Author	SHA1	Message	Date
Greg Kroah-Hartman	acebb4758a	Merge 5.4.245 into android11-5.4-lts ... Changes in 5.4.245 cdc_ncm: Implement the 32-bit version of NCM Transfer Block net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize power: supply: bq27xxx: After charger plug in/out wait 0.5s for things to stabilize power: supply: core: Refactor power_supply_set_input_current_limit_from_supplier() power: supply: bq24190: Call power_supply_changed() after updating input current fs: fix undefined behavior in bit shift for SB_NOUSER net/mlx5: devcom only supports 2 ports net/mlx5: Devcom, serialize devcom registration cdc_ncm: Fix the build warning io_uring: always grab lock in io_cancel_async_work() io_uring: don't drop completion lock before timer is fully initialized io_uring: have io_kill_timeout() honor the request references bluetooth: Add cmd validity checks at the start of hci_sock_ioctl() binder: fix UAF caused by faulty buffer cleanup ipv{4,6}/raw: fix output xfrm lookup wrt protocol netfilter: ctnetlink: Support offloaded conntrack entry deletion Linux 5.4.245 Change-Id: I25e786ed304f80b6ccb3896a8b8d2f16384f0cd6 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-06-20 16:54:26 +00:00
Greg Kroah-Hartman	fb4bb5a5f3	This is the 5.4.244 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmR14ZEACgkQONu9yGCS aT41Mw/+NyTg/nNT37u5X7l6TeoWkJTTpxJTFM+EIL0L/LZ8d+fPwvXRuSEfUH8X 7yLBaepbuGdtyMMCmJofxlNwMrx9L9M1xK03s9DnKGxVlkFZbJth/8L2FD/R939z 7IP06/uYL/YI8ZjJSSEf6bOLqvy0BdqSLRpn9NKK9eChK0aIVQ03TIrS1NarAzuQ lMD5CwaFqZCz8NaGfdpg01JDfMuvKdCD8dCkYE+bO9U/nQRr1dmKvHNsQMpecDte F/YXfbcv3CIh7vwfdw8UOFzwhyZWjWHsSWi0wRK8ZGy1ckDr3lZFgYj+jr0K/CWu mMRiEXUIphqwCb7mdi5doWyLD9ZFyU8Jx249vqWBeuL4Hb+74vqJVf1wKT0wOE8c F6LyxXkc7lfNIIWojn4MyvxtIu4SPo/NsTd9Qxz7kj4SZHmAJNJihFIEezMUB8Wr 7VZP8o75PJ4Kx0aKkFY2IyZuC/GJa7VD+9AnCyB93eWfkufzMV/1fdOR3WEukpOg cqRl2xRcQiRu7I1jkn09Ir6yHjR5zZ12QHT/MNZiapaXmnG/IwHGopkQKUlM3Cwz rbAg7gLb89mjHbbFq8TO1W7JIelLuejAk/P8tO1Uf9VEa/c0E0I7Q434posf0/Yk XJdV2V+meOG6qyGkW35yUgentd5+bcSxyaA9D1IarA0EC11UFjU= =hQuZ -----END PGP SIGNATURE----- Merge 5.4.244 into android11-5.4-lts Changes in 5.4.244 driver core: add a helper to setup both the of_node and fwnode of a device drm/mipi-dsi: Set the fwnode for mipi_dsi_device ARM: 9296/1: HP Jornada 7XX: fix kernel-doc warnings linux/dim: Do nothing if no time delta between samples net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs(). netfilter: conntrack: fix possible bug_on with enable_hooks=1 netlink: annotate accesses to nlk->cb_running net: annotate sk->sk_err write from do_recvmmsg() net: tap: check vlan with eth_type_vlan() method net: add vlan_get_protocol_and_depth() helper ipvlan:Fix out-of-bounds caused by unclear skb->cb net: datagram: fix data-races in datagram_poll() af_unix: Fix a data race of sk->sk_receive_queue->qlen. af_unix: Fix data races around sk->sk_shutdown. fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode() drm/amd/display: Use DC_LOG_DC in the trasform pixel function regmap: cache: Return error in cache sync operations for REGCACHE_NONE memstick: r592: Fix UAF bug in r592_remove due to race condition firmware: arm_sdei: Fix sleep from invalid context BUG ACPI: EC: Fix oops when removing custom query handlers drm/tegra: Avoid potential 32-bit integer overflow ACPICA: Avoid undefined behavior: applying zero offset to null pointer ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex ext2: Check block size validity during mount scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow net: pasemi: Fix return type of pasemi_mac_start_tx() net: Catch invalid index in XPS mapping scsi: target: iscsit: Free cmds before session free lib: cpu_rmap: Avoid use after free on rmap->obj array entries scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race condition gfs2: Fix inode height consistency check ext4: set goal start correctly in ext4_mb_normalize_request ext4: Fix best extent lstart adjustment logic in ext4_mb_new_inode_pa() f2fs: fix to drop all dirty pages during umount() if cp_error is set samples/bpf: Fix fout leak in hbm's run_bpf_prog wifi: iwlwifi: pcie: fix possible NULL pointer dereference wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE HID: logitech-hidpp: Don't use the USB serial for USB devices HID: logitech-hidpp: Reconcile USB and Unifying serials spi: spi-imx: fix MX51_ECSPI_* macros when cs > 3 HID: wacom: generic: Set battery quirk only when we see battery data usb: typec: tcpm: fix multiple times discover svids error serial: 8250: Reinit port->pm on port specific driver unbind mcb-pci: Reallocate memory region to avoid memory overlapping sched: Fix KCSAN noinstr violation recordmcount: Fix memory leaks in the uwrite function RDMA/core: Fix multiple -Warray-bounds warnings clk: tegra20: fix gcc-7 constant overflow warning iommu/arm-smmu-v3: Acknowledge pri/event queue overflow if any Input: xpad - add constants for GIP interface numbers phy: st: miphy28lp: use _poll_timeout functions for waits mfd: dln2: Fix memory leak in dln2_probe() btrfs: replace calls to btrfs_find_free_ino with btrfs_find_free_objectid btrfs: fix space cache inconsistency after error loading it from disk ASoC: fsl_micfil: register platform component before registering cpu dai cpupower: Make TSC read per CPU for Mperf monitor af_key: Reject optional tunnel/BEET mode templates in outbound policies net: fec: Better handle pm_runtime_get() failing in .remove() ALSA: firewire-digi00x: prevent potential use after free vsock: avoid to close connected socket after the timeout serial: arc_uart: fix of_iomap leak in `arc_serial_probe` ip6_gre: Fix skb_under_panic in __gre6_xmit() ip6_gre: Make o_seqno start from 0 in native mode ip_gre, ip6_gre: Fix race condition on o_seqno in collect_md mode erspan: get the proto with the md version for collect_md net: hns3: fix sending pfc frames after reset issue net: hns3: fix reset delay time to avoid configuration timeout media: netup_unidvb: fix use-after-free at del_timer() drm/exynos: fix g2d_open/close helper function definitions net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop() net: bcmgenet: Restore phy_stop() depending upon suspend/close wifi: iwlwifi: mvm: don't trust firmware n_channels cassini: Fix a memory leak in the error handling path of cas_init_one() igb: fix bit_shift to be in [1..8] range vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit() USB: usbtmc: Fix direction for 0-length ioctl control messages usb-storage: fix deadlock when a scsi command timeouts more than once USB: UHCI: adjust zhaoxin UHCI controllers OverCurrent bit value usb: dwc3: debugfs: Resume dwc3 before accessing registers usb: typec: altmodes/displayport: fix pin_assignment_show ALSA: hda: Fix Oops by 9.1 surround channel names ALSA: hda: Add NVIDIA codec IDs a3 through a7 to patch table ALSA: hda/realtek: Add a quirk for HP EliteDesk 805 ALSA: hda/realtek: Add quirk for 2nd ASUS GU603 can: j1939: recvmsg(): allow MSG_CMSG_COMPAT flag can: kvaser_pciefd: Set CAN_STATE_STOPPED in kvaser_pciefd_stop() can: kvaser_pciefd: Call request_irq() before enabling interrupts can: kvaser_pciefd: Empty SRB buffer in probe can: kvaser_pciefd: Clear listen-only bit if not explicitly requested can: kvaser_pciefd: Do not send EFLUSH command on TFD interrupt can: kvaser_pciefd: Disable interrupts in probe error path KVM: x86: do not report a vCPU as preempted outside instruction boundaries statfs: enforce statfs[64] structure initialization serial: Add support for Advantech PCI-1611U card ceph: force updating the msg pointer in non-split case tpm/tpm_tis: Disable interrupts for more Lenovo devices powerpc/64s/radix: Fix soft dirty tracking nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode() netfilter: nftables: add nft_parse_register_load() and use it netfilter: nftables: add nft_parse_register_store() and use it netfilter: nftables: statify nft_parse_register() netfilter: nf_tables: validate registers coming from userspace. netfilter: nf_tables: add nft_setelem_parse_key() netfilter: nf_tables: allow up to 64 bytes in the set element data area netfilter: nf_tables: stricter validation of element data netfilter: nf_tables: validate NFTA_SET_ELEM_OBJREF based on NFT_SET_OBJECT flag netfilter: nf_tables: hold mutex on netns pre_exit path HID: wacom: Force pen out of prox if no events have been received in a while HID: wacom: Add new Intuos Pro Small (PTH-460) device IDs HID: wacom: add three styli to wacom_intuos_get_tool_type lib/string_helpers: Introduce string_upper() and string_lower() helpers usb: gadget: u_ether: Convert prints to device prints usb: gadget: u_ether: Fix host MAC address case vc_screen: rewrite vcs_size to accept vc, not inode vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF s390/qdio: get rid of register asm s390/qdio: fix do_sqbs() inline assembly constraint watchdog: sp5100_tco: Immediately trigger upon starting. spi: fsl-spi: Re-organise transfer bits_per_word adaptation spi: fsl-cpm: Use 16 bit mode for large transfers with even size mt76: mt7615: Fix build with older compilers ALSA: hda/ca0132: add quirk for EVGA X299 DARK ALSA: hda/realtek: Enable headset onLenovo M70/M90 m68k: Move signal frame following exception on 68020/030 parisc: Handle kgdb breakpoints only in kernel context parisc: Allow to reboot machine after system halt gpio: mockup: Fix mode of debugfs files btrfs: use nofs when cleaning up aborted transactions x86/mm: Avoid incomplete Global INVLPG flushes selftests/memfd: Fix unknown type name build failure parisc: Fix flush_dcache_page() for usage from irq context x86/topology: Fix erroneous smp_num_siblings on Intel Hybrid platforms debugobjects: Don't wake up kswapd from fill_pool() fbdev: udlfb: Fix endpoint check net: fix stack overflow when LRO is disabled for virtual interfaces udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated(). USB: core: Add routines for endpoint checks in old drivers USB: sisusbvga: Add endpoint checks media: radio-shark: Add endpoint checks net: fix skb leak in __skb_tstamp_tx() selftests: fib_tests: mute cleanup error message bpf: Fix mask generation for 32-bit narrow loads of 64-bit fields ipv6: Fix out-of-bounds access in ipv6_find_tlv() power: supply: leds: Fix blink to LED on transition power: supply: bq27xxx: Fix bq27xxx_battery_update() race condition power: supply: bq27xxx: Fix I2C IRQ race on remove power: supply: bq27xxx: Fix poll_interval handling and races on remove power: supply: sbs-charger: Fix INHIBITED bit for Status reg coresight: Fix signedness bug in tmc_etr_buf_insert_barrier_packet() xen/pvcalls-back: fix double frees with pvcalls_new_active_socket() x86/show_trace_log_lvl: Ensure stack pointer is aligned, again ASoC: Intel: Skylake: Fix declaration of enum skl_ch_cfg forcedeth: Fix an error handling path in nv_probe() net/mlx5: Fix error message when failing to allocate device memory net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device 3c589_cs: Fix an error handling path in tc589_probe() Linux 5.4.244 Change-Id: I056fbc6363372dca786e64c8b6649768e49ee2ed Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-06-20 11:07:18 +00:00
Greg Kroah-Hartman	2bd517d6bc	Revert "uapi/linux/const.h: prefer ISO-friendly __typeof__" ... This reverts commit e1431faa89 which is commit 31088f6f7906253ef4577f6a9b84e2d42447dba0 upstream. It breaks the CRC generation of loads of symbols, and is not needed at all for any real Android issue at this point in time, so revert it to preserve the ABI. Bug: 161946584 Change-Id: I93095fb07b431a194e21bb21d4cd22435445dca3 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-06-15 10:57:59 +00:00
Greg Kroah-Hartman	88ac2d9193	This is the 5.4.243 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmRkoEsACgkQONu9yGCS aT6nbBAAxLX8QMuKuA8fcSFqQTZwrGAW/x7aOih1Sgkw/pttE8t8/q9sxlPZHljK UnZWzy/xjBayWA4aEskkd8pvZh7uXqcQH56UuiuzTiZwNtKQfAlvbVjsibzOk8mt leuNP1F/Kod7CFYi/o8yoo4tUrWPmNLgc5ZaAvR/FYapanpYLB/6I9u2mf8HPjRP tF1PwYPl9V7NdiAx5Liw6mczBI+v05FY7+G2tsUrnE/XM3SFOg8mwKNTksBeiZ8a vZxCwQgTohUR2yKMjSrsKnZ2sQAoskOlpc8YpdwSk2s7KZKf+QcI6Y2BhneK/A7+ BU9vQr8Y0qrciBrpZvBGLcBhcmXUQwgZBh4VKUwJCUWijSQRSjhs/3+rAyvj74rF w8hP6EDgyAb5fKSU//MAZiFqdQfzowGne2Uin/rgyhyK9l+zxRCRtY1Ra+T75Jvl 2MNU+VwvfRzzGJtP4BiuA2qoHsTqmLK2SUUrqmhyRm2D3cK17NuIJeGMwt3BXDzw g+FpXoVGmkmfl+HHQLWdqpJ654APpJgxjhK6Hjca5608V+FIW7FGScAWX2CRmpUK rTAUPloptXIuo41CI+z7hdmYSfFtJymOgd650p5ntmro+7tMRQkhhjnEDDF8y1Jr 703VIa3QkRWRE5/xGi2KM2GgEH81j0s2Nyo/7JQtiitOjqtpgJ4= =SrzM -----END PGP SIGNATURE----- Merge 5.4.243 into android11-5.4-lts Changes in 5.4.243 counter: 104-quad-8: Fix race condition between FLAG and CNTR reads wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() drm/fb-helper: set x/yres_virtual in drm_fb_helper_check_var bluetooth: Perform careful capability checks in hci_sock_ioctl() USB: serial: option: add UNISOC vendor and TOZED LT70C product iio: adc: palmas_gpadc: fix NULL dereference on rmmod ASoC: Intel: bytcr_rt5640: Add quirk for the Acer Iconia One 7 B1-750 asm-generic/io.h: suppress endianness warnings for readq() and writeq() USB: dwc3: fix runtime pm imbalance on probe errors USB: dwc3: fix runtime pm imbalance on unbind perf sched: Cast PTHREAD_STACK_MIN to int as it may turn into sysconf(__SC_THREAD_STACK_MIN_VALUE) staging: iio: resolver: ads1210: fix config mode debugfs: regset32: Add Runtime PM support xhci: fix debugfs register accesses while suspended MIPS: fw: Allow firmware to pass a empty env ipmi:ssif: Add send_retries increment ipmi: fix SSIF not responding under certain cond. kheaders: Use array declaration instead of char pwm: meson: Fix axg ao mux parents pwm: meson: Fix g12a ao clk81 name ring-buffer: Sync IRQ works before buffer destruction reiserfs: Add security prefix to xattr name in reiserfs_security_write() KVM: nVMX: Emulate NOPs in L2, and PAUSE if it's not intercepted i2c: omap: Fix standard mode false ACK readings Revert "ubifs: dirty_cow_znode: Fix memleak in error handling path" ubifs: Fix memleak when insert_old_idx() failed ubi: Fix return value overwrite issue in try_write_vid_and_data() ubifs: Free memory for tmpfile name selinux: fix Makefile dependencies of flask.h selinux: ensure av_permissions.h is built when needed tpm, tpm_tis: Do not skip reset of original interrupt vector erofs: stop parsing non-compact HEAD index if clusterofs is invalid erofs: fix potential overflow calculating xattr_isize drm/rockchip: Drop unbalanced obj unref drm/vgem: add missing mutex_destroy drm/probe-helper: Cancel previous job before starting new one arm64: dts: renesas: r8a77990: Remove bogus voltages from OPP table arm64: dts: renesas: r8a774c0: Remove bogus voltages from OPP table EDAC/skx: Fix overflows on the DRAM row address mapping arrays ARM: dts: qcom: ipq4019: Fix the PCI I/O port range ARM: dts: qcom: ipq8064: reduce pci IO size to 64K ARM: dts: qcom: ipq8064: Fix the PCI I/O port range media: bdisp: Add missing check for create_workqueue media: uapi: add MEDIA_BUS_FMT_METADATA_FIXED media bus format. media: av7110: prevent underflow in write_ts_to_decoder() firmware: qcom_scm: Clear download bit during reboot drm/msm: fix unbalanced pm_runtime_enable in adreno_gpu_{init, cleanup} drm/msm/adreno: Defer enabling runpm until hw_init() drm/msm/adreno: drop bogus pm_runtime_set_active() mmc: sdhci-of-esdhc: fix quirk to ignore command inhibit for data drm/lima/lima_drv: Add missing unwind goto in lima_pdev_probe() regulator: core: Consistently set mutex_owner when using ww_mutex_lock_slow() regulator: core: Avoid lockdep reports when resolving supplies x86/apic: Fix atomic update of offset in reserve_eilvt_offset() media: dm1105: Fix use after free bug in dm1105_remove due to race condition media: saa7134: fix use after free bug in saa7134_finidev due to race condition media: rcar_fdp1: simplify error check logic at fdp_open() media: rcar_fdp1: fix pm_runtime_get_sync() usage count media: rcar_fdp1: Make use of the helper function devm_platform_ioremap_resource() media: rcar_fdp1: Fix the correct variable assignments media: rcar_fdp1: Fix refcount leak in probe and remove function media: rc: gpio-ir-recv: Fix support for wake-up regulator: stm32-pwr: fix of_iomap leak x86/ioapic: Don't return 0 from arch_dynirq_lower_bound() arm64: kgdb: Set PSTATE.SS to 1 to re-enable single-step debugobject: Prevent init race with static objects timekeeping: Split jiffies seqlock tick/sched: Use tick_next_period for lockless quick check tick/sched: Reduce seqcount held scope in tick_do_update_jiffies64() tick/sched: Optimize tick_do_update_jiffies64() further tick: Get rid of tick_period tick/common: Align tick period with the HZ tick. wifi: ath6kl: minor fix for allocation size wifi: ath9k: hif_usb: fix memory leak of remain_skbs wifi: ath5k: fix an off by one check in ath5k_eeprom_read_freq_list() wifi: ath6kl: reduce WARN to dev_dbg() in callback tools: bpftool: Remove invalid \' json escape wifi: rtw88: mac: Return the original error from rtw_pwr_seq_parser() wifi: rtw88: mac: Return the original error from rtw_mac_power_switch() scm: fix MSG_CTRUNC setting condition for SO_PASSSEC vlan: partially enable SIOCSHWTSTAMP in container net/packet: annotate accesses to po->xmit net/packet: convert po->origdev to an atomic flag net/packet: convert po->auxdata to an atomic flag scsi: target: iscsit: Fix TAS handling during conn cleanup scsi: megaraid: Fix mega_cmd_done() CMDID_INT_CMDS f2fs: handle dqget error in f2fs_transfer_project_quota() rtlwifi: Start changing RT_TRACE into rtl_dbg rtlwifi: Replace RT_TRACE with rtl_dbg wifi: rtlwifi: fix incorrect error codes in rtl_debugfs_set_write_rfreg() wifi: rtlwifi: fix incorrect error codes in rtl_debugfs_set_write_reg() bpftool: Fix bug for long instructions in program CFG dumps crypto: drbg - make drbg_prepare_hrng() handle jent instantiation errors crypto: drbg - Only fail when jent is unavailable in FIPS mode scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup() bpf, sockmap: fix deadlocks in the sockhash and sockmap nvme: handle the persistent internal error AER nvme: fix async event trace event nvme-fcloop: fix "inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage" bpf, sockmap: Revert buggy deadlock fix in the sockhash and sockmap md/raid10: fix leak of 'r10bio->remaining' for recovery md/raid10: fix memleak for 'conf->bio_split' md: update the optimal I/O size on reshape md/raid10: fix memleak of md thread wifi: iwlwifi: make the loop for card preparation effective wifi: iwlwifi: mvm: check firmware response size ixgbe: Allow flow hash to be set via ethtool ixgbe: Enable setting RSS table to default values bpf: Don't EFAULT for getsockopt with optval=NULL netfilter: nf_tables: don't write table validation state without mutex ipv4: Fix potential uninit variable access bug in __ip_make_skb() Revert "Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work" netlink: Use copy_to_user() for optval in netlink_getsockopt(). net: amd: Fix link leak when verifying config failed tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp. pstore: Revert pmsg_lock back to a normal mutex usb: host: xhci-rcar: remove leftover quirk handling fpga: bridge: fix kernel-doc parameter description iio: light: max44009: add missing OF device matching usb: gadget: udc: renesas_usb3: Fix use after free bug in renesas_usb3_remove due to race condition PCI: imx6: Install the fault handler only on compatible match genirq: Add IRQF_NO_AUTOEN for request_irq/nmi() ASoC: es8316: Use IRQF_NO_AUTOEN when requesting the IRQ ASoC: es8316: Handle optional IRQ assignment linux/vt_buffer.h: allow either builtin or modular for macros spi: qup: Don't skip cleanup in remove's error path spi: fsl-spi: Fix CPM/QE mode Litte Endian vmci_host: fix a race condition in vmci_host_poll() causing GPF of: Fix modalias string generation ia64: mm/contig: fix section mismatch warning/error ia64: salinfo: placate defined-but-not-used warning scripts/gdb: bail early if there are no clocks PM: domains: Fix up terminology with parent/child scripts/gdb: bail early if there are no generic PD mtd: spi-nor: cadence-quadspi: Make driver independent of flash geometry mtd: spi-nor: cadence-quadspi: Provide a way to disable DAC mode mtd: spi-nor: cadence-quadspi: Don't initialize rx_dma_complete on failure mtd: spi-nor: cadence-quadspi: Handle probe deferral while requesting DMA channel spi: cadence-quadspi: fix suspend-resume implementations uapi/linux/const.h: prefer ISO-friendly __typeof__ sh: sq: Fix incorrect element size for allocating bitmap buffer usb: chipidea: fix missing goto in `ci_hdrc_probe` usb: mtu3: fix kernel panic at qmu transfer done irq handler firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe tty: serial: fsl_lpuart: adjust buffer length to the intended size serial: 8250: Add missing wakeup event reporting staging: rtl8192e: Fix W_DISABLE# does not work after stop/start spmi: Add a check for remove callback when removing a SPMI driver macintosh/windfarm_smu_sat: Add missing of_node_put() powerpc/mpc512x: fix resource printk format warning powerpc/wii: fix resource printk format warnings powerpc/sysdev/tsi108: fix resource printk format warnings macintosh: via-pmu-led: requires ATA to be set powerpc/rtas: use memmove for potentially overlapping buffer copy perf/core: Fix hardlockup failure caused by perf throttle RDMA/siw: Fix potential page_array out of range access RDMA/rdmavt: Delete unnecessary NULL check rtc: omap: include header for omap_rtc_power_off_program prototype RDMA/mlx4: Prevent shift wrapping in set_user_sq_size() rtc: meson-vrtc: Use ktime_get_real_ts64() to get the current time power: supply: generic-adc-battery: fix unit scaling clk: add missing of_node_put() in "assigned-clocks" property parsing RDMA/siw: Remove namespace check from siw_netdev_event() IB/hfi1: Fix SDMA mmu_rb_node not being evicted in LRU order NFSv4.1: Always send a RECLAIM_COMPLETE after establishing lease firmware: raspberrypi: Keep count of all consumers firmware: raspberrypi: Introduce devm_rpi_firmware_get() input: raspberrypi-ts: Release firmware handle when not needed Input: raspberrypi-ts - fix refcount leak in rpi_ts_probe SUNRPC: remove the maximum number of retries in call_bind_status RDMA/mlx5: Use correct device num_ports when modify DC clocksource/drivers/davinci: Avoid trailing '\n' hidden in pr_fmt() clocksource: davinci: axe a pointless __GFP_NOFAIL clocksource/drivers/davinci: Fix memory leak in davinci_timer_register when init fails openrisc: Properly store r31 to pt_regs on unhandled exceptions ext4: fix use-after-free read in ext4_find_extent for bigalloc + inline leds: TI_LMU_COMMON: select REGMAP instead of depending on it dmaengine: mv_xor_v2: Fix an error code. pwm: mtk-disp: Don't check the return code of pwmchip_remove() pwm: mtk-disp: Adjust the clocks to avoid them mismatch pwm: mtk-disp: Disable shadow registers before setting backlight values phy: tegra: xusb: Add missing tegra_xusb_port_unregister for usb2_port and ulpi_port dmaengine: dw-edma: Fix to change for continuous transfer dmaengine: dw-edma: Fix to enable to issue dma request on DMA processing dmaengine: at_xdmac: do not enable all cyclic channels afs: Fix updating of i_size with dv jump from server parisc: Fix argument pointer in real64_call_asm() nilfs2: do not write dirty data after degenerating to read-only nilfs2: fix infinite loop in nilfs_mdt_get_block() md/raid10: fix null-ptr-deref in raid10_sync_request mailbox: zynqmp: Fix IPI isr handling mailbox: zynqmp: Fix typo in IPI documentation wifi: rtl8xxxu: RTL8192EU always needs full init clk: rockchip: rk3399: allow clk_cifout to force clk_cifout_src to reparent scripts/gdb: fix lx-timerlist for Python3 btrfs: scrub: reject unsupported scrub flags s390/dasd: fix hanging blockdevice after request requeue dm clone: call kmem_cache_destroy() in dm_clone_init() error path dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path dm flakey: fix a crash with invalid table line dm ioctl: fix nested locking in table_clear() to remove deadlock concern perf auxtrace: Fix address filter entire kernel size perf intel-pt: Fix CYC timestamps after standalone CBR debugobject: Ensure pool refill (again) netfilter: nf_tables: deactivate anonymous set from preparation phase nohz: Add TICK_DEP_BIT_RCU tick/nohz: Fix cpu_is_hotpluggable() by checking with nohz subsystem mailbox: zynq: Switch to flexible array to simplify code mailbox: zynqmp: Fix counts of child nodes dm verity: skip redundant verity_handle_err() on I/O errors dm verity: fix error handling for check_at_most_once on FEC crypto: inside-secure - irq balance crypto: safexcel - Cleanup ring IRQ workqueues on load failure kernel/relay.c: fix read_pos error when multiple readers relayfs: fix out-of-bounds access in relay_file_read net/ncsi: clear Tx enable mode when handling a Config required AEN net/sched: cls_api: remove block_cb from driver_list before freeing sit: update dev->needed_headroom in ipip6_tunnel_bind_dev() net: dsa: mv88e6xxx: add mv88e6321 rsvd2cpu writeback: fix call of incorrect macro net/sched: act_mirred: Add carrier check rxrpc: Fix hard call timeout units ionic: remove noise from ethtool rxnfc error msg af_packet: Don't send zero-byte data in packet_sendmsg_spkt(). drm/amdgpu: add a missing lock for AMDGPU_SCHED ALSA: caiaq: input: Add error handling for unsupported input methods in `snd_usb_caiaq_input_init` net: dsa: mt7530: fix corrupt frames using trgmii on 40 MHz XTAL MT7621 virtio_net: split free_unused_bufs() virtio_net: suppress cpu stall when free_unused_bufs perf vendor events power9: Remove UTF-8 characters from JSON files perf map: Delete two variable initialisations before null pointer checks in sort__sym_from_cmp() perf symbols: Fix return incorrect build_id size in elf_read_build_id() btrfs: fix btrfs_prev_leaf() to not return the same key twice btrfs: don't free qgroup space unless specified btrfs: print-tree: parent bytenr must be aligned to sector size cifs: fix pcchunk length type in smb2_copychunk_range platform/x86: touchscreen_dmi: Add info for the Dexp Ursus KX210i inotify: Avoid reporting event with invalid wd sh: math-emu: fix macro redefined warning sh: init: use OF_EARLY_FLATTREE for early init sh: nmi_debug: fix return value of __setup handler remoteproc: stm32: Call of_node_put() on iteration error remoteproc: st: Call of_node_put() on iteration error ARM: dts: exynos: fix WM8960 clock name in Itop Elite ARM: dts: s5pv210: correct MIPI CSIS clock name f2fs: fix potential corruption when moving a directory drm/panel: otm8009a: Set backlight parent to panel device drm/amdgpu: fix an amdgpu_irq_put() issue in gmc_v9_0_hw_fini() drm/amdgpu/gfx: disable gfx9 cp_ecc_error_irq only when enabling legacy gfx ras drm/amdgpu: disable sdma ecc irq only when sdma RAS is enabled in suspend HID: wacom: Set a default resolution for older tablets HID: wacom: insert timestamp to packed Bluetooth (BT) events ext4: fix WARNING in mb_find_extent ext4: avoid a potential slab-out-of-bounds in ext4_group_desc_csum ext4: fix data races when using cached status extents ext4: improve error recovery code paths in __ext4_remount() ext4: fix deadlock when converting an inline directory in nojournal mode ext4: add bounds checking in get_max_inline_xattr_value_size() ext4: bail out of ext4_xattr_ibody_get() fails for any reason ext4: remove a BUG_ON in ext4_mb_release_group_pa() ext4: fix invalid free tracking in ext4_xattr_move_to_block() tty: Prevent writing chars during tcsetattr TCSADRAIN/FLUSH serial: 8250: Fix serial8250_tx_empty() race with DMA Tx drbd: correctly submit flush bio on barrier PCI: pciehp: Use down_read/write_nested(reset_lock) to fix lockdep errors PCI: pciehp: Fix AB-BA deadlock between reset_lock and device_lock printk: declare printk_deferred_{enter,safe}() in include/linux/printk.h PM: domains: Restore comment indentation for generic_pm_domain.child_links drm/msm: Fix double pm_runtime_disable() call firmware: raspberrypi: fix possible memory leak in rpi_firmware_probe() drm/msm/adreno: Fix null ptr access in adreno_gpu_cleanup() drm/exynos: move to use request_irq by IRQF_NO_AUTOEN flag mm/page_alloc: fix potential deadlock on zonelist_update_seq seqlock drm/amd/display: Fix hang when skipping modeset Linux 5.4.243 Change-Id: I103e06e639a82ddc7ca60ffed98c898946b81542 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-06-15 10:57:33 +00:00
Nicolas Dichtel	5b7d4d91c0	ipv{4,6}/raw: fix output xfrm lookup wrt protocol ... commit 3632679d9e4f879f49949bb5b050e0de553e4739 upstream. With a raw socket bound to IPPROTO_RAW (ie with hdrincl enabled), the protocol field of the flow structure, build by raw_sendmsg() / rawv6_sendmsg()), is set to IPPROTO_RAW. This breaks the ipsec policy lookup when some policies are defined with a protocol in the selector. For ipv6, the sin6_port field from 'struct sockaddr_in6' could be used to specify the protocol. Just accept all values for IPPROTO_RAW socket. For ipv4, the sin_port field of 'struct sockaddr_in' could not be used without breaking backward compatibility (the value of this field was never checked). Let's add a new kind of control message, so that the userland could specify which protocol is used. Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") CC: stable@vger.kernel.org Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Link: https://lore.kernel.org/r/20230522120820.1319391-1-nicolas.dichtel@6wind.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-06-05 08:17:33 +02:00
Cezary Rojewski	b8db4a4e20	ASoC: Intel: Skylake: Fix declaration of enum skl_ch_cfg ... commit 95109657471311601b98e71f03d0244f48dc61bb upstream. Constant 'C4_CHANNEL' does not exist on the firmware side. Value 0xC is reserved for 'C7_1' instead. Fixes: 04afbbbb1c ("ASoC: Intel: Skylake: Update the topology interface structure") Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com> Signed-off-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com> Link: https://lore.kernel.org/r/20230519201711.4073845-4-amadeuszx.slawinski@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-05-30 12:44:10 +01:00
Qu Wenruo	5492d40812	btrfs: scrub: reject unsupported scrub flags ... commit 604e6681e114d05a2e384c4d1e8ef81918037ef5 upstream. Since the introduction of scrub interface, the only flag that we support is BTRFS_SCRUB_READONLY. Thus there is no sanity checks, if there are some undefined flags passed in, we just ignore them. This is problematic if we want to introduce new scrub flags, as we have no way to determine if such flags are supported. Address the problem by introducing a check for the flags, and if unsupported flags are set, return -EOPNOTSUPP to inform the user space. This check should be backported for all supported kernels before any new scrub flags are introduced. CC: stable@vger.kernel.org # 4.14+ Reviewed-by: Anand Jain <anand.jain@oracle.com> Signed-off-by: Qu Wenruo <wqu@suse.com> Reviewed-by: David Sterba <dsterba@suse.com> Signed-off-by: David Sterba <dsterba@suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-05-17 11:35:55 +02:00
Kevin Brodsky	e1431faa89	uapi/linux/const.h: prefer ISO-friendly __typeof__ ... [ Upstream commit 31088f6f7906253ef4577f6a9b84e2d42447dba0 ] typeof is (still) a GNU extension, which means that it cannot be used when building ISO C (e.g. -std=c99). It should therefore be avoided in uapi headers in favour of the ISO-friendly __typeof__. Unfortunately this issue could not be detected by CONFIG_UAPI_HEADER_TEST=y as the __ALIGN_KERNEL() macro is not expanded in any uapi header. This matters from a userspace perspective, not a kernel one. uapi headers and their contents are expected to be usable in a variety of situations, and in particular when building ISO C applications (with -std=c99 or similar). This particular problem can be reproduced by trying to use the __ALIGN_KERNEL macro directly in application code, say: #include <linux/const.h> int align(int x, int a) { return __KERNEL_ALIGN(x, a); } and trying to build that with -std=c99. Link: https://lkml.kernel.org/r/20230411092747.3759032-1-kevin.brodsky@arm.com Fixes: a79ff731a1 ("netfilter: xtables: make XT_ALIGN() usable in exported headers by exporting __ALIGN_KERNEL()") Signed-off-by: Kevin Brodsky <kevin.brodsky@arm.com> Reported-by: Ruben Ayrapetyan <ruben.ayrapetyan@arm.com> Tested-by: Ruben Ayrapetyan <ruben.ayrapetyan@arm.com> Reviewed-by: Petr Vorel <pvorel@suse.cz> Tested-by: Petr Vorel <pvorel@suse.cz> Reviewed-by: Masahiro Yamada <masahiroy@kernel.org> Cc: Sam Ravnborg <sam@ravnborg.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-05-17 11:35:48 +02:00
Dafna Hirschfeld	1205c52cf2	media: uapi: add MEDIA_BUS_FMT_METADATA_FIXED media bus format. ... [ Upstream commit 6ad253cc3436269fc6bcff03d704c672f368da0a ] MEDIA_BUS_FMT_METADATA_FIXED should be used when the same driver handles both sides of the link and the bus format is a fixed metadata format that is not configurable from userspace. The width and height will be set to 0 for this format. Signed-off-by: Dafna Hirschfeld <dafna.hirschfeld@collabora.com> Acked-by: Helen Koike <helen.koike@collabora.com> Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Stable-dep-of: eed9496a0501 ("media: av7110: prevent underflow in write_ts_to_decoder()") Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-05-17 11:35:36 +02:00
Greg Kroah-Hartman	0d9d32f54c	This is the 5.4.235 stable release ... -----BEGIN PGP SIGNATURE----- iQIyBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmQModwACgkQONu9yGCS aT7W7A/1EyhortcaMdZXEkdl7kZYupASsOm2QgOzeRkK0ELtbYRTt1qXdZgl40hU binrh5Yib2avHTEAF9I6AKVXMirSUTtODe/zQ7icyxVNcXeanlIbobEVBzSWIBtC Wxj129KZyCQlucagWihngQ9D+66bvD5JCsJ3EHKJjpheSqmZI88KVnOSnvyoJArj yLDY21UgxRN4KASgB+tpLBT4x0yN9zk8VuCGpyJjO/nHzhj6Y6DkOcx2q7hAxdn+ H1OBCQ2QBCODCMrpW4xBuwy2blBZsRytUdEy8JsfxjgXvUp8+TdxUsuxb16a31jW pVo9LYB0cdKVoAzNJ2pTD8rhaATSbq+2MYDEUYCz8Rr+dZ/Nt2nTKSYeJprLsTwx TzPRNErQMKxKoQUQU/seWx47ebwt+Z8Rk4FAoyQMxRITw/9bBGLWpDKrGjNsByz9 A2Q9UU+uM+jyqZnjQMvkzKSznggwfJ+SgaeqDMjwyyCQysJS8DTXPr9nA+IC9cht Kz00QetNgvPvZPE/gg81XOcKtJVTmA4AITQ0PlxYJT0hHCHx02GxvdPH2XBspgUt aNbDgVsupq8ONvRZlEf9hJKltTUmIRvI9JSOXnuhaN2jCv88SNv1M0TKfAo0XDNK Z/prv3qCnugMZ0KB0TD7d09XqSlKbefOq8TdtbXoTcC0NzFQkw== =29jZ -----END PGP SIGNATURE----- Merge 5.4.235 into android11-5.4-lts Changes in 5.4.235 HID: asus: Remove check for same LED brightness on set HID: asus: use spinlock to protect concurrent accesses HID: asus: use spinlock to safely schedule workers ARM: OMAP2+: Fix memory leak in realtime_counter_init() arm64: dts: qcom: qcs404: use symbol names for PCIe resets ARM: zynq: Fix refcount leak in zynq_early_slcr_init arm64: dts: meson-gx: Fix Ethernet MAC address unit name arm64: dts: meson-g12a: Fix internal Ethernet PHY unit name arm64: dts: meson-gx: Fix the SCPI DVFS node name and unit address arm64: dts: meson: remove CPU opps below 1GHz for G12A boards ARM: OMAP1: call platform_device_put() in error case in omap1_dm_timer_init() ARM: dts: exynos: correct wr-active property in Exynos3250 Rinato ARM: imx: Call ida_simple_remove() for ida_simple_get arm64: dts: amlogic: meson-gx: fix SCPI clock dvfs node name arm64: dts: amlogic: meson-axg: fix SCPI clock dvfs node name arm64: dts: amlogic: meson-gx: add missing SCPI sensors compatible arm64: dts: amlogic: meson-gx: add missing unit address to rng node name arm64: dts: amlogic: meson-gxl: add missing unit address to eth-phy-mux node name arm64: dts: amlogic: meson-gxl-s905d-phicomm-n1: fix led node name ARM: dts: imx7s: correct iomuxc gpr mux controller cells arm64: dts: mediatek: mt7622: Add missing pwm-cells to pwm node Revert "scsi: core: run queue if SCSI device queue isn't ready and queue is idle" block: Limit number of items taken from the I/O scheduler in one go blk-mq: remove stale comment for blk_mq_sched_mark_restart_hctx blk-mq: wait on correct sbitmap_queue in blk_mq_mark_tag_wait blk-mq: correct stale comment of .get_budget s390/dasd: Prepare for additional path event handling s390/dasd: Fix potential memleak in dasd_eckd_init() sched/deadline,rt: Remove unused parameter from pick_next_[rt|dl]_entity() sched/rt: pick_next_rt_entity(): check list_entry block: bio-integrity: Copy flags when bio_integrity_payload is cloned wifi: rsi: Fix memory leak in rsi_coex_attach() net/wireless: Delete unnecessary checks before the macro call “dev_kfree_skb” wifi: iwlegacy: common: don't call dev_kfree_skb() under spin_lock_irqsave() wifi: libertas: fix memory leak in lbs_init_adapter() wifi: rtl8xxxu: don't call dev_kfree_skb() under spin_lock_irqsave() rtlwifi: fix -Wpointer-sign warning wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit() ipw2x00: switch from 'pci_' to 'dma_' API wifi: ipw2x00: don't call dev_kfree_skb() under spin_lock_irqsave() wifi: ipw2200: fix memory leak in ipw_wdev_init() wilc1000: let wilc_mac_xmit() return NETDEV_TX_OK wifi: wilc1000: fix potential memory leak in wilc_mac_xmit() wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit() wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid() wifi: libertas_tf: don't call kfree_skb() under spin_lock_irqsave() wifi: libertas: if_usb: don't call kfree_skb() under spin_lock_irqsave() wifi: libertas: main: don't call kfree_skb() under spin_lock_irqsave() wifi: libertas: cmdresp: don't call kfree_skb() under spin_lock_irqsave() wifi: wl3501_cs: don't call kfree_skb() under spin_lock_irqsave() crypto: x86/ghash - fix unaligned access in ghash_setkey() ACPICA: Drop port I/O validation for some regions genirq: Fix the return type of kstat_cpu_irqs_sum() lib/mpi: Fix buffer overrun when SG is too long ACPICA: nsrepair: handle cases without a return value correctly wifi: orinoco: check return value of hermes_write_wordrec() wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function ath9k: hif_usb: simplify if-if to if-else ath9k: htc: clean up statistics macros wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback() ACPI: battery: Fix missing NUL-termination with large strings crypto: ccp - Failure on re-initialization due to duplicate sysfs filename crypto: essiv - remove redundant null pointer check before kfree crypto: essiv - Handle EBUSY correctly crypto: seqiv - Handle EBUSY correctly powercap: fix possible name leak in powercap_register_zone() net/mlx5: Enhance debug print in page allocation failure irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe irqchip/ti-sci: Fix refcount leak in ti_sci_intr_irq_domain_probe mptcp: add sk_stop_timer_sync helper net: add sock_init_data_uid() tun: tun_chr_open(): correctly initialize socket uid tap: tap_open(): correctly initialize socket uid OPP: fix error checking in opp_migrate_dentry() Bluetooth: L2CAP: Fix potential user-after-free libbpf: Fix alen calculation in libbpf_nla_dump_errormsg() rds: rds_rm_zerocopy_callback() correct order for list_add_tail() crypto: rsa-pkcs1pad - Use akcipher_request_complete m68k: /proc/hardware should depend on PROC_FS RISC-V: time: initialize hrtimer based broadcast clock event device usb: gadget: udc: Avoid tasklet passing a global treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD() wifi: iwl3945: Add missing check for create_singlethread_workqueue wifi: iwl4965: Add missing check for create_singlethread_workqueue() wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize() crypto: crypto4xx - Call dma_unmap_page when done wifi: mac80211: make rate u32 in sta_set_rate_info_rx() thermal/drivers/hisi: Drop second sensor hi3660 can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits in case of a bus error irqchip/irq-brcmstb-l2: Set IRQ_LEVEL for level triggered interrupts irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts selftests/net: Interpret UDP_GRO cmsg data as an int value selftest: fib_tests: Always cleanup before exit drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC drm/bridge: megachips: Fix error handling in i2c_register_driver() drm/vc4: dpi: Add option for inverting pixel clock and output enable drm/vc4: dpi: Fix format mapping for RGB565 gpu: ipu-v3: common: Add of_node_put() for reference returned by of_graph_get_port_by_id() drm/msm/hdmi: Add missing check for alloc_ordered_workqueue pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain ASoC: fsl_sai: initialize is_dsp_mode flag ALSA: hda/ca0132: minor fix for allocation size drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness drm/msm: use strscpy instead of strncpy drm/msm/dpu: Add check for cstate drm/msm/dpu: Add check for pstates drm/exynos: Don't reset bridge->next drm/bridge: Rename bridge helpers targeting a bridge chain drm/bridge: Introduce drm_bridge_get_next_bridge() drm: Initialize struct drm_crtc_state.no_vblank from device settings drm/msm/mdp5: Add check for kzalloc gpu: host1x: Don't skip assigning syncpoints to channels drm/mediatek: remove cast to pointers passed to kfree drm/mediatek: Use NULL instead of 0 for NULL pointer drm/mediatek: Drop unbalanced obj unref drm/mediatek: Clean dangling pointer on bind error path ASoC: soc-compress.c: fixup private_data on snd_soc_new_compress() gpio: vf610: connect GPIO label to dev name hwmon: (ltc2945) Handle error case in ltc2945_value_store scsi: aic94xx: Add missing check for dma_map_single() spi: bcm63xx-hsspi: fix pm_runtime spi: bcm63xx-hsspi: Fix multi-bit mode setting hwmon: (mlxreg-fan) Return zero speed for broken fan dm: remove flush_scheduled_work() during local_exit() spi: synquacer: Fix timeout handling in synquacer_spi_transfer_one() ASoC: dapm: declare missing structure prototypes ASoC: soc-dapm.h: fixup warning struct snd_pcm_substream not declared HID: bigben: use spinlock to protect concurrent accesses HID: bigben_worker() remove unneeded check on report_field HID: bigben: use spinlock to safely schedule workers HID: asus: Only set EV_REP if we are adding a mapping HID: asus: Add report_size to struct asus_touchpad_info HID: asus: Add support for multi-touch touchpad on Medion Akoya E1239T HID: asus: Fix mute and touchpad-toggle keys on Medion Akoya E1239T hid: bigben_probe(): validate report count nfsd: fix race to check ls_layouts cifs: Fix lost destroy smbd connection when MR allocate failed cifs: Fix warning and UAF when destroy the MR list gfs2: jdata writepage fix perf llvm: Fix inadvertent file creation perf tools: Fix auto-complete on aarch64 sparc: allow PM configs for sparc32 COMPILE_TEST selftests/ftrace: Fix bash specific "==" operator mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read() clk: qcom: gcc-qcs404: disable gpll[04]_out_aux parents clk: qcom: gcc-qcs404: fix names of the DSI clocks used as parents mtd: rawnand: sunxi: Fix the size of the last OOB region clk: renesas: cpg-mssr: Fix use after free if cpg_mssr_common_init() failed clk: renesas: cpg-mssr: Use enum clk_reg_layout instead of a boolean flag clk: renesas: cpg-mssr: Remove superfluous check in resume code Input: ads7846 - don't report pressure for ads7845 Input: ads7846 - don't check penirq immediately for 7845 clk: qcom: gpucc-sdm845: fix clk_dis_wait being programmed for CX GDSC powerpc/powernv/ioda: Skip unallocated resources when mapping to PE clk: Honor CLK_OPS_PARENT_ENABLE in clk_core_is_enabled() powerpc/pseries/lpar: add missing RTAS retry status handling powerpc/pseries/lparcfg: add missing RTAS retry status handling powerpc/rtas: make all exports GPL powerpc/rtas: ensure 4KB alignment for rtas_data_buf powerpc/eeh: Small refactor of eeh_handle_normal_event() powerpc/eeh: Set channel state after notifying the drivers MIPS: SMP-CPS: fix build error when HOTPLUG_CPU not set MIPS: vpe-mt: drop physical_memsize remoteproc: qcom_q6v5_mss: Use a carveout to authenticate modem headers media: platform: ti: Add missing check for devm_regulator_get powerpc: Remove linker flag from KBUILD_AFLAGS media: ov5675: Fix memleak in ov5675_init_controls() media: i2c: ov772x: Fix memleak in ov772x_probe() media: rc: Fix use-after-free bugs caused by ene_tx_irqsim() media: i2c: ov7670: 0 instead of -EINVAL was returned media: usb: siano: Fix use after free bugs caused by do_submit_urb rpmsg: glink: Avoid infinite loop on intent for missing channel udf: Define EFSCORRUPTED error code ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy blk-iocost: fix divide by 0 error in calc_lcoefs() wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() rcu: Suppress smp_processor_id() complaint in synchronize_rcu_expedited_wait() thermal: intel: Fix unsigned comparison with less than zero timers: Prevent union confusion from unexpected restart_syscall() x86/bugs: Reset speculation control settings on init wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds wifi: mt7601u: fix an integer underflow inet: fix fast path in __inet_hash_connect() ice: add missing checks for PF vsi type ACPI: Don't build ACPICA with '-Os' net: bcmgenet: Add a check for oversized packets m68k: Check syscall_trace_enter() return code wifi: mt76: dma: free rx_head in mt76_dma_rx_cleanup ACPI: video: Fix Lenovo Ideapad Z570 DMI match net/mlx5: fw_tracer: Fix debug print coda: Avoid partial allocation of sig_inputArgs uaccess: Add minimum bounds check on kernel buffer size drm/amd/display: Fix potential null-deref in dm_resume drm/omap: dsi: Fix excessive stack usage HID: Add Mapping for System Microphone Mute drm/radeon: free iio for atombios when driver shutdown drm/msm/dsi: Add missing check for alloc_ordered_workqueue docs/scripts/gdb: add necessary make scripts_gdb step ASoC: kirkwood: Iterate over array indexes instead of using pointer math regulator: max77802: Bounds check regulator id against opmode regulator: s5m8767: Bounds check id indexing into arrays hwmon: (coretemp) Simplify platform device handling pinctrl: at91: use devm_kasprintf() to avoid potential leaks drm: panel-orientation-quirks: Add quirk for Lenovo IdeaPad Duet 3 10IGL5 dm thin: add cond_resched() to various workqueue loops dm cache: add cond_resched() to various workqueue loops nfsd: zero out pointers after putting nfsd_files on COPY setup error wifi: rtl8xxxu: fixing transmisison failure for rtl8192eu firmware: coreboot: framebuffer: Ignore reserved pixel color bits rtc: pm8xxx: fix set-alarm race ipmi_ssif: Rename idle state and check s390: discard .interp section s390/kprobes: fix irq mask clobbering on kprobe reenter from post_handler s390/kprobes: fix current_kprobe never cleared after kprobes reenter ARM: dts: exynos: correct HDMI phy compatible in Exynos4 hfs: fix missing hfs_bnode_get() in __hfs_bnode_create fs: hfsplus: fix UAF issue in hfsplus_put_super f2fs: fix information leak in f2fs_move_inline_dirents() f2fs: fix cgroup writeback accounting with fs-layer encryption ocfs2: fix defrag path triggering jbd2 ASSERT ocfs2: fix non-auto defrag path not working issue udf: Truncate added extents on failed expansion udf: Do not bother merging very long extents udf: Do not update file length for failed writes to inline files udf: Preserve link count of system files udf: Detect system inodes linked into directory hierarchy udf: Fix file corruption when appending just after end of preallocated extent KVM: Destroy target device if coalesced MMIO unregistration fails KVM: s390: disable migration mode when dirty tracking is disabled x86/virt: Force GIF=1 prior to disabling SVM (for reboot flows) x86/crash: Disable virt in core NMI crash handler to avoid double shootdown x86/reboot: Disable virtualization in an emergency if SVM is supported x86/reboot: Disable SVM, not just VMX, when stopping CPUs x86/kprobes: Fix __recover_optprobed_insn check optimizing logic x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe range x86/microcode/amd: Remove load_microcode_amd()'s bsp parameter x86/microcode/AMD: Add a @cpu parameter to the reloading functions x86/microcode/AMD: Fix mixed steppings support x86/speculation: Allow enabling STIBP with legacy IBRS Documentation/hw-vuln: Document the interaction between IBRS and STIBP ima: Align ima_file_mmap() parameters with mmap_file LSM hook irqdomain: Fix association race irqdomain: Fix disassociation race irqdomain: Drop bogus fwspec-mapping error handling ALSA: ice1712: Do not left ice->gpio_mutex locked in aureon_add_controls() ALSA: hda/realtek: Add quirk for HP EliteDesk 800 G6 Tower PC ext4: optimize ea_inode block expansion ext4: refuse to create ea block when umounted wifi: rtl8xxxu: Use a longer retry limit of 48 wifi: cfg80211: Fix use after free for wext thermal: intel: powerclamp: Fix cur_state for multi package system dm flakey: fix logic when corrupting a bio dm flakey: don't corrupt the zero page ARM: dts: exynos: correct TMU phandle in Exynos4 ARM: dts: exynos: correct TMU phandle in Odroid XU rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails alpha: fix FEN fault handling mips: fix syscall_get_nr media: ipu3-cio2: Fix PM runtime usage_count in driver unbind mm: memcontrol: deprecate charge moving mm/thp: check and bail out if page in deferred queue already ktest.pl: Give back console on Ctrt^C on monitor ktest.pl: Fix missing "end_monitor" when machine check fails ktest.pl: Add RUN_TIMEOUT option with default unlimited scsi: qla2xxx: Fix link failure in NPIV environment scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests scsi: qla2xxx: Fix erroneous link down scsi: ses: Don't attach if enclosure has no components scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses scsi: ses: Fix possible desc_ptr out-of-bounds accesses scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() PCI/PM: Observe reset delay irrespective of bridge_d3 PCI: hotplug: Allow marking devices as disconnected during bind/unbind PCI: Avoid FLR for AMD FCH AHCI adapters drm/i915/quirks: Add inverted backlight quirk for HP 14-r206nv drm/radeon: Fix eDP for single-display iMac11,2 wifi: ath9k: use proper statements in conditionals kbuild: Port silent mode detection to future gnu make. net/sched: Retire tcindex classifier fs/jfs: fix shift exponent db_agl2size negative pwm: sifive: Reduce time the controller lock is held pwm: sifive: Always let the first pwm_apply_state succeed pwm: stm32-lp: fix the check on arr and cmp registers update f2fs: use memcpy_{to,from}_page() where possible fs: f2fs: initialize fsdata in pagecache_write() um: vector: Fix memory leak in vector_config ubi: ensure that VID header offset + VID header size <= alloc, size ubifs: Fix build errors as symbol undefined ubifs: Rectify space budget for ubifs_symlink() if symlink is encrypted ubifs: Rectify space budget for ubifs_xrename() ubifs: Fix wrong dirty space budget for dirty inode ubifs: do_rename: Fix wrong space budget when target inode's nlink > 1 ubifs: Reserve one leb for each journal head while doing budget ubi: Fix use-after-free when volume resizing failed ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume() ubifs: Fix memory leak in alloc_wbufs() ubi: Fix possible null-ptr-deref in ubi_free_volume() ubifs: Re-statistic cleaned znode count if commit failed ubifs: dirty_cow_znode: Fix memleak in error handling path ubifs: ubifs_writepage: Mark page dirty after writing inode failed ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show() ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed x86: um: vdso: Add '%rcx' and '%r11' to the syscall clobber list watchdog: at91sam9_wdt: use devm_request_irq to avoid missing free_irq() in error path watchdog: Fix kmemleak in watchdog_cdev_register watchdog: pcwd_usb: Fix attempting to access uninitialized memory netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack() ipv6: Add lwtunnel encap size of all siblings in nexthop calculation sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop net: fix __dev_kfree_skb_any() vs drop monitor 9p/xen: fix version parsing 9p/xen: fix connection sequence 9p/rdma: unmap receive dma buffer in rdma_request()/post_recv() net/mlx5: Geneve, Fix handling of Geneve object id as error code nfc: fix memory leak of se_io context in nfc_genl_se_io net/sched: act_sample: fix action bind logic ARM: dts: spear320-hmi: correct STMPE GPIO compatible tcp: tcp_check_req() can be called from process context vc_screen: modify vcs_size() handling in vcs_read() rtc: sun6i: Make external 32k oscillator optional rtc: sun6i: Always export the internal oscillator scsi: ipr: Work around fortify-string warning thermal: intel: quark_dts: fix error pointer dereference thermal: intel: BXT_PMIC: select REGMAP instead of depending on it tracing: Add NULL checks for buffer in ring_buffer_free_read_page() firmware/efi sysfb_efi: Add quirk for Lenovo IdeaPad Duet 3 mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak media: uvcvideo: Handle cameras with invalid descriptors media: uvcvideo: Handle errors from calls to usb_string media: uvcvideo: Quirk for autosuspend in Logitech B910 and C910 media: uvcvideo: Silence memcpy() run-time false positive warnings staging: emxx_udc: Add checks for dma_alloc_coherent() tty: fix out-of-bounds access in tty_driver_lookup_tty() tty: serial: fsl_lpuart: disable the CTS when send break signal mei: bus-fixup:upon error print return values of send and receive tools/iio/iio_utils:fix memory leak iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_status_word() iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_config_word() usb: host: xhci: mvebu: Iterate over array indexes instead of using pointer math USB: ene_usb6250: Allocate enough memory for full object usb: uvc: Enumerate valid values for color matching kernel/fail_function: fix memory leak with using debugfs_lookup() PCI: Add ACS quirk for Wangxun NICs phy: rockchip-typec: Fix unsigned comparison with less than zero net: tls: avoid hanging tasks on the tx_lock x86/resctrl: Apply READ_ONCE/WRITE_ONCE to task_struct.{rmid,closid} x86/resctl: fix scheduler confusion with 'current' Bluetooth: hci_sock: purge socket queues in the destruct() callback tcp: Fix listen() regression in 5.4.229. media: uvcvideo: Provide sync and async uvc_ctrl_status_event media: uvcvideo: Fix race condition with usb_kill_urb dt-bindings: rtc: sun6i-a31-rtc: Loosen the requirements on the clocks Linux 5.4.235 Change-Id: I256ca8288bf61707f5103c9b7c7831da0d7a08a0 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-03-12 15:42:52 +00:00
Daniel Scally	195c1e9f45	usb: uvc: Enumerate valid values for color matching ... [ Upstream commit e16cab9c1596e251761d2bfb5e1467950d616963 ] The color matching descriptors defined in the UVC Specification contain 3 fields with discrete numeric values representing particular settings. Enumerate those values so that later code setting them can be more readable. Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Daniel Scally <dan.scally@ideasonboard.com> Link: https://lore.kernel.org/r/20230202114142.300858-2-dan.scally@ideasonboard.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-11 16:44:15 +01:00
Kees Cook	2072ed7c1a	media: uvcvideo: Silence memcpy() run-time false positive warnings ... [ Upstream commit b839212988575c701aab4d3d9ca15e44c87e383c ] The memcpy() in uvc_video_decode_meta() intentionally copies across the length and flags members and into the trailing buf flexible array. Split the copy so that the compiler can better reason about (the lack of) buffer overflows here. Avoid the run-time false positive warning: memcpy: detected field-spanning write (size 12) of single field "&meta->length" at drivers/media/usb/uvc/uvc_video.c:1355 (size 1) Additionally fix a typo in the documentation for struct uvc_meta_buf. Reported-by: ionut_n2001@yahoo.com Link: https://bugzilla.kernel.org/show_bug.cgi?id=216810 Signed-off-by: Kees Cook <keescook@chromium.org> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-03-11 16:44:14 +01:00
Greg Kroah-Hartman	e367c7b762	This is the 5.4.231 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmPgo/YACgkQONu9yGCS aT4o0RAAlt2uWRXaiDW2cYi1dKAuqk8Iyf0tlonzDkSESy6Qy28rw62BIbBRHFNv ObPjlz4FgI9ZfSVBsolFjBACTXvzS/fPvvqBEVmWqLA0+cN0/RRsJ8AJYV+wxV4U j0h+asxtkaWxhPmsnr0FtVG6KnqMCZkYCJYzkEwMmGZqmhkvqZVtGO5Hxwa+pTuD A+EpvsRCeqK42GqM1nn14er7Cej2bX6eM+MX1vhA/rNGgf4OrHSs5CQaLWFioFUO VN1I2/aiC+iqpF8poPC4evDgko291s+QYvtIRqcfCGjJqpfwGDWA8xReZPXKD4+4 JeY0WXHxtbjg1B+FQKZR4ESYlZfBLejI94CN32VJ3uI6CV+VgIyJMBXQ1Vs09OeN IEighGiXTHezS5NvHQTL/Y3CSooWuCxIQMmJelSW6Kr7tLpZ4/GMr4V2RU0XO9tF l3SRR/Q+w8IRtPsNNbmTB9wWJxcuyTHavrl6mG2DUy86UbJhoxjyYj7XUpiVyzbc /UmbHLXdeg9QCayhiHtCvPfcJF8EWoqoYfKSTJrj3B2ysQo7aPVK3D2/cYGRQ80A EssOD3IzC+QiBb30TzGJzJ5xaIMcaDZb61Hs7afYkhYUjQyqoQEh6ZxS8x0SCHFE 8YsVkwNm47Iw9ySPhfIIZiTfxMcK8n2zN85rAlfonlWasblr9Ok= =uM6z -----END PGP SIGNATURE----- Merge 5.4.231 into android11-5.4-lts Changes in 5.4.231 clk: generalize devm_clk_get() a bit clk: Provide new devm_clk helpers for prepared and enabled clocks memory: atmel-sdramc: Fix missing clk_disable_unprepare in atmel_ramc_probe() memory: mvebu-devbus: Fix missing clk_disable_unprepare in mvebu_devbus_probe() ARM: dts: imx6qdl-gw560x: Remove incorrect 'uart-has-rtscts' ARM: imx27: Retrieve the SYSCTRL base address from devicetree ARM: imx31: Retrieve the IIM base address from devicetree ARM: imx35: Retrieve the IIM base address from devicetree ARM: imx: add missing of_node_put() HID: intel_ish-hid: Add check for ishtp_dma_tx_map EDAC/highbank: Fix memory leak in highbank_mc_probe() tomoyo: fix broken dependency on *.conf.default RDMA/core: Fix ib block iterator counter overflow IB/hfi1: Reject a zero-length user expected buffer IB/hfi1: Reserve user expected TIDs IB/hfi1: Fix expected receive setup error exit issues affs: initialize fsdata in affs_truncate() amd-xgbe: TX Flow Ctrl Registers are h/w ver dependent amd-xgbe: Delay AN timeout during KR training bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation phy: rockchip-inno-usb2: Fix missing clk_disable_unprepare() in rockchip_usb2phy_power_on() net: nfc: Fix use-after-free in local_cleanup() net: wan: Add checks for NULL for utdm in undo_uhdlc_init and unmap_si_regs gpio: mxc: Always set GPIOs used as interrupt source to INPUT mode wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid net/sched: sch_taprio: fix possible use-after-free net: fix a concurrency bug in l2tp_tunnel_register() l2tp: Serialize access to sk_user_data with sk_callback_lock l2tp: Don't sleep and disable BH under writer-side sk_callback_lock net: usb: sr9700: Handle negative len net: mdio: validate parameter addr in mdiobus_get_phy() HID: check empty report_list in hid_validate_values() HID: check empty report_list in bigben_probe() net: stmmac: fix invalid call to mdiobus_get_phy() HID: revert CHERRY_MOUSE_000C quirk usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait usb: gadget: f_fs: Ensure ep0req is dequeued before free_request net: mlx5: eliminate anonymous module_init & module_exit drm/panfrost: fix GENERIC_ATOMIC64 dependency dmaengine: Fix double increment of client_count in dma_chan_get() net: macb: fix PTP TX timestamp failure due to packet padding HID: betop: check shape of output reports dmaengine: xilinx_dma: use devm_platform_ioremap_resource() dmaengine: xilinx_dma: Fix devm_platform_ioremap_resource error handling dmaengine: xilinx_dma: call of_node_put() when breaking out of for_each_child_of_node() tcp: avoid the lookup process failing to get sk in ehash table w1: fix deadloop in __w1_remove_master_device() w1: fix WARNING after calling w1_process() driver core: Fix test_async_probe_init saves device in wrong array net: dsa: microchip: ksz9477: port map correction in ALU table entry register tcp: fix rate_app_limited to default to 1 cpufreq: Add Tegra234 to cpufreq-dt-platdev blocklist ASoC: fsl_micfil: Correct the number of steps on SX controls drm: Add orientation quirk for Lenovo ideapad D330-10IGL s390/debug: add _ASM_S390_ prefix to header guard cpufreq: armada-37xx: stop using 0 as NULL pointer ASoC: fsl_ssi: Rename AC'97 streams to avoid collisions with AC'97 CODEC ASoC: fsl-asoc-card: Fix naming of AC'97 CODEC widgets spi: spidev: remove debug messages that access spidev->spi without locking KVM: s390: interrupt: use READ_ONCE() before cmpxchg() scsi: hisi_sas: Set a port invalid only if there are no devices attached when refreshing port id platform/x86: touchscreen_dmi: Add info for the CSL Panther Tab HD platform/x86: asus-nb-wmi: Add alternate mapping for KEY_SCREENLOCK lockref: stop doing cpu_relax in the cmpxchg loop mmc: sdhci-esdhc-imx: clear pending interrupt and halt cqhci mmc: sdhci-esdhc-imx: disable the CMD CRC check for standard tuning mmc: sdhci-esdhc-imx: correct the tuning start tap and step setting Revert "selftests/bpf: check null propagation only neither reg is PTR_TO_BTF_ID" netfilter: conntrack: do not renew entry stuck in tcp SYN_SENT state fs: reiserfs: remove useless new_opts in reiserfs_remount Revert "Revert "xhci: Set HCD flag to defer primary roothub registration"" Bluetooth: hci_sync: cancel cmd_timer if hci_open failed scsi: hpsa: Fix allocation size for scsi_host_alloc() module: Don't wait for GOING modules tracing: Make sure trace_printk() can output as soon as it can be used trace_events_hist: add check for return value of 'create_hist_field' ftrace/scripts: Update the instructions for ftrace-bisect.sh cifs: Fix oops due to uncleared server->smbd_conn in reconnect KVM: x86/vmx: Do not skip segment attributes if unusable bit is set thermal: intel: int340x: Protect trip temperature from concurrent updates ARM: 9280/1: mm: fix warning on phys_addr_t to void pointer assignment EDAC/device: Respect any driver-supplied workqueue polling value EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info netlink: prevent potential spectre v1 gadgets net: fix UaF in netns ops registration error path netfilter: nft_set_rbtree: skip elements in transaction from garbage collection netlink: annotate data races around nlk->portid netlink: annotate data races around dst_portid and dst_group netlink: annotate data races around sk_state ipv4: prevent potential spectre v1 gadget in ip_metrics_convert() ipv4: prevent potential spectre v1 gadget in fib_metrics_match() netfilter: conntrack: fix vtag checks for ABORT/SHUTDOWN_COMPLETE netrom: Fix use-after-free of a listening socket. net/sched: sch_taprio: do not schedule in taprio_reset() sctp: fail if no bound addresses can be used for a given scope net: ravb: Fix possible hang if RIS2_QFF1 happen thermal: intel: int340x: Add locking to int340x_thermal_get_trip_type() net/tg3: resolve deadlock in tg3_reset_task() during EEH net/phy/mdio-i2c: Move header file to include/linux/mdio net: xgene: Move shared header file into include/linux net: mdio-mux-meson-g12a: force internal PHY off on mux switch Revert "Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode" nfsd: Ensure knfsd shuts down when the "nfsd" pseudofs is unmounted block: fix and cleanup bio_check_ro x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL netfilter: conntrack: unify established states for SCTP paths perf/x86/amd: fix potential integer overflow on shift of a int clk: Fix pointer casting to prevent oops in devm_clk_release() x86/asm: Fix an assembler warning with current binutils ARM: dts: imx: Fix pca9547 i2c-mux node name bpf: Skip task with pid=1 in send_signal_common() blk-cgroup: fix missing pd_online_fn() while activating policy dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init sysctl: add a new register_sysctl_init() interface panic: unset panic_on_warn inside panic() mm: kasan: do not panic if both panic_on_warn and kasan_multishot set exit: Add and use make_task_dead. objtool: Add a missing comma to avoid string concatenation hexagon: Fix function name in die() h8300: Fix build errors from do_exit() to make_task_dead() transition csky: Fix function name in csky_alignment() and die() ia64: make IA64_MCA_RECOVERY bool instead of tristate exit: Put an upper limit on how often we can oops exit: Expose "oops_count" to sysfs exit: Allow oops_limit to be disabled panic: Consolidate open-coded panic_on_warn checks panic: Introduce warn_limit panic: Expose "warn_count" to sysfs docs: Fix path paste-o for /sys/kernel/warn_count exit: Use READ_ONCE() for all oops/warn limit reads ipv6: ensure sane device mtu in tunnels Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt usb: host: xhci-plat: add wakeup entry at sysfs Revert "xprtrdma: Fix regbuf data not freed in rpcrdma_req_create()" Linux 5.4.231 Change-Id: I0f670158dd88a589d5f56246d094d3392a1784f9 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-02-06 10:47:39 +00:00
Sriram Yagnaraman	f571e34005	netfilter: conntrack: unify established states for SCTP paths ... commit a44b7651489f26271ac784b70895e8a85d0cebf4 upstream. An SCTP endpoint can start an association through a path and tear it down over another one. That means the initial path will not see the shutdown sequence, and the conntrack entry will remain in ESTABLISHED state for 5 days. By merging the HEARTBEAT_ACKED and ESTABLISHED states into one ESTABLISHED state, there remains no difference between a primary or secondary path. The timeout for the merged ESTABLISHED state is set to 210 seconds (hb_interval * max_path_retrans + rto_max). So, even if a path doesn't see the shutdown sequence, it will expire in a reasonable amount of time. With this change in place, there is now more than one state from which we can transition to ESTABLISHED, COOKIE_ECHOED and HEARTBEAT_SENT, so handle the setting of ASSURED bit whenever a state change has happened and the new state is ESTABLISHED. Removed the check for dir==REPLY since the transition to ESTABLISHED can happen only in the reply direction. Fixes: 9fb9cbb108 ("[NETFILTER]: Add nf_conntrack subsystem.") Signed-off-by: Sriram Yagnaraman <sriram.yagnaraman@est.tech> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-02-06 07:52:47 +01:00
Greg Kroah-Hartman	68fdd20442	This is the 5.4.229 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmPHzUQACgkQONu9yGCS aT7QohAAtxV33qGSKGUdKMZk1JzIYuc8tAa+CHZhTi6xjTsoy1a5MlQGrj8a9YQ7 /5VvwslGSn29h/ThO/ai04CfeOsWugMtnuo4mT4+198DgH0CNQMlfWq2c25cCvY6 dIrrMTA7B2YhpdbjM4vkX8QIAxBVCHOVkseSammhMnujP7d+k4LtC6rRV4uiF+lD cKtsIJn8h+pezBeo5+pjvcTwndaAoApVOES4uOjJcf9pYOOoHxyi+8StpiO+j2Pv sRvkbvvmpS+IWAH+DMa3SAFI3C3AihX2Fu0rIFzUZByAviB1NmyWluX5mU54wW3R P80fl0rQFwuygEBU1UqTXe4hQ8YYwpJGAQzbLR22a11IT2MSO+vMRINdqG1un2BE T9hHix5R0JMeIN9AP7nKGBLrEZ3V6DqxEBz6ZC1sOUIIVQv93twtiwb0rNM0e7pq PpkIXpwXPIgqFDGXrd0y5ksRT08jJUKCRttuRVWkcGX8adotngWnrl0WBI5zqSuo B+x8X9Dw7YblJ6yQ+8mAZGk0Mj3j+cb4uhuRaz/6rqHmFOrbHm+JDXvPzZY65xy3 k8Ebtq5CxINLDwahfb/o13MgbmzMPPNPPp0cz23zOhm88OmwVzB4hAoB/1CfHZvF XhSbZMVBhhP9hYr2gYl902EQeZGE5yjk5xhFT5Wrh7QoZaPW2XM= =as6n -----END PGP SIGNATURE----- Merge 5.4.229 into android11-5.4-lts Changes in 5.4.229 tracing/ring-buffer: Only do full wait when cpu != RING_BUFFER_ALL_CPUS udf: Discard preallocation before extending file with a hole udf: Fix preallocation discarding at indirect extent boundary udf: Do not bother looking for prealloc extents if i_lenExtents matches i_size udf: Fix extending file within last block usb: gadget: uvc: Prevent buffer overflow in setup handler USB: serial: option: add Quectel EM05-G modem USB: serial: cp210x: add Kamstrup RF sniffer PIDs USB: serial: f81232: fix division by zero on line-speed change USB: serial: f81534: fix division by zero on line-speed change igb: Initialize mailbox message for VF reset xen-netback: move removal of "hotplug-status" to the right place HID: ite: Add support for Acer S1002 keyboard-dock HID: ite: Enable QUIRK_TOUCHPAD_ON_OFF_REPORT on Acer Aspire Switch 10E HID: ite: Enable QUIRK_TOUCHPAD_ON_OFF_REPORT on Acer Aspire Switch V 10 HID: uclogic: Add HID_QUIRK_HIDINPUT_FORCE quirk Bluetooth: L2CAP: Fix u8 overflow net: loopback: use NET_NAME_PREDICTABLE for name_assign_type usb: musb: remove extra check in musb_gadget_vbus_draw ARM: dts: qcom: apq8064: fix coresight compatible arm64: dts: qcom: sdm845-cheza: fix AP suspend pin bias drivers: soc: ti: knav_qmss_queue: Mark knav_acc_firmwares as static arm: dts: spear600: Fix clcd interrupt soc: ti: knav_qmss_queue: Use pm_runtime_resume_and_get instead of pm_runtime_get_sync soc: ti: knav_qmss_queue: Fix PM disable depth imbalance in knav_queue_probe soc: ti: smartreflex: Fix PM disable depth imbalance in omap_sr_probe perf: arm_dsu: Fix hotplug callback leak in dsu_pmu_init() perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init() arm64: dts: mt2712e: Fix unit_address_vs_reg warning for oscillators arm64: dts: mt2712e: Fix unit address for pinctrl node arm64: dts: mt2712-evb: Fix vproc fixed regulators unit names arm64: dts: mt2712-evb: Fix usb vbus regulators unit names arm64: dts: mediatek: mt6797: Fix 26M oscillator unit name ARM: dts: dove: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-370: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-xp: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-375: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-38x: Fix assigned-addresses for every PCIe Root Port ARM: dts: armada-39x: Fix assigned-addresses for every PCIe Root Port ARM: dts: turris-omnia: Add ethernet aliases ARM: dts: turris-omnia: Add switch port 6 node arm64: dts: armada-3720-turris-mox: Add missing interrupt for RTC pstore/ram: Fix error return code in ramoops_probe() ARM: mmp: fix timer_read delay pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP tpm/tpm_crb: Fix error message in __crb_relinquish_locality() cpuidle: dt: Return the correct numbers of parsed idle states alpha: fix syscall entry in !AUDUT_SYSCALL case PM: hibernate: Fix mistake in kerneldoc comment fs: don't audit the capability check in simple_xattr_list() selftests/ftrace: event_triggers: wait longer for test_event_enable perf: Fix possible memleak in pmu_dev_alloc() timerqueue: Use rb_entry_safe() in timerqueue_getnext() proc: fixup uptime selftest lib/fonts: fix undefined behavior in bit shift for get_default_font ocfs2: fix memory leak in ocfs2_stack_glue_init() MIPS: vpe-mt: fix possible memory leak while module exiting MIPS: vpe-cmp: fix possible memory leak while module exiting selftests/efivarfs: Add checking of the test return value PNP: fix name memory leak in pnp_alloc_dev() perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox() irqchip: gic-pm: Use pm_runtime_resume_and_get() in gic_probe() EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() nfsd: don't call nfsd_file_put from client states seqfile display genirq/irqdesc: Don't try to remove non-existing sysfs files cpufreq: amd_freq_sensitivity: Add missing pci_dev_put() libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value lib/notifier-error-inject: fix error when writing -errno to debugfs file docs: fault-injection: fix non-working usage of negative values debugfs: fix error when writing negative value to atomic_t debugfs file ocfs2: ocfs2_mount_volume does cleanup job before return error ocfs2: rewrite error handling of ocfs2_fill_super ocfs2: fix memory leak in ocfs2_mount_volume() rapidio: fix possible name leaks when rio_add_device() fails rapidio: rio: fix possible name leak in rio_register_mport() clocksource/drivers/sh_cmt: Make sure channel clock supply is enabled ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() uprobes/x86: Allow to probe a NOP instruction with 0x66 prefix xen/events: only register debug interrupt for 2-level events x86/xen: Fix memory leak in xen_smp_intr_init{_pv}() x86/xen: Fix memory leak in xen_init_lock_cpu() xen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource() PM: runtime: Improve path in rpm_idle() when no callback PM: runtime: Do not call __rpm_callback() from rpm_idle() platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]() MIPS: BCM63xx: Add check for NULL for clk in clk_enable MIPS: OCTEON: warn only once if deprecated link status is being used fs: sysv: Fix sysv_nblocks() returns wrong value rapidio: fix possible UAF when kfifo_alloc() fails eventfd: change int to __u64 in eventfd_signal() ifndef CONFIG_EVENTFD relay: fix type mismatch when allocating memory in relay_create_buf() hfs: Fix OOB Write in hfs_asc2mac rapidio: devices: fix missing put_device in mport_cdev_open wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs() wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb() wifi: rtl8xxxu: Fix reading the vendor of combo chips pata_ipx4xx_cf: Fix unsigned comparison with less than zero media: i2c: ad5820: Fix error path can: kvaser_usb: do not increase tx statistics when sending error message frames can: kvaser_usb: kvaser_usb_leaf: Get capabilities from device can: kvaser_usb: kvaser_usb_leaf: Rename {leaf,usbcan}_cmd_error_event to {leaf,usbcan}_cmd_can_error_event can: kvaser_usb: kvaser_usb_leaf: Handle CMD_ERROR_EVENT can: kvaser_usb_leaf: Set Warning state even without bus errors can: kvaser_usb_leaf: Fix improved state not being reported can: kvaser_usb_leaf: Fix wrong CAN state after stopping can: kvaser_usb_leaf: Fix bogus restart events can: kvaser_usb: Add struct kvaser_usb_busparams can: kvaser_usb: Compare requested bittiming parameters with actual parameters in do_set_{,data}_bittiming clk: renesas: r9a06g032: Repair grave increment error spi: Update reference to struct spi_controller drm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure ima: Rename internal filter rule functions ima: Fix fall-through warnings for Clang ima: Handle -ESTALE returned by ima_filter_rule_match() media: vivid: fix compose size exceed boundary bpf: propagate precision in ALU/ALU64 operations mtd: Fix device name leak when register device failed in add_mtd_device() wifi: rsi: Fix handling of 802.3 EAPOL frames sent via control port media: camss: Clean up received buffers on failed start of streaming net, proc: Provide PROC_FS=n fallback for proc_create_net_single_write() rxrpc: Fix ack.bufferSize to be 0 when generating an ack drm/radeon: Add the missed acpi_put_table() to fix memory leak drm/mediatek: Modify dpi power on/off sequence. ASoC: pxa: fix null-pointer dereference in filter() regulator: core: fix unbalanced of node refcount in regulator_dev_lookup() amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table() integrity: Fix memory leakage in keyring allocation error path ima: Fix misuse of dereference of pointer in template_desc_init_fields() wifi: ath10k: Fix return value in ath10k_pci_init() mtd: lpddr2_nvm: Fix possible null-ptr-deref Input: elants_i2c - properly handle the reset GPIO when power is off media: solo6x10: fix possible memory leak in solo_sysfs_init() media: platform: exynos4-is: Fix error handling in fimc_md_init() media: videobuf-dma-contig: use dma_mmap_coherent bpf: Move skb->len == 0 checks into __bpf_redirect HID: hid-sensor-custom: set fixed size for custom attributes ALSA: pcm: fix undefined behavior in bit shift for SNDRV_PCM_RATE_KNOT ALSA: seq: fix undefined behavior in bit shift for SNDRV_SEQ_FILTER_USE_EVENT regulator: core: use kfree_const() to free space conditionally clk: rockchip: Fix memory leak in rockchip_clk_register_pll() bonding: Export skip slave logic to function bonding: Rename slave_arr to usable_slaves bonding: fix link recovery in mode 2 when updelay is nonzero mtd: maps: pxa2xx-flash: fix memory leak in probe media: imon: fix a race condition in send_packet() clk: imx8mn: correct the usb1_ctrl parent to be usb_bus clk: imx: replace osc_hdmi with dummy pinctrl: pinconf-generic: add missing of_node_put() media: dvb-core: Fix ignored return value in dvb_register_frontend() media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer() media: s5p-mfc: Add variant data for MFC v7 hardware for Exynos 3250 SoC drm/tegra: Add missing clk_disable_unprepare() in tegra_dc_probe() ASoC: dt-bindings: wcd9335: fix reset line polarity in example ASoC: mediatek: mtk-btcvsd: Add checks for write and read of mtk_btcvsd_snd NFSv4.2: Clear FATTR4_WORD2_SECURITY_LABEL when done decoding NFSv4.2: Fix a memory stomp in decode_attr_security_label NFSv4.2: Fix initialisation of struct nfs4_label NFSv4: Fix a deadlock between nfs4_open_recover_helper() and delegreturn ALSA: asihpi: fix missing pci_disable_device() wifi: iwlwifi: mvm: fix double free on tx path. ASoC: mediatek: mt8173: Enable IRQ when pdata is ready drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios() drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios() ASoC: pcm512x: Fix PM disable depth imbalance in pcm512x_probe netfilter: conntrack: set icmpv6 redirects as RELATED bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data bpf, sockmap: Fix data loss caused by using apply_bytes on ingress redirect bonding: uninitialized variable in bond_miimon_inspect() spi: spidev: mask SPI_CS_HIGH in SPI_IOC_RD_MODE wifi: cfg80211: Fix not unregister reg_pdev when load_builtin_regdb_keys() fails regulator: core: fix module refcount leak in set_supply() clk: qcom: clk-krait: fix wrong div2 functions hsr: Avoid double remove of a node. configfs: fix possible memory leak in configfs_create_dir() regulator: core: fix resource leak in regulator_register() bpf, sockmap: fix race in sock_map_free() media: saa7164: fix missing pci_disable_device() ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt xprtrdma: Fix regbuf data not freed in rpcrdma_req_create() SUNRPC: Fix missing release socket in rpc_sockname() NFSv4.x: Fail client initialisation if state manager thread can't run mmc: alcor: fix return value check of mmc_add_host() mmc: moxart: fix return value check of mmc_add_host() mmc: mxcmmc: fix return value check of mmc_add_host() mmc: pxamci: fix return value check of mmc_add_host() mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host() mmc: toshsd: fix return value check of mmc_add_host() mmc: vub300: fix return value check of mmc_add_host() mmc: wmt-sdmmc: fix return value check of mmc_add_host() mmc: atmel-mci: fix return value check of mmc_add_host() mmc: omap_hsmmc: fix return value check of mmc_add_host() mmc: meson-gx: fix return value check of mmc_add_host() mmc: via-sdmmc: fix return value check of mmc_add_host() mmc: wbsd: fix return value check of mmc_add_host() mmc: mmci: fix return value check of mmc_add_host() media: c8sectpfe: Add of_node_put() when breaking out of loop media: coda: Add check for dcoda_iram_alloc media: coda: Add check for kmalloc clk: samsung: Fix memory leak in _samsung_clk_register_pll() spi: spi-gpio: Don't set MOSI as an input if not 3WIRE mode wifi: rtl8xxxu: Add __packed to struct rtl8723bu_c2h wifi: brcmfmac: Fix error return code in brcmf_sdio_download_firmware() blktrace: Fix output non-blktrace event when blk_classic option enabled clk: socfpga: clk-pll: Remove unused variable 'rc' clk: socfpga: use clk_hw_register for a5/c5 clk: socfpga: Fix memory leak in socfpga_gate_init() net: vmw_vsock: vmci: Check memcpy_from_msg() net: defxx: Fix missing err handling in dfx_init() net: stmmac: selftests: fix potential memleak in stmmac_test_arpoffload() drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init() of: overlay: fix null pointer dereferencing in find_dup_cset_node_entry() and find_dup_cset_prop() ethernet: s2io: don't call dev_kfree_skb() under spin_lock_irqsave() net: farsync: Fix kmemleak when rmmods farsync net/tunnel: wait until all sk_user_data reader finish before releasing the sock net: apple: mace: don't call dev_kfree_skb() under spin_lock_irqsave() net: apple: bmac: don't call dev_kfree_skb() under spin_lock_irqsave() net: emaclite: don't call dev_kfree_skb() under spin_lock_irqsave() net: ethernet: dnet: don't call dev_kfree_skb() under spin_lock_irqsave() hamradio: don't call dev_kfree_skb() under spin_lock_irqsave() net: amd: lance: don't call dev_kfree_skb() under spin_lock_irqsave() net: amd-xgbe: Fix logic around active and passive cables net: amd-xgbe: Check only the minimum speed for active/passive cables can: tcan4x5x: Remove invalid write in clear_interrupts net: lan9303: Fix read error execution path ntb_netdev: Use dev_kfree_skb_any() in interrupt context Bluetooth: btusb: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_ll: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_h5: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_bcsp: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: hci_core: don't call kfree_skb() under spin_lock_irqsave() Bluetooth: RFCOMM: don't call kfree_skb() under spin_lock_irqsave() stmmac: fix potential division by 0 apparmor: fix a memleak in multi_transaction_new() apparmor: fix lockdep warning when removing a namespace apparmor: Fix abi check to include v8 abi apparmor: Use pointer to struct aa_label for lbs_cred RDMA/core: Fix order of nldev_exit call f2fs: fix normal discard process RDMA/siw: Fix immediate work request flush to completion queue RDMA/nldev: Return "-EAGAIN" if the cm_id isn't from expected port RDMA/siw: Set defined status for work completion with undefined status scsi: scsi_debug: Fix a warning in resp_write_scat() crypto: ccree - swap SHA384 and SHA512 larval hashes at build time crypto: ccree - Remove debugfs when platform_driver_register failed PCI: Check for alloc failure in pci_request_irq() RDMA/hfi: Decrease PCI device reference count in error path crypto: ccree - Make cc_debugfs_global_fini() available for module init function RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed scsi: hpsa: Fix possible memory leak in hpsa_init_one() crypto: tcrypt - Fix multibuffer skcipher speed test mem leak scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add() scsi: hpsa: Fix error handling in hpsa_add_sas_host() scsi: hpsa: Fix possible memory leak in hpsa_add_sas_device() scsi: fcoe: Fix possible name leak when device_register() fails scsi: ipr: Fix WARNING in ipr_init() scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails scsi: snic: Fix possible UAF in snic_tgt_create() RDMA/nldev: Add checks for nla_nest_start() in fill_stat_counter_qps() f2fs: avoid victim selection from previous victim section crypto: omap-sham - Use pm_runtime_resume_and_get() in omap_sham_probe() RDMA/hfi1: Fix error return code in parse_platform_config() orangefs: Fix sysfs not cleanup when dev init failed crypto: img-hash - Fix variable dereferenced before check 'hdev->req' hwrng: amd - Fix PCI device refcount leak hwrng: geode - Fix PCI device refcount leak IB/IPoIB: Fix queue count inconsistency for PKEY child interfaces drivers: dio: fix possible memory leak in dio_init() tty: serial: tegra: Activate RX DMA transfer by request serial: tegra: Read DMA status before terminating class: fix possible memory leak in __class_register() vfio: platform: Do not pass return buffer to ACPI _RST method uio: uio_dmem_genirq: Fix missing unlock in irq configuration uio: uio_dmem_genirq: Fix deadlock between irq config and handling usb: fotg210-udc: Fix ages old endianness issues staging: vme_user: Fix possible UAF in tsi148_dma_list_add usb: typec: Check for ops->exit instead of ops->enter in altmode_exit usb: typec: tcpci: fix of node refcount leak in tcpci_register_port() serial: amba-pl011: avoid SBSA UART accessing DMACR register serial: pl011: Do not clear RX FIFO & RX interrupt in unthrottle. serial: pch: Fix PCI device refcount leak in pch_request_dma() tty: serial: clean up stop-tx part in altera_uart_tx_chars() tty: serial: altera_uart_{r,t}x_chars() need only uart_port serial: altera_uart: fix locking in polling mode serial: sunsab: Fix error handling in sunsab_init() test_firmware: fix memory leak in test_firmware_init() misc: ocxl: fix possible name leak in ocxl_file_register_afu() misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os cxl: fix possible null-ptr-deref in cxl_guest_init_afu|adapter() cxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter() counter: stm32-lptimer-cnt: fix the check on arr and cmp registers update usb: roles: fix of node refcount leak in usb_role_switch_is_parent() usb: gadget: f_hid: optional SETUP/SET_REPORT mode usb: gadget: f_hid: fix f_hidg lifetime vs cdev usb: gadget: f_hid: fix refcount leak on error path drivers: mcb: fix resource leak in mcb_probe() mcb: mcb-parse: fix error handing in chameleon_parse_gdd() chardev: fix error handling in cdev_device_add() i2c: pxa-pci: fix missing pci_disable_device() on error in ce4100_i2c_probe staging: rtl8192u: Fix use after free in ieee80211_rx() staging: rtl8192e: Fix potential use-after-free in rtllib_rx_Monitor() vme: Fix error not catched in fake_init() i2c: ismt: Fix an out-of-bounds bug in ismt_access() usb: storage: Add check for kcalloc tracing/hist: Fix issue of losting command info in error_log samples: vfio-mdev: Fix missing pci_disable_device() in mdpy_fb_probe() fbdev: ssd1307fb: Drop optional dependency fbdev: pm2fb: fix missing pci_disable_device() fbdev: via: Fix error in via_core_init() fbdev: vermilion: decrease reference count in error path fbdev: uvesafb: Fixes an error handling path in uvesafb_probe() HSI: omap_ssi_core: fix unbalanced pm_runtime_disable() HSI: omap_ssi_core: fix possible memory leak in ssi_probe() power: supply: fix residue sysfs file in error handle route of __power_supply_register() perf trace: Return error if a system call doesn't exist perf trace: Separate 'struct syscall_fmt' definition from syscall_fmts variable perf trace: Factor out the initialization of syscal_arg_fmt->scnprintf perf trace: Add the syscall_arg_fmt pointer to syscall_arg perf trace: Allow associating scnprintf routines with well known arg names perf trace: Add a strtoul() method to 'struct syscall_arg_fmt' perf trace: Use macro RAW_SYSCALL_ARGS_NUM to replace number perf trace: Handle failure when trace point folder is missed perf symbol: correction while adjusting symbol HSI: omap_ssi_core: Fix error handling in ssi_init() power: supply: fix null pointer dereferencing in power_supply_get_battery_info RDMA/siw: Fix pointer cast warning include/uapi/linux/swab: Fix potentially missing __always_inline rtc: snvs: Allow a time difference on clock register read rtc: pcf85063: Fix reading alarm iommu/amd: Fix pci device refcount leak in ppr_notifier() iommu/fsl_pamu: Fix resource leak in fsl_pamu_probe() macintosh: fix possible memory leak in macio_add_one_device() macintosh/macio-adb: check the return value of ioremap() powerpc/52xx: Fix a resource leak in an error handling path cxl: Fix refcount leak in cxl_calc_capp_routing powerpc/xive: add missing iounmap() in error path in xive_spapr_populate_irq_data() powerpc/perf: callchain validate kernel stack pointer bounds powerpc/83xx/mpc832x_rdb: call platform_device_put() in error case in of_fsl_spi_probe() powerpc/hv-gpci: Fix hv_gpci event list selftests/powerpc: Fix resource leaks pwm: sifive: Call pwm_sifive_update_clock() while mutex is held remoteproc: sysmon: fix memory leak in qcom_add_sysmon_subdev() remoteproc: qcom_q6v5_pas: Fix missing of_node_put() in adsp_alloc_memory_region() rtc: st-lpc: Add missing clk_disable_unprepare in st_rtc_probe() rtc: pic32: Move devm_rtc_allocate_device earlier in pic32_rtc_probe() nfsd: Define the file access mode enum for tracing NFSD: Add tracepoints to NFSD's duplicate reply cache nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure mISDN: hfcsusb: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() mISDN: hfcpci: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave() nfc: pn533: Clear nfc_target before being used r6040: Fix kmemleak in probe and remove rtc: mxc_v2: Add missing clk_disable_unprepare() openvswitch: Fix flow lookup to use unmasked key skbuff: Account for tail adjustment during pull operations mailbox: zynq-ipi: fix error handling while device_register() fails net_sched: reject TCF_EM_SIMPLE case for complex ematch module rxrpc: Fix missing unlock in rxrpc_do_sendmsg() myri10ge: Fix an error handling path in myri10ge_probe() net: stream: purge sk_error_queue in sk_stream_kill_queues() rcu: Fix __this_cpu_read() lockdep warning in rcu_force_quiescent_state() binfmt_misc: fix shift-out-of-bounds in check_special_flags fs: jfs: fix shift-out-of-bounds in dbAllocAG udf: Avoid double brelse() in udf_rename() fs: jfs: fix shift-out-of-bounds in dbDiscardAG ACPICA: Fix error code path in acpi_ds_call_control_method() nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset() acct: fix potential integer overflow in encode_comp_t() hfs: fix OOB Read in __hfs_brec_find drm/etnaviv: add missing quirks for GC300 brcmfmac: return error when getting invalid max_flowrings from dongle wifi: ath9k: verify the expected usb_endpoints are present wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out ASoC: codecs: rt298: Add quirk for KBL-R RVP platform ipmi: fix memleak when unload ipmi driver bpf: make sure skb->len != 0 when redirecting to a tunneling device net: ethernet: ti: Fix return type of netcp_ndo_start_xmit() hamradio: baycom_epp: Fix return type of baycom_send_packet() wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request() igb: Do not free q_vector unless new one was allocated s390/ctcm: Fix return type of ctc{mp,}m_tx() s390/netiucv: Fix return type of netiucv_tx() s390/lcs: Fix return type of lcs_start_xmit() drm/rockchip: Use drm_mode_copy() drm/sti: Use drm_mode_copy() drivers/md/md-bitmap: check the return value of md_bitmap_get_counter() md/raid1: stop mdx_raid1 thread when raid1 array run failed net: add atomic_long_t to net_device_stats fields mrp: introduce active flags to prevent UAF when applicant uninit ppp: associate skb with a device at tx bpf: Prevent decl_tag from being referenced in func_proto arg media: dvb-frontends: fix leak of memory fw media: dvbdev: adopts refcnt to avoid UAF media: dvb-usb: fix memory leak in dvb_usb_adapter_init() blk-mq: fix possible memleak when register 'hctx' failed regulator: core: fix use_count leakage when handling boot-on mmc: f-sdh30: Add quirks for broken timeout clock capability media: si470x: Fix use-after-free in si470x_int_in_callback() clk: st: Fix memory leak in st_of_quadfs_setup() hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param() drm/fsl-dcu: Fix return type of fsl_dcu_drm_connector_mode_valid() drm/sti: Fix return type of sti_{dvo,hda,hdmi}_connector_mode_valid() orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string() orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init() ALSA/ASoC: hda: move/rename snd_hdac_ext_stop_streams to hdac_stream.c ALSA: hda: add snd_hdac_stop_streams() helper ASoC: Intel: Skylake: Fix driver hang during shutdown ASoC: mediatek: mt8173-rt5650-rt5514: fix refcount leak in mt8173_rt5650_rt5514_dev_probe() ASoC: audio-graph-card: fix refcount leak of cpu_ep in __graph_for_each_link() ASoC: rockchip: pdm: Add missing clk_disable_unprepare() in rockchip_pdm_runtime_resume() ASoC: wm8994: Fix potential deadlock ASoC: rockchip: spdif: Add missing clk_disable_unprepare() in rk_spdif_runtime_resume() ASoC: rt5670: Remove unbalanced pm_runtime_put() pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion pstore: Make sure CONFIG_PSTORE_PMSG selects CONFIG_RT_MUTEXES ALSA: hda/realtek: Add quirk for Lenovo TianYi510Pro-14IOB ALSA: hda/hdmi: Add HP Device 0x8711 to force connect list usb: dwc3: core: defer probe on ulpi_read_id timeout HID: wacom: Ensure bootloader PID is usable in hidraw mode reiserfs: Add missing calls to reiserfs_security_free() iio: adc: ad_sigma_delta: do not use internal iio_dev lock iio: adc128s052: add proper .data members in adc128_of_match table regulator: core: fix deadlock on regulator enable gcov: add support for checksum field media: dvbdev: fix build warning due to comments media: dvbdev: fix refcnt bug cifs: fix oops during encryption nvme-pci: fix doorbell buffer value endianness ata: ahci: Fix PCS quirk application for suspend nvme: resync include/linux/nvme.h with nvmecli nvme: fix the NVME_CMD_EFFECTS_CSE_MASK definition objtool: Fix SEGFAULT powerpc/rtas: avoid device tree lookups in rtas_os_term() powerpc/rtas: avoid scheduling in rtas_os_term() HID: multitouch: fix Asus ExpertBook P2 P2451FA trackpoint HID: plantronics: Additional PIDs for double volume key presses quirk hfsplus: fix bug causing custom uid and gid being unable to be assigned with mount ovl: Use ovl mounter's fsuid and fsgid in ovl_link() ALSA: line6: correct midi status byte when receiving data from podxt ALSA: line6: fix stack overflow in line6_midi_transmit pnode: terminate at peers of source md: fix a crash in mempool_free mm, compaction: fix fast_isolate_around() to stay within boundaries f2fs: should put a page when checking the summary info mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails net/af_packet: add VLAN support for AF_PACKET SOCK_RAW GSO net/af_packet: make sure to pull mac header media: stv0288: use explicitly signed char soc: qcom: Select REMAP_MMIO for LLCC driver kest.pl: Fix grub2 menu handling for rebooting ktest.pl minconfig: Unset configs instead of just removing them mmc: sdhci-sprd: Disable CLK_AUTO when the clock is less than 400K btrfs: fix resolving backrefs for inline extent followed by prealloc ARM: ux500: do not directly dereference __iomem arm64: dts: qcom: sdm850-lenovo-yoga-c630: correct I2C12 pins drive strength selftests: Use optional USERCFLAGS and USERLDFLAGS cpufreq: Init completion before kobject_init_and_add() binfmt: Move install_exec_creds after setup_new_exec to match binfmt_elf binfmt: Fix error return code in load_elf_fdpic_binary() dm cache: Fix ABBA deadlock between shrink_slab and dm_cache_metadata_abort dm thin: Fix ABBA deadlock between shrink_slab and dm_pool_abort_metadata dm thin: Use last transaction's pmd->root when commit failed dm thin: Fix UAF in run_timer_softirq() dm integrity: Fix UAF in dm_integrity_dtr() dm clone: Fix UAF in clone_dtr() dm cache: Fix UAF in destroy() dm cache: set needs_check flag after aborting metadata tracing/hist: Fix out-of-bound write on 'action_data.var_ref_idx' x86/microcode/intel: Do not retry microcode reloading on the APs tracing/hist: Fix wrong return value in parse_action_params() tracing: Fix infinite loop in tracing_read_pipe on overflowed print_trace_line ARM: 9256/1: NWFPE: avoid compiler-generated __aeabi_uldivmod media: dvb-core: Fix double free in dvb_register_device() media: dvb-core: Fix UAF due to refcount races at releasing cifs: fix confusing debug message cifs: fix missing display of three mount options md/bitmap: Fix bitmap chunk size overflow issues efi: Add iMac Pro 2017 to uefi skip cert quirk ipmi: fix long wait in unload when IPMI disconnect mtd: spi-nor: Check for zero erase size in spi_nor_find_best_erase_type() ima: Fix a potential NULL pointer access in ima_restore_measurement_list ipmi: fix use after free in _ipmi_destroy_user() PCI: Fix pci_device_is_present() for VFs by checking PF PCI/sysfs: Fix double free in error path crypto: n2 - add missing hash statesize iommu/amd: Fix ivrs_acpihid cmdline parsing code parisc: led: Fix potential null-ptr-deref in start_task() device_cgroup: Roll back to original exceptions after copy failure drm/connector: send hotplug uevent on connector cleanup drm/vmwgfx: Validate the box size for the snooped cursor ext4: add inode table check in __ext4_get_inode_loc to aovid possible infinite loop ext4: fix undefined behavior in bit shift for ext4_check_flag_values ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode ext4: add helper to check quota inums ext4: fix reserved cluster accounting in __es_remove_extent() ext4: fix bug_on in __es_tree_search caused by bad boot loader inode ext4: init quota for 'old.inode' in 'ext4_rename' ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline ext4: fix corruption when online resizing a 1K bigalloc fs ext4: fix error code return to user-space in ext4_get_branch() ext4: avoid BUG_ON when creating xattrs ext4: fix inode leak in ext4_xattr_inode_create() on an error path ext4: initialize quota before expanding inode in setproject ioctl ext4: avoid unaccounted block allocation when expanding inode ext4: allocate extended attribute value in vmalloc area btrfs: replace strncpy() with strscpy() PM/devfreq: governor: Add a private governor_data for governor media: s5p-mfc: Fix to handle reference queue during finishing media: s5p-mfc: Clear workbit to handle error condition media: s5p-mfc: Fix in register read and write for H264 dm thin: resume even if in FAIL mode perf probe: Use dwarf_attr_integrate as generic DWARF attr accessor perf probe: Fix to get the DW_AT_decl_file and DW_AT_call_file as unsinged data KVM: x86: optimize more exit handlers in vmx.c KVM: retpolines: x86: eliminate retpoline from vmx.c exit handlers KVM: VMX: Rename INTERRUPT_PENDING to INTERRUPT_WINDOW KVM: VMX: Rename NMI_PENDING to NMI_WINDOW KVM: VMX: Fix the spelling of CPU_BASED_USE_TSC_OFFSETTING KVM: nVMX: Properly expose ENABLE_USR_WAIT_PAUSE control to L1 ravb: Fix "failed to switch device to config mode" message during unbind ext4: goto right label 'failed_mount3a' ext4: correct inconsistent error msg in nojournal mode mm/highmem: Lift memcpy_[to|from]_page to core ext4: use memcpy_to_page() in pagecache_write() fs: ext4: initialize fsdata in pagecache_write() ext4: use kmemdup() to replace kmalloc + memcpy mbcache: don't reclaim used entries mbcache: add functions to delete entry if unused ext4: remove EA inode entry from mbcache on inode eviction ext4: unindent codeblock in ext4_xattr_block_set() ext4: fix race when reusing xattr blocks mbcache: automatically delete entries from cache on freeing ext4: fix deadlock due to mbcache entry corruption SUNRPC: ensure the matching upcall is in-flight upon downcall bpf: pull before calling skb_postpull_rcsum() nfsd: shut down the NFSv4 state objects before the filecache net: hns3: add interrupts re-initialization while doing VF FLR net: sched: fix memory leak in tcindex_set_parms qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure nfc: Fix potential resource leaks vhost: fix range used in translate_desc() net: amd-xgbe: add missed tasklet_kill net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe RDMA/uverbs: Silence shiftTooManyBitsSigned warning RDMA/mlx5: Fix validation of max_rd_atomic caps for DC net: sched: atm: dont intepret cls results when asked to drop net: sched: cbq: dont intepret cls results when asked to drop perf tools: Fix resources leak in perf_data__open_dir() drivers/net/bonding/bond_3ad: return when there's no aggregator usb: rndis_host: Secure rndis_query check against int overflow drm/i915: unpin on error in intel_vgpu_shadow_mm_pin() caif: fix memory leak in cfctrl_linkup_request() udf: Fix extension of the last extent in the file ASoC: Intel: bytcr_rt5640: Add quirk for the Advantech MICA-071 tablet x86/bugs: Flush IBP in ib_prctl_set() nfsd: fix handling of readdir in v4root vs. mount upcall timeout riscv: uaccess: fix type of 0 variable on error in get_user() ext4: don't allow journal inode to have encrypt flag hfs/hfsplus: use WARN_ON for sanity check hfs/hfsplus: avoid WARN_ON() for sanity check, use proper error handling mbcache: Avoid nesting of cache->c_list_lock under bit locks parisc: Align parisc MADV_XXX constants with all other architectures selftests: Fix kselftest O=objdir build from cluttering top level objdir selftests: set the BUILD variable to absolute path driver core: Fix bus_type.match() error handling in __driver_attach() net: sched: disallow noqueue for qdisc classes KVM: arm64: Fix S1PTW handling on RO memslots efi: tpm: Avoid READ_ONCE() for accessing the event log docs: Fix the docs build with Sphinx 6.0 perf auxtrace: Fix address filter duplicate symbol selection s390/kexec: fix ipl report address for kdump s390/percpu: add READ_ONCE() to arch_this_cpu_to_op_simple() net/ulp: prevent ULP without clone op from entering the LISTEN status ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF ALSA: hda/hdmi: Add a HP device 0x8715 to force connect list cifs: Fix uninitialized memory read for smb311 posix symlink create drm/msm/adreno: Make adreno quirks not overwrite each other platform/x86: sony-laptop: Don't turn off 0x153 keyboard backlight during probe ixgbe: fix pci device refcount leak ipv6: raw: Deduct extension header length in rawv6_push_pending_frames wifi: wilc1000: sdio: fix module autoloading usb: ulpi: defer ulpi_register on ulpi_read_id timeout jbd2: use the correct print format quota: Factor out setup of quota inode ext4: fix bug_on in __es_tree_search caused by bad quota inode ext4: lost matching-pair of trace in ext4_truncate ext4: fix use-after-free in ext4_orphan_cleanup ext4: fix uninititialized value in 'ext4_evict_inode' netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function. powerpc/imc-pmu: Fix use of mutex in IRQs disabled section x86/boot: Avoid using Intel mnemonics in AT&T syntax asm EDAC/device: Fix period calculation in edac_device_reset_delay_period() regulator: da9211: Use irq handler when ready tipc: improve throughput between nodes in netns tipc: eliminate checking netns if node established tipc: fix unexpected link reset due to discovery messages hvc/xen: lock console list traversal nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame() net/sched: act_mpls: Fix warning during failed attribute validation net/mlx5: Rename ptp clock info net/mlx5: Fix ptp max frequency adjustment range iommu/mediatek-v1: Add error handle for mtk_iommu_probe iommu/mediatek-v1: Fix an error handling path in mtk_iommu_v1_probe() x86/resctrl: Use task_curr() instead of task_struct->on_cpu to prevent unnecessary IPI x86/resctrl: Fix task CLOSID/RMID update race drm/virtio: Fix GEM handle creation UAF arm64: atomics: format whitespace consistently arm64: atomics: remove LL/SC trampolines arm64: cmpxchg_double*: hazard against entire exchange variable efi: fix NULL-deref in init error path mm: Always release pages to the buddy allocator in memblock_free_late(). Revert "usb: ulpi: defer ulpi_register on ulpi_read_id timeout" tipc: fix use-after-free in tipc_disc_rcv() tty: serial: tegra: Handle RX transfer in PIO mode if DMA wasn't started tipc: Add a missing case of TIPC_DIRECT_MSG type ocfs2: fix freeing uninitialized resource on ocfs2_dlm_shutdown tipc: call tipc_lxc_xmit without holding node_read_lock Linux 5.4.229 Change-Id: If8e35d5d3e707352766ae3e4b665fd2369d9382b Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-01-18 12:21:41 +00:00
Matt Redfearn	6a54d03337	include/uapi/linux/swab: Fix potentially missing __always_inline ... [ Upstream commit defbab270d45e32b068e7e73c3567232d745c60f ] Commit bc27fb68aa ("include/uapi/linux/byteorder, swab: force inlining of some byteswap operations") added __always_inline to swab functions and commit 283d757378 ("uapi/linux/stddef.h: Provide __always_inline to userspace headers") added a definition of __always_inline for use in exported headers when the kernel's compiler.h is not available. However, since swab.h does not include stddef.h, if the header soup does not indirectly include it, the definition of __always_inline is missing, resulting in a compilation failure, which was observed compiling the perf tool using exported headers containing this commit: In file included from /usr/include/linux/byteorder/little_endian.h:12:0, from /usr/include/asm/byteorder.h:14, from tools/include/uapi/linux/perf_event.h:20, from perf.h:8, from builtin-bench.c:18: /usr/include/linux/swab.h:160:8: error: unknown type name `__always_inline' static __always_inline __u16 __swab16p(const __u16 *p) Fix this by replacing the inclusion of linux/compiler.h with linux/stddef.h to ensure that we pick up that definition if required, without relying on it's indirect inclusion. compiler.h is then included indirectly, via stddef.h. Fixes: 283d757378 ("uapi/linux/stddef.h: Provide __always_inline to userspace headers") Signed-off-by: Matt Redfearn <matt.redfearn@mips.com> Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: Arnd Bergmann <arnd@arndb.de> Tested-by: Nathan Chancellor <nathan@kernel.org> Reviewed-by: Petr Vaněk <arkamar@atlas.cz> Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-01-18 11:41:29 +01:00
Baisong Zhong	d884ed9a2f	ALSA: seq: fix undefined behavior in bit shift for SNDRV_SEQ_FILTER_USE_EVENT ... [ Upstream commit cf59e1e4c79bf741905484cdb13c130b53576a16 ] Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned. The UBSAN warning calltrace like below: UBSAN: shift-out-of-bounds in sound/core/seq/seq_clientmgr.c:509:22 left shift of 1 by 31 places cannot be represented in type 'int' ... Call Trace: <TASK> dump_stack_lvl+0x8d/0xcf ubsan_epilogue+0xa/0x44 __ubsan_handle_shift_out_of_bounds+0x1e7/0x208 snd_seq_deliver_single_event.constprop.21+0x191/0x2f0 snd_seq_deliver_event+0x1a2/0x350 snd_seq_kernel_client_dispatch+0x8b/0xb0 snd_seq_client_notify_subscription+0x72/0xa0 snd_seq_ioctl_subscribe_port+0x128/0x160 snd_seq_kernel_client_ctl+0xce/0xf0 snd_seq_oss_create_client+0x109/0x15b alsa_seq_oss_init+0x11c/0x1aa do_one_initcall+0x80/0x440 kernel_init_freeable+0x370/0x3c3 kernel_init+0x1b/0x190 ret_from_fork+0x1f/0x30 </TASK> Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Signed-off-by: Baisong Zhong <zhongbaisong@huawei.com> Link: https://lore.kernel.org/r/20221121111630.3119259-1-zhongbaisong@huawei.com Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-01-18 11:41:04 +01:00
Greg Kroah-Hartman	39c4c9c65c	This is the 5.4.226 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmORuw8ACgkQONu9yGCS aT4qeRAAjtp+p7ECcaXqZ4vHIka9IGcwRhjWbeB/xFCOgKKbOOLmZP9Cql1pJdEp grdcp/tjNAwi1ec80+G/3AaAWqGRFHYi/Tboe+ZSHIp4Oot78fSclMp6lCMh/bzC eR6niNNNlrEUC/lj0h5lWRJvQd6MK4orSCOCybeJ+HRmrLcm1pGSuJmssHoBn7Xk JHg3RR5OW4BU4UHQHmcJfeH+J5zfNH0ygu1L3MRqzoINWUJ7PtSrIdR5xCm/4ibr oyOH0nenC3hkOM4atui/92dX3HsNxazuA51Ch0AANFRiKYjJBIXMitapi1BvpqfB Ny1I95j37Tuys4OQhJhNlbvHgxdNmouEHH06SwY8+yaU6LPkrFtdD0AxIDofakBZ Npy9AkYmvj14ARAeyqzswxSQGWuuvlDjJR3dId/kIuP8wcRcNWsrFefHs0YZxhjn o0LKmpkw5QgjW7Gh8TKEdl4saAXZwLXV00gHN9DD6UOr4eYNHtBHUJg6zMN5aR19 Dco+UTJj1NlmlEBDP6pFp9LTAcTsjVh6FVpX+uMRs18+kXS3SxzPgB9qEwjerU5m HA0pzc+BgZqHpu3LhkbC4JfGNJ9fHnVZe6fT6/kTt3SiaEtLx8JKvH6VsCHVgEv6 whY3hlS4bWII8Jey0ZS8BtyKJiku3zfGDXAQ3rpwGbX1ddDn+d8= =qI32 -----END PGP SIGNATURE----- Merge 5.4.226 into android11-5.4-lts Changes in 5.4.226 wifi: mac80211: fix memory free error when registering wiphy fail wifi: mac80211_hwsim: fix debugfs attribute ps with rc table support audit: fix undefined behavior in bit shift for AUDIT_BIT wifi: mac80211: Fix ack frame idr leak when mesh has no route spi: stm32: fix stm32_spi_prepare_mbr() that halves spi clk for every run drm: panel-orientation-quirks: Add quirk for Acer Switch V 10 (SW5-017) block, bfq: fix null pointer dereference in bfq_bio_bfqg() arm64/syscall: Include asm/ptrace.h in syscall_wrapper header. RISC-V: vdso: Do not add missing symbols to version section in linker script MIPS: pic32: treat port as signed integer af_key: Fix send_acquire race with pfkey_register ARM: dts: am335x-pcm-953: Define fixed regulators in root node ASoC: sgtl5000: Reset the CHIP_CLK_CTRL reg on remove regulator: core: fix kobject release warning and memory leak in regulator_register() regulator: core: fix UAF in destroy_regulator() bus: sunxi-rsb: Support atomic transfers tee: optee: fix possible memory leak in optee_register_device() ARM: dts: at91: sam9g20ek: enable udc vbus gpio pinctrl net: liquidio: simplify if expression nfc/nci: fix race with opening and closing net: pch_gbe: fix potential memleak in pch_gbe_tx_queue() 9p/fd: fix issue of list_del corruption in p9_fd_cancel() ARM: mxs: fix memory leak in mxs_machine_init() net/mlx4: Check retval of mlx4_bitmap_init net/qla3xxx: fix potential memleak in ql3xxx_send() net: pch_gbe: fix pci device refcount leak while module exiting nfp: add port from netdev validation for EEPROM access Drivers: hv: vmbus: fix double free in the error path of vmbus_add_channel_work() Drivers: hv: vmbus: fix possible memory leak in vmbus_device_register() net/mlx5: Fix FW tracer timestamp calculation tipc: set con sock in tipc_conn_alloc tipc: add an extra conn_get in tipc_conn_alloc tipc: check skb_linearize() return value in tipc_disc_rcv() xfrm: Fix ignored return value in xfrm6_init() NFC: nci: fix memory leak in nci_rx_data_packet() regulator: twl6030: re-add TWL6032_SUBCLASS bnx2x: fix pci device refcount leak in bnx2x_vf_is_pcie_pending() dccp/tcp: Reset saddr on failure after inet6?_hash_connect(). s390/dasd: fix no record found for raw_track_access nfc: st-nci: fix incorrect validating logic in EVT_TRANSACTION nfc: st-nci: fix memory leaks in EVT_TRANSACTION net: thunderx: Fix the ACPI memory leak s390/crashdump: fix TOD programmable field size lib/vdso: use "grep -E" instead of "egrep" usb: dwc3: exynos: Fix remove() function arm64: dts: rockchip: lower rk3399-puma-haikou SD controller clock frequency iio: light: apds9960: fix wrong register for gesture gain iio: core: Fix entry not deleted when iio_register_sw_trigger_type() fails init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash nios2: add FORCE for vmlinuz.gz iio: ms5611: Simplify IO callback parameters iio: pressure: ms5611: fixed value compensation bug ceph: do not update snapshot context when there is no new snapshot ceph: avoid putting the realm twice when decoding snaps fails firmware: google: Release devices before unregistering the bus firmware: coreboot: Register bus in module init nilfs2: fix nilfs_sufile_mark_dirty() not set segment usage as dirty gcov: clang: fix the buffer overflow issue Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode ASoC: Intel: bytcht_es8316: Add quirk for the Nanote UMPC-01 serial: 8250: 8250_omap: Avoid RS485 RTS glitch on ->set_termios() xen/platform-pci: add missing free_irq() in error path platform/x86: asus-wmi: add missing pci_dev_put() in asus_wmi_set_xusb2pr() platform/x86: acer-wmi: Enable SW_TABLET_MODE on Switch V 10 (SW5-017) platform/x86: hp-wmi: Ignore Smart Experience App event tcp: configurable source port perturb table size net: usb: qmi_wwan: add Telit 0x103a composition dm integrity: flush the journal on suspend binder: avoid potential data leakage when copying txn binder: read pre-translated fds from sender buffer binder: defer copies of pre-patched txn data binder: fix pointer cast warning binder: Address corner cases in deferred copy and fixup binder: Gracefully handle BINDER_TYPE_FDA objects with num_fds=0 btrfs: free btrfs_path before copying root refs to userspace btrfs: free btrfs_path before copying fspath to userspace btrfs: free btrfs_path before copying subvol info to userspace btrfs: sysfs: normalize the error handling branch in btrfs_init_sysfs() drm/amd/dc/dce120: Fix audio register mapping, stop triggering KASAN drm/amdgpu: always register an MMU notifier for userptr drm/i915: fix TLB invalidation for Gen12 video and compute engines fuse: lock inode unconditionally in fuse_fallocate() btrfs: free btrfs_path before copying inodes to userspace spi: spi-imx: Fix spi_bus_clk if requested clock is higher than input clock btrfs: move QUOTA_ENABLED check to rescan_should_stop from btrfs_qgroup_rescan_worker drm/amdgpu: update drm_display_info correctly when the edid is read drm/amdgpu: Partially revert "drm/amdgpu: update drm_display_info correctly when the edid is read" btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() iio: health: afe4403: Fix oob read in afe4403_read_raw iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw iio: light: rpr0521: add missing Kconfig dependencies scripts/faddr2line: Fix regression in name resolution on ppc64le hwmon: (i5500_temp) fix missing pci_disable_device() hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails of: property: decrement node refcount in of_fwnode_get_reference_args() net/mlx5: Fix uninitialized variable bug in outlen_write() net/mlx5e: Fix use-after-free when reverting termination table can: sja1000_isa: sja1000_isa_probe(): add missing free_sja1000dev() can: cc770: cc770_isa_probe(): add missing free_cc770dev() qlcnic: fix sleep-in-atomic-context bugs caused by msleep wifi: cfg80211: fix buffer overflow in elem comparison net: phy: fix null-ptr-deref while probe() failed net: net_netdev: Fix error handling in ntb_netdev_init_module() net/9p: Fix a potential socket leak in p9_socket_open net: ethernet: nixge: fix NULL dereference dsa: lan9303: Correct stat name net: hsr: Fix potential use-after-free afs: Fix fileserver probe RTT handling net: tun: Fix use-after-free in tun_detach() packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE sctp: fix memory leak in sctp_stream_outq_migrate() net: ethernet: renesas: ravb: Fix promiscuous mode after system resumed hwmon: (coretemp) Check for null before removing sysfs attrs hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() net/mlx5: DR, Fix uninitialized var warning error-injection: Add prompt for function error injection tools/vm/slabinfo-gnuplot: use "grep -E" instead of "egrep" nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() x86/bugs: Make sure MSR_SPEC_CTRL is updated properly upon resume from S3 pinctrl: intel: Save and restore pins in "direct IRQ" mode mmc: mmc_test: Fix removal of debugfs file mmc: core: Fix ambiguous TRIM and DISCARD arg mmc: sdhci-esdhc-imx: correct CQHCI exit halt state check mmc: sdhci-sprd: Fix no reset data and command after voltage switch tracing: Free buffers when a used dynamic event is removed arm64: Fix panic() when Spectre-v2 causes Spectre-BHB to re-allocate KVM vectors arm64: errata: Fix KVM Spectre-v2 mitigation selection for Cortex-A57/A72 mm: Fix '.data.once' orphan section warning ASoC: ops: Fix bounds check for _sx controls pinctrl: single: Fix potential division by zero iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() parisc: Increase size of gcc stack frame check xtensa: increase size of gcc stack frame check parisc: Increase FRAME_WARN to 2048 bytes on parisc Kconfig.debug: provide a little extra FRAME_WARN leeway when KASAN is enabled selftests: net: add delete nexthop route warning test selftests: net: fix nexthop warning cleanup double ip typo ipv4: Handle attempt to delete multipath route when fib_info contains an nh reference ipv4: Fix route deletion when nexthop info is not specified tracing/ring-buffer: Have polling block on watermark epoll: call final ep_events_available() check under the lock epoll: check for events when removing a timed out thread from the wait queue nvme: restrict management ioctls to admin nvme: ensure subsystem reset is single threaded x86/tsx: Add a feature bit for TSX control MSR support x86/pm: Add enumeration check before spec MSRs save/restore setup Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM x86/ioremap: Fix page aligned size calculation in __ioremap_caller() Revert "clocksource/drivers/riscv: Events are stopped during CPU suspend" char: tpm: Protect tpm_pm_suspend with locks mmc: sdhci: use FIELD_GET for preset value bit masks mmc: sdhci: Fix voltage switch delay proc: avoid integer type confusion in get_proc_long proc: proc_skip_spaces() shouldn't think it is working on C strings v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() fails ipc/sem: Fix dangling sem_array access in semtimedop race Linux 5.4.226 Change-Id: I20fe6cd332455ffff094b2be6afa8302b20db571 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2022-12-08 16:50:20 +00:00
Gaosheng Cui	1f75f9c1af	audit: fix undefined behavior in bit shift for AUDIT_BIT ... [ Upstream commit 986d93f55bdeab1cac858d1e47b41fac10b2d7f6 ] Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned. The UBSAN warning calltrace like below: UBSAN: shift-out-of-bounds in kernel/auditfilter.c:179:23 left shift of 1 by 31 places cannot be represented in type 'int' Call Trace: <TASK> dump_stack_lvl+0x7d/0xa5 dump_stack+0x15/0x1b ubsan_epilogue+0xe/0x4e __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c audit_register_class+0x9d/0x137 audit_classes_init+0x4d/0xb8 do_one_initcall+0x76/0x430 kernel_init_freeable+0x3b3/0x422 kernel_init+0x24/0x1e0 ret_from_fork+0x1f/0x30 </TASK> Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com> [PM: remove bad 'Fixes' tag as issue predates git, added in v2.6.6-rc1] Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-12-08 11:22:57 +01:00
Greg Kroah-Hartman	17d66a1fd0	This is the 5.4.225 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmOA8KAACgkQONu9yGCS aT4gDQ//bzrHgBr7HQxbW1uI6g8SyjAyhLLP41kCv7uEdq/kzCm3moAo60VA59tR SsCj74NaQrZwcdRrfW+hTeayX+VOBlDFMHaeetwetPGw8ON3KGDeu0OVSJQZExVM sBXA6oT95R3Gw3tOFO/rPJj+X+GLgY9IRODeOdedeNPwEu0X0GOGm1gLKv857mWw WD13Zn85RqoV7XzEVL1jN1DEN31VbqIwr/b0hf02c1kAn5oErsHRZTx9yg32Wjq6 TPcrIN/SImysHTui5HMJvRHPOkacY3Iw1UmXThnrrskMX5tljhi++3qcsTokekbv qgARIRT/zC7CJHcLud7Q9+iG1IHYWnrraOhNZehAaK713hrmyBzFx8xJOkjE+041 BcY3BASrB39+Nx5cPMe66ArCBzRPS2ALbpJGu49Az4/Oh9+QFsrx68O3hjvBK/ev zefqhPXjGyOiiW/WHydpDavGy93g6JT9100XAvbF3lb4AMPH0BDhy9MfNuqlynuW 5acfRZTKVlcrXTSe+zQBQfIFXYCh1euLyMDzTvQUpIvArSl3Tn6UMJ7MflVITlGQ vLLhkYSyo0WN6/PruU8aUNh0dDBgh323K5bAjen3OinbdQND3abDXMMNLI6pCWx7 jgoM//tDSWfiNHdqNcpCYRIAP5NjjInx0+k/F7KWM9/Y3Xhr3T4= =2ZWO -----END PGP SIGNATURE----- Merge 5.4.225 into android11-5.4-lts Changes in 5.4.225 xfs: preserve rmapbt swapext block reservation from freed blocks xfs: rename xfs_bmap_is_real_extent to is_written_extent xfs: redesign the reflink remap loop to fix blkres depletion crash xfs: use MMAPLOCK around filemap_map_pages() xfs: preserve inode versioning across remounts xfs: drain the buf delwri queue before xfsaild idles phy: stm32: fix an error code in probe wifi: cfg80211: silence a sparse RCU warning wifi: cfg80211: fix memory leak in query_regdb_file() bpf, sockmap: Fix the sk->sk_forward_alloc warning of sk_stream_kill_queues HID: hyperv: fix possible memory leak in mousevsc_probe() net: gso: fix panic on frag_list with mixed head alloc types net: tun: Fix memory leaks of napi_get_frags bnxt_en: Fix possible crash in bnxt_hwrm_set_coal() bnxt_en: fix potentially incorrect return value for ndo_rx_flow_steer net: fman: Unregister ethernet device on removal capabilities: fix undefined behavior in bit shift for CAP_TO_MASK net: lapbether: fix issue of dev reference count leakage in lapbeth_device_event() hamradio: fix issue of dev reference count leakage in bpq_device_event() drm/vc4: Fix missing platform_unregister_drivers() call in vc4_drm_register() ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network can: af_can: fix NULL pointer dereference in can_rx_register() tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header dmaengine: pxa_dma: use platform_get_irq_optional dmaengine: mv_xor_v2: Fix a resource leak in mv_xor_v2_remove() drivers: net: xgene: disable napi when register irq failed in xgene_enet_open() perf stat: Fix printing os->prefix in CSV metrics output net: nixge: disable napi when enable interrupts failed in nixge_open() net/mlx5: Allow async trigger completion execution on single CPU systems net: cpsw: disable napi in cpsw_ndo_open() net: cxgb3_main: disable napi when bind qsets failed in cxgb_up() cxgb4vf: shut down the adapter when t4vf_update_port_info() failed in cxgb4vf_open() ethernet: s2io: disable napi when start nic failed in s2io_card_up() net: mv643xx_eth: disable napi when init rxq or txq failed in mv643xx_eth_open() ethernet: tundra: free irq when alloc ring failed in tsi108_open() net: macvlan: fix memory leaks of macvlan_common_newlink riscv: process: fix kernel info leakage arm64: efi: Fix handling of misaligned runtime regions and drop warning MIPS: jump_label: Fix compat branch range check mmc: cqhci: Provide helper for resetting both SDHCI and CQHCI mmc: sdhci-of-arasan: Fix SDHCI_RESET_ALL for CQHCI mmc: sdhci-tegra: Fix SDHCI_RESET_ALL for CQHCI ALSA: hda/ca0132: add quirk for EVGA Z390 DARK ALSA: hda: fix potential memleak in 'add_widget_node' ALSA: usb-audio: Add quirk entry for M-Audio Micro ALSA: usb-audio: Add DSD support for Accuphase DAC-60 vmlinux.lds.h: Fix placement of '.data..decrypted' section nilfs2: fix deadlock in nilfs_count_free_blocks() nilfs2: fix use-after-free bug of ns_writer on remount drm/i915/dmabuf: fix sg_table handling in map_dma_buf platform/x86: hp_wmi: Fix rfkill causing soft blocked wifi btrfs: selftests: fix wrong error check in btrfs_free_dummy_root() udf: Fix a slab-out-of-bounds write bug in udf_find_entry() can: j1939: j1939_send_one(): fix missing CAN header initialization cert host tools: Stop complaining about deprecated OpenSSL functions dmaengine: at_hdmac: Fix at_lli struct definition dmaengine: at_hdmac: Don't start transactions at tx_submit level dmaengine: at_hdmac: Fix completion of unissued descriptor in case of errors dmaengine: at_hdmac: Don't allow CPU to reorder channel enable dmaengine: at_hdmac: Fix impossible condition dmaengine: at_hdmac: Check return code of dma_async_device_register net: tun: call napi_schedule_prep() to ensure we own a napi x86/cpu: Restore AMD's DE_CFG MSR after resume ASoC: wm5102: Revert "ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe" ASoC: wm5110: Revert "ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe" ASoC: wm8997: Revert "ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe" ASoC: wm8962: Add an event handler for TEMP_HP and TEMP_SPK spi: intel: Fix the offset to get the 64K erase opcode ASoC: codecs: jz4725b: add missed Line In power control bit ASoC: codecs: jz4725b: fix reported volume for Master ctl ASoC: codecs: jz4725b: use right control for Capture Volume ASoC: codecs: jz4725b: fix capture selector naming selftests/futex: fix build for clang selftests/intel_pstate: fix build for ARCH=x86_64 NFSv4: Retry LOCK on OLD_STATEID during delegation return i2c: i801: add lis3lv02d's I2C address for Vostro 5568 drm/imx: imx-tve: Fix return type of imx_tve_connector_mode_valid btrfs: remove pointless and double ulist frees in error paths of qgroup tests Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm ASoC: codecs: jz4725b: Fix spelling mistake "Sourc" -> "Source", "Routee" -> "Route" spi: stm32: Print summary 'callbacks suppressed' message ASoC: core: Fix use-after-free in snd_soc_exit() serial: 8250_omap: remove wait loop from Errata i202 workaround serial: 8250: omap: Fix unpaired pm_runtime_put_sync() in omap8250_remove() serial: 8250: omap: Flush PM QOS work on remove serial: imx: Add missing .thaw_noirq hook tty: n_gsm: fix sleep-in-atomic-context bug in gsm_control_send ASoC: soc-utils: Remove __exit for snd_soc_util_exit() block: sed-opal: kmalloc the cmd/resp buffers siox: fix possible memory leak in siox_device_add() parport_pc: Avoid FIFO port location truncation pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map arm64: dts: imx8mm: Fix NAND controller size-cells arm64: dts: imx8mn: Fix NAND controller size-cells ata: libata-transport: fix double ata_host_put() in ata_tport_add() net: bgmac: Drop free_netdev() from bgmac_enet_remove() mISDN: fix possible memory leak in mISDN_dsp_element_register() net: liquidio: release resources when liquidio driver open failed mISDN: fix misuse of put_device() in mISDN_register_device() net: macvlan: Use built-in RCU list checking net: caif: fix double disconnect client in chnl_net_open() bnxt_en: Remove debugfs when pci_register_driver failed xen/pcpu: fix possible memory leak in register_pcpu() drbd: use after free in drbd_create_device() platform/x86/intel: pmc: Don't unconditionally attach Intel PMC when virtualized net/x25: Fix skb leak in x25_lapb_receive_frame() cifs: Fix wrong return value checking when GETFLAGS net: thunderbolt: Fix error handling in tbnet_init() cifs: add check for returning value of SMB2_set_info_init ftrace: Fix the possible incorrect kernel message ftrace: Optimize the allocation for mcount entries ftrace: Fix null pointer dereference in ftrace_add_mod() ring_buffer: Do not deactivate non-existant pages ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open() Revert "usb: dwc3: disable USB core PHY management" slimbus: stream: correct presence rate frequencies speakup: fix a segfault caused by switching consoles USB: serial: option: add Sierra Wireless EM9191 USB: serial: option: remove old LARA-R6 PID USB: serial: option: add u-blox LARA-R6 00B modem USB: serial: option: add u-blox LARA-L6 modem USB: serial: option: add Fibocom FM160 0x0111 composition usb: add NO_LPM quirk for Realforce 87U Keyboard usb: chipidea: fix deadlock in ci_otg_del_timer iio: adc: at91_adc: fix possible memory leak in at91_adc_allocate_trigger() iio: trigger: sysfs: fix possible memory leak in iio_sysfs_trig_init() iio: pressure: ms5611: changed hardcoded SPI speed to value limited dm ioctl: fix misbehavior if list_versions races with module loading serial: 8250: Fall back to non-DMA Rx if IIR_RDI occurs serial: 8250_lpss: Configure DMA also w/o DMA filter Input: iforce - invert valid length check when fetching device IDs scsi: zfcp: Fix double free of FSF request when qdio send fails mmc: core: properly select voltage range without power cycle mmc: sdhci-pci-o2micro: fix card detect fail issue caused by CD# debounce timeout mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put() docs: update mediator contact information in CoC doc misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() serial: 8250: Flush DMA Rx on RLSI ring-buffer: Include dropped pages in counting dirty patches scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus() kprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case Input: i8042 - fix leaking of platform device on module removal macvlan: enforce a consistent minimal mtu tcp: cdg: allow tcp_cdg_release() to be called multiple times kcm: avoid potential race in kcm_tx_work bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() kcm: close race conditions on sk_receive_queue 9p: trans_fd/p9_conn_cancel: drop client lock earlier gfs2: Check sb_bsize_shift after reading superblock gfs2: Switch from strlcpy to strscpy 9p/trans_fd: always use O_NONBLOCK read/write mm: fs: initialize fsdata passed to write_begin/write_end interface ntfs: fix use-after-free in ntfs_attr_find() ntfs: fix out-of-bounds read in ntfs_attr_find() ntfs: check overflow when iterating ATTR_RECORDs Linux 5.4.225 Change-Id: I7c04b5784804b3883c8cac2b860e6ddfef6f5e1f Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2022-11-29 16:39:04 +00:00
Gaosheng Cui	5661f111a1	capabilities: fix undefined behavior in bit shift for CAP_TO_MASK ... [ Upstream commit 46653972e3ea64f79e7f8ae3aa41a4d3fdb70a13 ] Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned. The UBSAN warning calltrace like below: UBSAN: shift-out-of-bounds in security/commoncap.c:1252:2 left shift of 1 by 31 places cannot be represented in type 'int' Call Trace: <TASK> dump_stack_lvl+0x7d/0xa5 dump_stack+0x15/0x1b ubsan_epilogue+0xe/0x4e __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c cap_task_prctl+0x561/0x6f0 security_task_prctl+0x5a/0xb0 __x64_sys_prctl+0x61/0x8f0 do_syscall_64+0x58/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK> Fixes: e338d263a7 ("Add 64-bit capability support to the kernel") Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com> Acked-by: Andrew G. Morgan <morgan@kernel.org> Reviewed-by: Serge Hallyn <serge@hallyn.com> Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-11-25 17:42:05 +01:00
Greg Kroah-Hartman	644fd1c691	This is the 5.4.223 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmNj1rwACgkQONu9yGCS aT5DQQ//VUpdKaGoc4SWxavdRxCvmTnD20NuoylngKyIyK3qFvGu2abm9jRwJj3u /7f9uA+bv2mV9DrmhMPglrEj6h8qULa9tGRNffsiIcMHIRmooYnqi83LgxqGSeg+ jDCNZnHDFbHx/HyGG+P2kOXIWVKG33vl64XvXDCb9GvkDJB0zVjOsxP5iw7z6CBT 1FF6hH0sxIf2KYLgqMpkMdjbThcFlx0hxMM3n+95PHl10jTXuZloH/xb0iYCfCH2 0FvrMosrLpYbJSI9NkYN+cxRPBX1pHLqb5sksFdiyjDoqXICTtSVuNTMdn7BY6E3 vnKqD8qaTBmfT+Xw4EBpJOXcJCGiH9p/XVZ+EHurgRnxQTZnJF27t1cqC86WUC2e Nl5GvmzATvzrjAif1PlbRWjJlYzVORF4V0vlK8q9cK2INncwvm+2xQWkT85h1RYz i32kJhsiZHf5h+ZeQ9eJX9UNJ0uur4CatwkOhtSTCtCNQCZgygSBmaYunmhiN3U/ mr/BN0Hcntc2hirN16inUpNAQGt5ho4K8VIp0drozYNLSFUfXCNBsXmlmpt2J/yz VpaW39HpBQx7ZbejukhS9eFR56t2cJoNf9PlTqOyuS0waflsXYYGCSnhNyWhwzih vtz26NgWfquqf0Ini+thq0g0dIjljK99cQzVn4QITniuCL7W5IQ= =n7Va -----END PGP SIGNATURE----- Merge 5.4.223 into android11-5.4-lts Changes in 5.4.223 can: j1939: transport: j1939_session_skb_drop_old(): spin_unlock_irqrestore() before kfree_skb() can: kvaser_usb: Fix possible completions during init_completion ALSA: Use del_timer_sync() before freeing timer ALSA: au88x0: use explicitly signed char USB: add RESET_RESUME quirk for NVIDIA Jetson devices in RCM usb: dwc3: gadget: Stop processing more requests on IMI usb: dwc3: gadget: Don't set IMI for no_interrupt usb: bdc: change state when port disconnected usb: xhci: add XHCI_SPURIOUS_SUCCESS to ASM1042 despite being a V0.96 controller mtd: rawnand: marvell: Use correct logic for nand-keep-config xhci: Remove device endpoints from bandwidth list when freeing the device tools: iio: iio_utils: fix digit calculation iio: light: tsl2583: Fix module unloading fbdev: smscufx: Fix several use-after-free bugs mac802154: Fix LQI recording drm/msm/dsi: fix memory corruption with too many bridges drm/msm/hdmi: fix memory corruption with too many bridges mmc: core: Fix kernel panic when remove non-standard SDIO card kernfs: fix use-after-free in __kernfs_remove perf auxtrace: Fix address filter symbol name match for modules s390/futex: add missing EX_TABLE entry to __futex_atomic_op() s390/pci: add missing EX_TABLE entries to __pcistg_mio_inuser()/__pcilg_mio_inuser() xfs: finish dfops on every insert range shift iteration xfs: clear XFS_DQ_FREEING if we can't lock the dquot buffer to flush xfs: force the log after remapping a synchronous-writes file Xen/gntdev: don't ignore kernel unmapping error xen/gntdev: Prevent leaking grants cgroup-v1: add disabled controller check in cgroup1_parse_param() mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages net: ieee802154: fix error return code in dgram_bind() media: v4l2: Fix v4l2_i2c_subdev_set_name function documentation drm/msm: Fix return type of mdp4_lvds_connector_mode_valid arc: iounmap() arg is volatile ALSA: ac97: fix possible memory leak in snd_ac97_dev_register() tipc: fix a null-ptr-deref in tipc_topsrv_accept net: netsec: fix error handling in netsec_register_mdio() x86/unwind/orc: Fix unreliable stack dump with gcov amd-xgbe: fix the SFP compliance codes check for DAC cables amd-xgbe: add the bit rate quirk for Molex cables kcm: annotate data-races around kcm->rx_psock kcm: annotate data-races around kcm->rx_wait net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed net: lantiq_etop: don't free skb when returning NETDEV_TX_BUSY tcp: fix indefinite deferral of RTO with SACK reneging can: mscan: mpc5xxx: mpc5xxx_can_probe(): add missing put_clock() in error path PM: hibernate: Allow hybrid sleep to work with s2idle media: vivid: s_fbuf: add more sanity checks media: vivid: dev->bitmap_cap wasn't freed in all cases media: v4l2-dv-timings: add sanity checks for blanking values media: videodev2.h: V4L2_DV_BT_BLANKING_HEIGHT should check 'interlaced' i40e: Fix ethtool rx-flow-hash setting for X722 i40e: Fix VF hang when reset is triggered on another VF i40e: Fix flow-type by setting GL_HASH_INSET registers net: ksz884x: fix missing pci_disable_device() on error in pcidev_init() PM: domains: Fix handling of unavailable/disabled idle states ALSA: aoa: i2sbus: fix possible memory leak in i2sbus_add_dev() ALSA: aoa: Fix I2S device accounting openvswitch: switch from WARN to pr_warn net: ehea: fix possible memory leak in ehea_register_port() nh: fix scope used to find saddr when adding non gw nh net/mlx5e: Do not increment ESN when updating IPsec ESN state net/mlx5: Fix possible use-after-free in async command interface net: enetc: survive memory pressure without crashing can: rcar_canfd: rcar_canfd_handle_global_receive(): fix IRQ storm on global FIFO receive Linux 5.4.223 Change-Id: I87028aec53aae948264a6aca2a6d2b217b710378 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2022-11-16 16:06:47 +00:00
Hans Verkuil	d303dabe7e	media: videodev2.h: V4L2_DV_BT_BLANKING_HEIGHT should check 'interlaced' ... [ Upstream commit 8da7f0976b9071b528c545008de9d10cc81883b1 ] If it is a progressive (non-interlaced) format, then ignore the interlaced timing values. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Fixes: 7f68127fa1 ([media] videodev2.h: defines to calculate blanking and frame sizes) Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-11-03 23:56:56 +09:00
Greg Kroah-Hartman	05426a3d4f	This is the 5.4.211 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmMHPogACgkQONu9yGCS aT6GgQ//eILgoV9jHOdWFDlOqWz80zTFxPo2d1Fyd+jKbxI9Joj6raMfyhbNQA5z sNS6B21FTC1V9TkPwt3/TaghYZlBvYutcIUWVgxvKHM2m2QCyiS6Y7VgfnqTVU2J C6Ri0zabWf0X2eahdDAd0uOxhejSbewo+3Xfv2Y090kOWKxj5b1SjQoo7/OapBFi 8ZZ60qamP5/Qfs3rTiVNDYHqY+n1okYuOpEL78Zh/imGC71ZfyKVZgAe/WHHaXtQ KBug0mmr/9K2yMFYdXmuPdOZrS66A2sklsaw+WdXIboZKhAMF16KkkNvN2BExX5G Hf03MRfCAEFDndhGO16X07WDNIr/CQaEYLjAn6PE1cGnIncQMw2vyWMHGiNlOdLO JZiOcyVEW6cao7vLmQD/Rk6x44nOlm+ttzxMD2spHwAU4tSM7aM0SrAvM201R8Vc 6hs6m1+NQr9XNEiH+QT+A4+cbIeOd/b8hkQdjB/uvlS0HTUNu4SGNlL7s3nwuB8D a1chV1VbmYfIjSyY6ffr3hNrTHfHSZN2M5otK2iDmvYlTrrbOAu6sPXCWHKskKSf Dm43Le+NaZmBHSS36ejcQKGdNpZ35H7uQ89bzuo5/kisQ4fY4VnQSYFNgmnRAY+s nOvbrj7M4K+QvumYBT1efoMrMYgXRYQSQOc03Mq7AQYuJBrQv/4= =U/Z1 -----END PGP SIGNATURE----- Merge 5.4.211 into android11-5.4-lts Changes in 5.4.211 Makefile: link with -z noexecstack --no-warn-rwx-segments x86: link vdso and boot with -z noexecstack --no-warn-rwx-segments scsi: Revert "scsi: qla2xxx: Fix disk failure to rediscover" ALSA: bcd2000: Fix a UAF bug on the error path of probing igc: Remove _I_PHY_ID checking wifi: mac80211_hwsim: fix race condition in pending packet wifi: mac80211_hwsim: add back erroneously removed cast wifi: mac80211_hwsim: use 32-bit skb cookie add barriers to buffer_uptodate and set_buffer_uptodate HID: wacom: Only report rotation for art pen HID: wacom: Don't register pad_input for touch switch KVM: nVMX: Snapshot pre-VM-Enter BNDCFGS for !nested_run_pending case KVM: nVMX: Snapshot pre-VM-Enter DEBUGCTL for !nested_run_pending case KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 KVM: nVMX: Let userspace set nVMX MSR to any _host_ supported value KVM: x86: Mark TSS busy during LTR emulation _after_ all fault checks KVM: x86: Set error code to segment selector on LLDT/LTR non-canonical #GP mm/mremap: hold the rmap lock in write mode when moving page table entries. ALSA: hda/conexant: Add quirk for LENOVO 20149 Notebook model ALSA: hda/cirrus - support for iMac 12,1 model ALSA: hda/realtek: Add quirk for another Asus K42JZ model tty: vt: initialize unicode screen buffer vfs: Check the truncate maximum size in inode_newsize_ok() fs: Add missing umask strip in vfs_tmpfile thermal: sysfs: Fix cooling_device_stats_setup() error code path fbcon: Fix boundary checks for fbcon=vc:n1-n2 parameters usbnet: Fix linkwatch use-after-free on disconnect ovl: drop WARN_ON() dentry is NULL in ovl_encode_fh() parisc: Fix device names in /proc/iomem parisc: io_pgetevents_time64() needs compat syscall in 32-bit compat mode drm/gem: Properly annotate WW context on drm_gem_lock_reservations() error drm/nouveau: fix another off-by-one in nvbios_addr drm/amdgpu: Check BO's requested pinning domains against its preferred_domains iio: light: isl29028: Fix the warning in isl29028_remove() fuse: limit nsec serial: mvebu-uart: uart2 error bits clearing md-raid10: fix KASAN warning ia64, processor: fix -Wincompatible-pointer-types in ia64_get_irr() PCI: Add defines for normal and subtractive PCI bridges powerpc/fsl-pci: Fix Class Code of PCIe Root Port powerpc/ptdump: Fix display of RW pages on FSL_BOOK3E powerpc/powernv: Avoid crashing if rng is NULL MIPS: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK coresight: Clear the connection field properly USB: HCD: Fix URB giveback issue in tasklet function ARM: dts: uniphier: Fix USB interrupts for PXs2 SoC arm64: dts: uniphier: Fix USB interrupts for PXs3 SoC netfilter: nf_tables: do not allow SET_ID to refer to another table netfilter: nf_tables: do not allow RULE_ID to refer to another chain netfilter: nf_tables: fix null deref due to zeroed list head epoll: autoremove wakers even more aggressively x86: Handle idle=nomwait cmdline properly for x86_idle arm64: Do not forget syscall when starting a new thread. arm64: fix oops in concurrently setting insn_emulation sysctls ext2: Add more validity checks for inode counts genirq: Don't return error on missing optional irq_request_resources() wait: Fix __wait_event_hrtimeout for RT/DL tasks ARM: dts: imx6ul: add missing properties for sram ARM: dts: imx6ul: change operating-points to uint32-matrix ARM: dts: imx6ul: fix csi node compatible ARM: dts: imx6ul: fix lcdif node compatible ARM: dts: imx6ul: fix qspi node compatible spi: synquacer: Add missing clk_disable_unprepare() ARM: OMAP2+: display: Fix refcount leak bug ACPI: EC: Remove duplicate ThinkPad X1 Carbon 6th entry from DMI quirks ACPI: PM: save NVS memory for Lenovo G40-45 ACPI: LPSS: Fix missing check in register_device_clock() arm64: dts: qcom: ipq8074: fix NAND node name arm64: dts: allwinner: a64: orangepi-win: Fix LED node name ARM: shmobile: rcar-gen2: Increase refcount for new reference PM: hibernate: defer device probing when resuming from hibernation selinux: Add boundary check in put_entry() spi: spi-rspi: Fix PIO fallback on RZ platforms ARM: findbit: fix overflowing offset meson-mx-socinfo: Fix refcount leak in meson_mx_socinfo_init ARM: bcm: Fix refcount leak in bcm_kona_smc_init x86/pmem: Fix platform-device leak in error path ARM: dts: ast2500-evb: fix board compatible ARM: dts: ast2600-evb: fix board compatible soc: fsl: guts: machine variable might be unset ARM: dts: qcom: mdm9615: add missing PMIC GPIO reg ARM: OMAP2+: Fix refcount leak in omapdss_init_of ARM: OMAP2+: Fix refcount leak in omap3xxx_prm_late_init cpufreq: zynq: Fix refcount leak in zynq_get_revision soc: qcom: aoss: Fix refcount leak in qmp_cooling_devices_register ARM: dts: qcom: pm8841: add required thermal-sensor-cells bus: hisi_lpc: fix missing platform_device_put() in hisi_lpc_acpi_probe() arm64: dts: mt7622: fix BPI-R64 WPS button erofs: avoid consecutive detection for Highmem memory blk-mq: don't create hctx debugfs dir until q->debugfs_dir is created regulator: of: Fix refcount leak bug in of_get_regulation_constraints() nohz/full, sched/rt: Fix missed tick-reenabling bug in dequeue_task_rt() thermal/tools/tmon: Include pthread and time headers in tmon.h dm: return early from dm_pr_call() if DM device is suspended ath10k: do not enforce interrupt trigger type wifi: rtlwifi: fix error codes in rtl_debugfs_set_write_h2c() drm/mipi-dbi: align max_chunk to 2 in spi_transfer drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers() drm/mediatek: Add pull-down MIPI operation in mtk_dsi_poweroff function drm: adv7511: override i2c address of cec before accessing it i2c: Fix a potential use after free media: tw686x: Register the irq at the end of probe ath9k: fix use-after-free in ath9k_hif_usb_rx_cb wifi: iwlegacy: 4965: fix potential off-by-one overflow in il4965_rs_fill_link_cmd() drm: bridge: adv7511: Add check for mipi_dsi_driver_register drm/mcde: Fix refcount leak in mcde_dsi_bind media: hdpvr: fix error value returns in hdpvr_read drm/vc4: plane: Remove subpixel positioning check drm/vc4: plane: Fix margin calculations for the right/bottom edges drm/vc4: dsi: Correct DSI divider calculations crypto: arm64/gcm - Select AEAD for GHASH_ARM64_CE drm/rockchip: vop: Don't crash for invalid duplicate_state() drm/rockchip: Fix an error handling path rockchip_dp_probe() drm/mediatek: dpi: Remove output format of YUV drm/mediatek: dpi: Only enable dpi after the bridge is enabled drm: bridge: sii8620: fix possible off-by-one drm/msm/mdp5: Fix global state lock backoff crypto: hisilicon - Kunpeng916 crypto driver don't sleep when in softirq media: platform: mtk-mdp: Fix mdp_ipi_comm structure alignment mediatek: mt76: mac80211: Fix missing of_node_put() in mt76_led_init() drm/exynos/exynos7_drm_decon: free resources when clk_set_parent() failed. tcp: make retransmitted SKB fit into the send window libbpf: Fix the name of a reused map selftests: timers: valid-adjtimex: build fix for newer toolchains selftests: timers: clocksource-switch: fix passing errors from child fs: check FMODE_LSEEK to control internal pipe splicing wifi: wil6210: debugfs: fix info leak in wil_write_file_wmi() wifi: p54: Fix an error handling path in p54spi_probe() wifi: p54: add missing parentheses in p54_flush() selftests/bpf: fix a test for snprintf() overflow can: pch_can: do not report txerr and rxerr during bus-off can: rcar_can: do not report txerr and rxerr during bus-off can: sja1000: do not report txerr and rxerr during bus-off can: hi311x: do not report txerr and rxerr during bus-off can: sun4i_can: do not report txerr and rxerr during bus-off can: kvaser_usb_hydra: do not report txerr and rxerr during bus-off can: kvaser_usb_leaf: do not report txerr and rxerr during bus-off can: usb_8dev: do not report txerr and rxerr during bus-off can: error: specify the values of data[5..7] of CAN error frames can: pch_can: pch_can_error(): initialize errc before using it Bluetooth: hci_intel: Add check for platform_driver_register i2c: cadence: Support PEC for SMBus block read i2c: mux-gpmux: Add of_node_put() when breaking out of loop wifi: wil6210: debugfs: fix uninitialized variable use in `wil_write_file_wmi()` wifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue wifi: libertas: Fix possible refcount leak in if_usb_probe() net/mlx5e: Fix the value of MLX5E_MAX_RQ_NUM_MTTS crypto: inside-secure - Add missing MODULE_DEVICE_TABLE for of iavf: Fix max_rate limiting netdevsim: Avoid allocation warnings triggered from user space net: rose: fix netdev reference changes dccp: put dccp_qpolicy_full() and dccp_qpolicy_push() in the same lock clk: renesas: r9a06g032: Fix UART clkgrp bitsel mtd: maps: Fix refcount leak in of_flash_probe_versatile mtd: maps: Fix refcount leak in ap_flash_init mtd: rawnand: meson: Fix a potential double free issue HID: cp2112: prevent a buffer overflow in cp2112_xfer() mtd: sm_ftl: Fix deadlock caused by cancel_work_sync in sm_release mtd: partitions: Fix refcount leak in parse_redboot_of mtd: st_spi_fsm: Add a clk_disable_unprepare() in .probe()'s error path fpga: altera-pr-ip: fix unsigned comparison with less than zero usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe usb: ohci-nxp: Fix refcount leak in ohci_hcd_nxp_probe usb: xhci: tegra: Fix error check clk: mediatek: reset: Fix written reset bit offset misc: rtsx: Fix an error handling path in rtsx_pci_probe() driver core: fix potential deadlock in __driver_attach clk: qcom: clk-krait: unlock spin after mux completion usb: host: xhci: use snprintf() in xhci_decode_trb() clk: qcom: ipq8074: fix NSS port frequency tables clk: qcom: ipq8074: set BRANCH_HALT_DELAY flag for UBI clocks clk: qcom: camcc-sdm845: Fix topology around titan_top power domain soundwire: bus_type: fix remove and shutdown support intel_th: Fix a resource leak in an error handling path intel_th: msu-sink: Potential dereference of null pointer intel_th: msu: Fix vmalloced buffers staging: rtl8192u: Fix sleep in atomic context bug in dm_fsync_timer_callback mmc: sdhci-of-esdhc: Fix refcount leak in esdhc_signal_voltage_switch memstick/ms_block: Fix some incorrect memory allocation memstick/ms_block: Fix a memory leak mmc: sdhci-of-at91: fix set_uhs_signaling rewriting of MC1R scsi: smartpqi: Fix DMA direction for RAID requests usb: gadget: udc: amd5536 depends on HAS_DMA RDMA/hns: Fix incorrect clearing of interrupt status register RDMA/siw: Fix duplicated reported IW_CM_EVENT_CONNECT_REPLY event RDMA/hfi1: fix potential memory leak in setup_base_ctxt() gpio: gpiolib-of: Fix refcount bugs in of_mm_gpiochip_add_data() mmc: cavium-octeon: Add of_node_put() when breaking out of loop mmc: cavium-thunderx: Add of_node_put() when breaking out of loop HID: alps: Declare U1_UNICORN_LEGACY support PCI: tegra194: Fix Root Port interrupt handling PCI: tegra194: Fix link up retry sequence USB: serial: fix tty-port initialized comments platform/olpc: Fix uninitialized data in debugfs write mm/mmap.c: fix missing call to vm_unacct_memory in mmap_region RDMA/rxe: Fix error unwind in rxe_create_qp() null_blk: fix ida error handling in null_add_dev() jbd2: fix outstanding credits assert in jbd2_journal_commit_transaction() ext4: recover csum seed of tmp_inode after migrating to extents jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted opp: Fix error check in dev_pm_opp_attach_genpd() ASoC: mediatek: mt8173: Fix refcount leak in mt8173_rt5650_rt5676_dev_probe ASoC: mt6797-mt6351: Fix refcount leak in mt6797_mt6351_dev_probe ASoC: codecs: da7210: add check for i2c_add_driver ASoC: mediatek: mt8173-rt5650: Fix refcount leak in mt8173_rt5650_dev_probe serial: 8250_dw: Store LSR into lsr_saved_flags in dw8250_tx_wait_empty() ASoC: codecs: msm8916-wcd-digital: move gains from SX_TLV to S8_TLV ASoC: codecs: wcd9335: move gains from SX_TLV to S8_TLV profiling: fix shift too large makes kernel panic tty: n_gsm: fix non flow control frames during mux flow off tty: n_gsm: fix packet re-transmission without open control channel tty: n_gsm: fix race condition in gsmld_write() remoteproc: qcom: wcnss: Fix handling of IRQs vfio/ccw: Do not change FSM state in subchannel event tty: n_gsm: fix wrong T1 retry count handling tty: n_gsm: fix DM command tty: n_gsm: fix missing corner cases in gsmld_poll() iommu/exynos: Handle failed IOMMU device registration properly rpmsg: qcom_smd: Fix refcount leak in qcom_smd_parse_edge kfifo: fix kfifo_to_user() return type mfd: t7l66xb: Drop platform disable callback mfd: max77620: Fix refcount leak in max77620_initialise_fps iommu/arm-smmu: qcom_iommu: Add of_node_put() when breaking out of loop s390/zcore: fix race when reading from hardware system area ASoC: qcom: q6dsp: Fix an off-by-one in q6adm_alloc_copp() fuse: Remove the control interface for virtio-fs ASoC: audio-graph-card: Add of_node_put() in fail path watchdog: armada_37xx_wdt: check the return value of devm_ioremap() in armada_37xx_wdt_probe() video: fbdev: amba-clcd: Fix refcount leak bugs video: fbdev: sis: fix typos in SiS_GetModeID() powerpc/32: Do not allow selection of e5500 or e6500 CPUs on PPC32 powerpc/pci: Prefer PCI domain assignment via DT 'linux,pci-domain' and alias powerpc/spufs: Fix refcount leak in spufs_init_isolated_loader powerpc/xive: Fix refcount leak in xive_get_max_prio powerpc/cell/axon_msi: Fix refcount leak in setup_msi_msg_address perf symbol: Fail to read phdr workaround kprobes: Forbid probing on trampoline and BPF code areas powerpc/pci: Fix PHB numbering when using opal-phbid genelf: Use HAVE_LIBCRYPTO_SUPPORT, not the never defined HAVE_LIBCRYPTO scripts/faddr2line: Fix vmlinux detection on arm64 x86/numa: Use cpumask_available instead of hardcoded NULL check video: fbdev: arkfb: Fix a divide-by-zero bug in ark_set_pixclock() tools/thermal: Fix possible path truncations video: fbdev: vt8623fb: Check the size of screen before memset_io() video: fbdev: arkfb: Check the size of screen before memset_io() video: fbdev: s3fb: Check the size of screen before memset_io() scsi: zfcp: Fix missing auto port scan and thus missing target ports scsi: qla2xxx: Fix discovery issues in FC-AL topology scsi: qla2xxx: Turn off multi-queue for 8G adapters scsi: qla2xxx: Fix erroneous mailbox timeout after PCI error injection x86/olpc: fix 'logical not is only applied to the left hand side' spmi: trace: fix stack-out-of-bound access in SPMI tracing functions kexec, KEYS, s390: Make use of built-in and secondary keyring for signature verification tpm: eventlog: Fix section mismatch for DEBUG_SECTION_MISMATCH btrfs: reset block group chunk force if we have to wait ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h ext4: make sure ext4_append() always allocates new block ext4: fix use-after-free in ext4_xattr_set_entry ext4: update s_overhead_clusters in the superblock during an on-line resize ext4: fix extent status tree race in writeback error recovery path ext4: correct max_inline_xattr_value_size computing ext4: correct the misjudgment in ext4_iget_extra_inode intel_th: pci: Add Raptor Lake-S CPU support intel_th: pci: Add Raptor Lake-S PCH support intel_th: pci: Add Meteor Lake-P support dm raid: fix address sanitizer warning in raid_resume dm raid: fix address sanitizer warning in raid_status dm thin: fix use-after-free crash in dm_sm_register_threshold_callback dm writecache: set a default MAX_WRITEBACK_JOBS ACPI: CPPC: Do not prevent CPPC from working in the future timekeeping: contribute wall clock to rng on time change firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) net_sched: cls_route: remove from list when handle is 0 btrfs: reject log replay if there is unsupported RO compat flag KVM: Add infrastructure and macro to mark VM as bugged KVM: x86: Check lapic_in_kernel() before attempting to set a SynIC irq KVM: x86: Avoid theoretical NULL pointer dereference in kvm_irq_delivery_to_apic_fast() tcp: fix over estimation in sk_forced_mem_schedule() scsi: sg: Allow waiting for commands to complete on removed device Revert "net: usb: ax88179_178a needs FLAG_SEND_ZLP" Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression net/9p: Initialize the iounit field during fid creation net_sched: cls_route: disallow handle of 0 ALSA: info: Fix llseek return value when using callback rds: add missing barrier to release_refill ata: libata-eh: Add missing command name mmc: pxamci: Fix another error handling path in pxamci_probe() mmc: pxamci: Fix an error handling path in pxamci_probe() btrfs: fix lost error handling when looking up extended ref on log replay tracing: Have filter accept "common_cpu" to be consistent can: ems_usb: fix clang's -Wunaligned-access warning apparmor: fix quiet_denied for file rules apparmor: fix absroot causing audited secids to begin with = apparmor: Fix failed mount permission check error message apparmor: fix aa_label_asxprint return check apparmor: fix overlapping attachment computation apparmor: fix reference count leak in aa_pivotroot() apparmor: Fix memleak in aa_simple_write_to_buffer() Documentation: ACPI: EINJ: Fix obsolete example NFSv4.1: Don't decrease the value of seq_nr_highest_sent NFSv4.1: Handle NFS4ERR_DELAY replies to OP_SEQUENCE correctly NFSv4: Fix races in the legacy idmapper upcall NFSv4.1: RECLAIM_COMPLETE must handle EACCES NFSv4/pnfs: Fix a use-after-free bug in open can: mcp251x: Fix race condition on receive interrupt sunrpc: fix expiry of auth creds SUNRPC: Reinitialise the backchannel request buffers before reuse devlink: Fix use-after-free after a failed reload net: bgmac: Fix a BUG triggered by wrong bytes_compl pinctrl: nomadik: Fix refcount leak in nmk_pinctrl_dt_subnode_to_map pinctrl: qcom: msm8916: Allow CAMSS GP clocks to be muxed pinctrl: sunxi: Add I/O bias setting for H6 R-PIO ACPI: property: Return type of acpi_add_nondev_subnodes() should be bool geneve: do not use RT_TOS for IPv6 flowlabel plip: avoid rcu debug splat vsock: Fix memory leak in vsock_connect() vsock: Set socket state back to SS_UNCONNECTED in vsock_connect_timeout() dt-bindings: arm: qcom: fix MSM8916 MTP compatibles tools/vm/slabinfo: use alphabetic order when two values are equal tools build: Switch to new openssl API for test-libcrypto NTB: ntb_tool: uninitialized heap data in tool_fn_write() nfp: ethtool: fix the display error of `ethtool -m DEVNAME` xen/xenbus: fix return type in xenbus_file_read() atm: idt77252: fix use-after-free bugs caused by tst_timer dpaa2-eth: trace the allocated address instead of page struct tee: add overflow check in register_shm_helper() nios2: page fault et.al. are *not* restartable syscalls... nios2: don't leave NULLs in sys_call_table[] nios2: traced syscall does need to check the syscall number nios2: fix syscall restart checks nios2: restarts apply only to the first sigframe we build... nios2: add force_successful_syscall_return() iavf: Fix adminq error handling clk: rockchip: add sclk_mac_lbtest to rk3188_critical_clocks netfilter: nf_tables: really skip inactive sets when allocating name powerpc/pci: Fix get_phb_number() locking net: dsa: mv88e6060: prevent crash on an unused port net: moxa: pass pdev instead of ndev to DMA functions net: dsa: microchip: ksz9477: fix fdb_dump last invalid entry ice: Ignore EEXIST when setting promisc mode i40e: Fix to stop tx_timeout recovery if GLOBR fails fec: Fix timer capture timing in `fec_ptp_enable_pps()` igb: Add lock to avoid data race gcc-plugins: Undefine LATENT_ENTROPY_PLUGIN when plugin disabled for a file locking/atomic: Make test_and_*_bit() ordered on failure drm/meson: Fix refcount bugs in meson_vpu_has_available_connectors() PCI: Add ACS quirk for Broadcom BCM5750x NICs usb: cdns3 fix use-after-free at workaround 2 usb: gadget: uvc: call uvc uvcg_warn on completed status instead of uvcg_info irqchip/tegra: Fix overflow implicit truncation warnings drm/meson: Fix overflow implicit truncation warnings usb: host: ohci-ppc-of: Fix refcount leak bug usb: renesas: Fix refcount leak bug vboxguest: Do not use devm for irq clk: qcom: ipq8074: dont disable gcc_sleep_clk_src scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input gadgetfs: ep_io - wait until IRQ finishes cxl: Fix a memory leak in an error handling path PCI/ACPI: Guard ARM64-specific mcfg_quirks um: add "noreboot" command line option for PANIC_TIMEOUT=-1 setups selftests/kprobe: Do not test for GRP/ without event failures dmaengine: sprd: Cleanup in .remove() after pm_runtime_get_sync() failed nvmet-tcp: fix lockdep complaint on nvmet_tcp_wq flush during queue teardown drivers:md:fix a potential use-after-free bug ext4: avoid remove directory when directory is corrupted ext4: avoid resizing to a partial cluster size lib/list_debug.c: Detect uninitialized lists tty: serial: Fix refcount leak bug in ucc_uart.c vfio: Clear the caps->buf to NULL after free mips: cavium-octeon: Fix missing of_node_put() in octeon2_usb_clocks_start riscv: mmap with PROT_WRITE but no PROT_READ is invalid RISC-V: Add fast call path of crash_kexec() watchdog: export lockup_detector_reconfigure powerpc/32: Don't always pass -mcpu=powerpc to the compiler ALSA: core: Add async signal helpers ALSA: timer: Use deferred fasync helper f2fs: fix to avoid use f2fs_bug_on() in f2fs_new_node_page() smb3: check xattr value length earlier powerpc/64: Init jump labels before parse_early_param() video: fbdev: i740fb: Check the argument of i740_calc_vclk() MIPS: tlbex: Explicitly compare _PAGE_NO_EXEC against 0 tracing/probes: Have kprobes and uprobes use $COMM too can: j1939: j1939_sk_queue_activate_next_locked(): replace WARN_ON_ONCE with netdev_warn_once() can: j1939: j1939_session_destroy(): fix memory leak of skbs btrfs: only write the sectors in the vertical stripe which has data stripes btrfs: raid56: don't trust any cached sector in __raid56_parity_recover() Linux 5.4.211 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I509fd58b7896bfeaa41497f558a2bfc079e46656	2022-08-25 12:12:16 +02:00
Vincent Mailhol	a025f6ca15	can: error: specify the values of data[5..7] of CAN error frames ... [ Upstream commit e70a3263a7eed768d5f947b8f2aff8d2a79c9d97 ] Currently, data[5..7] of struct can_frame, when used as a CAN error frame, are defined as being "controller specific". Device specific behaviours are problematic because it prevents someone from writing code which is portable between devices. As a matter of fact, data[5] is never used, data[6] is always used to report TX error counter and data[7] is always used to report RX error counter. can-utils also relies on this. This patch updates the comment in the uapi header to specify that data[5] is reserved (and thus should not be used) and that data[6..7] are used for error counters. Fixes: 0d66548a10 ("[CAN]: Add PF_CAN core module") Link: https://lore.kernel.org/all/20220719143550.3681-11-mailhol.vincent@wanadoo.fr Signed-off-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-08-25 11:17:47 +02:00
Andy Lutomirski	c4edc1055c	random: ignore GRND_RANDOM in getentropy(2) ... commit 48446f198f9adcb499b30332488dfd5bc3f176f6 upstream. The separate blocking pool is going away. Start by ignoring GRND_RANDOM in getentropy(2). This should not materially break any API. Any code that worked without this change should work at least as well with this change. Signed-off-by: Andy Lutomirski <luto@kernel.org> Link: https://lore.kernel.org/r/705c5a091b63cc5da70c99304bb97e0109be0a26.1577088521.git.luto@kernel.org Signed-off-by: Theodore Ts'o <tytso@mit.edu> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-06-22 14:11:03 +02:00
Andy Lutomirski	7f9f864af0	random: add GRND_INSECURE to return best-effort non-cryptographic bytes ... commit 75551dbf112c992bc6c99a972990b3f272247e23 upstream. Signed-off-by: Andy Lutomirski <luto@kernel.org> Link: https://lore.kernel.org/r/d5473b56cf1fa900ca4bd2b3fc1e5b8874399919.1577088521.git.luto@kernel.org Signed-off-by: Theodore Ts'o <tytso@mit.edu> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-06-22 14:11:03 +02:00
Greg Kroah-Hartman	0cf7a2be06	This is the 5.4.196 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmKN12MACgkQONu9yGCS aT4Uvg/8DPgL4dM+jKZ4R16cbJU1rpvY0pJEcYsepqLFXdHDSLBA04eakCXO8k+x Ksy0kXvZuVGRRl25OuTGoTPvsmdx/D0R+XNSEvh9KPWVHdcB5FoDM4TskBz8vENR NDfNyWImmnE2xRCxi7GjTXI7RAyaiEDGbHtpoO+E7EN3EWv1JyhkhBhL0mBpQLGk gfzjdn7W2s5RbvH4XQFxdF5AgvnQZdMp5L92DC14/77Uo7fZXcU1VUGvASacpYu8 A2z3jZBRI+YDMeLSGXdha5LDT2KoAUu5WE9Ms3OjEOn4jfoOmPDxEwsbpupFlk/i PRclY1oitWkOgLTTg+ZO/h72tj+kPaczVryVcdM4NKvC+10xyXHk2snW0JUxO1cI Kls9d3f0ADBeb5bUrHc6zBk0sj4Bx8sGWigZCUEU1QCirTj/83F3g+RwM0dSuS6g HFw5DTZ8WvPfn9SH2RQi6D4lOZydifxOOcD72iZiyt4rOpsNkO1BY74L8oNHPcuv ukYQinLttpCiuHJFU4SYjsqH5FRkpqaun0ovD9SF8icEIJM0igI0ZJ+AMZf9ZnQJ Ws7aijqwzoFw1GcKxNYFwDxRa5Q85pVwXkl6YS46lZGP70hqrVBgxBG/pBDBY+M7 lPtszi1Pp/9LpUIZdJLjEDIULWM3qVPLEY6EEtC70syue+XKevU= =ZjkQ -----END PGP SIGNATURE----- Merge 5.4.196 into android11-5.4-lts Changes in 5.4.196 floppy: use a statically allocated error counter x86/xen: Make the boot CPU idle task reliable x86/xen: Make the secondary CPU idle tasks reliable rtc: fix use-after-free on device removal um: Cleanup syscall_handler_t definition/cast, fix warning Input: add bounds checking to input_set_capability() Input: stmfts - fix reference leak in stmfts_input_open crypto: stm32 - fix reference leak in stm32_crc_remove crypto: x86/chacha20 - Avoid spurious jumps to other functions ALSA: hda/realtek: Enable headset mic on Lenovo P360 nvme-multipath: fix hang when disk goes live over reconnect rtc: mc146818-lib: Fix the AltCentury for AMD platforms MIPS: lantiq: check the return value of kzalloc() drbd: remove usage of list iterator variable after loop platform/chrome: cros_ec_debugfs: detach log reader wq from devm ARM: 9191/1: arm/stacktrace, kasan: Silence KASAN warnings in unwind_frame() nilfs2: fix lockdep warnings in page operations for btree nodes nilfs2: fix lockdep warnings during disk space reclamation mmc: core: Specify timeouts for BKOPS and CACHE_FLUSH for eMMC mmc: block: Use generic_cmd6_time when modifying INAND_CMD38_ARG_EXT_CSD mmc: core: Default to generic_cmd6_time as timeout in __mmc_switch() SUNRPC: Clean up scheduling of autoclose SUNRPC: Prevent immediate close+reconnect SUNRPC: Don't call connect() more than once on a TCP socket SUNRPC: Ensure we flush any closed sockets before xs_xprt_free() ALSA: wavefront: Proper check of get_user() error perf: Fix sys_perf_event_open() race against self Fix double fget() in vhost_net_set_backend() PCI/PM: Avoid putting Elo i2 PCIe Ports in D3cold KVM: x86/mmu: Update number of zapped pages even if page list is stable crypto: qcom-rng - fix infinite loop on requests not multiple of WORD_SZ drm/dp/mst: fix a possible memory leak in fetch_monitor_name() dma-buf: fix use of DMA_BUF_SET_NAME_{A,B} in userspace ARM: dts: aspeed-g6: remove FWQSPID group in pinctrl dtsi ARM: dts: aspeed-g6: fix SPI1/SPI2 quad pin group net: macb: Increment rx bd head after allocating skb and buffer net/sched: act_pedit: sanitize shift argument before usage net: vmxnet3: fix possible use-after-free bugs in vmxnet3_rq_alloc_rx_buf() net: vmxnet3: fix possible NULL pointer dereference in vmxnet3_rq_cleanup() ice: fix possible under reporting of ethtool Tx and Rx statistics clk: at91: generated: consider range when calculating best rate net/qla3xxx: Fix a test in ql_reset_work() NFC: nci: fix sleep in atomic context bugs caused by nci_skb_alloc net/mlx5e: Properly block LRO when XDP is enabled net: af_key: add check for pfkey_broadcast in function pfkey_process ARM: 9196/1: spectre-bhb: enable for Cortex-A15 ARM: 9197/1: spectre-bhb: fix loop8 sequence for Thumb2 igb: skip phy status check where unavailable net: bridge: Clear offload_fwd_mark when passing frame up bridge interface. gpio: gpio-vf610: do not touch other bits when set the target bit gpio: mvebu/pwm: Refuse requests with inverted polarity perf bench numa: Address compiler error on s390 scsi: qla2xxx: Fix missed DMA unmap for aborted commands mac80211: fix rx reordering with non explicit / psmp ack policy selftests: add ping test with ping_group_range tuned ethernet: tulip: fix missing pci_disable_device() on error in tulip_init_one() net: stmmac: fix missing pci_disable_device() on error in stmmac_pci_probe() net: atlantic: verify hw_head_ lies within TX buffer ring Input: ili210x - fix reset timing block: return ELEVATOR_DISCARD_MERGE if possible net: stmmac: disable Split Header (SPH) for Intel platforms firmware_loader: use kernel credentials when reading firmware ARM: dts: imx7: Use audio_mclk_post_div instead audio_mclk_root_clk Reinstate some of "swiotlb: rework "fix info leak with DMA_FROM_DEVICE"" x86/xen: fix booting 32-bit pv guest x86/xen: Mark cpu_bringup_and_idle() as dead_end_function i2c: mt7621: fix missing clk_disable_unprepare() on error in mtk_i2c_probe() afs: Fix afs_getattr() to refetch file status if callback break occurred Linux 5.4.196 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I8464b114a6d5d655386f3c794bbb8bbc3a94e0ec	2022-05-25 10:40:14 +02:00
Jérôme Pouiller	fe2a9469ec	dma-buf: fix use of DMA_BUF_SET_NAME_{A,B} in userspace ... commit 7c3e9fcad9c7d8bb5d69a576044fb16b1d2e8a01 upstream. The typedefs u32 and u64 are not available in userspace. Thus user get an error he try to use DMA_BUF_SET_NAME_A or DMA_BUF_SET_NAME_B: $ gcc -Wall -c -MMD -c -o ioctls_list.o ioctls_list.c In file included from /usr/include/x86_64-linux-gnu/asm/ioctl.h:1, from /usr/include/linux/ioctl.h:5, from /usr/include/asm-generic/ioctls.h:5, from ioctls_list.c:11: ioctls_list.c:463:29: error: ‘u32’ undeclared here (not in a function) 463 | { "DMA_BUF_SET_NAME_A", DMA_BUF_SET_NAME_A, -1, -1 }, // linux/dma-buf.h | ^~~~~~~~~~~~~~~~~~ ioctls_list.c:464:29: error: ‘u64’ undeclared here (not in a function) 464 | { "DMA_BUF_SET_NAME_B", DMA_BUF_SET_NAME_B, -1, -1 }, // linux/dma-buf.h | ^~~~~~~~~~~~~~~~~~ The issue was initially reported here[1]. [1]: https://github.com/jerome-pouiller/ioctl/pull/14 Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com> Reviewed-by: Christian König <christian.koenig@amd.com> Fixes: a5bff92eaac4 ("dma-buf: Fix SET_NAME ioctl uapi") CC: stable@vger.kernel.org Link: https://patchwork.freedesktop.org/patch/msgid/20220517072708.245265-1-Jerome.Pouiller@silabs.com Signed-off-by: Christian König <christian.koenig@amd.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-05-25 09:14:35 +02:00
Greg Kroah-Hartman	023cd1cf3f	This is the 5.4.189 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmJZYqcACgkQONu9yGCS aT51cA/+PXr+24MJMwa0PyLuQO9YScRAu/4E8PtEkumpj5dA9FuWJCcuNwO9cmNp YM6IdGGbHfW+JRsX3wLAothut1ID9hfl+Y2tpBFJacS7E5ezgzoiAF1ke8RsBxd/ s+sRwZqRfSVoVmwYGj9/SwXLzJJTdPwY/FwXUdsyxxkn8u99YmAURlNUZdv0+KWs vmAvS6mj4M4GfazS9FfBhnUVMcxbDgY0/rNlek2rMQi1ValvrYeNBATjKMI/NrkR /bRTplCezuDFDw82IqQfiqGQ71mMbpYFXxkbdXsJj3nhIJ1AimWRQhLRg/TqJOi4 0Hhx3cEk/5hs/22VBN9sIYIAbJr+z7Kr9gnhltAETPOrv0s9w9fnJARve5GlwSHV yKBm3Pfq0+abAQ2urnsmiHFvMMzFaiNuWe98TOF0BHkJbwMSFQpgFtp0yWx2bgMf Svx/rEXzd2Cx0h5X4dHAMykPqsJAek0qIb4MgOPAEpuZWLZ09xfXOeVc8lTbHG22 y/HfKE+4FMTw8tsAe/7E7xP+yjosPrAq8De2ymMo9NGDFxT8I9ro+gkqwMWwC+yi trYDVFEX3NNIEG9D6Oh+eP2nY97U898wCI1GFU18J9zOPQsw4peHSS8xPW7vLbqy zrzOxMKW+2khSwj/wFlSXRaj3pogP5/y4jaAXpMSse0Zb3Neu2U= =p4tc -----END PGP SIGNATURE----- Merge 5.4.189 into android11-5.4-lts Changes in 5.4.189 swiotlb: fix info leak with DMA_FROM_DEVICE USB: serial: pl2303: add IBM device IDs USB: serial: simple: add Nokia phone driver netdevice: add the case if dev is NULL HID: logitech-dj: add new lightspeed receiver id xfrm: fix tunnel model fragmentation behavior virtio_console: break out of buf poll on remove ethernet: sun: Free the coherent when failing in probing spi: Fix invalid sgs value net:mcf8390: Use platform_get_irq() to get the interrupt spi: Fix erroneous sgs value with min_t() af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register net: dsa: microchip: add spi_device_id tables iommu/iova: Improve 32-bit free space estimate tpm: fix reference counting for struct tpm_chip block: Add a helper to validate the block size virtio-blk: Use blk_validate_block_size() to validate block size USB: usb-storage: Fix use of bitfields for hardware data in ene_ub6250.c xhci: fix runtime PM imbalance in USB2 resume xhci: make xhci_handshake timeout for xhci_reset() adjustable xhci: fix uninitialized string returned by xhci_decode_ctrl_ctx() coresight: Fix TRCCONFIGR.QE sysfs interface iio: afe: rescale: use s64 for temporary scale calculations iio: inkern: apply consumer scale on IIO_VAL_INT cases iio: inkern: apply consumer scale when no channel scale is available iio: inkern: make a best effort on offset calculation greybus: svc: fix an error handling bug in gb_svc_hello() clk: uniphier: Fix fixed-rate initialization ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE KEYS: fix length validation in keyctl_pkey_params_get_2() Documentation: add link to stable release candidate tree Documentation: update stable tree link HID: intel-ish-hid: Use dma_alloc_coherent for firmware update SUNRPC: avoid race between mod_timer() and del_timer_sync() NFSD: prevent underflow in nfssvc_decode_writeargs() NFSD: prevent integer overflow on 32 bit systems f2fs: fix to unlock page correctly in error path of is_alive() f2fs: quota: fix loop condition at f2fs_quota_sync() f2fs: fix to do sanity check on .cp_pack_total_block_count pinctrl: samsung: drop pin banks references on error paths spi: mxic: Fix the transmit path can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path jffs2: fix use-after-free in jffs2_clear_xattr_subsystem jffs2: fix memory leak in jffs2_do_mount_fs jffs2: fix memory leak in jffs2_scan_medium mm/pages_alloc.c: don't create ZONE_MOVABLE beyond the end of a node mm: invalidate hwpoison page cache page in fault path mempolicy: mbind_range() set_policy() after vma_merge() scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands qed: display VF trust config qed: validate and restrict untrusted VFs vlan promisc mode riscv: Fix fill_callchain return value Revert "Input: clear BTN_RIGHT/MIDDLE on buttonpads" ALSA: cs4236: fix an incorrect NULL check on list iterator ALSA: hda/realtek: Fix audio regression on Mi Notebook Pro 2020 mm,hwpoison: unmap poisoned page before invalidation mm/kmemleak: reset tag when compare object pointer drbd: fix potential silent data corruption powerpc/kvm: Fix kvm_use_magic_page udp: call udp_encap_enable for v6 sockets when enabling encap ACPI: properties: Consistently return -ENOENT if there are no more references drivers: hamradio: 6pack: fix UAF bug caused by mod_timer() mailbox: tegra-hsp: Flush whole channel block: don't merge across cgroup boundaries if blkcg is enabled drm/edid: check basic audio support on CEA extension block video: fbdev: sm712fb: Fix crash in smtcfb_read() video: fbdev: atari: Atari 2 bpp (STe) palette bugfix ARM: dts: at91: sama5d2: Fix PMERRLOC resource size ARM: dts: exynos: fix UART3 pins configuration in Exynos5250 ARM: dts: exynos: add missing HDMI supplies on SMDK5250 ARM: dts: exynos: add missing HDMI supplies on SMDK5420 carl9170: fix missing bit-wise or operator for tx_params thermal: int340x: Increase bitmap size lib/raid6/test: fix multiple definition linking error crypto: rsa-pkcs1pad - correctly get hash from source scatterlist crypto: rsa-pkcs1pad - restore signature length check crypto: rsa-pkcs1pad - fix buffer overread in pkcs1pad_verify_complete() DEC: Limit PMAX memory probing to R3k systems media: davinci: vpif: fix unbalanced runtime PM get xtensa: fix stop_machine_cpuslocked call in patch_text xtensa: fix xtensa_wsr always writing 0 brcmfmac: firmware: Allocate space for default boardrev in nvram brcmfmac: pcie: Release firmwares in the brcmf_pcie_setup error path brcmfmac: pcie: Replace brcmf_pcie_copy_mem_todev with memcpy_toio brcmfmac: pcie: Fix crashes due to early IRQs PCI: pciehp: Clear cmd_busy bit in polling mode regulator: qcom_smd: fix for_each_child.cocci warnings crypto: authenc - Fix sleep in atomic context in decrypt_tail crypto: mxs-dcp - Fix scatterlist processing spi: tegra114: Add missing IRQ check in tegra_spi_probe selftests/x86: Add validity check and allow field splitting audit: log AUDIT_TIME_* records only from rules crypto: ccree - don't attempt 0 len DMA mappings spi: pxa2xx-pci: Balance reference count for PCI DMA device hwmon: (pmbus) Add mutex to regulator ops hwmon: (sch56xx-common) Replace WDOG_ACTIVE with WDOG_HW_RUNNING block: don't delete queue kobject before its children PM: hibernate: fix __setup handler error handling PM: suspend: fix return value of __setup handler hwrng: atmel - disable trng on failure path crypto: vmx - add missing dependencies clocksource/drivers/timer-of: Check return value of of_iomap in timer_of_base_init() ACPI: APEI: fix return value of __setup handlers crypto: ccp - ccp_dmaengine_unregister release dma channels hwmon: (pmbus) Add Vin unit off handling clocksource: acpi_pm: fix return value of __setup handler sched/debug: Remove mpol_get/put and task_lock/unlock from sched_show_numa perf/core: Fix address filter parser for multiple filters perf/x86/intel/pt: Fix address filter config for 32-bit kernel f2fs: fix missing free nid in f2fs_handle_failed_inode f2fs: fix to avoid potential deadlock media: bttv: fix WARNING regression on tunerless devices media: coda: Fix missing put_device() call in coda_get_vdoa_data media: hantro: Fix overfill bottom register field name media: aspeed: Correct value for h-total-pixels video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe() video: fbdev: atmel_lcdfb: fix an error code in atmel_lcdfb_probe() video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name() ARM: dts: qcom: ipq4019: fix sleep clock soc: qcom: rpmpd: Check for null return of devm_kcalloc soc: qcom: aoss: remove spurious IRQF_ONESHOT flags arm64: dts: qcom: sm8150: Correct TCS configuration for apps rsc soc: ti: wkup_m3_ipc: Fix IRQ check in wkup_m3_ipc_probe ARM: dts: imx: Add missing LVDS decoder on M53Menlo media: video/hdmi: handle short reads of hdmi info frame. media: em28xx: initialize refcount before kref_get media: usb: go7007: s2250-board: fix leak in probe() uaccess: fix nios2 and microblaze get_user_8() ASoC: rt5663: check the return value of devm_kzalloc() in rt5663_parse_dp() ASoC: ti: davinci-i2s: Add check for clk_enable() ALSA: spi: Add check for clk_enable() arm64: dts: ns2: Fix spi-cpol and spi-cpha property arm64: dts: broadcom: Fix sata nodename printk: fix return value of printk.devkmsg __setup handler ASoC: mxs-saif: Handle errors for clk_enable ASoC: atmel_ssc_dai: Handle errors for clk_enable ASoC: soc-compress: prevent the potentially use of null pointer memory: emif: Add check for setup_interrupts memory: emif: check the pointer temp in get_device_details() ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction arm64: dts: rockchip: Fix SDIO regulator supply properties on rk3399-firefly media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe ASoC: wm8350: Handle error for wm8350_register_irq ASoC: fsi: Add check for clk_enable video: fbdev: omapfb: Add missing of_node_put() in dvic_probe_of ivtv: fix incorrect device_caps for ivtvfb ASoC: dmaengine: do not use a NULL prepare_slave_config() callback ASoC: mxs: Fix error handling in mxs_sgtl5000_probe ASoC: imx-es8328: Fix error return code in imx_es8328_probe() ASoC: msm8916-wcd-digital: Fix missing clk_disable_unprepare() in msm8916_wcd_digital_probe mmc: davinci_mmc: Handle error for clk_enable ASoC: msm8916-wcd-analog: Fix error handling in pm8916_wcd_analog_spmi_probe drm/bridge: Fix free wrong object in sii8620_init_rcp_input_dev drm/bridge: Add missing pm_runtime_disable() in __dw_mipi_dsi_probe ath10k: fix memory overwrite of the WoWLAN wakeup packet pattern udmabuf: validate ubuf->pagecount Bluetooth: hci_serdev: call init_rwsem() before p->open() mtd: onenand: Check for error irq mtd: rawnand: gpmi: fix controller timings setting drm/edid: Don't clear formats if using deep color drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes() ath9k_htc: fix uninit value bugs KVM: PPC: Fix vmx/vsx mixup in mmio emulation i40e: don't reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb power: reset: gemini-poweroff: Fix IRQ check in gemini_poweroff_probe ray_cs: Check ioremap return value powerpc/perf: Don't use perf_hw_context for trace IMC PMU mt76: mt7603: check sta_rates pointer in mt7603_sta_rate_tbl_update mt76: mt7615: check sta_rates pointer in mt7615_sta_rate_tbl_update net: dsa: mv88e6xxx: Enable port policy support on 6097 PCI: aardvark: Fix reading PCI_EXP_RTSTA_PME bit on emulated bridge power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports iommu/ipmmu-vmsa: Check for error num after setting mask drm/amd/display: Add affected crtcs to atomic state for dsc mst unplug IB/cma: Allow XRC INI QPs to set their local ACK timeout dax: make sure inodes are flushed before destroy cache iwlwifi: Fix -EIO error code that is never returned iwlwifi: mvm: Fix an error code in iwl_mvm_up() dm crypt: fix get_key_size compiler warning if !CONFIG_KEYS scsi: pm8001: Fix command initialization in pm80XX_send_read_log() scsi: pm8001: Fix command initialization in pm8001_chip_ssp_tm_req() scsi: pm8001: Fix payload initialization in pm80xx_set_thermal_config() scsi: pm8001: Fix abort all task initialization drm/amd/display: Remove vupdate_int_entry definition TOMOYO: fix __setup handlers return values ext2: correct max file size computing drm/tegra: Fix reference leak in tegra_dsi_ganged_probe power: supply: bq24190_charger: Fix bq24190_vbus_is_enabled() wrong false return scsi: hisi_sas: Change permission of parameter prot_mask drm/bridge: cdns-dsi: Make sure to to create proper aliases for dt bpf, arm64: Call build_prologue() first in first JIT pass bpf, arm64: Feed byte-offset into bpf line info libbpf: Skip forward declaration when counting duplicated type names powerpc/Makefile: Don't pass -mcpu=powerpc64 when building 32-bit KVM: x86: Fix emulation in writing cr8 KVM: x86/emulator: Defer not-present segment check in __load_segment_descriptor() hv_balloon: rate-limit "Unhandled message" warning i2c: xiic: Make bus names unique power: supply: wm8350-power: Handle error for wm8350_register_irq power: supply: wm8350-power: Add missing free in free_charger_irq PCI: Reduce warnings on possible RW1C corruption mips: DEC: honor CONFIG_MIPS_FP_SUPPORT=n powerpc/sysdev: fix incorrect use to determine if list is empty mfd: mc13xxx: Add check for mc13xxx_irq_request selftests/bpf: Make test_lwt_ip_encap more stable and faster powerpc: 8xx: fix a return value error in mpc8xx_pic_init vxcan: enable local echo for sent CAN frames MIPS: RB532: fix return value of __setup handler mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init RDMA/mlx5: Fix memory leak in error flow for subscribe event routine bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full bpf, sockmap: Fix more uncharged while msg has more_data bpf, sockmap: Fix double uncharge the mem of sk_msg USB: storage: ums-realtek: fix error code in rts51x_read_mem() Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt af_netlink: Fix shift out of bounds in group mask calculation i2c: mux: demux-pinctrl: do not deactivate a master that is not active selftests/bpf/test_lirc_mode2.sh: Exit with proper code tcp: ensure PMTU updates are processed during fastopen openvswitch: always update flow key after nat tipc: fix the timer expires after interval 100ms mfd: asic3: Add missing iounmap() on error asic3_mfd_probe mxser: fix xmit_buf leak in activate when LSR == 0xff pwm: lpc18xx-sct: Initialize driver data and hardware before pwmchip_add() misc: alcor_pci: Fix an error handling path staging:iio:adc:ad7280a: Fix handing of device address bit reversing. pinctrl: renesas: r8a77470: Reduce size for narrow VIN1 channel clk: qcom: ipq8074: Use floor ops for SDCC1 clock phy: dphy: Correct lpx parameter and its derivatives(ta_{get,go,sure}) serial: 8250_mid: Balance reference count for PCI DMA device serial: 8250: Fix race condition in RTS-after-send handling iio: adc: Add check for devm_request_threaded_irq NFS: Return valid errors from nfs2/3_decode_dirent() dma-debug: fix return value of __setup handlers clk: imx7d: Remove audio_mclk_root_clk clk: qcom: clk-rcg2: Update logic to calculate D value for RCG clk: qcom: clk-rcg2: Update the frac table for pixel clock remoteproc: qcom: Fix missing of_node_put in adsp_alloc_memory_region remoteproc: qcom_wcnss: Add missing of_node_put() in wcnss_alloc_memory_region clk: actions: Terminate clk_div_table with sentinel element clk: loongson1: Terminate clk_div_table with sentinel element clk: clps711x: Terminate clk_div_table with sentinel element clk: tegra: tegra124-emc: Fix missing put_device() call in emc_ensure_emc_driver NFS: remove unneeded check in decode_devicenotify_args() staging: mt7621-dts: fix LEDs and pinctrl on GB-PC1 devicetree pinctrl: mediatek: Fix missing of_node_put() in mtk_pctrl_init pinctrl: mediatek: paris: Fix "argument" argument type for mtk_pinconf_get() pinctrl: mediatek: paris: Fix pingroup pin config state readback pinctrl: nomadik: Add missing of_node_put() in nmk_pinctrl_probe pinctrl/rockchip: Add missing of_node_put() in rockchip_pinctrl_probe tty: hvc: fix return value of __setup handler kgdboc: fix return value of __setup handler kgdbts: fix return value of __setup handler firmware: google: Properly state IOMEM dependency driver core: dd: fix return value of __setup handler jfs: fix divide error in dbNextAG netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options NFSv4.1: don't retry BIND_CONN_TO_SESSION on session error clk: qcom: gcc-msm8994: Fix gpll4 width clk: Initialize orphan req_rate xen: fix is_xen_pmu() net: phy: broadcom: Fix brcm_fet_config_init() selftests: test_vxlan_under_vrf: Fix broken test case qlcnic: dcb: default to returning -EOPNOTSUPP net/x25: Fix null-ptr-deref caused by x25_disconnect NFSv4/pNFS: Fix another issue with a list iterator pointing to the head net: dsa: bcm_sf2_cfp: fix an incorrect NULL check on list iterator lib/test: use after free in register_test_dev_kmod() LSM: general protection fault in legacy_parse_param gcc-plugins/stackleak: Exactly match strings instead of prefixes pinctrl: npcm: Fix broken references to chip->parent_device block, bfq: don't move oom_bfqq selinux: use correct type for context length loop: use sysfs_emit() in the sysfs xxx show() Fix incorrect type in assignment of ipv6 port for audit irqchip/qcom-pdc: Fix broken locking irqchip/nvic: Release nvic_base upon failure bfq: fix use-after-free in bfq_dispatch_request ACPICA: Avoid walking the ACPI Namespace if it is not there lib/raid6/test/Makefile: Use $(pound) instead of \# for Make 4.3 Revert "Revert "block, bfq: honor already-setup queue merges"" ACPI/APEI: Limit printable size of BERT table data PM: core: keep irq flags in device_pm_check_callbacks() spi: tegra20: Use of_device_get_match_data() ext4: don't BUG if someone dirty pages without asking ext4 first ntfs: add sanity check on allocation size video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow video: fbdev: w100fb: Reset global state video: fbdev: cirrusfb: check pixclock to avoid divide by zero video: fbdev: omapfb: acx565akm: replace snprintf with sysfs_emit ARM: dts: qcom: fix gic_irq_domain_translate warnings for msm8960 ARM: dts: bcm2837: Add the missing L1/L2 cache information ASoC: madera: Add dependencies on MFD video: fbdev: omapfb: panel-dsi-cm: Use sysfs_emit() instead of snprintf() video: fbdev: omapfb: panel-tpo-td043mtea1: Use sysfs_emit() instead of snprintf() video: fbdev: udlfb: replace snprintf in show functions with sysfs_emit ASoC: soc-core: skip zero num_dai component in searching dai name media: cx88-mpeg: clear interrupt status register before streaming video ARM: tegra: tamonten: Fix I2C3 pad setting ARM: mmp: Fix failure to remove sram device video: fbdev: sm712fb: Fix crash in smtcfb_write() media: Revert "media: em28xx: add missing em28xx_close_extension" media: hdpvr: initialize dev->worker at hdpvr_register_videodev mmc: host: Return an error when ->enable_sdio_irq() ops is missing ALSA: hda/realtek: Add alc256-samsung-headphone fixup powerpc/lib/sstep: Fix 'sthcx' instruction powerpc/lib/sstep: Fix build errors with newer binutils powerpc: Fix build errors with newer binutils scsi: qla2xxx: Fix stuck session in gpdb scsi: qla2xxx: Fix wrong FDMI data for 64G adapter scsi: qla2xxx: Fix warning for missing error code scsi: qla2xxx: Fix device reconnect in loop topology scsi: qla2xxx: Add devids and conditionals for 28xx scsi: qla2xxx: Check for firmware dump already collected scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair() scsi: qla2xxx: Fix disk failure to rediscover scsi: qla2xxx: Fix incorrect reporting of task management failure scsi: qla2xxx: Fix hang due to session stuck scsi: qla2xxx: Fix missed DMA unmap for NVMe ls requests scsi: qla2xxx: Fix N2N inconsistent PLOGI scsi: qla2xxx: Reduce false trigger to login scsi: qla2xxx: Use correct feature type field during RFF_ID processing KVM: Prevent module exit until all VMs are freed KVM: x86: fix sending PV IPI ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM ubifs: rename_whiteout: Fix double free for whiteout_ui->data ubifs: Fix deadlock in concurrent rename whiteout and inode writeback ubifs: Add missing iput if do_tmpfile() failed in rename whiteout ubifs: setflags: Make dirtied_ino_d 8 bytes aligned ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock() ubifs: rename_whiteout: correct old_dir size computing XArray: Fix xas_create_range() when multi-order entry present can: mcba_usb: mcba_usb_start_xmit(): fix double dev_kfree_skb in error path can: mcba_usb: properly check endpoint type XArray: Update the LRU list in xas_split() rtc: check if __rtc_read_time was successful gfs2: Make sure FITRIM minlen is rounded up to fs block size net: hns3: fix software vlan talbe of vlan 0 inconsistent with hardware pinctrl: pinconf-generic: Print arguments for bias-pull-* pinctrl: nuvoton: npcm7xx: Rename DS() macro to DSTR() pinctrl: nuvoton: npcm7xx: Use %zu printk format for ARRAY_SIZE() ASoC: mediatek: mt6358: add missing EXPORT_SYMBOLs ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl ARM: iop32x: offset IRQ numbers by 1 ACPI: CPPC: Avoid out of bounds access when parsing _CPC data powerpc/kasan: Fix early region not updated correctly ASoC: soc-compress: Change the check for codec_dai mm/mmap: return 1 from stack_guard_gap __setup() handler mm/memcontrol: return 1 from cgroup.memory __setup() handler mm/usercopy: return 1 from hardened_usercopy __setup() handler bpf: Fix comment for helper bpf_current_task_under_cgroup() dt-bindings: mtd: nand-controller: Fix the reg property description dt-bindings: mtd: nand-controller: Fix a comment in the examples dt-bindings: spi: mxic: The interrupt property is not mandatory ubi: fastmap: Return error code if memory allocation fails in add_aeb() ASoC: topology: Allow TLV control to be either read or write ARM: dts: spear1340: Update serial node properties ARM: dts: spear13xx: Update SPI dma properties um: Fix uml_mconsole stop/go openvswitch: Fixed nd target mask field in the flow dump. KVM: x86/mmu: do compare-and-exchange of gPTE via the user address KVM: x86: Forbid VMM to set SYNIC/STIMER MSRs when SynIC wasn't activated ubifs: Rectify space amount budget for mkdir/tmpfile operations rtc: wm8350: Handle error for wm8350_register_irq riscv module: remove (NOLOAD) ARM: 9187/1: JIVE: fix return value of __setup handler KVM: x86/svm: Clear reserved bits written to PerfEvtSeln MSRs drm: Add orientation quirk for GPD Win Max ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111 drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj ptp: replace snprintf with sysfs_emit powerpc: dts: t104xrdb: fix phy type for FMAN 4/5 bpf: Make dst_port field in struct bpf_sock 16-bit wide scsi: mvsas: Replace snprintf() with sysfs_emit() scsi: bfa: Replace snprintf() with sysfs_emit() power: supply: axp20x_battery: properly report current when discharging ipv6: make mc_forwarding atomic powerpc: Set crashkernel offset to mid of RMA region drm/amdgpu: Fix recursive locking warning PCI: aardvark: Fix support for MSI interrupts iommu/arm-smmu-v3: fix event handling soft lockup usb: ehci: add pci device support for Aspeed platforms PCI: pciehp: Add Qualcomm quirk for Command Completed erratum power: supply: axp288-charger: Set Vhold to 4.4V ipv4: Invalidate neighbour for broadcast address upon address addition dm ioctl: prevent potential spectre v1 gadget drm/amdkfd: make CRAT table missing message informational only scsi: pm8001: Fix pm8001_mpi_task_abort_resp() scsi: aha152x: Fix aha152x_setup() __setup handler return value net/smc: correct settings of RMB window update limit mips: ralink: fix a refcount leak in ill_acc_of_setup() macvtap: advertise link netns via netlink tuntap: add sanity checks about msg_controllen in sendmsg bnxt_en: Eliminate unintended link toggle during FW reset MIPS: fix fortify panic when copying asm exception handlers scsi: libfc: Fix use after free in fc_exch_abts_resp() usb: dwc3: omap: fix "unbalanced disables for smps10_out1" on omap5evm xtensa: fix DTC warning unit_address_format Bluetooth: Fix use after free in hci_send_acl netlabel: fix out-of-bounds memory accesses init/main.c: return 1 from handled __setup() functions minix: fix bug when opening a file with O_DIRECT clk: si5341: fix reported clk_rate when output divider is 2 w1: w1_therm: fixes w1_seq for ds28ea00 sensors NFSv4: Protect the state recovery thread against direct reclaim xen: delay xen_hvm_init_time_ops() if kdump is boot on vcpu>=32 clk: Enforce that disjoints limits are invalid SUNRPC/call_alloc: async tasks mustn't block waiting for memory NFS: swap IO handling is slightly different for O_DIRECT IO NFS: swap-out must always use STABLE writes. serial: samsung_tty: do not unlock port->lock for uart_write_wakeup() virtio_console: eliminate anonymous module_init & module_exit jfs: prevent NULL deref in diFree SUNRPC: Fix socket waits for write buffer space parisc: Fix CPU affinity for Lasi, WAX and Dino chips parisc: Fix patch code locking and flushing mm: fix race between MADV_FREE reclaim and blkdev direct IO read KVM: arm64: Check arm64_get_bp_hardening_data() didn't return NULL drm/amdgpu: fix off by one in amdgpu_gfx_kiq_acquire() Drivers: hv: vmbus: Fix potential crash on module unload scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one() net/tls: fix slab-out-of-bounds bug in decrypt_internal net: ipv4: fix route with nexthop object delete warning net: stmmac: Fix unset max_speed difference between DT and non-DT platforms drm/imx: Fix memory leak in imx_pd_connector_get_modes bnxt_en: reserve space inside receive page for skb_shared_info IB/rdmavt: add lock to call to rvt_error_qp to prevent a race condition dpaa2-ptp: Fix refcount leak in dpaa2_ptp_probe ipv6: Fix stats accounting in ip6_pkt_drop net: openvswitch: don't send internal clone attribute to the userspace. rxrpc: fix a race in rxrpc_exit_net() qede: confirm skb is allocated before using spi: bcm-qspi: fix MSPI only access with bcm_qspi_exec_mem_op() bpf: Support dual-stack sockets in bpf_tcp_check_syncookie drbd: Fix five use after free bugs in get_initial_state SUNRPC: Handle ENOMEM in call_transmit_status() SUNRPC: Handle low memory situations in call_status() perf tools: Fix perf's libperf_print callback perf session: Remap buf if there is no space for event Revert "mmc: sdhci-xenon: fix annoying 1.8V regulator warning" mmc: renesas_sdhi: don't overwrite TAP settings when HS400 tuning is complete lz4: fix LZ4_decompress_safe_partial read out of bound mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0) mm/mempolicy: fix mpol_new leak in shared_policy_replace x86/pm: Save the MSR validity status at context setup x86/speculation: Restore speculation related MSRs during S3 resume btrfs: fix qgroup reserve overflow the qgroup limit arm64: patch_text: Fixup last cpu should be master ata: sata_dwc_460ex: Fix crash due to OOB write perf: qcom_l2_pmu: fix an incorrect NULL check on list iterator irqchip/gic-v3: Fix GICR_CTLR.RWP polling tools build: Filter out options and warnings not supported by clang tools build: Use $(shell ) instead of `` to get embedded libperl's ccopts dmaengine: Revert "dmaengine: shdma: Fix runtime PM imbalance on error" mmc: mmci_sdmmc: Replace sg_dma_xxx macros mmc: mmci: stm32: correctly check all elements of sg list mm: don't skip swap entry even if zap_details specified arm64: module: remove (NOLOAD) from linker script mm/sparsemem: fix 'mem_section' will never be NULL gcc 12 warning drm/amdkfd: add missing void argument to function kgd2kfd_init drm/amdkfd: Fix -Wstrict-prototypes from amdgpu_amdkfd_gfx_10_0_get_functions() io_uring: fix fs->users overflow cgroup: Use open-time credentials for process migraton perm checks cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv cgroup: Use open-time cgroup namespace for process migration perm checks selftests: cgroup: Make cg_create() use 0755 for permission instead of 0644 selftests: cgroup: Test open-time credential usage for migration checks selftests: cgroup: Test open-time cgroup namespace usage for migration checks cpuidle: PSCI: Move the `has_lpi` check to the beginning of the function ACPI: processor idle: Check for architectural support for LPI Linux 5.4.189 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: If3564fc9b0854c215e077cf29dabd4d88de266eb	2022-04-19 16:29:31 +02:00
Jakub Sitnicki	ca5da71a58	bpf: Make dst_port field in struct bpf_sock 16-bit wide ... [ Upstream commit 4421a582718ab81608d8486734c18083b822390d ] Menglong Dong reports that the documentation for the dst_port field in struct bpf_sock is inaccurate and confusing. From the BPF program PoV, the field is a zero-padded 16-bit integer in network byte order. The value appears to the BPF user as if laid out in memory as so: offsetof(struct bpf_sock, dst_port) + 0 <port MSB> + 8 <port LSB> +16 0x00 +24 0x00 32-, 16-, and 8-bit wide loads from the field are all allowed, but only if the offset into the field is 0. 32-bit wide loads from dst_port are especially confusing. The loaded value, after converting to host byte order with bpf_ntohl(dst_port), contains the port number in the upper 16-bits. Remove the confusion by splitting the field into two 16-bit fields. For backward compatibility, allow 32-bit wide loads from offsetof(struct bpf_sock, dst_port). While at it, allow loads 8-bit loads at offset [0] and [1] from dst_port. Reported-by: Menglong Dong <imagedong@tencent.com> Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com> Link: https://lore.kernel.org/r/20220130115518.213259-2-jakub@cloudflare.com Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-04-15 14:18:32 +02:00
Hengqi Chen	7d418a0a56	bpf: Fix comment for helper bpf_current_task_under_cgroup() ... commit 58617014405ad5c9f94f464444f4972dabb71ca7 upstream. Fix the descriptions of the return values of helper bpf_current_task_under_cgroup(). Fixes: c6b5fb8690 ("bpf: add documentation for eBPF helpers (42-50)") Signed-off-by: Hengqi Chen <hengqi.chen@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Yonghong Song <yhs@fb.com> Link: https://lore.kernel.org/bpf/20220310155335.1278783-1-hengqi.chen@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-04-15 14:18:30 +02:00
Greg Kroah-Hartman	8f2333be80	This is the 5.4.183 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmInm3sACgkQONu9yGCS aT4y5xAAujjSyx5wPk2g/pldocgwngWwzJXLut3GPH7zyt/rwYswGQRXNXzIoXDn WyqnjEEmFR+zxKMnTcvLrJP92f8JWLGkmVCD+BPfy376tauUd72w7BT/WYspmfM9 HSdcZpmWwPBCW9tw/V7Rm07029TjM32/gQ4s1EYyVKxobb29t4TuaUjAoaKSFkaX h/NXAKXgKSCBbjX/ua28naTF1KMR5sV370Ed/OF4Meh8z6//B5z0dFNai9n/Pq7z SPiOs+g6CoA4Hyog3ivX1J43ggxDxSQ9ZbueQ4RRMxlSdxR0O4KBofgQztIoqOd3 HnTyLX4sFTNEdy2DOINigs3aT+YzSlCe7gWrnKXjbddohHh9SdKwplcIpAIQyKcJ PoLBlDrJ2SYwY8LDTiIKs3vCjn8dHYpXd0/2ey8Yx9EARHR+aD2734tlZ5ynCcmY tstF10ALDmHA63XZk1khHWdWgOokR8yrqo+CmQhWh2XKjr/k4+RK3EzDeZTWAmKL WMkOiz5tyYsiA4XuTKRAH6cewZjXjn9ThghIFC413swl8iUhvQzaj5HpFtcWV2ly CpXrRr4/m1vJp88QAy7CJRVkcElKyo07ECKaGQi2/kJynf3/f4ZTNgtjso5YBixL uyuM3Nf/0gT0uUM5wHK8scmWjdgCzFBP3wry3/kL8pIDDY5V+1I= =ifDj -----END PGP SIGNATURE----- Merge 5.4.183 into android11-5.4-lts Changes in 5.4.183 mac80211_hwsim: report NOACK frames in tx_status mac80211_hwsim: initialize ieee80211_tx_info at hw_scan_work i2c: bcm2835: Avoid clock stretching timeouts ASoC: rt5668: do not block workqueue if card is unbound ASoC: rt5682: do not block workqueue if card is unbound Input: clear BTN_RIGHT/MIDDLE on buttonpads cifs: fix double free race when mount fails in cifs_get_root() dmaengine: shdma: Fix runtime PM imbalance on error i2c: cadence: allow COMPILE_TEST i2c: qup: allow COMPILE_TEST net: usb: cdc_mbim: avoid altsetting toggling for Telit FN990 usb: gadget: don't release an existing dev->buf usb: gadget: clear related members when goto fail ata: pata_hpt37x: fix PCI clock detection ALSA: intel_hdmi: Fix reference to PCM buffer address ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min xfrm: fix MTU regression netfilter: fix use-after-free in __nf_register_net_hook() xfrm: fix the if_id check in changelink xfrm: enforce validity of offload input flags netfilter: nf_queue: don't assume sk is full socket netfilter: nf_queue: fix possible use-after-free batman-adv: Request iflink once in batadv-on-batadv check batman-adv: Request iflink once in batadv_get_real_netdevice batman-adv: Don't expect inter-netns unique iflink indices net: dcb: flush lingering app table entries for unregistered devices net/smc: fix unexpected SMC_CLC_DECL_ERR_REGRMB error generated by client net/smc: fix unexpected SMC_CLC_DECL_ERR_REGRMB error cause by server block: Fix fsync always failed if once failed xen/netfront: destroy queues before real_num_tx_queues is zeroed sched/topology: Make sched_init_numa() use a set for the deduplicating sort sched/topology: Fix sched_domain_topology_level alloc in sched_init_numa() ia64: ensure proper NUMA distance and possible map initialization mac80211: fix forwarded mesh frames AC & queue selection net: stmmac: fix return value of __setup handler iavf: Fix missing check for running netdev net: sxgbe: fix return value of __setup handler net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe() ixgbe: xsk: change !netif_carrier_ok() handling in ixgbe_xmit_zc() efivars: Respect "block" flag in efivar_entry_set_safe() firmware: arm_scmi: Remove space in MODULE_ALIAS name ASoC: cs4265: Fix the duplicated control name can: gs_usb: change active_channels's type from atomic_t to u8 arm64: dts: rockchip: Switch RK3399-Gru DP to SPDIF output igc: igc_read_phy_reg_gpy: drop premature return ARM: Fix kgdb breakpoint for Thumb2 ARM: 9182/1: mmu: fix returns from early_param() and __setup() functions igc: igc_write_phy_reg_gpy: drop premature return ibmvnic: free reset-work-item when flushing memfd: fix F_SEAL_WRITE after shmem huge page allocated soc: fsl: qe: Check of ioremap return value net: chelsio: cxgb3: check the return value of pci_find_capability() nl80211: Handle nla_memdup failures in handle_nan_filter Input: elan_i2c - move regulator_[en|dis]able() out of elan_[en|dis]able_power() Input: elan_i2c - fix regulator enable count imbalance after suspend/resume HID: add mapping for KEY_DICTATE HID: add mapping for KEY_ALL_APPLICATIONS tracing/histogram: Fix sorting on old "cpu" value tracing: Fix return value of __setup handlers btrfs: fix lost prealloc extents beyond eof after full fsync btrfs: qgroup: fix deadlock between rescan worker and remove qgroup btrfs: add missing run of delayed items after unlink during log replay Revert "xfrm: xfrm_state_mtu should return at least 1280 for ipv6" net: dcb: disable softirqs in dcbnl_flush_dev() hamradio: fix macro redefine warning Linux 5.4.183 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I37011d512091e3ad1398ea2ffff6be08efbc3361	2022-03-12 13:48:22 +01:00
William Mahon	35fa6f2a31	HID: add mapping for KEY_ALL_APPLICATIONS ... commit 327b89f0acc4c20a06ed59e4d9af7f6d804dc2e2 upstream. This patch adds a new key definition for KEY_ALL_APPLICATIONS and aliases KEY_DASHBOARD to it. It also maps the 0x0c/0x2a2 usage code to KEY_ALL_APPLICATIONS. Signed-off-by: William Mahon <wmahon@chromium.org> Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Link: https://lore.kernel.org/r/20220303035618.1.I3a7746ad05d270161a18334ae06e3b6db1a1d339@changeid Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-03-08 19:07:50 +01:00
William Mahon	ecefb8cc0f	HID: add mapping for KEY_DICTATE ... commit bfa26ba343c727e055223be04e08f2ebdd43c293 upstream. Numerous keyboards are adding dictate keys which allows for text messages to be dictated by a microphone. This patch adds a new key definition KEY_DICTATE and maps 0x0c/0x0d8 usage code to this new keycode. Additionally hid-debug is adjusted to recognize this new usage code as well. Signed-off-by: William Mahon <wmahon@chromium.org> Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Link: https://lore.kernel.org/r/20220303021501.1.I5dbf50eb1a7a6734ee727bda4a8573358c6d3ec0@changeid Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-03-08 19:07:50 +01:00
Leon Romanovsky	d2c96b1930	xfrm: enforce validity of offload input flags ... commit 7c76ecd9c99b6e9a771d813ab1aa7fa428b3ade1 upstream. struct xfrm_user_offload has flags variable that received user input, but kernel didn't check if valid bits were provided. It caused a situation where not sanitized input was forwarded directly to the drivers. For example, XFRM_OFFLOAD_IPV6 define that was exposed, was used by strongswan, but not implemented in the kernel at all. As a solution, check and sanitize input flags to forward XFRM_OFFLOAD_INBOUND to the drivers. Fixes: d77e38e612 ("xfrm: Add an IPsec hardware offloading API") Signed-off-by: Leon Romanovsky <leonro@nvidia.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-03-08 19:07:47 +01:00
Greg Kroah-Hartman	7ada083540	This is the 5.4.170 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmHVgw8ACgkQONu9yGCS aT71vhAAgVauEQ0nyXBUsH7vqKS6tYdcjoOor8FdNYSfoZ7iY6MptIdtHMVA0MxZ 793CRZDc7cyNtNVhGIomSzLPI4Nb/U5g57xfGrIQZ9Yzv1vcDsC8iEU1GLELWVAO 1gX6oyVJMXQb4JrbGGdP3QPqLPa6ekZ07c3/Dt2p32e+yqm3JvrcaDqklR7qSzBi Nx6VWp2ZxbvDqmzhzzVX+wWoB1darxp1I08ZgPMqsAbn78MelxrOxp8asNVuJQip KusrhdA4xSrXHfzYj1oxSAWctA0mlHJVie+/x+DPDKDP7/zIop+58fEbSEPLcDHA d+19gkNuNR0CtmEPACm/DAPU/iKiuK1YhmfGvPWQHdQCGQxxMKAdS0sH7BqQ2NU6 c7QiRA0Q3JNc+D2TGO5e2u1D5jqsVnBRaEAOnrHwnX6Dx27I8vwIsSKF1Si6TCdU S7whO8n1r7are5Ahaak25qR83wIpn/2fL4Q0AzP7Ox9kue7ceDQ42RfPzNoYh3LS ITJxRbxZYsnOHjlDS4dc5Hih+WioclSALmYhzSbWsjepzyv0EVEup6vzBffY5A4k ENlXQOCV7jZdfZ+ZdMI+kR9cTGO1F7Le5UKp4H+a0qpY/MWIlUI1C7qWDp5YZTsi 2iYwzrOpKCgqrMBhAR2jHeqmqItkal1dsTvrh2Lwc+3FPYRjNoo= =Lkh+ -----END PGP SIGNATURE----- Merge 5.4.170 into android11-5.4-lts Changes in 5.4.170 HID: asus: Add depends on USB_HID to HID_ASUS Kconfig option tee: handle lookup of shm with reference count 0 Input: i8042 - add deferred probe support Input: i8042 - enable deferred probe quirk for ASUS UM325UA tomoyo: Check exceeded quota early in tomoyo_domain_quota_is_ok(). platform/x86: apple-gmux: use resource_size() with res memblock: fix memblock_phys_alloc() section mismatch error recordmcount.pl: fix typo in s390 mcount regex selinux: initialize proto variable in selinux_ip_postroute_compat() scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write() net/mlx5: DR, Fix NULL vs IS_ERR checking in dr_domain_init_resources udp: using datalen to cap ipv6 udp max gso segments selftests: Calculate udpgso segment count without header adjustment sctp: use call_rcu to free endpoint net: usb: pegasus: Do not drop long Ethernet frames net: lantiq_xrx200: fix statistics of received bytes NFC: st21nfca: Fix memory leak in device probe and remove ionic: Initialize the 'lif->dbid_inuse' bitmap net/mlx5e: Fix wrong features assignment in case of error selftests/net: udpgso_bench_tx: fix dst ip argument net/ncsi: check for error return from call to nla_put_u32 fsl/fman: Fix missing put_device() call in fman_port_probe i2c: validate user data in compat ioctl nfc: uapi: use kernel size_t to fix user-space builds uapi: fix linux/nfc.h userspace compilation errors xhci: Fresco FL1100 controller should not have BROKEN_MSI quirk set. usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear. usb: mtu3: add memory barrier before set GPD's HWO usb: mtu3: fix list_head check warning usb: mtu3: set interval of FS intr and isoc endpoint binder: fix async_free_space accounting for empty parcels scsi: vmw_pvscsi: Set residual data length conditionally Input: appletouch - initialize work before device registration Input: spaceball - fix parsing of movement data packets net: fix use-after-free in tw_timer_handler perf script: Fix CPU filtering of a script's switch events Linux 5.4.170 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ic66d754505081f001b420af0ee4c8da1edf5c27f	2022-01-05 13:23:05 +01:00
Dmitry V. Levin	b364fcef96	uapi: fix linux/nfc.h userspace compilation errors ... commit 7175f02c4e5f5a9430113ab9ca0fd0ce98b28a51 upstream. Replace sa_family_t with __kernel_sa_family_t to fix the following linux/nfc.h userspace compilation errors: /usr/include/linux/nfc.h:266:2: error: unknown type name 'sa_family_t' sa_family_t sa_family; /usr/include/linux/nfc.h:274:2: error: unknown type name 'sa_family_t' sa_family_t sa_family; Fixes: 23b7869c0f ("NFC: add the NFC socket raw protocol") Fixes: d646960f79 ("NFC: Initial LLCP support") Cc: <stable@vger.kernel.org> Signed-off-by: Dmitry V. Levin <ldv@altlinux.org> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-01-05 12:37:45 +01:00
Krzysztof Kozlowski	245c5e43cd	nfc: uapi: use kernel size_t to fix user-space builds ... commit 79b69a83705e621b258ac6d8ae6d3bfdb4b930aa upstream. Fix user-space builds if it includes /usr/include/linux/nfc.h before some of other headers: /usr/include/linux/nfc.h:281:9: error: unknown type name ‘size_t’ 281 | size_t service_name_len; | ^~~~~~ Fixes: d646960f79 ("NFC: Initial LLCP support") Cc: <stable@vger.kernel.org> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-01-05 12:37:45 +01:00
Greg Kroah-Hartman	a91f4fe26c	This is the 5.4.165 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmG4oNgACgkQONu9yGCS aT7/Rw//UdbaPGmrtR7mUi9mXH/BVcD/M5eIFqeKvMWrCSriSN+C5otRWomNNySh NGTivPXmzVBKTub1TUPCNRrTFHWOn76VqLG1ecm4W6q9bxsKBsLrp2WuUdzLYi76 o+3+MurzbqVC10M26NQGXWY7pF+WOTtxn3SwJVQ4UR7YDzxdP2gRvRvTzam5DjzR D2q6escg33v+IGCwVTUluTKzya7YJhtsSrlzZZhhxvP60sOwV4GT7rCHXr9mM33w mvqoqftKMti6HUSaR1VvL+bclctCoYqedwcS/RsN9qv+e/wOMNFy/GsPmTzYh7E1 wWzjDS9/V4Oo47vFm237deKFSi6vXT7kQusb3uUTizca6N5xpwZNSzLGuJTdQkKP 7qZUMbx1e1f904P7mruWe+47Ktu1JCP6B4xo3yBNUTsmzngYqa2WA6pII+iEePtF KF1P4eb5Roza3NhVO1eKj8dBU6ZqveObX4jIxupl6skJJyK4cT0oqAJRJCSj29Cw TjJQOxLzp3Q/iOd+kdZQZU8Q9qxJIqEBRhoPOabTmQfV9tnNBFuPRlOj0SDyQguY 30WMLnFlPN/giMMXc7UKrJ3aX6sQSk4qYX4y75a6U+FKF4C52NiunUiIHk2BJljp hytIooKlAAheR9bMJJJO9qelWWFuo9mhQuDb/p37oAqRAtv3MIg= =5lsH -----END PGP SIGNATURE----- Merge 5.4.165 into android11-5.4-lts Changes in 5.4.165 serial: tegra: Change lower tolerance baud rate limit for tegra20 and tegra30 ntfs: fix ntfs_test_inode and ntfs_init_locked_inode function type HID: quirks: Add quirk for the Microsoft Surface 3 type-cover HID: google: add eel USB id HID: add hid_is_usb() function to make it simpler for USB detection HID: add USB_HID dependancy to hid-prodikeys HID: add USB_HID dependancy to hid-chicony HID: add USB_HID dependancy on some USB HID drivers HID: bigbenff: prevent null pointer dereference HID: wacom: fix problems when device is not a valid USB device HID: check for valid USB device for many HID drivers can: kvaser_usb: get CAN clock frequency from device can: kvaser_pciefd: kvaser_pciefd_rx_error_frame(): increase correct stats->{rx,tx}_errors counter can: sja1000: fix use after free in ems_pcmcia_add_card() nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done selftests: netfilter: add a vrf+conntrack testcase vrf: don't run conntrack on vrf with !dflt qdisc bpf: Fix the off-by-two error in range markings ice: ignore dropped packets during init bonding: make tx_rebalance_counter an atomic nfp: Fix memory leak in nfp_cpp_area_cache_add() seg6: fix the iif in the IPv6 socket control block udp: using datalen to cap max gso segments iavf: restore MSI state on reset iavf: Fix reporting when setting descriptor count IB/hfi1: Correct guard on eager buffer deallocation mm: bdi: initialize bdi_min_ratio when bdi is unregistered ALSA: ctl: Fix copy of updated id with element read/write ALSA: hda/realtek - Add headset Mic support for Lenovo ALC897 platform ALSA: pcm: oss: Fix negative period/buffer sizes ALSA: pcm: oss: Limit the period size to 16MB ALSA: pcm: oss: Handle missing errors in snd_pcm_oss_change_params*() btrfs: clear extent buffer uptodate when we fail to write it btrfs: replace the BUG_ON in btrfs_del_root_ref with proper error handling nfsd: Fix nsfd startup race (again) tracefs: Have new files inherit the ownership of their parent clk: qcom: regmap-mux: fix parent clock lookup drm/syncobj: Deal with signalled fences in drm_syncobj_find_fence. can: pch_can: pch_can_rx_normal: fix use after free can: m_can: Disable and ignore ELO interrupt x86/sme: Explicitly map new EFI memmap table as encrypted libata: add horkage for ASMedia 1092 wait: add wake_up_pollfree() binder: use wake_up_pollfree() signalfd: use wake_up_pollfree() aio: keep poll requests on waitqueue until completed aio: fix use-after-free due to missing POLLFREE handling tracefs: Set all files to the same group ownership as the mount option block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2) qede: validate non LSO skb length ASoC: qdsp6: q6routing: Fix return value from msm_routing_put_audio_mixer i40e: Fix failed opcode appearing if handling messages from VF i40e: Fix pre-set max number of queues for VF mtd: rawnand: fsmc: Take instruction delay into account mtd: rawnand: fsmc: Fix timing computation dt-bindings: net: Reintroduce PHY no lane swap binding tools build: Remove needless libpython-version feature check that breaks test-all fast path net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero net: altera: set a couple error code in probe() net: fec: only clear interrupt of handling queue in fec_enet_rx_queue() net, neigh: clear whole pneigh_entry at alloc time net/qla3xxx: fix an error code in ql_adapter_up() selftests/fib_tests: Rework fib_rp_filter_test() USB: gadget: detect too-big endpoint 0 requests USB: gadget: zero allocate endpoint 0 buffers usb: core: config: fix validation of wMaxPacketValue entries xhci: Remove CONFIG_USB_DEFAULT_PERSIST to prevent xHCI from runtime suspending usb: core: config: using bit mask instead of individual bits xhci: avoid race between disable slot command and host runtime suspend iio: trigger: Fix reference counting iio: trigger: stm32-timer: fix MODULE_ALIAS iio: stk3310: Don't return error code in interrupt handler iio: mma8452: Fix trigger reference couting iio: ltr501: Don't return error code in trigger handler iio: kxsd9: Don't return error code in trigger handler iio: itg3200: Call iio_trigger_notify_done() on error iio: dln2-adc: Fix lockdep complaint iio: dln2: Check return value of devm_iio_trigger_register() iio: at91-sama5d2: Fix incorrect sign extension iio: adc: axp20x_adc: fix charging current reporting on AXP22x iio: ad7768-1: Call iio_trigger_notify_done() on error iio: accel: kxcjk-1013: Fix possible memory leak in probe and remove irqchip/armada-370-xp: Fix return value of armada_370_xp_msi_alloc() irqchip/armada-370-xp: Fix support for Multi-MSI interrupts irqchip/irq-gic-v3-its.c: Force synchronisation when issuing INVALL irqchip: nvic: Fix offset for Interrupt Priority Offsets misc: fastrpc: fix improper packet size calculation bpf: Add selftests to cover packet access corner cases Linux 5.4.165 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I756efb854dc947509cf712a292eab0bf72f32694	2021-12-14 15:19:08 +01:00
Eric Biggers	4105e6a128	aio: fix use-after-free due to missing POLLFREE handling ... commit 50252e4b5e989ce64555c7aef7516bdefc2fea72 upstream. signalfd_poll() and binder_poll() are special in that they use a waitqueue whose lifetime is the current task, rather than the struct file as is normally the case. This is okay for blocking polls, since a blocking poll occurs within one task; however, non-blocking polls require another solution. This solution is for the queue to be cleared before it is freed, by sending a POLLFREE notification to all waiters. Unfortunately, only eventpoll handles POLLFREE. A second type of non-blocking poll, aio poll, was added in kernel v4.18, and it doesn't handle POLLFREE. This allows a use-after-free to occur if a signalfd or binder fd is polled with aio poll, and the waitqueue gets freed. Fix this by making aio poll handle POLLFREE. A patch by Ramji Jiyani <ramjiyani@google.com> (https://lore.kernel.org/r/20211027011834.2497484-1-ramjiyani@google.com) tried to do this by making aio_poll_wake() always complete the request inline if POLLFREE is seen. However, that solution had two bugs. First, it introduced a deadlock, as it unconditionally locked the aio context while holding the waitqueue lock, which inverts the normal locking order. Second, it didn't consider that POLLFREE notifications are missed while the request has been temporarily de-queued. The second problem was solved by my previous patch. This patch then properly fixes the use-after-free by handling POLLFREE in a deadlock-free way. It does this by taking advantage of the fact that freeing of the waitqueue is RCU-delayed, similar to what eventpoll does. Fixes: 2c14fa838c ("aio: implement IOCB_CMD_POLL") Cc: <stable@vger.kernel.org> # v4.18+ Link: https://lore.kernel.org/r/20211209010455.42744-6-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-12-14 14:49:02 +01:00
Greg Kroah-Hartman	b2d37d0916	Merge branch 'android11-5.4' into 'android11-5.4-lts' ... Sync up with android11-5.4 for the following commits: b0f930a58e BACKPORT: f2fs: relocate inline conversion from mmap() to mkwrite() 4f4602b711 BACKPORT: f2fs: support RO feature e6fd4c5c6a BACKPORT: f2fs: fix wrong total_sections check and fsmeta check ce664fbdcc BACKPORT: FROMGIT: binder: fix freeze race b1232b020f FROMGIT: binder: BINDER_GET_FROZEN_INFO ioctl a02d0f685d FROMGIT: binder: use EINTR for interrupted wait for work e658e9e4bc BACKPORT: FROMGIT: binder: BINDER_FREEZE ioctl 63ef444773 ANDROID: usb: gadget: f_accessory: Mitgate handling of non-existent USB request 50c9c8cb33 FROMGIT: binder: fix test regression due to sender_euid change 1c1f571840 BACKPORT: binder: use cred instead of task for getsecid ea1a2391d5 BACKPORT: binder: use cred instead of task for selinux checks 1fe8a2bb64 BACKPORT: binder: use euid from cred instead of using task a080050156 ANDROID: setlocalversion: make KMI_GENERATION optional e785a25f52 Revert "ANDROID: GKI: Enable CHACHA20POLY1305 and XCBC" Change-Id: Ica7d80e62dcd4b12f7294bcc4b5c9291491ad37b Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2021-12-09 11:01:27 +01:00
Li Li	ce664fbdcc	BACKPORT: FROMGIT: binder: fix freeze race ... Currently cgroup freezer is used to freeze the application threads, and BINDER_FREEZE is used to freeze the corresponding binder interface. There's already a mechanism in ioctl(BINDER_FREEZE) to wait for any existing transactions to drain out before actually freezing the binder interface. But freezing an app requires 2 steps, freezing the binder interface with ioctl(BINDER_FREEZE) and then freezing the application main threads with cgroupfs. This is not an atomic operation. The following race issue might happen. 1) Binder interface is frozen by ioctl(BINDER_FREEZE); 2) Main thread A initiates a new sync binder transaction to process B; 3) Main thread A is frozen by "echo 1 > cgroup.freeze"; 4) The response from process B reaches the frozen thread, which will unexpectedly fail. This patch provides a mechanism to check if there's any new pending transaction happening between ioctl(BINDER_FREEZE) and freezing the main thread. If there's any, the main thread freezing operation can be rolled back to finish the pending transaction. Furthermore, the response might reach the binder driver before the rollback actually happens. That will still cause failed transaction. As the other process doesn't wait for another response of the response, the response transaction failure can be fixed by treating the response transaction like an oneway/async one, allowing it to reach the frozen thread. And it will be consumed when the thread gets unfrozen later. NOTE: This patch reuses the existing definition of struct binder_frozen_status_info but expands the bit assignments of __u32 member sync_recv. To ensure backward compatibility, bit 0 of sync_recv still indicates there's an outstanding sync binder transaction. This patch adds new information to bit 1 of sync_recv, indicating the binder transaction happens exactly when there's a race. If an existing userspace app runs on a new kernel, a sync binder call will set bit 0 of sync_recv so ioctl(BINDER_GET_FROZEN_INFO) still return the expected value (true). The app just doesn't check bit 1 intentionally so it doesn't have the ability to tell if there's a race. This behavior is aligned with what happens on an old kernel which doesn't set bit 1 at all. A new userspace app can 1) check bit 0 to know if there's a sync binder transaction happened when being frozen - same as before; and 2) check bit 1 to know if that sync binder transaction happened exactly when there's a race - a new information for rollback decision. Fixes: 432ff1e91694 ("binder: BINDER_FREEZE ioctl") Acked-by: Todd Kjos <tkjos@google.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Li Li <dualli@google.com> Test: stress test with apps being frozen and initiating binder calls at the same time, confirmed the pending transactions succeeded. Link: https://lore.kernel.org/r/20210910164210.2282716-2-dualli@chromium.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Bug: 198493121 (cherry picked from commit b564171ade70570b7f335fa8ed17adb28409e3ac git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git char-misc-linus) Change-Id: I488ba75056f18bb3094ba5007027b76b5caebec9	2021-11-30 15:38:33 -08:00
Marco Ballesio	b1232b020f	FROMGIT: binder: BINDER_GET_FROZEN_INFO ioctl ... User space needs to know if binder transactions occurred to frozen processes. Introduce a new BINDER_GET_FROZEN ioctl and keep track of transactions occurring to frozen proceses. Bug: 180989544 (cherry picked from commit c55019c24b22d6770bd8e2f12fbddf3f83d37547 git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git char-misc-testing) Signed-off-by: Marco Ballesio <balejs@google.com> Signed-off-by: Li Li <dualli@google.com> Acked-by: Todd Kjos <tkjos@google.com> Link: https://lore.kernel.org/r/20210316011630.1121213-4-dualli@chromium.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Change-Id: Ie631f331ba4ca94a3bcdd43dec25fe9ba1306af2	2021-11-30 15:38:18 -08:00
Marco Ballesio	e658e9e4bc	BACKPORT: FROMGIT: binder: BINDER_FREEZE ioctl ... Frozen tasks can't process binder transactions, so a way is required to inform transmitting ends of communication failures due to the frozen state of their receiving counterparts. Additionally, races are possible between transitions to frozen state and binder transactions enqueued to a specific process. Implement BINDER_FREEZE ioctl for user space to inform the binder driver about the intention to freeze or unfreeze a process. When the ioctl is called, block the caller until any pending binder transactions toward the target process are flushed. Return an error to transactions to processes marked as frozen. Bug: 180989544 (cherry picked from commit 15949c3cdd97bccdcd45c0c0f6c31058520b6494 git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git char-misc-testing) Co-developed-by: Todd Kjos <tkjos@google.com> Acked-by: Todd Kjos <tkjos@google.com> Signed-off-by: Marco Ballesio <balejs@google.com> Signed-off-by: Todd Kjos <tkjos@google.com> Signed-off-by: Li Li <dualli@google.com> Link: https://lore.kernel.org/r/20210316011630.1121213-2-dualli@chromium.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Change-Id: Ia1b5951cd99eeb98b59e06c3e27d59062dc725f6	2021-11-30 15:37:59 -08:00
Greg Kroah-Hartman	91a7552bea	This is the 5.4.160 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmGUwhUACgkQONu9yGCS aT4hlBAAjcjBBtJ7IuVRAbJhRSIW3H0viMdPTBvydSNwSF6mk9BL56CQ+OyAGLaB Fnb5DNxhIO9DAbwuvBW4wEJibSA1Q4191bRjZEKrf70LRdmA51vz0dBu2KRNV+IV HWtJYyXIyqqU/EXPsVmdmNFxr6YUCUmkyEaE18/rsg/cZmMg/Zot434cnSuzVzrW 9yLQVQAs7CAKD7kICZ/S7P7V1IKQyuLj5meX2BBE24YwukvlA9N5ISXGQuW91683 iqv0cfjwYtfrNMOE7K2AKrDgZ0AxuLrIiyppqHjHPB+zIvgm2ErQU+Hp76hVtWpW yP0cq6ReP3ktc9Hmxr49xU1l3D/6jo+OyqQh5eomP2veGpRh3dq+oe1VoN7Iw9Xg YBvjOuononlBoChsddlbxwQTZIXff9MvOK2zADmHM0740xTlqSIgw6ITdg/lyKG8 7QbM6pSepXKVXDhHtbEQQGIJP/SvLyjGKX5pJjTKQ0cemkGJ/Sp/HNHMlf/CRLen LsS2kHCuBTWKQP0NJaAIp0J3lNfcCnB8Cv2BhmkHkVPx0jEvlZKDVJqdH7tbpIdy hdR9vwq9neBIjAiTFMEAuV1/+zGR4zNqiocUXhkIC9BAzrBKinyct78kV2trVOc2 J4lFhpOv1I9/HwaqP6kYnJW+nNoMzN3sD0uT8fk8dlYo5GBvbVk= =YkOP -----END PGP SIGNATURE----- Merge 5.4.160 into android11-5.4-lts Changes in 5.4.160 xhci: Fix USB 3.1 enumeration issues by increasing roothub power-on-good delay usb: xhci: Enable runtime-pm by default on AMD Yellow Carp platform binder: use euid from cred instead of using task binder: use cred instead of task for selinux checks binder: use cred instead of task for getsecid Input: iforce - fix control-message timeout Input: elantench - fix misreporting trackpoint coordinates Input: i8042 - Add quirk for Fujitsu Lifebook T725 libata: fix read log timeout value ocfs2: fix data corruption on truncate scsi: qla2xxx: Fix kernel crash when accessing port_speed sysfs file scsi: qla2xxx: Fix use after free in eh_abort path mmc: dw_mmc: Dont wait for DRTO on Write RSP error parisc: Fix ptrace check on syscall return tpm: Check for integer overflow in tpm2_map_response_body() firmware/psci: fix application of sizeof to pointer crypto: s5p-sss - Add error handling in s5p_aes_probe() media: ite-cir: IR receiver stop working after receive overflow media: ir-kbd-i2c: improve responsiveness of hauppauge zilog receivers media: v4l2-ioctl: Fix check_ext_ctrls ALSA: hda/realtek: Add quirk for Clevo PC70HS ALSA: hda/realtek: Add a quirk for Acer Spin SP513-54N ALSA: hda/realtek: Add quirk for ASUS UX550VE ALSA: hda/realtek: Add quirk for HP EliteBook 840 G7 mute LED ALSA: ua101: fix division by zero at probe ALSA: 6fire: fix control and bulk message timeouts ALSA: line6: fix control and interrupt message timeouts ALSA: usb-audio: Add registration quirk for JBL Quantum 400 ALSA: synth: missing check for possible NULL after the call to kstrdup ALSA: timer: Fix use-after-free problem ALSA: timer: Unconditionally unlink slave instances, too fuse: fix page stealing x86/sme: Use #define USE_EARLY_PGTABLE_L5 in mem_encrypt_identity.c x86/cpu: Fix migration safety with X86_BUG_NULL_SEL x86/irq: Ensure PI wakeup handler is unregistered before module unload cavium: Return negative value when pci_alloc_irq_vectors() fails scsi: qla2xxx: Return -ENOMEM if kzalloc() fails scsi: qla2xxx: Fix unmap of already freed sgl cavium: Fix return values of the probe function sfc: Don't use netif_info before net_device setup hyperv/vmbus: include linux/bitops.h ARM: dts: sun7i: A20-olinuxino-lime2: Fix ethernet phy-mode reset: socfpga: add empty driver allowing consumers to probe mmc: winbond: don't build on M68K drm: panel-orientation-quirks: Add quirk for Aya Neo 2021 bpf: Define bpf_jit_alloc_exec_limit for arm64 JIT bpf: Prevent increasing bpf_jit_limit above max xen/netfront: stop tx queues during live migration nvmet-tcp: fix a memory leak when releasing a queue spi: spl022: fix Microwire full duplex mode net: multicast: calculate csum of looped-back and forwarded packets watchdog: Fix OMAP watchdog early handling drm: panel-orientation-quirks: Add quirk for GPD Win3 nvmet-tcp: fix header digest verification r8169: Add device 10ec:8162 to driver r8169 vmxnet3: do not stop tx queues after netif_device_detach() nfp: bpf: relax prog rejection for mtu check through max_pkt_offset net/smc: Correct spelling mistake to TCPF_SYN_RECV btrfs: clear MISSING device status bit in btrfs_close_one_device btrfs: fix lost error handling when replaying directory deletes btrfs: call btrfs_check_rw_degradable only if there is a missing device ia64: kprobes: Fix to pass correct trampoline address to the handler hwmon: (pmbus/lm25066) Add offset coefficients regulator: s5m8767: do not use reset value as DVS voltage if GPIO DVS is disabled regulator: dt-bindings: samsung,s5m8767: correct s5m8767,pmic-buck-default-dvs-idx property EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell mwifiex: fix division by zero in fw download path ath6kl: fix division by zero in send path ath6kl: fix control-message timeout ath10k: fix control-message timeout ath10k: fix division by zero in send path PCI: Mark Atheros QCA6174 to avoid bus reset rtl8187: fix control-message timeouts evm: mark evm_fixmode as __ro_after_init wcn36xx: Fix HT40 capability for 2Ghz band mwifiex: Read a PCI register after writing the TX ring write pointer libata: fix checking of DMA state wcn36xx: handle connection loss indication rsi: fix occasional initialisation failure with BT coex rsi: fix key enabled check causing unwanted encryption for vap_id > 0 rsi: fix rate mask set leading to P2P failure rsi: Fix module dev_oper_mode parameter description RDMA/qedr: Fix NULL deref for query_qp on the GSI QP signal: Remove the bogus sigkill_pending in ptrace_stop signal/mips: Update (_save|_restore)_fp_context to fail with -EFAULT power: supply: max17042_battery: Prevent int underflow in set_soc_threshold power: supply: max17042_battery: use VFSOC for capacity when no rsns KVM: nVMX: Query current VMCS when determining if MSR bitmaps are in use can: j1939: j1939_tp_cmd_recv(): ignore abort message in the BAM transport can: j1939: j1939_can_recv(): ignore messages with invalid source address powerpc/85xx: Fix oops when mpc85xx_smp_guts_ids node cannot be found serial: core: Fix initializing and restoring termios speed ALSA: mixer: oss: Fix racy access to slots ALSA: mixer: fix deadlock in snd_mixer_oss_set_volume xen/balloon: add late_initcall_sync() for initial ballooning done PCI: pci-bridge-emul: Fix emulation of W1C bits PCI: aardvark: Do not clear status bits of masked interrupts PCI: aardvark: Fix checking for link up via LTSSM state PCI: aardvark: Do not unmask unused interrupts PCI: aardvark: Fix reporting Data Link Layer Link Active PCI: aardvark: Fix return value of MSI domain .alloc() method PCI: aardvark: Read all 16-bits from PCIE_MSI_PAYLOAD_REG quota: check block number when reading the block in quota file quota: correct error number in free_dqentry() pinctrl: core: fix possible memory leak in pinctrl_enable() iio: dac: ad5446: Fix ad5622_write() return value USB: serial: keyspan: fix memleak on probe errors USB: iowarrior: fix control-message timeouts USB: chipidea: fix interrupt deadlock dma-buf: WARN on dmabuf release with pending attachments drm: panel-orientation-quirks: Update the Lenovo Ideapad D330 quirk (v2) drm: panel-orientation-quirks: Add quirk for KD Kurio Smart C15200 2-in-1 drm: panel-orientation-quirks: Add quirk for the Samsung Galaxy Book 10.6 Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg() Bluetooth: fix use-after-free error in lock_sock_nested() drm/panel-orientation-quirks: add Valve Steam Deck platform/x86: wmi: do not fail if disabling fails MIPS: lantiq: dma: add small delay after reset MIPS: lantiq: dma: reset correct number of channel locking/lockdep: Avoid RCU-induced noinstr fail net: sched: update default qdisc visibility after Tx queue cnt changes smackfs: Fix use-after-free in netlbl_catmap_walk() x86: Increase exception stack sizes mwifiex: Run SET_BSS_MODE when changing from P2P to STATION vif-type mwifiex: Properly initialize private structure on interface type changes ath10k: high latency fixes for beacon buffer media: mt9p031: Fix corrupted frame after restarting stream media: netup_unidvb: handle interrupt properly according to the firmware media: stm32: Potential NULL pointer dereference in dcmi_irq_thread() media: uvcvideo: Set capability in s_param media: uvcvideo: Return -EIO for control errors media: uvcvideo: Set unique vdev name based in type media: s5p-mfc: fix possible null-pointer dereference in s5p_mfc_probe() media: s5p-mfc: Add checking to s5p_mfc_probe(). media: imx: set a media_device bus_info string media: mceusb: return without resubmitting URB in case of -EPROTO error. ia64: don't do IA64_CMPXCHG_DEBUG without CONFIG_PRINTK brcmfmac: Add DMI nvram filename quirk for Cyberbook T116 tablet media: rcar-csi2: Add checking to rcsi2_start_receiver() ipmi: Disable some operations during a panic ACPICA: Avoid evaluating methods too early during system resume media: ipu3-imgu: imgu_fmt: Handle properly try media: ipu3-imgu: VIDIOC_QUERYCAP: Fix bus_info media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte() net-sysfs: try not to restart the syscall if it will fail eventually tracefs: Have tracefs directories not set OTH permission bits by default ath: dfs_pattern_detector: Fix possible null-pointer dereference in channel_detector_create() iov_iter: Fix iov_iter_get_pages{,_alloc} page fault return value ACPI: battery: Accept charges over the design capacity as full leaking_addresses: Always print a trailing newline memstick: r592: Fix a UAF bug when removing the driver lib/xz: Avoid overlapping memcpy() with invalid input with in-place decompression lib/xz: Validate the value before assigning it to an enum variable workqueue: make sysfs of unbound kworker cpumask more clever tracing/cfi: Fix cmp_entries_* functions signature mismatch mwl8k: Fix use-after-free in mwl8k_fw_state_machine() block: remove inaccurate requeue check nvmet: fix use-after-free when a port is removed nvmet-tcp: fix use-after-free when a port is removed nvme: drop scan_lock and always kick requeue list when removing namespaces PM: hibernate: Get block device exclusively in swsusp_check() selftests: kvm: fix mismatched fclose() after popen() iwlwifi: mvm: disable RX-diversity in powersave smackfs: use __GFP_NOFAIL for smk_cipso_doi() ARM: clang: Do not rely on lr register for stacktrace gre/sit: Don't generate link-local addr if addr_gen_mode is IN6_ADDR_GEN_MODE_NONE ARM: 9136/1: ARMv7-M uses BE-8, not BE-32 vrf: run conntrack only in context of lower/physdev for locally generated packets net: annotate data-race in neigh_output() btrfs: do not take the uuid_mutex in btrfs_rm_device spi: bcm-qspi: Fix missing clk_disable_unprepare() on error in bcm_qspi_probe() x86/hyperv: Protect set_hv_tscchange_cb() against getting preempted parisc: fix warning in flush_tlb_all task_stack: Fix end_of_stack() for architectures with upwards-growing stack parisc/unwind: fix unwinder when CONFIG_64BIT is enabled parisc/kgdb: add kgdb_roundup() to make kgdb work with idle polling netfilter: conntrack: set on IPS_ASSURED if flows enters internal stream state selftests/bpf: Fix strobemeta selftest regression Bluetooth: fix init and cleanup of sco_conn.timeout_work rcu: Fix existing exp request check in sync_sched_exp_online_cleanup() drm/v3d: fix wait for TMU write combiner flush virtio-gpu: fix possible memory allocation failure net: net_namespace: Fix undefined member in key_remove_domain() cgroup: Make rebind_subsystems() disable v2 controllers all at once wilc1000: fix possible memory leak in cfg_scan_result() Bluetooth: btmtkuart: fix a memleak in mtk_hci_wmt_sync crypto: caam - disable pkc for non-E SoCs rxrpc: Fix _usecs_to_jiffies() by using usecs_to_jiffies() net: dsa: rtl8366rb: Fix off-by-one bug ath10k: Fix missing frame timestamp for beacon/probe-resp drm/amdgpu: fix warning for overflow check media: em28xx: add missing em28xx_close_extension media: cxd2880-spi: Fix a null pointer dereference on error handling path media: dvb-usb: fix ununit-value in az6027_rc_query media: TDA1997x: handle short reads of hdmi info frame. media: mtk-vpu: Fix a resource leak in the error handling path of 'mtk_vpu_probe()' media: radio-wl1273: Avoid card name truncation media: si470x: Avoid card name truncation media: tm6000: Avoid card name truncation media: cx23885: Fix snd_card_free call on null card pointer kprobes: Do not use local variable when creating debugfs file crypto: ecc - fix CRYPTO_DEFAULT_RNG dependency cpuidle: Fix kobject memory leaks in error paths media: em28xx: Don't use ops->suspend if it is NULL ath9k: Fix potential interrupt storm on queue reset EDAC/amd64: Handle three rank interleaving mode netfilter: nft_dynset: relax superfluous check on set updates media: dvb-frontends: mn88443x: Handle errors of clk_prepare_enable() crypto: qat - detect PFVF collision after ACK crypto: qat - disregard spurious PFVF interrupts hwrng: mtk - Force runtime pm ops for sleep ops b43legacy: fix a lower bounds test b43: fix a lower bounds test mmc: sdhci-omap: Fix NULL pointer exception if regulator is not configured memstick: avoid out-of-range warning memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host() net, neigh: Fix NTF_EXT_LEARNED in combination with NTF_USE hwmon: Fix possible memleak in __hwmon_device_register() hwmon: (pmbus/lm25066) Let compiler determine outer dimension of lm25066_coeff ath10k: fix max antenna gain unit drm/msm: uninitialized variable in msm_gem_import() net: stream: don't purge sk_error_queue in sk_stream_kill_queues() mmc: mxs-mmc: disable regulator on error and in the remove function block: ataflop: fix breakage introduced at blk-mq refactoring platform/x86: thinkpad_acpi: Fix bitwise vs. logical warning mt76: mt76x02: fix endianness warnings in mt76x02_mac.c rsi: stop thread firstly in rsi_91x_init() error handling mwifiex: Send DELBA requests according to spec phy: micrel: ksz8041nl: do not use power down mode nvme-rdma: fix error code in nvme_rdma_setup_ctrl PM: hibernate: fix sparse warnings clocksource/drivers/timer-ti-dm: Select TIMER_OF drm/msm: Fix potential NULL dereference in DPU SSPP smackfs: use netlbl_cfg_cipsov4_del() for deleting cipso_v4_doi libbpf: Fix BTF data layout checks and allow empty BTF s390/gmap: don't unconditionally call pte_unmap_unlock() in __gmap_zap() irq: mips: avoid nested irq_enter() tcp: don't free a FIN sk_buff in tcp_remove_empty_skb() samples/kretprobes: Fix return value if register_kretprobe() failed KVM: s390: Fix handle_sske page fault handling libertas_tf: Fix possible memory leak in probe and disconnect libertas: Fix possible memory leak in probe and disconnect wcn36xx: add proper DMA memory barriers in rx path drm/amdgpu/gmc6: fix DMA mask from 44 to 40 bits net: amd-xgbe: Toggle PLL settings during rate change net: phylink: avoid mvneta warning when setting pause parameters crypto: pcrypt - Delay write to padata->info selftests/bpf: Fix fclose/pclose mismatch in test_progs udp6: allow SO_MARK ctrl msg to affect routing ibmvnic: don't stop queue in xmit ibmvnic: Process crqs after enabling interrupts RDMA/rxe: Fix wrong port_cap_flags clk: mvebu: ap-cpu-clk: Fix a memory leak in error handling paths ARM: s3c: irq-s3c24xx: Fix return value check for s3c24xx_init_intc() arm64: dts: rockchip: Fix GPU register width for RK3328 ARM: dts: qcom: msm8974: Add xo_board reference clock to DSI0 PHY RDMA/bnxt_re: Fix query SRQ failure arm64: dts: meson-g12a: Fix the pwm regulator supply properties ARM: dts: at91: tse850: the emac<->phy interface is rmii scsi: dc395: Fix error case unwinding MIPS: loongson64: make CPU_LOONGSON64 depends on MIPS_FP_SUPPORT JFS: fix memleak in jfs_mount ALSA: hda: Reduce udelay() at SKL+ position reporting arm: dts: omap3-gta04a4: accelerometer irq fix soc/tegra: Fix an error handling path in tegra_powergate_power_up() memory: fsl_ifc: fix leak of irq and nand_irq in fsl_ifc_ctrl_probe clk: at91: check pmc node status before registering syscore ops video: fbdev: chipsfb: use memset_io() instead of memset() serial: 8250_dw: Drop wrong use of ACPI_PTR() usb: gadget: hid: fix error code in do_config() power: supply: rt5033_battery: Change voltage values to µV scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn() RDMA/mlx4: Return missed an error if device doesn't support steering staging: ks7010: select CRYPTO_HASH/CRYPTO_MICHAEL_MIC ARM: dts: stm32: fix SAI sub nodes register range ASoC: cs42l42: Correct some register default values ASoC: cs42l42: Defer probe if request_threaded_irq() returns EPROBE_DEFER phy: qcom-qusb2: Fix a memory leak on probe serial: xilinx_uartps: Fix race condition causing stuck TX HID: u2fzero: clarify error check and length calculations HID: u2fzero: properly handle timeouts in usb_submit_urb powerpc/44x/fsp2: add missing of_node_put mips: cm: Convert to bitfield API to fix out-of-bounds access power: supply: bq27xxx: Fix kernel crash on IRQ handler register error apparmor: fix error check rpmsg: Fix rpmsg_create_ept return when RPMSG config is not defined pnfs/flexfiles: Fix misplaced barrier in nfs4_ff_layout_prepare_ds drm/plane-helper: fix uninitialized variable reference PCI: aardvark: Don't spam about PIO Response Status PCI: aardvark: Fix preserving PCI_EXP_RTCTL_CRSSVE flag on emulated bridge opp: Fix return in _opp_add_static_v2() NFS: Fix deadlocks in nfs_scan_commit_list() fs: orangefs: fix error return code of orangefs_revalidate_lookup() mtd: spi-nor: hisi-sfc: Remove excessive clk_disable_unprepare() mtd: core: don't remove debugfs directory if device is in use dmaengine: at_xdmac: fix AT_XDMAC_CC_PERID() macro auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string auxdisplay: ht16k33: Connect backlight to fbdev auxdisplay: ht16k33: Fix frame buffer device blanking soc: fsl: dpaa2-console: free buffer before returning from dpaa2_console_read netfilter: nfnetlink_queue: fix OOB when mac header was cleared dmaengine: dmaengine_desc_callback_valid(): Check for `callback_result` signal/sh: Use force_sig(SIGKILL) instead of do_group_exit(SIGKILL) m68k: set a default value for MEMORY_RESERVE watchdog: f71808e_wdt: fix inaccurate report in WDIOC_GETTIMEOUT ar7: fix kernel builds for compiler test scsi: qla2xxx: Fix gnl list corruption scsi: qla2xxx: Turn off target reset during issue_lip NFSv4: Fix a regression in nfs_set_open_stateid_locked() i2c: xlr: Fix a resource leak in the error handling path of 'xlr_i2c_probe()' xen-pciback: Fix return in pm_ctrl_init() net: davinci_emac: Fix interrupt pacing disable net: vlan: fix a UAF in vlan_dev_real_dev() ACPI: PMIC: Fix intel_pmic_regs_handler() read accesses bonding: Fix a use-after-free problem when bond_sysfs_slave_add() failed mm/zsmalloc.c: close race window between zs_pool_dec_isolated() and zs_unregister_migration() zram: off by one in read_block_state() perf bpf: Add missing free to bpf_event__print_bpf_prog_info() llc: fix out-of-bound array index in llc_sk_dev_hash() nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails arm64: pgtable: make __pte_to_phys/__phys_to_pte_val inline functions bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding net/sched: sch_taprio: fix undefined behavior in ktime_mono_to_any net: hns3: allow configure ETS bandwidth of all TCs vsock: prevent unnecessary refcnt inc for nonblocking connect net/smc: fix sk_refcnt underflow on linkdown and fallback cxgb4: fix eeprom len when diagnostics not implemented selftests/net: udpgso_bench_rx: fix port argument ARM: 9155/1: fix early early_iounmap() ARM: 9156/1: drop cc-option fallbacks for architecture selection parisc: Fix backtrace to always include init funtion names parisc: Fix set_fixmap() on PA1.x CPUs irqchip/sifive-plic: Fixup EOI failed when masked f2fs: should use GFP_NOFS for directory inodes net, neigh: Enable state migration between NUD_PERMANENT and NTF_USE 9p/net: fix missing error check in p9_check_errors ovl: fix deadlock in splice write powerpc/lib: Add helper to check if offset is within conditional branch range powerpc/bpf: Validate branch ranges powerpc/bpf: Fix BPF_SUB when imm == 0x80000000 powerpc/security: Add a helper to query stf_barrier type powerpc/bpf: Emit stf barrier instruction sequences for BPF_NOSPEC mm, oom: pagefault_out_of_memory: don't force global OOM for dying tasks mm, oom: do not trigger out_of_memory from the #PF video: backlight: Drop maximum brightness override for brightness zero s390/cio: check the subchannel validity for dev_busid s390/tape: fix timer initialization in tape_std_assign() s390/cio: make ccw_device_dma_* more robust powerpc/powernv/prd: Unregister OPAL_MSG_PRD2 notifier during module unload PCI: Add PCI_EXP_DEVCTL_PAYLOAD_* macros SUNRPC: Partial revert of commit 6f9f17287e78 ath10k: fix invalid dma_addr_t token assignment selftests/bpf: Fix also no-alu32 strobemeta selftest Linux 5.4.160 Note, binder* patches were manually reverted as part of this merge, they are not present in this merge point at all. Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I1fb759dd89408adbe9b9ac1527af51bfdc4059de	2021-11-17 10:19:21 +01:00
Pali Rohár	5b7a0a4f7c	PCI: Add PCI_EXP_DEVCTL_PAYLOAD_* macros ... commit 460275f124fb072dca218a6b43b6370eebbab20d upstream. Define a macro PCI_EXP_DEVCTL_PAYLOAD_* for every possible Max Payload Size in linux/pci_regs.h, in the same style as PCI_EXP_DEVCTL_READRQ_*. Link: https://lore.kernel.org/r/20211005180952.6812-2-kabel@kernel.org Signed-off-by: Pali Rohár <pali@kernel.org> Signed-off-by: Marek Behún <kabel@kernel.org> Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com> Reviewed-by: Marek Behún <kabel@kernel.org> Reviewed-by: Bjorn Helgaas <bhelgaas@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-11-17 09:48:50 +01:00
Greg Kroah-Hartman	c4f92aff87	This is the 5.4.148 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmFLBPMACgkQONu9yGCS aT6BIQ//Wb4ZQJtEVvaKnda7vFwe8BoZzPGYZA4Imn9KERDRgHuavEuRfMQtKc2y YHwe/PD2JreuDHcd+Wz32xsdMe045xNvgiE1oGcxq0jNBvhJqANSmVTWpdqAquON cTmwsK3roa7ELC2g1WjrYZDv6CrCggqvbuM9AJ/cLITtd8zerhLdZo+CCDG/28cH EosrWvkBcaGmX+r/IBC86Rt6K2OFQ/3LLbb79L4vjKi5lopsm5CTAmfOfIk8p1gB mGB3PkQZnIqphBfqGXLGuljl4e+zb1SONrugUh78Egom393Ex34oo+RjWEGe9dV2 Stkuqo0GTi85X7JA7SGCA/xgF8A8yvaaLjQBsJsL9+2ji+GW+J7hfn4mE5h8H3Di UBjeLMFJA8Mge8Ng9xUSttvjRdwSTm0jWTS9SOl07w24b0pKYbMrQdWt2eI6CT+/ ytq3nCxNJZKeVcAVH+OJNrbSLYvMy/PgYvGTbzASkNmpAeyNiHOyBz1sRcoiAM9U QCWDdZyaqDKktqEyKHxK3opqPzbnHfZFFlCxR7Gw7vvR+itIGJEh/50RNv2F6vnu wzowrVxe+Bf1h7JiNEqLLVHdiuygRqjH1ygepGM4+3TVF4jYHzDISyrqlA/Se3Pg Hhvlzsbv7PH+KiApwBFjSeHTs5WOrokGMFQ7ZYFDpPkleWiywS0= =50Hk -----END PGP SIGNATURE----- Merge 5.4.148 into android11-5.4-lts Changes in 5.4.148 rtc: tps65910: Correct driver module alias btrfs: wake up async_delalloc_pages waiters after submit btrfs: reset replace target device to allocation state on close blk-zoned: allow zone management send operations without CAP_SYS_ADMIN blk-zoned: allow BLKREPORTZONE without CAP_SYS_ADMIN PCI/MSI: Skip masking MSI-X on Xen PV powerpc/perf/hv-gpci: Fix counter value parsing xen: fix setting of max_pfn in shared_info include/linux/list.h: add a macro to test if entry is pointing to the head 9p/xen: Fix end of loop tests for list_for_each_entry tools/thermal/tmon: Add cross compiling support pinctrl: stmfx: Fix hazardous u8[] to unsigned long cast pinctrl: ingenic: Fix incorrect pull up/down info soc: qcom: aoss: Fix the out of bound usage of cooling_devs soc: aspeed: lpc-ctrl: Fix boundary check for mmap soc: aspeed: p2a-ctrl: Fix boundary check for mmap arm64: head: avoid over-mapping in map_memory crypto: public_key: fix overflow during implicit conversion block: bfq: fix bfq_set_next_ioprio_data() power: supply: max17042: handle fails of reading status register dm crypt: Avoid percpu_counter spinlock contention in crypt_page_alloc() VMCI: fix NULL pointer dereference when unmapping queue pair media: uvc: don't do DMA on stack media: rc-loopback: return number of emitters rather than error Revert "dmaengine: imx-sdma: refine to load context only once" dmaengine: imx-sdma: remove duplicated sdma_load_context libata: add ATA_HORKAGE_NO_NCQ_TRIM for Samsung 860 and 870 SSDs ARM: 9105/1: atags_to_fdt: don't warn about stack size PCI/portdrv: Enable Bandwidth Notification only if port supports it PCI: Restrict ASMedia ASM1062 SATA Max Payload Size Supported PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure PCI: xilinx-nwl: Enable the clock through CCF PCI: aardvark: Fix checking for PIO status PCI: aardvark: Increase polling delay to 1.5s while waiting for PIO response PCI: aardvark: Fix masking and unmasking legacy INTx interrupts HID: input: do not report stylus battery state as "full" f2fs: quota: fix potential deadlock scsi: bsg: Remove support for SCSI_IOCTL_SEND_COMMAND IB/hfi1: Adjust pkey entry in index 0 RDMA/iwcm: Release resources if iw_cm module initialization fails docs: Fix infiniband uverbs minor number pinctrl: samsung: Fix pinctrl bank pin count vfio: Use config not menuconfig for VFIO_NOIOMMU powerpc/stacktrace: Include linux/delay.h RDMA/efa: Remove double QP type assignment f2fs: show f2fs instance in printk_ratelimited f2fs: reduce the scope of setting fsck tag when de->name_len is zero openrisc: don't printk() unconditionally dma-debug: fix debugfs initialization order SUNRPC: Fix potential memory corruption scsi: fdomain: Fix error return code in fdomain_probe() pinctrl: single: Fix error return code in pcs_parse_bits_in_pinctrl_entry() scsi: smartpqi: Fix an error code in pqi_get_raid_map() scsi: qedi: Fix error codes in qedi_alloc_global_queues() scsi: qedf: Fix error codes in qedf_alloc_global_queues() powerpc/config: Renable MTD_PHYSMAP_OF scsi: target: avoid per-loop XCOPY buffer allocations HID: i2c-hid: Fix Elan touchpad regression KVM: PPC: Book3S HV Nested: Reflect guest PMU in-use to L0 when guest SPRs are live platform/x86: dell-smbios-wmi: Add missing kfree in error-exit from run_smbios_call fscache: Fix cookie key hashing clk: at91: sam9x60: Don't use audio PLL clk: at91: clk-generated: pass the id of changeable parent at registration clk: at91: clk-generated: Limit the requested rate to our range KVM: PPC: Fix clearing never mapped TCEs in realmode f2fs: fix to account missing .skipped_gc_rwsem f2fs: fix unexpected ENOENT comes from f2fs_map_blocks() f2fs: fix to unmap pages from userspace process in punch_hole() MIPS: Malta: fix alignment of the devicetree buffer kbuild: Fix 'no symbols' warning when CONFIG_TRIM_UNUSD_KSYMS=y userfaultfd: prevent concurrent API initialization drm/amdgpu: Fix amdgpu_ras_eeprom_init() ASoC: atmel: ATMEL drivers don't need HAS_DMA media: dib8000: rewrite the init prbs logic crypto: mxs-dcp - Use sg_mapping_iter to copy data PCI: Use pci_update_current_state() in pci_enable_device_flags() tipc: keep the skb in rcv queue until the whole data is read iio: dac: ad5624r: Fix incorrect handling of an optional regulator. iavf: do not override the adapter state in the watchdog task iavf: fix locking of critical sections ARM: dts: qcom: apq8064: correct clock names video: fbdev: kyro: fix a DoS bug by restricting user input netlink: Deal with ESRCH error in nlmsg_notify() Smack: Fix wrong semantics in smk_access_entry() drm: avoid blocking in drm_clients_info's rcu section igc: Check if num of q_vectors is smaller than max before array access usb: host: fotg210: fix the endpoint's transactional opportunities calculation usb: host: fotg210: fix the actual_length of an iso packet usb: gadget: u_ether: fix a potential null pointer dereference USB: EHCI: ehci-mv: improve error handling in mv_ehci_enable() usb: gadget: composite: Allow bMaxPower=0 if self-powered staging: board: Fix uninitialized spinlock when attaching genpd tty: serial: jsm: hold port lock when reporting modem line changes drm/amd/display: Fix timer_per_pixel unit error drm/amd/amdgpu: Update debugfs link_settings output link_rate field in hex bpf/tests: Fix copy-and-paste error in double word test bpf/tests: Do not PASS tests without actually testing the result video: fbdev: asiliantfb: Error out if 'pixclock' equals zero video: fbdev: kyro: Error out if 'pixclock' equals zero video: fbdev: riva: Error out if 'pixclock' equals zero ipv4: ip_output.c: Fix out-of-bounds warning in ip_copy_addrs() flow_dissector: Fix out-of-bounds warnings s390/jump_label: print real address in a case of a jump label bug s390: make PCI mio support a machine flag serial: 8250: Define RX trigger levels for OxSemi 950 devices xtensa: ISS: don't panic in rs_init hvsi: don't panic on tty_register_driver failure serial: 8250_pci: make setup_port() parameters explicitly unsigned staging: ks7010: Fix the initialization of the 'sleep_status' structure samples: bpf: Fix tracex7 error raised on the missing argument ata: sata_dwc_460ex: No need to call phy_exit() befre phy_init() Bluetooth: skip invalid hci_sync_conn_complete_evt workqueue: Fix possible memory leaks in wq_numa_init() bonding: 3ad: fix the concurrency between __bond_release_one() and bond_3ad_state_machine_handler() arm64: tegra: Fix Tegra194 PCIe EP compatible string ASoC: Intel: bytcr_rt5640: Move "Platform Clock" routes to the maps for the matching in-/output media: imx258: Rectify mismatch of VTS value media: imx258: Limit the max analogue gain to 480 media: v4l2-dv-timings.c: fix wrong condition in two for-loops media: TDA1997x: fix tda1997x_query_dv_timings() return value media: tegra-cec: Handle errors of clk_prepare_enable() ARM: dts: imx53-ppd: Fix ACHC entry arm64: dts: qcom: sdm660: use reg value for memory node net: ethernet: stmmac: Do not use unreachable() in ipq806x_gmac_probe() drm/msm: mdp4: drop vblank get/put from prepare/complete_commit selftests/bpf: Fix xdp_tx.c prog section name Bluetooth: schedule SCO timeouts with delayed_work Bluetooth: avoid circular locks in sco_sock_connect net/mlx5: Fix variable type to match 64bit gpu: drm: amd: amdgpu: amdgpu_i2c: fix possible uninitialized-variable access in amdgpu_i2c_router_select_ddc_port() drm/display: fix possible null-pointer dereference in dcn10_set_clock() mac80211: Fix monitor MTU limit so that A-MSDUs get through ARM: tegra: tamonten: Fix UART pad setting arm64: tegra: Fix compatible string for Tegra132 CPUs arm64: dts: ls1046a: fix eeprom entries nvme-tcp: don't check blk_mq_tag_to_rq when receiving pdu data Bluetooth: Fix handling of LE Enhanced Connection Complete opp: Don't print an error if required-opps is missing serial: sh-sci: fix break handling for sysrq tcp: enable data-less, empty-cookie SYN with TFO_SERVER_COOKIE_NOT_REQD rpc: fix gss_svc_init cleanup on failure staging: rts5208: Fix get_ms_information() heap buffer size gfs2: Don't call dlm after protocol is unmounted usb: chipidea: host: fix port index underflow and UBSAN complains lockd: lockd server-side shouldn't set fl_ops drm/exynos: Always initialize mapping in exynos_drm_register_dma() m68knommu: only set CONFIG_ISA_DMA_API for ColdFire sub-arch btrfs: tree-log: check btrfs_lookup_data_extent return value ASoC: Intel: Skylake: Fix module configuration for KPB and MIXER ASoC: Intel: Skylake: Fix passing loadable flag for module of: Don't allow __of_attached_node_sysfs() without CONFIG_SYSFS mmc: sdhci-of-arasan: Check return value of non-void funtions mmc: rtsx_pci: Fix long reads when clock is prescaled selftests/bpf: Enlarge select() timeout for test_maps mmc: core: Return correct emmc response in case of ioctl error cifs: fix wrong release in sess_alloc_buffer() failed path Revert "USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk set" usb: musb: musb_dsps: request_irq() after initializing musb usbip: give back URBs for unsent unlink requests during cleanup usbip:vhci_hcd USB port can get stuck in the disabled state ASoC: rockchip: i2s: Fix regmap_ops hang ASoC: rockchip: i2s: Fixup config for DAIFMT_DSP_A/B drm/amdkfd: Account for SH/SE count when setting up cu masks. iwlwifi: mvm: fix a memory leak in iwl_mvm_mac_ctxt_beacon_changed iwlwifi: mvm: avoid static queue number aliasing iwlwifi: mvm: fix access to BSS elements net/mlx5: DR, Enable QP retransmission parport: remove non-zero check on count ath9k: fix OOB read ar9300_eeprom_restore_internal ath9k: fix sleeping in atomic context net: fix NULL pointer reference in cipso_v4_doi_free fix array-index-out-of-bounds in taprio_change net: w5100: check return value after calling platform_get_resource() parisc: fix crash with signals and alloca ovl: fix BUG_ON() in may_delete() when called from ovl_cleanup() scsi: BusLogic: Fix missing pr_cont() use scsi: qla2xxx: Changes to support kdump kernel scsi: qla2xxx: Sync queue idx with queue_pair_map idx cpufreq: powernv: Fix init_chip_info initialization in numa=off s390/pv: fix the forcing of the swiotlb mm/hugetlb: initialize hugetlb_usage in mm_init mm,vmscan: fix divide by zero in get_scan_count memcg: enable accounting for pids in nested pid namespaces platform/chrome: cros_ec_proto: Send command again when timeout occurs lib/test_stackinit: Fix static initializer test net: dsa: lantiq_gswip: fix maximum frame length drm/msi/mdp4: populate priv->kms in mdp4_kms_init drm/amdgpu: Fix BUG_ON assert drm/panfrost: Simplify lock_region calculation drm/panfrost: Use u64 for size in lock_region drm/panfrost: Clamp lock region to Bifrost minimum btrfs: fix upper limit for max_inline for page size 64K xen: reset legacy rtc flag for PV domU bnx2x: Fix enabling network interfaces without VFs arm64/sve: Use correct size when reinitialising SVE state PM: base: power: don't try to use non-existing RTC for storing data PCI: Add AMD GPU multi-function power dependencies drm/amd/amdgpu: Increase HWIP_MAX_INSTANCE to 10 drm/etnaviv: return context from etnaviv_iommu_context_get drm/etnaviv: put submit prev MMU context when it exists drm/etnaviv: stop abusing mmu_context as FE running marker drm/etnaviv: keep MMU context across runtime suspend/resume drm/etnaviv: exec and MMU state is lost when resetting the GPU drm/etnaviv: fix MMU context leak on GPU reset drm/etnaviv: reference MMU context when setting up hardware state drm/etnaviv: add missing MMU context put when reaping MMU mapping s390/sclp: fix Secure-IPL facility detection x86/mm: Fix kern_addr_valid() to cope with existing but not present entries tipc: fix an use-after-free issue in tipc_recvmsg net-caif: avoid user-triggerable WARN_ON(1) ptp: dp83640: don't define PAGE0 dccp: don't duplicate ccid when cloning dccp sock net/l2tp: Fix reference count leak in l2tp_udp_recv_core r6040: Restore MDIO clock frequency after MAC reset tipc: increase timeout in tipc_sk_enqueue() perf machine: Initialize srcline string member in add_location struct net/mlx5: FWTrace, cancel work on alloc pd error flow net/mlx5: Fix potential sleeping in atomic context events: Reuse value read using READ_ONCE instead of re-reading it vhost_net: fix OoB on sendmsg() failure. net/af_unix: fix a data-race in unix_dgram_poll net: dsa: destroy the phylink instance on any error in dsa_slave_phy_setup tcp: fix tp->undo_retrans accounting in tcp_sacktag_one() qed: Handle management FW error dt-bindings: arm: Fix Toradex compatible typo ibmvnic: check failover_pending in login response KVM: PPC: Book3S HV: Tolerate treclaim. in fake-suspend mode changing registers net: hns3: pad the short tunnel frame before sending to hardware net: hns3: change affinity_mask to numa node range net: hns3: disable mac in flr process net: hns3: fix the timing issue of VF clearing interrupt sources mm/memory_hotplug: use "unsigned long" for PFN in zone_for_pfn_range() dt-bindings: mtd: gpmc: Fix the ECC bytes vs. OOB bytes equation mfd: db8500-prcmu: Adjust map to reality PCI: Add ACS quirks for NXP LX2xx0 and LX2xx2 platforms fuse: fix use after free in fuse_read_interrupt() mfd: Don't use irq_create_mapping() to resolve a mapping tracing/probes: Reject events which have the same name of existing one PCI: Add ACS quirks for Cavium multi-function devices Set fc_nlinfo in nh_create_ipv4, nh_create_ipv6 net: usb: cdc_mbim: avoid altsetting toggling for Telit LN920 block, bfq: honor already-setup queue merges PCI: ibmphp: Fix double unmap of io_mem ethtool: Fix an error code in cxgb2.c NTB: Fix an error code in ntb_msit_probe() NTB: perf: Fix an error code in perf_setup_inbuf() mfd: axp20x: Update AXP288 volatile ranges PCI: Fix pci_dev_str_match_path() alloc while atomic bug mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set KVM: arm64: Handle PSCI resets before userspace touches vCPU state PCI: Sync __pci_register_driver() stub for CONFIG_PCI=n mtd: rawnand: cafe: Fix a resource leak in the error handling path of 'cafe_nand_probe()' ARC: export clear_user_page() for modules perf unwind: Do not overwrite FEATURE_CHECK_LDFLAGS-libunwind-{x86,aarch64} net: dsa: b53: Fix calculating number of switch ports netfilter: socket: icmp6: fix use-after-scope fq_codel: reject silly quantum parameters qlcnic: Remove redundant unlock in qlcnic_pinit_from_rom ip_gre: validate csum_start only on pull net: renesas: sh_eth: Fix freeing wrong tx descriptor s390/bpf: Fix optimizing out zero-extensions s390/bpf: Fix 64-bit subtraction of the -0x80000000 constant Linux 5.4.148 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I8613b511cb543a7ce0d1623663fc1306aaa45af1	2021-09-25 14:41:58 +02:00
Eric Dumazet	93f54354cc	fq_codel: reject silly quantum parameters ... [ Upstream commit c7c5e6ff533fe1f9afef7d2fa46678987a1335a7 ] syzbot found that forcing a big quantum attribute would crash hosts fast, essentially using this: tc qd replace dev eth0 root fq_codel quantum 4294967295 This is because fq_codel_dequeue() would have to loop ~2^31 times in : if (flow->deficit <= 0) { flow->deficit += q->quantum; list_move_tail(&flow->flowchain, &q->old_flows); goto begin; } SFQ max quantum is 2^19 (half a megabyte) Lets adopt a max quantum of one megabyte for FQ_CODEL. Fixes: 4b549a2ef4 ("fq_codel: Fair Queue Codel AQM") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-09-22 12:26:45 +02:00
Maciej W. Rozycki	5418023f81	serial: 8250: Define RX trigger levels for OxSemi 950 devices ... [ Upstream commit d7aff291d069c4418285f3c8ee27b0ff67ce5998 ] Oxford Semiconductor 950 serial port devices have a 128-byte FIFO and in the enhanced (650) mode, which we select in `autoconfig_has_efr' with the ECB bit set in the EFR register, they support the receive interrupt trigger level selectable with FCR bits 7:6 from the set of 16, 32, 112, 120. This applies to the original OX16C950 discrete UART[1] as well as 950 cores embedded into more complex devices. For these devices we set the default to 112, which sets an excessively high level of 112 or 7/8 of the FIFO capacity, unlike with other port types where we choose at most 1/2 of their respective FIFO capacities. Additionally we don't make the trigger level configurable. Consequently frequent input overruns happen with high bit rates where hardware flow control cannot be used (e.g. terminal applications) even with otherwise highly-performant systems. Lower the default receive interrupt trigger level to 32 then, and make it configurable. Document the trigger levels along with other port types, including the set of 16, 32, 64, 112 for the transmit interrupt as well[2]. References: [1] "OX16C950 rev B High Performance UART with 128 byte FIFOs", Oxford Semiconductor, Inc., DS-0031, Sep 05, Table 10: "Receiver Trigger Levels", p. 22 [2] same, Table 9: "Transmit Interrupt Trigger Levels", p. 22 Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk> Link: https://lore.kernel.org/r/alpine.DEB.2.21.2106260608480.37803@angie.orcam.me.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-09-22 12:26:29 +02:00