Fix possible race condition in data->type value in case of multithreaded
listener or app IOCTLs.
For example, below could cause inconsistent data->type value while
racing belows IOCTLs
Thread1 with QSEECOM_IOCTL_REGISTER_LISTENER_REQ
Thread2 with QSEECOM_IOCTL_UNREGISTER_LISTENER_REQ.
Change-Id: I436b63c044a66c324d94db27566a7be70981bd6b
Signed-off-by: Divisha Bisht <quic_divibish@quicinc.com>
'sprintf' has been deprecated, hence replace it with
a safer function scnprintf.
Change-Id: I9bc8e3dfd2032a0447f38fc98a3ad31d9d609cab
Signed-off-by: Rajashekar kuruva <quic_kuruva@quicinc.com>
Signed-off-by: Prashanth K <quic_prashk@quicinc.com>
Currently, the DSP updates header buffers with unused DMA handle fds.
In the put_args section, if any DMA handle FDs are present in the
header buffer, the corresponding map is freed. However, since the
header buffer is exposed to users in unsigned PD, users can update
invalid FDs. If this invalid FD matches with any FD that is already
in use, it could lead to a use-after-free (UAF) vulnerability.
As a solution,add DMA handle references for DMA FDs, and the map for
the FD will be freed only when a reference is found.
Acked-by: Om Deore <quic_odeore@quicinc.com>
Change-Id: I19ae21230bf11fe89858b10c9069a5daccabc392
Signed-off-by: Santosh Sakore <quic_ssakore@quicinc.com>
Currently, the get_current_groups API accesses group info, which
increases the usage refcount. If the IOCTL using the
get_current_groups API is called many times, the usage counter
overflows. To avoid this, access group info without taking a
reference. A reference is not required as group info is not
released during the IOCTL call.
Change-Id: Ib4de80cac8b36f73d8f5c6dd9824722153189285
Signed-off-by: ANANDU KRISHNAN E <quic_anane@quicinc.com>
Currently, functions gsi_inst_clean & gsi_free_inst utilises
gsi_opts without any check, however there is a possibility
that the opts structure could become NULL. In such case, due
to lack of if checks can result in NULL pointer dereference.
Change-Id: I548690e2eee377b5292f258972ae7e38417f3085
Signed-off-by: Prashanth K <quic_prashk@quicinc.com>
In current implementation, when host wake request is received in D0 and
M3 states, the following sequence of events are happening causing next
host wake request from IPA/ client to fail.
Sequence of events:
1. Device is in waking up process in D0, M3 states and expecting M0
next.
2. Wake up request received as device in M3.
3. Host wake API is executed setting host_wake_pending flag as well.
4. M0 received as part of wake up from 1.
5. Device in D0, M0 states.
6. Device again went to suspend state as no transfers are happening.
7. Device in D3cold, M3 states
8. Wake up request received from IPA.
9. Host wake API is called again but its returning without any operation
as host_wake_pending flag is set. wake toggle is not done.
10. host_wake_pending flag is cleared only on receiving next D0.
11. Host wake requests are failing because of 9.
To handle this, avoiding setting of host_wake_pending flag when the host
wake request is received in D0 state.
Change-Id: I83acde55e6c116653c3ed00e6b4560e3db6390bd
Signed-off-by: Sai Chaitanya Kaveti <quic_skaveti@quicinc.com>
Sometimes, device receives two consecutive wake-up events, added into a
workqueue. Then device assert WAKE# and host deassert PERST# if device
in D3cold state, triggering deassert perst IRQ. In IRQ thread, device
flush the workqueue to make sure previous d3cold process has completed
before enable endpoint. commit 43917f862f7d ("msm: mhi_dev: Flush
workqueue before processing PERST deassert"). However, the second wake
event is also in the workqueue, so ep_pcie_core_wakeup_host_internal
is invoked and seeing dev->perst_deast is true, setted by deassert
PERST# IRQ. Then device goes to access MHI register to issue inband PME,
leading to NOC error because endpoint is still disabled.
So add a check to prevent wake operation if a previous wake has completed.
10567.834470: [0x8219195 mhi_sm_dev_event_manager] Handling
MHI_DEV_EVENT_CORE_WAKEUP event, current states: M3 & D3_COLD_STATE
10567.834498: ep_pcie_core_toggle_wake_gpio: PCIe V1711211: No. 115 to
assert PCIe WAKE#; perst is asserted; D3hot is received, WAKE GPIO
state:0
10567.834507: ep_pcie_core_wakeup_host_internal: PCIe V1711211: Set wake
pending : 1 and return ; perst is not de-asserted; D3hot is set
10567.849704: [0x8219195 mhi_dev_notify_sm_event] received:
MHI_DEV_EVENT_HW_ACC_WAKEUP
10567.849976: ep_pcie_handle_perst_irq: PCIe V1711211: No. 1018 PERST
deassertion
10567.850053: [0x8219195 mhi_sm_dev_event_manager] Handling
MHI_DEV_EVENT_HW_ACC_WAKEUP event, current states: M3 & D3_COLD_STATE
10567.850071: ep_pcie_core_wakeup_host_internal: PCIe V1711211: request to
assert WAKE# when in D3hot
10567.860093: ep_pcie_core_issue_inband_pme: PCIe V1711211: request to
assert inband wake.
Change-Id: I85fb37c4171c5ef4974c573f0abba199cb718a84
Signed-off-by: Qiang Yu <quic_qianyu@quicinc.com>
Add code to install exception rule for icmp
and dhcp packet in DL direction for v4 and v6.
Change-Id: I27a2c3cb9cb342a5e4d22246e350bf721d784a15
Signed-off-by: Himansu Nayak <quic_himansu@quicinc.com>
* remotes/origin/tmp-564901b:
ANDROID: 16K: Only check basename of linker context
UPSTREAM: af_unix: Do not use atomic ops for unix_sk(sk)->inflight.
ANDROID: ABI fixup for abi break in struct dst_ops
BACKPORT: net: fix __dst_negative_advice() race
UPSTREAM: selftests: timers: Fix valid-adjtimex signed left-shift undefined behavior
ANDROID: 16K: Fix show maps CFI failure
ANDROID: 16K: Handle pad VMA splits and merges
ANDROID: 16K: madvise_vma_pad_pages: Remove filemap_fault check
ANDROID: 16K: Only madvise padding from dynamic linker context
ANDROID: 16K: Separate padding from ELF LOAD segment mappings
ANDROID: 16K: Exclude ELF padding for fault around range
ANDROID: 16K: Use MADV_DONTNEED to save VMA padding pages.
ANDROID: 16K: Introduce ELF padding representation for VMAs
ANDROID: 16K: Introduce /sys/kernel/mm/pgsize_miration/enabled
Revert "timers: Rename del_timer_sync() to timer_delete_sync()"
Reapply "media: ttpci: fix two memleaks in budget_av_attach"
Revert "media: rename VFL_TYPE_GRABBER to _VIDEO"
Revert "media: media/pci: rename VFL_TYPE_GRABBER to _VIDEO"
Revert "media: ttpci: fix two memleaks in budget_av_attach"
Revert "net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()"
Revert "regmap: allow to define reg_update_bits for no bus configuration"
Revert "regmap: Add bulk read/write callbacks into regmap_config"
Revert "serial: max310x: fix IO data corruption in batched operations"
Revert "geneve: make sure to pull inner header in geneve_rx()"
ANDROID: GKI: add snd_compr_stop_error to Xiaomi_abi
UPSTREAM: netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
UPSTREAM: netfilter: nf_tables: release batch on table validation from abort path
UPSTREAM: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout
Linux 5.4.274
firmware: meson_sm: fix to avoid potential NULL pointer dereference
ip_gre: do not report erspan version on GRE interface
erspan: Check IFLA_GRE_ERSPAN_VER is set.
VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler()
Bluetooth: btintel: Fixe build regression
x86/alternative: Don't call text_poke() in lazy TLB mode
drm/i915/gt: Reset queue_priority_hint on parking
x86/mm/pat: fix VM_PAT handling in COW mappings
virtio: reenable config if freezing device failed
drm/vkms: call drm_atomic_helper_shutdown before drm_dev_put()
tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc
netfilter: nf_tables: discard table flag update with pending basechain deletion
netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
netfilter: nf_tables: release batch on table validation from abort path
netfilter: nf_tables: reject new basechain after table flag update
fbmon: prevent division by zero in fb_videomode_from_videomode()
fbdev: viafb: fix typo in hw_bitblt_1 and hw_bitblt_2
usb: sl811-hcd: only defined function checkdone if QUIRK2 is defined
usb: typec: tcpci: add generic tcpci fallback compatible
tools: iio: replace seekdir() in iio_generic_buffer
ktest: force $buildonly = 1 for 'make_warnings_file' test type
Input: allocate keycode for Display refresh rate toggle
block: prevent division by zero in blk_rq_stat_sum()
Revert "ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default"
SUNRPC: increase size of rpc_wait_queue.qlen from unsigned short to unsigned int
drm/amd/display: Fix nanosec stat overflow
media: sta2x11: fix irq handler cast
isofs: handle CDs with bad root inode but good Joliet root directory
scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()
sysv: don't call sb_bread() with pointers_lock held
Input: synaptics-rmi4 - fail probing if memory allocation for "phys" fails
Bluetooth: btintel: Fix null ptr deref in btintel_read_version
btrfs: send: handle path ref underflow in header iterate_inode_ref()
btrfs: export: handle invalid inode or root reference in btrfs_get_parent()
btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks()
tools/power x86_energy_perf_policy: Fix file leak in get_pkg_num()
ionic: set adminq irq affinity
arm64: dts: rockchip: fix rk3399 hdmi ports node
arm64: dts: rockchip: fix rk3328 hdmi ports node
panic: Flush kernel log buffer at the end
VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()
wifi: ath9k: fix LNA selection in ath_ant_try_scan()
s390/entry: align system call table on 8 bytes
x86/mce: Make sure to grab mce_sysfs_mutex in set_bank()
ALSA: hda/realtek: Update Panasonic CF-SZ6 quirk to support headset with microphone
ata: sata_mv: Fix PCI device ID table declaration compilation warning
scsi: mylex: Fix sysfs buffer lengths
ata: sata_sx4: fix pdc20621_get_from_dimm() on 64-bit
ASoC: ops: Fix wraparound for mask in snd_soc_get_volsw
net: ravb: Always process TX descriptor ring
erspan: make sure erspan_base_hdr is present in skb->head
erspan: Add type I version 0 support.
init: open /initrd.image with O_LARGEFILE
initramfs: switch initramfs unpacking to struct file based APIs
fs: add a vfs_fchmod helper
fs: add a vfs_fchown helper
staging: vc04_services: fix information leak in create_component()
staging: vc04_services: changen strncpy() to strscpy_pad()
staging: mmal-vchiq: Fix client_component for 64 bit kernel
staging: mmal-vchiq: Allocate and free components as required
i40e: fix vf may be used uninitialized in this function warning
ipv6: Fix infinite recursion in fib6_dump_done().
selftests: reuseaddr_conflict: add missing new line at the end of the output
net: stmmac: fix rx queue priority assignment
net/sched: act_skbmod: prevent kernel-infoleak
bpf, sockmap: Prevent lock inversion deadlock in map delete elem
netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()
netfilter: nf_tables: flush pending destroy work before exit_net release
mm, vmscan: prevent infinite loop for costly GFP_NOIO | __GFP_RETRY_MAYFAIL allocations
Revert "x86/mm/ident_map: Use gbpages only where full GB page should be mapped."
vfio/platform: Create persistent IRQ handlers
vfio/pci: Create persistent INTx handler
vfio: Introduce interface to flush virqfd inject workqueue
vfio/pci: Lock external INTx masking ops
vfio/pci: Disable auto-enable of exclusive INTx IRQ
net/rds: fix possible cp null dereference
netfilter: nf_tables: disallow timeout for anonymous sets
Bluetooth: Fix TOCTOU in HCI debugfs implementation
Bluetooth: hci_event: set the conn encrypted before conn establishes
x86/cpufeatures: Add new word for scattered features
r8169: fix issue caused by buggy BIOS on certain boards with RTL8168d
dm integrity: fix out-of-range warning
tcp: properly terminate timers for kernel sockets
ixgbe: avoid sleeping allocation in ixgbe_ipsec_vf_add_sa()
nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet
USB: core: Fix deadlock in usb_deauthorize_interface()
scsi: lpfc: Correct size for wqe for memset()
x86/cpu: Enable STIBP on AMD if Automatic IBRS is enabled
scsi: qla2xxx: Fix command flush on cable pull
usb: udc: remove warning when queue disabled ep
usb: dwc2: gadget: LPM flow fix
usb: dwc2: host: Fix ISOC flow in DDMA mode
usb: dwc2: host: Fix hibernation flow
usb: dwc2: host: Fix remote wakeup from hibernation
scsi: core: Fix unremoved procfs host directory regression
ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs
usb: cdc-wdm: close race between read and workqueue
mmc: core: Avoid negative index with array access
mmc: core: Initialize mmc_blk_ioc_data
exec: Fix NOMMU linux_binprm::exec in transfer_args_to_stack()
wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes
mm/migrate: set swap entry values of THP tail pages properly.
mm/memory-failure: fix an incorrect use of tail pages
vt: fix memory overlapping when deleting chars in the buffer
bounds: support non-power-of-two CONFIG_NR_CPUS
powerpc: xor_vmx: Add '-mhard-float' to CFLAGS
efivarfs: Request at most 512 bytes for variable names
perf/core: Fix reentry problem in perf_output_read_group()
loop: loop_set_status_from_info() check before assignment
loop: Check for overflow while configuring loop
loop: Factor out configuring loop from status
loop: Refactor loop_set_status() size calculation
loop: Factor out setting loop device size
loop: Remove sector_t truncation checks
loop: Call loop_config_discard() only after new config is applied
Revert "loop: Check for overflow while configuring loop"
btrfs: allocate btrfs_ioctl_defrag_range_args on stack
printk: Update @console_may_schedule in console_trylock_spinning()
xen/events: close evtchn after mapping cleanup
x86/speculation: Support intra-function call validation
objtool: Add support for intra-function calls
objtool: is_fentry_call() crashes if call has no destination
fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion
vt: fix unicode buffer corruption when deleting characters
tty: serial: fsl_lpuart: avoid idle preamble pending if CTS is enabled
usb: port: Don't try to peer unused USB ports based on location
usb: gadget: ncm: Fix handling of zero block length packets
USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
ALSA: hda/realtek - Fix headset Mic no show at resume back for Lenovo ALC897 platform
xfrm: Avoid clang fortify warning in copy_to_user_tmpl()
netfilter: nf_tables: reject constant set with timeout
netfilter: nf_tables: disallow anonymous set with timeout flag
netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout
comedi: comedi_test: Prevent timers rescheduling during deletion
dm snapshot: fix lockup in dm_exception_table_exit
ahci: asm1064: asm1166: don't limit reported ports
ahci: asm1064: correct count of reported ports
x86/CPU/AMD: Update the Zenbleed microcode revisions
nilfs2: prevent kernel bug at submit_bh_wbc()
nilfs2: use a more common logging style
nilfs2: fix failure to detect DAT corruption in btree and direct mappings
memtest: use {READ,WRITE}_ONCE in memory scanning
drm/vc4: hdmi: do not return negative values from .get_modes()
drm/imx/ipuv3: do not return negative values from .get_modes()
drm/exynos: do not return negative values from .get_modes()
s390/zcrypt: fix reference counting on zcrypt card objects
soc: fsl: qbman: Use raw spinlock for cgr_lock
soc: fsl: qbman: Add CGR update function
soc: fsl: qbman: Add helper for sanity checking cgr ops
soc: fsl: qbman: Always disable interrupts when taking cgr_lock
ring-buffer: Fix full_waiters_pending in poll
ring-buffer: Fix resetting of shortest_full
vfio/platform: Disable virqfds on cleanup
kbuild: Move -Wenum-{compare-conditional,enum-conversion} into W=1
speakup: Fix 8bit characters from direct synth
slimbus: core: Remove usage of the deprecated ida_simple_xx() API
nvmem: meson-efuse: fix function pointer type mismatch
firmware: meson_sm: Rework driver as a proper platform driver
ext4: fix corruption during on-line resize
hwmon: (amc6821) add of_match table
mmc: core: Fix switch on gp3 partition
dm-raid: fix lockdep waring in "pers->hot_add_disk"
Revert "Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d""
PCI/PM: Drain runtime-idle callbacks before driver removal
PCI: Drop pci_device_remove() test of pci_dev->driver
btrfs: fix off-by-one chunk length calculation at contains_pending_extent()
fuse: don't unhash root
mmc: tmio: avoid concurrent runs of mmc_request_done()
PM: sleep: wakeirq: fix wake irq warning in system suspend
USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M
USB: serial: option: add MeiG Smart SLM320 product
USB: serial: cp210x: add ID for MGP Instruments PDS100
USB: serial: add device ID for VeriFone adapter
USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB
powerpc/fsl: Fix mfpmr build errors with newer binutils
clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays
clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays
clk: qcom: gcc-ipq8074: fix terminating of frequency table arrays
PM: suspend: Set mem_sleep_current during kernel command line setup
parisc: Strip upper 32 bit of sum in csum_ipv6_magic for 64-bit builds
parisc: Fix csum_ipv6_magic on 64-bit systems
parisc: Fix csum_ipv6_magic on 32-bit systems
parisc: Fix ip_fast_csum
parisc: Do not hardcode registers in checksum functions
mtd: rawnand: meson: fix scrambling mode value in command macro
ubi: correct the calculation of fastmap size
ubi: Check for too small LEB size in VTBL code
ubifs: Set page uptodate in the correct place
fat: fix uninitialized field in nostale filehandles
ext4: correct best extent lstart adjustment logic
selftests/mqueue: Set timeout to 180 seconds
crypto: qat - resolve race condition during AER recovery
crypto: qat - fix double free during reset
sparc: vDSO: fix return value of __setup handler
sparc64: NMI watchdog: fix return value of __setup handler
KVM: Always flush async #PF workqueue when vCPU is being destroyed
media: xc4000: Fix atomicity violation in xc4000_get_frequency
serial: max310x: fix NULL pointer dereference in I2C instantiation
arm: dts: marvell: Fix maxium->maxim typo in brownstone dts
ARM: dts: mmp2-brownstone: Don't redeclare phandle references
smack: Handle SMACK64TRANSMUTE in smack_inode_setsecurity()
smack: Set SMACK64TRANSMUTE only for dirs in smack_inode_setxattr()
clk: qcom: gcc-sdm845: Add soft dependency on rpmhpd
media: staging: ipu3-imgu: Set fields before media_entity_pads_init()
wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
timers: Rename del_timer_sync() to timer_delete_sync()
timers: Use del_timer_sync() even on UP
timers: Update kernel-doc for various functions
x86/bugs: Use sysfs_emit()
x86/cpu: Support AMD Automatic IBRS
Documentation/hw-vuln: Update spectre doc
amdkfd: use calloc instead of kzalloc to avoid integer overflow
Linux 5.4.273
regmap: Add missing map->bus check
spi: spi-mt65xx: Fix NULL pointer access in interrupt handler
bpf: report RCU QS in cpumap kthread
rcu: add a helper to report consolidated flavor QS
netfilter: nf_tables: do not compare internal table flags on updates
ARM: dts: sun8i-h2-plus-bananapi-m2-zero: add regulator nodes vcc-dram and vcc1v2
octeontx2-af: Use separate handlers for interrupts
net/bnx2x: Prevent access to a freed page in page_pool
hsr: Handle failures in module init
rds: introduce acquire/release ordering in acquire/release_in_xmit()
packet: annotate data-races around ignore_outgoing
hsr: Fix uninit-value access in hsr_get_node()
s390/vtime: fix average steal time calculation
octeontx2-af: Use matching wake_up API variant in CGX command interface
usb: gadget: net2272: Use irqflags in the call to net2272_probe_fin
staging: greybus: fix get_channel_from_mode() failure path
serial: 8250_exar: Don't remove GPIO device on suspend
rtc: mt6397: select IRQ_DOMAIN instead of depending on it
kconfig: fix infinite loop when expanding a macro at the end of file
tty: serial: samsung: fix tx_empty() to return TIOCSER_TEMT
serial: max310x: fix syntax error in IRQ error message
tty: vt: fix 20 vs 0x20 typo in EScsiignore
afs: Revert "afs: Hide silly-rename files from userspace"
NFS: Fix an off by one in root_nfs_cat()
watchdog: stm32_iwdg: initialize default timeout
net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr()
scsi: bfa: Fix function pointer type mismatch for hcb_qe->cbfn
RDMA/device: Fix a race between mad_client and cm_client init
scsi: csiostor: Avoid function pointer casts
ALSA: usb-audio: Stop parsing channels bits when all channels are found.
clk: Fix clk_core_get NULL dereference
sparc32: Fix section mismatch in leon_pci_grpci
backlight: lp8788: Fully initialize backlight_properties during probe
backlight: lm3639: Fully initialize backlight_properties during probe
backlight: da9052: Fully initialize backlight_properties during probe
backlight: lm3630a: Don't set bl->props.brightness in get_brightness
backlight: lm3630a: Initialize backlight_properties on init
powerpc/embedded6xx: Fix no previous prototype for avr_uart_send() etc.
drm/msm/dpu: add division of drm_display_mode's hskew parameter
powerpc/hv-gpci: Fix the H_GET_PERF_COUNTER_INFO hcall return value checks
drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip
media: ttpci: fix two memleaks in budget_av_attach
media: media/pci: rename VFL_TYPE_GRABBER to _VIDEO
media: rename VFL_TYPE_GRABBER to _VIDEO
media: v4l2-core: correctly validate video and metadata ioctls
media: go7007: fix a memleak in go7007_load_encoder
media: dvb-frontends: avoid stack overflow warnings with clang
media: pvrusb2: fix uaf in pvr2_context_set_notify
drm/amdgpu: Fix missing break in ATOM_ARG_IMM Case of atom_get_src_int()
ASoC: meson: axg-tdm-interface: fix mclk setup without mclk-fs
mtd: rawnand: lpc32xx_mlc: fix irq handler prototype
mtd: maps: physmap-core: fix flash size larger than 32-bit
crypto: arm/sha - fix function cast warnings
mfd: altera-sysmgr: Call of_node_put() only when of_parse_phandle() takes a ref
mfd: syscon: Call of_node_put() only when of_parse_phandle() takes a ref
drm/tegra: put drm_gem_object ref on error in tegra_fb_create
clk: hisilicon: hi3519: Release the correct number of gates in hi3519_clk_unregister()
PCI: Mark 3ware-9650SE Root Port Extended Tags as broken
drm/mediatek: dsi: Fix DSI RGB666 formats and definitions
clk: qcom: dispcc-sdm845: Adjust internal GDSC wait times
media: pvrusb2: fix pvr2_stream_callback casts
media: pvrusb2: remove redundant NULL check
media: go7007: add check of return value of go7007_read_addr()
media: imx: csc/scaler: fix v4l2_ctrl_handler memory leak
perf stat: Avoid metric-only segv
ALSA: seq: fix function cast warnings
drm/radeon/ni: Fix wrong firmware size logging in ni_init_microcode()
perf thread_map: Free strlist on normal path in thread_map__new_by_tid_str()
PCI: switchtec: Fix an error handling path in switchtec_pci_probe()
quota: Fix rcu annotations of inode dquot pointers
quota: Fix potential NULL pointer dereference
quota: simplify drop_dquot_ref()
clk: qcom: reset: Ensure write completion on reset de/assertion
clk: qcom: reset: Commonize the de/assert functions
clk: qcom: reset: support resetting multiple bits
clk: qcom: reset: Allow specifying custom reset delay
media: edia: dvbdev: fix a use-after-free
media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity
media: v4l2-tpg: fix some memleaks in tpg_alloc
media: em28xx: annotate unchecked call to media_device_register()
perf evsel: Fix duplicate initialization of data->id in evsel__parse_sample()
drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()'
perf record: Fix possible incorrect free in record__switch_output()
PCI/DPC: Print all TLP Prefixes, not just the first
media: tc358743: register v4l2 async device only after successful setup
dmaengine: tegra210-adma: Update dependency to ARCH_TEGRA
drm/rockchip: lvds: do not overwrite error code
drm: Don't treat 0 as -1 in drm_fixp2int_ceil
drm/rockchip: inno_hdmi: Fix video timing
drm/tegra: output: Fix missing i2c_put_adapter() in the error handling paths of tegra_output_probe()
drm/tegra: dsi: Fix missing pm_runtime_disable() in the error handling path of tegra_dsi_probe()
drm/tegra: dsi: Fix some error handling paths in tegra_dsi_probe()
drm/tegra: dsi: Make use of the helper function dev_err_probe()
gpu: host1x: mipi: Update tegra_mipi_request() to be node based
drm/tegra: dsi: Add missing check for of_find_device_by_node
dm: call the resume method on internal suspend
dm raid: fix false positive for requeue needed during reshape
nfp: flower: handle acti_netdevs allocation failure
net/x25: fix incorrect parameter validation in the x25_getsockopt() function
net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function
udp: fix incorrect parameter validation in the udp_lib_getsockopt() function
l2tp: fix incorrect parameter validation in the pppol2tp_getsockopt() function
tcp: fix incorrect parameter validation in the do_tcp_getsockopt() function
net: hns3: fix port duplex configure error in IMP reset
net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()
ipv6: fib6_rules: flush route cache when rule is changed
bpf: Fix stackmap overflow check on 32-bit arches
bpf: Fix hashtab overflow check on 32-bit arches
sr9800: Add check for usbnet_get_endpoints
Bluetooth: hci_core: Fix possible buffer overflow
Bluetooth: Remove superfluous call to hci_conn_check_pending()
igb: Fix missing time sync events
igb: move PEROUT and EXTTS isr logic to separate functions
mmc: wmt-sdmmc: remove an incorrect release_mem_region() call in the .remove function
SUNRPC: fix some memleaks in gssx_dec_option_array
x86, relocs: Ignore relocations in .notes section
ACPI: scan: Fix device check notification handling
ARM: dts: imx6dl-yapp4: Move the internal switch PHYs under the switch node
ARM: dts: imx6dl-yapp4: Fix typo in the QCA switch register address
ARM: dts: imx6dl-yapp4: Move phy reset into switch node
ARM: dts: arm: realview: Fix development chip ROM compatible value
net: ena: Remove ena_select_queue
net: ena: cosmetic: fix line break issues
wifi: brcmsmac: avoid function pointer casts
iommu/amd: Mark interrupt as managed
bus: tegra-aconnect: Update dependency to ARCH_TEGRA
ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()
arm64: dts: qcom: msm8996: Pad addresses
arm64: dts: qcom: msm8996: Move regulator consumers to db820c
arm64: dts: qcom: msm8996: Use node references in db820c
arm64: dts: qcom: db820c: Move non-soc entries out of /soc
bpf: Mark bpf_spin_{lock,unlock}() helpers with notrace correctly
bpf: Factor out bpf_spin_lock into helpers.
bpf: Add typecast to bpf helpers to help BTF generation
arm64: dts: mediatek: mt7622: add missing "device_type" to memory nodes
wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
net: blackhole_dev: fix build warning for ethh set but not used
af_unix: Annotate data-race of gc_in_progress in wait_for_unix_gc().
sock_diag: annotate data-races around sock_diag_handlers[family]
wifi: mwifiex: debugfs: Drop unnecessary error check for debugfs_create_dir()
wifi: wilc1000: fix RCU usage in connect path
wifi: wilc1000: fix declarations ordering
wifi: b43: Disable QoS for bcm4331
wifi: b43: Stop correct queue in DMA worker when QoS is disabled
b43: main: Fix use true/false for bool type
wifi: b43: Stop/wake correct queue in PIO Tx path when QoS is disabled
wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled
b43: dma: Fix use true/false for bool type variable
wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()
timekeeping: Fix cross-timestamp interpolation for non-x86
timekeeping: Fix cross-timestamp interpolation corner case decision
timekeeping: Fix cross-timestamp interpolation on counter wrap
aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
fs/select: rework stack allocation hack for clang
nbd: null check for nla_nest_start
do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
ASoC: wm8962: Fix up incorrect error message in wm8962_set_fll
ASoC: wm8962: Enable both SPKOUTR_ENA and SPKOUTL_ENA in mono mode
ASoC: wm8962: Enable oscillator if selecting WM8962_FLL_OSC
Input: gpio_keys_polled - suppress deferred probe error for gpio
ASoC: Intel: bytcr_rt5640: Add an extra entry for the Chuwi Vi8 tablet
firewire: core: use long bus reset on gap count error
Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security
scsi: mpt3sas: Prevent sending diag_reset when the controller is ready
btrfs: fix data race at btrfs_use_block_rsv() when accessing block reserve
dm-verity, dm-crypt: align "struct bvec_iter" correctly
block: sed-opal: handle empty atoms when parsing response
parisc/ftrace: add missing CONFIG_DYNAMIC_FTRACE check
net/iucv: fix the allocation size of iucv_path_table array
RDMA/mlx5: Relax DEVX access upon modify commands
HID: multitouch: Add required quirk for Synaptics 0xcddc device
MIPS: Clear Cause.BD in instruction_pointer_set
x86/xen: Add some null pointer checking to smp.c
ASoC: rt5645: Make LattePanda board DMI match more precise
selftests: tls: use exact comparison in recv_partial
io_uring: drop any code related to SCM_RIGHTS
io_uring/unix: drop usage of io_uring socket
UPSTREAM: arm64: dts: qcom: sdm845: fix USB DP/DM HS PHY interrupts
UPSTREAM: arm64: dts: qcom: add PDC interrupt controller for SDM845
Linux 5.4.272
arm64: dts: qcom: sdm845: fix USB DP/DM HS PHY interrupts
arm64: dts: qcom: add PDC interrupt controller for SDM845
serial: max310x: fix IO data corruption in batched operations
serial: max310x: implement I2C support
serial: max310x: make accessing revision id interface-agnostic
regmap: Add bulk read/write callbacks into regmap_config
regmap: allow to define reg_update_bits for no bus configuration
serial: max310x: Unprepare and disable clock in error path
getrusage: use sig->stats_lock rather than lock_task_sighand()
getrusage: use __for_each_thread()
getrusage: move thread_group_cputime_adjusted() outside of lock_task_sighand()
getrusage: add the "signal_struct *sig" local variable
y2038: rusage: use __kernel_old_timeval
hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed
hv_netvsc: use netif_is_bond_master() instead of open code
hv_netvsc: Make netvsc/VF binding check both MAC and serial number
Input: i8042 - fix strange behavior of touchpad on Clevo NS70PU
serial: max310x: prevent infinite while() loop in port startup
serial: max310x: use a separate regmap for each port
serial: max310x: use regmap methods for SPI batch operations
serial: max310x: Make use of device properties
serial: max310x: fail probe if clock crystal is unstable
serial: max310x: Try to get crystal clock rate from property
serial: max310x: Use devm_clk_get_optional() to get the input clock
um: allow not setting extra rpaths in the linux binary
selftests: mm: fix map_hugetlb failure on 64K page size systems
netrom: Fix data-races around sysctl_net_busy_read
netrom: Fix a data-race around sysctl_netrom_link_fails_count
netrom: Fix a data-race around sysctl_netrom_routing_control
netrom: Fix a data-race around sysctl_netrom_transport_no_activity_timeout
netrom: Fix a data-race around sysctl_netrom_transport_requested_window_size
netrom: Fix a data-race around sysctl_netrom_transport_busy_delay
netrom: Fix a data-race around sysctl_netrom_transport_acknowledge_delay
netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries
netrom: Fix a data-race around sysctl_netrom_transport_timeout
netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser
netrom: Fix a data-race around sysctl_netrom_obsolescence_count_initialiser
netrom: Fix a data-race around sysctl_netrom_default_path_quality
netfilter: nf_conntrack_h323: Add protection for bmp length out of range
netfilter: nft_ct: fix l3num expectations with inet pseudo family
net/rds: fix WARNING in rds_conn_connect_if_down
net/ipv6: avoid possible UAF in ip6_route_mpath_notify()
net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink()
geneve: make sure to pull inner header in geneve_rx()
ixgbe: {dis, en}able irqs in ixgbe_txrx_ring_{dis, en}able
net: lan78xx: fix runtime PM count underflow on link stop
lan78xx: Fix race conditions in suspend/resume handling
lan78xx: Fix partial packet errors on suspend/resume
lan78xx: Add missing return code checks
lan78xx: Fix white space and style issues
Linux 5.4.271
gpio: 74x164: Enable output pins after registers are reset
fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super
cachefiles: fix memory leak in cachefiles_add_cache()
x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers
mmc: core: Fix eMMC initialization with 1-bit bus connection
dmaengine: fsl-qdma: init irq after reg initialization
dmaengine: fsl-qdma: fix SoC may hang on 16 byte unaligned read
btrfs: dev-replace: properly validate device names
wifi: nl80211: reject iftype change with mesh ID change
gtp: fix use-after-free and null-ptr-deref in gtp_newlink()
afs: Fix endless loop in directory parsing
ALSA: Drop leftover snd-rtctimer stuff from Makefile
power: supply: bq27xxx-i2c: Do not free non existing IRQ
efi/capsule-loader: fix incorrect allocation size
rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back
netfilter: nf_tables: allow NFPROTO_INET in nft_(match/target)_validate()
Bluetooth: Enforce validation on max value of connection interval
Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST
Bluetooth: Avoid potential use-after-free in hci_error_reset
net: usb: dm9601: fix wrong return value in dm9601_mdio_read
lan78xx: enable auto speed configuration for LAN7850 if no EEPROM is detected
ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()
tun: Fix xdp_rxq_info's queue_index when detaching
net: ip_tunnel: prevent perpetual headroom growth
netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
ANDROID: GKI: update .xml file due to USB changes in 5.4.270
Revert "bpf: Add map and need_defer parameters to .map_fd_put_ptr()"
Revert "hrtimer: Report offline hrtimer enqueue"
Revert "drm/mipi-dsi: Fix detach call without attach"
Linux 5.4.270
scripts/bpf: Fix xdp_md forward declaration typo
fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio
drm/syncobj: call drm_syncobj_fence_add_wait when WAIT_AVAILABLE flag is set
drm/syncobj: make lockdep complain on WAIT_FOR_SUBMIT v3
netfilter: nf_tables: set dormant flag on hook register failure
tls: stop recv() if initial process_rx_list gave us non-DATA
tls: rx: drop pointless else after goto
tls: rx: jump to a more appropriate label
s390: use the correct count for __iowrite64_copy()
packet: move from strlcpy with unused retval to strscpy
ipv6: sr: fix possible use-after-free and null-ptr-deref
afs: Increase buffer size in afs_update_volume_status()
ipv6: properly combine dev_base_seq and ipv6.dev_addr_genid
ipv4: properly combine dev_base_seq and ipv4.dev_addr_genid
nouveau: fix function cast warnings
scsi: jazz_esp: Only build if SCSI core is builtin
bpf, scripts: Correct GPL license name
scripts/bpf: teach bpf_helpers_doc.py to dump BPF helper definitions
RDMA/srpt: fix function pointer cast warnings
RDMA/srpt: Make debug output more detailed
RDMA/bnxt_re: Return error for SRQ resize
IB/hfi1: Fix a memleak in init_credit_return
usb: roles: don't get/set_role() when usb_role_switch is unregistered
usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs
usb: cdns3: fix memory double free when handle zero packet
usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable()
ARM: ep93xx: Add terminator to gpiod_lookup_table
l2tp: pass correct message length to ip6_append_data
PCI/MSI: Prevent MSI hardware interrupt number truncation
gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()
dm-crypt: don't modify the data when using authenticated encryption
IB/hfi1: Fix sdma.h tx->num_descs off-by-one error
PCI: tegra: Fix OF node reference leak
PCI: tegra: Fix reporting GPIO error value
arm64: dts: qcom: msm8916: Fix typo in pronto remoteproc node
drm/amdgpu: Fix type of second parameter in trans_msg() callback
iomap: Set all uptodate bits for an Uptodate page
dm-integrity: don't modify bio's immutable bio_vec in integrity_metadata()
x86/alternatives: Disable KASAN in apply_alternatives()
drm/amdgpu: Check for valid number of registers to read
Revert "drm/sun4i: dsi: Change the start delay calculation"
ALSA: hda/realtek - Enable micmute LED on and HP system
selftests/bpf: Avoid running unprivileged tests with alignment requirements
net: bridge: clear bridge's private skb space on xmit
spi: mt7621: Fix an error message in mt7621_spi_probe()
pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups
pinctrl: pinctrl-rockchip: Fix a bunch of kerneldoc misdemeanours
tcp: add annotations around sk->sk_shutdown accesses
tcp: return EPOLLOUT from tcp_poll only when notsent_bytes is half the limit
tcp: factor out __tcp_close() helper
pmdomain: renesas: r8a77980-sysc: CR7 must be always on
s390/qeth: Fix potential loss of L3-IP@ in case of network issues
virtio-blk: Ensure no requests in virtqueues before deleting vqs.
firewire: core: send bus reset promptly on gap count error
scsi: lpfc: Use unsigned type for num_sge
hwmon: (coretemp) Enlarge per package core count limit
nvmet-fc: abort command when there is no binding
netfilter: conntrack: check SCTP_CID_SHUTDOWN_ACK for vtag setting in sctp_new
ASoC: sunxi: sun4i-spdif: Add support for Allwinner H616
nvmet-tcp: fix nvme tcp ida memory leak
regulator: pwm-regulator: Add validity checks in continuous .get_voltage
ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()
ahci: add 43-bit DMA address quirk for ASMedia ASM1061 controllers
ahci: asm1166: correct count of reported ports
fbdev: sis: Error out if pixclock equals zero
fbdev: savage: Error out if pixclock equals zero
wifi: mac80211: fix race condition on enabling fast-xmit
wifi: cfg80211: fix missing interfaces when dumping
dmaengine: fsl-qdma: increase size of 'irq_name'
dmaengine: shdma: increase size of 'dev_id'
scsi: target: core: Add TMF to tmr_list handling
sched/rt: Disallow writing invalid values to sched_rt_period_us
sched/rt: Fix sysctl_sched_rr_timeslice intial value
userfaultfd: fix mmap_changing checking in mfill_atomic_hugetlb
nilfs2: replace WARN_ONs for invalid DAT metadata block requests
memcg: add refcnt for pcpu stock to avoid UAF problem in drain_all_stock()
sched/rt: sysctl_sched_rr_timeslice show default timeslice after reset
net/sched: Retire dsmark qdisc
net/sched: Retire ATM qdisc
net/sched: Retire CBQ qdisc
KVM: arm64: vgic-its: Test for valid IRQ in MOVALL handler
KVM: arm64: vgic-its: Test for valid IRQ in its_sync_lpi_pending_table()
Linux 5.4.269
of: gpio unittest kfree() wrong object
of: unittest: fix EXPECT text for gpio hog errors
net: bcmgenet: Fix EEE implementation
Revert "Revert "mtd: rawnand: gpmi: Fix setting busy timeout setting""
netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval()
lsm: new security_file_ioctl_compat() hook
drm/msm/dsi: Enable runtime PM
PM: runtime: Have devm_pm_runtime_enable() handle pm_runtime_dont_use_autosuspend()
PM: runtime: add devm_pm_runtime_enable helper
nilfs2: fix potential bug in end_buffer_async_write
sched/membarrier: reduce the ability to hammer on sys_membarrier
net: prevent mss overflow in skb_segment()
netfilter: ipset: Missing gc cancellations fixed
netfilter: ipset: fix performance regression in swap operation
KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache
mips: Fix max_mapnr being uninitialized on early stages
arch, mm: remove stale mentions of DISCONIGMEM
bus: moxtet: Add spi device table
Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"
tracing: Inform kmemleak of saved_cmdlines allocation
pmdomain: core: Move the unused cleanup to a _sync initcall
can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)
irqchip/irq-brcmstb-l2: Add write memory barrier before exit
nfp: flower: prevent re-adding mac index for bonded port
nfp: use correct macro for LengthSelect in BAR config
nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
nilfs2: fix data corruption in dsync block recovery for small block sizes
ALSA: hda/conexant: Add quirk for SWS JS201D
mmc: slot-gpio: Allow non-sleeping GPIO ro
x86/mm/ident_map: Use gbpages only where full GB page should be mapped.
x86/Kconfig: Transmeta Crusoe is CPU family 5, not 6
serial: max310x: improve crystal stable clock detection
serial: max310x: set default value when reading clock ready bit
ring-buffer: Clean ring_buffer_poll_wait() error return
iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC
staging: iio: ad5933: fix type mismatch regression
tracing: Fix wasted memory in saved_cmdlines logic
ext4: fix double-free of blocks due to wrong extents moved_len
misc: fastrpc: Mark all sessions as invalid in cb_remove
binder: signal epoll threads of self-work
ALSA: hda/realtek: Enable headset mic on Vaio VJFE-ADL
xen-netback: properly sync TX responses
nfc: nci: free rx_data_reassembly skb on NCI device cleanup
kbuild: Fix changing ELF file type for output of gen_btf for big endian
firewire: core: correct documentation of fw_csr_string() kernel API
scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock"
i2c: i801: Fix block process call transactions
i2c: i801: Remove i801_set_block_buffer_mode
usb: f_mass_storage: forbid async queue when shutdown happen
USB: hub: check for alternate port before enabling A_ALT_HNP_SUPPORT
HID: wacom: Do not register input devices until after hid_hw_start
HID: wacom: generic: Avoid reporting a serial of '0' to userspace
mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again
tracing/trigger: Fix to return error if failed to alloc snapshot
i40e: Fix waiting for queues of all VSIs to be disabled
MIPS: Add 'memory' clobber to csum_ipv6_magic() inline assembler
ASoC: rt5645: Fix deadlock in rt5645_jack_detect_work()
spi: ppc4xx: Drop write-only variable
of: unittest: Fix compile in the non-dynamic case
of: unittest: add overlay gpio test to catch gpio hog problem
btrfs: send: return EOPNOTSUPP on unknown flags
btrfs: forbid deleting live subvol qgroup
btrfs: forbid creating subvol qgroups
netfilter: nft_set_rbtree: skip end interval element from gc
net: stmmac: xgmac: fix a typo of register name in DPP safety handling
net: stmmac: xgmac: use #define for string constants
vhost: use kzalloc() instead of kmalloc() followed by memset()
Input: atkbd - skip ATKBD_CMD_SETLEDS when skipping ATKBD_CMD_GETID
hrtimer: Report offline hrtimer enqueue
USB: serial: cp210x: add ID for IMST iM871A-USB
USB: serial: option: add Fibocom FM101-GL variant
USB: serial: qcserial: add new usb-id for Dell Wireless DW5826e
net/af_iucv: clean up a try_then_request_module()
netfilter: nft_ct: reject direction for ct id
netfilter: nft_compat: restrict match/target protocol to u16
netfilter: nft_compat: reject unused compat flag
ppp_async: limit MRU to 64K
tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()
rxrpc: Fix response to PING RESPONSE ACKs to a dead call
inet: read sk->sk_family once in inet_recv_error()
hwmon: (coretemp) Fix bogus core_id to attr name mapping
hwmon: (coretemp) Fix out-of-bounds memory access
hwmon: (aspeed-pwm-tacho) mutex for tach reading
atm: idt77252: fix a memleak in open_card_ubr0
selftests: net: avoid just another constant wait
net: stmmac: xgmac: fix handling of DPP safety error for DMA channels
phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV
phy: renesas: rcar-gen3-usb2: Fix returning wrong error code
dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA
dmaengine: fsl-qdma: Fix a memory leak related to the status queue DMA
bonding: remove print in bond_verify_device_path
HID: apple: Add 2021 magic keyboard FN key mapping
HID: apple: Swap the Fn and Left Control keys on Apple keyboards
HID: apple: Add support for the 2021 Magic Keyboard
net: sysfs: Fix /sys/class/net/<iface> path
af_unix: fix lockdep positive in sk_diag_dump_icons()
net: ipv4: fix a memleak in ip_setup_cork
netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations
netfilter: nf_log: replace BUG_ON by WARN_ON_ONCE when putting logger
llc: call sock_orphan() at release time
ipv6: Ensure natural alignment of const ipv6 loopback and router addresses
ixgbe: Fix an error handling path in ixgbe_read_iosf_sb_reg_x550()
ixgbe: Refactor overtemp event handling
ixgbe: Refactor returning internal error codes
ixgbe: Remove non-inclusive language
net: remove unneeded break
scsi: isci: Fix an error code problem in isci_io_request_build()
wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update
perf: Fix the nr_addr_filters fix
drm/amdgpu: Release 'adev->pm.fw' before return in 'amdgpu_device_need_post()'
ceph: fix deadlock or deadcode of misusing dget()
blk-mq: fix IO hang from sbitmap wakeup race
virtio_net: Fix "‘%d’ directive writing between 1 and 11 bytes into a region of size 10" warnings
libsubcmd: Fix memory leak in uniq()
PCI/AER: Decode Requester ID when no error info found
fs/kernfs/dir: obey S_ISGID
usb: hub: Replace hardcoded quirk value with BIT() macro
PCI: switchtec: Fix stdev_release() crash after surprise hot remove
PCI: Only override AMD USB controller if required
mfd: ti_am335x_tscadc: Fix TI SoC dependencies
i3c: master: cdns: Update maximum prescaler value for i2c clock
um: net: Fix return type of uml_net_start_xmit()
um: Don't use vfprintf() for os_info()
um: Fix naming clash between UML and scheduler
leds: trigger: panic: Don't register panic notifier if creating the trigger failed
drm/amdgpu: Drop 'fence' check in 'to_amdgpu_amdkfd_fence()'
drm/amdgpu: Let KFD sync with VM fences
clk: mmp: pxa168: Fix memory leak in pxa168_clk_init()
clk: hi3620: Fix memory leak in hi3620_mmc_clk_init()
drm/msm/dpu: Ratelimit framedone timeout msgs
media: ddbridge: fix an error code problem in ddb_probe
IB/ipoib: Fix mcast list locking
drm/exynos: Call drm_atomic_helper_shutdown() at shutdown/unbind time
ALSA: hda: Intel: add HDA_ARL PCI ID support
PCI: add INTEL_HDA_ARL to pci_ids.h
media: rockchip: rga: fix swizzling for RGB formats
media: stk1160: Fixed high volume of stk1160_dbg messages
drm/mipi-dsi: Fix detach call without attach
drm/framebuffer: Fix use of uninitialized variable
drm/drm_file: fix use of uninitialized variable
RDMA/IPoIB: Fix error code return in ipoib_mcast_join
fast_dput(): handle underflows gracefully
ASoC: doc: Fix undefined SND_SOC_DAPM_NOPM argument
f2fs: fix to check return value of f2fs_reserve_new_block()
wifi: cfg80211: free beacon_ies when overridden from hidden BSS
wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift()
wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices
arm64: dts: qcom: msm8998: Fix 'out-ports' is a required property
arm64: dts: qcom: msm8996: Fix 'in-ports' is a required property
md: Whenassemble the array, consult the superblock of the freshest device
block: prevent an integer overflow in bvec_try_merge_hw_page
ARM: dts: imx23/28: Fix the DMA controller node name
ARM: dts: imx23-sansa: Use preferred i2c-gpios properties
ARM: dts: imx27-apf27dev: Fix LED name
ARM: dts: imx25/27: Pass timing0
ARM: dts: imx1: Fix sram node
ARM: dts: imx27: Fix sram node
ARM: dts: imx: Use flash@0,0 pattern
ARM: dts: imx25/27-eukrea: Fix RTC node name
ARM: dts: rockchip: fix rk3036 hdmi ports node
scsi: libfc: Fix up timeout error in fc_fcp_rec_error()
scsi: libfc: Don't schedule abort twice
bpf: Add map and need_defer parameters to .map_fd_put_ptr()
wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
ARM: dts: imx7s: Fix nand-controller #size-cells
ARM: dts: imx7s: Fix lcdif compatible
ARM: dts: imx7d: Fix coresight funnel ports
bonding: return -ENOMEM instead of BUG in alb_upper_dev_walk
PCI: Add no PM reset quirk for NVIDIA Spectrum devices
scsi: lpfc: Fix possible file string name overflow when updating firmware
selftests/bpf: Fix pyperf180 compilation failure with clang18
selftests/bpf: satisfy compiler by having explicit return in btf test
wifi: rt2x00: restart beacon queue when hardware reset
ext4: avoid online resizing failures due to oversized flex bg
ext4: remove unnecessary check from alloc_flex_gd()
ext4: unify the type of flexbg_size to unsigned int
ext4: fix inconsistent between segment fstrim and full fstrim
ecryptfs: Reject casefold directory inodes
SUNRPC: Fix a suspicious RCU usage warning
KVM: s390: fix setting of fpc register
s390/ptrace: handle setting of fpc register correctly
jfs: fix array-index-out-of-bounds in diNewExt
rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock()
afs: fix the usage of read_seqbegin_or_lock() in afs_find_server*()
crypto: stm32/crc32 - fix parsing list of devices
pstore/ram: Fix crash when setting number of cpus to an odd number
jfs: fix uaf in jfs_evict_inode
jfs: fix array-index-out-of-bounds in dbAdjTree
jfs: fix slab-out-of-bounds Read in dtSearch
UBSAN: array-index-out-of-bounds in dtSplitRoot
FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
ACPI: extlog: fix NULL pointer dereference check
PNP: ACPI: fix fortify warning
ACPI: video: Add quirk for the Colorful X15 AT 23 Laptop
audit: Send netlink ACK before setting connection in auditd_set
regulator: core: Only increment use_count when enable_count changes
perf/core: Fix narrow startup race when creating the perf nr_addr_filters sysfs file
x86/mce: Mark fatal MCE's page as poison to avoid panic in the kdump kernel
powerpc/lib: Validate size for vector operations
powerpc: pmd_move_must_withdraw() is only needed for CONFIG_TRANSPARENT_HUGEPAGE
powerpc/mm: Fix build failures due to arch_reserved_kernel_pages()
powerpc: Fix build error due to is_valid_bugaddr()
powerpc/mm: Fix null-pointer dereference in pgtable_cache_add
x86/entry/ia32: Ensure s32 is sign extended to s64
tick/sched: Preserve number of idle sleeps across CPU hotplug events
mips: Call lose_fpu(0) before initializing fcr31 in mips_set_personality_nan
spi: bcm-qspi: fix SFDP BFPT read by usig mspi read
gpio: eic-sprd: Clear interrupt after set the interrupt type
drm/exynos: gsc: minor fix for loop iteration in gsc_runtime_resume
drm/exynos: fix accidental on-stack copy of exynos_drm_plane
drm/bridge: nxp-ptn3460: simplify some error checking
drm/bridge: nxp-ptn3460: fix i2c_master_send() error checking
drm: Don't unref the same fb many times by mistake due to deadlock handling
gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-04
netfilter: nf_tables: reject QUEUE/DROP verdict parameters
rbd: don't move requests to the running list on errors
btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args
btrfs: don't warn if discard range is not aligned to sector
btrfs: tree-checker: fix inline ref size in error messages
btrfs: ref-verify: free ref cache before clearing mount opt
net: fec: fix the unhandled context fault from smmu
fjes: fix memleaks in fjes_hw_setup
netfilter: nf_tables: validate NFPROTO_* family
netfilter: nf_tables: restrict anonymous set and map names to 16 bytes
net/mlx5e: fix a double-free in arfs_create_groups
net/mlx5: Use kfree(ft->g) in arfs_create_groups()
net/mlx5: DR, Use the right GVMI number for drop action
netlink: fix potential sleeping issue in mqueue_flush_file
tcp: Add memory barrier to tcp_push()
afs: Hide silly-rename files from userspace
tracing: Ensure visibility when inserting an element into tracing_map
net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv
llc: Drop support for ETH_P_TR_802_2.
llc: make llc_ui_sendmsg() more robust against bonding changes
vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING
net/smc: fix illegal rmb_desc access in SMC-D connection dump
x86/CPU/AMD: Fix disabling XSAVES on AMD family 0x17 due to erratum
powerpc: Use always instead of always-y in for crtsavres.o
fs: move S_ISGID stripping into the vfs_*() helpers
fs: add mode_strip_sgid() helper
mtd: spinand: macronix: Fix MX35LFxGE4AD page size
block: Remove special-casing of compound pages
rename(): fix the locking of subdirectories
ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
nouveau/vmm: don't set addr on the fail path to avoid warning
mmc: core: Use mrq.sbc in close-ended ffu
arm64: dts: qcom: sdm845: fix USB wakeup interrupt types
parisc/firmware: Fix F-extend for PDC addresses
rpmsg: virtio: Free driver_override when rpmsg_remove()
hwrng: core - Fix page fault dead lock on mmap-ed hwrng
PM: hibernate: Enforce ordering during image compression/decompression
crypto: api - Disallow identical driver names
ext4: allow for the last group to be marked as trimmed
serial: sc16is7xx: add check for unsupported SPI modes during probe
spi: introduce SPI_MODE_X_MASK macro
serial: sc16is7xx: set safe default SPI clock frequency
units: add the HZ macros
units: change from 'L' to 'UL'
units: Add Watt units
include/linux/units.h: add helpers for kelvin to/from Celsius conversion
PCI: mediatek: Clear interrupt status before dispatching handler
Conflicts:
both modified: include/linux/timer.h
both modified: mm/memory-failure.c
both modified: mm/mlock.c
both modified: mm/mprotect.c
both modified: scripts/Makefile.extrawarn
Change-Id: Ia59be9dbba9400fa82dcd3c3a7d50ee6012701fb
Signed-off-by: kamasali Satyanarayan <kamasali@qti.qualcomm.com>
Decrement the smcinvoke server object refcount in mutex context
so that we never get an object which is being freed.
Change-Id: I1bab3d630436923c7eb60f2d46dcc3f2bd037097
Signed-off-by: Nishant Pandey <quic_nishpand@quicinc.com>
External researcher found UAF in qcedev_smmu.c on an error condition in
qcedev_check_and_map_buffer. When an error occurs, we free binfo, but it
is still kept in the registeredbufs list. The fix removes it from the
list before freeing binfo.
Change-Id: I0327e456bd46106b12c36a5a21305407aae428dd
Signed-off-by: Daniel Perez-Zoghbi <quic_dperezzo@quicinc.com>
Add support to detect higher thermal profile parts and update thermal
zone trips dynamically based on nvmem cell data for tsens.
Change-Id: I792c4f2736d10d68b45cc9b64c0ec08d185cf007
Signed-off-by: Manaf Meethalavalappu Pallikunhi <quic_manafm@quicinc.com>
Should use different way to get the core info for
different device.
Change-Id: I8231d08afa75a1f47781f54ec2e5fa264820cc9e
Signed-off-by: ptak <quic_ptak@quicinc.com>
If FW send a pkt->size which is less than the sizeof packet structure
then pkt->size - sizeof() would result into an integer underflow.
Due to this the subsequent check would be bypassed and we will
start write to an OOB memory.
Change-Id: Icb3e4e6d64275592ceb6f747de653dcc1c65fec7
Signed-off-by: ptak <quic_ptak@quicinc.com>
Avoid setting this bit to make sure device stays in L1SS when D-state is
changes to D3 Hot.
Because of device not staying in L1SS the PCIe link was going through
recovery all the time power consumption was higher than expected value.
Change-Id: Id06996745171e62d3a9dbc499c693f8a9870b2ea
Signed-off-by: Pallavi Singh <quic_pallsing@quicinc.com>
Updated the existing pad variable to
support multi tunnel in SINGLE_TAG
feature.
Change-Id: I9be926250308e1b4375b677834e0e83eaa9aad41
Signed-off-by: Himansu Nayak <quic_himansu@quicinc.com>
Currently inorder to issue remote wakup to host, we perform some
register operations which are needed only for DWC3_IP versions
>= 194A, but we do perform operations for DWC31_IP controllers as
well, which is not expected. Hence cleanup the IP and revisions
of DWC3 in remote wakup path.
Change-Id: Idede7b05b1fb53fe582c6e2d7483784d578a9738
Signed-off-by: Prashanth K <quic_prashk@quicinc.com>
Currently if the Modem sends notifications like Rind Indicator
or Carrier Detect, we just bail out if USB is already suspended.
Add remote wakeup capability in this path.
Change-Id: I62321d67e54390f167776af563c0b666b0d9e789
Signed-off-by: Prashanth K <quic_prashk@quicinc.com>
In case nodump mode is already set, do not allow user to
change dump mode to other modes now.
Change-Id: I25b9e0d20b4dca2fb19d22f225a3dd9f0ea66cc5
Signed-off-by: Khaja Hussain Shaik Khaji <quic_kshaikkh@quicinc.com>
Add an SCM call to read the dload mode cookie, which can
be used in various drivers to make decisions based on the
dload mode. Earlier, this support was not there and HLOS
was not aware of changes in this cookie, outside of its
domain.
Change-Id: I3bb82b65bc411354090b34b98f7e651dd1888e5b
Signed-off-by: Khaja Hussain Shaik Khaji <quic_kshaikkh@quicinc.com>
Currently, separate submissions are made for page table
switch and context switch to the ring buffer. However, if
the page table switch succeeds but the context switch fails,
it can lead to use of wrong page table for drawctxt.
To address this issue, submit page table switch and context
switch commands as a single submission to ring buffer.
Also, remove the unnecessary ADRENO_DEVICE_FAULT check and
correctly put the refcount of adreno context during error
cleanup.
Change-Id: I1bb4ee3ebb0ce6ea32f0b6799cfb7fa89c0d09c7
Signed-off-by: Rakesh Naidu Bhaviripudi <quic_rakeshb@quicinc.com>
In case of unexpected warm-restart, device will go into special
download modes. Add support to not go into download modes
i.e., nodump mode.
Change-Id: Ica5f1b22a648458b151a8ae696e97aad83b7fc6c
Signed-off-by: Khaja Hussain Shaik Khaji <quic_kshaikkh@quicinc.com>
Enable POWER_RESET_QCOM_DOWNLOAD_MODE_NODUMP for sdxlemur so that
on a warm-restart, user can choose to set nodump as download mode.
Change-Id: Icc600c2c45a266a56df890c16f1d32fd7a7eb98c
Signed-off-by: Khaja Hussain Shaik Khaji <quic_kshaikkh@quicinc.com>
Depending on the platform binary being executed, the linker
(interpreter) requested can be one of:
1) /system/bin/bootstrap/linker64
2) /system/bin/linker64
3) /apex/com.android.runtime/bin/linker64
Relax the check to the basename (linker64), instead of the path.
Bug: 330767927
Bug: 335584973
Change-Id: I4a1f95b7cecd126f85ad8cefd9ff10d272947f9e
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
[ Upstream commit 97af84a6bba2ab2b9c704c08e67de3b5ea551bb2 ]
When touching unix_sk(sk)->inflight, we are always under
spin_lock(&unix_gc_lock).
Let's convert unix_sk(sk)->inflight to the normal unsigned long.
Bug: 336226035
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://lore.kernel.org/r/20240123170856.41348-3-kuniyu@amazon.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 47d8ac011fe1 ("af_unix: Fix garbage collector racing against connect()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 301fdbaa0bba4653570f07789909939f977a7620)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I0d965d5f2a863d798c06de9f21d0467f256b538e
NoC timeout issues are seen with HSP attach over QPS615 switch while
IPA is accessing HSP specific registers.
At the time of issue link state from PARF register dump showed that
link is in L0s.
So, disable the L0s state as a work-around
(vetted by hardware verification team) and this change should have
minimum power impact.
Change-Id: I21ddffdc69d83ece01ac8546c22b50b450cc6ed5
Signed-off-by: Paras Sharma <quic_parass@quicinc.com>
Currently, remote heap maps get added to the global list before the
fastrpc_internal_mmap function completes the mapping. Meanwhile, the
fastrpc_internal_munmap function accesses the map, starts unmapping, and
frees the map before the fastrpc_internal_mmap function completes,
resulting in a use-after-free (UAF) issue. Add the map to the list after
the fastrpc_internal_mmap function completes the mapping.
Change-Id: Ia524f142edba57a1f389dd0e5c83a1967c7f5a59
Acked-by: Abhishek Singh <abhishes@qti.qualcomm.com>
Signed-off-by: Santosh Sakore <quic_ssakore@quicinc.com>
