Commit graph android_kernel_motorola_sm6375/Makefile
Author SHA1 Message Date
Masahiro Yamada
6d288859ed
BACKPORT: kbuild: check CONFIG_AS_IS_LLVM instead of LLVM_IAS
commit 52cc02b910284d6bddba46cce402044ab775f314 upstream.

LLVM_IAS is the user interface to set the -(no-)integrated-as flag,
and it should be used only for that purpose.

LLVM_IAS is checked in some places to determine the assembler type,
but it is not precise.

For example,

 $ make CC=gcc LLVM_IAS=1

... will use the GNU assembler (i.e. binutils) since LLVM_IAS=1 is
effective only when $(CC) is clang.

Of course, 'CC=gcc LLVM_IAS=1' is an odd combination, but the build
system can be more robust against such insane input.

Commit ba64beb17493a ("kbuild: check the minimum assembler version in
Kconfig") introduced CONFIG_AS_IS_GNU/LLVM, which is more precise
because Kconfig checks the version string from the assembler in use.

Change-Id: I190f91350cdb4305a01cabc80d952b0541aef521
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
[nathan: Backport to 5.10]
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-05 20:02:23 +03:00
Michael Bestas
61798133a0
Revert "Makefile: Fix LLVM_IAS condition after IAS default flip"
This reverts commit af20c21925.

Reason for revert: Replaced by upstream commit.

Change-Id: I1482b87ca2fe94a377454728c004f3038df02137
2026-05-05 20:02:23 +03:00
Nathan Chancellor
74212e4117
BACKPORT: kbuild: Switch to 'f' variants of integrated assembler flag
commit 2185a7e4b0ade86c2c57fc63d4a7535c40254bd0 upstream.

It has been brought up a few times in various code reviews that clang
3.5 introduced -f{,no-}integrated-as as the preferred way to enable and
disable the integrated assembler, mentioning that -{no-,}integrated-as
are now considered legacy flags.

Switch the kernel over to using those variants in case there is ever a
time where clang decides to remove the non-'f' variants of the flag.

Also, fix a typo in a comment ("intergrated" -> "integrated").

Link: https://releases.llvm.org/3.5.0/tools/clang/docs/ReleaseNotes.html#new-compiler-flags
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Change-Id: Id848bd57d5e27afb85cf51c26d9312751168407e
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
[nathan: Backport to 5.10]
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-05 20:02:23 +03:00
Masahiro Yamada
9c8324ac4b
BACKPORT: kbuild: check the minimum assembler version in Kconfig
Documentation/process/changes.rst defines the minimum assembler version
(binutils version), but we have never checked it in the build time.

Kbuild never invokes 'as' directly because all assembly files in the
kernel tree are *.S, hence must be preprocessed. I do not expect
raw assembly source files (*.s) would be added to the kernel tree.

Therefore, we always use $(CC) as the assembler driver, and commit
aa824e0c962b ("kbuild: remove AS variable") removed 'AS'. However,
we are still interested in the version of the assembler acting behind.

As usual, the --version option prints the version string.

  $ as --version | head -n 1
  GNU assembler (GNU Binutils for Ubuntu) 2.35.1

But, we do not have $(AS). So, we can add the -Wa prefix so that
$(CC) passes --version down to the backing assembler.

  $ gcc -Wa,--version | head -n 1
  gcc: fatal error: no input files
  compilation terminated.

OK, we need to input something to satisfy gcc.

  $ gcc -Wa,--version -c -x assembler /dev/null -o /dev/null | head -n 1
  GNU assembler (GNU Binutils for Ubuntu) 2.35.1

The combination of Clang and GNU assembler works in the same way:

  $ clang -no-integrated-as -Wa,--version -c -x assembler /dev/null -o /dev/null | head -n 1
  GNU assembler (GNU Binutils for Ubuntu) 2.35.1

Clang with the integrated assembler fails like this:

  $ clang -integrated-as -Wa,--version -c -x assembler /dev/null -o /dev/null | head -n 1
  clang: error: unsupported argument '--version' to option 'Wa,'

For the last case, checking the error message is fragile. If the
proposal for -Wa,--version support [1] is accepted, this may not be
even an error in the future.

One easy way is to check if -integrated-as is present in the passed
arguments. We did not pass -integrated-as to CLANG_FLAGS before, but
we can make it explicit.

Nathan pointed out -integrated-as is the default for all of the
architectures/targets that the kernel cares about, but it goes
along with "explicit is better than implicit" policy. [2]

With all this in my mind, I implemented scripts/as-version.sh to
check the assembler version in Kconfig time.

  $ scripts/as-version.sh gcc
  GNU 23501
  $ scripts/as-version.sh clang -no-integrated-as
  GNU 23501
  $ scripts/as-version.sh clang -integrated-as
  LLVM 0

[1]: https://github.com/ClangBuiltLinux/linux/issues/1320
[2]: https://lore.kernel.org/linux-kbuild/20210307044253.v3h47ucq6ng25iay@archlinux-ax161/

Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
[nd: conflict in arch/Kconfig due to missing dc5723b02e523 ("kbuild: add
  support for Clang LTO") which landed in v5.12-rc1]
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
(cherry picked from commit ba64beb17493a4bfec563100c86a462a15926f24)
Bug: 210043760
Change-Id: I9bcc528adbb86fa902123611ce979af0dd455ad5
2026-05-05 20:02:23 +03:00
angelomds42
af20c21925 Makefile: Fix LLVM_IAS condition after IAS default flip
The commit 01ecebdbac6e ("BACKPORT: scripts/Makefile.clang: default to
LLVM_IAS=1") flipped LLVM_IAS to opt-out but did not update the
ifneq ($(LLVM_IAS),1) condition introduced by 2f5d594440ac ("FROMLIST:
Kbuild: do not emit debug info for assembly with LLVM_IAS=1"), causing
warnings when LLVM_IAS is unset:

warning: DWARF2 only supports one section per compilation unit

Fixes: 01ecebdbac6e ("BACKPORT: scripts/Makefile.clang: default to LLVM_IAS=1")
Change-Id: If373071466d851ee8d814751f9bc4672e68aaf34
2026-04-20 22:49:04 -04:00
Jiri Olsa
7c693559e6
BACKPORT: bpf: Resolve BTF IDs in vmlinux image
Using BTF_ID_LIST macro to define lists for several helpers
using BTF arguments.

And running resolve_btfids on vmlinux elf object during linking,
so the .BTF_ids section gets the IDs resolved.

Change-Id: I7299a611fb88195d58b2899e37d2ef5ded84e158
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Tested-by: Andrii Nakryiko <andriin@fb.com>
Acked-by: Andrii Nakryiko <andriin@fb.com>
Link: https://lore.kernel.org/bpf/20200711215329.41165-5-jolsa@kernel.org
2026-01-14 18:12:02 -08:00
basamaryan
9181ada660
Merge branch 'android11-5.4-lts' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
* 'android11-5.4-lts' of https://android.googlesource.com/kernel/common:
  Linux 5.4.302
  Input: pegasus-notetaker - fix potential out-of-bounds access
  Input: remove third argument of usb_maxpacket()
  usb: deprecate the third argument of usb_maxpacket()
  ata: libata-scsi: Fix system suspend for a security locked drive
  fs/proc: fix uaf in proc_readdir_de()
  pmdomain: imx: Fix reference count leak in imx_gpc_remove
  pmdomain: arm: scmi: Fix genpd leak on provider registration failure
  net: netpoll: fix incorrect refcount handling causing incorrect cleanup
  net: qede: Initialize qede_ll_ops with designated initializer
  uio_hv_generic: Set event for all channels on the device
  net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error
  ALSA: usb-audio: fix uac2 clock source at terminal parser
  mm/page_alloc: fix hash table order logging in alloc_large_system_hash()
  kconfig/nconf: Initialize the default locale at startup
  kconfig/mconf: Initialize the default locale at startup
  vsock: Ignore signal/timeout on connect() if already established
  s390/ctcm: Fix double-kfree
  net: openvswitch: remove never-working support for setting nsh fields
  mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats()
  MIPS: Malta: Fix !EVA SOC-it PCI MMIO
  scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()
  scsi: sg: Do not sleep in atomic context
  Input: cros_ec_keyb - fix an invalid memory access
  be2net: pass wrb_params in case of OS2BMC
  HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155
  isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe()
  EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection
  EDAC/altera: Handle OCRAM ECC enable after warm reset
  spi: Try to get ACPI GPIO IRQ earlier
  ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe
  strparser: Fix signed/unsigned mismatch bug
  gcov: add support for GCC 15
  mm/ksm: fix flag-dropping behavior in ksm_madvise
  ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd
  drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE
  ASoC: cs4271: Fix regulator leak on probe failure
  regulator: fixed: fix GPIO descriptor leak on register failure
  regulator: fixed: use dev_err_probe for register
  Bluetooth: L2CAP: export l2cap_chan_hold for modules
  net_sched: limit try_bulk_dequeue_skb() batches
  net_sched: remove need_resched() from qdisc_run()
  net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps
  net/mlx5e: Fix maxrate wraparound in threshold between units
  net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak
  wifi: mac80211: skip rate verification for not captured PSDUs
  net: mdio: fix resource leak in mdiobus_register_device()
  tipc: Fix use-after-free in tipc_mon_reinit_self().
  tipc: simplify the finalize work queue
  sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto
  sctp: get netns from asoc and ep base
  Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions
  Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion
  Bluetooth: 6lowpan: reset link-local header on ipv6 recv path
  Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF
  net: fec: correct rx_bytes statistic for the case SHIFT16 is set
  ASoC: max98090/91: fixed max98091 ALSA widget powering up/down
  HID: quirks: avoid Cooler Master MM712 dongle wakeup bug
  NFS4: Fix state renewals missing after boot
  compiler_types: Move unused static inline functions warning to W=2
  extcon: adc-jack: Cleanup wakeup source only if it was enabled
  tracing: Fix memory leaks in create_field_var()
  net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup
  sctp: Prevent TOCTOU out-of-bounds write
  sctp: Hold RCU read lock while iterating over address list
  net: dsa: b53: stop reading ARL entries if search is done
  net: dsa: b53: fix enabling ip multicast
  net: dsa: b53: fix resetting speed and pause on forced link
  net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325
  net: dsa/b53: change b53_force_port_config() pause argument
  net: vlan: sync VLAN features with lower device
  ceph: add checking of wait_for_completion_killable() return value
  fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
  ACPI: property: Return present device nodes only on fwnode interface
  9p: sysfs_init: don't hardcode error to ENOMEM
  9p: fix /sys/fs/9p/caches overwriting itself
  fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink
  ACPICA: Update dsmethod.c to get rid of unused variable warning
  orangefs: fix xattr related buffer overflow...
  page_pool: Clamp pool size to max 16K pages
  Bluetooth: bcsp: receive data only if registered
  Bluetooth: SCO: Fix UAF on sco_conn_free
  net: macb: avoid dealing with endianness in macb_set_hwaddr()
  nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing
  NFSv4.1: fix mount hang after CREATE_SESSION failure
  NFSv4: handle ERR_GRACE on delegation recalls
  remoteproc: qcom: q6v5: Avoid handling handover twice
  sparc/module: Add R_SPARC_UA64 relocation handling
  net: intel: fm10k: Fix parameter idx set but not used
  jfs: fix uninitialized waitqueue in transaction manager
  jfs: Verify inode mode when loading from disk
  ipv6: np->rxpmtu race annotation
  usb: xhci: plat: Facilitate using autosuspend for xhci plat devices
  usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs
  allow finish_no_open(file, ERR_PTR(-E...))
  scsi: lpfc: Define size of debugfs entry for xri rebalancing
  scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET
  selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency
  net/cls_cgroup: Fix task_get_classid() during qdisc run
  selftests: Replace sleep with slowwait
  selftests: Disable dad for ipv6 in fcnal-test.sh
  media: redrat3: use int type to store negative error codes
  net: sh_eth: Disable WoL if system can not suspend
  phy: cadence: cdns-dphy: Enable lower resolutions in dphy
  usb: gadget: f_hid: Fix zero length packet transfer
  net: call cond_resched() less often in __release_sock()
  ALSA: usb-audio: apply quirk for MOONDROP Quark2
  net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms
  dmaengine: dw-edma: Set status for callback_result
  dmaengine: mv_xor: match alloc_wc and free_wc
  dmaengine: sh: setup_xref error handling
  scsi: pm8001: Use int instead of u32 to store error codes
  mips: lantiq: xway: sysctrl: rename stp clock
  mips: lantiq: danube: add missing device_type in pci node
  mips: lantiq: danube: add missing properties to cpu node
  media: fix uninitialized symbol warnings
  drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption
  extcon: adc-jack: Fix wakeup source leaks on device unbind
  rds: Fix endianness annotation for RDS_MPATH_HASH
  PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call
  net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV.
  net: When removing nexthops, don't call synchronize_net if it is not necessary
  char: misc: Does not request module for miscdevice with dynamic minor
  usb: gadget: f_ncm: Fix MAC assignment NCM ethernet
  iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register
  media: imon: make send_packet() more robust
  net: ipv6: fix field-spanning memcpy warning in AH output
  bridge: Redirect to backup port when port is administratively down
  powerpc/eeh: Use result of error_detected() in uevent
  x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall
  media: pci: ivtv: Don't create fake v4l2_fh
  drm/amdkfd: return -ENOTTY for unsupported IOCTLs
  selftests/net: Ensure assert() triggers in psock_tpacket.c
  selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8
  PCI: Disable MSI on RDC PCI to PCIe bridges
  drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf()
  mfd: madera: Work around false-positive -Wininitialized warning
  mfd: stmpe-i2c: Add missing MODULE_LICENSE
  mfd: stmpe: Remove IRQ domain upon removal
  tools/power x86_energy_perf_policy: Prefer driver HWP limits
  tools/power x86_energy_perf_policy: Enhance HWP enable
  tools/cpupower: Fix incorrect size in cpuidle_state_disable()
  hwmon: (dell-smm) Add support for Dell OptiPlex 7040
  uprobe: Do not emulate/sstep original instruction when ip is changed
  clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel
  video: backlight: lp855x_bl: Set correct EPROM start for LP8556
  tee: allow a driver to allocate a tee_device without a pool
  ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method()
  mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
  irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
  arc: Fix __fls() const-foldability via __builtin_clzl()
  cpufreq/longhaul: handle NULL policy in longhaul_exit
  selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2
  ACPI: video: force native for Lenovo 82K8
  memstick: Add timeout to prevent indefinite waiting
  mmc: host: renesas_sdhi: Fix the actual clock
  bpf: Don't use %pK through printk
  spi: loopback-test: Don't use %pK through printk
  soc: qcom: smem: Fix endian-unaware access of num_entries
  usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
  serial: 8250_dw: handle reset control deassert error
  serial: 8250_dw: Use devm_add_action_or_reset()
  serial: 8250_dw: Use devm_clk_get_optional() to get the input clock
  can: gs_usb: increase max interface to U8_MAX
  devcoredump: Fix circular locking dependency with devcd->mutex.
  net: ravb: Enforce descriptor type ordering
  x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID
  wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode
  net: phy: dp83867: Disable EEE support as not implemented
  regmap: slimbus: fix bus_context pointer in regmap init calls
  drm/etnaviv: fix flush sequence logic
  usbnet: Prevents free active kevent
  wifi: ath10k: Fix memory leak on unsupported WMI command
  ASoC: qdsp6: q6asm: do not sleep while atomic
  fbdev: valkyriefb: Fix reference count leak in valkyriefb_init
  fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS
  fbdev: bitblit: bound-check glyph index in bit_putcs*
  ACPI: video: Fix use-after-free in acpi_video_switch_brightness()
  fbdev: atyfb: Check if pll_ops->init_pll failed
  net: usb: asix_devices: Check return value of usbnet_get_endpoints
  btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot()
  x86/bugs: Fix reporting of LFENCE retpoline
  net/sched: sch_qfq: Fix null-deref in agg_dequeue

 Conflicts:
	drivers/mmc/host/sdhci-msm.c
	drivers/usb/host/xhci-plat.c

Change-Id: I30739fea8840ace3825ea8955598d9efa687bb27
2025-12-11 01:41:51 -08:00
Michael Bestas
350c4ccfe1
Merge tag 'ASB-2025-12-01_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
https://source.android.com/docs/security/bulletin/2025-12-01
CVE-2025-48623
CVE-2025-48624
CVE-2025-48637
CVE-2025-48638
CVE-2024-35970
CVE-2025-38236
CVE-2025-38349
CVE-2025-48610
CVE-2025-38500

* tag 'ASB-2025-12-01_11-5.4' of https://android.googlesource.com/kernel/common:
  UPSTREAM: crypto: essiv - Check ssize for decryption and in-place encryption
  ANDROID: GKI: fix up build break where timer_delete_sync() was used
  Revert "net: rtnetlink: remove redundant assignment to variable err"
  Revert "net: rtnetlink: add msg kind names"
  Revert "net: rtnetlink: add helper to extract msg type's kind"
  Revert "net: rtnetlink: use BIT for flag values"
  Revert "net: netlink: add NLM_F_BULK delete request modifier"
  Revert "net: rtnetlink: add bulk delete support flag"
  Revert "net: rtnetlink: fix module reference count leak issue in rtnetlink_rcv_msg"
  Revert "net: add ndo_fdb_del_bulk"
  Revert "net: rtnetlink: add NLM_F_BULK support to rtnl_fdb_del"
  Revert "rtnetlink: Allow deleting FDB entries in user namespace"
  Linux 5.4.301
  net: rtnetlink: fix module reference count leak issue in rtnetlink_rcv_msg
  media: s5p-mfc: remove an unused/uninitialized variable
  NFSD: Fix last write offset handling in layoutcommit
  NFSD: Minor cleanup in layoutcommit processing
  padata: Reset next CPU when reorder sequence wraps around
  KEYS: trusted_tpm1: Compare HMAC values in constant time
  NFSD: Define a proc_layoutcommit for the FlexFiles layout type
  vfs: Don't leak disconnected dentries on umount
  jbd2: ensure that all ongoing I/O complete before freeing blocks
  ext4: detect invalid INLINE_DATA + EXTENTS flag combination
  drm/amdgpu: use atomic functions with memory barriers for vm fault info
  ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()
  spi: cadence-quadspi: Flush posted register writes before DAC access
  spi: cadence-quadspi: Flush posted register writes before INDAC access
  memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe
  memory: samsung: exynos-srom: Correct alignment
  arm64: errata: Apply workarounds for Neoverse-V3AE
  arm64: cputype: Add Neoverse-V3AE definitions
  comedi: fix divide-by-zero in comedi_buf_munge()
  binder: remove "invalid inc weak" check
  xhci: dbc: enable back DbC in resume if it was enabled before suspend
  usb/core/quirks: Add Huawei ME906S to wakeup quirk
  USB: serial: option: add Telit FN920C04 ECM compositions
  USB: serial: option: add Quectel RG255C
  USB: serial: option: add UNISOC UIS7720
  net: ravb: Ensure memory write completes before ringing TX doorbell
  net: usb: rtl8150: Fix frame padding
  ocfs2: clear extent cache after moving/defragmenting extents
  MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering
  Revert "cpuidle: menu: Avoid discarding useful information"
  net: bonding: fix possible peer notify event loss or dup issue
  sctp: avoid NULL dereference when chunk data buffer is missing
  arm64, mm: avoid always making PTE dirty in pte_mkwrite()
  net: enetc: correct the value of ENETC_RXB_TRUESIZE
  rtnetlink: Allow deleting FDB entries in user namespace
  net: rtnetlink: add NLM_F_BULK support to rtnl_fdb_del
  net: add ndo_fdb_del_bulk
  net: rtnetlink: add bulk delete support flag
  net: netlink: add NLM_F_BULK delete request modifier
  net: rtnetlink: use BIT for flag values
  net: rtnetlink: add helper to extract msg type's kind
  net: rtnetlink: add msg kind names
  net: rtnetlink: remove redundant assignment to variable err
  m68k: bitops: Fix find_*_bit() signatures
  hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super()
  hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()
  dlm: check for defined force value in dlm_lockspace_release
  hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat()
  hfs: validate record offset in hfsplus_bmap_alloc
  hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent()
  hfs: make proper initalization of struct hfs_find_data
  hfs: clear offset and space out of valid records in b-tree node
  exec: Fix incorrect type for ret
  hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp()
  ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings
  sched/fair: Fix pelt lost idle time detection
  sched/balancing: Rename newidle_balance() => sched_balance_newidle()
  sched/fair: Trivial correction of the newidle_balance() comment
  sched: Make newidle_balance() static again
  tls: don't rely on tx_work during send()
  tls: always set record_type in tls_process_cmsg
  tg3: prevent use of uninitialized remote_adv and local_adv variables
  tcp: fix tcp_tso_should_defer() vs large RTT
  amd-xgbe: Avoid spurious link down messages during interface toggle
  net/ip6_tunnel: Prevent perpetual tunnel growth
  net: dlink: handle dma_map_single() failure properly
  net: dl2k: switch from 'pci_' to 'dma_' API
  media: pci: ivtv: Add missing check after DMA map
  media: pci/ivtv: switch from 'pci_' to 'dma_' API
  xen/events: Update virq_to_irq on migration
  media: lirc: Fix error handling in lirc_register()
  media: rc: Directly use ida_free()
  drm/exynos: exynos7_drm_decon: remove ctx->suspended
  btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
  pwm: berlin: Fix wrong register in suspend/resume
  media: cx18: Add missing check after DMA map
  xen/events: Cleanup find_virq() return codes
  cramfs: Verify inode mode when loading from disk
  fs: Add 'initramfs_options' to set initramfs mount options
  pid: Add a judgment for ns null in pid_nr_ns
  minixfs: Verify inode mode when loading from disk
  tracing: Fix race condition in kprobe initialization causing NULL pointer dereference
  dm: fix NULL pointer dereference in __dm_suspend()
  mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag
  mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type
  mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value
  Squashfs: reject negative file sizes in squashfs_read_inode()
  Squashfs: add additional inode sanity checking
  media: mc: Clear minor number before put device
  mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data()
  fs: udf: fix OOB read in lengthAllocDescs handling
  KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O
  net/9p: fix double req put in p9_fd_cancelled
  ext4: guard against EA inode refcount underflow in xattr update
  ext4: correctly handle queries for metadata mappings
  ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch()
  nfsd: nfserr_jukebox in nlm_fopen should lead to a retry
  x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases)
  x86/umip: Check that the instruction opcode is at least two bytes
  PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit
  PCI/AER: Fix missing uevent on recovery when a reset is requested
  PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV
  rseq/selftests: Use weak symbol reference, not definition, to link with glibc
  rtc: interface: Fix long-standing race when setting alarm
  rtc: interface: Ensure alarm irq is enabled when UIE is enabled
  mmc: core: SPI mode remove cmd7
  mtd: rawnand: fsmc: Default to autodetect buswidth
  sparc: fix error handling in scan_one_device()
  sparc64: fix hugetlb for sun4u
  sctp: Fix MAC comparison to be constant-time
  scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()
  parisc: don't reference obsolete termio struct for TC* constants
  lib/genalloc: fix device leak in of_gen_pool_get()
  iio: frequency: adf4350: Fix prescaler usage.
  iio: dac: ad5421: use int type to store negative error codes
  iio: dac: ad5360: use int type to store negative error codes
  crypto: atmel - Fix dma_unmap_sg() direction
  cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()
  drm/nouveau: fix bad ret code in nouveau_bo_move_prep
  media: i2c: mt9v111: fix incorrect type for ret
  firmware: meson_sm: fix device leak at probe
  xen/manage: Fix suspend error path
  arm64: dts: qcom: msm8916: Add missing MDSS reset
  ACPI: debug: fix signedness issues in read/write helpers
  ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT
  tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
  tpm, tpm_tis: Claim locality before writing interrupt registers
  crypto: essiv - Check ssize for decryption and in-place encryption
  mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes
  mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call
  tools build: Align warning options with perf
  net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe
  tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
  net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
  drm/vmwgfx: Fix Use-after-free in validation
  net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
  scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
  scsi: mvsas: Use sas_task_find_rq() for tagging
  scsi: mvsas: Delete mvs_tag_init()
  scsi: libsas: Add sas_task_find_rq()
  clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver
  clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate()
  perf session: Fix handling when buffer exceeds 2 GiB
  rtc: x1205: Fix Xicor X1205 vendor prefix
  perf util: Fix compression checks returning -1 as bool
  iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
  clocksource/drivers/clps711x: Fix resource leaks in error paths
  pinctrl: check the return value of pinmux_ops::get_function_name()
  Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
  mm: hugetlb: avoid soft lockup when mprotect to large memory area
  uio_hv_generic: Let userspace take care of interrupt mask
  Squashfs: fix uninit-value in squashfs_get_parent
  Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"
  net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable
  nfp: fix RSS hash key size when RSS is not supported
  drivers/base/node: fix double free in register_one_node()
  ocfs2: fix double free in user_cluster_connect()
  net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
  RDMA/siw: Always report immediate post SQ errors
  usb: vhci-hcd: Prevent suspending virtually attached devices
  scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
  ipvs: Defer ip_vs_ftp unregister during netns cleanup
  NFSv4.1: fix backchannel max_resp_sz verification check
  remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
  sparc: fix accurate exception reporting in copy_{from,to}_user for M7
  sparc: fix accurate exception reporting in copy_to_user for Niagara 4
  sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara
  sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III
  sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC
  IB/sa: Fix sa_local_svc_timeout_ms read race
  RDMA/core: Resolve MAC of next-hop device without ARP support
  wifi: mt76: fix potential memory leak in mt76_wmac_probe()
  drivers/base/node: handle error properly in register_one_node()
  watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog
  netfilter: ipset: Remove unused htable_bits in macro ahash_region
  iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
  ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
  ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
  ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
  pps: fix warning in pps_register_cdev when register device fail
  misc: genwqe: Fix incorrect cmd field being reported in error
  usb: gadget: configfs: Correctly set use_os_string at bind
  usb: phy: twl6030: Fix incorrect type for ret
  tcp: fix __tcp_close() to only send RST when required
  PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation
  wifi: mwifiex: send world regulatory domain to driver
  ALSA: lx_core: use int type to store negative error codes
  media: rj54n1cb0c: Fix memleak in rj54n1_probe()
  scsi: myrs: Fix dma_alloc_coherent() error check
  scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
  serial: max310x: Add error checking in probe()
  usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup
  drm/radeon/r600_cs: clean up of dead code in r600_cs
  i2c: designware: Add disabling clocks when probe fails
  i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
  bpf: Explicitly check accesses to bpf_sock_addr
  selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported
  pwm: tiehrpwm: Fix corner case in clock divisor calculation
  block: use int to store blk_stack_limits() return value
  blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx
  pinctrl: meson-gxl: add missing i2c_d pinmux
  soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
  ACPI: processor: idle: Fix memory leak when register cpuidle device failed
  regmap: Remove superfluous check for !config in __regmap_init()
  x86/vdso: Fix output operand size of RDPID
  perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
  driver core/PM: Set power.no_callbacks along with power.no_pm
  staging: axis-fifo: flush RX FIFO on read errors
  staging: axis-fifo: fix maximum TX packet length check
  perf subcmd: avoid crash in exclude_cmds when excludes is empty
  dm-integrity: limit MAX_TAG_SIZE to 255
  wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188
  USB: serial: option: add SIMCom 8230C compositions
  media: rc: fix races with imon_disconnect()
  media: imon: grab lock earlier in imon_ir_change_protocol()
  media: imon: reorganize serialization
  media: rc: Add support for another iMON 0xffdc device
  media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe
  media: tuner: xc5000: Fix use-after-free in xc5000_release
  media: tunner: xc5000: Refactor firmware load
  udp: Fix memory accounting leak.
  media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove
  scsi: target: target_core_configfs: Add length check to avoid buffer overflow

 Conflicts:
	drivers/soc/qcom/rpmh-rsc.c
	kernel/sched/fair.c

Change-Id: I58ab24a3db8be4c698c41fd47daeb1f1fb7884ee
2025-12-04 19:21:35 +02:00
Greg Kroah-Hartman
ca00e0f525 This is the 5.4.302 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmkwI4sACgkQONu9yGCS
 aT46Mg//f9a0IiDkO2ybqt7JAStVCkQ5MM2CgPjlgHGyns6hWyxUES5twrVrTO0v
 mdYmeXLztyFSArUHMnoWcUK1O4IVUVK32SX3eEMFy81ojX+LpYm/m5TZg3tU1rvq
 jaTE0i6ihmwG48ciB63i28TxQfhY8QuVJTEV400Ro+ILY2hs1l6c6DYf9i0S/v4g
 gKDQpzuwR0AnGNFI+D6D6D0D8jbLVcBYnAndyvDrLYTIILczf7nJ66ZePYTBvlg3
 rIiIMjG0BX0V2ctPmez3mz0BDTpnZY4pwIwIG8K/bX4UZrgOKJPSZWh1SzbASaGN
 vTJQwRs9nGHvM/kK9CUUsi1+hhaAl7UmQEiRJ06BkXlR7chFCcL/fI/VEQjf12wL
 dyw6/RR/rXPxLbLxCYk+9C9ANTE/ByirLKSeJkNT/yoeiCSpaFuKxtoYkNslBK/B
 i0/Qweez0IzJuVUtUp/2/PrkNKyCaEbbqhDerbnLhU/0lcnT0fkFlFoLLLNzxNdt
 hj6RRJrcpoQB+Qrkf0+5Sxx6W1feP5clZJ2nRSL+rtUNEzCWk7HVh4GprCyvDn6i
 xjINN9Yh40suJkuKaE0+IrPF1tcL3/128OaT3e0VlL57wK5M4YmJTwrb7g4mlR2/
 31Z4bL1IFYju9WYPW2fWHrdrZUH4h22vLcpW6Q/VFdG0wTC6wVc=
 =Wt2i
 -----END PGP SIGNATURE-----

Merge 5.4.302 into android11-5.4-lts

Changes in 5.4.302
	net/sched: sch_qfq: Fix null-deref in agg_dequeue
	x86/bugs: Fix reporting of LFENCE retpoline
	btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot()
	net: usb: asix_devices: Check return value of usbnet_get_endpoints
	fbdev: atyfb: Check if pll_ops->init_pll failed
	ACPI: video: Fix use-after-free in acpi_video_switch_brightness()
	fbdev: bitblit: bound-check glyph index in bit_putcs*
	fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS
	fbdev: valkyriefb: Fix reference count leak in valkyriefb_init
	ASoC: qdsp6: q6asm: do not sleep while atomic
	wifi: ath10k: Fix memory leak on unsupported WMI command
	usbnet: Prevents free active kevent
	drm/etnaviv: fix flush sequence logic
	regmap: slimbus: fix bus_context pointer in regmap init calls
	net: phy: dp83867: Disable EEE support as not implemented
	wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode
	x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID
	net: ravb: Enforce descriptor type ordering
	devcoredump: Fix circular locking dependency with devcd->mutex.
	can: gs_usb: increase max interface to U8_MAX
	serial: 8250_dw: Use devm_clk_get_optional() to get the input clock
	serial: 8250_dw: Use devm_add_action_or_reset()
	serial: 8250_dw: handle reset control deassert error
	usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
	soc: qcom: smem: Fix endian-unaware access of num_entries
	spi: loopback-test: Don't use %pK through printk
	bpf: Don't use %pK through printk
	mmc: host: renesas_sdhi: Fix the actual clock
	memstick: Add timeout to prevent indefinite waiting
	ACPI: video: force native for Lenovo 82K8
	selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2
	cpufreq/longhaul: handle NULL policy in longhaul_exit
	arc: Fix __fls() const-foldability via __builtin_clzl()
	irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
	mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
	ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method()
	tee: allow a driver to allocate a tee_device without a pool
	video: backlight: lp855x_bl: Set correct EPROM start for LP8556
	clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel
	uprobe: Do not emulate/sstep original instruction when ip is changed
	hwmon: (dell-smm) Add support for Dell OptiPlex 7040
	tools/cpupower: Fix incorrect size in cpuidle_state_disable()
	tools/power x86_energy_perf_policy: Enhance HWP enable
	tools/power x86_energy_perf_policy: Prefer driver HWP limits
	mfd: stmpe: Remove IRQ domain upon removal
	mfd: stmpe-i2c: Add missing MODULE_LICENSE
	mfd: madera: Work around false-positive -Wininitialized warning
	drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf()
	PCI: Disable MSI on RDC PCI to PCIe bridges
	selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8
	selftests/net: Ensure assert() triggers in psock_tpacket.c
	drm/amdkfd: return -ENOTTY for unsupported IOCTLs
	media: pci: ivtv: Don't create fake v4l2_fh
	x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall
	powerpc/eeh: Use result of error_detected() in uevent
	bridge: Redirect to backup port when port is administratively down
	net: ipv6: fix field-spanning memcpy warning in AH output
	media: imon: make send_packet() more robust
	iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register
	usb: gadget: f_ncm: Fix MAC assignment NCM ethernet
	char: misc: Does not request module for miscdevice with dynamic minor
	net: When removing nexthops, don't call synchronize_net if it is not necessary
	net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV.
	PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call
	rds: Fix endianness annotation for RDS_MPATH_HASH
	extcon: adc-jack: Fix wakeup source leaks on device unbind
	drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption
	media: fix uninitialized symbol warnings
	mips: lantiq: danube: add missing properties to cpu node
	mips: lantiq: danube: add missing device_type in pci node
	mips: lantiq: xway: sysctrl: rename stp clock
	scsi: pm8001: Use int instead of u32 to store error codes
	dmaengine: sh: setup_xref error handling
	dmaengine: mv_xor: match alloc_wc and free_wc
	dmaengine: dw-edma: Set status for callback_result
	net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms
	ALSA: usb-audio: apply quirk for MOONDROP Quark2
	net: call cond_resched() less often in __release_sock()
	usb: gadget: f_hid: Fix zero length packet transfer
	phy: cadence: cdns-dphy: Enable lower resolutions in dphy
	net: sh_eth: Disable WoL if system can not suspend
	media: redrat3: use int type to store negative error codes
	selftests: Disable dad for ipv6 in fcnal-test.sh
	selftests: Replace sleep with slowwait
	net/cls_cgroup: Fix task_get_classid() during qdisc run
	selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency
	scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET
	scsi: lpfc: Define size of debugfs entry for xri rebalancing
	allow finish_no_open(file, ERR_PTR(-E...))
	usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs
	usb: xhci: plat: Facilitate using autosuspend for xhci plat devices
	ipv6: np->rxpmtu race annotation
	jfs: Verify inode mode when loading from disk
	jfs: fix uninitialized waitqueue in transaction manager
	net: intel: fm10k: Fix parameter idx set but not used
	sparc/module: Add R_SPARC_UA64 relocation handling
	remoteproc: qcom: q6v5: Avoid handling handover twice
	NFSv4: handle ERR_GRACE on delegation recalls
	NFSv4.1: fix mount hang after CREATE_SESSION failure
	nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing
	net: macb: avoid dealing with endianness in macb_set_hwaddr()
	Bluetooth: SCO: Fix UAF on sco_conn_free
	Bluetooth: bcsp: receive data only if registered
	page_pool: Clamp pool size to max 16K pages
	orangefs: fix xattr related buffer overflow...
	ACPICA: Update dsmethod.c to get rid of unused variable warning
	fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink
	9p: fix /sys/fs/9p/caches overwriting itself
	9p: sysfs_init: don't hardcode error to ENOMEM
	ACPI: property: Return present device nodes only on fwnode interface
	fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
	ceph: add checking of wait_for_completion_killable() return value
	net: vlan: sync VLAN features with lower device
	net: dsa/b53: change b53_force_port_config() pause argument
	net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325
	net: dsa: b53: fix resetting speed and pause on forced link
	net: dsa: b53: fix enabling ip multicast
	net: dsa: b53: stop reading ARL entries if search is done
	sctp: Hold RCU read lock while iterating over address list
	sctp: Prevent TOCTOU out-of-bounds write
	net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup
	tracing: Fix memory leaks in create_field_var()
	extcon: adc-jack: Cleanup wakeup source only if it was enabled
	compiler_types: Move unused static inline functions warning to W=2
	NFS4: Fix state renewals missing after boot
	HID: quirks: avoid Cooler Master MM712 dongle wakeup bug
	ASoC: max98090/91: fixed max98091 ALSA widget powering up/down
	net: fec: correct rx_bytes statistic for the case SHIFT16 is set
	Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF
	Bluetooth: 6lowpan: reset link-local header on ipv6 recv path
	Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion
	Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions
	sctp: get netns from asoc and ep base
	sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto
	tipc: simplify the finalize work queue
	tipc: Fix use-after-free in tipc_mon_reinit_self().
	net: mdio: fix resource leak in mdiobus_register_device()
	wifi: mac80211: skip rate verification for not captured PSDUs
	net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak
	net/mlx5e: Fix maxrate wraparound in threshold between units
	net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps
	net_sched: remove need_resched() from qdisc_run()
	net_sched: limit try_bulk_dequeue_skb() batches
	Bluetooth: L2CAP: export l2cap_chan_hold for modules
	regulator: fixed: use dev_err_probe for register
	regulator: fixed: fix GPIO descriptor leak on register failure
	ASoC: cs4271: Fix regulator leak on probe failure
	drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE
	ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd
	mm/ksm: fix flag-dropping behavior in ksm_madvise
	gcov: add support for GCC 15
	strparser: Fix signed/unsigned mismatch bug
	ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe
	spi: Try to get ACPI GPIO IRQ earlier
	EDAC/altera: Handle OCRAM ECC enable after warm reset
	EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection
	isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe()
	HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155
	be2net: pass wrb_params in case of OS2BMC
	Input: cros_ec_keyb - fix an invalid memory access
	scsi: sg: Do not sleep in atomic context
	scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()
	MIPS: Malta: Fix !EVA SOC-it PCI MMIO
	mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats()
	net: openvswitch: remove never-working support for setting nsh fields
	s390/ctcm: Fix double-kfree
	vsock: Ignore signal/timeout on connect() if already established
	kconfig/mconf: Initialize the default locale at startup
	kconfig/nconf: Initialize the default locale at startup
	mm/page_alloc: fix hash table order logging in alloc_large_system_hash()
	ALSA: usb-audio: fix uac2 clock source at terminal parser
	net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error
	uio_hv_generic: Set event for all channels on the device
	net: qede: Initialize qede_ll_ops with designated initializer
	net: netpoll: fix incorrect refcount handling causing incorrect cleanup
	pmdomain: arm: scmi: Fix genpd leak on provider registration failure
	pmdomain: imx: Fix reference count leak in imx_gpc_remove
	fs/proc: fix uaf in proc_readdir_de()
	ata: libata-scsi: Fix system suspend for a security locked drive
	usb: deprecate the third argument of usb_maxpacket()
	Input: remove third argument of usb_maxpacket()
	Input: pegasus-notetaker - fix potential out-of-bounds access
	Linux 5.4.302

Change-Id: I7291d845c3cfde8a154957356156fadcc4b96b80
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-12-03 14:36:44 +00:00
Greg Kroah-Hartman
9e3157c56e Linux 5.4.302
Last release of the 5.4.y branch.

This branch is now end-of-life, do not use anymore, please move to a
newer kernel release.  As of this point in time, there are over 1500
known unfixed CVEs for this branch, and that number will only increase
over time.

Link: https://lore.kernel.org/r/20251201112241.242614045@linuxfoundation.org
Tested-by: Brett A C Sheffield <bacs@librecast.net>
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
Tested-by: Slade Watkins <sr@sladewatkins.com>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Link: https://lore.kernel.org/r/20251202095448.089783651@linuxfoundation.org
Tested-by: Brett A C Sheffield <bacs@librecast.net>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Alok Tiwari <alok.a.tiwari@oracle.com>
Link: https://lore.kernel.org/r/20251202152903.637577865@linuxfoundation.org
Tested-by: Brett A C Sheffield <bacs@librecast.net>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-12-03 12:45:22 +01:00
Greg Kroah-Hartman
f6520a7c91 This is the 5.4.301 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmkCD9kACgkQONu9yGCS
 aT756BAAwEcL3lKO/0QKjMUrvgv7FRoRm9TH9Usq7Nswmiax6YKI3oPgZKfZZL6u
 yLGSnYqV8f+Jo8kALMJAybu+Oc3Z8WbBZJG/dvlAkvR7iN19ZCuKa2NwWmh8BTGd
 5ZP4/nyXlNlg0/IIZ8xJa3067U895y9IhgMDmSvOZoUFGFecqUmJNBoj8bHgJaPL
 /MENYb7D0CcKWbgCwzsqN0EEm9UKb7xgtaaC52sfZD+GHUPF/RLq9QNyUGtyL0m8
 y20HG6zXmBiVP+zdtYpTaaEP6OSNOCmiOweSZOFafnatd2XO1hRdnAoEk7+t2Lj+
 Xa5GowVUuglmBd8bPbeY8cwVihMxr81DxMns+OpQJTiDD8Q6Whcxbaqwv+tVe7z4
 cVDh1xlKG4U2rsDTeiGhbZVNb6gqqy3LnVFqImQE+dcZqlwC0pbqwO2lLdHMa8NF
 f+l1U3ab0k9qYx8HQegYDTufW5Eb0Rki/3YyHk8o3alOYd2Oc3r16lw9rpSw2Nq3
 Rku+VMSy6z8uvmIP7Ywobla6j73SGFrDc61F0nsU1x+Gd/dMIgkn36dfxciBCgPa
 /AmkK1Psx04s7dIPMowx/nXy5Jk8J4k3JlVMeBnMCuFVUNCNp3qzq5WXdeL1G5f5
 GFPJPblaZrfKQNSSlpUAmstl8v5t8aJcjxobmHn28fVliFAJdDI=
 =XPvH
 -----END PGP SIGNATURE-----

Merge 5.4.301 into android11-5.4-lts

Changes in 5.4.301
	scsi: target: target_core_configfs: Add length check to avoid buffer overflow
	media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove
	udp: Fix memory accounting leak.
	media: tunner: xc5000: Refactor firmware load
	media: tuner: xc5000: Fix use-after-free in xc5000_release
	media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe
	media: rc: Add support for another iMON 0xffdc device
	media: imon: reorganize serialization
	media: imon: grab lock earlier in imon_ir_change_protocol()
	media: rc: fix races with imon_disconnect()
	USB: serial: option: add SIMCom 8230C compositions
	wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188
	dm-integrity: limit MAX_TAG_SIZE to 255
	perf subcmd: avoid crash in exclude_cmds when excludes is empty
	staging: axis-fifo: fix maximum TX packet length check
	staging: axis-fifo: flush RX FIFO on read errors
	driver core/PM: Set power.no_callbacks along with power.no_pm
	perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
	x86/vdso: Fix output operand size of RDPID
	regmap: Remove superfluous check for !config in __regmap_init()
	ACPI: processor: idle: Fix memory leak when register cpuidle device failed
	soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
	pinctrl: meson-gxl: add missing i2c_d pinmux
	blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx
	block: use int to store blk_stack_limits() return value
	pwm: tiehrpwm: Fix corner case in clock divisor calculation
	selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported
	bpf: Explicitly check accesses to bpf_sock_addr
	i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
	i2c: designware: Add disabling clocks when probe fails
	drm/radeon/r600_cs: clean up of dead code in r600_cs
	usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup
	serial: max310x: Add error checking in probe()
	scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
	scsi: myrs: Fix dma_alloc_coherent() error check
	media: rj54n1cb0c: Fix memleak in rj54n1_probe()
	ALSA: lx_core: use int type to store negative error codes
	wifi: mwifiex: send world regulatory domain to driver
	PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation
	tcp: fix __tcp_close() to only send RST when required
	usb: phy: twl6030: Fix incorrect type for ret
	usb: gadget: configfs: Correctly set use_os_string at bind
	misc: genwqe: Fix incorrect cmd field being reported in error
	pps: fix warning in pps_register_cdev when register device fail
	ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
	ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
	ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
	iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
	netfilter: ipset: Remove unused htable_bits in macro ahash_region
	watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog
	drivers/base/node: handle error properly in register_one_node()
	wifi: mt76: fix potential memory leak in mt76_wmac_probe()
	RDMA/core: Resolve MAC of next-hop device without ARP support
	IB/sa: Fix sa_local_svc_timeout_ms read race
	sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC
	sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III
	sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara
	sparc: fix accurate exception reporting in copy_to_user for Niagara 4
	sparc: fix accurate exception reporting in copy_{from,to}_user for M7
	remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
	NFSv4.1: fix backchannel max_resp_sz verification check
	ipvs: Defer ip_vs_ftp unregister during netns cleanup
	scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
	usb: vhci-hcd: Prevent suspending virtually attached devices
	RDMA/siw: Always report immediate post SQ errors
	net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
	ocfs2: fix double free in user_cluster_connect()
	drivers/base/node: fix double free in register_one_node()
	nfp: fix RSS hash key size when RSS is not supported
	net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable
	Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"
	Squashfs: fix uninit-value in squashfs_get_parent
	uio_hv_generic: Let userspace take care of interrupt mask
	mm: hugetlb: avoid soft lockup when mprotect to large memory area
	Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
	pinctrl: check the return value of pinmux_ops::get_function_name()
	clocksource/drivers/clps711x: Fix resource leaks in error paths
	iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
	perf util: Fix compression checks returning -1 as bool
	rtc: x1205: Fix Xicor X1205 vendor prefix
	perf session: Fix handling when buffer exceeds 2 GiB
	clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate()
	clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver
	scsi: libsas: Add sas_task_find_rq()
	scsi: mvsas: Delete mvs_tag_init()
	scsi: mvsas: Use sas_task_find_rq() for tagging
	scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
	net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
	drm/vmwgfx: Fix Use-after-free in validation
	net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
	tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
	net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe
	tools build: Align warning options with perf
	mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call
	mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes
	crypto: essiv - Check ssize for decryption and in-place encryption
	tpm, tpm_tis: Claim locality before writing interrupt registers
	tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
	ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT
	ACPI: debug: fix signedness issues in read/write helpers
	arm64: dts: qcom: msm8916: Add missing MDSS reset
	xen/manage: Fix suspend error path
	firmware: meson_sm: fix device leak at probe
	media: i2c: mt9v111: fix incorrect type for ret
	drm/nouveau: fix bad ret code in nouveau_bo_move_prep
	cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()
	crypto: atmel - Fix dma_unmap_sg() direction
	iio: dac: ad5360: use int type to store negative error codes
	iio: dac: ad5421: use int type to store negative error codes
	iio: frequency: adf4350: Fix prescaler usage.
	lib/genalloc: fix device leak in of_gen_pool_get()
	parisc: don't reference obsolete termio struct for TC* constants
	scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()
	sctp: Fix MAC comparison to be constant-time
	sparc64: fix hugetlb for sun4u
	sparc: fix error handling in scan_one_device()
	mtd: rawnand: fsmc: Default to autodetect buswidth
	mmc: core: SPI mode remove cmd7
	rtc: interface: Ensure alarm irq is enabled when UIE is enabled
	rtc: interface: Fix long-standing race when setting alarm
	rseq/selftests: Use weak symbol reference, not definition, to link with glibc
	PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV
	PCI/AER: Fix missing uevent on recovery when a reset is requested
	PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit
	x86/umip: Check that the instruction opcode is at least two bytes
	x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases)
	nfsd: nfserr_jukebox in nlm_fopen should lead to a retry
	ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch()
	ext4: correctly handle queries for metadata mappings
	ext4: guard against EA inode refcount underflow in xattr update
	net/9p: fix double req put in p9_fd_cancelled
	KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O
	fs: udf: fix OOB read in lengthAllocDescs handling
	mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data()
	media: mc: Clear minor number before put device
	Squashfs: add additional inode sanity checking
	Squashfs: reject negative file sizes in squashfs_read_inode()
	mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value
	mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type
	mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag
	dm: fix NULL pointer dereference in __dm_suspend()
	tracing: Fix race condition in kprobe initialization causing NULL pointer dereference
	minixfs: Verify inode mode when loading from disk
	pid: Add a judgment for ns null in pid_nr_ns
	fs: Add 'initramfs_options' to set initramfs mount options
	cramfs: Verify inode mode when loading from disk
	xen/events: Cleanup find_virq() return codes
	media: cx18: Add missing check after DMA map
	pwm: berlin: Fix wrong register in suspend/resume
	btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
	drm/exynos: exynos7_drm_decon: remove ctx->suspended
	media: rc: Directly use ida_free()
	media: lirc: Fix error handling in lirc_register()
	xen/events: Update virq_to_irq on migration
	media: pci/ivtv: switch from 'pci_' to 'dma_' API
	media: pci: ivtv: Add missing check after DMA map
	net: dl2k: switch from 'pci_' to 'dma_' API
	net: dlink: handle dma_map_single() failure properly
	net/ip6_tunnel: Prevent perpetual tunnel growth
	amd-xgbe: Avoid spurious link down messages during interface toggle
	tcp: fix tcp_tso_should_defer() vs large RTT
	tg3: prevent use of uninitialized remote_adv and local_adv variables
	tls: always set record_type in tls_process_cmsg
	tls: don't rely on tx_work during send()
	sched: Make newidle_balance() static again
	sched/fair: Trivial correction of the newidle_balance() comment
	sched/balancing: Rename newidle_balance() => sched_balance_newidle()
	sched/fair: Fix pelt lost idle time detection
	ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings
	hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp()
	exec: Fix incorrect type for ret
	hfs: clear offset and space out of valid records in b-tree node
	hfs: make proper initalization of struct hfs_find_data
	hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent()
	hfs: validate record offset in hfsplus_bmap_alloc
	hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat()
	dlm: check for defined force value in dlm_lockspace_release
	hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()
	hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super()
	m68k: bitops: Fix find_*_bit() signatures
	net: rtnetlink: remove redundant assignment to variable err
	net: rtnetlink: add msg kind names
	net: rtnetlink: add helper to extract msg type's kind
	net: rtnetlink: use BIT for flag values
	net: netlink: add NLM_F_BULK delete request modifier
	net: rtnetlink: add bulk delete support flag
	net: add ndo_fdb_del_bulk
	net: rtnetlink: add NLM_F_BULK support to rtnl_fdb_del
	rtnetlink: Allow deleting FDB entries in user namespace
	net: enetc: correct the value of ENETC_RXB_TRUESIZE
	arm64, mm: avoid always making PTE dirty in pte_mkwrite()
	sctp: avoid NULL dereference when chunk data buffer is missing
	net: bonding: fix possible peer notify event loss or dup issue
	Revert "cpuidle: menu: Avoid discarding useful information"
	MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering
	ocfs2: clear extent cache after moving/defragmenting extents
	net: usb: rtl8150: Fix frame padding
	net: ravb: Ensure memory write completes before ringing TX doorbell
	USB: serial: option: add UNISOC UIS7720
	USB: serial: option: add Quectel RG255C
	USB: serial: option: add Telit FN920C04 ECM compositions
	usb/core/quirks: Add Huawei ME906S to wakeup quirk
	xhci: dbc: enable back DbC in resume if it was enabled before suspend
	binder: remove "invalid inc weak" check
	comedi: fix divide-by-zero in comedi_buf_munge()
	arm64: cputype: Add Neoverse-V3AE definitions
	arm64: errata: Apply workarounds for Neoverse-V3AE
	memory: samsung: exynos-srom: Correct alignment
	memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe
	spi: cadence-quadspi: Flush posted register writes before INDAC access
	spi: cadence-quadspi: Flush posted register writes before DAC access
	ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()
	drm/amdgpu: use atomic functions with memory barriers for vm fault info
	ext4: detect invalid INLINE_DATA + EXTENTS flag combination
	jbd2: ensure that all ongoing I/O complete before freeing blocks
	vfs: Don't leak disconnected dentries on umount
	NFSD: Define a proc_layoutcommit for the FlexFiles layout type
	KEYS: trusted_tpm1: Compare HMAC values in constant time
	padata: Reset next CPU when reorder sequence wraps around
	NFSD: Minor cleanup in layoutcommit processing
	NFSD: Fix last write offset handling in layoutcommit
	media: s5p-mfc: remove an unused/uninitialized variable
	net: rtnetlink: fix module reference count leak issue in rtnetlink_rcv_msg
	Linux 5.4.301

Change-Id: Ie2685625a0f630cb01ac8d8c9ddcd68c64ea6ed7
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-10-30 07:52:10 +00:00
Greg Kroah-Hartman
2e58fc1413 Linux 5.4.301
Link: https://lore.kernel.org/r/20251027183508.963233542@linuxfoundation.org
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Brett A C Sheffield <bacs@librecast.net>
Tested-by: Alok Tiwari <alok.a.tiwari@oracle.com>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-10-29 14:00:02 +01:00
Michael Bestas
b4aa467048
Merge branch 'android11-5.4-lts' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
* 'android11-5.4-lts' of https://android.googlesource.com/kernel/common:
  Revert "genirq: Provide new interfaces for affinity hints"
  Revert "i40e: Use irq_update_affinity_hint()"
  Revert "i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path"
  Linux 5.4.300
  mm/hugetlb: fix folio is still mapped when deleted
  i40e: add mask to apply valid bits for itr_idx
  i40e: fix validation of VF state in get resources
  i40e: fix idx validation in config queues msg
  i40e: add validation for ring_len param
  i40e: increase max descriptors for XL710
  mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize()
  fbcon: Fix OOB access in font allocation
  fbcon: fix integer overflow in fbcon_do_set_font
  i40e: add max boundary check for VF filters
  i40e: fix input validation logic for action_meta
  i40e: fix idx validation in i40e_validate_queue_map
  drm/gma500: Fix null dereference in hdmi teardown
  can: peak_usb: fix shift-out-of-bounds issue
  can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow
  can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow
  can: hi311x: populate ndo_change_mtu() to prevent buffer overflow
  can: rcar_can: rcar_can_resume(): fix s2ram with PSCI
  IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions
  usb: core: Add 0x prefix to quirks debug output
  ALSA: usb-audio: Fix build with CONFIG_INPUT=n
  ALSA: usb-audio: Convert comma to semicolon
  ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5
  ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks
  ALSA: usb-audio: Simplify NULL comparison in mixer_quirks
  ALSA: usb-audio: Avoid multiple assignments in mixer_quirks
  ALSA: usb-audio: Fix block comments in mixer_quirks
  KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active
  net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer
  net: rfkill: gpio: add DT support
  serial: sc16is7xx: fix bug in flow control levels init
  USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels
  usb: gadget: dummy_hcd: remove usage of list iterator past the loop body
  ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message
  ASoC: wm8974: Correct PLL rate rounding
  ASoC: wm8940: Correct typo in control name
  rds: ib: Increment i_fastreg_wrs before bailing out
  mmc: mvsdio: Fix dma_unmap_sg() nents value
  power: supply: bq27xxx: restrict no-battery detection to bq27000
  power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery
  nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/*
  cnic: Fix use-after-free bugs in cnic_delete_task
  net: liquidio: fix overflow in octeon_init_instr_queue()
  Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set"
  tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().
  i40e: remove redundant memory barrier when cleaning Tx descs
  net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure
  cgroup: split cgroup_destroy_wq into 3 workqueues
  pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch
  wifi: mac80211: fix incorrect type for ret
  ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported
  mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory
  soc: qcom: mdt_loader: Deal with zero e_shentsize
  phy: ti-pipe3: fix device leak at unbind
  dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees
  dmaengine: ti: edma: Fix memory allocation size for queue_priority_map
  can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails
  can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed
  i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path
  i40e: Use irq_update_affinity_hint()
  genirq: Provide new interfaces for affinity hints
  genirq: Export affinity setter for modules
  genirq/affinity: Add irq_update_affinity_desc()
  igb: fix link test skipping when interface is admin down
  net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable()
  USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions
  USB: serial: option: add Telit Cinterion FN990A w/audio compositions
  tty: hvc_console: Call hvc_kick in hvc_write unconditionally
  mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing
  mtd: nand: raw: atmel: Fix comment in timings preparation
  mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer
  mm/khugepaged: fix the address passed to notifier on testing young
  fuse: prevent overflow in copy_file_range return value
  fuse: check if copy_file_range() returns larger than requested size
  mtd: rawnand: stm32_fmc2: fix ECC overwrite
  ocfs2: fix recursive semaphore deadlock in fiemap call
  EDAC/altera: Delete an inappropriate dma_free_coherent() call
  tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork.
  NFSv4: Don't clear capabilities that won't be reset
  net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod.
  usb: hub: Fix flushing of delayed work used for post resume purposes

Change-Id: I9cbae559320c1ca8d46d8443b8ce47f1c9a50f4b
2025-10-08 15:23:13 +03:00
Michael Bestas
b31d93f6d6
Merge tag 'ASB-2025-10-06_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
https://source.android.com/docs/security/bulletin/2025-10-01

* tag 'ASB-2025-10-06_11-5.4' of https://android.googlesource.com/kernel/common:
  UPSTREAM: vsock: Do not allow binding to VMADDR_PORT_ANY
  Linux 5.4.299
  dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status()
  cifs: fix integer overflow in match_server()
  spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort
  spi: spi-fsl-lpspi: Set correct chip-select polarity bit
  spi: spi-fsl-lpspi: Fix transmissions when using CONT
  pcmcia: Add error handling for add_interval() in do_validate_mem()
  ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model
  randstruct: gcc-plugin: Fix attribute addition
  randstruct: gcc-plugin: Remove bogus void member
  vmxnet3: update MTU after device quiesce
  net: dsa: microchip: linearize skb for tail-tagging switches
  net: dsa: microchip: update tag_ksz masks for KSZ9477 family
  dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status()
  ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup
  gpio: pca953x: fix IRQ storm on system wake up
  iio: light: opt3001: fix deadlock due to concurrent flag access
  iio: chemical: pms7003: use aligned_s64 for timestamp
  KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer
  cpufreq/sched: Explicitly synchronize limits_changed flag handling
  mm/slub: avoid accessing metadata when pointer is invalid in object_err()
  scsi: lpfc: Fix buffer free/clear order in deferred receive path
  mm/khugepaged: fix ->anon_vma race
  e1000e: fix heap overflow in e1000_set_eeprom
  batman-adv: fix OOB read/write in network-coding decode
  drm/amdgpu: drop hw access in non-DC audio fini
  wifi: mwifiex: Initialize the chan_stats array to zero
  pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region()
  ALSA: usb-audio: Add mute TLV for playback volumes on some devices
  ppp: fix memory leak in pad_compress_skb
  net: atm: fix memory leak in atm_register_sysfs when device_register fail
  ax25: properly unshare skbs in ax25_kiss_rcv()
  ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init()
  net: thunder_bgx: decrement cleanup index before use
  net: thunder_bgx: add a missing of_node_put
  wifi: libertas: cap SSID len in lbs_associate()
  wifi: cw1200: cap SSID length in cw1200_do_join()
  net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets
  i40e: Fix potential invalid access when MAC list is empty
  icmp: fix icmp_ndo_send address translation for reply direction
  mISDN: Fix memory leak in dsp_hwec_enable()
  xirc2ps_cs: fix register access when enabling FullDuplex
  Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()
  netfilter: conntrack: helper: Replace -EEXIST by -EBUSY
  wifi: cfg80211: fix use-after-free in cmp_bss()
  powerpc: boot: Remove leading zero in label in udelay()
  Linux 5.4.298
  Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS"
  net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions
  Revert "drm/amdgpu: fix incorrect vm flags to map bo"
  HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()
  HID: wacom: Add a new Art Pen 2
  HID: asus: fix UAF via HID_CLAIMED_INPUT validation
  KVM: x86: use array_index_nospec with indices that come from guest
  efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare
  sctp: initialize more fields in sctp_v6_from_sk()
  net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts
  net/mlx5e: Set local Xoff after FW update
  net/mlx5e: Update and set Xon/Xoff upon port speed set
  net/mlx5e: Update and set Xon/Xoff upon MTU set
  net: dlink: fix multicast stats being counted incorrectly
  atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().
  net/atm: remove the atmdev_ops {get, set}sockopt methods
  Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced
  powerpc/kvm: Fix ifdef to remove build warning
  net: ipv4: fix regression in local-broadcast routes
  vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put()
  scsi: core: sysfs: Correct sysfs attributes access rights
  ftrace: Fix potential warning in trace_printk_seq during ftrace_dump
  pinctrl: STMFX: add missing HAS_IOMEM dependency
  Revert "PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports"
  Revert "PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit()"
  Linux 5.4.297
  alloc_fdtable(): change calling conventions.
  s390/hypfs: Enable limited access during lockdown
  s390/hypfs: Avoid unnecessary ioctl registration in debugfs
  ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation
  net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate
  net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit
  ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc
  ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add
  ALSA: usb-audio: Fix size validation in convert_chmap_v3()
  scsi: qla4xxx: Prevent a potential error pointer dereference
  usb: xhci: Fix slot_id resource race conflict
  nfs: fix UAF in direct writes
  NFS: Fix up commit deadlocks
  cifs: Fix UAF in cifs_demultiplex_thread()
  Bluetooth: fix use-after-free in device_for_each_child()
  act_mirred: use the backlog for nested calls to mirred ingress
  net/sched: act_mirred: better wording on protection against excessive stack growth
  net/sched: act_mirred: refactor the handle of xmit
  selftests: forwarding: tc_actions.sh: add matchall mirror test
  net: sched: don't expose action qstats to skb_tc_reinsert()
  net: sched: extract qstats update code into functions
  net: sched: extract bstats update code into function
  net: sched: extract common action counters update code into function
  mm: perform the mapping_map_writable() check after call_mmap()
  mm: update memfd seal write check to include F_SEAL_WRITE
  mm: drop the assumption that VM_SHARED always implies writable
  codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()
  sch_qfq: make qfq_qlen_notify() idempotent
  sch_hfsc: make hfsc_qlen_notify() idempotent
  sch_drr: make drr_qlen_notify() idempotent
  btrfs: populate otime when logging an inode item
  media: venus: hfi: explicitly release IRQ during teardown
  f2fs: fix to avoid out-of-boundary access in dnode page
  media: venus: protect against spurious interrupts during probe
  media: qcom: camss: cleanup media device allocated resource on error path
  media: venus: vdec: Clamp param smaller than 1fps and bigger than 240.
  drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS
  pwm: mediatek: Fix duty and period setting
  pwm: mediatek: Handle hardware enable and clock enable separately
  pwm: mediatek: Implement .apply() callback
  media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()
  media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free()
  media: v4l2-ctrls: always copy the controls on completion
  ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig
  soc: qcom: mdt_loader: Ensure we don't read past the ELF header
  rtc: ds1307: handle oscillator stop flag (OSF) for ds1341
  usb: musb: omap2430: fix device leak at unbind
  NFS: Fix the setting of capabilities when automounting a new filesystem
  NFS: Fix up handling of outstanding layoutcommit in nfs_update_inode()
  NFSv4: Fix nfs4_bitmap_copy_adjust()
  usb: typec: fusb302: cache PD RX state
  cdc-acm: fix race between initial clearing halt and open
  USB: cdc-acm: do not log successful probe on later errors
  mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock
  mm/kmemleak: turn kmemleak_lock and object->lock to raw_spinlock_t
  ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx()
  x86/fpu: Delay instruction pointer fixup until after warning
  mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery
  nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()
  pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov
  tracing: Add down_write(trace_event_sem) when adding trace event
  usb: hub: Don't try to recover devices lost during warm reset.
  usb: hub: avoid warm port reset during USB3 disconnect
  x86/mce/amd: Add default names for MCA banks and blocks
  iio: hid-sensor-prox: Fix incorrect OFFSET calculation
  f2fs: fix to do sanity check on ino and xnid
  mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n
  mm/zsmalloc.c: convert to use kmem_cache_zalloc in cache_alloc_zspage()
  drm/sched: Remove optimization that causes hang when killing dependent jobs
  ice: Fix a null pointer dereference in ice_copy_and_init_pkg()
  net: usbnet: Fix the wrong netif_carrier_on() call
  net: usbnet: Avoid potential RCU stall on LINK_CHANGE event
  PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports
  ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value
  comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large
  comedi: Fix initialization of data for instructions that write to subdevice
  kbuild: Add KBUILD_CPPFLAGS to as-option invocation
  kbuild: add $(CLANG_FLAGS) to KBUILD_CPPFLAGS
  kbuild: Add CLANG_FLAGS to as-instr
  mips: Include KBUILD_CPPFLAGS in CHECKFLAGS invocation
  kbuild: Update assembler calls to use proper flags and language target
  ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS
  usb: dwc3: Ignore late xferNotReady event to prevent halt timeout
  USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles
  usb: storage: realtek_cr: Use correct byte order for bcs->Residue
  USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera
  usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive
  iio: proximity: isl29501: fix buffered read on big-endian systems
  ftrace: Also allocate and copy hash for reading of filter files
  fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable()
  use uniform permission checks for all mount propagation changes
  move_mount: allow to add a mount into an existing group
  fs/buffer: fix use-after-free when call bh_read() helper
  drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs
  drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3
  squashfs: fix memory leak in squashfs_fill_super
  memstick: Fix deadlock by moving removing flag earlier
  media: venus: Add a check for packet size after reading from shared memory
  media: ov2659: Fix memory leaks in ov2659_probe()
  media: usbtv: Lock resolution while streaming
  media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init()
  media: gspca: Add bounds checking to firmware parser
  soc/tegra: pmc: Ensure power-domains are in a known state
  jbd2: prevent softlockup in jbd2_log_do_checkpoint()
  PCI: endpoint: Fix configfs group removal on driver teardown
  PCI: endpoint: Fix configfs group list head handling
  mtd: rawnand: fsmc: Add missing check after DMA map
  pwm: imx-tpm: Reset counter if CMOD is 0
  wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table()
  zynq_fpga: use sgtable-based scatterlist wrappers
  ata: libata-scsi: Fix ata_to_sense_error() status handling
  ext4: fix reserved gdt blocks handling in fsmap
  ext4: fix fsmap end of range reporting with bigalloc
  ext4: check fast symlink for ea_inode correctly
  Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()"
  vt: defkeymap: Map keycodes above 127 to K_HOLE
  vt: keyboard: Don't process Unicode characters in K_OFF mode
  usb: dwc3: meson-g12a: fix device leaks at unbind
  usb: gadget: udc: renesas_usb3: fix device leak at unbind
  usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init()
  m68k: Fix lost column on framebuffer debug console
  cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table()
  serial: 8250: fix panic due to PSLVERR
  media: uvcvideo: Do not mark valid metadata as invalid
  media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()
  mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup()
  parisc: Makefile: fix a typo in palo.conf
  btrfs: fix log tree replay failure due to file with 0 links and extents
  thunderbolt: Fix copy+paste error in match_service_id()
  comedi: fix race between polling and detaching
  misc: rtsx: usb: Ensure mmc child device is active when card is present
  drm/amdgpu: fix incorrect vm flags to map bo
  scsi: lpfc: Remove redundant assignment to avoid memory leak
  rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe
  pNFS: Fix uninited ptr deref in block/scsi layout
  pNFS: Handle RPC size limit for layoutcommits
  pNFS: Fix disk addr range check in block/scsi layout
  pNFS: Fix stripe mapping in block/scsi layout
  net: phy: smsc: add proper reset flags for LAN8710A
  ipmi: Fix strcpy source and destination the same
  kconfig: lxdialog: fix 'space' to (de)select options
  kconfig: gconf: fix potential memory leak in renderer_edited()
  kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed()
  ipmi: Use dev_warn_ratelimited() for incorrect message warnings
  scsi: aacraid: Stop using PCI_IRQ_AFFINITY
  scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans
  kconfig: nconf: Ensure null termination where strncpy is used
  kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c
  i3c: don't fail if GETHDRCAP is unsupported
  PCI: pnv_php: Work around switches with broken presence detection
  i3c: add missing include to internal header
  media: uvcvideo: Fix bandwidth issue for Alcor camera
  media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar
  media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb()
  media: usb: hdpvr: disable zero-length read messages
  media: tc358743: Increase FIFO trigger level to 374
  media: tc358743: Return an appropriate colorspace from tc358743_set_fmt
  media: tc358743: Check I2C succeeded during probe
  pinctrl: stm32: Manage irq affinity settings
  scsi: mpt3sas: Correctly handle ATA device errors
  scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure
  RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask()
  MIPS: Don't crash in stack_top() for tasks without ABI or vDSO
  jfs: upper bound check of tree index in dbAllocAG
  jfs: Regular file corruption check
  jfs: truncate good inode pages when hard link is 0
  scsi: bfa: Double-free fix
  MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free}
  watchdog: dw_wdt: Fix default timeout
  fs/orangefs: use snprintf() instead of sprintf()
  scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated
  ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr
  cifs: Fix calling CIFSFindFirst() for root path without msearch
  vhost: fail early when __vhost_add_used() fails
  net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325
  uapi: in6: restore visibility of most IPv6 socket options
  net: ncsi: Fix buffer overflow in fetching version id
  net: dsa: b53: prevent SWITCH_CTRL access on BCM5325
  net: dsa: b53: fix b53_imp_vlan_setup for BCM5325
  net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs
  wifi: iwlegacy: Check rate_idx range after addition
  netmem: fix skb_frag_address_safe with unreadable skbs
  wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`.
  wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect
  wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd()
  net: fec: allow disable coalescing
  (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer
  s390/stp: Remove udelay from stp_sync_clock()
  wifi: iwlwifi: mvm: fix scan request validation
  net: thunderx: Fix format-truncation warning in bgx_acpi_match_id()
  net: ipv4: fix incorrect MTU in broadcast routes
  wifi: cfg80211: Fix interface type validation
  rcu: Protect ->defer_qs_iw_pending from data race
  net: ag71xx: Add missing check after DMA map
  et131x: Add missing check after DMA map
  be2net: Use correct byte order and format string for TCP seq and ack_seq
  s390/time: Use monotonic clock in get_cycles()
  wifi: cfg80211: reject HTC bit for management frames
  ktest.pl: Prevent recursion of default variable options
  ASoC: codecs: rt5640: Retry DEVICE_ID verification
  ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros
  ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control
  platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches
  pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop()
  usb: core: usb_submit_urb: downgrade type check
  ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4
  ASoC: hdac_hdmi: Rate limit logging on connection and disconnection
  mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode()
  ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path
  ACPI: processor: fix acpi_object initialization
  PM: sleep: console: Fix the black screen issue
  thermal: sysfs: Return ENODATA instead of EAGAIN for reads
  PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit()
  selftests: tracing: Use mutex_unlock for testing glob filter
  ARM: tegra: Use I/O memcpy to write to IRAM
  gpio: tps65912: check the return value of regmap_update_bits()
  ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed
  ARM: rockchip: fix kernel hang during smp initialization
  cpufreq: Exit governor when failed to start old governor
  usb: xhci: Avoid showing errors during surprise removal
  usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command
  usb: xhci: Avoid showing warnings for dying controller
  selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t
  usb: xhci: print xhci->xhc_state when queue_command failed
  securityfs: don't pin dentries twice, once is enough...
  hfs: fix not erasing deleted b-tree node issue
  drbd: add missing kref_get in handle_write_conflicts
  udf: Verify partition map count
  arm64: Handle KCOV __init vs inline mismatches
  hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file()
  hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()
  hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read()
  hfs: fix slab-out-of-bounds in hfs_bnode_read()
  sctp: linearize cloned gso packets in sctp_rcv
  netfilter: ctnetlink: fix refcount leak on table dump
  udp: also consider secpath when evaluating ipsec use for checksumming
  ACPI: processor: perflib: Move problematic pr->performance check
  ACPI: processor: perflib: Fix initial _PPC limit application
  Documentation: ACPI: Fix parent device references
  fs: Prevent file descriptor table allocations exceeding INT_MAX
  sunvdc: Balance device refcount in vdc_port_mpgroup_check
  NFSD: detect mismatch of file handle and delegation stateid in OPEN op
  net: dpaa: fix device leak when querying time stamp info
  net: gianfar: fix device leak when querying time stamp info
  netlink: avoid infinite retry looping in netlink_unicast()
  ALSA: usb-audio: Validate UAC3 cluster segment descriptors
  ALSA: usb-audio: Validate UAC3 power domain descriptors, too
  io_uring: don't use int for ABI
  usb: gadget : fix use-after-free in composite_dev_cleanup()
  MIPS: mm: tlb-r4k: Uniquify TLB entries on init
  USB: serial: option: add Foxconn T99W709
  vsock: Do not allow binding to VMADDR_PORT_ANY
  net/packet: fix a race in packet_set_ring() and packet_notifier()
  perf/core: Prevent VMA split of buffer mappings
  perf/core: Exit early on perf_mmap() fail
  perf/core: Don't leak AUX buffer refcount on allocation failure
  pptp: fix pptp_xmit() error path
  smb: client: let recv_done() cleanup before notifying the callers.
  benet: fix BUG when creating VFs
  net: drop UFO packets in udp_rcv_segment()
  ipv6: reject malicious packets in ipv6_gso_segment()
  pptp: ensure minimal skb length in pptp_xmit()
  netpoll: prevent hanging NAPI when netcons gets enabled
  NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()
  pci/hotplug/pnv-php: Wrap warnings in macro
  pci/hotplug/pnv-php: Improve error msg on power state change failure
  usb: chipidea: udc: fix sleeping function called from invalid context
  f2fs: fix to avoid out-of-boundary access in devs.path
  f2fs: fix to avoid panic in f2fs_evict_inode
  f2fs: fix to avoid UAF in f2fs_sync_inode_meta()
  rtc: pcf8563: fix incorrect maximum clock rate handling
  rtc: hym8563: fix incorrect maximum clock rate handling
  rtc: ds1307: fix incorrect maximum clock rate handling
  module: Restore the moduleparam prefix length check
  bpf: Check flow_dissector ctx accesses are aligned
  mtd: rawnand: atmel: set pmecc data setup time
  mtd: rawnand: atmel: Fix dma_mapping_error() address
  jfs: fix metapage reference count leak in dbAllocCtl
  fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref
  crypto: qat - fix seq_file position update in adf_ring_next()
  dmaengine: nbpfaxi: Add missing check after DMA map
  dmaengine: mv_xor: Fix missing check after DMA map and missing unmap
  fs/orangefs: Allow 2 more characters in do_c_string()
  soundwire: stream: restore params when prepare ports fail
  crypto: img-hash - Fix dma_unmap_sg() nents value
  hwrng: mtk - handle devm_pm_runtime_enable errors
  watchdog: ziirave_wdt: check record length in ziirave_firm_verify()
  scsi: isci: Fix dma_unmap_sg() nents value
  scsi: mvsas: Fix dma_unmap_sg() nents value
  scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value
  clk: sunxi-ng: v3s: Fix de clock definition
  perf tests bp_account: Fix leaked file descriptor
  crypto: ccp - Fix crash when rebind ccp device for ccp.ko
  pinctrl: sunxi: Fix memory leak on krealloc failure
  power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set
  clk: davinci: Add NULL check in davinci_lpsc_clk_register()
  mtd: fix possible integer overflow in erase_xfer()
  crypto: marvell/cesa - Fix engine load inaccuracy
  PCI: rockchip-host: Fix "Unexpected Completion" log message
  vrf: Drop existing dst reference in vrf_ip6_input_dst
  selftests: rtnetlink.sh: remove esp4_offload after test
  netfilter: xt_nfacct: don't assume acct name is null-terminated
  can: kvaser_usb: Assign netdev.dev_port based on device channel index
  can: kvaser_pciefd: Store device channel index
  wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE
  Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()"
  mwl8k: Add missing check after DMA map
  wifi: rtl8xxxu: Fix RX skb size for aggregation disabled
  net/sched: Restrict conditions for adding duplicating netems to qdisc tree
  arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX
  netfilter: nf_tables: adjust lockdep assertions handling
  drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value
  m68k: Don't unregister boot console needlessly
  tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range
  iwlwifi: Add missing check for alloc_ordered_workqueue
  wifi: iwlwifi: Fix memory leak in iwl_mvm_init()
  wifi: rtl818x: Kill URBs before clearing tx status queue
  caif: reduce stack size, again
  bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure
  bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
  staging: nvec: Fix incorrect null termination of battery manufacturer
  samples: mei: Fix building on musl libc
  cpufreq: Init policy->rwsem before it may be possibly used
  ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface
  usb: early: xhci-dbc: Fix early_ioremap leak
  Revert "vmci: Prevent the dispatching of uninitialized payloads"
  pps: fix poll support
  vmci: Prevent the dispatching of uninitialized payloads
  staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc()
  ARM: dts: vfxxx: Correctly use two tuples for timer address
  ASoC: ops: dynamically allocate struct snd_ctl_elem_value
  hfsplus: remove mutex_lock check in hfsplus_free_extents
  ASoC: Intel: fix SND_SOC_SOF dependencies
  ethernet: intel: fix building with large NR_CPUS
  usb: phy: mxs: disconnect line when USB charger is attached
  usb: chipidea: add USB PHY event
  usb: chipidea: introduce CI_HDRC_CONTROLLER_VBUS_EVENT glue layer use
  usb: chipidea: udc: protect usb interrupt enable
  usb: chipidea: udc: add new API ci_hdrc_gadget_connect
  ALSA: hda: Add missing NVIDIA HDA codec IDs
  comedi: comedi_test: Fix possible deletion of uninitialized timers
  nilfs2: reject invalid file types when reading inodes
  i2c: qup: jump out of the loop in case of timeout
  net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class
  net: appletalk: Fix use-after-free in AARP proxy probe
  net: appletalk: fix kerneldoc warnings
  RDMA/core: Rate limit GID cache warning messages
  regulator: core: fix NULL dereference on unbind due to stale coupling data
  usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm
  usb: hub: fix detection of high tier USB3 devices behind suspended hubs
  net_sched: sch_sfq: reject invalid perturb period
  net_sched: sch_sfq: move the limit validation
  net_sched: sch_sfq: use a temporary work area for validating configuration
  net_sched: sch_sfq: don't allow 1 packet limit
  net_sched: sch_sfq: handle bigger packets
  net_sched: sch_sfq: annotate data-races around q->perturb_period
  power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition
  power: supply: bq24190_charger: using pm_runtime_resume_and_get instead of pm_runtime_get_sync
  power: supply: bq24190_charger: Fix runtime PM imbalance on error
  xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS
  virtio-net: ensure the received length does not exceed allocated size
  ASoC: fsl_sai: Force a software reset when starting in consumer mode
  usb: dwc3: qcom: Don't leave BCR asserted
  usb: musb: fix gadget state on disconnect
  net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree
  net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
  Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU
  Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout
  Bluetooth: SMP: If an unallowed command is received consider it a failure
  Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb()
  usb: net: sierra: check for no status endpoint
  net/sched: sch_qfq: Fix race condition on qfq_aggregate
  net: emaclite: Fix missing pointer increment in aligned_read()
  comedi: Fix use of uninitialized data in insn_rw_emulate_bits()
  comedi: Fix some signed shift left operations
  comedi: das6402: Fix bit shift out of bounds
  comedi: das16m1: Fix bit shift out of bounds
  comedi: aio_iiro_16: Fix bit shift out of bounds
  comedi: pcl812: Fix bit shift out of bounds
  iio: adc: stm32-adc: Fix race in installing chained IRQ handler
  iio: adc: max1363: Reorder mode_list[] entries
  iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[]
  soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled
  soc: aspeed: lpc-snoop: Cleanup resources in stack-order
  mmc: sdhci_am654: Workaround for Errata i2312
  mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models
  mmc: bcm2835: Fix dma_unmap_sg() nents value
  memstick: core: Zero initialize id_reg in h_memstick_read_dev_id()
  isofs: Verify inode mode when loading from disk
  dmaengine: nbpfaxi: Fix memory corruption in probe()
  af_packet: fix soft lockup issue caused by tpacket_snd()
  af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd()
  phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept()
  HID: core: do not bypass hid_hw_raw_request
  HID: core: ensure __hid_request reserves the report ID as the first byte
  HID: core: ensure the allocated report buffer can contain the reserved report ID
  pch_uart: Fix dma_sync_sg_for_device() nents value
  Input: xpad - set correct controller type for Acer NGR200
  i2c: stm32: fix the device used for the DMA map
  usb: gadget: configfs: Fix OOB read on empty string write
  USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI
  USB: serial: option: add Foxconn T99W640
  USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition

 Conflicts:
	drivers/soc/qcom/mdt_loader.c
	drivers/usb/dwc3/dwc3-qcom.c
	drivers/usb/host/xhci-plat.c
	mm/slub.c
	mm/zsmalloc.c

Change-Id: I83183b507249a323eba0ecec4c7b4b04d76cc7f6
2025-10-08 15:17:54 +03:00
Greg Kroah-Hartman
901ffda291 This is the 5.4.300 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmjeY04ACgkQONu9yGCS
 aT7jARAAtuC4ENHOhlmT+k8n2jrrNZ5RPHsFipG61AFMkXlTVDxF+ysmlR4Z7i7h
 fcVDqAfLBehA9rBHya/4A1WPsc5plXGLSy8Xl9C7243RnQRITBE6Y36ZB4MT5Lhy
 fWMmcE2X9YratNZ4X6pREueQgmtddNusEwB+ZJeYsa3byeLPB0yx9PhZUiitTpvI
 pLdp6hGtPAAOT8O0wuUhbHZ0khbeCiEmrMXbP44DVjjgAfcdMid+6/x76fgMJZ++
 gT8UkkCN2dqMJnT4LgazVBjrCxfbXrU+YNgTkU1O2k3ZINYdYWXZ1Aw2uRIDYwhE
 NUAbmqZkcafinjhw2/DVp/Rys2zCSsYf9VaZR5BVd+qHNAFnRiw2mOKiynxN/+bT
 pr3gzw6/SD/faYGMtoFmFcv8COZGx9Az9f2LJmfUoi+ieV9sxQ6xW4c0xDW0ZsQD
 wp/PBcvKGy6A9WHqT1oQ1lHUrCUY4kZ3/ymPGy1xuyIoB3ILtXAa19LgFB1wMMo6
 iPLBlXa+7GsluvYTYzFkJ7wA4BKgtvLONJ/ARyhG2jDpxHdMgikgdimiwmjaZyej
 uGoOm7Qmt5FPHt2dMlCj8DG120NuXwCgc4+tA/Y9iBVWrHZZsh0myCiO2TImnKwT
 pHrPWd4Rva8bgZClEFhulreW3evnWrVW3B6a4PJVMRb2csVdCjo=
 =FesN
 -----END PGP SIGNATURE-----

Merge 5.4.300 into android11-5.4-lts

Changes in 5.4.300
	usb: hub: Fix flushing of delayed work used for post resume purposes
	net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod.
	NFSv4: Don't clear capabilities that won't be reset
	tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork.
	EDAC/altera: Delete an inappropriate dma_free_coherent() call
	ocfs2: fix recursive semaphore deadlock in fiemap call
	mtd: rawnand: stm32_fmc2: fix ECC overwrite
	fuse: check if copy_file_range() returns larger than requested size
	fuse: prevent overflow in copy_file_range return value
	mm/khugepaged: fix the address passed to notifier on testing young
	mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer
	mtd: nand: raw: atmel: Fix comment in timings preparation
	mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing
	tty: hvc_console: Call hvc_kick in hvc_write unconditionally
	USB: serial: option: add Telit Cinterion FN990A w/audio compositions
	USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions
	net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable()
	igb: fix link test skipping when interface is admin down
	genirq/affinity: Add irq_update_affinity_desc()
	genirq: Export affinity setter for modules
	genirq: Provide new interfaces for affinity hints
	i40e: Use irq_update_affinity_hint()
	i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path
	can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed
	can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails
	dmaengine: ti: edma: Fix memory allocation size for queue_priority_map
	dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees
	phy: ti-pipe3: fix device leak at unbind
	soc: qcom: mdt_loader: Deal with zero e_shentsize
	mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory
	ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported
	wifi: mac80211: fix incorrect type for ret
	pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch
	cgroup: split cgroup_destroy_wq into 3 workqueues
	net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure
	i40e: remove redundant memory barrier when cleaning Tx descs
	tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().
	Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set"
	net: liquidio: fix overflow in octeon_init_instr_queue()
	cnic: Fix use-after-free bugs in cnic_delete_task
	nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/*
	power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery
	power: supply: bq27xxx: restrict no-battery detection to bq27000
	mmc: mvsdio: Fix dma_unmap_sg() nents value
	rds: ib: Increment i_fastreg_wrs before bailing out
	ASoC: wm8940: Correct typo in control name
	ASoC: wm8974: Correct PLL rate rounding
	ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message
	usb: gadget: dummy_hcd: remove usage of list iterator past the loop body
	USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels
	serial: sc16is7xx: fix bug in flow control levels init
	net: rfkill: gpio: add DT support
	net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer
	KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active
	ALSA: usb-audio: Fix block comments in mixer_quirks
	ALSA: usb-audio: Avoid multiple assignments in mixer_quirks
	ALSA: usb-audio: Simplify NULL comparison in mixer_quirks
	ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks
	ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5
	ALSA: usb-audio: Convert comma to semicolon
	ALSA: usb-audio: Fix build with CONFIG_INPUT=n
	usb: core: Add 0x prefix to quirks debug output
	IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions
	can: rcar_can: rcar_can_resume(): fix s2ram with PSCI
	can: hi311x: populate ndo_change_mtu() to prevent buffer overflow
	can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow
	can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow
	can: peak_usb: fix shift-out-of-bounds issue
	drm/gma500: Fix null dereference in hdmi teardown
	i40e: fix idx validation in i40e_validate_queue_map
	i40e: fix input validation logic for action_meta
	i40e: add max boundary check for VF filters
	fbcon: fix integer overflow in fbcon_do_set_font
	fbcon: Fix OOB access in font allocation
	mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize()
	i40e: increase max descriptors for XL710
	i40e: add validation for ring_len param
	i40e: fix idx validation in config queues msg
	i40e: fix validation of VF state in get resources
	i40e: add mask to apply valid bits for itr_idx
	mm/hugetlb: fix folio is still mapped when deleted
	Linux 5.4.300

Change-Id: I24b202860574c8b633ccc93f52ac4330e4ae51bf
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-10-02 13:53:47 +00:00
Greg Kroah-Hartman
86b57fd7c5 Linux 5.4.300
Link: https://lore.kernel.org/r/20250930143819.654157320@linuxfoundation.org
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
Tested-by: Brett A C Sheffield <bacs@librecast.net>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Alok Tiwari <alok.a.tiwari@oracle.com>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-10-02 13:34:35 +02:00
Elliot Berman
5e9e19c783
FROMLIST: kbuild: Add environment variables for userprogs flags
Allow additional arguments be passed to userprogs compilation.
Reproducible clang builds need to provide a sysroot and gcc path to
ensure the same toolchain is used across hosts. KCFLAGS is not currently
used for any user programs compilation, so add new USERCFLAGS and
USERLDFLAGS which serves similar purpose as HOSTCFLAGS/HOSTLDFLAGS.

Clang 13+ might detect GCC installation on hosts which have it installed
to a default location in /. With addition of these environment
variables, you can specify flags such as:

$ make USERCFLAGS=--sysroot=/path/to/sysroot

This can also be used to specify different sysroots such as musl or
bionic which may be installed on the host in paths that the compiler
may not search by default.

Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Bug: 214127735
Link: https://lore.kernel.org/linux-kbuild/20220201213542.2808035-1-quic_eberman@quicinc.com/
Change-Id: I035309a569130774a1212f294973eee2830a6588
(cherry picked from commit df704104322c6bd1b3d40cb7ad109cba7453f3be)
2025-09-28 10:00:32 +02:00
Masahiro Yamada
aff7958cac
kbuild: add infrastructure to build userspace programs
Kbuild supports the infrastructure to build host programs, but there
was no support to build userspace programs for the target architecture
(i.e. the same architecture as the kernel).

Sam Ravnborg worked on this in 2014 (https://lkml.org/lkml/2014/7/13/154),
but it was not merged. One problem at that time was, there was no good way
to know whether $(CC) can link standalone programs. In fact, pre-built
kernel.org toolchains [1] are often used for building the kernel, but they
do not provide libc.

Now, we can handle this cleanly because the compiler capability is
evaluated at the Kconfig time. If $(CC) cannot link standalone programs,
the relevant options are hidden by 'depends on CC_CAN_LINK'.

The implementation just mimics scripts/Makefile.host

The userspace programs are compiled with the same flags as the host
programs. In addition, it uses -m32 or -m64 if it is found in
$(KBUILD_CFLAGS).

This new syntax has two usecases.

- Sample programs

  Several userspace programs under samples/ include UAPI headers
  installed in usr/include. Most of them were previously built for
  the host architecture just to use the 'hostprogs' syntax.

  However, 'make headers' always works for the target architecture.
  This caused the arch mismatch in cross-compiling. To fix this
  distortion, sample code should be built for the target architecture.

- Bpfilter

  net/bpfilter/Makefile compiles bpfilter_umh as the user mode helper,
  and embeds it into the kernel. Currently, it overrides HOSTCC with
  CC to use the 'hostprogs' syntax. This hack should go away.

[1]: https://mirrors.edge.kernel.org/pub/tools/crosstool/
Change-Id: I2776c85673b212541b359fa1cfa168785018299c
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Acked-by: Sam Ravnborg <sam@ravnborg.org>
2025-09-28 10:00:32 +02:00
Masahiro Yamada
df493f21a7
kbuild: add -Wall to KBUILD_HOSTCXXFLAGS
Add -Wall to catch more warnings for C++ host programs.

When I submitted the previous version, the 0-day bot reported
-Wc++11-compat warnings for old GCC:

  HOSTCXX -fPIC scripts/gcc-plugins/latent_entropy_plugin.o
In file included from /usr/lib/gcc/x86_64-linux-gnu/4.8/plugin/include/tm.h:28:0,
                 from scripts/gcc-plugins/gcc-common.h:15,
                 from scripts/gcc-plugins/latent_entropy_plugin.c:78:
/usr/lib/gcc/x86_64-linux-gnu/4.8/plugin/include/config/elfos.h:102:21: warning: C++11 requires a space between string literal and macro [-Wc++11-compat]
    fprintf ((FILE), "%s"HOST_WIDE_INT_PRINT_UNSIGNED"\n",\
                     ^
/usr/lib/gcc/x86_64-linux-gnu/4.8/plugin/include/config/elfos.h:170:24: warning: C++11 requires a space between string literal and macro [-Wc++11-compat]
       fprintf ((FILE), ","HOST_WIDE_INT_PRINT_UNSIGNED",%u\n",  \
                        ^
In file included from /usr/lib/gcc/x86_64-linux-gnu/4.8/plugin/include/tm.h:42:0,
                 from scripts/gcc-plugins/gcc-common.h:15,
                 from scripts/gcc-plugins/latent_entropy_plugin.c:78:
/usr/lib/gcc/x86_64-linux-gnu/4.8/plugin/include/defaults.h:126:24: warning: C++11 requires a space between string literal and macro [-Wc++11-compat]
       fprintf ((FILE), ","HOST_WIDE_INT_PRINT_UNSIGNED",%u\n",  \
                        ^

The source of the warnings is in the plugin headers, so we have no
control of it. I just suppressed them by adding -Wno-c++11-compat to
scripts/gcc-plugins/Makefile.

Change-Id: I3cb616b5dbb4e6c55a537453807da86f473f73d8
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Acked-by: Kees Cook <keescook@chromium.org>
2025-09-28 10:00:32 +02:00
Michael Bestas
dae3d3ea9f
Merge tag 'ASB-2025-09-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
https://source.android.com/docs/security/bulletin/2025-09-01
CVE-2025-21755
CVE-2025-38352
CVE-2025-021701

* tag 'ASB-2025-09-05_11-5.4' of https://android.googlesource.com/kernel/common:
  UPSTREAM: perf/core: Fix potential NULL deref
  UPSTREAM: net/packet: fix a race in packet_set_ring() and packet_notifier()
  ANDROID: 16K: Allocate pad vma on the stack
  ANDROID: 16K: Don't copy data vma for maps/smaps output
  ANDROID: GKI: update Trimble symbol list
  UPSTREAM: net/sched: Always pass notifications when child class becomes empty
  Revert "drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling"
  Linux 5.4.296
  net: ipv6: Discard next-hop MTU less than minimum link MTU
  x86/mm: Disable hugetlb page table sharing on 32-bit
  Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID
  HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras
  HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY
  vt: add missing notification when switching back to text mode
  net: usb: qmi_wwan: add SIMCom 8230C composition
  atm: idt77252: Add missing `dma_map_error()`
  bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT
  bnxt_en: Fix DCB ETS validation
  can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level
  net: phy: microchip: limit 100M workaround to link-down events on LAN88xx
  net: appletalk: Fix device refcount leak in atrtr_create()
  md/raid1: Fix stack memory use after return in raid1_reshape
  wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev()
  dma-buf: fix timeout handling in dma_resv_wait_timeout v2
  Input: xpad - support Acer NGR 200 Controller
  Input: xpad - add VID for Turtle Beach controllers
  Input: xpad - add support for Amazon Game Controller
  NFSv4/flexfiles: Fix handling of NFS level errors in I/O
  flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes
  RDMA/mlx5: Fix vport loopback for MPV device
  netlink: Fix rmem check in netlink_broadcast_deliver().
  netlink: make sure we allow at least one dump skb
  pwm: mediatek: Ensure to disable clocks in error path
  Revert "ACPI: battery: negate current when discharging"
  usb: gadget: u_serial: Fix race condition in TTY wakeup
  drm/sched: Increment job count before swapping tail spsc queue
  pinctrl: qcom: msm: mark certain pins as invalid for interrupts
  x86/mce: Make sure CMCI banks are cleared during shutdown on Intel
  x86/mce: Don't remove sysfs if thresholding sysfs init fails
  x86/mce/amd: Fix threshold limit reset
  rxrpc: Fix oops due to non-existence of prealloc backlog struct
  net/sched: Abort __tc_modify_qdisc if parent class does not exist
  atm: clip: Fix NULL pointer dereference in vcc_sendmsg()
  atm: clip: Fix infinite recursive call of clip_push().
  atm: clip: Fix memory leak of struct clip_vcc.
  atm: clip: Fix potential null-ptr-deref in to_atmarpd().
  tipc: Fix use-after-free in tipc_conn_close().
  netlink: Fix wraparounds of sk->sk_rmem_alloc.
  fix proc_sys_compare() handling of in-lookup dentries
  proc: Clear the pieces of proc_inode that proc_evict_inode cares about
  drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling
  staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher()
  media: uvcvideo: Rollback non processed entities on error
  media: uvcvideo: Send control events for partial succeeds
  media: uvcvideo: Return the number of processed controls
  ACPI: PAD: fix crash in exit_round_robin()
  usb: typec: displayport: Fix potential deadlock
  Logitech C-270 even more broken
  rose: fix dangling neighbour pointers in rose_rt_device_down()
  net: rose: Fix fall-through warnings for Clang
  drm/i915/gt: Fix timeline left held on VMA alloc error
  drm/i915/selftests: Change mock_request() to return error pointers
  spi: spi-fsl-dspi: Clear completion counter before initiating transfer
  spi: spi-fsl-dspi: Fix interrupt-less DMA mode taking an XSPI code path
  spi: spi-fsl-dspi: Rename fifo_{read,write} and {tx,cmd}_fifo_write
  dpaa2-eth: fix xdp_rxq_info leak
  ethernet: atl1: Add missing DMA mapping error checks and count errors
  btrfs: use btrfs_record_snapshot_destroy() during rmdir
  btrfs: propagate last_unlink_trans earlier when doing a rmdir
  RDMA/mlx5: Fix CC counters query for MPV
  RDMA/core: Create and destroy counters in the ib_core
  scsi: ufs: core: Fix spelling of a sysfs attribute name
  drm/v3d: Disable interrupts before resetting the GPU
  mtk-sd: reset host->mrq on prepare_data() error
  mtk-sd: Prevent memory corruption from DMA map failure
  mmc: mediatek: use data instead of mrq parameter from msdc_{un}prepare_data()
  regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods
  regulator: gpio: Add input_supply support in gpio_regulator_config
  ACPICA: Refuse to evaluate a method if arguments are missing
  wifi: ath6kl: remove WARN on bad firmware input
  wifi: mac80211: drop invalid source address OCB frames
  powerpc: Fix struct termio related ioctl macros
  ata: pata_cs5536: fix build on 32-bit UML
  ALSA: sb: Force to disable DMAs once when DMA mode is changed
  net/sched: Always pass notifications when child class becomes empty
  nui: Fix dma_mapping_error() check
  enic: fix incorrect MTU comparison in enic_change_mtu()
  amd-xgbe: align CL37 AN sequence as per databook
  lib: test_objagg: Set error message in check_expect_hints_stats()
  drm/exynos: fimd: Guard display clock control with runtime PM calls
  btrfs: fix missing error handling when searching for inode refs during log replay
  scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu()
  nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.
  RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert
  platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment
  mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data
  usb: typec: altmodes/displayport: do not index invalid pin_assignments
  Revert "mmc: sdhci: Disable SD card clock before changing parameters"
  mmc: sdhci: Add a helper function for dump register in dynamic debug mode
  vsock/vmci: Clear the vmci transport packet properly when initializing it
  btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
  arm64: Restrict pagetable teardown to avoid false warning
  s390: Add '-std=gnu11' to decompressor and purgatory CFLAGS
  drm/bridge: cdns-dsi: Check return value when getting default PHY config
  drm/bridge: cdns-dsi: Fix connecting to next bridge
  drm/bridge: cdns-dsi: Fix the clock variable for mode_valid()
  drm/tegra: Assign plane type before registration
  HID: wacom: fix kobject reference count leak
  HID: wacom: fix memory leak on sysfs attribute creation failure
  HID: wacom: fix memory leak on kobject creation failure
  dm-raid: fix variable in journal device check
  Bluetooth: L2CAP: Fix L2CAP MTU negotiation
  atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister().
  net: enetc: Correct endianness handling in _enetc_rd_reg64
  um: ubd: Add missing error check in start_io_thread()
  vsock/uapi: fix linux/vm_sockets.h userspace compilation errors
  wifi: mac80211: fix beacon interval calculation overflow
  attach_recursive_mnt(): do not lock the covering tree when sliding something under it
  ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3()
  i2c: robotfuzz-osif: disable zero-length read messages
  i2c: tiny-usb: disable zero-length read messages
  RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction
  RDMA/core: Use refcount_t instead of atomic_t on refcount of iwcm_id_private
  media: vivid: Change the siize of the composing
  media: omap3isp: use sgtable-based scatterlist wrappers
  media: cxusb: no longer judge rbuf when the write fails
  media: cxusb: use dev_dbg() rather than hand-rolled debug
  jfs: validate AG parameters in dbMount() to prevent crashes
  fs/jfs: consolidate sanity checking in dbMount
  ASoC: meson: meson-card-utils: use of_property_present() for DT parsing
  of: Add of_property_present() helper
  of: property: define of_property_read_u{8,16,32,64}_array() unconditionally
  kbuild: hdrcheck: fix cross build with clang
  kbuild: add --target to correctly cross-compile UAPI headers with Clang
  bpfilter: match bit size of bpfilter_umh to that of the kernel
  kbuild: use -MMD instead of -MD to exclude system headers from dependency
  VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify
  VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF
  ovl: Check for NULL d_inode() in ovl_dentry_upper()
  ceph: fix possible integer overflow in ceph_zero_objects()
  ALSA: hda: Ignore unsol events for cards being shut down
  usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode
  usb: cdc-wdm: avoid setting WDM_READ for ZLP-s
  usb: Add checks for snprintf() calls in usb_alloc_dev()
  tty: serial: uartlite: register uart driver in init
  usb: potential integer overflow in usbg_make_tpg()
  iio: pressure: zpa2326: Use aligned_s64 for the timestamp
  md/md-bitmap: fix dm-raid max_write_behind setting
  dmaengine: xilinx_dma: Set dma_device directions
  mfd: max14577: Fix wakeup source leaks on device unbind
  mailbox: Not protect module_put with spin_lock_irqsave
  cifs: Fix cifs_query_path_info() for Windows NT servers

 Conflicts:
	drivers/hid/hid-ids.h
	drivers/pinctrl/qcom/pinctrl-msm.c

Change-Id: Ifd5acd2c013f9985e02b866e3f9383383077e3f0
2025-09-12 18:48:05 +03:00
Greg Kroah-Hartman
8b500987d7 This is the 5.4.299 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmjAWV4ACgkQONu9yGCS
 aT7E+Q//fo2+RnB0lUyOGiXkg1al0NhTy5NpO5REWwz0eAU8LS5PwbgkqpgAHeTl
 oTN/Vc8zXu0SIsEnQQIPq0nr1uTSAj/XiFKAoWq4D3tJUS2pvzTV95TTUXqhNc3H
 rGESzEZNyfHwTBHGT5v+KjD70QiPrIfldgpNqSQVnabqPHl6+NcdjXIQFmUhHWKZ
 fKV9U3g21wA4hDcWeeMf4gpwALu4Try4W7zazkhQ3Ys0OvWghWOMQZBCojzHHkaM
 imTiO7QNM6SfqCUk6YF1Tx3ME1spiD1modjzf2GdeerMx4ViK2zZuVlxObgrRlz8
 YjLNqhW1HLIpMwloWbPglYx8oyDvqXgW0MR7ubb2foCc+nsqNfpilKeRSSEgGIzO
 iV+Rxh+/I/JedThzok++i2o5LIR3gnL3I6nbKxvzgKqeAw21u5RxUOfrlVSUOzdC
 pO9zMtkbJWsiGsJuplKNEP8EHGh2aQbxRmPeKlSgMOVO+Mjj3pnEOqx0nUriIolk
 Om7NkzBnDIv4ck+b+JCtBQaf/X8OFtFYaoW84HpaSauvVchxU072t4RwOaVIfvU5
 6YGlpUcguNxRbTZ6pMDKaKvLdlnzAsPv+1GvNHA5aVN2vuz1GesTHsm0dzRegLyf
 wW7sakrIpKqqJZReBA5LOCrLlUE2518TCf8pZUlvQRn0M4Pmmqg=
 =eFKc
 -----END PGP SIGNATURE-----

Merge 5.4.299 into android11-5.4-lts

Changes in 5.4.299
	powerpc: boot: Remove leading zero in label in udelay()
	wifi: cfg80211: fix use-after-free in cmp_bss()
	netfilter: conntrack: helper: Replace -EEXIST by -EBUSY
	Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()
	xirc2ps_cs: fix register access when enabling FullDuplex
	mISDN: Fix memory leak in dsp_hwec_enable()
	icmp: fix icmp_ndo_send address translation for reply direction
	i40e: Fix potential invalid access when MAC list is empty
	net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets
	wifi: cw1200: cap SSID length in cw1200_do_join()
	wifi: libertas: cap SSID len in lbs_associate()
	net: thunder_bgx: add a missing of_node_put
	net: thunder_bgx: decrement cleanup index before use
	ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init()
	ax25: properly unshare skbs in ax25_kiss_rcv()
	net: atm: fix memory leak in atm_register_sysfs when device_register fail
	ppp: fix memory leak in pad_compress_skb
	ALSA: usb-audio: Add mute TLV for playback volumes on some devices
	pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region()
	wifi: mwifiex: Initialize the chan_stats array to zero
	drm/amdgpu: drop hw access in non-DC audio fini
	batman-adv: fix OOB read/write in network-coding decode
	e1000e: fix heap overflow in e1000_set_eeprom
	mm/khugepaged: fix ->anon_vma race
	scsi: lpfc: Fix buffer free/clear order in deferred receive path
	mm/slub: avoid accessing metadata when pointer is invalid in object_err()
	cpufreq/sched: Explicitly synchronize limits_changed flag handling
	KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer
	iio: chemical: pms7003: use aligned_s64 for timestamp
	iio: light: opt3001: fix deadlock due to concurrent flag access
	gpio: pca953x: fix IRQ storm on system wake up
	ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup
	dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status()
	net: dsa: microchip: update tag_ksz masks for KSZ9477 family
	net: dsa: microchip: linearize skb for tail-tagging switches
	vmxnet3: update MTU after device quiesce
	randstruct: gcc-plugin: Remove bogus void member
	randstruct: gcc-plugin: Fix attribute addition
	ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model
	pcmcia: Add error handling for add_interval() in do_validate_mem()
	spi: spi-fsl-lpspi: Fix transmissions when using CONT
	spi: spi-fsl-lpspi: Set correct chip-select polarity bit
	spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort
	cifs: fix integer overflow in match_server()
	dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status()
	Linux 5.4.299

Change-Id: I3dd8287459f00994b5550e295dc9137e49bf96bb
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-09-10 05:55:28 +00:00
Greg Kroah-Hartman
08c21a7a8d Linux 5.4.299
Link: https://lore.kernel.org/r/20250907195600.953058118@linuxfoundation.org
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
Tested-by: Brett A C Sheffield <bacs@librecast.net>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Alok Tiwari <alok.a.tiwari@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-09 18:44:02 +02:00
Greg Kroah-Hartman
4617bff45c This is the 5.4.298 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmi5gKcACgkQONu9yGCS
 aT4wjQ//WxXf2W2gfXey66soh1ouSRbzDeQMub4Mi4Kq0xJ6kqbRUQ0nrcyHVVQt
 +VBanUqLWQEW955KATt63nMJf3Nmi5H7vFA7RDHy9YkC28ViDeaLmnE+9U+vy790
 pDOs0ixW67x4YSqPSrVktJwfvT7I4uAmOQg9NdRD+jve/lT/jzmjTe1jkRhHX+uv
 p0uPOKYKMYignMjPzzIC2cfLxBlBJYk5og7IBhhDLHXTsPRQuFlKLUn/m3N/C5Cb
 XEae5l3U2OxaF4HZpCDn2x/LbDfiHIIslywt03+iiHEBQuJwA6y3U4nZ/YL7OBUM
 Pnnci7NJFCgPa37ZNAPKt2YKfVnjFHczefLKlGmSL/TZ23suc84ZmGnNs9E0cPEr
 /3S2nPLJKWMvMo68zO1xvI56EKB9GZG3sTJSnzkHXZd41ftAIo9SCl1c2ZDfJ6gu
 UcW9v9YlOCQbN3q/ZGHmkvLYB7s3vQBIXBls3yGeHRdpVpe54h5bB2B38Tf4iMW8
 18GBfCmbwdGqXerIDHqQI/MkczAnTdQ3mOBy9N1cjhSgUimxoiz1nfJ3lmdiHBX7
 /2oWPy94J3uNLqMa1kmvE0m9jgh+p/MCSE7DEZRiAjVPXZAvpar0YovLplmd2Yup
 OAYHwbs9NIhhyq5yyexH9c4s9m9BDNMlwTfNIlnHDjtUVCoTqVI=
 =ilIM
 -----END PGP SIGNATURE-----

Merge 5.4.298 into android11-5.4-lts

Changes in 5.4.298
	pinctrl: STMFX: add missing HAS_IOMEM dependency
	ftrace: Fix potential warning in trace_printk_seq during ftrace_dump
	scsi: core: sysfs: Correct sysfs attributes access rights
	vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put()
	net: ipv4: fix regression in local-broadcast routes
	powerpc/kvm: Fix ifdef to remove build warning
	Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced
	net/atm: remove the atmdev_ops {get, set}sockopt methods
	atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().
	net: dlink: fix multicast stats being counted incorrectly
	net/mlx5e: Update and set Xon/Xoff upon MTU set
	net/mlx5e: Update and set Xon/Xoff upon port speed set
	net/mlx5e: Set local Xoff after FW update
	net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts
	sctp: initialize more fields in sctp_v6_from_sk()
	efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare
	KVM: x86: use array_index_nospec with indices that come from guest
	HID: asus: fix UAF via HID_CLAIMED_INPUT validation
	HID: wacom: Add a new Art Pen 2
	HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()
	Revert "drm/amdgpu: fix incorrect vm flags to map bo"
	net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions
	Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS"
	Linux 5.4.298

Change-Id: Iececcdc155bbac10aa6d8c429cbc4a0b32b7df90
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-09-05 06:54:24 +00:00
Greg Kroah-Hartman
bbe1a55ea8 Linux 5.4.298
Link: https://lore.kernel.org/r/20250902131924.720400762@linuxfoundation.org
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Alok Tiwari <alok.a.tiwari@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-04 14:05:56 +02:00
Greg Kroah-Hartman
0f7dff11a8 This is the 5.4.297 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmiwZfcACgkQONu9yGCS
 aT54xQ/7Bakgl/fkNhIOFy8BZtf4GX4drYUsyMFXzYKhmY+rsB41MuhgXEXnt29s
 JGG9evsj2MzyL5sxR244F3W/zoH+KEELCLvY93/z6Tt++9r9XNVvX8cWsHKIx9iV
 mcVrI0/IvQPnPpgeZoHSwakk86DzyB5Ck6ITCurTndVNx49wcqonqxdxDB79ChjB
 GE3XPrSodkPDQFs3ESYa2STRFmOCxm3YmD06rUfOA8WWxHfCPSB+uNZwBHuD5wla
 jS5Od20zdAvY+sex179zCSknJB4HBq8rKizIkMxeo84tivBodNbIb8Kf2Hy889ii
 5pqIsF0jRmhV/ADO94OfBIcDB5+xoMkCUnqcSH3vsmaenfU7r93Godsl4Shii0z+
 Wiw58LEZ/Ki1ZJEfgTvJw0A5sPF0F+06ySVcocUW1z4E8GuT/RKgjJA0BSu82fto
 5T8GTJ2nrT1eZbAOiau0MU5jK72PPlFk2uEWD/kW6VYfelmfjGF/SYNy/JSGpivh
 dOQkW5V1ZLKyVzVYXyqYFvnZTxDNYCm9qGgYOL6Wkr2Q6XM7QiSKhhGMEBWMpSXP
 0xuhZ332a/xrLXdXRR0s04CWPXe5Nb1R2XvJ7EC3JMx/TQHSWGqrbDD+4LBgZWmQ
 I6uSNV4IGaqQ83xx2ekSxa5HmbAhPhVvtY/0NhQzyKm7pFAY3WU=
 =o4wf
 -----END PGP SIGNATURE-----

Merge 5.4.297 into android11-5.4-lts

Changes in 5.4.297
	USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition
	USB: serial: option: add Foxconn T99W640
	USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI
	usb: gadget: configfs: Fix OOB read on empty string write
	i2c: stm32: fix the device used for the DMA map
	Input: xpad - set correct controller type for Acer NGR200
	pch_uart: Fix dma_sync_sg_for_device() nents value
	HID: core: ensure the allocated report buffer can contain the reserved report ID
	HID: core: ensure __hid_request reserves the report ID as the first byte
	HID: core: do not bypass hid_hw_raw_request
	phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept()
	af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd()
	af_packet: fix soft lockup issue caused by tpacket_snd()
	dmaengine: nbpfaxi: Fix memory corruption in probe()
	isofs: Verify inode mode when loading from disk
	memstick: core: Zero initialize id_reg in h_memstick_read_dev_id()
	mmc: bcm2835: Fix dma_unmap_sg() nents value
	mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models
	mmc: sdhci_am654: Workaround for Errata i2312
	soc: aspeed: lpc-snoop: Cleanup resources in stack-order
	soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled
	iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[]
	iio: adc: max1363: Reorder mode_list[] entries
	iio: adc: stm32-adc: Fix race in installing chained IRQ handler
	comedi: pcl812: Fix bit shift out of bounds
	comedi: aio_iiro_16: Fix bit shift out of bounds
	comedi: das16m1: Fix bit shift out of bounds
	comedi: das6402: Fix bit shift out of bounds
	comedi: Fix some signed shift left operations
	comedi: Fix use of uninitialized data in insn_rw_emulate_bits()
	net: emaclite: Fix missing pointer increment in aligned_read()
	net/sched: sch_qfq: Fix race condition on qfq_aggregate
	usb: net: sierra: check for no status endpoint
	Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb()
	Bluetooth: SMP: If an unallowed command is received consider it a failure
	Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout
	Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU
	net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
	net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree
	usb: musb: fix gadget state on disconnect
	usb: dwc3: qcom: Don't leave BCR asserted
	ASoC: fsl_sai: Force a software reset when starting in consumer mode
	virtio-net: ensure the received length does not exceed allocated size
	xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS
	power: supply: bq24190_charger: Fix runtime PM imbalance on error
	power: supply: bq24190_charger: using pm_runtime_resume_and_get instead of pm_runtime_get_sync
	power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition
	net_sched: sch_sfq: annotate data-races around q->perturb_period
	net_sched: sch_sfq: handle bigger packets
	net_sched: sch_sfq: don't allow 1 packet limit
	net_sched: sch_sfq: use a temporary work area for validating configuration
	net_sched: sch_sfq: move the limit validation
	net_sched: sch_sfq: reject invalid perturb period
	usb: hub: fix detection of high tier USB3 devices behind suspended hubs
	usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm
	regulator: core: fix NULL dereference on unbind due to stale coupling data
	RDMA/core: Rate limit GID cache warning messages
	net: appletalk: fix kerneldoc warnings
	net: appletalk: Fix use-after-free in AARP proxy probe
	net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class
	i2c: qup: jump out of the loop in case of timeout
	nilfs2: reject invalid file types when reading inodes
	comedi: comedi_test: Fix possible deletion of uninitialized timers
	ALSA: hda: Add missing NVIDIA HDA codec IDs
	usb: chipidea: udc: add new API ci_hdrc_gadget_connect
	usb: chipidea: udc: protect usb interrupt enable
	usb: chipidea: introduce CI_HDRC_CONTROLLER_VBUS_EVENT glue layer use
	usb: chipidea: add USB PHY event
	usb: phy: mxs: disconnect line when USB charger is attached
	ethernet: intel: fix building with large NR_CPUS
	ASoC: Intel: fix SND_SOC_SOF dependencies
	hfsplus: remove mutex_lock check in hfsplus_free_extents
	ASoC: ops: dynamically allocate struct snd_ctl_elem_value
	ARM: dts: vfxxx: Correctly use two tuples for timer address
	staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc()
	vmci: Prevent the dispatching of uninitialized payloads
	pps: fix poll support
	Revert "vmci: Prevent the dispatching of uninitialized payloads"
	usb: early: xhci-dbc: Fix early_ioremap leak
	ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface
	cpufreq: Init policy->rwsem before it may be possibly used
	samples: mei: Fix building on musl libc
	staging: nvec: Fix incorrect null termination of battery manufacturer
	bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
	bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure
	caif: reduce stack size, again
	wifi: rtl818x: Kill URBs before clearing tx status queue
	wifi: iwlwifi: Fix memory leak in iwl_mvm_init()
	iwlwifi: Add missing check for alloc_ordered_workqueue
	tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range
	m68k: Don't unregister boot console needlessly
	drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value
	netfilter: nf_tables: adjust lockdep assertions handling
	arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX
	net/sched: Restrict conditions for adding duplicating netems to qdisc tree
	wifi: rtl8xxxu: Fix RX skb size for aggregation disabled
	mwl8k: Add missing check after DMA map
	Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()"
	wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE
	can: kvaser_pciefd: Store device channel index
	can: kvaser_usb: Assign netdev.dev_port based on device channel index
	netfilter: xt_nfacct: don't assume acct name is null-terminated
	selftests: rtnetlink.sh: remove esp4_offload after test
	vrf: Drop existing dst reference in vrf_ip6_input_dst
	PCI: rockchip-host: Fix "Unexpected Completion" log message
	crypto: marvell/cesa - Fix engine load inaccuracy
	mtd: fix possible integer overflow in erase_xfer()
	clk: davinci: Add NULL check in davinci_lpsc_clk_register()
	power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set
	pinctrl: sunxi: Fix memory leak on krealloc failure
	crypto: ccp - Fix crash when rebind ccp device for ccp.ko
	perf tests bp_account: Fix leaked file descriptor
	clk: sunxi-ng: v3s: Fix de clock definition
	scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value
	scsi: mvsas: Fix dma_unmap_sg() nents value
	scsi: isci: Fix dma_unmap_sg() nents value
	watchdog: ziirave_wdt: check record length in ziirave_firm_verify()
	hwrng: mtk - handle devm_pm_runtime_enable errors
	crypto: img-hash - Fix dma_unmap_sg() nents value
	soundwire: stream: restore params when prepare ports fail
	fs/orangefs: Allow 2 more characters in do_c_string()
	dmaengine: mv_xor: Fix missing check after DMA map and missing unmap
	dmaengine: nbpfaxi: Add missing check after DMA map
	crypto: qat - fix seq_file position update in adf_ring_next()
	fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref
	jfs: fix metapage reference count leak in dbAllocCtl
	mtd: rawnand: atmel: Fix dma_mapping_error() address
	mtd: rawnand: atmel: set pmecc data setup time
	bpf: Check flow_dissector ctx accesses are aligned
	module: Restore the moduleparam prefix length check
	rtc: ds1307: fix incorrect maximum clock rate handling
	rtc: hym8563: fix incorrect maximum clock rate handling
	rtc: pcf8563: fix incorrect maximum clock rate handling
	f2fs: fix to avoid UAF in f2fs_sync_inode_meta()
	f2fs: fix to avoid panic in f2fs_evict_inode
	f2fs: fix to avoid out-of-boundary access in devs.path
	usb: chipidea: udc: fix sleeping function called from invalid context
	pci/hotplug/pnv-php: Improve error msg on power state change failure
	pci/hotplug/pnv-php: Wrap warnings in macro
	NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()
	netpoll: prevent hanging NAPI when netcons gets enabled
	pptp: ensure minimal skb length in pptp_xmit()
	ipv6: reject malicious packets in ipv6_gso_segment()
	net: drop UFO packets in udp_rcv_segment()
	benet: fix BUG when creating VFs
	smb: client: let recv_done() cleanup before notifying the callers.
	pptp: fix pptp_xmit() error path
	perf/core: Don't leak AUX buffer refcount on allocation failure
	perf/core: Exit early on perf_mmap() fail
	perf/core: Prevent VMA split of buffer mappings
	net/packet: fix a race in packet_set_ring() and packet_notifier()
	vsock: Do not allow binding to VMADDR_PORT_ANY
	USB: serial: option: add Foxconn T99W709
	MIPS: mm: tlb-r4k: Uniquify TLB entries on init
	usb: gadget : fix use-after-free in composite_dev_cleanup()
	io_uring: don't use int for ABI
	ALSA: usb-audio: Validate UAC3 power domain descriptors, too
	ALSA: usb-audio: Validate UAC3 cluster segment descriptors
	netlink: avoid infinite retry looping in netlink_unicast()
	net: gianfar: fix device leak when querying time stamp info
	net: dpaa: fix device leak when querying time stamp info
	NFSD: detect mismatch of file handle and delegation stateid in OPEN op
	sunvdc: Balance device refcount in vdc_port_mpgroup_check
	fs: Prevent file descriptor table allocations exceeding INT_MAX
	Documentation: ACPI: Fix parent device references
	ACPI: processor: perflib: Fix initial _PPC limit application
	ACPI: processor: perflib: Move problematic pr->performance check
	udp: also consider secpath when evaluating ipsec use for checksumming
	netfilter: ctnetlink: fix refcount leak on table dump
	sctp: linearize cloned gso packets in sctp_rcv
	hfs: fix slab-out-of-bounds in hfs_bnode_read()
	hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read()
	hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()
	hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file()
	arm64: Handle KCOV __init vs inline mismatches
	udf: Verify partition map count
	drbd: add missing kref_get in handle_write_conflicts
	hfs: fix not erasing deleted b-tree node issue
	securityfs: don't pin dentries twice, once is enough...
	usb: xhci: print xhci->xhc_state when queue_command failed
	selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t
	usb: xhci: Avoid showing warnings for dying controller
	usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command
	usb: xhci: Avoid showing errors during surprise removal
	cpufreq: Exit governor when failed to start old governor
	ARM: rockchip: fix kernel hang during smp initialization
	ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed
	gpio: tps65912: check the return value of regmap_update_bits()
	ARM: tegra: Use I/O memcpy to write to IRAM
	selftests: tracing: Use mutex_unlock for testing glob filter
	PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit()
	thermal: sysfs: Return ENODATA instead of EAGAIN for reads
	PM: sleep: console: Fix the black screen issue
	ACPI: processor: fix acpi_object initialization
	ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path
	mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode()
	ASoC: hdac_hdmi: Rate limit logging on connection and disconnection
	ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4
	usb: core: usb_submit_urb: downgrade type check
	pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop()
	platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches
	ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control
	ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros
	ASoC: codecs: rt5640: Retry DEVICE_ID verification
	ktest.pl: Prevent recursion of default variable options
	wifi: cfg80211: reject HTC bit for management frames
	s390/time: Use monotonic clock in get_cycles()
	be2net: Use correct byte order and format string for TCP seq and ack_seq
	et131x: Add missing check after DMA map
	net: ag71xx: Add missing check after DMA map
	rcu: Protect ->defer_qs_iw_pending from data race
	wifi: cfg80211: Fix interface type validation
	net: ipv4: fix incorrect MTU in broadcast routes
	net: thunderx: Fix format-truncation warning in bgx_acpi_match_id()
	wifi: iwlwifi: mvm: fix scan request validation
	s390/stp: Remove udelay from stp_sync_clock()
	(powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer
	net: fec: allow disable coalescing
	wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd()
	wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect
	wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`.
	netmem: fix skb_frag_address_safe with unreadable skbs
	wifi: iwlegacy: Check rate_idx range after addition
	net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs
	net: dsa: b53: fix b53_imp_vlan_setup for BCM5325
	net: dsa: b53: prevent SWITCH_CTRL access on BCM5325
	net: ncsi: Fix buffer overflow in fetching version id
	uapi: in6: restore visibility of most IPv6 socket options
	net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325
	vhost: fail early when __vhost_add_used() fails
	cifs: Fix calling CIFSFindFirst() for root path without msearch
	ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr
	scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated
	fs/orangefs: use snprintf() instead of sprintf()
	watchdog: dw_wdt: Fix default timeout
	MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free}
	scsi: bfa: Double-free fix
	jfs: truncate good inode pages when hard link is 0
	jfs: Regular file corruption check
	jfs: upper bound check of tree index in dbAllocAG
	MIPS: Don't crash in stack_top() for tasks without ABI or vDSO
	RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask()
	scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure
	scsi: mpt3sas: Correctly handle ATA device errors
	pinctrl: stm32: Manage irq affinity settings
	media: tc358743: Check I2C succeeded during probe
	media: tc358743: Return an appropriate colorspace from tc358743_set_fmt
	media: tc358743: Increase FIFO trigger level to 374
	media: usb: hdpvr: disable zero-length read messages
	media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb()
	media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar
	media: uvcvideo: Fix bandwidth issue for Alcor camera
	i3c: add missing include to internal header
	PCI: pnv_php: Work around switches with broken presence detection
	i3c: don't fail if GETHDRCAP is unsupported
	kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c
	kconfig: nconf: Ensure null termination where strncpy is used
	scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans
	scsi: aacraid: Stop using PCI_IRQ_AFFINITY
	ipmi: Use dev_warn_ratelimited() for incorrect message warnings
	kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed()
	kconfig: gconf: fix potential memory leak in renderer_edited()
	kconfig: lxdialog: fix 'space' to (de)select options
	ipmi: Fix strcpy source and destination the same
	net: phy: smsc: add proper reset flags for LAN8710A
	pNFS: Fix stripe mapping in block/scsi layout
	pNFS: Fix disk addr range check in block/scsi layout
	pNFS: Handle RPC size limit for layoutcommits
	pNFS: Fix uninited ptr deref in block/scsi layout
	rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe
	scsi: lpfc: Remove redundant assignment to avoid memory leak
	drm/amdgpu: fix incorrect vm flags to map bo
	misc: rtsx: usb: Ensure mmc child device is active when card is present
	comedi: fix race between polling and detaching
	thunderbolt: Fix copy+paste error in match_service_id()
	btrfs: fix log tree replay failure due to file with 0 links and extents
	parisc: Makefile: fix a typo in palo.conf
	mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup()
	media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()
	media: uvcvideo: Do not mark valid metadata as invalid
	serial: 8250: fix panic due to PSLVERR
	cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table()
	m68k: Fix lost column on framebuffer debug console
	usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init()
	usb: gadget: udc: renesas_usb3: fix device leak at unbind
	usb: dwc3: meson-g12a: fix device leaks at unbind
	vt: keyboard: Don't process Unicode characters in K_OFF mode
	vt: defkeymap: Map keycodes above 127 to K_HOLE
	Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()"
	ext4: check fast symlink for ea_inode correctly
	ext4: fix fsmap end of range reporting with bigalloc
	ext4: fix reserved gdt blocks handling in fsmap
	ata: libata-scsi: Fix ata_to_sense_error() status handling
	zynq_fpga: use sgtable-based scatterlist wrappers
	wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table()
	pwm: imx-tpm: Reset counter if CMOD is 0
	mtd: rawnand: fsmc: Add missing check after DMA map
	PCI: endpoint: Fix configfs group list head handling
	PCI: endpoint: Fix configfs group removal on driver teardown
	jbd2: prevent softlockup in jbd2_log_do_checkpoint()
	soc/tegra: pmc: Ensure power-domains are in a known state
	media: gspca: Add bounds checking to firmware parser
	media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init()
	media: usbtv: Lock resolution while streaming
	media: ov2659: Fix memory leaks in ov2659_probe()
	media: venus: Add a check for packet size after reading from shared memory
	memstick: Fix deadlock by moving removing flag earlier
	squashfs: fix memory leak in squashfs_fill_super
	drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3
	drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs
	fs/buffer: fix use-after-free when call bh_read() helper
	move_mount: allow to add a mount into an existing group
	use uniform permission checks for all mount propagation changes
	fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable()
	ftrace: Also allocate and copy hash for reading of filter files
	iio: proximity: isl29501: fix buffered read on big-endian systems
	usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive
	USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera
	usb: storage: realtek_cr: Use correct byte order for bcs->Residue
	USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles
	usb: dwc3: Ignore late xferNotReady event to prevent halt timeout
	ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS
	kbuild: Update assembler calls to use proper flags and language target
	mips: Include KBUILD_CPPFLAGS in CHECKFLAGS invocation
	kbuild: Add CLANG_FLAGS to as-instr
	kbuild: add $(CLANG_FLAGS) to KBUILD_CPPFLAGS
	kbuild: Add KBUILD_CPPFLAGS to as-option invocation
	comedi: Fix initialization of data for instructions that write to subdevice
	comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large
	ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value
	PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports
	net: usbnet: Avoid potential RCU stall on LINK_CHANGE event
	net: usbnet: Fix the wrong netif_carrier_on() call
	ice: Fix a null pointer dereference in ice_copy_and_init_pkg()
	drm/sched: Remove optimization that causes hang when killing dependent jobs
	mm/zsmalloc.c: convert to use kmem_cache_zalloc in cache_alloc_zspage()
	mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n
	f2fs: fix to do sanity check on ino and xnid
	iio: hid-sensor-prox: Fix incorrect OFFSET calculation
	x86/mce/amd: Add default names for MCA banks and blocks
	usb: hub: avoid warm port reset during USB3 disconnect
	usb: hub: Don't try to recover devices lost during warm reset.
	tracing: Add down_write(trace_event_sem) when adding trace event
	pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov
	nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()
	mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery
	x86/fpu: Delay instruction pointer fixup until after warning
	ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx()
	mm/kmemleak: turn kmemleak_lock and object->lock to raw_spinlock_t
	mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock
	USB: cdc-acm: do not log successful probe on later errors
	cdc-acm: fix race between initial clearing halt and open
	usb: typec: fusb302: cache PD RX state
	NFSv4: Fix nfs4_bitmap_copy_adjust()
	NFS: Fix up handling of outstanding layoutcommit in nfs_update_inode()
	NFS: Fix the setting of capabilities when automounting a new filesystem
	usb: musb: omap2430: fix device leak at unbind
	rtc: ds1307: handle oscillator stop flag (OSF) for ds1341
	soc: qcom: mdt_loader: Ensure we don't read past the ELF header
	ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig
	media: v4l2-ctrls: always copy the controls on completion
	media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free()
	media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()
	pwm: mediatek: Implement .apply() callback
	pwm: mediatek: Handle hardware enable and clock enable separately
	pwm: mediatek: Fix duty and period setting
	drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS
	media: venus: vdec: Clamp param smaller than 1fps and bigger than 240.
	media: qcom: camss: cleanup media device allocated resource on error path
	media: venus: protect against spurious interrupts during probe
	f2fs: fix to avoid out-of-boundary access in dnode page
	media: venus: hfi: explicitly release IRQ during teardown
	btrfs: populate otime when logging an inode item
	sch_drr: make drr_qlen_notify() idempotent
	sch_hfsc: make hfsc_qlen_notify() idempotent
	sch_qfq: make qfq_qlen_notify() idempotent
	codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()
	mm: drop the assumption that VM_SHARED always implies writable
	mm: update memfd seal write check to include F_SEAL_WRITE
	mm: perform the mapping_map_writable() check after call_mmap()
	net: sched: extract common action counters update code into function
	net: sched: extract bstats update code into function
	net: sched: extract qstats update code into functions
	net: sched: don't expose action qstats to skb_tc_reinsert()
	selftests: forwarding: tc_actions.sh: add matchall mirror test
	net/sched: act_mirred: refactor the handle of xmit
	net/sched: act_mirred: better wording on protection against excessive stack growth
	act_mirred: use the backlog for nested calls to mirred ingress
	Bluetooth: fix use-after-free in device_for_each_child()
	cifs: Fix UAF in cifs_demultiplex_thread()
	NFS: Fix up commit deadlocks
	nfs: fix UAF in direct writes
	usb: xhci: Fix slot_id resource race conflict
	scsi: qla4xxx: Prevent a potential error pointer dereference
	ALSA: usb-audio: Fix size validation in convert_chmap_v3()
	ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add
	ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc
	net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit
	net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate
	ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation
	s390/hypfs: Avoid unnecessary ioctl registration in debugfs
	s390/hypfs: Enable limited access during lockdown
	alloc_fdtable(): change calling conventions.
	Linux 5.4.297

Change-Id: I31d1928fd98d4aebd14d5e4753dffcf88dd4c03b
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-09-02 10:52:40 +00:00
Michael Bestas
2b9e22c70c
Merge tag 'ASB-2025-08-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
https://source.android.com/docs/security/bulletin/2025-08-01

* tag 'ASB-2025-08-05_11-5.4' of https://android.googlesource.com/kernel/common:
  ANDROID: bpf: do not fail to load if log is full
  ANDROID: fix kernelci compressed kernel linking
  ANDROID: GKI: Update symbol list for Zebra
  UPSTREAM: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
  Linux 5.4.295
  scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops
  arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()
  perf: Fix sample vs do_exit()
  s390/pci: Fix __pcilg_mio_inuser() inline assembly
  rtc: test: Fix invalid format specifier.
  jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()
  mm/huge_memory: fix dereferencing invalid pmd migration entry
  rtc: Make rtc_time64_to_tm() support dates before 1970
  rtc: Improve performance of rtc_time64_to_tm(). Add tests.
  xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create
  posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
  ARM: dts: am335x-bone-common: Increase MDIO reset deassert delay to 50ms
  ARM: dts: am335x-bone-common: Increase MDIO reset deassert time
  ARM: dts: am335x-bone-common: Add GPIO PHY reset on revision C3 board
  net: atm: fix /proc/net/atm/lec handling
  net: atm: add lec_mutex
  calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().
  tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
  tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior
  atm: atmtcp: Free invalid length skb in atmtcp_c_send().
  mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
  wifi: carl9170: do not ping device which has failed to load firmware
  aoe: clean device rq_list in aoedev_downdev()
  hwmon: (occ) fix unaligned accesses
  drm/nouveau/bl: increase buffer size to avoid truncate warning
  erofs: remove unused trace event erofs_destroy_inode
  ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged
  ALSA: hda/intel: Add Thinkpad E15 to PM deny list
  Input: sparcspkr - avoid unannotated fall-through
  HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()
  atm: Revert atm_account_tx() if copy_from_iter_full() fails.
  selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len
  scsi: s390: zfcp: Ensure synchronous unit_add
  scsi: storvsc: Increase the timeouts to storvsc_timeout
  jffs2: check jffs2_prealloc_raw_node_refs() result in few other places
  jffs2: check that raw node were preallocated before writing summary
  drivers/rapidio/rio_cm.c: prevent possible heap overwrite
  Revert "x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2" on v6.6 and older
  powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery
  platform/x86: dell_rbu: Stop overwriting data buffer
  platform: Add Surface platform directory
  Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first"
  tee: Prevent size calculation wraparound on 32-bit kernels
  ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY
  bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value
  watchdog: da9052_wdt: respect TWDMIN
  i40e: fix MMIO write access to an invalid page in i40e_clear_hw
  sock: Correct error checking condition for (assign|release)_proto_idx()
  scsi: lpfc: Use memcpy() for BIOS version
  vxlan: Do not treat dst cache initialization errors as fatal
  clk: rockchip: rk3036: mark ddrphy as critical
  wifi: mac80211: do not offer a mesh path if forwarding is disabled
  net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info
  pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get()
  pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction()
  pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction()
  pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name()
  ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT
  tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows
  tcp: always seek for minimal rtt in tcp_rcv_rtt_update()
  net: dlink: add synchronization for stats update
  sctp: Do not wake readers in __sctp_write_space()
  emulex/benet: correct command version selection in be_cmd_get_stats()
  i2c: designware: Invoke runtime suspend on quick slave re-registration
  net: macb: Check return value of dma_set_mask_and_coherent()
  cpufreq: Force sync policy boost with global boost on sysfs update
  nios2: force update_mmu_cache on spurious tlb-permission--related pagefaults
  media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode()
  media: tc358743: ignore video while HPD is low
  drm/amdkfd: Set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB
  jfs: Fix null-ptr-deref in jfs_ioc_trim
  drm/amdgpu/gfx9: fix CSIB handling
  drm/amdgpu/gfx8: fix CSIB handling
  jfs: fix array-index-out-of-bounds read in add_missing_indices
  drm/amdgpu/gfx7: fix CSIB handling
  drm/amdgpu/gfx10: fix CSIB handling
  drm/msm/a6xx: Increase HFI response timeout
  drm/amd/display: Add NULL pointer checks in dm_force_atomic_commit()
  media: uapi: v4l: Fix V4L2_TYPE_IS_OUTPUT condition
  drm/msm/hdmi: add runtime PM calls to DDC transfer function
  drm/bridge: analogix_dp: Add irq flag IRQF_NO_AUTOEN instead of calling disable_irq()
  sunrpc: update nextcheck time when adding new cache entries
  drm/amdgpu/gfx6: fix CSIB handling
  ACPI: battery: negate current when discharging
  PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn()
  power: supply: bq27xxx: Retrieve again when busy
  ACPICA: fix acpi parse and parseext cache leaks
  ACPICA: Avoid sequence overread in call to strncmp()
  ACPICA: fix acpi operand cache leak in dswstate.c
  iio: adc: ad7606_spi: fix reg write value mask
  PCI: Fix lock symmetry in pci_slot_unlock()
  PCI: Add ACS quirk for Loongson PCIe
  uio_hv_generic: Use correct size for interrupt and monitor pages
  regulator: max14577: Add error check for max14577_read_reg()
  mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS
  staging: iio: ad5933: Correct settling cycles encoding per datasheet
  net: ch9200: fix uninitialised access during mii_nway_restart
  ftrace: Fix UAF when lookup kallsym after ftrace disabled
  dm-mirror: fix a tiny race condition
  mtd: nand: sunxi: Add randomizer configuration before randomizer enable
  mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk
  mm: fix ratelimit_pages update error in dirty_ratio_handler()
  ipc: fix to protect IPCS lookups using RCU
  parisc: fix building with gcc-15
  vgacon: Add check for vc_origin address range in vgacon_scroll()
  fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var
  EDAC/altera: Use correct write width with the INTTEST register
  NFC: nci: uart: Set tty->disc_data only in success path
  f2fs: prevent kernel warning due to negative i_nlink from corrupted image
  Input: ims-pcu - check record size in ims_pcu_flash_firmware()
  ext4: fix calculation of credits for extent tree modification
  ext4: inline: fix len overflow in ext4_prepare_inline_data
  bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device
  ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330
  ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap()
  media: v4l2-dev: fix error handling in __video_register_device()
  media: gspca: Add error handling for stv06xx_read_sensor()
  wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723
  nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request
  wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()
  gfs2: move msleep to sleepable context
  configfs: Do not override creating attribute file failure in populate_attrs()
  net: usb: aqc111: debug info before sanitation
  calipso: unlock rcu before returning -EAFNOSUPPORT
  xen/arm: call uaccess_ttbr0_enable for dm_op hypercall
  usb: Flush altsetting 0 endpoints before reinitializating them after reset.
  fs/filesystems: Fix potential unsigned integer underflow in fs_name()
  net/mdiobus: Fix potential out-of-bounds read/write access
  drm/amd/display: Do not add '-mhard-float' to dcn2{1,0}_resource.o for clang
  drm/amd/display: Do not add '-mhard-float' to dml_ccflags for clang
  MIPS: Move '-Wa,-msoft-float' check from as-option to cc-option
  x86/boot/compressed: prefer cc-option for CFLAGS additions
  net: mdio: C22 is now optional, EOPNOTSUPP if not provided
  net_sched: tbf: fix a race in tbf_change()
  net_sched: red: fix a race in __red_change()
  net_sched: prio: fix a race in prio_tune()
  net/mlx5: Fix return value when searching for existing flow group
  net/mlx5: Wait for inactive autogroups
  i40e: retry VFLR handling if there is ongoing VF reset
  i40e: return false from i40e_reset_vf if reset is in progress
  net_sched: sch_sfq: fix a potential crash on gso_skb handling
  scsi: iscsi: Fix incorrect error path labels for flashnode operations
  NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes
  NFSD: Fix ia_size underflow
  Input: synaptics-rmi - fix crash with unsupported versions of F34
  Input: synaptics-rmi4 - convert to use sysfs_emit() APIs
  pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id()
  do_change_type(): refuse to operate on unmounted/not ours mounts
  PM: sleep: Fix power.is_suspended cleanup for direct-complete devices
  ice: create new Tx scheduler nodes for new queues only
  Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION
  net/mlx4_en: Prevent potential integer overflow calculating Hz
  vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl()
  serial: Fix potential null-ptr-deref in mlb_usio_probe()
  usb: renesas_usbhs: Reorder clock handling and power management in probe
  rtc: Fix offset calculation for .start_secs < 0
  rtc: sh: assign correct interrupts with DT
  perf record: Fix incorrect --user-regs comments
  perf tests switch-tracking: Fix timestamp comparison
  mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE
  mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove()
  rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send()
  perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3
  perf ui browser hists: Set actions->thread before calling do_zoom_thread()
  fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()
  soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop()
  soc: aspeed: lpc: Fix impossible judgment condition
  arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou
  ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device
  bus: fsl-mc: fix double-free on mc_dev
  nilfs2: do not propagate ENOENT error from nilfs_btree_propagate()
  nilfs2: add pointer check for nilfs_direct_propagate()
  Squashfs: check return result of sb_min_blocksize
  ARM: dts: at91: at91sam9263: fix NAND chip selects
  ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select
  f2fs: fix to correct check conditions in f2fs_cross_rename
  f2fs: use d_inode(dentry) cleanup dentry->d_inode
  calipso: Don't call calipso functions for AF_INET sk.
  net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy
  net: usb: aqc111: fix error handling of usbnet read calls
  netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy
  wifi: ath9k_htc: Abort software beacon handling if disabled
  bpf: Fix WARN() in get_bpf_raw_tp_regs
  pinctrl: at91: Fix possible out-of-boundary access
  ktls, sockmap: Fix missing uncharge operation
  netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it
  f2fs: clean up w/ fscrypt_is_bounce_page()
  RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h
  wifi: rtw88: do not ignore hardware read error during DPK
  net: ncsi: Fix GCPS 64-bit member variables
  f2fs: fix to do sanity check on sbi->total_valid_block_count
  drm/tegra: rgb: Fix the unbound reference count
  drm/vkms: Adjust vkms_state->active_planes allocation type
  drm: rcar-du: Fix memory leak in rcar_du_vsps_init()
  selftests/seccomp: fix syscall_restart test for arm compat
  firmware: psci: Fix refcount leak in psci_dt_init
  m68k: mac: Fix macintosh_config for Mac II
  drm/vmwgfx: Add seqno waiter for sync_files
  spi: sh-msiof: Fix maximum DMA transfer size
  ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions"
  x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges()
  PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks()
  EDAC/skx_common: Fix general protection fault
  crypto: marvell/cesa - Avoid empty transfer descriptor
  crypto: marvell/cesa - Handle zero-length skcipher requests
  x86/cpu: Sanitize CPUID(0x80000000) output
  perf/core: Fix broken throttling when max_samples_per_tick=1
  gfs2: gfs2_create_inode error handling fix
  netfilter: nft_socket: fix sk refcount leaks
  thunderbolt: Do not double dequeue a configuration request
  usb: usbtmc: Fix timeout value in get_stb
  usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device
  usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE
  pinctrl: armada-37xx: set GPIO output value before setting direction
  pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs > 31
  tracing: Fix compilation warning on arm32
  BACKPORT: binder: Create safe versions of binder log files
  UPSTREAM: binder: Refactor binder_node print synchronization
  Revert "coredump: hand a pidfd to the usermode coredump helper"
  Linux 5.4.294
  xen/swiotlb: relax alignment requirements
  platform/x86: thinkpad_acpi: Ignore battery threshold change event notification
  platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys
  spi: spi-sun4i: fix early activation
  um: let 'make clean' properly clean underlying SUBARCH as well
  platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS
  nfs: don't share pNFS DS connections between net namespaces
  HID: quirks: Add ADATA XPG alpha wireless mouse support
  coredump: hand a pidfd to the usermode coredump helper
  fork: use pidfd_prepare()
  pid: add pidfd_prepare()
  pidfd: check pid has attached task in fdinfo
  coredump: fix error handling for replace_fd()
  net_sched: hfsc: Address reentrant enqueue adding class to eltree twice
  smb: client: Reset all search buffer pointers when releasing buffer
  smb: client: Fix use-after-free in cifs_fill_dirent
  drm/i915/gvt: fix unterminated-string-initialization warning
  netfilter: nf_tables: do not defer rule destruction via call_rcu
  netfilter: nf_tables: wait for rcu grace period on net_device removal
  netfilter: nf_tables: pass nft_chain to destroy function, not nft_ctx
  kbuild: Disable -Wdefault-const-init-unsafe
  spi: spi-fsl-dspi: restrict register range for regmap access
  mm/page_alloc.c: avoid infinite retries caused by cpuset race
  memcg: always call cond_resched() after fn()
  drm/edid: fixed the bug that hdr metadata was not reset
  llc: fix data loss when reading from a socket in llc_ui_recvmsg()
  ALSA: pcm: Fix race of buffer access at PCM OSS layer
  can: bcm: add missing rcu read protection for procfs content
  can: bcm: add locking for bcm_op runtime updates
  crypto: algif_hash - fix double free in hash_accept
  sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()
  net: dwmac-sun8i: Use parsed internal PHY address instead of 1
  bridge: netfilter: Fix forwarding of fragmented packets
  xfrm: Sanitize marks before insert
  __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock
  xenbus: Allow PVH dom0 a non-local xenstore
  btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref
  nvmet-tcp: don't restore null sk_state_change
  ASoC: Intel: bytcr_rt5640: Add DMI quirk for Acer Aspire SW3-013
  pinctrl: meson: define the pull up/down resistor value as 60 kOhm
  drm: Add valid clones check
  drm/atomic: clarify the rules around drm_atomic_state->allow_modeset
  regulator: ad5398: Add device tree support
  wifi: rtw88: Don't use static local variable in rtw8822b_set_tx_power_index_by_rate
  bpftool: Fix readlink usage in get_fd_type
  HID: usbkbd: Fix the bit shift number for LED_KANA
  scsi: st: Restore some drive settings after reset
  scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine
  rcu: fix header guard for rcu_all_qs()
  rcu: handle quiescent states for PREEMPT_RCU=n, PREEMPT_COUNT=y
  vxlan: Annotate FDB data races
  hwmon: (xgene-hwmon) use appropriate type for the latency value
  ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure().
  net/mlx5e: reduce rep rxq depth to 256 for ECPF
  net/mlx5e: set the tx_queue_len for pfifo_fast
  net/mlx5: Extend Ethtool loopback selftest to support non-linear SKB
  phy: core: don't require set_mode() callback for phy_get_mode() to work
  net/mlx4_core: Avoid impossible mlx4_db_alloc() order value
  smack: recognize ipv4 CIPSO w/o categories
  pinctrl: devicetree: do not goto err when probing hogs in pinctrl_dt_to_map
  ASoC: ops: Enforce platform maximum on initial value
  net/mlx5: Apply rate-limiting to high temperature warning
  net/mlx5: Modify LSB bitmask in temperature event to include only the first bit
  ACPI: HED: Always initialize before evged
  PCI: Fix old_size lower bound in calculate_iosize() too
  EDAC/ie31200: work around false positive build warning
  net: pktgen: fix access outside of user given buffer in pktgen_thread_write()
  wifi: rtw88: Fix rtw_init_ht_cap() for RTL8814AU
  scsi: mpt3sas: Send a diag reset if target reset fails
  MIPS: pm-cps: Use per-CPU variables as per-CPU, not per-core
  MIPS: Use arch specific syscall name match function
  cpuidle: menu: Avoid discarding useful information
  x86/nmi: Add an emergency handler in nmi_desc & use it in nmi_shootdown_cpus()
  bonding: report duplicate MAC address in all situations
  net: xgene-v2: remove incorrect ACPI_PTR annotation
  drm/amdkfd: KFD release_work possible circular locking
  net/mlx5: Avoid report two health errors on same syndrome
  fpga: altera-cvp: Increase credit timeout
  drm/mediatek: mtk_dpi: Add checks for reg_h_fre_con existence
  hwmon: (gpio-fan) Add missing mutex locks
  x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2
  net: pktgen: fix mpls maximum labels list parsing
  pinctrl: bcm281xx: Use "unsigned int" instead of bare "unsigned"
  media: cx231xx: set device_caps for 417
  orangefs: Do not truncate file size
  dm cache: prevent BUG_ON by blocking retries on failed device resumes
  media: c8sectpfe: Call of_node_put(i2c_bus) only once in c8sectpfe_probe()
  ARM: tegra: Switch DSI-B clock parent to PLLD on Tegra114
  ieee802154: ca8210: Use proper setters and getters for bitwise types
  rtc: ds1307: stop disabling alarms on probe
  powerpc/prom_init: Fixup missing #size-cells on PowerBook6,7
  mmc: sdhci: Disable SD card clock before changing parameters
  netfilter: conntrack: Bound nf_conntrack sysctl writes
  posix-timers: Add cond_resched() to posix_timer_add() search loop
  xen: Add support for XenServer 6.1 platform device
  dm: restrict dm device size to 2^63-512 bytes
  kbuild: fix argument parsing in scripts/config
  scsi: st: ERASE does not change tape location
  scsi: st: Tighten the page format heuristics with MODE SELECT
  ext4: reorder capability check last
  um: Update min_low_pfn to match changes in uml_reserved
  um: Store full CSGSFS and SS register from mcontext
  btrfs: send: return -ENAMETOOLONG when attempting a path that is too long
  btrfs: avoid linker error in btrfs_find_create_tree_block()
  i2c: pxa: fix call balance of i2c->clk handling routines
  mmc: host: Wait for Vdd to settle on card power off
  libnvdimm/labels: Fix divide error in nd_label_data_init()
  pNFS/flexfiles: Report ENETDOWN as a connection error
  tools/build: Don't pass test log files to linker
  dql: Fix dql->limit value when reset.
  SUNRPC: rpc_clnt_set_transport() must not change the autobind setting
  NFSv4: Treat ENETUNREACH errors as fatal for state recovery
  fbdev: core: tileblit: Implement missing margin clearing for tileblit
  fbdev: fsl-diu-fb: add missing device_remove_file()
  mailbox: use error ret code of of_parse_phandle_with_args()
  kconfig: merge_config: use an empty file as initfile
  cgroup: Fix compilation issue due to cgroup_mutex not being exported
  dma-mapping: avoid potential unused data compilation warning
  scsi: target: iscsi: Fix timeout on deleted connection
  openvswitch: Fix unsafe attribute parsing in output_userspace()
  Input: synaptics - enable InterTouch on TUXEDO InfinityBook Pro 14 v5
  Input: synaptics - enable SMBus for HP Elitebook 850 G1
  clocksource/i8253: Use raw_spinlock_irqsave() in clockevent_i8253_disable()
  phy: renesas: rcar-gen3-usb2: Set timing registers only once
  phy: Fix error handling in tegra_xusb_port_init
  ALSA: es1968: Add error handling for snd_pcm_hw_constraint_pow2()
  ACPI: PPTT: Fix processor subtable walk
  dmaengine: Revert "dmaengine: dmatest: Fix dmatest waiting less when interrupted"
  NFSv4/pnfs: Reset the layout state after a layoutreturn
  NFSv4/pnfs: pnfs_set_layout_stateid() should update the layout cred
  qlcnic: fix memory leak in qlcnic_sriov_channel_cfg_cmd()
  ALSA: sh: SND_AICA should depend on SH_DMA_API
  net: dsa: sja1105: discard incoming frames in BR_STATE_LISTENING
  spi: loopback-test: Do not split 1024-byte hexdumps
  nfs: handle failure of nfs_get_lock_context in unlock path
  RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug
  iio: chemical: sps30: use aligned_s64 for timestamp
  iio: adc: ad7768-1: Fix insufficient alignment of timestamp.
  staging: axis-fifo: Correct handling of tx_fifo_depth for size validation
  staging: axis-fifo: avoid parsing ignored device tree properties
  staging: axis-fifo: Remove hardware resets for user errors
  staging: axis-fifo: replace spinlock with mutex
  platform/x86: asus-wmi: Fix wlan_ctrl_by_user detection
  do_umount(): add missing barrier before refcount checks in sync case
  nvme: unblock ctrl state transition for firmware update
  MIPS: Fix MAX_REG_OFFSET
  iio: adc: dln2: Use aligned_s64 for timestamp
  types: Complement the aligned types with signed 64-bit one
  usb: usbtmc: Fix erroneous generic_read ioctl return
  usb: usbtmc: Fix erroneous wait_srq ioctl return
  usb: usbtmc: Fix erroneous get_stb ioctl error returns
  USB: usbtmc: use interruptible sleep in usbtmc_read
  usb: typec: ucsi: displayport: Fix NULL pointer access
  usb: typec: tcpm: delay SNK_TRY_WAIT_DEBOUNCE to SRC_TRYWAIT transition
  ocfs2: stop quota recovery before disabling quotas
  ocfs2: implement handshaking with ocfs2 recovery thread
  ocfs2: switch osb->disable_recovery to enum
  module: ensure that kobject_put() is safe for module type kobjects
  xenbus: Use kref to track req lifetime
  usb: uhci-platform: Make the clock really optional
  iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo
  iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo
  iio: adis16201: Correct inclinometer channel resolution
  iio: adc: ad7606: fix serial register access
  staging: iio: adc: ad7816: Correct conditional logic for store mode
  Input: synaptics - enable InterTouch on Dell Precision M3800
  Input: synaptics - enable InterTouch on Dynabook Portege X30L-G
  Input: synaptics - enable InterTouch on Dynabook Portege X30-D
  net: dsa: b53: fix learning on VLAN unaware bridges
  netfilter: ipset: fix region locking in hash types
  sch_htb: make htb_deactivate() idempotent
  scsi: target: Fix WRITE_SAME No Data Buffer crash
  dm: fix copying after src array boundaries
  iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid
  arm64: dts: rockchip: fix iface clock-name on px30 iommus
  usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling
  usb: chipidea: ci_hdrc_imx: use dev_err_probe()
  usb: chipidea: imx: refine the error handling for hsic
  usb: chipidea: imx: change hsic power regulator as optional
  irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()
  irqchip/gic-v2m: Mark a few functions __init
  irqchip/gic-v2m: Add const to of_device_id
  sch_htb: make htb_qlen_notify() idempotent
  of: module: add buffer overflow check in of_modalias()
  PCI: imx6: Skip controller_id generation logic for i.MX7D
  net: fec: ERR007885 Workaround for conventional TX
  net: lan743x: Fix memleak issue when GSO enabled
  lan743x: fix endianness when accessing descriptors
  lan743x: remove redundant initialization of variable current_head_index
  nvme-tcp: fix premature queue removal and I/O failover
  net: dlink: Correct endianness handling of led_mode
  net_sched: qfq: Fix double list add in class with netem as child qdisc
  net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc
  net_sched: drr: Fix double list add in class with netem as child qdisc
  net/mlx5: E-Switch, Initialize MAC Address for Default GID
  tracing: Fix oob write in trace_seq_to_buffer()
  dm: always update the array size in realloc_argv on success
  dm-integrity: fix a warning on invalid table line
  wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage()
  amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload
  parisc: Fix double SIGFPE crash
  i2c: imx-lpi2c: Fix clock count when probe defers
  EDAC/altera: Set DDR and SDMMC interrupt mask before registration
  EDAC/altera: Test the correct error reg offset

 Conflicts:
	Makefile
	drivers/platform/Kconfig
	drivers/platform/Makefile
	include/linux/pid.h

Change-Id: Iab0fd96a23cfe218e945cbf71eef0e87dce204db
2025-09-01 13:17:46 +03:00
Greg Kroah-Hartman
c25f780e49 Linux 5.4.297
Link: https://lore.kernel.org/r/20250826110905.607690791@linuxfoundation.org
Link: https://lore.kernel.org/r/20250827073826.377382421@linuxfoundation.org
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Alok Tiwari <alok.a.tiwari@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-08-28 16:21:37 +02:00
Masahiro Yamada
cbf2b29dce kbuild: add $(CLANG_FLAGS) to KBUILD_CPPFLAGS
commit feb843a469fb0ab00d2d23cfb9bcc379791011bb upstream.

When preprocessing arch/*/kernel/vmlinux.lds.S, the target triple is
not passed to $(CPP) because we add it only to KBUILD_{C,A}FLAGS.

As a result, the linker script is preprocessed with predefined macros
for the build host instead of the target.

Assuming you use an x86 build machine, compare the following:

 $ clang -dM -E -x c /dev/null
 $ clang -dM -E -x c /dev/null -target aarch64-linux-gnu

There is no actual problem presumably because our linker scripts do not
rely on such predefined macros, but it is better to define correct ones.

Move $(CLANG_FLAGS) to KBUILD_CPPFLAGS, so that all *.c, *.S, *.lds.S
will be processed with the proper target triple.

[Note]
After the patch submission, we got an actual problem that needs this
commit. (CBL issue 1859)

Link: https://github.com/ClangBuiltLinux/linux/issues/1859
Reported-by: Tom Rini <trini@konsulko.com>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
Tested-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-08-28 16:21:33 +02:00
Greg Kroah-Hartman
02f0aeffc1 This is the 5.4.296 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmh5JDkACgkQONu9yGCS
 aT5nfg//evp7vYDG9XXjBxzgNBJu1kP+N/yNxjM9ATgiEW4/gbhLASWZcMrdhiQl
 bvvEFad055VyjEnhK1OrCkAE/YivuJjnCvAhW4FA2V5sFTh2efYmGEOvgZBnHYsa
 txUYM/1NTlKZYPwM+YBX+9ImPDV84RX2Ryjx9ZKIZoCRsEAuH5rDbuNelgxHkmWe
 7NfscD2Fz5If2DCA7SLAwsL4KTdTfMKuOJThy0/LxAiV0ephZwgYtDB5Do56woqU
 rrV+k4dfKmGz02nOz5AJAP5fjZ0nzC27Ztwahxpey/X/Q2O3qAb9hpC1ELOC88Qv
 /yd5SqnsW4RWW2mrHumu5wngMgz2lXvjR+WOWox0BxHH2BlkkbEDJJRN74Ji7Fyu
 n0uGhRPfP9B0Qm9owTav3SJwD0fvJ1IEuOZ8H7XMONA6Zpv1Xhntqh2hGy0IwXaZ
 1lf9a0p0r9N6bbwLpOQXdDJXGh/nhmYVeTlbhkHdaZDtPpkpA28e3/bJJg15K9ap
 55t4+Xc4yU1qAP3M1GdmygRONCHKt9CpLadVBJ3EG9E6N3xFN1Y6oHAvczmoPTco
 8OITQWn1EBpg9ygLWWeof1COUZITPLsmqt6Yt3307UPqfPK+xjWiz39VNisFfuHB
 4W1lKHa7616bSrQtlc9uvBUO+jhppFtqz9EsrqOEr9epH6jiHJE=
 =LIf5
 -----END PGP SIGNATURE-----

Merge 5.4.296 into android11-5.4-lts

Changes in 5.4.296
	cifs: Fix cifs_query_path_info() for Windows NT servers
	mailbox: Not protect module_put with spin_lock_irqsave
	mfd: max14577: Fix wakeup source leaks on device unbind
	dmaengine: xilinx_dma: Set dma_device directions
	md/md-bitmap: fix dm-raid max_write_behind setting
	iio: pressure: zpa2326: Use aligned_s64 for the timestamp
	usb: potential integer overflow in usbg_make_tpg()
	tty: serial: uartlite: register uart driver in init
	usb: Add checks for snprintf() calls in usb_alloc_dev()
	usb: cdc-wdm: avoid setting WDM_READ for ZLP-s
	usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode
	ALSA: hda: Ignore unsol events for cards being shut down
	ceph: fix possible integer overflow in ceph_zero_objects()
	ovl: Check for NULL d_inode() in ovl_dentry_upper()
	VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF
	VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify
	kbuild: use -MMD instead of -MD to exclude system headers from dependency
	bpfilter: match bit size of bpfilter_umh to that of the kernel
	kbuild: add --target to correctly cross-compile UAPI headers with Clang
	kbuild: hdrcheck: fix cross build with clang
	of: property: define of_property_read_u{8,16,32,64}_array() unconditionally
	of: Add of_property_present() helper
	ASoC: meson: meson-card-utils: use of_property_present() for DT parsing
	fs/jfs: consolidate sanity checking in dbMount
	jfs: validate AG parameters in dbMount() to prevent crashes
	media: cxusb: use dev_dbg() rather than hand-rolled debug
	media: cxusb: no longer judge rbuf when the write fails
	media: omap3isp: use sgtable-based scatterlist wrappers
	media: vivid: Change the siize of the composing
	RDMA/core: Use refcount_t instead of atomic_t on refcount of iwcm_id_private
	RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction
	i2c: tiny-usb: disable zero-length read messages
	i2c: robotfuzz-osif: disable zero-length read messages
	ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3()
	attach_recursive_mnt(): do not lock the covering tree when sliding something under it
	wifi: mac80211: fix beacon interval calculation overflow
	vsock/uapi: fix linux/vm_sockets.h userspace compilation errors
	um: ubd: Add missing error check in start_io_thread()
	net: enetc: Correct endianness handling in _enetc_rd_reg64
	atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister().
	Bluetooth: L2CAP: Fix L2CAP MTU negotiation
	dm-raid: fix variable in journal device check
	HID: wacom: fix memory leak on kobject creation failure
	HID: wacom: fix memory leak on sysfs attribute creation failure
	HID: wacom: fix kobject reference count leak
	drm/tegra: Assign plane type before registration
	drm/bridge: cdns-dsi: Fix the clock variable for mode_valid()
	drm/bridge: cdns-dsi: Fix connecting to next bridge
	drm/bridge: cdns-dsi: Check return value when getting default PHY config
	s390: Add '-std=gnu11' to decompressor and purgatory CFLAGS
	arm64: Restrict pagetable teardown to avoid false warning
	btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
	vsock/vmci: Clear the vmci transport packet properly when initializing it
	mmc: sdhci: Add a helper function for dump register in dynamic debug mode
	Revert "mmc: sdhci: Disable SD card clock before changing parameters"
	usb: typec: altmodes/displayport: do not index invalid pin_assignments
	mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data
	platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment
	RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert
	nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.
	scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu()
	btrfs: fix missing error handling when searching for inode refs during log replay
	drm/exynos: fimd: Guard display clock control with runtime PM calls
	lib: test_objagg: Set error message in check_expect_hints_stats()
	amd-xgbe: align CL37 AN sequence as per databook
	enic: fix incorrect MTU comparison in enic_change_mtu()
	nui: Fix dma_mapping_error() check
	net/sched: Always pass notifications when child class becomes empty
	ALSA: sb: Force to disable DMAs once when DMA mode is changed
	ata: pata_cs5536: fix build on 32-bit UML
	powerpc: Fix struct termio related ioctl macros
	wifi: mac80211: drop invalid source address OCB frames
	wifi: ath6kl: remove WARN on bad firmware input
	ACPICA: Refuse to evaluate a method if arguments are missing
	regulator: gpio: Add input_supply support in gpio_regulator_config
	regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods
	mmc: mediatek: use data instead of mrq parameter from msdc_{un}prepare_data()
	mtk-sd: Prevent memory corruption from DMA map failure
	mtk-sd: reset host->mrq on prepare_data() error
	drm/v3d: Disable interrupts before resetting the GPU
	scsi: ufs: core: Fix spelling of a sysfs attribute name
	RDMA/core: Create and destroy counters in the ib_core
	RDMA/mlx5: Fix CC counters query for MPV
	btrfs: propagate last_unlink_trans earlier when doing a rmdir
	btrfs: use btrfs_record_snapshot_destroy() during rmdir
	ethernet: atl1: Add missing DMA mapping error checks and count errors
	dpaa2-eth: fix xdp_rxq_info leak
	spi: spi-fsl-dspi: Rename fifo_{read,write} and {tx,cmd}_fifo_write
	spi: spi-fsl-dspi: Fix interrupt-less DMA mode taking an XSPI code path
	spi: spi-fsl-dspi: Clear completion counter before initiating transfer
	drm/i915/selftests: Change mock_request() to return error pointers
	drm/i915/gt: Fix timeline left held on VMA alloc error
	net: rose: Fix fall-through warnings for Clang
	rose: fix dangling neighbour pointers in rose_rt_device_down()
	Logitech C-270 even more broken
	usb: typec: displayport: Fix potential deadlock
	ACPI: PAD: fix crash in exit_round_robin()
	media: uvcvideo: Return the number of processed controls
	media: uvcvideo: Send control events for partial succeeds
	media: uvcvideo: Rollback non processed entities on error
	staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher()
	drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling
	proc: Clear the pieces of proc_inode that proc_evict_inode cares about
	fix proc_sys_compare() handling of in-lookup dentries
	netlink: Fix wraparounds of sk->sk_rmem_alloc.
	tipc: Fix use-after-free in tipc_conn_close().
	atm: clip: Fix potential null-ptr-deref in to_atmarpd().
	atm: clip: Fix memory leak of struct clip_vcc.
	atm: clip: Fix infinite recursive call of clip_push().
	atm: clip: Fix NULL pointer dereference in vcc_sendmsg()
	net/sched: Abort __tc_modify_qdisc if parent class does not exist
	rxrpc: Fix oops due to non-existence of prealloc backlog struct
	x86/mce/amd: Fix threshold limit reset
	x86/mce: Don't remove sysfs if thresholding sysfs init fails
	x86/mce: Make sure CMCI banks are cleared during shutdown on Intel
	pinctrl: qcom: msm: mark certain pins as invalid for interrupts
	drm/sched: Increment job count before swapping tail spsc queue
	usb: gadget: u_serial: Fix race condition in TTY wakeup
	Revert "ACPI: battery: negate current when discharging"
	pwm: mediatek: Ensure to disable clocks in error path
	netlink: make sure we allow at least one dump skb
	netlink: Fix rmem check in netlink_broadcast_deliver().
	RDMA/mlx5: Fix vport loopback for MPV device
	flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes
	NFSv4/flexfiles: Fix handling of NFS level errors in I/O
	Input: xpad - add support for Amazon Game Controller
	Input: xpad - add VID for Turtle Beach controllers
	Input: xpad - support Acer NGR 200 Controller
	dma-buf: fix timeout handling in dma_resv_wait_timeout v2
	wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev()
	md/raid1: Fix stack memory use after return in raid1_reshape
	net: appletalk: Fix device refcount leak in atrtr_create()
	net: phy: microchip: limit 100M workaround to link-down events on LAN88xx
	can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level
	bnxt_en: Fix DCB ETS validation
	bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT
	atm: idt77252: Add missing `dma_map_error()`
	net: usb: qmi_wwan: add SIMCom 8230C composition
	vt: add missing notification when switching back to text mode
	HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY
	HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras
	Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID
	x86/mm: Disable hugetlb page table sharing on 32-bit
	net: ipv6: Discard next-hop MTU less than minimum link MTU
	Linux 5.4.296

Change-Id: Ida23d7bc57d7a55921aa3db936a175607d7859b8
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-07-18 10:57:54 +00:00
Greg Kroah-Hartman
04b7726c3c Linux 5.4.296
Link: https://lore.kernel.org/r/20250715130800.293690950@linuxfoundation.org
Tested-by: Alok Tiwari <alok.a.tiwari@oracle.com>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Link: https://lore.kernel.org/r/20250716141302.507854168@linuxfoundation.org
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-07-17 18:25:06 +02:00
Greg Kroah-Hartman
978aeb58ff This is the 5.4.295 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmhebGEACgkQONu9yGCS
 aT67mBAAqkBCrkNSqHHQpsl/YybmfDgGonfHeLkNOYp4G44Axp/oytb1bAEhg65A
 oqfTSF67Hr3xjBVEvFMHMnuFO1+xHxkKIy3LUr9o9gjS+6+rEn7U5cYkaHYPNef5
 hN/tPUwf90d2ivpAsTueUu4PegJUJTaux0VqW6PsECKJ/fRF2sdAW7NpGps4zwaw
 +gnxZ7fhWnMLDeSH4d6HAFsVB10AH4sC/WzVMGlXpiS7V8vzM7QjAj3S7NWkOjaX
 fUWmKLecRT6388V+PBH6tr7vwsbFAv83gKVENgFMPKnsfPLTKd3d81TJvWqbU5Dn
 Y+KxG1NWmIUkhlMeqDld51JJCP2JpLxSchqHvJ2TiFJs3gRdkYeQxiDfXHzRsZ+v
 8beqQufcmQFxOyUkWQLGlMR9ACva1IA7hQ4HdTqygDqcQjKcvIYGcy+29PpTBVjj
 +BNs6F8ttK6jQ19IqwhP2AeIObq/DQCtn0xRaOkfAwyODhi2nD7F191ZtmrRwAq7
 ax+hXzNIWkLhvsuG+YLuNXczYbOGKZ56mg8XI+3DQ0KNRUieznsgeXXsjkGbzivn
 uDPWkRtqO48RnZHzlLUzT0Zv7pNCWXscnHEa1LfQ7Effj3G0C74TJWLDRcfSgf0i
 +cdXwJhnHc1ztExtmuNvfk7SHEFRNhjB8Zmdd8weK6SUzH0knPE=
 =jzgM
 -----END PGP SIGNATURE-----

Merge 5.4.295 into android11-5.4-lts

Changes in 5.4.295
	tracing: Fix compilation warning on arm32
	pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs > 31
	pinctrl: armada-37xx: set GPIO output value before setting direction
	usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE
	usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device
	usb: usbtmc: Fix timeout value in get_stb
	thunderbolt: Do not double dequeue a configuration request
	netfilter: nft_socket: fix sk refcount leaks
	gfs2: gfs2_create_inode error handling fix
	perf/core: Fix broken throttling when max_samples_per_tick=1
	x86/cpu: Sanitize CPUID(0x80000000) output
	crypto: marvell/cesa - Handle zero-length skcipher requests
	crypto: marvell/cesa - Avoid empty transfer descriptor
	EDAC/skx_common: Fix general protection fault
	PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks()
	x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges()
	ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions"
	spi: sh-msiof: Fix maximum DMA transfer size
	drm/vmwgfx: Add seqno waiter for sync_files
	m68k: mac: Fix macintosh_config for Mac II
	firmware: psci: Fix refcount leak in psci_dt_init
	selftests/seccomp: fix syscall_restart test for arm compat
	drm: rcar-du: Fix memory leak in rcar_du_vsps_init()
	drm/vkms: Adjust vkms_state->active_planes allocation type
	drm/tegra: rgb: Fix the unbound reference count
	f2fs: fix to do sanity check on sbi->total_valid_block_count
	net: ncsi: Fix GCPS 64-bit member variables
	wifi: rtw88: do not ignore hardware read error during DPK
	RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h
	f2fs: clean up w/ fscrypt_is_bounce_page()
	netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it
	ktls, sockmap: Fix missing uncharge operation
	pinctrl: at91: Fix possible out-of-boundary access
	bpf: Fix WARN() in get_bpf_raw_tp_regs
	wifi: ath9k_htc: Abort software beacon handling if disabled
	netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy
	net: usb: aqc111: fix error handling of usbnet read calls
	net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy
	calipso: Don't call calipso functions for AF_INET sk.
	f2fs: use d_inode(dentry) cleanup dentry->d_inode
	f2fs: fix to correct check conditions in f2fs_cross_rename
	ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select
	ARM: dts: at91: at91sam9263: fix NAND chip selects
	Squashfs: check return result of sb_min_blocksize
	nilfs2: add pointer check for nilfs_direct_propagate()
	nilfs2: do not propagate ENOENT error from nilfs_btree_propagate()
	bus: fsl-mc: fix double-free on mc_dev
	ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device
	arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou
	soc: aspeed: lpc: Fix impossible judgment condition
	soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop()
	fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()
	perf ui browser hists: Set actions->thread before calling do_zoom_thread()
	perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3
	rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send()
	mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove()
	mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE
	perf tests switch-tracking: Fix timestamp comparison
	perf record: Fix incorrect --user-regs comments
	rtc: sh: assign correct interrupts with DT
	rtc: Fix offset calculation for .start_secs < 0
	usb: renesas_usbhs: Reorder clock handling and power management in probe
	serial: Fix potential null-ptr-deref in mlb_usio_probe()
	vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl()
	net/mlx4_en: Prevent potential integer overflow calculating Hz
	Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION
	ice: create new Tx scheduler nodes for new queues only
	PM: sleep: Fix power.is_suspended cleanup for direct-complete devices
	do_change_type(): refuse to operate on unmounted/not ours mounts
	pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id()
	Input: synaptics-rmi4 - convert to use sysfs_emit() APIs
	Input: synaptics-rmi - fix crash with unsupported versions of F34
	NFSD: Fix ia_size underflow
	NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes
	scsi: iscsi: Fix incorrect error path labels for flashnode operations
	net_sched: sch_sfq: fix a potential crash on gso_skb handling
	i40e: return false from i40e_reset_vf if reset is in progress
	i40e: retry VFLR handling if there is ongoing VF reset
	net/mlx5: Wait for inactive autogroups
	net/mlx5: Fix return value when searching for existing flow group
	net_sched: prio: fix a race in prio_tune()
	net_sched: red: fix a race in __red_change()
	net_sched: tbf: fix a race in tbf_change()
	net: mdio: C22 is now optional, EOPNOTSUPP if not provided
	x86/boot/compressed: prefer cc-option for CFLAGS additions
	MIPS: Move '-Wa,-msoft-float' check from as-option to cc-option
	drm/amd/display: Do not add '-mhard-float' to dml_ccflags for clang
	drm/amd/display: Do not add '-mhard-float' to dcn2{1,0}_resource.o for clang
	net/mdiobus: Fix potential out-of-bounds read/write access
	fs/filesystems: Fix potential unsigned integer underflow in fs_name()
	usb: Flush altsetting 0 endpoints before reinitializating them after reset.
	xen/arm: call uaccess_ttbr0_enable for dm_op hypercall
	calipso: unlock rcu before returning -EAFNOSUPPORT
	net: usb: aqc111: debug info before sanitation
	configfs: Do not override creating attribute file failure in populate_attrs()
	gfs2: move msleep to sleepable context
	wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()
	nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request
	wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723
	media: gspca: Add error handling for stv06xx_read_sensor()
	media: v4l2-dev: fix error handling in __video_register_device()
	ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap()
	ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330
	bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device
	ext4: inline: fix len overflow in ext4_prepare_inline_data
	ext4: fix calculation of credits for extent tree modification
	Input: ims-pcu - check record size in ims_pcu_flash_firmware()
	f2fs: prevent kernel warning due to negative i_nlink from corrupted image
	NFC: nci: uart: Set tty->disc_data only in success path
	EDAC/altera: Use correct write width with the INTTEST register
	fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var
	vgacon: Add check for vc_origin address range in vgacon_scroll()
	parisc: fix building with gcc-15
	ipc: fix to protect IPCS lookups using RCU
	mm: fix ratelimit_pages update error in dirty_ratio_handler()
	mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk
	mtd: nand: sunxi: Add randomizer configuration before randomizer enable
	dm-mirror: fix a tiny race condition
	ftrace: Fix UAF when lookup kallsym after ftrace disabled
	net: ch9200: fix uninitialised access during mii_nway_restart
	staging: iio: ad5933: Correct settling cycles encoding per datasheet
	mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS
	regulator: max14577: Add error check for max14577_read_reg()
	uio_hv_generic: Use correct size for interrupt and monitor pages
	PCI: Add ACS quirk for Loongson PCIe
	PCI: Fix lock symmetry in pci_slot_unlock()
	iio: adc: ad7606_spi: fix reg write value mask
	ACPICA: fix acpi operand cache leak in dswstate.c
	ACPICA: Avoid sequence overread in call to strncmp()
	ACPICA: fix acpi parse and parseext cache leaks
	power: supply: bq27xxx: Retrieve again when busy
	PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn()
	ACPI: battery: negate current when discharging
	drm/amdgpu/gfx6: fix CSIB handling
	sunrpc: update nextcheck time when adding new cache entries
	drm/bridge: analogix_dp: Add irq flag IRQF_NO_AUTOEN instead of calling disable_irq()
	drm/msm/hdmi: add runtime PM calls to DDC transfer function
	media: uapi: v4l: Fix V4L2_TYPE_IS_OUTPUT condition
	drm/amd/display: Add NULL pointer checks in dm_force_atomic_commit()
	drm/msm/a6xx: Increase HFI response timeout
	drm/amdgpu/gfx10: fix CSIB handling
	drm/amdgpu/gfx7: fix CSIB handling
	jfs: fix array-index-out-of-bounds read in add_missing_indices
	drm/amdgpu/gfx8: fix CSIB handling
	drm/amdgpu/gfx9: fix CSIB handling
	jfs: Fix null-ptr-deref in jfs_ioc_trim
	drm/amdkfd: Set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB
	media: tc358743: ignore video while HPD is low
	media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode()
	nios2: force update_mmu_cache on spurious tlb-permission--related pagefaults
	cpufreq: Force sync policy boost with global boost on sysfs update
	net: macb: Check return value of dma_set_mask_and_coherent()
	i2c: designware: Invoke runtime suspend on quick slave re-registration
	emulex/benet: correct command version selection in be_cmd_get_stats()
	sctp: Do not wake readers in __sctp_write_space()
	net: dlink: add synchronization for stats update
	tcp: always seek for minimal rtt in tcp_rcv_rtt_update()
	tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows
	ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT
	pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name()
	pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction()
	pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction()
	pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get()
	net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info
	wifi: mac80211: do not offer a mesh path if forwarding is disabled
	clk: rockchip: rk3036: mark ddrphy as critical
	vxlan: Do not treat dst cache initialization errors as fatal
	scsi: lpfc: Use memcpy() for BIOS version
	sock: Correct error checking condition for (assign|release)_proto_idx()
	i40e: fix MMIO write access to an invalid page in i40e_clear_hw
	watchdog: da9052_wdt: respect TWDMIN
	bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value
	ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY
	tee: Prevent size calculation wraparound on 32-bit kernels
	Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first"
	platform: Add Surface platform directory
	platform/x86: dell_rbu: Stop overwriting data buffer
	powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery
	Revert "x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2" on v6.6 and older
	drivers/rapidio/rio_cm.c: prevent possible heap overwrite
	jffs2: check that raw node were preallocated before writing summary
	jffs2: check jffs2_prealloc_raw_node_refs() result in few other places
	scsi: storvsc: Increase the timeouts to storvsc_timeout
	scsi: s390: zfcp: Ensure synchronous unit_add
	selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len
	atm: Revert atm_account_tx() if copy_from_iter_full() fails.
	HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()
	Input: sparcspkr - avoid unannotated fall-through
	ALSA: hda/intel: Add Thinkpad E15 to PM deny list
	ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged
	erofs: remove unused trace event erofs_destroy_inode
	drm/nouveau/bl: increase buffer size to avoid truncate warning
	hwmon: (occ) fix unaligned accesses
	aoe: clean device rq_list in aoedev_downdev()
	wifi: carl9170: do not ping device which has failed to load firmware
	mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
	atm: atmtcp: Free invalid length skb in atmtcp_c_send().
	tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior
	tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
	calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().
	net: atm: add lec_mutex
	net: atm: fix /proc/net/atm/lec handling
	ARM: dts: am335x-bone-common: Add GPIO PHY reset on revision C3 board
	ARM: dts: am335x-bone-common: Increase MDIO reset deassert time
	ARM: dts: am335x-bone-common: Increase MDIO reset deassert delay to 50ms
	posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
	xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create
	rtc: Improve performance of rtc_time64_to_tm(). Add tests.
	rtc: Make rtc_time64_to_tm() support dates before 1970
	mm/huge_memory: fix dereferencing invalid pmd migration entry
	jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()
	rtc: test: Fix invalid format specifier.
	s390/pci: Fix __pcilg_mio_inuser() inline assembly
	perf: Fix sample vs do_exit()
	arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()
	scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops
	Linux 5.4.295

Change-Id: I44ee88afdff6b4865efac55635f7529a2d9715e8
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-06-30 08:05:33 +00:00
Michael Bestas
691948d565
Merge tag 'ASB-2025-06-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
https://source.android.com/docs/security/bulletin/2025-06-01

* tag 'ASB-2025-06-05_11-5.4' of https://android.googlesource.com/kernel/common:
  ANDROID: binder: fix minimum node priority comparison
  ANDROID: 16K: Remove ELF padding entry from map_file ranges
  Linux 5.4.293
  MIPS: cm: Fix warning if MIPS_CM is disabled
  crypto: atmel-sha204a - Set hwrng quality to lowest possible
  comedi: jr3_pci: Fix synchronous deletion of timer
  md/raid1: Add check for missing source disk in process_checks()
  scsi: pm80xx: Set phy_attached to zero when device is gone
  x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline
  ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls
  selftests: ublk: fix test_stripe_04
  udmabuf: fix a buf size overflow issue during udmabuf creation
  KVM: s390: Don't use %pK through tracepoints
  sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP
  ntb: reduce stack usage in idt_scan_mws
  qibfs: fix _another_ leak
  usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev()
  dmaengine: dmatest: Fix dmatest waiting less when interrupted
  usb: host: max3421-hcd: Add missing spi_device_id table
  parisc: PDT: Fix missing prototype warning
  clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec()
  crypto: null - Use spin lock instead of mutex
  MIPS: cm: Detect CM quirks from device tree
  USB: VLI disk crashes if LPM is used
  usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive
  usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive
  usb: dwc3: gadget: check that event count does not exceed event buffer length
  USB: OHCI: Add quirk for LS7A OHCI controller (rev 0x02)
  usb: cdns3: Fix deadlock when using NCM gadget
  USB: serial: simple: add OWON HDS200 series oscilloscope support
  USB: serial: option: add Sierra Wireless EM9291
  USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe
  serial: sifive: lock port in startup()/shutdown() callbacks
  USB: storage: quirk for ADATA Portable HDD CH94
  mcb: fix a double free bug in chameleon_parse_gdd()
  virtio_console: fix missing byte order handling for cols and rows
  net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too
  net_sched: hfsc: Fix a UAF vulnerability in class handling
  tipc: fix NULL pointer dereference in tipc_mon_reinit_self()
  net: phy: leds: fix memory leak
  cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate()
  drm/amd/pm: Prevent division by zero
  misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error
  misc: pci_endpoint_test: Use INTX instead of LEGACY
  PCI: Rename PCI_IRQ_LEGACY to PCI_IRQ_INTX
  iio: adc: ad7768-1: Fix conversion result sign
  iio: adc: ad7768-1: Move setting of val a bit later to avoid unnecessary return value check
  net: dsa: mv88e6xxx: fix VTU methods for 6320 family
  media: vim2m: print device name after registering device
  ext4: fix OOB read when checking dotdot dir
  ext4: optimize __ext4_check_dir_entry()
  ext4: don't over-report free space or inodes in statvfs
  ext4: code cleanup for ext4_statfs_project()
  ext4: simplify checking quota limits in ext4_statfs()
  platform/x86: ISST: Correct command storage data length
  MIPS: ds1287: Match ds1287_set_base_clock() function types
  MIPS: cevt-ds1287: Add missing ds1287.h include
  MIPS: dec: Declare which_prom() as static
  virtio-net: Add validation for used length
  RDMA/srpt: Support specifying the srpt_service_guid parameter
  openvswitch: fix lockup on tx to unregistering netdev with carrier
  net: openvswitch: fix race on port output
  mmc: cqhci: Fix checking of CQHCI_HALT state
  nvmet-fc: Remove unused functions
  usb: dwc3: support continuous runtime PM with dual role
  misc: pci_endpoint_test: Fix 'irq_type' to convey the correct type
  misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error
  tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().
  powerpc/prom_init: Use -ffreestanding to avoid a reference to bcmp
  kbuild: Add '-fno-builtin-wcslen'
  cpufreq: Reference count policy in cpufreq_update_limits()
  drm/sti: remove duplicate object names
  drm/nouveau: prime: fix ttm_bo_delayed_delete oops
  drm/repaper: fix integer overflows in repeat functions
  module: sign with sha512 instead of sha1 by default
  perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR
  perf/x86/intel: Allow to update user space GPRs from PEBS records
  virtiofs: add filesystem context source name check
  riscv: Avoid fortify warning in syscall_get_arguments()
  isofs: Prevent the use of too small fid
  i2c: cros-ec-tunnel: defer probe if parent EC is not present
  hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key
  btrfs: correctly escape subvol in btrfs_show_options()
  nfs: add missing selections of CONFIG_CRC32
  nfs: move nfs_fhandle_hash to common include file
  NFSD: Constify @fh argument of knfsd_fh_hash()
  asus-laptop: Fix an uninitialized variable
  writeback: fix false warning in inode_to_wb()
  net: b53: enable BPDU reception for management port
  net: openvswitch: fix nested key length validation in the set() action
  Revert "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()"
  Bluetooth: btrtl: Prevent potential NULL dereference
  Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address
  RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe()
  scsi: iscsi: Fix missing scsi_host_put() in error path
  wifi: wl1251: fix memory leak in wl1251_tx_work
  wifi: mac80211: Purge vif txq in ieee80211_do_stop()
  wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()
  wifi: at76c50x: fix use after free access in at76_disconnect
  HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition
  pwm: mediatek: always use bus clock for PWM on MT7622
  Bluetooth: hci_uart: Fix another race during initialization
  x86/e820: Fix handling of subpage regions when calculating nosave ranges in e820__register_nosave_regions()
  PCI: Fix reference leak in pci_alloc_child_bus()
  of/irq: Fix device node refcount leakages in of_irq_init()
  of/irq: Fix device node refcount leakage in API irq_of_parse_and_map()
  of/irq: Fix device node refcount leakages in of_irq_count()
  ntb: use 64-bit arithmetic for the MSI doorbell mask
  gpio: zynq: Fix wakeup source leaks on device unbind
  ftrace: Add cond_resched() to ftrace_graph_set_hash()
  dm-integrity: set ti->error on memory allocation failure
  crypto: ccp - Fix check for the primary ASP device
  thermal/drivers/rockchip: Add missing rk3328 mapping entry
  sctp: detect and prevent references to a freed transport in sendmsg
  mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock
  sparc/mm: disable preemption in lazy mmu mode
  arm64: dts: mediatek: mt8173: Fix disp-pwm compatible string
  mtd: rawnand: Add status chack in r852_ready()
  mtd: inftlcore: Add error check for inftl_read_oob()
  lib: scatterlist: fix sg_split_phys to preserve original scatterlist offsets
  locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class()
  jbd2: remove wrong sb->s_sequence check
  i3c: Add NULL pointer check in i3c_master_queue_ibi()
  ext4: fix off-by-one error in do_split
  wifi: mac80211: fix integer overflow in hwmp_route_info_get()
  net: dsa: mv88e6xxx: workaround RGMII transmit delay erratum for 6320 family
  media: venus: hfi_parser: add check to avoid out of bound access
  media: i2c: ov7251: Introduce 1 ms delay between regulators and en GPIO
  media: i2c: ov7251: Set enable GPIO low in probe
  media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf()
  media: streamzap: prevent processing IR data on URB failure
  mtd: rawnand: brcmnand: fix PM resume warning
  arm64: cputype: Add MIDR_CORTEX_A76AE
  xenfs/xensyms: respect hypervisor's "next" indication
  media: siano: Fix error handling in smsdvb_module_init()
  media: venus: hfi: add check to handle incorrect queue size
  media: venus: hfi: add a check to handle OOB in sfr region
  media: i2c: adv748x: Fix test pattern selection mask
  ext4: don't treat fhandle lookup of ea_inode as FS corruption
  ext4: reject casefold inode flag without casefold feature
  bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags
  bpf: Add endian modifiers to fix endian warnings
  pwm: fsl-ftm: Handle clk_get_rate() returning 0
  pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config()
  pwm: mediatek: Always use bus clock
  fbdev: omapfb: Add 'plane' value check
  drm/mediatek: mtk_dpi: Explicitly manage TVD clock in power on/off
  drm/amdkfd: Fix pqm_destroy_queue race with GPU reset
  drm/amdkfd: clamp queue size to minimum
  drm: panel-orientation-quirks: Add new quirk for GPD Win 2
  drm: panel-orientation-quirks: Add support for AYANEO 2S
  drm: allow encoder mode_set even when connectors change for crtc
  Bluetooth: hci_uart: fix race during initialization
  tracing: fix return value in __ftrace_event_enable_disable for TRACE_REG_UNREGISTER
  net: vlan: don't propagate flags on open
  wifi: mt76: mt76x2u: add TP-Link TL-WDN6200 ID to device table
  scsi: st: Fix array overflow in st_setup()
  ext4: ignore xattrs past end
  ext4: protect ext4_release_dquot against freezing
  ahci: add PCI ID for Marvell 88SE9215 SATA Controller
  ata: libata-eh: Do not use ATAPI DMA for a device limited to PIO mode
  jfs: add sanity check for agwidth in dbMount
  jfs: Prevent copying of nlink with value 0 from disk inode
  fs/jfs: Prevent integer overflow in AG size calculation
  fs/jfs: cast inactags to s64 to prevent potential overflow
  page_pool: avoid infinite loop to schedule delayed worker
  ALSA: usb-audio: Fix CME quirk for UF series keyboards
  ALSA: hda: intel: Fix Optimus when GPU has no sound
  HID: pidff: Fix null pointer dereference in pidff_find_fields
  HID: pidff: Do not send effect envelope if it's empty
  HID: pidff: Convert infinite length from Linux API to PID standard
  xen/mcelog: Add __nonstring annotations for unterminated strings
  perf: arm_pmu: Don't disable counter in armpmu_add()
  x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD when running in a virtual machine
  pm: cpupower: bench: Prevent NULL dereference on malloc failure
  net: ppp: Add bound checking for skb data on ppp_sync_txmung
  ata: sata_sx4: Add error handling in pdc20621_i2c_read()
  ata: sata_sx4: Drop pointless VPRINTK() calls and convert the remaining ones
  tipc: fix memory leak in tipc_link_xmit
  ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe()

 Conflicts:
	arch/arm64/include/asm/cputype.h
	drivers/usb/core/quirks.c
	drivers/usb/dwc3/gadget.c

Change-Id: Ie734fa9555f5cdd3575d8b29f71ab946102b5f84
2025-06-30 10:49:17 +03:00
Greg Kroah-Hartman
39ed7800f9 Linux 5.4.295
Link: https://lore.kernel.org/r/20250623130611.896514667@linuxfoundation.org
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
Tested-by: Alok Tiwari <alok.a.tiwari@oracle.com>
Link: https://lore.kernel.org/r/20250625085227.279764371@linuxfoundation.org
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-06-27 11:02:58 +01:00
Greg Kroah-Hartman
cd881391f1 This is the 5.4.294 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmhAPSgACgkQONu9yGCS
 aT7FShAA16nZLD+wQFWNG0AB1oKDjWuH3cMzxcJnYKJC2LHAiFoCV8DX0SuLBEF/
 Lf79xdniv4NYWja7hGykC+0iMBlZKaRWvKOO5jmqA0+Tgy39NCgoDyD5r2azsSnn
 vKqfDsmhijaZ3Vkr1Kw3Co0i9aVHFS2G532eaIdXjr+XrVGyXGoS/a4pPuZz2S5M
 FGBzQfgsFnMVhnYG1CCz3PSE4iVKaC0jWOrJOxIsyjrZJ038362fKl75AQQho0ga
 fNEleCDJiItnBGyOsgEYTuYgpiJ9Q2mfmScJaK4epphCwZ3IwRNp9ZGEjOWQlr+6
 fmaDXqARB77cZ1HrrW89UyhiM/7D+yLZpmWGeSAKcpf0ytIUXzmkKwywFMd0znw7
 HGYpjOgSpQKG7Nbf7+cYYi5h2RenO1ecbmDxz+o8oR5bJ/w4B20Qbwy1VGizlSxb
 HU492UirF783ZYFUuNTAhmzvVF5KPp4fRQVrn2MpOLusQe5tSDmA1LQLnkIRKh+N
 9/w5CNugUvPUHwqJhJxEniTST+1mSJ3f3BDRWq16A4WVWN21IFtmFJOh3beC+cwB
 /maaA9ybh4D98XpPIo13tgjBYfDH5mAXWx80M7aoais+E0o08j4oMIyVhV/N/nJv
 dtjznweRdLFDyoST/PFku9JOKH+1WxzaM2vqX0D1NpB3BUfapww=
 =dZXI
 -----END PGP SIGNATURE-----

Merge 5.4.294 into android11-5.4-lts

Changes in 5.4.294
	EDAC/altera: Test the correct error reg offset
	EDAC/altera: Set DDR and SDMMC interrupt mask before registration
	i2c: imx-lpi2c: Fix clock count when probe defers
	parisc: Fix double SIGFPE crash
	amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload
	wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage()
	dm-integrity: fix a warning on invalid table line
	dm: always update the array size in realloc_argv on success
	tracing: Fix oob write in trace_seq_to_buffer()
	net/mlx5: E-Switch, Initialize MAC Address for Default GID
	net_sched: drr: Fix double list add in class with netem as child qdisc
	net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc
	net_sched: qfq: Fix double list add in class with netem as child qdisc
	net: dlink: Correct endianness handling of led_mode
	nvme-tcp: fix premature queue removal and I/O failover
	lan743x: remove redundant initialization of variable current_head_index
	lan743x: fix endianness when accessing descriptors
	net: lan743x: Fix memleak issue when GSO enabled
	net: fec: ERR007885 Workaround for conventional TX
	PCI: imx6: Skip controller_id generation logic for i.MX7D
	of: module: add buffer overflow check in of_modalias()
	sch_htb: make htb_qlen_notify() idempotent
	irqchip/gic-v2m: Add const to of_device_id
	irqchip/gic-v2m: Mark a few functions __init
	irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()
	usb: chipidea: imx: change hsic power regulator as optional
	usb: chipidea: imx: refine the error handling for hsic
	usb: chipidea: ci_hdrc_imx: use dev_err_probe()
	usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling
	arm64: dts: rockchip: fix iface clock-name on px30 iommus
	iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid
	dm: fix copying after src array boundaries
	scsi: target: Fix WRITE_SAME No Data Buffer crash
	sch_htb: make htb_deactivate() idempotent
	netfilter: ipset: fix region locking in hash types
	net: dsa: b53: fix learning on VLAN unaware bridges
	Input: synaptics - enable InterTouch on Dynabook Portege X30-D
	Input: synaptics - enable InterTouch on Dynabook Portege X30L-G
	Input: synaptics - enable InterTouch on Dell Precision M3800
	staging: iio: adc: ad7816: Correct conditional logic for store mode
	iio: adc: ad7606: fix serial register access
	iio: adis16201: Correct inclinometer channel resolution
	iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo
	iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo
	usb: uhci-platform: Make the clock really optional
	xenbus: Use kref to track req lifetime
	module: ensure that kobject_put() is safe for module type kobjects
	ocfs2: switch osb->disable_recovery to enum
	ocfs2: implement handshaking with ocfs2 recovery thread
	ocfs2: stop quota recovery before disabling quotas
	usb: typec: tcpm: delay SNK_TRY_WAIT_DEBOUNCE to SRC_TRYWAIT transition
	usb: typec: ucsi: displayport: Fix NULL pointer access
	USB: usbtmc: use interruptible sleep in usbtmc_read
	usb: usbtmc: Fix erroneous get_stb ioctl error returns
	usb: usbtmc: Fix erroneous wait_srq ioctl return
	usb: usbtmc: Fix erroneous generic_read ioctl return
	types: Complement the aligned types with signed 64-bit one
	iio: adc: dln2: Use aligned_s64 for timestamp
	MIPS: Fix MAX_REG_OFFSET
	nvme: unblock ctrl state transition for firmware update
	do_umount(): add missing barrier before refcount checks in sync case
	platform/x86: asus-wmi: Fix wlan_ctrl_by_user detection
	staging: axis-fifo: replace spinlock with mutex
	staging: axis-fifo: Remove hardware resets for user errors
	staging: axis-fifo: avoid parsing ignored device tree properties
	staging: axis-fifo: Correct handling of tx_fifo_depth for size validation
	iio: adc: ad7768-1: Fix insufficient alignment of timestamp.
	iio: chemical: sps30: use aligned_s64 for timestamp
	RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug
	nfs: handle failure of nfs_get_lock_context in unlock path
	spi: loopback-test: Do not split 1024-byte hexdumps
	net: dsa: sja1105: discard incoming frames in BR_STATE_LISTENING
	ALSA: sh: SND_AICA should depend on SH_DMA_API
	qlcnic: fix memory leak in qlcnic_sriov_channel_cfg_cmd()
	NFSv4/pnfs: pnfs_set_layout_stateid() should update the layout cred
	NFSv4/pnfs: Reset the layout state after a layoutreturn
	dmaengine: Revert "dmaengine: dmatest: Fix dmatest waiting less when interrupted"
	ACPI: PPTT: Fix processor subtable walk
	ALSA: es1968: Add error handling for snd_pcm_hw_constraint_pow2()
	phy: Fix error handling in tegra_xusb_port_init
	phy: renesas: rcar-gen3-usb2: Set timing registers only once
	clocksource/i8253: Use raw_spinlock_irqsave() in clockevent_i8253_disable()
	Input: synaptics - enable SMBus for HP Elitebook 850 G1
	Input: synaptics - enable InterTouch on TUXEDO InfinityBook Pro 14 v5
	openvswitch: Fix unsafe attribute parsing in output_userspace()
	scsi: target: iscsi: Fix timeout on deleted connection
	dma-mapping: avoid potential unused data compilation warning
	cgroup: Fix compilation issue due to cgroup_mutex not being exported
	kconfig: merge_config: use an empty file as initfile
	mailbox: use error ret code of of_parse_phandle_with_args()
	fbdev: fsl-diu-fb: add missing device_remove_file()
	fbdev: core: tileblit: Implement missing margin clearing for tileblit
	NFSv4: Treat ENETUNREACH errors as fatal for state recovery
	SUNRPC: rpc_clnt_set_transport() must not change the autobind setting
	dql: Fix dql->limit value when reset.
	tools/build: Don't pass test log files to linker
	pNFS/flexfiles: Report ENETDOWN as a connection error
	libnvdimm/labels: Fix divide error in nd_label_data_init()
	mmc: host: Wait for Vdd to settle on card power off
	i2c: pxa: fix call balance of i2c->clk handling routines
	btrfs: avoid linker error in btrfs_find_create_tree_block()
	btrfs: send: return -ENAMETOOLONG when attempting a path that is too long
	um: Store full CSGSFS and SS register from mcontext
	um: Update min_low_pfn to match changes in uml_reserved
	ext4: reorder capability check last
	scsi: st: Tighten the page format heuristics with MODE SELECT
	scsi: st: ERASE does not change tape location
	kbuild: fix argument parsing in scripts/config
	dm: restrict dm device size to 2^63-512 bytes
	xen: Add support for XenServer 6.1 platform device
	posix-timers: Add cond_resched() to posix_timer_add() search loop
	netfilter: conntrack: Bound nf_conntrack sysctl writes
	mmc: sdhci: Disable SD card clock before changing parameters
	powerpc/prom_init: Fixup missing #size-cells on PowerBook6,7
	rtc: ds1307: stop disabling alarms on probe
	ieee802154: ca8210: Use proper setters and getters for bitwise types
	ARM: tegra: Switch DSI-B clock parent to PLLD on Tegra114
	media: c8sectpfe: Call of_node_put(i2c_bus) only once in c8sectpfe_probe()
	dm cache: prevent BUG_ON by blocking retries on failed device resumes
	orangefs: Do not truncate file size
	media: cx231xx: set device_caps for 417
	pinctrl: bcm281xx: Use "unsigned int" instead of bare "unsigned"
	net: pktgen: fix mpls maximum labels list parsing
	x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2
	hwmon: (gpio-fan) Add missing mutex locks
	drm/mediatek: mtk_dpi: Add checks for reg_h_fre_con existence
	fpga: altera-cvp: Increase credit timeout
	net/mlx5: Avoid report two health errors on same syndrome
	drm/amdkfd: KFD release_work possible circular locking
	net: xgene-v2: remove incorrect ACPI_PTR annotation
	bonding: report duplicate MAC address in all situations
	x86/nmi: Add an emergency handler in nmi_desc & use it in nmi_shootdown_cpus()
	cpuidle: menu: Avoid discarding useful information
	MIPS: Use arch specific syscall name match function
	MIPS: pm-cps: Use per-CPU variables as per-CPU, not per-core
	scsi: mpt3sas: Send a diag reset if target reset fails
	wifi: rtw88: Fix rtw_init_ht_cap() for RTL8814AU
	net: pktgen: fix access outside of user given buffer in pktgen_thread_write()
	EDAC/ie31200: work around false positive build warning
	PCI: Fix old_size lower bound in calculate_iosize() too
	ACPI: HED: Always initialize before evged
	net/mlx5: Modify LSB bitmask in temperature event to include only the first bit
	net/mlx5: Apply rate-limiting to high temperature warning
	ASoC: ops: Enforce platform maximum on initial value
	pinctrl: devicetree: do not goto err when probing hogs in pinctrl_dt_to_map
	smack: recognize ipv4 CIPSO w/o categories
	net/mlx4_core: Avoid impossible mlx4_db_alloc() order value
	phy: core: don't require set_mode() callback for phy_get_mode() to work
	net/mlx5: Extend Ethtool loopback selftest to support non-linear SKB
	net/mlx5e: set the tx_queue_len for pfifo_fast
	net/mlx5e: reduce rep rxq depth to 256 for ECPF
	ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure().
	hwmon: (xgene-hwmon) use appropriate type for the latency value
	vxlan: Annotate FDB data races
	rcu: handle quiescent states for PREEMPT_RCU=n, PREEMPT_COUNT=y
	rcu: fix header guard for rcu_all_qs()
	scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine
	scsi: st: Restore some drive settings after reset
	HID: usbkbd: Fix the bit shift number for LED_KANA
	bpftool: Fix readlink usage in get_fd_type
	wifi: rtw88: Don't use static local variable in rtw8822b_set_tx_power_index_by_rate
	regulator: ad5398: Add device tree support
	drm/atomic: clarify the rules around drm_atomic_state->allow_modeset
	drm: Add valid clones check
	pinctrl: meson: define the pull up/down resistor value as 60 kOhm
	ASoC: Intel: bytcr_rt5640: Add DMI quirk for Acer Aspire SW3-013
	nvmet-tcp: don't restore null sk_state_change
	btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref
	xenbus: Allow PVH dom0 a non-local xenstore
	__legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock
	xfrm: Sanitize marks before insert
	bridge: netfilter: Fix forwarding of fragmented packets
	net: dwmac-sun8i: Use parsed internal PHY address instead of 1
	sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()
	crypto: algif_hash - fix double free in hash_accept
	can: bcm: add locking for bcm_op runtime updates
	can: bcm: add missing rcu read protection for procfs content
	ALSA: pcm: Fix race of buffer access at PCM OSS layer
	llc: fix data loss when reading from a socket in llc_ui_recvmsg()
	drm/edid: fixed the bug that hdr metadata was not reset
	memcg: always call cond_resched() after fn()
	mm/page_alloc.c: avoid infinite retries caused by cpuset race
	spi: spi-fsl-dspi: restrict register range for regmap access
	kbuild: Disable -Wdefault-const-init-unsafe
	netfilter: nf_tables: pass nft_chain to destroy function, not nft_ctx
	netfilter: nf_tables: wait for rcu grace period on net_device removal
	netfilter: nf_tables: do not defer rule destruction via call_rcu
	drm/i915/gvt: fix unterminated-string-initialization warning
	smb: client: Fix use-after-free in cifs_fill_dirent
	smb: client: Reset all search buffer pointers when releasing buffer
	net_sched: hfsc: Address reentrant enqueue adding class to eltree twice
	coredump: fix error handling for replace_fd()
	pidfd: check pid has attached task in fdinfo
	pid: add pidfd_prepare()
	fork: use pidfd_prepare()
	coredump: hand a pidfd to the usermode coredump helper
	HID: quirks: Add ADATA XPG alpha wireless mouse support
	nfs: don't share pNFS DS connections between net namespaces
	platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS
	um: let 'make clean' properly clean underlying SUBARCH as well
	spi: spi-sun4i: fix early activation
	platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys
	platform/x86: thinkpad_acpi: Ignore battery threshold change event notification
	xen/swiotlb: relax alignment requirements
	Linux 5.4.294

Change-Id: Iaf692049f875da760e327bc752534cc38c2795eb
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-06-05 07:11:21 +00:00
Greg Kroah-Hartman
44613a259d Linux 5.4.294
Link: https://lore.kernel.org/r/20250602134255.449974357@linuxfoundation.org
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Alok Tiwari <alok.a.tiwari@oracle.com>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-06-04 14:32:37 +02:00
Nathan Chancellor
86a8bec7cc kbuild: Disable -Wdefault-const-init-unsafe
commit d0afcfeb9e3810ec89d1ffde1a0e36621bb75dca upstream.

A new on by default warning in clang [1] aims to flags instances where
const variables without static or thread local storage or const members
in aggregate types are not initialized because it can lead to an
indeterminate value. This is quite noisy for the kernel due to
instances originating from header files such as:

  drivers/gpu/drm/i915/gt/intel_ring.h:62:2: error: default initialization of an object of type 'typeof (ring->size)' (aka 'const unsigned int') leaves the object uninitialized [-Werror,-Wdefault-const-init-var-unsafe]
     62 |         typecheck(typeof(ring->size), next);
        |         ^
  include/linux/typecheck.h:10:9: note: expanded from macro 'typecheck'
     10 | ({      type __dummy; \
        |              ^

  include/net/ip.h:478:14: error: default initialization of an object of type 'typeof (rt->dst.expires)' (aka 'const unsigned long') leaves the object uninitialized [-Werror,-Wdefault-const-init-var-unsafe]
    478 |                 if (mtu && time_before(jiffies, rt->dst.expires))
        |                            ^
  include/linux/jiffies.h:138:26: note: expanded from macro 'time_before'
    138 | #define time_before(a,b)        time_after(b,a)
        |                                 ^
  include/linux/jiffies.h:128:3: note: expanded from macro 'time_after'
    128 |         (typecheck(unsigned long, a) && \
        |          ^
  include/linux/typecheck.h:11:12: note: expanded from macro 'typecheck'
     11 |         typeof(x) __dummy2; \
        |                   ^

  include/linux/list.h:409:27: warning: default initialization of an object of type 'union (unnamed union at include/linux/list.h:409:27)' with const member leaves the object uninitialized [-Wdefault-const-init-field-unsafe]
    409 |         struct list_head *next = smp_load_acquire(&head->next);
        |                                  ^
  include/asm-generic/barrier.h:176:29: note: expanded from macro 'smp_load_acquire'
    176 | #define smp_load_acquire(p) __smp_load_acquire(p)
        |                             ^
  arch/arm64/include/asm/barrier.h:164:59: note: expanded from macro '__smp_load_acquire'
    164 |         union { __unqual_scalar_typeof(*p) __val; char __c[1]; } __u;   \
        |                                                                  ^
  include/linux/list.h:409:27: note: member '__val' declared 'const' here

  crypto/scatterwalk.c:66:22: error: default initialization of an object of type 'struct scatter_walk' with const member leaves the object uninitialized [-Werror,-Wdefault-const-init-field-unsafe]
     66 |         struct scatter_walk walk;
        |                             ^
  include/crypto/algapi.h:112:15: note: member 'addr' declared 'const' here
    112 |                 void *const addr;
        |                             ^

  fs/hugetlbfs/inode.c:733:24: error: default initialization of an object of type 'struct vm_area_struct' with const member leaves the object uninitialized [-Werror,-Wdefault-const-init-field-unsafe]
    733 |         struct vm_area_struct pseudo_vma;
        |                               ^
  include/linux/mm_types.h:803:20: note: member 'vm_flags' declared 'const' here
    803 |                 const vm_flags_t vm_flags;
        |                                  ^

Silencing the instances from typecheck.h is difficult because '= {}' is
not available in older but supported compilers and '= {0}' would cause
warnings about a literal 0 being treated as NULL. While it might be
possible to come up with a local hack to silence the warning for
clang-21+, it may not be worth it since -Wuninitialized will still
trigger if an uninitialized const variable is actually used.

In all audited cases of the "field" variant of the warning, the members
are either not used in the particular call path, modified through other
means such as memset() / memcpy() because the containing object is not
const, or are within a union with other non-const members.

Since this warning does not appear to have a high signal to noise ratio,
just disable it.

Cc: stable@vger.kernel.org
Link: 576161cb60 [1]
Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
Closes: https://lore.kernel.org/CA+G9fYuNjKcxFKS_MKPRuga32XbndkLGcY-PVuoSwzv6VWbY=w@mail.gmail.com/
Reported-by: Marcus Seyfarth <m.seyfarth@gmail.com>
Closes: https://github.com/ClangBuiltLinux/linux/issues/2088
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
[nathan: Apply change to Makefile instead of scripts/Makefile.extrawarn
         due to lack of e88ca24319e4 in older stable branches]
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-06-04 14:32:36 +02:00
Greg Kroah-Hartman
a095a2749d Merge tag 'android11-5.4.293_r00' into android11-5.4
This merges the android11-5.4.293_r00 tag into the android11-5.4 branch,
catching it up with the latest LTS releases.

It contains the following commits:

*   a38a5caa68 Merge 5.4.293 into android11-5.4-lts
|\
| * 2c8115e475 Linux 5.4.293
| * 9be010279d MIPS: cm: Fix warning if MIPS_CM is disabled
| * ea3ee99943 crypto: atmel-sha204a - Set hwrng quality to lowest possible
| * 348adceb91 comedi: jr3_pci: Fix synchronous deletion of timer
| * 6ac5fdd8ec md/raid1: Add check for missing source disk in process_checks()
| * 05b512879e scsi: pm80xx: Set phy_attached to zero when device is gone
| * 2eebce58d4 x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline
| * dcd76f5b6c ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls
| * 3e7f0febf9 selftests: ublk: fix test_stripe_04
| * e84a08fc7e udmabuf: fix a buf size overflow issue during udmabuf creation
| * 1249ee3538 KVM: s390: Don't use %pK through tracepoints
| * 97d8b168cf sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP
| * 302af84525 ntb: reduce stack usage in idt_scan_mws
| * 5e280cce3a qibfs: fix _another_ leak
| * a777ccfb9b usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev()
| * a33bcea3ab dmaengine: dmatest: Fix dmatest waiting less when interrupted
| * f34551a487 usb: host: max3421-hcd: Add missing spi_device_id table
| * 729fd4d553 parisc: PDT: Fix missing prototype warning
| * e31c2569c8 clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec()
| * f7a5a5c8e1 crypto: null - Use spin lock instead of mutex
| * 15e468c54e MIPS: cm: Detect CM quirks from device tree
| * 79af6c0fa8 USB: VLI disk crashes if LPM is used
| * 919025be9a usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive
| * ab0ffd23f3 usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive
| * 015c39f38e usb: dwc3: gadget: check that event count does not exceed event buffer length
| * 7109b8db9c USB: OHCI: Add quirk for LS7A OHCI controller (rev 0x02)
| * eebfb64c62 usb: cdns3: Fix deadlock when using NCM gadget
| * ec0f123f4d USB: serial: simple: add OWON HDS200 series oscilloscope support
| * d75e4f33e7 USB: serial: option: add Sierra Wireless EM9291
| * 244455a70c USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe
| * 1985ca87bf serial: sifive: lock port in startup()/shutdown() callbacks
| * 5d53a1329c USB: storage: quirk for ADATA Portable HDD CH94
| * d70184958b mcb: fix a double free bug in chameleon_parse_gdd()
| * bfe45a5cf5 virtio_console: fix missing byte order handling for cols and rows
| * 68f256305c net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too
| * 28b09a0678 net_sched: hfsc: Fix a UAF vulnerability in class handling
| * a3df560104 tipc: fix NULL pointer dereference in tipc_mon_reinit_self()
| * 966d6494e2 net: phy: leds: fix memory leak
| * ad4796f2da cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate()
| * 6b9f9b998b drm/amd/pm: Prevent division by zero
| * ce5af106a0 misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error
| * 74a0c5bbed misc: pci_endpoint_test: Use INTX instead of LEGACY
| * f4a9f4dd99 PCI: Rename PCI_IRQ_LEGACY to PCI_IRQ_INTX
| * 546ce870ea iio: adc: ad7768-1: Fix conversion result sign
| * dcf1a808ab iio: adc: ad7768-1: Move setting of val a bit later to avoid unnecessary return value check
| * a813f35a75 net: dsa: mv88e6xxx: fix VTU methods for 6320 family
| * 90f9068d3f media: vim2m: print device name after registering device
| * 14da7dbecb ext4: fix OOB read when checking dotdot dir
| * 890684675d ext4: optimize __ext4_check_dir_entry()
| * abf164b4a7 ext4: don't over-report free space or inodes in statvfs
| * f1da8176d3 ext4: code cleanup for ext4_statfs_project()
| * 4d49bd1b75 ext4: simplify checking quota limits in ext4_statfs()
| * ca898f02fe platform/x86: ISST: Correct command storage data length
| * 6fa53ec60f MIPS: ds1287: Match ds1287_set_base_clock() function types
| * 7b4585c93b MIPS: cevt-ds1287: Add missing ds1287.h include
| * 9d5401493e MIPS: dec: Declare which_prom() as static
| * c1b40d1959 virtio-net: Add validation for used length
| * e0055d6461 RDMA/srpt: Support specifying the srpt_service_guid parameter
| * b5c73fc92f openvswitch: fix lockup on tx to unregistering netdev with carrier
| * 9b0dd09c1c net: openvswitch: fix race on port output
| * 65f7f79153 mmc: cqhci: Fix checking of CQHCI_HALT state
| * 8593cd968f nvmet-fc: Remove unused functions
| * bd4c12b86c usb: dwc3: support continuous runtime PM with dual role
| * b325546ed6 misc: pci_endpoint_test: Fix 'irq_type' to convey the correct type
| * 705be96504 misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error
| * 106e457953 tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().
| * 4b12272c57 powerpc/prom_init: Use -ffreestanding to avoid a reference to bcmp
| * ff55c867b6 kbuild: Add '-fno-builtin-wcslen'
| * 66e30ca3c6 cpufreq: Reference count policy in cpufreq_update_limits()
| * 1f59fc66df drm/sti: remove duplicate object names
| * 706868a1a1 drm/nouveau: prime: fix ttm_bo_delayed_delete oops
| * b65769bc2e drm/repaper: fix integer overflows in repeat functions
| * 24f8c991ad module: sign with sha512 instead of sha1 by default
| * e142b4a15d perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR
| * a356aca317 perf/x86/intel: Allow to update user space GPRs from PEBS records
| * b84f13fdad virtiofs: add filesystem context source name check
| * 801246895f riscv: Avoid fortify warning in syscall_get_arguments()
| * ee01a309eb isofs: Prevent the use of too small fid
| * 092de5ac8c i2c: cros-ec-tunnel: defer probe if parent EC is not present
| * 8060afd777 hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key
| * 56f6e554a2 btrfs: correctly escape subvol in btrfs_show_options()
| * beca6a8f19 nfs: add missing selections of CONFIG_CRC32
| * 1ff1cd28d9 nfs: move nfs_fhandle_hash to common include file
| * 052549f912 NFSD: Constify @fh argument of knfsd_fh_hash()
| * 8a7f46c1cb asus-laptop: Fix an uninitialized variable
| * b3611185b1 writeback: fix false warning in inode_to_wb()
| * 43ebe532f4 net: b53: enable BPDU reception for management port
| * 54c6957d11 net: openvswitch: fix nested key length validation in the set() action
| * d00e4cf33a Revert "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()"
| * c3e9717276 Bluetooth: btrtl: Prevent potential NULL dereference
| * 4db9080b89 Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address
| * a37488a0b2 RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe()
| * 68558f83a3 scsi: iscsi: Fix missing scsi_host_put() in error path
| * 13c9744c1b wifi: wl1251: fix memory leak in wl1251_tx_work
| * 929ec2c9ad wifi: mac80211: Purge vif txq in ieee80211_do_stop()
| * bb5c4347d5 wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()
| * c731cdfddc wifi: at76c50x: fix use after free access in at76_disconnect
| * d03abc1c2b HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition
| * b09ed99b0d pwm: mediatek: always use bus clock for PWM on MT7622
| * 1dcf08fcff Bluetooth: hci_uart: Fix another race during initialization
| * 05718ff746 x86/e820: Fix handling of subpage regions when calculating nosave ranges in e820__register_nosave_regions()
| * 7b4487b8c6 PCI: Fix reference leak in pci_alloc_child_bus()
| * 4ddd8e34c5 of/irq: Fix device node refcount leakages in of_irq_init()
| * 45a6c3ffd1 of/irq: Fix device node refcount leakage in API irq_of_parse_and_map()
| * 80a8ad35e2 of/irq: Fix device node refcount leakages in of_irq_count()
| * 60584ba9c1 ntb: use 64-bit arithmetic for the MSI doorbell mask
| * 34c4feb0d2 gpio: zynq: Fix wakeup source leaks on device unbind
| * e5b4ae6f01 ftrace: Add cond_resched() to ftrace_graph_set_hash()
| * 5a349c098f dm-integrity: set ti->error on memory allocation failure
| * 9d18fcd0ab crypto: ccp - Fix check for the primary ASP device
| * 2f39c1bc67 thermal/drivers/rockchip: Add missing rk3328 mapping entry
| * 5477622502 sctp: detect and prevent references to a freed transport in sendmsg
| * 65af70aa56 mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock
| * dc076ef13a sparc/mm: disable preemption in lazy mmu mode
| * 36ddb3b767 arm64: dts: mediatek: mt8173: Fix disp-pwm compatible string
| * b7c45dd0b1 mtd: rawnand: Add status chack in r852_ready()
| * b828d39430 mtd: inftlcore: Add error check for inftl_read_oob()
| * 4435d12392 lib: scatterlist: fix sg_split_phys to preserve original scatterlist offsets
| * 1c5b5125ac locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class()
| * cf30432f5b jbd2: remove wrong sb->s_sequence check
| * 1b54faa5f4 i3c: Add NULL pointer check in i3c_master_queue_ibi()
| * b96bd2c3db ext4: fix off-by-one error in do_split
| * 563917cbae wifi: mac80211: fix integer overflow in hwmp_route_info_get()
| * 03ece0640e net: dsa: mv88e6xxx: workaround RGMII transmit delay erratum for 6320 family
| * e5133a0b25 media: venus: hfi_parser: add check to avoid out of bound access
| * 4397512185 media: i2c: ov7251: Introduce 1 ms delay between regulators and en GPIO
| * 998642d6c6 media: i2c: ov7251: Set enable GPIO low in probe
| * 00b363790b media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf()
| * 30b46f95f8 media: streamzap: prevent processing IR data on URB failure
| * 6f567c6a52 mtd: rawnand: brcmnand: fix PM resume warning
| * c9f9b216ed arm64: cputype: Add MIDR_CORTEX_A76AE
| * dc5d08b6fd xenfs/xensyms: respect hypervisor's "next" indication
| * 8069810d8c media: siano: Fix error handling in smsdvb_module_init()
| * 1b86c1917e media: venus: hfi: add check to handle incorrect queue size
| * 4dd109038d media: venus: hfi: add a check to handle OOB in sfr region
| * 68b37e31ce media: i2c: adv748x: Fix test pattern selection mask
| * 5871166a1c ext4: don't treat fhandle lookup of ea_inode as FS corruption
| * 84554e9848 ext4: reject casefold inode flag without casefold feature
| * 8ed702674d bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags
| * a74e04deb5 bpf: Add endian modifiers to fix endian warnings
| * ecfbbd8381 pwm: fsl-ftm: Handle clk_get_rate() returning 0
| * 8b9f60725d pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config()
| * a41edf64a0 pwm: mediatek: Always use bus clock
| * a570efb4d8 fbdev: omapfb: Add 'plane' value check
| * 67988473ea drm/mediatek: mtk_dpi: Explicitly manage TVD clock in power on/off
| * f2fac9a701 drm/amdkfd: Fix pqm_destroy_queue race with GPU reset
| * ed42a47bb3 drm/amdkfd: clamp queue size to minimum
| * 65d36a0212 drm: panel-orientation-quirks: Add new quirk for GPD Win 2
| * 4025531359 drm: panel-orientation-quirks: Add support for AYANEO 2S
| * a3477a2872 drm: allow encoder mode_set even when connectors change for crtc
| * 48effdb7a7 Bluetooth: hci_uart: fix race during initialization
| * 5d16d833cf tracing: fix return value in __ftrace_event_enable_disable for TRACE_REG_UNREGISTER
| * a32f1d4f1f net: vlan: don't propagate flags on open
| * f64bc50c28 wifi: mt76: mt76x2u: add TP-Link TL-WDN6200 ID to device table
| * 736ae988bf scsi: st: Fix array overflow in st_setup()
| * 6aff941cb0 ext4: ignore xattrs past end
| * 446d7281bf ext4: protect ext4_release_dquot against freezing
| * 68d8dcd8cd ahci: add PCI ID for Marvell 88SE9215 SATA Controller
| * 57e3bb459d ata: libata-eh: Do not use ATAPI DMA for a device limited to PIO mode
| * a065cec230 jfs: add sanity check for agwidth in dbMount
| * 5b2f26d3fb jfs: Prevent copying of nlink with value 0 from disk inode
| * dd07a985e2 fs/jfs: Prevent integer overflow in AG size calculation
| * 6ec5f343f5 fs/jfs: cast inactags to s64 to prevent potential overflow
| * c3c7c57017 page_pool: avoid infinite loop to schedule delayed worker
| * d806fbac0c ALSA: usb-audio: Fix CME quirk for UF series keyboards
| * d4bac556fe ALSA: hda: intel: Fix Optimus when GPU has no sound
| * 44a1b8b202 HID: pidff: Fix null pointer dereference in pidff_find_fields
| * 634b15ad56 HID: pidff: Do not send effect envelope if it's empty
| * 85123a581f HID: pidff: Convert infinite length from Linux API to PID standard
| * 5d6569da03 xen/mcelog: Add __nonstring annotations for unterminated strings
| * de2b636094 perf: arm_pmu: Don't disable counter in armpmu_add()
| * 863af3877b x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD when running in a virtual machine
| * 34a9394794 pm: cpupower: bench: Prevent NULL dereference on malloc failure
| * 529401c8f1 net: ppp: Add bound checking for skb data on ppp_sync_txmung
| * 19d88d74ec ata: sata_sx4: Add error handling in pdc20621_i2c_read()
| * 49d7e3fe0c ata: sata_sx4: Drop pointless VPRINTK() calls and convert the remaining ones
| * 84895f5ce3 tipc: fix memory leak in tipc_link_xmit
| * a551f75401 ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe()
* 9003e46d17 Merge branch 'android11-5.4' into android11-5.4-lts

Change-Id: Ieb83b2bb9752c47ce24a4fa8e2511957ce7378d9
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-05-26 03:40:18 -07:00
Michael Bestas
bbcf9da13a Merge tag 'ASB-2025-05-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
https://source.android.com/docs/security/bulletin/2025-05-01

* tag 'ASB-2025-05-05_11-5.4' of https://android.googlesource.com/kernel/common:
  UPSTREAM: net_sched: Prevent creation of classes with TC_H_ROOT
  Linux 5.4.292
  jfs: add index corruption check to DT_GETPAGE()
  jfs: fix slab-out-of-bounds read in ea_get()
  tracing: Fix use-after-free in print_graph_function_flags during tracer switching
  mmc: sdhci-pxav3: set NEED_RSP_BUSY capability
  ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP
  x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs
  x86/tsc: Always save/restore TSC sched_clock() on suspend/resume
  ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk()
  can: flexcan: only change CAN state when link up in system PM
  arcnet: Add NULL check in com20020pci_probe()
  net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on destroy
  ipv6: fix omitted netlink attributes when using RTEXT_FILTER_SKIP_STATS
  vsock: avoid timeout during connect() if the socket is closing
  net_sched: skbprio: Remove overly strict queue assertions
  netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets
  ntb: intel: Fix using link status DB's
  ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans
  spufs: fix a leak in spufs_create_context()
  spufs: fix a leak on spufs_new_file() failure
  hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9}
  can: statistics: use atomic access in hot path
  locking/semaphore: Use wake_q to wake up processes outside lock critical section
  sched/deadline: Use online cpus for validating runtime
  affs: don't write overlarge OFS data block size fields
  affs: generate OFS sequence numbers starting at 1
  wifi: iwlwifi: fw: allocate chained SG tables for dump
  sched/smt: Always inline sched_smt_active()
  octeontx2-af: Fix mbox INTR handler when num VFs > 64
  ring-buffer: Fix bytes_dropped calculation issue
  objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds()
  fs/procfs: fix the comment above proc_pid_wchan()
  perf python: Check if there is space to copy all the event
  perf python: Decrement the refcount of just created event on failure
  perf python: Fixup description of sample.id event member
  ocfs2: validate l_tree_depth to avoid out-of-bounds access
  kexec: initialize ELF lowest address to ULONG_MAX
  perf units: Fix insufficient array space
  iio: accel: mma8452: Ensure error return on failure to matching oversampling ratio
  coresight: catu: Fix number of pages while using 64k pages
  isofs: fix KMSAN uninit-value bug in do_isofs_readdir()
  x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment
  mfd: sm501: Switch to BIT() to mitigate integer overflows
  RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow
  power: supply: max77693: Fix wrong conversion of charge input threshold value
  x86/entry: Fix ORC unwinder for PUSH_REGS with save_ret=1
  clk: amlogic: g12a: fix mmc A peripheral clock
  clk: amlogic: gxbb: drop non existing 32k clock parent
  clk: amlogic: g12b: fix cluster A parent data
  IB/mad: Check available slots before posting receive WRs
  clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent
  pinctrl: renesas: rza2: Fix missing of_node_put() call
  lib: 842: Improve error handling in sw842_compress()
  bpf: Use preempt_count() directly in bpf_send_signal_common()
  clk: amlogic: gxbb: drop incorrect flag on 32k clock
  fbdev: sm501fb: Add some geometry checks.
  mdacon: rework dependency list
  fbdev: au1100fb: Move a variable assignment behind a null pointer check
  PCI: pciehp: Don't enable HPIE when resuming in poll mode
  PCI: Remove stray put_device() in pci_register_host_bridge()
  PCI/portdrv: Only disable pciehp interrupts early when needed
  PCI/ASPM: Fix link state exit during switch upstream function removal
  drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member
  ALSA: hda/realtek: Always honor no_shutup_pins
  perf/ring_buffer: Allow the EPOLLRDNORM flag for poll
  lockdep: Don't disable interrupts on RT in disable_irq_nosync_lockdep.*()
  PM: sleep: Fix handling devices with direct_complete set on errors
  thermal: int340x: Add NULL check for adev
  EDAC/ie31200: Fix the error path order of ie31200_init()
  EDAC/ie31200: Fix the DIMM size mask for several SoCs
  EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer
  selinux: Chain up tool resolving errors in install_policy.sh
  x86/platform: Only allow CONFIG_EISA for 32-bit
  x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct()
  cpufreq: governor: Fix negative 'idle_time' handling in dbs_update()
  x86/mm/pat: cpa-test: fix length for CPA_ARRAY test
  serial: 8250_dma: terminate correct DMA in tx_dma_flush()
  memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove
  net: usb: usbnet: restore usb%d name exception for local mac addresses
  net: usb: qmi_wwan: add Telit Cinterion FE990B composition
  net: usb: qmi_wwan: add Telit Cinterion FN990B composition
  tty: serial: 8250: Add some more device IDs
  counter: stm32-lptimer-cnt: fix error handling when enabling
  netfilter: socket: Lookup orig tuple for IPv6 SNAT
  ARM: Remove address checking for MMUless devices
  ARM: 9351/1: fault: Add "cut here" line for prefetch aborts
  ARM: 9350/1: fault: Implement copy_from_kernel_nofault_allowed()
  atm: Fix NULL pointer dereference
  HID: hid-plantronics: Add mic mute mapping and generalize quirks
  ALSA: usb-audio: Add quirk for Plantronics headsets to fix control names
  drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()
  batman-adv: Ignore own maximum aggregation size during RX
  ARM: shmobile: smp: Enforce shmobile_smp_* alignment
  mmc: atmel-mci: Add missing clk_disable_unprepare()
  drm/v3d: Don't run jobs that have errors flagged in its fence
  i2c: omap: fix IRQ storms
  net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES
  net: atm: fix use after free in lec_send()
  ipv6: Set errno after ip_fib_metrics_init() in ip6_route_info_create().
  ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw().
  Bluetooth: Fix error code in chan_alloc_skb_cb()
  RDMA/hns: Fix wrong value of max_sge_rd
  RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path
  xfrm_output: Force software GSO only in tunnel mode
  firmware: imx-scu: fix OF node leak in .probe()
  i2c: sis630: Fix an error handling path in sis630_probe()
  i2c: ali15x3: Fix an error handling path in ali15x3_probe()
  i2c: ali1535: Fix an error handling path in ali1535_probe()
  ASoC: codecs: wm0010: Fix error handling path in wm0010_spi_probe()
  drm/gma500: Add NULL check for pci_gfx_root in mid_get_vbt_data()
  qlcnic: fix memory leak issues in qlcnic_sriov_common.c
  drm/amd/display: Assign normalized_pix_clk when color depth = 14
  drm/atomic: Filter out redundant DPMS calls
  x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes
  USB: serial: option: match on interface class for Telit FN990B
  USB: serial: option: fix Telit Cinterion FE990A name
  USB: serial: option: add Telit Cinterion FE990B compositions
  USB: serial: ftdi_sio: add support for Altera USB Blaster 3
  block: fix 'kmem_cache of name 'bio-108' already exists'
  drm/nouveau: Do not override forced connector status
  x86/irq: Define trace events conditionally
  fuse: don't truncate cached, mutated symlink
  nvme: only allow entering LIVE from CONNECTING state
  sctp: Fix undefined behavior in left shift operation
  nvmet-rdma: recheck queue state is LIVE in state lock in recv done
  ASoC: rsnd: don't indicate warning on rsnd_kctrl_accept_runtime()
  s390/cio: Fix CHPID "configure" attribute caching
  HID: ignore non-functional sensor in HP 5MP Camera
  HID: intel-ish-hid: fix the length of MNG_SYNC_FW_CLOCK in doorbell
  ACPI: resource: IRQ override for Eluktronics MECH-17
  scsi: qla1280: Fix kernel oops when debug level > 2
  iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
  powercap: call put_device() on an error path in powercap_register_control_type()
  hrtimers: Mark is_migration_base() with __always_inline
  nvme-fc: go straight to connecting state when initializing
  net/mlx5e: Prevent bridge link show failure for non-eswitch-allowed devices
  netfilter: nft_exthdr: fix offset with ipv4_find_option()
  net_sched: Prevent creation of classes with TC_H_ROOT
  ipvs: prevent integer overflow in do_ip_vs_get_ctl()
  netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree()
  Drivers: hv: vmbus: Don't release fb_mmio resource in vmbus_free_mmio()
  drivers/hv: Replace binary semaphore with mutex
  netpoll: hold rcu read lock in __netpoll_send_skb()
  netpoll: netpoll_send_skb() returns transmit status
  netpoll: move netpoll_send_skb() out of line
  netpoll: remove dev argument from netpoll_send_skb_on_dev()
  netpoll: Fix use correct return type for ndo_start_xmit()
  pinctrl: bcm281xx: Fix incorrect regmap max_registers value
  sctp: sysctl: auth_enable: avoid using current->nsproxy
  sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy
  Revert "sctp: sysctl: auth_enable: avoid using current->nsproxy"
  Revert "sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy"
  sched/isolation: Prevent boot crash when the boot CPU is nohz_full
  clockevents/drivers/i8253: Fix stop sequence for timer 0
  vlan: fix memory leak in vlan_newlink()
  Revert "tasklet: Introduce new initialization API"
  Revert "net: usb: rtl8150: use new tasklet API"
  Revert "net: usb: rtl8150: enable basic endpoint checking"
  Revert "usb: xhci: Add timeout argument in address_device USB HCD callback"
  Revert "usb: xhci: Fix NULL pointer dereference on certain command aborts"
  Linux 5.4.291
  eeprom: digsy_mtc: Make GPIO lookup table match the device
  slimbus: messaging: Free transaction ID in delayed interrupt scenario
  intel_th: pci: Add Panther Lake-P/U support
  intel_th: pci: Add Panther Lake-H support
  intel_th: pci: Add Arrow Lake support
  Squashfs: check the inode number is not the invalid value of zero
  xhci: pci: Fix indentation in the PCI device ID definitions
  usb: gadget: Check bmAttributes only if configuration is valid
  usb: gadget: Fix setting self-powered state on suspend
  usb: gadget: Set self-powered based on MaxPower and bmAttributes
  usb: typec: tcpci_rt1711h: Unmask alert interrupts to fix functionality
  usb: typec: ucsi: increase timeout for PPM reset operations
  usb: atm: cxacru: fix a flaw in existing endpoint checks
  usb: renesas_usbhs: Flush the notify_hotplug_work
  usb: quirks: Add DELAY_INIT and NO_LPM for Prolific Mass Storage Card Reader
  usb: renesas_usbhs: Use devm_usb_get_phy()
  usb: renesas_usbhs: Call clk_put()
  Revert "drivers/card_reader/rtsx_usb: Restore interrupt based detection"
  gpio: rcar: Fix missing of_node_put() call
  net: ipv6: fix missing dst ref drop in ila lwtunnel
  net: ipv6: fix dst ref loop in ila lwtunnel
  net-timestamp: support TCP GSO case for a few missing flags
  vlan: enforce underlying device type
  ppp: Fix KMSAN uninit-value warning with bpf
  be2net: fix sleeping while atomic bugs in be_ndo_bridge_getlink
  drm/sched: Fix preprocessor guard
  hwmon: fix a NULL vs IS_ERR_OR_NULL() check in xgene_hwmon_probe()
  llc: do not use skb_get() before dev_queue_xmit()
  hwmon: (ad7314) Validate leading zero bits and return error
  hwmon: (ntc_thermistor) Fix the ncpXXxh103 sensor table
  hwmon: (pmbus) Initialise page count in pmbus_identify()
  caif_virtio: fix wrong pointer check in cfv_probe()
  net: gso: fix ownership in __udp_gso_segment
  HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove()
  HID: google: fix unused variable warning under !CONFIG_ACPI
  wifi: iwlwifi: limit printed string from FW file
  mm/page_alloc: fix uninitialized variable
  rapidio: fix an API misues when rio_add_net() fails
  rapidio: add check for rio_add_net() in rio_scan_alloc_net()
  wifi: nl80211: reject cooked mode if it is set along with other flags
  wifi: cfg80211: regulatory: improve invalid hints checking
  x86/cpu: Properly parse CPUID leaf 0x2 TLB descriptor 0x63
  x86/cpu: Validate CPUID leaf 0x2 EDX output
  x86/cacheinfo: Validate CPUID leaf 0x2 EDX output
  platform/x86: thinkpad_acpi: Add battery quirk for ThinkPad X131e
  drm/radeon: Fix rs400_gpu_init for ATI mobility radeon Xpress 200M
  ALSA: hda/realtek: update ALC222 depop optimize
  ALSA: hda: intel: Add Dell ALC3271 to power_save denylist
  HID: appleir: Fix potential NULL dereference at raw event handle
  Revert "of: reserved-memory: Fix using wrong number of cells to get property 'alignment'"
  drm/amdgpu: disable BAR resize on Dell G5 SE
  drm/amdgpu: Check extended configuration space register when system uses large bar
  drm/amdgpu: skip BAR resizing if the bios already did it
  acct: perform last write from workqueue
  kernel/acct.c: use dedicated helper to access rlimit values
  kernel/acct.c: use #elif instead of #end and #elif
  drop_monitor: fix incorrect initialization order
  pfifo_tail_enqueue: Drop new packet when sch->limit == 0
  sched/core: Prevent rescheduling when interrupts are disabled
  phy: exynos5-usbdrd: fix MPLL_MULTIPLIER and SSC_REFCLKSEL masks in refclk
  phy: tegra: xusb: reset VBUS & ID OVERRIDE
  usbnet: gl620a: fix endpoint checking in genelink_bind()
  perf/core: Fix low freq setting via IOC_PERIOD
  ftrace: Avoid potential division by zero in function_stat_show()
  x86/CPU: Fix warm boot hang regression on AMD SC1100 SoC systems
  net: mvpp2: cls: Fixed Non IP flow, with vlan tag flow defination.
  ipvs: Always clear ipvs_property flag in skb_scrub_packet()
  ASoC: es8328: fix route from DAC to output
  net: cadence: macb: Synchronize stats calculations
  net: loopback: Avoid sending IP packets without an Ethernet header
  sunrpc: suppress warnings for unused procfs functions
  batman-adv: Drop unmanaged ELP metric worker
  batman-adv: Ignore neighbor throughput metrics in error case
  acct: block access to kernel internal filesystems
  ALSA: hda/conexant: Add quirk for HP ProBook 450 G4 mute LED
  nfp: bpf: Add check for nfp_app_ctrl_msg_alloc()
  tee: optee: Fix supplicant wait loop
  power: supply: da9150-fg: fix potential overflow
  flow_dissector: Fix port range key handling in BPF conversion
  flow_dissector: Fix handling of mixed port and port-range keys
  net: extract port range fields from fl_flow_key
  geneve: Suppress list corruption splat in geneve_destroy_tunnels().
  gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl().
  geneve: Fix use-after-free in geneve_find_dev().
  powerpc/code-patching: Fix KASAN hit by not flagging text patching area as VM_ALLOC
  ALSA: hda/realtek: Fixup ALC225 depop procedure
  ALSA: hda/realtek - Add type for ALC287
  powerpc/64s: Rewrite __real_pte() and __rpte_to_hidx() as static inline
  powerpc/64s/mm: Move __real_pte stubs into hash-4k.h
  USB: gadget: f_midi: f_midi_complete to call queue_work
  usb/gadget: f_midi: Replace tasklet with work
  usb/gadget: f_midi: convert tasklets to use new tasklet_setup() API
  usb: dwc3: Fix timeout issue during controller enter/exit from halt state
  usb: dwc3: Increase DWC3 controller halt timeout
  memcg: fix soft lockup in the OOM process
  mm: update mark_victim tracepoints fields
  crypto: testmgr - some more fixes to RSA test vectors
  crypto: testmgr - populate RSA CRT parameters in RSA test vectors
  crypto: testmgr - fix version number of RSA tests
  crypto: testmgr - Fix wrong test case of RSA
  crypto: testmgr - fix wrong key length for pkcs1pad
  driver core: bus: Fix double free in driver API bus_register()
  scsi: storvsc: Set correct data length for sending SCSI command without payload
  vlan: move dev_put into vlan_dev_uninit
  vlan: introduce vlan_dev_free_egress_priority
  ima: Fix use-after-free on a dentry's dname.name
  pps: Fix a use-after-free
  btrfs: avoid monopolizing a core when activating a swap file
  Revert "btrfs: avoid monopolizing a core when activating a swap file"
  x86/i8253: Disable PIT timer 0 when not in use
  parport_pc: add support for ASIX AX99100
  serial: 8250_pci: add support for ASIX AX99100
  can: ems_pci: move ASIX AX99100 ids to pci_ids.h
  nilfs2: protect access to buffers with no active references
  nilfs2: do not force clear folio if buffer is referenced
  nilfs2: do not output warnings when clearing dirty buffers
  alpha: replace hardcoded stack offsets with autogenerated ones
  ndisc: extend RCU protection in ndisc_send_skb()
  openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
  arp: use RCU protection in arp_xmit()
  neighbour: use RCU protection in __neigh_notify()
  neighbour: delete redundant judgment statements
  ndisc: use RCU protection in ndisc_alloc_skb()
  ipv6: use RCU protection in ip6_default_advmss()
  ipv4: use RCU protection in inet_select_addr()
  ipv4: use RCU protection in rt_is_expired()
  net: add dev_net_rcu() helper
  net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu()
  regmap-irq: Add missing kfree()
  partitions: mac: fix handling of bogus partition table
  gpio: stmpe: Check return value of stmpe_reg_read in stmpe_gpio_irq_sync_unlock
  alpha: align stack for page fault and user unaligned trap handlers
  serial: 8250: Fix fifo underflow on flush
  alpha: make stack 16-byte aligned (most cases)
  can: j1939: j1939_sk_send_loop(): fix unable to send messages with data length zero
  can: c_can: fix unbalanced runtime PM disable in error path
  USB: serial: option: drop MeiG Smart defines
  USB: serial: option: fix Telit Cinterion FN990A name
  USB: serial: option: add Telit Cinterion FN990B compositions
  USB: serial: option: add MeiG Smart SLM828
  usb: cdc-acm: Fix handling of oversized fragments
  usb: cdc-acm: Check control transfer buffer size before access
  USB: cdc-acm: Fill in Renesas R-Car D3 USB Download mode quirk
  USB: hub: Ignore non-compliant devices with too many configs or interfaces
  usb: gadget: f_midi: fix MIDI Streaming descriptor lengths
  USB: Add USB_QUIRK_NO_LPM quirk for sony xperia xz1 smartphone
  USB: quirks: add USB_QUIRK_NO_LPM quirk for Teclast dist
  USB: pci-quirks: Fix HCCPARAMS register error for LS7A EHCI
  usb: dwc2: gadget: remove of_node reference upon udc_stop
  usb: gadget: udc: renesas_usb3: Fix compiler warning
  usb: roles: set switch registered flag early on
  batman-adv: fix panic during interface removal
  ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet 5V
  orangefs: fix a oob in orangefs_debug_write
  Grab mm lock before grabbing pt lock
  vfio/pci: Enable iowrite64 and ioread64 for vfio pci
  media: cxd2841er: fix 64-bit division on gcc-9
  x86/xen: allow larger contiguous memory regions in PV guests
  xen: remove a confusing comment on auto-translated guest I/O
  gpio: bcm-kona: Add missing newline to dev_err format string
  gpio: bcm-kona: Make sure GPIO bits are unlocked when requesting IRQ
  gpio: bcm-kona: Fix GPIO lock/unlock for banks above bank 0
  arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
  team: better TEAM_OPTION_TYPE_STRING validation
  vrf: use RCU protection in l3mdev_l3_out()
  ndisc: ndisc_send_redirect() must use dev_get_by_index_rcu()
  HID: multitouch: Add NULL check in mt_input_configured
  ocfs2: check dir i_size in ocfs2_find_entry
  MIPS: ftrace: Declare ftrace_get_parent_ra_addr() as static
  ptp: Ensure info->enable callback is always set
  net/ncsi: wait for the last response to Deselect Package before configuring channel
  misc: fastrpc: Fix registered buffer page address
  mtd: onenand: Fix uninitialized retlen in do_otp_read()
  NFC: nci: Add bounds checking in nci_hci_create_pipe()
  nilfs2: fix possible int overflows in nilfs_fiemap()
  ocfs2: handle a symlink read error correctly
  ocfs2: fix incorrect CPU endianness conversion causing mount failure
  vfio/platform: check the bounds of read/write syscalls
  nvmem: core: improve range check for nvmem_cell_write()
  crypto: qce - unregister previously registered algos in error path
  crypto: qce - fix goto jump in error path
  media: uvcvideo: Remove redundant NULL assignment
  media: uvcvideo: Fix event flags in uvc_ctrl_send_events
  media: ov5640: fix get_light_freq on auto
  soc: qcom: smem_state: fix missing of_node_put in error path
  kbuild: Move -Wenum-enum-conversion to W=2
  powerpc/pseries/eeh: Fix get PE state translation
  serial: sh-sci: Do not probe the serial port if its slot in sci_ports[] is in use
  serial: sh-sci: Drop __initdata macro for port_cfg
  soc: qcom: socinfo: Avoid out of bounds read of serial number
  usb: gadget: f_tcm: Don't prepare BOT write request twice
  usb: gadget: f_tcm: ep_autoconfig with fullspeed endpoint
  usb: gadget: f_tcm: Decrement command ref count on cleanup
  usb: gadget: f_tcm: Translate error to sense
  wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize()
  HID: hid-sensor-hub: don't use stale platform-data on remove
  of: reserved-memory: Fix using wrong number of cells to get property 'alignment'
  of: Fix of_find_node_opts_by_path() handling of alias+path+options
  of: Correct child specifier used as input of the 2nd nexus node
  perf bench: Fix undefined behavior in cmpworker()
  clk: qcom: clk-rpmh: prevent integer overflow in recalc_rate
  clk: qcom: clk-alpha-pll: fix alpha mode configuration
  Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc
  drm/komeda: Add check for komeda_get_layer_fourcc_list()
  KVM: s390: vsie: fix some corner-cases when grabbing vsie pages
  KVM: Explicitly verify target vCPU is online in kvm_get_vcpu()
  arm64: dts: rockchip: increase gmac rx_delay on rk3399-puma
  binfmt_flat: Fix integer overflow bug on 32 bit systems
  m68k: vga: Fix I/O defines
  s390/futex: Fix FUTEX_OP_ANDN implementation
  leds: lp8860: Write full EEPROM, not only half of it
  cpufreq: s3c64xx: Fix compilation warning
  tun: revert fix group permission check
  netem: Update sch->q.qlen before qdisc_tree_reduce_backlog()
  net: rose: lock the socket in rose_bind()
  udp: gso: do not drop small packets when PMTU reduces
  tg3: Disable tg3 PCIe AER on system reboot
  gpu: drm_dp_cec: fix broken CEC adapter properties check
  firmware: iscsi_ibft: fix ISCSI_IBFT Kconfig entry
  nvme: handle connectivity loss in nvme_set_queue_count
  usb: xhci: Fix NULL pointer dereference on certain command aborts
  usb: xhci: Add timeout argument in address_device USB HCD callback
  net: usb: rtl8150: enable basic endpoint checking
  net: usb: rtl8150: use new tasklet API
  tasklet: Introduce new initialization API
  kbuild: userprogs: use correct lld when linking through clang
  sched: sch_cake: add bounds checks to host bulk flow fairness counts
  media: uvcvideo: Remove dangling pointers
  media: uvcvideo: Only save async fh if success
  nilfs2: handle errors that nilfs_prepare_chunk() may return
  nilfs2: eliminate staggered calls to kunmap in nilfs_rename
  nilfs2: move page release outside of nilfs_delete_entry and nilfs_set_link
  spi-mxs: Fix chipselect glitch
  x86/mm: Don't disable PCID when INVLPG has been fixed by microcode
  APEI: GHES: Have GHES honor the panic= setting
  HID: Wacom: Add PCI Wacom device support
  mfd: lpc_ich: Add another Gemini Lake ISA bridge PCI device-id
  tomoyo: don't emit warning in tomoyo_write_control()
  wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy()
  mmc: core: Respect quirk_max_rate for non-UHS SDIO card
  tun: fix group permission check
  printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX
  x86/amd_nb: Restrict init function to AMD-based systems
  sched: Don't try to catch up excess steal time.
  btrfs: convert BUG_ON in btrfs_reloc_cow_block() to proper error handling
  btrfs: fix use-after-free when attempting to join an aborted transaction
  btrfs: output the reason for open_ctree() failure
  usb: gadget: f_tcm: Don't free command immediately
  media: uvcvideo: Fix double free in error path
  HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections
  usb: typec: tcpm: set SRC_SEND_CAPABILITIES timeout to PD_T_SENDER_RESPONSE
  drivers/card_reader/rtsx_usb: Restore interrupt based detection
  ktest.pl: Check kernelrelease return in get_version
  NFSD: Reset cb_seq_status after NFS4ERR_DELAY
  hexagon: Fix unbalanced spinlock in die()
  hexagon: fix using plain integer as NULL pointer warning in cmpxchg
  genksyms: fix memory leak when the same symbol is read from *.symref file
  genksyms: fix memory leak when the same symbol is added from source
  net: sh_eth: Fix missing rtnl lock in suspend/resume path
  vsock: Allow retrying on connect() failure
  perf trace: Fix runtime error of index out of bounds
  net: davicom: fix UAF in dm9000_drv_remove
  net: rose: fix timer races against user threads
  PM: hibernate: Add error handling for syscore_suspend()
  ipmr: do not call mr_mfc_uses_dev() for unres entries
  net: fec: implement TSO descriptor cleanup
  ubifs: skip dumping tnc tree when zroot is null
  rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read
  dmaengine: ti: edma: fix OF node reference leaks in edma_driver
  module: Extend the preempt disabled section in dereference_symbol_descriptor().
  ocfs2: mark dquot as inactive if failed to start trans while releasing dquot
  scsi: ufs: bsg: Delete bsg_dev when setting up bsg fails
  scsi: mpt3sas: Set ioc->manu_pg11.EEDPTagMode directly to 1
  staging: media: imx: fix OF node leak in imx_media_add_of_subdevs()
  media: uvcvideo: Propagate buf->error to userspace
  media: camif-core: Add check for clk_enable()
  media: mipi-csis: Add check for clk_enable()
  PCI: endpoint: Destroy the EPC device in devm_pci_epc_destroy()
  media: lmedm04: Handle errors for lme2510_int_read
  media: lmedm04: Use GFP_KERNEL for URB allocation/submission.
  media: rc: iguanair: handle timeouts
  fbdev: omapfb: Fix an OF node leak in dss_of_port_get_parent_device()
  ARM: dts: mediatek: mt7623: fix IR nodename
  arm64: dts: mediatek: mt8173-evb: Fix MT6397 PMIC sub-node names
  arm64: dts: mediatek: mt8173-evb: Drop regulator-compatible property
  rdma/cxgb4: Prevent potential integer overflow on 32bit
  RDMA/mlx4: Avoid false error about access to uninitialized gids array
  bpf: Send signals asynchronously if !preemptible
  perf report: Fix misleading help message about --demangle
  perf top: Don't complain about lack of vmlinux when not resolving some kernel samples
  padata: fix sysfs store callback check
  ktest.pl: Remove unused declarations in run_bisect_test function
  perf header: Fix one memory leakage in process_bpf_prog_info()
  perf header: Fix one memory leakage in process_bpf_btf()
  ASoC: sun4i-spdif: Add clock multiplier settings
  tools/testing/selftests/bpf/test_tc_tunnel.sh: Fix wait for server bind
  net: sched: Disallow replacing of child qdisc from one parent to another
  net/mlxfw: Drop hard coded max FW flash image size
  net: let net.core.dev_weight always be non-zero
  clk: analogbits: Fix incorrect calculation of vco rate delta
  selftests: harness: fix printing of mismatch values in __EXPECT()
  selftests/harness: Display signed values correctly
  wifi: wlcore: fix unbalanced pm_runtime calls
  regulator: of: Implement the unwind path of of_regulator_match()
  team: prevent adding a device which is already a team device lower
  cpupower: fix TSC MHz calculation
  wifi: rtlwifi: pci: wait for firmware loading before releasing memory
  wifi: rtlwifi: fix memory leaks and invalid access at probe error path
  wifi: rtlwifi: remove unused check_buddy_priv
  wifi: rtlwifi: remove unused dualmac control leftovers
  wifi: rtlwifi: remove unused timer and related code
  rtlwifi: replace usage of found with dedicated list iterator variable
  dt-bindings: mmc: controller: clarify the address-cells description
  wifi: rtlwifi: usb: fix workqueue leak when probe fails
  wifi: rtlwifi: rtl8192se: rise completion of firmware loading as last step
  rtlwifi: rtl8192se Rename RT_TRACE to rtl_dbg
  wifi: rtlwifi: do not complete firmware loading needlessly
  ipmi: ipmb: Add check devm_kasprintf() returned value
  drm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_range_table
  drm/etnaviv: Fix page property being used for non writecombine buffers
  partitions: ldm: remove the initial kernel-doc notation
  nbd: don't allow reconnect after disconnect
  afs: Fix directory format encoding struct
  overflow: Allow mixed type arguments
  overflow: Correct check_shl_overflow() comment
  overflow: Add __must_check attribute to check_*() helpers
  udf: Fix use of check_add_overflow() with mixed type arguments
  perf cs-etm: Add missing variable in cs_etm__process_queues()

 Conflicts:
	Documentation/devicetree/bindings/mmc/mmc-controller.yaml
	Documentation/devicetree/bindings~HEAD
	drivers/clk/qcom/clk-alpha-pll.c
	drivers/soc/qcom/socinfo.c
	drivers/usb/dwc3/gadget.c
	mm/oom_kill.c
	scripts/Makefile.extrawarn

Change-Id: I599df88164649e325b40d25cb1a8e64e5fd27cf0
2025-05-18 08:00:20 +00:00
Greg Kroah-Hartman
a38a5caa68 This is the 5.4.293 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmgUWpcACgkQONu9yGCS
 aT73HA/+LBb8+NLSn9lfxNg+iJKWhEZLIIhiD9/7AbRK72gIoAI4UdS3n1ohnQZI
 YYPhP3m+xm1DIdn9vpcX37hf8ibfLChWAkO9zMdRo8aWFBOc99kAhW6B1LKegPHz
 4IKlRaqnXHgpQ7/vzNv9tMd55PrK5vfD1nWoxFpBlnHzis4sF+jZ412+x37Br1gH
 7OGc08SaoCD/wYAjSZ5Nl3YVw5OhSCKzkDXKfxrYk+mKOv9iTPeHzzIel6SJXo4Z
 PXQiDkV3XoTBvG5kZu4n+lDJ92JcAB30pGvyG/W6EnzobXgiC4xPB87DKOKbJ6ia
 8CoKFW0ytL9+HOJW/FcklvKlbw4GntAbLmIPpyc8dMRbQOVNmSqMGDTD4GU4BubN
 0vxnMRa+sw88XMdR0xQsrAwACGcN5+zrqTBWrfN7BnTmCfw0UKJWePBj+5zpPCVH
 8lE96AL5OI3KNSqaD4mbISxYx3NuK/ggZ+go2LdbVEYfElMDJ8Jg5bYl94ymxsOh
 YFcXauCInBeRagR8gVyoVa2TTgV7ySO8cmvNh1QZqYDG7wIYqOKIVlTLiW1zLJvn
 3ix+yu5i2naq01NEX/jR2S9HVcTBq94x+1oyCWkZQeQy8SMef5vEIg9BCZAWJX6k
 cUoj/gUvtszp2epc2agrgFXhIZcJAACyxNUo4Ff4UJXorvzLWwU=
 =lSza
 -----END PGP SIGNATURE-----

Merge 5.4.293 into android11-5.4-lts

Changes in 5.4.293
	ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe()
	tipc: fix memory leak in tipc_link_xmit
	ata: sata_sx4: Drop pointless VPRINTK() calls and convert the remaining ones
	ata: sata_sx4: Add error handling in pdc20621_i2c_read()
	net: ppp: Add bound checking for skb data on ppp_sync_txmung
	pm: cpupower: bench: Prevent NULL dereference on malloc failure
	x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD when running in a virtual machine
	perf: arm_pmu: Don't disable counter in armpmu_add()
	xen/mcelog: Add __nonstring annotations for unterminated strings
	HID: pidff: Convert infinite length from Linux API to PID standard
	HID: pidff: Do not send effect envelope if it's empty
	HID: pidff: Fix null pointer dereference in pidff_find_fields
	ALSA: hda: intel: Fix Optimus when GPU has no sound
	ALSA: usb-audio: Fix CME quirk for UF series keyboards
	page_pool: avoid infinite loop to schedule delayed worker
	fs/jfs: cast inactags to s64 to prevent potential overflow
	fs/jfs: Prevent integer overflow in AG size calculation
	jfs: Prevent copying of nlink with value 0 from disk inode
	jfs: add sanity check for agwidth in dbMount
	ata: libata-eh: Do not use ATAPI DMA for a device limited to PIO mode
	ahci: add PCI ID for Marvell 88SE9215 SATA Controller
	ext4: protect ext4_release_dquot against freezing
	ext4: ignore xattrs past end
	scsi: st: Fix array overflow in st_setup()
	wifi: mt76: mt76x2u: add TP-Link TL-WDN6200 ID to device table
	net: vlan: don't propagate flags on open
	tracing: fix return value in __ftrace_event_enable_disable for TRACE_REG_UNREGISTER
	Bluetooth: hci_uart: fix race during initialization
	drm: allow encoder mode_set even when connectors change for crtc
	drm: panel-orientation-quirks: Add support for AYANEO 2S
	drm: panel-orientation-quirks: Add new quirk for GPD Win 2
	drm/amdkfd: clamp queue size to minimum
	drm/amdkfd: Fix pqm_destroy_queue race with GPU reset
	drm/mediatek: mtk_dpi: Explicitly manage TVD clock in power on/off
	fbdev: omapfb: Add 'plane' value check
	pwm: mediatek: Always use bus clock
	pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config()
	pwm: fsl-ftm: Handle clk_get_rate() returning 0
	bpf: Add endian modifiers to fix endian warnings
	bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags
	ext4: reject casefold inode flag without casefold feature
	ext4: don't treat fhandle lookup of ea_inode as FS corruption
	media: i2c: adv748x: Fix test pattern selection mask
	media: venus: hfi: add a check to handle OOB in sfr region
	media: venus: hfi: add check to handle incorrect queue size
	media: siano: Fix error handling in smsdvb_module_init()
	xenfs/xensyms: respect hypervisor's "next" indication
	arm64: cputype: Add MIDR_CORTEX_A76AE
	mtd: rawnand: brcmnand: fix PM resume warning
	media: streamzap: prevent processing IR data on URB failure
	media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf()
	media: i2c: ov7251: Set enable GPIO low in probe
	media: i2c: ov7251: Introduce 1 ms delay between regulators and en GPIO
	media: venus: hfi_parser: add check to avoid out of bound access
	net: dsa: mv88e6xxx: workaround RGMII transmit delay erratum for 6320 family
	wifi: mac80211: fix integer overflow in hwmp_route_info_get()
	ext4: fix off-by-one error in do_split
	i3c: Add NULL pointer check in i3c_master_queue_ibi()
	jbd2: remove wrong sb->s_sequence check
	locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class()
	lib: scatterlist: fix sg_split_phys to preserve original scatterlist offsets
	mtd: inftlcore: Add error check for inftl_read_oob()
	mtd: rawnand: Add status chack in r852_ready()
	arm64: dts: mediatek: mt8173: Fix disp-pwm compatible string
	sparc/mm: disable preemption in lazy mmu mode
	mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock
	sctp: detect and prevent references to a freed transport in sendmsg
	thermal/drivers/rockchip: Add missing rk3328 mapping entry
	crypto: ccp - Fix check for the primary ASP device
	dm-integrity: set ti->error on memory allocation failure
	ftrace: Add cond_resched() to ftrace_graph_set_hash()
	gpio: zynq: Fix wakeup source leaks on device unbind
	ntb: use 64-bit arithmetic for the MSI doorbell mask
	of/irq: Fix device node refcount leakages in of_irq_count()
	of/irq: Fix device node refcount leakage in API irq_of_parse_and_map()
	of/irq: Fix device node refcount leakages in of_irq_init()
	PCI: Fix reference leak in pci_alloc_child_bus()
	x86/e820: Fix handling of subpage regions when calculating nosave ranges in e820__register_nosave_regions()
	Bluetooth: hci_uart: Fix another race during initialization
	pwm: mediatek: always use bus clock for PWM on MT7622
	HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition
	wifi: at76c50x: fix use after free access in at76_disconnect
	wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()
	wifi: mac80211: Purge vif txq in ieee80211_do_stop()
	wifi: wl1251: fix memory leak in wl1251_tx_work
	scsi: iscsi: Fix missing scsi_host_put() in error path
	RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe()
	Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address
	Bluetooth: btrtl: Prevent potential NULL dereference
	Revert "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()"
	net: openvswitch: fix nested key length validation in the set() action
	net: b53: enable BPDU reception for management port
	writeback: fix false warning in inode_to_wb()
	asus-laptop: Fix an uninitialized variable
	NFSD: Constify @fh argument of knfsd_fh_hash()
	nfs: move nfs_fhandle_hash to common include file
	nfs: add missing selections of CONFIG_CRC32
	btrfs: correctly escape subvol in btrfs_show_options()
	hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key
	i2c: cros-ec-tunnel: defer probe if parent EC is not present
	isofs: Prevent the use of too small fid
	riscv: Avoid fortify warning in syscall_get_arguments()
	virtiofs: add filesystem context source name check
	perf/x86/intel: Allow to update user space GPRs from PEBS records
	perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR
	module: sign with sha512 instead of sha1 by default
	drm/repaper: fix integer overflows in repeat functions
	drm/nouveau: prime: fix ttm_bo_delayed_delete oops
	drm/sti: remove duplicate object names
	cpufreq: Reference count policy in cpufreq_update_limits()
	kbuild: Add '-fno-builtin-wcslen'
	powerpc/prom_init: Use -ffreestanding to avoid a reference to bcmp
	tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().
	misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error
	misc: pci_endpoint_test: Fix 'irq_type' to convey the correct type
	usb: dwc3: support continuous runtime PM with dual role
	nvmet-fc: Remove unused functions
	mmc: cqhci: Fix checking of CQHCI_HALT state
	net: openvswitch: fix race on port output
	openvswitch: fix lockup on tx to unregistering netdev with carrier
	RDMA/srpt: Support specifying the srpt_service_guid parameter
	virtio-net: Add validation for used length
	MIPS: dec: Declare which_prom() as static
	MIPS: cevt-ds1287: Add missing ds1287.h include
	MIPS: ds1287: Match ds1287_set_base_clock() function types
	platform/x86: ISST: Correct command storage data length
	ext4: simplify checking quota limits in ext4_statfs()
	ext4: code cleanup for ext4_statfs_project()
	ext4: don't over-report free space or inodes in statvfs
	ext4: optimize __ext4_check_dir_entry()
	ext4: fix OOB read when checking dotdot dir
	media: vim2m: print device name after registering device
	net: dsa: mv88e6xxx: fix VTU methods for 6320 family
	iio: adc: ad7768-1: Move setting of val a bit later to avoid unnecessary return value check
	iio: adc: ad7768-1: Fix conversion result sign
	PCI: Rename PCI_IRQ_LEGACY to PCI_IRQ_INTX
	misc: pci_endpoint_test: Use INTX instead of LEGACY
	misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error
	drm/amd/pm: Prevent division by zero
	cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate()
	net: phy: leds: fix memory leak
	tipc: fix NULL pointer dereference in tipc_mon_reinit_self()
	net_sched: hfsc: Fix a UAF vulnerability in class handling
	net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too
	virtio_console: fix missing byte order handling for cols and rows
	mcb: fix a double free bug in chameleon_parse_gdd()
	USB: storage: quirk for ADATA Portable HDD CH94
	serial: sifive: lock port in startup()/shutdown() callbacks
	USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe
	USB: serial: option: add Sierra Wireless EM9291
	USB: serial: simple: add OWON HDS200 series oscilloscope support
	usb: cdns3: Fix deadlock when using NCM gadget
	USB: OHCI: Add quirk for LS7A OHCI controller (rev 0x02)
	usb: dwc3: gadget: check that event count does not exceed event buffer length
	usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive
	usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive
	USB: VLI disk crashes if LPM is used
	MIPS: cm: Detect CM quirks from device tree
	crypto: null - Use spin lock instead of mutex
	clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec()
	parisc: PDT: Fix missing prototype warning
	usb: host: max3421-hcd: Add missing spi_device_id table
	dmaengine: dmatest: Fix dmatest waiting less when interrupted
	usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev()
	qibfs: fix _another_ leak
	ntb: reduce stack usage in idt_scan_mws
	sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP
	KVM: s390: Don't use %pK through tracepoints
	udmabuf: fix a buf size overflow issue during udmabuf creation
	selftests: ublk: fix test_stripe_04
	ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls
	x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline
	scsi: pm80xx: Set phy_attached to zero when device is gone
	md/raid1: Add check for missing source disk in process_checks()
	comedi: jr3_pci: Fix synchronous deletion of timer
	crypto: atmel-sha204a - Set hwrng quality to lowest possible
	MIPS: cm: Fix warning if MIPS_CM is disabled
	Linux 5.4.293

Change-Id: I7bbba3d6632da8db1c4df982c20fd1ca01af68aa
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-05-05 12:47:34 +00:00
Greg Kroah-Hartman
2c8115e475 Linux 5.4.293
Link: https://lore.kernel.org/r/20250429161049.383278312@linuxfoundation.org
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Alok Tiwari <alok.a.tiwari@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-05-02 07:39:30 +02:00
Nathan Chancellor
ff55c867b6 kbuild: Add '-fno-builtin-wcslen'
commit 84ffc79bfbf70c779e60218563f2f3ad45288671 upstream.

A recent optimization change in LLVM [1] aims to transform certain loop
idioms into calls to strlen() or wcslen(). This change transforms the
first while loop in UniStrcat() into a call to wcslen(), breaking the
build when UniStrcat() gets inlined into alloc_path_with_tree_prefix():

  ld.lld: error: undefined symbol: wcslen
  >>> referenced by nls_ucs2_utils.h:54 (fs/smb/client/../../nls/nls_ucs2_utils.h:54)
  >>>               vmlinux.o:(alloc_path_with_tree_prefix)
  >>> referenced by nls_ucs2_utils.h:54 (fs/smb/client/../../nls/nls_ucs2_utils.h:54)
  >>>               vmlinux.o:(alloc_path_with_tree_prefix)

Disable this optimization with '-fno-builtin-wcslen', which prevents the
compiler from assuming that wcslen() is available in the kernel's C
library.

[ More to the point - it's not that we couldn't implement wcslen(), it's
  that this isn't an optimization at all in the context of the kernel.

  Replacing a simple inlined loop with a function call to the same loop
  is just stupid and pointless if you don't have long strings and fancy
  libraries with vectorization support etc.

  For the regular 'strlen()' cases, we want the compiler to do this in
  order to handle the trivial case of constant strings. And we do have
  optimized versions of 'strlen()' on some architectures. But for
  wcslen? Just no.    - Linus ]

Cc: stable@vger.kernel.org
Link: 9694844d7e [1]
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[nathan: Resolve small conflict in older trees]
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-05-02 07:39:22 +02:00
Tommy Webb
3b5fdef6b4 Merge tag 'ASB-2025-03-05_11-5.4' into android13-5.4-lahaina
https://source.android.com/docs/security/bulletin/2025-03-01
CVE-2024-46852
CVE-2024-50302
CVE-2025-22413

# By Greg Kroah-Hartman (7) and others
# Via Greg Kroah-Hartman (3) and Terence Tritton (xWF) (1)
* tag 'ASB-2025-03-05_11-5.4':
  ANDROID: ABI: Cuttlefish Symbol update
  Revert "net: net_namespace: Optimize the code"
  Revert "net: add exit_batch_rtnl() method"
  Revert "gtp: use exit_batch_rtnl() method"
  Revert "gtp: Use for_each_netdev_rcu() in gtp_genl_dump_pdp()."
  Revert "gtp: Destroy device along with udp socket's netns dismantle."
  Linux 5.4.290
  Partial revert of xhci: use pm_ptr() instead #ifdef for CONFIG_PM conditionals
  xhci: use pm_ptr() instead of #ifdef for CONFIG_PM conditionals
  drm/v3d: Assign job pointer to NULL before signaling the fence
  Input: xpad - add support for wooting two he (arm)
  Input: xpad - add unofficial Xbox 360 wireless receiver clone
  Input: atkbd - map F23 key to support default copilot shortcut
  Revert "usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null"
  USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb()
  ext4: fix slab-use-after-free in ext4_split_extent_at()
  ext4: avoid ext4_error()'s caused by ENOMEM in the truncate path
  vfio/platform: check the bounds of read/write syscalls
  net/xen-netback: prevent UAF in xenvif_flush_hash()
  net: xen-netback: hash.c: Use built-in RCU list checking
  signal/m68k: Use force_sigsegv(SIGSEGV) in fpsp040_die
  m68k: Add missing mmap_read_lock() to sys_cacheflush()
  m68k: Update ->thread.esp0 before calling syscall_trace() in ret_from_signal
  gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag
  irqchip/sunxi-nmi: Add missing SKIP_WAKE flag
  scsi: iscsi: Fix redundant response for ISCSI_UEVENT_GET_HOST_STATS request
  ASoC: wm8994: Add depends on MFD core
  net: fix data-races around sk->sk_forward_alloc
  scsi: sg: Fix slab-use-after-free read in sg_release()
  ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev()
  hrtimers: Handle CPU state correctly on hotplug
  irqchip/gic-v3: Handle CPU_PM_ENTER_FAILED correctly
  fs/proc: fix softlockup in __read_vmcore (part 2)
  net: ethernet: xgbe: re-add aneg to supported features in PHY quirks
  nvmet: propagate npwg topology
  poll_wait: add mb() to fix theoretical race between waitqueue_active() and .poll()
  kheaders: Ignore silly-rename files
  hfs: Sanity check the root record
  mac802154: check local interfaces before deleting sdata list
  i2c: mux: demux-pinctrl: check initial mux selection, too
  drm/v3d: Ensure job pointer is set to NULL after job completion
  nfp: bpf: prevent integer overflow in nfp_bpf_event_output()
  gtp: Destroy device along with udp socket's netns dismantle.
  gtp: Use for_each_netdev_rcu() in gtp_genl_dump_pdp().
  gtp: use exit_batch_rtnl() method
  net: add exit_batch_rtnl() method
  net: net_namespace: Optimize the code
  net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()
  sctp: sysctl: rto_min/max: avoid using current->nsproxy
  ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
  ocfs2: correct return value of ocfs2_local_free_info()
  phy: core: Fix that API devm_of_phy_provider_unregister() fails to unregister the phy provider
  phy: core: fix code style in devm_of_phy_provider_unregister
  arm64: dts: rockchip: add hevc power domain clock to rk3328
  arm64: dts: rockchip: add #power-domain-cells to power domain nodes
  arm64: dts: rockchip: fix pd_tcpc0 and pd_tcpc1 node position on rk3399
  arm64: dts: rockchip: fix defines in pd_vio node for rk3399
  iio: inkern: call iio_device_put() only on mapped devices
  iio: adc: at91: call input_free_device() on allocated iio_dev
  iio: adc: ti-ads124s08: Use gpiod_set_value_cansleep()
  iio: gyro: fxas21002c: Fix missing data update in trigger handler
  iio: adc: ti-ads8688: fix information leak in triggered buffer
  iio: imu: kmx61: fix information leak in triggered buffer
  iio: light: vcnl4035: fix information leak in triggered buffer
  iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer
  iio: pressure: zpa2326: fix information leak in triggered buffer
  usb: gadget: f_fs: Remove WARN_ON in functionfs_bind
  usb: fix reference leak in usb_new_device()
  USB: core: Disable LPM only for non-suspended ports
  USB: usblp: return error when setting unsupported protocol
  usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null
  USB: serial: cp210x: add Phoenix Contact UPS Device
  usb-storage: Add max sectors quirk for Nokia 208
  staging: iio: ad9832: Correct phase range check
  staging: iio: ad9834: Correct phase range check
  USB: serial: option: add Neoway N723-EA support
  USB: serial: option: add MeiG Smart SRM815
  drm/amd/display: increase MAX_SURFACES to the value supported by hw
  ACPI: resource: Add Asus Vivobook X1504VAP to irq1_level_low_skip_override[]
  ACPI: resource: Add TongFang GM5HG0A to irq1_edge_low_force_override[]
  drm/amd/display: Add check for granularity in dml ceil/floor helpers
  sctp: sysctl: auth_enable: avoid using current->nsproxy
  sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy
  dm thin: make get_first_thin use rcu-safe list first function
  tls: Fix tls_sw_sendmsg error handling
  net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute
  tcp/dccp: allow a connection when sk_max_ack_backlog is zero
  tcp/dccp: complete lockless accesses to sk->sk_max_ack_backlog
  net: 802: LLC+SNAP OID:PID lookup on start of skb data
  ieee802154: ca8210: Add missing check for kfifo_alloc() in ca8210_probe()
  dm array: fix cursor index when skipping across block boundaries
  dm array: fix unreleased btree blocks on closing a faulty array cursor
  dm array: fix releasing a faulty array block twice in dm_array_cursor_end
  jbd2: flush filesystem device before updating tail sequence

Change-Id: I83cf20e29c63126cd17dfa393dca0ce7dfa47a76
2025-04-12 09:31:28 +00:00
Greg Kroah-Hartman
9b78f083cb This is the 5.4.292 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmf3uc8ACgkQONu9yGCS
 aT7cOA/+IMZpVcP8BeutEqLl9O0SXf4QS9LT8u/eQKy3b26p8otQXOkElhGmchBv
 cvb7+ZuJQGUcjfhW0CsHGx/vKfDz3qbbLaXH/F0sRvZxkYApX35pkSDOtcE3jAHn
 klQejHzoFlom8d951VUpQukwGXPoVfPExdXMWNg4RCrn1pcDnb3JjmEyhDRu5Sna
 fA1JeQ54UReNPUnXOHyixy+xoOLGBdikqVzV8SIqKNuzBloXIbSA831BGocFffrW
 xng8XIemuCEuK552/Ex8AJfUiY/q6XGH2OYy46g4oEG85xoyseGlQJqsnziOxDGX
 VYbdYGmtTZB7Tv2fwjpKsyluexoQEXmxVbu8CuGn/X0B1d48tRl40ROBMoAnOOhZ
 j7gjZG9TK9G7+fQSEpS8bLwknRndQWlbxSRMVEGAqIDcxF09+Hkkycu82siCtKz2
 JYQnKsv7We/m7EI+3uAh50zZrLU6NL+wVnkGlQy17RTQYYshZpSs6GYvB4OjJ5vx
 OXovZA2IKDnWA336viL265etHsUf2agNIyWiMr/5Tp4RgirN2WSQubZjNhp/FdjR
 e3MxVPrUxBD/QyGs2KuZo/rA/SuYDtMxdoogrYQO1cbpvBCcsyYvnczhAUcjVgKq
 C+iGTOAs+EEHWYol/CWuOJAkG/0O7Uj2U+cDdQQgeKD9SCSzohA=
 =wRcs
 -----END PGP SIGNATURE-----

Merge 5.4.292 into android11-5.4-lts

Changes in 5.4.292
	vlan: fix memory leak in vlan_newlink()
	clockevents/drivers/i8253: Fix stop sequence for timer 0
	sched/isolation: Prevent boot crash when the boot CPU is nohz_full
	Revert "sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy"
	Revert "sctp: sysctl: auth_enable: avoid using current->nsproxy"
	sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy
	sctp: sysctl: auth_enable: avoid using current->nsproxy
	pinctrl: bcm281xx: Fix incorrect regmap max_registers value
	netpoll: Fix use correct return type for ndo_start_xmit()
	netpoll: remove dev argument from netpoll_send_skb_on_dev()
	netpoll: move netpoll_send_skb() out of line
	netpoll: netpoll_send_skb() returns transmit status
	netpoll: hold rcu read lock in __netpoll_send_skb()
	drivers/hv: Replace binary semaphore with mutex
	Drivers: hv: vmbus: Don't release fb_mmio resource in vmbus_free_mmio()
	netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree()
	ipvs: prevent integer overflow in do_ip_vs_get_ctl()
	net_sched: Prevent creation of classes with TC_H_ROOT
	netfilter: nft_exthdr: fix offset with ipv4_find_option()
	net/mlx5e: Prevent bridge link show failure for non-eswitch-allowed devices
	nvme-fc: go straight to connecting state when initializing
	hrtimers: Mark is_migration_base() with __always_inline
	powercap: call put_device() on an error path in powercap_register_control_type()
	iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
	scsi: qla1280: Fix kernel oops when debug level > 2
	ACPI: resource: IRQ override for Eluktronics MECH-17
	HID: intel-ish-hid: fix the length of MNG_SYNC_FW_CLOCK in doorbell
	HID: ignore non-functional sensor in HP 5MP Camera
	s390/cio: Fix CHPID "configure" attribute caching
	ASoC: rsnd: don't indicate warning on rsnd_kctrl_accept_runtime()
	nvmet-rdma: recheck queue state is LIVE in state lock in recv done
	sctp: Fix undefined behavior in left shift operation
	nvme: only allow entering LIVE from CONNECTING state
	fuse: don't truncate cached, mutated symlink
	x86/irq: Define trace events conditionally
	drm/nouveau: Do not override forced connector status
	block: fix 'kmem_cache of name 'bio-108' already exists'
	USB: serial: ftdi_sio: add support for Altera USB Blaster 3
	USB: serial: option: add Telit Cinterion FE990B compositions
	USB: serial: option: fix Telit Cinterion FE990A name
	USB: serial: option: match on interface class for Telit FN990B
	x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes
	drm/atomic: Filter out redundant DPMS calls
	drm/amd/display: Assign normalized_pix_clk when color depth = 14
	qlcnic: fix memory leak issues in qlcnic_sriov_common.c
	drm/gma500: Add NULL check for pci_gfx_root in mid_get_vbt_data()
	ASoC: codecs: wm0010: Fix error handling path in wm0010_spi_probe()
	i2c: ali1535: Fix an error handling path in ali1535_probe()
	i2c: ali15x3: Fix an error handling path in ali15x3_probe()
	i2c: sis630: Fix an error handling path in sis630_probe()
	firmware: imx-scu: fix OF node leak in .probe()
	xfrm_output: Force software GSO only in tunnel mode
	RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path
	RDMA/hns: Fix wrong value of max_sge_rd
	Bluetooth: Fix error code in chan_alloc_skb_cb()
	ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw().
	ipv6: Set errno after ip_fib_metrics_init() in ip6_route_info_create().
	net: atm: fix use after free in lec_send()
	net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES
	i2c: omap: fix IRQ storms
	drm/v3d: Don't run jobs that have errors flagged in its fence
	mmc: atmel-mci: Add missing clk_disable_unprepare()
	ARM: shmobile: smp: Enforce shmobile_smp_* alignment
	batman-adv: Ignore own maximum aggregation size during RX
	drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()
	ALSA: usb-audio: Add quirk for Plantronics headsets to fix control names
	HID: hid-plantronics: Add mic mute mapping and generalize quirks
	atm: Fix NULL pointer dereference
	ARM: 9350/1: fault: Implement copy_from_kernel_nofault_allowed()
	ARM: 9351/1: fault: Add "cut here" line for prefetch aborts
	ARM: Remove address checking for MMUless devices
	netfilter: socket: Lookup orig tuple for IPv6 SNAT
	counter: stm32-lptimer-cnt: fix error handling when enabling
	tty: serial: 8250: Add some more device IDs
	net: usb: qmi_wwan: add Telit Cinterion FN990B composition
	net: usb: qmi_wwan: add Telit Cinterion FE990B composition
	net: usb: usbnet: restore usb%d name exception for local mac addresses
	memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove
	serial: 8250_dma: terminate correct DMA in tx_dma_flush()
	x86/mm/pat: cpa-test: fix length for CPA_ARRAY test
	cpufreq: governor: Fix negative 'idle_time' handling in dbs_update()
	x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct()
	x86/platform: Only allow CONFIG_EISA for 32-bit
	selinux: Chain up tool resolving errors in install_policy.sh
	EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer
	EDAC/ie31200: Fix the DIMM size mask for several SoCs
	EDAC/ie31200: Fix the error path order of ie31200_init()
	thermal: int340x: Add NULL check for adev
	PM: sleep: Fix handling devices with direct_complete set on errors
	lockdep: Don't disable interrupts on RT in disable_irq_nosync_lockdep.*()
	perf/ring_buffer: Allow the EPOLLRDNORM flag for poll
	ALSA: hda/realtek: Always honor no_shutup_pins
	drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member
	PCI/ASPM: Fix link state exit during switch upstream function removal
	PCI/portdrv: Only disable pciehp interrupts early when needed
	PCI: Remove stray put_device() in pci_register_host_bridge()
	PCI: pciehp: Don't enable HPIE when resuming in poll mode
	fbdev: au1100fb: Move a variable assignment behind a null pointer check
	mdacon: rework dependency list
	fbdev: sm501fb: Add some geometry checks.
	clk: amlogic: gxbb: drop incorrect flag on 32k clock
	bpf: Use preempt_count() directly in bpf_send_signal_common()
	lib: 842: Improve error handling in sw842_compress()
	pinctrl: renesas: rza2: Fix missing of_node_put() call
	clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent
	IB/mad: Check available slots before posting receive WRs
	clk: amlogic: g12b: fix cluster A parent data
	clk: amlogic: gxbb: drop non existing 32k clock parent
	clk: amlogic: g12a: fix mmc A peripheral clock
	x86/entry: Fix ORC unwinder for PUSH_REGS with save_ret=1
	power: supply: max77693: Fix wrong conversion of charge input threshold value
	RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow
	mfd: sm501: Switch to BIT() to mitigate integer overflows
	x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment
	isofs: fix KMSAN uninit-value bug in do_isofs_readdir()
	coresight: catu: Fix number of pages while using 64k pages
	iio: accel: mma8452: Ensure error return on failure to matching oversampling ratio
	perf units: Fix insufficient array space
	kexec: initialize ELF lowest address to ULONG_MAX
	ocfs2: validate l_tree_depth to avoid out-of-bounds access
	perf python: Fixup description of sample.id event member
	perf python: Decrement the refcount of just created event on failure
	perf python: Check if there is space to copy all the event
	fs/procfs: fix the comment above proc_pid_wchan()
	objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds()
	ring-buffer: Fix bytes_dropped calculation issue
	octeontx2-af: Fix mbox INTR handler when num VFs > 64
	sched/smt: Always inline sched_smt_active()
	wifi: iwlwifi: fw: allocate chained SG tables for dump
	affs: generate OFS sequence numbers starting at 1
	affs: don't write overlarge OFS data block size fields
	sched/deadline: Use online cpus for validating runtime
	locking/semaphore: Use wake_q to wake up processes outside lock critical section
	can: statistics: use atomic access in hot path
	hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9}
	spufs: fix a leak on spufs_new_file() failure
	spufs: fix a leak in spufs_create_context()
	ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans
	ntb: intel: Fix using link status DB's
	netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets
	net_sched: skbprio: Remove overly strict queue assertions
	vsock: avoid timeout during connect() if the socket is closing
	ipv6: fix omitted netlink attributes when using RTEXT_FILTER_SKIP_STATS
	net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on destroy
	arcnet: Add NULL check in com20020pci_probe()
	can: flexcan: only change CAN state when link up in system PM
	ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk()
	x86/tsc: Always save/restore TSC sched_clock() on suspend/resume
	x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs
	ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP
	mmc: sdhci-pxav3: set NEED_RSP_BUSY capability
	tracing: Fix use-after-free in print_graph_function_flags during tracer switching
	jfs: fix slab-out-of-bounds read in ea_get()
	jfs: add index corruption check to DT_GETPAGE()
	Linux 5.4.292

Change-Id: I9386a675acdf4384f0d612b6fc80c59bd6bb739f
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-04-11 08:16:05 +00:00
Greg Kroah-Hartman
1b01d9c341 Linux 5.4.292
Link: https://lore.kernel.org/r/20250408104815.295196624@linuxfoundation.org
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Alok Tiwari <alok.a.tiwari@oracle.com>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-04-10 14:29:43 +02:00
Greg Kroah-Hartman
d6a7c6fab0 This is the 5.4.291 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmfSxSAACgkQONu9yGCS
 aT4xFxAAlZPsz8ZaSZdkyMSpr9lnz1P7Z/ONSc4f2j9dURdLz+HfP1jwQHRzK/jd
 JDtO9c9eg77/3UjKIyszTeHlaPbyA5bKsNF2zE+UjonSXzRNvsASmZW7Wee770Rf
 Yt6ZOn2tbDPwRfEsUILhKugNHkoZABSDUj+3FCbPQm5XzaTNeB0ofjWaRxbop5qv
 +GJnaFKwtu9yOWRIvRCQ5tE9zxW39xt767uuOBmsN1C6YECx5SAtgXXPQrpjCJEL
 TY09ATSAqbTjxdHDsQGBL1oe2XEXHJmD4hBKY/FysXuq2i+oFxXEavk7Eq6dR34M
 CoDKbeMXyTL3XnZ6iOzcqsyB/9hWHqRqvkqJI7fOqeJUWydRy7xy3Arf93M3Occ1
 nGyJ1k51Wl19TaOE9G4hjWtBwBVx0rPtMIBOuWwBU1KP13R3pbPvUU41GKTEtw78
 7ruTFycqRbU3uxYUoyV/XEUqLoWEuPyGk6DRCZy8rls0jLXnRzeKLJ6FxfhwBbrP
 B/NHcI6yUGwxpIPhwFJxwy+H/0eprxxBKrqldJBK3NkI1IyB2azldHWmdMdJKUiO
 e7Gxqi2SFOyjTRYb2GSgD25nQMbXyarwyS3vQxDb8XCDuZw2KJCBoD6OCTbtEeMZ
 pytJMQrM/GM6+tlqAWZqMZaNwStA4FnJzBL17fLmoTIWEpdmy0o=
 =LuVk
 -----END PGP SIGNATURE-----

Merge 5.4.291 into android11-5.4-lts

Changes in 5.4.291
	perf cs-etm: Add missing variable in cs_etm__process_queues()
	udf: Fix use of check_add_overflow() with mixed type arguments
	overflow: Add __must_check attribute to check_*() helpers
	overflow: Correct check_shl_overflow() comment
	overflow: Allow mixed type arguments
	afs: Fix directory format encoding struct
	nbd: don't allow reconnect after disconnect
	partitions: ldm: remove the initial kernel-doc notation
	drm/etnaviv: Fix page property being used for non writecombine buffers
	drm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_range_table
	ipmi: ipmb: Add check devm_kasprintf() returned value
	wifi: rtlwifi: do not complete firmware loading needlessly
	rtlwifi: rtl8192se Rename RT_TRACE to rtl_dbg
	wifi: rtlwifi: rtl8192se: rise completion of firmware loading as last step
	wifi: rtlwifi: usb: fix workqueue leak when probe fails
	dt-bindings: mmc: controller: clarify the address-cells description
	rtlwifi: replace usage of found with dedicated list iterator variable
	wifi: rtlwifi: remove unused timer and related code
	wifi: rtlwifi: remove unused dualmac control leftovers
	wifi: rtlwifi: remove unused check_buddy_priv
	wifi: rtlwifi: fix memory leaks and invalid access at probe error path
	wifi: rtlwifi: pci: wait for firmware loading before releasing memory
	cpupower: fix TSC MHz calculation
	team: prevent adding a device which is already a team device lower
	regulator: of: Implement the unwind path of of_regulator_match()
	wifi: wlcore: fix unbalanced pm_runtime calls
	selftests/harness: Display signed values correctly
	selftests: harness: fix printing of mismatch values in __EXPECT()
	clk: analogbits: Fix incorrect calculation of vco rate delta
	net: let net.core.dev_weight always be non-zero
	net/mlxfw: Drop hard coded max FW flash image size
	net: sched: Disallow replacing of child qdisc from one parent to another
	tools/testing/selftests/bpf/test_tc_tunnel.sh: Fix wait for server bind
	ASoC: sun4i-spdif: Add clock multiplier settings
	perf header: Fix one memory leakage in process_bpf_btf()
	perf header: Fix one memory leakage in process_bpf_prog_info()
	ktest.pl: Remove unused declarations in run_bisect_test function
	padata: fix sysfs store callback check
	perf top: Don't complain about lack of vmlinux when not resolving some kernel samples
	perf report: Fix misleading help message about --demangle
	bpf: Send signals asynchronously if !preemptible
	RDMA/mlx4: Avoid false error about access to uninitialized gids array
	rdma/cxgb4: Prevent potential integer overflow on 32bit
	arm64: dts: mediatek: mt8173-evb: Drop regulator-compatible property
	arm64: dts: mediatek: mt8173-evb: Fix MT6397 PMIC sub-node names
	ARM: dts: mediatek: mt7623: fix IR nodename
	fbdev: omapfb: Fix an OF node leak in dss_of_port_get_parent_device()
	media: rc: iguanair: handle timeouts
	media: lmedm04: Use GFP_KERNEL for URB allocation/submission.
	media: lmedm04: Handle errors for lme2510_int_read
	PCI: endpoint: Destroy the EPC device in devm_pci_epc_destroy()
	media: mipi-csis: Add check for clk_enable()
	media: camif-core: Add check for clk_enable()
	media: uvcvideo: Propagate buf->error to userspace
	staging: media: imx: fix OF node leak in imx_media_add_of_subdevs()
	scsi: mpt3sas: Set ioc->manu_pg11.EEDPTagMode directly to 1
	scsi: ufs: bsg: Delete bsg_dev when setting up bsg fails
	ocfs2: mark dquot as inactive if failed to start trans while releasing dquot
	module: Extend the preempt disabled section in dereference_symbol_descriptor().
	dmaengine: ti: edma: fix OF node reference leaks in edma_driver
	rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read
	ubifs: skip dumping tnc tree when zroot is null
	net: fec: implement TSO descriptor cleanup
	ipmr: do not call mr_mfc_uses_dev() for unres entries
	PM: hibernate: Add error handling for syscore_suspend()
	net: rose: fix timer races against user threads
	net: davicom: fix UAF in dm9000_drv_remove
	perf trace: Fix runtime error of index out of bounds
	vsock: Allow retrying on connect() failure
	net: sh_eth: Fix missing rtnl lock in suspend/resume path
	genksyms: fix memory leak when the same symbol is added from source
	genksyms: fix memory leak when the same symbol is read from *.symref file
	hexagon: fix using plain integer as NULL pointer warning in cmpxchg
	hexagon: Fix unbalanced spinlock in die()
	NFSD: Reset cb_seq_status after NFS4ERR_DELAY
	ktest.pl: Check kernelrelease return in get_version
	drivers/card_reader/rtsx_usb: Restore interrupt based detection
	usb: typec: tcpm: set SRC_SEND_CAPABILITIES timeout to PD_T_SENDER_RESPONSE
	HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections
	media: uvcvideo: Fix double free in error path
	usb: gadget: f_tcm: Don't free command immediately
	btrfs: output the reason for open_ctree() failure
	btrfs: fix use-after-free when attempting to join an aborted transaction
	btrfs: convert BUG_ON in btrfs_reloc_cow_block() to proper error handling
	sched: Don't try to catch up excess steal time.
	x86/amd_nb: Restrict init function to AMD-based systems
	printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX
	tun: fix group permission check
	mmc: core: Respect quirk_max_rate for non-UHS SDIO card
	wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy()
	tomoyo: don't emit warning in tomoyo_write_control()
	mfd: lpc_ich: Add another Gemini Lake ISA bridge PCI device-id
	HID: Wacom: Add PCI Wacom device support
	APEI: GHES: Have GHES honor the panic= setting
	x86/mm: Don't disable PCID when INVLPG has been fixed by microcode
	spi-mxs: Fix chipselect glitch
	nilfs2: move page release outside of nilfs_delete_entry and nilfs_set_link
	nilfs2: eliminate staggered calls to kunmap in nilfs_rename
	nilfs2: handle errors that nilfs_prepare_chunk() may return
	media: uvcvideo: Only save async fh if success
	media: uvcvideo: Remove dangling pointers
	sched: sch_cake: add bounds checks to host bulk flow fairness counts
	kbuild: userprogs: use correct lld when linking through clang
	tasklet: Introduce new initialization API
	net: usb: rtl8150: use new tasklet API
	net: usb: rtl8150: enable basic endpoint checking
	usb: xhci: Add timeout argument in address_device USB HCD callback
	usb: xhci: Fix NULL pointer dereference on certain command aborts
	nvme: handle connectivity loss in nvme_set_queue_count
	firmware: iscsi_ibft: fix ISCSI_IBFT Kconfig entry
	gpu: drm_dp_cec: fix broken CEC adapter properties check
	tg3: Disable tg3 PCIe AER on system reboot
	udp: gso: do not drop small packets when PMTU reduces
	net: rose: lock the socket in rose_bind()
	netem: Update sch->q.qlen before qdisc_tree_reduce_backlog()
	tun: revert fix group permission check
	cpufreq: s3c64xx: Fix compilation warning
	leds: lp8860: Write full EEPROM, not only half of it
	s390/futex: Fix FUTEX_OP_ANDN implementation
	m68k: vga: Fix I/O defines
	binfmt_flat: Fix integer overflow bug on 32 bit systems
	arm64: dts: rockchip: increase gmac rx_delay on rk3399-puma
	KVM: Explicitly verify target vCPU is online in kvm_get_vcpu()
	KVM: s390: vsie: fix some corner-cases when grabbing vsie pages
	drm/komeda: Add check for komeda_get_layer_fourcc_list()
	Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc
	clk: qcom: clk-alpha-pll: fix alpha mode configuration
	clk: qcom: clk-rpmh: prevent integer overflow in recalc_rate
	perf bench: Fix undefined behavior in cmpworker()
	of: Correct child specifier used as input of the 2nd nexus node
	of: Fix of_find_node_opts_by_path() handling of alias+path+options
	of: reserved-memory: Fix using wrong number of cells to get property 'alignment'
	HID: hid-sensor-hub: don't use stale platform-data on remove
	wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize()
	usb: gadget: f_tcm: Translate error to sense
	usb: gadget: f_tcm: Decrement command ref count on cleanup
	usb: gadget: f_tcm: ep_autoconfig with fullspeed endpoint
	usb: gadget: f_tcm: Don't prepare BOT write request twice
	soc: qcom: socinfo: Avoid out of bounds read of serial number
	serial: sh-sci: Drop __initdata macro for port_cfg
	serial: sh-sci: Do not probe the serial port if its slot in sci_ports[] is in use
	powerpc/pseries/eeh: Fix get PE state translation
	kbuild: Move -Wenum-enum-conversion to W=2
	soc: qcom: smem_state: fix missing of_node_put in error path
	media: ov5640: fix get_light_freq on auto
	media: uvcvideo: Fix event flags in uvc_ctrl_send_events
	media: uvcvideo: Remove redundant NULL assignment
	crypto: qce - fix goto jump in error path
	crypto: qce - unregister previously registered algos in error path
	nvmem: core: improve range check for nvmem_cell_write()
	vfio/platform: check the bounds of read/write syscalls
	ocfs2: fix incorrect CPU endianness conversion causing mount failure
	ocfs2: handle a symlink read error correctly
	nilfs2: fix possible int overflows in nilfs_fiemap()
	NFC: nci: Add bounds checking in nci_hci_create_pipe()
	mtd: onenand: Fix uninitialized retlen in do_otp_read()
	misc: fastrpc: Fix registered buffer page address
	net/ncsi: wait for the last response to Deselect Package before configuring channel
	ptp: Ensure info->enable callback is always set
	MIPS: ftrace: Declare ftrace_get_parent_ra_addr() as static
	ocfs2: check dir i_size in ocfs2_find_entry
	HID: multitouch: Add NULL check in mt_input_configured
	ndisc: ndisc_send_redirect() must use dev_get_by_index_rcu()
	vrf: use RCU protection in l3mdev_l3_out()
	team: better TEAM_OPTION_TYPE_STRING validation
	arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
	gpio: bcm-kona: Fix GPIO lock/unlock for banks above bank 0
	gpio: bcm-kona: Make sure GPIO bits are unlocked when requesting IRQ
	gpio: bcm-kona: Add missing newline to dev_err format string
	xen: remove a confusing comment on auto-translated guest I/O
	x86/xen: allow larger contiguous memory regions in PV guests
	media: cxd2841er: fix 64-bit division on gcc-9
	vfio/pci: Enable iowrite64 and ioread64 for vfio pci
	Grab mm lock before grabbing pt lock
	orangefs: fix a oob in orangefs_debug_write
	ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet 5V
	batman-adv: fix panic during interface removal
	usb: roles: set switch registered flag early on
	usb: gadget: udc: renesas_usb3: Fix compiler warning
	usb: dwc2: gadget: remove of_node reference upon udc_stop
	USB: pci-quirks: Fix HCCPARAMS register error for LS7A EHCI
	USB: quirks: add USB_QUIRK_NO_LPM quirk for Teclast dist
	USB: Add USB_QUIRK_NO_LPM quirk for sony xperia xz1 smartphone
	usb: gadget: f_midi: fix MIDI Streaming descriptor lengths
	USB: hub: Ignore non-compliant devices with too many configs or interfaces
	USB: cdc-acm: Fill in Renesas R-Car D3 USB Download mode quirk
	usb: cdc-acm: Check control transfer buffer size before access
	usb: cdc-acm: Fix handling of oversized fragments
	USB: serial: option: add MeiG Smart SLM828
	USB: serial: option: add Telit Cinterion FN990B compositions
	USB: serial: option: fix Telit Cinterion FN990A name
	USB: serial: option: drop MeiG Smart defines
	can: c_can: fix unbalanced runtime PM disable in error path
	can: j1939: j1939_sk_send_loop(): fix unable to send messages with data length zero
	alpha: make stack 16-byte aligned (most cases)
	serial: 8250: Fix fifo underflow on flush
	alpha: align stack for page fault and user unaligned trap handlers
	gpio: stmpe: Check return value of stmpe_reg_read in stmpe_gpio_irq_sync_unlock
	partitions: mac: fix handling of bogus partition table
	regmap-irq: Add missing kfree()
	net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu()
	net: add dev_net_rcu() helper
	ipv4: use RCU protection in rt_is_expired()
	ipv4: use RCU protection in inet_select_addr()
	ipv6: use RCU protection in ip6_default_advmss()
	ndisc: use RCU protection in ndisc_alloc_skb()
	neighbour: delete redundant judgment statements
	neighbour: use RCU protection in __neigh_notify()
	arp: use RCU protection in arp_xmit()
	openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
	ndisc: extend RCU protection in ndisc_send_skb()
	alpha: replace hardcoded stack offsets with autogenerated ones
	nilfs2: do not output warnings when clearing dirty buffers
	nilfs2: do not force clear folio if buffer is referenced
	nilfs2: protect access to buffers with no active references
	can: ems_pci: move ASIX AX99100 ids to pci_ids.h
	serial: 8250_pci: add support for ASIX AX99100
	parport_pc: add support for ASIX AX99100
	x86/i8253: Disable PIT timer 0 when not in use
	Revert "btrfs: avoid monopolizing a core when activating a swap file"
	btrfs: avoid monopolizing a core when activating a swap file
	pps: Fix a use-after-free
	ima: Fix use-after-free on a dentry's dname.name
	vlan: introduce vlan_dev_free_egress_priority
	vlan: move dev_put into vlan_dev_uninit
	scsi: storvsc: Set correct data length for sending SCSI command without payload
	driver core: bus: Fix double free in driver API bus_register()
	crypto: testmgr - fix wrong key length for pkcs1pad
	crypto: testmgr - Fix wrong test case of RSA
	crypto: testmgr - fix version number of RSA tests
	crypto: testmgr - populate RSA CRT parameters in RSA test vectors
	crypto: testmgr - some more fixes to RSA test vectors
	mm: update mark_victim tracepoints fields
	memcg: fix soft lockup in the OOM process
	usb: dwc3: Increase DWC3 controller halt timeout
	usb: dwc3: Fix timeout issue during controller enter/exit from halt state
	usb/gadget: f_midi: convert tasklets to use new tasklet_setup() API
	usb/gadget: f_midi: Replace tasklet with work
	USB: gadget: f_midi: f_midi_complete to call queue_work
	powerpc/64s/mm: Move __real_pte stubs into hash-4k.h
	powerpc/64s: Rewrite __real_pte() and __rpte_to_hidx() as static inline
	ALSA: hda/realtek - Add type for ALC287
	ALSA: hda/realtek: Fixup ALC225 depop procedure
	powerpc/code-patching: Fix KASAN hit by not flagging text patching area as VM_ALLOC
	geneve: Fix use-after-free in geneve_find_dev().
	gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl().
	geneve: Suppress list corruption splat in geneve_destroy_tunnels().
	net: extract port range fields from fl_flow_key
	flow_dissector: Fix handling of mixed port and port-range keys
	flow_dissector: Fix port range key handling in BPF conversion
	power: supply: da9150-fg: fix potential overflow
	tee: optee: Fix supplicant wait loop
	nfp: bpf: Add check for nfp_app_ctrl_msg_alloc()
	ALSA: hda/conexant: Add quirk for HP ProBook 450 G4 mute LED
	acct: block access to kernel internal filesystems
	batman-adv: Ignore neighbor throughput metrics in error case
	batman-adv: Drop unmanaged ELP metric worker
	sunrpc: suppress warnings for unused procfs functions
	net: loopback: Avoid sending IP packets without an Ethernet header
	net: cadence: macb: Synchronize stats calculations
	ASoC: es8328: fix route from DAC to output
	ipvs: Always clear ipvs_property flag in skb_scrub_packet()
	net: mvpp2: cls: Fixed Non IP flow, with vlan tag flow defination.
	x86/CPU: Fix warm boot hang regression on AMD SC1100 SoC systems
	ftrace: Avoid potential division by zero in function_stat_show()
	perf/core: Fix low freq setting via IOC_PERIOD
	usbnet: gl620a: fix endpoint checking in genelink_bind()
	phy: tegra: xusb: reset VBUS & ID OVERRIDE
	phy: exynos5-usbdrd: fix MPLL_MULTIPLIER and SSC_REFCLKSEL masks in refclk
	sched/core: Prevent rescheduling when interrupts are disabled
	pfifo_tail_enqueue: Drop new packet when sch->limit == 0
	drop_monitor: fix incorrect initialization order
	kernel/acct.c: use #elif instead of #end and #elif
	kernel/acct.c: use dedicated helper to access rlimit values
	acct: perform last write from workqueue
	drm/amdgpu: skip BAR resizing if the bios already did it
	drm/amdgpu: Check extended configuration space register when system uses large bar
	drm/amdgpu: disable BAR resize on Dell G5 SE
	Revert "of: reserved-memory: Fix using wrong number of cells to get property 'alignment'"
	HID: appleir: Fix potential NULL dereference at raw event handle
	ALSA: hda: intel: Add Dell ALC3271 to power_save denylist
	ALSA: hda/realtek: update ALC222 depop optimize
	drm/radeon: Fix rs400_gpu_init for ATI mobility radeon Xpress 200M
	platform/x86: thinkpad_acpi: Add battery quirk for ThinkPad X131e
	x86/cacheinfo: Validate CPUID leaf 0x2 EDX output
	x86/cpu: Validate CPUID leaf 0x2 EDX output
	x86/cpu: Properly parse CPUID leaf 0x2 TLB descriptor 0x63
	wifi: cfg80211: regulatory: improve invalid hints checking
	wifi: nl80211: reject cooked mode if it is set along with other flags
	rapidio: add check for rio_add_net() in rio_scan_alloc_net()
	rapidio: fix an API misues when rio_add_net() fails
	mm/page_alloc: fix uninitialized variable
	wifi: iwlwifi: limit printed string from FW file
	HID: google: fix unused variable warning under !CONFIG_ACPI
	HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove()
	net: gso: fix ownership in __udp_gso_segment
	caif_virtio: fix wrong pointer check in cfv_probe()
	hwmon: (pmbus) Initialise page count in pmbus_identify()
	hwmon: (ntc_thermistor) Fix the ncpXXxh103 sensor table
	hwmon: (ad7314) Validate leading zero bits and return error
	llc: do not use skb_get() before dev_queue_xmit()
	hwmon: fix a NULL vs IS_ERR_OR_NULL() check in xgene_hwmon_probe()
	drm/sched: Fix preprocessor guard
	be2net: fix sleeping while atomic bugs in be_ndo_bridge_getlink
	ppp: Fix KMSAN uninit-value warning with bpf
	vlan: enforce underlying device type
	net-timestamp: support TCP GSO case for a few missing flags
	net: ipv6: fix dst ref loop in ila lwtunnel
	net: ipv6: fix missing dst ref drop in ila lwtunnel
	gpio: rcar: Fix missing of_node_put() call
	Revert "drivers/card_reader/rtsx_usb: Restore interrupt based detection"
	usb: renesas_usbhs: Call clk_put()
	usb: renesas_usbhs: Use devm_usb_get_phy()
	usb: quirks: Add DELAY_INIT and NO_LPM for Prolific Mass Storage Card Reader
	usb: renesas_usbhs: Flush the notify_hotplug_work
	usb: atm: cxacru: fix a flaw in existing endpoint checks
	usb: typec: ucsi: increase timeout for PPM reset operations
	usb: typec: tcpci_rt1711h: Unmask alert interrupts to fix functionality
	usb: gadget: Set self-powered based on MaxPower and bmAttributes
	usb: gadget: Fix setting self-powered state on suspend
	usb: gadget: Check bmAttributes only if configuration is valid
	xhci: pci: Fix indentation in the PCI device ID definitions
	Squashfs: check the inode number is not the invalid value of zero
	intel_th: pci: Add Arrow Lake support
	intel_th: pci: Add Panther Lake-H support
	intel_th: pci: Add Panther Lake-P/U support
	slimbus: messaging: Free transaction ID in delayed interrupt scenario
	eeprom: digsy_mtc: Make GPIO lookup table match the device
	Linux 5.4.291

Change-Id: Ica7eab9e6472f50da32bd885ba09d09dbb450ef0
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-03-13 14:53:52 +00:00
Greg Kroah-Hartman
52bcf31d8e Linux 5.4.291
Link: https://lore.kernel.org/r/20250311145714.865727435@linuxfoundation.org
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Alok Tiwari <alok.a.tiwari@oracle.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-03-13 12:43:33 +01:00
Thomas Weißschuh
579fac0e5c kbuild: userprogs: use correct lld when linking through clang
commit dfc1b168a8c4b376fa222b27b97c2c4ad4b786e1 upstream.

The userprog infrastructure links objects files through $(CC).
Either explicitly by manually calling $(CC) on multiple object files or
implicitly by directly compiling a source file to an executable.
The documentation at Documentation/kbuild/llvm.rst indicates that ld.lld
would be used for linking if LLVM=1 is specified.
However clang instead will use either a globally installed cross linker
from $PATH called ${target}-ld or fall back to the system linker, which
probably does not support crosslinking.
For the normal kernel build this is not an issue because the linker is
always executed directly, without the compiler being involved.

Explicitly pass --ld-path to clang so $(LD) is respected.
As clang 13.0.1 is required to build the kernel, this option is available.

Fixes: 7f3a59db274c ("kbuild: add infrastructure to build userspace programs")
Cc: stable@vger.kernel.org # needs wrapping in $(cc-option) for < 6.9
Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
[nathan: use cc-option for 6.6 and older, as those trees support back to
         clang-11]
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-03-13 12:43:04 +01:00
Michael Bestas
b9715311a2
Merge tag 'ASB-2025-02-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
https://source.android.com/docs/security/bulletin/2025-02-01
CVE-2024-53104
CVE-2025-0088

* tag 'ASB-2025-02-05_11-5.4' of https://android.googlesource.com/kernel/common: (449 commits)
  ANDROID: gki - change networking configuration
  ANDROID: kernelci build-break for 64-bit riscv clang builds (5.4 only)
  Revert "BACKPORT: RISC-V: Stop relying on GCC's register allocator's hueristics"
  Revert "ANDROID: declare sp_in_global outside of CONFIG_FRAME_POINTER"
  ANDROID: GKI: add Trimble symbol list
  UPSTREAM: selinux: ignore unknown extended permissions
  ANDROID: ABI: Update allowed list for galaxy
  Revert "netfilter: Replace zero-length array with flexible-array member"
  Revert "tracing: Constify string literal data member in struct trace_event_call"
  Revert "skb_expand_head() adjust skb->truesize incorrectly"
  Linux 5.4.289
  ftrace: use preempt_enable/disable notrace macros to avoid double fault
  mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim()
  drm: adv7511: Drop dsi single lane support
  net/sctp: Prevent autoclose integer overflow in sctp_association_init()
  sky2: Add device ID 11ab:4373 for Marvell 88E8075
  pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking
  RDMA/uverbs: Prevent integer overflow issue
  modpost: fix the missed iteration for the max bit in do_input()
  modpost: fix input MODULE_DEVICE_TABLE() built for 64-bit on 32-bit host
  ...

 Conflicts:
	arch/arm64/boot/dts/vendor/bindings/clock/adi,axi-clkgen.yaml
	arch/arm64/boot/dts/vendor/bindings/clock/axi-clkgen.txt
	drivers/rpmsg/qcom_glink_native.c
	drivers/soc/qcom/socinfo.c

Change-Id: I60727e0cdd974fda5ca71f938bc2f984a8bbf19a
2025-02-06 22:53:05 +02:00
Greg Kroah-Hartman
21c9625b20 This is the 5.4.290 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmeeWAYACgkQONu9yGCS
 aT5t0A/9F4Ob6p83a3Q6ISc4enw9KoIyWrOV0yxmS5eXYdpQObnvyzJoTGX0HSF3
 eNNAeKNQtv7JIKovSTY42MAwt7oB/jA22x5riiINkfcaKtsUIq4lMMbhA36XqoqH
 G2uB57OcmOK9BSI7l5URYcd7D5SyclHe+4yaK27Fzo+5RbQQ+uxT1Xm+oJFsIEL9
 +Nj8Y65OaYuSiK1//wpR/D4aqGBnykkeeXb+NwuwO21+6L0cC/xKubZvnv7C6Ahu
 jg96E7cu0w3sjRGOaQEomtV/ADMtZEHHFvNz1yq26w6pMxv1FhLcS1uTiQ0IU7y5
 MX0XG6T8/ppIoZCBw2lzEJwcwMozPnEtpjev1LUPRQtgoBF015sg1xSHQlADmc/r
 NVZr3dQVu71vNf8n9Z7nvZMsGykAAVaeeRCgAkCOwFkEraJZ/DIF+0fNLogYzQ/t
 wWmbnJt2a6KWVFGrYpSTmpsndjFvFQoRyrtuRP0QWvmEUd6Ll2od+OCopJTCLcRc
 gcBWi09IOi/y/Bsf0TcYfX+0jWAnc+J8M274T/ZkKSDyfixxoi+ie98+Ym5mmzcE
 mR7go6dzE8tA8HkXshxJ41fctaSxFO/mp5qb+IZ0vTquIJOeqtXdnX3Cgajx6olT
 8WeOu7S/pXw8xpdrgBKE3iKjjDfPgY+8roJC69yFdjYxRQg7nfc=
 =GVLF
 -----END PGP SIGNATURE-----

Merge 5.4.290 into android11-5.4-lts

Changes in 5.4.290
	jbd2: flush filesystem device before updating tail sequence
	dm array: fix releasing a faulty array block twice in dm_array_cursor_end
	dm array: fix unreleased btree blocks on closing a faulty array cursor
	dm array: fix cursor index when skipping across block boundaries
	ieee802154: ca8210: Add missing check for kfifo_alloc() in ca8210_probe()
	net: 802: LLC+SNAP OID:PID lookup on start of skb data
	tcp/dccp: complete lockless accesses to sk->sk_max_ack_backlog
	tcp/dccp: allow a connection when sk_max_ack_backlog is zero
	net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute
	tls: Fix tls_sw_sendmsg error handling
	dm thin: make get_first_thin use rcu-safe list first function
	sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy
	sctp: sysctl: auth_enable: avoid using current->nsproxy
	drm/amd/display: Add check for granularity in dml ceil/floor helpers
	ACPI: resource: Add TongFang GM5HG0A to irq1_edge_low_force_override[]
	ACPI: resource: Add Asus Vivobook X1504VAP to irq1_level_low_skip_override[]
	drm/amd/display: increase MAX_SURFACES to the value supported by hw
	USB: serial: option: add MeiG Smart SRM815
	USB: serial: option: add Neoway N723-EA support
	staging: iio: ad9834: Correct phase range check
	staging: iio: ad9832: Correct phase range check
	usb-storage: Add max sectors quirk for Nokia 208
	USB: serial: cp210x: add Phoenix Contact UPS Device
	usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null
	USB: usblp: return error when setting unsupported protocol
	USB: core: Disable LPM only for non-suspended ports
	usb: fix reference leak in usb_new_device()
	usb: gadget: f_fs: Remove WARN_ON in functionfs_bind
	iio: pressure: zpa2326: fix information leak in triggered buffer
	iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer
	iio: light: vcnl4035: fix information leak in triggered buffer
	iio: imu: kmx61: fix information leak in triggered buffer
	iio: adc: ti-ads8688: fix information leak in triggered buffer
	iio: gyro: fxas21002c: Fix missing data update in trigger handler
	iio: adc: ti-ads124s08: Use gpiod_set_value_cansleep()
	iio: adc: at91: call input_free_device() on allocated iio_dev
	iio: inkern: call iio_device_put() only on mapped devices
	arm64: dts: rockchip: fix defines in pd_vio node for rk3399
	arm64: dts: rockchip: fix pd_tcpc0 and pd_tcpc1 node position on rk3399
	arm64: dts: rockchip: add #power-domain-cells to power domain nodes
	arm64: dts: rockchip: add hevc power domain clock to rk3328
	phy: core: fix code style in devm_of_phy_provider_unregister
	phy: core: Fix that API devm_of_phy_provider_unregister() fails to unregister the phy provider
	ocfs2: correct return value of ocfs2_local_free_info()
	ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
	sctp: sysctl: rto_min/max: avoid using current->nsproxy
	net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()
	net: net_namespace: Optimize the code
	net: add exit_batch_rtnl() method
	gtp: use exit_batch_rtnl() method
	gtp: Use for_each_netdev_rcu() in gtp_genl_dump_pdp().
	gtp: Destroy device along with udp socket's netns dismantle.
	nfp: bpf: prevent integer overflow in nfp_bpf_event_output()
	drm/v3d: Ensure job pointer is set to NULL after job completion
	i2c: mux: demux-pinctrl: check initial mux selection, too
	mac802154: check local interfaces before deleting sdata list
	hfs: Sanity check the root record
	kheaders: Ignore silly-rename files
	poll_wait: add mb() to fix theoretical race between waitqueue_active() and .poll()
	nvmet: propagate npwg topology
	net: ethernet: xgbe: re-add aneg to supported features in PHY quirks
	fs/proc: fix softlockup in __read_vmcore (part 2)
	irqchip/gic-v3: Handle CPU_PM_ENTER_FAILED correctly
	hrtimers: Handle CPU state correctly on hotplug
	ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev()
	scsi: sg: Fix slab-use-after-free read in sg_release()
	net: fix data-races around sk->sk_forward_alloc
	ASoC: wm8994: Add depends on MFD core
	scsi: iscsi: Fix redundant response for ISCSI_UEVENT_GET_HOST_STATS request
	irqchip/sunxi-nmi: Add missing SKIP_WAKE flag
	gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag
	m68k: Update ->thread.esp0 before calling syscall_trace() in ret_from_signal
	m68k: Add missing mmap_read_lock() to sys_cacheflush()
	signal/m68k: Use force_sigsegv(SIGSEGV) in fpsp040_die
	net: xen-netback: hash.c: Use built-in RCU list checking
	net/xen-netback: prevent UAF in xenvif_flush_hash()
	vfio/platform: check the bounds of read/write syscalls
	ext4: avoid ext4_error()'s caused by ENOMEM in the truncate path
	ext4: fix slab-use-after-free in ext4_split_extent_at()
	USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb()
	Revert "usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null"
	Input: atkbd - map F23 key to support default copilot shortcut
	Input: xpad - add unofficial Xbox 360 wireless receiver clone
	Input: xpad - add support for wooting two he (arm)
	drm/v3d: Assign job pointer to NULL before signaling the fence
	xhci: use pm_ptr() instead of #ifdef for CONFIG_PM conditionals
	Partial revert of xhci: use pm_ptr() instead #ifdef for CONFIG_PM conditionals
	Linux 5.4.290

Change-Id: Ie2e10bc16d6eb9da965c01168b2b8854e5dfaf8c
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-02-05 17:00:16 +00:00
Greg Kroah-Hartman
856a224845 Linux 5.4.290
Link: https://lore.kernel.org/r/20250130140133.662535583@linuxfoundation.org
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Link: https://lore.kernel.org/r/20250131112114.030356568@linuxfoundation.org
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: kernelci.org bot <bot@kernelci.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-02-01 18:18:54 +01:00