Currently, multiple listeners can register on same fd which
could lead to potential vulnerabilities of use after free
while unregistering the listener. Add check to prevent more
than one listener registration on a fd.
Change-Id: Ia2973853943b5619bcf2047629b9c193f6a8c5cf
Signed-off-by: Pawan Rai <quic_pawarai@quicinc.com>
Signed-off-by: Ravi Kumar Bokka <quic_c_rbokka@quicinc.com>
Boot KPI driver has a limitation to print a maximum of 73 KPI node
entries due to sysfs implementation limitation. To fix this issue
replace place_marker calls with update_marker in the required drivers.
Unlike place_maker API update_marker API will first remove the marker
and add it again. So, the marker comes at end of the table when we
cat /sys/kernel/bootkpi/kpi_values.
Change-Id: I3137e6909c17a3e8f3237c0bc4df62ee628d8e7e
Signed-off-by: Khaja Hussain Shaik Khaji <quic_kshaikkh@quicinc.com>
Continuation messages can carry a maximum payload of
HH_RM_MAX_MSG_SIZE_BYTES. When initializing a connection buffer for
reply sequences, the hdr_size is 4 bytes larger than the
HH_RM_MAX_MSG_SIZE_BYTES: see the difference between
struct hh_rm_rpc_hdr and struct hh_rm_rpc_reply_hdr.
Fix the calculation.
Change-Id: If7a1124f581c9d1da8f7749d0296e064e6499cdf
[eberman: Make change in hh_rm_core.c]
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
During panic, all cores and irq's will gets disable. So, it
is not recommended to request for a new resource during this time.
So, add a check to return from notifier call based on the device
runtime status.
Change-Id: Ie4fd526ad2d107008b4af13997534fb614ca507a
Signed-off-by: Pradeep P V K <quic_pragalla@quicinc.com>
Replace place_marker with update_marker api to capture
suspend resume kpi of USB.
Change-Id: Ibbc30625d56f185ef856ae1ee18191aa0592955b
Signed-off-by: Selvarasu Ganesan <quic_selvaras@quicinc.com>
oom-reaper and process_mrelease system call should protect against
races with exit_mmap which can destroy page tables while they
walk the VMA tree. oom-reaper protects from that race by setting
MMF_OOM_VICTIM and by relying on exit_mmap to set MMF_OOM_SKIP
before taking and releasing mmap_write_lock. process_mrelease has
to elevate mm->mm_users to prevent such race. Both oom-reaper and
process_mrelease hold mmap_read_lock when walking the VMA tree.
The locking rules and mechanisms could be simpler if exit_mmap takes
mmap_write_lock while executing destructive operations such as
free_pgtables.
Change exit_mmap to hold the mmap_write_lock when calling
free_pgtables. Operations like unmap_vmas() and unlock_range() are not
destructive and could run under mmap_read_lock but for simplicity we
take one mmap_write_lock during almost the entire operation. Note
also that because oom-reaper checks VM_LOCKED flag, unlock_range()
should not be allowed to race with it.
In most cases this lock should be uncontended. Previously, Kirill
reported ~4% regression caused by a similar change [1]. We reran the
same test and although the individual results are quite noisy, the
percentiles show lower regression with 1.6% being the worst case [2].
The change allows oom-reaper and process_mrelease to execute safely
under mmap_read_lock without worries that exit_mmap might destroy page
tables from under them.
[1] https://lore.kernel.org/all/20170725141723.ivukwhddk2voyhuc@node.shutemov.name/
[2] https://lore.kernel.org/all/CAJuCfpGC9-c9P40x7oy=jy5SphMcd0o0G_6U1-+JAziGKG6dGA@mail.gmail.com/
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Link: https://lore.kernel.org/all/20211124235906.14437-1-surenb@google.com/
Bug: 130172058
Bug: 189803002
Change-Id: Ic87272d09a0b68a1b0e968e8f1a1510fd6fc776a
Git-commit: 28358ebf2adb31117893813992fefcfd359a6a16
Git-repo: https://android.googlesource.com/kernel/common/
[quic_gkohli@quicinc.com: Resolved cherry-pick conflict in mm/mmap.c due
to mmap lock was implemented differently in older kernel, and
Although process_mrelease is not applicable in older kernel, but this
patch is required to take exclusive lock in exit_mmap path so that
SPF knows an isolated vma was freed from this path]
Signed-off-by: Gaurav Kohli <quic_gkohli@quicinc.com>
Signed-off-by: Srinivasarao Pathipati <quic_c_spathi@quicinc.com>
Change is to configure QC RC MPS 128 bytes as 8168 device only supports
128 bytes. Without this quirk, since RC is using pcie_bus_perf flag
MPS is configured to 256 bytes, when EP MRRS is changed to 4096 bytes
RC is responding with packets of 256 bytes causing functionality break.
Since pcie_bus_perf is used for many products, this change provies a
provision to configure RC to 128 bytes for realtek 8168 attach alone.
Change-Id: I4a82293e4f71bf188d4f0f2be8fa194c5ab007c2
Signed-off-by: Subramanian Ananthanarayanan <quic_skananth@quicinc.com>
er_ctxt->rp pointer is updated by MDM which is untrusted to HLOS,
it could be arbitrary value.
If there is security issue on MDM, and updated pointer which is not
align then driver will never come out of loop where checking against
dev_rp != rp.
So added check to make sure it is in the buffer range & aligned to 128bit.
Change-Id: Ib484e07f2c75fcd657a4ccc648a3a20de3edeebc
Signed-off-by: Krishna chaitanya chundru <quic_krichai@quicinc.com>
Add buffer overflow check while accessing data buffer
received from AON.
Change-Id: I0472a0ad1e6edc3fe8102850fddacd89ceea4959
Signed-off-by: Naveen S Nair <quic_naveensn@quicinc.com>
drawobj_sync_timeline_fence_work() does a cleanup of fence and syncobj
allocations. Doing this cleanup in irq context requires the irq_work
struct to remain valid after the function executes. Avoid this constraint
by deferring this work to the memory workqueue.
Change-Id: Icf648a61686c1ef3fd84467a2376b11a9a4bb803
Signed-off-by: Lynus Vaz <quic_lvaz@quicinc.com>
* remotes/origin/tmp-e699d54:
ANDROID: HID: Only utilise UHID provided exports if UHID is enabled
ANDROID: HID; Over-ride default maximum buffer size when using UHID
Revert "ANDROID: AVB error handler to invalidate vbmeta partition."
UPSTREAM: mailbox: mailbox-test: fix a locking issue in mbox_test_message_write()
UPSTREAM: mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write()
UPSTREAM: efi: rt-wrapper: Add missing include
BACKPORT: arm64: efi: Execute runtime services from a dedicated stack
UPSTREAM: io_uring: have io_kill_timeout() honor the request references
UPSTREAM: io_uring: don't drop completion lock before timer is fully initialized
UPSTREAM: io_uring: always grab lock in io_cancel_async_work()
UPSTREAM: net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize
UPSTREAM: cdc_ncm: Fix the build warning
UPSTREAM: cdc_ncm: Implement the 32-bit version of NCM Transfer Block
UPSTREAM: ext4: avoid a potential slab-out-of-bounds in ext4_group_desc_csum
UPSTREAM: ext4: fix invalid free tracking in ext4_xattr_move_to_block()
Revert "Revert "mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse""
FROMLIST: binder: fix UAF caused by faulty buffer cleanup
UPSTREAM: usb: musb: mediatek: don't unregister something that wasn't registered
UPSTREAM: net: fix NULL pointer in skb_segment_list
UPSTREAM: xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr()
UPSTREAM: xfrm: compat: change expression for switch in xfrm_xlate64
UPSTREAM: perf/core: Call LSM hook after copying perf_event_attr
UPSTREAM: ext4: fix use-after-free in ext4_xattr_set_entry
UPSTREAM: ext4: remove duplicate definition of ext4_xattr_ibody_inline_set()
UPSTREAM: Revert "ext4: fix use-after-free in ext4_xattr_set_entry"
Linux 5.4.242
ASN.1: Fix check for strdup() success
iio: adc: at91-sama5d2_adc: fix an error code in at91_adc_allocate_trigger()
pwm: meson: Explicitly set .polarity in .get_state()
xfs: fix forkoff miscalculation related to XFS_LITINO(mp)
sctp: Call inet6_destroy_sock() via sk->sk_destruct().
dccp: Call inet6_destroy_sock() via sk->sk_destruct().
inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy().
tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct().
udp: Call inet6_destroy_sock() in setsockopt(IPV6_ADDRFORM).
ext4: fix use-after-free in ext4_xattr_set_entry
ext4: remove duplicate definition of ext4_xattr_ibody_inline_set()
Revert "ext4: fix use-after-free in ext4_xattr_set_entry"
x86/purgatory: Don't generate debug info for purgatory.ro
MIPS: Define RUNTIME_DISCARD_EXIT in LD script
mmc: sdhci_am654: Set HIGH_SPEED_ENA for SDR12 and SDR25
memstick: fix memory leak if card device is never registered
nilfs2: initialize unused bytes in segment summary blocks
iio: light: tsl2772: fix reading proximity-diodes from device tree
xen/netback: use same error messages for same errors
nvme-tcp: fix a possible UAF when failing to allocate an io queue
s390/ptrace: fix PTRACE_GET_LAST_BREAK error handling
net: dsa: b53: mmap: add phy ops
scsi: core: Improve scsi_vpd_inquiry() checks
scsi: megaraid_sas: Fix fw_crash_buffer_show()
selftests: sigaltstack: fix -Wuninitialized
Input: i8042 - add quirk for Fujitsu Lifebook A574/H
f2fs: Fix f2fs_truncate_partial_nodes ftrace event
e1000e: Disable TSO on i219-LM card to increase speed
bpf: Fix incorrect verifier pruning due to missing register precision taints
mlxfw: fix null-ptr-deref in mlxfw_mfa2_tlv_next()
i40e: fix i40e_setup_misc_vector() error handling
i40e: fix accessing vsi->active_filters without holding lock
netfilter: nf_tables: fix ifdef to also consider nf_tables=m
virtio_net: bugfix overflow inside xdp_linearize_page()
net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg
regulator: fan53555: Explicitly include bits header
netfilter: br_netfilter: fix recent physdev match breakage
arm64: dts: meson-g12-common: specify full DMC range
ARM: dts: rockchip: fix a typo error for rk3288 spdif node
Linux 5.4.241
xfs: force log and push AIL to clear pinned inodes when aborting mount
xfs: don't reuse busy extents on extent trim
xfs: consider shutdown in bmapbt cursor delete assert
xfs: shut down the filesystem if we screw up quota reservation
xfs: report corruption only as a regular error
xfs: set inode size after creating symlink
xfs: fix up non-directory creation in SGID directories
xfs: remove the di_version field from struct icdinode
xfs: simplify a check in xfs_ioctl_setattr_check_cowextsize
xfs: simplify di_flags2 inheritance in xfs_ialloc
xfs: only check the superblock version for dinode size calculation
xfs: add a new xfs_sb_version_has_v3inode helper
xfs: remove the kuid/kgid conversion wrappers
xfs: remove the icdinode di_uid/di_gid members
xfs: ensure that the inode uid/gid match values match the icdinode ones
xfs: merge the projid fields in struct xfs_icdinode
xfs: show the proper user quota options
coresight-etm4: Fix for() loop drvdata->nr_addr_cmp range bug
watchdog: sbsa_wdog: Make sure the timeout programming is within the limits
i2c: ocores: generate stop condition after timeout in polling mode
ubi: Fix deadlock caused by recursively holding work_sem
mtd: ubi: wl: Fix a couple of kernel-doc issues
ubi: Fix failure attaching when vid_hdr offset equals to (sub)page size
asymmetric_keys: log on fatal failures in PE/pkcs7
verify_pefile: relax wrapper length check
drm: panel-orientation-quirks: Add quirk for Lenovo Yoga Book X90F
efi: sysfb_efi: Add quirk for Lenovo Yoga Book X91F/L
i2c: imx-lpi2c: clean rx/tx buffers upon new message
power: supply: cros_usbpd: reclassify "default case!" as debug
net: macb: fix a memory corruption in extended buffer descriptor mode
udp6: fix potential access to stale information
RDMA/core: Fix GID entry ref leak when create_ah fails
sctp: fix a potential overflow in sctp_ifwdtsn_skip
qlcnic: check pci_reset_function result
niu: Fix missing unwind goto in niu_alloc_channels()
9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition
mtd: rawnand: stm32_fmc2: remove unsupported EDO mode
mtd: rawnand: meson: fix bitmask for length in command word
mtdblock: tolerate corrected bit-flips
btrfs: fix fast csum implementation detection
btrfs: print checksum type and implementation at mount time
Bluetooth: Fix race condition in hidp_session_thread
Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}
ALSA: hda/sigmatel: fix S/PDIF out on Intel D*45* motherboards
ALSA: firewire-tascam: add missing unwind goto in snd_tscm_stream_start_duplex()
ALSA: i2c/cs8427: fix iec958 mixer control deactivation
ALSA: hda/sigmatel: add pin overrides for Intel DP45SG motherboard
ALSA: emu10k1: fix capture interrupt handler unlinking
Revert "pinctrl: amd: Disable and mask interrupts on resume"
irqdomain: Fix mapping-creation race
irqdomain: Refactor __irq_domain_alloc_irqs()
irqdomain: Look for existing mapping only once
mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()
ring-buffer: Fix race while reader and writer are on the same page
drm/panfrost: Fix the panfrost_mmu_map_fault_addr() error path
net_sched: prevent NULL dereference if default qdisc setup failed
tracing: Free error logs of tracing instances
can: j1939: j1939_tp_tx_dat_new(): fix out-of-bounds memory access
ftrace: Mark get_lock_parent_ip() __always_inline
perf/core: Fix the same task check in perf_event_set_output
ALSA: hda/realtek: Add quirk for Clevo X370SNW
nilfs2: fix sysfs interface lifetime
nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread()
tty: serial: fsl_lpuart: avoid checking for transfer complete when UARTCTRL_SBK is asserted in lpuart32_tx_empty
tty: serial: sh-sci: Fix Rx on RZ/G2L SCI
tty: serial: sh-sci: Fix transmit end interrupt handler
iio: dac: cio-dac: Fix max DAC write value check for 12-bit
iio: adc: ti-ads7950: Set `can_sleep` flag for GPIO chip
USB: serial: option: add Quectel RM500U-CN modem
USB: serial: option: add Telit FE990 compositions
usb: typec: altmodes/displayport: Fix configure initial pin assignment
USB: serial: cp210x: add Silicon Labs IFS-USB-DATACABLE IDs
xhci: also avoid the XHCI_ZERO_64B_REGS quirk with a passthrough iommu
NFSD: callback request does not use correct credential for AUTH_SYS
sunrpc: only free unix grouplist after RCU settles
gpio: davinci: Add irq chip flag to skip set wake
ipv6: Fix an uninit variable access bug in __ip6_make_skb()
sctp: check send stream number after wait_for_sndbuf
net: don't let netpoll invoke NAPI if in xmit context
icmp: guard against too small mtu
wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta
pwm: sprd: Explicitly set .polarity in .get_state()
pwm: cros-ec: Explicitly set .polarity in .get_state()
pinctrl: amd: Disable and mask interrupts on resume
pinctrl: amd: disable and mask interrupts on probe
pinctrl: amd: Use irqchip template
smb3: fix problem with null cifs super block with previous patch
treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()
Revert "treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()"
cgroup/cpuset: Wake up cpuset_attach_wq tasks in cpuset_cancel_attach()
x86/PCI: Add quirk for AMD XHCI controller that loses MSI-X state in D3hot
scsi: ses: Handle enclosure with just a primary component gracefully
Linux 5.4.240
gfs2: Always check inode size of inline inodes
firmware: arm_scmi: Fix device node validation for mailbox transport
net: sched: fix race condition in qdisc_graft()
net_sched: add __rcu annotation to netdev->qdisc
ext4: fix kernel BUG in 'ext4_write_inline_data_end()'
btrfs: scan device in non-exclusive mode
s390/uaccess: add missing earlyclobber annotations to __clear_user()
drm/etnaviv: fix reference leak when mmaping imported buffer
ALSA: usb-audio: Fix regression on detection of Roland VS-100
ALSA: hda/conexant: Partial revert of a quirk for Lenovo
NFSv4: Fix hangs when recovering open state after a server reboot
pinctrl: at91-pio4: fix domain name assignment
xen/netback: don't do grant copy across page boundary
Input: goodix - add Lenovo Yoga Book X90F to nine_bytes_report DMI table
cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL
cifs: prevent infinite recursion in CIFSGetDFSRefer()
Input: focaltech - use explicitly signed char type
Input: alps - fix compatibility with -funsigned-char
pinctrl: ocelot: Fix alt mode for ocelot
net: mvneta: make tx buffer array agnostic
net: dsa: mv88e6xxx: Enable IGMP snooping on user ports only
bnxt_en: Fix typo in PCI id to device description string mapping
i40e: fix registers dump after run ethtool adapter self test
s390/vfio-ap: fix memory leak in vfio_ap device driver
can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write
net/net_failover: fix txq exceeding warning
regulator: Handle deferred clk
regulator: fix spelling mistake "Cant" -> "Can't"
ptp_qoriq: fix memory leak in probe()
scsi: megaraid_sas: Fix crash after a double completion
mtd: rawnand: meson: invalidate cache on polling ECC bit
mips: bmips: BCM6358: disable RAC flush for TP1
dma-mapping: drop the dev argument to arch_sync_dma_for_*
ca8210: Fix unsigned mac_len comparison with zero in ca8210_skb_tx()
fbdev: au1200fb: Fix potential divide by zero
fbdev: lxfb: Fix potential divide by zero
fbdev: intelfb: Fix potential divide by zero
fbdev: nvidia: Fix potential divide by zero
sched_getaffinity: don't assume 'cpumask_size()' is fully initialized
fbdev: tgafb: Fix potential divide by zero
ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set()
ALSA: asihpi: check pao in control_message()
md: avoid signed overflow in slot_store()
bus: imx-weim: fix branch condition evaluates to a garbage value
fsverity: don't drop pagecache at end of FS_IOC_ENABLE_VERITY
ocfs2: fix data corruption after failed write
tun: avoid double free in tun_free_netdev
sched/fair: Sanitize vruntime of entity being migrated
sched/fair: sanitize vruntime of entity being placed
dm crypt: add cond_resched() to dmcrypt_write()
dm stats: check for and propagate alloc_percpu failure
i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer()
nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy()
wifi: mac80211: fix qos on mesh interfaces
usb: chipidea: core: fix possible concurrent when switch role
usb: chipdea: core: fix return -EINVAL if request role is the same with current role
usb: cdns3: Fix issue with using incorrect PCI device function
dm thin: fix deadlock when swapping to thin device
igb: revert rtnl_lock() that causes deadlock
fsverity: Remove WQ_UNBOUND from fsverity read workqueue
usb: gadget: u_audio: don't let userspace block driver unbind
scsi: core: Add BLIST_SKIP_VPD_PAGES for SKhynix H28U74301AMR
cifs: empty interface list when server doesn't support query interfaces
sh: sanitize the flags on sigreturn
net: usb: qmi_wwan: add Telit 0x1080 composition
net: usb: cdc_mbim: avoid altsetting toggling for Telit FE990
scsi: lpfc: Avoid usage of list iterator variable after loop
scsi: ufs: core: Add soft dependency on governor_simpleondemand
scsi: target: iscsi: Fix an error message in iscsi_check_key()
selftests/bpf: check that modifier resolves after pointer
m68k: Only force 030 bus error if PC not in exception table
ca8210: fix mac_len negative array access
riscv: Bump COMMAND_LINE_SIZE value to 1024
thunderbolt: Use const qualifier for `ring_interrupt_index`
uas: Add US_FL_NO_REPORT_OPCODES for JMicron JMS583Gen 2
scsi: qla2xxx: Perform lockless command completion in abort path
hwmon (it87): Fix voltage scaling for chips with 10.9mV ADCs
platform/chrome: cros_ec_chardev: fix kernel data leak from ioctl
Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work
Bluetooth: btqcomsmd: Fix command timeout after setting BD address
net: mdio: thunder: Add missing fwnode_handle_put()
hvc/xen: prevent concurrent accesses to the shared ring
nvme-tcp: fix nvme_tcp_term_pdu to match spec
net/sonic: use dma_mapping_error() for error check
erspan: do not use skb_mac_header() in ndo_start_xmit()
atm: idt77252: fix kmemleak when rmmod idt77252
net/mlx5: Read the TC mapping of all priorities on ETS query
bpf: Adjust insufficient default bpf_jit_limit
keys: Do not cache key in task struct if key is requested from kernel thread
net/ps3_gelic_net: Use dma_mapping_error
net/ps3_gelic_net: Fix RX sk_buff length
net: qcom/emac: Fix use after free bug in emac_remove due to race condition
xirc2ps_cs: Fix use after free bug in xirc2ps_detach
qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info
net: usb: smsc95xx: Limit packet length to skb->len
scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate()
i2c: imx-lpi2c: check only for enabled interrupt flags
igbvf: Regard vf reset nack as success
intel/igbvf: free irq on the error path in igbvf_request_msix()
iavf: fix non-tunneled IPv6 UDP packet type and hashing
iavf: fix inverted Rx hash condition leading to disabled hash
power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition
net: tls: fix possible race condition between do_tls_getsockopt_conf() and do_tls_setsockopt_conf()
Linux 5.4.239
selftests: Fix the executable permissions for fib_tests.sh
BACKPORT: mac80211_hwsim: notify wmediumd of used MAC addresses
FROMGIT: mac80211_hwsim: add concurrent channels scanning support over virtio
Revert "HID: core: Provide new max_buffer_size attribute to over-ride the default"
Revert "HID: uhid: Over-ride the default maximum data buffer value with our own"
Linux 5.4.238
HID: uhid: Over-ride the default maximum data buffer value with our own
HID: core: Provide new max_buffer_size attribute to over-ride the default
PCI: Unify delay handling for reset and resume
s390/ipl: add missing intersection check to ipl_report handling
serial: 8250_em: Fix UART port type
drm/i915: Don't use stolen memory for ring buffers with LLC
x86/mm: Fix use of uninitialized buffer in sme_enable()
fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks
ftrace: Fix invalid address access in lookup_rec() when index is 0
KVM: nVMX: add missing consistency checks for CR0 and CR4
tracing: Make tracepoint lockdep check actually test something
tracing: Check field value in hist_field_name()
interconnect: fix mem leak when freeing nodes
tty: serial: fsl_lpuart: skip waiting for transmission complete when UARTCTRL_SBK is asserted
ext4: fix possible double unlock when moving a directory
sh: intc: Avoid spurious sizeof-pointer-div warning
drm/amdkfd: Fix an illegal memory access
ext4: fix task hung in ext4_xattr_delete_inode
ext4: fail ext4_iget if special inode unallocated
jffs2: correct logic when creating a hole in jffs2_write_begin
mmc: atmel-mci: fix race between stop command and start of next command
media: m5mols: fix off-by-one loop termination error
hwmon: (ina3221) return prober error code
hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
hwmon: (adt7475) Fix masking of hysteresis registers
hwmon: (adt7475) Display smoothing attributes in correct order
ethernet: sun: add check for the mdesc_grab()
net/iucv: Fix size of interrupt data
net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull
ipv4: Fix incorrect table ID in IOCTL path
block: sunvdc: add check for mdesc_grab() returning NULL
nvmet: avoid potential UAF in nvmet_req_complete()
net: usb: smsc75xx: Limit packet length to skb->len
nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails
net: tunnels: annotate lockless accesses to dev->needed_headroom
qed/qed_dev: guard against a possible division by zero
i40e: Fix kernel crash during reboot when adapter is in recovery mode
ipvlan: Make skb->skb_iif track skb->dev for l3s mode
nfc: pn533: initialize struct pn533_out_arg properly
tcp: tcp_make_synack() can be called from process context
scsi: core: Fix a procfs host directory removal regression
scsi: core: Fix a comment in function scsi_host_dev_release()
netfilter: nft_redir: correct value of inet type `.maxattrs`
ALSA: hda: Match only Intel devices with CONTROLLER_IN_GPU()
ALSA: hda: Add Intel DG2 PCI ID and HDMI codec vid
ALSA: hda: Add Alderlake-S PCI ID and HDMI codec vid
ALSA: hda - controller is in GPU on the DG1
ALSA: hda - add Intel DG1 PCI and HDMI ids
scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
docs: Correct missing "d_" prefix for dentry_operations member d_weak_revalidate
clk: HI655X: select REGMAP instead of depending on it
drm/meson: fix 1px pink line on GXM when scaling video overlay
cifs: Move the in_send statistic to __smb_send_rqst()
drm/panfrost: Don't sync rpm suspension after mmu flushing
xfrm: Allow transport-mode states with AF_UNSPEC selector
ext4: fix cgroup writeback accounting with fs-layer encryption
ANDROID: preserve CRC for __irq_domain_add()
Revert "drm/exynos: Don't reset bridge->next"
Revert "drm/bridge: Rename bridge helpers targeting a bridge chain"
Revert "drm/bridge: Introduce drm_bridge_get_next_bridge()"
Revert "drm: Initialize struct drm_crtc_state.no_vblank from device settings"
Revert "drm/msm/mdp5: Add check for kzalloc"
Linux 5.4.237
s390/dasd: add missing discipline function
UML: define RUNTIME_DISCARD_EXIT
sh: define RUNTIME_DISCARD_EXIT
s390: define RUNTIME_DISCARD_EXIT to fix link error with GNU ld < 2.36
powerpc/vmlinux.lds: Don't discard .rela* for relocatable builds
powerpc/vmlinux.lds: Define RUNTIME_DISCARD_EXIT
arch: fix broken BuildID for arm64 and riscv
x86, vmlinux.lds: Add RUNTIME_DISCARD_EXIT to generic DISCARDS
drm/i915: Don't use BAR mappings for ring buffers with LLC
ipmi:watchdog: Set panic count to proper value on a panic
ipmi/watchdog: replace atomic_add() and atomic_sub()
media: ov5640: Fix analogue gain control
PCI: Add SolidRun vendor ID
macintosh: windfarm: Use unsigned type for 1-bit bitfields
alpha: fix R_ALPHA_LITERAL reloc for large modules
MIPS: Fix a compilation issue
ext4: Fix deadlock during directory rename
riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode
net/smc: fix fallback failed while sendmsg with fastopen
scsi: megaraid_sas: Update max supported LD IDs to 240
btf: fix resolving BTF_KIND_VAR after ARRAY, STRUCT, UNION, PTR
netfilter: tproxy: fix deadlock due to missing BH disable
bnxt_en: Avoid order-5 memory allocation for TPA data
net: caif: Fix use-after-free in cfusbl_device_notify()
net: lan78xx: fix accessing the LAN7800's internal phy specific registers from the MAC driver
net: usb: lan78xx: Remove lots of set but unused 'ret' variables
selftests: nft_nat: ensuring the listening side is up before starting the client
ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping()
nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties
drm/msm/a5xx: fix setting of the CP_PREEMPT_ENABLE_LOCAL register
ext4: Fix possible corruption when moving a directory
scsi: core: Remove the /proc/scsi/${proc_name} directory earlier
cifs: Fix uninitialized memory read in smb3_qfs_tcon()
SMB3: Backup intent flag missing from some more ops
iommu/vt-d: Fix PASID directory pointer coherency
irqdomain: Fix domain registration race
irqdomain: Change the type of 'size' in __irq_domain_add() to be consistent
ipmi:ssif: Add a timer between request retries
ipmi:ssif: Increase the message retry time
ipmi:ssif: Remove rtc_us_timer
ipmi:ssif: resend_msg() cannot fail
ipmi:ssif: make ssif_i2c_send() void
iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter
iommu/amd: Fix ill-formed ivrs_ioapic, ivrs_hpet and ivrs_acpihid options
iommu/amd: Add PCI segment support for ivrs_[ioapic/hpet/acpihid] commands
nfc: change order inside nfc_se_io error path
ext4: zero i_disksize when initializing the bootloader inode
ext4: fix WARNING in ext4_update_inline_data
ext4: move where set the MAY_INLINE_DATA flag is set
ext4: fix another off-by-one fsmap error on 1k block filesystems
ext4: fix RENAME_WHITEOUT handling for inline directories
drm/connector: print max_requested_bpc in state debugfs
x86/CPU/AMD: Disable XSAVES on AMD family 0x17
fs: prevent out-of-bounds array speculation when closing a file descriptor
Linux 5.4.236
staging: rtl8192e: Remove call_usermodehelper starting RadioPower.sh
staging: rtl8192e: Remove function ..dm_check_ac_dc_power calling a script
wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext"
Linux 5.4.235
dt-bindings: rtc: sun6i-a31-rtc: Loosen the requirements on the clocks
media: uvcvideo: Fix race condition with usb_kill_urb
media: uvcvideo: Provide sync and async uvc_ctrl_status_event
tcp: Fix listen() regression in 5.4.229.
Bluetooth: hci_sock: purge socket queues in the destruct() callback
x86/resctl: fix scheduler confusion with 'current'
x86/resctrl: Apply READ_ONCE/WRITE_ONCE to task_struct.{rmid,closid}
net: tls: avoid hanging tasks on the tx_lock
phy: rockchip-typec: Fix unsigned comparison with less than zero
PCI: Add ACS quirk for Wangxun NICs
kernel/fail_function: fix memory leak with using debugfs_lookup()
usb: uvc: Enumerate valid values for color matching
USB: ene_usb6250: Allocate enough memory for full object
usb: host: xhci: mvebu: Iterate over array indexes instead of using pointer math
iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_config_word()
iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_status_word()
tools/iio/iio_utils:fix memory leak
mei: bus-fixup:upon error print return values of send and receive
tty: serial: fsl_lpuart: disable the CTS when send break signal
tty: fix out-of-bounds access in tty_driver_lookup_tty()
staging: emxx_udc: Add checks for dma_alloc_coherent()
media: uvcvideo: Silence memcpy() run-time false positive warnings
media: uvcvideo: Quirk for autosuspend in Logitech B910 and C910
media: uvcvideo: Handle errors from calls to usb_string
media: uvcvideo: Handle cameras with invalid descriptors
mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak
firmware/efi sysfb_efi: Add quirk for Lenovo IdeaPad Duet 3
tracing: Add NULL checks for buffer in ring_buffer_free_read_page()
thermal: intel: BXT_PMIC: select REGMAP instead of depending on it
thermal: intel: quark_dts: fix error pointer dereference
scsi: ipr: Work around fortify-string warning
rtc: sun6i: Always export the internal oscillator
rtc: sun6i: Make external 32k oscillator optional
vc_screen: modify vcs_size() handling in vcs_read()
tcp: tcp_check_req() can be called from process context
ARM: dts: spear320-hmi: correct STMPE GPIO compatible
net/sched: act_sample: fix action bind logic
nfc: fix memory leak of se_io context in nfc_genl_se_io
net/mlx5: Geneve, Fix handling of Geneve object id as error code
9p/rdma: unmap receive dma buffer in rdma_request()/post_recv()
9p/xen: fix connection sequence
9p/xen: fix version parsing
net: fix __dev_kfree_skb_any() vs drop monitor
sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop
ipv6: Add lwtunnel encap size of all siblings in nexthop calculation
netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack()
watchdog: pcwd_usb: Fix attempting to access uninitialized memory
watchdog: Fix kmemleak in watchdog_cdev_register
watchdog: at91sam9_wdt: use devm_request_irq to avoid missing free_irq() in error path
x86: um: vdso: Add '%rcx' and '%r11' to the syscall clobber list
ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed
ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()
ubifs: ubifs_writepage: Mark page dirty after writing inode failed
ubifs: dirty_cow_znode: Fix memleak in error handling path
ubifs: Re-statistic cleaned znode count if commit failed
ubi: Fix possible null-ptr-deref in ubi_free_volume()
ubifs: Fix memory leak in alloc_wbufs()
ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume()
ubi: Fix use-after-free when volume resizing failed
ubifs: Reserve one leb for each journal head while doing budget
ubifs: do_rename: Fix wrong space budget when target inode's nlink > 1
ubifs: Fix wrong dirty space budget for dirty inode
ubifs: Rectify space budget for ubifs_xrename()
ubifs: Rectify space budget for ubifs_symlink() if symlink is encrypted
ubifs: Fix build errors as symbol undefined
ubi: ensure that VID header offset + VID header size <= alloc, size
um: vector: Fix memory leak in vector_config
fs: f2fs: initialize fsdata in pagecache_write()
f2fs: use memcpy_{to,from}_page() where possible
pwm: stm32-lp: fix the check on arr and cmp registers update
pwm: sifive: Always let the first pwm_apply_state succeed
pwm: sifive: Reduce time the controller lock is held
fs/jfs: fix shift exponent db_agl2size negative
net/sched: Retire tcindex classifier
kbuild: Port silent mode detection to future gnu make.
wifi: ath9k: use proper statements in conditionals
drm/radeon: Fix eDP for single-display iMac11,2
drm/i915/quirks: Add inverted backlight quirk for HP 14-r206nv
PCI: Avoid FLR for AMD FCH AHCI adapters
PCI: hotplug: Allow marking devices as disconnected during bind/unbind
PCI/PM: Observe reset delay irrespective of bridge_d3
scsi: ses: Fix slab-out-of-bounds in ses_intf_remove()
scsi: ses: Fix possible desc_ptr out-of-bounds accesses
scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses
scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()
scsi: ses: Don't attach if enclosure has no components
scsi: qla2xxx: Fix erroneous link down
scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests
scsi: qla2xxx: Fix link failure in NPIV environment
ktest.pl: Add RUN_TIMEOUT option with default unlimited
ktest.pl: Fix missing "end_monitor" when machine check fails
ktest.pl: Give back console on Ctrt^C on monitor
mm/thp: check and bail out if page in deferred queue already
mm: memcontrol: deprecate charge moving
media: ipu3-cio2: Fix PM runtime usage_count in driver unbind
mips: fix syscall_get_nr
alpha: fix FEN fault handling
rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails
ARM: dts: exynos: correct TMU phandle in Odroid XU
ARM: dts: exynos: correct TMU phandle in Exynos4
dm flakey: don't corrupt the zero page
dm flakey: fix logic when corrupting a bio
thermal: intel: powerclamp: Fix cur_state for multi package system
wifi: cfg80211: Fix use after free for wext
wifi: rtl8xxxu: Use a longer retry limit of 48
ext4: refuse to create ea block when umounted
ext4: optimize ea_inode block expansion
ALSA: hda/realtek: Add quirk for HP EliteDesk 800 G6 Tower PC
ALSA: ice1712: Do not left ice->gpio_mutex locked in aureon_add_controls()
irqdomain: Drop bogus fwspec-mapping error handling
irqdomain: Fix disassociation race
irqdomain: Fix association race
ima: Align ima_file_mmap() parameters with mmap_file LSM hook
Documentation/hw-vuln: Document the interaction between IBRS and STIBP
x86/speculation: Allow enabling STIBP with legacy IBRS
x86/microcode/AMD: Fix mixed steppings support
x86/microcode/AMD: Add a @cpu parameter to the reloading functions
x86/microcode/amd: Remove load_microcode_amd()'s bsp parameter
x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe range
x86/kprobes: Fix __recover_optprobed_insn check optimizing logic
x86/reboot: Disable SVM, not just VMX, when stopping CPUs
x86/reboot: Disable virtualization in an emergency if SVM is supported
x86/crash: Disable virt in core NMI crash handler to avoid double shootdown
x86/virt: Force GIF=1 prior to disabling SVM (for reboot flows)
KVM: s390: disable migration mode when dirty tracking is disabled
KVM: Destroy target device if coalesced MMIO unregistration fails
udf: Fix file corruption when appending just after end of preallocated extent
udf: Detect system inodes linked into directory hierarchy
udf: Preserve link count of system files
udf: Do not update file length for failed writes to inline files
udf: Do not bother merging very long extents
udf: Truncate added extents on failed expansion
ocfs2: fix non-auto defrag path not working issue
ocfs2: fix defrag path triggering jbd2 ASSERT
f2fs: fix cgroup writeback accounting with fs-layer encryption
f2fs: fix information leak in f2fs_move_inline_dirents()
fs: hfsplus: fix UAF issue in hfsplus_put_super
hfs: fix missing hfs_bnode_get() in __hfs_bnode_create
ARM: dts: exynos: correct HDMI phy compatible in Exynos4
s390/kprobes: fix current_kprobe never cleared after kprobes reenter
s390/kprobes: fix irq mask clobbering on kprobe reenter from post_handler
s390: discard .interp section
ipmi_ssif: Rename idle state and check
rtc: pm8xxx: fix set-alarm race
firmware: coreboot: framebuffer: Ignore reserved pixel color bits
wifi: rtl8xxxu: fixing transmisison failure for rtl8192eu
nfsd: zero out pointers after putting nfsd_files on COPY setup error
dm cache: add cond_resched() to various workqueue loops
dm thin: add cond_resched() to various workqueue loops
drm: panel-orientation-quirks: Add quirk for Lenovo IdeaPad Duet 3 10IGL5
pinctrl: at91: use devm_kasprintf() to avoid potential leaks
hwmon: (coretemp) Simplify platform device handling
regulator: s5m8767: Bounds check id indexing into arrays
regulator: max77802: Bounds check regulator id against opmode
ASoC: kirkwood: Iterate over array indexes instead of using pointer math
docs/scripts/gdb: add necessary make scripts_gdb step
drm/msm/dsi: Add missing check for alloc_ordered_workqueue
drm/radeon: free iio for atombios when driver shutdown
HID: Add Mapping for System Microphone Mute
drm/omap: dsi: Fix excessive stack usage
drm/amd/display: Fix potential null-deref in dm_resume
uaccess: Add minimum bounds check on kernel buffer size
coda: Avoid partial allocation of sig_inputArgs
net/mlx5: fw_tracer: Fix debug print
ACPI: video: Fix Lenovo Ideapad Z570 DMI match
wifi: mt76: dma: free rx_head in mt76_dma_rx_cleanup
m68k: Check syscall_trace_enter() return code
net: bcmgenet: Add a check for oversized packets
ACPI: Don't build ACPICA with '-Os'
ice: add missing checks for PF vsi type
inet: fix fast path in __inet_hash_connect()
wifi: mt7601u: fix an integer underflow
wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds
x86/bugs: Reset speculation control settings on init
timers: Prevent union confusion from unexpected restart_syscall()
thermal: intel: Fix unsigned comparison with less than zero
rcu: Suppress smp_processor_id() complaint in synchronize_rcu_expedited_wait()
wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds()
blk-iocost: fix divide by 0 error in calc_lcoefs()
ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy
udf: Define EFSCORRUPTED error code
rpmsg: glink: Avoid infinite loop on intent for missing channel
media: usb: siano: Fix use after free bugs caused by do_submit_urb
media: i2c: ov7670: 0 instead of -EINVAL was returned
media: rc: Fix use-after-free bugs caused by ene_tx_irqsim()
media: i2c: ov772x: Fix memleak in ov772x_probe()
media: ov5675: Fix memleak in ov5675_init_controls()
powerpc: Remove linker flag from KBUILD_AFLAGS
media: platform: ti: Add missing check for devm_regulator_get
remoteproc: qcom_q6v5_mss: Use a carveout to authenticate modem headers
MIPS: vpe-mt: drop physical_memsize
MIPS: SMP-CPS: fix build error when HOTPLUG_CPU not set
powerpc/eeh: Set channel state after notifying the drivers
powerpc/eeh: Small refactor of eeh_handle_normal_event()
powerpc/rtas: ensure 4KB alignment for rtas_data_buf
powerpc/rtas: make all exports GPL
powerpc/pseries/lparcfg: add missing RTAS retry status handling
powerpc/pseries/lpar: add missing RTAS retry status handling
clk: Honor CLK_OPS_PARENT_ENABLE in clk_core_is_enabled()
powerpc/powernv/ioda: Skip unallocated resources when mapping to PE
clk: qcom: gpucc-sdm845: fix clk_dis_wait being programmed for CX GDSC
Input: ads7846 - don't check penirq immediately for 7845
Input: ads7846 - don't report pressure for ads7845
clk: renesas: cpg-mssr: Remove superfluous check in resume code
clk: renesas: cpg-mssr: Use enum clk_reg_layout instead of a boolean flag
clk: renesas: cpg-mssr: Fix use after free if cpg_mssr_common_init() failed
mtd: rawnand: sunxi: Fix the size of the last OOB region
clk: qcom: gcc-qcs404: fix names of the DSI clocks used as parents
clk: qcom: gcc-qcs404: disable gpll[04]_out_aux parents
mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read()
selftests/ftrace: Fix bash specific "==" operator
sparc: allow PM configs for sparc32 COMPILE_TEST
perf tools: Fix auto-complete on aarch64
perf llvm: Fix inadvertent file creation
gfs2: jdata writepage fix
cifs: Fix warning and UAF when destroy the MR list
cifs: Fix lost destroy smbd connection when MR allocate failed
nfsd: fix race to check ls_layouts
hid: bigben_probe(): validate report count
HID: asus: Fix mute and touchpad-toggle keys on Medion Akoya E1239T
HID: asus: Add support for multi-touch touchpad on Medion Akoya E1239T
HID: asus: Add report_size to struct asus_touchpad_info
HID: asus: Only set EV_REP if we are adding a mapping
HID: bigben: use spinlock to safely schedule workers
HID: bigben_worker() remove unneeded check on report_field
HID: bigben: use spinlock to protect concurrent accesses
ASoC: soc-dapm.h: fixup warning struct snd_pcm_substream not declared
ASoC: dapm: declare missing structure prototypes
spi: synquacer: Fix timeout handling in synquacer_spi_transfer_one()
dm: remove flush_scheduled_work() during local_exit()
hwmon: (mlxreg-fan) Return zero speed for broken fan
spi: bcm63xx-hsspi: Fix multi-bit mode setting
spi: bcm63xx-hsspi: fix pm_runtime
scsi: aic94xx: Add missing check for dma_map_single()
hwmon: (ltc2945) Handle error case in ltc2945_value_store
gpio: vf610: connect GPIO label to dev name
ASoC: soc-compress.c: fixup private_data on snd_soc_new_compress()
drm/mediatek: Clean dangling pointer on bind error path
drm/mediatek: Drop unbalanced obj unref
drm/mediatek: Use NULL instead of 0 for NULL pointer
drm/mediatek: remove cast to pointers passed to kfree
gpu: host1x: Don't skip assigning syncpoints to channels
drm/msm/mdp5: Add check for kzalloc
drm: Initialize struct drm_crtc_state.no_vblank from device settings
drm/bridge: Introduce drm_bridge_get_next_bridge()
drm/bridge: Rename bridge helpers targeting a bridge chain
drm/exynos: Don't reset bridge->next
drm/msm/dpu: Add check for pstates
drm/msm/dpu: Add check for cstate
drm/msm: use strscpy instead of strncpy
drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness
ALSA: hda/ca0132: minor fix for allocation size
ASoC: fsl_sai: initialize is_dsp_mode flag
pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain
drm/msm/hdmi: Add missing check for alloc_ordered_workqueue
gpu: ipu-v3: common: Add of_node_put() for reference returned by of_graph_get_port_by_id()
drm/vc4: dpi: Fix format mapping for RGB565
drm/vc4: dpi: Add option for inverting pixel clock and output enable
drm/bridge: megachips: Fix error handling in i2c_register_driver()
drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC
drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats
selftest: fib_tests: Always cleanup before exit
selftests/net: Interpret UDP_GRO cmsg data as an int value
irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts
irqchip/irq-brcmstb-l2: Set IRQ_LEVEL for level triggered interrupts
can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits in case of a bus error
thermal/drivers/hisi: Drop second sensor hi3660
wifi: mac80211: make rate u32 in sta_set_rate_info_rx()
crypto: crypto4xx - Call dma_unmap_page when done
wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize()
wifi: iwl4965: Add missing check for create_singlethread_workqueue()
wifi: iwl3945: Add missing check for create_singlethread_workqueue
treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()
usb: gadget: udc: Avoid tasklet passing a global
RISC-V: time: initialize hrtimer based broadcast clock event device
m68k: /proc/hardware should depend on PROC_FS
crypto: rsa-pkcs1pad - Use akcipher_request_complete
rds: rds_rm_zerocopy_callback() correct order for list_add_tail()
libbpf: Fix alen calculation in libbpf_nla_dump_errormsg()
Bluetooth: L2CAP: Fix potential user-after-free
OPP: fix error checking in opp_migrate_dentry()
tap: tap_open(): correctly initialize socket uid
tun: tun_chr_open(): correctly initialize socket uid
net: add sock_init_data_uid()
mptcp: add sk_stop_timer_sync helper
irqchip/ti-sci: Fix refcount leak in ti_sci_intr_irq_domain_probe
irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe
irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains
net/mlx5: Enhance debug print in page allocation failure
powercap: fix possible name leak in powercap_register_zone()
crypto: seqiv - Handle EBUSY correctly
crypto: essiv - Handle EBUSY correctly
crypto: essiv - remove redundant null pointer check before kfree
crypto: ccp - Failure on re-initialization due to duplicate sysfs filename
ACPI: battery: Fix missing NUL-termination with large strings
wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback()
wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails
ath9k: htc: clean up statistics macros
ath9k: hif_usb: simplify if-if to if-else
wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function
wifi: orinoco: check return value of hermes_write_wordrec()
ACPICA: nsrepair: handle cases without a return value correctly
lib/mpi: Fix buffer overrun when SG is too long
genirq: Fix the return type of kstat_cpu_irqs_sum()
ACPICA: Drop port I/O validation for some regions
crypto: x86/ghash - fix unaligned access in ghash_setkey()
wifi: wl3501_cs: don't call kfree_skb() under spin_lock_irqsave()
wifi: libertas: cmdresp: don't call kfree_skb() under spin_lock_irqsave()
wifi: libertas: main: don't call kfree_skb() under spin_lock_irqsave()
wifi: libertas: if_usb: don't call kfree_skb() under spin_lock_irqsave()
wifi: libertas_tf: don't call kfree_skb() under spin_lock_irqsave()
wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid()
wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit()
wifi: wilc1000: fix potential memory leak in wilc_mac_xmit()
wilc1000: let wilc_mac_xmit() return NETDEV_TX_OK
wifi: ipw2200: fix memory leak in ipw_wdev_init()
wifi: ipw2x00: don't call dev_kfree_skb() under spin_lock_irqsave()
ipw2x00: switch from 'pci_' to 'dma_' API
wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit()
rtlwifi: fix -Wpointer-sign warning
wifi: rtl8xxxu: don't call dev_kfree_skb() under spin_lock_irqsave()
wifi: libertas: fix memory leak in lbs_init_adapter()
wifi: iwlegacy: common: don't call dev_kfree_skb() under spin_lock_irqsave()
net/wireless: Delete unnecessary checks before the macro call “dev_kfree_skb”
wifi: rsi: Fix memory leak in rsi_coex_attach()
block: bio-integrity: Copy flags when bio_integrity_payload is cloned
sched/rt: pick_next_rt_entity(): check list_entry
sched/deadline,rt: Remove unused parameter from pick_next_[rt|dl]_entity()
s390/dasd: Fix potential memleak in dasd_eckd_init()
s390/dasd: Prepare for additional path event handling
blk-mq: correct stale comment of .get_budget
blk-mq: wait on correct sbitmap_queue in blk_mq_mark_tag_wait
blk-mq: remove stale comment for blk_mq_sched_mark_restart_hctx
block: Limit number of items taken from the I/O scheduler in one go
Revert "scsi: core: run queue if SCSI device queue isn't ready and queue is idle"
arm64: dts: mediatek: mt7622: Add missing pwm-cells to pwm node
ARM: dts: imx7s: correct iomuxc gpr mux controller cells
arm64: dts: amlogic: meson-gxl-s905d-phicomm-n1: fix led node name
arm64: dts: amlogic: meson-gxl: add missing unit address to eth-phy-mux node name
arm64: dts: amlogic: meson-gx: add missing unit address to rng node name
arm64: dts: amlogic: meson-gx: add missing SCPI sensors compatible
arm64: dts: amlogic: meson-axg: fix SCPI clock dvfs node name
arm64: dts: amlogic: meson-gx: fix SCPI clock dvfs node name
ARM: imx: Call ida_simple_remove() for ida_simple_get
ARM: dts: exynos: correct wr-active property in Exynos3250 Rinato
ARM: OMAP1: call platform_device_put() in error case in omap1_dm_timer_init()
arm64: dts: meson: remove CPU opps below 1GHz for G12A boards
arm64: dts: meson-gx: Fix the SCPI DVFS node name and unit address
arm64: dts: meson-g12a: Fix internal Ethernet PHY unit name
arm64: dts: meson-gx: Fix Ethernet MAC address unit name
ARM: zynq: Fix refcount leak in zynq_early_slcr_init
arm64: dts: qcom: qcs404: use symbol names for PCIe resets
ARM: OMAP2+: Fix memory leak in realtime_counter_init()
HID: asus: use spinlock to safely schedule workers
HID: asus: use spinlock to protect concurrent accesses
HID: asus: Remove check for same LED brightness on set
Linux 5.4.234
USB: core: Don't hold device lock while reading the "descriptors" sysfs file
USB: serial: option: add support for VW/Skoda "Carstick LTE"
dmaengine: sh: rcar-dmac: Check for error num after dma_set_max_seg_size
vc_screen: don't clobber return value in vcs_read
net: Remove WARN_ON_ONCE(sk->sk_forward_alloc) from sk_stream_kill_queues().
bpf: bpf_fib_lookup should not return neigh in NUD_FAILED state
HID: core: Fix deadloop in hid_apply_multiplier.
neigh: make sure used and confirmed times are valid
IB/hfi1: Assign npages earlier
btrfs: send: limit number of clones and allocated memory size
ACPI: NFIT: fix a potential deadlock during NFIT teardown
ARM: dts: rockchip: add power-domains property to dp node on rk3288
arm64: dts: rockchip: drop unused LED mode property from rk3328-roc-cc
Conflicts:
Documentation/devicetree/bindings
Documentation/devicetree/bindings/rtc/allwinner,sun6i-a31-rtc.yaml
arch/arm/mm/dma-mapping.c
drivers/clk/qcom/gcc-qcs404.c
drivers/iommu/dma-iommu.c
drivers/mtd/ubi/wl.c
kernel/dma/direct.c
Change-Id: I5797c8cb2276354d851af215d431950eec734174
Signed-off-by: Srinivasarao Pathipati <quic_c_spathi@quicinc.com>
Commit "ANDROID: HID; Over-ride default maximum buffer size when using
UHID" provided a means for the UHID driver to offer an alternative
(smaller) report buffer size when dealing with user-space. The method
used was an Android-only solution designed to prevent the KMI ABI from
being broken (nb: the upstream solution was cleaner, but broke the ABI).
Since this solution involved consuming resources exported by a
subordinate driver, that driver would have to be enabled for the export
to take place. Since all of our default configs enable UHID, an issue
was not detected. However, for more specific kernel configs, where HID
is enabled, but UHID is not, this leads to compile-time undefined symbol
errors:
ld.lld: error: undefined symbol: uhid_hid_driver
This patch relies on the compiler to leave out unutilised sections of
the code if the associated resources are not available.
Bug: 260007429
Reported-by: Paul Lawrence <paullawrence@google.com>
Reported-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I80b1aa7454c89d5c5e21f0268252ffb666efab97
Signed-off-by: Lee Jones <joneslee@google.com>
Add SOC ID to support socinfo for Blair APQ and Blair APQ-XR soc.
Change-Id: Ica80b43f1eab94d95bf38726571b36b7fc8a2e35
Signed-off-by: Swetha Chikkaboraiah <quic_schikk@quicinc.com>
The size parameter passed to qcom_smem_get() can become less than
global toc size, add check to avoid out of bound accessing.
Change-Id: I068b4d5e27e94ce23c26856dad106a3970fb56d6
Signed-off-by: Srinivasarao Pathipati <quic_c_spathi@quicinc.com>
Commit c99a841d40 ("usb: gadget: cdev: Add spinlock to synchronize
ports->cbits_updated")added spinlock to synchronize ports->cbits_updated
which is causing a spinlock recursion in usb_cser_notify_modem.
Fix this by unlocking the spinlock before it calls send_modem_ctrl_bits
which in turn tries to acquire the same spinlock.
Change-Id: I744ea93d7da60aaf27044400cf457cc81dab151d
Signed-off-by: Pratham Pratap <quic_ppratap@quicinc.com>
Consider a scenario in which open, write and close of AT port is being
done repeatedly. At some point in time, cbits_updated in f_cdev
structure gets overwritten by the previous close instance causing the AT
port to go unresponsive. This prevents port bridge service from sending
DTR/RTS settings to at_mdm0 from at_usb0.
Fix this by adding spinlock to synchronise the updation of
ports->cbits_updated field in f_cdev structure.
Change-Id: Ibf39aa90f3918cd5f22e32a3b06685db4c4298ae
Signed-off-by: Pratham Pratap <quic_ppratap@quicinc.com>
Realtek r8168 IOSS glue driver config set to m
Change-Id: I0a7ef825155f928212cc2979a73482874471004e
Signed-off-by: Raihan Haider <quic_rhaider@quicinc.com>
According to PCIe spec, PCIE_CAP_CLOCK_POWER_MAN bit in
LINK_CAPABILITIES_REG register should be set for EP. But it is seen as
cleared after core reset. In the current driver this bit is being set
but it is not taking effect. Enabling CLK_PM_EN in PCIE_ELBI_SYS_CTRL
register, so that PCIE_CAP_CLOCK_POWER_MAN is set.
Change-Id: I16654d5a477fa8eeaad61d6ec1dd32757627e2f9
Signed-off-by: Sai Chaitanya Kaveti <quic_skaveti@quicinc.com>
Presently, when a report is processed, its proposed size, provided by
the user of the API (as Report Size * Report Count) is compared against
the subsystem default HID_MAX_BUFFER_SIZE (16k). However, some
low-level HID drivers allocate a reduced amount of memory to their
buffers (e.g. UHID only allocates UHID_DATA_MAX (4k) buffers), rending
this check inadequate in some cases.
In these circumstances, if the received report ends up being smaller
than the proposed report size, the remainder of the buffer is zeroed.
That is, the space between sizeof(csize) (size of the current report)
and the rsize (size proposed i.e. Report Size * Report Count), which can
be handled up to HID_MAX_BUFFER_SIZE (16k). Meaning that memset()
shoots straight past the end of the buffer boundary and starts zeroing
out in-use values, often resulting in calamity.
This is an Android specific patch which essentially achieves the same
goal as the recently reverted upstream commits b1a37ed00d790 "(HID:
core: Provide new max_buffer_size attribute to over-ride the default")
and 1c5d4221240a2 ("HID: uhid: Over-ride the default maximum data buffer
value with our own") only it does so in an ABI friendly (albeit more
hacky) way.
Bug: 260007429
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I1f56673bb67b63ab14b58634bfe74a04b0758e3d
(cherry picked from commit 71761b36c37ae15a09fdd4d4adcc98bb939c426c)
Adding Support rtk8111k and add additional member
which fill from ioss and pass to GSI via IPA
num_queues_enabled (Total nuber of queue).
Change-Id: I7a127a9a60e1e45eb384634a7c7d74f813df3e08
Signed-off-by: Himansu Nayak <quic_himansu@quicinc.com>
This driver is not used and can cause problems if used on modern
devices. Remove it.
This reverts commit 6115619831.
Bug: 185178770
Signed-off-by: Alistair Delva <adelva@google.com>
Change-Id: I1d5acb96dda765a1e3ea0cf62a3bf4b2a78892ea
(cherry picked from commit ce6a5172613f990c6aaef168953d1be684f86e12)
[ Upstream commit 8fe72b76db79d694858e872370df49676bc3be8c ]
There was a bug where this code forgot to unlock the tdev->mutex if the
kzalloc() failed. Fix this issue, by moving the allocation outside the
lock.
Bug: 275340532
Fixes: 2d1e952a2b8e ("mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write()")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Lee Jones <lee@kernel.org>
Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 7d233f93594f0d9afe44e9409131a8d6ad4f593c)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I7a4a1bf06abbb2092aceb72610e3f894b2bfbf0f
[ Upstream commit 2d1e952a2b8e5e92d8d55ac88a7cf7ca5ea591ad ]
If a user can make copy_from_user() fail, there is a potential for
UAF/DF due to a lack of locking around the allocation, use and freeing
of the data buffers.
This issue is not theoretical. I managed to author a POC for it:
BUG: KASAN: double-free in kfree+0x5c/0xac
Free of addr ffff29280be5de00 by task poc/356
CPU: 1 PID: 356 Comm: poc Not tainted 6.1.0-00001-g961aa6552c04-dirty #20
Hardware name: linux,dummy-virt (DT)
Call trace:
dump_backtrace.part.0+0xe0/0xf0
show_stack+0x18/0x40
dump_stack_lvl+0x64/0x80
print_report+0x188/0x48c
kasan_report_invalid_free+0xa0/0xc0
____kasan_slab_free+0x174/0x1b0
__kasan_slab_free+0x18/0x24
__kmem_cache_free+0x130/0x2e0
kfree+0x5c/0xac
mbox_test_message_write+0x208/0x29c
full_proxy_write+0x90/0xf0
vfs_write+0x154/0x440
ksys_write+0xcc/0x180
__arm64_sys_write+0x44/0x60
invoke_syscall+0x60/0x190
el0_svc_common.constprop.0+0x7c/0x160
do_el0_svc+0x40/0xf0
el0_svc+0x2c/0x6c
el0t_64_sync_handler+0xf4/0x120
el0t_64_sync+0x18c/0x190
Allocated by task 356:
kasan_save_stack+0x3c/0x70
kasan_set_track+0x2c/0x40
kasan_save_alloc_info+0x24/0x34
__kasan_kmalloc+0xb8/0xc0
kmalloc_trace+0x58/0x70
mbox_test_message_write+0x6c/0x29c
full_proxy_write+0x90/0xf0
vfs_write+0x154/0x440
ksys_write+0xcc/0x180
__arm64_sys_write+0x44/0x60
invoke_syscall+0x60/0x190
el0_svc_common.constprop.0+0x7c/0x160
do_el0_svc+0x40/0xf0
el0_svc+0x2c/0x6c
el0t_64_sync_handler+0xf4/0x120
el0t_64_sync+0x18c/0x190
Freed by task 357:
kasan_save_stack+0x3c/0x70
kasan_set_track+0x2c/0x40
kasan_save_free_info+0x38/0x5c
____kasan_slab_free+0x13c/0x1b0
__kasan_slab_free+0x18/0x24
__kmem_cache_free+0x130/0x2e0
kfree+0x5c/0xac
mbox_test_message_write+0x208/0x29c
full_proxy_write+0x90/0xf0
vfs_write+0x154/0x440
ksys_write+0xcc/0x180
__arm64_sys_write+0x44/0x60
invoke_syscall+0x60/0x190
el0_svc_common.constprop.0+0x7c/0x160
do_el0_svc+0x40/0xf0
el0_svc+0x2c/0x6c
el0t_64_sync_handler+0xf4/0x120
el0t_64_sync+0x18c/0x190
Bug: 275340532
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit cad1abbe488dfd149499e492344c03b87bb0b08c)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I79753a9a63d8b04e139eaaeb9435bf1d05d38892
commit 18bba1843fc7f264f58c9345d00827d082f9c558 upstream.
Add the missing #include of asm/assembler.h, which is where the ldr_l
macro is defined.
Bug: 260821414
Fixes: ff7a167961d1b97e ("arm64: efi: Execute runtime services from a dedicated stack")
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Cc: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I50d1e21277ef64dcb1d58d7f1c062dc913cfee74
(cherry picked from commit dd8418a59a40ac8bda0f3a23a8f3fae439d0cc9e)
commit ff7a167961d1b97e0e205f245f806e564d3505e7 upstream.
With the introduction of PRMT in the ACPI subsystem, the EFI rts
workqueue is no longer the only caller of efi_call_virt_pointer() in the
kernel. This means the EFI runtime services lock is no longer sufficient
to manage concurrent calls into firmware, but also that firmware calls
may occur that are not marshalled via the workqueue mechanism, but
originate directly from the caller context.
For added robustness, and to ensure that the runtime services have 8 KiB
of stack space available as per the EFI spec, introduce a spinlock
protected EFI runtime stack of 8 KiB, where the spinlock also ensures
serialization between the EFI rts workqueue (which itself serializes EFI
runtime calls) and other callers of efi_call_virt_pointer().
While at it, use the stack pivot to avoid reloading the shadow call
stack pointer from the ordinary stack, as doing so could produce a
gadget to defeat it.
Bug: 260821414
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Cc: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ie961576ae93cafc315cb37fb84cca0a6402eda59
(cherry picked from commit 67884a649c141a44d91400df6ca0a5ef55e1771a)
[Lee: Swap-out the non-existent __vmalloc_node() for __vmalloc_node_range()]
(cherry picked from commit 8a060ef276605531bc52ffabb4137b1dbacb1824)
Signed-off-by: Lee Jones <joneslee@google.com>
No upstream commit exists for this patch.
Don't free the request unconditionally, if the request is issued async
then someone else may be holding a submit reference to it.
Bug: 278721720
Reported-and-tested-by: Lee Jones <lee@kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 9ba28194ea)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I05b6b0959befa4825aba60c397a115701e9b64ee
No upstream commit exists for this patch.
If we drop the lock right after adding it to the timeout list, then
someone attempting to kill timeouts will find it in an indeterminate
state. That means that cancelation could attempt to cancel and remove
a timeout, and then io_timeout() proceeds to init and add the timer
afterwards.
Ensure the timeout request is fully setup before we drop the
completion lock, which guards cancelation as well.
Bug: 278721720
Reported-and-tested-by: Lee Jones <lee@kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 6de3014d4b)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I6247b62e07825a0f06c7997d767dfc26fc4126e3
No upstream commit exists for this patch.
It's not necessarily safe to check the task_list locklessly, remove
this micro optimization and always grab task_lock before deeming it
empty.
Bug: 278721720
Reported-and-tested-by: Lee Jones <lee@kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit b0bfceaa8c)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I112708bdbe43f0e1c2cad5e73a56d7609c10d339
