Commit graph android_kernel_motorola_sm6375/scripts
Author SHA1 Message Date
Michael Bestas
376925d57f
Merge remote-tracking branch 'sm8350/lineage-20' into lineage-23.2
* sm8350/lineage-20: (306 commits)
  ANDROID: gki_defconfig: reduce KFENCE pool size
  ANDROID: GKI: enable KFENCE by setting the sample interval to 500ms
  ANDROID: GKI: Enable KFENCE
  UPSTREAM: random: split initialization into early step and later step
  UPSTREAM: kfence: avoid passing -g for test
  UPSTREAM: net: add and use skb_unclone_keeptruesize() helper
  UPSTREAM: kfence: fix memory leak when cat kfence objects
  UPSTREAM: kfence: unconditionally use unbound work queue
  UPSTREAM: kfence: use TASK_IDLE when awaiting allocation
  UPSTREAM: kfence: fix is_kfence_address() for addresses below KFENCE_POOL_SIZE
  FROMLIST: kfence: skip all GFP_ZONEMASK allocations
  FROMLIST: kfence: move the size check to the beginning of __kfence_alloc()
  ANDROID: kasan: fix interoperability with KFENCE
  UPSTREAM: arm64: mm: don't use CON and BLK mapping if KFENCE is enabled
  ANDROID: kfence: clean up unused variables
  FROMGIT: kfence: use power-efficient work queue to run delayed work
  FROMGIT: kfence: maximize allocation wait timeout duration
  FROMGIT: kfence: await for allocation using wait_event
  FROMGIT: kfence: zero guard page after out-of-bounds access
  UPSTREAM: kfence: make compatible with kmemleak
  ...

Change-Id: Id1436b77692839dc2394f500bba42487fac1b2b4
2026-05-07 18:19:43 +03:00
Nathan Chancellor
74212e4117
BACKPORT: kbuild: Switch to 'f' variants of integrated assembler flag
commit 2185a7e4b0ade86c2c57fc63d4a7535c40254bd0 upstream.

It has been brought up a few times in various code reviews that clang
3.5 introduced -f{,no-}integrated-as as the preferred way to enable and
disable the integrated assembler, mentioning that -{no-,}integrated-as
are now considered legacy flags.

Switch the kernel over to using those variants in case there is ever a
time where clang decides to remove the non-'f' variants of the flag.

Also, fix a typo in a comment ("intergrated" -> "integrated").

Link: https://releases.llvm.org/3.5.0/tools/clang/docs/ReleaseNotes.html#new-compiler-flags
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Change-Id: Id848bd57d5e27afb85cf51c26d9312751168407e
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
[nathan: Backport to 5.10]
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-05 20:02:23 +03:00
Masahiro Yamada
9c8324ac4b
BACKPORT: kbuild: check the minimum assembler version in Kconfig
Documentation/process/changes.rst defines the minimum assembler version
(binutils version), but we have never checked it in the build time.

Kbuild never invokes 'as' directly because all assembly files in the
kernel tree are *.S, hence must be preprocessed. I do not expect
raw assembly source files (*.s) would be added to the kernel tree.

Therefore, we always use $(CC) as the assembler driver, and commit
aa824e0c962b ("kbuild: remove AS variable") removed 'AS'. However,
we are still interested in the version of the assembler acting behind.

As usual, the --version option prints the version string.

  $ as --version | head -n 1
  GNU assembler (GNU Binutils for Ubuntu) 2.35.1

But, we do not have $(AS). So, we can add the -Wa prefix so that
$(CC) passes --version down to the backing assembler.

  $ gcc -Wa,--version | head -n 1
  gcc: fatal error: no input files
  compilation terminated.

OK, we need to input something to satisfy gcc.

  $ gcc -Wa,--version -c -x assembler /dev/null -o /dev/null | head -n 1
  GNU assembler (GNU Binutils for Ubuntu) 2.35.1

The combination of Clang and GNU assembler works in the same way:

  $ clang -no-integrated-as -Wa,--version -c -x assembler /dev/null -o /dev/null | head -n 1
  GNU assembler (GNU Binutils for Ubuntu) 2.35.1

Clang with the integrated assembler fails like this:

  $ clang -integrated-as -Wa,--version -c -x assembler /dev/null -o /dev/null | head -n 1
  clang: error: unsupported argument '--version' to option 'Wa,'

For the last case, checking the error message is fragile. If the
proposal for -Wa,--version support [1] is accepted, this may not be
even an error in the future.

One easy way is to check if -integrated-as is present in the passed
arguments. We did not pass -integrated-as to CLANG_FLAGS before, but
we can make it explicit.

Nathan pointed out -integrated-as is the default for all of the
architectures/targets that the kernel cares about, but it goes
along with "explicit is better than implicit" policy. [2]

With all this in my mind, I implemented scripts/as-version.sh to
check the assembler version in Kconfig time.

  $ scripts/as-version.sh gcc
  GNU 23501
  $ scripts/as-version.sh clang -no-integrated-as
  GNU 23501
  $ scripts/as-version.sh clang -integrated-as
  LLVM 0

[1]: https://github.com/ClangBuiltLinux/linux/issues/1320
[2]: https://lore.kernel.org/linux-kbuild/20210307044253.v3h47ucq6ng25iay@archlinux-ax161/

Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
[nd: conflict in arch/Kconfig due to missing dc5723b02e523 ("kbuild: add
  support for Clang LTO") which landed in v5.12-rc1]
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
(cherry picked from commit ba64beb17493a4bfec563100c86a462a15926f24)
Bug: 210043760
Change-Id: I9bcc528adbb86fa902123611ce979af0dd455ad5
2026-05-05 20:02:23 +03:00
Masahiro Yamada
0458cbd793
UPSTREAM: kbuild: simplify GCC_PLUGINS enablement in dummy-tools/gcc
commit f4c3b83b75b91c5059726cb91e3165cc01764ce7 upstream.

With commit 1e860048c53e ("gcc-plugins: simplify GCC plugin-dev
capability test") applied, this hunk can be way simplified because
now scripts/gcc-plugins/Kconfig only checks plugin-version.h

Change-Id: Ic718951bcba65cdfe92ac2b8b6857ad96424408c
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-05 20:02:22 +03:00
Jiri Slaby
f8e9ee98c3
UPSTREAM: kbuild: dummy-tools: fix inverted tests for gcc
[ Upstream commit b3d9fc1436808a4ef9927e558b3415e728e710c5 ]

There is a test in Kconfig which takes inverted value of a compiler
check:
* config CC_HAS_INT128
        def_bool !$(cc-option,$(m64-flag) -D__SIZEOF_INT128__=0)

This results in CC_HAS_INT128 not being in super-config generated by
dummy-tools. So take this into account in the gcc script.

Change-Id: Iaf7eb5d969bd92617c622a164bf7a2db58675932
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2026-05-05 20:02:22 +03:00
Masahiro Yamada
83fb6ffcab
UPSTREAM: kbuild: add dummy toolchains to enable all cc-option etc. in Kconfig
Staring v4.18, Kconfig evaluates compiler capabilities, and hides CONFIG
options your compiler does not support. This works well if you configure
and build the kernel on the same host machine.

It is inconvenient if you prepare the .config that is carried to a
different build environment (typically this happens when you package
the kernel for distros) because using a different compiler potentially
produces different CONFIG options than the real build environment.
So, you probably want to make as many options visible as possible.
In other words, you need to create a super-set of CONFIG options that
cover any build environment. If some of the CONFIG options turned out
to be unsupported on the build machine, they are automatically disabled
by the nature of Kconfig.

However, it is not feasible to get a full-featured compiler for every
arch.

This issue was discussed here:

  https://lkml.org/lkml/2019/12/9/620

Other than distros, savedefconfig is also a problem. Some arch sub-systems
periodically resync defconfig files. If you use a less-capable compiler
for savedefconfig, options that do not meet 'depends on $(cc-option,...)'
will be forcibly disabled. So, 'make defconfig && make savedefconfig'
may silently change the behavior.

This commit adds a set of dummy toolchains that pretend to support any
feature.

Most of compiler features are tested by cc-option, which simply checks
the exit code of $(CC). The dummy tools are shell scripts that always
exit with 0. So, $(cc-option, ...) is evaluated as 'y'.

There are more complicated checks such as:

  scripts/gcc-x86_{32,64}-has-stack-protector.sh
  scripts/gcc-plugin.sh
  scripts/tools-support-relr.sh

scripts/dummy-tools/gcc passes all checks.

From the top directory of the source tree, you can do:

   $ make CROSS_COMPILE=scripts/dummy-tools/ oldconfig

Change-Id: Ic0ed9f3c73888a14c38c5ce546bc171b479c35ed
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
Tested-by: Jeremy Cline <jcline@redhat.com>
2026-05-05 20:02:22 +03:00
Michael Bestas
2eb0f824a1
Merge remote-tracking branch 'sm8350/lineage-20' into lineage-23.0
* sm8350/lineage-20: (841 commits)
  UPSTREAM: fs: prevent out-of-bounds array speculation when closing a file descriptor
  UPSTREAM: file: let pick_file() tell caller it's done
  BACKPORT: rcu-tasks: Add a grace-period start time for throttling and debug
  BACKPORT: maccess: rename probe_user_{read,write} to copy_{from,to}_user_nofault
  BACKPORT: powerpc: use probe_user_read() and probe_user_write()
  BACKPORT: maccess: rename probe_kernel_address to get_kernel_nofault
  BACKPORT: tracing/kprobes: handle mixed kernel/userspace probes better
  BACKPORT: maccess: rename probe_kernel_{read,write} to copy_{from,to}_kernel_nofault
  UPSTREAM: maccess: unexport probe_kernel_write()
  UPSTREAM: maccess: return -ERANGE when probe_kernel_read() fails
  UPSTREAM: maccess: allow architectures to provide kernel probing directly
  BACKPORT: maccess: remove strncpy_from_unsafe
  UPSTREAM: bpf:bpf_seq_printf(): handle potentially unsafe format string better
  UPSTREAM: bpf: Use strncpy_from_unsafe_strict() in bpf_seq_printf() helper
  UPSTREAM: bpf: handle the compat string in bpf_trace_copy_string better
  UPSTREAM: bpf: factor out a bpf_trace_copy_string helper
  BACKPORT: maccess: always use strict semantics for probe_kernel_read
  UPSTREAM: maccess: unify the probe kernel arch hooks
  UPSTREAM: maccess: remove probe_read_common and probe_write_common
  UPSTREAM: maccess: remove duplicate kerneldoc comments
  ...

Change-Id: I22cf7d6fb34826727904effb4f012b0ef459149d
2026-01-20 20:47:39 +02:00
Toke Høiland-Jørgensen
39a4763712
UPSTREAM: bpf: Fix bpf_redirect_neigh helper api to support supplying nexthop
Based on the discussion in [0], update the bpf_redirect_neigh() helper to
accept an optional parameter specifying the nexthop information. This makes
it possible to combine bpf_fib_lookup() and bpf_redirect_neigh() without
incurring a duplicate FIB lookup - since the FIB lookup helper will return
the nexthop information even if no neighbour is present, this can simply
be passed on to bpf_redirect_neigh() if bpf_fib_lookup() returns
BPF_FIB_LKUP_RET_NO_NEIGH. Thus fix & extend it before helper API is frozen.

  [0] https://lore.kernel.org/bpf/393e17fc-d187-3a8d-2f0d-a627c7c63fca@iogearbox.net/

Change-Id: I9125e1738abc703d49ebe59ed9f976c9343334aa
Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://lore.kernel.org/bpf/160322915615.32199.1187570224032024535.stgit@toke.dk
2026-01-14 18:12:45 -08:00
Alan Maguire
c78911e5b1
UPSTREAM: bpf: Add bpf_snprintf_btf helper
A helper is added to support tracing kernel type information in BPF
using the BPF Type Format (BTF).  Its signature is

long bpf_snprintf_btf(char *str, u32 str_size, struct btf_ptr *ptr,
		      u32 btf_ptr_size, u64 flags);

struct btf_ptr * specifies

- a pointer to the data to be traced
- the BTF id of the type of data pointed to
- a flags field is provided for future use; these flags
  are not to be confused with the BTF_F_* flags
  below that control how the btf_ptr is displayed; the
  flags member of the struct btf_ptr may be used to
  disambiguate types in kernel versus module BTF, etc;
  the main distinction is the flags relate to the type
  and information needed in identifying it; not how it
  is displayed.

For example a BPF program with a struct sk_buff *skb
could do the following:

	static struct btf_ptr b = { };

	b.ptr = skb;
	b.type_id = __builtin_btf_type_id(struct sk_buff, 1);
	bpf_snprintf_btf(str, sizeof(str), &b, sizeof(b), 0, 0);

Default output looks like this:

(struct sk_buff){
 .transport_header = (__u16)65535,
 .mac_header = (__u16)65535,
 .end = (sk_buff_data_t)192,
 .head = (unsigned char *)0x000000007524fd8b,
 .data = (unsigned char *)0x000000007524fd8b,
 .truesize = (unsigned int)768,
 .users = (refcount_t){
  .refs = (atomic_t){
   .counter = (int)1,
  },
 },
}

Flags modifying display are as follows:

- BTF_F_COMPACT:	no formatting around type information
- BTF_F_NONAME:		no struct/union member names/types
- BTF_F_PTR_RAW:	show raw (unobfuscated) pointer values;
			equivalent to %px.
- BTF_F_ZERO:		show zero-valued struct/union members;
			they are not displayed by default

Change-Id: Ic45d195264ae573cc1b2e1e49304edd4c91a1c65
Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/1601292670-1616-4-git-send-email-alan.maguire@oracle.com
2026-01-14 18:12:37 -08:00
Jiri Olsa
73ea92cc7a
UPSTREAM: bpf: Add d_path helper
Adding d_path helper function that returns full path for
given 'struct path' object, which needs to be the kernel
BTF 'path' object. The path is returned in buffer provided
'buf' of size 'sz' and is zero terminated.

  bpf_d_path(&file->f_path, buf, size);

The helper calls directly d_path function, so there's only
limited set of function it can be called from. Adding just
very modest set for the start.

Updating also bpf.h tools uapi header and adding 'path' to
bpf_helpers_doc.py script.

Change-Id: Ic530ea9da08f5f6479bfd7a5b7c8c26d7d4aaa66
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Andrii Nakryiko <andriin@fb.com>
Acked-by: KP Singh <kpsingh@google.com>
Link: https://lore.kernel.org/bpf/20200825192124.710397-11-jolsa@kernel.org
2026-01-14 18:12:23 -08:00
Jakub Sitnicki
c4937609e1
UPSTREAM: bpf: Introduce SK_LOOKUP program type with a dedicated attach point
Add a new program type BPF_PROG_TYPE_SK_LOOKUP with a dedicated attach type
BPF_SK_LOOKUP. The new program kind is to be invoked by the transport layer
when looking up a listening socket for a new connection request for
connection oriented protocols, or when looking up an unconnected socket for
a packet for connection-less protocols.

When called, SK_LOOKUP BPF program can select a socket that will receive
the packet. This serves as a mechanism to overcome the limits of what
bind() API allows to express. Two use-cases driving this work are:

 (1) steer packets destined to an IP range, on fixed port to a socket

     192.0.2.0/24, port 80 -> NGINX socket

 (2) steer packets destined to an IP address, on any port to a socket

     198.51.100.1, any port -> L7 proxy socket

In its run-time context program receives information about the packet that
triggered the socket lookup. Namely IP version, L4 protocol identifier, and
address 4-tuple. Context can be further extended to include ingress
interface identifier.

To select a socket BPF program fetches it from a map holding socket
references, like SOCKMAP or SOCKHASH, and calls bpf_sk_assign(ctx, sk, ...)
helper to record the selection. Transport layer then uses the selected
socket as a result of socket lookup.

In its basic form, SK_LOOKUP acts as a filter and hence must return either
SK_PASS or SK_DROP. If the program returns with SK_PASS, transport should
look for a socket to receive the packet, or use the one selected by the
program if available, while SK_DROP informs the transport layer that the
lookup should fail.

This patch only enables the user to attach an SK_LOOKUP program to a
network namespace. Subsequent patches hook it up to run on local delivery
path in ipv4 and ipv6 stacks.

Suggested-by: Marek Majkowski <marek@cloudflare.com>
Change-Id: I4a245236f759b4789883365ffea7ef1e793c3ac8
Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20200717103536.397595-3-jakub@cloudflare.com
2026-01-14 18:12:05 -08:00
Jiri Olsa
7c693559e6
BACKPORT: bpf: Resolve BTF IDs in vmlinux image
Using BTF_ID_LIST macro to define lists for several helpers
using BTF arguments.

And running resolve_btfids on vmlinux elf object during linking,
so the .BTF_ids section gets the IDs resolved.

Change-Id: I7299a611fb88195d58b2899e37d2ef5ded84e158
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Tested-by: Andrii Nakryiko <andriin@fb.com>
Acked-by: Andrii Nakryiko <andriin@fb.com>
Link: https://lore.kernel.org/bpf/20200711215329.41165-5-jolsa@kernel.org
2026-01-14 18:12:02 -08:00
Song Liu
01067412db
UPSTREAM: bpf: Introduce helper bpf_get_task_stack()
Introduce helper bpf_get_task_stack(), which dumps stack trace of given
task. This is different to bpf_get_stack(), which gets stack track of
current task. One potential use case of bpf_get_task_stack() is to call
it from bpf_iter__task and dump all /proc/<pid>/stack to a seq_file.

bpf_get_task_stack() uses stack_trace_save_tsk() instead of
get_perf_callchain() for kernel stack. The benefit of this choice is that
stack_trace_save_tsk() doesn't require changes in arch/. The downside of
using stack_trace_save_tsk() is that stack_trace_save_tsk() dumps the
stack trace to unsigned long array. For 32-bit systems, we need to
translate it to u64 array.

Change-Id: I8ed75e8c319732433a0ea1dd05951176ca81d1dd
Signed-off-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Andrii Nakryiko <andriin@fb.com>
Link: https://lore.kernel.org/bpf/20200630062846.664389-3-songliubraving@fb.com
2026-01-14 18:12:01 -08:00
Yonghong Song
a5669bfd40
UPSTREAM: bpf: Add bpf_skc_to_udp6_sock() helper
The helper is used in tracing programs to cast a socket
pointer to a udp6_sock pointer.
The return value could be NULL if the casting is illegal.

Change-Id: If6ef5992dcf07b5b8171c8221078d0f96fdce956
Signed-off-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Cc: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/bpf/20200623230815.3988481-1-yhs@fb.com
2026-01-14 17:53:11 -08:00
Yonghong Song
96a11e9fba
UPSTREAM: bpf: Add bpf_skc_to_{tcp, tcp_timewait, tcp_request}_sock() helpers
Three more helpers are added to cast a sock_common pointer to
an tcp_sock, tcp_timewait_sock or a tcp_request_sock for
tracing programs.

Change-Id: I43e998912a1e786d8f96e01e9a331554832d29be
Signed-off-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/20200623230811.3988277-1-yhs@fb.com
2026-01-14 17:53:11 -08:00
Yonghong Song
2c45a6f681
UPSTREAM: bpf: Add bpf_skc_to_tcp6_sock() helper
The helper is used in tracing programs to cast a socket
pointer to a tcp6_sock pointer.
The return value could be NULL if the casting is illegal.

A new helper return type RET_PTR_TO_BTF_ID_OR_NULL is added
so the verifier is able to deduce proper return types for the helper.

Different from the previous BTF_ID based helpers,
the bpf_skc_to_tcp6_sock() argument can be several possible
btf_ids. More specifically, all possible socket data structures
with sock_common appearing in the first in the memory layout.
This patch only added socket types related to tcp and udp.

All possible argument btf_id and return value btf_id
for helper bpf_skc_to_tcp6_sock() are pre-calculcated and
cached. In the future, it is even possible to precompute
these btf_id's at kernel build time.

Change-Id: I42addc1779489c7e2ba1de30a59e009b1ba21f80
Signed-off-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Andrii Nakryiko <andriin@fb.com>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/20200623230809.3988195-1-yhs@fb.com
2026-01-14 17:53:11 -08:00
Quentin Monnet
2853254cac
UPSTREAM: bpf: Minor fixes to BPF helpers documentation
Minor improvements to the documentation for BPF helpers:

* Fix formatting for the description of "bpf_socket" for
  bpf_getsockopt() and bpf_setsockopt(), thus suppressing two warnings
  from rst2man about "Unexpected indentation".
* Fix formatting for return values for bpf_sk_assign() and seq_file
  helpers.
* Fix and harmonise formatting, in particular for function/struct names.
* Remove blank lines before "Return:" sections.
* Replace tabs found in the middle of text lines.
* Fix typos.
* Add a note to the footer (in Python script) about "bpftool feature
  probe", including for listing features available to unprivileged
  users, and add a reference to bpftool man page.

Thanks to Florian for reporting two typos (duplicated words).

Change-Id: Id1681928961a440b37ffaa027ffc160f1a957fcd
Signed-off-by: Quentin Monnet <quentin@isovalent.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20200511161536.29853-4-quentin@isovalent.com
2025-12-23 13:36:21 -08:00
Yonghong Song
26a17770c4
UPSTREAM: bpf: Add bpf_seq_printf and bpf_seq_write helpers
Two helpers bpf_seq_printf and bpf_seq_write, are added for
writing data to the seq_file buffer.

bpf_seq_printf supports common format string flag/width/type
fields so at least I can get identical results for
netlink and ipv6_route targets.

For bpf_seq_printf and bpf_seq_write, return value -EOVERFLOW
specifically indicates a write failure due to overflow, which
means the object will be repeated in the next bpf invocation
if object collection stays the same. Note that if the object
collection is changed, depending how collection traversal is
done, even if the object still in the collection, it may not
be visited.

For bpf_seq_printf, format %s, %p{i,I}{4,6} needs to
read kernel memory. Reading kernel memory may fail in
the following two cases:
  - invalid kernel address, or
  - valid kernel address but requiring a major fault
If reading kernel memory failed, the %s string will be
an empty string and %p{i,I}{4,6} will be all 0.
Not returning error to bpf program is consistent with
what bpf_trace_printk() does for now.

bpf_seq_printf may return -EBUSY meaning that internal percpu
buffer for memory copy of strings or other pointees is
not available. Bpf program can return 1 to indicate it
wants the same object to be repeated. Right now, this should not
happen on no-RT kernels since migrate_disable(), which guards
bpf prog call, calls preempt_disable().

Change-Id: I9d79c2ed32e2ef2276a17c37fcde5a634d71ed8f
Signed-off-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Andrii Nakryiko <andriin@fb.com>
Link: https://lore.kernel.org/bpf/20200509175914.2476661-1-yhs@fb.com
2025-12-23 13:36:20 -08:00
Carlos Neira
08bceb2e5a
BACKPORT: bpf: Added new helper bpf_get_ns_current_pid_tgid
New bpf helper bpf_get_ns_current_pid_tgid,
This helper will return pid and tgid from current task
which namespace matches dev_t and inode number provided,
this will allows us to instrument a process inside a container.

Change-Id: I77f95343f8252baf6b26b16ccfc0179e9b81f159
Signed-off-by: Carlos Neira <cneirabustos@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20200304204157.58695-3-cneirabustos@gmail.com
2025-12-23 13:36:04 -08:00
Michael Bestas
ad91405468
Merge remote-tracking branch 'sm8350/lineage-20' into lineage-23.0
* sm8350/lineage-20:
  tcp: Fix compiler error due to type confusion
  fixup! net: usb: rtl8150: Fix frame padding
  Linux 5.4.302
  Input: pegasus-notetaker - fix potential out-of-bounds access
  Input: remove third argument of usb_maxpacket()
  usb: deprecate the third argument of usb_maxpacket()
  ata: libata-scsi: Fix system suspend for a security locked drive
  fs/proc: fix uaf in proc_readdir_de()
  pmdomain: imx: Fix reference count leak in imx_gpc_remove
  pmdomain: arm: scmi: Fix genpd leak on provider registration failure
  net: netpoll: fix incorrect refcount handling causing incorrect cleanup
  net: qede: Initialize qede_ll_ops with designated initializer
  uio_hv_generic: Set event for all channels on the device
  net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error
  ALSA: usb-audio: fix uac2 clock source at terminal parser
  mm/page_alloc: fix hash table order logging in alloc_large_system_hash()
  kconfig/nconf: Initialize the default locale at startup
  kconfig/mconf: Initialize the default locale at startup
  vsock: Ignore signal/timeout on connect() if already established
  s390/ctcm: Fix double-kfree
  ...

 Conflicts:
	drivers/usb/gadget/configfs.c

Change-Id: I23044bb8ce42b6bd65eb30d909c4dba15ae3f915
2025-12-19 12:14:09 +02:00
basamaryan
9181ada660
Merge branch 'android11-5.4-lts' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
* 'android11-5.4-lts' of https://android.googlesource.com/kernel/common:
  Linux 5.4.302
  Input: pegasus-notetaker - fix potential out-of-bounds access
  Input: remove third argument of usb_maxpacket()
  usb: deprecate the third argument of usb_maxpacket()
  ata: libata-scsi: Fix system suspend for a security locked drive
  fs/proc: fix uaf in proc_readdir_de()
  pmdomain: imx: Fix reference count leak in imx_gpc_remove
  pmdomain: arm: scmi: Fix genpd leak on provider registration failure
  net: netpoll: fix incorrect refcount handling causing incorrect cleanup
  net: qede: Initialize qede_ll_ops with designated initializer
  uio_hv_generic: Set event for all channels on the device
  net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error
  ALSA: usb-audio: fix uac2 clock source at terminal parser
  mm/page_alloc: fix hash table order logging in alloc_large_system_hash()
  kconfig/nconf: Initialize the default locale at startup
  kconfig/mconf: Initialize the default locale at startup
  vsock: Ignore signal/timeout on connect() if already established
  s390/ctcm: Fix double-kfree
  net: openvswitch: remove never-working support for setting nsh fields
  mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats()
  MIPS: Malta: Fix !EVA SOC-it PCI MMIO
  scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()
  scsi: sg: Do not sleep in atomic context
  Input: cros_ec_keyb - fix an invalid memory access
  be2net: pass wrb_params in case of OS2BMC
  HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155
  isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe()
  EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection
  EDAC/altera: Handle OCRAM ECC enable after warm reset
  spi: Try to get ACPI GPIO IRQ earlier
  ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe
  strparser: Fix signed/unsigned mismatch bug
  gcov: add support for GCC 15
  mm/ksm: fix flag-dropping behavior in ksm_madvise
  ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd
  drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE
  ASoC: cs4271: Fix regulator leak on probe failure
  regulator: fixed: fix GPIO descriptor leak on register failure
  regulator: fixed: use dev_err_probe for register
  Bluetooth: L2CAP: export l2cap_chan_hold for modules
  net_sched: limit try_bulk_dequeue_skb() batches
  net_sched: remove need_resched() from qdisc_run()
  net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps
  net/mlx5e: Fix maxrate wraparound in threshold between units
  net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak
  wifi: mac80211: skip rate verification for not captured PSDUs
  net: mdio: fix resource leak in mdiobus_register_device()
  tipc: Fix use-after-free in tipc_mon_reinit_self().
  tipc: simplify the finalize work queue
  sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto
  sctp: get netns from asoc and ep base
  Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions
  Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion
  Bluetooth: 6lowpan: reset link-local header on ipv6 recv path
  Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF
  net: fec: correct rx_bytes statistic for the case SHIFT16 is set
  ASoC: max98090/91: fixed max98091 ALSA widget powering up/down
  HID: quirks: avoid Cooler Master MM712 dongle wakeup bug
  NFS4: Fix state renewals missing after boot
  compiler_types: Move unused static inline functions warning to W=2
  extcon: adc-jack: Cleanup wakeup source only if it was enabled
  tracing: Fix memory leaks in create_field_var()
  net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup
  sctp: Prevent TOCTOU out-of-bounds write
  sctp: Hold RCU read lock while iterating over address list
  net: dsa: b53: stop reading ARL entries if search is done
  net: dsa: b53: fix enabling ip multicast
  net: dsa: b53: fix resetting speed and pause on forced link
  net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325
  net: dsa/b53: change b53_force_port_config() pause argument
  net: vlan: sync VLAN features with lower device
  ceph: add checking of wait_for_completion_killable() return value
  fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
  ACPI: property: Return present device nodes only on fwnode interface
  9p: sysfs_init: don't hardcode error to ENOMEM
  9p: fix /sys/fs/9p/caches overwriting itself
  fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink
  ACPICA: Update dsmethod.c to get rid of unused variable warning
  orangefs: fix xattr related buffer overflow...
  page_pool: Clamp pool size to max 16K pages
  Bluetooth: bcsp: receive data only if registered
  Bluetooth: SCO: Fix UAF on sco_conn_free
  net: macb: avoid dealing with endianness in macb_set_hwaddr()
  nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing
  NFSv4.1: fix mount hang after CREATE_SESSION failure
  NFSv4: handle ERR_GRACE on delegation recalls
  remoteproc: qcom: q6v5: Avoid handling handover twice
  sparc/module: Add R_SPARC_UA64 relocation handling
  net: intel: fm10k: Fix parameter idx set but not used
  jfs: fix uninitialized waitqueue in transaction manager
  jfs: Verify inode mode when loading from disk
  ipv6: np->rxpmtu race annotation
  usb: xhci: plat: Facilitate using autosuspend for xhci plat devices
  usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs
  allow finish_no_open(file, ERR_PTR(-E...))
  scsi: lpfc: Define size of debugfs entry for xri rebalancing
  scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET
  selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency
  net/cls_cgroup: Fix task_get_classid() during qdisc run
  selftests: Replace sleep with slowwait
  selftests: Disable dad for ipv6 in fcnal-test.sh
  media: redrat3: use int type to store negative error codes
  net: sh_eth: Disable WoL if system can not suspend
  phy: cadence: cdns-dphy: Enable lower resolutions in dphy
  usb: gadget: f_hid: Fix zero length packet transfer
  net: call cond_resched() less often in __release_sock()
  ALSA: usb-audio: apply quirk for MOONDROP Quark2
  net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms
  dmaengine: dw-edma: Set status for callback_result
  dmaengine: mv_xor: match alloc_wc and free_wc
  dmaengine: sh: setup_xref error handling
  scsi: pm8001: Use int instead of u32 to store error codes
  mips: lantiq: xway: sysctrl: rename stp clock
  mips: lantiq: danube: add missing device_type in pci node
  mips: lantiq: danube: add missing properties to cpu node
  media: fix uninitialized symbol warnings
  drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption
  extcon: adc-jack: Fix wakeup source leaks on device unbind
  rds: Fix endianness annotation for RDS_MPATH_HASH
  PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call
  net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV.
  net: When removing nexthops, don't call synchronize_net if it is not necessary
  char: misc: Does not request module for miscdevice with dynamic minor
  usb: gadget: f_ncm: Fix MAC assignment NCM ethernet
  iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register
  media: imon: make send_packet() more robust
  net: ipv6: fix field-spanning memcpy warning in AH output
  bridge: Redirect to backup port when port is administratively down
  powerpc/eeh: Use result of error_detected() in uevent
  x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall
  media: pci: ivtv: Don't create fake v4l2_fh
  drm/amdkfd: return -ENOTTY for unsupported IOCTLs
  selftests/net: Ensure assert() triggers in psock_tpacket.c
  selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8
  PCI: Disable MSI on RDC PCI to PCIe bridges
  drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf()
  mfd: madera: Work around false-positive -Wininitialized warning
  mfd: stmpe-i2c: Add missing MODULE_LICENSE
  mfd: stmpe: Remove IRQ domain upon removal
  tools/power x86_energy_perf_policy: Prefer driver HWP limits
  tools/power x86_energy_perf_policy: Enhance HWP enable
  tools/cpupower: Fix incorrect size in cpuidle_state_disable()
  hwmon: (dell-smm) Add support for Dell OptiPlex 7040
  uprobe: Do not emulate/sstep original instruction when ip is changed
  clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel
  video: backlight: lp855x_bl: Set correct EPROM start for LP8556
  tee: allow a driver to allocate a tee_device without a pool
  ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method()
  mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
  irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
  arc: Fix __fls() const-foldability via __builtin_clzl()
  cpufreq/longhaul: handle NULL policy in longhaul_exit
  selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2
  ACPI: video: force native for Lenovo 82K8
  memstick: Add timeout to prevent indefinite waiting
  mmc: host: renesas_sdhi: Fix the actual clock
  bpf: Don't use %pK through printk
  spi: loopback-test: Don't use %pK through printk
  soc: qcom: smem: Fix endian-unaware access of num_entries
  usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
  serial: 8250_dw: handle reset control deassert error
  serial: 8250_dw: Use devm_add_action_or_reset()
  serial: 8250_dw: Use devm_clk_get_optional() to get the input clock
  can: gs_usb: increase max interface to U8_MAX
  devcoredump: Fix circular locking dependency with devcd->mutex.
  net: ravb: Enforce descriptor type ordering
  x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID
  wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode
  net: phy: dp83867: Disable EEE support as not implemented
  regmap: slimbus: fix bus_context pointer in regmap init calls
  drm/etnaviv: fix flush sequence logic
  usbnet: Prevents free active kevent
  wifi: ath10k: Fix memory leak on unsupported WMI command
  ASoC: qdsp6: q6asm: do not sleep while atomic
  fbdev: valkyriefb: Fix reference count leak in valkyriefb_init
  fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS
  fbdev: bitblit: bound-check glyph index in bit_putcs*
  ACPI: video: Fix use-after-free in acpi_video_switch_brightness()
  fbdev: atyfb: Check if pll_ops->init_pll failed
  net: usb: asix_devices: Check return value of usbnet_get_endpoints
  btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot()
  x86/bugs: Fix reporting of LFENCE retpoline
  net/sched: sch_qfq: Fix null-deref in agg_dequeue

 Conflicts:
	drivers/mmc/host/sdhci-msm.c
	drivers/usb/host/xhci-plat.c

Change-Id: I30739fea8840ace3825ea8955598d9efa687bb27
2025-12-11 01:41:51 -08:00
Greg Kroah-Hartman
ca00e0f525 This is the 5.4.302 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmkwI4sACgkQONu9yGCS
 aT46Mg//f9a0IiDkO2ybqt7JAStVCkQ5MM2CgPjlgHGyns6hWyxUES5twrVrTO0v
 mdYmeXLztyFSArUHMnoWcUK1O4IVUVK32SX3eEMFy81ojX+LpYm/m5TZg3tU1rvq
 jaTE0i6ihmwG48ciB63i28TxQfhY8QuVJTEV400Ro+ILY2hs1l6c6DYf9i0S/v4g
 gKDQpzuwR0AnGNFI+D6D6D0D8jbLVcBYnAndyvDrLYTIILczf7nJ66ZePYTBvlg3
 rIiIMjG0BX0V2ctPmez3mz0BDTpnZY4pwIwIG8K/bX4UZrgOKJPSZWh1SzbASaGN
 vTJQwRs9nGHvM/kK9CUUsi1+hhaAl7UmQEiRJ06BkXlR7chFCcL/fI/VEQjf12wL
 dyw6/RR/rXPxLbLxCYk+9C9ANTE/ByirLKSeJkNT/yoeiCSpaFuKxtoYkNslBK/B
 i0/Qweez0IzJuVUtUp/2/PrkNKyCaEbbqhDerbnLhU/0lcnT0fkFlFoLLLNzxNdt
 hj6RRJrcpoQB+Qrkf0+5Sxx6W1feP5clZJ2nRSL+rtUNEzCWk7HVh4GprCyvDn6i
 xjINN9Yh40suJkuKaE0+IrPF1tcL3/128OaT3e0VlL57wK5M4YmJTwrb7g4mlR2/
 31Z4bL1IFYju9WYPW2fWHrdrZUH4h22vLcpW6Q/VFdG0wTC6wVc=
 =Wt2i
 -----END PGP SIGNATURE-----

Merge 5.4.302 into android11-5.4-lts

Changes in 5.4.302
	net/sched: sch_qfq: Fix null-deref in agg_dequeue
	x86/bugs: Fix reporting of LFENCE retpoline
	btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot()
	net: usb: asix_devices: Check return value of usbnet_get_endpoints
	fbdev: atyfb: Check if pll_ops->init_pll failed
	ACPI: video: Fix use-after-free in acpi_video_switch_brightness()
	fbdev: bitblit: bound-check glyph index in bit_putcs*
	fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS
	fbdev: valkyriefb: Fix reference count leak in valkyriefb_init
	ASoC: qdsp6: q6asm: do not sleep while atomic
	wifi: ath10k: Fix memory leak on unsupported WMI command
	usbnet: Prevents free active kevent
	drm/etnaviv: fix flush sequence logic
	regmap: slimbus: fix bus_context pointer in regmap init calls
	net: phy: dp83867: Disable EEE support as not implemented
	wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode
	x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID
	net: ravb: Enforce descriptor type ordering
	devcoredump: Fix circular locking dependency with devcd->mutex.
	can: gs_usb: increase max interface to U8_MAX
	serial: 8250_dw: Use devm_clk_get_optional() to get the input clock
	serial: 8250_dw: Use devm_add_action_or_reset()
	serial: 8250_dw: handle reset control deassert error
	usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
	soc: qcom: smem: Fix endian-unaware access of num_entries
	spi: loopback-test: Don't use %pK through printk
	bpf: Don't use %pK through printk
	mmc: host: renesas_sdhi: Fix the actual clock
	memstick: Add timeout to prevent indefinite waiting
	ACPI: video: force native for Lenovo 82K8
	selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2
	cpufreq/longhaul: handle NULL policy in longhaul_exit
	arc: Fix __fls() const-foldability via __builtin_clzl()
	irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
	mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
	ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method()
	tee: allow a driver to allocate a tee_device without a pool
	video: backlight: lp855x_bl: Set correct EPROM start for LP8556
	clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel
	uprobe: Do not emulate/sstep original instruction when ip is changed
	hwmon: (dell-smm) Add support for Dell OptiPlex 7040
	tools/cpupower: Fix incorrect size in cpuidle_state_disable()
	tools/power x86_energy_perf_policy: Enhance HWP enable
	tools/power x86_energy_perf_policy: Prefer driver HWP limits
	mfd: stmpe: Remove IRQ domain upon removal
	mfd: stmpe-i2c: Add missing MODULE_LICENSE
	mfd: madera: Work around false-positive -Wininitialized warning
	drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf()
	PCI: Disable MSI on RDC PCI to PCIe bridges
	selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8
	selftests/net: Ensure assert() triggers in psock_tpacket.c
	drm/amdkfd: return -ENOTTY for unsupported IOCTLs
	media: pci: ivtv: Don't create fake v4l2_fh
	x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall
	powerpc/eeh: Use result of error_detected() in uevent
	bridge: Redirect to backup port when port is administratively down
	net: ipv6: fix field-spanning memcpy warning in AH output
	media: imon: make send_packet() more robust
	iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register
	usb: gadget: f_ncm: Fix MAC assignment NCM ethernet
	char: misc: Does not request module for miscdevice with dynamic minor
	net: When removing nexthops, don't call synchronize_net if it is not necessary
	net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV.
	PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call
	rds: Fix endianness annotation for RDS_MPATH_HASH
	extcon: adc-jack: Fix wakeup source leaks on device unbind
	drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption
	media: fix uninitialized symbol warnings
	mips: lantiq: danube: add missing properties to cpu node
	mips: lantiq: danube: add missing device_type in pci node
	mips: lantiq: xway: sysctrl: rename stp clock
	scsi: pm8001: Use int instead of u32 to store error codes
	dmaengine: sh: setup_xref error handling
	dmaengine: mv_xor: match alloc_wc and free_wc
	dmaengine: dw-edma: Set status for callback_result
	net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms
	ALSA: usb-audio: apply quirk for MOONDROP Quark2
	net: call cond_resched() less often in __release_sock()
	usb: gadget: f_hid: Fix zero length packet transfer
	phy: cadence: cdns-dphy: Enable lower resolutions in dphy
	net: sh_eth: Disable WoL if system can not suspend
	media: redrat3: use int type to store negative error codes
	selftests: Disable dad for ipv6 in fcnal-test.sh
	selftests: Replace sleep with slowwait
	net/cls_cgroup: Fix task_get_classid() during qdisc run
	selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency
	scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET
	scsi: lpfc: Define size of debugfs entry for xri rebalancing
	allow finish_no_open(file, ERR_PTR(-E...))
	usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs
	usb: xhci: plat: Facilitate using autosuspend for xhci plat devices
	ipv6: np->rxpmtu race annotation
	jfs: Verify inode mode when loading from disk
	jfs: fix uninitialized waitqueue in transaction manager
	net: intel: fm10k: Fix parameter idx set but not used
	sparc/module: Add R_SPARC_UA64 relocation handling
	remoteproc: qcom: q6v5: Avoid handling handover twice
	NFSv4: handle ERR_GRACE on delegation recalls
	NFSv4.1: fix mount hang after CREATE_SESSION failure
	nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing
	net: macb: avoid dealing with endianness in macb_set_hwaddr()
	Bluetooth: SCO: Fix UAF on sco_conn_free
	Bluetooth: bcsp: receive data only if registered
	page_pool: Clamp pool size to max 16K pages
	orangefs: fix xattr related buffer overflow...
	ACPICA: Update dsmethod.c to get rid of unused variable warning
	fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink
	9p: fix /sys/fs/9p/caches overwriting itself
	9p: sysfs_init: don't hardcode error to ENOMEM
	ACPI: property: Return present device nodes only on fwnode interface
	fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
	ceph: add checking of wait_for_completion_killable() return value
	net: vlan: sync VLAN features with lower device
	net: dsa/b53: change b53_force_port_config() pause argument
	net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325
	net: dsa: b53: fix resetting speed and pause on forced link
	net: dsa: b53: fix enabling ip multicast
	net: dsa: b53: stop reading ARL entries if search is done
	sctp: Hold RCU read lock while iterating over address list
	sctp: Prevent TOCTOU out-of-bounds write
	net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup
	tracing: Fix memory leaks in create_field_var()
	extcon: adc-jack: Cleanup wakeup source only if it was enabled
	compiler_types: Move unused static inline functions warning to W=2
	NFS4: Fix state renewals missing after boot
	HID: quirks: avoid Cooler Master MM712 dongle wakeup bug
	ASoC: max98090/91: fixed max98091 ALSA widget powering up/down
	net: fec: correct rx_bytes statistic for the case SHIFT16 is set
	Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF
	Bluetooth: 6lowpan: reset link-local header on ipv6 recv path
	Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion
	Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions
	sctp: get netns from asoc and ep base
	sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto
	tipc: simplify the finalize work queue
	tipc: Fix use-after-free in tipc_mon_reinit_self().
	net: mdio: fix resource leak in mdiobus_register_device()
	wifi: mac80211: skip rate verification for not captured PSDUs
	net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak
	net/mlx5e: Fix maxrate wraparound in threshold between units
	net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps
	net_sched: remove need_resched() from qdisc_run()
	net_sched: limit try_bulk_dequeue_skb() batches
	Bluetooth: L2CAP: export l2cap_chan_hold for modules
	regulator: fixed: use dev_err_probe for register
	regulator: fixed: fix GPIO descriptor leak on register failure
	ASoC: cs4271: Fix regulator leak on probe failure
	drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE
	ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd
	mm/ksm: fix flag-dropping behavior in ksm_madvise
	gcov: add support for GCC 15
	strparser: Fix signed/unsigned mismatch bug
	ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe
	spi: Try to get ACPI GPIO IRQ earlier
	EDAC/altera: Handle OCRAM ECC enable after warm reset
	EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection
	isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe()
	HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155
	be2net: pass wrb_params in case of OS2BMC
	Input: cros_ec_keyb - fix an invalid memory access
	scsi: sg: Do not sleep in atomic context
	scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()
	MIPS: Malta: Fix !EVA SOC-it PCI MMIO
	mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats()
	net: openvswitch: remove never-working support for setting nsh fields
	s390/ctcm: Fix double-kfree
	vsock: Ignore signal/timeout on connect() if already established
	kconfig/mconf: Initialize the default locale at startup
	kconfig/nconf: Initialize the default locale at startup
	mm/page_alloc: fix hash table order logging in alloc_large_system_hash()
	ALSA: usb-audio: fix uac2 clock source at terminal parser
	net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error
	uio_hv_generic: Set event for all channels on the device
	net: qede: Initialize qede_ll_ops with designated initializer
	net: netpoll: fix incorrect refcount handling causing incorrect cleanup
	pmdomain: arm: scmi: Fix genpd leak on provider registration failure
	pmdomain: imx: Fix reference count leak in imx_gpc_remove
	fs/proc: fix uaf in proc_readdir_de()
	ata: libata-scsi: Fix system suspend for a security locked drive
	usb: deprecate the third argument of usb_maxpacket()
	Input: remove third argument of usb_maxpacket()
	Input: pegasus-notetaker - fix potential out-of-bounds access
	Linux 5.4.302

Change-Id: I7291d845c3cfde8a154957356156fadcc4b96b80
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-12-03 14:36:44 +00:00
Jakub Horký
59cd20f678 kconfig/nconf: Initialize the default locale at startup
[ Upstream commit 43c2931a95e6b295bfe9e3b90dbe0f7596933e91 ]

Fix bug where make nconfig doesn't initialize the default locale, which
causes ncurses menu borders to be displayed incorrectly (lqqqqk) in
UTF-8 terminals that don't support VT100 ACS by default, such as PuTTY.

Signed-off-by: Jakub Horký <jakub.git@horky.net>
Link: https://patch.msgid.link/20251014144405.3975275-2-jakub.git@horky.net
[nathan: Alphabetize locale.h include]
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-12-03 12:45:20 +01:00
Jakub Horký
518a59533c kconfig/mconf: Initialize the default locale at startup
[ Upstream commit 3927c4a1084c48ef97f11281a0a43ecb2cb4d6f1 ]

Fix bug where make menuconfig doesn't initialize the default locale, which
causes ncurses menu borders to be displayed incorrectly (lqqqqk) in
UTF-8 terminals that don't support VT100 ACS by default, such as PuTTY.

Signed-off-by: Jakub Horký <jakub.git@horky.net>
Link: https://patch.msgid.link/20251014154933.3990990-1-jakub.git@horky.net
[nathan: Alphabetize locale.h include]
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-12-03 12:45:20 +01:00
Michael Bestas
cd41689b70
Merge remote-tracking branch 'sm8350/lineage-20' into lineage-22.2
* sm8350/lineage-20:
  ANDROID: fix wakeup reason findings
  Revert "genirq: Provide new interfaces for affinity hints"
  Revert "i40e: Use irq_update_affinity_hint()"
  Revert "i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path"
  Linux 5.4.300
  mm/hugetlb: fix folio is still mapped when deleted
  i40e: add mask to apply valid bits for itr_idx
  i40e: fix validation of VF state in get resources
  i40e: fix idx validation in config queues msg
  i40e: add validation for ring_len param
  i40e: increase max descriptors for XL710
  mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize()
  fbcon: Fix OOB access in font allocation
  fbcon: fix integer overflow in fbcon_do_set_font
  i40e: add max boundary check for VF filters
  i40e: fix input validation logic for action_meta
  i40e: fix idx validation in i40e_validate_queue_map
  drm/gma500: Fix null dereference in hdmi teardown
  can: peak_usb: fix shift-out-of-bounds issue
  can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow
  ...

Change-Id: I35c2bd8174f8de67fbe46fb7fba584ee769722fa
2025-10-08 16:01:01 +03:00
Michael Bestas
b31d93f6d6
Merge tag 'ASB-2025-10-06_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
https://source.android.com/docs/security/bulletin/2025-10-01

* tag 'ASB-2025-10-06_11-5.4' of https://android.googlesource.com/kernel/common:
  UPSTREAM: vsock: Do not allow binding to VMADDR_PORT_ANY
  Linux 5.4.299
  dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status()
  cifs: fix integer overflow in match_server()
  spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort
  spi: spi-fsl-lpspi: Set correct chip-select polarity bit
  spi: spi-fsl-lpspi: Fix transmissions when using CONT
  pcmcia: Add error handling for add_interval() in do_validate_mem()
  ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model
  randstruct: gcc-plugin: Fix attribute addition
  randstruct: gcc-plugin: Remove bogus void member
  vmxnet3: update MTU after device quiesce
  net: dsa: microchip: linearize skb for tail-tagging switches
  net: dsa: microchip: update tag_ksz masks for KSZ9477 family
  dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status()
  ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup
  gpio: pca953x: fix IRQ storm on system wake up
  iio: light: opt3001: fix deadlock due to concurrent flag access
  iio: chemical: pms7003: use aligned_s64 for timestamp
  KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer
  cpufreq/sched: Explicitly synchronize limits_changed flag handling
  mm/slub: avoid accessing metadata when pointer is invalid in object_err()
  scsi: lpfc: Fix buffer free/clear order in deferred receive path
  mm/khugepaged: fix ->anon_vma race
  e1000e: fix heap overflow in e1000_set_eeprom
  batman-adv: fix OOB read/write in network-coding decode
  drm/amdgpu: drop hw access in non-DC audio fini
  wifi: mwifiex: Initialize the chan_stats array to zero
  pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region()
  ALSA: usb-audio: Add mute TLV for playback volumes on some devices
  ppp: fix memory leak in pad_compress_skb
  net: atm: fix memory leak in atm_register_sysfs when device_register fail
  ax25: properly unshare skbs in ax25_kiss_rcv()
  ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init()
  net: thunder_bgx: decrement cleanup index before use
  net: thunder_bgx: add a missing of_node_put
  wifi: libertas: cap SSID len in lbs_associate()
  wifi: cw1200: cap SSID length in cw1200_do_join()
  net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets
  i40e: Fix potential invalid access when MAC list is empty
  icmp: fix icmp_ndo_send address translation for reply direction
  mISDN: Fix memory leak in dsp_hwec_enable()
  xirc2ps_cs: fix register access when enabling FullDuplex
  Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()
  netfilter: conntrack: helper: Replace -EEXIST by -EBUSY
  wifi: cfg80211: fix use-after-free in cmp_bss()
  powerpc: boot: Remove leading zero in label in udelay()
  Linux 5.4.298
  Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS"
  net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions
  Revert "drm/amdgpu: fix incorrect vm flags to map bo"
  HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()
  HID: wacom: Add a new Art Pen 2
  HID: asus: fix UAF via HID_CLAIMED_INPUT validation
  KVM: x86: use array_index_nospec with indices that come from guest
  efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare
  sctp: initialize more fields in sctp_v6_from_sk()
  net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts
  net/mlx5e: Set local Xoff after FW update
  net/mlx5e: Update and set Xon/Xoff upon port speed set
  net/mlx5e: Update and set Xon/Xoff upon MTU set
  net: dlink: fix multicast stats being counted incorrectly
  atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().
  net/atm: remove the atmdev_ops {get, set}sockopt methods
  Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced
  powerpc/kvm: Fix ifdef to remove build warning
  net: ipv4: fix regression in local-broadcast routes
  vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put()
  scsi: core: sysfs: Correct sysfs attributes access rights
  ftrace: Fix potential warning in trace_printk_seq during ftrace_dump
  pinctrl: STMFX: add missing HAS_IOMEM dependency
  Revert "PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports"
  Revert "PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit()"
  Linux 5.4.297
  alloc_fdtable(): change calling conventions.
  s390/hypfs: Enable limited access during lockdown
  s390/hypfs: Avoid unnecessary ioctl registration in debugfs
  ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation
  net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate
  net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit
  ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc
  ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add
  ALSA: usb-audio: Fix size validation in convert_chmap_v3()
  scsi: qla4xxx: Prevent a potential error pointer dereference
  usb: xhci: Fix slot_id resource race conflict
  nfs: fix UAF in direct writes
  NFS: Fix up commit deadlocks
  cifs: Fix UAF in cifs_demultiplex_thread()
  Bluetooth: fix use-after-free in device_for_each_child()
  act_mirred: use the backlog for nested calls to mirred ingress
  net/sched: act_mirred: better wording on protection against excessive stack growth
  net/sched: act_mirred: refactor the handle of xmit
  selftests: forwarding: tc_actions.sh: add matchall mirror test
  net: sched: don't expose action qstats to skb_tc_reinsert()
  net: sched: extract qstats update code into functions
  net: sched: extract bstats update code into function
  net: sched: extract common action counters update code into function
  mm: perform the mapping_map_writable() check after call_mmap()
  mm: update memfd seal write check to include F_SEAL_WRITE
  mm: drop the assumption that VM_SHARED always implies writable
  codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()
  sch_qfq: make qfq_qlen_notify() idempotent
  sch_hfsc: make hfsc_qlen_notify() idempotent
  sch_drr: make drr_qlen_notify() idempotent
  btrfs: populate otime when logging an inode item
  media: venus: hfi: explicitly release IRQ during teardown
  f2fs: fix to avoid out-of-boundary access in dnode page
  media: venus: protect against spurious interrupts during probe
  media: qcom: camss: cleanup media device allocated resource on error path
  media: venus: vdec: Clamp param smaller than 1fps and bigger than 240.
  drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS
  pwm: mediatek: Fix duty and period setting
  pwm: mediatek: Handle hardware enable and clock enable separately
  pwm: mediatek: Implement .apply() callback
  media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()
  media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free()
  media: v4l2-ctrls: always copy the controls on completion
  ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig
  soc: qcom: mdt_loader: Ensure we don't read past the ELF header
  rtc: ds1307: handle oscillator stop flag (OSF) for ds1341
  usb: musb: omap2430: fix device leak at unbind
  NFS: Fix the setting of capabilities when automounting a new filesystem
  NFS: Fix up handling of outstanding layoutcommit in nfs_update_inode()
  NFSv4: Fix nfs4_bitmap_copy_adjust()
  usb: typec: fusb302: cache PD RX state
  cdc-acm: fix race between initial clearing halt and open
  USB: cdc-acm: do not log successful probe on later errors
  mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock
  mm/kmemleak: turn kmemleak_lock and object->lock to raw_spinlock_t
  ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx()
  x86/fpu: Delay instruction pointer fixup until after warning
  mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery
  nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()
  pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov
  tracing: Add down_write(trace_event_sem) when adding trace event
  usb: hub: Don't try to recover devices lost during warm reset.
  usb: hub: avoid warm port reset during USB3 disconnect
  x86/mce/amd: Add default names for MCA banks and blocks
  iio: hid-sensor-prox: Fix incorrect OFFSET calculation
  f2fs: fix to do sanity check on ino and xnid
  mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n
  mm/zsmalloc.c: convert to use kmem_cache_zalloc in cache_alloc_zspage()
  drm/sched: Remove optimization that causes hang when killing dependent jobs
  ice: Fix a null pointer dereference in ice_copy_and_init_pkg()
  net: usbnet: Fix the wrong netif_carrier_on() call
  net: usbnet: Avoid potential RCU stall on LINK_CHANGE event
  PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports
  ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value
  comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large
  comedi: Fix initialization of data for instructions that write to subdevice
  kbuild: Add KBUILD_CPPFLAGS to as-option invocation
  kbuild: add $(CLANG_FLAGS) to KBUILD_CPPFLAGS
  kbuild: Add CLANG_FLAGS to as-instr
  mips: Include KBUILD_CPPFLAGS in CHECKFLAGS invocation
  kbuild: Update assembler calls to use proper flags and language target
  ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS
  usb: dwc3: Ignore late xferNotReady event to prevent halt timeout
  USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles
  usb: storage: realtek_cr: Use correct byte order for bcs->Residue
  USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera
  usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive
  iio: proximity: isl29501: fix buffered read on big-endian systems
  ftrace: Also allocate and copy hash for reading of filter files
  fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable()
  use uniform permission checks for all mount propagation changes
  move_mount: allow to add a mount into an existing group
  fs/buffer: fix use-after-free when call bh_read() helper
  drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs
  drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3
  squashfs: fix memory leak in squashfs_fill_super
  memstick: Fix deadlock by moving removing flag earlier
  media: venus: Add a check for packet size after reading from shared memory
  media: ov2659: Fix memory leaks in ov2659_probe()
  media: usbtv: Lock resolution while streaming
  media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init()
  media: gspca: Add bounds checking to firmware parser
  soc/tegra: pmc: Ensure power-domains are in a known state
  jbd2: prevent softlockup in jbd2_log_do_checkpoint()
  PCI: endpoint: Fix configfs group removal on driver teardown
  PCI: endpoint: Fix configfs group list head handling
  mtd: rawnand: fsmc: Add missing check after DMA map
  pwm: imx-tpm: Reset counter if CMOD is 0
  wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table()
  zynq_fpga: use sgtable-based scatterlist wrappers
  ata: libata-scsi: Fix ata_to_sense_error() status handling
  ext4: fix reserved gdt blocks handling in fsmap
  ext4: fix fsmap end of range reporting with bigalloc
  ext4: check fast symlink for ea_inode correctly
  Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()"
  vt: defkeymap: Map keycodes above 127 to K_HOLE
  vt: keyboard: Don't process Unicode characters in K_OFF mode
  usb: dwc3: meson-g12a: fix device leaks at unbind
  usb: gadget: udc: renesas_usb3: fix device leak at unbind
  usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init()
  m68k: Fix lost column on framebuffer debug console
  cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table()
  serial: 8250: fix panic due to PSLVERR
  media: uvcvideo: Do not mark valid metadata as invalid
  media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()
  mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup()
  parisc: Makefile: fix a typo in palo.conf
  btrfs: fix log tree replay failure due to file with 0 links and extents
  thunderbolt: Fix copy+paste error in match_service_id()
  comedi: fix race between polling and detaching
  misc: rtsx: usb: Ensure mmc child device is active when card is present
  drm/amdgpu: fix incorrect vm flags to map bo
  scsi: lpfc: Remove redundant assignment to avoid memory leak
  rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe
  pNFS: Fix uninited ptr deref in block/scsi layout
  pNFS: Handle RPC size limit for layoutcommits
  pNFS: Fix disk addr range check in block/scsi layout
  pNFS: Fix stripe mapping in block/scsi layout
  net: phy: smsc: add proper reset flags for LAN8710A
  ipmi: Fix strcpy source and destination the same
  kconfig: lxdialog: fix 'space' to (de)select options
  kconfig: gconf: fix potential memory leak in renderer_edited()
  kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed()
  ipmi: Use dev_warn_ratelimited() for incorrect message warnings
  scsi: aacraid: Stop using PCI_IRQ_AFFINITY
  scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans
  kconfig: nconf: Ensure null termination where strncpy is used
  kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c
  i3c: don't fail if GETHDRCAP is unsupported
  PCI: pnv_php: Work around switches with broken presence detection
  i3c: add missing include to internal header
  media: uvcvideo: Fix bandwidth issue for Alcor camera
  media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar
  media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb()
  media: usb: hdpvr: disable zero-length read messages
  media: tc358743: Increase FIFO trigger level to 374
  media: tc358743: Return an appropriate colorspace from tc358743_set_fmt
  media: tc358743: Check I2C succeeded during probe
  pinctrl: stm32: Manage irq affinity settings
  scsi: mpt3sas: Correctly handle ATA device errors
  scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure
  RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask()
  MIPS: Don't crash in stack_top() for tasks without ABI or vDSO
  jfs: upper bound check of tree index in dbAllocAG
  jfs: Regular file corruption check
  jfs: truncate good inode pages when hard link is 0
  scsi: bfa: Double-free fix
  MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free}
  watchdog: dw_wdt: Fix default timeout
  fs/orangefs: use snprintf() instead of sprintf()
  scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated
  ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr
  cifs: Fix calling CIFSFindFirst() for root path without msearch
  vhost: fail early when __vhost_add_used() fails
  net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325
  uapi: in6: restore visibility of most IPv6 socket options
  net: ncsi: Fix buffer overflow in fetching version id
  net: dsa: b53: prevent SWITCH_CTRL access on BCM5325
  net: dsa: b53: fix b53_imp_vlan_setup for BCM5325
  net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs
  wifi: iwlegacy: Check rate_idx range after addition
  netmem: fix skb_frag_address_safe with unreadable skbs
  wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`.
  wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect
  wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd()
  net: fec: allow disable coalescing
  (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer
  s390/stp: Remove udelay from stp_sync_clock()
  wifi: iwlwifi: mvm: fix scan request validation
  net: thunderx: Fix format-truncation warning in bgx_acpi_match_id()
  net: ipv4: fix incorrect MTU in broadcast routes
  wifi: cfg80211: Fix interface type validation
  rcu: Protect ->defer_qs_iw_pending from data race
  net: ag71xx: Add missing check after DMA map
  et131x: Add missing check after DMA map
  be2net: Use correct byte order and format string for TCP seq and ack_seq
  s390/time: Use monotonic clock in get_cycles()
  wifi: cfg80211: reject HTC bit for management frames
  ktest.pl: Prevent recursion of default variable options
  ASoC: codecs: rt5640: Retry DEVICE_ID verification
  ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros
  ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control
  platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches
  pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop()
  usb: core: usb_submit_urb: downgrade type check
  ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4
  ASoC: hdac_hdmi: Rate limit logging on connection and disconnection
  mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode()
  ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path
  ACPI: processor: fix acpi_object initialization
  PM: sleep: console: Fix the black screen issue
  thermal: sysfs: Return ENODATA instead of EAGAIN for reads
  PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit()
  selftests: tracing: Use mutex_unlock for testing glob filter
  ARM: tegra: Use I/O memcpy to write to IRAM
  gpio: tps65912: check the return value of regmap_update_bits()
  ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed
  ARM: rockchip: fix kernel hang during smp initialization
  cpufreq: Exit governor when failed to start old governor
  usb: xhci: Avoid showing errors during surprise removal
  usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command
  usb: xhci: Avoid showing warnings for dying controller
  selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t
  usb: xhci: print xhci->xhc_state when queue_command failed
  securityfs: don't pin dentries twice, once is enough...
  hfs: fix not erasing deleted b-tree node issue
  drbd: add missing kref_get in handle_write_conflicts
  udf: Verify partition map count
  arm64: Handle KCOV __init vs inline mismatches
  hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file()
  hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()
  hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read()
  hfs: fix slab-out-of-bounds in hfs_bnode_read()
  sctp: linearize cloned gso packets in sctp_rcv
  netfilter: ctnetlink: fix refcount leak on table dump
  udp: also consider secpath when evaluating ipsec use for checksumming
  ACPI: processor: perflib: Move problematic pr->performance check
  ACPI: processor: perflib: Fix initial _PPC limit application
  Documentation: ACPI: Fix parent device references
  fs: Prevent file descriptor table allocations exceeding INT_MAX
  sunvdc: Balance device refcount in vdc_port_mpgroup_check
  NFSD: detect mismatch of file handle and delegation stateid in OPEN op
  net: dpaa: fix device leak when querying time stamp info
  net: gianfar: fix device leak when querying time stamp info
  netlink: avoid infinite retry looping in netlink_unicast()
  ALSA: usb-audio: Validate UAC3 cluster segment descriptors
  ALSA: usb-audio: Validate UAC3 power domain descriptors, too
  io_uring: don't use int for ABI
  usb: gadget : fix use-after-free in composite_dev_cleanup()
  MIPS: mm: tlb-r4k: Uniquify TLB entries on init
  USB: serial: option: add Foxconn T99W709
  vsock: Do not allow binding to VMADDR_PORT_ANY
  net/packet: fix a race in packet_set_ring() and packet_notifier()
  perf/core: Prevent VMA split of buffer mappings
  perf/core: Exit early on perf_mmap() fail
  perf/core: Don't leak AUX buffer refcount on allocation failure
  pptp: fix pptp_xmit() error path
  smb: client: let recv_done() cleanup before notifying the callers.
  benet: fix BUG when creating VFs
  net: drop UFO packets in udp_rcv_segment()
  ipv6: reject malicious packets in ipv6_gso_segment()
  pptp: ensure minimal skb length in pptp_xmit()
  netpoll: prevent hanging NAPI when netcons gets enabled
  NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()
  pci/hotplug/pnv-php: Wrap warnings in macro
  pci/hotplug/pnv-php: Improve error msg on power state change failure
  usb: chipidea: udc: fix sleeping function called from invalid context
  f2fs: fix to avoid out-of-boundary access in devs.path
  f2fs: fix to avoid panic in f2fs_evict_inode
  f2fs: fix to avoid UAF in f2fs_sync_inode_meta()
  rtc: pcf8563: fix incorrect maximum clock rate handling
  rtc: hym8563: fix incorrect maximum clock rate handling
  rtc: ds1307: fix incorrect maximum clock rate handling
  module: Restore the moduleparam prefix length check
  bpf: Check flow_dissector ctx accesses are aligned
  mtd: rawnand: atmel: set pmecc data setup time
  mtd: rawnand: atmel: Fix dma_mapping_error() address
  jfs: fix metapage reference count leak in dbAllocCtl
  fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref
  crypto: qat - fix seq_file position update in adf_ring_next()
  dmaengine: nbpfaxi: Add missing check after DMA map
  dmaengine: mv_xor: Fix missing check after DMA map and missing unmap
  fs/orangefs: Allow 2 more characters in do_c_string()
  soundwire: stream: restore params when prepare ports fail
  crypto: img-hash - Fix dma_unmap_sg() nents value
  hwrng: mtk - handle devm_pm_runtime_enable errors
  watchdog: ziirave_wdt: check record length in ziirave_firm_verify()
  scsi: isci: Fix dma_unmap_sg() nents value
  scsi: mvsas: Fix dma_unmap_sg() nents value
  scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value
  clk: sunxi-ng: v3s: Fix de clock definition
  perf tests bp_account: Fix leaked file descriptor
  crypto: ccp - Fix crash when rebind ccp device for ccp.ko
  pinctrl: sunxi: Fix memory leak on krealloc failure
  power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set
  clk: davinci: Add NULL check in davinci_lpsc_clk_register()
  mtd: fix possible integer overflow in erase_xfer()
  crypto: marvell/cesa - Fix engine load inaccuracy
  PCI: rockchip-host: Fix "Unexpected Completion" log message
  vrf: Drop existing dst reference in vrf_ip6_input_dst
  selftests: rtnetlink.sh: remove esp4_offload after test
  netfilter: xt_nfacct: don't assume acct name is null-terminated
  can: kvaser_usb: Assign netdev.dev_port based on device channel index
  can: kvaser_pciefd: Store device channel index
  wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE
  Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()"
  mwl8k: Add missing check after DMA map
  wifi: rtl8xxxu: Fix RX skb size for aggregation disabled
  net/sched: Restrict conditions for adding duplicating netems to qdisc tree
  arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX
  netfilter: nf_tables: adjust lockdep assertions handling
  drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value
  m68k: Don't unregister boot console needlessly
  tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range
  iwlwifi: Add missing check for alloc_ordered_workqueue
  wifi: iwlwifi: Fix memory leak in iwl_mvm_init()
  wifi: rtl818x: Kill URBs before clearing tx status queue
  caif: reduce stack size, again
  bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure
  bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
  staging: nvec: Fix incorrect null termination of battery manufacturer
  samples: mei: Fix building on musl libc
  cpufreq: Init policy->rwsem before it may be possibly used
  ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface
  usb: early: xhci-dbc: Fix early_ioremap leak
  Revert "vmci: Prevent the dispatching of uninitialized payloads"
  pps: fix poll support
  vmci: Prevent the dispatching of uninitialized payloads
  staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc()
  ARM: dts: vfxxx: Correctly use two tuples for timer address
  ASoC: ops: dynamically allocate struct snd_ctl_elem_value
  hfsplus: remove mutex_lock check in hfsplus_free_extents
  ASoC: Intel: fix SND_SOC_SOF dependencies
  ethernet: intel: fix building with large NR_CPUS
  usb: phy: mxs: disconnect line when USB charger is attached
  usb: chipidea: add USB PHY event
  usb: chipidea: introduce CI_HDRC_CONTROLLER_VBUS_EVENT glue layer use
  usb: chipidea: udc: protect usb interrupt enable
  usb: chipidea: udc: add new API ci_hdrc_gadget_connect
  ALSA: hda: Add missing NVIDIA HDA codec IDs
  comedi: comedi_test: Fix possible deletion of uninitialized timers
  nilfs2: reject invalid file types when reading inodes
  i2c: qup: jump out of the loop in case of timeout
  net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class
  net: appletalk: Fix use-after-free in AARP proxy probe
  net: appletalk: fix kerneldoc warnings
  RDMA/core: Rate limit GID cache warning messages
  regulator: core: fix NULL dereference on unbind due to stale coupling data
  usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm
  usb: hub: fix detection of high tier USB3 devices behind suspended hubs
  net_sched: sch_sfq: reject invalid perturb period
  net_sched: sch_sfq: move the limit validation
  net_sched: sch_sfq: use a temporary work area for validating configuration
  net_sched: sch_sfq: don't allow 1 packet limit
  net_sched: sch_sfq: handle bigger packets
  net_sched: sch_sfq: annotate data-races around q->perturb_period
  power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition
  power: supply: bq24190_charger: using pm_runtime_resume_and_get instead of pm_runtime_get_sync
  power: supply: bq24190_charger: Fix runtime PM imbalance on error
  xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS
  virtio-net: ensure the received length does not exceed allocated size
  ASoC: fsl_sai: Force a software reset when starting in consumer mode
  usb: dwc3: qcom: Don't leave BCR asserted
  usb: musb: fix gadget state on disconnect
  net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree
  net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
  Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU
  Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout
  Bluetooth: SMP: If an unallowed command is received consider it a failure
  Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb()
  usb: net: sierra: check for no status endpoint
  net/sched: sch_qfq: Fix race condition on qfq_aggregate
  net: emaclite: Fix missing pointer increment in aligned_read()
  comedi: Fix use of uninitialized data in insn_rw_emulate_bits()
  comedi: Fix some signed shift left operations
  comedi: das6402: Fix bit shift out of bounds
  comedi: das16m1: Fix bit shift out of bounds
  comedi: aio_iiro_16: Fix bit shift out of bounds
  comedi: pcl812: Fix bit shift out of bounds
  iio: adc: stm32-adc: Fix race in installing chained IRQ handler
  iio: adc: max1363: Reorder mode_list[] entries
  iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[]
  soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled
  soc: aspeed: lpc-snoop: Cleanup resources in stack-order
  mmc: sdhci_am654: Workaround for Errata i2312
  mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models
  mmc: bcm2835: Fix dma_unmap_sg() nents value
  memstick: core: Zero initialize id_reg in h_memstick_read_dev_id()
  isofs: Verify inode mode when loading from disk
  dmaengine: nbpfaxi: Fix memory corruption in probe()
  af_packet: fix soft lockup issue caused by tpacket_snd()
  af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd()
  phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept()
  HID: core: do not bypass hid_hw_raw_request
  HID: core: ensure __hid_request reserves the report ID as the first byte
  HID: core: ensure the allocated report buffer can contain the reserved report ID
  pch_uart: Fix dma_sync_sg_for_device() nents value
  Input: xpad - set correct controller type for Acer NGR200
  i2c: stm32: fix the device used for the DMA map
  usb: gadget: configfs: Fix OOB read on empty string write
  USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI
  USB: serial: option: add Foxconn T99W640
  USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition

 Conflicts:
	drivers/soc/qcom/mdt_loader.c
	drivers/usb/dwc3/dwc3-qcom.c
	drivers/usb/host/xhci-plat.c
	mm/slub.c
	mm/zsmalloc.c

Change-Id: I83183b507249a323eba0ecec4c7b4b04d76cc7f6
2025-10-08 15:17:54 +03:00
Masahiro Yamada
aff7958cac
kbuild: add infrastructure to build userspace programs
Kbuild supports the infrastructure to build host programs, but there
was no support to build userspace programs for the target architecture
(i.e. the same architecture as the kernel).

Sam Ravnborg worked on this in 2014 (https://lkml.org/lkml/2014/7/13/154),
but it was not merged. One problem at that time was, there was no good way
to know whether $(CC) can link standalone programs. In fact, pre-built
kernel.org toolchains [1] are often used for building the kernel, but they
do not provide libc.

Now, we can handle this cleanly because the compiler capability is
evaluated at the Kconfig time. If $(CC) cannot link standalone programs,
the relevant options are hidden by 'depends on CC_CAN_LINK'.

The implementation just mimics scripts/Makefile.host

The userspace programs are compiled with the same flags as the host
programs. In addition, it uses -m32 or -m64 if it is found in
$(KBUILD_CFLAGS).

This new syntax has two usecases.

- Sample programs

  Several userspace programs under samples/ include UAPI headers
  installed in usr/include. Most of them were previously built for
  the host architecture just to use the 'hostprogs' syntax.

  However, 'make headers' always works for the target architecture.
  This caused the arch mismatch in cross-compiling. To fix this
  distortion, sample code should be built for the target architecture.

- Bpfilter

  net/bpfilter/Makefile compiles bpfilter_umh as the user mode helper,
  and embeds it into the kernel. Currently, it overrides HOSTCC with
  CC to use the 'hostprogs' syntax. This hack should go away.

[1]: https://mirrors.edge.kernel.org/pub/tools/crosstool/
Change-Id: I2776c85673b212541b359fa1cfa168785018299c
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Acked-by: Sam Ravnborg <sam@ravnborg.org>
2025-09-28 10:00:32 +02:00
Masahiro Yamada
df493f21a7
kbuild: add -Wall to KBUILD_HOSTCXXFLAGS
Add -Wall to catch more warnings for C++ host programs.

When I submitted the previous version, the 0-day bot reported
-Wc++11-compat warnings for old GCC:

  HOSTCXX -fPIC scripts/gcc-plugins/latent_entropy_plugin.o
In file included from /usr/lib/gcc/x86_64-linux-gnu/4.8/plugin/include/tm.h:28:0,
                 from scripts/gcc-plugins/gcc-common.h:15,
                 from scripts/gcc-plugins/latent_entropy_plugin.c:78:
/usr/lib/gcc/x86_64-linux-gnu/4.8/plugin/include/config/elfos.h:102:21: warning: C++11 requires a space between string literal and macro [-Wc++11-compat]
    fprintf ((FILE), "%s"HOST_WIDE_INT_PRINT_UNSIGNED"\n",\
                     ^
/usr/lib/gcc/x86_64-linux-gnu/4.8/plugin/include/config/elfos.h:170:24: warning: C++11 requires a space between string literal and macro [-Wc++11-compat]
       fprintf ((FILE), ","HOST_WIDE_INT_PRINT_UNSIGNED",%u\n",  \
                        ^
In file included from /usr/lib/gcc/x86_64-linux-gnu/4.8/plugin/include/tm.h:42:0,
                 from scripts/gcc-plugins/gcc-common.h:15,
                 from scripts/gcc-plugins/latent_entropy_plugin.c:78:
/usr/lib/gcc/x86_64-linux-gnu/4.8/plugin/include/defaults.h:126:24: warning: C++11 requires a space between string literal and macro [-Wc++11-compat]
       fprintf ((FILE), ","HOST_WIDE_INT_PRINT_UNSIGNED",%u\n",  \
                        ^

The source of the warnings is in the plugin headers, so we have no
control of it. I just suppressed them by adding -Wno-c++11-compat to
scripts/gcc-plugins/Makefile.

Change-Id: I3cb616b5dbb4e6c55a537453807da86f473f73d8
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Acked-by: Kees Cook <keescook@chromium.org>
2025-09-28 10:00:32 +02:00
Michael Bestas
ec51464b3d
Merge remote-tracking branch 'sm8350/lineage-20' into lineage-22.2
* sm8350/lineage-20:
  UPSTREAM: perf/core: Fix potential NULL deref
  UPSTREAM: net/packet: fix a race in packet_set_ring() and packet_notifier()
  ANDROID: 16K: Allocate pad vma on the stack
  ANDROID: 16K: Don't copy data vma for maps/smaps output
  ANDROID: GKI: update Trimble symbol list
  UPSTREAM: net/sched: Always pass notifications when child class becomes empty
  Revert "drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling"
  Linux 5.4.296
  net: ipv6: Discard next-hop MTU less than minimum link MTU
  x86/mm: Disable hugetlb page table sharing on 32-bit
  Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID
  HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras
  HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY
  vt: add missing notification when switching back to text mode
  net: usb: qmi_wwan: add SIMCom 8230C composition
  atm: idt77252: Add missing `dma_map_error()`
  bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT
  bnxt_en: Fix DCB ETS validation
  can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level
  net: phy: microchip: limit 100M workaround to link-down events on LAN88xx
  ...

Change-Id: Ibded01585f3540b8c4ac285da2c131d7c55e549b
2025-09-13 21:31:19 +03:00
Michael Bestas
dae3d3ea9f
Merge tag 'ASB-2025-09-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
https://source.android.com/docs/security/bulletin/2025-09-01
CVE-2025-21755
CVE-2025-38352
CVE-2025-021701

* tag 'ASB-2025-09-05_11-5.4' of https://android.googlesource.com/kernel/common:
  UPSTREAM: perf/core: Fix potential NULL deref
  UPSTREAM: net/packet: fix a race in packet_set_ring() and packet_notifier()
  ANDROID: 16K: Allocate pad vma on the stack
  ANDROID: 16K: Don't copy data vma for maps/smaps output
  ANDROID: GKI: update Trimble symbol list
  UPSTREAM: net/sched: Always pass notifications when child class becomes empty
  Revert "drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling"
  Linux 5.4.296
  net: ipv6: Discard next-hop MTU less than minimum link MTU
  x86/mm: Disable hugetlb page table sharing on 32-bit
  Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID
  HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras
  HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY
  vt: add missing notification when switching back to text mode
  net: usb: qmi_wwan: add SIMCom 8230C composition
  atm: idt77252: Add missing `dma_map_error()`
  bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT
  bnxt_en: Fix DCB ETS validation
  can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level
  net: phy: microchip: limit 100M workaround to link-down events on LAN88xx
  net: appletalk: Fix device refcount leak in atrtr_create()
  md/raid1: Fix stack memory use after return in raid1_reshape
  wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev()
  dma-buf: fix timeout handling in dma_resv_wait_timeout v2
  Input: xpad - support Acer NGR 200 Controller
  Input: xpad - add VID for Turtle Beach controllers
  Input: xpad - add support for Amazon Game Controller
  NFSv4/flexfiles: Fix handling of NFS level errors in I/O
  flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes
  RDMA/mlx5: Fix vport loopback for MPV device
  netlink: Fix rmem check in netlink_broadcast_deliver().
  netlink: make sure we allow at least one dump skb
  pwm: mediatek: Ensure to disable clocks in error path
  Revert "ACPI: battery: negate current when discharging"
  usb: gadget: u_serial: Fix race condition in TTY wakeup
  drm/sched: Increment job count before swapping tail spsc queue
  pinctrl: qcom: msm: mark certain pins as invalid for interrupts
  x86/mce: Make sure CMCI banks are cleared during shutdown on Intel
  x86/mce: Don't remove sysfs if thresholding sysfs init fails
  x86/mce/amd: Fix threshold limit reset
  rxrpc: Fix oops due to non-existence of prealloc backlog struct
  net/sched: Abort __tc_modify_qdisc if parent class does not exist
  atm: clip: Fix NULL pointer dereference in vcc_sendmsg()
  atm: clip: Fix infinite recursive call of clip_push().
  atm: clip: Fix memory leak of struct clip_vcc.
  atm: clip: Fix potential null-ptr-deref in to_atmarpd().
  tipc: Fix use-after-free in tipc_conn_close().
  netlink: Fix wraparounds of sk->sk_rmem_alloc.
  fix proc_sys_compare() handling of in-lookup dentries
  proc: Clear the pieces of proc_inode that proc_evict_inode cares about
  drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling
  staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher()
  media: uvcvideo: Rollback non processed entities on error
  media: uvcvideo: Send control events for partial succeeds
  media: uvcvideo: Return the number of processed controls
  ACPI: PAD: fix crash in exit_round_robin()
  usb: typec: displayport: Fix potential deadlock
  Logitech C-270 even more broken
  rose: fix dangling neighbour pointers in rose_rt_device_down()
  net: rose: Fix fall-through warnings for Clang
  drm/i915/gt: Fix timeline left held on VMA alloc error
  drm/i915/selftests: Change mock_request() to return error pointers
  spi: spi-fsl-dspi: Clear completion counter before initiating transfer
  spi: spi-fsl-dspi: Fix interrupt-less DMA mode taking an XSPI code path
  spi: spi-fsl-dspi: Rename fifo_{read,write} and {tx,cmd}_fifo_write
  dpaa2-eth: fix xdp_rxq_info leak
  ethernet: atl1: Add missing DMA mapping error checks and count errors
  btrfs: use btrfs_record_snapshot_destroy() during rmdir
  btrfs: propagate last_unlink_trans earlier when doing a rmdir
  RDMA/mlx5: Fix CC counters query for MPV
  RDMA/core: Create and destroy counters in the ib_core
  scsi: ufs: core: Fix spelling of a sysfs attribute name
  drm/v3d: Disable interrupts before resetting the GPU
  mtk-sd: reset host->mrq on prepare_data() error
  mtk-sd: Prevent memory corruption from DMA map failure
  mmc: mediatek: use data instead of mrq parameter from msdc_{un}prepare_data()
  regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods
  regulator: gpio: Add input_supply support in gpio_regulator_config
  ACPICA: Refuse to evaluate a method if arguments are missing
  wifi: ath6kl: remove WARN on bad firmware input
  wifi: mac80211: drop invalid source address OCB frames
  powerpc: Fix struct termio related ioctl macros
  ata: pata_cs5536: fix build on 32-bit UML
  ALSA: sb: Force to disable DMAs once when DMA mode is changed
  net/sched: Always pass notifications when child class becomes empty
  nui: Fix dma_mapping_error() check
  enic: fix incorrect MTU comparison in enic_change_mtu()
  amd-xgbe: align CL37 AN sequence as per databook
  lib: test_objagg: Set error message in check_expect_hints_stats()
  drm/exynos: fimd: Guard display clock control with runtime PM calls
  btrfs: fix missing error handling when searching for inode refs during log replay
  scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu()
  nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.
  RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert
  platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment
  mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data
  usb: typec: altmodes/displayport: do not index invalid pin_assignments
  Revert "mmc: sdhci: Disable SD card clock before changing parameters"
  mmc: sdhci: Add a helper function for dump register in dynamic debug mode
  vsock/vmci: Clear the vmci transport packet properly when initializing it
  btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
  arm64: Restrict pagetable teardown to avoid false warning
  s390: Add '-std=gnu11' to decompressor and purgatory CFLAGS
  drm/bridge: cdns-dsi: Check return value when getting default PHY config
  drm/bridge: cdns-dsi: Fix connecting to next bridge
  drm/bridge: cdns-dsi: Fix the clock variable for mode_valid()
  drm/tegra: Assign plane type before registration
  HID: wacom: fix kobject reference count leak
  HID: wacom: fix memory leak on sysfs attribute creation failure
  HID: wacom: fix memory leak on kobject creation failure
  dm-raid: fix variable in journal device check
  Bluetooth: L2CAP: Fix L2CAP MTU negotiation
  atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister().
  net: enetc: Correct endianness handling in _enetc_rd_reg64
  um: ubd: Add missing error check in start_io_thread()
  vsock/uapi: fix linux/vm_sockets.h userspace compilation errors
  wifi: mac80211: fix beacon interval calculation overflow
  attach_recursive_mnt(): do not lock the covering tree when sliding something under it
  ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3()
  i2c: robotfuzz-osif: disable zero-length read messages
  i2c: tiny-usb: disable zero-length read messages
  RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction
  RDMA/core: Use refcount_t instead of atomic_t on refcount of iwcm_id_private
  media: vivid: Change the siize of the composing
  media: omap3isp: use sgtable-based scatterlist wrappers
  media: cxusb: no longer judge rbuf when the write fails
  media: cxusb: use dev_dbg() rather than hand-rolled debug
  jfs: validate AG parameters in dbMount() to prevent crashes
  fs/jfs: consolidate sanity checking in dbMount
  ASoC: meson: meson-card-utils: use of_property_present() for DT parsing
  of: Add of_property_present() helper
  of: property: define of_property_read_u{8,16,32,64}_array() unconditionally
  kbuild: hdrcheck: fix cross build with clang
  kbuild: add --target to correctly cross-compile UAPI headers with Clang
  bpfilter: match bit size of bpfilter_umh to that of the kernel
  kbuild: use -MMD instead of -MD to exclude system headers from dependency
  VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify
  VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF
  ovl: Check for NULL d_inode() in ovl_dentry_upper()
  ceph: fix possible integer overflow in ceph_zero_objects()
  ALSA: hda: Ignore unsol events for cards being shut down
  usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode
  usb: cdc-wdm: avoid setting WDM_READ for ZLP-s
  usb: Add checks for snprintf() calls in usb_alloc_dev()
  tty: serial: uartlite: register uart driver in init
  usb: potential integer overflow in usbg_make_tpg()
  iio: pressure: zpa2326: Use aligned_s64 for the timestamp
  md/md-bitmap: fix dm-raid max_write_behind setting
  dmaengine: xilinx_dma: Set dma_device directions
  mfd: max14577: Fix wakeup source leaks on device unbind
  mailbox: Not protect module_put with spin_lock_irqsave
  cifs: Fix cifs_query_path_info() for Windows NT servers

 Conflicts:
	drivers/hid/hid-ids.h
	drivers/pinctrl/qcom/pinctrl-msm.c

Change-Id: Ifd5acd2c013f9985e02b866e3f9383383077e3f0
2025-09-12 18:48:05 +03:00
Greg Kroah-Hartman
8b500987d7 This is the 5.4.299 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmjAWV4ACgkQONu9yGCS
 aT7E+Q//fo2+RnB0lUyOGiXkg1al0NhTy5NpO5REWwz0eAU8LS5PwbgkqpgAHeTl
 oTN/Vc8zXu0SIsEnQQIPq0nr1uTSAj/XiFKAoWq4D3tJUS2pvzTV95TTUXqhNc3H
 rGESzEZNyfHwTBHGT5v+KjD70QiPrIfldgpNqSQVnabqPHl6+NcdjXIQFmUhHWKZ
 fKV9U3g21wA4hDcWeeMf4gpwALu4Try4W7zazkhQ3Ys0OvWghWOMQZBCojzHHkaM
 imTiO7QNM6SfqCUk6YF1Tx3ME1spiD1modjzf2GdeerMx4ViK2zZuVlxObgrRlz8
 YjLNqhW1HLIpMwloWbPglYx8oyDvqXgW0MR7ubb2foCc+nsqNfpilKeRSSEgGIzO
 iV+Rxh+/I/JedThzok++i2o5LIR3gnL3I6nbKxvzgKqeAw21u5RxUOfrlVSUOzdC
 pO9zMtkbJWsiGsJuplKNEP8EHGh2aQbxRmPeKlSgMOVO+Mjj3pnEOqx0nUriIolk
 Om7NkzBnDIv4ck+b+JCtBQaf/X8OFtFYaoW84HpaSauvVchxU072t4RwOaVIfvU5
 6YGlpUcguNxRbTZ6pMDKaKvLdlnzAsPv+1GvNHA5aVN2vuz1GesTHsm0dzRegLyf
 wW7sakrIpKqqJZReBA5LOCrLlUE2518TCf8pZUlvQRn0M4Pmmqg=
 =eFKc
 -----END PGP SIGNATURE-----

Merge 5.4.299 into android11-5.4-lts

Changes in 5.4.299
	powerpc: boot: Remove leading zero in label in udelay()
	wifi: cfg80211: fix use-after-free in cmp_bss()
	netfilter: conntrack: helper: Replace -EEXIST by -EBUSY
	Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()
	xirc2ps_cs: fix register access when enabling FullDuplex
	mISDN: Fix memory leak in dsp_hwec_enable()
	icmp: fix icmp_ndo_send address translation for reply direction
	i40e: Fix potential invalid access when MAC list is empty
	net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets
	wifi: cw1200: cap SSID length in cw1200_do_join()
	wifi: libertas: cap SSID len in lbs_associate()
	net: thunder_bgx: add a missing of_node_put
	net: thunder_bgx: decrement cleanup index before use
	ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init()
	ax25: properly unshare skbs in ax25_kiss_rcv()
	net: atm: fix memory leak in atm_register_sysfs when device_register fail
	ppp: fix memory leak in pad_compress_skb
	ALSA: usb-audio: Add mute TLV for playback volumes on some devices
	pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region()
	wifi: mwifiex: Initialize the chan_stats array to zero
	drm/amdgpu: drop hw access in non-DC audio fini
	batman-adv: fix OOB read/write in network-coding decode
	e1000e: fix heap overflow in e1000_set_eeprom
	mm/khugepaged: fix ->anon_vma race
	scsi: lpfc: Fix buffer free/clear order in deferred receive path
	mm/slub: avoid accessing metadata when pointer is invalid in object_err()
	cpufreq/sched: Explicitly synchronize limits_changed flag handling
	KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer
	iio: chemical: pms7003: use aligned_s64 for timestamp
	iio: light: opt3001: fix deadlock due to concurrent flag access
	gpio: pca953x: fix IRQ storm on system wake up
	ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup
	dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status()
	net: dsa: microchip: update tag_ksz masks for KSZ9477 family
	net: dsa: microchip: linearize skb for tail-tagging switches
	vmxnet3: update MTU after device quiesce
	randstruct: gcc-plugin: Remove bogus void member
	randstruct: gcc-plugin: Fix attribute addition
	ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model
	pcmcia: Add error handling for add_interval() in do_validate_mem()
	spi: spi-fsl-lpspi: Fix transmissions when using CONT
	spi: spi-fsl-lpspi: Set correct chip-select polarity bit
	spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort
	cifs: fix integer overflow in match_server()
	dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status()
	Linux 5.4.299

Change-Id: I3dd8287459f00994b5550e295dc9137e49bf96bb
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-09-10 05:55:28 +00:00
Kees Cook
d3a2d5b755 randstruct: gcc-plugin: Fix attribute addition
[ Upstream commit f39f18f3c3531aa802b58a20d39d96e82eb96c14 ]

Based on changes in the 2021 public version of the randstruct
out-of-tree GCC plugin[1], more carefully update the attributes on
resulting decls, to avoid tripping checks in GCC 15's
comptypes_check_enum_int() when it has been configured with
"--enable-checking=misc":

arch/arm64/kernel/kexec_image.c:132:14: internal compiler error: in comptypes_check_enum_int, at c/c-typeck.cc:1519
  132 | const struct kexec_file_ops kexec_image_ops = {
      |              ^~~~~~~~~~~~~~
 internal_error(char const*, ...), at gcc/gcc/diagnostic-global-context.cc:517
 fancy_abort(char const*, int, char const*), at gcc/gcc/diagnostic.cc:1803
 comptypes_check_enum_int(tree_node*, tree_node*, bool*), at gcc/gcc/c/c-typeck.cc:1519
 ...

Link: https://archive.org/download/grsecurity/grsecurity-3.1-5.10.41-202105280954.patch.gz [1]
Reported-by: Thiago Jung Bauermann <thiago.bauermann@linaro.org>
Closes: https://github.com/KSPP/linux/issues/367
Closes: https://lore.kernel.org/lkml/20250530000646.104457-1-thiago.bauermann@linaro.org/
Reported-by: Ingo Saitz <ingo@hannover.ccc.de>
Closes: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1104745
Fixes: 313dd1b629 ("gcc-plugins: Add the randstruct plugin")
Tested-by: Thiago Jung Bauermann <thiago.bauermann@linaro.org>
Link: https://lore.kernel.org/r/20250530221824.work.623-kees@kernel.org
Signed-off-by: Kees Cook <kees@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-09 18:44:01 +02:00
Kees Cook
e34c5bbe36 randstruct: gcc-plugin: Remove bogus void member
[ Upstream commit e136a4062174a9a8d1c1447ca040ea81accfa6a8 ]

When building the randomized replacement tree of struct members, the
randstruct GCC plugin would insert, as the first member, a 0-sized void
member. This appears as though it was done to catch non-designated
("unnamed") static initializers, which wouldn't be stable since they
depend on the original struct layout order.

This was accomplished by having the side-effect of the "void member"
tripping an assert in GCC internals (count_type_elements) if the member
list ever needed to be counted (e.g. for figuring out the order of members
during a non-designated initialization), which would catch impossible type
(void) in the struct:

security/landlock/fs.c: In function ‘hook_file_ioctl_common’:
security/landlock/fs.c:1745:61: internal compiler error: in count_type_elements, at expr.cc:7075
 1745 |                         .u.op = &(struct lsm_ioctlop_audit) {
      |                                                             ^

static HOST_WIDE_INT
count_type_elements (const_tree type, bool for_ctor_p)
{
  switch (TREE_CODE (type))
...
    case VOID_TYPE:
    default:
      gcc_unreachable ();
    }
}

However this is a redundant safety measure since randstruct uses the
__designated_initializer attribute both internally and within the
__randomized_layout attribute macro so that this would be enforced
by the compiler directly even when randstruct was not enabled (via
-Wdesignated-init).

A recent change in Landlock ended up tripping the same member counting
routine when using a full-struct copy initializer as part of an anonymous
initializer. This, however, is a false positive as the initializer is
copying between identical structs (and hence identical layouts). The
"path" member is "struct path", a randomized struct, and is being copied
to from another "struct path", the "f_path" member:

        landlock_log_denial(landlock_cred(file->f_cred), &(struct landlock_request) {
                .type = LANDLOCK_REQUEST_FS_ACCESS,
                .audit = {
                        .type = LSM_AUDIT_DATA_IOCTL_OP,
                        .u.op = &(struct lsm_ioctlop_audit) {
                                .path = file->f_path,
                                .cmd = cmd,
                        },
                },
	...

As can be seen with the coming randstruct KUnit test, there appears to
be no behavioral problems with this kind of initialization when the void
member is removed from the randstruct GCC plugin, so remove it.

Reported-by: "Dr. David Alan Gilbert" <linux@treblig.org>
Closes: https://lore.kernel.org/lkml/Z_PRaKx7q70MKgCA@gallifrey/
Reported-by: Mark Brown <broonie@kernel.org>
Closes: https://lore.kernel.org/lkml/20250407-kbuild-disable-gcc-plugins-v1-1-5d46ae583f5e@kernel.org/
Reported-by: WangYuli <wangyuli@uniontech.com>
Closes: https://lore.kernel.org/lkml/337D5D4887277B27+3c677db3-a8b9-47f0-93a4-7809355f1381@uniontech.com/
Fixes: 313dd1b629 ("gcc-plugins: Add the randstruct plugin")
Signed-off-by: Kees Cook <kees@kernel.org>
Stable-dep-of: f39f18f3c353 ("randstruct: gcc-plugin: Fix attribute addition")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-09 18:44:01 +02:00
Greg Kroah-Hartman
0f7dff11a8 This is the 5.4.297 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmiwZfcACgkQONu9yGCS
 aT54xQ/7Bakgl/fkNhIOFy8BZtf4GX4drYUsyMFXzYKhmY+rsB41MuhgXEXnt29s
 JGG9evsj2MzyL5sxR244F3W/zoH+KEELCLvY93/z6Tt++9r9XNVvX8cWsHKIx9iV
 mcVrI0/IvQPnPpgeZoHSwakk86DzyB5Ck6ITCurTndVNx49wcqonqxdxDB79ChjB
 GE3XPrSodkPDQFs3ESYa2STRFmOCxm3YmD06rUfOA8WWxHfCPSB+uNZwBHuD5wla
 jS5Od20zdAvY+sex179zCSknJB4HBq8rKizIkMxeo84tivBodNbIb8Kf2Hy889ii
 5pqIsF0jRmhV/ADO94OfBIcDB5+xoMkCUnqcSH3vsmaenfU7r93Godsl4Shii0z+
 Wiw58LEZ/Ki1ZJEfgTvJw0A5sPF0F+06ySVcocUW1z4E8GuT/RKgjJA0BSu82fto
 5T8GTJ2nrT1eZbAOiau0MU5jK72PPlFk2uEWD/kW6VYfelmfjGF/SYNy/JSGpivh
 dOQkW5V1ZLKyVzVYXyqYFvnZTxDNYCm9qGgYOL6Wkr2Q6XM7QiSKhhGMEBWMpSXP
 0xuhZ332a/xrLXdXRR0s04CWPXe5Nb1R2XvJ7EC3JMx/TQHSWGqrbDD+4LBgZWmQ
 I6uSNV4IGaqQ83xx2ekSxa5HmbAhPhVvtY/0NhQzyKm7pFAY3WU=
 =o4wf
 -----END PGP SIGNATURE-----

Merge 5.4.297 into android11-5.4-lts

Changes in 5.4.297
	USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition
	USB: serial: option: add Foxconn T99W640
	USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI
	usb: gadget: configfs: Fix OOB read on empty string write
	i2c: stm32: fix the device used for the DMA map
	Input: xpad - set correct controller type for Acer NGR200
	pch_uart: Fix dma_sync_sg_for_device() nents value
	HID: core: ensure the allocated report buffer can contain the reserved report ID
	HID: core: ensure __hid_request reserves the report ID as the first byte
	HID: core: do not bypass hid_hw_raw_request
	phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept()
	af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd()
	af_packet: fix soft lockup issue caused by tpacket_snd()
	dmaengine: nbpfaxi: Fix memory corruption in probe()
	isofs: Verify inode mode when loading from disk
	memstick: core: Zero initialize id_reg in h_memstick_read_dev_id()
	mmc: bcm2835: Fix dma_unmap_sg() nents value
	mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models
	mmc: sdhci_am654: Workaround for Errata i2312
	soc: aspeed: lpc-snoop: Cleanup resources in stack-order
	soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled
	iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[]
	iio: adc: max1363: Reorder mode_list[] entries
	iio: adc: stm32-adc: Fix race in installing chained IRQ handler
	comedi: pcl812: Fix bit shift out of bounds
	comedi: aio_iiro_16: Fix bit shift out of bounds
	comedi: das16m1: Fix bit shift out of bounds
	comedi: das6402: Fix bit shift out of bounds
	comedi: Fix some signed shift left operations
	comedi: Fix use of uninitialized data in insn_rw_emulate_bits()
	net: emaclite: Fix missing pointer increment in aligned_read()
	net/sched: sch_qfq: Fix race condition on qfq_aggregate
	usb: net: sierra: check for no status endpoint
	Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb()
	Bluetooth: SMP: If an unallowed command is received consider it a failure
	Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout
	Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU
	net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
	net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree
	usb: musb: fix gadget state on disconnect
	usb: dwc3: qcom: Don't leave BCR asserted
	ASoC: fsl_sai: Force a software reset when starting in consumer mode
	virtio-net: ensure the received length does not exceed allocated size
	xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS
	power: supply: bq24190_charger: Fix runtime PM imbalance on error
	power: supply: bq24190_charger: using pm_runtime_resume_and_get instead of pm_runtime_get_sync
	power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition
	net_sched: sch_sfq: annotate data-races around q->perturb_period
	net_sched: sch_sfq: handle bigger packets
	net_sched: sch_sfq: don't allow 1 packet limit
	net_sched: sch_sfq: use a temporary work area for validating configuration
	net_sched: sch_sfq: move the limit validation
	net_sched: sch_sfq: reject invalid perturb period
	usb: hub: fix detection of high tier USB3 devices behind suspended hubs
	usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm
	regulator: core: fix NULL dereference on unbind due to stale coupling data
	RDMA/core: Rate limit GID cache warning messages
	net: appletalk: fix kerneldoc warnings
	net: appletalk: Fix use-after-free in AARP proxy probe
	net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class
	i2c: qup: jump out of the loop in case of timeout
	nilfs2: reject invalid file types when reading inodes
	comedi: comedi_test: Fix possible deletion of uninitialized timers
	ALSA: hda: Add missing NVIDIA HDA codec IDs
	usb: chipidea: udc: add new API ci_hdrc_gadget_connect
	usb: chipidea: udc: protect usb interrupt enable
	usb: chipidea: introduce CI_HDRC_CONTROLLER_VBUS_EVENT glue layer use
	usb: chipidea: add USB PHY event
	usb: phy: mxs: disconnect line when USB charger is attached
	ethernet: intel: fix building with large NR_CPUS
	ASoC: Intel: fix SND_SOC_SOF dependencies
	hfsplus: remove mutex_lock check in hfsplus_free_extents
	ASoC: ops: dynamically allocate struct snd_ctl_elem_value
	ARM: dts: vfxxx: Correctly use two tuples for timer address
	staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc()
	vmci: Prevent the dispatching of uninitialized payloads
	pps: fix poll support
	Revert "vmci: Prevent the dispatching of uninitialized payloads"
	usb: early: xhci-dbc: Fix early_ioremap leak
	ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface
	cpufreq: Init policy->rwsem before it may be possibly used
	samples: mei: Fix building on musl libc
	staging: nvec: Fix incorrect null termination of battery manufacturer
	bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
	bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure
	caif: reduce stack size, again
	wifi: rtl818x: Kill URBs before clearing tx status queue
	wifi: iwlwifi: Fix memory leak in iwl_mvm_init()
	iwlwifi: Add missing check for alloc_ordered_workqueue
	tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range
	m68k: Don't unregister boot console needlessly
	drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value
	netfilter: nf_tables: adjust lockdep assertions handling
	arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX
	net/sched: Restrict conditions for adding duplicating netems to qdisc tree
	wifi: rtl8xxxu: Fix RX skb size for aggregation disabled
	mwl8k: Add missing check after DMA map
	Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()"
	wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE
	can: kvaser_pciefd: Store device channel index
	can: kvaser_usb: Assign netdev.dev_port based on device channel index
	netfilter: xt_nfacct: don't assume acct name is null-terminated
	selftests: rtnetlink.sh: remove esp4_offload after test
	vrf: Drop existing dst reference in vrf_ip6_input_dst
	PCI: rockchip-host: Fix "Unexpected Completion" log message
	crypto: marvell/cesa - Fix engine load inaccuracy
	mtd: fix possible integer overflow in erase_xfer()
	clk: davinci: Add NULL check in davinci_lpsc_clk_register()
	power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set
	pinctrl: sunxi: Fix memory leak on krealloc failure
	crypto: ccp - Fix crash when rebind ccp device for ccp.ko
	perf tests bp_account: Fix leaked file descriptor
	clk: sunxi-ng: v3s: Fix de clock definition
	scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value
	scsi: mvsas: Fix dma_unmap_sg() nents value
	scsi: isci: Fix dma_unmap_sg() nents value
	watchdog: ziirave_wdt: check record length in ziirave_firm_verify()
	hwrng: mtk - handle devm_pm_runtime_enable errors
	crypto: img-hash - Fix dma_unmap_sg() nents value
	soundwire: stream: restore params when prepare ports fail
	fs/orangefs: Allow 2 more characters in do_c_string()
	dmaengine: mv_xor: Fix missing check after DMA map and missing unmap
	dmaengine: nbpfaxi: Add missing check after DMA map
	crypto: qat - fix seq_file position update in adf_ring_next()
	fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref
	jfs: fix metapage reference count leak in dbAllocCtl
	mtd: rawnand: atmel: Fix dma_mapping_error() address
	mtd: rawnand: atmel: set pmecc data setup time
	bpf: Check flow_dissector ctx accesses are aligned
	module: Restore the moduleparam prefix length check
	rtc: ds1307: fix incorrect maximum clock rate handling
	rtc: hym8563: fix incorrect maximum clock rate handling
	rtc: pcf8563: fix incorrect maximum clock rate handling
	f2fs: fix to avoid UAF in f2fs_sync_inode_meta()
	f2fs: fix to avoid panic in f2fs_evict_inode
	f2fs: fix to avoid out-of-boundary access in devs.path
	usb: chipidea: udc: fix sleeping function called from invalid context
	pci/hotplug/pnv-php: Improve error msg on power state change failure
	pci/hotplug/pnv-php: Wrap warnings in macro
	NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()
	netpoll: prevent hanging NAPI when netcons gets enabled
	pptp: ensure minimal skb length in pptp_xmit()
	ipv6: reject malicious packets in ipv6_gso_segment()
	net: drop UFO packets in udp_rcv_segment()
	benet: fix BUG when creating VFs
	smb: client: let recv_done() cleanup before notifying the callers.
	pptp: fix pptp_xmit() error path
	perf/core: Don't leak AUX buffer refcount on allocation failure
	perf/core: Exit early on perf_mmap() fail
	perf/core: Prevent VMA split of buffer mappings
	net/packet: fix a race in packet_set_ring() and packet_notifier()
	vsock: Do not allow binding to VMADDR_PORT_ANY
	USB: serial: option: add Foxconn T99W709
	MIPS: mm: tlb-r4k: Uniquify TLB entries on init
	usb: gadget : fix use-after-free in composite_dev_cleanup()
	io_uring: don't use int for ABI
	ALSA: usb-audio: Validate UAC3 power domain descriptors, too
	ALSA: usb-audio: Validate UAC3 cluster segment descriptors
	netlink: avoid infinite retry looping in netlink_unicast()
	net: gianfar: fix device leak when querying time stamp info
	net: dpaa: fix device leak when querying time stamp info
	NFSD: detect mismatch of file handle and delegation stateid in OPEN op
	sunvdc: Balance device refcount in vdc_port_mpgroup_check
	fs: Prevent file descriptor table allocations exceeding INT_MAX
	Documentation: ACPI: Fix parent device references
	ACPI: processor: perflib: Fix initial _PPC limit application
	ACPI: processor: perflib: Move problematic pr->performance check
	udp: also consider secpath when evaluating ipsec use for checksumming
	netfilter: ctnetlink: fix refcount leak on table dump
	sctp: linearize cloned gso packets in sctp_rcv
	hfs: fix slab-out-of-bounds in hfs_bnode_read()
	hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read()
	hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()
	hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file()
	arm64: Handle KCOV __init vs inline mismatches
	udf: Verify partition map count
	drbd: add missing kref_get in handle_write_conflicts
	hfs: fix not erasing deleted b-tree node issue
	securityfs: don't pin dentries twice, once is enough...
	usb: xhci: print xhci->xhc_state when queue_command failed
	selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t
	usb: xhci: Avoid showing warnings for dying controller
	usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command
	usb: xhci: Avoid showing errors during surprise removal
	cpufreq: Exit governor when failed to start old governor
	ARM: rockchip: fix kernel hang during smp initialization
	ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed
	gpio: tps65912: check the return value of regmap_update_bits()
	ARM: tegra: Use I/O memcpy to write to IRAM
	selftests: tracing: Use mutex_unlock for testing glob filter
	PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit()
	thermal: sysfs: Return ENODATA instead of EAGAIN for reads
	PM: sleep: console: Fix the black screen issue
	ACPI: processor: fix acpi_object initialization
	ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path
	mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode()
	ASoC: hdac_hdmi: Rate limit logging on connection and disconnection
	ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4
	usb: core: usb_submit_urb: downgrade type check
	pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop()
	platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches
	ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control
	ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros
	ASoC: codecs: rt5640: Retry DEVICE_ID verification
	ktest.pl: Prevent recursion of default variable options
	wifi: cfg80211: reject HTC bit for management frames
	s390/time: Use monotonic clock in get_cycles()
	be2net: Use correct byte order and format string for TCP seq and ack_seq
	et131x: Add missing check after DMA map
	net: ag71xx: Add missing check after DMA map
	rcu: Protect ->defer_qs_iw_pending from data race
	wifi: cfg80211: Fix interface type validation
	net: ipv4: fix incorrect MTU in broadcast routes
	net: thunderx: Fix format-truncation warning in bgx_acpi_match_id()
	wifi: iwlwifi: mvm: fix scan request validation
	s390/stp: Remove udelay from stp_sync_clock()
	(powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer
	net: fec: allow disable coalescing
	wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd()
	wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect
	wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`.
	netmem: fix skb_frag_address_safe with unreadable skbs
	wifi: iwlegacy: Check rate_idx range after addition
	net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs
	net: dsa: b53: fix b53_imp_vlan_setup for BCM5325
	net: dsa: b53: prevent SWITCH_CTRL access on BCM5325
	net: ncsi: Fix buffer overflow in fetching version id
	uapi: in6: restore visibility of most IPv6 socket options
	net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325
	vhost: fail early when __vhost_add_used() fails
	cifs: Fix calling CIFSFindFirst() for root path without msearch
	ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr
	scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated
	fs/orangefs: use snprintf() instead of sprintf()
	watchdog: dw_wdt: Fix default timeout
	MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free}
	scsi: bfa: Double-free fix
	jfs: truncate good inode pages when hard link is 0
	jfs: Regular file corruption check
	jfs: upper bound check of tree index in dbAllocAG
	MIPS: Don't crash in stack_top() for tasks without ABI or vDSO
	RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask()
	scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure
	scsi: mpt3sas: Correctly handle ATA device errors
	pinctrl: stm32: Manage irq affinity settings
	media: tc358743: Check I2C succeeded during probe
	media: tc358743: Return an appropriate colorspace from tc358743_set_fmt
	media: tc358743: Increase FIFO trigger level to 374
	media: usb: hdpvr: disable zero-length read messages
	media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb()
	media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar
	media: uvcvideo: Fix bandwidth issue for Alcor camera
	i3c: add missing include to internal header
	PCI: pnv_php: Work around switches with broken presence detection
	i3c: don't fail if GETHDRCAP is unsupported
	kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c
	kconfig: nconf: Ensure null termination where strncpy is used
	scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans
	scsi: aacraid: Stop using PCI_IRQ_AFFINITY
	ipmi: Use dev_warn_ratelimited() for incorrect message warnings
	kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed()
	kconfig: gconf: fix potential memory leak in renderer_edited()
	kconfig: lxdialog: fix 'space' to (de)select options
	ipmi: Fix strcpy source and destination the same
	net: phy: smsc: add proper reset flags for LAN8710A
	pNFS: Fix stripe mapping in block/scsi layout
	pNFS: Fix disk addr range check in block/scsi layout
	pNFS: Handle RPC size limit for layoutcommits
	pNFS: Fix uninited ptr deref in block/scsi layout
	rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe
	scsi: lpfc: Remove redundant assignment to avoid memory leak
	drm/amdgpu: fix incorrect vm flags to map bo
	misc: rtsx: usb: Ensure mmc child device is active when card is present
	comedi: fix race between polling and detaching
	thunderbolt: Fix copy+paste error in match_service_id()
	btrfs: fix log tree replay failure due to file with 0 links and extents
	parisc: Makefile: fix a typo in palo.conf
	mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup()
	media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()
	media: uvcvideo: Do not mark valid metadata as invalid
	serial: 8250: fix panic due to PSLVERR
	cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table()
	m68k: Fix lost column on framebuffer debug console
	usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init()
	usb: gadget: udc: renesas_usb3: fix device leak at unbind
	usb: dwc3: meson-g12a: fix device leaks at unbind
	vt: keyboard: Don't process Unicode characters in K_OFF mode
	vt: defkeymap: Map keycodes above 127 to K_HOLE
	Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()"
	ext4: check fast symlink for ea_inode correctly
	ext4: fix fsmap end of range reporting with bigalloc
	ext4: fix reserved gdt blocks handling in fsmap
	ata: libata-scsi: Fix ata_to_sense_error() status handling
	zynq_fpga: use sgtable-based scatterlist wrappers
	wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table()
	pwm: imx-tpm: Reset counter if CMOD is 0
	mtd: rawnand: fsmc: Add missing check after DMA map
	PCI: endpoint: Fix configfs group list head handling
	PCI: endpoint: Fix configfs group removal on driver teardown
	jbd2: prevent softlockup in jbd2_log_do_checkpoint()
	soc/tegra: pmc: Ensure power-domains are in a known state
	media: gspca: Add bounds checking to firmware parser
	media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init()
	media: usbtv: Lock resolution while streaming
	media: ov2659: Fix memory leaks in ov2659_probe()
	media: venus: Add a check for packet size after reading from shared memory
	memstick: Fix deadlock by moving removing flag earlier
	squashfs: fix memory leak in squashfs_fill_super
	drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3
	drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs
	fs/buffer: fix use-after-free when call bh_read() helper
	move_mount: allow to add a mount into an existing group
	use uniform permission checks for all mount propagation changes
	fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable()
	ftrace: Also allocate and copy hash for reading of filter files
	iio: proximity: isl29501: fix buffered read on big-endian systems
	usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive
	USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera
	usb: storage: realtek_cr: Use correct byte order for bcs->Residue
	USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles
	usb: dwc3: Ignore late xferNotReady event to prevent halt timeout
	ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS
	kbuild: Update assembler calls to use proper flags and language target
	mips: Include KBUILD_CPPFLAGS in CHECKFLAGS invocation
	kbuild: Add CLANG_FLAGS to as-instr
	kbuild: add $(CLANG_FLAGS) to KBUILD_CPPFLAGS
	kbuild: Add KBUILD_CPPFLAGS to as-option invocation
	comedi: Fix initialization of data for instructions that write to subdevice
	comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large
	ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value
	PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports
	net: usbnet: Avoid potential RCU stall on LINK_CHANGE event
	net: usbnet: Fix the wrong netif_carrier_on() call
	ice: Fix a null pointer dereference in ice_copy_and_init_pkg()
	drm/sched: Remove optimization that causes hang when killing dependent jobs
	mm/zsmalloc.c: convert to use kmem_cache_zalloc in cache_alloc_zspage()
	mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n
	f2fs: fix to do sanity check on ino and xnid
	iio: hid-sensor-prox: Fix incorrect OFFSET calculation
	x86/mce/amd: Add default names for MCA banks and blocks
	usb: hub: avoid warm port reset during USB3 disconnect
	usb: hub: Don't try to recover devices lost during warm reset.
	tracing: Add down_write(trace_event_sem) when adding trace event
	pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov
	nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()
	mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery
	x86/fpu: Delay instruction pointer fixup until after warning
	ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx()
	mm/kmemleak: turn kmemleak_lock and object->lock to raw_spinlock_t
	mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock
	USB: cdc-acm: do not log successful probe on later errors
	cdc-acm: fix race between initial clearing halt and open
	usb: typec: fusb302: cache PD RX state
	NFSv4: Fix nfs4_bitmap_copy_adjust()
	NFS: Fix up handling of outstanding layoutcommit in nfs_update_inode()
	NFS: Fix the setting of capabilities when automounting a new filesystem
	usb: musb: omap2430: fix device leak at unbind
	rtc: ds1307: handle oscillator stop flag (OSF) for ds1341
	soc: qcom: mdt_loader: Ensure we don't read past the ELF header
	ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig
	media: v4l2-ctrls: always copy the controls on completion
	media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free()
	media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()
	pwm: mediatek: Implement .apply() callback
	pwm: mediatek: Handle hardware enable and clock enable separately
	pwm: mediatek: Fix duty and period setting
	drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS
	media: venus: vdec: Clamp param smaller than 1fps and bigger than 240.
	media: qcom: camss: cleanup media device allocated resource on error path
	media: venus: protect against spurious interrupts during probe
	f2fs: fix to avoid out-of-boundary access in dnode page
	media: venus: hfi: explicitly release IRQ during teardown
	btrfs: populate otime when logging an inode item
	sch_drr: make drr_qlen_notify() idempotent
	sch_hfsc: make hfsc_qlen_notify() idempotent
	sch_qfq: make qfq_qlen_notify() idempotent
	codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()
	mm: drop the assumption that VM_SHARED always implies writable
	mm: update memfd seal write check to include F_SEAL_WRITE
	mm: perform the mapping_map_writable() check after call_mmap()
	net: sched: extract common action counters update code into function
	net: sched: extract bstats update code into function
	net: sched: extract qstats update code into functions
	net: sched: don't expose action qstats to skb_tc_reinsert()
	selftests: forwarding: tc_actions.sh: add matchall mirror test
	net/sched: act_mirred: refactor the handle of xmit
	net/sched: act_mirred: better wording on protection against excessive stack growth
	act_mirred: use the backlog for nested calls to mirred ingress
	Bluetooth: fix use-after-free in device_for_each_child()
	cifs: Fix UAF in cifs_demultiplex_thread()
	NFS: Fix up commit deadlocks
	nfs: fix UAF in direct writes
	usb: xhci: Fix slot_id resource race conflict
	scsi: qla4xxx: Prevent a potential error pointer dereference
	ALSA: usb-audio: Fix size validation in convert_chmap_v3()
	ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add
	ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc
	net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit
	net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate
	ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation
	s390/hypfs: Avoid unnecessary ioctl registration in debugfs
	s390/hypfs: Enable limited access during lockdown
	alloc_fdtable(): change calling conventions.
	Linux 5.4.297

Change-Id: I31d1928fd98d4aebd14d5e4753dffcf88dd4c03b
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-09-02 10:52:40 +00:00
Michael Bestas
ee69f5d73d
Merge remote-tracking branch 'sm8350/lineage-20' into lineage-22.2
* sm8350/lineage-20:
  ANDROID: bpf: do not fail to load if log is full
  ANDROID: fix kernelci compressed kernel linking
  ANDROID: GKI: Update symbol list for Zebra
  UPSTREAM: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
  Linux 5.4.295
  scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops
  arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()
  perf: Fix sample vs do_exit()
  s390/pci: Fix __pcilg_mio_inuser() inline assembly
  rtc: test: Fix invalid format specifier.
  jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()
  mm/huge_memory: fix dereferencing invalid pmd migration entry
  rtc: Make rtc_time64_to_tm() support dates before 1970
  rtc: Improve performance of rtc_time64_to_tm(). Add tests.
  xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create
  posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
  ARM: dts: am335x-bone-common: Increase MDIO reset deassert delay to 50ms
  ARM: dts: am335x-bone-common: Increase MDIO reset deassert time
  ARM: dts: am335x-bone-common: Add GPIO PHY reset on revision C3 board
  net: atm: fix /proc/net/atm/lec handling
  ...

Change-Id: Ibdde607f7a4ae5a74994603f513e7f94a9eb04ad
2025-09-02 13:51:29 +03:00
Michael Bestas
2b9e22c70c
Merge tag 'ASB-2025-08-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
https://source.android.com/docs/security/bulletin/2025-08-01

* tag 'ASB-2025-08-05_11-5.4' of https://android.googlesource.com/kernel/common:
  ANDROID: bpf: do not fail to load if log is full
  ANDROID: fix kernelci compressed kernel linking
  ANDROID: GKI: Update symbol list for Zebra
  UPSTREAM: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
  Linux 5.4.295
  scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops
  arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()
  perf: Fix sample vs do_exit()
  s390/pci: Fix __pcilg_mio_inuser() inline assembly
  rtc: test: Fix invalid format specifier.
  jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()
  mm/huge_memory: fix dereferencing invalid pmd migration entry
  rtc: Make rtc_time64_to_tm() support dates before 1970
  rtc: Improve performance of rtc_time64_to_tm(). Add tests.
  xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create
  posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
  ARM: dts: am335x-bone-common: Increase MDIO reset deassert delay to 50ms
  ARM: dts: am335x-bone-common: Increase MDIO reset deassert time
  ARM: dts: am335x-bone-common: Add GPIO PHY reset on revision C3 board
  net: atm: fix /proc/net/atm/lec handling
  net: atm: add lec_mutex
  calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().
  tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
  tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior
  atm: atmtcp: Free invalid length skb in atmtcp_c_send().
  mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
  wifi: carl9170: do not ping device which has failed to load firmware
  aoe: clean device rq_list in aoedev_downdev()
  hwmon: (occ) fix unaligned accesses
  drm/nouveau/bl: increase buffer size to avoid truncate warning
  erofs: remove unused trace event erofs_destroy_inode
  ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged
  ALSA: hda/intel: Add Thinkpad E15 to PM deny list
  Input: sparcspkr - avoid unannotated fall-through
  HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()
  atm: Revert atm_account_tx() if copy_from_iter_full() fails.
  selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len
  scsi: s390: zfcp: Ensure synchronous unit_add
  scsi: storvsc: Increase the timeouts to storvsc_timeout
  jffs2: check jffs2_prealloc_raw_node_refs() result in few other places
  jffs2: check that raw node were preallocated before writing summary
  drivers/rapidio/rio_cm.c: prevent possible heap overwrite
  Revert "x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2" on v6.6 and older
  powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery
  platform/x86: dell_rbu: Stop overwriting data buffer
  platform: Add Surface platform directory
  Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first"
  tee: Prevent size calculation wraparound on 32-bit kernels
  ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY
  bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value
  watchdog: da9052_wdt: respect TWDMIN
  i40e: fix MMIO write access to an invalid page in i40e_clear_hw
  sock: Correct error checking condition for (assign|release)_proto_idx()
  scsi: lpfc: Use memcpy() for BIOS version
  vxlan: Do not treat dst cache initialization errors as fatal
  clk: rockchip: rk3036: mark ddrphy as critical
  wifi: mac80211: do not offer a mesh path if forwarding is disabled
  net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info
  pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get()
  pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction()
  pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction()
  pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name()
  ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT
  tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows
  tcp: always seek for minimal rtt in tcp_rcv_rtt_update()
  net: dlink: add synchronization for stats update
  sctp: Do not wake readers in __sctp_write_space()
  emulex/benet: correct command version selection in be_cmd_get_stats()
  i2c: designware: Invoke runtime suspend on quick slave re-registration
  net: macb: Check return value of dma_set_mask_and_coherent()
  cpufreq: Force sync policy boost with global boost on sysfs update
  nios2: force update_mmu_cache on spurious tlb-permission--related pagefaults
  media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode()
  media: tc358743: ignore video while HPD is low
  drm/amdkfd: Set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB
  jfs: Fix null-ptr-deref in jfs_ioc_trim
  drm/amdgpu/gfx9: fix CSIB handling
  drm/amdgpu/gfx8: fix CSIB handling
  jfs: fix array-index-out-of-bounds read in add_missing_indices
  drm/amdgpu/gfx7: fix CSIB handling
  drm/amdgpu/gfx10: fix CSIB handling
  drm/msm/a6xx: Increase HFI response timeout
  drm/amd/display: Add NULL pointer checks in dm_force_atomic_commit()
  media: uapi: v4l: Fix V4L2_TYPE_IS_OUTPUT condition
  drm/msm/hdmi: add runtime PM calls to DDC transfer function
  drm/bridge: analogix_dp: Add irq flag IRQF_NO_AUTOEN instead of calling disable_irq()
  sunrpc: update nextcheck time when adding new cache entries
  drm/amdgpu/gfx6: fix CSIB handling
  ACPI: battery: negate current when discharging
  PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn()
  power: supply: bq27xxx: Retrieve again when busy
  ACPICA: fix acpi parse and parseext cache leaks
  ACPICA: Avoid sequence overread in call to strncmp()
  ACPICA: fix acpi operand cache leak in dswstate.c
  iio: adc: ad7606_spi: fix reg write value mask
  PCI: Fix lock symmetry in pci_slot_unlock()
  PCI: Add ACS quirk for Loongson PCIe
  uio_hv_generic: Use correct size for interrupt and monitor pages
  regulator: max14577: Add error check for max14577_read_reg()
  mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS
  staging: iio: ad5933: Correct settling cycles encoding per datasheet
  net: ch9200: fix uninitialised access during mii_nway_restart
  ftrace: Fix UAF when lookup kallsym after ftrace disabled
  dm-mirror: fix a tiny race condition
  mtd: nand: sunxi: Add randomizer configuration before randomizer enable
  mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk
  mm: fix ratelimit_pages update error in dirty_ratio_handler()
  ipc: fix to protect IPCS lookups using RCU
  parisc: fix building with gcc-15
  vgacon: Add check for vc_origin address range in vgacon_scroll()
  fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var
  EDAC/altera: Use correct write width with the INTTEST register
  NFC: nci: uart: Set tty->disc_data only in success path
  f2fs: prevent kernel warning due to negative i_nlink from corrupted image
  Input: ims-pcu - check record size in ims_pcu_flash_firmware()
  ext4: fix calculation of credits for extent tree modification
  ext4: inline: fix len overflow in ext4_prepare_inline_data
  bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device
  ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330
  ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap()
  media: v4l2-dev: fix error handling in __video_register_device()
  media: gspca: Add error handling for stv06xx_read_sensor()
  wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723
  nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request
  wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()
  gfs2: move msleep to sleepable context
  configfs: Do not override creating attribute file failure in populate_attrs()
  net: usb: aqc111: debug info before sanitation
  calipso: unlock rcu before returning -EAFNOSUPPORT
  xen/arm: call uaccess_ttbr0_enable for dm_op hypercall
  usb: Flush altsetting 0 endpoints before reinitializating them after reset.
  fs/filesystems: Fix potential unsigned integer underflow in fs_name()
  net/mdiobus: Fix potential out-of-bounds read/write access
  drm/amd/display: Do not add '-mhard-float' to dcn2{1,0}_resource.o for clang
  drm/amd/display: Do not add '-mhard-float' to dml_ccflags for clang
  MIPS: Move '-Wa,-msoft-float' check from as-option to cc-option
  x86/boot/compressed: prefer cc-option for CFLAGS additions
  net: mdio: C22 is now optional, EOPNOTSUPP if not provided
  net_sched: tbf: fix a race in tbf_change()
  net_sched: red: fix a race in __red_change()
  net_sched: prio: fix a race in prio_tune()
  net/mlx5: Fix return value when searching for existing flow group
  net/mlx5: Wait for inactive autogroups
  i40e: retry VFLR handling if there is ongoing VF reset
  i40e: return false from i40e_reset_vf if reset is in progress
  net_sched: sch_sfq: fix a potential crash on gso_skb handling
  scsi: iscsi: Fix incorrect error path labels for flashnode operations
  NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes
  NFSD: Fix ia_size underflow
  Input: synaptics-rmi - fix crash with unsupported versions of F34
  Input: synaptics-rmi4 - convert to use sysfs_emit() APIs
  pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id()
  do_change_type(): refuse to operate on unmounted/not ours mounts
  PM: sleep: Fix power.is_suspended cleanup for direct-complete devices
  ice: create new Tx scheduler nodes for new queues only
  Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION
  net/mlx4_en: Prevent potential integer overflow calculating Hz
  vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl()
  serial: Fix potential null-ptr-deref in mlb_usio_probe()
  usb: renesas_usbhs: Reorder clock handling and power management in probe
  rtc: Fix offset calculation for .start_secs < 0
  rtc: sh: assign correct interrupts with DT
  perf record: Fix incorrect --user-regs comments
  perf tests switch-tracking: Fix timestamp comparison
  mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE
  mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove()
  rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send()
  perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3
  perf ui browser hists: Set actions->thread before calling do_zoom_thread()
  fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()
  soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop()
  soc: aspeed: lpc: Fix impossible judgment condition
  arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou
  ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device
  bus: fsl-mc: fix double-free on mc_dev
  nilfs2: do not propagate ENOENT error from nilfs_btree_propagate()
  nilfs2: add pointer check for nilfs_direct_propagate()
  Squashfs: check return result of sb_min_blocksize
  ARM: dts: at91: at91sam9263: fix NAND chip selects
  ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select
  f2fs: fix to correct check conditions in f2fs_cross_rename
  f2fs: use d_inode(dentry) cleanup dentry->d_inode
  calipso: Don't call calipso functions for AF_INET sk.
  net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy
  net: usb: aqc111: fix error handling of usbnet read calls
  netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy
  wifi: ath9k_htc: Abort software beacon handling if disabled
  bpf: Fix WARN() in get_bpf_raw_tp_regs
  pinctrl: at91: Fix possible out-of-boundary access
  ktls, sockmap: Fix missing uncharge operation
  netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it
  f2fs: clean up w/ fscrypt_is_bounce_page()
  RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h
  wifi: rtw88: do not ignore hardware read error during DPK
  net: ncsi: Fix GCPS 64-bit member variables
  f2fs: fix to do sanity check on sbi->total_valid_block_count
  drm/tegra: rgb: Fix the unbound reference count
  drm/vkms: Adjust vkms_state->active_planes allocation type
  drm: rcar-du: Fix memory leak in rcar_du_vsps_init()
  selftests/seccomp: fix syscall_restart test for arm compat
  firmware: psci: Fix refcount leak in psci_dt_init
  m68k: mac: Fix macintosh_config for Mac II
  drm/vmwgfx: Add seqno waiter for sync_files
  spi: sh-msiof: Fix maximum DMA transfer size
  ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions"
  x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges()
  PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks()
  EDAC/skx_common: Fix general protection fault
  crypto: marvell/cesa - Avoid empty transfer descriptor
  crypto: marvell/cesa - Handle zero-length skcipher requests
  x86/cpu: Sanitize CPUID(0x80000000) output
  perf/core: Fix broken throttling when max_samples_per_tick=1
  gfs2: gfs2_create_inode error handling fix
  netfilter: nft_socket: fix sk refcount leaks
  thunderbolt: Do not double dequeue a configuration request
  usb: usbtmc: Fix timeout value in get_stb
  usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device
  usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE
  pinctrl: armada-37xx: set GPIO output value before setting direction
  pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs > 31
  tracing: Fix compilation warning on arm32
  BACKPORT: binder: Create safe versions of binder log files
  UPSTREAM: binder: Refactor binder_node print synchronization
  Revert "coredump: hand a pidfd to the usermode coredump helper"
  Linux 5.4.294
  xen/swiotlb: relax alignment requirements
  platform/x86: thinkpad_acpi: Ignore battery threshold change event notification
  platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys
  spi: spi-sun4i: fix early activation
  um: let 'make clean' properly clean underlying SUBARCH as well
  platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS
  nfs: don't share pNFS DS connections between net namespaces
  HID: quirks: Add ADATA XPG alpha wireless mouse support
  coredump: hand a pidfd to the usermode coredump helper
  fork: use pidfd_prepare()
  pid: add pidfd_prepare()
  pidfd: check pid has attached task in fdinfo
  coredump: fix error handling for replace_fd()
  net_sched: hfsc: Address reentrant enqueue adding class to eltree twice
  smb: client: Reset all search buffer pointers when releasing buffer
  smb: client: Fix use-after-free in cifs_fill_dirent
  drm/i915/gvt: fix unterminated-string-initialization warning
  netfilter: nf_tables: do not defer rule destruction via call_rcu
  netfilter: nf_tables: wait for rcu grace period on net_device removal
  netfilter: nf_tables: pass nft_chain to destroy function, not nft_ctx
  kbuild: Disable -Wdefault-const-init-unsafe
  spi: spi-fsl-dspi: restrict register range for regmap access
  mm/page_alloc.c: avoid infinite retries caused by cpuset race
  memcg: always call cond_resched() after fn()
  drm/edid: fixed the bug that hdr metadata was not reset
  llc: fix data loss when reading from a socket in llc_ui_recvmsg()
  ALSA: pcm: Fix race of buffer access at PCM OSS layer
  can: bcm: add missing rcu read protection for procfs content
  can: bcm: add locking for bcm_op runtime updates
  crypto: algif_hash - fix double free in hash_accept
  sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()
  net: dwmac-sun8i: Use parsed internal PHY address instead of 1
  bridge: netfilter: Fix forwarding of fragmented packets
  xfrm: Sanitize marks before insert
  __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock
  xenbus: Allow PVH dom0 a non-local xenstore
  btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref
  nvmet-tcp: don't restore null sk_state_change
  ASoC: Intel: bytcr_rt5640: Add DMI quirk for Acer Aspire SW3-013
  pinctrl: meson: define the pull up/down resistor value as 60 kOhm
  drm: Add valid clones check
  drm/atomic: clarify the rules around drm_atomic_state->allow_modeset
  regulator: ad5398: Add device tree support
  wifi: rtw88: Don't use static local variable in rtw8822b_set_tx_power_index_by_rate
  bpftool: Fix readlink usage in get_fd_type
  HID: usbkbd: Fix the bit shift number for LED_KANA
  scsi: st: Restore some drive settings after reset
  scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine
  rcu: fix header guard for rcu_all_qs()
  rcu: handle quiescent states for PREEMPT_RCU=n, PREEMPT_COUNT=y
  vxlan: Annotate FDB data races
  hwmon: (xgene-hwmon) use appropriate type for the latency value
  ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure().
  net/mlx5e: reduce rep rxq depth to 256 for ECPF
  net/mlx5e: set the tx_queue_len for pfifo_fast
  net/mlx5: Extend Ethtool loopback selftest to support non-linear SKB
  phy: core: don't require set_mode() callback for phy_get_mode() to work
  net/mlx4_core: Avoid impossible mlx4_db_alloc() order value
  smack: recognize ipv4 CIPSO w/o categories
  pinctrl: devicetree: do not goto err when probing hogs in pinctrl_dt_to_map
  ASoC: ops: Enforce platform maximum on initial value
  net/mlx5: Apply rate-limiting to high temperature warning
  net/mlx5: Modify LSB bitmask in temperature event to include only the first bit
  ACPI: HED: Always initialize before evged
  PCI: Fix old_size lower bound in calculate_iosize() too
  EDAC/ie31200: work around false positive build warning
  net: pktgen: fix access outside of user given buffer in pktgen_thread_write()
  wifi: rtw88: Fix rtw_init_ht_cap() for RTL8814AU
  scsi: mpt3sas: Send a diag reset if target reset fails
  MIPS: pm-cps: Use per-CPU variables as per-CPU, not per-core
  MIPS: Use arch specific syscall name match function
  cpuidle: menu: Avoid discarding useful information
  x86/nmi: Add an emergency handler in nmi_desc & use it in nmi_shootdown_cpus()
  bonding: report duplicate MAC address in all situations
  net: xgene-v2: remove incorrect ACPI_PTR annotation
  drm/amdkfd: KFD release_work possible circular locking
  net/mlx5: Avoid report two health errors on same syndrome
  fpga: altera-cvp: Increase credit timeout
  drm/mediatek: mtk_dpi: Add checks for reg_h_fre_con existence
  hwmon: (gpio-fan) Add missing mutex locks
  x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2
  net: pktgen: fix mpls maximum labels list parsing
  pinctrl: bcm281xx: Use "unsigned int" instead of bare "unsigned"
  media: cx231xx: set device_caps for 417
  orangefs: Do not truncate file size
  dm cache: prevent BUG_ON by blocking retries on failed device resumes
  media: c8sectpfe: Call of_node_put(i2c_bus) only once in c8sectpfe_probe()
  ARM: tegra: Switch DSI-B clock parent to PLLD on Tegra114
  ieee802154: ca8210: Use proper setters and getters for bitwise types
  rtc: ds1307: stop disabling alarms on probe
  powerpc/prom_init: Fixup missing #size-cells on PowerBook6,7
  mmc: sdhci: Disable SD card clock before changing parameters
  netfilter: conntrack: Bound nf_conntrack sysctl writes
  posix-timers: Add cond_resched() to posix_timer_add() search loop
  xen: Add support for XenServer 6.1 platform device
  dm: restrict dm device size to 2^63-512 bytes
  kbuild: fix argument parsing in scripts/config
  scsi: st: ERASE does not change tape location
  scsi: st: Tighten the page format heuristics with MODE SELECT
  ext4: reorder capability check last
  um: Update min_low_pfn to match changes in uml_reserved
  um: Store full CSGSFS and SS register from mcontext
  btrfs: send: return -ENAMETOOLONG when attempting a path that is too long
  btrfs: avoid linker error in btrfs_find_create_tree_block()
  i2c: pxa: fix call balance of i2c->clk handling routines
  mmc: host: Wait for Vdd to settle on card power off
  libnvdimm/labels: Fix divide error in nd_label_data_init()
  pNFS/flexfiles: Report ENETDOWN as a connection error
  tools/build: Don't pass test log files to linker
  dql: Fix dql->limit value when reset.
  SUNRPC: rpc_clnt_set_transport() must not change the autobind setting
  NFSv4: Treat ENETUNREACH errors as fatal for state recovery
  fbdev: core: tileblit: Implement missing margin clearing for tileblit
  fbdev: fsl-diu-fb: add missing device_remove_file()
  mailbox: use error ret code of of_parse_phandle_with_args()
  kconfig: merge_config: use an empty file as initfile
  cgroup: Fix compilation issue due to cgroup_mutex not being exported
  dma-mapping: avoid potential unused data compilation warning
  scsi: target: iscsi: Fix timeout on deleted connection
  openvswitch: Fix unsafe attribute parsing in output_userspace()
  Input: synaptics - enable InterTouch on TUXEDO InfinityBook Pro 14 v5
  Input: synaptics - enable SMBus for HP Elitebook 850 G1
  clocksource/i8253: Use raw_spinlock_irqsave() in clockevent_i8253_disable()
  phy: renesas: rcar-gen3-usb2: Set timing registers only once
  phy: Fix error handling in tegra_xusb_port_init
  ALSA: es1968: Add error handling for snd_pcm_hw_constraint_pow2()
  ACPI: PPTT: Fix processor subtable walk
  dmaengine: Revert "dmaengine: dmatest: Fix dmatest waiting less when interrupted"
  NFSv4/pnfs: Reset the layout state after a layoutreturn
  NFSv4/pnfs: pnfs_set_layout_stateid() should update the layout cred
  qlcnic: fix memory leak in qlcnic_sriov_channel_cfg_cmd()
  ALSA: sh: SND_AICA should depend on SH_DMA_API
  net: dsa: sja1105: discard incoming frames in BR_STATE_LISTENING
  spi: loopback-test: Do not split 1024-byte hexdumps
  nfs: handle failure of nfs_get_lock_context in unlock path
  RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug
  iio: chemical: sps30: use aligned_s64 for timestamp
  iio: adc: ad7768-1: Fix insufficient alignment of timestamp.
  staging: axis-fifo: Correct handling of tx_fifo_depth for size validation
  staging: axis-fifo: avoid parsing ignored device tree properties
  staging: axis-fifo: Remove hardware resets for user errors
  staging: axis-fifo: replace spinlock with mutex
  platform/x86: asus-wmi: Fix wlan_ctrl_by_user detection
  do_umount(): add missing barrier before refcount checks in sync case
  nvme: unblock ctrl state transition for firmware update
  MIPS: Fix MAX_REG_OFFSET
  iio: adc: dln2: Use aligned_s64 for timestamp
  types: Complement the aligned types with signed 64-bit one
  usb: usbtmc: Fix erroneous generic_read ioctl return
  usb: usbtmc: Fix erroneous wait_srq ioctl return
  usb: usbtmc: Fix erroneous get_stb ioctl error returns
  USB: usbtmc: use interruptible sleep in usbtmc_read
  usb: typec: ucsi: displayport: Fix NULL pointer access
  usb: typec: tcpm: delay SNK_TRY_WAIT_DEBOUNCE to SRC_TRYWAIT transition
  ocfs2: stop quota recovery before disabling quotas
  ocfs2: implement handshaking with ocfs2 recovery thread
  ocfs2: switch osb->disable_recovery to enum
  module: ensure that kobject_put() is safe for module type kobjects
  xenbus: Use kref to track req lifetime
  usb: uhci-platform: Make the clock really optional
  iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo
  iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo
  iio: adis16201: Correct inclinometer channel resolution
  iio: adc: ad7606: fix serial register access
  staging: iio: adc: ad7816: Correct conditional logic for store mode
  Input: synaptics - enable InterTouch on Dell Precision M3800
  Input: synaptics - enable InterTouch on Dynabook Portege X30L-G
  Input: synaptics - enable InterTouch on Dynabook Portege X30-D
  net: dsa: b53: fix learning on VLAN unaware bridges
  netfilter: ipset: fix region locking in hash types
  sch_htb: make htb_deactivate() idempotent
  scsi: target: Fix WRITE_SAME No Data Buffer crash
  dm: fix copying after src array boundaries
  iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid
  arm64: dts: rockchip: fix iface clock-name on px30 iommus
  usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling
  usb: chipidea: ci_hdrc_imx: use dev_err_probe()
  usb: chipidea: imx: refine the error handling for hsic
  usb: chipidea: imx: change hsic power regulator as optional
  irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()
  irqchip/gic-v2m: Mark a few functions __init
  irqchip/gic-v2m: Add const to of_device_id
  sch_htb: make htb_qlen_notify() idempotent
  of: module: add buffer overflow check in of_modalias()
  PCI: imx6: Skip controller_id generation logic for i.MX7D
  net: fec: ERR007885 Workaround for conventional TX
  net: lan743x: Fix memleak issue when GSO enabled
  lan743x: fix endianness when accessing descriptors
  lan743x: remove redundant initialization of variable current_head_index
  nvme-tcp: fix premature queue removal and I/O failover
  net: dlink: Correct endianness handling of led_mode
  net_sched: qfq: Fix double list add in class with netem as child qdisc
  net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc
  net_sched: drr: Fix double list add in class with netem as child qdisc
  net/mlx5: E-Switch, Initialize MAC Address for Default GID
  tracing: Fix oob write in trace_seq_to_buffer()
  dm: always update the array size in realloc_argv on success
  dm-integrity: fix a warning on invalid table line
  wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage()
  amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload
  parisc: Fix double SIGFPE crash
  i2c: imx-lpi2c: Fix clock count when probe defers
  EDAC/altera: Set DDR and SDMMC interrupt mask before registration
  EDAC/altera: Test the correct error reg offset

 Conflicts:
	Makefile
	drivers/platform/Kconfig
	drivers/platform/Makefile
	include/linux/pid.h

Change-Id: Iab0fd96a23cfe218e945cbf71eef0e87dce204db
2025-09-01 13:17:46 +03:00
Nathan Chancellor
16ecad3f8b kbuild: Add KBUILD_CPPFLAGS to as-option invocation
commit 43fc0a99906e04792786edf8534d8d58d1e9de0c upstream.

After commit feb843a469fb ("kbuild: add $(CLANG_FLAGS) to
KBUILD_CPPFLAGS"), there is an error while building certain PowerPC
assembly files with clang:

  arch/powerpc/lib/copypage_power7.S: Assembler messages:
  arch/powerpc/lib/copypage_power7.S:34: Error: junk at end of line: `0b01000'
  arch/powerpc/lib/copypage_power7.S:35: Error: junk at end of line: `0b01010'
  arch/powerpc/lib/copypage_power7.S:37: Error: junk at end of line: `0b01000'
  arch/powerpc/lib/copypage_power7.S:38: Error: junk at end of line: `0b01010'
  arch/powerpc/lib/copypage_power7.S:40: Error: junk at end of line: `0b01010'
  clang: error: assembler command failed with exit code 1 (use -v to see invocation)

as-option only uses KBUILD_AFLAGS, so after removing CLANG_FLAGS from
KBUILD_AFLAGS, there is no more '--target=' or '--prefix=' flags. As a
result of those missing flags, the host target
will be tested during as-option calls and likely fail, meaning necessary
flags may not get added when building assembly files, resulting in
errors like seen above.

Add KBUILD_CPPFLAGS to as-option invocations to clear up the errors.
This should have been done in commit d5c8d6e0fa61 ("kbuild: Update
assembler calls to use proper flags and language target"), which
switched from using the assembler target to the assembler-with-cpp
target, so flags that affect preprocessing are passed along in all
relevant tests. as-option now mirrors cc-option.

Fixes: feb843a469fb ("kbuild: add $(CLANG_FLAGS) to KBUILD_CPPFLAGS")
Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
Closes: https://lore.kernel.org/CA+G9fYs=koW9WardsTtora+nMgLR3raHz-LSLr58tgX4T5Mxag@mail.gmail.com/
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Tested-by: Naresh Kamboju <naresh.kamboju@linaro.org>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-08-28 16:21:33 +02:00
Nathan Chancellor
dfd69889c9 kbuild: Add CLANG_FLAGS to as-instr
commit cff6e7f50bd315e5b39c4e46c704ac587ceb965f upstream.

A future change will move CLANG_FLAGS from KBUILD_{A,C}FLAGS to
KBUILD_CPPFLAGS so that '--target' is available while preprocessing.
When that occurs, the following errors appear multiple times when
building ARCH=powerpc powernv_defconfig:

  ld.lld: error: vmlinux.a(arch/powerpc/kernel/head_64.o):(.text+0x12d4): relocation R_PPC64_ADDR16_HI out of range: -4611686018409717520 is not in [-2147483648, 2147483647]; references '__start___soft_mask_table'
  ld.lld: error: vmlinux.a(arch/powerpc/kernel/head_64.o):(.text+0x12e8): relocation R_PPC64_ADDR16_HI out of range: -4611686018409717392 is not in [-2147483648, 2147483647]; references '__stop___soft_mask_table'

Diffing the .o.cmd files reveals that -DHAVE_AS_ATHIGH=1 is not present
anymore, because as-instr only uses KBUILD_AFLAGS, which will no longer
contain '--target'.

Mirror Kconfig's as-instr and add CLANG_FLAGS explicitly to the
invocation to ensure the target information is always present.

Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-08-28 16:21:33 +02:00
Nick Desaulniers
678a7813ca kbuild: Update assembler calls to use proper flags and language target
commit d5c8d6e0fa61401a729e9eb6a9c7077b2d3aebb0 upstream.

as-instr uses KBUILD_AFLAGS, but as-option uses KBUILD_CFLAGS. This can
cause as-option to fail unexpectedly when CONFIG_WERROR is set, because
clang will emit -Werror,-Wunused-command-line-argument for various -m
and -f flags in KBUILD_CFLAGS for assembler sources.

Callers of as-option and as-instr should be adding flags to
KBUILD_AFLAGS / aflags-y, not KBUILD_CFLAGS / cflags-y. Use
KBUILD_AFLAGS in all macros to clear up the initial problem.

Unfortunately, -Wunused-command-line-argument can still be triggered
with clang by the presence of warning flags or macro definitions because
'-x assembler' is used, instead of '-x assembler-with-cpp', which will
consume these flags. Switch to '-x assembler-with-cpp' in places where
'-x assembler' is used, as the compiler is always used as the driver for
out of line assembler sources in the kernel.

Finally, add -Werror to these macros so that they behave consistently
whether or not CONFIG_WERROR is set.

[nathan: Reworded and expanded on problems in commit message
         Use '-x assembler-with-cpp' in a couple more places]

Link: https://github.com/ClangBuiltLinux/linux/issues/1699
Suggested-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Anders Roxell <anders.roxell@linaro.org>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-08-28 16:21:33 +02:00
Yann E. MORIN
5b2775e515 kconfig: lxdialog: fix 'space' to (de)select options
[ Upstream commit 694174f94ebeeb5ec5cc0e9de9b40c82057e1d95 ]

In case a menu has comment without letters/numbers (eg. characters
matching the regexp '^[^[:alpha:][:digit:]]+$', for example - or *),
hitting space will cycle through those comments, rather than
selecting/deselecting the currently-highlighted option.

This is the behaviour of hitting any letter/digit: jump to the next
option which prompt starts with that letter. The only letters that
do not behave as such are 'y' 'm' and 'n'. Prompts that start with
one of those three letters are instead matched on the first letter
that is not 'y', 'm' or 'n'.

Fix that by treating 'space' as we treat y/m/n, ie. as an action key,
not as shortcut to jump to  prompt.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Cherniaev Andrei <dungeonlords789@naver.com>
[masahiro: took from Buildroot, adjusted the commit subject]
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-08-28 16:21:29 +02:00
Masahiro Yamada
0589cc9733 kconfig: gconf: fix potential memory leak in renderer_edited()
[ Upstream commit f72ed4c6a375e52a3f4b75615e4a89d29d8acea7 ]

If gtk_tree_model_get_iter() fails, gtk_tree_path_free() is not called.

Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Acked-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-08-28 16:21:29 +02:00
Masahiro Yamada
dca7764741 kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed()
[ Upstream commit cae9cdbcd9af044810bcceeb43a87accca47c71d ]

The on_treeview2_cursor_changed() handler is connected to both the left
and right tree views, but it hardcodes model2 (the GtkTreeModel of the
right tree view). This is incorrect. Get the associated model from the
view.

Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-08-28 16:21:29 +02:00
Shankari Anand
1bdd93389b kconfig: nconf: Ensure null termination where strncpy is used
[ Upstream commit f468992936894c9ce3b1659cf38c230d33b77a16 ]

strncpy() does not guarantee null-termination if the source string is
longer than the destination buffer.

Ensure the buffer is explicitly null-terminated to prevent potential
string overflows or undefined behavior.

Signed-off-by: Shankari Anand <shankari.ak0208@gmail.com>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Acked-by: Randy Dunlap <rdunlap@infradead.org>
Tested-by: Randy Dunlap <rdunlap@infradead.org>
Tested-by: Nicolas Schier <n.schier@avm.de>
Acked-by: Nicolas Schier <n.schier@avm.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-08-28 16:21:29 +02:00
Suchit Karunakaran
6d150a1775 kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c
[ Upstream commit 5ac726653a1029a2eccba93bbe59e01fc9725828 ]

strcpy() performs no bounds checking and can lead to buffer overflows if
the input string exceeds the destination buffer size. This patch replaces
it with strncpy(), and null terminates the input string.

Signed-off-by: Suchit Karunakaran <suchitkarunakaran@gmail.com>
Reviewed-by: Nicolas Schier <nicolas.schier@linux.dev>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-08-28 16:21:29 +02:00
Greg Kroah-Hartman
02f0aeffc1 This is the 5.4.296 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmh5JDkACgkQONu9yGCS
 aT5nfg//evp7vYDG9XXjBxzgNBJu1kP+N/yNxjM9ATgiEW4/gbhLASWZcMrdhiQl
 bvvEFad055VyjEnhK1OrCkAE/YivuJjnCvAhW4FA2V5sFTh2efYmGEOvgZBnHYsa
 txUYM/1NTlKZYPwM+YBX+9ImPDV84RX2Ryjx9ZKIZoCRsEAuH5rDbuNelgxHkmWe
 7NfscD2Fz5If2DCA7SLAwsL4KTdTfMKuOJThy0/LxAiV0ephZwgYtDB5Do56woqU
 rrV+k4dfKmGz02nOz5AJAP5fjZ0nzC27Ztwahxpey/X/Q2O3qAb9hpC1ELOC88Qv
 /yd5SqnsW4RWW2mrHumu5wngMgz2lXvjR+WOWox0BxHH2BlkkbEDJJRN74Ji7Fyu
 n0uGhRPfP9B0Qm9owTav3SJwD0fvJ1IEuOZ8H7XMONA6Zpv1Xhntqh2hGy0IwXaZ
 1lf9a0p0r9N6bbwLpOQXdDJXGh/nhmYVeTlbhkHdaZDtPpkpA28e3/bJJg15K9ap
 55t4+Xc4yU1qAP3M1GdmygRONCHKt9CpLadVBJ3EG9E6N3xFN1Y6oHAvczmoPTco
 8OITQWn1EBpg9ygLWWeof1COUZITPLsmqt6Yt3307UPqfPK+xjWiz39VNisFfuHB
 4W1lKHa7616bSrQtlc9uvBUO+jhppFtqz9EsrqOEr9epH6jiHJE=
 =LIf5
 -----END PGP SIGNATURE-----

Merge 5.4.296 into android11-5.4-lts

Changes in 5.4.296
	cifs: Fix cifs_query_path_info() for Windows NT servers
	mailbox: Not protect module_put with spin_lock_irqsave
	mfd: max14577: Fix wakeup source leaks on device unbind
	dmaengine: xilinx_dma: Set dma_device directions
	md/md-bitmap: fix dm-raid max_write_behind setting
	iio: pressure: zpa2326: Use aligned_s64 for the timestamp
	usb: potential integer overflow in usbg_make_tpg()
	tty: serial: uartlite: register uart driver in init
	usb: Add checks for snprintf() calls in usb_alloc_dev()
	usb: cdc-wdm: avoid setting WDM_READ for ZLP-s
	usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode
	ALSA: hda: Ignore unsol events for cards being shut down
	ceph: fix possible integer overflow in ceph_zero_objects()
	ovl: Check for NULL d_inode() in ovl_dentry_upper()
	VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF
	VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify
	kbuild: use -MMD instead of -MD to exclude system headers from dependency
	bpfilter: match bit size of bpfilter_umh to that of the kernel
	kbuild: add --target to correctly cross-compile UAPI headers with Clang
	kbuild: hdrcheck: fix cross build with clang
	of: property: define of_property_read_u{8,16,32,64}_array() unconditionally
	of: Add of_property_present() helper
	ASoC: meson: meson-card-utils: use of_property_present() for DT parsing
	fs/jfs: consolidate sanity checking in dbMount
	jfs: validate AG parameters in dbMount() to prevent crashes
	media: cxusb: use dev_dbg() rather than hand-rolled debug
	media: cxusb: no longer judge rbuf when the write fails
	media: omap3isp: use sgtable-based scatterlist wrappers
	media: vivid: Change the siize of the composing
	RDMA/core: Use refcount_t instead of atomic_t on refcount of iwcm_id_private
	RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction
	i2c: tiny-usb: disable zero-length read messages
	i2c: robotfuzz-osif: disable zero-length read messages
	ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3()
	attach_recursive_mnt(): do not lock the covering tree when sliding something under it
	wifi: mac80211: fix beacon interval calculation overflow
	vsock/uapi: fix linux/vm_sockets.h userspace compilation errors
	um: ubd: Add missing error check in start_io_thread()
	net: enetc: Correct endianness handling in _enetc_rd_reg64
	atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister().
	Bluetooth: L2CAP: Fix L2CAP MTU negotiation
	dm-raid: fix variable in journal device check
	HID: wacom: fix memory leak on kobject creation failure
	HID: wacom: fix memory leak on sysfs attribute creation failure
	HID: wacom: fix kobject reference count leak
	drm/tegra: Assign plane type before registration
	drm/bridge: cdns-dsi: Fix the clock variable for mode_valid()
	drm/bridge: cdns-dsi: Fix connecting to next bridge
	drm/bridge: cdns-dsi: Check return value when getting default PHY config
	s390: Add '-std=gnu11' to decompressor and purgatory CFLAGS
	arm64: Restrict pagetable teardown to avoid false warning
	btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
	vsock/vmci: Clear the vmci transport packet properly when initializing it
	mmc: sdhci: Add a helper function for dump register in dynamic debug mode
	Revert "mmc: sdhci: Disable SD card clock before changing parameters"
	usb: typec: altmodes/displayport: do not index invalid pin_assignments
	mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data
	platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment
	RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert
	nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.
	scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu()
	btrfs: fix missing error handling when searching for inode refs during log replay
	drm/exynos: fimd: Guard display clock control with runtime PM calls
	lib: test_objagg: Set error message in check_expect_hints_stats()
	amd-xgbe: align CL37 AN sequence as per databook
	enic: fix incorrect MTU comparison in enic_change_mtu()
	nui: Fix dma_mapping_error() check
	net/sched: Always pass notifications when child class becomes empty
	ALSA: sb: Force to disable DMAs once when DMA mode is changed
	ata: pata_cs5536: fix build on 32-bit UML
	powerpc: Fix struct termio related ioctl macros
	wifi: mac80211: drop invalid source address OCB frames
	wifi: ath6kl: remove WARN on bad firmware input
	ACPICA: Refuse to evaluate a method if arguments are missing
	regulator: gpio: Add input_supply support in gpio_regulator_config
	regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods
	mmc: mediatek: use data instead of mrq parameter from msdc_{un}prepare_data()
	mtk-sd: Prevent memory corruption from DMA map failure
	mtk-sd: reset host->mrq on prepare_data() error
	drm/v3d: Disable interrupts before resetting the GPU
	scsi: ufs: core: Fix spelling of a sysfs attribute name
	RDMA/core: Create and destroy counters in the ib_core
	RDMA/mlx5: Fix CC counters query for MPV
	btrfs: propagate last_unlink_trans earlier when doing a rmdir
	btrfs: use btrfs_record_snapshot_destroy() during rmdir
	ethernet: atl1: Add missing DMA mapping error checks and count errors
	dpaa2-eth: fix xdp_rxq_info leak
	spi: spi-fsl-dspi: Rename fifo_{read,write} and {tx,cmd}_fifo_write
	spi: spi-fsl-dspi: Fix interrupt-less DMA mode taking an XSPI code path
	spi: spi-fsl-dspi: Clear completion counter before initiating transfer
	drm/i915/selftests: Change mock_request() to return error pointers
	drm/i915/gt: Fix timeline left held on VMA alloc error
	net: rose: Fix fall-through warnings for Clang
	rose: fix dangling neighbour pointers in rose_rt_device_down()
	Logitech C-270 even more broken
	usb: typec: displayport: Fix potential deadlock
	ACPI: PAD: fix crash in exit_round_robin()
	media: uvcvideo: Return the number of processed controls
	media: uvcvideo: Send control events for partial succeeds
	media: uvcvideo: Rollback non processed entities on error
	staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher()
	drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling
	proc: Clear the pieces of proc_inode that proc_evict_inode cares about
	fix proc_sys_compare() handling of in-lookup dentries
	netlink: Fix wraparounds of sk->sk_rmem_alloc.
	tipc: Fix use-after-free in tipc_conn_close().
	atm: clip: Fix potential null-ptr-deref in to_atmarpd().
	atm: clip: Fix memory leak of struct clip_vcc.
	atm: clip: Fix infinite recursive call of clip_push().
	atm: clip: Fix NULL pointer dereference in vcc_sendmsg()
	net/sched: Abort __tc_modify_qdisc if parent class does not exist
	rxrpc: Fix oops due to non-existence of prealloc backlog struct
	x86/mce/amd: Fix threshold limit reset
	x86/mce: Don't remove sysfs if thresholding sysfs init fails
	x86/mce: Make sure CMCI banks are cleared during shutdown on Intel
	pinctrl: qcom: msm: mark certain pins as invalid for interrupts
	drm/sched: Increment job count before swapping tail spsc queue
	usb: gadget: u_serial: Fix race condition in TTY wakeup
	Revert "ACPI: battery: negate current when discharging"
	pwm: mediatek: Ensure to disable clocks in error path
	netlink: make sure we allow at least one dump skb
	netlink: Fix rmem check in netlink_broadcast_deliver().
	RDMA/mlx5: Fix vport loopback for MPV device
	flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes
	NFSv4/flexfiles: Fix handling of NFS level errors in I/O
	Input: xpad - add support for Amazon Game Controller
	Input: xpad - add VID for Turtle Beach controllers
	Input: xpad - support Acer NGR 200 Controller
	dma-buf: fix timeout handling in dma_resv_wait_timeout v2
	wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev()
	md/raid1: Fix stack memory use after return in raid1_reshape
	net: appletalk: Fix device refcount leak in atrtr_create()
	net: phy: microchip: limit 100M workaround to link-down events on LAN88xx
	can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level
	bnxt_en: Fix DCB ETS validation
	bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT
	atm: idt77252: Add missing `dma_map_error()`
	net: usb: qmi_wwan: add SIMCom 8230C composition
	vt: add missing notification when switching back to text mode
	HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY
	HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras
	Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID
	x86/mm: Disable hugetlb page table sharing on 32-bit
	net: ipv6: Discard next-hop MTU less than minimum link MTU
	Linux 5.4.296

Change-Id: Ida23d7bc57d7a55921aa3db936a175607d7859b8
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-07-18 10:57:54 +00:00
Masahiro Yamada
4451642747 kbuild: use -MMD instead of -MD to exclude system headers from dependency
[ Upstream commit 30a7729771731971839cc969d2a321e6ea7a144b ]

This omits system headers from the generated header dependency.

System headers are not updated unless you upgrade the compiler. Nor do
they contain CONFIG options, so fixdep does not need to parse them.

Having said that, the effect of this optimization will be quite small
because the kernel code generally does not include system headers
except <stdarg.h>. Host programs include a lot of system headers,
but there are not so many in the kernel tree.

At first, keeping system headers in .*.cmd files might be useful to
detect the compiler update, but there is no guarantee that <stdarg.h>
is included from every file. So, I implemented a more reliable way in
the previous commit.

Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Stable-dep-of: 02e9a22ceef0 ("kbuild: hdrcheck: fix cross build with clang")
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-07-17 18:24:51 +02:00
Greg Kroah-Hartman
cd881391f1 This is the 5.4.294 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmhAPSgACgkQONu9yGCS
 aT7FShAA16nZLD+wQFWNG0AB1oKDjWuH3cMzxcJnYKJC2LHAiFoCV8DX0SuLBEF/
 Lf79xdniv4NYWja7hGykC+0iMBlZKaRWvKOO5jmqA0+Tgy39NCgoDyD5r2azsSnn
 vKqfDsmhijaZ3Vkr1Kw3Co0i9aVHFS2G532eaIdXjr+XrVGyXGoS/a4pPuZz2S5M
 FGBzQfgsFnMVhnYG1CCz3PSE4iVKaC0jWOrJOxIsyjrZJ038362fKl75AQQho0ga
 fNEleCDJiItnBGyOsgEYTuYgpiJ9Q2mfmScJaK4epphCwZ3IwRNp9ZGEjOWQlr+6
 fmaDXqARB77cZ1HrrW89UyhiM/7D+yLZpmWGeSAKcpf0ytIUXzmkKwywFMd0znw7
 HGYpjOgSpQKG7Nbf7+cYYi5h2RenO1ecbmDxz+o8oR5bJ/w4B20Qbwy1VGizlSxb
 HU492UirF783ZYFUuNTAhmzvVF5KPp4fRQVrn2MpOLusQe5tSDmA1LQLnkIRKh+N
 9/w5CNugUvPUHwqJhJxEniTST+1mSJ3f3BDRWq16A4WVWN21IFtmFJOh3beC+cwB
 /maaA9ybh4D98XpPIo13tgjBYfDH5mAXWx80M7aoais+E0o08j4oMIyVhV/N/nJv
 dtjznweRdLFDyoST/PFku9JOKH+1WxzaM2vqX0D1NpB3BUfapww=
 =dZXI
 -----END PGP SIGNATURE-----

Merge 5.4.294 into android11-5.4-lts

Changes in 5.4.294
	EDAC/altera: Test the correct error reg offset
	EDAC/altera: Set DDR and SDMMC interrupt mask before registration
	i2c: imx-lpi2c: Fix clock count when probe defers
	parisc: Fix double SIGFPE crash
	amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload
	wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage()
	dm-integrity: fix a warning on invalid table line
	dm: always update the array size in realloc_argv on success
	tracing: Fix oob write in trace_seq_to_buffer()
	net/mlx5: E-Switch, Initialize MAC Address for Default GID
	net_sched: drr: Fix double list add in class with netem as child qdisc
	net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc
	net_sched: qfq: Fix double list add in class with netem as child qdisc
	net: dlink: Correct endianness handling of led_mode
	nvme-tcp: fix premature queue removal and I/O failover
	lan743x: remove redundant initialization of variable current_head_index
	lan743x: fix endianness when accessing descriptors
	net: lan743x: Fix memleak issue when GSO enabled
	net: fec: ERR007885 Workaround for conventional TX
	PCI: imx6: Skip controller_id generation logic for i.MX7D
	of: module: add buffer overflow check in of_modalias()
	sch_htb: make htb_qlen_notify() idempotent
	irqchip/gic-v2m: Add const to of_device_id
	irqchip/gic-v2m: Mark a few functions __init
	irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()
	usb: chipidea: imx: change hsic power regulator as optional
	usb: chipidea: imx: refine the error handling for hsic
	usb: chipidea: ci_hdrc_imx: use dev_err_probe()
	usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling
	arm64: dts: rockchip: fix iface clock-name on px30 iommus
	iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid
	dm: fix copying after src array boundaries
	scsi: target: Fix WRITE_SAME No Data Buffer crash
	sch_htb: make htb_deactivate() idempotent
	netfilter: ipset: fix region locking in hash types
	net: dsa: b53: fix learning on VLAN unaware bridges
	Input: synaptics - enable InterTouch on Dynabook Portege X30-D
	Input: synaptics - enable InterTouch on Dynabook Portege X30L-G
	Input: synaptics - enable InterTouch on Dell Precision M3800
	staging: iio: adc: ad7816: Correct conditional logic for store mode
	iio: adc: ad7606: fix serial register access
	iio: adis16201: Correct inclinometer channel resolution
	iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo
	iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo
	usb: uhci-platform: Make the clock really optional
	xenbus: Use kref to track req lifetime
	module: ensure that kobject_put() is safe for module type kobjects
	ocfs2: switch osb->disable_recovery to enum
	ocfs2: implement handshaking with ocfs2 recovery thread
	ocfs2: stop quota recovery before disabling quotas
	usb: typec: tcpm: delay SNK_TRY_WAIT_DEBOUNCE to SRC_TRYWAIT transition
	usb: typec: ucsi: displayport: Fix NULL pointer access
	USB: usbtmc: use interruptible sleep in usbtmc_read
	usb: usbtmc: Fix erroneous get_stb ioctl error returns
	usb: usbtmc: Fix erroneous wait_srq ioctl return
	usb: usbtmc: Fix erroneous generic_read ioctl return
	types: Complement the aligned types with signed 64-bit one
	iio: adc: dln2: Use aligned_s64 for timestamp
	MIPS: Fix MAX_REG_OFFSET
	nvme: unblock ctrl state transition for firmware update
	do_umount(): add missing barrier before refcount checks in sync case
	platform/x86: asus-wmi: Fix wlan_ctrl_by_user detection
	staging: axis-fifo: replace spinlock with mutex
	staging: axis-fifo: Remove hardware resets for user errors
	staging: axis-fifo: avoid parsing ignored device tree properties
	staging: axis-fifo: Correct handling of tx_fifo_depth for size validation
	iio: adc: ad7768-1: Fix insufficient alignment of timestamp.
	iio: chemical: sps30: use aligned_s64 for timestamp
	RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug
	nfs: handle failure of nfs_get_lock_context in unlock path
	spi: loopback-test: Do not split 1024-byte hexdumps
	net: dsa: sja1105: discard incoming frames in BR_STATE_LISTENING
	ALSA: sh: SND_AICA should depend on SH_DMA_API
	qlcnic: fix memory leak in qlcnic_sriov_channel_cfg_cmd()
	NFSv4/pnfs: pnfs_set_layout_stateid() should update the layout cred
	NFSv4/pnfs: Reset the layout state after a layoutreturn
	dmaengine: Revert "dmaengine: dmatest: Fix dmatest waiting less when interrupted"
	ACPI: PPTT: Fix processor subtable walk
	ALSA: es1968: Add error handling for snd_pcm_hw_constraint_pow2()
	phy: Fix error handling in tegra_xusb_port_init
	phy: renesas: rcar-gen3-usb2: Set timing registers only once
	clocksource/i8253: Use raw_spinlock_irqsave() in clockevent_i8253_disable()
	Input: synaptics - enable SMBus for HP Elitebook 850 G1
	Input: synaptics - enable InterTouch on TUXEDO InfinityBook Pro 14 v5
	openvswitch: Fix unsafe attribute parsing in output_userspace()
	scsi: target: iscsi: Fix timeout on deleted connection
	dma-mapping: avoid potential unused data compilation warning
	cgroup: Fix compilation issue due to cgroup_mutex not being exported
	kconfig: merge_config: use an empty file as initfile
	mailbox: use error ret code of of_parse_phandle_with_args()
	fbdev: fsl-diu-fb: add missing device_remove_file()
	fbdev: core: tileblit: Implement missing margin clearing for tileblit
	NFSv4: Treat ENETUNREACH errors as fatal for state recovery
	SUNRPC: rpc_clnt_set_transport() must not change the autobind setting
	dql: Fix dql->limit value when reset.
	tools/build: Don't pass test log files to linker
	pNFS/flexfiles: Report ENETDOWN as a connection error
	libnvdimm/labels: Fix divide error in nd_label_data_init()
	mmc: host: Wait for Vdd to settle on card power off
	i2c: pxa: fix call balance of i2c->clk handling routines
	btrfs: avoid linker error in btrfs_find_create_tree_block()
	btrfs: send: return -ENAMETOOLONG when attempting a path that is too long
	um: Store full CSGSFS and SS register from mcontext
	um: Update min_low_pfn to match changes in uml_reserved
	ext4: reorder capability check last
	scsi: st: Tighten the page format heuristics with MODE SELECT
	scsi: st: ERASE does not change tape location
	kbuild: fix argument parsing in scripts/config
	dm: restrict dm device size to 2^63-512 bytes
	xen: Add support for XenServer 6.1 platform device
	posix-timers: Add cond_resched() to posix_timer_add() search loop
	netfilter: conntrack: Bound nf_conntrack sysctl writes
	mmc: sdhci: Disable SD card clock before changing parameters
	powerpc/prom_init: Fixup missing #size-cells on PowerBook6,7
	rtc: ds1307: stop disabling alarms on probe
	ieee802154: ca8210: Use proper setters and getters for bitwise types
	ARM: tegra: Switch DSI-B clock parent to PLLD on Tegra114
	media: c8sectpfe: Call of_node_put(i2c_bus) only once in c8sectpfe_probe()
	dm cache: prevent BUG_ON by blocking retries on failed device resumes
	orangefs: Do not truncate file size
	media: cx231xx: set device_caps for 417
	pinctrl: bcm281xx: Use "unsigned int" instead of bare "unsigned"
	net: pktgen: fix mpls maximum labels list parsing
	x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2
	hwmon: (gpio-fan) Add missing mutex locks
	drm/mediatek: mtk_dpi: Add checks for reg_h_fre_con existence
	fpga: altera-cvp: Increase credit timeout
	net/mlx5: Avoid report two health errors on same syndrome
	drm/amdkfd: KFD release_work possible circular locking
	net: xgene-v2: remove incorrect ACPI_PTR annotation
	bonding: report duplicate MAC address in all situations
	x86/nmi: Add an emergency handler in nmi_desc & use it in nmi_shootdown_cpus()
	cpuidle: menu: Avoid discarding useful information
	MIPS: Use arch specific syscall name match function
	MIPS: pm-cps: Use per-CPU variables as per-CPU, not per-core
	scsi: mpt3sas: Send a diag reset if target reset fails
	wifi: rtw88: Fix rtw_init_ht_cap() for RTL8814AU
	net: pktgen: fix access outside of user given buffer in pktgen_thread_write()
	EDAC/ie31200: work around false positive build warning
	PCI: Fix old_size lower bound in calculate_iosize() too
	ACPI: HED: Always initialize before evged
	net/mlx5: Modify LSB bitmask in temperature event to include only the first bit
	net/mlx5: Apply rate-limiting to high temperature warning
	ASoC: ops: Enforce platform maximum on initial value
	pinctrl: devicetree: do not goto err when probing hogs in pinctrl_dt_to_map
	smack: recognize ipv4 CIPSO w/o categories
	net/mlx4_core: Avoid impossible mlx4_db_alloc() order value
	phy: core: don't require set_mode() callback for phy_get_mode() to work
	net/mlx5: Extend Ethtool loopback selftest to support non-linear SKB
	net/mlx5e: set the tx_queue_len for pfifo_fast
	net/mlx5e: reduce rep rxq depth to 256 for ECPF
	ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure().
	hwmon: (xgene-hwmon) use appropriate type for the latency value
	vxlan: Annotate FDB data races
	rcu: handle quiescent states for PREEMPT_RCU=n, PREEMPT_COUNT=y
	rcu: fix header guard for rcu_all_qs()
	scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine
	scsi: st: Restore some drive settings after reset
	HID: usbkbd: Fix the bit shift number for LED_KANA
	bpftool: Fix readlink usage in get_fd_type
	wifi: rtw88: Don't use static local variable in rtw8822b_set_tx_power_index_by_rate
	regulator: ad5398: Add device tree support
	drm/atomic: clarify the rules around drm_atomic_state->allow_modeset
	drm: Add valid clones check
	pinctrl: meson: define the pull up/down resistor value as 60 kOhm
	ASoC: Intel: bytcr_rt5640: Add DMI quirk for Acer Aspire SW3-013
	nvmet-tcp: don't restore null sk_state_change
	btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref
	xenbus: Allow PVH dom0 a non-local xenstore
	__legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock
	xfrm: Sanitize marks before insert
	bridge: netfilter: Fix forwarding of fragmented packets
	net: dwmac-sun8i: Use parsed internal PHY address instead of 1
	sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()
	crypto: algif_hash - fix double free in hash_accept
	can: bcm: add locking for bcm_op runtime updates
	can: bcm: add missing rcu read protection for procfs content
	ALSA: pcm: Fix race of buffer access at PCM OSS layer
	llc: fix data loss when reading from a socket in llc_ui_recvmsg()
	drm/edid: fixed the bug that hdr metadata was not reset
	memcg: always call cond_resched() after fn()
	mm/page_alloc.c: avoid infinite retries caused by cpuset race
	spi: spi-fsl-dspi: restrict register range for regmap access
	kbuild: Disable -Wdefault-const-init-unsafe
	netfilter: nf_tables: pass nft_chain to destroy function, not nft_ctx
	netfilter: nf_tables: wait for rcu grace period on net_device removal
	netfilter: nf_tables: do not defer rule destruction via call_rcu
	drm/i915/gvt: fix unterminated-string-initialization warning
	smb: client: Fix use-after-free in cifs_fill_dirent
	smb: client: Reset all search buffer pointers when releasing buffer
	net_sched: hfsc: Address reentrant enqueue adding class to eltree twice
	coredump: fix error handling for replace_fd()
	pidfd: check pid has attached task in fdinfo
	pid: add pidfd_prepare()
	fork: use pidfd_prepare()
	coredump: hand a pidfd to the usermode coredump helper
	HID: quirks: Add ADATA XPG alpha wireless mouse support
	nfs: don't share pNFS DS connections between net namespaces
	platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS
	um: let 'make clean' properly clean underlying SUBARCH as well
	spi: spi-sun4i: fix early activation
	platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys
	platform/x86: thinkpad_acpi: Ignore battery threshold change event notification
	xen/swiotlb: relax alignment requirements
	Linux 5.4.294

Change-Id: Iaf692049f875da760e327bc752534cc38c2795eb
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2025-06-05 07:11:21 +00:00
Seyediman Seyedarab
ac7d620cad kbuild: fix argument parsing in scripts/config
[ Upstream commit f757f6011c92b5a01db742c39149bed9e526478f ]

The script previously assumed --file was always the first argument,
which caused issues when it appeared later. This patch updates the
parsing logic to scan all arguments to find --file, sets the config
file correctly, and resets the argument list with the remaining
commands.

It also fixes --refresh to respect --file by passing KCONFIG_CONFIG=$FN
to make oldconfig.

Signed-off-by: Seyediman Seyedarab <imandevel@gmail.com>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-06-04 14:32:31 +02:00
Daniel Gomez
94a78c618e kconfig: merge_config: use an empty file as initfile
[ Upstream commit a26fe287eed112b4e21e854f173c8918a6a8596d ]

The scripts/kconfig/merge_config.sh script requires an existing
$INITFILE (or the $1 argument) as a base file for merging Kconfig
fragments. However, an empty $INITFILE can serve as an initial starting
point, later referenced by the KCONFIG_ALLCONFIG Makefile variable
if -m is not used. This variable can point to any configuration file
containing preset config symbols (the merged output) as stated in
Documentation/kbuild/kconfig.rst. When -m is used $INITFILE will
contain just the merge output requiring the user to run make (i.e.
KCONFIG_ALLCONFIG=<$INITFILE> make <allnoconfig/alldefconfig> or make
olddefconfig).

Instead of failing when `$INITFILE` is missing, create an empty file and
use it as the starting point for merges.

Signed-off-by: Daniel Gomez <da.gomez@samsung.com>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-06-04 14:32:30 +02:00
Michael Bestas
66b9cabfb9
Merge remote-tracking branch 'sm8350/lineage-20' into lineage-22.2
* sm8350/lineage-20:
  ANDROID: Fix compilation error with huge_pmd_share()
  BACKPORT: mm/gup: Remove enfornced COW mechanism
  UPSTREAM: mm/userfaultfd: selftests: fix memory corruption with thp enabled
  UPSTREAM: mm/shmem: use page_mapping() to detect page cache for uffd continue
  UPSTREAM: mm/userfaultfd: fix memory corruption due to writeprotect
  UPSTREAM: mm: hugetlb: add missing cache flushing in hugetlb_unshare_all_pmds()
  BACKPORT: userfaultfd: wp: declare _UFFDIO_WRITEPROTECT conditionally
  BACKPORT: mm, mempolicy: fix up gup usage in lookup_node
  UPSTREAM: mm/mempolicy: Allow lookup_node() to handle fatal signal
  UPSTREAM: mm/gup: Let __get_user_pages_locked() return -EINTR for fatal signal
  UPSTREAM: mm/gup: fix fixup_user_fault() on multiple retries
  UPSTREAM: mm/gup: Mark lock taken only after a successful retake
  UPSTREAM: mm/userfaultfd: honor FAULT_FLAG_KILLABLE in fault path
  UPSTREAM: mm/gup: allow to react to fatal signals
  UPSTREAM: mm/gup: allow VM_FAULT_RETRY for multiple times
  UPSTREAM: mm: allow VM_FAULT_RETRY for multiple times
  UPSTREAM: mm: introduce FAULT_FLAG_INTERRUPTIBLE
  UPSTREAM: mm: introduce FAULT_FLAG_DEFAULT
  UPSTREAM: userfaultfd: don't retake mmap_sem to emulate NOPAGE
  UPSTREAM: mm: return faster for non-fatal signals in user mode faults
  ...

Change-Id: I9d715b94bd5e1daaf1c3857facb03166aeba69e5
2025-05-18 11:12:21 +03:00