mirror of
https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git
synced 2026-10-15 17:24:14 -04:00
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Blagovest Kolenichev
|
7546983cd7 |
Merge android11-5.4.58+ (33cc3e7) into msm-5.4
* refs/heads/tmp-33cc3e7:
ANDROID: db845c: set BUILD_INITRAMFS=1
ANDROID: GKI: Build CEC_{CORE,NOTIFIER,PIN} in
ANDROID: GKI: Enable CEC support
ANDROID: ABI: Update ABI snapshot after additions to struct io_pgtable_cfg
ANDROID: iommu/io-pgtable: Allow IOMMU drivers to allocate/free page-table memory
ANDROID: update ABI
UPSTREAM: update to latest version of scripts/checkpatch.pl
FROMLIST: ufs: change the way to complete fDeviceInit
ANDROID: GKI: add built-in BCM Bluetooth driver
Revert "Revert "genetlink: remove genl_bind""
ANDROID: GKI: enable CONFIG_LEDS_TRIGGER_TIMER
ANDROID: GKI: add abi_gki_aarch64_oplus
ANDROID: GKI: fix up abi .xml file due to previous changes.
ANDROID: GKI: add some padding to some driver core structures
ANDROID: vendor_hooks: add waiting information for blocked tasks
ANDROID: GKI: Update abi_gki_aarch64_exynos
ANDROID: include/linux: add low power mode and fps to notifier
BACKPORT: scsi: ufs: Fix and simplify setup_xfer_req variant operation
ANDROID: GKI: enable USB UVC drivers
ANDROID: GKI: enabled CONFIG_USB_CONFIGFS_NCM=y
ANDROID: GKI: enable LEDS_CLASS_FLASH
Conflicts:
drivers/iommu/io-pgtable-arm.c
drivers/iommu/io-pgtable.c
include/linux/io-pgtable.h
scripts/checkpatch.pl
Change-Id: I6cbac7d913653388280a4c58f4f98e6f8b6b29f7
Signed-off-by: Ivaylo Georgiev <irgeorgiev@codeaurora.org>
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
|
||
Sangmoon Kim
|
b519ac4237 |
ANDROID: vendor_hooks: add waiting information for blocked tasks
- Add the hook to get mutex/rwsem information that the tasks are waiting for. - Add the hook to print messages for sched_show_task. - ANDROID_VENDOR_DATA_ARRAY added to task_struct Bug: 162776704 Signed-off-by: Sangmoon Kim <sangmoon.kim@samsung.com> Change-Id: Ib436fbd8d0ad509c3b5a73ea8f5170e0761a13fd |
||
Greg Kroah-Hartman
|
3a9b53bc89 |
This is the 5.4.58 stable release
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl8ynngACgkQONu9yGCS
aT5cPw/9GiiNZCLyjB3jVyalmN9uDYKQ+eS8H97GG7IBVYyg9whOKIrOCZHcLINH
DV5s/qnhRWJPzmQ47410ySuPb6QMvkhWTK7i5Xf+K7BOvoz/snfFGcmdu1CA4KxR
CuuH449Y4l3sH+5fPv7+EToovBqA2cfeiz/i5d5Di/N4yODWBCbHHAsZIt0oGvuK
sI1aI1K//R7vKZQvQo85tvENbWJWQwDN7eYVQj3aSbvnq8JqVpwTKTBpKfshzgzB
RmMSOVpQoQYNivW9oleG0NTQeHqj7alG8anFs3Drgu1hs5dzQhqAFlKddhtRS69j
mtrSJuf0GgJEYA6n+PfacoM4l7kHUZcQH9+bglbCXTA3nH24DLT7h0Lybm+ETPXc
ZAYo7cHqrS1BWv8VHZggSbqPr6YNKvgeflgS394wAgNEFcaJmaPfS6+elmc0qf2t
VPSas7QQruRS1Bqwb6CF2tHsl4N+VdvxX1a2JjHHcF5N3z5aqDm1qaVVQHxAg2rE
gXepFNGkEIBhWRxPz+5quxN1XBcUDiQYrzdoaKHxwY+OcdCf635P5Ob+1WK3w1oa
qhl/2scs44D67wZSgXHo5N4vMi9HhPOSV77jklgFcg75IzM9YWwYnJADQRHxo7nT
25XEgUlMfxm0ngw+CZWR0ssaP6rB9V1rRLDqb1W5HbqA7lp2YE8=
=Fe6H
-----END PGP SIGNATURE-----
Merge 5.4.58 into android11-5.4
Changes in 5.4.58
USB: serial: qcserial: add EM7305 QDL product ID
perf/core: Fix endless multiplex timer
USB: iowarrior: fix up report size handling for some devices
usb: xhci: define IDs for various ASMedia host controllers
usb: xhci: Fix ASMedia ASM1142 DMA addressing
io_uring: prevent re-read of sqe->opcode
io_uring: Fix use-after-free in io_sq_wq_submit_work()
Revert "ALSA: hda: call runtime_allow() for all hda controllers"
ALSA: hda/realtek: Add alc269/alc662 pin-tables for Loongson-3 laptops
ALSA: hda/ca0132 - Add new quirk ID for Recon3D.
ALSA: hda/ca0132 - Fix ZxR Headphone gain control get value.
ALSA: hda/ca0132 - Fix AE-5 microphone selection commands.
ALSA: seq: oss: Serialize ioctls
staging: android: ashmem: Fix lockdep warning for write operation
staging: rtl8712: handle firmware load failure
Staging: rtl8188eu: rtw_mlme: Fix uninitialized variable authmode
Bluetooth: Fix slab-out-of-bounds read in hci_extended_inquiry_result_evt()
Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_evt()
Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_with_rssi_evt()
omapfb: dss: Fix max fclk divider for omap36xx
binder: Prevent context manager from incrementing ref 0
Smack: fix use-after-free in smk_write_relabel_self()
scripts: add dummy report mode to add_namespace.cocci
vgacon: Fix for missing check in scrollback handling
mtd: properly check all write ioctls for permissions
leds: wm831x-status: fix use-after-free on unbind
leds: lm36274: fix use-after-free on unbind
leds: da903x: fix use-after-free on unbind
leds: lm3533: fix use-after-free on unbind
leds: 88pm860x: fix use-after-free on unbind
net/9p: validate fds in p9_fd_open
drm/nouveau/fbcon: fix module unload when fbcon init has failed for some reason
drm/nouveau/fbcon: zero-initialise the mode_cmd2 structure
nvme-pci: prevent SK hynix PC400 from using Write Zeroes command
drm/drm_fb_helper: fix fbdev with sparc64
i2c: slave: improve sanity check when registering
i2c: slave: add sanity check when unregistering
usb: hso: check for return value in hso_serial_common_create()
net: ethernet: mtk_eth_soc: Always call mtk_gmac0_rgmii_adjust() for mt7623
ALSA: hda: fix NULL pointer dereference during suspend
firmware: Fix a reference count leak.
cfg80211: check vendor command doit pointer before use
igb: reinit_locked() should be called with rtnl_lock
atm: fix atm_dev refcnt leaks in atmtcp_remove_persistent
tools lib traceevent: Fix memory leak in process_dynamic_array_len
Drivers: hv: vmbus: Ignore CHANNELMSG_TL_CONNECT_RESULT(23)
xattr: break delegations in {set,remove}xattr
Revert "powerpc/kasan: Fix shadow pages allocation failure"
PCI: tegra: Revert tegra124 raw_violation_fixup
ipv4: Silence suspicious RCU usage warning
ipv6: fix memory leaks on IPV6_ADDRFORM path
ipv6: Fix nexthop refcnt leak when creating ipv6 route info
net: ethernet: mtk_eth_soc: fix MTU warnings
rxrpc: Fix race between recvmsg and sendmsg on immediate call failure
vxlan: Ensure FDB dump is performed under RCU
net: lan78xx: replace bogus endpoint lookup
appletalk: Fix atalk_proc_init() return path
dpaa2-eth: Fix passing zero to 'PTR_ERR' warning
hv_netvsc: do not use VF device if link is down
net: gre: recompute gre csum for sctp over gre tunnels
net: thunderx: use spin_lock_bh in nicvf_set_rx_mode_task()
openvswitch: Prevent kernel-infoleak in ovs_ct_put_key()
Revert "vxlan: fix tos value before xmit"
selftests/net: relax cpu affinity requirement in msg_zerocopy test
tcp: apply a floor of 1 for RTT samples from TCP timestamps
ima: move APPRAISE_BOOTPARAM dependency on ARCH_POLICY to runtime
nfsd: Fix NFSv4 READ on RDMA when using readv
Linux 5.4.58
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I0e89e2c0faf90bdf1f6ac37f9a2c2395cacab054
|
||
Jann Horn
|
c5665cafbe |
binder: Prevent context manager from incrementing ref 0
commit 4b836a1426cb0f1ef2a6e211d7e553221594f8fc upstream.
Binder is designed such that a binder_proc never has references to
itself. If this rule is violated, memory corruption can occur when a
process sends a transaction to itself; see e.g.
<https://syzkaller.appspot.com/bug?extid=09e05aba06723a94d43d>.
There is a remaining edgecase through which such a transaction-to-self
can still occur from the context of a task with BINDER_SET_CONTEXT_MGR
access:
- task A opens /dev/binder twice, creating binder_proc instances P1
and P2
- P1 becomes context manager
- P2 calls ACQUIRE on the magic handle 0, allocating index 0 in its
handle table
- P1 dies (by closing the /dev/binder fd and waiting a bit)
- P2 becomes context manager
- P2 calls ACQUIRE on the magic handle 0, allocating index 1 in its
handle table
[this triggers a warning: "binder: 1974:1974 tried to acquire
reference to desc 0, got 1 instead"]
- task B opens /dev/binder once, creating binder_proc instance P3
- P3 calls P2 (via magic handle 0) with (void*)1 as argument (two-way
transaction)
- P2 receives the handle and uses it to call P3 (two-way transaction)
- P3 calls P2 (via magic handle 0) (two-way transaction)
- P2 calls P2 (via handle 1) (two-way transaction)
And then, if P2 does *NOT* accept the incoming transaction work, but
instead closes the binder fd, we get a crash.
Solve it by preventing the context manager from using ACQUIRE on ref 0.
There shouldn't be any legitimate reason for the context manager to do
that.
Additionally, print a warning if someone manages to find another way to
trigger a transaction-to-self bug in the future.
Cc: stable@vger.kernel.org
Fixes:
|
||
|
Blagovest Kolenichev
|
40bffd325d |
Merge android11-5.4.54 (261a54f) into msm-5.4
* refs/heads/tmp-261a54f:
Revert "soc: qcom: rpmh: Update dirty flag only when data changes"
Revert "soc: qcom: rpmh: Invalidate SLEEP and WAKE TCSes before flushing new data"
Revert "soc: qcom: rpmh-rsc: Clear active mode configuration for wake TCS"
Revert "soc: qcom: rpmh-rsc: Allow using free WAKE TCS for active request"
Revert "soc: qcom: rpmh: Dirt can only make you dirtier, not cleaner"
Linux 5.4.54
ath9k: Fix regression with Atheros 9271
ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb
dm integrity: fix integrity recalculation that is improperly skipped
ASoC: topology: fix tlvs in error handling for widget_dmixer
ASoC: topology: fix kernel oops on route addition error
ASoC: qcom: Drop HAS_DMA dependency to fix link failure
ASoC: rt5670: Add new gpio1_is_ext_spk_en quirk and enable it on the Lenovo Miix 2 10
x86, vmlinux.lds: Page-align end of ..page_aligned sections
parisc: Add atomic64_set_release() define to avoid CPU soft lockups
drm/amd/powerplay: fix a crash when overclocking Vega M
drm/amdgpu: Fix NULL dereference in dpm sysfs handlers
mmc: sdhci-of-aspeed: Fix clock divider calculation
io-mapping: indicate mapping failure
khugepaged: fix null-pointer dereference due to race
mm: memcg/slab: fix memory leak at non-root kmem_cache destroy
mm/memcg: fix refcount error while moving and swapping
mm/mmap.c: close race between munmap() and expand_upwards()/downwards()
Makefile: Fix GCC_TOOLCHAIN_DIR prefix for Clang cross compilation
vt: Reject zero-sized screen buffer size.
fbdev: Detect integer underflow at "struct fbcon_ops"->clear_margins.
/dev/mem: Add missing memory barriers for devmem_inode
serial: 8250_mtk: Fix high-speed baud rates clamping
serial: 8250: fix null-ptr-deref in serial8250_start_tx()
serial: tegra: fix CREAD handling for PIO
staging: comedi: addi_apci_1564: check INSN_CONFIG_DIGITAL_TRIG shift
staging: comedi: addi_apci_1500: check INSN_CONFIG_DIGITAL_TRIG shift
staging: comedi: ni_6527: fix INSN_CONFIG_DIGITAL_TRIG support
staging: comedi: addi_apci_1032: check INSN_CONFIG_DIGITAL_TRIG shift
staging: wlan-ng: properly check endpoint types
tty: xilinx_uartps: Really fix id assignment
iwlwifi: mvm: don't call iwl_mvm_free_inactive_queue() under RCU
Revert "cifs: Fix the target file was deleted when rename failed."
usb: xhci: Fix ASM2142/ASM3142 DMA addressing
usb: xhci-mtk: fix the failure of bandwidth allocation
binder: Don't use mmput() from shrinker function.
RISC-V: Upgrade smp_mb__after_spinlock() to iorw,iorw
drivers/perf: Prevent forced unbinding of PMU drivers
asm-generic/mmiowb: Allow mmiowb_set_pending() when preemptible()
x86: math-emu: Fix up 'cmp' insn for clang ias
arm64: Use test_tsk_thread_flag() for checking TIF_SINGLESTEP
drivers/perf: Fix kernel panic when rmmod PMU modules during perf sampling
ALSA: hda/realtek - fixup for yet another Intel reference board
hwmon: (scmi) Fix potential buffer overflow in scmi_hwmon_probe()
platform/x86: asus-wmi: allow BAT1 battery name
platform/x86: ISST: Add new PCI device ids
hwmon: (nct6775) Accept PECI Calibration as temperature source for NCT6798D
drm/amdgpu: fix preemption unit test
drm/amdgpu/gfx10: fix race condition for kiq
hwmon: (adm1275) Make sure we are reading enough data for different chips
usb: cdns3: trace: fix some endian issues
usb: cdns3: ep0: fix some endian issues
usb: gadget: udc: gr_udc: fix memleak on error handling path in gr_ep_init()
usb: dwc3: pci: add support for the Intel Jasper Lake
usb: dwc3: pci: add support for the Intel Tiger Lake PCH -H variant
Input: elan_i2c - only increment wakeup count on touch
Input: synaptics - enable InterTouch for ThinkPad X1E 1st gen
dmaengine: ioat setting ioat timeout as module parameter
dmaengine: fsl-edma: fix wrong tcd endianness for big-endian cpu
hwmon: (aspeed-pwm-tacho) Avoid possible buffer overflow
regmap: dev_get_regmap_match(): fix string comparison
spi: mediatek: use correct SPI_CFG2_REG MACRO
ARM: dts: n900: remove mmc1 card detect gpio
Input: add `SW_MACHINE_COVER`
dmaengine: tegra210-adma: Fix runtime PM imbalance on error
HID: apple: Disable Fn-key key-re-mapping on clone keyboards
HID: steam: fixes race in handling device list.
HID: alps: support devices with report id 2
HID: i2c-hid: add Mediacom FlexBook edge13 to descriptor override
scripts/gdb: fix lx-symbols 'gdb.error' while loading modules
scripts/decode_stacktrace: strip basepath from all paths
serial: exar: Fix GPIO configuration for Sealevel cards based on XR17V35X
geneve: fix an uninitialized value in geneve_changelink()
bonding: check return value of register_netdevice() in bond_newlink()
i2c: i2c-qcom-geni: Fix DMA transfer race
i2c: rcar: always clear ICSAR to avoid side effects
enetc: Remove the mdio bus on PF probe bailout
nfsd4: fix NULL dereference in nfsd/clients display code
Revert "PCI/PM: Assume ports without DLL Link Active train links in 100 ms"
net: ethernet: ave: Fix error returns in ave_init
ipvs: fix the connection sync failed in some cases
qed: suppress false-positives interrupt error messages on HW init
qed: suppress "don't support RoCE & iWARP" flooding on HW init
netdevsim: fix unbalaced locking in nsim_create()
net: dsa: microchip: call phy_remove_link_mode during probe
net: hns3: fix error handling for desc filling
net: ag71xx: add missed clk_disable_unprepare in error path of probe
ionic: fix up filter locks and debug msgs
ionic: use offset for ethtool regs data
mlxsw: destroy workqueue when trap_register in mlxsw_emad_init
bonding: check error value of register_netdevice() immediately
net: smc91x: Fix possible memory leak in smc_drv_probe()
drm: sun4i: hdmi: Fix inverted HPD result
ieee802154: fix one possible memleak in adf7242_probe
net: dp83640: fix SIOCSHWTSTAMP to update the struct with actual configuration
ASoC: Intel: bytcht_es8316: Add missed put_device()
RDMA/mlx5: Use xa_lock_irq when access to SRQ table
ax88172a: fix ax88172a_unbind() failures
vsock/virtio: annotate 'the_virtio_vsock' RCU pointer
hippi: Fix a size used in a 'pci_free_consistent()' in an error handling path
fpga: dfl: fix bug in port reset handshake
fpga: dfl: pci: reduce the scope of variable 'ret'
bnxt_en: Fix completion ring sizing with TPA enabled.
bnxt_en: Fix race when modifying pause settings.
btrfs: fix page leaks after failure to lock page for delalloc
btrfs: fix mount failure caused by race with umount
btrfs: fix double free on ulist after backref resolution failure
ASoC: rt5670: Correct RT5670_LDO_SEL_MASK
ALSA: info: Drop WARN_ON() from buffer NULL sanity check
ALSA: hda/realtek: Fixed ALC298 sound bug by adding quirk for Samsung Notebook Pen S
uprobes: Change handle_swbp() to send SIGTRAP with si_code=SI_KERNEL, to fix GDB regression
btrfs: reloc: clear DEAD_RELOC_TREE bit for orphan roots to prevent runaway balance
btrfs: reloc: fix reloc root leak and NULL pointer dereference
SUNRPC reverting d03727b248d0 ("NFSv4 fix CLOSE not waiting for direct IO compeletion")
drm/amd/display: Check DMCU Exists Before Loading
dmabuf: use spinlock to access dmabuf->name
ARM: dts: imx6qdl-gw551x: fix audio SSI
ARM: dts: imx6qdl-gw551x: Do not use 'simple-audio-card,dai-link'
irqdomain/treewide: Keep firmware node unconditionally allocated
fuse: fix weird page warning
drivers/firmware/psci: Fix memory leakage in alloc_init_cpu_groups()
dm: use bio_uninit instead of bio_disassociate_blkg
scsi: dh: Add Fujitsu device to devinfo and dh lists
scsi: mpt3sas: Fix error returns in BRM_status_show
drm/nouveau/i2c/g94-: increase NV_PMGR_DP_AUXCTL_TRANSACTREQ timeout
net: sky2: initialize return of gm_phy_read
ALSA: hda/hdmi: fix failures at PCM open on Intel ICL and later
drivers/net/wan/lapbether: Fixed the value of hard_header_len
scsi: mpt3sas: Fix unlock imbalance
xtensa: update *pos in cpuinfo_op.next
xtensa: fix __sync_fetch_and_{and,or}_4 declarations
scsi: scsi_transport_spi: Fix function pointer check
mac80211: allow rx of mesh eapol frames with default rx key
pinctrl: amd: fix npins for uart0 in kerncz_groups
gpio: arizona: put pm_runtime in case of failure
gpio: arizona: handle pm_runtime_get_sync failure case
soc: qcom: rpmh: Dirt can only make you dirtier, not cleaner
ANDROID: build: update ABI definitions
ANDROID: update the kernel release format for GKI
ANDROID: GKI: update clocksource abi due to upstream fixes needed for VDSO backport
UPSTREAM: arm64: arch_timer: Disable the compat vdso for cores affected by ARM64_WORKAROUND_1418040
UPSTREAM: arm64: arch_timer: Allow an workaround descriptor to disable compat vdso
UPSTREAM: arm64: Introduce a way to disable the 32bit vdso
ANDROID: staging: android: ion: Fix compilation error for ion_trace.h
ANDROID: GKI: enable CONFIG_SCSI_UFS_BSG=y
ANDROID: Incremental fs: magic number compatible 32-bit
ANDROID: kbuild: don't merge .*..compoundliteral in modules
ANDROID: KABI updates for db845c (QCOM_COMMAND_DB fixups)
ANDROID: soc: qcom: cmd-db: Allow COMMAND_DB driver to be loaded as a module
ANDROID: GKI: preserve ABI for struct sock_cgroup_data
Revert "genetlink: remove genl_bind"
Revert "arm64/alternatives: use subsections for replacement sequences"
ANDROID: KABI updates for db845c (USB_EHCI_HCD, USB_EHCI_HCD_PLATFORM and DWC3 fixups)
ANDROID: db845c_gki.fragment: Remove DWC3 modules built into GKI
ANDROID: db845c_gki.fragment: Remove modules built into GKI
ANDROID: power: wakeup_reason: refine wakeup logs
ANDROID: power: wakeup_reason: export log_threaded_irq_wakeup_reason
Linux 5.4.53
gpio: pca953x: disable regmap locking for automatic address incrementing
drm/i915/gvt: Fix two CFL MMIO handling caused by regression.
iommu/vt-d: Make Intel SVM code 64-bit only
ionic: export features for vlans to use
spi: sprd: switch the sequence of setting WDG_LOAD_LOW and _HIGH
rxrpc: Fix trace string
libceph: don't omit recovery_deletes in target_copy()
block: fix get_max_segment_size() overflow on 32bit arch
block: fix splitting segments on boundary masks
drm/i915/gt: Ignore irq enabling on the virtual engines
drm/amdgpu/sdma5: fix wptr overwritten in ->get_wptr()
genirq/affinity: Handle affinity setting on inactive interrupts correctly
sched/fair: handle case of task_h_load() returning 0
sched: Fix unreliable rseq cpu_id for new tasks
arm64: compat: Ensure upper 32 bits of x0 are zero on syscall return
arm64: ptrace: Consistently use pseudo-singlestep exceptions
arm64: ptrace: Override SPSR.SS when single-stepping is enabled
thermal/drivers/cpufreq_cooling: Fix wrong frequency converted from power
thermal: int3403_thermal: Downgrade error message
misc: atmel-ssc: lock with mutex instead of spinlock
dmaengine: fsl-edma-common: correct DSIZE_32BYTE
dmaengine: mcf-edma: Fix NULL pointer exception in mcf_edma_tx_handler
dmaengine: fsl-edma: Fix NULL pointer exception in fsl_edma_tx_handler
intel_th: Fix a NULL dereference when hub driver is not loaded
intel_th: pci: Add Emmitsburg PCH support
intel_th: pci: Add Tiger Lake PCH-H support
intel_th: pci: Add Jasper Lake CPU support
powerpc/pseries/svm: Fix incorrect check for shared_lppaca_size
powerpc/book3s64/pkeys: Fix pkey_access_permitted() for execute disable pkey
hwmon: (emc2103) fix unable to change fan pwm1_enable attribute
riscv: use 16KB kernel stack on 64-bit
timer: Fix wheel index calculation on last level
timer: Prevent base->clk from moving backward
scsi: megaraid_sas: Remove undefined ENABLE_IRQ_POLL macro
uio_pdrv_genirq: fix use without device tree and no interrupt
uio_pdrv_genirq: Remove warning when irq is not specified
Input: elan_i2c - add more hardware ID for Lenovo laptops
Input: i8042 - add Lenovo XiaoXin Air 12 to i8042 nomux list
mei: bus: don't clean driver pointer
Revert "zram: convert remaining CLASS_ATTR() to CLASS_ATTR_RO()"
fuse: Fix parameter for FS_IOC_{GET,SET}FLAGS
fuse: use ->reconfigure() instead of ->remount_fs()
fuse: ignore 'data' argument of mount(..., MS_REMOUNT)
ovl: fix unneeded call to ovl_change_flags()
ovl: relax WARN_ON() when decoding lower directory file handle
ovl: inode reference leak in ovl_is_inuse true case.
ovl: fix regression with re-formatted lower squashfs
serial: mxs-auart: add missed iounmap() in probe failure and remove
virtio: virtio_console: add missing MODULE_DEVICE_TABLE() for rproc serial
Revert "tty: xilinx_uartps: Fix missing id assignment to the console"
virt: vbox: Fix guest capabilities mask check
virt: vbox: Fix VBGL_IOCTL_VMMDEV_REQUEST_BIG and _LOG req numbers to match upstream
USB: serial: option: add Quectel EG95 LTE modem
USB: serial: option: add GosunCn GM500 series
USB: serial: ch341: add new Product ID for CH340
USB: serial: cypress_m8: enable Simply Automated UPB PIM
USB: serial: iuu_phoenix: fix memory corruption
usb: gadget: function: fix missing spinlock in f_uac1_legacy
usb: chipidea: core: add wakeup support for extcon
usb: dwc2: Fix shutdown callback in platform
USB: c67x00: fix use after free in c67x00_giveback_urb
ALSA: hda/realtek - Enable Speaker for ASUS UX563
ALSA: hda/realtek - Enable Speaker for ASUS UX533 and UX534
ALSA: hda/realtek: Enable headset mic of Acer TravelMate B311R-31 with ALC256
ALSA: hda/realtek: enable headset mic of ASUS ROG Zephyrus G14(G401) series with ALC289
ALSA: hda/realtek - change to suitable link model for ASUS platform
ALSA: usb-audio: Fix race against the error recovery URB submission
ALSA: line6: Sync the pending work cancel at disconnection
ALSA: line6: Perform sanity check for each URB creation
HID: quirks: Ignore Simply Automated UPB PIM
HID: quirks: Always poll Obins Anne Pro 2 keyboard
HID: magicmouse: do not set up autorepeat
HID: logitech-hidpp: avoid repeated "multiplier = " log messages
slimbus: core: Fix mismatch in of_node_get/put
clk: qcom: gcc: Add missing UFS clocks for SM8150
clk: qcom: gcc: Add GPU and NPU clocks for SM8150
mtd: rawnand: oxnas: Release all devices in the _remove() path
mtd: rawnand: oxnas: Unregister all devices on error
mtd: rawnand: oxnas: Keep track of registered devices
mtd: rawnand: brcmnand: fix CS0 layout
mtd: rawnand: brcmnand: correctly verify erased pages
mtd: rawnand: timings: Fix default tR_max and tCCS_min timings
mtd: rawnand: marvell: Fix probe error path
mtd: rawnand: marvell: Use nand_cleanup() when the device is not yet registered
mtd: rawnand: marvell: Fix the condition on a return code
RDMA/mlx5: Verify that QP is created with RQ or SQ
soc: qcom: rpmh-rsc: Allow using free WAKE TCS for active request
soc: qcom: rpmh-rsc: Clear active mode configuration for wake TCS
soc: qcom: rpmh: Invalidate SLEEP and WAKE TCSes before flushing new data
soc: qcom: rpmh: Update dirty flag only when data changes
perf stat: Zero all the 'ena' and 'run' array slot stats for interval mode
PCI/PM: Call .bridge_d3() hook only if non-NULL
habanalabs: Align protection bits configuration of all TPCs
apparmor: ensure that dfa state tables have entries
soc: qcom: socinfo: add missing soc_id sysfs entry
arm: dts: mt7623: add phy-mode property for gmac2
copy_xstate_to_kernel: Fix typo which caused GDB regression
regmap: debugfs: Don't sleep while atomic for fast_io regmaps
keys: asymmetric: fix error return code in software_key_query()
arm64: dts: spcfpga: Align GIC, NAND and UART nodenames with dtschema
ARM: dts: socfpga: Align L2 cache-controller nodename with dtschema
xprtrdma: fix incorrect header size calculations
Revert "thermal: mediatek: fix register index error"
ARM: dts: Fix dcan driver probe failed on am437x platform
fuse: don't ignore errors from fuse_writepages_fill()
NFS: Fix interrupted slots by sending a solo SEQUENCE operation
clk: AST2600: Add mux for EMMC clock
clk: mvebu: ARMADA_AP_CPU_CLK needs to select ARMADA_AP_CP_HELPER
staging: comedi: verify array index is correct before using it
usb: gadget: udc: atmel: fix uninitialized read in debug printk
spi: spi-sun6i: sun6i_spi_transfer_one(): fix setting of clock rate
dmaengine: dmatest: stop completed threads when running without set channel
dmaengine: dw: Initialize channel before each transfer
iio: adc: ad7780: Fix a resource handling path in 'ad7780_probe()'
bus: ti-sysc: Do not disable on suspend for no-idle
bus: ti-sysc: Fix sleeping function called from invalid context for RTC quirk
bus: ti-sysc: Fix wakeirq sleeping function called from invalid context
arm64: dts: meson-gxl-s805x: reduce initial Mali450 core frequency
arm64: dts: meson: add missing gxl rng clock
phy: sun4i-usb: fix dereference of pointer phy0 before it is null checked
dmaengine: sh: usb-dmac: set tx_result parameters
soundwire: intel: fix memory leak with devm_kasprintf
iio:health:afe4404 Fix timestamp alignment and prevent data leak.
ALSA: usb-audio: Add registration quirk for Kingston HyperX Cloud Flight S
bus: ti-sysc: Use optional clocks on for enable and wait for softreset bit
ACPI: video: Use native backlight on Acer TravelMate 5735Z
Input: mms114 - add extra compatible for mms345l
ALSA: usb-audio: Add quirk for Focusrite Scarlett 2i2
ALSA: usb-audio: Add registration quirk for Kingston HyperX Cloud Alpha S
ACPI: video: Use native backlight on Acer Aspire 5783z
ALSA: usb-audio: Rewrite registration quirk handling
mmc: sdhci: do not enable card detect interrupt for gpio cd type
doc: dt: bindings: usb: dwc3: Update entries for disabling SS instances in park mode
ALSA: usb-audio: Create a registration quirk for Kingston HyperX Amp (0951:16d8)
Input: goodix - fix touch coordinates on Cube I15-TC
ALSA: usb-audio: Add support for MOTU MicroBook IIc
bus: ti-sysc: Detect EDMA and set quirk flags for tptc
arm64: dts: g12-common: add parkmode_disable_ss_quirk on DWC3 controller
bus: ti-sysc: Detect display subsystem related devices
bus: ti-sysc: Handle module unlock quirk needed for some RTC
bus: ti-sysc: Consider non-existing registers too when matching quirks
bus: ti-sysc: Rename clk related quirks to pre_reset and post_reset quirks
scsi: sr: remove references to BLK_DEV_SR_VENDOR, leave it enabled
drm/sun4i: tcon: Separate quirks for tcon0 and tcon1 on A20
ARM: at91: pm: add quirk for sam9x60's ulp1
HID: quirks: Remove ITE 8595 entry from hid_have_special_driver
mmc: mmci: Support any block sizes for ux500v2 and qcom variant
ARM: OMAP2+: use separate IOMMU pdata to fix DRA7 IPU1 boot
ARM: OMAP2+: Add workaround for DRA7 DSP MStandby errata i879
ARM: OMAP4+: remove pdata quirks for omap4+ iommus
net: sfp: add some quirks for GPON modules
net: sfp: add support for module quirks
Revert "usb/xhci-plat: Set PM runtime as active on resume"
Revert "usb/ehci-platform: Set PM runtime as active on resume"
Revert "usb/ohci-platform: Fix a warning when hibernating"
net: ethernet: mvneta: Add back interface mode validation
net: ethernet: mvneta: Do not error out in non serdes modes
net: macb: call pm_runtime_put_sync on failure path
of: of_mdio: Correct loop scanning logic
net: dsa: bcm_sf2: Fix node reference count
spi: spi-fsl-dspi: Fix lockup if device is shutdown during SPI transfer
iio:health:afe4403 Fix timestamp alignment and prevent data leak.
iio:pressure:ms5611 Fix buffer element alignment
iio:humidity:hts221 Fix alignment and data leak issues
iio: pressure: zpa2326: handle pm_runtime_get_sync failure
iio: mma8452: Add missed iio_device_unregister() call in mma8452_probe()
iio: core: add missing IIO_MOD_H2/ETHANOL string identifiers
iio: magnetometer: ak8974: Fix runtime PM imbalance on error
iio:humidity:hdc100x Fix alignment and data leak issues
iio:magnetometer:ak8974: Fix alignment and data leak issues
arm64/alternatives: don't patch up internal branches
i2c: eg20t: Load module automatically if ID matches
gfs2: read-only mounts should grab the sd_freeze_gl glock
tpm_tis: extra chip->ops check on error path in tpm_tis_core_init
arm64/alternatives: use subsections for replacement sequences
cifs: prevent truncation from long to int in wait_for_free_credits
dt-bindings: mailbox: zynqmp_ipi: fix unit address
m68k: mm: fix node memblock init
m68k: nommu: register start of the memory with memblock
blk-mq-debugfs: update blk_queue_flag_name[] accordingly for new flags
thermal/drivers: imx: Fix missing of_node_put() at probe time
x86/fpu: Reset MXCSR to default in kernel_fpu_begin()
drm/exynos: fix ref count leak in mic_pre_enable
drm/exynos: Properly propagate return value in drm_iommu_attach_device()
drm/msm/dpu: allow initialization of encoder locks during encoder init
drm/msm: fix potential memleak in error branch
arm64: arch_timer: Disable the compat vdso for cores affected by ARM64_WORKAROUND_1418040
arm64: arch_timer: Allow an workaround descriptor to disable compat vdso
arm64: Introduce a way to disable the 32bit vdso
ip: Fix SO_MARK in RST, ACK and ICMP packets
cgroup: Fix sock_cgroup_data on big-endian.
cgroup: fix cgroup_sk_alloc() for sk_clone_lock()
tcp: md5: allow changing MD5 keys in all socket states
tcp: md5: refine tcp_md5_do_add()/tcp_md5_hash_key() barriers
vlan: consolidate VLAN parsing code and limit max parsing depth
tcp: md5: do not send silly options in SYNCOOKIES
tcp: md5: add missing memory barriers in tcp_md5_do_add()/tcp_md5_hash_key()
tcp: make sure listeners don't initialize congestion-control state
tcp: fix SO_RCVLOWAT possible hangs under high mem pressure
sched: consistently handle layer3 header accesses in the presence of VLANs
net: usb: qmi_wwan: add support for Quectel EG95 LTE modem
net_sched: fix a memory leak in atm_tc_init()
net: dsa: microchip: set the correct number of ports
net: Added pointer check for dst->ops->neigh_lookup in dst_neigh_lookup_skb
llc: make sure applications use ARPHRD_ETHER
l2tp: remove skb_dst_set() from l2tp_xmit_skb()
ipv6: Fix use of anycast address with loopback
ipv6: fib6_select_path can not use out path for nexthop objects
ipv4: fill fl4_icmp_{type,code} in ping_v4_sendmsg
genetlink: remove genl_bind
bridge: mcast: Fix MLD2 Report IPv6 payload length check
net: rmnet: fix lower interface leak
net: atlantic: fix ip dst and ipv6 address filters
crypto: atmel - Fix build error of CRYPTO_AUTHENC
crypto: atmel - Fix selection of CRYPTO_AUTHENC
ANDROID: GKI: update abi symbol lists now that CONFIG_DWC3 is enabled.
ANDROID: GKI: Enable CONFIG_USB_DWC3
ANDROID: ABI: add the symbols of dwc3.ko and sprd-dma.ko to unisoc
ANDROID: ABI: Update the ABI whitelist for QCOM
ANDROID: GKI: Update CF abi list for virtio-console
UPSTREAM: lkdtm/heap: Avoid edge and middle of slabs
UPSTREAM: lkdtm: Avoid more compiler optimizations for bad writes
ANDROID: GKI: Update ABI after RPMH config change
ANDROID: GKI: Adjust symbol lists after RPMH removed from gki_defconfig
ANDROID: db845c_gki.fragment: Add QCOM_RPMH and QCOM_RPMHPD as modules
ANDROID: gki_defconfig: Remove QCOM_RPMH from the gki_defconfig
ANDROID: Kconfig.gki: Remove GKI_QCOM_CLKS_CONFIGS and QCOM_RPMHPD from GKI_HACKS config option
FROMLIST: soc: qcom: rpmh: Allow RPMH driver to be loaded as a module
UPSTREAM: soc: qcom: rpmhpd: Allow RPMHPD driver to be loaded as a module
ANDROID: GKI: Export memblock_free to drivers
ANDROID: GKI: do not export symbol_get/put()
ANDROID: add xfs back to allmodconfig build tests
FROMLIST: rpmsg: core: Add signal API support
ANDROID: GKI: Fix x86 warning on DMA_VIRTUAL_CHANNELS
ANDROID: GKI: Update ABI and export list for qcom
Revert "ANDROID: net: enable wireless core features with GKI_LEGACY_WEXT_ALLCONFIG"
Revert "ALSA: compress: fix partial_drain completion state"
Conflicts:
Documentation/devicetree/bindings
Documentation/devicetree/bindings/mailbox/xlnx,zynqmp-ipi-mailbox.txt
Documentation/devicetree/bindings/usb/dwc3.txt
android/abi_gki_aarch64_qcom
drivers/soc/qcom/Kconfig
drivers/soc/qcom/socinfo.c
drivers/usb/host/xhci-plat.c
kernel/sched/core.c
Change-Id: If4d45d5447eb2b1b86326bae8c3844fe565a0b42
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
|
||
|
Greg Kroah-Hartman
|
261a54f37d |
This is the 5.4.54 stable release
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl8hMPEACgkQONu9yGCS
aT4XTw/+KgIRJRuJb3FKXbV/ranj4gSLiOoDq86W7L6SNYqDoz/sqMmGhe0ttiu8
38xCl6YrPQQqA91w9fiy6Y6DcY15XRtUTWIbLtVO5GPwTNiZHskfWZ+KwjNcM1B9
q/fSR/791nJ1lpNo6XjPws7sbVUNdX0UbTIlLCEZayoxvHdar6u/XmNNUTPwbY01
kD5EmVVv3tbrkhiDQ+MXqEfsF7cae85SbkUVGRrGm7uL/s6PB2NwRGEn1XbN/ZKJ
jmuRc0T5nwbB9rh2TV8P1c8PP3iPrpRdWFbaTGhcxCkJh2gzwqVnRBIfpWNQo2Fz
LuLj5g3BfzSx5xQcWkjZrcn72zobZLF9Bvx6NIaYm1Ly3vtR9mjYmqOcRtv3T0sJ
xi+ObxI73dZhvv0yeJTFbAquQ3Js+ohzNpSr8zJcJp4WX7XDTd/dE+u3uOmSBMoE
UlD2cWf/HIaYZcLLIOqSIM0uHmfTTc4KTgR2bMXzwEMhtResJpUG1BDa8/MOCDxX
7UhgRmrZ99faOjNy5jrdI4x5MwTMQs/znMtZ8Y6OlE9RZIogHON8/mTRGqLV0cRF
Drw6XTfS6QOu55vvddqjmie4J8/aFvhWVw4A90n0DmXH8fY+XqFI8mCguBQw/mW3
xm4lSSCgRFuQ2YFctXjgwD5MBaCDKAW2rp6iwZmC8sONYeoVCfM=
=IZ2W
-----END PGP SIGNATURE-----
Merge 5.4.54 into android11-5.4
Changes in 5.4.54
soc: qcom: rpmh: Dirt can only make you dirtier, not cleaner
gpio: arizona: handle pm_runtime_get_sync failure case
gpio: arizona: put pm_runtime in case of failure
pinctrl: amd: fix npins for uart0 in kerncz_groups
mac80211: allow rx of mesh eapol frames with default rx key
scsi: scsi_transport_spi: Fix function pointer check
xtensa: fix __sync_fetch_and_{and,or}_4 declarations
xtensa: update *pos in cpuinfo_op.next
scsi: mpt3sas: Fix unlock imbalance
drivers/net/wan/lapbether: Fixed the value of hard_header_len
ALSA: hda/hdmi: fix failures at PCM open on Intel ICL and later
net: sky2: initialize return of gm_phy_read
drm/nouveau/i2c/g94-: increase NV_PMGR_DP_AUXCTL_TRANSACTREQ timeout
scsi: mpt3sas: Fix error returns in BRM_status_show
scsi: dh: Add Fujitsu device to devinfo and dh lists
dm: use bio_uninit instead of bio_disassociate_blkg
drivers/firmware/psci: Fix memory leakage in alloc_init_cpu_groups()
fuse: fix weird page warning
irqdomain/treewide: Keep firmware node unconditionally allocated
ARM: dts: imx6qdl-gw551x: Do not use 'simple-audio-card,dai-link'
ARM: dts: imx6qdl-gw551x: fix audio SSI
dmabuf: use spinlock to access dmabuf->name
drm/amd/display: Check DMCU Exists Before Loading
SUNRPC reverting d03727b248d0 ("NFSv4 fix CLOSE not waiting for direct IO compeletion")
btrfs: reloc: fix reloc root leak and NULL pointer dereference
btrfs: reloc: clear DEAD_RELOC_TREE bit for orphan roots to prevent runaway balance
uprobes: Change handle_swbp() to send SIGTRAP with si_code=SI_KERNEL, to fix GDB regression
ALSA: hda/realtek: Fixed ALC298 sound bug by adding quirk for Samsung Notebook Pen S
ALSA: info: Drop WARN_ON() from buffer NULL sanity check
ASoC: rt5670: Correct RT5670_LDO_SEL_MASK
btrfs: fix double free on ulist after backref resolution failure
btrfs: fix mount failure caused by race with umount
btrfs: fix page leaks after failure to lock page for delalloc
bnxt_en: Fix race when modifying pause settings.
bnxt_en: Fix completion ring sizing with TPA enabled.
fpga: dfl: pci: reduce the scope of variable 'ret'
fpga: dfl: fix bug in port reset handshake
hippi: Fix a size used in a 'pci_free_consistent()' in an error handling path
vsock/virtio: annotate 'the_virtio_vsock' RCU pointer
ax88172a: fix ax88172a_unbind() failures
RDMA/mlx5: Use xa_lock_irq when access to SRQ table
ASoC: Intel: bytcht_es8316: Add missed put_device()
net: dp83640: fix SIOCSHWTSTAMP to update the struct with actual configuration
ieee802154: fix one possible memleak in adf7242_probe
drm: sun4i: hdmi: Fix inverted HPD result
net: smc91x: Fix possible memory leak in smc_drv_probe()
bonding: check error value of register_netdevice() immediately
mlxsw: destroy workqueue when trap_register in mlxsw_emad_init
ionic: use offset for ethtool regs data
ionic: fix up filter locks and debug msgs
net: ag71xx: add missed clk_disable_unprepare in error path of probe
net: hns3: fix error handling for desc filling
net: dsa: microchip: call phy_remove_link_mode during probe
netdevsim: fix unbalaced locking in nsim_create()
qed: suppress "don't support RoCE & iWARP" flooding on HW init
qed: suppress false-positives interrupt error messages on HW init
ipvs: fix the connection sync failed in some cases
net: ethernet: ave: Fix error returns in ave_init
Revert "PCI/PM: Assume ports without DLL Link Active train links in 100 ms"
nfsd4: fix NULL dereference in nfsd/clients display code
enetc: Remove the mdio bus on PF probe bailout
i2c: rcar: always clear ICSAR to avoid side effects
i2c: i2c-qcom-geni: Fix DMA transfer race
bonding: check return value of register_netdevice() in bond_newlink()
geneve: fix an uninitialized value in geneve_changelink()
serial: exar: Fix GPIO configuration for Sealevel cards based on XR17V35X
scripts/decode_stacktrace: strip basepath from all paths
scripts/gdb: fix lx-symbols 'gdb.error' while loading modules
HID: i2c-hid: add Mediacom FlexBook edge13 to descriptor override
HID: alps: support devices with report id 2
HID: steam: fixes race in handling device list.
HID: apple: Disable Fn-key key-re-mapping on clone keyboards
dmaengine: tegra210-adma: Fix runtime PM imbalance on error
Input: add `SW_MACHINE_COVER`
ARM: dts: n900: remove mmc1 card detect gpio
spi: mediatek: use correct SPI_CFG2_REG MACRO
regmap: dev_get_regmap_match(): fix string comparison
hwmon: (aspeed-pwm-tacho) Avoid possible buffer overflow
dmaengine: fsl-edma: fix wrong tcd endianness for big-endian cpu
dmaengine: ioat setting ioat timeout as module parameter
Input: synaptics - enable InterTouch for ThinkPad X1E 1st gen
Input: elan_i2c - only increment wakeup count on touch
usb: dwc3: pci: add support for the Intel Tiger Lake PCH -H variant
usb: dwc3: pci: add support for the Intel Jasper Lake
usb: gadget: udc: gr_udc: fix memleak on error handling path in gr_ep_init()
usb: cdns3: ep0: fix some endian issues
usb: cdns3: trace: fix some endian issues
hwmon: (adm1275) Make sure we are reading enough data for different chips
drm/amdgpu/gfx10: fix race condition for kiq
drm/amdgpu: fix preemption unit test
hwmon: (nct6775) Accept PECI Calibration as temperature source for NCT6798D
platform/x86: ISST: Add new PCI device ids
platform/x86: asus-wmi: allow BAT1 battery name
hwmon: (scmi) Fix potential buffer overflow in scmi_hwmon_probe()
ALSA: hda/realtek - fixup for yet another Intel reference board
drivers/perf: Fix kernel panic when rmmod PMU modules during perf sampling
arm64: Use test_tsk_thread_flag() for checking TIF_SINGLESTEP
x86: math-emu: Fix up 'cmp' insn for clang ias
asm-generic/mmiowb: Allow mmiowb_set_pending() when preemptible()
drivers/perf: Prevent forced unbinding of PMU drivers
RISC-V: Upgrade smp_mb__after_spinlock() to iorw,iorw
binder: Don't use mmput() from shrinker function.
usb: xhci-mtk: fix the failure of bandwidth allocation
usb: xhci: Fix ASM2142/ASM3142 DMA addressing
Revert "cifs: Fix the target file was deleted when rename failed."
iwlwifi: mvm: don't call iwl_mvm_free_inactive_queue() under RCU
tty: xilinx_uartps: Really fix id assignment
staging: wlan-ng: properly check endpoint types
staging: comedi: addi_apci_1032: check INSN_CONFIG_DIGITAL_TRIG shift
staging: comedi: ni_6527: fix INSN_CONFIG_DIGITAL_TRIG support
staging: comedi: addi_apci_1500: check INSN_CONFIG_DIGITAL_TRIG shift
staging: comedi: addi_apci_1564: check INSN_CONFIG_DIGITAL_TRIG shift
serial: tegra: fix CREAD handling for PIO
serial: 8250: fix null-ptr-deref in serial8250_start_tx()
serial: 8250_mtk: Fix high-speed baud rates clamping
/dev/mem: Add missing memory barriers for devmem_inode
fbdev: Detect integer underflow at "struct fbcon_ops"->clear_margins.
vt: Reject zero-sized screen buffer size.
Makefile: Fix GCC_TOOLCHAIN_DIR prefix for Clang cross compilation
mm/mmap.c: close race between munmap() and expand_upwards()/downwards()
mm/memcg: fix refcount error while moving and swapping
mm: memcg/slab: fix memory leak at non-root kmem_cache destroy
khugepaged: fix null-pointer dereference due to race
io-mapping: indicate mapping failure
mmc: sdhci-of-aspeed: Fix clock divider calculation
drm/amdgpu: Fix NULL dereference in dpm sysfs handlers
drm/amd/powerplay: fix a crash when overclocking Vega M
parisc: Add atomic64_set_release() define to avoid CPU soft lockups
x86, vmlinux.lds: Page-align end of ..page_aligned sections
ASoC: rt5670: Add new gpio1_is_ext_spk_en quirk and enable it on the Lenovo Miix 2 10
ASoC: qcom: Drop HAS_DMA dependency to fix link failure
ASoC: topology: fix kernel oops on route addition error
ASoC: topology: fix tlvs in error handling for widget_dmixer
dm integrity: fix integrity recalculation that is improperly skipped
ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb
ath9k: Fix regression with Atheros 9271
Linux 5.4.54
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ic2a25ecd02cfc4a44ec53c73e200b72cd7d930ba
|
||
Tetsuo Handa
|
93f1e16af4 |
binder: Don't use mmput() from shrinker function.
commit f867c771f98891841c217fa8459244ed0dd28921 upstream.
syzbot is reporting that mmput() from shrinker function has a risk of
deadlock [1], for delayed_uprobe_add() from update_ref_ctr() calls
kzalloc(GFP_KERNEL) with delayed_uprobe_lock held, and
uprobe_clear_state() from __mmput() also holds delayed_uprobe_lock.
Commit
|
||
|
Blagovest Kolenichev
|
fac8c789d8 |
Merge android11-5.4.52 (c7725ae) into msm-5.4
* refs/heads/tmp-c7725ae: Linux 5.4.52 s390/maccess: add no DAT mode to kernel_write s390: Change s390_kernel_write() return type to match memcpy() pwm: jz4740: Fix build failure perf scripts python: exported-sql-viewer.py: Fix unexpanded 'Find' result perf scripts python: exported-sql-viewer.py: Fix zero id in call tree 'Find' result perf scripts python: exported-sql-viewer.py: Fix zero id in call graph 'Find' result perf scripts python: export-to-postgresql.py: Fix struct.pack() int argument dm writecache: reject asynchronous pmem devices blk-mq: consider non-idle request as "inflight" in blk_mq_rq_inflight() s390/mm: fix huge pte soft dirty copying s390/setup: init jump labels before command line parsing ARC: elf: use right ELF_ARCH ARC: entry: fix potential EFA clobber when TIF_SYSCALL_TRACE mmc: meson-gx: limit segments to 1 when dram-access-quirk is needed dm: use noio when sending kobject event drm/amdgpu: don't do soft recovery if gpu_recovery=0 drm/radeon: fix double free btrfs: fix double put of block group with nocow btrfs: fix fatal extent_buffer readahead vs releasepage race Revert "ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb" bpf: Check correct cred for CAP_SYSLOG in bpf_dump_raw_ok() kprobes: Do not expose probe addresses to non-CAP_SYSLOG module: Do not expose section addresses to non-CAP_SYSLOG module: Refactor section attr into bin attribute kallsyms: Refactor kallsyms_show_value() to take cred KVM: arm64: Fix kvm_reset_vcpu() return code being incorrect with SVE KVM: x86: Mark CR4.TSD as being possibly owned by the guest KVM: x86: Inject #GP if guest attempts to toggle CR4.LA57 in 64-bit mode KVM: x86: bit 8 of non-leaf PDPEs is not reserved KVM: arm64: Annotate hyp NMI-related functions as __always_inline KVM: arm64: Stop clobbering x0 for HVC_SOFT_RESTART KVM: arm64: Fix definition of PAGE_HYP_DEVICE ALSA: hda/realtek: Enable headset mic of Acer Veriton N4660G with ALC269VC ALSA: hda/realtek: Enable headset mic of Acer C20-820 with ALC269VC ALSA: hda/realtek - Enable audio jacks of Acer vCopperbox with ALC269VC ALSA: hda/realtek - Fix Lenovo Thinkpad X1 Carbon 7th quirk subdevice id ALSA: usb-audio: Add implicit feedback quirk for RTX6001 ALSA: usb-audio: add quirk for MacroSilicon MS2109 ALSA: hda - let hs_mic be picked ahead of hp_mic ALSA: opl3: fix infoleak in opl3 IB/hfi1: Do not destroy link_wq when the device is shut down IB/hfi1: Do not destroy hfi1_wq when the device is shut down mlxsw: pci: Fix use-after-free in case of failed devlink reload mlxsw: spectrum_router: Remove inappropriate usage of WARN_ON() net: macb: fix call to pm_runtime in the suspend/resume functions net: macb: mark device wake capable when "magic-packet" property present net: macb: fix wakeup test in runtime suspend/resume routines bnxt_en: fix NULL dereference in case SR-IOV configuration fails net/mlx5e: Fix 50G per lane indication net/mlx5: Fix eeprom support for SFP module qed: Populate nvm-file attributes while reading nvm config partition. IB/mlx5: Fix 50G per lane indication cxgb4: fix all-mask IP address comparison nbd: Fix memory leak in nbd_add_socket arm64: kgdb: Fix single-step exception handling oops RDMA/siw: Fix reporting vendor_part_id ALSA: compress: fix partial_drain completion state net: hns3: fix use-after-free when doing self test net: hns3: add a missing uninit debugfs when unload driver smsc95xx: avoid memory leak in smsc95xx_bind smsc95xx: check return value of smsc95xx_reset perf intel-pt: Fix PEBS sample for XMM registers perf intel-pt: Fix recording PEBS-via-PT with registers perf report TUI: Fix segmentation fault in perf_evsel__hists_browse() netfilter: conntrack: refetch conntrack after nf_conntrack_update() net: dsa: microchip: set the correct number of ports IB/sa: Resolv use-after-free in ib_nl_make_request() net: cxgb4: fix return error value in t4_prep_fw net: mvneta: fix use of state->speed netfilter: ipset: call ip_set_free() instead of kfree() bpf, sockmap: RCU dereferenced psock may be used outside RCU block bpf, sockmap: RCU splat with redirect and strparser error or TLS drm/mediatek: Check plane visibility in atomic_update nl80211: don't return err unconditionally in nl80211_start_ap() gpio: pca953x: Fix GPIO resource leak on Intel Galileo Gen 2 gpio: pca953x: Override IRQ for one of the expanders on Galileo Gen 2 net: qrtr: Fix an out of bounds read qrtr_endpoint_post() sched/core: Check cpus_mask, not cpus_ptr in __set_cpus_allowed_ptr(), to fix mask corruption x86/entry: Increase entry_stack size to a full page nvme-rdma: assign completion vector correctly block: release bip in a right way in error path usb: dwc3: pci: Fix reference count leak in dwc3_pci_resume_work scsi: mptscsih: Fix read sense data size ARM: imx6: add missing put_device() call in imx6q_suspend_init() cifs: update ctime and mtime during truncate s390/kasan: fix early pgm check handler execution drm: panel-orientation-quirks: Use generic orientation-data for Acer S1003 drm: panel-orientation-quirks: Add quirk for Asus T101HA panel iommu/vt-d: Don't apply gfx quirks to untrusted devices powerpc/kvm/book3s64: Fix kernel crash with nested kvm & DEBUG_VIRTUAL ibmvnic: continue to init in CRQ reset returns H_CLOSED i40e: protect ring accesses with READ- and WRITE_ONCE ixgbe: protect ring accesses with READ- and WRITE_ONCE net: ethernet: mvneta: Add 2500BaseX support for SoCs without comphy net: ethernet: mvneta: Fix Serdes configuration for SoCs without comphy spi: spidev: fix a potential use-after-free in spidev_release() spi: spidev: fix a race between spidev_release and spidev_remove ALSA: hda: Intel: add missing PCI IDs for ICL-H, TGL-H and EKL ASoC: SOF: Intel: add PCI ID for CometLake-S drm: mcde: Fix display initialization problem gpu: host1x: Detach driver on unregister drm/tegra: hub: Do not enable orphaned window group drm/ttm: Fix dma_fence refcnt leak when adding move fence ARM: dts: omap4-droid4: Fix spi configuration and increase rate perf/x86/rapl: Fix RAPL config variable bug perf/x86/rapl: Move RAPL support to common x86 code regmap: fix alignment issue spi: spi-fsl-dspi: Fix lockup if device is removed during SPI transfer spi: spi-fsl-dspi: Adding shutdown hook KVM: s390: reduce number of IO pins to 1 ANDROID: ABI: add already existing symbols of ufs_* to unisoc ANDROID: ABI: add nf_* symbols to unisoc ANDROID: GKI: update abi xml file ANDROID: GKI: build in more Bluetooth drivers ANDROID: GKI: update abi xml file ANDROID: GKI: Enable CONFIG_BT_HIDP as it is needed by some platforms ANDROID: GKI: add CONFIG_BT to x86 gki_defconfig ANDROID: GKI: update abi definitions ANDROID: mm: add vendor padding for SPECULATIVE_PAGE_FAULTS ANDROID: GKI: enable usb storage drivers ANDROID: fscrypt: fix DUN contiguity with inline encryption + IV_INO_LBLK_32 policies ANDROID: GKI: set CONFIG_STATIC_USERMODEHELPER_PATH ANDROID: sound: usb: Add vendor's hooking interface UPSTREAM: slimbus: core: Set fwnode for a device when setting of_node ANDROID: f2fs: add back compress inode check ANDROID: abi: update abi dump for CONFIG_KPROBES ANDROID: gki_defconfig: Enable Kprobes ANDROID: Correct branch name after rename ANDROID: GKI: update ABI due to power supply changes UPSTREAM: power: supply: core: add POWER_SUPPLY_HEALTH_CALIBRATION_REQUIRED UPSTREAM: power: supply: core: add manufacture date properties UPSTREAM: power: supply: core: add capacity error margin property UPSTREAM: power: supply: core: Add type property to uevent env UPSTREAM: power: supply: core: Add a macro that maps enum properties to text values UPSTREAM: power: supply: core: Use designated initializer for property text arrays UPSTREAM: power: supply: core: Cleanup power supply sysfs attribute list UPSTREAM: power: supply: core: reduce power_supply_show_usb_type() parameters ANDROID: fix copyright notice ANDROID: add support for vendor hooks ANDROID: GKI: update abi definitions Linux 5.4.51 efi: Make it possible to disable efivar_ssdt entirely dm zoned: assign max_io_len correctly x86/resctrl: Fix memory bandwidth counter width for AMD mm, compaction: make capture control handling safe wrt interrupts mm, compaction: fully assume capture is not NULL in compact_zone_order() irqchip/gic: Atomically update affinity dma-buf: Move dma_buf_release() from fops to dentry_ops drm/amdgpu/atomfirmware: fix vram_info fetching for renoir drm/amdgpu: use %u rather than %d for sclk/mclk drm/amd/display: Only revalidate bandwidth on medium and fast updates MIPS: Add missing EHB in mtc0 -> mfc0 sequence for DSPen MIPS: lantiq: xway: sysctrl: fix the GPHY clock alias names cifs: Fix the target file was deleted when rename failed. SMB3: Honor 'handletimeout' flag for multiuser mounts SMB3: Honor lease disabling for multiuser mounts SMB3: Honor persistent/resilient handle flags for multiuser mounts SMB3: Honor 'seal' flag for multiuser mounts Revert "ALSA: usb-audio: Improve frames size computation" nfsd: apply umask on fs without ACL support spi: spi-fsl-dspi: Fix external abort on interrupt in resume or exit paths i2c: mlxcpld: check correct size of maximum RECV_LEN packet i2c: algo-pca: Add 0x78 as SCL stuck low status for PCA9665 samples/vfs: avoid warning in statx override nvme: fix a crash in nvme_mpath_add_disk nvme: fix identify error status silent ignore SMB3: Honor 'posix' flag for multiuser mounts virtio-blk: free vblk-vqs in error path of virtblk_probe() drm: sun4i: hdmi: Remove extra HPD polling nfsd: fix nfsdfs inode reference count leak nfsd4: fix nfsdfs reference count loop thermal/drivers/rcar_gen3: Fix undefined temperature if negative thermal/drivers/mediatek: Fix bank number settings on mt8183 hwmon: (acpi_power_meter) Fix potential memory leak in acpi_power_meter_add() hwmon: (max6697) Make sure the OVERT mask is set correctly cxgb4: fix SGE queue dump destination buffer context cxgb4: use correct type for all-mask IP address comparison cxgb4: fix endian conversions for L4 ports in filters cxgb4: parse TC-U32 key values and masks natively cxgb4: use unaligned conversion for fetching timestamp RDMA/counter: Query a counter before release rxrpc: Fix afs large storage transmission performance drop drm/msm/dpu: fix error return code in dpu_encoder_init crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() tpm: Fix TIS locality timeout problems selftests: tpm: Use /bin/sh instead of /bin/bash kgdb: Avoid suspicious RCU usage warning nvme-multipath: fix bogus request queue reference put nvme-multipath: fix deadlock due to head->lock nvme-multipath: fix deadlock between ana_work and scan_work nvme-multipath: set bdi capabilities once s390/debug: avoid kernel warning on too large number of pages tools lib traceevent: Handle __attribute__((user)) in field names tools lib traceevent: Add append() function helper for appending strings usb: usbtest: fix missing kfree(dev->buf) in usbtest_disconnect rxrpc: Fix race between incoming ACK parser and retransmitter mm/slub: fix stack overruns with SLUB_STATS mm/slub.c: fix corrupted freechain in deactivate_slab() sched/debug: Make sd->flags sysctl read-only usbnet: smsc95xx: Fix use-after-free after removal EDAC/amd64: Read back the scrub rate PCI register on F15h mm: fix swap cache node allocation mask io_uring: make sure async workqueue is canceled on exit ANDROID: update the ABI representation after ion sysfs changes ANDROID: add ion_stat tracepoint to common kernel ANDROID: staging: android: ion: Expose total heap and pool sizes via sysfs ANDROID: Update ABI representation for libabigail update ANDROID: Update the ABI representation ANDROID: GKI: Incremental fs: move MODULE_IMPORT_NS() line ANDROID: GKI: set vfs-only exports into their own namespace ANDROID: gki: build-in DMA_VIRTUAL_CHANNELS ANDROID: GKI: make VIDEOBUF2_DMA_CONTIG under GKI_HIDDEN_MEDIA_CONFIGS ANDROID: PM: sleep: export device_pm_callback_start/end trace event ANDROID: fix copyright notice ANDROID: GKI: add android_vendor.h ANDROID: GKI: enable CONFIG_V4L_PLATFORM_DRIVERS ANDROID: GKI: enable CONFIG_TYPEC_TCPM ANDROID: GKI: support CONFIG_INPUT_TOUCHSCREEN ANDROID: GKI: move abi files to android/ ANDROID: GKI: drop unneeded "_whitelist" off of symbol filenames ANDROID: GKI: modules should not run programs UPSTREAM: net: bpf: Make bpf_ktime_get_ns() available to non GPL programs UPSTREAM: bpf: Add gso_size to __sk_buff UPSTREAM: usb: musb: mediatek: add reset FADDR to zero in reset interrupt handle ANDROID: ABI/Whitelist: update symbols of incrementalfs.ko and sprd_*.ko to unisoc whitelist ANDROID: GKI: update abi definition now that EHCI driver is built in ANDROID: GKI: support CONFIG_USB_EHCI_HCD_PLATFORM ANDROID: GKI: support CONFIG_USB_EHCI_HCD ANDROID: Update kabi for db845c (keeping up with ufs-qcom zig-zag) ANDROID: GKI: scripts: Makefile: update the lz4 command (#2) Conflicts: android/abi_gki_aarch64_qcom drivers/dma-buf/dma-buf.c kernel/trace/power-traces.c Change-Id: I9993aff20a659ab20af5f890f1f789cd4ef19246 Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org> |
||
Kishore Sri venkata Ganesh Bolisetty
|
f9478fd636 |
binder: update latency_sensitive flag for binder transactions
To minimize wake up latency for binder transactions, set low_latency flag. Change-Id: If103199fc96e35d90b0eaaf32da38ae135976658 Signed-off-by: Kishore Sri venkata Ganesh Bolisetty <bsrivenk@codeaurora.org> |
||
Todd Kjos
|
2e904b4388 |
ANDROID: fix copyright notice
New vendor hook files cite Google, Inc instead of Google LLC
Bug: 149632552
Fixes: 7f62740112ef ("ANDROID: add support for vendor hooks")
Signed-off-by: Todd Kjos <tkjos@google.com>
Change-Id: If42762c4bbe6d0a7ff1cc75b64a3b224902e121c
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
|
||
|
Todd Kjos
|
5965ee663d |
ANDROID: add support for vendor hooks
Add support for vendor hooks. Adds include/trace/hooks
directory for trace definition headers where hooks
can be defined and vendor_hook.c for instantiating
and exporting them for vendor modules.
There are two variants of vendor hooks, both based
on tracepoints:
Normal: this uses the DECLARE_HOOK macro
to create a tracepoint function with the name trace_<name>
where <name> is the unique identifier for the trace.
Restricted: restricted hooks are needed for cases like
scheduler hooks where the attached function must be
called even if the cpu is offline or requires a
non-atomic context. Restricted vendor hooks cannot
be detached, so modules that attach to a restricted
hook can never unload. Also, only 1 attachment is
allowed (any other attempts to attach will fail with
-EBUSY).
For either case, modules attach to the hook by using
register_trace_<name>(func_ptr, NULL).
New hooks should be defined in headers in the
include/trace/hooks/ directory using the
DECLARE_HOOK() or DECLARE_RESTRICTED_HOOK()
macros.
New files added to include/trace/hooks should
be #include'd from drivers/android/vendor_hooks.c.
The EXPORT_TRACEPOINT_SYMBOL_GPL() should be
also added to drivers/android/vendor_hooks.c.
For example, if a new hook, 'android_vh_foo(int &ret)'
is added in do_exit() in exit.c, these changes are
needed:
1. create a new header file include/trace/hooks/foo.h
which contains:
#include <trace/hooks/vendor_hooks.h>
...
DECLARE_HOOK(android_vh_foo,
TP_PROTO(int *retp),
TP_ARGS(retp);
2. in exit.c, add
#include <trace/hooks/foo.h>
...
int ret = 0;
...
android_vh_foo(&ret);
if (ret)
return ret;
...
3. in drivers/android/vendor_hooks.c, add
#include <trace/hooks/foo.h>
...
EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_foo);
The hook can then be attached by adding the registration code
to the module:
#include <trace/hooks/sched.h>
...
static void my_foo(int *retp)
{
*retp = 0;
}
...
rc = register_trace_android_vh_sched_exit(my_foo, NULL);
Bug: 156285741
Bug: 149632552
Signed-off-by: Todd Kjos <tkjos@google.com>
Change-Id: I6a7d1c8919dae91c965e2a0450df50eac2d282db
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
|
||
|
Todd Kjos
|
2274a7421e |
binder: fix null deref of proc->context
commit d35d3660e065b69fdb8bf512f3d899f350afce52 upstream.
The binder driver makes the assumption proc->context pointer is invariant after
initialization (as documented in the kerneldoc header for struct proc).
However, in commit f0fe2c0f050d ("binder: prevent UAF for binderfs devices II")
proc->context is set to NULL during binder_deferred_release().
Another proc was in the middle of setting up a transaction to the dying
process and crashed on a NULL pointer deref on "context" which is a local
set to &proc->context:
new_ref->data.desc = (node == context->binder_context_mgr_node) ? 0 : 1;
Here's the stack:
[ 5237.855435] Call trace:
[ 5237.855441] binder_get_ref_for_node_olocked+0x100/0x2ec
[ 5237.855446] binder_inc_ref_for_node+0x140/0x280
[ 5237.855451] binder_translate_binder+0x1d0/0x388
[ 5237.855456] binder_transaction+0x2228/0x3730
[ 5237.855461] binder_thread_write+0x640/0x25bc
[ 5237.855466] binder_ioctl_write_read+0xb0/0x464
[ 5237.855471] binder_ioctl+0x30c/0x96c
[ 5237.855477] do_vfs_ioctl+0x3e0/0x700
[ 5237.855482] __arm64_sys_ioctl+0x78/0xa4
[ 5237.855488] el0_svc_common+0xb4/0x194
[ 5237.855493] el0_svc_handler+0x74/0x98
[ 5237.855497] el0_svc+0x8/0xc
The fix is to move the kfree of the binder_device to binder_free_proc()
so the binder_device is freed when we know there are no references
remaining on the binder_proc.
Fixes: f0fe2c0f050d ("binder: prevent UAF for binderfs devices II")
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Todd Kjos <tkjos@google.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200622200715.114382-1-tkjos@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
|
Todd Kjos
|
6dfe047050 |
FROMGIT: binder: fix null deref of proc->context
The binder driver makes the assumption proc->context pointer is invariant after
initialization (as documented in the kerneldoc header for struct proc).
However, in commit f0fe2c0f050d ("binder: prevent UAF for binderfs devices II")
proc->context is set to NULL during binder_deferred_release().
Another proc was in the middle of setting up a transaction to the dying
process and crashed on a NULL pointer deref on "context" which is a local
set to &proc->context:
new_ref->data.desc = (node == context->binder_context_mgr_node) ? 0 : 1;
Here's the stack:
[ 5237.855435] Call trace:
[ 5237.855441] binder_get_ref_for_node_olocked+0x100/0x2ec
[ 5237.855446] binder_inc_ref_for_node+0x140/0x280
[ 5237.855451] binder_translate_binder+0x1d0/0x388
[ 5237.855456] binder_transaction+0x2228/0x3730
[ 5237.855461] binder_thread_write+0x640/0x25bc
[ 5237.855466] binder_ioctl_write_read+0xb0/0x464
[ 5237.855471] binder_ioctl+0x30c/0x96c
[ 5237.855477] do_vfs_ioctl+0x3e0/0x700
[ 5237.855482] __arm64_sys_ioctl+0x78/0xa4
[ 5237.855488] el0_svc_common+0xb4/0x194
[ 5237.855493] el0_svc_handler+0x74/0x98
[ 5237.855497] el0_svc+0x8/0xc
The fix is to move the kfree of the binder_device to binder_free_proc()
so the binder_device is freed when we know there are no references
remaining on the binder_proc.
Fixes: f0fe2c0f050d ("binder: prevent UAF for binderfs devices II")
Signed-off-by: Todd Kjos <tkjos@google.com>
(cherry picked from commit d35d3660e065b69fdb8bf512f3d899f350afce52
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git char-misc-linus)
Bug: 158252621
Git-commit:
|
||
|
Todd Kjos
|
bf0e4f96e4 |
FROMGIT: binder: fix null deref of proc->context
The binder driver makes the assumption proc->context pointer is invariant after
initialization (as documented in the kerneldoc header for struct proc).
However, in commit f0fe2c0f050d ("binder: prevent UAF for binderfs devices II")
proc->context is set to NULL during binder_deferred_release().
Another proc was in the middle of setting up a transaction to the dying
process and crashed on a NULL pointer deref on "context" which is a local
set to &proc->context:
new_ref->data.desc = (node == context->binder_context_mgr_node) ? 0 : 1;
Here's the stack:
[ 5237.855435] Call trace:
[ 5237.855441] binder_get_ref_for_node_olocked+0x100/0x2ec
[ 5237.855446] binder_inc_ref_for_node+0x140/0x280
[ 5237.855451] binder_translate_binder+0x1d0/0x388
[ 5237.855456] binder_transaction+0x2228/0x3730
[ 5237.855461] binder_thread_write+0x640/0x25bc
[ 5237.855466] binder_ioctl_write_read+0xb0/0x464
[ 5237.855471] binder_ioctl+0x30c/0x96c
[ 5237.855477] do_vfs_ioctl+0x3e0/0x700
[ 5237.855482] __arm64_sys_ioctl+0x78/0xa4
[ 5237.855488] el0_svc_common+0xb4/0x194
[ 5237.855493] el0_svc_handler+0x74/0x98
[ 5237.855497] el0_svc+0x8/0xc
The fix is to move the kfree of the binder_device to binder_free_proc()
so the binder_device is freed when we know there are no references
remaining on the binder_proc.
Fixes: f0fe2c0f050d ("binder: prevent UAF for binderfs devices II")
Signed-off-by: Todd Kjos <tkjos@google.com>
(cherry picked from commit d35d3660e065b69fdb8bf512f3d899f350afce52
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git char-misc-linus)
Bug: 158252621
Change-Id: Iee9547d58b85794af034b78eaab47075f3635f82
|
||
|
Blagovest Kolenichev
|
8ec8dcf3dd |
Merge android-5.4.30 (5cfdde5) into msm-5.4
* refs/heads/tmp-5cfdde5:
Revert "ANDROID: gki_defconfig: enabled UAPI header compile testing"
Linux 5.4.30
arm64: dts: ls1046ardb: set RGMII interfaces to RGMII_ID mode
arm64: dts: ls1043a-rdb: correct RGMII delay mode to rgmii-id
ARM: dts: sun8i: r40: Move AHCI device node based on address order
ARM: dts: N900: fix onenand timings
ARM: dts: imx6: phycore-som: fix arm and soc minimum voltage
ARM: bcm2835-rpi-zero-w: Add missing pinctrl name
ARM: dts: oxnas: Fix clear-mask property
perf map: Fix off by one in strncpy() size argument
arm64: alternative: fix build with clang integrated assembler
libceph: fix alloc_msg_with_page_vector() memory leaks
clk: ti: am43xx: Fix clock parent for RTC clock
clk: imx: Align imx sc clock parent msg structs to 4
clk: imx: Align imx sc clock msg structs to 4
net: ks8851-ml: Fix IO operations, again
gpiolib: acpi: Add quirk to ignore EC wakeups on HP x2 10 CHT + AXP288 model
bpf: Explicitly memset some bpf info structures declared on the stack
bpf: Explicitly memset the bpf_attr structure
platform/x86: pmc_atom: Add Lex 2I385SW to critclk_systems DMI table
vt: vt_ioctl: fix use-after-free in vt_in_use()
vt: vt_ioctl: fix VT_DISALLOCATE freeing in-use virtual console
vt: vt_ioctl: remove unnecessary console allocation checks
vt: switch vt_dont_switch to bool
vt: ioctl, switch VT_IS_IN_USE and VT_BUSY to inlines
vt: selection, introduce vc_is_sel
serial: sprd: Fix a dereference warning
mac80211: fix authentication with iwlwifi/mvm
mac80211: Check port authorization in the ieee80211_tx_dequeue() case
ANDROID: 5.4.29 ABI update
ANDROID: GKI: remove kernel_read/write from whitelists
ANDROID: GKI: Fix ABI for scsi/ufs patches
FROMGIT: scsi: ufs-qcom: Override devfreq parameters
BACKPORT: FROMGIT: scsi: ufshcd: Let vendor override devfreq parameters
FROMGIT: scsi: ufshcd: Update the set frequency to devfreq
FROMLIST: scsi: ufs: full reinit upon resume if link was off
FROMGIT: scsi: ufs: set device as active power mode after resetting device
FROMGIT: scsi: ufs: Enable block layer runtime PM for well-known logical units
UPSTREAM: scsi: ufs: Fix possible unclocked access to auto hibern8 timer register
ANDROID: db845c build: Use merge_configs
ANDROID: ABI/Whitelist: update whitelist of unisoc
Linux 5.4.29
net: Fix CONFIG_NET_CLS_ACT=n and CONFIG_NFT_FWD_NETDEV={y, m} build
media: v4l2-core: fix a use-after-free bug of sd->devnode
media: xirlink_cit: add missing descriptor sanity checks
media: stv06xx: add missing descriptor sanity checks
media: dib0700: fix rc endpoint lookup
media: ov519: add missing endpoint sanity checks
libfs: fix infoleak in simple_attr_read()
ahci: Add Intel Comet Lake H RAID PCI ID
staging: wlan-ng: fix use-after-free Read in hfa384x_usbin_callback
staging: wlan-ng: fix ODEBUG bug in prism2sta_disconnect_usb
staging: rtl8188eu: Add ASUS USB-N10 Nano B1 to device table
staging: kpc2000: prevent underflow in cpld_reconfigure()
media: usbtv: fix control-message timeouts
media: flexcop-usb: fix endpoint sanity check
usb: musb: fix crash with highmen PIO and usbmon
USB: serial: io_edgeport: fix slab-out-of-bounds read in edge_interrupt_callback
USB: cdc-acm: restore capability check order
USB: serial: option: add Wistron Neweb D19Q1
USB: serial: option: add BroadMobi BM806U
USB: serial: option: add support for ASKEY WWHC050
bpf: Undo incorrect __reg_bound_offset32 handling
clocksource/drivers/hyper-v: Untangle stimers and timesync from clocksources
r8169: fix PHY driver check on platforms w/o module softdeps
vti6: Fix memory leak of skb if input policy check fails
ARM: dts: sun8i-a83t-tbs-a711: Fix USB OTG mode detection
bpf, sockmap: Remove bucket->lock from sock_{hash|map}_free
bpf/btf: Fix BTF verification of enum members in struct/union
bpf: Initialize storage pointers to NULL to prevent freeing garbage pointer
bpf, x32: Fix bug with JMP32 JSET BPF_X checking upper bits
i2c: nvidia-gpu: Handle timeout correctly in gpu_i2c_check_status()
netfilter: nft_fwd_netdev: allow to redirect to ifb via ingress
netfilter: nft_fwd_netdev: validate family and chain type
netfilter: flowtable: reload ip{v6}h in nf_flow_tuple_ip{v6}
mac80211: set IEEE80211_TX_CTRL_PORT_CTRL_PROTO for nl80211 TX
ieee80211: fix HE SPR size calculation
afs: Fix unpinned address list during probing
afs: Fix some tracing details
afs: Fix client call Rx-phase signal handling
xfrm: policy: Fix doulbe free in xfrm_policy_timer
xfrm: add the missing verify_sec_ctx_len check in xfrm_add_acquire
xfrm: fix uctx len check in verify_sec_ctx_len
RDMA/mlx5: Block delay drop to unprivileged users
RDMA/mlx5: Fix access to wrong pointer while performing flush due to error
RDMA/mlx5: Fix the number of hwcounters of a dynamic counter
vti[6]: fix packet tx through bpf_redirect() in XinY cases
xfrm: handle NETDEV_UNREGISTER for xfrm device
genirq: Fix reference leaks on irq affinity notifiers
afs: Fix handling of an abort from a service handler
RDMA/core: Ensure security pkey modify is not lost
bpf: Fix cgroup ref leak in cgroup_bpf_inherit on out-of-memory
gpiolib: acpi: Add quirk to ignore EC wakeups on HP x2 10 BYT + AXP288 model
gpiolib: acpi: Rework honor_wakeup option into an ignore_wake option
gpiolib: acpi: Correct comment for HP x2 10 honor_wakeup quirk
mm: fork: fix kernel_stack memcg stats for various stack implementations
mm/sparse: fix kernel crash with pfn_section_valid check
drivers/base/memory.c: indicate all memory blocks as removable
mm/swapfile.c: move inode_lock out of claim_swapfile
mac80211: mark station unauthorized before key removal
mac80211: drop data frames without key on encrypted links
nl80211: fix NL80211_ATTR_CHANNEL_WIDTH attribute type
scsi: sd: Fix optimal I/O size for devices that change reported values
scripts/dtc: Remove redundant YYLOC global declaration
tools: Let O= makes handle a relative path with -C option
rtlwifi: rtl8188ee: Fix regression due to commit
|
||
|
Blagovest Kolenichev
|
4e2b270d2c |
Merge android-5.4.26 (0d3cca0c) into msm-5.4
* refs/heads/tmp-0d3cca0c:
UPSTREAM: driver core: Skip unnecessary work when device doesn't have sync_state()
Linux 5.4.26
net/smc: cancel event worker during device removal
net/smc: check for valid ib_client_data
ipv6: restrict IPV6_ADDRFORM operation
iommu/amd: Fix IOMMU AVIC not properly update the is_run bit in IRTE
i2c: acpi: put device when verifying client fails
iommu/vt-d: Ignore devices with out-of-spec domain number
iommu/vt-d: Fix the wrong printing in RHSA parsing
netfilter: nft_chain_nat: inet family is missing module ownership
netfilter: nf_tables: dump NFTA_CHAIN_FLAGS attribute
netfilter: nft_tunnel: add missing attribute validation for tunnels
netfilter: nft_payload: add missing attribute validation for payload csum flags
netfilter: cthelper: add missing attribute validation for cthelper
perf bench futex-wake: Restore thread count default to online CPU count
nl80211: add missing attribute validation for channel switch
nl80211: add missing attribute validation for beacon report scanning
nl80211: add missing attribute validation for critical protocol indication
i2c: gpio: suppress error on probe defer
iommu/vt-d: Fix RCU-list bugs in intel_iommu_init()
driver code: clarify and fix platform device DMA mask allocation
drm/i915/gvt: Fix unnecessary schedule timer when no vGPU exits
pinctrl: core: Remove extra kref_get which blocks hogs being freed
drm/i915/gvt: Fix dma-buf display blur issue on CFL
virtio_ring: Fix mem leak with vring_new_virtqueue()
pinctrl: imx: scu: Align imx sc msg structs to 4
pinctrl: meson-gxl: fix GPIOX sdio pins
clk: imx8mn: Fix incorrect clock defines
batman-adv: Don't schedule OGM for disabled interface
iommu/vt-d: Fix a bug in intel_iommu_iova_to_phys() for huge page
iommu/vt-d: Fix RCU list debugging warnings
iommu/vt-d: dmar: replace WARN_TAINT with pr_warn + add_taint
iommu/dma: Fix MSI reservation allocation
x86/mce: Fix logic and comments around MSR_PPIN_CTL
perf/amd/uncore: Replace manual sampling check with CAP_NO_INTERRUPT flag
mt76: fix array overflow on receiving too many fragments for a packet
i2c: designware-pci: Fix BUG_ON during device removal
efi: Add a sanity check to efivar_store_raw()
efi: Fix a race and a buffer overflow while reading efivars via sysfs
x86/ioremap: Map EFI runtime services data as encrypted for SEV
macintosh: windfarm: fix MODINFO regression
fscrypt: don't evict dirty inodes after removing key
blk-iocost: fix incorrect vtime comparison in iocg_is_idle()
ipmi_si: Avoid spurious errors for optional IRQs
s390/dasd: fix data corruption for thin provisioned devices
fuse: fix stack use after return
ARC: define __ALIGN_STR and __ALIGN symbols for ARC
KVM: nVMX: avoid NULL pointer dereference with incorrect EVMCS GPAs
KVM: x86: clear stale x86_emulate_ctxt->intercept value
gfs2_atomic_open(): fix O_EXCL|O_CREAT handling on cold dcache
cifs_atomic_open(): fix double-put on late allocation failure
ktest: Add timeout for ssh sync testing
pinctrl: falcon: fix syntax error
mmc: sdhci-pci-gli: Enable MSI interrupt for GL975x
drm/i915: Defer semaphore priority bumping to a workqueue
drm/i915: be more solid in checking the alignment
drm/amd/display: remove duplicated assignment to grph_obj_type
workqueue: don't use wq_select_unbound_cpu() for bound works
netfilter: x_tables: xt_mttg_seq_next should increase position index
netfilter: xt_recent: recent_seq_next should increase position index
netfilter: synproxy: synproxy_cpu_seq_next should increase position index
netfilter: nf_conntrack: ct_cpu_seq_next should increase position index
iommu/vt-d: quirk_ioat_snb_local_iommu: replace WARN_TAINT with pr_warn + add_taint
virtio-blk: fix hw_queue stopped on arbitrary error
iwlwifi: mvm: Do not require PHY_SKU NVM section for 3168 devices
netfilter: nf_tables: fix infinite loop when expr is not available
cgroup: Iterate tasks that did not finish do_exit()
cgroup: cgroup_procs_next should increase position index
net: phy: Avoid multiple suspends
net: dsa: Don't instantiate phylink for CPU/DSA ports unless needed
selftests/net/fib_tests: update addr_metric_test for peer route testing
net/ipv6: remove the old peer route if change it to a new one
net/ipv6: need update peer route when modify metric
net: phy: fix MDIO bus PM PHY resuming
net: phy: avoid clearing PHY interrupts twice in irq handler
nfc: add missing attribute validation for vendor subcommand
nfc: add missing attribute validation for deactivate target
nfc: add missing attribute validation for SE API
tipc: add missing attribute validation for MTU property
team: add missing attribute validation for array index
team: add missing attribute validation for port ifindex
net: taprio: add missing attribute validation for txtime delay
net: fq: add missing attribute validation for orphan mask
macsec: add missing attribute validation for port
can: add missing attribute validation for termination
nl802154: add missing attribute validation for dev_type
nl802154: add missing attribute validation
fib: add missing attribute validation for tun_id
devlink: validate length of region addr/len
devlink: validate length of param values
net: memcg: fix lockdep splat in inet_csk_accept()
net: memcg: late association of sock to memcg
cgroup: memcg: net: do not associate sock with unrelated cgroup
bnxt_en: fix error handling when flashing from file
bnxt_en: reinitialize IRQs when MTU is modified
bonding/alb: make sure arp header is pulled before accessing it
taprio: Fix sending packets without dequeueing them
slip: make slhc_compress() more robust against malicious packets
sfc: detach from cb_page in efx_copy_channel()
r8152: check disconnect status after long sleep
net: systemport: fix index check to avoid an array out of bounds access
net: stmmac: dwmac1000: Disable ACS if enhanced descs are not used
net: phy: bcm63xx: fix OOPS due to missing driver name
net/packet: tpacket_rcv: do not increment ring index on drop
net: nfc: fix bounds checking bugs on "pipe"
net: macsec: update SCI upon MAC address change.
netlink: Use netlink header as base to calculate bad attribute offset
net/ipv6: use configured metric when add peer route
net: hns3: fix a not link up issue when fibre port supports autoneg
net: fec: validate the new settings in fec_enet_set_coalesce()
net: dsa: mv88e6xxx: fix lockup on warm boot
net: dsa: fix phylink_start()/phylink_stop() calls
macvlan: add cond_resched() during multicast processing
ipvlan: don't deref eth hdr before checking it's set
ipvlan: do not use cond_resched_rcu() in ipvlan_process_multicast()
ipvlan: do not add hardware address of master to its unicast filter list
ipvlan: add cond_resched_rcu() while processing muticast backlog
ipv6/addrconf: call ipv6_mc_up() for non-Ethernet interface
inet_diag: return classid for all socket types
gre: fix uninit-value in __iptunnel_pull_header
cgroup, netclassid: periodically release file_lock on classid updating
ALSA: hda/realtek - Fixed one of HP ALC671 platform Headset Mic supported
ALSA: hda/realtek - Add Headset Mic supported for HP cPC
ALSA: hda/realtek - More constifications
virtio_balloon: Adjust label in virtballoon_probe
ANDROID: GKI: Revert "mm: unexport free_reserved_area"
ANDROID: Export functions to be used with dma_map_ops in modules
ANDROID: GKI: add android_kabi.h
ANDROID: GKI: update abi due to CONFIG_JUMP_LABEL being enabled
ANDROID: GKI: enable CONFIG_JUMP_LABEL
ANDROID: Add build.config.gki-debug.x86_64
ANDROID: update the abi signatures
ANDROID: Add build.config.gki-debug.aarch64
Revert "ANDROID: drm: edid: add support for additional CEA extension blocks"
Revert "ANDROID: drm: Parse Colorimetry data block from EDID"
ANDROID: Add build.config files for ARM 32-bit
ANDROID: Kconfig.gki: Add FRAME_VECTOR
UPSTREAM: cgroup: Iterate tasks that did not finish do_exit()
ANDROID: gki_defconfig: Enable more USB_CONFIGFS gadgets
Revert "ANDROID: tty: serdev: Fix broken serial console input"
ANDROID: serdev: restrict claim of platform devices
ANDROID: Add TPM support and the vTPM proxy to Cuttlefish.
FROMGIT: ASoC: sprd: Allow the MCDT driver to build into modules
FROMGIT: thermal: sprd: Add Spreadtrum thermal driver support
FROMGIT: dt-bindings: thermal: sprd: Add the Spreadtrum thermal documentation
ANDROID: ABI update due to power supply patches being merged
FROMGIT: pinctrl: sprd: Fix the kconfig warning
FROMGIT: pinctrl: sprd: Allow the SPRD pinctrl driver building into a module
FROMGIT: pinctrl: Export some needed symbols at module load time
FROMGIT: power: reset: sc27xx: Allow the SC27XX poweroff driver building into a module
FROMGIT: power: reset: sc27xx: Change to use cpu_down()
FROMGIT: power: reset: sc27xx: Power off the external subsystems' connection
FROMGIT: power: supply: sc27xx: Add POWER_SUPPLY_PROP_CHARGE_NOW attribute
UPSTREAM: power: supply: sc27xx: Calibrate the resistance of coulomb counter
UPSTREAM: dt-bindings: power: sc27xx: Add a new property to describe the real resistance of coulomb counter chip
UPSTREAM: power: supply: sc27xx: Optimize the battery resistance with measuring temperature
UPSTREAM: power: supply: core: Add battery internal resistance temperature table support
UPSTREAM: dt-bindings: power: Introduce one property to describe the battery resistance with temperature changes
ANDROID: abi_gki_aarch64_whitelist: update after whitelist changes
ANDROID: update abi_gki_aarch64_cuttlefish_whitelist
ANDROID: update abi_gki_aarch64_db845c_whitelist
ANDROID: update abi due to interconnect changes
UPSTREAM: interconnect: Handle memory allocation errors
UPSTREAM: interconnect: Add basic tracepoints
UPSTREAM: interconnect: Add a name to struct icc_path
UPSTREAM: interconnect: Move internal structs into a separate file
Linux 5.4.25
drm/virtio: module_param_named() requires linux/moduleparam.h
csky: Implement copy_thread_tls
block, bfq: remove ifdefs from around gets/puts of bfq groups
block, bfq: get a ref to a group when adding it to a service tree
efi: READ_ONCE rng seed size before munmap
efi/x86: Handle by-ref arguments covering multiple pages in mixed mode
efi/x86: Align GUIDs to their size in the mixed mode runtime wrapper
powerpc: fix hardware PMU exception bug on PowerVM compatibility mode systems
EDAC/synopsys: Do not print an error with back-to-back snprintf() calls
bus: ti-sysc: Fix 1-wire reset quirk
arm64: dts: meson: fix gxm-khadas-vim2 wifi
dmaengine: coh901318: Fix a double lock bug in dma_tc_handle()
dma-buf: free dmabuf->name in dma_buf_release()
hwmon: (adt7462) Fix an error return in ADT7462_REG_VOLT()
ARM: dts: imx7-colibri: Fix frequency for sd/mmc
ARM: dts: dra7xx-clocks: Fixup IPU1 mux clock parent source
ARM: dts: am437x-idk-evm: Fix incorrect OPP node names
ARM: imx: build v7_cpu_resume() unconditionally
IB/hfi1, qib: Ensure RCU is locked when accessing list
RMDA/cm: Fix missing ib_cm_destroy_id() in ib_cm_insert_listen()
regulator: stm32-vrefbuf: fix a possible overshoot when re-enabling
RDMA/core: Fix protection fault in ib_mr_pool_destroy
RDMA/iwcm: Fix iwcm work deallocation
RDMA/siw: Fix failure handling during device creation
RDMA/nldev: Fix crash when set a QP to a new counter but QPN is missing
RDMA/rw: Fix error flow during RDMA context initialization
Revert "RDMA/cma: Simplify rdma_resolve_addr() error flow"
soc: imx-scu: Align imx sc msg structs to 4
firmware: imx: Align imx_sc_msg_req_cpu_start to 4
firmware: imx: scu-pd: Align imx sc msg structs to 4
firmware: imx: misc: Align imx sc msg structs to 4
arm64: dts: imx8qxp-mek: Remove unexisting Ethernet PHY
ARM: dts: imx6: phycore-som: fix emmc supply
phy: mapphone-mdm6600: Fix write timeouts with shorter GPIO toggle interval
phy: mapphone-mdm6600: Fix timeouts by adding wake-up handling
drm/i915/selftests: Fix return in assert_mmap_offset()
drm/i915: Program MBUS with rmw during initialization
drm/sun4i: de2/de3: Remove unsupported VI layer formats
drm/sun4i: Fix DE2 VI layer format support
drm/sun4i: Add separate DE3 VI layer formats
drm: kirin: Revert "Fix for hikey620 display offset problem"
drm/panfrost: Don't try to map on error faults
spi: atmel-quadspi: fix possible MMIO window size overrun
ASoC: dapm: Correct DAPM handling of active widgets during shutdown
ASoC: Intel: Skylake: Fix available clock counter incrementation
ASoC: pcm512x: Fix unbalanced regulator enable call in probe error path
ASoC: pcm: Fix possible buffer overflow in dpcm state sysfs output
powerpc/mm: Fix missing KUAP disable in flush_coherent_icache()
powerpc: Convert flush_icache_range & friends to C
powerpc: define helpers to get L1 icache sizes
ASoC: intel: skl: Fix possible buffer overflow in debug outputs
ASoC: intel: skl: Fix pin debug prints
ASoC: SOF: Fix snd_sof_ipc_stream_posn()
ASoC: topology: Fix memleak in soc_tplg_manifest_load()
ASoC: topology: Fix memleak in soc_tplg_link_elems_load()
drm/virtio: fix resource id creation race
drm/virtio: make resource id workaround runtime switchable.
spi: bcm63xx-hsspi: Really keep pll clk enabled
ARM: dts: ls1021a: Restore MDIO compatible to gianfar
arm64: dts: meson-sm1-sei610: add missing interrupt-names
dm: fix congested_fn for request-based device
dm zoned: Fix reference counter initial value of chunk works
dm writecache: verify watermark during resume
dm: report suspended device during destroy
dm cache: fix a crash due to incorrect work item cancelling
dm integrity: fix invalid table returned due to argument count mismatch
dm integrity: fix a deadlock due to offloading to an incorrect workqueue
dm integrity: fix recalculation when moving from journal mode to bitmap mode
dmaengine: tegra-apb: Prevent race conditions of tasklet vs free list
dmaengine: tegra-apb: Fix use-after-free
dmaengine: imx-sdma: Fix the event id check to include RX event for UART6
dmaengine: imx-sdma: fix context cache
s390/mm: fix panic in gup_fast on large pud
s390/pci: Fix unexpected write combine on resource
x86/pkeys: Manually set X86_FEATURE_OSPKE to preserve existing changes
spi: spidev: Fix CS polarity if GPIO descriptors are used
perf arm-spe: Fix endless record after being terminated
perf cs-etm: Fix endless record after being terminated
perf intel-bts: Fix endless record after being terminated
perf intel-pt: Fix endless record after being terminated
media: v4l2-mem2mem.c: fix broken links
media: vicodec: process all 4 components for RGB32 formats
media: mc-entity.c: use & to check pad flags, not ==
media: hantro: Fix broken media controller links
vt: selection, push sel_lock up
vt: selection, push console lock down
vt: selection, close sel_buffer race
serial: 8250_exar: add support for ACCES cards
tty: serial: fsl_lpuart: free IDs allocated by IDA
tty:serial:mvebu-uart:fix a wrong return
arm: dts: dra76x: Fix mmc3 max-frequency
arm64: dts: socfpga: agilex: Fix gmac compatible
btrfs: fix RAID direct I/O reads with alternate csums
fat: fix uninit-memory access for partial initialized inode
mm, hotplug: fix page online with DEBUG_PAGEALLOC compiled but not enabled
mm: fix possible PMD dirty bit lost in set_pmd_migration_entry()
mm, numa: fix bad pmd by atomically check for pmd_trans_huge when marking page tables prot_numa
vgacon: Fix a UAF in vgacon_invert_region
usb: core: port: do error out if usb_autopm_get_interface() fails
usb: core: hub: do error out if usb_autopm_get_interface() fails
usb: core: hub: fix unhandled return by employing a void function
usb: cdns3: gadget: toggle cycle bit before reset endpoint
usb: cdns3: gadget: link trb should point to next request
usb: dwc3: gadget: Update chain bit correctly when using sg list
usb: quirks: add NO_LPM quirk for Logitech Screen Share
usb: storage: Add quirk for Samsung Fit flash
cifs: fix rename() by ensuring source handle opened with DELETE bit
cifs: don't leak -EAGAIN for stat() during reconnect
ALSA: hda/realtek - Enable the headset of ASUS B9450FA with ALC294
ALSA: hda/realtek - Fix silent output on Gigabyte X570 Aorus Master
ALSA: hda/realtek - Add Headset Button supported for ThinkPad X1
ALSA: hda/realtek - Add Headset Mic supported
binder: prevent UAF for binderfs devices II
binder: prevent UAF for binderfs devices
firmware: imx: scu: Ensure sequential TX
selftests: forwarding: vxlan_bridge_1d: use more proper tos value
arch/csky: fix some Kconfig typos
csky: Fixup compile warning for three unimplemented syscalls
csky: Fixup ftrace modify panic
csky/smp: Fixup boot failed when CONFIG_SMP
csky: Set regs->usp to kernel sp, when the exception is from kernel
csky/mm: Fixup export invalid_pte_table symbol
net: thunderx: workaround BGX TX Underflow issue
x86/xen: Distribute switch variables for initialization
ice: Don't tell the OS that link is going down
nvme: Fix uninitialized-variable warning
s390/qdio: fill SL with absolute addresses
x86/boot/compressed: Don't declare __force_order in kaslr_64.c
nvme-pci: Use single IRQ vector for old Apple models
nvme/pci: Add sleep quirk for Samsung and Toshiba drives
iommu/amd: Disable IOMMU on Stoney Ridge systems
net/mlx5: DR, Fix matching on vport gvmi
efi: Only print errors about failing to get certs if EFI vars are found
s390: make 'install' not depend on vmlinux
s390/cio: cio_ignore_proc_seq_next should increase position index
watchdog: da9062: do not ping the hw during stop()
net: ethernet: dm9000: Handle -EPROBE_DEFER in dm9000_parse_dt()
net: ks8851-ml: Fix 16-bit IO operation
net: ks8851-ml: Fix 16-bit data access
net: ks8851-ml: Remove 8-bit bus accessors
net: atlantic: check rpc result and wait for rpc address
selftests: forwarding: vxlan_bridge_1d: fix tos value
selftests: forwarding: use proto icmp for {gretap, ip6gretap}_mac testing
drm/msm/dsi/pll: call vco set rate explicitly
drm/msm/dsi: save pll state before dsi host is powered off
scsi: megaraid_sas: silence a warning
drm/modes: Allow DRM_MODE_ROTATE_0 when applying video mode parameters
drm/modes: Make sure to parse valid rotation value from cmdline
drm: msm: Fix return type of dsi_mgr_connector_mode_valid for kCFI
drm/msm/mdp5: rate limit pp done timeout warnings
habanalabs: patched cb equals user cb in device memset
habanalabs: do not halt CoreSight during hard reset
habanalabs: halt the engines before hard-reset
usb: gadget: serial: fix Tx stall after buffer overflow
usb: gadget: ffs: ffs_aio_cancel(): Save/restore IRQ flags
usb: gadget: composite: Support more than 500mA MaxPower
selftests: fix too long argument
serial: ar933x_uart: set UART_CS_{RX,TX}_READY_ORIDE
ALSA: hda: do not override bus codec_mask in link_get()
blktrace: fix dereference after null check
kprobes: Fix optimize_kprobe()/unoptimize_kprobe() cancellation logic
kbuild: fix 'No such file or directory' warning when cleaning
RDMA/core: Fix use of logical OR in get_new_pps
RDMA/core: Fix pkey and port assignment in get_new_pps
dm thin metadata: fix lockdep complaint
net: stmmac: fix notifier registration
net: dsa: bcm_sf2: Forcibly configure IMP port for 1Gb/sec
ALSA: hda/realtek - Fix a regression for mute led on Lenovo Carbon X1
block, bfq: do not insert oom queue into position tree
block, bfq: get extra ref to prevent a queue from being freed during a group move
FROMGIT: kallsyms: unexport kallsyms_lookup_name() and kallsyms_on_each_symbol()
FROMGIT: samples/hw_breakpoint: drop use of kallsyms_lookup_name()
FROMGIT: samples/hw_breakpoint: drop HW_BREAKPOINT_R when reporting writes
UPSTREAM: fscrypt: don't evict dirty inodes after removing key
ANDROID: ABI/Whitelist: update whitelist of unisoc upstream code
ANDROID: gki_defconfig: Enable CONFIG_VM_EVENT_COUNTERS
ANDROID: gki_defconfig: Enable CONFIG_CLEANCACHE
ANDROID: arm64: update the abi with the new gki_defconfig
ANDROID: gki_defconfig: disable CONFIG_DEBUG_DEVRES
ANDROID: Update the abi xml file
ANDROID: GKI: arm64: reserve space in cpu_hwcaps and cpu_hwcap_keys arrays
FROMGIT: power: supply: Allow charger manager can be built as a module
ANDROID: arm64: gki_defconfig: disable CONFIG_DEBUG_PREEMPT
ANDROID: iommu/iova: Fix to use __alloc_and_insert_iova_best_fit
ANDROID: enable CONFIG_WATCHDOG_CORE=y
ANDROID: kbuild: align UNUSED_KSYMS_WHITELIST with upstream
FROMLIST: f2fs: fix wrong check on F2FS_IOC_FSSETXATTR
ANDROID: gki_defconfig: enable CONFIG_TYPEC
UPSTREAM: scsi: ufs: ufs-mediatek: add waiting time for reference clock
UPSTREAM: scsi: ufs: introduce common function to disable host TX LCC
UPSTREAM: scsi: ufs: ufs-mediatek: fix TX LCC disabling timing
UPSTREAM: scsi: ufs: ufs-mediatek: gate ref-clk during Auto-Hibern8
UPSTREAM: scsi: ufs: fix Auto-Hibern8 error detection
UPSTREAM: scsi: ufs: ufs-mediatek: support linkoff state during suspend
UPSTREAM: scsi: ufs: ufs-mediatek: ensure UniPro is not powered down before linkup
UPSTREAM: scsi: ufs: Move ufshcd_get_max_pwr_mode() to ufshcd_device_params_init()
BACKPORT: scsi: ufs: Split ufshcd_probe_hba() based on its called flow
FROMGIT: driver core: Reevaluate dev->links.need_for_probe as suppliers are added
FROMGIT: driver core: Call sync_state() even if supplier has no consumers
ANDROID: cpufreq: times: Remove per-UID time in state tracking
Revert "ANDROID: proc: Add /proc/uid directory"
Revert "ANDROID: cpufreq: Add time_in_state to /proc/uid directories"
ANDROID: cpufreq: times: Remove /proc/uid_concurrent_{active,policy}_time
ANDROID: drm: Add support for DP 1.4 Compliance edid corruption test
Revert "ANDROID: drm: Add support for DP 1.4 Compliance edid corruption test"
ANDROID: staging: ion: Add an in-kernel interface to request heap info.
FROMLIST: lib: test_stackinit.c: XFAIL switch variable init tests
UPSTREAM: scsi: ufs: Abort gating if clock on request is pending
UPSTREAM: scsi: ufs: Fix irq return code
UPSTREAM: scsi: ufs: Fix register dump caused sleep in atomic context
UPSTREAM: scsi: ufs-qcom: Add reset control support for host controller
UPSTREAM: scsi: ufs: Add device reset in link recovery path
FROMGIT: scsi: ufs-qcom: Delay specific time before gate ref clk
BACKPORT: FROMGIT: scsi: ufs: Add dev ref clock gating wait time support
Revert "FROMLIST: scsi: ufs: Add dev ref clock gating wait time support"
FROMGIT: scsi: ufs-qcom: Adjust bus bandwidth voting and unvoting
Revert "FROMLIST: scsi: ufs-qcom: Adjust bus bandwidth voting and unvoting"
ANDROID: CC_FLAGS_CFI add -fno-sanitize-blacklist
Conflicts:
Documentation/devicetree/bindings
Documentation/devicetree/bindings/power/supply/battery.txt
Documentation/devicetree/bindings/power/supply/sc27xx-fg.txt
drivers/dma-buf/dma-buf.c
drivers/interconnect/core.c
drivers/interconnect/internal.h
drivers/scsi/ufs/ufs-qcom.c
drivers/scsi/ufs/ufs-qcom.h
drivers/scsi/ufs/ufshcd.h
drivers/thermal/Makefile
drivers/usb/dwc3/gadget.c
drivers/usb/gadget/composite.c
drivers/usb/gadget/function/f_fs.c
scripts/gen_autoksyms.sh
Change-Id: Ic3227858328ceef3f34273428d1c4f81b78757b2
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
|
||
|
Blagovest Kolenichev
|
2e72d8932e |
Merge android-5.4.24 (ce5de62) into msm-5.4
* refs/heads/tmp-ce5de62:
Revert "BACKPORT: tracing: Remove unnecessary DEBUG_FS dependency"
Linux 5.4.24
blktrace: Protect q->blk_trace with RCU
kvm: nVMX: VMWRITE checks unsupported field before read-only field
kvm: nVMX: VMWRITE checks VMCS-link pointer before VMCS field
mm, thp: fix defrag setting if newline is not used
mm/huge_memory.c: use head to check huge zero page
mm/gup: allow FOLL_FORCE for get_user_pages_fast()
mm/debug.c: always print flags in dump_page()
locking/lockdep: Fix lockdep_stats indentation problem
xfs: clear kernel only flags in XFS_IOC_ATTRMULTI_BY_HANDLE
bus: tegra-aconnect: Remove PM_CLK dependency
netfilter: nf_flowtable: fix documentation
netfilter: nft_tunnel: no need to call htons() when dumping ports
thermal: brcmstb_thermal: Do not use DT coefficients
thermal: db8500: Depromote debug print
ubifs: Fix ino_t format warnings in orphan_delete()
rcu: Allow only one expedited GP to run concurrently with wakeups
KVM: x86: Remove spurious clearing of async #PF MSR
KVM: x86: Remove spurious kvm_mmu_unload() from vcpu destruction path
x86/resctrl: Check monitoring static key in the MBM overflow handler
perf ui gtk: Add missing zalloc object
perf hists browser: Restore ESC as "Zoom out" of DSO/thread/etc
pwm: omap-dmtimer: put_device() after of_find_device_by_node()
lib/vdso: Update coarse timekeeper unconditionally
lib/vdso: Make __arch_update_vdso_data() logic understandable
kprobes: Set unoptimized flag after unoptimizing code
ima: ima/lsm policy rule loading logic bug fixes
drivers: net: xgene: Fix the order of the arguments of 'alloc_etherdev_mqs()'
RDMA/hns: Bugfix for posting a wqe with sge
RDMA/hns: Simplify the calculation and usage of wqe idx for post verbs
f2fs: fix to add swap extent correctly
sched/fair: Optimize select_idle_cpu
KVM: Check for a bad hva before dropping into the ghc slow path
KVM: SVM: Override default MMIO mask if memory encryption is enabled
mwifiex: delete unused mwifiex_get_intf_num()
mwifiex: drop most magic numbers from mwifiex_process_tdls_action_frame()
namei: only return -ECHILD from follow_dotdot_rcu()
kbuild: make single target builds even faster
kbuild: remove unneeded variable, single-all
kbuild: move headers_check rule to usr/include/Makefile
kbuild: remove header compile test
selftests: Install settings files to fix TIMEOUT failures
net: ena: make ena rxfh support ETH_RSS_HASH_NO_CHANGE
net/smc: no peer ID in CLC decline for SMCD
net: atlantic: fix out of range usage of active_vlans array
net: atlantic: fix potential error handling
net: atlantic: fix use after free kasan warn
net: netlink: cap max groups which will be considered in netlink_bind()
s390/qeth: vnicc Fix EOPNOTSUPP precedence
nvme-pci: Hold cq_poll_lock while completing CQEs
usb: charger: assign specific number for enum value
hv_netvsc: Fix unwanted wakeup in netvsc_attach()
kbuild: fix DT binding schema rule to detect command line changes
mac80211: Remove a redundant mutex unlock
nl80211: fix potential leak in AP start
drm/i915/gvt: Separate display reset from ALL_ENGINES reset
drm/i915/gvt: Fix orphan vgpu dmabuf_objs' lifetime
i2c: jz4780: silence log flood on txabrt
i2c: altera: Fix potential integer overflow
MIPS: VPE: Fix a double free and a memory leak in 'release_vpe()'
HID: hiddev: Fix race in in hiddev_disconnect()
HID: alps: Fix an error handling path in 'alps_input_configured()'
netfilter: xt_hashlimit: reduce hashlimit_mutex scope for htable_put()
netfilter: ipset: Fix forceadd evaluation path
vhost: Check docket sk_family instead of call getname
net/smc: transfer fasync_list in case of fallback
netfilter: ipset: Fix "INFO: rcu detected stall in hash_xxx" reports
io_uring: fix 32-bit compatability with sendmsg/recvmsg
cpufreq: Fix policy initialization for internal governor drivers
amdgpu/gmc_v9: save/restore sdpif regs during S3
Revert "PM / devfreq: Modify the device name as devfreq(X) for sysfs"
tracing: Disable trace_printk() on post poned tests
macintosh: therm_windtunnel: fix regression when instantiating devices
drm/radeon: Inline drm_get_pci_dev
drm/amdgpu: Drop DRIVER_USE_AGP
HID: core: increase HID report buffer size to 8KiB
HID: core: fix off-by-one memset in hid_report_raw_event()
HID: ite: Only bind to keyboard USB interface on Acer SW5-012 keyboard dock
KVM: VMX: check descriptor table exits on instruction emulation
ACPI: watchdog: Fix gas->access_width usage
ACPICA: Introduce ACPI_ACCESS_BYTE_WIDTH() macro
audit: always check the netlink payload length in audit_receive_msg()
audit: fix error handling in audit_data_to_entry()
ext4: potential crash on allocation error in ext4_alloc_flex_bg_array()
nvme/pci: move cqe check after device shutdown
nvme: prevent warning triggered by nvme_stop_keep_alive
nvme/tcp: fix bug on double requeue when send fails
net: hns3: fix a copying IPv6 address error in hclge_fd_get_flow_tuples()
net: hns3: add management table after IMP reset
mac80211: fix wrong 160/80+80 MHz setting
cfg80211: add missing policy for NL80211_ATTR_STATUS_CODE
cifs: Fix mode output in debugging statements
ice: update Unit Load Status bitmask to check after reset
net: ena: ena-com.c: prevent NULL pointer dereference
net: ena: ethtool: use correct value for crc32 hash
net: ena: fix corruption of dev_idx_to_host_tbl
net: ena: fix incorrectly saving queue numbers when setting RSS indirection table
net: ena: rss: store hash function as values and not bits
net: ena: rss: fix failure to get indirection table
net: ena: rss: do not allocate key when not supported
net: ena: fix incorrect default RSS key
net: ena: add missing ethtool TX timestamping indication
net: ena: fix uses of round_jiffies()
net: ena: fix potential crash when rxfh key is NULL
i40e: Fix the conditional for i40e_vc_validate_vqs_bitmaps
soc/tegra: fuse: Fix build with Tegra194 configuration
amdgpu: Prevent build errors regarding soft/hard-float FP ABI tags
drm/amd/display: Add initialitions for PLL2 clock source
drm/amd/display: Limit minimum DPPCLK to 100MHz.
drm/amd/display: Check engine is not NULL before acquiring
RDMA/siw: Remove unwanted WARN_ON in siw_cm_llp_data_ready()
drm/amd/display: Do not set optimized_require to false after plane disable
ARM: dts: sti: fixup sound frame-inversion for stihxxx-b2120.dtsi
ceph: do not execute direct write in parallel if O_APPEND is specified
perf/x86/msr: Add Tremont support
perf/x86/cstate: Add Tremont support
perf/x86/intel: Add Elkhart Lake support
perf/smmuv3: Use platform_get_irq_optional() for wired interrupt
NFSv4: Fix races between open and dentry revalidation
qmi_wwan: unconditionally reject 2 ep interfaces
qmi_wwan: re-add DW5821e pre-production variant
s390/zcrypt: fix card and queue total counter wrap
cfg80211: check wiphy driver existence for drvinfo report
mac80211: consider more elements in parsing CRC
dax: pass NOWAIT flag to iomap_apply
sched/fair: Prevent unlimited runtime on throttled group
timers/nohz: Update NOHZ load in remote tick
sched/core: Don't skip remote tick for idle CPUs
drm/msm: Set dma maximum segment size for mdss
ipmi:ssif: Handle a possible NULL pointer reference
ipv6: Fix nlmsg_flags when splitting a multipath route
ipv6: Fix route replacement with dev-only route
bonding: fix lockdep warning in bond_get_stats()
net: export netdev_next_lower_dev_rcu()
bonding: add missing netdev_update_lockdep_key()
bnxt_en: Issue PCIe FLR in kdump kernel to cleanup pending DMAs.
bnxt_en: Improve device shutdown method.
sctp: move the format error check out of __sctp_sf_do_9_1_abort
udp: rehash on disconnect
Revert "net: dev: introduce support for sch BYPASS for lockless qdisc"
qede: Fix race between rdma destroy workqueue and link change event
nfc: pn544: Fix occasional HW initialization failure
net/tls: Fix to avoid gettig invalid tls record
net: sched: correct flower port blocking
net: phy: restore mdio regs in the iproc mdio driver
net: mscc: fix in frame extraction
net: macb: ensure interface is not suspended on at91rm9200
net: fib_rules: Correctly set table field when table number exceeds 8 bits
net: dsa: b53: Ensure the default VID is untagged
EDAC: skx_common: downgrade message importance on missing PCI device
io_uring: grab ->fs as part of async offload
ANDROID: abi_gki_aarch64_whitelist: add module_layout and task_struct
ANDROID: gki_defconfig: disable KPROBES, update ABI
FROMGIT: scsi: ufs: Select INITIAL ADAPT type for HS Gear4
FROMLIST: scsi: ufs: Use ufshcd_config_pwr_mode() when scale gear
FROMGIT: scsi: ufs-qcom: Apply QUIRK_HOST_TACTIVATE for WDC UFS devices
FROMGIT: scsi: ufs: Allow vendor device quirks to be applied early
BACKPORT: scsi: ufs: Delete struct ufs_dev_desc
ANDROID: gki_defconfig: enable IOMMU_LIMIT_IOVA_ALIGNMENT
FROMLIST: iommu/iova: Support limiting IOVA alignment
FROMLIST: iommu/iova: Add a best-fit algorithm
FROMLIST: iommu/dma: Allow drivers to reserve an iova range
ANDROID: Unconditionally create bridge tracepoints
ANDROID: gki_defconfig: Enable MFD_SYSCON on x86
ANDROID: update ABI for CONFIG_IIO_* changes
ANDROID: gki_defconfig: add CONFIG_IIO_BUFFER and CONFIG_IIO_TRIGGER
ANDROID: gki: set CONFIG_SERIAL_SPRD_CONSOLE for earlycon
ANDROID: Re-add default y for VIRTIO_PCI_LEGACY
ANDROID: GKI: build in HVC_DRIVER
ANDROID: Removed default m for virtual sw crypto device
ANDROID: Remove default y on BRIDGE_IGMP_SNOOPING
ANDROID: GKI: Added missing SND configs
ANDROID: scsi: ufs: allow ufs variants to override sg entry size
ANDROID: GKI: Remove CONFIG_BRIDGE from arm64 config
ANDROID: Enable HID_NINTENDO as y
FROMLIST: HID: nintendo: add nintendo switch controller driver
UPSTREAM: iommu/arm-smmu: Restore naming of driver parameter prefix
ANDROID: gki_defconfig: Remove 'BRIDGE_NETFILTER is not set'
UPSTREAM: net: disable BRIDGE_NETFILTER by default
Linux 5.4.23
ASoC: SOF: Intel: hda: Add iDisp4 DAI
bpf: Selftests build error in sockmap_basic.c
s390/mm: Explicitly compare PAGE_DEFAULT_KEY against zero in storage_key_init_range
s390/kaslr: Fix casts in get_random
net/mlx5e: Fix crash in recovery flow without devlink reporter
net/mlx5: Fix sleep while atomic in mlx5_eswitch_get_vepa
net/mlx5e: Reset RQ doorbell counter before moving RQ state from RST to RDY
xen: Enable interrupts when calling _cond_resched()
ata: ahci: Add shutdown to freeze hardware resources of ahci
io_uring: prevent sq_thread from spinning when it should stop
rxrpc: Fix call RCU cleanup using non-bh-safe locks
netfilter: xt_hashlimit: limit the max size of hashtable
ALSA: seq: Fix concurrent access to queue current tick/time
ALSA: seq: Avoid concurrent access to queue flags
ALSA: rawmidi: Avoid bit fields for state flags
io_uring: fix __io_iopoll_check deadlock in io_sq_thread
arm64: lse: Fix LSE atomics with LLVM
bpf, offload: Replace bitwise AND by logical AND in bpf_prog_offload_info_fill
genirq/proc: Reject invalid affinity masks (again)
crypto: rename sm3-256 to sm3 in hash_algo_name
iommu/vt-d: Fix compile warning from intel-svm.h
ecryptfs: replace BUG_ON with error handling code
ASoC: fsl_sai: Fix exiting path on probing failure
ASoC: atmel: fix atmel_ssc_set_audio link failure
staging: greybus: use after free in gb_audio_manager_remove_all()
staging: rtl8723bs: fix copy of overlapping memory
usb: dwc2: Fix in ISOC request length checking
usb: gadget: composite: Fix bMaxPower for SuperSpeedPlus
scsi: Revert "target: iscsi: Wait for all commands to finish before freeing a session"
scsi: Revert "RDMA/isert: Fix a recently introduced regression related to logout"
drm/msm/dpu: fix BGR565 vs RGB565 confusion
drm/i915/gt: Protect defer_request() from new waiters
drm/bridge: tc358767: fix poll timeouts
drm/i915/gvt: more locking for ppgtt mm LRU list
drm/i915/execlists: Always force a context reload when rewinding RING_TAIL
drm/i915/gt: Detect if we miss WaIdleLiteRestore
Revert "dmaengine: imx-sdma: Fix memory leak"
Btrfs: fix deadlock during fast fsync when logging prealloc extents beyond eof
btrfs: don't set path->leave_spinning for truncate
Btrfs: fix race between shrinking truncate and fiemap
Btrfs: fix btrfs_wait_ordered_range() so that it waits for all ordered extents
btrfs: do not check delayed items are empty for single transaction cleanup
btrfs: reset fs_root to NULL on error in open_ctree
btrfs: fix bytes_may_use underflow in prealloc error condtition
btrfs: destroy qgroup extent records on transaction abort
KVM: apic: avoid calculating pending eoi from an uninitialized val
KVM: nVMX: handle nested posted interrupts when apicv is disabled for L1
KVM: nVMX: clear PIN_BASED_POSTED_INTR from nested pinbased_ctls only when apicv is globally disabled
KVM: nVMX: Check IO instruction VM-exit conditions
KVM: nVMX: Refactor IO bitmap checks into helper function
ext4: fix race between writepages and enabling EXT4_EXTENTS_FL
ext4: rename s_journal_flag_rwsem to s_writepages_rwsem
ext4: fix mount failure with quota configured as module
ext4: fix potential race between s_flex_groups online resizing and access
ext4: fix potential race between s_group_info online resizing and access
ext4: fix potential race between online resizing and write operations
ext4: add cond_resched() to __ext4_find_entry()
ext4: fix a data race in EXT4_I(inode)->i_disksize
KVM: x86: don't notify userspace IOAPIC on edge-triggered interrupt EOI
KVM: nVMX: Don't emulate instructions in guest mode
sched/psi: Fix OOB write when writing 0 bytes to PSI files
drm/i915: Update drm/i915 bug filing URL
drm/i915: Wean off drm_pci_alloc/drm_pci_free
drm/nouveau/kms/gv100-: Re-set LUT after clearing for modesets
drm/amdgpu/gfx10: disable gfxoff when reading rlc clock
drm/amdgpu/gfx9: disable gfxoff when reading rlc clock
drm/amdgpu/soc15: fix xclk for raven
mm: Avoid creating virtual address aliases in brk()/mmap()/mremap()
lib/stackdepot.c: fix global out-of-bounds in stack_slabs
mm/sparsemem: pfn_to_page is not valid yet on SPARSEMEM
mm/vmscan.c: don't round up scan size for online memory cgroup
genirq/irqdomain: Make sure all irq domain flags are distinct
nvme-multipath: Fix memory leak with ana_log_buf
mm/memcontrol.c: lost css_put in memcg_expand_shrinker_maps()
Revert "ipc,sem: remove uneeded sem_undo_list lock usage in exit_sem()"
ACPI: PM: s2idle: Check fixed wakeup events in acpi_s2idle_wake()
MAINTAINERS: Update drm/i915 bug filing URL
serdev: ttyport: restore client ops on deregistration
tty: serial: qcom_geni_serial: Fix RX cancel command failure
tty: serial: imx: setup the correct sg entry for tx dma
tty/serial: atmel: manage shutdown in case of RS485 or ISO7816 mode
serial: 8250: Check UPF_IRQ_SHARED in advance
x86/cpu/amd: Enable the fixed Instructions Retired counter IRPERF
x86/mce/amd: Fix kobject lifetime
x86/mce/amd: Publish the bank pointer only after setup has succeeded
x86/ima: use correct identifier for SetupMode variable
jbd2: fix ocfs2 corrupt when clearing block group bits
arm64: memory: Add missing brackets to untagged_addr() macro
powerpc/hugetlb: Fix 8M hugepages on 8xx
powerpc/hugetlb: Fix 512k hugepages on 8xx with 16k page size
powerpc/entry: Fix an #if which should be an #ifdef in entry_32.S
powerpc/tm: Fix clearing MSR[TS] in current when reclaiming on signal delivery
powerpc/eeh: Fix deadlock handling dead PHB
powerpc/8xx: Fix clearing of bits 20-23 in ITLB miss
drm/panfrost: perfcnt: Reserve/use the AS attached to the perfcnt MMU context
staging: rtl8723bs: Fix potential overuse of kernel memory
staging: rtl8723bs: Fix potential security hole
staging: rtl8188eu: Fix potential overuse of kernel memory
staging: rtl8188eu: Fix potential security hole
scsi: Revert "target/core: Inline transport_lun_remove_cmd()"
usb: dwc3: debug: fix string position formatting mixup with ret and len
usb: dwc3: gadget: Check for IOC/LST bit in TRB->ctrl fields
usb: dwc2: Fix SET/CLEAR_FEATURE and GET_STATUS flows
USB: hub: Fix the broken detection of USB3 device in SMSC hub
USB: hub: Don't record a connect-change event during reset-resume
USB: Fix novation SourceControl XL after suspend
usb: uas: fix a plug & unplug racing
USB: quirks: blacklist duplicate ep on Sound Devices USBPre2
USB: core: add endpoint-blacklist quirk
usb: host: xhci: update event ring dequeue pointer on purpose
xhci: Fix memory leak when caching protocol extended capability PSI tables - take 2
xhci: apply XHCI_PME_STUCK_QUIRK to Intel Comet Lake platforms
xhci: fix runtime pm enabling for quirky Intel hosts
xhci: Force Maximum Packet size for Full-speed bulk devices to valid range.
staging: vt6656: fix sign of rx_dbm to bb_pre_ed_rssi.
staging: android: ashmem: Disallow ashmem memory from being remapped
vt: vt_ioctl: fix race in VT_RESIZEX
vt: selection, handle pending signals in paste_selection
vt: fix scrollback flushing on background consoles
floppy: check FDC index for errors before assigning it
e1000e: Use rtnl_lock to prevent race conditions between net and pci/pm
USB: misc: iowarrior: add support for the 100 device
USB: misc: iowarrior: add support for the 28 and 28L devices
USB: misc: iowarrior: add support for 2 OEMed devices
thunderbolt: Prevent crash if non-active NVMem file is read
btrfs: handle logged extent failure properly
ecryptfs: fix a memory leak bug in ecryptfs_init_messaging()
ecryptfs: fix a memory leak bug in parse_tag_1_packet()
tpm: Initialize crypto_id of allocated_banks to HASH_ALGO__LAST
ASoC: sun8i-codec: Fix setting DAI data format
ASoC: codec2codec: avoid invalid/double-free of pcm runtime
ALSA: hda/realtek - Apply quirk for yet another MSI laptop
ALSA: hda/realtek - Apply quirk for MSI GP63, too
ALSA: hda: Use scnprintf() for printing texts for sysfs/procfs
iommu/qcom: Fix bogus detach logic
UPSTREAM: sched/psi: Fix OOB write when writing 0 bytes to PSI files
ANDROID: build.config.gki.aarch64: enable symbol trimming
ANDROID: kbuild: avoid excessively long argument lists
ANDROID: gki_defconfig: Enable CONFIG_RD_LZ4
ANDROID: net: wireless: Add module_param(mac_prefix) to mac80211_hwsim
ANDROID: gki: Enable BINFMT_MISC as part of GKI
ANDROID: gki_defconfig: disable CONFIG_CRYPTO_MD4
FROMLIST: kbuild: generate autoksyms.h early
FROMLIST: kbuild: split adjust_autoksyms.sh in two parts
FROMLIST: kbuild: allow symbol whitelisting with TRIM_UNUSED_KSYMS
ANDROID: ABI/Whitelist: update for unisoc
ANDROID: Disable wq fp check in CFI builds
ANDROID: gki_defconfig: Disable CONFIG_RT_GROUP_SCHED
FROMGIT: of: property: Add device link support for power-domains and hwlocks
ANDROID: drm/msm/a6xx: Make a6xx_gmu_bo.iova a dma_addr_t
FROMLIST: of: of_reserved_mem: Increase limit on number of reserved regions
ANDROID: dm: Add wrapped key support in dm-default-key
ANDROID: dm: add support for passing through derive_raw_secret
ANDROID: block: Prevent crypto fallback for wrapped keys
FROMLIST: drm/msm/a6xx: Use the DMA API for GMU memory objects
FROMLIST: arm64: dts: sdm845: Set the virtual address range for GMU allocations
UPSTREAM: of: Make of_dma_get_range() work on bus nodes
UPSTREAM: of/address: Fix of_pci_range_parser_one translation of DMA addresses
UPSTREAM: of/address: Translate 'dma-ranges' for parent nodes missing 'dma-ranges'
UPSTREAM: of: Factor out #{addr,size}-cells parsing
UPSTREAM: of: address: Follow DMA parent for "dma-coherent"
UPSTREAM: of/address: Introduce of_get_next_dma_parent() helper
UPSTREAM: of: Make of_dma_get_range() private
ANDROID: fix merge issue in 5.4.22
ANDROID: update ABI for 5.4.22
Linux 5.4.22
rtc: Kconfig: select REGMAP_I2C when necessary
bcache: properly initialize 'path' and 'err' in register_bcache()
drm/amdgpu/display: handle multiple numbers of fclks in dcn_calcs.c (v2)
s390/pci: Recover handle in clp_set_pci_fn()
mlxsw: spectrum_dpipe: Add missing error path
fuse: don't overflow LLONG_MAX with end offset
virtio_balloon: prevent pfn array overflow
cifs: log warning message (once) if out of disk space
i40e: Relax i40e_xsk_wakeup's return value when PF is busy
help_next should increase position index
NFS: Fix memory leaks
drm/amdgpu/smu10: fix smu10_get_clock_by_type_with_voltage
drm/amdgpu/smu10: fix smu10_get_clock_by_type_with_latency
brd: check and limit max_part par
microblaze: Prevent the overflow of the start
asm-generic/tlb: add missing CONFIG symbol
iwlwifi: mvm: Check the sta is not NULL in iwl_mvm_cfg_he_sta()
iwlwifi: mvm: Fix thermal zone registration
nvme-pci: remove nvmeq->tags
nvmet: Pass lockdep expression to RCU lists
irqchip/gic-v3-its: Reference to its_invall_cmd descriptor when building INVALL
bcache: fix incorrect data type usage in btree_flush_write()
bcache: explicity type cast in bset_bkey_last()
bcache: fix memory corruption in bch_cache_accounting_clear()
reiserfs: prevent NULL pointer dereference in reiserfs_insert_item()
lib/scatterlist.c: adjust indentation in __sg_alloc_table
ocfs2: fix a NULL pointer dereference when call ocfs2_update_inode_fsync_trans()
ocfs2: make local header paths relative to C files
btrfs: do not do delalloc reservation under page lock
powerpc: Do not consider weak unresolved symbol relocations as bad
radeon: insert 10ms sleep in dce5_crtc_load_lut
trigger_next should increase position index
ftrace: fpid_next() should increase position index
char: hpet: Fix out-of-bounds read bug
drm/nouveau/disp/nv50-: prevent oops when no channel method map provided
irqchip/gic-v3: Only provision redistributors that are enabled in ACPI
drm/amd/display: do not allocate display_mode_lib unnecessarily
rbd: work around -Wuninitialized warning
ceph: check availability of mds cluster on mount after wait timeout
powerpc/mm: Don't log user reads to 0xffffffff
bpf: map_seq_next should always increase position index
cifs: fix NULL dereference in match_prepath
cifs: Fix mount options set in automount
cifs: fix unitialized variable poential problem with network I/O cache lock patch
iwlegacy: ensure loop counter addr does not wrap and cause an infinite loop
rtw88: fix potential NULL skb access in TX ISR
hostap: Adjust indentation in prism2_hostapd_add_sta
ALSA: usb-audio: add quirks for Line6 Helix devices fw>=2.82
ARM: 8951/1: Fix Kexec compilation issue.
selftests/eeh: Bump EEH wait time to 60s
powerpc/pseries/lparcfg: Fix display of Maximum Memory
jbd2: make sure ESHUTDOWN to be recorded in the journal superblock
jbd2: switch to use jbd2_journal_abort() when failed to submit the commit record
selftests: bpf: Reset global state between reuseport test runs
alarmtimer: Make alarmtimer platform device child of RTC device
iommu/vt-d: Remove unnecessary WARN_ON_ONCE()
bcache: fix use-after-free in register_bcache()
bcache: rework error unwinding in register_bcache
bcache: cached_dev_free needs to put the sb page
btrfs: Fix split-brain handling when changing FSID to metadata uuid
btrfs: separate definition of assertion failure handlers
media: uvcvideo: Add a quirk to force GEO GC6500 Camera bits-per-pixel value
powerpc/sriov: Remove VF eeh_dev state when disabling SR-IOV
drm/nouveau/mmu: fix comptag memory leak
sunrpc: Fix potential leaks in sunrpc_cache_unhash()
ALSA: hda - Add docking station support for Lenovo Thinkpad T420s
bpf, btf: Always output invariant hit in pahole DWARF to BTF transform
driver core: platform: fix u32 greater or equal to zero comparison
s390/ftrace: generate traced function stack frame
s390: adjust -mpacked-stack support check for clang 10
x86/decoder: Add TEST opcode to Group3-2
objtool: Fix ARCH=x86_64 build error
kbuild: use -S instead of -E for precise cc-option test in Kconfig
spi: spi-fsl-qspi: Ensure width is respected in spi-mem operations
ALSA: hda/hdmi - add retry logic to parse_intel_hdmi()
irqchip/mbigen: Set driver .suppress_bind_attrs to avoid remove problems
regulator: core: Fix exported symbols to the exported GPL version
remoteproc: Initialize rproc_class before use
module: avoid setting info->name early in case we can fall back to info->mod->name
btrfs: device stats, log when stats are zeroed
btrfs: safely advance counter when looking up bio csums
btrfs: fix possible NULL-pointer dereference in integrity checks
pwm: Remove set but not set variable 'pwm'
ide: serverworks: potential overflow in svwks_set_pio_mode()
cmd64x: potential buffer overflow in cmd64x_program_timings()
pwm: omap-dmtimer: Remove PWM chip in .remove before making it unfunctional
x86/mm: Fix NX bit clearing issue in kernel_map_pages_in_pgd
f2fs: fix memleak of kobject
regulator: vctrl-regulator: Avoid deadlock getting and setting the voltage
ASoC: SOF: Intel: hda: Fix SKL dai count
debugobjects: Fix various data races
watchdog/softlockup: Enforce that timestamp is valid on boot
perf/x86/amd: Constrain Large Increment per Cycle events
sched/topology: Assert non-NUMA topology masks don't (partially) overlap
sched/core: Fix size of rq::uclamp initialization
arm64: dts: ti: k3-j721e-main: Add missing power-domains for smmu
KVM: PPC: Remove set but not used variable 'ra', 'rs', 'rt'
EDAC/sifive: Fix return value check in ecc_register()
drm/amd/display: fixup DML dependencies
arm64: fix alternatives with LLVM's integrated assembler
arm64: lse: fix LSE atomics with LLVM's integrated assembler
RDMA/mlx5: Don't fake udata for kernel path
ALSA: usb-audio: add implicit fb quirk for MOTU M Series
crypto: essiv - fix AEAD capitalization and preposition use in help text
scsi: iscsi: Don't destroy session if there are outstanding connections
scsi: ufs-mediatek: add apply_dev_quirks variant operation
scsi: ufs: pass device information to apply_dev_quirks
f2fs: free sysfs kobject
f2fs: set I_LINKABLE early to avoid wrong access by vfs
ALSA: usb-audio: unlock on error in probe
iommu/arm-smmu-v3: Use WRITE_ONCE() when changing validity of an STE
kbuild: remove *.tmp file when filechk fails
usb: musb: omap2430: Get rid of musb .set_vbus for omap2430 glue
perf/imx_ddr: Fix cpu hotplug state cleanup
drm/vmwgfx: prevent memory leak in vmw_cmdbuf_res_add
gpiolib: Set lockdep class for hierarchical irq domains
dm thin: don't allow changing data device during thin-pool reload
drm/nouveau/fault/gv100-: fix memory leak on module unload
drm/nouveau/drm/ttm: Remove set but not used variable 'mem'
drm/nouveau: Fix copy-paste error in nouveau_fence_wait_uevent_handler
drm/nouveau/gr/gk20a,gm200-: add terminators to method lists read from fw
drm/nouveau/secboot/gm20b: initialize pointer in gm20b_secboot_new()
vme: bridges: reduce stack usage
bpf: Return -EBADRQC for invalid map type in __bpf_tx_xdp_map
ASoC: SOF: Intel: hda-dai: fix compilation warning in pcm_prepare
driver core: Print device when resources present in really_probe()
driver core: platform: Prevent resouce overflow from causing infinite loops
visorbus: fix uninitialized variable access
misc: xilinx_sdfec: fix xsdfec_poll()'s return type
tty: synclink_gt: Adjust indentation in several functions
tty: synclinkmp: Adjust indentation in several functions
raid6/test: fix a compilation warning
ASoC: atmel: fix build error with CONFIG_SND_ATMEL_SOC_DMA=m
ALSA: usb-audio: Add boot quirk for MOTU M Series
ARM: dts: rockchip: add reg property to brcmf sub node for rk3188-bqedison2qc
arm64: dts: rockchip: add reg property to brcmf sub-nodes
arm64: dts: rockchip: fix dwmmc clock name for px30
clocksource: davinci: only enable clockevents once tim34 is initialized
wan: ixp4xx_hss: fix compile-testing on 64-bit
x86/nmi: Remove irq_work from the long duration NMI handler
bnxt: Detach page from page pool before sending up the stack
Input: edt-ft5x06 - work around first register access error
rcu: Use WRITE_ONCE() for assignments to ->pprev for hlist_nulls
efi/x86: Don't panic or BUG() on non-critical error conditions
soc/tegra: fuse: Correct straps' address for older Tegra124 device trees
IB/hfi1: Add RcvShortLengthErrCnt to hfi1stats
IB/hfi1: Add software counter for ctxt0 seq drop
staging: rtl8188: avoid excessive stack usage
drm/mediatek: Add gamma property according to hardware capability
udf: Fix free space reporting for metadata and virtual partitions
usbip: Fix unsafe unaligned pointer usage
ARM: dts: stm32: Add power-supply for DSI panel on stm32f469-disco
usb: dwc3: use proper initializers for property entries
drm: remove the newline for CRC source name.
RDMA/hns: Avoid printing address of mtt page
mlx5: work around high stack usage with gcc
drm/amdkfd: Fix permissions of hang_hws
iommu/vt-d: Avoid sending invalid page response
iommu/vt-d: Match CPU and IOMMU paging mode
ACPI: button: Add DMI quirk for Razer Blade Stealth 13 late 2019 lid switch
ASoC: Intel: sof_rt5682: Ignore the speaker amp when there isn't one.
vfio/spapr/nvlink2: Skip unpinning pages on error exit
tools lib api fs: Fix gcc9 stringop-truncation compilation error
net: phy: fixed_phy: fix use-after-free when checking link GPIO
ALSA: sh: Fix compile warning wrt const
ALSA: hda/realtek - Apply mic mute LED quirk for Dell E7xx laptops, too
clk: uniphier: Add SCSSI clock gate for each channel
clk: Use parent node pointer during registration if necessary
ALSA: sh: Fix unused variable warnings
clk: sunxi-ng: add mux and pll notifiers for A64 CPU clock
RDMA/rxe: Fix error type of mmap_offset
fbdev: fix numbering of fbcon options
ASoC: soc-topology: fix endianness issues
reset: uniphier: Add SCSSI reset control for each channel
pinctrl: sh-pfc: sh7269: Fix CAN function GPIOs
drm/fbdev: Fallback to non tiled mode if all tiles not present
PM / devfreq: rk3399_dmc: Add COMPILE_TEST and HAVE_ARM_SMCCC dependency
PM / devfreq: exynos-ppmu: Fix excessive stack usage
x86/vdso: Provide missing include file
crypto: chtls - Fixed memory leak
net: phy: realtek: add logging for the RGMII TX delay configuration
bpf: Print error message for bpftool cgroup show
dmaengine: imx-sdma: Fix memory leak
dmaengine: Store module owner in dma_device struct
clk: actually call the clock init before any other callback of the clock
iommu/iova: Silence warnings under memory pressure
iommu/amd: Only support x2APIC with IVHD type 11h/40h
iommu/amd: Check feature support bit before accessing MSI capability registers
arm64: dts: qcom: db845c: Enable ath10k 8bit host-cap quirk
scsi: lpfc: Fix: Rework setting of fdmi symbolic node name registration
selinux: ensure we cleanup the internal AVC counters on error in avc_update()
ARM: dts: r8a7779: Add device node for ARM global timer
clk: renesas: rcar-gen3: Allow changing the RPC[D2] clocks
drm/mediatek: handle events when enabling/disabling crtc
crypto: inside-secure - add unspecified HAS_IOMEM dependency
scsi: aic7xxx: Adjust indentation in ahc_find_syncrate
scsi: ufs: Complete pending requests in host reset and restore path
nfsd: Clone should commit src file metadata too
ACPICA: Disassembler: create buffer fields in ACPI_PARSE_LOAD_PASS1
clk: qcom: smd: Add missing bimc clock
drm/amdgpu: fix KIQ ring test fail in TDR of SRIOV
orinoco: avoid assertion in case of NULL pointer
rtlwifi: rtl_pci: Fix -Wcast-function-type
iwlegacy: Fix -Wcast-function-type
ipw2x00: Fix -Wcast-function-type
b43legacy: Fix -Wcast-function-type
PCI: Add DMA alias quirk for PLX PEX NTB
PCI: Add nr_devfns parameter to pci_add_dma_alias()
ALSA: usx2y: Adjust indentation in snd_usX2Y_hwdep_dsp_status
netfilter: nft_tunnel: add the missing ERSPAN_VERSION nla_policy
fore200e: Fix incorrect checks of NULL pointer dereference
r8169: check that Realtek PHY driver module is loaded
samples/bpf: Set -fno-stack-protector when building BPF programs
reiserfs: Fix spurious unlock in reiserfs_fill_super() error handling
media: v4l2-device.h: Explicitly compare grp{id,mask} to zero in v4l2_device macros
selftests/net: make so_txtime more robust to timer variance
gpu/drm: ingenic: Avoid null pointer deference in plane atomic update
Revert "nfp: abm: fix memory leak in nfp_abm_u32_knode_replace"
PCI: Increase D3 delay for AMD Ryzen5/7 XHCI controllers
PCI: Add generic quirk for increasing D3hot delay
media: cx23885: Add support for AVerMedia CE310B
PCI: iproc: Apply quirk_paxc_bridge() for module as well as built-in
bus: ti-sysc: Implement quirk handling for CLKDM_NOAUTO
ARM: dts: imx6: rdu2: Limit USBH1 to Full Speed
ARM: dts: imx6: rdu2: Disable WP for USDHC2 and USDHC3
ARM: exynos_defconfig: Bring back explicitly wanted options
clk: imx: Add correct failure handling for clk based helpers
padata: validate cpumask without removed CPU during offline
arm64: dts: qcom: msm8996: Disable USB2 PHY suspend by core
selinux: ensure we cleanup the internal AVC counters on error in avc_insert()
opp: Free static OPPs on errors while adding them
arm: dts: allwinner: H3: Add PMU node
arm64: dts: allwinner: H5: Add PMU node
arm64: dts: allwinner: H6: Add PMU mode
NFC: port100: Convert cpu_to_le16(le16_to_cpu(E1) + E2) to use le16_add_cpu().
net/wan/fsl_ucc_hdlc: reject muram offsets above 64K
regulator: rk808: Lower log level on optional GPIOs being not available
ASoC: intel: sof_rt5682: Add support for tgl-max98357a-rt5682
ASoC: intel: sof_rt5682: Add quirk for number of HDMI DAI's
modules: lockdep: Suppress suspicious RCU usage warning
arm64: dts: rockchip: Fix NanoPC-T4 cooling maps
drm/panel: simple: Add Logic PD Type 28 display support
drm/amdgpu: Ensure ret is always initialized when using SOC15_WAIT_ON_RREG
ath10k: correct the tlv len of ath10k_wmi_tlv_op_gen_config_pno_start
drm/amdgpu: remove 4 set but not used variable in amdgpu_atombios_get_connector_info_from_object_table
bpf, sockhash: Synchronize_rcu before free'ing map
drm/amdkfd: Fix a bug in SDMA RLC queue counting under HWS mode
clk: qcom: rcg2: Don't crash if our parent can't be found; return an error
clk: qcom: Don't overwrite 'cfg' in clk_rcg2_dfs_populate_freq()
kconfig: fix broken dependency in randconfig-generated .config
block, bfq: do not plug I/O for bfq_queues with no proc refs
drivers/block/zram/zram_drv.c: fix error return codes not being returned in writeback_store
Btrfs: keep pages dirty when using btrfs_writepage_fixup_worker
KVM: s390: ENOTSUPP -> EOPNOTSUPP fixups
nbd: add a flush_workqueue in nbd_start_device
tracing: Simplify assignment parsing for hist triggers
drm/amd/display: Retrain dongles when SINK_COUNT becomes non-zero
rtc: i2c/spi: Avoid inclusion of REGMAP support when not needed
selftests: settings: tests can be in subsubdirs
brcmfmac: sdio: Fix OOB interrupt initialization on brcm43362
rtw88: fix rate mask for 1SS chip
ath10k: Correct the DMA direction for management tx buffers
ext4, jbd2: ensure panic when aborting with zero errno
ARM: 8952/1: Disable kmemleak on XIP kernels
tracing: Fix very unlikely race of registering two stat tracers
tracing: Fix tracing_stat return values in error handling paths
powerpc/iov: Move VF pdev fixup into pcibios_fixup_iov()
s390/pci: Fix possible deadlock in recover_store()
wan/hdlc_x25: fix skb handling
dmaengine: fsl-qdma: fix duplicated argument to &&
udf: Allow writing to 'Rewritable' partitions
pwm: omap-dmtimer: Simplify error handling
x86/sysfb: Fix check for bad VRAM size
clk: ti: dra7: fix parent for gmac_clkctrl
ext4: fix deadlock allocating bio_post_read_ctx from mempool
jbd2: clear JBD2_ABORT flag before journal_reset to update log tail info when load journal
kselftest: Minimise dependency of get_size on C library interfaces
drm/amd/display: Clear state after exiting fixed active VRR state
clocksource/drivers/bcm2835_timer: Fix memory leak of timer
usb: dwc2: Fix IN FIFO allocation
usb: gadget: udc: fix possible sleep-in-atomic-context bugs in gr_probe()
drm/nouveau/nouveau: fix incorrect sizeof on args.src an args.dst
spi: fsl-lpspi: fix only one cs-gpio working
drm/amdgpu/sriov: workaround on rev_id for Navi12 under sriov
uio: fix a sleep-in-atomic-context bug in uio_dmem_genirq_irqcontrol()
raid6/test: fix a compilation error
net: ethernet: ixp4xx: Standard module init
sparc: Add .exit.data section.
MIPS: Loongson: Fix potential NULL dereference in loongson3_platform_init()
efi/x86: Map the entire EFI vendor string before copying it
pinctrl: baytrail: Do not clear IRQ flags on direct-irq enabled pins
IB/core: Let IB core distribute cache update events
kernel/module: Fix memleak in module_add_modinfo_attrs()
media: sti: bdisp: fix a possible sleep-in-atomic-context bug in bdisp_device_run()
char/random: silence a lockdep splat with printk()
x86/fpu: Deactivate FPU state after failure during state load
iommu/vt-d: Fix off-by-one in PASID allocation
gpio: gpio-grgpio: fix possible sleep-in-atomic-context bugs in grgpio_irq_map/unmap()
clk: meson: meson8b: make the CCF use the glitch-free mali mux
powerpc/powernv/iov: Ensure the pdn for VFs always contains a valid PE number
clk: at91: sam9x60: fix programmable clock prescaler
media: sun4i-csi: Fix [HV]sync polarity handling
media: sun4i-csi: Fix data sampling polarity handling
media: sun4i-csi: Deal with DRAM offset
media: i2c: mt9v032: fix enum mbus codes and frame sizes
media: ov5640: Fix check for PLL1 exceeding max allowed rate
pxa168fb: Fix the function used to release some memory in an error handling path
drm/msm/adreno: fix zap vs no-zap handling
drm/mipi_dbi: Fix off-by-one bugs in mipi_dbi_blank()
printk: fix exclusive_console replaying
pinctrl: sh-pfc: sh7264: Fix CAN function GPIOs
gianfar: Fix TX timestamping with a stacked DSA driver
ALSA: ctl: allow TLV read operation for callback type of element in locked case
ext4: fix ext4_dax_read/write inode locking sequence for IOCB_NOWAIT
leds: pca963x: Fix open-drain initialization
drm/amd/display: Map ODM memory correctly when doing ODM combine
PCI: Fix pci_add_dma_alias() bitmask size
brcmfmac: Fix use after free in brcmf_sdio_readframes()
brcmfmac: Fix memory leak in brcmf_p2p_create_p2pdev()
cpu/hotplug, stop_machine: Fix stop_machine vs hotplug order
clk: meson: pll: Fix by 0 division in __pll_params_to_rate()
media: meson: add missing allocation failure check on new_buf
f2fs: call f2fs_balance_fs outside of locked page
f2fs: preallocate DIO blocks when forcing buffered_io
rcu: Fix data-race due to atomic_t copy-by-value
rcu: Fix missed wakeup of exp_wq waiters
rcu/nocb: Fix dump_tree hierarchy print always active
drm/qxl: Complete exception handling in qxl_device_init()
wil6210: fix break that is never reached because of zero'ing of a retry counter
ath10k: Fix qmi init error handling
drm/gma500: Fixup fbdev stolen size usage evaluation
net/sched: flower: add missing validation of TCA_FLOWER_FLAGS
net/sched: matchall: add missing validation of TCA_MATCHALL_FLAGS
net: dsa: tag_qca: Make sure there is headroom for tag
net/smc: fix leak of kernel memory to user space
enic: prevent waking up stopped tx queues over watchdog reset
core: Don't skip generic XDP program execution for cloned SKBs
ANDROID: ufs, block: fix crypto power management and move into block layer
ANDROID: rtc: class: support hctosys from modular RTC drivers
ANDROID: update the abi after clk changes
ANDROID: update abi for f2fs/fscrypt merge
ANDROID: Kconfig.gki: Remove most of the built in qcom clks
FROMLIST: f2fs: Handle casefolding with Encryption
FROMLIST: fscrypt: Have filesystems handle their d_ops
FROMLIST: ext4: Use generic casefolding support
FROMLIST: f2fs: Use generic casefolding support
FROMLIST: Add standard casefolding support
FROMLIST: unicode: Add utf8_casefold_hash
ANDROID: gki: Set CONFIG_SERIAL_SAMSUNG for early con.
UPSTREAM: tty: serial: samsung_tty: remove SERIAL_SAMSUNG_DEBUG
UPSTREAM: tty: serial: samsung_tty: build it for any platform
UPSTREAM: tty: serial: samsung_tty: do not abuse the struct uart_port unused fields
UPSTREAM: tty: serial: samsung_tty: fix blank line checkpatch warning
UPSTREAM: tty: serial: samsung_tty: fix up minor comment formatting
UPSTREAM: tty: serial: samsung_tty: use 'unsigned int' not 'unsigned'
UPSTREAM: tty: serial: samsung_tty: use standard debugging macros
UPSTREAM: tty: serial: samsung_tty: drop unneded dbg() calls
UPSTREAM: tty: serial: samsung_tty: delete samsung.h
UPSTREAM: tty: serial: samsung.h: remove reset_port callback from struct s3c24xx_uart_info
UPSTREAM: tty: serial: samsung.h: fix up minor comment issues
UPSTREAM: tty: serial: samsung_tty: fix build warning
UPSTREAM: tty: serial: samsung: allow driver to be built by anyone
UPSTREAM: tty: serial: samsung: remove variable 'ufstat' set but not used
UPSTREAM: {tty: serial, nand: onenand}: samsung: rename to fix build warning
UPSTREAM: random: ignore GRND_RANDOM in getentropy(2)
UPSTREAM: random: add GRND_INSECURE to return best-effort non-cryptographic bytes
UPSTREAM: linux/random.h: Mark CONFIG_ARCH_RANDOM functions __must_check
UPSTREAM: linux/random.h: Use false with bool
UPSTREAM: linux/random.h: Remove arch_has_random, arch_has_random_seed
UPSTREAM: random: remove some dead code of poolinfo
UPSTREAM: random: fix typo in add_timer_randomness()
UPSTREAM: random: Add and use pr_fmt()
UPSTREAM: random: convert to ENTROPY_BITS for better code readability
UPSTREAM: random: remove unnecessary unlikely()
UPSTREAM: random: remove kernel.random.read_wakeup_threshold
UPSTREAM: random: delete code to pull data into pools
UPSTREAM: random: remove the blocking pool
UPSTREAM: random: make /dev/random be almost like /dev/urandom
UPSTREAM: random: Add a urandom_read_nowait() for random APIs that don't warn
UPSTREAM: random: Don't wake crng_init_wait when crng_init == 1
UPSTREAM: char/random: silence a lockdep splat with printk()
ANDROID: Incremental fs: Support xattrs
BACKPORT: sched/fair: Remove wake_cap()
UPSTREAM: sched/core: Remove for_each_lower_domain()
UPSTREAM: sched/topology: Remove SD_BALANCE_WAKE on asymmetric capacity systems
UPSTREAM: sched/fair: Add asymmetric CPU capacity wakeup scan
ANDROID: ufs: add quirk to fix abnormal ocs fatal error
FROMLIST: ufs: fix a bug on printing PRDT
ANDROID: update abi for 5.4.21
ANDROID: clang: update to 10.0.4
Linux 5.4.21
mmc: core: Rework wp-gpio handling
gpio: add gpiod_toggle_active_low()
KVM: x86/mmu: Fix struct guest_walker arrays for 5-level paging
ext4: choose hardlimit when softlimit is larger than hardlimit in ext4_statfs_project()
jbd2: do not clear the BH_Mapped flag when forgetting a metadata buffer
jbd2: move the clearing of b_modified flag to the journal_unmap_buffer()
Revert "drm/sun4i: drv: Allow framebuffer modifiers in mode config"
NFSv4.1 make cachethis=no for writes
perf stat: Don't report a null stalled cycles per insn metric
KVM: x86: Mask off reserved bit from #DB exception payload
arm64: dts: fast models: Fix FVP PCI interrupt-map property
cifs: fix mount option display for sec=krb5i
mac80211: fix quiet mode activation in action frames
hwmon: (pmbus/ltc2978) Fix PMBus polling of MFR_COMMON definitions.
perf/x86/intel: Fix inaccurate period in context switch for auto-reload
spmi: pmic-arb: Set lockdep class for hierarchical irq domains
sched/uclamp: Reject negative values in cpu_uclamp_write()
s390/time: Fix clk type in get_tod_clock
RDMA/core: Fix protection fault in get_pkey_idx_qp_list
RDMA/rxe: Fix soft lockup problem due to using tasklets in softirq
RDMA/hfi1: Fix memory leak in _dev_comp_vect_mappings_create
RDMA/iw_cxgb4: initiate CLOSE when entering TERM
RDMA/core: Fix invalid memory access in spec_filter_size
IB/umad: Fix kernel crash while unloading ib_umad
IB/rdmavt: Reset all QPs when the device is shut down
IB/hfi1: Close window for pq and request coliding
IB/hfi1: Acquire lock to release TID entries when user file is closed
IB/mlx5: Return failure when rts2rts_qp_counters_set_id is not supported
drivers: ipmi: fix off-by-one bounds check that leads to a out-of-bounds write
nvme: fix the parameter order for nvme_get_log in nvme_get_fw_slot_info
bus: moxtet: fix potential stack buffer overflow
drm/panfrost: Make sure the shrinker does not reclaim referenced BOs
drm/vgem: Close use-after-free race in vgem_gem_create
s390/uv: Fix handling of length extensions
s390/pkey: fix missing length of protected key on return
perf/x86/amd: Add missing L2 misses event spec to AMD Family 17h's event map
KVM: nVMX: Use correct root level for nested EPT shadow page tables
EDAC/mc: Fix use-after-free and memleaks during device removal
EDAC/sysfs: Remove csrow objects on errors
cifs: make sure we do not overflow the max EA buffer size
xprtrdma: Fix DMA scatter-gather list mapping imbalance
arm64: ssbs: Fix context-switch when SSBS is present on all CPUs
gpio: xilinx: Fix bug where the wrong GPIO register is written to
ARM: npcm: Bring back GPIOLIB support
btrfs: log message when rw remount is attempted with unclean tree-log
btrfs: print message when tree-log replay starts
btrfs: ref-verify: fix memory leaks
Btrfs: fix race between using extent maps and merging them
ext4: improve explanation of a mount failure caused by a misconfigured kernel
ext4: add cond_resched() to ext4_protect_reserved_inode
ext4: fix checksum errors with indexed dirs
ext4: fix support for inode sizes > 1024 bytes
ext4: don't assume that mmp_nodename/bdevname have NUL
ALSA: usb-audio: Add clock validity quirk for Denon MC7000/MCX8000
ALSA: usb-audio: sound: usb: usb true/false for bool return type
ACPI: PM: s2idle: Prevent spurious SCIs from waking up the system
ACPICA: Introduce acpi_any_gpe_status_set()
ACPI: PM: s2idle: Avoid possible race related to the EC GPE
ACPI: EC: Fix flushing of pending work
ALSA: usb-audio: Apply sample rate quirk for Audioengine D1
ALSA: hda/realtek - Fix silent output on MSI-GL73
ALSA: hda/realtek - Add more codec supported Headset Button
ALSA: usb-audio: Fix UAC2/3 effect unit parsing
Input: synaptics - remove the LEN0049 dmi id from topbuttonpad list
Input: synaptics - enable SMBus on ThinkPad L470
Input: synaptics - switch T470s to RMI4 by default
ANDROID: ABI/Whitelist: initial unisoc whitelist
ANDROID: Fix ABI representation after enabling CONFIG_NET_NS
ANDROID: gki_defconfig: Enable CONFIG_NET_NS
ANDROID: gki_defconfig: Enable XDP_SOCKETS
ANDROID: gki_defconfig: Enable MAC80211_RC_MINSTREL
ANDROID: virtio: virtio_input: pass _DIRECT only if the device advertises _DIRECT
ANDROID: staging: ion: delete unused heap types and IDs
ANDROID: gki_defconfig: disable system_contig ion heap.
ANDROID: cf build: Use merge_configs
ANDROID: net: bpf: Allow TC programs to call BPF_FUNC_skb_change_head
ANDROID: gki_defconfig: Disable SDCARD_FS
Linux 5.4.20
selinux: fall back to ref-walk if audit is required
libertas: make lbs_ibss_join_existing() return error code on rates overflow
libertas: don't exit from lbs_ibss_join_existing() with RCU read lock held
mwifiex: Fix possible buffer overflows in mwifiex_cmd_append_vsie_tlv()
mwifiex: Fix possible buffer overflows in mwifiex_ret_wmm_get_status()
dmaengine: axi-dmac: add a check for devm_regmap_init_mmio
clk: meson: g12a: fix missing uart2 in regmap table
mfd: max77650: Select REGMAP_IRQ in Kconfig
regmap: fix writes to non incrementing registers
pinctrl: sh-pfc: r8a7778: Fix duplicate SDSELF_B and SD1_CLK_B
pinctrl: sh-pfc: r8a77965: Fix DU_DOTCLKIN3 drive/bias control
selinux: fix regression introduced by move_mount(2) syscall
selinux: revert "stop passing MAY_NOT_BLOCK to the AVC upon follow_link"
bcache: avoid unnecessary btree nodes flushing in btree_flush_write()
dt-bindings: iio: adc: ad7606: Fix wrong maxItems value
media: i2c: adv748x: Fix unsafe macros
drivers: watchdog: stm32_iwdg: set WDOG_HW_RUNNING at probe
crypto: caam/qi2 - fix typo in algorithm's driver name
crypto: atmel-sha - fix error handling when setting hmac key
crypto: artpec6 - return correct error code for failed setkey()
crypto: testmgr - don't try to decrypt uninitialized buffers
mtd: sharpslpart: Fix unsigned comparison to zero
mtd: onenand_base: Adjust indentation in onenand_read_ops_nolock
arm64: nofpsmid: Handle TIF_FOREIGN_FPSTATE flag cleanly
KVM: arm64: Treat emulated TVAL TimerValue as a signed 32-bit integer
KVM: arm64: pmu: Fix chained SW_INCR counters
KVM: arm64: pmu: Don't increment SW_INCR if PMCR.E is unset
KVM: arm: Make inject_abt32() inject an external abort instead
KVM: arm: Fix DFSR setting for non-LPAE aarch32 guests
KVM: arm/arm64: Fix young bit from mmu notifier
arm64: ptrace: nofpsimd: Fail FP/SIMD regset operations
arm64: cpufeature: Set the FP/SIMD compat HWCAP bits properly
arm64: cpufeature: Fix the type of no FP/SIMD capability
sched/uclamp: Fix a bug in propagating uclamp value in new cgroups
ARM: 8949/1: mm: mark free_memmap as __init
KVM: arm/arm64: vgic-its: Fix restoration of unmapped collections
ARM: at91: pm: use of_device_id array to find the proper shdwc node
ARM: at91: pm: use SAM9X60 PMC's compatible
iommu/arm-smmu-v3: Populate VMID field for CMDQ_OP_TLBI_NH_VA
powerpc/pseries: Allow not having ibm, hypertas-functions::hcall-multi-tce for DDW
powerpc/pseries/vio: Fix iommu_table use-after-free refcount warning
powerpc/papr_scm: Fix leaking 'bus_desc.provider_name' in some paths
powerpc/ptdump: Only enable PPC_CHECK_WX with STRICT_KERNEL_RWX
powerpc/ptdump: Fix W+X verification call in mark_rodata_ro()
Revert "powerpc/pseries/iommu: Don't use dma_iommu_ops on secure guests"
soc: qcom: rpmhpd: Set 'active_only' for active only power domains
tools/power/acpi: fix compilation error
ARM: dts: at91: sama5d3: define clock rate range for tcb1
ARM: dts: at91: sama5d3: fix maximum peripheral clock rates
ARM: dts: meson8b: use the actual frequency for the GPU's 364MHz OPP
ARM: dts: meson8: use the actual frequency for the GPU's 182.1MHz OPP
arm64: dts: marvell: clearfog-gt-8k: fix switch cpu port node
arm64: dts: renesas: r8a77990: ebisu: Remove clkout-lr-synchronous from sound
ARM: dts: am43xx: add support for clkout1 clock
ARM: dts: at91: Reenable UART TX pull-ups
arm64: dts: uDPU: fix broken ethernet
arm64: dts: qcom: msm8998: Fix tcsr syscon size
platform/x86: intel_mid_powerbtn: Take a copy of ddata
ARC: [plat-axs10x]: Add missing multicast filter number to GMAC node
watchdog: qcom: Use platform_get_irq_optional() for bark irq
rtc: cmos: Stop using shared IRQ
rtc: hym8563: Return -EINVAL if the time is known to be invalid
x86/boot: Handle malformed SRAT tables during early ACPI parsing
NFSv4.0: nfs4_do_fsinfo() should not do implicit lease renewals
NFSv4: try lease recovery on NFS4ERR_EXPIRED
NFSv4: pnfs_roc() must use cred_fscmp() to compare creds
NFS: Fix fix of show_nfs_errors
NFS/pnfs: Fix pnfs_generic_prepare_to_resend_writes()
NFS: Revalidate the file size on a fatal write error
nfs: NFS_SWAP should depend on SWAP
bpf, sockmap: Check update requirements after locking
bpf: Improve bucket_log calculation logic
selftests/bpf: Test freeing sockmap/sockhash with a socket in it
bpf, sockhash: Synchronize_rcu before free'ing map
bpf, sockmap: Don't sleep while holding RCU lock on tear-down
bpftool: Don't crash on missing xlated program instructions
iwlwifi: mvm: avoid use after free for pmsr request
PCI/AER: Initialize aer_fifo
PCI: Don't disable bridge BARs when assigning bus resources
PCI: tegra: Fix afi_pex2_ctrl reg offset for Tegra30
PCI/switchtec: Fix vep_vector_number ioread width
PCI/switchtec: Use dma_set_mask_and_coherent()
ath10k: pci: Only dump ATH10K_MEM_REGION_TYPE_IOREG when safe
PCI/IOV: Fix memory leak in pci_iov_add_virtfn()
scsi: ufs: Fix ufshcd_probe_hba() reture value in case ufshcd_scsi_add_wlus() fails
RDMA/umem: Fix ib_umem_find_best_pgsz()
RDMA/cma: Fix unbalanced cm_id reference count during address resolve
RDMA/uverbs: Verify MR access flags
RDMA/core: Fix locking in ib_uverbs_event_read
RDMA/i40iw: fix a potential NULL pointer dereference
RDMA/netlink: Do not always generate an ACK for some netlink operations
IB/mlx4: Fix leak in id_map_find_del
IB/srp: Never use immediate data if it is disabled by a user
IB/mlx4: Fix memory leak in add_gid error flow
hv_sock: Remove the accept port restriction
ASoC: pcm: update FE/BE trigger order based on the command
ANDROID: gki_defconfig: Add CONFIG_UNICODE
ANDROID: added memory initialization tests to cuttlefish config
ANDROID: gki_defconfig: enable CONFIG_RUNTIME_TESTING_MENU
fs-verity: use u64_to_user_ptr()
fs-verity: use mempool for hash requests
fs-verity: implement readahead of Merkle tree pages
fs-verity: implement readahead for FS_IOC_ENABLE_VERITY
fscrypt: improve format of no-key names
ubifs: allow both hash and disk name to be provided in no-key names
ubifs: don't trigger assertion on invalid no-key filename
fscrypt: clarify what is meant by a per-file key
fscrypt: derive dirhash key for casefolded directories
fscrypt: don't allow v1 policies with casefolding
fscrypt: add "fscrypt_" prefix to fname_encrypt()
fscrypt: don't print name of busy file when removing key
ubifs: use IS_ENCRYPTED() instead of ubifs_crypt_is_encrypted()
fscrypt: document gfp_flags for bounce page allocation
fscrypt: optimize fscrypt_zeroout_range()
fscrypt: remove redundant bi_status check
fscrypt: Allow modular crypto algorithms
FROMLIST: rename missed uaccess .fixup section
ANDROID: gki_defconfig: enable heap and stack initialization.
ANDROID: ABI/Whitelist: update for db845c
ANDROID: ABI/Whitelist: update for Cuttlefish
ANDROID: update ABI representation and GKI whitelist
ANDROID: f2fs: fix missing blk-crypto changes
fscrypt: include <linux/ioctl.h> in UAPI header
fscrypt: don't check for ENOKEY from fscrypt_get_encryption_info()
fscrypt: remove fscrypt_is_direct_key_policy()
fscrypt: move fscrypt_valid_enc_modes() to policy.c
fscrypt: check for appropriate use of DIRECT_KEY flag earlier
fscrypt: split up fscrypt_supported_policy() by policy version
fscrypt: introduce fscrypt_needs_contents_encryption()
fscrypt: move fscrypt_d_revalidate() to fname.c
fscrypt: constify inode parameter to filename encryption functions
fscrypt: constify struct fscrypt_hkdf parameter to fscrypt_hkdf_expand()
fscrypt: verify that the crypto_skcipher has the correct ivsize
fscrypt: use crypto_skcipher_driver_name()
fscrypt: support passing a keyring key to FS_IOC_ADD_ENCRYPTION_KEY
UPSTREAM: dynamic_debug: allow to work if debugfs is disabled
UPSTREAM: serial: sprd: Add polling IO support
UPSTREAM: dmaengine: sprd: Add wrap address support for link-list mode
UPSTREAM: pinctrl: sprd: Add CM4 sleep mode support
UPSTREAM: pinctrl: sprd: Add PIN_CONFIG_BIAS_DISABLE configuration support
UPSTREAM: spi: sprd: adi: Set BIT_WDG_NEW bit when rebooting
UPSTREAM: nvmem: sprd: Add Spreadtrum SoCs eFuse support
UPSTREAM: dt-bindings: nvmem: Add Spreadtrum eFuse controller documentation
UPSTREAM: scsi: ufs-mediatek: enable low-power mode for hibern8 state
BACKPORT: scsi: ufs: export some functions for vendor usage
UPSTREAM: scsi: ufs-mediatek: add dbg_register_dump implementation
UPSTREAM: scsi: ufs-mediatek: add apply_dev_quirks variant operation
UPSTREAM: scsi: ufs: pass device information to apply_dev_quirks
UPSTREAM: scsi: ufs: add device reset history for vendor implementations
UPSTREAM: scsi: ufs: fix empty check of error history
UPSTREAM: scsi: ufs-mediatek: configure and enable clk-gating
UPSTREAM: scsi: ufs-mediatek: configure customized auto-hibern8 timer
BACKPORT: scsi: ufs: export ufshcd_auto_hibern8_update for vendor usage
UPSTREAM: scsi: ufs-mediatek: introduce reference clock control
UPSTREAM: scsi: ufs-mediatek: add device reset implementation
UPSTREAM: scsi: soc: mediatek: add header for SiP service interface
BACKPORT: scsi: ufs: use ufshcd_vops_dbg_register_dump for vendor specific dumps
BACKPORT: scsi: ufs: unify scsi_block_requests usage
UPSTREAM: scsi: ufs: disable interrupt during clock-gating
UPSTREAM: scsi: ufs: disable irq before disabling clocks
UPSTREAM: scsi: ufs-mediatek: enable auto suspend capability
ANDROID: update ABI for 5.4.19
ANDROID: fix up dummy-cpufreq.c due to api changes
Linux 5.4.19
powerpc/kuap: Fix set direction in allow/prevent_user_access()
regulator fix for "regulator: core: Add regulator_is_equal() helper"
rxrpc: Fix service call disconnection
perf/core: Fix mlock accounting in perf_mmap()
clocksource: Prevent double add_timer_on() for watchdog_timer
x86/apic/msi: Plug non-maskable MSI affinity race
cifs: fail i/o on soft mounts if sessionsetup errors out
KVM: Play nice with read-only memslots when querying host page size
KVM: Use vcpu-specific gva->hva translation when querying host page size
KVM: nVMX: vmread should not set rflags to specify success in case of #PF
KVM: x86: fix overlap between SPTE_MMIO_MASK and generation
KVM: x86: Use gpa_t for cr2/gpa to fix TDP support on 32-bit KVM
KVM: x86: use CPUID to locate host page table reserved bits
KVM: x86/mmu: Apply max PA check for MMIO sptes to 32-bit KVM
drm/dp_mst: Remove VCPI while disabling topology mgr
btrfs: free block groups after free'ing fs trees
btrfs: use bool argument in free_root_pointers()
x86/timer: Don't skip PIT setup when APIC is disabled or in legacy mode
mfd: bd70528: Fix hour register mask
mfd: rn5t618: Mark ADC control register volatile
mfd: da9062: Fix watchdog compatible string
ASoC: Intel: skl_hda_dsp_common: Fix global-out-of-bounds bug
net/mlx5: Deprecate usage of generic TLS HW capability bit
net/mlx5: Fix deadlock in fs_core
drop_monitor: Do not cancel uninitialized work item
qed: Fix timestamping issue for L2 unicast ptp packets.
ipv6/addrconf: fix potential NULL deref in inet6_set_link_af()
taprio: Fix dropping packets when using taprio + ETF offloading
taprio: Use taprio_reset_tc() to reset Traffic Classes configuration
taprio: Add missing policy validation for flags
taprio: Fix still allowing changing the flags during runtime
taprio: Fix enabling offload with wrong number of traffic classes
net: macb: Limit maximum GEM TX length in TSO
net: macb: Remove unnecessary alignment check for TSO
net/mlx5: IPsec, fix memory leak at mlx5_fpga_ipsec_delete_sa_ctx
net/mlx5: IPsec, Fix esp modify function attribute
net: systemport: Avoid RBUF stuck in Wake-on-LAN mode
net: stmmac: fix a possible endless loop
net_sched: fix a resource leak in tcindex_set_parms()
net: mvneta: move rx_dropped and rx_errors in per-cpu stats
net: dsa: microchip: enable module autoprobe
net: dsa: bcm_sf2: Only 7278 supports 2Gb/sec IMP port
net: dsa: b53: Always use dev->vlan_enabled in b53_configure_vlan()
dpaa_eth: support all modes with rate adapting PHYs
devlink: report 0 after hitting end in region read
bonding/alb: properly access headers in bond_alb_xmit()
ASoC: sgtl5000: Fix VDDA and VDDIO comparison
regulator: core: Add regulator_is_equal() helper
ubifs: Fix memory leak from c->sup_node
ubi: Fix an error pointer dereference in error handling code
ubi: fastmap: Fix inverted logic in seen selfcheck
virtio_balloon: Fix memory leaks on errors in virtballoon_probe()
virtio-balloon: Fix memory leak when unloading while hinting is in progress
nfsd: Return the correct number of bytes written to the file
nfsd: fix jiffies/time_t mixup in LRU list
nfsd: fix delay timer on 32-bit architectures
IB/core: Fix ODP get user pages flow
IB/mlx5: Fix outstanding_pi index for GSI qps
net: tulip: Adjust indentation in {dmfe, uli526x}_init_module
net: smc911x: Adjust indentation in smc911x_phy_configure
ppp: Adjust indentation into ppp_async_input
NFC: pn544: Adjust indentation in pn544_hci_check_presence
drm: msm: mdp4: Adjust indentation in mdp4_dsi_encoder_enable
powerpc/44x: Adjust indentation in ibm4xx_denali_fixup_memsize
ext2: Adjust indentation in ext2_fill_super
phy: qualcomm: Adjust indentation in read_poll_timeout
mtd: spi-nor: Split mt25qu512a (n25q512a) entry into two
scsi: ufs: Recheck bkops level if bkops is disabled
scsi: qla4xxx: Adjust indentation in qla4xxx_mem_free
scsi: csiostor: Adjust indentation in csio_device_reset
scsi: qla2xxx: Fix the endianness of the qla82xx_get_fw_size() return type
ASoC: meson: axg-fifo: fix fifo threshold setup
percpu: Separate decrypted varaibles anytime encryption can be enabled
broken ping to ipv6 linklocal addresses on debian buster
fix up iter on short count in fuse_direct_io()
virtio-pci: check name when counting MSI-X vectors
virtio-balloon: initialize all vq callbacks
drm/amd/dm/mst: Ignore payload update failures
clk: tegra: Mark fuse clock as critical
mm/mmu_gather: invalidate TLB correctly on batch allocation failure and flush
arm64: dts: qcom: qcs404-evb: Set vdd_apc regulator in high power mode
mm/page_alloc.c: fix uninitialized memmaps on a partially populated last section
ocfs2: fix oops when writing cloned file
KVM: s390: do not clobber registers during guest reset/store status
KVM: x86: Revert "KVM: X86: Fix fpu state crash in kvm guest"
KVM: x86: Ensure guest's FPU state is loaded when accessing for emulation
KVM: x86: Handle TIF_NEED_FPU_LOAD in kvm_{load,put}_guest_fpu()
KVM: x86: Free wbinvd_dirty_mask if vCPU creation fails
KVM: x86: Don't let userspace set host-reserved cr4 bits
KVM: VMX: Add non-canonical check on writes to RTIT address MSRs
x86/KVM: Clean up host's steal time structure
x86/kvm: Cache gfn to pfn translation
x86/KVM: Make sure KVM_VCPU_FLUSH_TLB flag is not missed
x86/kvm: Introduce kvm_(un)map_gfn()
x86/kvm: Be careful not to clear KVM_VCPU_FLUSH_TLB bit
kvm/svm: PKU not currently supported
KVM: PPC: Book3S PR: Free shared page if mmu initialization fails
KVM: PPC: Book3S HV: Uninit vCPU if vcore creation fails
KVM: x86: Fix potential put_fpu() w/o load_fpu() on MPX platform
KVM: x86: Protect MSR-based index computations in fixed_msr_to_seg_unit() from Spectre-v1/L1TF attacks
KVM: x86: Protect x86_decode_insn from Spectre-v1/L1TF attacks
KVM: x86: Protect MSR-based index computations from Spectre-v1/L1TF attacks in x86.c
KVM: x86: Protect ioapic_read_indirect() from Spectre-v1/L1TF attacks
KVM: x86: Protect MSR-based index computations in pmu.h from Spectre-v1/L1TF attacks
KVM: x86: Protect ioapic_write_indirect() from Spectre-v1/L1TF attacks
KVM: x86: Protect kvm_hv_msr_[get|set]_crash_data() from Spectre-v1/L1TF attacks
KVM: x86: Protect kvm_lapic_reg_write() from Spectre-v1/L1TF attacks
KVM: x86: Protect DR-based index computations from Spectre-v1/L1TF attacks
KVM: x86: Protect pmu_intel.c from Spectre-v1/L1TF attacks
KVM: x86: Refactor prefix decoding to prevent Spectre-v1/L1TF attacks
KVM: x86: Refactor picdev_write() to prevent Spectre-v1/L1TF attacks
aio: prevent potential eventfd recursion on poll
eventfd: track eventfd_signal() recursion depth
bcache: add readahead cache policy options via sysfs interface
watchdog: fix UAF in reboot notifier handling in watchdog core code
xen/balloon: Support xend-based toolstack take two
tools/kvm_stat: Fix kvm_exit filter name
media: rc: ensure lirc is initialized before registering input device
media: iguanair: fix endpoint sanity check
drm/rect: Avoid division by zero
drm: atmel-hlcdc: prefer a lower pixel-clock than requested
drm: atmel-hlcdc: enable clock before configuring timing engine
drm: atmel-hlcdc: use double rate for pixel clock only if supported
gfs2: fix O_SYNC write handling
gfs2: move setting current->backing_dev_info
gfs2: fix gfs2_find_jhead that returns uninitialized jhead with seq 0
sunrpc: expiry_time should be seconds not timeval
mwifiex: fix unbalanced locking in mwifiex_process_country_ie()
iwlwifi: don't throw error when trying to remove IGTK
ARM: tegra: Enable PLLP bypass during Tegra124 LP1
btrfs: Correctly handle empty trees in find_first_clear_extent_bit
btrfs: flush write bio if we loop in extent_write_cache_pages
Btrfs: fix race between adding and putting tree mod seq elements and nodes
btrfs: drop log root for dropped roots
btrfs: set trans->drity in btrfs_commit_transaction
Btrfs: fix infinite loop during fsync after rename operations
Btrfs: make deduplication with range including the last block work
Btrfs: fix missing hole after hole punching and fsync when using NO_HOLES
ext4: fix race conditions in ->d_compare() and ->d_hash()
ext4: fix deadlock allocating crypto bounce page from mempool
jbd2_seq_info_next should increase position index
nfsd: fix filecache lookup
NFS: Directory page cache pages need to be locked when read
NFS: Fix memory leaks and corruption in readdir
scsi: qla2xxx: Fix unbound NVME response length
powerpc/futex: Fix incorrect user access blocking
crypto: picoxcell - adjust the position of tasklet_init and fix missed tasklet_kill
crypto: api - Fix race condition in crypto_spawn_alg
crypto: atmel-aes - Fix counter overflow in CTR mode
crypto: pcrypt - Do not clear MAY_SLEEP flag in original request
crypto: arm64/ghash-neon - bump priority to 150
crypto: ccp - set max RSA modulus size for v3 platform devices as well
crypto: hisilicon - Use the offset fields in sqe to avoid need to split scatterlists
crypto: api - fix unexpectedly getting generic implementation
selftests: bpf: Ignore FIN packets for reuseport tests
selftests: bpf: Use a temporary file in test_sockmap
selftests/bpf: Skip perf hw events test if the setup disabled it
selftests/bpf: Fix test_attach_probe
samples/bpf: Xdp_redirect_cpu fix missing tracepoint attach
samples/bpf: Don't try to remove user's homedir on clean
tc-testing: fix eBPF tests failure on linux fresh clones
libbpf: Fix realloc usage in bpf_core_find_cands
bpf, devmap: Pass lockdep expression to RCU lists
selftests/bpf: Fix perf_buffer test on systems w/ offline CPUs
riscv, bpf: Fix broken BPF tail calls
btrfs: Handle another split brain scenario with metadata uuid feature
btrfs: fix improper setting of scanned for range cyclic write cache pages
crypto: pcrypt - Avoid deadlock by using per-instance padata queues
ftrace: Protect ftrace_graph_hash with ftrace_sync
ftrace: Add comment to why rcu_dereference_sched() is open coded
tracing: Annotate ftrace_graph_notrace_hash pointer with __rcu
tracing: Annotate ftrace_graph_hash pointer with __rcu
ASoC: SOF: core: release resources on errors in probe_continue
ASoC: SOF: Introduce state machine for FW boot
scsi: qla2xxx: Fix stuck login session using prli_pend_timer
dm: fix potential for q->make_request_fn NULL pointer
dm thin metadata: use pool locking at end of dm_pool_metadata_close
dm crypt: fix benbi IV constructor crash if used in authenticated mode
dm crypt: fix GFP flags passed to skcipher_request_alloc()
dm writecache: fix incorrect flush sequence when doing SSD mode commit
dm space map common: fix to ensure new block isn't already in use
dm zoned: support zone sizes smaller than 128MiB
ARM: dma-api: fix max_pfn off-by-one error in __dma_supported()
of: Add OF_DMA_DEFAULT_COHERENT & select it on powerpc
cpufreq: Avoid creating excessively large stack frames
PM: core: Fix handling of devices deleted during system-wide resume
f2fs: fix race conditions in ->d_compare() and ->d_hash()
f2fs: fix dcache lookup of !casefolded directories
f2fs: code cleanup for f2fs_statfs_project()
f2fs: fix miscounted block limit in f2fs_statfs_project()
f2fs: choose hardlimit when softlimit is larger than hardlimit in f2fs_statfs_project()
ovl: fix lseek overflow on 32bit
ovl: fix wrong WARN_ON() in ovl_cache_update_ino()
power: supply: ltc2941-battery-gauge: fix use-after-free
power: supply: axp20x_ac_power: Fix reporting online status
cpupower: Revert library ABI changes from commit
|
||
|
Todd Kjos
|
553f33f495 |
Revert "ANDROID: binder: fix sleeping from invalid function caused by RT inheritance"
This reverts commit
|
||
|
Greg Kroah-Hartman
|
2341be6d9d |
This is the 5.4.28 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl57B4gACgkQONu9yGCS aT6KWQ//ToF4D+fDl1Muf4xuT83HnXe1yA1XFlyC54ZmEaxGFnFMSAgAvitBR7HC GEczXlvYbbVJl646ynTmX/LFz2d+V0i2zGv2QKN3xfd8GtDrAq/s+Ffhneaskk1k gKkIUzOyBq0nEAq5vXbCT4LbQDYGLw8BxxvurLim/YywSy5sfnw+hKkYE7cVVSOa rTIdt5qnuL4pxD8VeCAakoU6SajoxfFqS8pX79LC1UPY+++OaVcJjyJvM4APw0Kr e2E1BaeZxxCyY57pQY2oqhjG3cCfIcmfln19JRzMCVNo9+J3MEjZI5EUqP/Zcjwz 1V5FHqDmqMGfA9cn+CexDk79bTKW5+YOyYMEG2RJjV5alWJtvv3Wj6dRPVPpBhnJ O627IuIVGMsHuiEbjziKczaTtYYU5GTpJF+7COH0Jnud0q1w3/RjaJXspnb2Yozh L9BFqc4aonD+AyW2NXTxuuvc3hnD2YSVgLectm7LF/TbM2YFJVu4tounelFsGG6I CPH2VF0Tn+yNR2iWf8igvopvYPCjv+QFGXU6kFGxQxLQFTnXHqoO2sPF4awXx7Hv XF8LrJzPwissX5BbPyhUSIl0FEcmQi6UzSN1/6fpxVq+092OGVacMWpZvwqjUOV/ 3k/OrmcYsu7i2UUbms47YHAK0PRkL2ogKgxgcSO4aNZ7MfkXkm8= =kp1m -----END PGP SIGNATURE----- Merge 5.4.28 into android-5.4 Changes in 5.4.28 locks: fix a potential use-after-free problem when wakeup a waiter locks: reinstate locks_delete_block optimization spi: spi-omap2-mcspi: Support probe deferral for DMA channels drm/mediatek: Find the cursor plane instead of hard coding it phy: ti: gmii-sel: fix set of copy-paste errors phy: ti: gmii-sel: do not fail in case of gmii ARM: dts: dra7-l4: mark timer13-16 as pwm capable spi: qup: call spi_qup_pm_resume_runtime before suspending powerpc: Include .BTF section cifs: fix potential mismatch of UNC paths cifs: add missing mount option to /proc/mounts ARM: dts: dra7: Add "dma-ranges" property to PCIe RC DT nodes spi: pxa2xx: Add CS control clock quirk spi/zynqmp: remove entry that causes a cs glitch drm/exynos: dsi: propagate error value and silence meaningless warning drm/exynos: dsi: fix workaround for the legacy clock name drm/exynos: hdmi: don't leak enable HDMI_EN regulator if probe fails drivers/perf: fsl_imx8_ddr: Correct the CLEAR bit definition drivers/perf: arm_pmu_acpi: Fix incorrect checking of gicc pointer altera-stapl: altera_get_note: prevent write beyond end of 'key' dm bio record: save/restore bi_end_io and bi_integrity dm integrity: use dm_bio_record and dm_bio_restore riscv: avoid the PIC offset of static percpu data in module beyond 2G limits ASoC: stm32: sai: manage rebind issue spi: spi_register_controller(): free bus id on error paths riscv: Force flat memory model with no-mmu riscv: Fix range looking for kernel image memblock drm/amdgpu: clean wptr on wb when gpu recovery drm/amd/display: Clear link settings on MST disable connector drm/amd/display: fix dcc swath size calculations on dcn1 xenbus: req->body should be updated before req->state xenbus: req->err should be updated before req->state block, bfq: fix overwrite of bfq_group pointer in bfq_find_set_group() parse-maintainers: Mark as executable binderfs: use refcount for binder control devices too Revert "drm/fbdev: Fallback to non tiled mode if all tiles not present" USB: Disable LPM on WD19's Realtek Hub usb: quirks: add NO_LPM quirk for RTL8153 based ethernet adapters USB: serial: option: add ME910G1 ECM composition 0x110b usb: host: xhci-plat: add a shutdown USB: serial: pl2303: add device-id for HP LD381 usb: xhci: apply XHCI_SUSPEND_DELAY to AMD XHCI controller 1022:145c usb: typec: ucsi: displayport: Fix NULL pointer dereference usb: typec: ucsi: displayport: Fix a potential race during registration USB: cdc-acm: fix close_delay and closing_wait units in TIOCSSERIAL USB: cdc-acm: fix rounding error in TIOCSSERIAL ALSA: line6: Fix endless MIDI read loop ALSA: hda/realtek - Enable headset mic of Acer X2660G with ALC662 ALSA: hda/realtek - Enable the headset of Acer N50-600 with ALC662 ALSA: seq: virmidi: Fix running status after receiving sysex ALSA: seq: oss: Fix running status after receiving sysex ALSA: pcm: oss: Avoid plugin buffer overflow ALSA: pcm: oss: Remove WARNING from snd_pcm_plug_alloc() checks tty: fix compat TIOCGSERIAL leaking uninitialized memory tty: fix compat TIOCGSERIAL checking wrong function ptr iio: chemical: sps30: fix missing triggered buffer dependency iio: st_sensors: remap SMO8840 to LIS2DH12 iio: trigger: stm32-timer: disable master mode when stopping iio: accel: adxl372: Set iio_chan BE iio: magnetometer: ak8974: Fix negative raw values in sysfs iio: adc: stm32-dfsdm: fix sleep in atomic context iio: adc: at91-sama5d2_adc: fix differential channels in triggered mode iio: light: vcnl4000: update sampling periods for vcnl4200 iio: light: vcnl4000: update sampling periods for vcnl4040 mmc: rtsx_pci: Fix support for speed-modes that relies on tuning mmc: sdhci-of-at91: fix cd-gpios for SAMA5D2 mmc: sdhci-cadence: set SDHCI_QUIRK2_PRESET_VALUE_BROKEN for UniPhier CIFS: fiemap: do not return EINVAL if get nothing kbuild: Disable -Wpointer-to-enum-cast staging: rtl8188eu: Add device id for MERCUSYS MW150US v2 staging: greybus: loopback_test: fix poll-mask build breakage staging/speakup: fix get_word non-space look-ahead intel_th: msu: Fix the unexpected state warning intel_th: Fix user-visible error codes intel_th: pci: Add Elkhart Lake CPU support modpost: move the namespace field in Module.symvers last rtc: max8907: add missing select REGMAP_IRQ arm64: compat: Fix syscall number of compat_clock_getres xhci: Do not open code __print_symbolic() in xhci trace events btrfs: fix log context list corruption after rename whiteout error drm/amd/amdgpu: Fix GPR read from debugfs (v2) drm/lease: fix WARNING in idr_destroy stm class: sys-t: Fix the use of time_after() memcg: fix NULL pointer dereference in __mem_cgroup_usage_unregister_event mm, memcg: fix corruption on 64-bit divisor in memory.high throttling mm, memcg: throttle allocators based on ancestral memory.high mm/hotplug: fix hot remove failure in SPARSEMEM|!VMEMMAP case mm: do not allow MADV_PAGEOUT for CoW pages epoll: fix possible lost wakeup on epoll_ctl() path mm: slub: be more careful about the double cmpxchg of freelist mm, slub: prevent kmalloc_node crashes and memory leaks page-flags: fix a crash at SetPageError(THP_SWAP) x86/mm: split vmalloc_sync_all() futex: Fix inode life-time issue futex: Unbreak futex hashing ALSA: hda/realtek: Fix pop noise on ALC225 arm64: smp: fix smp_send_stop() behaviour arm64: smp: fix crash_smp_send_stop() behaviour nvmet-tcp: set MSG_MORE only if we actually have more to send drm/bridge: dw-hdmi: fix AVI frame colorimetry staging: greybus: loopback_test: fix potential path truncation staging: greybus: loopback_test: fix potential path truncations Linux 5.4.28 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I5d9d15d6236d8ab7374205c6ceda7efa7a9abb70 |
||
Christian Brauner
|
c71986d18d |
binderfs: use refcount for binder control devices too
[ Upstream commit 211b64e4b5b6bd5fdc19cd525c2cc9a90e6b0ec9 ]
Binderfs binder-control devices are cleaned up via binderfs_evict_inode
too() which will use refcount_dec_and_test(). However, we missed to set
the refcount for binderfs binder-control devices and so we underflowed
when the binderfs instance got unmounted. Pretty obvious oversight and
should have been part of the more general UAF fix. The good news is that
having test cases (suprisingly) helps.
Technically, we could detect that we're about to cleanup the
binder-control dentry in binderfs_evict_inode() and then simply clean it
up. But that makes the assumption that the binder driver itself will
never make use of a binderfs binder-control device after the binderfs
instance it belongs to has been unmounted and the superblock for it been
destroyed. While it is unlikely to ever come to this let's be on the
safe side. Performance-wise this also really doesn't matter since the
binder-control device is only every really when creating the binderfs
filesystem or creating additional binder devices. Both operations are
pretty rare.
Fixes: f0fe2c0f050d ("binder: prevent UAF for binderfs devices II")
Link: https://lore.kernel.org/r/CA+G9fYusdfg7PMfC9Xce-xLT7NiyKSbgojpK35GOm=Pf9jXXrA@mail.gmail.com
Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
Cc: stable@vger.kernel.org
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Acked-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20200311105309.1742827-1-christian.brauner@ubuntu.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
||
|
Greg Kroah-Hartman
|
6d52041543 |
This is the 5.4.25 stable release
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl5qJSMACgkQONu9yGCS
aT6/Dw//Usg9m0cBB4Ip4fYxI0EVz8BgnVe9KSdt+71gM63QCOi1ZeTS0NDMUtO0
MTsQSudUpfntrT8QHCmBwCZ5LlAAZvxDS9UOqnhkWbqNY5jGmUhH5u28RJL28dp2
8wJY6zZKg+pfOWXd81slW86uN27QZvURNEthT81sN2ucxe5DXV1gs87FILSdMpXm
I0Z3LpUoZDjpONeA6WTZqkDNA0J7Z9QjULx9/4LFi/gc0q1ApWC7FV1A9gpQHaBa
w4kDWJCGqq3mNx8Hi9BHau50VUHX5tuKvpn9RcmSl9BBba25pE5h0EVIGo8Dlq+9
T9hkVR5iXeMbFERnLm5iR0DjFHog/mOgAgUHSTTXB3BcdgIKWwUcc2gCcr2Y7KIK
CD7l+kX1nWUk4yYre7zXiG/vO9ilYgeboc8C5Qdq3XR6zaO90+8NUbCOpa2+6yEF
H7kugstb6l+iCJ1k8YJd0ORGOobl68+P79TLxAOFnkNGJRzuAoXmBH+xkqAugz1H
YKKAbE+MzW75sre7PxU1g1uPOHxfMfd5e3uRtUU5OETJv0A2kTte8ay5rqLNbe7H
QYqdfwTr2oFssnWKW5d/KdSopD5A/31/Kjkmzl6ED2xaLMEpA7zyed5p+G/Beu5s
dkPlteya8wCQ1W/KtDJRhbCauoG/NyCKIeoQitHBJwMapcEo8ZU=
=rDP8
-----END PGP SIGNATURE-----
Merge 5.4.25 into android-5.4
Changes in 5.4.25
block, bfq: get extra ref to prevent a queue from being freed during a group move
block, bfq: do not insert oom queue into position tree
ALSA: hda/realtek - Fix a regression for mute led on Lenovo Carbon X1
net: dsa: bcm_sf2: Forcibly configure IMP port for 1Gb/sec
net: stmmac: fix notifier registration
dm thin metadata: fix lockdep complaint
RDMA/core: Fix pkey and port assignment in get_new_pps
RDMA/core: Fix use of logical OR in get_new_pps
kbuild: fix 'No such file or directory' warning when cleaning
kprobes: Fix optimize_kprobe()/unoptimize_kprobe() cancellation logic
blktrace: fix dereference after null check
ALSA: hda: do not override bus codec_mask in link_get()
serial: ar933x_uart: set UART_CS_{RX,TX}_READY_ORIDE
selftests: fix too long argument
usb: gadget: composite: Support more than 500mA MaxPower
usb: gadget: ffs: ffs_aio_cancel(): Save/restore IRQ flags
usb: gadget: serial: fix Tx stall after buffer overflow
habanalabs: halt the engines before hard-reset
habanalabs: do not halt CoreSight during hard reset
habanalabs: patched cb equals user cb in device memset
drm/msm/mdp5: rate limit pp done timeout warnings
drm: msm: Fix return type of dsi_mgr_connector_mode_valid for kCFI
drm/modes: Make sure to parse valid rotation value from cmdline
drm/modes: Allow DRM_MODE_ROTATE_0 when applying video mode parameters
scsi: megaraid_sas: silence a warning
drm/msm/dsi: save pll state before dsi host is powered off
drm/msm/dsi/pll: call vco set rate explicitly
selftests: forwarding: use proto icmp for {gretap, ip6gretap}_mac testing
selftests: forwarding: vxlan_bridge_1d: fix tos value
net: atlantic: check rpc result and wait for rpc address
net: ks8851-ml: Remove 8-bit bus accessors
net: ks8851-ml: Fix 16-bit data access
net: ks8851-ml: Fix 16-bit IO operation
net: ethernet: dm9000: Handle -EPROBE_DEFER in dm9000_parse_dt()
watchdog: da9062: do not ping the hw during stop()
s390/cio: cio_ignore_proc_seq_next should increase position index
s390: make 'install' not depend on vmlinux
efi: Only print errors about failing to get certs if EFI vars are found
net/mlx5: DR, Fix matching on vport gvmi
iommu/amd: Disable IOMMU on Stoney Ridge systems
nvme/pci: Add sleep quirk for Samsung and Toshiba drives
nvme-pci: Use single IRQ vector for old Apple models
x86/boot/compressed: Don't declare __force_order in kaslr_64.c
s390/qdio: fill SL with absolute addresses
nvme: Fix uninitialized-variable warning
ice: Don't tell the OS that link is going down
x86/xen: Distribute switch variables for initialization
net: thunderx: workaround BGX TX Underflow issue
csky/mm: Fixup export invalid_pte_table symbol
csky: Set regs->usp to kernel sp, when the exception is from kernel
csky/smp: Fixup boot failed when CONFIG_SMP
csky: Fixup ftrace modify panic
csky: Fixup compile warning for three unimplemented syscalls
arch/csky: fix some Kconfig typos
selftests: forwarding: vxlan_bridge_1d: use more proper tos value
firmware: imx: scu: Ensure sequential TX
binder: prevent UAF for binderfs devices
binder: prevent UAF for binderfs devices II
ALSA: hda/realtek - Add Headset Mic supported
ALSA: hda/realtek - Add Headset Button supported for ThinkPad X1
ALSA: hda/realtek - Fix silent output on Gigabyte X570 Aorus Master
ALSA: hda/realtek - Enable the headset of ASUS B9450FA with ALC294
cifs: don't leak -EAGAIN for stat() during reconnect
cifs: fix rename() by ensuring source handle opened with DELETE bit
usb: storage: Add quirk for Samsung Fit flash
usb: quirks: add NO_LPM quirk for Logitech Screen Share
usb: dwc3: gadget: Update chain bit correctly when using sg list
usb: cdns3: gadget: link trb should point to next request
usb: cdns3: gadget: toggle cycle bit before reset endpoint
usb: core: hub: fix unhandled return by employing a void function
usb: core: hub: do error out if usb_autopm_get_interface() fails
usb: core: port: do error out if usb_autopm_get_interface() fails
vgacon: Fix a UAF in vgacon_invert_region
mm, numa: fix bad pmd by atomically check for pmd_trans_huge when marking page tables prot_numa
mm: fix possible PMD dirty bit lost in set_pmd_migration_entry()
mm, hotplug: fix page online with DEBUG_PAGEALLOC compiled but not enabled
fat: fix uninit-memory access for partial initialized inode
btrfs: fix RAID direct I/O reads with alternate csums
arm64: dts: socfpga: agilex: Fix gmac compatible
arm: dts: dra76x: Fix mmc3 max-frequency
tty:serial:mvebu-uart:fix a wrong return
tty: serial: fsl_lpuart: free IDs allocated by IDA
serial: 8250_exar: add support for ACCES cards
vt: selection, close sel_buffer race
vt: selection, push console lock down
vt: selection, push sel_lock up
media: hantro: Fix broken media controller links
media: mc-entity.c: use & to check pad flags, not ==
media: vicodec: process all 4 components for RGB32 formats
media: v4l2-mem2mem.c: fix broken links
perf intel-pt: Fix endless record after being terminated
perf intel-bts: Fix endless record after being terminated
perf cs-etm: Fix endless record after being terminated
perf arm-spe: Fix endless record after being terminated
spi: spidev: Fix CS polarity if GPIO descriptors are used
x86/pkeys: Manually set X86_FEATURE_OSPKE to preserve existing changes
s390/pci: Fix unexpected write combine on resource
s390/mm: fix panic in gup_fast on large pud
dmaengine: imx-sdma: fix context cache
dmaengine: imx-sdma: Fix the event id check to include RX event for UART6
dmaengine: tegra-apb: Fix use-after-free
dmaengine: tegra-apb: Prevent race conditions of tasklet vs free list
dm integrity: fix recalculation when moving from journal mode to bitmap mode
dm integrity: fix a deadlock due to offloading to an incorrect workqueue
dm integrity: fix invalid table returned due to argument count mismatch
dm cache: fix a crash due to incorrect work item cancelling
dm: report suspended device during destroy
dm writecache: verify watermark during resume
dm zoned: Fix reference counter initial value of chunk works
dm: fix congested_fn for request-based device
arm64: dts: meson-sm1-sei610: add missing interrupt-names
ARM: dts: ls1021a: Restore MDIO compatible to gianfar
spi: bcm63xx-hsspi: Really keep pll clk enabled
drm/virtio: make resource id workaround runtime switchable.
drm/virtio: fix resource id creation race
ASoC: topology: Fix memleak in soc_tplg_link_elems_load()
ASoC: topology: Fix memleak in soc_tplg_manifest_load()
ASoC: SOF: Fix snd_sof_ipc_stream_posn()
ASoC: intel: skl: Fix pin debug prints
ASoC: intel: skl: Fix possible buffer overflow in debug outputs
powerpc: define helpers to get L1 icache sizes
powerpc: Convert flush_icache_range & friends to C
powerpc/mm: Fix missing KUAP disable in flush_coherent_icache()
ASoC: pcm: Fix possible buffer overflow in dpcm state sysfs output
ASoC: pcm512x: Fix unbalanced regulator enable call in probe error path
ASoC: Intel: Skylake: Fix available clock counter incrementation
ASoC: dapm: Correct DAPM handling of active widgets during shutdown
spi: atmel-quadspi: fix possible MMIO window size overrun
drm/panfrost: Don't try to map on error faults
drm: kirin: Revert "Fix for hikey620 display offset problem"
drm/sun4i: Add separate DE3 VI layer formats
drm/sun4i: Fix DE2 VI layer format support
drm/sun4i: de2/de3: Remove unsupported VI layer formats
drm/i915: Program MBUS with rmw during initialization
drm/i915/selftests: Fix return in assert_mmap_offset()
phy: mapphone-mdm6600: Fix timeouts by adding wake-up handling
phy: mapphone-mdm6600: Fix write timeouts with shorter GPIO toggle interval
ARM: dts: imx6: phycore-som: fix emmc supply
arm64: dts: imx8qxp-mek: Remove unexisting Ethernet PHY
firmware: imx: misc: Align imx sc msg structs to 4
firmware: imx: scu-pd: Align imx sc msg structs to 4
firmware: imx: Align imx_sc_msg_req_cpu_start to 4
soc: imx-scu: Align imx sc msg structs to 4
Revert "RDMA/cma: Simplify rdma_resolve_addr() error flow"
RDMA/rw: Fix error flow during RDMA context initialization
RDMA/nldev: Fix crash when set a QP to a new counter but QPN is missing
RDMA/siw: Fix failure handling during device creation
RDMA/iwcm: Fix iwcm work deallocation
RDMA/core: Fix protection fault in ib_mr_pool_destroy
regulator: stm32-vrefbuf: fix a possible overshoot when re-enabling
RMDA/cm: Fix missing ib_cm_destroy_id() in ib_cm_insert_listen()
IB/hfi1, qib: Ensure RCU is locked when accessing list
ARM: imx: build v7_cpu_resume() unconditionally
ARM: dts: am437x-idk-evm: Fix incorrect OPP node names
ARM: dts: dra7xx-clocks: Fixup IPU1 mux clock parent source
ARM: dts: imx7-colibri: Fix frequency for sd/mmc
hwmon: (adt7462) Fix an error return in ADT7462_REG_VOLT()
dma-buf: free dmabuf->name in dma_buf_release()
dmaengine: coh901318: Fix a double lock bug in dma_tc_handle()
arm64: dts: meson: fix gxm-khadas-vim2 wifi
bus: ti-sysc: Fix 1-wire reset quirk
EDAC/synopsys: Do not print an error with back-to-back snprintf() calls
powerpc: fix hardware PMU exception bug on PowerVM compatibility mode systems
efi/x86: Align GUIDs to their size in the mixed mode runtime wrapper
efi/x86: Handle by-ref arguments covering multiple pages in mixed mode
efi: READ_ONCE rng seed size before munmap
block, bfq: get a ref to a group when adding it to a service tree
block, bfq: remove ifdefs from around gets/puts of bfq groups
csky: Implement copy_thread_tls
drm/virtio: module_param_named() requires linux/moduleparam.h
Linux 5.4.25
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I8ba29f273c7a2b02bfa54593f7a9087c34607cd5
|
||
|
Christian Brauner
|
f30f3aa5c3 |
binder: prevent UAF for binderfs devices II
commit f0fe2c0f050d31babcad7d65f1d550d462a40064 upstream.
This is a necessary follow up to the first fix I proposed and we merged
in 2669b8b0c79 ("binder: prevent UAF for binderfs devices"). I have been
overly optimistic that the simple fix I proposed would work. But alas,
ihold() + iput() won't work since the inodes won't survive the
destruction of the superblock.
So all we get with my prior fix is a different race with a tinier
race-window but it doesn't solve the issue. Fwiw, the problem lies with
generic_shutdown_super(). It even has this cozy Al-style comment:
if (!list_empty(&sb->s_inodes)) {
printk("VFS: Busy inodes after unmount of %s. "
"Self-destruct in 5 seconds. Have a nice day...\n",
sb->s_id);
}
On binder_release(), binder_defer_work(proc, BINDER_DEFERRED_RELEASE) is
called which punts the actual cleanup operation to a workqueue. At some
point, binder_deferred_func() will be called which will end up calling
binder_deferred_release() which will retrieve and cleanup the
binder_context attach to this struct binder_proc.
If we trace back where this binder_context is attached to binder_proc we
see that it is set in binder_open() and is taken from the struct
binder_device it is associated with. This obviously assumes that the
struct binder_device that context is attached to is _never_ freed. While
that might be true for devtmpfs binder devices it is most certainly
wrong for binderfs binder devices.
So, assume binder_open() is called on a binderfs binder devices. We now
stash away the struct binder_context associated with that struct
binder_devices:
proc->context = &binder_dev->context;
/* binderfs stashes devices in i_private */
if (is_binderfs_device(nodp)) {
binder_dev = nodp->i_private;
info = nodp->i_sb->s_fs_info;
binder_binderfs_dir_entry_proc = info->proc_log_dir;
} else {
.
.
.
proc->context = &binder_dev->context;
Now let's assume that the binderfs instance for that binder devices is
shutdown via umount() and/or the mount namespace associated with it goes
away. As long as there is still an fd open for that binderfs binder
device things are fine. But let's assume we now close the last fd for
that binderfs binder device. Now binder_release() is called and punts to
the workqueue. Assume that the workqueue has quite a bit of stuff to do
and doesn't get to cleaning up the struct binder_proc and the associated
struct binder_context with it for that binderfs binder device right
away. In the meantime, the VFS is killing the super block and is
ultimately calling sb->evict_inode() which means it will call
binderfs_evict_inode() which does:
static void binderfs_evict_inode(struct inode *inode)
{
struct binder_device *device = inode->i_private;
struct binderfs_info *info = BINDERFS_I(inode);
clear_inode(inode);
if (!S_ISCHR(inode->i_mode) || !device)
return;
mutex_lock(&binderfs_minors_mutex);
--info->device_count;
ida_free(&binderfs_minors, device->miscdev.minor);
mutex_unlock(&binderfs_minors_mutex);
kfree(device->context.name);
kfree(device);
}
thereby freeing the struct binder_device including struct
binder_context.
Now the workqueue finally has time to get around to cleaning up struct
binder_proc and is now trying to access the associate struct
binder_context. Since it's already freed it will OOPs.
Fix this by introducing a refounct on binder devices.
This is an alternative fix to
|
||
|
Christian Brauner
|
a2d63e7734 |
binder: prevent UAF for binderfs devices
commit 2669b8b0c798fbe1a31d49e07aa33233d469ad9b upstream.
On binder_release(), binder_defer_work(proc, BINDER_DEFERRED_RELEASE) is
called which punts the actual cleanup operation to a workqueue. At some
point, binder_deferred_func() will be called which will end up calling
binder_deferred_release() which will retrieve and cleanup the
binder_context attach to this struct binder_proc.
If we trace back where this binder_context is attached to binder_proc we
see that it is set in binder_open() and is taken from the struct
binder_device it is associated with. This obviously assumes that the
struct binder_device that context is attached to is _never_ freed. While
that might be true for devtmpfs binder devices it is most certainly
wrong for binderfs binder devices.
So, assume binder_open() is called on a binderfs binder devices. We now
stash away the struct binder_context associated with that struct
binder_devices:
proc->context = &binder_dev->context;
/* binderfs stashes devices in i_private */
if (is_binderfs_device(nodp)) {
binder_dev = nodp->i_private;
info = nodp->i_sb->s_fs_info;
binder_binderfs_dir_entry_proc = info->proc_log_dir;
} else {
.
.
.
proc->context = &binder_dev->context;
Now let's assume that the binderfs instance for that binder devices is
shutdown via umount() and/or the mount namespace associated with it goes
away. As long as there is still an fd open for that binderfs binder
device things are fine. But let's assume we now close the last fd for
that binderfs binder device. Now binder_release() is called and punts to
the workqueue. Assume that the workqueue has quite a bit of stuff to do
and doesn't get to cleaning up the struct binder_proc and the associated
struct binder_context with it for that binderfs binder device right
away. In the meantime, the VFS is killing the super block and is
ultimately calling sb->evict_inode() which means it will call
binderfs_evict_inode() which does:
static void binderfs_evict_inode(struct inode *inode)
{
struct binder_device *device = inode->i_private;
struct binderfs_info *info = BINDERFS_I(inode);
clear_inode(inode);
if (!S_ISCHR(inode->i_mode) || !device)
return;
mutex_lock(&binderfs_minors_mutex);
--info->device_count;
ida_free(&binderfs_minors, device->miscdev.minor);
mutex_unlock(&binderfs_minors_mutex);
kfree(device->context.name);
kfree(device);
}
thereby freeing the struct binder_device including struct
binder_context.
Now the workqueue finally has time to get around to cleaning up struct
binder_proc and is now trying to access the associate struct
binder_context. Since it's already freed it will OOPs.
Fix this by holding an additional reference to the inode that is only
released once the workqueue is done cleaning up struct binder_proc. This
is an easy alternative to introducing separate refcounting on struct
binder_device which we can always do later if it becomes necessary.
This is an alternative fix to
|
||
|
Greg Kroah-Hartman
|
83003512ab |
This is the 5.4.17 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl41RloACgkQONu9yGCS aT4LIQ//eBnfGLQqvZsaxI7N72c1rke1NqiIgbeljoJxpebjn5EES32POGa+WnEY QTkYx4VrKopuxGc2YvzW+uzYct1oLswJGGiR+iuRdfcU7EhB0yJDJVA9ib7NYUdz H9lQQU6cQBjNC8vj00IiehySgrCesLqmgy6gwYUxktSKQSWSHCoiKNJVqw8FlOdR ae5Go4DdYOje7KiTLivZ5xEEc+dqFmBdZzyiQ8AV/9tHatNVyCfyc3+a03ZwuYVx UOXhsrij5DqJU7hFSFIKUWNLzA/i+toScZjG31iAkGlWekhnjaDTcLdkhMlRTwQt u1PevrLD2uG8xREXNQ6avaPBsUPi9aUgjHBFgsZxnCgRXt9LKKoCZuBi86vQMeWu Lmi/0sOfBuYR5NmhE1LqAQtPsjGdPJLV2/87ua81mjGmRWBBG+SacNvcrwzuMI7u 9yFUFzOJfNcAPS4q3lifJLjN27JW+/ttgkSjt/Cie69KA3cZ7K1H21bXHREef+3H YvExYgxyb+yjWGKQemBoDpPB70ER/MRU5kJ8Dd3nN9r4S2rw8JsmotS2a2jTKpd5 4Smmg6q/e1+jRBbFIx1LKRb2eIRkU7EmlJ1umMonenML7hSA7FFGN/qNYlbNWYpg PcOrENcsaQxoqiVNsQTx9Cu6Vq5PDSmXs600ccoH1KntIsfjD0c= =ywm4 -----END PGP SIGNATURE----- Merge 5.4.17 into android-5.4 Changes in 5.4.17 Bluetooth: btusb: fix non-atomic allocation in completion handler orinoco_usb: fix interface sanity check rsi_91x_usb: fix interface sanity check usb: dwc3: pci: add ID for the Intel Comet Lake -V variant usb: host: xhci-tegra: set MODULE_FIRMWARE for tegra186 USB: serial: ir-usb: add missing endpoint sanity check USB: serial: ir-usb: fix link-speed handling USB: serial: ir-usb: fix IrLAP framing usb: dwc3: turn off VBUS when leaving host mode usb: typec: wcove: fix "op-sink-microwatt" default that was in mW usb: typec: fusb302: fix "op-sink-microwatt" default that was in mW staging: most: net: fix buffer overflow staging: wlan-ng: ensure error return is actually returned staging: vt6656: correct packet types for CTS protect, mode. staging: vt6656: use NULLFUCTION stack on mac80211 staging: vt6656: Fix false Tx excessive retries reporting. serial: 8250_bcm2835aux: Fix line mismatch on driver unbind serial: imx: fix a race condition in receive path debugfs: Return -EPERM when locked down component: do not dereference opaque pointer in debugfs binder: fix log spam for existing debugfs file creation. mei: hdcp: bind only with i915 on the same PCH mei: me: add comet point (lake) H device ids iio: adc: stm32-dfsdm: fix single conversion iio: st_gyro: Correct data for LSM9DS0 gyro driver core: Fix test_async_driver_probe if NUMA is disabled crypto: chelsio - fix writing tfm flags to wrong place CIFS: Fix task struct use-after-free on reconnect cifs: set correct max-buffer-size for smb2_ioctl_init() cifs: Fix memory allocation in __smb2_handle_cancelled_cmd() ath9k: fix storage endpoint lookup brcmfmac: fix interface sanity check rtl8xxxu: fix interface sanity check zd1211rw: fix storage endpoint lookup net_sched: ematch: reject invalid TCF_EM_SIMPLE net_sched: fix ops->bind_class() implementations net_sched: walk through all child classes in tc_bind_tclass() net: socionext: fix possible user-after-free in netsec_process_rx net: socionext: fix xdp_result initialization in netsec_process_rx udp: segment looped gso packets correctly mlxsw: minimal: Fix an error handling path in 'mlxsw_m_port_create()' net: include struct nhmsg size in nh nlmsg size rxrpc: Fix use-after-free in rxrpc_receive_data() HID: multitouch: Add LG MELF0410 I2C touchscreen support arc: eznps: fix allmodconfig kconfig warning HID: Add quirk for Xin-Mo Dual Controller HID: ite: Add USB id match for Acer SW5-012 keyboard dock HID: asus: Ignore Asus vendor-page usage-code 0xff events HID: Add quirk for incorrect input length on Lenovo Y720 HID: intel-ish-hid: ipc: add CMP device id HID: wacom: Recognize new MobileStudio Pro PID ASoC: SOF: fix fault at driver unload after failed probe ASoC: SOF: Intel: hda: hda-dai: fix oops on hda_link .hw_free drivers/hid/hid-multitouch.c: fix a possible null pointer access. phy: qcom-qmp: Increase PHY ready timeout ASoC: fsl_audmix: add missed pm_runtime_disable ASoC: topology: Prevent use-after-free in snd_soc_get_pcm_runtime() phy: cpcap-usb: Prevent USB line glitches from waking up modem HID: intel-ish-hid: ipc: Add Tiger Lake PCI device ID watchdog: max77620_wdt: fix potential build errors watchdog: rn5t618_wdt: fix module aliases watchdog: orion: fix platform_get_irq() complaints usb: musb: jz4740: Silence error if code is -EPROBE_DEFER can: tcan4x5x: tcan4x5x_parse_config(): reset device before register access spi: spi-dw: Add lock protect dw_spi rx/tx to prevent concurrent calls net: Google gve: Remove dma_wmb() before ringing doorbell drivers/net/b44: Change to non-atomic bit operations on pwol_mask net: wan: sdla: Fix cast from pointer to integer of different size gpio: max77620: Add missing dependency on GPIOLIB_IRQCHIP iommu/dma: fix variable 'cookie' set but not used drm/amd/display: Reduce HDMI pixel encoding if max clock is exceeded stmmac: debugfs entry name is not be changed when udev rename device name. atm: eni: fix uninitialized variable warning HID: steam: Fix input device disappearing extcon-intel-cht-wc: Don't reset USB data connection at probe ASoC: Intel: cht_bsw_rt5645: Add quirk for boards using pmc_plt_clk_0 drm/amdgpu/SRIOV: add navi12 pci id for SRIOV (v2) libbpf: Fix BTF-defined map's __type macro handling of arrays staging: mt7621-pci: add quirks for 'E2' revision using 'soc_device_attribute' platform/x86: dell-laptop: disable kbd backlight on Inspiron 10xx PCI: Add DMA alias quirk for Intel VCA NTB media: dvbsky: add support for eyeTV Geniatech T2 lite bus: ti-sysc: Handle mstandby quirk and use it for musb bus: ti-sysc: Use swsup quirks also for am335x musb spi: pxa2xx: Add support for Intel Comet Lake-H iommu/amd: Support multiple PCI DMA aliases in device table iommu/amd: Support multiple PCI DMA aliases in IRQ Remapping perf/imx_ddr: Add enhanced AXI ID filter support mfd: intel-lpss: Add Intel Comet Lake PCH-H PCI IDs ARM: config: aspeed-g5: Enable 8250_DW quirks ARM: OMAP2+: SmartReflex: add omap_sr_pdata definition mmc: sdhci-pci: Quirk for AMD SDHC Device 0x7906 mmc: sdhci-pci: Add support for Intel JSL bus: ti-sysc: Add module enable quirk for audio AESS usb-storage: Disable UAS on JMicron SATA enclosure ALSA: hda/realtek - Move some alc236 pintbls to fallback table Bluetooth: Allow combination of BDADDR_PROPERTY and INVALID_BDADDR quirks Bluetooth: btbcm: Use the BDADDR_PROPERTY quirk bus: ti-sysc: Fix missing force mstandby quirk handling rsi: fix use-after-free on failed probe and unbind rsi: fix use-after-free on probe errors rsi: fix memory leak on failed URB submission rsi: fix non-atomic allocation in completion handler crypto: af_alg - Use bh_lock_sock in sk_destruct crypto: vmx - reject xts inputs that are too short crypto: caam - do not reset pointer size from MCFGR register crypto: pcrypt - Fix user-after-free on module unload KVM: arm64: Write arch.mdcr_el2 changes since last vcpu_load on VHE Revert "um: Enable CONFIG_CONSTRUCTORS" power/supply: ingenic-battery: Don't change scale if there's only one Linux 5.4.17 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I03dc4a2a426ff7700c26560c294bcbfc66f26e38 |
||
Martin Fuzzey
|
7d46883724 |
binder: fix log spam for existing debugfs file creation.
commit eb143f8756e77c8fcfc4d574922ae9efd3a43ca9 upstream. Since commit |
||
|
Greg Kroah-Hartman
|
7dc1159904 |
This is the 5.4.4 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl35Ju4ACgkQONu9yGCS aT7IMQ//Vs+kE7VCDeHfzNu4ivh3+X0bleYWo/OPxNQRFx7IL4Lb2jVjWrMnAGld u8H31nVaL28bhJAcQJg+O/OD3AXWQ8nzRKixfVfwd669Zv1ggaLM8MW9xuTBwmQs ciFrQ4GirfjvUP0VdkpsSLp+bbi61nkqGB4WHgX3gL+8LWxtpE8nFlh+8P+3TT9Z h4BuYQHhGF8JyhOFKhfWbWAFUoHLsR7Aa7TPOeQPXGfzWBaSfISA/UVo6N7QGpVw 4DP5rc4Wb+tzNAJHkkgzbSDzuM6L6BHrO3SQCisd0Viw9XYO9M0U9NVbExtu9x9l M/sqE61cX1AxUmjstdgca37vyHCntJ+wMT7WRnOBVJfodZDjB/6wzPz8rWIZrSX+ +uXSJF8Xpp5FuvB0td0CQoyUsnrMDnwWbjnMnlVXY6mPcgD5fgB9dTDJN3FEQ8t6 MixN3JBy1KseY9ihe9cINaR0CBKqyogOwbGrqqw3XJNWzpJ5xgxhLuSc2PyuDLwZ bDaj7K9Ukx4n0QzXWvW5pZTQi+yNVc7DUVOKFDXTf2xR2/KvEVNW25gL7oBxrTTu q5gw4bBkO0KsbgofTMWUyUfO3aYhDqc7H4yfRRbc/Q08hiJHORFC2jhLXG9oubNN QrZ4AxJvzRSYl5vwrVpHW9vnlPe5SuJvRbkMN8164togc9BMNbc= =qUmE -----END PGP SIGNATURE----- Merge 5.4.4 into android-5.4 Changes in 5.4.4 usb: gadget: configfs: Fix missing spin_lock_init() usb: gadget: pch_udc: fix use after free nvme: Namepace identification descriptor list is optional Revert "nvme: Add quirk for Kingston NVME SSD running FW E8FK11.T" scsi: lpfc: Fix bad ndlp ptr in xri aborted handling scsi: zfcp: trace channel log even for FCP command responses scsi: qla2xxx: Do command completion on abort timeout scsi: qla2xxx: Fix driver unload hang scsi: qla2xxx: Fix double scsi_done for abort path scsi: qla2xxx: Fix memory leak when sending I/O fails compat_ioctl: add compat_ptr_ioctl() ceph: fix compat_ioctl for ceph_dir_operations media: venus: remove invalid compat_ioctl32 handler USB: uas: honor flag to avoid CAPACITY16 USB: uas: heed CAPACITY_HEURISTICS USB: documentation: flags on usb-storage versus UAS usb: Allow USB device to be warm reset in suspended state usb: host: xhci-tegra: Correct phy enable sequence binder: fix incorrect calculation for num_valid staging: exfat: fix multiple definition error of `rename_file' staging: rtl8188eu: fix interface sanity check staging: rtl8712: fix interface sanity check staging: vchiq: call unregister_chrdev_region() when driver registration fails staging: gigaset: fix general protection fault on probe staging: gigaset: fix illegal free on probe errors staging: gigaset: add endpoint-type sanity check usb: xhci: only set D3hot for pci device xhci: Fix memory leak in xhci_add_in_port() xhci: fix USB3 device initiated resume race with roothub autosuspend xhci: Increase STS_HALT timeout in xhci_suspend() xhci: handle some XHCI_TRUST_TX_LENGTH quirks cases as default behaviour. xhci: make sure interrupts are restored to correct state interconnect: qcom: sdm845: Walk the list safely on node removal interconnect: qcom: qcs404: Walk the list safely on node removal usb: common: usb-conn-gpio: Don't log an error on probe deferral ARM: dts: pandora-common: define wl1251 as child node of mmc3 iio: adis16480: Add debugfs_reg_access entry iio: imu: st_lsm6dsx: fix ODR check in st_lsm6dsx_write_raw iio: adis16480: Fix scales factors iio: humidity: hdc100x: fix IIO_HUMIDITYRELATIVE channel reporting iio: imu: inv_mpu6050: fix temperature reporting using bad unit iio: adc: ad7606: fix reading unnecessary data from device iio: adc: ad7124: Enable internal reference USB: atm: ueagle-atm: add missing endpoint check USB: idmouse: fix interface sanity checks USB: serial: io_edgeport: fix epic endpoint lookup usb: roles: fix a potential use after free USB: adutux: fix interface sanity check usb: core: urb: fix URB structure initialization function usb: mon: Fix a deadlock in usbmon between mmap and read tpm: add check after commands attribs tab allocation tpm: Switch to platform_get_irq_optional() EDAC/altera: Use fast register IO for S10 IRQs brcmfmac: disable PCIe interrupts before bus reset mtd: spear_smi: Fix Write Burst mode mtd: rawnand: Change calculating of position page containing BBM virt_wifi: fix use-after-free in virt_wifi_newlink() virtio-balloon: fix managed page counts when migrating pages between zones usb: dwc3: pci: add ID for the Intel Comet Lake -H variant usb: dwc3: gadget: Fix logical condition usb: dwc3: gadget: Clear started flag for non-IOC usb: dwc3: ep0: Clear started flag on completion phy: renesas: rcar-gen3-usb2: Fix sysfs interface of "role" usb: typec: fix use after free in typec_register_port() iwlwifi: pcie: fix support for transmitting SKBs with fraglist btrfs: check page->mapping when loading free space cache btrfs: use btrfs_block_group_cache_done in update_block_group btrfs: use refcount_inc_not_zero in kill_all_nodes Btrfs: fix metadata space leak on fixup worker failure to set range as delalloc Btrfs: fix negative subv_writers counter and data space leak after buffered write btrfs: Avoid getting stuck during cyclic writebacks btrfs: Remove btrfs_bio::flags member Btrfs: send, skip backreference walking for extents with many references btrfs: record all roots for rename exchange on a subvol rtlwifi: rtl8192de: Fix missing code to retrieve RX buffer address rtlwifi: rtl8192de: Fix missing callback that tests for hw release of buffer rtlwifi: rtl8192de: Fix missing enable interrupt flag lib: raid6: fix awk build warnings ovl: fix lookup failure on multi lower squashfs ovl: fix corner case of non-unique st_dev;st_ino ovl: relax WARN_ON() on rename to self hwrng: omap - Fix RNG wait loop timeout dm writecache: handle REQ_FUA dm zoned: reduce overhead of backing device checks workqueue: Fix spurious sanity check failures in destroy_workqueue() workqueue: Fix pwq ref leak in rescuer_thread() ASoC: rt5645: Fixed buddy jack support. ASoC: rt5645: Fixed typo for buddy jack support. ASoC: Jack: Fix NULL pointer dereference in snd_soc_jack_report ASoC: fsl_audmix: Add spin lock to protect tdms md: improve handling of bio with REQ_PREFLUSH in md_flush_request() blk-mq: avoid sysfs buffer overflow with too many CPU cores cgroup: pids: use atomic64_t for pids->limit wil6210: check len before memcpy() calls ar5523: check NULL before memcpy() in ar5523_cmd() s390/mm: properly clear _PAGE_NOEXEC bit when it is not supported media: hantro: Fix s_fmt for dynamic resolution changes media: hantro: Fix motion vectors usage condition media: hantro: Fix picture order count table enable media: vimc: sen: remove unused kthread_sen field media: bdisp: fix memleak on release media: radio: wl1273: fix interrupt masking on release media: cec.h: CEC_OP_REC_FLAG_ values were swapped cpuidle: Do not unset the driver if it is there already cpuidle: teo: Ignore disabled idle states that are too deep cpuidle: teo: Rename local variable in teo_select() cpuidle: teo: Consider hits and misses metrics of disabled states cpuidle: teo: Fix "early hits" handling for disabled idle states cpuidle: use first valid target residency as poll time erofs: zero out when listxattr is called with no xattr perf tests: Fix out of bounds memory access drm/panfrost: Open/close the perfcnt BO powerpc/perf: Disable trace_imc pmu intel_th: Fix a double put_device() in error path intel_th: pci: Add Ice Lake CPU support intel_th: pci: Add Tiger Lake CPU support PM / devfreq: Lock devfreq in trans_stat_show cpufreq: powernv: fix stack bloat and hard limit on number of CPUs ALSA: fireface: fix return value in error path of isochronous resources reservation ALSA: oxfw: fix return value in error path of isochronous resources reservation ALSA: hda/realtek - Line-out jack doesn't work on a Dell AIO ACPI / utils: Move acpi_dev_get_first_match_dev() under CONFIG_ACPI ACPI: LPSS: Add LNXVIDEO -> BYT I2C7 to lpss_device_links ACPI: LPSS: Add LNXVIDEO -> BYT I2C1 to lpss_device_links ACPI: LPSS: Add dmi quirk for skipping _DEP check for some device-links ACPI / hotplug / PCI: Allocate resources directly under the non-hotplug bridge ACPI: OSL: only free map once in osl.c ACPI: bus: Fix NULL pointer check in acpi_bus_get_private_data() ACPI: EC: Rework flushing of pending work ACPI: PM: Avoid attaching ACPI PM domain to certain devices pinctrl: rza2: Fix gpio name typos pinctrl: armada-37xx: Fix irq mask access in armada_37xx_irq_set_type() pinctrl: samsung: Add of_node_put() before return in error path pinctrl: samsung: Fix device node refcount leaks in Exynos wakeup controller init pinctrl: samsung: Fix device node refcount leaks in S3C24xx wakeup controller init pinctrl: samsung: Fix device node refcount leaks in init code pinctrl: samsung: Fix device node refcount leaks in S3C64xx wakeup controller init mmc: host: omap_hsmmc: add code for special init of wl1251 to get rid of pandora_wl1251_init_card ARM: dts: omap3-tao3530: Fix incorrect MMC card detection GPIO polarity RDMA/core: Fix ib_dma_max_seg_size() ppdev: fix PPGETTIME/PPSETTIME ioctls stm class: Lose the protocol driver when dropping its reference coresight: Serialize enabling/disabling a link device. powerpc: Allow 64bit VDSO __kernel_sync_dicache to work across ranges >4GB powerpc/xive: Prevent page fault issues in the machine crash handler powerpc: Allow flush_icache_range to work across ranges >4GB powerpc/xive: Skip ioremap() of ESB pages for LSI interrupts video/hdmi: Fix AVI bar unpack quota: Check that quota is not dirty before release ext2: check err when partial != NULL seccomp: avoid overflow in implicit constant conversion quota: fix livelock in dquot_writeback_dquots ext4: Fix credit estimate for final inode freeing reiserfs: fix extended attributes on the root directory scsi: qla2xxx: Fix SRB leak on switch command timeout scsi: qla2xxx: Fix a dma_pool_free() call Revert "scsi: qla2xxx: Fix memory leak when sending I/O fails" iio: ad7949: kill pointless "readback"-handling code iio: ad7949: fix channels mixups omap: pdata-quirks: revert pandora specific gpiod additions omap: pdata-quirks: remove openpandora quirks for mmc3 and wl1251 powerpc: Avoid clang warnings around setjmp and longjmp powerpc: Fix vDSO clock_getres() mm, memfd: fix COW issue on MAP_PRIVATE and F_SEAL_FUTURE_WRITE mappings mfd: rk808: Fix RK818 ID template mm: memcg/slab: wait for !root kmem_cache refcnt killing on root kmem_cache destruction ext4: work around deleting a file with i_nlink == 0 safely firmware: qcom: scm: Ensure 'a0' status code is treated as signed s390/smp,vdso: fix ASCE handling s390/kaslr: store KASLR offset for early dumps mm/shmem.c: cast the type of unmap_start to u64 powerpc: Define arch_is_kernel_initmem_freed() for lockdep USB: dummy-hcd: increase max number of devices to 32 rtc: disable uie before setting time and enable after splice: only read in as much information as there is pipe buffer space ext4: fix a bug in ext4_wait_for_tail_page_commit ext4: fix leak of quota reservations blk-mq: make sure that line break can be printed workqueue: Fix missing kfree(rescuer) in destroy_workqueue() r8169: fix rtl_hw_jumbo_disable for RTL8168evl EDAC/ghes: Do not warn when incrementing refcount on 0 Linux 5.4.4 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I8949a5fb2fbd836ce34907e70906e3aeb8a58b7c |
||
Todd Kjos
|
34d8a89fe1 |
binder: fix incorrect calculation for num_valid
commit 16981742717b04644a41052570fb502682a315d2 upstream.
For BINDER_TYPE_PTR and BINDER_TYPE_FDA transactions, the
num_valid local was calculated incorrectly causing the
range check in binder_validate_ptr() to miss out-of-bounds
offsets.
Fixes:
|
||
|
Greg Kroah-Hartman
|
7e59225e4e |
This is the 5.4.3 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl3zQekACgkQONu9yGCS aT4v0xAAi39hk/9NMVQkOVJEAw7KtrqaidZ21c8DIZKwEEdmh5cgVTKjuF+PggXR VrSPSMuvCK9Xp4p4ZUPNr6WFYATxfUINZFvRc5gh1c9XtHrxjlWX9oi4XQ4a3zWC 56Ak17gCt42eWcArHUslPQLFnq3XBDARs7qK8gv+6Vxt8w/3EaPkm4MKB8nGkdnK ItfkxGWnkKyUnwsE/01p1iR+LrbxnALXS+OM1izWBBA6ex2Zl6QDmmwZXXgKHOVt RAdO04t8k9jKrydo43DF/icUrYZuLbpIHaKIV6T0YH1Hco5qTZAz5+REmZelcEDH /vBNVxTVma5vAdYQsztEITv+qKNEkM2i+xoSoGierE8EPbRqo/ed3tDNdNxTmMcq zku+yztWm5VGicSbsGKRElwXt8+eyduIyEHyGKt5AON7n0NRDBmGl+HCnEU7Agoy XKJ+aDHjWK4AAYZL9osZ0MQ3QF55Dpaylijjnihc9VlMTVOTDY49MD8XSfoj0VFq pOdH7NWNDvh5eJfd+DQQHMtlMxN2dMppRlclh/ecXZ+2r6oKB/E11D9lzCguFZtQ HR1vDHl6HpnP08MXn++AZj0/hCx+zS/GzXJccGqjP5GWH10BAA+Kfig+ooo/t9We SJc8WcySU+0lmJN8yegcEintDyv/HkPQzJApRw3P0iL0t8oN8Ac= =8yzT -----END PGP SIGNATURE----- Merge 5.4.3 into android-5.4 Changes in 5.4.3 rsi: release skb if rsi_prepare_beacon fails arm64: tegra: Fix 'active-low' warning for Jetson TX1 regulator arm64: tegra: Fix 'active-low' warning for Jetson Xavier regulator perf scripts python: exported-sql-viewer.py: Fix use of TRUE with SQLite sparc64: implement ioremap_uc lp: fix sparc64 LPSETTIMEOUT ioctl time: Zero the upper 32-bits in __kernel_timespec on 32-bit mailbox: tegra: Fix superfluous IRQ error message staging/octeon: Use stubs for MIPS && !CAVIUM_OCTEON_SOC usb: gadget: u_serial: add missing port entry locking serial: 8250-mtk: Use platform_get_irq_optional() for optional irq tty: serial: fsl_lpuart: use the sg count from dma_map_sg tty: serial: msm_serial: Fix flow control serial: pl011: Fix DMA ->flush_buffer() serial: serial_core: Perform NULL checks for break_ctl ops serial: stm32: fix clearing interrupt error flags serial: 8250_dw: Avoid double error messaging when IRQ absent serial: ifx6x60: add missed pm_runtime_disable mwifiex: Re-work support for SDIO HW reset io_uring: fix dead-hung for non-iter fixed rw io_uring: transform send/recvmsg() -ERESTARTSYS to -EINTR fuse: fix leak of fuse_io_priv fuse: verify nlink fuse: verify write return fuse: verify attributes io_uring: fix missing kmap() declaration on powerpc io_uring: ensure req->submit is copied when req is deferred SUNRPC: Avoid RPC delays when exiting suspend ALSA: hda/realtek - Enable internal speaker of ASUS UX431FLC ALSA: hda/realtek - Enable the headset-mic on a Xiaomi's laptop ALSA: hda/realtek - Dell headphone has noise on unmute for ALC236 ALSA: hda/realtek - Fix inverted bass GPIO pin on Acer 8951G ALSA: pcm: oss: Avoid potential buffer overflows ALSA: hda - Add mute led support for HP ProBook 645 G4 ALSA: hda: Modify stream stripe mask only when needed soc: mediatek: cmdq: fixup wrong input order of write api Input: synaptics - switch another X1 Carbon 6 to RMI/SMbus Input: synaptics-rmi4 - re-enable IRQs in f34v7_do_reflash Input: synaptics-rmi4 - don't increment rmiaddr for SMBus transfers Input: goodix - add upside-down quirk for Teclast X89 tablet coresight: etm4x: Fix input validation for sysfs. Input: Fix memory leak in psxpad_spi_probe media: rc: mark input device as pointing stick x86/mm/32: Sync only to VMALLOC_END in vmalloc_sync_all() x86/PCI: Avoid AMD FCH XHCI USB PME# from D0 defect CIFS: Fix NULL-pointer dereference in smb2_push_mandatory_locks CIFS: Fix SMB2 oplock break processing tty: vt: keyboard: reject invalid keycodes can: slcan: Fix use-after-free Read in slcan_open nfsd: Ensure CLONE persists data and metadata changes to the target file nfsd: restore NFSv3 ACL support kernfs: fix ino wrap-around detection jbd2: Fix possible overflow in jbd2_log_space_left() drm/msm: fix memleak on release drm: damage_helper: Fix race checking plane->state->fb drm/i810: Prevent underflow in ioctl arm64: Validate tagged addresses in access_ok() called from kernel threads arm64: dts: exynos: Revert "Remove unneeded address space mapping for soc node" KVM: PPC: Book3S HV: XIVE: Free previous EQ page when setting up a new one KVM: PPC: Book3S HV: XIVE: Fix potential page leak on error path KVM: PPC: Book3S HV: XIVE: Set kvm->arch.xive when VPs are allocated KVM: nVMX: Always write vmcs02.GUEST_CR3 during nested VM-Enter KVM: arm/arm64: vgic: Don't rely on the wrong pending table KVM: x86: do not modify masked bits of shared MSRs KVM: x86: fix presentation of TSX feature in ARCH_CAPABILITIES KVM: x86: Remove a spurious export of a static function KVM: x86: Grab KVM's srcu lock when setting nested state crypto: crypto4xx - fix double-free in crypto4xx_destroy_sdr crypto: atmel-aes - Fix IV handling when req->nbytes < ivsize crypto: af_alg - cast ki_complete ternary op to int crypto: geode-aes - switch to skcipher for cbc(aes) fallback crypto: ccp - fix uninitialized list head crypto: ecdh - fix big endian bug in ECC library crypto: user - fix memory leak in crypto_report crypto: user - fix memory leak in crypto_reportstat spi: spi-fsl-qspi: Clear TDH bits in FLSHCR register spi: stm32-qspi: Fix kernel oops when unbinding driver spi: atmel: Fix CS high support spi: Fix SPI_CS_HIGH setting when using native and GPIO CS spi: Fix NULL pointer when setting SPI_CS_HIGH for GPIO CS can: ucan: fix non-atomic allocation in completion handler RDMA/qib: Validate ->show()/store() callbacks before calling them rfkill: allocate static minor bdev: Factor out bdev revalidation into a common helper bdev: Refresh bdev size for disks without partitioning iomap: Fix pipe page leakage during splicing thermal: Fix deadlock in thermal thermal_zone_device_check vcs: prevent write access to vcsu devices Revert "serial/8250: Add support for NI-Serial PXI/PXIe+485 devices" binder: Fix race between mmap() and binder_alloc_print_pages() binder: Prevent repeated use of ->mmap() via NULL mapping binder: Handle start==NULL in binder_update_page_range() KVM: x86: fix out-of-bounds write in KVM_GET_EMULATED_CPUID (CVE-2019-19332) ALSA: hda - Fix pending unsol events at shutdown cpufreq: imx-cpufreq-dt: Correct i.MX8MN's default speed grade value md/raid0: Fix an error message in raid0_make_request() drm/mcde: Fix an error handling path in 'mcde_probe()' watchdog: aspeed: Fix clock behaviour for ast2600 EDAC/ghes: Fix locking and memory barrier issues perf script: Fix invalid LBR/binary mismatch error kselftest: Fix NULL INSTALL_PATH for TARGETS runlist Linux 5.4.3 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I4dabe2d29ae191e3c99ade22b1c385f68b5a77d4 |
||
|
Jann Horn
|
e8f669921e |
binder: Handle start==NULL in binder_update_page_range()
commit 2a9edd056ed4fbf9d2e797c3fc06335af35bccc4 upstream.
The old loop wouldn't stop when reaching `start` if `start==NULL`, instead
continuing backwards to index -1 and crashing.
Luckily you need to be highly privileged to map things at NULL, so it's not
a big problem.
Fix it by adjusting the loop so that the loop variable is always in bounds.
This patch is deliberately minimal to simplify backporting, but IMO this
function could use a refactor. The jump labels in the second loop body are
horrible (the error gotos should be jumping to free_range instead), and
both loops would look nicer if they just iterated upwards through indices.
And the up_read()+mmput() shouldn't be duplicated like that.
Cc: stable@vger.kernel.org
Fixes:
|
||
|
Jann Horn
|
015c08bc70 |
binder: Prevent repeated use of ->mmap() via NULL mapping
commit a7a74d7ff55a0c657bc46238b050460b9eacea95 upstream. binder_alloc_mmap_handler() attempts to detect the use of ->mmap() on a binder_proc whose binder_alloc has already been initialized by checking whether alloc->buffer is non-zero. Before commit |
||
|
Jann Horn
|
6e0efd9e9e |
binder: Fix race between mmap() and binder_alloc_print_pages()
commit 8eb52a1ee37aafd9b796713aa0b3ab9cbc455be3 upstream.
binder_alloc_print_pages() iterates over
alloc->pages[0..alloc->buffer_size-1] under alloc->mutex.
binder_alloc_mmap_handler() writes alloc->pages and alloc->buffer_size
without holding that lock, and even writes them before the last bailout
point.
Unfortunately we can't take the alloc->mutex in the ->mmap() handler
because mmap_sem can be taken while alloc->mutex is held.
So instead, we have to locklessly check whether the binder_alloc has been
fully initialized with binder_alloc_get_vma(), like in
binder_alloc_new_buf_locked().
Fixes:
|
||
|
Todd Kjos
|
aefd2d632e |
ANDROID: binder: fix sleeping from invalid function caused by RT inheritance
When changing a thread's scheduling priority, binder calls sched_setscheduler_nocheck() while holding the node lock and proc inner lock. This was safe until v5.3 when a change was introduced where cpuset_read_lock() is called in this path which can sleep: commit |
||
|
Greg Kroah-Hartman
|
444da424c1 |
Linux 5.4-rc5
-----BEGIN PGP SIGNATURE----- iQFSBAABCAA8FiEEq68RxlopcLEwq+PEeb4+QwBBGIYFAl210Z8eHHRvcnZhbGRz QGxpbnV4LWZvdW5kYXRpb24ub3JnAAoJEHm+PkMAQRiGv+kIAKRpO7EuDokQL4qp hxEEaCMJA1T055EMlNU6FVAq/ZbmapzreUyNYiRMpPWKGTWNMkhIcZQfysYeGZz5 y/KRxAiVxlcB+3v3yRmoZd/XoQmhgvJmqD4zhaGI2Utonow4f/SGSEFFZqqs9WND 4HJROjZHgQ4JBxg9Z+QMo0FxbV/DCZpEOUq51N9WJywyyDRb18zotE83stpU+pE2 fjqT7mk0NLrnYXuDRAbFC1Aau9ed4H6LlwLmxaqxq/Pt5Rz7wIKwKL9HIT4Dm/0a qpani6phhHWL7MwUpa2wkEonFCD03rJFl3DUVJo64Ijh4up5D/jyXQ+GKV2P4WKJ 275Rb5Q= =WiZZ -----END PGP SIGNATURE----- Merge 5.4-rc5 into android-common Linux 5.4-rc5 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ib61881c64a2725c6229c26d2ce63f107b7215c47 |
||
|
Jann Horn
|
45d02f79b5 |
binder: Don't modify VMA bounds in ->mmap handler
binder_mmap() tries to prevent the creation of overly big binder mappings
by silently truncating the size of the VMA to 4MiB. However, this violates
the API contract of mmap(). If userspace attempts to create a large binder
VMA, and later attempts to unmap that VMA, it will call munmap() on a range
beyond the end of the VMA, which may have been allocated to another VMA in
the meantime. This can lead to userspace memory corruption.
The following sequence of calls leads to a segfault without this commit:
int main(void) {
int binder_fd = open("/dev/binder", O_RDWR);
if (binder_fd == -1) err(1, "open binder");
void *binder_mapping = mmap(NULL, 0x800000UL, PROT_READ, MAP_SHARED,
binder_fd, 0);
if (binder_mapping == MAP_FAILED) err(1, "mmap binder");
void *data_mapping = mmap(NULL, 0x400000UL, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
if (data_mapping == MAP_FAILED) err(1, "mmap data");
munmap(binder_mapping, 0x800000UL);
*(char*)data_mapping = 1;
return 0;
}
Cc: stable@vger.kernel.org
Signed-off-by: Jann Horn <jannh@google.com>
Acked-by: Todd Kjos <tkjos@google.com>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Link: https://lore.kernel.org/r/20191016150119.154756-1-jannh@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
|
Greg Kroah-Hartman
|
630839ac24 |
Linux 5.4-rc3
-----BEGIN PGP SIGNATURE----- iQFSBAABCAA8FiEEq68RxlopcLEwq+PEeb4+QwBBGIYFAl2jtUYeHHRvcnZhbGRz QGxpbnV4LWZvdW5kYXRpb24ub3JnAAoJEHm+PkMAQRiGL28H/Akb3JEXNKHCv3MI 89dzKlLgf/W/e0qJirb9/YdcUL462NUFoC0Bg0qLgLFYdhT94Zp5J68C4oZPJfxA /LrTDsHWrbUtTvhxJqMueVT3JTpkF36ZTvTGwLTHzTqexM/o3kuDWjWTTxZlMGbX Uais/ywmmCVCmaX8IJ3GJFGCJse+T1W73VOSo7bm6C+Ruy6Euwasa9kc40uHiPpD 6Xew9j9AJ0xIV96sLzDFOYAXYFQBZnAbFLA+Ho53TiuG78J6MP4Pm9+1VhMyF1uH mgeA5GAfKpqq/QXf32iMU7s7HTdoF5r1UaQJtu+p6BFTGhd7LrDrh4gA/9Wyv7+t 9stS20U= =ima3 -----END PGP SIGNATURE----- Merge 5.4-rc3 into android-mainline Linux 5.4-rc3 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ia87ba662738dd58ddb917e32c1fbd812861e7a46 |
||
Joel Fernandes (Google)
|
5dc54a06f6 |
binder: Fix comment headers on binder_alloc_prepare_to_free()
binder_alloc_buffer_lookup() doesn't exist and is named "binder_alloc_prepare_to_free()". Correct the code comments to reflect this. Signed-off-by: Joel Fernandes (Google) <joel@joelfernandes.org> Reviewed-by: Christian Brauner <christian.brauner@ubuntu.com> Link: https://lore.kernel.org/r/20190930201250.139554-1-joel@joelfernandes.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Christian Brauner
|
51d8a7eca6 |
binder: prevent UAF read in print_binder_transaction_log_entry()
When a binder transaction is initiated on a binder device coming from a
binderfs instance, a pointer to the name of the binder device is stashed
in the binder_transaction_log_entry's context_name member. Later on it
is used to print the name in print_binder_transaction_log_entry(). By
the time print_binder_transaction_log_entry() accesses context_name
binderfs_evict_inode() might have already freed the associated memory
thereby causing a UAF. Do the simple thing and prevent this by copying
the name of the binder device instead of stashing a pointer to it.
Reported-by: Jann Horn <jannh@google.com>
Fixes:
|
||
|
Greg Kroah-Hartman
|
bfa0399bc8 |
Merge Linus's 5.4-rc1-prerelease branch into android-mainline
This merges Linus's tree as of commit
|
||
Hridya Valsaraju
|
4feb80faf4 |
binder: Add binder_proc logging to binderfs
Currently /sys/kernel/debug/binder/proc contains the debug data for every binder_proc instance. This patch makes this information also available in a binderfs instance mounted with a mount option "stats=global" in addition to debugfs. The patch does not affect the presence of the file in debugfs. If a binderfs instance is mounted at path /dev/binderfs, this file would be present at /dev/binderfs/binder_logs/proc. This change provides an alternate way to access this file when debugfs is not mounted. Acked-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: Hridya Valsaraju <hridya@google.com> Link: https://lore.kernel.org/r/20190903161655.107408-5-hridya@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Hridya Valsaraju
|
03e2e07e38 |
binder: Make transaction_log available in binderfs
Currently, the binder transaction log files 'transaction_log' and 'failed_transaction_log' live in debugfs at the following locations: /sys/kernel/debug/binder/failed_transaction_log /sys/kernel/debug/binder/transaction_log This patch makes these files also available in a binderfs instance mounted with the mount option "stats=global". It does not affect the presence of these files in debugfs. If a binderfs instance is mounted at path /dev/binderfs, the location of these files will be as follows: /dev/binderfs/binder_logs/failed_transaction_log /dev/binderfs/binder_logs/transaction_log This change provides an alternate option to access these files when debugfs is not mounted. Acked-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: Hridya Valsaraju <hridya@google.com> Link: https://lore.kernel.org/r/20190903161655.107408-4-hridya@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Hridya Valsaraju
|
0e13e452da |
binder: Add stats, state and transactions files
The following binder stat files currently live in debugfs. /sys/kernel/debug/binder/state /sys/kernel/debug/binder/stats /sys/kernel/debug/binder/transactions This patch makes these files available in a binderfs instance mounted with the mount option 'stats=global'. For example, if a binderfs instance is mounted at path /dev/binderfs, the above files will be available at the following locations: /dev/binderfs/binder_logs/state /dev/binderfs/binder_logs/stats /dev/binderfs/binder_logs/transactions This provides a way to access them even when debugfs is not mounted. Acked-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: Hridya Valsaraju <hridya@google.com> Acked-by: Christian Brauner <christian.brauner@ubuntu.com> Link: https://lore.kernel.org/r/20190903161655.107408-3-hridya@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Hridya Valsaraju
|
f00834518e |
binder: add a mount option to show global stats
Currently, all binder state and statistics live in debugfs. We need this information even when debugfs is not mounted. This patch adds the mount option 'stats' to enable a binderfs instance to have binder debug information present in the same. 'stats=global' will enable the global binder statistics. In the future, 'stats=local' will enable binder statistics local to the binderfs instance. The two modes 'global' and 'local' will be mutually exclusive. 'stats=global' option is only available for a binderfs instance mounted in the initial user namespace. An attempt to use the option to mount a binderfs instance in another user namespace will return an EPERM error. Signed-off-by: Hridya Valsaraju <hridya@google.com> Acked-by: Christian Brauner <christian.brauner@ubuntu.com> Link: https://lore.kernel.org/r/20190903161655.107408-2-hridya@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Hridya Valsaraju
|
ca2864c6e8 |
binder: Add default binder devices through binderfs when configured
Currently, since each binderfs instance needs its own private binder devices, every time a binderfs instance is mounted, all the default binder devices need to be created via the BINDER_CTL_ADD IOCTL. This patch aims to add a solution to automatically create the default binder devices for each binderfs instance that gets mounted. To achieve this goal, when CONFIG_ANDROID_BINDERFS is set, the default binder devices specified by CONFIG_ANDROID_BINDER_DEVICES are created in each binderfs instance instead of global devices being created by the binder driver. Co-developed-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: Hridya Valsaraju <hridya@google.com> Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org> Link: https://lore.kernel.org/r/20190808222727.132744-2-hridya@google.com Link: https://lore.kernel.org/r/20190904110704.8606-2-christian.brauner@ubuntu.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Hridya Valsaraju
|
028fb5822b |
binder: Validate the default binderfs device names.
Length of a binderfs device name cannot exceed BINDERFS_MAX_NAME. This patch adds a check in binderfs_init() to ensure the same for the default binder devices that will be created in every binderfs instance. Co-developed-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: Hridya Valsaraju <hridya@google.com> Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org> Link: https://lore.kernel.org/r/20190808222727.132744-3-hridya@google.com Link: https://lore.kernel.org/r/20190904110704.8606-3-christian.brauner@ubuntu.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Greg Kroah-Hartman
|
bea0791583 |
Linux 5.3-rc2
-----BEGIN PGP SIGNATURE----- iQFSBAABCAA8FiEEq68RxlopcLEwq+PEeb4+QwBBGIYFAl09+8IeHHRvcnZhbGRz QGxpbnV4LWZvdW5kYXRpb24ub3JnAAoJEHm+PkMAQRiGMtgH/3yxnVbzgPatWSd9 w5ahpB+nQ2sludZQXcqmychDsNoGlhxmSxxufxUJ6OL7/lOnfjb4Bc3icNltVlCk s32YyOH7Z/f+zGBE2IkCUK0ttr5bDdENmwJUOjoB39KsPXNK1y46x83QLeorKvBA kOyPtjhgy0nL2UaiM0HKuzMoypslKqwaw4ptXzHQBUkib+WdxVGYLQrTjflkpUMl 71EYwNnVgKwYRuvnMATB5bSgQCASInuF5eHJv9N7XbnBjJ9yVZNARvWW1sX4gNVe vCET+mCRWsMD80Sdnt9RJ8Nt2AEf0dgk2fAVwKqX58vuMIXlD27dayIYkVmJojE0 YuAvnAU= =X832 -----END PGP SIGNATURE----- Merge 5.3-rc2 into android-mainline Linux 5.3-rc2 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I4d36fd27ccc8cd773ba1b97dc3bd382e99a4dd7a |
||
|
Hridya Valsaraju
|
49ed96943a |
binder: prevent transactions to context manager from its own process.
Currently, a transaction to context manager from its own process is prevented by checking if its binder_proc struct is the same as that of the sender. However, this would not catch cases where the process opens the binder device again and uses the new fd to send a transaction to the context manager. Reported-by: syzbot+8b3c354d33c4ac78bfad@syzkaller.appspotmail.com Signed-off-by: Hridya Valsaraju <hridya@google.com> Acked-by: Todd Kjos <tkjos@google.com> Cc: stable <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20190715191804.112933-1-hridya@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
Martijn Coenen
|
a565870650 |
binder: Set end of SG buffer area properly.
In case the target node requests a security context, the
extra_buffers_size is increased with the size of the security context.
But, that size is not available for use by regular scatter-gather
buffers; make sure the ending of that buffer is marked correctly.
Acked-by: Todd Kjos <tkjos@google.com>
Fixes:
|
||
|
Greg Kroah-Hartman
|
37766c2946 |
Linus 5.3-rc1
-----BEGIN PGP SIGNATURE----- iQFSBAABCAA8FiEEq68RxlopcLEwq+PEeb4+QwBBGIYFAl0006weHHRvcnZhbGRz QGxpbnV4LWZvdW5kYXRpb24ub3JnAAoJEHm+PkMAQRiGaDUIAJ4oTyVWpMRZkfG6 vVY8qVMU3zlzEqRiyLYjkXoe/mGpuU/UVTyyStllxZ+Gg9da0mGwlugScKriPJof 4KRUDDTGX5DrfEOo+0brKvM+PYh9uGViPgKXzyv7i6BrnX2z3JdBR4bKNuEYlAJ9 N93Qg7v05SBHIq2Gfp3klrdWbsTTW2EaDTLbcgifXLnfKyFr47kwsmXAHPlTFP0p dYsZHHmf14Y9n1+ToZeVINgjQFr6mFn6ygY/PqTnd6vCgEEfP9eENJ4BZCtN1ZL/ V0BO9MyJ5iZV0AfwSEKydk+kDEvO16TG/nyDrECVuur7AXsBx18ZplVc787f6GK+ dyCQJ3U= =XLAF -----END PGP SIGNATURE----- Merge 5.3.0-rc1 into android-mainline Linus 5.3-rc1 release Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ic171e37d4c21ffa495240c5538852bbb5a9dcce8 |
||
|
Todd Kjos
|
bb4a2e48d5 |
binder: return errors from buffer copy functions
The buffer copy functions assumed the caller would ensure
correct alignment and that the memory to be copied was
completely within the binder buffer. There have been
a few cases discovered by syzkallar where a malformed
transaction created by a user could violated the
assumptions and resulted in a BUG_ON.
The fix is to remove the BUG_ON and always return the
error to be handled appropriately by the caller.
Acked-by: Martijn Coenen <maco@android.com>
Reported-by: syzbot+3ae18325f96190606754@syzkaller.appspotmail.com
Fixes:
|
||
Greg Kroah-Hartman
|
8083f3d788 |
Merge 5.2-rc6 into char-misc-next
We need the char-misc fixes in here as well. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |