mirror of
https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git
synced 2026-10-11 23:24:22 -04:00
905,992 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Yuanfang Zhang
|
12d07c9ed6 |
coresight-tmc-etr: use sysfs_buf in tmc_sg_get_rwp_offset()
When usb bypass start, etr_buf may be null. If etr disable hw is called at the same time. Use sysfs_buf in tmc_sg_get_rwp_offset to avoid this issue. Change-Id: Id1e45269d08f61413d385de7aa46df4cc3d8c44d Signed-off-by: Yuanfang Zhang <zhangyuanfang@codeaurora.org> |
||
Greg Kroah-Hartman
|
7cd388bad4 |
This is the 5.4.158 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmGGfXkACgkQONu9yGCS aT4/NxAArB8wYtfu+RJhG8o7PmI2WQieLzqZPuVIWc/v39KbJPxSlsTvTrQn66/Y KWYTK6QTbT/NT6zHhpLE9n2ToC0D1PXNbiBeQZJemh3d03mMq2GcjHR6e+oesQPG 3t0lyU26E6FDvEPcDrHCbCS4VtUVXQroO7vxaQ79qOXPItoGrqHhXTTXIwKIyeeS 0KMWQtqNKKeiJCBftxpwqZi37KRUTYBMJOXU2OhrAn+nfbEGI/Di1Dve7uP090J7 yO8Djb3MszjofKbSR+L6zg3Id/T31SAftKGSo3nTTFNgbPyEnQNwpB77I3mfkfRW SbHTKPFr1gGFdSh9lfXXJut3O0z4fMyAPXsglAlYop/Gl7Vinsczjih0KODU/vQK ptgFFwrbqFXYkD1hj1ztBXNVsXsekbjZi/3A+G/9pIr06kDAOEhsOqQnJqRyJxas UDvypSKane0VKZq5bhDV+DersDzXsJlAX1d9jGvZXZxGWKw32OoBYBvVfrsQfhSK vnZmDGois5bFjzpinHlKu+uX9yIzo0sy+7of5uIXHcOz3jswH5R68jO+kYAwiOXm aF+Bk3kSEAOY3QoxUZWlLT4fIgUxtzDSsrBt6x8DNZb1O5BNJUZzA9Y3XbZ8VFQz joRIlebuAbaE3TanbVZQUdpRLHt9QpZCLg6O+KJ9ZG4nZya1wvE= =j3iw -----END PGP SIGNATURE----- Merge 5.4.158 into android11-5.4-lts Changes in 5.4.158 scsi: core: Put LLD module refcnt after SCSI device is released vrf: Revert "Reset skb conntrack connection..." net: ethernet: microchip: lan743x: Fix skb allocation failure media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt() Revert "xhci: Set HCD flag to defer primary roothub registration" Revert "usb: core: hcd: Add support for deferring roothub registration" sfc: Fix reading non-legacy supported link modes Revert "drm/ttm: fix memleak in ttm_transfered_destroy" ARM: 9120/1: Revert "amba: make use of -1 IRQs warn" Linux 5.4.158 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I78389a9bc39dca878c4178c11e86adb80c458f8a |
||
Greg Kroah-Hartman
|
c65356f0f7 |
Linux 5.4.158
Link: https://lore.kernel.org/r/20211104141158.384397574@linuxfoundation.org Tested-by: Florian Fainelli <f.fainelli@gmail.com> Tested-by: Shuah Khan <skhan@linuxfoundation.org> Tested-by: Jon Hunter <jonathanh@nvidia.com> Tested-by: Linux Kernel Functional Testing <lkft@linaro.org> Tested-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk> Tested-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
Wang Kefeng
|
e31d51f8a4 |
ARM: 9120/1: Revert "amba: make use of -1 IRQs warn"
commit eb4f756915875b0ea0757751cd29841f0504d547 upstream. After commit |
||
|
Greg Kroah-Hartman
|
960b1fdfc3 |
Revert "drm/ttm: fix memleak in ttm_transfered_destroy"
This reverts commit
|
||
Erik Ekman
|
a73ebe514a |
sfc: Fix reading non-legacy supported link modes
commit 041c61488236a5a84789083e3d9f0a51139b6edf upstream. Everything except the first 32 bits was lost when the pause flags were added. This makes the 50000baseCR2 mode flag (bit 34) not appear. I have tested this with a 10G card (SFN5122F-R7) by modifying it to return a non-legacy link mode (10000baseCR). Signed-off-by: Erik Ekman <erik@kryo.se> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Greg Kroah-Hartman
|
6789e4b759 |
Revert "usb: core: hcd: Add support for deferring roothub registration"
This reverts commit
|
||
|
Greg Kroah-Hartman
|
049849492b |
Revert "xhci: Set HCD flag to defer primary roothub registration"
This reverts commit
|
||
Dan Carpenter
|
2461f38384 |
media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt()
commit 35d2969ea3c7d32aee78066b1f3cf61a0d935a4e upstream.
The bounds checking in avc_ca_pmt() is not strict enough. It should
be checking "read_pos + 4" because it's reading 5 bytes. If the
"es_info_length" is non-zero then it reads a 6th byte so there needs to
be an additional check for that.
I also added checks for the "write_pos". I don't think these are
required because "read_pos" and "write_pos" are tied together so
checking one ought to be enough. But they make the code easier to
understand for me. The check on write_pos is:
if (write_pos + 4 >= sizeof(c->operand) - 4) {
The first "+ 4" is because we're writing 5 bytes and the last " - 4"
is to leave space for the CRC.
The other problem is that "length" can be invalid. It comes from
"data_length" in fdtv_ca_pmt().
Cc: stable@vger.kernel.org
Reported-by: Luo Likang <luolikang@nsfocus.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
Yuiko Oshino
|
21fc2bb836 |
net: ethernet: microchip: lan743x: Fix skb allocation failure
commit e8684db191e4164f3f5f3ad7dec04a6734c25f1c upstream.
The driver allocates skb during ndo_open with GFP_ATOMIC which has high chance of failure when there are multiple instances.
GFP_KERNEL is enough while open and use GFP_ATOMIC only from interrupt context.
Fixes:
|
||
Eugene Crosser
|
e02fdd7db4 |
vrf: Revert "Reset skb conntrack connection..."
commit 55161e67d44fdd23900be166a81e996abd6e3be9 upstream.
This reverts commit 09e856d54bda5f288ef8437a90ab2b9b3eab83d1.
When an interface is enslaved in a VRF, prerouting conntrack hook is
called twice: once in the context of the original input interface, and
once in the context of the VRF interface. If no special precausions are
taken, this leads to creation of two conntrack entries instead of one,
and breaks SNAT.
Commit above was intended to avoid creation of extra conntrack entries
when input interface is enslaved in a VRF. It did so by resetting
conntrack related data associated with the skb when it enters VRF context.
However it breaks netfilter operation. Imagine a use case when conntrack
zone must be assigned based on the original input interface, rather than
VRF interface (that would make original interfaces indistinguishable). One
could create netfilter rules similar to these:
chain rawprerouting {
type filter hook prerouting priority raw;
iif realiface1 ct zone set 1 return
iif realiface2 ct zone set 2 return
}
This works before the mentioned commit, but not after: zone assignment
is "forgotten", and any subsequent NAT or filtering that is dependent
on the conntrack zone does not work.
Here is a reproducer script that demonstrates the difference in behaviour.
==========
#!/bin/sh
# This script demonstrates unexpected change of nftables behaviour
# caused by commit 09e856d54bda5f28 ""vrf: Reset skb conntrack
# connection on VRF rcv"
# https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=09e856d54bda5f288ef8437a90ab2b9b3eab83d1
#
# Before the commit, it was possible to assign conntrack zone to a
# packet (or mark it for `notracking`) in the prerouting chanin, raw
# priority, based on the `iif` (interface from which the packet
# arrived).
# After the change, # if the interface is enslaved in a VRF, such
# assignment is lost. Instead, assignment based on the `iif` matching
# the VRF master interface is honored. Thus it is impossible to
# distinguish packets based on the original interface.
#
# This script demonstrates this change of behaviour: conntrack zone 1
# or 2 is assigned depending on the match with the original interface
# or the vrf master interface. It can be observed that conntrack entry
# appears in different zone in the kernel versions before and after
# the commit.
IPIN=172.30.30.1
IPOUT=172.30.30.2
PFXL=30
ip li sh vein >/dev/null 2>&1 && ip li del vein
ip li sh tvrf >/dev/null 2>&1 && ip li del tvrf
nft list table testct >/dev/null 2>&1 && nft delete table testct
ip li add vein type veth peer veout
ip li add tvrf type vrf table 9876
ip li set veout master tvrf
ip li set vein up
ip li set veout up
ip li set tvrf up
/sbin/sysctl -w net.ipv4.conf.veout.accept_local=1
/sbin/sysctl -w net.ipv4.conf.veout.rp_filter=0
ip addr add $IPIN/$PFXL dev vein
ip addr add $IPOUT/$PFXL dev veout
nft -f - <<__END__
table testct {
chain rawpre {
type filter hook prerouting priority raw;
iif { veout, tvrf } meta nftrace set 1
iif veout ct zone set 1 return
iif tvrf ct zone set 2 return
notrack
}
chain rawout {
type filter hook output priority raw;
notrack
}
}
__END__
uname -rv
conntrack -F
ping -W 1 -c 1 -I vein $IPOUT
conntrack -L
Signed-off-by: Eugene Crosser <crosser@average.org>
Acked-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
Ming Lei
|
1ce287eff9 |
scsi: core: Put LLD module refcnt after SCSI device is released
commit f2b85040acec9a928b4eb1b57a989324e8e38d3f upstream. SCSI host release is triggered when SCSI device is freed. We have to make sure that the low-level device driver module won't be unloaded before SCSI host instance is released because shost->hostt is required in the release handler. Make sure to put LLD module refcnt after SCSI device is released. Fixes a kernel panic of 'BUG: unable to handle page fault for address' reported by Changhui and Yi. Link: https://lore.kernel.org/r/20211008050118.1440686-1-ming.lei@redhat.com Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Reported-by: Changhui Zhong <czhong@redhat.com> Reported-by: Yi Zhang <yi.zhang@redhat.com> Tested-by: Yi Zhang <yi.zhang@redhat.com> Signed-off-by: Ming Lei <ming.lei@redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
qctecmdr
|
a0e35cc38e | Merge "msm: kgsl: Update register protection config" | ||
Srinivasarao Pathipati
|
828abb51dd |
Merge android11-5.4.147+ (dc8c919) into msm-5.4
* refs/heads/tmp-dc8c919:
Revert dwc3 changes
ANDROID: GKI: Update FCNT KMI symbol list No new symbols added that are not already in the .xml file.
ANDROID: GKI : Update symbols to symbol list
BACKPORT: crypto: arch - conditionalize crypto api in arch glue for lib code
BACKPORT: crypto: arch/lib - limit simd usage to 4k chunks
UPSTREAM: crypto: arm/blake2s - fix for big endian
ANDROID: gki_defconfig: enable BLAKE2b support
BACKPORT: crypto: arm/blake2b - add NEON-accelerated BLAKE2b
BACKPORT: crypto: blake2b - update file comment
BACKPORT: crypto: blake2b - sync with blake2s implementation
UPSTREAM: crypto: arm/blake2s - add ARM scalar optimized BLAKE2s
UPSTREAM: crypto: blake2s - include <linux/bug.h> instead of <asm/bug.h>
UPSTREAM: crypto: blake2s - adjust include guard naming
UPSTREAM: crypto: blake2s - add comment for blake2s_state fields
UPSTREAM: crypto: blake2s - optimize blake2s initialization
BACKPORT: crypto: blake2s - share the "shash" API boilerplate code
UPSTREAM: crypto: blake2s - move update and final logic to internal/blake2s.h
UPSTREAM: crypto: blake2s - remove unneeded includes
UPSTREAM: crypto: x86/blake2s - define shash_alg structs using macros
UPSTREAM: crypto: blake2s - define shash_alg structs using macros
UPSTREAM: crypto: lib/blake2s - Move selftest prototype into header file
UPSTREAM: crypto: blake2b - Fix clang optimization for ARMv7-M
UPSTREAM: crypto: blake2b - rename tfm context and _setkey callback
UPSTREAM: crypto: blake2b - merge _update to api callback
UPSTREAM: crypto: blake2b - open code set last block helper
UPSTREAM: crypto: blake2b - delete unused structs or members
UPSTREAM: crypto: blake2b - simplify key init
UPSTREAM: crypto: blake2b - merge blake2 init to api callback
UPSTREAM: crypto: blake2b - merge _final implementation to callback
BACKPORT: crypto: testmgr - add test vectors for blake2b
BACKPORT: crypto: blake2b - add blake2b generic implementation
UPSTREAM: crypto: blake2s - x86_64 SIMD implementation
UPSTREAM: crypto: blake2s - implement generic shash driver
UPSTREAM: crypto: testmgr - add test cases for Blake2s
UPSTREAM: crypto: blake2s - generic C library implementation and selftest
UPSTREAM: crypto: lib - tidy up lib/crypto Kconfig and Makefile
ANDROID: ion heap: init ion heaps in subsys_initcall
UPSTREAM: ovl: simplify file splice
ANDROID: ABI: update allowed list for galaxy
ANDROID: ABI: Update allowed list for QCOM
ANDROID: distribute Module.symvers
UPSTREAM: usb: max-3421: Prevent corruption of freed memory
ANDROID: ABI: Update allowed list for QCOM
UPSTREAM: driver core: Prevent warning when removing a device link from unregistered consumer
UPSTREAM: udp: properly flush normal packet at GRO time
UPSTREAM: net/xfrm/compat: Copy xfrm_spdattr_type_t atributes
UPSTREAM: f2fs: Advertise encrypted casefolding in sysfs
UPSTREAM: loop: Fix missing discard support when using LOOP_CONFIGURE
UPSTREAM: thermal/drivers/sprd: Add missing MODULE_DEVICE_TABLE
UPSTREAM: nvmem: sprd: Fix an error message
UPSTREAM: usb: musb: Fix an error message
UPSTREAM: scsi: ufs: core: Cancel rpm_dev_flush_recheck_work during system suspend
UPSTREAM: scsi: ufs: core: Do not put UFS power into LPM if link is broken
UPSTREAM: selinux: add proper NULL termination to the secclass_map permissions
UPSTREAM: of: property: fw_devlink: do not link ".*,nr-gpios"
UPSTREAM: udp: never accept GSO_FRAGLIST packets
UPSTREAM: udp: skip L4 aggregation for UDP tunnel packets
UPSTREAM: xfrm/compat: Cleanup WARN()s that can be user-triggered
UPSTREAM: pinctrl: sunxi: fix irq bank map for the Allwinner A100 pin controller
UPSTREAM: loop: Set correct device size when using LOOP_CONFIGURE
UPSTREAM: loop: unset GENHD_FL_NO_PART_SCAN on LOOP_CONFIGURE
ANDROID: ion_system_heap: Add __GFP_NOWARN to mid-order allocations
ANDROID: drivers: gpu: drm: increase the MAX_DRM_OPEN_COUNT
UPSTREAM: af_unix: fix garbage collect vs MSG_PEEK
Linux 5.4.147
Revert "time: Handle negative seconds correctly in timespec64_to_ns()"
Revert "posix-cpu-timers: Force next expiration recalc after itimer reset"
Revert "block: nbd: add sanity check for first_minor"
Revert "Bluetooth: Move shutdown callback before flushing tx and rx queue"
Linux 5.4.146
clk: kirkwood: Fix a clocking boot regression
backlight: pwm_bl: Improve bootloader/kernel device handover
fbmem: don't allow too huge resolutions
IMA: remove the dependency on CRYPTO_MD5
IMA: remove -Wmissing-prototypes warning
fuse: flush extending writes
fuse: truncate pagecache on atomic_o_trunc
KVM: nVMX: Unconditionally clear nested.pi_pending on nested VM-Enter
KVM: x86: Update vCPU's hv_clock before back to guest when tsc_offset is adjusted
KVM: s390: index kvm->arch.idle_mask by vcpu_idx
x86/resctrl: Fix a maybe-uninitialized build warning treated as error
perf/x86/amd/ibs: Extend PERF_PMU_CAP_NO_EXCLUDE to IBS Op
tty: Fix data race between tiocsti() and flush_to_ldisc()
time: Handle negative seconds correctly in timespec64_to_ns()
bpf: Fix pointer arithmetic mask tightening under state pruning
bpf: verifier: Allocate idmap scratch in verifier env
bpf: Fix leakage due to insufficient speculative store bypass mitigation
bpf: Introduce BPF nospec instruction for mitigating Spectre v4
ipv4: fix endianness issue in inet_rtm_getroute_build_skb()
octeontx2-af: Fix loop in free and unmap counter
net: qualcomm: fix QCA7000 checksum handling
net: sched: Fix qdisc_rate_table refcount leak when get tcf_block failed
ipv4: make exception cache less predictible
ipv6: make exception cache less predictible
brcmfmac: pcie: fix oops on failure to resume and reprobe
bcma: Fix memory leak for internally-handled cores
ath6kl: wmi: fix an error code in ath6kl_wmi_sync_point()
ASoC: wcd9335: Disable irq on slave ports in the remove function
ASoC: wcd9335: Fix a memory leak in the error handling path of the probe function
ASoC: wcd9335: Fix a double irq free in the remove function
tty: serial: fsl_lpuart: fix the wrong mapbase value
usb: bdc: Fix an error handling path in 'bdc_probe()' when no suitable DMA config is available
usb: ehci-orion: Handle errors of clk_prepare_enable() in probe
i2c: mt65xx: fix IRQ check
CIFS: Fix a potencially linear read overflow
bpf: Fix possible out of bound write in narrow load handling
mmc: moxart: Fix issue with uninitialized dma_slave_config
mmc: dw_mmc: Fix issue with uninitialized dma_slave_config
ASoC: Intel: Skylake: Fix module resource and format selection
ASoC: Intel: Skylake: Leave data as is when invoking TLV IPCs
rsi: fix an error code in rsi_probe()
rsi: fix error code in rsi_load_9116_firmware()
i2c: s3c2410: fix IRQ check
i2c: iop3xx: fix deferred probing
Bluetooth: add timeout sanity check to hci_inquiry
mm/swap: consider max pages in iomap_swapfile_add_extent
usb: gadget: mv_u3d: request_irq() after initializing UDC
nfsd4: Fix forced-expiry locking
lockd: Fix invalid lockowner cast after vfs_test_lock
mac80211: Fix insufficient headroom issue for AMSDU
usb: phy: tahvo: add IRQ check
usb: host: ohci-tmio: add IRQ check
Bluetooth: Move shutdown callback before flushing tx and rx queue
usb: gadget: udc: renesas_usb3: Fix soc_device_match() abuse
usb: phy: twl6030: add IRQ checks
usb: phy: fsl-usb: add IRQ check
usb: gadget: udc: at91: add IRQ check
drm/msm/dsi: Fix some reference counted resource leaks
Bluetooth: fix repeated calls to sco_sock_kill
counter: 104-quad-8: Return error when invalid mode during ceiling_write
arm64: dts: exynos: correct GIC CPU interfaces address range on Exynos7
drm/msm/dpu: make dpu_hw_ctl_clear_all_blendstages clear necessary LMs
PM: EM: Increase energy calculation precision
Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow
debugfs: Return error during {full/open}_proxy_open() on rmmod
soc: qcom: smsm: Fix missed interrupts if state changes while masked
PCI: PM: Enable PME if it can be signaled from D3cold
PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently
media: venus: venc: Fix potential null pointer dereference on pointer fmt
media: em28xx-input: fix refcount bug in em28xx_usb_disconnect
leds: trigger: audio: Add an activate callback to ensure the initial brightness is set
leds: lt3593: Put fwnode in any case during ->probe()
i2c: highlander: add IRQ check
net: cipso: fix warnings in netlbl_cipsov4_add_std
cgroup/cpuset: Fix a partition bug with hotplug
net/mlx5e: Prohibit inner indir TIRs in IPoIB
ARM: dts: meson8b: ec100: Fix the pwm regulator supply properties
ARM: dts: meson8b: mxq: Fix the pwm regulator supply properties
ARM: dts: meson8b: odroidc1: Fix the pwm regulator supply properties
ARM: dts: meson8: Use a higher default GPU clock frequency
tcp: seq_file: Avoid skipping sk during tcp_seek_last_pos
drm/amdgpu/acp: Make PM domain really work
netns: protect netns ID lookups with RCU
6lowpan: iphc: Fix an off-by-one check of array index
Bluetooth: sco: prevent information leak in sco_conn_defer_accept()
media: coda: fix frame_mem_ctrl for YUV420 and YVU420 formats
media: go7007: remove redundant initialization
media: dvb-usb: Fix error handling in dvb_usb_i2c_init
media: dvb-usb: fix uninit-value in vp702x_read_mac_addr
media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init
soc: qcom: rpmhpd: Use corner in power_off
arm64: dts: renesas: r8a77995: draak: Remove bogus adv7511w properties
ARM: dts: aspeed-g6: Fix HVI3C function-group in pinctrl dtsi
bpf: Fix potential memleak and UAF in the verifier.
bpf: Fix a typo of reuseport map in bpf.h.
media: cxd2880-spi: Fix an error handling path
soc: rockchip: ROCKCHIP_GRF should not default to y, unconditionally
media: TDA1997x: enable EDID support
drm/panfrost: Fix missing clk_disable_unprepare() on error in panfrost_clk_init()
EDAC/i10nm: Fix NVDIMM detection
spi: spi-zynq-qspi: use wait_for_completion_timeout to make zynq_qspi_exec_mem_op not interruptible
spi: sprd: Fix the wrong WDG_LOAD_VAL
regulator: vctrl: Avoid lockdep warning in enable/disable ops
regulator: vctrl: Use locked regulator_get_voltage in probe path
certs: Trigger creation of RSA module signing key if it's not an RSA key
crypto: qat - use proper type for vf_mask
block: nbd: add sanity check for first_minor
clocksource/drivers/sh_cmt: Fix wrong setting if don't request IRQ for clock source channel
lib/mpi: use kcalloc in mpi_resize
genirq/timings: Fix error return code in irq_timings_test_irqs()
spi: spi-pic32: Fix issue with uninitialized dma_slave_config
spi: spi-fsl-dspi: Fix issue with uninitialized dma_slave_config
sched: Fix UCLAMP_FLAG_IDLE setting
m68k: emu: Fix invalid free in nfeth_cleanup()
s390/debug: fix debug area life cycle
s390/kasan: fix large PMD pages address alignment check
udf_get_extendedattr() had no boundary checks.
fcntl: fix potential deadlock for &fasync_struct.fa_lock
crypto: qat - do not export adf_iov_putmsg()
crypto: qat - fix naming for init/shutdown VF to PF notifications
crypto: qat - fix reuse of completion variable
crypto: qat - handle both source of interrupt in VF ISR
crypto: qat - do not ignore errors from enable_vf2pf_comms()
libata: fix ata_host_start()
s390/cio: add dev_busid sysfs entry for each subchannel
power: supply: max17042_battery: fix typo in MAx17042_TOFF
nvmet: pass back cntlid on successful completion
nvme-rdma: don't update queue count when failing to set io queues
nvme-tcp: don't update queue count when failing to set io queues
bcache: add proper error unwinding in bcache_device_init
isofs: joliet: Fix iocharset=utf8 mount option
udf: Fix iocharset=utf8 mount option
udf: Check LVID earlier
hrtimer: Ensure timerfd notification for HIGHRES=n
hrtimer: Avoid double reprogramming in __hrtimer_start_range_ns()
posix-cpu-timers: Force next expiration recalc after itimer reset
rcu/tree: Handle VM stoppage in stall detection
sched/deadline: Fix missing clock update in migrate_task_rq_dl()
crypto: omap-sham - clear dma flags only after omap_sham_update_dma_stop()
power: supply: axp288_fuel_gauge: Report register-address on readb / writeb errors
sched/deadline: Fix reset_on_fork reporting of DL tasks
crypto: mxs-dcp - Check for DMA mapping errors
regmap: fix the offset of register error log
locking/mutex: Fix HANDOFF condition
ANDROID: GKI: db845c: Update symbols list and ABI for lts v5.4.144
Linux 5.4.145
PCI: Call Max Payload Size-related fixup quirks early
x86/reboot: Limit Dell Optiplex 990 quirk to early BIOS versions
xhci: fix unsafe memory usage in xhci tracing
usb: mtu3: fix the wrong HS mult value
usb: mtu3: use @mult for HS isoc or intr
usb: host: xhci-rcar: Don't reload firmware after the completion
ALSA: usb-audio: Add registration quirk for JBL Quantum 800
Revert "btrfs: compression: don't try to compress if we don't have enough pages"
x86/events/amd/iommu: Fix invalid Perf result due to IOMMU PMC power-gating
Revert "r8169: avoid link-up interrupt issue on RTL8106e if user enables ASPM"
mm/page_alloc: speed up the iteration of max_order
net: ll_temac: Remove left-over debug message
powerpc/boot: Delete unneeded .globl _zimage_start
ipv4/icmp: l3mdev: Perform icmp error route lookup on source device routing table (v2)
USB: serial: mos7720: improve OOM-handling in read_mos_reg()
igmp: Add ip_mc_list lock in ip_check_mc_rcu
media: stkwebcam: fix memory leak in stk_camera_probe
ARC: wireup clone3 syscall
ALSA: pcm: fix divide error in snd_pcm_lib_ioctl
ALSA: hda/realtek: Workaround for conflicting SSID on ASUS ROG Strix G17
ARM: 8918/2: only build return_address() if needed
cryptoloop: add a deprecation warning
perf/x86/amd/power: Assign pmu.module
perf/x86/amd/ibs: Work around erratum #1197
perf/x86/intel/pt: Fix mask of num_address_ranges
qede: Fix memset corruption
net: macb: Add a NULL check on desc_ptp
qed: Fix the VF msix vectors flow
reset: reset-zynqmp: Fixed the argument data type
gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for (semi)planar U/V formats
xtensa: fix kconfig unmet dependency warning for HAVE_FUTEX_CMPXCHG
kthread: Fix PF_KTHREAD vs to_kthread() race
ubifs: report correct st_size for encrypted symlinks
f2fs: report correct st_size for encrypted symlinks
ext4: report correct st_size for encrypted symlinks
fscrypt: add fscrypt_symlink_getattr() for computing st_size
ext4: fix race writing to an inline_data file while its xattrs are changing
Revert "once: Fix panic when module unload"
Linux 5.4.144
audit: move put_tree() to avoid trim_trees refcount underflow and UAF
net: don't unconditionally copy_from_user a struct ifreq for socket ioctls
Revert "parisc: Add assembly implementations for memset, strlen, strcpy, strncpy and strcat"
Revert "floppy: reintroduce O_NDELAY fix"
btrfs: fix NULL pointer dereference when deleting device by invalid id
arm64: dts: qcom: msm8994-angler: Fix gpio-reserved-ranges 85-88
KVM: x86/mmu: Treat NX as used (not reserved) for all !TDP shadow MMUs
net: dsa: mt7530: fix VLAN traffic leaks again
bpf: Fix cast to pointer from integer of different size warning
bpf: Track contents of read-only maps as scalars
vt_kdsetmode: extend console locking
btrfs: fix race between marking inode needs to be logged and log syncing
net/rds: dma_map_sg is entitled to merge entries
drm/nouveau/disp: power down unused DP links during init
drm: Copy drm_wait_vblank to user before returning
qed: Fix null-pointer dereference in qed_rdma_create_qp()
qed: qed ll2 race condition fixes
vringh: Use wiov->used to check for read/write desc order
virtio_pci: Support surprise removal of virtio pci device
virtio: Improve vq->broken access to avoid any compiler optimization
opp: remove WARN when no valid OPPs remain
perf/x86/intel/uncore: Fix integer overflow on 23 bit left shift of a u32
usb: gadget: u_audio: fix race condition on endpoint stop
drm/i915: Fix syncmap memory leak
net: hns3: fix get wrong pfc_en when query PFC configuration
net: hns3: fix duplicate node in VLAN list
net: hns3: clear hardware resource when loading driver
rtnetlink: Return correct error on changing device netns
net: marvell: fix MVNETA_TX_IN_PRGRS bit number
xgene-v2: Fix a resource leak in the error handling path of 'xge_probe()'
ip_gre: add validation for csum_start
RDMA/efa: Free IRQ vectors on error flow
e1000e: Fix the max snoop/no-snoop latency for 10M
IB/hfi1: Fix possible null-pointer dereference in _extend_sdma_tx_descs()
RDMA/bnxt_re: Add missing spin lock initialization
scsi: core: Fix hang of freezing queue between blocking and running device
usb: dwc3: gadget: Stop EP0 transfers during pullup disable
usb: dwc3: gadget: Fix dwc3_calc_trbs_left()
USB: serial: option: add new VID/PID to support Fibocom FG150
Revert "USB: serial: ch341: fix character loss at high transfer rates"
can: usb: esd_usb2: esd_usb2_rx_event(): fix the interchange of the CAN RX and TX error counters
mm, oom: make the calculation of oom badness more accurate
mmc: sdhci-msm: Update the software timeout value for sdhc
ovl: fix uninitialized pointer read in ovl_lookup_real_one()
once: Fix panic when module unload
netfilter: conntrack: collect all entries in one cycle
ARC: Fix CONFIG_STACKDEPOT
net: qrtr: fix another OOB Read in qrtr_endpoint_post
Revert "virtio: Protect vqs list access"
Revert "net: igmp: fix data-race in igmp_ifc_timer_expire()"
Revert "net: igmp: increase size of mr_ifc_count"
Revert "PCI/MSI: Protect msi_desc::masked for multi-MSI"
Linux 5.4.143
netfilter: nft_exthdr: fix endianness of tcp option cast
fs: warn about impending deprecation of mandatory locks
mm: memcontrol: fix occasional OOMs due to proportional memory.low reclaim
mm, memcg: avoid stale protection values when cgroup is above protection
ASoC: intel: atom: Fix breakage for PCM buffer address setup
PCI: Increase D3 delay for AMD Renoir/Cezanne XHCI
btrfs: prevent rename2 from exchanging a subvol with a directory from different parents
ipack: tpci200: fix memory leak in the tpci200_register
ipack: tpci200: fix many double free issues in tpci200_pci_probe
slimbus: ngd: reset dma setup during runtime pm
slimbus: messaging: check for valid transaction id
slimbus: messaging: start transaction ids from 1 instead of zero
tracing / histogram: Fix NULL pointer dereference on strcmp() on NULL event name
ALSA: hda - fix the 'Capture Switch' value change notifications
mmc: dw_mmc: Fix hang on data CRC error
ovl: add splice file read write helper
iavf: Fix ping is lost after untrusted VF had tried to change MAC
i40e: Fix ATR queue selection
ovs: clear skb->tstamp in forwarding path
net: mdio-mux: Handle -EPROBE_DEFER correctly
net: mdio-mux: Don't ignore memory allocation errors
net: qlcnic: add missed unlock in qlcnic_83xx_flash_read32
virtio-net: use NETIF_F_GRO_HW instead of NETIF_F_LRO
virtio-net: support XDP when not more queues
vrf: Reset skb conntrack connection on VRF rcv
bnxt_en: Add missing DMA memory barriers
ptp_pch: Restore dependency on PCI
net: 6pack: fix slab-out-of-bounds in decode_data
bnxt: disable napi before canceling DIM
bnxt: don't lock the tx queue from napi poll
bpf: Clear zext_dst of dead insns
vhost: Fix the calculation in vhost_overflow()
virtio: Protect vqs list access
dccp: add do-while-0 stubs for dccp_pr_debug macros
cpufreq: armada-37xx: forbid cpufreq for 1.2 GHz variant
iommu: Check if group is NULL before remove device
Bluetooth: hidp: use correct wait queue when removing ctrl_wait
drm/amd/display: Fix Dynamic bpp issue with 8K30 with Navi 1X
net: usb: lan78xx: don't modify phy_device state concurrently
ARM: dts: nomadik: Fix up interrupt controller node names
scsi: core: Fix capacity set to zero after offlinining device
scsi: core: Avoid printing an error if target_alloc() returns -ENXIO
scsi: scsi_dh_rdac: Avoid crash during rdac_bus_attach()
scsi: megaraid_mm: Fix end of loop tests for list_for_each_entry()
dmaengine: of-dma: router_xlate to return -EPROBE_DEFER if controller is not yet available
ARM: dts: am43x-epos-evm: Reduce i2c0 bus speed for tps65218
dmaengine: usb-dmac: Fix PM reference leak in usb_dmac_probe()
dmaengine: xilinx_dma: Fix read-after-free bug when terminating transfers
USB: core: Avoid WARNings for 0-length descriptor requests
media: drivers/media/usb: fix memory leak in zr364xx_probe
media: zr364xx: fix memory leaks in probe()
media: zr364xx: propagate errors from zr364xx_start_readpipe()
mtd: cfi_cmdset_0002: fix crash when erasing/writing AMD cards
ath9k: Postpone key cache entry deletion for TXQ frames reference it
ath: Modify ath_key_delete() to not need full key entry
ath: Export ath_hw_keysetmac()
ath9k: Clear key cache explicitly on disabling hardware
ath: Use safer key clearing with key cache entries
x86/fpu: Make init_fpstate correct with optimized XSAVE
ext4: fix EXT4_MAX_LOGICAL_BLOCK macro
Linux 5.4.142
KVM: nSVM: always intercept VMLOAD/VMSAVE when nested (CVE-2021-3656)
KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl (CVE-2021-3653)
iommu/vt-d: Fix agaw for a supported 48 bit guest address width
vmlinux.lds.h: Handle clang's module.{c,d}tor sections
ceph: take snap_empty_lock atomically with snaprealm refcount change
ceph: clean up locking annotation for ceph_get_snap_realm and __lookup_snap_realm
ceph: add some lockdep assertions around snaprealm handling
KVM: VMX: Use current VMCS to query WAITPKG support for MSR emulation
PCI/MSI: Protect msi_desc::masked for multi-MSI
PCI/MSI: Use msi_mask_irq() in pci_msi_shutdown()
PCI/MSI: Correct misleading comments
PCI/MSI: Do not set invalid bits in MSI mask
PCI/MSI: Enforce MSI[X] entry updates to be visible
PCI/MSI: Enforce that MSI-X table entry is masked for update
PCI/MSI: Mask all unused MSI-X entries
PCI/MSI: Enable and mask MSI-X early
genirq/timings: Prevent potential array overflow in __irq_timings_store()
genirq/msi: Ensure deactivation on teardown
x86/resctrl: Fix default monitoring groups reporting
x86/ioapic: Force affinity setup before startup
x86/msi: Force affinity setup before startup
genirq: Provide IRQCHIP_AFFINITY_PRE_STARTUP
x86/tools: Fix objdump version check again
powerpc/kprobes: Fix kprobe Oops happens in booke
nbd: Aovid double completion of a request
vsock/virtio: avoid potential deadlock when vsock device remove
xen/events: Fix race in set_evtchn_to_irq
net: igmp: increase size of mr_ifc_count
tcp_bbr: fix u32 wrap bug in round logic if bbr_init() called after 2B packets
net: linkwatch: fix failure to restore device state across suspend/resume
net: bridge: fix memleak in br_add_if()
net: dsa: sja1105: fix broken backpressure in .port_fdb_dump
net: dsa: lantiq: fix broken backpressure in .port_fdb_dump
net: dsa: lan9303: fix broken backpressure in .port_fdb_dump
net: igmp: fix data-race in igmp_ifc_timer_expire()
net: Fix memory leak in ieee802154_raw_deliver
net: dsa: microchip: Fix ksz_read64()
drm/meson: fix colour distortion from HDR set during vendor u-boot
net/mlx5: Fix return value from tracer initialization
psample: Add a fwd declaration for skbuff
iavf: Set RSS LUT and key in reset handle path
net: sched: act_mirred: Reset ct info when mirror/redirect skb
ppp: Fix generating ifname when empty IFLA_IFNAME is specified
net: phy: micrel: Fix link detection on ksz87xx switch"
platform/x86: pcengines-apuv2: Add missing terminating entries to gpio-lookup tables
platform/x86: pcengines-apuv2: revert wiring up simswitch GPIO as LED
net: dsa: mt7530: add the missing RxUnicast MIB counter
ASoC: cs42l42: Fix LRCLK frame start edge
netfilter: nf_conntrack_bridge: Fix memory leak when error
ASoC: cs42l42: Remove duplicate control for WNF filter frequency
ASoC: cs42l42: Fix inversion of ADC Notch Switch control
ASoC: cs42l42: Don't allow SND_SOC_DAIFMT_LEFT_J
ASoC: cs42l42: Correct definition of ADC Volume control
ieee802154: hwsim: fix GPF in hwsim_new_edge_nl
ieee802154: hwsim: fix GPF in hwsim_set_edge_lqi
libnvdimm/region: Fix label activation vs errors
ACPI: NFIT: Fix support for virtual SPA ranges
ceph: reduce contention in ceph_check_delayed_caps()
i2c: dev: zero out array used for i2c reads from userspace
ASoC: intel: atom: Fix reference to PCM buffer address
ASoC: xilinx: Fix reference to PCM buffer address
iio: adc: Fix incorrect exit of for-loop
iio: humidity: hdc100x: Add margin to the conversion time
iio: adc: ti-ads7950: Ensure CS is deasserted after reading channels
Linux 5.4.141
btrfs: don't flush from btrfs_delayed_inode_reserve_metadata
btrfs: export and rename qgroup_reserve_meta
btrfs: qgroup: don't commit transaction when we already hold the handle
net: xilinx_emaclite: Do not print real IOMEM pointer
btrfs: fix lockdep splat when enabling and disabling qgroups
btrfs: qgroup: remove ASYNC_COMMIT mechanism in favor of reserve retry-after-EDQUOT
btrfs: transaction: Cleanup unused TRANS_STATE_BLOCKED
btrfs: qgroup: try to flush qgroup space when we get -EDQUOT
btrfs: qgroup: allow to unreserve range without releasing other ranges
btrfs: make btrfs_qgroup_reserve_data take btrfs_inode
btrfs: make qgroup_free_reserved_data take btrfs_inode
ovl: prevent private clone if bind mount is not allowed
ppp: Fix generating ppp unit id when ifname is not specified
ALSA: hda: Add quirk for ASUS Flow x13
USB:ehci:fix Kunpeng920 ehci hardware problem
KVM: X86: MMU: Use the correct inherited permissions to get shadow page
usb: dwc3: gadget: Avoid runtime resume if disabling pullup
usb: dwc3: gadget: Disable gadget IRQ during pullup disable
usb: dwc3: gadget: Clear DEP flags after stop transfers in ep disable
usb: dwc3: gadget: Prevent EP queuing while stopping transfers
usb: dwc3: gadget: Restart DWC3 gadget when enabling pullup
usb: dwc3: gadget: Allow runtime suspend if UDC unbinded
usb: dwc3: Stop active transfers before halting the controller
tracing: Reject string operand in the histogram expression
media: v4l2-mem2mem: always consider OUTPUT queue during poll
tee: Correct inappropriate usage of TEE_SHM_DMA_BUF flag
KVM: SVM: Fix off-by-one indexing when nullifying last used SEV VMCB
Linux 5.4.140
arm64: fix compat syscall return truncation
net/qla3xxx: fix schedule while atomic in ql_wait_for_drvr_lock and ql_adapter_reset
alpha: Send stop IPI to send to online CPUs
virt_wifi: fix error on connect
reiserfs: check directory items on read from disk
reiserfs: add check for root_inode in reiserfs_fill_super
libata: fix ata_pio_sector for CONFIG_HIGHMEM
bpf, selftests: Adjust few selftest result_unpriv outcomes
perf/x86/amd: Don't touch the AMD64_EVENTSEL_HOSTONLY bit inside the guest
soc: ixp4xx/qmgr: fix invalid __iomem access
spi: meson-spicc: fix memory leak in meson_spicc_remove
soc: ixp4xx: fix printing resources
arm64: vdso: Avoid ISB after reading from cntvct_el0
KVM: x86/mmu: Fix per-cpu counter corruption on 32-bit builds
KVM: Do not leak memory for duplicate debugfs directories
KVM: x86: accept userspace interrupt only if no event is injected
md/raid10: properly indicate failure when ending a failed write request
pcmcia: i82092: fix a null pointer dereference bug
timers: Move clearing of base::timer_running under base:: Lock
serial: 8250_pci: Avoid irq sharing for MSI(-X) interrupts.
serial: 8250_pci: Enumerate Elkhart Lake UARTs via dedicated driver
MIPS: Malta: Do not byte-swap accesses to the CBUS UART
serial: 8250: Mask out floating 16/32-bit bus bits
serial: 8250_mtk: fix uart corruption issue when rx power off
serial: tegra: Only print FIFO error message when an error occurs
ext4: fix potential htree corruption when growing large_dir directories
pipe: increase minimum default pipe size to 2 pages
media: rtl28xxu: fix zero-length control request
staging: rtl8712: get rid of flush_scheduled_work
staging: rtl8723bs: Fix a resource leak in sd_int_dpc
tpm_ftpm_tee: Free and unregister TEE shared memory during kexec
optee: Fix memory leak when failing to register shm pages
tee: add tee_shm_alloc_kernel_buf()
optee: Clear stale cache entries during initialization
tracing / histogram: Give calculation hist_fields a size
scripts/tracing: fix the bug that can't parse raw_trace_func
clk: fix leak on devm_clk_bulk_get_all() unwind
usb: otg-fsm: Fix hrtimer list corruption
usb: gadget: f_hid: idle uses the highest byte for duration
usb: gadget: f_hid: fixed NULL pointer dereference
usb: gadget: f_hid: added GET_IDLE and SET_IDLE handlers
usb: cdns3: Fixed incorrect gadget state
ALSA: usb-audio: Add registration quirk for JBL Quantum 600
ALSA: hda/realtek: add mic quirk for Acer SF314-42
firmware_loader: fix use-after-free in firmware_fallback_sysfs
firmware_loader: use -ETIMEDOUT instead of -EAGAIN in fw_load_sysfs_fallback
USB: serial: ftdi_sio: add device ID for Auto-M3 OP-COM v2
USB: serial: ch341: fix character loss at high transfer rates
USB: serial: option: add Telit FD980 composition 0x1056
USB: usbtmc: Fix RCU stall warning
Bluetooth: defer cleanup of resources in hci_unregister_dev()
blk-iolatency: error out if blk_get_queue() failed in iolatency_set_limit()
net: vxge: fix use-after-free in vxge_device_unregister
net: fec: fix use-after-free in fec_drv_remove
net: pegasus: fix uninit-value in get_interrupt_interval
bnx2x: fix an error code in bnx2x_nic_load()
mips: Fix non-POSIX regexp
net: ipv6: fix returned variable type in ip6_skb_dst_mtu
nfp: update ethtool reporting of pauseframe control
sctp: move the active_key update after sh_keys is added
gpio: tqmx86: really make IRQ optional
net: natsemi: Fix missing pci_disable_device() in probe and remove
net: phy: micrel: Fix detection of ksz87xx switch
net: dsa: sja1105: invalidate dynamic FDB entries learned concurrently with statically added ones
net: dsa: sja1105: overwrite dynamic FDB entries with static ones in .port_fdb_add
net, gro: Set inner transport header offset in tcp/udp GRO hook
dmaengine: imx-dma: configure the generic DMA type to make it work
media: videobuf2-core: dequeue if start_streaming fails
scsi: sr: Return correct event when media event code is 3
spi: imx: mx51-ecspi: Fix low-speed CONFIGREG delay calculation
spi: imx: mx51-ecspi: Reinstate low-speed CONFIGREG delay
omap5-board-common: remove not physically existing vdds_1v8_main fixed-regulator
ARM: dts: am437x-l4: fix typo in can@0 node
clk: stm32f4: fix post divisor setup for I2S/SAI PLLs
ALSA: usb-audio: fix incorrect clock source setting
arm64: dts: armada-3720-turris-mox: remove mrvl,i2c-fast-mode
ARM: dts: imx: Swap M53Menlo pinctrl_power_button/pinctrl_power_out pins
ARM: imx: fix missing 3rd argument in macro imx_mmdc_perf_init
ARM: dts: colibri-imx6ull: limit SDIO clock to 25MHz
ARM: dts: imx6qdl-sr-som: Increase the PHY reset duration to 10ms
ARM: imx: add missing clk_disable_unprepare()
ARM: imx: add missing iounmap()
arm64: dts: ls1028a: fix node name for the sysclk
ALSA: seq: Fix racy deletion of subscriber
Revert "ACPICA: Fix memory leak caused by _CID repair function"
ANDROID: GKI: fix up android/abi_gki_aarch64.xml merge
Linux 5.4.139
spi: mediatek: Fix fifo transfer
bpf, selftests: Adjust few selftest outcomes wrt unreachable code
bpf, selftests: Add a verifier test for assigning 32bit reg states to 64bit ones
bpf: Test_verifier, add alu32 bounds tracking tests
bpf: Fix leakage under speculation on mispredicted branches
bpf: Do not mark insn as seen under speculative path verification
bpf: Inherit expanded/patched seen count from old aux data
Revert "watchdog: iTCO_wdt: Account for rebooting on second timeout"
firmware: arm_scmi: Add delayed response status check
firmware: arm_scmi: Ensure drivers provide a probe function
Revert "Bluetooth: Shutdown controller after workqueues are flushed or cancelled"
ACPI: fix NULL pointer dereference
nvme: fix nvme_setup_command metadata trace event
net: Fix zero-copy head len calculation.
qed: fix possible unpaired spin_{un}lock_bh in _qed_mcp_cmd_and_union()
r8152: Fix potential PM refcount imbalance
ASoC: tlv320aic31xx: fix reversed bclk/wclk master bits
spi: stm32h7: fix full duplex irq handler handling
regulator: rt5033: Fix n_voltages settings for BUCK and LDO
btrfs: fix lost inode on log replay after mix of fsync, rename and inode eviction
btrfs: fix race causing unnecessary inode logging during link and rename
btrfs: do not commit logs and transactions during link and rename operations
btrfs: delete duplicated words + other fixes in comments
Linux 5.4.138
can: j1939: j1939_session_deactivate(): clarify lifetime of session object
i40e: Add additional info to PHY type error
Revert "perf map: Fix dso->nsinfo refcounting"
powerpc/pseries: Fix regression while building external modules
PCI: mvebu: Setup BAR0 in order to fix MSI
can: hi311x: fix a signedness bug in hi3110_cmd()
sis900: Fix missing pci_disable_device() in probe and remove
tulip: windbond-840: Fix missing pci_disable_device() in probe and remove
sctp: fix return value check in __sctp_rcv_asconf_lookup
net/mlx5e: Fix nullptr in mlx5e_hairpin_get_mdev()
net/mlx5: Fix flow table chaining
net: llc: fix skb_over_panic
mlx4: Fix missing error code in mlx4_load_one()
net: Set true network header for ECN decapsulation
tipc: fix sleeping in tipc accept routine
i40e: Fix log TC creation failure when max num of queues is exceeded
i40e: Fix queue-to-TC mapping on Tx
i40e: Fix firmware LLDP agent related warning
i40e: Fix logic of disabling queues
netfilter: nft_nat: allow to specify layer 4 protocol NAT only
netfilter: conntrack: adjust stop timestamp to real expiry value
cfg80211: Fix possible memory leak in function cfg80211_bss_update
nfc: nfcsim: fix use after free during module unload
NIU: fix incorrect error return, missed in previous revert
HID: wacom: Re-enable touch by default for Cintiq 24HDT / 27QHDT
can: esd_usb2: fix memory leak
can: ems_usb: fix memory leak
can: usb_8dev: fix memory leak
can: mcba_usb_start(): add missing urb->transfer_dma initialization
can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
can: j1939: j1939_xtp_rx_dat_one(): fix rxtimer value between consecutive TP.DT to 750ms
ocfs2: issue zeroout to EOF blocks
ocfs2: fix zero out valid data
KVM: add missing compat KVM_CLEAR_DIRTY_LOG
x86/kvm: fix vcpu-id indexed array sizes
Revert "ACPI: resources: Add checks for ACPI IRQ override"
btrfs: mark compressed range uptodate only if all bio succeed
btrfs: fix rw device counting in __btrfs_free_extra_devids
x86/asm: Ensure asm/proto.h can be included stand-alone
net_sched: check error pointer in tcf_dump_walker()
Linux 5.4.137
ipv6: ip6_finish_output2: set sk into newly allocated nskb
ARM: dts: versatile: Fix up interrupt controller node names
iomap: remove the length variable in iomap_seek_hole
iomap: remove the length variable in iomap_seek_data
cifs: fix the out of range assignment to bit fields in parse_server_interfaces
firmware: arm_scmi: Fix range check for the maximum number of pending messages
firmware: arm_scmi: Fix possible scmi_linux_errmap buffer overflow
hfs: add lock nesting notation to hfs_find_init
hfs: fix high memory mapping in hfs_bnode_read
hfs: add missing clean-up in hfs_fill_super
ipv6: allocate enough headroom in ip6_finish_output2()
sctp: move 198 addresses from unusable to private scope
net: annotate data race around sk_ll_usec
net/802/garp: fix memleak in garp_request_join()
net/802/mrp: fix memleak in mrp_request_join()
cgroup1: fix leaked context root causing sporadic NULL deref in LTP
workqueue: fix UAF in pwq_unbound_release_workfn()
af_unix: fix garbage collect vs MSG_PEEK
KVM: x86: determine if an exception has an error code only when injecting it.
tools: Allow proper CC/CXX/... override with LLVM=1 in Makefile.include
selftest: fix build error in tools/testing/selftests/vm/userfaultfd.c
ANDROID: Update android/abi_gki_aarch64.xml
ANDROID: Update android/abi_gki_aarch64_goldfish
Linux 5.4.136
xhci: add xhci_get_virt_ep() helper
perf inject: Close inject.output on exit
PCI: Mark AMD Navi14 GPU ATS as broken
btrfs: compression: don't try to compress if we don't have enough pages
iio: accel: bma180: Fix BMA25x bandwidth register values
iio: accel: bma180: Use explicit member assignment
net: bcmgenet: ensure EXT_ENERGY_DET_MASK is clear
net: dsa: mv88e6xxx: use correct .stats_set_histogram() on Topaz
drm: Return -ENOTTY for non-drm ioctls
nds32: fix up stack guard gap
rbd: always kick acquire on "acquired" and "released" notifications
rbd: don't hold lock_rwsem while running_list is being drained
hugetlbfs: fix mount mode command line processing
userfaultfd: do not untag user pointers
selftest: use mmap instead of posix_memalign to allocate memory
ixgbe: Fix packet corruption due to missing DMA sync
media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf()
btrfs: check for missing device in btrfs_trim_fs
tracing: Fix bug in rb_per_cpu_empty() that might cause deadloop.
tracing/histogram: Rename "cpu" to "common_cpu"
firmware/efi: Tell memblock about EFI iomem reservations
usb: dwc2: gadget: Fix sending zero length packet in DDMA mode.
USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick
USB: serial: cp210x: fix comments for GE CS1000
USB: serial: option: add support for u-blox LARA-R6 family
usb: renesas_usbhs: Fix superfluous irqs happen after usb_pkt_pop()
usb: max-3421: Prevent corruption of freed memory
USB: usb-storage: Add LaCie Rugged USB3-FW to IGNORE_UAS
usb: hub: Fix link power management max exit latency (MEL) calculations
usb: hub: Disable USB 3 device initiated lpm if exit latency is too high
KVM: PPC: Book3S HV Nested: Sanitise H_ENTER_NESTED TM state
KVM: PPC: Book3S: Fix H_RTAS rets buffer overflow
xhci: Fix lost USB 2 remote wake
ALSA: hdmi: Expose all pins on MSI MS-7C94 board
ALSA: sb: Fix potential ABBA deadlock in CSP driver
ALSA: usb-audio: Add registration quirk for JBL Quantum headsets
ALSA: usb-audio: Add missing proc text entry for BESPOKEN type
s390/boot: fix use of expolines in the DMA code
s390/ftrace: fix ftrace_update_ftrace_func implementation
Revert "MIPS: add PMD table accounting into MIPS'pmd_alloc_one"
proc: Avoid mixing integer types in mem_rw()
drm/panel: raspberrypi-touchscreen: Prevent double-free
net: sched: cls_api: Fix the the wrong parameter
sctp: update active_key for asoc when old key is being replaced
nvme: set the PRACT bit when using Write Zeroes with T10 PI
r8169: Avoid duplicate sysfs entry creation error
afs: Fix tracepoint string placement with built-in AFS
Revert "USB: quirks: ignore remote wake-up on Fibocom L850-GL LTE modem"
nvme-pci: don't WARN_ON in nvme_reset_work if ctrl.state is not RESETTING
ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions
net/sched: act_skbmod: Skip non-Ethernet packets
net: hns3: fix rx VLAN offload state inconsistent issue
net/tcp_fastopen: fix data races around tfo_active_disable_stamp
net: hisilicon: rename CACHE_LINE_MASK to avoid redefinition
bnxt_en: Check abort error state in bnxt_half_open_nic()
bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in bnxt_fw_rset_task()
bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
bnxt_en: Improve bnxt_ulp_stop()/bnxt_ulp_start() call sequence.
spi: cadence: Correct initialisation of runtime PM again
scsi: target: Fix protect handling in WRITE SAME(32)
scsi: iscsi: Fix iface sysfs attr detection
netrom: Decrease sock refcount when sock timers expire
net: sched: fix memory leak in tcindex_partial_destroy_work
KVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak
KVM: PPC: Book3S: Fix CONFIG_TRANSACTIONAL_MEM=n crash
net: decnet: Fix sleeping inside in af_decnet
efi/tpm: Differentiate missing and invalid final event log table.
net: fix uninit-value in caif_seqpkt_sendmsg
bpftool: Check malloc return value in mount_bpffs_for_pin
bpf, sockmap, tcp: sk_prot needs inuse_idx set for proc stats
s390/bpf: Perform r1 range checking before accessing jit->seen_reg[r1]
liquidio: Fix unintentional sign extension issue on left shift of u16
ASoC: rt5631: Fix regcache sync errors on resume
spi: mediatek: fix fifo rx mode
regulator: hi6421: Fix getting wrong drvdata
regulator: hi6421: Use correct variable type for regmap api val argument
spi: stm32: fixes pm_runtime calls in probe/remove
spi: stm32: Use dma_request_chan() instead dma_request_slave_channel()
spi: imx: add a check for speed_hz before calculating the clock
perf data: Close all files in close_dir()
perf probe-file: Delete namelist in del_events() on the error path
perf lzma: Close lzma stream on exit
perf script: Fix memory 'threads' and 'cpus' leaks on exit
perf dso: Fix memory leak in dso__new_map()
perf test event_update: Fix memory leak of evlist
perf test session_topology: Delete session->evlist
perf env: Fix sibling_dies memory leak
perf probe: Fix dso->nsinfo refcounting
perf map: Fix dso->nsinfo refcounting
nvme-pci: do not call nvme_dev_remove_admin from nvme_remove
cxgb4: fix IRQ free race during driver unload
pwm: sprd: Ensure configuring period and duty_cycle isn't wrongly skipped
selftests: icmp_redirect: IPv6 PMTU info should be cleared after redirect
selftests: icmp_redirect: remove from checking for IPv6 route get
ipv6: fix 'disable_policy' for fwd packets
gve: Fix an error handling path in 'gve_probe()'
igb: Fix position of assignment to *ring
igb: Check if num of q_vectors is smaller than max before array access
iavf: Fix an error handling path in 'iavf_probe()'
e1000e: Fix an error handling path in 'e1000_probe()'
fm10k: Fix an error handling path in 'fm10k_probe()'
igb: Fix an error handling path in 'igb_probe()'
igc: Fix an error handling path in 'igc_probe()'
igc: Prefer to use the pci_release_mem_regions method
ixgbe: Fix an error handling path in 'ixgbe_probe()'
igc: change default return of igc_read_phy_reg()
igb: Fix use-after-free error during reset
igc: Fix use-after-free error during reset
Linux 5.4.135
udp: annotate data races around unix_sk(sk)->gso_size
perf test bpf: Free obj_buf
bpftool: Properly close va_list 'ap' by va_end() on error
ipv6: tcp: drop silly ICMPv6 packet too big messages
tcp: annotate data races around tp->mtu_info
dma-buf/sync_file: Don't leak fences on merge failure
net: fddi: fix UAF in fza_probe
net: validate lwtstate->data before returning from skb_tunnel_info()
net: send SYNACK packet with accepted fwmark
net: ti: fix UAF in tlan_remove_one
net: qcom/emac: fix UAF in emac_remove
net: moxa: fix UAF in moxart_mac_probe
net: ip_tunnel: fix mtu calculation for ETHER tunnel devices
net: bcmgenet: Ensure all TX/RX queues DMAs are disabled
net: bridge: sync fdb to new unicast-filtering ports
net/sched: act_ct: fix err check for nf_conntrack_confirm
netfilter: ctnetlink: suspicious RCU usage in ctnetlink_dump_helpinfo
net: ipv6: fix return value of ip6_skb_dst_mtu
net: dsa: mv88e6xxx: enable .rmu_disable() on Topaz
net: dsa: mv88e6xxx: enable .port_set_policy() on Topaz
dm writecache: return the exact table values that were set
mm: slab: fix kmem_cache_create failed when sysfs node not destroyed
usb: cdns3: Enable TDL_CHK only for OUT ep
f2fs: Show casefolding support only when supported
arm64: dts: marvell: armada-37xx: move firmware node to generic dtsi file
firmware: turris-mox-rwtm: add marvell,armada-3700-rwtm-firmware compatible string
arm64: dts: armada-3720-turris-mox: add firmware node
cifs: prevent NULL deref in cifs_compose_mount_options()
s390: introduce proper type handling call_on_stack() macro
sched/fair: Fix CFS bandwidth hrtimer expiry type
scsi: qedf: Add check to synchronize abort and flush
scsi: libfc: Fix array index out of bound exception
scsi: libsas: Add LUN number check in .slave_alloc callback
scsi: aic7xxx: Fix unintentional sign extension issue on left shift of u8
rtc: max77686: Do not enforce (incorrect) interrupt trigger type
kbuild: mkcompile_h: consider timestamp if KBUILD_BUILD_TIMESTAMP is set
thermal/core: Correct function name thermal_zone_device_unregister()
arm64: dts: imx8mq: assign PCIe clocks
arm64: dts: ls208xa: remove bus-num from dspi node
firmware: tegra: bpmp: Fix Tegra234-only builds
soc/tegra: fuse: Fix Tegra234-only builds
ARM: dts: stm32: move stmmac axi config in ethernet node on stm32mp15
ARM: dts: stm32: fix i2c node name on stm32f746 to prevent warnings
ARM: dts: rockchip: fix supply properties in io-domains nodes
arm64: dts: juno: Update SCPI nodes as per the YAML schema
ARM: dts: stm32: fix timer nodes on STM32 MCU to prevent warnings
ARM: dts: stm32: fix RCC node name on stm32f429 MCU
ARM: dts: stm32: fix gpio-keys node on STM32 MCU boards
ARM: dts: am437x-gp-evm: fix ti,no-reset-on-init flag for gpios
ARM: dts: am57xx-cl-som-am57x: fix ti,no-reset-on-init flag for gpios
kbuild: sink stdout from cmd for silent build
rtc: mxc_v2: add missing MODULE_DEVICE_TABLE
ARM: imx: pm-imx5: Fix references to imx5_cpu_suspend_info
ARM: dts: imx6: phyFLEX: Fix UART hardware flow control
ARM: dts: Hurricane 2: Fix NAND nodes names
ARM: dts: BCM63xx: Fix NAND nodes names
ARM: NSP: dts: fix NAND nodes names
ARM: Cygnus: dts: fix NAND nodes names
ARM: brcmstb: dts: fix NAND nodes names
reset: ti-syscon: fix to_ti_syscon_reset_data macro
arm64: dts: rockchip: Fix power-controller node names for rk3328
arm64: dts: rockchip: Fix power-controller node names for px30
ARM: dts: rockchip: Fix power-controller node names for rk3288
ARM: dts: rockchip: Fix power-controller node names for rk3188
ARM: dts: rockchip: Fix power-controller node names for rk3066a
ARM: dts: rockchip: Fix IOMMU nodes properties on rk322x
ARM: dts: rockchip: Fix the timer clocks order
arm64: dts: rockchip: fix pinctrl sleep nodename for rk3399.dtsi
ARM: dts: rockchip: fix pinctrl sleep nodename for rk3036-kylin and rk3288
ARM: dts: gemini: add device_type on pci
ARM: dts: gemini: rename mdio to the right name
Conflicts:
drivers/mmc/host/sdhci-msm.c
drivers/scsi/ufs/ufshcd.c
drivers/staging/android/ion/heaps/ion_cma_heap.c
drivers/usb/dwc3/gadget.c
include/linux/oom.h
kernel/time/hrtimer.c
mm/oom_kill.c
net/qrtr/qrtr.c
Change-Id: I1c29c9ef4233acd05550475b29b8f7d30b6c452d
Signed-off-by: Srinivasarao Pathipati <quic_spathi@quicinc.com>
|
||
|
Srinivasarao Pathipati
|
412723dbe4 |
Revert dwc3 changes
Reverting below dwc3 patches as they are already present in msm branch |
||
urevanth
|
684cdc265f |
dm verity: Add an optional arg to wait for target devices
Adding new argument "device_wait" Change-Id: I025855c8930415e7f02145b8f0309b8c2fbe2121 Signed-off-by: urevanth <quic_urevanth@quicinc.com> |
||
|
qctecmdr
|
b670ccd79c | Merge "sched/walt: eval_need code and trace cleanup" | ||
Connor O'Brien
|
937e6e41cc |
UPSTREAM: security: selinux: allow per-file labeling for bpffs
Add support for genfscon per-file labeling of bpffs files. This allows for separate permissions for different pinned bpf objects, which may be completely unrelated to each other. Signed-off-by: Connor O'Brien <connoro@google.com> Signed-off-by: Steven Moreland <smoreland@google.com> Acked-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: Paul Moore <paul@paul-moore.com> (cherry picked from commit 4ca54d3d3022ce27170b50e4bdecc3a42f05dbdc) [which is v5.6-rc1-10-g4ca54d3d3022 and thus already included in 5.10] Bug: 200440527 Change-Id: I8234b9047f29981b8140bd81bb2ff070b3b0b843 (cherry picked from commit d52ac987ad2ae16ff313d7fb6185bc412cb221a4) |
||
Akhil P Oommen
|
0c778c3a85 |
msm: kgsl: Update the IFPC power up reglist
Update the IFPC power up reglist to include all the CP Protect registers. Change-Id: I1b43420c466b8a228892afac8ecf05b11b5a80e6 Signed-off-by: Akhil P Oommen <akhilpo@codeaurora.org> |
||
|
Akhil P Oommen
|
0eb8808edc |
msm: kgsl: Update register protection config
Update the register protection configurations as per the latest recommendation. Change-Id: I70365268e8e4c7ee4ff28538f22e970822e4edf0 Signed-off-by: Akhil P Oommen <akhilpo@codeaurora.org> |
||
|
qctecmdr
|
64a2546eea | Merge "Revert "scsi: ufs-qcom: Abort phy power on sequence if clks are off"" | ||
|
Greg Kroah-Hartman
|
553d3c4173 |
This is the 5.4.157 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmGBh6EACgkQONu9yGCS aT4J7A//f9Hx5zW04Y1HOqF4Cd3zDTjSVLzgArYwHRsO22+jin+SqgxgjeXhW0d8 3VkZeSaSvEuwWMB8HCuayl88nzDudFNHm/XReCTnt4uKiP8VOFoDMHQGDeGGl6Rr U2212K8Q3xIkA5OYa5Oma1/IbnL7XDUnte4iHTvIYiBvNwFFd3rDiCUi9sdFti0P SWZI0jFtkZVztohayTdb9y5dcIMiLbvtJEB0aX1XAmHiFWqgD0maVym2fdX2L+5c p6O+eZxRH0LEVham6URh61YnD9b1by+bcIUdWlgnmZkPAf3AXskmWBo1bIcISSXC M/8RlBqlNgKVXD0Y7890ytkTQF+EQgILj0lR5plaeYIp47YyOTYLFg/Ues7dRhn6 XeP3sP/viqguYNzE54dX3t5HfYTbW3h/xzEXMoVZPuPRcM2f/YGAiOjxVyjv5hgv /4bQ1E9gfkNprXiDAad0VUfokxcqzFQR6s9asqmXaaNbvZ1a0Mk8UeR0qcl0FTvw dC6tQZgW2+d0Yi5kAG8pv/RCbZzgJwJa/tJ+I67XYdMUvISXkaGF5hMx6WG7wZBF NSW5JsBh0m8b2hKyypA3sktK0DJfx01y3/wZSXgAv+8by66hvQQuDN1mftChQnZH SAmQovITD85QXZ3LPiAZPtd2fRKAOWJhSQk7bP4cEmjBGPb4HoU= =q1OB -----END PGP SIGNATURE----- Merge 5.4.157 into android11-5.4-lts Changes in 5.4.157 ARM: 9133/1: mm: proc-macros: ensure *_tlb_fns are 4B aligned ARM: 9134/1: remove duplicate memcpy() definition ARM: 9139/1: kprobes: fix arch_init_kprobes() prototype ARM: 9141/1: only warn about XIP address when not compile testing powerpc/bpf: Fix BPF_MOD when imm == 1 ipv6: use siphash in rt6_exception_hash() ipv4: use siphash instead of Jenkins in fnhe_hashfun() usbnet: sanity check for maxpacket usbnet: fix error return code in usbnet_probe() Revert "pinctrl: bcm: ns: support updated DT binding as syscon subnode" ata: sata_mv: Fix the error handling of mv_chip_id() nfc: port100: fix using -ERRNO as command type mask Revert "net: mdiobus: Fix memory leak in __mdiobus_register" net/tls: Fix flipped sign in tls_err_abort() calls mmc: vub300: fix control-message timeouts mmc: cqhci: clear HALT state after CQE enable mmc: dw_mmc: exynos: fix the finding clock sample value mmc: sdhci: Map more voltage level to SDHCI_POWER_330 mmc: sdhci-esdhc-imx: clear the buffer_read_ready to reset standard tuning circuit cfg80211: scan: fix RCU in cfg80211_add_nontrans_list() net: lan78xx: fix division by zero in send path drm/ttm: fix memleak in ttm_transfered_destroy tcp_bpf: Fix one concurrency problem in the tcp_bpf_send_verdict function IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields IB/hfi1: Fix abba locking issue with sc_disable() nvmet-tcp: fix data digest pointer calculation nvme-tcp: fix data digest pointer calculation RDMA/mlx5: Set user priority for DCT arm64: dts: allwinner: h5: NanoPI Neo 2: Fix ethernet node regmap: Fix possible double-free in regcache_rbtree_exit() net: batman-adv: fix error handling net: Prevent infinite while loop in skb_tx_hash() RDMA/sa_query: Use strscpy_pad instead of memcpy to copy a string nios2: Make NIOS2_DTB_SOURCE_BOOL depend on !COMPILE_TEST net: ethernet: microchip: lan743x: Fix driver crash when lan743x_pm_resume fails net: ethernet: microchip: lan743x: Fix dma allocation failure by using dma_set_mask_and_coherent net: nxp: lpc_eth.c: avoid hang when bringing interface down net/tls: Fix flipped sign in async_wait.err assignment phy: phy_ethtool_ksettings_get: Lock the phy for consistency phy: phy_start_aneg: Add an unlocked version sctp: use init_tag from inithdr for ABORT chunk sctp: fix the processing for INIT_ACK chunk sctp: fix the processing for COOKIE_ECHO chunk sctp: add vtag check in sctp_sf_violation sctp: add vtag check in sctp_sf_do_8_5_1_E_sa sctp: add vtag check in sctp_sf_ootb net: use netif_is_bridge_port() to check for IFF_BRIDGE_PORT cfg80211: correct bridge/4addr mode check KVM: s390: clear kicked_mask before sleeping again KVM: s390: preserve deliverable_mask in __airqs_kick_single_vcpu perf script: Check session->header.env.arch before using it Linux 5.4.157 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I8dd3b408b22bc98c06b6a941260157df2a40de00 |
||
|
Greg Kroah-Hartman
|
e6de9a8b5b |
Linux 5.4.157
Link: https://lore.kernel.org/r/20211101082500.203657870@linuxfoundation.org Link: https://lore.kernel.org/r/20211101114235.515637019@linuxfoundation.org Tested-by: Jon Hunter <jonathanh@nvidia.com> Tested-by: Shuah Khan <skhan@linuxfoundation.org> Tested-by: Guenter Roeck <linux@roeck-us.net> Tested-by: Linux Kernel Functional Testing <lkft@linaro.org> Tested-by: Hulk Robot <hulkrobot@huawei.com> Tested-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
Song Liu
|
39fb393e21 |
perf script: Check session->header.env.arch before using it
commit 29c77550eef31b0d72a45b49eeab03b8963264e8 upstream. When perf.data is not written cleanly, we would like to process existing data as much as possible (please see f_header.data.size == 0 condition in perf_session__read_header). However, perf.data with partial data may crash perf. Specifically, we see crash in 'perf script' for NULL session->header.env.arch. Fix this by checking session->header.env.arch before using it to determine native_arch. Also split the if condition so it is easier to read. Committer notes: If it is a pipe, we already assume is a native arch, so no need to check session->header.env.arch. Signed-off-by: Song Liu <songliubraving@fb.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: kernel-team@fb.com Cc: stable@vger.kernel.org Link: http://lore.kernel.org/lkml/20211004053238.514936-1-songliubraving@fb.com Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
Halil Pasic
|
472d9354a9 |
KVM: s390: preserve deliverable_mask in __airqs_kick_single_vcpu
[ Upstream commit 0e9ff65f455dfd0a8aea5e7843678ab6fe097e21 ]
Changing the deliverable mask in __airqs_kick_single_vcpu() is a bug. If
one idle vcpu can't take the interrupts we want to deliver, we should
look for another vcpu that can, instead of saying that we don't want
to deliver these interrupts by clearing the bits from the
deliverable_mask.
Fixes:
|
||
|
Halil Pasic
|
07e9a4e1ab |
KVM: s390: clear kicked_mask before sleeping again
[ Upstream commit 9b57e9d5010bbed7c0d9d445085840f7025e6f9a ]
The idea behind kicked mask is that we should not re-kick a vcpu that
is already in the "kick" process, i.e. that was kicked and is
is about to be dispatched if certain conditions are met.
The problem with the current implementation is, that it assumes the
kicked vcpu is going to enter SIE shortly. But under certain
circumstances, the vcpu we just kicked will be deemed non-runnable and
will remain in wait state. This can happen, if the interrupt(s) this
vcpu got kicked to deal with got already cleared (because the interrupts
got delivered to another vcpu). In this case kvm_arch_vcpu_runnable()
would return false, and the vcpu would remain in kvm_vcpu_block(),
but this time with its kicked_mask bit set. So next time around we
wouldn't kick the vcpu form __airqs_kick_single_vcpu(), but would assume
that we just kicked it.
Let us make sure the kicked_mask is cleared before we give up on
re-dispatching the vcpu.
Fixes:
|
||
Janusz Dziedzic
|
5919a07d71 |
cfg80211: correct bridge/4addr mode check
[ Upstream commit 689a0a9f505f7bffdefe6f17fddb41c8ab6344f6 ]
Without the patch we fail:
$ sudo brctl addbr br0
$ sudo brctl addif br0 wlp1s0
$ sudo iw wlp1s0 set 4addr on
command failed: Device or resource busy (-16)
Last command failed but iface was already in 4addr mode.
Fixes:
|
||
Julian Wiedmann
|
dba9e632ed |
net: use netif_is_bridge_port() to check for IFF_BRIDGE_PORT
[ Upstream commit 2e92a2d0e450740ebe7e7a816162327ad1fde94b ] Trivial cleanup, so that all bridge port-specific code can be found in one go. CC: Johannes Berg <johannes@sipsolutions.net> CC: Roopa Prabhu <roopa@cumulusnetworks.com> CC: Nikolay Aleksandrov <nikolay@cumulusnetworks.com> Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com> Reviewed-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
Xin Long
|
0f5b4c57dc |
sctp: add vtag check in sctp_sf_ootb
[ Upstream commit 9d02831e517aa36ee6bdb453a0eb47bd49923fe3 ]
sctp_sf_ootb() is called when processing DATA chunk in closed state,
and many other places are also using it.
The vtag in the chunk's sctphdr should be verified, otherwise, as
later in chunk length check, it may send abort with the existent
asoc's vtag, which can be exploited by one to cook a malicious
chunk to terminate a SCTP asoc.
When fails to verify the vtag from the chunk, this patch sets asoc
to NULL, so that the abort will be made with the vtag from the
received chunk later.
Fixes:
|
||
|
Xin Long
|
df52776407 |
sctp: add vtag check in sctp_sf_do_8_5_1_E_sa
[ Upstream commit ef16b1734f0a176277b7bb9c71a6d977a6ef3998 ]
sctp_sf_do_8_5_1_E_sa() is called when processing SHUTDOWN_ACK chunk
in cookie_wait and cookie_echoed state.
The vtag in the chunk's sctphdr should be verified, otherwise, as
later in chunk length check, it may send abort with the existent
asoc's vtag, which can be exploited by one to cook a malicious
chunk to terminate a SCTP asoc.
Note that when fails to verify the vtag from SHUTDOWN-ACK chunk,
SHUTDOWN COMPLETE message will still be sent back to peer, but
with the vtag from SHUTDOWN-ACK chunk, as said in 5) of
rfc4960#section-8.4.
While at it, also remove the unnecessary chunk length check from
sctp_sf_shut_8_4_5(), as it's already done in both places where
it calls sctp_sf_shut_8_4_5().
Fixes:
|
||
|
Xin Long
|
0aa322b5fe |
sctp: add vtag check in sctp_sf_violation
[ Upstream commit aa0f697e45286a6b5f0ceca9418acf54b9099d99 ]
sctp_sf_violation() is called when processing HEARTBEAT_ACK chunk
in cookie_wait state, and some other places are also using it.
The vtag in the chunk's sctphdr should be verified, otherwise, as
later in chunk length check, it may send abort with the existent
asoc's vtag, which can be exploited by one to cook a malicious
chunk to terminate a SCTP asoc.
Fixes:
|
||
|
Xin Long
|
d6470c2200 |
sctp: fix the processing for COOKIE_ECHO chunk
[ Upstream commit a64b341b8695e1c744dd972b39868371b4f68f83 ]
1. In closed state: in sctp_sf_do_5_1D_ce():
When asoc is NULL, making packet for abort will use chunk's vtag
in sctp_ootb_pkt_new(). But when asoc exists, vtag from the chunk
should be verified before using peer.i.init_tag to make packet
for abort in sctp_ootb_pkt_new(), and just discard it if vtag is
not correct.
2. In the other states: in sctp_sf_do_5_2_4_dupcook():
asoc always exists, but duplicate cookie_echo's vtag will be
handled by sctp_tietags_compare() and then take actions, so before
that we only verify the vtag for the abort sent for invalid chunk
length.
Fixes:
|
||
|
Xin Long
|
5fe74d5e4d |
sctp: fix the processing for INIT_ACK chunk
[ Upstream commit 438b95a7c98f77d51cbf4db021f41b602d750a3f ]
Currently INIT_ACK chunk in non-cookie_echoed state is processed in
sctp_sf_discard_chunk() to send an abort with the existent asoc's
vtag if the chunk length is not valid. But the vtag in the chunk's
sctphdr is not verified, which may be exploited by one to cook a
malicious chunk to terminal a SCTP asoc.
sctp_sf_discard_chunk() also is called in many other places to send
an abort, and most of those have this problem. This patch is to fix
it by sending abort with the existent asoc's vtag only if the vtag
from the chunk's sctphdr is verified in sctp_sf_discard_chunk().
Note on sctp_sf_do_9_1_abort() and sctp_sf_shutdown_pending_abort(),
the chunk length has been verified before sctp_sf_discard_chunk(),
so replace it with sctp_sf_discard(). On sctp_sf_do_asconf_ack() and
sctp_sf_do_asconf(), move the sctp_chunk_length_valid check ahead of
sctp_sf_discard_chunk(), then replace it with sctp_sf_discard().
Fixes:
|
||
|
Xin Long
|
5953ee99ba |
sctp: use init_tag from inithdr for ABORT chunk
[ Upstream commit 4f7019c7eb33967eb87766e0e4602b5576873680 ]
Currently Linux SCTP uses the verification tag of the existing SCTP
asoc when failing to process and sending the packet with the ABORT
chunk. This will result in the peer accepting the ABORT chunk and
removing the SCTP asoc. One could exploit this to terminate a SCTP
asoc.
This patch is to fix it by always using the initiate tag of the
received INIT chunk for the ABORT chunk to be sent.
Fixes:
|
||
Andrew Lunn
|
5395650d15 |
phy: phy_start_aneg: Add an unlocked version
commit 707293a56f95f8e7e0cfae008010c7933fb68973 upstream.
Split phy_start_aneg into a wrapper which takes the PHY lock, and a
helper doing the real work. This will be needed when
phy_ethtook_ksettings_set takes the lock.
Fixes:
|
||
|
Andrew Lunn
|
c85b696270 |
phy: phy_ethtool_ksettings_get: Lock the phy for consistency
commit c10a485c3de5ccbf1fff65a382cebcb2730c6b06 upstream.
The PHY structure should be locked while copying information out if
it, otherwise there is no guarantee of self consistency. Without the
lock the PHY state machine could be updating the structure.
Fixes:
|
||
Daniel Jordan
|
0dea6379e2 |
net/tls: Fix flipped sign in async_wait.err assignment
commit 1d9d6fd21ad4a28b16ed9ee5432ae738b9dc58aa upstream.
sk->sk_err contains a positive number, yet async_wait.err wants the
opposite. Fix the missed sign flip, which Jakub caught by inspection.
Fixes:
|
||
Trevor Woerner
|
e12b8f3c2b |
net: nxp: lpc_eth.c: avoid hang when bringing interface down
commit ace19b992436a257d9a793672e57abc28fe83e2e upstream.
A hard hang is observed whenever the ethernet interface is brought
down. If the PHY is stopped before the LPC core block is reset,
the SoC will hang. Comparing lpc_eth_close() and lpc_eth_open() I
re-arranged the ordering of the functions calls in lpc_eth_close() to
reset the hardware before stopping the PHY.
Fixes:
|
||
|
Yuiko Oshino
|
b232898c1d |
net: ethernet: microchip: lan743x: Fix dma allocation failure by using dma_set_mask_and_coherent
commit 95a359c9553342d36d408d35331ff0bfce75272f upstream.
The dma failure was reported in the raspberry pi github (issue #4117).
https://github.com/raspberrypi/linux/issues/4117
The use of dma_set_mask_and_coherent fixes the issue.
Tested on 32/64-bit raspberry pi CM4 and 64-bit ubuntu x86 PC with EVB-LAN7430.
Fixes:
|
||
|
Yuiko Oshino
|
92507dc1ef |
net: ethernet: microchip: lan743x: Fix driver crash when lan743x_pm_resume fails
commit d6423d2ec39cce2bfca418c81ef51792891576bc upstream.
The driver needs to clean up and return when the initialization fails on resume.
Fixes:
|
||
Guenter Roeck
|
3708aa267d |
nios2: Make NIOS2_DTB_SOURCE_BOOL depend on !COMPILE_TEST
commit 4a089e95b4d6bb625044d47aed0c442a8f7bd093 upstream.
nios2:allmodconfig builds fail with
make[1]: *** No rule to make target 'arch/nios2/boot/dts/""',
needed by 'arch/nios2/boot/dts/built-in.a'. Stop.
make: [Makefile:1868: arch/nios2/boot/dts] Error 2 (ignored)
This is seen with compile tests since those enable NIOS2_DTB_SOURCE_BOOL,
which in turn enables NIOS2_DTB_SOURCE. This causes the build error
because the default value for NIOS2_DTB_SOURCE is an empty string.
Disable NIOS2_DTB_SOURCE_BOOL for compile tests to avoid the error.
Fixes:
|
||
Mark Zhang
|
b1c76f97ad |
RDMA/sa_query: Use strscpy_pad instead of memcpy to copy a string
commit 64733956ebba7cc629856f4a6ee35a52bc9c023f upstream.
When copying the device name, the length of the data memcpy copied exceeds
the length of the source buffer, which cause the KASAN issue below. Use
strscpy_pad() instead.
BUG: KASAN: slab-out-of-bounds in ib_nl_set_path_rec_attrs+0x136/0x320 [ib_core]
Read of size 64 at addr ffff88811a10f5e0 by task rping/140263
CPU: 3 PID: 140263 Comm: rping Not tainted 5.15.0-rc1+ #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
Call Trace:
dump_stack_lvl+0x57/0x7d
print_address_description.constprop.0+0x1d/0xa0
kasan_report+0xcb/0x110
kasan_check_range+0x13d/0x180
memcpy+0x20/0x60
ib_nl_set_path_rec_attrs+0x136/0x320 [ib_core]
ib_nl_make_request+0x1c6/0x380 [ib_core]
send_mad+0x20a/0x220 [ib_core]
ib_sa_path_rec_get+0x3e3/0x800 [ib_core]
cma_query_ib_route+0x29b/0x390 [rdma_cm]
rdma_resolve_route+0x308/0x3e0 [rdma_cm]
ucma_resolve_route+0xe1/0x150 [rdma_ucm]
ucma_write+0x17b/0x1f0 [rdma_ucm]
vfs_write+0x142/0x4d0
ksys_write+0x133/0x160
do_syscall_64+0x43/0x90
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f26499aa90f
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 29 fd ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 5c fd ff ff 48
RSP: 002b:00007f26495f2dc0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00000000000007d0 RCX: 00007f26499aa90f
RDX: 0000000000000010 RSI: 00007f26495f2e00 RDI: 0000000000000003
RBP: 00005632a8315440 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000293 R12: 00007f26495f2e00
R13: 00005632a83154e0 R14: 00005632a8315440 R15: 00005632a830a810
Allocated by task 131419:
kasan_save_stack+0x1b/0x40
__kasan_kmalloc+0x7c/0x90
proc_self_get_link+0x8b/0x100
pick_link+0x4f1/0x5c0
step_into+0x2eb/0x3d0
walk_component+0xc8/0x2c0
link_path_walk+0x3b8/0x580
path_openat+0x101/0x230
do_filp_open+0x12e/0x240
do_sys_openat2+0x115/0x280
__x64_sys_openat+0xce/0x140
do_syscall_64+0x43/0x90
entry_SYSCALL_64_after_hwframe+0x44/0xae
Fixes:
|
||
Michael Chan
|
18a012869f |
net: Prevent infinite while loop in skb_tx_hash()
commit 0c57eeecc559ca6bc18b8c4e2808bc78dbe769b0 upstream.
Drivers call netdev_set_num_tc() and then netdev_set_tc_queue()
to set the queue count and offset for each TC. So the queue count
and offset for the TCs may be zero for a short period after dev->num_tc
has been set. If a TX packet is being transmitted at this time in the
code path netdev_pick_tx() -> skb_tx_hash(), skb_tx_hash() may see
nonzero dev->num_tc but zero qcount for the TC. The while loop that
keeps looping while hash >= qcount will not end.
Fix it by checking the TC's qcount to be nonzero before using it.
Fixes:
|
||
Pavel Skripkin
|
6422e84718 |
net: batman-adv: fix error handling
commit 6f68cd634856f8ca93bafd623ba5357e0f648c68 upstream.
Syzbot reported ODEBUG warning in batadv_nc_mesh_free(). The problem was
in wrong error handling in batadv_mesh_init().
Before this patch batadv_mesh_init() was calling batadv_mesh_free() in case
of any batadv_*_init() calls failure. This approach may work well, when
there is some kind of indicator, which can tell which parts of batadv are
initialized; but there isn't any.
All written above lead to cleaning up uninitialized fields. Even if we hide
ODEBUG warning by initializing bat_priv->nc.work, syzbot was able to hit
GPF in batadv_nc_purge_paths(), because hash pointer in still NULL. [1]
To fix these bugs we can unwind batadv_*_init() calls one by one.
It is good approach for 2 reasons: 1) It fixes bugs on error handling
path 2) It improves the performance, since we won't call unneeded
batadv_*_free() functions.
So, this patch makes all batadv_*_init() clean up all allocated memory
before returning with an error to no call correspoing batadv_*_free()
and open-codes batadv_mesh_free() with proper order to avoid touching
uninitialized fields.
Link: https://lore.kernel.org/netdev/000000000000c87fbd05cef6bcb0@google.com/ [1]
Reported-and-tested-by: syzbot+28b0702ada0bf7381f58@syzkaller.appspotmail.com
Fixes:
|
||
Yang Yingliang
|
1cead23c1c |
regmap: Fix possible double-free in regcache_rbtree_exit()
commit 55e6d8037805b3400096d621091dfbf713f97e83 upstream.
In regcache_rbtree_insert_to_block(), when 'present' realloc failed,
the 'blk' which is supposed to assign to 'rbnode->block' will be freed,
so 'rbnode->block' points a freed memory, in the error handling path of
regcache_rbtree_init(), 'rbnode->block' will be freed again in
regcache_rbtree_exit(), KASAN will report double-free as follows:
BUG: KASAN: double-free or invalid-free in kfree+0xce/0x390
Call Trace:
slab_free_freelist_hook+0x10d/0x240
kfree+0xce/0x390
regcache_rbtree_exit+0x15d/0x1a0
regcache_rbtree_init+0x224/0x2c0
regcache_init+0x88d/0x1310
__regmap_init+0x3151/0x4a80
__devm_regmap_init+0x7d/0x100
madera_spi_probe+0x10f/0x333 [madera_spi]
spi_probe+0x183/0x210
really_probe+0x285/0xc30
To fix this, moving up the assignment of rbnode->block to immediately after
the reallocation has succeeded so that the data structure stays valid even
if the second reallocation fails.
Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes:
|
||
Clément Bœsch
|
207e6e93e7 |
arm64: dts: allwinner: h5: NanoPI Neo 2: Fix ethernet node
commit 0764e365dacd0b8f75c1736f9236be280649bd18 upstream.
RX and TX delay are provided by ethernet PHY. Reflect that in ethernet
node.
Fixes:
|
||
Patrisious Haddad
|
c29c3295e0 |
RDMA/mlx5: Set user priority for DCT
commit 1ab52ac1e9bc9391f592c9fa8340a6e3e9c36286 upstream.
Currently, the driver doesn't set the PCP-based priority for DCT, hence
DCT response packets are transmitted without user priority.
Fix it by setting user provided priority in the eth_prio field in the DCT
context, which in turn sets the value in the transmitted packet.
Fixes:
|
||
Varun Prakash
|
13ad93a42c |
nvme-tcp: fix data digest pointer calculation
commit d89b9f3bbb58e9e378881209756b0723694f22ff upstream.
ddgst is of type __le32, &req->ddgst + req->offset
increases &req->ddgst by 4 * req->offset, fix this by
type casting &req->ddgst to u8 *.
Fixes:
|
||
|
Varun Prakash
|
b597b0e2e8 |
nvmet-tcp: fix data digest pointer calculation
commit e790de54e94a7a15fb725b34724d41d41cbaa60c upstream.
exp_ddgst is of type __le32, &cmd->exp_ddgst + cmd->offset increases
&cmd->exp_ddgst by 4 * cmd->offset, fix this by type casting
&cmd->exp_ddgst to u8 *.
Fixes:
|
||
Mike Marciniszyn
|
d997d4e436 |
IB/hfi1: Fix abba locking issue with sc_disable()
commit 13bac861952a78664907a0f927d3e874e9a59034 upstream.
sc_disable() after having disabled the send context wakes up any waiters
by calling hfi1_qp_wakeup() while holding the waitlock for the sc.
This is contrary to the model for all other calls to hfi1_qp_wakeup()
where the waitlock is dropped and a local is used to drive calls to
hfi1_qp_wakeup().
Fix by moving the sc->piowait into a local list and driving the wakeup
calls from the list.
Fixes:
|