"LA.UM.9.14.r1-21200-LAHAINA.QSSI13.0"
* tag 'LA.UM.9.14.r1-21200-LAHAINA.QSSI13.0' of https://git.codelinaro.org/clo/la/platform/vendor/qcom-opensource/wlan/qca-wifi-host-cmn:
qcacmn: Realloc memory for wmi_service_ext_bitmap
qcacmn: Remove logic to enable/disable wake msi for drv systems
qcacmn: Fix FILS Discovery rx frames capture in packet capture mode
qcacmn: Roam control configuration for 6 GHz in full scan only on prior discovery
qcacmn: Send fils discovery template to wmi layer
qcacmn: Add a vendor attribute for roam control configuration for full scan
qcacmn: A vendor roam control configuration for delaying hand off for RX
qcacmn: Update mgmt action category
qcacmn: Add support to handle vendor specific protected action frame
Change-Id: I37354c38b6a51b425e14582a06ed29008646f2ad
"LA.UM.9.14.r1-21200-LAHAINA.QSSI13.0"
* tag 'LA.UM.9.14.r1-21200-LAHAINA.QSSI13.0' of https://git.codelinaro.org/clo/la/kernel/msm-5.4:
msm: ipa: add support for PMIPv6
msm: kgsl: Use dma_buf_get() to get dma_buf structure
msm: ipa3: Update MPLS DL Vlan tag array to use 16 bits
soc: qcom: qsee_ipc_irq_bridge: Remove redundant cleanup
wait: Fix __wait_event_hrtimeout for RT/DL tasks
msm: mhi_dev: Add support for MSI disable
spi: spi-msm-geni: Handle IRQ enable and disable
msm: ipa: Add disable_msi flag
msm: ep_pcie: Enable BME Deassert IRQ
Revert "wait: Fix __wait_event_hrtimeout for RT/DL tasks"
net: qrtr: Prevent wakeups using service id based filter
msm: ipa: Rmnet CV2X header file changes
msm: mhi-net-dev: Set MIN and MAX MTU size for Ethernet packet
msm: mhi-net-dev: Don't over-write skb length
mfd: qcom-spmi-pmic: Add remove API
msm: ep_pcie: Add support for MSI disable
cnss2: Add API to send WFC mode to WLAN FW
cnss2: Add data length validation in cnss_wlfw_qdss_data_send_sync()
icnss2: Add data length validation in cnss_wlfw_qdss_data_send_sync()
mhi: core: Add the basic sanity to check the irq registration
cnss2: Unregister host driver during PCI remove
net: qrtr: haven: Add bounds check on tx path
msm: ipa: Add DSCP PCP mapping info ioctl
rpmsg: glink: Remove dev_set_name to avoid KASAN issue
net: qrtr: haven: Add bounds check in rx path
icnss2: Add data length validation in cnss_wlfw_qdss_data_send_sync()
devfreq: memlat: Change number of array elements for holding core_stats
cpu-topology: Change the size of allocation for cpu's raw_capacity
iio: qcom-spmi-adc5: remove the remove callback
cnss2: Validate maximum number of memory segments
cnss2: Add data length validation in cnss_wlfw_qdss_data_send_sync()
Reverts below USB and netfilter patches
memshare: Free QMI handle only if its valid
ANDROID: arm64: mm: perform clean & invalidation in __dma_map_area
arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer
msm: ep_pcie: Sending PME for device initiated D3cold exit
Conflicts:
arch/arm64/boot/dts/vendor/bindings/dma/moxa,moxart-dma.txt
drivers/mmc/core/sd.c
drivers/rpmsg/qcom_glink_native.c
include/linux/rmap.h
mm/rmap.c
Change-Id: Ifc094d4b928fb27ebb4c344cbcf914d9697d705c
Memory allocation is happening without checking the overflow.
This could lead to an unexpected results. Check for overflow
before allocating memory.
Change-Id: Icb513ebd8030976e3f0970e9542596f9c5917843
Signed-off-by: Murali Nalajala <quic_mnalajal@quicinc.com>
Commit e186eb0c0c seperated
the qcom,cpus node into qcom,cluster0/1.
Update accordingly to enable cpu voltage cooling device.
Change-Id: I92fc40e4904cb7c1d31557a2ae6a79aed5451eec
https://source.android.com/docs/security/bulletin/2023-03-01
CVE-2021-33655
* tag 'ASB-2023-03-05_11-5.4' of https://android.googlesource.com/kernel/common:
ANDROID: fs/f2fs: fixup __f2fs_cluster_blocks with F2FS_FS_COMPRESSION
UPSTREAM: usb: gadget: f_fs: Ensure ep0req is dequeued before free_request
UPSTREAM: KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS
UPSTREAM: ext4: add inode table check in __ext4_get_inode_loc to aovid possible infinite loop
UPSTREAM: net_sched: reject TCF_EM_SIMPLE case for complex ematch module
UPSTREAM: ipv6: ensure sane device mtu in tunnels
BACKPORT: iommu: Avoid races around device probe
BACKPORT: mac80211_hwsim: notify wmediumd of used MAC addresses
FROMGIT: mac80211_hwsim: add concurrent channels scanning support over virtio
Change-Id: I225e03054221dc7eae34b5e2b282265951cdcbee
Commit 3cf0f8245d introduced `inode` as
a parameter to F2FS_I_SB() but never declared from where it was
supposed to be accessed from.
This leads to a compile error with CONFIG_F2FS_FS_COMPRESSION enabled:
In file included from fs/f2fs/compress.c:17:
fs/f2fs/compress.c: In function '__f2fs_cluster_blocks':
fs/f2fs/compress.c:813:39: error: 'inode' undeclared (first use in this function)
813 | f2fs_bug_on(F2FS_I_SB(inode),
| ^~~~~
fs/f2fs/f2fs.h:38:38: note: in definition of macro 'f2fs_bug_on'
38 | set_sbi_flag(sbi, SBI_NEED_FSCK); \
| ^~~
fs/f2fs/compress.c:813:39: note: each undeclared identifier is reported only once for each function it appears in
813 | f2fs_bug_on(F2FS_I_SB(inode),
| ^~~~~
fs/f2fs/f2fs.h:38:38: note: in definition of macro 'f2fs_bug_on'
38 | set_sbi_flag(sbi, SBI_NEED_FSCK); \
|
Test: Enable CONFIG_F2FS_FS_COMPRESSION, check compile.
Fixes: 3cf0f8245d ("BACKPORT: f2fs: compress: remove unneeded preallocation")
Change-Id: I40015a66b8b872c86ff782b30581b24f752bb19a
Signed-off-by: Vaisakh Murali <vaisakhmurali@gmail.com>
As per the documentation, function usb_ep_free_request guarantees
the request will not be queued or no longer be re-queued (or
otherwise used). However, with the current implementation it
doesn't make sure that the request in ep0 isn't reused.
Fix this by dequeuing the ep0req on functionfs_unbind before
freeing the request to align with the definition.
Fixes: ddf8abd259 ("USB: f_fs: the FunctionFS driver")
Signed-off-by: Udipto Goswami <quic_ugoswami@quicinc.com>
Tested-by: Krishna Kurapati <quic_kriskura@quicinc.com>
Link: https://lore.kernel.org/r/20221215052906.8993-3-quic_ugoswami@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 265837309
Bug: 266213784
(cherry picked from commit ce405d561b020e5a46340eb5146805a625dcacee https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git/ usb-linus)
Change-Id: Idbc5f13cedac59cbc893d229383b01662f4e4a03
Signed-off-by: Prashanth K <quic_prashk@quicinc.com>
Signed-off-by: Lee Jones <joneslee@google.com>
[ Upstream commit 2e7eab81425ad6c875f2ed47c0ce01e78afc38a5 ]
According to Intel's document on Indirect Branch Restricted
Speculation, "Enabling IBRS does not prevent software from controlling
the predicted targets of indirect branches of unrelated software
executed later at the same predictor mode (for example, between two
different user applications, or two different virtual machines). Such
isolation can be ensured through use of the Indirect Branch Predictor
Barrier (IBPB) command." This applies to both basic and enhanced IBRS.
Since L1 and L2 VMs share hardware predictor modes (guest-user and
guest-kernel), hardware IBRS is not sufficient to virtualize
IBRS. (The way that basic IBRS is implemented on pre-eIBRS parts,
hardware IBRS is actually sufficient in practice, even though it isn't
sufficient architecturally.)
For virtual CPUs that support IBRS, add an indirect branch prediction
barrier on emulated VM-exit, to ensure that the predicted targets of
indirect branches executed in L1 cannot be controlled by software that
was executed in L2.
Since we typically don't intercept guest writes to IA32_SPEC_CTRL,
perform the IBPB at emulated VM-exit regardless of the current
IA32_SPEC_CTRL.IBRS value, even though the IBPB could technically be
deferred until L1 sets IA32_SPEC_CTRL.IBRS, if IA32_SPEC_CTRL.IBRS is
clear at emulated VM-exit.
This is CVE-2022-2196.
Bug: 265479180
Fixes: 5c911beff20a ("KVM: nVMX: Skip IBPB when switching between vmcs01 and vmcs02")
Cc: Sean Christopherson <seanjc@google.com>
Signed-off-by: Jim Mattson <jmattson@google.com>
Reviewed-by: Sean Christopherson <seanjc@google.com>
Link: https://lore.kernel.org/r/20221019213620.1953281-3-jmattson@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ic3ac006d834719d41f8a84c7a557d60b82e05197
Make changes to add new proc ctx and uCP commands to support Proxy Mobile IPv6.
Change-Id: I4c0995ffe6969c3183e6b16dd6dbd1203d7bec43
Signed-off-by: Krishna Nagaraja <quic_krisnag@quicinc.com>
commit eee22187b53611e173161e38f61de1c7ecbeb876 upstream.
In do_writepages, if the value returned by ext4_writepages is "-ENOMEM"
and "wbc->sync_mode == WB_SYNC_ALL", retry until the condition is not met.
In __ext4_get_inode_loc, if the bh returned by sb_getblk is NULL,
the function returns -ENOMEM.
In __getblk_slow, if the return value of grow_buffers is less than 0,
the function returns NULL.
When the three processes are connected in series like the following stack,
an infinite loop may occur:
do_writepages <--- keep retrying
ext4_writepages
mpage_map_and_submit_extent
mpage_map_one_extent
ext4_map_blocks
ext4_ext_map_blocks
ext4_ext_handle_unwritten_extents
ext4_ext_convert_to_initialized
ext4_split_extent
ext4_split_extent_at
__ext4_ext_dirty
__ext4_mark_inode_dirty
ext4_reserve_inode_write
ext4_get_inode_loc
__ext4_get_inode_loc <--- return -ENOMEM
sb_getblk
__getblk_gfp
__getblk_slow <--- return NULL
grow_buffers
grow_dev_page <--- return -ENXIO
ret = (block < end_block) ? 1 : -ENXIO;
In this issue, bg_inode_table_hi is overwritten as an incorrect value.
As a result, `block < end_block` cannot be met in grow_dev_page.
Therefore, __ext4_get_inode_loc always returns '-ENOMEM' and do_writepages
keeps retrying. As a result, the writeback process is in the D state due
to an infinite loop.
Add a check on inode table block in the __ext4_get_inode_loc function by
referring to ext4_read_inode_bitmap to avoid this infinite loop.
Cc: stable@kernel.org
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Link: https://lore.kernel.org/r/20220817132701.3015912-3-libaokun1@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 264629802
Bug: 264632463
Change-Id: Id3bb71336059cac33f16fca383e783add3a01295
Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>
[ Upstream commit 9cd3fd2054c3b3055163accbf2f31a4426f10317 ]
When TCF_EM_SIMPLE was introduced, it is supposed to be convenient
for ematch implementation:
https://lore.kernel.org/all/20050105110048.GO26856@postel.suug.ch/
"You don't have to, providing a 32bit data chunk without TCF_EM_SIMPLE
set will simply result in allocating & copy. It's an optimization,
nothing more."
So if an ematch module provides ops->datalen that means it wants a
complex data structure (saved in its em->data) instead of a simple u32
value. We should simply reject such a combination, otherwise this u32
could be misinterpreted as a pointer.
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-and-tested-by: syzbot+4caeae4c7103813598ae@syzkaller.appspotmail.com
Reported-by: Jun Nie <jun.nie@linaro.org>
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Cc: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Cong Wang <cong.wang@bytedance.com>
Acked-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Bug: 262113355
Bug: 262114215
Change-Id: I03be57351f76f699d4635cf31178e0f3a19e61a5
Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>
Currently we don't ensure if vma->vm_file is associated with dma_buf. This
can cause issues later when private_data from a non dma_buf file is used as
dma_buf structure. Hence get the fd that is associated with vma->vm_file
and use dma_buf_get() to get pointer to dma_buf structure. dma_buf_get()
ensures that the file from the input fd is associated with dma_buf.
Change-Id: Ib78aef8b16bedca5ca86d3a132278ff9f07dce73
Signed-off-by: Puranam V G Tejaswi <quic_pvgtejas@quicinc.com>
We currently have 3 different ways that __iommu_probe_device() may be
called, but no real guarantee that multiple callers can't tread on each
other, especially once asynchronous driver probe gets involved. It would
likely have taken a fair bit of luck to hit this previously, but commit
57365a04c921 ("iommu: Move bus setup to IOMMU device registration") ups
the odds since now it's not just omap-iommu that may trigger multiple
bus_iommu_probe() calls in parallel if probing asynchronously.
Add a lock to ensure we can't try to double-probe a device, and also
close some possible race windows to make sure we're truly robust against
trying to double-initialise a group via two different member devices.
Reported-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Tested-by: Brian Norris <briannorris@chromium.org>
Fixes: 57365a04c921 ("iommu: Move bus setup to IOMMU device registration")
Link: https://lore.kernel.org/r/1946ef9f774851732eed78760a78ec40dbc6d178.1667591503.git.robin.murphy@arm.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Bug: 269232600
(cherry picked from commit 01657bc14a3990c665375f77978631fee77b1fce)
Change-Id: Ie87f8f7a7b90431c3a2682923961885ce7b239f3
Signed-off-by: Zhenhua Huang <quic_zhenhuah@quicinc.com>
Signed-off-by: Srinivasarao Pathipati <quic_spathi@quicinc.com>
MPLS GRE supports 12 bits up to 4094 vlans. 16 bits
can support this max value while 8 bits will support
only 254 values. Without this fix, vlans 255-4094 are
not usable.
Change-Id: I582f0186b2d1042e394b75762793b6234b0f097e
Signed-off-by: Michael Adisumarta <quic_madisuma@quicinc.com>
https://source.android.com/docs/security/bulletin/2023-02-01
CVE-2022-39189
CVE-2022-39842
CVE-2022-41222
CVE-2023-20937
CVE-2023-20938
CVE-2022-0850
* tag 'ASB-2023-02-05_11-5.4' of https://android.googlesource.com/kernel/common:
ANDROID: ABI: Cuttlefish Symbol update
UPSTREAM: media: dvb-core: Fix UAF due to refcount races at releasing
ANDROID: abi_gki_aarch64_qcom: Add hrtimer_sleeper_start_expires
UPSTREAM: ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF
ANDROID: Revert "tracing/ring-buffer: Have polling block on watermark"
UPSTREAM: usb: gadget: f_hid: fix f_hidg lifetime vs cdev
UPSTREAM: usb: gadget: f_hid: optional SETUP/SET_REPORT mode
ANDROID: add TEST_MAPPING for net/, include/net
UPSTREAM: nfp: fix use-after-free in area_cache_get()
UPSTREAM: proc: avoid integer type confusion in get_proc_long
UPSTREAM: proc: proc_skip_spaces() shouldn't think it is working on C strings
ANDROID: usb: f_accessory: Check buffer size when initialised via composite
BACKPORT: mm: don't be stuck to rmap lock on reclaim path
ANDROID: Add more hvc devices for virtio-console.
Revert "mmc: sdhci: Fix voltage switch delay"
ANDROID: gki_defconfig: add CONFIG_FUNCTION_ERROR_INJECTION
Linux 5.4.226
ipc/sem: Fix dangling sem_array access in semtimedop race
v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() fails
proc: proc_skip_spaces() shouldn't think it is working on C strings
proc: avoid integer type confusion in get_proc_long
mmc: sdhci: Fix voltage switch delay
mmc: sdhci: use FIELD_GET for preset value bit masks
char: tpm: Protect tpm_pm_suspend with locks
Revert "clocksource/drivers/riscv: Events are stopped during CPU suspend"
x86/ioremap: Fix page aligned size calculation in __ioremap_caller()
Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM
x86/pm: Add enumeration check before spec MSRs save/restore setup
x86/tsx: Add a feature bit for TSX control MSR support
nvme: ensure subsystem reset is single threaded
nvme: restrict management ioctls to admin
epoll: check for events when removing a timed out thread from the wait queue
epoll: call final ep_events_available() check under the lock
tracing/ring-buffer: Have polling block on watermark
ipv4: Fix route deletion when nexthop info is not specified
ipv4: Handle attempt to delete multipath route when fib_info contains an nh reference
selftests: net: fix nexthop warning cleanup double ip typo
selftests: net: add delete nexthop route warning test
Kconfig.debug: provide a little extra FRAME_WARN leeway when KASAN is enabled
parisc: Increase FRAME_WARN to 2048 bytes on parisc
xtensa: increase size of gcc stack frame check
parisc: Increase size of gcc stack frame check
iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init()
pinctrl: single: Fix potential division by zero
ASoC: ops: Fix bounds check for _sx controls
mm: Fix '.data.once' orphan section warning
arm64: errata: Fix KVM Spectre-v2 mitigation selection for Cortex-A57/A72
arm64: Fix panic() when Spectre-v2 causes Spectre-BHB to re-allocate KVM vectors
tracing: Free buffers when a used dynamic event is removed
mmc: sdhci-sprd: Fix no reset data and command after voltage switch
mmc: sdhci-esdhc-imx: correct CQHCI exit halt state check
mmc: core: Fix ambiguous TRIM and DISCARD arg
mmc: mmc_test: Fix removal of debugfs file
pinctrl: intel: Save and restore pins in "direct IRQ" mode
x86/bugs: Make sure MSR_SPEC_CTRL is updated properly upon resume from S3
nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()
tools/vm/slabinfo-gnuplot: use "grep -E" instead of "egrep"
error-injection: Add prompt for function error injection
net/mlx5: DR, Fix uninitialized var warning
hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()
hwmon: (coretemp) Check for null before removing sysfs attrs
net: ethernet: renesas: ravb: Fix promiscuous mode after system resumed
sctp: fix memory leak in sctp_stream_outq_migrate()
packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE
net: tun: Fix use-after-free in tun_detach()
afs: Fix fileserver probe RTT handling
net: hsr: Fix potential use-after-free
dsa: lan9303: Correct stat name
net: ethernet: nixge: fix NULL dereference
net/9p: Fix a potential socket leak in p9_socket_open
net: net_netdev: Fix error handling in ntb_netdev_init_module()
net: phy: fix null-ptr-deref while probe() failed
wifi: cfg80211: fix buffer overflow in elem comparison
qlcnic: fix sleep-in-atomic-context bugs caused by msleep
can: cc770: cc770_isa_probe(): add missing free_cc770dev()
can: sja1000_isa: sja1000_isa_probe(): add missing free_sja1000dev()
net/mlx5e: Fix use-after-free when reverting termination table
net/mlx5: Fix uninitialized variable bug in outlen_write()
of: property: decrement node refcount in of_fwnode_get_reference_args()
hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails
hwmon: (i5500_temp) fix missing pci_disable_device()
scripts/faddr2line: Fix regression in name resolution on ppc64le
iio: light: rpr0521: add missing Kconfig dependencies
iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw
iio: health: afe4403: Fix oob read in afe4403_read_raw
btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit()
drm/amdgpu: Partially revert "drm/amdgpu: update drm_display_info correctly when the edid is read"
drm/amdgpu: update drm_display_info correctly when the edid is read
btrfs: move QUOTA_ENABLED check to rescan_should_stop from btrfs_qgroup_rescan_worker
spi: spi-imx: Fix spi_bus_clk if requested clock is higher than input clock
btrfs: free btrfs_path before copying inodes to userspace
fuse: lock inode unconditionally in fuse_fallocate()
drm/i915: fix TLB invalidation for Gen12 video and compute engines
drm/amdgpu: always register an MMU notifier for userptr
drm/amd/dc/dce120: Fix audio register mapping, stop triggering KASAN
btrfs: sysfs: normalize the error handling branch in btrfs_init_sysfs()
btrfs: free btrfs_path before copying subvol info to userspace
btrfs: free btrfs_path before copying fspath to userspace
btrfs: free btrfs_path before copying root refs to userspace
binder: Gracefully handle BINDER_TYPE_FDA objects with num_fds=0
binder: Address corner cases in deferred copy and fixup
binder: fix pointer cast warning
binder: defer copies of pre-patched txn data
binder: read pre-translated fds from sender buffer
binder: avoid potential data leakage when copying txn
dm integrity: flush the journal on suspend
net: usb: qmi_wwan: add Telit 0x103a composition
tcp: configurable source port perturb table size
platform/x86: hp-wmi: Ignore Smart Experience App event
platform/x86: acer-wmi: Enable SW_TABLET_MODE on Switch V 10 (SW5-017)
platform/x86: asus-wmi: add missing pci_dev_put() in asus_wmi_set_xusb2pr()
xen/platform-pci: add missing free_irq() in error path
serial: 8250: 8250_omap: Avoid RS485 RTS glitch on ->set_termios()
ASoC: Intel: bytcht_es8316: Add quirk for the Nanote UMPC-01
Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode
gcov: clang: fix the buffer overflow issue
nilfs2: fix nilfs_sufile_mark_dirty() not set segment usage as dirty
firmware: coreboot: Register bus in module init
firmware: google: Release devices before unregistering the bus
ceph: avoid putting the realm twice when decoding snaps fails
ceph: do not update snapshot context when there is no new snapshot
iio: pressure: ms5611: fixed value compensation bug
iio: ms5611: Simplify IO callback parameters
nios2: add FORCE for vmlinuz.gz
init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash
iio: core: Fix entry not deleted when iio_register_sw_trigger_type() fails
iio: light: apds9960: fix wrong register for gesture gain
arm64: dts: rockchip: lower rk3399-puma-haikou SD controller clock frequency
usb: dwc3: exynos: Fix remove() function
lib/vdso: use "grep -E" instead of "egrep"
s390/crashdump: fix TOD programmable field size
net: thunderx: Fix the ACPI memory leak
nfc: st-nci: fix memory leaks in EVT_TRANSACTION
nfc: st-nci: fix incorrect validating logic in EVT_TRANSACTION
s390/dasd: fix no record found for raw_track_access
dccp/tcp: Reset saddr on failure after inet6?_hash_connect().
bnx2x: fix pci device refcount leak in bnx2x_vf_is_pcie_pending()
regulator: twl6030: re-add TWL6032_SUBCLASS
NFC: nci: fix memory leak in nci_rx_data_packet()
xfrm: Fix ignored return value in xfrm6_init()
tipc: check skb_linearize() return value in tipc_disc_rcv()
tipc: add an extra conn_get in tipc_conn_alloc
tipc: set con sock in tipc_conn_alloc
net/mlx5: Fix FW tracer timestamp calculation
Drivers: hv: vmbus: fix possible memory leak in vmbus_device_register()
Drivers: hv: vmbus: fix double free in the error path of vmbus_add_channel_work()
nfp: add port from netdev validation for EEPROM access
net: pch_gbe: fix pci device refcount leak while module exiting
net/qla3xxx: fix potential memleak in ql3xxx_send()
net/mlx4: Check retval of mlx4_bitmap_init
ARM: mxs: fix memory leak in mxs_machine_init()
9p/fd: fix issue of list_del corruption in p9_fd_cancel()
net: pch_gbe: fix potential memleak in pch_gbe_tx_queue()
nfc/nci: fix race with opening and closing
net: liquidio: simplify if expression
ARM: dts: at91: sam9g20ek: enable udc vbus gpio pinctrl
tee: optee: fix possible memory leak in optee_register_device()
bus: sunxi-rsb: Support atomic transfers
regulator: core: fix UAF in destroy_regulator()
regulator: core: fix kobject release warning and memory leak in regulator_register()
ASoC: sgtl5000: Reset the CHIP_CLK_CTRL reg on remove
ARM: dts: am335x-pcm-953: Define fixed regulators in root node
af_key: Fix send_acquire race with pfkey_register
MIPS: pic32: treat port as signed integer
RISC-V: vdso: Do not add missing symbols to version section in linker script
arm64/syscall: Include asm/ptrace.h in syscall_wrapper header.
block, bfq: fix null pointer dereference in bfq_bio_bfqg()
drm: panel-orientation-quirks: Add quirk for Acer Switch V 10 (SW5-017)
spi: stm32: fix stm32_spi_prepare_mbr() that halves spi clk for every run
wifi: mac80211: Fix ack frame idr leak when mesh has no route
audit: fix undefined behavior in bit shift for AUDIT_BIT
wifi: mac80211_hwsim: fix debugfs attribute ps with rc table support
wifi: mac80211: fix memory free error when registering wiphy fail
Revert "can: af_can: fix NULL pointer dereference in can_rx_register()"
Linux 5.4.225
ntfs: check overflow when iterating ATTR_RECORDs
ntfs: fix out-of-bounds read in ntfs_attr_find()
ntfs: fix use-after-free in ntfs_attr_find()
mm: fs: initialize fsdata passed to write_begin/write_end interface
9p/trans_fd: always use O_NONBLOCK read/write
gfs2: Switch from strlcpy to strscpy
gfs2: Check sb_bsize_shift after reading superblock
9p: trans_fd/p9_conn_cancel: drop client lock earlier
kcm: close race conditions on sk_receive_queue
bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb()
kcm: avoid potential race in kcm_tx_work
tcp: cdg: allow tcp_cdg_release() to be called multiple times
macvlan: enforce a consistent minimal mtu
Input: i8042 - fix leaking of platform device on module removal
kprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case
scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus()
ring-buffer: Include dropped pages in counting dirty patches
serial: 8250: Flush DMA Rx on RLSI
misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
docs: update mediator contact information in CoC doc
mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
mmc: sdhci-pci-o2micro: fix card detect fail issue caused by CD# debounce timeout
mmc: core: properly select voltage range without power cycle
scsi: zfcp: Fix double free of FSF request when qdio send fails
Input: iforce - invert valid length check when fetching device IDs
serial: 8250_lpss: Configure DMA also w/o DMA filter
serial: 8250: Fall back to non-DMA Rx if IIR_RDI occurs
dm ioctl: fix misbehavior if list_versions races with module loading
iio: pressure: ms5611: changed hardcoded SPI speed to value limited
iio: trigger: sysfs: fix possible memory leak in iio_sysfs_trig_init()
iio: adc: at91_adc: fix possible memory leak in at91_adc_allocate_trigger()
usb: chipidea: fix deadlock in ci_otg_del_timer
usb: add NO_LPM quirk for Realforce 87U Keyboard
USB: serial: option: add Fibocom FM160 0x0111 composition
USB: serial: option: add u-blox LARA-L6 modem
USB: serial: option: add u-blox LARA-R6 00B modem
USB: serial: option: remove old LARA-R6 PID
USB: serial: option: add Sierra Wireless EM9191
speakup: fix a segfault caused by switching consoles
slimbus: stream: correct presence rate frequencies
Revert "usb: dwc3: disable USB core PHY management"
ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open()
ring_buffer: Do not deactivate non-existant pages
ftrace: Fix null pointer dereference in ftrace_add_mod()
ftrace: Optimize the allocation for mcount entries
ftrace: Fix the possible incorrect kernel message
cifs: add check for returning value of SMB2_set_info_init
net: thunderbolt: Fix error handling in tbnet_init()
cifs: Fix wrong return value checking when GETFLAGS
net/x25: Fix skb leak in x25_lapb_receive_frame()
platform/x86/intel: pmc: Don't unconditionally attach Intel PMC when virtualized
drbd: use after free in drbd_create_device()
xen/pcpu: fix possible memory leak in register_pcpu()
bnxt_en: Remove debugfs when pci_register_driver failed
net: caif: fix double disconnect client in chnl_net_open()
net: macvlan: Use built-in RCU list checking
mISDN: fix misuse of put_device() in mISDN_register_device()
net: liquidio: release resources when liquidio driver open failed
mISDN: fix possible memory leak in mISDN_dsp_element_register()
net: bgmac: Drop free_netdev() from bgmac_enet_remove()
ata: libata-transport: fix double ata_host_put() in ata_tport_add()
arm64: dts: imx8mn: Fix NAND controller size-cells
arm64: dts: imx8mm: Fix NAND controller size-cells
pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map
parport_pc: Avoid FIFO port location truncation
siox: fix possible memory leak in siox_device_add()
block: sed-opal: kmalloc the cmd/resp buffers
ASoC: soc-utils: Remove __exit for snd_soc_util_exit()
tty: n_gsm: fix sleep-in-atomic-context bug in gsm_control_send
serial: imx: Add missing .thaw_noirq hook
serial: 8250: omap: Flush PM QOS work on remove
serial: 8250: omap: Fix unpaired pm_runtime_put_sync() in omap8250_remove()
serial: 8250_omap: remove wait loop from Errata i202 workaround
ASoC: core: Fix use-after-free in snd_soc_exit()
spi: stm32: Print summary 'callbacks suppressed' message
ASoC: codecs: jz4725b: Fix spelling mistake "Sourc" -> "Source", "Routee" -> "Route"
Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm
btrfs: remove pointless and double ulist frees in error paths of qgroup tests
drm/imx: imx-tve: Fix return type of imx_tve_connector_mode_valid
i2c: i801: add lis3lv02d's I2C address for Vostro 5568
NFSv4: Retry LOCK on OLD_STATEID during delegation return
selftests/intel_pstate: fix build for ARCH=x86_64
selftests/futex: fix build for clang
ASoC: codecs: jz4725b: fix capture selector naming
ASoC: codecs: jz4725b: use right control for Capture Volume
ASoC: codecs: jz4725b: fix reported volume for Master ctl
ASoC: codecs: jz4725b: add missed Line In power control bit
spi: intel: Fix the offset to get the 64K erase opcode
ASoC: wm8962: Add an event handler for TEMP_HP and TEMP_SPK
ASoC: wm8997: Revert "ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe"
ASoC: wm5110: Revert "ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe"
ASoC: wm5102: Revert "ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe"
x86/cpu: Restore AMD's DE_CFG MSR after resume
net: tun: call napi_schedule_prep() to ensure we own a napi
dmaengine: at_hdmac: Check return code of dma_async_device_register
dmaengine: at_hdmac: Fix impossible condition
dmaengine: at_hdmac: Don't allow CPU to reorder channel enable
dmaengine: at_hdmac: Fix completion of unissued descriptor in case of errors
dmaengine: at_hdmac: Don't start transactions at tx_submit level
dmaengine: at_hdmac: Fix at_lli struct definition
cert host tools: Stop complaining about deprecated OpenSSL functions
can: j1939: j1939_send_one(): fix missing CAN header initialization
udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
btrfs: selftests: fix wrong error check in btrfs_free_dummy_root()
platform/x86: hp_wmi: Fix rfkill causing soft blocked wifi
drm/i915/dmabuf: fix sg_table handling in map_dma_buf
nilfs2: fix use-after-free bug of ns_writer on remount
nilfs2: fix deadlock in nilfs_count_free_blocks()
vmlinux.lds.h: Fix placement of '.data..decrypted' section
ALSA: usb-audio: Add DSD support for Accuphase DAC-60
ALSA: usb-audio: Add quirk entry for M-Audio Micro
ALSA: hda: fix potential memleak in 'add_widget_node'
ALSA: hda/ca0132: add quirk for EVGA Z390 DARK
mmc: sdhci-tegra: Fix SDHCI_RESET_ALL for CQHCI
mmc: sdhci-of-arasan: Fix SDHCI_RESET_ALL for CQHCI
mmc: cqhci: Provide helper for resetting both SDHCI and CQHCI
MIPS: jump_label: Fix compat branch range check
arm64: efi: Fix handling of misaligned runtime regions and drop warning
riscv: process: fix kernel info leakage
net: macvlan: fix memory leaks of macvlan_common_newlink
ethernet: tundra: free irq when alloc ring failed in tsi108_open()
net: mv643xx_eth: disable napi when init rxq or txq failed in mv643xx_eth_open()
ethernet: s2io: disable napi when start nic failed in s2io_card_up()
cxgb4vf: shut down the adapter when t4vf_update_port_info() failed in cxgb4vf_open()
net: cxgb3_main: disable napi when bind qsets failed in cxgb_up()
net: cpsw: disable napi in cpsw_ndo_open()
net/mlx5: Allow async trigger completion execution on single CPU systems
net: nixge: disable napi when enable interrupts failed in nixge_open()
perf stat: Fix printing os->prefix in CSV metrics output
drivers: net: xgene: disable napi when register irq failed in xgene_enet_open()
dmaengine: mv_xor_v2: Fix a resource leak in mv_xor_v2_remove()
dmaengine: pxa_dma: use platform_get_irq_optional
tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header
can: af_can: fix NULL pointer dereference in can_rx_register()
ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network
drm/vc4: Fix missing platform_unregister_drivers() call in vc4_drm_register()
hamradio: fix issue of dev reference count leakage in bpq_device_event()
net: lapbether: fix issue of dev reference count leakage in lapbeth_device_event()
capabilities: fix undefined behavior in bit shift for CAP_TO_MASK
net: fman: Unregister ethernet device on removal
bnxt_en: fix potentially incorrect return value for ndo_rx_flow_steer
bnxt_en: Fix possible crash in bnxt_hwrm_set_coal()
net: tun: Fix memory leaks of napi_get_frags
net: gso: fix panic on frag_list with mixed head alloc types
HID: hyperv: fix possible memory leak in mousevsc_probe()
bpf, sockmap: Fix the sk->sk_forward_alloc warning of sk_stream_kill_queues
wifi: cfg80211: fix memory leak in query_regdb_file()
wifi: cfg80211: silence a sparse RCU warning
phy: stm32: fix an error code in probe
xfs: drain the buf delwri queue before xfsaild idles
xfs: preserve inode versioning across remounts
xfs: use MMAPLOCK around filemap_map_pages()
xfs: redesign the reflink remap loop to fix blkres depletion crash
xfs: rename xfs_bmap_is_real_extent to is_written_extent
xfs: preserve rmapbt swapext block reservation from freed blocks
ANDROID: properly copy the scm_io_uring field in struct sk_buff
Linux 5.4.224
ipc: remove memcg accounting for sops objects in do_semtimedop()
wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker()
drm/i915/sdvo: Setup DDC fully before output init
drm/i915/sdvo: Filter out invalid outputs more sensibly
drm/rockchip: dsi: Force synchronous probe
mtd: rawnand: gpmi: Set WAIT_FOR_READY timeout based on program/erase times
KVM: x86: emulator: update the emulation mode after CR0 write
KVM: x86: emulator: introduce emulator_recalc_and_set_mode
KVM: x86: emulator: em_sysexit should update ctxt->mode
KVM: x86: Mask off reserved bits in CPUID.80000008H
KVM: x86: Mask off reserved bits in CPUID.8000001AH
ext4: fix BUG_ON() when directory entry has invalid rec_len
ext4: fix warning in 'ext4_da_release_space'
parisc: Avoid printing the hardware path twice
parisc: Export iosapic_serial_irq() symbol for serial port driver
parisc: Make 8250_gsc driver dependend on CONFIG_PARISC
ALSA: usb-audio: Add quirks for MacroSilicon MS2100/MS2106 devices
perf/x86/intel: Add Cooper Lake stepping to isolation_ucodes[]
perf/x86/intel: Fix pebs event constraints for ICL
efi: random: reduce seed size to 32 bytes
fuse: add file_modified() to fallocate
capabilities: fix potential memleak on error path from vfs_getxattr_alloc()
tracing/histogram: Update document for KEYS_MAX size
tools/nolibc/string: Fix memcmp() implementation
kprobe: reverse kp->flags when arm_kprobe failed
tcp/udp: Make early_demux back namespacified.
btrfs: fix type of parameter generation in btrfs_get_dentry
binder: fix UAF of alloc->vma in race with munmap()
memcg: enable accounting of ipc resources
tcp/udp: Fix memory leak in ipv6_renew_options().
block, bfq: protect 'bfqd->queued' by 'bfqd->lock'
Bluetooth: L2CAP: Fix attempting to access uninitialized memory
xfs: Add the missed xfs_perag_put() for xfs_ifree_cluster()
xfs: don't fail unwritten extent conversion on writeback due to edquot
xfs: group quota should return EDQUOT when prj quota enabled
xfs: gut error handling in xfs_trans_unreserve_and_mod_sb()
xfs: use ordered buffers to initialize dquot buffers during quotacheck
xfs: don't fail verifier on empty attr3 leaf block
i2c: xiic: Add platform module alias
HID: saitek: add madcatz variant of MMO7 mouse device ID
scsi: core: Restrict legal sdev_state transitions via sysfs
media: meson: vdec: fix possible refcount leak in vdec_probe()
media: dvb-frontends/drxk: initialize err to 0
media: cros-ec-cec: limit msg.len to CEC_MAX_MSG_SIZE
media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE
ipv6: fix WARNING in ip6_route_net_exit_late()
net, neigh: Fix null-ptr-deref in neigh_table_clear()
net: mdio: fix undefined behavior in bit shift for __mdiobus_register
Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del()
Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu
btrfs: fix ulist leaks in error paths of qgroup self tests
btrfs: fix inode list leak during backref walking at find_parent_nodes()
btrfs: fix inode list leak during backref walking at resolve_indirect_refs()
isdn: mISDN: netjet: fix wrong check of device registration
mISDN: fix possible memory leak in mISDN_register_device()
rose: Fix NULL pointer dereference in rose_send_frame()
ipvs: fix WARNING in ip_vs_app_net_cleanup()
ipvs: fix WARNING in __ip_vs_cleanup_batch()
ipvs: use explicitly signed chars
netfilter: nf_tables: release flow rule object from commit path
net: tun: fix bugs for oversize packet when napi frags enabled
net: sched: Fix use after free in red_enqueue()
ata: pata_legacy: fix pdc20230_set_piomode()
net: fec: fix improper use of NETDEV_TX_BUSY
nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send()
nfc: s3fwrn5: Fix potential memory leak in s3fwrn5_nci_send()
RDMA/qedr: clean up work queue on failure in qedr_alloc_resources()
RDMA/core: Fix null-ptr-deref in ib_core_cleanup()
net: dsa: Fix possible memory leaks in dsa_loop_init()
nfs4: Fix kmemleak when allocate slot failed
NFSv4.1: We must always send RECLAIM_COMPLETE after a reboot
NFSv4.1: Handle RECLAIM_COMPLETE trunking errors
IB/hfi1: Correctly move list in sc_disable()
RDMA/cma: Use output interface for net_dev check
Linux 5.4.223
can: rcar_canfd: rcar_canfd_handle_global_receive(): fix IRQ storm on global FIFO receive
net: enetc: survive memory pressure without crashing
net/mlx5: Fix possible use-after-free in async command interface
net/mlx5e: Do not increment ESN when updating IPsec ESN state
nh: fix scope used to find saddr when adding non gw nh
net: ehea: fix possible memory leak in ehea_register_port()
openvswitch: switch from WARN to pr_warn
ALSA: aoa: Fix I2S device accounting
ALSA: aoa: i2sbus: fix possible memory leak in i2sbus_add_dev()
PM: domains: Fix handling of unavailable/disabled idle states
net: ksz884x: fix missing pci_disable_device() on error in pcidev_init()
i40e: Fix flow-type by setting GL_HASH_INSET registers
i40e: Fix VF hang when reset is triggered on another VF
i40e: Fix ethtool rx-flow-hash setting for X722
media: videodev2.h: V4L2_DV_BT_BLANKING_HEIGHT should check 'interlaced'
media: v4l2-dv-timings: add sanity checks for blanking values
media: vivid: dev->bitmap_cap wasn't freed in all cases
media: vivid: s_fbuf: add more sanity checks
PM: hibernate: Allow hybrid sleep to work with s2idle
can: mscan: mpc5xxx: mpc5xxx_can_probe(): add missing put_clock() in error path
tcp: fix indefinite deferral of RTO with SACK reneging
net: lantiq_etop: don't free skb when returning NETDEV_TX_BUSY
net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed
kcm: annotate data-races around kcm->rx_wait
kcm: annotate data-races around kcm->rx_psock
amd-xgbe: add the bit rate quirk for Molex cables
amd-xgbe: fix the SFP compliance codes check for DAC cables
x86/unwind/orc: Fix unreliable stack dump with gcov
net: netsec: fix error handling in netsec_register_mdio()
tipc: fix a null-ptr-deref in tipc_topsrv_accept
ALSA: ac97: fix possible memory leak in snd_ac97_dev_register()
arc: iounmap() arg is volatile
drm/msm: Fix return type of mdp4_lvds_connector_mode_valid
media: v4l2: Fix v4l2_i2c_subdev_set_name function documentation
net: ieee802154: fix error return code in dgram_bind()
mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages
cgroup-v1: add disabled controller check in cgroup1_parse_param()
xen/gntdev: Prevent leaking grants
Xen/gntdev: don't ignore kernel unmapping error
xfs: force the log after remapping a synchronous-writes file
xfs: clear XFS_DQ_FREEING if we can't lock the dquot buffer to flush
xfs: finish dfops on every insert range shift iteration
s390/pci: add missing EX_TABLE entries to __pcistg_mio_inuser()/__pcilg_mio_inuser()
s390/futex: add missing EX_TABLE entry to __futex_atomic_op()
perf auxtrace: Fix address filter symbol name match for modules
kernfs: fix use-after-free in __kernfs_remove
mmc: core: Fix kernel panic when remove non-standard SDIO card
drm/msm/hdmi: fix memory corruption with too many bridges
drm/msm/dsi: fix memory corruption with too many bridges
mac802154: Fix LQI recording
fbdev: smscufx: Fix several use-after-free bugs
iio: light: tsl2583: Fix module unloading
tools: iio: iio_utils: fix digit calculation
xhci: Remove device endpoints from bandwidth list when freeing the device
mtd: rawnand: marvell: Use correct logic for nand-keep-config
usb: xhci: add XHCI_SPURIOUS_SUCCESS to ASM1042 despite being a V0.96 controller
usb: bdc: change state when port disconnected
usb: dwc3: gadget: Don't set IMI for no_interrupt
usb: dwc3: gadget: Stop processing more requests on IMI
USB: add RESET_RESUME quirk for NVIDIA Jetson devices in RCM
ALSA: au88x0: use explicitly signed char
ALSA: Use del_timer_sync() before freeing timer
can: kvaser_usb: Fix possible completions during init_completion
can: j1939: transport: j1939_session_skb_drop_old(): spin_unlock_irqrestore() before kfree_skb()
UPSTREAM: once: fix section mismatch on clang builds
ANDROID: fix up struct sk_buf ABI breakage
ANDROID: fix up CRC issue with struct tcp_sock
Linux 5.4.222
once: fix section mismatch on clang builds
ANDROID: fix up 131287ff83 ("once: add DO_ONCE_SLOW() for sleepable contexts")
Revert "serial: 8250: Fix restoring termios speed after suspend"
Linux 5.4.221
mm: /proc/pid/smaps_rollup: fix no vma's null-deref
hv_netvsc: Fix race between VF offering and VF association message from host
Makefile.debug: re-enable debug info for .S files
ACPI: video: Force backlight native for more TongFang devices
riscv: topology: fix default topology reporting
arm64: topology: move store_cpu_topology() to shared code
iommu/vt-d: Clean up si_domain in the init_dmars() error path
net: hns: fix possible memory leak in hnae_ae_register()
net: sched: cake: fix null pointer access issue when cake_init() fails
net: phy: dp83867: Extend RX strap quirk for SGMII mode
net/atm: fix proc_mpc_write incorrect return value
HID: magicmouse: Do not set BTN_MOUSE on double report
tipc: fix an information leak in tipc_topsrv_kern_subscr
tipc: Fix recognition of trial period
ACPI: extlog: Handle multiple records
btrfs: fix processing of delayed tree block refs during backref walking
btrfs: fix processing of delayed data refs during backref walking
r8152: add PID for the Lenovo OneLink+ Dock
arm64: errata: Remove AES hwcap for COMPAT tasks
media: venus: dec: Handle the case where find_format fails
KVM: arm64: vgic: Fix exit condition in scan_its_table()
ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS
ata: ahci-imx: Fix MODULE_ALIAS
hwmon/coretemp: Handle large core ID value
x86/microcode/AMD: Apply the patch early on every logical thread
ocfs2: fix BUG when iput after ocfs2_mknod fails
ocfs2: clear dinode links count in case of error
xfs: fix use-after-free on CIL context on shutdown
xfs: move inode flush to the sync workqueue
xfs: reflink should force the log out if mounted with wsync
xfs: factor out a new xfs_log_force_inode helper
xfs: trylock underlying buffer on dquot flush
xfs: don't write a corrupt unmount record to force summary counter recalc
xfs: tail updates only need to occur when LSN changes
xfs: factor common AIL item deletion code
xfs: Throttle commits on delayed background CIL push
xfs: Lower CIL flush limit for large logs
xfs: preserve default grace interval during quotacheck
xfs: fix unmount hang and memory leak on shutdown during quotaoff
xfs: factor out quotaoff intent AIL removal and memory free
xfs: Replace function declaration by actual definition
xfs: remove the xfs_qoff_logitem_t typedef
xfs: remove the xfs_dq_logitem_t typedef
xfs: remove the xfs_disk_dquot_t and xfs_dquot_t
xfs: Use scnprintf() for avoiding potential buffer overflow
xfs: check owner of dir3 blocks
xfs: check owner of dir3 data blocks
xfs: fix buffer corruption reporting when xfs_dir3_free_header_check fails
xfs: xfs_buf_corruption_error should take __this_address
xfs: add a function to deal with corrupt buffers post-verifiers
xfs: rework collapse range into an atomic operation
xfs: rework insert range into an atomic operation
xfs: open code insert range extent split helper
Linux 5.4.220
thermal: intel_powerclamp: Use first online CPU as control_cpu
inet: fully convert sk->sk_rx_dst to RCU rules
efi: libstub: drop pointless get_memory_map() call
md: Replace snprintf with scnprintf
ext4: continue to expand file system when the target size doesn't reach
net/ieee802154: don't warn zero-sized raw_sendmsg()
Revert "net/ieee802154: reject zero-sized raw_sendmsg()"
net: ieee802154: return -EINVAL for unknown addr type
io_uring/af_unix: defer registered files gc to io_uring release
perf intel-pt: Fix segfault in intel_pt_print_info() with uClibc
clk: bcm2835: Make peripheral PLLC critical
usb: idmouse: fix an uninit-value in idmouse_open
nvmet-tcp: add bounds check on Transfer Tag
nvme: copy firmware_rev on each init
staging: rtl8723bs: fix a potential memory leak in rtw_init_cmd_priv()
Revert "usb: storage: Add quirk for Samsung Fit flash"
usb: musb: Fix musb_gadget.c rxstate overflow bug
usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info()
md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d
HID: roccat: Fix use-after-free in roccat_read()
bcache: fix set_at_max_writeback_rate() for multiple attached devices
ata: libahci_platform: Sanity check the DT child nodes number
staging: vt6655: fix potential memory leak
power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type()
nbd: Fix hung when signal interrupts nbd_start_device_ioctl()
scsi: 3w-9xxx: Avoid disabling device if failing to enable it
clk: zynqmp: pll: rectify rate rounding in zynqmp_pll_round_rate
media: cx88: Fix a null-ptr-deref bug in buffer_prepare()
clk: zynqmp: Fix stack-out-of-bounds in strncpy`
btrfs: scrub: try to fix super block errors
ARM: dts: imx6sx: add missing properties for sram
ARM: dts: imx6sll: add missing properties for sram
ARM: dts: imx6sl: add missing properties for sram
ARM: dts: imx6qp: add missing properties for sram
ARM: dts: imx6dl: add missing properties for sram
ARM: dts: imx6q: add missing properties for sram
ARM: dts: imx7d-sdb: config the max pressure for tsc2046
mmc: sdhci-msm: add compatible string check for sdm670
drm/amdgpu: fix initial connector audio value
platform/x86: msi-laptop: Change DMI match / alias strings to fix module autoloading
drm: panel-orientation-quirks: Add quirk for Anbernic Win600
drm/vc4: vec: Fix timings for VEC modes
drm/amd/display: fix overflow on MIN_I64 definition
drm: Prevent drm_copy_field() to attempt copying a NULL pointer
drm: Use size_t type for len variable in drm_copy_field()
drm/nouveau/nouveau_bo: fix potential memory leak in nouveau_bo_alloc()
r8152: Rate limit overflow messages
Bluetooth: L2CAP: Fix user-after-free
net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory
wifi: rt2x00: correctly set BBP register 86 for MT7620
wifi: rt2x00: set SoC wmac clock register
wifi: rt2x00: set VGC gain for both chains of MT7620
wifi: rt2x00: set correct TX_SW_CFG1 MAC register for MT7620
wifi: rt2x00: don't run Rt5592 IQ calibration on MT7620
can: bcm: check the result of can_send() in bcm_can_tx()
Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times
Bluetooth: L2CAP: initialize delayed works at l2cap_chan_create()
wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit()
xfrm: Update ipcomp_scratches with NULL when freed
wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg()
tcp: annotate data-race around tcp_md5sig_pool_populated
openvswitch: Fix overreporting of drops in dropwatch
openvswitch: Fix double reporting of drops in dropwatch
bpftool: Clear errno after libcap's checks
wifi: brcmfmac: fix invalid address access when enabling SCAN log level
NFSD: Return nfserr_serverfault if splice_ok but buf->pages have data
thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash
powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue
MIPS: BCM47XX: Cast memcmp() of function to (void *)
ACPI: video: Add Toshiba Satellite/Portege Z830 quirk
f2fs: fix race condition on setting FI_NO_EXTENT flag
crypto: cavium - prevent integer overflow loading firmware
kbuild: remove the target in signal traps when interrupted
iommu/iova: Fix module config properly
crypto: ccp - Release dma channels before dmaengine unrgister
crypto: akcipher - default implementation for setting a private key
iommu/omap: Fix buffer overflow in debugfs
cgroup/cpuset: Enable update_tasks_cpumask() on top_cpuset
powerpc: Fix SPE Power ISA properties for e500v1 platforms
powerpc/64s: Fix GENERIC_CPU build flags for PPC970 / G5
x86/hyperv: Fix 'struct hv_enlightened_vmcs' definition
powerpc/powernv: add missing of_node_put() in opal_export_attrs()
powerpc/pci_dn: Add missing of_node_put()
powerpc/sysdev/fsl_msi: Add missing of_node_put()
powerpc/math_emu/efp: Include module.h
mailbox: bcm-ferxrm-mailbox: Fix error check for dma_map_sg
clk: ast2600: BCLK comes from EPLL
clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe
clk: bcm2835: fix bcm2835_clock_rate_from_divisor declaration
spmi: pmic-arb: correct duplicate APID to PPID mapping logic
dmaengine: ioat: stop mod_timer from resurrecting deleted timer in __cleanup()
clk: mediatek: mt8183: mfgcfg: Propagate rate changes to parent
mfd: sm501: Add check for platform_driver_register()
mfd: fsl-imx25: Fix check for platform_get_irq() errors
mfd: lp8788: Fix an error handling path in lp8788_irq_init() and lp8788_irq_init()
mfd: lp8788: Fix an error handling path in lp8788_probe()
mfd: fsl-imx25: Fix an error handling path in mx25_tsadc_setup_irq()
mfd: intel_soc_pmic: Fix an error handling path in intel_soc_pmic_i2c_probe()
fsi: core: Check error number after calling ida_simple_get
scsi: libsas: Fix use-after-free bug in smp_execute_task_sg()
serial: 8250: Fix restoring termios speed after suspend
firmware: google: Test spinlock on panic path to avoid lockups
staging: vt6655: fix some erroneous memory clean-up loops
phy: qualcomm: call clk_disable_unprepare in the error handling
tty: serial: fsl_lpuart: disable dma rx/tx use flags in lpuart_dma_shutdown
drivers: serial: jsm: fix some leaks in probe
usb: gadget: function: fix dangling pnp_string in f_printer.c
xhci: Don't show warning for reinit on known broken suspend
md/raid5: Ensure stripe_fill happens on non-read IO with journal
mtd: rawnand: meson: fix bit map use in meson_nfc_ecc_correct()
ata: fix ata_id_has_dipm()
ata: fix ata_id_has_ncq_autosense()
ata: fix ata_id_has_devslp()
ata: fix ata_id_sense_reporting_enabled() and ata_id_has_sense_reporting()
RDMA/siw: Always consume all skbuf data in sk_data_ready() upcall.
mtd: devices: docg3: check the return value of devm_ioremap() in the probe
dyndbg: let query-modname override actual module name
dyndbg: fix module.dyndbg handling
misc: ocxl: fix possible refcount leak in afu_ioctl()
RDMA/rxe: Fix the error caused by qp->sk
RDMA/rxe: Fix "kernel NULL pointer dereference" error
media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init
tty: xilinx_uartps: Fix the ignore_status
media: exynos4-is: fimc-is: Add of_node_put() when breaking out of loop
HSI: omap_ssi_port: Fix dma_map_sg error check
HSI: omap_ssi: Fix refcount leak in ssi_probe
clk: tegra20: Fix refcount leak in tegra20_clock_init
clk: tegra: Fix refcount leak in tegra114_clock_init
clk: tegra: Fix refcount leak in tegra210_clock_init
clk: berlin: Add of_node_put() for of_get_parent()
clk: oxnas: Hold reference returned by of_get_parent()
clk: meson: Hold reference returned by of_get_parent()
iio: ABI: Fix wrong format of differential capacitance channel ABI.
iio: inkern: only release the device node when done with it
iio: adc: at91-sama5d2_adc: lock around oversampling and sample freq
iio: adc: at91-sama5d2_adc: check return status for pressure and touch
iio: adc: at91-sama5d2_adc: fix AT91_SAMA5D2_MR_TRACKTIM_MAX
ARM: dts: exynos: fix polarity of VBUS GPIO of Origen
ARM: Drop CMDLINE_* dependency on ATAGS
ARM: dts: exynos: correct s5k6a3 reset polarity on Midas family
ARM: dts: kirkwood: lsxl: remove first ethernet port
ARM: dts: kirkwood: lsxl: fix serial line
ARM: dts: turris-omnia: Fix mpp26 pin name and comment
soc: qcom: smem_state: Add refcounting for the 'state->of_node'
soc: qcom: smsm: Fix refcount leak bugs in qcom_smsm_probe()
memory: of: Fix refcount leak bug in of_get_ddr_timings()
memory: pl353-smc: Fix refcount leak bug in pl353_smc_probe()
ALSA: hda/hdmi: Don't skip notification handling during PM operation
ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe
ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe
ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe
mmc: wmt-sdmmc: Fix an error handling path in wmt_mci_probe()
ALSA: dmaengine: increment buffer pointer atomically
drm/msm/dpu: index dpu_kms->hw_vbif using vbif_idx
ASoC: eureka-tlv320: Hold reference returned from of_find_xxx API
mmc: au1xmmc: Fix an error handling path in au1xmmc_probe()
drm/omap: dss: Fix refcount leak bugs
ALSA: hda: beep: Simplify keep-power-at-enable behavior
ASoC: rsnd: Add check for rsnd_mod_power_on
drm/bridge: megachips: Fix a null pointer dereference bug
drm: fix drm_mipi_dbi build errors
platform/x86: msi-laptop: Fix resource cleanup
platform/x86: msi-laptop: Fix old-ec check for backlight registering
platform/chrome: fix memory corruption in ioctl
platform/chrome: fix double-free in chromeos_laptop_prepare()
drm/mipi-dsi: Detach devices when removing the host
drm: bridge: adv7511: fix CEC power down control register offset
net: mvpp2: fix mvpp2 debugfs leak
once: add DO_ONCE_SLOW() for sleepable contexts
net/ieee802154: reject zero-sized raw_sendmsg()
bnx2x: fix potential memory leak in bnx2x_tpa_stop()
net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks()
tcp: fix tcp_cwnd_validate() to not forget is_cwnd_limited
sctp: handle the error returned from sctp_auth_asoc_init_active_key
mISDN: fix use-after-free bugs in l1oip timer handlers
vhost/vsock: Use kvmalloc/kvfree for larger packets.
spi: s3c64xx: Fix large transfers with DMA
netfilter: nft_fib: Fix for rpath check with VRF devices
spi/omap100k:Fix PM disable depth imbalance in omap1_spi100k_probe
x86/microcode/AMD: Track patch allocation size explicitly
bpf: Ensure correct locking around vulnerable function find_vpid()
net: fs_enet: Fix wrong check in do_pd_setup
wifi: rtl8xxxu: gen2: Fix mistake in path B IQ calibration
bpf: btf: fix truncated last_member_type_id in btf_struct_resolve
wifi: rtl8xxxu: Fix skb misuse in TX queue selection
spi: qup: add missing clk_disable_unprepare on error in spi_qup_pm_resume_runtime()
spi: qup: add missing clk_disable_unprepare on error in spi_qup_resume()
wifi: rtl8xxxu: tighten bounds checking in rtl8xxxu_read_efuse()
x86/resctrl: Fix to restore to original value when re-enabling hardware prefetch register
bpftool: Fix a wrong type cast in btf_dumper_int
wifi: mac80211: allow bw change during channel switch in mesh
wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()
nfsd: Fix a memory leak in an error handling path
ARM: 9247/1: mm: set readonly for MT_MEMORY_RO with ARM_LPAE
sh: machvec: Use char[] for section boundaries
userfaultfd: open userfaultfds with O_RDONLY
tracing: Disable interrupt or preemption before acquiring arch_spinlock_t
selinux: use "grep -E" instead of "egrep"
drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table()
gcov: support GCC 12.1 and newer compilers
KVM: VMX: Drop bits 31:16 when shoving exception error code into VMCS
KVM: nVMX: Unconditionally purge queued/injected events on nested "exit"
KVM: x86/emulator: Fix handing of POP SS to correctly set interruptibility
media: cedrus: Set the platform driver data earlier
ring-buffer: Fix race between reset page and reading page
ring-buffer: Check pending waiters when doing wake ups as well
ring-buffer: Have the shortest_full queue be the shortest not longest
ring-buffer: Allow splice to read previous partially read pages
ftrace: Properly unset FTRACE_HASH_FL_MOD
livepatch: fix race between fork and KLP transition
ext4: place buffer head allocation before handle start
ext4: make ext4_lazyinit_thread freezable
ext4: fix null-ptr-deref in ext4_write_info
ext4: avoid crash when inline data creation follows DIO write
jbd2: wake up journal waiters in FIFO order, not LIFO
nilfs2: fix use-after-free bug of struct nilfs_root
f2fs: fix to do sanity check on summary info
f2fs: fix to do sanity check on destination blkaddr during recovery
f2fs: increase the limit for reserve_root
btrfs: fix race between quota enable and quota rescan ioctl
fbdev: smscufx: Fix use-after-free in ufx_ops_open()
powerpc/boot: Explicitly disable usage of SPE instructions
PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge
UM: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
riscv: Pass -mno-relax only on lld < 15.0.0
riscv: Allow PROT_WRITE-only mmap()
parisc: fbdev/stifb: Align graphics memory size to 4MB
RISC-V: Make port I/O string accessors actually work
regulator: qcom_rpm: Fix circular deferral regression
ASoC: wcd9335: fix order of Slimbus unprepare/disable
quota: Check next/prev free block number after reading from quota file
HID: multitouch: Add memory barriers
fs: dlm: handle -EBUSY first in lock arg validation
fs: dlm: fix race between test_bit() and queue_work()
mmc: sdhci-sprd: Fix minimum clock limit
can: kvaser_usb_leaf: Fix CAN state after restart
can: kvaser_usb_leaf: Fix TX queue out of sync after restart
can: kvaser_usb_leaf: Fix overread with an invalid command
can: kvaser_usb: Fix use of uninitialized completion
usb: add quirks for Lenovo OneLink+ Dock
iio: pressure: dps310: Reset chip after timeout
iio: pressure: dps310: Refactor startup procedure
iio: dac: ad5593r: Fix i2c read protocol requirements
cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message
cifs: destage dirty pages before re-reading them for cache=none
mtd: rawnand: atmel: Unmap streaming DMA mappings
ALSA: hda/realtek: Add Intel Reference SSID to support headset keys
ALSA: hda/realtek: Add quirk for ASUS GV601R laptop
ALSA: hda/realtek: Correct pin configs for ASUS G533Z
ALSA: hda/realtek: remove ALC289_FIXUP_DUAL_SPK for Dell 5530
ALSA: usb-audio: Fix NULL dererence at error path
ALSA: usb-audio: Fix potential memory leaks
ALSA: rawmidi: Drop register_mutex in snd_rawmidi_free()
ALSA: oss: Fix potential deadlock at unregistration
Conflicts:
drivers/android/binder.c
include/linux/rmap.h
kernel/cgroup/cpuset.c
mm/rmap.c
Change-Id: I34fe2d5c9b0d5844560de9c983867511b5d57265
Currently, wmediumd requires each used MAC address to be configured
as a station in the virtual air, but that doesn't make sense as any
station could have multiple MAC addresses, and even have randomized
ones in scanning, etc.
Add some code here to tell wmediumd of used MAC addresses, binding
them to the hardware address. Combined with a wmediumd patch that
makes it track the addresses this allows configuring just the radio
address (42:00:00:00:nn:00 unless the radio was manually created)
in wmediumd as a station, and all addresses that the station uses
are added/removed dynamically.
Tested with random scan, which without this and the corresponding
wmediumd change doesn't get anything through as the sender doesn't
exist as far as wmediumd is concerned (it's random).
Link: https://lore.kernel.org/r/20200323162358.b397b1a1acef.Ice0536e34e5d96c51f97c374ea8af9551347c7e8@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
(cherry picked from commit 5cc58a9ecfa1bbf5fb587ec65e42f15dd5051238)
Signed-off-by: Jeongik Cha <jeongik@google.com>
Bug: 238124637
Change-Id: I973948f65a6303ffff7aa8998b68cc8e6ce98930
(cherry picked from commit cc9d67ff745c7e47893a9724824882c1e7b25764)
qiib_cleanup in qiib_driver_data_deinit is redundant since
this cleanup is already done in driver remove.
Remove qiib_cleanup in deinit and add required NULL check to
avoid any use-after-free scenario.
Change-Id: I95fa3cf91b5ca6cbaeb66d304a0572ba1d294a69
Signed-off-by: Arun Prakash <quic_app@quicinc.com>
[ Upstream commit cceeeb6a6d02e7b9a74ddd27a3225013b34174aa ]
Changes to hrtimer mode (potentially made by __hrtimer_init_sleeper on
PREEMPT_RT) are not visible to hrtimer_start_range_ns, thus not
accounted for by hrtimer_start_expires call paths. In particular,
__wait_event_hrtimeout suffers from this problem as we have, for
example:
fs/aio.c::read_events
wait_event_interruptible_hrtimeout
__wait_event_hrtimeout
hrtimer_init_sleeper_on_stack <- this might "mode |= HRTIMER_MODE_HARD"
on RT if task runs at RT/DL priority
hrtimer_start_range_ns
WARN_ON_ONCE(!(mode & HRTIMER_MODE_HARD) ^ !timer->is_hard)
fires since the latter doesn't see the change of mode done by
init_sleeper
Fix it by making __wait_event_hrtimeout call hrtimer_sleeper_start_expires,
which is aware of the special RT/DL case, instead of hrtimer_start_range_ns.
Change-Id: I0fa428c0a9a8fb43bca19bb999b822c5111b6284
Reported-by: Bruno Goncalves <bgoncalv@redhat.com>
Signed-off-by: Juri Lelli <juri.lelli@redhat.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Daniel Bristot de Oliveira <bristot@kernel.org>
Reviewed-by: Valentin Schneider <vschneid@redhat.com>
Link: https://lore.kernel.org/r/20220627095051.42470-1-juri.lelli@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
Git-commit: bd80dd86f9
Git-repo: https://android.googlesource.com/kernel/common/
Signed-off-by: Srinivasarao Pathipati <quic_c_spathi@quicinc.com>
* refs/heads/tmp-d72fdcc:
ANDROID: abi_gki_aarch64_qcom: Add hrtimer_sleeper_start_expires
UPSTREAM: ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF
ANDROID: Revert "tracing/ring-buffer: Have polling block on watermark"
UPSTREAM: usb: gadget: f_hid: fix f_hidg lifetime vs cdev
UPSTREAM: usb: gadget: f_hid: optional SETUP/SET_REPORT mode
ANDROID: add TEST_MAPPING for net/, include/net
UPSTREAM: nfp: fix use-after-free in area_cache_get()
UPSTREAM: proc: avoid integer type confusion in get_proc_long
UPSTREAM: proc: proc_skip_spaces() shouldn't think it is working on C strings
ANDROID: usb: f_accessory: Check buffer size when initialised via composite
BACKPORT: mm: don't be stuck to rmap lock on reclaim path
ANDROID: Add more hvc devices for virtio-console.
UPSTREAM: HID: playstation: support updated DualSense rumble mode.
UPSTREAM: HID: playstation: add initial DualSense Edge controller support
UPSTREAM: HID: playstation: stop DualSense output work on remove.
UPSTREAM: HID: playstation: convert to use dev_groups
UPSTREAM: HID: playstation: fix return from dualsense_player_led_set_brightness()
UPSTREAM: HID: playstation: expose DualSense player LEDs through LED class.
BACKPORT: leds: add new LED_FUNCTION_PLAYER for player LEDs for game controllers.
UPSTREAM: HID: playstation: expose DualSense lightbar through a multi-color LED.
UPSTREAM: leds: flash: Fix multicolor no-ops registration by return 0
UPSTREAM: leds: multicolor: Introduce a multicolor class definition
ANDROID: GKI: enable mulitcolor-led
Revert "mmc: sdhci: Fix voltage switch delay"
ANDROID: gki_defconfig: add CONFIG_FUNCTION_ERROR_INJECTION
Linux 5.4.226
ipc/sem: Fix dangling sem_array access in semtimedop race
v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() fails
proc: proc_skip_spaces() shouldn't think it is working on C strings
proc: avoid integer type confusion in get_proc_long
mmc: sdhci: Fix voltage switch delay
mmc: sdhci: use FIELD_GET for preset value bit masks
char: tpm: Protect tpm_pm_suspend with locks
Revert "clocksource/drivers/riscv: Events are stopped during CPU suspend"
x86/ioremap: Fix page aligned size calculation in __ioremap_caller()
Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM
x86/pm: Add enumeration check before spec MSRs save/restore setup
x86/tsx: Add a feature bit for TSX control MSR support
nvme: ensure subsystem reset is single threaded
nvme: restrict management ioctls to admin
epoll: check for events when removing a timed out thread from the wait queue
epoll: call final ep_events_available() check under the lock
tracing/ring-buffer: Have polling block on watermark
ipv4: Fix route deletion when nexthop info is not specified
ipv4: Handle attempt to delete multipath route when fib_info contains an nh reference
selftests: net: fix nexthop warning cleanup double ip typo
selftests: net: add delete nexthop route warning test
Kconfig.debug: provide a little extra FRAME_WARN leeway when KASAN is enabled
parisc: Increase FRAME_WARN to 2048 bytes on parisc
xtensa: increase size of gcc stack frame check
parisc: Increase size of gcc stack frame check
iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init()
pinctrl: single: Fix potential division by zero
ASoC: ops: Fix bounds check for _sx controls
mm: Fix '.data.once' orphan section warning
arm64: errata: Fix KVM Spectre-v2 mitigation selection for Cortex-A57/A72
arm64: Fix panic() when Spectre-v2 causes Spectre-BHB to re-allocate KVM vectors
tracing: Free buffers when a used dynamic event is removed
mmc: sdhci-sprd: Fix no reset data and command after voltage switch
mmc: sdhci-esdhc-imx: correct CQHCI exit halt state check
mmc: core: Fix ambiguous TRIM and DISCARD arg
mmc: mmc_test: Fix removal of debugfs file
pinctrl: intel: Save and restore pins in "direct IRQ" mode
x86/bugs: Make sure MSR_SPEC_CTRL is updated properly upon resume from S3
nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()
tools/vm/slabinfo-gnuplot: use "grep -E" instead of "egrep"
error-injection: Add prompt for function error injection
net/mlx5: DR, Fix uninitialized var warning
hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()
hwmon: (coretemp) Check for null before removing sysfs attrs
net: ethernet: renesas: ravb: Fix promiscuous mode after system resumed
sctp: fix memory leak in sctp_stream_outq_migrate()
packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE
net: tun: Fix use-after-free in tun_detach()
afs: Fix fileserver probe RTT handling
net: hsr: Fix potential use-after-free
dsa: lan9303: Correct stat name
net: ethernet: nixge: fix NULL dereference
net/9p: Fix a potential socket leak in p9_socket_open
net: net_netdev: Fix error handling in ntb_netdev_init_module()
net: phy: fix null-ptr-deref while probe() failed
wifi: cfg80211: fix buffer overflow in elem comparison
qlcnic: fix sleep-in-atomic-context bugs caused by msleep
can: cc770: cc770_isa_probe(): add missing free_cc770dev()
can: sja1000_isa: sja1000_isa_probe(): add missing free_sja1000dev()
net/mlx5e: Fix use-after-free when reverting termination table
net/mlx5: Fix uninitialized variable bug in outlen_write()
of: property: decrement node refcount in of_fwnode_get_reference_args()
hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails
hwmon: (i5500_temp) fix missing pci_disable_device()
scripts/faddr2line: Fix regression in name resolution on ppc64le
iio: light: rpr0521: add missing Kconfig dependencies
iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw
iio: health: afe4403: Fix oob read in afe4403_read_raw
btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit()
drm/amdgpu: Partially revert "drm/amdgpu: update drm_display_info correctly when the edid is read"
drm/amdgpu: update drm_display_info correctly when the edid is read
btrfs: move QUOTA_ENABLED check to rescan_should_stop from btrfs_qgroup_rescan_worker
spi: spi-imx: Fix spi_bus_clk if requested clock is higher than input clock
btrfs: free btrfs_path before copying inodes to userspace
fuse: lock inode unconditionally in fuse_fallocate()
drm/i915: fix TLB invalidation for Gen12 video and compute engines
drm/amdgpu: always register an MMU notifier for userptr
drm/amd/dc/dce120: Fix audio register mapping, stop triggering KASAN
btrfs: sysfs: normalize the error handling branch in btrfs_init_sysfs()
btrfs: free btrfs_path before copying subvol info to userspace
btrfs: free btrfs_path before copying fspath to userspace
btrfs: free btrfs_path before copying root refs to userspace
binder: Gracefully handle BINDER_TYPE_FDA objects with num_fds=0
binder: Address corner cases in deferred copy and fixup
binder: fix pointer cast warning
binder: defer copies of pre-patched txn data
binder: read pre-translated fds from sender buffer
binder: avoid potential data leakage when copying txn
dm integrity: flush the journal on suspend
net: usb: qmi_wwan: add Telit 0x103a composition
tcp: configurable source port perturb table size
platform/x86: hp-wmi: Ignore Smart Experience App event
platform/x86: acer-wmi: Enable SW_TABLET_MODE on Switch V 10 (SW5-017)
platform/x86: asus-wmi: add missing pci_dev_put() in asus_wmi_set_xusb2pr()
xen/platform-pci: add missing free_irq() in error path
serial: 8250: 8250_omap: Avoid RS485 RTS glitch on ->set_termios()
ASoC: Intel: bytcht_es8316: Add quirk for the Nanote UMPC-01
Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode
gcov: clang: fix the buffer overflow issue
nilfs2: fix nilfs_sufile_mark_dirty() not set segment usage as dirty
firmware: coreboot: Register bus in module init
firmware: google: Release devices before unregistering the bus
ceph: avoid putting the realm twice when decoding snaps fails
ceph: do not update snapshot context when there is no new snapshot
iio: pressure: ms5611: fixed value compensation bug
iio: ms5611: Simplify IO callback parameters
nios2: add FORCE for vmlinuz.gz
init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash
iio: core: Fix entry not deleted when iio_register_sw_trigger_type() fails
iio: light: apds9960: fix wrong register for gesture gain
arm64: dts: rockchip: lower rk3399-puma-haikou SD controller clock frequency
usb: dwc3: exynos: Fix remove() function
lib/vdso: use "grep -E" instead of "egrep"
s390/crashdump: fix TOD programmable field size
net: thunderx: Fix the ACPI memory leak
nfc: st-nci: fix memory leaks in EVT_TRANSACTION
nfc: st-nci: fix incorrect validating logic in EVT_TRANSACTION
s390/dasd: fix no record found for raw_track_access
dccp/tcp: Reset saddr on failure after inet6?_hash_connect().
bnx2x: fix pci device refcount leak in bnx2x_vf_is_pcie_pending()
regulator: twl6030: re-add TWL6032_SUBCLASS
NFC: nci: fix memory leak in nci_rx_data_packet()
xfrm: Fix ignored return value in xfrm6_init()
tipc: check skb_linearize() return value in tipc_disc_rcv()
tipc: add an extra conn_get in tipc_conn_alloc
tipc: set con sock in tipc_conn_alloc
net/mlx5: Fix FW tracer timestamp calculation
Drivers: hv: vmbus: fix possible memory leak in vmbus_device_register()
Drivers: hv: vmbus: fix double free in the error path of vmbus_add_channel_work()
nfp: add port from netdev validation for EEPROM access
net: pch_gbe: fix pci device refcount leak while module exiting
net/qla3xxx: fix potential memleak in ql3xxx_send()
net/mlx4: Check retval of mlx4_bitmap_init
ARM: mxs: fix memory leak in mxs_machine_init()
9p/fd: fix issue of list_del corruption in p9_fd_cancel()
net: pch_gbe: fix potential memleak in pch_gbe_tx_queue()
nfc/nci: fix race with opening and closing
net: liquidio: simplify if expression
ARM: dts: at91: sam9g20ek: enable udc vbus gpio pinctrl
tee: optee: fix possible memory leak in optee_register_device()
bus: sunxi-rsb: Support atomic transfers
regulator: core: fix UAF in destroy_regulator()
regulator: core: fix kobject release warning and memory leak in regulator_register()
ASoC: sgtl5000: Reset the CHIP_CLK_CTRL reg on remove
ARM: dts: am335x-pcm-953: Define fixed regulators in root node
af_key: Fix send_acquire race with pfkey_register
MIPS: pic32: treat port as signed integer
RISC-V: vdso: Do not add missing symbols to version section in linker script
arm64/syscall: Include asm/ptrace.h in syscall_wrapper header.
block, bfq: fix null pointer dereference in bfq_bio_bfqg()
drm: panel-orientation-quirks: Add quirk for Acer Switch V 10 (SW5-017)
spi: stm32: fix stm32_spi_prepare_mbr() that halves spi clk for every run
wifi: mac80211: Fix ack frame idr leak when mesh has no route
audit: fix undefined behavior in bit shift for AUDIT_BIT
wifi: mac80211_hwsim: fix debugfs attribute ps with rc table support
wifi: mac80211: fix memory free error when registering wiphy fail
Revert "can: af_can: fix NULL pointer dereference in can_rx_register()"
Linux 5.4.225
ntfs: check overflow when iterating ATTR_RECORDs
ntfs: fix out-of-bounds read in ntfs_attr_find()
ntfs: fix use-after-free in ntfs_attr_find()
mm: fs: initialize fsdata passed to write_begin/write_end interface
9p/trans_fd: always use O_NONBLOCK read/write
gfs2: Switch from strlcpy to strscpy
gfs2: Check sb_bsize_shift after reading superblock
9p: trans_fd/p9_conn_cancel: drop client lock earlier
kcm: close race conditions on sk_receive_queue
bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb()
kcm: avoid potential race in kcm_tx_work
tcp: cdg: allow tcp_cdg_release() to be called multiple times
macvlan: enforce a consistent minimal mtu
Input: i8042 - fix leaking of platform device on module removal
kprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case
scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus()
ring-buffer: Include dropped pages in counting dirty patches
serial: 8250: Flush DMA Rx on RLSI
misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
docs: update mediator contact information in CoC doc
mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
mmc: sdhci-pci-o2micro: fix card detect fail issue caused by CD# debounce timeout
mmc: core: properly select voltage range without power cycle
scsi: zfcp: Fix double free of FSF request when qdio send fails
Input: iforce - invert valid length check when fetching device IDs
serial: 8250_lpss: Configure DMA also w/o DMA filter
serial: 8250: Fall back to non-DMA Rx if IIR_RDI occurs
dm ioctl: fix misbehavior if list_versions races with module loading
iio: pressure: ms5611: changed hardcoded SPI speed to value limited
iio: trigger: sysfs: fix possible memory leak in iio_sysfs_trig_init()
iio: adc: at91_adc: fix possible memory leak in at91_adc_allocate_trigger()
usb: chipidea: fix deadlock in ci_otg_del_timer
usb: add NO_LPM quirk for Realforce 87U Keyboard
USB: serial: option: add Fibocom FM160 0x0111 composition
USB: serial: option: add u-blox LARA-L6 modem
USB: serial: option: add u-blox LARA-R6 00B modem
USB: serial: option: remove old LARA-R6 PID
USB: serial: option: add Sierra Wireless EM9191
speakup: fix a segfault caused by switching consoles
slimbus: stream: correct presence rate frequencies
Revert "usb: dwc3: disable USB core PHY management"
ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open()
ring_buffer: Do not deactivate non-existant pages
ftrace: Fix null pointer dereference in ftrace_add_mod()
ftrace: Optimize the allocation for mcount entries
ftrace: Fix the possible incorrect kernel message
cifs: add check for returning value of SMB2_set_info_init
net: thunderbolt: Fix error handling in tbnet_init()
cifs: Fix wrong return value checking when GETFLAGS
net/x25: Fix skb leak in x25_lapb_receive_frame()
platform/x86/intel: pmc: Don't unconditionally attach Intel PMC when virtualized
drbd: use after free in drbd_create_device()
xen/pcpu: fix possible memory leak in register_pcpu()
bnxt_en: Remove debugfs when pci_register_driver failed
net: caif: fix double disconnect client in chnl_net_open()
net: macvlan: Use built-in RCU list checking
mISDN: fix misuse of put_device() in mISDN_register_device()
net: liquidio: release resources when liquidio driver open failed
mISDN: fix possible memory leak in mISDN_dsp_element_register()
net: bgmac: Drop free_netdev() from bgmac_enet_remove()
ata: libata-transport: fix double ata_host_put() in ata_tport_add()
arm64: dts: imx8mn: Fix NAND controller size-cells
arm64: dts: imx8mm: Fix NAND controller size-cells
pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map
parport_pc: Avoid FIFO port location truncation
siox: fix possible memory leak in siox_device_add()
block: sed-opal: kmalloc the cmd/resp buffers
ASoC: soc-utils: Remove __exit for snd_soc_util_exit()
tty: n_gsm: fix sleep-in-atomic-context bug in gsm_control_send
serial: imx: Add missing .thaw_noirq hook
serial: 8250: omap: Flush PM QOS work on remove
serial: 8250: omap: Fix unpaired pm_runtime_put_sync() in omap8250_remove()
serial: 8250_omap: remove wait loop from Errata i202 workaround
ASoC: core: Fix use-after-free in snd_soc_exit()
spi: stm32: Print summary 'callbacks suppressed' message
ASoC: codecs: jz4725b: Fix spelling mistake "Sourc" -> "Source", "Routee" -> "Route"
Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm
btrfs: remove pointless and double ulist frees in error paths of qgroup tests
drm/imx: imx-tve: Fix return type of imx_tve_connector_mode_valid
i2c: i801: add lis3lv02d's I2C address for Vostro 5568
NFSv4: Retry LOCK on OLD_STATEID during delegation return
selftests/intel_pstate: fix build for ARCH=x86_64
selftests/futex: fix build for clang
ASoC: codecs: jz4725b: fix capture selector naming
ASoC: codecs: jz4725b: use right control for Capture Volume
ASoC: codecs: jz4725b: fix reported volume for Master ctl
ASoC: codecs: jz4725b: add missed Line In power control bit
spi: intel: Fix the offset to get the 64K erase opcode
ASoC: wm8962: Add an event handler for TEMP_HP and TEMP_SPK
ASoC: wm8997: Revert "ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe"
ASoC: wm5110: Revert "ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe"
ASoC: wm5102: Revert "ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe"
x86/cpu: Restore AMD's DE_CFG MSR after resume
net: tun: call napi_schedule_prep() to ensure we own a napi
dmaengine: at_hdmac: Check return code of dma_async_device_register
dmaengine: at_hdmac: Fix impossible condition
dmaengine: at_hdmac: Don't allow CPU to reorder channel enable
dmaengine: at_hdmac: Fix completion of unissued descriptor in case of errors
dmaengine: at_hdmac: Don't start transactions at tx_submit level
dmaengine: at_hdmac: Fix at_lli struct definition
cert host tools: Stop complaining about deprecated OpenSSL functions
can: j1939: j1939_send_one(): fix missing CAN header initialization
udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
btrfs: selftests: fix wrong error check in btrfs_free_dummy_root()
platform/x86: hp_wmi: Fix rfkill causing soft blocked wifi
drm/i915/dmabuf: fix sg_table handling in map_dma_buf
nilfs2: fix use-after-free bug of ns_writer on remount
nilfs2: fix deadlock in nilfs_count_free_blocks()
vmlinux.lds.h: Fix placement of '.data..decrypted' section
ALSA: usb-audio: Add DSD support for Accuphase DAC-60
ALSA: usb-audio: Add quirk entry for M-Audio Micro
ALSA: hda: fix potential memleak in 'add_widget_node'
ALSA: hda/ca0132: add quirk for EVGA Z390 DARK
mmc: sdhci-tegra: Fix SDHCI_RESET_ALL for CQHCI
mmc: sdhci-of-arasan: Fix SDHCI_RESET_ALL for CQHCI
mmc: cqhci: Provide helper for resetting both SDHCI and CQHCI
MIPS: jump_label: Fix compat branch range check
arm64: efi: Fix handling of misaligned runtime regions and drop warning
riscv: process: fix kernel info leakage
net: macvlan: fix memory leaks of macvlan_common_newlink
ethernet: tundra: free irq when alloc ring failed in tsi108_open()
net: mv643xx_eth: disable napi when init rxq or txq failed in mv643xx_eth_open()
ethernet: s2io: disable napi when start nic failed in s2io_card_up()
cxgb4vf: shut down the adapter when t4vf_update_port_info() failed in cxgb4vf_open()
net: cxgb3_main: disable napi when bind qsets failed in cxgb_up()
net: cpsw: disable napi in cpsw_ndo_open()
net/mlx5: Allow async trigger completion execution on single CPU systems
net: nixge: disable napi when enable interrupts failed in nixge_open()
perf stat: Fix printing os->prefix in CSV metrics output
drivers: net: xgene: disable napi when register irq failed in xgene_enet_open()
dmaengine: mv_xor_v2: Fix a resource leak in mv_xor_v2_remove()
dmaengine: pxa_dma: use platform_get_irq_optional
tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header
can: af_can: fix NULL pointer dereference in can_rx_register()
ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network
drm/vc4: Fix missing platform_unregister_drivers() call in vc4_drm_register()
hamradio: fix issue of dev reference count leakage in bpq_device_event()
net: lapbether: fix issue of dev reference count leakage in lapbeth_device_event()
capabilities: fix undefined behavior in bit shift for CAP_TO_MASK
net: fman: Unregister ethernet device on removal
bnxt_en: fix potentially incorrect return value for ndo_rx_flow_steer
bnxt_en: Fix possible crash in bnxt_hwrm_set_coal()
net: tun: Fix memory leaks of napi_get_frags
net: gso: fix panic on frag_list with mixed head alloc types
HID: hyperv: fix possible memory leak in mousevsc_probe()
bpf, sockmap: Fix the sk->sk_forward_alloc warning of sk_stream_kill_queues
wifi: cfg80211: fix memory leak in query_regdb_file()
wifi: cfg80211: silence a sparse RCU warning
phy: stm32: fix an error code in probe
xfs: drain the buf delwri queue before xfsaild idles
xfs: preserve inode versioning across remounts
xfs: use MMAPLOCK around filemap_map_pages()
xfs: redesign the reflink remap loop to fix blkres depletion crash
xfs: rename xfs_bmap_is_real_extent to is_written_extent
xfs: preserve rmapbt swapext block reservation from freed blocks
ANDROID: properly copy the scm_io_uring field in struct sk_buff
Linux 5.4.224
ipc: remove memcg accounting for sops objects in do_semtimedop()
wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker()
drm/i915/sdvo: Setup DDC fully before output init
drm/i915/sdvo: Filter out invalid outputs more sensibly
drm/rockchip: dsi: Force synchronous probe
mtd: rawnand: gpmi: Set WAIT_FOR_READY timeout based on program/erase times
KVM: x86: emulator: update the emulation mode after CR0 write
KVM: x86: emulator: introduce emulator_recalc_and_set_mode
KVM: x86: emulator: em_sysexit should update ctxt->mode
KVM: x86: Mask off reserved bits in CPUID.80000008H
KVM: x86: Mask off reserved bits in CPUID.8000001AH
ext4: fix BUG_ON() when directory entry has invalid rec_len
ext4: fix warning in 'ext4_da_release_space'
parisc: Avoid printing the hardware path twice
parisc: Export iosapic_serial_irq() symbol for serial port driver
parisc: Make 8250_gsc driver dependend on CONFIG_PARISC
ALSA: usb-audio: Add quirks for MacroSilicon MS2100/MS2106 devices
perf/x86/intel: Add Cooper Lake stepping to isolation_ucodes[]
perf/x86/intel: Fix pebs event constraints for ICL
efi: random: reduce seed size to 32 bytes
fuse: add file_modified() to fallocate
capabilities: fix potential memleak on error path from vfs_getxattr_alloc()
tracing/histogram: Update document for KEYS_MAX size
tools/nolibc/string: Fix memcmp() implementation
kprobe: reverse kp->flags when arm_kprobe failed
tcp/udp: Make early_demux back namespacified.
btrfs: fix type of parameter generation in btrfs_get_dentry
binder: fix UAF of alloc->vma in race with munmap()
memcg: enable accounting of ipc resources
tcp/udp: Fix memory leak in ipv6_renew_options().
block, bfq: protect 'bfqd->queued' by 'bfqd->lock'
Bluetooth: L2CAP: Fix attempting to access uninitialized memory
xfs: Add the missed xfs_perag_put() for xfs_ifree_cluster()
xfs: don't fail unwritten extent conversion on writeback due to edquot
xfs: group quota should return EDQUOT when prj quota enabled
xfs: gut error handling in xfs_trans_unreserve_and_mod_sb()
xfs: use ordered buffers to initialize dquot buffers during quotacheck
xfs: don't fail verifier on empty attr3 leaf block
i2c: xiic: Add platform module alias
HID: saitek: add madcatz variant of MMO7 mouse device ID
scsi: core: Restrict legal sdev_state transitions via sysfs
media: meson: vdec: fix possible refcount leak in vdec_probe()
media: dvb-frontends/drxk: initialize err to 0
media: cros-ec-cec: limit msg.len to CEC_MAX_MSG_SIZE
media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE
ipv6: fix WARNING in ip6_route_net_exit_late()
net, neigh: Fix null-ptr-deref in neigh_table_clear()
net: mdio: fix undefined behavior in bit shift for __mdiobus_register
Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del()
Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu
btrfs: fix ulist leaks in error paths of qgroup self tests
btrfs: fix inode list leak during backref walking at find_parent_nodes()
btrfs: fix inode list leak during backref walking at resolve_indirect_refs()
isdn: mISDN: netjet: fix wrong check of device registration
mISDN: fix possible memory leak in mISDN_register_device()
rose: Fix NULL pointer dereference in rose_send_frame()
ipvs: fix WARNING in ip_vs_app_net_cleanup()
ipvs: fix WARNING in __ip_vs_cleanup_batch()
ipvs: use explicitly signed chars
netfilter: nf_tables: release flow rule object from commit path
net: tun: fix bugs for oversize packet when napi frags enabled
net: sched: Fix use after free in red_enqueue()
ata: pata_legacy: fix pdc20230_set_piomode()
net: fec: fix improper use of NETDEV_TX_BUSY
nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send()
nfc: s3fwrn5: Fix potential memory leak in s3fwrn5_nci_send()
RDMA/qedr: clean up work queue on failure in qedr_alloc_resources()
RDMA/core: Fix null-ptr-deref in ib_core_cleanup()
net: dsa: Fix possible memory leaks in dsa_loop_init()
nfs4: Fix kmemleak when allocate slot failed
NFSv4.1: We must always send RECLAIM_COMPLETE after a reboot
NFSv4.1: Handle RECLAIM_COMPLETE trunking errors
IB/hfi1: Correctly move list in sc_disable()
RDMA/cma: Use output interface for net_dev check
Linux 5.4.223
can: rcar_canfd: rcar_canfd_handle_global_receive(): fix IRQ storm on global FIFO receive
net: enetc: survive memory pressure without crashing
net/mlx5: Fix possible use-after-free in async command interface
net/mlx5e: Do not increment ESN when updating IPsec ESN state
nh: fix scope used to find saddr when adding non gw nh
net: ehea: fix possible memory leak in ehea_register_port()
openvswitch: switch from WARN to pr_warn
ALSA: aoa: Fix I2S device accounting
ALSA: aoa: i2sbus: fix possible memory leak in i2sbus_add_dev()
PM: domains: Fix handling of unavailable/disabled idle states
net: ksz884x: fix missing pci_disable_device() on error in pcidev_init()
i40e: Fix flow-type by setting GL_HASH_INSET registers
i40e: Fix VF hang when reset is triggered on another VF
i40e: Fix ethtool rx-flow-hash setting for X722
media: videodev2.h: V4L2_DV_BT_BLANKING_HEIGHT should check 'interlaced'
media: v4l2-dv-timings: add sanity checks for blanking values
media: vivid: dev->bitmap_cap wasn't freed in all cases
media: vivid: s_fbuf: add more sanity checks
PM: hibernate: Allow hybrid sleep to work with s2idle
can: mscan: mpc5xxx: mpc5xxx_can_probe(): add missing put_clock() in error path
tcp: fix indefinite deferral of RTO with SACK reneging
net: lantiq_etop: don't free skb when returning NETDEV_TX_BUSY
net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed
kcm: annotate data-races around kcm->rx_wait
kcm: annotate data-races around kcm->rx_psock
amd-xgbe: add the bit rate quirk for Molex cables
amd-xgbe: fix the SFP compliance codes check for DAC cables
x86/unwind/orc: Fix unreliable stack dump with gcov
net: netsec: fix error handling in netsec_register_mdio()
tipc: fix a null-ptr-deref in tipc_topsrv_accept
ALSA: ac97: fix possible memory leak in snd_ac97_dev_register()
arc: iounmap() arg is volatile
drm/msm: Fix return type of mdp4_lvds_connector_mode_valid
media: v4l2: Fix v4l2_i2c_subdev_set_name function documentation
net: ieee802154: fix error return code in dgram_bind()
mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages
cgroup-v1: add disabled controller check in cgroup1_parse_param()
xen/gntdev: Prevent leaking grants
Xen/gntdev: don't ignore kernel unmapping error
xfs: force the log after remapping a synchronous-writes file
xfs: clear XFS_DQ_FREEING if we can't lock the dquot buffer to flush
xfs: finish dfops on every insert range shift iteration
s390/pci: add missing EX_TABLE entries to __pcistg_mio_inuser()/__pcilg_mio_inuser()
s390/futex: add missing EX_TABLE entry to __futex_atomic_op()
perf auxtrace: Fix address filter symbol name match for modules
kernfs: fix use-after-free in __kernfs_remove
mmc: core: Fix kernel panic when remove non-standard SDIO card
drm/msm/hdmi: fix memory corruption with too many bridges
drm/msm/dsi: fix memory corruption with too many bridges
mac802154: Fix LQI recording
fbdev: smscufx: Fix several use-after-free bugs
iio: light: tsl2583: Fix module unloading
tools: iio: iio_utils: fix digit calculation
xhci: Remove device endpoints from bandwidth list when freeing the device
mtd: rawnand: marvell: Use correct logic for nand-keep-config
usb: xhci: add XHCI_SPURIOUS_SUCCESS to ASM1042 despite being a V0.96 controller
usb: bdc: change state when port disconnected
usb: dwc3: gadget: Don't set IMI for no_interrupt
usb: dwc3: gadget: Stop processing more requests on IMI
USB: add RESET_RESUME quirk for NVIDIA Jetson devices in RCM
ALSA: au88x0: use explicitly signed char
ALSA: Use del_timer_sync() before freeing timer
can: kvaser_usb: Fix possible completions during init_completion
can: j1939: transport: j1939_session_skb_drop_old(): spin_unlock_irqrestore() before kfree_skb()
UPSTREAM: once: fix section mismatch on clang builds
ANDROID: fix up struct sk_buf ABI breakage
ANDROID: fix up CRC issue with struct tcp_sock
Linux 5.4.222
once: fix section mismatch on clang builds
ANDROID: fix up 131287ff83 ("once: add DO_ONCE_SLOW() for sleepable contexts")
Revert "serial: 8250: Fix restoring termios speed after suspend"
Linux 5.4.221
mm: /proc/pid/smaps_rollup: fix no vma's null-deref
hv_netvsc: Fix race between VF offering and VF association message from host
Makefile.debug: re-enable debug info for .S files
ACPI: video: Force backlight native for more TongFang devices
riscv: topology: fix default topology reporting
arm64: topology: move store_cpu_topology() to shared code
iommu/vt-d: Clean up si_domain in the init_dmars() error path
net: hns: fix possible memory leak in hnae_ae_register()
net: sched: cake: fix null pointer access issue when cake_init() fails
net: phy: dp83867: Extend RX strap quirk for SGMII mode
net/atm: fix proc_mpc_write incorrect return value
HID: magicmouse: Do not set BTN_MOUSE on double report
tipc: fix an information leak in tipc_topsrv_kern_subscr
tipc: Fix recognition of trial period
ACPI: extlog: Handle multiple records
btrfs: fix processing of delayed tree block refs during backref walking
btrfs: fix processing of delayed data refs during backref walking
r8152: add PID for the Lenovo OneLink+ Dock
arm64: errata: Remove AES hwcap for COMPAT tasks
media: venus: dec: Handle the case where find_format fails
KVM: arm64: vgic: Fix exit condition in scan_its_table()
ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS
ata: ahci-imx: Fix MODULE_ALIAS
hwmon/coretemp: Handle large core ID value
x86/microcode/AMD: Apply the patch early on every logical thread
ocfs2: fix BUG when iput after ocfs2_mknod fails
ocfs2: clear dinode links count in case of error
xfs: fix use-after-free on CIL context on shutdown
xfs: move inode flush to the sync workqueue
xfs: reflink should force the log out if mounted with wsync
xfs: factor out a new xfs_log_force_inode helper
xfs: trylock underlying buffer on dquot flush
xfs: don't write a corrupt unmount record to force summary counter recalc
xfs: tail updates only need to occur when LSN changes
xfs: factor common AIL item deletion code
xfs: Throttle commits on delayed background CIL push
xfs: Lower CIL flush limit for large logs
xfs: preserve default grace interval during quotacheck
xfs: fix unmount hang and memory leak on shutdown during quotaoff
xfs: factor out quotaoff intent AIL removal and memory free
xfs: Replace function declaration by actual definition
xfs: remove the xfs_qoff_logitem_t typedef
xfs: remove the xfs_dq_logitem_t typedef
xfs: remove the xfs_disk_dquot_t and xfs_dquot_t
xfs: Use scnprintf() for avoiding potential buffer overflow
xfs: check owner of dir3 blocks
xfs: check owner of dir3 data blocks
xfs: fix buffer corruption reporting when xfs_dir3_free_header_check fails
xfs: xfs_buf_corruption_error should take __this_address
xfs: add a function to deal with corrupt buffers post-verifiers
xfs: rework collapse range into an atomic operation
xfs: rework insert range into an atomic operation
xfs: open code insert range extent split helper
Linux 5.4.220
thermal: intel_powerclamp: Use first online CPU as control_cpu
inet: fully convert sk->sk_rx_dst to RCU rules
efi: libstub: drop pointless get_memory_map() call
md: Replace snprintf with scnprintf
ext4: continue to expand file system when the target size doesn't reach
net/ieee802154: don't warn zero-sized raw_sendmsg()
Revert "net/ieee802154: reject zero-sized raw_sendmsg()"
net: ieee802154: return -EINVAL for unknown addr type
io_uring/af_unix: defer registered files gc to io_uring release
perf intel-pt: Fix segfault in intel_pt_print_info() with uClibc
clk: bcm2835: Make peripheral PLLC critical
usb: idmouse: fix an uninit-value in idmouse_open
nvmet-tcp: add bounds check on Transfer Tag
nvme: copy firmware_rev on each init
staging: rtl8723bs: fix a potential memory leak in rtw_init_cmd_priv()
Revert "usb: storage: Add quirk for Samsung Fit flash"
usb: musb: Fix musb_gadget.c rxstate overflow bug
usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info()
md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d
HID: roccat: Fix use-after-free in roccat_read()
bcache: fix set_at_max_writeback_rate() for multiple attached devices
ata: libahci_platform: Sanity check the DT child nodes number
staging: vt6655: fix potential memory leak
power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type()
nbd: Fix hung when signal interrupts nbd_start_device_ioctl()
scsi: 3w-9xxx: Avoid disabling device if failing to enable it
clk: zynqmp: pll: rectify rate rounding in zynqmp_pll_round_rate
media: cx88: Fix a null-ptr-deref bug in buffer_prepare()
clk: zynqmp: Fix stack-out-of-bounds in strncpy`
btrfs: scrub: try to fix super block errors
ARM: dts: imx6sx: add missing properties for sram
ARM: dts: imx6sll: add missing properties for sram
ARM: dts: imx6sl: add missing properties for sram
ARM: dts: imx6qp: add missing properties for sram
ARM: dts: imx6dl: add missing properties for sram
ARM: dts: imx6q: add missing properties for sram
ARM: dts: imx7d-sdb: config the max pressure for tsc2046
mmc: sdhci-msm: add compatible string check for sdm670
drm/amdgpu: fix initial connector audio value
platform/x86: msi-laptop: Change DMI match / alias strings to fix module autoloading
drm: panel-orientation-quirks: Add quirk for Anbernic Win600
drm/vc4: vec: Fix timings for VEC modes
drm/amd/display: fix overflow on MIN_I64 definition
drm: Prevent drm_copy_field() to attempt copying a NULL pointer
drm: Use size_t type for len variable in drm_copy_field()
drm/nouveau/nouveau_bo: fix potential memory leak in nouveau_bo_alloc()
r8152: Rate limit overflow messages
Bluetooth: L2CAP: Fix user-after-free
net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory
wifi: rt2x00: correctly set BBP register 86 for MT7620
wifi: rt2x00: set SoC wmac clock register
wifi: rt2x00: set VGC gain for both chains of MT7620
wifi: rt2x00: set correct TX_SW_CFG1 MAC register for MT7620
wifi: rt2x00: don't run Rt5592 IQ calibration on MT7620
can: bcm: check the result of can_send() in bcm_can_tx()
Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times
Bluetooth: L2CAP: initialize delayed works at l2cap_chan_create()
wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit()
xfrm: Update ipcomp_scratches with NULL when freed
wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg()
tcp: annotate data-race around tcp_md5sig_pool_populated
openvswitch: Fix overreporting of drops in dropwatch
openvswitch: Fix double reporting of drops in dropwatch
bpftool: Clear errno after libcap's checks
wifi: brcmfmac: fix invalid address access when enabling SCAN log level
NFSD: Return nfserr_serverfault if splice_ok but buf->pages have data
thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash
powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue
MIPS: BCM47XX: Cast memcmp() of function to (void *)
ACPI: video: Add Toshiba Satellite/Portege Z830 quirk
f2fs: fix race condition on setting FI_NO_EXTENT flag
crypto: cavium - prevent integer overflow loading firmware
kbuild: remove the target in signal traps when interrupted
iommu/iova: Fix module config properly
crypto: ccp - Release dma channels before dmaengine unrgister
crypto: akcipher - default implementation for setting a private key
iommu/omap: Fix buffer overflow in debugfs
cgroup/cpuset: Enable update_tasks_cpumask() on top_cpuset
powerpc: Fix SPE Power ISA properties for e500v1 platforms
powerpc/64s: Fix GENERIC_CPU build flags for PPC970 / G5
x86/hyperv: Fix 'struct hv_enlightened_vmcs' definition
powerpc/powernv: add missing of_node_put() in opal_export_attrs()
powerpc/pci_dn: Add missing of_node_put()
powerpc/sysdev/fsl_msi: Add missing of_node_put()
powerpc/math_emu/efp: Include module.h
mailbox: bcm-ferxrm-mailbox: Fix error check for dma_map_sg
clk: ast2600: BCLK comes from EPLL
clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe
clk: bcm2835: fix bcm2835_clock_rate_from_divisor declaration
spmi: pmic-arb: correct duplicate APID to PPID mapping logic
dmaengine: ioat: stop mod_timer from resurrecting deleted timer in __cleanup()
clk: mediatek: mt8183: mfgcfg: Propagate rate changes to parent
mfd: sm501: Add check for platform_driver_register()
mfd: fsl-imx25: Fix check for platform_get_irq() errors
mfd: lp8788: Fix an error handling path in lp8788_irq_init() and lp8788_irq_init()
mfd: lp8788: Fix an error handling path in lp8788_probe()
mfd: fsl-imx25: Fix an error handling path in mx25_tsadc_setup_irq()
mfd: intel_soc_pmic: Fix an error handling path in intel_soc_pmic_i2c_probe()
fsi: core: Check error number after calling ida_simple_get
scsi: libsas: Fix use-after-free bug in smp_execute_task_sg()
serial: 8250: Fix restoring termios speed after suspend
firmware: google: Test spinlock on panic path to avoid lockups
staging: vt6655: fix some erroneous memory clean-up loops
phy: qualcomm: call clk_disable_unprepare in the error handling
tty: serial: fsl_lpuart: disable dma rx/tx use flags in lpuart_dma_shutdown
drivers: serial: jsm: fix some leaks in probe
usb: gadget: function: fix dangling pnp_string in f_printer.c
xhci: Don't show warning for reinit on known broken suspend
md/raid5: Ensure stripe_fill happens on non-read IO with journal
mtd: rawnand: meson: fix bit map use in meson_nfc_ecc_correct()
ata: fix ata_id_has_dipm()
ata: fix ata_id_has_ncq_autosense()
ata: fix ata_id_has_devslp()
ata: fix ata_id_sense_reporting_enabled() and ata_id_has_sense_reporting()
RDMA/siw: Always consume all skbuf data in sk_data_ready() upcall.
mtd: devices: docg3: check the return value of devm_ioremap() in the probe
dyndbg: let query-modname override actual module name
dyndbg: fix module.dyndbg handling
misc: ocxl: fix possible refcount leak in afu_ioctl()
RDMA/rxe: Fix the error caused by qp->sk
RDMA/rxe: Fix "kernel NULL pointer dereference" error
media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init
tty: xilinx_uartps: Fix the ignore_status
media: exynos4-is: fimc-is: Add of_node_put() when breaking out of loop
HSI: omap_ssi_port: Fix dma_map_sg error check
HSI: omap_ssi: Fix refcount leak in ssi_probe
clk: tegra20: Fix refcount leak in tegra20_clock_init
clk: tegra: Fix refcount leak in tegra114_clock_init
clk: tegra: Fix refcount leak in tegra210_clock_init
clk: berlin: Add of_node_put() for of_get_parent()
clk: oxnas: Hold reference returned by of_get_parent()
clk: meson: Hold reference returned by of_get_parent()
iio: ABI: Fix wrong format of differential capacitance channel ABI.
iio: inkern: only release the device node when done with it
iio: adc: at91-sama5d2_adc: lock around oversampling and sample freq
iio: adc: at91-sama5d2_adc: check return status for pressure and touch
iio: adc: at91-sama5d2_adc: fix AT91_SAMA5D2_MR_TRACKTIM_MAX
ARM: dts: exynos: fix polarity of VBUS GPIO of Origen
ARM: Drop CMDLINE_* dependency on ATAGS
ARM: dts: exynos: correct s5k6a3 reset polarity on Midas family
ARM: dts: kirkwood: lsxl: remove first ethernet port
ARM: dts: kirkwood: lsxl: fix serial line
ARM: dts: turris-omnia: Fix mpp26 pin name and comment
soc: qcom: smem_state: Add refcounting for the 'state->of_node'
soc: qcom: smsm: Fix refcount leak bugs in qcom_smsm_probe()
memory: of: Fix refcount leak bug in of_get_ddr_timings()
memory: pl353-smc: Fix refcount leak bug in pl353_smc_probe()
ALSA: hda/hdmi: Don't skip notification handling during PM operation
ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe
ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe
ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe
mmc: wmt-sdmmc: Fix an error handling path in wmt_mci_probe()
ALSA: dmaengine: increment buffer pointer atomically
drm/msm/dpu: index dpu_kms->hw_vbif using vbif_idx
ASoC: eureka-tlv320: Hold reference returned from of_find_xxx API
mmc: au1xmmc: Fix an error handling path in au1xmmc_probe()
drm/omap: dss: Fix refcount leak bugs
ALSA: hda: beep: Simplify keep-power-at-enable behavior
ASoC: rsnd: Add check for rsnd_mod_power_on
drm/bridge: megachips: Fix a null pointer dereference bug
drm: fix drm_mipi_dbi build errors
platform/x86: msi-laptop: Fix resource cleanup
platform/x86: msi-laptop: Fix old-ec check for backlight registering
platform/chrome: fix memory corruption in ioctl
platform/chrome: fix double-free in chromeos_laptop_prepare()
drm/mipi-dsi: Detach devices when removing the host
drm: bridge: adv7511: fix CEC power down control register offset
net: mvpp2: fix mvpp2 debugfs leak
once: add DO_ONCE_SLOW() for sleepable contexts
net/ieee802154: reject zero-sized raw_sendmsg()
bnx2x: fix potential memory leak in bnx2x_tpa_stop()
net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks()
tcp: fix tcp_cwnd_validate() to not forget is_cwnd_limited
sctp: handle the error returned from sctp_auth_asoc_init_active_key
mISDN: fix use-after-free bugs in l1oip timer handlers
vhost/vsock: Use kvmalloc/kvfree for larger packets.
spi: s3c64xx: Fix large transfers with DMA
netfilter: nft_fib: Fix for rpath check with VRF devices
spi/omap100k:Fix PM disable depth imbalance in omap1_spi100k_probe
x86/microcode/AMD: Track patch allocation size explicitly
bpf: Ensure correct locking around vulnerable function find_vpid()
net: fs_enet: Fix wrong check in do_pd_setup
wifi: rtl8xxxu: gen2: Fix mistake in path B IQ calibration
bpf: btf: fix truncated last_member_type_id in btf_struct_resolve
wifi: rtl8xxxu: Fix skb misuse in TX queue selection
spi: qup: add missing clk_disable_unprepare on error in spi_qup_pm_resume_runtime()
spi: qup: add missing clk_disable_unprepare on error in spi_qup_resume()
wifi: rtl8xxxu: tighten bounds checking in rtl8xxxu_read_efuse()
x86/resctrl: Fix to restore to original value when re-enabling hardware prefetch register
bpftool: Fix a wrong type cast in btf_dumper_int
wifi: mac80211: allow bw change during channel switch in mesh
wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()
nfsd: Fix a memory leak in an error handling path
ARM: 9247/1: mm: set readonly for MT_MEMORY_RO with ARM_LPAE
sh: machvec: Use char[] for section boundaries
userfaultfd: open userfaultfds with O_RDONLY
tracing: Disable interrupt or preemption before acquiring arch_spinlock_t
selinux: use "grep -E" instead of "egrep"
drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table()
gcov: support GCC 12.1 and newer compilers
KVM: VMX: Drop bits 31:16 when shoving exception error code into VMCS
KVM: nVMX: Unconditionally purge queued/injected events on nested "exit"
KVM: x86/emulator: Fix handing of POP SS to correctly set interruptibility
media: cedrus: Set the platform driver data earlier
ring-buffer: Fix race between reset page and reading page
ring-buffer: Check pending waiters when doing wake ups as well
ring-buffer: Have the shortest_full queue be the shortest not longest
ring-buffer: Allow splice to read previous partially read pages
ftrace: Properly unset FTRACE_HASH_FL_MOD
livepatch: fix race between fork and KLP transition
ext4: place buffer head allocation before handle start
ext4: make ext4_lazyinit_thread freezable
ext4: fix null-ptr-deref in ext4_write_info
ext4: avoid crash when inline data creation follows DIO write
jbd2: wake up journal waiters in FIFO order, not LIFO
nilfs2: fix use-after-free bug of struct nilfs_root
f2fs: fix to do sanity check on summary info
f2fs: fix to do sanity check on destination blkaddr during recovery
f2fs: increase the limit for reserve_root
btrfs: fix race between quota enable and quota rescan ioctl
fbdev: smscufx: Fix use-after-free in ufx_ops_open()
powerpc/boot: Explicitly disable usage of SPE instructions
PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge
UM: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
riscv: Pass -mno-relax only on lld < 15.0.0
riscv: Allow PROT_WRITE-only mmap()
parisc: fbdev/stifb: Align graphics memory size to 4MB
RISC-V: Make port I/O string accessors actually work
regulator: qcom_rpm: Fix circular deferral regression
ASoC: wcd9335: fix order of Slimbus unprepare/disable
quota: Check next/prev free block number after reading from quota file
HID: multitouch: Add memory barriers
fs: dlm: handle -EBUSY first in lock arg validation
fs: dlm: fix race between test_bit() and queue_work()
mmc: sdhci-sprd: Fix minimum clock limit
can: kvaser_usb_leaf: Fix CAN state after restart
can: kvaser_usb_leaf: Fix TX queue out of sync after restart
can: kvaser_usb_leaf: Fix overread with an invalid command
can: kvaser_usb: Fix use of uninitialized completion
usb: add quirks for Lenovo OneLink+ Dock
iio: pressure: dps310: Reset chip after timeout
iio: pressure: dps310: Refactor startup procedure
iio: dac: ad5593r: Fix i2c read protocol requirements
cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message
cifs: destage dirty pages before re-reading them for cache=none
mtd: rawnand: atmel: Unmap streaming DMA mappings
ALSA: hda/realtek: Add Intel Reference SSID to support headset keys
ALSA: hda/realtek: Add quirk for ASUS GV601R laptop
ALSA: hda/realtek: Correct pin configs for ASUS G533Z
ALSA: hda/realtek: remove ALC289_FIXUP_DUAL_SPK for Dell 5530
ALSA: usb-audio: Fix NULL dererence at error path
ALSA: usb-audio: Fix potential memory leaks
ALSA: rawmidi: Drop register_mutex in snd_rawmidi_free()
ALSA: oss: Fix potential deadlock at unregistration
Conflicts:
include/linux/rmap.h
kernel/cgroup/cpuset.c
mm/rmap.c
Change-Id: Icfcc8ff31af6311f7b8d36a8909b77e62ec8f2e6
Signed-off-by: Srinivasarao Pathipati <quic_c_spathi@quicinc.com>
Some android userspace is sending BINDER_TYPE_FDA objects with
num_fds=0. Like the previous patch, this is reproducible when
playing a video.
Before commit 09184ae9b575 BINDER_TYPE_FDA objects with num_fds=0
were 'correctly handled', as in no fixup was performed.
After commit 09184ae9b575 we aggregate fixup and skip regions in
binder_ptr_fixup structs and distinguish between the two by using
the skip_size field: if it's 0, then it's a fixup, otherwise skip.
When processing BINDER_TYPE_FDA objects with num_fds=0 we add a
skip region of skip_size=0, and this causes issues because now
binder_do_deferred_txn_copies will think this was a fixup region.
To address that, return early from binder_translate_fd_array to
avoid adding an empty skip region.
Fixes: 09184ae9b575 ("binder: defer copies of pre-patched txn data")
Acked-by: Todd Kjos <tkjos@google.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Alessandro Astone <ales.astone@gmail.com>
Link: https://lore.kernel.org/r/20220415120015.52684-1-ales.astone@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 257685302
(cherry picked from commit ef38de9217a04c9077629a24652689d8fdb4c6c6)
Change-Id: I34fab41c0c1beee366a5df4724b263e4385ad13b
Signed-off-by: Carlos Llamas <cmllamas@google.com>
When handling BINDER_TYPE_FDA object we are pushing a parent fixup
with a certain skip_size but no scatter-gather copy object, since
the copy is handled standalone.
If BINDER_TYPE_FDA is the last children the scatter-gather copy
loop will never stop to skip it, thus we are left with an item in
the parent fixup list. This will trigger the BUG_ON().
This is reproducible in android when playing a video.
We receive a transaction that looks like this:
obj[0] BINDER_TYPE_PTR, parent
obj[1] BINDER_TYPE_PTR, child
obj[2] BINDER_TYPE_PTR, child
obj[3] BINDER_TYPE_FDA, child
Fixes: 09184ae9b575 ("binder: defer copies of pre-patched txn data")
Acked-by: Todd Kjos <tkjos@google.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Alessandro Astone <ales.astone@gmail.com>
Link: https://lore.kernel.org/r/20220415120015.52684-2-ales.astone@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 257685302
(cherry picked from commit 2d1746e3fda0c3612143d7c06f8e1d1830c13e23)
Change-Id: I3963a98dfc48b01d7bb8166aaa90341818bf6416
Signed-off-by: Carlos Llamas <cmllamas@google.com>
binder_uintptr_t is not the same as uintptr_t, so converting it into a
pointer requires a second cast:
drivers/android/binder.c: In function 'binder_translate_fd_array':
drivers/android/binder.c:2511:28: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
2511 | sender_ufda_base = (void __user *)sender_uparent->buffer + fda->parent_offset;
| ^
Fixes: 656e01f3ab54 ("binder: read pre-translated fds from sender buffer")
Acked-by: Todd Kjos <tkjos@google.com>
Acked-by: Randy Dunlap <rdunlap@infradead.org> # build-tested
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20211207122448.1185769-1-arnd@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 257685302
(cherry picked from commit 9a0a930fe2535a76ad70d3f43caeccf0d86a3009)
Change-Id: I1c9b86a90bcf2be81012e59e0c472869f551e61a
Signed-off-by: Carlos Llamas <cmllamas@google.com>
BINDER_TYPE_PTR objects point to memory areas in the
source process to be copied into the target buffer
as part of a transaction. This implements a scatter-
gather model where non-contiguous memory in a source
process is "gathered" into a contiguous region in
the target buffer.
The data can include pointers that must be fixed up
to correctly point to the copied data. To avoid making
source process pointers visible to the target process,
this patch defers the copy until the fixups are known
and then copies and fixeups are done together.
There is a special case of BINDER_TYPE_FDA which applies
the fixup later in the target process context. In this
case the user data is skipped (so no untranslated fds
become visible to the target).
Reviewed-by: Martijn Coenen <maco@android.com>
Signed-off-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20211130185152.437403-5-tkjos@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 137131904
Bug: 257685302
(cherry picked from commit 09184ae9b5756cc469db6fd1d1cfdcffbf627c2d)
[cmllamas: fix trivial merge conflict]
Change-Id: I6de75b192d1e3b2cc73c8d91077d97b608e8c5a9
Signed-off-by: Carlos Llamas <cmllamas@google.com>
This patch is to prepare for an up coming patch where we read
pre-translated fds from the sender buffer and translate them before
copying them to the target. It does not change run time.
The patch adds two new parameters to binder_translate_fd_array() to
hold the sender buffer and sender buffer parent. These parameters let
us call copy_from_user() directly from the sender instead of using
binder_alloc_copy_from_buffer() to copy from the target. Also the patch
adds some new alignment checks. Previously the alignment checks would
have been done in a different place, but this lets us print more
useful error messages.
Reviewed-by: Martijn Coenen <maco@android.com>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20211130185152.437403-4-tkjos@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 137131904
Bug: 257685302
(cherry picked from commit 656e01f3ab54afe71bed066996fc2640881e1220)
Change-Id: Ib786020e49bd33e35aec88d43965f9d98021fa53
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Transactions are copied from the sender to the target
first and objects like BINDER_TYPE_PTR and BINDER_TYPE_FDA
are then fixed up. This means there is a short period where
the sender's version of these objects are visible to the
target prior to the fixups.
Instead of copying all of the data first, copy data only
after any needed fixups have been applied.
Fixes: 457b9a6f09 ("Staging: android: add binder driver")
Reviewed-by: Martijn Coenen <maco@android.com>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20211130185152.437403-3-tkjos@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 137131904
Bug: 257685302
(cherry picked from commit 6d98eb95b450a75adb4516a1d33652dc78d2b20c)
[cmllamas: fix trivial merge conflict]
Change-Id: I8c14a03a2ee23c5f060c82e1626686f72eff33d9
Signed-off-by: Carlos Llamas <cmllamas@google.com>
When the target process is busy, incoming oneway transactions are
queued in the async_todo list. If the clients continue sending extra
oneway transactions while the target process is frozen, this queue can
become too large to accommodate new transactions. That's why binder
driver introduced ONEWAY_SPAM_DETECTION to detect this situation. It's
helpful to debug the async binder buffer exhausting issue, but the
issue itself isn't solved directly.
In real cases applications are designed to send oneway transactions
repeatedly, delivering updated inforamtion to the target process.
Typical examples are Wi-Fi signal strength and some real time sensor
data. Even if the apps might only care about the lastet information,
all outdated oneway transactions are still accumulated there until the
frozen process is thawed later. For this kind of situations, there's
no existing method to skip those outdated transactions and deliver the
latest one only.
This patch introduces a new transaction flag TF_UPDATE_TXN. To use it,
use apps can set this new flag along with TF_ONE_WAY. When such an
oneway transaction is to be queued into the async_todo list of a frozen
process, binder driver will check if any previous pending transactions
can be superseded by comparing their code, flags and target node. If
such an outdated pending transaction is found, the latest transaction
will supersede that outdated one. This effectively prevents the async
binder buffer running out and saves unnecessary binder read workloads.
Acked-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Li Li <dualli@google.com>
Link: https://lore.kernel.org/r/20220526220018.3334775-2-dualli@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 231624308
Test: manually check async binder buffer size of frozen apps
Test: stress test with kernel 4.14/4.19/5.10/5.15
(cherry picked from commit 9864bb4801331daa48514face9d0f4861e4d485b
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
char-misc-next)
Change-Id: I1c4bff1eda1ca15aaaad5bf696c8fc00be743176
All the other ioctl paths return EFAULT in case the
copy_from_user/copy_to_user call fails, make oneway spam detection
follow the same paradigm.
Fixes: a7dc1e6f99df ("binder: tell userspace to dump current backtrace when detected oneway spamming")
Acked-by: Todd Kjos <tkjos@google.com>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Luca Stefani <luca.stefani.ge1@gmail.com>
Link: https://lore.kernel.org/r/20210506193726.45118-1-luca.stefani.ge1@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit ced081a436d21a7d34d4d42acb85058f9cf423f2)
Bug: 187129171
Signed-off-by: Connor O'Brien <connoro@google.com>
Change-Id: I7c5e6ec7108c42721de6c82f4c1e9ff3d4f0e88d
When async binder buffer got exhausted, some normal oneway transactions
will also be discarded and may cause system or application failures. By
that time, the binder debug information we dump may not be relevant to
the root cause. And this issue is difficult to debug if without the
backtrace of the thread sending spam.
This change will send BR_ONEWAY_SPAM_SUSPECT to userspace when oneway
spamming is detected, request to dump current backtrace. Oneway spamming
will be reported only once when exceeding the threshold (target process
dips below 80% of its oneway space, and current process is responsible
for either more than 50 transactions, or more than 50% of the oneway
space). And the detection will restart when the async buffer has
returned to a healthy state.
Acked-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Hang Lu <hangl@codeaurora.org>
Link: https://lore.kernel.org/r/1617961246-4502-3-git-send-email-hangl@codeaurora.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 181190340
Change-Id: Id3d2526099bc89f04d8ad3ad6e48141b2a8f2515
(cherry picked from commit a7dc1e6f99df59799ab0128d9c4e47bbeceb934d)
Signed-off-by: Hang Lu <hangl@codeaurora.org>
security_secid_to_secctx() can fail because of a GFP_ATOMIC allocation
This needs to be retried from userspace. However, binder driver doesn't
propagate specific enough error codes just yet (WIP b/28321379). We'll
retry on the binder driver as a temporary work around until userspace
can do this instead.
Bug: 174806915
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Change-Id: Ifebddeb7adf9707613512952b97ab702f0d2d592
(cherry picked from commit 3bca0b53448b28938cf4282caaa98f6233f0399c)
This fixed the crash when setting channels to 2 or more when
communicating over virtio.
Signed-off-by: Weilun Du <wdu@google.com>
Link: https://lore.kernel.org/r/20210506180530.3418576-1-wdu@google.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
(cherry picked from commit 626c30f9e77354301ff9162c3bdddaf92d9b5cf3 https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/commit/?id=626c30f9e77354301ff9162c3bdddaf92d9b5cf3)
Bug: 182576217
Signed-off-by: Weilun Du <wdu@google.com>
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ia9be6c1d962b941a92f4e1be41e874dbe08024e5
(cherry picked from commit 2e289f3641a9c37ad054f9e84398533ccd930c8f)
(cherry picked from commit 085ebe864e396d3df82d06761bb1ddb97d8ce4d9)
PCIe endpoint device informs PCIe root complex/host about completion
or availability of new work using MSI. In some cases like UEFI, MSI
functionality is not supported by used PCIe root complex/host, and
can work in polling mode only. In MSI not supported case, endpoint
is not allowed to raise MSI. This change queries MSI functionality
support with root complex/host, and handle case where MSI
functionality is not supported by polling MHI state, and not
invoking MSIs towards host.
Change-Id: Ie9c78f40fe7e9735d3e0104f845e29ac82d76778
Signed-off-by: Mohana Basava Tejesh Reddy Mareddy <quic_mmareddy@quicinc.com>
Handle irq enable and disable based on irq status
flag, to avoid unbalanced irq errors. Enable irq
only if irq status is disabled. Disable irq
only if irq status is enabled.
Change-Id: Ie01f89d10b0e2413bc8ba9a442ef99d358ce7f50
Signed-off-by: Manisha Podhuturi <quic_mpodhtur@quicinc.com>
In certain use cases, host doesn't expect MSI
interrupts from device. Provide configuration support
to disable MSI in case host doesn't support it.
Change-Id: Ia629054024ad0090e5b7039dda99dbe4abe40745
Signed-off-by: Chaitanya Pratapa <quic_cpratapa@quicinc.com>
The cuttlefish symbol list has bitrotted preventing this kernel's startup. Updating it with the following steps.
$ BUILD_CONFIG=common/build.config.gki.aarch64 build/build.sh
$ BUILD_CONFIG=common-modules/virtual-\
device/build.config.cuttlefish.aarch64 build/build.sh
$ build/abi/extract_symbols out/android11-5.4/dist/ --whitelist \
common/android/abi_gki_aarch64_cuttlefish --additions-only
$ BUILD_CONFIG=common/build.config.gki.aarch64 build/build_abi.sh \
--update --print-report
Bug: 267474419
Bug: 254392308
Test: Local boot on cuttlefish arm64 android11-gsi
Signed-off-by: Ram Muthiah <rammuthiah@google.com>
Change-Id: I45b54bed9584c8669d1e277a0ffbed2e5026eeb8
commit fd3d91ab1c6ab0628fe642dd570b56302c30a792 upstream.
The dvb-core tries to sync the releases of opened files at
dvb_dmxdev_release() with two refcounts: dvbdev->users and
dvr_dvbdev->users. A problem is present in those two syncs: when yet
another dvb_demux_open() is called during those sync waits,
dvb_demux_open() continues to process even if the device is being
closed. This includes the increment of the former refcount, resulting
in the leftover refcount after the sync of the latter refcount at
dvb_dmxdev_release(). It ends up with use-after-free, since the
function believes that all usages were gone and releases the
resources.
This patch addresses the problem by adding the check of dmxdev->exit
flag at dvb_demux_open(), just like dvb_dvr_open() already does. With
the exit flag check, the second call of dvb_demux_open() fails, hence
the further corruption can be avoided.
Also for avoiding the races of the dmxdev->exit flag reference, this
patch serializes the dmxdev->exit set up and the sync waits with the
dmxdev->mutex lock at dvb_dmxdev_release(). Without the mutex lock,
dvb_demux_open() (or dvb_dvr_open()) may run concurrently with
dvb_dmxdev_release(), which allows to skip the exit flag check and
continue the open process that is being closed.
CVE-2022-41218 is assigned to those bugs above.
Bug: 248356119
Reported-by: Hyunwoo Kim <imv4bel@gmail.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/20220908132754.30532-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I5a0dd4444ca25d07a050dcb07609c7c7ccf658af
Enable BUS_MASTER_EN_DEASSERT IRQ as part of aggregated IRQ and Print
error log when BME is deasserted to help in debugging.
Use the device tree flag to distinguish if the device supports BME
deassert IRQ or not and enable it only on supported devices.
Change-Id: I810619b995255dab02eaabf05a6bc5c6e7639419
Signed-off-by: Sai Chaitanya Kaveti <quic_skaveti@quicinc.com>
Michael Bestas
Murali Nalajala
Divyanshu-Modi
Linux Build Service Account
Vaisakh Murali
Udipto Goswami
Jim Mattson
Krishna Nagaraja
Baokun Li
Cong Wang
Eric Dumazet
qctecmdr
Puranam V G Tejaswi
Robin Murphy
Michael Adisumarta
Johannes Berg
Arun Prakash
Juri Lelli
Srinivasarao Pathipati
Alessandro Astone
Arnd Bergmann
Todd Kjos
Li Li
Luca Stefani
Hang Lu
Carlos Llamas
Weilun Du
Mohana Basava Tejesh Reddy Mareddy
Manisha Podhuturi
Chaitanya Pratapa
Ram Muthiah
Takashi Iwai
Sai Chaitanya Kaveti