Author	SHA1	Message	Date
Carlos Llamas	f4e5b5151e	FROMLIST: binder: fix UAF caused by offsets overwrite ... Binder objects are processed and copied individually into the target buffer during transactions. Any raw data in-between these objects is copied as well. However, this raw data copy lacks an out-of-bounds check. If the raw data exceeds the data section size then the copy overwrites the offsets section. This eventually triggers an error that attempts to unwind the processed objects. However, at this point the offsets used to index these objects are now corrupted. Unwinding with corrupted offsets can result in decrements of arbitrary nodes and lead to their premature release. Other users of such nodes are left with a dangling pointer triggering a use-after-free. This issue is made evident by the following KASAN report (trimmed): ================================================================== BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x19c Write of size 4 at addr ffff47fc91598f04 by task binder-util/743 CPU: 9 UID: 0 PID: 743 Comm: binder-util Not tainted 6.11.0-rc4 #1 Hardware name: linux,dummy-virt (DT) Call trace: _raw_spin_lock+0xe4/0x19c binder_free_buf+0x128/0x434 binder_thread_write+0x8a4/0x3260 binder_ioctl+0x18f0/0x258c [...] Allocated by task 743: __kmalloc_cache_noprof+0x110/0x270 binder_new_node+0x50/0x700 binder_transaction+0x413c/0x6da8 binder_thread_write+0x978/0x3260 binder_ioctl+0x18f0/0x258c [...] Freed by task 745: kfree+0xbc/0x208 binder_thread_read+0x1c5c/0x37d4 binder_ioctl+0x16d8/0x258c [...] ================================================================== To avoid this issue, let's check that the raw data copy is within the boundaries of the data section. Fixes: 6d98eb95b450 ("binder: avoid potential data leakage when copying txn") Cc: Todd Kjos <tkjos@google.com> Cc: stable@vger.kernel.org Signed-off-by: Carlos Llamas <cmllamas@google.com> Bug: 352520660 Link: https://lore.kernel.org/all/20240822182353.2129600-1-cmllamas@google.com/ Change-Id: I1b2dd8403b63e5eeb58904558b7b542141c83fc2 Signed-off-by: Carlos Llamas <cmllamas@google.com>	2024-08-23 16:47:50 +00:00
Greg Kroah-Hartman	eb1a0358d1	This is the 5.4.278 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmZuzHwACgkQONu9yGCS aT6M7xAAuCGja5JhZ7ciWjhdxIFxACHrSVm3l/i+bqNAXoDh2rJDKgOize1OTLGR R1Fq2qBEtfMsoKNa+3DyMCB8D1IsMUrhr8hdM56+AqDBbmaTsDmw+L6vzepwJKVV ksX2onT5tXdydH95IjqnM7vbadxnU9cLkHZIpckXkb2dDA2kjhMksWSfA+GJfRsY XReqFYfeQhLWv4c0OWZ//ssSmGWztSVaRCX22jemUJ5MYpQHt3TYQXVpFYkaQLYH FZHDxBFEr48Gt9bQtnBZ2fyurKX9NdzZF+WwNDuo0DShlEpJB99vYHQ/dIxzxl9R 7VOs3Cj7vvUBSIRPY9DhuhBm7tQrpCvf4w3qUBc0TD+IdPPIIf0ZqDsVUvZGM9JE T54rnXppxNKlbW8HmYqefc2FBgjrZn08NprrAVqIVhNwFyq+8/ADqdSTTKlD9z1i S/3Pur7ES2e15YsrjOrDJIpGl3klMrEBbz9XyEHwrTY2vrDjdqOF0NHYUaugnjSd B+qmUtZxwSjzRok5wgQaf/EbrW78e9q1lTj97QRJfBr0A7MUpDMuQCvmsMoe2HUA vANx7ty/ubNk/9PLTGyBHUw4/F58Bk5osibAKRmulvlO5g80FsJXEU9WWqQmIkzp 3df+cOL8ipqh0fg/PaUOBCoeVs2HqPHnewOlYRegN41FokQndsE= =XU0g -----END PGP SIGNATURE----- Merge 5.4.278 into android11-5.4-lts Changes in 5.4.278 x86/tsc: Trust initial offset in architectural TSC-adjust MSRs tty: n_gsm: fix possible out-of-bounds in gsm0_receive() speakup: Fix sizeof() vs ARRAY_SIZE() bug ring-buffer: Fix a race between readers and resize checks net: smc91x: Fix m68k kernel compilation for ColdFire CPU nilfs2: fix unexpected freezing of nilfs_segctor_sync() nilfs2: fix potential hang in nilfs_detach_log_writer() wifi: cfg80211: fix the order of arguments for trace events of the tx_rx_evt class net: usb: qmi_wwan: add Telit FN920C04 compositions drm/amd/display: Set color_mgmt_changed to true on unsuspend ASoC: rt5645: Fix the electric noise due to the CBJ contacts floating ASoC: dt-bindings: rt5645: add cbj sleeve gpio property ASoC: da7219-aad: fix usage of device_get_named_child_node() drm/amdkfd: Flush the process wq before creating a kfd_process nvme: find numa distance only if controller has valid numa id openpromfs: finish conversion to the new mount API crypto: bcm - Fix pointer arithmetic firmware: raspberrypi: Use correct device for DMA mappings ecryptfs: Fix buffer size for tag 66 packet nilfs2: fix out-of-range warning parisc: add missing export of __cmpxchg_u8() crypto: ccp - drop platform ifdef checks s390/cio: fix tracepoint subchannel type field jffs2: prevent xattr node from overflowing the eraseblock null_blk: Fix missing mutex_destroy() at module removal md: fix resync softlockup when bitmap size is less than array size wifi: ath10k: poll service ready message before failing x86/boot: Ignore relocations in .notes sections in walk_relocs() too qed: avoid truncating work queue length scsi: ufs: qcom: Perform read back after writing reset bit scsi: ufs: cdns-pltfrm: Perform read back after writing HCLKDIV scsi: ufs: core: Perform read back after disabling interrupts scsi: ufs: core: Perform read back after disabling UIC_COMMAND_COMPL irqchip/alpine-msi: Fix off-by-one in allocation error path ACPI: disable -Wstringop-truncation cpufreq: Reorganize checks in cpufreq_offline() cpufreq: Split cpufreq_offline() cpufreq: Rearrange locking in cpufreq_remove_dev() cpufreq: exit() callback is optional scsi: libsas: Fix the failure of adding phy with zero-address to port scsi: hpsa: Fix allocation size for Scsi_Host private data x86/purgatory: Switch to the position-independent small code model wifi: ath10k: Fix an error code problem in ath10k_dbg_sta_write_peer_debug_trigger() wifi: ath10k: populate board data for WCN3990 tcp: minor optimization in tcp_add_backlog() tcp: fix a signed-integer-overflow bug in tcp_add_backlog() tcp: avoid premature drops in tcp_add_backlog() macintosh/via-macii: Fix "BUG: sleeping function called from invalid context" wifi: carl9170: add a proper sanity check for endpoints wifi: ar5523: enable proper endpoint verification sh: kprobes: Merge arch_copy_kprobe() into arch_prepare_kprobe() Revert "sh: Handle calling csum_partial with misaligned data" HID: intel-ish-hid: ipc: Add check for pci_alloc_irq_vectors scsi: bfa: Ensure the copied buf is NUL terminated scsi: qedf: Ensure the copied buf is NUL terminated wifi: mwl8k: initialize cmd->addr[] properly usb: aqc111: stop lying about skb->truesize net: usb: sr9700: stop lying about skb->truesize m68k: Fix spinlock race in kernel thread creation m68k: mac: Fix reboot hang on Mac IIci net: ethernet: cortina: Locking fixes af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg net: usb: smsc95xx: stop lying about skb->truesize net: openvswitch: fix overwriting ct original tuple for ICMPv6 ipv6: sr: add missing seg6_local_exit ipv6: sr: fix incorrect unregister order ipv6: sr: fix invalid unregister error path drm/amd/display: Fix potential index out of bounds in color transformation function mtd: rawnand: hynix: fixed typo fbdev: shmobile: fix snprintf truncation drm/mediatek: Add 0 size check to mtk_drm_gem_obj powerpc/fsl-soc: hide unused const variable fbdev: sisfb: hide unused variables media: ngene: Add dvb_ca_en50221_init return value check media: radio-shark2: Avoid led_names truncations platform/x86: wmi: Make two functions static fbdev: sh7760fb: allow modular build drm/arm/malidp: fix a possible null pointer dereference ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value drm/panel: simple: Add missing Innolux G121X1-L03 format, flags, connector RDMA/hns: Use complete parentheses in macros x86/insn: Fix PUSH instruction in x86 instruction decoder opcode map ext4: avoid excessive credit estimate in ext4_tmpfile() sunrpc: removed redundant procp check SUNRPC: Fix gss_free_in_token_pages() selftests/kcmp: Make the test output consistent and clear selftests/kcmp: remove unused open mode RDMA/IPoIB: Fix format truncation compilation errors netrom: fix possible dead-lock in nr_rt_ioctl() af_packet: do not call packet_read_pending() from tpacket_destruct_skb() sched/topology: Don't set SD_BALANCE_WAKE on cpuset domain relax sched/fair: Allow disabling sched_balance_newidle with sched_relax_domain_level greybus: lights: check return of get_channel_from_mode soundwire: cadence/intel: simplify PDI/port mapping soundwire: intel: don't filter out PDI0/1 soundwire: cadence_master: improve PDI allocation soundwire: cadence: fix invalid PDI offset dmaengine: idma64: Add check for dma_set_max_seg_size firmware: dmi-id: add a release callback function serial: max3100: Lock port->lock when calling uart_handle_cts_change() serial: max3100: Update uart_driver_registered on driver removal serial: max3100: Fix bitwise types greybus: arche-ctrl: move device table to its right location iio: pressure: dps310: support negative temperature values microblaze: Remove gcc flag for non existing early_printk.c file microblaze: Remove early printk call from cpuinfo-static.c usb: gadget: u_audio: Clear uac pointer when freed. stm class: Fix a double free in stm_register_device() ppdev: Remove usage of the deprecated ida_simple_xx() API ppdev: Add an error check in register_device extcon: max8997: select IRQ_DOMAIN instead of depending on it f2fs: fix to release node block count in error path of f2fs_new_node_page() serial: sh-sci: protect invalidating RXDMA on shutdown libsubcmd: Fix parse-options memory leak Input: ims-pcu - fix printf string overflow Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation drm/msm/dpu: Always flush the slave INTF on the CTL um: Fix return value in ubd_init() um: Add winch to winch_handlers before registering winch IRQ media: stk1160: fix bounds checking in stk1160_copy_video() scsi: qla2xxx: Replace all non-returning strlcpy() with strscpy() powerpc/pseries: Add failure related checks for h_get_mpp and h_get_ppp um: Fix the -Wmissing-prototypes warning for __switch_mm media: cec: cec-adap: always cancel work in cec_transmit_msg_fh media: cec: cec-api: add locking in cec_release() null_blk: Fix the WARNING: modpost: missing MODULE_DESCRIPTION() x86/kconfig: Select ARCH_WANT_FRAME_POINTERS again when UNWINDER_FRAME_POINTER=y nfc: nci: Fix uninit-value in nci_rx_work sunrpc: fix NFSACL RPC retry on soft mount ipv6: sr: fix memleak in seg6_hmac_init_algo params: lift param_set_uint_minmax to common code tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). openvswitch: Set the skbuff pkt_type for proper pmtud support. arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY virtio: delete vq in vp_find_vqs_msix() when request_irq() fails net: fec: avoid lock evasion when reading pps_enable nfc: nci: Fix kcov check in nci_rx_work() nfc: nci: Fix handling of zero-length payload packets in nci_rx_work() netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() spi: Don't mark message DMA mapped when no transfer in it is nvmet: fix ns enable/disable possible hang net/mlx5e: Use rx_missed_errors instead of rx_dropped for reporting buffer exhaustion dma-buf/sw-sync: don't enable IRQ from sync_print_obj() enic: Validate length of nl attributes in enic_set_vf_port smsc95xx: remove redundant function arguments smsc95xx: use usbnet->driver_priv net: usb: smsc95xx: fix changing LED_SEL bit value updated from EEPROM net:fec: Add fec_enet_deinit() netfilter: tproxy: bail out if IP has been disabled on the device kconfig: fix comparison to constant symbols, 'm', 'n' spi: stm32: Don't warn about spurious interrupts ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound ALSA: timer: Set lower bound of start tick time genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline SUNRPC: Fix loop termination condition in gss_free_in_token_pages() binder: fix max_thread type inconsistency mmc: core: Do not force a retune before RPMB switch io_uring: fail NOP if non-zero op flags is passed in afs: Don't cross .backup mountpoint from backup volume nilfs2: fix use-after-free of timer for log writer thread vxlan: Fix regression when dropping packets due to invalid src addresses x86/mm: Remove broken vsyscall emulation code from the page fault code f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode() media: lgdt3306a: Add a check against null-pointer-def drm/amdgpu: add error handle to avoid out-of-bounds ata: pata_legacy: make legacy_exit() work again ACPI: resource: Do IRQ override on TongFang GXxHRXx and GMxHGxx arm64: tegra: Correct Tegra132 I2C alias md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING wifi: rtl8xxxu: Fix the TX power of RTL8192CU, RTL8723AU arm64: dts: hi3798cv200: fix the size of GICR media: mc: mark the media devnode as registered from the, start media: mxl5xx: Move xpt structures off stack media: v4l2-core: hold videodev_lock until dev reg, finishes fbdev: savage: Handle err return when savagefb_check_var failed KVM: arm64: Allow AArch32 PSTATE.M to be restored as System mode crypto: ecrdsa - Fix module auto-load on add_key crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak net/ipv6: Fix route deleting failure when metric equals 0 net/9p: fix uninit-value in p9_client_rpc() intel_th: pci: Add Meteor Lake-S CPU support sparc64: Fix number of online CPUs kdb: Fix buffer overflow during tab-complete kdb: Use format-strings rather than '\0' injection in kdb_read() kdb: Fix console handling when editing and tab-completing commands kdb: Merge identical case statements in kdb_read() kdb: Use format-specifiers rather than memset() for padding in kdb_read() net: fix __dst_negative_advice() race xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING sparc: move struct termio to asm/termios.h ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() s390/ap: Fix crash in AP internal function modify_bitmap() nfs: fix undefined behavior in nfs_block_bits() Linux 5.4.278 Change-Id: I0cdcfac77f01b25b5790752b68d92f1eafaa9ddd Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-06-18 14:18:49 +00:00
Carlos Llamas	e4daa1a1ff	binder: fix max_thread type inconsistency ... commit 42316941335644a98335f209daafa4c122f28983 upstream. The type defined for the BINDER_SET_MAX_THREADS ioctl was changed from size_t to __u32 in order to avoid incompatibility issues between 32 and 64-bit kernels. However, the internal types used to copy from user and store the value were never updated. Use u32 to fix the inconsistency. Fixes: a9350fc859 ("staging: android: binder: fix BINDER_SET_MAX_THREADS declaration") Reported-by: Arve Hjønnevåg <arve@android.com> Cc: stable@vger.kernel.org Signed-off-by: Carlos Llamas <cmllamas@google.com> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Link: https://lore.kernel.org/r/20240421173750.3117808-1-cmllamas@google.com [cmllamas: resolve minor conflicts due to missing commit 421518a2740f] Signed-off-by: Carlos Llamas <cmllamas@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2024-06-16 13:28:48 +02:00
Greg Kroah-Hartman	65d8957031	This is the 5.4.275 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmYzoYAACgkQONu9yGCS aT5Gog/8DiBn13NgIqTvlQucOpiKcQrFS6ghuLjWUj+H+toaBPCoiAaSNzDgk3a6 Vc7aW+/H6035Wpt6qmA9nr9VljS4JgHRlxPbp442zcXoaQabxXstt80s05EgC+ue MamCnirQwtkSaHYTQDHwumyr+J73b/EM6w0MHinmKJKbmLOpF6ejt87bBN8i1i4N 0/atD79jq6l3wOIwNpJI5hIdc/OwNKnCd0M1lQL60XQgN+4Yc5Gup/BazSnVzTHN PvkyqJOPSHcOcTkaDsS6t6RRJ5fQcHDihEPILwQuyqDbasyVULaNWxuZjVUeXbIS rcgrlPTsJB1KjtZuGSkSCmj3FrmBBhs9Fd2HBEGE2UfShJa1c4O/Hbmq3sHvijUQ i8Oaakkx0Z4XKiXf5djwG0QNm4vT8M+nBDNTxw+/pzWg2L0uzlpVh87YwODsrtT2 /WHQ0B1MFXncCDebweXqlxTWKRCoqR183MjMedDJt25smCKp1RZZR7pJb9c065Mn bg2benOfKUr/+Us5oiQboV3XZkZiPc39V/E6J9NjYE62EPht6Gb/yoblFKp9t+/f 8MYPXqyAjGGXIzkqD7e1+YyOH6N/96EOZ2TrLhZiMb/3W6+dCjc1YeFtquNmaN9b pdYhzG3qlneflRNTz/30YKIyMQE5Zv+1DMR2mpBSD4hvSEYCmE4= =yaox -----END PGP SIGNATURE----- Merge 5.4.275 into android11-5.4-lts Changes in 5.4.275 batman-adv: Avoid infinite loop trying to resize local TT Bluetooth: Fix memory leak in hci_req_sync_complete() nouveau: fix function cast warning net: openvswitch: fix unwanted error log on timeout policy probing u64_stats: fix u64_stats_init() for lockdep when used repeatedly in one file geneve: fix header validation in geneve[6]_xmit_skb ipv6: fib: hide unused 'pn' variable ipv4/route: avoid unused-but-set-variable warning ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr net/mlx5: Properly link new fs rules into the tree af_unix: Do not use atomic ops for unix_sk(sk)->inflight. af_unix: Fix garbage collector racing against connect() net: ena: Fix potential sign extension issue btrfs: qgroup: correctly model root qgroup rsv in convert drm/client: Fully protect modes[] with dev->mode_config.mutex vhost: Add smp_rmb() in vhost_vq_avail_empty() selftests: timers: Fix abs() warning in posix_timers test x86/apic: Force native_apic_mem_read() to use the MOV instruction btrfs: record delayed inode root in transaction selftests/ftrace: Limit length in subsystem-enable tests kprobes: Fix possible use-after-free issue on kprobe registration Revert "tracing/trigger: Fix to return error if failed to alloc snapshot" netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() tun: limit printing rate when illegal packet received by tun dev RDMA/rxe: Fix the problem "mutex_destroy missing" RDMA/mlx5: Fix port number for counter query in multi-port configuration drm: nv04: Fix out of bounds access clk: Remove prepare_lock hold assertion in __clk_release() clk: Mark 'all_lists' as const clk: remove extra empty line clk: Print an info line before disabling unused clocks clk: Initialize struct clk_core kref earlier clk: Get runtime PM before walking tree during disable_unused x86/cpufeatures: Fix dependencies for GFNI, VAES, and VPCLMULQDQ binder: check offset alignment in binder_get_object() comedi: vmk80xx: fix incomplete endpoint checking serial/pmac_zilog: Remove flawed mitigation for rx irq flood USB: serial: option: add Fibocom FM135-GL variants USB: serial: option: add support for Fibocom FM650/FG650 USB: serial: option: add Lonsung U8300/U9300 product USB: serial: option: support Quectel EM060K sub-models USB: serial: option: add Rolling RW101-GL and RW135-GL support USB: serial: option: add Telit FN920C04 rmnet compositions Revert "usb: cdc-wdm: close race between read and workqueue" usb: dwc2: host: Fix dereference issue in DDMA completion flow. usb: Disable USB3 LPM at shutdown speakup: Avoid crash on very long word fs: sysfs: Fix reference leak in sysfs_break_active_protection() nouveau: fix instmem race condition around ptr stores nilfs2: fix OOB in nilfs_set_de_type KVM: async_pf: Cleanup kvm_setup_async_pf() arm64: dts: rockchip: fix alphabetical ordering RK3399 puma arm64: dts: rockchip: enable internal pull-up on PCIE_WAKE# for RK3399 Puma arm64: dts: mediatek: mt7622: fix IR nodename arm64: dts: mediatek: mt7622: fix ethernet controller "compatible" arm64: dts: mediatek: mt7622: drop "reset-names" from thermal block arm64: dts: mt2712: add ethernet device node arm64: dts: mediatek: mt2712: fix validation errors ARC: [plat-hsdk]: Remove misplaced interrupt-cells property vxlan: drop packets from invalid src-address mlxsw: core: Unregister EMAD trap using FORWARD action NFC: trf7970a: disable all regulators on removal net: usb: ax88179_178a: stop lying about skb->truesize net: gtp: Fix Use-After-Free in gtp_dellink ipvs: Fix checksumming on GSO of SCTP packets net: openvswitch: Fix Use-After-Free in ovs_ct_exit mlxsw: spectrum_acl_tcam: Fix race during rehash delayed work mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash mlxsw: spectrum_acl_tcam: Rate limit error message mlxsw: spectrum_acl_tcam: Fix memory leak during rehash mlxsw: spectrum_acl_tcam: Fix warning during rehash mlxsw: spectrum_acl_tcam: Fix incorrect list API usage mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work i40e: Do not use WQ_MEM_RECLAIM flag for workqueue iavf: Fix TC config comparison with existing adapter TC config af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc(). serial: core: Provide port lock wrappers serial: mxs-auart: add spinlock around changing cts state drm/amdgpu: restrict bo mapping within gpu address limits amdgpu: validate offset_in_bo of drm_amdgpu_gem_va drm/amdgpu: validate the parameters of bo mapping operations more clearly Revert "crypto: api - Disallow identical driver names" net/mlx5e: Fix a race in command alloc flow tracing: Show size of requested perf buffer tracing: Increase PERF_MAX_TRACE_SIZE to handle Sentinel1 and docker together Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old() Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0bda:0x4853 btrfs: fix information leak in btrfs_ioctl_logical_to_ino() arm64: dts: rockchip: enable internal pull-up for Q7_THRM# on RK3399 Puma drm/amdgpu: Fix leak when GPU memory allocation fails irqchip/gic-v3-its: Prevent double free on error ethernet: Add helper for assigning packet type when dest address does not match device address net: b44: set pause params only when interface is up stackdepot: respect __GFP_NOLOCKDEP allocation flag mtd: diskonchip: work around ubsan link failure tcp: Clean up kernel listener's reqsk in inet_twsk_purge() tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge() dmaengine: owl: fix register access functions idma64: Don't try to serve interrupts when device is powered off i2c: smbus: fix NULL function pointer dereference HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up bounds: Use the right number of bits for power-of-two CONFIG_NR_CPUS dm: limit the number of targets and parameter size area udp: preserve the connected status if only UDP cmsg serial: core: fix kernel-doc for uart_port_unlock_irqrestore() Linux 5.4.275 Change-Id: I0ebcbc604c4ef7fb2b1ce4d7a530f57e27a74cb6 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-05-15 16:00:38 +00:00
Carlos Llamas	68a28f551e	binder: check offset alignment in binder_get_object() ... commit aaef73821a3b0194a01bd23ca77774f704a04d40 upstream. Commit 6d98eb95b450 ("binder: avoid potential data leakage when copying txn") introduced changes to how binder objects are copied. In doing so, it unintentionally removed an offset alignment check done through calls to binder_alloc_copy_from_buffer() -> check_buffer(). These calls were replaced in binder_get_object() with copy_from_user(), so now an explicit offset alignment check is needed here. This avoids later complications when unwinding the objects gets harder. It is worth noting this check existed prior to commit 7a67a39320 ("binder: add function to copy binder object from buffer"), likely removed due to redundancy at the time. Fixes: 6d98eb95b450 ("binder: avoid potential data leakage when copying txn") Cc: stable@vger.kernel.org Signed-off-by: Carlos Llamas <cmllamas@google.com> Acked-by: Todd Kjos <tkjos@google.com> Link: https://lore.kernel.org/r/20240330190115.1877819-1-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2024-05-02 16:18:31 +02:00
Greg Kroah-Hartman	806fb883ea	This is the 5.4.269 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmXYSHgACgkQONu9yGCS aT74ag/6AqWJBzK/2xvUCYjfBU5+4ApFWQt47Ly9MKFhFX7YBjQGXS6av1YFA9Kw i01R9SCpIv2eaDrM7/J0wvXGybemfvQ8VyNngG30QC/0jTc4ZAj0PEbtyHpUaz4F HWOFfAlHAYcLQWhmjhXitoGUfeyhchWnQZpn45mkT0i3DSAEFc5gsiMlO+jaM8No hOaAHEpGsd7zlH32NYpWrFI0i54HSCwlaHlQFJ7U+rbWyG935RdLjMAX+488R8oc KccOj+xb4zQyASdC7qdgPz02U7Tm3UB5s0lLrviDiBrYVxSe77vw2TBEeejF+7ZE oYqjsygRYmRbKuI55rxyxph7cT93ZctL48DZJ4fT4zVIT9kak3S/NtFs0Hyr3TkY N6ZlDnd10cj8QsnXXtTd9QgT7Ind+3KySv7sr4a/gLO/N39EYpztrMCc/lKfG/Bu MPDMXBrEtKkjMelcnISwac9QcOb/MAJaepCWtYgcXbEcaBP+/Or8OM0yZPOEk7SA 3CamE+ou0Ds/c6gnsBw6WDMTJd+sX6sw6+4cMEaWzaWiE12Ryc0gscCDJXjEAYzc +47PiPijNJ+iPjsos8ZaNnTQHALemgJ4cjolHivsEvAYU1s5cyKjVEgMB1MJN8ib y19D9L8T9BtG2ukWBxtIXMIt51VZ7B8fXodcYXbyqtV25JZj/k8= =cJfu -----END PGP SIGNATURE----- Merge 5.4.269 into android11-5.4-lts Changes in 5.4.269 PCI: mediatek: Clear interrupt status before dispatching handler include/linux/units.h: add helpers for kelvin to/from Celsius conversion units: Add Watt units units: change from 'L' to 'UL' units: add the HZ macros serial: sc16is7xx: set safe default SPI clock frequency spi: introduce SPI_MODE_X_MASK macro serial: sc16is7xx: add check for unsupported SPI modes during probe ext4: allow for the last group to be marked as trimmed crypto: api - Disallow identical driver names PM: hibernate: Enforce ordering during image compression/decompression hwrng: core - Fix page fault dead lock on mmap-ed hwrng rpmsg: virtio: Free driver_override when rpmsg_remove() parisc/firmware: Fix F-extend for PDC addresses arm64: dts: qcom: sdm845: fix USB wakeup interrupt types mmc: core: Use mrq.sbc in close-ended ffu nouveau/vmm: don't set addr on the fail path to avoid warning ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path rename(): fix the locking of subdirectories block: Remove special-casing of compound pages mtd: spinand: macronix: Fix MX35LFxGE4AD page size fs: add mode_strip_sgid() helper fs: move S_ISGID stripping into the vfs_*() helpers powerpc: Use always instead of always-y in for crtsavres.o x86/CPU/AMD: Fix disabling XSAVES on AMD family 0x17 due to erratum net/smc: fix illegal rmb_desc access in SMC-D connection dump vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING llc: make llc_ui_sendmsg() more robust against bonding changes llc: Drop support for ETH_P_TR_802_2. net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv tracing: Ensure visibility when inserting an element into tracing_map afs: Hide silly-rename files from userspace tcp: Add memory barrier to tcp_push() netlink: fix potential sleeping issue in mqueue_flush_file net/mlx5: DR, Use the right GVMI number for drop action net/mlx5: Use kfree(ft->g) in arfs_create_groups() net/mlx5e: fix a double-free in arfs_create_groups netfilter: nf_tables: restrict anonymous set and map names to 16 bytes netfilter: nf_tables: validate NFPROTO_* family fjes: fix memleaks in fjes_hw_setup net: fec: fix the unhandled context fault from smmu btrfs: ref-verify: free ref cache before clearing mount opt btrfs: tree-checker: fix inline ref size in error messages btrfs: don't warn if discard range is not aligned to sector btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args rbd: don't move requests to the running list on errors netfilter: nf_tables: reject QUEUE/DROP verdict parameters gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-04 drm: Don't unref the same fb many times by mistake due to deadlock handling drm/bridge: nxp-ptn3460: fix i2c_master_send() error checking drm/bridge: nxp-ptn3460: simplify some error checking drm/exynos: fix accidental on-stack copy of exynos_drm_plane drm/exynos: gsc: minor fix for loop iteration in gsc_runtime_resume gpio: eic-sprd: Clear interrupt after set the interrupt type spi: bcm-qspi: fix SFDP BFPT read by usig mspi read mips: Call lose_fpu(0) before initializing fcr31 in mips_set_personality_nan tick/sched: Preserve number of idle sleeps across CPU hotplug events x86/entry/ia32: Ensure s32 is sign extended to s64 powerpc/mm: Fix null-pointer dereference in pgtable_cache_add powerpc: Fix build error due to is_valid_bugaddr() powerpc/mm: Fix build failures due to arch_reserved_kernel_pages() powerpc: pmd_move_must_withdraw() is only needed for CONFIG_TRANSPARENT_HUGEPAGE powerpc/lib: Validate size for vector operations x86/mce: Mark fatal MCE's page as poison to avoid panic in the kdump kernel perf/core: Fix narrow startup race when creating the perf nr_addr_filters sysfs file regulator: core: Only increment use_count when enable_count changes audit: Send netlink ACK before setting connection in auditd_set ACPI: video: Add quirk for the Colorful X15 AT 23 Laptop PNP: ACPI: fix fortify warning ACPI: extlog: fix NULL pointer dereference check FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree UBSAN: array-index-out-of-bounds in dtSplitRoot jfs: fix slab-out-of-bounds Read in dtSearch jfs: fix array-index-out-of-bounds in dbAdjTree jfs: fix uaf in jfs_evict_inode pstore/ram: Fix crash when setting number of cpus to an odd number crypto: stm32/crc32 - fix parsing list of devices afs: fix the usage of read_seqbegin_or_lock() in afs_find_server*() rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock() jfs: fix array-index-out-of-bounds in diNewExt s390/ptrace: handle setting of fpc register correctly KVM: s390: fix setting of fpc register SUNRPC: Fix a suspicious RCU usage warning ecryptfs: Reject casefold directory inodes ext4: fix inconsistent between segment fstrim and full fstrim ext4: unify the type of flexbg_size to unsigned int ext4: remove unnecessary check from alloc_flex_gd() ext4: avoid online resizing failures due to oversized flex bg wifi: rt2x00: restart beacon queue when hardware reset selftests/bpf: satisfy compiler by having explicit return in btf test selftests/bpf: Fix pyperf180 compilation failure with clang18 scsi: lpfc: Fix possible file string name overflow when updating firmware PCI: Add no PM reset quirk for NVIDIA Spectrum devices bonding: return -ENOMEM instead of BUG in alb_upper_dev_walk ARM: dts: imx7d: Fix coresight funnel ports ARM: dts: imx7s: Fix lcdif compatible ARM: dts: imx7s: Fix nand-controller #size-cells wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() bpf: Add map and need_defer parameters to .map_fd_put_ptr() scsi: libfc: Don't schedule abort twice scsi: libfc: Fix up timeout error in fc_fcp_rec_error() ARM: dts: rockchip: fix rk3036 hdmi ports node ARM: dts: imx25/27-eukrea: Fix RTC node name ARM: dts: imx: Use flash@0,0 pattern ARM: dts: imx27: Fix sram node ARM: dts: imx1: Fix sram node ARM: dts: imx25/27: Pass timing0 ARM: dts: imx27-apf27dev: Fix LED name ARM: dts: imx23-sansa: Use preferred i2c-gpios properties ARM: dts: imx23/28: Fix the DMA controller node name block: prevent an integer overflow in bvec_try_merge_hw_page md: Whenassemble the array, consult the superblock of the freshest device arm64: dts: qcom: msm8996: Fix 'in-ports' is a required property arm64: dts: qcom: msm8998: Fix 'out-ports' is a required property wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift() wifi: cfg80211: free beacon_ies when overridden from hidden BSS f2fs: fix to check return value of f2fs_reserve_new_block() ASoC: doc: Fix undefined SND_SOC_DAPM_NOPM argument fast_dput(): handle underflows gracefully RDMA/IPoIB: Fix error code return in ipoib_mcast_join drm/drm_file: fix use of uninitialized variable drm/framebuffer: Fix use of uninitialized variable drm/mipi-dsi: Fix detach call without attach media: stk1160: Fixed high volume of stk1160_dbg messages media: rockchip: rga: fix swizzling for RGB formats PCI: add INTEL_HDA_ARL to pci_ids.h ALSA: hda: Intel: add HDA_ARL PCI ID support drm/exynos: Call drm_atomic_helper_shutdown() at shutdown/unbind time IB/ipoib: Fix mcast list locking media: ddbridge: fix an error code problem in ddb_probe drm/msm/dpu: Ratelimit framedone timeout msgs clk: hi3620: Fix memory leak in hi3620_mmc_clk_init() clk: mmp: pxa168: Fix memory leak in pxa168_clk_init() drm/amdgpu: Let KFD sync with VM fences drm/amdgpu: Drop 'fence' check in 'to_amdgpu_amdkfd_fence()' leds: trigger: panic: Don't register panic notifier if creating the trigger failed um: Fix naming clash between UML and scheduler um: Don't use vfprintf() for os_info() um: net: Fix return type of uml_net_start_xmit() i3c: master: cdns: Update maximum prescaler value for i2c clock mfd: ti_am335x_tscadc: Fix TI SoC dependencies PCI: Only override AMD USB controller if required PCI: switchtec: Fix stdev_release() crash after surprise hot remove usb: hub: Replace hardcoded quirk value with BIT() macro fs/kernfs/dir: obey S_ISGID PCI/AER: Decode Requester ID when no error info found libsubcmd: Fix memory leak in uniq() virtio_net: Fix "‘%d’ directive writing between 1 and 11 bytes into a region of size 10" warnings blk-mq: fix IO hang from sbitmap wakeup race ceph: fix deadlock or deadcode of misusing dget() drm/amdgpu: Release 'adev->pm.fw' before return in 'amdgpu_device_need_post()' perf: Fix the nr_addr_filters fix wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update scsi: isci: Fix an error code problem in isci_io_request_build() net: remove unneeded break ixgbe: Remove non-inclusive language ixgbe: Refactor returning internal error codes ixgbe: Refactor overtemp event handling ixgbe: Fix an error handling path in ixgbe_read_iosf_sb_reg_x550() ipv6: Ensure natural alignment of const ipv6 loopback and router addresses llc: call sock_orphan() at release time netfilter: nf_log: replace BUG_ON by WARN_ON_ONCE when putting logger netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations net: ipv4: fix a memleak in ip_setup_cork af_unix: fix lockdep positive in sk_diag_dump_icons() net: sysfs: Fix /sys/class/net/<iface> path HID: apple: Add support for the 2021 Magic Keyboard HID: apple: Swap the Fn and Left Control keys on Apple keyboards HID: apple: Add 2021 magic keyboard FN key mapping bonding: remove print in bond_verify_device_path dmaengine: fsl-qdma: Fix a memory leak related to the status queue DMA dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA phy: renesas: rcar-gen3-usb2: Fix returning wrong error code dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP net: stmmac: xgmac: fix handling of DPP safety error for DMA channels selftests: net: avoid just another constant wait atm: idt77252: fix a memleak in open_card_ubr0 hwmon: (aspeed-pwm-tacho) mutex for tach reading hwmon: (coretemp) Fix out-of-bounds memory access hwmon: (coretemp) Fix bogus core_id to attr name mapping inet: read sk->sk_family once in inet_recv_error() rxrpc: Fix response to PING RESPONSE ACKs to a dead call tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() ppp_async: limit MRU to 64K netfilter: nft_compat: reject unused compat flag netfilter: nft_compat: restrict match/target protocol to u16 netfilter: nft_ct: reject direction for ct id net/af_iucv: clean up a try_then_request_module() USB: serial: qcserial: add new usb-id for Dell Wireless DW5826e USB: serial: option: add Fibocom FM101-GL variant USB: serial: cp210x: add ID for IMST iM871A-USB hrtimer: Report offline hrtimer enqueue Input: atkbd - skip ATKBD_CMD_SETLEDS when skipping ATKBD_CMD_GETID vhost: use kzalloc() instead of kmalloc() followed by memset() net: stmmac: xgmac: use #define for string constants net: stmmac: xgmac: fix a typo of register name in DPP safety handling netfilter: nft_set_rbtree: skip end interval element from gc btrfs: forbid creating subvol qgroups btrfs: forbid deleting live subvol qgroup btrfs: send: return EOPNOTSUPP on unknown flags of: unittest: add overlay gpio test to catch gpio hog problem of: unittest: Fix compile in the non-dynamic case spi: ppc4xx: Drop write-only variable ASoC: rt5645: Fix deadlock in rt5645_jack_detect_work() MIPS: Add 'memory' clobber to csum_ipv6_magic() inline assembler i40e: Fix waiting for queues of all VSIs to be disabled tracing/trigger: Fix to return error if failed to alloc snapshot mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again HID: wacom: generic: Avoid reporting a serial of '0' to userspace HID: wacom: Do not register input devices until after hid_hw_start USB: hub: check for alternate port before enabling A_ALT_HNP_SUPPORT usb: f_mass_storage: forbid async queue when shutdown happen i2c: i801: Remove i801_set_block_buffer_mode i2c: i801: Fix block process call transactions scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock" firewire: core: correct documentation of fw_csr_string() kernel API kbuild: Fix changing ELF file type for output of gen_btf for big endian nfc: nci: free rx_data_reassembly skb on NCI device cleanup xen-netback: properly sync TX responses ALSA: hda/realtek: Enable headset mic on Vaio VJFE-ADL binder: signal epoll threads of self-work misc: fastrpc: Mark all sessions as invalid in cb_remove ext4: fix double-free of blocks due to wrong extents moved_len tracing: Fix wasted memory in saved_cmdlines logic staging: iio: ad5933: fix type mismatch regression iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC ring-buffer: Clean ring_buffer_poll_wait() error return serial: max310x: set default value when reading clock ready bit serial: max310x: improve crystal stable clock detection x86/Kconfig: Transmeta Crusoe is CPU family 5, not 6 x86/mm/ident_map: Use gbpages only where full GB page should be mapped. mmc: slot-gpio: Allow non-sleeping GPIO ro ALSA: hda/conexant: Add quirk for SWS JS201D nilfs2: fix data corruption in dsync block recovery for small block sizes nilfs2: fix hang in nilfs_lookup_dirty_data_buffers() nfp: use correct macro for LengthSelect in BAR config nfp: flower: prevent re-adding mac index for bonded port irqchip/irq-brcmstb-l2: Add write memory barrier before exit can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER) pmdomain: core: Move the unused cleanup to a _sync initcall tracing: Inform kmemleak of saved_cmdlines allocation Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d" bus: moxtet: Add spi device table arch, mm: remove stale mentions of DISCONIGMEM mips: Fix max_mapnr being uninitialized on early stages KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache netfilter: ipset: fix performance regression in swap operation netfilter: ipset: Missing gc cancellations fixed net: prevent mss overflow in skb_segment() sched/membarrier: reduce the ability to hammer on sys_membarrier nilfs2: fix potential bug in end_buffer_async_write PM: runtime: add devm_pm_runtime_enable helper PM: runtime: Have devm_pm_runtime_enable() handle pm_runtime_dont_use_autosuspend() drm/msm/dsi: Enable runtime PM lsm: new security_file_ioctl_compat() hook netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval() Revert "Revert "mtd: rawnand: gpmi: Fix setting busy timeout setting"" net: bcmgenet: Fix EEE implementation of: unittest: fix EXPECT text for gpio hog errors of: gpio unittest kfree() wrong object Linux 5.4.269 Change-Id: Iedabcdbe95a83593f102e237f2a80d2fc7206669 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-02-24 15:47:08 +00:00
Carlos Llamas	42beab162d	binder: signal epoll threads of self-work ... commit 97830f3c3088638ff90b20dfba2eb4d487bf14d7 upstream. In (e)poll mode, threads often depend on I/O events to determine when data is ready for consumption. Within binder, a thread may initiate a command via BINDER_WRITE_READ without a read buffer and then make use of epoll_wait() or similar to consume any responses afterwards. It is then crucial that epoll threads are signaled via wakeup when they queue their own work. Otherwise, they risk waiting indefinitely for an event leaving their work unhandled. What is worse, subsequent commands won't trigger a wakeup either as the thread has pending work. Fixes: 457b9a6f09 ("Staging: android: add binder driver") Cc: Arve Hjønnevåg <arve@android.com> Cc: Martijn Coenen <maco@android.com> Cc: Alice Ryhl <aliceryhl@google.com> Cc: Steven Moreland <smoreland@google.com> Cc: stable@vger.kernel.org # v4.19+ Signed-off-by: Carlos Llamas <cmllamas@google.com> Link: https://lore.kernel.org/r/20240131215347.1808751-1-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2024-02-23 08:25:11 +01:00
Greg Kroah-Hartman	74299cb130	This is the 5.4.268 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmWy4hYACgkQONu9yGCS aT7SVBAAyx1DlSyJWcqzpESH0+VfqyWHxXlKS6Ip5wT0/+t0gglIKkwU/O0FsRXw pLO24wL0+MuIzgfZZj7wieAOPlGLOonKAvvUHGEMlpfAzyKjmZuW93WLKQlA/Oec uaT2ooQevRQcgXzbuV1yN/CeCnhbtmiQdcwy6OU5QACfzguQYtDbNGpbVHJEyEIW khlr+tj1KgRMzh/Sx76RPg4C/hkZBHun3tPcE0lTg+5QZDSkUj5gEdhVOSG2qmSh Lj9zt/isY3v6Whixel9YoTLr9SukI7ZlKzMrH1kSbGtTW3uZqgqB+7wCi1tWoNE1 Zwu9/kUe1dU1kfwYW8AA5OwupjBjADVnZZx1cKN3nQZG2J8bSKHwHmuZPx3DGhJ1 sxlaQ0nGvcEbCKljlIqsHzx2U22YKk939mVz5Y+MZYT5uwWRHI+iH4yRW97putSP t8tb3uX69Gsl6B+gLu38Mr7kkwyY06xmMnc5dfNCPwh8SxLj3dG7Gft90CNq1JKT q2cwlMEcDZRlC08kwzD7pRehZ6hYLRlTOv8yhQsQefcfzrtsT18Cec5TI2k72NOe fbIY8us3Qsr8JVSYuObGqT8LmkX9pkmRozEXgENvwltijEsWULoO2Hs+Z/yD07z8 RYqtxWxVxFVeHTkrXbbMUTZWhFx5LE+rtxCySpfeFkv0WgRRwa8= =vkKq -----END PGP SIGNATURE----- Merge 5.4.268 into android11-5.4-lts Changes in 5.4.268 f2fs: explicitly null-terminate the xattr list pinctrl: lochnagar: Don't build on MIPS ALSA: hda - Fix speaker and headset mic pin config for CHUWI CoreBook XPro ASoC: Intel: Skylake: Fix mem leak in few functions ASoC: nau8822: Fix incorrect type in assignment and cast to restricted __be16 ASoC: Intel: Skylake: mem leak in skl register function ASoC: cs43130: Fix the position of const qualifier ASoC: cs43130: Fix incorrect frame delay configuration ASoC: rt5650: add mutex to avoid the jack detection failure nouveau/tu102: flush all pdbs on vmm flush net/tg3: fix race condition in tg3_reset_task() ASoC: da7219: Support low DC impedance headset nvme: introduce helper function to get ctrl state drm/exynos: fix a potential error pointer dereference drm/exynos: fix a wrong error checking clk: rockchip: rk3128: Fix HCLK_OTG gate register jbd2: correct the printing of write_flags in jbd2_write_superblock() drm/crtc: Fix uninit-value bug in drm_mode_setcrtc neighbour: Don't let neigh_forced_gc() disable preemption for long tracing: Have large events show up as '[LINE TOO BIG]' instead of nothing tracing: Add size check when printing trace_marker output ring-buffer: Do not record in NMI if the arch does not support cmpxchg in NMI reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning Input: atkbd - skip ATKBD_CMD_GETID in translated mode Input: i8042 - add nomux quirk for Acer P459-G2-M s390/scm: fix virtual vs physical address confusion ARC: fix spare error Input: xpad - add Razer Wolverine V2 support ida: Fix crash in ida_free when the bitmap is empty ARM: sun9i: smp: fix return code check of of_property_match_string drm/crtc: fix uninitialized variable use ACPI: resource: Add another DMI match for the TongFang GMxXGxx binder: use EPOLLERR from eventpoll.h binder: fix trivial typo of binder_free_buf_locked() binder: fix comment on binder_alloc_new_buf() return value uio: Fix use-after-free in uio_open parport: parport_serial: Add Brainboxes BAR details parport: parport_serial: Add Brainboxes device IDs and geometry coresight: etm4x: Fix width of CCITMIN field x86/lib: Fix overflow when counting digits EDAC/thunderx: Fix possible out-of-bounds string access powerpc: add crtsavres.o to always-y instead of extra-y powerpc/44x: select I2C for CURRITUCK powerpc/pseries/memhotplug: Quieten some DLPAR operations powerpc/pseries/memhp: Fix access beyond end of drmem array selftests/powerpc: Fix error handling in FPU/VMX preemption tests powerpc/powernv: Add a null pointer check to scom_debug_init_one() powerpc/powernv: Add a null pointer check in opal_event_init() powerpc/powernv: Add a null pointer check in opal_powercap_init() powerpc/imc-pmu: Add a null pointer check in update_events_in_group() mtd: rawnand: Increment IFC_TIMEOUT_MSECS for nand controller response ACPI: video: check for error while searching for backlight device parent ACPI: LPIT: Avoid u32 multiplication overflow net: netlabel: Fix kerneldoc warnings netlabel: remove unused parameter in netlbl_netlink_auditinfo() calipso: fix memory leak in netlbl_calipso_add_pass() spi: sh-msiof: Enforce fixed DTDL for R-Car H3 mtd: Fix gluebi NULL pointer dereference caused by ftl notifier selinux: Fix error priority for bind with AF_UNSPEC on PF_INET6 socket crypto: virtio - Handle dataq logic with tasklet crypto: virtio - don't use 'default m' virtio_crypto: Introduce VIRTIO_CRYPTO_NOSPC crypto: ccp - fix memleak in ccp_init_dm_workarea crypto: af_alg - Disallow multiple in-flight AIO requests crypto: sahara - remove FLAGS_NEW_KEY logic crypto: sahara - fix ahash selftest failure crypto: sahara - fix processing requests with cryptlen < sg->length crypto: sahara - fix error handling in sahara_hw_descriptor_create() pstore: ram_core: fix possible overflow in persistent_ram_init_ecc() gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump crypto: virtio - Wait for tasklet to complete on device remove crypto: sahara - fix ahash reqsize crypto: sahara - fix wait_for_completion_timeout() error handling crypto: sahara - improve error handling in sahara_sha_process() crypto: sahara - fix processing hash requests with req->nbytes < sg->length crypto: sahara - do not resize req->src when doing hash operations crypto: scomp - fix req->dst buffer overflow blocklayoutdriver: Fix reference leak of pnfs_device_node NFSv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT wifi: rtw88: fix RX filter in FIF_ALLMULTI flag bpf, lpm: Fix check prefixlen before walking trie wifi: libertas: stop selecting wext ARM: dts: qcom: apq8064: correct XOADC register address ncsi: internal.h: Fix a spello net/ncsi: Fix netlink major/minor version numbers firmware: ti_sci: Fix an off-by-one in ti_sci_debugfs_create() rtlwifi: Use ffs in <foo>_phy_calculate_bit_shift wifi: rtlwifi: rtl8821ae: phy: fix an undefined bitwise shift behavior scsi: fnic: Return error if vmalloc() failed arm64: dts: qcom: sdm845-db845c: correct LED panic indicator scsi: hisi_sas: Replace with standard error code return value selftests/net: fix grep checking for fib_nexthop_multiprefix virtio/vsock: fix logic which reduces credit update messages dma-mapping: clear dev->dma_mem to NULL after freeing it wifi: rtlwifi: add calculate_bit_shift() wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift() wifi: rtlwifi: rtl8192c: using calculate_bit_shift() wifi: rtlwifi: rtl8192cu: using calculate_bit_shift() wifi: rtlwifi: rtl8192ce: using calculate_bit_shift() rtlwifi: rtl8192de: make arrays static const, makes object smaller wifi: rtlwifi: rtl8192de: using calculate_bit_shift() wifi: rtlwifi: rtl8192ee: using calculate_bit_shift() wifi: rtlwifi: rtl8192se: using calculate_bit_shift() netfilter: nf_tables: mark newset as dead on transaction abort Bluetooth: Fix bogus check for re-auth no supported with non-ssp Bluetooth: btmtkuart: fix recv_buf() return value ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() ARM: davinci: always select CONFIG_CPU_ARM926T RDMA/usnic: Silence uninitialized symbol smatch warnings media: pvrusb2: fix use after free on context disconnection drm/bridge: Fix typo in post_disable() description f2fs: fix to avoid dirent corruption drm/radeon/r600_cs: Fix possible int overflows in r600_cs_check_reg() drm/radeon/r100: Fix integer overflow issues in r100_cs_track_check() drm/radeon: check return value of radeon_ring_lock() ASoC: cs35l33: Fix GPIO name and drop legacy include ASoC: cs35l34: Fix GPIO name and drop legacy include drm/msm/mdp4: flush vblank event on disable drm/msm/dsi: Use pm_runtime_resume_and_get to prevent refcnt leaks drm/drv: propagate errors from drm_modeset_register_all() drm/radeon: check the alloc_workqueue return value in radeon_crtc_init() drm/radeon/dpm: fix a memleak in sumo_parse_power_table drm/radeon/trinity_dpm: fix a memleak in trinity_parse_power_table drm/bridge: tc358767: Fix return value on error case media: cx231xx: fix a memleak in cx231xx_init_isoc media: dvbdev: drop refcount on error path in dvb_device_open() drm/amdgpu/debugfs: fix error code when smc register accessors are NULL drm/amd/pm: fix a double-free in si_dpm_init drivers/amd/pm: fix a use-after-free in kv_parse_power_table gpu/drm/radeon: fix two memleaks in radeon_vm_init drivers: clk: zynqmp: calculate closest mux rate watchdog: set cdev owner before adding watchdog/hpwdt: Only claim UNKNOWN NMI if from iLO watchdog: bcm2835_wdt: Fix WDIOC_SETTIMEOUT handling clk: si5341: fix an error code problem in si5341_output_clk_set_rate mmc: sdhci_omap: Fix TI SoC dependencies of: Fix double free in of_parse_phandle_with_args_map of: unittest: Fix of_count_phandle_with_args() expected value message binder: fix async space check for 0-sized buffers binder: fix use-after-free in shinker's callback Input: atkbd - use ab83 as id when skipping the getid command Revert "ASoC: atmel: Remove system clock tree configuration for at91sam9g20ek" xen-netback: don't produce zero-size SKB frags binder: fix race between mmput() and do_exit() binder: fix unused alloc->free_async_space tick-sched: Fix idle and iowait sleeptime accounting vs CPU hotplug usb: phy: mxs: remove CONFIG_USB_OTG condition for mxs_phy_is_otg_host() usb: dwc: ep0: Update request status in dwc3_ep0_stall_restart Revert "usb: dwc3: Soft reset phy on probe for host" Revert "usb: dwc3: don't reset device side if dwc3 was configured as host-only" usb: chipidea: wait controller resume finished for wakeup irq Revert "usb: typec: class: fix typec_altmode_put_partner to put plugs" usb: typec: class: fix typec_altmode_put_partner to put plugs usb: mon: Fix atomicity violation in mon_bin_vma_fault ALSA: oxygen: Fix right channel of capture volume mixer fbdev: flush deferred work in fb_deferred_io_fsync() rootfs: Fix support for rootfstype= when root= is given wifi: rtlwifi: Remove bogus and dangerous ASPM disable/enable code wifi: rtlwifi: Convert LNKCTL change to PCIe cap RMW accessors wifi: mwifiex: configure BSSID consistently when starting AP x86/kvm: Do not try to disable kvmclock if it was not enabled HID: wacom: Correct behavior when processing some confidence == false touches mips: Fix incorrect max_low_pfn adjustment MIPS: Alchemy: Fix an out-of-bound access in db1200_dev_setup() MIPS: Alchemy: Fix an out-of-bound access in db1550_dev_setup() serial: 8250: omap: Don't skip resource freeing if pm_runtime_resume_and_get() failed acpi: property: Let args be NULL in __acpi_node_get_property_reference software node: Let args be NULL in software_node_get_reference_args perf genelf: Set ELF program header addresses properly nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length nvmet-tcp: fix a crash in nvmet_req_complete() perf env: Add perf_env__numa_node() perf record: Move sb_evlist to 'struct record' perf top: Move sb_evlist to 'struct perf_top' perf bpf: Decouple creating the evlist from adding the SB event perf env: Avoid recursively taking env->bpf_progs.lock apparmor: avoid crash when parsed profile name is empty serial: imx: Correct clock error message in function probe() nvmet-tcp: Fix the H2C expected PDU len calculation PCI: keystone: Fix race condition when initializing PHYs s390/pci: fix max size calculation in zpci_memcpy_toio() net: qualcomm: rmnet: fix global oob in rmnet_policy net: phy: micrel: populate .soft_reset for KSZ9131 net: ravb: Fix dma_addr_t truncation in error case net: dsa: vsc73xx: Add null pointer check to vsc73xx_gpio_probe netfilter: nf_tables: skip dead set elements in netlink dump ipvs: avoid stat macros calls from preemptible context kdb: Censor attempts to set PROMPT without ENABLE_MEM_READ kdb: Fix a potential buffer overflow in kdb_local() mlxsw: spectrum_acl_erp: Fix error flow of pool allocation failure i2c: s3c24xx: fix read transfers in polling mode i2c: s3c24xx: fix transferring more than one message in polling mode perf top: Skip side-band event setup if HAVE_LIBBPF_SUPPORT is not set arm64: dts: armada-3720-turris-mox: set irq type for RTC Linux 5.4.268 Change-Id: I347fc44c3a9947e2b7cb476d622adca58677f78a Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-01-26 02:15:05 +00:00
Carlos Llamas	5c3d4930c7	binder: fix unused alloc->free_async_space ... commit c6d05e0762ab276102246d24affd1e116a46aa0c upstream. Each transaction is associated with a 'struct binder_buffer' that stores the metadata about its buffer area. Since commit 74310e06be ("android: binder: Move buffer out of area shared with user space") this struct is no longer embedded within the buffer itself but is instead allocated on the heap to prevent userspace access to this driver-exclusive info. Unfortunately, the space of this struct is still being accounted for in the total buffer size calculation, specifically for async transactions. This results in an additional 104 bytes added to every async buffer request, and this area is never used. This wasted space can be substantial. If we consider the maximum mmap buffer space of SZ_4M, the driver will reserve half of it for async transactions, or 0x200000. This area should, in theory, accommodate up to 262,144 buffers of the minimum 8-byte size. However, after adding the extra 'sizeof(struct binder_buffer)', the total number of buffers drops to only 18,724, which is a sad 7.14% of the actual capacity. This patch fixes the buffer size calculation to enable the utilization of the entire async buffer space. This is expected to reduce the number of -ENOSPC errors that are seen on the field. Fixes: 74310e06be ("android: binder: Move buffer out of area shared with user space") Signed-off-by: Carlos Llamas <cmllamas@google.com> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Link: https://lore.kernel.org/r/20231201172212.1813387-6-cmllamas@google.com [cmllamas: fix trivial conflict with missing 261e7818f06e.] Signed-off-by: Carlos Llamas <cmllamas@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2024-01-25 14:34:29 -08:00
Carlos Llamas	252a2a5569	binder: fix race between mmput() and do_exit() ... commit 9a9ab0d963621d9d12199df9817e66982582d5a5 upstream. Task A calls binder_update_page_range() to allocate and insert pages on a remote address space from Task B. For this, Task A pins the remote mm via mmget_not_zero() first. This can race with Task B do_exit() and the final mmput() refcount decrement will come from Task A. Task A | Task B ------------------+------------------ mmget_not_zero() | | do_exit() | exit_mm() | mmput() mmput() | exit_mmap() | remove_vma() | fput() | In this case, the work of ____fput() from Task B is queued up in Task A as TWA_RESUME. So in theory, Task A returns to userspace and the cleanup work gets executed. However, Task A instead sleep, waiting for a reply from Task B that never comes (it's dead). This means the binder_deferred_release() is blocked until an unrelated binder event forces Task A to go back to userspace. All the associated death notifications will also be delayed until then. In order to fix this use mmput_async() that will schedule the work in the corresponding mm->async_put_work WQ instead of Task A. Fixes: 457b9a6f09 ("Staging: android: add binder driver") Reviewed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Carlos Llamas <cmllamas@google.com> Link: https://lore.kernel.org/r/20231201172212.1813387-4-cmllamas@google.com [cmllamas: fix trivial conflict with missing d8ed45c5dcd4.] Signed-off-by: Carlos Llamas <cmllamas@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2024-01-25 14:34:29 -08:00
Carlos Llamas	a53e15e592	binder: fix use-after-free in shinker's callback ... commit 3f489c2067c5824528212b0fc18b28d51332d906 upstream. The mmap read lock is used during the shrinker's callback, which means that using alloc->vma pointer isn't safe as it can race with munmap(). As of commit dd2283f260 ("mm: mmap: zap pages with read mmap_sem in munmap") the mmap lock is downgraded after the vma has been isolated. I was able to reproduce this issue by manually adding some delays and triggering page reclaiming through the shrinker's debug sysfs. The following KASAN report confirms the UAF: ================================================================== BUG: KASAN: slab-use-after-free in zap_page_range_single+0x470/0x4b8 Read of size 8 at addr ffff356ed50e50f0 by task bash/478 CPU: 1 PID: 478 Comm: bash Not tainted 6.6.0-rc5-00055-g1c8b86a3799f-dirty #70 Hardware name: linux,dummy-virt (DT) Call trace: zap_page_range_single+0x470/0x4b8 binder_alloc_free_page+0x608/0xadc __list_lru_walk_one+0x130/0x3b0 list_lru_walk_node+0xc4/0x22c binder_shrink_scan+0x108/0x1dc shrinker_debugfs_scan_write+0x2b4/0x500 full_proxy_write+0xd4/0x140 vfs_write+0x1ac/0x758 ksys_write+0xf0/0x1dc __arm64_sys_write+0x6c/0x9c Allocated by task 492: kmem_cache_alloc+0x130/0x368 vm_area_alloc+0x2c/0x190 mmap_region+0x258/0x18bc do_mmap+0x694/0xa60 vm_mmap_pgoff+0x170/0x29c ksys_mmap_pgoff+0x290/0x3a0 __arm64_sys_mmap+0xcc/0x144 Freed by task 491: kmem_cache_free+0x17c/0x3c8 vm_area_free_rcu_cb+0x74/0x98 rcu_core+0xa38/0x26d4 rcu_core_si+0x10/0x1c __do_softirq+0x2fc/0xd24 Last potentially related work creation: __call_rcu_common.constprop.0+0x6c/0xba0 call_rcu+0x10/0x1c vm_area_free+0x18/0x24 remove_vma+0xe4/0x118 do_vmi_align_munmap.isra.0+0x718/0xb5c do_vmi_munmap+0xdc/0x1fc __vm_munmap+0x10c/0x278 __arm64_sys_munmap+0x58/0x7c Fix this issue by performing instead a vma_lookup() which will fail to find the vma that was isolated before the mmap lock downgrade. Note that this option has better performance than upgrading to a mmap write lock which would increase contention. Plus, mmap_write_trylock() has been recently removed anyway. Fixes: dd2283f260 ("mm: mmap: zap pages with read mmap_sem in munmap") Cc: stable@vger.kernel.org Cc: Liam Howlett <liam.howlett@oracle.com> Cc: Minchan Kim <minchan@kernel.org> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Carlos Llamas <cmllamas@google.com> Link: https://lore.kernel.org/r/20231201172212.1813387-3-cmllamas@google.com [cmllamas: use find_vma() instead of vma_lookup() as commit ce6d42f2e4a2 is missing in v5.4. This only works because we check the vma against our cached alloc->vma pointer. Also, unlock via up_read() instead of mmap_read_unlock() as commit d8ed45c5dcd4 is also missing in v5.4.] Signed-off-by: Carlos Llamas <cmllamas@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2024-01-25 14:34:29 -08:00
Carlos Llamas	fc1119a3c6	binder: fix async space check for 0-sized buffers ... commit 3091c21d3e9322428691ce0b7a0cfa9c0b239eeb upstream. Move the padding of 0-sized buffers to an earlier stage to account for this round up during the alloc->free_async_space check. Fixes: 74310e06be ("android: binder: Move buffer out of area shared with user space") Reviewed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Carlos Llamas <cmllamas@google.com> Link: https://lore.kernel.org/r/20231201172212.1813387-5-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2024-01-25 14:34:29 -08:00
Carlos Llamas	da488e1aad	binder: fix comment on binder_alloc_new_buf() return value ... commit e1090371e02b601cbfcea175c2a6cc7c955fa830 upstream. Update the comments of binder_alloc_new_buf() to reflect that the return value of the function is now ERR_PTR(-errno) on failure. No functional changes in this patch. Cc: stable@vger.kernel.org Fixes: 57ada2fb22 ("binder: add log information for binder transaction failures") Reviewed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Carlos Llamas <cmllamas@google.com> Link: https://lore.kernel.org/r/20231201172212.1813387-8-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2024-01-25 14:34:21 -08:00
Carlos Llamas	a92b2797ca	binder: fix trivial typo of binder_free_buf_locked() ... commit 122a3c1cb0ff304c2b8934584fcfea4edb2fe5e3 upstream. Fix minor misspelling of the function in the comment section. No functional changes in this patch. Cc: stable@vger.kernel.org Fixes: 0f966cba95c7 ("binder: add flag to clear buffer on txn complete") Reviewed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Carlos Llamas <cmllamas@google.com> Link: https://lore.kernel.org/r/20231201172212.1813387-7-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2024-01-25 14:34:21 -08:00
Carlos Llamas	9774dabad7	binder: use EPOLLERR from eventpoll.h ... commit 6ac061db9c58ca5b9270b1b3940d2464fb3ff183 upstream. Use EPOLLERR instead of POLLERR to make sure it is cast to the correct __poll_t type. This fixes the following sparse issue: drivers/android/binder.c:5030:24: warning: incorrect type in return expression (different base types) drivers/android/binder.c:5030:24: expected restricted __poll_t drivers/android/binder.c:5030:24: got int Fixes: f88982679f ("binder: check for binder_thread allocation failure in binder_poll()") Cc: stable@vger.kernel.org Cc: Eric Biggers <ebiggers@google.com> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Carlos Llamas <cmllamas@google.com> Link: https://lore.kernel.org/r/20231201172212.1813387-2-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2024-01-25 14:34:21 -08:00
Greg Kroah-Hartman	38b412a16c	This is the 5.4.254 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmTc9xQACgkQONu9yGCS aT4VrQ//aeDhl35R4kgB8ZYcv2EHa9DgE+cDkFYIUruQ029jPET1NkMuXMiWys2K trzC5VCAawfac8jHR4kAetP2W6ydHgSQprtUxjgjIwKlPgiFQOla5/DXNqMGTv9Y fFKcIfgpef9OkvPr46LHf1S4i3H8vaVu3pN40gEnIAPu4Rgz3wvbmi6BoSTszThI MrbOu70iRxVxF8+3HR8G3Ja6bly4dTl2Y36P6G+JPAQc8+X9RT1Yv39kiAg7TSzP i/SIn2G5pNu2+BMcxUn0SO13YXPYIGQTZ6xLX13QIDEuoqQRjDB9vZPaKoSm7170 Nh1JjvUXy72/zvDJYJWzbrL/o4AfS2tHBNTUq5loXO4LPvbmg18g3Xysuk6vRBmG NjOpbG9PK3MCwWEQIdEAgtFF6hw74MF/UM7b1Tty3FAaWf4Ca75vY5acqSy4Fhbx KuBnNGZTaRJRCUFeEBtAz8sIeFCclfuSpBhrQzj8zCkDT59PuiWJ7wyW1yAizMtE VNvDJFxdQXtU06AHWJxp9msWiXYBZbFfk75MVTxnZLS3SDJuJ40fDjjGCM4WciMg gBLS+v4tO67KEuhj8t50WJW4Kk7P1Q0j3QkItHOMMRpsJQZF3z8rqEqthAacEaAH hVvB2OxpXicqpHwrFW3DZuxzgfJd6sofaKq85/2I7FullRyXVjg= =6G08 -----END PGP SIGNATURE----- Merge 5.4.254 into android11-5.4-lts Changes in 5.4.254 mmc: moxart: read scr register without changing byte order ipv6: adjust ndisc_is_useropt() to also return true for PIO dmaengine: pl330: Return DMA_PAUSED when transaction is paused drm/nouveau/gr: enable memory loads on helper invocation on all channels radix tree test suite: fix incorrect allocation size for pthreads x86/pkeys: Revert a5eff72597 ("x86/pkeys: Add PKRU value to init_fpstate") nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput iio: cros_ec: Fix the allocation size for cros_ec_command binder: fix memory leak in binder_init() usb-storage: alauda: Fix uninit-value in alauda_check_media() usb: dwc3: Properly handle processing of pending events usb: common: usb-conn-gpio: Prevent bailing out if initial role is none x86/cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405 x86/mm: Fix VDSO and VVAR placement on 5-level paging machines x86: Move gds_ucode_mitigated() declaration to header drm/nouveau/disp: Revert a NULL check inside nouveau_connector_get_modes selftests/rseq: Fix build with undefined __weak mISDN: Update parameter type of dsp_cmx_send() net/packet: annotate data-races around tp->status bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves dccp: fix data-race around dp->dccps_mss_cache drivers: net: prevent tun_build_skb() to exceed the packet size limit IB/hfi1: Fix possible panic during hotplug remove wifi: cfg80211: fix sband iftype data lookup for AP_VLAN dmaengine: mcf-edma: Fix a potential un-allocated memory access net/mlx5: Allow 0 for total host VFs ibmvnic: Handle DMA unmapping of login buffs in release functions btrfs: don't stop integrity writeback too early btrfs: set cache_block_group_error if we find an error nvme-tcp: fix potential unbalanced freeze & unfreeze nvme-rdma: fix potential unbalanced freeze & unfreeze netfilter: nf_tables: report use refcount overflow scsi: core: Fix legacy /proc parsing buffer overflow scsi: storvsc: Fix handling of virtual Fibre Channel timeouts scsi: 53c700: Check that command slot is not NULL scsi: snic: Fix possible memory leak if device_add() fails scsi: core: Fix possible memory leak if device_add() fails alpha: remove __init annotation from exported page_is_ram() sch_netem: fix issues in netem_change() vs get_dist_table() Linux 5.4.254 Change-Id: I187a81acd36ef0ec486a959c626f1f06373170cc Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-08-23 15:06:40 +00:00
Qi Zheng	b97dad01c1	binder: fix memory leak in binder_init() ... commit adb9743d6a08778b78d62d16b4230346d3508986 upstream. In binder_init(), the destruction of binder_alloc_shrinker_init() is not performed in the wrong path, which will cause memory leaks. So this commit introduces binder_alloc_shrinker_exit() and calls it in the wrong path to fix that. Signed-off-by: Qi Zheng <zhengqi.arch@bytedance.com> Acked-by: Carlos Llamas <cmllamas@google.com> Fixes: f2517eb76f ("android: binder: Add global lru shrinker to binder") Cc: stable <stable@kernel.org> Link: https://lore.kernel.org/r/20230625154937.64316-1-qi.zheng@linux.dev Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-08-16 18:19:23 +02:00
Carlos Llamas	6c88024cab	binder: fix UAF caused by faulty buffer cleanup ... commit bdc1c5fac982845a58d28690cdb56db8c88a530d upstream. In binder_transaction_buffer_release() the 'failed_at' offset indicates the number of objects to clean up. However, this function was changed by commit 44d8047f1d ("binder: use standard functions to allocate fds"), to release all the objects in the buffer when 'failed_at' is zero. This introduced an issue when a transaction buffer is released without any objects having been processed so far. In this case, 'failed_at' is indeed zero yet it is misinterpreted as releasing the entire buffer. This leads to use-after-free errors where nodes are incorrectly freed and subsequently accessed. Such is the case in the following KASAN report: ================================================================== BUG: KASAN: slab-use-after-free in binder_thread_read+0xc40/0x1f30 Read of size 8 at addr ffff4faf037cfc58 by task poc/474 CPU: 6 PID: 474 Comm: poc Not tainted 6.3.0-12570-g7df047b3f0aa #5 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x94/0xec show_stack+0x18/0x24 dump_stack_lvl+0x48/0x60 print_report+0xf8/0x5b8 kasan_report+0xb8/0xfc __asan_load8+0x9c/0xb8 binder_thread_read+0xc40/0x1f30 binder_ioctl+0xd9c/0x1768 __arm64_sys_ioctl+0xd4/0x118 invoke_syscall+0x60/0x188 [...] Allocated by task 474: kasan_save_stack+0x3c/0x64 kasan_set_track+0x2c/0x40 kasan_save_alloc_info+0x24/0x34 __kasan_kmalloc+0xb8/0xbc kmalloc_trace+0x48/0x5c binder_new_node+0x3c/0x3a4 binder_transaction+0x2b58/0x36f0 binder_thread_write+0x8e0/0x1b78 binder_ioctl+0x14a0/0x1768 __arm64_sys_ioctl+0xd4/0x118 invoke_syscall+0x60/0x188 [...] Freed by task 475: kasan_save_stack+0x3c/0x64 kasan_set_track+0x2c/0x40 kasan_save_free_info+0x38/0x5c __kasan_slab_free+0xe8/0x154 __kmem_cache_free+0x128/0x2bc kfree+0x58/0x70 binder_dec_node_tmpref+0x178/0x1fc binder_transaction_buffer_release+0x430/0x628 binder_transaction+0x1954/0x36f0 binder_thread_write+0x8e0/0x1b78 binder_ioctl+0x14a0/0x1768 __arm64_sys_ioctl+0xd4/0x118 invoke_syscall+0x60/0x188 [...] ================================================================== In order to avoid these issues, let's always calculate the intended 'failed_at' offset beforehand. This is renamed and wrapped in a helper function to make it clear and convenient. Fixes: 32e9f56a96d8 ("binder: don't detect sender/target during buffer cleanup") Reported-by: Zi Fan Tan <zifantan@google.com> Cc: stable@vger.kernel.org Signed-off-by: Carlos Llamas <cmllamas@google.com> Acked-by: Todd Kjos <tkjos@google.com> Link: https://lore.kernel.org/r/20230505203020.4101154-1-cmllamas@google.com [cmllamas: resolve trivial conflict due to missing commit 9864bb4801331] Signed-off-by: Carlos Llamas <cmllamas@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-06-05 08:17:33 +02:00
Carlos Llamas	6d5e0c7837	FROMLIST: binder: fix UAF caused by faulty buffer cleanup ... In binder_transaction_buffer_release() the 'failed_at' offset indicates the number of objects to clean up. However, this function was changed by commit 44d8047f1d ("binder: use standard functions to allocate fds"), to release all the objects in the buffer when 'failed_at' is zero. This introduced an issue when a transaction buffer is released without any objects having been processed so far. In this case, 'failed_at' is indeed zero yet it is misinterpreted as releasing the entire buffer. This leads to use-after-free errors where nodes are incorrectly freed and subsequently accessed. Such is the case in the following KASAN report: ================================================================== BUG: KASAN: slab-use-after-free in binder_thread_read+0xc40/0x1f30 Read of size 8 at addr ffff4faf037cfc58 by task poc/474 CPU: 6 PID: 474 Comm: poc Not tainted 6.3.0-12570-g7df047b3f0aa #5 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x94/0xec show_stack+0x18/0x24 dump_stack_lvl+0x48/0x60 print_report+0xf8/0x5b8 kasan_report+0xb8/0xfc __asan_load8+0x9c/0xb8 binder_thread_read+0xc40/0x1f30 binder_ioctl+0xd9c/0x1768 __arm64_sys_ioctl+0xd4/0x118 invoke_syscall+0x60/0x188 [...] Allocated by task 474: kasan_save_stack+0x3c/0x64 kasan_set_track+0x2c/0x40 kasan_save_alloc_info+0x24/0x34 __kasan_kmalloc+0xb8/0xbc kmalloc_trace+0x48/0x5c binder_new_node+0x3c/0x3a4 binder_transaction+0x2b58/0x36f0 binder_thread_write+0x8e0/0x1b78 binder_ioctl+0x14a0/0x1768 __arm64_sys_ioctl+0xd4/0x118 invoke_syscall+0x60/0x188 [...] Freed by task 475: kasan_save_stack+0x3c/0x64 kasan_set_track+0x2c/0x40 kasan_save_free_info+0x38/0x5c __kasan_slab_free+0xe8/0x154 __kmem_cache_free+0x128/0x2bc kfree+0x58/0x70 binder_dec_node_tmpref+0x178/0x1fc binder_transaction_buffer_release+0x430/0x628 binder_transaction+0x1954/0x36f0 binder_thread_write+0x8e0/0x1b78 binder_ioctl+0x14a0/0x1768 __arm64_sys_ioctl+0xd4/0x118 invoke_syscall+0x60/0x188 [...] ================================================================== In order to avoid these issues, let's always calculate the intended 'failed_at' offset beforehand. This is renamed and wrapped in a helper function to make it clear and convenient. Fixes: 32e9f56a96d8 ("binder: don't detect sender/target during buffer cleanup") Reported-by: Zi Fan Tan <zifantan@google.com> Link: https://b.corp.google.com/issues/275041864 Cc: stable@vger.kernel.org Signed-off-by: Carlos Llamas <cmllamas@google.com> Bug: 275041864 Link: https://lore.kernel.org/all/20230505203020.4101154-1-cmllamas@google.com Change-Id: I4bcc8bde77a8118872237d100cccb5caf95d99a1 [cmllamas: drop hunk for missing commit 9864bb480133] Signed-off-by: Carlos Llamas <cmllamas@google.com>	2023-05-08 14:22:01 +00:00
Greg Kroah-Hartman	39c4c9c65c	This is the 5.4.226 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmORuw8ACgkQONu9yGCS aT4qeRAAjtp+p7ECcaXqZ4vHIka9IGcwRhjWbeB/xFCOgKKbOOLmZP9Cql1pJdEp grdcp/tjNAwi1ec80+G/3AaAWqGRFHYi/Tboe+ZSHIp4Oot78fSclMp6lCMh/bzC eR6niNNNlrEUC/lj0h5lWRJvQd6MK4orSCOCybeJ+HRmrLcm1pGSuJmssHoBn7Xk JHg3RR5OW4BU4UHQHmcJfeH+J5zfNH0ygu1L3MRqzoINWUJ7PtSrIdR5xCm/4ibr oyOH0nenC3hkOM4atui/92dX3HsNxazuA51Ch0AANFRiKYjJBIXMitapi1BvpqfB Ny1I95j37Tuys4OQhJhNlbvHgxdNmouEHH06SwY8+yaU6LPkrFtdD0AxIDofakBZ Npy9AkYmvj14ARAeyqzswxSQGWuuvlDjJR3dId/kIuP8wcRcNWsrFefHs0YZxhjn o0LKmpkw5QgjW7Gh8TKEdl4saAXZwLXV00gHN9DD6UOr4eYNHtBHUJg6zMN5aR19 Dco+UTJj1NlmlEBDP6pFp9LTAcTsjVh6FVpX+uMRs18+kXS3SxzPgB9qEwjerU5m HA0pzc+BgZqHpu3LhkbC4JfGNJ9fHnVZe6fT6/kTt3SiaEtLx8JKvH6VsCHVgEv6 whY3hlS4bWII8Jey0ZS8BtyKJiku3zfGDXAQ3rpwGbX1ddDn+d8= =qI32 -----END PGP SIGNATURE----- Merge 5.4.226 into android11-5.4-lts Changes in 5.4.226 wifi: mac80211: fix memory free error when registering wiphy fail wifi: mac80211_hwsim: fix debugfs attribute ps with rc table support audit: fix undefined behavior in bit shift for AUDIT_BIT wifi: mac80211: Fix ack frame idr leak when mesh has no route spi: stm32: fix stm32_spi_prepare_mbr() that halves spi clk for every run drm: panel-orientation-quirks: Add quirk for Acer Switch V 10 (SW5-017) block, bfq: fix null pointer dereference in bfq_bio_bfqg() arm64/syscall: Include asm/ptrace.h in syscall_wrapper header. RISC-V: vdso: Do not add missing symbols to version section in linker script MIPS: pic32: treat port as signed integer af_key: Fix send_acquire race with pfkey_register ARM: dts: am335x-pcm-953: Define fixed regulators in root node ASoC: sgtl5000: Reset the CHIP_CLK_CTRL reg on remove regulator: core: fix kobject release warning and memory leak in regulator_register() regulator: core: fix UAF in destroy_regulator() bus: sunxi-rsb: Support atomic transfers tee: optee: fix possible memory leak in optee_register_device() ARM: dts: at91: sam9g20ek: enable udc vbus gpio pinctrl net: liquidio: simplify if expression nfc/nci: fix race with opening and closing net: pch_gbe: fix potential memleak in pch_gbe_tx_queue() 9p/fd: fix issue of list_del corruption in p9_fd_cancel() ARM: mxs: fix memory leak in mxs_machine_init() net/mlx4: Check retval of mlx4_bitmap_init net/qla3xxx: fix potential memleak in ql3xxx_send() net: pch_gbe: fix pci device refcount leak while module exiting nfp: add port from netdev validation for EEPROM access Drivers: hv: vmbus: fix double free in the error path of vmbus_add_channel_work() Drivers: hv: vmbus: fix possible memory leak in vmbus_device_register() net/mlx5: Fix FW tracer timestamp calculation tipc: set con sock in tipc_conn_alloc tipc: add an extra conn_get in tipc_conn_alloc tipc: check skb_linearize() return value in tipc_disc_rcv() xfrm: Fix ignored return value in xfrm6_init() NFC: nci: fix memory leak in nci_rx_data_packet() regulator: twl6030: re-add TWL6032_SUBCLASS bnx2x: fix pci device refcount leak in bnx2x_vf_is_pcie_pending() dccp/tcp: Reset saddr on failure after inet6?_hash_connect(). s390/dasd: fix no record found for raw_track_access nfc: st-nci: fix incorrect validating logic in EVT_TRANSACTION nfc: st-nci: fix memory leaks in EVT_TRANSACTION net: thunderx: Fix the ACPI memory leak s390/crashdump: fix TOD programmable field size lib/vdso: use "grep -E" instead of "egrep" usb: dwc3: exynos: Fix remove() function arm64: dts: rockchip: lower rk3399-puma-haikou SD controller clock frequency iio: light: apds9960: fix wrong register for gesture gain iio: core: Fix entry not deleted when iio_register_sw_trigger_type() fails init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash nios2: add FORCE for vmlinuz.gz iio: ms5611: Simplify IO callback parameters iio: pressure: ms5611: fixed value compensation bug ceph: do not update snapshot context when there is no new snapshot ceph: avoid putting the realm twice when decoding snaps fails firmware: google: Release devices before unregistering the bus firmware: coreboot: Register bus in module init nilfs2: fix nilfs_sufile_mark_dirty() not set segment usage as dirty gcov: clang: fix the buffer overflow issue Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode ASoC: Intel: bytcht_es8316: Add quirk for the Nanote UMPC-01 serial: 8250: 8250_omap: Avoid RS485 RTS glitch on ->set_termios() xen/platform-pci: add missing free_irq() in error path platform/x86: asus-wmi: add missing pci_dev_put() in asus_wmi_set_xusb2pr() platform/x86: acer-wmi: Enable SW_TABLET_MODE on Switch V 10 (SW5-017) platform/x86: hp-wmi: Ignore Smart Experience App event tcp: configurable source port perturb table size net: usb: qmi_wwan: add Telit 0x103a composition dm integrity: flush the journal on suspend binder: avoid potential data leakage when copying txn binder: read pre-translated fds from sender buffer binder: defer copies of pre-patched txn data binder: fix pointer cast warning binder: Address corner cases in deferred copy and fixup binder: Gracefully handle BINDER_TYPE_FDA objects with num_fds=0 btrfs: free btrfs_path before copying root refs to userspace btrfs: free btrfs_path before copying fspath to userspace btrfs: free btrfs_path before copying subvol info to userspace btrfs: sysfs: normalize the error handling branch in btrfs_init_sysfs() drm/amd/dc/dce120: Fix audio register mapping, stop triggering KASAN drm/amdgpu: always register an MMU notifier for userptr drm/i915: fix TLB invalidation for Gen12 video and compute engines fuse: lock inode unconditionally in fuse_fallocate() btrfs: free btrfs_path before copying inodes to userspace spi: spi-imx: Fix spi_bus_clk if requested clock is higher than input clock btrfs: move QUOTA_ENABLED check to rescan_should_stop from btrfs_qgroup_rescan_worker drm/amdgpu: update drm_display_info correctly when the edid is read drm/amdgpu: Partially revert "drm/amdgpu: update drm_display_info correctly when the edid is read" btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() iio: health: afe4403: Fix oob read in afe4403_read_raw iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw iio: light: rpr0521: add missing Kconfig dependencies scripts/faddr2line: Fix regression in name resolution on ppc64le hwmon: (i5500_temp) fix missing pci_disable_device() hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails of: property: decrement node refcount in of_fwnode_get_reference_args() net/mlx5: Fix uninitialized variable bug in outlen_write() net/mlx5e: Fix use-after-free when reverting termination table can: sja1000_isa: sja1000_isa_probe(): add missing free_sja1000dev() can: cc770: cc770_isa_probe(): add missing free_cc770dev() qlcnic: fix sleep-in-atomic-context bugs caused by msleep wifi: cfg80211: fix buffer overflow in elem comparison net: phy: fix null-ptr-deref while probe() failed net: net_netdev: Fix error handling in ntb_netdev_init_module() net/9p: Fix a potential socket leak in p9_socket_open net: ethernet: nixge: fix NULL dereference dsa: lan9303: Correct stat name net: hsr: Fix potential use-after-free afs: Fix fileserver probe RTT handling net: tun: Fix use-after-free in tun_detach() packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE sctp: fix memory leak in sctp_stream_outq_migrate() net: ethernet: renesas: ravb: Fix promiscuous mode after system resumed hwmon: (coretemp) Check for null before removing sysfs attrs hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() net/mlx5: DR, Fix uninitialized var warning error-injection: Add prompt for function error injection tools/vm/slabinfo-gnuplot: use "grep -E" instead of "egrep" nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() x86/bugs: Make sure MSR_SPEC_CTRL is updated properly upon resume from S3 pinctrl: intel: Save and restore pins in "direct IRQ" mode mmc: mmc_test: Fix removal of debugfs file mmc: core: Fix ambiguous TRIM and DISCARD arg mmc: sdhci-esdhc-imx: correct CQHCI exit halt state check mmc: sdhci-sprd: Fix no reset data and command after voltage switch tracing: Free buffers when a used dynamic event is removed arm64: Fix panic() when Spectre-v2 causes Spectre-BHB to re-allocate KVM vectors arm64: errata: Fix KVM Spectre-v2 mitigation selection for Cortex-A57/A72 mm: Fix '.data.once' orphan section warning ASoC: ops: Fix bounds check for _sx controls pinctrl: single: Fix potential division by zero iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() parisc: Increase size of gcc stack frame check xtensa: increase size of gcc stack frame check parisc: Increase FRAME_WARN to 2048 bytes on parisc Kconfig.debug: provide a little extra FRAME_WARN leeway when KASAN is enabled selftests: net: add delete nexthop route warning test selftests: net: fix nexthop warning cleanup double ip typo ipv4: Handle attempt to delete multipath route when fib_info contains an nh reference ipv4: Fix route deletion when nexthop info is not specified tracing/ring-buffer: Have polling block on watermark epoll: call final ep_events_available() check under the lock epoll: check for events when removing a timed out thread from the wait queue nvme: restrict management ioctls to admin nvme: ensure subsystem reset is single threaded x86/tsx: Add a feature bit for TSX control MSR support x86/pm: Add enumeration check before spec MSRs save/restore setup Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM x86/ioremap: Fix page aligned size calculation in __ioremap_caller() Revert "clocksource/drivers/riscv: Events are stopped during CPU suspend" char: tpm: Protect tpm_pm_suspend with locks mmc: sdhci: use FIELD_GET for preset value bit masks mmc: sdhci: Fix voltage switch delay proc: avoid integer type confusion in get_proc_long proc: proc_skip_spaces() shouldn't think it is working on C strings v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() fails ipc/sem: Fix dangling sem_array access in semtimedop race Linux 5.4.226 Change-Id: I20fe6cd332455ffff094b2be6afa8302b20db571 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2022-12-08 16:50:20 +00:00
Alessandro Astone	4741b00cac	binder: Gracefully handle BINDER_TYPE_FDA objects with num_fds=0 ... commit ef38de9217a04c9077629a24652689d8fdb4c6c6 upstream. Some android userspace is sending BINDER_TYPE_FDA objects with num_fds=0. Like the previous patch, this is reproducible when playing a video. Before commit 09184ae9b575 BINDER_TYPE_FDA objects with num_fds=0 were 'correctly handled', as in no fixup was performed. After commit 09184ae9b575 we aggregate fixup and skip regions in binder_ptr_fixup structs and distinguish between the two by using the skip_size field: if it's 0, then it's a fixup, otherwise skip. When processing BINDER_TYPE_FDA objects with num_fds=0 we add a skip region of skip_size=0, and this causes issues because now binder_do_deferred_txn_copies will think this was a fixup region. To address that, return early from binder_translate_fd_array to avoid adding an empty skip region. Fixes: 09184ae9b575 ("binder: defer copies of pre-patched txn data") Acked-by: Todd Kjos <tkjos@google.com> Cc: stable <stable@kernel.org> Signed-off-by: Alessandro Astone <ales.astone@gmail.com> Link: https://lore.kernel.org/r/20220415120015.52684-1-ales.astone@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Carlos Llamas <cmllamas@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-12-08 11:23:01 +01:00
Alessandro Astone	4e682ce560	binder: Address corner cases in deferred copy and fixup ... commit 2d1746e3fda0c3612143d7c06f8e1d1830c13e23 upstream. When handling BINDER_TYPE_FDA object we are pushing a parent fixup with a certain skip_size but no scatter-gather copy object, since the copy is handled standalone. If BINDER_TYPE_FDA is the last children the scatter-gather copy loop will never stop to skip it, thus we are left with an item in the parent fixup list. This will trigger the BUG_ON(). This is reproducible in android when playing a video. We receive a transaction that looks like this: obj[0] BINDER_TYPE_PTR, parent obj[1] BINDER_TYPE_PTR, child obj[2] BINDER_TYPE_PTR, child obj[3] BINDER_TYPE_FDA, child Fixes: 09184ae9b575 ("binder: defer copies of pre-patched txn data") Acked-by: Todd Kjos <tkjos@google.com> Cc: stable <stable@kernel.org> Signed-off-by: Alessandro Astone <ales.astone@gmail.com> Link: https://lore.kernel.org/r/20220415120015.52684-2-ales.astone@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Carlos Llamas <cmllamas@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-12-08 11:23:01 +01:00
Arnd Bergmann	15e098ab1d	binder: fix pointer cast warning ... commit 9a0a930fe2535a76ad70d3f43caeccf0d86a3009 upstream. binder_uintptr_t is not the same as uintptr_t, so converting it into a pointer requires a second cast: drivers/android/binder.c: In function 'binder_translate_fd_array': drivers/android/binder.c:2511:28: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast] 2511 | sender_ufda_base = (void __user *)sender_uparent->buffer + fda->parent_offset; | ^ Fixes: 656e01f3ab54 ("binder: read pre-translated fds from sender buffer") Acked-by: Todd Kjos <tkjos@google.com> Acked-by: Randy Dunlap <rdunlap@infradead.org> # build-tested Acked-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: Arnd Bergmann <arnd@arndb.de> Link: https://lore.kernel.org/r/20211207122448.1185769-1-arnd@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Carlos Llamas <cmllamas@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-12-08 11:23:01 +01:00
Todd Kjos	74e7f1828a	binder: defer copies of pre-patched txn data ... commit 09184ae9b5756cc469db6fd1d1cfdcffbf627c2d upstream. BINDER_TYPE_PTR objects point to memory areas in the source process to be copied into the target buffer as part of a transaction. This implements a scatter- gather model where non-contiguous memory in a source process is "gathered" into a contiguous region in the target buffer. The data can include pointers that must be fixed up to correctly point to the copied data. To avoid making source process pointers visible to the target process, this patch defers the copy until the fixups are known and then copies and fixeups are done together. There is a special case of BINDER_TYPE_FDA which applies the fixup later in the target process context. In this case the user data is skipped (so no untranslated fds become visible to the target). Reviewed-by: Martijn Coenen <maco@android.com> Signed-off-by: Todd Kjos <tkjos@google.com> Link: https://lore.kernel.org/r/20211130185152.437403-5-tkjos@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> [cmllamas: fix trivial merge conflict] Signed-off-by: Carlos Llamas <cmllamas@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-12-08 11:23:01 +01:00
Todd Kjos	7b31ab0d9e	binder: read pre-translated fds from sender buffer ... commit 656e01f3ab54afe71bed066996fc2640881e1220 upstream. This patch is to prepare for an up coming patch where we read pre-translated fds from the sender buffer and translate them before copying them to the target. It does not change run time. The patch adds two new parameters to binder_translate_fd_array() to hold the sender buffer and sender buffer parent. These parameters let us call copy_from_user() directly from the sender instead of using binder_alloc_copy_from_buffer() to copy from the target. Also the patch adds some new alignment checks. Previously the alignment checks would have been done in a different place, but this lets us print more useful error messages. Reviewed-by: Martijn Coenen <maco@android.com> Acked-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: Todd Kjos <tkjos@google.com> Link: https://lore.kernel.org/r/20211130185152.437403-4-tkjos@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Carlos Llamas <cmllamas@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-12-08 11:23:01 +01:00
Todd Kjos	c056a6ba35	binder: avoid potential data leakage when copying txn ... commit 6d98eb95b450a75adb4516a1d33652dc78d2b20c upstream. Transactions are copied from the sender to the target first and objects like BINDER_TYPE_PTR and BINDER_TYPE_FDA are then fixed up. This means there is a short period where the sender's version of these objects are visible to the target prior to the fixups. Instead of copying all of the data first, copy data only after any needed fixups have been applied. Fixes: 457b9a6f09 ("Staging: android: add binder driver") Reviewed-by: Martijn Coenen <maco@android.com> Acked-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: Todd Kjos <tkjos@google.com> Link: https://lore.kernel.org/r/20211130185152.437403-3-tkjos@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> [cmllamas: fix trivial merge conflict] Signed-off-by: Carlos Llamas <cmllamas@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-12-08 11:23:01 +01:00
Greg Kroah-Hartman	0bd6dcc07a	This is the 5.4.224 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmNtLZoACgkQONu9yGCS aT5VuQ/8CBRf5xVvPfDAGCXjoksCQWaVvSp4bs8UBRO7OM2bbzLOXgNR/aTXBYXS MmrHn/9vCy1EM/+MvsCF9BB7SBu5DN28/X18H/KvhNBXdSggYYSYiaHDsaU8YS89 PKCQouG9q5qNzMbiVx9ullBUQXNov3PMFs6La0AbRjiSuDnaQhwbhliZmbMWo+Wx YdxqT0PNrPdZsXA4aP6DZP1tHQ7rKt7BFZdDE2UhmMCkrycw3f4bm5nLyOIJgkCq JcnJu7mPbhGxwTVqBEBPH31cH+vC4TxMuRIgm7gmuTcIp883C2rhzYMfNK2aP8j6 5VdG+WZmlqkWJ7ipPGaMgT2el/+40Fy/TlAg+kdUQ7MDT9aLZM9ecv+q7o+qV8qn RxbkqBEUh3byJyx5hR6fmP+6QxF3x7X89QyAmQJ6+2thDhZtrZdM4cGk8AbK534u Pfv0Biu59u1rBHAcY2gFwtUMhPYQYK65liefeQoBFgc83ZQbPYOs3pk3gjPmOyy5 ce2JeyRIqWU9qN3/pxCDO8gVD7uUtMC/ut5fM2IPoatoGBmvpg0iFZLa+TF0PdVe U7+v6uakW86sWYzHdNLMXIaghzO3i04BVokOKoFHjP8WQeOaYBk5uUOP/qWS+Dke cSOhayYj7UALVAQww34mAWlPFN6l5sfW2GszN9a2GcfT1sLphDY= =bOv2 -----END PGP SIGNATURE----- Merge 5.4.224 into android11-5.4-lts Changes in 5.4.224 RDMA/cma: Use output interface for net_dev check IB/hfi1: Correctly move list in sc_disable() NFSv4.1: Handle RECLAIM_COMPLETE trunking errors NFSv4.1: We must always send RECLAIM_COMPLETE after a reboot nfs4: Fix kmemleak when allocate slot failed net: dsa: Fix possible memory leaks in dsa_loop_init() RDMA/core: Fix null-ptr-deref in ib_core_cleanup() RDMA/qedr: clean up work queue on failure in qedr_alloc_resources() nfc: s3fwrn5: Fix potential memory leak in s3fwrn5_nci_send() nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send() net: fec: fix improper use of NETDEV_TX_BUSY ata: pata_legacy: fix pdc20230_set_piomode() net: sched: Fix use after free in red_enqueue() net: tun: fix bugs for oversize packet when napi frags enabled netfilter: nf_tables: release flow rule object from commit path ipvs: use explicitly signed chars ipvs: fix WARNING in __ip_vs_cleanup_batch() ipvs: fix WARNING in ip_vs_app_net_cleanup() rose: Fix NULL pointer dereference in rose_send_frame() mISDN: fix possible memory leak in mISDN_register_device() isdn: mISDN: netjet: fix wrong check of device registration btrfs: fix inode list leak during backref walking at resolve_indirect_refs() btrfs: fix inode list leak during backref walking at find_parent_nodes() btrfs: fix ulist leaks in error paths of qgroup self tests Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del() net: mdio: fix undefined behavior in bit shift for __mdiobus_register net, neigh: Fix null-ptr-deref in neigh_table_clear() ipv6: fix WARNING in ip6_route_net_exit_late() media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE media: cros-ec-cec: limit msg.len to CEC_MAX_MSG_SIZE media: dvb-frontends/drxk: initialize err to 0 media: meson: vdec: fix possible refcount leak in vdec_probe() scsi: core: Restrict legal sdev_state transitions via sysfs HID: saitek: add madcatz variant of MMO7 mouse device ID i2c: xiic: Add platform module alias xfs: don't fail verifier on empty attr3 leaf block xfs: use ordered buffers to initialize dquot buffers during quotacheck xfs: gut error handling in xfs_trans_unreserve_and_mod_sb() xfs: group quota should return EDQUOT when prj quota enabled xfs: don't fail unwritten extent conversion on writeback due to edquot xfs: Add the missed xfs_perag_put() for xfs_ifree_cluster() Bluetooth: L2CAP: Fix attempting to access uninitialized memory block, bfq: protect 'bfqd->queued' by 'bfqd->lock' tcp/udp: Fix memory leak in ipv6_renew_options(). memcg: enable accounting of ipc resources binder: fix UAF of alloc->vma in race with munmap() btrfs: fix type of parameter generation in btrfs_get_dentry tcp/udp: Make early_demux back namespacified. kprobe: reverse kp->flags when arm_kprobe failed tools/nolibc/string: Fix memcmp() implementation tracing/histogram: Update document for KEYS_MAX size capabilities: fix potential memleak on error path from vfs_getxattr_alloc() fuse: add file_modified() to fallocate efi: random: reduce seed size to 32 bytes perf/x86/intel: Fix pebs event constraints for ICL perf/x86/intel: Add Cooper Lake stepping to isolation_ucodes[] ALSA: usb-audio: Add quirks for MacroSilicon MS2100/MS2106 devices parisc: Make 8250_gsc driver dependend on CONFIG_PARISC parisc: Export iosapic_serial_irq() symbol for serial port driver parisc: Avoid printing the hardware path twice ext4: fix warning in 'ext4_da_release_space' ext4: fix BUG_ON() when directory entry has invalid rec_len KVM: x86: Mask off reserved bits in CPUID.8000001AH KVM: x86: Mask off reserved bits in CPUID.80000008H KVM: x86: emulator: em_sysexit should update ctxt->mode KVM: x86: emulator: introduce emulator_recalc_and_set_mode KVM: x86: emulator: update the emulation mode after CR0 write mtd: rawnand: gpmi: Set WAIT_FOR_READY timeout based on program/erase times drm/rockchip: dsi: Force synchronous probe drm/i915/sdvo: Filter out invalid outputs more sensibly drm/i915/sdvo: Setup DDC fully before output init wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker() ipc: remove memcg accounting for sops objects in do_semtimedop() Linux 5.4.224 Change-Id: I4620eca3873c24ff6e810a762a0977bae99dcaeb Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2022-11-16 16:18:17 +00:00
Carlos Llamas	27a594bc7a	binder: fix UAF of alloc->vma in race with munmap() ... In commit 720c241924 ("ANDROID: binder: change down_write to down_read") binder assumed the mmap read lock is sufficient to protect alloc->vma inside binder_update_page_range(). This used to be accurate until commit dd2283f260 ("mm: mmap: zap pages with read mmap_sem in munmap"), which now downgrades the mmap_lock after detaching the vma from the rbtree in munmap(). Then it proceeds to teardown and free the vma with only the read lock held. This means that accesses to alloc->vma in binder_update_page_range() now will race with vm_area_free() in munmap() and can cause a UAF as shown in the following KASAN trace: ================================================================== BUG: KASAN: use-after-free in vm_insert_page+0x7c/0x1f0 Read of size 8 at addr ffff16204ad00600 by task server/558 CPU: 3 PID: 558 Comm: server Not tainted 5.10.150-00001-gdc8dcf942daa #1 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x0/0x2a0 show_stack+0x18/0x2c dump_stack+0xf8/0x164 print_address_description.constprop.0+0x9c/0x538 kasan_report+0x120/0x200 __asan_load8+0xa0/0xc4 vm_insert_page+0x7c/0x1f0 binder_update_page_range+0x278/0x50c binder_alloc_new_buf+0x3f0/0xba0 binder_transaction+0x64c/0x3040 binder_thread_write+0x924/0x2020 binder_ioctl+0x1610/0x2e5c __arm64_sys_ioctl+0xd4/0x120 el0_svc_common.constprop.0+0xac/0x270 do_el0_svc+0x38/0xa0 el0_svc+0x1c/0x2c el0_sync_handler+0xe8/0x114 el0_sync+0x180/0x1c0 Allocated by task 559: kasan_save_stack+0x38/0x6c __kasan_kmalloc.constprop.0+0xe4/0xf0 kasan_slab_alloc+0x18/0x2c kmem_cache_alloc+0x1b0/0x2d0 vm_area_alloc+0x28/0x94 mmap_region+0x378/0x920 do_mmap+0x3f0/0x600 vm_mmap_pgoff+0x150/0x17c ksys_mmap_pgoff+0x284/0x2dc __arm64_sys_mmap+0x84/0xa4 el0_svc_common.constprop.0+0xac/0x270 do_el0_svc+0x38/0xa0 el0_svc+0x1c/0x2c el0_sync_handler+0xe8/0x114 el0_sync+0x180/0x1c0 Freed by task 560: kasan_save_stack+0x38/0x6c kasan_set_track+0x28/0x40 kasan_set_free_info+0x24/0x4c __kasan_slab_free+0x100/0x164 kasan_slab_free+0x14/0x20 kmem_cache_free+0xc4/0x34c vm_area_free+0x1c/0x2c remove_vma+0x7c/0x94 __do_munmap+0x358/0x710 __vm_munmap+0xbc/0x130 __arm64_sys_munmap+0x4c/0x64 el0_svc_common.constprop.0+0xac/0x270 do_el0_svc+0x38/0xa0 el0_svc+0x1c/0x2c el0_sync_handler+0xe8/0x114 el0_sync+0x180/0x1c0 [...] ================================================================== To prevent the race above, revert back to taking the mmap write lock inside binder_update_page_range(). One might expect an increase of mmap lock contention. However, binder already serializes these calls via top level alloc->mutex. Also, there was no performance impact shown when running the binder benchmark tests. Note this patch is specific to stable branches 5.4 and 5.10. Since in newer kernel releases binder no longer caches a pointer to the vma. Instead, it has been refactored to use vma_lookup() which avoids the issue described here. This switch was introduced in commit a43cfc87caaf ("android: binder: stop saving a pointer to the VMA"). Fixes: dd2283f260 ("mm: mmap: zap pages with read mmap_sem in munmap") Reported-by: Jann Horn <jannh@google.com> Cc: <stable@vger.kernel.org> # 5.4.x Cc: Minchan Kim <minchan@kernel.org> Cc: Yang Shi <yang.shi@linux.alibaba.com> Cc: Liam Howlett <liam.howlett@oracle.com> Signed-off-by: Carlos Llamas <cmllamas@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-11-10 17:57:54 +01:00
Carlos Llamas	30d0901b30	binder: fix UAF of ref->proc caused by race condition ... commit a0e44c64b6061dda7e00b7c458e4523e2331b739 upstream. A transaction of type BINDER_TYPE_WEAK_HANDLE can fail to increment the reference for a node. In this case, the target proc normally releases the failed reference upon close as expected. However, if the target is dying in parallel the call will race with binder_deferred_release(), so the target could have released all of its references by now leaving the cleanup of the new failed reference unhandled. The transaction then ends and the target proc gets released making the ref->proc now a dangling pointer. Later on, ref->node is closed and we attempt to take spin_lock(&ref->proc->inner_lock), which leads to the use-after-free bug reported below. Let's fix this by cleaning up the failed reference on the spot instead of relying on the target to do so. ================================================================== BUG: KASAN: use-after-free in _raw_spin_lock+0xa8/0x150 Write of size 4 at addr ffff5ca207094238 by task kworker/1:0/590 CPU: 1 PID: 590 Comm: kworker/1:0 Not tainted 5.19.0-rc8 #10 Hardware name: linux,dummy-virt (DT) Workqueue: events binder_deferred_func Call trace: dump_backtrace.part.0+0x1d0/0x1e0 show_stack+0x18/0x70 dump_stack_lvl+0x68/0x84 print_report+0x2e4/0x61c kasan_report+0xa4/0x110 kasan_check_range+0xfc/0x1a4 __kasan_check_write+0x3c/0x50 _raw_spin_lock+0xa8/0x150 binder_deferred_func+0x5e0/0x9b0 process_one_work+0x38c/0x5f0 worker_thread+0x9c/0x694 kthread+0x188/0x190 ret_from_fork+0x10/0x20 Acked-by: Christian Brauner (Microsoft) <brauner@kernel.org> Signed-off-by: Carlos Llamas <cmllamas@google.com> Cc: stable <stable@kernel.org> # 4.14+ Link: https://lore.kernel.org/r/20220801182511.3371447-1-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-09-15 12:04:51 +02:00
Pavel Begunkov	fc78b2fc21	io_uring: disable polling pollfree files ... Older kernels lack io_uring POLLFREE handling. As only affected files are signalfd and android binder the safest option would be to disable polling those files via io_uring and hope there are no users. Fixes: 221c5eb233 ("io_uring: add support for IORING_OP_POLL") Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-09-05 10:27:47 +02:00
Carlos Llamas	012ab662e2	ANDROID: binder: fix pending prio state for early exit ... When calling binder_do_set_priority() with the same policy and priority values as the current task, we exit early since there is nothing to do. However, the BINDER_PRIO_PENDING state might be set and in this case we fail to update it. A subsequent call to binder_transaction_priority() will then read an incorrect state and save the wrong priority. Fix this by setting thread->prio_state to BINDER_PRIO_SET on our way out. Bug: 199309216 Fixes: cac827f2619b ("ANDROID: binder: fix race in priority restore") Signed-off-by: Carlos Llamas <cmllamas@google.com> Change-Id: I21e906cf4b2ebee908af41fe101ecd458ae1991c (cherry picked from commit 72193be6d4bd9ad29dacd998c14dff97f7a6c6c9)	2022-08-03 16:21:47 +00:00
Carlos Llamas	da97a10882	ANDROID: binder: fix race in priority restore ... During a reply, the target gets woken up and then the priority of the replier is restored. The order is such to allow the target to process the reply ASAP. Otherwise, we risk the sender getting scheduled out before the wakeup happens. This strategy reduces transaction latency. However, a subsequent transaction from the same target could be started before the priority of the replier gets restored. At this point we save the wrong priority and it gets reinstated at the end of the transaction. This patch allows the incoming transaction to detect the race condition and save the correct next priority. Additionally, the replier will abort its pending priority restore which allows the new transaction to always run at the desired priority. Bug: 148101660 Signed-off-by: Carlos Llamas <cmllamas@google.com> Change-Id: I6fec41ae1a1342023f78212ab1f984e26f068221 (cherry picked from commit cac827f2619b280d418e546a09f25da600dafe5a) [cmllamas: fixed trivial merge conflict]	2022-08-03 16:21:47 +00:00
Carlos Llamas	308230b9d7	ANDROID: binder: switch task argument for binder_thread ... Refactor binder priority functions to take in 'struct binder_thread *' instead of just 'struct task_struct *'. This allows access to other thread fields used in subsequent patches. In any case, the same task reference is still available under thread->task. There is no functional impact from this patch. Bug: 148101660 Signed-off-by: Carlos Llamas <cmllamas@google.com> Change-Id: I67b599884580d957d776500e467827e5035c99f6 (cherry picked from commit 759d98484b5b51932d3d11651fa83c6bb268ce03)	2022-08-03 16:21:47 +00:00
Carlos Llamas	807b6742c9	ANDROID: binder: pass desired priority by reference ... Avoid making unnecessary stack copies of struct binder_priority and pass the argument by reference instead. Rename 'desired_prio' to 'desired' to match the usage in other priority functions. There is no functional impact from this patch. Bug: 148101660 Signed-off-by: Carlos Llamas <cmllamas@google.com> Change-Id: I66ff5305296e7b9dba56ed265236f2af518f66e0 (cherry picked from commit 52d85f8a16467ce0bca374f885de24918f017371) [cmllamas: fixed minor merge conflict]	2022-08-03 16:21:47 +00:00
Carlos Llamas	88c3fd6461	ANDROID: binder: fold common setup of node_prio ... The setup of node_prio is always the same, so just fold this logic into binder_transaction_priority() to avoid duplication. Let's pass the node reference instead, which also gives access to node->inherit_rt. There is no functional impact from this patch. Bug: 148101660 Signed-off-by: Carlos Llamas <cmllamas@google.com> Change-Id: Ib390204556e69c4bc8492cd9cd873773f9cdce42 (cherry picked from commit 498bf715b77c68e54d0289fa66e3f112278f87dc) [cmllamas: fixed minor merge conflicts]	2022-08-03 16:21:47 +00:00
Carlos Llamas	458b37a82d	FROMLIST: binder: fix UAF of ref->proc caused by race condition ... A transaction of type BINDER_TYPE_WEAK_HANDLE can fail to increment the reference for a node. In this case, the target proc normally releases the failed reference upon close as expected. However, if the target is dying in parallel the call will race with binder_deferred_release(), so the target could have released all of its references by now leaving the cleanup of the new failed reference unhandled. The transaction then ends and the target proc gets released making the ref->proc now a dangling pointer. Later on, ref->node is closed and we attempt to take spin_lock(&ref->proc->inner_lock), which leads to the use-after-free bug reported below. Let's fix this by cleaning up the failed reference on the spot instead of relying on the target to do so. ================================================================== BUG: KASAN: use-after-free in _raw_spin_lock+0xa8/0x150 Write of size 4 at addr ffff5ca207094238 by task kworker/1:0/590 CPU: 1 PID: 590 Comm: kworker/1:0 Not tainted 5.19.0-rc8 #10 Hardware name: linux,dummy-virt (DT) Workqueue: events binder_deferred_func Call trace: dump_backtrace.part.0+0x1d0/0x1e0 show_stack+0x18/0x70 dump_stack_lvl+0x68/0x84 print_report+0x2e4/0x61c kasan_report+0xa4/0x110 kasan_check_range+0xfc/0x1a4 __kasan_check_write+0x3c/0x50 _raw_spin_lock+0xa8/0x150 binder_deferred_func+0x5e0/0x9b0 process_one_work+0x38c/0x5f0 worker_thread+0x9c/0x694 kthread+0x188/0x190 ret_from_fork+0x10/0x20 Signed-off-by: Carlos Llamas <cmllamas@google.com> Acked-by: Christian Brauner (Microsoft) <brauner@kernel.org> Bug: 239630375 Link: https://lore.kernel.org/all/20220801182511.3371447-1-cmllamas@google.com/ Signed-off-by: Carlos Llamas <cmllamas@google.com> Change-Id: I5085dd0dc805a780a64c057e5819f82dd8f02868 (cherry picked from commit ae3fa5d16a02ba7c7b170e0e1ab56d6f0ba33964)	2022-08-02 22:15:29 +00:00
Greg Kroah-Hartman	82b6e1787f	Merge branch 'android11-5.4' into 'android11-5.4-lts' ... Sync up with android11-5.4 for the following commits: 617c7432b5 ANDROID: GKI: Enable CONFIG_SERIAL_8250_RUNTIME_UARTS=0 813b12454e ANDROID: GKI: db845c: Update symbols list and ABI 15dd5a8bc0 ANDROID: Increase x86 cmdline size to 4k 4ec7ffac46 UPSTREAM: cgroup-v1: Require capabilities to set release_agent fe0c18d0f0 ANDROID: incremental-fs: remove index and incomplete dir on umount 7aedba616c UPSTREAM: binder: fix async_free_space accounting for empty parcels f1a1171f3c UPSTREAM: tee: handle lookup of shm with reference count 0 693158f765 UPSTREAM: bpf: Fix integer overflow in argument calculation for bpf_map_area_alloc b9d179c605 UPSTREAM: driver core: Fix possible memory leak in device_link_add() 3aeff14796 UPSTREAM: blk-mq: fix kernel panic during iterating over flush request 54e1868c8b UPSTREAM: net: xfrm: fix memory leak in xfrm_user_rcv_msg a4e84758f0 UPSTREAM: binder: fix the missing BR_FROZEN_REPLY in binder_return_strings 013b7ed754 ANDROID: incremental-fs: fix mount_fs issue ba4942c83d Merge tag 'android11-5.4.161_r00' into android11-5.4 202bc8432c UPSTREAM: vfs: fs_context: fix up param length parsing in legacy_parse_param New symbols tracked due to them being added in the android11-5.4 branch: Leaf changes summary: 1 artifact changed Changed leaf types summary: 0 leaf type changed Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 1 Added function Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variable 1 Added function: [A] 'function void kill_anon_super(super_block*)' Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I89df6d21c7c36bb6b2a9047b1f7e2988f48a5637	2022-02-11 16:21:49 +01:00
Todd Kjos	7aedba616c	UPSTREAM: binder: fix async_free_space accounting for empty parcels ... commit cfd0d84ba28c18b531648c9d4a35ecca89ad9901 upstream. In 4.13, commit 74310e06be ("android: binder: Move buffer out of area shared with user space") fixed a kernel structure visibility issue. As part of that patch, sizeof(void *) was used as the buffer size for 0-length data payloads so the driver could detect abusive clients sending 0-length asynchronous transactions to a server by enforcing limits on async_free_size. Unfortunately, on the "free" side, the accounting of async_free_space did not add the sizeof(void *) back. The result was that up to 8-bytes of async_free_space were leaked on every async transaction of 8-bytes or less. These small transactions are uncommon, so this accounting issue has gone undetected for several years. The fix is to use "buffer_size" (the allocated buffer size) instead of "size" (the logical buffer size) when updating the async_free_space during the free operation. These are the same except for this corner case of asynchronous transactions with payloads < 8 bytes. Fixes: 74310e06be ("android: binder: Move buffer out of area shared with user space") Signed-off-by: Todd Kjos <tkjos@google.com> Cc: stable@vger.kernel.org # 4.14+ Link: https://lore.kernel.org/r/20211220190150.2107077-1-tkjos@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Change-Id: Ie01082a056bff56f51035c0f6be34e136bd56faf	2022-01-31 14:15:02 -08:00
Greg Kroah-Hartman	b3174205cf	This is the 5.4.174 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmHyVbEACgkQONu9yGCS aT6r6BAA13mGwb3g/n6W1539J2McTd3Wq7HhkvGnOQmJAHJKLzp51QYAXgLbRLCM gUOCPXh6o2gt3+lFrhFy0TE9F1VQY7Igyb2RziF9mdAcvEqcBXL11n6kZHGxx0TO rOpv/SoWMd/QrKC7Ytf5zgH+81dGYWr1L1Ge9g7KWmCev15zAvJQ4mQv6a8CQhCD pUZRBvFx8AGS6q/s9ZPZfvVBcHJDNF89/mkkWNzFgIOcXJh/01JdqNK635stUXu4 +hQYUpG2gj9X2i+e0bc2i95pql7M5OAdX3TBlMeiEjKkyXJuyWTCXSO332QLTeaP xF8Z6JQ0n4W4GI9AgQCWwOaDahtlh6rmpVj+iekeYOMMB6Y5zAoFOIu1DTBEwDK6 F+s5KGfV8t5zkWY6iFOUwHTsjeNc4qqX8B6Br3Yjo7HHBxiggNDD5k4IYe0wAvJL NzOTjdvVbG+qRmhGMQMOpLhDJaHVEJCaXCmv1G97AceaL/RcenUZkn3pQZbn5O7u iMFV620WB0tYyfsiWaQrC7HgVZRyoUYBcxuxdm/g8NqYAPM61HOBKQbyaG9jClyf dq+lnvipJzUmeTsrzkd0NON24HS53hYBZPQjxp7xuoFooBUQjd5iYJvPzeLUm2+g /PlDC4B48pZa3zm8z2amyxf7leaxZUqc2d/J8wSGM/lvaJ3BV7M= =eMMF -----END PGP SIGNATURE----- Merge 5.4.174 into android11-5.4-lts Changes in 5.4.174 HID: uhid: Fix worker destroying device without any protection HID: wacom: Reset expected and received contact counts at the same time HID: wacom: Ignore the confidence flag when a touch is removed HID: wacom: Avoid using stale array indicies to read contact count f2fs: fix to do sanity check in is_alive() nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind() mtd: rawnand: gpmi: Add ERR007117 protection for nfc_apply_timings mtd: rawnand: gpmi: Remove explicit default gpmi clock setting for i.MX6 x86/gpu: Reserve stolen memory for first integrated Intel GPU tools/nolibc: x86-64: Fix startup code bug tools/nolibc: i386: fix initial stack alignment tools/nolibc: fix incorrect truncation of exit code rtc: cmos: take rtc_lock while reading from CMOS media: v4l2-ioctl.c: readbuffers depends on V4L2_CAP_READWRITE media: flexcop-usb: fix control-message timeouts media: mceusb: fix control-message timeouts media: em28xx: fix control-message timeouts media: cpia2: fix control-message timeouts media: s2255: fix control-message timeouts media: dib0700: fix undefined behavior in tuner shutdown media: redrat3: fix control-message timeouts media: pvrusb2: fix control-message timeouts media: stk1160: fix control-message timeouts can: softing_cs: softingcs_probe(): fix memleak on registration failure lkdtm: Fix content of section containing lkdtm_rodata_do_nothing() iommu/io-pgtable-arm-v7s: Add error handle for page table allocation failure dma_fence_array: Fix PENDING_ERROR leak in dma_fence_array_signaled() PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller mm_zone: add function to check if managed dma zone exists mm/page_alloc.c: do not warn allocation failure on zone DMA if no managed pages shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode drm/rockchip: dsi: Hold pm-runtime across bind/unbind drm/rockchip: dsi: Reconfigure hardware on resume() drm/panel: kingdisplay-kd097d04: Delete panel on attach() failure drm/panel: innolux-p079zca: Delete panel on attach() failure drm/rockchip: dsi: Fix unbalanced clock on probe error Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails clk: bcm-2835: Pick the closest clock rate clk: bcm-2835: Remove rounding up the dividers wcn36xx: Indicate beacon not connection loss on MISSED_BEACON_IND wcn36xx: Release DMA channel descriptor allocations media: videobuf2: Fix the size printk format media: aspeed: fix mode-detect always time out at 2nd run media: em28xx: fix memory leak in em28xx_init_dev media: aspeed: Update signal status immediately to ensure sane hw state arm64: dts: meson-gxbb-wetek: fix HDMI in early boot arm64: dts: meson-gxbb-wetek: fix missing GPIO binding Bluetooth: stop proccessing malicious adv data tee: fix put order in teedev_close_context() media: dmxdev: fix UAF when dvb_register_device() fails crypto: qce - fix uaf on qce_ahash_register_one arm64: dts: ti: k3-j721e: correct cache-sets info tty: serial: atmel: Check return code of dmaengine_submit() tty: serial: atmel: Call dma_async_issue_pending() media: rcar-csi2: Correct the selection of hsfreqrange media: imx-pxp: Initialize the spinlock prior to using it media: si470x-i2c: fix possible memory leak in si470x_i2c_probe() media: mtk-vcodec: call v4l2_m2m_ctx_release first when file is released media: venus: core: Fix a resource leak in the error handling path of 'venus_probe()' netfilter: bridge: add support for pppoe filtering arm64: dts: qcom: msm8916: fix MMC controller aliases ACPI: EC: Rework flushing of EC work while suspended to idle drm/amdgpu: Fix a NULL pointer dereference in amdgpu_connector_lcd_native_mode() drm/radeon/radeon_kms: Fix a NULL pointer dereference in radeon_driver_open_kms() arm64: dts: ti: k3-j721e: Fix the L2 cache sets tty: serial: uartlite: allow 64 bit address serial: amba-pl011: do not request memory region twice floppy: Fix hang in watchdog when disk is ejected staging: rtl8192e: return error code from rtllib_softmac_init() staging: rtl8192e: rtllib_module: fix error handle case in alloc_rtllib() Bluetooth: btmtksdio: fix resume failure media: dib8000: Fix a memleak in dib8000_init() media: saa7146: mxb: Fix a NULL pointer dereference in mxb_attach() media: si2157: Fix "warm" tuner state detection sched/rt: Try to restart rt period timer when rt runtime exceeded rcu/exp: Mark current CPU as exp-QS in IPI loop second pass mwifiex: Fix possible ABBA deadlock xfrm: fix a small bug in xfrm_sa_len() crypto: stm32/cryp - fix xts and race condition in crypto_engine requests crypto: stm32/cryp - fix double pm exit crypto: stm32/cryp - fix lrw chaining mode ARM: dts: gemini: NAS4220-B: fis-index-block with 128 KiB sectors media: dw2102: Fix use after free media: msi001: fix possible null-ptr-deref in msi001_probe() media: coda/imx-vdoa: Handle dma_set_coherent_mask error codes drm/msm/dpu: fix safe status debugfs file drm/bridge: ti-sn65dsi86: Set max register for regmap media: hantro: Fix probe func error path xfrm: interface with if_id 0 should return error xfrm: state and policy should fail if XFRMA_IF_ID 0 ARM: 9159/1: decompressor: Avoid UNPREDICTABLE NOP encoding usb: ftdi-elan: fix memory leak on device disconnect ARM: dts: armada-38x: Add generic compatible to UART nodes mmc: meson-mx-sdio: add IRQ check selinux: fix potential memleak in selinux_add_opt() bpftool: Enable line buffering for stdout x86/mce/inject: Avoid out-of-bounds write when setting flags ACPI: scan: Create platform device for BCM4752 and LNV4752 ACPI nodes pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in __nonstatic_find_io_region() pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in nonstatic_find_mem_region() netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check() bpf: Fix SO_RCVBUF/SO_SNDBUF handling in _bpf_setsockopt(). ppp: ensure minimum packet size in ppp_write() rocker: fix a sleeping in atomic bug staging: greybus: audio: Check null pointer fsl/fman: Check for null pointer after calling devm_ioremap Bluetooth: hci_bcm: Check for error irq HID: hid-uclogic-params: Invalid parameter check in uclogic_params_init HID: hid-uclogic-params: Invalid parameter check in uclogic_params_get_str_desc HID: hid-uclogic-params: Invalid parameter check in uclogic_params_huion_init HID: hid-uclogic-params: Invalid parameter check in uclogic_params_frame_init_v1_buttonpad debugfs: lockdown: Allow reading debugfs files that are not world readable net/mlx5e: Don't block routes with nexthop objects in SW Revert "net/mlx5e: Block offload of outer header csum for UDP tunnels" net/mlx5: Set command entry semaphore up once got index free spi: spi-meson-spifc: Add missing pm_runtime_disable() in meson_spifc_probe tpm: add request_locality before write TPM_INT_ENABLE can: softing: softing_startstop(): fix set but not used variable warning can: xilinx_can: xcan_probe(): check for error irq pcmcia: fix setting of kthread task states net: mcs7830: handle usb read errors properly ext4: avoid trim error on fs with small groups ALSA: jack: Add missing rwsem around snd_ctl_remove() calls ALSA: PCM: Add missing rwsem around snd_ctl_remove() calls ALSA: hda: Add missing rwsem around snd_ctl_remove() calls RDMA/hns: Validate the pkey index clk: imx8mn: Fix imx8mn_clko1_sels powerpc/prom_init: Fix improper check of prom_getprop() ASoC: uniphier: drop selecting non-existing SND_SOC_UNIPHIER_AIO_DMA ALSA: oss: fix compile error when OSS_DEBUG is enabled char/mwave: Adjust io port register size binder: fix handling of error during copy iommu/io-pgtable-arm: Fix table descriptor paddr formatting scsi: ufs: Fix race conditions related to driver data PCI/MSI: Fix pci_irq_vector()/pci_irq_get_affinity() powerpc/powermac: Add additional missing lockdep_register_key() RDMA/core: Let ib_find_gid() continue search even after empty entry RDMA/cma: Let cma_resolve_ib_dev() continue search even after empty entry ASoC: rt5663: Handle device_property_read_u32_array error codes clk: stm32: Fix ltdc's clock turn off by clk_disable_unused() after system enter shell dmaengine: pxa/mmp: stop referencing config->slave_id iommu/iova: Fix race between FQ timeout and teardown phy: uniphier-usb3ss: fix unintended writing zeros to PHY register ASoC: mediatek: Check for error clk pointer ASoC: samsung: idma: Check of ioremap return value misc: lattice-ecp3-config: Fix task hung when firmware load failed mips: lantiq: add support for clk_set_parent() mips: bcm63xx: add support for clk_set_parent() RDMA/cxgb4: Set queue pair state when being queried of: base: Fix phandle argument length mismatch error message Bluetooth: Fix debugfs entry leak in hci_register_dev() fs: dlm: filter user dlm messages for kernel locks drm/lima: fix warning when CONFIG_DEBUG_SG=y & CONFIG_DMA_API_DEBUG=y ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply drm/nouveau/pmu/gm200-: avoid touching PMU outside of DEVINIT/PREOS/ACR ARM: shmobile: rcar-gen2: Add missing of_node_put() batman-adv: allow netlink usage in unprivileged containers usb: gadget: f_fs: Use stream_open() for endpoint files drm: panel-orientation-quirks: Add quirk for the Lenovo Yoga Book X91F/L HID: apple: Do not reset quirks when the Fn key is not found media: b2c2: Add missing check in flexcop_pci_isr: EDAC/synopsys: Use the quirk for version instead of ddr version mlxsw: pci: Add shutdown method in PCI driver drm/bridge: megachips: Ensure both bridges are probed before registration gpiolib: acpi: Do not set the IRQ type if the IRQ is already in use HSI: core: Fix return freed object in hsi_new_client mwifiex: Fix skb_over_panic in mwifiex_usb_recv() rsi: Fix use-after-free in rsi_rx_done_handler() rsi: Fix out-of-bounds read in rsi_read_pkt() usb: uhci: add aspeed ast2600 uhci support floppy: Add max size check for user space request x86/mm: Flush global TLB when switching to trampoline page-table media: uvcvideo: Increase UVC_CTRL_CONTROL_TIMEOUT to 5 seconds. media: saa7146: hexium_orion: Fix a NULL pointer dereference in hexium_attach() media: m920x: don't use stack on USB reads iwlwifi: mvm: synchronize with FW after multicast commands ath10k: Fix tx hanging net-sysfs: update the queue counts in the unregistration path net: phy: prefer 1000baseT over 1000baseKX gpio: aspeed: Convert aspeed_gpio.lock to raw_spinlock x86/mce: Mark mce_panic() noinstr x86/mce: Mark mce_end() noinstr x86/mce: Mark mce_read_aux() noinstr net: bonding: debug: avoid printing debug logs when bond is not notifying peers bpf: Do not WARN in bpf_warn_invalid_xdp_action() HID: quirks: Allow inverting the absolute X/Y values media: igorplugusb: receiver overflow should be reported media: saa7146: hexium_gemini: Fix a NULL pointer dereference in hexium_attach() mmc: core: Fixup storing of OCR for MMC_QUIRK_NONSTD_SDIO audit: ensure userspace is penalized the same as the kernel when under pressure arm64: dts: ls1028a-qds: move rtc node to the correct i2c bus arm64: tegra: Adjust length of CCPLEX cluster MMIO region cpufreq: Fix initialization of min and max frequency QoS requests usb: hub: Add delay for SuperSpeed hub resume to let links transit to U0 ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream iwlwifi: fix leaks/bad data after failed firmware load iwlwifi: remove module loading failure message iwlwifi: mvm: Fix calculation of frame length um: registers: Rename function names to avoid conflicts and build problems jffs2: GC deadlock reading a page that is used in jffs2_write_begin() ACPICA: actypes.h: Expand the ACPI_ACCESS_ definitions ACPICA: Utilities: Avoid deleting the same object twice in a row ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R() ACPICA: Fix wrong interpretation of PCC address ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5 drm/amdgpu: fixup bad vram size on gmc v8 ACPI: battery: Add the ThinkPad "Not Charging" quirk btrfs: remove BUG_ON() in find_parent_nodes() btrfs: remove BUG_ON(!eie) in find_parent_nodes net: mdio: Demote probed message to debug print mac80211: allow non-standard VHT MCS-10/11 dm btree: add a defensive bounds check to insert_at() dm space map common: add bounds check to sm_ll_lookup_bitmap() net: phy: marvell: configure RGMII delays for 88E1118 net: gemini: allow any RGMII interface mode regulator: qcom_smd: Align probe function with rpmh-regulator serial: pl010: Drop CR register reset on set_termios serial: core: Keep mctrl register state and cached copy in sync random: do not throw away excess input to crng_fast_load parisc: Avoid calling faulthandler_disabled() twice powerpc/6xx: add missing of_node_put powerpc/powernv: add missing of_node_put powerpc/cell: add missing of_node_put powerpc/btext: add missing of_node_put powerpc/watchdog: Fix missed watchdog reset due to memory ordering race i2c: i801: Don't silently correct invalid transfer size powerpc/smp: Move setup_profiling_timer() under CONFIG_PROFILING i2c: mpc: Correct I2C reset procedure clk: meson: gxbb: Fix the SDM_EN bit for MPLL0 on GXBB powerpc/powermac: Add missing lockdep_register_key() KVM: PPC: Book3S: Suppress failed alloc warning in H_COPY_TOFROM_GUEST w1: Misuse of get_user()/put_user() reported by sparse scsi: lpfc: Trigger SLI4 firmware dump before doing driver cleanup ALSA: seq: Set upper limit of processed events powerpc: handle kdump appropriately with crash_kexec_post_notifiers option MIPS: OCTEON: add put_device() after of_find_device_by_node() i2c: designware-pci: Fix to change data types of hcnt and lcnt parameters MIPS: Octeon: Fix build errors using clang scsi: sr: Don't use GFP_DMA ASoC: mediatek: mt8173: fix device_node leak power: bq25890: Enable continuous conversion for ADC at charging rpmsg: core: Clean up resources on announce_create failure. crypto: omap-aes - Fix broken pm_runtime_and_get() usage crypto: stm32/crc32 - Fix kernel BUG triggered in probe() crypto: caam - replace this_cpu_ptr with raw_cpu_ptr ubifs: Error path in ubifs_remount_rw() seems to wrongly free write buffers fuse: Pass correct lend value to filemap_write_and_wait_range() serial: Fix incorrect rs485 polarity on uart open cputime, cpuacct: Include guest time in user time in cpuacct.stat tracing/kprobes: 'nmissed' not showed correctly for kretprobe iwlwifi: mvm: Increase the scan timeout guard to 30 seconds s390/mm: fix 2KB pgtable release race drm/etnaviv: limit submit sizes drm/nouveau/kms/nv04: use vzalloc for nv04_display drm/bridge: analogix_dp: Make PSR-exit block less PCI: pci-bridge-emul: Properly mark reserved PCIe bits in PCI config space PCI: pci-bridge-emul: Correctly set PCIe capabilities PCI: pci-bridge-emul: Set PCI_STATUS_CAP_LIST for PCIe device xfrm: fix policy lookup for ipv6 gre packets btrfs: fix deadlock between quota enable and other quota operations btrfs: check the root node for uptodate before returning it btrfs: respect the max size in the header when activating swap file ext4: make sure to reset inode lockdep class when quota enabling fails ext4: make sure quota gets properly shutdown on error ext4: set csum seed in tmp inode while migrating to extents ext4: Fix BUG_ON in ext4_bread when write quota data ext4: don't use the orphan list when migrating an inode drm/radeon: fix error handling in radeon_driver_open_kms of: base: Improve argument length mismatch error firmware: Update Kconfig help text for Google firmware media: rcar-csi2: Optimize the selection PHTW register Documentation: dmaengine: Correctly describe dmatest with channel unset Documentation: ACPI: Fix data node reference documentation Documentation: refer to config RANDOMIZE_BASE for kernel address-space randomization Documentation: fix firewire.rst ABI file path error scsi: core: Show SCMD_LAST in text form RDMA/hns: Modify the mapping attribute of doorbell to device RDMA/rxe: Fix a typo in opcode name dmaengine: stm32-mdma: fix STM32_MDMA_CTBR_TSEL_MASK Revert "net/mlx5: Add retry mechanism to the command entry index allocation" powerpc/cell: Fix clang -Wimplicit-fallthrough warning powerpc/fsl/dts: Enable WA for erratum A-009885 on fman3l MDIO buses bpftool: Remove inclusion of utilities.mak from Makefiles ipv4: avoid quadratic behavior in netns dismantle net/fsl: xgmac_mdio: Fix incorrect iounmap when removing module parisc: pdc_stable: Fix memory leak in pdcs_register_pathentries f2fs: fix to reserve space for IO align feature af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress clk: si5341: Fix clock HW provider cleanup net: axienet: limit minimum TX ring size net: axienet: fix number of TX ring slots for available check net: axienet: increase default TX ring size to 128 rtc: pxa: fix null pointer dereference inet: frags: annotate races around fqdir->dead and fqdir->high_thresh netns: add schedule point in ops_exit_list() xfrm: Don't accidentally set RTO_ONLINK in decode_session4() gre: Don't accidentally set RTO_ONLINK in gre_fill_metadata_dst() libcxgb: Don't accidentally set RTO_ONLINK in cxgb_find_route() perf script: Fix hex dump character output dmaengine: at_xdmac: Don't start transactions at tx_submit level dmaengine: at_xdmac: Print debug message after realeasing the lock dmaengine: at_xdmac: Fix concurrency over xfers_list dmaengine: at_xdmac: Fix lld view setting dmaengine: at_xdmac: Fix at_xdmac_lld struct definition arm64: dts: qcom: msm8996: drop not documented adreno properties net_sched: restore "mpu xxx" handling bcmgenet: add WOL IRQ check net: ethernet: mtk_eth_soc: fix error checking in mtk_mac_config() dt-bindings: display: meson-dw-hdmi: add missing sound-name-prefix property dt-bindings: display: meson-vpu: Add missing amlogic,canvas property scripts/dtc: dtx_diff: remove broken example from help text lib82596: Fix IRQ check in sni_82596_probe lib/test_meminit: destroy cache in kmem_cache_alloc_bulk() test mtd: nand: bbt: Fix corner case in bad block table handling Revert "ia64: kprobes: Use generic kretprobe trampoline handler" Linux 5.4.174 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ia656821e4377afa7ca279a6ed92195989be831b3	2022-01-31 15:14:13 +01:00
Todd Kjos	48fc8eebd1	binder: fix handling of error during copy ... [ Upstream commit fe6b1869243f23a485a106c214bcfdc7aa0ed593 ] If a memory copy function fails to copy the whole buffer, a positive integar with the remaining bytes is returned. In binder_translate_fd_array() this can result in an fd being skipped due to the failed copy, but the loop continues processing fds since the early return condition expects a negative integer on error. Fix by returning "ret > 0 ? -EINVAL : ret" to handle this case. Fixes: bb4a2e48d5 ("binder: return errors from buffer copy functions") Suggested-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: Todd Kjos <tkjos@google.com> Link: https://lore.kernel.org/r/20211130185152.437403-2-tkjos@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-01-27 09:19:38 +01:00
Hang Lu	a4e84758f0	UPSTREAM: binder: fix the missing BR_FROZEN_REPLY in binder_return_strings ... Add BR_FROZEN_REPLY in binder_return_strings to support stat function. Fixes: ae28c1be1e54 ("binder: BINDER_GET_FROZEN_INFO ioctl") Acked-by: Todd Kjos <tkjos@google.com> Signed-off-by: Hang Lu <hangl@codeaurora.org> Link: https://lore.kernel.org/r/1617961246-4502-2-git-send-email-hangl@codeaurora.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 005169157448ca41eff8716d79dc1b8f158229d2) Bug: 187129171 Signed-off-by: Connor O'Brien <connoro@google.com> Change-Id: I3b0f67ee9f3a747d9052b7a900f2239b0e4097f5	2022-01-24 11:41:01 -08:00
Greg Kroah-Hartman	ba4942c83d	Merge tag 'android11-5.4.161_r00' into android11-5.4 ... This is the merge of the upstream LTS release of 5.4.1161 into the android11-5.4 branch. It contains the following commits: b52fb22557 ANDROID: GKI: disable CONFIG_FORTIFY_SOURCE 26b09f181d Merge 5.4.161 into android11-5.4-lts 5c088fba39 Linux 5.4.161 b786cb3236 erofs: fix unsafe pagevec reuse of hooked pclusters 83de35ae27 erofs: remove the occupied parameter from z_erofs_pagevec_enqueue() b37f6da8c3 PCI: Add MSI masking quirk for Nvidia ION AHCI db1390b60e PCI/MSI: Deal with devices lying about their MSI mask capability 49b55a7792 PCI/MSI: Destroy sysfs before freeing entries 7186be970c parisc/entry: fix trace test in syscall exit path 258c42a8fb fortify: Explicitly disable Clang support 4f9a3cda16 scsi: ufs: Fix tm request when non-fatal error happens c468f9249d ext4: fix lazy initialization next schedule time computation in more granular unit 307c6f7287 MIPS: Fix assembly error from MIPSr2 code used within MIPS_ISA_ARCH_LEVEL 7be773a028 scsi: ufs: Fix interrupt error message for shared interrupts e3c97ba4a6 soc/tegra: pmc: Fix imbalanced clock disabling in error code path ebd1ef6eae Revert "net: sched: update default qdisc visibility after Tx queue cnt changes" 9084a8ecc9 Revert "serial: core: Fix initializing and restoring termios speed" 91a7552bea Merge 5.4.160 into android11-5.4-lts 17efa1a44c Linux 5.4.160 66bd28d6be selftests/bpf: Fix also no-alu32 strobemeta selftest e7ea088cd0 ath10k: fix invalid dma_addr_t token assignment 20a951afb7 SUNRPC: Partial revert of commit 6f9f17287e78 5b7a0a4f7c PCI: Add PCI_EXP_DEVCTL_PAYLOAD_* macros 256a1e009b powerpc/powernv/prd: Unregister OPAL_MSG_PRD2 notifier during module unload fe02d37870 s390/cio: make ccw_device_dma_* more robust 8a8d007bae s390/tape: fix timer initialization in tape_std_assign() 5ef14af166 s390/cio: check the subchannel validity for dev_busid b0989ae51d video: backlight: Drop maximum brightness override for brightness zero 66938ba128 mm, oom: do not trigger out_of_memory from the #PF d6648b55ed mm, oom: pagefault_out_of_memory: don't force global OOM for dying tasks c6f9a5c11a powerpc/bpf: Emit stf barrier instruction sequences for BPF_NOSPEC 453b779d2b powerpc/security: Add a helper to query stf_barrier type 84b3fbfd8e powerpc/bpf: Fix BPF_SUB when imm == 0x80000000 7edda4bd9e powerpc/bpf: Validate branch ranges 0347c001c9 powerpc/lib: Add helper to check if offset is within conditional branch range c4461ca7a8 ovl: fix deadlock in splice write 8d750efc8d 9p/net: fix missing error check in p9_check_errors aba12bb38b net, neigh: Enable state migration between NUD_PERMANENT and NTF_USE 223985fa1b f2fs: should use GFP_NOFS for directory inodes af73b240e0 irqchip/sifive-plic: Fixup EOI failed when masked 53014c1c41 parisc: Fix set_fixmap() on PA1.x CPUs 645d6dfdcb parisc: Fix backtrace to always include init funtion names 62c4e0a3d8 ARM: 9156/1: drop cc-option fallbacks for architecture selection 61a5e446bb ARM: 9155/1: fix early early_iounmap() dc33574246 selftests/net: udpgso_bench_rx: fix port argument dd3a418ba5 cxgb4: fix eeprom len when diagnostics not implemented 1800c9eecd net/smc: fix sk_refcnt underflow on linkdown and fallback b2d1b6624b vsock: prevent unnecessary refcnt inc for nonblocking connect 72aca95f95 net: hns3: allow configure ETS bandwidth of all TCs 07b218db54 net/sched: sch_taprio: fix undefined behavior in ktime_mono_to_any 18f2809441 bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding 180a9b539c arm64: pgtable: make __pte_to_phys/__phys_to_pte_val inline functions 572599cbf1 nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails c1d5f943bb llc: fix out-of-bound array index in llc_sk_dev_hash() bdf94057aa perf bpf: Add missing free to bpf_event__print_bpf_prog_info() 23def86bbf zram: off by one in read_block_state() d26835de40 mm/zsmalloc.c: close race window between zs_pool_dec_isolated() and zs_unregister_migration() 46d695e870 bonding: Fix a use-after-free problem when bond_sysfs_slave_add() failed dce69e0a06 ACPI: PMIC: Fix intel_pmic_regs_handler() read accesses 700602b662 net: vlan: fix a UAF in vlan_dev_real_dev() 98e0ab88f4 net: davinci_emac: Fix interrupt pacing disable 70ecaadb49 xen-pciback: Fix return in pm_ctrl_init() 7f57b9bc8e i2c: xlr: Fix a resource leak in the error handling path of 'xlr_i2c_probe()' 53ad06ff3b NFSv4: Fix a regression in nfs_set_open_stateid_locked() c9dcb51ae4 scsi: qla2xxx: Turn off target reset during issue_lip 211f08d1ff scsi: qla2xxx: Fix gnl list corruption 9b180f3c2d ar7: fix kernel builds for compiler test 59e97c74d1 watchdog: f71808e_wdt: fix inaccurate report in WDIOC_GETTIMEOUT 162a1cfcd5 m68k: set a default value for MEMORY_RESERVE 9770f8c29f signal/sh: Use force_sig(SIGKILL) instead of do_group_exit(SIGKILL) 9e6985190f dmaengine: dmaengine_desc_callback_valid(): Check for `callback_result` fd1de35901 netfilter: nfnetlink_queue: fix OOB when mac header was cleared 15351d5e8b soc: fsl: dpaa2-console: free buffer before returning from dpaa2_console_read be832f781d auxdisplay: ht16k33: Fix frame buffer device blanking c441943075 auxdisplay: ht16k33: Connect backlight to fbdev 1fa9803de9 auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string e63507ea43 dmaengine: at_xdmac: fix AT_XDMAC_CC_PERID() macro 04317e7474 mtd: core: don't remove debugfs directory if device is in use 59929f9a57 mtd: spi-nor: hisi-sfc: Remove excessive clk_disable_unprepare() a83aaf1507 fs: orangefs: fix error return code of orangefs_revalidate_lookup() c79c37c775 NFS: Fix deadlocks in nfs_scan_commit_list() 5a893e0eab opp: Fix return in _opp_add_static_v2() 98ac698216 PCI: aardvark: Fix preserving PCI_EXP_RTCTL_CRSSVE flag on emulated bridge 819925eff0 PCI: aardvark: Don't spam about PIO Response Status bab1cfec7a drm/plane-helper: fix uninitialized variable reference 4b48c6ede3 pnfs/flexfiles: Fix misplaced barrier in nfs4_ff_layout_prepare_ds 2b2fdb6f48 rpmsg: Fix rpmsg_create_ept return when RPMSG config is not defined bd48bdbfd9 apparmor: fix error check a7b2947649 power: supply: bq27xxx: Fix kernel crash on IRQ handler register error 3f698d97f7 mips: cm: Convert to bitfield API to fix out-of-bounds access fb7b73cd94 powerpc/44x/fsp2: add missing of_node_put d3dd1a057c HID: u2fzero: properly handle timeouts in usb_submit_urb b216a39b32 HID: u2fzero: clarify error check and length calculations fae0552d83 serial: xilinx_uartps: Fix race condition causing stuck TX 818e100c2b phy: qcom-qusb2: Fix a memory leak on probe de43e75917 ASoC: cs42l42: Defer probe if request_threaded_irq() returns EPROBE_DEFER f00ff5357b ASoC: cs42l42: Correct some register default values baf5c1225e ARM: dts: stm32: fix SAI sub nodes register range bb74ce1feb staging: ks7010: select CRYPTO_HASH/CRYPTO_MICHAEL_MIC 73aaa6222a RDMA/mlx4: Return missed an error if device doesn't support steering 20dfad97db scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn() 5ead6f4fea power: supply: rt5033_battery: Change voltage values to µV fdbe8e8a08 usb: gadget: hid: fix error code in do_config() 15355466cd serial: 8250_dw: Drop wrong use of ACPI_PTR() d8241e7a21 video: fbdev: chipsfb: use memset_io() instead of memset() e7df004eb1 clk: at91: check pmc node status before registering syscore ops 44a2dcd146 memory: fsl_ifc: fix leak of irq and nand_irq in fsl_ifc_ctrl_probe 03fe35ce9a soc/tegra: Fix an error handling path in tegra_powergate_power_up() 543d85602f arm: dts: omap3-gta04a4: accelerometer irq fix 7cf7d9b83d ALSA: hda: Reduce udelay() at SKL+ position reporting d1cf71d79e JFS: fix memleak in jfs_mount 56911ee537 MIPS: loongson64: make CPU_LOONGSON64 depends on MIPS_FP_SUPPORT ee49b6598c scsi: dc395: Fix error case unwinding dd49dee254 ARM: dts: at91: tse850: the emac<->phy interface is rmii 1df7102f26 arm64: dts: meson-g12a: Fix the pwm regulator supply properties 681c58f344 RDMA/bnxt_re: Fix query SRQ failure 50eca29537 ARM: dts: qcom: msm8974: Add xo_board reference clock to DSI0 PHY 863e71a3af arm64: dts: rockchip: Fix GPU register width for RK3328 6694960195 ARM: s3c: irq-s3c24xx: Fix return value check for s3c24xx_init_intc() d27580c1b0 clk: mvebu: ap-cpu-clk: Fix a memory leak in error handling paths 9212ebb1c6 RDMA/rxe: Fix wrong port_cap_flags cf234bc5fb ibmvnic: Process crqs after enabling interrupts bc40616481 ibmvnic: don't stop queue in xmit a91c8ee2ed udp6: allow SO_MARK ctrl msg to affect routing 9ff14503f4 selftests/bpf: Fix fclose/pclose mismatch in test_progs af51aa2b85 crypto: pcrypt - Delay write to padata->info 9be9cb2a2b net: phylink: avoid mvneta warning when setting pause parameters 077410c790 net: amd-xgbe: Toggle PLL settings during rate change 63a3b1af04 drm/amdgpu/gmc6: fix DMA mask from 44 to 40 bits 9ca0d10742 wcn36xx: add proper DMA memory barriers in rx path a3256ae45b libertas: Fix possible memory leak in probe and disconnect 427583b93d libertas_tf: Fix possible memory leak in probe and disconnect 2339ff4162 KVM: s390: Fix handle_sske page fault handling 3f3b4054e2 samples/kretprobes: Fix return value if register_kretprobe() failed 9435b2f9c0 tcp: don't free a FIN sk_buff in tcp_remove_empty_skb() a8226599cb irq: mips: avoid nested irq_enter() ae5a244648 s390/gmap: don't unconditionally call pte_unmap_unlock() in __gmap_zap() 8fb436d146 libbpf: Fix BTF data layout checks and allow empty BTF 03a818c096 smackfs: use netlbl_cfg_cipsov4_del() for deleting cipso_v4_doi 12ccb57379 drm/msm: Fix potential NULL dereference in DPU SSPP dc18f08062 clocksource/drivers/timer-ti-dm: Select TIMER_OF c523474f2a PM: hibernate: fix sparse warnings 0d22f55014 nvme-rdma: fix error code in nvme_rdma_setup_ctrl 67ba6c8e71 phy: micrel: ksz8041nl: do not use power down mode ae213c059a mwifiex: Send DELBA requests according to spec 3a781e2131 rsi: stop thread firstly in rsi_91x_init() error handling ad4cd01307 mt76: mt76x02: fix endianness warnings in mt76x02_mac.c bdbc9311f1 platform/x86: thinkpad_acpi: Fix bitwise vs. logical warning 3446e5ecdf block: ataflop: fix breakage introduced at blk-mq refactoring 2918a29fc8 mmc: mxs-mmc: disable regulator on error and in the remove function b631c603b5 net: stream: don't purge sk_error_queue in sk_stream_kill_queues() f27fbff862 drm/msm: uninitialized variable in msm_gem_import() 32ac072c24 ath10k: fix max antenna gain unit 218fb43fff hwmon: (pmbus/lm25066) Let compiler determine outer dimension of lm25066_coeff 8384c4a7bc hwmon: Fix possible memleak in __hwmon_device_register() f7fd072039 net, neigh: Fix NTF_EXT_LEARNED in combination with NTF_USE 9498f5272a memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host() 5f462b38ce memstick: avoid out-of-range warning 3a7525d5d7 mmc: sdhci-omap: Fix NULL pointer exception if regulator is not configured dc73f7cae1 b43: fix a lower bounds test 1b6365fdae b43legacy: fix a lower bounds test c51ac7fd02 hwrng: mtk - Force runtime pm ops for sleep ops 52d2cdab52 crypto: qat - disregard spurious PFVF interrupts 4d7881430f crypto: qat - detect PFVF collision after ACK a3d3f9c5dc media: dvb-frontends: mn88443x: Handle errors of clk_prepare_enable() 73dd601bec netfilter: nft_dynset: relax superfluous check on set updates 62f6260f70 EDAC/amd64: Handle three rank interleaving mode f399e650c0 ath9k: Fix potential interrupt storm on queue reset 843ff688eb media: em28xx: Don't use ops->suspend if it is NULL e577924b70 cpuidle: Fix kobject memory leaks in error paths 18fdbdbecf crypto: ecc - fix CRYPTO_DEFAULT_RNG dependency a993159a2a kprobes: Do not use local variable when creating debugfs file 71411bd79e media: cx23885: Fix snd_card_free call on null card pointer 1c2c8030e7 media: tm6000: Avoid card name truncation 61266f852f media: si470x: Avoid card name truncation 4e65b9ec21 media: radio-wl1273: Avoid card name truncation 8eeec127d5 media: mtk-vpu: Fix a resource leak in the error handling path of 'mtk_vpu_probe()' 2b9ae7bac9 media: TDA1997x: handle short reads of hdmi info frame. 23b65152a0 media: dvb-usb: fix ununit-value in az6027_rc_query e2b2d221a4 media: cxd2880-spi: Fix a null pointer dereference on error handling path f46da0c6af media: em28xx: add missing em28xx_close_extension 14f3d77c77 drm/amdgpu: fix warning for overflow check 465dc8a1b1 ath10k: Fix missing frame timestamp for beacon/probe-resp 7c12c2fe45 net: dsa: rtl8366rb: Fix off-by-one bug 674637270e rxrpc: Fix _usecs_to_jiffies() by using usecs_to_jiffies() d4cd7a167c crypto: caam - disable pkc for non-E SoCs 555fe5734d Bluetooth: btmtkuart: fix a memleak in mtk_hci_wmt_sync 8c68d12f1a wilc1000: fix possible memory leak in cfg_scan_result() 1713b85634 cgroup: Make rebind_subsystems() disable v2 controllers all at once bd76ec43f1 net: net_namespace: Fix undefined member in key_remove_domain() 3a37742128 virtio-gpu: fix possible memory allocation failure 606c95078a drm/v3d: fix wait for TMU write combiner flush 6a93d8ebb8 rcu: Fix existing exp request check in sync_sched_exp_online_cleanup() 6237a1685c Bluetooth: fix init and cleanup of sco_conn.timeout_work 28c1d96562 selftests/bpf: Fix strobemeta selftest regression f2c04d46c8 netfilter: conntrack: set on IPS_ASSURED if flows enters internal stream state 0c2acfede5 parisc/kgdb: add kgdb_roundup() to make kgdb work with idle polling cbe2872427 parisc/unwind: fix unwinder when CONFIG_64BIT is enabled a9a411adca task_stack: Fix end_of_stack() for architectures with upwards-growing stack c06cf3b1d0 parisc: fix warning in flush_tlb_all 7324419233 x86/hyperv: Protect set_hv_tscchange_cb() against getting preempted ad67a7e2ab spi: bcm-qspi: Fix missing clk_disable_unprepare() on error in bcm_qspi_probe() a15fc58933 btrfs: do not take the uuid_mutex in btrfs_rm_device aba1db41dd net: annotate data-race in neigh_output() 2f78cb7ecc vrf: run conntrack only in context of lower/physdev for locally generated packets 5919f02e18 ARM: 9136/1: ARMv7-M uses BE-8, not BE-32 d99f320a1b gre/sit: Don't generate link-local addr if addr_gen_mode is IN6_ADDR_GEN_MODE_NONE 9929b3db46 ARM: clang: Do not rely on lr register for stacktrace 681a426e6b smackfs: use __GFP_NOFAIL for smk_cipso_doi() 4752a9c3a0 iwlwifi: mvm: disable RX-diversity in powersave 41e583edb1 selftests: kvm: fix mismatched fclose() after popen() 4411d0d8df PM: hibernate: Get block device exclusively in swsusp_check() a528d3aac3 nvme: drop scan_lock and always kick requeue list when removing namespaces 209c39b3f5 nvmet-tcp: fix use-after-free when a port is removed 81d11e40fd nvmet: fix use-after-free when a port is removed 1ec1ca2be9 block: remove inaccurate requeue check bfde056402 mwl8k: Fix use-after-free in mwl8k_fw_state_machine() e4af3e42ba tracing/cfi: Fix cmp_entries_* functions signature mismatch caeb6bae75 workqueue: make sysfs of unbound kworker cpumask more clever 58b4e0c075 lib/xz: Validate the value before assigning it to an enum variable 8cdab20660 lib/xz: Avoid overlapping memcpy() with invalid input with in-place decompression eb8f087201 memstick: r592: Fix a UAF bug when removing the driver 2226ad0314 leaking_addresses: Always print a trailing newline 63c3c7b699 ACPI: battery: Accept charges over the design capacity as full 2efb81b22d iov_iter: Fix iov_iter_get_pages{,_alloc} page fault return value d5fb057f23 ath: dfs_pattern_detector: Fix possible null-pointer dereference in channel_detector_create() e2c27194fc tracefs: Have tracefs directories not set OTH permission bits by default ace6e7fe96 net-sysfs: try not to restart the syscall if it will fail eventually d8d1d35405 media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte() 382e7b6458 media: ipu3-imgu: VIDIOC_QUERYCAP: Fix bus_info e5f9be4869 media: ipu3-imgu: imgu_fmt: Handle properly try cdf338e1db ACPICA: Avoid evaluating methods too early during system resume 9ff00d0b1d ipmi: Disable some operations during a panic 4bba26f89e media: rcar-csi2: Add checking to rcsi2_start_receiver() c08a655ed9 brcmfmac: Add DMI nvram filename quirk for Cyberbook T116 tablet f64551db52 ia64: don't do IA64_CMPXCHG_DEBUG without CONFIG_PRINTK 31b7848647 media: mceusb: return without resubmitting URB in case of -EPROTO error. e419469adf media: imx: set a media_device bus_info string b2b2f91782 media: s5p-mfc: Add checking to s5p_mfc_probe(). 6b8ab552e2 media: s5p-mfc: fix possible null-pointer dereference in s5p_mfc_probe() bc4af8c782 media: uvcvideo: Set unique vdev name based in type 7a646855d6 media: uvcvideo: Return -EIO for control errors ab7fca0eae media: uvcvideo: Set capability in s_param bff0833e2b media: stm32: Potential NULL pointer dereference in dcmi_irq_thread() cede36511c media: netup_unidvb: handle interrupt properly according to the firmware 3fe3d04354 media: mt9p031: Fix corrupted frame after restarting stream 08743f9c48 ath10k: high latency fixes for beacon buffer fadb4cd750 mwifiex: Properly initialize private structure on interface type changes 7d3e6635c2 mwifiex: Run SET_BSS_MODE when changing from P2P to STATION vif-type 480c240ab6 x86: Increase exception stack sizes 91b9c23b6d smackfs: Fix use-after-free in netlbl_catmap_walk() 31df731c87 net: sched: update default qdisc visibility after Tx queue cnt changes a82f379378 locking/lockdep: Avoid RCU-induced noinstr fail f14eca60bf MIPS: lantiq: dma: reset correct number of channel ca07aff257 MIPS: lantiq: dma: add small delay after reset e5ea3dca94 platform/x86: wmi: do not fail if disabling fails b57df4d6fc drm/panel-orientation-quirks: add Valve Steam Deck 67bd269a84 Bluetooth: fix use-after-free error in lock_sock_nested() d416020f1a Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg() a52bd11b24 drm: panel-orientation-quirks: Add quirk for the Samsung Galaxy Book 10.6 e5ca76568a drm: panel-orientation-quirks: Add quirk for KD Kurio Smart C15200 2-in-1 c19cabfa55 drm: panel-orientation-quirks: Update the Lenovo Ideapad D330 quirk (v2) 46a25b7a25 dma-buf: WARN on dmabuf release with pending attachments 1bee9e59c6 USB: chipidea: fix interrupt deadlock 8a643c0f95 USB: iowarrior: fix control-message timeouts 3285811674 USB: serial: keyspan: fix memleak on probe errors 8ce0bc6962 iio: dac: ad5446: Fix ad5622_write() return value f01e16d324 pinctrl: core: fix possible memory leak in pinctrl_enable() 270541cbc0 quota: correct error number in free_dqentry() 10b808307d quota: check block number when reading the block in quota file a509a515f3 PCI: aardvark: Read all 16-bits from PCIE_MSI_PAYLOAD_REG 0ea58b9bb9 PCI: aardvark: Fix return value of MSI domain .alloc() method ee9cdca4d6 PCI: aardvark: Fix reporting Data Link Layer Link Active 6f99c7a51e PCI: aardvark: Do not unmask unused interrupts d964886327 PCI: aardvark: Fix checking for link up via LTSSM state e0269c0c81 PCI: aardvark: Do not clear status bits of masked interrupts 50b0ce94fb PCI: pci-bridge-emul: Fix emulation of W1C bits 3d995568c9 xen/balloon: add late_initcall_sync() for initial ballooning done 3f6255a91b ALSA: mixer: fix deadlock in snd_mixer_oss_set_volume 6225a31b2e ALSA: mixer: oss: Fix racy access to slots e9adf72bdb serial: core: Fix initializing and restoring termios speed b535b63464 powerpc/85xx: Fix oops when mpc85xx_smp_guts_ids node cannot be found bfefc5d6f9 can: j1939: j1939_can_recv(): ignore messages with invalid source address 94a3f521e3 can: j1939: j1939_tp_cmd_recv(): ignore abort message in the BAM transport 8e61c799c8 KVM: nVMX: Query current VMCS when determining if MSR bitmaps are in use 654a824816 power: supply: max17042_battery: use VFSOC for capacity when no rsns 11129762e3 power: supply: max17042_battery: Prevent int underflow in set_soc_threshold 625c3ed247 signal/mips: Update (_save|_restore)_fp_context to fail with -EFAULT ec5ef8d4d7 signal: Remove the bogus sigkill_pending in ptrace_stop 28c70d5036 RDMA/qedr: Fix NULL deref for query_qp on the GSI QP 91a29609bd rsi: Fix module dev_oper_mode parameter description 9defe9b1ab rsi: fix rate mask set leading to P2P failure 2f1f06be3e rsi: fix key enabled check causing unwanted encryption for vap_id > 0 1fa1da8a60 rsi: fix occasional initialisation failure with BT coex 398e7e5add wcn36xx: handle connection loss indication 4a67355383 libata: fix checking of DMA state 6f2f91b9df mwifiex: Read a PCI register after writing the TX ring write pointer 3991cdc40f wcn36xx: Fix HT40 capability for 2Ghz band 301d33c954 evm: mark evm_fixmode as __ro_after_init e1f71a3289 rtl8187: fix control-message timeouts 76d2ce7ca9 PCI: Mark Atheros QCA6174 to avoid bus reset 3110371c7a ath10k: fix division by zero in send path 2b94d10056 ath10k: fix control-message timeout cfbe74d8b1 ath6kl: fix control-message timeout 1a2fe1c3d8 ath6kl: fix division by zero in send path 78ebff828a mwifiex: fix division by zero in fw download path 08501eb9ff EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell a147922924 regulator: dt-bindings: samsung,s5m8767: correct s5m8767,pmic-buck-default-dvs-idx property c9e5a00596 regulator: s5m8767: do not use reset value as DVS voltage if GPIO DVS is disabled 3baa5886d1 hwmon: (pmbus/lm25066) Add offset coefficients 98bea92379 ia64: kprobes: Fix to pass correct trampoline address to the handler ddb54bf3b7 btrfs: call btrfs_check_rw_degradable only if there is a missing device 5223324ed1 btrfs: fix lost error handling when replaying directory deletes c25984fa18 btrfs: clear MISSING device status bit in btrfs_close_one_device 87a87c82f7 net/smc: Correct spelling mistake to TCPF_SYN_RECV cc14499b9d nfp: bpf: relax prog rejection for mtu check through max_pkt_offset a62d430841 vmxnet3: do not stop tx queues after netif_device_detach() 17dcecf20c r8169: Add device 10ec:8162 to driver r8169 e84b38e578 nvmet-tcp: fix header digest verification 2804181e1b drm: panel-orientation-quirks: Add quirk for GPD Win3 7273488fd3 watchdog: Fix OMAP watchdog early handling 5ffdddcf28 net: multicast: calculate csum of looped-back and forwarded packets 9420e2496d spi: spl022: fix Microwire full duplex mode 1a667bc329 nvmet-tcp: fix a memory leak when releasing a queue 2f3860ba60 xen/netfront: stop tx queues during live migration de649ec7ad bpf: Prevent increasing bpf_jit_limit above max df8665c398 bpf: Define bpf_jit_alloc_exec_limit for arm64 JIT 8dd688ba67 drm: panel-orientation-quirks: Add quirk for Aya Neo 2021 c4282bb805 mmc: winbond: don't build on M68K 05f0a97e2f reset: socfpga: add empty driver allowing consumers to probe dfa8fb782b ARM: dts: sun7i: A20-olinuxino-lime2: Fix ethernet phy-mode f09014e8be hyperv/vmbus: include linux/bitops.h 054fe50d26 sfc: Don't use netif_info before net_device setup 82005afbb3 cavium: Fix return values of the probe function 9f5fd5aab8 scsi: qla2xxx: Fix unmap of already freed sgl 96183337e9 scsi: qla2xxx: Return -ENOMEM if kzalloc() fails 8e3a0d28ed cavium: Return negative value when pci_alloc_irq_vectors() fails 58608e80d6 x86/irq: Ensure PI wakeup handler is unregistered before module unload 7252cb96e4 x86/cpu: Fix migration safety with X86_BUG_NULL_SEL e3d4ba338b x86/sme: Use #define USE_EARLY_PGTABLE_L5 in mem_encrypt_identity.c ccc4e5e60b fuse: fix page stealing 9505d48721 ALSA: timer: Unconditionally unlink slave instances, too 2c6446168f ALSA: timer: Fix use-after-free problem 246c6a1fe3 ALSA: synth: missing check for possible NULL after the call to kstrdup ce9f7535ec ALSA: usb-audio: Add registration quirk for JBL Quantum 400 7da6f4c5c2 ALSA: line6: fix control and interrupt message timeouts 4a12e624e5 ALSA: 6fire: fix control and bulk message timeouts ab3f823af2 ALSA: ua101: fix division by zero at probe a3bb6e0db7 ALSA: hda/realtek: Add quirk for HP EliteBook 840 G7 mute LED 40243342d2 ALSA: hda/realtek: Add quirk for ASUS UX550VE 8af6ade7ac ALSA: hda/realtek: Add a quirk for Acer Spin SP513-54N 809416fe0a ALSA: hda/realtek: Add quirk for Clevo PC70HS 638b53d67f media: v4l2-ioctl: Fix check_ext_ctrls 8c11269bd6 media: ir-kbd-i2c: improve responsiveness of hauppauge zilog receivers bbd62d2fca media: ite-cir: IR receiver stop working after receive overflow eef6cb3d3c crypto: s5p-sss - Add error handling in s5p_aes_probe() d7a5d872b4 firmware/psci: fix application of sizeof to pointer 18f0fb57a9 tpm: Check for integer overflow in tpm2_map_response_body() f38f3da360 parisc: Fix ptrace check on syscall return acbc2a08ea mmc: dw_mmc: Dont wait for DRTO on Write RSP error 5ee76475f8 scsi: qla2xxx: Fix use after free in eh_abort path cc5b139488 scsi: qla2xxx: Fix kernel crash when accessing port_speed sysfs file 617d2fd48d ocfs2: fix data corruption on truncate c20eb9551c libata: fix read log timeout value 69c2199f49 Input: i8042 - Add quirk for Fujitsu Lifebook T725 17ec1c6b45 Input: elantench - fix misreporting trackpoint coordinates ce4bec0a54 Input: iforce - fix control-message timeout db39f49ee7 binder: use cred instead of task for getsecid fc9c470cd5 binder: use cred instead of task for selinux checks 28a1e470b0 binder: use euid from cred instead of using task 3e87c4996d usb: xhci: Enable runtime-pm by default on AMD Yellow Carp platform 3fa7efd1fa xhci: Fix USB 3.1 enumeration issues by increasing roothub power-on-good delay f911d1ad48 Merge 5.4.159 into android11-5.4-lts 5915b0ea67 Linux 5.4.159 abc49cc45d rsi: fix control-message timeout 64e6632ab4 media: staging/intel-ipu3: css: Fix wrong size comparison imgu_css_fw_init 6c382b6365 staging: rtl8192u: fix control-message timeouts f66258cb60 staging: r8712u: fix control-message timeout 88a252ff78 comedi: vmk80xx: fix bulk and interrupt message timeouts 1ae4715121 comedi: vmk80xx: fix bulk-buffer overflow 199acd8c11 comedi: vmk80xx: fix transfer-buffer overflows b0156b7c96 comedi: ni_usb6501: fix NULL-deref in command paths 3efb7af8ac comedi: dt9812: fix DMA buffers on stack 6e80e9314f isofs: Fix out of bound access for corrupted isofs image adc56dbfc4 printk/console: Allow to disable console output by using console="" or console=null 589ac131b3 binder: don't detect sender/target during buffer cleanup b60e89b63e usb-storage: Add compatibility quirk flags for iODD 2531/2541 5c3eba2904 usb: musb: Balance list entry in musb_gadget_queue 161571745d usb: gadget: Mark USB_FSL_QE broken on 64-bit d6013265a7 usb: ehci: handshake CMD_RUN instead of STS_HALT 6d000e1c16 Revert "x86/kvm: fix vcpu-id indexed array sizes" 3197361248 Merge branch 'android11-5.4' into 'android11-5.4-lts' 7cd388bad4 Merge 5.4.158 into android11-5.4-lts c65356f0f7 Linux 5.4.158 e31d51f8a4 ARM: 9120/1: Revert "amba: make use of -1 IRQs warn" 960b1fdfc3 Revert "drm/ttm: fix memleak in ttm_transfered_destroy" a73ebe514a sfc: Fix reading non-legacy supported link modes 6789e4b759 Revert "usb: core: hcd: Add support for deferring roothub registration" 049849492b Revert "xhci: Set HCD flag to defer primary roothub registration" 2461f38384 media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt() 21fc2bb836 net: ethernet: microchip: lan743x: Fix skb allocation failure e02fdd7db4 vrf: Revert "Reset skb conntrack connection..." 1ce287eff9 scsi: core: Put LLD module refcnt after SCSI device is released 553d3c4173 Merge 5.4.157 into android11-5.4-lts e6de9a8b5b Linux 5.4.157 39fb393e21 perf script: Check session->header.env.arch before using it 472d9354a9 KVM: s390: preserve deliverable_mask in __airqs_kick_single_vcpu 07e9a4e1ab KVM: s390: clear kicked_mask before sleeping again 5919a07d71 cfg80211: correct bridge/4addr mode check dba9e632ed net: use netif_is_bridge_port() to check for IFF_BRIDGE_PORT 0f5b4c57dc sctp: add vtag check in sctp_sf_ootb df52776407 sctp: add vtag check in sctp_sf_do_8_5_1_E_sa 0aa322b5fe sctp: add vtag check in sctp_sf_violation d6470c2200 sctp: fix the processing for COOKIE_ECHO chunk 5fe74d5e4d sctp: fix the processing for INIT_ACK chunk 5953ee99ba sctp: use init_tag from inithdr for ABORT chunk 5395650d15 phy: phy_start_aneg: Add an unlocked version c85b696270 phy: phy_ethtool_ksettings_get: Lock the phy for consistency 0dea6379e2 net/tls: Fix flipped sign in async_wait.err assignment e12b8f3c2b net: nxp: lpc_eth.c: avoid hang when bringing interface down b232898c1d net: ethernet: microchip: lan743x: Fix dma allocation failure by using dma_set_mask_and_coherent 92507dc1ef net: ethernet: microchip: lan743x: Fix driver crash when lan743x_pm_resume fails 3708aa267d nios2: Make NIOS2_DTB_SOURCE_BOOL depend on !COMPILE_TEST b1c76f97ad RDMA/sa_query: Use strscpy_pad instead of memcpy to copy a string 18a012869f net: Prevent infinite while loop in skb_tx_hash() 6422e84718 net: batman-adv: fix error handling 1cead23c1c regmap: Fix possible double-free in regcache_rbtree_exit() 207e6e93e7 arm64: dts: allwinner: h5: NanoPI Neo 2: Fix ethernet node c29c3295e0 RDMA/mlx5: Set user priority for DCT 13ad93a42c nvme-tcp: fix data digest pointer calculation b597b0e2e8 nvmet-tcp: fix data digest pointer calculation d997d4e436 IB/hfi1: Fix abba locking issue with sc_disable() 0f8cdfff06 IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields 5f0bfe21c8 tcp_bpf: Fix one concurrency problem in the tcp_bpf_send_verdict function bd99782f3c drm/ttm: fix memleak in ttm_transfered_destroy d2c64ebcc7 net: lan78xx: fix division by zero in send path a37c5e70ac cfg80211: scan: fix RCU in cfg80211_add_nontrans_list() 590abe5bec mmc: sdhci-esdhc-imx: clear the buffer_read_ready to reset standard tuning circuit 07da44b086 mmc: sdhci: Map more voltage level to SDHCI_POWER_330 0821c5608d mmc: dw_mmc: exynos: fix the finding clock sample value 08328d65cb mmc: cqhci: clear HALT state after CQE enable 55a3870f4a mmc: vub300: fix control-message timeouts e0cfd5159f net/tls: Fix flipped sign in tls_err_abort() calls 6a18d155d5 Revert "net: mdiobus: Fix memory leak in __mdiobus_register" 9fdcf66ee4 nfc: port100: fix using -ERRNO as command type mask 853f22623d ata: sata_mv: Fix the error handling of mv_chip_id() 6d0b30784f Revert "pinctrl: bcm: ns: support updated DT binding as syscon subnode" b7dfc536db usbnet: fix error return code in usbnet_probe() 492140e45d usbnet: sanity check for maxpacket 4ba6c163fe ipv4: use siphash instead of Jenkins in fnhe_hashfun() 3f439c231a ipv6: use siphash in rt6_exception_hash() 1cad781ecf powerpc/bpf: Fix BPF_MOD when imm == 1 ca10ddbbab ARM: 9141/1: only warn about XIP address when not compile testing 40cd329455 ARM: 9139/1: kprobes: fix arch_init_kprobes() prototype 2f7647cc13 ARM: 9134/1: remove duplicate memcpy() definition 9f44f66396 ARM: 9133/1: mm: proc-macros: ensure *_tlb_fns are 4B aligned 5f1f361447 Merge 5.4.156 into android11-5.4-lts 3a7a77d783 Merge branch 'android11-5.4' into 'android11-5.4-lts' 89b6869b94 Linux 5.4.156 7cdcaa7c76 pinctrl: stm32: use valid pin identifier in stm32_pinctrl_resume() a9c4e246f7 ARM: 9122/1: select HAVE_FUTEX_CMPXCHG a98c81ab17 tracing: Have all levels of checks prevent recursion b0feaa8376 net: mdiobus: Fix memory leak in __mdiobus_register 0ab35e7074 scsi: core: Fix shost->cmd_per_lun calculation in scsi_add_host_with_dma() 9068beaa04 Input: snvs_pwrkey - add clk handling 8de335e819 ALSA: hda: avoid write to STATESTS if controller is in reset 570bc60dcd platform/x86: intel_scu_ipc: Update timeout value in comment 4054b869dc isdn: mISDN: Fix sleeping function called from invalid context 5001160d3e ARM: dts: spear3xx: Fix gmac node e9d9ffa193 net: stmmac: add support for dwmac 3.40a 044fa2afd6 btrfs: deal with errors when checking if a dir entry exists during log replay d49a293b94 gcc-plugins/structleak: add makefile var for disabling structleak e8ef998441 selftests: netfilter: remove stray bash debug line b7fdebde2c netfilter: Kconfig: use 'default y' instead of 'm' for bool config option 285e9210b1 isdn: cpai: check ctr->cnr to avoid array index out of bound 1f75f8883b nfc: nci: fix the UAF of rf_conn_info object 4f5d1c29cf mm, slub: fix potential memoryleak in kmem_cache_open() a1ec195a19 mm, slub: fix mismatch between reconstructed freelist depth and cnt 8e25a62e8d powerpc/idle: Don't corrupt back chain when going idle d0148cfaf8 KVM: PPC: Book3S HV: Make idle_kvm_start_guest() return 0 if it went to guest 80bbb0bc3a KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest() 722e6f6ac8 powerpc64/idle: Fix SP offsets when saving GPRs d6f451f1f6 audit: fix possible null-pointer dereference in audit_filter_rules c974f2f92c ASoC: DAPM: Fix missing kctl change notifications 5307a77b71 ALSA: hda/realtek: Add quirk for Clevo PC50HS 50fc52e5ca ALSA: usb-audio: Provide quirk for Sennheiser GSP670 Headset 0f218ba4c8 vfs: check fd has read access in kernel_read_file_from_fd() f439d2bcb6 elfcore: correct reference to CONFIG_UML d3a8357637 ocfs2: mount fails with buffer overflow in strlen b05caf023b ocfs2: fix data corruption after conversion from inline format bce53fbee9 ceph: fix handling of "meta" errors 151c72bba1 can: j1939: j1939_xtp_rx_rts_session_new(): abort TP less than 9 bytes 0ddf781882 can: j1939: j1939_xtp_rx_dat_one(): cancel session if receive TP.DT with error length a0e47d2833 can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv 7e66cfed66 can: j1939: j1939_tp_rxtimer(): fix errant alert in j1939_tp_rxtimer 1248582e47 can: peak_pci: peak_pci_remove(): fix UAF ea82c2463e can: peak_usb: pcan_usb_fd_decode_status(): fix back to ERROR_ACTIVE state notification c26dcd1cb8 can: rcar_can: fix suspend/resume 8c5585eae3 net: enetc: fix ethtool counter name for PM0_TERR c0b0baade9 net: stmmac: Fix E2E delay mechanism c4b64011e4 net: hns3: disable sriov before unload hclge layer 472acf1582 net: hns3: add limit ets dwrr bandwidth cannot be 0 b1f9380ee2 net: hns3: reset DWRR of unused tc to zero 12bdcbc043 NIOS2: irqflags: rename a redefined register name 599766696f net: dsa: lantiq_gswip: fix register definition f49ce82f9b lan78xx: select CRC32 83094f8c44 netfilter: ipvs: make global sysctl readonly in non-init netns ce70ee94dd ASoC: wm8960: Fix clock configuration on slave mode 0f5b08ca22 dma-debug: fix sg checks in debug_dma_map_sg() 50aefa9acc NFSD: Keep existing listeners on portlist error 4a5bf3e729 xtensa: xtfpga: Try software restart before simulating CPU reset 31137288b9 xtensa: xtfpga: use CONFIG_USE_OF instead of CONFIG_OF d946a39bad ARM: dts: at91: sama5d2_som1_ek: disable ISC node by default e7c4819c0b tee: optee: Fix missing devices unregister during optee_remove b1e9b4e0f6 net: switchdev: do not propagate bridge updates across bridges 2d22cd0482 parisc: math-emu: Fix fall-through warnings ff9005a69e Merge branch 'android11-5.4' into 'android11-5.4-lts' fa6db42758 Merge 5.4.155 into android11-5.4-lts 4f508aa9dd Linux 5.4.155 32d2ce0b94 ionic: don't remove netdev->dev_addr when syncing uc list abaf8e8b90 r8152: select CRC32 and CRYPTO/CRYPTO_HASH/CRYPTO_SHA256 a4f7d2246e qed: Fix missing error code in qed_slowpath_start() 62d96bb68b mqprio: Correct stats in mqprio_dump_class_stats(). fa272e8353 acpi/arm64: fix next_platform_timer() section mismatch error 32ac4ed32b drm/msm/dsi: fix off by one in dsi_bus_clk_enable error handling 4620098958 drm/msm/dsi: Fix an error code in msm_dsi_modeset_init() f302be08e3 drm/msm: Fix null pointer dereference on pointer edp 0d5ef1e875 drm/panel: olimex-lcd-olinuxino: select CRC32 9225d57f51 platform/mellanox: mlxreg-io: Fix argument base in kstrtou32() call ae0993739e mlxsw: thermal: Fix out-of-bounds memory accesses 97e6dcb416 ata: ahci_platform: fix null-ptr-deref in ahci_platform_enable_regulators() b9352ed9b9 pata_legacy: fix a couple uninitialized variable bugs 2bde4aca56 NFC: digital: fix possible memory leak in digital_in_send_sdd_req() 7ab488d722 NFC: digital: fix possible memory leak in digital_tg_listen_mdaa() 69b3a13f0d nfc: fix error handling of nfc_proto_register() 2731eaac19 ethernet: s2io: fix setting mac address during resume 4c2eb80fc9 net: encx24j600: check error in devm_regmap_init_encx24j600 0904e1be2a net: stmmac: fix get_hw_feature() on old hardware 06251ea8d1 net/mlx5e: Mutually exclude RX-FCS and RX-port-timestamp 19a01522c5 net: korina: select CRC32 32b57d897e net: arc: select CRC32 2880dc1302 gpio: pca953x: Improve bias setting d887745395 sctp: account stream padding length for reconf chunk 232c485c6b iio: dac: ti-dac5571: fix an error code in probe() 69696951de iio: ssp_sensors: fix error code in ssp_print_mcu_debug() 10ecff1522 iio: ssp_sensors: add more range checking in ssp_parse_dataframe() ac0688bcd1 iio: light: opt3001: Fixed timeout error when 0 lux 3c00d93297 iio: mtk-auxadc: fix case IIO_CHAN_INFO_PROCESSED cf4b39907a iio: adc128s052: Fix the error handling path of 'adc128_probe()' 580c09a9ef iio: adc: aspeed: set driver data when adc probe. 1904050cac powerpc/xive: Discard disabled interrupts in get_irqchip_state() 5683ed468f x86/Kconfig: Do not enable AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT automatically 0594f1d048 nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells d07571672c EDAC/armada-xp: Fix output of uncorrectable error counter dba8834bae virtio: write back F_VERSION_1 before validate 1b39a67856 USB: serial: option: add prod. id for Quectel EG91 41e178c138 USB: serial: option: add Telit LE910Cx composition 0x1204 848eac2cb7 USB: serial: option: add Quectel EC200S-CN module support 958e98ca52 USB: serial: qcserial: add EM9191 QDL support 733dcc08e9 Input: xpad - add support for another USB ID of Nacon GC-100 9ab5d539bc usb: musb: dsps: Fix the probe error path 278e483dc7 efi: Change down_interruptible() in virt_efi_reset_system() to down_trylock() 27a847dbc9 efi/cper: use stack buffer for error record decoding 6e35a5e926 cb710: avoid NULL pointer subtraction e71ce4a81e xhci: Enable trust tx length quirk for Fresco FL11 USB controller 01c2dcb67e xhci: Fix command ring pointer corruption while aborting a command 7ce7d4a46d xhci: guard accesses to ep_state in xhci_endpoint_reset() 783579057c mei: me: add Ice Lake-N device id. 9264bd22d7 x86/resctrl: Free the ctrlval arrays when domain_setup_mon_state() fails 10b77e16b3 watchdog: orion: use 0 for unset heartbeat 9acf1c10f1 btrfs: check for error when looking up inode during dir entry replay 625565fd80 btrfs: deal with errors when adding inode reference during log replay 6e2ac49b21 btrfs: deal with errors when replaying dir entry during log replay 005a07c9ac btrfs: unlock newly allocated extent buffer after error e9f457f056 csky: Fixup regs.sr broken in ptrace a6f4ea748a csky: don't let sigreturn play with priveleged bits of status register 98544ca6cb s390: fix strrchr() implementation 5959e22e07 nds32/ftrace: Fix Error: invalid operands (*UND* and *UND* sections) for `^' 2e41b9c846 ALSA: hda/realtek: Fix the mic type detection issue for ASUS G551JW 90cf96afa3 ALSA: hda/realtek - ALC236 headset MIC recording issue 33627fa4db ALSA: hda/realtek: Add quirk for Clevo X170KM-G e96079ab1c ALSA: hda/realtek: Complete partial device name to avoid ambiguity dd3f048315 ALSA: seq: Fix a potential UAF by wrong private_free call order 825786f723 ALSA: usb-audio: Add quirk for VF0770 43d9332526 ovl: simplify file splice 615b28244c Merge 5.4.154 into android11-5.4-lts ce061ef43f Linux 5.4.154 291a48871e sched: Always inline is_percpu_thread() 3e105ecc4a scsi: virtio_scsi: Fix spelling mistake "Unsupport" -> "Unsupported" 1ff5ee9d39 scsi: ses: Fix unsigned comparison with less than zero 83d857d6b0 drm/amdgpu: fix gart.bo pin_count leak 1843ae8c4b net: sun: SUNVNET_COMMON should depend on INET 6d1d7acb10 mac80211: check return value of rhashtable_init 2aaf3fd5e1 net: prevent user from passing illegal stab size 1e66a472b5 m68k: Handle arrivals of multiple signals correctly be191c8e68 mac80211: Drop frames from invalid MAC address in ad-hoc mode fffad5988f netfilter: nf_nat_masquerade: defer conntrack walk to work queue b3cb063034 netfilter: nf_nat_masquerade: make async masq_inet6_event handling generic a9d8aa2d3c HID: wacom: Add new Intuos BT (CTL-4100WL/CTL-6100WL) device IDs 8c6680025b netfilter: ip6_tables: zero-initialize fragment offset 744b908a7f HID: apple: Fix logical maximum and usage maximum of Magic Keyboard JIS b6bccc978e ext4: correct the error path of ext4_write_inline_data_end() de4a28b718 net: phy: bcm7xxx: Fixed indirect MMD operations 57f5a5a9ae UPSTREAM: ovl: simplify file splice 65d414cb38 Merge branch 'android11-5.4' into 'android11-5.4-lts' ffab1c7d7c Merge 5.4.153 into android11-5.4-lts 940a14a7d8 Linux 5.4.153 6a89b1e0c2 x86/Kconfig: Correct reference to MWINCHIP3D 5b3b400741 x86/hpet: Use another crystalball to evaluate HPET usability 367f643191 x86/platform/olpc: Correct ifdef symbol to intended CONFIG_OLPC_XO15_SCI 9e2a9da532 RISC-V: Include clone3() on rv32 a326f9c01c bpf, s390: Fix potential memory leak about jit_data 60bacf259e i2c: acpi: fix resource leak in reconfiguration device addition b723b34a98 net: prefer socket bound to interface when not in VRF 17063cac40 i40e: Fix freeing of uninitialized misc IRQ vector 0a1fcc981d i40e: fix endless loop under rtnl d6c0668119 gve: fix gve_get_stats() d83787c26d rtnetlink: fix if_nlmsg_stats_size() under estimation 0311d97753 gve: Correct available tx qpl check 11cd944bb8 drm/nouveau/debugfs: fix file release memory leak cb7e651879 video: fbdev: gbefb: Only instantiate device when built for IP32 04f981251e bus: ti-sysc: Use CLKDM_NOAUTO for dra7 dcan1 for errata i893 809aa82ac6 netlink: annotate data races around nlk->bound fd73c2e64b net: sfp: Fix typo in state machine debug string c951c08a59 net/sched: sch_taprio: properly cancel timer from taprio_destroy() c2c45102ae net: bridge: use nla_total_size_64bit() in br_get_linkxstats_size() 8af0c7d3fb ARM: imx6: disable the GIC CPU interface before calling stby-poweroff sequence ebe58e1c1a arm64: dts: ls1028a: add missing CAN nodes 1b9f0d242a arm64: dts: freescale: Fix SP805 clock-names 27e53e23a3 ptp_pch: Load module automatically if ID matches a7b441a2e2 powerpc/fsl/dts: Fix phy-connection-type for fm1mac3 c951a3be5e net_sched: fix NULL deref in fifo_set_limit() 414bb4ead1 phy: mdio: fix memory leak b14f28126c bpf: Fix integer overflow in prealloc_elems_and_freelist() a3d68a4245 bpf, arm: Fix register clobbering in div/mod implementation e0c6e864d2 xtensa: call irqchip_init only when CONFIG_USE_OF is selected d10a2a8f88 xtensa: use CONFIG_USE_OF instead of CONFIG_OF 73711563f5 xtensa: move XCHAL_KIO_* definitions to kmem_layout.h c82cffe171 arm64: dts: qcom: pm8150: use qcom,pm8998-pon binding 14c9c75d48 ARM: dts: imx: Fix USB host power regulator polarity on M53Menlo 720a4dceee ARM: dts: imx: Add missing pinctrl-names for panel on M53Menlo 6b2855ac7e soc: qcom: mdt_loader: Drop PT_LOAD check on hash segment 1179cd690a ARM: dts: qcom: apq8064: Use 27MHz PXO clock as DSI PLL reference bdc189d6b6 soc: qcom: socinfo: Fixed argument passed to platform_set_data() 1a0fe45501 bpf, mips: Validate conditional branch offsets 7ed0402445 MIPS: BPF: Restore MIPS32 cBPF JIT 4239cd380a ARM: dts: qcom: apq8064: use compatible which contains chipid 30d68bf74d ARM: dts: omap3430-sdp: Fix NAND device node 2abb4077fa xen/balloon: fix cancelled balloon action 42fbcbaa8a nfsd4: Handle the NFSv4 READDIR 'dircount' hint being zero f88420197a nfsd: fix error handling of register_pernet_subsys() in init_nfsd() fab338f33c ovl: fix missing negative dentry check in ovl_rename() 4920aae61b mmc: meson-gx: do not use memcpy_to/fromio for dram-access-quirk 47f7bb3dc2 xen/privcmd: fix error handling in mmap-resource processing 9d93cfdaf8 usb: typec: tcpm: handle SRC_STARTUP state if cc changes b53aa224ad USB: cdc-acm: fix break reporting 3135935b7f USB: cdc-acm: fix racy tty buffer accesses 7c2392f03f Partially revert "usb: Kconfig: using select for USB_COMMON dependency" cc109ff104 ANDROID: Different fix for KABI breakage in 5.4.151 in struct sock 17eb597c8b Merge 5.4.152 into android11-5.4-lts faaca480fd Linux 5.4.152 caff281e20 libata: Add ATA_HORKAGE_NO_NCQ_ON_ATI for Samsung 860 and 870 SSD. fecbe957ef silence nfscache allocation warnings with kvzalloc 5546e3987d perf/x86: Reset destroy callback on event init failure 2787cde6cb kvm: x86: Add AMD PMU MSRs to msrs_to_save_all[] ba58770c14 KVM: do not shrink halt_poll_ns below grow_start d67e01e5e0 tools/vm/page-types: remove dependency on opt_file for idle page tracking 65c7e3c973 scsi: ses: Retry failed Send/Receive Diagnostic commands e4e756054d selftests:kvm: fix get_warnings_count() ignoring fscanf() return warn 1f830ab345 selftests: be sure to make khdr before other targets 8b9c1c33e5 usb: dwc2: check return value after calling platform_get_resource() 5d124ee0d2 usb: testusb: Fix for showing the connection speed 350d048cc5 scsi: sd: Free scsi_disk device via put_device() 4f194b5769 ext2: fix sleeping in atomic bugs on error 2d8eb45674 sparc64: fix pci_iounmap() when CONFIG_PCI is not set 61504f62bb xen-netback: correct success/error reporting for the SKB-with-fraglist case 2ecca3b282 net: mdio: introduce a shutdown method to mdio device drivers 4659036941 ANDROID: Fix up KABI breakage in 5.4.151 in struct sock 0454b0c925 Merge 5.4.151 into android11-5.4-lts 31cdcb6d43 Linux 5.4.151 965147067f HID: usbhid: free raw_report buffers in usbhid_stop 6f2f68640b netfilter: ipset: Fix oversized kvmalloc() calls fe9bb925e7 HID: betop: fix slab-out-of-bounds Write in betop_probe 24f3d26091 crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd() 62c5cacb09 usb: hso: remove the bailout parameter fe57d53dd9 usb: hso: fix error handling code of hso_create_net_device d29c7a1a32 hso: fix bailout in error case of probe 1f2b324e82 libnvdimm/pmem: Fix crash triggered when I/O in-flight during unbind dd336267d8 PCI: Fix pci_host_bridge struct device release/free handling e81f3b7e71 net: stmmac: don't attach interface until resume finishes f8ffde0bb9 net: udp: annotate data race around udp_sk(sk)->corkflag 9dbf7e343b HID: u2fzero: ignore incomplete packets without data d518ea0314 ext4: fix potential infinite loop in ext4_dx_readdir() 59c19fdcde ext4: fix reserved space counter leakage c4b8db2b47 ext4: fix loff_t overflow in ext4_max_bitmap_size() 3253c87e1e ipack: ipoctal: fix module reference leak 9c802a0574 ipack: ipoctal: fix missing allocation-failure check 3fd682d461 ipack: ipoctal: fix tty-registration error handling e6a71c173e ipack: ipoctal: fix tty registration race 8657158a3b ipack: ipoctal: fix stack information leak 91d5de0b71 debugfs: debugfs_create_file_size(): use IS_ERR to check for error 98574c91e3 elf: don't use MAP_FIXED_NOREPLACE for elf interpreter mappings 9356e4dceb perf/x86/intel: Update event constraints for ICX 0fcfaa8ed9 af_unix: fix races in sk_peer_pid and sk_peer_cred accesses 694b0cee7f net: sched: flower: protect fl_walk() with rcu 5a31d4e73a net: hns3: do not allow call hns3_nic_net_open repeatedly 87de237b0b scsi: csiostor: Add module softdep on cxgb4 1b6ccfcec6 Revert "block, bfq: honor already-setup queue merges" 753096c38a selftests, bpf: test_lwt_ip_encap: Really disable rp_filter 897d1401d1 e100: fix buffer overrun in e100_get_regs 93372e02f9 e100: fix length calculation in e100_get_regs_len a2624e0934 net: ipv4: Fix rtnexthop len when RTA_FLOW is present c37d3287e7 hwmon: (tmp421) fix rounding for negative values 8a07d5aba3 hwmon: (tmp421) report /PVLD condition as fault ec018021cf sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb 9bee85de2c mac80211-hwsim: fix late beacon hrtimer handling 21c3a84493 mac80211: mesh: fix potentially unaligned access ab85997465 mac80211: limit injected vht mcs/nss in ieee80211_parse_tx_radiotap 87e06c4428 mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug a6c42ae153 hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs 2c30592255 ipvs: check that ip_vs_conn_tab_bits is between 8 and 20 9a571d83ac drm/amd/display: Pass PCI deviceid into DC 3443eb443f x86/kvmclock: Move this_cpu_pvti into kvmclock.h 50149e0866 mac80211: fix use-after-free in CCMP/GCMP RX 956bc3ee31 scsi: ufs: Fix illegal offset in UPIU event trace 44d3c480e4 hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field 200ced5ba7 hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field 6cb01fe630 hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field 504cf969d5 fs-verity: fix signed integer overflow with i_size near S64_MAX b2fb6ce06c usb: cdns3: fix race condition before setting doorbell e2370e1935 cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory 67c98e0231 cpufreq: schedutil: Use kobject release() method to free sugov_tunables 883f7897a2 tty: Fix out-of-bound vmalloc access in imageblit ec298edf02 Merge 5.4.150 into android11-5.4-lts 2abce4ec2a Merge 5.4.149 into android11-5.4-lts 5785e5360a Revert "crypto: public_key: fix overflow during implicit conversion" 3a7dc5b4cf Linux 5.4.150 27f8c4402c qnx4: work around gcc false positive warning bug 3a0f951e37 xen/balloon: fix balloon kthread freezing f80b679381 arm64: dts: marvell: armada-37xx: Extend PCIe MEM space 04783de9c0 thermal/drivers/int340x: Do not set a wrong tcc offset on resume de1c350680 EDAC/synopsys: Fix wrong value type assignment for edac_mode 8ede848bc9 spi: Fix tegra20 build with CONFIG_PM=n d193f7dbf4 net: 6pack: Fix tx timeout and slot time fa56f2c987 alpha: Declare virt_to_phys and virt_to_bus parameter as pointer to volatile af4a142ab7 arm64: Mark __stack_chk_guard as __ro_after_init aeb19da46c parisc: Use absolute_pointer() to define PAGE0 8cd34eb616 qnx4: avoid stringop-overread errors 1214ace614 sparc: avoid stringop-overread errors 113a8edfb9 net: i825xx: Use absolute_pointer for memcpy from fixed memory location 2397ea2db2 compiler.h: Introduce absolute_pointer macro d12ddd843f blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd 9d77988232 sparc32: page align size in arch_dma_alloc ec49f3f7f6 nvme-multipath: fix ANA state updates when a namespace is not present 29917bbb07 xen/balloon: use a kernel thread instead a workqueue 93937596e0 bpf: Add oversize check before call kvcalloc() 7273cb182f ipv6: delay fib6_sernum increase in fib6_add 7432ecc55f m68k: Double cast io functions to unsigned long 29c70b0d33 net: stmmac: allow CSR clock of 300MHz 1da750d1e2 net: macb: fix use after free on rmmod ebb8d26d93 blktrace: Fix uaf in blk_trace access after removing by sysfs 2b5befcd40 md: fix a lock order reversal in md_alloc 42d3711c23 irqchip/gic-v3-its: Fix potential VPE leak on error 71f323f605 irqchip/goldfish-pic: Select GENERIC_IRQ_CHIP to fix build 1b59625da6 scsi: lpfc: Use correct scnprintf() limit 30d373dc35 scsi: qla2xxx: Restore initiator in dual mode d140ccb140 cifs: fix a sign extension bug 1c1062c5cf thermal/core: Potential buffer overflow in thermal_build_list_of_policies() b869901cab fpga: machxo2-spi: Fix missing error code in machxo2_write_complete() 0ebc3e688f fpga: machxo2-spi: Return an error on failure 5bcead7cde tty: synclink_gt: rename a conflicting function name c5f27aedf6 tty: synclink_gt, drop unneeded forward declarations 1deb94d37a scsi: iscsi: Adjust iface sysfs attr detection d0f4a2eeeb net/mlx4_en: Don't allow aRFS for encapsulated packets ae7b957ef0 qed: rdma - don't wait for resources under hw error recovery flow 23716d7153 gpio: uniphier: Fix void functions to remove return value f7fb7dbdfb net/smc: add missing error check in smc_clc_prfx_set() 363438ed5d bnxt_en: Fix TX timeout when TX ring size is set to the smallest 4c4c305291 enetc: Fix illegal access when reading affinity_hint cf9138c966 platform/x86/intel: punit_ipc: Drop wrong use of ACPI_PTR() a8e8b14819 afs: Fix incorrect triggering of sillyrename on 3rd-party invalidation acce91ba0d net: hso: fix muxed tty registration 494260e20a serial: mvebu-uart: fix driver's tx_empty callback 2d7c20db72 xhci: Set HCD flag to defer primary roothub registration 381c8ce0ab btrfs: prevent __btrfs_dump_space_info() to underflow its free space d4ec140e71 erofs: fix up erofs_lookup tracepoint 7751f609ea mcb: fix error handling in mcb_alloc_bus() 406ff5bf72 USB: serial: option: add device id for Foxconn T99W265 4b2cf0faff USB: serial: option: remove duplicate USB device ID 59564b0183 USB: serial: option: add Telit LN920 compositions 5cc674a3f1 USB: serial: mos7840: remove duplicated 0xac24 device ID 20c9fdde30 usb: core: hcd: Add support for deferring roothub registration a6c7d3c2d1 Re-enable UAS for LaCie Rugged USB3-FW with fk quirk 4dc56951a8 staging: greybus: uart: fix tty use after free aa2c274c27 binder: make sure fd closes complete 93fa08e9a3 USB: cdc-acm: fix minor-number release 0dc1cfa7b9 USB: serial: cp210x: add ID for GW Instek GDM-834x Digital Multimeter 85d3493085 usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c d4e7647695 xen/x86: fix PV trap handling on secondary processors 8b06b0f17f cifs: fix incorrect check for null pointer in header_assemble b1f6efa27b usb: musb: tusb6010: uninitialized data in tusb_fifo_write_unaligned() b8c8060651 usb: dwc2: gadget: Fix ISOC transfer complete handling for DDMA ff275c870e usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave f013a5001b usb: gadget: r8a66597: fix a loop in set_feature() aa40438c71 ocfs2: drop acl cache for directories too e74e2950a0 Linux 5.4.149 3825263486 drm/nouveau/nvkm: Replace -ENOSYS with -ENODEV 409cb0b3d4 rtc: rx8010: select REGMAP_I2C 43832bf763 blk-throttle: fix UAF by deleteing timer in blk_throtl_exit() c37a34d797 pwm: stm32-lp: Don't modify HW state in .remove() callback 8a29e68ea8 pwm: rockchip: Don't modify HW state in .remove() callback ed60d2db31 pwm: img: Don't modify HW state in .remove() callback b16f4acf6b nilfs2: fix memory leak in nilfs_sysfs_delete_snapshot_group 594addd436 nilfs2: fix memory leak in nilfs_sysfs_create_snapshot_group 237ca37ca5 nilfs2: fix memory leak in nilfs_sysfs_delete_##name##_group 288c8b5ba5 nilfs2: fix memory leak in nilfs_sysfs_create_##name##_group dc70f0c8c3 nilfs2: fix NULL pointer in nilfs_##name##_attr_release 9c3ba40488 nilfs2: fix memory leak in nilfs_sysfs_create_device_group fb4c7d2923 btrfs: fix lockdep warning while mounting sprout fs 3f2d5c11be ceph: lockdep annotations for try_nonblocking_invalidate 3bbb11261a ceph: request Fw caps before updating the mtime in ceph_write_iter 2c89a856fa dmaengine: xilinx_dma: Set DMA mask for coherent APIs 2f3206199d dmaengine: ioat: depends on !UML 644f1e87fe dmaengine: sprd: Add missing MODULE_DEVICE_TABLE 445a3379f6 parisc: Move pci_dev_is_behind_card_dino to where it is used 2f7bfc07e3 drivers: base: cacheinfo: Get rid of DEFINE_SMP_CALL_CACHE_FUNCTION() a12743d072 thermal/core: Fix thermal_cooling_device_register() prototype c7b9a866ee Kconfig.debug: drop selecting non-existing HARDLOCKUP_DETECTOR_ARCH 3c1d9b650c net: stmmac: reset Tx desc base address before restarting Tx 729f9d5ee3 phy: avoid unnecessary link-up delay in polling mode 81e6b51709 pwm: lpc32xx: Don't modify HW state in .probe() after the PWM chip was registered b94def8a47 profiling: fix shift-out-of-bounds bugs 7e98111cb2 nilfs2: use refcount_dec_and_lock() to fix potential UAF 5607b1bae1 prctl: allow to setup brk for et_dyn executables b40301607c 9p/trans_virtio: Remove sysfs file on probe failure c3b45ea0a3 thermal/drivers/exynos: Fix an error code in exynos_tmu_probe() e106080303 dmaengine: acpi: Avoid comparison GSI with Linux vIRQ 93f8a98ad8 um: virtio_uml: fix memory leak on init failures 4cd05e390a staging: rtl8192u: Fix bitwise vs logical operator in TranslateRxSignalStuff819xUsb() 2f4b67bceb sctp: add param size validation for SCTP_PARAM_SET_PRIMARY cbd10b1189 sctp: validate chunk size in __rcv_asconf_lookup 6a12918e90 ARM: 9098/1: ftrace: MODULE_PLT: Fix build problem without DYNAMIC_FTRACE 2f7974cd7b ARM: 9079/1: ftrace: Add MODULE_PLTS support 1b27a03d12 ARM: 9078/1: Add warn suppress parameter to arm_gen_branch_link() 490be340c8 ARM: 9077/1: PLT: Move struct plt_entries definition to header 278df06460 apparmor: remove duplicate macro list_entry_is_head() f23763ab46 ARM: Qualify enabling of swiotlb_init() 6bfdc3056c s390/pci_mmio: fully validate the VMA before calling follow_pte() bd292c6873 console: consume APC, DM, DCS b0c813fbbf KVM: remember position in kvm->vcpus array 5163578e9d PCI/ACPI: Add Ampere Altra SOC MCFG quirk ec29e33e5c PCI: aardvark: Fix reporting CRS value 3f0e275e43 PCI: pci-bridge-emul: Add PCIe Root Capabilities Register 296895c4f0 PCI: aardvark: Indicate error in 'val' when config read fails 2fcb7b7a1d PCI: pci-bridge-emul: Fix big-endian support c4f92aff87 Merge 5.4.148 into android11-5.4-lts 07e5f23d3f Linux 5.4.148 54ac8339ae s390/bpf: Fix 64-bit subtraction of the -0x80000000 constant a5fc48000b s390/bpf: Fix optimizing out zero-extensions f7f1bac898 net: renesas: sh_eth: Fix freeing wrong tx descriptor 3d32ce5472 ip_gre: validate csum_start only on pull f9b308f730 qlcnic: Remove redundant unlock in qlcnic_pinit_from_rom 93f54354cc fq_codel: reject silly quantum parameters d448b240b1 netfilter: socket: icmp6: fix use-after-scope b79204169d net: dsa: b53: Fix calculating number of switch ports d5c0f016ae perf unwind: Do not overwrite FEATURE_CHECK_LDFLAGS-libunwind-{x86,aarch64} 114bf5776f ARC: export clear_user_page() for modules 9b63c27d6b mtd: rawnand: cafe: Fix a resource leak in the error handling path of 'cafe_nand_probe()' 14e0fdc43d PCI: Sync __pci_register_driver() stub for CONFIG_PCI=n 810f9b6f0a KVM: arm64: Handle PSCI resets before userspace touches vCPU state 5f289dcf0b mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set e1746c27c3 PCI: Fix pci_dev_str_match_path() alloc while atomic bug beaf65f0fe mfd: axp20x: Update AXP288 volatile ranges 4a6c7c818b NTB: perf: Fix an error code in perf_setup_inbuf() 5a16141949 NTB: Fix an error code in ntb_msit_probe() 0980697969 ethtool: Fix an error code in cxgb2.c f336aa92b4 PCI: ibmphp: Fix double unmap of io_mem 0f9550c4f4 block, bfq: honor already-setup queue merges b61a99dda3 net: usb: cdc_mbim: avoid altsetting toggling for Telit LN920 79b584d859 Set fc_nlinfo in nh_create_ipv4, nh_create_ipv6 cf4168c4e0 PCI: Add ACS quirks for Cavium multi-function devices b3435cd968 tracing/probes: Reject events which have the same name of existing one 32280649f0 mfd: Don't use irq_create_mapping() to resolve a mapping e904621ae0 fuse: fix use after free in fuse_read_interrupt() a1eaaa6b7d PCI: Add ACS quirks for NXP LX2xx0 and LX2xx2 platforms 47c4490617 mfd: db8500-prcmu: Adjust map to reality 88834a6253 dt-bindings: mtd: gpmc: Fix the ECC bytes vs. OOB bytes equation 8656566821 mm/memory_hotplug: use "unsigned long" for PFN in zone_for_pfn_range() d291cca2c4 net: hns3: fix the timing issue of VF clearing interrupt sources 65bcb8f73a net: hns3: disable mac in flr process d8fe64c351 net: hns3: change affinity_mask to numa node range dede0381da net: hns3: pad the short tunnel frame before sending to hardware 4bf2c9605d KVM: PPC: Book3S HV: Tolerate treclaim. in fake-suspend mode changing registers 235f782d5e ibmvnic: check failover_pending in login response d3939844eb dt-bindings: arm: Fix Toradex compatible typo c642afd17a qed: Handle management FW error 9ebbb8b964 tcp: fix tp->undo_retrans accounting in tcp_sacktag_one() baf4504771 net: dsa: destroy the phylink instance on any error in dsa_slave_phy_setup 498e765b85 net/af_unix: fix a data-race in unix_dgram_poll e7332a1ac1 vhost_net: fix OoB on sendmsg() failure. 172749c879 events: Reuse value read using READ_ONCE instead of re-reading it cd78d9c996 net/mlx5: Fix potential sleeping in atomic context 48e79555c2 net/mlx5: FWTrace, cancel work on alloc pd error flow 4655f8a5af perf machine: Initialize srcline string member in add_location struct 6808e70a77 tipc: increase timeout in tipc_sk_enqueue() 678787dcfe r6040: Restore MDIO clock frequency after MAC reset efe35db948 net/l2tp: Fix reference count leak in l2tp_udp_recv_core 5ab04a4ffe dccp: don't duplicate ccid when cloning dccp sock 6c4b7a87ba ptp: dp83640: don't define PAGE0 faf9d46542 net-caif: avoid user-triggerable WARN_ON(1) 79ab38864d tipc: fix an use-after-free issue in tipc_recvmsg 08f33350ed x86/mm: Fix kern_addr_valid() to cope with existing but not present entries fde4caf6fe s390/sclp: fix Secure-IPL facility detection 15b674b1e5 drm/etnaviv: add missing MMU context put when reaping MMU mapping b2ec1e6f1d drm/etnaviv: reference MMU context when setting up hardware state 5827dbac41 drm/etnaviv: fix MMU context leak on GPU reset 5e67b38435 drm/etnaviv: exec and MMU state is lost when resetting the GPU 7068030d5e drm/etnaviv: keep MMU context across runtime suspend/resume a7970d4f00 drm/etnaviv: stop abusing mmu_context as FE running marker ee52ccecfe drm/etnaviv: put submit prev MMU context when it exists a9bacefda0 drm/etnaviv: return context from etnaviv_iommu_context_get b56b6c51a9 drm/amd/amdgpu: Increase HWIP_MAX_INSTANCE to 10 c221eb008a PCI: Add AMD GPU multi-function power dependencies d180a373a0 PM: base: power: don't try to use non-existing RTC for storing data 484fbe9cc0 arm64/sve: Use correct size when reinitialising SVE state 2f72542033 bnx2x: Fix enabling network interfaces without VFs 66c88a4793 xen: reset legacy rtc flag for PV domU c7fab1f536 btrfs: fix upper limit for max_inline for page size 64K b9cc70e3dc drm/panfrost: Clamp lock region to Bifrost minimum 9a6c885489 drm/panfrost: Use u64 for size in lock_region 6c635129bf drm/panfrost: Simplify lock_region calculation 825ba38dfd drm/amdgpu: Fix BUG_ON assert d7a936da63 drm/msi/mdp4: populate priv->kms in mdp4_kms_init 90358cb02a net: dsa: lantiq_gswip: fix maximum frame length c1f12f440c lib/test_stackinit: Fix static initializer test 3c232895b8 platform/chrome: cros_ec_proto: Send command again when timeout occurs 0569920e43 memcg: enable accounting for pids in nested pid namespaces d0ddb80bbf mm,vmscan: fix divide by zero in get_scan_count 22b11dbbf9 mm/hugetlb: initialize hugetlb_usage in mm_init 1dc6df795c s390/pv: fix the forcing of the swiotlb f3b57cf090 cpufreq: powernv: Fix init_chip_info initialization in numa=off b5eb54c4a9 scsi: qla2xxx: Sync queue idx with queue_pair_map idx f499a9e9ed scsi: qla2xxx: Changes to support kdump kernel cfa4591328 scsi: BusLogic: Fix missing pr_cont() use a701ae9a0d ovl: fix BUG_ON() in may_delete() when called from ovl_cleanup() 1a2f728b03 parisc: fix crash with signals and alloca 76bebc93e1 net: w5100: check return value after calling platform_get_resource() 3179dd79db fix array-index-out-of-bounds in taprio_change ef9a7867b2 net: fix NULL pointer reference in cipso_v4_doi_free 88a4ed85e8 ath9k: fix sleeping in atomic context 99b950d55e ath9k: fix OOB read ar9300_eeprom_restore_internal 5f70ea4a5c parport: remove non-zero check on count c30ea33b03 net/mlx5: DR, Enable QP retransmission c9095f788d iwlwifi: mvm: fix access to BSS elements f950996d64 iwlwifi: mvm: avoid static queue number aliasing 2db5ae5b28 iwlwifi: mvm: fix a memory leak in iwl_mvm_mac_ctxt_beacon_changed 3da13a1e2a drm/amdkfd: Account for SH/SE count when setting up cu masks. 2af60889c8 ASoC: rockchip: i2s: Fixup config for DAIFMT_DSP_A/B 98381f840f ASoC: rockchip: i2s: Fix regmap_ops hang a1c7bc02e1 usbip:vhci_hcd USB port can get stuck in the disabled state 4f6095b0c9 usbip: give back URBs for unsent unlink requests during cleanup 9a4a680529 usb: musb: musb_dsps: request_irq() after initializing musb d24381e5a7 Revert "USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk set" aa40cf19bf cifs: fix wrong release in sess_alloc_buffer() failed path 39111cbb7b mmc: core: Return correct emmc response in case of ioctl error 26f55b60f2 selftests/bpf: Enlarge select() timeout for test_maps 48f5a5f027 mmc: rtsx_pci: Fix long reads when clock is prescaled 4e773c5553 mmc: sdhci-of-arasan: Check return value of non-void funtions a73bbfabfe of: Don't allow __of_attached_node_sysfs() without CONFIG_SYSFS 2fdf7d38ee ASoC: Intel: Skylake: Fix passing loadable flag for module f6ff4d5609 ASoC: Intel: Skylake: Fix module configuration for KPB and MIXER 736f60bd48 btrfs: tree-log: check btrfs_lookup_data_extent return value 53a72858bc m68knommu: only set CONFIG_ISA_DMA_API for ColdFire sub-arch 3710cff57d drm/exynos: Always initialize mapping in exynos_drm_register_dma() 727c973ffe lockd: lockd server-side shouldn't set fl_ops a18cfd715e usb: chipidea: host: fix port index underflow and UBSAN complains 8deedce385 gfs2: Don't call dlm after protocol is unmounted 50cf8f1b6c staging: rts5208: Fix get_ms_information() heap buffer size 8dfd785ae1 rpc: fix gss_svc_init cleanup on failure 0bc818e023 tcp: enable data-less, empty-cookie SYN with TFO_SERVER_COOKIE_NOT_REQD 2918eca497 serial: sh-sci: fix break handling for sysrq d02a1c5fd7 opp: Don't print an error if required-opps is missing d772d993b0 Bluetooth: Fix handling of LE Enhanced Connection Complete fb8593e8ed nvme-tcp: don't check blk_mq_tag_to_rq when receiving pdu data 072660f6c6 arm64: dts: ls1046a: fix eeprom entries 08825a784e arm64: tegra: Fix compatible string for Tegra132 CPUs a6b69a76c3 ARM: tegra: tamonten: Fix UART pad setting a66049c5ff mac80211: Fix monitor MTU limit so that A-MSDUs get through 1e2842fb7e drm/display: fix possible null-pointer dereference in dcn10_set_clock() cf82fe45be gpu: drm: amd: amdgpu: amdgpu_i2c: fix possible uninitialized-variable access in amdgpu_i2c_router_select_ddc_port() bbaa21da55 net/mlx5: Fix variable type to match 64bit 0d563020b8 Bluetooth: avoid circular locks in sco_sock_connect 37d7ae2b05 Bluetooth: schedule SCO timeouts with delayed_work c408efcb8a selftests/bpf: Fix xdp_tx.c prog section name 350e7501ee drm/msm: mdp4: drop vblank get/put from prepare/complete_commit e545080477 net: ethernet: stmmac: Do not use unreachable() in ipq806x_gmac_probe() ed3400f22b arm64: dts: qcom: sdm660: use reg value for memory node 52f8a30730 ARM: dts: imx53-ppd: Fix ACHC entry e15afa6747 media: tegra-cec: Handle errors of clk_prepare_enable() 53d02b0409 media: TDA1997x: fix tda1997x_query_dv_timings() return value 71de2779e5 media: v4l2-dv-timings.c: fix wrong condition in two for-loops d785cef384 media: imx258: Limit the max analogue gain to 480 33bd83fe3f media: imx258: Rectify mismatch of VTS value 8d179746b3 ASoC: Intel: bytcr_rt5640: Move "Platform Clock" routes to the maps for the matching in-/output 37414bd6ec arm64: tegra: Fix Tegra194 PCIe EP compatible string 5a24034ad8 bonding: 3ad: fix the concurrency between __bond_release_one() and bond_3ad_state_machine_handler() b6cee35839 workqueue: Fix possible memory leaks in wq_numa_init() 9b4f0170e0 Bluetooth: skip invalid hci_sync_conn_complete_evt 7b1718666f ata: sata_dwc_460ex: No need to call phy_exit() befre phy_init() 76cbc142a5 samples: bpf: Fix tracex7 error raised on the missing argument 917eb0bbb8 staging: ks7010: Fix the initialization of the 'sleep_status' structure 44fd61a8bd serial: 8250_pci: make setup_port() parameters explicitly unsigned 4beadefea8 hvsi: don't panic on tty_register_driver failure af0bd97b9d xtensa: ISS: don't panic in rs_init 5418023f81 serial: 8250: Define RX trigger levels for OxSemi 950 devices b050848bba s390: make PCI mio support a machine flag 0dd8da8ad0 s390/jump_label: print real address in a case of a jump label bug 91b4d44c7c flow_dissector: Fix out-of-bounds warnings 8076709052 ipv4: ip_output.c: Fix out-of-bounds warning in ip_copy_addrs() faf0749c90 video: fbdev: riva: Error out if 'pixclock' equals zero ae0d210aa7 video: fbdev: kyro: Error out if 'pixclock' equals zero 98551f0a7b video: fbdev: asiliantfb: Error out if 'pixclock' equals zero 9dff06c505 bpf/tests: Do not PASS tests without actually testing the result 58831317c9 bpf/tests: Fix copy-and-paste error in double word test a23430e79e drm/amd/amdgpu: Update debugfs link_settings output link_rate field in hex 9baa552b2f drm/amd/display: Fix timer_per_pixel unit error 6c78ee1aec tty: serial: jsm: hold port lock when reporting modem line changes 7993ee1733 staging: board: Fix uninitialized spinlock when attaching genpd 995567ded0 usb: gadget: composite: Allow bMaxPower=0 if self-powered 44bbd4e636 USB: EHCI: ehci-mv: improve error handling in mv_ehci_enable() 7b96de5c30 usb: gadget: u_ether: fix a potential null pointer dereference e1480bcb40 usb: host: fotg210: fix the actual_length of an iso packet 33109bdf2c usb: host: fotg210: fix the endpoint's transactional opportunities calculation b190fdb93a igc: Check if num of q_vectors is smaller than max before array access f4bf2fdfe3 drm: avoid blocking in drm_clients_info's rcu section a1d12196c3 Smack: Fix wrong semantics in smk_access_entry() c454b1a215 netlink: Deal with ESRCH error in nlmsg_notify() 5adbbb27bb video: fbdev: kyro: fix a DoS bug by restricting user input 4ee6cc0f52 ARM: dts: qcom: apq8064: correct clock names b9707a9504 iavf: fix locking of critical sections 35429d3aa3 iavf: do not override the adapter state in the watchdog task ab03f15c1d iio: dac: ad5624r: Fix incorrect handling of an optional regulator. 0de0c16739 tipc: keep the skb in rcv queue until the whole data is read fe14f10c07 PCI: Use pci_update_current_state() in pci_enable_device_flags() 7d35690974 crypto: mxs-dcp - Use sg_mapping_iter to copy data 80bec14b4e media: dib8000: rewrite the init prbs logic 4cab14bcff ASoC: atmel: ATMEL drivers don't need HAS_DMA 4a7c6e9159 drm/amdgpu: Fix amdgpu_ras_eeprom_init() d766826eee userfaultfd: prevent concurrent API initialization 7bf2913a5b kbuild: Fix 'no symbols' warning when CONFIG_TRIM_UNUSD_KSYMS=y 0ac2ecb915 MIPS: Malta: fix alignment of the devicetree buffer debdff9600 f2fs: fix to unmap pages from userspace process in punch_hole() 1c28c23dc8 f2fs: fix unexpected ENOENT comes from f2fs_map_blocks() 1ca5b00782 f2fs: fix to account missing .skipped_gc_rwsem ec5cab3798 KVM: PPC: Fix clearing never mapped TCEs in realmode e46ce5a8ab clk: at91: clk-generated: Limit the requested rate to our range 557f6445e3 clk: at91: clk-generated: pass the id of changeable parent at registration d93a37889e clk: at91: sam9x60: Don't use audio PLL 57188e2cac fscache: Fix cookie key hashing e2e3758a2c platform/x86: dell-smbios-wmi: Add missing kfree in error-exit from run_smbios_call ba5d4dc003 KVM: PPC: Book3S HV Nested: Reflect guest PMU in-use to L0 when guest SPRs are live a02309beb2 HID: i2c-hid: Fix Elan touchpad regression f934961bf4 scsi: target: avoid per-loop XCOPY buffer allocations 389946024f powerpc/config: Renable MTD_PHYSMAP_OF db16408d52 scsi: qedf: Fix error codes in qedf_alloc_global_queues() 5e56c8d843 scsi: qedi: Fix error codes in qedi_alloc_global_queues() a90ef02f01 scsi: smartpqi: Fix an error code in pqi_get_raid_map() 3365d41c04 pinctrl: single: Fix error return code in pcs_parse_bits_in_pinctrl_entry() ef476b8d5a scsi: fdomain: Fix error return code in fdomain_probe() 9ee7b45edd SUNRPC: Fix potential memory corruption be09cbd6a3 dma-debug: fix debugfs initialization order 9315497b17 openrisc: don't printk() unconditionally f56ee9af23 f2fs: reduce the scope of setting fsck tag when de->name_len is zero 2a2afb6d26 f2fs: show f2fs instance in printk_ratelimited 25ed049891 RDMA/efa: Remove double QP type assignment b8bb4b2839 powerpc/stacktrace: Include linux/delay.h 02889ac588 vfio: Use config not menuconfig for VFIO_NOIOMMU b900cc4816 pinctrl: samsung: Fix pinctrl bank pin count e69c283621 docs: Fix infiniband uverbs minor number fb42b9801e RDMA/iwcm: Release resources if iw_cm module initialization fails 7930b1f98d IB/hfi1: Adjust pkey entry in index 0 2b1addd585 scsi: bsg: Remove support for SCSI_IOCTL_SEND_COMMAND a02982545e f2fs: quota: fix potential deadlock bd74d6de0b HID: input: do not report stylus battery state as "full" 0656eb5e7e PCI: aardvark: Fix masking and unmasking legacy INTx interrupts 2b58db229e PCI: aardvark: Increase polling delay to 1.5s while waiting for PIO response 0f39f8429c PCI: aardvark: Fix checking for PIO status d810fa6f5f PCI: xilinx-nwl: Enable the clock through CCF d43ad02ad3 PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure 3aa6d023c6 PCI: Restrict ASMedia ASM1062 SATA Max Payload Size Supported 4d2bc69df9 PCI/portdrv: Enable Bandwidth Notification only if port supports it 0445da50b7 ARM: 9105/1: atags_to_fdt: don't warn about stack size 8ec08f1431 libata: add ATA_HORKAGE_NO_NCQ_TRIM for Samsung 860 and 870 SSDs 7cfbf391e8 dmaengine: imx-sdma: remove duplicated sdma_load_context 788122c99d Revert "dmaengine: imx-sdma: refine to load context only once" 86e1abcd14 media: rc-loopback: return number of emitters rather than error 9d91046f6b media: uvc: don't do DMA on stack 1ccb1fa41f VMCI: fix NULL pointer dereference when unmapping queue pair 80d1675903 dm crypt: Avoid percpu_counter spinlock contention in crypt_page_alloc() a6d4ac3f86 power: supply: max17042: handle fails of reading status register 668370dd4c block: bfq: fix bfq_set_next_ioprio_data() cfdd25cd42 crypto: public_key: fix overflow during implicit conversion 3411b481ed arm64: head: avoid over-mapping in map_memory 991b64b89b soc: aspeed: p2a-ctrl: Fix boundary check for mmap 2712f29c44 soc: aspeed: lpc-ctrl: Fix boundary check for mmap 24c245de17 soc: qcom: aoss: Fix the out of bound usage of cooling_devs 603dbb1fa2 pinctrl: ingenic: Fix incorrect pull up/down info eda59ca42f pinctrl: stmfx: Fix hazardous u8[] to unsigned long cast d4acec5e94 tools/thermal/tmon: Add cross compiling support 8a964aa6ed 9p/xen: Fix end of loop tests for list_for_each_entry 7d81fcc203 include/linux/list.h: add a macro to test if entry is pointing to the head 4bc0d1b535 xen: fix setting of max_pfn in shared_info 27f3b7f5c6 powerpc/perf/hv-gpci: Fix counter value parsing 7e9e6d0e07 PCI/MSI: Skip masking MSI-X on Xen PV 2edc06fa38 blk-zoned: allow BLKREPORTZONE without CAP_SYS_ADMIN 8da22cc41a blk-zoned: allow zone management send operations without CAP_SYS_ADMIN cd7b39e7c4 btrfs: reset replace target device to allocation state on close 8554095328 btrfs: wake up async_delalloc_pages waiters after submit d609c63a71 rtc: tps65910: Correct driver module alias 4076dc42c4 Merge branch 'android11-5.4' into 'android11-5.4-lts' Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Idd628e993b6566952e119bfe31f4c8fe87d818a8	2022-01-21 08:26:49 +01:00
Greg Kroah-Hartman	7ada083540	This is the 5.4.170 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmHVgw8ACgkQONu9yGCS aT71vhAAgVauEQ0nyXBUsH7vqKS6tYdcjoOor8FdNYSfoZ7iY6MptIdtHMVA0MxZ 793CRZDc7cyNtNVhGIomSzLPI4Nb/U5g57xfGrIQZ9Yzv1vcDsC8iEU1GLELWVAO 1gX6oyVJMXQb4JrbGGdP3QPqLPa6ekZ07c3/Dt2p32e+yqm3JvrcaDqklR7qSzBi Nx6VWp2ZxbvDqmzhzzVX+wWoB1darxp1I08ZgPMqsAbn78MelxrOxp8asNVuJQip KusrhdA4xSrXHfzYj1oxSAWctA0mlHJVie+/x+DPDKDP7/zIop+58fEbSEPLcDHA d+19gkNuNR0CtmEPACm/DAPU/iKiuK1YhmfGvPWQHdQCGQxxMKAdS0sH7BqQ2NU6 c7QiRA0Q3JNc+D2TGO5e2u1D5jqsVnBRaEAOnrHwnX6Dx27I8vwIsSKF1Si6TCdU S7whO8n1r7are5Ahaak25qR83wIpn/2fL4Q0AzP7Ox9kue7ceDQ42RfPzNoYh3LS ITJxRbxZYsnOHjlDS4dc5Hih+WioclSALmYhzSbWsjepzyv0EVEup6vzBffY5A4k ENlXQOCV7jZdfZ+ZdMI+kR9cTGO1F7Le5UKp4H+a0qpY/MWIlUI1C7qWDp5YZTsi 2iYwzrOpKCgqrMBhAR2jHeqmqItkal1dsTvrh2Lwc+3FPYRjNoo= =Lkh+ -----END PGP SIGNATURE----- Merge 5.4.170 into android11-5.4-lts Changes in 5.4.170 HID: asus: Add depends on USB_HID to HID_ASUS Kconfig option tee: handle lookup of shm with reference count 0 Input: i8042 - add deferred probe support Input: i8042 - enable deferred probe quirk for ASUS UM325UA tomoyo: Check exceeded quota early in tomoyo_domain_quota_is_ok(). platform/x86: apple-gmux: use resource_size() with res memblock: fix memblock_phys_alloc() section mismatch error recordmcount.pl: fix typo in s390 mcount regex selinux: initialize proto variable in selinux_ip_postroute_compat() scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write() net/mlx5: DR, Fix NULL vs IS_ERR checking in dr_domain_init_resources udp: using datalen to cap ipv6 udp max gso segments selftests: Calculate udpgso segment count without header adjustment sctp: use call_rcu to free endpoint net: usb: pegasus: Do not drop long Ethernet frames net: lantiq_xrx200: fix statistics of received bytes NFC: st21nfca: Fix memory leak in device probe and remove ionic: Initialize the 'lif->dbid_inuse' bitmap net/mlx5e: Fix wrong features assignment in case of error selftests/net: udpgso_bench_tx: fix dst ip argument net/ncsi: check for error return from call to nla_put_u32 fsl/fman: Fix missing put_device() call in fman_port_probe i2c: validate user data in compat ioctl nfc: uapi: use kernel size_t to fix user-space builds uapi: fix linux/nfc.h userspace compilation errors xhci: Fresco FL1100 controller should not have BROKEN_MSI quirk set. usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear. usb: mtu3: add memory barrier before set GPD's HWO usb: mtu3: fix list_head check warning usb: mtu3: set interval of FS intr and isoc endpoint binder: fix async_free_space accounting for empty parcels scsi: vmw_pvscsi: Set residual data length conditionally Input: appletouch - initialize work before device registration Input: spaceball - fix parsing of movement data packets net: fix use-after-free in tw_timer_handler perf script: Fix CPU filtering of a script's switch events Linux 5.4.170 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ic66d754505081f001b420af0ee4c8da1edf5c27f	2022-01-05 13:23:05 +01:00
Todd Kjos	103b16a8c5	binder: fix async_free_space accounting for empty parcels ... commit cfd0d84ba28c18b531648c9d4a35ecca89ad9901 upstream. In 4.13, commit 74310e06be ("android: binder: Move buffer out of area shared with user space") fixed a kernel structure visibility issue. As part of that patch, sizeof(void *) was used as the buffer size for 0-length data payloads so the driver could detect abusive clients sending 0-length asynchronous transactions to a server by enforcing limits on async_free_size. Unfortunately, on the "free" side, the accounting of async_free_space did not add the sizeof(void *) back. The result was that up to 8-bytes of async_free_space were leaked on every async transaction of 8-bytes or less. These small transactions are uncommon, so this accounting issue has gone undetected for several years. The fix is to use "buffer_size" (the allocated buffer size) instead of "size" (the logical buffer size) when updating the async_free_space during the free operation. These are the same except for this corner case of asynchronous transactions with payloads < 8 bytes. Fixes: 74310e06be ("android: binder: Move buffer out of area shared with user space") Signed-off-by: Todd Kjos <tkjos@google.com> Cc: stable@vger.kernel.org # 4.14+ Link: https://lore.kernel.org/r/20211220190150.2107077-1-tkjos@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-01-05 12:37:46 +01:00
Greg Kroah-Hartman	a91f4fe26c	This is the 5.4.165 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmG4oNgACgkQONu9yGCS aT7/Rw//UdbaPGmrtR7mUi9mXH/BVcD/M5eIFqeKvMWrCSriSN+C5otRWomNNySh NGTivPXmzVBKTub1TUPCNRrTFHWOn76VqLG1ecm4W6q9bxsKBsLrp2WuUdzLYi76 o+3+MurzbqVC10M26NQGXWY7pF+WOTtxn3SwJVQ4UR7YDzxdP2gRvRvTzam5DjzR D2q6escg33v+IGCwVTUluTKzya7YJhtsSrlzZZhhxvP60sOwV4GT7rCHXr9mM33w mvqoqftKMti6HUSaR1VvL+bclctCoYqedwcS/RsN9qv+e/wOMNFy/GsPmTzYh7E1 wWzjDS9/V4Oo47vFm237deKFSi6vXT7kQusb3uUTizca6N5xpwZNSzLGuJTdQkKP 7qZUMbx1e1f904P7mruWe+47Ktu1JCP6B4xo3yBNUTsmzngYqa2WA6pII+iEePtF KF1P4eb5Roza3NhVO1eKj8dBU6ZqveObX4jIxupl6skJJyK4cT0oqAJRJCSj29Cw TjJQOxLzp3Q/iOd+kdZQZU8Q9qxJIqEBRhoPOabTmQfV9tnNBFuPRlOj0SDyQguY 30WMLnFlPN/giMMXc7UKrJ3aX6sQSk4qYX4y75a6U+FKF4C52NiunUiIHk2BJljp hytIooKlAAheR9bMJJJO9qelWWFuo9mhQuDb/p37oAqRAtv3MIg= =5lsH -----END PGP SIGNATURE----- Merge 5.4.165 into android11-5.4-lts Changes in 5.4.165 serial: tegra: Change lower tolerance baud rate limit for tegra20 and tegra30 ntfs: fix ntfs_test_inode and ntfs_init_locked_inode function type HID: quirks: Add quirk for the Microsoft Surface 3 type-cover HID: google: add eel USB id HID: add hid_is_usb() function to make it simpler for USB detection HID: add USB_HID dependancy to hid-prodikeys HID: add USB_HID dependancy to hid-chicony HID: add USB_HID dependancy on some USB HID drivers HID: bigbenff: prevent null pointer dereference HID: wacom: fix problems when device is not a valid USB device HID: check for valid USB device for many HID drivers can: kvaser_usb: get CAN clock frequency from device can: kvaser_pciefd: kvaser_pciefd_rx_error_frame(): increase correct stats->{rx,tx}_errors counter can: sja1000: fix use after free in ems_pcmcia_add_card() nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done selftests: netfilter: add a vrf+conntrack testcase vrf: don't run conntrack on vrf with !dflt qdisc bpf: Fix the off-by-two error in range markings ice: ignore dropped packets during init bonding: make tx_rebalance_counter an atomic nfp: Fix memory leak in nfp_cpp_area_cache_add() seg6: fix the iif in the IPv6 socket control block udp: using datalen to cap max gso segments iavf: restore MSI state on reset iavf: Fix reporting when setting descriptor count IB/hfi1: Correct guard on eager buffer deallocation mm: bdi: initialize bdi_min_ratio when bdi is unregistered ALSA: ctl: Fix copy of updated id with element read/write ALSA: hda/realtek - Add headset Mic support for Lenovo ALC897 platform ALSA: pcm: oss: Fix negative period/buffer sizes ALSA: pcm: oss: Limit the period size to 16MB ALSA: pcm: oss: Handle missing errors in snd_pcm_oss_change_params*() btrfs: clear extent buffer uptodate when we fail to write it btrfs: replace the BUG_ON in btrfs_del_root_ref with proper error handling nfsd: Fix nsfd startup race (again) tracefs: Have new files inherit the ownership of their parent clk: qcom: regmap-mux: fix parent clock lookup drm/syncobj: Deal with signalled fences in drm_syncobj_find_fence. can: pch_can: pch_can_rx_normal: fix use after free can: m_can: Disable and ignore ELO interrupt x86/sme: Explicitly map new EFI memmap table as encrypted libata: add horkage for ASMedia 1092 wait: add wake_up_pollfree() binder: use wake_up_pollfree() signalfd: use wake_up_pollfree() aio: keep poll requests on waitqueue until completed aio: fix use-after-free due to missing POLLFREE handling tracefs: Set all files to the same group ownership as the mount option block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2) qede: validate non LSO skb length ASoC: qdsp6: q6routing: Fix return value from msm_routing_put_audio_mixer i40e: Fix failed opcode appearing if handling messages from VF i40e: Fix pre-set max number of queues for VF mtd: rawnand: fsmc: Take instruction delay into account mtd: rawnand: fsmc: Fix timing computation dt-bindings: net: Reintroduce PHY no lane swap binding tools build: Remove needless libpython-version feature check that breaks test-all fast path net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero net: altera: set a couple error code in probe() net: fec: only clear interrupt of handling queue in fec_enet_rx_queue() net, neigh: clear whole pneigh_entry at alloc time net/qla3xxx: fix an error code in ql_adapter_up() selftests/fib_tests: Rework fib_rp_filter_test() USB: gadget: detect too-big endpoint 0 requests USB: gadget: zero allocate endpoint 0 buffers usb: core: config: fix validation of wMaxPacketValue entries xhci: Remove CONFIG_USB_DEFAULT_PERSIST to prevent xHCI from runtime suspending usb: core: config: using bit mask instead of individual bits xhci: avoid race between disable slot command and host runtime suspend iio: trigger: Fix reference counting iio: trigger: stm32-timer: fix MODULE_ALIAS iio: stk3310: Don't return error code in interrupt handler iio: mma8452: Fix trigger reference couting iio: ltr501: Don't return error code in trigger handler iio: kxsd9: Don't return error code in trigger handler iio: itg3200: Call iio_trigger_notify_done() on error iio: dln2-adc: Fix lockdep complaint iio: dln2: Check return value of devm_iio_trigger_register() iio: at91-sama5d2: Fix incorrect sign extension iio: adc: axp20x_adc: fix charging current reporting on AXP22x iio: ad7768-1: Call iio_trigger_notify_done() on error iio: accel: kxcjk-1013: Fix possible memory leak in probe and remove irqchip/armada-370-xp: Fix return value of armada_370_xp_msi_alloc() irqchip/armada-370-xp: Fix support for Multi-MSI interrupts irqchip/irq-gic-v3-its.c: Force synchronisation when issuing INVALL irqchip: nvic: Fix offset for Interrupt Priority Offsets misc: fastrpc: fix improper packet size calculation bpf: Add selftests to cover packet access corner cases Linux 5.4.165 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I756efb854dc947509cf712a292eab0bf72f32694	2021-12-14 15:19:08 +01:00
Eric Biggers	1a478a0522	binder: use wake_up_pollfree() ... commit a880b28a71e39013e357fd3adccd1d8a31bc69a8 upstream. wake_up_poll() uses nr_exclusive=1, so it's not guaranteed to wake up all exclusive waiters. Yet, POLLFREE *must* wake up all waiters. epoll and aio poll are fortunately not affected by this, but it's very fragile. Thus, the new function wake_up_pollfree() has been introduced. Convert binder to use wake_up_pollfree(). Reported-by: Linus Torvalds <torvalds@linux-foundation.org> Fixes: f5cb779ba1 ("ANDROID: binder: remove waitqueue when thread exits.") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20211209010455.42744-3-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-12-14 14:49:02 +01:00
Eric Biggers	da5ecad710	UPSTREAM: binder: use wake_up_pollfree() ... commit a880b28a71e39013e357fd3adccd1d8a31bc69a8 upstream. wake_up_poll() uses nr_exclusive=1, so it's not guaranteed to wake up all exclusive waiters. Yet, POLLFREE *must* wake up all waiters. epoll and aio poll are fortunately not affected by this, but it's very fragile. Thus, the new function wake_up_pollfree() has been introduced. Convert binder to use wake_up_pollfree(). Reported-by: Linus Torvalds <torvalds@linux-foundation.org> Fixes: f5cb779ba1 ("ANDROID: binder: remove waitqueue when thread exits.") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20211209010455.42744-3-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Bug: 185125206 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I0f08d9f9a40348d7d2381607fabe3648416ab2a2	2021-12-12 16:44:26 +01:00
Greg Kroah-Hartman	b2d37d0916	Merge branch 'android11-5.4' into 'android11-5.4-lts' ... Sync up with android11-5.4 for the following commits: b0f930a58e BACKPORT: f2fs: relocate inline conversion from mmap() to mkwrite() 4f4602b711 BACKPORT: f2fs: support RO feature e6fd4c5c6a BACKPORT: f2fs: fix wrong total_sections check and fsmeta check ce664fbdcc BACKPORT: FROMGIT: binder: fix freeze race b1232b020f FROMGIT: binder: BINDER_GET_FROZEN_INFO ioctl a02d0f685d FROMGIT: binder: use EINTR for interrupted wait for work e658e9e4bc BACKPORT: FROMGIT: binder: BINDER_FREEZE ioctl 63ef444773 ANDROID: usb: gadget: f_accessory: Mitgate handling of non-existent USB request 50c9c8cb33 FROMGIT: binder: fix test regression due to sender_euid change 1c1f571840 BACKPORT: binder: use cred instead of task for getsecid ea1a2391d5 BACKPORT: binder: use cred instead of task for selinux checks 1fe8a2bb64 BACKPORT: binder: use euid from cred instead of using task a080050156 ANDROID: setlocalversion: make KMI_GENERATION optional e785a25f52 Revert "ANDROID: GKI: Enable CHACHA20POLY1305 and XCBC" Change-Id: Ica7d80e62dcd4b12f7294bcc4b5c9291491ad37b Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2021-12-09 11:01:27 +01:00
Todd Kjos	aaa83768ba	binder: fix test regression due to sender_euid change ... commit c21a80ca0684ec2910344d72556c816cb8940c01 upstream. This is a partial revert of commit 29bc22ac5e5b ("binder: use euid from cred instead of using task"). Setting sender_euid using proc->cred caused some Android system test regressions that need further investigation. It is a partial reversion because subsequent patches rely on proc->cred. Fixes: 29bc22ac5e5b ("binder: use euid from cred instead of using task") Cc: stable@vger.kernel.org # 4.4+ Acked-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: Todd Kjos <tkjos@google.com> Change-Id: I9b1769a3510fed250bb21859ef8beebabe034c66 Link: https://lore.kernel.org/r/20211112180720.2858135-1-tkjos@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-12-01 09:23:28 +01:00
Li Li	ce664fbdcc	BACKPORT: FROMGIT: binder: fix freeze race ... Currently cgroup freezer is used to freeze the application threads, and BINDER_FREEZE is used to freeze the corresponding binder interface. There's already a mechanism in ioctl(BINDER_FREEZE) to wait for any existing transactions to drain out before actually freezing the binder interface. But freezing an app requires 2 steps, freezing the binder interface with ioctl(BINDER_FREEZE) and then freezing the application main threads with cgroupfs. This is not an atomic operation. The following race issue might happen. 1) Binder interface is frozen by ioctl(BINDER_FREEZE); 2) Main thread A initiates a new sync binder transaction to process B; 3) Main thread A is frozen by "echo 1 > cgroup.freeze"; 4) The response from process B reaches the frozen thread, which will unexpectedly fail. This patch provides a mechanism to check if there's any new pending transaction happening between ioctl(BINDER_FREEZE) and freezing the main thread. If there's any, the main thread freezing operation can be rolled back to finish the pending transaction. Furthermore, the response might reach the binder driver before the rollback actually happens. That will still cause failed transaction. As the other process doesn't wait for another response of the response, the response transaction failure can be fixed by treating the response transaction like an oneway/async one, allowing it to reach the frozen thread. And it will be consumed when the thread gets unfrozen later. NOTE: This patch reuses the existing definition of struct binder_frozen_status_info but expands the bit assignments of __u32 member sync_recv. To ensure backward compatibility, bit 0 of sync_recv still indicates there's an outstanding sync binder transaction. This patch adds new information to bit 1 of sync_recv, indicating the binder transaction happens exactly when there's a race. If an existing userspace app runs on a new kernel, a sync binder call will set bit 0 of sync_recv so ioctl(BINDER_GET_FROZEN_INFO) still return the expected value (true). The app just doesn't check bit 1 intentionally so it doesn't have the ability to tell if there's a race. This behavior is aligned with what happens on an old kernel which doesn't set bit 1 at all. A new userspace app can 1) check bit 0 to know if there's a sync binder transaction happened when being frozen - same as before; and 2) check bit 1 to know if that sync binder transaction happened exactly when there's a race - a new information for rollback decision. Fixes: 432ff1e91694 ("binder: BINDER_FREEZE ioctl") Acked-by: Todd Kjos <tkjos@google.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Li Li <dualli@google.com> Test: stress test with apps being frozen and initiating binder calls at the same time, confirmed the pending transactions succeeded. Link: https://lore.kernel.org/r/20210910164210.2282716-2-dualli@chromium.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Bug: 198493121 (cherry picked from commit b564171ade70570b7f335fa8ed17adb28409e3ac git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git char-misc-linus) Change-Id: I488ba75056f18bb3094ba5007027b76b5caebec9	2021-11-30 15:38:33 -08:00