mirror of
https://github.com/LineageOS/android_kernel_fxtec_sm6115.git
synced 2026-08-19 12:11:10 +00:00
6e00a9207c70d7db8527d073cd71d4af56fdb00a
4433 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
| 2665d6b5ee |
UPSTREAM: ipv6: constify rt6_nexthop()
There is no functional change in this patch, it only prepares the next one. rt6_nexthop() will be used by ip6_dst_lookup_neigh(), which uses const variables. Change-Id: I58b854002c39ba63a9454699f284da913041b7bb Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Reported-by: kbuild test robot <lkp@intel.com> Acked-by: Nick Desaulniers <ndesaulniers@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> |
|||
| 23ea704e18 |
Merge tag 'v4.19.325-cip132' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip into android13-4.19-kona
version 4.19.325-cip132 * tag 'v4.19.325-cip132' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip: CIP: Bump version suffix to -cip132 after merge from cip/linux-4.19.y-st tree Update localversion-st, tree is up-to-date with 5.10.254. x86/CPU: Fix FPDSS on Zen1 seg6: separate dst_cache for input and output paths in seg6 lwtunnel netfilter: nft_ct: fix use-after-free in timeout object destroy apparmor: fix differential encoding verification apparmor: fix missing bounds check on DEFAULT table in verify_dfa() ext4: convert inline data to extents when truncate exceeds inline size virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl crypto: authencesn - Fix src offset when decrypting in-place crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption crypto: authenc - use memcpy_sglist() instead of null skcipher crypto: algif_aead - snapshot IV for async AEAD requests crypto: algif_aead - Revert to operating out-of-place crypto: algif_aead - use memcpy_sglist() instead of null skcipher crypto: doc - fix kernel-doc notation in chacha.c and af_alg.c Buffer overflow in drivers/xen/sys-hypervisor.c xen/privcmd: fix double free via VMA splitting crypto: algif_aead - Fix minimum RX size check for decryption crypto: scatterwalk - Backport memcpy_sglist() batman-adv: avoid OGM aggregation when skb tailroom is insufficient device property: Check fwnode->secondary when finding properties device property: Check fwnode->secondary in fwnode_graph_get_next_endpoint() device property: Retrieve fwnode from of_node via accessor media: device property: Return true in fwnode_device_is_available for NULL ops ext4: fix the might_sleep() warnings in kvfree() mm/huge_memory: fix folio isn't locked in softleaf_to_folio() usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop usb: gadget: f_hid: move list and spinlock inits from bind to alloc net: rfkill: prevent unlimited numbers of rfkill events from being created cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path cpufreq: governor: Free dbs_data directly when gov->init() fails xen/privcmd: unregister xenstore notifier on module exit rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING) net: stmmac: fix integer underflow in chain mode net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure mmc: vub300: fix NULL-deref on disconnect net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() batman-adv: reject oversized global TT response buffers arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity wifi: brcmsmac: Fix dma_free_coherent() size tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG apparmor: fix unprivileged local user can do privileged policy management apparmor: Fix double free of ns_name in aa_replace_profiles() apparmor: fix side-effect bug in match_char() macro usage apparmor: fix: limit the number of levels of policy namespaces apparmor: replace recursive profile removal with iterative approach apparmor: fix memory leak in verify_header apparmor: validate DFA start states are in bounds in unpack_pdb mm/rmap: fix two comments related to huge_pmd_unshare() mm/hugetlb: fix two comments related to huge_pmd_unshare() mm/hugetlb: make detecting shared pte more reliable Input: uinput - take event lock when submitting FF request "event" Input: uinput - fix circular locking dependency with ff-core xfrm_user: fix info leak in build_report() wifi: rt2x00usb: fix devres lifetime usb: gadget: f_uac1_legacy: validate control request size usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer USB: dummy-hcd: Fix locking/synchronization error vxlan: validate ND option lengths in vxlan_na_create comedi: me4000: Fix potential overrun of firmware buffer comedi: me_daq: Fix potential overrun of firmware buffer comedi: ni_atmio16d: Fix invalid clean-up after failed attach comedi: Reinit dev->spinlock between attachments to low-level drivers comedi: dt2815: add hardware detection to prevent crash bridge: br_nd_send: validate ND option lengths usb: ulpi: fix double free in ulpi_register_interface() error path usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive iio: gyro: mpu3050: Fix out-of-sequence free_irq() iio: gyro: mpu3050: Move iio_device_register() to correct location iio: gyro: mpu3050: Fix irq resource leak iio: gyro: mpu3050: Fix incorrect free_irq() variable Input: xpad - add support for Razer Wolverine V3 Pro USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam USB: serial: option: add support for Rolling Wireless RW135R-GL USB: serial: io_edgeport: add support for Blackbox IC135A drm/ast: dp501: Fix initialization of SCU2C MIPS: Fix the GCC version check for `__multi3' workaround Bluetooth: SMP: force responder MITM requirements before building the pairing response Bluetooth: SMP: derive legacy responder STK authentication from MITM state ALSA: ctxfi: Fix missing SPDIFI1 index handling ALSA: caiaq: fix stack out-of-bounds read in init_card USB: serial: option: add MeiG Smart SRM825WN drm/ioc32: stop speculation on the drm_compat_ioctl path media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar Revert "media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar" drm/vmwgfx: Add seqno waiter for sync_files Revert "drm/vmwgfx: Add seqno waiter for sync_files" ipv6: avoid overflows in ip6_datagram_send_ctl() net/sched: cls_flow: fix NULL pointer dereference on shared blocks net/sched: cls_fw: fix NULL pointer dereference on shared blocks net/x25: Fix overflow when accumulating packets net/x25: Fix potential double free of skb net: macb: properly unregister fixed rate clocks net: macb: fix clk handling on PCI glue driver removal Bluetooth: MGMT: validate LTK enc_size on load netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent netfilter: nf_conntrack_helper: pass helper to expect cleanup netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr netfilter: x_tables: ensure names are nul-terminated netfilter: nfnetlink_log: account for netlink header size net: ipv6: flowlabel: defer exclusive option free until RCU teardown bpf: Fix regsafe() for pointers to packet net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec ipv6: prevent possible UaF in addrconf_permanent_addr() net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() bridge: br_nd_send: linearize skb before parsing ND options ip6_tunnel: clear skb2->cb[] in ip4ip6_err() ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() tg3: Fix race for querying speed/duplex net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak crypto: af-alg - fix NULL pointer dereference in scatterwalk HID: multitouch: Check to ensure report responses match the request atm: lec: fix use-after-free in sock_def_readable() HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA dmaengine: xilinx_dma: Program interrupt delay timeout btrfs: fix lost error when running device stats on multiple devices fs btrfs: fix super block offset in error message in btrfs_validate_super() dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA dmaengine: xilinx: xilinx_dma: Fix dma_device directions ext4: reject mount if bigalloc with s_first_data_block != 0 ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() ext4: make recently_deleted() properly work with lazy itable initialization scsi: ses: Handle positive SCSI error from ses_recv_diag() scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() alarmtimer: Fix argument order in alarm_timer_forward() cpufreq: conservative: Reset requested_freq on limits change s390/barrier: Make array_index_mask_nospec() __always_inline sysctl: fix uninitialized variable in proc_do_large_bitmap ACPICA: Allow address_space_handler Install and _REG execution as 2 separate steps ACPICA: include/acpi/acpixf.h: Fix indentation drm/i915/gmbus: fix spurious timeout on 512-byte burst reads scsi: scsi_transport_sas: Fix the maximum channel scanning issue RDMA/rw: Fall back to direct SGE on MR pool exhaustion net: macb: use the current queue number for stats netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop net: fix fanout UAF in packet_release() via NETDEV_UP race rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size openvswitch: validate MPLS set/set_masked payload length net: openvswitch: Avoid releasing netdev before teardown completes pinctrl: mediatek: common: Fix probe failure for devices without EINT Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb Bluetooth: hci_ll: Fix firmware leak on error path Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() af_key: validate families in pfkey_send_migrate() xfrm: call xdo_dev_state_delete during state update dma-buf: Include ioctl.h in UAPI header xen/privcmd: restrict usage in unprivileged domU i2c: fsi: Fix a potential leak in fsi_i2c_probe() icmp: fix NULL pointer dereference in icmp_tag_validation() nfnetlink_osf: validate individual option lengths in fingerprints net: bonding: fix NULL deref in bond_debug_rlb_hash_show udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n net: macb: fix uninitialized rx_fs_lock wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom wifi: mac80211: fix NULL deref in mesh_matches_local() PM: runtime: Fix a race condition related to device removal net: bcmgenet: increase WoL poll timeout netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() netfilter: xt_time: use unsigned int for monthday bit shift netfilter: xt_CT: drop pending enqueued packets on template removal netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() netfilter: ctnetlink: remove refcounting in expectation dumpers net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect Bluetooth: HIDP: Fix possible UAF Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU staging: rtl8723bs: fix null dereference in find_network net/tcp-md5: Fix MAC comparison to be constant-time ALSA: pcm: fix wait_time calculations can: gs_usb: gs_can_open(): always configure bitrates before starting device usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling nfsd: fix heap overflow in NFSv4.0 LOCK replay cache arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation smb: client: fix iface port assignment in parse_server_interfaces iio: light: bh1780: fix PM runtime leak on error path tracing: Fix syscall events activation by ensuring refcount hits zero s390/xor: Fix xor_xc_2() inline assembly constraints drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink smb: client: Don't log plaintext credentials in cifs_set_cifscreds wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() wifi: libertas: fix use-after-free in lbs_free_adapter() ext4: fix dirtyclusters double decrement on fs shutdown ext4: drop extent cache when splitting extent fails drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() net: Handle napi_schedule() calls from non-interrupt drm/radeon: apply state adjust rules to some additional HAINAN vairants serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access net: macb: fix use-after-free access to PTP clock nvdimm/bus: Fix potential use after free in asynchronous initialization iio: chemical: bme680: Fix measurement wait duration calculation iio: potentiometer: mcp4131: fix double application of wiper shift iio: dac: ds4424: reject -128 RAW value btrfs: abort transaction on failure to update root in the received subvol ioctl x86/apic: Disable x2apic on resume if the kernel expects so drm/amdgpu: Fix use-after-free race in VM acquire net: ethernet: arc: emac: quiesce interrupts before requesting IRQ net: ncsi: fix skb leak in error paths parisc: Fix initial page table creation for boot nouveau/dpcd: return EBUSY for aux xfer if the device is asleep parisc: Increase initial mapping to 64 MB with KALLSYMS batman-adv: Avoid double-rtnl_lock ELP metric worker media: dvb-net: fix OOB access in ULE extension header tables staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index() usb: image: mdc800: kill download URB on timeout usb: mdc800: handle signal and read racing usb: class: cdc-wdm: fix reordering issue in read code path USB: usbcore: Introduce usb_bulk_msg_killable() usb: misc: uss720: properly clean up reference in uss720_probe() usb: yurex: fix race in probe usb: xhci: Fix memory leak in xhci_disable_slot() usb/core/quirks: Add Huawei ME906S-device to wakeup quirk net: usb: lan78xx: skip LTM configuration for LAN7850 net: usb: lan78xx: fix silent drop of packets with checksum errors cgroup: fix race between task migration and iteration e1000/e1000e: Fix leak in DMA error cleanup i40e: fix src IP mask checks and memcpy argument names in cloud filter nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set sched: idle: Make skipping governor callbacks more consistent netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path netfilter: x_tables: guard option walkers against 1-byte tail reads can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value serial: caif: hold tty->link reference in ldisc_open and ser_release net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit powerpc: 83xx: km83xx: Fix keymile vendor prefix remoteproc: sysmon: Correct subsys_name_len type in QMI request powerpc/uaccess: Fix inline assembly for clang build on PPC32 scsi: ses: Fix devices attaching to different hosts ACPI: OSI: Add DMI quirk for Acer Aspire One D255 unshare: fix unshare_fs() handling ACPI: PM: Save NVS memory on Lenovo G70-35 scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled nfc: rawsock: cancel tx_work before socket teardown nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback nfc: nci: free skb on nci_transceive early error paths net: nfc: nci: Fix zero-length proprietary notifications amd-xgbe: fix sleep while atomic on suspend/resume xen/acpi-processor: fix _CST detection using undersized evaluation buffer wifi: wlcore: Fix a locking bug can: bcm: fix locking for bcm_op runtime updates atm: lec: fix null-ptr-deref in lec_arp_clear_vccs platform/x86: thinkpad_acpi: Fix errors reading battery thresholds drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() Squashfs: check metadata block offset is within range wifi: radiotap: reject radiotap with unknown bits ALSA: usb-audio: Use correct version for UAC3 header validation can: ucan: Fix infinite loop from zero-length messages can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message net: usb: pegasus: validate USB endpoints net: usb: kalmia: validate USB endpoints net: usb: kaweth: validate USB endpoints nfc: pn533: properly drop the usb interface reference on disconnect media: dvb-core: fix wrong reinitialization of ringbuffer on reopen net: arcnet: com20020-pci: fix support for 2.5Mbit cards ALSA: hda/conexant: Add quirk for HP ZBook Studio G4 clk: tegra: tegra124-emc: fix device leak on set_rate() drm/tegra: dsi: fix device leak on probe ARM: omap2: Fix reference count leaks in omap_control_init() ARM: OMAP2+: add missing of_node_put before break and return ARM: clean up the memset64() C wrapper Change-Id: If58eb7898e90d049cd97232a5f2c1fc971671b1f |
|||
| b90f1bd010 |
Bluetooth: SMP: force responder MITM requirements before building the pairing response
commit d05111bfe37bfd8bd4d2dfe6675d6bdeef43f7c7 upstream.
smp_cmd_pairing_req() currently builds the pairing response from the
initiator auth_req before enforcing the local BT_SECURITY_HIGH
requirement. If the initiator omits SMP_AUTH_MITM, the response can
also omit it even though the local side still requires MITM.
tk_request() then sees an auth value without SMP_AUTH_MITM and may
select JUST_CFM, making method selection inconsistent with the pairing
policy the responder already enforces.
When the local side requires HIGH security, first verify that MITM can
be achieved from the IO capabilities and then force SMP_AUTH_MITM in the
response in both rsp.auth_req and auth. This keeps the responder auth bits
and later method selection aligned.
Fixes:
|
|||
| a573374472 |
Bluetooth: SMP: derive legacy responder STK authentication from MITM state
commit 20756fec2f0108cb88e815941f1ffff88dc286fe upstream.
The legacy responder path in smp_random() currently labels the stored
STK as authenticated whenever pending_sec_level is BT_SECURITY_HIGH.
That reflects what the local service requested, not what the pairing
flow actually achieved.
For Just Works/Confirm legacy pairing, SMP_FLAG_MITM_AUTH stays clear
and the resulting STK should remain unauthenticated even if the local
side requested HIGH security. Use the established MITM state when
storing the responder STK so the key metadata matches the pairing result.
This also keeps the legacy path aligned with the Secure Connections code,
which already treats JUST_WORKS/JUST_CFM as unauthenticated.
Fixes:
|
|||
| 7188b7cfd1 |
Bluetooth: MGMT: validate LTK enc_size on load
[ Upstream commit b8dbe9648d69059cfe3a28917bfbf7e61efd7f15 ]
Load Long Term Keys stores the user-provided enc_size and later uses
it to size fixed-size stack operations when replying to LE LTK
requests. An enc_size larger than the 16-byte key buffer can therefore
overflow the reply stack buffer.
Reject oversized enc_size values while validating the management LTK
record so invalid keys never reach the stored key state.
Fixes:
|
|||
| 755d5b6d1d |
Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop
[ Upstream commit 25f420a0d4cfd61d3d23ec4b9c56d9f443d91377 ]
l2cap_config_req() processes CONFIG_REQ for channels in BT_CONNECTED
state to support L2CAP reconfiguration (e.g. MTU changes). However,
since both CONF_INPUT_DONE and CONF_OUTPUT_DONE are already set from
the initial configuration, the reconfiguration path falls through to
l2cap_ertm_init(), which re-initializes tx_q, srej_q, srej_list, and
retrans_list without freeing the previous allocations and sets
chan->sdu to NULL without freeing the existing skb. This leaks all
previously allocated ERTM resources.
Additionally, l2cap_parse_conf_req() does not validate the minimum
value of remote_mps derived from the RFC max_pdu_size option. A zero
value propagates to l2cap_segment_sdu() where pdu_len becomes zero,
causing the while loop to never terminate since len is never
decremented, exhausting all available memory.
Fix the double-init by skipping l2cap_ertm_init() and
l2cap_chan_ready() when the channel is already in BT_CONNECTED state,
while still allowing the reconfiguration parameters to be updated
through l2cap_parse_conf_req(). Also add a pdu_len zero check in
l2cap_segment_sdu() as a safeguard.
Fixes: 96298f640104 ("Bluetooth: L2CAP: handle l2cap config request during open state")
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>
|
|||
| c026fd39d3 |
Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
[ Upstream commit b6552e0503973daf6f23bd6ed9273ef131ee364f ]
Before using sk pointer, check if it is null.
Fix the following:
KASAN: null-ptr-deref in range [0x0000000000000260-0x0000000000000267]
CPU: 0 UID: 0 PID: 5985 Comm: kworker/0:5 Not tainted 7.0.0-rc4-00029-ga989fde763f4 #1 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-9.fc43 06/10/2025
Workqueue: events l2cap_info_timeout
RIP: 0010:kasan_byte_accessible+0x12/0x30
Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cce
veth0_macvtap: entered promiscuous mode
RSP: 0018:ffffc90006e0f808 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffffffff89746018 RCX: 0000000080000001
RDX: 0000000000000000 RSI: ffffffff89746018 RDI: 000000000000004c
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffffff8aae3e70 R12: 0000000000000000
R13: 0000000000000260 R14: 0000000000000260 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff8880983c2000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005582615a5008 CR3: 000000007007e000 CR4: 0000000000752ef0
PKRU: 55555554
Call Trace:
<TASK>
__kasan_check_byte+0x12/0x40
lock_acquire+0x79/0x2e0
lock_sock_nested+0x48/0x100
? l2cap_sock_ready_cb+0x46/0x160
l2cap_sock_ready_cb+0x46/0x160
l2cap_conn_start+0x779/0xff0
? __pfx_l2cap_conn_start+0x10/0x10
? l2cap_info_timeout+0x60/0xa0
? __pfx___mutex_lock+0x10/0x10
l2cap_info_timeout+0x68/0xa0
? process_scheduled_works+0xa8d/0x18c0
process_scheduled_works+0xb6e/0x18c0
? __pfx_process_scheduled_works+0x10/0x10
? assign_work+0x3d5/0x5e0
worker_thread+0xa53/0xfc0
kthread+0x388/0x470
? __pfx_worker_thread+0x10/0x10
? __pfx_kthread+0x10/0x10
ret_from_fork+0x51e/0xb90
? __pfx_ret_from_fork+0x10/0x10
veth1_macvtap: entered promiscuous mode
? __switch_to+0xc7d/0x1450
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
batman_adv: batadv0: Interface activated: batadv_slave_0
batman_adv: batadv0: Interface activated: batadv_slave_1
netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
RIP: 0010:kasan_byte_accessible+0x12/0x30
Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cce
ieee80211 phy39: Selected rate control algorithm 'minstrel_ht'
RSP: 0018:ffffc90006e0f808 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffffffff89746018 RCX: 0000000080000001
RDX: 0000000000000000 RSI: ffffffff89746018 RDI: 000000000000004c
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffffff8aae3e70 R12: 0000000000000000
R13: 0000000000000260 R14: 0000000000000260 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff8880983c2000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7e16139e9c CR3: 000000000e74e000 CR4: 0000000000752ef0
PKRU: 55555554
Kernel panic - not syncing: Fatal exception
Fixes:
|
|||
| c2779b10ee |
Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()
[ Upstream commit c65bd945d1c08c3db756821b6bf9f1c4a77b29c6 ]
l2cap_ecred_data_rcv() reads the SDU length field from skb->data using
get_unaligned_le16() without first verifying that skb contains at least
L2CAP_SDULEN_SIZE (2) bytes. When skb->len is less than 2, this reads
past the valid data in the skb.
The ERTM reassembly path correctly calls pskb_may_pull() before reading
the SDU length (l2cap_reassemble_sdu, L2CAP_SAR_START case). Apply the
same validation to the Enhanced Credit Based Flow Control data path.
Fixes:
|
|||
| 323c9712e9 |
Bluetooth: HIDP: Fix possible UAF
[ Upstream commit dbf666e4fc9bdd975a61bf682b3f75cb0145eedd ]
This fixes the following trace caused by not dropping l2cap_conn
reference when user->remove callback is called:
[ 97.809249] l2cap_conn_free: freeing conn ffff88810a171c00
[ 97.809907] CPU: 1 UID: 0 PID: 1419 Comm: repro_standalon Not tainted 7.0.0-rc1-dirty #14 PREEMPT(lazy)
[ 97.809935] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014
[ 97.809947] Call Trace:
[ 97.809954] <TASK>
[ 97.809961] dump_stack_lvl (lib/dump_stack.c:122)
[ 97.809990] l2cap_conn_free (net/bluetooth/l2cap_core.c:1808)
[ 97.810017] l2cap_conn_del (./include/linux/kref.h:66 net/bluetooth/l2cap_core.c:1821 net/bluetooth/l2cap_core.c:1798)
[ 97.810055] l2cap_disconn_cfm (net/bluetooth/l2cap_core.c:7347 (discriminator 1) net/bluetooth/l2cap_core.c:7340 (discriminator 1))
[ 97.810086] ? __pfx_l2cap_disconn_cfm (net/bluetooth/l2cap_core.c:7341)
[ 97.810117] hci_conn_hash_flush (./include/net/bluetooth/hci_core.h:2152 (discriminator 2) net/bluetooth/hci_conn.c:2644 (discriminator 2))
[ 97.810148] hci_dev_close_sync (net/bluetooth/hci_sync.c:5360)
[ 97.810180] ? __pfx_hci_dev_close_sync (net/bluetooth/hci_sync.c:5285)
[ 97.810212] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 97.810242] ? up_write (./arch/x86/include/asm/atomic64_64.h:87 (discriminator 5) ./include/linux/atomic/atomic-arch-fallback.h:2852 (discriminator 5) ./include/linux/atomic/atomic-long.h:268 (discriminator 5) ./include/linux/atomic/atomic-instrumented.h:3391 (discriminator 5) kernel/locking/rwsem.c:1385 (discriminator 5) kernel/locking/rwsem.c:1643 (discriminator 5))
[ 97.810267] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 97.810290] ? rcu_is_watching (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:457 ./include/linux/context_tracking.h:128 kernel/rcu/tree.c:752)
[ 97.810320] hci_unregister_dev (net/bluetooth/hci_core.c:504 net/bluetooth/hci_core.c:2716)
[ 97.810346] vhci_release (drivers/bluetooth/hci_vhci.c:691)
[ 97.810375] ? __pfx_vhci_release (drivers/bluetooth/hci_vhci.c:678)
[ 97.810404] __fput (fs/file_table.c:470)
[ 97.810430] task_work_run (kernel/task_work.c:235)
[ 97.810451] ? __pfx_task_work_run (kernel/task_work.c:201)
[ 97.810472] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 97.810495] ? do_raw_spin_unlock (./include/asm-generic/qspinlock.h:128 (discriminator 5) kernel/locking/spinlock_debug.c:142 (discriminator 5))
[ 97.810527] do_exit (kernel/exit.c:972)
[ 97.810547] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 97.810574] ? __pfx_do_exit (kernel/exit.c:897)
[ 97.810594] ? lock_acquire (kernel/locking/lockdep.c:470 (discriminator 6) kernel/locking/lockdep.c:5870 (discriminator 6) kernel/locking/lockdep.c:5825 (discriminator 6))
[ 97.810616] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 97.810639] ? do_raw_spin_lock (kernel/locking/spinlock_debug.c:95 (discriminator 4) kernel/locking/spinlock_debug.c:118 (discriminator 4))
[ 97.810664] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 97.810688] ? find_held_lock (kernel/locking/lockdep.c:5350 (discriminator 1))
[ 97.810721] do_group_exit (kernel/exit.c:1093)
[ 97.810745] get_signal (kernel/signal.c:3007 (discriminator 1))
[ 97.810772] ? security_file_permission (./arch/x86/include/asm/jump_label.h:37 security/security.c:2366)
[ 97.810803] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 97.810826] ? vfs_read (fs/read_write.c:555)
[ 97.810854] ? __pfx_get_signal (kernel/signal.c:2800)
[ 97.810880] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 97.810905] ? __pfx_vfs_read (fs/read_write.c:555)
[ 97.810932] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 97.810960] arch_do_signal_or_restart (arch/x86/kernel/signal.c:337 (discriminator 1))
[ 97.810990] ? __pfx_arch_do_signal_or_restart (arch/x86/kernel/signal.c:334)
[ 97.811021] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 97.811055] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 97.811078] ? ksys_read (fs/read_write.c:707)
[ 97.811106] ? __pfx_ksys_read (fs/read_write.c:707)
[ 97.811137] exit_to_user_mode_loop (kernel/entry/common.c:66 kernel/entry/common.c:98)
[ 97.811169] ? rcu_is_watching (./arch/x86/include/asm/atomic.h:23 ./include/linux/atomic/atomic-arch-fallback.h:457 ./include/linux/context_tracking.h:128 kernel/rcu/tree.c:752)
[ 97.811192] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 97.811215] ? trace_hardirqs_off (./include/trace/events/preemptirq.h:36 (discriminator 33) kernel/trace/trace_preemptirq.c:95 (discriminator 33) kernel/trace/trace_preemptirq.c:90 (discriminator 33))
[ 97.811240] do_syscall_64 (./include/linux/irq-entry-common.h:226 ./include/linux/irq-entry-common.h:256 ./include/linux/entry-common.h:325 arch/x86/entry/syscall_64.c:100)
[ 97.811268] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 97.811292] ? exc_page_fault (arch/x86/mm/fault.c:1480 (discriminator 3) arch/x86/mm/fault.c:1527 (discriminator 3))
[ 97.811318] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[ 97.811338] RIP: 0033:0x445cfe
[ 97.811352] Code: Unable to access opcode bytes at 0x445cd4.
Code starting with the faulting instruction
===========================================
[ 97.811360] RSP: 002b:00007f65c41c6dc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 97.811378] RAX: fffffffffffffe00 RBX: 00007f65c41c76c0 RCX: 0000000000445cfe
[ 97.811391] RDX: 0000000000000400 RSI: 00007f65c41c6e40 RDI: 0000000000000004
[ 97.811403] RBP: 00007f65c41c7250 R08: 0000000000000000 R09: 0000000000000000
[ 97.811415] R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffe8
[ 97.811428] R13: 0000000000000000 R14: 00007fff780a8c00 R15: 00007f65c41c76c0
[ 97.811453] </TASK>
[ 98.402453] ==================================================================
[ 98.403560] BUG: KASAN: use-after-free in __mutex_lock (kernel/locking/mutex.c:199 kernel/locking/mutex.c:694 kernel/locking/mutex.c:776)
[ 98.404541] Read of size 8 at addr ffff888113ee40a8 by task khidpd_00050004/1430
[ 98.405361]
[ 98.405563] CPU: 1 UID: 0 PID: 1430 Comm: khidpd_00050004 Not tainted 7.0.0-rc1-dirty #14 PREEMPT(lazy)
[ 98.405588] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014
[ 98.405600] Call Trace:
[ 98.405607] <TASK>
[ 98.405614] dump_stack_lvl (lib/dump_stack.c:122)
[ 98.405641] print_report (mm/kasan/report.c:379 mm/kasan/report.c:482)
[ 98.405667] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 98.405691] ? __virt_addr_valid (arch/x86/mm/physaddr.c:55)
[ 98.405724] ? __mutex_lock (kernel/locking/mutex.c:199 kernel/locking/mutex.c:694 kernel/locking/mutex.c:776)
[ 98.405748] kasan_report (mm/kasan/report.c:221 mm/kasan/report.c:597)
[ 98.405778] ? __mutex_lock (kernel/locking/mutex.c:199 kernel/locking/mutex.c:694 kernel/locking/mutex.c:776)
[ 98.405807] __mutex_lock (kernel/locking/mutex.c:199 kernel/locking/mutex.c:694 kernel/locking/mutex.c:776)
[ 98.405832] ? do_raw_spin_lock (kernel/locking/spinlock_debug.c:95 (discriminator 4) kernel/locking/spinlock_debug.c:118 (discriminator 4))
[ 98.405859] ? l2cap_unregister_user (./include/linux/list.h:381 (discriminator 2) net/bluetooth/l2cap_core.c:1723 (discriminator 2))
[ 98.405888] ? __pfx_do_raw_spin_lock (kernel/locking/spinlock_debug.c:114)
[ 98.405915] ? __pfx___mutex_lock (kernel/locking/mutex.c:775)
[ 98.405939] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 98.405963] ? lock_acquire (kernel/locking/lockdep.c:470 (discriminator 6) kernel/locking/lockdep.c:5870 (discriminator 6) kernel/locking/lockdep.c:5825 (discriminator 6))
[ 98.405984] ? find_held_lock (kernel/locking/lockdep.c:5350 (discriminator 1))
[ 98.406015] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 98.406038] ? lock_release (kernel/locking/lockdep.c:5536 kernel/locking/lockdep.c:5889 kernel/locking/lockdep.c:5875)
[ 98.406061] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 98.406085] ? _raw_spin_unlock_irqrestore (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:119 ./arch/x86/include/asm/irqflags.h:159 ./include/linux/spinlock_api_smp.h:178 kernel/locking/spinlock.c:194)
[ 98.406107] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 98.406130] ? __timer_delete_sync (kernel/time/timer.c:1592)
[ 98.406158] ? l2cap_unregister_user (./include/linux/list.h:381 (discriminator 2) net/bluetooth/l2cap_core.c:1723 (discriminator 2))
[ 98.406186] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 98.406210] l2cap_unregister_user (./include/linux/list.h:381 (discriminator 2) net/bluetooth/l2cap_core.c:1723 (discriminator 2))
[ 98.406263] hidp_session_thread (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/linux/kref.h:64 net/bluetooth/hidp/core.c:996 net/bluetooth/hidp/core.c:1305)
[ 98.406293] ? __pfx_hidp_session_thread (net/bluetooth/hidp/core.c:1264)
[ 98.406323] ? kthread (kernel/kthread.c:433)
[ 98.406340] ? __pfx_hidp_session_wake_function (net/bluetooth/hidp/core.c:1251)
[ 98.406370] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 98.406393] ? find_held_lock (kernel/locking/lockdep.c:5350 (discriminator 1))
[ 98.406424] ? __pfx_hidp_session_wake_function (net/bluetooth/hidp/core.c:1251)
[ 98.406453] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 98.406476] ? trace_hardirqs_on (kernel/trace/trace_preemptirq.c:79 (discriminator 1))
[ 98.406499] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 98.406523] ? kthread (kernel/kthread.c:433)
[ 98.406539] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 98.406565] ? kthread (kernel/kthread.c:433)
[ 98.406581] ? __pfx_hidp_session_thread (net/bluetooth/hidp/core.c:1264)
[ 98.406610] kthread (kernel/kthread.c:467)
[ 98.406627] ? __pfx_kthread (kernel/kthread.c:412)
[ 98.406645] ret_from_fork (arch/x86/kernel/process.c:164)
[ 98.406674] ? __pfx_ret_from_fork (arch/x86/kernel/process.c:153)
[ 98.406704] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 98.406728] ? __pfx_kthread (kernel/kthread.c:412)
[ 98.406747] ret_from_fork_asm (arch/x86/entry/entry_64.S:258)
[ 98.406774] </TASK>
[ 98.406780]
[ 98.433693] The buggy address belongs to the physical page:
[ 98.434405] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888113ee7c40 pfn:0x113ee4
[ 98.435557] flags: 0x200000000000000(node=0|zone=2)
[ 98.436198] raw: 0200000000000000 ffffea0004244308 ffff8881f6f3ebc0 0000000000000000
[ 98.437195] raw: ffff888113ee7c40 0000000000000000 00000000ffffffff 0000000000000000
[ 98.438115] page dumped because: kasan: bad access detected
[ 98.438951]
[ 98.439211] Memory state around the buggy address:
[ 98.439871] ffff888113ee3f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 98.440714] ffff888113ee4000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 98.441580] >ffff888113ee4080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 98.442458] ^
[ 98.443011] ffff888113ee4100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 98.443889] ffff888113ee4180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 98.444768] ==================================================================
[ 98.445719] Disabling lock debugging due to kernel taint
[ 98.448074] l2cap_conn_free: freeing conn ffff88810c22b400
[ 98.450012] CPU: 1 UID: 0 PID: 1430 Comm: khidpd_00050004 Tainted: G B 7.0.0-rc1-dirty #14 PREEMPT(lazy)
[ 98.450040] Tainted: [B]=BAD_PAGE
[ 98.450047] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014
[ 98.450059] Call Trace:
[ 98.450065] <TASK>
[ 98.450071] dump_stack_lvl (lib/dump_stack.c:122)
[ 98.450099] l2cap_conn_free (net/bluetooth/l2cap_core.c:1808)
[ 98.450125] l2cap_conn_put (net/bluetooth/l2cap_core.c:1822)
[ 98.450154] session_free (net/bluetooth/hidp/core.c:990)
[ 98.450181] hidp_session_thread (net/bluetooth/hidp/core.c:1307)
[ 98.450213] ? __pfx_hidp_session_thread (net/bluetooth/hidp/core.c:1264)
[ 98.450271] ? kthread (kernel/kthread.c:433)
[ 98.450293] ? __pfx_hidp_session_wake_function (net/bluetooth/hidp/core.c:1251)
[ 98.450339] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 98.450368] ? find_held_lock (kernel/locking/lockdep.c:5350 (discriminator 1))
[ 98.450406] ? __pfx_hidp_session_wake_function (net/bluetooth/hidp/core.c:1251)
[ 98.450442] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 98.450471] ? trace_hardirqs_on (kernel/trace/trace_preemptirq.c:79 (discriminator 1))
[ 98.450499] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 98.450528] ? kthread (kernel/kthread.c:433)
[ 98.450547] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 98.450578] ? kthread (kernel/kthread.c:433)
[ 98.450598] ? __pfx_hidp_session_thread (net/bluetooth/hidp/core.c:1264)
[ 98.450637] kthread (kernel/kthread.c:467)
[ 98.450657] ? __pfx_kthread (kernel/kthread.c:412)
[ 98.450680] ret_from_fork (arch/x86/kernel/process.c:164)
[ 98.450715] ? __pfx_ret_from_fork (arch/x86/kernel/process.c:153)
[ 98.450752] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221)
[ 98.450782] ? __pfx_kthread (kernel/kthread.c:412)
[ 98.450804] ret_from_fork_asm (arch/x86/entry/entry_64.S:258)
[ 98.450836] </TASK>
Fixes:
|
|||
| f823ec5186 |
Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy
[ Upstream commit 0e4d4dcc1a6e82cc6f9abf32193558efa7e1613d ]
The last test step ("Test with Invalid public key X and Y, all set to
0") expects to get an "DHKEY check failed" instead of "unspecified".
Fixes: 6d19628f539f ("Bluetooth: SMP: Fail if remote and local public keys are identical")
Signed-off-by: Christian Eggers <ceggers@arri.de>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>
|
|||
| 4616e18079 |
Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU
[ Upstream commit b6a2bf43aa37670432843bc73ae2a6288ba4d6f8 ]
Core 6.0, Vol 3, Part A, 3.4.3:
"... If the sum of the payload sizes for the K-frames exceeds the
specified SDU length, the receiver shall disconnect the channel."
This fixes L2CAP/LE/CFC/BV-27-C (running together with 'l2test -r -P
0x0027 -V le_public').
Fixes:
|
|||
| 5b49b89514 |
Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU
[ Upstream commit e1d9a66889867c232657a9b6f25d451d7c3ab96f ]
Core 6.0, Vol 3, Part A, 3.4.3:
"If the SDU length field value exceeds the receiver's MTU, the receiver
shall disconnect the channel..."
This fixes L2CAP/LE/CFC/BV-26-C (running together with 'l2test -r -P
0x0027 -V le_public -I 100').
Fixes:
|
|||
| c25a662a6e |
Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access
commit dd815e6e3918dc75a49aaabac36e4f024d675101 upstream.
l2cap_information_rsp() checks that cmd_len covers the fixed
l2cap_info_rsp header (type + result, 4 bytes) but then reads
rsp->data without verifying that the payload is present:
- L2CAP_IT_FEAT_MASK calls get_unaligned_le32(rsp->data), which reads
4 bytes past the header (needs cmd_len >= 8).
- L2CAP_IT_FIXED_CHAN reads rsp->data[0], 1 byte past the header
(needs cmd_len >= 5).
A truncated L2CAP_INFO_RSP with result == L2CAP_IR_SUCCESS triggers an
out-of-bounds read of adjacent skb data.
Guard each data access with the required payload length check. If the
payload is too short, skip the read and let the state machine complete
with safe defaults (feat_mask and remote_fixed_chan remain zero from
kzalloc), so the info timer cleanup and l2cap_conn_start() still run
and the connection is not stalled.
Fixes:
|
|||
| b0da80ea68 |
Merge tag 'v4.19.325-cip131' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip into android13-4.19-kona
version 4.19.325-cip131 * tag 'v4.19.325-cip131' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip: CIP: Bump version suffix to -cip131 after merge from cip/linux-4.19.y-st tree Update localversion-st, tree is up-to-date with 5.10.252. nfsd: fix return error code for nfsd_map_name_to_[ug]id net: usb: pegasus: enable basic endpoint checking Bluetooth: L2CAP: Fix not checking l2cap_chan security level Bluetooth: Enforce key size of 16 bytes on FIPS level xfrm6: fix uninitialized saddr in xfrm6_get_saddr() netfilter: nf_conntrack: Add allow_clash to generic protocol handler ext4: don't cache extent during splitting extent NTB: ntb_transport: Fix too small buffer for debugfs_name net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle fbdev: ffb: fix corrupted video output on Sun FFB1 fbdev: of: display_timing: fix refcount leak in of_get_display_timings() atm: fore200e: fix use-after-free in tasklets during device removal net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean() net: ethernet: marvell: skge: remove incorrect conflicting PCI ID ceph: supply snapshot context in ceph_zero_partial_object() MIPS: rb532: Fix MMIO UART resource registration parisc: kernel: replace kfree() with put_device() in create_tree_node() drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() usb: dwc2: fix resume failure if dr_mode is host btrfs: continue trimming remaining devices on failure kexec: derive purgatory entry from symbol ocfs2: fix reflink preserve cleanup issue ocfs2: fix xattr array entry __counted_by error rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() iio: gyro: itg3200: Fix unchecked return value in read_raw dm mpath: make pg_init_delay_msecs settable bus: fsl-mc: fix an error handling in fsl_mc_device_add() md/bitmap: fix GPF in write_page caused by resize race xfs: fix remote xattr valuelblk check xfs: fix freemap adjustments when adding xattrs to leaf blocks xfs: delete attr leaf freemap entries when empty xfs: mark data structures corrupt on EIO and ENODATA mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations drm: of: drm_of_panel_bridge_remove(): fix device_node leak dm-unstripe: fix mapping bug when there are multiple targets in a table clk: tegra: tegra124-emc: Fix potential memory leak in tegra124_clk_register_emc() dm: clear cloned request bio pointer when last clone bio completes media: i2c/tw9906: Fix potential memory leak in tw9906_probe() media: i2c/tw9903: Fix potential memory leak in tw9903_probe() media: cx25821: Add missing unmap in snd_cx25821_hw_params() media: cx23885: Add missing unmap in snd_cx23885_hw_params() media: cx88: Add missing unmap in snd_cx88_hw_params() media: radio-keene: fix memory leak in error path HID: prodikeys: Check presence of pm->input_ep82 HID: magicmouse: Do not crash on missing msc->input HID: hid-pl: handle probe errors media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() dm-verity: correctly handle dm_bufio_client_create() failure fpga: dfl: use subsys_initcall to allow built-in drivers to be added rpmsg: core: fix race in driver_override_show() and use core helper netfilter: nf_conntrack_h323: fix OOB read in decode_choice() net: consume xmit errors of GSO frames Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ Bluetooth: l2cap: Check encryption key size on incoming connection wifi: cfg80211: wext: fix IGTK key ID off-by-one net: usb: lan78xx: scan all MDIO addresses on LAN7801 lan78xx: Fix memory allocation bug lan78xx: Fix race condition in disconnect handling lan78xx: Remove unused pause frame queue net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access drm/radeon: Add HAINAN clock adjustment drm/amdgpu: Add HAINAN clock adjustment ARM: 9467/1: mm: Don't use %pK through printk include: uapi: netfilter_bridge.h: Cover for musl libc iio: magnetometer: Remove IRQF_ONESHOT Revert "mfd: da9052-spi: Change read-mask to write-mask" binder: don't use %pK through printk serial: 8250_dw: handle clock enable errors in runtime_resume m68k: nommu: fix memmove() with differently aligned src and dest for 68000 clk: microchip: core: correct return value on *_get_parent() nfc: nxp-nci: remove interrupt trigger type myri10ge: avoid uninitialized variable use PCI: Mark Nvidia GB10 to avoid bus reset PCI: Fix pci_slot_lock () device locking PCI: Mark ASM1164 SATA controller to avoid bus reset net/rds: Clear reconnect pending bit vmw_vsock: bypass false-positive Wnonnull warning with gcc-16 net: usb: sr9700: remove code to drive nonexistent multicast filter Bluetooth: btusb: Add device ID for Realtek RTL8761BU Bluetooth: hci_conn: use mod_delayed_work for active mode timeout ipv4: fib: Annotate access to struct fib_alias.fa_state. wifi: iwlegacy: add missing mutex protection in il3945_store_measurement() wifi: iwlegacy: add missing mutex protection in il4965_store_tx_power() net/rds: No shortcut out of RDS_CONN_ERROR net: usb: r8152: fix transmit queue timeout openrisc: define arch-specific version of nop() netfilter: xt_tcpmss: check remaining length before reading optlen wifi: libertas: fix WARNING in usb_tx_block jfs: nlink overflow in jfs_rename jfs: Add missing set_freezable() for freezable kthread modpost: Amend ppc64 save/restfpr symnames for -Os build ASoC: es8328: Add error unwind in resume HID: multitouch: add eGalaxTouch EXC3188 support drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback virt: vbox: uapi: Mark inner unions in packed structs as packed hyper-v: Mark inner union in hv_kvp_exchg_msg_value as packed drm: Account property blob allocations to memcg media: cx25821: Fix a resource leak in cx25821_dev_setup() media: solo6x10: Check for out of bounds chip_id media: pvrusb2: fix URB leak in pvr2_send_request_ex media: adv7180: fix frame interval in progressive mode ASoC: wm8962: Add WM8962_ADC_MONOMIX to "3D Coefficients" mask media: omap3isp: set initial format media: omap3isp: isppreview: always clamp in preview_try_format() media: omap3isp: isp_video_mbus_to_pix/pix_to_mbus fixes media: dvb-core: dmxdevfilter must always flush bufs parisc: Prevent interrupts during reboot arm64: tegra: smaug: Add usb-role-switch support pstore: ram_core: fix incorrect success return when vmap() fails mailbox: bcm-ferxrm-mailbox: Use default primary handler clocksource/drivers/sh_tmu: Always leave device running after probe sparc: don't reference obsolete termio struct for TC* constants xenbus: Use .freeze/.thaw to handle xenbus devices ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP EFI/CPER: don't go past the ARM processor CPER record buffer x86/xen/pvh: Enable PAE mode for 32-bit guest only when CONFIG_X86_PAE is set s390/purgatory: Add -Wno-default-const-init-unsafe to KBUILD_CFLAGS tools/power cpupower: Reset errno before strtoull() minix: Add required sanity checking to minix_check_superblock() hfsplus: pretend special inodes as regular files audit: add missing syscalls to read class hfsplus: fix volume corruption issue for generic/498 audit: add fchmodat2() to change attributes class rtc: interface: Alarm race handling should not discard preceding error SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths ata: pata_ftide010: Fix some DMA timings ext4: fix memory leak in ext4_ext_shift_extents() MIPS: Work around LLVM bug when gp is used as global register variable apparmor: fix invalid deref of rawdata when export_binary is unset apparmor: fix rlimit for posix cpu timers apparmor: fix NULL sock in aa_sock_file_perm bonding: alb: fix UAF in rlb_arp_recv during bond up/down macvlan: observe an RCU grace period in macvlan_common_newlink() error path netfilter: nf_conntrack_h323: don't pass uninitialised l3num value net/rds: rds_sendmsg should not discard payload_len xen-netback: reject zero-queue configuration from guest net: usb: catc: enable basic endpoint checking usbb: catc: use correct API for MAC addresses cpuidle: Skip governor when only one idle state is available pinctrl: single: fix refcount leak in pcs_add_gpio_func() iio: sca3000: Fix a resource leak in sca3000_probe() ovl: Fix uninit-value in ovl_fill_real drivers: iio: mpu3050: use dev_err_probe for regulator request mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms" mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms mmc: core: Initial support for SD express card/host serial: SH_SCI: improve "DMA support" prompt staging: greybus: lights: avoid NULL deref fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros scsi: csiostor: Fix dereference of null pointer rn pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN svcrdma: Remove queue-shortening warnings RDMA/core: Fix a couple of obvious typos in comments power: supply: wm97xx_battery: Convert to GPIO descriptor power: supply: bq27xxx: fix wrong errno when bus ops are unsupported power: supply: sbs-battery: Fix use-after-free in power_supply_changed() power: supply: rt9455: Fix use-after-free in power_supply_changed() power: supply: act8945a: Fix use-after-free in power_supply_changed() serial: caif: fix use-after-free in caif_serial ldisc_close() net: atm: fix crash due to unvalidated vcc pointer in sigd_send() procfs: fix missing RCU protection when reading real_parent in do_task_stat() netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets netfilter: nft_set_hash: fix get operation on big endian bonding: only set speed/duplex to unknown, if getting speed failed ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit() tcp: tcp_tx_timestamp() must look at the rtx queue fat: avoid parent link count underflow in rmdir PCI: Mark 3ware-9650SA Root Port Extended Tags as broken netfilter: nf_conncount: fix tracking of connections from localhost netfilter: nf_conncount: increase the connection clean up limit to 64 netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH wifi: cfg80211: stop NAN and P2P in cfg80211_leave PCI/portdrv: Fix potential resource leak PCI: Do not attempt to set ExtTag for VFs PCI: mediatek: Fix IRQ domain leak when MSI allocation fails Revert "hwmon: (ibmpex) fix use-after-free in high/low store" spi: tools: Add include folder to .gitignore regulator: Flag uncontrollable regulators as always_on regulator: core: Respect off_on_delay at startup smack: /smack/doi: accept previously used values smack: /smack/doi must be > 0 arm64: dts: amlogic: gx: assign the MMC signal clocks ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size() EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size() pstore/ram: fix buffer overflow in persistent_ram_save_old() sched/rt: Skip currently executing CPU in rto_next_cpu() mfd: wm8350-core: Use IRQF_ONESHOT EDAC/altera: Remove IRQF_ONESHOT hrtimer: Fix trace oddity crypto: cavium - fix dma_free_coherent() size s390/cio: Fix device lifecycle handling in css_alloc_subchannel() PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races md/raid10: fix any_working flag handling in raid10_sync_request tpm: st33zp24: Fix missing cleanup on get_burstcount() error tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure gfs2: Add metapath_dibh helper gfs2: Add wrapper for iomap_file_buffered_write fs: add <linux/init_task.h> for 'init_fs' hfsplus: return error when node already exists in hfs_bnode_create auxdisplay: arm-charlcd: fix release_mem_region() size RDMA/umad: Reject negative data_len in ib_umad_write Change-Id: Ice1efa8b2faaaab14d1d1563e5aa6ae36549682b |
|||
| 0bbc91dd57 |
Bluetooth: L2CAP: Fix not checking l2cap_chan security level
[ Upstream commit 7af8479d9eb4319b4ba7b47a8c4d2c55af1c31e1 ]
l2cap_check_enc_key_size shall check the security level of the
l2cap_chan rather than the hci_conn since for incoming connection
request that may be different as hci_conn may already been
encrypted using a different security level.
Fixes: 522e9ed157e3 ("Bluetooth: l2cap: Check encryption key size on incoming connection")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Stable-dep-of: 138d7eca445e ("Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>
|
|||
| 390fad321b |
Bluetooth: Enforce key size of 16 bytes on FIPS level
[ Upstream commit 288c06973daae4637f25a0d1bdaf65fdbf8455f9 ] According to the spec Ver 5.2, Vol 3, Part C, Sec 5.2.2.8: Device in security mode 4 level 4 shall enforce: 128-bit equivalent strength for link and encryption keys required using FIPS approved algorithms (E0 not allowed, SAFER+ not allowed, and P-192 not allowed; encryption key not shortened) This patch rejects connection with key size below 16 for FIPS level services. Signed-off-by: Archie Pusaka <apusaka@chromium.org> Reviewed-by: Alain Michaud <alainm@chromium.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Stable-dep-of: 138d7eca445e ("Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ") Signed-off-by: Sasha Levin <sashal@kernel.org> [uli: backport to 4.19] Signed-off-by: Ulrich Hecht <uli@kernel.org> Reviewed-by: Pavel Machek <pavel@nabladev.com> |
|||
| 7f6a2970bc |
Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ
[ Upstream commit 138d7eca445ef37a0333425d269ee59900ca1104 ]
This adds a check for encryption key size upon receiving
L2CAP_LE_CONN_REQ which is required by L2CAP/LE/CFC/BV-15-C which
expects L2CAP_CR_LE_BAD_KEY_SIZE.
Link: https://lore.kernel.org/linux-bluetooth/5782243.rdbgypaU67@n9w6sw14/
Fixes:
|
|||
| b07d69c009 |
Bluetooth: l2cap: Check encryption key size on incoming connection
[ Upstream commit 522e9ed157e3c21b4dd623c79967f72c21e45b78 ]
This is required for passing GAP/SEC/SEM/BI-04-C PTS test case:
Security Mode 4 Level 4, Responder - Invalid Encryption Key Size
- 128 bit
This tests the security key with size from 1 to 15 bytes while the
Security Mode 4 Level 4 requests 16 bytes key size.
Currently PTS fails with the following logs:
- expected:Connection Response:
Code: [3 (0x03)] Code
Identifier: (lt)WildCard: Exists(gt)
Length: [8 (0x0008)]
Destination CID: (lt)WildCard: Exists(gt)
Source CID: [64 (0x0040)]
Result: [3 (0x0003)] Connection refused - Security block
Status: (lt)WildCard: Exists(gt),
but received:Connection Response:
Code: [3 (0x03)] Code
Identifier: [1 (0x01)]
Length: [8 (0x0008)]
Destination CID: [64 (0x0040)]
Source CID: [64 (0x0040)]
Result: [0 (0x0000)] Connection Successful
Status: [0 (0x0000)] No further information available
And HCI logs:
< HCI Command: Read Encrypti.. (0x05|0x0008) plen 2
Handle: 14 Address: 00:1B:DC:F2:24:10 (Vencer Co., Ltd.)
> HCI Event: Command Complete (0x0e) plen 7
Read Encryption Key Size (0x05|0x0008) ncmd 1
Status: Success (0x00)
Handle: 14 Address: 00:1B:DC:F2:24:10 (Vencer Co., Ltd.)
Key size: 7
> ACL Data RX: Handle 14 flags 0x02 dlen 12
L2CAP: Connection Request (0x02) ident 1 len 4
PSM: 4097 (0x1001)
Source CID: 64
< ACL Data TX: Handle 14 flags 0x00 dlen 16
L2CAP: Connection Response (0x03) ident 1 len 8
Destination CID: 64
Source CID: 64
Result: Connection successful (0x0000)
Status: No further information available (0x0000)
Fixes: 288c06973daa ("Bluetooth: Enforce key size of 16 bytes on FIPS level")
Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Stable-dep-of: 138d7eca445e ("Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>
|
|||
| 04bd60706f |
Bluetooth: hci_conn: use mod_delayed_work for active mode timeout
[ Upstream commit 49d0901e260739de2fcc90c0c29f9e31e39a2d9b ] hci_conn_enter_active_mode() uses queue_delayed_work() with the intention that the work will run after the given timeout. However, queue_delayed_work() does nothing if the work is already queued, so depending on the link policy we may end up putting the connection into idle mode every hdev->idle_timeout ms. Use mod_delayed_work() instead so the work is queued if not already queued, and the timeout is updated otherwise. Signed-off-by: Stefan Sørensen <ssorensen@roku.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Ulrich Hecht <uli@kernel.org> |
|||
| e0479e4a5b |
Merge tag 'v4.19.325-cip127' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip into android13-4.19-kona
version 4.19.325-cip127 * tag 'v4.19.325-cip127' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip: CIP: Bump version suffix to -cip127 after merge from cip/linux-4.19.y-st tree Update localversion-st, tree is up-to-date with 5.10.247. usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer scsi: pm80xx: Set phy->enable_completion only when we drm/amd/display: Check NULL before accessing wifi: ath10k: Fix connection after GTK rekeying pinctrl: single: fix bias pull up/down handling in pin_config_set ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up fs: writeback: fix use-after-free in __mark_inode_dirty() libceph: fix potential use-after-free in have_mon_and_osd_map() drm: sti: fix device leaks at component probe USB: serial: option: add support for Rolling RW101R-GL USB: serial: ftdi_sio: add support for u-blox EVK-M101 usb: storage: sddr55: Reject out-of-bound new_pba USB: storage: Remove subclass and protocol overrides from Novatek quirk usb: storage: Fix memory leak in USB bulk transport usb: gadget: f_eem: Fix memory leak in eem_unwrap slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves dm-verity: fix unreliable memory allocation can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling can: sja1000: fix max irq loop handling atm/fore200e: Fix possible data race in fore200e_open() MIPS: mm: Prevent a TLB shutdown on initial uniquification iio:common:ssp_sensors: Fix an error handling path ssp_probe() spi: bcm63xx: fix premature CS deassertion on RX-only transactions net: sxgbe: fix potential NULL dereference in sxgbe_rx() can: kvaser_usb: leaf: Fix potential infinite loop in command parsers mtd: onenand: Pass correct pointer to IRQ handler fsdax: mark the iomap argument to dax_iomap_sector as const net: sctp: Fix some typos iommu/amd: Skip enabling command/event buffers for kdump nvme-fc: use lock accessing port_state and rport state net: netpoll: fix incorrect refcount handling causing incorrect cleanup net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error tipc: Fix use-after-free in tipc_mon_reinit_self(). sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode net/sched: sch_qfq: Fix null-deref in agg_dequeue Input: pegasus-notetaker - fix potential out-of-bounds access Input: remove third argument of usb_maxpacket() usb: deprecate the third argument of usb_maxpacket() ata: libata-scsi: Fix system suspend for a security locked drive fs/proc: fix uaf in proc_readdir_de() pmdomain: imx: Fix reference count leak in imx_gpc_remove pmdomain: arm: scmi: Fix genpd leak on provider registration failure net: qede: Initialize qede_ll_ops with designated initializer uio_hv_generic: Set event for all channels on the device ALSA: usb-audio: fix uac2 clock source at terminal parser kconfig/nconf: Initialize the default locale at startup kconfig/mconf: Initialize the default locale at startup vsock: Ignore signal/timeout on connect() if already established s390/ctcm: Fix double-kfree net: openvswitch: remove never-working support for setting nsh fields mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() MIPS: Malta: Fix !EVA SOC-it PCI MMIO scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() scsi: sg: Do not sleep in atomic context Input: cros_ec_keyb - fix an invalid memory access be2net: pass wrb_params in case of OS2BMC HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() spi: Try to get ACPI GPIO IRQ earlier ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe strparser: Fix signed/unsigned mismatch bug gcov: add support for GCC 15 mm/ksm: fix flag-dropping behavior in ksm_madvise ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd ASoC: cs4271: Fix regulator leak on probe failure regulator: fixed: use dev_err_probe for register Bluetooth: L2CAP: export l2cap_chan_hold for modules net_sched: remove need_resched() from qdisc_run() net/mlx5e: Fix maxrate wraparound in threshold between units net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion Bluetooth: 6lowpan: reset link-local header on ipv6 recv path net: fec: correct rx_bytes statistic for the case SHIFT16 is set ASoC: max98090/91: fixed max98091 ALSA widget powering up/down HID: quirks: avoid Cooler Master MM712 dongle wakeup bug NFS4: Fix state renewals missing after boot extcon: adc-jack: Cleanup wakeup source only if it was enabled net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup sctp: Prevent TOCTOU out-of-bounds write sctp: Hold RCU read lock while iterating over address list net: vlan: sync VLAN features with lower device ceph: add checking of wait_for_completion_killable() return value fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds ACPI: property: Return present device nodes only on fwnode interface 9p: sysfs_init: don't hardcode error to ENOMEM 9p: fix /sys/fs/9p/caches overwriting itself fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink ACPICA: Update dsmethod.c to get rid of unused variable warning page_pool: Clamp pool size to max 16K pages Bluetooth: bcsp: receive data only if registered Bluetooth: SCO: Fix UAF on sco_conn_free net: macb: avoid dealing with endianness in macb_set_hwaddr() nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing NFSv4.1: fix mount hang after CREATE_SESSION failure NFSv4: handle ERR_GRACE on delegation recalls remoteproc: qcom: q6v5: Avoid handling handover twice sparc/module: Add R_SPARC_UA64 relocation handling net: intel: fm10k: Fix parameter idx set but not used jfs: fix uninitialized waitqueue in transaction manager jfs: Verify inode mode when loading from disk ipv6: np->rxpmtu race annotation usb: xhci: plat: Facilitate using autosuspend for xhci plat devices usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs allow finish_no_open(file, ERR_PTR(-E...)) scsi: lpfc: Define size of debugfs entry for xri rebalancing scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency net/cls_cgroup: Fix task_get_classid() during qdisc run media: redrat3: use int type to store negative error codes net: sh_eth: Disable WoL if system can not suspend usb: gadget: f_hid: Fix zero length packet transfer net: call cond_resched() less often in __release_sock() ALSA: usb-audio: apply quirk for MOONDROP Quark2 net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms dmaengine: mv_xor: match alloc_wc and free_wc scsi: pm8001: Use int instead of u32 to store error codes mips: lantiq: xway: sysctrl: rename stp clock mips: lantiq: danube: add missing properties to cpu node media: fix uninitialized symbol warnings extcon: adc-jack: Fix wakeup source leaks on device unbind rds: Fix endianness annotation for RDS_MPATH_HASH net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV. char: misc: Does not request module for miscdevice with dynamic minor usb: gadget: f_ncm: Fix MAC assignment NCM ethernet iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register media: imon: make send_packet() more robust net: ipv6: fix field-spanning memcpy warning in AH output bridge: Redirect to backup port when port is administratively down media: pci: ivtv: Don't create fake v4l2_fh drm/amdkfd: return -ENOTTY for unsupported IOCTLs selftests/net: Ensure assert() triggers in psock_tpacket.c selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 PCI: Disable MSI on RDC PCI to PCIe bridges drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() mfd: madera: Work around false-positive -Wininitialized warning mfd: stmpe: Remove IRQ domain upon removal tools/power x86_energy_perf_policy: Prefer driver HWP limits tools/power x86_energy_perf_policy: Enhance HWP enable tools/cpupower: Fix incorrect size in cpuidle_state_disable() hwmon: (dell-smm) Add support for Dell OptiPlex 7040 uprobe: Do not emulate/sstep original instruction when ip is changed clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel video: backlight: lp855x_bl: Set correct EPROM start for LP8556 tee: allow a driver to allocate a tee_device without a pool ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment arc: Fix __fls() const-foldability via __builtin_clzl() cpufreq/longhaul: handle NULL policy in longhaul_exit selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 ACPI: video: force native for Lenovo 82K8 memstick: Add timeout to prevent indefinite waiting bpf: Don't use %pK through printk spi: loopback-test: Don't use %pK through printk soc: qcom: smem: Fix endian-unaware access of num_entries usb: gadget: f_fs: Fix epfile null pointer access after ep enable. serial: 8250_dw: Use devm_clk_get_optional() to get the input clock can: gs_usb: increase max interface to U8_MAX devcoredump: Fix circular locking dependency with devcd->mutex. x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID net: phy: dp83867: Disable EEE support as not implemented regmap: slimbus: fix bus_context pointer in regmap init calls usbnet: Prevents free active kevent wifi: ath10k: Fix memory leak on unsupported WMI command ASoC: qdsp6: q6asm: do not sleep while atomic fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS fbdev: bitblit: bound-check glyph index in bit_putcs* ACPI: video: Fix use-after-free in acpi_video_switch_brightness() fbdev: atyfb: Check if pll_ops->init_pll failed net: usb: asix_devices: Check return value of usbnet_get_endpoints btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() x86/bugs: Fix reporting of LFENCE retpoline Conflicts: drivers/slimbus/qcom-ngd-ctrl.c drivers/usb/gadget/function/f_fs.c drivers/usb/host/xhci-plat.c Change-Id: Id995e84f0ff2c819145f7ebd62bc8dcd47fbbb47 |
|||
| 05766c8e34 |
Bluetooth: L2CAP: export l2cap_chan_hold for modules
[ Upstream commit e060088db0bdf7932e0e3c2d24b7371c4c5b867c ] l2cap_chan_put() is exported, so export also l2cap_chan_hold() for modules. l2cap_chan_hold() has use case in net/bluetooth/6lowpan.c Signed-off-by: Pauli Virtanen <pav@iki.fi> Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Ulrich Hecht <uli@kernel.org> |
|||
| 9c5b11d790 |
Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions
[ Upstream commit 98454bc812f3611551e4b1f81732da4aa7b9597e ]
disconnect_all_peers() calls sleeping function (l2cap_chan_close) under
spinlock. Holding the lock doesn't actually do any good -- we work on a
local copy of the list, and the lock doesn't protect against peer->chan
having already been freed.
Fix by taking refcounts of peer->chan instead. Clean up the code and
old comments a bit.
Take devices_lock instead of RCU, because the kfree_rcu();
l2cap_chan_put(); construct in chan_close_cb() does not guarantee
peer->chan is necessarily valid in RCU.
Also take l2cap_chan_lock() which is required for l2cap_chan_close().
Log: (bluez 6lowpan-tester Client Connect - Disable)
------
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:575
...
<TASK>
...
l2cap_send_disconn_req (net/bluetooth/l2cap_core.c:938 net/bluetooth/l2cap_core.c:1495)
...
? __pfx_l2cap_chan_close (net/bluetooth/l2cap_core.c:809)
do_enable_set (net/bluetooth/6lowpan.c:1048 net/bluetooth/6lowpan.c:1068)
------
Fixes:
|
|||
| 0037a14002 |
Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion
[ Upstream commit b454505bf57a2e4f5d49951d4deb03730a9348d9 ]
Bluetooth 6lowpan.c confuses BDADDR_LE and ADDR_LE_DEV address types,
e.g. debugfs "connect" command takes the former, and "disconnect" and
"connect" to already connected device take the latter. This is due to
using same value both for l2cap_chan_connect and hci_conn_hash_lookup_le
which take different dst_type values.
Fix address type passed to hci_conn_hash_lookup_le().
Retain the debugfs API difference between "connect" and "disconnect"
commands since it's been like this since 2015 and nobody apparently
complained.
Fixes:
|
|||
| d2fa415c12 |
Bluetooth: 6lowpan: reset link-local header on ipv6 recv path
[ Upstream commit 3b78f50918276ab28fb22eac9aa49401ac436a3b ]
Bluetooth 6lowpan.c netdev has header_ops, so it must set link-local
header for RX skb, otherwise things crash, eg. with AF_PACKET SOCK_RAW
Add missing skb_reset_mac_header() for uncompressed ipv6 RX path.
For the compressed one, it is done in lowpan_header_decompress().
Log: (BlueZ 6lowpan-tester Client Recv Raw - Success)
------
kernel BUG at net/core/skbuff.c:212!
Call Trace:
<IRQ>
...
packet_rcv (net/packet/af_packet.c:2152)
...
<TASK>
__local_bh_enable_ip (kernel/softirq.c:407)
netif_rx (net/core/dev.c:5648)
chan_recv_cb (net/bluetooth/6lowpan.c:294 net/bluetooth/6lowpan.c:359)
------
Fixes:
|
|||
| 087c664f20 |
Bluetooth: SCO: Fix UAF on sco_conn_free
[ Upstream commit ecb9a843be4d6fd710d7026e359f21015a062572 ] BUG: KASAN: slab-use-after-free in sco_conn_free net/bluetooth/sco.c:87 [inline] BUG: KASAN: slab-use-after-free in kref_put include/linux/kref.h:65 [inline] BUG: KASAN: slab-use-after-free in sco_conn_put+0xdd/0x410 net/bluetooth/sco.c:107 Write of size 8 at addr ffff88811cb96b50 by task kworker/u17:4/352 CPU: 1 UID: 0 PID: 352 Comm: kworker/u17:4 Not tainted 6.17.0-rc5-g717368f83676 #4 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: hci13 hci_cmd_sync_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x10b/0x170 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x191/0x550 mm/kasan/report.c:482 kasan_report+0xc4/0x100 mm/kasan/report.c:595 sco_conn_free net/bluetooth/sco.c:87 [inline] kref_put include/linux/kref.h:65 [inline] sco_conn_put+0xdd/0x410 net/bluetooth/sco.c:107 sco_connect_cfm+0xb4/0xae0 net/bluetooth/sco.c:1441 hci_connect_cfm include/net/bluetooth/hci_core.h:2082 [inline] hci_conn_failed+0x20a/0x2e0 net/bluetooth/hci_conn.c:1313 hci_conn_unlink+0x55f/0x810 net/bluetooth/hci_conn.c:1121 hci_conn_del+0xb6/0x1110 net/bluetooth/hci_conn.c:1147 hci_abort_conn_sync+0x8c5/0xbb0 net/bluetooth/hci_sync.c:5689 hci_cmd_sync_work+0x281/0x380 net/bluetooth/hci_sync.c:332 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0x77e/0x1040 kernel/workqueue.c:3319 worker_thread+0xbee/0x1200 kernel/workqueue.c:3400 kthread+0x3c7/0x870 kernel/kthread.c:463 ret_from_fork+0x13a/0x1e0 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> Allocated by task 31370: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x30/0x70 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:388 [inline] __kasan_kmalloc+0x82/0x90 mm/kasan/common.c:405 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4382 [inline] __kmalloc_noprof+0x22f/0x390 mm/slub.c:4394 kmalloc_noprof include/linux/slab.h:909 [inline] sk_prot_alloc+0xae/0x220 net/core/sock.c:2239 sk_alloc+0x34/0x5a0 net/core/sock.c:2295 bt_sock_alloc+0x3c/0x330 net/bluetooth/af_bluetooth.c:151 sco_sock_alloc net/bluetooth/sco.c:562 [inline] sco_sock_create+0xc0/0x350 net/bluetooth/sco.c:593 bt_sock_create+0x161/0x3b0 net/bluetooth/af_bluetooth.c:135 __sock_create+0x3ad/0x780 net/socket.c:1589 sock_create net/socket.c:1647 [inline] __sys_socket_create net/socket.c:1684 [inline] __sys_socket+0xd5/0x330 net/socket.c:1731 __do_sys_socket net/socket.c:1745 [inline] __se_sys_socket net/socket.c:1743 [inline] __x64_sys_socket+0x7a/0x90 net/socket.c:1743 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc7/0x240 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 31374: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x30/0x70 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:243 [inline] __kasan_slab_free+0x3d/0x50 mm/kasan/common.c:275 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2428 [inline] slab_free mm/slub.c:4701 [inline] kfree+0x199/0x3b0 mm/slub.c:4900 sk_prot_free net/core/sock.c:2278 [inline] __sk_destruct+0x4aa/0x630 net/core/sock.c:2373 sco_sock_release+0x2ad/0x300 net/bluetooth/sco.c:1333 __sock_release net/socket.c:649 [inline] sock_close+0xb8/0x230 net/socket.c:1439 __fput+0x3d1/0x9e0 fs/file_table.c:468 task_work_run+0x206/0x2a0 kernel/task_work.c:227 get_signal+0x1201/0x1410 kernel/signal.c:2807 arch_do_signal_or_restart+0x34/0x740 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop+0x68/0xc0 kernel/entry/common.c:40 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline] do_syscall_64+0x1dd/0x240 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f Reported-by: cen zhang <zzzccc427@gmail.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Ulrich Hecht <uli@kernel.org> |
|||
| 5976bf775a |
Merge tag 'v4.19.325-cip125' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip into android13-4.19-kona
version 4.19.325-cip125 * tag 'v4.19.325-cip125' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip: CIP: Bump version suffix to -cip125 after merge from cip/linux-4.19.y-st tree Update localversion-st, tree is up-to-date with 5.4.300. mm/khugepaged: fix ->anon_vma race mm/hugetlb: fix folio is still mapped when deleted i40e: add mask to apply valid bits for itr_idx i40e: add validation for ring_len param i40e: increase max descriptors for XL710 mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() fbcon: Fix OOB access in font allocation fbcon: fix integer overflow in fbcon_do_set_font i40e: add max boundary check for VF filters i40e: fix input validation logic for action_meta i40e: fix idx validation in i40e_validate_queue_map drm/gma500: Fix null dereference in hdmi teardown can: peak_usb: fix shift-out-of-bounds issue can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow can: hi311x: populate ndo_change_mtu() to prevent buffer overflow can: rcar_can: rcar_can_resume(): fix s2ram with PSCI usb: core: Add 0x prefix to quirks debug output ALSA: usb-audio: Fix build with CONFIG_INPUT=n ALSA: usb-audio: Convert comma to semicolon ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks ALSA: usb-audio: Simplify NULL comparison in mixer_quirks ALSA: usb-audio: Avoid multiple assignments in mixer_quirks ALSA: usb-audio: Fix block comments in mixer_quirks KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer net: rfkill: gpio: add DT support serial: sc16is7xx: fix bug in flow control levels init USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels usb: gadget: dummy_hcd: remove usage of list iterator past the loop body ASoC: wm8974: Correct PLL rate rounding ASoC: wm8940: Correct typo in control name mmc: mvsdio: Fix dma_unmap_sg() nents value power: supply: bq27xxx: restrict no-battery detection to bq27000 power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* cnic: Fix use-after-free bugs in cnic_delete_task net: liquidio: fix overflow in octeon_init_instr_queue() tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). i40e: remove redundant memory barrier when cleaning Tx descs net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure cgroup: split cgroup_destroy_wq into 3 workqueues pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory phy: ti-pipe3: fix device leak at unbind dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees dmaengine: ti: edma: Fix memory allocation size for queue_priority_map i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path igb: fix link test skipping when interface is admin down net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions tty: hvc_console: Call hvc_kick in hvc_write unconditionally mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing mtd: nand: raw: atmel: Fix comment in timings preparation mm/khugepaged: fix the address passed to notifier on testing young ocfs2: fix recursive semaphore deadlock in fiemap call EDAC/altera: Delete an inappropriate dma_free_coherent() call net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. cifs: fix integer overflow in match_server() spi: spi-fsl-lpspi: Set correct chip-select polarity bit pcmcia: Add error handling for add_interval() in do_validate_mem() randstruct: gcc-plugin: Fix attribute addition randstruct: gcc-plugin: Remove bogus void member vmxnet3: update MTU after device quiesce iio: light: opt3001: fix deadlock due to concurrent flag access KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer cpufreq/sched: Explicitly synchronize limits_changed flag handling mm/slub: avoid accessing metadata when pointer is invalid in object_err() e1000e: fix heap overflow in e1000_set_eeprom batman-adv: fix OOB read/write in network-coding decode drm/amdgpu: drop hw access in non-DC audio fini wifi: mwifiex: Initialize the chan_stats array to zero pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() ALSA: usb-audio: Add mute TLV for playback volumes on some devices ppp: fix memory leak in pad_compress_skb ax25: properly unshare skbs in ax25_kiss_rcv() net: thunder_bgx: decrement cleanup index before use net: thunder_bgx: add a missing of_node_put wifi: libertas: cap SSID len in lbs_associate() wifi: cw1200: cap SSID length in cw1200_do_join() net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets i40e: Fix potential invalid access when MAC list is empty icmp: fix icmp_ndo_send address translation for reply direction mISDN: Fix memory leak in dsp_hwec_enable() xirc2ps_cs: fix register access when enabling FullDuplex Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() netfilter: conntrack: helper: Replace -EEXIST by -EBUSY powerpc: boot: Remove leading zero in label in udelay() Change-Id: I2c31de17310aeb8f59d10e02bc91f20cf80279e3 |
|||
| f19308af3c |
Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()
[ Upstream commit 862c628108562d8c7a516a900034823b381d3cba ]
syzbot reported the splat below without a repro.
In the splat, a single thread calling bt_accept_dequeue() freed sk
and touched it after that.
The root cause would be the racy l2cap_sock_cleanup_listen() call
added by the cited commit.
bt_accept_dequeue() is called under lock_sock() except for
l2cap_sock_release().
Two threads could see the same socket during the list iteration
in bt_accept_dequeue():
CPU1 CPU2 (close())
---- ----
sock_hold(sk) sock_hold(sk);
lock_sock(sk) <-- block close()
sock_put(sk)
bt_accept_unlink(sk)
sock_put(sk) <-- refcnt by bt_accept_enqueue()
release_sock(sk)
lock_sock(sk)
sock_put(sk)
bt_accept_unlink(sk)
sock_put(sk) <-- last refcnt
bt_accept_unlink(sk) <-- UAF
Depending on the timing, the other thread could show up in the
"Freed by task" part.
Let's call l2cap_sock_cleanup_listen() under lock_sock() in
l2cap_sock_release().
[0]:
BUG: KASAN: slab-use-after-free in debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline]
BUG: KASAN: slab-use-after-free in do_raw_spin_lock+0x26f/0x2b0 kernel/locking/spinlock_debug.c:115
Read of size 4 at addr ffff88803b7eb1c4 by task syz.5.3276/16995
CPU: 3 UID: 0 PID: 16995 Comm: syz.5.3276 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xcd/0x630 mm/kasan/report.c:482
kasan_report+0xe0/0x110 mm/kasan/report.c:595
debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline]
do_raw_spin_lock+0x26f/0x2b0 kernel/locking/spinlock_debug.c:115
spin_lock_bh include/linux/spinlock.h:356 [inline]
release_sock+0x21/0x220 net/core/sock.c:3746
bt_accept_dequeue+0x505/0x600 net/bluetooth/af_bluetooth.c:312
l2cap_sock_cleanup_listen+0x5c/0x2a0 net/bluetooth/l2cap_sock.c:1451
l2cap_sock_release+0x5c/0x210 net/bluetooth/l2cap_sock.c:1425
__sock_release+0xb3/0x270 net/socket.c:649
sock_close+0x1c/0x30 net/socket.c:1439
__fput+0x3ff/0xb70 fs/file_table.c:468
task_work_run+0x14d/0x240 kernel/task_work.c:227
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop+0xeb/0x110 kernel/entry/common.c:43
exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
do_syscall_64+0x3f6/0x4c0 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2accf8ebe9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdb6cb1378 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00000000000426fb RCX: 00007f2accf8ebe9
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f2acd1b7da0 R08: 0000000000000001 R09: 00000012b6cb166f
R10: 0000001b30e20000 R11: 0000000000000246 R12: 00007f2acd1b609c
R13: 00007f2acd1b6090 R14: ffffffffffffffff R15: 00007ffdb6cb1490
</TASK>
Allocated by task 5326:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:388 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:405
kasan_kmalloc include/linux/kasan.h:260 [inline]
__do_kmalloc_node mm/slub.c:4365 [inline]
__kmalloc_noprof+0x223/0x510 mm/slub.c:4377
kmalloc_noprof include/linux/slab.h:909 [inline]
sk_prot_alloc+0x1a8/0x2a0 net/core/sock.c:2239
sk_alloc+0x36/0xc20 net/core/sock.c:2295
bt_sock_alloc+0x3b/0x3a0 net/bluetooth/af_bluetooth.c:151
l2cap_sock_alloc.constprop.0+0x33/0x1d0 net/bluetooth/l2cap_sock.c:1894
l2cap_sock_new_connection_cb+0x101/0x240 net/bluetooth/l2cap_sock.c:1482
l2cap_connect_cfm+0x4c4/0xf80 net/bluetooth/l2cap_core.c:7287
hci_connect_cfm include/net/bluetooth/hci_core.h:2050 [inline]
hci_remote_features_evt+0x4dd/0x970 net/bluetooth/hci_event.c:3712
hci_event_func net/bluetooth/hci_event.c:7519 [inline]
hci_event_packet+0xa0d/0x11c0 net/bluetooth/hci_event.c:7573
hci_rx_work+0x2c5/0x16b0 net/bluetooth/hci_core.c:4071
process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3236
process_scheduled_works kernel/workqueue.c:3319 [inline]
worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400
kthread+0x3c2/0x780 kernel/kthread.c:463
ret_from_fork+0x5d7/0x6f0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Freed by task 16995:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576
poison_slab_object mm/kasan/common.c:243 [inline]
__kasan_slab_free+0x60/0x70 mm/kasan/common.c:275
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2417 [inline]
slab_free mm/slub.c:4680 [inline]
kfree+0x2b4/0x4d0 mm/slub.c:4879
sk_prot_free net/core/sock.c:2278 [inline]
__sk_destruct+0x75f/0x9a0 net/core/sock.c:2373
sk_destruct+0xc2/0xf0 net/core/sock.c:2401
__sk_free+0xf4/0x3e0 net/core/sock.c:2412
sk_free+0x6a/0x90 net/core/sock.c:2423
sock_put include/net/sock.h:1960 [inline]
bt_accept_unlink+0x245/0x2e0 net/bluetooth/af_bluetooth.c:262
bt_accept_dequeue+0x517/0x600 net/bluetooth/af_bluetooth.c:308
l2cap_sock_cleanup_listen+0x5c/0x2a0 net/bluetooth/l2cap_sock.c:1451
l2cap_sock_release+0x5c/0x210 net/bluetooth/l2cap_sock.c:1425
__sock_release+0xb3/0x270 net/socket.c:649
sock_close+0x1c/0x30 net/socket.c:1439
__fput+0x3ff/0xb70 fs/file_table.c:468
task_work_run+0x14d/0x240 kernel/task_work.c:227
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop+0xeb/0x110 kernel/entry/common.c:43
exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
do_syscall_64+0x3f6/0x4c0 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Fixes: 1728137b33c0 ("Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb")
Reported-by: syzbot+e5e64cdf8e92046dd3e1@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-bluetooth/68af6b9d.a70a0220.3cafd4.0032.GAE@google.com/
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>
|
|||
| 5d8a052b84 |
Merge tag 'v4.19.325-cip124' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip into android13-4.19-kona
version 4.19.325-cip124 * tag 'v4.19.325-cip124' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip: CIP: Bump version suffix to -cip124 after merge from cip/linux-4.19.y-st tree Update localversion-st, tree is up-to-date with 5.4.298. f2fs: fix to do sanity check on ino and xnid squashfs: fix memory leak in squashfs_fill_super pNFS: Handle RPC size limit for layoutcommits wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect usb: core: usb_submit_urb: downgrade type check udf: Verify partition map count f2fs: fix to avoid panic in f2fs_evict_inode usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() HID: asus: fix UAF via HID_CLAIMED_INPUT validation efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare sctp: initialize more fields in sctp_v6_from_sk() net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts net/mlx5e: Set local Xoff after FW update net: dlink: fix multicast stats being counted incorrectly atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). net/atm: remove the atmdev_ops {get, set}sockopt methods Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced powerpc/kvm: Fix ifdef to remove build warning net: ipv4: fix regression in local-broadcast routes vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() scsi: core: sysfs: Correct sysfs attributes access rights ftrace: Fix potential warning in trace_printk_seq during ftrace_dump alloc_fdtable(): change calling conventions. ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add ALSA: usb-audio: Fix size validation in convert_chmap_v3() scsi: qla4xxx: Prevent a potential error pointer dereference usb: xhci: Fix slot_id resource race conflict nfs: fix UAF in direct writes NFS: Fix up commit deadlocks Bluetooth: fix use-after-free in device_for_each_child() selftests: forwarding: tc_actions.sh: add matchall mirror test codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() sch_qfq: make qfq_qlen_notify() idempotent sch_hfsc: make hfsc_qlen_notify() idempotent sch_drr: make drr_qlen_notify() idempotent btrfs: populate otime when logging an inode item media: venus: hfi: explicitly release IRQ during teardown f2fs: fix to avoid out-of-boundary access in dnode page media: venus: protect against spurious interrupts during probe media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig usb: musb: omap2430: fix device leak at unbind NFS: Fix the setting of capabilities when automounting a new filesystem NFS: Fix up handling of outstanding layoutcommit in nfs_update_inode() NFSv4: Fix nfs4_bitmap_copy_adjust() usb: typec: fusb302: cache PD RX state cdc-acm: fix race between initial clearing halt and open USB: cdc-acm: do not log successful probe on later errors nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() tracing: Add down_write(trace_event_sem) when adding trace event usb: hub: Don't try to recover devices lost during warm reset. usb: hub: avoid warm port reset during USB3 disconnect x86/mce/amd: Add default names for MCA banks and blocks iio: hid-sensor-prox: Fix incorrect OFFSET calculation mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n mm/zsmalloc.c: convert to use kmem_cache_zalloc in cache_alloc_zspage() net: usbnet: Fix the wrong netif_carrier_on() call net: usbnet: Avoid potential RCU stall on LINK_CHANGE event PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value kbuild: Add KBUILD_CPPFLAGS to as-option invocation kbuild: add $(CLANG_FLAGS) to KBUILD_CPPFLAGS kbuild: Add CLANG_FLAGS to as-instr mips: Include KBUILD_CPPFLAGS in CHECKFLAGS invocation kbuild: Update assembler calls to use proper flags and language target ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS usb: dwc3: Ignore late xferNotReady event to prevent halt timeout USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles usb: storage: realtek_cr: Use correct byte order for bcs->Residue USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive iio: proximity: isl29501: fix buffered read on big-endian systems ftrace: Also allocate and copy hash for reading of filter files fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() fs/buffer: fix use-after-free when call bh_read() helper drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 media: venus: Add a check for packet size after reading from shared memory media: ov2659: Fix memory leaks in ov2659_probe() media: usbtv: Lock resolution while streaming media: gspca: Add bounds checking to firmware parser jbd2: prevent softlockup in jbd2_log_do_checkpoint() PCI: endpoint: Fix configfs group removal on driver teardown PCI: endpoint: Fix configfs group list head handling mtd: rawnand: fsmc: Add missing check after DMA map wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() zynq_fpga: use sgtable-based scatterlist wrappers ata: libata-scsi: Fix ata_to_sense_error() status handling ext4: fix reserved gdt blocks handling in fsmap ext4: fix fsmap end of range reporting with bigalloc ext4: check fast symlink for ea_inode correctly Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" vt: defkeymap: Map keycodes above 127 to K_HOLE usb: gadget: udc: renesas_usb3: fix device leak at unbind usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() m68k: Fix lost column on framebuffer debug console serial: 8250: fix panic due to PSLVERR media: uvcvideo: Do not mark valid metadata as invalid media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() btrfs: fix log tree replay failure due to file with 0 links and extents thunderbolt: Fix copy+paste error in match_service_id() misc: rtsx: usb: Ensure mmc child device is active when card is present scsi: lpfc: Remove redundant assignment to avoid memory leak rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe pNFS: Fix uninited ptr deref in block/scsi layout pNFS: Fix disk addr range check in block/scsi layout pNFS: Fix stripe mapping in block/scsi layout ipmi: Fix strcpy source and destination the same kconfig: lxdialog: fix 'space' to (de)select options kconfig: gconf: fix potential memory leak in renderer_edited() kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() scsi: aacraid: Stop using PCI_IRQ_AFFINITY scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans kconfig: nconf: Ensure null termination where strncpy is used kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c PCI: pnv_php: Work around switches with broken presence detection media: uvcvideo: Fix bandwidth issue for Alcor camera media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() media: usb: hdpvr: disable zero-length read messages media: tc358743: Increase FIFO trigger level to 374 media: tc358743: Return an appropriate colorspace from tc358743_set_fmt media: tc358743: Check I2C succeeded during probe pinctrl: stm32: Manage irq affinity settings scsi: mpt3sas: Correctly handle ATA device errors RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() MIPS: Don't crash in stack_top() for tasks without ABI or vDSO jfs: upper bound check of tree index in dbAllocAG jfs: Regular file corruption check jfs: truncate good inode pages when hard link is 0 scsi: bfa: Double-free fix MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} watchdog: dw_wdt: Fix default timeout fs/orangefs: use snprintf() instead of sprintf() scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr vhost: fail early when __vhost_add_used() fails uapi: in6: restore visibility of most IPv6 socket options net: ncsi: Fix buffer overflow in fetching version id net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs wifi: iwlegacy: Check rate_idx range after addition netmem: fix skb_frag_address_safe with unreadable skbs wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() net: fec: allow disable coalescing (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer s390/stp: Remove udelay from stp_sync_clock() wifi: iwlwifi: mvm: fix scan request validation net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() net: ipv4: fix incorrect MTU in broadcast routes wifi: cfg80211: Fix interface type validation et131x: Add missing check after DMA map be2net: Use correct byte order and format string for TCP seq and ack_seq s390/time: Use monotonic clock in get_cycles() wifi: cfg80211: reject HTC bit for management frames ktest.pl: Prevent recursion of default variable options ASoC: codecs: rt5640: Retry DEVICE_ID verification ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 ASoC: hdac_hdmi: Rate limit logging on connection and disconnection mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() ACPI: processor: fix acpi_object initialization PM: sleep: console: Fix the black screen issue thermal: sysfs: Return ENODATA instead of EAGAIN for reads selftests: tracing: Use mutex_unlock for testing glob filter ARM: tegra: Use I/O memcpy to write to IRAM gpio: tps65912: check the return value of regmap_update_bits() ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed cpufreq: Exit governor when failed to start old governor usb: xhci: Avoid showing errors during surprise removal usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command usb: xhci: Avoid showing warnings for dying controller selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t usb: xhci: print xhci->xhc_state when queue_command failed securityfs: don't pin dentries twice, once is enough... hfs: fix not erasing deleted b-tree node issue drbd: add missing kref_get in handle_write_conflicts arm64: Handle KCOV __init vs inline mismatches hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() hfs: fix slab-out-of-bounds in hfs_bnode_read() sctp: linearize cloned gso packets in sctp_rcv netfilter: ctnetlink: fix refcount leak on table dump udp: also consider secpath when evaluating ipsec use for checksumming fs: Prevent file descriptor table allocations exceeding INT_MAX sunvdc: Balance device refcount in vdc_port_mpgroup_check NFSD: detect mismatch of file handle and delegation stateid in OPEN op net: dpaa: fix device leak when querying time stamp info net: gianfar: fix device leak when querying time stamp info netlink: avoid infinite retry looping in netlink_unicast() ALSA: usb-audio: Validate UAC3 cluster segment descriptors ALSA: usb-audio: Validate UAC3 power domain descriptors, too usb: gadget : fix use-after-free in composite_dev_cleanup() MIPS: mm: tlb-r4k: Uniquify TLB entries on init USB: serial: option: add Foxconn T99W709 vsock: Do not allow binding to VMADDR_PORT_ANY net/packet: fix a race in packet_set_ring() and packet_notifier() perf/core: Prevent VMA split of buffer mappings perf/core: Exit early on perf_mmap() fail perf/core: Don't leak AUX buffer refcount on allocation failure pptp: fix pptp_xmit() error path smb: client: let recv_done() cleanup before notifying the callers. benet: fix BUG when creating VFs ipv6: reject malicious packets in ipv6_gso_segment() pptp: ensure minimal skb length in pptp_xmit() netpoll: prevent hanging NAPI when netcons gets enabled NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() pci/hotplug/pnv-php: Wrap warnings in macro pci/hotplug/pnv-php: Improve error msg on power state change failure usb: chipidea: udc: fix sleeping function called from invalid context f2fs: fix to avoid out-of-boundary access in devs.path f2fs: fix to avoid UAF in f2fs_sync_inode_meta() rtc: pcf8563: fix incorrect maximum clock rate handling rtc: hym8563: fix incorrect maximum clock rate handling rtc: ds1307: fix incorrect maximum clock rate handling mtd: rawnand: atmel: set pmecc data setup time mtd: rawnand: atmel: Fix dma_mapping_error() address jfs: fix metapage reference count leak in dbAllocCtl fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref crypto: qat - fix seq_file position update in adf_ring_next() dmaengine: nbpfaxi: Add missing check after DMA map dmaengine: mv_xor: Fix missing check after DMA map and missing unmap fs/orangefs: Allow 2 more characters in do_c_string() crypto: img-hash - Fix dma_unmap_sg() nents value scsi: isci: Fix dma_unmap_sg() nents value scsi: mvsas: Fix dma_unmap_sg() nents value scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value perf tests bp_account: Fix leaked file descriptor crypto: ccp - Fix crash when rebind ccp device for ccp.ko pinctrl: sunxi: Fix memory leak on krealloc failure power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set clk: davinci: Add NULL check in davinci_lpsc_clk_register() mtd: fix possible integer overflow in erase_xfer() crypto: marvell/cesa - Fix engine load inaccuracy PCI: rockchip-host: Fix "Unexpected Completion" log message vrf: Drop existing dst reference in vrf_ip6_input_dst netfilter: xt_nfacct: don't assume acct name is null-terminated can: kvaser_usb: Assign netdev.dev_port based on device channel index wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" mwl8k: Add missing check after DMA map wifi: rtl8xxxu: Fix RX skb size for aggregation disabled net/sched: Restrict conditions for adding duplicating netems to qdisc tree arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX netfilter: nf_tables: adjust lockdep assertions handling drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value m68k: Don't unregister boot console needlessly tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range iwlwifi: Add missing check for alloc_ordered_workqueue wifi: iwlwifi: Fix memory leak in iwl_mvm_init() wifi: rtl818x: Kill URBs before clearing tx status queue caif: reduce stack size, again staging: nvec: Fix incorrect null termination of battery manufacturer samples: mei: Fix building on musl libc usb: early: xhci-dbc: Fix early_ioremap leak Revert "vmci: Prevent the dispatching of uninitialized payloads" pps: fix poll support vmci: Prevent the dispatching of uninitialized payloads staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() ARM: dts: vfxxx: Correctly use two tuples for timer address ASoC: ops: dynamically allocate struct snd_ctl_elem_value hfsplus: remove mutex_lock check in hfsplus_free_extents ASoC: Intel: fix SND_SOC_SOF dependencies ethernet: intel: fix building with large NR_CPUS usb: phy: mxs: disconnect line when USB charger is attached usb: chipidea: udc: protect usb interrupt enable usb: chipidea: udc: add new API ci_hdrc_gadget_connect comedi: comedi_test: Fix possible deletion of uninitialized timers nilfs2: reject invalid file types when reading inodes i2c: qup: jump out of the loop in case of timeout net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class net: appletalk: Fix use-after-free in AARP proxy probe net: appletalk: fix kerneldoc warnings RDMA/core: Rate limit GID cache warning messages usb: hub: fix detection of high tier USB3 devices behind suspended hubs net_sched: sch_sfq: reject invalid perturb period net_sched: sch_sfq: move the limit validation net_sched: sch_sfq: use a temporary work area for validating configuration net_sched: sch_sfq: don't allow 1 packet limit net_sched: sch_sfq: handle bigger packets net_sched: sch_sfq: annotate data-races around q->perturb_period power: supply: bq24190_charger: Fix runtime PM imbalance on error xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS virtio-net: ensure the received length does not exceed allocated size usb: dwc3: qcom: Don't leave BCR asserted usb: musb: fix gadget state on disconnect net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout Bluetooth: SMP: If an unallowed command is received consider it a failure Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() usb: net: sierra: check for no status endpoint net/sched: sch_qfq: Fix race condition on qfq_aggregate net: emaclite: Fix missing pointer increment in aligned_read() comedi: Fix use of uninitialized data in insn_rw_emulate_bits() comedi: Fix some signed shift left operations comedi: das6402: Fix bit shift out of bounds comedi: das16m1: Fix bit shift out of bounds comedi: aio_iiro_16: Fix bit shift out of bounds comedi: pcl812: Fix bit shift out of bounds iio: adc: max1363: Reorder mode_list[] entries iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled soc: aspeed: lpc-snoop: Cleanup resources in stack-order mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() isofs: Verify inode mode when loading from disk dmaengine: nbpfaxi: Fix memory corruption in probe() af_packet: fix soft lockup issue caused by tpacket_snd() af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() HID: core: do not bypass hid_hw_raw_request HID: core: ensure __hid_request reserves the report ID as the first byte HID: core: ensure the allocated report buffer can contain the reserved report ID pch_uart: Fix dma_sync_sg_for_device() nents value Input: xpad - set correct controller type for Acer NGR200 i2c: stm32: fix the device used for the DMA map usb: gadget: configfs: Fix OOB read on empty string write USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI USB: serial: option: add Foxconn T99W640 USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition dma-mapping: add generic helpers for mapping sgtable objects usb: renesas_usbhs: Flush the notify_hotplug_work gpio: rcar: Use raw_spinlock to protect register access Change-Id: I03484e31376795f9823adc2824120ec86da6e3bf |
|||
| e0b26448cc |
Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced
[ Upstream commit 15bf2c6391bafb14a3020d06ec0761bce0803463 ]
This attempts to detect if HCI_EV_NUM_COMP_PKTS contain an unbalanced
(more than currently considered outstanding) number of packets otherwise
it could cause the hcon->sent to underflow and loop around breaking the
tracking of the outstanding packets pending acknowledgment.
Fixes:
|
|||
| 0d84d849ca |
Bluetooth: fix use-after-free in device_for_each_child()
commit 27aabf27fd014ae037cc179c61b0bee7cff55b3d upstream. Syzbot has reported the following KASAN splat: BUG: KASAN: slab-use-after-free in device_for_each_child+0x18f/0x1a0 Read of size 8 at addr ffff88801f605308 by task kbnepd bnep0/4980 CPU: 0 UID: 0 PID: 4980 Comm: kbnepd bnep0 Not tainted 6.12.0-rc4-00161-gae90f6a6170d #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x100/0x190 ? device_for_each_child+0x18f/0x1a0 print_report+0x13a/0x4cb ? __virt_addr_valid+0x5e/0x590 ? __phys_addr+0xc6/0x150 ? device_for_each_child+0x18f/0x1a0 kasan_report+0xda/0x110 ? device_for_each_child+0x18f/0x1a0 ? __pfx_dev_memalloc_noio+0x10/0x10 device_for_each_child+0x18f/0x1a0 ? __pfx_device_for_each_child+0x10/0x10 pm_runtime_set_memalloc_noio+0xf2/0x180 netdev_unregister_kobject+0x1ed/0x270 unregister_netdevice_many_notify+0x123c/0x1d80 ? __mutex_trylock_common+0xde/0x250 ? __pfx_unregister_netdevice_many_notify+0x10/0x10 ? trace_contention_end+0xe6/0x140 ? __mutex_lock+0x4e7/0x8f0 ? __pfx_lock_acquire.part.0+0x10/0x10 ? rcu_is_watching+0x12/0xc0 ? unregister_netdev+0x12/0x30 unregister_netdevice_queue+0x30d/0x3f0 ? __pfx_unregister_netdevice_queue+0x10/0x10 ? __pfx_down_write+0x10/0x10 unregister_netdev+0x1c/0x30 bnep_session+0x1fb3/0x2ab0 ? __pfx_bnep_session+0x10/0x10 ? __pfx_lock_release+0x10/0x10 ? __pfx_woken_wake_function+0x10/0x10 ? __kthread_parkme+0x132/0x200 ? __pfx_bnep_session+0x10/0x10 ? kthread+0x13a/0x370 ? __pfx_bnep_session+0x10/0x10 kthread+0x2b7/0x370 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x48/0x80 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 4974: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0xaa/0xb0 __kmalloc_noprof+0x1d1/0x440 hci_alloc_dev_priv+0x1d/0x2820 __vhci_create_device+0xef/0x7d0 vhci_write+0x2c7/0x480 vfs_write+0x6a0/0xfc0 ksys_write+0x12f/0x260 do_syscall_64+0xc7/0x250 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 4979: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x4f/0x70 kfree+0x141/0x490 hci_release_dev+0x4d9/0x600 bt_host_release+0x6a/0xb0 device_release+0xa4/0x240 kobject_put+0x1ec/0x5a0 put_device+0x1f/0x30 vhci_release+0x81/0xf0 __fput+0x3f6/0xb30 task_work_run+0x151/0x250 do_exit+0xa79/0x2c30 do_group_exit+0xd5/0x2a0 get_signal+0x1fcd/0x2210 arch_do_signal_or_restart+0x93/0x780 syscall_exit_to_user_mode+0x140/0x290 do_syscall_64+0xd4/0x250 entry_SYSCALL_64_after_hwframe+0x77/0x7f In 'hci_conn_del_sysfs()', 'device_unregister()' may be called when an underlying (kobject) reference counter is greater than 1. This means that reparenting (happened when the device is actually freed) is delayed and, during that delay, parent controller device (hciX) may be deleted. Since the latter may create a dangling pointer to freed parent, avoid that scenario by reparenting to NULL explicitly. Reported-by: syzbot+6cf5652d3df49fae2e3f@syzkaller.appspotmail.com Tested-by: syzbot+6cf5652d3df49fae2e3f@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6cf5652d3df49fae2e3f Fixes: a85fb91e3d72 ("Bluetooth: Fix double free in hci_conn_cleanup") Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> [ chanho: Backported from v5.10.y to v5.4.y. device_find_any_child() is not supported in v5.4.y, so changed to use device_find_child() with __match_any ] Signed-off-by: Chanho Min <chanho.min@lge.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Ulrich Hecht <uli@kernel.org> |
|||
| c6c13861ad |
Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU
[ Upstream commit d24e4a7fedae121d33fb32ad785b87046527eedb ] Configuration request only configure the incoming direction of the peer initiating the request, so using the MTU is the other direction shall not be used, that said the spec allows the peer responding to adjust: Bluetooth Core 6.1, Vol 3, Part A, Section 4.5 'Each configuration parameter value (if any is present) in an L2CAP_CONFIGURATION_RSP packet reflects an ‘adjustment’ to a configuration parameter value that has been sent (or, in case of default values, implied) in the corresponding L2CAP_CONFIGURATION_REQ packet.' That said adjusting the MTU in the response shall be limited to ERTM channels only as for older modes the remote stack may not be able to detect the adjustment causing it to silently drop packets. Link: https://github.com/bluez/bluez/issues/1422 Link: https://gitlab.archlinux.org/archlinux/packaging/packages/linux/-/issues/149 Link: https://gitlab.freedesktop.org/pipewire/pipewire/-/issues/4793 Fixes: 042bb9603c44 ("Bluetooth: L2CAP: Fix L2CAP MTU negotiation") Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Ulrich Hecht <uli@kernel.org> |
|||
| c7e4544c89 |
Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout
[ Upstream commit 6ef99c917688a8510259e565bd1b168b7146295a ]
This replaces the usage of HCI_ERROR_REMOTE_USER_TERM, which as the name
suggest is to indicate a regular disconnection initiated by an user,
with HCI_ERROR_AUTH_FAILURE to indicate the session has timeout thus any
pairing shall be considered as failed.
Fixes:
|
|||
| da158efcc3 |
Bluetooth: SMP: If an unallowed command is received consider it a failure
[ Upstream commit fe4840df0bdf341f376885271b7680764fe6b34e ]
If a command is received while a bonding is ongoing consider it a
pairing failure so the session is cleanup properly and the device is
disconnected immediately instead of continuing with other commands that
may result in the session to get stuck without ever completing such as
the case bellow:
> ACL Data RX: Handle 2048 flags 0x02 dlen 21
SMP: Identity Information (0x08) len 16
Identity resolving key[16]: d7e08edef97d3e62cd2331f82d8073b0
> ACL Data RX: Handle 2048 flags 0x02 dlen 21
SMP: Signing Information (0x0a) len 16
Signature key[16]: 1716c536f94e843a9aea8b13ffde477d
Bluetooth: hci0: unexpected SMP command 0x0a from XX:XX:XX:XX:XX:XX
> ACL Data RX: Handle 2048 flags 0x02 dlen 12
SMP: Identity Address Information (0x09) len 7
Address: XX:XX:XX:XX:XX:XX (Intel Corporate)
While accourding to core spec 6.1 the expected order is always BD_ADDR
first first then CSRK:
When using LE legacy pairing, the keys shall be distributed in the
following order:
LTK by the Peripheral
EDIV and Rand by the Peripheral
IRK by the Peripheral
BD_ADDR by the Peripheral
CSRK by the Peripheral
LTK by the Central
EDIV and Rand by the Central
IRK by the Central
BD_ADDR by the Central
CSRK by the Central
When using LE Secure Connections, the keys shall be distributed in the
following order:
IRK by the Peripheral
BD_ADDR by the Peripheral
CSRK by the Peripheral
IRK by the Central
BD_ADDR by the Central
CSRK by the Central
According to the Core 6.1 for commands used for key distribution "Key
Rejected" can be used:
'3.6.1. Key distribution and generation
A device may reject a distributed key by sending the Pairing Failed command
with the reason set to "Key Rejected".
Fixes:
|
|||
| 9b7d32f5c1 |
Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb()
[ Upstream commit a0075accbf0d76c2dad1ad3993d2e944505d99a0 ]
syzbot reported null-ptr-deref in l2cap_sock_resume_cb(). [0]
l2cap_sock_resume_cb() has a similar problem that was fixed by commit
1bff51ea59a9 ("Bluetooth: fix use-after-free error in lock_sock_nested()").
Since both l2cap_sock_kill() and l2cap_sock_resume_cb() are executed
under l2cap_sock_resume_cb(), we can avoid the issue simply by checking
if chan->data is NULL.
Let's not access to the killed socket in l2cap_sock_resume_cb().
[0]:
BUG: KASAN: null-ptr-deref in instrument_atomic_write include/linux/instrumented.h:82 [inline]
BUG: KASAN: null-ptr-deref in clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline]
BUG: KASAN: null-ptr-deref in l2cap_sock_resume_cb+0xb4/0x17c net/bluetooth/l2cap_sock.c:1711
Write of size 8 at addr 0000000000000570 by task kworker/u9:0/52
CPU: 1 UID: 0 PID: 52 Comm: kworker/u9:0 Not tainted 6.16.0-rc4-syzkaller-g7482bb149b9f #0 PREEMPT
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Workqueue: hci0 hci_rx_work
Call trace:
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:501 (C)
__dump_stack+0x30/0x40 lib/dump_stack.c:94
dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
print_report+0x58/0x84 mm/kasan/report.c:524
kasan_report+0xb0/0x110 mm/kasan/report.c:634
check_region_inline mm/kasan/generic.c:-1 [inline]
kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:189
__kasan_check_write+0x20/0x30 mm/kasan/shadow.c:37
instrument_atomic_write include/linux/instrumented.h:82 [inline]
clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline]
l2cap_sock_resume_cb+0xb4/0x17c net/bluetooth/l2cap_sock.c:1711
l2cap_security_cfm+0x524/0xea0 net/bluetooth/l2cap_core.c:7357
hci_auth_cfm include/net/bluetooth/hci_core.h:2092 [inline]
hci_auth_complete_evt+0x2e8/0xa4c net/bluetooth/hci_event.c:3514
hci_event_func net/bluetooth/hci_event.c:7511 [inline]
hci_event_packet+0x650/0xe9c net/bluetooth/hci_event.c:7565
hci_rx_work+0x320/0xb18 net/bluetooth/hci_core.c:4070
process_one_work+0x7e8/0x155c kernel/workqueue.c:3238
process_scheduled_works kernel/workqueue.c:3321 [inline]
worker_thread+0x958/0xed8 kernel/workqueue.c:3402
kthread+0x5fc/0x75c kernel/kthread.c:464
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:847
Fixes:
|
|||
| 9aff51ad3a |
Merge tag 'v4.19.325-cip123' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip into android13-4.19-kona
version 4.19.325-cip123 * tag 'v4.19.325-cip123' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip: CIP: Bump version suffix to -cip123 after merge from cip/linux-4.19.y-st tree Update localversion-st, tree is up-to-date with 5.4.296. emulex/benet: Fix build by return mismatch in be_cmd_unlock() net/sched: Abort __tc_modify_qdisc if parent class does not exist mtk-sd: Prevent memory corruption from DMA map failure mmc: mediatek: use data instead of mrq parameter from msdc_{un}prepare_data() scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() btrfs: don't abort filesystem when attempting to snapshot deleted subvolume VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify net: ipv6: Discard next-hop MTU less than minimum link MTU Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY vt: add missing notification when switching back to text mode net: usb: qmi_wwan: add SIMCom 8230C composition atm: idt77252: Add missing `dma_map_error()` bnxt_en: Fix DCB ETS validation can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level net: appletalk: Fix device refcount leak in atrtr_create() md/raid1: Fix stack memory use after return in raid1_reshape wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() dma-buf: fix timeout handling in dma_resv_wait_timeout v2 Input: xpad - support Acer NGR 200 Controller Input: xpad - add VID for Turtle Beach controllers Input: xpad - add support for Amazon Game Controller netlink: Fix rmem check in netlink_broadcast_deliver(). netlink: make sure we allow at least one dump skb Revert "ACPI: battery: negate current when discharging" usb: gadget: u_serial: Fix race condition in TTY wakeup drm/sched: Increment job count before swapping tail spsc queue x86/mce: Make sure CMCI banks are cleared during shutdown on Intel x86/mce: Don't remove sysfs if thresholding sysfs init fails x86/mce/amd: Fix threshold limit reset rxrpc: Fix oops due to non-existence of prealloc backlog struct atm: clip: Fix NULL pointer dereference in vcc_sendmsg() atm: clip: Fix infinite recursive call of clip_push(). atm: clip: Fix memory leak of struct clip_vcc. atm: clip: Fix potential null-ptr-deref in to_atmarpd(). tipc: Fix use-after-free in tipc_conn_close(). netlink: Fix wraparounds of sk->sk_rmem_alloc. fix proc_sys_compare() handling of in-lookup dentries proc: Clear the pieces of proc_inode that proc_evict_inode cares about staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() media: uvcvideo: Rollback non processed entities on error media: uvcvideo: Send control events for partial succeeds media: uvcvideo: Return the number of processed controls ACPI: PAD: fix crash in exit_round_robin() usb: typec: displayport: Fix potential deadlock Logitech C-270 even more broken rose: fix dangling neighbour pointers in rose_rt_device_down() net: rose: Fix fall-through warnings for Clang ethernet: atl1: Add missing DMA mapping error checks and count errors btrfs: use btrfs_record_snapshot_destroy() during rmdir btrfs: propagate last_unlink_trans earlier when doing a rmdir RDMA/mlx5: Fix CC counters query for MPV scsi: ufs: core: Fix spelling of a sysfs attribute name ACPICA: Refuse to evaluate a method if arguments are missing wifi: ath6kl: remove WARN on bad firmware input wifi: mac80211: drop invalid source address OCB frames powerpc: Fix struct termio related ioctl macros ata: pata_cs5536: fix build on 32-bit UML ALSA: sb: Force to disable DMAs once when DMA mode is changed net/sched: Always pass notifications when child class becomes empty nui: Fix dma_mapping_error() check enic: fix incorrect MTU comparison in enic_change_mtu() amd-xgbe: align CL37 AN sequence as per databook btrfs: fix missing error handling when searching for inode refs during log replay mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data usb: typec: altmodes/displayport: do not index invalid pin_assignments Revert "mmc: sdhci: Disable SD card clock before changing parameters" mmc: sdhci: Add a helper function for dump register in dynamic debug mode vsock/vmci: Clear the vmci transport packet properly when initializing it arm64: Restrict pagetable teardown to avoid false warning drm/bridge: cdns-dsi: Fix connecting to next bridge drm/tegra: Assign plane type before registration HID: wacom: fix kobject reference count leak HID: wacom: fix memory leak on sysfs attribute creation failure HID: wacom: fix memory leak on kobject creation failure dm-raid: fix variable in journal device check Bluetooth: L2CAP: Fix L2CAP MTU negotiation atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). um: ubd: Add missing error check in start_io_thread() vsock/uapi: fix linux/vm_sockets.h userspace compilation errors wifi: mac80211: fix beacon interval calculation overflow ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() i2c: robotfuzz-osif: disable zero-length read messages i2c: tiny-usb: disable zero-length read messages RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction RDMA/core: Use refcount_t instead of atomic_t on refcount of iwcm_id_private media: vivid: Change the siize of the composing media: omap3isp: use sgtable-based scatterlist wrappers jfs: validate AG parameters in dbMount() to prevent crashes fs/jfs: consolidate sanity checking in dbMount VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF ovl: Check for NULL d_inode() in ovl_dentry_upper() ceph: fix possible integer overflow in ceph_zero_objects() ALSA: hda: Ignore unsol events for cards being shut down usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode usb: cdc-wdm: avoid setting WDM_READ for ZLP-s usb: Add checks for snprintf() calls in usb_alloc_dev() usb: potential integer overflow in usbg_make_tpg() iio: pressure: zpa2326: Use aligned_s64 for the timestamp md/md-bitmap: fix dm-raid max_write_behind setting dmaengine: xilinx_dma: Set dma_device directions mfd: max14577: Fix wakeup source leaks on device unbind mailbox: Not protect module_put with spin_lock_irqsave cifs: Fix cifs_query_path_info() for Windows NT servers CIP: Bump version suffix to -cip122 after merge from cip/linux-4.19.y-st tree Update localversion-st, tree is up-to-date with 5.4.295. ARM: dts: am335x-bone-common: Increase MDIO reset deassert delay to 50ms ARM: dts: am335x-bone-common: Increase MDIO reset deassert time ARM: dts: am335x-bone-common: Add GPIO PHY reset on revision C3 board ARM: dts: am335x-bone-common: get rid of phy_id property mtd: nand: sunxi: Add randomizer configuration before randomizer enable mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() bridge: netfilter: Fix forwarding of fragmented packets vxlan: Annotate FDB data races hwmon: (gpio-fan) Add missing mutex locks nfs: handle failure of nfs_get_lock_context in unlock path sch_htb: make htb_deactivate() idempotent scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() perf: Fix sample vs do_exit() jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() mm/huge_memory: fix dereferencing invalid pmd migration entry posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() net: atm: fix /proc/net/atm/lec handling net: atm: add lec_mutex calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer atm: atmtcp: Free invalid length skb in atmtcp_c_send(). mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). wifi: carl9170: do not ping device which has failed to load firmware drm/nouveau/bl: increase buffer size to avoid truncate warning ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged ALSA: hda/intel: Add Thinkpad E15 to PM deny list Input: sparcspkr - avoid unannotated fall-through HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() atm: Revert atm_account_tx() if copy_from_iter_full() fails. selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len scsi: s390: zfcp: Ensure synchronous unit_add jffs2: check jffs2_prealloc_raw_node_refs() result in few other places jffs2: check that raw node were preallocated before writing summary drivers/rapidio/rio_cm.c: prevent possible heap overwrite Revert "x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2" on v6.6 and older powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery platform/x86: dell_rbu: Stop overwriting data buffer tee: Prevent size calculation wraparound on 32-bit kernels ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value watchdog: da9052_wdt: respect TWDMIN i40e: fix MMIO write access to an invalid page in i40e_clear_hw sock: Correct error checking condition for (assign|release)_proto_idx() vxlan: Do not treat dst cache initialization errors as fatal clk: rockchip: rk3036: mark ddrphy as critical wifi: mac80211: do not offer a mesh path if forwarding is disabled net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT tcp: always seek for minimal rtt in tcp_rcv_rtt_update() net: dlink: add synchronization for stats update sctp: Do not wake readers in __sctp_write_space() emulex/benet: correct command version selection in be_cmd_get_stats() i2c: designware: Invoke runtime suspend on quick slave re-registration net: macb: Check return value of dma_set_mask_and_coherent() cpufreq: Force sync policy boost with global boost on sysfs update nios2: force update_mmu_cache on spurious tlb-permission--related pagefaults media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() media: tc358743: ignore video while HPD is low drm/amdkfd: Set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB jfs: Fix null-ptr-deref in jfs_ioc_trim drm/amdgpu/gfx9: fix CSIB handling drm/amdgpu/gfx8: fix CSIB handling jfs: fix array-index-out-of-bounds read in add_missing_indices drm/amdgpu/gfx7: fix CSIB handling drm/amd/display: Add NULL pointer checks in dm_force_atomic_commit() media: uapi: v4l: Fix V4L2_TYPE_IS_OUTPUT condition sunrpc: update nextcheck time when adding new cache entries drm/amdgpu/gfx6: fix CSIB handling ACPI: battery: negate current when discharging power: supply: bq27xxx: Retrieve again when busy ACPICA: fix acpi parse and parseext cache leaks ACPICA: Avoid sequence overread in call to strncmp() ACPICA: fix acpi operand cache leak in dswstate.c PCI: Fix lock symmetry in pci_slot_unlock() regulator: max14577: Add error check for max14577_read_reg() staging: iio: ad5933: Correct settling cycles encoding per datasheet net: ch9200: fix uninitialised access during mii_nway_restart ftrace: Fix UAF when lookup kallsym after ftrace disabled dm-mirror: fix a tiny race condition mm: fix ratelimit_pages update error in dirty_ratio_handler() ipc: fix to protect IPCS lookups using RCU parisc: fix building with gcc-15 vgacon: Add check for vc_origin address range in vgacon_scroll() NFC: nci: uart: Set tty->disc_data only in success path f2fs: prevent kernel warning due to negative i_nlink from corrupted image Input: ims-pcu - check record size in ims_pcu_flash_firmware() ext4: fix calculation of credits for extent tree modification ext4: inline: fix len overflow in ext4_prepare_inline_data ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 media: v4l2-dev: fix error handling in __video_register_device() media: gspca: Add error handling for stv06xx_read_sensor() wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() gfs2: move msleep to sleepable context configfs: Do not override creating attribute file failure in populate_attrs() calipso: unlock rcu before returning -EAFNOSUPPORT usb: Flush altsetting 0 endpoints before reinitializating them after reset. fs/filesystems: Fix potential unsigned integer underflow in fs_name() net/mdiobus: Fix potential out-of-bounds read/write access MIPS: Move '-Wa,-msoft-float' check from as-option to cc-option x86/boot/compressed: prefer cc-option for CFLAGS additions net: mdio: C22 is now optional, EOPNOTSUPP if not provided i40e: retry VFLR handling if there is ongoing VF reset i40e: return false from i40e_reset_vf if reset is in progress net_sched: sch_sfq: fix a potential crash on gso_skb handling scsi: iscsi: Fix incorrect error path labels for flashnode operations NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes NFSD: Fix ia_size underflow Input: synaptics-rmi - fix crash with unsupported versions of F34 Input: synaptics-rmi4 - convert to use sysfs_emit() APIs do_change_type(): refuse to operate on unmounted/not ours mounts net/mlx4_en: Prevent potential integer overflow calculating Hz rtc: Fix offset calculation for .start_secs < 0 rtc: sh: assign correct interrupts with DT perf tests switch-tracking: Fix timestamp comparison mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() perf ui browser hists: Set actions->thread before calling do_zoom_thread() fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() soc: aspeed: lpc: Fix impossible judgment condition arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device bus: fsl-mc: fix double-free on mc_dev nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() nilfs2: add pointer check for nilfs_direct_propagate() Squashfs: check return result of sb_min_blocksize ARM: dts: at91: at91sam9263: fix NAND chip selects ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select f2fs: fix to correct check conditions in f2fs_cross_rename f2fs: use d_inode(dentry) cleanup dentry->d_inode calipso: Don't call calipso functions for AF_INET sk. net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy wifi: ath9k_htc: Abort software beacon handling if disabled bpf: Fix WARN() in get_bpf_raw_tp_regs pinctrl: at91: Fix possible out-of-boundary access net: ncsi: Fix GCPS 64-bit member variables f2fs: fix to do sanity check on sbi->total_valid_block_count drm/tegra: rgb: Fix the unbound reference count drm: rcar-du: Fix memory leak in rcar_du_vsps_init() selftests/seccomp: fix syscall_restart test for arm compat firmware: psci: Fix refcount leak in psci_dt_init m68k: mac: Fix macintosh_config for Mac II drm/vmwgfx: Add seqno waiter for sync_files ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() crypto: marvell/cesa - Avoid empty transfer descriptor crypto: marvell/cesa - Handle zero-length skcipher requests x86/cpu: Sanitize CPUID(0x80000000) output perf/core: Fix broken throttling when max_samples_per_tick=1 gfs2: gfs2_create_inode error handling fix netfilter: nft_socket: fix sk refcount leaks thunderbolt: Do not double dequeue a configuration request usb: usbtmc: Fix timeout value in get_stb usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE pinctrl: armada-37xx: set GPIO output value before setting direction pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs > 31 tracing: Fix compilation warning on arm32 platform/x86: thinkpad_acpi: Ignore battery threshold change event notification platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys spi: spi-sun4i: fix early activation um: let 'make clean' properly clean underlying SUBARCH as well platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS nfs: don't share pNFS DS connections between net namespaces HID: quirks: Add ADATA XPG alpha wireless mouse support coredump: fix error handling for replace_fd() smb: client: Reset all search buffer pointers when releasing buffer smb: client: Fix use-after-free in cifs_fill_dirent drm/i915/gvt: fix unterminated-string-initialization warning netfilter: nf_tables: do not defer rule destruction via call_rcu netfilter: nf_tables: wait for rcu grace period on net_device removal netfilter: nf_tables: pass nft_chain to destroy function, not nft_ctx mm/page_alloc.c: avoid infinite retries caused by cpuset race llc: fix data loss when reading from a socket in llc_ui_recvmsg() ALSA: pcm: Fix race of buffer access at PCM OSS layer can: bcm: add missing rcu read protection for procfs content can: bcm: add locking for bcm_op runtime updates crypto: algif_hash - fix double free in hash_accept net: dwmac-sun8i: Use parsed internal PHY address instead of 1 __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock xenbus: Allow PVH dom0 a non-local xenstore btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref ASoC: Intel: bytcr_rt5640: Add DMI quirk for Acer Aspire SW3-013 pinctrl: meson: define the pull up/down resistor value as 60 kOhm drm: Add valid clones check regulator: ad5398: Add device tree support bpftool: Fix readlink usage in get_fd_type HID: usbkbd: Fix the bit shift number for LED_KANA scsi: st: Restore some drive settings after reset scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine hwmon: (xgene-hwmon) use appropriate type for the latency value ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure(). net/mlx5: Extend Ethtool loopback selftest to support non-linear SKB net/mlx4_core: Avoid impossible mlx4_db_alloc() order value smack: recognize ipv4 CIPSO w/o categories pinctrl: devicetree: do not goto err when probing hogs in pinctrl_dt_to_map ASoC: ops: Enforce platform maximum on initial value ACPI: HED: Always initialize before evged PCI: Fix old_size lower bound in calculate_iosize() too EDAC/ie31200: work around false positive build warning net: pktgen: fix access outside of user given buffer in pktgen_thread_write() MIPS: pm-cps: Use per-CPU variables as per-CPU, not per-core MIPS: Use arch specific syscall name match function cpuidle: menu: Avoid discarding useful information x86/nmi: Add an emergency handler in nmi_desc & use it in nmi_shootdown_cpus() bonding: report duplicate MAC address in all situations net: xgene-v2: remove incorrect ACPI_PTR annotation x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2 net: pktgen: fix mpls maximum labels list parsing pinctrl: bcm281xx: Use "unsigned int" instead of bare "unsigned" media: cx231xx: set device_caps for 417 dm cache: prevent BUG_ON by blocking retries on failed device resumes media: c8sectpfe: Call of_node_put(i2c_bus) only once in c8sectpfe_probe() ARM: tegra: Switch DSI-B clock parent to PLLD on Tegra114 ieee802154: ca8210: Use proper setters and getters for bitwise types rtc: ds1307: stop disabling alarms on probe powerpc/prom_init: Fixup missing #size-cells on PowerBook6,7 mmc: sdhci: Disable SD card clock before changing parameters posix-timers: Add cond_resched() to posix_timer_add() search loop xen: Add support for XenServer 6.1 platform device dm: restrict dm device size to 2^63-512 bytes kbuild: fix argument parsing in scripts/config scsi: st: ERASE does not change tape location scsi: st: Tighten the page format heuristics with MODE SELECT ext4: reorder capability check last um: Update min_low_pfn to match changes in uml_reserved um: Store full CSGSFS and SS register from mcontext btrfs: send: return -ENAMETOOLONG when attempting a path that is too long btrfs: avoid linker error in btrfs_find_create_tree_block() i2c: pxa: fix call balance of i2c->clk handling routines mmc: host: Wait for Vdd to settle on card power off pNFS/flexfiles: Report ENETDOWN as a connection error tools/build: Don't pass test log files to linker dql: Fix dql->limit value when reset. SUNRPC: rpc_clnt_set_transport() must not change the autobind setting NFSv4: Treat ENETUNREACH errors as fatal for state recovery fbdev: core: tileblit: Implement missing margin clearing for tileblit fbdev: fsl-diu-fb: add missing device_remove_file() mailbox: use error ret code of of_parse_phandle_with_args() kconfig: merge_config: use an empty file as initfile cgroup: Fix compilation issue due to cgroup_mutex not being exported dma-mapping: avoid potential unused data compilation warning scsi: target: iscsi: Fix timeout on deleted connection openvswitch: Fix unsafe attribute parsing in output_userspace() Input: synaptics - enable InterTouch on TUXEDO InfinityBook Pro 14 v5 Input: synaptics - enable SMBus for HP Elitebook 850 G1 phy: Fix error handling in tegra_xusb_port_init ALSA: es1968: Add error handling for snd_pcm_hw_constraint_pow2() ACPI: PPTT: Fix processor subtable walk qlcnic: fix memory leak in qlcnic_sriov_channel_cfg_cmd() ALSA: sh: SND_AICA should depend on SH_DMA_API spi: loopback-test: Do not split 1024-byte hexdumps RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug staging: axis-fifo: Correct handling of tx_fifo_depth for size validation staging: axis-fifo: avoid parsing ignored device tree properties platform/x86: asus-wmi: Fix wlan_ctrl_by_user detection do_umount(): add missing barrier before refcount checks in sync case MIPS: Fix MAX_REG_OFFSET iio: adc: dln2: Use aligned_s64 for timestamp types: Complement the aligned types with signed 64-bit one USB: usbtmc: use interruptible sleep in usbtmc_read usb: typec: tcpm: delay SNK_TRY_WAIT_DEBOUNCE to SRC_TRYWAIT transition ocfs2: stop quota recovery before disabling quotas ocfs2: implement handshaking with ocfs2 recovery thread ocfs2: switch osb->disable_recovery to enum module: ensure that kobject_put() is safe for module type kobjects xenbus: Use kref to track req lifetime usb: uhci-platform: Make the clock really optional iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo iio: adis16201: Correct inclinometer channel resolution Input: synaptics - enable InterTouch on Dell Precision M3800 Input: synaptics - enable InterTouch on Dynabook Portege X30L-G Input: synaptics - enable InterTouch on Dynabook Portege X30-D net: dsa: b53: fix learning on VLAN unaware bridges scsi: target: Fix WRITE_SAME No Data Buffer crash dm: fix copying after src array boundaries iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid irqchip/gic-v2m: Add const to of_device_id sch_htb: make htb_qlen_notify() idempotent of: module: add buffer overflow check in of_modalias() net: fec: ERR007885 Workaround for conventional TX lan743x: remove redundant initialization of variable current_head_index net: dlink: Correct endianness handling of led_mode tracing: Fix oob write in trace_seq_to_buffer() dm: always update the array size in realloc_argv on success wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload i2c: imx-lpi2c: Fix clock count when probe defers EDAC/altera: Set DDR and SDMMC interrupt mask before registration EDAC/altera: Test the correct error reg offset signal/m68k: Use force_sigsegv(SIGSEGV) in fpsp040_die mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro() x86/bugs: fix backport error in "x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline" x86/bugs: fix backport error in "x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline" CIP: Bump version suffix to -cip121 after merge from cip/linux-4.19.y-st tree Update localversion-st, tree is up-to-date with 5.4.293. x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec() PCI: Rename PCI_IRQ_LEGACY to PCI_IRQ_INTX MIPS: cm: Fix warning if MIPS_CM is disabled comedi: jr3_pci: Fix synchronous deletion of timer scsi: pm80xx: Set phy_attached to zero when device is gone ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls selftests: ublk: fix test_stripe_04 KVM: s390: Don't use %pK through tracepoints sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP ntb: reduce stack usage in idt_scan_mws qibfs: fix _another_ leak usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev() usb: host: max3421-hcd: Add missing spi_device_id table parisc: PDT: Fix missing prototype warning MIPS: cm: Detect CM quirks from device tree USB: VLI disk crashes if LPM is used usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive usb: dwc3: gadget: check that event count does not exceed event buffer length USB: OHCI: Add quirk for LS7A OHCI controller (rev 0x02) USB: serial: simple: add OWON HDS200 series oscilloscope support USB: serial: option: add Sierra Wireless EM9291 USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe USB: storage: quirk for ADATA Portable HDD CH94 mcb: fix a double free bug in chameleon_parse_gdd() virtio_console: fix missing byte order handling for cols and rows net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too net_sched: hfsc: Fix a UAF vulnerability in class handling tipc: fix NULL pointer dereference in tipc_mon_reinit_self() net: phy: leds: fix memory leak cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error misc: pci_endpoint_test: Use INTX instead of LEGACY net: dsa: mv88e6xxx: fix VTU methods for 6320 family ext4: fix OOB read when checking dotdot dir ext4: optimize __ext4_check_dir_entry() MIPS: ds1287: Match ds1287_set_base_clock() function types MIPS: cevt-ds1287: Add missing ds1287.h include MIPS: dec: Declare which_prom() as static virtio-net: Add validation for used length openvswitch: fix lockup on tx to unregistering netdev with carrier net: openvswitch: fix race on port output mmc: cqhci: Fix checking of CQHCI_HALT state nvmet-fc: Remove unused functions usb: dwc3: support continuous runtime PM with dual role misc: pci_endpoint_test: Fix 'irq_type' to convey the correct type misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). kbuild: Add '-fno-builtin-wcslen' drm/sti: remove duplicate object names drm/repaper: fix integer overflows in repeat functions module: sign with sha512 instead of sha1 by default isofs: Prevent the use of too small fid i2c: cros-ec-tunnel: defer probe if parent EC is not present hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key btrfs: correctly escape subvol in btrfs_show_options() nfs: move nfs_fhandle_hash to common include file NFSD: Constify @fh argument of knfsd_fh_hash() asus-laptop: Fix an uninitialized variable writeback: fix false warning in inode_to_wb() net: b53: enable BPDU reception for management port net: openvswitch: fix nested key length validation in the set() action Revert "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" Bluetooth: btrtl: Prevent potential NULL dereference Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe() scsi: iscsi: Fix missing scsi_host_put() in error path wifi: wl1251: fix memory leak in wl1251_tx_work wifi: mac80211: Purge vif txq in ieee80211_do_stop() wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue() wifi: at76c50x: fix use after free access in at76_disconnect HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition Bluetooth: hci_uart: Fix another race during initialization x86/e820: Fix handling of subpage regions when calculating nosave ranges in e820__register_nosave_regions() PCI: Fix reference leak in pci_alloc_child_bus() of/irq: Fix device node refcount leakages in of_irq_init() of/irq: Fix device node refcount leakage in API irq_of_parse_and_map() gpio: zynq: Fix wakeup source leaks on device unbind ftrace: Add cond_resched() to ftrace_graph_set_hash() crypto: ccp - Fix check for the primary ASP device thermal/drivers/rockchip: Add missing rk3328 mapping entry sctp: detect and prevent references to a freed transport in sendmsg mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock sparc/mm: disable preemption in lazy mmu mode arm64: dts: mediatek: mt8173: Fix disp-pwm compatible string mtd: inftlcore: Add error check for inftl_read_oob() lib: scatterlist: fix sg_split_phys to preserve original scatterlist offsets jbd2: remove wrong sb->s_sequence check ext4: fix off-by-one error in do_split media: venus: hfi_parser: add check to avoid out of bound access media: i2c: ov7251: Introduce 1 ms delay between regulators and en GPIO media: i2c: ov7251: Set enable GPIO low in probe media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf() media: streamzap: prevent processing IR data on URB failure mtd: rawnand: brcmnand: fix PM resume warning arm64: cputype: Add MIDR_CORTEX_A76AE xenfs/xensyms: respect hypervisor's "next" indication media: siano: Fix error handling in smsdvb_module_init() media: venus: hfi: add check to handle incorrect queue size media: venus: hfi: add a check to handle OOB in sfr region media: i2c: adv748x: Fix test pattern selection mask bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags bpf: Add endian modifiers to fix endian warnings fbdev: omapfb: Add 'plane' value check drm/mediatek: mtk_dpi: Explicitly manage TVD clock in power on/off drm/amdkfd: Fix pqm_destroy_queue race with GPU reset drm: allow encoder mode_set even when connectors change for crtc Bluetooth: hci_uart: fix race during initialization tracing: fix return value in __ftrace_event_enable_disable for TRACE_REG_UNREGISTER net: vlan: don't propagate flags on open scsi: st: Fix array overflow in st_setup() ext4: ignore xattrs past end ext4: protect ext4_release_dquot against freezing ahci: add PCI ID for Marvell 88SE9215 SATA Controller ata: libata-eh: Do not use ATAPI DMA for a device limited to PIO mode jfs: add sanity check for agwidth in dbMount jfs: Prevent copying of nlink with value 0 from disk inode fs/jfs: Prevent integer overflow in AG size calculation fs/jfs: cast inactags to s64 to prevent potential overflow ALSA: usb-audio: Fix CME quirk for UF series keyboards ALSA: hda: intel: Fix Optimus when GPU has no sound HID: pidff: Fix null pointer dereference in pidff_find_fields HID: pidff: Do not send effect envelope if it's empty HID: pidff: Convert infinite length from Linux API to PID standard perf: arm_pmu: Don't disable counter in armpmu_add() x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD when running in a virtual machine pm: cpupower: bench: Prevent NULL dereference on malloc failure net: ppp: Add bound checking for skb data on ppp_sync_txmung ata: sata_sx4: Add error handling in pdc20621_i2c_read() ata: sata_sx4: Drop pointless VPRINTK() calls and convert the remaining ones tipc: fix memory leak in tipc_link_xmit ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe() CIP: Bump version suffix to -cip120 after merge from cip/linux-4.19.y-st tree Update localversion-st, tree is up-to-date with 5.4.292. net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on destroy jfs: add index corruption check to DT_GETPAGE() jfs: fix slab-out-of-bounds read in ea_get() tracing: Fix use-after-free in print_graph_function_flags during tracer switching mmc: sdhci-pxav3: set NEED_RSP_BUSY capability x86/tsc: Always save/restore TSC sched_clock() on suspend/resume ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk() arcnet: Add NULL check in com20020pci_probe() ipv6: fix omitted netlink attributes when using RTEXT_FILTER_SKIP_STATS vsock: avoid timeout during connect() if the socket is closing net_sched: skbprio: Remove overly strict queue assertions netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets ntb: intel: Fix using link status DB's ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans spufs: fix a leak in spufs_create_context() spufs: fix a leak on spufs_new_file() failure hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9} sched/deadline: Use online cpus for validating runtime affs: don't write overlarge OFS data block size fields affs: generate OFS sequence numbers starting at 1 wifi: iwlwifi: fw: allocate chained SG tables for dump sched/smt: Always inline sched_smt_active() ring-buffer: Fix bytes_dropped calculation issue objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds() fs/procfs: fix the comment above proc_pid_wchan() perf python: Check if there is space to copy all the event perf python: Decrement the refcount of just created event on failure perf python: Fixup description of sample.id event member ocfs2: validate l_tree_depth to avoid out-of-bounds access perf units: Fix insufficient array space iio: accel: mma8452: Ensure error return on failure to matching oversampling ratio coresight: catu: Fix number of pages while using 64k pages isofs: fix KMSAN uninit-value bug in do_isofs_readdir() x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment mfd: sm501: Switch to BIT() to mitigate integer overflows RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow power: supply: max77693: Fix wrong conversion of charge input threshold value x86/entry: Fix ORC unwinder for PUSH_REGS with save_ret=1 IB/mad: Check available slots before posting receive WRs clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent lib: 842: Improve error handling in sw842_compress() clk: amlogic: gxbb: drop incorrect flag on 32k clock fbdev: sm501fb: Add some geometry checks. mdacon: rework dependency list fbdev: au1100fb: Move a variable assignment behind a null pointer check PCI/portdrv: Only disable pciehp interrupts early when needed ALSA: hda/realtek: Always honor no_shutup_pins perf/ring_buffer: Allow the EPOLLRDNORM flag for poll lockdep: Don't disable interrupts on RT in disable_irq_nosync_lockdep.*() thermal: int340x: Add NULL check for adev EDAC/ie31200: Fix the error path order of ie31200_init() EDAC/ie31200: Fix the DIMM size mask for several SoCs x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct() cpufreq: governor: Fix negative 'idle_time' handling in dbs_update() net: usb: usbnet: restore usb%d name exception for local mac addresses net: usb: qmi_wwan: add Telit Cinterion FE990B composition net: usb: qmi_wwan: add Telit Cinterion FN990B composition tty: serial: 8250: Add some more device IDs netfilter: socket: Lookup orig tuple for IPv6 SNAT ARM: 9351/1: fault: Add "cut here" line for prefetch aborts ARM: 9350/1: fault: Implement copy_from_kernel_nofault_allowed() atm: Fix NULL pointer dereference ALSA: usb-audio: Add quirk for Plantronics headsets to fix control names drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() batman-adv: Ignore own maximum aggregation size during RX ARM: shmobile: smp: Enforce shmobile_smp_* alignment mmc: atmel-mci: Add missing clk_disable_unprepare() net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES net: atm: fix use after free in lec_send() Bluetooth: Fix error code in chan_alloc_skb_cb() RDMA/hns: Fix wrong value of max_sge_rd RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path xfrm_output: Force software GSO only in tunnel mode i2c: sis630: Fix an error handling path in sis630_probe() i2c: ali15x3: Fix an error handling path in ali15x3_probe() i2c: ali1535: Fix an error handling path in ali1535_probe() ASoC: codecs: wm0010: Fix error handling path in wm0010_spi_probe() drm/gma500: Add NULL check for pci_gfx_root in mid_get_vbt_data() qlcnic: fix memory leak issues in qlcnic_sriov_common.c drm/amd/display: Assign normalized_pix_clk when color depth = 14 x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes USB: serial: option: match on interface class for Telit FN990B USB: serial: option: fix Telit Cinterion FE990A name USB: serial: option: add Telit Cinterion FE990B compositions USB: serial: ftdi_sio: add support for Altera USB Blaster 3 block: fix 'kmem_cache of name 'bio-108' already exists' drm/nouveau: Do not override forced connector status x86/irq: Define trace events conditionally nvme: only allow entering LIVE from CONNECTING state sctp: Fix undefined behavior in left shift operation nvmet-rdma: recheck queue state is LIVE in state lock in recv done s390/cio: Fix CHPID "configure" attribute caching HID: ignore non-functional sensor in HP 5MP Camera iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() powercap: call put_device() on an error path in powercap_register_control_type() nvme-fc: go straight to connecting state when initializing net_sched: Prevent creation of classes with TC_H_ROOT ipvs: prevent integer overflow in do_ip_vs_get_ctl() netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree() Drivers: hv: vmbus: Don't release fb_mmio resource in vmbus_free_mmio() drivers/hv: Replace binary semaphore with mutex netpoll: hold rcu read lock in __netpoll_send_skb() netpoll: netpoll_send_skb() returns transmit status netpoll: move netpoll_send_skb() out of line netpoll: remove dev argument from netpoll_send_skb_on_dev() netpoll: Fix use correct return type for ndo_start_xmit() pinctrl: bcm281xx: Fix incorrect regmap max_registers value sctp: sysctl: auth_enable: avoid using current->nsproxy sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy Revert "sctp: sysctl: auth_enable: avoid using current->nsproxy" Revert "sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy" sched/isolation: Prevent boot crash when the boot CPU is nohz_full CIP: Bump version suffix to -cip119 after merge from cip/linux-4.19.y-st tree watchdog: renesas_wdt: support handover from bootloader Update localversion-st, tree is up-to-date with 5.4.291. gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl(). gtp: Destroy device along with udp socket's netns dismantle. net: gso: fix ownership in __udp_gso_segment vlan: fix memory leak in vlan_newlink() batman-adv: Drop unmanaged ELP metric worker tee: optee: Fix supplicant wait loop pps: Fix a use-after-free net: rose: lock the socket in rose_bind() btrfs: fix use-after-free when attempting to join an aborted transaction media: lmedm04: Handle errors for lme2510_int_read wifi: rtlwifi: rtl8192se: rise completion of firmware loading as last step eeprom: digsy_mtc: Make GPIO lookup table match the device slimbus: messaging: Free transaction ID in delayed interrupt scenario intel_th: pci: Add Panther Lake-P/U support intel_th: pci: Add Panther Lake-H support intel_th: pci: Add Arrow Lake support Squashfs: check the inode number is not the invalid value of zero xhci: pci: Fix indentation in the PCI device ID definitions usb: gadget: Check bmAttributes only if configuration is valid usb: gadget: Fix setting self-powered state on suspend usb: gadget: Set self-powered based on MaxPower and bmAttributes usb: typec: tcpci_rt1711h: Unmask alert interrupts to fix functionality usb: typec: ucsi: increase timeout for PPM reset operations usb: atm: cxacru: fix a flaw in existing endpoint checks usb: quirks: Add DELAY_INIT and NO_LPM for Prolific Mass Storage Card Reader usb: renesas_usbhs: Use devm_usb_get_phy() Revert "drivers/card_reader/rtsx_usb: Restore interrupt based detection" net: ipv6: fix missing dst ref drop in ila lwtunnel net: ipv6: fix dst ref loop in ila lwtunnel net-timestamp: support TCP GSO case for a few missing flags vlan: enforce underlying device type ppp: Fix KMSAN uninit-value warning with bpf be2net: fix sleeping while atomic bugs in be_ndo_bridge_getlink hwmon: fix a NULL vs IS_ERR_OR_NULL() check in xgene_hwmon_probe() llc: do not use skb_get() before dev_queue_xmit() hwmon: (ad7314) Validate leading zero bits and return error hwmon: (ntc_thermistor) Fix the ncpXXxh103 sensor table hwmon: (pmbus) Initialise page count in pmbus_identify() caif_virtio: fix wrong pointer check in cfv_probe() HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() mm/page_alloc: fix uninitialized variable rapidio: fix an API misues when rio_add_net() fails rapidio: add check for rio_add_net() in rio_scan_alloc_net() wifi: nl80211: reject cooked mode if it is set along with other flags wifi: cfg80211: regulatory: improve invalid hints checking x86/cpu: Properly parse CPUID leaf 0x2 TLB descriptor 0x63 x86/cpu: Validate CPUID leaf 0x2 EDX output x86/cacheinfo: Validate CPUID leaf 0x2 EDX output platform/x86: thinkpad_acpi: Add battery quirk for ThinkPad X131e drm/radeon: Fix rs400_gpu_init for ATI mobility radeon Xpress 200M ALSA: hda/realtek: update ALC222 depop optimize ALSA: hda: intel: Add Dell ALC3271 to power_save denylist HID: appleir: Fix potential NULL dereference at raw event handle Revert "of: reserved-memory: Fix using wrong number of cells to get property 'alignment'" drm/amdgpu: disable BAR resize on Dell G5 SE drm/amdgpu: Check extended configuration space register when system uses large bar drm/amdgpu: skip BAR resizing if the bios already did it acct: perform last write from workqueue kernel/acct.c: use dedicated helper to access rlimit values kernel/acct.c: use #elif instead of #end and #elif pfifo_tail_enqueue: Drop new packet when sch->limit == 0 sched/core: Prevent rescheduling when interrupts are disabled phy: exynos5-usbdrd: fix MPLL_MULTIPLIER and SSC_REFCLKSEL masks in refclk usbnet: gl620a: fix endpoint checking in genelink_bind() perf/core: Fix low freq setting via IOC_PERIOD ftrace: Avoid potential division by zero in function_stat_show() x86/CPU: Fix warm boot hang regression on AMD SC1100 SoC systems ipvs: Always clear ipvs_property flag in skb_scrub_packet() ASoC: es8328: fix route from DAC to output net: cadence: macb: Synchronize stats calculations sunrpc: suppress warnings for unused procfs functions batman-adv: Ignore neighbor throughput metrics in error case acct: block access to kernel internal filesystems ALSA: hda/conexant: Add quirk for HP ProBook 450 G4 mute LED nfp: bpf: Add check for nfp_app_ctrl_msg_alloc() power: supply: da9150-fg: fix potential overflow geneve: Suppress list corruption splat in geneve_destroy_tunnels(). geneve: Fix use-after-free in geneve_find_dev(). powerpc/code-patching: Fix KASAN hit by not flagging text patching area as VM_ALLOC ALSA: hda/realtek - Add type for ALC287 powerpc/64s: Rewrite __real_pte() and __rpte_to_hidx() as static inline powerpc/64s/mm: Move __real_pte stubs into hash-4k.h USB: gadget: f_midi: f_midi_complete to call queue_work usb/gadget: f_midi: Replace tasklet with work usb/gadget: f_midi: convert tasklets to use new tasklet_setup() API usb: dwc3: Fix timeout issue during controller enter/exit from halt state mm: update mark_victim tracepoints fields crypto: testmgr - some more fixes to RSA test vectors crypto: testmgr - populate RSA CRT parameters in RSA test vectors crypto: testmgr - fix version number of RSA tests crypto: testmgr - Fix wrong test case of RSA crypto: testmgr - fix wrong key length for pkcs1pad driver core: bus: Fix double free in driver API bus_register() scsi: storvsc: Set correct data length for sending SCSI command without payload vlan: move dev_put into vlan_dev_uninit vlan: introduce vlan_dev_free_egress_priority Revert "btrfs: avoid monopolizing a core when activating a swap file" parport_pc: add support for ASIX AX99100 can: ems_pci: move ASIX AX99100 ids to pci_ids.h nilfs2: protect access to buffers with no active references nilfs2: do not force clear folio if buffer is referenced nilfs2: do not output warnings when clearing dirty buffers alpha: replace hardcoded stack offsets with autogenerated ones ndisc: extend RCU protection in ndisc_send_skb() openvswitch: use RCU protection in ovs_vport_cmd_fill_info() arp: use RCU protection in arp_xmit() neighbour: use RCU protection in __neigh_notify() neighbour: delete redundant judgment statements ndisc: use RCU protection in ndisc_alloc_skb() ipv6: use RCU protection in ip6_default_advmss() ipv4: use RCU protection in inet_select_addr() ipv4: use RCU protection in rt_is_expired() net: add dev_net_rcu() helper net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() partitions: mac: fix handling of bogus partition table gpio: stmpe: Check return value of stmpe_reg_read in stmpe_gpio_irq_sync_unlock alpha: align stack for page fault and user unaligned trap handlers alpha: make stack 16-byte aligned (most cases) can: c_can: fix unbalanced runtime PM disable in error path USB: serial: option: drop MeiG Smart defines USB: serial: option: fix Telit Cinterion FN990A name USB: serial: option: add Telit Cinterion FN990B compositions USB: serial: option: add MeiG Smart SLM828 usb: cdc-acm: Fix handling of oversized fragments usb: cdc-acm: Check control transfer buffer size before access USB: cdc-acm: Fill in Renesas R-Car D3 USB Download mode quirk USB: hub: Ignore non-compliant devices with too many configs or interfaces usb: gadget: f_midi: fix MIDI Streaming descriptor lengths USB: Add USB_QUIRK_NO_LPM quirk for sony xperia xz1 smartphone USB: quirks: add USB_QUIRK_NO_LPM quirk for Teclast dist USB: pci-quirks: Fix HCCPARAMS register error for LS7A EHCI usb: dwc2: gadget: remove of_node reference upon udc_stop usb: gadget: udc: renesas_usb3: Fix compiler warning usb: roles: set switch registered flag early on batman-adv: fix panic during interface removal ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet 5V orangefs: fix a oob in orangefs_debug_write Grab mm lock before grabbing pt lock vfio/pci: Enable iowrite64 and ioread64 for vfio pci media: cxd2841er: fix 64-bit division on gcc-9 xen: remove a confusing comment on auto-translated guest I/O gpio: bcm-kona: Add missing newline to dev_err format string gpio: bcm-kona: Fix GPIO lock/unlock for banks above bank 0 arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array team: better TEAM_OPTION_TYPE_STRING validation vrf: use RCU protection in l3mdev_l3_out() ndisc: ndisc_send_redirect() must use dev_get_by_index_rcu() HID: multitouch: Add NULL check in mt_input_configured ocfs2: check dir i_size in ocfs2_find_entry MIPS: ftrace: Declare ftrace_get_parent_ra_addr() as static ptp: Ensure info->enable callback is always set mtd: onenand: Fix uninitialized retlen in do_otp_read() NFC: nci: Add bounds checking in nci_hci_create_pipe() nilfs2: fix possible int overflows in nilfs_fiemap() ocfs2: handle a symlink read error correctly ocfs2: fix incorrect CPU endianness conversion causing mount failure nvmem: core: improve range check for nvmem_cell_write() crypto: qce - fix goto jump in error path media: uvcvideo: Remove redundant NULL assignment media: uvcvideo: Fix event flags in uvc_ctrl_send_events media: ov5640: fix get_light_freq on auto soc: qcom: smem_state: fix missing of_node_put in error path powerpc/pseries/eeh: Fix get PE state translation serial: sh-sci: Do not probe the serial port if its slot in sci_ports[] is in use serial: sh-sci: Drop __initdata macro for port_cfg usb: gadget: f_tcm: Don't prepare BOT write request twice usb: gadget: f_tcm: ep_autoconfig with fullspeed endpoint usb: gadget: f_tcm: Decrement command ref count on cleanup usb: gadget: f_tcm: Translate error to sense wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize() HID: hid-sensor-hub: don't use stale platform-data on remove of: reserved-memory: Fix using wrong number of cells to get property 'alignment' of: Fix of_find_node_opts_by_path() handling of alias+path+options of: Correct child specifier used as input of the 2nd nexus node clk: qcom: clk-alpha-pll: fix alpha mode configuration Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc KVM: s390: vsie: fix some corner-cases when grabbing vsie pages KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() arm64: dts: rockchip: increase gmac rx_delay on rk3399-puma binfmt_flat: Fix integer overflow bug on 32 bit systems m68k: vga: Fix I/O defines s390/futex: Fix FUTEX_OP_ANDN implementation leds: lp8860: Write full EEPROM, not only half of it cpufreq: s3c64xx: Fix compilation warning tun: revert fix group permission check netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() udp: gso: do not drop small packets when PMTU reduces tg3: Disable tg3 PCIe AER on system reboot firmware: iscsi_ibft: fix ISCSI_IBFT Kconfig entry nvme: handle connectivity loss in nvme_set_queue_count usb: xhci: Fix NULL pointer dereference on certain command aborts usb: xhci: Add timeout argument in address_device USB HCD callback media: uvcvideo: Remove dangling pointers media: uvcvideo: Only save async fh if success nilfs2: handle errors that nilfs_prepare_chunk() may return nilfs2: eliminate staggered calls to kunmap in nilfs_rename nilfs2: move page release outside of nilfs_delete_entry and nilfs_set_link x86/mm: Don't disable PCID when INVLPG has been fixed by microcode HID: Wacom: Add PCI Wacom device support mfd: lpc_ich: Add another Gemini Lake ISA bridge PCI device-id wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() mmc: core: Respect quirk_max_rate for non-UHS SDIO card tun: fix group permission check printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX sched: Don't try to catch up excess steal time. btrfs: convert BUG_ON in btrfs_reloc_cow_block() to proper error handling btrfs: output the reason for open_ctree() failure usb: gadget: f_tcm: Don't free command immediately media: uvcvideo: Fix double free in error path usb: typec: tcpm: set SRC_SEND_CAPABILITIES timeout to PD_T_SENDER_RESPONSE drivers/card_reader/rtsx_usb: Restore interrupt based detection ktest.pl: Check kernelrelease return in get_version NFSD: Reset cb_seq_status after NFS4ERR_DELAY hexagon: Fix unbalanced spinlock in die() hexagon: fix using plain integer as NULL pointer warning in cmpxchg genksyms: fix memory leak when the same symbol is read from *.symref file genksyms: fix memory leak when the same symbol is added from source net: sh_eth: Fix missing rtnl lock in suspend/resume path vsock: Allow retrying on connect() failure net: davicom: fix UAF in dm9000_drv_remove net: rose: fix timer races against user threads PM: hibernate: Add error handling for syscore_suspend() net: fec: implement TSO descriptor cleanup ubifs: skip dumping tnc tree when zroot is null dmaengine: ti: edma: fix OF node reference leaks in edma_driver module: Extend the preempt disabled section in dereference_symbol_descriptor(). ocfs2: mark dquot as inactive if failed to start trans while releasing dquot scsi: mpt3sas: Set ioc->manu_pg11.EEDPTagMode directly to 1 media: camif-core: Add check for clk_enable() media: mipi-csis: Add check for clk_enable() PCI: endpoint: Destroy the EPC device in devm_pci_epc_destroy() media: rc: iguanair: handle timeouts fbdev: omapfb: Fix an OF node leak in dss_of_port_get_parent_device() ARM: dts: mediatek: mt7623: fix IR nodename arm64: dts: mediatek: mt8173-evb: Fix MT6397 PMIC sub-node names arm64: dts: mediatek: mt8173-evb: Drop regulator-compatible property rdma/cxgb4: Prevent potential integer overflow on 32bit RDMA/mlx4: Avoid false error about access to uninitialized gids array perf report: Fix misleading help message about --demangle perf top: Don't complain about lack of vmlinux when not resolving some kernel samples padata: fix sysfs store callback check ktest.pl: Remove unused declarations in run_bisect_test function net: sched: Disallow replacing of child qdisc from one parent to another net/mlxfw: Drop hard coded max FW flash image size selftests: harness: fix printing of mismatch values in __EXPECT() selftests/harness: Display signed values correctly wifi: wlcore: fix unbalanced pm_runtime calls regulator: of: Implement the unwind path of of_regulator_match() team: prevent adding a device which is already a team device lower cpupower: fix TSC MHz calculation wifi: rtlwifi: pci: wait for firmware loading before releasing memory wifi: rtlwifi: fix memory leaks and invalid access at probe error path wifi: rtlwifi: remove unused dualmac control leftovers rtlwifi: replace usage of found with dedicated list iterator variable wifi: rtlwifi: usb: fix workqueue leak when probe fails wifi: rtlwifi: do not complete firmware loading needlessly drm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_range_table drm/etnaviv: Fix page property being used for non writecombine buffers afs: Fix directory format encoding struct overflow: Allow mixed type arguments overflow: Correct check_shl_overflow() comment overflow: Add __must_check attribute to check_*() helpers udf: Fix use of check_add_overflow() with mixed type arguments CIP: Bump version suffix to -cip118 after merge from cip/linux-4.19.y-st tree Update localversion-st, tree is up-to-date with 5.4.290. gtp: Use for_each_netdev_rcu() in gtp_genl_dump_pdp(). arm64: dts: rockchip: add hevc power domain clock to rk3328 Partial revert of xhci: use pm_ptr() instead #ifdef for CONFIG_PM conditionals xhci: use pm_ptr() instead of #ifdef for CONFIG_PM conditionals Input: xpad - add support for wooting two he (arm) Input: xpad - add unofficial Xbox 360 wireless receiver clone Input: atkbd - map F23 key to support default copilot shortcut Revert "usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null" USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb() vfio/platform: check the bounds of read/write syscalls net/xen-netback: prevent UAF in xenvif_flush_hash() m68k: Add missing mmap_read_lock() to sys_cacheflush() m68k: Update ->thread.esp0 before calling syscall_trace() in ret_from_signal gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag irqchip/sunxi-nmi: Add missing SKIP_WAKE flag scsi: iscsi: Fix redundant response for ISCSI_UEVENT_GET_HOST_STATS request ASoC: wm8994: Add depends on MFD core net: fix data-races around sk->sk_forward_alloc scsi: sg: Fix slab-use-after-free read in sg_release() ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev() irqchip/gic-v3: Handle CPU_PM_ENTER_FAILED correctly fs/proc: fix softlockup in __read_vmcore (part 2) poll_wait: add mb() to fix theoretical race between waitqueue_active() and .poll() hfs: Sanity check the root record mac802154: check local interfaces before deleting sdata list i2c: mux: demux-pinctrl: check initial mux selection, too nfp: bpf: prevent integer overflow in nfp_bpf_event_output() gtp: use exit_batch_rtnl() method net: add exit_batch_rtnl() method net: net_namespace: Optimize the code net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field() sctp: sysctl: rto_min/max: avoid using current->nsproxy ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv ocfs2: correct return value of ocfs2_local_free_info() phy: core: Fix that API devm_of_phy_provider_unregister() fails to unregister the phy provider phy: core: fix code style in devm_of_phy_provider_unregister arm64: dts: rockchip: fix pd_tcpc0 and pd_tcpc1 node position on rk3399 arm64: dts: rockchip: fix defines in pd_vio node for rk3399 iio: inkern: call iio_device_put() only on mapped devices iio: adc: at91: call input_free_device() on allocated iio_dev iio: adc: ti-ads8688: fix information leak in triggered buffer iio: imu: kmx61: fix information leak in triggered buffer iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer iio: pressure: zpa2326: fix information leak in triggered buffer usb: gadget: f_fs: Remove WARN_ON in functionfs_bind usb: fix reference leak in usb_new_device() USB: usblp: return error when setting unsupported protocol usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null USB: serial: cp210x: add Phoenix Contact UPS Device usb-storage: Add max sectors quirk for Nokia 208 staging: iio: ad9832: Correct phase range check staging: iio: ad9834: Correct phase range check USB: serial: option: add Neoway N723-EA support USB: serial: option: add MeiG Smart SRM815 drm/amd/display: Add check for granularity in dml ceil/floor helpers sctp: sysctl: auth_enable: avoid using current->nsproxy sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy dm thin: make get_first_thin use rcu-safe list first function tcp/dccp: allow a connection when sk_max_ack_backlog is zero tcp/dccp: complete lockless accesses to sk->sk_max_ack_backlog net: 802: LLC+SNAP OID:PID lookup on start of skb data ieee802154: ca8210: Add missing check for kfifo_alloc() in ca8210_probe() dm array: fix cursor index when skipping across block boundaries dm array: fix unreleased btree blocks on closing a faulty array cursor dm array: fix releasing a faulty array block twice in dm_array_cursor_end jbd2: flush filesystem device before updating tail sequence ravb: Fix use-after-free issue in ravb_tx_timeout_work() net/sched: netem: fix backport of "account for backlog updates from child qdisc" CIP: Bump version suffix to -cip117 after merge from cip/linux-4.19.y-st tree Update localversion-st, tree is up-to-date with 5.4.289. RDMA/bnxt_re: Fix max_qp_wrs reported net/sched: netem: account for backlog updates from child qdisc net/sched: cbs: Fix integer overflow in cbs_set_port_rate() netfilter: nft_set_hash: skip duplicated elements pending gc run drm/etnaviv: flush shader L1 cache after user commandstream usb: yurex: make waiting on yurex_write interruptible perf trace: Avoid garbage when not printing a syscall's arguments scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb() mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() drm: adv7511: Drop dsi single lane support net/sctp: Prevent autoclose integer overflow in sctp_association_init() sky2: Add device ID 11ab:4373 for Marvell 88E8075 pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking modpost: fix the missed iteration for the max bit in do_input() modpost: fix input MODULE_DEVICE_TABLE() built for 64-bit on 32-bit host irqchip/gic: Correct declaration of *percpu_base pointer in union gic_base net: usb: qmi_wwan: add Telit FE910C04 compositions sound: usb: format: don't warn that raw DSD is unsupported wifi: mac80211: wake the queues in case of failure in resume ila: serialize calls to nf_register_net_hooks() af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK af_packet: fix vlan_get_tci() vs MSG_PEEK ALSA: usb-audio: US16x08: Initialize array before use net: llc: reset skb->transport_header netrom: check buffer length before accessing it drm/bridge: adv7511_audio: Update Audio InfoFrame properly drm: bridge: adv7511: Enable SPDIF DAI RDMA/bnxt_re: Fix reporting hw_ver in query_device RDMA/bnxt_re: Add check for path mtu in modify_qp Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet selinux: ignore unknown extended permissions btrfs: avoid monopolizing a core when activating a swap file tracing: Constify string literal data member in struct trace_event_call MIPS: Probe toolchain support of -msym32 virtio-blk: don't keep queue frozen during system suspend platform/x86: asus-nb-wmi: Ignore unknown event 0xCF regmap: Use correct format specifier for logging range errors scsi: qla1280: Fix hw revision numbering for ISP1020/1040 tracing/kprobe: Make trace_kprobe's module callback called after jump_label update mtd: rawnand: fix double free in atmel_pmecc_create_user() dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset dmaengine: mv_xor: fix child node refcount handling in early exit phy: core: Fix that API devm_phy_destroy() fails to destroy the phy phy: core: Fix that API devm_phy_put() fails to release the phy phy: core: Fix an OF node refcount leakage in of_phy_provider_lookup() phy: core: Fix an OF node refcount leakage in _of_phy_get() mtd: diskonchip: Cast an operand to prevent potential overflow nfsd: restore callback functionality for NFSv4.0 bpf: Check negative offsets in __bpf_skb_min_len() media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg of: Fix error path in of_parse_phandle_with_args_map() nilfs2: prevent use of deleted inode of/irq: Fix using uninitialized variable @addr_len in API of_irq_parse_one() NFS/pnfs: Fix a live lock between recalled layouts and layoutget zram: refuse to use zero sized block device as backing device sh: clk: Fix clk_enable() to return 0 on NULL clk USB: serial: option: add Telit FE910C04 rmnet compositions USB: serial: option: add MediaTek T7XX compositions USB: serial: option: add Netprisma LCUK54 modules for WWAN Ready USB: serial: option: add MeiG Smart SLM770A USB: serial: option: add TCL IK512 MBIM & ECM efivarfs: Fix error on non-existent file i2c: riic: Always round-up when calculating bus period chelsio/chtls: prevent potential integer overflow on 32bit mmc: sdhci-tegra: Remove SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC quirk netfilter: ipset: Fix for recursive locking warning net: ethernet: bgmac-platform: fix an OF node reference leak net: hinic: Fix cleanup in create_rxqs/txqs() net/smc: check sndbuf_space again after NOSPACE flag is set in smc_poll i2c: pnx: Fix timeout in wait functions PCI: Add ACS quirk for Broadcom BCM5760X NIC ALSA: usb: Fix UBSAN warning in parse_audio_unit() PCI/AER: Disable AER service on suspend net: sched: fix ordering of qlen adjustment ALSA: usb-audio: Fix a DMA to stack memory bug xen/netfront: fix crash when removing device KVM: arm64: Ignore PMCNTENSET_EL0 while checking for overflow status qca_spi: Make driver probing reliable ACPI: resource: Fix memory resource type union access net: lapb: increase LAPB_HEADER_LEN batman-adv: Do not let TT changes list grows indefinitely batman-adv: Remove uninitialized data in full table TT response batman-adv: Do not send uninitialized TT changes usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer usb: ehci-hcd: fix call balance of clocks handling routines usb: dwc2: hcd: Fix GetPortStatus & SetPortFeature ata: sata_highbank: fix OF node reference leak in highbank_initialize_phys() usb: host: max3421-hcd: Correctly abort a USB request. bpf, xdp: Update devmap comments to reflect napi/rcu usage ALSA: usb-audio: Fix out of bounds reads when finding clock sources PCI: rockchip-ep: Fix address translation unit programming Revert "drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()" modpost: Add .irqentry.text to OTHER_SECTIONS ocfs2: Revert "ocfs2: fix the la space leak when unmounting an ocfs2 volume" jffs2: Fix rtime decompressor jffs2: Prevent rtime decompress memory corruption KVM: arm64: vgic-its: Clear ITE when DISCARD frees an ITE KVM: arm64: vgic-its: Clear DTE when MAPD unmaps a device KVM: arm64: vgic-its: Add a data length check in vgic_its_save_* misc: eeprom: eeprom_93cx6: Add quirk for extra read clock cycle powerpc/prom_init: Fixup missing powermac #size-cells usb: chipidea: udc: handle USB Error Interrupt if IOC not set PCI: Add 'reset_subordinate' to reset hierarchy below bridge nvdimm: rectify the illogical code within nd_dax_probe() scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset scsi: st: Don't modify unknown block number in MTIOCGET leds: class: Protect brightness_show() with led_cdev->led_access mutex tracing: Use atomic64_inc_return() in trace_clock_counter() netpoll: Use rcu_access_pointer() in __netpoll_setup rocker: fix link status detection in rocker_carrier_init() ASoC: hdmi-codec: reorder channel allocation list wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw() wifi: ipw2x00: libipw_rx_any(): fix bad alignment jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree jfs: fix array-index-out-of-bounds in jfs_readdir jfs: fix shift-out-of-bounds in dbSplit jfs: array-index-out-of-bounds fix in dtReadFirst wifi: ath5k: add PCI ID for Arcadyan devices wifi: ath5k: add PCI ID for SX76X net: inet6: do not leave a dangling sk pointer in inet6_create() net: inet: do not leave a dangling sk pointer in inet_create() net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() net: af_can: do not leave a dangling sk pointer in can_create() Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() af_packet: avoid erroring out after sock_init_data() in packet_create() net: ethernet: fs_enet: Use %pa to format resource_size_t net: fec_mpc52xx_phy: Use %pa to format resource_size_t samples/bpf: Fix a resource leak drm/radeon/r600_cs: Fix possible int overflow in r600_packet3_check() media: cx231xx: Add support for Dexatek USB Video Grabber 1d19:6108 media: uvcvideo: Add a quirk for the Kaiweets KTI-W02 infrared camera s390/cpum_sf: Handle CPU hotplug remove during sampling regmap: detach regmap from dev on regmap_exit bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry() scsi: qla2xxx: Remove check req_sg_cnt should be equal to rsp_sg_cnt scsi: qla2xxx: Supported speed displayed incorrectly for VPorts ocfs2: update seq_file index in ocfs2_dlm_seq_next tracing: Fix cmp_entries_dup() to respect sort() comparison rules HID: wacom: fix when get product name maybe null pointer bpf: Fix exact match conditions in trie_get_next_key() bpf: Handle BPF_EXIST and BPF_NOEXIST for LPM trie ocfs2: free inode when ocfs2_get_init_inode() fails spi: mpc52xx: Add cancel_work_sync before module remove drm/sti: Add __iomem for mixer_dbg_mxn's parameter gpio: grgpio: Add NULL check in grgpio_probe gpio: grgpio: use a helper variable to store the address of ofdev->dev crypto: x86/aegis128 - access 32-bit arguments as 32-bit x86/asm: Reorder early variables xen: Fix the issue of resource not being properly released in xenbus_dev_probe() xen/xenbus: fix locking xenbus/backend: Protect xenbus callback with lock xenbus/backend: Add memory pressure handler callback xen/xenbus: reference count registered modules netfilter: ipset: Hold module reference while requesting a module igb: Fix potential invalid memory access in igb_init_module() net/qed: allow old cards not supporting "num_images" to work dccp: Fix memory leak in dccp_feat_change_recv net/ipv6: release expired exception dst cached in socket netfilter: x_tables: fix LED ID check in led_tg_check() ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() can: sun4i_can: sun4i_can_err(): fix {rx,tx}_errors statistics can: sun4i_can: sun4i_can_err(): call can_change_state() even if cf is NULL watchdog: mediatek: Make sure system reset gets asserted in mtk_wdt_restart() nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur dm thin: Add missing destroy_work_on_stack() util_macros.h: fix/rework find_closest() macros ftrace: Fix regression with module command in stack_trace_filter ovl: Filter invalid inodes with missing lookup function media: gspca: ov534-ov772x: Fix off-by-one error in set_frame_rate() media: venus: Fix pm_runtime_set_suspended() with runtime pm enabled media: ts2020: fix null-ptr-deref in ts2020_probe() media: i2c: tc358743: Fix crash in the probe error path when using polling btrfs: ref-verify: fix use-after-free after invalid ref action quota: flush quota_release_work upon quota writeback SUNRPC: correct error code comment in xs_tcp_setup_socket() um/sysrq: remove needless variable sp ALSA: hda/realtek: Set PCBeep to default value for ALC274 Revert "serial: sh-sci: Clean sci_ports[0] after at earlycon exit" serial: sh-sci: Clean sci_ports[0] after at earlycon exit ipmr: convert /proc handlers to rcu_read_lock() mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device mfd: intel_soc_pmic_bxtwc: Use dev_err_probe() x86/xen/pvh: Annotate indirect branch as safe CIP: Bump version suffix to -cip116 after merge from stable Mark this as 4.19.324-cip115 release. CIP: Bump version suffix to -cip114 after merge from stable Mark this as 4.19.322-cip113 release. CIP: Bump version suffix to -cip112 after merge from stable CIP: Bump version suffix to -cip111 after merge from stable CIP: Bump version suffix to -cip110 after merge from stable CIP: Bump version suffix to -cip109 after merge from stable CIP: Bump version suffix to -cip108 after merge from stable memory: renesas-rpc-if: Clear HS bit during hardware initialization arm64: dts: renesas: rzg2: Add RPC-IF Support spi: spi-rpc-if: Check return value of rpcif_sw_init() memory: renesas-rpc-if: Remove redundant division of dummy memory: renesas-rpc-if: Simplify single/double data register access memory: renesas-rpc-if: Drop usage of RPCIF_DIRMAP_SIZE macro memory: renesas-rpc-if: Return error in case devm_ioremap_resource() fails memory: renesas-rpc-if: Fix HF/OSPI data transfer in Manual Mode memory: renesas-rpc-if: Correct QSPI data transfer in Manual mode memory: renesas-rpc-if: fix possible NULL pointer dereference of resource CIP: Bump version suffix to -cip107 after merge from stable ravb: remove undocumented counter processing ravb: remove undocumented endianness selection ravb: update "undocumented" annotations CIP: Bump version suffix to -cip106 after merge from stable Mark this as 4.19.299-cip105 release. CIP: Bump version suffix to -cip104 after merge from stable CIP: Bump version suffix to -cip103 after merge from stable CIP: Bump version suffix to -cip102 after merge from stable CIP: Bump version suffix to -cip101 after merge from stable CIP: Bump version suffix to -cip100 after merge from stable CIP: Bump version suffix to -cip99 after merge from stable CIP: Bump version suffix to -cip98 after merge from stable CIP: Bump version suffix to -cip97 after merge from stable CIP: Bump version suffix to -cip96 after merge from stable CIP: Bump version suffix to -cip95 after merge from stable CIP: Bump version suffix to -cip94 after merge from stable CIP: Bump version suffix to -cip93 after merge from stable CIP: Bump version suffix to -cip92 after merge from stable CIP: Bump version suffix to -cip91 after merge from stable CIP: Bump version suffix to -cip90 after merge from stable CIP: Bump version suffix to -cip89 after merge from stable CIP: Bump version suffix to -cip88 after merge from stable CIP: Bump version suffix to -cip87 after merge from stable CIP: Bump version suffix to -cip86 after merge from stable CIP: Bump version suffix to -cip85 after merge from stable CIP: Bump version suffix to -cip84 after merge from stable CIP: Bump version suffix to -cip83 after merge from stable CIP: Bump version suffix to -cip82 after merge from stable CIP: Bump version suffix to -cip81 after merge from stable drm: rcar-du: Fix Alpha blending issue on Gen3 CIP: Bump version suffix to -cip80 after merge from stable CIP: Bump version suffix to -cip79 after merge from stable CIP: Bump version suffix to -cip78 after merge from stable CIP: Bump version suffix to -cip77 after merge from stable CIP: Bump version suffix to -cip76 after merge from stable CIP: Bump version suffix to -cip75 after merge from stable CIP: Bump version suffix to -cip74 after merge from stable CIP: Bump version suffix to -cip73 after merge from stable CIP: Bump version suffix to -cip72 after merge from stable CIP: Bump version suffix to -cip71 after merge from stable CIP: Bump version suffix to -cip70 after merge from stable CIP: Bump version suffix to -cip69 after merge from stable CIP: Bump version suffix to -cip68 after merge from stable CIP: Bump version suffix to -cip67 after merge from stable CIP: Bump version suffix to -cip66 after merge from stable CIP: Bump version suffix to -cip65 after merge from stable CIP: Bump version suffix to -cip64 after merge from stable CIP: Bump version suffix to -cip63 after merge from stable CIP: Bump version suffix to -cip62 after merge from stable CIP: Bump version suffix to -cip61 after merge from stable CIP: Bump version suffix to -cip60 after merge from stable CIP: Bump version suffix to -cip59 after merge from stable CIP: Bump version suffix to -cip58 after merge from stable CIP: Bump version suffix to -cip57 after merge from stable CIP: Bump version suffix to -cip56 after merge from stable CIP: Bump version suffix to -cip55 after merge from stable CIP: Bump version suffix to -cip54 after merge from stable CIP: Bump version suffix to -cip53 after merge from stable CIP: Bump version suffix to -cip52 after merge from stable CIP: Bump version suffix to -cip51 after merge from stable CIP: Bump version suffix to -cip50 after merge from stable CIP: Bump version suffix to -cip49 after merge from stable media: i2c: imx219: Balance runtime PM use-count media: i2c: imx219: Move out locking/unlocking of vflip and hflip controls from imx219_set_stream CIP: Bump version suffix to -cip48 after merge from stable drm: rcar-du: Fix crash when using LVDS1 clock for CRTC CIP: Bump version suffix to -cip47 after merge from stable CIP: Bump version suffix to -cip46 after merge from stable arm64: dts: renesas: Add support for MIPI Adapter V2.1 connected to HiHope RZ/G2N arm64: dts: renesas: Add support for MIPI Adapter V2.1 connected to HiHope RZ/G2M arm64: dts: renesas: Add support for MIPI Adapter V2.1 connected to HiHope RZ/G2H arm64: dts: renesas: aistarvision-mipi-adapter-2.1: Add parent macro for each sensor arm64: dts: renesas: r8a774e1: Add VIN and CSI-2 nodes media: rcar-csi2: Enable support for R8A774E1 media: dt-bindings: media: renesas,csi2: Add R8A774E1 support media: rcar-vin: Enable support for R8A774E1 media: dt-bindings: media: renesas,vin: Add R8A774E1 support arm64: dts: renesas: r8a774b1: Add VIN and CSI-2 support media: rcar-csi2: Enable support for R8A774B1 media: dt-bindings: rcar-csi2: Add R8A774B1 support media: rcar-vin: Enable support for R8A774B1 media: dt-bindings: rcar-vin: Add R8A774B1 support arm64: dts: renesas: r8a774a1: Add VIN and CSI-2 nodes media: rcar-csi2: Enable support for r8a774a1 media: dt-bindings: media: rcar-csi2: Add r8a774a1 support media: rcar-vin: Enable support for r8a774a1 media: dt-bindings: media: rcar_vin: Add r8a774a1 support arm64: dts: renesas: r8a774c0-cat874: Add support for AISTARVISION MIPI Adapter V2.1 media: i2c: imx219: take lock in imx219_enum_mbus_code/frame_size media: i2c: imx219: Selection compliance fixes media: i2c: imx219: Fix a bug in imx219_enum_frame_size media: i2c: imx219: Implement get_selection media: i2c: imx219: Add support for cropped 640x480 resolution media: i2c: imx219: Add support for RAW8 bit bayer format media: i2c: imx219: Fix power sequence media: i2c: Add driver for Sony IMX219 sensor media: dt-bindings: media: i2c: Add IMX219 CMOS sensor binding media: rcar-csi2: Add support for MEDIA_BUS_FMT_SRGGB8_1X8 format media: rcar-vin: Add support for MEDIA_BUS_FMT_SRGGB8_1X8 format media: rcar-vin: Invalidate pipeline if conversion is not possible on input formats media: rcar-csi2: Update V3M and E3 start procedure media: rcar-vin: fix wrong return value in rvin_set_channel_routing() media: v4l: ctrl: Provide unlocked variant of v4l2_ctrl_grab media: v4l2-async: Log message in case of heterogeneous fwnode match media: v4l2-async: Pass notifier pointer to match functions media: v4l2-async: Accept endpoints and devices for fwnode matching media: device property: Add a function to test is a fwnode is a graph endpoint media: ov5645: Remove unneeded regulator_set_voltage() CIP: Bump version suffix to -cip45 after merge from stable CIP: Bump version suffix to -cip44 after merge from stable CIP: Bump version suffix to -cip43 after merge from stable CIP: Bump version suffix to -cip42 after merge from stable CIP: Bump version suffix to -cip41 after merge from stable spi: spi-mem: Make spi_mem_default_supports_op() static inline pinctrl: renesas: r8a77965: Add QSPI[01] pins, groups and functions pinctrl: renesas: r8a7796: Add QSPI[01] pins, groups and functions pinctrl: renesas: r8a77951: Add QSPI[01] pins, groups and functions pinctrl: renesas: r8a77990: Add QSPI[01] pins, groups and functions pinctrl: renesas: r8a77990: Optimize pinctrl image size for R8A774C0 pinctrl: renesas: r8a77965: Optimize pinctrl image size for R8A774B1 pinctrl: renesas: r8a77951: Optimize pinctrl image size for R8A774E1 pinctrl: renesas: r8a7796: Optimize pinctrl image size for R8A774A1 clk: renesas: r8a774c0: Add RPC clocks clk: renesas: r8a774b1: Add RPC clocks clk: renesas: r8a774a1: Add RPC clocks spi: rpc-if: Fix use-after-free on unbind spi: add Renesas RPC-IF driver spi: spi-mem: Fix a memory leak in spi_mem_dirmap_destroy() spi: spi-mem: Fix spi_mem_dirmap_destroy() kerneldoc spi: spi-mem: Add a new API to support direct mapping spi: spi-mem: Compute length only when needed spi: spi-mem: Fix passing zero to 'PTR_ERR' warning spi: spi-mem: fix reference leak in spi_mem_access_start spi: spi-mem: Split spi_mem_exec_op() code spi: spi-mem: export spi_mem_default_supports_op() spi: spi-mem: Add SPI_MEM_NO_DATA to the spi_mem_data_dir enum memory: renesas-rpc-if: Make rpcif_enable/disable_rpm() as static inline memory: renesas-rpc-if: Fix a node reference leak in rpcif_probe() memory: renesas-rpc-if: Fix unbalanced pm_runtime_enable in rpcif_{enable,disable}_rpm memory: renesas-rpc-if: Return correct value to the caller of rpcif_manual_xfer() memory: add Renesas RPC-IF driver dt-bindings: memory: document Renesas RPC-IF bindings dt-bindings: thermal: rcar-gen3-thermal: Add r8a774e1 support dt-bindings: PCI: rcar-pci-host: Document r8a774e1 bindings dt-bindings: PCI: rcar: Add device tree support for r8a774b1 dt-bindings: timer: renesas: tmu: Document r8a774e1 bindings dt-bindings: pci: rcar-pci-ep: Document missing interrupts property CIP: Bump version suffix to -cip40 after merge from stable arm64: dts: renesas: r8a774c0: Fix MSIOF1 DMA channels CIP: Bump version suffix to -cip39 after merge from stable arm64: dts: renesas: r8a774e1: Add audio support arm64: dts: renesas: r8a774e1: Add missing audio_clk_b CIP: Bump version suffix to -cip38 after merge from stable arm64: dts: renesas: r8a774e1: Add USB-DMAC and HSUSB device nodes arm64: dts: renesas: r8a774e1: Add USB3.0 device nodes arm64: dts: renesas: r8a774e1: Add USB2.0 phy and host (EHCI/OHCI) device nodes dt-bindings: dma: renesas,usb-dmac: Add binding for r8a774e1 dt-bindings: phy: renesas,usb3-phy: Add r8a774e1 support dt-bindings: phy: renesas,usb2-phy: Add r8a774e1 support dt-bindings: sound: renesas, rsnd: Document r8a774e1 bindings arm64: dts: renesas: Add HiHope RZ/G2H board with idk-1110wr display arm64: dts: renesas: r8a774e1: Add PWM device nodes dt-bindings: pwm: renesas,pwm-rcar: Add r8a774e1 support arm64: dts: renesas: r8a774e1-hihope-rzg2h: Setup DU clocks arm64: dts: renesas: r8a774e1: Add LVDS device node drm: rcar-du: lvds: Add support for R8A774E1 SoC dt-bindings: display: renesas,lvds: Document r8a774e1 bindings arm64: dts: renesas: r8a774e1: Populate HDMI encoder node dt-bindings: display: renesas,dw-hdmi: Add r8a774e1 support arm64: dts: renesas: r8a774e1: Populate DU device node drm: rcar-du: Add support for R8A774E1 SoC dt-bindings: display: renesas,du: Document r8a774e1 bindings arm64: dts: renesas: r8a774e1: Add FDP1 device nodes arm64: dts: renesas: r8a774e1: Add VSP instances arm64: dts: renesas: r8a774e1: Add FCPF and FCPV instances arm64: dts: renesas: r8a774e1-hihope-rzg2h-ex: Enable sata misc: pci_endpoint_test: Add Device ID for RZ/G2H PCIe controller arm64: dts: renesas: r8a774e1: Add PCIe EP nodes dt-bindings: pci: rcar-pci-ep: Document r8a774e1 arm64: dts: renesas: r8a774e1: Add SATA controller node arm64: dts: renesas: r8a774e1: Add PCIe device nodes misc: pci_endpoint_test: Add Device ID for RZ/G2M and RZ/G2N PCIe controllers arm64: dts: renesas: r8a774b1: Add PCIe EP nodes arm64: dts: renesas: r8a774a1: Add PCIe EP nodes arm64: dts: renesas: r8a774c0: Add PCIe EP node dt-bindings: pci: rcar-pci-ep: Document r8a774a1 and r8a774b1 ata: sata_rcar: Fix DMA boundary mask arm64: dts: renesas: r8a774b1-hihope-rzg2n-ex: Enable sata arm64: dts: renesas: r8a774b1: Add SATA controller node dt-bindings: ata: sata_rcar: Add r8a774b1 support CIP: Bump version suffix to -cip37 after merge from stable misc: pci_endpoint_test: Add Device ID for RZ/G2E PCIe controller arm64: defconfig: Enable R-Car PCIe endpoint driver PCI: rcar: Add endpoint mode support dt-bindings: PCI: rcar: Add bindings for R-Car PCIe endpoint controller PCI: rcar: Fix calculating mask for PCIEPAMR register PCI: rcar: Move shareable code to a common file arm64: defconfig: Enable CONFIG_PCIE_RCAR_HOST PCI: rcar: Rename pcie-rcar.c to pcie-rcar-host.c PCI: endpoint: functions/pci-epf-test: Print throughput information PCI: endpoint: Add support to handle multiple base for mapping outbound memory PCI: endpoint: Pass page size as argument to pci_epc_mem_init() PCI: endpoint: Fix ->set_msix() to take BIR and offset as arguments PCI: pci-epf-test: Add support to defer core initialization PCI: endpoint: Add notification for core init completion PCI: endpoint: Add core init notifying feature PCI: endpoint: Assign function number for each PF in EPC core PCI: endpoint: Protect concurrent access to pci_epf_ops with mutex PCI: endpoint: Replace spinlock with mutex PCI: endpoint: Use notification chain mechanism to notify EPC events to EPF tools: PCI: Fix fd leakage tools: PCI: Exit with error code when test fails PCI: dwc: Fix dw_pcie_ep_raise_msix_irq() to get correct MSI-X table address PCI: endpoint: Fix clearing start entry in configfs PCI: endpoint: Cast the page number to phys_addr_t PCI: endpoint: Clear BAR before freeing its space PCI: endpoint: Skip odd BAR when skipping 64bit BAR PCI: endpoint: Allocate enough space for fixed size BAR PCI: endpoint: Set endpoint controller pointer to NULL PCI: endpoint: Add support to specify alignment for buffers allocated to BARs PCI: endpoint: Fix a potential NULL pointer dereference PCI: endpoint: Remove features member in struct pci_epc PCI: designware-plat: Remove setting epc->features in Designware plat EP driver PCI: rockchip: Remove pci_epf_linkup() from Rockchip EP driver PCI: cadence: Remove pci_epf_linkup() from Cadence EP driver PCI: pci-epf-test: Use pci_epc_get_features() to get EPC features PCI: pci-epf-test: Do not allocate next BARs memory if current BAR is 64Bit PCI: pci-epf-test: Remove setting epf_bar flags in function driver PCI: endpoint: Fix pci_epf_alloc_space() to set correct MEM TYPE flags PCI: endpoint: Add helper to get first unreserved BAR PCI: cadence: Populate ->get_features() cdns_pcie_epc_ops PCI: rockchip: Populate ->get_features() dw_pcie_ep_ops PCI: pci-dra7xx: Populate ->get_features() dw_pcie_ep_ops PCI: designware-plat: Populate ->get_features() dw_pcie_ep_ops PCI: dwc: Add ->get_features() callback function to dw_pcie_ep_ops PCI: endpoint: Add new pci_epc_ops to get EPC features CIP: Bump version suffix to -cip36 after merge from stable with ravb fix Revert "ravb: Fixed to be able to unload modules" CIP: Bump version suffix to -cip35 after merge from stable CIP: Bump version suffix to -cip34 after merge from stable arm64: dts: renesas: Fix SD Card/eMMC interface device node names arm64: dts: renesas: r8a774e1: Add RWDT node dt-bindings: watchdog: renesas,wdt: Document r8a774e1 support arm64: dts: renesas: r8a774e1: Add MSIOF nodes spi: renesas,sh-msiof: Add r8a774e1 support arm64: dts: renesas: r8a774e1: Add I2C and IIC-DVFS support dt-bindings: i2c: renesas,iic: Document r8a774e1 support dt-bindings: i2c: renesas,i2c: Document r8a774e1 support arm64: dts: renesas: r8a774e1: Add SDHI nodes mmc: renesas_sdhi_internal_dmac: Add r8a774e1 support arm64: dts: renesas: r8a774e1: Add SCIF and HSCIF nodes arm64: dts: renesas: r8a774e1: Add CAN[FD] support can: rcar_can: Remove unused platform data support arm64: dts: renesas: r8a774e1: Add TMU device nodes arm64: dts: renesas: r8a774e1: Add CMT device nodes arm64: dts: renesas: r8a774e1: Add RZ/G2H thermal support thermal: rcar_gen3_thermal: Add r8a774e1 support thermal/drivers/rcar_gen3: Fix undefined temperature if negative thermal: rcar_gen3_thermal: Generate interrupt when temperature changes thermal: rcar_gen3_thermal: Remove temperature bound arm64: dts: renesas: r8a774e1: Add operating points arm64: dts: renesas: r8a774e1: Add Ethernet AVB node arm64: dts: renesas: r8a774e1: Add GPIO device nodes arm64: dts: renesas: r8a774e1: Add SYS-DMAC device nodes dt-bindings: dma: renesas,rcar-dmac: Document R8A774E1 bindings arm64: dts: renesas: r8a774e1: Add IPMMU device nodes iommu/ipmmu-vmsa: Hook up R8A774E1 DT matching code dt-bindings: iommu: renesas,ipmmu-vmsa: Add r8a774e1 support arm64: dts: renesas: Add HiHope RZ/G2H sub board support arm64: dts: renesas: Add HiHope RZ/G2H main board support dt-bindings: arm: renesas: Add HopeRun RZ/G2H boards arm64: dts: renesas: Initial r8a774e1 SoC device tree pinctrl: sh-pfc: pfc-r8a77951: Add R8A774E1 PFC support dt-bindings: pinctrl: sh-pfc: Document r8a774e1 PFC support pinctrl: sh-pfc: Split R-Car H3 support in two independent drivers pinctrl: sh-pfc: pfc-r8a7795: Fix typo in pinmux macro for SCL3 pinctrl: sh-pfc: pfc-r8a7795-es1: Fix typo in pinmux macro for SCL3 pinctrl: sh-pfc: r8a7795: Use new macros for non-GPIO pins pinctrl: sh-pfc: r8a7795-es1: Use new macros for non-GPIO pins pinctrl: sh-pfc: r8a7795: Add TPU pins, groups and functions pinctrl: sh-pfc: r8a7795-es1: Add TPU pins, groups and functions pinctrl: sh-pfc: rcar-gen3: Rename RTS{0,1,3,4}# pin function definitions pinctrl: sh-pfc: rcar-gen3: Retain TDSELCTRL register across suspend/resume pinctrl: sh-pfc: r8a7795: Deduplicate VIN5 pin definitions pinctrl: sh-pfc: r8a7795: Add I2C{0,3,5} pins, groups and functions pinctrl: sh-pfc: r8a7795-es1: Add I2C{0,3,5} pins, groups and functions pinctrl: sh-pfc: r8a7795: Fix VIN versioned groups pinctrl: sh-pfc: r8a77965: Fix DU_DOTCLKIN3 drive/bias control arm64: defconfig: Enable R8A774E1 SoC clk: renesas: cpg-mssr: Add r8a774e1 support dt-bindings: clock: renesas,cpg-mssr: Document r8a774e1 clk: renesas: rzg2: Mark RWDT clocks as critical clk: renesas: cpg-mssr: Mark clocks as critical only if on at boot clk: renesas: rcar-gen3: Allow changing the RPC[D2] clocks clk: renesas: Add r8a774e1 CPG Core Clock Definitions clk: renesas: rcar-gen3: Add RPC clocks soc: renesas: rcar-rst: Add support for RZ/G2H dt-bindings: reset: rcar-rst: Document r8a774e1 reset module soc: renesas: Identify RZ/G2H dt-bindings: arm: renesas: Document RZ/G2H SoC DT bindings soc: renesas: Add Renesas R8A774E1 config option soc: renesas: rcar-sysc: Add r8a774e1 support dt-bindings: power: renesas,rcar-sysc: Document r8a774e1 SYSC binding dt-bindings: power: Add r8a774e1 SYSC power domain definitions arm64: dts: renesas: r8a774a1: Remove audio port node arm64: dts: renesas: Add HiHope RZ/G2N Rev2.0/3.0/4.0 board with idk-1110wr display arm64: dts: renesas: Add HiHope RZ/G2N Rev.3.0/4.0 sub board support arm64: dts: renesas: Add HiHope RZ/G2N Rev.3.0/4.0 main board support arm64: dts: renesas: Add HiHope RZ/G2M Rev.3.0/4.0 board with idk-1110wr display arm64: dts: renesas: hihope-rzg2-ex: Separate out lvds specific nodes into common file arm64: dts: renesas: Add HiHope RZ/G2M Rev.3.0/4.0 sub board support arm64: dts: renesas: Add HiHope RZ/G2M Rev.3.0/4.0 main board support arm64: dts: renesas: Add HiHope RZ/G2M[N] Rev.3.0/4.0 specific into common file arm64: dts: renesas: hihope-common: Separate out Rev.2.0 specific into hihope-rev2.dtsi file arm64: dts: renesas: r8a774b1-hihope-rzg2n[-ex]: Rename HiHope RZ/G2N boards arm64: dts: renesas: r8a774a1-hihope-rzg2m[-ex/-ex-idk-1110wr]: Rename HiHope RZ/G2M boards CIP: Bump version suffix to -cip33 after merge from stable drm: atomic helper: fix W=1 warnings drm: Add drm_atomic_get_old/new_private_obj_state drm: of: Fix linking when CONFIG_OF is not set CIP: Bump version suffix to -cip32 after merge from stable drm: of: Fix double-free bug CIP: Bump version suffix to -cip31 after merge from stable arm64: dts: renesas: Add EK874 board with idk-2121wr display support dt-bindings: display: Add idk-2121wr binding arm64: dts: renesas: rzg2: Add reset control properties for display arm64: dts: renesas: r8a774c0: Point LVDS0 to its companion LVDS1 drm: rcar-du: lvds: Allow for even and odd pixels swap drm: rcar-du: lvds: Get dual link configuration from DT drm: of: Add drm_of_lvds_get_dual_link_pixel_order drm: rcar-du: lvds: Improve identification of panels drm: rcar-du: lvds: Get mode from state drm: Add atomic variants for bridge enable/disable drm: Add drm_atomic_get_(old|new)_connector_for_encoder() helpers drm: rcar_lvds: Fix dual link mode operations drm: rcar-du: Skip LVDS1 output on Gen3 when using dual-link LVDS mode drm: rcar-du: lvds: Add support for dual-link mode dt-bindings: display: renesas: lvds: Add renesas,companion property drm: bridge: Add dual_link field to the drm_bridge_timings structure drm: rcar-du: lvds: Remove LVDS double-enable checks arm64: defconfig: Enable additional support for Renesas platforms ASoC: rsnd: fixup SSI clock during suspend/resume modes CIP: Bump version suffix to -cip30 after merge from stable CIP: Bump version suffix to -cip29 after merge from stable CIP: Bump version suffix to -cip28 after merge from stable CIP: Bump version suffix to -cip27 after merge from stable CIP: Bump version suffix to -cip26 after merge from stable CIP: Bump version suffix to -cip25 after merge from stable arm64: dts: renesas: Add HiHope RZ/G2M board with idk-1110wr display dt-bindings: display: Add idk-1110wr binding CIP: Bump version suffix to -cip24 after merge from stable CIP: Bump version suffix to -cip23 after merge from stable CIP: Bump version suffix to -cip22 after merge from stable CIP: Bump version suffix to -cip21 after merge from stable arm64: dts: renesas: cat874: Enable usb role switch support arm64: dts: renesas: cat874: Enable USB3.0 host/peripheral device node usb: gadget: udc: renesas_usb3: Enhance role switch support usb: typec: fix an IS_ERR() vs NULL bug in hd3ss3220_probe() usb: typec: hd3ss3220: hd3ss3220_probe() warn: passing zero to 'PTR_ERR' usb: typec: add dependency for TYPEC_HD3SS3220 usb: typec: hd3ss3220_irq() can be static usb: typec: driver for TI HD3SS3220 USB Type-C DRP port controller dt-bindings: usb: renesas_usb3: Document usb role switch support dt-bindings: usb: hd3ss3220 device tree binding document usb: roles: Add fwnode_usb_role_switch_get() function device connection: Add fwnode_connection_find_match() usb: roles: Introduce stubs for the exiting functions in role.h device connection: Find connections also by checking the references device property: Introduce fwnode_find_reference() device connection: Find device connections also from device graphs device connection: Prepare support for firmware described connections usb: typec: Find the ports by also matching against the device node usb: roles: Find the muxes by also matching against the device node usb: typec: mux: Fix unsigned comparison with less than zero usb: typec: mux: Find the muxes by also matching against the device node device connection: Add fwnode member to struct device_connection CIP: Bump version suffix to -cip20 after merge from stable arm64: dts: renesas: r8a774b1: Add USB3.0 device nodes arm64: dts: renesas: r8a774b1: Add USB-DMAC and HSUSB device nodes arm64: dts: renesas: r8a774b1: Add USB2.0 phy and host (EHCI/OHCI) device nodes dt-bindings: usb: renesas_usb3: Document r8a774b1 support dt-bindings: usb: renesas_gen3: Rename bindings documentation file to reflect IP block dt-bindings: usb-xhci: Add r8a774b1 support dt-bindings: rcar-gen3-phy-usb3: Add r8a774b1 support dt-bindings: usb: renesas_usbhs: Add r8a774b1 support dt-bindings: usb: renesas_usbhs: Rename bindings documentation file dt-bindings: dmaengine: usb-dmac: Add binding for r8a774b1 dt-bindings: rcar-gen3-phy-usb2: Add r8a774b1 support arm64: dts: renesas: r8a774b1: Add Sound and Audio DMAC device nodes ASoC: rsnd: Document r8a774b1 bindings arm64: dts: renesas: r8a774a1: Remove audio port node arm64: dts: renesas: Add support for Advantech idk-1110wr LVDS panel arm64: dts: renesas: hihope-rzg2-ex: Add LVDS support drm: rcar-du: lvds: Add r8a774b1 support arm64: dts: renesas: hihope-rzg2-ex: Enable backlight arm64: dts: renesas: r8a774b1: Add PWM device nodes arm64: dts: renesas: r8a774b1: Add FDP1 device nodes arm64: dts: renesas: r8a774b1-hihope-rzg2n: Add display clock properties arm64: dts: renesas: r8a774b1: Add HDMI encoder instance arm64: dts: renesas: r8a774b1: Add DU device to DT drm: rcar-du: Add R8A774B1 support arm64: dts: renesas: hihope-common: Move du clk properties out of common dtsi arm64: dts: renesas: r8a774b1: Connect Ethernet-AVB to IPMMU-DS0 arm64: dts: renesas: r8a774b1: Tie SYS-DMAC to IPMMU-DS0/1 arm64: dts: renesas: r8a774b1: Add VSP instances arm64: dts: renesas: r8a774b1: Add FCPF and FCPV instances arm64: dts: renesas: r8a774b1: Add IPMMU device nodes iommu/ipmmu-vmsa: Hook up r8a774b1 DT matching code dt-bindings: iommu: ipmmu-vmsa: Add r8a774b1 support arm64: dts: renesas: r8a774b1: Add CAN and CAN FD support dt-bindings: can: rcar_canfd: document r8a774b1 support dt-bindings: can: rcar_can: document r8a774b1 support arm64: dts: renesas: r8a774b1: Add TMU device nodes clk: renesas: r8a774b1: Add TMU clock dt-bindings: timer: renesas: tmu: Document r8a774b1 bindings arm64: dts: renesas: r8a774b1: Add CMT device nodes dt-bindings: timer: renesas, cmt: Document r8a774b1 CMT support arm64: dts: renesas: r8a774b1: Add RZ/G2N thermal support thermal: rcar_gen3_thermal: Add r8a774b1 support dt-bindings: thermal: rcar-gen3-thermal: Add r8a774b1 support arm64: dts: renesas: r8a774b1: Add OPPs table for cpu devices arm64: dts: renesas: r8a774b1: Add I2C and IIC-DVFS support dt-bindings: i2c: sh_mobile: Add r8a774b1 support dt-bindings: i2c: sh_mobile: Rename bindings documentation file dt-bindings: i2c: rcar: Add r8a774b1 support dt-bindings: i2c: rcar: Rename bindings documentation file arm64: dts: renesas: r8a774b1-hihope-rzg2n: Enable HS400 mode arm64: dts: renesas: r8a774b1: Add SDHI support mmc: renesas_sdhi_internal_dmac: Add r8a774b1 support dt-bindings: mmc: renesas_sdhi: Add r8a774b1 support arm64: dts: renesas: r8a774b1: Add INTC-EX device node arm64: dts: renesas: hihope-rzg2-ex: Let the board specific DT decide about pciec1 arm64: dts: renesas: r8a774b1: Add PCIe device nodes arm64: dts: renesas: r8a774b1: Add all MSIOF nodes arm64: dts: renesas: r8a774b1: Add RWDT node dt-bindings: watchdog: renesas-wdt: Document r8a774b1 support dt-bindings: watchdog: Rename bindings documentation file dt-bindings: spi: sh-msiof: Add r8a774b1 support arm64: dts: renesas: Add HiHope RZ/G2N sub board support arm64: dts: renesas: r8a774b1: Add Ethernet AVB node dt-bindings: net: ravb: Add support for r8a774b1 SoC arm64: dts: renesas: r8a774b1: Add GPIO device nodes dt-bindings: gpio: rcar: Add DT binding for r8a774b1 arm64: dts: renesas: r8a774b1: Add SCIF and HSCIF nodes arm64: dts: renesas: r8a774b1: Add SYS-DMAC device nodes dt-bindings: dmaengine: rcar-dmac: Document R8A774B1 bindings CIP: Bump version suffix to -cip19 after merge from stable arm64: dts: renesas: r8a774c0: cat874: Sort nodes arm64: dts: renesas: Use ip=on for bootargs arm64: dts: renesas: r8a774c0: cat874: Add definition for 12V regulator arm64: dts: renesas: Update 'vsps' properties for readability arm64: dts: renesas: r8a774c0: Fix register range of display node arm64: dts: renesas: r8a774c0: Add missing assigned-clocks for CAN[01] arm64: dts: renesas: r8a774c0: Clean up CPU compatibles arm64: dts: renesas: r8a774c0: Add dynamic power coefficient arm64: dts: renesas: r8a774c0: Create thermal zone to support IPA thermal: rcar_thermal: update calculation formula for R-Car Gen3 SoCs dt-bindings: can: rcar_can: Complete documentation for RZ/G2[EM] dt-bindings: can: rcar_can: document r8a77965 support CIP: Bump version suffix to -cip18 after merge from stable CIP: Bump version suffix to -cip17 after merge from stable arm64: defconfig: Enable R8A774B1 SoC arm64: dts: renesas: Add HiHope RZ/G2N main board support arm64: dts: renesas: Initial r8a774b1 SoC device tree dt-bindings: serial: sh-sci: Document r8a774b1 bindings pinctrl: sh-pfc: pfc-r8a77965: Fix typo in pinmux macro for SCL3 pinctrl: sh-pfc: r8a77965: Add R8A774B1 PFC support dt-bindings: pinctrl: sh-pfc: Document r8a774b1 PFC support pinctrl: sh-pfc: r8a77965: Use new macros for non-GPIO pins pinctrl: sh-pfc: r8a77965: Add TPU pins, groups and functions pinctrl: sh-pfc: r8a77965: Add I2C{0,3,5} pins, groups and functions pinctrl: sh-pfc: r8a77965: Add DRIF pins, groups and functions pinctrl: sh-pfc: r8a77965: Add TMU pins, groups and functions pinctrl: sh-pfc: r8a77965: Replace DU_DOTCLKIN2 by DU_DOTCLKIN3 pinctrl: sh-pfc: r8a77965: Add CAN FD pins, groups and functions pinctrl: sh-pfc: r8a77965: Add CAN pins, groups and functions pinctrl: sh-pfc: r8a77965: Add VIN[4|5] groups/functions pinctrl: sh-pfc: r8a77965: Add Audio SSI pin support pinctrl: sh-pfc: r8a77965: Add Audio clock pin support pinctrl: sh-pfc: r8a77965: Add SATA pins, groups and functions clk: renesas: cpg-mssr: Add r8a774b1 support dt-bindings: clock: renesas: cpg-mssr: Document r8a774b1 binding dt-bindings: clk: Add r8a774b1 CPG Core Clock Definitions soc: renesas: rcar-rst: Add support for RZ/G2N dt-bindings: reset: rcar-rst: Document r8a774b1 reset module soc: renesas: rcar-sysc: Add r8a774b1 support soc: renesas: r8a774c0-sysc: Fix power request conflicts soc: renesas: r8a77990-sysc: Fix power request conflicts soc: renesas: r8a77980-sysc: Fix power request conflicts soc: renesas: r8a77970-sysc: Fix power request conflicts soc: renesas: r8a77965-sysc: Fix power request conflicts soc: renesas: r8a7796-sysc: Fix power request conflicts soc: renesas: r8a7795-sysc: Fix power request conflicts soc: renesas: rcar-sysc: Prepare for fixing power request conflicts dt-bindings: power: rcar-sysc: Document r8a774b1 sysc dt-bindings: power: Add r8a774b1 SYSC power domain definitions soc: renesas: Identify RZ/G2N soc: renesas: Add Renesas R8A774B1 config option dt-bindings: arm: renesas: Add HopeRun RZ/G2N boards dt-bindings: arm: renesas: Document RZ/G2N SoC DT bindings CIP: Bump version suffix to -cip16 after merge from stable CIP: Bump version suffix to -cip15 after merge from stable gitlab-ci: Use external linux-cip-pipelines repository to define CI arm64: dts: renesas: r8a774a1: Add SSIU support for sound ASoC: rsnd: add SSIU BUSIF support ASoC: rsnd: add .get_id/.get_id_sub ASoC: rsnd: move .get_status under rsnd_mod_ops ASoC: rsnd: merge .nolock_start and .prepare ASoC: rsnd: ssiu: Support to init different BUSIF instance ASoC: rsnd: ssiu: Support BUSIF other than BUSIF0 ASoc: rsnd: dma: Calculate PDMACHCRE with consider of BUSIF ASoc: rsnd: dma: Calculate dma address with consider of BUSIF ASoC: rsnd: ssi: Check runtime channel number rather than hw_params ASoC: rsnd: ssi: Fix issue in dma data address assignment ASoC: rsnd: remove is_play parameter from hw_rule function ASoC: rsnd: add support for 8 bit S8 format ASoC: rsnd: add support for 16/24 bit slot widths ASoC: rsnd: add warning message to rsnd_kctrl_accept_runtime() CIP: Bump version suffix to -cip14 after merge from stable gitlab-ci: Remove test timeout gitlab-ci: Remove unofficial build configurations gitlab-ci: Split tests into separate jobs CIP: Bump version suffix to -cip13 after merge from stable arm64: dts: renesas: hihope-rzg2-ex: Enable CAN interfaces arm64: dts: renesas: r8a774a1: Add CANFD support arm64: dts: renesas: r8a774a1: Add missing assigned-clocks for CAN[01] dt-bindings: can: rcar_canfd: document r8a774a1 support arm64: dts: renesas: hihope-common: Add HDMI audio support arm64: dts: renesas: r8a774a1: Use extended audio dmac registers arm64: dts: renesas: cat874: Add BT support arm64: dts: renesas: cat874: Add WLAN support arm64: dts: renesas: hihope-common: Add WLAN support arm64: dts: renesas: hihope-common: Add BT support arm64: dts: renesas: hihope-common: Add PCA9654 I/O expander CIP: Bump version suffix to -cip12 after merge from stable arm64: dts: renesas: r8a774c0: Add CANFD support dt-bindings: can: rcar_canfd: document r8a774c0 support arm64: dts: renesas: cat874: Add HDMI audio arm64: dts: renesas: cat874: Add HDMI video support arm64: defconfig: Enable TDA19988 arm64: dts: renesas: r8a774c0: Add display output support media: use strscpy() instead of strlcpy() drm: rcar-du: Replace EXT_CTRL_REGS feature flag with generation check drm: rcar-du: Disable unused DPAD outputs drm/rcar-du: Use drm_fbdev_generic_setup() drm: rcar-du: Reject modes that fail CRTC timing requirements drm: rcar-du: Fix external clock error checks drm: rcar-du: Fix vblank initialization drm: rcar-du: Fix the return value in case of error in 'rcar_du_crtc_set_crc_source()' drm/rcar-du: Replace drm_dev_unref with drm_dev_put drm: rcar-du: Enable configurable DPAD0 routing on Gen3 drm: rcar-du: Improve non-DPLL clock selection drm: rcar-du: lvds: Adjust operating frequency for D3 and E3 drm: rcar-du: lvds: Fix post-DLL divider calculation drm: rcar-du: Turn LVDS clock output on/off for DPAD0 output on D3/E3 drm: rcar-du: lvds: Add API to enable/disable clock output drm: rcar-du: lvds: Don't fail probe if output is not connected on D3/E3 drm: rcar-du: Simplify encoder registration drm: rcar-du: Move CRTC outputs bitmask to private CRTC state drm: rcar-du: lvds: add R8A774C0 support drm: rcar-du: Add r8a774c0 device support drm: rcar-du: Use LVDS PLL clock as dot clock when possible drm: rcar-du: Perform the initial CRTC setup from rcar_du_crtc_get() drm: rcar-du: lvds: D3/E3 support dt-bindings: display: renesas: lvds: Document r8a774c0 bindings dt-bindings: display: renesas: lvds: Add EXTAL and DU_DOTCLKIN clocks dt-bindings: display: renesas: du: Document r8a774c0 bindings media: dt-bindings: media: renesas-fcp: Add RZ/G2 support media: vsp1: Add RZ/G support CIP: Bump version suffix to -cip11 after merge from stable gitlab-ci: Always store job artifacts gitlab-ci: Increase test timeout to 60 minutes arm64: dts: renesas: hihope-common: Add HDMI support arm64: dts: renesas: r8a774a1: Add HDMI encoder instance arm64: dts: renesas: r8a774a1: Connect Ethernet-AVB to IPMMU-DS0 arm64: dts: renesas: r8a774a1: Tie Audio-DMAC to IPMMU-MP arm64: dts: renesas: r8a774a1: Tie SYS-DMAC to IPMMU-DS0/1 arm64: dts: renesas: r8a774a1: Add FDP1 instance arm64: dts: renesas: r8a774a1: Add DU device to DT arm64: dts: renesas: r8a774a1: Add VSP instances arm64: dts: renesas: hihope-rzg2-ex: Enable PCIe support arm64: dts: renesas: hihope-common: Declare pcie bus clock arm64: dts: renesas: r8a774a1: Add PCIe device nodes drm: rcar-du: Update framebuffer pitch and alignment limits for Gen3 drm: rcar-du: Store V4L2 fourcc in rcar_du_format_info structure drm: rcar-du: Add support for missing pixel formats drm: rcar-du: Rename and document dpll_ch field drm: rcar-du: Rework clock configuration based on hardware limits drm: rcar-du: Support interlaced video output through vsp1 drm: rcar-du: Don't use TV sync mode when not supported by the hardware drm: rcar-du: Cache DSYSR value to ensure known initial value drm: rcar-du: Add interlaced feature flag drm: rcar-du: Refactor Feature and Quirk definitions drm: rcar-du: dw-hdmi: Reject modes with a too high clock frequency drm: rcar-du: lvds: Add r8a774a1 support drm: rcar-du: Add R8A774A1 support PCI: rcar: Do not shadow the 'irq' variable PCI: rcar: Clean up debug messages PCI: rcar: Replace various variable types with unsigned ones for register values PCI: rcar: Replace unsigned long with u32/unsigned int in register accessors dt-bindings: display: renesas: Add r8a774a1 support dt-bindings: display: renesas: lvds: Document r8a774a1 bindings dt-bindings: display: renesas: du: Document the r8a774a1 bindings dt-bindings: PCI: rcar: Add device tree support for r8a774a1 CIP: Bump version suffix to -cip10 after merge from stable arm64: dts: renesas: hihope-common: Enable USB3.0 arm64: dts: renesas: hihope-common: Add USB 2.0 support arm64: dts: renesas: r8a774a1: Fix USB 2.0 clocks phy: renesas: rcar-gen3-usb2: fix imbalance powered flag arm64: dts: renesas: hihope-common: Remove "label" from LEDs arm64: dts: renesas: hihope-common: Add LEDs support arm64: dts: renesas: hihope-common: Add uSD and eMMC mmc: renesas_sdhi: prevent overflow for max_req_size mmc: tmio: introduce macro for max block size mmc: renesas_sdhi: Change HW adjustment register according to speed mode arm64: dts: renesas: r8a774a1: Add dynamic power coefficient arm64: dts: renesas: r8a774a1: Create thermal zone to support IPA arm64: dts: renesas: r8a774a1: Add CPU capacity-dmips-mhz arm64: dts: renesas: r8a774a1: Add CPU topology on r8a774a1 SoC arm64: dts: renesas: r8a774a1: Add operating points thermal: rcar_gen3_thermal: Update temperature conversion method thermal: rcar_gen3_thermal: Update calculation formula of IRQTEMP thermal: rcar_gen3_thermal: Update value of Tj_1 thermal: rcar_gen3_thermal: Fix to show correct trip points number thermal: rcar_gen3_thermal: fix interrupt type thermal: rcar_gen3_thermal: Fix init value of IRQCTL register thermal: rcar_gen3_thermal: Register hwmon sysfs interface arm64: dts: renesas: r8a774a1: Add TMU device nodes clk: renesas: r8a774a1: Add TMU clock arm64: dts: renesas: r8a774a1: Add CMT device nodes arm64: dts: renesas: hihope-common: Add RWDT support watchdog: renesas_wdt: Add a few cycles delay watchdog: renesas_wdt: Use 'dev' instead of dereferencing it repeatedly watchdog: renesas_wdt: drop superfluous glob pattern watchdog: renesas_wdt: don't keep timer value during suspend/resume watchdog: renesas_wdt: Fix typos watchdog: renesas_wdt: stop when unregistering arm64: dts: renesas: Add HiHope RZ/G2M sub board support arm64: dts: renesas: hihope-common: Add pincontrol support to scif2/scif clock arm64: dts: renesas: Add HiHope RZ/G2M main board support dt-bindings: Add vendor prefix for HopeRun dt-bindings: arm: renesas: Add HopeRun RZ/G2[M] boards gitlab-ci: Start testing the r8a774a1-hihope-rzg2m-ex device arm64: dts: renesas: r8a774a1: Add clkp2 clock to CAN nodes arm64: dts: Remove inconsistent use of 'arm,armv8' compatible string arm64: dts: renesas: r8a774a1: Fix hsusb reg size arm64: dts: renesas: r8a774a1: Enable DMA for SCIF2 arm64: dts: renesas: r8a774a1: Replace clock magic numbers arm64: dts: renesas: r8a774a1: Replace power magic numbers arm64: dts: renesas: r8a774a1: Add CAN nodes arm64: dts: renesas: Remove unneeded status from thermal nodes arm64: dts: renesas: Fix whitespace around assignments arm64: dts: renesas: r8a774a1: Add USB3.0 device nodes arm64: dts: renesas: r8a774a1: Add USB-DMAC and HSUSB device nodes arm64: dts: renesas: r8a774a1: Add USB2.0 phy and host(EHCI/OHCI) device nodes arm64: dts: renesas: r8a774a1: Add FCPF and FCPV instances arm64: dts: renesas: r8a774a1: Add audio support arm64: dts: renesas: r8a774a1: Add PWM device nodes arm64: dts: renesas: r8a774a1: Add Cortex-A53 CPU cores arm64: dts: renesas: r8a774a1: Add all MSIOF nodes arm64: dts: renesas: r8a774a1: Add IPMMU device nodes arm64: dts: renesas: r8a774a1: Add RZ/G2M thermal support arm64: dts: renesas: r8a774a1: Add I2C and IIC-DVFS support arm64: dts: renesas: r8a774a1: Add SDHI nodes arm64: dts: renesas: r8a774a1: Add GPIO device nodes arm64: dts: renesas: r8a774a1: Add pinctrl device node arm64: dts: renesas: r8a774a1: Add RWDT node arm64: dts: renesas: r8a774a1: Add Ethernet AVB node arm64: dts: renesas: r8a774a1: Add INTC-EX device node arm64: dts: renesas: r8a774a1: Add SCIF and HSCIF nodes arm64: dts: renesas: r8a774a1: Add SYS-DMAC controller nodes arm64: dts: renesas: Initial r8a774a1 SoC device tree mmc: renesas_sdhi_internal_dmac: set scatter/gather max segment size ravb: Avoid unsupported internal delay mode for R-Car E3/D3 ravb: remove tx buffer addr 4byte alilgnment restriction for R-Car Gen3 spi: sh-msiof: fix deferred probing dmaengine: rcar-dmac: Update copyright information dmaengine: rcar-dmac: set scatter/gather max segment size serial: sh-sci: Fix fallback to PIO in sci_dma_rx_complete() serial: sh-sci: Extract sci_dma_rx_reenable_irq() serial: sh-sci: Extract sci_dma_rx_chan_invalidate() serial: sh-sci: Fix crash in rx_timer_fn() on PIO fallback soc: renesas: rcar-sysc: Fix power domain control after system resume soc: renesas: rcar-sysc: Merge PM Domain registration and linking soc: renesas: rcar-sysc: Remove rcar_sysc_power_{down,up}() helpers clk: renesas: cpg-mssr: Remove error messages on out-of-memory conditions clk: renesas: cpg-mssr: Use genpd of_node instead of local copy gpio: rcar: Pedantic formatting gpio: rcar: select General Output Register to set output states gpio: rcar: reference device instead of platform device thermal: rcar_gen3_thermal: Add r8a774a1 support dt-bindings: dmaengine: usb-dmac: Add binding for r8a774a1 dt-bindings: thermal: rcar-gen3-thermal: Add r8a774a1 support dt-bindings: usb: renesas_usbhs: Add r8a774a1 support dt-bindings: usb-xhci: Add r8a774c0 support dt-bindings: usb-xhci: Add r8a774a1 support dt-bindings: rcar-gen3-phy-usb3: Add r8a774a1 support dt-bindings: can: rcar_can: Add r8a774c0 support dt-bindings: can: rcar_can: Fix RZ/G2 CAN clocks dt-bindings: can: rcar_can: Add r8a774a1 support pinctrl: sh-pfc: sh73a0: Use new macros for non-GPIO pins pinctrl: sh-pfc: sh73a0: Add missing TO pin to tpu4_to3 group pinctrl: sh-pfc: sh73a0: Fix fsic_spdif pin groups pinctrl: sh-pfc: r8a7791: Fix scifb2_data_c pin group pinctrl: sh-pfc: r8a7791: Fix VIN1 versioned groups pinctrl: sh-pfc: r8a7791: Remove bogus marks from vin1_b_data18 group pinctrl: sh-pfc: r8a7791: Remove bogus ctrl marks from qspi_data4_b group pinctrl: sh-pfc: r8a77995: Remove unused PINMUX_IPSR_{MSEL2,PHYS}() pinctrl: sh-pfc: r8a7740: Add missing LCD0 marks to lcd0_data24_1 group pinctrl: sh-pfc: r8a7740: Add missing REF125CK pin to gether_gmii group pinctrl: sh-pfc: r8a7796: Remove placeholder I2C pin data pinctrl: sh-pfc: r8a7796: Use new macros for non-GPIO pins pinctrl: sh-pfc: r8a7796: Add TPU pins, groups and functions pinctrl: sh-pfc: r8a77990: Use new macros for non-GPIO pins pinctrl: sh-pfc: Move PIN_NONE to shared header file pinctrl: sh-pfc: Add PORT_GP_27 helper macro pinctrl: sh-pfc: rcar-gen3: Rename SEL_NDFC to SEL_NDF pinctrl: sh-pfc: rcar-gen3: Rename RTS{0,1,3,4}# pin function definitions pinctrl: sh-pfc: r8a77990: Fix MOD_SEL1 bit30 when using SSI_SCK2 and SSI_WS2 pinctrl: sh-pfc: r8a77990: Fix MOD_SEL1 bit31 when using SIM0_D pinctrl: sh-pfc: r8a77990: Fix MOD_SEL0 bit16 when using NFALE and NFRB_N pinctrl: sh-pfc: rcar-gen3: Rename SEL_ADG_{A,B,C} to SEL_ADG{A,B,C} pinctrl: sh-pfc: rcar-gen3: Remove CC5_OSCOUT pin pinctrl: sh-pfc: rcar-gen3: Remove HDMI CEC pins, groups, and functions pinctrl: sh-pfc: Add missing #include <linux/errno.h> pinctrl: sh-pfc: rcar-gen3: Retain TDSELCTRL register across suspend/resume pinctrl: sh-pfc: r8a77990: Move CANFD pin groups and functions pinctrl: sh-pfc: r8a77990: Rename IOCTRLx registers pinctrl: sh-pfc: r8a7796: Move CANFD pin groups and functions pinctrl: sh-pfc: r8a7796: Deduplicate VIN5 pin definitions pinctrl: sh-pfc: r8a7796: Add I2C{0,3,5} pins, groups and functions pinctrl: sh-pfc: r8a7796: Fix VIN versioned groups pinctrl: sh-pfc: Validate pin tables at runtime pinctrl: sh-pfc: Add check for empty pinmux groups/functions pinctrl: sh-pfc: Mark run-time debug code __init pinctrl: sh-pfc: Correct printk level of group reference warning pinctrl: sh-pfc: Add new non-GPIO helper macros pinctrl: sh-pfc: Add SH_PFC_PIN_CFG_PULL_UP_DOWN shorthand pinctrl: sh-pfc: Rename 2-parameter CPU_ALL_PORT() variant pinctrl: sh-pfc: Improve PINMUX_IPSR_PHYS() documentation pinctrl: sh-pfc: Validate enum IDs for regs with variable-width fields pinctrl: sh-pfc: Validate enum IDs for regs with fixed-width fields pinctrl: sh-pfc: Absorb enum IDs in PINMUX_DATA_REG() macro pinctrl: sh-pfc: Absorb enum IDs in PINMUX_CFG_REG_VAR() macro pinctrl: sh-pfc: Absorb enum IDs in PINMUX_CFG_REG() macro pinctrl: sh-pfc: Validate fixed-size field widths at build time pinctrl: sh-pfc: Make pinmux_cfg_reg.var_field_width[] variable-length pinctrl: sh-pfc: Validate pins/marks in pin groups at build time pinctrl: sh-pfc: Add physical pin multiplexing helper macros pinctrl: sh-pfc: Validate pinmux tables at runtime when debugging pinctrl: sh-pfc: Print actual field width for variable-width fields CIP: Bump version suffix to -cip9 after merge from stable staging: m57621-mmc: delete driver from the tree. CIP: Bump version suffix to -cip8 after merge from stable Update to run all CIP arm, arm64 and x86 configs Update CI to use the latest linux-cip-ci containers CIP: Bump version suffix to -cip7 after merge from stable arm64: dts: renesas: r8a774c0: sort subnodes of the soc node arm64: dts: renesas: r8a774c0: Remove invalid compatible value for CSI40 arm64: dts: renesas: r8a774c0: Fix SCIF5 DMA channels arm64: dts: renesas: r8a774c0: Enable DMA for SCIF2 arm64: dts: renesas: r8a774c0-cat874: Add RWDT support arm64: dts: renesas: r8a774c0-cat874: Add LEDs support arm64: dts: renesas: r8a774c0-cat874: add RTC support arm64: defconfig: enable RX-8581 config option rtc: rx8581: Add support for Epson rx8571 RTC dt-bindings: rtc: add rx8571 compatible rtc: nvmem: remove nvmem from struct rtc_device rtc: nvmem: use devm_nvmem_register() arm64: dts: renesas: cat874: Add USB-HOST support phy: renesas: rcar-gen3-usb2: enable/disable independent irqs phy: renesas: rcar-gen3-usb2: Use pdev's device pointer on dev_vdbg() phy: rcar-gen3-usb2: Add support for r8a77470 phy: renesas: rcar-gen3-usb2: follow the hardware manual procedure phy: renesas: rcar-gen3-usb2: add is_otg_channel to use "role" sysfs phy: renesas: rcar-gen3-usb2: change a condition "dr_mode" phy: renesas: rcar-gen3-usb2: add conditions for uses_otg_pins == false phy: renesas: rcar-gen3-usb2: unify OBINTEN handling phy: renesas: rcar-gen3-usb2: Check a property to use otg pins phy: renesas: rcar-gen3-usb2: Rename has_otg_pins to uses_otg_pins phy: renesas: rcar-gen3-usb2: fix vbus_ctrl for role sysfs arm64: dts: renesas: cat875: Add CAN support arm64: dts: renesas: r8a774c0: Add clkp2 clock to CAN nodes arm64: dts: renesas: r8a774c0: Add CAN nodes arm64: dts: renesas: r8a774c0: Fix cpu nodes style arm64: dts: renesas: r8a774c0: Add OPPs table for cpu devices clk: renesas: rcar-gen3: Remove unused variable clk: renesas: rcar-gen3: Fix cpg_sd_clock_round_rate() return value clk: renesas: rcar-gen3: Correct parent clock of Audio-DMAC clk: renesas: rcar-gen3: Correct parent clock of SYS-DMAC clk: renesas: rcar-gen3: Correct parent clock of HS-USB clk: renesas: rcar-gen3: Correct parent clock of EHCI/OHCI clk: renesas: r8a774c0: Add Z2 clock clk: renesas: rcar-gen3: Support Z and Z2 clocks with high frequency parents math64: New DIV64_U64_ROUND_CLOSEST helper clk: renesas: rcar-gen3: Remove CLK_TYPE_GEN3_Z2 clk: renesas: rcar-gen3: Parameterise Z and Z2 clock offset clk: renesas: rcar-gen3: Parameterise Z and Z2 clock fixed divisor clk: renesas: rcar-gen3: Pass name/offset to cpg_sd_clk_register() clk: renesas: r8a774a1: Fix LAST_DT_CORE_CLK clk: renesas: rcar-gen3: Add spinlock clk: renesas: rcar-gen3: Factor out cpg_reg_modify() clk: renesas: r8a774a1: Add missing CANFD clock clk: renesas: Remove usage of CLK_IS_BASIC clk: renesas: rcar-gen3: Add HS400 quirk for SD clock clk: renesas: rcar-gen3: Add documentation for SD clocks clk: renesas: rcar-gen3: Set state when registering SD clocks clk: renesas: r8a774a1: Add CPEX clock CIP: Bump version suffix to -cip6 after merge from stable Add gitlab-ci.yaml CIP: Bump version suffix to -cip5 after merge from stable CIP: Bump version suffix to -cip4 after merge from stable CIP: Bump version suffix to -cip3 after merge from stable dt-bindings: Add vendor prefix for Silicon Linux. CIP: Bump version suffix to -cip2 after Renesas patches arm64: defconfig: Enable R-Car thermal driver arm64: dts: renesas: r8a774c0: Add thermal support dt-bindings: thermal: rcar-thermal: add R8A774C0 support thermal: rcar_thermal: add R8A774C0 support arm64: dts: renesas: r8a774c0: Connect RZ/G2E Audio-DMAC to IPMMU arm64: dts: renesas: r8a774c0: Connect RZ/G2E AVB to IPMMU arm64: dts: renesas: r8a774c0: Connect RZ/G2E SYS-DMAC to IPMMU arm64: dts: renesas: r8a774c0: Add PWM support dt-bindings: pwm: rcar: Add r8a774c0 support dt-bindings: pwm: rcar: Add r8a774a1 support arm64: dts: renesas: r8a774c0: Add audio support ASoC: rsnd: Add r8a774c0 support ASoC: rsnd: Add r8a774a1 support arm64: dts: renesas: r8a774c0: Add VIN and CSI-2 device nodes media: dt-bindings: rcar-csi2: Add r8a774c0 media: dt-bindings: rcar-vin: Add R8A774C0 support media: rcar-csi2: Add support for RZ/G2E media: rcar-csi2: Fix PHTW table values for E3/V3M media: rcar-csi2: Handle per-SoC number of channels media: rcar: rcar-csi2: Update V3M/E3 PHTW tables media: rcar-csi2: Add R8A77990 support media: rcar-vin: Add support for RZ/G2E media: rcar-vin: Add support for R-Car R8A77990 arm64: dts: renesas: r8a774c0: Add IPMMU device nodes dt-bindings: iommu: ipmmu-vmsa: Add r8a774c0 support dt-bindings: iommu: ipmmu-vmsa: Add r8a774a1 support iommu/ipmmu-vmsa: Hook up r8a774c0 DT matching code iommu/ipmmu-vmsa: Modify ipmmu_slave_whitelist() to check SoC revisions iommu/ipmmu-vmsa: Hook up R8A774A1 DT maching code arm64: dts: renesas: r8a774c0: Add USB3.0 device nodes usb: gadget: udc: renesas_usb3: Add bindings for r8a774c0 usb: gadget: udc: renesas_usb3: Add r8a774a1 support usb: gadget: udc: renesas_usb3: add support for r8a774c0 usb: gadget: udc: renesas_usb3: add a safety connection way for forced_b_device usb: gadget: udc: renesas_usb3: add support for r8a77990 arm64: dts: renesas: r8a774c0: Add USB-DMAC and HSUSB device nodes dt-bindings: dmaengine: usb-dmac: Add binding for r8a774c0 dt-bindings: usb: renesas_usbhs: Add r8a774c0 support dt-bindings: usb: renesas_usbhs: add clock-names property Revert "usb: renesas_usbhs: add extcon notifier to set mode for non-otg channel" usb: renesas_usbhs: Add multiple clocks management usb: renesas_usbhs: Add reset_control usb: renesas_usbhs: add support for RZ/G2E arm64: dts: renesas: r8a774c0: Add USB2.0 phy and host device nodes dt-bindings: rcar-gen3-phy-usb2: Add r8a774c0 support dt-bindings: rcar-gen3-phy-usb2: Add r8a774a1 support arm64: renesas: Enable GPIOLIB to allow GPIO driver selection arm64: enable CMT/TMU support for Renesas SoC clocksource/drivers/sh_tmu: Convert to SPDX identifiers arm64: dts: renesas: r8a774c0: Add TMU device nodes dt-bindings: timer: renesas: tmu: Document r8a774c0 bindings clk: renesas: r8a774c0: Fix LAST_DT_CORE_CLK clk: renesas: r8a774c0: Add TMU clock clk: renesas: r8a774c0: Correct parent clock of DU clk: renesas: r8a774c0: Add missing CANFD clock arm64: dts: renesas: r8a774c0: Add CMT device nodes dt-bindings: timer: renesas, cmt: Document r8a774c0 CMT support dt-bindings: timer: renesas, cmt: Document r8a774a1 CMT support clocksource/drivers/sh_cmt: Add R-Car gen3 support dt-bindings: timer: renesas: cmt: document R-Car gen3 support clocksource/drivers/sh_cmt: Properly line-wrap sh_cmt_of_table[] initializer clocksource/drivers/sh_cmt: Fix clocksource width for 32-bit machines clocksource/drivers/sh_cmt: Fixup for 64-bit machines clocksource/drivers/sh_cmt: Convert to SPDX identifiers pinctrl: sh-pfc: r8a77990: Add DRIF pins, groups and functions pinctrl: sh-pfc: r8a77990: Add TMU pins, groups and functions pinctrl: sh-pfc: r8a77990: GP6_9 does not have pull-down capability pinctrl: sh-pfc: r8a77990: Fix MOD_SEL bit numbering pinctrl: sh-pfc: r8a77990: Fix MOD_SEL0 bit2 when using RX2, TX2 and SCK2 pinctrl: sh-pfc: r8a77990: Fix MOD_SEL0 bit3 when using TX0 pinctrl: sh-pfc: r8a77990: Fix MOD_SEL0 SEL_I2C1 field width pinctrl: sh-pfc: r8a77990: Fix IOCTRL reg state after s2ram on R-Car E3 pinctrl: sh-pfc: r8a77990: Add CAN FD pins, groups and functions pinctrl: sh-pfc: r8a77990: Add CAN pins, groups and functions arm64: dts: renesas: cat875: Enable PCIe support arm64: dts: renesas: r8a774c0-cat874: Add pciec0 support arm64: dts: renesas: r8a774c0: Add PCIe device node dt-bindings: PCI: rcar: Add device tree support for r8a774c0 arm64: dts: renesas: r8a774c0: Add MSIOF nodes spi: sh-msiof: Add r8a774c0 support spi: sh-msiof: Add r8a774a1 support arm64: dts: renesas: r8a774c0: Add I2C and IIC-DVFS support dt-bindings: i2c: rcar: Add r8a774c0 support i2c: sh_mobile: Add support for r8a774c0 (RZ/G2E) i2c: sh_mobile: add support for r8a77990 (R-Car E3) dt-bindings: i2c: sh_mobile: Add r8a774c0 support i2c: sh_mobile: document support for r8a77990 (R-Car E3) pinctrl: sh-pfc: r8a77990: Add HSCIF pins, groups, and functions pinctrl: sh-pfc: r8a77990: Add VIN[4|5] groups/functions pinctrl: sh-pfc: Add optional arg to VIN_DATA_PIN_GROUP pinctrl: sh-pfc: Reduce kernel size for narrow VIN channels arm64: dts: renesas: r8a774c0: Add watchdog support dt-bindings: watchdog: renesas-wdt: Document r8a774c0 support arm64: dts: renesas: cat875: Add ethernet support arm64: dts: renesas: r8a774c0: Add Ethernet AVB node dt-bindings: net: ravb: Add support for r8a774c0 SoC arm64: dts: renesas: r8a774c0-cat874: Add uSD support arm64: dts: renesas: r8a774c0: Add SDHI nodes mmc: renesas_sdhi_internal_dmac: Whitelist r8a774c0 dt-bindings: mmc: renesas_sdhi: Add r8a774c0 support dt-bindings: mmc: renesas_sdhi: Add r8a77470 support mmc: renesas_sdhi_internal_dmac: Whitelist r8a774a1 mmc: renesas_sdhi: Add r8a774a1 support pinctrl: sh-pfc: r8a77990: Add voltage switch operations for SDHI pinctrl: sh-pfc: r8a77990: Add SDHI pins, groups and functions pinctrl: sh-pfc: r8a77990: Add Audio SSI pins, groups and functions pinctrl: sh-pfc: r8a77990: Add Audio clock pins, groups and functions arm64: dts: renesas: r8a774c0-cat874: Add pincontrol support to scif2 arm64: dts: renesas: r8a774c0: Add GPIO device nodes dt-bindings: gpio: rcar: Add r8a774c0 (RZ/G2E) support dt-bindings: gpio: rcar: Add r8a774a1 (RZ/G2M) support arm64: dts: renesas: r8a774c0: Add PFC support arm64: dts: renesas: r8a774c0: Add INTC-EX device node pinctrl: sh-pfc: r8a77990: Add INTC-EX pins, groups and function pinctrl: sh-pfc: rcar: Rename automotive-only arrays to automotive arm64: dts: renesas: r8a774c0: Add secondary CA53 CPU core clk: renesas: cpg-mssr: Add r8a774c0 support dt-bindings: clock: renesas: cpg-mssr: Document r8a774c0 clk: renesas: cpg-mssr: Add r8a774a1 support clk: renesas: rcar-gen3: Add support for mode pin clock selection clk: renesas: rcar-gen3: Add support for RCKSEL clock selection clk: renesas: cpg-mssr: Add support for fixed rate clocks clk: renesas: rcar-gen3: Add support for OSC EXTAL predivider clk: renesas: Add r8a774a1 CPG Core Clock Definitions clk: renesas: Add r8a774c0 CPG Core Clock Definitions arm64: dts: renesas: r8a774c0: Add SCIF and HSCIF nodes dt-bindings: serial: sh-sci: Document r8a774c0 bindings dt-bindings: serial: sh-sci: Document r8a774a1 bindings arm64: dts: renesas: r8a774c0: Add SYS-DMAC controller nodes dmaengine: rcar-dmac: Document R8A774C0 bindings dmaengine: rcar-dmac: Document R8A774A1 bindings arm64: dts: renesas: Add Si-Linux EK874 board support arm64: dts: renesas: Add Si-Linux CAT874 board support arm64: dts: renesas: Initial device tree for r8a774c0 dt-bindings: arm: Add si-linux cat87[45] boards ARM: dts: socfpga: Rename socfpga_cyclone5_de0_{sockit, nano_soc} dt-bindings: irqchip: renesas-irqc: Document r8a774c0 support soc: renesas: rcar-rst: Add support for RZ/G2E dt-bindings: reset: rcar-rst: Document r8a774c0 rst soc: renesas: rcar-rst: Add support for RZ/G2M soc: renesas: rcar-sysc: Add r8a774c0 support dt-bindings: power: rcar-sysc: Document r8a774c0 sysc soc: renesas: rcar-sysc: Add r8a774a1 support dt-bindings: power: Add r8a774c0 SYSC power domain definitions dt-bindings: power: Add r8a774a1 SYSC power domain definitions arm64: defconfig: enable R8A774C0 SoC arm64: defconfig: enable R8A774A1 SoC arm64: Add Renesas R8A774C0 support arm64: Add Renesas R8A774A1 support soc: renesas: Identify RZ/G2E soc: renesas: Identify RZ/G2M dt-bindings: arm: Fix RZ/G2E part number dt-bindings: arm: Document RZ/G2E SoC DT bindings dt-bindings: arm: Document RZ/G2M SoC DT bindings pinctrl: sh-pfc: r8a77990: Add R8A774C0 PFC support pinctrl: sh-pfc: r8a77990: Add MSIOF pins, groups and functions pinctrl: sh-pfc: r8a77990: Add DU pins, groups and function pinctrl: sh-pfc: r8a77990: Add PWM pins, groups and functions dt-bindings: pinctrl: sh-pfc: Document r8a774c0 PFC support pinctrl: sh-pfc: r8a7796: Add R8A774A1 PFC support dt-bindings: pinctrl: sh-pfc: Document r8a774a1 PFC support CIP: Add a number to the version suffix Conflicts: Documentation/devicetree/bindings/i2c/i2c-rcar.txt Documentation/devicetree/bindings/i2c/i2c-sh_mobile.txt Documentation/devicetree/bindings/usb/renesas_usb3.txt Documentation/devicetree/bindings/usb/renesas_usbhs.txt Documentation/devicetree/bindings/watchdog/renesas-wdt.txt arch/arm64/boot/dts/vendor/bindings/display/panel/advantech,idk-1110wr.txt arch/arm64/boot/dts/vendor/bindings/display/panel/advantech,idk-2121wr.yaml arch/arm64/boot/dts/vendor/bindings/i2c/i2c-rcar.txt arch/arm64/boot/dts/vendor/bindings/i2c/i2c-sh_mobile.txt arch/arm64/boot/dts/vendor/bindings/i2c/renesas,i2c.txt arch/arm64/boot/dts/vendor/bindings/i2c/renesas,iic.txt arch/arm64/boot/dts/vendor/bindings/media/i2c/imx219.yaml arch/arm64/boot/dts/vendor/bindings/memory-controllers/renesas,rpc-if.yaml arch/arm64/boot/dts/vendor/bindings/pci/rcar-pci-ep.yaml arch/arm64/boot/dts/vendor/bindings/usb/renesas,usb3-peri.txt arch/arm64/boot/dts/vendor/bindings/usb/renesas,usbhs.txt arch/arm64/boot/dts/vendor/bindings/usb/renesas_usb3.txt arch/arm64/boot/dts/vendor/bindings/usb/renesas_usbhs.txt arch/arm64/boot/dts/vendor/bindings/usb/ti,hd3ss3220.txt arch/arm64/boot/dts/vendor/bindings/watchdog/renesas,wdt.txt arch/arm64/boot/dts/vendor/bindings/watchdog/renesas-wdt.txt drivers/clk/qcom/clk-alpha-pll.c drivers/hid/hid-ids.h drivers/irqchip/irq-gic-v3.c drivers/media/platform/qcom/venus/hfi_parser.c drivers/mmc/host/sdhci.h drivers/platform/x86/intel_cht_int33fe.c drivers/slimbus/messaging.c drivers/usb/dwc3/core.c drivers/usb/dwc3/gadget.c drivers/usb/gadget/function/f_fs.c drivers/usb/typec/mux.c fs/ext4/dir.c kernel/time/posix-timers.c mm/oom_kill.c Change-Id: I6ccf7ce22c6636030db6245952c67bfa54aef5a4 |
|||
| ac1f7e9235 |
Bluetooth: L2CAP: Fix L2CAP MTU negotiation
commit 042bb9603c44620dce98717a2d23235ca57a00d7 upstream.
OBEX download from iPhone is currently slow due to small packet size
used to transfer data which doesn't follow the MTU negotiated during
L2CAP connection, i.e. 672 bytes instead of 32767:
< ACL Data TX: Handle 11 flags 0x00 dlen 12
L2CAP: Connection Request (0x02) ident 18 len 4
PSM: 4103 (0x1007)
Source CID: 72
> ACL Data RX: Handle 11 flags 0x02 dlen 16
L2CAP: Connection Response (0x03) ident 18 len 8
Destination CID: 14608
Source CID: 72
Result: Connection successful (0x0000)
Status: No further information available (0x0000)
< ACL Data TX: Handle 11 flags 0x00 dlen 27
L2CAP: Configure Request (0x04) ident 20 len 19
Destination CID: 14608
Flags: 0x0000
Option: Maximum Transmission Unit (0x01) [mandatory]
MTU: 32767
Option: Retransmission and Flow Control (0x04) [mandatory]
Mode: Enhanced Retransmission (0x03)
TX window size: 63
Max transmit: 3
Retransmission timeout: 2000
Monitor timeout: 12000
Maximum PDU size: 1009
> ACL Data RX: Handle 11 flags 0x02 dlen 26
L2CAP: Configure Request (0x04) ident 72 len 18
Destination CID: 72
Flags: 0x0000
Option: Retransmission and Flow Control (0x04) [mandatory]
Mode: Enhanced Retransmission (0x03)
TX window size: 32
Max transmit: 255
Retransmission timeout: 0
Monitor timeout: 0
Maximum PDU size: 65527
Option: Frame Check Sequence (0x05) [mandatory]
FCS: 16-bit FCS (0x01)
< ACL Data TX: Handle 11 flags 0x00 dlen 29
L2CAP: Configure Response (0x05) ident 72 len 21
Source CID: 14608
Flags: 0x0000
Result: Success (0x0000)
Option: Maximum Transmission Unit (0x01) [mandatory]
MTU: 672
Option: Retransmission and Flow Control (0x04) [mandatory]
Mode: Enhanced Retransmission (0x03)
TX window size: 32
Max transmit: 255
Retransmission timeout: 2000
Monitor timeout: 12000
Maximum PDU size: 1009
> ACL Data RX: Handle 11 flags 0x02 dlen 32
L2CAP: Configure Response (0x05) ident 20 len 24
Source CID: 72
Flags: 0x0000
Result: Success (0x0000)
Option: Maximum Transmission Unit (0x01) [mandatory]
MTU: 32767
Option: Retransmission and Flow Control (0x04) [mandatory]
Mode: Enhanced Retransmission (0x03)
TX window size: 63
Max transmit: 3
Retransmission timeout: 2000
Monitor timeout: 12000
Maximum PDU size: 1009
Option: Frame Check Sequence (0x05) [mandatory]
FCS: 16-bit FCS (0x01)
...
> ACL Data RX: Handle 11 flags 0x02 dlen 680
Channel: 72 len 676 ctrl 0x0202 [PSM 4103 mode Enhanced Retransmission (0x03)] {chan 8}
I-frame: Unsegmented TxSeq 1 ReqSeq 2
< ACL Data TX: Handle 11 flags 0x00 dlen 13
Channel: 14608 len 9 ctrl 0x0204 [PSM 4103 mode Enhanced Retransmission (0x03)] {chan 8}
I-frame: Unsegmented TxSeq 2 ReqSeq 2
> ACL Data RX: Handle 11 flags 0x02 dlen 680
Channel: 72 len 676 ctrl 0x0304 [PSM 4103 mode Enhanced Retransmission (0x03)] {chan 8}
I-frame: Unsegmented TxSeq 2 ReqSeq 3
The MTUs are negotiated for each direction. In this traces 32767 for
iPhone->localhost and no MTU for localhost->iPhone, which based on
'4.4 L2CAP_CONFIGURATION_REQ' (Core specification v5.4, Vol. 3, Part
A):
The only parameters that should be included in the
L2CAP_CONFIGURATION_REQ packet are those that require different
values than the default or previously agreed values.
...
Any missing configuration parameters are assumed to have their
most recently explicitly or implicitly accepted values.
and '5.1 Maximum transmission unit (MTU)':
If the remote device sends a positive L2CAP_CONFIGURATION_RSP
packet it should include the actual MTU to be used on this channel
for traffic flowing into the local device.
...
The default value is 672 octets.
is set by BlueZ to 672 bytes.
It seems that the iPhone used the lowest negotiated value to transfer
data to the localhost instead of the negotiated one for the incoming
direction.
This could be fixed by using the MTU negotiated for the other
direction, if exists, in the L2CAP_CONFIGURATION_RSP.
This allows to use segmented packets as in the following traces:
< ACL Data TX: Handle 11 flags 0x00 dlen 12
L2CAP: Connection Request (0x02) ident 22 len 4
PSM: 4103 (0x1007)
Source CID: 72
< ACL Data TX: Handle 11 flags 0x00 dlen 27
L2CAP: Configure Request (0x04) ident 24 len 19
Destination CID: 2832
Flags: 0x0000
Option: Maximum Transmission Unit (0x01) [mandatory]
MTU: 32767
Option: Retransmission and Flow Control (0x04) [mandatory]
Mode: Enhanced Retransmission (0x03)
TX window size: 63
Max transmit: 3
Retransmission timeout: 2000
Monitor timeout: 12000
Maximum PDU size: 1009
> ACL Data RX: Handle 11 flags 0x02 dlen 26
L2CAP: Configure Request (0x04) ident 15 len 18
Destination CID: 72
Flags: 0x0000
Option: Retransmission and Flow Control (0x04) [mandatory]
Mode: Enhanced Retransmission (0x03)
TX window size: 32
Max transmit: 255
Retransmission timeout: 0
Monitor timeout: 0
Maximum PDU size: 65527
Option: Frame Check Sequence (0x05) [mandatory]
FCS: 16-bit FCS (0x01)
< ACL Data TX: Handle 11 flags 0x00 dlen 29
L2CAP: Configure Response (0x05) ident 15 len 21
Source CID: 2832
Flags: 0x0000
Result: Success (0x0000)
Option: Maximum Transmission Unit (0x01) [mandatory]
MTU: 32767
Option: Retransmission and Flow Control (0x04) [mandatory]
Mode: Enhanced Retransmission (0x03)
TX window size: 32
Max transmit: 255
Retransmission timeout: 2000
Monitor timeout: 12000
Maximum PDU size: 1009
> ACL Data RX: Handle 11 flags 0x02 dlen 32
L2CAP: Configure Response (0x05) ident 24 len 24
Source CID: 72
Flags: 0x0000
Result: Success (0x0000)
Option: Maximum Transmission Unit (0x01) [mandatory]
MTU: 32767
Option: Retransmission and Flow Control (0x04) [mandatory]
Mode: Enhanced Retransmission (0x03)
TX window size: 63
Max transmit: 3
Retransmission timeout: 2000
Monitor timeout: 12000
Maximum PDU size: 1009
Option: Frame Check Sequence (0x05) [mandatory]
FCS: 16-bit FCS (0x01)
...
> ACL Data RX: Handle 11 flags 0x02 dlen 1009
Channel: 72 len 1005 ctrl 0x4202 [PSM 4103 mode Enhanced Retransmission (0x03)] {chan 8}
I-frame: Start (len 21884) TxSeq 1 ReqSeq 2
> ACL Data RX: Handle 11 flags 0x02 dlen 1009
Channel: 72 len 1005 ctrl 0xc204 [PSM 4103 mode Enhanced Retransmission (0x03)] {chan 8}
I-frame: Continuation TxSeq 2 ReqSeq 2
This has been tested with kernel 5.4 and BlueZ 5.77.
Cc: stable@vger.kernel.org
Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>
|
|||
| faf0fd6706 |
Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address
[ Upstream commit eb73b5a9157221f405b4fe32751da84ee46b7a25 ]
This fixes sending MGMT_EV_DEVICE_FOUND for invalid address
(00:00:00:00:00:00) which is a regression introduced by
a2ec905d1e16 ("Bluetooth: fix kernel oops in store_pending_adv_report")
since in the attempt to skip storing data for extended advertisement it
actually made the code to skip the entire if statement supposed to send
MGMT_EV_DEVICE_FOUND without attempting to use the last_addr_adv which
is garanteed to be invalid for extended advertisement since we never
store anything on it.
Link: https://github.com/bluez/bluez/issues/1157
Link: https://github.com/bluez/bluez/issues/1149#issuecomment-2767215658
Fixes: a2ec905d1e16 ("Bluetooth: fix kernel oops in store_pending_adv_report")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>
|
|||
| 6b5f7be41e |
Bluetooth: Fix error code in chan_alloc_skb_cb()
[ Upstream commit 72d061ee630d0dbb45c2920d8d19b3861c413e54 ]
The chan_alloc_skb_cb() function is supposed to return error pointers on
error. Returning NULL will lead to a NULL dereference.
Fixes:
|
|||
| 95467a3cc7 |
Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc
commit 5f397409f8ee5bc82901eeaf799e1cbc4f8edcf1 upstream.
A NULL sock pointer is passed into l2cap_sock_alloc() when it is called
from l2cap_sock_new_connection_cb() and the error handling paths should
also be aware of it.
Seemingly a more elegant solution would be to swap bt_sock_alloc() and
l2cap_chan_create() calls since they are not interdependent to that moment
but then l2cap_chan_create() adds the soon to be deallocated and still
dummy-initialized channel to the global list accessible by many L2CAP
paths. The channel would be removed from the list in short period of time
but be a bit more straight-forward here and just check for NULL instead of
changing the order of function calls.
Found by Linux Verification Center (linuxtesting.org) with SVACE static
analysis tool.
Fixes: 7c4f78cdb8e7 ("Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()")
Cc: stable@vger.kernel.org
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>
|
|||
| 7b9f986e0e |
Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()
[ Upstream commit 7c4f78cdb8e7501e9f92d291a7d956591bf73be9 ] bt_sock_alloc() allocates the sk object and attaches it to the provided sock object. On error l2cap_sock_alloc() frees the sk object, but the dangling pointer is still attached to the sock object, which may create use-after-free in other code. Signed-off-by: Ignat Korchagin <ignat@cloudflare.com> Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20241014153808.51894-3-ignat@cloudflare.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Ulrich Hecht <uli@kernel.org> |
|||
| 874391c94e |
Merge 4.19.325 into android-4.19-stable
Changes in 4.19.325
netlink: terminate outstanding dump on socket close
ocfs2: uncache inode which has failed entering the group
nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint
ocfs2: fix UBSAN warning in ocfs2_verify_volume()
nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint
Revert "mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K"
media: dvbdev: fix the logic when DVB_DYNAMIC_MINORS is not set
kbuild: Use uname for LINUX_COMPILE_HOST detection
mm: revert "mm: shmem: fix data-race in shmem_getattr()"
ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet
mac80211: fix user-power when emulating chanctx
selftests/watchdog-test: Fix system accidentally reset after watchdog-test
x86/amd_nb: Fix compile-testing without CONFIG_AMD_NB
net: usb: qmi_wwan: add Quectel RG650V
proc/softirqs: replace seq_printf with seq_put_decimal_ull_width
nvme: fix metadata handling in nvme-passthrough
initramfs: avoid filename buffer overrun
m68k: mvme147: Fix SCSI controller IRQ numbers
m68k: mvme16x: Add and use "mvme16x.h"
m68k: mvme147: Reinstate early console
acpi/arm64: Adjust error handling procedure in gtdt_parse_timer_block()
s390/syscalls: Avoid creation of arch/arch/ directory
hfsplus: don't query the device logical block size multiple times
EDAC/fsl_ddr: Fix bad bit shift operations
crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY
crypto: cavium - Fix the if condition to exit loop after timeout
crypto: bcm - add error check in the ahash_hmac_init function
crypto: cavium - Fix an error handling path in cpt_ucode_load_fw()
time: Fix references to _msecs_to_jiffies() handling of values
soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get()
mmc: mmc_spi: drop buggy snprintf()
ARM: dts: cubieboard4: Fix DCDC5 regulator constraints
regmap: irq: Set lockdep class for hierarchical IRQ domains
firmware: arm_scpi: Check the DVFS OPP count returned by the firmware
drm/mm: Mark drm_mm_interval_tree*() functions with __maybe_unused
wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service()
drm/omap: Fix locking in omap_gem_new_dmabuf()
bpf: Fix the xdp_adjust_tail sample prog issue
wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan()
drm/etnaviv: consolidate hardware fence handling in etnaviv_gpu
drm/etnaviv: dump: fix sparse warnings
drm/etnaviv: fix power register offset on GC300
drm/etnaviv: hold GPU lock across perfmon sampling
net: rfkill: gpio: Add check for clk_enable()
ALSA: us122l: Use snd_card_free_when_closed() at disconnection
ALSA: caiaq: Use snd_card_free_when_closed() at disconnection
ALSA: 6fire: Release resources at card release
netpoll: Use rcu_access_pointer() in netpoll_poll_lock
trace/trace_event_perf: remove duplicate samples on the first tracepoint event
powerpc/vdso: Flag VDSO64 entry points as functions
mfd: da9052-spi: Change read-mask to write-mask
cpufreq: loongson2: Unregister platform_driver on failure
mtd: rawnand: atmel: Fix possible memory leak
RDMA/bnxt_re: Check cqe flags to know imm_data vs inv_irkey
mfd: rt5033: Fix missing regmap_del_irq_chip()
scsi: bfa: Fix use-after-free in bfad_im_module_exit()
scsi: fusion: Remove unused variable 'rc'
scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()
ocfs2: fix uninitialized value in ocfs2_file_read_iter()
powerpc/sstep: make emulate_vsx_load and emulate_vsx_store static
fbdev/sh7760fb: Alloc DMA memory from hardware device
fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem()
dt-bindings: clock: adi,axi-clkgen: convert old binding to yaml format
dt-bindings: clock: axi-clkgen: include AXI clk
clk: axi-clkgen: use devm_platform_ioremap_resource() short-hand
clk: clk-axi-clkgen: make sure to enable the AXI bus clock
perf probe: Correct demangled symbols in C++ program
PCI: cpqphp: Use PCI_POSSIBLE_ERROR() to check config reads
PCI: cpqphp: Fix PCIBIOS_* return value confusion
m68k: mcfgpio: Fix incorrect register offset for CONFIG_M5441x
m68k: coldfire/device.c: only build FEC when HW macros are defined
rpmsg: glink: Add TX_DATA_CONT command while sending
rpmsg: glink: Send READ_NOTIFY command in FIFO full case
rpmsg: glink: Fix GLINK command prefix
rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length
NFSD: Prevent NULL dereference in nfsd4_process_cb_update()
NFSD: Cap the number of bytes copied by nfs4_reset_recoverydir()
vfio/pci: Properly hide first-in-list PCIe extended capability
power: supply: core: Remove might_sleep() from power_supply_put()
net: usb: lan78xx: Fix memory leak on device unplug by freeing PHY device
tg3: Set coherent DMA mask bits to 31 for BCM57766 chipsets
net: usb: lan78xx: Fix refcounting and autosuspend on invalid WoL configuration
marvell: pxa168_eth: fix call balance of pep->clk handling routines
net: stmmac: dwmac-socfpga: Set RX watchdog interrupt as broken
usb: using mutex lock and supporting O_NONBLOCK flag in iowarrior_read()
USB: chaoskey: fail open after removal
USB: chaoskey: Fix possible deadlock chaoskey_list_lock
misc: apds990x: Fix missing pm_runtime_disable()
apparmor: fix 'Do simple duplicate message elimination'
usb: ehci-spear: fix call balance of sehci clk handling routines
ext4: supress data-race warnings in ext4_free_inodes_{count,set}()
ext4: fix FS_IOC_GETFSMAP handling
jfs: xattr: check invalid xattr size more strictly
ASoC: codecs: Fix atomicity violation in snd_soc_component_get_drvdata()
PCI: Fix use-after-free of slot->bus on hot remove
tty: ldsic: fix tty_ldisc_autoload sysctl's proc_handler
Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}()
ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices
Revert "usb: gadget: composite: fix OS descriptors w_value logic"
serial: sh-sci: Clean sci_ports[0] after at earlycon exit
Revert "serial: sh-sci: Clean sci_ports[0] after at earlycon exit"
netfilter: ipset: add missing range check in bitmap_ip_uadt
spi: Fix acpi deferred irq probe
ubi: wl: Put source PEB into correct list if trying locking LEB failed
um: ubd: Do not use drvdata in release
um: net: Do not use drvdata in release
serial: 8250: omap: Move pm_runtime_get_sync
um: vector: Do not use drvdata in release
sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
arm64: tls: Fix context-switching of tpidrro_el0 when kpti is enabled
block: fix ordering between checking BLK_MQ_S_STOPPED request adding
HID: wacom: Interpret tilt data from Intuos Pro BT as signed values
media: wl128x: Fix atomicity violation in fmc_send_cmd()
usb: dwc3: gadget: Fix checking for number of TRBs left
lib: string_helpers: silence snprintf() output truncation warning
NFSD: Prevent a potential integer overflow
rpmsg: glink: Propagate TX failures in intentless mode as well
um: Fix the return value of elf_core_copy_task_fpregs
NFSv4.0: Fix a use-after-free problem in the asynchronous open()
rtc: check if __rtc_read_time was successful in rtc_timer_do_work()
ubifs: Correct the total block count by deducting journal reservation
ubi: fastmap: Fix duplicate slab cache names while attaching
jffs2: fix use of uninitialized variable
block: return unsigned int from bdev_io_min
9p/xen: fix init sequence
9p/xen: fix release of IRQ
modpost: remove incorrect code in do_eisa_entry()
sh: intc: Fix use-after-free bug in register_intc_controller()
Linux 4.19.325
Change-Id: I50250c8bd11f9ff4b40da75225c1cfb060e0c258
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
|
|||
| 38c54efd11 |
Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}()
commit 5fe6caa62b07fd39cd6a28acc8f92ba2955e11a6 upstream.
Commit 9bf4e919ccad worked around an issue introduced after an innocuous
optimisation change in LLVM main:
> len is defined as an 'int' because it is assigned from
> '__user int *optlen'. However, it is clamped against the result of
> sizeof(), which has a type of 'size_t' ('unsigned long' for 64-bit
> platforms). This is done with min_t() because min() requires compatible
> types, which results in both len and the result of sizeof() being casted
> to 'unsigned int', meaning len changes signs and the result of sizeof()
> is truncated. From there, len is passed to copy_to_user(), which has a
> third parameter type of 'unsigned long', so it is widened and changes
> signs again. This excessive casting in combination with the KCSAN
> instrumentation causes LLVM to fail to eliminate the __bad_copy_from()
> call, failing the build.
The same issue occurs in rfcomm in functions rfcomm_sock_getsockopt and
rfcomm_sock_getsockopt_old.
Change the type of len to size_t in both rfcomm_sock_getsockopt and
rfcomm_sock_getsockopt_old and replace min_t() with min().
Cc: stable@vger.kernel.org
Co-authored-by: Aleksei Vetrov <vvvvvv@google.com>
Improves: 9bf4e919ccad ("Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old()")
Link: https://github.com/ClangBuiltLinux/linux/issues/2007
Link: https://github.com/llvm/llvm-project/issues/85647
Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|||
| 2d76dea417 |
Merge 4.19.323 into android-4.19-stable
Changes in 4.19.323 staging: iio: frequency: ad9833: Get frequency value statically staging: iio: frequency: ad9833: Load clock using clock framework staging: iio: frequency: ad9834: Validate frequency parameter value usbnet: ipheth: fix carrier detection in modes 1 and 4 net: ethernet: use ip_hdrlen() instead of bit shift net: phy: vitesse: repair vsc73xx autonegotiation scripts: kconfig: merge_config: config files: add a trailing newline arm64: dts: rockchip: override BIOS_DISABLE signal via GPIO hog on RK3399 Puma net/mlx5: Update the list of the PCI supported devices net: ftgmac100: Enable TX interrupt to avoid TX timeout net: dpaa: Pad packets to ETH_ZLEN soundwire: stream: Revert "soundwire: stream: fix programming slave ports for non-continous port maps" selftests/vm: remove call to ksft_set_plan() selftests/kcmp: remove call to ksft_set_plan() ASoC: allow module autoloading for table db1200_pids pinctrl: at91: make it work with current gpiolib microblaze: don't treat zero reserved memory regions as error net: ftgmac100: Ensure tx descriptor updates are visible wifi: iwlwifi: mvm: fix iwl_mvm_max_scan_ie_fw_cmd_room() wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead ASoC: tda7419: fix module autoloading spi: bcm63xx: Enable module autoloading x86/hyperv: Set X86_FEATURE_TSC_KNOWN_FREQ when Hyper-V provides frequency ocfs2: add bounds checking to ocfs2_xattr_find_entry() ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry() gpio: prevent potential speculation leaks in gpio_device_get_desc() USB: serial: pl2303: add device id for Macrosilicon MS3020 ACPI: PMIC: Remove unneeded check in tps68470_pmic_opregion_probe() wifi: ath9k: fix parameter check in ath9k_init_debug() wifi: ath9k: Remove error checks when creating debugfs entries netfilter: nf_tables: elements with timeout below CONFIG_HZ never expire wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan() wifi: cfg80211: fix two more possible UBSAN-detected off-by-one errors wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop() can: bcm: Clear bo->bcm_proc_read after remove_proc_entry(). Bluetooth: btusb: Fix not handling ZPL/short-transfer block, bfq: fix possible UAF for bfqq->bic with merge chain block, bfq: choose the last bfqq from merge chain in bfq_setup_cooperator() block, bfq: don't break merge chain in bfq_split_bfqq() spi: ppc4xx: handle irq_of_parse_and_map() errors spi: ppc4xx: Avoid returning 0 when failed to parse and map IRQ ARM: versatile: fix OF node leak in CPUs prepare reset: berlin: fix OF node leak in probe() error path clocksource/drivers/qcom: Add missing iounmap() on errors in msm_dt_timer_init() hwmon: (max16065) Fix overflows seen when writing limits mtd: slram: insert break after errors in parsing the map hwmon: (ntc_thermistor) fix module autoloading power: supply: max17042_battery: Fix SOC threshold calc w/ no current sense fbdev: hpfb: Fix an error handling path in hpfb_dio_probe() drm/stm: Fix an error handling path in stm_drm_platform_probe() drm/amd: fix typo drm/amdgpu: Replace one-element array with flexible-array member drm/amdgpu: properly handle vbios fake edid sizing drm/radeon: Replace one-element array with flexible-array member drm/radeon: properly handle vbios fake edid sizing drm/rockchip: vop: Allow 4096px width scaling drm/radeon/evergreen_cs: fix int overflow errors in cs track offsets jfs: fix out-of-bounds in dbNextAG() and diAlloc() drm/msm/a5xx: properly clear preemption records on resume drm/msm/a5xx: fix races in preemption evaluation stage ipmi: docs: don't advertise deprecated sysfs entries drm/msm: fix %s null argument error xen: use correct end address of kernel for conflict checking xen/swiotlb: simplify range_straddles_page_boundary() xen/swiotlb: add alignment check for dma buffers selftests/bpf: Fix error compiling test_lru_map.c xz: cleanup CRC32 edits from 2018 kthread: add kthread_work tracepoints kthread: fix task state in kthread worker if being frozen jbd2: introduce/export functions jbd2_journal_submit|finish_inode_data_buffers() ext4: clear EXT4_GROUP_INFO_WAS_TRIMMED_BIT even mount with discard smackfs: Use rcu_assign_pointer() to ensure safe assignment in smk_set_cipso ext4: avoid negative min_clusters in find_group_orlov() ext4: return error on ext4_find_inline_entry ext4: avoid OOB when system.data xattr changes underneath the filesystem nilfs2: fix potential null-ptr-deref in nilfs_btree_insert() nilfs2: determine empty node blocks as corrupted nilfs2: fix potential oob read in nilfs_btree_check_delete() perf sched timehist: Fix missing free of session in perf_sched__timehist() perf sched timehist: Fixed timestamp error when unable to confirm event sched_in time perf time-utils: Fix 32-bit nsec parsing clk: rockchip: Set parent rate for DCLK_VOP clock on RK3228 drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error PCI: xilinx-nwl: Fix register misspelling RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency pinctrl: single: fix missing error code in pcs_probe() clk: ti: dra7-atl: Fix leak of of_nodes pinctrl: mvebu: Fix devinit_dove_pinctrl_probe function RDMA/cxgb4: Added NULL check for lookup_atid ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir() nfsd: call cache_put if xdr_reserve_space returns NULL f2fs: enhance to update i_mode and acl atomically in f2fs_setattr() f2fs: fix typo f2fs: fix to update i_ctime in __f2fs_setxattr() f2fs: remove unneeded check condition in __f2fs_setxattr() f2fs: reduce expensive checkpoint trigger frequency coresight: tmc: sg: Do not leak sg_table netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition tcp: introduce tcp_skb_timestamp_us() helper tcp: check skb is non-NULL in tcp_rto_delta_us() net: qrtr: Update packets cloning when broadcasting netfilter: ctnetlink: compile ctnetlink_label_size with CONFIG_NF_CONNTRACK_EVENTS crypto: aead,cipher - zeroize key buffer after use Remove *.orig pattern from .gitignore soc: versatile: integrator: fix OF node leak in probe() error path USB: appledisplay: close race between probe and completion handler USB: misc: cypress_cy7c63: check for short transfer firmware_loader: Block path traversal tty: rp2: Fix reset with non forgiving PCIe host bridges drbd: Fix atomicity violation in drbd_uuid_set_bm() drbd: Add NULL check for net_conf to prevent dereference in state validation ACPI: sysfs: validate return type of _STR method f2fs: prevent possible int overflow in dir_block_index() f2fs: avoid potential int overflow in sanity_check_area_boundary() vfs: fix race between evice_inodes() and find_inode()&iput() fs: Fix file_set_fowner LSM hook inconsistencies nfs: fix memory leak in error path of nfs4_do_reclaim PCI: xilinx-nwl: Use irq_data_get_irq_chip_data() PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler soc: versatile: realview: fix memory leak during device remove soc: versatile: realview: fix soc_dev leak during device remove usb: yurex: Replace snprintf() with the safer scnprintf() variant USB: misc: yurex: fix race between read and write pps: remove usage of the deprecated ida_simple_xx() API pps: add an error check in parport_attach i2c: aspeed: Update the stop sw state when the bus recovery occurs i2c: isch: Add missed 'else' usb: yurex: Fix inconsistent locking bug in yurex_read() mailbox: rockchip: fix a typo in module autoloading mailbox: bcm2835: Fix timeout during suspend mode ceph: remove the incorrect Fw reference check when dirtying pages netfilter: uapi: NFTA_FLOWTABLE_HOOK is NLA_NESTED netfilter: nf_tables: prevent nf_skb_duplicated corruption r8152: Factor out OOB link list waits net: ethernet: lantiq_etop: fix memory disclosure net: avoid potential underflow in qdisc_pkt_len_init() with UFO net: add more sanity checks to qdisc_pkt_len_init() ipv4: ip_gre: Fix drops of small packets in ipgre_xmit sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start ALSA: hda/generic: Unconditionally prefer preferred_dacs pairs ALSA: hda/conexant: Fix conflicting quirk for System76 Pangolin f2fs: Require FMODE_WRITE for atomic write ioctls wifi: ath9k: fix possible integer overflow in ath9k_get_et_stats() wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit net: hisilicon: hip04: fix OF node leak in probe() net: hisilicon: hns_dsaf_mac: fix OF node leak in hns_mac_get_info() net: hisilicon: hns_mdio: fix OF node leak in probe() ACPICA: Fix memory leak if acpi_ps_get_next_namepath() fails ACPICA: Fix memory leak if acpi_ps_get_next_field() fails ACPI: EC: Do not release locks during operation region accesses ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package() tipc: guard against string buffer overrun net: mvpp2: Increase size of queue_name buffer ipv4: Check !in_dev earlier for ioctl(SIOCSIFADDR). ipv4: Mask upper DSCP bits and ECN bits in NETLINK_FIB_LOOKUP family tcp: avoid reusing FIN_WAIT2 when trying to find port in connect() process ACPICA: iasl: handle empty connection_node wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext() signal: Replace BUG_ON()s ALSA: asihpi: Fix potential OOB array access ALSA: hdsp: Break infinite MIDI input flush loop fbdev: pxafb: Fix possible use after free in pxafb_task() power: reset: brcmstb: Do not go into infinite loop if reset fails ata: sata_sil: Rename sil_blacklist to sil_quirks jfs: UBSAN: shift-out-of-bounds in dbFindBits jfs: Fix uaf in dbFreeBits jfs: check if leafidx greater than num leaves per dmap tree jfs: Fix uninit-value access of new_ea in ea_buffer drm/amd/display: Check stream before comparing them drm/amd/display: Fix index out of bounds in degamma hardware format translation drm/printer: Allow NULL data in devcoredump printer scsi: aacraid: Rearrange order of struct aac_srb_unit drm/radeon/r100: Handle unknown family in r100_cp_init_microcode() of/irq: Refer to actual buffer size in of_irq_parse_one() ext4: ext4_search_dir should return a proper error ext4: fix i_data_sem unlock order in ext4_ind_migrate() spi: s3c64xx: fix timeout counters in flush_fifo selftests: breakpoints: use remaining time to check if suspend succeed selftests: vDSO: fix vDSO symbols lookup for powerpc64 i2c: xiic: Wait for TX empty to avoid missed TX NAKs spi: bcm63xx: Fix module autoloading perf/core: Fix small negative period being ignored parisc: Fix itlb miss handler for 64-bit programs ALSA: core: add isascii() check to card ID generator ext4: no need to continue when the number of entries is 1 ext4: propagate errors from ext4_find_extent() in ext4_insert_range() ext4: fix incorrect tid assumption in __jbd2_log_wait_for_space() ext4: aovid use-after-free in ext4_ext_insert_extent() ext4: fix double brelse() the buffer of the extents path ext4: fix incorrect tid assumption in ext4_wait_for_tail_page_commit() parisc: Fix 64-bit userspace syscall path of/irq: Support #msi-cells=<0> in of_msi_get_domain jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error ocfs2: fix the la space leak when unmounting an ocfs2 volume ocfs2: fix uninit-value in ocfs2_get_block() ocfs2: reserve space for inline xattr before attaching reflink tree ocfs2: cancel dqi_sync_work before freeing oinfo ocfs2: remove unreasonable unlock in ocfs2_read_blocks ocfs2: fix null-ptr-deref when journal load failed. ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate riscv: define ILLEGAL_POINTER_VALUE for 64bit aoe: fix the potential use-after-free problem in more places clk: rockchip: fix error for unknown clocks media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags media: venus: fix use after free bug in venus_remove due to race condition iio: magnetometer: ak8975: Fix reading for ak099xx sensors tomoyo: fallback to realpath if symlink's pathname does not exist Input: adp5589-keys - fix adp5589_gpio_get_value() btrfs: wait for fixup workers before stopping cleaner kthread during umount gpio: davinci: fix lazy disable ext4: avoid ext4_error()'s caused by ENOMEM in the truncate path ext4: fix slab-use-after-free in ext4_split_extent_at() ext4: update orig_path in ext4_find_extent() arm64: Add Cortex-715 CPU part definition arm64: cputype: Add Neoverse-N3 definitions arm64: errata: Expand speculative SSBS workaround once more uprobes: fix kernel info leak via "[uprobes]" vma nfsd: use ktime_get_seconds() for timestamps nfsd: fix delegation_blocked() to block correctly for at least 30 seconds rtc: at91sam9: drop platform_data support rtc: at91sam9: fix OF node leak in probe() error path ACPI: battery: Simplify battery hook locking ACPI: battery: Fix possible crash when unregistering a battery hook ext4: fix inode tree inconsistency caused by ENOMEM net: ethernet: cortina: Drop TSO support tracing: Remove precision vsnprintf() check from print event drm: Move drm_mode_setcrtc() local re-init to failure path drm/crtc: fix uninitialized variable use even harder virtio_console: fix misc probe bugs Input: synaptics-rmi4 - fix UAF of IRQ domain on driver removal bpf: Check percpu map value size first s390/facility: Disable compile time optimization for decompressor code s390/mm: Add cond_resched() to cmm_alloc/free_pages() ext4: nested locking for xattr inode s390/cpum_sf: Remove WARN_ON_ONCE statements ktest.pl: Avoid false positives with grub2 skip regex clk: bcm: bcm53573: fix OF node leak in init i2c: i801: Use a different adapter-name for IDF adapters PCI: Mark Creative Labs EMU20k2 INTx masking as broken media: videobuf2-core: clear memory related fields in __vb2_plane_dmabuf_put() usb: chipidea: udc: enable suspend interrupt after usb reset tools/iio: Add memory allocation failure check for trigger_name driver core: bus: Return -EIO instead of 0 when show/store invalid bus attribute fbdev: sisfb: Fix strbuf array overflow NFS: Remove print_overflow_msg() SUNRPC: Fix integer overflow in decode_rc_list() tcp: fix tcp_enter_recovery() to zero retrans_stamp when it's safe netfilter: br_netfilter: fix panic with metadata_dst skb Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change gpio: aspeed: Add the flush write to ensure the write complete. clk: Add (devm_)clk_get_optional() functions clk: generalize devm_clk_get() a bit clk: Provide new devm_clk helpers for prepared and enabled clocks gpio: aspeed: Use devm_clk api to manage clock source igb: Do not bring the device up after non-fatal error net: ibm: emac: mal: fix wrong goto ppp: fix ppp_async_encode() illegal access net: ipv6: ensure we call ipv6_mc_down() at most once CDC-NCM: avoid overflow in sanity checking HID: plantronics: Workaround for an unexcepted opposite volume key Revert "usb: yurex: Replace snprintf() with the safer scnprintf() variant" usb: xhci: Fix problem with xhci resume from suspend usb: storage: ignore bogus device raised by JieLi BR21 USB sound chip net: Fix an unsafe loop on the list posix-clock: Fix missing timespec64 check in pc_clock_settime() arm64: probes: Remove broken LDR (literal) uprobe support arm64: probes: Fix simulate_ldr*_literal() PCI: Add function 0 DMA alias quirk for Glenfly Arise chip fat: fix uninitialized variable KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() net: dsa: mv88e6xxx: Fix out-of-bound access s390/sclp_vt220: Convert newlines to CRLF instead of LFCR KVM: s390: Change virtual to physical address access in diag 0x258 handler x86/cpufeatures: Define X86_FEATURE_AMD_IBPB_RET drm/vmwgfx: Handle surface check failure correctly iio: dac: stm32-dac-core: add missing select REGMAP_MMIO in Kconfig iio: adc: ti-ads8688: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig iio: hid-sensors: Fix an error handling path in _hid_sensor_set_report_latency() iio: light: opt3001: add missing full-scale range value Bluetooth: Remove debugfs directory on module init failure Bluetooth: btusb: Fix regression with fake CSR controllers 0a12:0001 xhci: Fix incorrect stream context type macro USB: serial: option: add support for Quectel EG916Q-GL USB: serial: option: add Telit FN920C04 MBIM compositions parport: Proper fix for array out-of-bounds access x86/apic: Always explicitly disarm TSC-deadline timer nilfs2: propagate directory read errors from nilfs_find_entry() clk: Fix pointer casting to prevent oops in devm_clk_release() clk: Fix slab-out-of-bounds error in devm_clk_release() RDMA/bnxt_re: Fix incorrect AVID type in WQE structure RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP RDMA/bnxt_re: Return more meaningful error drm/msm/dsi: fix 32-bit signed integer extension in pclk_rate calculation macsec: don't increment counters for an unrelated SA net: ethernet: aeroflex: fix potential memory leak in greth_start_xmit_gbit() net: systemport: fix potential memory leak in bcm_sysport_xmit() usb: typec: altmode should keep reference to parent Bluetooth: bnep: fix wild-memory-access in proto_unregister arm64:uprobe fix the uprobe SWBP_INSN in big-endian arm64: probes: Fix uprobes for big-endian kernels KVM: s390: gaccess: Refactor gpa and length calculation KVM: s390: gaccess: Refactor access address range check KVM: s390: gaccess: Cleanup access to guest pages KVM: s390: gaccess: Check if guest address is in memslot udf: fix uninit-value use in udf_get_fileshortad jfs: Fix sanity check in dbMount net/sun3_82586: fix potential memory leak in sun3_82586_send_packet() be2net: fix potential memory leak in be_xmit() net: usb: usbnet: fix name regression posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime() ALSA: hda/realtek: Update default depop procedure drm/amd: Guard against bad data for ATIF ACPI method ACPI: button: Add DMI quirk for Samsung Galaxy Book2 to fix initial lid detection issue nilfs2: fix kernel bug due to missing clearing of buffer delay flag hv_netvsc: Fix VF namespace also in synthetic NIC NETDEV_REGISTER event selinux: improve error checking in sel_write_load() arm64/uprobes: change the uprobe_opcode_t typedef to fix the sparse warning xfrm: validate new SA's prefixlen using SA family when sel.family is unset usb: dwc3: remove generic PHY calibrate() calls usb: dwc3: Add splitdisable quirk for Hisilicon Kirin Soc usb: dwc3: core: Stop processing of pending events if controller is halted cgroup: Fix potential overflow issue when checking max_depth wifi: mac80211: skip non-uploaded keys in ieee80211_iter_keys gtp: simplify error handling code in 'gtp_encap_enable()' gtp: allow -1 to be specified as file description from userspace net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT bpf: Fix out-of-bounds write in trie_get_next_key() net: support ip generic csum processing in skb_csum_hwoffload_help net: skip offload for NETIF_F_IPV6_CSUM if ipv6 header contains extension netfilter: nft_payload: sanitize offset and length before calling skb_checksum() firmware: arm_sdei: Fix the input parameter of cpuhp_remove_state() net: amd: mvme147: Fix probe banner message misc: sgi-gru: Don't disable preemption in GRU driver usbip: tools: Fix detach_port() invalid port error path usb: phy: Fix API devm_usb_put_phy() can not release the phy xhci: Fix Link TRB DMA in command ring stopped completion event Revert "driver core: Fix uevent_show() vs driver detach race" wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower wifi: ath10k: Fix memory leak in management tx wifi: iwlegacy: Clear stale interrupts before resuming device nilfs2: fix potential deadlock with newly created symlinks ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow nilfs2: fix kernel bug due to missing clearing of checked flag mm: shmem: fix data-race in shmem_getattr() vt: prevent kernel-infoleak in con_font_get() Linux 4.19.323 Change-Id: I2348f834187153067ab46b3b48b8fe7da9cee1f1 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
|||
| e232728242 |
Bluetooth: bnep: fix wild-memory-access in proto_unregister
[ Upstream commit 64a90991ba8d4e32e3173ddd83d0b24167a5668c ]
There's issue as follows:
KASAN: maybe wild-memory-access in range [0xdead...108-0xdead...10f]
CPU: 3 UID: 0 PID: 2805 Comm: rmmod Tainted: G W
RIP: 0010:proto_unregister+0xee/0x400
Call Trace:
<TASK>
__do_sys_delete_module+0x318/0x580
do_syscall_64+0xc1/0x1d0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
As bnep_init() ignore bnep_sock_init()'s return value, and bnep_sock_init()
will cleanup all resource. Then when remove bnep module will call
bnep_sock_cleanup() to cleanup sock's resource.
To solve above issue just return bnep_sock_init()'s return value in
bnep_exit().
Fixes:
|
|||
| 9010d2cace |
Bluetooth: Remove debugfs directory on module init failure
commit 1db4564f101b47188c1b71696bd342ef09172b22 upstream.
If bt_init() fails, the debugfs directory currently is not removed. If
the module is loaded again after that, the debugfs directory is not set
up properly due to the existing directory.
# modprobe bluetooth
# ls -laF /sys/kernel/debug/bluetooth
total 0
drwxr-xr-x 2 root root 0 Sep 27 14:26 ./
drwx------ 31 root root 0 Sep 27 14:25 ../
-r--r--r-- 1 root root 0 Sep 27 14:26 l2cap
-r--r--r-- 1 root root 0 Sep 27 14:26 sco
# modprobe -r bluetooth
# ls -laF /sys/kernel/debug/bluetooth
ls: cannot access '/sys/kernel/debug/bluetooth': No such file or directory
#
# modprobe bluetooth
modprobe: ERROR: could not insert 'bluetooth': Invalid argument
# dmesg | tail -n 6
Bluetooth: Core ver 2.22
NET: Registered PF_BLUETOOTH protocol family
Bluetooth: HCI device and connection manager initialized
Bluetooth: HCI socket layer initialized
Bluetooth: Faking l2cap_init() failure for testing
NET: Unregistered PF_BLUETOOTH protocol family
# ls -laF /sys/kernel/debug/bluetooth
total 0
drwxr-xr-x 2 root root 0 Sep 27 14:31 ./
drwx------ 31 root root 0 Sep 27 14:26 ../
#
# modprobe bluetooth
# dmesg | tail -n 7
Bluetooth: Core ver 2.22
debugfs: Directory 'bluetooth' with parent '/' already present!
NET: Registered PF_BLUETOOTH protocol family
Bluetooth: HCI device and connection manager initialized
Bluetooth: HCI socket layer initialized
Bluetooth: L2CAP socket layer initialized
Bluetooth: SCO socket layer initialized
# ls -laF /sys/kernel/debug/bluetooth
total 0
drwxr-xr-x 2 root root 0 Sep 27 14:31 ./
drwx------ 31 root root 0 Sep 27 14:26 ../
#
Cc: stable@vger.kernel.org
Fixes:
|
|||
| b77b3fb12f |
Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
[ Upstream commit 08d1914293dae38350b8088980e59fbc699a72fe ]
rfcomm_sk_state_change attempts to use sock_lock so it must never be
called with it locked but rfcomm_sock_ioctl always attempt to lock it
causing the following trace:
======================================================
WARNING: possible circular locking dependency detected
6.8.0-syzkaller-08951-gfe46a7dd189e #0 Not tainted
------------------------------------------------------
syz-executor386/5093 is trying to acquire lock:
ffff88807c396258 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1671 [inline]
ffff88807c396258 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: rfcomm_sk_state_change+0x5b/0x310 net/bluetooth/rfcomm/sock.c:73
but task is already holding lock:
ffff88807badfd28 (&d->lock){+.+.}-{3:3}, at: __rfcomm_dlc_close+0x226/0x6a0 net/bluetooth/rfcomm/core.c:491
Reported-by: syzbot+d7ce59b06b3eb14fd218@syzkaller.appspotmail.com
Tested-by: syzbot+d7ce59b06b3eb14fd218@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d7ce59b06b3eb14fd218
Fixes:
|
|||
| d757552385 |
Merge 4.19.321 into android-4.19-stable
Changes in 4.19.321 fuse: Initialize beyond-EOF page contents before setting uptodate ALSA: usb-audio: Support Yamaha P-125 quirk entry xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to NUMA_NO_NODE dm resume: don't return EINVAL when signalled dm persistent data: fix memory allocation failure bitmap: introduce generic optimized bitmap_size() fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE selinux: fix potential counting error in avc_add_xperms_decision() drm/amdgpu: Actually check flags for all context ops. memcg_write_event_control(): fix a user-triggerable oops s390/cio: rename bitmap_size() -> idset_bitmap_size() overflow.h: Add flex_array_size() helper overflow: Implement size_t saturating arithmetic helpers btrfs: rename bitmap_set_bits() -> btrfs_bitmap_set_bits() net/mlx5e: Correctly report errors for ethtool rx flows atm: idt77252: prevent use after free in dequeue_rx() net: dsa: vsc73xx: pass value in phy_write operation ssb: Fix division by zero issue in ssb_calc_clock_rate wifi: cw1200: Avoid processing an invalid TIM IE i2c: riic: avoid potential division by zero staging: ks7010: disable bh on tx_dev_lock binfmt_misc: cleanup on filesystem umount scsi: spi: Fix sshdr use gfs2: setattr_chown: Add missing initialization wifi: iwlwifi: abort scan when rfkill on but device enabled powerpc/xics: Check return value of kasprintf in icp_native_map_one_cpu ext4: do not trim the group with corrupted block bitmap quota: Remove BUG_ON from dqget() media: pci: cx23885: check cx23885_vdev_init() return fs: binfmt_elf_efpic: don't use missing interpreter's properties scsi: lpfc: Initialize status local variable in lpfc_sli4_repost_sgl_list() net/sun3_82586: Avoid reading past buffer in debug output md: clean up invalid BUG_ON in md_ioctl parisc: Use irq_enter_rcu() to fix warning at kernel/context_tracking.c:367 powerpc/boot: Handle allocation failure in simple_realloc() powerpc/boot: Only free if realloc() succeeds btrfs: change BUG_ON to assertion when checking for delayed_node root btrfs: handle invalid root reference found in may_destroy_subvol() btrfs: send: handle unexpected data in header buffer in begin_cmd() btrfs: delete pointless BUG_ON check on quota root in btrfs_qgroup_account_extent() f2fs: fix to do sanity check in update_sit_entry usb: gadget: fsl: Increase size of name buffer for endpoints Bluetooth: bnep: Fix out-of-bound access NFS: avoid infinite loop in pnfs_update_layout. openrisc: Call setup_memory() earlier in the init sequence s390/iucv: fix receive buffer virtual vs physical address confusion usb: dwc3: core: Skip setting event buffers for host only controllers irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc ext4: set the type of max_zeroout to unsigned int to avoid overflow nvmet-rdma: fix possible bad dereference when freeing rsps hrtimer: Prevent queuing of hrtimer without a function callback gtp: pull network headers in gtp_dev_xmit() block: use "unsigned long" for blk_validate_block_size(). Bluetooth: Make use of __check_timeout on hci_sched_le Bluetooth: hci_core: Fix not handling link timeouts propertly Bluetooth: hci_core: Fix LE quote calculation kcm: Serialise kcm_sendmsg() for the same socket. netfilter: nft_counter: Synchronize nft_counter_reset() against reader. ipv6: prevent UAF in ip6_send_skb() net: xilinx: axienet: Always disable promiscuous mode drm/msm: use drm_debug_enabled() to check for debug categories drm/msm/dpu: don't play tricks with debug macros mmc: mmc_test: Fix NULL dereference on allocation failure Bluetooth: MGMT: Add error handling to pair_device() HID: wacom: Defer calculation of resolution until resolution_code is known cxgb4: add forgotten u64 ivlan cast before shift mmc: dw_mmc: allow biu and ciu clocks to defer ALSA: timer: Relax start tick time check for slave timer elements Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO Input: MT - limit max slots tools: move alignment-related macros to new <linux/align.h> drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc pinctrl: single: fix potential NULL dereference in pcs_get_function() wifi: mwifiex: duplicate static structs used in driver instances dm suspend: return -ERESTARTSYS instead of -EINTR scsi: mpt3sas: Avoid IOMMU page faults on REPORT ZONES filelock: Correct the filelock owner in fcntl_setlk/fcntl_setlk64 media: uvcvideo: Fix integer overflow calculating timestamp ata: libata-core: Fix null pointer dereference on error cgroup/cpuset: Prevent UAF in proc_cpuset_show() memcg: enable accounting of ipc resources fbcon: Prevent that screen size is smaller than font size fbmem: Check virtual screen sizes in fb_set_var() net:rds: Fix possible deadlock in rds_message_put ida: Fix crash in ida_free when the bitmap is empty net: prevent mss overflow in skb_segment() soundwire: stream: fix programming slave ports for non-continous port maps gtp: fix a potential NULL pointer dereference net: busy-poll: use ktime_get_ns() instead of local_clock() cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller USB: serial: option: add MeiG Smart SRM825L usb: dwc3: omap: add missing depopulate in probe error path usb: dwc3: core: Prevent USB core invalid event buffer address access usb: dwc3: st: fix probed platform device ref count on probe error path usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes() scsi: aacraid: Fix double-free on probe failure ipc: remove memcg accounting for sops objects in do_semtimedop() drm/fb-helper: set x/yres_virtual in drm_fb_helper_check_var Linux 4.19.321 Change-Id: I5ee663c7c3343a99e3c73dd8f663ca5c4e298478 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
|||
| 11b4b0e63f |
Bluetooth: MGMT: Add error handling to pair_device()
commit 538fd3921afac97158d4177139a0ad39f056dbb2 upstream.
hci_conn_params_add() never checks for a NULL value and could lead to a NULL
pointer dereference causing a crash.
Fixed by adding error handling in the function.
Cc: Stable <stable@kernel.org>
Fixes:
|
|||
| 08829a8ff1 |
Bluetooth: hci_core: Fix LE quote calculation
[ Upstream commit 932021a11805b9da4bd6abf66fe233cccd59fe0e ]
Function hci_sched_le needs to update the respective counter variable
inplace other the likes of hci_quote_sent would attempt to use the
possible outdated value of conn->{le_cnt,acl_cnt}.
Link: https://github.com/bluez/bluez/issues/915
Fixes:
|
|||
| edb7dbcf8c |
Bluetooth: hci_core: Fix not handling link timeouts propertly
[ Upstream commit 116523c8fac05d1d26f748fee7919a4ec5df67ea ]
Change that introduced the use of __check_timeout did not account for
link types properly, it always assumes ACL_LINK is used thus causing
hdev->acl_last_tx to be used even in case of LE_LINK and then again
uses ACL_LINK with hci_link_tx_to.
To fix this __check_timeout now takes the link type as parameter and
then procedure to use the right last_tx based on the link type and pass
it to hci_link_tx_to.
Fixes: 1b1d29e51499 ("Bluetooth: Make use of __check_timeout on hci_sched_le")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Tested-by: David Beinder <david@beinder.at>
Stable-dep-of: 932021a11805 ("Bluetooth: hci_core: Fix LE quote calculation")
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
