Commit Graph

215 Commits

Author SHA1 Message Date
23ea704e18 Merge tag 'v4.19.325-cip132' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip into android13-4.19-kona
version 4.19.325-cip132

* tag 'v4.19.325-cip132' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip:
  CIP: Bump version suffix to -cip132 after merge from cip/linux-4.19.y-st tree
  Update localversion-st, tree is up-to-date with 5.10.254.
  x86/CPU: Fix FPDSS on Zen1
  seg6: separate dst_cache for input and output paths in seg6 lwtunnel
  netfilter: nft_ct: fix use-after-free in timeout object destroy
  apparmor: fix differential encoding verification
  apparmor: fix missing bounds check on DEFAULT table in verify_dfa()
  ext4: convert inline data to extents when truncate exceeds inline size
  virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
  ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()
  crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
  crypto: authencesn - Fix src offset when decrypting in-place
  crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption
  crypto: authenc - use memcpy_sglist() instead of null skcipher
  crypto: algif_aead - snapshot IV for async AEAD requests
  crypto: algif_aead - Revert to operating out-of-place
  crypto: algif_aead - use memcpy_sglist() instead of null skcipher
  crypto: doc - fix kernel-doc notation in chacha.c and af_alg.c
  Buffer overflow in drivers/xen/sys-hypervisor.c
  xen/privcmd: fix double free via VMA splitting
  crypto: algif_aead - Fix minimum RX size check for decryption
  crypto: scatterwalk - Backport memcpy_sglist()
  batman-adv: avoid OGM aggregation when skb tailroom is insufficient
  device property: Check fwnode->secondary when finding properties
  device property: Check fwnode->secondary in fwnode_graph_get_next_endpoint()
  device property: Retrieve fwnode from of_node via accessor
  media: device property: Return true in fwnode_device_is_available for NULL ops
  ext4: fix the might_sleep() warnings in kvfree()
  mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
  usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop
  usb: gadget: f_hid: move list and spinlock inits from bind to alloc
  net: rfkill: prevent unlimited numbers of rfkill events from being created
  cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path
  cpufreq: governor: Free dbs_data directly when gov->init() fails
  xen/privcmd: unregister xenstore notifier on module exit
  rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING)
  net: stmmac: fix integer underflow in chain mode
  net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure
  mmc: vub300: fix NULL-deref on disconnect
  net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit()
  batman-adv: reject oversized global TT response buffers
  arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges
  arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity
  wifi: brcmsmac: Fix dma_free_coherent() size
  tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
  apparmor: fix unprivileged local user can do privileged policy management
  apparmor: Fix double free of ns_name in aa_replace_profiles()
  apparmor: fix side-effect bug in match_char() macro usage
  apparmor: fix: limit the number of levels of policy namespaces
  apparmor: replace recursive profile removal with iterative approach
  apparmor: fix memory leak in verify_header
  apparmor: validate DFA start states are in bounds in unpack_pdb
  mm/rmap: fix two comments related to huge_pmd_unshare()
  mm/hugetlb: fix two comments related to huge_pmd_unshare()
  mm/hugetlb: make detecting shared pte more reliable
  Input: uinput - take event lock when submitting FF request "event"
  Input: uinput - fix circular locking dependency with ff-core
  xfrm_user: fix info leak in build_report()
  wifi: rt2x00usb: fix devres lifetime
  usb: gadget: f_uac1_legacy: validate control request size
  usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer
  USB: dummy-hcd: Fix locking/synchronization error
  vxlan: validate ND option lengths in vxlan_na_create
  comedi: me4000: Fix potential overrun of firmware buffer
  comedi: me_daq: Fix potential overrun of firmware buffer
  comedi: ni_atmio16d: Fix invalid clean-up after failed attach
  comedi: Reinit dev->spinlock between attachments to low-level drivers
  comedi: dt2815: add hardware detection to prevent crash
  bridge: br_nd_send: validate ND option lengths
  usb: ulpi: fix double free in ulpi_register_interface() error path
  usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive
  iio: gyro: mpu3050: Fix out-of-sequence free_irq()
  iio: gyro: mpu3050: Move iio_device_register() to correct location
  iio: gyro: mpu3050: Fix irq resource leak
  iio: gyro: mpu3050: Fix incorrect free_irq() variable
  Input: xpad - add support for Razer Wolverine V3 Pro
  USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam
  USB: serial: option: add support for Rolling Wireless RW135R-GL
  USB: serial: io_edgeport: add support for Blackbox IC135A
  drm/ast: dp501: Fix initialization of SCU2C
  MIPS: Fix the GCC version check for `__multi3' workaround
  Bluetooth: SMP: force responder MITM requirements before building the pairing response
  Bluetooth: SMP: derive legacy responder STK authentication from MITM state
  ALSA: ctxfi: Fix missing SPDIFI1 index handling
  ALSA: caiaq: fix stack out-of-bounds read in init_card
  USB: serial: option: add MeiG Smart SRM825WN
  drm/ioc32: stop speculation on the drm_compat_ioctl path
  media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar
  Revert "media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar"
  drm/vmwgfx: Add seqno waiter for sync_files
  Revert "drm/vmwgfx: Add seqno waiter for sync_files"
  ipv6: avoid overflows in ip6_datagram_send_ctl()
  net/sched: cls_flow: fix NULL pointer dereference on shared blocks
  net/sched: cls_fw: fix NULL pointer dereference on shared blocks
  net/x25: Fix overflow when accumulating packets
  net/x25: Fix potential double free of skb
  net: macb: properly unregister fixed rate clocks
  net: macb: fix clk handling on PCI glue driver removal
  Bluetooth: MGMT: validate LTK enc_size on load
  netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP
  netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent
  netfilter: nf_conntrack_helper: pass helper to expect cleanup
  netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr
  netfilter: x_tables: ensure names are nul-terminated
  netfilter: nfnetlink_log: account for netlink header size
  net: ipv6: flowlabel: defer exclusive option free until RCU teardown
  bpf: Fix regsafe() for pointers to packet
  net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec
  ipv6: prevent possible UaF in addrconf_permanent_addr()
  net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()
  bridge: br_nd_send: linearize skb before parsing ND options
  ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
  ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
  tg3: Fix race for querying speed/duplex
  net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak
  crypto: af-alg - fix NULL pointer dereference in scatterwalk
  HID: multitouch: Check to ensure report responses match the request
  atm: lec: fix use-after-free in sock_def_readable()
  HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
  dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA
  dmaengine: xilinx_dma: Program interrupt delay timeout
  btrfs: fix lost error when running device stats on multiple devices fs
  btrfs: fix super block offset in error message in btrfs_validate_super()
  dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA
  dmaengine: xilinx: xilinx_dma: Fix dma_device directions
  ext4: reject mount if bigalloc with s_first_data_block != 0
  ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()
  ext4: make recently_deleted() properly work with lazy itable initialization
  scsi: ses: Handle positive SCSI error from ses_recv_diag()
  scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()
  alarmtimer: Fix argument order in alarm_timer_forward()
  cpufreq: conservative: Reset requested_freq on limits change
  s390/barrier: Make array_index_mask_nospec() __always_inline
  sysctl: fix uninitialized variable in proc_do_large_bitmap
  ACPICA: Allow address_space_handler Install and _REG execution as 2 separate steps
  ACPICA: include/acpi/acpixf.h: Fix indentation
  drm/i915/gmbus: fix spurious timeout on 512-byte burst reads
  scsi: scsi_transport_sas: Fix the maximum channel scanning issue
  RDMA/rw: Fall back to direct SGE on MR pool exhaustion
  net: macb: use the current queue number for stats
  netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp
  netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
  netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD
  Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop
  net: fix fanout UAF in packet_release() via NETDEV_UP race
  rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size
  openvswitch: validate MPLS set/set_masked payload length
  net: openvswitch: Avoid releasing netdev before teardown completes
  pinctrl: mediatek: common: Fix probe failure for devices without EINT
  Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
  Bluetooth: hci_ll: Fix firmware leak on error path
  Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()
  af_key: validate families in pfkey_send_migrate()
  xfrm: call xdo_dev_state_delete during state update
  dma-buf: Include ioctl.h in UAPI header
  xen/privcmd: restrict usage in unprivileged domU
  i2c: fsi: Fix a potential leak in fsi_i2c_probe()
  icmp: fix NULL pointer dereference in icmp_tag_validation()
  nfnetlink_osf: validate individual option lengths in fingerprints
  net: bonding: fix NULL deref in bond_debug_rlb_hash_show
  udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n
  net: macb: fix uninitialized rx_fs_lock
  wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom
  wifi: mac80211: fix NULL deref in mesh_matches_local()
  PM: runtime: Fix a race condition related to device removal
  net: bcmgenet: increase WoL poll timeout
  netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
  netfilter: xt_time: use unsigned int for monthday bit shift
  netfilter: xt_CT: drop pending enqueued packets on template removal
  netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case
  netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()
  netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()
  netfilter: ctnetlink: remove refcounting in expectation dumpers
  net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect
  Bluetooth: HIDP: Fix possible UAF
  Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy
  Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU
  Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU
  staging: rtl8723bs: fix null dereference in find_network
  net/tcp-md5: Fix MAC comparison to be constant-time
  ALSA: pcm: fix wait_time calculations
  can: gs_usb: gs_can_open(): always configure bitrates before starting device
  usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling
  nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
  arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation
  smb: client: fix iface port assignment in parse_server_interfaces
  iio: light: bh1780: fix PM runtime leak on error path
  tracing: Fix syscall events activation by ensuring refcount hits zero
  s390/xor: Fix xor_xc_2() inline assembly constraints
  drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink
  smb: client: Don't log plaintext credentials in cifs_set_cifscreds
  wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()
  wifi: libertas: fix use-after-free in lbs_free_adapter()
  ext4: fix dirtyclusters double decrement on fs shutdown
  ext4: drop extent cache when splitting extent fails
  drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl()
  net: Handle napi_schedule() calls from non-interrupt
  drm/radeon: apply state adjust rules to some additional HAINAN vairants
  serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY
  Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access
  net: macb: fix use-after-free access to PTP clock
  nvdimm/bus: Fix potential use after free in asynchronous initialization
  iio: chemical: bme680: Fix measurement wait duration calculation
  iio: potentiometer: mcp4131: fix double application of wiper shift
  iio: dac: ds4424: reject -128 RAW value
  btrfs: abort transaction on failure to update root in the received subvol ioctl
  x86/apic: Disable x2apic on resume if the kernel expects so
  drm/amdgpu: Fix use-after-free race in VM acquire
  net: ethernet: arc: emac: quiesce interrupts before requesting IRQ
  net: ncsi: fix skb leak in error paths
  parisc: Fix initial page table creation for boot
  nouveau/dpcd: return EBUSY for aux xfer if the device is asleep
  parisc: Increase initial mapping to 64 MB with KALLSYMS
  batman-adv: Avoid double-rtnl_lock ELP metric worker
  media: dvb-net: fix OOB access in ULE extension header tables
  staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie
  libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()
  mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index()
  usb: image: mdc800: kill download URB on timeout
  usb: mdc800: handle signal and read racing
  usb: class: cdc-wdm: fix reordering issue in read code path
  USB: usbcore: Introduce usb_bulk_msg_killable()
  usb: misc: uss720: properly clean up reference in uss720_probe()
  usb: yurex: fix race in probe
  usb: xhci: Fix memory leak in xhci_disable_slot()
  usb/core/quirks: Add Huawei ME906S-device to wakeup quirk
  net: usb: lan78xx: skip LTM configuration for LAN7850
  net: usb: lan78xx: fix silent drop of packets with checksum errors
  cgroup: fix race between task migration and iteration
  e1000/e1000e: Fix leak in DMA error cleanup
  i40e: fix src IP mask checks and memcpy argument names in cloud filter
  nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set
  sched: idle: Make skipping governor callbacks more consistent
  netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()
  netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path
  netfilter: x_tables: guard option walkers against 1-byte tail reads
  can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value
  serial: caif: hold tty->link reference in ldisc_open and ser_release
  net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit
  powerpc: 83xx: km83xx: Fix keymile vendor prefix
  remoteproc: sysmon: Correct subsys_name_len type in QMI request
  powerpc/uaccess: Fix inline assembly for clang build on PPC32
  scsi: ses: Fix devices attaching to different hosts
  ACPI: OSI: Add DMI quirk for Acer Aspire One D255
  unshare: fix unshare_fs() handling
  ACPI: PM: Save NVS memory on Lenovo G70-35
  scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT
  net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled
  net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled
  nfc: rawsock: cancel tx_work before socket teardown
  nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback
  nfc: nci: free skb on nci_transceive early error paths
  net: nfc: nci: Fix zero-length proprietary notifications
  amd-xgbe: fix sleep while atomic on suspend/resume
  xen/acpi-processor: fix _CST detection using undersized evaluation buffer
  wifi: wlcore: Fix a locking bug
  can: bcm: fix locking for bcm_op runtime updates
  atm: lec: fix null-ptr-deref in lec_arp_clear_vccs
  platform/x86: thinkpad_acpi: Fix errors reading battery thresholds
  drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock()
  Squashfs: check metadata block offset is within range
  wifi: radiotap: reject radiotap with unknown bits
  ALSA: usb-audio: Use correct version for UAC3 header validation
  can: ucan: Fix infinite loop from zero-length messages
  can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message
  net: usb: pegasus: validate USB endpoints
  net: usb: kalmia: validate USB endpoints
  net: usb: kaweth: validate USB endpoints
  nfc: pn533: properly drop the usb interface reference on disconnect
  media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
  net: arcnet: com20020-pci: fix support for 2.5Mbit cards
  ALSA: hda/conexant: Add quirk for HP ZBook Studio G4
  clk: tegra: tegra124-emc: fix device leak on set_rate()
  drm/tegra: dsi: fix device leak on probe
  ARM: omap2: Fix reference count leaks in omap_control_init()
  ARM: OMAP2+: add missing of_node_put before break and return
  ARM: clean up the memset64() C wrapper

Change-Id: If58eb7898e90d049cd97232a5f2c1fc971671b1f
2026-05-12 18:00:02 +01:00
6cfd8a9d01 net: rfkill: prevent unlimited numbers of rfkill events from being created
[ Upstream commit ea245d78dec594372e27d8c79616baf49e98a4a1 ]

Userspace can create an unlimited number of rfkill events if the system
is so configured, while not consuming them from the rfkill file
descriptor, causing a potential out of memory situation.  Prevent this
from bounding the number of pending rfkill events at a "large" number
(i.e. 1000) to prevent abuses like this.

Cc: Johannes Berg <johannes@sipsolutions.net>
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://patch.msgid.link/2026033013-disfigure-scroll-e25e@gregkh
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
[ replaced `rfkill_event_ext` with `rfkill_event`, `scoped_guard` with explicit mutex calls, and removed outer `data->mtx` lock in `rfkill_fop_open` to avoid deadlock with new internal locking ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>
2026-05-07 10:55:27 +02:00
5976bf775a Merge tag 'v4.19.325-cip125' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip into android13-4.19-kona
version 4.19.325-cip125

* tag 'v4.19.325-cip125' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip:
  CIP: Bump version suffix to -cip125 after merge from cip/linux-4.19.y-st tree
  Update localversion-st, tree is up-to-date with 5.4.300.
  mm/khugepaged: fix ->anon_vma race
  mm/hugetlb: fix folio is still mapped when deleted
  i40e: add mask to apply valid bits for itr_idx
  i40e: add validation for ring_len param
  i40e: increase max descriptors for XL710
  mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize()
  fbcon: Fix OOB access in font allocation
  fbcon: fix integer overflow in fbcon_do_set_font
  i40e: add max boundary check for VF filters
  i40e: fix input validation logic for action_meta
  i40e: fix idx validation in i40e_validate_queue_map
  drm/gma500: Fix null dereference in hdmi teardown
  can: peak_usb: fix shift-out-of-bounds issue
  can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow
  can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow
  can: hi311x: populate ndo_change_mtu() to prevent buffer overflow
  can: rcar_can: rcar_can_resume(): fix s2ram with PSCI
  usb: core: Add 0x prefix to quirks debug output
  ALSA: usb-audio: Fix build with CONFIG_INPUT=n
  ALSA: usb-audio: Convert comma to semicolon
  ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5
  ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks
  ALSA: usb-audio: Simplify NULL comparison in mixer_quirks
  ALSA: usb-audio: Avoid multiple assignments in mixer_quirks
  ALSA: usb-audio: Fix block comments in mixer_quirks
  KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active
  net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer
  net: rfkill: gpio: add DT support
  serial: sc16is7xx: fix bug in flow control levels init
  USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels
  usb: gadget: dummy_hcd: remove usage of list iterator past the loop body
  ASoC: wm8974: Correct PLL rate rounding
  ASoC: wm8940: Correct typo in control name
  mmc: mvsdio: Fix dma_unmap_sg() nents value
  power: supply: bq27xxx: restrict no-battery detection to bq27000
  power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery
  nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/*
  cnic: Fix use-after-free bugs in cnic_delete_task
  net: liquidio: fix overflow in octeon_init_instr_queue()
  tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().
  i40e: remove redundant memory barrier when cleaning Tx descs
  net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure
  cgroup: split cgroup_destroy_wq into 3 workqueues
  pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch
  ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported
  mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory
  phy: ti-pipe3: fix device leak at unbind
  dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees
  dmaengine: ti: edma: Fix memory allocation size for queue_priority_map
  i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path
  igb: fix link test skipping when interface is admin down
  net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable()
  USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions
  tty: hvc_console: Call hvc_kick in hvc_write unconditionally
  mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing
  mtd: nand: raw: atmel: Fix comment in timings preparation
  mm/khugepaged: fix the address passed to notifier on testing young
  ocfs2: fix recursive semaphore deadlock in fiemap call
  EDAC/altera: Delete an inappropriate dma_free_coherent() call
  net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod.
  cifs: fix integer overflow in match_server()
  spi: spi-fsl-lpspi: Set correct chip-select polarity bit
  pcmcia: Add error handling for add_interval() in do_validate_mem()
  randstruct: gcc-plugin: Fix attribute addition
  randstruct: gcc-plugin: Remove bogus void member
  vmxnet3: update MTU after device quiesce
  iio: light: opt3001: fix deadlock due to concurrent flag access
  KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer
  cpufreq/sched: Explicitly synchronize limits_changed flag handling
  mm/slub: avoid accessing metadata when pointer is invalid in object_err()
  e1000e: fix heap overflow in e1000_set_eeprom
  batman-adv: fix OOB read/write in network-coding decode
  drm/amdgpu: drop hw access in non-DC audio fini
  wifi: mwifiex: Initialize the chan_stats array to zero
  pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region()
  ALSA: usb-audio: Add mute TLV for playback volumes on some devices
  ppp: fix memory leak in pad_compress_skb
  ax25: properly unshare skbs in ax25_kiss_rcv()
  net: thunder_bgx: decrement cleanup index before use
  net: thunder_bgx: add a missing of_node_put
  wifi: libertas: cap SSID len in lbs_associate()
  wifi: cw1200: cap SSID length in cw1200_do_join()
  net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets
  i40e: Fix potential invalid access when MAC list is empty
  icmp: fix icmp_ndo_send address translation for reply direction
  mISDN: Fix memory leak in dsp_hwec_enable()
  xirc2ps_cs: fix register access when enabling FullDuplex
  Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()
  netfilter: conntrack: helper: Replace -EEXIST by -EBUSY
  powerpc: boot: Remove leading zero in label in udelay()

Change-Id: I2c31de17310aeb8f59d10e02bc91f20cf80279e3
2025-10-25 11:29:53 +01:00
08e5a34cd5 BACKPORT: compat_ioctl: move more drivers to compat_ptr_ioctl
The .ioctl and .compat_ioctl file operations have the same prototype so
they can both point to the same function, which works great almost all
the time when all the commands are compatible.

One exception is the s390 architecture, where a compat pointer is only
31 bit wide, and converting it into a 64-bit pointer requires calling
compat_ptr(). Most drivers here will never run in s390, but since we now
have a generic helper for it, it's easy enough to use it consistently.

I double-checked all these drivers to ensure that all ioctl arguments
are used as pointers or are ignored, but are not interpreted as integer
values.

Acked-by: Jason Gunthorpe <jgg@mellanox.com>
Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Acked-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: David Sterba <dsterba@suse.com>
Acked-by: Darren Hart (VMware) <dvhart@infradead.org>
Acked-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Acked-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Acked-by: Dan Williams <dan.j.williams@intel.com>
Change-Id: I7c19d15ea2d2e48a30e726ca0a5b8ee915e6bbe7
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2025-10-16 21:01:09 +01:00
4d4150912b net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer
[ Upstream commit b6f56a44e4c1014b08859dcf04ed246500e310e5 ]

Since commit 7d5e9737ef ("net: rfkill: gpio: get the name and type from
device property") rfkill_find_type() gets called with the possibly
uninitialized "const char *type_name;" local variable.

On x86 systems when rfkill-gpio binds to a "BCM4752" or "LNV4752"
acpi_device, the rfkill->type is set based on the ACPI acpi_device_id:

        rfkill->type = (unsigned)id->driver_data;

and there is no "type" property so device_property_read_string() will fail
and leave type_name uninitialized, leading to a potential crash.

rfkill_find_type() does accept a NULL pointer, fix the potential crash
by initializing type_name to NULL.

Note likely sofar this has not been caught because:

1. Not many x86 machines actually have a "BCM4752"/"LNV4752" acpi_device
2. The stack happened to contain NULL where type_name is stored

Fixes: 7d5e9737ef ("net: rfkill: gpio: get the name and type from device property")
Cc: stable@vger.kernel.org
Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Hans de Goede <hansg@kernel.org>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://patch.msgid.link/20250913113515.21698-1-hansg@kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>
2025-10-16 12:15:35 +02:00
15713b4874 net: rfkill: gpio: add DT support
[ Upstream commit d64c732dfc9edcd57feb693c23162117737e426b ]

Allow probing rfkill-gpio via device tree. This hooks up the already
existing support that was started in commit 262c91ee5e ("net:
rfkill: gpio: prepare for DT and ACPI support") via the "rfkill-gpio"
compatible, with the "name" and "type" properties renamed to "label"
and "radio-type", respectively, in the device tree case.

Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Link: https://lore.kernel.org/r/20230102-rfkill-gpio-dt-v2-2-d1b83758c16d@pengutronix.de
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Stable-dep-of: b6f56a44e4c1 ("net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>
2025-10-16 12:15:35 +02:00
c22009ad76 Merge tag 'ASB-2025-01-05_4.19-stable' of https://android.googlesource.com/kernel/common into android13-4.19-kona
https://source.android.com/docs/security/bulletin/2025-01-01

* tag 'ASB-2025-01-05_4.19-stable' of https://android.googlesource.com/kernel/common: (132 commits)
  Revert "UPSTREAM: unicode: Don't special case ignorable code points"
  Reapply "UPSTREAM: unicode: Don't special case ignorable code points"
  Revert "UPSTREAM: unicode: Don't special case ignorable code points"
  Linux 4.19.325
  sh: intc: Fix use-after-free bug in register_intc_controller()
  modpost: remove incorrect code in do_eisa_entry()
  9p/xen: fix release of IRQ
  9p/xen: fix init sequence
  block: return unsigned int from bdev_io_min
  jffs2: fix use of uninitialized variable
  ubi: fastmap: Fix duplicate slab cache names while attaching
  ubifs: Correct the total block count by deducting journal reservation
  rtc: check if __rtc_read_time was successful in rtc_timer_do_work()
  NFSv4.0: Fix a use-after-free problem in the asynchronous open()
  um: Fix the return value of elf_core_copy_task_fpregs
  rpmsg: glink: Propagate TX failures in intentless mode as well
  NFSD: Prevent a potential integer overflow
  lib: string_helpers: silence snprintf() output truncation warning
  usb: dwc3: gadget: Fix checking for number of TRBs left
  media: wl128x: Fix atomicity violation in fmc_send_cmd()
  ...

 Conflicts:
	arch/arm64/boot/dts/vendor/bindings/clock/adi,axi-clkgen.yaml
	arch/arm64/boot/dts/vendor/bindings/clock/axi-clkgen.txt
	drivers/rpmsg/qcom_glink_native.c

Change-Id: Iea6ddf20dfaa4419f6e0b2efcee1890bfa8e2554
2025-01-10 13:09:21 +02:00
0868402191 net: rfkill: gpio: Add check for clk_enable()
[ Upstream commit 8251e7621b25ccdb689f1dd9553b8789e3745ea1 ]

Add check for the return value of clk_enable() to catch the potential
error.

Fixes: 7176ba23f8 ("net: rfkill: add generic gpio rfkill driver")
Signed-off-by: Mingwei Zheng <zmw12306@gmail.com>
Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
Link: https://patch.msgid.link/20241108195341.1853080-1-zmw12306@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-12-05 10:59:33 +01:00
f8239b8b4e Merge tag 'ASB-2024-10-05_4.19-stable' of https://android.googlesource.com/kernel/common into android13-4.19-kona
https://source.android.com/docs/security/bulletin/2024-10-01

* tag 'ASB-2024-10-05_4.19-stable' of https://android.googlesource.com/kernel/common: (99 commits)
  Linux 4.19.322
  Revert "parisc: Use irq_enter_rcu() to fix warning at kernel/context_tracking.c:367"
  netns: restore ops before calling ops_exit_list
  cx82310_eth: fix error return code in cx82310_bind()
  net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket
  rtmutex: Drop rt_mutex::wait_lock before scheduling
  drm/i915/fence: Mark debug_fence_free() with __maybe_unused
  drm/i915/fence: Mark debug_fence_init_onstack() with __maybe_unused
  ACPI: processor: Fix memory leaks in error paths of processor_add()
  ACPI: processor: Return an error if acpi_processor_get_info() fails in processor_add()
  ila: call nf_unregister_net_hooks() sooner
  netns: add pre_exit method to struct pernet_operations
  nilfs2: protect references to superblock parameters exposed in sysfs
  nilfs2: replace snprintf in show functions with sysfs_emit
  tracing: Avoid possible softlockup in tracing_iter_reset()
  ring-buffer: Rename ring_buffer_read() to read_buffer_iter_advance()
  uprobes: Use kzalloc to allocate xol area
  clocksource/drivers/imx-tpm: Fix next event not taking effect sometime
  clocksource/drivers/imx-tpm: Fix return -ETIME when delta exceeds INT_MAX
  VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
  ...

 Conflicts:
	drivers/clk/qcom/clk-alpha-pll.c

Change-Id: I79078f7d518fa7e6a2b373df48acbd6f9f9ba30b
2024-10-09 03:14:26 +03:00
2579dc71bf rfkill: fix spelling mistake contidion to condition
[ Upstream commit f404c3ecc401b3617c454c06a3d36a43a01f1aaf ]

This came about while trying to determine if there would be any pattern
match on contid, a new audit container identifier internal variable.
This was the only one.

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Stable-dep-of: bee2ef946d31 ("net: bridge: br_fdb_external_learn_add(): always set EXT_LEARN")
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-09-12 11:02:52 +02:00
bfc560ed37 Merge tag 'ASB-2024-01-05_4.19-stable' of https://android.googlesource.com/kernel/common into android13-4.19-kona
https://source.android.com/docs/security/bulletin/2024-01-01

* tag 'ASB-2024-01-05_4.19-stable' of https://android.googlesource.com/kernel/common:
  Linux 4.19.304
  block: Don't invalidate pagecache for invalid falloc modes
  dm-integrity: don't modify bio's immutable bio_vec in integrity_metadata()
  smb: client: fix OOB in smbCalcSize()
  usb: fotg210-hcd: delete an incorrect bounds test
  usb: musb: fix MUSB_QUIRK_B_DISCONNECT_99 handling
  x86/alternatives: Sync core before enabling interrupts
  net: rfkill: gpio: set GPIO direction
  net: 9p: avoid freeing uninit memory in p9pdu_vreadf
  Bluetooth: hci_event: Fix not checking if HCI_OP_INQUIRY has been sent
  USB: serial: option: add Quectel RM500Q R13 firmware support
  USB: serial: option: add Foxconn T99W265 with new baseline
  USB: serial: option: add Quectel EG912Y module support
  USB: serial: ftdi_sio: update Actisense PIDs constant names
  wifi: cfg80211: fix certs build to not depend on file order
  wifi: cfg80211: Add my certificate
  iio: common: ms_sensors: ms_sensors_i2c: fix humidity conversion time table
  scsi: bnx2fc: Fix skb double free in bnx2fc_rcv()
  scsi: bnx2fc: Remove set but not used variable 'oxid'
  Input: ipaq-micro-keys - add error handling for devm_kmemdup
  iio: imu: inv_mpu6050: fix an error code problem in inv_mpu6050_read_raw
  btrfs: do not allow non subvolume root targets for snapshot
  smb: client: fix NULL deref in asn1_ber_decoder()
  pinctrl: at91-pio4: use dedicated lock class for IRQ
  net: check dev->gso_max_size in gso_features_check()
  net: warn if gso_type isn't set for a GSO SKB
  afs: Fix the dynamic root's d_delete to always delete unused dentries
  net: check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev()
  net/rose: fix races in rose_kill_by_device()
  ethernet: atheros: fix a memleak in atl1e_setup_ring_resources
  net: sched: ife: fix potential use-after-free
  net/mlx5: Fix fw tracer first block check
  net/mlx5: improve some comments
  wifi: mac80211: mesh_plink: fix matches_local logic
  s390/vx: fix save/restore of fpu kernel context
  reset: Fix crash when freeing non-existent optional resets
  ARM: OMAP2+: Fix null pointer dereference and memory leak in omap_soc_device_init
  ksmbd: fix wrong name of SMB2_CREATE_ALLOCATION_SIZE
  ALSA: hda/realtek: Enable headset on Lenovo M90 Gen5
  ALSA: hda/realtek: Enable headset onLenovo M70/M90
  ALSA: hda/realtek: Add quirk for Lenovo TianYi510Pro-14IOB
  arm64: dts: mediatek: mt8173-evb: Fix regulator-fixed node names
  Revert "cred: switch to using atomic_long_t"
  Linux 4.19.303
  powerpc/ftrace: Fix stack teardown in ftrace_no_trace
  powerpc/ftrace: Create a dummy stackframe to fix stack unwind
  mmc: block: Be sure to wait while busy in CQE error recovery
  ring-buffer: Fix memory leak of free page
  team: Fix use-after-free when an option instance allocation fails
  arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify
  ext4: prevent the normalized size from exceeding EXT_MAX_BLOCKS
  perf: Fix perf_event_validate_size() lockdep splat
  HID: hid-asus: add const to read-only outgoing usb buffer
  net: usb: qmi_wwan: claim interface 4 for ZTE MF290
  asm-generic: qspinlock: fix queued_spin_value_unlocked() implementation
  HID: multitouch: Add quirk for HONOR GLO-GXXX touchpad
  HID: hid-asus: reset the backlight brightness level on resume
  HID: add ALWAYS_POLL quirk for Apple kb
  platform/x86: intel_telemetry: Fix kernel doc descriptions
  bcache: avoid NULL checking to c->root in run_cache_set()
  bcache: add code comments for bch_btree_node_get() and __bch_btree_node_alloc()
  bcache: avoid oversize memory allocation by small stripe_size
  blk-throttle: fix lockdep warning of "cgroup_mutex or RCU read lock required!"
  cred: switch to using atomic_long_t
  Revert "PCI: acpiphp: Reassign resources on bridge if necessary"
  appletalk: Fix Use-After-Free in atalk_ioctl
  net: stmmac: Handle disabled MDIO busses from devicetree
  vsock/virtio: Fix unsigned integer wrap around in virtio_transport_has_space()
  sign-file: Fix incorrect return values check
  net: Remove acked SYN flag from packet in the transmit queue correctly
  qed: Fix a potential use-after-free in qed_cxt_tables_alloc
  net/rose: Fix Use-After-Free in rose_ioctl
  atm: Fix Use-After-Free in do_vcc_ioctl
  atm: solos-pci: Fix potential deadlock on &tx_queue_lock
  atm: solos-pci: Fix potential deadlock on &cli_queue_lock
  qca_spi: Fix reset behavior
  qca_debug: Fix ethtool -G iface tx behavior
  qca_debug: Prevent crash on TX ring changes
  Revert "psample: Require 'CAP_NET_ADMIN' when joining "packets" group"
  Revert "genetlink: add CAP_NET_ADMIN test for multicast bind"
  Revert "drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group"
  Revert "perf/core: Add a new read format to get a number of lost samples"
  Revert "perf: Fix perf_event_validate_size()"
  Revert "hrtimers: Push pending hrtimers away from outgoing CPU earlier"
  ANDROID: Snapshot Mainline's version of checkpatch.pl
  Linux 4.19.302
  devcoredump: Send uevent once devcd is ready
  devcoredump : Serialize devcd_del work
  IB/isert: Fix unaligned immediate-data handling
  tools headers UAPI: Sync linux/perf_event.h with the kernel sources
  drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group
  psample: Require 'CAP_NET_ADMIN' when joining "packets" group
  genetlink: add CAP_NET_ADMIN test for multicast bind
  netlink: don't call ->netlink_bind with table lock held
  nilfs2: fix missing error check for sb_set_blocksize call
  KVM: s390/mm: Properly reset no-dat
  x86/CPU/AMD: Check vendor in the AMD microcode callback
  serial: 8250_omap: Add earlycon support for the AM654 UART controller
  serial: sc16is7xx: address RX timeout interrupt errata
  usb: typec: class: fix typec_altmode_put_partner to put plugs
  parport: Add support for Brainboxes IX/UC/PX parallel cards
  usb: gadget: f_hid: fix report descriptor allocation
  gpiolib: sysfs: Fix error handling on failed export
  perf: Fix perf_event_validate_size()
  perf/core: Add a new read format to get a number of lost samples
  tracing: Fix a possible race when disabling buffered events
  tracing: Fix incomplete locking when disabling buffered events
  tracing: Always update snapshot buffer size
  nilfs2: prevent WARNING in nilfs_sufile_set_segment_usage()
  packet: Move reference count in packet_sock to atomic_long_t
  ALSA: pcm: fix out-of-bounds in snd_pcm_state_names
  ARM: dts: imx7: Declare timers compatible with fsl,imx6dl-gpt
  ARM: dts: imx: make gpt node name generic
  ARM: imx: Check return value of devm_kasprintf in imx_mmdc_perf_init
  scsi: be2iscsi: Fix a memleak in beiscsi_init_wrb_handle()
  tracing: Fix a warning when allocating buffered events fails
  hwmon: (acpi_power_meter) Fix 4.29 MW bug
  RDMA/bnxt_re: Correct module description string
  tcp: do not accept ACK of bytes we never sent
  netfilter: xt_owner: Fix for unsafe access of sk->sk_socket
  netfilter: xt_owner: Add supplementary groups option
  net: hns: fix fake link up on xge port
  ipv4: ip_gre: Avoid skb_pull() failure in ipgre_xmit()
  arcnet: restoring support for multiple Sohard Arcnet cards
  net: arcnet: com20020 fix error handling
  net: arcnet: Fix RESET flag handling
  hv_netvsc: rndis_filter needs to select NLS
  ipv6: fix potential NULL deref in fib6_add()
  drm/amdgpu: correct chunk_ptr to a pointer to chunk.
  kconfig: fix memory leak from range properties
  tg3: Increment tx_dropped in tg3_tso_bug()
  tg3: Move the [rt]x_dropped counters to tg3_napi
  netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test
  hrtimers: Push pending hrtimers away from outgoing CPU earlier
  media: davinci: vpif_capture: fix potential double free
  spi: imx: mx51-ecspi: Move some initialisation to prepare_message hook.
  spi: imx: correct wml as the last sg length
  spi: imx: move wml setting to later than setup_transfer
  spi: imx: add a device specific prepare_message callback
  Linux 4.19.301
  mmc: block: Retry commands in CQE error recovery
  mmc: core: convert comma to semicolon
  mmc: cqhci: Fix task clearing in CQE error recovery
  mmc: cqhci: Warn of halt or task clear failure
  mmc: cqhci: Increase recovery halt timeout
  cpufreq: imx6q: Don't disable 792 Mhz OPP unnecessarily
  cpufreq: imx6q: don't warn for disabling a non-existing frequency
  ima: detect changes to the backing overlay file
  ovl: skip overlayfs superblocks at global sync
  ima: annotate iint mutex to avoid lockdep false positive warnings
  fbdev: stifb: Make the STI next font pointer a 32-bit signed offset
  mtd: cfi_cmdset_0001: Byte swap OTP info
  mtd: cfi_cmdset_0001: Support the absence of protection registers
  s390/cmma: fix detection of DAT pages
  s390/mm: fix phys vs virt confusion in mark_kernel_pXd() functions family
  smb3: fix touch -h of symlink
  net: ravb: Start TX queues after HW initialization succeeded
  ravb: Fix races between ravb_tx_timeout_work() and net related ops
  ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
  Input: xpad - add HyperX Clutch Gladiate Support
  btrfs: send: ensure send_fd is writable
  btrfs: fix off-by-one when checking chunk map includes logical address
  powerpc: Don't clobber f0/vs0 during fp|altivec register save
  bcache: revert replacing IS_ERR_OR_NULL with IS_ERR
  dm verity: don't perform FEC for failed readahead IO
  dm-verity: align struct dm_verity_fec_io properly
  ALSA: hda/realtek: Headset Mic VREF to 100%
  ALSA: hda: Disable power-save on KONTRON SinglePC
  mmc: block: Do not lose cache flush during CQE error recovery
  firewire: core: fix possible memory leak in create_units()
  pinctrl: avoid reload of p state in list iteration
  USB: dwc3: qcom: fix wakeup after probe deferral
  usb: dwc3: set the dma max_seg_size
  USB: dwc2: write HCINT with INTMASK applied
  USB: serial: option: don't claim interface 4 for ZTE MF290
  USB: serial: option: fix FM101R-GL defines
  USB: serial: option: add Fibocom L7xx modules
  bcache: prevent potential division by zero error
  bcache: check return value from btree_node_alloc_replacement()
  dm-delay: fix a race between delay_presuspend and delay_bio
  hv_netvsc: Mark VF as slave before exposing it to user-mode
  hv_netvsc: Fix race of register_netdevice_notifier and VF register
  USB: serial: option: add Luat Air72*U series products
  s390/dasd: protect device queue against concurrent access
  bcache: replace a mistaken IS_ERR() by IS_ERR_OR_NULL() in btree_gc_coalesce()
  mtd: rawnand: brcmnand: Fix ecc chunk calculation for erased page bitfips
  KVM: arm64: limit PMU version to PMUv3 for ARMv8.1
  arm64: cpufeature: Extract capped perfmon fields
  MIPS: KVM: Fix a build warning about variable set but not used
  net: axienet: Fix check for partial TX checksum
  amd-xgbe: propagate the correct speed and duplex status
  amd-xgbe: handle the corner-case during tx completion
  amd-xgbe: handle corner-case during sfp hotplug
  arm/xen: fix xen_vcpu_info allocation alignment
  net: usb: ax88179_178a: fix failed operations during ax88179_reset
  ipv4: Correct/silence an endian warning in __ip_do_redirect
  HID: fix HID device resource race between HID core and debugging support
  HID: core: store the unique system identifier in hid_device
  drm/rockchip: vop: Fix color for RGB888/BGR888 format on VOP full
  ata: pata_isapnp: Add missing error check for devm_ioport_map()
  drm/panel: simple: Fix Innolux G101ICE-L01 timings
  RDMA/irdma: Prevent zero-length STAG registration
  driver core: Release all resources during unbind before updating device links

 Conflicts:
	drivers/mmc/host/cqhci.c
	drivers/net/usb/ax88179_178a.c
	drivers/usb/dwc3/core.c
	scripts/checkpatch.pl

Change-Id: I571c71df4f4c1c612d4101c9b9c2b901b4408103
2024-01-13 21:09:02 +02:00
f08531dd7c net: rfkill: gpio: set GPIO direction
commit 23484d817082c3005252d8edfc8292c8a1006b5b upstream.

Fix the undefined usage of the GPIO consumer API after retrieving the
GPIO description with GPIO_ASIS. The API documentation mentions that
GPIO_ASIS won't set a GPIO direction and requires the user to set a
direction before using the GPIO.

This can be confirmed on i.MX6 hardware, where rfkill-gpio is no longer
able to enabled/disable a device, presumably because the GPIO controller
was never configured for the output direction.

Fixes: b2f750c3a80b ("net: rfkill: gpio: prevent value glitch during probe")
Cc: stable@vger.kernel.org
Signed-off-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Link: https://msgid.link/20231207075835.3091694-1-r.czerwinski@pengutronix.de
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-01-08 11:27:36 +01:00
9cd6ae99b7 Merge tag 'ASB-2023-11-05_4.19-stable' of https://android.googlesource.com/kernel/common into android13-4.19-kona
https://source.android.com/docs/security/bulletin/2023-11-01

* tag 'ASB-2023-11-05_4.19-stable' of https://android.googlesource.com/kernel/common:
  Reapply "perf: Disallow mis-matched inherited group reads"
  Revert "perf: Disallow mis-matched inherited group reads"
  Revert "xfrm: fix a data-race in xfrm_gen_index()"
  Revert "Bluetooth: hci_core: Fix build warnings"
  Revert "xfrm: interface: use DEV_STATS_INC()"
  Linux 4.19.297
  xfrm6: fix inet6_dev refcount underflow problem
  Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name
  Bluetooth: hci_sock: fix slab oob read in create_monitor_event
  phy: mapphone-mdm6600: Fix runtime PM for remove
  ASoC: pxa: fix a memory leak in probe()
  gpio: vf610: set value before the direction to avoid a glitch
  s390/pci: fix iommu bitmap allocation
  perf: Disallow mis-matched inherited group reads
  USB: serial: option: add Fibocom to DELL custom modem FM101R-GL
  USB: serial: option: add entry for Sierra EM9191 with new firmware
  USB: serial: option: add Telit LE910C4-WWX 0x1035 composition
  ACPI: irq: Fix incorrect return value in acpi_register_gsi()
  Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()"
  mmc: core: Capture correct oemid-bits for eMMC cards
  mtd: spinand: micron: correct bitmask for ecc status
  mtd: rawnand: qcom: Unmap the right resource upon probe failure
  Bluetooth: hci_event: Fix using memcmp when comparing keys
  btrfs: fix some -Wmaybe-uninitialized warnings in ioctl.c
  drm: panel-orientation-quirks: Add quirk for One Mix 2S
  sky2: Make sure there is at least one frag_addr available
  wifi: cfg80211: avoid leaking stack data into trace
  wifi: mac80211: allow transmitting EAPOL frames with tainted key
  Bluetooth: hci_core: Fix build warnings
  Bluetooth: Avoid redundant authentication
  HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event
  tracing: relax trace_event_eval_update() execution with cond_resched()
  ata: libata-eh: Fix compilation warning in ata_eh_link_report()
  gpio: timberdale: Fix potential deadlock on &tgpio->lock
  overlayfs: set ctime when setting mtime and atime
  i2c: mux: Avoid potential false error message in i2c_mux_add_adapter
  btrfs: initialize start_slot in btrfs_log_prealloc_extents
  btrfs: return -EUCLEAN for delayed tree ref with a ref count not equals to 1
  ARM: dts: ti: omap: Fix noisy serial with overrun-throttle-ms for mapphone
  libceph: use kernel_connect()
  libceph: fix unaligned accesses in ceph_entity_addr handling
  net: pktgen: Fix interface flags printing
  netfilter: nft_set_rbtree: .deactivate fails if element has expired
  net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve
  i40e: prevent crash on probe if hw registers have invalid values
  net: usb: smsc95xx: Fix an error code in smsc95xx_reset()
  tcp: tsq: relax tcp_small_queue_check() when rtx queue contains a single skb
  tcp: fix excessive TLP and RACK timeouts from HZ rounding
  net: rfkill: gpio: prevent value glitch during probe
  net: ipv6: fix return value check in esp_remove_trailer
  net: ipv4: fix return value check in esp_remove_trailer
  xfrm: interface: use DEV_STATS_INC()
  xfrm: fix a data-race in xfrm_gen_index()
  netfilter: nft_payload: fix wrong mac header matching
  KVM: x86: Mask LVTPC when handling a PMI
  regmap: fix NULL deref on lookup
  nfc: nci: fix possible NULL pointer dereference in send_acknowledge()
  Bluetooth: avoid memcmp() out of bounds warning
  Bluetooth: hci_event: Fix coding style
  Bluetooth: vhci: Fix race when opening vhci device
  Bluetooth: Fix a refcnt underflow problem for hci_conn
  Bluetooth: Reject connection with the device which has same BD_ADDR
  Bluetooth: hci_event: Ignore NULL link key
  usb: hub: Guard against accesses to uninitialized BOS descriptors
  dev_forward_skb: do not scrub skb mark within the same name space
  x86/alternatives: Disable KASAN in apply_alternatives()
  powerpc/64e: Fix wrong test in __ptep_test_and_clear_young()
  usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call
  usb: gadget: udc-xilinx: replace memcpy with memcpy_toio
  x86/cpu: Fix AMD erratum #1485 on Zen4-based CPUs
  pinctrl: avoid unsafe code pattern in find_pinctrl()
  cgroup: Remove duplicates in cgroup v1 tasks file
  Input: xpad - add PXN V900 support
  Input: psmouse - fix fast_reconnect function for PS/2 mode
  Input: powermate - fix use-after-free in powermate_config_complete
  ceph: fix incorrect revoked caps assert in ceph_fill_file_size()
  mcb: remove is_added flag from mcb_device struct
  iio: pressure: ms5611: ms5611_prom_is_valid false negative bug
  iio: pressure: bmp280: Fix NULL pointer exception
  usb: musb: Modify the "HWVers" register address
  usb: musb: Get the musb_qh poniter after musb_giveback
  usb: dwc3: Soft reset phy on probe for host
  net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read
  usb: xhci: xhci-ring: Use sysdev for mapping bounce buffer
  dmaengine: stm32-mdma: abort resume if no ongoing transfer
  sched,idle,rcu: Push rcu_idle deeper into the idle path
  workqueue: Override implicit ordered attribute in workqueue_apply_unbound_cpumask()
  nfc: nci: assert requested protocol is valid
  net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()
  ixgbe: fix crash with empty VF macvlan list
  drm/vmwgfx: fix typo of sizeof argument
  xen-netback: use default TX queue size for vifs
  ieee802154: ca8210: Fix a potential UAF in ca8210_probe
  drm/msm/dsi: skip the wait for video mode done if not applicable
  drm: etvnaviv: fix bad backport leading to warning
  net: prevent address rewrite in kernel_bind()
  quota: Fix slow quotaoff
  HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect
  RDMA/cxgb4: Check skb value for failure to allocate
  net: prevent rewrite of msg_name in sock_sendmsg()
  net: fix kernel-doc warnings for socket.c
  net: use indirect calls helpers at the socket layer
  indirect call wrappers: helpers to speed-up indirect calls of builtin
  Revert "net: add atomic_long_t to net_device_stats fields"
  Revert "net: Fix unwanted sign extension in netdev_stats_to_stats64()"
  Revert "net: bridge: use DEV_STATS_INC()"
  Linux 4.19.296
  xen/events: replace evtchn_rwlock with RCU
  rtnetlink: Reject negative ifindexes in RTM_NEWLINK
  Revert "rtnetlink: Reject negative ifindexes in RTM_NEWLINK"
  dccp: fix dccp_v4_err()/dccp_v6_err() again
  parisc: Restore __ldcw_align for PA-RISC 2.0 processors
  RDMA/mlx5: Fix NULL string error
  RDMA/cma: Fix truncation compilation warning in make_cma_ports
  gpio: pxa: disable pinctrl calls for MMP_GPIO
  gpio: aspeed: fix the GPIO number passed to pinctrl_gpio_set_config()
  IB/mlx4: Fix the size of a buffer in add_port_entries()
  cpupower: add Makefile dependencies for install targets
  sctp: update hb timer immediately after users change hb_interval
  sctp: update transport state when processing a dupcook packet
  tcp: fix delayed ACKs for MSS boundary condition
  tcp: fix quick-ack counting to count actual ACKs of new data
  net: stmmac: dwmac-stm32: fix resume on STM32 MCU
  net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg
  ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data()
  modpost: add missing else to the "of" check
  scsi: target: core: Fix deadlock due to recursive locking
  regmap: rbtree: Fix wrong register marked as in-cache when creating new node
  drivers/net: process the result of hdlc_open() and add call of hdlc_close() in uhdlc_close()
  wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet
  ubi: Refuse attaching if mtd's erasesize is 0
  net: replace calls to sock->ops->connect() with kernel_connect()
  wifi: mwifiex: Fix tlv_buf_left calculation
  qed/red_ll2: Fix undefined behavior bug in struct qed_ll2_info
  scsi: zfcp: Fix a double put in zfcp_port_enqueue()
  Revert "PCI: qcom: Disable write access to read only registers for IP v2.3.3"
  media: dvb: symbol fixup for dvb_attach() - again
  Revert "drivers core: Use sysfs_emit and sysfs_emit_at for show(device *...) functions"
  ata: libata: disallow dev-initiated LPM transitions to unsupported states
  ext4: fix rec_len verify error
  fs: binfmt_elf_efpic: fix personality for ELF-FDPIC
  ata: libata-sata: increase PMP SRST timeout to 10s
  ata: libata-core: Do not register PM operations for SAS ports
  ata: libata-core: Fix port and device removal
  ata: libata-core: Fix ata_port_request_pm() locking
  net: thunderbolt: Fix TCPv6 GSO checksum calculation
  btrfs: properly report 0 avail for very full file systems
  i2c: i801: unregister tco_pdev in i801_probe() error path
  ata: libata-scsi: ignore reserved bits for REPORT SUPPORTED OPERATION CODES
  ALSA: hda: Disable power save for solving pop issue on Lenovo ThinkCentre M70q
  nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
  serial: 8250_port: Check IRQ data before use
  smack: Record transmuting in smk_transmuted
  smack: Retrieve transmuting information in smack_inode_getsecurity()
  Smack:- Use overlay inode label in smack_inode_copy_up()
  scsi: megaraid_sas: Enable msix_load_balance for Invader and later controllers
  net: Fix unwanted sign extension in netdev_stats_to_stats64()
  watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running
  watchdog: iTCO_wdt: No need to stop the timer in probe
  nvme-pci: do not set the NUMA node of device if it has none
  fbdev/sh7760fb: Depend on FB=y
  bpf: Clarify error expectations from bpf_clone_redirect
  ata: libata-eh: do not clear ATA_PFLAG_EH_PENDING in ata_eh_reset()
  ring-buffer: Avoid softlockup in ring_buffer_resize()
  selftests/ftrace: Correctly enable event in instance-event.tc
  parisc: irq: Make irq_stack_union static to avoid sparse warning
  parisc: drivers: Fix sparse warning
  parisc: iosapic.c: Fix sparse warnings
  parisc: sba: Fix compile warning wrt list of SBA devices
  gpio: pmic-eic-sprd: Add can_sleep flag for PMIC EIC chip
  ARM: dts: ti: omap: motorola-mapphone: Fix abe_clkctrl warning on boot
  clk: tegra: fix error return case for recalc_rate
  MIPS: Alchemy: only build mmc support helpers if au1xmmc is enabled
  ext4: do not let fstrim block system suspend
  ext4: move setting of trimmed bit into ext4_try_to_trim_range()
  ext4: replace the traditional ternary conditional operator with with max()/min()
  ext4: mark group as trimmed only if it was fully scanned
  ext4: change s_last_trim_minblks type to unsigned long
  ext4: scope ret locally in ext4_try_to_trim_range()
  ext4: add new helper interface ext4_try_to_trim_range()
  ext4: remove the 'group' parameter of ext4_trim_extent
  scsi: megaraid_sas: Fix deadlock on firmware crashdump
  scsi: megaraid_sas: Load balance completions across all MSI-X
  scsi: qla2xxx: Remove unsupported ql2xenabledif option
  scsi: qla2xxx: Add protection mask module parameters
  Input: i8042 - add quirk for TUXEDO Gemini 17 Gen1/Clevo PD70PN
  i2c: mux: demux-pinctrl: check the return value of devm_kstrdup()
  gpio: tb10x: Fix an error handling path in tb10x_gpio_probe()
  team: fix null-ptr-deref when team device type is changed
  net: bridge: use DEV_STATS_INC()
  net: add atomic_long_t to net_device_stats fields
  net: hns3: add 5ms delay before clear firmware reset irq source
  powerpc/perf/hv-24x7: Update domain value check
  ipv4: fix null-deref in ipv4_link_failure
  selftests: tls: swap the TX and RX sockets in some tests
  selftests/tls: Add {} to avoid static checker warning
  netfilter: nf_tables: disallow element removal on anonymous sets
  ata: libahci: clear pending interrupt status
  ata: ahci: Drop pointless VPRINTK() calls and convert the remaining ones
  NFS/pNFS: Report EINVAL errors from connect() to the server
  ANDROID: ALSA: jack: Revert mismerge done in v4.19.291

 Conflicts:
	include/net/tcp.h
	kernel/events/core.c
	kernel/sched/idle.c

Change-Id: I141cc494dcfda5fbd11f8bd2f7166bf3bf157084
2023-11-09 14:55:01 +02:00
160ad7ba7a net: rfkill: gpio: prevent value glitch during probe
commit b2f750c3a80b285cd60c9346f8c96bd0a2a66cde upstream.

When either reset- or shutdown-gpio have are initially deasserted,
e.g. after a reboot - or when the hardware does not include pull-down,
there will be a short toggle of both IOs to logical 0 and back to 1.

It seems that the rfkill default is unblocked, so the driver should not
glitch to output low during probe.
It can lead e.g. to unexpected lte modem reconnect:

[1] root@localhost:~# dmesg | grep "usb 2-1"
[    2.136124] usb 2-1: new SuperSpeed USB device number 2 using xhci-hcd
[   21.215278] usb 2-1: USB disconnect, device number 2
[   28.833977] usb 2-1: new SuperSpeed USB device number 3 using xhci-hcd

The glitch has been discovered on an arm64 board, now that device-tree
support for the rfkill-gpio driver has finally appeared :).

Change the flags for devm_gpiod_get_optional from GPIOD_OUT_LOW to
GPIOD_ASIS to avoid any glitches.
The rfkill driver will set the intended value during rfkill_sync_work.

Fixes: 7176ba23f8 ("net: rfkill: add generic gpio rfkill driver")
Signed-off-by: Josua Mayer <josua@solid-run.com>
Link: https://lore.kernel.org/r/20231004163928.14609-1-josua@solid-run.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-10-25 11:16:45 +02:00
9459964334 Merge android-4.19-q.95 (138a4a6) into msm-4.19
* refs/heads/tmp-138a4a6:
  Linux 4.19.95
  usb: missing parentheses in USE_NEW_SCHEME
  USB: serial: option: add Telit ME910G1 0x110a composition
  USB: core: fix check for duplicate endpoints
  usb: dwc3: gadget: Fix request complete check
  net: sch_prio: When ungrafting, replace with FIFO
  mlxsw: spectrum_qdisc: Ignore grafting of invisible FIFO
  vlan: vlan_changelink() should propagate errors
  vlan: fix memory leak in vlan_dev_set_egress_priority
  vxlan: fix tos value before xmit
  tcp: fix "old stuff" D-SACK causing SACK to be treated as D-SACK
  sctp: free cmd->obj.chunk for the unprocessed SCTP_CMD_REPLY
  sch_cake: avoid possible divide by zero in cake_enqueue()
  pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM
  net: usb: lan78xx: fix possible skb leak
  net: stmmac: dwmac-sunxi: Allow all RGMII modes
  net: stmmac: dwmac-sun8i: Allow all RGMII modes
  net: dsa: mv88e6xxx: Preserve priority when setting CPU port.
  macvlan: do not assume mac_header is set in macvlan_broadcast()
  gtp: fix bad unlock balance in gtp_encap_enable_socket
  PCI/switchtec: Read all 64 bits of part_event_bitmap
  ARM: dts: imx6ul: use nvmem-cells for cpu speed grading
  cpufreq: imx6q: read OCOTP through nvmem for imx6ul/imx6ull
  powerpc/spinlocks: Include correct header for static key
  powerpc/vcpu: Assume dedicated processors as non-preempt
  hv_netvsc: Fix unwanted rx_table reset
  llc2: Fix return statement of llc_stat_ev_rx_null_dsap_xid_c (and _test_c)
  parisc: Fix compiler warnings in debug_core.c
  block: fix memleak when __blk_rq_map_user_iov() is failed
  s390/dasd: fix memleak in path handling error case
  s390/dasd/cio: Interpret ccw_device_get_mdc return value correctly
  drm/exynos: gsc: add missed component_del
  s390/purgatory: do not build purgatory with kcov, kasan and friends
  net: stmmac: Always arm TX Timer at end of transmission start
  net: stmmac: RX buffer size must be 16 byte aligned
  net: stmmac: xgmac: Clear previous RX buffer size
  net: stmmac: Do not accept invalid MTU values
  fs: avoid softlockups in s_inodes iterators
  perf/x86/intel: Fix PT PMI handling
  kconfig: don't crash on NULL expressions in expr_eq()
  iommu/iova: Init the struct iova to fix the possible memleak
  regulator: rn5t618: fix module aliases
  ASoC: wm8962: fix lambda value
  rfkill: Fix incorrect check to avoid NULL pointer dereference
  parisc: add missing __init annotation
  net: usb: lan78xx: Fix error message format specifier
  cxgb4: Fix kernel panic while accessing sge_info
  bnx2x: Fix logic to get total no. of PFs per engine
  bnx2x: Do not handle requests from VFs after parity
  bpf: Clear skb->tstamp in bpf_redirect when necessary
  btrfs: Fix error messages in qgroup_rescan_init
  powerpc: Ensure that swiotlb buffer is allocated from low memory
  samples: bpf: fix syscall_tp due to unused syscall
  samples: bpf: Replace symbol compare of trace_event
  ARM: dts: am437x-gp/epos-evm: fix panel compatible
  spi: spi-ti-qspi: Fix a bug when accessing non default CS
  bpf, mips: Limit to 33 tail calls
  bnxt_en: Return error if FW returns more data than dump length
  ARM: dts: bcm283x: Fix critical trip point
  ASoC: topology: Check return value for soc_tplg_pcm_create()
  spi: spi-cavium-thunderx: Add missing pci_release_regions()
  ARM: dts: Cygnus: Fix MDIO node address/size cells
  selftests/ftrace: Fix multiple kprobe testcase
  ARM: dts: BCM5301X: Fix MDIO node address/size cells
  netfilter: nf_tables: validate NFT_DATA_VALUE after nft_data_init()
  netfilter: nf_tables: validate NFT_SET_ELEM_INTERVAL_END
  netfilter: nft_set_rbtree: bogus lookup/get on consecutive elements in named sets
  netfilter: uapi: Avoid undefined left-shift in xt_sctp.h
  ARM: vexpress: Set-up shared OPP table instead of individual for each CPU
  ARM: dts: imx6ul: imx6ul-14x14-evk.dtsi: Fix SPI NOR probing
  efi/gop: Fix memory leak in __gop_query32/64()
  efi/gop: Return EFI_SUCCESS if a usable GOP was found
  efi/gop: Return EFI_NOT_FOUND if there are no usable GOPs
  ASoC: Intel: bytcr_rt5640: Update quirk for Teclast X89
  x86/efi: Update e820 with reserved EFI boot services data to fix kexec breakage
  libtraceevent: Fix lib installation with O=
  mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame()
  netfilter: ctnetlink: netns exit must wait for callbacks
  locking/spinlock/debug: Fix various data races
  ASoC: max98090: fix possible race conditions
  regulator: fix use after free issue
  bpf: Fix passing modified ctx to ld/abs/ind instruction
  USB: dummy-hcd: increase max number of devices to 32
  USB: dummy-hcd: use usb_urb_dir_in instead of usb_pipein

Conflicts:
	kernel/locking/spinlock_debug.c

1683149 ("usb: dwc3: gadget: Fix logical condition") was reverted
on importing android-4.19-q.90 into msm-4.19 as this change
prevented the adbd userspace daemon from ever receiving packets
from the kernel USB driver. android-4.19-q.95 introduced new
change ceaeb21b ("usb: dwc3: gadget: Fix request complete check")
that fixed the regression, hence it is safe to restore the revert.
It is done in this merge.

Change-Id: I5f839319ad7746728a98c01f8b5c3dab9c9f368a
Signed-off-by: Ivaylo Georgiev <irgeorgiev@codeaurora.org>
2020-02-03 21:43:57 -08:00
e56696c197 Merge android-4.19-q.92 (3e66813) into msm-4.19
* refs/heads/tmp-3e66813:
  Linux 4.19.92
  perf probe: Fix to show function entry line as probe-able
  nbd: fix shutdown and recv work deadlock v2
  mmc: sdhci: Add a quirk for broken command queuing
  mmc: sdhci: Workaround broken command queuing on Intel GLK
  mmc: sdhci-of-esdhc: fix P2020 errata handling
  mmc: sdhci: Update the tuning failed messages to pr_debug level
  mmc: sdhci-of-esdhc: Revert "mmc: sdhci-of-esdhc: add erratum A-009204 support"
  mmc: sdhci-msm: Correct the offset and value for DDR_CONFIG register
  powerpc/irq: fix stack overflow verification
  powerpc/vcpu: Assume dedicated processors as non-preempt
  x86/MCE/AMD: Allow Reserved types to be overwritten in smca_banks[]
  x86/MCE/AMD: Do not use rdmsr_safe_on_cpu() in smca_configure()
  KVM: arm64: Ensure 'params' is initialised when looking up sys register
  ext4: unlock on error in ext4_expand_extra_isize()
  ext4: check for directory entries too close to block end
  ext4: fix ext4_empty_dir() for directories with holes
  staging: comedi: gsc_hpdi: check dma_alloc_coherent() return value
  platform/x86: hp-wmi: Make buffer for HPWMI_FEATURE2_QUERY 128 bytes
  intel_th: pci: Add Elkhart Lake SOC support
  intel_th: pci: Add Comet Lake PCH-V support
  USB: EHCI: Do not return -EPIPE when hub is disconnected
  cpufreq: Avoid leaving stale IRQ work items during CPU offline
  usbip: Fix error path of vhci_recv_ret_submit()
  usbip: Fix receive error in vhci-hcd when using scatter-gather
  btrfs: return error pointer from alloc_test_extent_buffer
  s390/ftrace: fix endless recursion in function_graph tracer
  drm/amdgpu: fix uninitialized variable pasid_mapping_needed
  usb: xhci: Fix build warning seen with CONFIG_PM=n
  can: kvaser_usb: kvaser_usb_leaf: Fix some info-leaks to USB devices
  mmc: mediatek: fix CMD_TA to 2 for MT8173 HS200/HS400 mode
  Revert "mmc: sdhci: Fix incorrect switch to HS mode"
  btrfs: don't prematurely free work in scrub_missing_raid56_worker()
  btrfs: don't prematurely free work in reada_start_machine_worker()
  net: phy: initialise phydev speed and duplex sanely
  drm/amdgpu: fix bad DMA from INTERRUPT_CNTL2
  mips: fix build when "48 bits virtual memory" is enabled
  libtraceevent: Fix memory leakage in copy_filter_type
  crypto: vmx - Avoid weird build failures
  mac80211: consider QoS Null frames for STA_NULLFUNC_ACKED
  crypto: sun4i-ss - Fix 64-bit size_t warnings on sun4i-ss-hash.c
  crypto: sun4i-ss - Fix 64-bit size_t warnings
  net: ethernet: ti: ale: clean ale tbl on init and intf restart
  fbtft: Make sure string is NULL terminated
  iwlwifi: check kasprintf() return value
  brcmfmac: remove monitor interface when detaching
  x86/insn: Add some Intel instructions to the opcode map
  ASoC: Intel: bytcr_rt5640: Update quirk for Acer Switch 10 SW5-012 2-in-1
  ASoC: wm5100: add missed pm_runtime_disable
  spi: st-ssc4: add missed pm_runtime_disable
  ASoC: wm2200: add missed operations in remove and probe failure
  btrfs: don't prematurely free work in run_ordered_work()
  btrfs: don't prematurely free work in end_workqueue_fn()
  mmc: tmio: Add MMC_CAP_ERASE to allow erase/discard/trim requests
  crypto: virtio - deal with unsupported input sizes
  tun: fix data-race in gro_normal_list()
  spi: tegra20-slink: add missed clk_unprepare
  ASoC: wm8904: fix regcache handling
  iwlwifi: mvm: fix unaligned read of rx_pkt_status
  bcache: fix deadlock in bcache_allocator
  tracing/kprobe: Check whether the non-suffixed symbol is notrace
  tracing: use kvcalloc for tgid_map array allocation
  x86/crash: Add a forward declaration of struct kimage
  cpufreq: Register drivers only after CPU devices have been registered
  bcache: fix static checker warning in bcache_device_free()
  parport: load lowlevel driver if ports not found
  nvme: Discard workaround for non-conformant devices
  s390/disassembler: don't hide instruction addresses
  ASoC: Intel: kbl_rt5663_rt5514_max98927: Add dmic format constraint
  iio: dac: ad5446: Add support for new AD5600 DAC
  ASoC: rt5677: Mark reg RT5677_PWR_ANLG2 as volatile
  spi: pxa2xx: Add missed security checks
  EDAC/ghes: Fix grain calculation
  media: si470x-i2c: add missed operations in remove
  ice: delay less
  crypto: atmel - Fix authenc support when it is set to m
  soundwire: intel: fix PDI/stream mapping for Bulk
  media: pvrusb2: Fix oops on tear-down when radio support is not present
  fsi: core: Fix small accesses and unaligned offsets via sysfs
  ath10k: fix get invalid tx rate for Mesh metric
  perf probe: Filter out instances except for inlined subroutine and subprogram
  perf probe: Skip end-of-sequence and non statement lines
  perf probe: Fix to show calling lines of inlined functions
  perf probe: Return a better scope DIE if there is no best scope
  perf probe: Skip overlapped location on searching variables
  perf parse: If pmu configuration fails free terms
  xen/gntdev: Use select for DMA_SHARED_BUFFER
  drm/amdgpu: fix potential double drop fence reference
  drm/amdgpu: disallow direct upload save restore list from gfx driver
  perf tools: Splice events onto evlist even on error
  perf probe: Fix to probe a function which has no entry pc
  libsubcmd: Use -O0 with DEBUG=1
  perf probe: Fix to show inlined function callsite without entry_pc
  perf probe: Fix to show ranges of variables in functions without entry_pc
  perf probe: Fix to probe an inline function which has no entry pc
  perf probe: Walk function lines in lexical blocks
  perf jevents: Fix resource leak in process_mapfile() and main()
  perf probe: Fix to list probe event with correct line number
  perf probe: Fix to find range-only function instance
  rtlwifi: fix memory leak in rtl92c_set_fw_rsvdpagepkt()
  ALSA: timer: Limit max amount of slave instances
  spi: img-spfi: fix potential double release
  bnx2x: Fix PF-VF communication over multi-cos queues.
  rfkill: allocate static minor
  nvmem: imx-ocotp: reset error status on probe
  media: v4l2-core: fix touch support in v4l_g_fmt
  media: rcar_drif: fix a memory disclosure
  ixgbe: protect TX timestamping from API misuse
  pinctrl: amd: fix __iomem annotation in amd_gpio_irq_handler()
  Bluetooth: Fix advertising duplicated flags
  libbpf: Fix error handling in bpf_map__reuse_fd()
  iio: dln2-adc: fix iio_triggered_buffer_postenable() position
  pinctrl: sh-pfc: sh7734: Fix duplicate TCLK1_B
  loop: fix no-unmap write-zeroes request behavior
  libata: Ensure ata_port probe has completed before detach
  net: hns3: add struct netdev_queue debug info for TX timeout
  s390/mm: add mm_pxd_folded() checks to pxd_free()
  s390/time: ensure get_clock_monotonic() returns monotonic values
  phy: qcom-usb-hs: Fix extcon double register after power cycle
  net: dsa: LAN9303: select REGMAP when LAN9303 enable
  gpu: host1x: Allocate gather copy for host1x
  RDMA/qedr: Fix memory leak in user qp and mr
  ACPI: button: Add DMI quirk for Medion Akoya E2215T
  spi: sprd: adi: Add missing lock protection when rebooting
  drm/tegra: sor: Use correct SOR index on Tegra210
  net: phy: dp83867: enable robust auto-mdix
  i40e: initialize ITRN registers with correct values
  arm64: psci: Reduce the waiting time for cpu_psci_cpu_kill()
  md/bitmap: avoid race window between md_bitmap_resize and bitmap_file_clear_bit
  media: smiapp: Register sensor after enabling runtime PM on the device
  x86/ioapic: Prevent inconsistent state when moving an interrupt
  ipmi: Don't allow device module unload when in use
  rtl8xxxu: fix RTL8723BU connection failure issue after warm reboot
  drm/gma500: fix memory disclosures due to uninitialized bytes
  perf tests: Disable bp_signal testing for arm64
  x86/mce: Lower throttling MCE messages' priority to warning
  bpf/stackmap: Fix deadlock with rq_lock in bpf_get_stack()
  Bluetooth: hci_core: fix init for HCI_USER_CHANNEL
  Bluetooth: Workaround directed advertising bug in Broadcom controllers
  Bluetooth: missed cpu_to_le16 conversion in hci_init4_req
  iio: adc: max1027: Reset the device at probe time
  usb: usbfs: Suppress problematic bind and unbind uevents.
  perf report: Add warning when libunwind not compiled in
  perf test: Report failure for mmap events
  drm/bridge: dw-hdmi: Restore audio when setting a mode
  ath10k: Correct error handling of dma_map_single()
  x86/mm: Use the correct function type for native_set_fixmap()
  extcon: sm5502: Reset registers during initialization
  drm/amd/display: Fix dongle_caps containing stale information.
  syscalls/x86: Use the correct function type in SYSCALL_DEFINE0
  media: ti-vpe: vpe: fix a v4l2-compliance failure about invalid sizeimage
  media: ti-vpe: vpe: ensure buffers are cleaned up properly in abort cases
  media: ti-vpe: vpe: fix a v4l2-compliance failure causing a kernel panic
  media: ti-vpe: vpe: Make sure YUYV is set as default format
  media: ti-vpe: vpe: fix a v4l2-compliance failure about frame sequence number
  media: ti-vpe: vpe: fix a v4l2-compliance warning about invalid pixel format
  media: ti-vpe: vpe: Fix Motion Vector vpdma stride
  media: cx88: Fix some error handling path in 'cx8800_initdev()'
  drm/drm_vblank: Change EINVAL by the correct errno
  mwifiex: pcie: Fix memory leak in mwifiex_pcie_init_evt_ring
  block: Fix writeback throttling W=1 compiler warnings
  samples: pktgen: fix proc_cmd command result check logic
  drm/bridge: dw-hdmi: Refuse DDC/CI transfers on the internal I2C controller
  media: cec-funcs.h: add status_req checks
  media: flexcop-usb: fix NULL-ptr deref in flexcop_usb_transfer_init()
  regulator: max8907: Fix the usage of uninitialized variable in max8907_regulator_probe()
  hwrng: omap3-rom - Call clk_disable_unprepare() on exit only if not idled
  usb: renesas_usbhs: add suspend event support in gadget mode
  media: venus: Fix occasionally failures to suspend
  selftests/bpf: Correct path to include msg + path
  drm/amdkfd: fix a potential NULL pointer dereference (v2)
  pinctrl: devicetree: Avoid taking direct reference to device name string
  ath10k: fix offchannel tx failure when no ath10k_mac_tx_frm_has_freq
  media: venus: core: Fix msm8996 frequency table
  tools/power/cpupower: Fix initializer override in hsw_ext_cstates
  media: ov6650: Fix stored crop rectangle not in sync with hardware
  media: ov6650: Fix stored frame format not in sync with hardware
  media: i2c: ov2659: Fix missing 720p register config
  media: ov6650: Fix crop rectangle alignment not passed back
  media: i2c: ov2659: fix s_stream return value
  media: am437x-vpfe: Setting STD to current value is not an error
  IB/iser: bound protection_sg size by data_sg size
  ath10k: fix backtrace on coredump
  libertas: fix a potential NULL pointer dereference
  rtlwifi: prevent memory leak in rtl_usb_probe
  staging: rtl8188eu: fix possible null dereference
  staging: rtl8192u: fix multiple memory leaks on error path
  spi: Add call to spi_slave_abort() function when spidev driver is released
  drm/amdgpu: grab the id mgr lock while accessing passid_mapping
  iio: light: bh1750: Resolve compiler warning and make code more readable
  drm/bridge: analogix-anx78xx: silence -EPROBE_DEFER warnings
  drm/panel: Add missing drm_panel_init() in panel drivers
  drm: mst: Fix query_payload ack reply struct
  ALSA: hda/ca0132 - Fix work handling in delayed HP detection
  ALSA: hda/ca0132 - Avoid endless loop
  ALSA: hda/ca0132 - Keep power on during processing DSP response
  ALSA: pcm: Avoid possible info leaks from PCM stream buffers
  Btrfs: fix removal logic of the tree mod log that leads to use-after-free issues
  btrfs: handle ENOENT in btrfs_uuid_tree_iterate
  btrfs: do not leak reloc root if we fail to read the fs root
  btrfs: skip log replay on orphaned roots
  btrfs: abort transaction after failed inode updates in create_subvol
  btrfs: send: remove WARN_ON for readonly mount
  Btrfs: fix missing data checksums after replaying a log tree
  btrfs: do not call synchronize_srcu() in inode_tree_del
  btrfs: don't double lock the subvol_sem for rename exchange
  selftests: forwarding: Delete IPv6 address at the end
  sctp: fully initialize v4 addr in some functions
  qede: Fix multicast mac configuration
  qede: Disable hardware gro when xdp prog is installed
  net: usb: lan78xx: Fix suspend/resume PHY register access error
  net: qlogic: Fix error paths in ql_alloc_large_buffers()
  net: nfc: nci: fix a possible sleep-in-atomic-context bug in nci_uart_tty_receive()
  net: hisilicon: Fix a BUG trigered by wrong bytes_compl
  net: gemini: Fix memory leak in gmac_setup_txqs
  net: dst: Force 4-byte alignment of dst_metrics
  mod_devicetable: fix PHY module format
  fjes: fix missed check in fjes_acpi_add
  af_packet: set defaule value for tmo
  ANDROID: cuttlefish_defconfig: Disable TRANSPARENT_HUGEPAGE

Conflicts:
	drivers/mmc/host/sdhci-msm.c

Change-Id: Ic97e378f655dc8e07f5e5dd5b435ec37f60deac0
Signed-off-by: Ivaylo Georgiev <irgeorgiev@codeaurora.org>
2020-02-03 21:39:14 -08:00
d8ec4cf103 rfkill: Fix incorrect check to avoid NULL pointer dereference
[ Upstream commit 6fc232db9e8cd50b9b83534de9cd91ace711b2d7 ]

In rfkill_register, the struct rfkill pointer is first derefernced
and then checked for NULL. This patch removes the BUG_ON and returns
an error to the caller in case rfkill is NULL.

Signed-off-by: Aditya Pakki <pakki001@umn.edu>
Link: https://lore.kernel.org/r/20191215153409.21696-1-pakki001@umn.edu
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-01-12 12:17:17 +01:00
b542133014 rfkill: allocate static minor
[ Upstream commit 8670b2b8b029a6650d133486be9d2ace146fd29a ]

udev has a feature of creating /dev/<node> device-nodes if it finds
a devnode:<node> modalias. This allows for auto-loading of modules that
provide the node. This requires to use a statically allocated minor
number for misc character devices.

However, rfkill uses dynamic minor numbers and prevents auto-loading
of the module. So allocate the next static misc minor number and use
it for rfkill.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Link: https://lore.kernel.org/r/20191024174042.19851-1-marcel@holtmann.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-12-31 16:35:38 +01:00
bfee6d7f04 Merge remote-tracking branch 'origin/tmp-11da3a7' into msm-kona
* origin/tmp-11da3a7:
  Linux 4.19-rc3
  kbuild: modules_install: warn when missing System.map file
  x86/mm: Use WRITE_ONCE() when setting PTEs
  x86/apic/vector: Make error return value negative
  afs: Fix cell specification to permit an empty address list
  KVM: LAPIC: Fix pv ipis out-of-bounds access
  KVM: nVMX: Fix loss of pending IRQ/NMI before entering L2
  arm64: KVM: Remove pgd_lock
  KVM: Remove obsolete kvm_unmap_hva notifier backend
  arm64: KVM: Only force FPEXC32_EL2.EN if trapping FPSIMD
  KVM: arm/arm64: Clean dcache to PoC when changing PTE due to CoW
  i2c: xiic: Record xilinx i2c with Zynq fragment
  clocksource: Revert "Remove kthread"
  i2c: xiic: Make the start and the byte count write atomic
  irqchip/gic-v3-its: Cap lpi_id_bits to reduce memory footprint
  block: bfq: swap puts in bfqg_and_blkg_put
  memory: ti-aemif: fix a potential NULL-pointer dereference
  arm64: fix erroneous warnings in page freeing functions
  firmware: arm_scmi: fix divide by zero when sustained_perf_level is zero
  printk/tracing: Do not trace printk_nmi_enter()
  rbd: support cloning across namespaces
  rbd: factor out get_parent_info()
  ceph: avoid a use-after-free in ceph_destroy_options()
  cpu/hotplug: Prevent state corruption on error rollback
  cpu/hotplug: Adjust misplaced smb() in cpuhp_thread_fun()
  x86/process: Don't mix user/kernel regs in 64bit __show_regs()
  x86/tsc: Prevent result truncation on 32bit
  ACPI / LPSS: Force LPSS quirks on boot
  ACPI / bus: Only call dmi_check_system() on X86
  block: don't warn when doing fsync on read-only devices
  hwmon: rpi: add module alias to raspberrypi-hwmon
  tracing: Add back in rcu_irq_enter/exit_irqson() for rcuidle tracepoints
  nds32: linker script: GCOV kernel may refers data in __exit
  nilfs2: convert to SPDX license tags
  drivers/dax/device.c: convert variable to vm_fault_t type
  lib/Kconfig.debug: fix three typos in help text
  checkpatch: add __ro_after_init to known $Attribute
  mm: fix BUG_ON() in vmf_insert_pfn_pud() from VM_MIXEDMAP removal
  uapi/linux/keyctl.h: don't use C++ reserved keyword as a struct member name
  memory_hotplug: fix kernel_panic on offline page processing
  checkpatch: add optional static const to blank line declarations test
  ipc/shm: properly return EIDRM in shm_lock()
  mm/hugetlb: filter out hugetlb pages if HUGEPAGE migration is not supported.
  mm/util.c: improve kvfree() kerneldoc
  tools/vm/page-types.c: fix "defined but not used" warning
  tools/vm/slabinfo.c: fix sign-compare warning
  kmemleak: always register debugfs file
  mm: respect arch_dup_mmap() return value
  mm, oom: fix missing tlb_finish_mmu() in __oom_reap_task_mm().
  mm: memcontrol: print proper OOM header when no eligible victim left
  ARC: don't check for HIGHMEM pages in arch_dma_alloc
  ARC: IOC: panic if both IOC and ZONE_HIGHMEM enabled
  ARC: dma [IOC] Enable per device io coherency
  net: phy: sfp: Handle unimplemented hwmon limits and alarms
  net: sched: action_ife: take reference to meta module
  act_ife: fix a potential use-after-free
  net/mlx5: Fix SQ offset in QPs with small RQ
  nbd: don't allow invalid blocksize settings
  i2c: i801: fix DNV's SMBCTRL register offset
  KVM: s390: Properly lock mm context allow_gmap_hpage_1m setting
  KVM: s390: vsie: copy wrapping keys to right place
  KVM: s390: Fix pfmf and conditional skey emulation
  nds32: fix build error because of wrong semicolon
  nds32: Fix a kernel panic issue because of wrong frame pointer access.
  nds32: Only print one page of stack when die to prevent printing too much information.
  nds32: Add macro definition for offset of lp register on stack
  nds32: Remove the deprecated ABI implementation
  nds32/stack: Get real return address by using ftrace_graph_ret_addr
  nds32/ftrace: Support dynamic function graph tracer
  nds32/ftrace: Support dynamic function tracer
  nds32/ftrace: Add RECORD_MCOUNT support
  nds32/ftrace: Support static function graph tracer
  nds32/ftrace: Support static function tracer
  nds32: Extract the checking and getting pointer to a macro
  nds32: Clean up the coding style
  nds32: Fix get_user/put_user macro expand pointer problem
  nds32: Fix empty call trace
  nds32: add NULL entry to the end of_device_id array
  nds32: fix logic for module
  tipc: correct spelling errors for tipc_topsrv_queue_evt() comments
  tipc: correct spelling errors for struct tipc_bc_base's comment
  bnxt_en: Do not adjust max_cp_rings by the ones used by RDMA.
  bnxt_en: Clean up unused functions.
  bnxt_en: Fix firmware signaled resource change logic in open.
  sctp: not traverse asoc trans list if non-ipv6 trans exists for ipv6_flowlabel
  sctp: fix invalid reference to the index variable of the iterator
  net/ibm/emac: wrong emac_calc_base call was used by typo
  net: sched: null actions array pointer before releasing action
  drm/i915/dp_mst: Fix enabling pipe clock for all streams
  drm/i915/dsc: Fix PPS register definition macros for 2nd VDSC engine
  drm/i915: Re-apply "Perform link quality check, unconditionally during long pulse"
  vhost: fix VHOST_GET_BACKEND_FEATURES ioctl request definition
  r8169: add support for NCube 8168 network card
  ip6_tunnel: respect ttl inherit for ip6tnl
  ALSA: hda: Fix several mismatch for register mask and value
  apparmor: fix bad debug check in apparmor_secid_to_secctx()
  ALSA: rawmidi: Initialize allocated buffers
  fsnotify: fix ignore mask logic in fsnotify()
  timekeeping: Fix declaration of read_persistent_wall_and_boot_offset()
  x86: Fix kernel-doc atomic.h warnings
  mac80211: shorten the IBSS debug messages
  mac80211: don't Tx a deauth frame if the AP forbade Tx
  mac80211: Fix station bandwidth setting after channel switch
  mac80211: fix a race between restart and CSA flows
  mac80211: fix WMM TXOP calculation
  cfg80211: fix a type issue in ieee80211_chandef_to_operating_class()
  mac80211: fix an off-by-one issue in A-MSDU max_subframe computation
  drm/i915/gvt: Give new born vGPU higher scheduling chance
  cifs: connect to servername instead of IP for IPC$ share
  smb3: check for and properly advertise directory lease support
  smb3: minor debugging clarifications in rfc1001 len processing
  SMB3: Backup intent flag missing for directory opens with backupuid mounts
  fs/cifs: don't translate SFM_SLASH (U+F026) to backslash
  m68k: fix early memory reservation for ColdFire MMU systems
  uapi: Fix linux/rds.h userspace compilation errors.
  net: cadence: Fix a sleep-in-atomic-context bug in macb_halt_tx()
  i2c: imx-lpi2c: Remove mx8dv compatible entry
  dt-bindings: imx-lpi2c: Remove mx8dv compatible entry
  i2c: uniphier-f: issue STOP only for last message or I2C_M_STOP
  i2c: uniphier: issue STOP only for last message or I2C_M_STOP
  net/ipv6: Only update MTU metric if it set
  net: ethernet: cpsw-phy-sel: prefer phandle for phy sel
  dt-bindings: net: cpsw: Document cpsw-phy-sel usage but prefer phandle
  igmp: fix incorrect unsolicit report count after link down and up
  igmp: fix incorrect unsolicit report count when join group
  bpf: avoid misuse of psock when TCP_ULP_BPF collides with another ULP
  tools/bpf: bpftool, add xskmap in map types
  bpf: Fix bpf_msg_pull_data()
  kbuild: make missing $DEPMOD a Warning instead of an Error
  kconfig: do not require pkg-config on make {menu,n}config
  x86/microcode: Update the new microcode revision unconditionally
  x86/microcode: Make sure boot_cpu_data.microcode is up-to-date
  of/platform: initialise AMBA default DMA masks
  sparc: set a default 32-bit dma mask for OF devices
  ipv6: don't get lwtstate twice in ip6_rt_copy_init()
  random: make CPU trust a boot parameter
  kernel/dma/direct: take DMA offset into account in dma_direct_supported
  ibmvnic: Include missing return code checks in reset function
  selftests: pmtu: detect correct binary to ping ipv6 addresses
  selftests: pmtu: maximum MTU for vti4 is 2^16-1-20
  tcp: do not restart timewait timer on rst reception
  net/rds: RDS is not Radio Data System
  hv_netvsc: Fix a deadlock by getting rtnl lock earlier in netvsc_probe()
  nfp: wait for posted reconfigs when disabling the device
  Revert "packet: switch kvzalloc to allocate memory"
  md-cluster: release RESYNC lock after the last resync message
  RAID10 BUG_ON in raise_barrier when force is true and conf->barrier is 0
  md/raid5-cache: disable reshape completely
  blkcg: use tryget logic when associating a blkg with a bio
  blkcg: delay blkg destruction until after writeback has finished
  Revert "blk-throttle: fix race between blkcg_bio_issue_check() and cgroup_rmdir()"
  ARC: dma [IOC]: mark DMA devices connected as dma-coherent
  ARC: atomics: unbork atomic_fetch_##op()
  MIPS: VDSO: Match data page cache colouring when D$ aliases
  kconfig: remove a spurious self-assignment
  scripts/setlocalversion: git: Make -dirty check more robust
  gpio: Fix crash due to registration race
  arc: remove redundant GCC version checks
  tools/kvm_stat: re-animate display of dead guests
  tools/kvm_stat: indicate dead guests as such
  tools/kvm_stat: handle guest removals more gracefully
  tools/kvm_stat: don't reset stats when setting PID filter for debugfs
  tools/kvm_stat: fix updates for dead guests
  tools/kvm_stat: fix handling of invalid paths in debugfs provider
  tools/kvm_stat: fix python3 issues
  KVM: x86: Unexport x86_emulate_instruction()
  KVM: x86: Rename emulate_instruction() to kvm_emulate_instruction()
  KVM: x86: Do not re-{try,execute} after failed emulation in L2
  KVM: x86: Default to not allowing emulation retry in kvm_mmu_page_fault
  KVM: x86: Merge EMULTYPE_RETRY and EMULTYPE_ALLOW_REEXECUTE
  KVM: x86: Invert emulation re-execute behavior to make it opt-in
  KVM: x86: SVM: Set EMULTYPE_NO_REEXECUTE for RSM emulation
  KVM: VMX: Do not allow reexecute_instruction() when skipping MMIO instr
  KVM: SVM: remove unused variable dst_vaddr_end
  KVM: nVMX: avoid redundant double assignment of nested_run_pending
  ALSA: hda - Fix cancel_work_sync() stall from jackpoll work
  mac80211: always account for A-MSDU header changes
  mac80211: do not convert to A-MSDU if frag/subframe limited
  cfg80211: nl80211_update_ft_ies() to validate NL80211_ATTR_IE
  tc-testing: add test-cases for numeric and invalid control action
  net_sched: reject unknown tcfa_action values
  net: mvpp2: initialize port of_node pointer
  drm/i915/gvt: Fix drm_format_mod value for vGPU plane
  drm/i915/gvt: move intel_runtime_pm_get out of spin_lock in stop_schedule
  drm/i915/gvt: Handle GEN9_WM_CHICKEN3 with F_CMD_ACCESS.
  drm/i915/gvt: Make correct handling to vreg BXT_PHY_CTL_FAMILY
  drm/i915/gvt: emulate gen9 dbuf ctl register access
  net: bcmgenet: use MAC link status for fixed phy
  net: stmmac: build the dwmac-socfpga platform driver for Stratix10
  net: rtnl: return early from rtnl_unregister_all when protocol isn't registered
  ipv6: fix cleanup ordering for pingv6 registration
  ipv6: fix cleanup ordering for ip6_mr failure
  net/sched: act_pedit: fix dump of extended layered op
  sh_eth: Add R7S9210 support
  net: hns: add netif_carrier_off before change speed and duplex
  net: hns: add the code for cleaning pkt in chip
  r8169: set RxConfig after tx/rx is enabled for RTL8169sb/8110sb devices
  tipc: switch to rhashtable iterator
  Revert "net: stmmac: Do not keep rearming the coalesce timer in stmmac_xmit"
  tipc: fix a missing rhashtable_walk_exit()
  vti6: remove !skb->ignore_df check from vti6_xmit()
  bpf: fix sg shift repair start offset in bpf_msg_pull_data
  bpf: fix shift upon scatterlist ring wrap-around in bpf_msg_pull_data
  bpf: fix msg->data/data_end after sg shift repair in bpf_msg_pull_data
  gpio: dwapb: Fix error handling in dwapb_gpio_probe()
  gpiolib-acpi: Register GpioInt ACPI event handlers from a late_initcall
  gpiolib: acpi: Switch to cansleep version of GPIO library call
  mac80211: avoid kernel panic when building AMSDU from non-linear SKB
  mac80211: mesh: fix HWMP sequence numbering to follow standard
  gpio: adp5588: Fix sleep-in-atomic-context bug
  bpf: fix several offset tests in bpf_msg_pull_data
  nl80211: Pass center frequency in kHz instead of MHz
  nl80211: Fix nla_put_u8 to u16 for NL80211_WMMR_TXOP
  mac80211_hwsim: Fix possible Spectre-v1 for hwsim_world_regdom_custom
  mac80211: don't update the PM state of a peer upon a multicast frame
  cfg80211: make wmm_rule part of the reg_rule structure
  mac80211_hwsim: correct use of IEEE80211_VHT_CAP_RXSTBC_X
  mac80211: correct use of IEEE80211_VHT_CAP_RXSTBC_X
  bpf: sockmap, decrement copied count correctly in redirect error case
  bpf: fix build error with clang
  bpf, sockmap: fix psock refcount leak in bpf_tcp_recvmsg
  bpf, sockmap: fix potential use after free in bpf_tcp_close
  net/rds: Use rdma_read_gids to get connection SGID/DGID in IPv6
  net: dsa: Drop GPIO includes
  tipc: fix the big/little endian issue in tipc_dest
  net: sched: return -ENOENT when trying to remove filter from non-existent chain
  net: sched: fix extack error message when chain is failed to be created
  erspan: set erspan_ver to 1 by default when adding an erspan dev
  sctp: remove useless start_fail from sctp_ht_iter in proc
  sctp: hold transport before accessing its asoc in sctp_transport_get_next
  scsi: aacraid: fix a signedness bug
  Revert "scsi: core: avoid host-wide host_busy counter for scsi_mq"
  Revert "scsi: core: fix scsi_host_queue_ready"
  scsi: libata: Add missing newline at end of file
  scsi: target: iscsi: cxgbit: use pr_debug() instead of pr_info()
  scsi: hpsa: limit transfer length to 1MB, not 512kB
  scsi: lpfc: Correct MDS diag and nvmet configuration
  scsi: lpfc: Default fdmi_on to on
  scsi: csiostor: fix incorrect port capabilities
  scsi: csiostor: add a check for NULL pointer after kmalloc()
  scsi: documentation: add scsi_mod.use_blk_mq to scsi-parameters
  scsi: core: Update SCSI_MQ_DEFAULT help text to match default
  ARC: sort Kconfig
  ARC: cleanup show_faulting_vma()
  ARC: [plat-axs*]: Enable SWAP
  ARC: [plat-axs*/plat-hsdk]: Allow U-Boot to pass MAC-address to the kernel
  ARC: configs: cleanup
  arm64: allwinner: dts: h6: fix Pine H64 MMC bus width
  btrfs: Fix suspicious RCU usage warning in btrfs_debug_in_rcu
  btrfs: use after free in btrfs_quota_enable
  btrfs: btrfs_shrink_device should call commit transaction at the end
  btrfs: fix qgroup_free wrong num_bytes in btrfs_subvolume_reserve_metadata
  Btrfs: fix data corruption when deduplicating between different files
  Btrfs: sync log after logging new name
  cfg80211: remove division by size of sizeof(struct ieee80211_wmm_rule)
  KVM: PPC: Book3S HV: Don't truncate HPTE index in xlate function
  Btrfs: fix unexpected failure of nocow buffered writes after snapshotting when low on space
  mac80211_hwsim: require at least one channel
  KVM: PPC: Book3S HV: Use correct pagesize in kvm_unmap_radix()
  mac80211: Run TXQ teardown code before de-registering interfaces
  rfkill-gpio: include linux/mod_devicetable.h

Change-Id: Ic6d1654e67ece823a5fce6ae18d241ad350bfb08
Signed-off-by: Rishabh Bhatnagar <rishabhb@codeaurora.org>
2018-09-14 11:24:01 -07:00
fc3e3bf55f Merge tag 'mac80211-for-davem-2018-09-03' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211
Johannes Berg says:

====================
Here are quite a large number of fixes, notably:
 * various A-MSDU building fixes (currently only affects mt76)
 * syzkaller & spectre fixes in hwsim
 * TXQ vs. teardown fix that was causing crashes
 * embed WMM info in reg rule, bad code here had been causing crashes
 * one compilation issue with fix from Arnd (rfkill-gpio includes)
 * fixes for a race and bad data during/after channel switch
 * nl80211: a validation fix, attribute type & unit fixes
along with other small fixes.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2018-09-03 22:12:02 -07:00
37de588f8f ANDROID: net: rfkill: Introduce CONFIG_RFKILL_PM and use instead of CONFIG_PM to power down
Some platforms do not want to power down rfkill devices on suspend.

Change-Id: I62a11630521c636d54a4a02ab9037a43435925f5
Signed-off-by: Nick Pelly <npelly@google.com>

[AmitP: Folded following android-4.9 commit changes into this patch
        faad2b874fea ("rfkill: fix unused function warning")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
2018-08-28 17:10:42 +05:30
f623f75ae4 rfkill-gpio: include linux/mod_devicetable.h
One more driver is apparently broken by the recent change
to linux/platform_device.h:

net/rfkill/rfkill-gpio.c: In function 'rfkill_gpio_acpi_probe':
net/rfkill/rfkill-gpio.c:82:29: error: dereferencing pointer to incomplete type 'const struct acpi_device_id'

Include linux/mod_devicetable.h to get the definition of the
acpi_device_id structure.

Fixes: ac3167257b ("headers: separate linux/mod_devicetable.h from linux/platform_device.h")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2018-08-14 13:59:28 +02:00
2282e125a4 leds: triggers: let struct led_trigger::activate() return an error code
Given that activating a trigger can fail, let the callback return an
indication. This prevents to have a trigger active according to the
"trigger" sysfs attribute but not functional.

All users are changed accordingly to return 0 for now. There is no intended
change in behaviour.

Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
2018-07-05 23:21:10 +02:00
232aa23ec3 rfkill: Create rfkill-none LED trigger
Creates a new trigger rfkill-none, as a complement to rfkill-any, which
drives LEDs when any radio is enabled. The new trigger is meant to turn
a LED ON whenever all radios are OFF, and turn it OFF otherwise.

Signed-off-by: João Paulo Rechi Vita <jprvita@endlessm.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2018-05-23 11:26:45 +02:00
d874cd7430 rfkill: Rename rfkill_any_led_trigger* functions
Rename these functions to rfkill_global_led_trigger*, as they are going
to be extended to handle another global rfkill led trigger.

This commit does not change any functionality.

Signed-off-by: João Paulo Rechi Vita <jprvita@endlessm.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2018-05-23 11:25:05 +02:00
4bf01ca21e rfkill: gpio: fix memory leak in probe error path
Make sure to free the rfkill device in case registration fails during
probe.

Fixes: 5e7ca3937f ("net: rfkill: gpio: convert to resource managed allocation")
Cc: stable <stable@vger.kernel.org>	# 3.13
Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2018-05-07 15:01:40 +02:00
a9a08845e9 vfs: do bulk POLL* -> EPOLL* replacement
This is the mindless scripted replacement of kernel use of POLL*
variables as described by Al, done by this script:

    for V in IN OUT PRI ERR RDNORM RDBAND WRNORM WRBAND HUP RDHUP NVAL MSG; do
        L=`git grep -l -w POLL$V | grep -v '^t' | grep -v /um/ | grep -v '^sa' | grep -v '/poll.h$'|grep -v '^D'`
        for f in $L; do sed -i "-es/^\([^\"]*\)\(\<POLL$V\>\)/\\1E\\2/" $f; done
    done

with de-mangling cleanups yet to come.

NOTE! On almost all architectures, the EPOLL* constants have the same
values as the POLL* constants do.  But they keyword here is "almost".
For various bad reasons they aren't the same, and epoll() doesn't
actually work quite correctly in some cases due to this on Sparc et al.

The next patch from Al will sort out the final differences, and we
should be all done.

Scripted-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2018-02-11 14:34:03 -08:00
ade994f4f6 net: annotate ->poll() instances
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2017-11-27 16:20:04 -05:00
4524667b1e net: rfkill: gpio: Switch to devm_acpi_dev_add_driver_gpios()
Switch to use managed variant of acpi_dev_add_driver_gpios() to simplify
error path and fix potentially wrong assingment if ->probe() fails.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2017-06-13 11:07:51 +02:00
1331b62c97 rfkill: remove rfkill-regulator
There are no users of this ("vrfkill") in the tree, so it's just
dead code - remove it.

This also isn't really how rfkill is supposed to be used - it's
intended as a signalling mechanism to/from the device, which the
driver (and partially cfg80211) will handle - having a separate
rfkill instance for a regulator is confusing, the driver should
use the regulator instead to turn off the device when requested.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2017-01-24 11:07:35 +01:00
9b8e34e211 rfkill: Add rfkill-any LED trigger
Add a new "global" (i.e. not per-rfkill device) LED trigger, rfkill-any,
which may be useful on laptops with a single "radio LED" and multiple
radio transmitters.  The trigger is meant to turn a LED on whenever
there is at least one radio transmitter active and turn it off
otherwise.

Signed-off-by: Michał Kępień <kernel@kempniu.pl>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2017-01-09 11:40:33 +01:00
7b854982b2 Revert "rfkill: Add rfkill-any LED trigger"
This reverts commit 73f4f76a19.

As Mike reported, and I should've seen in review, we can't call
the new LED functions, which acquire the mutex, from places like
rfkill_set_sw_state() that are documented to be callable from
any context the user likes to use. For Mike's case it led to a
deadlock, but other scenarios are possible.

Reported-by: Михаил Кринкин <krinkin.m.u@gmail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2016-12-20 08:45:54 +01:00
f6b4122c93 rfkill: hide unused goto label
A cleanup introduced a harmless warning in some configurations:

net/rfkill/core.c: In function 'rfkill_init':
net/rfkill/core.c:1350:1: warning: label 'error_input' defined but not used [-Wunused-label]

This adds another #ifdef around the label to match that around the
caller.

Fixes: 6124c53ede ("rfkill: Cleanup error handling in rfkill_init()")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2016-12-16 10:05:39 +01:00
73f4f76a19 rfkill: Add rfkill-any LED trigger
Add a new "global" (i.e. not per-rfkill device) LED trigger, rfkill-any,
which may be useful on laptops with a single "radio LED" and multiple
radio transmitters.  The trigger is meant to turn a LED on whenever
there is at least one radio transmitter active and turn it off
otherwise.

This requires taking rfkill_global_mutex before calling rfkill_set_block()
in rfkill_resume(): since __rfkill_any_led_trigger_event() is called from
rfkill_set_block() unconditionally, each caller of the latter needs to
take care of locking rfkill_global_mutex.

Signed-off-by: Michał Kępień <kernel@kempniu.pl>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2016-12-13 16:20:29 +01:00
6124c53ede rfkill: Cleanup error handling in rfkill_init()
Use a separate label per error condition in rfkill_init() to make it a
bit cleaner and easier to extend.

Signed-off-by: Michał Kępień <kernel@kempniu.pl>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2016-12-13 16:20:29 +01:00
74204f8fa1 rfkill: simplify rfkill_set_hw_state() slightly
Simplify the two conditions gating the schedule_work() into
a single one and get rid of the additional exit point from
the function in doing so.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2016-12-13 16:04:35 +01:00
1948b2a2ec rfkill: Use switch to demux userspace operations
Using a switch to handle different ev.op values in rfkill_fop_write()
makes the code easier to extend, as out-of-range values can always be
handled by the default case.

Signed-off-by: João Paulo Rechi Vita <jprvita@endlessm.com>
[roll in fix for RFKILL_OP_CHANGE from Jouni]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2016-04-05 10:48:53 +02:00
d67703fced Merge tag 'mac80211-next-for-davem-2016-02-26' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next
Johannes Berg says:

====================
Here's another round of updates for -next:
 * big A-MSDU RX performance improvement (avoid linearize of paged RX)
 * rfkill changes: cleanups, documentation, platform properties
 * basic PBSS support in cfg80211
 * MU-MIMO action frame processing support
 * BlockAck reordering & duplicate detection offload support
 * various cleanups & little fixes
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
2016-03-01 17:03:27 -05:00
9487bd6b96 rfkill: Factor rfkill_global_states[].cur assignments
Factor all assignments to rfkill_global_states[].cur into a single
function rfkill_update_global_state().

Signed-off-by: João Paulo Rechi Vita <jprvita@endlessm.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2016-02-24 09:13:11 +01:00
1a1078901b rfkill: Remove extra blank line
Signed-off-by: João Paulo Rechi Vita <jprvita@endlessm.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2016-02-24 09:13:10 +01:00
3ff707d668 rfkill: Improve documentation language
Signed-off-by: João Paulo Rechi Vita <jprvita@endlessm.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2016-02-24 09:13:09 +01:00
fb2e6b7b7b net: rfkill: gpio: remove rfkill_gpio_platform_data
No more users for it.

Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2016-02-24 09:13:09 +01:00
7d5e9737ef net: rfkill: gpio: get the name and type from device property
This prepares the driver for removal of platform data.

Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2016-02-24 09:13:08 +01:00
648b50dd6a net: rfkill: add rfkill_find_type function
Helper for finding the type based on name. Useful if the
type needs to be determined based on device property.

Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
[modify rfkill_types array and BUILD_BUG_ON to not cause errors]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2016-02-24 09:12:45 +01:00
e2a35e8929 rfkill: Remove obsolete "claim" sysfs interface
This was scheduled to be removed in 2012 by:

 commit 69c86373c6
 Author: florian@mickler.org <florian@mickler.org>
 Date:   Wed Feb 24 12:05:16 2010 +0100

     Document the rfkill sysfs ABI

     This moves sysfs ABI info from Documentation/rfkill.txt to the
     ABI subfolder and reformats it.

     This also schedules the deprecated sysfs parts to be removed in
     2012 (claim file) and 2014 (state file).

     Signed-off-by: Florian Mickler <florian@mickler.org>
     Signed-off-by: John W. Linville <linville@tuxdriver.com>

Signed-off-by: João Paulo Rechi Vita <jprvita@endlessm.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2016-02-24 09:04:24 +01:00
1926e260d8 rfkill: remove/inline __rfkill_set_hw_state
__rfkill_set_hw_state() is only one used in rfkill_set_hw_state(), and
none of them are long or complicated, so merging the two makes the code
easier to read.

Signed-off-by: João Paulo Rechi Vita <jprvita@endlessm.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2016-02-24 09:04:24 +01:00
f3e7fae248 rfkill: use variable instead of duplicating the expression
RFKILL_BLOCK_SW value have just been saved to prev, no need to check it
again in the if expression. This makes code a little bit easier to read.

Signed-off-by: João Paulo Rechi Vita <jprvita@endlessm.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2016-02-24 09:04:23 +01:00
dd21dfc645 rfkill: disentangle polling pause and suspend
When suspended while polling is paused, polling will erroneously
resume at resume time. Fix this by tracking pause and suspend in
separate state variable and adding the necessary checks.

Clarify the documentation on this as well.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2016-02-24 09:04:22 +01:00
6736fde967 rfkill: fix rfkill_fop_read wait_event usage
The code within wait_event_interruptible() is called with
!TASK_RUNNING, so mustn't call any functions that can sleep,
like mutex_lock().

Since we re-check the list_empty() in a loop after the wait,
it's safe to simply use list_empty() without locking.

This bug has existed forever, but was only discovered now
because all userspace implementations, including the default
'rfkill' tool, use poll() or select() to get a readable fd
before attempting to read.

Cc: stable@vger.kernel.org
Fixes: c64fb01627 ("rfkill: create useful userspace interface")
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2016-01-26 11:32:05 +01:00
d3d2072540 Bluetooth: hci_bcm: move all Broadcom ACPI IDs to BCM HCI driver
The IDs should all be for Broadcom BCM43241 module, and
hci_bcm is now the proper driver for them. This removes one
of two different ways of handling PM with the module.

Cc: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2016-01-04 19:22:05 +01:00