Merge tag 'ASB-2023-05-05_4.19-stable' of...

Merge tag 'ASB-2023-05-05_4.19-stable' of https://android.googlesource.com/kernel/common into android13-4.19-kona

https://source.android.com/docs/security/bulletin/2023-05-01
CVE-2023-21102
CVE-2023-21106
CVE-2023-0266

* tag 'ASB-2023-05-05_4.19-stable' of https://android.googlesource.com/kernel/common:
  Linux 4.19.282
  ASN.1: Fix check for strdup() success
  iio: adc: at91-sama5d2_adc: fix an error code in at91_adc_allocate_trigger()
  counter: 104-quad-8: Fix race condition between FLAG and CNTR reads
  sctp: Call inet6_destroy_sock() via sk->sk_destruct().
  dccp: Call inet6_destroy_sock() via sk->sk_destruct().
  inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy().
  tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct().
  udp: Call inet6_destroy_sock() in setsockopt(IPV6_ADDRFORM).
  ext4: fix use-after-free in ext4_xattr_set_entry
  ext4: remove duplicate definition of ext4_xattr_ibody_inline_set()
  Revert "ext4: fix use-after-free in ext4_xattr_set_entry"
  x86/purgatory: Don't generate debug info for purgatory.ro
  memstick: fix memory leak if card device is never registered
  nilfs2: initialize unused bytes in segment summary blocks
  xen/netback: use same error messages for same errors
  s390/ptrace: fix PTRACE_GET_LAST_BREAK error handling
  net: dsa: b53: mmap: add phy ops
  scsi: core: Improve scsi_vpd_inquiry() checks
  scsi: megaraid_sas: Fix fw_crash_buffer_show()
  selftests: sigaltstack: fix -Wuninitialized
  Input: i8042 - add quirk for Fujitsu Lifebook A574/H
  f2fs: Fix f2fs_truncate_partial_nodes ftrace event
  e1000e: Disable TSO on i219-LM card to increase speed
  mlxfw: fix null-ptr-deref in mlxfw_mfa2_tlv_next()
  i40e: fix i40e_setup_misc_vector() error handling
  i40e: fix accessing vsi->active_filters without holding lock
  virtio_net: bugfix overflow inside xdp_linearize_page()
  net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg
  ARM: dts: rockchip: fix a typo error for rk3288 spdif node
  Linux 4.19.281
  arm64: KVM: Fix system register enumeration
  KVM: arm64: Filter out invalid core register IDs in KVM_GET_REG_LIST
  KVM: arm64: Factor out core register ID enumeration
  KVM: nVMX: add missing consistency checks for CR0 and CR4
  coresight-etm4: Fix for() loop drvdata->nr_addr_cmp range bug
  watchdog: sbsa_wdog: Make sure the timeout programming is within the limits
  cgroup/cpuset: Wake up cpuset_attach_wq tasks in cpuset_cancel_attach()
  ubi: Fix deadlock caused by recursively holding work_sem
  mtd: ubi: wl: Fix a couple of kernel-doc issues
  ubi: Fix failure attaching when vid_hdr offset equals to (sub)page size
  x86/PCI: Add quirk for AMD XHCI controller that loses MSI-X state in D3hot
  scsi: ses: Handle enclosure with just a primary component gracefully
  verify_pefile: relax wrapper length check
  efi: sysfb_efi: Add quirk for Lenovo Yoga Book X91F/L
  i2c: imx-lpi2c: clean rx/tx buffers upon new message
  power: supply: cros_usbpd: reclassify "default case!" as debug
  udp6: fix potential access to stale information
  net: macb: fix a memory corruption in extended buffer descriptor mode
  sctp: fix a potential overflow in sctp_ifwdtsn_skip
  qlcnic: check pci_reset_function result
  niu: Fix missing unwind goto in niu_alloc_channels()
  9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition
  mtdblock: tolerate corrected bit-flips
  Bluetooth: Fix race condition in hidp_session_thread
  Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}
  ALSA: hda/sigmatel: fix S/PDIF out on Intel D*45* motherboards
  ALSA: i2c/cs8427: fix iec958 mixer control deactivation
  ALSA: hda/sigmatel: add pin overrides for Intel DP45SG motherboard
  ALSA: emu10k1: fix capture interrupt handler unlinking
  Revert "pinctrl: amd: Disable and mask interrupts on resume"
  mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()
  ring-buffer: Fix race while reader and writer are on the same page
  ftrace: Mark get_lock_parent_ip() __always_inline
  perf/core: Fix the same task check in perf_event_set_output
  ALSA: hda/realtek: Add quirk for Clevo X370SNW
  nilfs2: fix sysfs interface lifetime
  nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread()
  tty: serial: sh-sci: Fix Rx on RZ/G2L SCI
  tty: serial: sh-sci: Fix transmit end interrupt handler
  iio: dac: cio-dac: Fix max DAC write value check for 12-bit
  USB: serial: option: add Quectel RM500U-CN modem
  USB: serial: option: add Telit FE990 compositions
  USB: serial: cp210x: add Silicon Labs IFS-USB-DATACABLE IDs
  gpio: davinci: Add irq chip flag to skip set wake
  ipv6: Fix an uninit variable access bug in __ip6_make_skb()
  sctp: check send stream number after wait_for_sndbuf
  net: don't let netpoll invoke NAPI if in xmit context
  icmp: guard against too small mtu
  wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta
  pwm: cros-ec: Explicitly set .polarity in .get_state()
  NFSv4: Fix hangs when recovering open state after a server reboot
  NFSv4: Check the return value of update_open_stateid()
  NFSv4: Convert struct nfs4_state to use refcount_t
  pinctrl: amd: Disable and mask interrupts on resume
  pinctrl: amd: disable and mask interrupts on probe
  pinctrl: amd: Use irqchip template
  pinctrl: Added IRQF_SHARED flag for amd-pinctrl driver
  Revert "dm thin: fix deadlock when swapping to thin device"
  Linux 4.19.280
  cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all()
  cgroup: Fix threadgroup_rwsem <-> cpus_read_lock() deadlock
  cgroup/cpuset: Change cpuset_rwsem and hotplug lock order
  net: sched: cbq: dont intepret cls results when asked to drop
  gfs2: Always check inode size of inline inodes
  firmware: arm_scmi: Fix device node validation for mailbox transport
  ext4: fix kernel BUG in 'ext4_write_inline_data_end()'
  usb: host: ohci-pxa27x: Fix and & vs | typo
  s390/uaccess: add missing earlyclobber annotations to __clear_user()
  drm/etnaviv: fix reference leak when mmaping imported buffer
  ALSA: usb-audio: Fix regression on detection of Roland VS-100
  ALSA: hda/conexant: Partial revert of a quirk for Lenovo
  pinctrl: at91-pio4: fix domain name assignment
  xen/netback: don't do grant copy across page boundary
  cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL
  cifs: prevent infinite recursion in CIFSGetDFSRefer()
  Input: focaltech - use explicitly signed char type
  Input: alps - fix compatibility with -funsigned-char
  net: mvneta: make tx buffer array agnostic
  net: dsa: mv88e6xxx: Enable IGMP snooping on user ports only
  i40e: fix registers dump after run ethtool adapter self test
  can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write
  scsi: megaraid_sas: Fix crash after a double completion
  ca8210: Fix unsigned mac_len comparison with zero in ca8210_skb_tx()
  fbdev: au1200fb: Fix potential divide by zero
  fbdev: lxfb: Fix potential divide by zero
  fbdev: intelfb: Fix potential divide by zero
  fbdev: nvidia: Fix potential divide by zero
  sched_getaffinity: don't assume 'cpumask_size()' is fully initialized
  fbdev: tgafb: Fix potential divide by zero
  ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set()
  ALSA: asihpi: check pao in control_message()
  md: avoid signed overflow in slot_store()
  bus: imx-weim: fix branch condition evaluates to a garbage value
  ocfs2: fix data corruption after failed write
  tun: avoid double free in tun_free_netdev
  sched/fair: Sanitize vruntime of entity being migrated
  sched/fair: sanitize vruntime of entity being placed
  dm crypt: add cond_resched() to dmcrypt_write()
  dm stats: check for and propagate alloc_percpu failure
  i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer()
  nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy()
  usb: chipidea: core: fix possible concurrent when switch role
  usb: chipdea: core: fix return -EINVAL if request role is the same with current role
  dm thin: fix deadlock when swapping to thin device
  igb: revert rtnl_lock() that causes deadlock
  usb: gadget: u_audio: don't let userspace block driver unbind
  scsi: core: Add BLIST_SKIP_VPD_PAGES for SKhynix H28U74301AMR
  cifs: empty interface list when server doesn't support query interfaces
  sh: sanitize the flags on sigreturn
  net: usb: qmi_wwan: add Telit 0x1080 composition
  net: usb: cdc_mbim: avoid altsetting toggling for Telit FE990
  scsi: ufs: core: Add soft dependency on governor_simpleondemand
  scsi: target: iscsi: Fix an error message in iscsi_check_key()
  m68k: Only force 030 bus error if PC not in exception table
  ca8210: fix mac_len negative array access
  riscv: Bump COMMAND_LINE_SIZE value to 1024
  thunderbolt: Use const qualifier for `ring_interrupt_index`
  uas: Add US_FL_NO_REPORT_OPCODES for JMicron JMS583Gen 2
  hwmon (it87): Fix voltage scaling for chips with 10.9mV ADCs
  Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work
  Bluetooth: btqcomsmd: Fix command timeout after setting BD address
  net: mdio: thunder: Add missing fwnode_handle_put()
  hvc/xen: prevent concurrent accesses to the shared ring
  net/sonic: use dma_mapping_error() for error check
  erspan: do not use skb_mac_header() in ndo_start_xmit()
  atm: idt77252: fix kmemleak when rmmod idt77252
  net/mlx5: Read the TC mapping of all priorities on ETS query
  bpf: Adjust insufficient default bpf_jit_limit
  net/ps3_gelic_net: Use dma_mapping_error
  net/ps3_gelic_net: Fix RX sk_buff length
  net: qcom/emac: Fix use after free bug in emac_remove due to race condition
  xirc2ps_cs: Fix use after free bug in xirc2ps_detach
  qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info
  net: usb: smsc95xx: Limit packet length to skb->len
  scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate()
  i2c: imx-lpi2c: check only for enabled interrupt flags
  igbvf: Regard vf reset nack as success
  intel/igbvf: free irq on the error path in igbvf_request_msix()
  iavf: fix inverted Rx hash condition leading to disabled hash
  iavf: diet and reformat
  intel-ethernet: rename i40evf to iavf
  i40evf: Change a VF mac without reloading the VF driver
  power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition

 Conflicts:
	kernel/cgroup/cpuset.c

Change-Id: Ic09017614f20bff94eb0b913bb7fb5b9656dc272