Commit b4a6b74b authored Sep 21, 2022 by Greg Kroah-Hartman

Merge 5.4.213 into android11-5.4-lts



Changes in 5.4.213
	efi: capsule-loader: Fix use-after-free in efi_capsule_write
	wifi: iwlegacy: 4965: corrected fix for potential off-by-one overflow in il4965_rs_fill_link_cmd()
	net: mvpp2: debugfs: fix memory leak when using debugfs_lookup()
	fs: only do a memory barrier for the first set_buffer_uptodate()
	Revert "mm: kmemleak: take a full lowmem check in kmemleak_*_phys()"
	net: dp83822: disable false carrier interrupt
	drm/msm/dsi: fix the inconsistent indenting
	drm/msm/dsi: Fix number of regulators for msm8996_dsi_cfg
	platform/x86: pmc_atom: Fix SLP_TYPx bitfield mask
	iio: adc: mcp3911: make use of the sign bit
	ieee802154/adf7242: defer destroy_workqueue call
	wifi: cfg80211: debugfs: fix return type in ht40allow_map_read()
	Revert "xhci: turn off port power in shutdown"
	net: sched: tbf: don't call qdisc_put() while holding tree lock
	ethernet: rocker: fix sleep in atomic context bug in neigh_timer_handler
	kcm: fix strp_init() order and cleanup
	sch_cake: Return __NET_XMIT_STOLEN when consuming enqueued skb
	tcp: annotate data-race around challenge_timestamp
	Revert "sch_cake: Return __NET_XMIT_STOLEN when consuming enqueued skb"
	net/smc: Remove redundant refcount increase
	serial: fsl_lpuart: RS485 RTS polariy is inverse
	staging: rtl8712: fix use after free bugs
	powerpc: align syscall table for ppc32
	vt: Clear selection before changing the font
	tty: serial: lpuart: disable flow control while waiting for the transmit engine to complete
	Input: iforce - wake up after clearing IFORCE_XMIT_RUNNING flag
	iio: adc: mcp3911: use correct formula for AD conversion
	misc: fastrpc: fix memory corruption on probe
	misc: fastrpc: fix memory corruption on open
	USB: serial: ftdi_sio: add Omron CS1W-CIF31 device id
	binder: fix UAF of ref->proc caused by race condition
	usb: dwc3: qcom: fix use-after-free on runtime-PM wakeup
	drm/i915/reg: Fix spelling mistake "Unsupport" -> "Unsupported"
	clk: core: Honor CLK_OPS_PARENT_ENABLE for clk gate ops
	Revert "clk: core: Honor CLK_OPS_PARENT_ENABLE for clk gate ops"
	clk: core: Fix runtime PM sequence in clk_core_unprepare()
	Input: rk805-pwrkey - fix module autoloading
	clk: bcm: rpi: Fix error handling of raspberrypi_fw_get_rate
	hwmon: (gpio-fan) Fix array out of bounds access
	gpio: pca953x: Add mutex_lock for regcache sync in PM
	thunderbolt: Use the actual buffer in tb_async_error()
	xhci: Add grace period after xHC start to prevent premature runtime suspend.
	USB: serial: cp210x: add Decagon UCA device id
	USB: serial: option: add support for OPPO R11 diag port
	USB: serial: option: add Quectel EM060K modem
	USB: serial: option: add support for Cinterion MV32-WA/WB RmNet mode
	usb: typec: altmodes/displayport: correct pin assignment for UFP receptacles
	usb: dwc2: fix wrong order of phy_power_on and phy_init
	USB: cdc-acm: Add Icom PMR F3400 support (0c26:0020)
	usb-storage: Add ignore-residue quirk for NXP PN7462AU
	s390/hugetlb: fix prepare_hugepage_range() check for 2 GB hugepages
	s390: fix nospec table alignments
	USB: core: Prevent nested device-reset calls
	usb: gadget: mass_storage: Fix cdrom data transfers on MAC-OS
	driver core: Don't probe devices after bus_type.match() probe deferral
	wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected
	ip: fix triggering of 'icmp redirect'
	net: mac802154: Fix a condition in the receive path
	ALSA: seq: oss: Fix data-race for max_midi_devs access
	ALSA: seq: Fix data-race at module auto-loading
	drm/i915/glk: ECS Liva Q2 needs GLK HDMI port timing quirk
	btrfs: harden identification of a stale device
	usb: dwc3: fix PHY disable sequence
	usb: dwc3: disable USB core PHY management
	USB: serial: ch341: fix lost character on LCR updates
	USB: serial: ch341: fix disabled rx timer on older devices
	scsi: megaraid_sas: Fix double kfree()
	drm/gem: Fix GEM handle release errors
	drm/amdgpu: Check num_gfx_rings for gfx v9_0 rb setup.
	drm/radeon: add a force flush to delay work when radeon
	parisc: ccio-dma: Handle kmalloc failure in ccio_init_resources()
	parisc: Add runtime check to prevent PA2.0 kernels on PA1.x machines
	arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level
	fbdev: chipsfb: Add missing pci_disable_device() in chipsfb_pci_init()
	drm/amdgpu: mmVM_L2_CNTL3 register not initialized correctly
	ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc()
	ALSA: aloop: Fix random zeros in capture data when using jiffies timer
	ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface()
	kprobes: Prohibit probes in gate area
	debugfs: add debugfs_lookup_and_remove()
	nvmet: fix a use-after-free
	scsi: mpt3sas: Fix use-after-free warning
	scsi: lpfc: Add missing destroy_workqueue() in error path
	cgroup: Optimize single thread migration
	cgroup: Elide write-locking threadgroup_rwsem when updating csses on an empty subtree
	cgroup: Fix threadgroup_rwsem <-> cpus_read_lock() deadlock
	smb3: missing inode locks in punch hole
	ARM: dts: imx6qdl-kontron-samx6i: remove duplicated node
	regulator: core: Clean up on enable failure
	RDMA/cma: Fix arguments order in net device validation
	soc: brcmstb: pm-arm: Fix refcount leak and __iomem leak bugs
	RDMA/hns: Fix supported page size
	netfilter: br_netfilter: Drop dst references before setting.
	netfilter: nf_conntrack_irc: Fix forged IP logic
	rxrpc: Fix an insufficiently large sglist in rxkad_verify_packet_2()
	afs: Use the operation issue time instead of the reply time for callbacks
	sch_sfb: Don't assume the skb is still around after enqueueing to child
	tipc: fix shift wrapping bug in map_get()
	i40e: Fix kernel crash during module removal
	RDMA/siw: Pass a pointer to virt_to_page()
	ipv6: sr: fix out-of-bounds read when setting HMAC data.
	RDMA/mlx5: Set local port to one when accessing counters
	nvme-tcp: fix UAF when detecting digest errors
	tcp: fix early ETIMEDOUT after spurious non-SACK RTO
	sch_sfb: Also store skb len before calling child enqueue
	x86/nospec: Fix i386 RSB stuffing
	MIPS: loongson32: ls1c: Fix hang during startup
	Linux 5.4.213

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ic3f5e3a6ecfe0a7377117e09cf2690b4027238a5

parents d6022393 7e173970

Makefile

+1 −1

Original line number	Diff line number	Diff line
		# SPDX-License-Identifier: GPL-2.0
		VERSION = 5
		PATCHLEVEL = 4
		SUBLEVEL = 212
		SUBLEVEL = 213
		EXTRAVERSION =
		NAME = Kleptomaniac Octopus

arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi

+0 −10

Original line number	Diff line number	Diff line
		@@ -51,16 +51,6 @@
		vin-supply = <&reg_3p3v_s5>;
		};

		reg_3p3v_s0: regulator-3p3v-s0 {
		compatible = "regulator-fixed";
		regulator-name = "V_3V3_S0";
		regulator-min-microvolt = <3300000>;
		regulator-max-microvolt = <3300000>;
		regulator-always-on;
		regulator-boot-on;
		vin-supply = <&reg_3p3v_s5>;
		};

		reg_3p3v_s5: regulator-3p3v-s5 {
		compatible = "regulator-fixed";
		regulator-name = "V_3V3_S5";

arch/arm64/kernel/cacheinfo.c

+5 −1

Original line number	Diff line number	Diff line
		@@ -45,7 +45,8 @@ static void ci_leaf_init(struct cacheinfo *this_leaf,

		int init_cache_level(unsigned int cpu)
		{
		unsigned int ctype, level, leaves, fw_level;
		unsigned int ctype, level, leaves;
		int fw_level;
		struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);

		for (level = 1, leaves = 0; level <= MAX_CACHE_LEVEL; level++) {
		@@ -63,6 +64,9 @@ int init_cache_level(unsigned int cpu)
		else
		fw_level = acpi_find_last_cache_level(cpu);

		if (fw_level < 0)
		return fw_level;

		if (level < fw_level) {
		/*
		* some external caches not specified in CLIDR_EL1

arch/mips/loongson32/ls1c/board.c

+0 −1

Original line number	Diff line number	Diff line
		@@ -15,7 +15,6 @@ static struct platform_device *ls1c_platform_devices[] __initdata = {
		static int __init ls1c_platform_init(void)
		{
		ls1x_serial_set_uartclk(&ls1x_uart_pdev);
		ls1x_rtc_set_extclk(&ls1x_rtc_pdev);

		return platform_add_devices(ls1c_platform_devices,
		ARRAY_SIZE(ls1c_platform_devices));

arch/parisc/kernel/head.S

+42 −1

Original line number	Diff line number	Diff line
		@@ -22,7 +22,7 @@
		#include <linux/linkage.h>
		#include <linux/init.h>

		.level PA_ASM_LEVEL
		.level 1.1

		__INITDATA
		ENTRY(boot_args)
		@@ -69,6 +69,47 @@ $bss_loop:
		stw,ma %arg2,4(%r1)
		stw,ma %arg3,4(%r1)

		#if !defined(CONFIG_64BIT) && defined(CONFIG_PA20)
		/* This 32-bit kernel was compiled for PA2.0 CPUs. Check current CPU
		* and halt kernel if we detect a PA1.x CPU. */
		ldi 32,%r10
		mtctl %r10,%cr11
		.level 2.0
		mfctl,w %cr11,%r10
		.level 1.1
		comib,<>,n 0,%r10,$cpu_ok

		load32 PA(msg1),%arg0
		ldi msg1_end-msg1,%arg1
		$iodc_panic:
		copy %arg0, %r10
		copy %arg1, %r11
		load32 PA(init_stack),%sp
		#define MEM_CONS 0x3A0
		ldw MEM_CONS+32(%r0),%arg0 // HPA
		ldi ENTRY_IO_COUT,%arg1
		ldw MEM_CONS+36(%r0),%arg2 // SPA
		ldw MEM_CONS+8(%r0),%arg3 // layers
		load32 PA(__bss_start),%r1
		stw %r1,-52(%sp) // arg4
		stw %r0,-56(%sp) // arg5
		stw %r10,-60(%sp) // arg6 = ptr to text
		stw %r11,-64(%sp) // arg7 = len
		stw %r0,-68(%sp) // arg8
		load32 PA(.iodc_panic_ret), %rp
		ldw MEM_CONS+40(%r0),%r1 // ENTRY_IODC
		bv,n (%r1)
		.iodc_panic_ret:
		b . /* wait endless with ... */
		or %r10,%r10,%r10 /* qemu idle sleep */
		msg1: .ascii "Can't boot kernel which was built for PA8x00 CPUs on this machine.\r\n"
		msg1_end:

		$cpu_ok:
		#endif

		.level PA_ASM_LEVEL

		/* Initialize startup VM. Just map first 16/32 MB of memory */
		load32 PA(swapper_pg_dir),%r4
		mtctl %r4,%cr24 /* Initialize kernel root pointer */