Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Unverified Commit 7d036060 authored by Michael Bestas's avatar Michael Bestas
Browse files

Merge tag 'ASB-2023-11-05_4.14-stable' of... 

Merge tag 'ASB-2023-11-05_4.14-stable' of https://android.googlesource.com/kernel/common into android13-4.14-msmnile

https://source.android.com/docs/security/bulletin/2023-11-01

* tag 'ASB-2023-11-05_4.14-stable' of https://android.googlesource.com/kernel/common:
  Linux 4.14.328
  Bluetooth: hci_event: Fix using memcmp when comparing keys
  Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name
  Bluetooth: hci_sock: fix slab oob read in create_monitor_event
  gpio: vf610: set value before the direction to avoid a glitch
  s390/pci: fix iommu bitmap allocation
  perf: Disallow mis-matched inherited group reads
  USB: serial: option: add Fibocom to DELL custom modem FM101R-GL
  USB: serial: option: add entry for Sierra EM9191 with new firmware
  USB: serial: option: add Telit LE910C4-WWX 0x1035 composition
  ACPI: irq: Fix incorrect return value in acpi_register_gsi()
  Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()"
  mmc: core: Capture correct oemid-bits for eMMC cards
  sky2: Make sure there is at least one frag_addr available
  wifi: cfg80211: avoid leaking stack data into trace
  wifi: mac80211: allow transmitting EAPOL frames with tainted key
  Bluetooth: hci_core: Fix build warnings
  Bluetooth: Avoid redundant authentication
  HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event
  tracing: relax trace_event_eval_update() execution with cond_resched()
  ata: libata-eh: Fix compilation warning in ata_eh_link_report()
  gpio: timberdale: Fix potential deadlock on &tgpio->lock
  overlayfs: set ctime when setting mtime and atime
  i2c: mux: Avoid potential false error message in i2c_mux_add_adapter
  btrfs: initialize start_slot in btrfs_log_prealloc_extents
  ARM: dts: ti: omap: Fix noisy serial with overrun-throttle-ms for mapphone
  i40e: prevent crash on probe if hw registers have invalid values
  net: usb: smsc95xx: Fix an error code in smsc95xx_reset()
  net: rfkill: gpio: prevent value glitch during probe
  net: ipv6: fix return value check in esp_remove_trailer
  net: ipv4: fix return value check in esp_remove_trailer
  xfrm: fix a data-race in xfrm_gen_index()
  netfilter: nft_payload: fix wrong mac header matching
  KVM: x86: Mask LVTPC when handling a PMI
  regmap: fix NULL deref on lookup
  nfc: nci: fix possible NULL pointer dereference in send_acknowledge()
  Bluetooth: avoid memcmp() out of bounds warning
  Bluetooth: hci_event: Fix coding style
  Bluetooth: vhci: Fix race when opening vhci device
  Bluetooth: Fix a refcnt underflow problem for hci_conn
  Bluetooth: Reject connection with the device which has same BD_ADDR
  Bluetooth: hci_event: Ignore NULL link key
  usb: hub: Guard against accesses to uninitialized BOS descriptors
  x86/cpu: Fix AMD erratum #1485 on Zen4-based CPUs
  usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call
  usb: gadget: udc-xilinx: replace memcpy with memcpy_toio
  pinctrl: avoid unsafe code pattern in find_pinctrl()
  cgroup: Remove duplicates in cgroup v1 tasks file
  Input: xpad - add PXN V900 support
  Input: powermate - fix use-after-free in powermate_config_complete
  ceph: fix incorrect revoked caps assert in ceph_fill_file_size()
  mcb: remove is_added flag from mcb_device struct
  iio: pressure: ms5611: ms5611_prom_is_valid false negative bug
  iio: pressure: bmp280: Fix NULL pointer exception
  usb: musb: Modify the "HWVers" register address
  usb: musb: Get the musb_qh poniter after musb_giveback
  net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read
  usb: xhci: xhci-ring: Use sysdev for mapping bounce buffer
  workqueue: Override implicit ordered attribute in workqueue_apply_unbound_cpumask()
  nfc: nci: assert requested protocol is valid
  ixgbe: fix crash with empty VF macvlan list
  drm/vmwgfx: fix typo of sizeof argument
  ieee802154: ca8210: Fix a potential UAF in ca8210_probe
  drm: etvnaviv: fix bad backport leading to warning
  HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect
  RDMA/cxgb4: Check skb value for failure to allocate
  Linux 4.14.327
  xen/events: replace evtchn_rwlock with RCU
  rtnetlink: Reject negative ifindexes in RTM_NEWLINK
  Revert "rtnetlink: Reject negative ifindexes in RTM_NEWLINK"
  parisc: Restore __ldcw_align for PA-RISC 2.0 processors
  RDMA/mlx5: Fix NULL string error
  RDMA/cma: Fix truncation compilation warning in make_cma_ports
  gpio: aspeed: fix the GPIO number passed to pinctrl_gpio_set_config()
  IB/mlx4: Fix the size of a buffer in add_port_entries()
  cpupower: add Makefile dependencies for install targets
  sctp: update hb timer immediately after users change hb_interval
  sctp: update transport state when processing a dupcook packet
  tcp: fix delayed ACKs for MSS boundary condition
  net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg
  ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data()
  modpost: add missing else to the "of" check
  scsi: target: core: Fix deadlock due to recursive locking
  regmap: rbtree: Fix wrong register marked as in-cache when creating new node
  drivers/net: process the result of hdlc_open() and add call of hdlc_close() in uhdlc_close()
  wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet
  ubi: Refuse attaching if mtd's erasesize is 0
  wifi: mwifiex: Fix tlv_buf_left calculation
  scsi: zfcp: Fix a double put in zfcp_port_enqueue()
  media: dvb: symbol fixup for dvb_attach() - again
  ata: libata: disallow dev-initiated LPM transitions to unsupported states
  net/sched: sch_hfsc: Ensure inner classes have fsc curve
  ext4: fix rec_len verify error
  vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF
  fs: binfmt_elf_efpic: fix personality for ELF-FDPIC
  ata: libata-sata: increase PMP SRST timeout to 10s
  ata: libata-core: Fix port and device removal
  ata: libata-core: Fix ata_port_request_pm() locking
  btrfs: properly report 0 avail for very full file systems
  i2c: i801: unregister tco_pdev in i801_probe() error path
  ata: libata-scsi: ignore reserved bits for REPORT SUPPORTED OPERATION CODES
  nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
  serial: 8250_port: Check IRQ data before use
  watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running
  watchdog: iTCO_wdt: No need to stop the timer in probe
  ata: libahci: clear pending interrupt status
  ata: ahci: Drop pointless VPRINTK() calls and convert the remaining ones
  fbdev/sh7760fb: Depend on FB=y
  ata: libata-eh: do not clear ATA_PFLAG_EH_PENDING in ata_eh_reset()
  ring-buffer: Avoid softlockup in ring_buffer_resize()
  selftests/ftrace: Correctly enable event in instance-event.tc
  parisc: irq: Make irq_stack_union static to avoid sparse warning
  parisc: iosapic.c: Fix sparse warnings
  parisc: sba: Fix compile warning wrt list of SBA devices
  xtensa: boot/lib: fix function prototypes
  xtensa: boot: don't add include-dirs
  clk: tegra: fix error return case for recalc_rate
  i2c: mux: demux-pinctrl: check the return value of devm_kstrdup()
  gpio: tb10x: Fix an error handling path in tb10x_gpio_probe()
  team: fix null-ptr-deref when team device type is changed
  dccp: fix dccp_v4_err()/dccp_v6_err() again
  powerpc/perf/hv-24x7: Update domain value check
  ipv4: fix null-deref in ipv4_link_failure
  NFS/pNFS: Report EINVAL errors from connect() to the server

 Conflicts:
	kernel/events/core.c

Change-Id: Idd943ad7328420dab2fd1510193d9254be9f56f4
parents 97f63069 67419faf

Makefile

+1 −1
Original line number Diff line number Diff line 
# SPDX-License-Identifier: GPL-2.0

VERSION = 4

PATCHLEVEL = 14

SUBLEVEL = 326

SUBLEVEL = 328

EXTRAVERSION =

NAME = Petit Gorille

arch/arm/boot/dts/omap4-droid4-xt894.dts

+1 −0
Original line number Diff line number Diff line
@@ -533,6 +533,7 @@ 
&uart3 {

	interrupts-extended = <&wakeupgen GIC_SPI 74 IRQ_TYPE_LEVEL_HIGH

			       &omap4_pmx_core 0x17c>;

	overrun-throttle-ms = <500>;

};



&uart4 {

arch/parisc/include/asm/ldcw.h

+20 −16
Original line number Diff line number Diff line
@@ -2,7 +2,6 @@ 
#ifndef __PARISC_LDCW_H

#define __PARISC_LDCW_H



#ifndef CONFIG_PA20

/* Because kmalloc only guarantees 8-byte alignment for kmalloc'd data,

   and GCC only guarantees 8-byte alignment for stack locals, we can't

   be assured of 16-byte alignment for atomic lock data even if we
@@ -11,6 +10,21 @@ 
   type and dynamically select the 16-byte aligned int from the array

   for the semaphore. */



/* From: "Jim Hull" <jim.hull of hp.com>

   I've attached a summary of the change, but basically, for PA 2.0, as

   long as the ",CO" (coherent operation) completer is implemented, then the

   16-byte alignment requirement for ldcw and ldcd is relaxed, and instead

   they only require "natural" alignment (4-byte for ldcw, 8-byte for

   ldcd).



   Although the cache control hint is accepted by all PA 2.0 processors,

   it is only implemented on PA8800/PA8900 CPUs. Prior PA8X00 CPUs still

   require 16-byte alignment. If the address is unaligned, the operation

   of the instruction is undefined. The ldcw instruction does not generate

   unaligned data reference traps so misaligned accesses are not detected.

   This hid the problem for years. So, restore the 16-byte alignment dropped

   by Kyle McMartin in "Remove __ldcw_align for PA-RISC 2.0 processors". */



#define __PA_LDCW_ALIGNMENT	16

#define __PA_LDCW_ALIGN_ORDER	4

#define __ldcw_align(a) ({					\
@@ -19,22 +33,12 @@ 
		& ~(__PA_LDCW_ALIGNMENT - 1);			\

	(volatile unsigned int *) __ret;			\

})

#define __LDCW	"ldcw"



#else /*CONFIG_PA20*/

/* From: "Jim Hull" <jim.hull of hp.com>

   I've attached a summary of the change, but basically, for PA 2.0, as

   long as the ",CO" (coherent operation) completer is specified, then the

   16-byte alignment requirement for ldcw and ldcd is relaxed, and instead

   they only require "natural" alignment (4-byte for ldcw, 8-byte for

   ldcd). */



#define __PA_LDCW_ALIGNMENT	4

#define __PA_LDCW_ALIGN_ORDER	2

#define __ldcw_align(a) (&(a)->slock)

#ifdef CONFIG_PA20

#define __LDCW	"ldcw,co"



#endif /*!CONFIG_PA20*/

#else

#define __LDCW	"ldcw"

#endif



/* LDCW, the only atomic read-write operation PA-RISC has. *sigh*.

   We don't explicitly expose that "*a" may be written as reload

arch/parisc/include/asm/ropes.h

+3 −0
Original line number Diff line number Diff line
@@ -86,6 +86,9 @@ struct sba_device { 
	struct ioc		ioc[MAX_IOC];

};



/* list of SBA's in system, see drivers/parisc/sba_iommu.c */

extern struct sba_device *sba_list;



#define ASTRO_RUNWAY_PORT	0x582

#define IKE_MERCED_PORT		0x803

#define REO_MERCED_PORT		0x804

arch/parisc/include/asm/spinlock_types.h

+0 −5
Original line number Diff line number Diff line
@@ -3,13 +3,8 @@ 
#define __ASM_SPINLOCK_TYPES_H



typedef struct {

#ifdef CONFIG_PA20

	volatile unsigned int slock;

# define __ARCH_SPIN_LOCK_UNLOCKED { 1 }

#else

	volatile unsigned int lock[4];

# define __ARCH_SPIN_LOCK_UNLOCKED	{ { 1, 1, 1, 1 } }

#endif

} arch_spinlock_t;



typedef struct {