Skip to content
This repository has been archived by the owner on Jun 19, 2024. It is now read-only.

Commit

Permalink
Merge tag 'ASB-2022-02-05_4.14-q' into Grass-Unified
Browse files Browse the repository at this point in the history
https://source.android.com/security/bulletin/2022-02-01
CVE-2021-39685
CVE-2021-39686

* tag 'ASB-2022-02-05_4.14-q':
  BACKPORT: ipv6: Implement draft-ietf-6man-rfc4941bis
  Linux 4.14.264
  drm/vmwgfx: Fix stale file descriptors on failed usercopy
  can: bcm: fix UAF of bcm op
  drm/i915: Flush TLBs before releasing backing store
  Linux 4.14.263
  NFSv4: Initialise connection to the server in nfs4_alloc_client()
  gianfar: fix jumbo packets+napi+rx overrun crash
  gianfar: simplify FCS handling and fix memory leak
  fuse: fix live lock in fuse_iget()
  fuse: fix bad inode
  drm/ttm/nouveau: don't call tt destroy callback on alloc failure.
  mips,s390,sh,sparc: gup: Work around the "COW can break either way" issue
  lib82596: Fix IRQ check in sni_82596_probe
  scripts/dtc: dtx_diff: remove broken example from help text
  bcmgenet: add WOL IRQ check
  net_sched: restore "mpu xxx" handling
  dmaengine: at_xdmac: Fix at_xdmac_lld struct definition
  dmaengine: at_xdmac: Fix lld view setting
  dmaengine: at_xdmac: Print debug message after realeasing the lock
  dmaengine: at_xdmac: Don't start transactions at tx_submit level
  libcxgb: Don't accidentally set RTO_ONLINK in cxgb_find_route()
  netns: add schedule point in ops_exit_list()
  net: axienet: fix number of TX ring slots for available check
  net: axienet: Wait for PhyRstCmplt after core reset
  af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress
  parisc: pdc_stable: Fix memory leak in pdcs_register_pathentries
  net/fsl: xgmac_mdio: Fix incorrect iounmap when removing module
  powerpc/fsl/dts: Enable WA for erratum A-009885 on fman3l MDIO buses
  powerpc/cell: Fix clang -Wimplicit-fallthrough warning
  RDMA/rxe: Fix a typo in opcode name
  RDMA/hns: Modify the mapping attribute of doorbell to device
  Documentation: refer to config RANDOMIZE_BASE for kernel address-space randomization
  firmware: Update Kconfig help text for Google firmware
  drm/radeon: fix error handling in radeon_driver_open_kms
  crypto: stm32/crc32 - Fix kernel BUG triggered in probe()
  ext4: don't use the orphan list when migrating an inode
  ext4: Fix BUG_ON in ext4_bread when write quota data
  ext4: set csum seed in tmp inode while migrating to extents
  ext4: make sure quota gets properly shutdown on error
  iwlwifi: mvm: Increase the scan timeout guard to 30 seconds
  cputime, cpuacct: Include guest time in user time in cpuacct.stat
  serial: Fix incorrect rs485 polarity on uart open
  ubifs: Error path in ubifs_remount_rw() seems to wrongly free write buffers
  power: bq25890: Enable continuous conversion for ADC at charging
  ASoC: mediatek: mt8173: fix device_node leak
  scsi: sr: Don't use GFP_DMA
  MIPS: Octeon: Fix build errors using clang
  i2c: designware-pci: Fix to change data types of hcnt and lcnt parameters
  MIPS: OCTEON: add put_device() after of_find_device_by_node()
  ALSA: seq: Set upper limit of processed events
  w1: Misuse of get_user()/put_user() reported by sparse
  i2c: mpc: Correct I2C reset procedure
  powerpc/smp: Move setup_profiling_timer() under CONFIG_PROFILING
  i2c: i801: Don't silently correct invalid transfer size
  powerpc/watchdog: Fix missed watchdog reset due to memory ordering race
  powerpc/btext: add missing of_node_put
  powerpc/cell: add missing of_node_put
  powerpc/powernv: add missing of_node_put
  powerpc/6xx: add missing of_node_put
  parisc: Avoid calling faulthandler_disabled() twice
  serial: core: Keep mctrl register state and cached copy in sync
  serial: pl010: Drop CR register reset on set_termios
  net: phy: marvell: configure RGMII delays for 88E1118
  dm space map common: add bounds check to sm_ll_lookup_bitmap()
  dm btree: add a defensive bounds check to insert_at()
  mac80211: allow non-standard VHT MCS-10/11
  net: mdio: Demote probed message to debug print
  btrfs: remove BUG_ON(!eie) in find_parent_nodes
  btrfs: remove BUG_ON() in find_parent_nodes()
  ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5
  ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R()
  ACPICA: Utilities: Avoid deleting the same object twice in a row
  ACPICA: actypes.h: Expand the ACPI_ACCESS_ definitions
  jffs2: GC deadlock reading a page that is used in jffs2_write_begin()
  um: registers: Rename function names to avoid conflicts and build problems
  iwlwifi: remove module loading failure message
  iwlwifi: fix leaks/bad data after failed firmware load
  ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream
  usb: hub: Add delay for SuperSpeed hub resume to let links transit to U0
  arm64: tegra: Adjust length of CCPLEX cluster MMIO region
  mmc: core: Fixup storing of OCR for MMC_QUIRK_NONSTD_SDIO
  media: saa7146: hexium_gemini: Fix a NULL pointer dereference in hexium_attach()
  media: igorplugusb: receiver overflow should be reported
  bpf: Do not WARN in bpf_warn_invalid_xdp_action()
  net: bonding: debug: avoid printing debug logs when bond is not notifying peers
  ath10k: Fix tx hanging
  iwlwifi: mvm: synchronize with FW after multicast commands
  media: m920x: don't use stack on USB reads
  media: saa7146: hexium_orion: Fix a NULL pointer dereference in hexium_attach()
  media: uvcvideo: Increase UVC_CTRL_CONTROL_TIMEOUT to 5 seconds.
  floppy: Add max size check for user space request
  usb: uhci: add aspeed ast2600 uhci support
  mwifiex: Fix skb_over_panic in mwifiex_usb_recv()
  HSI: core: Fix return freed object in hsi_new_client
  gpiolib: acpi: Do not set the IRQ type if the IRQ is already in use
  drm/bridge: megachips: Ensure both bridges are probed before registration
  mlxsw: pci: Add shutdown method in PCI driver
  media: b2c2: Add missing check in flexcop_pci_isr:
  HID: apple: Do not reset quirks when the Fn key is not found
  usb: gadget: f_fs: Use stream_open() for endpoint files
  drm/nouveau/pmu/gm200-: avoid touching PMU outside of DEVINIT/PREOS/ACR
  ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply
  fs: dlm: filter user dlm messages for kernel locks
  Bluetooth: Fix debugfs entry leak in hci_register_dev()
  RDMA/cxgb4: Set queue pair state when being queried
  mips: bcm63xx: add support for clk_set_parent()
  mips: lantiq: add support for clk_set_parent()
  misc: lattice-ecp3-config: Fix task hung when firmware load failed
  ASoC: samsung: idma: Check of ioremap return value
  iommu/iova: Fix race between FQ timeout and teardown
  dmaengine: pxa/mmp: stop referencing config->slave_id
  RDMA/core: Let ib_find_gid() continue search even after empty entry
  scsi: ufs: Fix race conditions related to driver data
  char/mwave: Adjust io port register size
  ALSA: oss: fix compile error when OSS_DEBUG is enabled
  powerpc/prom_init: Fix improper check of prom_getprop()
  RDMA/hns: Validate the pkey index
  ALSA: hda: Add missing rwsem around snd_ctl_remove() calls
  ALSA: PCM: Add missing rwsem around snd_ctl_remove() calls
  ALSA: jack: Add missing rwsem around snd_ctl_remove() calls
  ext4: avoid trim error on fs with small groups
  net: mcs7830: handle usb read errors properly
  pcmcia: fix setting of kthread task states
  can: xilinx_can: xcan_probe(): check for error irq
  can: softing: softing_startstop(): fix set but not used variable warning
  tpm: add request_locality before write TPM_INT_ENABLE
  spi: spi-meson-spifc: Add missing pm_runtime_disable() in meson_spifc_probe
  fsl/fman: Check for null pointer after calling devm_ioremap
  ppp: ensure minimum packet size in ppp_write()
  pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in nonstatic_find_mem_region()
  pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in __nonstatic_find_io_region()
  x86/mce/inject: Avoid out-of-bounds write when setting flags
  usb: ftdi-elan: fix memory leak on device disconnect
  media: msi001: fix possible null-ptr-deref in msi001_probe()
  media: dw2102: Fix use after free
  sched/rt: Try to restart rt period timer when rt runtime exceeded
  media: si2157: Fix "warm" tuner state detection
  media: saa7146: mxb: Fix a NULL pointer dereference in mxb_attach()
  media: dib8000: Fix a memleak in dib8000_init()
  floppy: Fix hang in watchdog when disk is ejected
  serial: amba-pl011: do not request memory region twice
  drm/radeon/radeon_kms: Fix a NULL pointer dereference in radeon_driver_open_kms()
  drm/amdgpu: Fix a NULL pointer dereference in amdgpu_connector_lcd_native_mode()
  arm64: dts: qcom: msm8916: fix MMC controller aliases
  netfilter: bridge: add support for pppoe filtering
  media: mtk-vcodec: call v4l2_m2m_ctx_release first when file is released
  tty: serial: atmel: Call dma_async_issue_pending()
  tty: serial: atmel: Check return code of dmaengine_submit()
  crypto: qce - fix uaf on qce_ahash_register_one
  media: dmxdev: fix UAF when dvb_register_device() fails
  Bluetooth: stop proccessing malicious adv data
  media: em28xx: fix memory leak in em28xx_init_dev
  wcn36xx: Indicate beacon not connection loss on MISSED_BEACON_IND
  clk: bcm-2835: Remove rounding up the dividers
  clk: bcm-2835: Pick the closest clock rate
  Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails
  PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller
  shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode
  can: softing_cs: softingcs_probe(): fix memleak on registration failure
  media: stk1160: fix control-message timeouts
  media: pvrusb2: fix control-message timeouts
  media: redrat3: fix control-message timeouts
  media: dib0700: fix undefined behavior in tuner shutdown
  media: s2255: fix control-message timeouts
  media: cpia2: fix control-message timeouts
  media: em28xx: fix control-message timeouts
  media: mceusb: fix control-message timeouts
  media: flexcop-usb: fix control-message timeouts
  rtc: cmos: take rtc_lock while reading from CMOS
  nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind()
  HID: wacom: Avoid using stale array indicies to read contact count
  HID: wacom: Ignore the confidence flag when a touch is removed
  HID: uhid: Fix worker destroying device without any protection
  Bluetooth: fix init and cleanup of sco_conn.timeout_work
  Bluetooth: schedule SCO timeouts with delayed_work
  rtlwifi: rtl8192cu: Fix WARNING when calling local_irq_restore() with interrupts enabled
  media: uvcvideo: fix division by zero at stream start
  orangefs: Fix the size of a memory allocation in orangefs_bufmap_alloc()
  drm/i915: Avoid bitwise vs logical OR warning in snb_wm_latency_quirk()
  staging: wlan-ng: Avoid bitwise vs logical OR warning in hfa384x_usb_throttlefn()
  random: fix data race on crng init time
  random: fix data race on crng_node_pool
  can: gs_usb: gs_can_start_xmit(): zero-initialize hf->{flags,reserved}
  can: gs_usb: fix use of uninitialized variable, detach device on reception of invalid USB data
  mfd: intel-lpss: Fix too early PM enablement in the ACPI ->probe()
  USB: Fix "slab-out-of-bounds Write" bug in usb_hcd_poll_rh_status
  USB: core: Fix bug in resuming hub's handling of wakeup requests
  Bluetooth: bfusb: fix division by zero in send path
  Linux 4.14.262
  mISDN: change function names to avoid conflicts
  net: udp: fix alignment problem in udp4_seq_show()
  ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate
  scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown()
  ipv6: Do cleanup if attribute validation fails in multipath route
  ipv6: Continue processing multipath route even if gateway attribute is invalid
  phonet: refcount leak in pep_sock_accep
  rndis_host: support Hytera digital radios
  power: reset: ltc2952: Fix use of floating point literals
  xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate
  sch_qfq: prevent shift-out-of-bounds in qfq_init_qdisc
  ipv6: Check attribute length for RTA_GATEWAY when deleting multipath route
  ipv6: Check attribute length for RTA_GATEWAY in multipath route
  i40e: Fix incorrect netdev's real number of RX/TX queues
  i40e: fix use-after-free in i40e_sync_filters_subtask()
  mac80211: initialize variable have_higher_than_11mbit
  RDMA/core: Don't infoleak GRH fields
  ieee802154: atusb: fix uninit value in atusb_set_extended_addr
  virtio_pci: Support surprise removal of virtio pci device
  tracing: Tag trace_percpu_buffer as a percpu pointer
  tracing: Fix check for trace_percpu_buffer validity in get_trace_buf()
  Bluetooth: btusb: Apply QCA Rome patches for some ATH3012 models
  Linux 4.14.261
  sctp: use call_rcu to free endpoint
  net: fix use-after-free in tw_timer_handler
  Input: spaceball - fix parsing of movement data packets
  Input: appletouch - initialize work before device registration
  scsi: vmw_pvscsi: Set residual data length conditionally
  binder: fix async_free_space accounting for empty parcels
  usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.
  xhci: Fresco FL1100 controller should not have BROKEN_MSI quirk set.
  uapi: fix linux/nfc.h userspace compilation errors
  nfc: uapi: use kernel size_t to fix user-space builds
  fsl/fman: Fix missing put_device() call in fman_port_probe
  NFC: st21nfca: Fix memory leak in device probe and remove
  net: usb: pegasus: Do not drop long Ethernet frames
  scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write()
  selinux: initialize proto variable in selinux_ip_postroute_compat()
  recordmcount.pl: fix typo in s390 mcount regex
  platform/x86: apple-gmux: use resource_size() with res
  tee: handle lookup of shm with reference count 0
  HID: asus: Add depends on USB_HID to HID_ASUS Kconfig option
  Linux 4.14.260
  phonet/pep: refuse to enable an unbound pipe
  hamradio: improve the incomplete fix to avoid NPD
  hamradio: defer ax25 kfree after unregister_netdev
  ax25: NPD bug when detaching AX25 device
  hwmon: (lm90) Do not report 'busy' status bit as alarm
  KVM: VMX: Fix stale docs for kvm-intel.emulate_invalid_guest_state
  usb: gadget: u_ether: fix race in setting MAC address in setup phase
  f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr()
  ARM: 9169/1: entry: fix Thumb2 bug in iWMMXt exception handling
  pinctrl: stm32: consider the GPIO offset to expose all the GPIO lines
  x86/pkey: Fix undefined behaviour with PKRU_WD_BIT
  Input: atmel_mxt_ts - fix double free in mxt_read_info_block
  ALSA: drivers: opl3: Fix incorrect use of vp->state
  ALSA: jack: Check the return value of kstrdup()
  hwmon: (lm90) Fix usage of CONFIG2 register in detect function
  sfc: falcon: Check null pointer of rx_queue->page_ring
  drivers: net: smc911x: Check for error irq
  fjes: Check for error irq
  bonding: fix ad_actor_system option setting to default
  net: skip virtio_net_hdr_set_proto if protocol already set
  net: accept UFOv6 packages in virtio_net_hdr_to_skb
  qlcnic: potential dereference null pointer of rx_queue->page_ring
  netfilter: fix regression in looped (broad|multi)cast's MAC handling
  IB/qib: Fix memory leak in qib_user_sdma_queue_pkts()
  spi: change clk_disable_unprepare to clk_unprepare
  HID: holtek: fix mouse probing
  can: kvaser_usb: get CAN clock frequency from device
  net: usb: lan78xx: add Allied Telesis AT29M2-AF
  Linux 4.14.259
  xen/netback: don't queue unlimited number of packages
  xen/netback: fix rx queue stall detection
  xen/console: harden hvc_xen against event channel storms
  xen/netfront: harden netfront against event channel storms
  xen/blkfront: harden blkfront against event channel storms
  Input: touchscreen - avoid bitwise vs logical OR warning
  ARM: 8800/1: use choice for kernel unwinders
  mwifiex: Remove unnecessary braces from HostCmd_SET_SEQ_NO_BSS_INFO
  ARM: 8805/2: remove unneeded naked function usage
  net: lan78xx: Avoid unnecessary self assignment
  scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select()
  fuse: annotate lock in fuse_reverse_inval_entry()
  ARM: dts: imx6ull-pinfunc: Fix CSI_DATA07__ESAI_TX0 pad name
  firmware: arm_scpi: Fix string overflow in SCPI genpd driver
  net: systemport: Add global locking for descriptor lifecycle
  libata: if T_LENGTH is zero, dma direction should be DMA_NONE
  timekeeping: Really make sure wall_to_monotonic isn't positive
  USB: serial: option: add Telit FN990 compositions
  PCI/MSI: Mask MSI-X vectors only on success
  PCI/MSI: Clear PCI_MSIX_FLAGS_MASKALL on error
  USB: gadget: bRequestType is a bitfield, not a enum
  sit: do not call ipip6_dev_free() from sit_init_net()
  net/packet: rx_owner_map depends on pg_vec
  ixgbe: set X550 MDIO speed before talking to PHY
  igbvf: fix double free in `igbvf_probe`
  soc/tegra: fuse: Fix bitwise vs. logical OR warning
  dmaengine: st_fdma: fix MODULE_ALIAS
  ARM: socfpga: dts: fix qspi node compatible
  x86/sme: Explicitly map new EFI memmap table as encrypted
  x86: Make ARCH_USE_MEMREMAP_PROT a generic Kconfig symbol
  nfsd: fix use-after-free due to delegation race
  audit: improve robustness of the audit queue handling
  dm btree remove: fix use after free in rebalance_children()
  recordmcount.pl: look for jgnop instruction as well as bcrl on s390
  mac80211: send ADDBA requests using the tid/queue of the aggregation session
  hwmon: (dell-smm) Fix warning on /proc/i8k creation error
  bpf: fix panic due to oob in bpf_prog_test_run_skb
  tracing: Fix a kmemleak false positive in tracing_map
  net: netlink: af_netlink: Prevent empty skb by adding a check on len.
  i2c: rk3x: Handle a spurious start completion interrupt flag
  parisc/agp: Annotate parisc agp init functions with __init
  net/mlx4_en: Update reported link modes for 1/10G
  drm/msm/dsi: set default num_data_lanes
  nfc: fix segfault in nfc_genl_dump_devices_done
  FROMGIT: USB: gadget: bRequestType is a bitfield, not a enum
  Linux 4.14.258
  irqchip: nvic: Fix offset for Interrupt Priority Offsets
  irqchip/irq-gic-v3-its.c: Force synchronisation when issuing INVALL
  irqchip/armada-370-xp: Fix support for Multi-MSI interrupts
  irqchip/armada-370-xp: Fix return value of armada_370_xp_msi_alloc()
  iio: accel: kxcjk-1013: Fix possible memory leak in probe and remove
  iio: adc: axp20x_adc: fix charging current reporting on AXP22x
  iio: dln2: Check return value of devm_iio_trigger_register()
  iio: dln2-adc: Fix lockdep complaint
  iio: itg3200: Call iio_trigger_notify_done() on error
  iio: kxsd9: Don't return error code in trigger handler
  iio: ltr501: Don't return error code in trigger handler
  iio: mma8452: Fix trigger reference couting
  iio: stk3310: Don't return error code in interrupt handler
  iio: trigger: stm32-timer: fix MODULE_ALIAS
  iio: trigger: Fix reference counting
  usb: core: config: using bit mask instead of individual bits
  xhci: Remove CONFIG_USB_DEFAULT_PERSIST to prevent xHCI from runtime suspending
  usb: core: config: fix validation of wMaxPacketValue entries
  USB: gadget: zero allocate endpoint 0 buffers
  USB: gadget: detect too-big endpoint 0 requests
  net/qla3xxx: fix an error code in ql_adapter_up()
  net, neigh: clear whole pneigh_entry at alloc time
  net: fec: only clear interrupt of handling queue in fec_enet_rx_queue()
  net: altera: set a couple error code in probe()
  net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero
  qede: validate non LSO skb length
  block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2)
  tracefs: Set all files to the same group ownership as the mount option
  signalfd: use wake_up_pollfree()
  binder: use wake_up_pollfree()
  wait: add wake_up_pollfree()
  libata: add horkage for ASMedia 1092
  can: m_can: Disable and ignore ELO interrupt
  can: pch_can: pch_can_rx_normal: fix use after free
  tracefs: Have new files inherit the ownership of their parent
  ALSA: pcm: oss: Handle missing errors in snd_pcm_oss_change_params*()
  ALSA: pcm: oss: Limit the period size to 16MB
  ALSA: pcm: oss: Fix negative period/buffer sizes
  ALSA: ctl: Fix copy of updated id with element read/write
  mm: bdi: initialize bdi_min_ratio when bdi is unregistered
  IB/hfi1: Correct guard on eager buffer deallocation
  seg6: fix the iif in the IPv6 socket control block
  nfp: Fix memory leak in nfp_cpp_area_cache_add()
  bpf: Fix the off-by-two error in range markings
  nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done
  can: sja1000: fix use after free in ems_pcmcia_add_card()
  HID: check for valid USB device for many HID drivers
  HID: wacom: fix problems when device is not a valid USB device
  HID: add USB_HID dependancy on some USB HID drivers
  HID: add USB_HID dependancy to hid-chicony
  HID: add USB_HID dependancy to hid-prodikeys
  HID: add hid_is_usb() function to make it simpler for USB detection
  UPSTREAM: USB: gadget: zero allocate endpoint 0 buffers
  UPSTREAM: USB: gadget: detect too-big endpoint 0 requests
  Linux 4.14.257
  parisc: Mark cr16 CPU clocksource unstable on all SMP machines
  serial: core: fix transmit-buffer reset and memleak
  serial: pl011: Add ACPI SBSA UART match id
  tty: serial: msm_serial: Deactivate RX DMA for polling support
  x86/64/mm: Map all kernel memory into trampoline_pgd
  usb: typec: tcpm: Wait in SNK_DEBOUNCED until disconnect
  xhci: Fix commad ring abort, write all 64 bits to CRCR register.
  vgacon: Propagate console boot parameters before calling `vc_resize'
  parisc: Fix "make install" on newer debian releases
  parisc: Fix KBUILD_IMAGE for self-extracting kernel
  net/smc: Keep smc_close_final rc during active close
  net/rds: correct socket tunable error in rds_tcp_tune()
  net: usb: lan78xx: lan78xx_phy_init(): use PHY_POLL instead of "0" if no IRQ is available
  net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources()
  siphash: use _unaligned version by default
  net: mpls: Fix notifications when deleting a device
  net: qlogic: qlcnic: Fix a NULL pointer dereference in qlcnic_83xx_add_rings()
  natsemi: xtensa: fix section mismatch warnings
  fget: check that the fd still exists after getting a ref to it
  fs: add fget_many() and fput_many()
  sata_fsl: fix warning in remove_proc_entry when rmmod sata_fsl
  sata_fsl: fix UAF in sata_fsl_port_stop when rmmod sata_fsl
  kprobes: Limit max data_size of the kretprobe instances
  vrf: Reset IPCB/IP6CB when processing outbound pkts in vrf dev xmit
  perf hist: Fix memory leak of a perf_hpp_fmt
  net: ethernet: dec: tulip: de4x5: fix possible array overflows in type3_infoblock()
  net: tulip: de4x5: fix the problem that the array 'lp->phy[8]' may be out of bound
  ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port()
  scsi: iscsi: Unblock session then wake up error handler
  thermal: core: Reset previous low and high trip during thermal zone init
  btrfs: check-integrity: fix a warning on write caching disabled disk
  s390/setup: avoid using memblock_enforce_memory_limit
  platform/x86: thinkpad_acpi: Fix WWAN device disabled issue after S3 deep
  net: return correct error code
  hugetlb: take PMD sharing into account when flushing tlb/caches
  NFSv42: Fix pagecache invalidation after COPY/CLONE
  ipc: WARN if trying to remove ipc object which is absent
  shm: extend forced shm destroy to support objects from several IPC nses
  tty: hvc: replace BUG_ON() with negative return value
  xen/netfront: don't trust the backend response data blindly
  xen/netfront: disentangle tx_skb_freelist
  xen/netfront: don't read data from request on the ring page
  xen/netfront: read response from backend only once
  xen/blkfront: don't trust the backend response data blindly
  xen/blkfront: don't take local copy of a request from the ring page
  xen/blkfront: read response from backend only once
  xen: sync include/xen/interface/io/ring.h with Xen's newest version
  fuse: release pipe buf after last use
  NFC: add NCI_UNREG flag to eliminate the race
  proc/vmcore: fix clearing user buffer by properly using clear_user()
  hugetlbfs: flush TLBs correctly after huge_pmd_unshare
  arm64: dts: marvell: armada-37xx: Set pcie_reset_pin to gpio function
  arm64: dts: marvell: armada-37xx: declare PCIe reset pin
  pinctrl: armada-37xx: Correct PWM pins definitions
  pinctrl: armada-37xx: add missing pin: PCIe1 Wakeup
  pinctrl: armada-37xx: Correct mpp definitions
  PCI: aardvark: Fix checking for link up via LTSSM state
  PCI: aardvark: Fix link training
  PCI: Add PCI_EXP_LNKCTL2_TLS* macros
  PCI: aardvark: Fix PCIe Max Payload Size setting
  PCI: aardvark: Configure PCIe resources from 'ranges' DT property
  PCI: aardvark: Remove PCIe outbound window configuration
  PCI: aardvark: Update comment about disabling link training
  PCI: aardvark: Move PCIe reset card code to advk_pcie_train_link()
  PCI: aardvark: Fix compilation on s390
  PCI: aardvark: Don't touch PCIe registers if no card connected
  PCI: aardvark: Introduce an advk_pcie_valid_device() helper
  PCI: aardvark: Indicate error in 'val' when config read fails
  PCI: aardvark: Replace custom macros by standard linux/pci_regs.h macros
  PCI: aardvark: Issue PERST via GPIO
  PCI: aardvark: Improve link training
  PCI: aardvark: Train link immediately after enabling training
  PCI: aardvark: Wait for endpoint to be ready before training link
  PCI: aardvark: Fix a leaked reference by adding missing of_node_put()
  PCI: aardvark: Fix I/O space page leak
  s390/mm: validate VMA in PGSTE manipulation functions
  tracing: Check pid filtering when creating events
  vhost/vsock: fix incorrect used length reported to the guest
  net/smc: Don't call clcsock shutdown twice when smc shutdown
  MIPS: use 3-level pgtable for 64KB page size on MIPS_VA_BITS_48
  tcp_cubic: fix spurious Hystart ACK train detections for not-cwnd-limited flows
  PM: hibernate: use correct mode for swsusp_close()
  net/smc: Ensure the active closing peer first closes clcsock
  ipv6: fix typos in __ip6_finish_output()
  drm/vc4: fix error code in vc4_create_object()
  scsi: mpt3sas: Fix kernel panic during drive powercycle test
  ARM: socfpga: Fix crash with CONFIG_FORTIRY_SOURCE
  NFSv42: Don't fail clone() unless the OP_CLONE operation failed
  net: ieee802154: handle iftypes as u32
  ASoC: topology: Add missing rwsem around snd_ctl_remove() calls
  ARM: dts: BCM5301X: Add interrupt properties to GPIO node
  ARM: dts: BCM5301X: Fix I2C controller interrupt
  netfilter: ipvs: Fix reuse connection if RS weight is 0
  tracing: Fix pid filtering when triggers are attached
  xen: detect uninitialized xenbus in xenbus_init
  xen: don't continue xenstore initialization in case of errors
  fuse: fix page stealing
  staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect()
  HID: wacom: Use "Confidence" flag to prevent reporting invalid contacts
  media: cec: copy sequence field for the reply
  ALSA: ctxfi: Fix out-of-range access
  binder: fix test regression due to sender_euid change
  usb: hub: Fix locking issues with address0_mutex
  usb: hub: Fix usb enumeration issue due to address0 race
  USB: serial: option: add Fibocom FM101-GL variants
  USB: serial: option: add Telit LE910S1 0x9200 composition
  • Loading branch information
Royna2544 committed Dec 7, 2023
2 parents 70595d9 + 3343f72 commit f85754d
Show file tree
Hide file tree
Showing 475 changed files with 4,490 additions and 2,199 deletions.
2 changes: 1 addition & 1 deletion Documentation/admin-guide/hw-vuln/spectre.rst
Original file line number Diff line number Diff line change
Expand Up @@ -468,7 +468,7 @@ Spectre variant 2
before invoking any firmware code to prevent Spectre variant 2 exploits
using the firmware.

Using kernel address space randomization (CONFIG_RANDOMIZE_SLAB=y
Using kernel address space randomization (CONFIG_RANDOMIZE_BASE=y
and CONFIG_SLAB_FREELIST_RANDOM=y in the kernel configuration) makes
attacks on the kernel generally more difficult.

Expand Down
8 changes: 6 additions & 2 deletions Documentation/admin-guide/kernel-parameters.txt
Original file line number Diff line number Diff line change
Expand Up @@ -1905,8 +1905,12 @@
Default is 1 (enabled)

kvm-intel.emulate_invalid_guest_state=
[KVM,Intel] Enable emulation of invalid guest states
Default is 0 (disabled)
[KVM,Intel] Disable emulation of invalid guest state.
Ignored if kvm-intel.enable_unrestricted_guest=1, as
guest state is never invalid for unrestricted guests.
This param doesn't apply to nested guests (L2), as KVM
never emulates invalid L2 guest state.
Default is 1 (enabled)

kvm-intel.flexpriority=
[KVM,Intel] Disable FlexPriority feature (TPR shadow).
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -43,26 +43,26 @@ group emmc_nb

group pwm0
- pin 11 (GPIO1-11)
- functions pwm, gpio
- functions pwm, led, gpio

group pwm1
- pin 12
- functions pwm, gpio
- functions pwm, led, gpio

group pwm2
- pin 13
- functions pwm, gpio
- functions pwm, led, gpio

group pwm3
- pin 14
- functions pwm, gpio
- functions pwm, led, gpio

group pmic1
- pin 17
- pin 7
- functions pmic, gpio

group pmic0
- pin 16
- pin 6
- functions pmic, gpio

group i2c2
Expand Down Expand Up @@ -112,17 +112,25 @@ group usb2_drvvbus1
- functions drvbus, gpio

group sdio_sb
- pins 60-64
- pins 60-65
- functions sdio, gpio

group rgmii
- pins 42-55
- pins 42-53
- functions mii, gpio

group pcie1
- pins 39-40
- pins 39
- functions pcie, gpio

group pcie1_clkreq
- pins 40
- functions pcie, gpio

group smi
- pins 54-55
- functions smi, gpio

group ptp
- pins 56-58
- functions ptp, gpio
Expand Down
11 changes: 6 additions & 5 deletions Documentation/networking/bonding.txt
Original file line number Diff line number Diff line change
Expand Up @@ -191,11 +191,12 @@ ad_actor_sys_prio
ad_actor_system

In an AD system, this specifies the mac-address for the actor in
protocol packet exchanges (LACPDUs). The value cannot be NULL or
multicast. It is preferred to have the local-admin bit set for this
mac but driver does not enforce it. If the value is not given then
system defaults to using the masters' mac address as actors' system
address.
protocol packet exchanges (LACPDUs). The value cannot be a multicast
address. If the all-zeroes MAC is specified, bonding will internally
use the MAC of the bond itself. It is preferred to have the
local-admin bit set for this mac but driver does not enforce it. If
the value is not given then system defaults to using the masters'
mac address as actors' system address.

This parameter has effect only in 802.3ad mode and is available through
SysFs interface.
Expand Down
2 changes: 1 addition & 1 deletion Documentation/networking/ip-sysctl.txt
Original file line number Diff line number Diff line change
Expand Up @@ -1644,7 +1644,7 @@ use_tempaddr - INTEGER

temp_valid_lft - INTEGER
valid lifetime (in seconds) for temporary addresses.
Default: 604800 (7 days)
Default: 172800 (2 days)

temp_prefered_lft - INTEGER
Preferred lifetime (in seconds) for temporary addresses.
Expand Down
3 changes: 1 addition & 2 deletions Documentation/networking/ipvs-sysctl.txt
Original file line number Diff line number Diff line change
Expand Up @@ -30,8 +30,7 @@ conn_reuse_mode - INTEGER

0: disable any special handling on port reuse. The new
connection will be delivered to the same real server that was
servicing the previous connection. This will effectively
disable expire_nodest_conn.
servicing the previous connection.

bit 1: enable rescheduling of new connections when it is safe.
That is, whenever expire_nodest_conn and for TCP sockets, when
Expand Down
2 changes: 1 addition & 1 deletion Makefile
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# SPDX-License-Identifier: GPL-2.0
VERSION = 4
PATCHLEVEL = 14
SUBLEVEL = 256
SUBLEVEL = 264
EXTRAVERSION =
NAME = Petit Gorille

Expand Down
3 changes: 3 additions & 0 deletions arch/Kconfig
Original file line number Diff line number Diff line change
Expand Up @@ -1145,4 +1145,7 @@ config HAVE_ARCH_COMPILER_H
linux/compiler-*.h in order to override macro definitions that those
headers generally provide.

config ARCH_USE_MEMREMAP_PROT
bool

source "kernel/gcov/Kconfig"
44 changes: 28 additions & 16 deletions arch/arm/Kconfig.debug
Original file line number Diff line number Diff line change
Expand Up @@ -16,30 +16,42 @@ config ARM_PTDUMP
kernel.
If in doubt, say "N"

# RMK wants arm kernels compiled with frame pointers or stack unwinding.
# If you know what you are doing and are willing to live without stack
# traces, you can get a slightly smaller kernel by setting this option to
# n, but then RMK will have to kill you ;).
config FRAME_POINTER
bool
depends on !THUMB2_KERNEL
default y if !ARM_UNWIND || FUNCTION_GRAPH_TRACER
choice
prompt "Choose kernel unwinder"
default UNWINDER_ARM if AEABI && !FUNCTION_GRAPH_TRACER
default UNWINDER_FRAME_POINTER if !AEABI || FUNCTION_GRAPH_TRACER
help
This determines which method will be used for unwinding kernel stack
traces for panics, oopses, bugs, warnings, perf, /proc/<pid>/stack,
livepatch, lockdep, and more.

config UNWINDER_FRAME_POINTER
bool "Frame pointer unwinder"
depends on !THUMB2_KERNEL && !CC_IS_CLANG
select ARCH_WANT_FRAME_POINTERS
select FRAME_POINTER
help
If you say N here, the resulting kernel will be slightly smaller and
faster. However, if neither FRAME_POINTER nor ARM_UNWIND are enabled,
when a problem occurs with the kernel, the information that is
reported is severely limited.
This option enables the frame pointer unwinder for unwinding
kernel stack traces.

config ARM_UNWIND
bool "Enable stack unwinding support (EXPERIMENTAL)"
config UNWINDER_ARM
bool "ARM EABI stack unwinder"
depends on AEABI
default y
select ARM_UNWIND
help
This option enables stack unwinding support in the kernel
using the information automatically generated by the
compiler. The resulting kernel image is slightly bigger but
the performance is not affected. Currently, this feature
only works with EABI compilers. If unsure say Y.
only works with EABI compilers.

endchoice

config ARM_UNWIND
bool

config FRAME_POINTER
bool

config OLD_MCOUNT
bool
Expand Down
4 changes: 3 additions & 1 deletion arch/arm/boot/dts/bcm5301x.dtsi
Original file line number Diff line number Diff line change
Expand Up @@ -246,6 +246,8 @@

gpio-controller;
#gpio-cells = <2>;
interrupt-controller;
#interrupt-cells = <2>;
};

pcie0: pcie@12000 {
Expand Down Expand Up @@ -365,7 +367,7 @@
i2c0: i2c@18009000 {
compatible = "brcm,iproc-i2c";
reg = <0x18009000 0x50>;
interrupts = <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>;
interrupts = <GIC_SPI 89 IRQ_TYPE_LEVEL_HIGH>;
#address-cells = <1>;
#size-cells = <0>;
clock-frequency = <100000>;
Expand Down
2 changes: 1 addition & 1 deletion arch/arm/boot/dts/imx6ull-pinfunc.h
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,6 @@
#define MX6ULL_PAD_CSI_DATA04__ESAI_TX_FS 0x01F4 0x0480 0x0000 0x9 0x0
#define MX6ULL_PAD_CSI_DATA05__ESAI_TX_CLK 0x01F8 0x0484 0x0000 0x9 0x0
#define MX6ULL_PAD_CSI_DATA06__ESAI_TX5_RX0 0x01FC 0x0488 0x0000 0x9 0x0
#define MX6ULL_PAD_CSI_DATA07__ESAI_T0 0x0200 0x048C 0x0000 0x9 0x0
#define MX6ULL_PAD_CSI_DATA07__ESAI_TX0 0x0200 0x048C 0x0000 0x9 0x0

#endif /* __DTS_IMX6ULL_PINFUNC_H */
2 changes: 1 addition & 1 deletion arch/arm/boot/dts/socfpga_arria10_socdk_qspi.dts
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@
flash0: n25q00@0 {
#address-cells = <1>;
#size-cells = <1>;
compatible = "n25q00aa";
compatible = "micron,mt25qu02g", "jedec,spi-nor";
reg = <0>;
spi-max-frequency = <100000000>;

Expand Down
2 changes: 1 addition & 1 deletion arch/arm/boot/dts/socfpga_arria5_socdk.dts
Original file line number Diff line number Diff line change
Expand Up @@ -131,7 +131,7 @@
flash: flash@0 {
#address-cells = <1>;
#size-cells = <1>;
compatible = "n25q256a";
compatible = "micron,n25q256a", "jedec,spi-nor";
reg = <0>;
spi-max-frequency = <100000000>;

Expand Down
2 changes: 1 addition & 1 deletion arch/arm/boot/dts/socfpga_cyclone5_socdk.dts
Original file line number Diff line number Diff line change
Expand Up @@ -136,7 +136,7 @@
flash0: n25q00@0 {
#address-cells = <1>;
#size-cells = <1>;
compatible = "n25q00";
compatible = "micron,mt25qu02g", "jedec,spi-nor";
reg = <0>; /* chip select */
spi-max-frequency = <100000000>;

Expand Down
2 changes: 1 addition & 1 deletion arch/arm/boot/dts/socfpga_cyclone5_sockit.dts
Original file line number Diff line number Diff line change
Expand Up @@ -181,7 +181,7 @@
flash: flash@0 {
#address-cells = <1>;
#size-cells = <1>;
compatible = "n25q00";
compatible = "micron,mt25qu02g", "jedec,spi-nor";
reg = <0>;
spi-max-frequency = <100000000>;

Expand Down
2 changes: 1 addition & 1 deletion arch/arm/boot/dts/socfpga_cyclone5_socrates.dts
Original file line number Diff line number Diff line change
Expand Up @@ -87,7 +87,7 @@
flash: flash@0 {
#address-cells = <1>;
#size-cells = <1>;
compatible = "n25q256a";
compatible = "micron,n25q256a", "jedec,spi-nor";
reg = <0>;
spi-max-frequency = <100000000>;
m25p,fast-read;
Expand Down
2 changes: 1 addition & 1 deletion arch/arm/boot/dts/socfpga_cyclone5_sodia.dts
Original file line number Diff line number Diff line change
Expand Up @@ -128,7 +128,7 @@
flash0: n25q512a@0 {
#address-cells = <1>;
#size-cells = <1>;
compatible = "n25q512a";
compatible = "micron,n25q512a", "jedec,spi-nor";
reg = <0>;
spi-max-frequency = <100000000>;

Expand Down
4 changes: 2 additions & 2 deletions arch/arm/boot/dts/socfpga_cyclone5_vining_fpga.dts
Original file line number Diff line number Diff line change
Expand Up @@ -249,7 +249,7 @@
n25q128@0 {
#address-cells = <1>;
#size-cells = <1>;
compatible = "n25q128";
compatible = "micron,n25q128", "jedec,spi-nor";
reg = <0>; /* chip select */
spi-max-frequency = <100000000>;
m25p,fast-read;
Expand All @@ -266,7 +266,7 @@
n25q00@1 {
#address-cells = <1>;
#size-cells = <1>;
compatible = "n25q00";
compatible = "micron,mt25qu02g", "jedec,spi-nor";
reg = <1>; /* chip select */
spi-max-frequency = <100000000>;
m25p,fast-read;
Expand Down
8 changes: 8 additions & 0 deletions arch/arm/include/asm/tlb.h
Original file line number Diff line number Diff line change
Expand Up @@ -280,6 +280,14 @@ tlb_remove_pmd_tlb_entry(struct mmu_gather *tlb, pmd_t *pmdp, unsigned long addr
tlb_add_flush(tlb, addr);
}

static inline void
tlb_flush_pmd_range(struct mmu_gather *tlb, unsigned long address,
unsigned long size)
{
tlb_add_flush(tlb, address);
tlb_add_flush(tlb, address + size - PMD_SIZE);
}

#define pte_free_tlb(tlb, ptep, addr) __pte_free_tlb(tlb, ptep, addr)
#define pmd_free_tlb(tlb, pmdp, addr) __pmd_free_tlb(tlb, pmdp, addr)
#define pud_free_tlb(tlb, pudp, addr) pud_free((tlb)->mm, pudp)
Expand Down
8 changes: 3 additions & 5 deletions arch/arm/kernel/entry-armv.S
Original file line number Diff line number Diff line change
Expand Up @@ -624,11 +624,9 @@ call_fpe:
tstne r0, #0x04000000 @ bit 26 set on both ARM and Thumb-2
reteq lr
and r8, r0, #0x00000f00 @ mask out CP number
THUMB( lsr r8, r8, #8 )
mov r7, #1
add r6, r10, #TI_USED_CP
ARM( strb r7, [r6, r8, lsr #8] ) @ set appropriate used_cp[]
THUMB( strb r7, [r6, r8] ) @ set appropriate used_cp[]
add r6, r10, r8, lsr #8 @ add used_cp[] array offset first
strb r7, [r6, #TI_USED_CP] @ set appropriate used_cp[]
#ifdef CONFIG_IWMMXT
@ Test if we need to give access to iWMMXt coprocessors
ldr r5, [r10, #TI_FLAGS]
Expand All @@ -637,7 +635,7 @@ call_fpe:
bcs iwmmxt_task_enable
#endif
ARM( add pc, pc, r8, lsr #6 )
THUMB( lsl r8, r8, #2 )
THUMB( lsr r8, r8, #6 )
THUMB( add pc, r8 )
nop

Expand Down
2 changes: 1 addition & 1 deletion arch/arm/mach-socfpga/core.h
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@ extern void __iomem *sdr_ctl_base_addr;
u32 socfpga_sdram_self_refresh(u32 sdr_base);
extern unsigned int socfpga_sdram_self_refresh_sz;

extern char secondary_trampoline, secondary_trampoline_end;
extern char secondary_trampoline[], secondary_trampoline_end[];

extern unsigned long socfpga_cpu1start_addr;

Expand Down
8 changes: 4 additions & 4 deletions arch/arm/mach-socfpga/platsmp.c
Original file line number Diff line number Diff line change
Expand Up @@ -31,14 +31,14 @@

static int socfpga_boot_secondary(unsigned int cpu, struct task_struct *idle)
{
int trampoline_size = &secondary_trampoline_end - &secondary_trampoline;
int trampoline_size = secondary_trampoline_end - secondary_trampoline;

if (socfpga_cpu1start_addr) {
/* This will put CPU #1 into reset. */
writel(RSTMGR_MPUMODRST_CPU1,
rst_manager_base_addr + SOCFPGA_RSTMGR_MODMPURST);

memcpy(phys_to_virt(0), &secondary_trampoline, trampoline_size);
memcpy(phys_to_virt(0), secondary_trampoline, trampoline_size);

writel(__pa_symbol(secondary_startup),
sys_manager_base_addr + (socfpga_cpu1start_addr & 0x000000ff));
Expand All @@ -56,12 +56,12 @@ static int socfpga_boot_secondary(unsigned int cpu, struct task_struct *idle)

static int socfpga_a10_boot_secondary(unsigned int cpu, struct task_struct *idle)
{
int trampoline_size = &secondary_trampoline_end - &secondary_trampoline;
int trampoline_size = secondary_trampoline_end - secondary_trampoline;

if (socfpga_cpu1start_addr) {
writel(RSTMGR_MPUMODRST_CPU1, rst_manager_base_addr +
SOCFPGA_A10_RSTMGR_MODMPURST);
memcpy(phys_to_virt(0), &secondary_trampoline, trampoline_size);
memcpy(phys_to_virt(0), secondary_trampoline, trampoline_size);

writel(__pa_symbol(secondary_startup),
sys_manager_base_addr + (socfpga_cpu1start_addr & 0x00000fff));
Expand Down
Loading

0 comments on commit f85754d

Please sign in to comment.