Commit Graph

3451 Commits

Author SHA1 Message Date
Tao Huang
b50aca0c9a Merge tag 'ASB-2021-02-05_4.19-stable' of https://android.googlesource.com/kernel/common
https://source.android.com/security/bulletin/2021-02-01
CVE-2017-18509
CVE-2020-10767

* tag 'ASB-2021-02-05_4.19-stable': (809 commits)
  ANDROID: GKI: fix up abi issues with 4.19.172
  Linux 4.19.172
  fs: fix lazytime expiration handling in __writeback_single_inode()
  writeback: Drop I_DIRTY_TIME_EXPIRE
  dm integrity: conditionally disable "recalculate" feature
  tools: Factor HOSTCC, HOSTLD, HOSTAR definitions
  tracing: Fix race in trace_open and buffer resize call
  HID: wacom: Correct NULL dereference on AES pen proximity
  futex: Handle faults correctly for PI futexes
  futex: Simplify fixup_pi_state_owner()
  futex: Use pi_state_update_owner() in put_pi_state()
  rtmutex: Remove unused argument from rt_mutex_proxy_unlock()
  futex: Provide and use pi_state_update_owner()
  futex: Replace pointless printk in fixup_owner()
  futex: Ensure the correct return value from futex_lock_pi()
  futex: Prevent exit livelock
  futex: Provide distinct return value when owner is exiting
  futex: Add mutex around futex exit
  futex: Provide state handling for exec() as well
  futex: Sanitize exit state handling
  ...

Change-Id: Ieba6ee3a91a05d504e1f829a84e7d364e7d983f2

Conflicts:
	arch/arm64/boot/dts/rockchip/rk3328.dtsi
	drivers/md/Kconfig
	drivers/usb/gadget/function/f_uac2.c
2021-02-26 15:30:04 +08:00
Greg Kroah-Hartman
709f9b702e This is the 4.19.171 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmAROwsACgkQONu9yGCS
 aT4T5w//XnQz3KLe6G/Gu641fwHbOmNmYg/Ob43DRj0JtMRDFsGm7wl5KVYXgf3l
 eI4/K8vMevO0XlSly8Xo8MkYoKiVbv8BX/owsZ9SUTbcGguJ79xKjJ++cXnezsFf
 knwiHKQRg+3KM/PZdT29mgkcYo2T6ndcmeq1Q2Q49Xn7vDdCCJuzLYccKRRaR5zm
 RoWn9AKtobUaFhuhkMm4gi0mkpH9viD4Su62k3EjQW8ysE5l4OPmlMcy6M+dpt5A
 Nh0DMsMnjuqPp1Bm5bSSY5gJ7foHZ9iNAC7UxoD+EIXPMN1jVOoCnqmfSKy+dE65
 ROgex14HP1Zmrn5Zj7spc4zX2zWMbIyJgLQDpp+0dK+4wpINw97yXXoyYW+V5iyY
 ouf5BKXfudv4Du/PiKkAqf/s0Q5Lh19XSns0hygb+WG67h0CLJxQcH3o2wFWKzl3
 JniD5BohTYpqsu5V/zSANqJuugHVxyx2N2SSWtpsYZoFX7GRCtNBOV2NSgH65jW7
 S+N4Md8Hfx6rlp+BOkhKfBtDePev6orrSt4wxZ4JSRH++/ztFKo/1CY23NkLsdGN
 9PIC6dawYIPTNGtrczwvmebEdBUbEYDBLyeKTcCeRLB1yP4sbb4a2yOoCmjdmAeD
 AKUMnx2+20Tl5k67HdrUKxA17KJ1qD5IkurfQkRpUo2uUkSEqpY=
 =Ao4u
 -----END PGP SIGNATURE-----

Merge 4.19.171 into android-4.19-stable

Changes in 4.19.171
	i2c: bpmp-tegra: Ignore unknown I2C_M flags
	ALSA: seq: oss: Fix missing error check in snd_seq_oss_synth_make_info()
	ALSA: hda/via: Add minimum mute flag
	ACPI: scan: Make acpi_bus_get_device() clear return pointer on error
	btrfs: fix lockdep splat in btrfs_recover_relocation
	mmc: core: don't initialize block size from ext_csd if not present
	mmc: sdhci-xenon: fix 1.8v regulator stabilization
	dm: avoid filesystem lookup in dm_get_dev_t()
	dm integrity: fix a crash if "recalculate" used without "internal_hash"
	drm/atomic: put state on error path
	ASoC: Intel: haswell: Add missing pm_ops
	scsi: ufs: Correct the LUN used in eh_device_reset_handler() callback
	scsi: qedi: Correct max length of CHAP secret
	riscv: Fix kernel time_init()
	HID: Ignore battery for Elan touchscreen on ASUS UX550
	clk: tegra30: Add hda clock default rates to clock driver
	xen: Fix event channel callback via INTX/GSI
	drm/nouveau/bios: fix issue shadowing expansion ROMs
	drm/nouveau/privring: ack interrupts the same way as RM
	drm/nouveau/i2c/gm200: increase width of aux semaphore owner fields
	drm/nouveau/mmu: fix vram heap sizing
	drm/nouveau/kms/nv50-: fix case where notifier buffer is at offset 0
	scsi: megaraid_sas: Fix MEGASAS_IOC_FIRMWARE regression
	i2c: octeon: check correct size of maximum RECV_LEN packet
	platform/x86: intel-vbtn: Drop HP Stream x360 Convertible PC 11 from allow-list
	selftests: net: fib_tests: remove duplicate log test
	can: dev: can_restart: fix use after free bug
	can: vxcan: vxcan_xmit: fix use after free bug
	can: peak_usb: fix use after free bugs
	iio: ad5504: Fix setting power-down state
	irqchip/mips-cpu: Set IPI domain parent chip
	intel_th: pci: Add Alder Lake-P support
	stm class: Fix module init return on allocation failure
	serial: mvebu-uart: fix tx lost characters at power off
	ehci: fix EHCI host controller initialization sequence
	USB: ehci: fix an interrupt calltrace error
	usb: gadget: aspeed: fix stop dma register setting.
	usb: udc: core: Use lock when write to soft_connect
	usb: bdc: Make bdc pci driver depend on BROKEN
	xhci: make sure TRB is fully written before giving it to the controller
	xhci: tegra: Delay for disabling LFPS detector
	driver core: Extend device_is_dependent()
	netfilter: rpfilter: mask ecn bits before fib lookup
	sh: dma: fix kconfig dependency for G2_DMA
	sh_eth: Fix power down vs. is_opened flag ordering
	skbuff: back tiny skbs with kmalloc() in __netdev_alloc_skb() too
	kasan: fix unaligned address is unhandled in kasan_remove_zero_shadow
	kasan: fix incorrect arguments passing in kasan_add_zero_shadow
	udp: mask TOS bits in udp_v4_early_demux()
	ipv6: create multicast route with RTPROT_KERNEL
	net_sched: avoid shift-out-of-bounds in tcindex_set_parms()
	net_sched: reject silly cell_log in qdisc_get_rtab()
	ipv6: set multicast flag on the multicast route
	net: mscc: ocelot: allow offloading of bridge on top of LAG
	net: Disable NETIF_F_HW_TLS_RX when RXCSUM is disabled
	net: dsa: b53: fix an off by one in checking "vlan->vid"
	Linux 4.19.171

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I2be7d084a443bfc87e6a3d5753d9c233f54788ac
2021-01-27 11:45:59 +01:00
Lars-Peter Clausen
166bd161d6 iio: ad5504: Fix setting power-down state
commit efd597b283 upstream.

The power-down mask of the ad5504 is actually a power-up mask. Meaning if
a bit is set the corresponding channel is powered up and if it is not set
the channel is powered down.

The driver currently has this the wrong way around, resulting in the
channel being powered up when requested to be powered down and vice versa.

Fixes: 3bbbf150ff ("staging:iio:dac:ad5504: Use strtobool for boolean values")
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Link: https://lore.kernel.org/r/20201209104649.5794-1-lars@metafoo.de
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-27 11:05:39 +01:00
Greg Kroah-Hartman
5905c14687 This is the 4.19.168 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmAENesACgkQONu9yGCS
 aT7VQg//Sr2GXQqTswXLMTMFCALNh7jSzYthMwvok9RqEeNg4bZlaXNFyylZxAgr
 q3WSPCtmJWlQ2L5mjae5qYnIvgrvf5uKRhVoiZ+piDPIaz1HLixO+oNosxsBVFc8
 Mx0OZpTP5TPRRLEyprOyQBo0fI3v4NHKQ3PYbJPzqA5jRSU+i5r1opKh8y+6pZjN
 PXdpZSinHpzs7qXWpPU3xEvmqy7TbNicD/SzJm12yoyVM3e1eB12rPDvaNMqGdLZ
 lgGhvcIunDS+rtNWrjnG4hXpKPfrpNFmH/QUK1v+/5oZDwFNn9tf1hIar5fu6T9U
 4gHhEiKlrRfJhZwgjppUTpMvt14q/XyOV3Bty3ekl6kjWalSAbffOrWongmAs5fG
 Xz/hPrhl2bO/WtXmyvuV8oQcuSc+7Ufu5lPAVALOtQcVqurOS/6KmylOWTuYaSqv
 oLzlHgHfBUf6ES1HRNb7Rn+li7c7DNzydtlr3jGxagn1ZTj6/I8GfI+UxyVPVCie
 Rq9C5ul6tE9bWnDCJEuTvEIKu11GysZqFk8nWKomXidc0pgWtr2nEtVzrsLXY+rp
 mrfmXwtHOlNmgW+kl9DFqgLUbo2kzefn62zVekbG3R7Oni3xs+YwbxZHJVkkFkXz
 G5ggw96v7M/kVRMzg/kuRaF3oYVJn6iQOueP+haX+YwoAUPjD0c=
 =zbAi
 -----END PGP SIGNATURE-----

Merge 4.19.168 into android-4.19-stable

Changes in 4.19.168
	net: cdc_ncm: correct overhead in delayed_ndp_size
	net: hns3: fix the number of queues actually used by ARQ
	net: stmmac: dwmac-sun8i: Balance internal PHY resource references
	net: stmmac: dwmac-sun8i: Balance internal PHY power
	net: vlan: avoid leaks on register_vlan_dev() failures
	net/sonic: Fix some resource leaks in error handling paths
	net: ip: always refragment ip defragmented packets
	net: fix pmtu check in nopmtudisc mode
	net: ipv6: fib: flush exceptions when purging route
	chtls: Fix hardware tid leak
	chtls: Remove invalid set_tcb call
	chtls: Fix panic when route to peer not configured
	chtls: Replace skb_dequeue with skb_peek
	chtls: Added a check to avoid NULL pointer dereference
	chtls: Fix chtls resources release sequence
	x86/resctrl: Use an IPI instead of task_work_add() to update PQR_ASSOC MSR
	x86/resctrl: Don't move a task to the same resource group
	vmlinux.lds.h: Add PGO and AutoFDO input sections
	drm/i915: Fix mismatch between misplaced vma check and vma insert
	spi: pxa2xx: Fix use-after-free on unbind
	iio: imu: st_lsm6dsx: flip irq return logic
	iio: imu: st_lsm6dsx: fix edge-trigger interrupts
	HID: wacom: Fix memory leakage caused by kfifo_alloc
	ARM: OMAP2+: omap_device: fix idling of devices during probe
	i2c: sprd: use a specific timeout to avoid system hang up issue
	cpufreq: powernow-k8: pass policy rather than use cpufreq_cpu_get()
	spi: stm32: FIFO threshold level - fix align packet size
	dmaengine: mediatek: mtk-hsdma: Fix a resource leak in the error handling path of the probe function
	dmaengine: xilinx_dma: check dma_async_device_register return value
	dmaengine: xilinx_dma: fix incompatible param warning in _child_probe()
	dmaengine: xilinx_dma: fix mixed_enum_type coverity warning
	wil6210: select CONFIG_CRC32
	block: rsxx: select CONFIG_CRC32
	lightnvm: select CONFIG_CRC32
	iommu/intel: Fix memleak in intel_irq_remapping_alloc
	net/mlx5e: Fix memleak in mlx5e_create_l2_table_groups
	net/mlx5e: Fix two double free cases
	regmap: debugfs: Fix a memory leak when calling regmap_attach_dev
	wan: ds26522: select CONFIG_BITREVERSE
	KVM: arm64: Don't access PMCR_EL0 when no PMU is available
	block: fix use-after-free in disk_part_iter_next
	net: drop bogus skb with CHECKSUM_PARTIAL and offset beyond end of trimmed packet
	regmap: debugfs: Fix a reversed if statement in regmap_debugfs_init()
	Linux 4.19.168

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ia39a78431db8bf624b3d0c0940be36c514b79a77
2021-01-17 15:40:58 +01:00
Lorenzo Bianconi
b7d8a1a073 iio: imu: st_lsm6dsx: fix edge-trigger interrupts
commit 3f9bce7a22 upstream

If we are using edge IRQs, new samples can arrive while processing
current interrupt since there are no hw guarantees the irq line
stays "low" long enough to properly detect the new interrupt.
In this case the new sample will be missed.
Polling FIFO status register in st_lsm6dsx_handler_thread routine
allow us to read new samples even if the interrupt arrives while
processing previous data and the timeslot where the line is "low"
is too short to be properly detected.

Fixes: 89ca88a7cd ("iio: imu: st_lsm6dsx: support active-low interrupts")
Fixes: 290a6ce11d ("iio: imu: add support to lsm6dsx driver")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://lore.kernel.org/r/5e93cda7dc1e665f5685c53ad8e9ea71dbae782d.1605378871.git.lorenzo@kernel.org
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
[sudip: manual backport to old irq handler path]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-17 14:04:21 +01:00
Sean Nyekjaer
11126289d8 iio: imu: st_lsm6dsx: flip irq return logic
commit ec76d918f2 upstream

No need for using reverse logic in the irq return,
fix this by flip things around.

Signed-off-by: Sean Nyekjaer <sean@geanix.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-17 14:04:20 +01:00
Greg Kroah-Hartman
f0eb67744b This is the 4.19.166 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl/5pRkACgkQONu9yGCS
 aT501BAAyZvZU8L2J0/PKodZL6+o8+jDdejiIZfBNZPn1423GYvH7lQt25EUnXEZ
 PNozCiIygV9S7T6MnbRivHVTw0cwaDX/Ud0pUxw84KOvZ1MMhxotpk39F9KaztBe
 Qqi33DIQYUu1CRdb+ITj5Lrzq5kEGVCLXli7X/8F70I8EzInIKv2xQtwzjxVbmoW
 2EtQCtTiyXKmXtSBJXrFNznAnRySIPL02RXusLMNMqQvQPqdtAcqFDFMCvQsAvEv
 Bza64ZnRgzWeJv7LVhlZEuTbSDulpvf54X7LRp24AEOSchFVW0XT+UcCJDleH0nz
 QwASkmO0OJ2Kw5W/gaRgGOI7OLtBT6w+SVumFaLh4zphU/LU8fOFVOOfbaVUqgxY
 tLqPi3+63cuR2ZCaQGQfVfXGg7lL8GuUc7HxLinRcq6ke4l9YJuyb/M7bzHCgF++
 jGQrzgrcUW3RttjXavc5MfxXC+bf2r1IfMXfbmxW5ivygVvZtkXT4GeAIesi2jFv
 nmjU1jPf97cX/vuTTmdEaVBTTgxkat/5CZJb7U3nwwS94t2NTjQpHa197pNPev6V
 VF2ApHJ3iCkZzqtsynTv792GHcX1sZHPXSK1y9KqQXJs2S0ESDpJ5IaEtE9igBnw
 lZmlchdcTv4oZSNZvERtqYQNui14scG3+UPuyhGAhpsgECDE0tA=
 =GfSF
 -----END PGP SIGNATURE-----

Merge 4.19.166 into android-4.19-stable

Changes in 4.19.166
	Revert "mtd: spinand: Fix OOB read"
	dmaengine: at_hdmac: Substitute kzalloc with kmalloc
	dmaengine: at_hdmac: add missing put_device() call in at_dma_xlate()
	dmaengine: at_hdmac: add missing kfree() call in at_dma_xlate()
	kdev_t: always inline major/minor helper functions
	iio:imu:bmi160: Fix alignment and data leak issues
	iio:magnetometer:mag3110: Fix alignment and data leak issues.
	mwifiex: Fix possible buffer overflows in mwifiex_cmd_802_11_ad_hoc_start
	Linux 4.19.166

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ib7d0ce70832eb58e4aed2b7b6f29082184f64299
2021-01-09 16:46:11 +01:00
Jonathan Cameron
f817a9938e iio:magnetometer:mag3110: Fix alignment and data leak issues.
commit 89deb13342 upstream

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp() assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses an array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here.  We close both issues by
moving to a suitable structure in the iio_priv() data.
This data is allocated with kzalloc() so no data can leak apart from
previous readings.

The explicit alignment of ts is not necessary in this case but
does make the code slightly less fragile so I have included it.

Fixes: 39631b5f95 ("iio: Add Freescale mag3110 magnetometer driver")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200920112742.170751-4-jic23@kernel.org
[sudip: adjust context]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-09 13:43:48 +01:00
Jonathan Cameron
74729e663d iio:imu:bmi160: Fix alignment and data leak issues
commit 7b6b51234d upstream

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses an array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here.  We close both issues by
moving to a suitable array in the iio_priv() data with alignment
explicitly requested.  This data is allocated with kzalloc() so no
data can leak apart from previous readings.

In this driver, depending on which channels are enabled, the timestamp
can be in a number of locations.  Hence we cannot use a structure
to specify the data layout without it being misleading.

Fixes: 77c4ad2d6a ("iio: imu: Add initial support for Bosch BMI160")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Cc: Daniel Baluta  <daniel.baluta@gmail.com>
Cc: Daniel Baluta <daniel.baluta@oss.nxp.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200920112742.170751-6-jic23@kernel.org
[sudip: adjust context and use bmi160_data in old location]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-09 13:43:48 +01:00
Greg Kroah-Hartman
07ce88e9de This is the 4.19.164 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl/sVdwACgkQONu9yGCS
 aT581g/+KZ4lFcY/lAEY6/n6RjFenerl5O2a4tqO+j7eivOA8aNOzXQpvwcPXFKZ
 uCCwab3shrp0MdOJ4Ub1qLF5rZoJ/QvLNkI+8GVRztnchkWHwNlYbheZqHRows9E
 LM5w/+SUh+I7wymfjsjxr8ohSOxkvygNL9PLLTkuQMwbs/jjdizmcgqeYo54Plih
 IdtHrp/ZjxKMOu+fkp1dpTy2RUfbxxWS4RnVjSI+g3s8vaxWh90jMCwLP3fyUwpX
 a8eNCFkIV0lBCj+dYF+ry5x7wGd9mvCVAG70DmRkHd4nyc1WGnp+yz3lQlQnIzeq
 Hc7k3ts3FXmXBSRTzkqM9pmaOuyrKwqu3DoiplXxHgjeJYegP9k0jh33eohXmc/u
 qSz9XB3FhBxy7uRf8tqGLKiUsARnQUYfqzR8qgGFndvWRpIBr9egSzDKVNSF5uWu
 bPt3UQpM8O714NcnB2PGs4OUPqxSikT3BrnfurZOzEddkSveXfkItYnt3mc300bx
 MSHYY/iuLpsBeDd0U6POgf5J5RigmOWvayZrMkPSxlnm7v9diefpKo7xB7+l3AqD
 DZ5BSZMNtgKHwzck6d3RXX+GCILreL16Lj299NM1SJPm+j5SEkna7luikgi2pqrk
 r2cD31L9JHiq36L3uP5u30JoxEG6+W2Px+dqc+uyB3RXHJzRwy4=
 =TKv4
 -----END PGP SIGNATURE-----

Merge 4.19.164 into android-4.19-stable

Changes in 4.19.164
	Kbuild: do not emit debug info for assembly with LLVM_IAS=1
	x86/lib: Change .weak to SYM_FUNC_START_WEAK for arch/x86/lib/mem*_64.S
	spi: bcm2835aux: Fix use-after-free on unbind
	spi: bcm2835aux: Restore err assignment in bcm2835aux_spi_probe
	iwlwifi: pcie: limit memory read spin time
	arm64: dts: rockchip: Assign a fixed index to mmc devices on rk3399 boards.
	iwlwifi: mvm: fix kernel panic in case of assert during CSA
	powerpc: Drop -me200 addition to build flags
	ARC: stack unwinding: don't assume non-current task is sleeping
	scsi: ufs: Make sure clk scaling happens only when HBA is runtime ACTIVE
	irqchip/gic-v3-its: Unconditionally save/restore the ITS state on suspend
	soc: fsl: dpio: Get the cpumask through cpumask_of(cpu)
	platform/x86: thinkpad_acpi: Do not report SW_TABLET_MODE on Yoga 11e
	platform/x86: thinkpad_acpi: Add BAT1 is primary battery quirk for Thinkpad Yoga 11e 4th gen
	platform/x86: acer-wmi: add automatic keyboard background light toggle key as KEY_LIGHTS_TOGGLE
	platform/x86: intel-vbtn: Support for tablet mode on HP Pavilion 13 x360 PC
	Input: cm109 - do not stomp on control URB
	Input: i8042 - add Acer laptops to the i8042 reset list
	pinctrl: amd: remove debounce filter setting in IRQ type setting
	mmc: block: Fixup condition for CMD13 polling for RPMB requests
	kbuild: avoid static_assert for genksyms
	scsi: be2iscsi: Revert "Fix a theoretical leak in beiscsi_create_eqs()"
	x86/mm/mem_encrypt: Fix definition of PMD_FLAGS_DEC_WP
	x86/membarrier: Get rid of a dubious optimization
	x86/apic/vector: Fix ordering in vector assignment
	compiler.h: fix barrier_data() on clang
	PCI: qcom: Add missing reset for ipq806x
	mac80211: mesh: fix mesh_pathtbl_init() error path
	net: stmmac: free tx skb buffer in stmmac_resume()
	tcp: select sane initial rcvq_space.space for big MSS
	tcp: fix cwnd-limited bug for TSO deferral where we send nothing
	net/mlx4_en: Avoid scheduling restart task if it is already running
	lan743x: fix for potential NULL pointer dereference with bare card
	net/mlx4_en: Handle TX error CQE
	net: stmmac: delete the eee_ctrl_timer after napi disabled
	net: stmmac: dwmac-meson8b: fix mask definition of the m250_sel mux
	net: bridge: vlan: fix error return code in __vlan_add()
	ktest.pl: If size of log is too big to email, email error message
	USB: dummy-hcd: Fix uninitialized array use in init()
	USB: add RESET_RESUME quirk for Snapscan 1212
	ALSA: usb-audio: Fix potential out-of-bounds shift
	ALSA: usb-audio: Fix control 'access overflow' errors from chmap
	xhci: Give USB2 ports time to enter U3 in bus suspend
	USB: UAS: introduce a quirk to set no_write_same
	USB: sisusbvga: Make console support depend on BROKEN
	ALSA: pcm: oss: Fix potential out-of-bounds shift
	serial: 8250_omap: Avoid FIFO corruption caused by MDR1 access
	drm/xen-front: Fix misused IS_ERR_OR_NULL checks
	drm: fix drm_dp_mst_port refcount leaks in drm_dp_mst_allocate_vcpi
	arm64: lse: fix LSE atomics with LLVM's integrated assembler
	arm64: lse: Fix LSE atomics with LLVM
	arm64: Change .weak to SYM_FUNC_START_WEAK_PI for arch/arm64/lib/mem*.S
	x86/resctrl: Remove unused struct mbm_state::chunks_bw
	x86/resctrl: Fix incorrect local bandwidth when mba_sc is enabled
	pinctrl: merrifield: Set default bias in case no particular value given
	pinctrl: baytrail: Avoid clearing debounce value when turning it off
	ARM: dts: sun8i: v3s: fix GIC node memory range
	gpio: mvebu: fix potential user-after-free on probe
	scsi: bnx2i: Requires MMU
	xsk: Fix xsk_poll()'s return type
	can: softing: softing_netdev_open(): fix error handling
	clk: renesas: r9a06g032: Drop __packed for portability
	block: factor out requeue handling from dispatch code
	netfilter: x_tables: Switch synchronization to RCU
	gpio: eic-sprd: break loop when getting NULL device resource
	selftests/bpf/test_offload.py: Reset ethtool features after failed setting
	RDMA/cm: Fix an attempt to use non-valid pointer when cleaning timewait
	ixgbe: avoid premature Rx buffer reuse
	drm/tegra: replace idr_init() by idr_init_base()
	kernel/cpu: add arch override for clear_tasks_mm_cpumask() mm handling
	drm/tegra: sor: Disable clocks on error in tegra_sor_init()
	arm64: syscall: exit userspace before unmasking exceptions
	vxlan: Add needed_headroom for lower device
	vxlan: Copy needed_tailroom from lowerdev
	scsi: mpt3sas: Increase IOCInit request timeout to 30s
	dm table: Remove BUG_ON(in_interrupt())
	soc/tegra: fuse: Fix index bug in get_process_id
	USB: serial: option: add interface-number sanity check to flag handling
	USB: gadget: f_acm: add support for SuperSpeed Plus
	USB: gadget: f_midi: setup SuperSpeed Plus descriptors
	usb: gadget: f_fs: Re-use SS descriptors for SuperSpeedPlus
	USB: gadget: f_rndis: fix bitrate for SuperSpeed and above
	usb: chipidea: ci_hdrc_imx: Pass DISABLE_DEVICE_STREAMING flag to imx6ul
	ARM: dts: exynos: fix roles of USB 3.0 ports on Odroid XU
	ARM: dts: exynos: fix USB 3.0 VBUS control and over-current pins on Exynos5410
	ARM: dts: exynos: fix USB 3.0 pins supply being turned off on Odroid XU
	coresight: tmc-etr: Check if page is valid before dma_map_page()
	scsi: megaraid_sas: Check user-provided offsets
	HID: i2c-hid: add Vero K147 to descriptor override
	serial_core: Check for port state when tty is in error state
	Bluetooth: Fix slab-out-of-bounds read in hci_le_direct_adv_report_evt()
	quota: Sanity-check quota file headers on load
	media: msi2500: assign SPI bus number dynamically
	crypto: af_alg - avoid undefined behavior accessing salg_name
	md: fix a warning caused by a race between concurrent md_ioctl()s
	perf cs-etm: Change tuple from traceID-CPU# to traceID-metadata
	perf cs-etm: Move definition of 'traceid_list' global variable from header file
	drm/gma500: fix double free of gma_connector
	drm/tve200: Fix handling of platform_get_irq() error
	soc: renesas: rmobile-sysc: Fix some leaks in rmobile_init_pm_domains()
	soc: mediatek: Check if power domains can be powered on at boot time
	soc: qcom: geni: More properly switch to DMA mode
	RDMA/bnxt_re: Set queue pair state when being queried
	selinux: fix error initialization in inode_doinit_with_dentry()
	ARM: dts: aspeed: s2600wf: Fix VGA memory region location
	RDMA/rxe: Compute PSN windows correctly
	x86/mm/ident_map: Check for errors from ident_pud_init()
	ARM: p2v: fix handling of LPAE translation in BE mode
	x86/apic: Fix x2apic enablement without interrupt remapping
	sched/deadline: Fix sched_dl_global_validate()
	sched: Reenable interrupts in do_sched_yield()
	crypto: talitos - Endianess in current_desc_hdr()
	crypto: talitos - Fix return type of current_desc_hdr()
	crypto: inside-secure - Fix sizeof() mismatch
	powerpc/64: Set up a kernel stack for secondaries before cpu_restore()
	spi: img-spfi: fix reference leak in img_spfi_resume
	drm/msm/dsi_pll_10nm: restore VCO rate during restore_state
	ASoC: pcm: DRAIN support reactivation
	selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling
	arm64: dts: exynos: Include common syscon restart/poweroff for Exynos7
	arm64: dts: exynos: Correct psci compatible used on Exynos7
	Bluetooth: Fix null pointer dereference in hci_event_packet()
	Bluetooth: hci_h5: fix memory leak in h5_close
	spi: spi-ti-qspi: fix reference leak in ti_qspi_setup
	spi: tegra20-slink: fix reference leak in slink ops of tegra20
	spi: tegra20-sflash: fix reference leak in tegra_sflash_resume
	spi: tegra114: fix reference leak in tegra spi ops
	spi: bcm63xx-hsspi: fix missing clk_disable_unprepare() on error in bcm63xx_hsspi_resume
	mwifiex: fix mwifiex_shutdown_sw() causing sw reset failure
	ASoC: wm8998: Fix PM disable depth imbalance on error
	ASoC: arizona: Fix a wrong free in wm8997_probe
	RDMa/mthca: Work around -Wenum-conversion warning
	MIPS: BCM47XX: fix kconfig dependency bug for BCM47XX_BCMA
	crypto: qat - fix status check in qat_hal_put_rel_rd_xfer()
	staging: greybus: codecs: Fix reference counter leak in error handling
	staging: gasket: interrupt: fix the missed eventfd_ctx_put() in gasket_interrupt.c
	media: tm6000: Fix sizeof() mismatches
	media: mtk-vcodec: add missing put_device() call in mtk_vcodec_release_dec_pm()
	ASoC: meson: fix COMPILE_TEST error
	scsi: core: Fix VPD LUN ID designator priorities
	media: solo6x10: fix missing snd_card_free in error handling case
	video: fbdev: atmel_lcdfb: fix return error code in atmel_lcdfb_of_init()
	drm/omap: dmm_tiler: fix return error code in omap_dmm_probe()
	Input: ads7846 - fix race that causes missing releases
	Input: ads7846 - fix integer overflow on Rt calculation
	Input: ads7846 - fix unaligned access on 7845
	usb/max3421: fix return error code in max3421_probe()
	spi: mxs: fix reference leak in mxs_spi_probe
	powerpc/feature: Fix CPU_FTRS_ALWAYS by removing CPU_FTRS_GENERIC_32
	crypto: crypto4xx - Replace bitwise OR with logical OR in crypto4xx_build_pd
	crypto: omap-aes - Fix PM disable depth imbalance in omap_aes_probe
	spi: fix resource leak for drivers without .remove callback
	soc: ti: knav_qmss: fix reference leak in knav_queue_probe
	soc: ti: Fix reference imbalance in knav_dma_probe
	drivers: soc: ti: knav_qmss_queue: Fix error return code in knav_queue_probe
	Input: omap4-keypad - fix runtime PM error handling
	RDMA/cxgb4: Validate the number of CQEs
	memstick: fix a double-free bug in memstick_check
	ARM: dts: at91: sama5d4_xplained: add pincontrol for USB Host
	ARM: dts: at91: sama5d3_xplained: add pincontrol for USB Host
	orinoco: Move context allocation after processing the skb
	cw1200: fix missing destroy_workqueue() on error in cw1200_init_common
	dmaengine: mv_xor_v2: Fix error return code in mv_xor_v2_probe()
	media: siano: fix memory leak of debugfs members in smsdvb_hotplug
	platform/x86: mlx-platform: Remove PSU EEPROM from default platform configuration
	platform/x86: mlx-platform: Remove PSU EEPROM from MSN274x platform configuration
	samples: bpf: Fix lwt_len_hist reusing previous BPF map
	mips: cdmm: fix use-after-free in mips_cdmm_bus_discover
	media: max2175: fix max2175_set_csm_mode() error code
	slimbus: qcom-ngd-ctrl: Avoid sending power requests without QMI
	HSI: omap_ssi: Don't jump to free ID in ssi_add_controller()
	ARM: dts: Remove non-existent i2c1 from 98dx3236
	arm64: dts: rockchip: Set dr_mode to "host" for OTG on rk3328-roc-cc
	power: supply: axp288_charger: Fix HP Pavilion x2 10 DMI matching
	power: supply: bq24190_charger: fix reference leak
	genirq/irqdomain: Don't try to free an interrupt that has no mapping
	PCI: Bounds-check command-line resource alignment requests
	PCI: Fix overflow in command-line resource alignment requests
	PCI: iproc: Fix out-of-bound array accesses
	arm64: dts: meson: fix spi-max-frequency on Khadas VIM2
	ARM: dts: at91: at91sam9rl: fix ADC triggers
	platform/x86: dell-smbios-base: Fix error return code in dell_smbios_init
	ath10k: Fix the parsing error in service available event
	ath10k: Fix an error handling path
	ath10k: Release some resources in an error handling path
	NFSv4.2: condition READDIR's mask for security label based on LSM state
	SUNRPC: xprt_load_transport() needs to support the netid "rdma6"
	lockd: don't use interval-based rebinding over TCP
	NFS: switch nfsiod to be an UNBOUND workqueue.
	vfio-pci: Use io_remap_pfn_range() for PCI IO memory
	media: saa7146: fix array overflow in vidioc_s_audio()
	clocksource/drivers/cadence_ttc: Fix memory leak in ttc_setup_clockevent()
	ARM: dts: at91: sama5d2: map securam as device
	pinctrl: falcon: add missing put_device() call in pinctrl_falcon_probe()
	arm64: dts: rockchip: Fix UART pull-ups on rk3328
	memstick: r592: Fix error return in r592_probe()
	net/mlx5: Properly convey driver version to firmware
	ASoC: jz4740-i2s: add missed checks for clk_get()
	dm ioctl: fix error return code in target_message
	clocksource/drivers/arm_arch_timer: Correct fault programming of CNTKCTL_EL1.EVNTI
	cpufreq: highbank: Add missing MODULE_DEVICE_TABLE
	cpufreq: mediatek: Add missing MODULE_DEVICE_TABLE
	cpufreq: st: Add missing MODULE_DEVICE_TABLE
	cpufreq: loongson1: Add missing MODULE_ALIAS
	cpufreq: scpi: Add missing MODULE_ALIAS
	scsi: qedi: Fix missing destroy_workqueue() on error in __qedi_probe
	scsi: pm80xx: Fix error return in pm8001_pci_probe()
	seq_buf: Avoid type mismatch for seq_buf_init
	scsi: fnic: Fix error return code in fnic_probe()
	platform/x86: mlx-platform: Fix item counter assignment for MSN2700, MSN24xx systems
	powerpc/pseries/hibernation: drop pseries_suspend_begin() from suspend ops
	powerpc/pseries/hibernation: remove redundant cacheinfo update
	usb: ehci-omap: Fix PM disable depth umbalance in ehci_hcd_omap_probe
	usb: oxu210hp-hcd: Fix memory leak in oxu_create
	speakup: fix uninitialized flush_lock
	nfsd: Fix message level for normal termination
	nfs_common: need lock during iterate through the list
	x86/kprobes: Restore BTF if the single-stepping is cancelled
	bus: fsl-mc: fix error return code in fsl_mc_object_allocate()
	clk: tegra: Fix duplicated SE clock entry
	extcon: max77693: Fix modalias string
	mac80211: don't set set TDLS STA bandwidth wider than possible
	ASoC: wm_adsp: remove "ctl" from list on error in wm_adsp_create_control()
	irqchip/alpine-msi: Fix freeing of interrupts on allocation error path
	watchdog: sirfsoc: Add missing dependency on HAS_IOMEM
	watchdog: sprd: remove watchdog disable from resume fail path
	watchdog: sprd: check busy bit before new loading rather than after that
	watchdog: Fix potential dereferencing of null pointer
	um: Monitor error events in IRQ controller
	um: tty: Fix handling of close in tty lines
	um: chan_xterm: Fix fd leak
	nfc: s3fwrn5: Release the nfc firmware
	powerpc/ps3: use dma_mapping_error()
	checkpatch: fix unescaped left brace
	net: bcmgenet: Fix a resource leak in an error handling path in the probe functin
	net: allwinner: Fix some resources leak in the error handling path of the probe and in the remove function
	net: korina: fix return value
	libnvdimm/label: Return -ENXIO for no slot in __blk_label_update
	watchdog: qcom: Avoid context switch in restart handler
	watchdog: coh901327: add COMMON_CLK dependency
	clk: ti: Fix memleak in ti_fapll_synth_setup
	pwm: zx: Add missing cleanup in error path
	pwm: lp3943: Dynamically allocate PWM chip base
	perf record: Fix memory leak when using '--user-regs=?' to list registers
	qlcnic: Fix error code in probe
	clk: s2mps11: Fix a resource leak in error handling paths in the probe function
	clk: sunxi-ng: Make sure divider tables have sentinel
	kconfig: fix return value of do_error_if()
	ARM: sunxi: Add machine match for the Allwinner V3 SoC
	cfg80211: initialize rekey_data
	fix namespaced fscaps when !CONFIG_SECURITY
	lwt: Disable BH too in run_lwt_bpf()
	Input: cros_ec_keyb - send 'scancodes' in addition to key events
	Input: goodix - add upside-down quirk for Teclast X98 Pro tablet
	media: gspca: Fix memory leak in probe
	media: sunxi-cir: ensure IR is handled when it is continuous
	media: netup_unidvb: Don't leak SPI master in probe error path
	media: ipu3-cio2: Remove traces of returned buffers
	media: ipu3-cio2: Return actual subdev format
	media: ipu3-cio2: Serialise access to pad format
	media: ipu3-cio2: Validate mbus format in setting subdev format
	media: ipu3-cio2: Make the field on subdev format V4L2_FIELD_NONE
	Input: cyapa_gen6 - fix out-of-bounds stack access
	ALSA: hda/ca0132 - Change Input Source enum strings.
	PM: ACPI: PCI: Drop acpi_pm_set_bridge_wakeup()
	Revert "ACPI / resources: Use AE_CTRL_TERMINATE to terminate resources walks"
	ACPI: PNP: compare the string length in the matching_id()
	ALSA: hda: Fix regressions on clear and reconfig sysfs
	ALSA: hda/realtek - Enable headset mic of ASUS X430UN with ALC256
	ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255
	ALSA: pcm: oss: Fix a few more UBSAN fixes
	ALSA: hda/realtek: Add quirk for MSI-GP73
	ALSA: hda/realtek: Apply jack fixup for Quanta NL3
	ALSA: usb-audio: Add VID to support native DSD reproduction on FiiO devices
	ALSA: usb-audio: Disable sample read check if firmware doesn't give back
	s390/smp: perform initial CPU reset also for SMT siblings
	s390/kexec_file: fix diag308 subcode when loading crash kernel
	s390/dasd: fix hanging device offline processing
	s390/dasd: prevent inconsistent LCU device data
	s390/dasd: fix list corruption of pavgroup group list
	s390/dasd: fix list corruption of lcu list
	staging: comedi: mf6x4: Fix AI end-of-conversion detection
	powerpc/perf: Exclude kernel samples while counting events in user space.
	crypto: ecdh - avoid unaligned accesses in ecdh_set_secret()
	EDAC/amd64: Fix PCI component registration
	USB: serial: mos7720: fix parallel-port state restore
	USB: serial: digi_acceleport: fix write-wakeup deadlocks
	USB: serial: keyspan_pda: fix dropped unthrottle interrupts
	USB: serial: keyspan_pda: fix write deadlock
	USB: serial: keyspan_pda: fix stalled writes
	USB: serial: keyspan_pda: fix write-wakeup use-after-free
	USB: serial: keyspan_pda: fix tx-unthrottle use-after-free
	USB: serial: keyspan_pda: fix write unthrottling
	ext4: fix a memory leak of ext4_free_data
	ext4: fix deadlock with fs freezing and EA inodes
	KVM: arm64: Introduce handling of AArch32 TTBCR2 traps
	ARM: dts: pandaboard: fix pinmux for gpio user button of Pandaboard ES
	ARM: dts: at91: sama5d2: fix CAN message ram offset and size
	powerpc: Fix incorrect stw{, ux, u, x} instructions in __set_pte_at
	powerpc/rtas: Fix typo of ibm,open-errinjct in RTAS filter
	powerpc/xmon: Change printk() to pr_cont()
	powerpc/powernv/memtrace: Don't leak kernel memory to user space
	powerpc/powernv/memtrace: Fix crashing the kernel when enabling concurrently
	ima: Don't modify file descriptor mode on the fly
	ceph: fix race in concurrent __ceph_remove_cap invocations
	SMB3: avoid confusing warning message on mount to Azure
	SMB3.1.1: do not log warning message if server doesn't populate salt
	ubifs: wbuf: Don't leak kernel memory to flash
	jffs2: Fix GC exit abnormally
	jfs: Fix array index bounds check in dbAdjTree
	drm/dp_aux_dev: check aux_dev before use in drm_dp_aux_dev_get_by_minor()
	spi: spi-sh: Fix use-after-free on unbind
	spi: davinci: Fix use-after-free on unbind
	spi: pic32: Don't leak DMA channels in probe error path
	spi: rb4xx: Don't leak SPI master in probe error path
	spi: sc18is602: Don't leak SPI master in probe error path
	spi: st-ssc4: Fix unbalanced pm_runtime_disable() in probe error path
	spi: mt7621: fix missing clk_disable_unprepare() on error in mt7621_spi_probe
	soc: qcom: smp2p: Safely acquire spinlock without IRQs
	mtd: spinand: Fix OOB read
	mtd: parser: cmdline: Fix parsing of part-names with colons
	mtd: rawnand: qcom: Fix DMA sync on FLASH_STATUS register read
	scsi: lpfc: Fix invalid sleeping context in lpfc_sli4_nvmet_alloc()
	scsi: lpfc: Re-fix use after free in lpfc_rq_buf_free()
	iio: buffer: Fix demux update
	iio: adc: rockchip_saradc: fix missing clk_disable_unprepare() on error in rockchip_saradc_resume
	iio:light:rpr0521: Fix timestamp alignment and prevent data leak.
	iio:light:st_uvis25: Fix timestamp alignment and prevent data leak.
	iio:pressure:mpl3115: Force alignment of buffer
	iio:imu:bmi160: Fix too large a buffer.
	md/cluster: block reshape with remote resync job
	md/cluster: fix deadlock when node is doing resync job
	pinctrl: sunxi: Always call chained_irq_{enter, exit} in sunxi_pinctrl_irq_handler
	clk: mvebu: a3700: fix the XTAL MODE pin to MPP1_9
	xen-blkback: set ring->xenblkd to NULL after kthread_stop()
	xen/xenbus: Allow watches discard events before queueing
	xen/xenbus: Add 'will_handle' callback support in xenbus_watch_path()
	xen/xenbus/xen_bus_type: Support will_handle watch callback
	xen/xenbus: Count pending messages for each watch
	xenbus/xenbus_backend: Disallow pending watch messages
	libnvdimm/namespace: Fix reaping of invalidated block-window-namespace labels
	platform/x86: intel-vbtn: Allow switch events on Acer Switch Alpha 12
	PCI: Fix pci_slot_release() NULL pointer dereference
	platform/x86: mlx-platform: remove an unused variable
	Linux 4.19.164

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I8e2d24b45393ee2360186893d4e578e20156c7f1
2020-12-30 12:19:31 +01:00
Jonathan Cameron
d4911cdcd3 iio:imu:bmi160: Fix too large a buffer.
commit dc7de42d6b upstream.

The comment implies this device has 3 sensor types, but it only
has an accelerometer and a gyroscope (both 3D).  As such the
buffer does not need to be as long as stated.

Note I've separated this from the following patch which fixes
the alignment for passing to iio_push_to_buffers_with_timestamp()
as they are different issues even if they affect the same line
of code.

Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Cc: Daniel Baluta <daniel.baluta@oss.nxp.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200920112742.170751-5-jic23@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:26:16 +01:00
Jonathan Cameron
e4c3573b76 iio:pressure:mpl3115: Force alignment of buffer
commit 198cf32f05 upstream.

Whilst this is another case of the issue Lars reported with
an array of elements of smaller than 8 bytes being passed
to iio_push_to_buffers_with_timestamp(), the solution here is
a bit different from the other cases and relies on __aligned
working on the stack (true since 4.6?)

This one is unusual.  We have to do an explicit memset() each time
as we are reading 3 bytes into a potential 4 byte channel which
may sometimes be a 2 byte channel depending on what is enabled.
As such, moving the buffer to the heap in the iio_priv structure
doesn't save us much.  We can't use a nice explicit structure
on the stack either as the data channels have different storage
sizes and are all separately controlled.

Fixes: cc26ad455f ("iio: Add Freescale MPL3115A2 pressure / temperature sensor driver")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Cc: Peter Meerwald <pmeerw@pmeerw.net>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200920112742.170751-7-jic23@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:26:16 +01:00
Jonathan Cameron
8660424807 iio:light:st_uvis25: Fix timestamp alignment and prevent data leak.
commit d837a996f5 upstream.

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp() assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses an array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here.  We close both issues by
moving to a suitable structure in the iio_priv()

This data is allocated with kzalloc() so no data can leak apart
from previous readings.

A local unsigned int variable is used for the regmap call so it
is clear there is no potential issue with writing into the padding
of the structure.

Fixes: 3025c8688c ("iio: light: add support for UVIS25 sensor")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200920112742.170751-3-jic23@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:26:15 +01:00
Jonathan Cameron
c0d48a11c4 iio:light:rpr0521: Fix timestamp alignment and prevent data leak.
commit a61817216b upstream.

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp() assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses an array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here.  We close both issues by
moving to a suitable structure in the iio_priv().
This data is allocated with kzalloc() so no data can leak apart
from previous readings and in this case the status byte from the device.

The forced alignment of ts is not necessary in this case but it
potentially makes the code less fragile.

>From personal communications with Mikko:

We could probably split the reading of the int register, but it
would mean a significant performance cost of 20 i2c clock cycles.

Fixes: e12ffd241c ("iio: light: rpr0521 triggered buffer")
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Cc: Mikko Koivunen <mikko.koivunen@fi.rohmeurope.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200920112742.170751-2-jic23@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:26:15 +01:00
Qinglang Miao
3c472f0a8b iio: adc: rockchip_saradc: fix missing clk_disable_unprepare() on error in rockchip_saradc_resume
commit 560c6b914c upstream.

Fix the missing clk_disable_unprepare() of info->pclk
before return from rockchip_saradc_resume in the error
handling case when fails to prepare and enable info->clk.

Suggested-by: Robin Murphy <robin.murphy@arm.com>
Fixes: 44d6f2ef94 ("iio: adc: add driver for Rockchip saradc")
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201103120743.110662-1-miaoqinglang@huawei.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:26:15 +01:00
Nuno Sá
de1174bfe1 iio: buffer: Fix demux update
commit 19ef7b70ca upstream.

When updating the buffer demux, we will skip a scan element from the
device in the case `in_ind != out_ind` and we enter the while loop.
in_ind should only be refreshed with `find_next_bit()` in the end of the
loop.

Note, to cause problems we need a situation where we are skippig over
an element (channel not enabled) that happens to not have the same size
as the next element.   Whilst this is a possible situation we haven't
actually identified any cases in mainline where it happens as most drivers
have consistent channel storage sizes with the exception of the timestamp
which is the last element and hence never skipped over.

Fixes: 5ada4ea9be ("staging:iio: add demux optionally to path from device to buffer")
Signed-off-by: Nuno Sá <nuno.sa@analog.com>
Link: https://lore.kernel.org/r/20201112144323.28887-1-nuno.sa@analog.com
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:26:15 +01:00
Tao Huang
5647c1d492 Merge tag 'ASB-2020-12-05_4.19-stable' of https://android.googlesource.com/kernel/common
https://source.android.com/security/bulletin/2020-12-01
CVE-2020-0444
CVE-2020-0465
CVE-2020-0466

* tag 'ASB-2020-12-05_4.19-stable': (636 commits)
  ANDROID: kbuild: use grep -F instead of fgrep
  ANDROID: GKI: usb: gadget: support claiming indexed endpoints by name
  UPSTREAM: arm64: sysreg: Clean up instructions for modifying PSTATE fields
  Revert "Revert "ANDROID: clang: update to 11.0.5""
  ANDROID: kbuild: speed up ksym_dep_filter
  Revert "drm/atomic_helper: Stop modesets on unregistered connectors harder"
  Linux 4.19.161
  USB: core: Fix regression in Hercules audio card
  x86/resctrl: Add necessary kernfs_put() calls to prevent refcount leak
  x86/resctrl: Remove superfluous kernfs_get() calls to prevent refcount leak
  x86/speculation: Fix prctl() when spectre_v2_user={seccomp,prctl},ibpb
  usb: gadget: Fix memleak in gadgetfs_fill_super
  USB: quirks: Add USB_QUIRK_DISCONNECT_SUSPEND quirk for Lenovo A630Z TIO built-in usb-audio card
  usb: gadget: f_midi: Fix memleak in f_midi_alloc
  USB: core: Change %pK for __user pointers to %px
  perf probe: Fix to die_entrypc() returns error correctly
  can: m_can: fix nominal bitiming tseg2 min for version >= 3.1
  platform/x86: toshiba_acpi: Fix the wrong variable assignment
  platform/x86: thinkpad_acpi: Send tablet mode switch at wakeup time
  can: gs_usb: fix endianess problem with candleLight firmware
  ...

Change-Id: I82ccfc3d6561d3ef3b1b06ac98d48fac997c8fb6

Conflicts:
	drivers/pinctrl/pinctrl-rockchip.c
	drivers/usb/dwc3/gadget.c
	drivers/usb/host/xhci.c
	drivers/usb/host/xhci.h
2020-12-29 16:10:48 +08:00
Simon Xue
7f1fcf680e iio: adc: rockchip_saradc: trigger saradc test via sys for test
Take RK3568 as an example:

start sampling:
echo "chn number" > /sys/devices/platform/fe720000.saradc/saradc_test_chn

stop sampling:
echo 8 > /sys/devices/platform/fe720000.saradc/saradc_test_chn

Change-Id: I320bee7a9a9f293dd83defdede4cd1e5974ec527
Signed-off-by: Simon Xue <xxm@rock-chips.com>
2020-12-01 09:42:31 +08:00
Greg Kroah-Hartman
f8d9d560b9 This is the 4.19.160 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl+8/EkACgkQONu9yGCS
 aT6g6xAAxZs2sTi6peZpLHhzTgMUZtZYJf9rgAWeF3wwIT1DeEVi8dpOuQbu6j17
 bK65D/qJjmiZGJbFG+Mjt5GcQBOnQz+hQ+EaaADk3HOt6G9oFB99Bybmg6JP94TH
 184JkzUMBnHWj9O4wBtF9IjqPoN5iDIz07D8RArxAqXW8+IWX6BjY2Qzd/dO2vns
 UufBBoKznAC1HWwI1WGyMTki+DHtk1m8hV4+H0G4wHrux4cQRXWzxZx3Zfnmkjqh
 v7Ig90GzVegxHjreYc7RnxDi4XCgOhRqevB+0uf5jms7mzd4spxz1kaAZqO5r/DQ
 tTn/90CL2n7+LC6HGZSGnD5WdKawEZwgbimjpsAQ8uygWyzTJ23hL71ZiGxFaKPc
 Yc7UqVMsSsFCAxUc+ri7ZLrKqBEn3NFZNNjAlqZRW4k1ayjuNz7EdP6CS9T6AZih
 vqmeygmnALbKaX/VPDk/GChWtcpSOfNRA4d3XkSdANavIsNoI114tKZOwwLUQQjd
 D/8h2gng7gnX6TquMQSLyQmYTTV3UxK8UW1Ipi00KLMfmYVHMSI0gn2fGDUwOyfJ
 vkwi/15GJXKQ+GJAvkuyJEDTwFE0iU/+gM28Jv56L9Kv25vWu7vdQVcDU6vslEhY
 bbPMzkOA8zSwOkTZTWS8k6cpMMeiWbIZyxHKovXsU84n0nSf6Hs=
 =IcSi
 -----END PGP SIGNATURE-----

Merge 4.19.160 into android-4.19-stable

Changes in 4.19.160
	ah6: fix error return code in ah6_input()
	atm: nicstar: Unmap DMA on send error
	bnxt_en: read EEPROM A2h address using page 0
	devlink: Add missing genlmsg_cancel() in devlink_nl_sb_port_pool_fill()
	inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill()
	lan743x: fix issue causing intermittent kernel log warnings
	lan743x: prevent entire kernel HANG on open, for some platforms
	mlxsw: core: Use variable timeout for EMAD retries
	net: b44: fix error return code in b44_init_one()
	net: bridge: add missing counters to ndo_get_stats64 callback
	net: dsa: mv88e6xxx: Avoid VTU corruption on 6097
	net: Have netpoll bring-up DSA management interface
	netlabel: fix our progress tracking in netlbl_unlabel_staticlist()
	netlabel: fix an uninitialized warning in netlbl_unlabel_staticlist()
	net/mlx4_core: Fix init_hca fields offset
	net: qualcomm: rmnet: Fix incorrect receive packet handling during cleanup
	net: x25: Increase refcnt of "struct x25_neigh" in x25_rx_call_request
	page_frag: Recover from memory pressure
	qed: fix error return code in qed_iwarp_ll2_start()
	qlcnic: fix error return code in qlcnic_83xx_restart_hw()
	sctp: change to hold/put transport for proto_unreach_timer
	tcp: only postpone PROBE_RTT if RTT is < current min_rtt estimate
	net/mlx5: Disable QoS when min_rates on all VFs are zero
	net: usb: qmi_wwan: Set DTR quirk for MR400
	net/ncsi: Fix netlink registration
	net: ftgmac100: Fix crash when removing driver
	pinctrl: rockchip: enable gpio pclk for rockchip_gpio_to_irq
	scsi: ufs: Fix unbalanced scsi_block_reqs_cnt caused by ufshcd_hold()
	selftests: kvm: Fix the segment descriptor layout to match the actual layout
	ACPI: button: Add DMI quirk for Medion Akoya E2228T
	arm64: psci: Avoid printing in cpu_psci_cpu_die()
	vfs: remove lockdep bogosity in __sb_start_write
	arm64: dts: allwinner: a64: Pine64 Plus: Fix ethernet node
	arm64: dts: allwinner: h5: OrangePi PC2: Fix ethernet node
	ARM: dts: sun8i: r40: bananapi-m2-ultra: Fix ethernet node
	Revert "arm: sun8i: orangepi-pc-plus: Set EMAC activity LEDs to active high"
	ARM: dts: sun8i: h3: orangepi-plus2e: Enable RGMII RX/TX delay on Ethernet PHY
	ARM: dts: sun8i: a83t: Enable both RGMII RX/TX delay on Ethernet PHY
	arm64: dts: allwinner: a64: bananapi-m64: Enable RGMII RX/TX delay on PHY
	Input: adxl34x - clean up a data type in adxl34x_probe()
	MIPS: export has_transparent_hugepage() for modules
	arm64: dts: allwinner: h5: OrangePi Prime: Fix ethernet node
	arm: dts: imx6qdl-udoo: fix rgmii phy-mode for ksz9031 phy
	ARM: dts: imx50-evk: Fix the chip select 1 IOMUX
	Input: resistive-adc-touch - fix kconfig dependency on IIO_BUFFER
	perf lock: Don't free "lock_seq_stat" if read_count isn't zero
	ip_tunnels: Set tunnel option flag when tunnel metadata is present
	can: af_can: prevent potential access of uninitialized member in can_rcv()
	can: af_can: prevent potential access of uninitialized member in canfd_rcv()
	can: dev: can_restart(): post buffer from the right context
	can: ti_hecc: Fix memleak in ti_hecc_probe
	can: mcba_usb: mcba_usb_start_xmit(): first fill skb, then pass to can_put_echo_skb()
	can: peak_usb: fix potential integer overflow on shift of a int
	can: m_can: m_can_handle_state_change(): fix state change
	ASoC: qcom: lpass-platform: Fix memory leak
	MIPS: Alchemy: Fix memleak in alchemy_clk_setup_cpu
	drm/sun4i: dw-hdmi: fix error return code in sun8i_dw_hdmi_bind()
	can: kvaser_usb: kvaser_usb_hydra: Fix KCAN bittiming limits
	xfs: fix the minrecs logic when dealing with inode root child blocks
	xfs: strengthen rmap record flags checking
	regulator: ti-abb: Fix array out of bound read access on the first transition
	fail_function: Remove a redundant mutex unlock
	xfs: revert "xfs: fix rmap key and record comparison functions"
	efi/x86: Free efi_pgd with free_pages()
	libfs: fix error cast of negative value in simple_attr_write()
	speakup: Do not let the line discipline be used several times
	ALSA: firewire: Clean up a locking issue in copy_resp_to_buf()
	ALSA: usb-audio: Add delay quirk for all Logitech USB devices
	ALSA: ctl: fix error path at adding user-defined element set
	ALSA: mixart: Fix mutex deadlock
	ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220)
	tty: serial: imx: keep console clocks always on
	efivarfs: fix memory leak in efivarfs_create()
	staging: rtl8723bs: Add 024c:0627 to the list of SDIO device-ids
	ext4: fix bogus warning in ext4_update_dx_flag()
	iio: accel: kxcjk1013: Replace is_smo8500_device with an acpi_type enum
	iio: accel: kxcjk1013: Add support for KIOX010A ACPI DSM for setting tablet-mode
	regulator: pfuze100: limit pfuze-support-disable-sw to pfuze{100,200}
	regulator: fix memory leak with repeated set_machine_constraints()
	regulator: avoid resolve_supply() infinite recursion
	regulator: workaround self-referent regulators
	xtensa: disable preemption around cache alias management calls
	mac80211: minstrel: remove deferred sampling code
	mac80211: minstrel: fix tx status processing corner case
	mac80211: free sta in sta_info_insert_finish() on errors
	s390/cpum_sf.c: fix file permission for cpum_sfb_size
	s390/dasd: fix null pointer dereference for ERP requests
	ptrace: Set PF_SUPERPRIV when checking capability
	seccomp: Set PF_SUPERPRIV when checking capability
	x86/microcode/intel: Check patch signature before saving microcode for early loading
	mm/userfaultfd: do not access vma->vm_mm after calling handle_userfault()
	Linux 4.19.160

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I3a7304be6687f4ffe96f0e765da0c0ec7dcb971d
2020-11-24 14:57:17 +01:00
Hans de Goede
03fe4c0880 iio: accel: kxcjk1013: Add support for KIOX010A ACPI DSM for setting tablet-mode
commit e5b1032a65 upstream.

Some 360 degree hinges (yoga) style 2-in-1 devices use 2 KXCJ91008-s
to allow the OS to determine the angle between the display and the base
of the device, so that the OS can determine if the 2-in-1 is in laptop
or in tablet-mode.

On Windows both accelerometers are read by a special HingeAngleService
process; and this process calls a DSM (Device Specific Method) on the
ACPI KIOX010A device node for the sensor in the display, to let the
embedded-controller (EC) know about the mode so that it can disable the
kbd and touchpad to avoid spurious input while folded into tablet-mode.

This notifying of the EC is problematic because sometimes the EC comes up
thinking that device is in tablet-mode and the kbd and touchpad do not
work. This happens for example on Irbis NB111 devices after a suspend /
resume cycle (after a complete battery drain / hard reset without having
booted Windows at least once). Other 2-in-1s which are likely affected
too are e.g. the Teclast F5 and F6 series.

The kxcjk-1013 driver may seem like a strange place to deal with this,
but since it is *the* driver for the ACPI KIOX010A device, it is also
the driver which has access to the ACPI handle needed by the DSM.

Add support for calling the DSM and on probe unconditionally tell the
EC that the device is laptop mode, fixing the kbd and touchpad sometimes
not working.

Fixes: 7f6232e695 ("iio: accel: kxcjk1013: Add KIOX010A ACPI Hardware-ID")
Reported-and-tested-by: russianneuromancer <russianneuromancer@ya.ru>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201110133835.129080-3-hdegoede@redhat.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-24 13:27:25 +01:00
Hans de Goede
1ee67cb29e iio: accel: kxcjk1013: Replace is_smo8500_device with an acpi_type enum
commit 11e94f28c3 upstream.

Replace the boolean is_smo8500_device variable with an acpi_type enum.

For now this can be either ACPI_GENERIC or ACPI_SMO8500, this is a
preparation patch for adding special handling for the KIOX010A ACPI HID,
which will add a ACPI_KIOX010A acpi_type to the introduced enum.

For stable as needed as precursor for next patch.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Fixes: 7f6232e695 ("iio: accel: kxcjk1013: Add KIOX010A ACPI Hardware-ID")
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201110133835.129080-2-hdegoede@redhat.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-24 13:27:25 +01:00
Heiko Stuebner
679e5ec1ca UPSTREAM: iio: adc: rockchip_saradc: move all of probe to devm-functions
Parts of the saradc probe rely on devm functions and later parts do not.
This makes it more difficult to for example enable triggers via their
devm-functions and would need more undo-work in remove.

So to make life easier for the driver, move the rest of probe calls
also to their devm-equivalents.

This includes moving the clk- and regulator-disabling to a devm_action
so that they gets disabled both during remove and in the error case
in probe, after the action is registered.

Change-Id: Icfab5091b6a988ed5a684fe800ff1cf8fa179a89
Signed-off-by: Heiko Stuebner <heiko.stuebner@theobroma-systems.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Tao Huang <huangtao@rock-chips.com>
(cherry picked from commit d0389d4ed3)
2020-11-19 20:49:11 +08:00
Simon Xue
ce845b03c2 iio: adc: rockchip_saradc: add support for RK3568
Change-Id: I9d83351b1117eba67277cdd0a32e5d0c59ad1c7f
Signed-off-by: Simon Xue <xxm@rock-chips.com>
2020-11-18 17:43:32 +08:00
Greg Kroah-Hartman
d1253c75a8 This is the 4.19.155 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl+jz0oACgkQONu9yGCS
 aT4hPA//Xp0LuMofylz77cZMkWiagSQ5k/4oKn2O2iEISKfdcFMzjcJbRBMmTFFP
 r1T0Uu5N2gZQ8ZAV67itpaA/KV9YlytbDrwRBKQ/mxNMP7xaX+hC43hbPrx72Qc5
 on6v3z9xTxMB2+HwFlJZpsmYrrjqg1ruGtxR5UMZ37Jt7KUYDRbHDbqMEXRkKHko
 pWtZ/8GkY8UG3GNpiPlka9BfDK9X0k5m65r3vscbmgCd7bQFQi9rbp930N0y7MMX
 e/YIBss699EZp6r7hpH1+ETBP6Z2qHxRFY86kcL9I3NcZnI3NrX0pKql0hWlqPOm
 CeR3z6fpW9Xyf1CqQOkyDBCMfvMLsMarwQ+bb8d+zIQD/I4W12whPhGM4eh6rYcu
 2WL4gwiyhju0OuPK7ZcCzMOEPUwWQYvyvwoBnoywZfN5L8702Xi4eN8QqP5l7Hcd
 lcZH5gv/v1z0Xb6pU4AMthbLB+VcQ5w5g3DfvF/A9kOyzmP0YvKa39y8J379mwdJ
 6DXu8DRvee5bYW8LObszzKqshnF79eia+xcf7YFJn1Y2cwh63AQgOcSzaEc5q7/2
 kuWNfrZJCyvt41j48bO7MtTEULeCAtPkuKvVrZuCO7Q4J2wFSWuGCUQTg3bm8dQd
 5B9V6jQKaCIOn3+/dPXg5N6yaRKZR4dHIUsWpKOs1tOQuucpVmw=
 =2s9n
 -----END PGP SIGNATURE-----

Merge 4.19.155 into android-4.19-stable

Changes in 4.19.155
	objtool: Support Clang non-section symbols in ORC generation
	scripts/setlocalversion: make git describe output more reliable
	arm64: Run ARCH_WORKAROUND_1 enabling code on all CPUs
	arm64: link with -z norelro regardless of CONFIG_RELOCATABLE
	x86/PCI: Fix intel_mid_pci.c build error when ACPI is not enabled
	efivarfs: Replace invalid slashes with exclamation marks in dentries.
	chelsio/chtls: fix deadlock issue
	chelsio/chtls: fix memory leaks in CPL handlers
	chelsio/chtls: fix tls record info to user
	gtp: fix an use-before-init in gtp_newlink()
	mlxsw: core: Fix memory leak on module removal
	netem: fix zero division in tabledist
	ravb: Fix bit fields checking in ravb_hwtstamp_get()
	tcp: Prevent low rmem stalls with SO_RCVLOWAT.
	tipc: fix memory leak caused by tipc_buf_append()
	r8169: fix issue with forced threading in combination with shared interrupts
	cxgb4: set up filter action after rewrites
	arch/x86/amd/ibs: Fix re-arming IBS Fetch
	x86/xen: disable Firmware First mode for correctable memory errors
	fuse: fix page dereference after free
	bpf: Fix comment for helper bpf_current_task_under_cgroup()
	evm: Check size of security.evm before using it
	p54: avoid accessing the data mapped to streaming DMA
	cxl: Rework error message for incompatible slots
	RDMA/addr: Fix race with netevent_callback()/rdma_addr_cancel()
	mtd: lpddr: Fix bad logic in print_drs_error
	serial: pl011: Fix lockdep splat when handling magic-sysrq interrupt
	ata: sata_rcar: Fix DMA boundary mask
	fscrypt: return -EXDEV for incompatible rename or link into encrypted dir
	fscrypt: clean up and improve dentry revalidation
	fscrypt: fix race allowing rename() and link() of ciphertext dentries
	fs, fscrypt: clear DCACHE_ENCRYPTED_NAME when unaliasing directory
	fscrypt: only set dentry_operations on ciphertext dentries
	fscrypt: fix race where ->lookup() marks plaintext dentry as ciphertext
	Revert "block: ratelimit handle_bad_sector() message"
	xen/events: don't use chip_data for legacy IRQs
	xen/events: avoid removing an event channel while handling it
	xen/events: add a proper barrier to 2-level uevent unmasking
	xen/events: fix race in evtchn_fifo_unmask()
	xen/events: add a new "late EOI" evtchn framework
	xen/blkback: use lateeoi irq binding
	xen/netback: use lateeoi irq binding
	xen/scsiback: use lateeoi irq binding
	xen/pvcallsback: use lateeoi irq binding
	xen/pciback: use lateeoi irq binding
	xen/events: switch user event channels to lateeoi model
	xen/events: use a common cpu hotplug hook for event channels
	xen/events: defer eoi in case of excessive number of events
	xen/events: block rogue events for some time
	x86/unwind/orc: Fix inactive tasks with stack pointer in %sp on GCC 10 compiled kernels
	mlxsw: core: Fix use-after-free in mlxsw_emad_trans_finish()
	RDMA/qedr: Fix memory leak in iWARP CM
	ata: sata_nv: Fix retrieving of active qcs
	futex: Fix incorrect should_fail_futex() handling
	powerpc/powernv/smp: Fix spurious DBG() warning
	mm: fix exec activate_mm vs TLB shootdown and lazy tlb switching race
	powerpc: select ARCH_WANT_IRQS_OFF_ACTIVATE_MM
	sparc64: remove mm_cpumask clearing to fix kthread_use_mm race
	f2fs: add trace exit in exception path
	f2fs: fix uninit-value in f2fs_lookup
	f2fs: fix to check segment boundary during SIT page readahead
	um: change sigio_spinlock to a mutex
	ARM: 8997/2: hw_breakpoint: Handle inexact watchpoint addresses
	power: supply: bq27xxx: report "not charging" on all types
	xfs: fix realtime bitmap/summary file truncation when growing rt volume
	video: fbdev: pvr2fb: initialize variables
	ath10k: start recovery process when payload length exceeds max htc length for sdio
	ath10k: fix VHT NSS calculation when STBC is enabled
	drm/brige/megachips: Add checking if ge_b850v3_lvds_init() is working correctly
	media: videodev2.h: RGB BT2020 and HSV are always full range
	media: platform: Improve queue set up flow for bug fixing
	usb: typec: tcpm: During PR_SWAP, source caps should be sent only after tSwapSourceStart
	media: tw5864: check status of tw5864_frameinterval_get
	media: imx274: fix frame interval handling
	mmc: via-sdmmc: Fix data race bug
	drm/bridge/synopsys: dsi: add support for non-continuous HS clock
	arm64: topology: Stop using MPIDR for topology information
	printk: reduce LOG_BUF_SHIFT range for H8300
	ia64: kprobes: Use generic kretprobe trampoline handler
	kgdb: Make "kgdbcon" work properly with "kgdb_earlycon"
	media: uvcvideo: Fix dereference of out-of-bound list iterator
	riscv: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO
	cpufreq: sti-cpufreq: add stih418 support
	USB: adutux: fix debugging
	uio: free uio id after uio file node is freed
	usb: xhci: omit duplicate actions when suspending a runtime suspended host.
	arm64/mm: return cpu_all_mask when node is NUMA_NO_NODE
	xfs: don't free rt blocks when we're doing a REMAP bunmapi call
	ACPI: Add out of bounds and numa_off protections to pxm_to_node()
	drivers/net/wan/hdlc_fr: Correctly handle special skb->protocol values
	bus/fsl_mc: Do not rely on caller to provide non NULL mc_io
	power: supply: test_power: add missing newlines when printing parameters by sysfs
	drm/amd/display: HDMI remote sink need mode validation for Linux
	btrfs: fix replace of seed device
	md/bitmap: md_bitmap_get_counter returns wrong blocks
	bnxt_en: Log unknown link speed appropriately.
	rpmsg: glink: Use complete_all for open states
	clk: ti: clockdomain: fix static checker warning
	net: 9p: initialize sun_server.sun_path to have addr's value only when addr is valid
	drivers: watchdog: rdc321x_wdt: Fix race condition bugs
	ext4: Detect already used quota file early
	gfs2: add validation checks for size of superblock
	cifs: handle -EINTR in cifs_setattr
	arm64: dts: renesas: ulcb: add full-pwr-cycle-in-suspend into eMMC nodes
	ARM: dts: omap4: Fix sgx clock rate for 4430
	memory: emif: Remove bogus debugfs error handling
	ARM: dts: s5pv210: remove DMA controller bus node name to fix dtschema warnings
	ARM: dts: s5pv210: move PMU node out of clock controller
	ARM: dts: s5pv210: remove dedicated 'audio-subsystem' node
	nbd: make the config put is called before the notifying the waiter
	sgl_alloc_order: fix memory leak
	nvme-rdma: fix crash when connect rejected
	md/raid5: fix oops during stripe resizing
	mmc: sdhci-acpi: AMDI0040: Set SDHCI_QUIRK2_PRESET_VALUE_BROKEN
	perf/x86/amd/ibs: Don't include randomized bits in get_ibs_op_count()
	perf/x86/amd/ibs: Fix raw sample data accumulation
	leds: bcm6328, bcm6358: use devres LED registering function
	media: uvcvideo: Fix uvc_ctrl_fixup_xu_info() not having any effect
	fs: Don't invalidate page buffers in block_write_full_page()
	NFS: fix nfs_path in case of a rename retry
	ACPI: button: fix handling lid state changes when input device closed
	ACPI / extlog: Check for RDMSR failure
	ACPI: video: use ACPI backlight for HP 635 Notebook
	ACPI: debug: don't allow debugging when ACPI is disabled
	acpi-cpufreq: Honor _PSD table setting on new AMD CPUs
	w1: mxc_w1: Fix timeout resolution problem leading to bus error
	scsi: mptfusion: Fix null pointer dereferences in mptscsih_remove()
	scsi: qla2xxx: Fix crash on session cleanup with unload
	btrfs: qgroup: fix wrong qgroup metadata reserve for delayed inode
	btrfs: improve device scanning messages
	btrfs: reschedule if necessary when logging directory items
	btrfs: send, recompute reference path after orphanization of a directory
	btrfs: use kvzalloc() to allocate clone_roots in btrfs_ioctl_send()
	btrfs: cleanup cow block on error
	btrfs: fix use-after-free on readahead extent after failure to create it
	usb: xhci: Workaround for S3 issue on AMD SNPS 3.0 xHC
	usb: dwc3: ep0: Fix ZLP for OUT ep0 requests
	usb: dwc3: gadget: Check MPS of the request length
	usb: dwc3: core: add phy cleanup for probe error handling
	usb: dwc3: core: don't trigger runtime pm when remove driver
	usb: cdc-acm: fix cooldown mechanism
	usb: typec: tcpm: reset hard_reset_count for any disconnect
	usb: host: fsl-mph-dr-of: check return of dma_set_mask()
	drm/i915: Force VT'd workarounds when running as a guest OS
	vt: keyboard, simplify vt_kdgkbsent
	vt: keyboard, extend func_buf_lock to readers
	HID: wacom: Avoid entering wacom_wac_pen_report for pad / battery
	udf: Fix memory leak when mounting
	dmaengine: dma-jz4780: Fix race in jz4780_dma_tx_status
	iio:light:si1145: Fix timestamp alignment and prevent data leak.
	iio:adc:ti-adc0832 Fix alignment issue with timestamp
	iio:adc:ti-adc12138 Fix alignment issue with timestamp
	iio:gyro:itg3200: Fix timestamp alignment and prevent data leak.
	powerpc/drmem: Make lmb_size 64 bit
	s390/stp: add locking to sysfs functions
	powerpc/rtas: Restrict RTAS requests from userspace
	powerpc: Warn about use of smt_snooze_delay
	powerpc/powernv/elog: Fix race while processing OPAL error log event.
	powerpc: Fix undetected data corruption with P9N DD2.1 VSX CI load emulation
	NFSv4.2: support EXCHGID4_FLAG_SUPP_FENCE_OPS 4.2 EXCHANGE_ID flag
	NFSD: Add missing NFSv2 .pc_func methods
	ubifs: dent: Fix some potential memory leaks while iterating entries
	perf python scripting: Fix printable strings in python3 scripts
	ubi: check kthread_should_stop() after the setting of task state
	ia64: fix build error with !COREDUMP
	i2c: imx: Fix external abort on interrupt in exit paths
	drm/amdgpu: don't map BO in reserved region
	drm/amd/display: Don't invoke kgdb_breakpoint() unconditionally
	ceph: promote to unsigned long long before shifting
	libceph: clear con->out_msg on Policy::stateful_server faults
	9P: Cast to loff_t before multiplying
	ring-buffer: Return 0 on success from ring_buffer_resize()
	vringh: fix __vringh_iov() when riov and wiov are different
	ext4: fix leaking sysfs kobject after failed mount
	ext4: fix error handling code in add_new_gdb
	ext4: fix invalid inode checksum
	drm/ttm: fix eviction valuable range check.
	rtc: rx8010: don't modify the global rtc ops
	tty: make FONTX ioctl use the tty pointer they were actually passed
	arm64: berlin: Select DW_APB_TIMER_OF
	cachefiles: Handle readpage error correctly
	hil/parisc: Disable HIL driver when it gets stuck
	arm: dts: mt7623: add missing pause for switchport
	ARM: samsung: fix PM debug build with DEBUG_LL but !MMU
	ARM: s3c24xx: fix missing system reset
	device property: Keep secondary firmware node secondary by type
	device property: Don't clear secondary pointer for shared primary firmware node
	KVM: arm64: Fix AArch32 handling of DBGD{CCINT,SCRext} and DBGVCR
	staging: comedi: cb_pcidas: Allow 2-channel commands for AO subdevice
	staging: octeon: repair "fixed-link" support
	staging: octeon: Drop on uncorrectable alignment or FCS error
	Linux 4.19.155

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I18fefb5bfaa4d05772c61c2975340d0f089b8e3e
2020-11-05 14:02:27 +01:00
Jonathan Cameron
c7975bd7fd iio:gyro:itg3200: Fix timestamp alignment and prevent data leak.
commit 10ab7cfd55 upstream.

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses a 16 byte array of smaller elements on the stack.
This is fixed by using an explicit c structure. As there are no
holes in the structure, there is no possiblity of data leakage
in this case.

The explicit alignment of ts is not strictly necessary but potentially
makes the code slightly less fragile.  It also removes the possibility
of this being cut and paste into another driver where the alignment
isn't already true.

Fixes: 36e0371e77 ("iio:itg3200: Use iio_push_to_buffers_with_timestamp()")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200722155103.979802-6-jic23@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-05 11:08:51 +01:00
Jonathan Cameron
da58185f7b iio:adc:ti-adc12138 Fix alignment issue with timestamp
commit 293e809b2e upstream.

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses an array of smaller elements on the stack.

We move to a suitable structure in the iio_priv() data with alignment
explicitly requested.  This data is allocated with kzalloc so no
data can leak apart from previous readings. Note that previously
no leak at all could occur, but previous readings should never
be a problem.

In this case the timestamp location depends on what other channels
are enabled. As such we can't use a structure without misleading
by suggesting only one possible timestamp location.

Fixes: 50a6edb1b6 ("iio: adc: add ADC12130/ADC12132/ADC12138 ADC driver")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: Akinobu Mita <akinobu.mita@gmail.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200722155103.979802-26-jic23@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-05 11:08:50 +01:00
Jonathan Cameron
8a8900553d iio:adc:ti-adc0832 Fix alignment issue with timestamp
commit 39e91f3be4 upstream.

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses an array of smaller elements on the stack.

We fix this issues by moving to a suitable structure in the iio_priv()
data with alignment explicitly requested.  This data is allocated
with kzalloc so no data can leak apart from previous readings.
Note that previously no data could leak 'including' previous readings
but I don't think it is an issue to potentially leak them like
this now does.

In this case the postioning of the timestamp is depends on what
other channels are enabled. As such we cannot use a structure to
make the alignment explicit as it would be missleading by suggesting
only one possible location for the timestamp.

Fixes: 815bbc8746 ("iio: ti-adc0832: add triggered buffer support")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: Akinobu Mita <akinobu.mita@gmail.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200722155103.979802-25-jic23@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-05 11:08:50 +01:00
Jonathan Cameron
edd3906136 iio:light:si1145: Fix timestamp alignment and prevent data leak.
commit 0456ecf34d upstream.

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses a 24 byte array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here.  We close both issues by
moving to a suitable array in the iio_priv() data with alignment
explicitly requested.  This data is allocated with kzalloc so no
data can leak appart from previous readings.

Depending on the enabled channels, the  location of the timestamp
can be at various aligned offsets through the buffer.  As such we
any use of a structure to enforce this alignment would incorrectly
suggest a single location for the timestamp.  Comments adjusted to
express this clearly in the code.

Fixes: ac45e57f15 ("iio: light: Add driver for Silabs si1132, si1141/2/3 and si1145/6/7 ambient light, uv index and proximity sensors")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: Peter Meerwald-Stadler <pmeerw@pmeerw.net>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200722155103.979802-9-jic23@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-05 11:08:50 +01:00
Tao Huang
0c17cc5fc3 Merge tag 'ASB-2020-10-05_4.19-stable' of https://android.googlesource.com/kernel/common
https://source.android.com/security/bulletin/2020-10-01
Fix for CVE-2020-0423 not yet public.

* tag 'ASB-2020-10-05_4.19-stable': (518 commits)
  ANDROID: use arm-linux-androidkernel- for CROSS_COMPILE_COMPAT
  ANDROID: build.config.common: enable LLVM=1
  Linux 4.19.149
  KVM: arm64: Assume write fault on S1PTW permission fault on instruction fetch
  ata: sata_mv, avoid trigerrable BUG_ON
  ata: make qc_prep return ata_completion_errors
  ata: define AC_ERR_OK
  kprobes: Fix compiler warning for !CONFIG_KPROBES_ON_FTRACE
  s390/zcrypt: Fix ZCRYPT_PERDEV_REQCNT ioctl
  mm, THP, swap: fix allocating cluster for swapfile by mistake
  kprobes: Fix to check probe enabled before disarm_kprobe_ftrace()
  s390/dasd: Fix zero write for FBA devices
  tracing: fix double free
  KVM: SVM: Add a dedicated INVD intercept routine
  KVM: x86: Reset MMU context if guest toggles CR4.SMAP or CR4.PKE
  MIPS: Add the missing 'CPU_1074K' into __get_cpu_type()
  regmap: fix page selection for noinc reads
  ALSA: asihpi: fix iounmap in error handler
  bpf: Fix a rcu warning for bpffs map pretty-print
  batman-adv: mcast: fix duplicate mcast packets from BLA backbone to mesh
  ...

Change-Id: I5af52b9921cfd8b55aba5b7705a8bc1a4f88db74

Conflicts:
	drivers/tty/serial/8250/8250_port.c
	drivers/usb/core/message.c
	drivers/usb/core/quirks.c
2020-10-10 18:38:14 +08:00
Tao Huang
48f4e7f7c2 Merge tag 'ASB-2020-09-05_4.19-stable' of https://android.googlesource.com/kernel/common
https://source.android.com/security/bulletin/2020-09-01
CVE-2020-0402
CVE-2020-0404
CVE-2020-0407

* tag 'ASB-2020-09-05_4.19-stable': (3616 commits)
  Linux 4.19.143
  ALSA: usb-audio: Update documentation comment for MS2109 quirk
  HID: hiddev: Fix slab-out-of-bounds write in hiddev_ioctl_usage()
  tpm: Unify the mismatching TPM space buffer sizes
  usb: dwc3: gadget: Handle ZLP for sg requests
  usb: dwc3: gadget: Fix handling ZLP
  usb: dwc3: gadget: Don't setup more than requested
  btrfs: check the right error variable in btrfs_del_dir_entries_in_log
  usb: storage: Add unusual_uas entry for Sony PSZ drives
  USB: cdc-acm: rework notification_buffer resizing
  USB: gadget: u_f: Unbreak offset calculation in VLAs
  USB: gadget: f_ncm: add bounds checks to ncm_unwrap_ntb()
  USB: gadget: u_f: add overflow checks to VLA macros
  usb: host: ohci-exynos: Fix error handling in exynos_ohci_probe()
  USB: Ignore UAS for JMicron JMS567 ATA/ATAPI Bridge
  USB: quirks: Ignore duplicate endpoint on Sound Devices MixPre-D
  USB: quirks: Add no-lpm quirk for another Raydium touchscreen
  usb: uas: Add quirk for PNY Pro Elite
  USB: yurex: Fix bad gfp argument
  drm/amd/pm: correct Vega12 swctf limit setting
  ...

Change-Id: Iece02c55e9b3446bdda5dc7bdfbe3e310b2dbc83

Conflicts:
	arch/arm/boot/dts/rk322x.dtsi
	arch/arm64/boot/dts/rockchip/rk3399.dtsi
	arch/arm64/kernel/cpuinfo.c
	drivers/clk/clk.c
	drivers/clk/rockchip/clk-cpu.c
	drivers/clk/rockchip/clk-rk3228.c
	drivers/devfreq/governor_simpleondemand.c
	drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
	drivers/gpu/drm/drm_edid.c
	drivers/hid/usbhid/hid-core.c
	drivers/media/i2c/ov5695.c
	drivers/media/v4l2-core/v4l2-ioctl.c
	drivers/regulator/core.c
	drivers/thermal/cpu_cooling.c
	drivers/usb/core/quirks.c
	drivers/usb/dwc2/platform.c
	drivers/usb/dwc3/core.c
	drivers/usb/dwc3/core.h
	drivers/usb/dwc3/gadget.c
	drivers/usb/host/ehci-platform.c
	drivers/usb/storage/unusual_uas.h
	include/drm/drm_connector.h
	include/linux/clk-provider.h
	include/linux/devfreq.h
	include/linux/pci_ids.h
	kernel/power/wakeup_reason.c
	mm/memory.c
	mm/swapfile.c
2020-09-24 17:59:50 +08:00
Greg Kroah-Hartman
443485d847 This is the 4.19.146 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl9jTJEACgkQONu9yGCS
 aT7XARAAo0FTpcnk62Aqo+Wv1BZOFtDxXTHPsW/1CzK2lebub4CGM0y7cNYBf8XP
 aEytk/RHKhh+F27htxuHZ6T+izQuWbJaM2h7LDwgaWTlmRh2FPEHTI3iwAgzVnM6
 7V5OOcAWkC49CpnsBgEQX++R1SgttHypS+/naZpjeGJwd/ivjLSCBqxqiWt1IT1W
 Qo/LeOjQEbI58lln/3qS9zs0OLByJ/6Y8poYREngof2sbxaOARk8u1gWefe9kuYG
 jYcAKFFj3GGMrK+y5V9R6I/XoAB7/DQA/+LTlrLKuqxMXT+fzgLFFd9Yn/LORiYh
 hlNfvXDTvRL+aZ2LUGXhkUyU24dcO500HxHN7mp5TmWOVgkCa8lruCW5Vu3YLQ0u
 aXajrc9SGJJ9OZSb9Pm5oCkzIN0Io7GIkNaB5qIErur7egFC4/F5wZdShxnrcJhX
 yQRCIgCtQk1HoOuQkAKcaq6o/BjDkuOjFleu30JF+EMWm2KjQMN46td6tAnrxVdW
 CjXQzjYJxnLphZzKwUndmjekZk+OcAgw1E9Qud9F19R306PrL+eVmndh3PZyhNCF
 tga5vmB0acwWSRMRDsGncR3aG3WUt+xLhCy9gER/8amSJm6bBO9ENCJvALFksEJo
 T6t2UvMksr6R1ZqrP66EiJjBCgyyfhEhnctLKvW63yNNjcxhmZs=
 =3vVI
 -----END PGP SIGNATURE-----

Merge 4.19.146 into android-4.19-stable

Changes in 4.19.146
	ARM: dts: logicpd-torpedo-baseboard: Fix broken audio
	ARM: dts: logicpd-som-lv-baseboard: Fix broken audio
	ARM: dts: socfpga: fix register entry for timer3 on Arria10
	ARM: dts: ls1021a: fix QuadSPI-memory reg range
	RDMA/rxe: Fix memleak in rxe_mem_init_user
	RDMA/rxe: Drop pointless checks in rxe_init_ports
	RDMA/bnxt_re: Do not report transparent vlan from QP1
	drm/sun4i: Fix dsi dcs long write function
	scsi: libsas: Set data_dir as DMA_NONE if libata marks qc as NODATA
	RDMA/core: Fix reported speed and width
	mmc: sdhci-msm: Add retries when all tuning phases are found valid
	ARM: dts: bcm: HR2: Fixed QSPI compatible string
	ARM: dts: NSP: Fixed QSPI compatible string
	ARM: dts: BCM5301X: Fixed QSPI compatible string
	arm64: dts: ns2: Fixed QSPI compatible string
	ARC: HSDK: wireup perf irq
	dmaengine: acpi: Put the CSRT table after using it
	netfilter: conntrack: allow sctp hearbeat after connection re-use
	drivers/net/wan/lapbether: Added needed_tailroom
	NFC: st95hf: Fix memleak in st95hf_in_send_cmd
	firestream: Fix memleak in fs_open
	ALSA: hda: Fix 2 channel swapping for Tegra
	drivers/net/wan/lapbether: Set network_header before transmitting
	xfs: initialize the shortform attr header padding entry
	irqchip/eznps: Fix build error for !ARC700 builds
	nvme-fabrics: don't check state NVME_CTRL_NEW for request acceptance
	nvme-rdma: serialize controller teardown sequences
	HID: quirks: Set INCREMENT_USAGE_ON_DUPLICATE for all Saitek X52 devices
	drivers/net/wan/hdlc_cisco: Add hard_header_len
	HID: elan: Fix memleak in elan_input_configured
	ARC: [plat-hsdk]: Switch ethernet phy-mode to rgmii-id
	cpufreq: intel_pstate: Refuse to turn off with HWP enabled
	cpufreq: intel_pstate: Fix intel_pstate_get_hwp_max() for turbo disabled
	ALSA: hda: fix a runtime pm issue in SOF when integrated GPU is disabled
	drm/amdgpu: Fix bug in reporting voltage for CIK
	iommu/amd: Do not use IOMMUv2 functionality when SME is active
	gcov: Disable gcov build with GCC 10
	iio: adc: mcp3422: fix locking scope
	iio: adc: mcp3422: fix locking on error path
	iio: adc: ti-ads1015: fix conversion when CONFIG_PM is not set
	iio:light:ltr501 Fix timestamp alignment issue.
	iio:accel:bmc150-accel: Fix timestamp alignment and prevent data leak.
	iio:adc:ti-adc084s021 Fix alignment and data leak issues.
	iio:adc:ina2xx Fix timestamp alignment issue.
	iio:adc:max1118 Fix alignment of timestamp and data leak issues
	iio:adc:ti-adc081c Fix alignment and data leak issues
	iio:magnetometer:ak8975 Fix alignment and data leak issues.
	iio:light:max44000 Fix timestamp alignment and prevent data leak.
	iio:chemical:ccs811: Fix timestamp alignment and prevent data leak.
	iio: accel: kxsd9: Fix alignment of local buffer.
	iio:accel:mma7455: Fix timestamp alignment and prevent data leak.
	iio:accel:mma8452: Fix timestamp alignment and prevent data leak.
	staging: wlan-ng: fix out of bounds read in prism2sta_probe_usb()
	btrfs: require only sector size alignment for parent eb bytenr
	btrfs: fix lockdep splat in add_missing_dev
	btrfs: fix wrong address when faulting in pages in the search ioctl
	regulator: push allocation in set_consumer_device_supply() out of lock
	scsi: target: iscsi: Fix data digest calculation
	scsi: target: iscsi: Fix hang in iscsit_access_np() when getting tpg->np_login_sem
	drm/tve200: Stabilize enable/disable
	drm/msm: Disable preemption on all 5xx targets
	rbd: require global CAP_SYS_ADMIN for mapping and unmapping
	RDMA/rxe: Fix the parent sysfs read when the interface has 15 chars
	vgacon: remove software scrollback support
	fbcon: remove soft scrollback code
	fbcon: remove now unusued 'softback_lines' cursor() argument
	KVM: VMX: Don't freeze guest when event delivery causes an APIC-access exit
	ARM: dts: vfxxx: Add syscon compatible with OCOTP
	video: fbdev: fix OOB read in vga_8planes_imageblit()
	staging: greybus: audio: fix uninitialized value issue
	phy: qcom-qmp: Use correct values for ipq8074 PCIe Gen2 PHY init
	usb: core: fix slab-out-of-bounds Read in read_descriptors
	USB: serial: ftdi_sio: add IDs for Xsens Mti USB converter
	USB: serial: option: support dynamic Quectel USB compositions
	USB: serial: option: add support for SIM7070/SIM7080/SIM7090 modules
	usb: Fix out of sync data toggle if a configured device is reconfigured
	usb: typec: ucsi: acpi: Check the _DEP dependencies
	gcov: add support for GCC 10.1
	Linux 4.19.146

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ic9b467bc37c7cbbc1e9704d662bc0c8fda05416e
2020-09-17 13:59:19 +02:00
Jonathan Cameron
3cb4aa0027 iio:accel:mma8452: Fix timestamp alignment and prevent data leak.
commit 89226a296d upstream.

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses a 16 byte u8 array on the stack.  As Lars also noted
this anti pattern can involve a leak of data to userspace and that
indeed can happen here.  We close both issues by moving to
a suitable structure in the iio_priv() data with alignment
ensured by use of an explicit c structure.  This data is allocated
with kzalloc so no data can leak appart from previous readings.

The additional forcing of the 8 byte alignment of the timestamp
is not strictly necessary but makes the code less fragile by
making this explicit.

Fixes: c7eeea93ac ("iio: Add Freescale MMA8452Q 3-axis accelerometer driver")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Cc: Peter Meerwald <pmeerw@pmeerw.net>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-17 13:45:28 +02:00
Jonathan Cameron
12a50595ce iio:accel:mma7455: Fix timestamp alignment and prevent data leak.
commit 7e5ac1f220 upstream.

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses a 16 byte u8 array on the stack   As Lars also noted
this anti pattern can involve a leak of data to userspace and that
indeed can happen here.  We close both issues by moving to
a suitable structure in the iio_priv() data with alignment
ensured by use of an explicit c structure.  This data is allocated
with kzalloc so no data can leak appart from previous readings.

The force alignment of ts is not strictly necessary in this particularly
case but does make the code less fragile.

Fixes: a84ef0d181 ("iio: accel: add Freescale MMA7455L/MMA7456L 3-axis accelerometer driver")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Cc: <Stable@vger.kernel.org>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-17 13:45:28 +02:00
Jonathan Cameron
d395aab940 iio: accel: kxsd9: Fix alignment of local buffer.
commit 95ad67577d upstream.

iio_push_to_buffers_with_timestamp assumes 8 byte alignment which
is not guaranteed by an array of smaller elements.

Note that whilst in this particular case the alignment forcing
of the ts element is not strictly necessary it acts as good
documentation.  Doing this where not necessary should cut
down on the number of cut and paste introduced errors elsewhere.

Fixes: 0427a106a9 ("iio: accel: kxsd9: Add triggered buffer handling")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-17 13:45:28 +02:00
Jonathan Cameron
9f67ad0fa7 iio:chemical:ccs811: Fix timestamp alignment and prevent data leak.
commit eb1a148ef4 upstream.

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses an array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here.  We close both issues by
moving to a suitable structure in the iio_priv() data with alignment
explicitly requested.  This data is allocated with kzalloc so no
data can leak appart from previous readings.

The explicit alignment of ts is necessary to ensure consistent
padding for x86_32 in which the ts would otherwise be 4 byte aligned.

Fixes: 283d26917a ("iio: chemical: ccs811: Add triggered buffer support")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Cc: Narcisa Ana Maria Vasile <narcisaanamaria12@gmail.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-17 13:45:28 +02:00
Jonathan Cameron
412480300a iio:light:max44000 Fix timestamp alignment and prevent data leak.
commit 523628852a upstream.

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses a 16 byte array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here.  We close both issues by
moving to a suitable structure in the iio_priv().
This data is allocated with kzalloc so no data can leak appart
from previous readings.

It is necessary to force the alignment of ts to avoid the padding
on x86_32 being different from 64 bit platorms (it alows for
4 bytes aligned 8 byte types.

Fixes: 06ad7ea10e ("max44000: Initial triggered buffer support")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-17 13:45:27 +02:00
Jonathan Cameron
a24fd33527 iio:magnetometer:ak8975 Fix alignment and data leak issues.
commit 02ad21cefb upstream.

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses an array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here.  We close both issues by
moving to a suitable structure in the iio_priv() data.

This data is allocated with kzalloc so no data can leak apart from
previous readings.

The explicit alignment of ts is not necessary in this case as by
coincidence the padding will end up the same, however I consider
it to make the code less fragile and have included it.

Fixes: bc11ca4a0b ("iio:magnetometer:ak8975: triggered buffer support")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Cc: Gregor Boirie <gregor.boirie@parrot.com>
Cc: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-17 13:45:27 +02:00
Jonathan Cameron
62d46fa157 iio:adc:ti-adc081c Fix alignment and data leak issues
commit 54f82df2ba upstream.

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses an array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here.  We close both issues by
moving to a suitable structure in the iio_priv().

This data is allocated with kzalloc so no data can leak apart
from previous readings.

The eplicit alignment of ts is necessary to ensure correct padding
on x86_32 where s64 is only aligned to 4 bytes.

Fixes: 08e05d1fce ("ti-adc081c: Initial triggered buffer support")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-17 13:45:27 +02:00
Jonathan Cameron
234974cf05 iio:adc:max1118 Fix alignment of timestamp and data leak issues
commit db8f06d97e upstream.

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses an array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here.  We close both issues by
moving to a suitable structure in the iio_priv() data.

This data is allocated with kzalloc so no data can leak apart
from previous readings.

The explicit alignment of ts is necessary to ensure correct padding
on architectures where s64 is only 4 bytes aligned such as x86_32.

Fixes: a9e9c7153e ("iio: adc: add max1117/max1118/max1119 ADC driver")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Cc: Akinobu Mita <akinobu.mita@gmail.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-17 13:45:27 +02:00
Jonathan Cameron
e7a63f2877 iio:adc:ina2xx Fix timestamp alignment issue.
commit f8cd222feb upstream.

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses a 32 byte array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here.  We close both issues by
moving to a suitable structure in the iio_priv() data with alignment
explicitly requested.  This data is allocated with kzalloc so no
data can leak apart from previous readings. The explicit alignment
isn't technically needed here, but it reduced fragility and avoids
cut and paste into drivers where it will be needed.

If we want this in older stables will need manual backport due to
driver reworks.

Fixes: c43a102e67 ("iio: ina2xx: add support for TI INA2xx Power Monitors")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Cc: Stefan Brüns <stefan.bruens@rwth-aachen.de>
Cc: Marc Titinger <mtitinger@baylibre.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-17 13:45:27 +02:00
Jonathan Cameron
5acf848605 iio:adc:ti-adc084s021 Fix alignment and data leak issues.
commit a661b571e3 upstream.

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses an array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here.  We close both issues by
moving to a suitable structure in the iio_priv().

This data is allocated with kzalloc so no data can leak apart from
previous readings.

The force alignment of ts is not strictly necessary in this case
but reduces the fragility of the code.

Fixes: 3691e5a694 ("iio: adc: add driver for the ti-adc084s021 chip")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Cc: Mårten Lindahl <martenli@axis.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-17 13:45:27 +02:00
Jonathan Cameron
0ddc21f7cb iio:accel:bmc150-accel: Fix timestamp alignment and prevent data leak.
commit a6f86f7243 upstream.

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses a 16 byte array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here.  We close both issues by moving
to a suitable structure in the iio_priv() data with alignment
ensured by use of an explicit c structure.  This data is allocated
with kzalloc so no data can leak appart from previous readings.

Fixes tag is beyond some major refactoring so likely manual backporting
would be needed to get that far back.

Whilst the force alignment of the ts is not strictly necessary, it
does make the code less fragile.

Fixes: 3bbec97733 ("iio: bmc150_accel: add support for hardware fifo")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-17 13:45:27 +02:00
Jonathan Cameron
a418187843 iio:light:ltr501 Fix timestamp alignment issue.
commit 2684d50034 upstream.

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses an array of smaller elements on the stack.
Here we use a structure on the stack.  The driver already did an
explicit memset so no data leak was possible.

Forced alignment of ts is not strictly necessary but probably makes
the code slightly less fragile.

Note there has been some rework in this driver of the years, so no
way this will apply cleanly all the way back.

Fixes: 2690be9051 ("iio: Add Lite-On ltr501 ambient light / proximity sensor driver")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-17 13:45:27 +02:00
Maxim Kochetkov
da2eb70c3c iio: adc: ti-ads1015: fix conversion when CONFIG_PM is not set
commit e71e6dbe96 upstream.

To stop conversion ads1015_set_power_state() function call unimplemented
function __pm_runtime_suspend() from pm_runtime_put_autosuspend()
if CONFIG_PM is not set.
In case of CONFIG_PM is not set: __pm_runtime_suspend() returns -ENOSYS,
so ads1015_read_raw() failed because ads1015_set_power_state() returns an
error.

If CONFIG_PM is disabled, there is no need to start/stop conversion.
Fix it by adding return 0 function variant if CONFIG_PM is not set.

Signed-off-by: Maxim Kochetkov <fido_max@inbox.ru>
Fixes: ecc24e72f4 ("iio: adc: Add TI ADS1015 ADC driver support")
Tested-by: Maxim Kiselev <bigunclemax@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-17 13:45:26 +02:00
Angelo Compagnucci
4fea86da6a iio: adc: mcp3422: fix locking on error path
[ Upstream commit a139ffa40f ]

Reading from the chip should be unlocked on error path else the lock
could never being released.

Fixes: 07914c84ba ("iio: adc: Add driver for Microchip MCP3422/3/4 high resolution ADC")
Fixes: 3f1093d83d ("iio: adc: mcp3422: fix locking scope")
Acked-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Signed-off-by: Angelo Compagnucci <angelo.compagnucci@gmail.com>
Link: https://lore.kernel.org/r/20200901093218.1500845-1-angelo.compagnucci@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-09-17 13:45:26 +02:00
Angelo Compagnucci
4e8bf9d2ba iio: adc: mcp3422: fix locking scope
commit 3f1093d83d upstream.

Locking should be held for the entire reading sequence involving setting
the channel, waiting for the channel switch and reading from the
channel.
If not, reading from a channel can result mixing with the reading from
another channel.

Fixes: 07914c84ba ("iio: adc: Add driver for Microchip MCP3422/3/4 high resolution ADC")
Signed-off-by: Angelo Compagnucci <angelo.compagnucci@gmail.com>
Link: https://lore.kernel.org/r/20200819075525.1395248-1-angelo.compagnucci@gmail.com
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-17 13:45:26 +02:00
Greg Kroah-Hartman
369c9d2963 This is the 4.19.141 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl8/jnoACgkQONu9yGCS
 aT54fA//azItNUOsY1HujeNfINHWCqCLV7OHpdxa9MEeixSpP/ufsGcgyZBTslNw
 WOENkdUPGYxUQt9yyZjSY5CEneH6a007idCfUWIuHRZ9nxKbDZm312xDDcDkeZI7
 P4TGvIdpDq7Czk2c+OCSUnmp/+fCJdPCpCYJZp0kBDVbUsKeUwpBJ42Dca8f/2iM
 lWVlGR2KwMIV+NSVArpu8EUOpw7X4rPsGz72kEvVhCkcXa9GFxGbs65AVNG5NTzt
 9sHBlja7PZTqt844/6UBM5EgTR43uJT5z8sSV5N5s6j2d07m/T+2f73PyKqr6+jQ
 SXKpIp/J6Po7tCej5u4B9LO+ePpasuxbNAXmn1GLuiP7qzKRAriFxK2RfXXxqIuE
 aP9DB6P/wbr/MszFjIFFg9nrr9G/biriRNPWtnzD2hbUk1mfM8WNCCSIt90MZh0f
 CT85JiEBFlU5cZhgUJfqJcfZcckE8gbdUGOBvZ5NOq0hxqN2S6+/phespwkd4h/a
 A4QyhER6eI9zT/StBoSLejs8c/lHKHjqyMARNjXLPF+bkkR90L9WDgocB1KiV0jn
 YOY+j4tjXGnn/QAsuW/uhYVvzETtkQ5oSyeV5uTcgYvU3iw+QFo9H//y83yB5Q0o
 pdDRNmMTtdYwrwkzt73xsjKGlVXaA8kB5kRCuBwGb5kzr0G8baE=
 =Txdz
 -----END PGP SIGNATURE-----

Merge 4.19.141 into android-4.19-stable

Changes in 4.19.141
	smb3: warn on confusing error scenario with sec=krb5
	genirq/affinity: Make affinity setting if activated opt-in
	PCI: hotplug: ACPI: Fix context refcounting in acpiphp_grab_context()
	PCI: Mark AMD Navi10 GPU rev 0x00 ATS as broken
	PCI: Add device even if driver attach failed
	PCI: qcom: Define some PARF params needed for ipq8064 SoC
	PCI: qcom: Add support for tx term offset for rev 2.1.0
	PCI: Probe bridge window attributes once at enumeration-time
	btrfs: free anon block device right after subvolume deletion
	btrfs: don't allocate anonymous block device for user invisible roots
	btrfs: ref-verify: fix memory leak in add_block_entry
	btrfs: don't traverse into the seed devices in show_devname
	btrfs: open device without device_list_mutex
	btrfs: fix messages after changing compression level by remount
	btrfs: only search for left_info if there is no right_info in try_merge_free_space
	btrfs: fix memory leaks after failure to lookup checksums during inode logging
	btrfs: fix return value mixup in btrfs_get_extent
	dt-bindings: iio: io-channel-mux: Fix compatible string in example code
	iio: dac: ad5592r: fix unbalanced mutex unlocks in ad5592r_read_raw()
	xtensa: fix xtensa_pmu_setup prototype
	cifs: Fix leak when handling lease break for cached root fid
	powerpc: Allow 4224 bytes of stack expansion for the signal frame
	powerpc: Fix circular dependency between percpu.h and mmu.h
	media: vsp1: dl: Fix NULL pointer dereference on unbind
	net: ethernet: stmmac: Disable hardware multicast filter
	net: stmmac: dwmac1000: provide multicast filter fallback
	net/compat: Add missing sock updates for SCM_RIGHTS
	md/raid5: Fix Force reconstruct-write io stuck in degraded raid5
	bcache: allocate meta data pages as compound pages
	bcache: fix overflow in offset_to_stripe()
	mac80211: fix misplaced while instead of if
	driver core: Avoid binding drivers to dead devices
	MIPS: CPU#0 is not hotpluggable
	ext2: fix missing percpu_counter_inc
	ocfs2: change slot number type s16 to u16
	mm/page_counter.c: fix protection usage propagation
	ftrace: Setup correct FTRACE_FL_REGS flags for module
	kprobes: Fix NULL pointer dereference at kprobe_ftrace_handler
	tracing/hwlat: Honor the tracing_cpumask
	tracing: Use trace_sched_process_free() instead of exit() for pid tracing
	watchdog: f71808e_wdt: indicate WDIOF_CARDRESET support in watchdog_info.options
	watchdog: f71808e_wdt: remove use of wrong watchdog_info option
	watchdog: f71808e_wdt: clear watchdog timeout occurred flag
	pseries: Fix 64 bit logical memory block panic
	module: Correctly truncate sysfs sections output
	perf intel-pt: Fix FUP packet state
	remoteproc: qcom: q6v5: Update running state before requesting stop
	drm/imx: imx-ldb: Disable both channels for split mode in enc->disable()
	mfd: arizona: Ensure 32k clock is put on driver unbind and error
	RDMA/ipoib: Return void from ipoib_ib_dev_stop()
	RDMA/ipoib: Fix ABBA deadlock with ipoib_reap_ah()
	media: rockchip: rga: Introduce color fmt macros and refactor CSC mode logic
	media: rockchip: rga: Only set output CSC mode for RGB input
	USB: serial: ftdi_sio: make process-packet buffer unsigned
	USB: serial: ftdi_sio: clean up receive processing
	mmc: renesas_sdhi_internal_dmac: clean up the code for dma complete
	gpu: ipu-v3: image-convert: Combine rotate/no-rotate irq handlers
	dm rq: don't call blk_mq_queue_stopped() in dm_stop_queue()
	selftests/powerpc: ptrace-pkey: Rename variables to make it easier to follow code
	selftests/powerpc: ptrace-pkey: Update the test to mark an invalid pkey correctly
	selftests/powerpc: ptrace-pkey: Don't update expected UAMOR value
	iommu/omap: Check for failure of a call to omap_iommu_dump_ctx
	iommu/vt-d: Enforce PASID devTLB field mask
	i2c: rcar: slave: only send STOP event when we have been addressed
	clk: clk-atlas6: fix return value check in atlas6_clk_init()
	pwm: bcm-iproc: handle clk_get_rate() return
	tools build feature: Use CC and CXX from parent
	i2c: rcar: avoid race when unregistering slave
	openrisc: Fix oops caused when dumping stack
	scsi: lpfc: nvmet: Avoid hang / use-after-free again when destroying targetport
	watchdog: initialize device before misc_register
	Input: sentelic - fix error return when fsp_reg_write fails
	drm/vmwgfx: Use correct vmw_legacy_display_unit pointer
	drm/vmwgfx: Fix two list_for_each loop exit tests
	net: qcom/emac: add missed clk_disable_unprepare in error path of emac_clks_phase1_init
	nfs: Fix getxattr kernel panic and memory overflow
	fs/minix: set s_maxbytes correctly
	fs/minix: fix block limit check for V1 filesystems
	fs/minix: remove expected error message in block_to_path()
	fs/ufs: avoid potential u32 multiplication overflow
	test_kmod: avoid potential double free in trigger_config_run_type()
	mfd: dln2: Run event handler loop under spinlock
	ALSA: echoaudio: Fix potential Oops in snd_echo_resume()
	perf bench mem: Always memset source before memcpy
	tools build feature: Quote CC and CXX for their arguments
	sh: landisk: Add missing initialization of sh_io_port_base
	khugepaged: retract_page_tables() remember to test exit
	arm64: dts: marvell: espressobin: add ethernet alias
	drm: Added orientation quirk for ASUS tablet model T103HAF
	drm/amdgpu: Fix bug where DPM is not enabled after hibernate and resume
	Linux 4.19.141

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I0800f8e03919fd8f054c1bcda87efd70a6e5db6b
2020-08-21 13:01:46 +02:00
Alexandru Ardelean
b86f06e13c iio: dac: ad5592r: fix unbalanced mutex unlocks in ad5592r_read_raw()
commit 65afb0932a upstream.

There are 2 exit paths where the lock isn't held, but try to unlock the
mutex when exiting. In these places we should just return from the
function.

A neater approach would be to cleanup the ad5592r_read_raw(), but that
would make this patch more difficult to backport to stable versions.

Fixes 56ca9db862bf3: ("iio: dac: Add support for the AD5592R/AD5593R ADCs/DACs")
Reported-by: Charles Stanhope <charles.stanhope@gmail.com>
Signed-off-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-08-21 11:05:31 +02:00
Greg Kroah-Hartman
a5218b3636 This is the 4.19.137 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl8qaHIACgkQONu9yGCS
 aT62TxAAwZ04yMUrjhm9TpAYUGJXcZ77AL2fliW4Ep8VRE1umCoKhmp8kB6JV5TD
 U/hxqufydvFbuRJK0hmrPhRPCkQfsTD6xKITjq1JgvEz5abGbrPXi7VZtJPQaiUN
 LxcNLwYfe2j8cRMWOpPQ10V/HvFpvlyrGF5TYpCT/5h1Y48FdBFTywNzmbL/J55O
 v7LMDgg2KB5SMPVsVktThWR5nsATiWBmJWb+4d0+GNkRX0idhu+XIKkNVWW8GAQa
 zjaUP9E7ysNU+YBwgD6uaRu0sgIxxqi9eITqqk+46b4gy1S/n5iorIkddkMoaySN
 ttLOiZZal9TDs1CTXXCPrw/14b+go9irEpwtYXGMdkmtOV28022m6YF7IkYHpX4I
 IsEPfLRlulB0i8DddNguOhHKVkD6Kuf934+sYV447QyqlPSszaGGxh+EK+aOk4/4
 PdwvUJlS90ExND0ID4whMgl50MOf6YcQxZ2oykDyNeVqU8USwdo0c6tYatNvdiu9
 DRzV6AU9CwnA0rYpCSpXY89j1uWeJCgKvYH3rTBIqUPKWT3LMfshu8xJioxP+29R
 eooKvy3I5miPv47s9cQKw+5dae0kH/8boR2flLBkGV/VB5VvnBBswP6Z0CCwMcT0
 M5+z7oLnbJdPIJ58kAKDvg6Fu9S/8Y5KVwUiZp3KkNRl9L5lDQY=
 =bZTL
 -----END PGP SIGNATURE-----

Merge 4.19.137 into android-4.19-stable

Changes in 4.19.137
	crypto: ccp - Release all allocated memory if sha type is invalid
	media: rc: prevent memory leak in cx23888_ir_probe
	iio: imu: adis16400: fix memory leak
	drm/amdgpu: fix multiple memory leaks in acp_hw_init
	tracing: Have error path in predicate_parse() free its allocated memory
	ath9k_htc: release allocated buffer if timed out
	ath9k: release allocated buffer if timed out
	drm/amd/display: prevent memory leak
	btrfs: inode: Verify inode mode to avoid NULL pointer dereference
	sctp: implement memory accounting on tx path
	Btrfs: fix selftests failure due to uninitialized i_mode in test inodes
	PCI/ASPM: Disable ASPM on ASMedia ASM1083/1085 PCIe-to-PCI bridge
	9p/trans_fd: Fix concurrency del of req_list in p9_fd_cancelled/p9_read_work
	wireless: Use offsetof instead of custom macro.
	ARM: 8986/1: hw_breakpoint: Don't invoke overflow handler on uaccess watchpoints
	Revert "drm/amdgpu: Fix NULL dereference in dpm sysfs handlers"
	drm/amdgpu: Prevent kernel-infoleak in amdgpu_info_ioctl()
	drm: hold gem reference until object is no longer accessed
	rds: Prevent kernel-infoleak in rds_notify_queue_get()
	xfs: fix missed wakeup on l_flush_wait
	net/x25: Fix x25_neigh refcnt leak when x25 disconnect
	net/x25: Fix null-ptr-deref in x25_disconnect
	xfrm: Fix crash when the hold queue is used.
	selftests/net: rxtimestamp: fix clang issues for target arch PowerPC
	selftests/net: psock_fanout: fix clang issues for target arch PowerPC
	sh: Fix validation of system call number
	net/mlx5: Verify Hardware supports requested ptp function on a given pin
	net: lan78xx: add missing endpoint sanity check
	net: lan78xx: fix transfer-buffer memory leak
	mlx4: disable device on shutdown
	mlxsw: core: Increase scope of RCU read-side critical section
	mlxsw: core: Free EMAD transactions using kfree_rcu()
	ibmvnic: Fix IRQ mapping disposal in error path
	bpf: Fix map leak in HASH_OF_MAPS map
	mac80211: mesh: Free ie data when leaving mesh
	mac80211: mesh: Free pending skb when destroying a mpath
	arm64/alternatives: move length validation inside the subsection
	arm64: csum: Fix handling of bad packets
	Bluetooth: fix kernel oops in store_pending_adv_report
	net: gemini: Fix missing clk_disable_unprepare() in error path of gemini_ethernet_port_probe()
	net/mlx5e: fix bpf_prog reference count leaks in mlx5e_alloc_rq
	usb: hso: Fix debug compile warning on sparc32
	qed: Disable "MFW indication via attention" SPAM every 5 minutes
	nfc: s3fwrn5: add missing release on skb in s3fwrn5_recv_frame
	parisc: add support for cmpxchg on u8 pointers
	net: ethernet: ravb: exit if re-initialization fails in tx timeout
	Revert "i2c: cadence: Fix the hold bit setting"
	x86/unwind/orc: Fix ORC for newly forked tasks
	cxgb4: add missing release on skb in uld_send()
	xen-netfront: fix potential deadlock in xennet_remove()
	KVM: LAPIC: Prevent setting the tscdeadline timer if the lapic is hw disabled
	x86/i8259: Use printk_deferred() to prevent deadlock
	Linux 4.19.137

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ic57c1620f2febb595f4f764757b1792ffc866643
2020-08-05 12:07:48 +02:00
Sasha Levin
c57c213538 iio: imu: adis16400: fix memory leak
[ Upstream commit 9c0530e898 ]

In adis_update_scan_mode_burst, if adis->buffer allocation fails release
the adis->xfer.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-08-05 10:05:59 +02:00