4331 Commits

Author	SHA1	Message	Date
Tao Huang	c7a43f0886	Merge tag 'ASB-2022-06-05_12-5.10' of https://android.googlesource.com/kernel/common ... https://source.android.com/security/bulletin/2022-01-01 CVE-2022-24958 CVE-2022-20136 CVE-2022-23960 CVE-2022-20141 CVE-2021-4154 CVE-2022-20132 * tag 'ASB-2022-06-05_12-5.10': (1188 commits) BACKPORT: net/sched: cls_u32: fix netns refcount changes in u32_change() UPSTREAM: io_uring: always use original task when preparing req identity FROMLIST: remoteproc: Fix dma_mem leak after rproc_shutdown FROMLIST: dma-mapping: Add dma_release_coherent_memory to DMA API ANDROID: Update QCOM symbol list for __reset_control_get ANDROID: vendor_hooks: Add hooks for mutex BACKPORT: can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path BACKPORT: can: usb_8dev: usb_8dev_start_xmit(): fix double dev_kfree_skb() in error path ANDROID: GKI: Update symbols to symbol list ANDROID: oplus: Update the ABI xml and symbol list UPSTREAM: remoteproc: Fix count check in rproc_coredump_write() BACKPORT: esp: Fix possible buffer overflow in ESP transformation ANDROID: Fix the drain_all_pages default condition broken by a hook UPSTREAM: Revert "xfrm: xfrm_state_mtu should return at least 1280 for ipv6" UPSTREAM: xfrm: fix MTU regression ANDROID: signal: Add vendor hook for memory reaping FROMGIT: usb: gadget: uvc: allow for application to cleanly shutdown FROMGIT: usb: dwc3: gadget: increase tx fifo size for ss isoc endpoints UPSTREAM: usb: gadget: configfs: clear deactivation flag in configfs_composite_unbind() FROMGIT: usb: gadget: uvc: remove pause flag use ... Change-Id: Idf3eea3b21dc69c8189161c0e24744336431913a Conflicts: drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c drivers/spi/spi-rockchip.c drivers/usb/gadget/function/f_uvc.c drivers/usb/gadget/function/uvc.h drivers/usb/gadget/function/uvc_configfs.c drivers/usb/gadget/function/uvc_queue.c drivers/usb/gadget/function/uvc_video.c sound/soc/rockchip/rockchip_i2s.c	2022-07-15 17:58:38 +08:00
Tao Huang	24cbee6672	Merge tag 'ASB-2022-04-05_12-5.10' of https://android.googlesource.com/kernel/common ... https://source.android.com/security/bulletin/2022-04-01 CVE-2021-0707 CVE-2021-39800 CVE-2021-39801 (4.9 only) CVE-2021-39802 * tag 'ASB-2022-04-05_12-5.10': (3832 commits) ANDROID: GKI: Update symbols to abi_gki_aarch64_oplus ANDROID: vendor_hooks: Reduce pointless modversions CRC churn UPSTREAM: locking/lockdep: Avoid potential access of invalid memory in lock_class ANDROID: mm: Fix implicit declaration of function 'isolate_lru_page' ANDROID: GKI: Update symbols to symbol list ANDROID: GKI: Update symbols to symbol list ANDROID: GKI: Add hook symbol to symbol list Revert "ANDROID: dm-bow: Protect Ranges fetched and erased from the RB tree" ANDROID: vendor_hooks: Add hooks to for free_unref_page_commit ANDROID: vendor_hooks: Add hooks to for alloc_contig_range ANDROID: GKI: Update symbols to symbol list ANDROID: vendor_hooks: Add hook in shrink_node_memcgs ANDROID: GKI: Add symbols to symbol list FROMGIT: iommu/iova: Improve 32-bit free space estimate ANDROID: export walk_page_range and swp_swap_info ANDROID: vendor_hooks: export shrink_slab ANDROID: usb: gadget: f_accessory: add compat_ioctl support UPSTREAM: sr9700: sanity check for packet length UPSTREAM: io_uring: return back safer resurrect UPSTREAM: Revert "xfrm: state and policy should fail if XFRMA_IF_ID 0" ... Change-Id: Ic61ead530b99b10ffd535a358a48fe9bb8c33fd4 Conflicts: drivers/android/Kconfig drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c drivers/gpu/drm/rockchip/rockchip_vop_reg.c drivers/i2c/busses/i2c-rk3x.c drivers/media/i2c/imx258.c drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c drivers/usb/dwc2/gadget.c drivers/usb/gadget/function/uvc.h lib/Kconfig.debug	2022-07-15 17:40:39 +08:00
Greg Kroah-Hartman	95f4203fc9	This is the 5.10.110 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmJQLWwACgkQONu9yGCS aT4R2BAAr/cGnf2/BQ6+zNPW+LlfGn75803yd+oWNL8WzjNiQGrTsQavE1jL0LXP 45iPxvY6eOlP9oEoJGYyNYhzQfUM92Unysa/KemB/xUBsb2If0ZdWk1WB9Lnw0xq m65kACXovbcg4LsZGpgCv7ln1ykogo+bNMES9P6CLxwKR/DMKUeJxbRNKE/AkD5l DxF7IJEP+YRbKAtoLM2Xj4KdjVSfRIfs+Pf0A1t43GqAw6tt3beqmzeCwDzuzz5a DHpXS6PeJjTZOjz4LkuBSbyK5cKGFv1C6o7JVjWSZhDyI5E4OLdNDpNKqcjsXAN+ wMqS1eh4gYUBXmPE44BGwkkugPyaR0/KHUebfkFZG2/H/8DfvrGqlbvsGSFNXxsV jH2/AV/rOxAFeM/U0c1I4Ve42MU18kdf1MRBo0Dq5xSoN9HFQhNp+HE5jpppgsvi FYpMqZoQzH31GIjOq7g0zLdj4NTBrkO9dh7kbpH0Xay1yBmigvD2PA4qpsL1+VMI v73Iq/RJVGUJFAeiYFjn9IGs9EsiKNG08v9uoKS+1m1VLrpVdgwtzo+RjJ/E51Mt Nk4WK94MyoivkRFKulDasv9yBWdcZCfljc91271UCKCERlyO/bmsTqhffeATGGRh N/7oxa71BHvxp0VYqvKD6xFUs+jFt9DQmIX7Pl1/yLpaz+sN0no= =31mv -----END PGP SIGNATURE----- Merge 5.10.110 into android12-5.10-lts Changes in 5.10.110 swiotlb: fix info leak with DMA_FROM_DEVICE USB: serial: pl2303: add IBM device IDs USB: serial: simple: add Nokia phone driver hv: utils: add PTP_1588_CLOCK to Kconfig to fix build netdevice: add the case if dev is NULL HID: logitech-dj: add new lightspeed receiver id xfrm: fix tunnel model fragmentation behavior ARM: mstar: Select HAVE_ARM_ARCH_TIMER virtio_console: break out of buf poll on remove vdpa/mlx5: should verify CTRL_VQ feature exists for MQ tools/virtio: fix virtio_test execution ethernet: sun: Free the coherent when failing in probing gpio: Revert regression in sysfs-gpio (gpiolib.c) spi: Fix invalid sgs value net:mcf8390: Use platform_get_irq() to get the interrupt Revert "gpio: Revert regression in sysfs-gpio (gpiolib.c)" spi: Fix erroneous sgs value with min_t() Input: zinitix - do not report shadow fingers af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register net: dsa: microchip: add spi_device_id tables locking/lockdep: Avoid potential access of invalid memory in lock_class iommu/iova: Improve 32-bit free space estimate tpm: fix reference counting for struct tpm_chip virtio-blk: Use blk_validate_block_size() to validate block size USB: usb-storage: Fix use of bitfields for hardware data in ene_ub6250.c xhci: fix garbage USBSTS being logged in some cases xhci: fix runtime PM imbalance in USB2 resume xhci: make xhci_handshake timeout for xhci_reset() adjustable xhci: fix uninitialized string returned by xhci_decode_ctrl_ctx() mei: me: add Alder Lake N device id. mei: avoid iterator usage outside of list_for_each_entry coresight: Fix TRCCONFIGR.QE sysfs interface iio: afe: rescale: use s64 for temporary scale calculations iio: inkern: apply consumer scale on IIO_VAL_INT cases iio: inkern: apply consumer scale when no channel scale is available iio: inkern: make a best effort on offset calculation greybus: svc: fix an error handling bug in gb_svc_hello() clk: uniphier: Fix fixed-rate initialization ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE KEYS: fix length validation in keyctl_pkey_params_get_2() Documentation: add link to stable release candidate tree Documentation: update stable tree link firmware: stratix10-svc: add missing callback parameter on RSU HID: intel-ish-hid: Use dma_alloc_coherent for firmware update SUNRPC: avoid race between mod_timer() and del_timer_sync() NFSD: prevent underflow in nfssvc_decode_writeargs() NFSD: prevent integer overflow on 32 bit systems f2fs: fix to unlock page correctly in error path of is_alive() f2fs: quota: fix loop condition at f2fs_quota_sync() f2fs: fix to do sanity check on .cp_pack_total_block_count remoteproc: Fix count check in rproc_coredump_write() pinctrl: samsung: drop pin banks references on error paths spi: mxic: Fix the transmit path mtd: rawnand: protect access to rawnand devices while in suspend can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path jffs2: fix use-after-free in jffs2_clear_xattr_subsystem jffs2: fix memory leak in jffs2_do_mount_fs jffs2: fix memory leak in jffs2_scan_medium mm/pages_alloc.c: don't create ZONE_MOVABLE beyond the end of a node mm: invalidate hwpoison page cache page in fault path mempolicy: mbind_range() set_policy() after vma_merge() scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands qed: display VF trust config qed: validate and restrict untrusted VFs vlan promisc mode riscv: Fix fill_callchain return value riscv: Increase stack size under KASAN Revert "Input: clear BTN_RIGHT/MIDDLE on buttonpads" cifs: prevent bad output lengths in smb2_ioctl_query_info() cifs: fix NULL ptr dereference in smb2_ioctl_query_info() ALSA: cs4236: fix an incorrect NULL check on list iterator ALSA: hda: Avoid unsol event during RPM suspending ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock ALSA: hda/realtek: Fix audio regression on Mi Notebook Pro 2020 mm: madvise: skip unmapped vma holes passed to process_madvise mm: madvise: return correct bytes advised with process_madvise Revert "mm: madvise: skip unmapped vma holes passed to process_madvise" mm,hwpoison: unmap poisoned page before invalidation mm/kmemleak: reset tag when compare object pointer dm integrity: set journal entry unused when shrinking device drbd: fix potential silent data corruption can: isotp: sanitize CAN ID checks in isotp_bind() powerpc/kvm: Fix kvm_use_magic_page udp: call udp_encap_enable for v6 sockets when enabling encap arm64: signal: nofpsimd: Do not allocate fp/simd context when not available arm64: dts: ti: k3-am65: Fix gic-v3 compatible regs arm64: dts: ti: k3-j721e: Fix gic-v3 compatible regs arm64: dts: ti: k3-j7200: Fix gic-v3 compatible regs ACPI: properties: Consistently return -ENOENT if there are no more references coredump: Also dump first pages of non-executable ELF libraries ext4: fix ext4_fc_stats trace point ext4: fix fs corruption when tring to remove a non-empty directory with IO error drivers: hamradio: 6pack: fix UAF bug caused by mod_timer() mailbox: tegra-hsp: Flush whole channel block: limit request dispatch loop duration block: don't merge across cgroup boundaries if blkcg is enabled drm/edid: check basic audio support on CEA extension block video: fbdev: sm712fb: Fix crash in smtcfb_read() video: fbdev: atari: Atari 2 bpp (STe) palette bugfix ARM: dts: at91: sama5d2: Fix PMERRLOC resource size ARM: dts: exynos: fix UART3 pins configuration in Exynos5250 ARM: dts: exynos: add missing HDMI supplies on SMDK5250 ARM: dts: exynos: add missing HDMI supplies on SMDK5420 mgag200 fix memmapsl configuration in GCTL6 register carl9170: fix missing bit-wise or operator for tx_params pstore: Don't use semaphores in always-atomic-context code thermal: int340x: Increase bitmap size lib/raid6/test: fix multiple definition linking error exec: Force single empty string when argv is empty crypto: rsa-pkcs1pad - only allow with rsa crypto: rsa-pkcs1pad - correctly get hash from source scatterlist crypto: rsa-pkcs1pad - restore signature length check crypto: rsa-pkcs1pad - fix buffer overread in pkcs1pad_verify_complete() bcache: fixup multiple threads crash DEC: Limit PMAX memory probing to R3k systems media: gpio-ir-tx: fix transmit with long spaces on Orange Pi PC media: davinci: vpif: fix unbalanced runtime PM get media: davinci: vpif: fix unbalanced runtime PM enable xtensa: fix stop_machine_cpuslocked call in patch_text xtensa: fix xtensa_wsr always writing 0 brcmfmac: firmware: Allocate space for default boardrev in nvram brcmfmac: pcie: Release firmwares in the brcmf_pcie_setup error path brcmfmac: pcie: Replace brcmf_pcie_copy_mem_todev with memcpy_toio brcmfmac: pcie: Fix crashes due to early IRQs drm/i915/opregion: check port number bounds for SWSCI display power state drm/i915/gem: add missing boundary check in vm_access PCI: pciehp: Clear cmd_busy bit in polling mode PCI: xgene: Revert "PCI: xgene: Fix IB window setup" regulator: qcom_smd: fix for_each_child.cocci warnings selinux: check return value of sel_make_avc_files hwrng: cavium - Check health status while reading random data hwrng: cavium - HW_RANDOM_CAVIUM should depend on ARCH_THUNDER crypto: sun8i-ss - really disable hash on A80 crypto: authenc - Fix sleep in atomic context in decrypt_tail crypto: mxs-dcp - Fix scatterlist processing thermal: int340x: Check for NULL after calling kmemdup() spi: tegra114: Add missing IRQ check in tegra_spi_probe arm64/mm: avoid fixmap race condition when create pud mapping selftests/x86: Add validity check and allow field splitting crypto: rockchip - ECB does not need IV audit: log AUDIT_TIME_* records only from rules EVM: fix the evm= __setup handler return value crypto: ccree - don't attempt 0 len DMA mappings spi: pxa2xx-pci: Balance reference count for PCI DMA device hwmon: (pmbus) Add mutex to regulator ops hwmon: (sch56xx-common) Replace WDOG_ACTIVE with WDOG_HW_RUNNING nvme: cleanup __nvme_check_ids block: don't delete queue kobject before its children PM: hibernate: fix __setup handler error handling PM: suspend: fix return value of __setup handler spi: spi-zynqmp-gqspi: Handle error for dma_set_mask hwrng: atmel - disable trng on failure path crypto: sun8i-ss - call finalize with bh disabled crypto: sun8i-ce - call finalize with bh disabled crypto: amlogic - call finalize with bh disabled crypto: vmx - add missing dependencies clocksource/drivers/timer-ti-dm: Fix regression from errata i940 fix clocksource/drivers/exynos_mct: Refactor resources allocation clocksource/drivers/exynos_mct: Handle DTS with higher number of interrupts clocksource/drivers/timer-microchip-pit64b: Use notrace clocksource/drivers/timer-of: Check return value of of_iomap in timer_of_base_init() ACPI: APEI: fix return value of __setup handlers crypto: ccp - ccp_dmaengine_unregister release dma channels crypto: ccree - Fix use after free in cc_cipher_exit() vfio: platform: simplify device removal amba: Make the remove callback return void hwrng: nomadik - Change clk_disable to clk_disable_unprepare hwmon: (pmbus) Add Vin unit off handling clocksource: acpi_pm: fix return value of __setup handler io_uring: terminate manual loop iterator loop correctly for non-vecs watch_queue: Fix NULL dereference in error cleanup watch_queue: Actually free the watch f2fs: fix to enable ATGC correctly via gc_idle sysfs interface sched/debug: Remove mpol_get/put and task_lock/unlock from sched_show_numa sched/core: Export pelt_thermal_tp rseq: Optimise rseq_get_rseq_cs() and clear_rseq_cs() rseq: Remove broken uapi field layout on 32-bit little endian perf/core: Fix address filter parser for multiple filters perf/x86/intel/pt: Fix address filter config for 32-bit kernel f2fs: fix missing free nid in f2fs_handle_failed_inode nfsd: more robust allocation failure handling in nfsd_file_cache_init f2fs: fix to avoid potential deadlock btrfs: fix unexpected error path when reflinking an inline extent f2fs: compress: remove unneeded read when rewrite whole cluster f2fs: fix compressed file start atomic write may cause data corruption selftests, x86: fix how check_cc.sh is being invoked kunit: make kunit_test_timeout compatible with comment media: staging: media: zoran: fix usage of vb2_dma_contig_set_max_seg_size media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across ioctls media: mtk-vcodec: potential dereference of null pointer media: bttv: fix WARNING regression on tunerless devices ASoC: xilinx: xlnx_formatter_pcm: Handle sysclk setting ASoC: generic: simple-card-utils: remove useless assignment media: coda: Fix missing put_device() call in coda_get_vdoa_data media: meson: vdec: potential dereference of null pointer media: hantro: Fix overfill bottom register field name media: aspeed: Correct value for h-total-pixels video: fbdev: matroxfb: set maxvram of vbG200eW to the same as vbG200 to avoid black screen video: fbdev: controlfb: Fix set but not used warnings video: fbdev: controlfb: Fix COMPILE_TEST build video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe() video: fbdev: atmel_lcdfb: fix an error code in atmel_lcdfb_probe() video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name() firmware: qcom: scm: Remove reassignment to desc following initializer ARM: dts: qcom: ipq4019: fix sleep clock soc: qcom: rpmpd: Check for null return of devm_kcalloc soc: qcom: ocmem: Fix missing put_device() call in of_get_ocmem soc: qcom: aoss: remove spurious IRQF_ONESHOT flags arm64: dts: qcom: sdm845: fix microphone bias properties and values arm64: dts: qcom: sm8150: Correct TCS configuration for apps rsc firmware: ti_sci: Fix compilation failure when CONFIG_TI_SCI_PROTOCOL is not defined soc: ti: wkup_m3_ipc: Fix IRQ check in wkup_m3_ipc_probe ARM: dts: sun8i: v3s: Move the csi1 block to follow address order ARM: dts: imx: Add missing LVDS decoder on M53Menlo media: video/hdmi: handle short reads of hdmi info frame. media: em28xx: initialize refcount before kref_get media: usb: go7007: s2250-board: fix leak in probe() media: cedrus: H265: Fix neighbour info buffer size media: cedrus: h264: Fix neighbour info buffer size ASoC: codecs: wcd934x: fix return value of wcd934x_rx_hph_mode_put uaccess: fix nios2 and microblaze get_user_8() ASoC: rt5663: check the return value of devm_kzalloc() in rt5663_parse_dp() ASoC: ti: davinci-i2s: Add check for clk_enable() ALSA: spi: Add check for clk_enable() arm64: dts: ns2: Fix spi-cpol and spi-cpha property arm64: dts: broadcom: Fix sata nodename printk: fix return value of printk.devkmsg __setup handler ASoC: mxs-saif: Handle errors for clk_enable ASoC: atmel_ssc_dai: Handle errors for clk_enable ASoC: dwc-i2s: Handle errors for clk_enable ASoC: soc-compress: prevent the potentially use of null pointer memory: emif: Add check for setup_interrupts memory: emif: check the pointer temp in get_device_details() ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction arm64: dts: rockchip: Fix SDIO regulator supply properties on rk3399-firefly m68k: coldfire/device.c: only build for MCF_EDMA when h/w macros are defined media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED media: vidtv: Check for null return of vzalloc ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe ASoC: wm8350: Handle error for wm8350_register_irq ASoC: fsi: Add check for clk_enable video: fbdev: omapfb: Add missing of_node_put() in dvic_probe_of media: saa7134: convert list_for_each to entry variant media: saa7134: fix incorrect use to determine if list is empty ivtv: fix incorrect device_caps for ivtvfb ASoC: rockchip: i2s: Use devm_platform_get_and_ioremap_resource() ASoC: rockchip: i2s: Fix missing clk_disable_unprepare() in rockchip_i2s_probe ASoC: SOF: Add missing of_node_put() in imx8m_probe ASoC: dmaengine: do not use a NULL prepare_slave_config() callback ASoC: mxs: Fix error handling in mxs_sgtl5000_probe ASoC: fsl_spdif: Disable TX clock when stop ASoC: imx-es8328: Fix error return code in imx_es8328_probe() ASoC: msm8916-wcd-digital: Fix missing clk_disable_unprepare() in msm8916_wcd_digital_probe mmc: davinci_mmc: Handle error for clk_enable ASoC: atmel: sam9x5_wm8731: use devm_snd_soc_register_card() ASoC: atmel: Fix error handling in sam9x5_wm8731_driver_probe ASoC: msm8916-wcd-analog: Fix error handling in pm8916_wcd_analog_spmi_probe ASoC: codecs: wcd934x: Add missing of_node_put() in wcd934x_codec_parse_data ARM: configs: multi_v5_defconfig: re-enable CONFIG_V4L_PLATFORM_DRIVERS drm/meson: osd_afbcd: Add an exit callback to struct meson_afbcd_ops drm/bridge: Fix free wrong object in sii8620_init_rcp_input_dev drm/bridge: Add missing pm_runtime_disable() in __dw_mipi_dsi_probe drm/bridge: nwl-dsi: Fix PM disable depth imbalance in nwl_dsi_probe drm: bridge: adv7511: Fix ADV7535 HPD enablement ath10k: fix memory overwrite of the WoWLAN wakeup packet pattern drm/panfrost: Check for error num after setting mask libbpf: Fix possible NULL pointer dereference when destroying skeleton udmabuf: validate ubuf->pagecount Bluetooth: hci_serdev: call init_rwsem() before p->open() mtd: onenand: Check for error irq mtd: rawnand: gpmi: fix controller timings setting drm/edid: Don't clear formats if using deep color ionic: fix type complaint in ionic_dev_cmd_clean() drm/nouveau/acr: Fix undefined behavior in nvkm_acr_hsfw_load_bl() drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes() drm/amd/pm: return -ENOTSUPP if there is no get_dpm_ultimate_freq function ath9k_htc: fix uninit value bugs RDMA/core: Set MR type in ib_reg_user_mr KVM: PPC: Fix vmx/vsx mixup in mmio emulation i40e: don't reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb i40e: respect metadata on XSK Rx to skb power: reset: gemini-poweroff: Fix IRQ check in gemini_poweroff_probe ray_cs: Check ioremap return value powerpc: dts: t1040rdb: fix ports names for Seville Ethernet switch KVM: PPC: Book3S HV: Check return value of kvmppc_radix_init powerpc/perf: Don't use perf_hw_context for trace IMC PMU mt76: mt7915: use proper aid value in mt7915_mcu_wtbl_generic_tlv in sta mode mt76: mt7915: use proper aid value in mt7915_mcu_sta_basic_tlv mt76: mt7603: check sta_rates pointer in mt7603_sta_rate_tbl_update mt76: mt7615: check sta_rates pointer in mt7615_sta_rate_tbl_update net: dsa: mv88e6xxx: Enable port policy support on 6097 scripts/dtc: Call pkg-config POSIXly correct livepatch: Fix build failure on 32 bits processors PCI: aardvark: Fix reading PCI_EXP_RTSTA_PME bit on emulated bridge drm/bridge: dw-hdmi: use safe format when first in bridge chain power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports iommu/ipmmu-vmsa: Check for error num after setting mask drm/amd/pm: enable pm sysfs write for one VF mode drm/amd/display: Add affected crtcs to atomic state for dsc mst unplug IB/cma: Allow XRC INI QPs to set their local ACK timeout dax: make sure inodes are flushed before destroy cache iwlwifi: Fix -EIO error code that is never returned iwlwifi: mvm: Fix an error code in iwl_mvm_up() drm/msm/dp: populate connector of struct dp_panel drm/msm/dpu: add DSPP blocks teardown drm/msm/dpu: fix dp audio condition dm crypt: fix get_key_size compiler warning if !CONFIG_KEYS scsi: pm8001: Fix command initialization in pm80XX_send_read_log() scsi: pm8001: Fix command initialization in pm8001_chip_ssp_tm_req() scsi: pm8001: Fix payload initialization in pm80xx_set_thermal_config() scsi: pm8001: Fix le32 values handling in pm80xx_set_sas_protocol_timer_config() scsi: pm8001: Fix payload initialization in pm80xx_encrypt_update() scsi: pm8001: Fix le32 values handling in pm80xx_chip_ssp_io_req() scsi: pm8001: Fix le32 values handling in pm80xx_chip_sata_req() scsi: pm8001: Fix NCQ NON DATA command task initialization scsi: pm8001: Fix NCQ NON DATA command completion handling scsi: pm8001: Fix abort all task initialization RDMA/mlx5: Fix the flow of a miss in the allocation of a cache ODP MR drm/amd/display: Remove vupdate_int_entry definition TOMOYO: fix __setup handlers return values ext2: correct max file size computing drm/tegra: Fix reference leak in tegra_dsi_ganged_probe power: supply: bq24190_charger: Fix bq24190_vbus_is_enabled() wrong false return scsi: hisi_sas: Change permission of parameter prot_mask drm/bridge: cdns-dsi: Make sure to to create proper aliases for dt bpf, arm64: Call build_prologue() first in first JIT pass bpf, arm64: Feed byte-offset into bpf line info gpu: host1x: Fix a memory leak in 'host1x_remove()' libbpf: Skip forward declaration when counting duplicated type names powerpc/mm/numa: skip NUMA_NO_NODE onlining in parse_numa_properties() powerpc/Makefile: Don't pass -mcpu=powerpc64 when building 32-bit KVM: x86: Fix emulation in writing cr8 KVM: x86/emulator: Defer not-present segment check in __load_segment_descriptor() hv_balloon: rate-limit "Unhandled message" warning i2c: xiic: Make bus names unique power: supply: wm8350-power: Handle error for wm8350_register_irq power: supply: wm8350-power: Add missing free in free_charger_irq IB/hfi1: Allow larger MTU without AIP PCI: Reduce warnings on possible RW1C corruption net: axienet: fix RX ring refill allocation failure handling mips: DEC: honor CONFIG_MIPS_FP_SUPPORT=n powerpc/sysdev: fix incorrect use to determine if list is empty mfd: mc13xxx: Add check for mc13xxx_irq_request libbpf: Unmap rings when umem deleted selftests/bpf: Make test_lwt_ip_encap more stable and faster platform/x86: huawei-wmi: check the return value of device_create_file() powerpc: 8xx: fix a return value error in mpc8xx_pic_init vxcan: enable local echo for sent CAN frames ath10k: Fix error handling in ath10k_setup_msa_resources mips: cdmm: Fix refcount leak in mips_cdmm_phys_base MIPS: RB532: fix return value of __setup handler MIPS: pgalloc: fix memory leak caused by pgd_free() mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init RDMA/mlx5: Fix memory leak in error flow for subscribe event routine bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full bpf, sockmap: Fix more uncharged while msg has more_data bpf, sockmap: Fix double uncharge the mem of sk_msg samples/bpf, xdpsock: Fix race when running for fix duration of time USB: storage: ums-realtek: fix error code in rts51x_read_mem() can: isotp: return -EADDRNOTAVAIL when reading from unbound socket can: isotp: support MSG_TRUNC flag when reading from socket bareudp: use ipv6_mod_enabled to check if IPv6 enabled selftests/bpf: Fix error reporting from sock_fields programs Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt ipv4: Fix route lookups when handling ICMP redirects and PMTU updates af_netlink: Fix shift out of bounds in group mask calculation i2c: meson: Fix wrong speed use from probe i2c: mux: demux-pinctrl: do not deactivate a master that is not active selftests/bpf/test_lirc_mode2.sh: Exit with proper code PCI: Avoid broken MSI on SB600 USB devices net: bcmgenet: Use stronger register read/writes to assure ordering tcp: ensure PMTU updates are processed during fastopen openvswitch: always update flow key after nat tipc: fix the timer expires after interval 100ms mfd: asic3: Add missing iounmap() on error asic3_mfd_probe mxser: fix xmit_buf leak in activate when LSR == 0xff pwm: lpc18xx-sct: Initialize driver data and hardware before pwmchip_add() fsi: aspeed: convert to devm_platform_ioremap_resource fsi: Aspeed: Fix a potential double free misc: alcor_pci: Fix an error handling path cpufreq: qcom-cpufreq-nvmem: fix reading of PVS Valid fuse soundwire: intel: fix wrong register name in intel_shim_wake clk: qcom: ipq8074: fix PCI-E clock oops iio: mma8452: Fix probe failing when an i2c_device_id is used staging:iio:adc:ad7280a: Fix handing of device address bit reversing. pinctrl: renesas: r8a77470: Reduce size for narrow VIN1 channel pinctrl: renesas: checker: Fix miscalculation of number of states clk: qcom: ipq8074: Use floor ops for SDCC1 clock phy: dphy: Correct lpx parameter and its derivatives(ta_{get,go,sure}) serial: 8250_mid: Balance reference count for PCI DMA device serial: 8250_lpss: Balance reference count for PCI DMA device NFS: Use of mapping_set_error() results in spurious errors serial: 8250: Fix race condition in RTS-after-send handling iio: adc: Add check for devm_request_threaded_irq habanalabs: Add check for pci_enable_device NFS: Return valid errors from nfs2/3_decode_dirent() dma-debug: fix return value of __setup handlers clk: imx7d: Remove audio_mclk_root_clk clk: at91: sama7g5: fix parents of PDMCs' GCLK clk: qcom: clk-rcg2: Update logic to calculate D value for RCG clk: qcom: clk-rcg2: Update the frac table for pixel clock dmaengine: hisi_dma: fix MSI allocate fail when reload hisi_dma remoteproc: qcom: Fix missing of_node_put in adsp_alloc_memory_region remoteproc: qcom_wcnss: Add missing of_node_put() in wcnss_alloc_memory_region remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region nvdimm/region: Fix default alignment for small regions clk: actions: Terminate clk_div_table with sentinel element clk: loongson1: Terminate clk_div_table with sentinel element clk: clps711x: Terminate clk_div_table with sentinel element clk: tegra: tegra124-emc: Fix missing put_device() call in emc_ensure_emc_driver NFS: remove unneeded check in decode_devicenotify_args() staging: mt7621-dts: fix LEDs and pinctrl on GB-PC1 devicetree staging: mt7621-dts: fix formatting staging: mt7621-dts: fix pinctrl properties for ethernet staging: mt7621-dts: fix GB-PC2 devicetree pinctrl: mediatek: Fix missing of_node_put() in mtk_pctrl_init pinctrl: mediatek: paris: Fix PIN_CONFIG_BIAS_* readback pinctrl: mediatek: paris: Fix "argument" argument type for mtk_pinconf_get() pinctrl: mediatek: paris: Fix pingroup pin config state readback pinctrl: mediatek: paris: Skip custom extra pin config dump for virtual GPIOs pinctrl: nomadik: Add missing of_node_put() in nmk_pinctrl_probe pinctrl/rockchip: Add missing of_node_put() in rockchip_pinctrl_probe tty: hvc: fix return value of __setup handler kgdboc: fix return value of __setup handler serial: 8250: fix XOFF/XON sending when DMA is used kgdbts: fix return value of __setup handler firmware: google: Properly state IOMEM dependency driver core: dd: fix return value of __setup handler jfs: fix divide error in dbNextAG netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options NFSv4.1: don't retry BIND_CONN_TO_SESSION on session error kdb: Fix the putarea helper function clk: qcom: gcc-msm8994: Fix gpll4 width clk: Initialize orphan req_rate xen: fix is_xen_pmu() net: enetc: report software timestamping via SO_TIMESTAMPING net: hns3: fix bug when PF set the duplicate MAC address for VFs net: phy: broadcom: Fix brcm_fet_config_init() selftests: test_vxlan_under_vrf: Fix broken test case qlcnic: dcb: default to returning -EOPNOTSUPP net/x25: Fix null-ptr-deref caused by x25_disconnect NFSv4/pNFS: Fix another issue with a list iterator pointing to the head net: dsa: bcm_sf2_cfp: fix an incorrect NULL check on list iterator fs: fd tables have to be multiples of BITS_PER_LONG lib/test: use after free in register_test_dev_kmod() fs: fix fd table size alignment properly LSM: general protection fault in legacy_parse_param regulator: rpi-panel: Handle I2C errors/timing to the Atmel gcc-plugins/stackleak: Exactly match strings instead of prefixes pinctrl: npcm: Fix broken references to chip->parent_device block, bfq: don't move oom_bfqq selinux: use correct type for context length selinux: allow FIOCLEX and FIONCLEX with policy capability loop: use sysfs_emit() in the sysfs xxx show() Fix incorrect type in assignment of ipv6 port for audit irqchip/qcom-pdc: Fix broken locking irqchip/nvic: Release nvic_base upon failure fs/binfmt_elf: Fix AT_PHDR for unusual ELF files bfq: fix use-after-free in bfq_dispatch_request ACPICA: Avoid walking the ACPI Namespace if it is not there lib/raid6/test/Makefile: Use $(pound) instead of \# for Make 4.3 Revert "Revert "block, bfq: honor already-setup queue merges"" ACPI/APEI: Limit printable size of BERT table data PM: core: keep irq flags in device_pm_check_callbacks() parisc: Fix handling off probe non-access faults nvme-tcp: lockdep: annotate in-kernel sockets spi: tegra20: Use of_device_get_match_data() locking/lockdep: Iterate lock_classes directly when reading lockdep files ext4: correct cluster len and clusters changed accounting in ext4_mb_mark_bb ext4: fix ext4_mb_mark_bb() with flex_bg with fast_commit ext4: don't BUG if someone dirty pages without asking ext4 first f2fs: fix to do sanity check on curseg->alloc_type NFSD: Fix nfsd_breaker_owns_lease() return values f2fs: compress: fix to print raw data size in error path of lz4 decompression ntfs: add sanity check on allocation size media: staging: media: zoran: move videodev alloc media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com media: staging: media: zoran: fix various V4L2 compliance errors media: ir_toy: free before error exiting video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow video: fbdev: w100fb: Reset global state video: fbdev: cirrusfb: check pixclock to avoid divide by zero video: fbdev: omapfb: acx565akm: replace snprintf with sysfs_emit ARM: dts: qcom: fix gic_irq_domain_translate warnings for msm8960 ARM: dts: bcm2837: Add the missing L1/L2 cache information ASoC: madera: Add dependencies on MFD media: atomisp_gmin_platform: Add DMI quirk to not turn AXP ELDO2 regulator off on some boards media: atomisp: fix dummy_ptr check to avoid duplicate active_bo ARM: ftrace: avoid redundant loads or clobbering IP ARM: dts: imx7: Use audio_mclk_post_div instead audio_mclk_root_clk arm64: defconfig: build imx-sdma as a module video: fbdev: omapfb: panel-dsi-cm: Use sysfs_emit() instead of snprintf() video: fbdev: omapfb: panel-tpo-td043mtea1: Use sysfs_emit() instead of snprintf() video: fbdev: udlfb: replace snprintf in show functions with sysfs_emit ARM: dts: bcm2711: Add the missing L1/L2 cache information ASoC: soc-core: skip zero num_dai component in searching dai name media: cx88-mpeg: clear interrupt status register before streaming video uaccess: fix type mismatch warnings from access_ok() lib/test_lockup: fix kernel pointer check for separate address spaces ARM: tegra: tamonten: Fix I2C3 pad setting ARM: mmp: Fix failure to remove sram device video: fbdev: sm712fb: Fix crash in smtcfb_write() media: Revert "media: em28xx: add missing em28xx_close_extension" media: hdpvr: initialize dev->worker at hdpvr_register_videodev mmc: host: Return an error when ->enable_sdio_irq() ops is missing media: atomisp: fix bad usage at error handling logic ALSA: hda/realtek: Add alc256-samsung-headphone fixup KVM: x86/mmu: Check for present SPTE when clearing dirty bit in TDP MMU powerpc/kasan: Fix early region not updated correctly powerpc/lib/sstep: Fix 'sthcx' instruction powerpc/lib/sstep: Fix build errors with newer binutils powerpc: Fix build errors with newer binutils scsi: qla2xxx: Fix stuck session in gpdb scsi: qla2xxx: Fix scheduling while atomic scsi: qla2xxx: Fix wrong FDMI data for 64G adapter scsi: qla2xxx: Fix warning for missing error code scsi: qla2xxx: Fix device reconnect in loop topology scsi: qla2xxx: Add devids and conditionals for 28xx scsi: qla2xxx: Check for firmware dump already collected scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair() scsi: qla2xxx: Fix disk failure to rediscover scsi: qla2xxx: Fix incorrect reporting of task management failure scsi: qla2xxx: Fix hang due to session stuck scsi: qla2xxx: Fix missed DMA unmap for NVMe ls requests scsi: qla2xxx: Fix N2N inconsistent PLOGI scsi: qla2xxx: Reduce false trigger to login scsi: qla2xxx: Use correct feature type field during RFF_ID processing platform: chrome: Split trace include file KVM: x86: Forbid VMM to set SYNIC/STIMER MSRs when SynIC wasn't activated KVM: Prevent module exit until all VMs are freed KVM: x86: fix sending PV IPI KVM: SVM: fix panic on out-of-bounds guest IRQ ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM ubifs: rename_whiteout: Fix double free for whiteout_ui->data ubifs: Fix deadlock in concurrent rename whiteout and inode writeback ubifs: Add missing iput if do_tmpfile() failed in rename whiteout ubifs: setflags: Make dirtied_ino_d 8 bytes aligned ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock() ubifs: Fix to add refcount once page is set private ubifs: rename_whiteout: correct old_dir size computing wireguard: queueing: use CFI-safe ptr_ring cleanup function wireguard: socket: free skb in send6 when ipv6 is disabled wireguard: socket: ignore v6 endpoints when ipv6 is disabled XArray: Fix xas_create_range() when multi-order entry present can: mcba_usb: mcba_usb_start_xmit(): fix double dev_kfree_skb in error path can: mcba_usb: properly check endpoint type can: mcp251xfd: mcp251xfd_register_get_dev_id(): fix return of error value XArray: Update the LRU list in xas_split() rtc: check if __rtc_read_time was successful gfs2: Make sure FITRIM minlen is rounded up to fs block size net: hns3: fix software vlan talbe of vlan 0 inconsistent with hardware rxrpc: Fix call timer start racing with call destruction mailbox: imx: fix wakeup failure from freeze mode crypto: arm/aes-neonbs-cbc - Select generic cbc and aes watch_queue: Free the page array when watch_queue is dismantled pinctrl: pinconf-generic: Print arguments for bias-pull-* watchdog: rti-wdt: Add missing pm_runtime_disable() in probe function pinctrl: nuvoton: npcm7xx: Rename DS() macro to DSTR() pinctrl: nuvoton: npcm7xx: Use %zu printk format for ARRAY_SIZE() ASoC: mediatek: mt6358: add missing EXPORT_SYMBOLs ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl ARM: iop32x: offset IRQ numbers by 1 io_uring: fix memory leak of uid in files registration riscv module: remove (NOLOAD) ACPI: CPPC: Avoid out of bounds access when parsing _CPC data platform/chrome: cros_ec_typec: Check for EC device can: isotp: restore accidentally removed MSG_PEEK feature proc: bootconfig: Add null pointer check staging: mt7621-dts: fix pinctrl-0 items to be size-1 items on ethernet ASoC: soc-compress: Change the check for codec_dai batman-adv: Check ptr for NULL before reducing its refcnt mm/mmap: return 1 from stack_guard_gap __setup() handler ARM: 9187/1: JIVE: fix return value of __setup handler mm/memcontrol: return 1 from cgroup.memory __setup() handler mm/usercopy: return 1 from hardened_usercopy __setup() handler bpf: Adjust BPF stack helper functions to accommodate skip > 0 bpf: Fix comment for helper bpf_current_task_under_cgroup() dt-bindings: mtd: nand-controller: Fix the reg property description dt-bindings: mtd: nand-controller: Fix a comment in the examples dt-bindings: spi: mxic: The interrupt property is not mandatory ubi: fastmap: Return error code if memory allocation fails in add_aeb() ASoC: topology: Allow TLV control to be either read or write ARM: dts: spear1340: Update serial node properties ARM: dts: spear13xx: Update SPI dma properties um: Fix uml_mconsole stop/go docs: sysctl/kernel: add missing bit to panic_print openvswitch: Fixed nd target mask field in the flow dump. KVM: x86/mmu: do compare-and-exchange of gPTE via the user address can: m_can: m_can_tx_handler(): fix use after free of skb can: usb_8dev: usb_8dev_start_xmit(): fix double dev_kfree_skb() in error path coredump: Snapshot the vmas in do_coredump coredump: Remove the WARN_ON in dump_vma_snapshot coredump/elf: Pass coredump_params into fill_note_info coredump: Use the vma snapshot in fill_files_note arm64: Do not defer reserve_crashkernel() for platforms with no DMA memory zones PCI: xgene: Revert "PCI: xgene: Use inbound resources for setup" Linux 5.10.110 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I12fbe227793dd40c0582588e1700cf88cafd0ac6	2022-04-18 17:41:18 +02:00
Dmitry Torokhov	ab63b24ae6	HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports ... [ Upstream commit a5e5e03e94 ] Internally kernel prepends all report buffers, for both numbered and unnumbered reports, with report ID, therefore to properly handle unnumbered reports we should prepend it ourselves. For the same reason we should skip the first byte of the buffer when calling i2c_hid_set_or_send_report() which then will take care of properly formatting the transfer buffer based on its separate report ID argument along with report payload. [jkosina@suse.cz: finalize trimmed sentence in changelog as spotted by Benjamin] Fixes: 9b5a9ae885 ("HID: i2c-hid: implement ll_driver transport-layer callbacks") Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Tested-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-04-08 14:40:15 +02:00
Gwendal Grignou	f51ab2f60a	HID: intel-ish-hid: Use dma_alloc_coherent for firmware update ... commit f97ec5d75e upstream. Allocating memory with kmalloc and GPF_DMA32 is not allowed, the allocator will ignore the attribute. Instead, use dma_alloc_coherent() API as we allocate a small amount of memory to transfer firmware fragment to the ISH. On Arcada chromebook, after the patch the warning: "Unexpected gfp: 0x4 (GFP_DMA32). Fixing up to gfp: 0xcc0 (GFP_KERNEL). Fix your code!" is gone. The ISH firmware is loaded properly and we can interact with the ISH: > ectool --name cros_ish version ... Build info: arcada_ish_v2.0.3661+3c1a1c1ae0 2022-02-08 05:37:47 @localhost Tool version: v2.0.12300-900b03ec7f 2022-02-08 10:01:48 @localhost Fixes: commit 91b228107d ("HID: intel-ish-hid: ISH firmware loader client driver") Signed-off-by: Gwendal Grignou <gwendal@chromium.org> Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Cc: stable@vger.kernel.org Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-04-08 14:39:50 +02:00
Lucas Zampieri	e05ae08ea8	HID: logitech-dj: add new lightspeed receiver id ... [ Upstream commit 25666e8ccd ] As of logitech lightspeed receiver fw version 04.02.B0009, HIDPP_PARAM_DEVICE_INFO is being reported as 0x11. With patch "HID: logitech-dj: add support for the new lightspeed receiver iteration", the mouse starts to error out with: logitech-djreceiver: unusable device of type UNKNOWN (0x011) connected on slot 1 and becomes unusable. This has been noticed on a Logitech G Pro X Superlight fw MPM 25.01.B0018. Signed-off-by: Lucas Zampieri <lzampier@redhat.com> Acked-by: Nestor Lopez Casado <nlopezcasad@logitech.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-04-08 14:39:47 +02:00
Greg Kroah-Hartman	5287773dba	This is the 5.10.106 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmIx4yUACgkQONu9yGCS aT5q2A/+OlbFfkWLW5T0p54BIaXQGduXCtKyG81gZeJJPjQH0Meh6rtzea3n9/2/ ESgOBWmoGCX1I9dq8oWgE+krdg4Bu1pSsyWELlVBD5YeovsrdMJokfbZ5AW7wioO ca/sZpaysp0TiluGSwkU2eYLOeaUNvSUrLPoAK/BjZ4W/INXKQyY3gaG9SqhSEiY ag13I9BLvltepYWQbgq2MJzI5vKq3DHiQSC4/wDA1J02rfa8+C3pTSYZVKES6+6/ NVend811EpI/XQeQhsTP4wVtOYODJyVrXFIcV2n4MIsw80MhlomJjI/3BYiIYTf4 aYqwdGn0CZTQDCAC/HkNJbttcSw5wyJHGDG3e/QQArQ4L0Tu2ah9pXygIkMs9RXj ClUlR2sE0HQBtWrMxz9qT5Yo0F33ghU40VaDGUpX9QNs0Tat5hqGpj3KNVutxrk5 D5U5ueXA8DysmjWv8+oawUoRCuYa4NfPPHA9LExkn+oatu/GdCT6j3Ih5pxOOorw uWijcyvElOvSRvOzBbrLcHmbqV9WIM3cO2ob5I+HbV/agCoytnZS487KY4wp/ZRQ hd/gc03hIJiyJxIWAFosDAHJYsSnyVHTMDqDNF2EQ/Myto0Tf4idAjThCAl8pE1K WmcmqArZei0PfFfa68jOtd5CTE/dBQHwamSaQx0Rf9UkxN7sOko= =PEUE -----END PGP SIGNATURE----- Merge 5.10.106 into android12-5.10-lts Changes in 5.10.106 ARM: boot: dts: bcm2711: Fix HVS register range clk: qcom: gdsc: Add support to update GDSC transition delay HID: vivaldi: fix sysfs attributes leak arm64: dts: armada-3720-turris-mox: Add missing ethernet0 alias tipc: fix kernel panic when enabling bearer mISDN: Remove obsolete PIPELINE_DEBUG debugging information mISDN: Fix memory leak in dsp_pipeline_build() virtio-blk: Don't use MAX_DISCARD_SEGMENTS if max_discard_seg is zero isdn: hfcpci: check the return value of dma_set_mask() in setup_hw() net: qlogic: check the return value of dma_alloc_coherent() in qed_vf_hw_prepare() esp: Fix BEET mode inter address family tunneling on GSO qed: return status of qed_iov_get_link drm/sun4i: mixer: Fix P010 and P210 format numbers net: dsa: mt7530: fix incorrect test in mt753x_phylink_validate() ARM: dts: aspeed: Fix AST2600 quad spi group i40e: stop disabling VFs due to PF error responses ice: stop disabling VFs due to PF error responses ice: Align macro names to the specification ice: Remove unnecessary checker loop ice: Rename a couple of variables ice: Fix curr_link_speed advertised speed ethernet: Fix error handling in xemaclite_of_probe tipc: fix incorrect order of state message data sanity check net: ethernet: ti: cpts: Handle error for clk_enable net: ethernet: lpc_eth: Handle error for clk_enable ax25: Fix NULL pointer dereference in ax25_kill_by_device net/mlx5: Fix size field in bufferx_reg struct net/mlx5: Fix a race on command flush flow net/mlx5e: Lag, Only handle events from highest priority multipath entry NFC: port100: fix use-after-free in port100_send_complete selftests: pmtu.sh: Kill tcpdump processes launched by subshell. gpio: ts4900: Do not set DAT and OE together gianfar: ethtool: Fix refcount leak in gfar_get_ts_info net: phy: DP83822: clear MISR2 register to disable interrupts sctp: fix kernel-infoleak for SCTP sockets net: bcmgenet: Don't claim WOL when its not available selftests/bpf: Add test for bpf_timer overwriting crash spi: rockchip: Fix error in getting num-cs property spi: rockchip: terminate dma transmission when slave abort net-sysfs: add check for netdevice being present to speed_show hwmon: (pmbus) Clear pmbus fault/warning bits after read gpio: Return EPROBE_DEFER if gc->to_irq is NULL Revert "xen-netback: remove 'hotplug-status' once it has served its purpose" Revert "xen-netback: Check for hotplug-status existence before watching" ipv6: prevent a possible race condition with lifetimes tracing: Ensure trace buffer is at least 4096 bytes large selftest/vm: fix map_fixed_noreplace test failure selftests/memfd: clean up mapping in mfd_fail_write ARM: Spectre-BHB: provide empty stub for non-config fuse: fix pipe buffer lifetime for direct_io staging: rtl8723bs: Fix access-point mode deadlock staging: gdm724x: fix use after free in gdm_lte_rx() net: macb: Fix lost RX packet wakeup race in NAPI receive mmc: meson: Fix usage of meson_mmc_post_req() riscv: Fix auipc+jalr relocation range checks arm64: dts: marvell: armada-37xx: Remap IO space to bus address 0x0 virtio: unexport virtio_finalize_features virtio: acknowledge all features before access watch_queue, pipe: Free watchqueue state after clearing pipe ring watch_queue: Fix to release page in ->release() watch_queue: Fix to always request a pow-of-2 pipe ring size watch_queue: Fix the alloc bitmap size to reflect notes allocated watch_queue: Free the alloc bitmap when the watch_queue is torn down watch_queue: Fix lack of barrier/sync/lock between post and read watch_queue: Make comment about setting ->defunct more accurate x86/boot: Fix memremap of setup_indirect structures x86/boot: Add setup_indirect support in early_memremap_is_setup_data() x86/traps: Mark do_int3() NOKPROBE_SYMBOL ext4: add check to prevent attempting to resize an fs with sparse_super2 ARM: fix Thumb2 regression with Spectre BHB watch_queue: Fix filter limit check Linux 5.10.106 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ic7943bdf8c771bff4a95fcf0585ec9c24057cb5b	2022-03-18 15:02:31 +01:00
Dmitry Torokhov	2c6a75ea32	HID: vivaldi: fix sysfs attributes leak ... [ Upstream commit cc71d37fd1 ] The driver creates the top row map sysfs attribute in input_configured() method; unfortunately we do not have a callback that is executed when HID interface is unbound, thus we are leaking these sysfs attributes, for example when device is disconnected. To fix it let's switch to managed version of adding sysfs attributes which will ensure that they are destroyed when the driver is unbound. Fixes: 14c9c014ba ("HID: add vivaldi HID driver") Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Tested-by: Stephen Boyd <swboyd@chromium.org> Reviewed-by: Stephen Boyd <swboyd@chromium.org> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-03-16 14:15:56 +01:00
Greg Kroah-Hartman	0773736e48	This is the 5.10.104 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmInm+kACgkQONu9yGCS aT4/lw/6AoFz3oHbzlft4tCUn4UXQIut8gIiJfrXBnIqw6pa5YQPA1E7hgQBxTnG v9llnwDRFR7qouXq1qhoXU01vETiRqZ2ClkT/MnvLfRMQcHgtS9B61VgwnpNuNBg qStZORcqFi6rQHXySUgs2ObF6NZQ3BRyHY2LYqZPj0YkuHIdQo48WtQ9cy0XWZLV WT49LIVxkTZ6D0fs/k10qRv+M4lmeOzCqEZf4591F0sjoVuTFj3F1xMsSbu8W3xZ xXxE0hPbN0If3JFhnb3DqdQ20kRNSmrrV1CzYaN09jyP7KHpdIDVT8R1hSau3TFP 3zd2fBWmOP0FPzOVkNnqetMuKspKH8p3kKW2rkTyHYcGtUFzh54Hm0QRpA3CVB3L JZje9HCkxWiBSl1mwypmBGp88kWOe+n3NRUOhX3yqPoT3R2n45coBV+sfSOakkxv K8mUw1FFbJTPjgJtMCs57zzxybInnMrAF5/7XA2MgHCr3SVvYQA7+joSPn3CO+0K zKO4kTdEmD9jTT+3vMDL4Z3VSmOJMVcxCHBTUrac/OBIiBz+7y9WQSc7a6aRbfdu k3wy7HJ98pmjYB6g73MJcXOtTwXuoTqur4QWU5MCgTw6+qglgRQHr5ILSs35ZeAV LO1zvAsklOWFMc/3fD8heLmKGBZ0GHcn+0Y7ZqfFKLmqOTnx7tA= =W+lo -----END PGP SIGNATURE----- Merge 5.10.104 into android12-5.10-lts Changes in 5.10.104 mac80211_hwsim: report NOACK frames in tx_status mac80211_hwsim: initialize ieee80211_tx_info at hw_scan_work i2c: bcm2835: Avoid clock stretching timeouts ASoC: rt5668: do not block workqueue if card is unbound ASoC: rt5682: do not block workqueue if card is unbound regulator: core: fix false positive in regulator_late_cleanup() Input: clear BTN_RIGHT/MIDDLE on buttonpads KVM: arm64: vgic: Read HW interrupt pending state from the HW tipc: fix a bit overflow in tipc_crypto_key_rcv() cifs: fix double free race when mount fails in cifs_get_root() selftests/seccomp: Fix seccomp failure by adding missing headers dmaengine: shdma: Fix runtime PM imbalance on error i2c: cadence: allow COMPILE_TEST i2c: qup: allow COMPILE_TEST net: usb: cdc_mbim: avoid altsetting toggling for Telit FN990 usb: gadget: don't release an existing dev->buf usb: gadget: clear related members when goto fail exfat: reuse exfat_inode_info variable instead of calling EXFAT_I() exfat: fix i_blocks for files truncated over 4 GiB tracing: Add test for user space strings when filtering on string pointers serial: stm32: prevent TDR register overwrite when sending x_char ata: pata_hpt37x: fix PCI clock detection drm/amdgpu: check vm ready by amdgpu_vm->evicting flag tracing: Add ustring operation to filtering string pointers ALSA: intel_hdmi: Fix reference to PCM buffer address riscv/efi_stub: Fix get_boot_hartid_from_fdt() return value riscv: Fix config KASAN && SPARSEMEM && !SPARSE_VMEMMAP riscv: Fix config KASAN && DEBUG_VIRTUAL ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min iommu/amd: Recover from event log overflow drm/i915: s/JSP2/ICP2/ PCH xen/netfront: destroy queues before real_num_tx_queues is zeroed thermal: core: Fix TZ_GET_TRIP NULL pointer dereference ntb: intel: fix port config status offset for SPR mm: Consider __GFP_NOWARN flag for oversized kvmalloc() calls xfrm: fix MTU regression netfilter: fix use-after-free in __nf_register_net_hook() bpf, sockmap: Do not ignore orig_len parameter xfrm: fix the if_id check in changelink xfrm: enforce validity of offload input flags e1000e: Correct NVM checksum verification flow net: fix up skbs delta_truesize in UDP GRO frag_list netfilter: nf_queue: don't assume sk is full socket netfilter: nf_queue: fix possible use-after-free netfilter: nf_queue: handle socket prefetch batman-adv: Request iflink once in batadv-on-batadv check batman-adv: Request iflink once in batadv_get_real_netdevice batman-adv: Don't expect inter-netns unique iflink indices net: ipv6: ensure we call ipv6_mc_down() at most once net: dcb: flush lingering app table entries for unregistered devices net/smc: fix connection leak net/smc: fix unexpected SMC_CLC_DECL_ERR_REGRMB error generated by client net/smc: fix unexpected SMC_CLC_DECL_ERR_REGRMB error cause by server rcu/nocb: Fix missed nocb_timer requeue ice: Fix race conditions between virtchnl handling and VF ndo ops ice: fix concurrent reset and removal of VFs sched/topology: Make sched_init_numa() use a set for the deduplicating sort sched/topology: Fix sched_domain_topology_level alloc in sched_init_numa() ia64: ensure proper NUMA distance and possible map initialization mac80211: fix forwarded mesh frames AC & queue selection net: stmmac: fix return value of __setup handler mac80211: treat some SAE auth steps as final iavf: Fix missing check for running netdev net: sxgbe: fix return value of __setup handler ibmvnic: register netdev after init of adapter net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe() ixgbe: xsk: change !netif_carrier_ok() handling in ixgbe_xmit_zc() efivars: Respect "block" flag in efivar_entry_set_safe() firmware: arm_scmi: Remove space in MODULE_ALIAS name ASoC: cs4265: Fix the duplicated control name can: gs_usb: change active_channels's type from atomic_t to u8 arm64: dts: rockchip: Switch RK3399-Gru DP to SPDIF output igc: igc_read_phy_reg_gpy: drop premature return ARM: Fix kgdb breakpoint for Thumb2 ARM: 9182/1: mmu: fix returns from early_param() and __setup() functions selftests: mlxsw: tc_police_scale: Make test more robust pinctrl: sunxi: Use unique lockdep classes for IRQs igc: igc_write_phy_reg_gpy: drop premature return ibmvnic: free reset-work-item when flushing memfd: fix F_SEAL_WRITE after shmem huge page allocated s390/extable: fix exception table sorting ARM: dts: switch timer config to common devkit8000 devicetree ARM: dts: Use 32KiHz oscillator on devkit8000 soc: fsl: guts: Revert commit 3c0d64e867 soc: fsl: guts: Add a missing memory allocation failure check soc: fsl: qe: Check of ioremap return value ARM: tegra: Move panels to AUX bus ibmvnic: complete init_done on transport events net: chelsio: cxgb3: check the return value of pci_find_capability() iavf: Refactor iavf state machine tracking nl80211: Handle nla_memdup failures in handle_nan_filter drm/amdgpu: fix suspend/resume hang regression net: dcb: disable softirqs in dcbnl_flush_dev() Input: elan_i2c - move regulator_[en|dis]able() out of elan_[en|dis]able_power() Input: elan_i2c - fix regulator enable count imbalance after suspend/resume Input: samsung-keypad - properly state IOMEM dependency HID: add mapping for KEY_DICTATE HID: add mapping for KEY_ALL_APPLICATIONS tracing/histogram: Fix sorting on old "cpu" value tracing: Fix return value of __setup handlers btrfs: fix lost prealloc extents beyond eof after full fsync btrfs: qgroup: fix deadlock between rescan worker and remove qgroup btrfs: add missing run of delayed items after unlink during log replay Revert "xfrm: xfrm_state_mtu should return at least 1280 for ipv6" hamradio: fix macro redefine warning Linux 5.10.104 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I24dabeba483a0b0123a4e8c10d1a568b11dfb9c8	2022-03-12 13:57:09 +01:00
William Mahon	0e188fde82	HID: add mapping for KEY_ALL_APPLICATIONS ... commit 327b89f0ac upstream. This patch adds a new key definition for KEY_ALL_APPLICATIONS and aliases KEY_DASHBOARD to it. It also maps the 0x0c/0x2a2 usage code to KEY_ALL_APPLICATIONS. Signed-off-by: William Mahon <wmahon@chromium.org> Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Link: https://lore.kernel.org/r/20220303035618.1.I3a7746ad05d270161a18334ae06e3b6db1a1d339@changeid Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-03-08 19:09:38 +01:00
William Mahon	f276ea5035	HID: add mapping for KEY_DICTATE ... commit bfa26ba343 upstream. Numerous keyboards are adding dictate keys which allows for text messages to be dictated by a microphone. This patch adds a new key definition KEY_DICTATE and maps 0x0c/0x0d8 usage code to this new keycode. Additionally hid-debug is adjusted to recognize this new usage code as well. Signed-off-by: William Mahon <wmahon@chromium.org> Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Link: https://lore.kernel.org/r/20220303021501.1.I5dbf50eb1a7a6734ee727bda4a8573358c6d3ec0@changeid Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-03-08 19:09:38 +01:00
Greg Kroah-Hartman	79553fad5c	This is the 5.10.102 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmIWE/gACgkQONu9yGCS aT74Cw//awQY9EgXHMRNNU5+qun0ESkj918YvfAIKGDRutaOXK00YUdkqjuxEP6V gOso0rbXe1LiravgrbPSaYbgSvhGVPOPXHLhb7QQkiodxMZ0oaEEzST2VzM4a19k xfhne2BeqCCl4oUUA84NZPcCpohaLhRjZesMWR23zWNbVMEIt7uV8eeqRcC0S4YA r7cA4PURBMUiTlWWssBwlrEVy5JZrlcTYCvljxcpd8ws1Xs0KnmxX4gIDpQzNoFj Dfwg3lSFcl+ar/Xrg14qL3q3iO8zpaJ2msguZ4vq+OLiYWoTfoFcBF625eQJn6/B eWrzpNUqzFv5Eu31vMnv4Wm/iN8/1Yd+lacSqKwxejdmZzwX79VRqv9kD2naT/eP C/tkI1b93Ig7+teIjm+aqMAFDoAeR75oVK0KwKEkDIT19mbX1CSex9VnJtaSHZTM ON7N8NBUyIPLmhc3jencrsFNIY11W7xUedcN/+JmrZoi4Xy4Yr0mh3H4fZVs/vAH I6uYZgylTZiX0esCqJeiHrasETL0IStDw57+wbrjLlBrATgkMbhZQ+VTBxio/mxV yok4TiIB+EHaNMOgIAuT6uaZrXwDwHekR1EX1s4p2cPTz1kstp1ZIC2Gdv910xKB gprzPa/ocwqk71QODgwhogwntR/a4edbbYvCVHKLXQH9Pd81jkM= =TZTu -----END PGP SIGNATURE----- Merge 5.10.102 into android12-5.10-lts Changes in 5.10.102 drm/nouveau/pmu/gm200-: use alternate falcon reset sequence mm: memcg: synchronize objcg lists with a dedicated spinlock rcu: Do not report strict GPs for outgoing CPUs fget: clarify and improve __fget_files() implementation fs/proc: task_mmu.c: don't read mapcount for migration entry can: isotp: prevent race between isotp_bind() and isotp_setsockopt() can: isotp: add SF_BROADCAST support for functional addressing scsi: lpfc: Fix mailbox command failure during driver initialization HID:Add support for UGTABLET WP5540 Revert "svm: Add warning message for AVIC IPI invalid target" serial: parisc: GSC: fix build when IOSAPIC is not set parisc: Drop __init from map_pages declaration parisc: Fix data TLB miss in sba_unmap_sg parisc: Fix sglist access in ccio-dma.c mmc: block: fix read single on recovery logic mm: don't try to NUMA-migrate COW pages that have other uses PCI: hv: Fix NUMA node assignment when kernel boots with custom NUMA topology parisc: Add ioread64_lo_hi() and iowrite64_lo_hi() btrfs: send: in case of IO error log it platform/x86: touchscreen_dmi: Add info for the RWC NANOTE P8 AY07J 2-in-1 platform/x86: ISST: Fix possible circular locking dependency detected selftests: rtc: Increase test timeout so that all tests run kselftest: signal all child processes net: ieee802154: at86rf230: Stop leaking skb's selftests/zram: Skip max_comp_streams interface on newer kernel selftests/zram01.sh: Fix compression ratio calculation selftests/zram: Adapt the situation that /dev/zram0 is being used selftests: openat2: Print also errno in failure messages selftests: openat2: Add missing dependency in Makefile selftests: openat2: Skip testcases that fail with EOPNOTSUPP selftests: skip mincore.check_file_mmap when fs lacks needed support ax25: improve the incomplete fix to avoid UAF and NPD bugs vfs: make freeze_super abort when sync_filesystem returns error quota: make dquot_quota_sync return errors from ->sync_fs scsi: pm8001: Fix use-after-free for aborted TMF sas_task scsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task nvme: fix a possible use-after-free in controller reset during load nvme-tcp: fix possible use-after-free in transport error_recovery work nvme-rdma: fix possible use-after-free in transport error_recovery work drm/amdgpu: fix logic inversion in check x86/Xen: streamline (and fix) PV CPU enumeration Revert "module, async: async_synchronize_full() on module init iff async is used" gcc-plugins/stackleak: Use noinstr in favor of notrace random: wake up /dev/random writers after zap kbuild: lto: merge module sections kbuild: lto: Merge module sections if and only if CONFIG_LTO_CLANG is enabled iwlwifi: fix use-after-free drm/radeon: Fix backlight control on iMac 12,1 drm/i915/opregion: check port number bounds for SWSCI display power state vsock: remove vsock from connected table when connect is interrupted by a signal drm/i915/gvt: Make DRM_I915_GVT depend on X86 iwlwifi: pcie: fix locking when "HW not ready" iwlwifi: pcie: gen2: fix locking when "HW not ready" selftests: netfilter: fix exit value for nft_concat_range netfilter: nft_synproxy: unregister hooks on init error path ipv6: per-netns exclusive flowlabel checks net: dsa: lan9303: fix reset on probe net: dsa: lantiq_gswip: fix use after free in gswip_remove() net: ieee802154: ca8210: Fix lifs/sifs periods ping: fix the dif and sdif check in ping_lookup bonding: force carrier update when releasing slave drop_monitor: fix data-race in dropmon_net_event / trace_napi_poll_hit net_sched: add __rcu annotation to netdev->qdisc bonding: fix data-races around agg_select_timer libsubcmd: Fix use-after-free for realloc(..., 0) dpaa2-eth: Initialize mutex used in one step timestamping path perf bpf: Defer freeing string after possible strlen() on it selftests/exec: Add non-regular to TEST_GEN_PROGS ALSA: hda/realtek: Add quirk for Legion Y9000X 2019 ALSA: hda/realtek: Fix deadlock by COEF mutex ALSA: hda: Fix regression on forced probe mask option ALSA: hda: Fix missing codec probe on Shenker Dock 15 ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw() ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw_range() powerpc/lib/sstep: fix 'ptesync' build error mtd: rawnand: gpmi: don't leak PM reference in error path KVM: SVM: Never reject emulation due to SMAP errata for !SEV guests ASoC: tas2770: Insert post reset delay block/wbt: fix negative inflight counter when remove scsi device NFS: LOOKUP_DIRECTORY is also ok with symlinks NFS: Do not report writeback errors in nfs_getattr() tty: n_tty: do not look ahead for EOL character past the end of the buffer mtd: rawnand: qcom: Fix clock sequencing in qcom_nandc_probe() mtd: rawnand: brcmnand: Fixed incorrect sub-page ECC status Drivers: hv: vmbus: Fix memory leak in vmbus_add_channel_kobj KVM: x86/pmu: Refactoring find_arch_event() to pmc_perf_hw_id() KVM: x86/pmu: Don't truncate the PerfEvtSeln MSR when creating a perf event KVM: x86/pmu: Use AMD64_RAW_EVENT_MASK for PERF_TYPE_RAW NFS: Don't set NFS_INO_INVALID_XATTR if there is no xattr cache ARM: OMAP2+: hwmod: Add of_node_put() before break ARM: OMAP2+: adjust the location of put_device() call in omapdss_init_of phy: usb: Leave some clocks running during suspend irqchip/sifive-plic: Add missing thead,c900-plic match string netfilter: conntrack: don't refresh sctp entries in closed state arm64: dts: meson-gx: add ATF BL32 reserved-memory region arm64: dts: meson-g12: add ATF BL32 reserved-memory region arm64: dts: meson-g12: drop BL32 region from SEI510/SEI610 pidfd: fix test failure due to stack overflow on some arches selftests: fixup build warnings in pidfd / clone3 tests kconfig: let 'shell' return enough output for deep path names lib/iov_iter: initialize "flags" in new pipe_buffer ata: libata-core: Disable TRIM on M88V29 soc: aspeed: lpc-ctrl: Block error printing on probe defer cases xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create drm/rockchip: dw_hdmi: Do not leave clock enabled in error case tracing: Fix tp_printk option related with tp_printk_stop_on_boot net: usb: qmi_wwan: Add support for Dell DW5829e net: macb: Align the dma and coherent dma masks kconfig: fix failing to generate auto.conf scsi: lpfc: Fix pt2pt NVMe PRLI reject LOGO loop EDAC: Fix calculation of returned address and next offset in edac_align_ptr() net: sched: limit TC_ACT_REPEAT loops dmaengine: sh: rcar-dmac: Check for error num after setting mask dmaengine: stm32-dmamux: Fix PM disable depth imbalance in stm32_dmamux_probe dmaengine: sh: rcar-dmac: Check for error num after dma_set_max_seg_size i2c: qcom-cci: don't delete an unregistered adapter i2c: qcom-cci: don't put a device tree node before i2c_add_adapter() copy_process(): Move fd_install() out of sighand->siglock critical section i2c: brcmstb: fix support for DSL and CM variants lockdep: Correct lock_classes index mapping Linux 5.10.102 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ief12c0d77b23f9796b81a8fc3b79ac6589e81dc9	2022-02-23 12:56:37 +01:00
Sergio Costas	126382b556	HID:Add support for UGTABLET WP5540 ... commit fd5dd6acd8 upstream. This patch adds support for the UGTABLET WP5540 digitizer tablet devices. Without it, the pen moves the cursor, but neither the buttons nor the tap sensor in the tip do work. Signed-off-by: Sergio Costas <rastersoft@gmail.com> Link: https://lore.kernel.org/r/63dece1d-91ca-1b1b-d90d-335be66896be@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-02-23 12:00:57 +01:00
Greg Kroah-Hartman	4ec3c2eea5	This is the 5.10.94 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmHya+IACgkQONu9yGCS aT7k/RAAqdd8bNhAiO6iDpvZbQtxq9jepx4KCkcd+gsYvSvePEnBQHaTaavfCK/7 +taWsc2i6Hwc1Z4oVfUiU02cCsqMJJXqb0nfJaavE5cZspbTc7QeS0zv9BkzSKUZ +DxXWyjzeJquI7EbdU0n7inb0iwvBxmTGNIg2j1pPi81Q7XnpjmDsSvuoftRQ0AN DGYefowWL1VcfsZRfhEudnpxWC/DjOdB8zD34SgXxKat6/O8YG4T5pM2BOUlKtOW QcXFhpG6gU0XqmI3QQDvAESujOQxzC1u3AwIOHYJ/tlFYsUJXjiZIEVnMqPYGpNl fXS8xcNSeo6fipXWkzsc489Tteq9H+bfm8sBG0jhExRnyGckkihJDhRFZ9yBrzo/ 1PtUdUIJ4d5fUmdZp7gxucncFyIYFsyJm/5nsYmObP794oStPGKsH8llhp/PcEFF ua1+Gy2WW2f6BOaDVFmt+jWZRMa/3oZnFhe8/FPRsAjGOj+q/+V6bsksGDYupsrM x8/QQI6OVlnOZsrdpX7zkW46qLov0J0bO9cANTm7kcRaesrkikFKqiIF2uIW2OU6 W0tZZf0Jy/gSLEljkZ3SuMHCmldWKm/KxMYSjnQ3Y34QvOLYPNAZGF78rbV3s8/0 otGR3ra5TKCz1kxuDaE1FqZXxpPQidXbF4QUoaRIaPwA1k5NvLY= =ktJL -----END PGP SIGNATURE----- Merge 5.10.94 into android12-5.10-lts Changes in 5.10.94 KVM: VMX: switch blocked_vcpu_on_cpu_lock to raw spinlock HID: uhid: Fix worker destroying device without any protection HID: wacom: Reset expected and received contact counts at the same time HID: wacom: Ignore the confidence flag when a touch is removed HID: wacom: Avoid using stale array indicies to read contact count f2fs: fix to do sanity check in is_alive() nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind() mtd: rawnand: gpmi: Add ERR007117 protection for nfc_apply_timings mtd: rawnand: gpmi: Remove explicit default gpmi clock setting for i.MX6 mtd: Fixed breaking list in __mtd_del_partition. mtd: rawnand: davinci: Don't calculate ECC when reading page mtd: rawnand: davinci: Avoid duplicated page read mtd: rawnand: davinci: Rewrite function description x86/gpu: Reserve stolen memory for first integrated Intel GPU tools/nolibc: x86-64: Fix startup code bug tools/nolibc: i386: fix initial stack alignment tools/nolibc: fix incorrect truncation of exit code rtc: cmos: take rtc_lock while reading from CMOS media: v4l2-ioctl.c: readbuffers depends on V4L2_CAP_READWRITE media: flexcop-usb: fix control-message timeouts media: mceusb: fix control-message timeouts media: em28xx: fix control-message timeouts media: cpia2: fix control-message timeouts media: s2255: fix control-message timeouts media: dib0700: fix undefined behavior in tuner shutdown media: redrat3: fix control-message timeouts media: pvrusb2: fix control-message timeouts media: stk1160: fix control-message timeouts media: cec-pin: fix interrupt en/disable handling can: softing_cs: softingcs_probe(): fix memleak on registration failure iio: adc: ti-adc081c: Partial revert of removal of ACPI IDs lkdtm: Fix content of section containing lkdtm_rodata_do_nothing() iommu/io-pgtable-arm-v7s: Add error handle for page table allocation failure gpu: host1x: Add back arm_iommu_detach_device() dma_fence_array: Fix PENDING_ERROR leak in dma_fence_array_signaled() PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller mm_zone: add function to check if managed dma zone exists dma/pool: create dma atomic pool only if dma zone has managed pages mm/page_alloc.c: do not warn allocation failure on zone DMA if no managed pages shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode drm/ttm: Put BO in its memory manager's lru list Bluetooth: L2CAP: Fix not initializing sk_peer_pid drm/bridge: display-connector: fix an uninitialized pointer in probe() drm: fix null-ptr-deref in drm_dev_init_release() drm/panel: kingdisplay-kd097d04: Delete panel on attach() failure drm/panel: innolux-p079zca: Delete panel on attach() failure drm/rockchip: dsi: Fix unbalanced clock on probe error drm/rockchip: dsi: Hold pm-runtime across bind/unbind drm/rockchip: dsi: Disable PLL clock on bind error drm/rockchip: dsi: Reconfigure hardware on resume() Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails clk: bcm-2835: Pick the closest clock rate clk: bcm-2835: Remove rounding up the dividers drm/vc4: hdmi: Set a default HSM rate wcn36xx: ensure pairing of init_scan/finish_scan and start_scan/end_scan wcn36xx: Indicate beacon not connection loss on MISSED_BEACON_IND wcn36xx: Fix DMA channel enable/disable cycle wcn36xx: Release DMA channel descriptor allocations wcn36xx: Put DXE block into reset before freeing memory wcn36xx: populate band before determining rate on RX wcn36xx: fix RX BD rate mapping for 5GHz legacy rates ath11k: Send PPDU_STATS_CFG with proper pdev mask to firmware mtd: hyperbus: rpc-if: Check return value of rpcif_sw_init() media: videobuf2: Fix the size printk format media: atomisp: add missing media_device_cleanup() in atomisp_unregister_entities() media: atomisp: fix punit_ddr_dvfs_enable() argument for mrfld_power up case media: atomisp: fix inverted logic in buffers_needed() media: atomisp: do not use err var when checking port validity for ISP2400 media: atomisp: fix inverted error check for ia_css_mipi_is_source_port_valid() media: atomisp: fix ifdefs in sh_css.c media: staging: media: atomisp: pci: Balance braces around conditional statements in file atomisp_cmd.c media: atomisp: add NULL check for asd obtained from atomisp_video_pipe media: atomisp: fix enum formats logic media: atomisp: fix uninitialized bug in gmin_get_pmic_id_and_addr() media: aspeed: fix mode-detect always time out at 2nd run media: em28xx: fix memory leak in em28xx_init_dev media: aspeed: Update signal status immediately to ensure sane hw state arm64: dts: amlogic: meson-g12: Fix GPU operating point table node name arm64: dts: amlogic: Fix SPI NOR flash node name for ODROID N2/N2+ arm64: dts: meson-gxbb-wetek: fix HDMI in early boot arm64: dts: meson-gxbb-wetek: fix missing GPIO binding fs: dlm: use sk->sk_socket instead of con->sock fs: dlm: don't call kernel_getpeername() in error_report() memory: renesas-rpc-if: Return error in case devm_ioremap_resource() fails Bluetooth: stop proccessing malicious adv data ath11k: Fix ETSI regd with weather radar overlap ath11k: clear the keys properly via DISABLE_KEY ath11k: reset RSN/WPA present state for open BSS tee: fix put order in teedev_close_context() fs: dlm: fix build with CONFIG_IPV6 disabled drm/vboxvideo: fix a NULL vs IS_ERR() check arm64: dts: renesas: cat875: Add rx/tx delays media: dmxdev: fix UAF when dvb_register_device() fails crypto: qce - fix uaf on qce_ahash_register_one crypto: qce - fix uaf on qce_skcipher_register_one mtd: hyperbus: rpc-if: fix bug in rpcif_hb_remove ARM: dts: stm32: fix dtbs_check warning on ili9341 dts binding on stm32f429 disco crypto: qat - fix spelling mistake: "messge" -> "message" crypto: qat - remove unnecessary collision prevention step in PFVF crypto: qat - make pfvf send message direction agnostic crypto: qat - fix undetected PFVF timeout in ACK loop ath11k: Use host CE parameters for CE interrupts configuration arm64: dts: ti: k3-j721e: correct cache-sets info tty: serial: atmel: Check return code of dmaengine_submit() tty: serial: atmel: Call dma_async_issue_pending() mfd: atmel-flexcom: Remove #ifdef CONFIG_PM_SLEEP mfd: atmel-flexcom: Use .resume_noirq media: rcar-csi2: Correct the selection of hsfreqrange media: imx-pxp: Initialize the spinlock prior to using it media: si470x-i2c: fix possible memory leak in si470x_i2c_probe() media: mtk-vcodec: call v4l2_m2m_ctx_release first when file is released media: coda: fix CODA960 JPEG encoder buffer overflow media: venus: pm_helpers: Control core power domain manually media: venus: core, venc, vdec: Fix probe dependency error media: venus: core: Fix a potential NULL pointer dereference in an error handling path media: venus: core: Fix a resource leak in the error handling path of 'venus_probe()' thermal/drivers/imx: Implement runtime PM support netfilter: bridge: add support for pppoe filtering arm64: dts: qcom: msm8916: fix MMC controller aliases cgroup: Trace event cgroup id fields should be u64 ACPI: EC: Rework flushing of EC work while suspended to idle thermal/drivers/imx8mm: Enable ADC when enabling monitor drm/amdgpu: Fix a NULL pointer dereference in amdgpu_connector_lcd_native_mode() drm/radeon/radeon_kms: Fix a NULL pointer dereference in radeon_driver_open_kms() arm64: dts: ti: k3-j7200: Fix the L2 cache sets arm64: dts: ti: k3-j721e: Fix the L2 cache sets arm64: dts: ti: k3-j7200: Correct the d-cache-sets info tty: serial: uartlite: allow 64 bit address serial: amba-pl011: do not request memory region twice floppy: Fix hang in watchdog when disk is ejected staging: rtl8192e: return error code from rtllib_softmac_init() staging: rtl8192e: rtllib_module: fix error handle case in alloc_rtllib() Bluetooth: btmtksdio: fix resume failure sched/fair: Fix detection of per-CPU kthreads waking a task sched/fair: Fix per-CPU kthread and wakee stacking for asym CPU capacity bpf: Adjust BTF log size limit. bpf: Disallow BPF_LOG_KERNEL log level for bpf(BPF_BTF_LOAD) bpf: Remove config check to enable bpf support for branch records arm64: lib: Annotate {clear, copy}_page() as position-independent arm64: clear_page() shouldn't use DC ZVA when DCZID_EL0.DZP == 1 media: dib8000: Fix a memleak in dib8000_init() media: saa7146: mxb: Fix a NULL pointer dereference in mxb_attach() media: si2157: Fix "warm" tuner state detection wireless: iwlwifi: Fix a double free in iwl_txq_dyn_alloc_dma sched/rt: Try to restart rt period timer when rt runtime exceeded drm/msm/dp: displayPort driver need algorithm rational rcu/exp: Mark current CPU as exp-QS in IPI loop second pass mwifiex: Fix possible ABBA deadlock xfrm: fix a small bug in xfrm_sa_len() x86/uaccess: Move variable into switch case statement selftests: clone3: clone3: add case CLONE3_ARGS_NO_TEST selftests: harness: avoid false negatives if test has no ASSERTs crypto: stm32 - Fix last sparse warning in stm32_cryp_check_ctr_counter crypto: stm32/cryp - fix CTR counter carry crypto: stm32/cryp - fix xts and race condition in crypto_engine requests crypto: stm32/cryp - check early input data crypto: stm32/cryp - fix double pm exit crypto: stm32/cryp - fix lrw chaining mode crypto: stm32/cryp - fix bugs and crash in tests crypto: stm32 - Revert broken pm_runtime_resume_and_get changes ath11k: Fix deleting uninitialized kernel timer during fragment cache flush ARM: dts: gemini: NAS4220-B: fis-index-block with 128 KiB sectors media: dw2102: Fix use after free media: msi001: fix possible null-ptr-deref in msi001_probe() media: coda/imx-vdoa: Handle dma_set_coherent_mask error codes ath11k: Fix a NULL pointer dereference in ath11k_mac_op_hw_scan() arm64: dts: qcom: c630: Fix soundcard setup arm64: dts: qcom: ipq6018: Fix gpio-ranges property drm/msm/dpu: fix safe status debugfs file drm/bridge: ti-sn65dsi86: Set max register for regmap drm/tegra: vic: Fix DMA API misuse media: hantro: Fix probe func error path xfrm: interface with if_id 0 should return error xfrm: state and policy should fail if XFRMA_IF_ID 0 ARM: 9159/1: decompressor: Avoid UNPREDICTABLE NOP encoding usb: ftdi-elan: fix memory leak on device disconnect arm64: dts: marvell: cn9130: add GPIO and SPI aliases arm64: dts: marvell: cn9130: enable CP0 GPIO controllers ARM: dts: armada-38x: Add generic compatible to UART nodes iwlwifi: mvm: fix 32-bit build in FTM iwlwifi: mvm: test roc running status bits before removing the sta mmc: meson-mx-sdhc: add IRQ check mmc: meson-mx-sdio: add IRQ check selinux: fix potential memleak in selinux_add_opt() um: fix ndelay/udelay defines um: virtio_uml: Fix time-travel external time propagation Bluetooth: L2CAP: Fix using wrong mode bpftool: Enable line buffering for stdout backlight: qcom-wled: Validate enabled string indices in DT backlight: qcom-wled: Pass number of elements to read to read_u32_array backlight: qcom-wled: Fix off-by-one maximum with default num_strings backlight: qcom-wled: Override default length with qcom,enabled-strings backlight: qcom-wled: Use cpu_to_le16 macro to perform conversion backlight: qcom-wled: Respect enabled-strings in set_brightness software node: fix wrong node passed to find nargs_prop Bluetooth: hci_qca: Stop IBS timer during BT OFF x86/boot/compressed: Move CLANG_FLAGS to beginning of KBUILD_CFLAGS hwmon: (mr75203) fix wrong power-up delay value x86/mce/inject: Avoid out-of-bounds write when setting flags ACPI: scan: Create platform device for BCM4752 and LNV4752 ACPI nodes pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in __nonstatic_find_io_region() pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in nonstatic_find_mem_region() power: reset: mt6397: Check for null res pointer netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check() bpf: Don't promote bogus looking registers after null check. bpf: Fix SO_RCVBUF/SO_SNDBUF handling in _bpf_setsockopt(). netfilter: nft_set_pipapo: allocate pcpu scratch maps on clone ppp: ensure minimum packet size in ppp_write() rocker: fix a sleeping in atomic bug staging: greybus: audio: Check null pointer fsl/fman: Check for null pointer after calling devm_ioremap Bluetooth: hci_bcm: Check for error irq Bluetooth: hci_qca: Fix NULL vs IS_ERR_OR_NULL check in qca_serdev_probe usb: dwc3: qcom: Fix NULL vs IS_ERR checking in dwc3_qcom_probe HID: hid-uclogic-params: Invalid parameter check in uclogic_params_init HID: hid-uclogic-params: Invalid parameter check in uclogic_params_get_str_desc HID: hid-uclogic-params: Invalid parameter check in uclogic_params_huion_init HID: hid-uclogic-params: Invalid parameter check in uclogic_params_frame_init_v1_buttonpad debugfs: lockdown: Allow reading debugfs files that are not world readable net/mlx5e: Fix page DMA map/unmap attributes net/mlx5e: Don't block routes with nexthop objects in SW Revert "net/mlx5e: Block offload of outer header csum for UDP tunnels" net/mlx5: Set command entry semaphore up once got index free lib/mpi: Add the return value check of kcalloc() Bluetooth: L2CAP: uninitialized variables in l2cap_sock_setsockopt() spi: spi-meson-spifc: Add missing pm_runtime_disable() in meson_spifc_probe ax25: uninitialized variable in ax25_setsockopt() netrom: fix api breakage in nr_setsockopt() regmap: Call regmap_debugfs_exit() prior to _init() can: mcp251xfd: add missing newline to printed strings tpm: add request_locality before write TPM_INT_ENABLE tpm_tis: Fix an error handling path in 'tpm_tis_core_init()' can: softing: softing_startstop(): fix set but not used variable warning can: xilinx_can: xcan_probe(): check for error irq pcmcia: fix setting of kthread task states iwlwifi: mvm: Use div_s64 instead of do_div in iwl_mvm_ftm_rtt_smoothing() net: mcs7830: handle usb read errors properly ext4: avoid trim error on fs with small groups ALSA: jack: Add missing rwsem around snd_ctl_remove() calls ALSA: PCM: Add missing rwsem around snd_ctl_remove() calls ALSA: hda: Add missing rwsem around snd_ctl_remove() calls RDMA/bnxt_re: Scan the whole bitmap when checking if "disabling RCFW with pending cmd-bit" RDMA/hns: Validate the pkey index scsi: pm80xx: Update WARN_ON check in pm8001_mpi_build_cmd() clk: imx8mn: Fix imx8mn_clko1_sels powerpc/prom_init: Fix improper check of prom_getprop() ASoC: uniphier: drop selecting non-existing SND_SOC_UNIPHIER_AIO_DMA dt-bindings: thermal: Fix definition of cooling-maps contribution property powerpc/64s: Convert some cpu_setup() and cpu_restore() functions to C powerpc/perf: MMCR0 control for PMU registers under PMCC=00 powerpc/perf: move perf irq/nmi handling details into traps.c powerpc/irq: Add helper to set regs->softe powerpc/perf: Fix PMU callbacks to clear pending PMI before resetting an overflown PMC powerpc/32s: Fix shift-out-of-bounds in KASAN init clocksource: Reduce clocksource-skew threshold clocksource: Avoid accidental unstable marking of clocksources ALSA: oss: fix compile error when OSS_DEBUG is enabled ALSA: usb-audio: Drop superfluous '0' in Presonus Studio 1810c's ID char/mwave: Adjust io port register size binder: fix handling of error during copy openrisc: Add clone3 ABI wrapper iommu/io-pgtable-arm: Fix table descriptor paddr formatting scsi: ufs: Fix race conditions related to driver data RDMA/qedr: Fix reporting max_{send/recv}_wr attrs PCI/MSI: Fix pci_irq_vector()/pci_irq_get_affinity() powerpc/powermac: Add additional missing lockdep_register_key() RDMA/core: Let ib_find_gid() continue search even after empty entry RDMA/cma: Let cma_resolve_ib_dev() continue search even after empty entry ASoC: rt5663: Handle device_property_read_u32_array error codes of: unittest: fix warning on PowerPC frame size warning of: unittest: 64 bit dma address test requires arch support clk: stm32: Fix ltdc's clock turn off by clk_disable_unused() after system enter shell mips: add SYS_HAS_CPU_MIPS64_R5 config for MIPS Release 5 support mips: fix Kconfig reference to PHYS_ADDR_T_64BIT dmaengine: pxa/mmp: stop referencing config->slave_id iommu/amd: Remove iommu_init_ga() iommu/amd: Restore GA log/tail pointer on host resume ASoC: Intel: catpt: Test dmaengine_submit() result before moving on iommu/iova: Fix race between FQ timeout and teardown scsi: block: pm: Always set request queue runtime active in blk_post_runtime_resume() phy: uniphier-usb3ss: fix unintended writing zeros to PHY register ASoC: mediatek: Check for error clk pointer ASoC: samsung: idma: Check of ioremap return value misc: lattice-ecp3-config: Fix task hung when firmware load failed counter: stm32-lptimer-cnt: remove iio counter abi arm64: tegra: Fix Tegra194 HDA {clock,reset}-names ordering arm64: tegra: Remove non existent Tegra194 reset mips: lantiq: add support for clk_set_parent() mips: bcm63xx: add support for clk_set_parent() powerpc/xive: Add missing null check after calling kmalloc ASoC: fsl_mqs: fix MODULE_ALIAS RDMA/cxgb4: Set queue pair state when being queried ASoC: fsl_asrc: refine the check of available clock divider clk: bm1880: remove kfrees on static allocations of: base: Fix phandle argument length mismatch error message ARM: dts: omap3-n900: Fix lp5523 for multi color Bluetooth: Fix debugfs entry leak in hci_register_dev() fs: dlm: filter user dlm messages for kernel locks drm/lima: fix warning when CONFIG_DEBUG_SG=y & CONFIG_DMA_API_DEBUG=y selftests/bpf: Fix bpf_object leak in skb_ctx selftest ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply drm/bridge: dw-hdmi: handle ELD when DRM_BRIDGE_ATTACH_NO_CONNECTOR drm/nouveau/pmu/gm200-: avoid touching PMU outside of DEVINIT/PREOS/ACR media: atomisp: fix try_fmt logic media: atomisp: set per-device's default mode media: atomisp-ov2680: Fix ov2680_set_fmt() clobbering the exposure ARM: shmobile: rcar-gen2: Add missing of_node_put() batman-adv: allow netlink usage in unprivileged containers media: atomisp: handle errors at sh_css_create_isp_params() ath11k: Fix crash caused by uninitialized TX ring usb: gadget: f_fs: Use stream_open() for endpoint files drm: panel-orientation-quirks: Add quirk for the Lenovo Yoga Book X91F/L HID: apple: Do not reset quirks when the Fn key is not found media: b2c2: Add missing check in flexcop_pci_isr: EDAC/synopsys: Use the quirk for version instead of ddr version ARM: imx: rename DEBUG_IMX21_IMX27_UART to DEBUG_IMX27_UART drm/amd/display: check top_pipe_to_program pointer drm/amdgpu/display: set vblank_disable_immediate for DC soc: ti: pruss: fix referenced node in error message mlxsw: pci: Add shutdown method in PCI driver drm/bridge: megachips: Ensure both bridges are probed before registration tty: serial: imx: disable UCR4_OREN in .stop_rx() instead of .shutdown() gpiolib: acpi: Do not set the IRQ type if the IRQ is already in use HSI: core: Fix return freed object in hsi_new_client crypto: jitter - consider 32 LSB for APT mwifiex: Fix skb_over_panic in mwifiex_usb_recv() rsi: Fix use-after-free in rsi_rx_done_handler() rsi: Fix out-of-bounds read in rsi_read_pkt() ath11k: Avoid NULL ptr access during mgmt tx cleanup media: venus: avoid calling core_clk_setrate() concurrently during concurrent video sessions ACPI / x86: Drop PWM2 device on Lenovo Yoga Book from always present table ACPI: Change acpi_device_always_present() into acpi_device_override_status() ACPI / x86: Allow specifying acpi_device_override_status() quirks by path ACPI / x86: Add not-present quirk for the PCI0.SDHB.BRC1 device on the GPD win arm64: dts: ti: j7200-main: Fix 'dtbs_check' serdes_ln_ctrl node usb: uhci: add aspeed ast2600 uhci support floppy: Add max size check for user space request x86/mm: Flush global TLB when switching to trampoline page-table drm: rcar-du: Fix CRTC timings when CMM is used media: uvcvideo: Increase UVC_CTRL_CONTROL_TIMEOUT to 5 seconds. media: rcar-vin: Update format alignment constraints media: saa7146: hexium_orion: Fix a NULL pointer dereference in hexium_attach() media: m920x: don't use stack on USB reads thunderbolt: Runtime PM activate both ends of the device link iwlwifi: mvm: synchronize with FW after multicast commands iwlwifi: mvm: avoid clearing a just saved session protection id ath11k: avoid deadlock by change ieee80211_queue_work for regd_update_work ath10k: Fix tx hanging net-sysfs: update the queue counts in the unregistration path net: phy: prefer 1000baseT over 1000baseKX gpio: aspeed: Convert aspeed_gpio.lock to raw_spinlock selftests/ftrace: make kprobe profile testcase description unique ath11k: Avoid false DEADLOCK warning reported by lockdep x86/mce: Allow instrumentation during task work queueing x86/mce: Mark mce_panic() noinstr x86/mce: Mark mce_end() noinstr x86/mce: Mark mce_read_aux() noinstr net: bonding: debug: avoid printing debug logs when bond is not notifying peers bpf: Do not WARN in bpf_warn_invalid_xdp_action() HID: quirks: Allow inverting the absolute X/Y values media: igorplugusb: receiver overflow should be reported media: saa7146: hexium_gemini: Fix a NULL pointer dereference in hexium_attach() mmc: core: Fixup storing of OCR for MMC_QUIRK_NONSTD_SDIO audit: ensure userspace is penalized the same as the kernel when under pressure arm64: dts: ls1028a-qds: move rtc node to the correct i2c bus arm64: tegra: Adjust length of CCPLEX cluster MMIO region PM: runtime: Add safety net to supplier device release cpufreq: Fix initialization of min and max frequency QoS requests usb: hub: Add delay for SuperSpeed hub resume to let links transit to U0 ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream rtw88: 8822c: update rx settings to prevent potential hw deadlock PM: AVS: qcom-cpr: Use div64_ul instead of do_div iwlwifi: fix leaks/bad data after failed firmware load iwlwifi: remove module loading failure message iwlwifi: mvm: Fix calculation of frame length iwlwifi: pcie: make sure prph_info is set when treating wakeup IRQ um: registers: Rename function names to avoid conflicts and build problems ath11k: Fix napi related hang Bluetooth: vhci: Set HCI_QUIRK_VALID_LE_STATES xfrm: rate limit SA mapping change message to user space drm/etnaviv: consider completed fence seqno in hang check jffs2: GC deadlock reading a page that is used in jffs2_write_begin() ACPICA: actypes.h: Expand the ACPI_ACCESS_ definitions ACPICA: Utilities: Avoid deleting the same object twice in a row ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R() ACPICA: Fix wrong interpretation of PCC address ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5 drm/amdgpu: fixup bad vram size on gmc v8 amdgpu/pm: Make sysfs pm attributes as read-only for VFs ACPI: battery: Add the ThinkPad "Not Charging" quirk btrfs: remove BUG_ON() in find_parent_nodes() btrfs: remove BUG_ON(!eie) in find_parent_nodes net: mdio: Demote probed message to debug print mac80211: allow non-standard VHT MCS-10/11 dm btree: add a defensive bounds check to insert_at() dm space map common: add bounds check to sm_ll_lookup_bitmap() mlxsw: pci: Avoid flow control for EMAD packets net: phy: marvell: configure RGMII delays for 88E1118 net: gemini: allow any RGMII interface mode regulator: qcom_smd: Align probe function with rpmh-regulator serial: pl010: Drop CR register reset on set_termios serial: core: Keep mctrl register state and cached copy in sync random: do not throw away excess input to crng_fast_load parisc: Avoid calling faulthandler_disabled() twice x86/kbuild: Enable CONFIG_KALLSYMS_ALL=y in the defconfigs powerpc/6xx: add missing of_node_put powerpc/powernv: add missing of_node_put powerpc/cell: add missing of_node_put powerpc/btext: add missing of_node_put powerpc/watchdog: Fix missed watchdog reset due to memory ordering race i2c: i801: Don't silently correct invalid transfer size powerpc/smp: Move setup_profiling_timer() under CONFIG_PROFILING i2c: mpc: Correct I2C reset procedure clk: meson: gxbb: Fix the SDM_EN bit for MPLL0 on GXBB powerpc/powermac: Add missing lockdep_register_key() KVM: PPC: Book3S: Suppress warnings when allocating too big memory slots KVM: PPC: Book3S: Suppress failed alloc warning in H_COPY_TOFROM_GUEST w1: Misuse of get_user()/put_user() reported by sparse nvmem: core: set size for sysfs bin file dm: fix alloc_dax error handling in alloc_dev scsi: lpfc: Trigger SLI4 firmware dump before doing driver cleanup ALSA: seq: Set upper limit of processed events MIPS: Loongson64: Use three arguments for slti powerpc/40x: Map 32Mbytes of memory at startup selftests/powerpc/spectre_v2: Return skip code when miss_percent is high powerpc: handle kdump appropriately with crash_kexec_post_notifiers option powerpc/fadump: Fix inaccurate CPU state info in vmcore generated with panic udf: Fix error handling in udf_new_inode() MIPS: OCTEON: add put_device() after of_find_device_by_node() irqchip/gic-v4: Disable redistributors' view of the VPE table at boot time i2c: designware-pci: Fix to change data types of hcnt and lcnt parameters MIPS: Octeon: Fix build errors using clang scsi: sr: Don't use GFP_DMA ASoC: mediatek: mt8173: fix device_node leak ASoC: mediatek: mt8183: fix device_node leak phy: mediatek: Fix missing check in mtk_mipi_tx_probe rpmsg: core: Clean up resources on announce_create failure. crypto: omap-aes - Fix broken pm_runtime_and_get() usage crypto: stm32/crc32 - Fix kernel BUG triggered in probe() crypto: caam - replace this_cpu_ptr with raw_cpu_ptr ubifs: Error path in ubifs_remount_rw() seems to wrongly free write buffers tpm: fix NPE on probe for missing device spi: uniphier: Fix a bug that doesn't point to private data correctly xen/gntdev: fix unmap notification order fuse: Pass correct lend value to filemap_write_and_wait_range() serial: Fix incorrect rs485 polarity on uart open cputime, cpuacct: Include guest time in user time in cpuacct.stat tracing/kprobes: 'nmissed' not showed correctly for kretprobe iwlwifi: mvm: Increase the scan timeout guard to 30 seconds s390/mm: fix 2KB pgtable release race device property: Fix fwnode_graph_devcon_match() fwnode leak drm/etnaviv: limit submit sizes drm/nouveau/kms/nv04: use vzalloc for nv04_display drm/bridge: analogix_dp: Make PSR-exit block less parisc: Fix lpa and lpa_user defines powerpc/64s/radix: Fix huge vmap false positive PCI: xgene: Fix IB window setup PCI: pciehp: Use down_read/write_nested(reset_lock) to fix lockdep errors PCI: pci-bridge-emul: Make expansion ROM Base Address register read-only PCI: pci-bridge-emul: Properly mark reserved PCIe bits in PCI config space PCI: pci-bridge-emul: Fix definitions of reserved bits PCI: pci-bridge-emul: Correctly set PCIe capabilities PCI: pci-bridge-emul: Set PCI_STATUS_CAP_LIST for PCIe device xfrm: fix policy lookup for ipv6 gre packets btrfs: fix deadlock between quota enable and other quota operations btrfs: check the root node for uptodate before returning it btrfs: respect the max size in the header when activating swap file ext4: make sure to reset inode lockdep class when quota enabling fails ext4: make sure quota gets properly shutdown on error ext4: fix a possible ABBA deadlock due to busy PA ext4: initialize err_blk before calling __ext4_get_inode_loc ext4: fix fast commit may miss tracking range for FALLOC_FL_ZERO_RANGE ext4: set csum seed in tmp inode while migrating to extents ext4: Fix BUG_ON in ext4_bread when write quota data ext4: use ext4_ext_remove_space() for fast commit replay delete range ext4: fast commit may miss tracking unwritten range during ftruncate ext4: destroy ext4_fc_dentry_cachep kmemcache on module removal ext4: fix null-ptr-deref in '__ext4_journal_ensure_credits' ext4: don't use the orphan list when migrating an inode drm/radeon: fix error handling in radeon_driver_open_kms of: base: Improve argument length mismatch error firmware: Update Kconfig help text for Google firmware can: mcp251xfd: mcp251xfd_tef_obj_read(): fix typo in error message media: rcar-csi2: Optimize the selection PHTW register drm/vc4: hdmi: Make sure the device is powered with CEC media: correct MEDIA_TEST_SUPPORT help text Documentation: dmaengine: Correctly describe dmatest with channel unset Documentation: ACPI: Fix data node reference documentation Documentation: refer to config RANDOMIZE_BASE for kernel address-space randomization Documentation: fix firewire.rst ABI file path error Bluetooth: hci_sync: Fix not setting adv set duration scsi: core: Show SCMD_LAST in text form dmaengine: uniphier-xdmac: Fix type of address variables RDMA/hns: Modify the mapping attribute of doorbell to device RDMA/rxe: Fix a typo in opcode name dmaengine: stm32-mdma: fix STM32_MDMA_CTBR_TSEL_MASK Revert "net/mlx5: Add retry mechanism to the command entry index allocation" powerpc/cell: Fix clang -Wimplicit-fallthrough warning powerpc/fsl/dts: Enable WA for erratum A-009885 on fman3l MDIO buses block: Fix fsync always failed if once failed bpftool: Remove inclusion of utilities.mak from Makefiles xdp: check prog type before updating BPF link perf evsel: Override attr->sample_period for non-libpfm4 events ipv4: update fib_info_cnt under spinlock protection ipv4: avoid quadratic behavior in netns dismantle net/fsl: xgmac_mdio: Add workaround for erratum A-009885 net/fsl: xgmac_mdio: Fix incorrect iounmap when removing module parisc: pdc_stable: Fix memory leak in pdcs_register_pathentries f2fs: compress: fix potential deadlock of compress file f2fs: fix to reserve space for IO align feature af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress clk: Emit a stern warning with writable debugfs enabled clk: si5341: Fix clock HW provider cleanup net/smc: Fix hung_task when removing SMC-R devices net: axienet: increase reset timeout net: axienet: Wait for PhyRstCmplt after core reset net: axienet: reset core on initialization prior to MDIO access net: axienet: add missing memory barriers net: axienet: limit minimum TX ring size net: axienet: Fix TX ring slot available check net: axienet: fix number of TX ring slots for available check net: axienet: fix for TX busy handling net: axienet: increase default TX ring size to 128 HID: vivaldi: fix handling devices not using numbered reports rtc: pxa: fix null pointer dereference vdpa/mlx5: Fix wrong configuration of virtio_version_1_0 virtio_ring: mark ring unused on error taskstats: Cleanup the use of task->exit_code inet: frags: annotate races around fqdir->dead and fqdir->high_thresh netns: add schedule point in ops_exit_list() xfrm: Don't accidentally set RTO_ONLINK in decode_session4() gre: Don't accidentally set RTO_ONLINK in gre_fill_metadata_dst() libcxgb: Don't accidentally set RTO_ONLINK in cxgb_find_route() perf script: Fix hex dump character output dmaengine: at_xdmac: Don't start transactions at tx_submit level dmaengine: at_xdmac: Start transfer for cyclic channels in issue_pending dmaengine: at_xdmac: Print debug message after realeasing the lock dmaengine: at_xdmac: Fix concurrency over xfers_list dmaengine: at_xdmac: Fix lld view setting dmaengine: at_xdmac: Fix at_xdmac_lld struct definition perf probe: Fix ppc64 'perf probe add events failed' case devlink: Remove misleading internal_flags from health reporter dump arm64: dts: qcom: msm8996: drop not documented adreno properties net: bonding: fix bond_xmit_broadcast return value error bug net_sched: restore "mpu xxx" handling bcmgenet: add WOL IRQ check net: ethernet: mtk_eth_soc: fix error checking in mtk_mac_config() net: sfp: fix high power modules without diagnostic monitoring net: mscc: ocelot: fix using match before it is set dt-bindings: display: meson-dw-hdmi: add missing sound-name-prefix property dt-bindings: display: meson-vpu: Add missing amlogic,canvas property dt-bindings: watchdog: Require samsung,syscon-phandle for Exynos7 scripts/dtc: dtx_diff: remove broken example from help text lib82596: Fix IRQ check in sni_82596_probe mm/hmm.c: allow VM_MIXEDMAP to work with hmm_range_fault lib/test_meminit: destroy cache in kmem_cache_alloc_bulk() test mtd: nand: bbt: Fix corner case in bad block table handling ath10k: Fix the MTU size on QCA9377 SDIO scripts: sphinx-pre-install: add required ctex dependency scripts: sphinx-pre-install: Fix ctex support on Debian Linux 5.10.94 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I857f2417c899508815a1ba13d1285fd400a1f133	2022-01-27 11:49:22 +01:00
Dmitry Torokhov	8b8ff4c793	HID: vivaldi: fix handling devices not using numbered reports ... commit 3fe6acd4dc upstream. Unfortunately details of USB HID transport bled into HID core and handling of numbered/unnumbered reports is quite a mess, with hid_report_len() calculating the length according to USB rules, and hid_hw_raw_request() adding report ID to the buffer for both numbered and unnumbered reports. Untangling it all requres a lot of changes in HID, so for now let's handle this in the driver. [jkosina@suse.cz: microoptimize field->report->id to report->id] Fixes: 14c9c014ba ("HID: add vivaldi HID driver") Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Tested-by: Stephen Boyd <swboyd@chromium.org> # CoachZ Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-01-27 10:54:33 +01:00
Alistair Francis	d698e024be	HID: quirks: Allow inverting the absolute X/Y values ... [ Upstream commit fd8d135b2c ] Add a HID_QUIRK_X_INVERT/HID_QUIRK_Y_INVERT quirk that can be used to invert the X/Y values. Signed-off-by: Alistair Francis <alistair@alistair23.me> [bentiss: silence checkpatch warning] Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Link: https://lore.kernel.org/r/20211208124045.61815-2-alistair@alistair23.me Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-01-27 10:54:16 +01:00
José Expósito	c978d39a8b	HID: apple: Do not reset quirks when the Fn key is not found ... [ Upstream commit a5fe7864d8 ] When a keyboard without a function key is detected, instead of removing all quirks, remove only the APPLE_HAS_FN quirk. Signed-off-by: José Expósito <jose.exposito89@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-01-27 10:54:11 +01:00
José Expósito	b9b5da3e18	HID: hid-uclogic-params: Invalid parameter check in uclogic_params_frame_init_v1_buttonpad ... [ Upstream commit aa320fdbbb ] The function performs a check on the hdev input parameters, however, it is used before the check. Initialize the udev variable after the sanity check to avoid a possible NULL pointer dereference. Fixes: 9614219e93 ("HID: uclogic: Extract tablet parameter discovery into a module") Addresses-Coverity-ID: 1443763 ("Null pointer dereference") Signed-off-by: José Expósito <jose.exposito89@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-01-27 10:54:02 +01:00
José Expósito	541c3a044b	HID: hid-uclogic-params: Invalid parameter check in uclogic_params_huion_init ... [ Upstream commit ff6b548afe ] The function performs a check on its input parameters, however, the hdev parameter is used before the check. Initialize the stack variables after checking the input parameters to avoid a possible NULL pointer dereference. Fixes: 9614219e93 ("HID: uclogic: Extract tablet parameter discovery into a module") Addresses-Coverity-ID: 1443804 ("Null pointer dereference") Signed-off-by: José Expósito <jose.exposito89@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-01-27 10:54:02 +01:00
José Expósito	c47f842e0c	HID: hid-uclogic-params: Invalid parameter check in uclogic_params_get_str_desc ... [ Upstream commit 0a94131d69 ] The function performs a check on the hdev input parameters, however, it is used before the check. Initialize the udev variable after the sanity check to avoid a possible NULL pointer dereference. Fixes: 9614219e93 ("HID: uclogic: Extract tablet parameter discovery into a module") Addresses-Coverity-ID: 1443827 ("Null pointer dereference") Signed-off-by: José Expósito <jose.exposito89@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-01-27 10:54:02 +01:00
José Expósito	cf5ad827ee	HID: hid-uclogic-params: Invalid parameter check in uclogic_params_init ... [ Upstream commit f364c571a5 ] The function performs a check on its input parameters, however, the hdev parameter is used before the check. Initialize the stack variables after checking the input parameters to avoid a possible NULL pointer dereference. Fixes: 9614219e93 ("HID: uclogic: Extract tablet parameter discovery into a module") Addresses-Coverity-ID: 1443831 ("Null pointer dereference") Signed-off-by: José Expósito <jose.exposito89@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-01-27 10:54:01 +01:00
Jason Gerecke	57cfc965e3	HID: wacom: Avoid using stale array indicies to read contact count ... commit 20f3cf5f86 upstream. If we ever see a touch report with contact count data we initialize several variables used to read the contact count in the pre-report phase. These variables are never reset if we process a report which doesn't contain a contact count, however. This can cause the pre- report function to trigger a read of arbitrary memory (e.g. NULL if we're lucky) and potentially crash the driver. This commit restores resetting of the variables back to default "none" values that were used prior to the commit mentioned below. Link: https://github.com/linuxwacom/input-wacom/issues/276 Fixes: 003f50ab67 (HID: wacom: Update last_slot_field during pre_report phase) CC: stable@vger.kernel.org Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com> Reviewed-by: Ping Cheng <ping.cheng@wacom.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-01-27 10:53:40 +01:00
Jason Gerecke	7fd22c99bb	HID: wacom: Ignore the confidence flag when a touch is removed ... commit df03e9bd6d upstream. AES hardware may internally re-classify a contact that it thought was intentional as a palm. Intentional contacts are reported as "down" with the confidence bit set. When this re-classification occurs, however, the state transitions to "up" with the confidence bit cleared. This kind of transition appears to be legal according to Microsoft docs, but we do not handle it correctly. Because the confidence bit is clear, we don't call `wacom_wac_finger_slot` and update userspace. This causes hung touches that confuse userspace and interfere with pen arbitration. This commit adds a special case to ignore the confidence flag if a contact is reported as removed. This ensures we do not leave a hung touch if one of these re-classification events occured. Ideally we'd have some way to also let userspace know that the touch has been re-classified as a palm and needs to be canceled, but that's not possible right now :) Link: https://github.com/linuxwacom/input-wacom/issues/288 Fixes: 7fb0413baa (HID: wacom: Use "Confidence" flag to prevent reporting invalid contacts) CC: stable@vger.kernel.org Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com> Reviewed-by: Ping Cheng <ping.cheng@wacom.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-01-27 10:53:40 +01:00
Jason Gerecke	9a4800e0f6	HID: wacom: Reset expected and received contact counts at the same time ... commit 546e41ac99 upstream. These two values go hand-in-hand and must be valid for the driver to behave correctly. We are currently lazy about updating the values and rely on the "expected" code flow to take care of making sure they're valid at the point they're needed. The "expected" flow changed somewhat with commit f8b6a74719 ("HID: wacom: generic: Support multiple tools per report"), however. This led to problems with the DTH-2452 due (in part) to *all* contacts being fully processed -- even those past the expected contact count. Specifically, the received count gets reset to 0 once all expected fingers are processed, but not the expected count. The rest of the contacts in the report are then *also* processed since now the driver thinks we've only processed 0 of N expected contacts. Later commits such as 7fb0413baa (HID: wacom: Use "Confidence" flag to prevent reporting invalid contacts) worked around the DTH-2452 issue by skipping the invalid contacts at the end of the report, but this is not a complete fix. The confidence flag cannot be relied on when a contact is removed (see the following patch), and dealing with that condition re-introduces the DTH-2452 issue unless we also address this contact count laziness. By resetting expected and received counts at the same time we ensure the driver understands that there are 0 more contacts expected in the report. Similarly, we also make sure to reset the received count if for some reason we're out of sync in the pre-report phase. Link: https://github.com/linuxwacom/input-wacom/issues/288 Fixes: f8b6a74719 ("HID: wacom: generic: Support multiple tools per report") CC: stable@vger.kernel.org Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com> Reviewed-by: Ping Cheng <ping.cheng@wacom.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-01-27 10:53:40 +01:00
Jann Horn	c2e39d5df0	HID: uhid: Fix worker destroying device without any protection ... commit 4ea5763fb7 upstream. uhid has to run hid_add_device() from workqueue context while allowing parallel use of the userspace API (which is protected with ->devlock). But hid_add_device() can fail. Currently, that is handled by immediately destroying the associated HID device, without using ->devlock - but if there are concurrent requests from userspace, that's wrong and leads to NULL dereferences and/or memory corruption (via use-after-free). Fix it by leaving the HID device as-is in the worker. We can clean it up later, either in the UHID_DESTROY command handler or in the ->release() handler. Cc: stable@vger.kernel.org Fixes: 67f8ecc550 ("HID: uhid: fix timeout when probe races with IO") Signed-off-by: Jann Horn <jannh@google.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-01-27 10:53:40 +01:00
Greg Kroah-Hartman	9b28b48fb3	This is the 5.10.89 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmHMRdcACgkQONu9yGCS aT5RlhAAnYAuRi8dGsYUh9jabBfNmquYbr8rV3LM5fNBJBa+JqkGvOlplZ+EmB+O 4xaUY4VfV6R/X/jf4NX5G+2w5EOAzf9h2pGSuBPYL4cpJ4N9n3nlYqktfMP9joHS r6+UJHE0g2CK2hUnDruXSRfiiswyjKuKMgRlVLTctpt/rW3GijwfhmBZhEbSjhZV ALav77ngzjMGic6UtwceJCQIfOnqK0GvkPfD9EWtVWdhMMxoJisNncda2iX/86os PpzyD16QtQK5jIT9vAZof4cavxy2uQcd/n15gejZvfOa0AZ/pop9lVPRfqZqqHJd /bKWzDUi5tUmEAZmUD1s88EnsodR39kVX901oVi0WQ9tMgqatck6zrZSrjjBnAdu khnxQITTM8DqPodQwzFwbK4i5VkRy8xJ+eoJQBSxlvhN/7wy4TTqN3Y2D6/Hkowk 7zkcAUscdHHw+ANZZxB8A/y1Z+ekOIj81OrIUWY3Omfd1hrsoW467KXewrIU4+CH p0OrGSRTcHih69e3QUoFXisnY+czg4vAdZH+5MDnEmDr18vznUP0f9NyF9ucYOr8 wmVWkX9Cut9ZH4Ev3l0QGsgDg7QSrrXvKFtlxKURJbwT93bsVA0pFr/NMa0Aejlp 7xZ+KiBDXt1lNlyI2Dt9VD247HknhTK5zcsqx8Q9UiyrQfD/N7g= =GbaX -----END PGP SIGNATURE----- Merge 5.10.89 into android12-5.10-lts Changes in 5.10.89 arm64: vdso32: drop -no-integrated-as flag arm64: vdso32: require CROSS_COMPILE_COMPAT for gcc+bfd net: usb: lan78xx: add Allied Telesis AT29M2-AF ext4: prevent partial update of the extent blocks ext4: check for out-of-order index extents in ext4_valid_extent_entries() ext4: check for inconsistent extents between index and leaf block HID: holtek: fix mouse probing HID: potential dereference of null pointer arm64: dts: allwinner: orangepi-zero-plus: fix PHY mode spi: change clk_disable_unprepare to clk_unprepare ASoC: meson: aiu: fifo: Add missing dma_coerce_mask_and_coherent() IB/qib: Fix memory leak in qib_user_sdma_queue_pkts() RDMA/hns: Replace kfree() with kvfree() netfilter: fix regression in looped (broad|multi)cast's MAC handling ARM: dts: imx6qdl-wandboard: Fix Ethernet support net: marvell: prestera: fix incorrect return of port_find qlcnic: potential dereference null pointer of rx_queue->page_ring net: accept UFOv6 packages in virtio_net_hdr_to_skb net: skip virtio_net_hdr_set_proto if protocol already set igb: fix deadlock caused by taking RTNL in RPM resume path ipmi: Fix UAF when uninstall ipmi_si and ipmi_msghandler module bonding: fix ad_actor_system option setting to default fjes: Check for error irq drivers: net: smc911x: Check for error irq net: ks8851: Check for error irq sfc: Check null pointer of rx_queue->page_ring sfc: falcon: Check null pointer of rx_queue->page_ring Input: elantech - fix stack out of bound access in elantech_change_report_id() pinctrl: bcm2835: Change init order for gpio hogs hwmon: (lm90) Fix usage of CONFIG2 register in detect function hwmon: (lm90) Add basic support for TI TMP461 hwmon: (lm90) Introduce flag indicating extended temperature support hwmon: (lm90) Drop critical attribute support for MAX6654 ALSA: jack: Check the return value of kstrdup() ALSA: drivers: opl3: Fix incorrect use of vp->state ALSA: hda/realtek: Amp init fixup for HP ZBook 15 G6 ALSA: hda/realtek: Add new alc285-hp-amp-init model ALSA: hda/realtek: Fix quirk for Clevo NJ51CU ASoC: meson: aiu: Move AIU_I2S_MISC hold setting to aiu-fifo-i2s Input: atmel_mxt_ts - fix double free in mxt_read_info_block ipmi: bail out if init_srcu_struct fails ipmi: ssif: initialize ssif_info->client early ipmi: fix initialization when workqueue allocation fails parisc: Correct completer in lws start parisc: Fix mask used to select futex spinlock tee: handle lookup of shm with reference count 0 x86/pkey: Fix undefined behaviour with PKRU_WD_BIT platform/x86: intel_pmc_core: fix memleak on registration failure KVM: VMX: Wake vCPU when delivering posted IRQ even if vCPU == this vCPU pinctrl: stm32: consider the GPIO offset to expose all the GPIO lines gpio: dln2: Fix interrupts when replugging the device mmc: sdhci-tegra: Fix switch to HS400ES mode mmc: meson-mx-sdhc: Set MANUAL_STOP for multi-block SDIO commands mmc: core: Disable card detect during shutdown mmc: mmci: stm32: clear DLYB_CR after sending tuning command ARM: 9169/1: entry: fix Thumb2 bug in iWMMXt exception handling mac80211: fix locking in ieee80211_start_ap error path mm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any_page() tee: optee: Fix incorrect page free bug f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr() ceph: fix up non-directory creation in SGID directories usb: gadget: u_ether: fix race in setting MAC address in setup phase KVM: VMX: Fix stale docs for kvm-intel.emulate_invalid_guest_state mm: mempolicy: fix THP allocations escaping mempolicy restrictions Input: elants_i2c - do not check Remark ID on eKTH3900/eKTH5312 Input: goodix - add id->model mapping for the "9111" model ASoC: tas2770: Fix setting of high sample rates ASoC: rt5682: fix the wrong jack type detected pinctrl: mediatek: fix global-out-of-bounds issue hwmom: (lm90) Fix citical alarm status for MAX6680/MAX6681 hwmon: (lm90) Do not report 'busy' status bit as alarm ax25: NPD bug when detaching AX25 device hamradio: defer ax25 kfree after unregister_netdev hamradio: improve the incomplete fix to avoid NPD phonet/pep: refuse to enable an unbound pipe Linux 5.10.89 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ia55f14e15b207944d78ec600ad4c4c7a79760e56	2021-12-29 14:17:18 +01:00
Jiasheng Jiang	ef2dce4325	HID: potential dereference of null pointer ... commit 13251ce1dd upstream. The return value of devm_kzalloc() needs to be checked. To avoid hdev->dev->driver_data to be null in case of the failure of alloc. Fixes: 14c9c014ba ("HID: add vivaldi HID driver") Cc: stable@vger.kernel.org Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Link: https://lore.kernel.org/r/20211215083605.117638-1-jiasheng@iscas.ac.cn Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-12-29 12:25:54 +01:00
Benjamin Tissoires	3110bc5862	HID: holtek: fix mouse probing ... commit 93a2207c25 upstream. An overlook from the previous commit: we don't even parse or start the device, meaning that the device is not presented to user space. Fixes: 93020953d0 ("HID: check for valid USB device for many HID drivers") Cc: stable@vger.kernel.org Link: https://bugs.archlinux.org/task/73048 Link: https://bugzilla.kernel.org/show_bug.cgi?id=215341 Link: https://lore.kernel.org/r/e4efbf13-bd8d-0370-629b-6c80c0044b15@leemhuis.info/ Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-12-29 12:25:54 +01:00
Greg Kroah-Hartman	afc997898e	This is the 5.10.85 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmG4cugACgkQONu9yGCS aT4+uxAAiLJvOIA6ElsmMq2c3pNu9UDPh58j1FlmhggAxr7baIvR1UuEZURTSLW9 pnu+r9bHkhJGBOpANfPJAQZqv+JtCi3crMhw0mwHJ0Mls3TNSmclzB1+jGM4w93E cT+5hoDeQqwZwpKYvWI7u9UGEE0BXluVTRCvmuncaJ8wGbxnDgV0AEXe32XDlFxB kSLAXO1FFn8Z1yMg9BMVURU9IAszdwCIhqbcNWnPunOPowdHDWBJdF7eSZUqmJfq TMyFgm6c6ENbBrwYt+9qf+1oS/D9r6TEjwaFoRJ4ApWSAD4iKV7U6dA0rxm9mrMl nSAxNXuSXXYszoYjrxPPRGhCY/URahs1Vmju1WK//4vz3brxk5N88T+2nN7PMYKn bIHGTl9SadlrHvi/OBqOvbsNMHX+ln/V/y7ct0fsxXeNBHYXdXCtimRDvtsj9kmp HO9OLXVsF6DUM22ODW28Vxt7HGN3XQzs0y2jwfzdMV81p3oEqP9wWQITwG2LVVAE WdkvQ/3ugdkR9F15Vp0cjkbJQLN4UbYUJW5K7SZTW013TgsYyIHQrP5qj9xvfwNt KdILXVMH2JqPXAkRqmFqIeNIUX2oevWwpgV/SwqIj3T5ytmXPluZsaMlGg5xZ401 Xuhp0LPU6rl+wcCt1bInZvn8nrTVDADpao7xTbSyoel5TAunVrk= =u1Am -----END PGP SIGNATURE----- Merge 5.10.85 into android12-5.10-lts Changes in 5.10.85 usb: gadget: uvc: fix multiple opens gcc-plugins: simplify GCC plugin-dev capability test gcc-plugins: fix gcc 11 indigestion with plugins... HID: quirks: Add quirk for the Microsoft Surface 3 type-cover HID: google: add eel USB id HID: add hid_is_usb() function to make it simpler for USB detection HID: add USB_HID dependancy to hid-prodikeys HID: add USB_HID dependancy to hid-chicony HID: add USB_HID dependancy on some USB HID drivers HID: bigbenff: prevent null pointer dereference HID: wacom: fix problems when device is not a valid USB device HID: check for valid USB device for many HID drivers nft_set_pipapo: Fix bucket load in AVX2 lookup routine for six 8-bit groups IB/hfi1: Insure use of smp_processor_id() is preempt disabled IB/hfi1: Fix early init panic IB/hfi1: Fix leak of rcvhdrtail_dummy_kvaddr can: kvaser_usb: get CAN clock frequency from device can: kvaser_pciefd: kvaser_pciefd_rx_error_frame(): increase correct stats->{rx,tx}_errors counter can: sja1000: fix use after free in ems_pcmcia_add_card() x86/sme: Explicitly map new EFI memmap table as encrypted drm/amd/amdkfd: adjust dummy functions' placement drm/amdkfd: separate kfd_iommu_resume from kfd_resume drm/amdgpu: add amdgpu_amdkfd_resume_iommu drm/amdgpu: move iommu_resume before ip init/resume drm/amdgpu: init iommu after amdkfd device init drm/amdkfd: fix boot failure when iommu is disabled in Picasso. nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done selftests: netfilter: add a vrf+conntrack testcase vrf: don't run conntrack on vrf with !dflt qdisc bpf, x86: Fix "no previous prototype" warning bpf: Fix the off-by-two error in range markings ice: ignore dropped packets during init bonding: make tx_rebalance_counter an atomic nfp: Fix memory leak in nfp_cpp_area_cache_add() seg6: fix the iif in the IPv6 socket control block udp: using datalen to cap max gso segments netfilter: conntrack: annotate data-races around ct->timeout iavf: restore MSI state on reset iavf: Fix reporting when setting descriptor count IB/hfi1: Correct guard on eager buffer deallocation devlink: fix netns refcount leak in devlink_nl_cmd_reload() net/sched: fq_pie: prevent dismantle issue KVM: x86: Wait for IPIs to be delivered when handling Hyper-V TLB flush hypercall mm: bdi: initialize bdi_min_ratio when bdi is unregistered ALSA: ctl: Fix copy of updated id with element read/write ALSA: hda/realtek - Add headset Mic support for Lenovo ALC897 platform ALSA: hda/realtek: Fix quirk for TongFang PHxTxX1 ALSA: pcm: oss: Fix negative period/buffer sizes ALSA: pcm: oss: Limit the period size to 16MB ALSA: pcm: oss: Handle missing errors in snd_pcm_oss_change_params*() scsi: qla2xxx: Format log strings only if needed btrfs: clear extent buffer uptodate when we fail to write it btrfs: replace the BUG_ON in btrfs_del_root_ref with proper error handling md: fix update super 1.0 on rdev size change nfsd: fix use-after-free due to delegation race nfsd: Fix nsfd startup race (again) tracefs: Have new files inherit the ownership of their parent mmc: renesas_sdhi: initialize variable properly when tuning clk: qcom: regmap-mux: fix parent clock lookup drm/syncobj: Deal with signalled fences in drm_syncobj_find_fence. can: pch_can: pch_can_rx_normal: fix use after free can: m_can: Disable and ignore ELO interrupt libata: add horkage for ASMedia 1092 wait: add wake_up_pollfree() binder: use wake_up_pollfree() signalfd: use wake_up_pollfree() aio: keep poll requests on waitqueue until completed aio: fix use-after-free due to missing POLLFREE handling net: mvpp2: fix XDP rx queues registering tracefs: Set all files to the same group ownership as the mount option block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2) scsi: pm80xx: Do not call scsi_remove_host() in pm8001_alloc() scsi: scsi_debug: Fix buffer size of REPORT ZONES command qede: validate non LSO skb length PM: runtime: Fix pm_runtime_active() kerneldoc comment ASoC: rt5682: Fix crash due to out of scope stack vars ASoC: qdsp6: q6routing: Fix return value from msm_routing_put_audio_mixer ASoC: codecs: wsa881x: fix return values from kcontrol put ASoC: codecs: wcd934x: handle channel mappping list correctly ASoC: codecs: wcd934x: return correct value from mixer put RDMA/hns: Do not halt commands during reset until later RDMA/hns: Do not destroy QP resources in the hw resetting phase clk: imx: use module_platform_driver i40e: Fix failed opcode appearing if handling messages from VF i40e: Fix pre-set max number of queues for VF mtd: rawnand: fsmc: Take instruction delay into account mtd: rawnand: fsmc: Fix timing computation i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc Revert "PCI: aardvark: Fix support for PCI_ROM_ADDRESS1 on emulated bridge" perf tools: Fix SMT detection fast read path Documentation/locking/locktypes: Update migrate_disable() bits. dt-bindings: net: Reintroduce PHY no lane swap binding tools build: Remove needless libpython-version feature check that breaks test-all fast path net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero net: altera: set a couple error code in probe() net: fec: only clear interrupt of handling queue in fec_enet_rx_queue() net, neigh: clear whole pneigh_entry at alloc time net/qla3xxx: fix an error code in ql_adapter_up() selftests/fib_tests: Rework fib_rp_filter_test() USB: gadget: detect too-big endpoint 0 requests USB: gadget: zero allocate endpoint 0 buffers usb: core: config: fix validation of wMaxPacketValue entries xhci: Remove CONFIG_USB_DEFAULT_PERSIST to prevent xHCI from runtime suspending usb: core: config: using bit mask instead of individual bits xhci: avoid race between disable slot command and host runtime suspend iio: gyro: adxrs290: fix data signedness iio: trigger: Fix reference counting iio: trigger: stm32-timer: fix MODULE_ALIAS iio: stk3310: Don't return error code in interrupt handler iio: mma8452: Fix trigger reference couting iio: ltr501: Don't return error code in trigger handler iio: kxsd9: Don't return error code in trigger handler iio: itg3200: Call iio_trigger_notify_done() on error iio: dln2-adc: Fix lockdep complaint iio: dln2: Check return value of devm_iio_trigger_register() iio: at91-sama5d2: Fix incorrect sign extension iio: adc: stm32: fix a current leak by resetting pcsel before disabling vdda iio: adc: axp20x_adc: fix charging current reporting on AXP22x iio: ad7768-1: Call iio_trigger_notify_done() on error iio: accel: kxcjk-1013: Fix possible memory leak in probe and remove csky: fix typo of fpu config macro irqchip/aspeed-scu: Replace update_bits with write_bits. irqchip/armada-370-xp: Fix return value of armada_370_xp_msi_alloc() irqchip/armada-370-xp: Fix support for Multi-MSI interrupts irqchip/irq-gic-v3-its.c: Force synchronisation when issuing INVALL irqchip: nvic: Fix offset for Interrupt Priority Offsets misc: fastrpc: fix improper packet size calculation bpf: Add selftests to cover packet access corner cases kbuild: simplify GCC_PLUGINS enablement in dummy-tools/gcc doc: gcc-plugins: update gcc-plugins.rst MAINTAINERS: adjust GCC PLUGINS after gcc-plugin.sh removal Documentation/Kbuild: Remove references to gcc-plugin.sh Linux 5.10.85 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I351da1b00f30a370b021125180a48b1c1ecb97ce	2021-12-14 15:11:46 +01:00
Greg Kroah-Hartman	89f3edc98f	HID: check for valid USB device for many HID drivers ... commit 93020953d0 upstream. Many HID drivers assume that the HID device assigned to them is a USB device as that was the only way HID devices used to be able to be created in Linux. However, with the additional ways that HID devices can be created for many different bus types, that is no longer true, so properly check that we have a USB device associated with the HID device before allowing a driver that makes this assumption to claim it. Cc: Jiri Kosina <jikos@kernel.org> Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com> Cc: Michael Zaidman <michael.zaidman@gmail.com> Cc: Stefan Achatz <erazor_de@users.sourceforge.net> Cc: Maxime Coquelin <mcoquelin.stm32@gmail.com> Cc: Alexandre Torgue <alexandre.torgue@foss.st.com> Cc: linux-input@vger.kernel.org Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Tested-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> [bentiss: amended for thrustmater.c hunk to apply] Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Link: https://lore.kernel.org/r/20211201183503.2373082-3-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-12-14 11:32:34 +01:00
Greg Kroah-Hartman	889c39113f	HID: wacom: fix problems when device is not a valid USB device ... commit 720ac46720 upstream. The wacom driver accepts devices of more than just USB types, but some code paths can cause problems if the device being controlled is not a USB device due to a lack of checking. Add the needed checks to ensure that the USB device accesses are only happening on a "real" USB device, and not one on some other bus. Cc: Jiri Kosina <jikos@kernel.org> Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com> Cc: linux-input@vger.kernel.org Cc: stable@vger.kernel.org Tested-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Link: https://lore.kernel.org/r/20211201183503.2373082-2-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-12-14 11:32:34 +01:00
Benjamin Tissoires	6272b17001	HID: bigbenff: prevent null pointer dereference ... commit 918aa1ef10 upstream. When emulating the device through uhid, there is a chance we don't have output reports and so report_field is null. Cc: stable@vger.kernel.org Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://lore.kernel.org/r/20211202095334.14399-3-benjamin.tissoires@redhat.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-12-14 11:32:34 +01:00
Greg Kroah-Hartman	d877651afd	HID: add USB_HID dependancy on some USB HID drivers ... commit f237d9028f upstream. Some HID drivers are only for USB drivers, yet did not depend on CONFIG_USB_HID. This was hidden by the fact that the USB functions were stubbed out in the past, but now that drivers are checking for USB devices properly, build errors can occur with some random configurations. Reported-by: kernel test robot <lkp@intel.com> Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Link: https://lore.kernel.org/r/20211202114819.2511954-1-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-12-14 11:32:34 +01:00
Greg Kroah-Hartman	a7e9c5ddf5	HID: add USB_HID dependancy to hid-chicony ... commit d080811f27 upstream. The chicony HID driver only controls USB devices, yet did not have a dependancy on USB_HID. This causes build errors on some configurations like sparc when building due to new changes to the chicony driver. Reported-by: Stephen Rothwell <sfr@canb.auug.org.au> Cc: stable@vger.kernel.org Cc: Jiri Kosina <jikos@kernel.org> Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Link: https://lore.kernel.org/r/20211203075927.2829218-1-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-12-14 11:32:34 +01:00
Greg Kroah-Hartman	28989ed4d7	HID: add USB_HID dependancy to hid-prodikeys ... commit 30cb3c2ad2 upstream. The prodikeys HID driver only controls USB devices, yet did not have a dependancy on USB_HID. This causes build errors on some configurations like nios2 when building due to new changes to the prodikeys driver. Reported-by: kernel test robot <lkp@intel.com> Cc: stable@vger.kernel.org Cc: Jiri Kosina <jikos@kernel.org> Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Link: https://lore.kernel.org/r/20211203081231.2856936-1-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-12-14 11:32:34 +01:00
Greg Kroah-Hartman	6114432960	HID: add hid_is_usb() function to make it simpler for USB detection ... commit f83baa0cb6 upstream. A number of HID drivers already call hid_is_using_ll_driver() but only for the detection of if this is a USB device or not. Make this more obvious by creating hid_is_usb() and calling the function that way. Also converts the existing hid_is_using_ll_driver() functions to use the new call. Cc: Jiri Kosina <jikos@kernel.org> Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com> Cc: linux-input@vger.kernel.org Cc: stable@vger.kernel.org Tested-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Link: https://lore.kernel.org/r/20211201183503.2373082-1-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-12-14 11:32:33 +01:00
xiazhengqiao	2298d5edd8	HID: google: add eel USB id ... commit caff009098 upstream. Add one additional hammer-like device. Signed-off-by: xiazhengqiao <xiazhengqiao@huaqin.corp-partner.google.com> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Link: https://lore.kernel.org/r/20211203030119.28612-1-xiazhengqiao@huaqin.corp-partner.google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-12-14 11:32:33 +01:00
Hans de Goede	12362cd3a4	HID: quirks: Add quirk for the Microsoft Surface 3 type-cover ... commit 9003fbe0f3 upstream. Add a HID_QUIRK_NO_INIT_REPORTS quirk for the Microsoft Surface 3 (non pro) type-cover. Trying to init the reports seems to confuse the type-cover and causes 2 issues: 1. Despite hid-multitouch sending the command to switch the touchpad to multitouch mode, it keeps sending events on the mouse emulation interface. 2. The touchpad completely stops sending events after a reboot. Adding the HID_QUIRK_NO_INIT_REPORTS quirk fixes both issues. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-12-14 11:32:33 +01:00
Tao Huang	f6909c028f	Merge tag 'ASB-2021-12-05_12-5.10' of https://android.googlesource.com/kernel/common ... https://source.android.com/security/bulletin/2021-12-01 CVE-2021-33909 CVE-2021-38204 CVE-2021-0961 * tag 'ASB-2021-12-05_12-5.10': (3010 commits) ANDROID: workqueue: export symbol of the function wq_worker_comm() ANDROID: GKI: Update symbols to symbol list ANDROID: vendor_hooks: Add hooks for binder proc transaction ANDROID: GKI: Add symbols abi for USB IP kernel modules. ANDROID: GKI: Fix file mode on mtk abi file UPSTREAM: erofs: fix deadlock when shrink erofs slab ANDROID: init_task: Init android vendor and oem data UPSTREAM: sched/core: Mitigate race cpus_share_cache()/update_top_cache_domain() ANDROID: Update symbol list for mtk UPSTREAM: erofs: fix unsafe pagevec reuse of hooked pclusters UPSTREAM: erofs: remove the occupied parameter from z_erofs_pagevec_enqueue() UPSTREAM: usb: dwc3: gadget: Fix null pointer exception ANDROID: fips140: support "evaluation testing" builds via build.sh FROMGIT: sched/scs: Reset task stack state in bringup_cpu() ANDROID: dma-buf: heaps: fix dma-buf heap pool pages stat ANDROID: ABI: Add several spi_mem related symbols UPSTREAM: spi: spi-mem: add spi_mem_dtr_supports_op() ANDROID: gki_defconfig: enable CONFIG_SPI_MEM ANDROID: ABI: Add several iio related symbols ANDROID: ABI: Update symbol list for IMX ... Change-Id: I09cddc92fa34553b944e62cc5cbbba94a84e5437 Conflicts: arch/arm/boot/dts/rk322x.dtsi arch/arm64/boot/dts/rockchip/rk3399.dtsi drivers/dma-buf/heaps/system_heap.c drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c drivers/gpu/drm/rockchip/rockchip_drm_vop.c drivers/gpu/drm/rockchip/rockchip_lvds.c drivers/gpu/drm/rockchip/rockchip_vop_reg.c drivers/mtd/nand/spi/core.c drivers/pci/controller/pcie-rockchip-host.c drivers/soc/rockchip/Kconfig drivers/usb/dwc3/core.c drivers/usb/dwc3/core.h	2021-12-14 17:09:02 +08:00
Greg Kroah-Hartman	249dae115a	This is the 5.10.83 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmGnMAIACgkQONu9yGCS aT6DvhAAnicmgFqzIcVpZmh+zd1VQFVQmFnlJTdfanz48k9JzkciCIjsSmnMvDZG oPA2xIZf1oXMkxRLO+PYrUP0Y2G5XT5ADh4qAdkxTD2QtNduq5G5iH6UdZzgyey7 awhWpi/U2aE2imwbV95c1ZfSG7nNMf/XWG36uGAqUKBGQZLeoAvWy3jHqcFoIL0+ UfbAu8TN06dTizQ7IiJzM/CrqlxSRA5EnF4D58n7Hf0etVR7BdFBCGSgefnR8Dog /zYGw2Jb0WczN6Qzws/WZm4zIC83NBYRdeaqKTIMF+0E5SrlCk1nE8Nc/WHzGazK Co8k4zm84DY5mpkCxTqGIgZ12Whho+kB8McAKeJ3Yzvq8qjKscPt+8nVLjyj/h8Q SNt1hTeHwTu5TGNMyNEWBjdnvuKv2XeyArpbPUsAofBdiMy8g/pkPiCOE9hoRV3N hPMrAw6jfZC6etie30ngsepE/3r0H0/n/U3Sh5mf12gY02zBQkMlJcMi86FNnxgk wcKgwYJca2elr3y2jSvOzs8k0OhTvaqEo0QnObR3ivooEiEbD9q2mTYidHgETM0V x/5Aqb+09suyER6vL4G1i0agbO6sn2AAepGTRLGTDAbHHFP9aG1VbIZwoORZ1fII VPGOq7/l0xYlIA/o0NUemcxPpGTvEkeKba7MVTbzxWcTdcF67g0= =J7jt -----END PGP SIGNATURE----- Merge 5.10.83 into android-5.10 Changes in 5.10.83 bpf: Fix toctou on read-only map's constant scalar tracking ACPI: Get acpi_device's parent from the parent field USB: serial: option: add Telit LE910S1 0x9200 composition USB: serial: option: add Fibocom FM101-GL variants usb: dwc2: gadget: Fix ISOC flow for elapsed frames usb: dwc2: hcd_queue: Fix use of floating point literal usb: dwc3: gadget: Ignore NoStream after End Transfer usb: dwc3: gadget: Check for L1/L2/U3 for Start Transfer usb: dwc3: gadget: Fix null pointer exception net: nexthop: fix null pointer dereference when IPv6 is not enabled usb: chipidea: ci_hdrc_imx: fix potential error pointer dereference in probe usb: typec: fusb302: Fix masking of comparator and bc_lvl interrupts usb: hub: Fix usb enumeration issue due to address0 race usb: hub: Fix locking issues with address0_mutex binder: fix test regression due to sender_euid change ALSA: ctxfi: Fix out-of-range access ALSA: hda/realtek: Add quirk for ASRock NUC Box 1100 ALSA: hda/realtek: Fix LED on HP ProBook 435 G7 media: cec: copy sequence field for the reply Revert "parisc: Fix backtrace to always include init funtion names" HID: wacom: Use "Confidence" flag to prevent reporting invalid contacts staging/fbtft: Fix backlight staging: greybus: Add missing rwsem around snd_ctl_remove() calls staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() fuse: release pipe buf after last use xen: don't continue xenstore initialization in case of errors xen: detect uninitialized xenbus in xenbus_init KVM: PPC: Book3S HV: Prevent POWER7/8 TLB flush flushing SLB tracing/uprobe: Fix uprobe_perf_open probes iteration tracing: Fix pid filtering when triggers are attached mmc: sdhci-esdhc-imx: disable CMDQ support mmc: sdhci: Fix ADMA for PAGE_SIZE >= 64KiB mdio: aspeed: Fix "Link is Down" issue powerpc/32: Fix hardlockup on vmap stack overflow PCI: aardvark: Deduplicate code in advk_pcie_rd_conf() PCI: aardvark: Update comment about disabling link training PCI: aardvark: Implement re-issuing config requests on CRS response PCI: aardvark: Simplify initialization of rootcap on virtual bridge PCI: aardvark: Fix link training proc/vmcore: fix clearing user buffer by properly using clear_user() netfilter: ctnetlink: fix filtering with CTA_TUPLE_REPLY netfilter: ctnetlink: do not erase error code with EINVAL netfilter: ipvs: Fix reuse connection if RS weight is 0 netfilter: flowtable: fix IPv6 tunnel addr match ARM: dts: BCM5301X: Fix I2C controller interrupt ARM: dts: BCM5301X: Add interrupt properties to GPIO node ARM: dts: bcm2711: Fix PCIe interrupts ASoC: qdsp6: q6routing: Conditionally reset FrontEnd Mixer ASoC: qdsp6: q6asm: fix q6asm_dai_prepare error handling ASoC: topology: Add missing rwsem around snd_ctl_remove() calls ASoC: codecs: wcd934x: return error code correctly from hw_params net: ieee802154: handle iftypes as u32 firmware: arm_scmi: pm: Propagate return value to caller NFSv42: Don't fail clone() unless the OP_CLONE operation failed ARM: socfpga: Fix crash with CONFIG_FORTIRY_SOURCE drm/nouveau/acr: fix a couple NULL vs IS_ERR() checks scsi: mpt3sas: Fix kernel panic during drive powercycle test drm/vc4: fix error code in vc4_create_object() net: marvell: prestera: fix double free issue on err path iavf: Prevent changing static ITR values if adaptive moderation is on ALSA: intel-dsp-config: add quirk for JSL devices based on ES8336 codec mptcp: fix delack timer firmware: smccc: Fix check for ARCH_SOC_ID not implemented ipv6: fix typos in __ip6_finish_output() nfp: checking parameter process for rx-usecs/tx-usecs is invalid net: stmmac: fix system hang caused by eee_ctrl_timer during suspend/resume net: stmmac: retain PTP clock time during SIOCSHWTSTAMP ioctls net: ipv6: add fib6_nh_release_dsts stub net: nexthop: release IPv6 per-cpu dsts when replacing a nexthop group ice: fix vsi->txq_map sizing ice: avoid bpf_prog refcount underflow scsi: core: sysfs: Fix setting device state to SDEV_RUNNING scsi: scsi_debug: Zero clear zones at reset write pointer erofs: fix deadlock when shrink erofs slab net/smc: Ensure the active closing peer first closes clcsock mlxsw: Verify the accessed index doesn't exceed the array length mlxsw: spectrum: Protect driver from buggy firmware net: marvell: mvpp2: increase MTU limit when XDP enabled nvmet-tcp: fix incomplete data digest send net/ncsi : Add payload to be 32-bit aligned to fix dropped packets PM: hibernate: use correct mode for swsusp_close() drm/amd/display: Set plane update flags for all planes in reset tcp_cubic: fix spurious Hystart ACK train detections for not-cwnd-limited flows lan743x: fix deadlock in lan743x_phy_link_status_change() net: phylink: Force link down and retrigger resolve on interface change net: phylink: Force retrigger in case of latched link-fail indicator net/smc: Fix NULL pointer dereferencing in smc_vlan_by_tcpsk() net/smc: Fix loop in smc_listen nvmet: use IOCB_NOWAIT only if the filesystem supports it igb: fix netpoll exit with traffic MIPS: loongson64: fix FTLB configuration MIPS: use 3-level pgtable for 64KB page size on MIPS_VA_BITS_48 tls: splice_read: fix record type check tls: fix replacing proto_ops net/sched: sch_ets: don't peek at classes beyond 'nbands' net: vlan: fix underflow for the real_dev refcnt net/smc: Don't call clcsock shutdown twice when smc shutdown net: hns3: fix VF RSS failed problem after PF enable multi-TCs net: mscc: ocelot: don't downgrade timestamping RX filters in SIOCSHWTSTAMP net: mscc: ocelot: correctly report the timestamping RX filters in ethtool tcp: correctly handle increased zerocopy args struct size sched/scs: Reset task stack state in bringup_cpu() f2fs: set SBI_NEED_FSCK flag when inconsistent node block found ceph: properly handle statfs on multifs setups smb3: do not error on fsync when readonly iommu/amd: Clarify AMD IOMMUv2 initialization messages vhost/vsock: fix incorrect used length reported to the guest tracing: Check pid filtering when creating events xen: sync include/xen/interface/io/ring.h with Xen's newest version xen/blkfront: read response from backend only once xen/blkfront: don't take local copy of a request from the ring page xen/blkfront: don't trust the backend response data blindly xen/netfront: read response from backend only once xen/netfront: don't read data from request on the ring page xen/netfront: disentangle tx_skb_freelist xen/netfront: don't trust the backend response data blindly tty: hvc: replace BUG_ON() with negative return value s390/mm: validate VMA in PGSTE manipulation functions shm: extend forced shm destroy to support objects from several IPC nses net: stmmac: platform: fix build warning when with !CONFIG_PM_SLEEP drm/amdgpu/gfx9: switch to golden tsc registers for renoir+ Linux 5.10.83 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ief47fb0c545e95bd269b07477eacd4c8713f287d	2021-12-03 15:52:39 +01:00
Jason Gerecke	8fc5e3c7ca	HID: wacom: Use "Confidence" flag to prevent reporting invalid contacts ... commit 7fb0413baa upstream. The HID descriptor of many of Wacom's touch input devices include a "Confidence" usage that signals if a particular touch collection contains useful data. The driver does not look at this flag, however, which causes even invalid contacts to be reported to userspace. A lucky combination of kernel event filtering and device behavior (specifically: contact ID 0 == invalid, contact ID >0 == valid; and order all data so that all valid contacts are reported before any invalid contacts) spare most devices from any visibly-bad behavior. The DTH-2452 is one example of an unlucky device that misbehaves. It uses ID 0 for both the first valid contact and all invalid contacts. Because we report both the valid and invalid contacts, the kernel reports that contact 0 first goes down (valid) and then goes up (invalid) in every report. This causes ~100 clicks per second simply by touching the screen. This patch inroduces new `confidence` flag in our `hid_data` structure. The value is initially set to `true` at the start of a report and can be set to `false` if an invalid touch usage is seen. Link: https://github.com/linuxwacom/input-wacom/issues/270 Fixes: f8b6a74719 ("HID: wacom: generic: Support multiple tools per report") Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com> Tested-by: Joshua Dickens <joshua.dickens@wacom.com> Cc: <stable@vger.kernel.org> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-12-01 09:19:00 +01:00
Greg Kroah-Hartman	c553d9a246	This is the 5.10.80 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmGWT+QACgkQONu9yGCS aT5mYw//ZXKzugaeJjuIaFqr7tcM7x8EefbKd2H4oMr8SW3IFElJIbNPJGMJAG/C tLZVWZvIum7QzZoxTL+JCCKpDzBERNTo4e5u7UwzAdVqiEX69YkNU0FBOzb4qXJ7 gOZMBhy4UMIKdKD12CSXXf7ZspocsNXfzdmulRQ7CQcPoPrIMKpc4vuagN1Fy/Dz JgXYvRUAkLxtFHoQ/TeXvR4Gv9+w2ToMdb02mI48QBO+YYrFaGt+Rza2eHTv75H+ Lydz37Nv1Pk32tA1q2jWxCzz16+Kzn+AviKiCfQK0Fb9IqnJksUIWLHSiODlVIcf kQHejanPn/p1BnBl8puPk1KFtDW45p2GwYhXG7hjGh08DGlR7QLHBS5Aa3xPYfdd uOy4ctygSVTx5nLjPH5vr3OE0wk/TuSSf/eyk2fmcUCspwAgBOnSYSmnJOem7LTK VqIgXFdCRplsqN415D35ddruP2BLCKqBu4KjwJ1LGIwgsx/Pmz4hlc5YcpLm8uRg XMqGTdcieQFOGmZJjJ2q3ecaCjfb0nmTrOylP5b55/74TFwFo042YR1ua0fEtpD4 euoHLfYv3BY1dCp34TOUFGX0l+J1kAtf//vfD/JgJx/nX+ksdFBHhYwdbSi2oQG/ 9CceXYJ5duEnG+JmDOWJvcZ3T49K5XaIDNfY2zGpcSu1VZKubWg= =tQ0m -----END PGP SIGNATURE----- Merge 5.10.80 into android12-5.10-lts Changes in 5.10.80 xhci: Fix USB 3.1 enumeration issues by increasing roothub power-on-good delay usb: xhci: Enable runtime-pm by default on AMD Yellow Carp platform binder: use euid from cred instead of using task binder: use cred instead of task for selinux checks binder: use cred instead of task for getsecid Input: iforce - fix control-message timeout Input: elantench - fix misreporting trackpoint coordinates Input: i8042 - Add quirk for Fujitsu Lifebook T725 libata: fix read log timeout value ocfs2: fix data corruption on truncate scsi: core: Remove command size deduction from scsi_setup_scsi_cmnd() scsi: qla2xxx: Fix kernel crash when accessing port_speed sysfs file scsi: qla2xxx: Fix use after free in eh_abort path mmc: mtk-sd: Add wait dma stop done flow mmc: dw_mmc: Dont wait for DRTO on Write RSP error exfat: fix incorrect loading of i_blocks for large files parisc: Fix set_fixmap() on PA1.x CPUs parisc: Fix ptrace check on syscall return tpm: Check for integer overflow in tpm2_map_response_body() firmware/psci: fix application of sizeof to pointer crypto: s5p-sss - Add error handling in s5p_aes_probe() media: rkvdec: Do not override sizeimage for output format media: ite-cir: IR receiver stop working after receive overflow media: rkvdec: Support dynamic resolution changes media: ir-kbd-i2c: improve responsiveness of hauppauge zilog receivers media: v4l2-ioctl: Fix check_ext_ctrls ALSA: hda/realtek: Fix mic mute LED for the HP Spectre x360 14 ALSA: hda/realtek: Add a quirk for HP OMEN 15 mute LED ALSA: hda/realtek: Add quirk for Clevo PC70HS ALSA: hda/realtek: Headset fixup for Clevo NH77HJQ ALSA: hda/realtek: Add a quirk for Acer Spin SP513-54N ALSA: hda/realtek: Add quirk for ASUS UX550VE ALSA: hda/realtek: Add quirk for HP EliteBook 840 G7 mute LED ALSA: ua101: fix division by zero at probe ALSA: 6fire: fix control and bulk message timeouts ALSA: line6: fix control and interrupt message timeouts ALSA: usb-audio: Line6 HX-Stomp XL USB_ID for 48k-fixed quirk ALSA: usb-audio: Add registration quirk for JBL Quantum 400 ALSA: hda: Free card instance properly at probe errors ALSA: synth: missing check for possible NULL after the call to kstrdup ALSA: timer: Fix use-after-free problem ALSA: timer: Unconditionally unlink slave instances, too ext4: fix lazy initialization next schedule time computation in more granular unit ext4: ensure enough credits in ext4_ext_shift_path_extents ext4: refresh the ext4_ext_path struct after dropping i_data_sem. fuse: fix page stealing x86/sme: Use #define USE_EARLY_PGTABLE_L5 in mem_encrypt_identity.c x86/cpu: Fix migration safety with X86_BUG_NULL_SEL x86/irq: Ensure PI wakeup handler is unregistered before module unload ASoC: soc-core: fix null-ptr-deref in snd_soc_del_component_unlocked() ALSA: hda/realtek: Fixes HP Spectre x360 15-eb1xxx speakers cavium: Return negative value when pci_alloc_irq_vectors() fails scsi: qla2xxx: Return -ENOMEM if kzalloc() fails scsi: qla2xxx: Fix unmap of already freed sgl mISDN: Fix return values of the probe function cavium: Fix return values of the probe function sfc: Export fibre-specific supported link modes sfc: Don't use netif_info before net_device setup hyperv/vmbus: include linux/bitops.h ARM: dts: sun7i: A20-olinuxino-lime2: Fix ethernet phy-mode reset: socfpga: add empty driver allowing consumers to probe mmc: winbond: don't build on M68K drm: panel-orientation-quirks: Add quirk for Aya Neo 2021 fcnal-test: kill hanging ping/nettest binaries on cleanup bpf: Define bpf_jit_alloc_exec_limit for arm64 JIT bpf: Prevent increasing bpf_jit_limit above max gpio: mlxbf2.c: Add check for bgpio_init failure xen/netfront: stop tx queues during live migration nvmet-tcp: fix a memory leak when releasing a queue spi: spl022: fix Microwire full duplex mode net: multicast: calculate csum of looped-back and forwarded packets watchdog: Fix OMAP watchdog early handling drm: panel-orientation-quirks: Add quirk for GPD Win3 block: schedule queue restart after BLK_STS_ZONE_RESOURCE nvmet-tcp: fix header digest verification r8169: Add device 10ec:8162 to driver r8169 vmxnet3: do not stop tx queues after netif_device_detach() nfp: bpf: relax prog rejection for mtu check through max_pkt_offset net/smc: Fix smc_link->llc_testlink_time overflow net/smc: Correct spelling mistake to TCPF_SYN_RECV rds: stop using dmapool btrfs: clear MISSING device status bit in btrfs_close_one_device btrfs: fix lost error handling when replaying directory deletes btrfs: call btrfs_check_rw_degradable only if there is a missing device KVM: VMX: Unregister posted interrupt wakeup handler on hardware unsetup ia64: kprobes: Fix to pass correct trampoline address to the handler selinux: fix race condition when computing ocontext SIDs hwmon: (pmbus/lm25066) Add offset coefficients regulator: s5m8767: do not use reset value as DVS voltage if GPIO DVS is disabled regulator: dt-bindings: samsung,s5m8767: correct s5m8767,pmic-buck-default-dvs-idx property EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell mwifiex: fix division by zero in fw download path ath6kl: fix division by zero in send path ath6kl: fix control-message timeout ath10k: fix control-message timeout ath10k: fix division by zero in send path PCI: Mark Atheros QCA6174 to avoid bus reset rtl8187: fix control-message timeouts evm: mark evm_fixmode as __ro_after_init ifb: Depend on netfilter alternatively to tc wcn36xx: Fix HT40 capability for 2Ghz band wcn36xx: Fix tx_status mechanism wcn36xx: Fix (QoS) null data frame bitrate/modulation PM: sleep: Do not let "syscore" devices runtime-suspend during system transitions mwifiex: Read a PCI register after writing the TX ring write pointer mwifiex: Try waking the firmware until we get an interrupt libata: fix checking of DMA state wcn36xx: handle connection loss indication rsi: fix occasional initialisation failure with BT coex rsi: fix key enabled check causing unwanted encryption for vap_id > 0 rsi: fix rate mask set leading to P2P failure rsi: Fix module dev_oper_mode parameter description perf/x86/intel/uncore: Support extra IMC channel on Ice Lake server perf/x86/intel/uncore: Fix Intel ICX IIO event constraints RDMA/qedr: Fix NULL deref for query_qp on the GSI QP signal: Remove the bogus sigkill_pending in ptrace_stop memory: renesas-rpc-if: Correct QSPI data transfer in Manual mode signal/mips: Update (_save|_restore)_fp_context to fail with -EFAULT soc: fsl: dpio: replace smp_processor_id with raw_smp_processor_id soc: fsl: dpio: use the combined functions to protect critical zone mtd: rawnand: socrates: Keep the driver compatible with on-die ECC engines power: supply: max17042_battery: Prevent int underflow in set_soc_threshold power: supply: max17042_battery: use VFSOC for capacity when no rsns KVM: arm64: Extract ESR_ELx.EC only KVM: nVMX: Query current VMCS when determining if MSR bitmaps are in use can: j1939: j1939_tp_cmd_recv(): ignore abort message in the BAM transport can: j1939: j1939_can_recv(): ignore messages with invalid source address powerpc/85xx: Fix oops when mpc85xx_smp_guts_ids node cannot be found ring-buffer: Protect ring_buffer_reset() from reentrancy serial: core: Fix initializing and restoring termios speed ifb: fix building without CONFIG_NET_CLS_ACT ALSA: mixer: oss: Fix racy access to slots ALSA: mixer: fix deadlock in snd_mixer_oss_set_volume xen/balloon: add late_initcall_sync() for initial ballooning done ovl: fix use after free in struct ovl_aio_req PCI: pci-bridge-emul: Fix emulation of W1C bits PCI: cadence: Add cdns_plat_pcie_probe() missing return PCI: aardvark: Do not clear status bits of masked interrupts PCI: aardvark: Fix checking for link up via LTSSM state PCI: aardvark: Do not unmask unused interrupts PCI: aardvark: Fix reporting Data Link Layer Link Active PCI: aardvark: Fix configuring Reference clock PCI: aardvark: Fix return value of MSI domain .alloc() method PCI: aardvark: Read all 16-bits from PCIE_MSI_PAYLOAD_REG PCI: aardvark: Fix support for bus mastering and PCI_COMMAND on emulated bridge PCI: aardvark: Fix support for PCI_BRIDGE_CTL_BUS_RESET on emulated bridge PCI: aardvark: Set PCI Bridge Class Code to PCI Bridge PCI: aardvark: Fix support for PCI_ROM_ADDRESS1 on emulated bridge quota: check block number when reading the block in quota file quota: correct error number in free_dqentry() pinctrl: core: fix possible memory leak in pinctrl_enable() coresight: cti: Correct the parameter for pm_runtime_put iio: dac: ad5446: Fix ad5622_write() return value iio: ad5770r: make devicetree property reading consistent USB: serial: keyspan: fix memleak on probe errors serial: 8250: fix racy uartclk update most: fix control-message timeouts USB: iowarrior: fix control-message timeouts USB: chipidea: fix interrupt deadlock power: supply: max17042_battery: Clear status bits in interrupt handler dma-buf: WARN on dmabuf release with pending attachments drm: panel-orientation-quirks: Update the Lenovo Ideapad D330 quirk (v2) drm: panel-orientation-quirks: Add quirk for KD Kurio Smart C15200 2-in-1 drm: panel-orientation-quirks: Add quirk for the Samsung Galaxy Book 10.6 Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg() Bluetooth: fix use-after-free error in lock_sock_nested() drm/panel-orientation-quirks: add Valve Steam Deck rcutorture: Avoid problematic critical section nesting on PREEMPT_RT platform/x86: wmi: do not fail if disabling fails MIPS: lantiq: dma: add small delay after reset MIPS: lantiq: dma: reset correct number of channel locking/lockdep: Avoid RCU-induced noinstr fail net: sched: update default qdisc visibility after Tx queue cnt changes rcu-tasks: Move RTGS_WAIT_CBS to beginning of rcu_tasks_kthread() loop smackfs: Fix use-after-free in netlbl_catmap_walk() ath11k: Align bss_chan_info structure with firmware x86: Increase exception stack sizes mwifiex: Run SET_BSS_MODE when changing from P2P to STATION vif-type mwifiex: Properly initialize private structure on interface type changes fscrypt: allow 256-bit master keys with AES-256-XTS drm/amdgpu: Fix MMIO access page fault ath11k: Avoid reg rules update during firmware recovery ath11k: add handler for scan event WMI_SCAN_EVENT_DEQUEUED ath11k: Change DMA_FROM_DEVICE to DMA_TO_DEVICE when map reinjected packets ath10k: high latency fixes for beacon buffer media: mt9p031: Fix corrupted frame after restarting stream media: netup_unidvb: handle interrupt properly according to the firmware media: atomisp: Fix error handling in probe media: stm32: Potential NULL pointer dereference in dcmi_irq_thread() media: uvcvideo: Set capability in s_param media: uvcvideo: Return -EIO for control errors media: uvcvideo: Set unique vdev name based in type media: s5p-mfc: fix possible null-pointer dereference in s5p_mfc_probe() media: s5p-mfc: Add checking to s5p_mfc_probe(). media: imx: set a media_device bus_info string media: mceusb: return without resubmitting URB in case of -EPROTO error. ia64: don't do IA64_CMPXCHG_DEBUG without CONFIG_PRINTK rtw88: fix RX clock gate setting while fifo dump brcmfmac: Add DMI nvram filename quirk for Cyberbook T116 tablet media: rcar-csi2: Add checking to rcsi2_start_receiver() ipmi: Disable some operations during a panic fs/proc/uptime.c: Fix idle time reporting in /proc/uptime ACPICA: Avoid evaluating methods too early during system resume media: ipu3-imgu: imgu_fmt: Handle properly try media: ipu3-imgu: VIDIOC_QUERYCAP: Fix bus_info media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte() net-sysfs: try not to restart the syscall if it will fail eventually tracefs: Have tracefs directories not set OTH permission bits by default ath: dfs_pattern_detector: Fix possible null-pointer dereference in channel_detector_create() mmc: moxart: Fix reference count leaks in moxart_probe iov_iter: Fix iov_iter_get_pages{,_alloc} page fault return value ACPI: battery: Accept charges over the design capacity as full drm/amdkfd: fix resume error when iommu disabled in Picasso net: phy: micrel: make *-skew-ps check more lenient leaking_addresses: Always print a trailing newline drm/msm: prevent NULL dereference in msm_gpu_crashstate_capture() block: bump max plugged deferred size from 16 to 32 md: update superblock after changing rdev flags in state_store memstick: r592: Fix a UAF bug when removing the driver lib/xz: Avoid overlapping memcpy() with invalid input with in-place decompression lib/xz: Validate the value before assigning it to an enum variable workqueue: make sysfs of unbound kworker cpumask more clever tracing/cfi: Fix cmp_entries_* functions signature mismatch mt76: mt7915: fix an off-by-one bound check mwl8k: Fix use-after-free in mwl8k_fw_state_machine() block: remove inaccurate requeue check media: allegro: ignore interrupt if mailbox is not initialized nvmet: fix use-after-free when a port is removed nvmet-rdma: fix use-after-free when a port is removed nvmet-tcp: fix use-after-free when a port is removed nvme: drop scan_lock and always kick requeue list when removing namespaces PM: hibernate: Get block device exclusively in swsusp_check() selftests: kvm: fix mismatched fclose() after popen() selftests/bpf: Fix perf_buffer test on system with offline cpus iwlwifi: mvm: disable RX-diversity in powersave smackfs: use __GFP_NOFAIL for smk_cipso_doi() ARM: clang: Do not rely on lr register for stacktrace gre/sit: Don't generate link-local addr if addr_gen_mode is IN6_ADDR_GEN_MODE_NONE gfs2: Cancel remote delete work asynchronously gfs2: Fix glock_hash_walk bugs ARM: 9136/1: ARMv7-M uses BE-8, not BE-32 vrf: run conntrack only in context of lower/physdev for locally generated packets net: annotate data-race in neigh_output() ACPI: AC: Quirk GK45 to skip reading _PSR btrfs: reflink: initialize return value to 0 in btrfs_extent_same() btrfs: do not take the uuid_mutex in btrfs_rm_device spi: bcm-qspi: Fix missing clk_disable_unprepare() on error in bcm_qspi_probe() wcn36xx: Correct band/freq reporting on RX x86/hyperv: Protect set_hv_tscchange_cb() against getting preempted drm/amd/display: dcn20_resource_construct reduce scope of FPU enabled selftests/core: fix conflicting types compile error for close_range() parisc: fix warning in flush_tlb_all task_stack: Fix end_of_stack() for architectures with upwards-growing stack erofs: don't trigger WARN() when decompression fails parisc/unwind: fix unwinder when CONFIG_64BIT is enabled parisc/kgdb: add kgdb_roundup() to make kgdb work with idle polling netfilter: conntrack: set on IPS_ASSURED if flows enters internal stream state selftests/bpf: Fix strobemeta selftest regression Bluetooth: fix init and cleanup of sco_conn.timeout_work rcu: Fix existing exp request check in sync_sched_exp_online_cleanup() MIPS: lantiq: dma: fix burst length for DEU objtool: Add xen_start_kernel() to noreturn list x86/xen: Mark cpu_bringup_and_idle() as dead_end_function objtool: Fix static_call list generation drm/v3d: fix wait for TMU write combiner flush virtio-gpu: fix possible memory allocation failure lockdep: Let lock_is_held_type() detect recursive read as read net: net_namespace: Fix undefined member in key_remove_domain() cgroup: Make rebind_subsystems() disable v2 controllers all at once wcn36xx: Fix Antenna Diversity Switching wilc1000: fix possible memory leak in cfg_scan_result() Bluetooth: btmtkuart: fix a memleak in mtk_hci_wmt_sync crypto: caam - disable pkc for non-E SoCs rxrpc: Fix _usecs_to_jiffies() by using usecs_to_jiffies() net: dsa: rtl8366rb: Fix off-by-one bug ath11k: fix some sleeping in atomic bugs ath11k: Avoid race during regd updates ath11k: fix packet drops due to incorrect 6 GHz freq value in rx status ath11k: Fix memory leak in ath11k_qmi_driver_event_work ath10k: Fix missing frame timestamp for beacon/probe-resp ath10k: sdio: Add missing BH locking around napi_schdule() drm/ttm: stop calling tt_swapin in vm_access arm64: mm: update max_pfn after memory hotplug drm/amdgpu: fix warning for overflow check media: em28xx: add missing em28xx_close_extension media: cxd2880-spi: Fix a null pointer dereference on error handling path media: dvb-usb: fix ununit-value in az6027_rc_query media: v4l2-ioctl: S_CTRL output the right value media: TDA1997x: handle short reads of hdmi info frame. media: mtk-vpu: Fix a resource leak in the error handling path of 'mtk_vpu_probe()' media: radio-wl1273: Avoid card name truncation media: si470x: Avoid card name truncation media: tm6000: Avoid card name truncation media: cx23885: Fix snd_card_free call on null card pointer kprobes: Do not use local variable when creating debugfs file crypto: ecc - fix CRYPTO_DEFAULT_RNG dependency cpuidle: Fix kobject memory leaks in error paths media: em28xx: Don't use ops->suspend if it is NULL ath9k: Fix potential interrupt storm on queue reset PM: EM: Fix inefficient states detection EDAC/amd64: Handle three rank interleaving mode rcu: Always inline rcu_dynticks_task*_{enter,exit}() netfilter: nft_dynset: relax superfluous check on set updates media: dvb-frontends: mn88443x: Handle errors of clk_prepare_enable() crypto: qat - detect PFVF collision after ACK crypto: qat - disregard spurious PFVF interrupts hwrng: mtk - Force runtime pm ops for sleep ops b43legacy: fix a lower bounds test b43: fix a lower bounds test gve: Recover from queue stall due to missed IRQ mmc: sdhci-omap: Fix NULL pointer exception if regulator is not configured mmc: sdhci-omap: Fix context restore memstick: avoid out-of-range warning memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host() net, neigh: Fix NTF_EXT_LEARNED in combination with NTF_USE hwmon: Fix possible memleak in __hwmon_device_register() hwmon: (pmbus/lm25066) Let compiler determine outer dimension of lm25066_coeff ath10k: fix max antenna gain unit kernel/sched: Fix sched_fork() access an invalid sched_task_group tcp: switch orphan_count to bare per-cpu counters drm/msm: potential error pointer dereference in init() drm/msm: uninitialized variable in msm_gem_import() net: stream: don't purge sk_error_queue in sk_stream_kill_queues() media: ir_toy: assignment to be16 should be of correct type mmc: mxs-mmc: disable regulator on error and in the remove function platform/x86: thinkpad_acpi: Fix bitwise vs. logical warning mt76: mt7615: fix endianness warning in mt7615_mac_write_txwi mt76: mt76x02: fix endianness warnings in mt76x02_mac.c mt76: mt7915: fix possible infinite loop release semaphore mt76: mt7915: fix sta_rec_wtbl tag len mt76: mt7915: fix muar_idx in mt7915_mcu_alloc_sta_req() rsi: stop thread firstly in rsi_91x_init() error handling mwifiex: Send DELBA requests according to spec net: enetc: unmap DMA in enetc_send_cmd() phy: micrel: ksz8041nl: do not use power down mode nvme-rdma: fix error code in nvme_rdma_setup_ctrl PM: hibernate: fix sparse warnings clocksource/drivers/timer-ti-dm: Select TIMER_OF x86/sev: Fix stack type check in vc_switch_off_ist() drm/msm: Fix potential NULL dereference in DPU SSPP smackfs: use netlbl_cfg_cipsov4_del() for deleting cipso_v4_doi KVM: selftests: Add operand to vmsave/vmload/vmrun in svm.c KVM: selftests: Fix nested SVM tests when built with clang bpftool: Avoid leaking the JSON writer prepared for program metadata libbpf: Fix BTF data layout checks and allow empty BTF libbpf: Allow loading empty BTFs libbpf: Fix overflow in BTF sanity checks libbpf: Fix BTF header parsing checks s390/gmap: don't unconditionally call pte_unmap_unlock() in __gmap_zap() KVM: s390: pv: avoid double free of sida page KVM: s390: pv: avoid stalls for kvm_s390_pv_init_vm irq: mips: avoid nested irq_enter() tpm: fix Atmel TPM crash caused by too frequent queries tpm_tis_spi: Add missing SPI ID libbpf: Fix endianness detection in BPF_CORE_READ_BITFIELD_PROBED() tcp: don't free a FIN sk_buff in tcp_remove_empty_skb() spi: spi-rpc-if: Check return value of rpcif_sw_init() samples/kretprobes: Fix return value if register_kretprobe() failed KVM: s390: Fix handle_sske page fault handling libertas_tf: Fix possible memory leak in probe and disconnect libertas: Fix possible memory leak in probe and disconnect wcn36xx: add proper DMA memory barriers in rx path wcn36xx: Fix discarded frames due to wrong sequence number drm/amdgpu/gmc6: fix DMA mask from 44 to 40 bits selftests: bpf: Convert sk_lookup ctx access tests to PROG_TEST_RUN selftests/bpf: Fix fd cleanup in sk_lookup test net: amd-xgbe: Toggle PLL settings during rate change net: phylink: avoid mvneta warning when setting pause parameters crypto: pcrypt - Delay write to padata->info selftests/bpf: Fix fclose/pclose mismatch in test_progs udp6: allow SO_MARK ctrl msg to affect routing ibmvnic: don't stop queue in xmit ibmvnic: Process crqs after enabling interrupts cgroup: Fix rootcg cpu.stat guest double counting bpf: Fix propagation of bounds from 64-bit min/max into 32-bit and var_off. bpf: Fix propagation of signed bounds from 64-bit min/max into 32-bit. of: unittest: fix EXPECT text for gpio hog errors iio: st_sensors: Call st_sensors_power_enable() from bus drivers iio: st_sensors: disable regulators after device unregistration RDMA/rxe: Fix wrong port_cap_flags ARM: dts: BCM5301X: Fix memory nodes names clk: mvebu: ap-cpu-clk: Fix a memory leak in error handling paths ARM: s3c: irq-s3c24xx: Fix return value check for s3c24xx_init_intc() arm64: dts: rockchip: Fix GPU register width for RK3328 ARM: dts: qcom: msm8974: Add xo_board reference clock to DSI0 PHY RDMA/bnxt_re: Fix query SRQ failure arm64: dts: ti: k3-j721e-main: Fix "max-virtual-functions" in PCIe EP nodes arm64: dts: ti: k3-j721e-main: Fix "bus-range" upto 256 bus number for PCIe arm64: dts: meson-g12a: Fix the pwm regulator supply properties arm64: dts: meson-g12b: Fix the pwm regulator supply properties bus: ti-sysc: Fix timekeeping_suspended warning on resume ARM: dts: at91: tse850: the emac<->phy interface is rmii scsi: dc395: Fix error case unwinding MIPS: loongson64: make CPU_LOONGSON64 depends on MIPS_FP_SUPPORT JFS: fix memleak in jfs_mount arm64: dts: qcom: msm8916: Fix Secondary MI2S bit clock arm64: dts: renesas: beacon: Fix Ethernet PHY mode arm64: dts: qcom: pm8916: Remove wrong reg-names for rtc@6000 ALSA: hda: Reduce udelay() at SKL+ position reporting ALSA: hda: Release controller display power during shutdown/reboot ALSA: hda: Fix hang during shutdown due to link reset ALSA: hda: Use position buffer for SKL+ again soundwire: debugfs: use controller id and link_id for debugfs scsi: pm80xx: Fix misleading log statement in pm8001_mpi_get_nvmd_resp() driver core: Fix possible memory leak in device_link_add() arm: dts: omap3-gta04a4: accelerometer irq fix ASoC: SOF: topology: do not power down primary core during topology removal soc/tegra: Fix an error handling path in tegra_powergate_power_up() memory: fsl_ifc: fix leak of irq and nand_irq in fsl_ifc_ctrl_probe clk: at91: check pmc node status before registering syscore ops video: fbdev: chipsfb: use memset_io() instead of memset() powerpc: Refactor is_kvm_guest() declaration to new header powerpc: Rename is_kvm_guest() to check_kvm_guest() powerpc: Reintroduce is_kvm_guest() as a fast-path check powerpc: Fix is_kvm_guest() / kvm_para_available() powerpc: fix unbalanced node refcount in check_kvm_guest() serial: 8250_dw: Drop wrong use of ACPI_PTR() usb: gadget: hid: fix error code in do_config() power: supply: rt5033_battery: Change voltage values to µV power: supply: max17040: fix null-ptr-deref in max17040_probe() scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn() RDMA/mlx4: Return missed an error if device doesn't support steering usb: musb: select GENERIC_PHY instead of depending on it staging: most: dim2: do not double-register the same device staging: ks7010: select CRYPTO_HASH/CRYPTO_MICHAEL_MIC pinctrl: renesas: checker: Fix off-by-one bug in drive register check ARM: dts: stm32: Reduce DHCOR SPI NOR frequency to 50 MHz ARM: dts: stm32: fix SAI sub nodes register range ARM: dts: stm32: fix AV96 board SAI2 pin muxing on stm32mp15 ASoC: cs42l42: Correct some register default values ASoC: cs42l42: Defer probe if request_threaded_irq() returns EPROBE_DEFER soc: qcom: rpmhpd: Provide some missing struct member descriptions soc: qcom: rpmhpd: Make power_on actually enable the domain usb: typec: STUSB160X should select REGMAP_I2C iio: adis: do not disabe IRQs in 'adis_init()' scsi: ufs: Refactor ufshcd_setup_clocks() to remove skip_ref_clk scsi: ufs: ufshcd-pltfrm: Fix memory leak due to probe defer serial: imx: fix detach/attach of serial console usb: dwc2: drd: fix dwc2_force_mode call in dwc2_ovr_init usb: dwc2: drd: fix dwc2_drd_role_sw_set when clock could be disabled usb: dwc2: drd: reset current session before setting the new one firmware: qcom_scm: Fix error retval in __qcom_scm_is_call_available() soc: qcom: apr: Add of_node_put() before return pinctrl: equilibrium: Fix function addition in multiple groups phy: qcom-qusb2: Fix a memory leak on probe phy: ti: gmii-sel: check of_get_address() for failure phy: qcom-snps: Correct the FSEL_MASK serial: xilinx_uartps: Fix race condition causing stuck TX clk: at91: sam9x60-pll: use DIV_ROUND_CLOSEST_ULL HID: u2fzero: clarify error check and length calculations HID: u2fzero: properly handle timeouts in usb_submit_urb powerpc/44x/fsp2: add missing of_node_put ASoC: cs42l42: Disable regulators if probe fails ASoC: cs42l42: Use device_property API instead of of_property ASoC: cs42l42: Correct configuring of switch inversion from ts-inv virtio_ring: check desc == NULL when using indirect with packed mips: cm: Convert to bitfield API to fix out-of-bounds access power: supply: bq27xxx: Fix kernel crash on IRQ handler register error apparmor: fix error check rpmsg: Fix rpmsg_create_ept return when RPMSG config is not defined nfsd: don't alloc under spinlock in rpc_parse_scope_id i2c: mediatek: fixing the incorrect register offset NFS: Fix dentry verifier races pnfs/flexfiles: Fix misplaced barrier in nfs4_ff_layout_prepare_ds drm/plane-helper: fix uninitialized variable reference PCI: aardvark: Don't spam about PIO Response Status PCI: aardvark: Fix preserving PCI_EXP_RTCTL_CRSSVE flag on emulated bridge opp: Fix return in _opp_add_static_v2() NFS: Fix deadlocks in nfs_scan_commit_list() fs: orangefs: fix error return code of orangefs_revalidate_lookup() mtd: spi-nor: hisi-sfc: Remove excessive clk_disable_unprepare() PCI: uniphier: Serialize INTx masking/unmasking and fix the bit operation mtd: core: don't remove debugfs directory if device is in use remoteproc: Fix a memory leak in an error handling path in 'rproc_handle_vdev()' rtc: rv3032: fix error handling in rv3032_clkout_set_rate() dmaengine: at_xdmac: fix AT_XDMAC_CC_PERID() macro NFS: Fix up commit deadlocks NFS: Fix an Oops in pnfs_mark_request_commit() Fix user namespace leak auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string auxdisplay: ht16k33: Connect backlight to fbdev auxdisplay: ht16k33: Fix frame buffer device blanking soc: fsl: dpaa2-console: free buffer before returning from dpaa2_console_read netfilter: nfnetlink_queue: fix OOB when mac header was cleared dmaengine: dmaengine_desc_callback_valid(): Check for `callback_result` signal/sh: Use force_sig(SIGKILL) instead of do_group_exit(SIGKILL) m68k: set a default value for MEMORY_RESERVE watchdog: f71808e_wdt: fix inaccurate report in WDIOC_GETTIMEOUT ar7: fix kernel builds for compiler test scsi: qla2xxx: Changes to support FCP2 Target scsi: qla2xxx: Relogin during fabric disturbance scsi: qla2xxx: Fix gnl list corruption scsi: qla2xxx: Turn off target reset during issue_lip NFSv4: Fix a regression in nfs_set_open_stateid_locked() i2c: xlr: Fix a resource leak in the error handling path of 'xlr_i2c_probe()' xen-pciback: Fix return in pm_ctrl_init() net: davinci_emac: Fix interrupt pacing disable ethtool: fix ethtool msg len calculation for pause stats openrisc: fix SMP tlb flush NULL pointer dereference net: vlan: fix a UAF in vlan_dev_real_dev() ice: Fix replacing VF hardware MAC to existing MAC filter ice: Fix not stopping Tx queues for VFs ACPI: PMIC: Fix intel_pmic_regs_handler() read accesses drm/nouveau/svm: Fix refcount leak bug and missing check against null bug net: phy: fix duplex out of sync problem while changing settings bonding: Fix a use-after-free problem when bond_sysfs_slave_add() failed mfd: core: Add missing of_node_put for loop iteration can: mcp251xfd: mcp251xfd_chip_start(): fix error handling for mcp251xfd_chip_rx_int_enable() mm/zsmalloc.c: close race window between zs_pool_dec_isolated() and zs_unregister_migration() zram: off by one in read_block_state() perf bpf: Add missing free to bpf_event__print_bpf_prog_info() llc: fix out-of-bound array index in llc_sk_dev_hash() nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails arm64: pgtable: make __pte_to_phys/__phys_to_pte_val inline functions bpf, sockmap: Remove unhash handler for BPF sockmap usage bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding gve: Fix off by one in gve_tx_timeout() seq_file: fix passing wrong private data net/sched: sch_taprio: fix undefined behavior in ktime_mono_to_any net: hns3: fix kernel crash when unload VF while it is being reset net: hns3: allow configure ETS bandwidth of all TCs net: stmmac: allow a tc-taprio base-time of zero vsock: prevent unnecessary refcnt inc for nonblocking connect net/smc: fix sk_refcnt underflow on linkdown and fallback cxgb4: fix eeprom len when diagnostics not implemented selftests/net: udpgso_bench_rx: fix port argument ARM: 9155/1: fix early early_iounmap() ARM: 9156/1: drop cc-option fallbacks for architecture selection parisc: Fix backtrace to always include init funtion names MIPS: Fix assembly error from MIPSr2 code used within MIPS_ISA_ARCH_LEVEL x86/mce: Add errata workaround for Skylake SKX37 posix-cpu-timers: Clear task::posix_cputimers_work in copy_process() irqchip/sifive-plic: Fixup EOI failed when masked f2fs: should use GFP_NOFS for directory inodes net, neigh: Enable state migration between NUD_PERMANENT and NTF_USE 9p/net: fix missing error check in p9_check_errors memcg: prohibit unconditional exceeding the limit of dying tasks powerpc/lib: Add helper to check if offset is within conditional branch range powerpc/bpf: Validate branch ranges powerpc/security: Add a helper to query stf_barrier type powerpc/bpf: Emit stf barrier instruction sequences for BPF_NOSPEC mm, oom: pagefault_out_of_memory: don't force global OOM for dying tasks mm, oom: do not trigger out_of_memory from the #PF mfd: dln2: Add cell for initializing DLN2 ADC video: backlight: Drop maximum brightness override for brightness zero s390/cio: check the subchannel validity for dev_busid s390/tape: fix timer initialization in tape_std_assign() s390/ap: Fix hanging ioctl caused by orphaned replies s390/cio: make ccw_device_dma_* more robust mtd: rawnand: ams-delta: Keep the driver compatible with on-die ECC engines mtd: rawnand: xway: Keep the driver compatible with on-die ECC engines mtd: rawnand: mpc5121: Keep the driver compatible with on-die ECC engines mtd: rawnand: gpio: Keep the driver compatible with on-die ECC engines mtd: rawnand: pasemi: Keep the driver compatible with on-die ECC engines mtd: rawnand: orion: Keep the driver compatible with on-die ECC engines mtd: rawnand: plat_nand: Keep the driver compatible with on-die ECC engines mtd: rawnand: au1550nd: Keep the driver compatible with on-die ECC engines powerpc/powernv/prd: Unregister OPAL_MSG_PRD2 notifier during module unload powerpc/85xx: fix timebase sync issue when CONFIG_HOTPLUG_CPU=n drm/sun4i: Fix macros in sun8i_csc.h PCI: Add PCI_EXP_DEVCTL_PAYLOAD_* macros PCI: aardvark: Fix PCIe Max Payload Size setting SUNRPC: Partial revert of commit 6f9f17287e ath10k: fix invalid dma_addr_t token assignment mmc: moxart: Fix null pointer dereference on pointer host selftests/bpf: Fix also no-alu32 strobemeta selftest arch/cc: Introduce a function to check for confidential computing features x86/sev: Add an x86 version of cc_platform_has() x86/sev: Make the #VC exception stacks part of the default stacks storage soc/tegra: pmc: Fix imbalanced clock disabling in error code path Linux 5.10.80 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I21c750863965fbf584251fa2de3c941ae5922d3f	2021-11-19 11:50:41 +01:00
Andrej Shadura	4310970d0b	HID: u2fzero: properly handle timeouts in usb_submit_urb ... [ Upstream commit 43775e62c4 ] The wait_for_completion_timeout function returns 0 if timed out or a positive value if completed. Hence, "less than zero" comparison always misses timeouts and doesn't kill the URB as it should, leading to re-sending it while it is active. Fixes: 42337b9d4d ("HID: add driver for U2F Zero built-in LED and RNG") Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-11-18 14:04:21 +01:00
Andrej Shadura	e2f0bff411	HID: u2fzero: clarify error check and length calculations ... [ Upstream commit b7abf78b7a ] The previous commit fixed handling of incomplete packets but broke error handling: offsetof returns an unsigned value (size_t), but when compared against the signed return value, the return value is interpreted as if it were unsigned, so negative return values are never less than the offset. To make the code easier to read, calculate the minimal packet length once and separately, and assign it to a signed int variable to eliminate unsigned math and the need for type casts. It then becomes immediately obvious how the actual data length is calculated and why the return value cannot be less than the minimal length. Fixes: 22d65765f2 ("HID: u2fzero: ignore incomplete packets without data") Fixes: 42337b9d4d ("HID: add driver for U2F Zero built-in LED and RNG") Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-11-18 14:04:21 +01:00
Greg Kroah-Hartman	a336e746e3	This is the 5.10.74 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmFr4joACgkQONu9yGCS aT7FEhAAtYeqq/Q4Q+TFU8yaL7vM5FJ+6P7LrTab2RkSiVK3iyw7PID1QwO4lOwy AaQeWgl/tTOHwVJyjrjUIWzSh27fnvlpL4eAMTuvMlziSi4oPJVZDvh7uMGcg6SH YK9BkjDxyFloOOY5MMk8IOCFhkgXAirpbf0UhcJ7BvqQTUyTbLl5ta5comQkdb86 f+XImpN8nsVa8HIqzcMMu399KLslb++hx5HKWw2WUZJZMGtDws3UNxGFegsMVZaY 3QbI+31td+4NS8akgGmNbHnBOwjyC+FH9jcvUCn8jXVG+BckFi32ly5LTQ+iLCRm SgFNnCKoIQJWmS32IZu7FwZ2/lUxYiC129wO7Ek0e3Mnae7AFn75OkO+4zcm7cfd NAXHuTk7aWgKLRPSrSxgMhR7zwOGNNs0IJ3URohkYbdK74rWqlpI0aw+e+pJ2jpa HuTLfIhatxop32TnxrrZAfmkrwvKFcwDDAmVrtuPHjtmoaSLqzJzTjUyXhQJQB2E Z30ZOjSGOkXtwqR37hMR1oOoyOjnMqRzZ5hqm8wtjLquDTUmhsHUvwwWgbiQjK5p jXFN7p0vJFFMjDu7+Hkq51fRBgMqEgZ729TYAHAzbIi3kNr7TbwYVYs2nvP8Qa2D BW5eFHQL3qGUcKCUn1/q+xkHQL9fwitLvVq5zRDo9Ef3ZKjF7yU= =cbzE -----END PGP SIGNATURE----- Merge 5.10.74 into android12-5.10-lts Changes in 5.10.74 ext4: check and update i_disksize properly ext4: correct the error path of ext4_write_inline_data_end() ASoC: Intel: sof_sdw: tag SoundWire BEs as non-atomic HID: apple: Fix logical maximum and usage maximum of Magic Keyboard JIS netfilter: ip6_tables: zero-initialize fragment offset HID: wacom: Add new Intuos BT (CTL-4100WL/CTL-6100WL) device IDs ASoC: SOF: loader: release_firmware() on load failure to avoid batching netfilter: nf_nat_masquerade: make async masq_inet6_event handling generic netfilter: nf_nat_masquerade: defer conntrack walk to work queue mac80211: Drop frames from invalid MAC address in ad-hoc mode m68k: Handle arrivals of multiple signals correctly hwmon: (ltc2947) Properly handle errors when looking for the external clock net: prevent user from passing illegal stab size mac80211: check return value of rhashtable_init vboxfs: fix broken legacy mount signature checking net: sun: SUNVNET_COMMON should depend on INET drm/amdgpu: fix gart.bo pin_count leak scsi: ses: Fix unsigned comparison with less than zero scsi: virtio_scsi: Fix spelling mistake "Unsupport" -> "Unsupported" perf/core: fix userpage->time_enabled of inactive events sched: Always inline is_percpu_thread() hwmon: (pmbus/ibm-cffps) max_power_out swap changes Linux 5.10.74 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ic5235aa8641c64ee2849355a7f10613ae204c74e	2021-10-17 11:42:28 +02:00
Joshua-Dickens	f6952b1e22	HID: wacom: Add new Intuos BT (CTL-4100WL/CTL-6100WL) device IDs ... [ Upstream commit 0c8fbaa553 ] Add the new PIDs to wacom_wac.c to support the new models in the Intuos series. [jkosina@suse.cz: fix changelog] Signed-off-by: Joshua Dickens <joshua.dickens@wacom.com> Reviewed-by: Ping Cheng <ping.cheng@wacom.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-10-17 10:43:32 +02:00
Mizuho Mori	ddf026d6ae	HID: apple: Fix logical maximum and usage maximum of Magic Keyboard JIS ... [ Upstream commit 67fd71ba16 ] Apple Magic Keyboard(JIS)'s Logical Maximum and Usage Maximum are wrong. Below is a report descriptor. 0x05, 0x01, /* Usage Page (Desktop), */ 0x09, 0x06, /* Usage (Keyboard), */ 0xA1, 0x01, /* Collection (Application), */ 0x85, 0x01, /* Report ID (1), */ 0x05, 0x07, /* Usage Page (Keyboard), */ 0x15, 0x00, /* Logical Minimum (0), */ 0x25, 0x01, /* Logical Maximum (1), */ 0x19, 0xE0, /* Usage Minimum (KB Leftcontrol), */ 0x29, 0xE7, /* Usage Maximum (KB Right GUI), */ 0x75, 0x01, /* Report Size (1), */ 0x95, 0x08, /* Report Count (8), */ 0x81, 0x02, /* Input (Variable), */ 0x95, 0x05, /* Report Count (5), */ 0x75, 0x01, /* Report Size (1), */ 0x05, 0x08, /* Usage Page (LED), */ 0x19, 0x01, /* Usage Minimum (01h), */ 0x29, 0x05, /* Usage Maximum (05h), */ 0x91, 0x02, /* Output (Variable), */ 0x95, 0x01, /* Report Count (1), */ 0x75, 0x03, /* Report Size (3), */ 0x91, 0x03, /* Output (Constant, Variable), */ 0x95, 0x08, /* Report Count (8), */ 0x75, 0x01, /* Report Size (1), */ 0x15, 0x00, /* Logical Minimum (0), */ 0x25, 0x01, /* Logical Maximum (1), */ here is a report descriptor which is parsed one in kernel. see sys/kernel/debug/hid/<dev>/rdesc 05 01 09 06 a1 01 85 01 05 07 15 00 25 01 19 e0 29 e7 75 01 95 08 81 02 95 05 75 01 05 08 19 01 29 05 91 02 95 01 75 03 91 03 95 08 75 01 15 00 25 01 06 00 ff 09 03 81 03 95 06 75 08 15 00 25 [65] 05 07 19 00 29 [65] 81 00 95 01 75 01 15 00 25 01 05 0c 09 b8 81 02 95 01 75 01 06 01 ff 09 03 81 02 95 01 75 06 81 03 06 02 ff 09 55 85 55 15 00 26 ff 00 75 08 95 40 b1 a2 c0 06 00 ff 09 14 a1 01 85 90 05 84 75 01 95 03 15 00 25 01 09 61 05 85 09 44 09 46 81 02 95 05 81 01 75 08 95 01 15 00 26 ff 00 09 65 81 02 c0 00 Position 64(Logical Maximum) and 70(Usage Maximum) are 101. Both should be 0xE7 to support JIS specific keys(ろ, Eisu, Kana, |) support. position 117 is also 101 but not related(it is Usage 65h). There are no difference of product id between JIS and ANSI. They are same 0x0267. Signed-off-by: Mizuho Mori <morimolymoly@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-10-17 10:43:32 +02:00
Greg Kroah-Hartman	c23269dad5	This is the 5.10.71 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmFdqxMACgkQONu9yGCS aT4n8BAAt6WBtGY6OmnqqVDriJQxYPmF5oL+rpREdBRks97sinOCI4sAQS6NRb1T J8GUzwv1A2KbDOW+iky+XUhYV6wF6RFaiUnYbEAz0hbg+FEbJYBLcO98naJpReTr GnyjVEyMQ/NO/xDuJlguI3+6UHl6LPXmqoYR2XD77cwQiXEZW588VtbhtYoK4M8k r/Fh0bIbhS5CkWF7TYnzUD3ceSwHWq7N4yGK86s+yrkaeMJ0BsKeisOe4PW5JI3f iiqB4FJMbnNe412SdmYoPKfDcNWQbirJ4UnS1hdVslZMCyPktMiI2sRiVr1Euz45 zh221ObMIqyFK4attV809C2dtyqdI2Zt3maMCwtJWgOJOrpdeUpjyQ91cZ0WJcW0 2d0ZW0AqpkMpERFsHtcZNtkCBzLNcIgPu+yYJRlimG/Sh95VQWtMbtFsS0W5ZI5D F+2PC8cluXwGFLgHvxfkpas/KXVhv2w3m9x0xEgaWxZis31lKzQ4vRVzLewNqhJ9 C5S7Qb6qEVjRzY9CzT07AV66+faai2RZp1UtC0Lf+mbh4nW4JN0jDc2uxggZWGMb inTxl9LfIFFK0apCt6xvuEDPYvMwySKumeNJK3VMP2F3Py/PuZ4SW5Z/OH09+0/S liA2dMFBOp8h/AivWQ7qV7B/qGcpasn5ZRabIkLYiaF6zftpUmo= =ZCXg -----END PGP SIGNATURE----- Merge 5.10.71 into android12-5.10-lts Changes in 5.10.71 tty: Fix out-of-bound vmalloc access in imageblit cpufreq: schedutil: Use kobject release() method to free sugov_tunables scsi: qla2xxx: Changes to support kdump kernel for NVMe BFS cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory usb: cdns3: fix race condition before setting doorbell ALSA: hda/realtek: Quirks to enable speaker output for Lenovo Legion 7i 15IMHG05, Yoga 7i 14ITL5/15ITL5, and 13s Gen2 laptops. ACPI: NFIT: Use fallback node id when numa info in NFIT table is incorrect fs-verity: fix signed integer overflow with i_size near S64_MAX hwmon: (tmp421) handle I2C errors hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field gpio: pca953x: do not ignore i2c errors scsi: ufs: Fix illegal offset in UPIU event trace mac80211: fix use-after-free in CCMP/GCMP RX x86/kvmclock: Move this_cpu_pvti into kvmclock.h KVM: x86: Fix stack-out-of-bounds memory access from ioapic_write_indirect() KVM: x86: nSVM: don't copy virt_ext from vmcb12 KVM: nVMX: Filter out all unsupported controls when eVMCS was activated KVM: rseq: Update rseq when processing NOTIFY_RESUME on xfer to KVM guest media: ir_toy: prevent device from hanging during transmit RDMA/cma: Do not change route.addr.src_addr.ss_family drm/amd/display: Pass PCI deviceid into DC drm/amdgpu: correct initial cp_hqd_quantum for gfx9 ipvs: check that ip_vs_conn_tab_bits is between 8 and 20 bpf: Handle return value of BPF_PROG_TYPE_STRUCT_OPS prog IB/cma: Do not send IGMP leaves for sendonly Multicast groups RDMA/cma: Fix listener leak in rdma_cma_listen_on_all() failure bpf, mips: Validate conditional branch offsets hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug mac80211: limit injected vht mcs/nss in ieee80211_parse_tx_radiotap mac80211: mesh: fix potentially unaligned access mac80211-hwsim: fix late beacon hrtimer handling sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb mptcp: don't return sockets in foreign netns hwmon: (tmp421) report /PVLD condition as fault hwmon: (tmp421) fix rounding for negative values net: enetc: fix the incorrect clearing of IF_MODE bits net: ipv4: Fix rtnexthop len when RTA_FLOW is present smsc95xx: fix stalled rx after link change drm/i915/request: fix early tracepoints dsa: mv88e6xxx: 6161: Use chip wide MAX MTU dsa: mv88e6xxx: Fix MTU definition dsa: mv88e6xxx: Include tagger overhead when setting MTU for DSA and CPU ports e100: fix length calculation in e100_get_regs_len e100: fix buffer overrun in e100_get_regs RDMA/hns: Fix inaccurate prints bpf: Exempt CAP_BPF from checks against bpf_jit_limit selftests, bpf: Fix makefile dependencies on libbpf selftests, bpf: test_lwt_ip_encap: Really disable rp_filter net: ks8851: fix link error Revert "block, bfq: honor already-setup queue merges" scsi: csiostor: Add module softdep on cxgb4 ixgbe: Fix NULL pointer dereference in ixgbe_xdp_setup net: hns3: do not allow call hns3_nic_net_open repeatedly net: hns3: keep MAC pause mode when multiple TCs are enabled net: hns3: fix mixed flag HCLGE_FLAG_MQPRIO_ENABLE and HCLGE_FLAG_DCB_ENABLE net: hns3: fix show wrong state when add existing uc mac address net: hns3: fix prototype warning net: hns3: reconstruct function hns3_self_test net: hns3: fix always enable rx vlan filter problem after selftest net: phy: bcm7xxx: Fixed indirect MMD operations net: sched: flower: protect fl_walk() with rcu af_unix: fix races in sk_peer_pid and sk_peer_cred accesses perf/x86/intel: Update event constraints for ICX hwmon: (pmbus/mp2975) Add missed POUT attribute for page 1 mp2975 controller nvme: add command id quirk for apple controllers elf: don't use MAP_FIXED_NOREPLACE for elf interpreter mappings debugfs: debugfs_create_file_size(): use IS_ERR to check for error ipack: ipoctal: fix stack information leak ipack: ipoctal: fix tty registration race ipack: ipoctal: fix tty-registration error handling ipack: ipoctal: fix missing allocation-failure check ipack: ipoctal: fix module reference leak ext4: fix loff_t overflow in ext4_max_bitmap_size() ext4: limit the number of blocks in one ADD_RANGE TLV ext4: fix reserved space counter leakage ext4: add error checking to ext4_ext_replay_set_iblocks() ext4: fix potential infinite loop in ext4_dx_readdir() HID: u2fzero: ignore incomplete packets without data net: udp: annotate data race around udp_sk(sk)->corkflag ASoC: dapm: use component prefix when checking widget names usb: hso: remove the bailout parameter crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd() HID: betop: fix slab-out-of-bounds Write in betop_probe netfilter: ipset: Fix oversized kvmalloc() calls mm: don't allow oversized kvmalloc() calls HID: usbhid: free raw_report buffers in usbhid_stop KVM: x86: Handle SRCU initialization failure during page track init netfilter: conntrack: serialize hash resizes and cleanups netfilter: nf_tables: Fix oversized kvmalloc() calls Linux 5.10.71 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I238c3de739c3d4ba0a04a484460356161899f222	2021-10-06 17:33:06 +02:00
Anirudh Rayabharam	f7ac4d24e1	HID: usbhid: free raw_report buffers in usbhid_stop ... commit f7744fa16b upstream. Free the unsent raw_report buffers when the device is removed. Fixes a memory leak reported by syzbot at: https://syzkaller.appspot.com/bug?id=7b4fa7cb1a7c2d3342a2a8a6c53371c8c418ab47 Reported-by: syzbot+47b26cd837ececfc666d@syzkaller.appspotmail.com Tested-by: syzbot+47b26cd837ececfc666d@syzkaller.appspotmail.com Signed-off-by: Anirudh Rayabharam <mail@anirudhrb.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-10-06 15:56:03 +02:00
F.A.Sulaiman	dedfc35a2d	HID: betop: fix slab-out-of-bounds Write in betop_probe ... commit 1e4ce418b1 upstream. Syzbot reported slab-out-of-bounds Write bug in hid-betopff driver. The problem is the driver assumes the device must have an input report but some malicious devices violate this assumption. So this patch checks hid_device's input is non empty before it's been used. Reported-by: syzbot+07efed3bc5a1407bd742@syzkaller.appspotmail.com Signed-off-by: F.A. SULAIMAN <asha.16@itfac.mrt.ac.lk> Reviewed-by: Pavel Skripkin <paskripkin@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-10-06 15:56:03 +02:00