In function parameters, `u32 data[]` decays to `u32 *`, making
the array syntax misleading and triggering
-Wsizeof-array-argument warnings.
Replace the array-style parameter with an explicit pointer type
to match the actual semantics and silence the warning.
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
After backporting some tracing changes from 4.19, these macro are not
working anymore. While we should fix them, the reality is that we are not
using them anymore so we can safely remove them.
Signed-off-by: Roberto Sartori <roberto.sartori.android@gmail.com>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Roberto Sartoriauthored and Sorayukiicommited 2026-05-15 17:57:09 +07:00
This is a backport from Linux 5.2-rc1 of a patch series to greatly enhance vmalloc's performance
especially on embedded systems, plus all of its dependencies that were missing in kernel 4.9.
For all the informations, refer to LKML: https://lkml.org/lkml/2018/10/19/786
Brief informations:
Currently an allocation of the new VA area is done over busy list iteration until a suitable hole
is found between two busy areas. Therefore each new allocation causes the list being grown.
Due to long list and different permissive parameters an allocation can take a long time on
embedded devices(milliseconds).
This patch organizes the vmalloc memory layout into free areas of the VMALLOC_START-VMALLOC_END range.
It uses a red-black tree that keeps blocks sorted by their offsets in pair with linked list
keeping the free space in order of increasing addresses.
Quote Phoronix:
With this patch from Uladzislau Rezki, calling vmalloc() can take up to 67% less time compared
to the behavior on Linux 5.1 and prior, at least with tests done by the developer under QEMU.
Personal tests are showing that the device is more responsive when memory pressure is
high and when huge allocations are to be done, it's also noticeably faster in this case, like
when starting Chrome with more than 100 opened tabs after a system reboot (so, an
uncached complete load of it).
Shameless kanged from:
https://github.com/sonyxperiadev/kernel / Pull Request 2016
Signed-off-by: sweetyicecare <gabrielseedev@outlook.com>
Signed-off-by: Aoihara <veronicadisa6@gmail.com>
Signed-off-by: KangMamles <imzea69@gmail.com>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Angelo G. Del Regnoauthored and Sorayukiicommited 2026-05-15 17:48:25 +07:00
commit 8310ca94075e784bbb06593cd6c068ee6b6e4ca6 upstream.
DST_QUEUE_OFF_BASE is applied to offset/mem_offset on MMAP capture buffers
only for the VIDIOC_QUERYBUF ioctl, while the userspace fields (including
offset/mem_offset) are filled in for VIDIOC_{QUERY,PREPARE,Q,DQ}BUF
ioctls. This leads to differences in the values presented to userspace.
If userspace attempts to mmap the capture buffer directly using values
from DQBUF, it will fail.
Move the code that applies the magic offset into a helper, and call
that helper from all four ioctl entry points.
[hverkuil: drop unnecessary '= 0' in v4l2_m2m_querybuf() for ret]
Fixes: 7f98639def ("V4L/DVB: add memory-to-memory device helper framework for videobuf")
Fixes: 908a0d7c58 ("[media] v4l: mem2mem: port to videobuf2")
Change-Id: I5c71ead4403236508db99c04efc017e36364b7fe
Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
[OP: adjusted return logic for 4.14]
Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Chen-Yu Tsaiauthored and Michael Bestascommited 2026-02-05 19:45:36 +02:00
Validate the input fence for mdss and sde rotator before
referencing the structure objects.
and also log the fence driver name waiting for the fence.
Earlier the fence name was null irrespective of the
driver.
Change-Id: Ie277d861057a41092505c73ef3815f7d769d114e
Signed-off-by: Raghavendra Ambadas <quic_c_rambad@quicinc.com>
Raghavendra Ambadasauthored and Michael Bestascommited 2025-02-14 15:30:54 +02:00
This can lead to out of bounds writes since frames of this type were not
taken into account when calculating the size of the frames buffer in
uvc_parse_streaming.
Fixes: c0efd23292 ("V4L/DVB (8145a): USB Video Class driver")
Signed-off-by: Benoit Sevens <bsevens@google.com>
Cc: stable@vger.kernel.org
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 378455392
(cherry picked from commit ecf2b43018da9579842c774b7f35dbe11b5c38dd)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I959a6374ba7adf021fc19da755f5c7611fef9b8c
Benoit Sevensauthored and Michael Bestascommited 2025-02-06 16:16:59 +02:00
This feature seems to require updated venus firmware, as it breaks
vidc completely. As it's unlikely any SDM845 device will get a
firmware update, let's revert this change.
This reverts commit 07a303b15a.
Change-Id: I5d3397c9d90e9eae129dc555ef9acc1bafd7c473
"LA.UM.8.3.c25-08900-sdm845.0"
* tag 'LA.UM.8.3.c25-08900-sdm845.0' of https://git.codelinaro.org/clo/la/kernel/msm-4.9:
iommu: Fix missing return check of arm_lpae_init_pte
msm: vidc: modify allocation of hfi_cmd_sys_set_property_packet
msm: vidc: Dynamic resolution crop enable for SDM845
msm: vidc: Change minimum frame qp to 0
msm: vidc: Fix for dynamic resolution crop issue
msm: ADSPRPC: Add reference count for context map
msm: vidc: Fix max value of base layer pid
msm: kgsl: Prevent wrap around during user address mapping
bus: mhi: misc: Add check for dev_rp if it is iommu range or not
Conflicts:
drivers/char/adsprpc.c
drivers/gpu/msm/kgsl_iommu.c
Change-Id: Icddefe39498eaa0bfbb36128e5468e20e18f65d5
When CONFIG_DEBUG_FS is disabled, the call to
debugfs_create_dir will result in an error.
Add a check of the config to avoid the error.
Change-Id: I7a79dbc5c4c5e1e3192a11d55ad9b7994788f30f
Signed-off-by: ziqic <quic_ziqic_01@quicinc.com>
ziqicauthored and Michael Bestascommited 2023-12-12 01:48:08 +02:00
Enable dynamic resolution crop for SDM845 target.
When there is resolution changed firmware has to use
the latest SPS header instead of old SPS header.
Change-Id: I096e8170793cfa7742bcdd0eb5d236fe1077e502
Signed-off-by: Agnimitra Sen <quic_agnimitr@quicinc.com>
Frame QP value 0 is supported by firmware and hardware.
Driver should accept this value from userspace and pass
through.
CRs-Fixed: 2213967
Change-Id: Idf8dd773aab245f71f64f4639de55d5f9fb71b63
Signed-off-by: Chinmay Sawarkar <chinmays@codeaurora.org>
Chinmay Sawarkarauthored and Agnimitra Sencommited 2023-10-03 03:14:29 -07:00
Fix dynamic resolution crop issue for QCS605 target.
When there is resolution changed firmware has to use
the latest SPS header instead of old SPS header.
Change-Id: I245af34dd9fca4e6404374c609c5acb8a91e7197
Signed-off-by: Mahesh Voorugonda <quic_mvoorugo@quicinc.com>
Mahesh Voorugondaauthored and Agnimitra Sencommited 2023-10-03 15:36:26 +05:30
Increase the max allowed value of base layer pid
from 6 to 63 as per the spec.
Change-Id: Ie51de329a1f67633dd488bc15b3d37101a1a0b33
Signed-off-by: Mahesh Voorugonda <quic_mvoorugo@quicinc.com>
Mahesh Voorugondaauthored and Agnimitra Sencommited 2023-09-21 12:58:08 -07:00
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmO5Un4ACgkQONu9yGCS
aT4tjQ/+OkrmqBUWwmj+AzH/qKqB6LGqHKmSXNMI1zVvHO9ZR366702YrDnjdfYY
YtcI2AYuBHjpbSoXUBrSkGAeAE0upXtkk6qG0SaZb5kxihU2TRQ80i6P0WeB+2Ng
RYzKib1W6TV7QptMqf7e+LYmMkmhBDXEITGM9RuWJ0ilb1O+4UnA1pt3JvRMMCCl
8yAwon/S+zWFBYGVe8Pg8tf/ZxV7hvYMn+UToHU+E3ffd3JQUkJBW21l9UJRtoZl
X9yjr4JFXNh3W/ph8PRnq3b1d9SPHB/gOGkegOFzEla0lgx0w8IbJN3eKvEb4R7S
1TakEMAAn7MRpWtI5OlyhxismaorisrHd9+zKe21WTZYkOU2sljgkRRqq1fsGwD5
XrqYShUX0N19M8W2X3yPod7XDPooF/r8RGESG/WRvgfjTyxSXnA5GRDT93eCXIsJ
7wFOqSBZLUn6GJ0W5t4+lLZWSgoUXVbSVxGi3EdYn4lU2dxSWmo9rMX1j0C2y8IV
SmbsyG1l4Um6dJKTK/XWuxR6EKOvKfk/K5WALKjE1xho25gFlHRnpvtcOQ6246cC
PbC9ZjkrM8uojMElLTy3ZQwwVz01OPl6vKYPWFkdTy5IpwgnVbztdzwJ9uzz91oh
75gKoI9tVArkQF54GDCC5AU2fnJOijleWq8iMcpXGBNSCIavan0=
=+wRq
-----END PGP SIGNATURE-----
Merge 4.9.337 into android-4.9-q
Changes in 4.9.337
mm/khugepaged: fix GUP-fast interaction by sending IPI
mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths
block: unhash blkdev part inode when the part is deleted
ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx()
can: sja1000: fix size of OCR_MODE_MASK define
ASoC: ops: Correct bounds check for second channel on SX controls
udf: Discard preallocation before extending file with a hole
udf: Drop unused arguments of udf_delete_aext()
udf: Fix preallocation discarding at indirect extent boundary
udf: Do not bother looking for prealloc extents if i_lenExtents matches i_size
udf: Fix extending file within last block
usb: gadget: uvc: Prevent buffer overflow in setup handler
USB: serial: cp210x: add Kamstrup RF sniffer PIDs
Bluetooth: L2CAP: Fix u8 overflow
net: loopback: use NET_NAME_PREDICTABLE for name_assign_type
drivers: soc: ti: knav_qmss_queue: Mark knav_acc_firmwares as static
arm: dts: spear600: Fix clcd interrupt
soc: ti: smartreflex: Fix PM disable depth imbalance in omap_sr_probe
ARM: dts: dove: Fix assigned-addresses for every PCIe Root Port
ARM: dts: armada-370: Fix assigned-addresses for every PCIe Root Port
ARM: dts: armada-xp: Fix assigned-addresses for every PCIe Root Port
ARM: dts: armada-375: Fix assigned-addresses for every PCIe Root Port
ARM: dts: armada-38x: Fix assigned-addresses for every PCIe Root Port
ARM: dts: armada-39x: Fix assigned-addresses for every PCIe Root Port
ARM: mmp: fix timer_read delay
pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP
cpuidle: dt: Return the correct numbers of parsed idle states
alpha: fix syscall entry in !AUDUT_SYSCALL case
PM: hibernate: Fix mistake in kerneldoc comment
fs: don't audit the capability check in simple_xattr_list()
perf: Fix possible memleak in pmu_dev_alloc()
timerqueue: Use rb_entry_safe() in timerqueue_getnext()
ocfs2: fix memory leak in ocfs2_stack_glue_init()
MIPS: vpe-mt: fix possible memory leak while module exiting
MIPS: vpe-cmp: fix possible memory leak while module exiting
PNP: fix name memory leak in pnp_alloc_dev()
irqchip: gic-pm: Use pm_runtime_resume_and_get() in gic_probe()
libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value
lib/notifier-error-inject: fix error when writing -errno to debugfs file
rapidio: fix possible name leaks when rio_add_device() fails
rapidio: rio: fix possible name leak in rio_register_mport()
ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage()
uprobes/x86: Allow to probe a NOP instruction with 0x66 prefix
x86/xen: Fix memory leak in xen_init_lock_cpu()
MIPS: BCM63xx: Add check for NULL for clk in clk_enable
fs: sysv: Fix sysv_nblocks() returns wrong value
rapidio: fix possible UAF when kfifo_alloc() fails
eventfd: change int to __u64 in eventfd_signal() ifndef CONFIG_EVENTFD
hfs: Fix OOB Write in hfs_asc2mac
rapidio: devices: fix missing put_device in mport_cdev_open
wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs()
wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()
media: i2c: ad5820: Fix error path
media: vivid: fix compose size exceed boundary
mtd: Fix device name leak when register device failed in add_mtd_device()
ASoC: pxa: fix null-pointer dereference in filter()
regulator: core: fix unbalanced of node refcount in regulator_dev_lookup()
ima: Fix misuse of dereference of pointer in template_desc_init_fields()
wifi: ath10k: Fix return value in ath10k_pci_init()
mtd: lpddr2_nvm: Fix possible null-ptr-deref
Input: elants_i2c - properly handle the reset GPIO when power is off
media: solo6x10: fix possible memory leak in solo_sysfs_init()
media: platform: exynos4-is: Fix error handling in fimc_md_init()
HID: hid-sensor-custom: set fixed size for custom attributes
ALSA: seq: fix undefined behavior in bit shift for SNDRV_SEQ_FILTER_USE_EVENT
clk: rockchip: Fix memory leak in rockchip_clk_register_pll()
mtd: maps: pxa2xx-flash: fix memory leak in probe
media: imon: fix a race condition in send_packet()
pinctrl: pinconf-generic: add missing of_node_put()
media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()
NFSv4.2: Fix a memory stomp in decode_attr_security_label
NFSv4: Fix a deadlock between nfs4_open_recover_helper() and delegreturn
ALSA: asihpi: fix missing pci_disable_device()
drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios()
drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios()
ASoC: pcm512x: Fix PM disable depth imbalance in pcm512x_probe
bonding: uninitialized variable in bond_miimon_inspect()
regulator: core: fix module refcount leak in set_supply()
media: saa7164: fix missing pci_disable_device()
ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt
SUNRPC: Fix missing release socket in rpc_sockname()
mmc: moxart: fix return value check of mmc_add_host()
mmc: mxcmmc: fix return value check of mmc_add_host()
mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host()
mmc: toshsd: fix return value check of mmc_add_host()
mmc: vub300: fix return value check of mmc_add_host()
mmc: via-sdmmc: fix return value check of mmc_add_host()
mmc: wbsd: fix return value check of mmc_add_host()
mmc: mmci: fix return value check of mmc_add_host()
media: c8sectpfe: Add of_node_put() when breaking out of loop
media: coda: Add check for dcoda_iram_alloc
media: coda: Add check for kmalloc
wifi: rtl8xxxu: Add __packed to struct rtl8723bu_c2h
wifi: brcmfmac: Fix error return code in brcmf_sdio_download_firmware()
blktrace: Fix output non-blktrace event when blk_classic option enabled
net: vmw_vsock: vmci: Check memcpy_from_msg()
net: defxx: Fix missing err handling in dfx_init()
drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init()
ethernet: s2io: don't call dev_kfree_skb() under spin_lock_irqsave()
net: farsync: Fix kmemleak when rmmods farsync
net/tunnel: wait until all sk_user_data reader finish before releasing the sock
net: apple: mace: don't call dev_kfree_skb() under spin_lock_irqsave()
net: apple: bmac: don't call dev_kfree_skb() under spin_lock_irqsave()
net: emaclite: don't call dev_kfree_skb() under spin_lock_irqsave()
net: ethernet: dnet: don't call dev_kfree_skb() under spin_lock_irqsave()
hamradio: don't call dev_kfree_skb() under spin_lock_irqsave()
net: amd: lance: don't call dev_kfree_skb() under spin_lock_irqsave()
ntb_netdev: Use dev_kfree_skb_any() in interrupt context
Bluetooth: btusb: don't call kfree_skb() under spin_lock_irqsave()
Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave()
Bluetooth: hci_h5: don't call kfree_skb() under spin_lock_irqsave()
Bluetooth: hci_bcsp: don't call kfree_skb() under spin_lock_irqsave()
Bluetooth: hci_core: don't call kfree_skb() under spin_lock_irqsave()
stmmac: fix potential division by 0
scsi: hpsa: Fix error handling in hpsa_add_sas_host()
scsi: hpsa: Fix possible memory leak in hpsa_add_sas_device()
scsi: fcoe: Fix possible name leak when device_register() fails
scsi: ipr: Fix WARNING in ipr_init()
scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails
scsi: snic: Fix possible UAF in snic_tgt_create()
orangefs: Fix sysfs not cleanup when dev init failed
crypto: img-hash - Fix variable dereferenced before check 'hdev->req'
hwrng: amd - Fix PCI device refcount leak
hwrng: geode - Fix PCI device refcount leak
IB/IPoIB: Fix queue count inconsistency for PKEY child interfaces
drivers: dio: fix possible memory leak in dio_init()
vfio: platform: Do not pass return buffer to ACPI _RST method
uio: uio_dmem_genirq: Fix missing unlock in irq configuration
uio: uio_dmem_genirq: Fix deadlock between irq config and handling
usb: fotg210-udc: Fix ages old endianness issues
staging: vme_user: Fix possible UAF in tsi148_dma_list_add
serial: amba-pl011: avoid SBSA UART accessing DMACR register
serial: pch: Fix PCI device refcount leak in pch_request_dma()
serial: sunsab: Fix error handling in sunsab_init()
misc: tifm: fix possible memory leak in tifm_7xx1_switch_media()
misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os
cxl: fix possible null-ptr-deref in cxl_guest_init_afu|adapter()
cxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter()
drivers: mcb: fix resource leak in mcb_probe()
mcb: mcb-parse: fix error handing in chameleon_parse_gdd()
chardev: fix error handling in cdev_device_add()
i2c: pxa-pci: fix missing pci_disable_device() on error in ce4100_i2c_probe
staging: rtl8192u: Fix use after free in ieee80211_rx()
staging: rtl8192e: Fix potential use-after-free in rtllib_rx_Monitor()
vme: Fix error not catched in fake_init()
i2c: ismt: Fix an out-of-bounds bug in ismt_access()
usb: storage: Add check for kcalloc
fbdev: ssd1307fb: Drop optional dependency
fbdev: pm2fb: fix missing pci_disable_device()
fbdev: via: Fix error in via_core_init()
fbdev: vermilion: decrease reference count in error path
fbdev: uvesafb: Fixes an error handling path in uvesafb_probe()
HSI: omap_ssi_core: fix unbalanced pm_runtime_disable()
HSI: omap_ssi_core: fix possible memory leak in ssi_probe()
power: supply: fix residue sysfs file in error handle route of __power_supply_register()
HSI: omap_ssi_core: Fix error handling in ssi_init()
include/uapi/linux/swab: Fix potentially missing __always_inline
rtc: snvs: Allow a time difference on clock register read
iommu/fsl_pamu: Fix resource leak in fsl_pamu_probe()
macintosh: fix possible memory leak in macio_add_one_device()
macintosh/macio-adb: check the return value of ioremap()
powerpc/52xx: Fix a resource leak in an error handling path
powerpc/perf: callchain validate kernel stack pointer bounds
powerpc/83xx/mpc832x_rdb: call platform_device_put() in error case in of_fsl_spi_probe()
powerpc/hv-gpci: Fix hv_gpci event list
selftests/powerpc: Fix resource leaks
rtc: st-lpc: Add missing clk_disable_unprepare in st_rtc_probe()
nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure
mISDN: hfcsusb: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()
mISDN: hfcpci: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()
mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()
nfc: pn533: Clear nfc_target before being used
r6040: Fix kmemleak in probe and remove
openvswitch: Fix flow lookup to use unmasked key
skbuff: Account for tail adjustment during pull operations
net_sched: reject TCF_EM_SIMPLE case for complex ematch module
myri10ge: Fix an error handling path in myri10ge_probe()
net: stream: purge sk_error_queue in sk_stream_kill_queues()
binfmt_misc: fix shift-out-of-bounds in check_special_flags
fs: jfs: fix shift-out-of-bounds in dbAllocAG
udf: Avoid double brelse() in udf_rename()
fs: jfs: fix shift-out-of-bounds in dbDiscardAG
ACPICA: Fix error code path in acpi_ds_call_control_method()
nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset()
acct: fix potential integer overflow in encode_comp_t()
hfs: fix OOB Read in __hfs_brec_find
wifi: ath9k: verify the expected usb_endpoints are present
wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out
ipmi: fix memleak when unload ipmi driver
net: ethernet: ti: Fix return type of netcp_ndo_start_xmit()
hamradio: baycom_epp: Fix return type of baycom_send_packet()
wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request()
igb: Do not free q_vector unless new one was allocated
s390/ctcm: Fix return type of ctc{mp,}m_tx()
s390/netiucv: Fix return type of netiucv_tx()
s390/lcs: Fix return type of lcs_start_xmit()
drm/sti: Use drm_mode_copy()
md/raid1: stop mdx_raid1 thread when raid1 array run failed
mrp: introduce active flags to prevent UAF when applicant uninit
ppp: associate skb with a device at tx
media: dvb-frontends: fix leak of memory fw
media: dvb-usb: fix memory leak in dvb_usb_adapter_init()
blk-mq: fix possible memleak when register 'hctx' failed
mmc: f-sdh30: Add quirks for broken timeout clock capability
media: si470x: Fix use-after-free in si470x_int_in_callback()
clk: st: Fix memory leak in st_of_quadfs_setup()
drm/fsl-dcu: Fix return type of fsl_dcu_drm_connector_mode_valid()
drm/sti: Fix return type of sti_{dvo,hda,hdmi}_connector_mode_valid()
orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string()
ASoC: mediatek: mt8173-rt5650-rt5514: fix refcount leak in mt8173_rt5650_rt5514_dev_probe()
ASoC: wm8994: Fix potential deadlock
ASoC: rockchip: spdif: Add missing clk_disable_unprepare() in rk_spdif_runtime_resume()
ASoC: rt5670: Remove unbalanced pm_runtime_put()
HID: wacom: Ensure bootloader PID is usable in hidraw mode
reiserfs: Add missing calls to reiserfs_security_free()
iio: adc: ad_sigma_delta: do not use internal iio_dev lock
gcov: add support for checksum field
powerpc/rtas: avoid scheduling in rtas_os_term()
HID: plantronics: Additional PIDs for double volume key presses quirk
hfsplus: fix bug causing custom uid and gid being unable to be assigned with mount
ALSA: line6: correct midi status byte when receiving data from podxt
ALSA: line6: fix stack overflow in line6_midi_transmit
pnode: terminate at peers of source
md: fix a crash in mempool_free
mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING
media: stv0288: use explicitly signed char
ktest.pl minconfig: Unset configs instead of just removing them
ARM: ux500: do not directly dereference __iomem
dm cache: Fix ABBA deadlock between shrink_slab and dm_cache_metadata_abort
dm thin: Use last transaction's pmd->root when commit failed
dm thin: Fix UAF in run_timer_softirq()
dm cache: Fix UAF in destroy()
dm cache: set needs_check flag after aborting metadata
tracing: Fix infinite loop in tracing_read_pipe on overflowed print_trace_line
ARM: 9256/1: NWFPE: avoid compiler-generated __aeabi_uldivmod
media: dvb-core: Fix double free in dvb_register_device()
cifs: fix confusing debug message
PCI/sysfs: Fix double free in error path
crypto: n2 - add missing hash statesize
iommu/amd: Fix ivrs_acpihid cmdline parsing code
parisc: led: Fix potential null-ptr-deref in start_task()
device_cgroup: Roll back to original exceptions after copy failure
drm/connector: send hotplug uevent on connector cleanup
drm/vmwgfx: Validate the box size for the snooped cursor
ext4: add inode table check in __ext4_get_inode_loc to aovid possible infinite loop
ext4: fix undefined behavior in bit shift for ext4_check_flag_values
ext4: fix bug_on in __es_tree_search caused by bad boot loader inode
ext4: init quota for 'old.inode' in 'ext4_rename'
ext4: fix error code return to user-space in ext4_get_branch()
ext4: avoid BUG_ON when creating xattrs
ext4: initialize quota before expanding inode in setproject ioctl
Linux 4.9.337
Change-Id: I923e3fef499ae1688b25c70a1a805b55a9f4f027
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
commit 6b0d0477fce747d4137aa65856318b55fba72198 upstream.
In function dvb_register_device() -> dvb_register_media_device() ->
dvb_create_media_entity(), dvb->entity is allocated and initialized. If
the initialization fails, it frees the dvb->entity, and return an error
code. The caller takes the error code and handles the error by calling
dvb_media_device_free(), which unregisters the entity and frees the
field again if it is not NULL. As dvb->entity may not NULLed in
dvb_create_media_entity() when the allocation of dvbdev->pad fails, a
double free may occur. This may also cause an Use After free in
media_device_unregister_entity().
Fix this by storing NULL to dvb->entity when it is freed.
Link: https://lore.kernel.org/linux-media/20220426052921.2088416-1-keitasuzuki.park@sslab.ics.keio.ac.jp
Fixes: fcd5ce4b3936 ("media: dvb-core: fix a memory leak bug")
Cc: stable@vger.kernel.org
Cc: Wenwen Wang <wenwen@cs.uga.edu>
Signed-off-by: Keita Suzuki <keitasuzuki.park@sslab.ics.keio.ac.jp>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Keita Suzukiauthored and Greg Kroah-Hartmancommited 2023-01-07 12:07:36 +01:00
commit 7392134428c92a4cb541bd5c8f4f5c8d2e88364d upstream.
With char becoming unsigned by default, and with `char` alone being
ambiguous and based on architecture, signed chars need to be marked
explicitly as such. Use `s8` and `u8` types here, since that's what
surrounding code does. This fixes:
drivers/media/dvb-frontends/stv0288.c:471 stv0288_set_frontend() warn: assigning (-9) to unsigned variable 'tm'
drivers/media/dvb-frontends/stv0288.c:471 stv0288_set_frontend() warn: we never enter this loop
Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
Cc: linux-media@vger.kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Jason A. Donenfeldauthored and Greg Kroah-Hartmancommited 2023-01-07 12:07:35 +01:00
[ Upstream commit 7d21e0b1b41b21d628bf2afce777727bd4479aa5 ]
syzbot reported use-after-free in si470x_int_in_callback() [1]. This
indicates that urb->context, which contains struct si470x_device
object, is freed when si470x_int_in_callback() is called.
The cause of this issue is that si470x_int_in_callback() is called for
freed urb.
si470x_usb_driver_probe() calls si470x_start_usb(), which then calls
usb_submit_urb() and si470x_start(). If si470x_start_usb() fails,
si470x_usb_driver_probe() doesn't kill urb, but it just frees struct
si470x_device object, as depicted below:
si470x_usb_driver_probe()
...
si470x_start_usb()
...
usb_submit_urb()
retval = si470x_start()
return retval
if (retval < 0)
free struct si470x_device object, but don't kill urb
This patch fixes this issue by killing urb when si470x_start_usb()
fails and urb is submitted. If si470x_start_usb() fails and urb is
not submitted, i.e. submitting usb fails, it just frees struct
si470x_device object.
Reported-by: syzbot+9ca7a12fd736d93e0232@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?id=94ed6dddd5a55e90fd4bab942aa4bb297741d977 [1]
Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Shigeru Yoshidaauthored and Greg Kroah-Hartmancommited 2023-01-07 12:07:33 +01:00
[ Upstream commit 94d90fb06b94a90c176270d38861bcba34ce377d ]
Syzbot reports a memory leak in "dvb_usb_adapter_init()".
The leak is due to not accounting for and freeing current iteration's
adapter->priv in case of an error. Currently if an error occurs,
it will exit before incrementing "num_adapters_initalized",
which is used as a reference counter to free all adap->priv
in "dvb_usb_adapter_exit()". There are multiple error paths that
can exit from before incrementing the counter. Including the
error handling paths for "dvb_usb_adapter_stream_init()",
"dvb_usb_adapter_dvb_init()" and "dvb_usb_adapter_frontend_init()"
within "dvb_usb_adapter_init()".
This means that in case of an error in any of these functions the
current iteration is not accounted for and the current iteration's
adap->priv is not freed.
Fix this by freeing the current iteration's adap->priv in the
"stream_init_err:" label in the error path. The rest of the
(accounted for) adap->priv objects are freed in dvb_usb_adapter_exit()
as expected using the num_adapters_initalized variable.
Syzbot report:
BUG: memory leak
unreferenced object 0xffff8881172f1a00 (size 512):
comm "kworker/0:2", pid 139, jiffies 4294994873 (age 10.960s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff844af012>] dvb_usb_adapter_init drivers/media/usb/dvb-usb/dvb-usb-init.c:75 [inline]
[<ffffffff844af012>] dvb_usb_init drivers/media/usb/dvb-usb/dvb-usb-init.c:184 [inline]
[<ffffffff844af012>] dvb_usb_device_init.cold+0x4e5/0x79e drivers/media/usb/dvb-usb/dvb-usb-init.c:308
[<ffffffff830db21d>] dib0700_probe+0x8d/0x1b0 drivers/media/usb/dvb-usb/dib0700_core.c:883
[<ffffffff82d3fdc7>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
[<ffffffff8274ab37>] call_driver_probe drivers/base/dd.c:542 [inline]
[<ffffffff8274ab37>] really_probe.part.0+0xe7/0x310 drivers/base/dd.c:621
[<ffffffff8274ae6c>] really_probe drivers/base/dd.c:583 [inline]
[<ffffffff8274ae6c>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:752
[<ffffffff8274af6a>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:782
[<ffffffff8274b786>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:899
[<ffffffff82747c87>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
[<ffffffff8274b352>] __device_attach+0x122/0x260 drivers/base/dd.c:970
[<ffffffff827498f6>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:487
[<ffffffff82745cdb>] device_add+0x5fb/0xdf0 drivers/base/core.c:3405
[<ffffffff82d3d202>] usb_set_configuration+0x8f2/0xb80 drivers/usb/core/message.c:2170
[<ffffffff82d4dbfc>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
[<ffffffff82d3f49c>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293
[<ffffffff8274ab37>] call_driver_probe drivers/base/dd.c:542 [inline]
[<ffffffff8274ab37>] really_probe.part.0+0xe7/0x310 drivers/base/dd.c:621
[<ffffffff8274ae6c>] really_probe drivers/base/dd.c:583 [inline]
[<ffffffff8274ae6c>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:752
Link: https://syzkaller.appspot.com/bug?extid=f66dd31987e6740657be
Reported-and-tested-by: syzbot+f66dd31987e6740657be@syzkaller.appspotmail.com
Link: https://lore.kernel.org/linux-media/20220824012152.539788-1-mazinalhaddad05@gmail.com
Signed-off-by: Mazin Al Haddad <mazinalhaddad05@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Mazin Al Haddadauthored and Greg Kroah-Hartmancommited 2023-01-07 12:07:33 +01:00
[ Upstream commit 6e5e5defdb8b0186312c2f855ace175aee6daf9b ]
As the kmalloc may return NULL pointer,
it should be better to check the return value
in order to avoid NULL poineter dereference,
same as the others.
Fixes: cb1d3a3363 ("[media] coda: add CODA7541 JPEG support")
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Jiasheng Jiangauthored and Greg Kroah-Hartmancommited 2023-01-07 12:07:20 +01:00
[ Upstream commit 6b8082238fb8bb20f67e46388123e67a5bbc558d ]
As the coda_iram_alloc may return NULL pointer,
it should be better to check the return value
in order to avoid NULL poineter dereference,
same as the others.
Fixes: b313bcc9a4 ("[media] coda: simplify IRAM setup")
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Jiasheng Jiangauthored and Greg Kroah-Hartmancommited 2023-01-07 12:07:20 +01:00
[ Upstream commit 63ff05a1ad242a5a0f897921c87b70d601bda59c ]
In configure_channels(), we should call of_node_put() when breaking
out of for_each_child_of_node() which will automatically increase
and decrease the refcount.
Fixes: c5f5d0f997 ("[media] c8sectpfe: STiH407/10 Linux DVB demux support")
Signed-off-by: Liang He <windhl@126.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Liang Heauthored and Greg Kroah-Hartmancommited 2023-01-07 12:07:20 +01:00
[ Upstream commit 813ceef062b53d68f296aa3cb944b21a091fabdb ]
The function send_packet() has a race condition as follows:
func send_packet()
{
// do work
call usb_submit_urb()
mutex_unlock()
wait_for_event_interruptible() <-- lock gone
mutex_lock()
}
func vfd_write()
{
mutex_lock()
call send_packet() <- prev call is not completed
mutex_unlock()
}
When the mutex is unlocked and the function send_packet() waits for the
call to complete, vfd_write() can start another call, which leads to the
"URB submitted while active" warning in usb_submit_urb().
Fix this by removing the mutex_unlock() call in send_packet() and using
mutex_lock_interruptible().
Link: https://syzkaller.appspot.com/bug?id=e378e6a51fbe6c5cc43e34f131cc9a315ef0337e
Fixes: 21677cfc56 ("V4L/DVB: ir-core: add imon driver")
Reported-by: syzbot+0c3cb6dc05fbbdc3ad66@syzkaller.appspotmail.com
Signed-off-by: Gautam Menghani <gautammenghani201@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Gautam Menghaniauthored and Greg Kroah-Hartmancommited 2023-01-07 12:07:17 +01:00
[ Upstream commit b434422c45282a0573d8123239abc41fa72665d4 ]
A problem about modprobe s5p_fimc failed is triggered with the
following log given:
[ 272.075275] Error: Driver 'exynos4-fimc' is already registered, aborting...
modprobe: ERROR: could not insert 's5p_fimc': Device or resource busy
The reason is that fimc_md_init() returns platform_driver_register()
directly without checking its return value, if platform_driver_register()
failed, it returns without unregister fimc_driver, resulting the
s5p_fimc can never be installed later.
A simple call graph is shown as below:
fimc_md_init()
fimc_register_driver() # register fimc_driver
platform_driver_register()
platform_driver_register()
driver_register()
bus_add_driver()
dev = kzalloc(...) # OOM happened
# return without unregister fimc_driver
Fix by unregister fimc_driver when platform_driver_register() returns
error.
Fixes: d3953223b0 ("[media] s5p-fimc: Add the media device driver")
Signed-off-by: Yuan Can <yuancan@huawei.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Yuan Canauthored and Greg Kroah-Hartmancommited 2023-01-07 12:07:17 +01:00
[ Upstream commit 7f5866dd96d95b74e439f6ee17b8abd8195179fb ]
If device_register() returns error in solo_sysfs_init(), the
name allocated by dev_set_name() need be freed. As comment of
device_register() says, it should use put_device() to give up
the reference in the error path. So fix this by calling
put_device(), then the name can be freed in kobject_cleanup().
Fixes: dcae5dacbc ("[media] solo6x10: sync to latest code from Bluecherry's git repo")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Yang Yingliangauthored and Greg Kroah-Hartmancommited 2023-01-07 12:07:17 +01:00
[ Upstream commit 9fce241660f37d9e95e93c0ae6fba8cfefa5797b ]
Error path seems to be swaped. Fix the order and provide some meaningful
names.
Fixes: bee3d51156 ("[media] ad5820: Add driver for auto-focus coil")
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Ricardo Ribaldaauthored and Greg Kroah-Hartmancommited 2023-01-07 12:07:16 +01:00
* common/android-4.9-q:
Linux 4.9.335
v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() fails
proc: proc_skip_spaces() shouldn't think it is working on C strings
proc: avoid integer type confusion in get_proc_long
x86/ioremap: Fix page aligned size calculation in __ioremap_caller()
Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM
x86/pm: Add enumeration check before spec MSRs save/restore setup
x86/tsx: Add a feature bit for TSX control MSR support
Revert "fbdev: fb_pm2fb: Avoid potential divide by zero error"
tcp/udp: Fix memory leak in ipv6_renew_options().
iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init()
pinctrl: single: Fix potential division by zero
ASoC: ops: Fix bounds check for _sx controls
arm64: errata: Fix KVM Spectre-v2 mitigation selection for Cortex-A57/A72
arm64: Fix panic() when Spectre-v2 causes Spectre-BHB to re-allocate KVM vectors
nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()
tools/vm/slabinfo-gnuplot: use "grep -E" instead of "egrep"
btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit()
hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()
hwmon: (coretemp) Check for null before removing sysfs attrs
net: ethernet: renesas: ravb: Fix promiscuous mode after system resumed
packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE
net: hsr: Fix potential use-after-free
net/9p: Fix a potential socket leak in p9_socket_open
net: net_netdev: Fix error handling in ntb_netdev_init_module()
net: phy: fix null-ptr-deref while probe() failed
qlcnic: fix sleep-in-atomic-context bugs caused by msleep
can: cc770: cc770_isa_probe(): add missing free_cc770dev()
can: sja1000_isa: sja1000_isa_probe(): add missing free_sja1000dev()
net/mlx5: Fix uninitialized variable bug in outlen_write()
hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails
hwmon: (i5500_temp) fix missing pci_disable_device()
iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw
iio: health: afe4403: Fix oob read in afe4403_read_raw
drm/amdgpu: always register an MMU notifier for userptr
net: usb: qmi_wwan: add Telit 0x103a composition
tcp: configurable source port perturb table size
platform/x86: asus-wmi: add missing pci_dev_put() in asus_wmi_set_xusb2pr()
xen/platform-pci: add missing free_irq() in error path
serial: 8250: 8250_omap: Avoid RS485 RTS glitch on ->set_termios()
nilfs2: fix nilfs_sufile_mark_dirty() not set segment usage as dirty
nios2: add FORCE for vmlinuz.gz
kconfig: display recursive dependency resolution hint just once
iio: core: Fix entry not deleted when iio_register_sw_trigger_type() fails
iio: light: apds9960: fix wrong register for gesture gain
s390/crashdump: fix TOD programmable field size
net: thunderx: Fix the ACPI memory leak
nfc: st-nci: fix memory leaks in EVT_TRANSACTION
nfc: st-nci: fix incorrect validating logic in EVT_TRANSACTION
NFC: nci: fix memory leak in nci_rx_data_packet()
xfrm: Fix ignored return value in xfrm6_init()
net/qla3xxx: fix potential memleak in ql3xxx_send()
net/mlx4: Check retval of mlx4_bitmap_init
ARM: mxs: fix memory leak in mxs_machine_init()
9p/fd: fix issue of list_del corruption in p9_fd_cancel()
net: pch_gbe: fix potential memleak in pch_gbe_tx_queue()
nfc/nci: fix race with opening and closing
ARM: dts: at91: sam9g20ek: enable udc vbus gpio pinctrl
bus: sunxi-rsb: Support atomic transfers
af_key: Fix send_acquire race with pfkey_register
MIPS: pic32: treat port as signed integer
wifi: mac80211: Fix ack frame idr leak when mesh has no route
audit: fix undefined behavior in bit shift for AUDIT_BIT
wifi: mac80211_hwsim: fix debugfs attribute ps with rc table support
Linux 4.9.334
ntfs: check overflow when iterating ATTR_RECORDs
ntfs: fix out-of-bounds read in ntfs_attr_find()
ntfs: fix use-after-free in ntfs_attr_find()
mm: fs: initialize fsdata passed to write_begin/write_end interface
9p/trans_fd: always use O_NONBLOCK read/write
gfs2: Switch from strlcpy to strscpy
gfs2: Check sb_bsize_shift after reading superblock
9p: trans_fd/p9_conn_cancel: drop client lock earlier
kcm: avoid potential race in kcm_tx_work
tcp: cdg: allow tcp_cdg_release() to be called multiple times
serial: 8250: Flush DMA Rx on RLSI
nilfs2: fix use-after-free bug of ns_writer on remount
misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
mmc: core: properly select voltage range without power cycle
serial: 8250_lpss: Configure DMA also w/o DMA filter
serial: 8250: Fall back to non-DMA Rx if IIR_RDI occurs
dm ioctl: fix misbehavior if list_versions races with module loading
iio: pressure: ms5611: changed hardcoded SPI speed to value limited
iio: trigger: sysfs: fix possible memory leak in iio_sysfs_trig_init()
iio: adc: at91_adc: fix possible memory leak in at91_adc_allocate_trigger()
usb: chipidea: fix deadlock in ci_otg_del_timer
usb: add NO_LPM quirk for Realforce 87U Keyboard
USB: serial: option: add Fibocom FM160 0x0111 composition
USB: serial: option: add u-blox LARA-L6 modem
USB: serial: option: add u-blox LARA-R6 00B modem
USB: serial: option: remove old LARA-R6 PID
USB: serial: option: add Sierra Wireless EM9191
ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open()
ring_buffer: Do not deactivate non-existant pages
ftrace: Optimize the allocation for mcount entries
ftrace: Fix the possible incorrect kernel message
cifs: Fix wrong return value checking when GETFLAGS
net/x25: Fix skb leak in x25_lapb_receive_frame()
xen/pcpu: fix possible memory leak in register_pcpu()
net: caif: fix double disconnect client in chnl_net_open()
mISDN: fix misuse of put_device() in mISDN_register_device()
mISDN: fix possible memory leak in mISDN_dsp_element_register()
pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map
parport_pc: Avoid FIFO port location truncation
ASoC: soc-utils: Remove __exit for snd_soc_util_exit()
tty: n_gsm: fix sleep-in-atomic-context bug in gsm_control_send
serial: 8250: omap: Flush PM QOS work on remove
serial: 8250_omap: remove wait loop from Errata i202 workaround
ASoC: core: Fix use-after-free in snd_soc_exit()
Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm
drm/imx: imx-tve: Fix return type of imx_tve_connector_mode_valid
x86/cpu: Restore AMD's DE_CFG MSR after resume
dmaengine: at_hdmac: Check return code of dma_async_device_register
dmaengine: at_hdmac: Fix impossible condition
dmaengine: at_hdmac: Don't allow CPU to reorder channel enable
dmaengine: at_hdmac: Fix completion of unissued descriptor in case of errors
dmaengine: at_hdmac: Don't start transactions at tx_submit level
dmaengine: at_hdmac: Fix at_lli struct definition
cert host tools: Stop complaining about deprecated OpenSSL functions
udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
btrfs: selftests: fix wrong error check in btrfs_free_dummy_root()
platform/x86: hp_wmi: Fix rfkill causing soft blocked wifi
nilfs2: fix deadlock in nilfs_count_free_blocks()
ALSA: usb-audio: Add quirk entry for M-Audio Micro
ALSA: hda: fix potential memleak in 'add_widget_node'
net: macvlan: fix memory leaks of macvlan_common_newlink
net: mv643xx_eth: disable napi when init rxq or txq failed in mv643xx_eth_open()
ethernet: s2io: disable napi when start nic failed in s2io_card_up()
net: cxgb3_main: disable napi when bind qsets failed in cxgb_up()
drivers: net: xgene: disable napi when register irq failed in xgene_enet_open()
dmaengine: mv_xor_v2: Fix a resource leak in mv_xor_v2_remove()
tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header
ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network
hamradio: fix issue of dev reference count leakage in bpq_device_event()
net: lapbether: fix issue of dev reference count leakage in lapbeth_device_event()
capabilities: fix undefined behavior in bit shift for CAP_TO_MASK
net: fman: Unregister ethernet device on removal
bnxt_en: fix potentially incorrect return value for ndo_rx_flow_steer
net: gso: fix panic on frag_list with mixed head alloc types
HID: hyperv: fix possible memory leak in mousevsc_probe()
Linux 4.9.333
wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker()
KVM: x86: emulator: update the emulation mode after CR0 write
KVM: x86: emulator: introduce emulator_recalc_and_set_mode
KVM: x86: emulator: em_sysexit should update ctxt->mode
KVM: x86: Mask off reserved bits in CPUID.80000008H
ext4: fix warning in 'ext4_da_release_space'
parisc: Export iosapic_serial_irq() symbol for serial port driver
parisc: Make 8250_gsc driver dependend on CONFIG_PARISC
ALSA: usb-audio: Add quirks for MacroSilicon MS2100/MS2106 devices
btrfs: fix type of parameter generation in btrfs_get_dentry
Bluetooth: L2CAP: Fix attempting to access uninitialized memory
i2c: xiic: Add platform module alias
media: dvb-frontends/drxk: initialize err to 0
media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE
net: mdio: fix undefined behavior in bit shift for __mdiobus_register
Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del()
Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu
btrfs: fix ulist leaks in error paths of qgroup self tests
isdn: mISDN: netjet: fix wrong check of device registration
mISDN: fix possible memory leak in mISDN_register_device()
rose: Fix NULL pointer dereference in rose_send_frame()
ipvs: use explicitly signed chars
net: sched: Fix use after free in red_enqueue()
ata: pata_legacy: fix pdc20230_set_piomode()
net: fec: fix improper use of NETDEV_TX_BUSY
nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send()
nfc: s3fwrn5: Fix potential memory leak in s3fwrn5_nci_send()
nfs4: Fix kmemleak when allocate slot failed
NFSv4.1: We must always send RECLAIM_COMPLETE after a reboot
NFSv4.1: Handle RECLAIM_COMPLETE trunking errors
Change-Id: Ie30850b718c1347e040c5ef46ee50f1b81fe4fc6
commit 5eef2141776da02772c44ec406d6871a790761ee upstream.
Sanity checks were added to verify the v4l2_bt_timings blanking fields
in order to avoid integer overflows when userspace passes weird values.
But that assumed that userspace would correctly fill in the front porch,
backporch and sync values, but sometimes all you know is the total
blanking, which is then assigned to just one of these fields.
And that can fail with these checks.
So instead set a maximum for the total horizontal and vertical
blanking and check that each field remains below that.
That is still sufficient to avoid integer overflows, but it also
allows for more flexibility in how userspace fills in these fields.
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Fixes: 4b6d66a45ed3 ("media: v4l2-dv-timings: add sanity checks for blanking values")
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Hans Verkuilauthored and Greg Kroah-Hartmancommited 2022-12-14 11:24:33 +01:00
* common/android-4.9-q:
Linux 4.9.332
can: rcar_canfd: rcar_canfd_handle_global_receive(): fix IRQ storm on global FIFO receive
net: ehea: fix possible memory leak in ehea_register_port()
openvswitch: switch from WARN to pr_warn
ALSA: aoa: Fix I2S device accounting
ALSA: aoa: i2sbus: fix possible memory leak in i2sbus_add_dev()
net: ksz884x: fix missing pci_disable_device() on error in pcidev_init()
i40e: Fix ethtool rx-flow-hash setting for X722
media: videodev2.h: V4L2_DV_BT_BLANKING_HEIGHT should check 'interlaced'
media: v4l2-dv-timings: add sanity checks for blanking values
media: vivid: dev->bitmap_cap wasn't freed in all cases
media: vivid: s_fbuf: add more sanity checks
can: mscan: mpc5xxx: mpc5xxx_can_probe(): add missing put_clock() in error path
tcp: fix indefinite deferral of RTO with SACK reneging
net: lantiq_etop: don't free skb when returning NETDEV_TX_BUSY
kcm: annotate data-races around kcm->rx_wait
kcm: annotate data-races around kcm->rx_psock
ALSA: ac97: fix possible memory leak in snd_ac97_dev_register()
arc: iounmap() arg is volatile
drm/msm: Fix return type of mdp4_lvds_connector_mode_valid
net: ieee802154: fix error return code in dgram_bind()
mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages
xen/gntdev: Prevent leaking grants
Xen/gntdev: don't ignore kernel unmapping error
s390/futex: add missing EX_TABLE entry to __futex_atomic_op()
kernfs: fix use-after-free in __kernfs_remove
mmc: core: Fix kernel panic when remove non-standard SDIO card
drm/msm/hdmi: fix memory corruption with too many bridges
mac802154: Fix LQI recording
fbdev: smscufx: Fix several use-after-free bugs
tools: iio: iio_utils: fix digit calculation
xhci: Remove device endpoints from bandwidth list when freeing the device
usb: bdc: change state when port disconnected
USB: add RESET_RESUME quirk for NVIDIA Jetson devices in RCM
ALSA: au88x0: use explicitly signed char
ALSA: Use del_timer_sync() before freeing timer
ACPI: video: Force backlight native for more TongFang devices
net: hns: fix possible memory leak in hnae_ae_register()
net/atm: fix proc_mpc_write incorrect return value
HID: magicmouse: Do not set BTN_MOUSE on double report
arm64: errata: Remove AES hwcap for COMPAT tasks
ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS
ata: ahci-imx: Fix MODULE_ALIAS
ocfs2: fix BUG when iput after ocfs2_mknod fails
ocfs2: clear dinode links count in case of error
Linux 4.9.331
gcov: support GCC 12.1 and newer compilers
thermal: intel_powerclamp: Use first online CPU as control_cpu
inet: fully convert sk->sk_rx_dst to RCU rules
ext4: continue to expand file system when the target size doesn't reach
net/ieee802154: don't warn zero-sized raw_sendmsg()
net: ieee802154: return -EINVAL for unknown addr type
perf intel-pt: Fix segfault in intel_pt_print_info() with uClibc
usb: idmouse: fix an uninit-value in idmouse_open
Revert "usb: storage: Add quirk for Samsung Fit flash"
usb: musb: Fix musb_gadget.c rxstate overflow bug
usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info()
HID: roccat: Fix use-after-free in roccat_read()
scsi: 3w-9xxx: Avoid disabling device if failing to enable it
media: cx88: Fix a null-ptr-deref bug in buffer_prepare()
ARM: dts: imx6sl: add missing properties for sram
ARM: dts: imx6qp: add missing properties for sram
ARM: dts: imx6dl: add missing properties for sram
ARM: dts: imx6q: add missing properties for sram
ARM: dts: imx7d-sdb: config the max pressure for tsc2046
drm/amdgpu: fix initial connector audio value
platform/x86: msi-laptop: Change DMI match / alias strings to fix module autoloading
drm: Prevent drm_copy_field() to attempt copying a NULL pointer
drm: Use size_t type for len variable in drm_copy_field()
r8152: Rate limit overflow messages
Bluetooth: L2CAP: Fix user-after-free
wifi: rt2x00: don't run Rt5592 IQ calibration on MT7620
can: bcm: check the result of can_send() in bcm_can_tx()
Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times
Bluetooth: L2CAP: initialize delayed works at l2cap_chan_create()
xfrm: Update ipcomp_scratches with NULL when freed
tcp: annotate data-race around tcp_md5sig_pool_populated
openvswitch: Fix overreporting of drops in dropwatch
openvswitch: Fix double reporting of drops in dropwatch
thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash
powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue
MIPS: BCM47XX: Cast memcmp() of function to (void *)
ACPI: video: Add Toshiba Satellite/Portege Z830 quirk
f2fs: fix race condition on setting FI_NO_EXTENT flag
iommu/omap: Fix buffer overflow in debugfs
powerpc: Fix SPE Power ISA properties for e500v1 platforms
powerpc/pci_dn: Add missing of_node_put()
powerpc/math_emu/efp: Include module.h
clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe
clk: bcm2835: fix bcm2835_clock_rate_from_divisor declaration
dmaengine: ioat: stop mod_timer from resurrecting deleted timer in __cleanup()
mfd: sm501: Add check for platform_driver_register()
mfd: lp8788: Fix an error handling path in lp8788_irq_init() and lp8788_irq_init()
mfd: lp8788: Fix an error handling path in lp8788_probe()
mfd: intel_soc_pmic: Fix an error handling path in intel_soc_pmic_i2c_probe()
serial: 8250: Fix restoring termios speed after suspend
firmware: google: Test spinlock on panic path to avoid lockups
drivers: serial: jsm: fix some leaks in probe
ata: fix ata_id_has_dipm()
ata: fix ata_id_has_ncq_autosense()
ata: fix ata_id_has_devslp()
ata: fix ata_id_sense_reporting_enabled() and ata_id_has_sense_reporting()
dyndbg: let query-modname override actual module name
dyndbg: fix module.dyndbg handling
RDMA/rxe: Fix the error caused by qp->sk
RDMA/rxe: Fix "kernel NULL pointer dereference" error
media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init
tty: xilinx_uartps: Fix the ignore_status
media: exynos4-is: fimc-is: Add of_node_put() when breaking out of loop
HSI: omap_ssi_port: Fix dma_map_sg error check
HSI: omap_ssi: Fix refcount leak in ssi_probe
clk: tegra20: Fix refcount leak in tegra20_clock_init
clk: tegra: Fix refcount leak in tegra114_clock_init
clk: tegra: Fix refcount leak in tegra210_clock_init
iio: ABI: Fix wrong format of differential capacitance channel ABI.
iio: inkern: only release the device node when done with it
iio: adc: at91-sama5d2_adc: fix AT91_SAMA5D2_MR_TRACKTIM_MAX
ARM: dts: exynos: fix polarity of VBUS GPIO of Origen
ARM: Drop CMDLINE_* dependency on ATAGS
ARM: dts: kirkwood: lsxl: remove first ethernet port
ARM: dts: kirkwood: lsxl: fix serial line
soc: qcom: smem_state: Add refcounting for the 'state->of_node'
soc: qcom: smsm: Fix refcount leak bugs in qcom_smsm_probe()
memory: of: Fix refcount leak bug in of_get_ddr_timings()
ALSA: dmaengine: increment buffer pointer atomically
ASoC: eureka-tlv320: Hold reference returned from of_find_xxx API
mmc: au1xmmc: Fix an error handling path in au1xmmc_probe()
platform/x86: msi-laptop: Fix old-ec check for backlight registering
drm/mipi-dsi: Detach devices when removing the host
bnx2x: fix potential memory leak in bnx2x_tpa_stop()
net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks()
tcp: fix tcp_cwnd_validate() to not forget is_cwnd_limited
mISDN: fix use-after-free bugs in l1oip timer handlers
spi/omap100k:Fix PM disable depth imbalance in omap1_spi100k_probe
net: fs_enet: Fix wrong check in do_pd_setup
wifi: rtl8xxxu: gen2: Fix mistake in path B IQ calibration
spi: qup: add missing clk_disable_unprepare on error in spi_qup_pm_resume_runtime()
spi: qup: add missing clk_disable_unprepare on error in spi_qup_resume()
wifi: rtl8xxxu: tighten bounds checking in rtl8xxxu_read_efuse()
wifi: mac80211: allow bw change during channel switch in mesh
wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()
sh: machvec: Use char[] for section boundaries
selinux: use "grep -E" instead of "egrep"
KVM: x86/emulator: Fix handing of POP SS to correctly set interruptibility
ring-buffer: Fix race between reset page and reading page
ring-buffer: Check pending waiters when doing wake ups as well
ring-buffer: Allow splice to read previous partially read pages
ext4: place buffer head allocation before handle start
ext4: make ext4_lazyinit_thread freezable
ext4: fix null-ptr-deref in ext4_write_info
ext4: avoid crash when inline data creation follows DIO write
nilfs2: fix use-after-free bug of struct nilfs_root
fbdev: smscufx: Fix use-after-free in ufx_ops_open()
PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge
UM: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
parisc: fbdev/stifb: Align graphics memory size to 4MB
regulator: qcom_rpm: Fix circular deferral regression
quota: Check next/prev free block number after reading from quota file
fs: dlm: handle -EBUSY first in lock arg validation
fs: dlm: fix race between test_bit() and queue_work()
iio: dac: ad5593r: Fix i2c read protocol requirements
ALSA: usb-audio: Fix NULL dererence at error path
ALSA: usb-audio: Fix potential memory leaks
ALSA: rawmidi: Drop register_mutex in snd_rawmidi_free()
ALSA: oss: Fix potential deadlock at unregistration
random: use expired timer rather than wq for mixing fast pool
Input: xpad - fix wireless 360 controller breaking after suspend
Input: xpad - add supported devices as contributed on github
random: restore O_NONBLOCK support
wifi: mac80211_hwsim: avoid mac80211 warning on bad rate
random: avoid reading two cache lines on irq randomness
USB: serial: qcserial: add new usb-id for Dell branded EM7455
scsi: stex: Properly zero out the passthrough command structure
ALSA: hda: Fix position reporting on Poulsbo
random: clamp credited irq bits to maximum mixed
ceph: don't truncate file in atomic_open
nilfs2: replace WARN_ONs by nilfs_error for checkpoint acquisition failure
nilfs2: fix leak of nilfs_root in case of writer thread creation failure
nilfs2: fix NULL pointer dereference at nilfs_bmap_lookup_at_level()
USB: serial: ftdi_sio: fix 300 bps rate for SIO
usb: mon: make mmapped memory read only
um: Cleanup compiler warning in arch/x86/um/tls_32.c
um: Cleanup syscall_handler_t cast in syscalls_32.h
net/ieee802154: fix uninit value bug in dgram_sendmsg
ARM: dts: fix Moxa SDIO 'compatible', remove 'sdhci' misnomer
dmaengine: xilinx_dma: Report error in case of dma_set_mask_and_coherent API failure
dmaengine: xilinx_dma: cleanup for fetching xlnx,num-fstores property
fs: fix UAF/GPF bug in nilfs_mdt_destroy
ARM: fix function graph tracer and unwinder dependencies
Makefile.extrawarn: Move -Wcast-function-type-strict to W=1
clk: iproc: Do not rely on node name for correct PLL setup
clk: iproc: Minor tidy up of iproc pll data structures
selftests: Fix the if conditions of in test_extra_filter()
nvme: Fix IOC_PR_CLEAR and IOC_PR_RELEASE ioctls for nvme devices
nvme: add new line after variable declatation
usbnet: Fix memory leak in usbnet_disconnect()
Input: melfas_mip4 - fix return value check in mip4_probe()
Revert "drm: bridge: analogix/dp: add panel prepare/unprepare in suspend/resume time"
mm: prevent page_frag_alloc() from corrupting the memory
mmc: moxart: fix 4-bit bus width and remove 8-bit bus width
ntfs: fix BUG_ON in ntfs_lookup_inode_by_name()
net: usb: qmi_wwan: Add new usb-id for Dell branded EM7455
uas: ignore UAS for Thinkplus chips
usb-storage: Add Hiksemi USB3-FW to IGNORE_UAS
uas: add no-uas quirk for Hiksemi usb_disk
Conflicts:
net/ipv4/udp.c
Change-Id: Ieefd73f73a15cc8f4dd6922ff3cd8342cb5cd5c9
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmNj1QEACgkQONu9yGCS
aT7REw/+J0di8jiWuojAFZnSuu4cxLn8PzhE7vMxnBAtDZ/AuItfYoD+F5Cw5/1U
7SESrM/oypHDJja3AzEFLQJHhaY96MqPF7fKurfO92s1fi0imk1oAGXAoRJPjs7m
PKQ9KBXAzQhqHnnYzDpE32kfbA8rkJhJMU1Kf0ezlwuwr4F5d3rOmEXegbT2jvSr
POe2d10n0sc3O7rf0lVkWVo93FYyOLVGvTtSqC0mB5hYPBil7yY7Wk+/BTmqyMYk
odnM+piHozvQ0mItJ37YyemIQT6eWYf47Um2DFnEvlDZy4X01of0FcocsPFZ8QLH
2iMPy8R5+mVou+C3+h63I4OyMFsCsmm6sGadfMI2iCzlsd+wvLwNX37T3weK/TJ6
T7Eyu7G4s2YnsHMvNG7LD+vADKOdCpA3KI6uJo5lNTRPyHS4ZAa+6Zy13oCPHKfy
+fBDyNqqGrvMzBau2GdENUy9G7q8cw6ZO33X/jt1g2vfhMQn/+9o0Hwstip6d964
7PYDVwGTBhm8yeiP6t1lCgm2JuyTYy4GcgvcLD30fXZlz1BwpDEIhUwHKBjO+3dg
lVz0cc95PCICRD3vD7rE9ovqSkd/SqIkRMGCkPSppFOHpnft0nf/t/jDkfgSCK3D
HbcxzBWuAXVyyrOFFJ6pVh/y4ts0vE9BjTF1eavl3tn/JyOQ2qQ=
=/sbY
-----END PGP SIGNATURE-----
Merge 4.9.332 into android-4.9-q
Changes in 4.9.332
ocfs2: clear dinode links count in case of error
ocfs2: fix BUG when iput after ocfs2_mknod fails
ata: ahci-imx: Fix MODULE_ALIAS
ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS
arm64: errata: Remove AES hwcap for COMPAT tasks
HID: magicmouse: Do not set BTN_MOUSE on double report
net/atm: fix proc_mpc_write incorrect return value
net: hns: fix possible memory leak in hnae_ae_register()
ACPI: video: Force backlight native for more TongFang devices
ALSA: Use del_timer_sync() before freeing timer
ALSA: au88x0: use explicitly signed char
USB: add RESET_RESUME quirk for NVIDIA Jetson devices in RCM
usb: bdc: change state when port disconnected
xhci: Remove device endpoints from bandwidth list when freeing the device
tools: iio: iio_utils: fix digit calculation
fbdev: smscufx: Fix several use-after-free bugs
mac802154: Fix LQI recording
drm/msm/hdmi: fix memory corruption with too many bridges
mmc: core: Fix kernel panic when remove non-standard SDIO card
kernfs: fix use-after-free in __kernfs_remove
s390/futex: add missing EX_TABLE entry to __futex_atomic_op()
Xen/gntdev: don't ignore kernel unmapping error
xen/gntdev: Prevent leaking grants
mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages
net: ieee802154: fix error return code in dgram_bind()
drm/msm: Fix return type of mdp4_lvds_connector_mode_valid
arc: iounmap() arg is volatile
ALSA: ac97: fix possible memory leak in snd_ac97_dev_register()
kcm: annotate data-races around kcm->rx_psock
kcm: annotate data-races around kcm->rx_wait
net: lantiq_etop: don't free skb when returning NETDEV_TX_BUSY
tcp: fix indefinite deferral of RTO with SACK reneging
can: mscan: mpc5xxx: mpc5xxx_can_probe(): add missing put_clock() in error path
media: vivid: s_fbuf: add more sanity checks
media: vivid: dev->bitmap_cap wasn't freed in all cases
media: v4l2-dv-timings: add sanity checks for blanking values
media: videodev2.h: V4L2_DV_BT_BLANKING_HEIGHT should check 'interlaced'
i40e: Fix ethtool rx-flow-hash setting for X722
net: ksz884x: fix missing pci_disable_device() on error in pcidev_init()
ALSA: aoa: i2sbus: fix possible memory leak in i2sbus_add_dev()
ALSA: aoa: Fix I2S device accounting
openvswitch: switch from WARN to pr_warn
net: ehea: fix possible memory leak in ehea_register_port()
can: rcar_canfd: rcar_canfd_handle_global_receive(): fix IRQ storm on global FIFO receive
Linux 4.9.332
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I34f534c6b1ba325afd8991a2731dab1bac206c0c
[ Upstream commit 1f65ea411cc7b6ff128d82a3493d7b5648054e6f ]
Whenever the compose width/height values change, the dev->bitmap_cap
vmalloc'ed array must be freed and dev->bitmap_cap set to NULL.
This was done in some places, but not all. This is only an issue if
overlay support is enabled and the bitmap clipping is used.
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Fixes: ef834f7836 ([media] vivid: add the video capture and output parts)
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Hans Verkuilauthored and Greg Kroah-Hartmancommited 2022-11-03 23:49:18 +09:00
[ Upstream commit f8bcaf714abfc94818dff8c0db84d750433984f4 ]
VIDIOC_S_FBUF is by definition a scary ioctl, which is why only root
can use it. But at least check if the framebuffer parameters match that
of one of the framebuffer created by vivid, and reject anything else.
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Fixes: ef834f7836 ([media] vivid: add the video capture and output parts)
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Hans Verkuilauthored and Greg Kroah-Hartmancommited 2022-11-03 23:49:18 +09:00
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmNZFvEACgkQONu9yGCS
aT7N6g//dQkjLOXwqQ9hKxpGzxSF/VqKBup/ze1kPIwNAB4TEWR0iyCjqmnu2HQo
23hE0/V2HMTsgWkSVar92TEgVKbcfHS3g0T6MwZmTRamTK4YG02ccj9ryraawL9M
nTBYYT35U4a0fL1n2Yay67CKvxIghdVETlPRApl269PgQaUbDardG2bCOmNzcN0/
Ki7wmgTsrun4GQMapDsgGMqT+Jyk8kgPJtru4Vi4UgerMAuLv7GHcnPCtbEEl/Ye
FkA4EiFLeAUiYvluSsMyNlPvemWAe+ZFlPNRz5I/rzHoR4zA8vaKHTfbiObukBwL
ZD4GN/ZfVPJx1LZFqsFpkVnjPa0vyRzLv7M6UEO8mW4YlzVRBGCOhVC5wR+KyjW9
3Rqx+XBV9X2iD02KKyUh6F8d4Mq9D1JGDeTTdwAasuFOOtruy+MIE0M7tkTz2Dr5
UNQ1EhUTxjuFVpO86wiXe6icX50i1PkfmF4qgKKb3Le9Nq98dLMZvkLgBktE9uf4
Dm6o2oWqoE9oLhlvl613zBjpWJt71l4wrEp1C9XOy7q4idYxFxHylUMAYz8cF3UR
fTuJMTaTMg4fHnD0p/g5WRLdEUX3Os6v82YXC7LFm/y6B/Bxazh5K4VN8v69lQrU
SZs3ySJZQ7s3GpbEhPHgQ3DLJPxv6LfBNd0o+7qUjd00zPcw/h8=
=+FCj
-----END PGP SIGNATURE-----
Merge 4.9.331 into android-4.9-q
Changes in 4.9.331
uas: add no-uas quirk for Hiksemi usb_disk
usb-storage: Add Hiksemi USB3-FW to IGNORE_UAS
uas: ignore UAS for Thinkplus chips
net: usb: qmi_wwan: Add new usb-id for Dell branded EM7455
ntfs: fix BUG_ON in ntfs_lookup_inode_by_name()
mmc: moxart: fix 4-bit bus width and remove 8-bit bus width
mm: prevent page_frag_alloc() from corrupting the memory
Revert "drm: bridge: analogix/dp: add panel prepare/unprepare in suspend/resume time"
Input: melfas_mip4 - fix return value check in mip4_probe()
usbnet: Fix memory leak in usbnet_disconnect()
nvme: add new line after variable declatation
nvme: Fix IOC_PR_CLEAR and IOC_PR_RELEASE ioctls for nvme devices
selftests: Fix the if conditions of in test_extra_filter()
clk: iproc: Minor tidy up of iproc pll data structures
clk: iproc: Do not rely on node name for correct PLL setup
Makefile.extrawarn: Move -Wcast-function-type-strict to W=1
ARM: fix function graph tracer and unwinder dependencies
fs: fix UAF/GPF bug in nilfs_mdt_destroy
dmaengine: xilinx_dma: cleanup for fetching xlnx,num-fstores property
dmaengine: xilinx_dma: Report error in case of dma_set_mask_and_coherent API failure
ARM: dts: fix Moxa SDIO 'compatible', remove 'sdhci' misnomer
net/ieee802154: fix uninit value bug in dgram_sendmsg
um: Cleanup syscall_handler_t cast in syscalls_32.h
um: Cleanup compiler warning in arch/x86/um/tls_32.c
usb: mon: make mmapped memory read only
USB: serial: ftdi_sio: fix 300 bps rate for SIO
nilfs2: fix NULL pointer dereference at nilfs_bmap_lookup_at_level()
nilfs2: fix leak of nilfs_root in case of writer thread creation failure
nilfs2: replace WARN_ONs by nilfs_error for checkpoint acquisition failure
ceph: don't truncate file in atomic_open
random: clamp credited irq bits to maximum mixed
ALSA: hda: Fix position reporting on Poulsbo
scsi: stex: Properly zero out the passthrough command structure
USB: serial: qcserial: add new usb-id for Dell branded EM7455
random: avoid reading two cache lines on irq randomness
wifi: mac80211_hwsim: avoid mac80211 warning on bad rate
random: restore O_NONBLOCK support
Input: xpad - add supported devices as contributed on github
Input: xpad - fix wireless 360 controller breaking after suspend
random: use expired timer rather than wq for mixing fast pool
ALSA: oss: Fix potential deadlock at unregistration
ALSA: rawmidi: Drop register_mutex in snd_rawmidi_free()
ALSA: usb-audio: Fix potential memory leaks
ALSA: usb-audio: Fix NULL dererence at error path
iio: dac: ad5593r: Fix i2c read protocol requirements
fs: dlm: fix race between test_bit() and queue_work()
fs: dlm: handle -EBUSY first in lock arg validation
quota: Check next/prev free block number after reading from quota file
regulator: qcom_rpm: Fix circular deferral regression
parisc: fbdev/stifb: Align graphics memory size to 4MB
UM: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge
fbdev: smscufx: Fix use-after-free in ufx_ops_open()
nilfs2: fix use-after-free bug of struct nilfs_root
ext4: avoid crash when inline data creation follows DIO write
ext4: fix null-ptr-deref in ext4_write_info
ext4: make ext4_lazyinit_thread freezable
ext4: place buffer head allocation before handle start
ring-buffer: Allow splice to read previous partially read pages
ring-buffer: Check pending waiters when doing wake ups as well
ring-buffer: Fix race between reset page and reading page
KVM: x86/emulator: Fix handing of POP SS to correctly set interruptibility
selinux: use "grep -E" instead of "egrep"
sh: machvec: Use char[] for section boundaries
wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()
wifi: mac80211: allow bw change during channel switch in mesh
wifi: rtl8xxxu: tighten bounds checking in rtl8xxxu_read_efuse()
spi: qup: add missing clk_disable_unprepare on error in spi_qup_resume()
spi: qup: add missing clk_disable_unprepare on error in spi_qup_pm_resume_runtime()
wifi: rtl8xxxu: gen2: Fix mistake in path B IQ calibration
net: fs_enet: Fix wrong check in do_pd_setup
spi/omap100k:Fix PM disable depth imbalance in omap1_spi100k_probe
mISDN: fix use-after-free bugs in l1oip timer handlers
tcp: fix tcp_cwnd_validate() to not forget is_cwnd_limited
net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks()
bnx2x: fix potential memory leak in bnx2x_tpa_stop()
drm/mipi-dsi: Detach devices when removing the host
platform/x86: msi-laptop: Fix old-ec check for backlight registering
mmc: au1xmmc: Fix an error handling path in au1xmmc_probe()
ASoC: eureka-tlv320: Hold reference returned from of_find_xxx API
ALSA: dmaengine: increment buffer pointer atomically
memory: of: Fix refcount leak bug in of_get_ddr_timings()
soc: qcom: smsm: Fix refcount leak bugs in qcom_smsm_probe()
soc: qcom: smem_state: Add refcounting for the 'state->of_node'
ARM: dts: kirkwood: lsxl: fix serial line
ARM: dts: kirkwood: lsxl: remove first ethernet port
ARM: Drop CMDLINE_* dependency on ATAGS
ARM: dts: exynos: fix polarity of VBUS GPIO of Origen
iio: adc: at91-sama5d2_adc: fix AT91_SAMA5D2_MR_TRACKTIM_MAX
iio: inkern: only release the device node when done with it
iio: ABI: Fix wrong format of differential capacitance channel ABI.
clk: tegra: Fix refcount leak in tegra210_clock_init
clk: tegra: Fix refcount leak in tegra114_clock_init
clk: tegra20: Fix refcount leak in tegra20_clock_init
HSI: omap_ssi: Fix refcount leak in ssi_probe
HSI: omap_ssi_port: Fix dma_map_sg error check
media: exynos4-is: fimc-is: Add of_node_put() when breaking out of loop
tty: xilinx_uartps: Fix the ignore_status
media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init
RDMA/rxe: Fix "kernel NULL pointer dereference" error
RDMA/rxe: Fix the error caused by qp->sk
dyndbg: fix module.dyndbg handling
dyndbg: let query-modname override actual module name
ata: fix ata_id_sense_reporting_enabled() and ata_id_has_sense_reporting()
ata: fix ata_id_has_devslp()
ata: fix ata_id_has_ncq_autosense()
ata: fix ata_id_has_dipm()
drivers: serial: jsm: fix some leaks in probe
firmware: google: Test spinlock on panic path to avoid lockups
serial: 8250: Fix restoring termios speed after suspend
mfd: intel_soc_pmic: Fix an error handling path in intel_soc_pmic_i2c_probe()
mfd: lp8788: Fix an error handling path in lp8788_probe()
mfd: lp8788: Fix an error handling path in lp8788_irq_init() and lp8788_irq_init()
mfd: sm501: Add check for platform_driver_register()
dmaengine: ioat: stop mod_timer from resurrecting deleted timer in __cleanup()
clk: bcm2835: fix bcm2835_clock_rate_from_divisor declaration
clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe
powerpc/math_emu/efp: Include module.h
powerpc/pci_dn: Add missing of_node_put()
powerpc: Fix SPE Power ISA properties for e500v1 platforms
iommu/omap: Fix buffer overflow in debugfs
f2fs: fix race condition on setting FI_NO_EXTENT flag
ACPI: video: Add Toshiba Satellite/Portege Z830 quirk
MIPS: BCM47XX: Cast memcmp() of function to (void *)
powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue
thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash
openvswitch: Fix double reporting of drops in dropwatch
openvswitch: Fix overreporting of drops in dropwatch
tcp: annotate data-race around tcp_md5sig_pool_populated
xfrm: Update ipcomp_scratches with NULL when freed
Bluetooth: L2CAP: initialize delayed works at l2cap_chan_create()
Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times
can: bcm: check the result of can_send() in bcm_can_tx()
wifi: rt2x00: don't run Rt5592 IQ calibration on MT7620
Bluetooth: L2CAP: Fix user-after-free
r8152: Rate limit overflow messages
drm: Use size_t type for len variable in drm_copy_field()
drm: Prevent drm_copy_field() to attempt copying a NULL pointer
platform/x86: msi-laptop: Change DMI match / alias strings to fix module autoloading
drm/amdgpu: fix initial connector audio value
ARM: dts: imx7d-sdb: config the max pressure for tsc2046
ARM: dts: imx6q: add missing properties for sram
ARM: dts: imx6dl: add missing properties for sram
ARM: dts: imx6qp: add missing properties for sram
ARM: dts: imx6sl: add missing properties for sram
media: cx88: Fix a null-ptr-deref bug in buffer_prepare()
scsi: 3w-9xxx: Avoid disabling device if failing to enable it
HID: roccat: Fix use-after-free in roccat_read()
usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info()
usb: musb: Fix musb_gadget.c rxstate overflow bug
Revert "usb: storage: Add quirk for Samsung Fit flash"
usb: idmouse: fix an uninit-value in idmouse_open
perf intel-pt: Fix segfault in intel_pt_print_info() with uClibc
net: ieee802154: return -EINVAL for unknown addr type
net/ieee802154: don't warn zero-sized raw_sendmsg()
ext4: continue to expand file system when the target size doesn't reach
inet: fully convert sk->sk_rx_dst to RCU rules
thermal: intel_powerclamp: Use first online CPU as control_cpu
gcov: support GCC 12.1 and newer compilers
Linux 4.9.331
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I105d6215a29d200abe3330f328ce3c2009ba0df9
[ Upstream commit 2b064d91440b33fba5b452f2d1b31f13ae911d71 ]
When the driver calls cx88_risc_buffer() to prepare the buffer, the
function call may fail, resulting in a empty buffer and null-ptr-deref
later in buffer_queue().
The following log can reveal it:
[ 41.822762] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI
[ 41.824488] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
[ 41.828027] RIP: 0010:buffer_queue+0xc2/0x500
[ 41.836311] Call Trace:
[ 41.836945] __enqueue_in_driver+0x141/0x360
[ 41.837262] vb2_start_streaming+0x62/0x4a0
[ 41.838216] vb2_core_streamon+0x1da/0x2c0
[ 41.838516] __vb2_init_fileio+0x981/0xbc0
[ 41.839141] __vb2_perform_fileio+0xbf9/0x1120
[ 41.840072] vb2_fop_read+0x20e/0x400
[ 41.840346] v4l2_read+0x215/0x290
[ 41.840603] vfs_read+0x162/0x4c0
Fix this by checking the return value of cx88_risc_buffer()
[hverkuil: fix coding style issues]
Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Zheyu Maauthored and Greg Kroah-Hartmancommited 2022-10-26 13:15:47 +02:00
[ Upstream commit 1c78f19c3a0ea312a8178a6bfd8934eb93e9b10a ]
of_get_child_by_name() returns a node pointer with refcount
incremented, we should use of_node_put() on it when not need anymore.
Add missing of_node_put() to avoid refcount leak.
Fixes: df3305156f ("[media] v4l: xilinx: Add Xilinx Video IP core")
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Miaoqian Linauthored and Greg Kroah-Hartmancommited 2022-10-26 13:15:42 +02:00
[ Upstream commit 211f8304fa21aaedc2c247f0c9d6c7f1aaa61ad7 ]
In fimc_is_register_subdevs(), we need to call of_node_put() for
the reference 'i2c_bus' when breaking out of the
for_each_compatible_node() which has increased the refcount.
Fixes: 9a761e4368 ("[media] exynos4-is: Add Exynos4x12 FIMC-IS driver")
Signed-off-by: Liang He <windhl@126.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Liang Heauthored and Greg Kroah-Hartmancommited 2022-10-26 13:15:42 +02:00
* common/android-4.9-q:
Linux 4.9.327
kprobes: don't call disarm_kprobe() for disabled kprobes
mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse
netfilter: conntrack: NF_CONNTRACK_PROCFS should no longer default to y
s390/hypfs: avoid error message under KVM
arm64: map FDT as RW for early_init_dt_scan()
ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead
fbdev: fb_pm2fb: Avoid potential divide by zero error
HID: hidraw: fix memory leak in hidraw_release()
media: pvrusb2: fix memory leak in pvr_probe
Bluetooth: L2CAP: Fix build errors in some archs
kbuild: Fix include path in scripts/Makefile.modpost
x86/bugs: Add "unknown" reporting for MMIO Stale Data
x86/cpu: Add Tiger Lake to Intel family
s390/mm: do not trigger write fault when vma does not allow VM_WRITE
mm: Force TLB flush for PFNMAP mappings before unlink_file_vma()
mm/hugetlb: fix hugetlb not supporting softdirty tracking
asm-generic: sections: refactor memory_intersects
loop: Check for overflow while configuring loop
btrfs: check if root is readonly while setting security xattr
ixgbe: stop resetting SYSTIME in ixgbe_ptp_start_cyclecounter
net: Fix a data-race around sysctl_somaxconn.
net: Fix a data-race around sysctl_net_busy_read.
net: Fix a data-race around sysctl_net_busy_poll.
net: Fix a data-race around sysctl_tstamp_allow_data.
ratelimit: Fix data-races in ___ratelimit().
netfilter: nft_payload: report ERANGE for too long offset and length
bonding: 802.3ad: fix no transmission of LACPDUs
rose: check NULL rose_loopback_neigh->loopback
af_key: Do not call xfrm_probe_algs in parallel
xfrm: fix refcount leak in __xfrm_policy_check()
parisc: Fix exception handler for fldw and fstw instructions
Linux 4.9.326
MIPS: tlbex: Explicitly compare _PAGE_NO_EXEC against 0
video: fbdev: i740fb: Check the argument of i740_calc_vclk()
powerpc/64: Init jump labels before parse_early_param()
ALSA: timer: Use deferred fasync helper
ALSA: core: Add async signal helpers
mips: cavium-octeon: Fix missing of_node_put() in octeon2_usb_clocks_start
vfio: Clear the caps->buf to NULL after free
tty: serial: Fix refcount leak bug in ucc_uart.c
ext4: avoid resizing to a partial cluster size
ext4: avoid remove directory when directory is corrupted
drivers:md:fix a potential use-after-free bug
cxl: Fix a memory leak in an error handling path
gadgetfs: ep_io - wait until IRQ finishes
usb: host: ohci-ppc-of: Fix refcount leak bug
irqchip/tegra: Fix overflow implicit truncation warnings
fec: Fix timer capture timing in `fec_ptp_enable_pps()`
netfilter: nf_tables: really skip inactive sets when allocating name
nios2: add force_successful_syscall_return()
nios2: restarts apply only to the first sigframe we build...
nios2: fix syscall restart checks
nios2: traced syscall does need to check the syscall number
nios2: don't leave NULLs in sys_call_table[]
nios2: page fault et.al. are *not* restartable syscalls...
atm: idt77252: fix use-after-free bugs caused by tst_timer
xen/xenbus: fix return type in xenbus_file_read()
vsock: Fix memory leak in vsock_connect()
pinctrl: qcom: msm8916: Allow CAMSS GP clocks to be muxed
pinctrl: nomadik: Fix refcount leak in nmk_pinctrl_dt_subnode_to_map
SUNRPC: Reinitialise the backchannel request buffers before reuse
NFSv4.1: RECLAIM_COMPLETE must handle EACCES
can: ems_usb: fix clang's -Wunaligned-access warning
btrfs: fix lost error handling when looking up extended ref on log replay
ata: libata-eh: Add missing command name
rds: add missing barrier to release_refill
ALSA: info: Fix llseek return value when using callback
net_sched: cls_route: disallow handle of 0
net/9p: Initialize the iounit field during fid creation
nios2: time: Read timer in get_cycles only if initialized
Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression
Revert "net: usb: ax88179_178a needs FLAG_SEND_ZLP"
scsi: sg: Allow waiting for commands to complete on removed device
tcp: fix over estimation in sk_forced_mem_schedule()
btrfs: reject log replay if there is unsupported RO compat flag
net_sched: cls_route: remove from list when handle is 0
dm raid: fix address sanitizer warning in raid_status
ext4: correct max_inline_xattr_value_size computing
ext4: fix extent status tree race in writeback error recovery path
ext4: update s_overhead_clusters in the superblock during an on-line resize
ext4: fix use-after-free in ext4_xattr_set_entry
ext4: make sure ext4_append() always allocates new block
ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h
spmi: trace: fix stack-out-of-bound access in SPMI tracing functions
x86/olpc: fix 'logical not is only applied to the left hand side'
scsi: zfcp: Fix missing auto port scan and thus missing target ports
netfilter: nf_tables: fix null deref due to zeroed list head
USB: HCD: Fix URB giveback issue in tasklet function
MIPS: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
powerpc/powernv: Avoid crashing if rng is NULL
powerpc/fsl-pci: Fix Class Code of PCIe Root Port
PCI: Add defines for normal and subtractive PCI bridges
ia64, processor: fix -Wincompatible-pointer-types in ia64_get_irr()
md-raid10: fix KASAN warning
fuse: limit nsec
bpf: fix overflow in prog accounting
drm/nouveau: fix another off-by-one in nvbios_addr
parisc: Fix device names in /proc/iomem
usbnet: Fix linkwatch use-after-free on disconnect
vfs: Check the truncate maximum size in inode_newsize_ok()
ALSA: hda/cirrus - support for iMac 12,1 model
ALSA: hda/conexant: Add quirk for LENOVO 20149 Notebook model
KVM: x86: Mark TSS busy during LTR emulation _after_ all fault checks
KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0
add barriers to buffer_uptodate and set_buffer_uptodate
ALSA: bcd2000: Fix a UAF bug on the error path of probing
macintosh/adb: fix oob read in do_adb_query() function
random: only call boot_init_stack_canary() once
ACPI: video: Shortening quirk list by identifying Clevo by board_name only
ACPI: video: Force backlight native for some TongFang devices
init/main.c: extract early boot entropy from the passed cmdline
init: move stack canary initialization after setup_arch
init/main: properly align the multi-line comment
init/main: Fix double "the" in comment
include/uapi/linux/swab.h: fix userspace breakage, use __BITS_PER_LONG for swap
selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling
selinux: fix error initialization in inode_doinit_with_dentry()
selinux: Convert isec->lock into a spinlock
selinux: Clean up initialization of isec->sclass
proc: Pass file mode to proc_pid_make_inode
selinux: Minor cleanups
ion: Make user_ion_handle_put_nolock() a void function
mt7601u: add USB device ID for some versions of XiaoDu WiFi Dongle.
ARM: crypto: comment out gcc warning that breaks clang builds
netfilter: nf_queue: do not allow packet truncation below transport header offset
net: sungem_phy: Add of_node_put() for reference returned by of_get_parent()
net: ping6: Fix memleak in ipv6_renew_options().
scsi: ufs: host: Hold reference returned by of_parse_phandle()
ntfs: fix use-after-free in ntfs_ucsncmp()
Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put
FROMLIST: binder: fix UAF of ref->proc caused by race condition
Linux 4.9.325
net: usb: ax88179_178a needs FLAG_SEND_ZLP
tty: use new tty_insert_flip_string_and_push_buffer() in pty_write()
tty: extract tty_flip_buffer_commit() from tty_flip_buffer_push()
tty: drop tty_schedule_flip()
tty: the rest, stop using tty_schedule_flip()
tty: drivers/tty/, stop using tty_schedule_flip()
ALSA: memalloc: Align buffer allocations in page size
bpf: Make sure mac_header was set before using it
mm/mempolicy: fix uninit-value in mpol_rebind_policy()
Revert "Revert "char/random: silence a lockdep splat with printk()""
be2net: Fix buffer overflow in be_get_module_eeprom
tcp: Fix a data-race around sysctl_tcp_notsent_lowat.
igmp: Fix a data-race around sysctl_igmp_max_memberships.
igmp: Fix data-races around sysctl_igmp_llm_reports.
i2c: cadence: Change large transfer count reset logic to be unconditional
tcp: Fix a data-race around sysctl_tcp_probe_threshold.
tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept.
ip: Fix a data-race around sysctl_fwmark_reflect.
perf/core: Fix data race between perf_event_set_output() and perf_mmap_close()
power/reset: arm-versatile: Fix refcount leak in versatile_reboot_probe
xfrm: xfrm_policy: fix a possible double xfrm_pols_put() in xfrm_bundle_lookup()
misc: rtsx_usb: set return value in rsp_buf alloc err path
misc: rtsx_usb: use separate command and response buffers
misc: rtsx_usb: fix use of dma mapped buffer for usb bulk transfer
xen/gntdev: Ignore failure to unmap INVALID_GRANT_HANDLE
security,selinux,smack: kill security_task_wait hook
FROMGIT: arm64: fix oops in concurrently setting insn_emulation sysctls
Linux 4.9.324
can: m_can: m_can_tx_handler(): fix use after free of skb
mm: invalidate hwpoison page cache page in fault path
serial: 8250: fix return error code in serial8250_request_std_resource()
tty: serial: samsung_tty: set dma burst_size to 1
usb: dwc3: gadget: Fix event pending check
USB: serial: ftdi_sio: add Belimo device ids
signal handling: don't use BUG_ON() for debugging
x86: Clear .brk area at early boot
ASoC: wm5110: Fix DRE control
ASoC: ops: Fix off by one in range control validation
NFC: nxp-nci: don't print header length mismatch on i2c error
net: tipc: fix possible refcount leak in tipc_sk_create()
cpufreq: pmac32-cpufreq: Fix refcount leak bug
virtio_mmio: Restore guest page size on resume
virtio_mmio: Add missing PM calls to freeze/restore
sfc: fix kernel panic when creating VF
sfc: fix use after free when disabling sriov
ipv4: Fix data-races around sysctl_ip_dynaddr.
icmp: Fix data-races around sysctl.
cipso: Fix data-races around sysctl.
ARM: 9209/1: Spectre-BHB: avoid pr_info() every time a CPU comes out of idle
net: dsa: bcm_sf2: force pause link settings
nilfs2: fix incorrect masking of permission flags for symlinks
ARM: 9213/1: Print message about disabled Spectre workarounds only once
net: sock: tracing: Fix sock_exceed_buf_limit not to dereference stale pointer
xen/netback: avoid entering xenvif_rx_next_skb() with an empty rx queue
ALSA: hda - Add fixup for Dell Latitidue E5430
arm64: entry: Restore tramp_map_kernel ISB
Linux 4.9.323
dmaengine: ti: Add missing put_device in ti_dra7_xbar_route_allocate
dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate
dmaengine: at_xdma: handle errors of at_xdmac_alloc_desc() correctly
ida: don't use BUG_ON() for debugging
i2c: cadence: Unregister the clk notifier in error path
pinctrl: sunxi: a83t: Fix NAND function name for some pins
xfs: remove incorrect ASSERT in xfs_rename
video: of_display_timing.h: include errno.h
iommu/vt-d: Fix PCI bus rescan device hot add
net: rose: fix UAF bug caused by rose_t0timer_expiry
usbnet: fix memory leak in error case
can: gs_usb: gs_usb_open/close(): fix memory leak
can: grcan: grcan_probe(): remove extra of_node_get()
mm/slub: add missing TID updates on slab deactivation
Linux 4.9.322
net: usb: qmi_wwan: add Telit 0x1070 composition
net: usb: qmi_wwan: add Telit 0x1060 composition
net: usb: qmi_wwan: add Telit LE910Cx 0x1230 composition
net: usb: qmi_wwan: add Telit 0x1260 and 0x1261 compositions
qmi_wwan: Added support for Telit LN940 series
xen/arm: Fix race in RB-tree based P2M accounting
xen/blkfront: force data bouncing when backend is untrusted
xen/netfront: force data bouncing when backend is untrusted
xen/netfront: fix leaking data in shared pages
xen/blkfront: fix leaking data in shared pages
net: Rename and export copy_skb_header
ipv6/sit: fix ipip6_tunnel_get_prl return value
sit: use min
hwmon: (ibmaem) don't call platform_device_del() if platform_device_add() fails
xen/gntdev: Avoid blocking in unmap_grant_pages()
NFC: nxp-nci: Don't issue a zero length i2c_master_read()
nfc: nfcmrvl: Fix irq_of_parse_and_map() return value
net: bonding: fix use-after-free after 802.3ad slave unbind
net: bonding: fix possible NULL deref in rlb code
netfilter: nft_dynset: restore set element counter when failing to update
caif_virtio: fix race between virtio_device_ready() and ndo_open()
powerpc/powernv: wire up rng during setup_arch
usbnet: fix memory allocation in helpers
usbnet: make sure no NULL pointer is passed through
net: usb: ax88179_178a: Fix packet receiving
net: rose: fix UAF bugs caused by timer handler
SUNRPC: Fix READ_PLUS crasher
dm raid: fix KASAN warning in raid5_add_disks
Conflicts:
arch/arm64/kernel/setup.c
drivers/staging/android/ion/ion-ioctl.c
drivers/usb/dwc3/gadget.c
security/selinux/include/objsec.h
Change-Id: I22b34d087ac0e3c3c2ad8c90f2a590e54ed3a6e8
Sorayukii
commited 
Roberto Sartori
authored and
Angelo G. Del Regno
authored and
exer
authored and
Chen-Yu Tsai
authored and
Michael Bestas
commited 
Raghavendra Ambadas
authored and
Benoit Sevens
authored and
Swami Reddy Reddy
authored and
Edwin Moquete
commited 
ziqic
authored and
Alexander Martinz
commited 
Agnimitra Sen
commited 
Chinmay Sawarkar
authored and
Mahesh Voorugonda
authored and
Greg Kroah-Hartman
commited 
Keita Suzuki
authored and
Greg Kroah-Hartman
commited 
Jason A. Donenfeld
authored and
Shigeru Yoshida
authored and
Mazin Al Haddad
authored and
Yan Lei
authored and
Jiasheng Jiang
authored and
Liang He
authored and
Liu Shixin
authored and
Baisong Zhong
authored and
Gautam Menghani
authored and
Yuan Can
authored and
Yang Yingliang
authored and
Ricardo Ribalda
authored and
Hans Verkuil
authored and
Zheyu Ma
authored and
Miaoqian Lin
authored and