Merge 4.14.302 into android-4.14-stable
Linux 4.14.302
net: mvneta: Fix an out of bounds check
* ipv6: avoid use-after-free in ip6_fragment()
net/ipv6/ip6_output.c
net: plip: don't call kfree_skb/dev_kfree_skb() under spin_lock_irq()
xen/netback: fix build warning
ethernet: aeroflex: fix potential skb leak in greth_init_rings()
tipc: Fix potential OOB in tipc_link_proto_rcv()
net: hisilicon: Fix potential use-after-free in hix5hd2_rx()
net: hisilicon: Fix potential use-after-free in hisi_femac_rx()
net: stmmac: fix "snps,axi-config" node property parsing
NFC: nci: Bounds check struct nfc_target arrays
net: mvneta: Prevent out of bounds read in mvneta_config_rss()
net: encx24j600: Fix invalid logic in reading of MISTAT register
net: encx24j600: Add parentheses to fix precedence
mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()
Bluetooth: 6LoWPAN: add missing hci_dev_put() in get_l2cap_conn()
igb: Allocate MSI-X vector when testing
e1000e: Fix TX dispatch condition
gpio: amd8111: Fix PCI device reference count leak
ca8210: Fix crash by zero initializing data
ieee802154: cc2520: Fix error return code in cc2520_hw_init()
* HID: core: fix shift-out-of-bounds in hid_report_raw_event
drivers/hid/hid-core.c
HID: hid-lg4ff: Add check for empty lbuf
KVM: s390: vsie: Fix the initialization of the epoch extension (epdx) field
* memcg: fix possible use-after-free in memcg_write_event_control()
include/linux/cgroup.h
kernel/cgroup/cgroup-internal.h
* media: v4l2-dv-timings.c: fix too strict blanking sanity checks
drivers/media/v4l2-core/v4l2-dv-timings.c
rcutorture: Automatically create initrd directory
xen/netback: don't call kfree_skb() with interrupts disabled
xen/netback: do some code cleanup
xen/netback: Ensure protocol headers don't fall in the non-linear area
net: usb: qmi_wwan: add u-blox 0x1342 composition
regulator: twl6030: fix get status of twl6032 regulators
* ASoC: soc-pcm: Add NULL check in BE reparenting
sound/soc/soc-pcm.c
ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event
ARM: dts: rockchip: disable arm_global_timer on rk3066 and rk3188
ARM: 9266/1: mm: fix no-MMU ZERO_PAGE() implementation
ARM: 9251/1: perf: Fix stacktraces for tracepoint events in THUMB2 kernels
ARM: dts: rockchip: fix ir-receiver node names
arm: dts: rockchip: fix node name for hym8563 rtc
Merge 4.14.301 into android-4.14-stable
Linux 4.14.301
Revert "x86/speculation: Change FILL_RETURN_BUFFER to work with objtool"
x86/nospec: Fix i386 RSB stuffing
ipc/sem: Fix dangling sem_array access in semtimedop race
* v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() fails
mm/frame_vector.c
* proc: proc_skip_spaces() shouldn't think it is working on C strings
kernel/sysctl.c
* proc: avoid integer type confusion in get_proc_long
kernel/sysctl.c
* mmc: sdhci: Fix voltage switch delay
drivers/mmc/host/sdhci.c
* mmc: sdhci: use FIELD_GET for preset value bit masks
drivers/mmc/host/sdhci.c
x86/ioremap: Fix page aligned size calculation in __ioremap_caller()
* Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM
net/bluetooth/l2cap_core.c
x86/pm: Add enumeration check before spec MSRs save/restore setup
x86/tsx: Add a feature bit for TSX control MSR support
nvme: restrict management ioctls to admin
* tcp/udp: Fix memory leak in ipv6_renew_options().
net/ipv6/ipv6_sockglue.c
iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init()
pinctrl: single: Fix potential division by zero
* ASoC: ops: Fix bounds check for _sx controls
sound/soc/soc-ops.c
efi: random: Properly limit the size of the random seed
* arm64: errata: Fix KVM Spectre-v2 mitigation selection for Cortex-A57/A72
arch/arm64/kernel/cpu_errata.c
* arm64: Fix panic() when Spectre-v2 causes Spectre-BHB to re-allocate KVM vectors
arch/arm64/kernel/cpu_errata.c
x86/bugs: Make sure MSR_SPEC_CTRL is updated properly upon resume from S3
nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()
tools/vm/slabinfo-gnuplot: use "grep -E" instead of "egrep"
btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit()
* perf: Add sample_flags to indicate the PMU-filled sample data
include/linux/perf_event.h
kernel/events/core.c
hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()
hwmon: (coretemp) Check for null before removing sysfs attrs
net: ethernet: renesas: ravb: Fix promiscuous mode after system resumed
* packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE
net/packet/af_packet.c
net: hsr: Fix potential use-after-free
dsa: lan9303: Correct stat name
net/9p: Fix a potential socket leak in p9_socket_open
net: net_netdev: Fix error handling in ntb_netdev_init_module()
* net: phy: fix null-ptr-deref while probe() failed
drivers/net/phy/phy_device.c
qlcnic: fix sleep-in-atomic-context bugs caused by msleep
can: cc770: cc770_isa_probe(): add missing free_cc770dev()
can: sja1000_isa: sja1000_isa_probe(): add missing free_sja1000dev()
net/mlx5: Fix uninitialized variable bug in outlen_write()
* of: property: decrement node refcount in of_fwnode_get_reference_args()
drivers/of/property.c
hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails
hwmon: (i5500_temp) fix missing pci_disable_device()
* iio: light: rpr0521: add missing Kconfig dependencies
drivers/iio/light/Kconfig
iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw
iio: health: afe4403: Fix oob read in afe4403_read_raw
drm/amdgpu: always register an MMU notifier for userptr
net: usb: qmi_wwan: add Telit 0x103a composition
* tcp: configurable source port perturb table size
net/ipv4/Kconfig
net/ipv4/inet_hashtables.c
platform/x86: hp-wmi: Ignore Smart Experience App event
platform/x86: acer-wmi: Enable SW_TABLET_MODE on Switch V 10 (SW5-017)
platform/x86: asus-wmi: add missing pci_dev_put() in asus_wmi_set_xusb2pr()
xen/platform-pci: add missing free_irq() in error path
serial: 8250: 8250_omap: Avoid RS485 RTS glitch on ->set_termios()
Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode
nilfs2: fix nilfs_sufile_mark_dirty() not set segment usage as dirty
* kconfig: display recursive dependency resolution hint just once
scripts/kconfig/symbol.c
iio: core: Fix entry not deleted when iio_register_sw_trigger_type() fails
iio: light: apds9960: fix wrong register for gesture gain
arm64: dts: rockchip: lower rk3399-puma-haikou SD controller clock frequency
nios2: add FORCE for vmlinuz.gz
s390/crashdump: fix TOD programmable field size
net: thunderx: Fix the ACPI memory leak
nfc: st-nci: fix memory leaks in EVT_TRANSACTION
nfc: st-nci: fix incorrect validating logic in EVT_TRANSACTION
s390/dasd: fix no record found for raw_track_access
* dccp/tcp: Reset saddr on failure after inet6?_hash_connect().
net/ipv4/tcp_ipv4.c
net/ipv6/tcp_ipv6.c
NFC: nci: fix memory leak in nci_rx_data_packet()
* xfrm: Fix ignored return value in xfrm6_init()
net/ipv6/xfrm6_policy.c
net/qla3xxx: fix potential memleak in ql3xxx_send()
net/mlx4: Check retval of mlx4_bitmap_init
ARM: mxs: fix memory leak in mxs_machine_init()
9p/fd: fix issue of list_del corruption in p9_fd_cancel()
net: pch_gbe: fix potential memleak in pch_gbe_tx_queue()
nfc/nci: fix race with opening and closing
ARM: dts: at91: sam9g20ek: enable udc vbus gpio pinctrl
bus: sunxi-rsb: Support atomic transfers
ARM: dts: am335x-pcm-953: Define fixed regulators in root node
* af_key: Fix send_acquire race with pfkey_register
net/key/af_key.c
MIPS: pic32: treat port as signed integer
spi: stm32: fix stm32_spi_prepare_mbr() that halves spi clk for every run
wifi: mac80211: Fix ack frame idr leak when mesh has no route
* audit: fix undefined behavior in bit shift for AUDIT_BIT
include/uapi/linux/audit.h
wifi: mac80211_hwsim: fix debugfs attribute ps with rc table support
Merge 4.14.300 into android-4.14-stable
Linux 4.14.300
ntfs: check overflow when iterating ATTR_RECORDs
ntfs: fix out-of-bounds read in ntfs_attr_find()
ntfs: fix use-after-free in ntfs_attr_find()
* mm: fs: initialize fsdata passed to write_begin/write_end interface
fs/buffer.c
fs/namei.c
mm/filemap.c
9p/trans_fd: always use O_NONBLOCK read/write
gfs2: Switch from strlcpy to strscpy
gfs2: Check sb_bsize_shift after reading superblock
9p: trans_fd/p9_conn_cancel: drop client lock earlier
kcm: close race conditions on sk_receive_queue
* bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb()
net/bpf/test_run.c
kcm: avoid potential race in kcm_tx_work
tcp: cdg: allow tcp_cdg_release() to be called multiple times
macvlan: enforce a consistent minimal mtu
serial: 8250: Flush DMA Rx on RLSI
nilfs2: fix use-after-free bug of ns_writer on remount
misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put()
mmc: core: properly select voltage range without power cycle
serial: 8250_lpss: Configure DMA also w/o DMA filter
serial: 8250: Fall back to non-DMA Rx if IIR_RDI occurs
* dm ioctl: fix misbehavior if list_versions races with module loading
drivers/md/dm-ioctl.c
iio: pressure: ms5611: changed hardcoded SPI speed to value limited
iio: trigger: sysfs: fix possible memory leak in iio_sysfs_trig_init()
iio: adc: at91_adc: fix possible memory leak in at91_adc_allocate_trigger()
usb: chipidea: fix deadlock in ci_otg_del_timer
* usb: add NO_LPM quirk for Realforce 87U Keyboard
drivers/usb/core/quirks.c
USB: serial: option: add Fibocom FM160 0x0111 composition
USB: serial: option: add u-blox LARA-L6 modem
USB: serial: option: add u-blox LARA-R6 00B modem
USB: serial: option: remove old LARA-R6 PID
USB: serial: option: add Sierra Wireless EM9191
* ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open()
sound/usb/midi.c
* ring_buffer: Do not deactivate non-existant pages
kernel/trace/ring_buffer.c
ftrace: Fix null pointer dereference in ftrace_add_mod()
ftrace: Optimize the allocation for mcount entries
ftrace: Fix the possible incorrect kernel message
cifs: Fix wrong return value checking when GETFLAGS
net/x25: Fix skb leak in x25_lapb_receive_frame()
drbd: use after free in drbd_create_device()
xen/pcpu: fix possible memory leak in register_pcpu()
net: caif: fix double disconnect client in chnl_net_open()
mISDN: fix misuse of put_device() in mISDN_register_device()
mISDN: fix possible memory leak in mISDN_dsp_element_register()
net: bgmac: Drop free_netdev() from bgmac_enet_remove()
* pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map
drivers/pinctrl/devicetree.c
parport_pc: Avoid FIFO port location truncation
block: sed-opal: kmalloc the cmd/resp buffers
* ASoC: soc-utils: Remove __exit for snd_soc_util_exit()
sound/soc/soc-utils.c
tty: n_gsm: fix sleep-in-atomic-context bug in gsm_control_send
serial: 8250: omap: Flush PM QOS work on remove
serial: 8250_omap: remove wait loop from Errata i202 workaround
* ASoC: core: Fix use-after-free in snd_soc_exit()
sound/soc/soc-core.c
* Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm
net/bluetooth/l2cap_core.c
drm/imx: imx-tve: Fix return type of imx_tve_connector_mode_valid
selftests/futex: fix build for clang
x86/cpu: Restore AMD's DE_CFG MSR after resume
dmaengine: at_hdmac: Check return code of dma_async_device_register
dmaengine: at_hdmac: Fix impossible condition
dmaengine: at_hdmac: Don't allow CPU to reorder channel enable
dmaengine: at_hdmac: Fix completion of unissued descriptor in case of errors
dmaengine: at_hdmac: Don't start transactions at tx_submit level
dmaengine: at_hdmac: Fix at_lli struct definition
* cert host tools: Stop complaining about deprecated OpenSSL functions
scripts/extract-cert.c
udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
btrfs: selftests: fix wrong error check in btrfs_free_dummy_root()
platform/x86: hp_wmi: Fix rfkill causing soft blocked wifi
drm/i915/dmabuf: fix sg_table handling in map_dma_buf
nilfs2: fix deadlock in nilfs_count_free_blocks()
* ALSA: usb-audio: Add quirk entry for M-Audio Micro
sound/usb/quirks-table.h
ALSA: hda: fix potential memleak in 'add_widget_node'
arm64: efi: Fix handling of misaligned runtime regions and drop warning
net: macvlan: fix memory leaks of macvlan_common_newlink
net: mv643xx_eth: disable napi when init rxq or txq failed in mv643xx_eth_open()
ethernet: s2io: disable napi when start nic failed in s2io_card_up()
net: cxgb3_main: disable napi when bind qsets failed in cxgb_up()
drivers: net: xgene: disable napi when register irq failed in xgene_enet_open()
dmaengine: mv_xor_v2: Fix a resource leak in mv_xor_v2_remove()
tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header
* ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network
net/ipv6/addrlabel.c
drm/vc4: Fix missing platform_unregister_drivers() call in vc4_drm_register()
hamradio: fix issue of dev reference count leakage in bpq_device_event()
net: lapbether: fix issue of dev reference count leakage in lapbeth_device_event()
* capabilities: fix undefined behavior in bit shift for CAP_TO_MASK
include/uapi/linux/capability.h
net: fman: Unregister ethernet device on removal
bnxt_en: fix potentially incorrect return value for ndo_rx_flow_steer
* net: gso: fix panic on frag_list with mixed head alloc types
net/core/skbuff.c
HID: hyperv: fix possible memory leak in mousevsc_probe()
Bug: 263916797
Change-Id: I51192457a574c0d06884b644b950753a4953c2bb
Signed-off-by: JohnnLee <johnnlee@google.com>
4accad7636