bka
61254 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Wiktor Rudzki
|
23c4b5c9eb |
Merge remote-tracking branch 'qcom_sm8350/lineage-20' into lineage-22.2
* qcom_sm8350/lineage-20: UPSTREAM: net: sched: Disallow replacing of child qdisc from one parent to another FROMGIT: media: venus: hfi: add a check to handle OOB in sfr region FROMGIT: media: venus: hfi: add check to handle incorrect queue size FROMGIT: media: venus: hfi_parser: refactor hfi packet parsing logic FROMGIT: media: venus: hfi_parser: add check to avoid out of bound access UPSTREAM: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 UPSTREAM: f2fs: compress: don't allow unaligned truncation on released compress inode UPSTREAM: net: core: reject skb_copy(_expand) for fraglist GSO skbs UPSTREAM: udp: prevent local UDP tunnel packets from being GROed UPSTREAM: udp: do not transition UDP GRO fraglist partial checksums to unnecessary UPSTREAM: udp: do not accept non-tunnel GSO skbs landing in a tunnel UPSTREAM: binder: Return EFAULT if we fail BINDER_ENABLE_ONEWAY_SPAM_DETECTION UPSTREAM: usb: dwc3: host: Set XHCI_SG_TRB_CACHE_SIZE_QUIRK UPSTREAM: usb: host: xhci-plat: Add support for XHCI_SG_TRB_CACHE_SIZE_QUIRK UPSTREAM: usb: xhci: Add error handling in xhci_map_urb_for_dma UPSTREAM: usb: xhci: Use temporary buffer to consolidate SG UPSTREAM: usb: xhci: Set quirk for XHCI_SG_TRB_CACHE_SIZE_QUIRK defconfig: Enable RTL8152 ETH-USB driver ANDROID: ABI: Cuttlefish Symbol update fw-api: CL 28563606 - update fw common interface files fw-api: CL 28550964 - update fw common interface files fw-api: CL 28541501 - update fw common interface files msm: mhi_dev: Breaking memory for event request in smaller chunks fw-api: CL 28534399 - update fw common interface files fw-api: CL 28532052 - update fw common interface files fw-api: CL 28539558 - update fw common interface files fw-api: CL 28524940 - update fw common interface files Revert "net: net_namespace: Optimize the code" Revert "net: add exit_batch_rtnl() method" Revert "gtp: use exit_batch_rtnl() method" Revert "gtp: Use for_each_netdev_rcu() in gtp_genl_dump_pdp()." Revert "gtp: Destroy device along with udp socket's netns dismantle." disp: msm: sde: fix kms NULL pointer access in encoder IRQ control Linux 5.4.290 Partial revert of xhci: use pm_ptr() instead #ifdef for CONFIG_PM conditionals xhci: use pm_ptr() instead of #ifdef for CONFIG_PM conditionals drm/v3d: Assign job pointer to NULL before signaling the fence Input: xpad - add support for wooting two he (arm) Input: xpad - add unofficial Xbox 360 wireless receiver clone Input: atkbd - map F23 key to support default copilot shortcut Revert "usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null" USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb() ext4: fix slab-use-after-free in ext4_split_extent_at() ext4: avoid ext4_error()'s caused by ENOMEM in the truncate path vfio/platform: check the bounds of read/write syscalls net/xen-netback: prevent UAF in xenvif_flush_hash() net: xen-netback: hash.c: Use built-in RCU list checking signal/m68k: Use force_sigsegv(SIGSEGV) in fpsp040_die m68k: Add missing mmap_read_lock() to sys_cacheflush() m68k: Update ->thread.esp0 before calling syscall_trace() in ret_from_signal gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag irqchip/sunxi-nmi: Add missing SKIP_WAKE flag scsi: iscsi: Fix redundant response for ISCSI_UEVENT_GET_HOST_STATS request ASoC: wm8994: Add depends on MFD core net: fix data-races around sk->sk_forward_alloc scsi: sg: Fix slab-use-after-free read in sg_release() ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev() hrtimers: Handle CPU state correctly on hotplug irqchip/gic-v3: Handle CPU_PM_ENTER_FAILED correctly fs/proc: fix softlockup in __read_vmcore (part 2) net: ethernet: xgbe: re-add aneg to supported features in PHY quirks nvmet: propagate npwg topology poll_wait: add mb() to fix theoretical race between waitqueue_active() and .poll() kheaders: Ignore silly-rename files hfs: Sanity check the root record mac802154: check local interfaces before deleting sdata list i2c: mux: demux-pinctrl: check initial mux selection, too drm/v3d: Ensure job pointer is set to NULL after job completion nfp: bpf: prevent integer overflow in nfp_bpf_event_output() gtp: Destroy device along with udp socket's netns dismantle. gtp: Use for_each_netdev_rcu() in gtp_genl_dump_pdp(). gtp: use exit_batch_rtnl() method net: add exit_batch_rtnl() method net: net_namespace: Optimize the code net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field() sctp: sysctl: rto_min/max: avoid using current->nsproxy ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv ocfs2: correct return value of ocfs2_local_free_info() phy: core: Fix that API devm_of_phy_provider_unregister() fails to unregister the phy provider phy: core: fix code style in devm_of_phy_provider_unregister arm64: dts: rockchip: add hevc power domain clock to rk3328 arm64: dts: rockchip: add #power-domain-cells to power domain nodes arm64: dts: rockchip: fix pd_tcpc0 and pd_tcpc1 node position on rk3399 arm64: dts: rockchip: fix defines in pd_vio node for rk3399 iio: inkern: call iio_device_put() only on mapped devices iio: adc: at91: call input_free_device() on allocated iio_dev iio: adc: ti-ads124s08: Use gpiod_set_value_cansleep() iio: gyro: fxas21002c: Fix missing data update in trigger handler iio: adc: ti-ads8688: fix information leak in triggered buffer iio: imu: kmx61: fix information leak in triggered buffer iio: light: vcnl4035: fix information leak in triggered buffer iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer iio: pressure: zpa2326: fix information leak in triggered buffer usb: gadget: f_fs: Remove WARN_ON in functionfs_bind usb: fix reference leak in usb_new_device() USB: core: Disable LPM only for non-suspended ports USB: usblp: return error when setting unsupported protocol usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null USB: serial: cp210x: add Phoenix Contact UPS Device usb-storage: Add max sectors quirk for Nokia 208 staging: iio: ad9832: Correct phase range check staging: iio: ad9834: Correct phase range check USB: serial: option: add Neoway N723-EA support USB: serial: option: add MeiG Smart SRM815 drm/amd/display: increase MAX_SURFACES to the value supported by hw ACPI: resource: Add Asus Vivobook X1504VAP to irq1_level_low_skip_override[] ACPI: resource: Add TongFang GM5HG0A to irq1_edge_low_force_override[] drm/amd/display: Add check for granularity in dml ceil/floor helpers sctp: sysctl: auth_enable: avoid using current->nsproxy sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy dm thin: make get_first_thin use rcu-safe list first function tls: Fix tls_sw_sendmsg error handling net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute tcp/dccp: allow a connection when sk_max_ack_backlog is zero tcp/dccp: complete lockless accesses to sk->sk_max_ack_backlog net: 802: LLC+SNAP OID:PID lookup on start of skb data ieee802154: ca8210: Add missing check for kfifo_alloc() in ca8210_probe() dm array: fix cursor index when skipping across block boundaries dm array: fix unreleased btree blocks on closing a faulty array cursor dm array: fix releasing a faulty array block twice in dm_array_cursor_end jbd2: flush filesystem device before updating tail sequence fw-api: CL 28481760 - update fw common interface files fw-api: CL 28447311 - update fw common interface files fw-api: CL 28444600 - update fw common interface files msm: eva: Validating the SFR buffer size before accessing msm: eva: Copy back the validated size to avoid security issue fw-api: CL 28429679 - update fw common interface files fw-api: CL 28361807 - update fw common interface files fw-api: CL 28373291 - update fw common interface files fw-api: CL 28388903 - update fw common interface files fw-api: CL 28373275 - update fw common interface files fw-api: CL 28354118 - update fw common interface files fw-api: CL 28343275 - update fw common interface files fw-api: CL 28339144 - update fw common interface files fw-api: CL 28338484 - update fw common interface files audio-kernel: avoid out of bound read while checking a bit Release 2.0.8.34Z qcacld-3.0: Update key management in original auth mode for WAPI Change-Id: Ice0645074a7474efa16f2119f4128ce0e5797da6 |
||
|
Tommy Webb
|
3b5fdef6b4 |
Merge tag 'ASB-2025-03-05_11-5.4' into android13-5.4-lahaina
https://source.android.com/docs/security/bulletin/2025-03-01 CVE-2024-46852 CVE-2024-50302 CVE-2025-22413 # By Greg Kroah-Hartman (7) and others # Via Greg Kroah-Hartman (3) and Terence Tritton (xWF) (1) * tag 'ASB-2025-03-05_11-5.4': ANDROID: ABI: Cuttlefish Symbol update Revert "net: net_namespace: Optimize the code" Revert "net: add exit_batch_rtnl() method" Revert "gtp: use exit_batch_rtnl() method" Revert "gtp: Use for_each_netdev_rcu() in gtp_genl_dump_pdp()." Revert "gtp: Destroy device along with udp socket's netns dismantle." Linux 5.4.290 Partial revert of xhci: use pm_ptr() instead #ifdef for CONFIG_PM conditionals xhci: use pm_ptr() instead of #ifdef for CONFIG_PM conditionals drm/v3d: Assign job pointer to NULL before signaling the fence Input: xpad - add support for wooting two he (arm) Input: xpad - add unofficial Xbox 360 wireless receiver clone Input: atkbd - map F23 key to support default copilot shortcut Revert "usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null" USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb() ext4: fix slab-use-after-free in ext4_split_extent_at() ext4: avoid ext4_error()'s caused by ENOMEM in the truncate path vfio/platform: check the bounds of read/write syscalls net/xen-netback: prevent UAF in xenvif_flush_hash() net: xen-netback: hash.c: Use built-in RCU list checking signal/m68k: Use force_sigsegv(SIGSEGV) in fpsp040_die m68k: Add missing mmap_read_lock() to sys_cacheflush() m68k: Update ->thread.esp0 before calling syscall_trace() in ret_from_signal gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag irqchip/sunxi-nmi: Add missing SKIP_WAKE flag scsi: iscsi: Fix redundant response for ISCSI_UEVENT_GET_HOST_STATS request ASoC: wm8994: Add depends on MFD core net: fix data-races around sk->sk_forward_alloc scsi: sg: Fix slab-use-after-free read in sg_release() ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev() hrtimers: Handle CPU state correctly on hotplug irqchip/gic-v3: Handle CPU_PM_ENTER_FAILED correctly fs/proc: fix softlockup in __read_vmcore (part 2) net: ethernet: xgbe: re-add aneg to supported features in PHY quirks nvmet: propagate npwg topology poll_wait: add mb() to fix theoretical race between waitqueue_active() and .poll() kheaders: Ignore silly-rename files hfs: Sanity check the root record mac802154: check local interfaces before deleting sdata list i2c: mux: demux-pinctrl: check initial mux selection, too drm/v3d: Ensure job pointer is set to NULL after job completion nfp: bpf: prevent integer overflow in nfp_bpf_event_output() gtp: Destroy device along with udp socket's netns dismantle. gtp: Use for_each_netdev_rcu() in gtp_genl_dump_pdp(). gtp: use exit_batch_rtnl() method net: add exit_batch_rtnl() method net: net_namespace: Optimize the code net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field() sctp: sysctl: rto_min/max: avoid using current->nsproxy ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv ocfs2: correct return value of ocfs2_local_free_info() phy: core: Fix that API devm_of_phy_provider_unregister() fails to unregister the phy provider phy: core: fix code style in devm_of_phy_provider_unregister arm64: dts: rockchip: add hevc power domain clock to rk3328 arm64: dts: rockchip: add #power-domain-cells to power domain nodes arm64: dts: rockchip: fix pd_tcpc0 and pd_tcpc1 node position on rk3399 arm64: dts: rockchip: fix defines in pd_vio node for rk3399 iio: inkern: call iio_device_put() only on mapped devices iio: adc: at91: call input_free_device() on allocated iio_dev iio: adc: ti-ads124s08: Use gpiod_set_value_cansleep() iio: gyro: fxas21002c: Fix missing data update in trigger handler iio: adc: ti-ads8688: fix information leak in triggered buffer iio: imu: kmx61: fix information leak in triggered buffer iio: light: vcnl4035: fix information leak in triggered buffer iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer iio: pressure: zpa2326: fix information leak in triggered buffer usb: gadget: f_fs: Remove WARN_ON in functionfs_bind usb: fix reference leak in usb_new_device() USB: core: Disable LPM only for non-suspended ports USB: usblp: return error when setting unsupported protocol usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null USB: serial: cp210x: add Phoenix Contact UPS Device usb-storage: Add max sectors quirk for Nokia 208 staging: iio: ad9832: Correct phase range check staging: iio: ad9834: Correct phase range check USB: serial: option: add Neoway N723-EA support USB: serial: option: add MeiG Smart SRM815 drm/amd/display: increase MAX_SURFACES to the value supported by hw ACPI: resource: Add Asus Vivobook X1504VAP to irq1_level_low_skip_override[] ACPI: resource: Add TongFang GM5HG0A to irq1_edge_low_force_override[] drm/amd/display: Add check for granularity in dml ceil/floor helpers sctp: sysctl: auth_enable: avoid using current->nsproxy sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy dm thin: make get_first_thin use rcu-safe list first function tls: Fix tls_sw_sendmsg error handling net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute tcp/dccp: allow a connection when sk_max_ack_backlog is zero tcp/dccp: complete lockless accesses to sk->sk_max_ack_backlog net: 802: LLC+SNAP OID:PID lookup on start of skb data ieee802154: ca8210: Add missing check for kfifo_alloc() in ca8210_probe() dm array: fix cursor index when skipping across block boundaries dm array: fix unreleased btree blocks on closing a faulty array cursor dm array: fix releasing a faulty array block twice in dm_array_cursor_end jbd2: flush filesystem device before updating tail sequence Change-Id: I83cf20e29c63126cd17dfa393dca0ce7dfa47a76 |
||
|
Wiktor Rudzki
|
ac36ed4433 |
Merge remote-tracking branch 'qcom_8350/lineage-20' into lineage-22.1
* qcom_8350/lineage-20:
arm64: Only enable CC_HAVE_STACKPROTECTOR_SYSREG for GCC
msm: camera: sensor: TOCTOU error handling
ANDROID: gki - change networking configuration
ANDROID: kernelci build-break for 64-bit riscv clang builds (5.4 only)
Revert "BACKPORT: RISC-V: Stop relying on GCC's register allocator's hueristics"
Revert "ANDROID: declare sp_in_global outside of CONFIG_FRAME_POINTER"
Revert "usb: dwc3: dwc3-msm: Save dr_mode from DWC3 core node into mdwc"
usb: dwc3: msm: Enforce usb_data_enabled by blocking role switches
usb: dwc3: dwc3-msm-core: Reject incompatible role/mode request
usb: dwc3: dwc3-msm: Save dr_mode from DWC3 core node into mdwc
Revert "usb: dwc3: Handle charging behavior when usb data is disabled"
ANDROID: GKI: add Trimble symbol list
UPSTREAM: selinux: ignore unknown extended permissions
ANDROID: ABI: Update allowed list for galaxy
Revert "netfilter: Replace zero-length array with flexible-array member"
Revert "tracing: Constify string literal data member in struct trace_event_call"
Revert "skb_expand_head() adjust skb->truesize incorrectly"
Linux 5.4.289
ftrace: use preempt_enable/disable notrace macros to avoid double fault
mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim()
drm: adv7511: Drop dsi single lane support
net/sctp: Prevent autoclose integer overflow in sctp_association_init()
sky2: Add device ID 11ab:4373 for Marvell 88E8075
pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking
RDMA/uverbs: Prevent integer overflow issue
modpost: fix the missed iteration for the max bit in do_input()
modpost: fix input MODULE_DEVICE_TABLE() built for 64-bit on 32-bit host
ARC: build: Try to guess GCC variant of cross compiler
irqchip/gic: Correct declaration of *percpu_base pointer in union gic_base
net: usb: qmi_wwan: add Telit FE910C04 compositions
bpf: fix potential error return
sound: usb: format: don't warn that raw DSD is unsupported
wifi: mac80211: wake the queues in case of failure in resume
ila: serialize calls to nf_register_net_hooks()
af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK
af_packet: fix vlan_get_tci() vs MSG_PEEK
ALSA: usb-audio: US16x08: Initialize array before use
net: llc: reset skb->transport_header
netfilter: nft_set_hash: unaligned atomic read on struct nft_set_ext
netfilter: Replace zero-length array with flexible-array member
netrom: check buffer length before accessing it
drm/bridge: adv7511_audio: Update Audio InfoFrame properly
drm: bridge: adv7511: Enable SPDIF DAI
RDMA/bnxt_re: Fix max_qp_wrs reported
RDMA/bnxt_re: Fix reporting hw_ver in query_device
RDMA/bnxt_re: Add check for path mtu in modify_qp
RDMA/mlx5: Enforce same type port association for multiport RoCE
net/mlx5: Make API mlx5_core_is_ecpf accept const pointer
IB/mlx5: Introduce and use mlx5_core_is_vf()
Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet
selinux: ignore unknown extended permissions
ipv6: prevent possible UAF in ip6_xmit()
skb_expand_head() adjust skb->truesize incorrectly
btrfs: avoid monopolizing a core when activating a swap file
tracing: Constify string literal data member in struct trace_event_call
bpf: fix recursive lock when verdict program return SK_PASS
ipv6: fix possible UAF in ip6_finish_output2()
ipv6: use skb_expand_head in ip6_xmit
ipv6: use skb_expand_head in ip6_finish_output2
skbuff: introduce skb_expand_head()
MIPS: Probe toolchain support of -msym32
epoll: Add synchronous wakeup support for ep_poll_callback
virtio-blk: don't keep queue frozen during system suspend
scsi: mpt3sas: Diag-Reset when Doorbell-In-Use bit is set during driver load time
platform/x86: asus-nb-wmi: Ignore unknown event 0xCF
regmap: Use correct format specifier for logging range errors
scsi: megaraid_sas: Fix for a potential deadlock
scsi: qla1280: Fix hw revision numbering for ISP1020/1040
tracing/kprobe: Make trace_kprobe's module callback called after jump_label update
mtd: rawnand: fix double free in atmel_pmecc_create_user()
dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset
dmaengine: mv_xor: fix child node refcount handling in early exit
phy: core: Fix that API devm_phy_destroy() fails to destroy the phy
phy: core: Fix that API devm_phy_put() fails to release the phy
phy: core: Fix an OF node refcount leakage in of_phy_provider_lookup()
phy: core: Fix an OF node refcount leakage in _of_phy_get()
mtd: diskonchip: Cast an operand to prevent potential overflow
nfsd: restore callback functionality for NFSv4.0
bpf: Check negative offsets in __bpf_skb_min_len()
media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg
of: Fix refcount leakage for OF node returned by __of_get_dma_parent()
of: Fix error path in of_parse_phandle_with_args_map()
udmabuf: also check for F_SEAL_FUTURE_WRITE
nilfs2: prevent use of deleted inode
of/irq: Fix using uninitialized variable @addr_len in API of_irq_parse_one()
NFS/pnfs: Fix a live lock between recalled layouts and layoutget
btrfs: tree-checker: reject inline extent items with 0 ref count
zram: refuse to use zero sized block device as backing device
sh: clk: Fix clk_enable() to return 0 on NULL clk
USB: serial: option: add Telit FE910C04 rmnet compositions
USB: serial: option: add MediaTek T7XX compositions
USB: serial: option: add Netprisma LCUK54 modules for WWAN Ready
USB: serial: option: add MeiG Smart SLM770A
USB: serial: option: add TCL IK512 MBIM & ECM
efivarfs: Fix error on non-existent file
i2c: riic: Always round-up when calculating bus period
chelsio/chtls: prevent potential integer overflow on 32bit
mmc: sdhci-tegra: Remove SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC quirk
netfilter: ipset: Fix for recursive locking warning
net: ethernet: bgmac-platform: fix an OF node reference leak
net: hinic: Fix cleanup in create_rxqs/txqs()
ionic: use ee->offset when returning sprom data
net/smc: check sndbuf_space again after NOSPACE flag is set in smc_poll
erofs: fix incorrect symlink detection in fast symlink
erofs: fix order >= MAX_ORDER warning due to crafted negative i_size
drm/i915: Fix memory leak by correcting cache object name in error handler
i2c: pnx: Fix timeout in wait functions
PCI: Add ACS quirk for Broadcom BCM5760X NIC
ALSA: usb: Fix UBSAN warning in parse_audio_unit()
PCI/AER: Disable AER service on suspend
usb: dwc2: gadget: Don't write invalid mapped sg entries into dma_desc with iommu enabled
net: sched: fix ordering of qlen adjustment
Linux 5.4.288
ALSA: usb-audio: Fix a DMA to stack memory bug
xen/netfront: fix crash when removing device
tracing/kprobes: Skip symbol counting logic for module symbols in create_local_trace_kprobe()
KVM: arm64: Ignore PMCNTENSET_EL0 while checking for overflow status
blk-iocost: Avoid using clamp() on inuse in __propagate_weights()
blk-iocost: fix weight updates of inner active iocgs
blk-iocost: clamp inuse and skip noops in __propagate_weights()
ACPICA: events/evxfregn: don't release the ContextMutex that was never acquired
net/sched: netem: account for backlog updates from child qdisc
qca_spi: Make driver probing reliable
qca_spi: Fix clock speed for multiple QCA7000
ACPI: resource: Fix memory resource type union access
net: lapb: increase LAPB_HEADER_LEN
tipc: fix NULL deref in cleanup_bearer()
batman-adv: Do not let TT changes list grows indefinitely
batman-adv: Remove uninitialized data in full table TT response
batman-adv: Do not send uninitialized TT changes
bpf, sockmap: Fix update element with same
xfs: don't drop errno values when we fail to ficlone the entire range
usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer
usb: ehci-hcd: fix call balance of clocks handling routines
usb: dwc2: hcd: Fix GetPortStatus & SetPortFeature
ata: sata_highbank: fix OF node reference leak in highbank_initialize_phys()
usb: host: max3421-hcd: Correctly abort a USB request.
Revert "cgroup: Make operations on the cgroup root_list RCU safe"
Revert "cgroup: Move rcu_head up near the top of cgroup_root"
Linux 5.4.287
bpf, xdp: Update devmap comments to reflect napi/rcu usage
ALSA: usb-audio: Fix out of bounds reads when finding clock sources
PCI: rockchip-ep: Fix address translation unit programming
Revert "drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()"
modpost: Add .irqentry.text to OTHER_SECTIONS
ocfs2: Revert "ocfs2: fix the la space leak when unmounting an ocfs2 volume"
jffs2: Fix rtime decompressor
jffs2: Prevent rtime decompress memory corruption
KVM: arm64: vgic-its: Clear ITE when DISCARD frees an ITE
KVM: arm64: vgic-its: Clear DTE when MAPD unmaps a device
KVM: arm64: vgic-its: Add a data length check in vgic_its_save_*
perf/x86/intel/pt: Fix buffer full but size is 0 case
Revert "unicode: Don't special case ignorable code points"
bpf: fix OOB devmap writes when deleting elements
xdp: Simplify devmap cleanup
misc: eeprom: eeprom_93cx6: Add quirk for extra read clock cycle
powerpc/prom_init: Fixup missing powermac #size-cells
usb: chipidea: udc: handle USB Error Interrupt if IOC not set
i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock
PCI: Add ACS quirk for Wangxun FF5xxx NICs
PCI: Add 'reset_subordinate' to reset hierarchy below bridge
f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode.
nvdimm: rectify the illogical code within nd_dax_probe()
pinctrl: qcom-pmic-gpio: add support for PM8937
scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset
scsi: st: Don't modify unknown block number in MTIOCGET
leds: class: Protect brightness_show() with led_cdev->led_access mutex
tracing: Use atomic64_inc_return() in trace_clock_counter()
netpoll: Use rcu_access_pointer() in __netpoll_setup
net/neighbor: clear error in case strict check is not set
rocker: fix link status detection in rocker_carrier_init()
ASoC: hdmi-codec: reorder channel allocation list
Bluetooth: btusb: Add RTL8852BE device 0489:e123 to device tables
wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw()
wifi: ipw2x00: libipw_rx_any(): fix bad alignment
drm/amdgpu: set the right AMDGPU sg segment limitation
jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree
jfs: fix array-index-out-of-bounds in jfs_readdir
jfs: fix shift-out-of-bounds in dbSplit
jfs: array-index-out-of-bounds fix in dtReadFirst
wifi: ath5k: add PCI ID for Arcadyan devices
wifi: ath5k: add PCI ID for SX76X
net: inet6: do not leave a dangling sk pointer in inet6_create()
net: inet: do not leave a dangling sk pointer in inet_create()
net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
net: af_can: do not leave a dangling sk pointer in can_create()
Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()
af_packet: avoid erroring out after sock_init_data() in packet_create()
net/sched: cbs: Fix integer overflow in cbs_set_port_rate()
net: ethernet: fs_enet: Use %pa to format resource_size_t
net: fec_mpc52xx_phy: Use %pa to format resource_size_t
samples/bpf: Fix a resource leak
drm/radeon/r600_cs: Fix possible int overflow in r600_packet3_check()
drm/mcde: Enable module autoloading
drm: panel-orientation-quirks: Add quirk for AYA NEO 2 model
media: cx231xx: Add support for Dexatek USB Video Grabber 1d19:6108
media: uvcvideo: Add a quirk for the Kaiweets KTI-W02 infrared camera
s390/cpum_sf: Handle CPU hotplug remove during sampling
mmc: core: Further prevent card detect during shutdown
regmap: detach regmap from dev on regmap_exit
dma-buf: fix dma_fence_array_signaled v4
bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again
nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()
scsi: qla2xxx: Remove check req_sg_cnt should be equal to rsp_sg_cnt
scsi: qla2xxx: Supported speed displayed incorrectly for VPorts
scsi: qla2xxx: Fix NVMe and NPIV connect issue
ocfs2: update seq_file index in ocfs2_dlm_seq_next
tracing: Fix cmp_entries_dup() to respect sort() comparison rules
HID: wacom: fix when get product name maybe null pointer
bpf: Fix exact match conditions in trie_get_next_key()
bpf: Handle BPF_EXIST and BPF_NOEXIST for LPM trie
ocfs2: free inode when ocfs2_get_init_inode() fails
spi: mpc52xx: Add cancel_work_sync before module remove
tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg
drm/sti: Add __iomem for mixer_dbg_mxn's parameter
gpio: grgpio: Add NULL check in grgpio_probe
gpio: grgpio: use a helper variable to store the address of ofdev->dev
crypto: x86/aegis128 - access 32-bit arguments as 32-bit
x86/asm: Reorder early variables
xen: Fix the issue of resource not being properly released in xenbus_dev_probe()
xen/xenbus: fix locking
xenbus/backend: Protect xenbus callback with lock
xenbus/backend: Add memory pressure handler callback
xen/xenbus: reference count registered modules
netfilter: nft_set_hash: skip duplicated elements pending gc run
netfilter: ipset: Hold module reference while requesting a module
igb: Fix potential invalid memory access in igb_init_module()
net/qed: allow old cards not supporting "num_images" to work
tipc: Fix use-after-free of kernel socket in cleanup_bearer().
tipc: add new AEAD key structure for user API
tipc: enable creating a "preliminary" node
tipc: add reference counter to bearer
dccp: Fix memory leak in dccp_feat_change_recv
net/ipv6: release expired exception dst cached in socket
can: j1939: j1939_session_new(): fix skb reference counting
net/sched: tbf: correct backlog statistic for GSO packets
netfilter: x_tables: fix LED ID check in led_tg_check()
ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()
can: sun4i_can: sun4i_can_err(): fix {rx,tx}_errors statistics
can: sun4i_can: sun4i_can_err(): call can_change_state() even if cf is NULL
watchdog: mediatek: Make sure system reset gets asserted in mtk_wdt_restart()
iTCO_wdt: mask NMI_NOW bit for update_no_reboot_bit() call
drm/etnaviv: flush shader L1 cache after user commandstream
nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur
nfsd: make sure exp active before svc_export_show
dm thin: Add missing destroy_work_on_stack()
i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()
util_macros.h: fix/rework find_closest() macros
ad7780: fix division by zero in ad7780_write_raw()
clk: qcom: gcc-qcs404: fix initial rate of GPLL3
ftrace: Fix regression with module command in stack_trace_filter
ovl: Filter invalid inodes with missing lookup function
media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal()
media: gspca: ov534-ov772x: Fix off-by-one error in set_frame_rate()
media: venus: Fix pm_runtime_set_suspended() with runtime pm enabled
media: ts2020: fix null-ptr-deref in ts2020_probe()
media: i2c: tc358743: Fix crash in the probe error path when using polling
btrfs: ref-verify: fix use-after-free after invalid ref action
quota: flush quota_release_work upon quota writeback
ASoC: fsl_micfil: fix the naming style for mask definition
sh: intc: Fix use-after-free bug in register_intc_controller()
sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport
SUNRPC: Replace internal use of SOCKWQ_ASYNC_NOSPACE
SUNRPC: correct error code comment in xs_tcp_setup_socket()
modpost: remove incorrect code in do_eisa_entry()
rtc: ab-eoz9: don't fail temperature reads on undervoltage notification
9p/xen: fix release of IRQ
9p/xen: fix init sequence
block: return unsigned int from bdev_io_min
jffs2: fix use of uninitialized variable
ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit
ubi: fastmap: Fix duplicate slab cache names while attaching
ubifs: Correct the total block count by deducting journal reservation
rtc: check if __rtc_read_time was successful in rtc_timer_do_work()
rtc: abx80x: Fix WDT bit position of the status register
rtc: st-lpc: Use IRQF_NO_AUTOEN flag in request_irq()
NFSv4.0: Fix a use-after-free problem in the asynchronous open()
um: Always dump trace for specified task in show_stack
um: Clean up stacktrace dump
um: add show_stack_loglvl()
um/sysrq: remove needless variable sp
um: Fix the return value of elf_core_copy_task_fpregs
um: Fix potential integer overflow during physmem setup
rpmsg: glink: Propagate TX failures in intentless mode as well
SUNRPC: make sure cache entry active before cache_show
NFSD: Prevent a potential integer overflow
lib: string_helpers: silence snprintf() output truncation warning
usb: dwc3: gadget: Fix checking for number of TRBs left
ALSA: hda/realtek: Apply quirk for Medion E15433
ALSA: hda/realtek: Fix Internal Speaker and Mic boost of Infinix Y4 Max
ALSA: hda/realtek: Set PCBeep to default value for ALC274
ALSA: hda/realtek: Update ALC225 depop procedure
media: wl128x: Fix atomicity violation in fmc_send_cmd()
HID: wacom: Interpret tilt data from Intuos Pro BT as signed values
block: fix ordering between checking BLK_MQ_S_STOPPED request adding
arm64: tls: Fix context-switching of tpidrro_el0 when kpti is enabled
sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
um: vector: Do not use drvdata in release
serial: 8250: omap: Move pm_runtime_get_sync
um: net: Do not use drvdata in release
um: ubd: Do not use drvdata in release
ubi: wl: Put source PEB into correct list if trying locking LEB failed
spi: Fix acpi deferred irq probe
netfilter: ipset: add missing range check in bitmap_ip_uadt
Revert "serial: sh-sci: Clean sci_ports[0] after at earlycon exit"
serial: sh-sci: Clean sci_ports[0] after at earlycon exit
Revert "usb: gadget: composite: fix OS descriptors w_value logic"
Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}()
tty: ldsic: fix tty_ldisc_autoload sysctl's proc_handler
comedi: Flush partial mappings in error case
PCI: Fix use-after-free of slot->bus on hot remove
ASoC: codecs: Fix atomicity violation in snd_soc_component_get_drvdata()
jfs: xattr: check invalid xattr size more strictly
ext4: fix FS_IOC_GETFSMAP handling
ext4: supress data-race warnings in ext4_free_inodes_{count,set}()
ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices
soc: qcom: socinfo: fix revision check in qcom_socinfo_probe()
cgroup: Move rcu_head up near the top of cgroup_root
cgroup: Make operations on the cgroup root_list RCU safe
usb: ehci-spear: fix call balance of sehci clk handling routines
apparmor: fix 'Do simple duplicate message elimination'
staging: greybus: uart: clean up TIOCGSERIAL
misc: apds990x: Fix missing pm_runtime_disable()
USB: chaoskey: Fix possible deadlock chaoskey_list_lock
USB: chaoskey: fail open after removal
usb: yurex: make waiting on yurex_write interruptible
usb: using mutex lock and supporting O_NONBLOCK flag in iowarrior_read()
ipmr: fix tables suspicious RCU usage
ipmr: convert /proc handlers to rcu_read_lock()
net: stmmac: dwmac-socfpga: Set RX watchdog interrupt as broken
marvell: pxa168_eth: fix call balance of pep->clk handling routines
net: usb: lan78xx: Fix refcounting and autosuspend on invalid WoL configuration
tg3: Set coherent DMA mask bits to 31 for BCM57766 chipsets
net: usb: lan78xx: Fix memory leak on device unplug by freeing PHY device
power: supply: core: Remove might_sleep() from power_supply_put()
vfio/pci: Properly hide first-in-list PCIe extended capability
NFSD: Fix nfsd4_shutdown_copy()
NFSD: Cap the number of bytes copied by nfs4_reset_recoverydir()
NFSD: Prevent NULL dereference in nfsd4_process_cb_update()
rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length
rpmsg: glink: Fix GLINK command prefix
rpmsg: glink: Send READ_NOTIFY command in FIFO full case
rpmsg: glink: Add TX_DATA_CONT command while sending
perf trace: Avoid garbage when not printing a syscall's arguments
perf trace: Do not lose last events in a race
m68k: coldfire/device.c: only build FEC when HW macros are defined
m68k: mcfgpio: Fix incorrect register offset for CONFIG_M5441x
PCI: cpqphp: Fix PCIBIOS_* return value confusion
PCI: cpqphp: Use PCI_POSSIBLE_ERROR() to check config reads
perf probe: Correct demangled symbols in C++ program
perf cs-etm: Don't flush when packet_queue fills up
clk: clk-axi-clkgen: make sure to enable the AXI bus clock
clk: axi-clkgen: use devm_platform_ioremap_resource() short-hand
dt-bindings: clock: axi-clkgen: include AXI clk
dt-bindings: clock: adi,axi-clkgen: convert old binding to yaml format
fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem()
fbdev/sh7760fb: Alloc DMA memory from hardware device
powerpc/sstep: make emulate_vsx_load and emulate_vsx_store static
ocfs2: fix uninitialized value in ocfs2_file_read_iter()
scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()
scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb()
scsi: fusion: Remove unused variable 'rc'
scsi: bfa: Fix use-after-free in bfad_im_module_exit()
mfd: rt5033: Fix missing regmap_del_irq_chip()
RDMA/bnxt_re: Check cqe flags to know imm_data vs inv_irkey
mtd: rawnand: atmel: Fix possible memory leak
cpufreq: loongson2: Unregister platform_driver on failure
mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices
mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device
mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device
mfd: intel_soc_pmic_bxtwc: Use dev_err_probe()
mfd: da9052-spi: Change read-mask to write-mask
mfd: tps65010: Use IRQF_NO_AUTOEN flag in request_irq() to fix race
powerpc/vdso: Flag VDSO64 entry points as functions
trace/trace_event_perf: remove duplicate samples on the first tracepoint event
netpoll: Use rcu_access_pointer() in netpoll_poll_lock
ALSA: 6fire: Release resources at card release
ALSA: caiaq: Use snd_card_free_when_closed() at disconnection
ALSA: us122l: Use snd_card_free_when_closed() at disconnection
net: rfkill: gpio: Add check for clk_enable()
selftests: net: really check for bg process completion
bpf, sockmap: Fix sk_msg_reset_curr
bpf, sockmap: Several fixes to bpf_msg_pop_data
bpf, sockmap: Several fixes to bpf_msg_push_data
drm/etnaviv: hold GPU lock across perfmon sampling
drm/etnaviv: fix power register offset on GC300
drm/etnaviv: dump: fix sparse warnings
drm/msm/adreno: Use IRQF_NO_AUTOEN flag in request_irq()
drm/panfrost: Remove unused id_mask from struct panfrost_model
wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan()
bpf: Fix the xdp_adjust_tail sample prog issue
ASoC: fsl_micfil: fix regmap_write_bits usage
ASoC: fsl_micfil: use GENMASK to define register bit fields
ASoC: fsl_micfil: do not define SHIFT/MASK for single bits
ASoC: fsl_micfil: Drop unnecessary register read
dt-bindings: vendor-prefixes: Add NeoFidelity, Inc
drm/imx/ipuv3: Use IRQF_NO_AUTOEN flag in request_irq()
wifi: mwifiex: Use IRQF_NO_AUTOEN flag in request_irq()
wifi: p54: Use IRQF_NO_AUTOEN flag in request_irq()
drm/omap: Fix locking in omap_gem_new_dmabuf()
wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service()
drm/mm: Mark drm_mm_interval_tree*() functions with __maybe_unused
firmware: arm_scpi: Check the DVFS OPP count returned by the firmware
regmap: irq: Set lockdep class for hierarchical IRQ domains
ARM: dts: cubieboard4: Fix DCDC5 regulator constraints
tpm: fix signed/unsigned bug when checking event logs
efi/tpm: Pass correct address to memblock_reserve
mmc: mmc_spi: drop buggy snprintf()
soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get()
soc: ti: smartreflex: Use IRQF_NO_AUTOEN flag in request_irq()
time: Fix references to _msecs_to_jiffies() handling of values
crypto: cavium - Fix an error handling path in cpt_ucode_load_fw()
crypto: bcm - add error check in the ahash_hmac_init function
crypto: cavium - Fix the if condition to exit loop after timeout
crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY
EDAC/fsl_ddr: Fix bad bit shift operations
EDAC/bluefield: Fix potential integer overflow
firmware: google: Unregister driver_info on failure
firmware: google: Unregister driver_info on failure and exit in gsmi
hfsplus: don't query the device logical block size multiple times
s390/syscalls: Avoid creation of arch/arch/ directory
acpi/arm64: Adjust error handling procedure in gtdt_parse_timer_block()
m68k: mvme147: Reinstate early console
m68k: mvme16x: Add and use "mvme16x.h"
m68k: mvme147: Fix SCSI controller IRQ numbers
nvme-pci: fix freeing of the HMB descriptor table
initramfs: avoid filename buffer overrun
mips: asm: fix warning when disabling MIPS_FP_SUPPORT
x86/xen/pvh: Annotate indirect branch as safe
nvme: fix metadata handling in nvme-passthrough
NFSD: Force all NFSv4.2 COPY requests to be synchronous
cifs: Fix buffer overflow when parsing NFS reparse points
ipmr: Fix access to mfc_cache_list without lock held
proc/softirqs: replace seq_printf with seq_put_decimal_ull_width
ASoC: stm: Prevent potential division by zero in stm32_sai_get_clk_div()
ASoC: stm: Prevent potential division by zero in stm32_sai_mclk_round_rate()
regulator: rk808: Add apply_bit for BUCK3 on RK809
soc: qcom: Add check devm_kasprintf() returned value
net: usb: qmi_wwan: add Quectel RG650V
x86/amd_nb: Fix compile-testing without CONFIG_AMD_NB
ALSA: hda/realtek: Add subwoofer quirk for Infinix ZERO BOOK 13
selftests/watchdog-test: Fix system accidentally reset after watchdog-test
mac80211: fix user-power when emulating chanctx
ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet
mm: revert "mm: shmem: fix data-race in shmem_getattr()"
kbuild: Use uname for LINUX_COMPILE_HOST detection
media: dvbdev: fix the logic when DVB_DYNAMIC_MINORS is not set
Revert "mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K"
nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint
ocfs2: fix UBSAN warning in ocfs2_verify_volume()
nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint
KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN
ocfs2: uncache inode which has failed entering the group
net/mlx5e: kTLS, Fix incorrect page refcounting
net/mlx5: fs, lock FTE when checking if active
netlink: terminate outstanding dump on socket close
Change-Id: Ic2d25f06fdad1b93fb421380a76d33f0b15c7b28
|
||
|
Michael Bestas
|
b9715311a2 |
Merge tag 'ASB-2025-02-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
https://source.android.com/docs/security/bulletin/2025-02-01 CVE-2024-53104 CVE-2025-0088 * tag 'ASB-2025-02-05_11-5.4' of https://android.googlesource.com/kernel/common: (449 commits) ANDROID: gki - change networking configuration ANDROID: kernelci build-break for 64-bit riscv clang builds (5.4 only) Revert "BACKPORT: RISC-V: Stop relying on GCC's register allocator's hueristics" Revert "ANDROID: declare sp_in_global outside of CONFIG_FRAME_POINTER" ANDROID: GKI: add Trimble symbol list UPSTREAM: selinux: ignore unknown extended permissions ANDROID: ABI: Update allowed list for galaxy Revert "netfilter: Replace zero-length array with flexible-array member" Revert "tracing: Constify string literal data member in struct trace_event_call" Revert "skb_expand_head() adjust skb->truesize incorrectly" Linux 5.4.289 ftrace: use preempt_enable/disable notrace macros to avoid double fault mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() drm: adv7511: Drop dsi single lane support net/sctp: Prevent autoclose integer overflow in sctp_association_init() sky2: Add device ID 11ab:4373 for Marvell 88E8075 pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking RDMA/uverbs: Prevent integer overflow issue modpost: fix the missed iteration for the max bit in do_input() modpost: fix input MODULE_DEVICE_TABLE() built for 64-bit on 32-bit host ... Conflicts: arch/arm64/boot/dts/vendor/bindings/clock/adi,axi-clkgen.yaml arch/arm64/boot/dts/vendor/bindings/clock/axi-clkgen.txt drivers/rpmsg/qcom_glink_native.c drivers/soc/qcom/socinfo.c Change-Id: I60727e0cdd974fda5ca71f938bc2f984a8bbf19a |
||
|
Greg Kroah-Hartman
|
21c9625b20 |
Merge 5.4.290 into android11-5.4-lts
Changes in 5.4.290 jbd2: flush filesystem device before updating tail sequence dm array: fix releasing a faulty array block twice in dm_array_cursor_end dm array: fix unreleased btree blocks on closing a faulty array cursor dm array: fix cursor index when skipping across block boundaries ieee802154: ca8210: Add missing check for kfifo_alloc() in ca8210_probe() net: 802: LLC+SNAP OID:PID lookup on start of skb data tcp/dccp: complete lockless accesses to sk->sk_max_ack_backlog tcp/dccp: allow a connection when sk_max_ack_backlog is zero net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute tls: Fix tls_sw_sendmsg error handling dm thin: make get_first_thin use rcu-safe list first function sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy sctp: sysctl: auth_enable: avoid using current->nsproxy drm/amd/display: Add check for granularity in dml ceil/floor helpers ACPI: resource: Add TongFang GM5HG0A to irq1_edge_low_force_override[] ACPI: resource: Add Asus Vivobook X1504VAP to irq1_level_low_skip_override[] drm/amd/display: increase MAX_SURFACES to the value supported by hw USB: serial: option: add MeiG Smart SRM815 USB: serial: option: add Neoway N723-EA support staging: iio: ad9834: Correct phase range check staging: iio: ad9832: Correct phase range check usb-storage: Add max sectors quirk for Nokia 208 USB: serial: cp210x: add Phoenix Contact UPS Device usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null USB: usblp: return error when setting unsupported protocol USB: core: Disable LPM only for non-suspended ports usb: fix reference leak in usb_new_device() usb: gadget: f_fs: Remove WARN_ON in functionfs_bind iio: pressure: zpa2326: fix information leak in triggered buffer iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer iio: light: vcnl4035: fix information leak in triggered buffer iio: imu: kmx61: fix information leak in triggered buffer iio: adc: ti-ads8688: fix information leak in triggered buffer iio: gyro: fxas21002c: Fix missing data update in trigger handler iio: adc: ti-ads124s08: Use gpiod_set_value_cansleep() iio: adc: at91: call input_free_device() on allocated iio_dev iio: inkern: call iio_device_put() only on mapped devices arm64: dts: rockchip: fix defines in pd_vio node for rk3399 arm64: dts: rockchip: fix pd_tcpc0 and pd_tcpc1 node position on rk3399 arm64: dts: rockchip: add #power-domain-cells to power domain nodes arm64: dts: rockchip: add hevc power domain clock to rk3328 phy: core: fix code style in devm_of_phy_provider_unregister phy: core: Fix that API devm_of_phy_provider_unregister() fails to unregister the phy provider ocfs2: correct return value of ocfs2_local_free_info() ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv sctp: sysctl: rto_min/max: avoid using current->nsproxy net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field() net: net_namespace: Optimize the code net: add exit_batch_rtnl() method gtp: use exit_batch_rtnl() method gtp: Use for_each_netdev_rcu() in gtp_genl_dump_pdp(). gtp: Destroy device along with udp socket's netns dismantle. nfp: bpf: prevent integer overflow in nfp_bpf_event_output() drm/v3d: Ensure job pointer is set to NULL after job completion i2c: mux: demux-pinctrl: check initial mux selection, too mac802154: check local interfaces before deleting sdata list hfs: Sanity check the root record kheaders: Ignore silly-rename files poll_wait: add mb() to fix theoretical race between waitqueue_active() and .poll() nvmet: propagate npwg topology net: ethernet: xgbe: re-add aneg to supported features in PHY quirks fs/proc: fix softlockup in __read_vmcore (part 2) irqchip/gic-v3: Handle CPU_PM_ENTER_FAILED correctly hrtimers: Handle CPU state correctly on hotplug ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev() scsi: sg: Fix slab-use-after-free read in sg_release() net: fix data-races around sk->sk_forward_alloc ASoC: wm8994: Add depends on MFD core scsi: iscsi: Fix redundant response for ISCSI_UEVENT_GET_HOST_STATS request irqchip/sunxi-nmi: Add missing SKIP_WAKE flag gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag m68k: Update ->thread.esp0 before calling syscall_trace() in ret_from_signal m68k: Add missing mmap_read_lock() to sys_cacheflush() signal/m68k: Use force_sigsegv(SIGSEGV) in fpsp040_die net: xen-netback: hash.c: Use built-in RCU list checking net/xen-netback: prevent UAF in xenvif_flush_hash() vfio/platform: check the bounds of read/write syscalls ext4: avoid ext4_error()'s caused by ENOMEM in the truncate path ext4: fix slab-use-after-free in ext4_split_extent_at() USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb() Revert "usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null" Input: atkbd - map F23 key to support default copilot shortcut Input: xpad - add unofficial Xbox 360 wireless receiver clone Input: xpad - add support for wooting two he (arm) drm/v3d: Assign job pointer to NULL before signaling the fence xhci: use pm_ptr() instead of #ifdef for CONFIG_PM conditionals Partial revert of xhci: use pm_ptr() instead #ifdef for CONFIG_PM conditionals Linux 5.4.290 Change-Id: Ie2e10bc16d6eb9da965c01168b2b8854e5dfaf8c Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
|
Maíra Canal
|
9793206fbf |
drm/v3d: Assign job pointer to NULL before signaling the fence
commit 6e64d6b3a3c39655de56682ec83e894978d23412 upstream.
In commit e4b5ccd392b9 ("drm/v3d: Ensure job pointer is set to NULL
after job completion"), we introduced a change to assign the job pointer
to NULL after completing a job, indicating job completion.
However, this approach created a race condition between the DRM
scheduler workqueue and the IRQ execution thread. As soon as the fence is
signaled in the IRQ execution thread, a new job starts to be executed.
This results in a race condition where the IRQ execution thread sets the
job pointer to NULL simultaneously as the `run_job()` function assigns
a new job to the pointer.
This race condition can lead to a NULL pointer dereference if the IRQ
execution thread sets the job pointer to NULL after `run_job()` assigns
it to the new job. When the new job completes and the GPU emits an
interrupt, `v3d_irq()` is triggered, potentially causing a crash.
[ 466.310099] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000c0
[ 466.318928] Mem abort info:
[ 466.321723] ESR = 0x0000000096000005
[ 466.325479] EC = 0x25: DABT (current EL), IL = 32 bits
[ 466.330807] SET = 0, FnV = 0
[ 466.333864] EA = 0, S1PTW = 0
[ 466.337010] FSC = 0x05: level 1 translation fault
[ 466.341900] Data abort info:
[ 466.344783] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
[ 466.350285] CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[ 466.355350] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[ 466.360677] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000089772000
[ 466.367140] [00000000000000c0] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000
[ 466.375875] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP
[ 466.382163] Modules linked in: rfcomm snd_seq_dummy snd_hrtimer snd_seq snd_seq_device algif_hash algif_skcipher af_alg bnep binfmt_misc vc4 snd_soc_hdmi_codec drm_display_helper cec brcmfmac_wcc spidev rpivid_hevc(C) drm_client_lib brcmfmac hci_uart drm_dma_helper pisp_be btbcm brcmutil snd_soc_core aes_ce_blk v4l2_mem2mem bluetooth aes_ce_cipher snd_compress videobuf2_dma_contig ghash_ce cfg80211 gf128mul snd_pcm_dmaengine videobuf2_memops ecdh_generic sha2_ce ecc videobuf2_v4l2 snd_pcm v3d sha256_arm64 rfkill videodev snd_timer sha1_ce libaes gpu_sched snd videobuf2_common sha1_generic drm_shmem_helper mc rp1_pio drm_kms_helper raspberrypi_hwmon spi_bcm2835 gpio_keys i2c_brcmstb rp1 raspberrypi_gpiomem rp1_mailbox rp1_adc nvmem_rmem uio_pdrv_genirq uio i2c_dev drm ledtrig_pattern drm_panel_orientation_quirks backlight fuse dm_mod ip_tables x_tables ipv6
[ 466.458429] CPU: 0 UID: 1000 PID: 2008 Comm: chromium Tainted: G C 6.13.0-v8+ #18
[ 466.467336] Tainted: [C]=CRAP
[ 466.470306] Hardware name: Raspberry Pi 5 Model B Rev 1.0 (DT)
[ 466.476157] pstate: 404000c9 (nZcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 466.483143] pc : v3d_irq+0x118/0x2e0 [v3d]
[ 466.487258] lr : __handle_irq_event_percpu+0x60/0x228
[ 466.492327] sp : ffffffc080003ea0
[ 466.495646] x29: ffffffc080003ea0 x28: ffffff80c0c94200 x27: 0000000000000000
[ 466.502807] x26: ffffffd08dd81d7b x25: ffffff80c0c94200 x24: ffffff8003bdc200
[ 466.509969] x23: 0000000000000001 x22: 00000000000000a7 x21: 0000000000000000
[ 466.517130] x20: ffffff8041bb0000 x19: 0000000000000001 x18: 0000000000000000
[ 466.524291] x17: ffffffafadfb0000 x16: ffffffc080000000 x15: 0000000000000000
[ 466.531452] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
[ 466.538613] x11: 0000000000000000 x10: 0000000000000000 x9 : ffffffd08c527eb0
[ 466.545777] x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
[ 466.552941] x5 : ffffffd08c4100d0 x4 : ffffffafadfb0000 x3 : ffffffc080003f70
[ 466.560102] x2 : ffffffc0829e8058 x1 : 0000000000000001 x0 : 0000000000000000
[ 466.567263] Call trace:
[ 466.569711] v3d_irq+0x118/0x2e0 [v3d] (P)
[ 466.573826] __handle_irq_event_percpu+0x60/0x228
[ 466.578546] handle_irq_event+0x54/0xb8
[ 466.582391] handle_fasteoi_irq+0xac/0x240
[ 466.586498] generic_handle_domain_irq+0x34/0x58
[ 466.591128] gic_handle_irq+0x48/0xd8
[ 466.594798] call_on_irq_stack+0x24/0x58
[ 466.598730] do_interrupt_handler+0x88/0x98
[ 466.602923] el0_interrupt+0x44/0xc0
[ 466.606508] __el0_irq_handler_common+0x18/0x28
[ 466.611050] el0t_64_irq_handler+0x10/0x20
[ 466.615156] el0t_64_irq+0x198/0x1a0
[ 466.618740] Code: 52800035 3607faf3 f9442e80 52800021 (f9406018)
[ 466.624853] ---[ end trace 0000000000000000 ]---
[ 466.629483] Kernel panic - not syncing: Oops: Fatal exception in interrupt
[ 466.636384] SMP: stopping secondary CPUs
[ 466.640320] Kernel Offset: 0x100c400000 from 0xffffffc080000000
[ 466.646259] PHYS_OFFSET: 0x0
[ 466.649141] CPU features: 0x100,00000170,00901250,0200720b
[ 466.654644] Memory Limit: none
[ 466.657706] ---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]---
Fix the crash by assigning the job pointer to NULL before signaling the
fence. This ensures that the job pointer is cleared before any new job
starts execution, preventing the race condition and the NULL pointer
dereference crash.
Cc: stable@vger.kernel.org
Fixes: e4b5ccd392b9 ("drm/v3d: Ensure job pointer is set to NULL after job completion")
Signed-off-by: Maíra Canal <mcanal@igalia.com>
Reviewed-by: Jose Maria Casanova Crespo <jmcasanova@igalia.com>
Reviewed-by: Iago Toral Quiroga <itoral@igalia.com>
Tested-by: Phil Elwell <phil@raspberrypi.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20250123012403.20447-1-mcanal@igalia.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
|
Maíra Canal
|
1bd6303d08 |
drm/v3d: Ensure job pointer is set to NULL after job completion
[ Upstream commit e4b5ccd392b92300a2b341705cc4805681094e49 ]
After a job completes, the corresponding pointer in the device must
be set to NULL. Failing to do so triggers a warning when unloading
the driver, as it appears the job is still active. To prevent this,
assign the job pointer to NULL after completing the job, indicating
the job has finished.
Fixes:
|
||
|
Melissa Wen
|
04301fadfb |
drm/amd/display: increase MAX_SURFACES to the value supported by hw
commit 21541bc6b44241e3f791f9e552352d8440b2b29e upstream. As the hw supports up to 4 surfaces, increase the maximum number of surfaces to prevent the DC error when trying to use more than three planes. [drm:dc_state_add_plane [amdgpu]] *ERROR* Surface: can not attach plane_state 000000003e2cb82c! Maximum is: 3 Link: https://gitlab.freedesktop.org/drm/amd/-/issues/3693 Signed-off-by: Melissa Wen <mwen@igalia.com> Reviewed-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com> Signed-off-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit b8d6daffc871a42026c3c20bff7b8fa0302298c1) Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Roman Li
|
8a9315e6f7 |
drm/amd/display: Add check for granularity in dml ceil/floor helpers
commit 0881fbc4fd62e00a2b8e102725f76d10351b2ea8 upstream. [Why] Wrapper functions for dcn_bw_ceil2() and dcn_bw_floor2() should check for granularity is non zero to avoid assert and divide-by-zero error in dcn_bw_ functions. [How] Add check for granularity 0. Cc: Mario Limonciello <mario.limonciello@amd.com> Reviewed-by: Alvin Lee <alvin.lee2@amd.com> Signed-off-by: Roman Li <Roman.Li@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit f6e09701c3eb2ccb8cb0518e0b67f1c69742a4ec) Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Lynus Vaz
|
50912cf9c7 |
kgsl: Update kgsl_cancel_event() to cancel the first matching event
When cancelling events, we go through the entire list and remove all matching events. This is not what we want since callers expect to cancel a single event. So, exit the search when we find and cancel the first matching event in the list. Change-Id: I81af95e853f6408c6a0c5769fcece5f4493938bc Signed-off-by: Lynus Vaz <quic_lvaz@quicinc.com> Signed-off-by: aswin7469 <aswinas@pixysos.com> |
||
|
Lynus Vaz
|
337fd31173 |
kgsl: Cancel waittimestamp events on timeout
When a waittimestamp times out, the corresponding event structure still remains on the event list. If repeated timeouts occur, this can cause them to pile up and delay processing of other events. Instead of leaving these events active, cancel them. Change-Id: I4932636a4dfbec8a01533fafe772a99b1c48167a Signed-off-by: Lynus Vaz <quic_lvaz@quicinc.com> |
||
|
Kazuki Hashimoto
|
29181981df |
Revert "msm: kgsl: Print always on counters if fenced write timed out"
This reverts commit
|
||
|
Cosmin Tanislav
|
9c390214f5 |
Revert "msm: kgsl: Add tracepoints for the pools"
This reverts commit
|
||
|
Sultan Alsawaf
|
25f01507a5 |
Revert "msm: kgsl: Add per process GPU memory usage trace"
This reverts commit c1661af828b27a9177bbcb2cf061f91853bd66a7. This is debug cruft. Remove it completely since CAF's 4.14 branch doesn't have it. Signed-off-by: Sultan Alsawaf <sultan@kerneltoast.com> Signed-off-by: Divyanshu-Modi <divyan.m05@gmail.com> Change-Id: I6a49d732b7a52a06416356b079f92b9ac050d38f |
||
|
Sultan Alsawaf
|
daea648433 |
msm: kgsl: Use lock-less list for page pools
Page pool additions and removals are very hot during GPU workloads, so they should be optimized accordingly. We can use a lock-less list for storing the free pages in order to speed things up. The lock-less list allows for one llist_del_first() user and unlimited llist_add() users to run concurrently, so only a spin lock around the llist_del_first() is needed; everything else is lock-free. The per-pool page count is now an atomic to make it lock-free as well. Signed-off-by: Sultan Alsawaf <sultan@kerneltoast.com> Signed-off-by: Juhyung Park <qkrwngud825@gmail.com> Signed-off-by: Divyanshu-Modi <divyan.m05@gmail.com> Change-Id: I2af850aa81e3a66a0165af1e230a438eb6493ad9 Signed-off-by: Divyanshu-Modi <divyan.m05@gmail.com> |
||
|
Sultan Alsawaf
|
735cc9d2d4 |
msm: kgsl: Remove unneeded profiling from ringbuffer submission
The profiling here is only used to provide additional debug info for a context dump as well as a tracepoint. It adds non-trivial overhead to ringbuffer submission since it accesses GPU registers, so remove it along with the tracepoint since we're not debugging adreno. Signed-off-by: Sultan Alsawaf <sultan@kerneltoast.com> [Kazuki: Remove tracer cruft + fix unused variable warnings] Signed-off-by: Kazuki Hashimoto <kazukih@tuta.io> Signed-off-by: Divyanshu-Modi <divyan.m05@gmail.com> Change-Id: I92ffbdd26caa8e08850f70505e9872f9f0f2c0e8 Signed-off-by: Divyanshu-Modi <divyan.m05@gmail.com> |
||
|
Sultan Alsawaf
|
7acdfa92bf |
msm: kgsl: Don't busy wait for fenced GMU writes when possible
The most frequent user of fenced GMU writes, adreno_ringbuffer_submit(), performs a fenced GMU write under a spin lock, and since fenced GMU writes use udelay(), a lot of CPU cycles are burned here. Not only is the spin lock held for longer than necessary (because the write doesn't need to be inside the spin lock), but also a lot of CPU time is wasted in udelay() for tens of microseconds when usleep_range() can be used instead. Move the locked fenced GMU writes to outside their spin locks and make adreno_gmu_fenced_write() use usleep_range() when not in atomic/IRQ context, to save power and improve performance. Fenced GMU writes are found to take an average of 28 microseconds on the Snapdragon 855, so a usleep range of 10 to 30 microseconds is optimal. Signed-off-by: Sultan Alsawaf <sultan@kerneltoast.com> Signed-off-by: Divyanshu-Modi <divyan.m05@gmail.com> Change-Id: I52320941b9c6d471834060e7920f3778e2d33f38 Signed-off-by: Divyanshu-Modi <divyan.m05@gmail.com> |
||
|
Sultan Alsawaf
|
40df18d725 |
msm: kgsl: Don't try to wait for fences that have been signaled
Trying to wait for fences that have already been signaled incurs a high setup cost, since dynamic memory allocation must be used. Avoiding this overhead when it isn't needed improves performance. Signed-off-by: Sultan Alsawaf <sultan@kerneltoast.com> Signed-off-by: Divyanshu-Modi <divyan.m05@gmail.com> Change-Id: I5a71946e3fe824ad15bb51cbed0cb31d3e3b3d8a Signed-off-by: Divyanshu-Modi <divyan.m05@gmail.com> |
||
|
Sultan Alsawaf
|
b2434914a8 |
msm: kgsl: Wake GPU upon receiving an ioctl rather than upon touch input
Waking the GPU upon touch wastes power when the screen is being touched in a way that does not induce animation or any actual need for GPU usage. Instead of preemptively waking the GPU on touch input, wake it up upon receiving a IOCTL_KGSL_GPU_COMMAND ioctl since it is a sign that the GPU will soon be needed. Signed-off-by: Sultan Alsawaf <sultan@kerneltoast.com> [Kazuki: Port to v5.4] Signed-off-by: Kazuki Hashimoto <kazukih@tuta.io> Signed-off-by: Divyanshu-Modi <divyan.m05@gmail.com> Change-Id: I848ac0b00f72f7bb2b08b478e86968ea8c595f3c Signed-off-by: Divyanshu-Modi <divyan.m05@gmail.com> Signed-off-by: aswin7469 <aswinas@pixysos.com> |
||
|
Sultan Alsawaf
|
e6e8523900 |
msm: kgsl: Increase worker thread priority
Currently, the kgsl worker thread is erroneously ranked right below Android's audio threads in terms of priority. The kgsl worker thread is in the critical path for rendering frames to the display, so increase its priority to match the priority of the display commit threads. Signed-off-by: Sultan Alsawaf <sultan@kerneltoast.com> Signed-off-by: mukesh22584 <mks22584@gmail.com> |
||
|
Tim Murray
|
c65c12f8f5 |
drivers: gpu: kgsl: Add low_prio_worker thread
Adds a new CFS thread for freeing GPU memory. Improves performance when tearing down processes (eg, via LMK) and not blocking currently running UI from submitting work to the GPU. Test: boots, works Bug: 137140296 Bug: 137927078 Signed-off-by: Tim Murray <timmurray@google.com> Signed-off-by: Sean Callanan <spyffe@google.com> Change-Id: I84c2aab45859af3227edd8e8aa66429ea58f21ec Signed-off-by: mukesh22584 <mks22584@gmail.com> |
||
|
Rick Yiu
|
07901b02a1 |
drivers: gpu: Move kgsl_3d_init to async probe
To reduce boot time to first stage. Bug: 129688998 Test: reboot 100 times, camera, wifi, basic operation Signed-off-by: Rick Yiu <rickyiu@google.com> Change-Id: Ifb353952fc416b9817c44496401d28b545a4208c |
||
|
Kamal Agrawal
|
0791231845 |
msm: kgsl: Avoid inline submission if slumber is in progress
Consider a scenario where usermode is submitting commands while slumber is in progress. During slumber sequence, device mutex is held by kgsl and it polls for CX gdsc to go down. It is possible that SMMU can keep a vote on CX due to ongoing iommu operations and it may take longer for CX gdsc to go down. In another thread, say usermode is submitting commands, currently these commands are submitted inline to the GPU for gmu based targets. However, while submitting commands to GPU, device mutex is needed. Usermode thread will be blocked on device mutex as it is held by slumber thread. This can result in UI freeze or janks. To resolve this, avoid inline submission whenever slumber is in progress. Add relevant code to properly update the slumber entry and exit flag. Change-Id: I1b103891ad4b386e230b260fe5dbf6db20470ca9 Signed-off-by: Deepak Kumar <quic_dkumar@quicinc.com> Signed-off-by: Kamal Agrawal <quic_kamaagra@quicinc.com> |
||
|
Rohan Sethi
|
16478f9c60 |
msm: kgsl: set vm_pgoff of vma to zero
kgsl gets the entry id or the gpu address through vm_pgoff. It is used during mmap and never needed again. But this pgoff has different meaning at other parts of kernel. Not setting to zero will let way for wrong assumption when tried to unmap a page from the vma. Change-Id: Ia81c64a77456caf168c6bd23bdf5755c3f3ee31c Signed-off-by: Puranam V G Tejaswi <pvgtejas@codeaurora.org> Signed-off-by: Rohan Sethi <rohsethi@codeaurora.org> |
||
|
Pankaj Gupta
|
21e776685d |
msm: kgsl: Skip msm-adreno-tz algorithm when single power level in use
msm-adreno-tz governor updates performance counters which are needed for msm-adreno-tz and gpubw_mon governors. When single power level is enabled, update stats and return without running msm-adreno-tz algorithm to save cpu cycles. These updated stats can be used by gpubw_mon governor. Change-Id: I3d0d5cde8726a9ee5421516c2841aa19b57050e2 Signed-off-by: Pankaj Gupta <quic_gpankaj@quicinc.com> |
||
|
Rohan Sethi
|
6142a55dfd |
msm: kgsl: Skip VM page insert operations for IO-Coherent cached buffers
IO-Coherent cached buffers can be reclaimed. There is possibility that for reclaimed buffer mmap() request can result into null pointer dereference in vm_insert_page(). So, skip VM page insert operations for IO-coherent cached buffers in mmap(). These buffers can be handled at CPU page fault time in the kgsl vmfault handler. Change-Id: I6cf29af2d37de736df27f745fc9bceb01cb097e6 Signed-off-by: Hareesh Gundu <quic_hareeshg@quicinc.com> Signed-off-by: Rohan Sethi <quic_rohsethi@quicinc.com> |
||
|
Lynus Vaz
|
a57654a5fc |
msm: kgsl: Allocate memory for sync callbacks using GFP_KERNEL
The sync fence callbacks are allocated in kernel context. Use the GFP_KERNEL flag instead of GFP_ATOMIC to permit the allocation to sleep if required. Change-Id: I2099229cb1fb734e87e4bff0ddc38a2ced2c03ea Signed-off-by: Lynus Vaz <quic_lvaz@quicinc.com> |
||
|
Akhil P Oommen
|
128fd4c083 |
msm: kgsl: Trigger timers during inline submission
Currently, we don't trigger dispatcher timer while doing an inline submission. This breaks the long ib detection. So, trigger dispatcher timer during an inline submission. Change-Id: I36397cea3f6ea4393789cd4b54a2258e189f4b13 Signed-off-by: Akhil P Oommen <quic_akhilpo@quicinc.com> |
||
|
Kamal Agrawal
|
19f5efce4c |
msm: kgsl: Avoid global process lock for close
Currently, resources for processes are freed within global process lock. This can block resources of multiple other processes. Ideally, there is no global resource that is being protected. Introduce a process private level lock to protect the private information. Change-Id: Ib28da1e346269eaa0a638b32ebc7471ff676afb0 Signed-off-by: Kamal Agrawal <quic_kamaagra@quicinc.com> |
||
|
Harshdeep Dhatt
|
160c73ac5c |
msm: kgsl: Avoid double SLUMBER entry
adreno_suspend_context() relinquishes the device mutex which opens up a window for a concurrent thread to attempt SLUMBER. Hence, check for flags again, before proceeding with SLUMBER sequence. Change-Id: I3f36e19e31f5399a038a29af5cb9bc9f59bdfa5b Signed-off-by: Harshdeep Dhatt <hdhatt@codeaurora.org> |
||
|
Rituraj Raman
|
80c1f7b9b8 |
msm: kgsl: set/clear power_flags
For gmu/rgmu based targets, set/clear power_flags during clock enable/disable. This flag is checked before accessing power counter. Change-Id: Ie3eba37cc66135d909daa2669fd8e7e0fe4287a4 Signed-off-by: Rituraj Raman <riturama@codeaurora.org> |
||
|
Nitheesh Muthuraj
|
f59ec4a85e |
msm: kgsl: Fix syncsource spinlock recursion
Syncsource spinlocks can be taken in IRQ context, so it needs to be IRQ-safe else it would lead to spinlock recursion. Disable the interrupt when the lock is taken in interrupt context, and re-enable it when while unlocking. Change-Id: Ifb76d6f450d47f1d22fe661fac0388b9f4c941db Signed-off-by: Nitheesh Muthuraj <nmuthuraj@codeaurora.org> |
||
|
Jake Weinstein
|
a1df06de62 |
modules: Allow Yupik and Shima to build without ARCH_LAHAINA
Change-Id: I965f994c83723709ae340ee8d4a4d4145b0f9a49 |
||
|
alk3pInjection
|
62ae18a846 |
treewide: Import OEM changes
Change-Id: I1375797d70876931eef62f215f70e2e4bc776d5b |
||
|
Sultan Alsawaf
|
d429f1b5c0 |
adreno_tz: Fix GPU target frequency calculation for HFR
It seems that the black-box GPU frequency selection algorithm is unaware of high refresh rates, and assumes a refresh rate of 60 Hz for its target frequencies. This results in frequencies that are too low being selected when a higher refresh rate, such as 90 Hz, is used. To remedy this, multiply the GPU's busy time by a ratio of the current refresh rate to 60 Hz. This makes msm-adreno-tz select the right frequencies needed to avoid stuttering. Change-Id: Id8b2f025ce9f74faa20ecbee42f27d69fd74f7de [ghostrider-reborn: support dfps] Signed-off-by: Adithya R <gh0strider.2k18.reborn@gmail.com> |
||
|
Greg Kroah-Hartman
|
a85d92d704 |
Merge 5.4.289 into android11-5.4-lts
Changes in 5.4.289 net: sched: fix ordering of qlen adjustment usb: dwc2: gadget: Don't write invalid mapped sg entries into dma_desc with iommu enabled PCI/AER: Disable AER service on suspend ALSA: usb: Fix UBSAN warning in parse_audio_unit() PCI: Add ACS quirk for Broadcom BCM5760X NIC i2c: pnx: Fix timeout in wait functions drm/i915: Fix memory leak by correcting cache object name in error handler erofs: fix order >= MAX_ORDER warning due to crafted negative i_size erofs: fix incorrect symlink detection in fast symlink net/smc: check sndbuf_space again after NOSPACE flag is set in smc_poll ionic: use ee->offset when returning sprom data net: hinic: Fix cleanup in create_rxqs/txqs() net: ethernet: bgmac-platform: fix an OF node reference leak netfilter: ipset: Fix for recursive locking warning mmc: sdhci-tegra: Remove SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC quirk chelsio/chtls: prevent potential integer overflow on 32bit i2c: riic: Always round-up when calculating bus period efivarfs: Fix error on non-existent file USB: serial: option: add TCL IK512 MBIM & ECM USB: serial: option: add MeiG Smart SLM770A USB: serial: option: add Netprisma LCUK54 modules for WWAN Ready USB: serial: option: add MediaTek T7XX compositions USB: serial: option: add Telit FE910C04 rmnet compositions sh: clk: Fix clk_enable() to return 0 on NULL clk zram: refuse to use zero sized block device as backing device btrfs: tree-checker: reject inline extent items with 0 ref count NFS/pnfs: Fix a live lock between recalled layouts and layoutget of/irq: Fix using uninitialized variable @addr_len in API of_irq_parse_one() nilfs2: prevent use of deleted inode udmabuf: also check for F_SEAL_FUTURE_WRITE of: Fix error path in of_parse_phandle_with_args_map() of: Fix refcount leakage for OF node returned by __of_get_dma_parent() media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg bpf: Check negative offsets in __bpf_skb_min_len() nfsd: restore callback functionality for NFSv4.0 mtd: diskonchip: Cast an operand to prevent potential overflow phy: core: Fix an OF node refcount leakage in _of_phy_get() phy: core: Fix an OF node refcount leakage in of_phy_provider_lookup() phy: core: Fix that API devm_phy_put() fails to release the phy phy: core: Fix that API devm_phy_destroy() fails to destroy the phy dmaengine: mv_xor: fix child node refcount handling in early exit dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset mtd: rawnand: fix double free in atmel_pmecc_create_user() tracing/kprobe: Make trace_kprobe's module callback called after jump_label update scsi: qla1280: Fix hw revision numbering for ISP1020/1040 scsi: megaraid_sas: Fix for a potential deadlock regmap: Use correct format specifier for logging range errors platform/x86: asus-nb-wmi: Ignore unknown event 0xCF scsi: mpt3sas: Diag-Reset when Doorbell-In-Use bit is set during driver load time virtio-blk: don't keep queue frozen during system suspend epoll: Add synchronous wakeup support for ep_poll_callback MIPS: Probe toolchain support of -msym32 skbuff: introduce skb_expand_head() ipv6: use skb_expand_head in ip6_finish_output2 ipv6: use skb_expand_head in ip6_xmit ipv6: fix possible UAF in ip6_finish_output2() bpf: fix recursive lock when verdict program return SK_PASS tracing: Constify string literal data member in struct trace_event_call btrfs: avoid monopolizing a core when activating a swap file skb_expand_head() adjust skb->truesize incorrectly ipv6: prevent possible UAF in ip6_xmit() selinux: ignore unknown extended permissions Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet IB/mlx5: Introduce and use mlx5_core_is_vf() net/mlx5: Make API mlx5_core_is_ecpf accept const pointer RDMA/mlx5: Enforce same type port association for multiport RoCE RDMA/bnxt_re: Add check for path mtu in modify_qp RDMA/bnxt_re: Fix reporting hw_ver in query_device RDMA/bnxt_re: Fix max_qp_wrs reported drm: bridge: adv7511: Enable SPDIF DAI drm/bridge: adv7511_audio: Update Audio InfoFrame properly netrom: check buffer length before accessing it netfilter: Replace zero-length array with flexible-array member netfilter: nft_set_hash: unaligned atomic read on struct nft_set_ext net: llc: reset skb->transport_header ALSA: usb-audio: US16x08: Initialize array before use af_packet: fix vlan_get_tci() vs MSG_PEEK af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK ila: serialize calls to nf_register_net_hooks() wifi: mac80211: wake the queues in case of failure in resume sound: usb: format: don't warn that raw DSD is unsupported bpf: fix potential error return net: usb: qmi_wwan: add Telit FE910C04 compositions irqchip/gic: Correct declaration of *percpu_base pointer in union gic_base ARC: build: Try to guess GCC variant of cross compiler modpost: fix input MODULE_DEVICE_TABLE() built for 64-bit on 32-bit host modpost: fix the missed iteration for the max bit in do_input() RDMA/uverbs: Prevent integer overflow issue pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking sky2: Add device ID 11ab:4373 for Marvell 88E8075 net/sctp: Prevent autoclose integer overflow in sctp_association_init() drm: adv7511: Drop dsi single lane support mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() ftrace: use preempt_enable/disable notrace macros to avoid double fault Linux 5.4.289 Change-Id: I2fe8ada5386224ce16b22d4e1eff016656be40f3 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
|
Biju Das
|
bad27f62d8 |
drm: adv7511: Drop dsi single lane support
commit 79d67c499c3f886202a40c5cb27e747e4fa4d738 upstream.
As per [1] and [2], ADV7535/7533 supports only 2-, 3-, or 4-lane. Drop
unsupported 1-lane.
[1] https://www.analog.com/media/en/technical-documentation/data-sheets/ADV7535.pdf
[2] https://www.analog.com/media/en/technical-documentation/data-sheets/ADV7533.pdf
Fixes:
|
||
|
Stefan Ekenberg
|
53425075fb |
drm/bridge: adv7511_audio: Update Audio InfoFrame properly
[ Upstream commit 902806baf3c1e8383c1fe3ff0b6042b8cb5c2707 ]
AUDIO_UPDATE bit (Bit 5 of MAIN register 0x4A) needs to be set to 1
while updating Audio InfoFrame information and then set to 0 when done.
Otherwise partially updated Audio InfoFrames could be sent out. Two
cases where this rule were not followed are fixed:
- In adv7511_hdmi_hw_params() make sure AUDIO_UPDATE bit is updated
before/after setting ADV7511_REG_AUDIO_INFOFRAME.
- In audio_startup() use the correct register for clearing
AUDIO_UPDATE bit.
The problem with corrupted audio infoframes were discovered by letting
a HDMI logic analyser check the output of ADV7535.
Note that this patchs replaces writing REG_GC(1) with
REG_INFOFRAME_UPDATE. Bit 5 of REG_GC(1) is positioned within field
GC_PP[3:0] and that field doesn't control audio infoframe and is read-
only. My conclusion therefore was that the author if this code meant to
clear bit 5 of REG_INFOFRAME_UPDATE from the very beginning.
Tested-by: Biju Das <biju.das.jz@bp.renesas.com>
Fixes:
|
||
|
Bogdan Togorean
|
6ffd9a346f |
drm: bridge: adv7511: Enable SPDIF DAI
[ Upstream commit f7f436b99364a3904387eba613fc69853cc2f220 ] ADV7511 support I2S or SPDIF as audio input interfaces. This commit enable support for SPDIF. Signed-off-by: Bogdan Togorean <bogdan.togorean@analog.com> Reviewed-by: Andrzej Hajda <a.hajda@samsung.com> Signed-off-by: Andrzej Hajda <a.hajda@samsung.com> Link: https://patchwork.freedesktop.org/patch/msgid/20200413113513.86091-1-bogdan.togorean@analog.com Stable-dep-of: 902806baf3c1 ("drm/bridge: adv7511_audio: Update Audio InfoFrame properly") Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
|
Jiasheng Jiang
|
0430f13291 |
drm/i915: Fix memory leak by correcting cache object name in error handler
[ Upstream commit 9bc5e7dc694d3112bbf0fa4c46ef0fa0f114937a ]
Replace "slab_priorities" with "slab_dependencies" in the error handler
to avoid memory leak.
Fixes:
|
||
|
Michael Bestas
|
0262d4e51f |
Merge tag 'ASB-2024-12-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina
https://source.android.com/docs/security/bulletin/2024-12-01 * tag 'ASB-2024-12-05_11-5.4' of https://android.googlesource.com/kernel/common: (552 commits) UPSTREAM: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT ANDROID: add file for recording allowed ABI breaks Revert "spi: Fix deadlock when adding SPI controllers on SPI buses" Revert "spi: fix use-after-free of the add_lock mutex" ANDROID: declare sp_in_global outside of CONFIG_FRAME_POINTER BACKPORT: RISC-V: Stop relying on GCC's register allocator's hueristics UPSTREAM: x86/percpu: Clean up percpu_add_op() UPSTREAM: x86/percpu: Clean up percpu_from_op() UPSTREAM: x86/percpu: Clean up percpu_to_op() UPSTREAM: x86/percpu: Introduce size abstraction macros BACKPORT: FROMGIT: binder: add delivered_freeze to debugfs output BACKPORT: FROMGIT: binder: fix memleak of proc->delivered_freeze FROMGIT: binder: allow freeze notification for dead nodes FROMGIT: binder: fix BINDER_WORK_CLEAR_FREEZE_NOTIFICATION debug logs FROMGIT: binder: fix BINDER_WORK_FROZEN_BINDER debug logs BACKPORT: FROMGIT: binder: fix freeze UAF in binder_release_work() FROMGIT: binder: fix OOB in binder_add_freeze_work() FROMGIT: binder: fix node UAF in binder_add_freeze_work() Linux 5.4.286 mm: avoid leaving partial pfn mappings around in error case ... Conflicts: arch/arm64/boot/dts/vendor/bindings/gpu/samsung-rotator.txt arch/arm64/boot/dts/vendor/bindings/gpu/samsung-rotator.yaml drivers/clk/qcom/clk-rpmh.c drivers/usb/dwc3/core.c fs/erofs/decompressor.c net/qrtr/qrtr.c Change-Id: Iae3a7502b304d7be66da795411c4f330eef8b693 |
||
|
Greg Kroah-Hartman
|
ad8d63bdc6 |
Merge 5.4.287 into android11-5.4-lts
Changes in 5.4.287
netlink: terminate outstanding dump on socket close
net/mlx5: fs, lock FTE when checking if active
net/mlx5e: kTLS, Fix incorrect page refcounting
ocfs2: uncache inode which has failed entering the group
KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN
nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint
ocfs2: fix UBSAN warning in ocfs2_verify_volume()
nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint
Revert "mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K"
media: dvbdev: fix the logic when DVB_DYNAMIC_MINORS is not set
kbuild: Use uname for LINUX_COMPILE_HOST detection
mm: revert "mm: shmem: fix data-race in shmem_getattr()"
ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet
mac80211: fix user-power when emulating chanctx
selftests/watchdog-test: Fix system accidentally reset after watchdog-test
ALSA: hda/realtek: Add subwoofer quirk for Infinix ZERO BOOK 13
x86/amd_nb: Fix compile-testing without CONFIG_AMD_NB
net: usb: qmi_wwan: add Quectel RG650V
soc: qcom: Add check devm_kasprintf() returned value
regulator: rk808: Add apply_bit for BUCK3 on RK809
ASoC: stm: Prevent potential division by zero in stm32_sai_mclk_round_rate()
ASoC: stm: Prevent potential division by zero in stm32_sai_get_clk_div()
proc/softirqs: replace seq_printf with seq_put_decimal_ull_width
ipmr: Fix access to mfc_cache_list without lock held
cifs: Fix buffer overflow when parsing NFS reparse points
NFSD: Force all NFSv4.2 COPY requests to be synchronous
nvme: fix metadata handling in nvme-passthrough
x86/xen/pvh: Annotate indirect branch as safe
mips: asm: fix warning when disabling MIPS_FP_SUPPORT
initramfs: avoid filename buffer overrun
nvme-pci: fix freeing of the HMB descriptor table
m68k: mvme147: Fix SCSI controller IRQ numbers
m68k: mvme16x: Add and use "mvme16x.h"
m68k: mvme147: Reinstate early console
acpi/arm64: Adjust error handling procedure in gtdt_parse_timer_block()
s390/syscalls: Avoid creation of arch/arch/ directory
hfsplus: don't query the device logical block size multiple times
firmware: google: Unregister driver_info on failure and exit in gsmi
firmware: google: Unregister driver_info on failure
EDAC/bluefield: Fix potential integer overflow
EDAC/fsl_ddr: Fix bad bit shift operations
crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY
crypto: cavium - Fix the if condition to exit loop after timeout
crypto: bcm - add error check in the ahash_hmac_init function
crypto: cavium - Fix an error handling path in cpt_ucode_load_fw()
time: Fix references to _msecs_to_jiffies() handling of values
soc: ti: smartreflex: Use IRQF_NO_AUTOEN flag in request_irq()
soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get()
mmc: mmc_spi: drop buggy snprintf()
efi/tpm: Pass correct address to memblock_reserve
tpm: fix signed/unsigned bug when checking event logs
ARM: dts: cubieboard4: Fix DCDC5 regulator constraints
regmap: irq: Set lockdep class for hierarchical IRQ domains
firmware: arm_scpi: Check the DVFS OPP count returned by the firmware
drm/mm: Mark drm_mm_interval_tree*() functions with __maybe_unused
wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service()
drm/omap: Fix locking in omap_gem_new_dmabuf()
wifi: p54: Use IRQF_NO_AUTOEN flag in request_irq()
wifi: mwifiex: Use IRQF_NO_AUTOEN flag in request_irq()
drm/imx/ipuv3: Use IRQF_NO_AUTOEN flag in request_irq()
dt-bindings: vendor-prefixes: Add NeoFidelity, Inc
ASoC: fsl_micfil: Drop unnecessary register read
ASoC: fsl_micfil: do not define SHIFT/MASK for single bits
ASoC: fsl_micfil: use GENMASK to define register bit fields
ASoC: fsl_micfil: fix regmap_write_bits usage
bpf: Fix the xdp_adjust_tail sample prog issue
wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan()
drm/panfrost: Remove unused id_mask from struct panfrost_model
drm/msm/adreno: Use IRQF_NO_AUTOEN flag in request_irq()
drm/etnaviv: dump: fix sparse warnings
drm/etnaviv: fix power register offset on GC300
drm/etnaviv: hold GPU lock across perfmon sampling
bpf, sockmap: Several fixes to bpf_msg_push_data
bpf, sockmap: Several fixes to bpf_msg_pop_data
bpf, sockmap: Fix sk_msg_reset_curr
selftests: net: really check for bg process completion
net: rfkill: gpio: Add check for clk_enable()
ALSA: us122l: Use snd_card_free_when_closed() at disconnection
ALSA: caiaq: Use snd_card_free_when_closed() at disconnection
ALSA: 6fire: Release resources at card release
netpoll: Use rcu_access_pointer() in netpoll_poll_lock
trace/trace_event_perf: remove duplicate samples on the first tracepoint event
powerpc/vdso: Flag VDSO64 entry points as functions
mfd: tps65010: Use IRQF_NO_AUTOEN flag in request_irq() to fix race
mfd: da9052-spi: Change read-mask to write-mask
mfd: intel_soc_pmic_bxtwc: Use dev_err_probe()
mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device
mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device
mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices
cpufreq: loongson2: Unregister platform_driver on failure
mtd: rawnand: atmel: Fix possible memory leak
RDMA/bnxt_re: Check cqe flags to know imm_data vs inv_irkey
mfd: rt5033: Fix missing regmap_del_irq_chip()
scsi: bfa: Fix use-after-free in bfad_im_module_exit()
scsi: fusion: Remove unused variable 'rc'
scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb()
scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()
ocfs2: fix uninitialized value in ocfs2_file_read_iter()
powerpc/sstep: make emulate_vsx_load and emulate_vsx_store static
fbdev/sh7760fb: Alloc DMA memory from hardware device
fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem()
dt-bindings: clock: adi,axi-clkgen: convert old binding to yaml format
dt-bindings: clock: axi-clkgen: include AXI clk
clk: axi-clkgen: use devm_platform_ioremap_resource() short-hand
clk: clk-axi-clkgen: make sure to enable the AXI bus clock
perf cs-etm: Don't flush when packet_queue fills up
perf probe: Correct demangled symbols in C++ program
PCI: cpqphp: Use PCI_POSSIBLE_ERROR() to check config reads
PCI: cpqphp: Fix PCIBIOS_* return value confusion
m68k: mcfgpio: Fix incorrect register offset for CONFIG_M5441x
m68k: coldfire/device.c: only build FEC when HW macros are defined
perf trace: Do not lose last events in a race
perf trace: Avoid garbage when not printing a syscall's arguments
rpmsg: glink: Add TX_DATA_CONT command while sending
rpmsg: glink: Send READ_NOTIFY command in FIFO full case
rpmsg: glink: Fix GLINK command prefix
rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length
NFSD: Prevent NULL dereference in nfsd4_process_cb_update()
NFSD: Cap the number of bytes copied by nfs4_reset_recoverydir()
NFSD: Fix nfsd4_shutdown_copy()
vfio/pci: Properly hide first-in-list PCIe extended capability
power: supply: core: Remove might_sleep() from power_supply_put()
net: usb: lan78xx: Fix memory leak on device unplug by freeing PHY device
tg3: Set coherent DMA mask bits to 31 for BCM57766 chipsets
net: usb: lan78xx: Fix refcounting and autosuspend on invalid WoL configuration
marvell: pxa168_eth: fix call balance of pep->clk handling routines
net: stmmac: dwmac-socfpga: Set RX watchdog interrupt as broken
ipmr: convert /proc handlers to rcu_read_lock()
ipmr: fix tables suspicious RCU usage
usb: using mutex lock and supporting O_NONBLOCK flag in iowarrior_read()
usb: yurex: make waiting on yurex_write interruptible
USB: chaoskey: fail open after removal
USB: chaoskey: Fix possible deadlock chaoskey_list_lock
misc: apds990x: Fix missing pm_runtime_disable()
staging: greybus: uart: clean up TIOCGSERIAL
apparmor: fix 'Do simple duplicate message elimination'
usb: ehci-spear: fix call balance of sehci clk handling routines
cgroup: Make operations on the cgroup root_list RCU safe
cgroup: Move rcu_head up near the top of cgroup_root
soc: qcom: socinfo: fix revision check in qcom_socinfo_probe()
ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices
ext4: supress data-race warnings in ext4_free_inodes_{count,set}()
ext4: fix FS_IOC_GETFSMAP handling
jfs: xattr: check invalid xattr size more strictly
ASoC: codecs: Fix atomicity violation in snd_soc_component_get_drvdata()
PCI: Fix use-after-free of slot->bus on hot remove
comedi: Flush partial mappings in error case
tty: ldsic: fix tty_ldisc_autoload sysctl's proc_handler
Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}()
Revert "usb: gadget: composite: fix OS descriptors w_value logic"
serial: sh-sci: Clean sci_ports[0] after at earlycon exit
Revert "serial: sh-sci: Clean sci_ports[0] after at earlycon exit"
netfilter: ipset: add missing range check in bitmap_ip_uadt
spi: Fix acpi deferred irq probe
ubi: wl: Put source PEB into correct list if trying locking LEB failed
um: ubd: Do not use drvdata in release
um: net: Do not use drvdata in release
serial: 8250: omap: Move pm_runtime_get_sync
um: vector: Do not use drvdata in release
sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
arm64: tls: Fix context-switching of tpidrro_el0 when kpti is enabled
block: fix ordering between checking BLK_MQ_S_STOPPED request adding
HID: wacom: Interpret tilt data from Intuos Pro BT as signed values
media: wl128x: Fix atomicity violation in fmc_send_cmd()
ALSA: hda/realtek: Update ALC225 depop procedure
ALSA: hda/realtek: Set PCBeep to default value for ALC274
ALSA: hda/realtek: Fix Internal Speaker and Mic boost of Infinix Y4 Max
ALSA: hda/realtek: Apply quirk for Medion E15433
usb: dwc3: gadget: Fix checking for number of TRBs left
lib: string_helpers: silence snprintf() output truncation warning
NFSD: Prevent a potential integer overflow
SUNRPC: make sure cache entry active before cache_show
rpmsg: glink: Propagate TX failures in intentless mode as well
um: Fix potential integer overflow during physmem setup
um: Fix the return value of elf_core_copy_task_fpregs
um/sysrq: remove needless variable sp
um: add show_stack_loglvl()
um: Clean up stacktrace dump
um: Always dump trace for specified task in show_stack
NFSv4.0: Fix a use-after-free problem in the asynchronous open()
rtc: st-lpc: Use IRQF_NO_AUTOEN flag in request_irq()
rtc: abx80x: Fix WDT bit position of the status register
rtc: check if __rtc_read_time was successful in rtc_timer_do_work()
ubifs: Correct the total block count by deducting journal reservation
ubi: fastmap: Fix duplicate slab cache names while attaching
ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit
jffs2: fix use of uninitialized variable
block: return unsigned int from bdev_io_min
9p/xen: fix init sequence
9p/xen: fix release of IRQ
rtc: ab-eoz9: don't fail temperature reads on undervoltage notification
modpost: remove incorrect code in do_eisa_entry()
SUNRPC: correct error code comment in xs_tcp_setup_socket()
SUNRPC: Replace internal use of SOCKWQ_ASYNC_NOSPACE
sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport
sh: intc: Fix use-after-free bug in register_intc_controller()
ASoC: fsl_micfil: fix the naming style for mask definition
quota: flush quota_release_work upon quota writeback
btrfs: ref-verify: fix use-after-free after invalid ref action
media: i2c: tc358743: Fix crash in the probe error path when using polling
media: ts2020: fix null-ptr-deref in ts2020_probe()
media: venus: Fix pm_runtime_set_suspended() with runtime pm enabled
media: gspca: ov534-ov772x: Fix off-by-one error in set_frame_rate()
media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal()
ovl: Filter invalid inodes with missing lookup function
ftrace: Fix regression with module command in stack_trace_filter
clk: qcom: gcc-qcs404: fix initial rate of GPLL3
ad7780: fix division by zero in ad7780_write_raw()
util_macros.h: fix/rework find_closest() macros
i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()
dm thin: Add missing destroy_work_on_stack()
nfsd: make sure exp active before svc_export_show
nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur
drm/etnaviv: flush shader L1 cache after user commandstream
iTCO_wdt: mask NMI_NOW bit for update_no_reboot_bit() call
watchdog: mediatek: Make sure system reset gets asserted in mtk_wdt_restart()
can: sun4i_can: sun4i_can_err(): call can_change_state() even if cf is NULL
can: sun4i_can: sun4i_can_err(): fix {rx,tx}_errors statistics
ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()
netfilter: x_tables: fix LED ID check in led_tg_check()
net/sched: tbf: correct backlog statistic for GSO packets
can: j1939: j1939_session_new(): fix skb reference counting
net/ipv6: release expired exception dst cached in socket
dccp: Fix memory leak in dccp_feat_change_recv
tipc: add reference counter to bearer
tipc: enable creating a "preliminary" node
tipc: add new AEAD key structure for user API
tipc: Fix use-after-free of kernel socket in cleanup_bearer().
net/qed: allow old cards not supporting "num_images" to work
igb: Fix potential invalid memory access in igb_init_module()
netfilter: ipset: Hold module reference while requesting a module
netfilter: nft_set_hash: skip duplicated elements pending gc run
xen/xenbus: reference count registered modules
xenbus/backend: Add memory pressure handler callback
xenbus/backend: Protect xenbus callback with lock
xen/xenbus: fix locking
xen: Fix the issue of resource not being properly released in xenbus_dev_probe()
x86/asm: Reorder early variables
crypto: x86/aegis128 - access 32-bit arguments as 32-bit
gpio: grgpio: use a helper variable to store the address of ofdev->dev
gpio: grgpio: Add NULL check in grgpio_probe
drm/sti: Add __iomem for mixer_dbg_mxn's parameter
tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg
spi: mpc52xx: Add cancel_work_sync before module remove
ocfs2: free inode when ocfs2_get_init_inode() fails
bpf: Handle BPF_EXIST and BPF_NOEXIST for LPM trie
bpf: Fix exact match conditions in trie_get_next_key()
HID: wacom: fix when get product name maybe null pointer
tracing: Fix cmp_entries_dup() to respect sort() comparison rules
ocfs2: update seq_file index in ocfs2_dlm_seq_next
scsi: qla2xxx: Fix NVMe and NPIV connect issue
scsi: qla2xxx: Supported speed displayed incorrectly for VPorts
scsi: qla2xxx: Remove check req_sg_cnt should be equal to rsp_sg_cnt
nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()
bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again
dma-buf: fix dma_fence_array_signaled v4
regmap: detach regmap from dev on regmap_exit
mmc: core: Further prevent card detect during shutdown
s390/cpum_sf: Handle CPU hotplug remove during sampling
media: uvcvideo: Add a quirk for the Kaiweets KTI-W02 infrared camera
media: cx231xx: Add support for Dexatek USB Video Grabber 1d19:6108
drm: panel-orientation-quirks: Add quirk for AYA NEO 2 model
drm/mcde: Enable module autoloading
drm/radeon/r600_cs: Fix possible int overflow in r600_packet3_check()
samples/bpf: Fix a resource leak
net: fec_mpc52xx_phy: Use %pa to format resource_size_t
net: ethernet: fs_enet: Use %pa to format resource_size_t
net/sched: cbs: Fix integer overflow in cbs_set_port_rate()
af_packet: avoid erroring out after sock_init_data() in packet_create()
Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()
net: af_can: do not leave a dangling sk pointer in can_create()
net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
net: inet: do not leave a dangling sk pointer in inet_create()
net: inet6: do not leave a dangling sk pointer in inet6_create()
wifi: ath5k: add PCI ID for SX76X
wifi: ath5k: add PCI ID for Arcadyan devices
jfs: array-index-out-of-bounds fix in dtReadFirst
jfs: fix shift-out-of-bounds in dbSplit
jfs: fix array-index-out-of-bounds in jfs_readdir
jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree
drm/amdgpu: set the right AMDGPU sg segment limitation
wifi: ipw2x00: libipw_rx_any(): fix bad alignment
wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw()
Bluetooth: btusb: Add RTL8852BE device 0489:e123 to device tables
ASoC: hdmi-codec: reorder channel allocation list
rocker: fix link status detection in rocker_carrier_init()
net/neighbor: clear error in case strict check is not set
netpoll: Use rcu_access_pointer() in __netpoll_setup
tracing: Use atomic64_inc_return() in trace_clock_counter()
leds: class: Protect brightness_show() with led_cdev->led_access mutex
scsi: st: Don't modify unknown block number in MTIOCGET
scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset
pinctrl: qcom-pmic-gpio: add support for PM8937
nvdimm: rectify the illogical code within nd_dax_probe()
f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode.
PCI: Add 'reset_subordinate' to reset hierarchy below bridge
PCI: Add ACS quirk for Wangxun FF5xxx NICs
i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock
usb: chipidea: udc: handle USB Error Interrupt if IOC not set
powerpc/prom_init: Fixup missing powermac #size-cells
misc: eeprom: eeprom_93cx6: Add quirk for extra read clock cycle
xdp: Simplify devmap cleanup
bpf: fix OOB devmap writes when deleting elements
Revert "unicode: Don't special case ignorable code points"
perf/x86/intel/pt: Fix buffer full but size is 0 case
KVM: arm64: vgic-its: Add a data length check in vgic_its_save_*
KVM: arm64: vgic-its: Clear DTE when MAPD unmaps a device
KVM: arm64: vgic-its: Clear ITE when DISCARD frees an ITE
jffs2: Prevent rtime decompress memory corruption
jffs2: Fix rtime decompressor
ocfs2: Revert "ocfs2: fix the la space leak when unmounting an ocfs2 volume"
modpost: Add .irqentry.text to OTHER_SECTIONS
Revert "drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()"
PCI: rockchip-ep: Fix address translation unit programming
ALSA: usb-audio: Fix out of bounds reads when finding clock sources
bpf, xdp: Update devmap comments to reflect napi/rcu usage
Linux 5.4.287
Change-Id: Ib48a7a0e01226c0f910efae2139893c6a139b9b5
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
|
||
|
Zhang Zekun
|
e0e1cde240 |
Revert "drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()"
This reverts commit
|
||
|
Prike Liang
|
b5807a0895 |
drm/amdgpu: set the right AMDGPU sg segment limitation
[ Upstream commit e2e97435783979124ba92d6870415c57ecfef6a5 ] The driver needs to set the correct max_segment_size; otherwise debug_dma_map_sg() will complain about the over-mapping of the AMDGPU sg length as following: WARNING: CPU: 6 PID: 1964 at kernel/dma/debug.c:1178 debug_dma_map_sg+0x2dc/0x370 [ 364.049444] Modules linked in: veth amdgpu(OE) amdxcp drm_exec gpu_sched drm_buddy drm_ttm_helper ttm(OE) drm_suballoc_helper drm_display_helper drm_kms_helper i2c_algo_bit rpcsec_gss_krb5 auth_rpcgss nfsv4 nfs lockd grace netfs xt_conntrack xt_MASQUERADE nf_conntrack_netlink xfrm_user xfrm_algo iptable_nat xt_addrtype iptable_filter br_netfilter nvme_fabrics overlay nfnetlink_cttimeout nfnetlink openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c bridge stp llc amd_atl intel_rapl_msr intel_rapl_common sunrpc sch_fq_codel snd_hda_codec_realtek snd_hda_codec_generic snd_hda_scodec_component snd_hda_codec_hdmi snd_hda_intel snd_intel_dspcfg edac_mce_amd binfmt_misc snd_hda_codec snd_pci_acp6x snd_hda_core snd_acp_config snd_hwdep snd_soc_acpi kvm_amd snd_pcm kvm snd_seq_midi snd_seq_midi_event crct10dif_pclmul ghash_clmulni_intel sha512_ssse3 snd_rawmidi sha256_ssse3 sha1_ssse3 aesni_intel snd_seq nls_iso8859_1 crypto_simd snd_seq_device cryptd snd_timer rapl input_leds snd [ 364.049532] ipmi_devintf wmi_bmof ccp serio_raw k10temp sp5100_tco soundcore ipmi_msghandler cm32181 industrialio mac_hid msr parport_pc ppdev lp parport drm efi_pstore ip_tables x_tables pci_stub crc32_pclmul nvme ahci libahci i2c_piix4 r8169 nvme_core i2c_designware_pci realtek i2c_ccgx_ucsi video wmi hid_generic cdc_ether usbnet usbhid hid r8152 mii [ 364.049576] CPU: 6 PID: 1964 Comm: rocminfo Tainted: G OE 6.10.0-custom #492 [ 364.049579] Hardware name: AMD Majolica-RN/Majolica-RN, BIOS RMJ1009A 06/13/2021 [ 364.049582] RIP: 0010:debug_dma_map_sg+0x2dc/0x370 [ 364.049585] Code: 89 4d b8 e8 36 b1 86 00 8b 4d b8 48 8b 55 b0 44 8b 45 a8 4c 8b 4d a0 48 89 c6 48 c7 c7 00 4b 74 bc 4c 89 4d b8 e8 b4 73 f3 ff <0f> 0b 4c 8b 4d b8 8b 15 c8 2c b8 01 85 d2 0f 85 ee fd ff ff 8b 05 [ 364.049588] RSP: 0018:ffff9ca600b57ac0 EFLAGS: 00010286 [ 364.049590] RAX: 0000000000000000 RBX: ffff88b7c132b0c8 RCX: 0000000000000027 [ 364.049592] RDX: ffff88bb0f521688 RSI: 0000000000000001 RDI: ffff88bb0f521680 [ 364.049594] RBP: ffff9ca600b57b20 R08: 000000000000006f R09: ffff9ca600b57930 [ 364.049596] R10: ffff9ca600b57928 R11: ffffffffbcb46328 R12: 0000000000000000 [ 364.049597] R13: 0000000000000001 R14: ffff88b7c19c0700 R15: ffff88b7c9059800 [ 364.049599] FS: 00007fb2d3516e80(0000) GS:ffff88bb0f500000(0000) knlGS:0000000000000000 [ 364.049601] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 364.049603] CR2: 000055610bd03598 CR3: 00000001049f6000 CR4: 0000000000350ef0 [ 364.049605] Call Trace: [ 364.049607] <TASK> [ 364.049609] ? show_regs+0x6d/0x80 [ 364.049614] ? __warn+0x8c/0x140 [ 364.049618] ? debug_dma_map_sg+0x2dc/0x370 [ 364.049621] ? report_bug+0x193/0x1a0 [ 364.049627] ? handle_bug+0x46/0x80 [ 364.049631] ? exc_invalid_op+0x1d/0x80 [ 364.049635] ? asm_exc_invalid_op+0x1f/0x30 [ 364.049642] ? debug_dma_map_sg+0x2dc/0x370 [ 364.049647] __dma_map_sg_attrs+0x90/0xe0 [ 364.049651] dma_map_sgtable+0x25/0x40 [ 364.049654] amdgpu_bo_move+0x59a/0x850 [amdgpu] [ 364.049935] ? srso_return_thunk+0x5/0x5f [ 364.049939] ? amdgpu_ttm_tt_populate+0x5d/0xc0 [amdgpu] [ 364.050095] ttm_bo_handle_move_mem+0xc3/0x180 [ttm] [ 364.050103] ttm_bo_validate+0xc1/0x160 [ttm] [ 364.050108] ? amdgpu_ttm_tt_get_user_pages+0xe5/0x1b0 [amdgpu] [ 364.050263] amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0xa12/0xc90 [amdgpu] [ 364.050473] kfd_ioctl_alloc_memory_of_gpu+0x16b/0x3b0 [amdgpu] [ 364.050680] kfd_ioctl+0x3c2/0x530 [amdgpu] [ 364.050866] ? __pfx_kfd_ioctl_alloc_memory_of_gpu+0x10/0x10 [amdgpu] [ 364.051054] ? srso_return_thunk+0x5/0x5f [ 364.051057] ? tomoyo_file_ioctl+0x20/0x30 [ 364.051063] __x64_sys_ioctl+0x9c/0xd0 [ 364.051068] x64_sys_call+0x1219/0x20d0 [ 364.051073] do_syscall_64+0x51/0x120 [ 364.051077] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 364.051081] RIP: 0033:0x7fb2d2f1a94f Signed-off-by: Prike Liang <Prike.Liang@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
|
Igor Artemiev
|
cb8ae56d73 |
drm/radeon/r600_cs: Fix possible int overflow in r600_packet3_check()
[ Upstream commit a1e2da6a5072f8abe5b0feaa91a5bcd9dc544a04 ] It is possible, although unlikely, that an integer overflow will occur when the result of radeon_get_ib_value() is shifted to the left. Avoid it by casting one of the operands to larger data type (u64). Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE. Signed-off-by: Igor Artemiev <Igor.A.Artemiev@mcst.ru> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
|
Liao Chen
|
4c245d6d19 |
drm/mcde: Enable module autoloading
[ Upstream commit 8a16b5cdae26207ff4c22834559384ad3d7bc970 ] Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from of_device_id table. Signed-off-by: Liao Chen <liaochen4@huawei.com> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Link: https://patchwork.freedesktop.org/patch/msgid/20240902113320.903147-4-liaochen4@huawei.com Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
|
Joaquín Ignacio Aramendía
|
920c9149bd |
drm: panel-orientation-quirks: Add quirk for AYA NEO 2 model
[ Upstream commit 361ebf5ef843b0aa1704c72eb26b91cf76c3c5b7 ] Add quirk orientation for AYA NEO 2. The name appears without spaces in DMI strings. That made it difficult to reuse the 2021 match. Also the display is larger in resolution. Tested by the JELOS team that has been patching their own kernel for a while now and confirmed by users in the AYA NEO and ChimeraOS discord servers. Signed-off-by: Joaquín Ignacio Aramendía <samsagax@gmail.com> Signed-off-by: Tobias Jakobi <tjakobi@math.uni-bielefeld.de> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Reviewed-by: Hans de Goede <hdegoede@redhat.com> Link: https://patchwork.freedesktop.org/patch/msgid/2b35545b77a9fd8c9699b751ca282226dcecb1dd.1726492131.git.tjakobi@math.uni-bielefeld.de Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
|
Pei Xiao
|
079484a928 |
drm/sti: Add __iomem for mixer_dbg_mxn's parameter
[ Upstream commit 86e8f94789dd6f3e705bfa821e1e416f97a2f863 ]
Sparse complains about incorrect type in argument 1.
expected void const volatile __iomem *ptr but got void *.
so modify mixer_dbg_mxn's addr parameter.
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202411191809.6V3c826r-lkp@intel.com/
Fixes:
|
||
|
Lucas Stach
|
f145c9924c |
drm/etnaviv: flush shader L1 cache after user commandstream
commit 4f8dbadef085ab447a01a8d4806a3f629fea05ed upstream. The shader L1 cache is a writeback cache for shader loads/stores and thus must be flushed before any BOs backing the shader buffers are potentially freed. Cc: stable@vger.kernel.org Reviewed-by: Christian Gmeiner <cgmeiner@igalia.com> Signed-off-by: Lucas Stach <l.stach@pengutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Lucas Stach
|
2cc97daab5 |
drm/etnaviv: hold GPU lock across perfmon sampling
[ Upstream commit 37dc4737447a7667f8e9ec790dac251da057eb27 ]
The perfmon sampling mutates shared GPU state (e.g. VIVS_HI_CLOCK_CONTROL
to select the pipe for the perf counter reads). To avoid clashing with
other functions mutating the same state (e.g. etnaviv_gpu_update_clock)
the perfmon sampling needs to hold the GPU lock.
Fixes:
|