[ Upstream commit 727cc0147f5066e359aca65cc6cc5e6d64cc15d8 ]
The ACPI buffer memory (out.pointer) returned by wmi_evaluate_method()
is not freed after the call, so it leads to memory leak.
The method results in ACPI buffer is not used, so just pass NULL to
wmi_evaluate_method() which fixes the memory leak.
Fixes: 99b38b4acc ("platform/x86: add MXM WMI driver.")
Signed-off-by: Yu Liao <liaoyu15@huawei.com>
Link: https://lore.kernel.org/r/20221129011101.2042315-1-liaoyu15@huawei.com
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Receiving the global interrupt INT1 without sending
any generic commands. So disabling interrupt by default.
Enabling the interrupt only before sending the generic command.
Change-Id: I55011933d92d29e19cc478ed1dbea9d08b95d239
Signed-off-by: Ashok Vuyyuru <quic_avuyyuru@quicinc.com>
[ Upstream commit 1e817b889c7d8c14e7005258e15fec62edafe03c ]
Like the Acer Switch 10 (SW5-012) and Acer Switch 10 (S1003) models
the Acer Switch V 10 (SW5-017) supports reporting SW_TABLET_MODE
through acer-wmi.
Add a DMI quirk for the SW5-017 setting force_caps to ACER_CAP_KBD_DOCK
(these devices have no other acer-wmi based functionality).
Cc: Rudolf Polzer <rpolzer@google.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20221111111639.35730-1-hdegoede@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
commit 1598bfa8e1faa932de42e1ee7628a1c4c4263f0a upstream.
After upgrading BIOS to U82 01.02.01 Rev.A, the console is flooded
strange char "^@" which printed out every second and makes login
nearly impossible. Also the below messages were shown both in console
and journal/dmesg every second:
usb 1-3: Device not responding to setup address.
usb 1-3: device not accepting address 4, error -71
usb 1-3: device descriptor read/all, error -71
usb usb1-port3: unable to enumerate USB device
Wifi is soft blocked by checking rfkill. When unblocked manually,
after few seconds it would be soft blocked again. So I was suspecting
something triggered rfkill to soft block wifi. At the end it was
fixed by removing hp_wmi module.
The root cause is the way hp-wmi driver handles command 1B on
post-2009 BIOS. In pre-2009 BIOS, command 1Bh return 0x4 to indicate
that BIOS no longer controls the power for the wireless devices.
Signed-off-by: Jorge Lopez <jorge.lopez2@hp.com>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216468
Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
Link: https://lore.kernel.org/r/20221028155527.7724-1-jorge.lopez2@hp.com
Cc: stable@vger.kernel.org
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit 2a2565272a3628e45d61625e36ef17af7af4e3de ]
On a MSI S270 with Fedora 37 x86_64 / systemd-251.4 the module does not
properly autoload.
This is likely caused by issues with how systemd-udevd handles the single
quote char (') which is part of the sys_vendor / chassis_vendor strings
on this laptop. As a workaround remove the single quote char + everything
behind it from the sys_vendor + chassis_vendor matches. This fixes
the module not autoloading.
Link: https://github.com/systemd/systemd/issues/24715
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20220917210407.647432-1-hdegoede@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 83ac7a1c2ed5f17caa07cbbc84bad3c05dc3bf22 ]
Commit 2cc6c71779 ("msi-laptop: Port to new backlight interface
selection API") replaced this check:
if (!quirks->old_ec_model || acpi_video_backlight_support())
pr_info("Brightness ignored, ...");
else
do_register();
With:
if (quirks->old_ec_model ||
acpi_video_get_backlight_type() == acpi_backlight_vendor)
do_register();
But since the do_register() part was part of the else branch, the entire
condition should be inverted. So not only the 2 statements on either
side of the || should be inverted, but the || itself should be replaced
with a &&.
In practice this has likely not been an issue because the new-ec models
(old_ec_model==false) likely all support ACPI video backlight control,
making acpi_video_get_backlight_type() return acpi_backlight_video
turning the second part of the || also false when old_ec_model == false.
Fixes: 2cc6c71779 ("msi-laptop: Port to new backlight interface selection API")
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20220825141336.208597-1-hdegoede@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
Squashed commit of the following:
commit 3b9d24a9265b0c4211950f39ee5bc21261410db6
Author: Kazuki Hashimoto <kazukih@tuta.io>
Date: Sun Jun 19 10:44:11 2022 +0900
ipa: Allocate page with __GFP_RETRY_MAYFAIL and __GFP_NOWARN
Taken from Google.
5c90cf2148
Signed-off-by: Kazuki Hashimoto <kazukih@tuta.io>
commit 07beb1e16313d84eb6239e8d007a9414f1d17ce9
Author: Luan Cachoroski Halaiko <luhalaiko@gmail.com>
Date: Wed Feb 9 21:14:31 2022 -0300
[1/5] drivers: platform: msm: ipa: add a switch to disable DEBUG_FS
--> User builds don't need debugfs, this is the first of 5 patches
that add a switch disabling DEBUG_FS on user builds, bringing
kernel size a bit down and providing less spamming on kernel log
Signed-off-by: Luan Cachoroski Halaiko <luhalaiko@gmail.com>
commit 74c16e08c078ca3ac5f0d2d7af691ed10f0e5a53
Author: Pooja Kumari <kumarip@codeaurora.org>
Date: Wed Mar 11 19:15:04 2020 +0530
msm: ipa3: increase rmnet_ipa timeout value
With current timeout value rmnet_ipa driver is
getting watchdog timeout. Increase timeout value
to avoid timeout error.
Bug: 134918361
Test: Browsing/Speedtest/SST
Change-Id: I76b35948968114c6540294fe1b560003bed5e1fb
Signed-off-by: Pooja Kumari <kumarip@codeaurora.org>
commit e5d5511b3c2b3a5e1cddd39d058488e5c9d4f0cd
Author: Andrzej Perczak <linux@andrzejperczak.com>
Date: Thu Jul 7 21:29:27 2022 +0200
msm: ipa: Cast enums to fix compiler warnings
Signed-off-by: Andrzej Perczak <linux@andrzejperczak.com>
commit 24e6f2b99953b50b60ef998fec8010eececa439e
Author: Ashok Vuyyuru <avuyyuru@codeaurora.org>
Date: Mon Jul 4 15:56:28 2022 +0200
msm: ipa3: Fix to avoid gsi/sys len stats mismatch
In suspend just before stopping the channel possible to receive
the IEOB interrupt and xfer pointer will not be processed in this
mode but gsi stats are updated. In resume after starting the channel
will receive the IEOB interrupt and xfer pointer will be overwritten
because of this observing the gsi/sys len stats are not matching and
buffers won't be replinished properly leading to HW stall.
To avoid this process all data in polling context, gsi/sys len
stats are updated properly.
Change-Id: Id665448165b6aa51b251cddd72573c6df64ee541
Signed-off-by: Ashok Vuyyuru <avuyyuru@codeaurora.org>
Signed-off-by: Andrzej Perczak <linux@andrzejperczak.com>
commit e9bf5fcaa70735ad327431a8a8131a505807a2b7
Author: Signed-off-by: Michael Adisumarta <madisuma@codeaurora.org>
Date: Sun Dec 19 13:43:23 2021 +0100
msm: ipa: use detach/attach netif instead of stop/wakeup
To make sure detach and attach netif instead of stop
and wakeup and also to update transfer timer update.
Change-Id: I9d589b7f9f6fe98f778df509d3c16f339dfdeea1
Signed-off-by: Michael Adisumarta <madisuma@codeaurora.org>
Signed-off-by: Andrzej Perczak <linux@andrzejperczak.com>
commit 96053803d70c48e3dbc2e986dc0ec78bc9129aa4
Author: Andrzej Perczak <linux@andrzejperczak.com>
Date: Sun Dec 19 13:41:39 2021 +0100
Revert "msm: ipa: Fix to avoid NETDEV WATCHDOG warning logs"
This reverts commit 7f6c43f620.
commit a9becf6c3ae3e78ac51872b4c1f61c7fed6f0e11
Author: Amir Levy <alevy@codeaurora.org>
Date: Sun Dec 12 22:58:00 2021 +0100
msm: ipa: added likely/unlikely branch prediction to the lan dp
Added branch prediction in an effort to make
the data path more efficent.
Acked-by: Tal Gelbard <tgelbard@qti.qualcomm.com>
Change-Id: I3bd2157ee6c263d89de9425c7a0249370ab918fc
Signed-off-by: Amir Levy <alevy@codeaurora.org>
Signed-off-by: Andrzej Perczak <linux@andrzejperczak.com>
commit 1f411db6f9962c991120c26b6f7aba0afc316122
Author: Ashok Vuyyuru <avuyyuru@codeaurora.org>
Date: Thu Apr 2 22:26:35 2020 +0530
msm: ipa3: Fix to use paired PM operation for IPA
Becauase of using wrong pair of PM operation device
was not resuming if suspend fails. Adding changes to
use correct set of PM operations.
Change-Id: Ib9fdea8f93f0a6dafbd5908dc8fc2bbf4f1e0904
Signed-off-by: Ashok Vuyyuru <avuyyuru@codeaurora.org>
Signed-off-by: Andrzej Perczak <linux@andrzejperczak.com>
commit 5719e064761ead0ed048127bc3144ff10ad592f1
Author: Kailash <kailash.sudhakar@gmail.com>
Date: Thu Apr 16 01:38:29 2020 +0530
drivers: msm: ipa_v3: Return operation unsupported when CONFIG_PCI is unset
From 100.10.107.46 source drop
commit 2a9bf475119b27b56fda73f9e8c432f6e894c19a
Author: Bojun Pan <bojunp@codeaurora.org>
Date: Fri Jan 31 22:24:47 2020 +0530
msm: ipa: Fix the force_coals command stuck issue on AP suspend
IPA force_coals command stuck due to not getting the gsi interrupt.
The suspend on IPA AP/RMNET_IPA driver was registered as noirq type,
gsi interrupt handler won't be called because of this.
The fix is to change the suspend cb from suspend_noirq to suspend.
Change-Id: I148c981b0edb28c414a30b991294b2683b198399
Signed-off-by: Bojun Pan <bojunp@codeaurora.org>
Signed-off-by: Andrzej Perczak <linux@andrzejperczak.com>
commit cb9c06b83fd9957ac8d63a990847076dd34aa559
Author: Alex Naidis <alex.naidis@paranoidandroid.co>
Date: Tue Jul 31 16:37:16 2018 -0400
msm: ipa_v3: Mitigate usleep_range calls
Calling usleep_range with identical min and max values,
results in a delta of 0us.
This causes the issue that the scheduler gets no chance to re-use an already
scheduled interrupt for this wait which results in a negative performance
impact by adding uninterruptible sleep.
Fix the issue by allowing the delay to take 20% longer than requested.
This should be good enough for these cases.
Signed-off-by: Alex Naidis <alex.naidis@paranoidandroid.co>
Signed-off-by: Park Ju Hyung <qkrwngud825@gmail.com>
commit 0ec1247d32dd39a8b4a0b2da78c58c2537c4ead3
Author: Sultan Alsawaf <sultan@kerneltoast.com>
Date: Tue Jan 12 00:08:29 2021 -0800
msm: ipa3: Fix non-atomic read on atomic_t variable
Accessing an atomic variable without the atomic_*() helpers is illegal.
Signed-off-by: Sultan Alsawaf <sultan@kerneltoast.com>
commit 891f71a631b08746b7070c0f35a06be03e1784fe
Author: Sultan Alsawaf <sultan@kerneltoast.com>
Date: Tue Jan 12 00:07:19 2021 -0800
msm: ipa3: Fix format specifier warnings
Signed-off-by: Sultan Alsawaf <sultan@kerneltoast.com>
commit 68fba094615efc7c1131d8e6df0be7863a0938ad
Author: Sultan Alsawaf <sultan@kerneltoast.com>
Date: Thu Dec 24 22:53:54 2020 -0800
msm: ipa: Refactor buffer size check in ipa3_write()
This confuses GCC's FORTIFY_SOURCE check for the copy_from_user() in
this function. Simplify it to resolve the GCC warning.
Signed-off-by: Sultan Alsawaf <sultan@kerneltoast.com>
commit 883cd9e245955fcdd8ed1c4166b8f4324d3ac090
Author: Sami Tolvanen <samitolvanen@google.com>
Date: Fri Jan 19 11:19:11 2018 -0800
msm: ipa3: fix callback function type for ndo_start_xmit
Bug: 117299373
Change-Id: Iad7ed493bd29e2da85e2d6bc0f1dc0fbdac8a41d
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
commit 98d90c2ac07a802751b31b0afff300dce17ad511
Author: kondors1995 <normandija1945@gmail.com>
Date: Mon Oct 17 13:50:52 2022 +0300
\Revert "drivers: ipa_v3: Conditionally compile out ipa wakelock code"
This reverts commit e46958360f.
commit 314eab9899967ab6487bd8163ef6404106cbd602
Author: kondors1995 <normandija1945@gmail.com>
Date: Mon Oct 17 13:50:49 2022 +0300
Revert "[1/5] drivers: platform: msm: ipa: add a switch to disable DEBUG_FS"
This reverts commit 9f9dc2f45c.
commit 090ab7d9400bba97b2fc0d68cb5b5cc3a986376a
Author: kondors1995 <normandija1945@gmail.com>
Date: Mon Oct 17 13:50:06 2022 +0300
Revert "msm: ipa_v3: Mitigate usleep_range calls"
This reverts commit df2ea99946.
commit 23234070df088d9b08ae61bb1b99f1749e2b76cb
Author: kondors1995 <normandija1945@gmail.com>
Date: Mon Oct 17 13:49:59 2022 +0300
Revert "drivers: msm-ipa: Only include emulation init with CONFIG_IPA_EMULATION"
This reverts commit c827afff53.
commit 550cb7c2a4eccb3aa8452399d3311aa2a4825dfd
Author: kondors1995 <normandija1945@gmail.com>
Date: Mon Oct 17 13:49:47 2022 +0300
Revert "msm: ipa: Fix the force_coals command stuck issue on AP suspend"
This reverts commit a7d75b5f3e.
commit 510b440d3df7ea9c3f6b5537b60cac0c39269912
Author: kondors1995 <normandija1945@gmail.com>
Date: Mon Oct 17 13:49:38 2022 +0300
Revert "msm: ipa3: Fix to use paired PM operation for IPA"
This reverts commit 00cbc4db2c.
commit 245f9a9d555c6b0488c6031fd2d3cbfda38651c2
Author: kondors1995 <normandija1945@gmail.com>
Date: Mon Oct 17 13:49:23 2022 +0300
Revert "rmnet_ipa: Fix netdev watchdog triggering on suspend"
This reverts commit d42f2391da.
commit d385eb5a1e8c65231edf8b3b73953e952b560038
Author: kondors1995 <normandija1945@gmail.com>
Date: Mon Oct 17 13:48:57 2022 +0300
Revert "ipa: Allocate page with __GFP_RETRY_MAYFAIL and __GFP_NOWARN"
This reverts commit 75f9a8c6b4.
commit 119731ad74ac2cb0228d5571020e37a0cf67784b
Author: kondors1995 <normandija1945@gmail.com>
Date: Mon Oct 17 13:48:47 2022 +0300
Revert "msm: ipa: Cast enums to fix compiler warnings"
This reverts commit 9eaf6d119f.
commit 91aaadc7d9d66819f26490899abfa0ace5c014c8
Author: kondors1995 <normandija1945@gmail.com>
Date: Mon Oct 17 13:48:06 2022 +0300
Revert "msm: ipa3: increase rmnet_ipa timeout value"
This reverts commit 4503a36ec7.
commit 1a88043379494ba9c343a8736e4921c44d40252c
Author: kondors1995 <normandija1945@gmail.com>
Date: Mon Oct 17 13:48:00 2022 +0300
Revert "msm: ipa3: fix callback function type for ndo_start_xmit"
This reverts commit a25522ebfe.
commit 0a2748e422c0aa56be9d07bd5effc50ff05d7874
Author: kondors1995 <normandija1945@gmail.com>
Date: Mon Oct 17 13:47:50 2022 +0300
Revert "platform: msm: ipa: Correctly allocate memory for copy_from_user"
This reverts commit c18f8ff38c.
commit c032130a46746b3e4b6e0ae41cb96c58f11521da
Author: kondors1995 <normandija1945@gmail.com>
Date: Mon Oct 17 13:47:42 2022 +0300
Revert "platform: msm: ipav3: Correct smallest ipa3_write string to 1."
This reverts commit 2fff1651ec.
The smallest string that this function deals with is "1", which is of
size 1. Correct the if to allow this case.
Change-Id: Iaa68bcc452a3428d4752e5c34c98d0bd2e926c5a
Signed-off-by: MarijnS95 <marijns95@gmail.com>
Copying from user to a global variable inside the driver is
unsafe and insecure: allocate and free the memory used for
copying from userspace in the functions doing it.
This also has the good side effect of solving a build failure
when the kernel is built with GCC >=4.9
Change-Id: I04bfb0cd0ffb6870481f639818cf8c51191d927d
With current timeout value rmnet_ipa driver is
getting watchdog timeout. Increase timeout value
to avoid timeout error.
Bug: 134918361
Test: Browsing/Speedtest/SST
Change-Id: I76b35948968114c6540294fe1b560003bed5e1fb
Signed-off-by: Pooja Kumari <kumarip@codeaurora.org>
[ Upstream commit c3b82d26bc85f5fc2fef5ec8cce17c89633a55a8 ]
2 keymap fixes for the Acer Aspire One AOD270 and the same hardware
rebranded as Packard Bell Dot SC:
1. The F2 key is marked with a big '?' symbol on the Packard Bell Dot SC,
this sends WMID_HOTKEY_EVENTs with a scancode of 0x27 add a mapping
for this.
2. Scancode 0x61 is KEY_SWITCHVIDEOMODE. Usually this is a duplicate
input event with the "Video Bus" input device events. But on these devices
the "Video Bus" does not send events for this key. Map 0x61 to KEY_UNKNOWN
instead of using KE_IGNORE so that udev/hwdb can override it on these devs.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20220829163544.5288-1-hdegoede@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 40ec787e1adf302c11668d4cc69838f4d584187d ]
The call to:
size = simple_write_to_buffer(cmdbuf, sizeof(cmdbuf), ppos, buf, size);
will succeed if at least one byte is written to the "cmdbuf" buffer.
The "*ppos" value controls which byte is written. Another problem is
that this code does not check for errors so it's possible for the entire
buffer to be uninitialized.
Inintialize the struct to zero to prevent reading uninitialized stack
data.
Debugfs is normally only writable by root so the impact of this bug is
very minimal.
Fixes: 6cca83d498 ("Platform: OLPC: move debugfs support from x86 EC driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/YthIKn+TfZSZMEcM@kili
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
The packets on IPA RX pipe 0 are route back to IPA TX pipe 0
which is causing the IPA stall. This fix allows to clear ipa
pipeline for ep config such as set/reset DMA mode
for rmnet tethering config.
Change-Id: Idd923f67bebfbc0aed8afcd0ea94a175ff691395
Signed-off-by: Vinayaka B M <quic_vinaybm@quicinc.com>
Fix to NULL terminate the peers list ptr
after freeing it, to get rid of use after
free issue.
Change-Id: Ide9fde9e7648a7af561a5b0ae0fa085810e59ea6
Signed-off-by: Prashanth Reddy Baddam <quic_pbaddam@quicinc.com>
Sometimes remnet_ipa fails to suspend with the following trace:
NETDEV WATCHDOG: rmnet_ipa0 (): transmit queue 0 timed out
Signed-off-by: celtare21 <celtare21@gmail.com>
--> User builds don't need debugfs, this is the first of 5 patches
that add a switch disabling DEBUG_FS on user builds, bringing
kernel size a bit down and providing less spamming on kernel log
Signed-off-by: Luan Cachoroski Halaiko <luhalaiko@gmail.com>
During NAT table Initialization parameter pass from HLOS, if max/zero
table entries passed it was leading to out of bound read. Adding checks
to validate the table entries before passing to NAT table parameter.
Change-Id: Ie2b252ea18deed694c6f76a34955af604ffeb3f3
Signed-off-by: Himansu Nayak <quic_himansu@quicinc.com>
This is the 4.14.262 stable release
* tag 'v4.14.262' of git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux: (72 commits)
Linux 4.14.262
mISDN: change function names to avoid conflicts
net: udp: fix alignment problem in udp4_seq_show()
ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate
scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown()
ipv6: Do cleanup if attribute validation fails in multipath route
ipv6: Continue processing multipath route even if gateway attribute is invalid
phonet: refcount leak in pep_sock_accep
rndis_host: support Hytera digital radios
power: reset: ltc2952: Fix use of floating point literals
xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate
sch_qfq: prevent shift-out-of-bounds in qfq_init_qdisc
ipv6: Check attribute length for RTA_GATEWAY when deleting multipath route
ipv6: Check attribute length for RTA_GATEWAY in multipath route
i40e: Fix incorrect netdev's real number of RX/TX queues
i40e: fix use-after-free in i40e_sync_filters_subtask()
mac80211: initialize variable have_higher_than_11mbit
RDMA/core: Don't infoleak GRH fields
ieee802154: atusb: fix uninit value in atusb_set_extended_addr
virtio_pci: Support surprise removal of virtio pci device
...
Becauase of using wrong pair of PM operation device
was not resuming if suspend fails. Adding changes to
use correct set of PM operations.
Change-Id: Ib9fdea8f93f0a6dafbd5908dc8fc2bbf4f1e0904
Signed-off-by: Ashok Vuyyuru <avuyyuru@codeaurora.org>
Signed-off-by: Panchajanya1999 <panchajanya@azure-dev.live>
IPA force_coals command stuck due to not getting the gsi interrupt.
The suspend on IPA AP/RMNET_IPA driver was registered as noirq type,
gsi interrupt handler won't be called because of this.
The fix is to change the suspend cb from suspend_noirq to suspend.
Change-Id: I148c981b0edb28c414a30b991294b2683b198399
Signed-off-by: Bojun Pan <bojunp@codeaurora.org>
Signed-off-by: Panchajanya1999 <panchajanya@azure-dev.live>
Changes in 4.14.256
xhci: Fix USB 3.1 enumeration issues by increasing roothub power-on-good delay
binder: use euid from cred instead of using task
binder: use cred instead of task for selinux checks
Input: elantench - fix misreporting trackpoint coordinates
Input: i8042 - Add quirk for Fujitsu Lifebook T725
libata: fix read log timeout value
ocfs2: fix data corruption on truncate
mmc: dw_mmc: Dont wait for DRTO on Write RSP error
parisc: Fix ptrace check on syscall return
tpm: Check for integer overflow in tpm2_map_response_body()
media: ite-cir: IR receiver stop working after receive overflow
ALSA: ua101: fix division by zero at probe
ALSA: 6fire: fix control and bulk message timeouts
ALSA: line6: fix control and interrupt message timeouts
ALSA: synth: missing check for possible NULL after the call to kstrdup
ALSA: timer: Fix use-after-free problem
ALSA: timer: Unconditionally unlink slave instances, too
x86/irq: Ensure PI wakeup handler is unregistered before module unload
cavium: Return negative value when pci_alloc_irq_vectors() fails
scsi: qla2xxx: Fix unmap of already freed sgl
cavium: Fix return values of the probe function
sfc: Don't use netif_info before net_device setup
hyperv/vmbus: include linux/bitops.h
mmc: winbond: don't build on M68K
bpf: Prevent increasing bpf_jit_limit above max
xen/netfront: stop tx queues during live migration
spi: spl022: fix Microwire full duplex mode
watchdog: Fix OMAP watchdog early handling
vmxnet3: do not stop tx queues after netif_device_detach()
btrfs: fix lost error handling when replaying directory deletes
hwmon: (pmbus/lm25066) Add offset coefficients
regulator: s5m8767: do not use reset value as DVS voltage if GPIO DVS is disabled
regulator: dt-bindings: samsung,s5m8767: correct s5m8767,pmic-buck-default-dvs-idx property
EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell
mwifiex: fix division by zero in fw download path
ath6kl: fix division by zero in send path
ath6kl: fix control-message timeout
ath10k: fix control-message timeout
ath10k: fix division by zero in send path
PCI: Mark Atheros QCA6174 to avoid bus reset
rtl8187: fix control-message timeouts
evm: mark evm_fixmode as __ro_after_init
wcn36xx: Fix HT40 capability for 2Ghz band
mwifiex: Read a PCI register after writing the TX ring write pointer
libata: fix checking of DMA state
wcn36xx: handle connection loss indication
RDMA/qedr: Fix NULL deref for query_qp on the GSI QP
signal: Remove the bogus sigkill_pending in ptrace_stop
signal/mips: Update (_save|_restore)_fp_context to fail with -EFAULT
power: supply: max17042_battery: Prevent int underflow in set_soc_threshold
power: supply: max17042_battery: use VFSOC for capacity when no rsns
powerpc/85xx: Fix oops when mpc85xx_smp_guts_ids node cannot be found
serial: core: Fix initializing and restoring termios speed
ALSA: mixer: oss: Fix racy access to slots
ALSA: mixer: fix deadlock in snd_mixer_oss_set_volume
xen/balloon: add late_initcall_sync() for initial ballooning done
PCI: aardvark: Do not clear status bits of masked interrupts
PCI: aardvark: Do not unmask unused interrupts
PCI: aardvark: Fix return value of MSI domain .alloc() method
PCI: aardvark: Read all 16-bits from PCIE_MSI_PAYLOAD_REG
quota: check block number when reading the block in quota file
quota: correct error number in free_dqentry()
pinctrl: core: fix possible memory leak in pinctrl_enable()
iio: dac: ad5446: Fix ad5622_write() return value
USB: serial: keyspan: fix memleak on probe errors
USB: iowarrior: fix control-message timeouts
Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg()
Bluetooth: fix use-after-free error in lock_sock_nested()
platform/x86: wmi: do not fail if disabling fails
MIPS: lantiq: dma: add small delay after reset
MIPS: lantiq: dma: reset correct number of channel
locking/lockdep: Avoid RCU-induced noinstr fail
smackfs: Fix use-after-free in netlbl_catmap_walk()
x86: Increase exception stack sizes
mwifiex: Run SET_BSS_MODE when changing from P2P to STATION vif-type
mwifiex: Properly initialize private structure on interface type changes
media: mt9p031: Fix corrupted frame after restarting stream
media: netup_unidvb: handle interrupt properly according to the firmware
media: uvcvideo: Set capability in s_param
media: s5p-mfc: fix possible null-pointer dereference in s5p_mfc_probe()
media: s5p-mfc: Add checking to s5p_mfc_probe().
media: mceusb: return without resubmitting URB in case of -EPROTO error.
ia64: don't do IA64_CMPXCHG_DEBUG without CONFIG_PRINTK
ACPICA: Avoid evaluating methods too early during system resume
media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte()
tracefs: Have tracefs directories not set OTH permission bits by default
ath: dfs_pattern_detector: Fix possible null-pointer dereference in channel_detector_create()
ACPI: battery: Accept charges over the design capacity as full
leaking_addresses: Always print a trailing newline
memstick: r592: Fix a UAF bug when removing the driver
lib/xz: Avoid overlapping memcpy() with invalid input with in-place decompression
lib/xz: Validate the value before assigning it to an enum variable
tracing/cfi: Fix cmp_entries_* functions signature mismatch
mwl8k: Fix use-after-free in mwl8k_fw_state_machine()
PM: hibernate: Get block device exclusively in swsusp_check()
iwlwifi: mvm: disable RX-diversity in powersave
smackfs: use __GFP_NOFAIL for smk_cipso_doi()
ARM: clang: Do not rely on lr register for stacktrace
gre/sit: Don't generate link-local addr if addr_gen_mode is IN6_ADDR_GEN_MODE_NONE
ARM: 9136/1: ARMv7-M uses BE-8, not BE-32
spi: bcm-qspi: Fix missing clk_disable_unprepare() on error in bcm_qspi_probe()
parisc: fix warning in flush_tlb_all
task_stack: Fix end_of_stack() for architectures with upwards-growing stack
parisc/kgdb: add kgdb_roundup() to make kgdb work with idle polling
cgroup: Make rebind_subsystems() disable v2 controllers all at once
media: dvb-usb: fix ununit-value in az6027_rc_query
media: mtk-vpu: Fix a resource leak in the error handling path of 'mtk_vpu_probe()'
media: si470x: Avoid card name truncation
media: cx23885: Fix snd_card_free call on null card pointer
cpuidle: Fix kobject memory leaks in error paths
ath9k: Fix potential interrupt storm on queue reset
crypto: qat - detect PFVF collision after ACK
crypto: qat - disregard spurious PFVF interrupts
hwrng: mtk - Force runtime pm ops for sleep ops
b43legacy: fix a lower bounds test
b43: fix a lower bounds test
memstick: avoid out-of-range warning
memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host()
hwmon: Fix possible memleak in __hwmon_device_register()
ath10k: fix max antenna gain unit
drm/msm: uninitialized variable in msm_gem_import()
net: stream: don't purge sk_error_queue in sk_stream_kill_queues()
mmc: mxs-mmc: disable regulator on error and in the remove function
platform/x86: thinkpad_acpi: Fix bitwise vs. logical warning
mwifiex: Send DELBA requests according to spec
phy: micrel: ksz8041nl: do not use power down mode
PM: hibernate: fix sparse warnings
smackfs: use netlbl_cfg_cipsov4_del() for deleting cipso_v4_doi
s390/gmap: don't unconditionally call pte_unmap_unlock() in __gmap_zap()
irq: mips: avoid nested irq_enter()
samples/kretprobes: Fix return value if register_kretprobe() failed
libertas_tf: Fix possible memory leak in probe and disconnect
libertas: Fix possible memory leak in probe and disconnect
net: amd-xgbe: Toggle PLL settings during rate change
net: phylink: avoid mvneta warning when setting pause parameters
crypto: pcrypt - Delay write to padata->info
ibmvnic: Process crqs after enabling interrupts
RDMA/rxe: Fix wrong port_cap_flags
ARM: s3c: irq-s3c24xx: Fix return value check for s3c24xx_init_intc()
ARM: dts: at91: tse850: the emac<->phy interface is rmii
scsi: dc395: Fix error case unwinding
MIPS: loongson64: make CPU_LOONGSON64 depends on MIPS_FP_SUPPORT
JFS: fix memleak in jfs_mount
ALSA: hda: Reduce udelay() at SKL+ position reporting
arm: dts: omap3-gta04a4: accelerometer irq fix
soc/tegra: Fix an error handling path in tegra_powergate_power_up()
memory: fsl_ifc: fix leak of irq and nand_irq in fsl_ifc_ctrl_probe
video: fbdev: chipsfb: use memset_io() instead of memset()
serial: 8250_dw: Drop wrong use of ACPI_PTR()
usb: gadget: hid: fix error code in do_config()
power: supply: rt5033_battery: Change voltage values to µV
scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn()
RDMA/mlx4: Return missed an error if device doesn't support steering
ASoC: cs42l42: Correct some register default values
ASoC: cs42l42: Defer probe if request_threaded_irq() returns EPROBE_DEFER
serial: xilinx_uartps: Fix race condition causing stuck TX
mips: cm: Convert to bitfield API to fix out-of-bounds access
power: supply: bq27xxx: Fix kernel crash on IRQ handler register error
apparmor: fix error check
rpmsg: Fix rpmsg_create_ept return when RPMSG config is not defined
pnfs/flexfiles: Fix misplaced barrier in nfs4_ff_layout_prepare_ds
drm/plane-helper: fix uninitialized variable reference
PCI: aardvark: Don't spam about PIO Response Status
NFS: Fix deadlocks in nfs_scan_commit_list()
fs: orangefs: fix error return code of orangefs_revalidate_lookup()
mtd: spi-nor: hisi-sfc: Remove excessive clk_disable_unprepare()
dmaengine: at_xdmac: fix AT_XDMAC_CC_PERID() macro
auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty string
auxdisplay: ht16k33: Connect backlight to fbdev
auxdisplay: ht16k33: Fix frame buffer device blanking
netfilter: nfnetlink_queue: fix OOB when mac header was cleared
dmaengine: dmaengine_desc_callback_valid(): Check for `callback_result`
m68k: set a default value for MEMORY_RESERVE
watchdog: f71808e_wdt: fix inaccurate report in WDIOC_GETTIMEOUT
ar7: fix kernel builds for compiler test
scsi: qla2xxx: Turn off target reset during issue_lip
i2c: xlr: Fix a resource leak in the error handling path of 'xlr_i2c_probe()'
xen-pciback: Fix return in pm_ctrl_init()
net: davinci_emac: Fix interrupt pacing disable
ACPI: PMIC: Fix intel_pmic_regs_handler() read accesses
bonding: Fix a use-after-free problem when bond_sysfs_slave_add() failed
mm/zsmalloc.c: close race window between zs_pool_dec_isolated() and zs_unregister_migration()
llc: fix out-of-bound array index in llc_sk_dev_hash()
nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails
vsock: prevent unnecessary refcnt inc for nonblocking connect
USB: chipidea: fix interrupt deadlock
ARM: 9155/1: fix early early_iounmap()
ARM: 9156/1: drop cc-option fallbacks for architecture selection
powerpc/lib: Add helper to check if offset is within conditional branch range
powerpc/bpf: Validate branch ranges
powerpc/bpf: Fix BPF_SUB when imm == 0x80000000
mm, oom: pagefault_out_of_memory: don't force global OOM for dying tasks
mm, oom: do not trigger out_of_memory from the #PF
s390/cio: check the subchannel validity for dev_busid
PCI: Add PCI_EXP_DEVCTL_PAYLOAD_* macros
ext4: fix lazy initialization next schedule time computation in more granular unit
tracing: Resize tgid_map to pid_max, not PID_MAX_DEFAULT
parisc/entry: fix trace test in syscall exit path
PCI/MSI: Destroy sysfs before freeing entries
arm64: zynqmp: Fix serial compatible string
scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()
usb: musb: tusb6010: check return value after calling platform_get_resource()
scsi: advansys: Fix kernel pointer leak
ARM: dts: omap: fix gpmc,mux-add-data type
usb: host: ohci-tmio: check return value after calling platform_get_resource()
tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc
MIPS: sni: Fix the build
scsi: target: Fix ordered tag handling
scsi: target: Fix alua_tg_pt_gps_count tracking
powerpc/5200: dts: fix memory node unit name
ALSA: gus: fix null pointer dereference on pointer block
powerpc/dcr: Use cmplwi instead of 3-argument cmpli
sh: check return code of request_irq
maple: fix wrong return value of maple_bus_init().
sh: fix kconfig unmet dependency warning for FRAME_POINTER
sh: define __BIG_ENDIAN for math-emu
mips: BCM63XX: ensure that CPU_SUPPORTS_32BIT_KERNEL is set
sched/core: Mitigate race cpus_share_cache()/update_top_cache_domain()
net: bnx2x: fix variable dereferenced before check
iavf: Fix for the false positive ASQ/ARQ errors while issuing VF reset
MIPS: generic/yamon-dt: fix uninitialized variable error
mips: bcm63xx: add support for clk_get_parent()
mips: lantiq: add support for clk_get_parent()
platform/x86: hp_accel: Fix an error handling path in 'lis3lv02d_probe()'
net: virtio_net_hdr_to_skb: count transport header in UFO
i40e: Fix NULL ptr dereference on VSI filter sync
NFC: reorganize the functions in nci_request
NFC: reorder the logic in nfc_{un,}register_device
perf/x86/intel/uncore: Fix filter_tid mask for CHA events on Skylake Server
perf/x86/intel/uncore: Fix IIO event constraints for Skylake Server
tun: fix bonding active backup with arp monitoring
hexagon: export raw I/O routines for modules
mm: kmemleak: slob: respect SLAB_NOLEAKTRACE flag
btrfs: fix memory ordering between normal and ordered work functions
parisc/sticon: fix reverse colors
cfg80211: call cfg80211_stop_ap when switch from P2P_GO type
drm/udl: fix control-message timeout
drm/amdgpu: fix set scaling mode Full/Full aspect/Center not works on vga and dvi connectors
perf/core: Avoid put_page() when GUP fails
batman-adv: mcast: fix duplicate mcast packets in BLA backbone from LAN
batman-adv: mcast: fix duplicate mcast packets from BLA backbone to mesh
batman-adv: Consider fragmentation for needed_headroom
batman-adv: Reserve needed_*room for fragments
batman-adv: Don't always reallocate the fragmentation skb head
RDMA/netlink: Add __maybe_unused to static inline in C file
ASoC: DAPM: Cover regression by kctl change notification fix
usb: max-3421: Use driver data instead of maintaining a list of bound devices
soc/tegra: pmc: Fix imbalanced clock disabling in error code path
Linux 4.14.256
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I32f0b43f5aa192eda1aa3a220a2f348ade0536d2
