bka
3670 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
bengris32
|
c6aa1292ca |
Merge branch 'linux-4.19.y-cip' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip into android-4.19.y-mediatek
* 'linux-4.19.y-cip' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip: CIP: Bump version suffix to -cip124 after merge from cip/linux-4.19.y-st tree Update localversion-st, tree is up-to-date with 5.4.298. f2fs: fix to do sanity check on ino and xnid squashfs: fix memory leak in squashfs_fill_super pNFS: Handle RPC size limit for layoutcommits wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect usb: core: usb_submit_urb: downgrade type check udf: Verify partition map count f2fs: fix to avoid panic in f2fs_evict_inode usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() HID: asus: fix UAF via HID_CLAIMED_INPUT validation efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare sctp: initialize more fields in sctp_v6_from_sk() net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts net/mlx5e: Set local Xoff after FW update net: dlink: fix multicast stats being counted incorrectly atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). net/atm: remove the atmdev_ops {get, set}sockopt methods Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced powerpc/kvm: Fix ifdef to remove build warning net: ipv4: fix regression in local-broadcast routes vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() scsi: core: sysfs: Correct sysfs attributes access rights ftrace: Fix potential warning in trace_printk_seq during ftrace_dump alloc_fdtable(): change calling conventions. ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add ALSA: usb-audio: Fix size validation in convert_chmap_v3() scsi: qla4xxx: Prevent a potential error pointer dereference usb: xhci: Fix slot_id resource race conflict nfs: fix UAF in direct writes NFS: Fix up commit deadlocks Bluetooth: fix use-after-free in device_for_each_child() selftests: forwarding: tc_actions.sh: add matchall mirror test codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() sch_qfq: make qfq_qlen_notify() idempotent sch_hfsc: make hfsc_qlen_notify() idempotent sch_drr: make drr_qlen_notify() idempotent btrfs: populate otime when logging an inode item media: venus: hfi: explicitly release IRQ during teardown f2fs: fix to avoid out-of-boundary access in dnode page media: venus: protect against spurious interrupts during probe media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig usb: musb: omap2430: fix device leak at unbind NFS: Fix the setting of capabilities when automounting a new filesystem NFS: Fix up handling of outstanding layoutcommit in nfs_update_inode() NFSv4: Fix nfs4_bitmap_copy_adjust() usb: typec: fusb302: cache PD RX state cdc-acm: fix race between initial clearing halt and open USB: cdc-acm: do not log successful probe on later errors nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() tracing: Add down_write(trace_event_sem) when adding trace event usb: hub: Don't try to recover devices lost during warm reset. usb: hub: avoid warm port reset during USB3 disconnect x86/mce/amd: Add default names for MCA banks and blocks iio: hid-sensor-prox: Fix incorrect OFFSET calculation mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n mm/zsmalloc.c: convert to use kmem_cache_zalloc in cache_alloc_zspage() net: usbnet: Fix the wrong netif_carrier_on() call net: usbnet: Avoid potential RCU stall on LINK_CHANGE event PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value kbuild: Add KBUILD_CPPFLAGS to as-option invocation kbuild: add $(CLANG_FLAGS) to KBUILD_CPPFLAGS kbuild: Add CLANG_FLAGS to as-instr mips: Include KBUILD_CPPFLAGS in CHECKFLAGS invocation kbuild: Update assembler calls to use proper flags and language target ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS usb: dwc3: Ignore late xferNotReady event to prevent halt timeout USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles usb: storage: realtek_cr: Use correct byte order for bcs->Residue USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive iio: proximity: isl29501: fix buffered read on big-endian systems ftrace: Also allocate and copy hash for reading of filter files fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() fs/buffer: fix use-after-free when call bh_read() helper drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 media: venus: Add a check for packet size after reading from shared memory media: ov2659: Fix memory leaks in ov2659_probe() media: usbtv: Lock resolution while streaming media: gspca: Add bounds checking to firmware parser jbd2: prevent softlockup in jbd2_log_do_checkpoint() PCI: endpoint: Fix configfs group removal on driver teardown PCI: endpoint: Fix configfs group list head handling mtd: rawnand: fsmc: Add missing check after DMA map wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() zynq_fpga: use sgtable-based scatterlist wrappers ata: libata-scsi: Fix ata_to_sense_error() status handling ext4: fix reserved gdt blocks handling in fsmap ext4: fix fsmap end of range reporting with bigalloc ext4: check fast symlink for ea_inode correctly Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" vt: defkeymap: Map keycodes above 127 to K_HOLE usb: gadget: udc: renesas_usb3: fix device leak at unbind usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() m68k: Fix lost column on framebuffer debug console serial: 8250: fix panic due to PSLVERR media: uvcvideo: Do not mark valid metadata as invalid media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() btrfs: fix log tree replay failure due to file with 0 links and extents thunderbolt: Fix copy+paste error in match_service_id() misc: rtsx: usb: Ensure mmc child device is active when card is present scsi: lpfc: Remove redundant assignment to avoid memory leak rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe pNFS: Fix uninited ptr deref in block/scsi layout pNFS: Fix disk addr range check in block/scsi layout pNFS: Fix stripe mapping in block/scsi layout ipmi: Fix strcpy source and destination the same kconfig: lxdialog: fix 'space' to (de)select options kconfig: gconf: fix potential memory leak in renderer_edited() kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() scsi: aacraid: Stop using PCI_IRQ_AFFINITY scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans kconfig: nconf: Ensure null termination where strncpy is used kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c PCI: pnv_php: Work around switches with broken presence detection media: uvcvideo: Fix bandwidth issue for Alcor camera media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() media: usb: hdpvr: disable zero-length read messages media: tc358743: Increase FIFO trigger level to 374 media: tc358743: Return an appropriate colorspace from tc358743_set_fmt media: tc358743: Check I2C succeeded during probe pinctrl: stm32: Manage irq affinity settings scsi: mpt3sas: Correctly handle ATA device errors RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() MIPS: Don't crash in stack_top() for tasks without ABI or vDSO jfs: upper bound check of tree index in dbAllocAG jfs: Regular file corruption check jfs: truncate good inode pages when hard link is 0 scsi: bfa: Double-free fix MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} watchdog: dw_wdt: Fix default timeout fs/orangefs: use snprintf() instead of sprintf() scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr vhost: fail early when __vhost_add_used() fails uapi: in6: restore visibility of most IPv6 socket options net: ncsi: Fix buffer overflow in fetching version id net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs wifi: iwlegacy: Check rate_idx range after addition netmem: fix skb_frag_address_safe with unreadable skbs wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() net: fec: allow disable coalescing (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer s390/stp: Remove udelay from stp_sync_clock() wifi: iwlwifi: mvm: fix scan request validation net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() net: ipv4: fix incorrect MTU in broadcast routes wifi: cfg80211: Fix interface type validation et131x: Add missing check after DMA map be2net: Use correct byte order and format string for TCP seq and ack_seq s390/time: Use monotonic clock in get_cycles() wifi: cfg80211: reject HTC bit for management frames ktest.pl: Prevent recursion of default variable options ASoC: codecs: rt5640: Retry DEVICE_ID verification ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 ASoC: hdac_hdmi: Rate limit logging on connection and disconnection mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() ACPI: processor: fix acpi_object initialization PM: sleep: console: Fix the black screen issue thermal: sysfs: Return ENODATA instead of EAGAIN for reads selftests: tracing: Use mutex_unlock for testing glob filter ARM: tegra: Use I/O memcpy to write to IRAM gpio: tps65912: check the return value of regmap_update_bits() ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed cpufreq: Exit governor when failed to start old governor usb: xhci: Avoid showing errors during surprise removal usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command usb: xhci: Avoid showing warnings for dying controller selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t usb: xhci: print xhci->xhc_state when queue_command failed securityfs: don't pin dentries twice, once is enough... hfs: fix not erasing deleted b-tree node issue drbd: add missing kref_get in handle_write_conflicts arm64: Handle KCOV __init vs inline mismatches hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() hfs: fix slab-out-of-bounds in hfs_bnode_read() sctp: linearize cloned gso packets in sctp_rcv netfilter: ctnetlink: fix refcount leak on table dump udp: also consider secpath when evaluating ipsec use for checksumming fs: Prevent file descriptor table allocations exceeding INT_MAX sunvdc: Balance device refcount in vdc_port_mpgroup_check NFSD: detect mismatch of file handle and delegation stateid in OPEN op net: dpaa: fix device leak when querying time stamp info net: gianfar: fix device leak when querying time stamp info netlink: avoid infinite retry looping in netlink_unicast() ALSA: usb-audio: Validate UAC3 cluster segment descriptors ALSA: usb-audio: Validate UAC3 power domain descriptors, too usb: gadget : fix use-after-free in composite_dev_cleanup() MIPS: mm: tlb-r4k: Uniquify TLB entries on init USB: serial: option: add Foxconn T99W709 vsock: Do not allow binding to VMADDR_PORT_ANY net/packet: fix a race in packet_set_ring() and packet_notifier() perf/core: Prevent VMA split of buffer mappings perf/core: Exit early on perf_mmap() fail perf/core: Don't leak AUX buffer refcount on allocation failure pptp: fix pptp_xmit() error path smb: client: let recv_done() cleanup before notifying the callers. benet: fix BUG when creating VFs ipv6: reject malicious packets in ipv6_gso_segment() pptp: ensure minimal skb length in pptp_xmit() netpoll: prevent hanging NAPI when netcons gets enabled NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() pci/hotplug/pnv-php: Wrap warnings in macro pci/hotplug/pnv-php: Improve error msg on power state change failure usb: chipidea: udc: fix sleeping function called from invalid context f2fs: fix to avoid out-of-boundary access in devs.path f2fs: fix to avoid UAF in f2fs_sync_inode_meta() rtc: pcf8563: fix incorrect maximum clock rate handling rtc: hym8563: fix incorrect maximum clock rate handling rtc: ds1307: fix incorrect maximum clock rate handling mtd: rawnand: atmel: set pmecc data setup time mtd: rawnand: atmel: Fix dma_mapping_error() address jfs: fix metapage reference count leak in dbAllocCtl fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref crypto: qat - fix seq_file position update in adf_ring_next() dmaengine: nbpfaxi: Add missing check after DMA map dmaengine: mv_xor: Fix missing check after DMA map and missing unmap fs/orangefs: Allow 2 more characters in do_c_string() crypto: img-hash - Fix dma_unmap_sg() nents value scsi: isci: Fix dma_unmap_sg() nents value scsi: mvsas: Fix dma_unmap_sg() nents value scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value perf tests bp_account: Fix leaked file descriptor crypto: ccp - Fix crash when rebind ccp device for ccp.ko pinctrl: sunxi: Fix memory leak on krealloc failure power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set clk: davinci: Add NULL check in davinci_lpsc_clk_register() mtd: fix possible integer overflow in erase_xfer() crypto: marvell/cesa - Fix engine load inaccuracy PCI: rockchip-host: Fix "Unexpected Completion" log message vrf: Drop existing dst reference in vrf_ip6_input_dst netfilter: xt_nfacct: don't assume acct name is null-terminated can: kvaser_usb: Assign netdev.dev_port based on device channel index wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" mwl8k: Add missing check after DMA map wifi: rtl8xxxu: Fix RX skb size for aggregation disabled net/sched: Restrict conditions for adding duplicating netems to qdisc tree arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX netfilter: nf_tables: adjust lockdep assertions handling drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value m68k: Don't unregister boot console needlessly tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range iwlwifi: Add missing check for alloc_ordered_workqueue wifi: iwlwifi: Fix memory leak in iwl_mvm_init() wifi: rtl818x: Kill URBs before clearing tx status queue caif: reduce stack size, again staging: nvec: Fix incorrect null termination of battery manufacturer samples: mei: Fix building on musl libc usb: early: xhci-dbc: Fix early_ioremap leak Revert "vmci: Prevent the dispatching of uninitialized payloads" pps: fix poll support vmci: Prevent the dispatching of uninitialized payloads staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() ARM: dts: vfxxx: Correctly use two tuples for timer address ASoC: ops: dynamically allocate struct snd_ctl_elem_value hfsplus: remove mutex_lock check in hfsplus_free_extents ASoC: Intel: fix SND_SOC_SOF dependencies ethernet: intel: fix building with large NR_CPUS usb: phy: mxs: disconnect line when USB charger is attached usb: chipidea: udc: protect usb interrupt enable usb: chipidea: udc: add new API ci_hdrc_gadget_connect comedi: comedi_test: Fix possible deletion of uninitialized timers nilfs2: reject invalid file types when reading inodes i2c: qup: jump out of the loop in case of timeout net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class net: appletalk: Fix use-after-free in AARP proxy probe net: appletalk: fix kerneldoc warnings RDMA/core: Rate limit GID cache warning messages usb: hub: fix detection of high tier USB3 devices behind suspended hubs net_sched: sch_sfq: reject invalid perturb period net_sched: sch_sfq: move the limit validation net_sched: sch_sfq: use a temporary work area for validating configuration net_sched: sch_sfq: don't allow 1 packet limit net_sched: sch_sfq: handle bigger packets net_sched: sch_sfq: annotate data-races around q->perturb_period power: supply: bq24190_charger: Fix runtime PM imbalance on error xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS virtio-net: ensure the received length does not exceed allocated size usb: dwc3: qcom: Don't leave BCR asserted usb: musb: fix gadget state on disconnect net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout Bluetooth: SMP: If an unallowed command is received consider it a failure Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() usb: net: sierra: check for no status endpoint net/sched: sch_qfq: Fix race condition on qfq_aggregate net: emaclite: Fix missing pointer increment in aligned_read() comedi: Fix use of uninitialized data in insn_rw_emulate_bits() comedi: Fix some signed shift left operations comedi: das6402: Fix bit shift out of bounds comedi: das16m1: Fix bit shift out of bounds comedi: aio_iiro_16: Fix bit shift out of bounds comedi: pcl812: Fix bit shift out of bounds iio: adc: max1363: Reorder mode_list[] entries iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled soc: aspeed: lpc-snoop: Cleanup resources in stack-order mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() isofs: Verify inode mode when loading from disk dmaengine: nbpfaxi: Fix memory corruption in probe() af_packet: fix soft lockup issue caused by tpacket_snd() af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() HID: core: do not bypass hid_hw_raw_request HID: core: ensure __hid_request reserves the report ID as the first byte HID: core: ensure the allocated report buffer can contain the reserved report ID pch_uart: Fix dma_sync_sg_for_device() nents value Input: xpad - set correct controller type for Acer NGR200 i2c: stm32: fix the device used for the DMA map usb: gadget: configfs: Fix OOB read on empty string write USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI USB: serial: option: add Foxconn T99W640 USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition dma-mapping: add generic helpers for mapping sgtable objects usb: renesas_usbhs: Flush the notify_hotplug_work gpio: rcar: Use raw_spinlock to protect register access Change-Id: Ia6b8b00918487999c648f298d3550afc7eaaae03 Signed-off-by: bengris32 <bengris32@protonmail.ch> |
||
|
Minjong Kim
|
06801897cd |
HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()
commit 185c926283da67a72df20a63a5046b3b4631b7d9 upstream. in ntrig_report_version(), hdev parameter passed from hid_probe(). sending descriptor to /dev/uhid can make hdev->dev.parent->parent to null if hdev->dev.parent->parent is null, usb_dev has invalid address(0xffffffffffffff58) that hid_to_usb_dev(hdev) returned when usb_rcvctrlpipe() use usb_dev,it trigger page fault error for address(0xffffffffffffff58) add null check logic to ntrig_report_version() before calling hid_to_usb_dev() Signed-off-by: Minjong Kim <minbell.kim@samsung.com> Link: https://patch.msgid.link/20250813-hid-ntrig-page-fault-fix-v2-1-f98581f35106@samsung.com Signed-off-by: Benjamin Tissoires <bentiss@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Ulrich Hecht <uli@kernel.org> |
||
|
Qasim Ijaz
|
dcebfd64ab |
HID: asus: fix UAF via HID_CLAIMED_INPUT validation
commit d3af6ca9a8c34bbd8cff32b469b84c9021c9e7e4 upstream.
After hid_hw_start() is called hidinput_connect() will eventually be
called to set up the device with the input layer since the
HID_CONNECT_DEFAULT connect mask is used. During hidinput_connect()
all input and output reports are processed and corresponding hid_inputs
are allocated and configured via hidinput_configure_usages(). This
process involves slot tagging report fields and configuring usages
by setting relevant bits in the capability bitmaps. However it is possible
that the capability bitmaps are not set at all leading to the subsequent
hidinput_has_been_populated() check to fail leading to the freeing of the
hid_input and the underlying input device.
This becomes problematic because a malicious HID device like a
ASUS ROG N-Key keyboard can trigger the above scenario via a
specially crafted descriptor which then leads to a user-after-free
when the name of the freed input device is written to later on after
hid_hw_start(). Below, report 93 intentionally utilises the
HID_UP_UNDEFINED Usage Page which is skipped during usage
configuration, leading to the frees.
0x05, 0x0D, // Usage Page (Digitizer)
0x09, 0x05, // Usage (Touch Pad)
0xA1, 0x01, // Collection (Application)
0x85, 0x0D, // Report ID (13)
0x06, 0x00, 0xFF, // Usage Page (Vendor Defined 0xFF00)
0x09, 0xC5, // Usage (0xC5)
0x15, 0x00, // Logical Minimum (0)
0x26, 0xFF, 0x00, // Logical Maximum (255)
0x75, 0x08, // Report Size (8)
0x95, 0x04, // Report Count (4)
0xB1, 0x02, // Feature (Data,Var,Abs)
0x85, 0x5D, // Report ID (93)
0x06, 0x00, 0x00, // Usage Page (Undefined)
0x09, 0x01, // Usage (0x01)
0x15, 0x00, // Logical Minimum (0)
0x26, 0xFF, 0x00, // Logical Maximum (255)
0x75, 0x08, // Report Size (8)
0x95, 0x1B, // Report Count (27)
0x81, 0x02, // Input (Data,Var,Abs)
0xC0, // End Collection
Below is the KASAN splat after triggering the UAF:
[ 21.672709] ==================================================================
[ 21.673700] BUG: KASAN: slab-use-after-free in asus_probe+0xeeb/0xf80
[ 21.673700] Write of size 8 at addr ffff88810a0ac000 by task kworker/1:2/54
[ 21.673700]
[ 21.673700] CPU: 1 UID: 0 PID: 54 Comm: kworker/1:2 Not tainted 6.16.0-rc4-g9773391cf4dd-dirty #36 PREEMPT(voluntary)
[ 21.673700] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[ 21.673700] Call Trace:
[ 21.673700] <TASK>
[ 21.673700] dump_stack_lvl+0x5f/0x80
[ 21.673700] print_report+0xd1/0x660
[ 21.673700] kasan_report+0xe5/0x120
[ 21.673700] __asan_report_store8_noabort+0x1b/0x30
[ 21.673700] asus_probe+0xeeb/0xf80
[ 21.673700] hid_device_probe+0x2ee/0x700
[ 21.673700] really_probe+0x1c6/0x6b0
[ 21.673700] __driver_probe_device+0x24f/0x310
[ 21.673700] driver_probe_device+0x4e/0x220
[...]
[ 21.673700]
[ 21.673700] Allocated by task 54:
[ 21.673700] kasan_save_stack+0x3d/0x60
[ 21.673700] kasan_save_track+0x18/0x40
[ 21.673700] kasan_save_alloc_info+0x3b/0x50
[ 21.673700] __kasan_kmalloc+0x9c/0xa0
[ 21.673700] __kmalloc_cache_noprof+0x139/0x340
[ 21.673700] input_allocate_device+0x44/0x370
[ 21.673700] hidinput_connect+0xcb6/0x2630
[ 21.673700] hid_connect+0xf74/0x1d60
[ 21.673700] hid_hw_start+0x8c/0x110
[ 21.673700] asus_probe+0x5a3/0xf80
[ 21.673700] hid_device_probe+0x2ee/0x700
[ 21.673700] really_probe+0x1c6/0x6b0
[ 21.673700] __driver_probe_device+0x24f/0x310
[ 21.673700] driver_probe_device+0x4e/0x220
[...]
[ 21.673700]
[ 21.673700] Freed by task 54:
[ 21.673700] kasan_save_stack+0x3d/0x60
[ 21.673700] kasan_save_track+0x18/0x40
[ 21.673700] kasan_save_free_info+0x3f/0x60
[ 21.673700] __kasan_slab_free+0x3c/0x50
[ 21.673700] kfree+0xcf/0x350
[ 21.673700] input_dev_release+0xab/0xd0
[ 21.673700] device_release+0x9f/0x220
[ 21.673700] kobject_put+0x12b/0x220
[ 21.673700] put_device+0x12/0x20
[ 21.673700] input_free_device+0x4c/0xb0
[ 21.673700] hidinput_connect+0x1862/0x2630
[ 21.673700] hid_connect+0xf74/0x1d60
[ 21.673700] hid_hw_start+0x8c/0x110
[ 21.673700] asus_probe+0x5a3/0xf80
[ 21.673700] hid_device_probe+0x2ee/0x700
[ 21.673700] really_probe+0x1c6/0x6b0
[ 21.673700] __driver_probe_device+0x24f/0x310
[ 21.673700] driver_probe_device+0x4e/0x220
[...]
Fixes:
|
||
|
bengris32
|
c1807d7150 |
Merge branch 'linux-4.19.y-cip' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip into android-4.19.y-mediatek
* 'linux-4.19.y-cip' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip: CIP: Bump version suffix to -cip123 after merge from cip/linux-4.19.y-st tree Update localversion-st, tree is up-to-date with 5.4.296. emulex/benet: Fix build by return mismatch in be_cmd_unlock() net/sched: Abort __tc_modify_qdisc if parent class does not exist mtk-sd: Prevent memory corruption from DMA map failure mmc: mediatek: use data instead of mrq parameter from msdc_{un}prepare_data() scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu() btrfs: don't abort filesystem when attempting to snapshot deleted subvolume VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify net: ipv6: Discard next-hop MTU less than minimum link MTU Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY vt: add missing notification when switching back to text mode net: usb: qmi_wwan: add SIMCom 8230C composition atm: idt77252: Add missing `dma_map_error()` bnxt_en: Fix DCB ETS validation can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level net: appletalk: Fix device refcount leak in atrtr_create() md/raid1: Fix stack memory use after return in raid1_reshape wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() dma-buf: fix timeout handling in dma_resv_wait_timeout v2 Input: xpad - support Acer NGR 200 Controller Input: xpad - add VID for Turtle Beach controllers Input: xpad - add support for Amazon Game Controller netlink: Fix rmem check in netlink_broadcast_deliver(). netlink: make sure we allow at least one dump skb Revert "ACPI: battery: negate current when discharging" usb: gadget: u_serial: Fix race condition in TTY wakeup drm/sched: Increment job count before swapping tail spsc queue x86/mce: Make sure CMCI banks are cleared during shutdown on Intel x86/mce: Don't remove sysfs if thresholding sysfs init fails x86/mce/amd: Fix threshold limit reset rxrpc: Fix oops due to non-existence of prealloc backlog struct atm: clip: Fix NULL pointer dereference in vcc_sendmsg() atm: clip: Fix infinite recursive call of clip_push(). atm: clip: Fix memory leak of struct clip_vcc. atm: clip: Fix potential null-ptr-deref in to_atmarpd(). tipc: Fix use-after-free in tipc_conn_close(). netlink: Fix wraparounds of sk->sk_rmem_alloc. fix proc_sys_compare() handling of in-lookup dentries proc: Clear the pieces of proc_inode that proc_evict_inode cares about staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher() media: uvcvideo: Rollback non processed entities on error media: uvcvideo: Send control events for partial succeeds media: uvcvideo: Return the number of processed controls ACPI: PAD: fix crash in exit_round_robin() usb: typec: displayport: Fix potential deadlock Logitech C-270 even more broken rose: fix dangling neighbour pointers in rose_rt_device_down() net: rose: Fix fall-through warnings for Clang ethernet: atl1: Add missing DMA mapping error checks and count errors btrfs: use btrfs_record_snapshot_destroy() during rmdir btrfs: propagate last_unlink_trans earlier when doing a rmdir RDMA/mlx5: Fix CC counters query for MPV scsi: ufs: core: Fix spelling of a sysfs attribute name ACPICA: Refuse to evaluate a method if arguments are missing wifi: ath6kl: remove WARN on bad firmware input wifi: mac80211: drop invalid source address OCB frames powerpc: Fix struct termio related ioctl macros ata: pata_cs5536: fix build on 32-bit UML ALSA: sb: Force to disable DMAs once when DMA mode is changed net/sched: Always pass notifications when child class becomes empty nui: Fix dma_mapping_error() check enic: fix incorrect MTU comparison in enic_change_mtu() amd-xgbe: align CL37 AN sequence as per databook btrfs: fix missing error handling when searching for inode refs during log replay mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data usb: typec: altmodes/displayport: do not index invalid pin_assignments Revert "mmc: sdhci: Disable SD card clock before changing parameters" mmc: sdhci: Add a helper function for dump register in dynamic debug mode vsock/vmci: Clear the vmci transport packet properly when initializing it arm64: Restrict pagetable teardown to avoid false warning drm/bridge: cdns-dsi: Fix connecting to next bridge drm/tegra: Assign plane type before registration HID: wacom: fix kobject reference count leak HID: wacom: fix memory leak on sysfs attribute creation failure HID: wacom: fix memory leak on kobject creation failure dm-raid: fix variable in journal device check Bluetooth: L2CAP: Fix L2CAP MTU negotiation atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). um: ubd: Add missing error check in start_io_thread() vsock/uapi: fix linux/vm_sockets.h userspace compilation errors wifi: mac80211: fix beacon interval calculation overflow ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() i2c: robotfuzz-osif: disable zero-length read messages i2c: tiny-usb: disable zero-length read messages RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction RDMA/core: Use refcount_t instead of atomic_t on refcount of iwcm_id_private media: vivid: Change the siize of the composing media: omap3isp: use sgtable-based scatterlist wrappers jfs: validate AG parameters in dbMount() to prevent crashes fs/jfs: consolidate sanity checking in dbMount VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF ovl: Check for NULL d_inode() in ovl_dentry_upper() ceph: fix possible integer overflow in ceph_zero_objects() ALSA: hda: Ignore unsol events for cards being shut down usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode usb: cdc-wdm: avoid setting WDM_READ for ZLP-s usb: Add checks for snprintf() calls in usb_alloc_dev() usb: potential integer overflow in usbg_make_tpg() iio: pressure: zpa2326: Use aligned_s64 for the timestamp md/md-bitmap: fix dm-raid max_write_behind setting dmaengine: xilinx_dma: Set dma_device directions mfd: max14577: Fix wakeup source leaks on device unbind mailbox: Not protect module_put with spin_lock_irqsave cifs: Fix cifs_query_path_info() for Windows NT servers Change-Id: I4aaea1c594726dc12be1a02671ae15f0baf43f89 Signed-off-by: bengris32 <bengris32@protonmail.ch> |
||
|
Benjamin Tissoires
|
65b36e0f16 |
HID: core: do not bypass hid_hw_raw_request
commit c2ca42f190b6714d6c481dfd3d9b62ea091c946b upstream. hid_hw_raw_request() is actually useful to ensure the provided buffer and length are valid. Directly calling in the low level transport driver function bypassed those checks and allowed invalid paramto be used. Reported-by: Alan Stern <stern@rowland.harvard.edu> Closes: https://lore.kernel.org/linux-input/c75433e0-9b47-4072-bbe8-b1d14ea97b13@rowland.harvard.edu/ Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250710-report-size-null-v2-3-ccf922b7c4e5@kernel.org Signed-off-by: Benjamin Tissoires <bentiss@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Ulrich Hecht <uli@kernel.org> |
||
|
Benjamin Tissoires
|
a74bf5ee7a |
HID: core: ensure __hid_request reserves the report ID as the first byte
commit 0d0777ccaa2d46609d05b66ba0096802a2746193 upstream.
The low level transport driver expects the first byte to be the report
ID, even when the report ID is not use (in which case they just shift
the buffer).
However, __hid_request() whas not offsetting the buffer it used by one
in this case, meaning that the raw_request() callback emitted by the
transport driver would be stripped of the first byte.
Note: this changes the API for uhid devices when a request is made
through hid_hw_request. However, several considerations makes me think
this is fine:
- every request to a HID device made through hid_hw_request() would see
that change, but every request made through hid_hw_raw_request()
already has the new behaviour. So that means that the users are
already facing situations where they might have or not the first byte
being the null report ID when it is 0. We are making things more
straightforward in the end.
- uhid is mainly used for BLE devices
- uhid is also used for testing, but I don't see that change a big issue
- for BLE devices, we can check which kernel module is calling
hid_hw_request()
- and in those modules, we can check which are using a Bluetooth device
- and then we can check if the command is used with a report ID or not.
- surprise: none of the kernel module are using a report ID 0
- and finally, bluez, in its function set_report()[0], does the same
shift if the report ID is 0 and the given buffer has a size > 0.
[0] https://git.kernel.org/pub/scm/bluetooth/bluez.git/tree/profiles/input/hog-lib.c#n879
Reported-by: Alan Stern <stern@rowland.harvard.edu>
Closes: https://lore.kernel.org/linux-input/c75433e0-9b47-4072-bbe8-b1d14ea97b13@rowland.harvard.edu/
Reported-by: syzbot+8258d5439c49d4c35f43@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=8258d5439c49d4c35f43
Tested-by: syzbot+8258d5439c49d4c35f43@syzkaller.appspotmail.com
Fixes:
|
||
|
Benjamin Tissoires
|
194a3e80a9 |
HID: core: ensure the allocated report buffer can contain the reserved report ID
commit 4f15ee98304b96e164ff2340e1dfd6181c3f42aa upstream. When the report ID is not used, the low level transport drivers expect the first byte to be 0. However, currently the allocated buffer not account for that extra byte, meaning that instead of having 8 guaranteed bytes for implement to be working, we only have 7. Reported-by: Alan Stern <stern@rowland.harvard.edu> Closes: https://lore.kernel.org/linux-input/c75433e0-9b47-4072-bbe8-b1d14ea97b13@rowland.harvard.edu/ Cc: stable@vger.kernel.org Suggested-by: Alan Stern <stern@rowland.harvard.edu> Link: https://patch.msgid.link/20250710-report-size-null-v2-1-ccf922b7c4e5@kernel.org Signed-off-by: Benjamin Tissoires <bentiss@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Ulrich Hecht <uli@kernel.org> |
||
|
Chia-Lin Kao (AceLan)
|
4c4cada0a1 |
HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras
[ Upstream commit 54bae4c17c11688339eb73a04fd24203bb6e7494 ] The Chicony Electronics HP 5MP Cameras (USB ID 04F2:B824 & 04F2:B82C) report a HID sensor interface that is not actually implemented. Attempting to access this non-functional sensor via iio_info causes system hangs as runtime PM tries to wake up an unresponsive sensor. Add these 2 devices to the HID ignore list since the sensor interface is non-functional by design and should not be exposed to userspace. Signed-off-by: Chia-Lin Kao (AceLan) <acelan.kao@canonical.com> Signed-off-by: Jiri Kosina <jkosina@suse.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Ulrich Hecht <uli@kernel.org> |
||
|
Zhang Heng
|
a4a9ccda22 |
HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY
[ Upstream commit 1a8953f4f7746c6a515989774fe03047c522c613 ] MARTLINKTECHNOLOGY is a microphone device, when the HID interface in an audio device is requested to get specific report id, the following error may occur. [ 562.939373] usb 1-1.4.1.2: new full-speed USB device number 21 using xhci_hcd [ 563.104908] usb 1-1.4.1.2: New USB device found, idVendor=4c4a, idProduct=4155, bcdDevice= 1.00 [ 563.104910] usb 1-1.4.1.2: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 563.104911] usb 1-1.4.1.2: Product: USB Composite Device [ 563.104912] usb 1-1.4.1.2: Manufacturer: SmartlinkTechnology [ 563.104913] usb 1-1.4.1.2: SerialNumber: 20201111000001 [ 563.229499] input: SmartlinkTechnology USB Composite Device as /devices/pci0000:00/0000:00:07.1/0000:04:00.3/usb1/1-1/1-1.4/1-1.4.1/1-1.4.1.2/1-1.4.1.2:1.2/0003:4C4A:4155.000F/input/input35 [ 563.291505] hid-generic 0003:4C4A:4155.000F: input,hidraw2: USB HID v2.01 Keyboard [SmartlinkTechnology USB Composite Device] on usb-0000:04:00.3-1.4.1.2/input2 [ 563.291557] usbhid 1-1.4.1.2:1.3: couldn't find an input interrupt endpoint [ 568.506654] usb 1-1.4.1.2: 1:1: usb_set_interface failed (-110) [ 573.626656] usb 1-1.4.1.2: 1:1: usb_set_interface failed (-110) [ 578.746657] usb 1-1.4.1.2: 1:1: usb_set_interface failed (-110) [ 583.866655] usb 1-1.4.1.2: 1:1: usb_set_interface failed (-110) [ 588.986657] usb 1-1.4.1.2: 1:1: usb_set_interface failed (-110) Ignore HID interface. The device is working properly. Signed-off-by: Zhang Heng <zhangheng@kylinos.cn> Signed-off-by: Jiri Kosina <jkosina@suse.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Ulrich Hecht <uli@kernel.org> |
||
|
Qasim Ijaz
|
449537ed25 |
HID: wacom: fix kobject reference count leak
commit 85a720f4337f0ddf1603c8b75a8f1ffbbe022ef9 upstream.
When sysfs_create_files() fails in wacom_initialize_remotes() the error
is returned and the cleanup action will not have been registered yet.
As a result the kobject???s refcount is never dropped, so the
kobject can never be freed leading to a reference leak.
Fix this by calling kobject_put() before returning.
Fixes:
|
||
|
Qasim Ijaz
|
dfe1719e9a |
HID: wacom: fix memory leak on sysfs attribute creation failure
commit 1a19ae437ca5d5c7d9ec2678946fb339b1c706bf upstream.
When sysfs_create_files() fails during wacom_initialize_remotes() the
fifo buffer is not freed leading to a memory leak.
Fix this by calling kfifo_free() before returning.
Fixes:
|
||
|
Qasim Ijaz
|
72d8b1d568 |
HID: wacom: fix memory leak on kobject creation failure
commit 5ae416c5b1e2e816aee7b3fc8347adf70afabb4c upstream.
During wacom_initialize_remotes() a fifo buffer is allocated
with kfifo_alloc() and later a cleanup action is registered
during devm_add_action_or_reset() to clean it up.
However if the code fails to create a kobject and register it
with sysfs the code simply returns -ENOMEM before the cleanup
action is registered leading to a memory leak.
Fix this by ensuring the fifo is freed when the kobject creation
and registration process fails.
Fixes:
|
||
|
bengris32
|
3b5670d492 |
Merge branch 'linux-4.19.y-cip' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip into lineage-22.2
* 'linux-4.19.y-cip' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip: CIP: Bump version suffix to -cip122 after merge from cip/linux-4.19.y-st tree Update localversion-st, tree is up-to-date with 5.4.295. ARM: dts: am335x-bone-common: Increase MDIO reset deassert delay to 50ms ARM: dts: am335x-bone-common: Increase MDIO reset deassert time ARM: dts: am335x-bone-common: Add GPIO PHY reset on revision C3 board ARM: dts: am335x-bone-common: get rid of phy_id property mtd: nand: sunxi: Add randomizer configuration before randomizer enable mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() bridge: netfilter: Fix forwarding of fragmented packets vxlan: Annotate FDB data races hwmon: (gpio-fan) Add missing mutex locks nfs: handle failure of nfs_get_lock_context in unlock path sch_htb: make htb_deactivate() idempotent scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() perf: Fix sample vs do_exit() jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() mm/huge_memory: fix dereferencing invalid pmd migration entry posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() net: atm: fix /proc/net/atm/lec handling net: atm: add lec_mutex calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer atm: atmtcp: Free invalid length skb in atmtcp_c_send(). mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). wifi: carl9170: do not ping device which has failed to load firmware drm/nouveau/bl: increase buffer size to avoid truncate warning ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged ALSA: hda/intel: Add Thinkpad E15 to PM deny list Input: sparcspkr - avoid unannotated fall-through HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() atm: Revert atm_account_tx() if copy_from_iter_full() fails. selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len scsi: s390: zfcp: Ensure synchronous unit_add jffs2: check jffs2_prealloc_raw_node_refs() result in few other places jffs2: check that raw node were preallocated before writing summary drivers/rapidio/rio_cm.c: prevent possible heap overwrite Revert "x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2" on v6.6 and older powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery platform/x86: dell_rbu: Stop overwriting data buffer tee: Prevent size calculation wraparound on 32-bit kernels ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value watchdog: da9052_wdt: respect TWDMIN i40e: fix MMIO write access to an invalid page in i40e_clear_hw sock: Correct error checking condition for (assign|release)_proto_idx() vxlan: Do not treat dst cache initialization errors as fatal clk: rockchip: rk3036: mark ddrphy as critical wifi: mac80211: do not offer a mesh path if forwarding is disabled net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get() pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction() pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction() pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name() ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT tcp: always seek for minimal rtt in tcp_rcv_rtt_update() net: dlink: add synchronization for stats update sctp: Do not wake readers in __sctp_write_space() emulex/benet: correct command version selection in be_cmd_get_stats() i2c: designware: Invoke runtime suspend on quick slave re-registration net: macb: Check return value of dma_set_mask_and_coherent() cpufreq: Force sync policy boost with global boost on sysfs update nios2: force update_mmu_cache on spurious tlb-permission--related pagefaults media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() media: tc358743: ignore video while HPD is low drm/amdkfd: Set SDMA_RLCx_IB_CNTL/SWITCH_INSIDE_IB jfs: Fix null-ptr-deref in jfs_ioc_trim drm/amdgpu/gfx9: fix CSIB handling drm/amdgpu/gfx8: fix CSIB handling jfs: fix array-index-out-of-bounds read in add_missing_indices drm/amdgpu/gfx7: fix CSIB handling drm/amd/display: Add NULL pointer checks in dm_force_atomic_commit() media: uapi: v4l: Fix V4L2_TYPE_IS_OUTPUT condition sunrpc: update nextcheck time when adding new cache entries drm/amdgpu/gfx6: fix CSIB handling ACPI: battery: negate current when discharging power: supply: bq27xxx: Retrieve again when busy ACPICA: fix acpi parse and parseext cache leaks ACPICA: Avoid sequence overread in call to strncmp() ACPICA: fix acpi operand cache leak in dswstate.c PCI: Fix lock symmetry in pci_slot_unlock() regulator: max14577: Add error check for max14577_read_reg() staging: iio: ad5933: Correct settling cycles encoding per datasheet net: ch9200: fix uninitialised access during mii_nway_restart ftrace: Fix UAF when lookup kallsym after ftrace disabled dm-mirror: fix a tiny race condition mm: fix ratelimit_pages update error in dirty_ratio_handler() ipc: fix to protect IPCS lookups using RCU parisc: fix building with gcc-15 vgacon: Add check for vc_origin address range in vgacon_scroll() NFC: nci: uart: Set tty->disc_data only in success path f2fs: prevent kernel warning due to negative i_nlink from corrupted image Input: ims-pcu - check record size in ims_pcu_flash_firmware() ext4: fix calculation of credits for extent tree modification ext4: inline: fix len overflow in ext4_prepare_inline_data ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 media: v4l2-dev: fix error handling in __video_register_device() media: gspca: Add error handling for stv06xx_read_sensor() wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() gfs2: move msleep to sleepable context configfs: Do not override creating attribute file failure in populate_attrs() calipso: unlock rcu before returning -EAFNOSUPPORT usb: Flush altsetting 0 endpoints before reinitializating them after reset. fs/filesystems: Fix potential unsigned integer underflow in fs_name() net/mdiobus: Fix potential out-of-bounds read/write access MIPS: Move '-Wa,-msoft-float' check from as-option to cc-option x86/boot/compressed: prefer cc-option for CFLAGS additions net: mdio: C22 is now optional, EOPNOTSUPP if not provided i40e: retry VFLR handling if there is ongoing VF reset i40e: return false from i40e_reset_vf if reset is in progress net_sched: sch_sfq: fix a potential crash on gso_skb handling scsi: iscsi: Fix incorrect error path labels for flashnode operations NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes NFSD: Fix ia_size underflow Input: synaptics-rmi - fix crash with unsupported versions of F34 Input: synaptics-rmi4 - convert to use sysfs_emit() APIs do_change_type(): refuse to operate on unmounted/not ours mounts net/mlx4_en: Prevent potential integer overflow calculating Hz rtc: Fix offset calculation for .start_secs < 0 rtc: sh: assign correct interrupts with DT perf tests switch-tracking: Fix timestamp comparison mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove() rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() perf ui browser hists: Set actions->thread before calling do_zoom_thread() fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() soc: aspeed: lpc: Fix impossible judgment condition arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device bus: fsl-mc: fix double-free on mc_dev nilfs2: do not propagate ENOENT error from nilfs_btree_propagate() nilfs2: add pointer check for nilfs_direct_propagate() Squashfs: check return result of sb_min_blocksize ARM: dts: at91: at91sam9263: fix NAND chip selects ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select f2fs: fix to correct check conditions in f2fs_cross_rename f2fs: use d_inode(dentry) cleanup dentry->d_inode calipso: Don't call calipso functions for AF_INET sk. net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy wifi: ath9k_htc: Abort software beacon handling if disabled bpf: Fix WARN() in get_bpf_raw_tp_regs pinctrl: at91: Fix possible out-of-boundary access net: ncsi: Fix GCPS 64-bit member variables f2fs: fix to do sanity check on sbi->total_valid_block_count drm/tegra: rgb: Fix the unbound reference count drm: rcar-du: Fix memory leak in rcar_du_vsps_init() selftests/seccomp: fix syscall_restart test for arm compat firmware: psci: Fix refcount leak in psci_dt_init m68k: mac: Fix macintosh_config for Mac II drm/vmwgfx: Add seqno waiter for sync_files ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions" x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges() crypto: marvell/cesa - Avoid empty transfer descriptor crypto: marvell/cesa - Handle zero-length skcipher requests x86/cpu: Sanitize CPUID(0x80000000) output perf/core: Fix broken throttling when max_samples_per_tick=1 gfs2: gfs2_create_inode error handling fix netfilter: nft_socket: fix sk refcount leaks thunderbolt: Do not double dequeue a configuration request usb: usbtmc: Fix timeout value in get_stb usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE pinctrl: armada-37xx: set GPIO output value before setting direction pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs > 31 tracing: Fix compilation warning on arm32 platform/x86: thinkpad_acpi: Ignore battery threshold change event notification platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys spi: spi-sun4i: fix early activation um: let 'make clean' properly clean underlying SUBARCH as well platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS nfs: don't share pNFS DS connections between net namespaces HID: quirks: Add ADATA XPG alpha wireless mouse support coredump: fix error handling for replace_fd() smb: client: Reset all search buffer pointers when releasing buffer smb: client: Fix use-after-free in cifs_fill_dirent drm/i915/gvt: fix unterminated-string-initialization warning netfilter: nf_tables: do not defer rule destruction via call_rcu netfilter: nf_tables: wait for rcu grace period on net_device removal netfilter: nf_tables: pass nft_chain to destroy function, not nft_ctx mm/page_alloc.c: avoid infinite retries caused by cpuset race llc: fix data loss when reading from a socket in llc_ui_recvmsg() ALSA: pcm: Fix race of buffer access at PCM OSS layer can: bcm: add missing rcu read protection for procfs content can: bcm: add locking for bcm_op runtime updates crypto: algif_hash - fix double free in hash_accept net: dwmac-sun8i: Use parsed internal PHY address instead of 1 __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock xenbus: Allow PVH dom0 a non-local xenstore btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref ASoC: Intel: bytcr_rt5640: Add DMI quirk for Acer Aspire SW3-013 pinctrl: meson: define the pull up/down resistor value as 60 kOhm drm: Add valid clones check regulator: ad5398: Add device tree support bpftool: Fix readlink usage in get_fd_type HID: usbkbd: Fix the bit shift number for LED_KANA scsi: st: Restore some drive settings after reset scsi: lpfc: Handle duplicate D_IDs in ndlp search-by D_ID routine hwmon: (xgene-hwmon) use appropriate type for the latency value ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure(). net/mlx5: Extend Ethtool loopback selftest to support non-linear SKB net/mlx4_core: Avoid impossible mlx4_db_alloc() order value smack: recognize ipv4 CIPSO w/o categories pinctrl: devicetree: do not goto err when probing hogs in pinctrl_dt_to_map ASoC: ops: Enforce platform maximum on initial value ACPI: HED: Always initialize before evged PCI: Fix old_size lower bound in calculate_iosize() too EDAC/ie31200: work around false positive build warning net: pktgen: fix access outside of user given buffer in pktgen_thread_write() MIPS: pm-cps: Use per-CPU variables as per-CPU, not per-core MIPS: Use arch specific syscall name match function cpuidle: menu: Avoid discarding useful information x86/nmi: Add an emergency handler in nmi_desc & use it in nmi_shootdown_cpus() bonding: report duplicate MAC address in all situations net: xgene-v2: remove incorrect ACPI_PTR annotation x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2 net: pktgen: fix mpls maximum labels list parsing pinctrl: bcm281xx: Use "unsigned int" instead of bare "unsigned" media: cx231xx: set device_caps for 417 dm cache: prevent BUG_ON by blocking retries on failed device resumes media: c8sectpfe: Call of_node_put(i2c_bus) only once in c8sectpfe_probe() ARM: tegra: Switch DSI-B clock parent to PLLD on Tegra114 ieee802154: ca8210: Use proper setters and getters for bitwise types rtc: ds1307: stop disabling alarms on probe powerpc/prom_init: Fixup missing #size-cells on PowerBook6,7 mmc: sdhci: Disable SD card clock before changing parameters posix-timers: Add cond_resched() to posix_timer_add() search loop xen: Add support for XenServer 6.1 platform device dm: restrict dm device size to 2^63-512 bytes kbuild: fix argument parsing in scripts/config scsi: st: ERASE does not change tape location scsi: st: Tighten the page format heuristics with MODE SELECT ext4: reorder capability check last um: Update min_low_pfn to match changes in uml_reserved um: Store full CSGSFS and SS register from mcontext btrfs: send: return -ENAMETOOLONG when attempting a path that is too long btrfs: avoid linker error in btrfs_find_create_tree_block() i2c: pxa: fix call balance of i2c->clk handling routines mmc: host: Wait for Vdd to settle on card power off pNFS/flexfiles: Report ENETDOWN as a connection error tools/build: Don't pass test log files to linker dql: Fix dql->limit value when reset. SUNRPC: rpc_clnt_set_transport() must not change the autobind setting NFSv4: Treat ENETUNREACH errors as fatal for state recovery fbdev: core: tileblit: Implement missing margin clearing for tileblit fbdev: fsl-diu-fb: add missing device_remove_file() mailbox: use error ret code of of_parse_phandle_with_args() kconfig: merge_config: use an empty file as initfile cgroup: Fix compilation issue due to cgroup_mutex not being exported dma-mapping: avoid potential unused data compilation warning scsi: target: iscsi: Fix timeout on deleted connection openvswitch: Fix unsafe attribute parsing in output_userspace() Input: synaptics - enable InterTouch on TUXEDO InfinityBook Pro 14 v5 Input: synaptics - enable SMBus for HP Elitebook 850 G1 phy: Fix error handling in tegra_xusb_port_init ALSA: es1968: Add error handling for snd_pcm_hw_constraint_pow2() ACPI: PPTT: Fix processor subtable walk qlcnic: fix memory leak in qlcnic_sriov_channel_cfg_cmd() ALSA: sh: SND_AICA should depend on SH_DMA_API spi: loopback-test: Do not split 1024-byte hexdumps RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug staging: axis-fifo: Correct handling of tx_fifo_depth for size validation staging: axis-fifo: avoid parsing ignored device tree properties platform/x86: asus-wmi: Fix wlan_ctrl_by_user detection do_umount(): add missing barrier before refcount checks in sync case MIPS: Fix MAX_REG_OFFSET iio: adc: dln2: Use aligned_s64 for timestamp types: Complement the aligned types with signed 64-bit one USB: usbtmc: use interruptible sleep in usbtmc_read usb: typec: tcpm: delay SNK_TRY_WAIT_DEBOUNCE to SRC_TRYWAIT transition ocfs2: stop quota recovery before disabling quotas ocfs2: implement handshaking with ocfs2 recovery thread ocfs2: switch osb->disable_recovery to enum module: ensure that kobject_put() is safe for module type kobjects xenbus: Use kref to track req lifetime usb: uhci-platform: Make the clock really optional iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo iio: adis16201: Correct inclinometer channel resolution Input: synaptics - enable InterTouch on Dell Precision M3800 Input: synaptics - enable InterTouch on Dynabook Portege X30L-G Input: synaptics - enable InterTouch on Dynabook Portege X30-D net: dsa: b53: fix learning on VLAN unaware bridges scsi: target: Fix WRITE_SAME No Data Buffer crash dm: fix copying after src array boundaries iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid irqchip/gic-v2m: Add const to of_device_id sch_htb: make htb_qlen_notify() idempotent of: module: add buffer overflow check in of_modalias() net: fec: ERR007885 Workaround for conventional TX lan743x: remove redundant initialization of variable current_head_index net: dlink: Correct endianness handling of led_mode tracing: Fix oob write in trace_seq_to_buffer() dm: always update the array size in realloc_argv on success wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload i2c: imx-lpi2c: Fix clock count when probe defers EDAC/altera: Set DDR and SDMMC interrupt mask before registration EDAC/altera: Test the correct error reg offset signal/m68k: Use force_sigsegv(SIGSEGV) in fpsp040_die mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro() x86/bugs: fix backport error in "x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline" Change-Id: Ia48bfc7454e776a311efd14a33b7c414038c8a6d |
||
|
Terry Junge
|
8a78c94b4f |
HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()
commit fe7f7ac8e0c708446ff017453add769ffc15deed upstream.
Update struct hid_descriptor to better reflect the mandatory and
optional parts of the HID Descriptor as per USB HID 1.11 specification.
Note: the kernel currently does not parse any optional HID class
descriptors, only the mandatory report descriptor.
Update all references to member element desc[0] to rpt_desc.
Add test to verify bLength and bNumDescriptors values are valid.
Replace the for loop with direct access to the mandatory HID class
descriptor member for the report descriptor. This eliminates the
possibility of getting an out-of-bounds fault.
Add a warning message if the HID descriptor contains any unsupported
optional HID class descriptors.
Reported-by: syzbot+c52569baf0c843f35495@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c52569baf0c843f35495
Fixes:
|
||
|
Milton Barrera
|
6f91224605 |
HID: quirks: Add ADATA XPG alpha wireless mouse support
[ Upstream commit fa9fdeea1b7d6440c22efa6d59a769eae8bc89f1 ] This patch adds HID_QUIRK_ALWAYS_POLL for the ADATA XPG wireless gaming mouse (USB ID 125f:7505) and its USB dongle (USB ID 125f:7506). Without this quirk, the device does not generate input events properly. Signed-off-by: Milton Barrera <miltonjosue2001@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Ulrich Hecht <uli@kernel.org> |
||
|
junan
|
342f234de4 |
HID: usbkbd: Fix the bit shift number for LED_KANA
[ Upstream commit d73a4bfa2881a6859b384b75a414c33d4898b055 ] Since "LED_KANA" was defined as "0x04", the shift number should be "4". Signed-off-by: junan <junan76@163.com> Signed-off-by: Jiri Kosina <jkosina@suse.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Ulrich Hecht <uli@kernel.org> |
||
|
bengris32
|
b7c670dfff |
Merge branch 'linux-4.19.y-cip' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip into lineage-22.2
* 'linux-4.19.y-cip' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip: x86/bugs: fix backport error in "x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline" CIP: Bump version suffix to -cip121 after merge from cip/linux-4.19.y-st tree Update localversion-st, tree is up-to-date with 5.4.293. x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec() PCI: Rename PCI_IRQ_LEGACY to PCI_IRQ_INTX MIPS: cm: Fix warning if MIPS_CM is disabled comedi: jr3_pci: Fix synchronous deletion of timer scsi: pm80xx: Set phy_attached to zero when device is gone ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls selftests: ublk: fix test_stripe_04 KVM: s390: Don't use %pK through tracepoints sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP ntb: reduce stack usage in idt_scan_mws qibfs: fix _another_ leak usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev() usb: host: max3421-hcd: Add missing spi_device_id table parisc: PDT: Fix missing prototype warning MIPS: cm: Detect CM quirks from device tree USB: VLI disk crashes if LPM is used usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive usb: dwc3: gadget: check that event count does not exceed event buffer length USB: OHCI: Add quirk for LS7A OHCI controller (rev 0x02) USB: serial: simple: add OWON HDS200 series oscilloscope support USB: serial: option: add Sierra Wireless EM9291 USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe USB: storage: quirk for ADATA Portable HDD CH94 mcb: fix a double free bug in chameleon_parse_gdd() virtio_console: fix missing byte order handling for cols and rows net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too net_sched: hfsc: Fix a UAF vulnerability in class handling tipc: fix NULL pointer dereference in tipc_mon_reinit_self() net: phy: leds: fix memory leak cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error misc: pci_endpoint_test: Use INTX instead of LEGACY net: dsa: mv88e6xxx: fix VTU methods for 6320 family ext4: fix OOB read when checking dotdot dir ext4: optimize __ext4_check_dir_entry() MIPS: ds1287: Match ds1287_set_base_clock() function types MIPS: cevt-ds1287: Add missing ds1287.h include MIPS: dec: Declare which_prom() as static virtio-net: Add validation for used length openvswitch: fix lockup on tx to unregistering netdev with carrier net: openvswitch: fix race on port output mmc: cqhci: Fix checking of CQHCI_HALT state nvmet-fc: Remove unused functions usb: dwc3: support continuous runtime PM with dual role misc: pci_endpoint_test: Fix 'irq_type' to convey the correct type misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). kbuild: Add '-fno-builtin-wcslen' drm/sti: remove duplicate object names drm/repaper: fix integer overflows in repeat functions module: sign with sha512 instead of sha1 by default isofs: Prevent the use of too small fid i2c: cros-ec-tunnel: defer probe if parent EC is not present hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key btrfs: correctly escape subvol in btrfs_show_options() nfs: move nfs_fhandle_hash to common include file NFSD: Constify @fh argument of knfsd_fh_hash() asus-laptop: Fix an uninitialized variable writeback: fix false warning in inode_to_wb() net: b53: enable BPDU reception for management port net: openvswitch: fix nested key length validation in the set() action Revert "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" Bluetooth: btrtl: Prevent potential NULL dereference Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe() scsi: iscsi: Fix missing scsi_host_put() in error path wifi: wl1251: fix memory leak in wl1251_tx_work wifi: mac80211: Purge vif txq in ieee80211_do_stop() wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue() wifi: at76c50x: fix use after free access in at76_disconnect HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition Bluetooth: hci_uart: Fix another race during initialization x86/e820: Fix handling of subpage regions when calculating nosave ranges in e820__register_nosave_regions() PCI: Fix reference leak in pci_alloc_child_bus() of/irq: Fix device node refcount leakages in of_irq_init() of/irq: Fix device node refcount leakage in API irq_of_parse_and_map() gpio: zynq: Fix wakeup source leaks on device unbind ftrace: Add cond_resched() to ftrace_graph_set_hash() crypto: ccp - Fix check for the primary ASP device thermal/drivers/rockchip: Add missing rk3328 mapping entry sctp: detect and prevent references to a freed transport in sendmsg mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock sparc/mm: disable preemption in lazy mmu mode arm64: dts: mediatek: mt8173: Fix disp-pwm compatible string mtd: inftlcore: Add error check for inftl_read_oob() lib: scatterlist: fix sg_split_phys to preserve original scatterlist offsets jbd2: remove wrong sb->s_sequence check ext4: fix off-by-one error in do_split media: venus: hfi_parser: add check to avoid out of bound access media: i2c: ov7251: Introduce 1 ms delay between regulators and en GPIO media: i2c: ov7251: Set enable GPIO low in probe media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf() media: streamzap: prevent processing IR data on URB failure mtd: rawnand: brcmnand: fix PM resume warning arm64: cputype: Add MIDR_CORTEX_A76AE xenfs/xensyms: respect hypervisor's "next" indication media: siano: Fix error handling in smsdvb_module_init() media: venus: hfi: add check to handle incorrect queue size media: venus: hfi: add a check to handle OOB in sfr region media: i2c: adv748x: Fix test pattern selection mask bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags bpf: Add endian modifiers to fix endian warnings fbdev: omapfb: Add 'plane' value check drm/mediatek: mtk_dpi: Explicitly manage TVD clock in power on/off drm/amdkfd: Fix pqm_destroy_queue race with GPU reset drm: allow encoder mode_set even when connectors change for crtc Bluetooth: hci_uart: fix race during initialization tracing: fix return value in __ftrace_event_enable_disable for TRACE_REG_UNREGISTER net: vlan: don't propagate flags on open scsi: st: Fix array overflow in st_setup() ext4: ignore xattrs past end ext4: protect ext4_release_dquot against freezing ahci: add PCI ID for Marvell 88SE9215 SATA Controller ata: libata-eh: Do not use ATAPI DMA for a device limited to PIO mode jfs: add sanity check for agwidth in dbMount jfs: Prevent copying of nlink with value 0 from disk inode fs/jfs: Prevent integer overflow in AG size calculation fs/jfs: cast inactags to s64 to prevent potential overflow ALSA: usb-audio: Fix CME quirk for UF series keyboards ALSA: hda: intel: Fix Optimus when GPU has no sound HID: pidff: Fix null pointer dereference in pidff_find_fields HID: pidff: Do not send effect envelope if it's empty HID: pidff: Convert infinite length from Linux API to PID standard perf: arm_pmu: Don't disable counter in armpmu_add() x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD when running in a virtual machine pm: cpupower: bench: Prevent NULL dereference on malloc failure net: ppp: Add bound checking for skb data on ppp_sync_txmung ata: sata_sx4: Add error handling in pdc20621_i2c_read() ata: sata_sx4: Drop pointless VPRINTK() calls and convert the remaining ones tipc: fix memory leak in tipc_link_xmit ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe() Conflicts: fs/ext4/dir.c Signed-off-by: bengris32 <bengris32@protonmail.ch> Change-Id: Ifff69aae6aeecbbab378fba35b117f05e6076c6e |
||
|
Tomasz Pakuła
|
79af551077 |
HID: pidff: Fix null pointer dereference in pidff_find_fields
[ Upstream commit 22a05462c3d0eee15154faf8d13c49e6295270a5 ] This function triggered a null pointer dereference if used to search for a report that isn't implemented on the device. This happened both for optional and required reports alike. The same logic was applied to pidff_find_special_field and although pidff_init_fields should return an error earlier if one of the required reports is missing, future modifications could change this logic and resurface this possible null pointer dereference again. LKML bug report: https://lore.kernel.org/all/CAL-gK7f5=R0nrrQdPtaZZr1fd-cdAMbDMuZ_NLA8vM0SX+nGSw@mail.gmail.com Reported-by: Nolan Nicholson <nolananicholson@gmail.com> Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com> Reviewed-by: Michał Kopeć <michal@nozomi.space> Reviewed-by: Paul Dino Jones <paul@spacefreak18.xyz> Tested-by: Paul Dino Jones <paul@spacefreak18.xyz> Tested-by: Cristóferson Bueno <cbueno81@gmail.com> Tested-by: Pablo Cisneros <patchkez@protonmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Ulrich Hecht <uli@kernel.org> |
||
|
Tomasz Pakuła
|
db4392d5b4 |
HID: pidff: Do not send effect envelope if it's empty
[ Upstream commit 8876fc1884f5b39550c8387ff3176396c988541d ] Envelope struct is always initialized, but the envelope itself is optional as described in USB PID Device class definition 1.0. 5.1.1.1 Type Specific Block Offsets ... 4) Effects that do not use Condition Blocks use 1 Parameter Block and an *optional* Envelope Block. Sending out "empty" envelope breaks force feedback on some devices with games that use SINE effect + offset to emulate constant force effect, as well as generally breaking Constant/Periodic effects. One of the affected brands is Moza Racing. This change prevents the envelope from being sent if it contains all 0 values while keeping the old behavior of only sending it, if it differs from the old one. Changes in v6: - Simplify the checks to make them clearer - Fix possible null pointer dereference while calling pidff_needs_set_envelope Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com> Reviewed-by: Michał Kopeć <michal@nozomi.space> Reviewed-by: Paul Dino Jones <paul@spacefreak18.xyz> Tested-by: Paul Dino Jones <paul@spacefreak18.xyz> Tested-by: Cristóferson Bueno <cbueno81@gmail.com> Tested-by: Pablo Cisneros <patchkez@protonmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Ulrich Hecht <uli@kernel.org> |
||
|
Tomasz Pakuła
|
2ef1a5fb3d |
HID: pidff: Convert infinite length from Linux API to PID standard
[ Upstream commit 37e0591fe44dce39d1ebc7a82d5b6e4dba1582eb ] Software uses 0 as de-facto infinite lenght on Linux FF apis (SDL), Linux doesn't actually define anythi as of now, while USB PID defines NULL (0xffff). Most PID devices do not expect a 0-length effect and can't interpret it as infinite. This change fixes Force Feedback for most PID compliant devices. As most games depend on updating the values of already playing infinite effects, this is crucial to ensure they will actually work. Previously, users had to rely on third-party software to do this conversion and make their PID devices usable. Co-developed-by: Makarenko Oleg <oleg@makarenk.ooo> Signed-off-by: Makarenko Oleg <oleg@makarenk.ooo> Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com> Reviewed-by: Michał Kopeć <michal@nozomi.space> Reviewed-by: Paul Dino Jones <paul@spacefreak18.xyz> Tested-by: Paul Dino Jones <paul@spacefreak18.xyz> Tested-by: Cristóferson Bueno <cbueno81@gmail.com> Tested-by: Pablo Cisneros <patchkez@protonmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Ulrich Hecht <uli@kernel.org> |
||
|
bengris32
|
2162cb9481 |
Merge branch 'linux-4.19.y-cip' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip into lineage-22.1
* 'linux-4.19.y-cip' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip: CIP: Bump version suffix to -cip120 after merge from cip/linux-4.19.y-st tree Update localversion-st, tree is up-to-date with 5.4.292. net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on destroy jfs: add index corruption check to DT_GETPAGE() jfs: fix slab-out-of-bounds read in ea_get() tracing: Fix use-after-free in print_graph_function_flags during tracer switching mmc: sdhci-pxav3: set NEED_RSP_BUSY capability x86/tsc: Always save/restore TSC sched_clock() on suspend/resume ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk() arcnet: Add NULL check in com20020pci_probe() ipv6: fix omitted netlink attributes when using RTEXT_FILTER_SKIP_STATS vsock: avoid timeout during connect() if the socket is closing net_sched: skbprio: Remove overly strict queue assertions netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets ntb: intel: Fix using link status DB's ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans spufs: fix a leak in spufs_create_context() spufs: fix a leak on spufs_new_file() failure hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9} sched/deadline: Use online cpus for validating runtime affs: don't write overlarge OFS data block size fields affs: generate OFS sequence numbers starting at 1 wifi: iwlwifi: fw: allocate chained SG tables for dump sched/smt: Always inline sched_smt_active() ring-buffer: Fix bytes_dropped calculation issue objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds() fs/procfs: fix the comment above proc_pid_wchan() perf python: Check if there is space to copy all the event perf python: Decrement the refcount of just created event on failure perf python: Fixup description of sample.id event member ocfs2: validate l_tree_depth to avoid out-of-bounds access perf units: Fix insufficient array space iio: accel: mma8452: Ensure error return on failure to matching oversampling ratio coresight: catu: Fix number of pages while using 64k pages isofs: fix KMSAN uninit-value bug in do_isofs_readdir() x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment mfd: sm501: Switch to BIT() to mitigate integer overflows RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow power: supply: max77693: Fix wrong conversion of charge input threshold value x86/entry: Fix ORC unwinder for PUSH_REGS with save_ret=1 IB/mad: Check available slots before posting receive WRs clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent lib: 842: Improve error handling in sw842_compress() clk: amlogic: gxbb: drop incorrect flag on 32k clock fbdev: sm501fb: Add some geometry checks. mdacon: rework dependency list fbdev: au1100fb: Move a variable assignment behind a null pointer check PCI/portdrv: Only disable pciehp interrupts early when needed ALSA: hda/realtek: Always honor no_shutup_pins perf/ring_buffer: Allow the EPOLLRDNORM flag for poll lockdep: Don't disable interrupts on RT in disable_irq_nosync_lockdep.*() thermal: int340x: Add NULL check for adev EDAC/ie31200: Fix the error path order of ie31200_init() EDAC/ie31200: Fix the DIMM size mask for several SoCs x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct() cpufreq: governor: Fix negative 'idle_time' handling in dbs_update() net: usb: usbnet: restore usb%d name exception for local mac addresses net: usb: qmi_wwan: add Telit Cinterion FE990B composition net: usb: qmi_wwan: add Telit Cinterion FN990B composition tty: serial: 8250: Add some more device IDs netfilter: socket: Lookup orig tuple for IPv6 SNAT ARM: 9351/1: fault: Add "cut here" line for prefetch aborts ARM: 9350/1: fault: Implement copy_from_kernel_nofault_allowed() atm: Fix NULL pointer dereference ALSA: usb-audio: Add quirk for Plantronics headsets to fix control names drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() batman-adv: Ignore own maximum aggregation size during RX ARM: shmobile: smp: Enforce shmobile_smp_* alignment mmc: atmel-mci: Add missing clk_disable_unprepare() net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES net: atm: fix use after free in lec_send() Bluetooth: Fix error code in chan_alloc_skb_cb() RDMA/hns: Fix wrong value of max_sge_rd RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path xfrm_output: Force software GSO only in tunnel mode i2c: sis630: Fix an error handling path in sis630_probe() i2c: ali15x3: Fix an error handling path in ali15x3_probe() i2c: ali1535: Fix an error handling path in ali1535_probe() ASoC: codecs: wm0010: Fix error handling path in wm0010_spi_probe() drm/gma500: Add NULL check for pci_gfx_root in mid_get_vbt_data() qlcnic: fix memory leak issues in qlcnic_sriov_common.c drm/amd/display: Assign normalized_pix_clk when color depth = 14 x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes USB: serial: option: match on interface class for Telit FN990B USB: serial: option: fix Telit Cinterion FE990A name USB: serial: option: add Telit Cinterion FE990B compositions USB: serial: ftdi_sio: add support for Altera USB Blaster 3 block: fix 'kmem_cache of name 'bio-108' already exists' drm/nouveau: Do not override forced connector status x86/irq: Define trace events conditionally nvme: only allow entering LIVE from CONNECTING state sctp: Fix undefined behavior in left shift operation nvmet-rdma: recheck queue state is LIVE in state lock in recv done s390/cio: Fix CHPID "configure" attribute caching HID: ignore non-functional sensor in HP 5MP Camera iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() powercap: call put_device() on an error path in powercap_register_control_type() nvme-fc: go straight to connecting state when initializing net_sched: Prevent creation of classes with TC_H_ROOT ipvs: prevent integer overflow in do_ip_vs_get_ctl() netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree() Drivers: hv: vmbus: Don't release fb_mmio resource in vmbus_free_mmio() drivers/hv: Replace binary semaphore with mutex netpoll: hold rcu read lock in __netpoll_send_skb() netpoll: netpoll_send_skb() returns transmit status netpoll: move netpoll_send_skb() out of line netpoll: remove dev argument from netpoll_send_skb_on_dev() netpoll: Fix use correct return type for ndo_start_xmit() pinctrl: bcm281xx: Fix incorrect regmap max_registers value sctp: sysctl: auth_enable: avoid using current->nsproxy sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy Revert "sctp: sysctl: auth_enable: avoid using current->nsproxy" Revert "sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy" sched/isolation: Prevent boot crash when the boot CPU is nohz_full CIP: Bump version suffix to -cip119 after merge from cip/linux-4.19.y-st tree watchdog: renesas_wdt: support handover from bootloader Update localversion-st, tree is up-to-date with 5.4.291. gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl(). gtp: Destroy device along with udp socket's netns dismantle. net: gso: fix ownership in __udp_gso_segment vlan: fix memory leak in vlan_newlink() batman-adv: Drop unmanaged ELP metric worker tee: optee: Fix supplicant wait loop pps: Fix a use-after-free net: rose: lock the socket in rose_bind() btrfs: fix use-after-free when attempting to join an aborted transaction media: lmedm04: Handle errors for lme2510_int_read wifi: rtlwifi: rtl8192se: rise completion of firmware loading as last step eeprom: digsy_mtc: Make GPIO lookup table match the device slimbus: messaging: Free transaction ID in delayed interrupt scenario intel_th: pci: Add Panther Lake-P/U support intel_th: pci: Add Panther Lake-H support intel_th: pci: Add Arrow Lake support Squashfs: check the inode number is not the invalid value of zero xhci: pci: Fix indentation in the PCI device ID definitions usb: gadget: Check bmAttributes only if configuration is valid usb: gadget: Fix setting self-powered state on suspend usb: gadget: Set self-powered based on MaxPower and bmAttributes usb: typec: tcpci_rt1711h: Unmask alert interrupts to fix functionality usb: typec: ucsi: increase timeout for PPM reset operations usb: atm: cxacru: fix a flaw in existing endpoint checks usb: quirks: Add DELAY_INIT and NO_LPM for Prolific Mass Storage Card Reader usb: renesas_usbhs: Use devm_usb_get_phy() Revert "drivers/card_reader/rtsx_usb: Restore interrupt based detection" net: ipv6: fix missing dst ref drop in ila lwtunnel net: ipv6: fix dst ref loop in ila lwtunnel net-timestamp: support TCP GSO case for a few missing flags vlan: enforce underlying device type ppp: Fix KMSAN uninit-value warning with bpf be2net: fix sleeping while atomic bugs in be_ndo_bridge_getlink hwmon: fix a NULL vs IS_ERR_OR_NULL() check in xgene_hwmon_probe() llc: do not use skb_get() before dev_queue_xmit() hwmon: (ad7314) Validate leading zero bits and return error hwmon: (ntc_thermistor) Fix the ncpXXxh103 sensor table hwmon: (pmbus) Initialise page count in pmbus_identify() caif_virtio: fix wrong pointer check in cfv_probe() HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() mm/page_alloc: fix uninitialized variable rapidio: fix an API misues when rio_add_net() fails rapidio: add check for rio_add_net() in rio_scan_alloc_net() wifi: nl80211: reject cooked mode if it is set along with other flags wifi: cfg80211: regulatory: improve invalid hints checking x86/cpu: Properly parse CPUID leaf 0x2 TLB descriptor 0x63 x86/cpu: Validate CPUID leaf 0x2 EDX output x86/cacheinfo: Validate CPUID leaf 0x2 EDX output platform/x86: thinkpad_acpi: Add battery quirk for ThinkPad X131e drm/radeon: Fix rs400_gpu_init for ATI mobility radeon Xpress 200M ALSA: hda/realtek: update ALC222 depop optimize ALSA: hda: intel: Add Dell ALC3271 to power_save denylist HID: appleir: Fix potential NULL dereference at raw event handle Revert "of: reserved-memory: Fix using wrong number of cells to get property 'alignment'" drm/amdgpu: disable BAR resize on Dell G5 SE drm/amdgpu: Check extended configuration space register when system uses large bar drm/amdgpu: skip BAR resizing if the bios already did it acct: perform last write from workqueue kernel/acct.c: use dedicated helper to access rlimit values kernel/acct.c: use #elif instead of #end and #elif pfifo_tail_enqueue: Drop new packet when sch->limit == 0 sched/core: Prevent rescheduling when interrupts are disabled phy: exynos5-usbdrd: fix MPLL_MULTIPLIER and SSC_REFCLKSEL masks in refclk usbnet: gl620a: fix endpoint checking in genelink_bind() perf/core: Fix low freq setting via IOC_PERIOD ftrace: Avoid potential division by zero in function_stat_show() x86/CPU: Fix warm boot hang regression on AMD SC1100 SoC systems ipvs: Always clear ipvs_property flag in skb_scrub_packet() ASoC: es8328: fix route from DAC to output net: cadence: macb: Synchronize stats calculations sunrpc: suppress warnings for unused procfs functions batman-adv: Ignore neighbor throughput metrics in error case acct: block access to kernel internal filesystems ALSA: hda/conexant: Add quirk for HP ProBook 450 G4 mute LED nfp: bpf: Add check for nfp_app_ctrl_msg_alloc() power: supply: da9150-fg: fix potential overflow geneve: Suppress list corruption splat in geneve_destroy_tunnels(). geneve: Fix use-after-free in geneve_find_dev(). powerpc/code-patching: Fix KASAN hit by not flagging text patching area as VM_ALLOC ALSA: hda/realtek - Add type for ALC287 powerpc/64s: Rewrite __real_pte() and __rpte_to_hidx() as static inline powerpc/64s/mm: Move __real_pte stubs into hash-4k.h USB: gadget: f_midi: f_midi_complete to call queue_work usb/gadget: f_midi: Replace tasklet with work usb/gadget: f_midi: convert tasklets to use new tasklet_setup() API usb: dwc3: Fix timeout issue during controller enter/exit from halt state mm: update mark_victim tracepoints fields crypto: testmgr - some more fixes to RSA test vectors crypto: testmgr - populate RSA CRT parameters in RSA test vectors crypto: testmgr - fix version number of RSA tests crypto: testmgr - Fix wrong test case of RSA crypto: testmgr - fix wrong key length for pkcs1pad driver core: bus: Fix double free in driver API bus_register() scsi: storvsc: Set correct data length for sending SCSI command without payload vlan: move dev_put into vlan_dev_uninit vlan: introduce vlan_dev_free_egress_priority Revert "btrfs: avoid monopolizing a core when activating a swap file" parport_pc: add support for ASIX AX99100 can: ems_pci: move ASIX AX99100 ids to pci_ids.h nilfs2: protect access to buffers with no active references nilfs2: do not force clear folio if buffer is referenced nilfs2: do not output warnings when clearing dirty buffers alpha: replace hardcoded stack offsets with autogenerated ones ndisc: extend RCU protection in ndisc_send_skb() openvswitch: use RCU protection in ovs_vport_cmd_fill_info() arp: use RCU protection in arp_xmit() neighbour: use RCU protection in __neigh_notify() neighbour: delete redundant judgment statements ndisc: use RCU protection in ndisc_alloc_skb() ipv6: use RCU protection in ip6_default_advmss() ipv4: use RCU protection in inet_select_addr() ipv4: use RCU protection in rt_is_expired() net: add dev_net_rcu() helper net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() partitions: mac: fix handling of bogus partition table gpio: stmpe: Check return value of stmpe_reg_read in stmpe_gpio_irq_sync_unlock alpha: align stack for page fault and user unaligned trap handlers alpha: make stack 16-byte aligned (most cases) can: c_can: fix unbalanced runtime PM disable in error path USB: serial: option: drop MeiG Smart defines USB: serial: option: fix Telit Cinterion FN990A name USB: serial: option: add Telit Cinterion FN990B compositions USB: serial: option: add MeiG Smart SLM828 usb: cdc-acm: Fix handling of oversized fragments usb: cdc-acm: Check control transfer buffer size before access USB: cdc-acm: Fill in Renesas R-Car D3 USB Download mode quirk USB: hub: Ignore non-compliant devices with too many configs or interfaces usb: gadget: f_midi: fix MIDI Streaming descriptor lengths USB: Add USB_QUIRK_NO_LPM quirk for sony xperia xz1 smartphone USB: quirks: add USB_QUIRK_NO_LPM quirk for Teclast dist USB: pci-quirks: Fix HCCPARAMS register error for LS7A EHCI usb: dwc2: gadget: remove of_node reference upon udc_stop usb: gadget: udc: renesas_usb3: Fix compiler warning usb: roles: set switch registered flag early on batman-adv: fix panic during interface removal ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet 5V orangefs: fix a oob in orangefs_debug_write Grab mm lock before grabbing pt lock vfio/pci: Enable iowrite64 and ioread64 for vfio pci media: cxd2841er: fix 64-bit division on gcc-9 xen: remove a confusing comment on auto-translated guest I/O gpio: bcm-kona: Add missing newline to dev_err format string gpio: bcm-kona: Fix GPIO lock/unlock for banks above bank 0 arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array team: better TEAM_OPTION_TYPE_STRING validation vrf: use RCU protection in l3mdev_l3_out() ndisc: ndisc_send_redirect() must use dev_get_by_index_rcu() HID: multitouch: Add NULL check in mt_input_configured ocfs2: check dir i_size in ocfs2_find_entry MIPS: ftrace: Declare ftrace_get_parent_ra_addr() as static ptp: Ensure info->enable callback is always set mtd: onenand: Fix uninitialized retlen in do_otp_read() NFC: nci: Add bounds checking in nci_hci_create_pipe() nilfs2: fix possible int overflows in nilfs_fiemap() ocfs2: handle a symlink read error correctly ocfs2: fix incorrect CPU endianness conversion causing mount failure nvmem: core: improve range check for nvmem_cell_write() crypto: qce - fix goto jump in error path media: uvcvideo: Remove redundant NULL assignment media: uvcvideo: Fix event flags in uvc_ctrl_send_events media: ov5640: fix get_light_freq on auto soc: qcom: smem_state: fix missing of_node_put in error path powerpc/pseries/eeh: Fix get PE state translation serial: sh-sci: Do not probe the serial port if its slot in sci_ports[] is in use serial: sh-sci: Drop __initdata macro for port_cfg usb: gadget: f_tcm: Don't prepare BOT write request twice usb: gadget: f_tcm: ep_autoconfig with fullspeed endpoint usb: gadget: f_tcm: Decrement command ref count on cleanup usb: gadget: f_tcm: Translate error to sense wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize() HID: hid-sensor-hub: don't use stale platform-data on remove of: reserved-memory: Fix using wrong number of cells to get property 'alignment' of: Fix of_find_node_opts_by_path() handling of alias+path+options of: Correct child specifier used as input of the 2nd nexus node clk: qcom: clk-alpha-pll: fix alpha mode configuration Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc KVM: s390: vsie: fix some corner-cases when grabbing vsie pages KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() arm64: dts: rockchip: increase gmac rx_delay on rk3399-puma binfmt_flat: Fix integer overflow bug on 32 bit systems m68k: vga: Fix I/O defines s390/futex: Fix FUTEX_OP_ANDN implementation leds: lp8860: Write full EEPROM, not only half of it cpufreq: s3c64xx: Fix compilation warning tun: revert fix group permission check netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() udp: gso: do not drop small packets when PMTU reduces tg3: Disable tg3 PCIe AER on system reboot firmware: iscsi_ibft: fix ISCSI_IBFT Kconfig entry nvme: handle connectivity loss in nvme_set_queue_count usb: xhci: Fix NULL pointer dereference on certain command aborts usb: xhci: Add timeout argument in address_device USB HCD callback media: uvcvideo: Remove dangling pointers media: uvcvideo: Only save async fh if success nilfs2: handle errors that nilfs_prepare_chunk() may return nilfs2: eliminate staggered calls to kunmap in nilfs_rename nilfs2: move page release outside of nilfs_delete_entry and nilfs_set_link x86/mm: Don't disable PCID when INVLPG has been fixed by microcode HID: Wacom: Add PCI Wacom device support mfd: lpc_ich: Add another Gemini Lake ISA bridge PCI device-id wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() mmc: core: Respect quirk_max_rate for non-UHS SDIO card tun: fix group permission check printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX sched: Don't try to catch up excess steal time. btrfs: convert BUG_ON in btrfs_reloc_cow_block() to proper error handling btrfs: output the reason for open_ctree() failure usb: gadget: f_tcm: Don't free command immediately media: uvcvideo: Fix double free in error path usb: typec: tcpm: set SRC_SEND_CAPABILITIES timeout to PD_T_SENDER_RESPONSE drivers/card_reader/rtsx_usb: Restore interrupt based detection ktest.pl: Check kernelrelease return in get_version NFSD: Reset cb_seq_status after NFS4ERR_DELAY hexagon: Fix unbalanced spinlock in die() hexagon: fix using plain integer as NULL pointer warning in cmpxchg genksyms: fix memory leak when the same symbol is read from *.symref file genksyms: fix memory leak when the same symbol is added from source net: sh_eth: Fix missing rtnl lock in suspend/resume path vsock: Allow retrying on connect() failure net: davicom: fix UAF in dm9000_drv_remove net: rose: fix timer races against user threads PM: hibernate: Add error handling for syscore_suspend() net: fec: implement TSO descriptor cleanup ubifs: skip dumping tnc tree when zroot is null dmaengine: ti: edma: fix OF node reference leaks in edma_driver module: Extend the preempt disabled section in dereference_symbol_descriptor(). ocfs2: mark dquot as inactive if failed to start trans while releasing dquot scsi: mpt3sas: Set ioc->manu_pg11.EEDPTagMode directly to 1 media: camif-core: Add check for clk_enable() media: mipi-csis: Add check for clk_enable() PCI: endpoint: Destroy the EPC device in devm_pci_epc_destroy() media: rc: iguanair: handle timeouts fbdev: omapfb: Fix an OF node leak in dss_of_port_get_parent_device() ARM: dts: mediatek: mt7623: fix IR nodename arm64: dts: mediatek: mt8173-evb: Fix MT6397 PMIC sub-node names arm64: dts: mediatek: mt8173-evb: Drop regulator-compatible property rdma/cxgb4: Prevent potential integer overflow on 32bit RDMA/mlx4: Avoid false error about access to uninitialized gids array perf report: Fix misleading help message about --demangle perf top: Don't complain about lack of vmlinux when not resolving some kernel samples padata: fix sysfs store callback check ktest.pl: Remove unused declarations in run_bisect_test function net: sched: Disallow replacing of child qdisc from one parent to another net/mlxfw: Drop hard coded max FW flash image size selftests: harness: fix printing of mismatch values in __EXPECT() selftests/harness: Display signed values correctly wifi: wlcore: fix unbalanced pm_runtime calls regulator: of: Implement the unwind path of of_regulator_match() team: prevent adding a device which is already a team device lower cpupower: fix TSC MHz calculation wifi: rtlwifi: pci: wait for firmware loading before releasing memory wifi: rtlwifi: fix memory leaks and invalid access at probe error path wifi: rtlwifi: remove unused dualmac control leftovers rtlwifi: replace usage of found with dedicated list iterator variable wifi: rtlwifi: usb: fix workqueue leak when probe fails wifi: rtlwifi: do not complete firmware loading needlessly drm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_range_table drm/etnaviv: Fix page property being used for non writecombine buffers afs: Fix directory format encoding struct overflow: Allow mixed type arguments overflow: Correct check_shl_overflow() comment overflow: Add __must_check attribute to check_*() helpers udf: Fix use of check_add_overflow() with mixed type arguments Change-Id: Ia7c26633509cfe8ec59d7dd0d6efd602629c87f4 Signed-off-by: bengris32 <bengris32@protonmail.ch> |
||
|
Chia-Lin Kao (AceLan)
|
d3304f0215 |
HID: ignore non-functional sensor in HP 5MP Camera
[ Upstream commit 363236d709e75610b628c2a4337ccbe42e454b6d ] The HP 5MP Camera (USB ID 0408:5473) reports a HID sensor interface that is not actually implemented. Attempting to access this non-functional sensor via iio_info causes system hangs as runtime PM tries to wake up an unresponsive sensor. [453] hid-sensor-hub 0003:0408:5473.0003: Report latency attributes: ffffffff:ffffffff [453] hid-sensor-hub 0003:0408:5473.0003: common attributes: 5:1, 2:1, 3:1 ffffffff:ffffffff Add this device to the HID ignore list since the sensor interface is non-functional by design and should not be exposed to userspace. Signed-off-by: Chia-Lin Kao (AceLan) <acelan.kao@canonical.com> Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Signed-off-by: Jiri Kosina <jkosina@suse.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Ulrich Hecht <uli@kernel.org> |
||
|
Zhang Lixu
|
5997ff4281 |
HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove()
[ Upstream commit 07583a0010696a17fb0942e0b499a62785c5fc9f ]
The system can experience a random crash a few minutes after the driver is
removed. This issue occurs due to improper handling of memory freeing in
the ishtp_hid_remove() function.
The function currently frees the `driver_data` directly within the loop
that destroys the HID devices, which can lead to accessing freed memory.
Specifically, `hid_destroy_device()` uses `driver_data` when it calls
`hid_ishtp_set_feature()` to power off the sensor, so freeing
`driver_data` beforehand can result in accessing invalid memory.
This patch resolves the issue by storing the `driver_data` in a temporary
variable before calling `hid_destroy_device()`, and then freeing the
`driver_data` after the device is destroyed.
Fixes:
|
||
|
Daniil Dulov
|
022d17124d |
HID: appleir: Fix potential NULL dereference at raw event handle
commit 2ff5baa9b5275e3acafdf7f2089f74cccb2f38d1 upstream.
Syzkaller reports a NULL pointer dereference issue in input_event().
BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:68 [inline]
BUG: KASAN: null-ptr-deref in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
BUG: KASAN: null-ptr-deref in is_event_supported drivers/input/input.c:67 [inline]
BUG: KASAN: null-ptr-deref in input_event+0x42/0xa0 drivers/input/input.c:395
Read of size 8 at addr 0000000000000028 by task syz-executor199/2949
CPU: 0 UID: 0 PID: 2949 Comm: syz-executor199 Not tainted 6.13.0-rc4-syzkaller-00076-gf097a36ef88d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
kasan_report+0xd9/0x110 mm/kasan/report.c:602
check_region_inline mm/kasan/generic.c:183 [inline]
kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189
instrument_atomic_read include/linux/instrumented.h:68 [inline]
_test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
is_event_supported drivers/input/input.c:67 [inline]
input_event+0x42/0xa0 drivers/input/input.c:395
input_report_key include/linux/input.h:439 [inline]
key_down drivers/hid/hid-appleir.c:159 [inline]
appleir_raw_event+0x3e5/0x5e0 drivers/hid/hid-appleir.c:232
__hid_input_report.constprop.0+0x312/0x440 drivers/hid/hid-core.c:2111
hid_ctrl+0x49f/0x550 drivers/hid/usbhid/hid-core.c:484
__usb_hcd_giveback_urb+0x389/0x6e0 drivers/usb/core/hcd.c:1650
usb_hcd_giveback_urb+0x396/0x450 drivers/usb/core/hcd.c:1734
dummy_timer+0x17f7/0x3960 drivers/usb/gadget/udc/dummy_hcd.c:1993
__run_hrtimer kernel/time/hrtimer.c:1739 [inline]
__hrtimer_run_queues+0x20a/0xae0 kernel/time/hrtimer.c:1803
hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1820
handle_softirqs+0x206/0x8d0 kernel/softirq.c:561
__do_softirq kernel/softirq.c:595 [inline]
invoke_softirq kernel/softirq.c:435 [inline]
__irq_exit_rcu+0xfa/0x160 kernel/softirq.c:662
irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0x90/0xb0 arch/x86/kernel/apic/apic.c:1049
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
__mod_timer+0x8f6/0xdc0 kernel/time/timer.c:1185
add_timer+0x62/0x90 kernel/time/timer.c:1295
schedule_timeout+0x11f/0x280 kernel/time/sleep_timeout.c:98
usbhid_wait_io+0x1c7/0x380 drivers/hid/usbhid/hid-core.c:645
usbhid_init_reports+0x19f/0x390 drivers/hid/usbhid/hid-core.c:784
hiddev_ioctl+0x1133/0x15b0 drivers/hid/usbhid/hiddev.c:794
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl fs/ioctl.c:892 [inline]
__x64_sys_ioctl+0x190/0x200 fs/ioctl.c:892
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
This happens due to the malformed report items sent by the emulated device
which results in a report, that has no fields, being added to the report list.
Due to this appleir_input_configured() is never called, hidinput_connect()
fails which results in the HID_CLAIMED_INPUT flag is not being set. However,
it does not make appleir_probe() fail and lets the event callback to be
called without the associated input device.
Thus, add a check for the HID_CLAIMED_INPUT flag and leave the event hook
early if the driver didn't claim any input_dev for some reason. Moreover,
some other hid drivers accessing input_dev in their event callbacks do have
similar checks, too.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Fixes:
|
||
|
Charles Han
|
19a435fc3c |
HID: multitouch: Add NULL check in mt_input_configured
[ Upstream commit 9b8e2220d3a052a690b1d1b23019673e612494c5 ]
devm_kasprintf() can return a NULL pointer on failure,but this
returned value in mt_input_configured() is not checked.
Add NULL check in mt_input_configured(), to handle kernel NULL
pointer dereference error.
Fixes: 479439463529 ("HID: multitouch: Correct devm device reference for hidinput input_dev name")
Signed-off-by: Charles Han <hanchunchao@inspur.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>
|
||
|
Heiko Stuebner
|
e7bcaf27eb |
HID: hid-sensor-hub: don't use stale platform-data on remove
commit 8a5b38c3fd709e8acd2bfdedf66c25e6af759576 upstream. The hid-sensor-hub creates the individual device structs and transfers them to the created mfd platform-devices via the platform_data in the mfd_cell. Before |
||
|
Even Xu
|
4b66ef790d |
HID: Wacom: Add PCI Wacom device support
[ Upstream commit c4c123504a65583e3689b3de04a61dc5272e453a ] Add PCI device ID of wacom device into driver support list. Signed-off-by: Even Xu <even.xu@intel.com> Tested-by: Tatsunosuke Tobita <tatsunosuke.tobita@wacom.com> Reviewed-by: Ping Cheng <ping.cheng@wacom.com> Signed-off-by: Jiri Kosina <jkosina@suse.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Ulrich Hecht <uli@kernel.org> |
||
|
bengris32
|
4289aa84bd |
Merge tag 'v4.19.325-cip118' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip into staging/lineage-22.1
version 4.19.325-cip118 * tag 'v4.19.325-cip118' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip: CIP: Bump version suffix to -cip118 after merge from cip/linux-4.19.y-st tree Update localversion-st, tree is up-to-date with 5.4.290. gtp: Use for_each_netdev_rcu() in gtp_genl_dump_pdp(). arm64: dts: rockchip: add hevc power domain clock to rk3328 Partial revert of xhci: use pm_ptr() instead #ifdef for CONFIG_PM conditionals xhci: use pm_ptr() instead of #ifdef for CONFIG_PM conditionals Input: xpad - add support for wooting two he (arm) Input: xpad - add unofficial Xbox 360 wireless receiver clone Input: atkbd - map F23 key to support default copilot shortcut Revert "usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null" USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb() vfio/platform: check the bounds of read/write syscalls net/xen-netback: prevent UAF in xenvif_flush_hash() m68k: Add missing mmap_read_lock() to sys_cacheflush() m68k: Update ->thread.esp0 before calling syscall_trace() in ret_from_signal gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag irqchip/sunxi-nmi: Add missing SKIP_WAKE flag scsi: iscsi: Fix redundant response for ISCSI_UEVENT_GET_HOST_STATS request ASoC: wm8994: Add depends on MFD core net: fix data-races around sk->sk_forward_alloc scsi: sg: Fix slab-use-after-free read in sg_release() ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev() irqchip/gic-v3: Handle CPU_PM_ENTER_FAILED correctly fs/proc: fix softlockup in __read_vmcore (part 2) poll_wait: add mb() to fix theoretical race between waitqueue_active() and .poll() hfs: Sanity check the root record mac802154: check local interfaces before deleting sdata list i2c: mux: demux-pinctrl: check initial mux selection, too nfp: bpf: prevent integer overflow in nfp_bpf_event_output() gtp: use exit_batch_rtnl() method net: add exit_batch_rtnl() method net: net_namespace: Optimize the code net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field() sctp: sysctl: rto_min/max: avoid using current->nsproxy ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv ocfs2: correct return value of ocfs2_local_free_info() phy: core: Fix that API devm_of_phy_provider_unregister() fails to unregister the phy provider phy: core: fix code style in devm_of_phy_provider_unregister arm64: dts: rockchip: fix pd_tcpc0 and pd_tcpc1 node position on rk3399 arm64: dts: rockchip: fix defines in pd_vio node for rk3399 iio: inkern: call iio_device_put() only on mapped devices iio: adc: at91: call input_free_device() on allocated iio_dev iio: adc: ti-ads8688: fix information leak in triggered buffer iio: imu: kmx61: fix information leak in triggered buffer iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer iio: pressure: zpa2326: fix information leak in triggered buffer usb: gadget: f_fs: Remove WARN_ON in functionfs_bind usb: fix reference leak in usb_new_device() USB: usblp: return error when setting unsupported protocol usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null USB: serial: cp210x: add Phoenix Contact UPS Device usb-storage: Add max sectors quirk for Nokia 208 staging: iio: ad9832: Correct phase range check staging: iio: ad9834: Correct phase range check USB: serial: option: add Neoway N723-EA support USB: serial: option: add MeiG Smart SRM815 drm/amd/display: Add check for granularity in dml ceil/floor helpers sctp: sysctl: auth_enable: avoid using current->nsproxy sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy dm thin: make get_first_thin use rcu-safe list first function tcp/dccp: allow a connection when sk_max_ack_backlog is zero tcp/dccp: complete lockless accesses to sk->sk_max_ack_backlog net: 802: LLC+SNAP OID:PID lookup on start of skb data ieee802154: ca8210: Add missing check for kfifo_alloc() in ca8210_probe() dm array: fix cursor index when skipping across block boundaries dm array: fix unreleased btree blocks on closing a faulty array cursor dm array: fix releasing a faulty array block twice in dm_array_cursor_end jbd2: flush filesystem device before updating tail sequence ravb: Fix use-after-free issue in ravb_tx_timeout_work() net/sched: netem: fix backport of "account for backlog updates from child qdisc" CIP: Bump version suffix to -cip117 after merge from cip/linux-4.19.y-st tree Update localversion-st, tree is up-to-date with 5.4.289. RDMA/bnxt_re: Fix max_qp_wrs reported net/sched: netem: account for backlog updates from child qdisc net/sched: cbs: Fix integer overflow in cbs_set_port_rate() netfilter: nft_set_hash: skip duplicated elements pending gc run drm/etnaviv: flush shader L1 cache after user commandstream usb: yurex: make waiting on yurex_write interruptible perf trace: Avoid garbage when not printing a syscall's arguments scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb() mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() drm: adv7511: Drop dsi single lane support net/sctp: Prevent autoclose integer overflow in sctp_association_init() sky2: Add device ID 11ab:4373 for Marvell 88E8075 pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking modpost: fix the missed iteration for the max bit in do_input() modpost: fix input MODULE_DEVICE_TABLE() built for 64-bit on 32-bit host irqchip/gic: Correct declaration of *percpu_base pointer in union gic_base net: usb: qmi_wwan: add Telit FE910C04 compositions sound: usb: format: don't warn that raw DSD is unsupported wifi: mac80211: wake the queues in case of failure in resume ila: serialize calls to nf_register_net_hooks() af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK af_packet: fix vlan_get_tci() vs MSG_PEEK ALSA: usb-audio: US16x08: Initialize array before use net: llc: reset skb->transport_header netrom: check buffer length before accessing it drm/bridge: adv7511_audio: Update Audio InfoFrame properly drm: bridge: adv7511: Enable SPDIF DAI RDMA/bnxt_re: Fix reporting hw_ver in query_device RDMA/bnxt_re: Add check for path mtu in modify_qp Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet selinux: ignore unknown extended permissions btrfs: avoid monopolizing a core when activating a swap file tracing: Constify string literal data member in struct trace_event_call MIPS: Probe toolchain support of -msym32 virtio-blk: don't keep queue frozen during system suspend platform/x86: asus-nb-wmi: Ignore unknown event 0xCF regmap: Use correct format specifier for logging range errors scsi: qla1280: Fix hw revision numbering for ISP1020/1040 tracing/kprobe: Make trace_kprobe's module callback called after jump_label update mtd: rawnand: fix double free in atmel_pmecc_create_user() dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset dmaengine: mv_xor: fix child node refcount handling in early exit phy: core: Fix that API devm_phy_destroy() fails to destroy the phy phy: core: Fix that API devm_phy_put() fails to release the phy phy: core: Fix an OF node refcount leakage in of_phy_provider_lookup() phy: core: Fix an OF node refcount leakage in _of_phy_get() mtd: diskonchip: Cast an operand to prevent potential overflow nfsd: restore callback functionality for NFSv4.0 bpf: Check negative offsets in __bpf_skb_min_len() media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg of: Fix error path in of_parse_phandle_with_args_map() nilfs2: prevent use of deleted inode of/irq: Fix using uninitialized variable @addr_len in API of_irq_parse_one() NFS/pnfs: Fix a live lock between recalled layouts and layoutget zram: refuse to use zero sized block device as backing device sh: clk: Fix clk_enable() to return 0 on NULL clk USB: serial: option: add Telit FE910C04 rmnet compositions USB: serial: option: add MediaTek T7XX compositions USB: serial: option: add Netprisma LCUK54 modules for WWAN Ready USB: serial: option: add MeiG Smart SLM770A USB: serial: option: add TCL IK512 MBIM & ECM efivarfs: Fix error on non-existent file i2c: riic: Always round-up when calculating bus period chelsio/chtls: prevent potential integer overflow on 32bit mmc: sdhci-tegra: Remove SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC quirk netfilter: ipset: Fix for recursive locking warning net: ethernet: bgmac-platform: fix an OF node reference leak net: hinic: Fix cleanup in create_rxqs/txqs() net/smc: check sndbuf_space again after NOSPACE flag is set in smc_poll i2c: pnx: Fix timeout in wait functions PCI: Add ACS quirk for Broadcom BCM5760X NIC ALSA: usb: Fix UBSAN warning in parse_audio_unit() PCI/AER: Disable AER service on suspend net: sched: fix ordering of qlen adjustment ALSA: usb-audio: Fix a DMA to stack memory bug xen/netfront: fix crash when removing device KVM: arm64: Ignore PMCNTENSET_EL0 while checking for overflow status qca_spi: Make driver probing reliable ACPI: resource: Fix memory resource type union access net: lapb: increase LAPB_HEADER_LEN batman-adv: Do not let TT changes list grows indefinitely batman-adv: Remove uninitialized data in full table TT response batman-adv: Do not send uninitialized TT changes usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer usb: ehci-hcd: fix call balance of clocks handling routines usb: dwc2: hcd: Fix GetPortStatus & SetPortFeature ata: sata_highbank: fix OF node reference leak in highbank_initialize_phys() usb: host: max3421-hcd: Correctly abort a USB request. bpf, xdp: Update devmap comments to reflect napi/rcu usage ALSA: usb-audio: Fix out of bounds reads when finding clock sources PCI: rockchip-ep: Fix address translation unit programming Revert "drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()" modpost: Add .irqentry.text to OTHER_SECTIONS ocfs2: Revert "ocfs2: fix the la space leak when unmounting an ocfs2 volume" jffs2: Fix rtime decompressor jffs2: Prevent rtime decompress memory corruption KVM: arm64: vgic-its: Clear ITE when DISCARD frees an ITE KVM: arm64: vgic-its: Clear DTE when MAPD unmaps a device KVM: arm64: vgic-its: Add a data length check in vgic_its_save_* misc: eeprom: eeprom_93cx6: Add quirk for extra read clock cycle powerpc/prom_init: Fixup missing powermac #size-cells usb: chipidea: udc: handle USB Error Interrupt if IOC not set PCI: Add 'reset_subordinate' to reset hierarchy below bridge nvdimm: rectify the illogical code within nd_dax_probe() scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset scsi: st: Don't modify unknown block number in MTIOCGET leds: class: Protect brightness_show() with led_cdev->led_access mutex tracing: Use atomic64_inc_return() in trace_clock_counter() netpoll: Use rcu_access_pointer() in __netpoll_setup rocker: fix link status detection in rocker_carrier_init() ASoC: hdmi-codec: reorder channel allocation list wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw() wifi: ipw2x00: libipw_rx_any(): fix bad alignment jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree jfs: fix array-index-out-of-bounds in jfs_readdir jfs: fix shift-out-of-bounds in dbSplit jfs: array-index-out-of-bounds fix in dtReadFirst wifi: ath5k: add PCI ID for Arcadyan devices wifi: ath5k: add PCI ID for SX76X net: inet6: do not leave a dangling sk pointer in inet6_create() net: inet: do not leave a dangling sk pointer in inet_create() net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() net: af_can: do not leave a dangling sk pointer in can_create() Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() af_packet: avoid erroring out after sock_init_data() in packet_create() net: ethernet: fs_enet: Use %pa to format resource_size_t net: fec_mpc52xx_phy: Use %pa to format resource_size_t samples/bpf: Fix a resource leak drm/radeon/r600_cs: Fix possible int overflow in r600_packet3_check() media: cx231xx: Add support for Dexatek USB Video Grabber 1d19:6108 media: uvcvideo: Add a quirk for the Kaiweets KTI-W02 infrared camera s390/cpum_sf: Handle CPU hotplug remove during sampling regmap: detach regmap from dev on regmap_exit bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry() scsi: qla2xxx: Remove check req_sg_cnt should be equal to rsp_sg_cnt scsi: qla2xxx: Supported speed displayed incorrectly for VPorts ocfs2: update seq_file index in ocfs2_dlm_seq_next tracing: Fix cmp_entries_dup() to respect sort() comparison rules HID: wacom: fix when get product name maybe null pointer bpf: Fix exact match conditions in trie_get_next_key() bpf: Handle BPF_EXIST and BPF_NOEXIST for LPM trie ocfs2: free inode when ocfs2_get_init_inode() fails spi: mpc52xx: Add cancel_work_sync before module remove drm/sti: Add __iomem for mixer_dbg_mxn's parameter gpio: grgpio: Add NULL check in grgpio_probe gpio: grgpio: use a helper variable to store the address of ofdev->dev crypto: x86/aegis128 - access 32-bit arguments as 32-bit x86/asm: Reorder early variables xen: Fix the issue of resource not being properly released in xenbus_dev_probe() xen/xenbus: fix locking xenbus/backend: Protect xenbus callback with lock xenbus/backend: Add memory pressure handler callback xen/xenbus: reference count registered modules netfilter: ipset: Hold module reference while requesting a module igb: Fix potential invalid memory access in igb_init_module() net/qed: allow old cards not supporting "num_images" to work dccp: Fix memory leak in dccp_feat_change_recv net/ipv6: release expired exception dst cached in socket netfilter: x_tables: fix LED ID check in led_tg_check() ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() can: sun4i_can: sun4i_can_err(): fix {rx,tx}_errors statistics can: sun4i_can: sun4i_can_err(): call can_change_state() even if cf is NULL watchdog: mediatek: Make sure system reset gets asserted in mtk_wdt_restart() nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur dm thin: Add missing destroy_work_on_stack() util_macros.h: fix/rework find_closest() macros ftrace: Fix regression with module command in stack_trace_filter ovl: Filter invalid inodes with missing lookup function media: gspca: ov534-ov772x: Fix off-by-one error in set_frame_rate() media: venus: Fix pm_runtime_set_suspended() with runtime pm enabled media: ts2020: fix null-ptr-deref in ts2020_probe() media: i2c: tc358743: Fix crash in the probe error path when using polling btrfs: ref-verify: fix use-after-free after invalid ref action quota: flush quota_release_work upon quota writeback SUNRPC: correct error code comment in xs_tcp_setup_socket() um/sysrq: remove needless variable sp ALSA: hda/realtek: Set PCBeep to default value for ALC274 Revert "serial: sh-sci: Clean sci_ports[0] after at earlycon exit" serial: sh-sci: Clean sci_ports[0] after at earlycon exit ipmr: convert /proc handlers to rcu_read_lock() mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device mfd: intel_soc_pmic_bxtwc: Use dev_err_probe() x86/xen/pvh: Annotate indirect branch as safe CIP: Bump version suffix to -cip116 after merge from stable Mark this as 4.19.324-cip115 release. CIP: Bump version suffix to -cip114 after merge from stable Mark this as 4.19.322-cip113 release. CIP: Bump version suffix to -cip112 after merge from stable CIP: Bump version suffix to -cip111 after merge from stable CIP: Bump version suffix to -cip110 after merge from stable CIP: Bump version suffix to -cip109 after merge from stable CIP: Bump version suffix to -cip108 after merge from stable memory: renesas-rpc-if: Clear HS bit during hardware initialization arm64: dts: renesas: rzg2: Add RPC-IF Support spi: spi-rpc-if: Check return value of rpcif_sw_init() memory: renesas-rpc-if: Remove redundant division of dummy memory: renesas-rpc-if: Simplify single/double data register access memory: renesas-rpc-if: Drop usage of RPCIF_DIRMAP_SIZE macro memory: renesas-rpc-if: Return error in case devm_ioremap_resource() fails memory: renesas-rpc-if: Fix HF/OSPI data transfer in Manual Mode memory: renesas-rpc-if: Correct QSPI data transfer in Manual mode memory: renesas-rpc-if: fix possible NULL pointer dereference of resource CIP: Bump version suffix to -cip107 after merge from stable ravb: remove undocumented counter processing ravb: remove undocumented endianness selection ravb: update "undocumented" annotations CIP: Bump version suffix to -cip106 after merge from stable Mark this as 4.19.299-cip105 release. CIP: Bump version suffix to -cip104 after merge from stable CIP: Bump version suffix to -cip103 after merge from stable CIP: Bump version suffix to -cip102 after merge from stable CIP: Bump version suffix to -cip101 after merge from stable CIP: Bump version suffix to -cip100 after merge from stable CIP: Bump version suffix to -cip99 after merge from stable CIP: Bump version suffix to -cip98 after merge from stable CIP: Bump version suffix to -cip97 after merge from stable CIP: Bump version suffix to -cip96 after merge from stable CIP: Bump version suffix to -cip95 after merge from stable CIP: Bump version suffix to -cip94 after merge from stable CIP: Bump version suffix to -cip93 after merge from stable CIP: Bump version suffix to -cip92 after merge from stable CIP: Bump version suffix to -cip91 after merge from stable CIP: Bump version suffix to -cip90 after merge from stable CIP: Bump version suffix to -cip89 after merge from stable CIP: Bump version suffix to -cip88 after merge from stable CIP: Bump version suffix to -cip87 after merge from stable CIP: Bump version suffix to -cip86 after merge from stable CIP: Bump version suffix to -cip85 after merge from stable CIP: Bump version suffix to -cip84 after merge from stable CIP: Bump version suffix to -cip83 after merge from stable CIP: Bump version suffix to -cip82 after merge from stable CIP: Bump version suffix to -cip81 after merge from stable drm: rcar-du: Fix Alpha blending issue on Gen3 CIP: Bump version suffix to -cip80 after merge from stable CIP: Bump version suffix to -cip79 after merge from stable CIP: Bump version suffix to -cip78 after merge from stable CIP: Bump version suffix to -cip77 after merge from stable CIP: Bump version suffix to -cip76 after merge from stable CIP: Bump version suffix to -cip75 after merge from stable CIP: Bump version suffix to -cip74 after merge from stable CIP: Bump version suffix to -cip73 after merge from stable CIP: Bump version suffix to -cip72 after merge from stable CIP: Bump version suffix to -cip71 after merge from stable CIP: Bump version suffix to -cip70 after merge from stable CIP: Bump version suffix to -cip69 after merge from stable CIP: Bump version suffix to -cip68 after merge from stable CIP: Bump version suffix to -cip67 after merge from stable CIP: Bump version suffix to -cip66 after merge from stable CIP: Bump version suffix to -cip65 after merge from stable CIP: Bump version suffix to -cip64 after merge from stable CIP: Bump version suffix to -cip63 after merge from stable CIP: Bump version suffix to -cip62 after merge from stable CIP: Bump version suffix to -cip61 after merge from stable CIP: Bump version suffix to -cip60 after merge from stable CIP: Bump version suffix to -cip59 after merge from stable CIP: Bump version suffix to -cip58 after merge from stable CIP: Bump version suffix to -cip57 after merge from stable CIP: Bump version suffix to -cip56 after merge from stable CIP: Bump version suffix to -cip55 after merge from stable CIP: Bump version suffix to -cip54 after merge from stable CIP: Bump version suffix to -cip53 after merge from stable CIP: Bump version suffix to -cip52 after merge from stable CIP: Bump version suffix to -cip51 after merge from stable CIP: Bump version suffix to -cip50 after merge from stable CIP: Bump version suffix to -cip49 after merge from stable media: i2c: imx219: Balance runtime PM use-count media: i2c: imx219: Move out locking/unlocking of vflip and hflip controls from imx219_set_stream CIP: Bump version suffix to -cip48 after merge from stable drm: rcar-du: Fix crash when using LVDS1 clock for CRTC CIP: Bump version suffix to -cip47 after merge from stable CIP: Bump version suffix to -cip46 after merge from stable arm64: dts: renesas: Add support for MIPI Adapter V2.1 connected to HiHope RZ/G2N arm64: dts: renesas: Add support for MIPI Adapter V2.1 connected to HiHope RZ/G2M arm64: dts: renesas: Add support for MIPI Adapter V2.1 connected to HiHope RZ/G2H arm64: dts: renesas: aistarvision-mipi-adapter-2.1: Add parent macro for each sensor arm64: dts: renesas: r8a774e1: Add VIN and CSI-2 nodes media: rcar-csi2: Enable support for R8A774E1 media: dt-bindings: media: renesas,csi2: Add R8A774E1 support media: rcar-vin: Enable support for R8A774E1 media: dt-bindings: media: renesas,vin: Add R8A774E1 support arm64: dts: renesas: r8a774b1: Add VIN and CSI-2 support media: rcar-csi2: Enable support for R8A774B1 media: dt-bindings: rcar-csi2: Add R8A774B1 support media: rcar-vin: Enable support for R8A774B1 media: dt-bindings: rcar-vin: Add R8A774B1 support arm64: dts: renesas: r8a774a1: Add VIN and CSI-2 nodes media: rcar-csi2: Enable support for r8a774a1 media: dt-bindings: media: rcar-csi2: Add r8a774a1 support media: rcar-vin: Enable support for r8a774a1 media: dt-bindings: media: rcar_vin: Add r8a774a1 support arm64: dts: renesas: r8a774c0-cat874: Add support for AISTARVISION MIPI Adapter V2.1 media: i2c: imx219: take lock in imx219_enum_mbus_code/frame_size media: i2c: imx219: Selection compliance fixes media: i2c: imx219: Fix a bug in imx219_enum_frame_size media: i2c: imx219: Implement get_selection media: i2c: imx219: Add support for cropped 640x480 resolution media: i2c: imx219: Add support for RAW8 bit bayer format media: i2c: imx219: Fix power sequence media: i2c: Add driver for Sony IMX219 sensor media: dt-bindings: media: i2c: Add IMX219 CMOS sensor binding media: rcar-csi2: Add support for MEDIA_BUS_FMT_SRGGB8_1X8 format media: rcar-vin: Add support for MEDIA_BUS_FMT_SRGGB8_1X8 format media: rcar-vin: Invalidate pipeline if conversion is not possible on input formats media: rcar-csi2: Update V3M and E3 start procedure media: rcar-vin: fix wrong return value in rvin_set_channel_routing() media: v4l: ctrl: Provide unlocked variant of v4l2_ctrl_grab media: v4l2-async: Log message in case of heterogeneous fwnode match media: v4l2-async: Pass notifier pointer to match functions media: v4l2-async: Accept endpoints and devices for fwnode matching media: device property: Add a function to test is a fwnode is a graph endpoint media: ov5645: Remove unneeded regulator_set_voltage() CIP: Bump version suffix to -cip45 after merge from stable CIP: Bump version suffix to -cip44 after merge from stable CIP: Bump version suffix to -cip43 after merge from stable CIP: Bump version suffix to -cip42 after merge from stable CIP: Bump version suffix to -cip41 after merge from stable spi: spi-mem: Make spi_mem_default_supports_op() static inline pinctrl: renesas: r8a77965: Add QSPI[01] pins, groups and functions pinctrl: renesas: r8a7796: Add QSPI[01] pins, groups and functions pinctrl: renesas: r8a77951: Add QSPI[01] pins, groups and functions pinctrl: renesas: r8a77990: Add QSPI[01] pins, groups and functions pinctrl: renesas: r8a77990: Optimize pinctrl image size for R8A774C0 pinctrl: renesas: r8a77965: Optimize pinctrl image size for R8A774B1 pinctrl: renesas: r8a77951: Optimize pinctrl image size for R8A774E1 pinctrl: renesas: r8a7796: Optimize pinctrl image size for R8A774A1 clk: renesas: r8a774c0: Add RPC clocks clk: renesas: r8a774b1: Add RPC clocks clk: renesas: r8a774a1: Add RPC clocks spi: rpc-if: Fix use-after-free on unbind spi: add Renesas RPC-IF driver spi: spi-mem: Fix a memory leak in spi_mem_dirmap_destroy() spi: spi-mem: Fix spi_mem_dirmap_destroy() kerneldoc spi: spi-mem: Add a new API to support direct mapping spi: spi-mem: Compute length only when needed spi: spi-mem: Fix passing zero to 'PTR_ERR' warning spi: spi-mem: fix reference leak in spi_mem_access_start spi: spi-mem: Split spi_mem_exec_op() code spi: spi-mem: export spi_mem_default_supports_op() spi: spi-mem: Add SPI_MEM_NO_DATA to the spi_mem_data_dir enum memory: renesas-rpc-if: Make rpcif_enable/disable_rpm() as static inline memory: renesas-rpc-if: Fix a node reference leak in rpcif_probe() memory: renesas-rpc-if: Fix unbalanced pm_runtime_enable in rpcif_{enable,disable}_rpm memory: renesas-rpc-if: Return correct value to the caller of rpcif_manual_xfer() memory: add Renesas RPC-IF driver dt-bindings: memory: document Renesas RPC-IF bindings dt-bindings: thermal: rcar-gen3-thermal: Add r8a774e1 support dt-bindings: PCI: rcar-pci-host: Document r8a774e1 bindings dt-bindings: PCI: rcar: Add device tree support for r8a774b1 dt-bindings: timer: renesas: tmu: Document r8a774e1 bindings dt-bindings: pci: rcar-pci-ep: Document missing interrupts property CIP: Bump version suffix to -cip40 after merge from stable arm64: dts: renesas: r8a774c0: Fix MSIOF1 DMA channels CIP: Bump version suffix to -cip39 after merge from stable arm64: dts: renesas: r8a774e1: Add audio support arm64: dts: renesas: r8a774e1: Add missing audio_clk_b CIP: Bump version suffix to -cip38 after merge from stable arm64: dts: renesas: r8a774e1: Add USB-DMAC and HSUSB device nodes arm64: dts: renesas: r8a774e1: Add USB3.0 device nodes arm64: dts: renesas: r8a774e1: Add USB2.0 phy and host (EHCI/OHCI) device nodes dt-bindings: dma: renesas,usb-dmac: Add binding for r8a774e1 dt-bindings: phy: renesas,usb3-phy: Add r8a774e1 support dt-bindings: phy: renesas,usb2-phy: Add r8a774e1 support dt-bindings: sound: renesas, rsnd: Document r8a774e1 bindings arm64: dts: renesas: Add HiHope RZ/G2H board with idk-1110wr display arm64: dts: renesas: r8a774e1: Add PWM device nodes dt-bindings: pwm: renesas,pwm-rcar: Add r8a774e1 support arm64: dts: renesas: r8a774e1-hihope-rzg2h: Setup DU clocks arm64: dts: renesas: r8a774e1: Add LVDS device node drm: rcar-du: lvds: Add support for R8A774E1 SoC dt-bindings: display: renesas,lvds: Document r8a774e1 bindings arm64: dts: renesas: r8a774e1: Populate HDMI encoder node dt-bindings: display: renesas,dw-hdmi: Add r8a774e1 support arm64: dts: renesas: r8a774e1: Populate DU device node drm: rcar-du: Add support for R8A774E1 SoC dt-bindings: display: renesas,du: Document r8a774e1 bindings arm64: dts: renesas: r8a774e1: Add FDP1 device nodes arm64: dts: renesas: r8a774e1: Add VSP instances arm64: dts: renesas: r8a774e1: Add FCPF and FCPV instances arm64: dts: renesas: r8a774e1-hihope-rzg2h-ex: Enable sata misc: pci_endpoint_test: Add Device ID for RZ/G2H PCIe controller arm64: dts: renesas: r8a774e1: Add PCIe EP nodes dt-bindings: pci: rcar-pci-ep: Document r8a774e1 arm64: dts: renesas: r8a774e1: Add SATA controller node arm64: dts: renesas: r8a774e1: Add PCIe device nodes misc: pci_endpoint_test: Add Device ID for RZ/G2M and RZ/G2N PCIe controllers arm64: dts: renesas: r8a774b1: Add PCIe EP nodes arm64: dts: renesas: r8a774a1: Add PCIe EP nodes arm64: dts: renesas: r8a774c0: Add PCIe EP node dt-bindings: pci: rcar-pci-ep: Document r8a774a1 and r8a774b1 ata: sata_rcar: Fix DMA boundary mask arm64: dts: renesas: r8a774b1-hihope-rzg2n-ex: Enable sata arm64: dts: renesas: r8a774b1: Add SATA controller node dt-bindings: ata: sata_rcar: Add r8a774b1 support CIP: Bump version suffix to -cip37 after merge from stable misc: pci_endpoint_test: Add Device ID for RZ/G2E PCIe controller arm64: defconfig: Enable R-Car PCIe endpoint driver PCI: rcar: Add endpoint mode support dt-bindings: PCI: rcar: Add bindings for R-Car PCIe endpoint controller PCI: rcar: Fix calculating mask for PCIEPAMR register PCI: rcar: Move shareable code to a common file arm64: defconfig: Enable CONFIG_PCIE_RCAR_HOST PCI: rcar: Rename pcie-rcar.c to pcie-rcar-host.c PCI: endpoint: functions/pci-epf-test: Print throughput information PCI: endpoint: Add support to handle multiple base for mapping outbound memory PCI: endpoint: Pass page size as argument to pci_epc_mem_init() PCI: endpoint: Fix ->set_msix() to take BIR and offset as arguments PCI: pci-epf-test: Add support to defer core initialization PCI: endpoint: Add notification for core init completion PCI: endpoint: Add core init notifying feature PCI: endpoint: Assign function number for each PF in EPC core PCI: endpoint: Protect concurrent access to pci_epf_ops with mutex PCI: endpoint: Replace spinlock with mutex PCI: endpoint: Use notification chain mechanism to notify EPC events to EPF tools: PCI: Fix fd leakage tools: PCI: Exit with error code when test fails PCI: dwc: Fix dw_pcie_ep_raise_msix_irq() to get correct MSI-X table address PCI: endpoint: Fix clearing start entry in configfs PCI: endpoint: Cast the page number to phys_addr_t PCI: endpoint: Clear BAR before freeing its space PCI: endpoint: Skip odd BAR when skipping 64bit BAR PCI: endpoint: Allocate enough space for fixed size BAR PCI: endpoint: Set endpoint controller pointer to NULL PCI: endpoint: Add support to specify alignment for buffers allocated to BARs PCI: endpoint: Fix a potential NULL pointer dereference PCI: endpoint: Remove features member in struct pci_epc PCI: designware-plat: Remove setting epc->features in Designware plat EP driver PCI: rockchip: Remove pci_epf_linkup() from Rockchip EP driver PCI: cadence: Remove pci_epf_linkup() from Cadence EP driver PCI: pci-epf-test: Use pci_epc_get_features() to get EPC features PCI: pci-epf-test: Do not allocate next BARs memory if current BAR is 64Bit PCI: pci-epf-test: Remove setting epf_bar flags in function driver PCI: endpoint: Fix pci_epf_alloc_space() to set correct MEM TYPE flags PCI: endpoint: Add helper to get first unreserved BAR PCI: cadence: Populate ->get_features() cdns_pcie_epc_ops PCI: rockchip: Populate ->get_features() dw_pcie_ep_ops PCI: pci-dra7xx: Populate ->get_features() dw_pcie_ep_ops PCI: designware-plat: Populate ->get_features() dw_pcie_ep_ops PCI: dwc: Add ->get_features() callback function to dw_pcie_ep_ops PCI: endpoint: Add new pci_epc_ops to get EPC features CIP: Bump version suffix to -cip36 after merge from stable with ravb fix Revert "ravb: Fixed to be able to unload modules" CIP: Bump version suffix to -cip35 after merge from stable CIP: Bump version suffix to -cip34 after merge from stable arm64: dts: renesas: Fix SD Card/eMMC interface device node names arm64: dts: renesas: r8a774e1: Add RWDT node dt-bindings: watchdog: renesas,wdt: Document r8a774e1 support arm64: dts: renesas: r8a774e1: Add MSIOF nodes spi: renesas,sh-msiof: Add r8a774e1 support arm64: dts: renesas: r8a774e1: Add I2C and IIC-DVFS support dt-bindings: i2c: renesas,iic: Document r8a774e1 support dt-bindings: i2c: renesas,i2c: Document r8a774e1 support arm64: dts: renesas: r8a774e1: Add SDHI nodes mmc: renesas_sdhi_internal_dmac: Add r8a774e1 support arm64: dts: renesas: r8a774e1: Add SCIF and HSCIF nodes arm64: dts: renesas: r8a774e1: Add CAN[FD] support can: rcar_can: Remove unused platform data support arm64: dts: renesas: r8a774e1: Add TMU device nodes arm64: dts: renesas: r8a774e1: Add CMT device nodes arm64: dts: renesas: r8a774e1: Add RZ/G2H thermal support thermal: rcar_gen3_thermal: Add r8a774e1 support thermal/drivers/rcar_gen3: Fix undefined temperature if negative thermal: rcar_gen3_thermal: Generate interrupt when temperature changes thermal: rcar_gen3_thermal: Remove temperature bound arm64: dts: renesas: r8a774e1: Add operating points arm64: dts: renesas: r8a774e1: Add Ethernet AVB node arm64: dts: renesas: r8a774e1: Add GPIO device nodes arm64: dts: renesas: r8a774e1: Add SYS-DMAC device nodes dt-bindings: dma: renesas,rcar-dmac: Document R8A774E1 bindings arm64: dts: renesas: r8a774e1: Add IPMMU device nodes iommu/ipmmu-vmsa: Hook up R8A774E1 DT matching code dt-bindings: iommu: renesas,ipmmu-vmsa: Add r8a774e1 support arm64: dts: renesas: Add HiHope RZ/G2H sub board support arm64: dts: renesas: Add HiHope RZ/G2H main board support dt-bindings: arm: renesas: Add HopeRun RZ/G2H boards arm64: dts: renesas: Initial r8a774e1 SoC device tree pinctrl: sh-pfc: pfc-r8a77951: Add R8A774E1 PFC support dt-bindings: pinctrl: sh-pfc: Document r8a774e1 PFC support pinctrl: sh-pfc: Split R-Car H3 support in two independent drivers pinctrl: sh-pfc: pfc-r8a7795: Fix typo in pinmux macro for SCL3 pinctrl: sh-pfc: pfc-r8a7795-es1: Fix typo in pinmux macro for SCL3 pinctrl: sh-pfc: r8a7795: Use new macros for non-GPIO pins pinctrl: sh-pfc: r8a7795-es1: Use new macros for non-GPIO pins pinctrl: sh-pfc: r8a7795: Add TPU pins, groups and functions pinctrl: sh-pfc: r8a7795-es1: Add TPU pins, groups and functions pinctrl: sh-pfc: rcar-gen3: Rename RTS{0,1,3,4}# pin function definitions pinctrl: sh-pfc: rcar-gen3: Retain TDSELCTRL register across suspend/resume pinctrl: sh-pfc: r8a7795: Deduplicate VIN5 pin definitions pinctrl: sh-pfc: r8a7795: Add I2C{0,3,5} pins, groups and functions pinctrl: sh-pfc: r8a7795-es1: Add I2C{0,3,5} pins, groups and functions pinctrl: sh-pfc: r8a7795: Fix VIN versioned groups pinctrl: sh-pfc: r8a77965: Fix DU_DOTCLKIN3 drive/bias control arm64: defconfig: Enable R8A774E1 SoC clk: renesas: cpg-mssr: Add r8a774e1 support dt-bindings: clock: renesas,cpg-mssr: Document r8a774e1 clk: renesas: rzg2: Mark RWDT clocks as critical clk: renesas: cpg-mssr: Mark clocks as critical only if on at boot clk: renesas: rcar-gen3: Allow changing the RPC[D2] clocks clk: renesas: Add r8a774e1 CPG Core Clock Definitions clk: renesas: rcar-gen3: Add RPC clocks soc: renesas: rcar-rst: Add support for RZ/G2H dt-bindings: reset: rcar-rst: Document r8a774e1 reset module soc: renesas: Identify RZ/G2H dt-bindings: arm: renesas: Document RZ/G2H SoC DT bindings soc: renesas: Add Renesas R8A774E1 config option soc: renesas: rcar-sysc: Add r8a774e1 support dt-bindings: power: renesas,rcar-sysc: Document r8a774e1 SYSC binding dt-bindings: power: Add r8a774e1 SYSC power domain definitions arm64: dts: renesas: r8a774a1: Remove audio port node arm64: dts: renesas: Add HiHope RZ/G2N Rev2.0/3.0/4.0 board with idk-1110wr display arm64: dts: renesas: Add HiHope RZ/G2N Rev.3.0/4.0 sub board support arm64: dts: renesas: Add HiHope RZ/G2N Rev.3.0/4.0 main board support arm64: dts: renesas: Add HiHope RZ/G2M Rev.3.0/4.0 board with idk-1110wr display arm64: dts: renesas: hihope-rzg2-ex: Separate out lvds specific nodes into common file arm64: dts: renesas: Add HiHope RZ/G2M Rev.3.0/4.0 sub board support arm64: dts: renesas: Add HiHope RZ/G2M Rev.3.0/4.0 main board support arm64: dts: renesas: Add HiHope RZ/G2M[N] Rev.3.0/4.0 specific into common file arm64: dts: renesas: hihope-common: Separate out Rev.2.0 specific into hihope-rev2.dtsi file arm64: dts: renesas: r8a774b1-hihope-rzg2n[-ex]: Rename HiHope RZ/G2N boards arm64: dts: renesas: r8a774a1-hihope-rzg2m[-ex/-ex-idk-1110wr]: Rename HiHope RZ/G2M boards CIP: Bump version suffix to -cip33 after merge from stable drm: atomic helper: fix W=1 warnings drm: Add drm_atomic_get_old/new_private_obj_state drm: of: Fix linking when CONFIG_OF is not set CIP: Bump version suffix to -cip32 after merge from stable drm: of: Fix double-free bug CIP: Bump version suffix to -cip31 after merge from stable arm64: dts: renesas: Add EK874 board with idk-2121wr display support dt-bindings: display: Add idk-2121wr binding arm64: dts: renesas: rzg2: Add reset control properties for display arm64: dts: renesas: r8a774c0: Point LVDS0 to its companion LVDS1 drm: rcar-du: lvds: Allow for even and odd pixels swap drm: rcar-du: lvds: Get dual link configuration from DT drm: of: Add drm_of_lvds_get_dual_link_pixel_order drm: rcar-du: lvds: Improve identification of panels drm: rcar-du: lvds: Get mode from state drm: Add atomic variants for bridge enable/disable drm: Add drm_atomic_get_(old|new)_connector_for_encoder() helpers drm: rcar_lvds: Fix dual link mode operations drm: rcar-du: Skip LVDS1 output on Gen3 when using dual-link LVDS mode drm: rcar-du: lvds: Add support for dual-link mode dt-bindings: display: renesas: lvds: Add renesas,companion property drm: bridge: Add dual_link field to the drm_bridge_timings structure drm: rcar-du: lvds: Remove LVDS double-enable checks arm64: defconfig: Enable additional support for Renesas platforms ASoC: rsnd: fixup SSI clock during suspend/resume modes CIP: Bump version suffix to -cip30 after merge from stable CIP: Bump version suffix to -cip29 after merge from stable CIP: Bump version suffix to -cip28 after merge from stable CIP: Bump version suffix to -cip27 after merge from stable CIP: Bump version suffix to -cip26 after merge from stable CIP: Bump version suffix to -cip25 after merge from stable arm64: dts: renesas: Add HiHope RZ/G2M board with idk-1110wr display dt-bindings: display: Add idk-1110wr binding CIP: Bump version suffix to -cip24 after merge from stable CIP: Bump version suffix to -cip23 after merge from stable CIP: Bump version suffix to -cip22 after merge from stable CIP: Bump version suffix to -cip21 after merge from stable arm64: dts: renesas: cat874: Enable usb role switch support arm64: dts: renesas: cat874: Enable USB3.0 host/peripheral device node usb: gadget: udc: renesas_usb3: Enhance role switch support usb: typec: fix an IS_ERR() vs NULL bug in hd3ss3220_probe() usb: typec: hd3ss3220: hd3ss3220_probe() warn: passing zero to 'PTR_ERR' usb: typec: add dependency for TYPEC_HD3SS3220 usb: typec: hd3ss3220_irq() can be static usb: typec: driver for TI HD3SS3220 USB Type-C DRP port controller dt-bindings: usb: renesas_usb3: Document usb role switch support dt-bindings: usb: hd3ss3220 device tree binding document usb: roles: Add fwnode_usb_role_switch_get() function device connection: Add fwnode_connection_find_match() usb: roles: Introduce stubs for the exiting functions in role.h device connection: Find connections also by checking the references device property: Introduce fwnode_find_reference() device connection: Find device connections also from device graphs device connection: Prepare support for firmware described connections usb: typec: Find the ports by also matching against the device node usb: roles: Find the muxes by also matching against the device node usb: typec: mux: Fix unsigned comparison with less than zero usb: typec: mux: Find the muxes by also matching against the device node device connection: Add fwnode member to struct device_connection CIP: Bump version suffix to -cip20 after merge from stable arm64: dts: renesas: r8a774b1: Add USB3.0 device nodes arm64: dts: renesas: r8a774b1: Add USB-DMAC and HSUSB device nodes arm64: dts: renesas: r8a774b1: Add USB2.0 phy and host (EHCI/OHCI) device nodes dt-bindings: usb: renesas_usb3: Document r8a774b1 support dt-bindings: usb: renesas_gen3: Rename bindings documentation file to reflect IP block dt-bindings: usb-xhci: Add r8a774b1 support dt-bindings: rcar-gen3-phy-usb3: Add r8a774b1 support dt-bindings: usb: renesas_usbhs: Add r8a774b1 support dt-bindings: usb: renesas_usbhs: Rename bindings documentation file dt-bindings: dmaengine: usb-dmac: Add binding for r8a774b1 dt-bindings: rcar-gen3-phy-usb2: Add r8a774b1 support arm64: dts: renesas: r8a774b1: Add Sound and Audio DMAC device nodes ASoC: rsnd: Document r8a774b1 bindings arm64: dts: renesas: r8a774a1: Remove audio port node arm64: dts: renesas: Add support for Advantech idk-1110wr LVDS panel arm64: dts: renesas: hihope-rzg2-ex: Add LVDS support drm: rcar-du: lvds: Add r8a774b1 support arm64: dts: renesas: hihope-rzg2-ex: Enable backlight arm64: dts: renesas: r8a774b1: Add PWM device nodes arm64: dts: renesas: r8a774b1: Add FDP1 device nodes arm64: dts: renesas: r8a774b1-hihope-rzg2n: Add display clock properties arm64: dts: renesas: r8a774b1: Add HDMI encoder instance arm64: dts: renesas: r8a774b1: Add DU device to DT drm: rcar-du: Add R8A774B1 support arm64: dts: renesas: hihope-common: Move du clk properties out of common dtsi arm64: dts: renesas: r8a774b1: Connect Ethernet-AVB to IPMMU-DS0 arm64: dts: renesas: r8a774b1: Tie SYS-DMAC to IPMMU-DS0/1 arm64: dts: renesas: r8a774b1: Add VSP instances arm64: dts: renesas: r8a774b1: Add FCPF and FCPV instances arm64: dts: renesas: r8a774b1: Add IPMMU device nodes iommu/ipmmu-vmsa: Hook up r8a774b1 DT matching code dt-bindings: iommu: ipmmu-vmsa: Add r8a774b1 support arm64: dts: renesas: r8a774b1: Add CAN and CAN FD support dt-bindings: can: rcar_canfd: document r8a774b1 support dt-bindings: can: rcar_can: document r8a774b1 support arm64: dts: renesas: r8a774b1: Add TMU device nodes clk: renesas: r8a774b1: Add TMU clock dt-bindings: timer: renesas: tmu: Document r8a774b1 bindings arm64: dts: renesas: r8a774b1: Add CMT device nodes dt-bindings: timer: renesas, cmt: Document r8a774b1 CMT support arm64: dts: renesas: r8a774b1: Add RZ/G2N thermal support thermal: rcar_gen3_thermal: Add r8a774b1 support dt-bindings: thermal: rcar-gen3-thermal: Add r8a774b1 support arm64: dts: renesas: r8a774b1: Add OPPs table for cpu devices arm64: dts: renesas: r8a774b1: Add I2C and IIC-DVFS support dt-bindings: i2c: sh_mobile: Add r8a774b1 support dt-bindings: i2c: sh_mobile: Rename bindings documentation file dt-bindings: i2c: rcar: Add r8a774b1 support dt-bindings: i2c: rcar: Rename bindings documentation file arm64: dts: renesas: r8a774b1-hihope-rzg2n: Enable HS400 mode arm64: dts: renesas: r8a774b1: Add SDHI support mmc: renesas_sdhi_internal_dmac: Add r8a774b1 support dt-bindings: mmc: renesas_sdhi: Add r8a774b1 support arm64: dts: renesas: r8a774b1: Add INTC-EX device node arm64: dts: renesas: hihope-rzg2-ex: Let the board specific DT decide about pciec1 arm64: dts: renesas: r8a774b1: Add PCIe device nodes arm64: dts: renesas: r8a774b1: Add all MSIOF nodes arm64: dts: renesas: r8a774b1: Add RWDT node dt-bindings: watchdog: renesas-wdt: Document r8a774b1 support dt-bindings: watchdog: Rename bindings documentation file dt-bindings: spi: sh-msiof: Add r8a774b1 support arm64: dts: renesas: Add HiHope RZ/G2N sub board support arm64: dts: renesas: r8a774b1: Add Ethernet AVB node dt-bindings: net: ravb: Add support for r8a774b1 SoC arm64: dts: renesas: r8a774b1: Add GPIO device nodes dt-bindings: gpio: rcar: Add DT binding for r8a774b1 arm64: dts: renesas: r8a774b1: Add SCIF and HSCIF nodes arm64: dts: renesas: r8a774b1: Add SYS-DMAC device nodes dt-bindings: dmaengine: rcar-dmac: Document R8A774B1 bindings CIP: Bump version suffix to -cip19 after merge from stable arm64: dts: renesas: r8a774c0: cat874: Sort nodes arm64: dts: renesas: Use ip=on for bootargs arm64: dts: renesas: r8a774c0: cat874: Add definition for 12V regulator arm64: dts: renesas: Update 'vsps' properties for readability arm64: dts: renesas: r8a774c0: Fix register range of display node arm64: dts: renesas: r8a774c0: Add missing assigned-clocks for CAN[01] arm64: dts: renesas: r8a774c0: Clean up CPU compatibles arm64: dts: renesas: r8a774c0: Add dynamic power coefficient arm64: dts: renesas: r8a774c0: Create thermal zone to support IPA thermal: rcar_thermal: update calculation formula for R-Car Gen3 SoCs dt-bindings: can: rcar_can: Complete documentation for RZ/G2[EM] dt-bindings: can: rcar_can: document r8a77965 support CIP: Bump version suffix to -cip18 after merge from stable CIP: Bump version suffix to -cip17 after merge from stable arm64: defconfig: Enable R8A774B1 SoC arm64: dts: renesas: Add HiHope RZ/G2N main board support arm64: dts: renesas: Initial r8a774b1 SoC device tree dt-bindings: serial: sh-sci: Document r8a774b1 bindings pinctrl: sh-pfc: pfc-r8a77965: Fix typo in pinmux macro for SCL3 pinctrl: sh-pfc: r8a77965: Add R8A774B1 PFC support dt-bindings: pinctrl: sh-pfc: Document r8a774b1 PFC support pinctrl: sh-pfc: r8a77965: Use new macros for non-GPIO pins pinctrl: sh-pfc: r8a77965: Add TPU pins, groups and functions pinctrl: sh-pfc: r8a77965: Add I2C{0,3,5} pins, groups and functions pinctrl: sh-pfc: r8a77965: Add DRIF pins, groups and functions pinctrl: sh-pfc: r8a77965: Add TMU pins, groups and functions pinctrl: sh-pfc: r8a77965: Replace DU_DOTCLKIN2 by DU_DOTCLKIN3 pinctrl: sh-pfc: r8a77965: Add CAN FD pins, groups and functions pinctrl: sh-pfc: r8a77965: Add CAN pins, groups and functions pinctrl: sh-pfc: r8a77965: Add VIN[4|5] groups/functions pinctrl: sh-pfc: r8a77965: Add Audio SSI pin support pinctrl: sh-pfc: r8a77965: Add Audio clock pin support pinctrl: sh-pfc: r8a77965: Add SATA pins, groups and functions clk: renesas: cpg-mssr: Add r8a774b1 support dt-bindings: clock: renesas: cpg-mssr: Document r8a774b1 binding dt-bindings: clk: Add r8a774b1 CPG Core Clock Definitions soc: renesas: rcar-rst: Add support for RZ/G2N dt-bindings: reset: rcar-rst: Document r8a774b1 reset module soc: renesas: rcar-sysc: Add r8a774b1 support soc: renesas: r8a774c0-sysc: Fix power request conflicts soc: renesas: r8a77990-sysc: Fix power request conflicts soc: renesas: r8a77980-sysc: Fix power request conflicts soc: renesas: r8a77970-sysc: Fix power request conflicts soc: renesas: r8a77965-sysc: Fix power request conflicts soc: renesas: r8a7796-sysc: Fix power request conflicts soc: renesas: r8a7795-sysc: Fix power request conflicts soc: renesas: rcar-sysc: Prepare for fixing power request conflicts dt-bindings: power: rcar-sysc: Document r8a774b1 sysc dt-bindings: power: Add r8a774b1 SYSC power domain definitions soc: renesas: Identify RZ/G2N soc: renesas: Add Renesas R8A774B1 config option dt-bindings: arm: renesas: Add HopeRun RZ/G2N boards dt-bindings: arm: renesas: Document RZ/G2N SoC DT bindings CIP: Bump version suffix to -cip16 after merge from stable CIP: Bump version suffix to -cip15 after merge from stable gitlab-ci: Use external linux-cip-pipelines repository to define CI arm64: dts: renesas: r8a774a1: Add SSIU support for sound ASoC: rsnd: add SSIU BUSIF support ASoC: rsnd: add .get_id/.get_id_sub ASoC: rsnd: move .get_status under rsnd_mod_ops ASoC: rsnd: merge .nolock_start and .prepare ASoC: rsnd: ssiu: Support to init different BUSIF instance ASoC: rsnd: ssiu: Support BUSIF other than BUSIF0 ASoc: rsnd: dma: Calculate PDMACHCRE with consider of BUSIF ASoc: rsnd: dma: Calculate dma address with consider of BUSIF ASoC: rsnd: ssi: Check runtime channel number rather than hw_params ASoC: rsnd: ssi: Fix issue in dma data address assignment ASoC: rsnd: remove is_play parameter from hw_rule function ASoC: rsnd: add support for 8 bit S8 format ASoC: rsnd: add support for 16/24 bit slot widths ASoC: rsnd: add warning message to rsnd_kctrl_accept_runtime() CIP: Bump version suffix to -cip14 after merge from stable gitlab-ci: Remove test timeout gitlab-ci: Remove unofficial build configurations gitlab-ci: Split tests into separate jobs CIP: Bump version suffix to -cip13 after merge from stable arm64: dts: renesas: hihope-rzg2-ex: Enable CAN interfaces arm64: dts: renesas: r8a774a1: Add CANFD support arm64: dts: renesas: r8a774a1: Add missing assigned-clocks for CAN[01] dt-bindings: can: rcar_canfd: document r8a774a1 support arm64: dts: renesas: hihope-common: Add HDMI audio support arm64: dts: renesas: r8a774a1: Use extended audio dmac registers arm64: dts: renesas: cat874: Add BT support arm64: dts: renesas: cat874: Add WLAN support arm64: dts: renesas: hihope-common: Add WLAN support arm64: dts: renesas: hihope-common: Add BT support arm64: dts: renesas: hihope-common: Add PCA9654 I/O expander CIP: Bump version suffix to -cip12 after merge from stable arm64: dts: renesas: r8a774c0: Add CANFD support dt-bindings: can: rcar_canfd: document r8a774c0 support arm64: dts: renesas: cat874: Add HDMI audio arm64: dts: renesas: cat874: Add HDMI video support arm64: defconfig: Enable TDA19988 arm64: dts: renesas: r8a774c0: Add display output support media: use strscpy() instead of strlcpy() drm: rcar-du: Replace EXT_CTRL_REGS feature flag with generation check drm: rcar-du: Disable unused DPAD outputs drm/rcar-du: Use drm_fbdev_generic_setup() drm: rcar-du: Reject modes that fail CRTC timing requirements drm: rcar-du: Fix external clock error checks drm: rcar-du: Fix vblank initialization drm: rcar-du: Fix the return value in case of error in 'rcar_du_crtc_set_crc_source()' drm/rcar-du: Replace drm_dev_unref with drm_dev_put drm: rcar-du: Enable configurable DPAD0 routing on Gen3 drm: rcar-du: Improve non-DPLL clock selection drm: rcar-du: lvds: Adjust operating frequency for D3 and E3 drm: rcar-du: lvds: Fix post-DLL divider calculation drm: rcar-du: Turn LVDS clock output on/off for DPAD0 output on D3/E3 drm: rcar-du: lvds: Add API to enable/disable clock output drm: rcar-du: lvds: Don't fail probe if output is not connected on D3/E3 drm: rcar-du: Simplify encoder registration drm: rcar-du: Move CRTC outputs bitmask to private CRTC state drm: rcar-du: lvds: add R8A774C0 support drm: rcar-du: Add r8a774c0 device support drm: rcar-du: Use LVDS PLL clock as dot clock when possible drm: rcar-du: Perform the initial CRTC setup from rcar_du_crtc_get() drm: rcar-du: lvds: D3/E3 support dt-bindings: display: renesas: lvds: Document r8a774c0 bindings dt-bindings: display: renesas: lvds: Add EXTAL and DU_DOTCLKIN clocks dt-bindings: display: renesas: du: Document r8a774c0 bindings media: dt-bindings: media: renesas-fcp: Add RZ/G2 support media: vsp1: Add RZ/G support CIP: Bump version suffix to -cip11 after merge from stable gitlab-ci: Always store job artifacts gitlab-ci: Increase test timeout to 60 minutes arm64: dts: renesas: hihope-common: Add HDMI support arm64: dts: renesas: r8a774a1: Add HDMI encoder instance arm64: dts: renesas: r8a774a1: Connect Ethernet-AVB to IPMMU-DS0 arm64: dts: renesas: r8a774a1: Tie Audio-DMAC to IPMMU-MP arm64: dts: renesas: r8a774a1: Tie SYS-DMAC to IPMMU-DS0/1 arm64: dts: renesas: r8a774a1: Add FDP1 instance arm64: dts: renesas: r8a774a1: Add DU device to DT arm64: dts: renesas: r8a774a1: Add VSP instances arm64: dts: renesas: hihope-rzg2-ex: Enable PCIe support arm64: dts: renesas: hihope-common: Declare pcie bus clock arm64: dts: renesas: r8a774a1: Add PCIe device nodes drm: rcar-du: Update framebuffer pitch and alignment limits for Gen3 drm: rcar-du: Store V4L2 fourcc in rcar_du_format_info structure drm: rcar-du: Add support for missing pixel formats drm: rcar-du: Rename and document dpll_ch field drm: rcar-du: Rework clock configuration based on hardware limits drm: rcar-du: Support interlaced video output through vsp1 drm: rcar-du: Don't use TV sync mode when not supported by the hardware drm: rcar-du: Cache DSYSR value to ensure known initial value drm: rcar-du: Add interlaced feature flag drm: rcar-du: Refactor Feature and Quirk definitions drm: rcar-du: dw-hdmi: Reject modes with a too high clock frequency drm: rcar-du: lvds: Add r8a774a1 support drm: rcar-du: Add R8A774A1 support PCI: rcar: Do not shadow the 'irq' variable PCI: rcar: Clean up debug messages PCI: rcar: Replace various variable types with unsigned ones for register values PCI: rcar: Replace unsigned long with u32/unsigned int in register accessors dt-bindings: display: renesas: Add r8a774a1 support dt-bindings: display: renesas: lvds: Document r8a774a1 bindings dt-bindings: display: renesas: du: Document the r8a774a1 bindings dt-bindings: PCI: rcar: Add device tree support for r8a774a1 CIP: Bump version suffix to -cip10 after merge from stable arm64: dts: renesas: hihope-common: Enable USB3.0 arm64: dts: renesas: hihope-common: Add USB 2.0 support arm64: dts: renesas: r8a774a1: Fix USB 2.0 clocks phy: renesas: rcar-gen3-usb2: fix imbalance powered flag arm64: dts: renesas: hihope-common: Remove "label" from LEDs arm64: dts: renesas: hihope-common: Add LEDs support arm64: dts: renesas: hihope-common: Add uSD and eMMC mmc: renesas_sdhi: prevent overflow for max_req_size mmc: tmio: introduce macro for max block size mmc: renesas_sdhi: Change HW adjustment register according to speed mode arm64: dts: renesas: r8a774a1: Add dynamic power coefficient arm64: dts: renesas: r8a774a1: Create thermal zone to support IPA arm64: dts: renesas: r8a774a1: Add CPU capacity-dmips-mhz arm64: dts: renesas: r8a774a1: Add CPU topology on r8a774a1 SoC arm64: dts: renesas: r8a774a1: Add operating points thermal: rcar_gen3_thermal: Update temperature conversion method thermal: rcar_gen3_thermal: Update calculation formula of IRQTEMP thermal: rcar_gen3_thermal: Update value of Tj_1 thermal: rcar_gen3_thermal: Fix to show correct trip points number thermal: rcar_gen3_thermal: fix interrupt type thermal: rcar_gen3_thermal: Fix init value of IRQCTL register thermal: rcar_gen3_thermal: Register hwmon sysfs interface arm64: dts: renesas: r8a774a1: Add TMU device nodes clk: renesas: r8a774a1: Add TMU clock arm64: dts: renesas: r8a774a1: Add CMT device nodes arm64: dts: renesas: hihope-common: Add RWDT support watchdog: renesas_wdt: Add a few cycles delay watchdog: renesas_wdt: Use 'dev' instead of dereferencing it repeatedly watchdog: renesas_wdt: drop superfluous glob pattern watchdog: renesas_wdt: don't keep timer value during suspend/resume watchdog: renesas_wdt: Fix typos watchdog: renesas_wdt: stop when unregistering arm64: dts: renesas: Add HiHope RZ/G2M sub board support arm64: dts: renesas: hihope-common: Add pincontrol support to scif2/scif clock arm64: dts: renesas: Add HiHope RZ/G2M main board support dt-bindings: Add vendor prefix for HopeRun dt-bindings: arm: renesas: Add HopeRun RZ/G2[M] boards gitlab-ci: Start testing the r8a774a1-hihope-rzg2m-ex device arm64: dts: renesas: r8a774a1: Add clkp2 clock to CAN nodes arm64: dts: Remove inconsistent use of 'arm,armv8' compatible string arm64: dts: renesas: r8a774a1: Fix hsusb reg size arm64: dts: renesas: r8a774a1: Enable DMA for SCIF2 arm64: dts: renesas: r8a774a1: Replace clock magic numbers arm64: dts: renesas: r8a774a1: Replace power magic numbers arm64: dts: renesas: r8a774a1: Add CAN nodes arm64: dts: renesas: Remove unneeded status from thermal nodes arm64: dts: renesas: Fix whitespace around assignments arm64: dts: renesas: r8a774a1: Add USB3.0 device nodes arm64: dts: renesas: r8a774a1: Add USB-DMAC and HSUSB device nodes arm64: dts: renesas: r8a774a1: Add USB2.0 phy and host(EHCI/OHCI) device nodes arm64: dts: renesas: r8a774a1: Add FCPF and FCPV instances arm64: dts: renesas: r8a774a1: Add audio support arm64: dts: renesas: r8a774a1: Add PWM device nodes arm64: dts: renesas: r8a774a1: Add Cortex-A53 CPU cores arm64: dts: renesas: r8a774a1: Add all MSIOF nodes arm64: dts: renesas: r8a774a1: Add IPMMU device nodes arm64: dts: renesas: r8a774a1: Add RZ/G2M thermal support arm64: dts: renesas: r8a774a1: Add I2C and IIC-DVFS support arm64: dts: renesas: r8a774a1: Add SDHI nodes arm64: dts: renesas: r8a774a1: Add GPIO device nodes arm64: dts: renesas: r8a774a1: Add pinctrl device node arm64: dts: renesas: r8a774a1: Add RWDT node arm64: dts: renesas: r8a774a1: Add Ethernet AVB node arm64: dts: renesas: r8a774a1: Add INTC-EX device node arm64: dts: renesas: r8a774a1: Add SCIF and HSCIF nodes arm64: dts: renesas: r8a774a1: Add SYS-DMAC controller nodes arm64: dts: renesas: Initial r8a774a1 SoC device tree mmc: renesas_sdhi_internal_dmac: set scatter/gather max segment size ravb: Avoid unsupported internal delay mode for R-Car E3/D3 ravb: remove tx buffer addr 4byte alilgnment restriction for R-Car Gen3 spi: sh-msiof: fix deferred probing dmaengine: rcar-dmac: Update copyright information dmaengine: rcar-dmac: set scatter/gather max segment size serial: sh-sci: Fix fallback to PIO in sci_dma_rx_complete() serial: sh-sci: Extract sci_dma_rx_reenable_irq() serial: sh-sci: Extract sci_dma_rx_chan_invalidate() serial: sh-sci: Fix crash in rx_timer_fn() on PIO fallback soc: renesas: rcar-sysc: Fix power domain control after system resume soc: renesas: rcar-sysc: Merge PM Domain registration and linking soc: renesas: rcar-sysc: Remove rcar_sysc_power_{down,up}() helpers clk: renesas: cpg-mssr: Remove error messages on out-of-memory conditions clk: renesas: cpg-mssr: Use genpd of_node instead of local copy gpio: rcar: Pedantic formatting gpio: rcar: select General Output Register to set output states gpio: rcar: reference device instead of platform device thermal: rcar_gen3_thermal: Add r8a774a1 support dt-bindings: dmaengine: usb-dmac: Add binding for r8a774a1 dt-bindings: thermal: rcar-gen3-thermal: Add r8a774a1 support dt-bindings: usb: renesas_usbhs: Add r8a774a1 support dt-bindings: usb-xhci: Add r8a774c0 support dt-bindings: usb-xhci: Add r8a774a1 support dt-bindings: rcar-gen3-phy-usb3: Add r8a774a1 support dt-bindings: can: rcar_can: Add r8a774c0 support dt-bindings: can: rcar_can: Fix RZ/G2 CAN clocks dt-bindings: can: rcar_can: Add r8a774a1 support pinctrl: sh-pfc: sh73a0: Use new macros for non-GPIO pins pinctrl: sh-pfc: sh73a0: Add missing TO pin to tpu4_to3 group pinctrl: sh-pfc: sh73a0: Fix fsic_spdif pin groups pinctrl: sh-pfc: r8a7791: Fix scifb2_data_c pin group pinctrl: sh-pfc: r8a7791: Fix VIN1 versioned groups pinctrl: sh-pfc: r8a7791: Remove bogus marks from vin1_b_data18 group pinctrl: sh-pfc: r8a7791: Remove bogus ctrl marks from qspi_data4_b group pinctrl: sh-pfc: r8a77995: Remove unused PINMUX_IPSR_{MSEL2,PHYS}() pinctrl: sh-pfc: r8a7740: Add missing LCD0 marks to lcd0_data24_1 group pinctrl: sh-pfc: r8a7740: Add missing REF125CK pin to gether_gmii group pinctrl: sh-pfc: r8a7796: Remove placeholder I2C pin data pinctrl: sh-pfc: r8a7796: Use new macros for non-GPIO pins pinctrl: sh-pfc: r8a7796: Add TPU pins, groups and functions pinctrl: sh-pfc: r8a77990: Use new macros for non-GPIO pins pinctrl: sh-pfc: Move PIN_NONE to shared header file pinctrl: sh-pfc: Add PORT_GP_27 helper macro pinctrl: sh-pfc: rcar-gen3: Rename SEL_NDFC to SEL_NDF pinctrl: sh-pfc: rcar-gen3: Rename RTS{0,1,3,4}# pin function definitions pinctrl: sh-pfc: r8a77990: Fix MOD_SEL1 bit30 when using SSI_SCK2 and SSI_WS2 pinctrl: sh-pfc: r8a77990: Fix MOD_SEL1 bit31 when using SIM0_D pinctrl: sh-pfc: r8a77990: Fix MOD_SEL0 bit16 when using NFALE and NFRB_N pinctrl: sh-pfc: rcar-gen3: Rename SEL_ADG_{A,B,C} to SEL_ADG{A,B,C} pinctrl: sh-pfc: rcar-gen3: Remove CC5_OSCOUT pin pinctrl: sh-pfc: rcar-gen3: Remove HDMI CEC pins, groups, and functions pinctrl: sh-pfc: Add missing #include <linux/errno.h> pinctrl: sh-pfc: rcar-gen3: Retain TDSELCTRL register across suspend/resume pinctrl: sh-pfc: r8a77990: Move CANFD pin groups and functions pinctrl: sh-pfc: r8a77990: Rename IOCTRLx registers pinctrl: sh-pfc: r8a7796: Move CANFD pin groups and functions pinctrl: sh-pfc: r8a7796: Deduplicate VIN5 pin definitions pinctrl: sh-pfc: r8a7796: Add I2C{0,3,5} pins, groups and functions pinctrl: sh-pfc: r8a7796: Fix VIN versioned groups pinctrl: sh-pfc: Validate pin tables at runtime pinctrl: sh-pfc: Add check for empty pinmux groups/functions pinctrl: sh-pfc: Mark run-time debug code __init pinctrl: sh-pfc: Correct printk level of group reference warning pinctrl: sh-pfc: Add new non-GPIO helper macros pinctrl: sh-pfc: Add SH_PFC_PIN_CFG_PULL_UP_DOWN shorthand pinctrl: sh-pfc: Rename 2-parameter CPU_ALL_PORT() variant pinctrl: sh-pfc: Improve PINMUX_IPSR_PHYS() documentation pinctrl: sh-pfc: Validate enum IDs for regs with variable-width fields pinctrl: sh-pfc: Validate enum IDs for regs with fixed-width fields pinctrl: sh-pfc: Absorb enum IDs in PINMUX_DATA_REG() macro pinctrl: sh-pfc: Absorb enum IDs in PINMUX_CFG_REG_VAR() macro pinctrl: sh-pfc: Absorb enum IDs in PINMUX_CFG_REG() macro pinctrl: sh-pfc: Validate fixed-size field widths at build time pinctrl: sh-pfc: Make pinmux_cfg_reg.var_field_width[] variable-length pinctrl: sh-pfc: Validate pins/marks in pin groups at build time pinctrl: sh-pfc: Add physical pin multiplexing helper macros pinctrl: sh-pfc: Validate pinmux tables at runtime when debugging pinctrl: sh-pfc: Print actual field width for variable-width fields CIP: Bump version suffix to -cip9 after merge from stable staging: m57621-mmc: delete driver from the tree. CIP: Bump version suffix to -cip8 after merge from stable Update to run all CIP arm, arm64 and x86 configs Update CI to use the latest linux-cip-ci containers CIP: Bump version suffix to -cip7 after merge from stable arm64: dts: renesas: r8a774c0: sort subnodes of the soc node arm64: dts: renesas: r8a774c0: Remove invalid compatible value for CSI40 arm64: dts: renesas: r8a774c0: Fix SCIF5 DMA channels arm64: dts: renesas: r8a774c0: Enable DMA for SCIF2 arm64: dts: renesas: r8a774c0-cat874: Add RWDT support arm64: dts: renesas: r8a774c0-cat874: Add LEDs support arm64: dts: renesas: r8a774c0-cat874: add RTC support arm64: defconfig: enable RX-8581 config option rtc: rx8581: Add support for Epson rx8571 RTC dt-bindings: rtc: add rx8571 compatible rtc: nvmem: remove nvmem from struct rtc_device rtc: nvmem: use devm_nvmem_register() arm64: dts: renesas: cat874: Add USB-HOST support phy: renesas: rcar-gen3-usb2: enable/disable independent irqs phy: renesas: rcar-gen3-usb2: Use pdev's device pointer on dev_vdbg() phy: rcar-gen3-usb2: Add support for r8a77470 phy: renesas: rcar-gen3-usb2: follow the hardware manual procedure phy: renesas: rcar-gen3-usb2: add is_otg_channel to use "role" sysfs phy: renesas: rcar-gen3-usb2: change a condition "dr_mode" phy: renesas: rcar-gen3-usb2: add conditions for uses_otg_pins == false phy: renesas: rcar-gen3-usb2: unify OBINTEN handling phy: renesas: rcar-gen3-usb2: Check a property to use otg pins phy: renesas: rcar-gen3-usb2: Rename has_otg_pins to uses_otg_pins phy: renesas: rcar-gen3-usb2: fix vbus_ctrl for role sysfs arm64: dts: renesas: cat875: Add CAN support arm64: dts: renesas: r8a774c0: Add clkp2 clock to CAN nodes arm64: dts: renesas: r8a774c0: Add CAN nodes arm64: dts: renesas: r8a774c0: Fix cpu nodes style arm64: dts: renesas: r8a774c0: Add OPPs table for cpu devices clk: renesas: rcar-gen3: Remove unused variable clk: renesas: rcar-gen3: Fix cpg_sd_clock_round_rate() return value clk: renesas: rcar-gen3: Correct parent clock of Audio-DMAC clk: renesas: rcar-gen3: Correct parent clock of SYS-DMAC clk: renesas: rcar-gen3: Correct parent clock of HS-USB clk: renesas: rcar-gen3: Correct parent clock of EHCI/OHCI clk: renesas: r8a774c0: Add Z2 clock clk: renesas: rcar-gen3: Support Z and Z2 clocks with high frequency parents math64: New DIV64_U64_ROUND_CLOSEST helper clk: renesas: rcar-gen3: Remove CLK_TYPE_GEN3_Z2 clk: renesas: rcar-gen3: Parameterise Z and Z2 clock offset clk: renesas: rcar-gen3: Parameterise Z and Z2 clock fixed divisor clk: renesas: rcar-gen3: Pass name/offset to cpg_sd_clk_register() clk: renesas: r8a774a1: Fix LAST_DT_CORE_CLK clk: renesas: rcar-gen3: Add spinlock clk: renesas: rcar-gen3: Factor out cpg_reg_modify() clk: renesas: r8a774a1: Add missing CANFD clock clk: renesas: Remove usage of CLK_IS_BASIC clk: renesas: rcar-gen3: Add HS400 quirk for SD clock clk: renesas: rcar-gen3: Add documentation for SD clocks clk: renesas: rcar-gen3: Set state when registering SD clocks clk: renesas: r8a774a1: Add CPEX clock CIP: Bump version suffix to -cip6 after merge from stable Add gitlab-ci.yaml CIP: Bump version suffix to -cip5 after merge from stable CIP: Bump version suffix to -cip4 after merge from stable CIP: Bump version suffix to -cip3 after merge from stable dt-bindings: Add vendor prefix for Silicon Linux. CIP: Bump version suffix to -cip2 after Renesas patches arm64: defconfig: Enable R-Car thermal driver arm64: dts: renesas: r8a774c0: Add thermal support dt-bindings: thermal: rcar-thermal: add R8A774C0 support thermal: rcar_thermal: add R8A774C0 support arm64: dts: renesas: r8a774c0: Connect RZ/G2E Audio-DMAC to IPMMU arm64: dts: renesas: r8a774c0: Connect RZ/G2E AVB to IPMMU arm64: dts: renesas: r8a774c0: Connect RZ/G2E SYS-DMAC to IPMMU arm64: dts: renesas: r8a774c0: Add PWM support dt-bindings: pwm: rcar: Add r8a774c0 support dt-bindings: pwm: rcar: Add r8a774a1 support arm64: dts: renesas: r8a774c0: Add audio support ASoC: rsnd: Add r8a774c0 support ASoC: rsnd: Add r8a774a1 support arm64: dts: renesas: r8a774c0: Add VIN and CSI-2 device nodes media: dt-bindings: rcar-csi2: Add r8a774c0 media: dt-bindings: rcar-vin: Add R8A774C0 support media: rcar-csi2: Add support for RZ/G2E media: rcar-csi2: Fix PHTW table values for E3/V3M media: rcar-csi2: Handle per-SoC number of channels media: rcar: rcar-csi2: Update V3M/E3 PHTW tables media: rcar-csi2: Add R8A77990 support media: rcar-vin: Add support for RZ/G2E media: rcar-vin: Add support for R-Car R8A77990 arm64: dts: renesas: r8a774c0: Add IPMMU device nodes dt-bindings: iommu: ipmmu-vmsa: Add r8a774c0 support dt-bindings: iommu: ipmmu-vmsa: Add r8a774a1 support iommu/ipmmu-vmsa: Hook up r8a774c0 DT matching code iommu/ipmmu-vmsa: Modify ipmmu_slave_whitelist() to check SoC revisions iommu/ipmmu-vmsa: Hook up R8A774A1 DT maching code arm64: dts: renesas: r8a774c0: Add USB3.0 device nodes usb: gadget: udc: renesas_usb3: Add bindings for r8a774c0 usb: gadget: udc: renesas_usb3: Add r8a774a1 support usb: gadget: udc: renesas_usb3: add support for r8a774c0 usb: gadget: udc: renesas_usb3: add a safety connection way for forced_b_device usb: gadget: udc: renesas_usb3: add support for r8a77990 arm64: dts: renesas: r8a774c0: Add USB-DMAC and HSUSB device nodes dt-bindings: dmaengine: usb-dmac: Add binding for r8a774c0 dt-bindings: usb: renesas_usbhs: Add r8a774c0 support dt-bindings: usb: renesas_usbhs: add clock-names property Revert "usb: renesas_usbhs: add extcon notifier to set mode for non-otg channel" usb: renesas_usbhs: Add multiple clocks management usb: renesas_usbhs: Add reset_control usb: renesas_usbhs: add support for RZ/G2E arm64: dts: renesas: r8a774c0: Add USB2.0 phy and host device nodes dt-bindings: rcar-gen3-phy-usb2: Add r8a774c0 support dt-bindings: rcar-gen3-phy-usb2: Add r8a774a1 support arm64: renesas: Enable GPIOLIB to allow GPIO driver selection arm64: enable CMT/TMU support for Renesas SoC clocksource/drivers/sh_tmu: Convert to SPDX identifiers arm64: dts: renesas: r8a774c0: Add TMU device nodes dt-bindings: timer: renesas: tmu: Document r8a774c0 bindings clk: renesas: r8a774c0: Fix LAST_DT_CORE_CLK clk: renesas: r8a774c0: Add TMU clock clk: renesas: r8a774c0: Correct parent clock of DU clk: renesas: r8a774c0: Add missing CANFD clock arm64: dts: renesas: r8a774c0: Add CMT device nodes dt-bindings: timer: renesas, cmt: Document r8a774c0 CMT support dt-bindings: timer: renesas, cmt: Document r8a774a1 CMT support clocksource/drivers/sh_cmt: Add R-Car gen3 support dt-bindings: timer: renesas: cmt: document R-Car gen3 support clocksource/drivers/sh_cmt: Properly line-wrap sh_cmt_of_table[] initializer clocksource/drivers/sh_cmt: Fix clocksource width for 32-bit machines clocksource/drivers/sh_cmt: Fixup for 64-bit machines clocksource/drivers/sh_cmt: Convert to SPDX identifiers pinctrl: sh-pfc: r8a77990: Add DRIF pins, groups and functions pinctrl: sh-pfc: r8a77990: Add TMU pins, groups and functions pinctrl: sh-pfc: r8a77990: GP6_9 does not have pull-down capability pinctrl: sh-pfc: r8a77990: Fix MOD_SEL bit numbering pinctrl: sh-pfc: r8a77990: Fix MOD_SEL0 bit2 when using RX2, TX2 and SCK2 pinctrl: sh-pfc: r8a77990: Fix MOD_SEL0 bit3 when using TX0 pinctrl: sh-pfc: r8a77990: Fix MOD_SEL0 SEL_I2C1 field width pinctrl: sh-pfc: r8a77990: Fix IOCTRL reg state after s2ram on R-Car E3 pinctrl: sh-pfc: r8a77990: Add CAN FD pins, groups and functions pinctrl: sh-pfc: r8a77990: Add CAN pins, groups and functions arm64: dts: renesas: cat875: Enable PCIe support arm64: dts: renesas: r8a774c0-cat874: Add pciec0 support arm64: dts: renesas: r8a774c0: Add PCIe device node dt-bindings: PCI: rcar: Add device tree support for r8a774c0 arm64: dts: renesas: r8a774c0: Add MSIOF nodes spi: sh-msiof: Add r8a774c0 support spi: sh-msiof: Add r8a774a1 support arm64: dts: renesas: r8a774c0: Add I2C and IIC-DVFS support dt-bindings: i2c: rcar: Add r8a774c0 support i2c: sh_mobile: Add support for r8a774c0 (RZ/G2E) i2c: sh_mobile: add support for r8a77990 (R-Car E3) dt-bindings: i2c: sh_mobile: Add r8a774c0 support i2c: sh_mobile: document support for r8a77990 (R-Car E3) pinctrl: sh-pfc: r8a77990: Add HSCIF pins, groups, and functions pinctrl: sh-pfc: r8a77990: Add VIN[4|5] groups/functions pinctrl: sh-pfc: Add optional arg to VIN_DATA_PIN_GROUP pinctrl: sh-pfc: Reduce kernel size for narrow VIN channels arm64: dts: renesas: r8a774c0: Add watchdog support dt-bindings: watchdog: renesas-wdt: Document r8a774c0 support arm64: dts: renesas: cat875: Add ethernet support arm64: dts: renesas: r8a774c0: Add Ethernet AVB node dt-bindings: net: ravb: Add support for r8a774c0 SoC arm64: dts: renesas: r8a774c0-cat874: Add uSD support arm64: dts: renesas: r8a774c0: Add SDHI nodes mmc: renesas_sdhi_internal_dmac: Whitelist r8a774c0 dt-bindings: mmc: renesas_sdhi: Add r8a774c0 support dt-bindings: mmc: renesas_sdhi: Add r8a77470 support mmc: renesas_sdhi_internal_dmac: Whitelist r8a774a1 mmc: renesas_sdhi: Add r8a774a1 support pinctrl: sh-pfc: r8a77990: Add voltage switch operations for SDHI pinctrl: sh-pfc: r8a77990: Add SDHI pins, groups and functions pinctrl: sh-pfc: r8a77990: Add Audio SSI pins, groups and functions pinctrl: sh-pfc: r8a77990: Add Audio clock pins, groups and functions arm64: dts: renesas: r8a774c0-cat874: Add pincontrol support to scif2 arm64: dts: renesas: r8a774c0: Add GPIO device nodes dt-bindings: gpio: rcar: Add r8a774c0 (RZ/G2E) support dt-bindings: gpio: rcar: Add r8a774a1 (RZ/G2M) support arm64: dts: renesas: r8a774c0: Add PFC support arm64: dts: renesas: r8a774c0: Add INTC-EX device node pinctrl: sh-pfc: r8a77990: Add INTC-EX pins, groups and function pinctrl: sh-pfc: rcar: Rename automotive-only arrays to automotive arm64: dts: renesas: r8a774c0: Add secondary CA53 CPU core clk: renesas: cpg-mssr: Add r8a774c0 support dt-bindings: clock: renesas: cpg-mssr: Document r8a774c0 clk: renesas: cpg-mssr: Add r8a774a1 support clk: renesas: rcar-gen3: Add support for mode pin clock selection clk: renesas: rcar-gen3: Add support for RCKSEL clock selection clk: renesas: cpg-mssr: Add support for fixed rate clocks clk: renesas: rcar-gen3: Add support for OSC EXTAL predivider clk: renesas: Add r8a774a1 CPG Core Clock Definitions clk: renesas: Add r8a774c0 CPG Core Clock Definitions arm64: dts: renesas: r8a774c0: Add SCIF and HSCIF nodes dt-bindings: serial: sh-sci: Document r8a774c0 bindings dt-bindings: serial: sh-sci: Document r8a774a1 bindings arm64: dts: renesas: r8a774c0: Add SYS-DMAC controller nodes dmaengine: rcar-dmac: Document R8A774C0 bindings dmaengine: rcar-dmac: Document R8A774A1 bindings arm64: dts: renesas: Add Si-Linux EK874 board support arm64: dts: renesas: Add Si-Linux CAT874 board support arm64: dts: renesas: Initial device tree for r8a774c0 dt-bindings: arm: Add si-linux cat87[45] boards ARM: dts: socfpga: Rename socfpga_cyclone5_de0_{sockit, nano_soc} dt-bindings: irqchip: renesas-irqc: Document r8a774c0 support soc: renesas: rcar-rst: Add support for RZ/G2E dt-bindings: reset: rcar-rst: Document r8a774c0 rst soc: renesas: rcar-rst: Add support for RZ/G2M soc: renesas: rcar-sysc: Add r8a774c0 support dt-bindings: power: rcar-sysc: Document r8a774c0 sysc soc: renesas: rcar-sysc: Add r8a774a1 support dt-bindings: power: Add r8a774c0 SYSC power domain definitions dt-bindings: power: Add r8a774a1 SYSC power domain definitions arm64: defconfig: enable R8A774C0 SoC arm64: defconfig: enable R8A774A1 SoC arm64: Add Renesas R8A774C0 support arm64: Add Renesas R8A774A1 support soc: renesas: Identify RZ/G2E soc: renesas: Identify RZ/G2M dt-bindings: arm: Fix RZ/G2E part number dt-bindings: arm: Document RZ/G2E SoC DT bindings dt-bindings: arm: Document RZ/G2M SoC DT bindings pinctrl: sh-pfc: r8a77990: Add R8A774C0 PFC support pinctrl: sh-pfc: r8a77990: Add MSIOF pins, groups and functions pinctrl: sh-pfc: r8a77990: Add DU pins, groups and function pinctrl: sh-pfc: r8a77990: Add PWM pins, groups and functions dt-bindings: pinctrl: sh-pfc: Document r8a774c0 PFC support pinctrl: sh-pfc: r8a7796: Add R8A774A1 PFC support dt-bindings: pinctrl: sh-pfc: Document r8a774a1 PFC support CIP: Add a number to the version suffix Signed-off-by: bengris32 <bengris32@protonmail.ch> Change-Id: I8df832a466b4899d9b12006b6238f003c5aebd26 Signed-off-by: bengris32 <bengris32@protonmail.ch> |
||
|
WangYuli
|
87775a0f73 |
HID: wacom: fix when get product name maybe null pointer
commit 59548215b76be98cf3422eea9a67d6ea578aca3d upstream.
Due to incorrect dev->product reporting by certain devices, null
pointer dereferences occur when dev->product is empty, leading to
potential system crashes.
This issue was found on EXCELSIOR DL37-D05 device with
Loongson-LS3A6000-7A2000-DL37 motherboard.
Kernel logs:
[ 56.470885] usb 4-3: new full-speed USB device number 4 using ohci-pci
[ 56.671638] usb 4-3: string descriptor 0 read error: -22
[ 56.671644] usb 4-3: New USB device found, idVendor=056a, idProduct=0374, bcdDevice= 1.07
[ 56.671647] usb 4-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 56.678839] hid-generic 0003:056A:0374.0004: hiddev0,hidraw3: USB HID v1.10 Device [HID 056a:0374] on usb-0000:00:05.0-3/input0
[ 56.697719] CPU 2 Unable to handle kernel paging request at virtual address 0000000000000000, era == 90000000066e35c8, ra == ffff800004f98a80
[ 56.697732] Oops[#1]:
[ 56.697734] CPU: 2 PID: 2742 Comm: (udev-worker) Tainted: G OE 6.6.0-loong64-desktop #25.00.2000.015
[ 56.697737] Hardware name: Inspur CE520L2/C09901N000000000, BIOS 2.09.00 10/11/2024
[ 56.697739] pc 90000000066e35c8 ra ffff800004f98a80 tp 9000000125478000 sp 900000012547b8a0
[ 56.697741] a0 0000000000000000 a1 ffff800004818b28 a2 0000000000000000 a3 0000000000000000
[ 56.697743] a4 900000012547b8f0 a5 0000000000000000 a6 0000000000000000 a7 0000000000000000
[ 56.697745] t0 ffff800004818b2d t1 0000000000000000 t2 0000000000000003 t3 0000000000000005
[ 56.697747] t4 0000000000000000 t5 0000000000000000 t6 0000000000000000 t7 0000000000000000
[ 56.697748] t8 0000000000000000 u0 0000000000000000 s9 0000000000000000 s0 900000011aa48028
[ 56.697750] s1 0000000000000000 s2 0000000000000000 s3 ffff800004818e80 s4 ffff800004810000
[ 56.697751] s5 90000001000b98d0 s6 ffff800004811f88 s7 ffff800005470440 s8 0000000000000000
[ 56.697753] ra: ffff800004f98a80 wacom_update_name+0xe0/0x300 [wacom]
[ 56.697802] ERA: 90000000066e35c8 strstr+0x28/0x120
[ 56.697806] CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE)
[ 56.697816] PRMD: 0000000c (PPLV0 +PIE +PWE)
[ 56.697821] EUEN: 00000000 (-FPE -SXE -ASXE -BTE)
[ 56.697827] ECFG: 00071c1d (LIE=0,2-4,10-12 VS=7)
[ 56.697831] ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0)
[ 56.697835] BADV: 0000000000000000
[ 56.697836] PRID: 0014d000 (Loongson-64bit, Loongson-3A6000)
[ 56.697838] Modules linked in: wacom(+) bnep bluetooth rfkill qrtr nls_iso8859_1 nls_cp437 snd_hda_codec_conexant snd_hda_codec_generic ledtrig_audio snd_hda_codec_hdmi snd_hda_intel snd_intel_dspcfg snd_hda_codec snd_hda_core snd_hwdep snd_pcm snd_timer snd soundcore input_leds mousedev led_class joydev deepin_netmonitor(OE) fuse nfnetlink dmi_sysfs ip_tables x_tables overlay amdgpu amdxcp drm_exec gpu_sched drm_buddy radeon drm_suballoc_helper i2c_algo_bit drm_ttm_helper r8169 ttm drm_display_helper spi_loongson_pci xhci_pci cec xhci_pci_renesas spi_loongson_core hid_generic realtek gpio_loongson_64bit
[ 56.697887] Process (udev-worker) (pid: 2742, threadinfo=00000000aee0d8b4, task=00000000a9eff1f3)
[ 56.697890] Stack : 0000000000000000 ffff800004817e00 0000000000000000 0000251c00000000
[ 56.697896] 0000000000000000 00000011fffffffd 0000000000000000 0000000000000000
[ 56.697901] 0000000000000000 1b67a968695184b9 0000000000000000 90000001000b98d0
[ 56.697906] 90000001000bb8d0 900000011aa48028 0000000000000000 ffff800004f9d74c
[ 56.697911] 90000001000ba000 ffff800004f9ce58 0000000000000000 ffff800005470440
[ 56.697916] ffff800004811f88 90000001000b98d0 9000000100da2aa8 90000001000bb8d0
[ 56.697921] 0000000000000000 90000001000ba000 900000011aa48028 ffff800004f9d74c
[ 56.697926] ffff8000054704e8 90000001000bb8b8 90000001000ba000 0000000000000000
[ 56.697931] 90000001000bb8d0 9000000006307564 9000000005e666e0 90000001752359b8
[ 56.697936] 9000000008cbe400 900000000804d000 9000000005e666e0 0000000000000000
[ 56.697941] ...
[ 56.697944] Call Trace:
[ 56.697945] [<90000000066e35c8>] strstr+0x28/0x120
[ 56.697950] [<ffff800004f98a80>] wacom_update_name+0xe0/0x300 [wacom]
[ 56.698000] [<ffff800004f9ce58>] wacom_parse_and_register+0x338/0x900 [wacom]
[ 56.698050] [<ffff800004f9d74c>] wacom_probe+0x32c/0x420 [wacom]
[ 56.698099] [<9000000006307564>] hid_device_probe+0x144/0x260
[ 56.698103] [<9000000005e65d68>] really_probe+0x208/0x540
[ 56.698109] [<9000000005e661dc>] __driver_probe_device+0x13c/0x1e0
[ 56.698112] [<9000000005e66620>] driver_probe_device+0x40/0x100
[ 56.698116] [<9000000005e6680c>] __device_attach_driver+0x12c/0x180
[ 56.698119] [<9000000005e62bc8>] bus_for_each_drv+0x88/0x160
[ 56.698123] [<9000000005e66468>] __device_attach+0x108/0x260
[ 56.698126] [<9000000005e63918>] device_reprobe+0x78/0x100
[ 56.698129] [<9000000005e62a68>] bus_for_each_dev+0x88/0x160
[ 56.698132] [<9000000006304e54>] __hid_bus_driver_added+0x34/0x80
[ 56.698134] [<9000000005e62bc8>] bus_for_each_drv+0x88/0x160
[ 56.698137] [<9000000006304df0>] __hid_register_driver+0x70/0xa0
[ 56.698142] [<9000000004e10fe4>] do_one_initcall+0x104/0x320
[ 56.698146] [<9000000004f38150>] do_init_module+0x90/0x2c0
[ 56.698151] [<9000000004f3a3d8>] init_module_from_file+0xb8/0x120
[ 56.698155] [<9000000004f3a590>] idempotent_init_module+0x150/0x3a0
[ 56.698159] [<9000000004f3a890>] sys_finit_module+0xb0/0x140
[ 56.698163] [<900000000671e4e8>] do_syscall+0x88/0xc0
[ 56.698166] [<9000000004e12404>] handle_syscall+0xc4/0x160
[ 56.698171] Code: 0011958f 00150224 5800cd85 <2a00022c> 00150004 4000c180 0015022c 03400000 03400000
[ 56.698192] ---[ end trace 0000000000000000 ]---
Fixes:
|
||
|
bengris32
|
dc38585c87 |
Merge branch 'android-4.19-stable' of https://android.googlesource.com/kernel/common into lineage-21
* 'android-4.19-stable' of https://android.googlesource.com/kernel/common: Revert "UPSTREAM: unicode: Don't special case ignorable code points" Reapply "UPSTREAM: unicode: Don't special case ignorable code points" Revert "UPSTREAM: unicode: Don't special case ignorable code points" Linux 4.19.325 sh: intc: Fix use-after-free bug in register_intc_controller() modpost: remove incorrect code in do_eisa_entry() 9p/xen: fix release of IRQ 9p/xen: fix init sequence block: return unsigned int from bdev_io_min jffs2: fix use of uninitialized variable ubi: fastmap: Fix duplicate slab cache names while attaching ubifs: Correct the total block count by deducting journal reservation rtc: check if __rtc_read_time was successful in rtc_timer_do_work() NFSv4.0: Fix a use-after-free problem in the asynchronous open() um: Fix the return value of elf_core_copy_task_fpregs rpmsg: glink: Propagate TX failures in intentless mode as well NFSD: Prevent a potential integer overflow lib: string_helpers: silence snprintf() output truncation warning usb: dwc3: gadget: Fix checking for number of TRBs left media: wl128x: Fix atomicity violation in fmc_send_cmd() HID: wacom: Interpret tilt data from Intuos Pro BT as signed values block: fix ordering between checking BLK_MQ_S_STOPPED request adding arm64: tls: Fix context-switching of tpidrro_el0 when kpti is enabled sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK um: vector: Do not use drvdata in release serial: 8250: omap: Move pm_runtime_get_sync um: net: Do not use drvdata in release um: ubd: Do not use drvdata in release ubi: wl: Put source PEB into correct list if trying locking LEB failed spi: Fix acpi deferred irq probe netfilter: ipset: add missing range check in bitmap_ip_uadt Revert "serial: sh-sci: Clean sci_ports[0] after at earlycon exit" serial: sh-sci: Clean sci_ports[0] after at earlycon exit Revert "usb: gadget: composite: fix OS descriptors w_value logic" ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}() tty: ldsic: fix tty_ldisc_autoload sysctl's proc_handler PCI: Fix use-after-free of slot->bus on hot remove ASoC: codecs: Fix atomicity violation in snd_soc_component_get_drvdata() jfs: xattr: check invalid xattr size more strictly ext4: fix FS_IOC_GETFSMAP handling ext4: supress data-race warnings in ext4_free_inodes_{count,set}() usb: ehci-spear: fix call balance of sehci clk handling routines apparmor: fix 'Do simple duplicate message elimination' misc: apds990x: Fix missing pm_runtime_disable() USB: chaoskey: Fix possible deadlock chaoskey_list_lock USB: chaoskey: fail open after removal usb: using mutex lock and supporting O_NONBLOCK flag in iowarrior_read() net: stmmac: dwmac-socfpga: Set RX watchdog interrupt as broken marvell: pxa168_eth: fix call balance of pep->clk handling routines net: usb: lan78xx: Fix refcounting and autosuspend on invalid WoL configuration tg3: Set coherent DMA mask bits to 31 for BCM57766 chipsets net: usb: lan78xx: Fix memory leak on device unplug by freeing PHY device power: supply: core: Remove might_sleep() from power_supply_put() vfio/pci: Properly hide first-in-list PCIe extended capability NFSD: Cap the number of bytes copied by nfs4_reset_recoverydir() NFSD: Prevent NULL dereference in nfsd4_process_cb_update() rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length rpmsg: glink: Fix GLINK command prefix rpmsg: glink: Send READ_NOTIFY command in FIFO full case rpmsg: glink: Add TX_DATA_CONT command while sending m68k: coldfire/device.c: only build FEC when HW macros are defined m68k: mcfgpio: Fix incorrect register offset for CONFIG_M5441x PCI: cpqphp: Fix PCIBIOS_* return value confusion PCI: cpqphp: Use PCI_POSSIBLE_ERROR() to check config reads perf probe: Correct demangled symbols in C++ program clk: clk-axi-clkgen: make sure to enable the AXI bus clock clk: axi-clkgen: use devm_platform_ioremap_resource() short-hand dt-bindings: clock: axi-clkgen: include AXI clk dt-bindings: clock: adi,axi-clkgen: convert old binding to yaml format fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem() fbdev/sh7760fb: Alloc DMA memory from hardware device powerpc/sstep: make emulate_vsx_load and emulate_vsx_store static ocfs2: fix uninitialized value in ocfs2_file_read_iter() scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb() scsi: fusion: Remove unused variable 'rc' scsi: bfa: Fix use-after-free in bfad_im_module_exit() mfd: rt5033: Fix missing regmap_del_irq_chip() RDMA/bnxt_re: Check cqe flags to know imm_data vs inv_irkey mtd: rawnand: atmel: Fix possible memory leak cpufreq: loongson2: Unregister platform_driver on failure mfd: da9052-spi: Change read-mask to write-mask powerpc/vdso: Flag VDSO64 entry points as functions trace/trace_event_perf: remove duplicate samples on the first tracepoint event netpoll: Use rcu_access_pointer() in netpoll_poll_lock ALSA: 6fire: Release resources at card release ALSA: caiaq: Use snd_card_free_when_closed() at disconnection ALSA: us122l: Use snd_card_free_when_closed() at disconnection net: rfkill: gpio: Add check for clk_enable() drm/etnaviv: hold GPU lock across perfmon sampling drm/etnaviv: fix power register offset on GC300 drm/etnaviv: dump: fix sparse warnings drm/etnaviv: consolidate hardware fence handling in etnaviv_gpu wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan() bpf: Fix the xdp_adjust_tail sample prog issue drm/omap: Fix locking in omap_gem_new_dmabuf() wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() drm/mm: Mark drm_mm_interval_tree*() functions with __maybe_unused firmware: arm_scpi: Check the DVFS OPP count returned by the firmware regmap: irq: Set lockdep class for hierarchical IRQ domains ARM: dts: cubieboard4: Fix DCDC5 regulator constraints mmc: mmc_spi: drop buggy snprintf() soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get() time: Fix references to _msecs_to_jiffies() handling of values crypto: cavium - Fix an error handling path in cpt_ucode_load_fw() crypto: bcm - add error check in the ahash_hmac_init function crypto: cavium - Fix the if condition to exit loop after timeout crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY EDAC/fsl_ddr: Fix bad bit shift operations hfsplus: don't query the device logical block size multiple times s390/syscalls: Avoid creation of arch/arch/ directory acpi/arm64: Adjust error handling procedure in gtdt_parse_timer_block() m68k: mvme147: Reinstate early console m68k: mvme16x: Add and use "mvme16x.h" m68k: mvme147: Fix SCSI controller IRQ numbers initramfs: avoid filename buffer overrun nvme: fix metadata handling in nvme-passthrough proc/softirqs: replace seq_printf with seq_put_decimal_ull_width net: usb: qmi_wwan: add Quectel RG650V x86/amd_nb: Fix compile-testing without CONFIG_AMD_NB selftests/watchdog-test: Fix system accidentally reset after watchdog-test mac80211: fix user-power when emulating chanctx ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet mm: revert "mm: shmem: fix data-race in shmem_getattr()" kbuild: Use uname for LINUX_COMPILE_HOST detection media: dvbdev: fix the logic when DVB_DYNAMIC_MINORS is not set Revert "mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K" nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint ocfs2: fix UBSAN warning in ocfs2_verify_volume() nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint ocfs2: uncache inode which has failed entering the group netlink: terminate outstanding dump on socket close Linux 4.19.324 9p: fix slab cache name creation for real net: usb: qmi_wwan: add Fibocom FG132 0x0112 composition fs: Fix uninitialized value issue in from_kuid and from_kgid powerpc/powernv: Free name on error in opal_event_init() sound: Make CONFIG_SND depend on INDIRECT_IOMEM instead of UML bpf: use kvzmalloc to allocate BPF verifier environment HID: multitouch: Add quirk for HONOR MagicBook Art 14 touchpad 9p: Avoid creating multiple slab caches with the same name ALSA: usb-audio: Add endianness annotations vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer ALSA: usb-audio: Add quirks for Dell WD19 dock ALSA: usb-audio: Support jack detection on Dell dock ALSA: usb-audio: Add custom mixer status quirks for RME CC devices ALSA: pcm: Return 0 when size < start_threshold in capture ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove() irqchip/gic-v3: Force propagation of the active state with a read-back USB: serial: option: add Quectel RG650V USB: serial: option: add Fibocom FG132 0x0112 composition USB: serial: qcserial: add support for Sierra Wireless EM86xx USB: serial: io_edgeport: fix use after free in debug printk usb: musb: sunxi: Fix accessing an released usb phy fs/proc: fix compile warning about variable 'vmcore_mmap_ops' media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format net: bridge: xmit: make sure we have at least eth header len bytes bonding (gcc13): synchronize bond_{a,t}lb_xmit() types btrfs: reinitialize delayed ref list after deleting it from the list nfs: Fix KMSAN warning in decode_getfattr_attrs() dm-unstriped: cast an operand to sector_t to prevent potential uint32_t overflow dm cache: fix potential out-of-bounds access on the first resume dm cache: optimize dirty bit checking with find_next_bit when resizing dm cache: fix out-of-bounds access to the dirty bitset when resizing dm cache: correct the number of origin blocks to match the target length drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read() media: v4l2-tpg: prevent the risk of a division by zero media: cx24116: prevent overflows on SNR calculus media: s5p-jpeg: prevent buffer overflows ALSA: firewire-lib: fix return value on fail in amdtp_tscm_init() media: adv7604: prevent underflow condition when reporting colorspace media: dvb_frontend: don't play tricks with underflow values media: dvbdev: prevent the risk of out of memory access media: stb0899_algo: initialize cfr before using it net: hns3: fix kernel crash when uninstalling driver can: c_can: fix {rx,tx}_errors statistics sctp: properly validate chunk size in sctp_sf_ootb() security/keys: fix slab-out-of-bounds in key_task_permission HID: core: zero-initialize the report buffer ARM: dts: rockchip: Fix the realtek audio codec on rk3036-kylin ARM: dts: rockchip: drop grf reference from rk3036 hdmi ARM: dts: rockchip: fix rk3036 acodec node arm64: dts: rockchip: Fix rt5651 compatible value on rk3399-sapphire-excavator Linux 4.19.323 vt: prevent kernel-infoleak in con_font_get() mm: shmem: fix data-race in shmem_getattr() nilfs2: fix kernel bug due to missing clearing of checked flag ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow nilfs2: fix potential deadlock with newly created symlinks wifi: iwlegacy: Clear stale interrupts before resuming device wifi: ath10k: Fix memory leak in management tx wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower Revert "driver core: Fix uevent_show() vs driver detach race" xhci: Fix Link TRB DMA in command ring stopped completion event usb: phy: Fix API devm_usb_put_phy() can not release the phy usbip: tools: Fix detach_port() invalid port error path misc: sgi-gru: Don't disable preemption in GRU driver net: amd: mvme147: Fix probe banner message firmware: arm_sdei: Fix the input parameter of cpuhp_remove_state() netfilter: nft_payload: sanitize offset and length before calling skb_checksum() net: skip offload for NETIF_F_IPV6_CSUM if ipv6 header contains extension net: support ip generic csum processing in skb_csum_hwoffload_help bpf: Fix out-of-bounds write in trie_get_next_key() net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT gtp: allow -1 to be specified as file description from userspace gtp: simplify error handling code in 'gtp_encap_enable()' wifi: mac80211: skip non-uploaded keys in ieee80211_iter_keys cgroup: Fix potential overflow issue when checking max_depth usb: dwc3: core: Stop processing of pending events if controller is halted usb: dwc3: Add splitdisable quirk for Hisilicon Kirin Soc usb: dwc3: remove generic PHY calibrate() calls xfrm: validate new SA's prefixlen using SA family when sel.family is unset arm64/uprobes: change the uprobe_opcode_t typedef to fix the sparse warning selinux: improve error checking in sel_write_load() hv_netvsc: Fix VF namespace also in synthetic NIC NETDEV_REGISTER event nilfs2: fix kernel bug due to missing clearing of buffer delay flag ACPI: button: Add DMI quirk for Samsung Galaxy Book2 to fix initial lid detection issue drm/amd: Guard against bad data for ATIF ACPI method ALSA: hda/realtek: Update default depop procedure posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime() net: usb: usbnet: fix name regression be2net: fix potential memory leak in be_xmit() net/sun3_82586: fix potential memory leak in sun3_82586_send_packet() jfs: Fix sanity check in dbMount udf: fix uninit-value use in udf_get_fileshortad KVM: s390: gaccess: Check if guest address is in memslot KVM: s390: gaccess: Cleanup access to guest pages KVM: s390: gaccess: Refactor access address range check KVM: s390: gaccess: Refactor gpa and length calculation arm64: probes: Fix uprobes for big-endian kernels arm64:uprobe fix the uprobe SWBP_INSN in big-endian Bluetooth: bnep: fix wild-memory-access in proto_unregister usb: typec: altmode should keep reference to parent net: systemport: fix potential memory leak in bcm_sysport_xmit() net: ethernet: aeroflex: fix potential memory leak in greth_start_xmit_gbit() macsec: don't increment counters for an unrelated SA drm/msm/dsi: fix 32-bit signed integer extension in pclk_rate calculation RDMA/bnxt_re: Return more meaningful error RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP RDMA/bnxt_re: Fix incorrect AVID type in WQE structure clk: Fix slab-out-of-bounds error in devm_clk_release() clk: Fix pointer casting to prevent oops in devm_clk_release() nilfs2: propagate directory read errors from nilfs_find_entry() x86/apic: Always explicitly disarm TSC-deadline timer parport: Proper fix for array out-of-bounds access USB: serial: option: add Telit FN920C04 MBIM compositions USB: serial: option: add support for Quectel EG916Q-GL xhci: Fix incorrect stream context type macro Bluetooth: btusb: Fix regression with fake CSR controllers 0a12:0001 Bluetooth: Remove debugfs directory on module init failure iio: light: opt3001: add missing full-scale range value iio: hid-sensors: Fix an error handling path in _hid_sensor_set_report_latency() iio: adc: ti-ads8688: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig iio: dac: stm32-dac-core: add missing select REGMAP_MMIO in Kconfig drm/vmwgfx: Handle surface check failure correctly x86/cpufeatures: Define X86_FEATURE_AMD_IBPB_RET KVM: s390: Change virtual to physical address access in diag 0x258 handler s390/sclp_vt220: Convert newlines to CRLF instead of LFCR net: dsa: mv88e6xxx: Fix out-of-bound access KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() fat: fix uninitialized variable PCI: Add function 0 DMA alias quirk for Glenfly Arise chip arm64: probes: Fix simulate_ldr*_literal() arm64: probes: Remove broken LDR (literal) uprobe support posix-clock: Fix missing timespec64 check in pc_clock_settime() net: Fix an unsafe loop on the list usb: storage: ignore bogus device raised by JieLi BR21 USB sound chip usb: xhci: Fix problem with xhci resume from suspend Revert "usb: yurex: Replace snprintf() with the safer scnprintf() variant" HID: plantronics: Workaround for an unexcepted opposite volume key CDC-NCM: avoid overflow in sanity checking net: ipv6: ensure we call ipv6_mc_down() at most once ppp: fix ppp_async_encode() illegal access net: ibm: emac: mal: fix wrong goto igb: Do not bring the device up after non-fatal error gpio: aspeed: Use devm_clk api to manage clock source clk: Provide new devm_clk helpers for prepared and enabled clocks clk: generalize devm_clk_get() a bit clk: Add (devm_)clk_get_optional() functions gpio: aspeed: Add the flush write to ensure the write complete. Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change netfilter: br_netfilter: fix panic with metadata_dst skb tcp: fix tcp_enter_recovery() to zero retrans_stamp when it's safe SUNRPC: Fix integer overflow in decode_rc_list() NFS: Remove print_overflow_msg() fbdev: sisfb: Fix strbuf array overflow driver core: bus: Return -EIO instead of 0 when show/store invalid bus attribute tools/iio: Add memory allocation failure check for trigger_name usb: chipidea: udc: enable suspend interrupt after usb reset media: videobuf2-core: clear memory related fields in __vb2_plane_dmabuf_put() PCI: Mark Creative Labs EMU20k2 INTx masking as broken i2c: i801: Use a different adapter-name for IDF adapters clk: bcm: bcm53573: fix OF node leak in init ktest.pl: Avoid false positives with grub2 skip regex s390/cpum_sf: Remove WARN_ON_ONCE statements ext4: nested locking for xattr inode s390/mm: Add cond_resched() to cmm_alloc/free_pages() s390/facility: Disable compile time optimization for decompressor code bpf: Check percpu map value size first Input: synaptics-rmi4 - fix UAF of IRQ domain on driver removal virtio_console: fix misc probe bugs drm/crtc: fix uninitialized variable use even harder drm: Move drm_mode_setcrtc() local re-init to failure path tracing: Remove precision vsnprintf() check from print event net: ethernet: cortina: Drop TSO support ext4: fix inode tree inconsistency caused by ENOMEM ACPI: battery: Fix possible crash when unregistering a battery hook ACPI: battery: Simplify battery hook locking rtc: at91sam9: fix OF node leak in probe() error path rtc: at91sam9: drop platform_data support nfsd: fix delegation_blocked() to block correctly for at least 30 seconds nfsd: use ktime_get_seconds() for timestamps uprobes: fix kernel info leak via "[uprobes]" vma arm64: errata: Expand speculative SSBS workaround once more arm64: cputype: Add Neoverse-N3 definitions arm64: Add Cortex-715 CPU part definition ext4: update orig_path in ext4_find_extent() ext4: fix slab-use-after-free in ext4_split_extent_at() ext4: avoid ext4_error()'s caused by ENOMEM in the truncate path gpio: davinci: fix lazy disable btrfs: wait for fixup workers before stopping cleaner kthread during umount Input: adp5589-keys - fix adp5589_gpio_get_value() tomoyo: fallback to realpath if symlink's pathname does not exist iio: magnetometer: ak8975: Fix reading for ak099xx sensors media: venus: fix use after free bug in venus_remove due to race condition media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags clk: rockchip: fix error for unknown clocks aoe: fix the potential use-after-free problem in more places riscv: define ILLEGAL_POINTER_VALUE for 64bit ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate ocfs2: fix null-ptr-deref when journal load failed. ocfs2: remove unreasonable unlock in ocfs2_read_blocks ocfs2: cancel dqi_sync_work before freeing oinfo ocfs2: reserve space for inline xattr before attaching reflink tree ocfs2: fix uninit-value in ocfs2_get_block() ocfs2: fix the la space leak when unmounting an ocfs2 volume jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error of/irq: Support #msi-cells=<0> in of_msi_get_domain parisc: Fix 64-bit userspace syscall path ext4: fix incorrect tid assumption in ext4_wait_for_tail_page_commit() ext4: fix double brelse() the buffer of the extents path ext4: aovid use-after-free in ext4_ext_insert_extent() ext4: fix incorrect tid assumption in __jbd2_log_wait_for_space() ext4: propagate errors from ext4_find_extent() in ext4_insert_range() ext4: no need to continue when the number of entries is 1 ALSA: core: add isascii() check to card ID generator parisc: Fix itlb miss handler for 64-bit programs perf/core: Fix small negative period being ignored spi: bcm63xx: Fix module autoloading i2c: xiic: Wait for TX empty to avoid missed TX NAKs selftests: vDSO: fix vDSO symbols lookup for powerpc64 selftests: breakpoints: use remaining time to check if suspend succeed spi: s3c64xx: fix timeout counters in flush_fifo ext4: fix i_data_sem unlock order in ext4_ind_migrate() ext4: ext4_search_dir should return a proper error of/irq: Refer to actual buffer size in of_irq_parse_one() drm/radeon/r100: Handle unknown family in r100_cp_init_microcode() scsi: aacraid: Rearrange order of struct aac_srb_unit drm/printer: Allow NULL data in devcoredump printer drm/amd/display: Fix index out of bounds in degamma hardware format translation drm/amd/display: Check stream before comparing them jfs: Fix uninit-value access of new_ea in ea_buffer jfs: check if leafidx greater than num leaves per dmap tree jfs: Fix uaf in dbFreeBits jfs: UBSAN: shift-out-of-bounds in dbFindBits ata: sata_sil: Rename sil_blacklist to sil_quirks power: reset: brcmstb: Do not go into infinite loop if reset fails fbdev: pxafb: Fix possible use after free in pxafb_task() ALSA: hdsp: Break infinite MIDI input flush loop ALSA: asihpi: Fix potential OOB array access signal: Replace BUG_ON()s wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext() ACPICA: iasl: handle empty connection_node tcp: avoid reusing FIN_WAIT2 when trying to find port in connect() process ipv4: Mask upper DSCP bits and ECN bits in NETLINK_FIB_LOOKUP family ipv4: Check !in_dev earlier for ioctl(SIOCSIFADDR). net: mvpp2: Increase size of queue_name buffer tipc: guard against string buffer overrun ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package() ACPI: EC: Do not release locks during operation region accesses ACPICA: Fix memory leak if acpi_ps_get_next_field() fails ACPICA: Fix memory leak if acpi_ps_get_next_namepath() fails net: hisilicon: hns_mdio: fix OF node leak in probe() net: hisilicon: hns_dsaf_mac: fix OF node leak in hns_mac_get_info() net: hisilicon: hip04: fix OF node leak in probe() wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit wifi: ath9k: fix possible integer overflow in ath9k_get_et_stats() f2fs: Require FMODE_WRITE for atomic write ioctls ALSA: hda/conexant: Fix conflicting quirk for System76 Pangolin ALSA: hda/generic: Unconditionally prefer preferred_dacs pairs sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start ipv4: ip_gre: Fix drops of small packets in ipgre_xmit net: add more sanity checks to qdisc_pkt_len_init() net: avoid potential underflow in qdisc_pkt_len_init() with UFO net: ethernet: lantiq_etop: fix memory disclosure r8152: Factor out OOB link list waits netfilter: nf_tables: prevent nf_skb_duplicated corruption netfilter: uapi: NFTA_FLOWTABLE_HOOK is NLA_NESTED ceph: remove the incorrect Fw reference check when dirtying pages mailbox: bcm2835: Fix timeout during suspend mode mailbox: rockchip: fix a typo in module autoloading usb: yurex: Fix inconsistent locking bug in yurex_read() i2c: isch: Add missed 'else' i2c: aspeed: Update the stop sw state when the bus recovery occurs pps: add an error check in parport_attach pps: remove usage of the deprecated ida_simple_xx() API USB: misc: yurex: fix race between read and write usb: yurex: Replace snprintf() with the safer scnprintf() variant soc: versatile: realview: fix soc_dev leak during device remove soc: versatile: realview: fix memory leak during device remove PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler PCI: xilinx-nwl: Use irq_data_get_irq_chip_data() nfs: fix memory leak in error path of nfs4_do_reclaim fs: Fix file_set_fowner LSM hook inconsistencies vfs: fix race between evice_inodes() and find_inode()&iput() f2fs: avoid potential int overflow in sanity_check_area_boundary() f2fs: prevent possible int overflow in dir_block_index() ACPI: sysfs: validate return type of _STR method drbd: Add NULL check for net_conf to prevent dereference in state validation drbd: Fix atomicity violation in drbd_uuid_set_bm() tty: rp2: Fix reset with non forgiving PCIe host bridges firmware_loader: Block path traversal USB: misc: cypress_cy7c63: check for short transfer USB: appledisplay: close race between probe and completion handler soc: versatile: integrator: fix OF node leak in probe() error path Remove *.orig pattern from .gitignore crypto: aead,cipher - zeroize key buffer after use netfilter: ctnetlink: compile ctnetlink_label_size with CONFIG_NF_CONNTRACK_EVENTS net: qrtr: Update packets cloning when broadcasting tcp: check skb is non-NULL in tcp_rto_delta_us() tcp: introduce tcp_skb_timestamp_us() helper net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() coresight: tmc: sg: Do not leak sg_table f2fs: reduce expensive checkpoint trigger frequency f2fs: remove unneeded check condition in __f2fs_setxattr() f2fs: fix to update i_ctime in __f2fs_setxattr() f2fs: fix typo f2fs: enhance to update i_mode and acl atomically in f2fs_setattr() nfsd: call cache_put if xdr_reserve_space returns NULL ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir() RDMA/cxgb4: Added NULL check for lookup_atid pinctrl: mvebu: Fix devinit_dove_pinctrl_probe function clk: ti: dra7-atl: Fix leak of of_nodes pinctrl: single: fix missing error code in pcs_probe() RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency PCI: xilinx-nwl: Fix register misspelling drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error clk: rockchip: Set parent rate for DCLK_VOP clock on RK3228 perf time-utils: Fix 32-bit nsec parsing perf sched timehist: Fixed timestamp error when unable to confirm event sched_in time perf sched timehist: Fix missing free of session in perf_sched__timehist() nilfs2: fix potential oob read in nilfs_btree_check_delete() nilfs2: determine empty node blocks as corrupted nilfs2: fix potential null-ptr-deref in nilfs_btree_insert() ext4: avoid OOB when system.data xattr changes underneath the filesystem ext4: return error on ext4_find_inline_entry ext4: avoid negative min_clusters in find_group_orlov() smackfs: Use rcu_assign_pointer() to ensure safe assignment in smk_set_cipso ext4: clear EXT4_GROUP_INFO_WAS_TRIMMED_BIT even mount with discard jbd2: introduce/export functions jbd2_journal_submit|finish_inode_data_buffers() kthread: fix task state in kthread worker if being frozen kthread: add kthread_work tracepoints xz: cleanup CRC32 edits from 2018 selftests/bpf: Fix error compiling test_lru_map.c xen/swiotlb: add alignment check for dma buffers xen/swiotlb: simplify range_straddles_page_boundary() xen: use correct end address of kernel for conflict checking drm/msm: fix %s null argument error ipmi: docs: don't advertise deprecated sysfs entries drm/msm/a5xx: fix races in preemption evaluation stage drm/msm/a5xx: properly clear preemption records on resume jfs: fix out-of-bounds in dbNextAG() and diAlloc() drm/radeon/evergreen_cs: fix int overflow errors in cs track offsets drm/rockchip: vop: Allow 4096px width scaling drm/radeon: properly handle vbios fake edid sizing drm/radeon: Replace one-element array with flexible-array member drm/amdgpu: properly handle vbios fake edid sizing drm/amdgpu: Replace one-element array with flexible-array member drm/amd: fix typo drm/stm: Fix an error handling path in stm_drm_platform_probe() fbdev: hpfb: Fix an error handling path in hpfb_dio_probe() power: supply: max17042_battery: Fix SOC threshold calc w/ no current sense hwmon: (ntc_thermistor) fix module autoloading mtd: slram: insert break after errors in parsing the map hwmon: (max16065) Fix overflows seen when writing limits clocksource/drivers/qcom: Add missing iounmap() on errors in msm_dt_timer_init() reset: berlin: fix OF node leak in probe() error path ARM: versatile: fix OF node leak in CPUs prepare spi: ppc4xx: Avoid returning 0 when failed to parse and map IRQ spi: ppc4xx: handle irq_of_parse_and_map() errors block, bfq: don't break merge chain in bfq_split_bfqq() block, bfq: choose the last bfqq from merge chain in bfq_setup_cooperator() block, bfq: fix possible UAF for bfqq->bic with merge chain Bluetooth: btusb: Fix not handling ZPL/short-transfer can: bcm: Clear bo->bcm_proc_read after remove_proc_entry(). wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop() wifi: cfg80211: fix two more possible UBSAN-detected off-by-one errors wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan() netfilter: nf_tables: elements with timeout below CONFIG_HZ never expire wifi: ath9k: Remove error checks when creating debugfs entries wifi: ath9k: fix parameter check in ath9k_init_debug() ACPI: PMIC: Remove unneeded check in tps68470_pmic_opregion_probe() USB: serial: pl2303: add device id for Macrosilicon MS3020 gpio: prevent potential speculation leaks in gpio_device_get_desc() ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry() ocfs2: add bounds checking to ocfs2_xattr_find_entry() x86/hyperv: Set X86_FEATURE_TSC_KNOWN_FREQ when Hyper-V provides frequency spi: bcm63xx: Enable module autoloading ASoC: tda7419: fix module autoloading wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead wifi: iwlwifi: mvm: fix iwl_mvm_max_scan_ie_fw_cmd_room() net: ftgmac100: Ensure tx descriptor updates are visible microblaze: don't treat zero reserved memory regions as error pinctrl: at91: make it work with current gpiolib ASoC: allow module autoloading for table db1200_pids selftests/kcmp: remove call to ksft_set_plan() selftests/vm: remove call to ksft_set_plan() soundwire: stream: Revert "soundwire: stream: fix programming slave ports for non-continous port maps" net: dpaa: Pad packets to ETH_ZLEN net: ftgmac100: Enable TX interrupt to avoid TX timeout net/mlx5: Update the list of the PCI supported devices arm64: dts: rockchip: override BIOS_DISABLE signal via GPIO hog on RK3399 Puma scripts: kconfig: merge_config: config files: add a trailing newline net: phy: vitesse: repair vsc73xx autonegotiation net: ethernet: use ip_hdrlen() instead of bit shift usbnet: ipheth: fix carrier detection in modes 1 and 4 staging: iio: frequency: ad9834: Validate frequency parameter value staging: iio: frequency: ad9833: Load clock using clock framework staging: iio: frequency: ad9833: Get frequency value statically Change-Id: Id96e4bf331d59a5f3f52791887390bc747dc31cb Signed-off-by: bengris32 <bengris32@protonmail.ch> |
||
|
Greg Kroah-Hartman
|
874391c94e |
Merge 4.19.325 into android-4.19-stable
Changes in 4.19.325
netlink: terminate outstanding dump on socket close
ocfs2: uncache inode which has failed entering the group
nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint
ocfs2: fix UBSAN warning in ocfs2_verify_volume()
nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint
Revert "mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K"
media: dvbdev: fix the logic when DVB_DYNAMIC_MINORS is not set
kbuild: Use uname for LINUX_COMPILE_HOST detection
mm: revert "mm: shmem: fix data-race in shmem_getattr()"
ASoC: Intel: bytcr_rt5640: Add DMI quirk for Vexia Edu Atla 10 tablet
mac80211: fix user-power when emulating chanctx
selftests/watchdog-test: Fix system accidentally reset after watchdog-test
x86/amd_nb: Fix compile-testing without CONFIG_AMD_NB
net: usb: qmi_wwan: add Quectel RG650V
proc/softirqs: replace seq_printf with seq_put_decimal_ull_width
nvme: fix metadata handling in nvme-passthrough
initramfs: avoid filename buffer overrun
m68k: mvme147: Fix SCSI controller IRQ numbers
m68k: mvme16x: Add and use "mvme16x.h"
m68k: mvme147: Reinstate early console
acpi/arm64: Adjust error handling procedure in gtdt_parse_timer_block()
s390/syscalls: Avoid creation of arch/arch/ directory
hfsplus: don't query the device logical block size multiple times
EDAC/fsl_ddr: Fix bad bit shift operations
crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY
crypto: cavium - Fix the if condition to exit loop after timeout
crypto: bcm - add error check in the ahash_hmac_init function
crypto: cavium - Fix an error handling path in cpt_ucode_load_fw()
time: Fix references to _msecs_to_jiffies() handling of values
soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get()
mmc: mmc_spi: drop buggy snprintf()
ARM: dts: cubieboard4: Fix DCDC5 regulator constraints
regmap: irq: Set lockdep class for hierarchical IRQ domains
firmware: arm_scpi: Check the DVFS OPP count returned by the firmware
drm/mm: Mark drm_mm_interval_tree*() functions with __maybe_unused
wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service()
drm/omap: Fix locking in omap_gem_new_dmabuf()
bpf: Fix the xdp_adjust_tail sample prog issue
wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan()
drm/etnaviv: consolidate hardware fence handling in etnaviv_gpu
drm/etnaviv: dump: fix sparse warnings
drm/etnaviv: fix power register offset on GC300
drm/etnaviv: hold GPU lock across perfmon sampling
net: rfkill: gpio: Add check for clk_enable()
ALSA: us122l: Use snd_card_free_when_closed() at disconnection
ALSA: caiaq: Use snd_card_free_when_closed() at disconnection
ALSA: 6fire: Release resources at card release
netpoll: Use rcu_access_pointer() in netpoll_poll_lock
trace/trace_event_perf: remove duplicate samples on the first tracepoint event
powerpc/vdso: Flag VDSO64 entry points as functions
mfd: da9052-spi: Change read-mask to write-mask
cpufreq: loongson2: Unregister platform_driver on failure
mtd: rawnand: atmel: Fix possible memory leak
RDMA/bnxt_re: Check cqe flags to know imm_data vs inv_irkey
mfd: rt5033: Fix missing regmap_del_irq_chip()
scsi: bfa: Fix use-after-free in bfad_im_module_exit()
scsi: fusion: Remove unused variable 'rc'
scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()
ocfs2: fix uninitialized value in ocfs2_file_read_iter()
powerpc/sstep: make emulate_vsx_load and emulate_vsx_store static
fbdev/sh7760fb: Alloc DMA memory from hardware device
fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem()
dt-bindings: clock: adi,axi-clkgen: convert old binding to yaml format
dt-bindings: clock: axi-clkgen: include AXI clk
clk: axi-clkgen: use devm_platform_ioremap_resource() short-hand
clk: clk-axi-clkgen: make sure to enable the AXI bus clock
perf probe: Correct demangled symbols in C++ program
PCI: cpqphp: Use PCI_POSSIBLE_ERROR() to check config reads
PCI: cpqphp: Fix PCIBIOS_* return value confusion
m68k: mcfgpio: Fix incorrect register offset for CONFIG_M5441x
m68k: coldfire/device.c: only build FEC when HW macros are defined
rpmsg: glink: Add TX_DATA_CONT command while sending
rpmsg: glink: Send READ_NOTIFY command in FIFO full case
rpmsg: glink: Fix GLINK command prefix
rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length
NFSD: Prevent NULL dereference in nfsd4_process_cb_update()
NFSD: Cap the number of bytes copied by nfs4_reset_recoverydir()
vfio/pci: Properly hide first-in-list PCIe extended capability
power: supply: core: Remove might_sleep() from power_supply_put()
net: usb: lan78xx: Fix memory leak on device unplug by freeing PHY device
tg3: Set coherent DMA mask bits to 31 for BCM57766 chipsets
net: usb: lan78xx: Fix refcounting and autosuspend on invalid WoL configuration
marvell: pxa168_eth: fix call balance of pep->clk handling routines
net: stmmac: dwmac-socfpga: Set RX watchdog interrupt as broken
usb: using mutex lock and supporting O_NONBLOCK flag in iowarrior_read()
USB: chaoskey: fail open after removal
USB: chaoskey: Fix possible deadlock chaoskey_list_lock
misc: apds990x: Fix missing pm_runtime_disable()
apparmor: fix 'Do simple duplicate message elimination'
usb: ehci-spear: fix call balance of sehci clk handling routines
ext4: supress data-race warnings in ext4_free_inodes_{count,set}()
ext4: fix FS_IOC_GETFSMAP handling
jfs: xattr: check invalid xattr size more strictly
ASoC: codecs: Fix atomicity violation in snd_soc_component_get_drvdata()
PCI: Fix use-after-free of slot->bus on hot remove
tty: ldsic: fix tty_ldisc_autoload sysctl's proc_handler
Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}()
ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices
Revert "usb: gadget: composite: fix OS descriptors w_value logic"
serial: sh-sci: Clean sci_ports[0] after at earlycon exit
Revert "serial: sh-sci: Clean sci_ports[0] after at earlycon exit"
netfilter: ipset: add missing range check in bitmap_ip_uadt
spi: Fix acpi deferred irq probe
ubi: wl: Put source PEB into correct list if trying locking LEB failed
um: ubd: Do not use drvdata in release
um: net: Do not use drvdata in release
serial: 8250: omap: Move pm_runtime_get_sync
um: vector: Do not use drvdata in release
sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
arm64: tls: Fix context-switching of tpidrro_el0 when kpti is enabled
block: fix ordering between checking BLK_MQ_S_STOPPED request adding
HID: wacom: Interpret tilt data from Intuos Pro BT as signed values
media: wl128x: Fix atomicity violation in fmc_send_cmd()
usb: dwc3: gadget: Fix checking for number of TRBs left
lib: string_helpers: silence snprintf() output truncation warning
NFSD: Prevent a potential integer overflow
rpmsg: glink: Propagate TX failures in intentless mode as well
um: Fix the return value of elf_core_copy_task_fpregs
NFSv4.0: Fix a use-after-free problem in the asynchronous open()
rtc: check if __rtc_read_time was successful in rtc_timer_do_work()
ubifs: Correct the total block count by deducting journal reservation
ubi: fastmap: Fix duplicate slab cache names while attaching
jffs2: fix use of uninitialized variable
block: return unsigned int from bdev_io_min
9p/xen: fix init sequence
9p/xen: fix release of IRQ
modpost: remove incorrect code in do_eisa_entry()
sh: intc: Fix use-after-free bug in register_intc_controller()
Linux 4.19.325
Change-Id: I50250c8bd11f9ff4b40da75225c1cfb060e0c258
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
|
||
|
Jason Gerecke
|
bcfa652eac |
HID: wacom: Interpret tilt data from Intuos Pro BT as signed values
commit 49a397ad24ee5e2c53a59dada2780d7e71bd3f77 upstream.
The tilt data contained in the Bluetooth packets of an Intuos Pro are
supposed to be interpreted as signed values. Simply casting the values
to type `char` is not guaranteed to work since it is implementation-
defined whether it is signed or unsigned. At least one user has noticed
the data being reported incorrectly on their system. To ensure that the
data is interpreted properly, we specifically cast to `signed char`
instead.
Link: https://github.com/linuxwacom/input-wacom/issues/445
Fixes:
|
||
|
Greg Kroah-Hartman
|
4f94b88d7d |
Merge 4.19.324 into android-4.19-stable
Changes in 4.19.324
arm64: dts: rockchip: Fix rt5651 compatible value on rk3399-sapphire-excavator
ARM: dts: rockchip: fix rk3036 acodec node
ARM: dts: rockchip: drop grf reference from rk3036 hdmi
ARM: dts: rockchip: Fix the realtek audio codec on rk3036-kylin
HID: core: zero-initialize the report buffer
security/keys: fix slab-out-of-bounds in key_task_permission
sctp: properly validate chunk size in sctp_sf_ootb()
can: c_can: fix {rx,tx}_errors statistics
net: hns3: fix kernel crash when uninstalling driver
media: stb0899_algo: initialize cfr before using it
media: dvbdev: prevent the risk of out of memory access
media: dvb_frontend: don't play tricks with underflow values
media: adv7604: prevent underflow condition when reporting colorspace
ALSA: firewire-lib: fix return value on fail in amdtp_tscm_init()
media: s5p-jpeg: prevent buffer overflows
media: cx24116: prevent overflows on SNR calculus
media: v4l2-tpg: prevent the risk of a division by zero
drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()
drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported
dm cache: correct the number of origin blocks to match the target length
dm cache: fix out-of-bounds access to the dirty bitset when resizing
dm cache: optimize dirty bit checking with find_next_bit when resizing
dm cache: fix potential out-of-bounds access on the first resume
dm-unstriped: cast an operand to sector_t to prevent potential uint32_t overflow
nfs: Fix KMSAN warning in decode_getfattr_attrs()
btrfs: reinitialize delayed ref list after deleting it from the list
bonding (gcc13): synchronize bond_{a,t}lb_xmit() types
net: bridge: xmit: make sure we have at least eth header len bytes
media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format
fs/proc: fix compile warning about variable 'vmcore_mmap_ops'
usb: musb: sunxi: Fix accessing an released usb phy
USB: serial: io_edgeport: fix use after free in debug printk
USB: serial: qcserial: add support for Sierra Wireless EM86xx
USB: serial: option: add Fibocom FG132 0x0112 composition
USB: serial: option: add Quectel RG650V
irqchip/gic-v3: Force propagation of the active state with a read-back
ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove()
ALSA: pcm: Return 0 when size < start_threshold in capture
ALSA: usb-audio: Add custom mixer status quirks for RME CC devices
ALSA: usb-audio: Support jack detection on Dell dock
ALSA: usb-audio: Add quirks for Dell WD19 dock
hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer
vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans
ALSA: usb-audio: Add endianness annotations
9p: Avoid creating multiple slab caches with the same name
HID: multitouch: Add quirk for HONOR MagicBook Art 14 touchpad
bpf: use kvzmalloc to allocate BPF verifier environment
sound: Make CONFIG_SND depend on INDIRECT_IOMEM instead of UML
powerpc/powernv: Free name on error in opal_event_init()
fs: Fix uninitialized value issue in from_kuid and from_kgid
net: usb: qmi_wwan: add Fibocom FG132 0x0112 composition
9p: fix slab cache name creation for real
Linux 4.19.324
Change-Id: Ib8e7c89304d2c2cc72aea03446ea40a8704b41ec
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
|
||
|
WangYuli
|
52a1b77eb0 |
HID: multitouch: Add quirk for HONOR MagicBook Art 14 touchpad
[ Upstream commit 7a5ab8071114344f62a8b1e64ed3452a77257d76 ] The behavior of HONOR MagicBook Art 14 touchpad is not consistent after reboots, as sometimes it reports itself as a touchpad, and sometimes as a mouse. Similarly to GLO-GXXX it is possible to call MT_QUIRK_FORCE_GET_FEATURE as a workaround to force set feature in mt_set_input_mode() for such special touchpad device. [jkosina@suse.com: reword changelog a little bit] Link: https://gitlab.freedesktop.org/libinput/libinput/-/issues/1040 Signed-off-by: Wentao Guan <guanwentao@uniontech.com> Signed-off-by: WangYuli <wangyuli@uniontech.com> Reviewed-by: Benjamin Tissoires <bentiss@kernel.org> Signed-off-by: Jiri Kosina <jkosina@suse.com> Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
|
Jiri Kosina
|
e7ea60184e |
HID: core: zero-initialize the report buffer
[ Upstream commit 177f25d1292c7e16e1199b39c85480f7f8815552 ]
Since the report buffer is used by all kinds of drivers in various ways, let's
zero-initialize it during allocation to make sure that it can't be ever used
to leak kernel memory via specially-crafted report.
Fixes:
|
||
|
Greg Kroah-Hartman
|
2d76dea417 |
Merge 4.19.323 into android-4.19-stable
Changes in 4.19.323 staging: iio: frequency: ad9833: Get frequency value statically staging: iio: frequency: ad9833: Load clock using clock framework staging: iio: frequency: ad9834: Validate frequency parameter value usbnet: ipheth: fix carrier detection in modes 1 and 4 net: ethernet: use ip_hdrlen() instead of bit shift net: phy: vitesse: repair vsc73xx autonegotiation scripts: kconfig: merge_config: config files: add a trailing newline arm64: dts: rockchip: override BIOS_DISABLE signal via GPIO hog on RK3399 Puma net/mlx5: Update the list of the PCI supported devices net: ftgmac100: Enable TX interrupt to avoid TX timeout net: dpaa: Pad packets to ETH_ZLEN soundwire: stream: Revert "soundwire: stream: fix programming slave ports for non-continous port maps" selftests/vm: remove call to ksft_set_plan() selftests/kcmp: remove call to ksft_set_plan() ASoC: allow module autoloading for table db1200_pids pinctrl: at91: make it work with current gpiolib microblaze: don't treat zero reserved memory regions as error net: ftgmac100: Ensure tx descriptor updates are visible wifi: iwlwifi: mvm: fix iwl_mvm_max_scan_ie_fw_cmd_room() wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead ASoC: tda7419: fix module autoloading spi: bcm63xx: Enable module autoloading x86/hyperv: Set X86_FEATURE_TSC_KNOWN_FREQ when Hyper-V provides frequency ocfs2: add bounds checking to ocfs2_xattr_find_entry() ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry() gpio: prevent potential speculation leaks in gpio_device_get_desc() USB: serial: pl2303: add device id for Macrosilicon MS3020 ACPI: PMIC: Remove unneeded check in tps68470_pmic_opregion_probe() wifi: ath9k: fix parameter check in ath9k_init_debug() wifi: ath9k: Remove error checks when creating debugfs entries netfilter: nf_tables: elements with timeout below CONFIG_HZ never expire wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan() wifi: cfg80211: fix two more possible UBSAN-detected off-by-one errors wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop() can: bcm: Clear bo->bcm_proc_read after remove_proc_entry(). Bluetooth: btusb: Fix not handling ZPL/short-transfer block, bfq: fix possible UAF for bfqq->bic with merge chain block, bfq: choose the last bfqq from merge chain in bfq_setup_cooperator() block, bfq: don't break merge chain in bfq_split_bfqq() spi: ppc4xx: handle irq_of_parse_and_map() errors spi: ppc4xx: Avoid returning 0 when failed to parse and map IRQ ARM: versatile: fix OF node leak in CPUs prepare reset: berlin: fix OF node leak in probe() error path clocksource/drivers/qcom: Add missing iounmap() on errors in msm_dt_timer_init() hwmon: (max16065) Fix overflows seen when writing limits mtd: slram: insert break after errors in parsing the map hwmon: (ntc_thermistor) fix module autoloading power: supply: max17042_battery: Fix SOC threshold calc w/ no current sense fbdev: hpfb: Fix an error handling path in hpfb_dio_probe() drm/stm: Fix an error handling path in stm_drm_platform_probe() drm/amd: fix typo drm/amdgpu: Replace one-element array with flexible-array member drm/amdgpu: properly handle vbios fake edid sizing drm/radeon: Replace one-element array with flexible-array member drm/radeon: properly handle vbios fake edid sizing drm/rockchip: vop: Allow 4096px width scaling drm/radeon/evergreen_cs: fix int overflow errors in cs track offsets jfs: fix out-of-bounds in dbNextAG() and diAlloc() drm/msm/a5xx: properly clear preemption records on resume drm/msm/a5xx: fix races in preemption evaluation stage ipmi: docs: don't advertise deprecated sysfs entries drm/msm: fix %s null argument error xen: use correct end address of kernel for conflict checking xen/swiotlb: simplify range_straddles_page_boundary() xen/swiotlb: add alignment check for dma buffers selftests/bpf: Fix error compiling test_lru_map.c xz: cleanup CRC32 edits from 2018 kthread: add kthread_work tracepoints kthread: fix task state in kthread worker if being frozen jbd2: introduce/export functions jbd2_journal_submit|finish_inode_data_buffers() ext4: clear EXT4_GROUP_INFO_WAS_TRIMMED_BIT even mount with discard smackfs: Use rcu_assign_pointer() to ensure safe assignment in smk_set_cipso ext4: avoid negative min_clusters in find_group_orlov() ext4: return error on ext4_find_inline_entry ext4: avoid OOB when system.data xattr changes underneath the filesystem nilfs2: fix potential null-ptr-deref in nilfs_btree_insert() nilfs2: determine empty node blocks as corrupted nilfs2: fix potential oob read in nilfs_btree_check_delete() perf sched timehist: Fix missing free of session in perf_sched__timehist() perf sched timehist: Fixed timestamp error when unable to confirm event sched_in time perf time-utils: Fix 32-bit nsec parsing clk: rockchip: Set parent rate for DCLK_VOP clock on RK3228 drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error PCI: xilinx-nwl: Fix register misspelling RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency pinctrl: single: fix missing error code in pcs_probe() clk: ti: dra7-atl: Fix leak of of_nodes pinctrl: mvebu: Fix devinit_dove_pinctrl_probe function RDMA/cxgb4: Added NULL check for lookup_atid ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir() nfsd: call cache_put if xdr_reserve_space returns NULL f2fs: enhance to update i_mode and acl atomically in f2fs_setattr() f2fs: fix typo f2fs: fix to update i_ctime in __f2fs_setxattr() f2fs: remove unneeded check condition in __f2fs_setxattr() f2fs: reduce expensive checkpoint trigger frequency coresight: tmc: sg: Do not leak sg_table netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition tcp: introduce tcp_skb_timestamp_us() helper tcp: check skb is non-NULL in tcp_rto_delta_us() net: qrtr: Update packets cloning when broadcasting netfilter: ctnetlink: compile ctnetlink_label_size with CONFIG_NF_CONNTRACK_EVENTS crypto: aead,cipher - zeroize key buffer after use Remove *.orig pattern from .gitignore soc: versatile: integrator: fix OF node leak in probe() error path USB: appledisplay: close race between probe and completion handler USB: misc: cypress_cy7c63: check for short transfer firmware_loader: Block path traversal tty: rp2: Fix reset with non forgiving PCIe host bridges drbd: Fix atomicity violation in drbd_uuid_set_bm() drbd: Add NULL check for net_conf to prevent dereference in state validation ACPI: sysfs: validate return type of _STR method f2fs: prevent possible int overflow in dir_block_index() f2fs: avoid potential int overflow in sanity_check_area_boundary() vfs: fix race between evice_inodes() and find_inode()&iput() fs: Fix file_set_fowner LSM hook inconsistencies nfs: fix memory leak in error path of nfs4_do_reclaim PCI: xilinx-nwl: Use irq_data_get_irq_chip_data() PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler soc: versatile: realview: fix memory leak during device remove soc: versatile: realview: fix soc_dev leak during device remove usb: yurex: Replace snprintf() with the safer scnprintf() variant USB: misc: yurex: fix race between read and write pps: remove usage of the deprecated ida_simple_xx() API pps: add an error check in parport_attach i2c: aspeed: Update the stop sw state when the bus recovery occurs i2c: isch: Add missed 'else' usb: yurex: Fix inconsistent locking bug in yurex_read() mailbox: rockchip: fix a typo in module autoloading mailbox: bcm2835: Fix timeout during suspend mode ceph: remove the incorrect Fw reference check when dirtying pages netfilter: uapi: NFTA_FLOWTABLE_HOOK is NLA_NESTED netfilter: nf_tables: prevent nf_skb_duplicated corruption r8152: Factor out OOB link list waits net: ethernet: lantiq_etop: fix memory disclosure net: avoid potential underflow in qdisc_pkt_len_init() with UFO net: add more sanity checks to qdisc_pkt_len_init() ipv4: ip_gre: Fix drops of small packets in ipgre_xmit sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start ALSA: hda/generic: Unconditionally prefer preferred_dacs pairs ALSA: hda/conexant: Fix conflicting quirk for System76 Pangolin f2fs: Require FMODE_WRITE for atomic write ioctls wifi: ath9k: fix possible integer overflow in ath9k_get_et_stats() wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit net: hisilicon: hip04: fix OF node leak in probe() net: hisilicon: hns_dsaf_mac: fix OF node leak in hns_mac_get_info() net: hisilicon: hns_mdio: fix OF node leak in probe() ACPICA: Fix memory leak if acpi_ps_get_next_namepath() fails ACPICA: Fix memory leak if acpi_ps_get_next_field() fails ACPI: EC: Do not release locks during operation region accesses ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package() tipc: guard against string buffer overrun net: mvpp2: Increase size of queue_name buffer ipv4: Check !in_dev earlier for ioctl(SIOCSIFADDR). ipv4: Mask upper DSCP bits and ECN bits in NETLINK_FIB_LOOKUP family tcp: avoid reusing FIN_WAIT2 when trying to find port in connect() process ACPICA: iasl: handle empty connection_node wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext() signal: Replace BUG_ON()s ALSA: asihpi: Fix potential OOB array access ALSA: hdsp: Break infinite MIDI input flush loop fbdev: pxafb: Fix possible use after free in pxafb_task() power: reset: brcmstb: Do not go into infinite loop if reset fails ata: sata_sil: Rename sil_blacklist to sil_quirks jfs: UBSAN: shift-out-of-bounds in dbFindBits jfs: Fix uaf in dbFreeBits jfs: check if leafidx greater than num leaves per dmap tree jfs: Fix uninit-value access of new_ea in ea_buffer drm/amd/display: Check stream before comparing them drm/amd/display: Fix index out of bounds in degamma hardware format translation drm/printer: Allow NULL data in devcoredump printer scsi: aacraid: Rearrange order of struct aac_srb_unit drm/radeon/r100: Handle unknown family in r100_cp_init_microcode() of/irq: Refer to actual buffer size in of_irq_parse_one() ext4: ext4_search_dir should return a proper error ext4: fix i_data_sem unlock order in ext4_ind_migrate() spi: s3c64xx: fix timeout counters in flush_fifo selftests: breakpoints: use remaining time to check if suspend succeed selftests: vDSO: fix vDSO symbols lookup for powerpc64 i2c: xiic: Wait for TX empty to avoid missed TX NAKs spi: bcm63xx: Fix module autoloading perf/core: Fix small negative period being ignored parisc: Fix itlb miss handler for 64-bit programs ALSA: core: add isascii() check to card ID generator ext4: no need to continue when the number of entries is 1 ext4: propagate errors from ext4_find_extent() in ext4_insert_range() ext4: fix incorrect tid assumption in __jbd2_log_wait_for_space() ext4: aovid use-after-free in ext4_ext_insert_extent() ext4: fix double brelse() the buffer of the extents path ext4: fix incorrect tid assumption in ext4_wait_for_tail_page_commit() parisc: Fix 64-bit userspace syscall path of/irq: Support #msi-cells=<0> in of_msi_get_domain jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error ocfs2: fix the la space leak when unmounting an ocfs2 volume ocfs2: fix uninit-value in ocfs2_get_block() ocfs2: reserve space for inline xattr before attaching reflink tree ocfs2: cancel dqi_sync_work before freeing oinfo ocfs2: remove unreasonable unlock in ocfs2_read_blocks ocfs2: fix null-ptr-deref when journal load failed. ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate riscv: define ILLEGAL_POINTER_VALUE for 64bit aoe: fix the potential use-after-free problem in more places clk: rockchip: fix error for unknown clocks media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags media: venus: fix use after free bug in venus_remove due to race condition iio: magnetometer: ak8975: Fix reading for ak099xx sensors tomoyo: fallback to realpath if symlink's pathname does not exist Input: adp5589-keys - fix adp5589_gpio_get_value() btrfs: wait for fixup workers before stopping cleaner kthread during umount gpio: davinci: fix lazy disable ext4: avoid ext4_error()'s caused by ENOMEM in the truncate path ext4: fix slab-use-after-free in ext4_split_extent_at() ext4: update orig_path in ext4_find_extent() arm64: Add Cortex-715 CPU part definition arm64: cputype: Add Neoverse-N3 definitions arm64: errata: Expand speculative SSBS workaround once more uprobes: fix kernel info leak via "[uprobes]" vma nfsd: use ktime_get_seconds() for timestamps nfsd: fix delegation_blocked() to block correctly for at least 30 seconds rtc: at91sam9: drop platform_data support rtc: at91sam9: fix OF node leak in probe() error path ACPI: battery: Simplify battery hook locking ACPI: battery: Fix possible crash when unregistering a battery hook ext4: fix inode tree inconsistency caused by ENOMEM net: ethernet: cortina: Drop TSO support tracing: Remove precision vsnprintf() check from print event drm: Move drm_mode_setcrtc() local re-init to failure path drm/crtc: fix uninitialized variable use even harder virtio_console: fix misc probe bugs Input: synaptics-rmi4 - fix UAF of IRQ domain on driver removal bpf: Check percpu map value size first s390/facility: Disable compile time optimization for decompressor code s390/mm: Add cond_resched() to cmm_alloc/free_pages() ext4: nested locking for xattr inode s390/cpum_sf: Remove WARN_ON_ONCE statements ktest.pl: Avoid false positives with grub2 skip regex clk: bcm: bcm53573: fix OF node leak in init i2c: i801: Use a different adapter-name for IDF adapters PCI: Mark Creative Labs EMU20k2 INTx masking as broken media: videobuf2-core: clear memory related fields in __vb2_plane_dmabuf_put() usb: chipidea: udc: enable suspend interrupt after usb reset tools/iio: Add memory allocation failure check for trigger_name driver core: bus: Return -EIO instead of 0 when show/store invalid bus attribute fbdev: sisfb: Fix strbuf array overflow NFS: Remove print_overflow_msg() SUNRPC: Fix integer overflow in decode_rc_list() tcp: fix tcp_enter_recovery() to zero retrans_stamp when it's safe netfilter: br_netfilter: fix panic with metadata_dst skb Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change gpio: aspeed: Add the flush write to ensure the write complete. clk: Add (devm_)clk_get_optional() functions clk: generalize devm_clk_get() a bit clk: Provide new devm_clk helpers for prepared and enabled clocks gpio: aspeed: Use devm_clk api to manage clock source igb: Do not bring the device up after non-fatal error net: ibm: emac: mal: fix wrong goto ppp: fix ppp_async_encode() illegal access net: ipv6: ensure we call ipv6_mc_down() at most once CDC-NCM: avoid overflow in sanity checking HID: plantronics: Workaround for an unexcepted opposite volume key Revert "usb: yurex: Replace snprintf() with the safer scnprintf() variant" usb: xhci: Fix problem with xhci resume from suspend usb: storage: ignore bogus device raised by JieLi BR21 USB sound chip net: Fix an unsafe loop on the list posix-clock: Fix missing timespec64 check in pc_clock_settime() arm64: probes: Remove broken LDR (literal) uprobe support arm64: probes: Fix simulate_ldr*_literal() PCI: Add function 0 DMA alias quirk for Glenfly Arise chip fat: fix uninitialized variable KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() net: dsa: mv88e6xxx: Fix out-of-bound access s390/sclp_vt220: Convert newlines to CRLF instead of LFCR KVM: s390: Change virtual to physical address access in diag 0x258 handler x86/cpufeatures: Define X86_FEATURE_AMD_IBPB_RET drm/vmwgfx: Handle surface check failure correctly iio: dac: stm32-dac-core: add missing select REGMAP_MMIO in Kconfig iio: adc: ti-ads8688: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig iio: hid-sensors: Fix an error handling path in _hid_sensor_set_report_latency() iio: light: opt3001: add missing full-scale range value Bluetooth: Remove debugfs directory on module init failure Bluetooth: btusb: Fix regression with fake CSR controllers 0a12:0001 xhci: Fix incorrect stream context type macro USB: serial: option: add support for Quectel EG916Q-GL USB: serial: option: add Telit FN920C04 MBIM compositions parport: Proper fix for array out-of-bounds access x86/apic: Always explicitly disarm TSC-deadline timer nilfs2: propagate directory read errors from nilfs_find_entry() clk: Fix pointer casting to prevent oops in devm_clk_release() clk: Fix slab-out-of-bounds error in devm_clk_release() RDMA/bnxt_re: Fix incorrect AVID type in WQE structure RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP RDMA/bnxt_re: Return more meaningful error drm/msm/dsi: fix 32-bit signed integer extension in pclk_rate calculation macsec: don't increment counters for an unrelated SA net: ethernet: aeroflex: fix potential memory leak in greth_start_xmit_gbit() net: systemport: fix potential memory leak in bcm_sysport_xmit() usb: typec: altmode should keep reference to parent Bluetooth: bnep: fix wild-memory-access in proto_unregister arm64:uprobe fix the uprobe SWBP_INSN in big-endian arm64: probes: Fix uprobes for big-endian kernels KVM: s390: gaccess: Refactor gpa and length calculation KVM: s390: gaccess: Refactor access address range check KVM: s390: gaccess: Cleanup access to guest pages KVM: s390: gaccess: Check if guest address is in memslot udf: fix uninit-value use in udf_get_fileshortad jfs: Fix sanity check in dbMount net/sun3_82586: fix potential memory leak in sun3_82586_send_packet() be2net: fix potential memory leak in be_xmit() net: usb: usbnet: fix name regression posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime() ALSA: hda/realtek: Update default depop procedure drm/amd: Guard against bad data for ATIF ACPI method ACPI: button: Add DMI quirk for Samsung Galaxy Book2 to fix initial lid detection issue nilfs2: fix kernel bug due to missing clearing of buffer delay flag hv_netvsc: Fix VF namespace also in synthetic NIC NETDEV_REGISTER event selinux: improve error checking in sel_write_load() arm64/uprobes: change the uprobe_opcode_t typedef to fix the sparse warning xfrm: validate new SA's prefixlen using SA family when sel.family is unset usb: dwc3: remove generic PHY calibrate() calls usb: dwc3: Add splitdisable quirk for Hisilicon Kirin Soc usb: dwc3: core: Stop processing of pending events if controller is halted cgroup: Fix potential overflow issue when checking max_depth wifi: mac80211: skip non-uploaded keys in ieee80211_iter_keys gtp: simplify error handling code in 'gtp_encap_enable()' gtp: allow -1 to be specified as file description from userspace net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT bpf: Fix out-of-bounds write in trie_get_next_key() net: support ip generic csum processing in skb_csum_hwoffload_help net: skip offload for NETIF_F_IPV6_CSUM if ipv6 header contains extension netfilter: nft_payload: sanitize offset and length before calling skb_checksum() firmware: arm_sdei: Fix the input parameter of cpuhp_remove_state() net: amd: mvme147: Fix probe banner message misc: sgi-gru: Don't disable preemption in GRU driver usbip: tools: Fix detach_port() invalid port error path usb: phy: Fix API devm_usb_put_phy() can not release the phy xhci: Fix Link TRB DMA in command ring stopped completion event Revert "driver core: Fix uevent_show() vs driver detach race" wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower wifi: ath10k: Fix memory leak in management tx wifi: iwlegacy: Clear stale interrupts before resuming device nilfs2: fix potential deadlock with newly created symlinks ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow nilfs2: fix kernel bug due to missing clearing of checked flag mm: shmem: fix data-race in shmem_getattr() vt: prevent kernel-infoleak in con_font_get() Linux 4.19.323 Change-Id: I2348f834187153067ab46b3b48b8fe7da9cee1f1 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
|
Wade Wang
|
b1ce11ce52 |
HID: plantronics: Workaround for an unexcepted opposite volume key
commit 87b696209007b7c4ef7bdfe39ea0253404a43770 upstream.
Some Plantronics headset as the below send an unexcept opposite
volume key's HID report for each volume key press after 200ms, like
unecepted Volume Up Key following Volume Down key pressed by user.
This patch adds a quirk to hid-plantronics for these devices, which
will ignore the second unexcepted opposite volume key if it happens
within 220ms from the last one that was handled.
Plantronics EncorePro 500 Series (047f:431e)
Plantronics Blackwire_3325 Series (047f:430c)
The patch was tested on the mentioned model, it shouldn't affect
other models, however, this quirk might be needed for them too.
Auto-repeat (when a key is held pressed) is not affected per test
result.
Cc: stable@vger.kernel.org
Signed-off-by: Wade Wang <wade.wang@hp.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
|
bengris32
|
cfe5bfae8c |
Merge tag 'ASB-2024-10-05_4.19-stable' of https://android.googlesource.com/kernel/common into lineage-21
https://source.android.com/docs/security/bulletin/2024-10-01 * tag 'ASB-2024-10-05_4.19-stable' of https://android.googlesource.com/kernel/common: Linux 4.19.322 Revert "parisc: Use irq_enter_rcu() to fix warning at kernel/context_tracking.c:367" netns: restore ops before calling ops_exit_list cx82310_eth: fix error return code in cx82310_bind() net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket rtmutex: Drop rt_mutex::wait_lock before scheduling drm/i915/fence: Mark debug_fence_free() with __maybe_unused drm/i915/fence: Mark debug_fence_init_onstack() with __maybe_unused ACPI: processor: Fix memory leaks in error paths of processor_add() ACPI: processor: Return an error if acpi_processor_get_info() fails in processor_add() ila: call nf_unregister_net_hooks() sooner netns: add pre_exit method to struct pernet_operations nilfs2: protect references to superblock parameters exposed in sysfs nilfs2: replace snprintf in show functions with sysfs_emit tracing: Avoid possible softlockup in tracing_iter_reset() ring-buffer: Rename ring_buffer_read() to read_buffer_iter_advance() uprobes: Use kzalloc to allocate xol area clocksource/drivers/imx-tpm: Fix next event not taking effect sometime clocksource/drivers/imx-tpm: Fix return -ETIME when delta exceeds INT_MAX VMCI: Fix use-after-free when removing resource in vmci_resource_remove() Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind nvmem: Fix return type of devm_nvmem_device_get() in kerneldoc iio: fix scale application in iio_convert_raw_to_processed_unlocked iio: buffer-dmaengine: fix releasing dma channel on error ata: pata_macio: Use WARN instead of BUG of/irq: Prevent device address out-of-bounds read in interrupt map walk Squashfs: sanity check symbolic link size usbnet: ipheth: race between ipheth_close and error handling Input: uinput - reject requests with unreasonable number of slots HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup btrfs: initialize location to fix -Wmaybe-uninitialized in btrfs_lookup_dentry() PCI: Add missing bridge lock to pci_bus_lock() btrfs: clean up our handling of refs == 0 in snapshot delete btrfs: replace BUG_ON with ASSERT in walk_down_proc() smp: Add missing destroy_work_on_stack() call in smp_call_on_cpu() wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id() hwmon: (w83627ehf) Fix underflows seen when writing limit attributes hwmon: (nct6775-core) Fix underflows seen when writing limit attributes hwmon: (lm95234) Fix underflows seen when writing limit attributes hwmon: (adc128d818) Fix underflows seen when writing limit attributes pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv devres: Initialize an uninitialized struct member um: line: always fill *error_out in setup_one_line() cgroup: Protect css->cgroup write under css_set_lock iommu/vt-d: Handle volatile descriptor status read net: dsa: vsc73xx: fix possible subblocks range of CAPT block net: bridge: br_fdb_external_learn_add(): always set EXT_LEARN net: bridge: fdb: convert added_by_external_learn to use bitops net: bridge: fdb: convert added_by_user to bitops net: bridge: fdb: convert is_sticky to bitops net: bridge: fdb: convert is_static to bitops net: bridge: fdb: convert is_local to bitops bridge: switchdev: Allow clearing FDB entry offload indication net: bridge: add support for sticky fdb entries rfkill: fix spelling mistake contidion to condition usbnet: modern method to get random MAC net: usb: don't write directly to netdev->dev_addr drivers/net/usb: Remove all strcpy() uses cx82310_eth: re-enable ethernet mode after router reboot platform/x86: dell-smbios: Fix error path in dell_smbios_init() igb: Fix not clearing TimeSync interrupts for 82580 can: bcm: Remove proc entry when dev is unregistered. pcmcia: Use resource_size function on resource object media: qcom: camss: Add check for v4l2_fwnode_endpoint_parse wifi: brcmsmac: advertise MFP_CAPABLE to enable WPA3 udf: Avoid excessive partition lengths netfilter: nf_conncount: fix wrong variable type af_unix: Remove put_pid()/put_cred() in copy_peercred(). irqchip/armada-370-xp: Do not allow mapping IRQ 0 and 1 smack: unix sockets: fix accept()ed socket label ALSA: hda: Add input value sanity checks to HDMI channel map controls nilfs2: fix state management in error path of log writing function nilfs2: fix missing cleanup on rollforward recovery error clk: qcom: clk-alpha-pll: Fix the pll post div mask fuse: use unsigned type for getxattr/listxattr size truncation mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K ata: libata: Fix memory leak for error path in ata_host_alloc() ALSA: hda/conexant: Add pincfg quirk to enable top speakers on Sirius devices sch/netem: fix use after free in netem_dequeue ALSA: usb-audio: Fix gpf in snd_usb_pipe_sanity_check ALSA: usb-audio: Sanity checks for each pipe and EP types udf: Limit file size to 4TB virtio_net: Fix napi_skb_cache_put warning block: initialize integrity buffer to zero before writing it to media media: uvcvideo: Enforce alignment of frame and interval smack: tcp: ipv4, fix incorrect labeling usbip: Don't submit special requests twice apparmor: fix possible NULL pointer dereference drm/amdkfd: Reconcile the definition and use of oem_id in struct kfd_topology_device drm/amdgpu: fix mc_data out-of-bounds read warning drm/amdgpu: fix ucode out-of-bounds read warning drm/amdgpu: fix overflowed array index read warning drm/amdgpu: Fix uninitialized variable warning in amdgpu_afmt_acr usb: dwc3: st: add missing depopulate in probe error path usb: dwc3: st: Add of_node_put() before return in probe function net: usb: qmi_wwan: add MeiG Smart SRM825L BACKPORT: f2fs: fix to handle segment allocation failure correctly BACKPORT: f2fs: stop checkpoint when get a out-of-bounds segment Change-Id: I84f0eb875b2be21a380550b54cee41eeee3a1ed6 Signed-off-by: bengris32 <bengris32@protonmail.ch> |
||
|
bengris32
|
6880313f90 |
Merge tag 'ASB-2024-09-05_4.19-stable' of https://android.googlesource.com/kernel/common into lineage-21
https://source.android.com/docs/security/bulletin/2024-09-01 CVE-2024-36972 * tag 'ASB-2024-09-05_4.19-stable' of https://android.googlesource.com/kernel/common: Linux 4.19.321 drm/fb-helper: set x/yres_virtual in drm_fb_helper_check_var ipc: remove memcg accounting for sops objects in do_semtimedop() scsi: aacraid: Fix double-free on probe failure usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes() usb: dwc3: st: fix probed platform device ref count on probe error path usb: dwc3: core: Prevent USB core invalid event buffer address access usb: dwc3: omap: add missing depopulate in probe error path USB: serial: option: add MeiG Smart SRM825L cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller net: busy-poll: use ktime_get_ns() instead of local_clock() gtp: fix a potential NULL pointer dereference soundwire: stream: fix programming slave ports for non-continous port maps net: prevent mss overflow in skb_segment() ida: Fix crash in ida_free when the bitmap is empty net:rds: Fix possible deadlock in rds_message_put fbmem: Check virtual screen sizes in fb_set_var() fbcon: Prevent that screen size is smaller than font size memcg: enable accounting of ipc resources cgroup/cpuset: Prevent UAF in proc_cpuset_show() ata: libata-core: Fix null pointer dereference on error media: uvcvideo: Fix integer overflow calculating timestamp filelock: Correct the filelock owner in fcntl_setlk/fcntl_setlk64 scsi: mpt3sas: Avoid IOMMU page faults on REPORT ZONES dm suspend: return -ERESTARTSYS instead of -EINTR wifi: mwifiex: duplicate static structs used in driver instances pinctrl: single: fix potential NULL dereference in pcs_get_function() drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc tools: move alignment-related macros to new <linux/align.h> Input: MT - limit max slots Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO ALSA: timer: Relax start tick time check for slave timer elements mmc: dw_mmc: allow biu and ciu clocks to defer cxgb4: add forgotten u64 ivlan cast before shift HID: wacom: Defer calculation of resolution until resolution_code is known Bluetooth: MGMT: Add error handling to pair_device() mmc: mmc_test: Fix NULL dereference on allocation failure drm/msm/dpu: don't play tricks with debug macros drm/msm: use drm_debug_enabled() to check for debug categories net: xilinx: axienet: Always disable promiscuous mode ipv6: prevent UAF in ip6_send_skb() netfilter: nft_counter: Synchronize nft_counter_reset() against reader. kcm: Serialise kcm_sendmsg() for the same socket. Bluetooth: hci_core: Fix LE quote calculation Bluetooth: hci_core: Fix not handling link timeouts propertly Bluetooth: Make use of __check_timeout on hci_sched_le block: use "unsigned long" for blk_validate_block_size(). gtp: pull network headers in gtp_dev_xmit() hrtimer: Prevent queuing of hrtimer without a function callback nvmet-rdma: fix possible bad dereference when freeing rsps ext4: set the type of max_zeroout to unsigned int to avoid overflow irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc usb: dwc3: core: Skip setting event buffers for host only controllers s390/iucv: fix receive buffer virtual vs physical address confusion openrisc: Call setup_memory() earlier in the init sequence NFS: avoid infinite loop in pnfs_update_layout. Bluetooth: bnep: Fix out-of-bound access usb: gadget: fsl: Increase size of name buffer for endpoints f2fs: fix to do sanity check in update_sit_entry btrfs: delete pointless BUG_ON check on quota root in btrfs_qgroup_account_extent() btrfs: send: handle unexpected data in header buffer in begin_cmd() btrfs: handle invalid root reference found in may_destroy_subvol() btrfs: change BUG_ON to assertion when checking for delayed_node root powerpc/boot: Only free if realloc() succeeds powerpc/boot: Handle allocation failure in simple_realloc() parisc: Use irq_enter_rcu() to fix warning at kernel/context_tracking.c:367 md: clean up invalid BUG_ON in md_ioctl net/sun3_82586: Avoid reading past buffer in debug output scsi: lpfc: Initialize status local variable in lpfc_sli4_repost_sgl_list() fs: binfmt_elf_efpic: don't use missing interpreter's properties media: pci: cx23885: check cx23885_vdev_init() return quota: Remove BUG_ON from dqget() ext4: do not trim the group with corrupted block bitmap powerpc/xics: Check return value of kasprintf in icp_native_map_one_cpu wifi: iwlwifi: abort scan when rfkill on but device enabled gfs2: setattr_chown: Add missing initialization scsi: spi: Fix sshdr use binfmt_misc: cleanup on filesystem umount staging: ks7010: disable bh on tx_dev_lock i2c: riic: avoid potential division by zero wifi: cw1200: Avoid processing an invalid TIM IE ssb: Fix division by zero issue in ssb_calc_clock_rate net: dsa: vsc73xx: pass value in phy_write operation atm: idt77252: prevent use after free in dequeue_rx() net/mlx5e: Correctly report errors for ethtool rx flows btrfs: rename bitmap_set_bits() -> btrfs_bitmap_set_bits() overflow: Implement size_t saturating arithmetic helpers overflow.h: Add flex_array_size() helper s390/cio: rename bitmap_size() -> idset_bitmap_size() memcg_write_event_control(): fix a user-triggerable oops drm/amdgpu: Actually check flags for all context ops. selinux: fix potential counting error in avc_add_xperms_decision() fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE bitmap: introduce generic optimized bitmap_size() dm persistent data: fix memory allocation failure dm resume: don't return EINVAL when signalled arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to NUMA_NO_NODE xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration ALSA: usb-audio: Support Yamaha P-125 quirk entry fuse: Initialize beyond-EOF page contents before setting uptodate Linux 4.19.320 nvme/pci: Add APST quirk for Lenovo N60z laptop exec: Fix ToCToU between perm check and set-uid/gid usage drm/i915/gem: Fix Virtual Memory mapping boundaries calculation media: uvcvideo: Use entity get_cur in uvc_ctrl_set arm64: cpufeature: Fix the visibility of compat hwcaps netfilter: nf_tables: prefer nft_chain_validate netfilter: nf_tables: use timestamp to check for set element timeout netfilter: nf_tables: set element extended ACK reporting support kbuild: Fix '-S -c' in x86 stack protector scripts drm/mgag200: Set DDC timeout in milliseconds drm/bridge: analogix_dp: properly handle zero sized AUX transactions x86/mtrr: Check if fixed MTRRs exist before saving them tracing: Fix overflow in get_free_elt() power: supply: axp288_charger: Round constant_charge_voltage writes down power: supply: axp288_charger: Fix constant_charge_voltage writes serial: core: check uartclk for zero to avoid divide by zero ntp: Safeguard against time_constant overflow driver core: Fix uevent_show() vs driver detach race ntp: Clamp maxerror and esterror to operating range tick/broadcast: Move per CPU pointer access into the atomic section scsi: ufs: core: Fix hba->last_dme_cmd_tstamp timestamp updating logic usb: gadget: core: Check for unset descriptor USB: serial: debug: do not echo input by default usb: vhci-hcd: Do not drop references before new references are gained ALSA: line6: Fix racy access to midibuf spi: spi-fsl-lpspi: Fix scldiv calculation spi: fsl-lpspi: remove unneeded array spi: lpspi: add the error info of transfer speed setting spi: lpspi: Add i.MX8 boards support for lpspi spi: lpspi: Let watermark change with send data length spi: lpspi: Add slave mode support spi: lpspi: Replace all "master" with "controller" bpf: kprobe: remove unused declaring of bpf_kprobe_override i2c: smbus: Send alert notifications to all devices if source not found i2c: smbus: Improve handling of stuck alerts i2c: smbus: Don't filter out duplicate alerts arm64: errata: Expand speculative SSBS workaround (again) arm64: cputype: Add Cortex-A725 definitions arm64: cputype: Add Cortex-X1C definitions arm64: errata: Expand speculative SSBS workaround arm64: errata: Unify speculative SSBS errata logic arm64: cputype: Add Cortex-X925 definitions arm64: cputype: Add Cortex-A720 definitions arm64: cputype: Add Cortex-X3 definitions arm64: errata: Add workaround for Arm errata 3194386 and 3312417 arm64: cputype: Add Neoverse-V3 definitions arm64: cputype: Add Cortex-X4 definitions arm64: Add Neoverse-V2 part arm64: cpufeature: Force HWCAP to be based on the sysreg visible to user-space arm64: Add support for SB barrier and patch in over DSB; ISB sequences ext4: fix wrong unit use in ext4_mb_find_by_goal SUNRPC: Fix a race to wake a sync task s390/sclp: Prevent release of buffer in I/O jbd2: avoid memleak in jbd2_journal_write_metadata_buffer media: uvcvideo: Fix the bandwdith quirk on USB 3.x media: uvcvideo: Ignore empty TS packets btrfs: fix bitmap leak when loading free space cache on duplicate entry wifi: nl80211: don't give key data to userspace udf: prevent integer overflow in udf_bitmap_free_blocks() PCI: Add Edimax Vendor ID to pci_ids.h clocksource/drivers/sh_cmt: Address race condition for clock events md/raid5: avoid BUG_ON() while continue reshape after reassembling net: fec: Stop PPS on driver remove Bluetooth: l2cap: always unlock channel in l2cap_conless_channel() net: linkwatch: use system_unbound_wq net: usb: qmi_wwan: fix memory leak for not ip packets x86/mm: Fix pti_clone_pgtable() alignment assumption irqchip/mbigen: Fix mbigen node address layout net: usb: sr9700: fix uninitialized variable use in sr_mdio_read ALSA: usb-audio: Correct surround channels in UAC1 channel map protect the fetch of ->fd[fd] in do_dup2() from mispredictions ipv6: fix ndisc_is_useropt() handling for PIO net/iucv: fix use after free in iucv_sock_close() drm/vmwgfx: Fix overlay when using Screen Targets remoteproc: imx_rproc: Skip over memory region when node value is NULL remoteproc: imx_rproc: Fix ignoring mapping vdev regions remoteproc: imx_rproc: ignore mapping vdev regions perf/x86/intel/pt: Fix a topa_entry base address calculation perf/x86/intel/pt: Split ToPA metadata and page layout perf/x86/intel/pt: Use pointer arithmetics instead in ToPA entry calculation perf/x86/intel/pt: Use helpers to obtain ToPA entry size perf/x86/intel/pt: Export pt_cap_get() devres: Fix memory leakage caused by driver API devm_free_percpu() driver core: Cast to (void *) with __force for __percpu pointer dev/parport: fix the array out-of-bounds risk parport: Standardize use of printmode parport: Convert printk(KERN_<LEVEL> to pr_<level>( parport: parport_pc: Mark expected switch fall-through PCI: rockchip: Use GPIOD_OUT_LOW flag while requesting ep_gpio PCI: rockchip: Make 'ep-gpios' DT property optional mm: avoid overflows in dirty throttling logic mISDN: Fix a use after free in hfcmulti_tx() tipc: Return non-zero value from tipc_udp_addr2str() on error net: bonding: correctly annotate RCU in bond_should_notify_peers() ipv4: Fix incorrect source address in Record Route option net: ip_rt_get_source() - use new style struct initializer instead of memset MIPS: SMP-CPS: Fix address for GCR_ACCESS register for CM3 and later dma: fix call order in dmam_free_coherent jfs: Fix array-index-out-of-bounds in diFree kdb: Use the passed prompt in kdb_position_cursor() kdb: address -Wformat-security warnings kdb: Fix bound check compiler warning nilfs2: handle inconsistent state in nilfs_btnode_create_block() selftests/sigaltstack: Fix ppc64 GCC build RDMA/iwcm: Fix a use-after-free related to destroying CM IDs platform: mips: cpu_hwmon: Disable driver on unsupported hardware watchdog/perf: properly initialize the turbo mode timestamp and rearm counter perf/x86/intel/pt: Fix topa_entry base length scsi: qla2xxx: validate nvme_local_port correctly scsi: qla2xxx: During vport delete send async logout explicitly rtc: cmos: Fix return value of nvmem callbacks kobject_uevent: Fix OOB access within zap_modalias_env() decompress_bunzip2: fix rare decompression failure ubi: eba: properly rollback inside self_check_eba clk: davinci: da8xx-cfgchip: Initialize clk_init_data before use f2fs: fix to don't dirty inode for readonly filesystem scsi: qla2xxx: Return ENOBUFS if sg_cnt is more than one for ELS cmds binder: fix hang of unregistered readers PCI: hv: Return zero, not garbage, when reading PCI_INTERRUPT_PIN hwrng: amd - Convert PCIBIOS_* return codes to errnos tools/memory-model: Fix bug in lock.cat leds: ss4200: Convert PCIBIOS_* return codes to errnos wifi: mwifiex: Fix interface type change ext4: make sure the first directory block is not a hole ext4: check dot and dotdot of dx_root before making dir indexed m68k: amiga: Turn off Warp1260 interrupts during boot drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode() media: venus: fix use after free in vdec_close char: tpm: Fix possible memory leak in tpm_bios_measurements_open() ipv6: take care of scope when choosing the src addr af_packet: Handle outgoing VLAN packets without hardware offloading net: netconsole: Disable target before netpoll cleanup tick/broadcast: Make takeover of broadcast hrtimer reliable nilfs2: avoid undefined behavior in nilfs_cnt32_ge macro fs/nilfs2: remove some unused macros to tame gcc pinctrl: freescale: mxs: Fix refcount of child pinctrl: ti: ti-iodelay: fix possible memory leak when pinctrl_enable() fails pinctrl: ti: ti-iodelay: Drop if block with always false condition pinctrl: single: fix possible memory leak when pinctrl_enable() fails pinctrl: core: fix possible memory leak when pinctrl_enable() fails netfilter: ctnetlink: use helper function to calculate expect ID ice: Rework flex descriptor programming bnxt_re: Fix imm_data endianness macintosh/therm_windtunnel: fix module unload. powerpc/xmon: Fix disassembly CPU feature checks MIPS: Octeron: remove source file executable bit Input: elan_i2c - do not leave interrupt disabled on suspend failure mtd: make mtd_test.c a separate module RDMA/rxe: Don't set BTH_ACK_MASK for UC or UD QPs RDMA/mlx4: Fix truncated output warning in alias_GUID.c RDMA/mlx4: Fix truncated output warning in mad.c PCI: Fix resource double counting on remove & rescan PCI: Equalize hotplug memory and io for occupied and empty slots sparc64: Fix incorrect function signature and add prototype for prom_cif_init ext4: avoid writing unitialized memory to disk in EA inodes mfd: omap-usb-tll: Use struct_size to allocate tll drm/etnaviv: fix DMA direction handling for cached RW buffers perf report: Fix condition in sort__sym_cmp() leds: trigger: Unregister sysfs attributes before calling deactivate() media: renesas: vsp1: Store RPF partition configuration per RPF instance media: renesas: vsp1: Fix _irqsave and _irq mix media: uvcvideo: Override default flags media: uvcvideo: Allow entity-defined get_info and get_cur saa7134: Unchecked i2c_transfer function result fixed media: imon: Fix race getting ictx->lock selftests: forwarding: devlink_lib: Wait for udev events after reloading bna: adjust 'name' buf size of bna_tcb and bna_ccb structures perf: Prevent passing zero nr_pages to rb_alloc_aux() perf: Fix perf_aux_size() for greater-than 32-bit size ipvs: Avoid unnecessary calls to skb_is_gso_sctp net: fec: Fix FEC_ECR_EN1588 being cleared on link-down net: fec: Refactor: #define magic constants wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he() wifi: cfg80211: fix typo in cfg80211_calculate_bitrate_he() selftests/bpf: Check length of recv in test_sockmap net/smc: set rmb's SG_MAX_SINGLE_ALLOC limitation only when CONFIG_ARCH_NO_SG_CHAIN is defined net/smc: Allow SMC-D 1MB DMB allocations wifi: brcmsmac: LCN PHY code is used for BCM4313 2G-only device m68k: cmpxchg: Fix return value for default case in __arch_xchg() x86/xen: Convert comma to semicolon m68k: atari: Fix TT bootup freeze / unexpected (SCU) interrupt messages arm64: dts: rockchip: Increase VOP clk rate on RK3328 hwmon: (max6697) Fix swapped temp{1,8} critical alarms hwmon: (max6697) Auto-convert to use SENSOR_DEVICE_ATTR_{RO, RW, WO} hwmon: Introduce SENSOR_DEVICE_ATTR_{RO, RW, WO} and variants hwmon: (max6697) Fix underflow when writing limit attributes pwm: stm32: Always do lazy disabling hwmon: (adt7475) Fix default duty on fan is disabled x86/platform/iosf_mbi: Convert PCIBIOS_* return codes to errnos x86/pci/xen: Fix PCIBIOS_* return code handling x86/pci/intel_mid_pci: Fix PCIBIOS_* return code handling x86/of: Return consistent error type from x86_of_pci_irq_enable() hfsplus: fix to avoid false alarm of circular locking platform/chrome: cros_ec_debugfs: fix wrong EC message version Revert "net: mac802154: Fix racy device stats updates by DEV_STATS_INC() and DEV_STATS_ADD()" Linux 4.19.319 filelock: Fix fcntl/close race recovery compat path jfs: don't walk off the end of ealist ocfs2: add bounds checking to ocfs2_check_dir_entry() net: relax socket state check at accept time. ACPI: processor_idle: Fix invalid comparison with insertion sort for latency ARM: 9324/1: fix get_user() broken with veneer filelock: Remove locks reliably when fcntl/close race is detected hfsplus: fix uninit-value in copy_name selftests/vDSO: fix clang build errors and warnings spi: imx: Don't expect DMA for i.MX{25,35,50,51,53} cspi devices fs: better handle deep ancestor chains in is_subdir() Bluetooth: hci_core: cancel all works upon hci_unregister_dev() net: mac802154: Fix racy device stats updates by DEV_STATS_INC() and DEV_STATS_ADD() net: usb: qmi_wwan: add Telit FN912 compositions ALSA: dmaengine_pcm: terminate dmaengine before synchronize s390/sclp: Fix sclp_init() cleanup on failure can: kvaser_usb: fix return value for hif_usb_send_regout bytcr_rt5640 : inverse jack detect for Archos 101 cesium Input: elantech - fix touchpad state on resume for Lenovo N24 wifi: cfg80211: wext: add extra SIOCSIWSCAN data check mei: demote client disconnect warning on suspend to debug fs/file: fix the check in find_next_fd() kconfig: remove wrong expr_trans_bool() kconfig: gconf: give a proper initial state to the Save button ila: block BH in ila_output() Input: silead - Always support 10 fingers wifi: mac80211: fix UBSAN noise in ieee80211_prep_hw_scan() wifi: mac80211: mesh: init nonpeer_pm to active by default in mesh sdata ACPI: EC: Avoid returning AE_OK on errors in address space handler ACPI: EC: Abort address space access upon error scsi: qedf: Set qed_slowpath_params to zero before use gcc-plugins: Rename last_stmt() for GCC 14+ Change-Id: I5d910141e3e22bc861c6b0343780dcfbf31b6341 Signed-off-by: bengris32 <bengris32@protonmail.ch> |
||
|
Greg Kroah-Hartman
|
1b3964c5e0 |
Merge 4.19.322 into android-4.19-stable
Changes in 4.19.322 net: usb: qmi_wwan: add MeiG Smart SRM825L usb: dwc3: st: Add of_node_put() before return in probe function usb: dwc3: st: add missing depopulate in probe error path drm/amdgpu: Fix uninitialized variable warning in amdgpu_afmt_acr drm/amdgpu: fix overflowed array index read warning drm/amdgpu: fix ucode out-of-bounds read warning drm/amdgpu: fix mc_data out-of-bounds read warning drm/amdkfd: Reconcile the definition and use of oem_id in struct kfd_topology_device apparmor: fix possible NULL pointer dereference usbip: Don't submit special requests twice smack: tcp: ipv4, fix incorrect labeling media: uvcvideo: Enforce alignment of frame and interval block: initialize integrity buffer to zero before writing it to media virtio_net: Fix napi_skb_cache_put warning udf: Limit file size to 4TB ALSA: usb-audio: Sanity checks for each pipe and EP types ALSA: usb-audio: Fix gpf in snd_usb_pipe_sanity_check sch/netem: fix use after free in netem_dequeue ALSA: hda/conexant: Add pincfg quirk to enable top speakers on Sirius devices ata: libata: Fix memory leak for error path in ata_host_alloc() mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K fuse: use unsigned type for getxattr/listxattr size truncation clk: qcom: clk-alpha-pll: Fix the pll post div mask nilfs2: fix missing cleanup on rollforward recovery error nilfs2: fix state management in error path of log writing function ALSA: hda: Add input value sanity checks to HDMI channel map controls smack: unix sockets: fix accept()ed socket label irqchip/armada-370-xp: Do not allow mapping IRQ 0 and 1 af_unix: Remove put_pid()/put_cred() in copy_peercred(). netfilter: nf_conncount: fix wrong variable type udf: Avoid excessive partition lengths wifi: brcmsmac: advertise MFP_CAPABLE to enable WPA3 media: qcom: camss: Add check for v4l2_fwnode_endpoint_parse pcmcia: Use resource_size function on resource object can: bcm: Remove proc entry when dev is unregistered. igb: Fix not clearing TimeSync interrupts for 82580 platform/x86: dell-smbios: Fix error path in dell_smbios_init() cx82310_eth: re-enable ethernet mode after router reboot drivers/net/usb: Remove all strcpy() uses net: usb: don't write directly to netdev->dev_addr usbnet: modern method to get random MAC rfkill: fix spelling mistake contidion to condition net: bridge: add support for sticky fdb entries bridge: switchdev: Allow clearing FDB entry offload indication net: bridge: fdb: convert is_local to bitops net: bridge: fdb: convert is_static to bitops net: bridge: fdb: convert is_sticky to bitops net: bridge: fdb: convert added_by_user to bitops net: bridge: fdb: convert added_by_external_learn to use bitops net: bridge: br_fdb_external_learn_add(): always set EXT_LEARN net: dsa: vsc73xx: fix possible subblocks range of CAPT block iommu/vt-d: Handle volatile descriptor status read cgroup: Protect css->cgroup write under css_set_lock um: line: always fill *error_out in setup_one_line() devres: Initialize an uninitialized struct member pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv hwmon: (adc128d818) Fix underflows seen when writing limit attributes hwmon: (lm95234) Fix underflows seen when writing limit attributes hwmon: (nct6775-core) Fix underflows seen when writing limit attributes hwmon: (w83627ehf) Fix underflows seen when writing limit attributes wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id() smp: Add missing destroy_work_on_stack() call in smp_call_on_cpu() btrfs: replace BUG_ON with ASSERT in walk_down_proc() btrfs: clean up our handling of refs == 0 in snapshot delete PCI: Add missing bridge lock to pci_bus_lock() btrfs: initialize location to fix -Wmaybe-uninitialized in btrfs_lookup_dentry() HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup Input: uinput - reject requests with unreasonable number of slots usbnet: ipheth: race between ipheth_close and error handling Squashfs: sanity check symbolic link size of/irq: Prevent device address out-of-bounds read in interrupt map walk ata: pata_macio: Use WARN instead of BUG iio: buffer-dmaengine: fix releasing dma channel on error iio: fix scale application in iio_convert_raw_to_processed_unlocked nvmem: Fix return type of devm_nvmem_device_get() in kerneldoc uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic VMCI: Fix use-after-free when removing resource in vmci_resource_remove() clocksource/drivers/imx-tpm: Fix return -ETIME when delta exceeds INT_MAX clocksource/drivers/imx-tpm: Fix next event not taking effect sometime uprobes: Use kzalloc to allocate xol area ring-buffer: Rename ring_buffer_read() to read_buffer_iter_advance() tracing: Avoid possible softlockup in tracing_iter_reset() nilfs2: replace snprintf in show functions with sysfs_emit nilfs2: protect references to superblock parameters exposed in sysfs netns: add pre_exit method to struct pernet_operations ila: call nf_unregister_net_hooks() sooner ACPI: processor: Return an error if acpi_processor_get_info() fails in processor_add() ACPI: processor: Fix memory leaks in error paths of processor_add() drm/i915/fence: Mark debug_fence_init_onstack() with __maybe_unused drm/i915/fence: Mark debug_fence_free() with __maybe_unused rtmutex: Drop rt_mutex::wait_lock before scheduling net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket cx82310_eth: fix error return code in cx82310_bind() netns: restore ops before calling ops_exit_list Revert "parisc: Use irq_enter_rcu() to fix warning at kernel/context_tracking.c:367" Linux 4.19.322 Change-Id: I91163696e8593c077f8fe3d59348a68c76a2624b Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
|
Camila Alvarez
|
e239e44dcd |
HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
[ Upstream commit a6e9c391d45b5865b61e569146304cff72821a5d ] report_fixup for the Cougar 500k Gaming Keyboard was not verifying that the report descriptor size was correct before accessing it Reported-by: syzbot+24c0361074799d02c452@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=24c0361074799d02c452 Signed-off-by: Camila Alvarez <cam.alvarez.i@gmail.com> Reviewed-by: Silvan Jegen <s.jegen@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com> Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
|
Greg Kroah-Hartman
|
d757552385 |
Merge 4.19.321 into android-4.19-stable
Changes in 4.19.321 fuse: Initialize beyond-EOF page contents before setting uptodate ALSA: usb-audio: Support Yamaha P-125 quirk entry xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to NUMA_NO_NODE dm resume: don't return EINVAL when signalled dm persistent data: fix memory allocation failure bitmap: introduce generic optimized bitmap_size() fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE selinux: fix potential counting error in avc_add_xperms_decision() drm/amdgpu: Actually check flags for all context ops. memcg_write_event_control(): fix a user-triggerable oops s390/cio: rename bitmap_size() -> idset_bitmap_size() overflow.h: Add flex_array_size() helper overflow: Implement size_t saturating arithmetic helpers btrfs: rename bitmap_set_bits() -> btrfs_bitmap_set_bits() net/mlx5e: Correctly report errors for ethtool rx flows atm: idt77252: prevent use after free in dequeue_rx() net: dsa: vsc73xx: pass value in phy_write operation ssb: Fix division by zero issue in ssb_calc_clock_rate wifi: cw1200: Avoid processing an invalid TIM IE i2c: riic: avoid potential division by zero staging: ks7010: disable bh on tx_dev_lock binfmt_misc: cleanup on filesystem umount scsi: spi: Fix sshdr use gfs2: setattr_chown: Add missing initialization wifi: iwlwifi: abort scan when rfkill on but device enabled powerpc/xics: Check return value of kasprintf in icp_native_map_one_cpu ext4: do not trim the group with corrupted block bitmap quota: Remove BUG_ON from dqget() media: pci: cx23885: check cx23885_vdev_init() return fs: binfmt_elf_efpic: don't use missing interpreter's properties scsi: lpfc: Initialize status local variable in lpfc_sli4_repost_sgl_list() net/sun3_82586: Avoid reading past buffer in debug output md: clean up invalid BUG_ON in md_ioctl parisc: Use irq_enter_rcu() to fix warning at kernel/context_tracking.c:367 powerpc/boot: Handle allocation failure in simple_realloc() powerpc/boot: Only free if realloc() succeeds btrfs: change BUG_ON to assertion when checking for delayed_node root btrfs: handle invalid root reference found in may_destroy_subvol() btrfs: send: handle unexpected data in header buffer in begin_cmd() btrfs: delete pointless BUG_ON check on quota root in btrfs_qgroup_account_extent() f2fs: fix to do sanity check in update_sit_entry usb: gadget: fsl: Increase size of name buffer for endpoints Bluetooth: bnep: Fix out-of-bound access NFS: avoid infinite loop in pnfs_update_layout. openrisc: Call setup_memory() earlier in the init sequence s390/iucv: fix receive buffer virtual vs physical address confusion usb: dwc3: core: Skip setting event buffers for host only controllers irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc ext4: set the type of max_zeroout to unsigned int to avoid overflow nvmet-rdma: fix possible bad dereference when freeing rsps hrtimer: Prevent queuing of hrtimer without a function callback gtp: pull network headers in gtp_dev_xmit() block: use "unsigned long" for blk_validate_block_size(). Bluetooth: Make use of __check_timeout on hci_sched_le Bluetooth: hci_core: Fix not handling link timeouts propertly Bluetooth: hci_core: Fix LE quote calculation kcm: Serialise kcm_sendmsg() for the same socket. netfilter: nft_counter: Synchronize nft_counter_reset() against reader. ipv6: prevent UAF in ip6_send_skb() net: xilinx: axienet: Always disable promiscuous mode drm/msm: use drm_debug_enabled() to check for debug categories drm/msm/dpu: don't play tricks with debug macros mmc: mmc_test: Fix NULL dereference on allocation failure Bluetooth: MGMT: Add error handling to pair_device() HID: wacom: Defer calculation of resolution until resolution_code is known cxgb4: add forgotten u64 ivlan cast before shift mmc: dw_mmc: allow biu and ciu clocks to defer ALSA: timer: Relax start tick time check for slave timer elements Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO Input: MT - limit max slots tools: move alignment-related macros to new <linux/align.h> drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc pinctrl: single: fix potential NULL dereference in pcs_get_function() wifi: mwifiex: duplicate static structs used in driver instances dm suspend: return -ERESTARTSYS instead of -EINTR scsi: mpt3sas: Avoid IOMMU page faults on REPORT ZONES filelock: Correct the filelock owner in fcntl_setlk/fcntl_setlk64 media: uvcvideo: Fix integer overflow calculating timestamp ata: libata-core: Fix null pointer dereference on error cgroup/cpuset: Prevent UAF in proc_cpuset_show() memcg: enable accounting of ipc resources fbcon: Prevent that screen size is smaller than font size fbmem: Check virtual screen sizes in fb_set_var() net:rds: Fix possible deadlock in rds_message_put ida: Fix crash in ida_free when the bitmap is empty net: prevent mss overflow in skb_segment() soundwire: stream: fix programming slave ports for non-continous port maps gtp: fix a potential NULL pointer dereference net: busy-poll: use ktime_get_ns() instead of local_clock() cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller USB: serial: option: add MeiG Smart SRM825L usb: dwc3: omap: add missing depopulate in probe error path usb: dwc3: core: Prevent USB core invalid event buffer address access usb: dwc3: st: fix probed platform device ref count on probe error path usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes() scsi: aacraid: Fix double-free on probe failure ipc: remove memcg accounting for sops objects in do_semtimedop() drm/fb-helper: set x/yres_virtual in drm_fb_helper_check_var Linux 4.19.321 Change-Id: I5ee663c7c3343a99e3c73dd8f663ca5c4e298478 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
|
Jason Gerecke
|
10ddadfab0 |
HID: wacom: Defer calculation of resolution until resolution_code is known
commit 1b8f9c1fb464968a5b18d3acc1da8c00bad24fad upstream.
The Wacom driver maps the HID_DG_TWIST usage to ABS_Z (rather than ABS_RZ)
for historic reasons. When the code to support twist was introduced in
commit
|
||
|
bengris32
|
425dddb2d1 |
Merge tag 'ASB-2024-07-05_4.19-stable' of https://android.googlesource.com/kernel/common into lineage-21
https://source.android.com/docs/security/bulletin/2024-07-01 CVE-2024-26923 * tag 'ASB-2024-07-05_4.19-stable' of https://android.googlesource.com/kernel/common: Linux 4.19.317 arm64: dts: rockchip: Add sound-dai-cells for RK3368 tcp: Fix data races around icsk->icsk_af_ops. ipv6: Fix data races around sk->sk_prot. ipv6: annotate some data-races around sk->sk_prot pwm: stm32: Refuse too small period requests ftruncate: pass a signed offset ata: libata-core: Fix double free on error batman-adv: Don't accept TT entries for out-of-spec VIDs drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes hexagon: fix fadvise64_64 calling conventions tty: mcf: MCF54418 has 10 UARTS usb: atm: cxacru: fix endpoint checking in cxacru_bind() usb: musb: da8xx: fix a resource leak in probe() usb: gadget: printer: SS+ support net: usb: ax88179_178a: improve link status logs iio: chemical: bme680: Fix sensor data read operation iio: chemical: bme680: Fix overflows in compensate() functions iio: chemical: bme680: Fix calibration data variable iio: chemical: bme680: Fix pressure value output iio: adc: ad7266: Fix variable checking bug mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos x86: stop playing stack games in profile_pc() i2c: ocores: set IACK bit after core is enabled i2c: ocores: stop transfer on timeout gpio: davinci: Validate the obtained number of IRQs nvme: fixup comment for nvme RDMA Provider Type soc: ti: wkup_m3_ipc: Send NULL dummy message instead of pointer message media: dvbdev: Initialize sbuf ALSA: emux: improve patch ioctl data validation net/iucv: Avoid explicit cpumask var allocation on stack drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers ASoC: fsl-asoc-card: set priv->pdev before using it netfilter: nf_tables: validate family when identifying table via handle drm/amdgpu: fix UBSAN warning in kv_dpm.c pinctrl: rockchip: fix pinmux reset in rockchip_pmx_set pinctrl: rockchip: fix pinmux bits for RK3328 GPIO3-B pins pinctrl: rockchip: fix pinmux bits for RK3328 GPIO2-B pins pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER usb: xhci: do not perform Soft Retry for some xHCI hosts xhci: Set correct transferred length for cancelled bulk transfers xhci: Use soft retry to recover faster from transaction errors scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory scsi: mpt3sas: Gracefully handle online firmware update scsi: mpt3sas: Add ioc_<level> logging macros iio: dac: ad5592r: fix temperature channel scaling value iio: dac: ad5592r: un-indent code-block for scale read iio: dac: ad5592r-base: Replace indio_dev->mlock with own device lock x86/amd_nb: Check for invalid SMN reads PCI: Add PCI_ERROR_RESPONSE and related definitions perf/core: Fix missing wakeup when waiting for context reference tracing: Add MODULE_DESCRIPTION() to preemptirq_delay_test selftests/ftrace: Fix checkbashisms errors ARM: dts: samsung: smdk4412: fix keypad no-autorepeat ARM: dts: samsung: exynos4412-origen: fix keypad no-autorepeat ARM: dts: samsung: smdkv310: fix keypad no-autorepeat gcov: add support for GCC 14 drm/radeon: fix UBSAN warning in kv_dpm.c ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." dmaengine: ioatdma: Fix missing kmem_cache_destroy() regulator: core: Fix modpost error "regulator_get_regmap" undefined net: usb: rtl8150 fix unintiatilzed variables in rtl8150_get_link_ksettings virtio_net: checksum offloading handling fix xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() ipv6: prevent possible NULL dereference in rt6_probe() netrom: Fix a memory leak in nr_heartbeat_expiry() cipso: fix total option length computation MIPS: Routerboard 532: Fix vendor retry check code MIPS: Octeon: Add PCIe link status check PCI/PM: Avoid D3cold for HP Pavilion 17 PC/1972 PCIe Ports udf: udftime: prevent overflow in udf_disk_stamp_to_time() usb: misc: uss720: check for incompatible versions of the Belkin F5U002 powerpc/io: Avoid clang null pointer arithmetic warnings powerpc/pseries: Enforce hcall result buffer validity and size scsi: qedi: Fix crash while reading debugfs attribute batman-adv: bypass empty buckets in batadv_purge_orig_ref() rcutorture: Fix rcu_torture_one_read() pipe_count overflow comment usb-storage: alauda: Check whether the media is initialized hugetlb_encode.h: fix undefined behaviour (34 << 26) hv_utils: drain the timesync packets on onchannelcallback nilfs2: fix potential kernel bug due to lack of writeback flag waiting intel_th: pci: Add Lunar Lake support intel_th: pci: Add Meteor Lake-S support intel_th: pci: Add Sapphire Rapids SOC support intel_th: pci: Add Granite Rapids SOC support intel_th: pci: Add Granite Rapids support dmaengine: axi-dmac: fix possible race in remove() PCI: rockchip-ep: Remove wrong mask on subsys_vendor_id ocfs2: fix races between hole punching and AIO+DIO ocfs2: use coarse time for new created files fs/proc: fix softlockup in __read_vmcore vmci: prevent speculation leaks by sanitizing event in event_deliver() drm/exynos/vidi: fix memory leak in .get_modes() drivers: core: synchronize really_probe() and dev_uevent() net/ipv6: Fix the RT cache flush via sysctl using a previous delay ipv6/route: Add a missing check on proc_dointvec Bluetooth: L2CAP: Fix rejecting L2CAP_CONN_PARAM_UPDATE_REQ tcp: fix race in tcp_v6_syn_recv_sock() drm/bridge/panel: Fix runtime warning on panel bridge release liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet iommu/amd: Fix sysfs leak in iommu init HID: core: remove unnecessary WARN_ON() in implement() xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING Input: try trimming too long modalias strings xhci: Apply broken streams quirk to Etron EJ188 xHCI host xhci: Apply reset resume quirk to Etron EJ188 xHCI host jfs: xattr: fix buffer overflow for invalid xattr mei: me: release irq in mei_me_pci_resume error path USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors nilfs2: return the mapped address from nilfs_get_page() nilfs2: Remove check for PageError selftests/mm: compaction_test: fix bogus test success on Aarch64 selftests/mm: conform test to TAP format output selftests/mm: compaction_test: fix incorrect write of zero to nr_hugepages media: mc: mark the media devnode as registered from the, start serial: sc16is7xx: fix bug in sc16is7xx_set_baud() when using prescaler serial: sc16is7xx: replace hardcoded divisor value with BIT() macro drm/amd/display: Handle Y carry-over in VCP X.Y calculation usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete af_unix: Annotate data-race of sk->sk_shutdown in sk_diag_fill(). af_unix: Use skb_queue_len_lockless() in sk_diag_show_rqlen(). af_unix: Use unix_recvq_full_lockless() in unix_stream_connect(). af_unix: Annotate data-race of net->unx.sysctl_max_dgram_qlen. af_unix: Annotate data-races around sk->sk_state in UNIX_DIAG. af_unix: Annotate data-races around sk->sk_state in sendmsg() and recvmsg(). af_unix: Annotate data-races around sk->sk_state in unix_write_space() and poll(). af_unix: Annotate data-race of sk->sk_state in unix_inq_len(). ptp: Fix error message on failed pin verification tcp: count CLOSE-WAIT sockets for TCP_MIB_CURRESTAB vxlan: Fix regression when dropping packets due to invalid src addresses ipv6: sr: block BH in seg6_output_core() and seg6_input_core() wifi: iwlwifi: mvm: don't read past the mfuart notifcation wifi: iwlwifi: mvm: revert gen2 TX A-MPDU size to 64 wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects ANDROID: arm64: Place CFI jump table sections in .text Linux 4.19.316 nfs: fix undefined behavior in nfs_block_bits() s390/ap: Fix crash in AP internal function modify_bitmap() ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() sparc: move struct termio to asm/termios.h net: fix __dst_negative_advice() race kdb: Use format-specifiers rather than memset() for padding in kdb_read() kdb: Merge identical case statements in kdb_read() kdb: Fix console handling when editing and tab-completing commands kdb: Use format-strings rather than '\0' injection in kdb_read() kdb: Fix buffer overflow during tab-complete sparc64: Fix number of online CPUs intel_th: pci: Add Meteor Lake-S CPU support net/9p: fix uninit-value in p9_client_rpc() crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak KVM: arm64: Allow AArch32 PSTATE.M to be restored as System mode netfilter: nf_tables: discard table flag update with pending basechain deletion netfilter: nf_tables: reject new basechain after table flag update netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout netfilter: nf_tables: do not compare internal table flags on updates netfilter: nf_tables: allow NFPROTO_INET in nft_(match/target)_validate() netfilter: nf_tables: set dormant flag on hook register failure netfilter: nft_set_rbtree: skip end interval element from gc netfilter: nf_tables: validate NFPROTO_* family netfilter: nf_tables: skip dead set elements in netlink dump netfilter: nf_tables: mark newset as dead on transaction abort netfilter: nft_dynset: relax superfluous check on set updates netfilter: nft_dynset: report EOPNOTSUPP on missing set feature netfilter: nftables: exthdr: fix 4-byte stack OOB write netfilter: nft_dynset: fix timeouts later than 23 days netfilter: nf_tables: bogus EBUSY when deleting flowtable after flush (for 4.19) netfilter: nf_tables: disable toggling dormant table state more than once netfilter: nf_tables: fix table flag updates netfilter: nftables: update table flags from the commit phase netfilter: nf_tables: double hook unregistration in netns path netfilter: nf_tables: unregister flowtable hooks on netns exit netfilter: nf_tables: fix memleak when more than 255 elements expired netfilter: nft_set_hash: try later when GC hits EAGAIN on iteration netfilter: nft_set_rbtree: use read spinlock to avoid datapath contention netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction netfilter: nf_tables: defer gc run if previous batch is still pending netfilter: nf_tables: GC transaction race with abort path netfilter: nf_tables: GC transaction race with netns dismantle netfilter: nf_tables: fix GC transaction races with netns and netlink event exit path netfilter: nf_tables: remove busy mark and gc batch API netfilter: nf_tables: adapt set backend to use GC transaction API netfilter: nf_tables: GC transaction API to avoid race with control plane netfilter: nf_tables: don't skip expired elements during walk netfilter: nft_set_rbtree: fix overlap expiration walk netfilter: nft_set_rbtree: fix null deref on element insertion netfilter: nft_set_rbtree: Switch to node list walk for overlap detection netfilter: nft_set_rbtree: Add missing expired checks netfilter: nft_set_rbtree: allow loose matching of closing element in interval netfilter: nf_tables: drop map element references from preparation phase netfilter: nftables: rename set element data activation/deactivation functions netfilter: nf_tables: pass context to nft_set_destroy() fbdev: savage: Handle err return when savagefb_check_var failed media: v4l2-core: hold videodev_lock until dev reg, finishes media: mxl5xx: Move xpt structures off stack arm64: dts: hi3798cv200: fix the size of GICR wifi: rtl8xxxu: Fix the TX power of RTL8192CU, RTL8723AU md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING arm64: tegra: Correct Tegra132 I2C alias ata: pata_legacy: make legacy_exit() work again neighbour: fix unaligned access to pneigh_entry vxlan: Fix regression when dropping packets due to invalid src addresses nilfs2: fix use-after-free of timer for log writer thread mmc: core: Do not force a retune before RPMB switch binder: fix max_thread type inconsistency SUNRPC: Fix loop termination condition in gss_free_in_token_pages() genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline ALSA: timer: Set lower bound of start tick time ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound kconfig: fix comparison to constant symbols, 'm', 'n' net:fec: Add fec_enet_deinit() net: usb: smsc95xx: fix changing LED_SEL bit value updated from EEPROM smsc95xx: use usbnet->driver_priv smsc95xx: remove redundant function arguments enic: Validate length of nl attributes in enic_set_vf_port dma-buf/sw-sync: don't enable IRQ from sync_print_obj() net/mlx5e: Use rx_missed_errors instead of rx_dropped for reporting buffer exhaustion nvmet: fix ns enable/disable possible hang spi: Don't mark message DMA mapped when no transfer in it is netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() nfc: nci: Fix handling of zero-length payload packets in nci_rx_work() nfc: nci: Fix kcov check in nci_rx_work() net: fec: avoid lock evasion when reading pps_enable virtio: delete vq in vp_find_vqs_msix() when request_irq() fails arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY openvswitch: Set the skbuff pkt_type for proper pmtud support. tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). params: lift param_set_uint_minmax to common code ipv6: sr: fix memleak in seg6_hmac_init_algo nfc: nci: Fix uninit-value in nci_rx_work x86/kconfig: Select ARCH_WANT_FRAME_POINTERS again when UNWINDER_FRAME_POINTER=y null_blk: Fix the WARNING: modpost: missing MODULE_DESCRIPTION() media: cec: cec-api: add locking in cec_release() media: cec: cec-adap: always cancel work in cec_transmit_msg_fh um: Fix the -Wmissing-prototypes warning for __switch_mm powerpc/pseries: Add failure related checks for h_get_mpp and h_get_ppp media: stk1160: fix bounds checking in stk1160_copy_video() um: Add winch to winch_handlers before registering winch IRQ um: Fix return value in ubd_init() drm/msm/dpu: use kms stored hw mdp block Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation Input: ims-pcu - fix printf string overflow libsubcmd: Fix parse-options memory leak serial: sh-sci: protect invalidating RXDMA on shutdown serial: sh-sci: Extract sci_dma_rx_chan_invalidate() f2fs: fix to release node block count in error path of f2fs_new_node_page() f2fs: add error prints for debugging mount failure extcon: max8997: select IRQ_DOMAIN instead of depending on it ppdev: Add an error check in register_device ppdev: Remove usage of the deprecated ida_simple_xx() API stm class: Fix a double free in stm_register_device() usb: gadget: u_audio: Clear uac pointer when freed. microblaze: Remove early printk call from cpuinfo-static.c microblaze: Remove gcc flag for non existing early_printk.c file greybus: arche-ctrl: move device table to its right location serial: max3100: Fix bitwise types serial: max3100: Update uart_driver_registered on driver removal serial: max3100: Lock port->lock when calling uart_handle_cts_change() firmware: dmi-id: add a release callback function dmaengine: idma64: Add check for dma_set_max_seg_size greybus: lights: check return of get_channel_from_mode sched/fair: Allow disabling sched_balance_newidle with sched_relax_domain_level sched/topology: Don't set SD_BALANCE_WAKE on cpuset domain relax af_packet: do not call packet_read_pending() from tpacket_destruct_skb() netrom: fix possible dead-lock in nr_rt_ioctl() RDMA/IPoIB: Fix format truncation compilation errors selftests/kcmp: remove unused open mode selftests/kcmp: Make the test output consistent and clear SUNRPC: Fix gss_free_in_token_pages() ext4: avoid excessive credit estimate in ext4_tmpfile() x86/insn: Fix PUSH instruction in x86 instruction decoder opcode map RDMA/hns: Use complete parentheses in macros ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value drm/arm/malidp: fix a possible null pointer dereference fbdev: sh7760fb: allow modular build media: radio-shark2: Avoid led_names truncations media: ngene: Add dvb_ca_en50221_init return value check fbdev: sisfb: hide unused variables powerpc/fsl-soc: hide unused const variable drm/mediatek: Add 0 size check to mtk_drm_gem_obj fbdev: shmobile: fix snprintf truncation mtd: rawnand: hynix: fixed typo drm/amd/display: Fix potential index out of bounds in color transformation function ipv6: sr: fix invalid unregister error path ipv6: sr: fix incorrect unregister order ipv6: sr: add missing seg6_local_exit net: openvswitch: fix overwriting ct original tuple for ICMPv6 net: usb: smsc95xx: stop lying about skb->truesize af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg net: ethernet: cortina: Locking fixes m68k: mac: Fix reboot hang on Mac IIci m68k/mac: Use '030 reset method on SE/30 m68k: Fix spinlock race in kernel thread creation net: usb: sr9700: stop lying about skb->truesize wifi: mwl8k: initialize cmd->addr[] properly scsi: qedf: Ensure the copied buf is NUL terminated scsi: bfa: Ensure the copied buf is NUL terminated Revert "sh: Handle calling csum_partial with misaligned data" sh: kprobes: Merge arch_copy_kprobe() into arch_prepare_kprobe() wifi: ar5523: enable proper endpoint verification wifi: carl9170: add a proper sanity check for endpoints macintosh/via-macii: Fix "BUG: sleeping function called from invalid context" macintosh/via-macii, macintosh/adb-iop: Clean up whitespace macintosh/via-macii: Remove BUG_ON assertions wifi: ath10k: populate board data for WCN3990 wifi: ath10k: Fix an error code problem in ath10k_dbg_sta_write_peer_debug_trigger() x86/purgatory: Switch to the position-independent small code model scsi: hpsa: Fix allocation size for Scsi_Host private data scsi: libsas: Fix the failure of adding phy with zero-address to port ACPI: disable -Wstringop-truncation irqchip/alpine-msi: Fix off-by-one in allocation error path scsi: ufs: core: Perform read back after disabling UIC_COMMAND_COMPL scsi: ufs: core: Perform read back after disabling interrupts scsi: ufs: add a low-level __ufshcd_issue_tm_cmd helper scsi: ufs: cleanup struct utp_task_req_desc scsi: ufs: qcom: Perform read back after writing reset bit qed: avoid truncating work queue length x86/boot: Ignore relocations in .notes sections in walk_relocs() too wifi: ath10k: poll service ready message before failing nfsd: drop st_mutex before calling move_to_close_lru() power: supply: cros_usbpd: provide ID table for avoiding fallback match md: fix resync softlockup when bitmap size is less than array size null_blk: Fix missing mutex_destroy() at module removal jffs2: prevent xattr node from overflowing the eraseblock s390/cio: fix tracepoint subchannel type field crypto: ccp - drop platform ifdef checks crypto: ccp - Remove forward declaration parisc: add missing export of __cmpxchg_u8() nilfs2: fix out-of-range warning ecryptfs: Fix buffer size for tag 66 packet firmware: raspberrypi: Use correct device for DMA mappings crypto: bcm - Fix pointer arithmetic ASoC: da7219-aad: fix usage of device_get_named_child_node() ASoC: dt-bindings: rt5645: add cbj sleeve gpio property ASoC: rt5645: Fix the electric noise due to the CBJ contacts floating drm/amd/display: Set color_mgmt_changed to true on unsuspend net: usb: qmi_wwan: add Telit FN920C04 compositions wifi: cfg80211: fix the order of arguments for trace events of the tx_rx_evt class tty: n_gsm: fix possible out-of-bounds in gsm0_receive() nilfs2: fix potential hang in nilfs_detach_log_writer() nilfs2: fix unexpected freezing of nilfs_segctor_sync() net: smc91x: Fix m68k kernel compilation for ColdFire CPU ring-buffer: Fix a race between readers and resize checks speakup: Fix sizeof() vs ARRAY_SIZE() bug x86/tsc: Trust initial offset in architectural TSC-adjust MSRs Change-Id: Ia8a0522057b7e917a9c165a869bec3a24bb9eb58 Signed-off-by: bengris32 <bengris32@protonmail.ch> |
||
|
Greg Kroah-Hartman
|
46d5c15467 |
Merge 4.19.317 into android-4.19-stable
Changes in 4.19.317
wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects
wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()
wifi: iwlwifi: mvm: revert gen2 TX A-MPDU size to 64
wifi: iwlwifi: mvm: don't read past the mfuart notifcation
ipv6: sr: block BH in seg6_output_core() and seg6_input_core()
vxlan: Fix regression when dropping packets due to invalid src addresses
tcp: count CLOSE-WAIT sockets for TCP_MIB_CURRESTAB
ptp: Fix error message on failed pin verification
af_unix: Annotate data-race of sk->sk_state in unix_inq_len().
af_unix: Annotate data-races around sk->sk_state in unix_write_space() and poll().
af_unix: Annotate data-races around sk->sk_state in sendmsg() and recvmsg().
af_unix: Annotate data-races around sk->sk_state in UNIX_DIAG.
af_unix: Annotate data-race of net->unx.sysctl_max_dgram_qlen.
af_unix: Use unix_recvq_full_lockless() in unix_stream_connect().
af_unix: Use skb_queue_len_lockless() in sk_diag_show_rqlen().
af_unix: Annotate data-race of sk->sk_shutdown in sk_diag_fill().
usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete
drm/amd/display: Handle Y carry-over in VCP X.Y calculation
serial: sc16is7xx: replace hardcoded divisor value with BIT() macro
serial: sc16is7xx: fix bug in sc16is7xx_set_baud() when using prescaler
media: mc: mark the media devnode as registered from the, start
selftests/mm: compaction_test: fix incorrect write of zero to nr_hugepages
selftests/mm: conform test to TAP format output
selftests/mm: compaction_test: fix bogus test success on Aarch64
nilfs2: Remove check for PageError
nilfs2: return the mapped address from nilfs_get_page()
nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors
USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
mei: me: release irq in mei_me_pci_resume error path
jfs: xattr: fix buffer overflow for invalid xattr
xhci: Apply reset resume quirk to Etron EJ188 xHCI host
xhci: Apply broken streams quirk to Etron EJ188 xHCI host
Input: try trimming too long modalias strings
xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING
HID: core: remove unnecessary WARN_ON() in implement()
iommu/amd: Fix sysfs leak in iommu init
liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet
drm/bridge/panel: Fix runtime warning on panel bridge release
tcp: fix race in tcp_v6_syn_recv_sock()
Bluetooth: L2CAP: Fix rejecting L2CAP_CONN_PARAM_UPDATE_REQ
ipv6/route: Add a missing check on proc_dointvec
net/ipv6: Fix the RT cache flush via sysctl using a previous delay
drivers: core: synchronize really_probe() and dev_uevent()
drm/exynos/vidi: fix memory leak in .get_modes()
vmci: prevent speculation leaks by sanitizing event in event_deliver()
fs/proc: fix softlockup in __read_vmcore
ocfs2: use coarse time for new created files
ocfs2: fix races between hole punching and AIO+DIO
PCI: rockchip-ep: Remove wrong mask on subsys_vendor_id
dmaengine: axi-dmac: fix possible race in remove()
intel_th: pci: Add Granite Rapids support
intel_th: pci: Add Granite Rapids SOC support
intel_th: pci: Add Sapphire Rapids SOC support
intel_th: pci: Add Meteor Lake-S support
intel_th: pci: Add Lunar Lake support
nilfs2: fix potential kernel bug due to lack of writeback flag waiting
hv_utils: drain the timesync packets on onchannelcallback
hugetlb_encode.h: fix undefined behaviour (34 << 26)
usb-storage: alauda: Check whether the media is initialized
rcutorture: Fix rcu_torture_one_read() pipe_count overflow comment
batman-adv: bypass empty buckets in batadv_purge_orig_ref()
scsi: qedi: Fix crash while reading debugfs attribute
powerpc/pseries: Enforce hcall result buffer validity and size
powerpc/io: Avoid clang null pointer arithmetic warnings
usb: misc: uss720: check for incompatible versions of the Belkin F5U002
udf: udftime: prevent overflow in udf_disk_stamp_to_time()
PCI/PM: Avoid D3cold for HP Pavilion 17 PC/1972 PCIe Ports
MIPS: Octeon: Add PCIe link status check
MIPS: Routerboard 532: Fix vendor retry check code
cipso: fix total option length computation
netrom: Fix a memory leak in nr_heartbeat_expiry()
ipv6: prevent possible NULL dereference in rt6_probe()
xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()
virtio_net: checksum offloading handling fix
net: usb: rtl8150 fix unintiatilzed variables in rtl8150_get_link_ksettings
regulator: core: Fix modpost error "regulator_get_regmap" undefined
dmaengine: ioatdma: Fix missing kmem_cache_destroy()
ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine."
drm/radeon: fix UBSAN warning in kv_dpm.c
gcov: add support for GCC 14
ARM: dts: samsung: smdkv310: fix keypad no-autorepeat
ARM: dts: samsung: exynos4412-origen: fix keypad no-autorepeat
ARM: dts: samsung: smdk4412: fix keypad no-autorepeat
selftests/ftrace: Fix checkbashisms errors
tracing: Add MODULE_DESCRIPTION() to preemptirq_delay_test
perf/core: Fix missing wakeup when waiting for context reference
PCI: Add PCI_ERROR_RESPONSE and related definitions
x86/amd_nb: Check for invalid SMN reads
iio: dac: ad5592r-base: Replace indio_dev->mlock with own device lock
iio: dac: ad5592r: un-indent code-block for scale read
iio: dac: ad5592r: fix temperature channel scaling value
scsi: mpt3sas: Add ioc_<level> logging macros
scsi: mpt3sas: Gracefully handle online firmware update
scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory
xhci: Use soft retry to recover faster from transaction errors
xhci: Set correct transferred length for cancelled bulk transfers
usb: xhci: do not perform Soft Retry for some xHCI hosts
pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER
pinctrl: rockchip: fix pinmux bits for RK3328 GPIO2-B pins
pinctrl: rockchip: fix pinmux bits for RK3328 GPIO3-B pins
pinctrl: rockchip: fix pinmux reset in rockchip_pmx_set
drm/amdgpu: fix UBSAN warning in kv_dpm.c
netfilter: nf_tables: validate family when identifying table via handle
ASoC: fsl-asoc-card: set priv->pdev before using it
netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers
drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep
net/iucv: Avoid explicit cpumask var allocation on stack
ALSA: emux: improve patch ioctl data validation
media: dvbdev: Initialize sbuf
soc: ti: wkup_m3_ipc: Send NULL dummy message instead of pointer message
nvme: fixup comment for nvme RDMA Provider Type
gpio: davinci: Validate the obtained number of IRQs
i2c: ocores: stop transfer on timeout
i2c: ocores: set IACK bit after core is enabled
x86: stop playing stack games in profile_pc()
mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
iio: adc: ad7266: Fix variable checking bug
iio: chemical: bme680: Fix pressure value output
iio: chemical: bme680: Fix calibration data variable
iio: chemical: bme680: Fix overflows in compensate() functions
iio: chemical: bme680: Fix sensor data read operation
net: usb: ax88179_178a: improve link status logs
usb: gadget: printer: SS+ support
usb: musb: da8xx: fix a resource leak in probe()
usb: atm: cxacru: fix endpoint checking in cxacru_bind()
tty: mcf: MCF54418 has 10 UARTS
hexagon: fix fadvise64_64 calling conventions
drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes
drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes
batman-adv: Don't accept TT entries for out-of-spec VIDs
ata: libata-core: Fix double free on error
ftruncate: pass a signed offset
pwm: stm32: Refuse too small period requests
ipv6: annotate some data-races around sk->sk_prot
ipv6: Fix data races around sk->sk_prot.
tcp: Fix data races around icsk->icsk_af_ops.
arm64: dts: rockchip: Add sound-dai-cells for RK3368
Linux 4.19.317
Change-Id: Ic469df3aff3d8233947e4f13951e091deca41c65
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
|
||
|
Nikita Zhandarovich
|
955b376467 |
HID: core: remove unnecessary WARN_ON() in implement()
[ Upstream commit 4aa2dcfbad538adf7becd0034a3754e1bd01b2b5 ]
Syzkaller hit a warning [1] in a call to implement() when trying
to write a value into a field of smaller size in an output report.
Since implement() already has a warn message printed out with the
help of hid_warn() and value in question gets trimmed with:
...
value &= m;
...
WARN_ON may be considered superfluous. Remove it to suppress future
syzkaller triggers.
[1]
WARNING: CPU: 0 PID: 5084 at drivers/hid/hid-core.c:1451 implement drivers/hid/hid-core.c:1451 [inline]
WARNING: CPU: 0 PID: 5084 at drivers/hid/hid-core.c:1451 hid_output_report+0x548/0x760 drivers/hid/hid-core.c:1863
Modules linked in:
CPU: 0 PID: 5084 Comm: syz-executor424 Not tainted 6.9.0-rc7-syzkaller-00183-gcf87f46fd34d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
RIP: 0010:implement drivers/hid/hid-core.c:1451 [inline]
RIP: 0010:hid_output_report+0x548/0x760 drivers/hid/hid-core.c:1863
...
Call Trace:
<TASK>
__usbhid_submit_report drivers/hid/usbhid/hid-core.c:591 [inline]
usbhid_submit_report+0x43d/0x9e0 drivers/hid/usbhid/hid-core.c:636
hiddev_ioctl+0x138b/0x1f00 drivers/hid/usbhid/hiddev.c:726
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:904 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:890
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
...
Fixes:
|
||
|
Roderick Colenbrander
|
42deae6724 |
UPSTREAM: HID: playstation: support updated DualSense rumble mode.
Newer DualSense firmware supports a revised classic rumble mode, which feels more similar to rumble as supported on previous PlayStation controllers. It has been made the default on PlayStation and non-PlayStation devices now (e.g. iOS and Windows). Default to this new mode when supported. Signed-off-by: Roderick Colenbrander <roderick.colenbrander@sony.com> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Link: https://lore.kernel.org/r/20221010212313.78275-4-roderick.colenbrander@sony.com Bug: 260685629 (cherry picked from commit 9fecab247ed15e6145c126fc56ee1e89860741a7) Change-Id: Icd330111a4d1b1e76a04cd11c623d0982ce3d66f Signed-off-by: Farid Chahla <farid.chahla@sony.com> |
||
|
Roderick Colenbrander
|
2fa3c14e7c |
UPSTREAM: HID: playstation: add initial DualSense Edge controller support
Provide initial support for the DualSense Edge controller. The brings support up to the level of the original DualSense, but won't yet provide support for new features (e.g. reprogrammable buttons). Signed-off-by: Roderick Colenbrander <roderick.colenbrander@sony.com> CC: stable@vger.kernel.org Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Link: https://lore.kernel.org/r/20221010212313.78275-3-roderick.colenbrander@sony.com Bug: 260685629 (cherry picked from commit b8a968efab301743fd659b5649c5d7d3e30e63a6) Change-Id: I5b95de806e823085d1144f016d8cfd76e4a933ef Signed-off-by: Farid Chahla <farid.chahla@sony.com> |
||
|
Roderick Colenbrander
|
b926654828 |
UPSTREAM: HID: playstation: add DualSense player LED support.
The DualSense features 5 player LEDs below its touchpad, which are meant as player id indications. The LEDs are configured with a player ID determined by an ID allocator, which assign player ids to ps_device instances. This patch is a combination of the following original patches minus use of LED framework APIs: - HID: playstation: add DualSense player LEDs support. - HID: playstation: DualSense set LEDs to default player id. Signed-off-by: Roderick Colenbrander <roderick.colenbrander@sony.com> Reviewed-by: Barnabás Pőcze <pobrn@protonmail.com> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Bug: 167947264 Change-Id: I2a9ef9949bb82df18247a14e64cb8c54e9b3924c (cherry picked from commit 949aaccda019723050a2cd98d7b4492b06423f27) Signed-off-by: Farid Chahla <farid.chahla@sony.com> |
||
|
Roderick Colenbrander
|
eb5b1ef25b |
UPSTREAM: HID: playstation: add microphone mute support for DualSense.
The DualSense controller has a built-in microphone exposed as an audio device over USB (or HID using Bluetooth). A dedicated button on the controller handles mute, but software has to configure the device to mute the audio stream. This patch captures the mute button and schedules an output report to mute/unmute the audio stream as well as toggle the mute LED. Signed-off-by: Roderick Colenbrander <roderick.colenbrander@sony.com> Reviewed-by: Barnabás Pőcze <pobrn@protonmail.com> Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Bug: 167947264 Change-Id: I6fce08b0b28c1cf41c682a2ff5655f00d7a52843 (cherry picked from commit c26e48b150fccb07c4b7f0f419f2b0a2c42e57d2) Signed-off-by: Farid Chahla <farid.chahla@sony.com> |