lisa/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

This is the 5.4.234 stable release

Browse Source 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmQBzvYACgkQONu9yGCS
 aT74Kg//bz7qQT9GuM8kadwoz3ZA075tC2kW/rviywRPLKzs/jOKniwCxdvExXwV
 Ym1lw8d2CTie6VYdKzKAwJRkbeYjcIU41zhF+YPBupfUU45XGZR3gZzIDYnvAgKp
 UkWPwlcOrTbSTDc18HnvJjAnIyxxisJOfXTsTPetkhXufTlrvGTPOiPh8ufxDZ1x
 K2uLoJJoOTBHGIx1ccutyolu1UiCp7dRj27sbJWmy8nCb8fbn2RVJxvYnzPlW2TS
 c3bSpfpbV8s0wQMK+TWajFqMx+rJNZH+IHAGVpDhU8EcoUMM1/WvvaJ7r5D+gKkK
 mXNiU1m8u6IuY4wkaZ4vG7JUQwTRjgAKhlHhi5Q1u/JEDEjAaF+ThmGOHTT1uz9k
 JLEMujXCI2CISxiEoh1T6T8NGjHfrVKnKt1XFBFryaHCgZ92bnpnor1fQ744feit
 dbVWMBh6I8zvLFt/bB1UcPsoYqlRZXPWVZKZsNq9XwTC+LyV/C4gBkqZznYXLzIO
 VUDPkplle0wnK4JjPaQMDFa92JaLb2Sw1tBaKVH5QZuxShLkBWQmVBKLp/ZDk0NP
 va9O0T0JhlbxvDLsWwsbqYi0WYc2JpwMuV9u3NFL/M8pK5bt3zL7AmG/5Qyd8r56
 EwycjC3yqBU85WQ5W+D3j5S3n4jvYgJKQMDXf5fZWHUKcpFZbEk=
 =Na3Y
 -----END PGP SIGNATURE-----

Merge 5.4.234 into android11-5.4-lts

Changes in 5.4.234
	arm64: dts: rockchip: drop unused LED mode property from rk3328-roc-cc
	ARM: dts: rockchip: add power-domains property to dp node on rk3288
	ACPI: NFIT: fix a potential deadlock during NFIT teardown
	btrfs: send: limit number of clones and allocated memory size
	IB/hfi1: Assign npages earlier
	neigh: make sure used and confirmed times are valid
	HID: core: Fix deadloop in hid_apply_multiplier.
	bpf: bpf_fib_lookup should not return neigh in NUD_FAILED state
	net: Remove WARN_ON_ONCE(sk->sk_forward_alloc) from sk_stream_kill_queues().
	vc_screen: don't clobber return value in vcs_read
	dmaengine: sh: rcar-dmac: Check for error num after dma_set_max_seg_size
	USB: serial: option: add support for VW/Skoda "Carstick LTE"
	USB: core: Don't hold device lock while reading the "descriptors" sysfs file
	Linux 5.4.234

Change-Id: I6837168681c8976aff33a4de3c1d91a56ba2b708
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This commit is contained in:
Greg Kroah-Hartman 2023-03-03 12:31:23 +00:00
commit f9c844d00d
16 changed files with 43 additions and 32 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Makefile
View File

@ -1,7 +1,7 @@
# SPDX-License-Identifier: GPL-2.0
VERSION = 5
PATCHLEVEL = 4
SUBLEVEL = 233
SUBLEVEL = 234
EXTRAVERSION =
NAME = Kleptomaniac Octopus

1
arch/arm/boot/dts/rk3288.dtsi
View File

@ -1188,6 +1188,7 @@
clock-names = "dp", "pclk";
phys = <&edp_phy>;
phy-names = "dp";
power-domains = <&power RK3288_PD_VIO>;
resets = <&cru SRST_EDP>;
reset-names = "dp";
rockchip,grf = <&grf>;

2
arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
View File

@ -90,7 +90,6 @@
linux,default-trigger = "heartbeat";
gpios = <&rk805 1 GPIO_ACTIVE_LOW>;
default-state = "on";
mode = <0x23>;
};
user {
@ -98,7 +97,6 @@
linux,default-trigger = "mmc1";
gpios = <&rk805 0 GPIO_ACTIVE_LOW>;
default-state = "off";
mode = <0x05>;
};
};
};

2
drivers/acpi/nfit/core.c
View File

@ -3599,8 +3599,8 @@ void acpi_nfit_shutdown(void *data)
mutex_lock(&acpi_desc->init_mutex);
set_bit(ARS_CANCEL, &acpi_desc->scrub_flags);
cancel_delayed_work_sync(&acpi_desc->dwork);
mutex_unlock(&acpi_desc->init_mutex);
cancel_delayed_work_sync(&acpi_desc->dwork);
/*
* Bounce the nvdimm bus lock to make sure any in-flight

5
drivers/dma/sh/rcar-dmac.c
View File

@ -1824,7 +1824,10 @@ static int rcar_dmac_probe(struct platform_device *pdev)
dmac->dev = &pdev->dev;
platform_set_drvdata(pdev, dmac);
dmac->dev->dma_parms = &dmac->parms;
dma_set_max_seg_size(dmac->dev, RCAR_DMATCR_MASK);
ret = dma_set_max_seg_size(dmac->dev, RCAR_DMATCR_MASK);
if (ret)
return ret;
ret = dma_set_mask_and_coherent(dmac->dev, DMA_BIT_MASK(40));
if (ret)
return ret;

3
drivers/hid/hid-core.c
View File

@ -1190,6 +1190,7 @@ int hid_open_report(struct hid_device *device)
__u8 *end;
__u8 *next;
int ret;
int i;
static int (*dispatch_type[])(struct hid_parser *parser,
struct hid_item *item) = {
hid_parser_main,
@ -1240,6 +1241,8 @@ int hid_open_report(struct hid_device *device)
goto err;
}
device->collection_size = HID_DEFAULT_NUM_COLLECTIONS;
for (i = 0; i < HID_DEFAULT_NUM_COLLECTIONS; i++)
device->collection[i].parent_idx = -1;
ret = -EINVAL;
while ((next = fetch_item(start, end, &item)) != NULL) {

9
drivers/infiniband/hw/hfi1/user_exp_rcv.c
View File

@ -215,16 +215,11 @@ static void unpin_rcv_pages(struct hfi1_filedata *fd,
static int pin_rcv_pages(struct hfi1_filedata *fd, struct tid_user_buf *tidbuf)
{
int pinned;
unsigned int npages;
unsigned int npages = tidbuf->npages;
unsigned long vaddr = tidbuf->vaddr;
struct page **pages = NULL;
struct hfi1_devdata *dd = fd->uctxt->dd;
/* Get the number of pages the user buffer spans */
npages = num_user_pages(vaddr, tidbuf->length);
if (!npages)
return -EINVAL;
if (npages > fd->uctxt->expected_count) {
dd_dev_err(dd, "Expected buffer too big\n");
return -EINVAL;
@ -258,7 +253,6 @@ static int pin_rcv_pages(struct hfi1_filedata *fd, struct tid_user_buf *tidbuf)
return pinned;
}
tidbuf->pages = pages;
tidbuf->npages = npages;
fd->tid_n_pinned += pinned;
return pinned;
}
@ -334,6 +328,7 @@ int hfi1_user_exp_rcv_setup(struct hfi1_filedata *fd,
tidbuf->vaddr = tinfo->vaddr;
tidbuf->length = tinfo->length;
tidbuf->npages = num_user_pages(tidbuf->vaddr, tidbuf->length);
tidbuf->psets = kcalloc(uctxt->expected_count, sizeof(*tidbuf->psets),
GFP_KERNEL);
if (!tidbuf->psets) {

7
drivers/tty/vt/vc_screen.c
View File

@ -284,10 +284,11 @@ vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
ssize_t orig_count;
long p = pos;
ret = -ENXIO;
vc = vcs_vc(inode, &viewed);
if (!vc)
goto unlock_out;
if (!vc) {
ret = -ENXIO;
break;
}
/* Check whether we are above size each round,
* as copy_to_user at the end of this loop

5
drivers/usb/core/hub.c
View File

@ -2380,9 +2380,8 @@ static int usb_enumerate_device_otg(struct usb_device *udev)
* usb_enumerate_device - Read device configs/intfs/otg (usbcore-internal)
* @udev: newly addressed device (in ADDRESS state)
*
* This is only called by usb_new_device() and usb_authorize_device()
* and FIXME -- all comments that apply to them apply here wrt to
* environment.
* This is only called by usb_new_device() -- all comments that apply there
* apply here wrt to environment.
*
* If the device is WUSB and not authorized, we don't attempt to read
* the string descriptors, as they will be errored out by the device

5
drivers/usb/core/sysfs.c
View File

@ -889,11 +889,7 @@ read_descriptors(struct file *filp, struct kobject *kobj,
size_t srclen, n;
int cfgno;
void *src;
int retval;
retval = usb_lock_device_interruptible(udev);
if (retval < 0)
return -EINTR;
/* The binary attribute begins with the device descriptor.
* Following that are the raw descriptor entries for all the
* configurations (config plus subsidiary descriptors).
@ -918,7 +914,6 @@ read_descriptors(struct file *filp, struct kobject *kobj,
off -= srclen;
}
}
usb_unlock_device(udev);
return count - nleft;
}

4
drivers/usb/serial/option.c
View File

@ -402,6 +402,8 @@ static void option_instat_callback(struct urb *urb);
#define LONGCHEER_VENDOR_ID 0x1c9e
/* 4G Systems products */
/* This one was sold as the VW and Skoda "Carstick LTE" */
#define FOUR_G_SYSTEMS_PRODUCT_CARSTICK_LTE 0x7605
/* This is the 4G XS Stick W14 a.k.a. Mobilcom Debitel Surf-Stick *
* It seems to contain a Qualcomm QSC6240/6290 chipset */
#define FOUR_G_SYSTEMS_PRODUCT_W14 0x9603
@ -1976,6 +1978,8 @@ static const struct usb_device_id option_ids[] = {
.driver_info = RSVD(2) },
{ USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) },
{ USB_DEVICE(TLAYTECH_VENDOR_ID, TLAYTECH_PRODUCT_TEU800) },
{ USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_CARSTICK_LTE),
.driver_info = RSVD(0) },
{ USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14),
.driver_info = NCTRL(0) | NCTRL(1) },
{ USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W100),

6
fs/btrfs/send.c
View File

@ -7347,10 +7347,10 @@ long btrfs_ioctl_send(struct file *mnt_file, struct btrfs_ioctl_send_args *arg)
/*
* Check that we don't overflow at later allocations, we request
* clone_sources_count + 1 items, and compare to unsigned long inside
* access_ok.
* access_ok. Also set an upper limit for allocation size so this can't
* easily exhaust memory. Max number of clone sources is about 200K.
*/
if (arg->clone_sources_count >
ULONG_MAX / sizeof(struct clone_root) - 1) {
if (arg->clone_sources_count > SZ_8M / sizeof(struct clone_root)) {
ret = -EINVAL;
goto out;
}

1
net/caif/caif_socket.c
View File

@ -1022,6 +1022,7 @@ static void caif_sock_destructor(struct sock *sk)
return;
}
sk_stream_kill_queues(&cf_sk->sk);
WARN_ON(sk->sk_forward_alloc);
caif_free_client(&cf_sk->layer);
}

4
net/core/filter.c
View File

@ -4732,7 +4732,7 @@ static int bpf_ipv4_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
neigh = __ipv6_neigh_lookup_noref_stub(dev, dst);
}
if (!neigh)
if (!neigh || !(neigh->nud_state & NUD_VALID))
return BPF_FIB_LKUP_RET_NO_NEIGH;
return bpf_fib_set_fwd_params(params, neigh, dev);
@ -4845,7 +4845,7 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
* not needed here.
*/
neigh = __ipv6_neigh_lookup_noref_stub(dev, dst);
if (!neigh)
if (!neigh || !(neigh->nud_state & NUD_VALID))
return BPF_FIB_LKUP_RET_NO_NEIGH;
return bpf_fib_set_fwd_params(params, neigh, dev);

18
net/core/neighbour.c
View File

@ -240,7 +240,7 @@ static int neigh_forced_gc(struct neigh_table *tbl)
write_lock(&n->lock);
if ((n->nud_state == NUD_FAILED) ||
(n->nud_state == NUD_NOARP) ||
time_after(tref, n->updated))
!time_in_range(n->updated, tref, jiffies))
remove = true;
write_unlock(&n->lock);
@ -260,7 +260,17 @@ static int neigh_forced_gc(struct neigh_table *tbl)
static void neigh_add_timer(struct neighbour *n, unsigned long when)
{
/* Use safe distance from the jiffies - LONG_MAX point while timer
* is running in DELAY/PROBE state but still show to user space
* large times in the past.
*/
unsigned long mint = jiffies - (LONG_MAX - 86400 * HZ);
neigh_hold(n);
if (!time_in_range(n->confirmed, mint, jiffies))
n->confirmed = mint;
if (time_before(n->used, n->confirmed))
n->used = n->confirmed;
if (unlikely(mod_timer(&n->timer, when))) {
printk("NEIGH: BUG, double timer add, state is %x\n",
n->nud_state);
@ -946,12 +956,14 @@ static void neigh_periodic_work(struct work_struct *work)
goto next_elt;
}
if (time_before(n->used, n->confirmed))
if (time_before(n->used, n->confirmed) &&
time_is_before_eq_jiffies(n->confirmed))
n->used = n->confirmed;
if (refcount_read(&n->refcnt) == 1 &&
(state == NUD_FAILED ||
time_after(jiffies, n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) {
!time_in_range_open(jiffies, n->used,
n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) {
*np = n->next;
neigh_mark_dead(n);
write_unlock(&n->lock);

1
net/core/stream.c
View File

@ -209,7 +209,6 @@ void sk_stream_kill_queues(struct sock *sk)
sk_mem_reclaim(sk);
WARN_ON(sk->sk_wmem_queued);
WARN_ON(sk->sk_forward_alloc);
/* It is _impossible_ for the backlog to contain anything
* when we get here. All user references to this socket