[PATCH 4.19 043/120] udf: fix silent AED tagLocation corruption

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Steven J. Magnani [ Upstream commit 63c9e47a1642fc817654a1bc18a6ec4bbcc0f056 ] When extending a file, udf_do_extend_file() may enter following empty indirect extent. At the end of udf_do_extend_file() we revert prev_epos to point to the last written extent.

[PATCH 5.11 134/306] platform/x86: amd-pmc: put device on error paths

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Pan Bian [ Upstream commit 745ed17a04f966406c8c27c8f992544336c06013 ] Put the PCI device rdev on error paths to fix potential reference count leaks. Signed-off-by: Pan Bian Link: https://lore.kernel.org/r/20210121045005.73342-1-bianpan2...@163.com Reviewed-by:

[PATCH 4.14 73/95] staging: comedi: addi_apci_1500: Fix endian problem for command sample

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Ian Abbott commit ac0bbf55ed3be75fde1f8907e91ecd2fd589bde3 upstream. The digital input subdevice supports Comedi asynchronous commands that read interrupt status information. This uses 16-bit Comedi samples (of which only the bottom 8 bits contain status

[PATCH 5.10 112/290] s390/qeth: fix notification for pending buffers during teardown

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Julian Wiedmann [ Upstream commit 7eefda7f353ef86ad82a2dc8329e8a3538c08ab6 ] The cited commit reworked the state machine for pending TX buffers. In qeth_iqd_tx_complete() it turned PENDING into a transient state, and uses NEED_QAOB for buffers that get parked

[PATCH 4.19 065/120] Revert 95ebabde382c ("capabilities: Dont allow writing ambiguous v3 file capabilities")

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Eric W. Biederman commit 3b0c2d3eaa83da259d7726192cf55a137769012f upstream. It turns out that there are in fact userspace implementations that care and this recent change caused a regression. https://github.com/containers/buildah/issues/3071 As the motivation

[PATCH 5.4 106/168] usb: gadget: f_uac1: stop playback on function disable

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Ruslan Bilovol commit cc2ac63d4cf72104e0e7f58bb846121f0f51bb19 upstream. There is missing playback stop/cleanup in case of gadget's ->disable callback that happens on events like USB host resetting or gadget disconnection Fixes: 0591bc236015 ("usb: gadget: add

[PATCH 4.14 58/95] USB: serial: cp210x: add ID for Acuity Brands nLight Air Adapter

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Karan Singhal commit ca667a33207daeaf9c62b106815728718def60ec upstream. IDs of nLight Air Adapter, Acuity Brands, Inc.: vid: 10c4 pid: 88d8 Signed-off-by: Karan Singhal Cc: sta...@vger.kernel.org Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman

[PATCH 5.11 121/306] MIPS: kernel: Reserve exception base early to prevent corruption

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Thomas Bogendoerfer [ Upstream commit bd67b711bfaa02cf19e88aa2d9edae5c1c1d2739 ] BMIPS is one of the few platforms that do change the exception base. After commit 2dcb39645441 ("memblock: do not start bottom-up allocations with kernel_end") we started seeing

[PATCH 5.11 114/306] qxl: Fix uninitialised struct field head.surface_id

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Colin Ian King commit 738acd49eb018feb873e0fac8f9517493f6ce2c7 upstream. The surface_id struct field in head is not being initialized and static analysis warns that this is being passed through to dev->monitors_config->heads[i] on an assignment. Clear up this

[PATCH 5.11 113/306] s390/crypto: return -EFAULT if copy_to_user() fails

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Wang Qing commit 942df4be7ab40195e2a839e9de81951a5862bc5b upstream. The copy_to_user() function returns the number of bytes remaining to be copied, but we want to return -EFAULT if the copy doesn't complete. Fixes: e06670c5fe3b ("s390: vfio-ap: implement

[PATCH 4.19 057/120] scsi: target: core: Add cmd length set before cmd complete

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Aleksandr Miloserdov [ Upstream commit 1c73e0c5e54d5f7d77f422a10b03ebe61eaed5ad ] TCM doesn't properly handle underflow case for service actions. One way to prevent it is to always complete command with target_complete_cmd_with_length(), however it requires

[PATCH 4.14 51/95] usb: gadget: f_uac2: always increase endpoint max_packet_size by one audio slot

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Ruslan Bilovol commit 789ea77310f0200c84002884ffd628e2baf3ad8a upstream. As per UAC2 Audio Data Formats spec (2.3.1.1 USB Packets), if the sampling rate is a constant, the allowable variation of number of audio slots per virtual frame is +/- 1 audio slot. It

[PATCH 5.4 099/168] s390/dasd: fix hanging IO request during DASD driver unbind

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Stefan Haberland commit 66f669a272898feb1c69b770e1504aa2ec7723d1 upstream. Prevent that an IO request is build during device shutdown initiated by a driver unbind. This request will never be able to be processed or canceled and will hang forever. This will lead

[PATCH 5.4 107/168] usb: dwc3: qcom: Add missing DWC3 OF node refcount decrement

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Serge Semin commit 1cffb1c66499a9db9a735473778abf8427d16287 upstream. of_get_child_by_name() increments the reference counter of the OF node it managed to find. So after the code is done using the device node, the refcount must be decremented. Add missing

[PATCH 4.14 49/95] Goodix Fingerprint device is not a modem

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Yorick de Wid commit 4d8654e81db7346f915eca9f1aff18f385cab621 upstream. The CDC ACM driver is false matching the Goodix Fingerprint device against the USB_CDC_ACM_PROTO_AT_V25TER. The Goodix Fingerprint device is a biometrics sensor that should be handled in

[PATCH 4.19 055/120] s390/smp: __smp_rescan_cpus() - move cpumask away from stack

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Heiko Carstens [ Upstream commit 62c8dca9e194326802b43c60763f856d782b225c ] Avoid a potentially large stack frame and overflow by making "cpumask_t avail" a static variable. There is no concurrent access due to the existing locking. Signed-off-by: Heiko

[PATCH 4.14 59/95] USB: serial: cp210x: add some more GE USB IDs

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Sebastian Reichel commit 42213a0190b535093a604945db05a4225bf43885 upstream. GE CS1000 has some more custom USB IDs for CP2102N; add them to the driver to have working auto-probing. Signed-off-by: Sebastian Reichel Cc: sta...@vger.kernel.org Signed-off-by:

[PATCH 4.19 063/120] ALSA: usb-audio: Fix "cannot get freq eq" errors on Dell AE515 sound bar

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Takashi Iwai commit fec60c3bc5d1713db2727cdffc638d48f9c07dc3 upstream. Dell AE515 sound bar (413c:a506) spews the error messages when the driver tries to read the current sample frequency, hence it needs to be on the list in snd_usb_get_sample_rate_quirk().

[PATCH 5.10 113/290] net: dsa: implement a central TX reallocation procedure

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Vladimir Oltean [ Upstream commit a3b0b6479700a5b0af2c631cb2ec0fb7a0d978f2 ] At the moment, taggers are left with the task of ensuring that the skb headers are writable (which they aren't, if the frames were cloned for TX timestamping, for flooding by the

[PATCH 5.11 123/306] mptcp: reset last_snd on subflow close

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Florian Westphal [ Upstream commit e0be4931f3fee2e04dec4013ea4f27ec2db8556f ] Send logic caches last active subflow in the msk, so it needs to be cleared when the cached subflow is closed. Fixes: d5f49190def61c ("mptcp: allow picking different xmit subflows")

[PATCH 4.19 066/120] s390/dasd: fix hanging DASD driver unbind

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Stefan Haberland commit 7d365bd0bff3c0310c39ebaffc9a8458e036d666 upstream. In case of an unbind of the DASD device driver the function dasd_generic_remove() is called which shuts down the device. Among others this functions removes the int_handler from the cdev.

[PATCH 4.19 078/120] usb: xhci: Fix ASMedia ASM1042A and ASM3242 DMA addressing

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Forest Crossman commit b71c669ad8390dd1c866298319ff89fe68b45653 upstream. I've confirmed that both the ASMedia ASM1042A and ASM3242 have the same problem as the ASM1142 and ASM2142/ASM3142, where they lose some of the upper bits of 64-bit DMA addresses. As with

[PATCH 5.10 114/290] net: dsa: tag_ksz: dont allocate additional memory for padding/tagging

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Christian Eggers [ Upstream commit 88fda8eefd9a7a7175bf4dad1d02cc084058 ] The caller (dsa_slave_xmit) guarantees that the frame length is at least ETH_ZLEN and that enough memory for tail tagging is available. Signed-off-by: Christian Eggers Signed-off-by:

[PATCH 4.14 60/95] usbip: fix stub_dev to check for stream socket

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Shuah Khan commit 47ccc8fc2c9c94558b27b6f9e2582df32d29e6e8 upstream. Fix usbip_sockfd_store() to validate the passed in file descriptor is a stream socket. If the file descriptor passed was a SOCK_DGRAM socket, sock_recvmsg() can't detect end of stream. Cc:

[PATCH 5.4 120/168] usbip: fix vhci_hcd to check for stream socket

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Shuah Khan commit f55a0571690c4aae03180e001522538c0927432f upstream. Fix attach_store() to validate the passed in file descriptor is a stream socket. If the file descriptor passed was a SOCK_DGRAM socket, sock_recvmsg() can't detect end of stream. Cc:

[PATCH 4.14 63/95] usbip: fix stub_dev usbip_sockfd_store() races leading to gpf

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Shuah Khan commit 9380afd6df70e24eacbdbde33afc6a3950965d22 upstream. usbip_sockfd_store() is invoked when user requests attach (import) detach (unimport) usb device from usbip host. vhci_hcd sends import request and usbip_sockfd_store() exports the device if it

[PATCH 5.4 113/168] usb: xhci: Fix ASMedia ASM1042A and ASM3242 DMA addressing

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Forest Crossman commit b71c669ad8390dd1c866298319ff89fe68b45653 upstream. I've confirmed that both the ASMedia ASM1042A and ASM3242 have the same problem as the ASM1142 and ASM2142/ASM3142, where they lose some of the upper bits of 64-bit DMA addresses. As with

[PATCH 4.14 61/95] usbip: fix vhci_hcd to check for stream socket

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Shuah Khan commit f55a0571690c4aae03180e001522538c0927432f upstream. Fix attach_store() to validate the passed in file descriptor is a stream socket. If the file descriptor passed was a SOCK_DGRAM socket, sock_recvmsg() can't detect end of stream. Cc:

[PATCH 5.11 124/306] i2c: rcar: faster irq code to minimize HW race condition

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Wolfram Sang [ Upstream commit c7b514ec979e23a08c411f3d8ed39c7922751422 ] To avoid the HW race condition on R-Car Gen2 and earlier, we need to write to ICMCR as soon as possible in the interrupt handler. We can improve this by writing a static value instead of

[PATCH 5.11 126/306] scsi: pm80xx: Fix missing tag_free in NVMD DATA req

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: akshatzen [ Upstream commit 5d28026891c7041deec08cc5ddd8f3abd90195e1 ] Tag was not freed in NVMD get/set data request failure scenario. This caused a tag leak each time a request failed. Link:

[PATCH 5.4 110/168] usb: renesas_usbhs: Clear PIPECFG for re-enabling pipe with other EPNUM

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Yoshihiro Shimoda commit b1d25e6ee57c2605845595b6c61340d734253eb3 upstream. According to the datasheet, this controller has a restriction which "set an endpoint number so that combinations of the DIR bit and the EPNUM bits do not overlap.". However, since the

[PATCH 5.10 115/290] net: dsa: trailer: dont allocate additional memory for padding/tagging

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Christian Eggers [ Upstream commit ef3f72fee286bd270453ce2344feb7295a798508 ] The caller (dsa_slave_xmit) guarantees that the frame length is at least ETH_ZLEN and that enough memory for tail tagging is available. Signed-off-by: Christian Eggers Signed-off-by:

[PATCH 5.10 122/290] net: dsa: tag_dsa: let DSA core deal with TX reallocation

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Vladimir Oltean [ Upstream commit 952a06345015867e3bd37f8d9045fc1429637d43 ] Now that we have a central TX reallocation procedure that accounts for the tagger's needed headroom in a generic way, we can remove the skb_cow_head call. Similar to the EtherType DSA

[PATCH 5.4 111/168] usb: xhci: do not perform Soft Retry for some xHCI hosts

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Stanislaw Gruszka commit a4a251f8c23518899d2078c320cf9ce2fa459c9f upstream. On some systems rt2800usb and mt7601u devices are unable to operate since commit f8f80be501aa ("xhci: Use soft retry to recover faster from transaction errors") Seems that some xHCI

[PATCH 5.4 108/168] usb: dwc3: qcom: Honor wakeup enabled/disabled state

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Matthias Kaehlcke commit 2664deb0930643149d61cddbb66ada527ae180bd upstream. The dwc3-qcom currently enables wakeup interrupts unconditionally when suspending, however this should not be done when wakeup is disabled (e.g. through the sysfs attribute

[PATCH 4.19 076/120] usb: renesas_usbhs: Clear PIPECFG for re-enabling pipe with other EPNUM

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Yoshihiro Shimoda commit b1d25e6ee57c2605845595b6c61340d734253eb3 upstream. According to the datasheet, this controller has a restriction which "set an endpoint number so that combinations of the DIR bit and the EPNUM bits do not overlap.". However, since the

[PATCH 4.14 72/95] staging: comedi: addi_apci_1032: Fix endian problem for COS sample

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Ian Abbott commit 25317f428a78fde71b2bf3f24d05850f08a73a52 upstream. The Change-Of-State (COS) subdevice supports Comedi asynchronous commands to read 16-bit change-of-state values. However, the interrupt handler is calling `comedi_buf_write_samples()` with the

[PATCH 5.11 127/306] scsi: ufs: WB is only available on LUN #0 to #7

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Jaegeuk Kim [ Upstream commit a2fca52ee640a04112ed9d9a137c940ea6ad288e ] Kernel stack violation when getting unit_descriptor/wb_buf_alloc_units from rpmb LUN. The reason is that the unit descriptor length is different per LU. The length of Normal LU is 45 while

[PATCH 5.10 121/290] net: dsa: tag_brcm: let DSA core deal with TX reallocation

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Vladimir Oltean [ Upstream commit 2f0d030c5ffec6660f79a32b4f522155f75a9d71 ] Now that we have a central TX reallocation procedure that accounts for the tagger's needed headroom in a generic way, we can remove the skb_cow_head call. Cc: Florian Fainelli

[PATCH 4.19 077/120] xhci: Improve detection of device initiated wake signal.

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Mathias Nyman commit 253f588c70f66184b1f3a9bbb428b49bbda73e80 upstream. A xHC USB 3 port might miss the first wake signal from a USB 3 device if the port LFPS reveiver isn't enabled fast enough after xHC resume. xHC host will anyway be resumed by a PME# signal,

[PATCH 4.14 71/95] staging: rtl8192e: Fix possible buffer overflow in _rtl92e_wx_set_scan

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Lee Gibson commit 8687bf9ef9551bcf93897e33364d121667b1aadf upstream. Function _rtl92e_wx_set_scan calls memcpy without checking the length. A user could control that length and trigger a buffer overflow. Fix by checking the length is within the maximum allowed

[PATCH 4.14 70/95] staging: rtl8712: Fix possible buffer overflow in r8712_sitesurvey_cmd

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Lee Gibson commit b93c1e3981af19527beee1c10a2bef67a228c48c upstream. Function r8712_sitesurvey_cmd calls memcpy without checking the length. A user could control that length and trigger a buffer overflow. Fix by checking the length is within the maximum allowed

[PATCH 5.4 118/168] USB: serial: cp210x: add some more GE USB IDs

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Sebastian Reichel commit 42213a0190b535093a604945db05a4225bf43885 upstream. GE CS1000 has some more custom USB IDs for CP2102N; add them to the driver to have working auto-probing. Signed-off-by: Sebastian Reichel Cc: sta...@vger.kernel.org Signed-off-by:

[PATCH 5.10 120/290] net: dsa: tag_edsa: let DSA core deal with TX reallocation

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Vladimir Oltean [ Upstream commit c6c4e1237dfe731644e79fa06d073625f28cd945 ] Now that we have a central TX reallocation procedure that accounts for the tagger's needed headroom in a generic way, we can remove the skb_cow_head call. Note that the VLAN code path

[PATCH 5.11 129/306] udf: fix silent AED tagLocation corruption

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Steven J. Magnani [ Upstream commit 63c9e47a1642fc817654a1bc18a6ec4bbcc0f056 ] When extending a file, udf_do_extend_file() may enter following empty indirect extent. At the end of udf_do_extend_file() we revert prev_epos to point to the last written extent.

[PATCH 5.4 112/168] xhci: Improve detection of device initiated wake signal.

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Mathias Nyman commit 253f588c70f66184b1f3a9bbb428b49bbda73e80 upstream. A xHC USB 3 port might miss the first wake signal from a USB 3 device if the port LFPS reveiver isn't enabled fast enough after xHC resume. xHC host will anyway be resumed by a PME# signal,

[PATCH 5.11 131/306] mmc: mxs-mmc: Fix a resource leak in an error handling path in mxs_mmc_probe()

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Christophe JAILLET [ Upstream commit 0bb7e560f821c7770973a94e346654c4bdccd42c ] If 'mmc_of_parse()' fails, we must undo the previous 'dma_request_chan()' call. Signed-off-by: Christophe JAILLET Link:

[PATCH 5.4 117/168] USB: serial: cp210x: add ID for Acuity Brands nLight Air Adapter

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Karan Singhal commit ca667a33207daeaf9c62b106815728718def60ec upstream. IDs of nLight Air Adapter, Acuity Brands, Inc.: vid: 10c4 pid: 88d8 Signed-off-by: Karan Singhal Cc: sta...@vger.kernel.org Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman

[PATCH 5.4 114/168] xhci: Fix repeated xhci wake after suspend due to uncleared internal wake state

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Mathias Nyman commit d26c00e7276fc92b18c253d69e872f6b03832bad upstream. If port terminations are detected in suspend, but link never reaches U0 then xHCI may have an internal uncleared wake state that will cause an immediate wake after suspend. This wake state

[PATCH 5.10 118/290] net: dsa: tag_mtk: let DSA core deal with TX reallocation

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Vladimir Oltean [ Upstream commit 941f66beb7bb4e0e4726aa31336d9ccc1c3a3dc2 ] Now that we have a central TX reallocation procedure that accounts for the tagger's needed headroom in a generic way, we can remove the skb_cow_head call. Cc: DENG Qingfang Cc: Sean

[PATCH 4.14 65/95] staging: rtl8192u: fix ->ssid overflow in r8192_wx_set_scan()

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Dan Carpenter commit 87107518d7a93fec6cdb2559588862afeee800fb upstream. We need to cap len at IW_ESSID_MAX_SIZE (32) to avoid memory corruption. This can be controlled by the user via the ioctl. Fixes: 5f53d8ca3d5d ("Staging: add rtl8192SU wireless usb driver")

[PATCH 5.4 116/168] USB: serial: ch341: add new Product ID

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Niv Sardi commit 5563b3b6420362c8a1f468ca04afe6d5f0a8d0a3 upstream. Add PID for CH340 that's found on cheap programmers. The driver works flawlessly as soon as the new PID (0x9986) is added to it. These look like ANU232MI but ship with a ch341 inside. They have

[PATCH 4.19 075/120] USB: usblp: fix a hang in poll() if disconnected

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Pete Zaitcev commit 9de2c43acf37a17dc4c69ff78bb099b80fb74325 upstream. Apparently an application that opens a device and calls select() on it, will hang if the decice is disconnected. It's a little surprising that we had this bug for 15 years, but apparently

[PATCH 5.10 119/290] net: dsa: tag_lan9303: let DSA core deal with TX reallocation

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Vladimir Oltean [ Upstream commit 6ed94135f58372cdec34cafb60f7596893b0b371 ] Now that we have a central TX reallocation procedure that accounts for the tagger's needed headroom in a generic way, we can remove the skb_cow_head call. Signed-off-by: Vladimir

[PATCH 4.19 073/120] usb: gadget: f_uac1: stop playback on function disable

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Ruslan Bilovol commit cc2ac63d4cf72104e0e7f58bb846121f0f51bb19 upstream. There is missing playback stop/cleanup in case of gadget's ->disable callback that happens on events like USB host resetting or gadget disconnection Fixes: 0591bc236015 ("usb: gadget: add

[PATCH 4.19 074/120] usb: dwc3: qcom: Honor wakeup enabled/disabled state

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Matthias Kaehlcke commit 2664deb0930643149d61cddbb66ada527ae180bd upstream. The dwc3-qcom currently enables wakeup interrupts unconditionally when suspending, however this should not be done when wakeup is disabled (e.g. through the sysfs attribute

[PATCH 4.14 67/95] staging: rtl8712: unterminated string leads to read overflow

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Dan Carpenter commit d660f4f42ccea50262c6ee90c8e7ad19a69fb225 upstream. The memdup_user() function does not necessarily return a NUL terminated string so this can lead to a read overflow. Switch from memdup_user() to strndup_user() to fix this bug. Fixes:

[PATCH 5.11 128/306] scsi: ufs: Protect some contexts from unexpected clock scaling

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Can Guo [ Upstream commit 0e9d4ca43ba8112821397f56a26d20682001c011 ] In contexts like suspend, shutdown, and error handling we need to suspend devfreq to make sure these contexts won't be disturbed by clock scaling. However, suspending devfreq is not enough

[PATCH 5.11 130/306] iommu/vt-d: Clear PRQ overflow only when PRQ is empty

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Lu Baolu [ Upstream commit 28a77185f1cd0650b664f546141433a7a615 ] It is incorrect to always clear PRO when it's set w/o first checking whether the overflow condition has been cleared. Current code assumes that if an overflow condition occurs it must have

[PATCH 4.14 68/95] staging: rtl8188eu: fix potential memory corruption in rtw_check_beacon_data()

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Dan Carpenter commit d4ac640322b06095128a5c45ba4a1e80929fe7f3 upstream. The "ie_len" is a value in the 1-255 range that comes from the user. We have to cap it to ensure that it's not too large or it could lead to memory corruption. Fixes: 9a7fe54ddc3a

[PATCH 4.19 064/120] ALSA: usb-audio: Apply the control quirk to Plantronics headsets

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Takashi Iwai commit 06abcb18b3a021ba1a3f2020cbefb3ed04e59e72 upstream. Other Plantronics headset models seem requiring the same workaround as C320-M to add the 20ms delay for the control messages, too. Apply the workaround generically for devices with the

[PATCH 4.19 072/120] usb: gadget: f_uac2: always increase endpoint max_packet_size by one audio slot

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Ruslan Bilovol commit 789ea77310f0200c84002884ffd628e2baf3ad8a upstream. As per UAC2 Audio Data Formats spec (2.3.1.1 USB Packets), if the sampling rate is a constant, the allowable variation of number of audio slots per virtual frame is +/- 1 audio slot. It

[PATCH 5.4 115/168] USB: serial: io_edgeport: fix memory leak in edge_startup

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Pavel Skripkin commit cfdc67acc785e01a8719eeb7012709d245564701 upstream. sysbot found memory leak in edge_startup(). The problem was that when an error was received from the usb_submit_urb(), nothing was cleaned up. Reported-by:

[PATCH 5.11 122/306] mptcp: always graft subflow socket to parent

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Paolo Abeni [ Upstream commit 866f26f2a9c33bc70eb0f07ffc37fd9424ffe501 ] Currently, incoming subflows link to the parent socket, while outgoing ones link to a per subflow socket. The latter is not really needed, except at the initial connect() time and for the

[PATCH 5.10 117/290] net: dsa: tag_ocelot: let DSA core deal with TX reallocation

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Vladimir Oltean [ Upstream commit 9c5c3bd00557e57c1049f7861f11e5e39f0fb42d ] Now that we have a central TX reallocation procedure that accounts for the tagger's needed headroom in a generic way, we can remove the skb_cow_head call. Signed-off-by: Vladimir

[PATCH 4.14 64/95] usbip: fix vhci_hcd attach_store() races leading to gpf

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Shuah Khan commit 718ad9693e3656120064b715fe931f43a6201e67 upstream. attach_store() is invoked when user requests import (attach) a device from usbip host. Attach and detach are governed by local state and shared state - Shared state (usbip device status) -

[PATCH 4.19 069/120] mmc: cqhci: Fix random crash when remove mmc module/card

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Frank Li commit f06391c45e83f9a731045deb23df7cc3814fd795 upstream. [ 6684.493350] Unable to handle kernel paging request at virtual address 800011c5b0f0 [ 6684.498531] mmc0: card 0001 removed [ 6684.501556] Mem abort info: [ 6684.509681] ESR = 0x9647

[PATCH 5.10 116/290] net: dsa: tag_qca: let DSA core deal with TX reallocation

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Vladimir Oltean [ Upstream commit 9bbda29ae1044bc4c1c01a5b7c44688c4765785f ] Now that we have a central TX reallocation procedure that accounts for the tagger's needed headroom in a generic way, we can remove the skb_cow_head call. Cc: John Crispin Cc:

[PATCH 5.10 111/290] s390/qeth: improve completion of pending TX buffers

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Julian Wiedmann [ Upstream commit c20383ad1656b0f6354dd50e4acd894f9d94090d ] The current design attaches a pending TX buffer to a custom single-linked list, which is anchored at the buffer's slot on the TX ring. The buffer is then checked for final completion

[PATCH 4.19 070/120] Goodix Fingerprint device is not a modem

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Yorick de Wid commit 4d8654e81db7346f915eca9f1aff18f385cab621 upstream. The CDC ACM driver is false matching the Goodix Fingerprint device against the USB_CDC_ACM_PROTO_AT_V25TER. The Goodix Fingerprint device is a biometrics sensor that should be handled in

[PATCH 4.19 068/120] mmc: core: Fix partition switch time for eMMC

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Adrian Hunter commit 66fbacccbab91e6e55d9c8f1fc0910a8eb6c81f7 upstream. Avoid the following warning by always defining partition switch time: [3.209874] mmc1: unspecified timeout for CMD6 - use generic [3.222780] [ cut here ]

[PATCH 5.11 125/306] i2c: rcar: optimize cacheline to minimize HW race condition

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Wolfram Sang [ Upstream commit 25c2e0fb5fefb8d7847214cf114d94c7aad8e9ce ] 'flags' and 'io' are needed first, so they should be at the beginning of the private struct. Signed-off-by: Wolfram Sang Reviewed-by: Niklas Söderlund Signed-off-by: Wolfram Sang

[PATCH 4.14 62/95] usbip: fix vudc to check for stream socket

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Shuah Khan commit 6801854be94fe8819b3894979875ea31482f5658 upstream. Fix usbip_sockfd_store() to validate the passed in file descriptor is a stream socket. If the file descriptor passed was a SOCK_DGRAM socket, sock_recvmsg() can't detect end of stream. Cc:

[PATCH 4.19 067/120] s390/dasd: fix hanging IO request during DASD driver unbind

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Stefan Haberland commit 66f669a272898feb1c69b770e1504aa2ec7723d1 upstream. Prevent that an IO request is build during device shutdown initiated by a driver unbind. This request will never be able to be processed or canceled and will hang forever. This will lead

[PATCH 5.4 109/168] USB: usblp: fix a hang in poll() if disconnected

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Pete Zaitcev commit 9de2c43acf37a17dc4c69ff78bb099b80fb74325 upstream. Apparently an application that opens a device and calls select() on it, will hang if the decice is disconnected. It's a little surprising that we had this bug for 15 years, but apparently

[PATCH 5.4 105/168] usb: gadget: f_uac2: always increase endpoint max_packet_size by one audio slot

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Ruslan Bilovol commit 789ea77310f0200c84002884ffd628e2baf3ad8a upstream. As per UAC2 Audio Data Formats spec (2.3.1.1 USB Packets), if the sampling rate is a constant, the allowable variation of number of audio slots per virtual frame is +/- 1 audio slot. It

[PATCH 4.14 57/95] USB: serial: ch341: add new Product ID

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Niv Sardi commit 5563b3b6420362c8a1f468ca04afe6d5f0a8d0a3 upstream. Add PID for CH340 that's found on cheap programmers. The driver works flawlessly as soon as the new PID (0x9986) is added to it. These look like ANU232MI but ship with a ch341 inside. They have

[PATCH 5.4 104/168] USB: gadget: u_ether: Fix a configfs return code

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Dan Carpenter commit 650bf52208d804ad5ee449c58102f8dc43175573 upstream. If the string is invalid, this should return -EINVAL instead of 0. Fixes: 73517cf49bd4 ("usb: gadget: add RNDIS configfs options for class/subclass/protocol") Cc: stable Acked-by: Lorenzo

[PATCH 5.4 084/168] sysctl.c: fix underflow value setting risk in vm_table

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Lin Feng [ Upstream commit 3b3376f222e3ab58367d9dd405cafd09d5e37b7c ] Apart from subsystem specific .proc_handler handler, all ctl_tables with extra1 and extra2 members set should use proc_dointvec_minmax instead of proc_dointvec, or the limit set in extra*

[PATCH 4.19 044/120] mmc: mxs-mmc: Fix a resource leak in an error handling path in mxs_mmc_probe()

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Christophe JAILLET [ Upstream commit 0bb7e560f821c7770973a94e346654c4bdccd42c ] If 'mmc_of_parse()' fails, we must undo the previous 'dma_request_chan()' call. Signed-off-by: Christophe JAILLET Link:

[PATCH 4.14 36/95] powerpc/perf: Record counter overflow always if SAMPLE_IP is unset

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Athira Rajeev [ Upstream commit d137845c973147a22622cc76c7b0bc16f6206323 ] While sampling for marked events, currently we record the sample only if the SIAR valid bit of Sampled Instruction Event Register (SIER) is set. SIAR_VALID bit is used for fetching the

[PATCH 5.4 102/168] mmc: cqhci: Fix random crash when remove mmc module/card

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Frank Li commit f06391c45e83f9a731045deb23df7cc3814fd795 upstream. [ 6684.493350] Unable to handle kernel paging request at virtual address 800011c5b0f0 [ 6684.498531] mmc0: card 0001 removed [ 6684.501556] Mem abort info: [ 6684.509681] ESR = 0x9647

[PATCH 4.14 35/95] powerpc: improve handling of unrecoverable system reset

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Nicholas Piggin [ Upstream commit 11cb0a25f71818ca7ab4856548ecfd83c169aa4d ] If an unrecoverable system reset hits in process context, the system does not have to panic. Similar to machine check, call nmi_exit() before die(). Signed-off-by: Nicholas Piggin

[PATCH 5.10 098/290] s390/cio: return -EFAULT if copy_to_user() fails

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Eric Farman commit d9c48a948d29bcb22f4fe61a81b718ef6de561a0 upstream. Fixes: 120e214e504f ("vfio: ccw: realize VFIO_DEVICE_G(S)ET_IRQ_INFO ioctls") Signed-off-by: Eric Farman Signed-off-by: Heiko Carstens Signed-off-by: Greg Kroah-Hartman ---

[PATCH 5.11 108/306] drm/amdgpu: fix S0ix handling when the CONFIG_AMD_PMC=m

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Alex Deucher commit a5cb3c1a36376c25cd25fd3e99918dc48ac420bb upstream. Need to check the module variant as well. Acked-by: Prike Liang Signed-off-by: Alex Deucher Cc: sta...@vger.kernel.org Signed-off-by: Greg Kroah-Hartman ---

[PATCH 5.4 088/168] ALSA: usb: Add Plantronics C320-M USB ctrl msg delay quirk

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: John Ernberg commit fc7c5c208eb7bc2df3a9f4234f14eca250001cb6 upstream. The microphone in the Plantronics C320-M headset will randomly fail to initialize properly, at least when using Microsoft Teams. Introducing a 20ms delay on the control messages appears to

[PATCH 5.10 093/290] drm/shmem-helper: Dont remove the offset in vm_area_struct pgoff

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Neil Roberts commit 11d5a4745e00e73745774671dbf2fb07bd6e2363 upstream. When mmapping the shmem, it would previously adjust the pgoff in the vm_area_struct to remove the fake offset that is added to be able to identify the buffer. This patch removes the

[PATCH 4.19 034/120] drm/compat: Clear bounce structures

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Daniel Vetter commit de066e116306baf3a6a62691ac63cfc0b1dabddb upstream. Some of them have gaps, or fields we don't clear. Native ioctl code does full copies plus zero-extends on size mismatch, so nothing can leak. But compat is more hand-rolled so need to be

[PATCH 4.14 25/95] perf traceevent: Ensure read cmdlines are null terminated.

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Ian Rogers commit 137a5258939aca56558f3a23eb229b9c4b293917 upstream. Issue detected by address sanitizer. Fixes: cd4ceb63438e9e28 ("perf util: Save pid-cmdline mapping into tracing header") Signed-off-by: Ian Rogers Acked-by: Namhyung Kim Cc: Alexander

[PATCH 5.10 066/290] net: stmmac: stop each tx channel independently

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Joakim Zhang commit a3e860a83397bf761ec1128a3f0ba186445992c6 upstream. If clear GMAC_CONFIG_TE bit, it would stop all tx channels, but users may only want to stop specific tx channel. Fixes: 48863ce5940f ("stmmac: add DMA support for GMAC 4.xx") Signed-off-by:

[PATCH 5.11 120/306] media: rc: compile rc-cec.c into rc-core

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Hans Verkuil commit f09f9f93afad770a04b35235a0aa465fcc8d6e3d upstream. The rc-cec keymap is unusual in that it can't be built as a module, instead it is registered directly in rc-main.c if CONFIG_MEDIA_CEC_RC is set. This is because it can be called from

[PATCH 4.19 061/120] ALSA: hda: Drop the BATCH workaround for AMD controllers

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Takashi Iwai commit 28e96c1693ec1cdc963807611f8b5ad400431e82 upstream. The commit c02f77d32d2c ("ALSA: hda - Workaround for crackled sound on AMD controller (1022:1457)") introduced a few workarounds for the recent AMD HD-audio controller, and one of them is the

[PATCH 5.10 110/290] s390/qeth: remove QETH_QDIO_BUF_HANDLED_DELAYED state

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Julian Wiedmann [ Upstream commit 75cf3854dcdf7b5c583538cae12ffa054d237d93 ] Reuse the QETH_QDIO_BUF_EMPTY state to indicate that a TX buffer has been completed with a QAOB notification, and may be cleaned up by qeth_cleanup_handled_pending(). Signed-off-by:

[PATCH 5.4 100/168] software node: Fix node registration

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Heikki Krogerus commit 8891123f9cbb9c1ee531e5a87fa116f0af685c48 upstream. Software node can not be registered before its parent. Fixes: 80488a6b1d3c ("software node: Add support for static node descriptors") Cc: 5.10+ # 5.10+ Signed-off-by: Heikki Krogerus

[PATCH 4.19 062/120] ALSA: hda: Avoid spurious unsol event handling during S3/S4

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Takashi Iwai commit 5ff9dde42e8c72ed8102eb8cb62e03f9dc2103ab upstream. When HD-audio bus receives unsolicited events during its system suspend/resume (S3 and S4) phase, the controller driver may still try to process events although the codec chips are already

[PATCH 5.4 096/168] Revert 95ebabde382c ("capabilities: Dont allow writing ambiguous v3 file capabilities")

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Eric W. Biederman commit 3b0c2d3eaa83da259d7726192cf55a137769012f upstream. It turns out that there are in fact userspace implementations that care and this recent change caused a regression. https://github.com/containers/buildah/issues/3071 As the motivation

[PATCH 5.10 105/290] media: v4l: vsp1: Fix bru null pointer access

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Biju Das commit ac8d82f586c8692b501cb974604a71ef0e22a04c upstream. RZ/G2L SoC has only BRS. This patch fixes null pointer access,when only BRS is enabled. Fixes: cbb7fa49c7466("media: v4l: vsp1: Rename BRU to BRx") Signed-off-by: Biju Das Signed-off-by: Hans

[PATCH 4.14 55/95] usb: xhci: Fix ASMedia ASM1042A and ASM3242 DMA addressing

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Forest Crossman commit b71c669ad8390dd1c866298319ff89fe68b45653 upstream. I've confirmed that both the ASMedia ASM1042A and ASM3242 have the same problem as the ASM1142 and ASM2142/ASM3142, where they lose some of the upper bits of 64-bit DMA addresses. As with

[PATCH 4.19 059/120] ALSA: usb: Add Plantronics C320-M USB ctrl msg delay quirk

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: John Ernberg commit fc7c5c208eb7bc2df3a9f4234f14eca250001cb6 upstream. The microphone in the Plantronics C320-M headset will randomly fail to initialize properly, at least when using Microsoft Teams. Introducing a 20ms delay on the control messages appears to

[PATCH 4.14 54/95] xhci: Improve detection of device initiated wake signal.

2021-03-15 Thread gregkh
From: Greg Kroah-Hartman From: Mathias Nyman commit 253f588c70f66184b1f3a9bbb428b49bbda73e80 upstream. A xHC USB 3 port might miss the first wake signal from a USB 3 device if the port LFPS reveiver isn't enabled fast enough after xHC resume. xHC host will anyway be resumed by a PME# signal,

<    1   2   3   4   5   6   7   8   9   10   >