Add hsi2c_7 for gs101
Add hsi2c_8 for gs201
Request is from NFC

Bug: 360739836
Test: build pass

Change-Id: I8068ca5a2fe00cf93347080df14c0a66a37399a9
Signed-off-by: Zheng Pan <zhengpan@google.com>

Merge android13-5.10-2024-07 ab/12225542 into android13-gs-pixel-5.10-24Q4 [ DO NOT MERGE ANYWHERE ]

Merge SHA:
eda2373a UPSTREAM: eeprom: at24: fix memory corruption race condition

Bug: 355176020
Bug: 357011632 (ACK)
Bug: 358529695 (ACK)
Bug: 359558663 (ACK)
Change-Id: I6a57db114cf0444702bb404e2aac1d8f8da31659
Signed-off-by: Pindar Yang <pindaryang@google.com>

When the value of first_usage_date is 0, framework will treats
this feature as unsupported.

Bug: 354342303
Test: build
Change-Id: I62c4d23709874175c4d557af27da28cd253837f7
Signed-off-by: Jack Wu <wjack@google.com>

[ Upstream commit f42c9702 ]

If the eeprom is not accessible, an nvmem device will be registered, the
read will fail, and the device will be torn down. If another driver
accesses the nvmem device after the teardown, it will reference
invalid memory.

Move the failure point before registering the nvmem device.

Bug: 359558663

Change-Id: If6368cf79172ca2d3e953e63e68ee4e7b3830512
Signed-off-by: Daniel Okazaki <dtokazaki@google.com>
Fixes: b20eb4c1 ("eeprom: at24: drop unnecessary label")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20240422174337.2487142-1-dtokazaki@google.com


Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit c850f71fca09ea41800ed55905980063d17e01da)

[ Upstream commit caba40ec ]

The DDR3 SPD data structure advertises the presence of a thermal
sensor on a DDR3 module in byte 32, bit 7. Let's use this information
to explicitly instantiate the thermal sensor I2C client instead of
having to rely on class-based I2C probing.

The temp sensor i2c address can be derived from the SPD i2c address,
so we can directly instantiate the device and don't have to probe
for it. If the temp sensor has been instantiated already by other
means (e.g. class-based auto-detection), then the busy-check in
i2c_new_client_device will detect this.

Note: Thermal sensors on DDR4 DIMM's are instantiated from the
      ee1004 driver.

Bug: 359558663

Change-Id: I4dfb4969f7a5ae6c31bd96436c2773d16c9dcf81
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Link: https://lore.kernel.org/r/68113672-3724-44d5-9ff8-313dd6628f8c@gmail.com


Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: f42c9702 ("eeprom: at24: fix memory corruption race condition")
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit ec9dbddea26b38bd6b2827ddb763831564282295)

[ Upstream commit a3c10035 ]

When using nvmem layouts it is possible devm_nvmem_register returns
-EPROBE_DEFER, resulting in an 'empty' in
/sys/kernel/debug/devices_deferred. Use dev_err_probe for providing
additional information.

Bug: 359558663

Change-Id: I75c5d2437dbe4ee1dfe4f5eb88c8f892cb49ab4f
Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Stable-dep-of: f42c9702 ("eeprom: at24: fix memory corruption race condition")
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit b2643d2532eee507d83e0a0055da8aac1bd1660a)

The "scmi_info->irq" get -22 (-EINVAL) when no "a2p" interrupt, keep to
use (scmi_info->irq > 0) as if condition to avoid BUG happen like this:

For cherry picked patch 18126b26 (UPSTREAM: firmware: arm_scmi: Fix chan_free cleanup on SMC),
it depends on below two patches from mainline to avoid the BUG we met.
f716cbd3 firmware: arm_scmi: Make smc transport use common completions
a690b7e6 firmware: arm_scmi: Add configurable polling mode for transports

These two patch can't apply directly now, quiet a lot of changes need to merge,
which is much higher risk than just apply this simple fix.

[ 0.199652][ T1] arm-scmi firmware:scmi: SCMI Notifications - Core Enabled.
[ 0.200296][ T1] list_add corruption. prev is NULL.
[ 0.200773][ T1] ------------[ cut here ]------------
[ 0.201242][ T1] kernel BUG at lib/list_debug.c:24!
[ 0.201696][ T1] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
[ 0.202246][ T1] Modules linked in:
[ 0.202581][ T1] CPU: 4 PID: 1 Comm: swapper/0 Not tainted 5.10.214-android13-4-00002-g4c868a6e89f5-ab12097184 #1
[ 0.203511][ T1] Hardware name: Rockchip RK3588S EVB8 LP4X V10 Board (DT)
[ 0.204137][ T1] pstate: 60800085 (nZCv daIf -PAN +UAO -TCO BTYPE=--)
[ 0.204735][ T1] pc : list_add_valid+0x80/0xc0
[ 0.205168][ T1] lr : __list_add_valid+0x80/0xc0
[ 0.205599][ T1] sp : ffffffc00b24b700
[ 0.205958][ T1] x29: ffffffc00b24b700 x28: 0000000000000002
[ 0.206494][ T1] x27: 00000000000000e0 x26: ffffff810019ca00
[ 0.207027][ T1] x25: 0000000000000000 x24: ffffff810122c1e0
[ 0.207560][ T1] x23: ffffff810122c1d8 x22: ffffffc00b24b728
[ 0.208097][ T1] x21: ffffff810122c1d0 x20: 0000000000000000
[ 0.208631][ T1] x19: 7fffffffffffffff x18: ffffffc00b2350b8
[ 0.209165][ T1] x17: ffffffffffffffff x16: 0000000000000000
[ 0.209697][ T1] x15: 0000000000000004 x14: ffffffc00af6d130
[ 0.210231][ T1] x13: 0000000000000fff x12: 0000000000000003
[ 0.210769][ T1] x11: 00000000ffffffff x10: c0000000ffffefff
[ 0.211300][ T1] x9 : 91b264ed20239600 x8 : 91b264ed20239600
[ 0.211834][ T1] x7 : 322e30202020205b x6 : ffffffc00b1873d8
[ 0.212365][ T1] x5 : ffffffc00b184fee x4 : 0000000000000000
[ 0.212896][ T1] x3 : 0000000000000000 x2 : 0000000000000000
[ 0.213426][ T1] x1 : ffffffc00b24b4d0 x0 : 0000000000000022
[ 0.213959][ T1] Call trace:
[ 0.214239][ T1] __list_add_valid+0x80/0xc0
[ 0.214645][ T1] wait_for_common+0x104/0x308
[ 0.215059][ T1] smc_send_message+0x100/0x2a8
[ 0.215477][ T1] do_xfer+0x128/0x858
[ 0.215826][ T1] version_get+0x88/0x20c
[ 0.216198][ T1] scmi_base_protocol_init+0x6c/0x720
[ 0.216663][ T1] scmi_get_protocol_instance+0x1f4/0x49c
[ 0.217156][ T1] scmi_probe+0x244/0x724
[ 0.217531][ T1] platform_drv_probe+0x60/0x17c
[ 0.217956][ T1] really_probe+0x310/0x974
[ 0.218342][ T1] driver_probe_device+0x74/0x298
[ 0.218776][ T1] device_driver_attach+0x158/0x208
[ 0.219224][ T1] __driver_attach+0x248/0x420
[ 0.219634][ T1] bus_add_driver+0x1d4/0x498
[ 0.220036][ T1] driver_register+0x84/0x17c
[ 0.220442][ T1] scmi_driver_init+0xb0/0xc0
[ 0.220846][ T1] __initstubkmod_scmi_module__425_1626_scmi_driver_init4.cfi+0x14/0x24
[ 0.221589][ T1] do_one_initcall+0x114/0x3b0
[ 0.221998][ T1] do_initcall_level+0xdc/0x1bc
[ 0.222415][ T1] do_initcalls+0x58/0x9c
[ 0.222785][ T1] do_basic_setup+0x28/0x38
[ 0.223172][ T1] kernel_init_freeable+0xfc/0x1bc
[ 0.223616][ T1] kernel_init+0x2c/0x304
[ 0.223988][ T1] ret_from_fork+0x10/0x30
[ 0.224369][ T1] Code: d4210000 d000c600 9118a800 97e0729d (d4210000)
[ 0.224974][ T1] ---[ end trace 6c77dafcd8f3982d ]---
[ 0.225881][ T1] Kernel panic - not syncing: Oops - BUG: Fatal exception

Bug: 357011632
Bug: 358529695
Fixes: 18126b26 ("UPSTREAM: firmware: arm_scmi: Fix chan_free cleanup on SMC")
Signed-off-by: Kever Yang <kever.yang@rock-chips.com>
Change-Id: I9d9edb48a313b1e4277749082e41ea02ca5ec2a5
(cherry picked from commit fcc95b0adc7f1387fc638592ab284d69d96ef91b)

Merge android13-5.10-2024-07 ab/12097184 into android13-gs-pixel-5.10-24Q4 [ DO NOT MERGE ANYWHERE ]

Merge SHA:
4c868a6e ANDROID: Initialize android13-5.10-2024-07

Bug: 300854197
Bug: 161946584 (ACK)
Bug: 336226035 (ACK)
Bug: 347878754 (ACK)
Change-Id: I6ed460870653ea5f86b52e1dfb926b3e0db85e46
Signed-off-by: Pindar Yang <pindaryang@google.com>

suspending flag for ourport is introduced,
to prevent rts toggling due to sicd power mode during suspend.

suspending flag is set to 1 at the start of suspend sequence
and set to 0 at the end of suspend sequence.

BUG: 322129034
Test: build test build and run BCST
Change-Id: I15940a5dc64735c8e56471eff9d5cdb14a6575b3
Signed-off-by: Sophie Hu <sophiehu@google.com>

Original change: https://partner-android-review.googlesource.com/c/kernel/private/gs-google/+/2885705



Change-Id: I239599f1bbea350bae275656bd92b7ccb74f06a6
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

Original change: https://partner-android-review.googlesource.com/c/kernel/private/gs-google/+/2884544



Change-Id: I2adc5cac20cdf9038ccbf4ac60e08799ca6b346b
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

Original change: https://partner-android-review.googlesource.com/c/kernel/private/gs-google/+/2884543



Change-Id: I25753a31c4f991832e2379e713ab43b4d299c420
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

Original change: https://partner-android-review.googlesource.com/c/kernel/private/gs-google/+/2884542



Change-Id: I9689c80ddcad3540c4ef441b3676822de4bbbebe
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

Original change: https://partner-android-review.googlesource.com/c/kernel/private/gs-google/+/2873197



Change-Id: Idde345a590821155ecadf609d0ac616f0f49830e
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

[automerger skipped] arm64/dts: gs201: Add Alive S2MPU am: b4d74ef4 -s ours am: 3e07d89c -s ours

am skip reason: Merged-In I844cdd4e2485fbae416c618b0b8a83e30b847065 with SHA-1 7b40bac4 is already in history

Original change: https://partner-android-review.googlesource.com/c/kernel/private/gs-google/+/2877409



Change-Id: I6854543c88e55dfbad722b2064d168d2fb25bab4
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

am skip reason: Merged-In I38a1a2af556eaca83be3bd93db1b5dd400034255 with SHA-1 d913e04f is already in history

Original change: https://partner-android-review.googlesource.com/c/kernel/private/gs-google/+/2877864



Change-Id: Ic253cae204672d26767dedf70031cff4483eb27e
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

[automerger skipped] arm64/s2mpu: Add deny-all support am: 3a4aa019 -s ours am: 2ab6052c -s ours

am skip reason: Merged-In Id8a38b38310ec950841074b288797041355a3ec7 with SHA-1 0f1c59c0 is already in history

Original change: https://partner-android-review.googlesource.com/c/kernel/private/gs-google/+/2877863



Change-Id: I907d4232884506201eebc62275c018c642d596da
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

Original change: https://partner-android-review.googlesource.com/c/kernel/private/gs-google/+/2870608



Change-Id: I1b97d1973702faf287747a8263e87e6689e0b220
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

Original change: https://partner-android-review.googlesource.com/c/kernel/private/gs-google/+/2870607



Change-Id: I401d792dd1076dc578f869a1ddef3e02dda3053d
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

Original change: https://partner-android-review.googlesource.com/c/kernel/private/gs-google/+/2870606



Change-Id: I149556c8754655fa7cc8dd6af7f74ad9b6935599
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

In order to print less log to make room for other logs.
Skip print if the data not filled.

Bug: 332426051
Test: echo c > /proc/sysrq-trigger and check irq info

Change-Id: I6519455c02ff6905f33464bd8f220c194e152a65
Signed-off-by: Eric Lai <ericllai@google.com>

Remove dpm override, let the driver direct control the
support method without dpm change.

In order to print less log to make room for other logs.
Disable last info which is unsupported.

Bug: 332426051
Test: echo c > /proc/sysrq-trigger and check irq info

Change-Id: I9789da3b8c96ae7c0023a80560a86f5f912d0a89
Signed-off-by: Eric Lai <ericllai@google.com>

In order to print less log to make room for other logs.
Uses IRQ_THRESHOLD * boot time to filter normal IRQ. Since no IRQ
should reach 50 times per second beside system IRQ. Set IRQ_THRESHOLD
to 50.

Bug: 332426051
Test: echo c > /proc/sysrq-trigger and check irq info
Change-Id: I838aa119ae214f533c83ee64fffd1642bf6b64ce
Signed-off-by: Eric Lai <ericllai@google.com>

Reduce the amount of data being dumped into logs via the panic notifier if the Trusty kernel has not itself panicked.

Bug: 332426051
Test: sys-rq crash with force option
Test: sys-rq crash without force option
Test: Trusty panic without force option
Change-Id: I0d2622b905236f50388c2f5b00c17cbdbd0c2edb
Signed-off-by: Michael McTernan <mikemcternan@google.com>

Bug: 347878754
Signed-off-by: Todd Kjos <tkjos@google.com>
Change-Id: I655772a76591a402c934bb1d8189ee0d4dda3067

misfit_task_load will be set as 0 when task util is 1024

Bug: 346060683
Change-Id: Ib59d76264b9beba9471c6f301b3b2db7867945aa
Signed-off-by: Chungkai Mei <chungkai@google.com>

am skip reason: Merged-In I844cdd4e2485fbae416c618b0b8a83e30b847065 with SHA-1 7b40bac4 is already in history

Original change: https://partner-android-review.googlesource.com/c/kernel/private/gs-google/+/2877409



Change-Id: I7965f476dd52444d1ccd7a1e9965039723a03130
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

am skip reason: Merged-In I38a1a2af556eaca83be3bd93db1b5dd400034255 with SHA-1 d913e04f is already in history

Original change: https://partner-android-review.googlesource.com/c/kernel/private/gs-google/+/2877864



Change-Id: I4a5955495de690eaa4e423cb47fe95c9aad05140
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

am skip reason: Merged-In Id8a38b38310ec950841074b288797041355a3ec7 with SHA-1 0f1c59c0 is already in history

Original change: https://partner-android-review.googlesource.com/c/kernel/private/gs-google/+/2877863



Change-Id: I24f0e9ffce21318e06645aefbe7b5bf5cb4fae4d
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

Alive S2MPU is fully trusted and is not managed by the kernel.
However, we need to make sure the kernel can’t map it to use
it in emulation mode of the S2MPU.

So we define it as:
- “deny-all”: So it never gets power managed or updated
- “off-at-boot”: Never configured at boot.

Which mainly means it remains unconfigured but it's MMIO is not
accessible to the kernel.

Bug: 342511931
Signed-off-by: Mostafa Saleh <smostafa@google.com>
(cherry picked from https://partner-android-review.googlesource.com/q/commit:7b40bac463a2ce4ea983b0c5963a8f65532f37fb)
Merged-In: I844cdd4e2485fbae416c618b0b8a83e30b847065
Change-Id: I844cdd4e2485fbae416c618b0b8a83e30b847065

AoC is only controlled by TZ.

However, SysMMU has an emulation feature that can be misused to read
from arbitrary memory locations, and with SysMMU under the control of
the kernel, we need to configure S2MPU to block such potentially
malicious transactions.

Add the AoC S2MPU with the new flag “deny-all” which would mainly
unmap the S2MPU interface and configure it to deny all traffic.

Bug: 342511931
Signed-off-by: Mostafa Saleh <smostafa@google.com>
(cherry picked from https://partner-android-review.googlesource.com/q/commit:d913e04f18a500d4b46e4e928fd4e69106b28ebd)
Merged-In: I38a1a2af556eaca83be3bd93db1b5dd400034255
Change-Id: I38a1a2af556eaca83be3bd93db1b5dd400034255

Add "deny-all" propery for S2MPUs, this has the same purpose as other
branches but implemented in a slightly different way.

Mainly, we want to ensure that this device is not accessible from
host and in deny-all state, at probe the device is set to deny state
and then all PM calls are blocked so the hypervisor would never touch
any of its MMIO
But they are registered with the hypervisor so they are not accessible
from host.

Bug: 342511931
Signed-off-by: Mostafa Saleh <smostafa@google.com>
(cherry picked from https://partner-android-review.googlesource.com/q/commit:0f1c59c0ddc06986260f0e99d58d543ab43cf4de)
Merged-In: Id8a38b38310ec950841074b288797041355a3ec7
Change-Id: Id8a38b38310ec950841074b288797041355a3ec7

Alive S2MPU is fully trusted and is not managed by the kernel.
However, we need to make sure the kernel can’t map it to use
it in emulation mode of the S2MPU.

So we define it as:
- “deny-all”: So it never gets power managed or updated
- “off-at-boot”: Never configured at boot.

Which mainly means it remains unconfigured but it's MMIO is not
accessible to the kernel.

Bug: 342511931
Change-Id: I844cdd4e2485fbae416c618b0b8a83e30b847065
Signed-off-by: Mostafa Saleh <smostafa@google.com>

AoC is only controlled by TZ.

However, SysMMU has an emulation feature that can be misused to read
from arbitrary memory locations, and with SysMMU under the control of
the kernel, we need to configure S2MPU to block such potentially
malicious transactions.

Add the AoC S2MPU with the new flag “deny-all” which would mainly
unmap the S2MPU interface and configure it to deny all traffic.

Bug: 342511931
Change-Id: I38a1a2af556eaca83be3bd93db1b5dd400034255
Signed-off-by: Mostafa Saleh <smostafa@google.com>

Add "deny-all" propery for S2MPUs, this has the same purpose as other
branches but implemented in a slightly different way.

Mainly, we want to ensure that this device is not accessible from
host and in deny-all state, at probe the device is set to deny state
and then all PM calls are blocked so the hypervisor would never touch
any of its MMIO
But they are registered with the hypervisor so they are not accessible
from host.

Bug: 342511931
Change-Id: Id8a38b38310ec950841074b288797041355a3ec7
Signed-off-by: Mostafa Saleh <smostafa@google.com>

An android-only patch to work around frozen KMI for android14 kernels
allows a dependency between hid and uhid if both modules are enabled:

if (IS_ENABLED(CONFIG_UHID) && parser->device->ll_driver == &uhid_hid_driver)
    max_buffer_size = UHID_DATA_MAX;

For allmodconfig builds, both hid and uhid are modules so this creates
a cyclic dependancy and we see this error in kernelci tests:

    ERROR: Cycle detected: hid -> uhid -> hid

Fix by changeing to IS_BUILTIN() instead of IS_ENABLED() since Android
builds always build uhid into the core kernel.

Fixes: 7668cef28386 ("ANDROID: HID: Only utilise UHID provided exports if UHID is enabled")
Signed-off-by: Todd Kjos <tkjos@google.com>
Change-Id: I622466a42ad94e3606820cf506188bd679078cbf

This merges the 5.10.214 LTS kernel into the android13-5.10 branch.
Included in here are the following commits:

* a8e7f812 ANDROID: cpufreq: brcmstb-avs-cpufreq: fix build error
* 857c3acf Revert "remoteproc: Add new get_loaded_rsc_table() to rproc_ops"
* 03ec1765 Revert "remoteproc: stm32: Move resource table setup to rproc_ops"
* f12616df Revert "remoteproc: stm32: Fix incorrect type assignment returned by stm32_rproc_get_loaded_rsc_tablef"
* 2fa9d4f5 Revert "remoteproc: stm32: fix phys_addr_t format string"
* aa0f90d1 Revert "remoteproc: stm32: use correct format strings on 64-bit"
* 9739f8b1 Revert "remoteproc: stm32: Fix incorrect type in assignment for va"
* 9c618c05 Revert "block: add a new set_read_only method"
* 1ce9783e Revert "md: implement ->set_read_only to hook into BLKROSET processing"
* 36cc24f8 Revert "md: Don't clear MD_CLOSING when the raid is about to stop"
* d592f841 Revert "bpf: Defer the free of inner map when necessary"
* 85ee6cd9 Revert "net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()"
*   3f163fb7 Merge 5.10.214 into android13-5.10-lts
|\
| * dfa38259 Linux 5.10.214
| * 5148026b remoteproc: stm32: fix phys_addr_t format string
| * a943eb82 regmap: Add missing map->bus check
| * bcfcdf19 spi: spi-mt65xx: Fix NULL pointer access in interrupt handler
| * 6c46d680 bpf: report RCU QS in cpumap kthread
| * aad6bb26 rcu: add a helper to report consolidated flavor QS
| * fcf32a5b netfilter: nf_tables: do not compare internal table flags on updates
| * 096245bb ARM: dts: sun8i-h2-plus-bananapi-m2-zero: add regulator nodes vcc-dram and vcc1v2
| * f205ed8d scsi: fc: Update formal FPIN descriptor definitions
| * b36b8329 netfilter: nft_set_pipapo: release elements in clone only from destroy path
| * 766c2627 octeontx2-af: Use separate handlers for interrupts
| * 8eebff95 net/bnx2x: Prevent access to a freed page in page_pool
| * f6c6ca61 hsr: Handle failures in module init
| * 1e1e4316 rds: introduce acquire/release ordering in acquire/release_in_xmit()
| * f87884e0 wireguard: receive: annotate data-race around receiving_counter.counter
| * d0ab075e net: dsa: mt7530: prevent possible incorrect XTAL frequency selection
| * 68e84120 packet: annotate data-races around ignore_outgoing
| * 7fb2d4d6 hsr: Fix uninit-value access in hsr_get_node()
| * cdff6144 soc: fsl: dpio: fix kcalloc() argument order
| * 76d1394d s390/vtime: fix average steal time calculation
| * ce061bf4 octeontx2-af: Use matching wake_up API variant in CGX command interface
| * 2ddc931c io_uring: don't save/restore iowait state
| * ed71e736 usb: gadget: net2272: Use irqflags in the call to net2272_probe_fin
| * 745c2718 staging: greybus: fix get_channel_from_mode() failure path
| * a4d50385 serial: 8250_exar: Don't remove GPIO device on suspend
| * 864f17c1 rtc: mt6397: select IRQ_DOMAIN instead of depending on it
| * 87ddba29 kconfig: fix infinite loop when expanding a macro at the end of file
| * 1639e9c7 tty: serial: samsung: fix tx_empty() to return TIOCSER_TEMT
| * 1eb9ab1f serial: max310x: fix syntax error in IRQ error message
| * 6199e194 tty: vt: fix 20 vs 0x20 typo in EScsiignore
| * 40260d06 remoteproc: stm32: Fix incorrect type assignment returned by stm32_rproc_get_loaded_rsc_tablef
| * 0dd5b63a remoteproc: stm32: Fix incorrect type in assignment for va
| * f0b0a4de remoteproc: stm32: use correct format strings on 64-bit
| * 9d057eac remoteproc: stm32: Move resource table setup to rproc_ops
| * 7b954720 remoteproc: Add new get_loaded_rsc_table() to rproc_ops
| * 1d7e9bc4 remoteproc: stm32: Constify st_rproc_ops
| * b94f434f afs: Revert "afs: Hide silly-rename files from userspace"
| * b8c52f7d NFS: Fix an off by one in root_nfs_cat()
| * 32903ecf watchdog: stm32_iwdg: initialize default timeout
| * 916ee6de NFSv4.2: fix listxattr maximum XDR buffer size
| * 4403438e NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102
| * 84ec5c0a net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr()
| * a2b74f35 scsi: bfa: Fix function pointer type mismatch for hcb_qe->cbfn
| * 11adfabe RDMA/device: Fix a race between mad_client and cm_client init
| * 3ac85382 scsi: csiostor: Avoid function pointer casts
| * 6370d070 f2fs: compress: fix to check unreleased compressed cluster
| * bdd895e0 RDMA/srpt: Do not register event handler until srpt device is fully setup
| * 5cd46667 ALSA: usb-audio: Stop parsing channels bits when all channels are found.
| * 4266f6e7 ALSA: hda/realtek: fix ALC285 issues on HP Envy x360 laptops
| * 23917453 clk: Fix clk_core_get NULL dereference
| * e55a6014 sparc32: Fix section mismatch in leon_pci_grpci
| * 6ec49d07 backlight: lp8788: Fully initialize backlight_properties during probe
| * ad70a788 backlight: lm3639: Fully initialize backlight_properties during probe
| * f3bd1e36 backlight: da9052: Fully initialize backlight_properties during probe
| * f58ce2be backlight: lm3630a: Don't set bl->props.brightness in get_brightness
| * fc43d668 backlight: lm3630a: Initialize backlight_properties on init
| * 97b397aa leds: sgm3140: Add missing timer cleanup and flash gpio control
| * b9040d57 leds: aw2013: Unlock mutex before destroying it
| * 72f9bf6d powerpc/embedded6xx: Fix no previous prototype for avr_uart_send() etc.
| * cfb3a57e drm/msm/dpu: add division of drm_display_mode's hskew parameter
| * fd639cb8 powerpc/hv-gpci: Fix the H_GET_PERF_COUNTER_INFO hcall return value checks
| * 4688be96 drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip
| * 6c5a1562 media: mediatek: vcodec: avoid -Wcast-function-type-strict warning
| * 91036347 media: ttpci: fix two memleaks in budget_av_attach
| * b49fe84c media: go7007: fix a memleak in go7007_load_encoder
| * fb07104a media: dvb-frontends: avoid stack overflow warnings with clang
| * ab896d93 media: pvrusb2: fix uaf in pvr2_context_set_notify
| * 1c5620f9 drm/amdgpu: Fix missing break in ATOM_ARG_IMM Case of atom_get_src_int()
| * 24d71c7e ASoC: meson: axg-tdm-interface: add frame rate constraint
| * 4bc8e7f3 ASoC: meson: axg-tdm-interface: fix mclk setup without mclk-fs
| * fe9796ed mtd: rawnand: lpc32xx_mlc: fix irq handler prototype
| * 2c8a6d2b mtd: maps: physmap-core: fix flash size larger than 32-bit
| * 858839c6 drm/tidss: Fix initial plane zpos values
| * 9e42bebd crypto: arm/sha - fix function cast warnings
| * 9883ac68 mfd: altera-sysmgr: Call of_node_put() only when of_parse_phandle() takes a ref
| * df692444 mfd: syscon: Call of_node_put() only when of_parse_phandle() takes a ref
| * bd5f2747 drm/tegra: put drm_gem_object ref on error in tegra_fb_create
| * 2d476959 clk: hisilicon: hi3519: Release the correct number of gates in hi3519_clk_unregister()
| * 7057b8fa PCI: Mark 3ware-9650SE Root Port Extended Tags as broken
| * 792e6428 drm/mediatek: dsi: Fix DSI RGB666 formats and definitions
| * 85e2d916 clk: qcom: dispcc-sdm845: Adjust internal GDSC wait times
| * 0680a58e media: pvrusb2: fix pvr2_stream_callback casts
| * 964f45a7 media: pvrusb2: remove redundant NULL check
| * 1f8d45cd media: go7007: add check of return value of go7007_read_addr()
| * 5d9fe604 media: imx: csc/scaler: fix v4l2_ctrl_handler memory leak
| * c753ca1e media: sun8i-di: Fix chroma difference threshold
| * 6b5791c5 media: sun8i-di: Fix power on/off sequences
| * d2f80666 media: sun8i-di: Fix coefficient writes
| * 47588154 ASoC: meson: t9015: fix function pointer type mismatch
| * 3df9cd61 ASoC: meson: aiu: fix function pointer type mismatch
| * ac85b842 ASoC: meson: Use dev_err_probe() helper
| * bae8577e perf stat: Avoid metric-only segv
| * eca94a4b ALSA: seq: fix function cast warnings
| * 33a44d87 drm/radeon/ni: Fix wrong firmware size logging in ni_init_microcode()
| * 89526d77 perf thread_map: Free strlist on normal path in thread_map__new_by_tid_str()
| * 8a01335a crypto: xilinx - call finalize with bh disabled
| * 38e61b75 PCI: switchtec: Fix an error handling path in switchtec_pci_probe()
| * ca1cd560 quota: Fix rcu annotations of inode dquot pointers
| * 61380537 quota: Fix potential NULL pointer dereference
| * 00684e93 quota: simplify drop_dquot_ref()
| * 2e005642 clk: qcom: reset: Ensure write completion on reset de/assertion
| * b3080046 clk: qcom: reset: Commonize the de/assert functions
| * 160095aa pinctrl: mediatek: Drop bogus slew rate register range for MT8192
| * 09623703 media: edia: dvbdev: fix a use-after-free
| * afd2a82f media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity
| * 94303a06 media: v4l2-tpg: fix some memleaks in tpg_alloc
| * 19cb33fa media: em28xx: annotate unchecked call to media_device_register()
| * 892d955f perf evsel: Fix duplicate initialization of data->id in evsel__parse_sample()
| * 330caa06 drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()'
| * ff28893c drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()'
| * 53dea95c HID: lenovo: Add middleclick_workaround sysfs knob for cptkbd
| * 7007354d perf record: Fix possible incorrect free in record__switch_output()
| * ed2be47b PCI/DPC: Print all TLP Prefixes, not just the first
| * 610f20e5 media: tc358743: register v4l2 async device only after successful setup
| * 2c58c4dd dmaengine: tegra210-adma: Update dependency to ARCH_TEGRA
| * f2e80ac9 drm/lima: fix a memleak in lima_heap_alloc
| * e0d4850e drm/rockchip: lvds: do not print scary message when probing defer
| * 375a60fc drm/rockchip: lvds: do not overwrite error code
| * 2cb88106 drm: Don't treat 0 as -1 in drm_fixp2int_ceil
| * fbb37b39 drm/rockchip: inno_hdmi: Fix video timing
| * b7a82cfb drm/tegra: output: Fix missing i2c_put_adapter() in the error handling paths of tegra_output_probe()
| * f95401a5 drm/tegra: dsi: Fix missing pm_runtime_disable() in the error handling path of tegra_dsi_probe()
| * 317155c5 drm/tegra: dsi: Fix some error handling paths in tegra_dsi_probe()
| * 0e8c9283 drm/tegra: dsi: Make use of the helper function dev_err_probe()
| * 92003981 drm/tegra: dsi: Add missing check for of_find_device_by_node
| * f89bd277 dm: call the resume method on internal suspend
| * 94a6a9cf dm raid: fix false positive for requeue needed during reshape
| * 928705e3 nfp: flower: handle acti_netdevs allocation failure
| * e9b72f72 net/x25: fix incorrect parameter validation in the x25_getsockopt() function
| * 3627f21b net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function
| * 03c74f54 udp: fix incorrect parameter validation in the udp_lib_getsockopt() function
| * b42e5643 l2tp: fix incorrect parameter validation in the pppol2tp_getsockopt() function
| * 5a98fa33 ipmr: fix incorrect parameter validation in the ip_mroute_getsockopt() function
| * 8693e3cf bpf: net: Change do_ip_getsockopt() to take the sockptr_t argument
| * 415edd2d net/ipv4/ipv6: Replace one-element arraya with flexible-array members
| * 7394669d net/ipv4: Revert use of struct_size() helper
| * 1ebd0d89 net/ipv4: Replace one-element array with flexible-array member
| * c8059876 tcp: fix incorrect parameter validation in the do_tcp_getsockopt() function
| * 1f6244e9 OPP: debugfs: Fix warning around icc_get_name()
| * 6cf2e533 net: phy: dp83822: Fix RGMII TX delay configuration
| * c44a5aa4 net: phy: DP83822: enable rgmii mode if phy_interface_is_rgmii
| * a352d039 net: hns3: fix port duplex configure error in IMP reset
| * 06dd2104 net: phy: fix phy_get_internal_delay accessing an empty array
| * 77fd5294 net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()
| * edcec236 ipv6: fib6_rules: flush route cache when rule is changed
| * 15641007 bpf: Fix stackmap overflow check on 32-bit arches
| * 64f00b4d bpf: Fix hashtab overflow check on 32-bit arches
| * 225da02a bpf: Fix DEVMAP_HASH overflow check on 32-bit arches
| * 70294d8b bpf: Eliminate rlimit-based memory accounting for devmap maps
| * 6b4a39ac sr9800: Add check for usbnet_get_endpoints
| * d47e6c19 Bluetooth: hci_core: Fix possible buffer overflow
| * 69d9425b Bluetooth: Remove superfluous call to hci_conn_check_pending()
| * cbe742db igb: Fix missing time sync events
| * 02cba676 igb: move PEROUT and EXTTS isr logic to separate functions
| * f873b85e iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected
| * f858c084 PCI: Make pci_dev_is_disconnected() helper public for other drivers
| * 722c24cd wifi: rtw88: 8821c: Fix false alarm count
| * c55cc636 mmc: wmt-sdmmc: remove an incorrect release_mem_region() call in the .remove function
| * bb336cd8 SUNRPC: fix some memleaks in gssx_dec_option_array
| * a4e7ff1a x86, relocs: Ignore relocations in .notes section
| * 47a429a5 ACPI: scan: Fix device check notification handling
| * 5f99b46d arm64: dts: marvell: reorder crypto interrupts on Armada SoCs
| * 46792f9b ARM: dts: imx6dl-yapp4: Move the internal switch PHYs under the switch node
| * 2d1e5157 ARM: dts: imx6dl-yapp4: Fix typo in the QCA switch register address
| * 23d05494 ARM: dts: imx6dl-yapp4: Move phy reset into switch node
| * 229563e2 ARM: dts: arm: realview: Fix development chip ROM compatible value
| * 2478026f net: ena: Remove ena_select_queue
| * 98d186a1 wifi: brcmsmac: avoid function pointer casts
| * fb7601eb iommu/amd: Mark interrupt as managed
| * be8c5339 bus: tegra-aconnect: Update dependency to ARCH_TEGRA
| * c2a30c81 ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()
| * 5956f420 wifi: wilc1000: prevent use-after-free on vif when cleaning up all interfaces
| * 115252fc wireless: Remove redundant 'flush_workqueue()' calls
| * 23278c84 bpf: Mark bpf_spin_{lock,unlock}() helpers with notrace correctly
| * c5f2076a bpf: Factor out bpf_spin_lock into helpers.
| * dfd8a62a arm64: dts: mediatek: mt7622: add missing "device_type" to memory nodes
| * f0dd2731 wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
| * 7d4b47f2 net: blackhole_dev: fix build warning for ethh set but not used
| * 918d7f0d wifi: iwlwifi: fix EWRD table validity check
| * fabe2db7 wifi: iwlwifi: dbg-tlv: ensure NUL termination
| * 1bc5461a wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete
| * bdaf08b4 af_unix: Annotate data-race of gc_in_progress in wait_for_unix_gc().
| * 1524f463 bpftool: Silence build warning about calloc()
| * 926d95eb inet_diag: annotate data-races around inet_diag_table[]
| * 78441224 sock_diag: annotate data-races around sock_diag_handlers[family]
| * 9127599c cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value
| * 11824d6a wifi: mwifiex: debugfs: Drop unnecessary error check for debugfs_create_dir()
| * 5aa586bf wifi: wilc1000: fix multi-vif management when deleting a vif
| * dddedfa3 wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work
| * b4bbf38c wifi: wilc1000: fix RCU usage in connect path
| * fd86efb8 wifi: wilc1000: fix declarations ordering
| * caa839d4 wifi: b43: Disable QoS for bcm4331
| * 39c915a3 wifi: b43: Stop correct queue in DMA worker when QoS is disabled
| * 87178899 wifi: b43: Stop/wake correct queue in PIO Tx path when QoS is disabled
| * 49f06772 wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled
| * e1dc7aa8 wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()
| * c6fd906c timekeeping: Fix cross-timestamp interpolation for non-x86
| * 763a0092 timekeeping: Fix cross-timestamp interpolation corner case decision
| * fe908062 timekeeping: Fix cross-timestamp interpolation on counter wrap
| * faf0b4c5 aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
| * bb567cb5 md: Don't clear MD_CLOSING when the raid is about to stop
| * ab25f7cd md: implement ->set_read_only to hook into BLKROSET processing
| * 2a0f8202 block: add a new set_read_only method
| * a0bccba5 fs/select: rework stack allocation hack for clang
| * 4af837db nbd: null check for nla_nest_start
| * cde76b3a do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
| * cc6ddd6f x86/paravirt: Fix build due to __text_gen_insn() backport
| * 0344b12a ASoC: wm8962: Fix up incorrect error message in wm8962_set_fll
| * cd72f7de ASoC: wm8962: Enable both SPKOUTR_ENA and SPKOUTL_ENA in mono mode
| * 423d747f ASoC: wm8962: Enable oscillator if selecting WM8962_FLL_OSC
| * 44286475 Input: gpio_keys_polled - suppress deferred probe error for gpio
| * 02060144 ASoC: Intel: bytcr_rt5640: Add an extra entry for the Chuwi Vi8 tablet
| * 713eaf5c firewire: core: use long bus reset on gap count error
| * 81d7d920 Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security
| * ba3a55d1 scsi: mpt3sas: Prevent sending diag_reset when the controller is ready
| * e30b8525 dm-verity, dm-crypt: align "struct bvec_iter" correctly
| * 87221877 block: sed-opal: handle empty atoms when parsing response
| * d2e2cb52 parisc/ftrace: add missing CONFIG_DYNAMIC_FTRACE check
| * 3e0f73be net/iucv: fix the allocation size of iucv_path_table array
| * 6e4694e6 x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault()
| * aa64355c x86/mm: Move is_vsyscall_vaddr() into asm/vsyscall.h
| * 434a709d RDMA/mlx5: Relax DEVX access upon modify commands
| * d27c48dc RDMA/mlx5: Fix fortify source warning while accessing Eth segment
| * 0f9fa4e6 gen_compile_commands: fix invalid escape sequence warning
| * a8fee667 HID: multitouch: Add required quirk for Synaptics 0xcddc device
| * df14e946 MIPS: Clear Cause.BD in instruction_pointer_set
| * eb279074 x86/xen: Add some null pointer checking to smp.c
| * eddf7e95 ASoC: rt5645: Make LattePanda board DMI match more precise
| * 8e2113f6 selftests: tls: use exact comparison in recv_partial
| * 90c44579 bpf: Defer the free of inner map when necessary
| * 93c37f1c rcu-tasks: Provide rcu_trace_implies_rcu_gp()
| * a6771f34 io_uring: drop any code related to SCM_RIGHTS
| * 875f5fed io_uring/unix: drop usage of io_uring socket
* | 15b61bfa Revert "regmap: allow to define reg_update_bits for no bus configuration"
* | 0f0bcf2d Revert "regmap: Add bulk read/write callbacks into regmap_config"
* | 0d525b67 Revert "serial: max310x: make accessing revision id interface-agnostic"
* | d09c3a00 Revert "serial: max310x: implement I2C support"
* | e086f600 Revert "serial: max310x: fix IO data corruption in batched operations"
* | 7f1fc97f Revert "geneve: make sure to pull inner header in geneve_rx()"
* | 17eb54b8 Merge 5.10.213 into android13-5.10-lts
|\|
| * d35f3855 Linux 5.10.213
| * 738845b0 serial: max310x: fix IO data corruption in batched operations
| * 85d79478 serial: max310x: implement I2C support
| * 8082cc99 serial: max310x: make accessing revision id interface-agnostic
| * f36ef837 regmap: Add bulk read/write callbacks into regmap_config
| * 915848be regmap: allow to define reg_update_bits for no bus configuration
| * 82a62478 Drivers: hv: vmbus: Drop error message when 'No request id available'
| * 74d83d0f serial: max310x: Unprepare and disable clock in error path
| * f610023e getrusage: use sig->stats_lock rather than lock_task_sighand()
| * 9ca97868 getrusage: use __for_each_thread()
| * 21677f35 getrusage: move thread_group_cputime_adjusted() outside of lock_task_sighand()
| * 811415fe getrusage: add the "signal_struct *sig" local variable
| * 14136bed mm: hugetlb pages should not be reserved by shmat() if SHM_NORESERVE
| * 05edf434 mm/hugetlb: change hugetlb_reserve_pages() to type bool
| * 5b10a88f hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed
| * 8f41b33d hv_netvsc: use netif_is_bond_master() instead of open code
| * 0d54d224 hv_netvsc: Make netvsc/VF binding check both MAC and serial number
| * 3cfee566 hv_netvsc: Process NETDEV_GOING_DOWN on VF hot remove
| * 0db98ee0 hv_netvsc: Wait for completion on request SWITCH_DATA_PATH
| * cdba0356 hv_netvsc: Use vmbus_requestor to generate transaction IDs for VMBus hardening
| * 2ce36635 Drivers: hv: vmbus: Add vmbus_requestor data structure for VMBus hardening
| * 58bf67d5 ext4: convert to exclusive lock while inserting delalloc extents
| * 5b69dabd ext4: refactor ext4_da_map_blocks()
| * b3bca5e8 ext4: make ext4_es_insert_extent() return void
| * c09ffff2 lsm: fix default return value of the socket_getpeersec_*() hooks
| * ea6e87db lsm: make security_socket_getpeersec_stream() sockptr_t safe
| * a9482f3b bpf: net: Change sk_getsockopt() to take the sockptr_t argument
| * be155e94 net: Change sock_getsockopt() to take the sk ptr instead of the sock ptr
| * 518ec3da serial: max310x: prevent infinite while() loop in port startup
| * fe0d16b3 serial: max310x: use a separate regmap for each port
| * c1ecaadb serial: max310x: use regmap methods for SPI batch operations
| * 32e32ab1 serial: max310x: Make use of device properties
| * c7e9e6d5 serial: max310x: fail probe if clock crystal is unstable
| * c2b9cbf0 serial: max310x: Try to get crystal clock rate from property
| * 569154b2 serial: max310x: Use devm_clk_get_optional() to get the input clock
| * 696e4112 xhci: handle isoc Babble and Buffer Overrun events properly
| * fe2322ca xhci: process isoc TD properly when there was a transaction error mid TD.
| * fa5aaf31 xhci: prevent double-fetch of transfer and transfer event TRBs
| * 89ed7eba xhci: remove extra loop in interrupt context
| * 9c398afd um: allow not setting extra rpaths in the linux binary
| * c9c3cc6a selftests: mm: fix map_hugetlb failure on 64K page size systems
| * 1dee72c0 selftests/mm: switch to bash from sh
| * bbf950a6 netrom: Fix data-races around sysctl_net_busy_read
| * cfe0f73f netrom: Fix a data-race around sysctl_netrom_link_fails_count
| * b7d33e08 netrom: Fix a data-race around sysctl_netrom_routing_control
| * 01d4e3af netrom: Fix a data-race around sysctl_netrom_transport_no_activity_timeout
| * 652b0b35 netrom: Fix a data-race around sysctl_netrom_transport_requested_window_size
| * f3315a6e netrom: Fix a data-race around sysctl_netrom_transport_busy_delay
| * 34c84e00 netrom: Fix a data-race around sysctl_netrom_transport_acknowledge_delay
| * 34a164d2 netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries
| * 291d36d7 netrom: Fix a data-race around sysctl_netrom_transport_timeout
| * d1261bde netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser
| * 18c95d11 netrom: Fix a data-race around sysctl_netrom_obsolescence_count_initialiser
| * e041df5d netrom: Fix a data-race around sysctl_netrom_default_path_quality
| * ccd1108b netfilter: nf_conntrack_h323: Add protection for bmp length out of range
| * 2b4e7cb7 netfilter: nft_ct: fix l3num expectations with inet pseudo family
| * 9dfc15a1 net/rds: fix WARNING in rds_conn_connect_if_down
| * 5f4e51ab cpumap: Zero-initialise xdp_rxq_info struct before running XDP program
| * 79ce2e54 net/ipv6: avoid possible UAF in ip6_route_mpath_notify()
| * 37fe9901 net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink()
| * c7137900 geneve: make sure to pull inner header in geneve_rx()
| * fdb63c17 tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string
| * 71e21eb1 i40e: disable NAPI right after disabling irqs when handling xsk_pool
| * ad91d5d1 ixgbe: {dis, en}able irqs in ixgbe_txrx_ring_{dis, en}able
| * 336261af net: lan78xx: fix runtime PM count underflow on link stop
| * 11a3c9f4 lan78xx: Fix race conditions in suspend/resume handling
| * 69215f8e lan78xx: Fix partial packet errors on suspend/resume
| * e5d7f43c lan78xx: Add missing return code checks
| * 06133626 lan78xx: Fix white space and style issues
| * 0224cbc5 mmc: mmci: stm32: fix DMA API overlapping mappings warning
| * abda366e mmc: mmci: stm32: use a buffer for unaligned DMA requests
* | 287331ff Merge 5.10.212 into android13-5.10-lts
|\|
| * 7cfcd0ed Linux 5.10.212
| * f74362a0 mptcp: fix double-free on socket dismantle
| * 30d84d87 mtd: spinand: gigadevice: fix Quad IO for GD5F1GQ5UExxG
| * 1805131d gpio: fix resource unwinding order in error path
| * 51f7044d gpiolib: Fix the error path order in gpiochip_add_data_with_key()
| * 947baae1 gpio: 74x164: Enable output pins after registers are reset
| * 80d85229 fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super
| * 43eccc58 cachefiles: fix memory leak in cachefiles_add_cache()
| * 28717281 ext4: avoid bb_free and bb_fragments inconsistency in mb_free_blocks()
| * 70e5b013 mptcp: fix possible deadlock in subflow diag
| * 36103f8c x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers
| * 7a7cb526 pmdomain: qcom: rpmhpd: Fix enabled_corner aggregation
| * 36b02df0 mmc: sdhci-xenon: fix PHY init clock stability
| * d3c703c2 mmc: sdhci-xenon: add timeout for PHY init complete
| * 3fd14520 mmc: core: Fix eMMC initialization with 1-bit bus connection
| * 9579a21e dmaengine: fsl-qdma: init irq after reg initialization
| * bb3a06e9 dmaengine: fsl-qdma: fix SoC may hang on 16 byte unaligned read
| * 2886fe30 btrfs: dev-replace: properly validate device names
| * 99eb2159 wifi: nl80211: reject iftype change with mesh ID change
| * e668b92a gtp: fix use-after-free and null-ptr-deref in gtp_newlink()
| * a23ac178 tomoyo: fix UAF write bug in tomoyo_write_control()
| * 8af1c121 riscv: Sparse-Memory/vmemmap out-of-bounds fix
| * 96370ba3 afs: Fix endless loop in directory parsing
| * 14aacfcd ALSA: Drop leftover snd-rtctimer stuff from Makefile
| * d7acc4a5 power: supply: bq27xxx-i2c: Do not free non existing IRQ
| * 537e3f49 efi/capsule-loader: fix incorrect allocation size
| * 882a51a1 rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back
| * 80fabcd5 netfilter: nf_tables: allow NFPROTO_INET in nft_(match/target)_validate()
| * e24acaef Bluetooth: Enforce validation on max value of connection interval
| * df193568 Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST
| * 0309b68a Bluetooth: hci_event: Fix wrongly recorded wakeup BD_ADDR
| * 6dd0a9df Bluetooth: Avoid potential use-after-free in hci_error_reset
| * 6782a54e net: usb: dm9601: fix wrong return value in dm9601_mdio_read
| * c1c7396b lan78xx: enable auto speed configuration for LAN7850 if no EEPROM is detected
| * 810fa7d5 ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()
| * 906986fe tun: Fix xdp_rxq_info's queue_index when detaching
| * 2e95350f net: ip_tunnel: prevent perpetual headroom growth
| * f19d1f98 netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
| * acd9f6d4 mtd: spinand: gigadevice: Fix the get ecc status issue
| * 8e3a8675 mtd: spinand: gigadevice: Support GD5F1GQ5UExxG
| * 37077ed1 crypto: virtio/akcipher - Fix stack overflow on memcpy
| * bf85def4 platform/x86: touchscreen_dmi: Allow partial (prefix) matches for ACPI names
* | cbf8e561 Revert "mptcp: fix lockless access in subflow ULP diag"
* | ad677e1f Revert "net: dev: Convert sa_data to flexible array in struct sockaddr"
* | 8ca8f588 Revert "arp: Prevent overflow in arp_req_get()."
* | dc68375e Revert "usb: roles: fix NULL pointer issue when put module's reference"
* | 048142f2 Revert "usb: roles: don't get/set_role() when usb_role_switch is unregistered"
* | ef7c62ce Merge 5.10.211 into android13-5.10-lts
|/
* 9985c44f Linux 5.10.211
* 94ebf71b ext4: regenerate buddy after block freeing failed if under fc replay
* dbc9b22d arp: Prevent overflow in arp_req_get().
* ea1cd64d fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio
* bff0a065 block: ataflop: more blk-mq refactoring fixes
* b49b022f drm/amd/display: Fix memory leak in dm_sw_fini()
* c6551ff2 drm/syncobj: call drm_syncobj_fence_add_wait when WAIT_AVAILABLE flag is set
* 144ec5e1 drm/syncobj: make lockdep complain on WAIT_FOR_SUBMIT v3
* 31ea574a netfilter: nf_tables: set dormant flag on hook register failure
* 31e10d6c tls: stop recv() if initial process_rx_list gave us non-DATA
* 7c54eaa3 tls: rx: drop pointless else after goto
* 4820e84e tls: rx: jump to a more appropriate label
* 5d4e4eff s390: use the correct count for __iowrite64_copy()
* f6ce9056 net: dev: Convert sa_data to flexible array in struct sockaddr
* c1b447a2 packet: move from strlcpy with unused retval to strscpy
* 65c38f23 ipv6: sr: fix possible use-after-free and null-ptr-deref
* d9b5e2b7 afs: Increase buffer size in afs_update_volume_status()
* 2f56d712 ipv6: properly combine dev_base_seq and ipv6.dev_addr_genid
* dcc1375d ipv4: properly combine dev_base_seq and ipv4.dev_addr_genid
* fc30793e nouveau: fix function cast warnings
* 49ef33a9 scsi: jazz_esp: Only build if SCSI core is builtin
* b42b801a bpf, scripts: Correct GPL license name
* a2d1e1f8 RDMA/srpt: fix function pointer cast warnings
* 905de68f arm64: dts: rockchip: set num-cs property for spi on px30
* 5639414a RDMA/qedr: Fix qedr_create_user_qp error flow
* 5a5c039d RDMA/srpt: Support specifying the srpt_service_guid parameter
* 179bb088 RDMA/bnxt_re: Return error for SRQ resize
* 3fa240bb IB/hfi1: Fix a memleak in init_credit_return
* 8affdbb3 mptcp: fix lockless access in subflow ULP diag
* eb369345 usb: roles: don't get/set_role() when usb_role_switch is unregistered
* e279bf8e usb: roles: fix NULL pointer issue when put module's reference
* 57ca0e16 usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs
* 1e204a8e usb: cdns3: fix memory double free when handle zero packet
* b40328ee usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable()
* 1dfe6393 x86/alternative: Make custom return thunk unconditional
* dd1a169b Revert "x86/alternative: Make custom return thunk unconditional"
* e8e9d1f6 x86/returnthunk: Allow different return thunks
* 4eb421fa x86/ftrace: Use alternative RET encoding
* b253061d x86/ibt,paravirt: Use text_gen_insn() for paravirt_patch()
* e752912c x86/text-patching: Make text_gen_insn() play nice with ANNOTATE_NOENDBR
* c13d4260 Revert "x86/ftrace: Use alternative RET encoding"
* 70d92abb ARM: ep93xx: Add terminator to gpiod_lookup_table
* dcb4d142 l2tp: pass correct message length to ip6_append_data
* 03366ad1 PCI/MSI: Prevent MSI hardware interrupt number truncation
* 2e534fd1 gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()
* 6e5069b4 KVM: arm64: vgic-its: Test for valid IRQ in its_sync_lpi_pending_table()
* 615af9cb KVM: arm64: vgic-its: Test for valid IRQ in MOVALL handler
* 3c652f6f dm-crypt: don't modify the data when using authenticated encryption
* f6a765a6 s390/cio: fix invalid -EBUSY on ccw_device_start
* 3f38d22e IB/hfi1: Fix sdma.h tx->num_descs off-by-one error
* a0180e94 erofs: fix lz4 inplace decompression
* 841b9f6f x86: drop bogus "cc" clobber from __try_cmpxchg_user_asm()
* 6360869c jbd2: Fix wrongly judgement for buffer head removing while doing checkpoint
* 69389d82 jbd2: recheck chechpointing non-dirty buffer
* cb1609ef jbd2: remove redundant buffer io error checks
* 52b9609b iwlwifi: mvm: write queue_sync_state only for sync
* f5e6da2c iwlwifi: mvm: do more useful queue sync accounting
* 87b7d049 platform/x86: intel-vbtn: Support for tablet mode on HP Pavilion 13 x360 PC
* 6c367739 lan743x: fix for potential NULL pointer dereference with bare card
* a1ccc4f4 btrfs: do not pin logs too early during renames
* 16b70511 btrfs: unify lookup return value when dir entry is missing
* fccb8a61 btrfs: introduce btrfs_lookup_match_dir
* aaf2d6b7 btrfs: tree-checker: check for overlapping extent items
* b8034ca2 task_stack, x86/cea: Force-inline stack helpers
* 68ffe3ec ASoC: Intel: bytcr_rt5651: Drop reference count of ACPI device after use
* edeef1b4 ASoC: Intel: boards: get codec device with ACPI instead of bus search
* 151b360f ASoC: Intel: boards: harden codec property handling
* 877037ef mtd: spinand: macronix: Add support for MX35LFxGE4AD
* b6c4a44e cifs: add a warning when the in-flight count goes negative
* e410dfaa powerpc/watchpoints: Annotate atomic context in more places
* 2641aa3f powerpc/watchpoint: Workaround P10 DD1 issue with VSX-32 byte instructions
* d021ba11 block: ataflop: fix breakage introduced at blk-mq refactoring
* 1dd3dc38 seccomp: Invalidate seccomp mode to catch death failures
* 7ab8a3ba x86/uaccess: Implement macros for CMPXCHG on user addresses
* 13f6937f hsr: Avoid double remove of a node.
* b2e72d88 hvc/xen: prevent concurrent accesses to the shared ring
* 86ba65e5 media: av7110: prevent underflow in write_ts_to_decoder()
* d6e60c53 ASoC: fsl_micfil: register platform component before registering cpu dai
* de899eda ARM: dts: imx: Set default tuning step for imx6sx usdhc
* 51582123 irqchip/mips-gic: Don't touch vl_map if a local interrupt is not routable
* ef6128a1 ARM: dts: BCM53573: Drop nonexistent "default-off" LED trigger
* a4c0234b pmdomain: renesas: r8a77980-sysc: CR7 must be always on
* 5fe446b2 virtio-blk: Ensure no requests in virtqueues before deleting vqs.
* 92a1090b firewire: core: send bus reset promptly on gap count error
* 6a375022 scsi: lpfc: Use unsigned type for num_sge
* 7fb19792 hwmon: (coretemp) Enlarge per package core count limit
* 988ae00e efi: Don't add memblocks for soft-reserved memory
* 4fff3d73 efi: runtime: Fix potential overflow of soft-reserved region size
* 865f99f6 Input: i8042 - add Fujitsu Lifebook U728 to i8042 quirk table
* 30a87845 ext4: correct the hole length returned by ext4_map_blocks()
* a72037da nvmet-fc: abort command when there is no binding
* a0fa157b nvmet-fc: release reference on target port
* 5da866be nvmet-fcloop: swap the list_add_tail arguments
* 4f2c9501 nvme-fc: do not wait in vain when unloading module
* f82ed69f netfilter: conntrack: check SCTP_CID_SHUTDOWN_ACK for vtag setting in sctp_new
* da47fc8d spi: sh-msiof: avoid integer overflow in constants
* 0a840d79 ASoC: sunxi: sun4i-spdif: Add support for Allwinner H616
* 5b33bbee nvmet-tcp: fix nvme tcp ida memory leak
* d21c122d regulator: pwm-regulator: Add validity checks in continuous .get_voltage
* c432094a dmaengine: ti: edma: Add some null pointer checks to the edma_probe
* ffeb72a8 ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
* 927794a0 ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()
* 2b39c1a0 ahci: add 43-bit DMA address quirk for ASMedia ASM1061 controllers
* 15bb22da ahci: asm1166: correct count of reported ports
* e94da8ac spi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected
* cd36da76 fbdev: sis: Error out if pixclock equals zero
* 512ee6d6 fbdev: savage: Error out if pixclock equals zero
* 5ffab99e wifi: mac80211: fix race condition on enabling fast-xmit
* 7e71fbc6 wifi: cfg80211: fix missing interfaces when dumping
* 17c976fe dmaengine: fsl-qdma: increase size of 'irq_name'
* d94a80da dmaengine: shdma: increase size of 'dev_id'
* 168ed591 scsi: target: core: Add TMF to tmr_list handling
* e4bc3117 sched/rt: Disallow writing invalid values to sched_rt_period_us
* 13c6bce7 sched/rt: Fix sysctl_sched_rr_timeslice intial value
* b1ba0651 zonefs: Improve error handling
* 19087d70 userfaultfd: fix mmap_changing checking in mfill_atomic_hugetlb
* 18d88bf9 sched/rt: sysctl_sched_rr_timeslice show default timeslice after reset
* 94b06498 smb: client: fix parsing of SMB3.1.1 POSIX create context
* 13fb0fc4 smb: client: fix potential OOBs in smb2_parse_contexts()
* b03c8099 smb: client: fix OOB in receive_encrypted_standard()
* 3fa31e7a net/sched: Retire dsmark qdisc
* 71925d68 net/sched: Retire ATM qdisc
* 56a6720d net/sched: Retire CBQ qdisc

Change-Id: I26dd62610959a84f5965fc73cd9307555314830f
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

[ Upstream commit 47d8ac01 ]

Garbage collector does not take into account the risk of embryo getting
enqueued during the garbage collection. If such embryo has a peer that
carries SCM_RIGHTS, two consecutive passes of scan_children() may see a
different set of children. Leading to an incorrectly elevated inflight
count, and then a dangling pointer within the gc_inflight_list.

sockets are AF_UNIX/SOCK_STREAM
S is an unconnected socket
L is a listening in-flight socket bound to addr, not in fdtable
V's fd will be passed via sendmsg(), gets inflight count bumped

connect(S, addr)	sendmsg(S, [V]); close(V)	__unix_gc()
----------------	-------------------------	-----------

NS = unix_create1()
skb1 = sock_wmalloc(NS)
L = unix_find_other(addr)
unix_state_lock(L)
unix_peer(S) = NS
			// V count=1 inflight=0

 			NS = unix_peer(S)
 			skb2 = sock_alloc()
			skb_queue_tail(NS, skb2[V])

			// V became in-flight
			// V count=2 inflight=1

			close(V)

			// V count=1 inflight=1
			// GC candidate condition met

						for u in gc_inflight_list:
						  if (total_refs == inflight_refs)
						    add u to gc_candidates

						// gc_candidates={L, V}

						for u in gc_candidates:
						  scan_children(u, dec_inflight)

						// embryo (skb1) was not
						// reachable from L yet, so V's
						// inflight remains unchanged
__skb_queue_tail(L, skb1)
unix_state_unlock(L)
						for u in gc_candidates:
						  if (u.inflight)
						    scan_children(u, inc_inflight_move_tail)

						// V count=1 inflight=2 (!)

If there is a GC-candidate listening socket, lock/unlock its state. This
makes GC wait until the end of any ongoing connect() to that socket. After
flipping the lock, a possibly SCM-laden embryo is already enqueued. And if
there is another embryo coming, it can not possibly carry SCM_RIGHTS. At
this point, unix_inflight() can not happen because unix_gc_lock is already
taken. Inflight graph remains unaffected.

Bug: 336226035
Fixes: 1fd05ba5 ("[AF_UNIX]: Rewrite garbage collector, fixes race.")
Signed-off-by: Michal Luczaj <mhal@rbox.co>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Link: https://lore.kernel.org/r/20240409201047.1032217-1-mhal@rbox.co


Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 507cc232ffe53a352847893f8177d276c3b532a9)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: If321f78b8b3220f5a1caea4b5e9450f1235b0770

Original change: https://partner-android-review.googlesource.com/c/kernel/private/gs-google/+/2860179



Change-Id: Ia19bfe383688889adaa7a4cf55ff5763d24719ce
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

Assigns device data to `s3c_wdt[cluster_index]` only when probe function
completes. Several functions of s3c2410_wdt use the existence of
`s3c_wdt[*]` to decide whether the device data is ready to be accessed.
This causes an invalid access issue as long as the probe function puts
device data to `s3c_wdt[cluster_index]` before completely preparing the
content. Fixes the issue by rearranging the assignment order.

Bug: 342585125
Change-Id: Idb4c3b71fb2e0518725c697db01e708aa0c7c86b
Signed-off-by: Woody Lin <woodylin@google.com>
(cherry picked from commit d7bd15571d51e658a081d98dfbcc17e3aa104585)