* sm8250/lineage-20:
qcacld-3.0: Correcting the TSInfo structure size according to the Spec
BACKPORT: dsp-kernel: Add attribute and flag checks during map creation
UPSTREAM: ALSA: usb-audio: Fix out of bounds reads when finding clock sources
Change-Id: I42bd289165e9cf1a74977f34c3b184616b60e598
According to spec the TSinfo size should be 4 bytes.
To fix this issue,TSInfo size is increased to 4bytes aligning with the
current standard.
CRs-Fixed: 3910625
Change-Id: I7979fa84af0295d21d4afe1b876af494a5b8fed8
A persistence map is expected to hold refs=2 during its creation.
However, the Fuzzy test can create a persistence map by configuring
a mismatch between attributes and flags using the KEEP MAP attribute
and FD NOMAP flags. This sets the map reference count to 1. The user
then calls fastrpc_internal_munmap_fd to free the map since it
doesn't check flags, which can cause a use-after-free (UAF) for the
file map and shared buffer. Add a check to restrict DMA handle
maps with invalid attributes.
Change-Id: I2f024ef99cc2a0487010504166e3af3433d5302d
Acked-by: Santosh <quic_ssakore@quicinc.com>
Signed-off-by: Abhinav Parihar <quic_parihar@quicinc.com>
commit a3dd4d63eeb452cfb064a13862fb376ab108f6a6 upstream.
The current USB-audio driver code doesn't check bLength of each
descriptor at traversing for clock descriptors. That is, when a
device provides a bogus descriptor with a shorter bLength, the driver
might hit out-of-bounds reads.
For addressing it, this patch adds sanity checks to the validator
functions for the clock descriptor traversal. When the descriptor
length is shorter than expected, it's skipped in the loop.
For the clock source and clock multiplier descriptors, we can just
check bLength against the sizeof() of each descriptor type.
OTOH, the clock selector descriptor of UAC2 and UAC3 has an array
of bNrInPins elements and two more fields at its tail, hence those
have to be checked in addition to the sizeof() check.
Bug: 382239029
Reported-by: Benoît Sevens <bsevens@google.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/20241121140613.3651-1-bsevens@google.com
Link: https://patch.msgid.link/20241125144629.20757-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Benoît Sevens <bsevens@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 45a92cbc88e4013bfed7fd2ccab3ade45f8e896b)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I13e916ffd46fce6fd08f7b9f96cea82bb4bc475d
* sm8250/lineage-20:
Revert "ANDROID: modpost: add an exception for CFI stubs"
ANDROID: Update CFI patchset from android11-5.4
ANDROID: adding __nocfi to cpuidle_enter_state
ANDROID: arm64: Fix the address of ftrace_call compiled with CFI_CLANG
ANDROID: arm64: add __va_function
arm64: bpf: Don't use module memory for the BPF JIT CFI check.
arm64/bpf: don't allocate BPF JIT programs in module memory
bpf: add __weak hook for allocating executable memory
clk/qcom/clk-alpha-pll: Fix pll post div mask when width is not set
bpf: Use dedicated bpf_trace_printk event instead of trace_printk()
BACKPORT: audio-kernel: Disable clock voting logs
msm: kgsl: introduce CONFIG_CORESIGHT_ADRENO.
Change-Id: I6ea6bdae1d2efa2be9620b5f68d9ae7e78dcdf4a
This reverts commit e525d2cfbe652f4e287a7f84ce397d4f751d3aed.
Reason for revert: not present in android11-5.4
Change-Id: If175677a9002962baf605e632c74435f659e0420
Signed-off-by: Alexander Winkowski <dereference23@outlook.com>
Background:
When CPU is going to idle state, it would inform RCU that
current CPU is entering idle through rcu_idle_enter(),
and RCU will ignore read-side critical sections of this CPU.
However, there is CFI check mechanism inside idle flow and
calls rcu_read_lock(), so "rcu_read_lock() used illegally while idle"
in rcu_read_lock() will be triggered because rcu_idle_enter()
was already called before.
Beside, the pointer of rcu_dereference() might be invalid
due to the RCU read-side critical sections will be ignoring in
this going idle CPU, it might cause problems like:
access the wrong data/address, kernel exception...
Based on above description:
We will add __nocfi to cpuidle_enter_state to avoid
“rcu_read_lock() used illegally while idle!”
and avoid the usage of invalid pointer of rcu_dereference()
in this situation.
Bug: 169017431
Change-Id: I8bbe25704e18cfde351a8f4277dd4b44b07421f5
Signed-off-by: rogercl.yang <rogercl.yang@mediatek.com>
Signed-off-by: Chun-Hung Wu <chun-hung.wu@mediatek.com>
When CONFIG_CFI_CLANG and CONFIG_DYNAMIC_FTRACE are enabled, LLVM will
generate a jump function named ftrace_call.cfi_jt for ftrace_call, which
makes "&ftrace_call" in ftrace_update_ftrace_func() actually the address
of ftrace_call.cfi_jt. As a result, the tracer can't be really enabled
through runtime modification. Use __va_function() to get the actual address
of ftrace_call to fix the issue.
Bug: 184105181
Signed-off-by: Ben Dai <ben.dai@unisoc.com>
Change-Id: Ic9272cd4ab447b3b145d8e397e5c9010c49f7a12
With CFI, the compiler replaces function references with pointers
to the CFI jump table. This breaks passing these addresses to
code running at EL2, where the jump tables are not valid. Add a
__va_function macro similarly to the earlier __pa_function to take
address of the actual function in inline assembly and use that in
kvm_ksym_ref instead.
Bug: 163385976
Change-Id: I097b99409995512c00786300e7d18fe42c720a1b
(cherry picked from commit 2f4d6c9fd77c88ad0500aad4bf1f64aaf2654c49)
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
The arm64 module region is a 128 MB region that is kept close to
the core kernel, in order to ensure that relative branches are
always in range. So using the same region for programs that do
not have this restriction is wasteful, and preferably avoided.
Now that the core BPF JIT code permits the alloc/free routines to
be overridden, implement them by vmalloc()/vfree() calls from a
dedicated 128 MB region set aside for BPF programs. This ensures
that BPF programs are still in branching range of each other, which
is something the JIT currently depends upon (and is not guaranteed
when using module_alloc() on KASLR kernels like we do currently).
It also ensures that placement of BPF programs does not correlate
with the placement of the core kernel or modules, making it less
likely that leaking the former will reveal the latter.
This also solves an issue under KASAN, where shadow memory is
needlessly allocated for all BPF programs (which don't require KASAN
shadow pages since they are not KASAN instrumented)
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Acked-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Danny Lin <danny@kdrag0n.dev>
Change-Id: Id3a066651f282249e8825b7bcdf9a78e84c1f878
By default, BPF uses module_alloc() to allocate executable memory,
but this is not necessary on all arches and potentially undesirable
on some of them.
So break out the module_alloc() and module_memfree() calls into __weak
functions to allow them to be overridden in arch code.
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Danny Lin <danny@kdrag0n.dev>
Change-Id: I582794881942bc0b766515861f2232354860536b
The bpf helper bpf_trace_printk() uses trace_printk() under the hood.
This leads to an alarming warning message originating from trace
buffer allocation which occurs the first time a program using
bpf_trace_printk() is loaded.
We can instead create a trace event for bpf_trace_printk() and enable
it in-kernel when/if we encounter a program using the
bpf_trace_printk() helper. With this approach, trace_printk()
is not used directly and no warning message appears.
This work was started by Steven (see Link) and finished by Alan; added
Steven's Signed-off-by with his permission.
Change-Id: Ie1e4cf1dce934e62613440b5081cb757cdbe982c
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Andrii Nakryiko <andriin@fb.com>
Link: https://lore.kernel.org/r/20200628194334.6238b933@oasis.local.home
Link: https://lore.kernel.org/bpf/1594641154-18897-2-git-send-email-alan.maguire@oracle.com
trace_printk is recommended for debugging purpose as it
requires temporary memory to handle strings. If used
anywhere within the kernel, memory will be allocated to it.
Hence removed it to avoid any unnecessary memory allocation.
Change-Id: If7b0cada91c97b21987f91e0ff7b7a15ce2145e2
Signed-off-by: Faiz Nabi Kuchay <quic_fkuchay@quicinc.com>
Signed-off-by: Hridaya Prajapati <info.hridayaprajapati@gmail.com>
We want to build coresight drivers as builtin drivers. But
adreno-coresight.c in msm_adreno.ko calls coresight functions.
To avoid exporting new symbols in vmlinux and breaking the ABI, this
patch separates adreno-coresight.c into CONFIG_CORESIGHT_ADRENO.
CONFIG_CORESIGHT_ADRENO is only enabled when both coresight and adreno
are builtin drivers.
Bug: 167414982
Bug: 170753932
Signed-off-by: Yabin Cui <yabinc@google.com>
Change-Id: I7488293445ade738ba03cc457320e0d74f910886
* sm8250/lineage-20:
qcacld-5.0: Fix the possible OOB write in country IE unpack
disp: msm: dsi: add null pointer check in dsi_display_dev_remove
Change-Id: I0067d570daaf449d58b6e6be6630c303cb3cb0aa
Fix the possible OOB write in unpacking the country IE due to
the IE length check against integer division.
CRs-Fixed: 3910626
Change-Id: I800290ab7285fb46ed43a46ce38967046b4881fa
* sm8250/lineage-20:
ANDROID: android-verity: Prevent double-freeing metadata
UPSTREAM: f2fs: fix UAF in f2fs_available_free_memory
msm: ipa2: Add check to validate rule_cnt
msm: eva: Copy back the validated size to avoid security issue
msm: adsprpc: Avoid double free on map
msm: npu: Fix use after free issue
msm: npu: Fix use after free issue
clk: qcom: lpasscc-scuba: Add Support for AON & AUDIO clock drivers
dt-bindings: clk: lpasscc-scuba: Add support for LPASS AONCC and AUDIOCC
msm: ipa: clean up netdev resources in AFTER_SHUTDOWN cb
msm: camera: isp: Copy the userdata in kernel to avoid TOCTOU
asoc: codec: avoid out of bound write to map array
asoc: codec: avoid out of bound write to map array
Slimbus: slim-msm-ngd: Avoid accessing deallocated stack
dsp: q6voice: Changing data type from %d to %ld
dsp: q6voice: Add buf size check for cvp cal data
Change-Id: I82dc4d87d7cfe64c21a014d59d318fd5dd7e65c0
"LA.UM.9.15.2.r1-11100-KAMORTA.QSSI14.0"
* tag 'LA.UM.9.15.2.r1-11100-KAMORTA.QSSI14.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/audio-kernel:
asoc: codec: avoid out of bound write to map array
asoc: codec: avoid out of bound write to map array
dsp: q6voice: Changing data type from %d to %ld
dsp: q6voice: Add buf size check for cvp cal data
Conflicts:
techpack/audio/asoc/codecs/wcd938x/wcd938x.c
Change-Id: I7d1385928f2945ca39e10a6d5a8b7cc497ea9d26
"LA.UM.9.15.2.r1-11100-KAMORTA.QSSI14.0"
* tag 'LA.UM.9.15.2.r1-11100-KAMORTA.QSSI14.0' of https://git.codelinaro.org/clo/la/kernel/msm-4.19:
msm: eva: Copy back the validated size to avoid security issue
msm: adsprpc: Avoid double free on map
msm: npu: Fix use after free issue
msm: npu: Fix use after free issue
clk: qcom: lpasscc-scuba: Add Support for AON & AUDIO clock drivers
dt-bindings: clk: lpasscc-scuba: Add support for LPASS AONCC and AUDIOCC
msm: ipa: clean up netdev resources in AFTER_SHUTDOWN cb
Slimbus: slim-msm-ngd: Avoid accessing deallocated stack
Change-Id: I4eb6096f7140d127f8bf3d2c299550aec2720bc1
If extract_metadata() fails, it will free metadata in its own error
path, so it is safe to simply return the provided error value without
worrying about resource handling/releasing.
Moreover, if we simply return in extract_metadata()'s error path, we
can assume the thread of execution will only make it down into the
free_metadata: tag area sometime after extract_metadata()'s success,
in which case metadata will need to be freed without question.
Bug: 234030265
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Change-Id: I1bf42ff9ecef3eea26543526c6955d7823d45c43
if2fs_fill_super
-> f2fs_build_segment_manager
-> create_discard_cmd_control
-> f2fs_start_discard_thread
It invokes kthread_run to create a thread and run issue_discard_thread.
However, if f2fs_build_node_manager fails, the control flow goes to
free_nm and calls f2fs_destroy_node_manager. This function will free
sbi->nm_info. However, if issue_discard_thread accesses sbi->nm_info
after the deallocation, but before the f2fs_stop_discard_thread, it will
cause UAF(Use-after-free).
-> f2fs_destroy_segment_manager
-> destroy_discard_cmd_control
-> f2fs_stop_discard_thread
Fix this by stopping discard thread before f2fs_destroy_node_manager.
Note that, the commit d6d2b491a82e1 introduces the call of
f2fs_available_free_memory into issue_discard_thread.
Cc: stable@vger.kernel.org
Fixes: d6d2b491a82e ("f2fs: allow to change discard policy based on cached discard cmds")
Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit 5429c9dbc9025f9a166f64e22e3a69c94fd5b29b)
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Change-Id: If121b453455b11b2aded8ba8a3899faad431dbd3
Add proper check to validate table rule count
which may lead to overflow error.
Change-Id: Idfa86878db49ad4803f8902c995eb4186a2d3523
Signed-off-by: Praveen Kurapati <pkurapat@codeaurora.org>
commit f7d306b47a24367302bd4fe846854e07752ffcd9 upstream.
The usb_get_descriptor() function does DMA so we're not allowed
to use a stack buffer for that. Doing DMA to the stack is not portable
all architectures. Move the "new_device_descriptor" from being stored
on the stack and allocate it with kmalloc() instead.
Bug: 382243530
Fixes: b909df18ce2a ("ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices")
Cc: stable@kernel.org
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://patch.msgid.link/60e3aa09-039d-46d2-934c-6f123026c2eb@stanley.mountain
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Benoît Sevens <bsevens@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 4e54dc4bbc602133217de301d9f814f3e6d22eee)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I469212aa538584e3d8cc5b0087b68c99acf43f64
As we are reading the packet from a shared queue, there is a
possibility to corrupt the packet->size data of shared queue by
malicious FW after validating it in the kernel driver.
Change-Id: I3aae85dea560e2805e7bff2c48d4be763da597de
Signed-off-by: Gopireddy Arunteja Reddy <quic_garuntej@quicinc.com>
* sm8250/lineage-20:
Revert "UPSTREAM: unicode: Don't special case ignorable code points"
Reapply "UPSTREAM: unicode: Don't special case ignorable code points"
Revert "UPSTREAM: unicode: Don't special case ignorable code points"
Linux 4.19.325
sh: intc: Fix use-after-free bug in register_intc_controller()
modpost: remove incorrect code in do_eisa_entry()
9p/xen: fix release of IRQ
9p/xen: fix init sequence
block: return unsigned int from bdev_io_min
jffs2: fix use of uninitialized variable
ubi: fastmap: Fix duplicate slab cache names while attaching
ubifs: Correct the total block count by deducting journal reservation
rtc: check if __rtc_read_time was successful in rtc_timer_do_work()
NFSv4.0: Fix a use-after-free problem in the asynchronous open()
um: Fix the return value of elf_core_copy_task_fpregs
rpmsg: glink: Propagate TX failures in intentless mode as well
NFSD: Prevent a potential integer overflow
lib: string_helpers: silence snprintf() output truncation warning
usb: dwc3: gadget: Fix checking for number of TRBs left
media: wl128x: Fix atomicity violation in fmc_send_cmd()
...
Change-Id: If54aa57568cf7d234b4458495ae863dcc1903d63
https://source.android.com/docs/security/bulletin/2025-01-01
* tag 'ASB-2025-01-05_4.19-stable' of https://android.googlesource.com/kernel/common: (132 commits)
Revert "UPSTREAM: unicode: Don't special case ignorable code points"
Reapply "UPSTREAM: unicode: Don't special case ignorable code points"
Revert "UPSTREAM: unicode: Don't special case ignorable code points"
Linux 4.19.325
sh: intc: Fix use-after-free bug in register_intc_controller()
modpost: remove incorrect code in do_eisa_entry()
9p/xen: fix release of IRQ
9p/xen: fix init sequence
block: return unsigned int from bdev_io_min
jffs2: fix use of uninitialized variable
ubi: fastmap: Fix duplicate slab cache names while attaching
ubifs: Correct the total block count by deducting journal reservation
rtc: check if __rtc_read_time was successful in rtc_timer_do_work()
NFSv4.0: Fix a use-after-free problem in the asynchronous open()
um: Fix the return value of elf_core_copy_task_fpregs
rpmsg: glink: Propagate TX failures in intentless mode as well
NFSD: Prevent a potential integer overflow
lib: string_helpers: silence snprintf() output truncation warning
usb: dwc3: gadget: Fix checking for number of TRBs left
media: wl128x: Fix atomicity violation in fmc_send_cmd()
...
Conflicts:
arch/arm64/boot/dts/vendor/bindings/clock/adi,axi-clkgen.yaml
arch/arm64/boot/dts/vendor/bindings/clock/axi-clkgen.txt
drivers/rpmsg/qcom_glink_native.c
Change-Id: Iea6ddf20dfaa4419f6e0b2efcee1890bfa8e2554
Decrement and check the ref count of map
inside the lock. Otherwise, two threads may
free the same map.
Change-Id: I081b937bfd3e8da3e2480f062cad6966662994b5
Acked-by: Sharad Kumar <sharku@qti.qualcomm.com>
Signed-off-by: Abhinav Parihar <quic_parihar@quicinc.com>
There is possibility that network will be used after free.
This change is to fix this issue.
Change-Id: I39aa81ddc4a7d1801b2f7157aa21f0051ff2d5a5
Signed-off-by: Gao Wang <quic_gaowang@quicinc.com>
(cherry picked from commit c29b693900)
There is possibility that network will be used after free.
This change is to fix this issue.
Change-Id: I39aa81ddc4a7d1801b2f7157aa21f0051ff2d5a5
Signed-off-by: Gao Wang <quic_gaowang@quicinc.com>
* sm8250/lineage-20:
arm64: vdso32: require CROSS_COMPILE_COMPAT for gcc+bfd
of: restore old handling of cells_name=NULL in of_*_phandle_with_args()
of: Let of_for_each_phandle fallback to non-negative cell_count
msm: eva: put kref after processing deprecated message
nl80211: add WPA3 definition for SAE authentication
Linux 4.19.324
9p: fix slab cache name creation for real
net: usb: qmi_wwan: add Fibocom FG132 0x0112 composition
fs: Fix uninitialized value issue in from_kuid and from_kgid
powerpc/powernv: Free name on error in opal_event_init()
sound: Make CONFIG_SND depend on INDIRECT_IOMEM instead of UML
bpf: use kvzmalloc to allocate BPF verifier environment
HID: multitouch: Add quirk for HONOR MagicBook Art 14 touchpad
9p: Avoid creating multiple slab caches with the same name
ALSA: usb-audio: Add endianness annotations
vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans
hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer
ALSA: usb-audio: Add quirks for Dell WD19 dock
ALSA: usb-audio: Support jack detection on Dell dock
ALSA: usb-audio: Add custom mixer status quirks for RME CC devices
...
Change-Id: Ifdb726aa81a94924d85fcac089475157a9d81a16
commit 3e6f8d1fa18457d54b20917bd9174d27daf09ab9 upstream.
Similar to
commit 231ad7f409f1 ("Makefile: infer --target from ARCH for CC=clang")
There really is no point in setting --target based on
$CROSS_COMPILE_COMPAT for clang when the integrated assembler is being
used, since
commit ef94340583ee ("arm64: vdso32: drop -no-integrated-as flag").
Allows COMPAT_VDSO to be selected without setting $CROSS_COMPILE_COMPAT
when using clang and lld together.
Before:
$ ARCH=arm64 CROSS_COMPILE_COMPAT=arm-linux-gnueabi- make -j72 LLVM=1 defconfig
$ grep CONFIG_COMPAT_VDSO .config
CONFIG_COMPAT_VDSO=y
$ ARCH=arm64 make -j72 LLVM=1 defconfig
$ grep CONFIG_COMPAT_VDSO .config
$
After:
$ ARCH=arm64 CROSS_COMPILE_COMPAT=arm-linux-gnueabi- make -j72 LLVM=1 defconfig
$ grep CONFIG_COMPAT_VDSO .config
CONFIG_COMPAT_VDSO=y
$ ARCH=arm64 make -j72 LLVM=1 defconfig
$ grep CONFIG_COMPAT_VDSO .config
CONFIG_COMPAT_VDSO=y
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
Suggested-by: Nathan Chancellor <nathan@kernel.org>
Tested-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
Link: https://lore.kernel.org/r/20211019223646.1146945-5-ndesaulniers@google.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: I91e4f7a6944819e9ec0dffc0f19da5436d62fec3
Before commit e42ee61017f5 ("of: Let of_for_each_phandle fallback to
non-negative cell_count") the iterator functions calling
of_for_each_phandle assumed a cell count of 0 if cells_name was NULL.
This corner case was missed when implementing the fallback logic in
e42ee61017f5 and resulted in an endless loop.
Restore the old behaviour of of_count_phandle_with_args() and
of_parse_phandle_with_args() and add a check to
of_phandle_iterator_init() to prevent a similar failure as a safety
precaution. of_parse_phandle_with_args_map() doesn't need a similar fix
as cells_name isn't NULL there.
Affected drivers are:
- drivers/base/power/domain.c
- drivers/base/power/domain.c
- drivers/clk/ti/clk-dra7-atl.c
- drivers/hwmon/ibmpowernv.c
- drivers/i2c/muxes/i2c-demux-pinctrl.c
- drivers/iommu/mtk_iommu.c
- drivers/net/ethernet/freescale/fman/mac.c
- drivers/opp/of.c
- drivers/perf/arm_dsu_pmu.c
- drivers/regulator/of_regulator.c
- drivers/remoteproc/imx_rproc.c
- drivers/soc/rockchip/pm_domains.c
- sound/soc/fsl/imx-audmix.c
- sound/soc/fsl/imx-audmix.c
- sound/soc/meson/axg-card.c
- sound/soc/samsung/tm2_wm5110.c
- sound/soc/samsung/tm2_wm5110.c
Thanks to Geert Uytterhoeven for reporting the issue, Peter Rosin for
helping pinpoint the actual problem and the testers for confirming this
fix.
Fixes: e42ee61017f5 ("of: Let of_for_each_phandle fallback to non-negative cell_count")
Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
Change-Id: I684efc01df23ea32c578c1da4f8ea6fcf6f03ced
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Rob Herring <robh@kernel.org>
Referencing device tree nodes from a property allows to pass arguments.
This is for example used for referencing gpios. This looks as follows:
gpio_ctrl: gpio-controller {
#gpio-cells = <2>
...
}
someothernode {
gpios = <&gpio_ctrl 5 0 &gpio_ctrl 3 0>;
...
}
To know the number of arguments this must be either fixed, or the
referenced node is checked for a $cells_name (here: "#gpio-cells")
property and with this information the start of the second reference can
be determined.
Currently regulators are referenced with no additional arguments. To
allow some optional arguments without having to change all referenced
nodes this change introduces a way to specify a default cell_count. So
when a phandle is parsed we check for the $cells_name property and use
it as before if present. If it is not present we fall back to
cells_count if non-negative and only fail if cells_count is smaller than
zero.
Change-Id: Ic7a6a5e667d46847becb2a9593a00ba6db49fc98
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Rob Herring <robh@kernel.org>
https://source.android.com/docs/security/bulletin/2024-12-01
* tag 'ASB-2024-12-05_4.19-stable' of https://android.googlesource.com/kernel/common: (401 commits)
Linux 4.19.324
9p: fix slab cache name creation for real
net: usb: qmi_wwan: add Fibocom FG132 0x0112 composition
fs: Fix uninitialized value issue in from_kuid and from_kgid
powerpc/powernv: Free name on error in opal_event_init()
sound: Make CONFIG_SND depend on INDIRECT_IOMEM instead of UML
bpf: use kvzmalloc to allocate BPF verifier environment
HID: multitouch: Add quirk for HONOR MagicBook Art 14 touchpad
9p: Avoid creating multiple slab caches with the same name
ALSA: usb-audio: Add endianness annotations
vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans
hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer
ALSA: usb-audio: Add quirks for Dell WD19 dock
ALSA: usb-audio: Support jack detection on Dell dock
ALSA: usb-audio: Add custom mixer status quirks for RME CC devices
ALSA: pcm: Return 0 when size < start_threshold in capture
ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove()
irqchip/gic-v3: Force propagation of the active state with a read-back
USB: serial: option: add Quectel RG650V
USB: serial: option: add Fibocom FG132 0x0112 composition
...
Conflicts:
drivers/usb/dwc3/core.c
drivers/usb/dwc3/core.h
net/qrtr/qrtr.c
Change-Id: I328847813eb875d25c4aa35dcc7ba58ad09b53ae
Michael Bestas