version 4.19.325-cip134
* tag 'v4.19.325-cip134' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip:
CIP: Bump version suffix to -cip134 after merge from cip/linux-4.19.y-st tree
Update localversion-st, tree is up-to-date with 5.10.258.
tipc: fix double-free in tipc_buf_append()
slip: reject VJ receive packets on instances with no rstate array
netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check
wifi: brcmfmac: Fix error pointer dereference
bpf: fix end-of-list detection in cgroup_storage_get_next_key()
crypto: ccp - copy IV using skcipher ivsize
netfilter: ipset: stop hash:* range iteration at end
net/sched: netem: fix queue limit check to include reordered packets
cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro()
btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent()
crypto: authencesn - reject short ahash digests during instance creation
crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed
crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed
x86/uprobes: Fix XOL allocation failure for 32-bit tasks
blk-mq: use quiesced elevator switch when reinitializing queues
scsi: ufs: core: Improve SCSI abort handling
bcache: fix cached_dev.sb_bio use-after-free and crash
rxrpc: proc: size address buffers for %pISpc output
can: raw: fix ro->uniq use-after-free in raw_rcv()
can: af_can: export can_sock_destruct()
batman-adv: hold claim backbone gateways by reference
l2tp: Drop large packets with UDP encap
xsk: tighten UMEM headroom validation to account for tailroom and min frame
can: mcp251x: add error handling for power enable in open and resume
net: skbuff: propagate shared-frag marker through frag-transfer helpers
Revert "i2c: fsi: Fix a potential leak in fsi_i2c_probe()"
net: usb: lan78xx: Fix double free issue with interrupt buffer allocation
string: add mem_is_zero() helper to check if memory area is all zeros
tracing: Avoid NULL return from hist_field_name() on truncation
platform/x86: intel-hid: Check ACPI_HANDLE() against NULL
HID: quirks: really enable the intended work around for appledisplay
net: ethernet: cs89x0: remove stale CONFIG_MACH_MX31ADS reference
net: ethernet: cortina: Carry over frag counter
net: ethernet: cortina: Drop half-assembled SKB
net: ethernet: cortina: Make RX SKB per-port
irqchip/ath79-cpu: Remove unused function
ARM: integrator: Fix early initialization
batman-adv: tt: fix negative tt_buff_len
batman-adv: tt: fix negative last_changeset_len
batman-adv: tp_meter: avoid use of uninit sender vars
batman-adv: bla: fix report_work leak on backbone_gw purge
batman-adv: frag: disallow unicast fragment in fragment
batman-adv: fix tp_meter counter underflow during shutdown
batman-adv: fix fragment reassembly length accounting
batman-adv: dat: handle forward allocation error
batman-adv: clear current gateway during teardown
batman-adv: mcast: fix use-after-free in orig_node RCU release
drm/amd/display: Fix integer overflow in bios_get_image()
spi: ti-qspi: fix use-after-free after DMA setup failure
scsi: isci: Fix use-after-free in device removal path
tracing: Do not call map->ops->elt_free() if elt_alloc() fails
ixgbevf: fix use-after-free in VEPA multicast source pruning
ipv4: raw: reject IP_HDRINCL packets with ihl < 5
vsock/vmci: fix UAF when peer resets connection during handshake
netfilter: ip6t_hbh: reject oversized option lists
net: bcmgenet: keep RBUF EEE/PM disabled
phonet/pep: disable BH around forwarded sk_receive_skb()
Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths
Bluetooth: bnep: Fix UAF read of dev->name
ALSA: asihpi: Fix potential OOB array access at reading cache
ALSA: ua101: Reject too-short USB descriptors
sysfs: don't remove existing directory on update failure
smb: client: reject userspace cifs.spnego descriptions
Revert "s390/cio: Fix device lifecycle handling in css_alloc_subchannel()"
selftests: lib.mk: Also install "config" and "settings"
s390/debug: Reject zero-length input before trimming a newline
net/rds: reset op_nents when zerocopy page pin fails
drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup
libceph: Fix potential out-of-bounds access in crush_decode()
libceph: Fix potential null-ptr-deref in decode_choose_args()
powerpc/warp: Fix error handling in pika_dtm_thread
ceph: fix a buffer leak in __ceph_setxattr()
ALSA: usb-audio: Bound MIDI endpoint descriptor scans
audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV
audit: fix incorrect inheritable capability in CAPSET records
crypto: af_alg - Cap AEAD AD length to 0x80000000
btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file()
drm/amd/display: Read EDID from VBIOS embedded panel info
drm/amd/display: Allow DCE link encoder without AUX registers
net/sched: sch_cake: annotate data-races in cake_dump_stats() (V)
sctp: discard stale INIT after handshake completion
ASoC: codecs: ab8500: Fix casting of private data
NFC: trf7970a: Ignore antenna noise when checking for RF field
net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit
net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()
vrf: Fix a potential NPD when removing a port from a VRF
net/sched: sch_choke: annotate data-races in choke_dump_stats()
net: sched: choke: remove unused variables in struct choke_sched_data
net/sched: netem: validate slot configuration
net/sched: netem: fix probability gaps in 4-state loss model
net: sched: sch_netem: Refactor code in 4-state loss generator
scsi: sr: Add memory allocation failure handling for get_capabilities()
netfilter: nf_conntrack_sip: don't use simple_strtoul
netfilter: xt_policy: fix strict mode inbound policy matching
drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2)
netfilter: arp_tables: fix IEEE1394 ARP payload parsing
tracing: branch: Fix inverted check on stat tracer registration
mailbox: mailbox-test: initialize struct earlier
mailbox: mailbox-test: don't free the reused channel
mailbox: add sanity check for channel array
cgroup/rdma: fix integer overflow in rdmacg_try_charge()
mailbox: mailbox-test: free channels on probe error
fbdev: offb: fix PCI device reference leak on probe failure
net/sched: sch_sfb: annotate data-races in sfb_dump_stats()
net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats()
net_sched: sch_hhf: annotate data-races in hhf_dump_stats()
net/rds: zero per-item info buffer before handing it to visitors
slip: bound decode() reads against the compressed packet length
netfilter: nfnetlink_osf: fix out-of-bounds read on option matching
ipvs: fix MTU check for GSO packets in tunnel mode
netfilter: xtables: restrict several matches to inet family
netfilter: conntrack: remove sprintf usage
netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO
netfilter: nft_osf: restrict it to ipv4
openvswitch: cap upcall PID array size and pre-size vport replies
dissector: do not set invalid PPP protocol
sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks
ipv6: fix possible UAF in icmpv6_rcv()
e1000e: Unroll PTP in probe error handling
i40e: don't advertise IFF_SUPP_NOFCS
PCMCIA: Fix garbled log messages for KERN_CONT
clk: xgene: Fix mapping leak in xgene_pllclk_init()
clk: qoriq: avoid format string warning
clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels()
scsi: target: core: Fix integer overflow in UNMAP bounds check
scsi: sg: Resolve soft lockup issue when opening /dev/sgX
RDMA/core: Prefer NLA_NUL_STRING
nfs/blocklayout: Fix compilation error (`make W=1`) in bl_write_pagelist()
mfd: mc13xxx-core: Fix memory leak in mc13xxx_add_subdevice_pdata()
tty: hvc_iucv: fix off-by-one in number of supported devices
tty: hvc: remove HVC_IUCV_MAGIC
platform/surface: surfacepro3_button: Drop wakeup source on remove
driver core: device.h: remove extern from function prototypes
perf util: Kill die() prototype, dead for a long time
pinctrl: abx500: Fix type of 'argument' variable
pinctrl: pinctrl-pic32: Fix resource leak
bpf: Fix precedence bug in convert_bpf_ld_abs alignment check
HID: usbhid: fix deadlock in hid_post_reset()
mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob
HID: asus: do not abort probe when not necessary
HID: asus: make asus_resume adhere to linux kernel coding standards
ima: check return value of crypto_shash_final() in boot aggregate
tracing: Rebuild full_name on each hist_field_name() call
ocfs2: validate group add input before caching
ocfs2: validate bg_bits during freefrag scan
ocfs2: fix listxattr handling when the buffer is full
ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison
ocfs2/dlm: validate qr_numregions in dlm_match_regions()
memory: tegra124-emc: Fix dll_change check
ARM: dts: mediatek: mt7623: fix efuse fallback compatible
efi/capsule-loader: fix incorrect sizeof in phys array reallocation
quota: Fix race of dquot_scan_active() with quota deactivation
ktest: Honor empty per-test option overrides
ktest: Avoid undef warning when WARNINGS_FILE is unset
selftest: memcg: skip memcg_sock test if address family not supported
Documentation: fix a hugetlbfs reservation statement
ALSA: hda/realtek: fix code style (ERROR: else should follow close brace '}')
ALSA: hda/realtek: Whitespace fix
drm/amd/pm/ci: Clear EnabledForActivity field for memory levels
drm/amd/pm/ci: Fix powertune defaults for Hawaii 0x67B0
drm/amd/pm/ci: Use highest MCLK on CI when MCLK DPM is disabled
ALSA: core: Validate compress device numbers without dynamic minors
ALSA: compress: Drop unused functions
fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break
drm/sun4i: Fix resource leaks
dm log: fix out-of-bounds write due to region_count overflow
dm cache metadata: fix memory leak on metadata abort retry
dm cache: fix concurrent write failure in passthrough mode
dm cache policy smq: fix missing locks in invalidating cache blocks
dm cache: fix write path cache coherency in passthrough mode
dm cache: fix null-deref with concurrent writes in passthrough mode
ASoC: sti: use managed regmap_field allocations
ASoC: sti: Return errors from regmap_field_alloc()
Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error
Bluetooth: L2CAP: Fix printing wrong information if SDU length exceeds MTU
ppp: require CAP_NET_ADMIN in target netns for unattached ioctls
net/rds: Optimize rds_ib_laddr_check
net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf
6pack: propagage new tty types
netfilter: nft_fwd_netdev: check ttl/hl before forwarding
net: bcmgenet: fix off-by-one in bcmgenet_put_txcb
wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet
firmware: dmi: Correct an indexing error in dmi.h
locking: Fix rwlock support in <linux/spinlock_up.h>
irqchip/irq-pic32-evic: Address warning related to wrong printf() formatter
thermal/drivers/spear: Fix error condition for reading st,thermal-flags
pstore/ram: fix resource leak when ioremap() fails
nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty()
drbd: Balance RCU calls in drbd_adm_dump_devices()
fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START
Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()
batman-adv: bla: put backbone reference on failed claim hash insert
batman-adv: bla: only purge non-released claims
batman-adv: bla: prevent use-after-free when deleting claims
batman-adv: reject new tp_meter sessions during teardown
batman-adv: fix integer overflow on buff_pos
sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL
drm/amdgpu/pm: align Hawaii mclk workaround with radeon
drm/amdgpu/pm: add missing revision check for CI
drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission
drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ
drm/radeon: add missing revision check for CI
spi: mpc52xx: fix use-after-free on unbind
media: dib8000: avoid division by 0 in dib8000_set_dds()
media: rc: streamzap: Error handling in probe
media: uvcvideo: Enable VB2_DMABUF for metadata stream
RDMA/rxe: Reject unknown opcodes before ICRC processing
RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp()
power: supply: max17042: avoid overflow when determining health
PCI/AER: Stop ruling out unbound devices as error source
s390/debug: Reject zero-length input in debug_input_flush_fn()
nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free
md/raid10: fix divide-by-zero in setup_geo() with zero far_copies
isofs: validate block number from NFS file handle in isofs_export_iget
isofs: validate Rock Ridge CE continuation extent against volume size
dm-verity-fec: correctly reject too-small hash devices
dm-verity-fec: correctly reject too-small FEC devices
dm: fix a buffer overflow in ioctl processing
dm: don't report warning when doing deferred remove
cpuidle: powerpc: avoid double clear when breaking snooze
spi: topcliff-pch: fix use-after-free on unbind
udf: reject descriptors with oversized CRC length
ibmveth: Disable GSO for packets with small MSS
parisc: Fix IRQ leak in LASI driver
net/rds: handle zerocopy send cleanup before the message is queued
ip6_gre: Use cached t->net in ip6erspan_changelink().
sound: ua101: fix division by zero at probe
Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()
Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()
usb: ulpi: fix memory leak on ulpi_register() error paths
USB: serial: option: add Telit Cinterion LE910Cx compositions
USB: omap_udc: DMA: Don't enable burst 4 mode
ALSA: usb-audio: Fix UAC3 cluster descriptor size check
ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()
usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl
usb: usblp: fix heap leak in IEEE 1284 device ID via short response
wifi: b43: enforce bounds check on firmware key index in b43_rx()
wifi: ath5k: do not access array OOB
wifi: rsi: fix kthread lifetime race between self-exit and external-stop
wifi: b43legacy: enforce bounds check on firmware key index in RX path
ipmi:ssif: NULL thread on error
ipmi:ssif: Remove unnecessary indention
ipmi:ssif: Clean up kthread on errors
ipmi:ssif: Fix a shutdown race
net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked
fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free
ipmi:si: Return state to normal if message allocation fails
ipmi: Check event message buffer response for bad data
ipmi: Add limits to event and receive message requests
scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()
ALSA: caiaq: fix usb_dev refcount leak on probe failure
ALSA: caiaq: Don't abort when no input device is available
ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path
dm mirror: fix integer overflow in create_dirty_log()
crypto: atmel-tdes - fix DMA sync direction
crypto: ccree - fix a memory leak in cc_mac_digest()
crypto: hisilicon - Fix dma_unmap_single() direction
crypto: atmel-ecc - Release client on allocation failure
crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup
taskstats: set version in TGID exit notifications
inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails
md/raid5: validate payload size before accessing journal metadata
md/raid5: fix soft lockup in retry_aligned_read()
ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all()
userfaultfd: allow registration of ranges below mmap_min_addr
tpm: tpm_tis: add error logging for data transfer
mmc: block: use single block write in retry
RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv
ALSA: 6fire: Fix input volume change detection
ALSA: caiaq: Handle probe errors properly
ALSA: caiaq: Fix control_put() result and cache rollback
ALSA: seq_oss: return full count for successful SEQ_FULLSIZE writes
ALSA: ctxfi: Add fallback to default RSR for S/PDIF
lib/ts_kmp: fix integer overflow in pattern length calculation
Revert "ALSA: usb: Increase volume range that triggers a warning"
net: strparser: fix skb_head leak in strp_abort_strp()
net: caif: clear client service pointer on teardown
ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names()
crypto: pcrypt - Fix handling of MAY_BACKLOG requests
um: drivers: call kernel_strrchr() explicitly in cow_user.c
firmware: google: framebuffer: Do not mark framebuffer as busy
ibmasm: fix heap over-read in ibmasm_send_i2o_message()
ibmasm: fix OOB reads in command_file_write due to missing size checks
misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt()
ALSA: usb-audio: Fix Audio Advantage Micro II SPDIF switch
ALSA: usb-audio: Avoid false E-MU sample-rate notifications
ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES
rxrpc: Fix missing validation of ticket length in non-XDR key preparsing
ALSA: caiaq: take a reference on the USB device in create_card()
ALSA: usb-audio: apply quirk for MOONDROP JU Jiu
rxrpc: Fix anonymous key handling
scripts/dtc: Remove unused dts_version in dtc-lexer.l
gfs2: Validate i_depth for exhash directories
mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()
ocfs2: fix possible deadlock between unlink and dio_end_io_write
fs/ocfs2: fix comments mentioning i_mutex
rxrpc: reject undecryptable rxkad response tickets
ocfs2: fix out-of-bounds write in ocfs2_write_end_inline
ocfs2: validate inline data i_size during inode read
ocfs2: add inline inode consistency check to ocfs2_validate_inode_block()
xfrm: clear trailing padding in build_polexpire()
rxrpc: fix reference count leak in rxrpc_server_keyring()
mailbox: Prevent out-of-bounds access in of_mbox_index_xlate()
wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure
ipv6: add NULL checks for idev in SRv6 paths
net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null
media: hackrf: fix to not free memory after the device is registered in hackrf_probe()
nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map
media: as102: fix to not free memory after the device is registered in as102_usb_probe()
ALSA: 6fire: fix use-after-free on disconnect
media: em28xx: fix use-after-free in em28xx_v4l2_open()
mm/kasan: fix double free for kasan pXds
KVM: x86: Use scratch field in MMIO fragment to hold small write values
media: uvcvideo: Allow extra entities
Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave"
rxrpc: Fix call removal to use RCU safe deletion
ACPI: property: Constify stubs for CONFIG_ACPI=n case
ocfs2: handle invalid dinode in ocfs2_group_extend
ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY
ALSA: ctxfi: Limit PTP to a single page
USB: serial: option: add Telit Cinterion FN990A MBIM composition
fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
usb: storage: Expand range of matched versions for VL817 quirks entry
usbip: validate number_of_packets in usbip_pack_ret_submit()
usb: gadget: renesas_usb3: validate endpoint index in standard request handlers
usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete()
usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()
fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
ALSA: fireworks: bound device-supplied status before string array lookup
NFC: digital: Bounds check NFC-A cascade depth in SDD response handler
net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()
HID: core: clamp report_size in s32ton() to avoid undefined shift
HID: alps: fix NULL pointer dereference in alps_raw_event()
staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify()
i2c: s3c24xx: check the size of the SMBUS message before using it
nfc: llcp: add missing return after LLCP_CLOSED checks
MIPS: mm: Suppress TLB uniquification on EHINV hardware
af_unix: read UNIX_DIAG_VFS data under unix_state_lock
netfilter: ip6t_eui64: reject invalid MAC header for all packets
netfilter: xt_multiport: validate range encoding in checkentry
netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator
xfrm_user: fix info leak in build_mapping()
e1000: check return value of e1000_read_eeprom
net: lapbether: replace comparison to NULL with "lapbeth_get_x25_dev"
net: lapbether: Close the LAPB device before its underlying Ethernet device closes
net: sched: act_csum: validate nested VLAN headers
drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock
drm/vc4: Fix a memory leak in hang state error path
drm/vc4: Fix memory leak of BO array in hang state
ASoC: stm32_sai: fix incorrect BCLK polarity for DSP_A/B, LEFT_J
wifi: brcmfmac: validate bsscfg indices in IF events
ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585
HID: roccat: fix use-after-free in roccat_report_event
HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3
wifi: wl1251: validate packet IDs before indexing tx_frames
btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file()
ALSA: asihpi: avoid write overflow check warning
net: skbuff: preserve shared-frag marker during coalescing
Change-Id: I535ecdb1a77312a12564125fedb9f99b3a5533d1
Thomas Turner
b49f61e801