version 4.19.325-cip132
* tag 'v4.19.325-cip132' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip:
CIP: Bump version suffix to -cip132 after merge from cip/linux-4.19.y-st tree
Update localversion-st, tree is up-to-date with 5.10.254.
x86/CPU: Fix FPDSS on Zen1
seg6: separate dst_cache for input and output paths in seg6 lwtunnel
netfilter: nft_ct: fix use-after-free in timeout object destroy
apparmor: fix differential encoding verification
apparmor: fix missing bounds check on DEFAULT table in verify_dfa()
ext4: convert inline data to extents when truncate exceeds inline size
virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()
crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
crypto: authencesn - Fix src offset when decrypting in-place
crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption
crypto: authenc - use memcpy_sglist() instead of null skcipher
crypto: algif_aead - snapshot IV for async AEAD requests
crypto: algif_aead - Revert to operating out-of-place
crypto: algif_aead - use memcpy_sglist() instead of null skcipher
crypto: doc - fix kernel-doc notation in chacha.c and af_alg.c
Buffer overflow in drivers/xen/sys-hypervisor.c
xen/privcmd: fix double free via VMA splitting
crypto: algif_aead - Fix minimum RX size check for decryption
crypto: scatterwalk - Backport memcpy_sglist()
batman-adv: avoid OGM aggregation when skb tailroom is insufficient
device property: Check fwnode->secondary when finding properties
device property: Check fwnode->secondary in fwnode_graph_get_next_endpoint()
device property: Retrieve fwnode from of_node via accessor
media: device property: Return true in fwnode_device_is_available for NULL ops
ext4: fix the might_sleep() warnings in kvfree()
mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop
usb: gadget: f_hid: move list and spinlock inits from bind to alloc
net: rfkill: prevent unlimited numbers of rfkill events from being created
cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path
cpufreq: governor: Free dbs_data directly when gov->init() fails
xen/privcmd: unregister xenstore notifier on module exit
rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING)
net: stmmac: fix integer underflow in chain mode
net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure
mmc: vub300: fix NULL-deref on disconnect
net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit()
batman-adv: reject oversized global TT response buffers
arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges
arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity
wifi: brcmsmac: Fix dma_free_coherent() size
tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
apparmor: fix unprivileged local user can do privileged policy management
apparmor: Fix double free of ns_name in aa_replace_profiles()
apparmor: fix side-effect bug in match_char() macro usage
apparmor: fix: limit the number of levels of policy namespaces
apparmor: replace recursive profile removal with iterative approach
apparmor: fix memory leak in verify_header
apparmor: validate DFA start states are in bounds in unpack_pdb
mm/rmap: fix two comments related to huge_pmd_unshare()
mm/hugetlb: fix two comments related to huge_pmd_unshare()
mm/hugetlb: make detecting shared pte more reliable
Input: uinput - take event lock when submitting FF request "event"
Input: uinput - fix circular locking dependency with ff-core
xfrm_user: fix info leak in build_report()
wifi: rt2x00usb: fix devres lifetime
usb: gadget: f_uac1_legacy: validate control request size
usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer
USB: dummy-hcd: Fix locking/synchronization error
vxlan: validate ND option lengths in vxlan_na_create
comedi: me4000: Fix potential overrun of firmware buffer
comedi: me_daq: Fix potential overrun of firmware buffer
comedi: ni_atmio16d: Fix invalid clean-up after failed attach
comedi: Reinit dev->spinlock between attachments to low-level drivers
comedi: dt2815: add hardware detection to prevent crash
bridge: br_nd_send: validate ND option lengths
usb: ulpi: fix double free in ulpi_register_interface() error path
usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive
iio: gyro: mpu3050: Fix out-of-sequence free_irq()
iio: gyro: mpu3050: Move iio_device_register() to correct location
iio: gyro: mpu3050: Fix irq resource leak
iio: gyro: mpu3050: Fix incorrect free_irq() variable
Input: xpad - add support for Razer Wolverine V3 Pro
USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam
USB: serial: option: add support for Rolling Wireless RW135R-GL
USB: serial: io_edgeport: add support for Blackbox IC135A
drm/ast: dp501: Fix initialization of SCU2C
MIPS: Fix the GCC version check for `__multi3' workaround
Bluetooth: SMP: force responder MITM requirements before building the pairing response
Bluetooth: SMP: derive legacy responder STK authentication from MITM state
ALSA: ctxfi: Fix missing SPDIFI1 index handling
ALSA: caiaq: fix stack out-of-bounds read in init_card
USB: serial: option: add MeiG Smart SRM825WN
drm/ioc32: stop speculation on the drm_compat_ioctl path
media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar
Revert "media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar"
drm/vmwgfx: Add seqno waiter for sync_files
Revert "drm/vmwgfx: Add seqno waiter for sync_files"
ipv6: avoid overflows in ip6_datagram_send_ctl()
net/sched: cls_flow: fix NULL pointer dereference on shared blocks
net/sched: cls_fw: fix NULL pointer dereference on shared blocks
net/x25: Fix overflow when accumulating packets
net/x25: Fix potential double free of skb
net: macb: properly unregister fixed rate clocks
net: macb: fix clk handling on PCI glue driver removal
Bluetooth: MGMT: validate LTK enc_size on load
netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP
netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent
netfilter: nf_conntrack_helper: pass helper to expect cleanup
netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr
netfilter: x_tables: ensure names are nul-terminated
netfilter: nfnetlink_log: account for netlink header size
net: ipv6: flowlabel: defer exclusive option free until RCU teardown
bpf: Fix regsafe() for pointers to packet
net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec
ipv6: prevent possible UaF in addrconf_permanent_addr()
net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()
bridge: br_nd_send: linearize skb before parsing ND options
ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
tg3: Fix race for querying speed/duplex
net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak
crypto: af-alg - fix NULL pointer dereference in scatterwalk
HID: multitouch: Check to ensure report responses match the request
atm: lec: fix use-after-free in sock_def_readable()
HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA
dmaengine: xilinx_dma: Program interrupt delay timeout
btrfs: fix lost error when running device stats on multiple devices fs
btrfs: fix super block offset in error message in btrfs_validate_super()
dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA
dmaengine: xilinx: xilinx_dma: Fix dma_device directions
ext4: reject mount if bigalloc with s_first_data_block != 0
ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()
ext4: make recently_deleted() properly work with lazy itable initialization
scsi: ses: Handle positive SCSI error from ses_recv_diag()
scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()
alarmtimer: Fix argument order in alarm_timer_forward()
cpufreq: conservative: Reset requested_freq on limits change
s390/barrier: Make array_index_mask_nospec() __always_inline
sysctl: fix uninitialized variable in proc_do_large_bitmap
ACPICA: Allow address_space_handler Install and _REG execution as 2 separate steps
ACPICA: include/acpi/acpixf.h: Fix indentation
drm/i915/gmbus: fix spurious timeout on 512-byte burst reads
scsi: scsi_transport_sas: Fix the maximum channel scanning issue
RDMA/rw: Fall back to direct SGE on MR pool exhaustion
net: macb: use the current queue number for stats
netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp
netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD
Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop
net: fix fanout UAF in packet_release() via NETDEV_UP race
rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size
openvswitch: validate MPLS set/set_masked payload length
net: openvswitch: Avoid releasing netdev before teardown completes
pinctrl: mediatek: common: Fix probe failure for devices without EINT
Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
Bluetooth: hci_ll: Fix firmware leak on error path
Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()
af_key: validate families in pfkey_send_migrate()
xfrm: call xdo_dev_state_delete during state update
dma-buf: Include ioctl.h in UAPI header
xen/privcmd: restrict usage in unprivileged domU
i2c: fsi: Fix a potential leak in fsi_i2c_probe()
icmp: fix NULL pointer dereference in icmp_tag_validation()
nfnetlink_osf: validate individual option lengths in fingerprints
net: bonding: fix NULL deref in bond_debug_rlb_hash_show
udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n
net: macb: fix uninitialized rx_fs_lock
wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom
wifi: mac80211: fix NULL deref in mesh_matches_local()
PM: runtime: Fix a race condition related to device removal
net: bcmgenet: increase WoL poll timeout
netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
netfilter: xt_time: use unsigned int for monthday bit shift
netfilter: xt_CT: drop pending enqueued packets on template removal
netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case
netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()
netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()
netfilter: ctnetlink: remove refcounting in expectation dumpers
net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect
Bluetooth: HIDP: Fix possible UAF
Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy
Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU
Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU
staging: rtl8723bs: fix null dereference in find_network
net/tcp-md5: Fix MAC comparison to be constant-time
ALSA: pcm: fix wait_time calculations
can: gs_usb: gs_can_open(): always configure bitrates before starting device
usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling
nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation
smb: client: fix iface port assignment in parse_server_interfaces
iio: light: bh1780: fix PM runtime leak on error path
tracing: Fix syscall events activation by ensuring refcount hits zero
s390/xor: Fix xor_xc_2() inline assembly constraints
drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink
smb: client: Don't log plaintext credentials in cifs_set_cifscreds
wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()
wifi: libertas: fix use-after-free in lbs_free_adapter()
ext4: fix dirtyclusters double decrement on fs shutdown
ext4: drop extent cache when splitting extent fails
drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl()
net: Handle napi_schedule() calls from non-interrupt
drm/radeon: apply state adjust rules to some additional HAINAN vairants
serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY
Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access
net: macb: fix use-after-free access to PTP clock
nvdimm/bus: Fix potential use after free in asynchronous initialization
iio: chemical: bme680: Fix measurement wait duration calculation
iio: potentiometer: mcp4131: fix double application of wiper shift
iio: dac: ds4424: reject -128 RAW value
btrfs: abort transaction on failure to update root in the received subvol ioctl
x86/apic: Disable x2apic on resume if the kernel expects so
drm/amdgpu: Fix use-after-free race in VM acquire
net: ethernet: arc: emac: quiesce interrupts before requesting IRQ
net: ncsi: fix skb leak in error paths
parisc: Fix initial page table creation for boot
nouveau/dpcd: return EBUSY for aux xfer if the device is asleep
parisc: Increase initial mapping to 64 MB with KALLSYMS
batman-adv: Avoid double-rtnl_lock ELP metric worker
media: dvb-net: fix OOB access in ULE extension header tables
staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie
libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()
mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index()
usb: image: mdc800: kill download URB on timeout
usb: mdc800: handle signal and read racing
usb: class: cdc-wdm: fix reordering issue in read code path
USB: usbcore: Introduce usb_bulk_msg_killable()
usb: misc: uss720: properly clean up reference in uss720_probe()
usb: yurex: fix race in probe
usb: xhci: Fix memory leak in xhci_disable_slot()
usb/core/quirks: Add Huawei ME906S-device to wakeup quirk
net: usb: lan78xx: skip LTM configuration for LAN7850
net: usb: lan78xx: fix silent drop of packets with checksum errors
cgroup: fix race between task migration and iteration
e1000/e1000e: Fix leak in DMA error cleanup
i40e: fix src IP mask checks and memcpy argument names in cloud filter
nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set
sched: idle: Make skipping governor callbacks more consistent
netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()
netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path
netfilter: x_tables: guard option walkers against 1-byte tail reads
can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value
serial: caif: hold tty->link reference in ldisc_open and ser_release
net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit
powerpc: 83xx: km83xx: Fix keymile vendor prefix
remoteproc: sysmon: Correct subsys_name_len type in QMI request
powerpc/uaccess: Fix inline assembly for clang build on PPC32
scsi: ses: Fix devices attaching to different hosts
ACPI: OSI: Add DMI quirk for Acer Aspire One D255
unshare: fix unshare_fs() handling
ACPI: PM: Save NVS memory on Lenovo G70-35
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT
net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled
net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled
nfc: rawsock: cancel tx_work before socket teardown
nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback
nfc: nci: free skb on nci_transceive early error paths
net: nfc: nci: Fix zero-length proprietary notifications
amd-xgbe: fix sleep while atomic on suspend/resume
xen/acpi-processor: fix _CST detection using undersized evaluation buffer
wifi: wlcore: Fix a locking bug
can: bcm: fix locking for bcm_op runtime updates
atm: lec: fix null-ptr-deref in lec_arp_clear_vccs
platform/x86: thinkpad_acpi: Fix errors reading battery thresholds
drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock()
Squashfs: check metadata block offset is within range
wifi: radiotap: reject radiotap with unknown bits
ALSA: usb-audio: Use correct version for UAC3 header validation
can: ucan: Fix infinite loop from zero-length messages
can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message
net: usb: pegasus: validate USB endpoints
net: usb: kalmia: validate USB endpoints
net: usb: kaweth: validate USB endpoints
nfc: pn533: properly drop the usb interface reference on disconnect
media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
net: arcnet: com20020-pci: fix support for 2.5Mbit cards
ALSA: hda/conexant: Add quirk for HP ZBook Studio G4
clk: tegra: tegra124-emc: fix device leak on set_rate()
drm/tegra: dsi: fix device leak on probe
ARM: omap2: Fix reference count leaks in omap_control_init()
ARM: OMAP2+: add missing of_node_put before break and return
ARM: clean up the memset64() C wrapper
Change-Id: If58eb7898e90d049cd97232a5f2c1fc971671b1f
Thomas Turner
23ea704e18