Merge 4.19.324 into android-4.19-stable

Changes in 4.19.324
	arm64: dts: rockchip: Fix rt5651 compatible value on rk3399-sapphire-excavator
	ARM: dts: rockchip: fix rk3036 acodec node
	ARM: dts: rockchip: drop grf reference from rk3036 hdmi
	ARM: dts: rockchip: Fix the realtek audio codec on rk3036-kylin
	HID: core: zero-initialize the report buffer
	security/keys: fix slab-out-of-bounds in key_task_permission
	sctp: properly validate chunk size in sctp_sf_ootb()
	can: c_can: fix {rx,tx}_errors statistics
	net: hns3: fix kernel crash when uninstalling driver
	media: stb0899_algo: initialize cfr before using it
	media: dvbdev: prevent the risk of out of memory access
	media: dvb_frontend: don't play tricks with underflow values
	media: adv7604: prevent underflow condition when reporting colorspace
	ALSA: firewire-lib: fix return value on fail in amdtp_tscm_init()
	media: s5p-jpeg: prevent buffer overflows
	media: cx24116: prevent overflows on SNR calculus
	media: v4l2-tpg: prevent the risk of a division by zero
	drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()
	drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported
	dm cache: correct the number of origin blocks to match the target length
	dm cache: fix out-of-bounds access to the dirty bitset when resizing
	dm cache: optimize dirty bit checking with find_next_bit when resizing
	dm cache: fix potential out-of-bounds access on the first resume
	dm-unstriped: cast an operand to sector_t to prevent potential uint32_t overflow
	nfs: Fix KMSAN warning in decode_getfattr_attrs()
	btrfs: reinitialize delayed ref list after deleting it from the list
	bonding (gcc13): synchronize bond_{a,t}lb_xmit() types
	net: bridge: xmit: make sure we have at least eth header len bytes
	media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format
	fs/proc: fix compile warning about variable 'vmcore_mmap_ops'
	usb: musb: sunxi: Fix accessing an released usb phy
	USB: serial: io_edgeport: fix use after free in debug printk
	USB: serial: qcserial: add support for Sierra Wireless EM86xx
	USB: serial: option: add Fibocom FG132 0x0112 composition
	USB: serial: option: add Quectel RG650V
	irqchip/gic-v3: Force propagation of the active state with a read-back
	ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove()
	ALSA: pcm: Return 0 when size < start_threshold in capture
	ALSA: usb-audio: Add custom mixer status quirks for RME CC devices
	ALSA: usb-audio: Support jack detection on Dell dock
	ALSA: usb-audio: Add quirks for Dell WD19 dock
	hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer
	vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans
	ALSA: usb-audio: Add endianness annotations
	9p: Avoid creating multiple slab caches with the same name
	HID: multitouch: Add quirk for HONOR MagicBook Art 14 touchpad
	bpf: use kvzmalloc to allocate BPF verifier environment
	sound: Make CONFIG_SND depend on INDIRECT_IOMEM instead of UML
	powerpc/powernv: Free name on error in opal_event_init()
	fs: Fix uninitialized value issue in from_kuid and from_kgid
	net: usb: qmi_wwan: add Fibocom FG132 0x0112 composition
	9p: fix slab cache name creation for real
	Linux 4.19.324

Change-Id: Ib8e7c89304d2c2cc72aea03446ea40a8704b41ec
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

Author: gregkh

Makefile

@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 4
 PATCHLEVEL = 19
-SUBLEVEL = 323
+SUBLEVEL = 324
 EXTRAVERSION =
 NAME = "People's Front"
 

arch/arm/boot/dts/rk3036-kylin.dts

@@ -300,8 +300,8 @@
 &i2c2 {
 	status = "okay";
 
-	rt5616: rt5616@1b {
-		compatible = "rt5616";
+	rt5616: audio-codec@1b {
+		compatible = "realtek,rt5616";
 		reg = <0x1b>;
 		clocks = <&cru SCLK_I2S_OUT>;
 		clock-names = "mclk";

arch/arm/boot/dts/rk3036.dtsi

@@ -316,12 +316,13 @@
 		};
 	};
 
-	acodec: acodec-ana@20030000 {
-		compatible = "rk3036-codec";
+	acodec: audio-codec@20030000 {
+		compatible = "rockchip,rk3036-codec";
 		reg = <0x20030000 0x4000>;
-		rockchip,grf = <&grf>;
 		clock-names = "acodec_pclk";
 		clocks = <&cru PCLK_ACODEC>;
+		rockchip,grf = <&grf>;
+		#sound-dai-cells = <0>;
 		status = "disabled";
 	};
 
@@ -331,7 +332,6 @@
 		interrupts = <GIC_SPI 45 IRQ_TYPE_LEVEL_HIGH>;
 		clocks = <&cru  PCLK_HDMI>;
 		clock-names = "pclk";
-		rockchip,grf = <&grf>;
 		pinctrl-names = "default";
 		pinctrl-0 = <&hdmi_ctl>;
 		status = "disabled";

arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts

@@ -123,7 +123,7 @@
 	status = "okay";
 
 	rt5651: rt5651@1a {
-		compatible = "rockchip,rt5651";
+		compatible = "realtek,rt5651";
 		reg = <0x1a>;
 		clocks = <&cru SCLK_I2S_8CH_OUT>;
 		clock-names = "mclk";

arch/powerpc/platforms/powernv/opal-irqchip.c

@@ -289,6 +289,7 @@ int __init opal_event_init(void)
 				 name, NULL);
 		if (rc) {
 			pr_warn("Error %d requesting OPAL irq %d\n", rc, (int)r->start);
+			kfree(name);
 			continue;
 		}
 	}

drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c

@@ -115,8 +115,8 @@ static union acpi_object *amdgpu_atif_call(struct amdgpu_atif *atif,
 				      &buffer);
 	obj = (union acpi_object *)buffer.pointer;
 
-	/* Fail if calling the method fails and ATIF is supported */
-	if (ACPI_FAILURE(status) && status != AE_NOT_FOUND) {
+	/* Fail if calling the method fails */
+	if (ACPI_FAILURE(status)) {
 		DRM_DEBUG_DRIVER("failed to evaluate ATIF got %s\n",
 				 acpi_format_exception(status));
 		kfree(obj);

drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c

@@ -394,7 +394,7 @@ static ssize_t amdgpu_debugfs_regs_smc_read(struct file *f, char __user *buf,
 	if (!adev->smc_rreg)
 		return -EOPNOTSUPP;
 
-	if (size & 0x3 || *pos & 0x3)
+	if (size > 4096 || size & 0x3 || *pos & 0x3)
 		return -EINVAL;
 
 	while (size) {

drivers/hid/hid-core.c

@@ -1482,7 +1482,7 @@ u8 *hid_alloc_report_buf(struct hid_report *report, gfp_t flags)
 
 	u32 len = hid_report_len(report) + 7;
 
-	return kmalloc(len, flags);
+	return kzalloc(len, flags);
 }
 EXPORT_SYMBOL_GPL(hid_alloc_report_buf);
 

drivers/hid/hid-multitouch.c

@@ -1986,6 +1986,11 @@ static const struct hid_device_id mt_devices[] = {
 		HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8,
 			0x347d, 0x7853) },
 
+	/* HONOR MagicBook Art 14 touchpad */
+	{ .driver_data = MT_CLS_VTL,
+		HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8,
+			0x35cc, 0x0104) },
+
 	/* Ilitek dual touch panel */
 	{  .driver_data = MT_CLS_NSMU,
 		MT_USB_DEVICE(USB_VENDOR_ID_ILITEK,

drivers/irqchip/irq-gic-v3.c

@@ -254,6 +254,13 @@ static int gic_irq_set_irqchip_state(struct irq_data *d,
 	}
 
 	gic_poke_irq(d, reg);
+
+	/*
+	 * Force read-back to guarantee that the active state has taken
+	 * effect, and won't race with a guest-driven deactivation.
+	 */
+	if (reg == GICD_ISACTIVER)
+		gic_peek_irq(d, reg);
 	return 0;
 }