https://source.android.com/docs/security/bulletin/2022-09-01
CVE-2022-20399
CVE-2022-23960
CVE-2021-4083
CVE-2022-29582
* tag 'ASB-2022-09-05_4.19-stable' of https://android.googlesource.com/kernel/common:
Linux 4.19.255
x86/speculation: Add LFENCE to RSB fill sequence
x86/speculation: Add RSB VM Exit protections
macintosh/adb: fix oob read in do_adb_query() function
ACPI: video: Shortening quirk list by identifying Clevo by board_name only
ACPI: video: Force backlight native for some TongFang devices
scsi: core: Fix race between handling STS_RESOURCE and completion
mt7601u: add USB device ID for some versions of XiaoDu WiFi Dongle.
ARM: crypto: comment out gcc warning that breaks clang builds
perf symbol: Correct address for bss symbols
netfilter: nf_queue: do not allow packet truncation below transport header offset
sctp: fix sleep in atomic context bug in timer handlers
i40e: Fix interface init with MSI interrupts (no MSI-X)
tcp: Fix a data-race around sysctl_tcp_comp_sack_nr.
tcp: Fix a data-race around sysctl_tcp_comp_sack_delay_ns.
Documentation: fix sctp_wmem in ip-sysctl.rst
tcp: Fix a data-race around sysctl_tcp_invalid_ratelimit.
tcp: Fix a data-race around sysctl_tcp_autocorking.
tcp: Fix a data-race around sysctl_tcp_min_rtt_wlen.
tcp: Fix a data-race around sysctl_tcp_min_tso_segs.
net: sungem_phy: Add of_node_put() for reference returned by of_get_parent()
igmp: Fix data-races around sysctl_igmp_qrv.
net: ping6: Fix memleak in ipv6_renew_options().
tcp: Fix a data-race around sysctl_tcp_challenge_ack_limit.
scsi: ufs: host: Hold reference returned by of_parse_phandle()
tcp: Fix a data-race around sysctl_tcp_nometrics_save.
tcp: Fix a data-race around sysctl_tcp_frto.
tcp: Fix a data-race around sysctl_tcp_adv_win_scale.
tcp: Fix a data-race around sysctl_tcp_app_win.
tcp: Fix data-races around sysctl_tcp_dsack.
s390/archrandom: prevent CPACF trng invocations in interrupt context
ntfs: fix use-after-free in ntfs_ucsncmp()
Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put
FROMLIST: binder: fix UAF of ref->proc caused by race condition
Linux 4.19.254
PCI: hv: Fix interrupt mapping for multi-MSI
PCI: hv: Reuse existing IRTE allocation in compose_msi_msg()
PCI: hv: Fix hv_arch_irq_unmask() for multi-MSI
PCI: hv: Fix multi-MSI to allow more than one MSI vector
net: usb: ax88179_178a needs FLAG_SEND_ZLP
tty: use new tty_insert_flip_string_and_push_buffer() in pty_write()
tty: extract tty_flip_buffer_commit() from tty_flip_buffer_push()
tty: drop tty_schedule_flip()
tty: the rest, stop using tty_schedule_flip()
tty: drivers/tty/, stop using tty_schedule_flip()
serial: mvebu-uart: correctly report configured baudrate value
Bluetooth: Fix bt_skb_sendmmsg not allocating partial chunks
Bluetooth: SCO: Fix sco_send_frame returning skb->len
Bluetooth: Fix passing NULL to PTR_ERR
Bluetooth: RFCOMM: Replace use of memcpy_from_msg with bt_skb_sendmmsg
Bluetooth: SCO: Replace use of memcpy_from_msg with bt_skb_sendmsg
Bluetooth: Add bt_skb_sendmmsg helper
Bluetooth: Add bt_skb_sendmsg helper
ALSA: memalloc: Align buffer allocations in page size
ima: remove the IMA_TEMPLATE Kconfig option
dlm: fix pending remove if msg allocation fails
HID: add ALWAYS_POLL quirk to lenovo pixart mouse
HID: multitouch: add support for the Smart Tech panel
HID: multitouch: Lenovo X1 Tablet Gen3 trackpoint and buttons
HID: multitouch: simplify the application retrieval
tilcdc: tilcdc_external: fix an incorrect NULL check on list iterator
drm/tilcdc: Remove obsolete crtc_mode_valid() hack
bpf: Make sure mac_header was set before using it
mm/mempolicy: fix uninit-value in mpol_rebind_policy()
Revert "Revert "char/random: silence a lockdep splat with printk()""
tcp: Fix data-races around sysctl_tcp_max_reordering.
tcp: Fix a data-race around sysctl_tcp_rfc1337.
tcp: Fix a data-race around sysctl_tcp_stdurg.
tcp: Fix a data-race around sysctl_tcp_retrans_collapse.
tcp: Fix data-races around sysctl_tcp_slow_start_after_idle.
tcp: Fix a data-race around sysctl_tcp_thin_linear_timeouts.
tcp: Fix data-races around sysctl_tcp_recovery.
tcp: Fix a data-race around sysctl_tcp_early_retrans.
be2net: Fix buffer overflow in be_get_module_eeprom
tcp: Fix data-races around sysctl_tcp_fastopen.
tcp: Fix a data-race around sysctl_tcp_tw_reuse.
tcp: Fix a data-race around sysctl_tcp_notsent_lowat.
tcp: Fix data-races around some timeout sysctl knobs.
tcp: Fix data-races around sysctl_tcp_reordering.
igmp: Fix a data-race around sysctl_igmp_max_memberships.
igmp: Fix data-races around sysctl_igmp_llm_reports.
net/tls: Fix race in TLS device down flow
net: stmmac: fix dma queue left shift overflow issue
i2c: cadence: Change large transfer count reset logic to be unconditional
tcp: Fix a data-race around sysctl_tcp_probe_interval.
tcp: Fix a data-race around sysctl_tcp_probe_threshold.
tcp: Fix data-races around sysctl_tcp_mtu_probing.
tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept.
ip: Fix a data-race around sysctl_fwmark_reflect.
ip: Fix data-races around sysctl_ip_nonlocal_bind.
ip: Fix data-races around sysctl_ip_fwd_use_pmtu.
perf/core: Fix data race between perf_event_set_output() and perf_mmap_close()
pinctrl: ralink: Check for null return of devm_kcalloc
power/reset: arm-versatile: Fix refcount leak in versatile_reboot_probe
xfrm: xfrm_policy: fix a possible double xfrm_pols_put() in xfrm_bundle_lookup()
xen/gntdev: Ignore failure to unmap INVALID_GRANT_HANDLE
riscv: add as-options for modules with assembly compontents
Revert "cgroup: Use separate src/dst nodes when preloading css_sets for migration"
Linux 4.19.253
can: m_can: m_can_tx_handler(): fix use after free of skb
serial: pl011: UPSTAT_AUTORTS requires .throttle/unthrottle
serial: stm32: Clear prev values before setting RTS delays
serial: 8250: fix return error code in serial8250_request_std_resource()
tty: serial: samsung_tty: set dma burst_size to 1
usb: dwc3: gadget: Fix event pending check
usb: typec: add missing uevent when partner support PD
USB: serial: ftdi_sio: add Belimo device ids
signal handling: don't use BUG_ON() for debugging
ARM: dts: stm32: use the correct clock source for CEC on stm32mp151
x86: Clear .brk area at early boot
irqchip: or1k-pic: Undefine mask_ack for level triggered hardware
ASoC: wm5110: Fix DRE control
ASoC: ops: Fix off by one in range control validation
net: sfp: fix memory leak in sfp_probe()
NFC: nxp-nci: don't print header length mismatch on i2c error
net: tipc: fix possible refcount leak in tipc_sk_create()
platform/x86: hp-wmi: Ignore Sanitization Mode event
cpufreq: pmac32-cpufreq: Fix refcount leak bug
netfilter: br_netfilter: do not skip all hooks with 0 priority
virtio_mmio: Restore guest page size on resume
virtio_mmio: Add missing PM calls to freeze/restore
sfc: fix kernel panic when creating VF
seg6: bpf: fix skb checksum in bpf_push_seg6_encap()
seg6: fix skb checksum in SRv6 End.B6 and End.B6.Encaps behaviors
seg6: fix skb checksum evaluation in SRH encapsulation/insertion
sfc: fix use after free when disabling sriov
ipv4: Fix data-races around sysctl_ip_dynaddr.
icmp: Fix a data-race around sysctl_icmp_ratemask.
icmp: Fix a data-race around sysctl_icmp_ratelimit.
ARM: dts: sunxi: Fix SPI NOR campatible on Orange Pi Zero
icmp: Fix data-races around sysctl.
cipso: Fix data-races around sysctl.
net: Fix data-races around sysctl_mem.
inetpeer: Fix data-races around sysctl.
ASoC: sgtl5000: Fix noise on shutdown/remove
ARM: 9209/1: Spectre-BHB: avoid pr_info() every time a CPU comes out of idle
ARM: dts: imx6qdl-ts7970: Fix ngpio typo and count
nilfs2: fix incorrect masking of permission flags for symlinks
cgroup: Use separate src/dst nodes when preloading css_sets for migration
ARM: 9214/1: alignment: advance IT state after emulating Thumb instruction
ARM: 9213/1: Print message about disabled Spectre workarounds only once
net: sock: tracing: Fix sock_exceed_buf_limit not to dereference stale pointer
tracing/histograms: Fix memory leak problem
xen/netback: avoid entering xenvif_rx_next_skb() with an empty rx queue
ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc221
ALSA: hda/conexant: Apply quirk for another HP ProDesk 600 G3 model
ALSA: hda - Add fixup for Dell Latitidue E5430
Change-Id: I2ea45f6f13cf904894563522f1bb35830dd0bf9e
ee48262ac6