From: Greg Kroah-Hartman Date: Wed, 5 Jan 2022 12:21:43 +0000 (+0100) Subject: Merge 4.14.261 into android-4.14-q X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=c718692d400817a0175db9e8a078c482f88c1271;p=GitHub%2FLineageOS%2Fandroid_kernel_motorola_exynos9610.git Merge 4.14.261 into android-4.14-q Changes in 4.14.261 HID: asus: Add depends on USB_HID to HID_ASUS Kconfig option tee: handle lookup of shm with reference count 0 platform/x86: apple-gmux: use resource_size() with res recordmcount.pl: fix typo in s390 mcount regex selinux: initialize proto variable in selinux_ip_postroute_compat() scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write() net: usb: pegasus: Do not drop long Ethernet frames NFC: st21nfca: Fix memory leak in device probe and remove fsl/fman: Fix missing put_device() call in fman_port_probe nfc: uapi: use kernel size_t to fix user-space builds uapi: fix linux/nfc.h userspace compilation errors xhci: Fresco FL1100 controller should not have BROKEN_MSI quirk set. usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear. binder: fix async_free_space accounting for empty parcels scsi: vmw_pvscsi: Set residual data length conditionally Input: appletouch - initialize work before device registration Input: spaceball - fix parsing of movement data packets net: fix use-after-free in tw_timer_handler sctp: use call_rcu to free endpoint Linux 4.14.261 Signed-off-by: Greg Kroah-Hartman Change-Id: Ie15afb0abcf6e093e40fa70eaea6a2f65d9031cb --- c718692d400817a0175db9e8a078c482f88c1271 diff --cc drivers/android/binder_alloc.c index 1b5a131278bc,1687368ea71f..c508156843e5 --- a/drivers/android/binder_alloc.c +++ b/drivers/android/binder_alloc.c @@@ -609,11 -615,11 +609,11 @@@ static void binder_free_buf_locked(stru BUG_ON(buffer->free); BUG_ON(size > buffer_size); BUG_ON(buffer->transaction != NULL); - BUG_ON(buffer->data < alloc->buffer); - BUG_ON(buffer->data > alloc->buffer + alloc->buffer_size); + BUG_ON(buffer->user_data < alloc->buffer); + BUG_ON(buffer->user_data > alloc->buffer + alloc->buffer_size); if (buffer->async_transaction) { - alloc->free_async_space += size + sizeof(struct binder_buffer); + alloc->free_async_space += buffer_size + sizeof(struct binder_buffer); binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC, "%d: binder_free_buf size %zd async free %zd\n",