https://source.android.com/docs/security/bulletin/2023-02-01
CVE-2022-39189
CVE-2022-39842
CVE-2022-41222
CVE-2023-20937
CVE-2023-20938
CVE-2022-0850
Merge 4.14.305 into android-4.14
Changes in 4.14.305
ARM: dts: imx6qdl-gw560x: Remove incorrect 'uart-has-rtscts'
HID: intel_ish-hid: Add check for ishtp_dma_tx_map
EDAC/highbank: Fix memory leak in highbank_mc_probe()
tomoyo: fix broken dependency on *.conf.default
IB/hfi1: Reject a zero-length user expected buffer
IB/hfi1: Reserve user expected TIDs
affs: initialize fsdata in affs_truncate()
amd-xgbe: TX Flow Ctrl Registers are h/w ver dependent
phy: rockchip-inno-usb2: Fix missing clk_disable_unprepare() in rockchip_usb2phy_power_on()
net: nfc: Fix use-after-free in local_cleanup()
wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid
net: usb: sr9700: Handle negative len
net: mdio: validate parameter addr in mdiobus_get_phy()
HID: check empty report_list in hid_validate_values()
usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
usb: gadget: f_fs: Ensure ep0req is dequeued before free_request
net: mlx5: eliminate anonymous module_init & module_exit
dmaengine: Fix double increment of client_count in dma_chan_get()
HID: betop: check shape of output reports
w1: fix deadloop in __w1_remove_master_device()
w1: fix WARNING after calling w1_process()
comedi: adv_pci1760: Fix PWM instruction handling
fs: reiserfs: remove useless new_opts in reiserfs_remount
Bluetooth: hci_sync: cancel cmd_timer if hci_open failed
scsi: hpsa: Fix allocation size for scsi_host_alloc()
module: Don't wait for GOING modules
tracing: Make sure trace_printk() can output as soon as it can be used
ARM: 9280/1: mm: fix warning on phys_addr_t to void pointer assignment
EDAC/device: Respect any driver-supplied workqueue polling value
netlink: annotate data races around dst_portid and dst_group
netlink: annotate data races around sk_state
netfilter: conntrack: fix vtag checks for ABORT/SHUTDOWN_COMPLETE
netrom: Fix use-after-free of a listening socket.
sctp: fail if no bound addresses can be used for a given scope
net: ravb: Fix possible hang if RIS2_QFF1 happen
net/tg3: resolve deadlock in tg3_reset_task() during EEH
Revert "Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode"
x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL
wifi: brcmfmac: fix up incorrect 4.14.y backport for brcmf_fw_map_chip_to_name()
xen: Fix up build warning with xen_init_time_ops() reference
drm/radeon/dp: make radeon_dp_get_dp_link_config static
scsi: qla2xxx: don't break the bsg-lib abstractions
x86/asm: Fix an assembler warning with current binutils
x86/entry/64: Add instruction suffix to SYSRET
sysctl: add a new register_sysctl_init() interface
panic: unset panic_on_warn inside panic()
exit: Add and use make_task_dead.
objtool: Add a missing comma to avoid string concatenation
hexagon: Fix function name in die()
h8300: Fix build errors from do_exit() to make_task_dead() transition
ia64: make IA64_MCA_RECOVERY bool instead of tristate
exit: Put an upper limit on how often we can oops
exit: Expose "oops_count" to sysfs
exit: Allow oops_limit to be disabled
panic: Consolidate open-coded panic_on_warn checks
panic: Introduce warn_limit
panic: Expose "warn_count" to sysfs
docs: Fix path paste-o for /sys/kernel/warn_count
exit: Use READ_ONCE() for all oops/warn limit reads
mm: kvmalloc does not fallback to vmalloc for incompatible gfp flags
ipv6: ensure sane device mtu in tunnels
usb: host: xhci-plat: add wakeup entry at sysfs
Linux 4.14.305
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I63d98b772289d5417008eec559caf16812d343a1
