Merge 5.10.251 into android13-5.10-lts

Changes in 5.10.251
	crypto: octeontx - Fix length check to avoid truncation in ucode_load_store
	crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly
	crypto: virtio - Add spinlock protection with virtqueue notification
	nilfs2: Fix potential block overflow that cause system hang
	scsi: qla2xxx: Delay module unload while fabric scan in progress
	scsi: qla2xxx: Query FW again before proceeding with login
	gpio: omap: do not register driver in probe()
	ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU
	gpio: sprd: Change sprd_gpio lock to raw_spin_lock
	romfs: check sb_set_blocksize() return value
	drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used
	platform/x86: classmate-laptop: Add missing NULL pointer checks
	gpiolib: acpi: Fix gpio count with string references
	fs: dlm: fix invalid derefence of sb_lvbptr
	selftests: mptcp: pm: ensure unknown flags are ignored
	crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req
	scsi: qla2xxx: Validate sp before freeing associated memory
	scsi: qla2xxx: Free sp in error path to fix system crash
	scsi: qla2xxx: Fix bsg_done() causing double free
	fbdev: rivafb: fix divide error in nv3_arb()
	fbdev: smscufx: properly copy ioctl memory to kernelspace
	f2fs: fix out-of-bounds access in sysfs attribute read/write
	f2fs: fix to avoid UAF in f2fs_write_end_io()
	USB: serial: option: add Telit FN920C04 RNDIS compositions
	Linux 5.10.251

Change-Id: Ifcfbd76af897b55e781e8d4e35b9dcf698393fc6
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

Makefile

diff --git a/Makefile b/Makefile
index 16a1980..7ecc786 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 10
-SUBLEVEL = 250
+SUBLEVEL = 251
 EXTRAVERSION =
 NAME = Dare mighty things
 

drivers/usb/serial/option.c

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index a89cba3..f7179fe 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -1401,12 +1401,16 @@ static const struct usb_device_id option_ids[] = {
 	  .driver_info = NCTRL(0) | RSVD(1) },
 	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a0, 0xff),	/* Telit FN20C04 (rmnet) */
 	  .driver_info = RSVD(0) | NCTRL(3) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a1, 0xff),	/* Telit FN20C04 (RNDIS) */
+	  .driver_info = NCTRL(4) },
 	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a2, 0xff),	/* Telit FN920C04 (MBIM) */
 	  .driver_info = NCTRL(4) },
 	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a3, 0xff),	/* Telit FN920C04 (ECM) */
 	  .driver_info = NCTRL(4) },
 	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a4, 0xff),	/* Telit FN20C04 (rmnet) */
 	  .driver_info = RSVD(0) | NCTRL(3) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a6, 0xff),	/* Telit FN920C04 (RNDIS) */
+	  .driver_info = NCTRL(4) },
 	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a7, 0xff),	/* Telit FN920C04 (MBIM) */
 	  .driver_info = NCTRL(4) },
 	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a8, 0xff),	/* Telit FN920C04 (ECM) */
@@ -1415,6 +1419,8 @@ static const struct usb_device_id option_ids[] = {
 	  .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) },
 	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10aa, 0xff),	/* Telit FN920C04 (MBIM) */
 	  .driver_info = NCTRL(3) | RSVD(4) | RSVD(5) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10ab, 0xff),	/* Telit FN920C04 (RNDIS) */
+	  .driver_info = NCTRL(3) | RSVD(4) | RSVD(5) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b0, 0xff, 0xff, 0x30),	/* Telit FE990B (rmnet) */
 	  .driver_info = NCTRL(5) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b0, 0xff, 0xff, 0x40) },

fs/f2fs/data.c

diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
index 9de89b4..a9f0689 100644
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -361,14 +361,20 @@ static void f2fs_write_end_io(struct bio *bio)
 					page->index != nid_of_node(page));
 
 		dec_page_count(sbi, type);
+
+		/*
+		 * we should access sbi before end_page_writeback() to
+		 * avoid racing w/ kill_f2fs_super()
+		 */
+		if (type == F2FS_WB_CP_DATA && !get_pages(sbi, type) &&
+				wq_has_sleeper(&sbi->cp_wait))
+			wake_up(&sbi->cp_wait);
+
 		if (f2fs_in_warm_node_list(sbi, page))
 			f2fs_del_fsync_node_entry(sbi, page);
 		clear_page_private_gcing(page);
 		end_page_writeback(page);
 	}
-	if (!get_pages(sbi, F2FS_WB_CP_DATA) &&
-				wq_has_sleeper(&sbi->cp_wait))
-		wake_up(&sbi->cp_wait);
 
 	bio_put(bio);
 }