Commit Graph

2468 Commits

Author SHA1 Message Date
Tao Huang
f6909c028f Merge tag 'ASB-2021-12-05_12-5.10' of https://android.googlesource.com/kernel/common
https://source.android.com/security/bulletin/2021-12-01
CVE-2021-33909
CVE-2021-38204
CVE-2021-0961

* tag 'ASB-2021-12-05_12-5.10': (3010 commits)
  ANDROID: workqueue: export symbol of the function wq_worker_comm()
  ANDROID: GKI: Update symbols to symbol list
  ANDROID: vendor_hooks: Add hooks for binder proc transaction
  ANDROID: GKI: Add symbols abi for USB IP kernel modules.
  ANDROID: GKI: Fix file mode on mtk abi file
  UPSTREAM: erofs: fix deadlock when shrink erofs slab
  ANDROID: init_task: Init android vendor and oem data
  UPSTREAM: sched/core: Mitigate race cpus_share_cache()/update_top_cache_domain()
  ANDROID: Update symbol list for mtk
  UPSTREAM: erofs: fix unsafe pagevec reuse of hooked pclusters
  UPSTREAM: erofs: remove the occupied parameter from z_erofs_pagevec_enqueue()
  UPSTREAM: usb: dwc3: gadget: Fix null pointer exception
  ANDROID: fips140: support "evaluation testing" builds via build.sh
  FROMGIT: sched/scs: Reset task stack state in bringup_cpu()
  ANDROID: dma-buf: heaps: fix dma-buf heap pool pages stat
  ANDROID: ABI: Add several spi_mem related symbols
  UPSTREAM: spi: spi-mem: add spi_mem_dtr_supports_op()
  ANDROID: gki_defconfig: enable CONFIG_SPI_MEM
  ANDROID: ABI: Add several iio related symbols
  ANDROID: ABI: Update symbol list for IMX
  ...

Change-Id: I09cddc92fa34553b944e62cc5cbbba94a84e5437

Conflicts:
	arch/arm/boot/dts/rk322x.dtsi
	arch/arm64/boot/dts/rockchip/rk3399.dtsi
	drivers/dma-buf/heaps/system_heap.c
	drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c
	drivers/gpu/drm/rockchip/rockchip_drm_vop.c
	drivers/gpu/drm/rockchip/rockchip_lvds.c
	drivers/gpu/drm/rockchip/rockchip_vop_reg.c
	drivers/mtd/nand/spi/core.c
	drivers/pci/controller/pcie-rockchip-host.c
	drivers/soc/rockchip/Kconfig
	drivers/usb/dwc3/core.c
	drivers/usb/dwc3/core.h
2021-12-14 17:09:02 +08:00
Greg Kroah-Hartman
674d2ac211 This is the 5.10.62 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmEx2IsACgkQONu9yGCS
 aT6bihAA1pqL2x40IIk7nmu3XW/lNJxt4WLRjT7kGehDYE5gNz5VTQDaccb/+PiM
 18XjLN0RcSkhiai8410A/SNoHBvPSMWrNvf093NpFcGm0WcvsZVyNUfRgdXfs1N8
 FM1DAgA5eVowL+CthZyJIIRX6VllLAg1b3Z61frNO/t1nOUsS26enoxMSeaziqjz
 BuvajftaRGtJBMA3iNB1iKR3EEHRqfuWMT4swfQGDshdHlzXbdDOs0KV4bTYRo+f
 76n1bvftiMH4vRONIR3T+ZeJWeaL6IfW01v7qYx+06hBa6TtkwDc+Ofw5zxWFtj1
 7abou5U46gHIp4Ce8ANJzmnvd7iOssFk7+6y8Z7lZgUQCdwHFLP70VX9Jd3bRlsK
 UIwG0qiIG0jdLgUvjgritDWIcxuSniWIbecLr1xfHIzJAIvVr6bjRNyOz3gXgaa/
 h16oHZRhprC3+4baUQPjPiSb54z+y0Xrx8x9ZSvgHe4gQmctjzoKMVr9Fy7NSpQv
 MVVNi9GvqRI+o+Tu7/N3yxShdXvuRvOOFgeOcyvA7BigrxMb+LvOsPcISFIBva6a
 6+vKuRY79TMwEbDJkURnSNqkVyvMuqKhH5OGiKVHkQrp3AkltpDyDuap+6i2oar4
 ba20HaVstcSdCfx8iCmiy/l0g16vOyNC8cVVdB4WoX1fU6aiv9Y=
 =g+cC
 -----END PGP SIGNATURE-----

Merge 5.10.62 into android12-5.10-lts

Changes in 5.10.62
	net: qrtr: fix another OOB Read in qrtr_endpoint_post
	bpf: Fix ringbuf helper function compatibility
	bpf: Fix NULL pointer dereference in bpf_get_local_storage() helper
	ASoC: rt5682: Adjust headset volume button threshold
	ASoC: component: Remove misplaced prefix handling in pin control functions
	ARC: Fix CONFIG_STACKDEPOT
	netfilter: conntrack: collect all entries in one cycle
	once: Fix panic when module unload
	blk-iocost: fix lockdep warning on blkcg->lock
	ovl: fix uninitialized pointer read in ovl_lookup_real_one()
	net: mscc: Fix non-GPL export of regmap APIs
	can: usb: esd_usb2: esd_usb2_rx_event(): fix the interchange of the CAN RX and TX error counters
	ceph: correctly handle releasing an embedded cap flush
	riscv: Ensure the value of FP registers in the core dump file is up to date
	Revert "btrfs: compression: don't try to compress if we don't have enough pages"
	drm/amdgpu: Cancel delayed work when GFXOFF is disabled
	Revert "USB: serial: ch341: fix character loss at high transfer rates"
	USB: serial: option: add new VID/PID to support Fibocom FG150
	usb: renesas-xhci: Prefer firmware loading on unknown ROM state
	usb: dwc3: gadget: Fix dwc3_calc_trbs_left()
	usb: dwc3: gadget: Stop EP0 transfers during pullup disable
	scsi: core: Fix hang of freezing queue between blocking and running device
	RDMA/bnxt_re: Add missing spin lock initialization
	IB/hfi1: Fix possible null-pointer dereference in _extend_sdma_tx_descs()
	RDMA/bnxt_re: Remove unpaired rtnl unlock in bnxt_re_dev_init()
	ice: do not abort devlink info if board identifier can't be found
	net: usb: pegasus: fixes of set_register(s) return value evaluation;
	igc: fix page fault when thunderbolt is unplugged
	igc: Use num_tx_queues when iterating over tx_ring queue
	e1000e: Fix the max snoop/no-snoop latency for 10M
	e1000e: Do not take care about recovery NVM checksum
	RDMA/efa: Free IRQ vectors on error flow
	ip_gre: add validation for csum_start
	xgene-v2: Fix a resource leak in the error handling path of 'xge_probe()'
	net: marvell: fix MVNETA_TX_IN_PRGRS bit number
	ucounts: Increase ucounts reference counter before the security hook
	net/sched: ets: fix crash when flipping from 'strict' to 'quantum'
	ipv6: use siphash in rt6_exception_hash()
	ipv4: use siphash instead of Jenkins in fnhe_hashfun()
	cxgb4: dont touch blocked freelist bitmap after free
	rtnetlink: Return correct error on changing device netns
	net: hns3: clear hardware resource when loading driver
	net: hns3: add waiting time before cmdq memory is released
	net: hns3: fix duplicate node in VLAN list
	net: hns3: fix get wrong pfc_en when query PFC configuration
	Revert "mmc: sdhci-iproc: Set SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN on BCM2711"
	net: stmmac: add mutex lock to protect est parameters
	net: stmmac: fix kernel panic due to NULL pointer dereference of plat->est
	drm/i915: Fix syncmap memory leak
	usb: gadget: u_audio: fix race condition on endpoint stop
	dt-bindings: sifive-l2-cache: Fix 'select' matching
	perf/x86/intel/uncore: Fix integer overflow on 23 bit left shift of a u32
	clk: renesas: rcar-usb2-clock-sel: Fix kernel NULL pointer dereference
	iwlwifi: pnvm: accept multiple HW-type TLVs
	opp: remove WARN when no valid OPPs remain
	cpufreq: blocklist Qualcomm sm8150 in cpufreq-dt-platdev
	virtio: Improve vq->broken access to avoid any compiler optimization
	virtio_pci: Support surprise removal of virtio pci device
	virtio_vdpa: reject invalid vq indices
	vringh: Use wiov->used to check for read/write desc order
	tools/virtio: fix build
	qed: qed ll2 race condition fixes
	qed: Fix null-pointer dereference in qed_rdma_create_qp()
	Revert "drm/amd/pm: fix workload mismatch on vega10"
	drm/amd/pm: change the workload type for some cards
	blk-mq: don't grab rq's refcount in blk_mq_check_expired()
	drm: Copy drm_wait_vblank to user before returning
	drm/nouveau/disp: power down unused DP links during init
	drm/nouveau/kms/nv50: workaround EFI GOP window channel format differences
	net/rds: dma_map_sg is entitled to merge entries
	btrfs: fix race between marking inode needs to be logged and log syncing
	pipe: avoid unnecessary EPOLLET wakeups under normal loads
	pipe: do FASYNC notifications for every pipe IO, not just state changes
	mtd: spinand: Fix incorrect parameters for on-die ECC
	tipc: call tipc_wait_for_connect only when dlen is not 0
	vt_kdsetmode: extend console locking
	Bluetooth: btusb: check conditions before enabling USB ALT 3 for WBS
	riscv: Fixup wrong ftrace remove cflag
	riscv: Fixup patch_text panic in ftrace
	perf env: Fix memory leak of bpf_prog_info_linear member
	perf symbol-elf: Fix memory leak by freeing sdt_note.args
	perf record: Fix memory leak in vDSO found using ASAN
	perf tools: Fix arm64 build error with gcc-11
	perf annotate: Fix jump parsing for C++ code.
	powerpc/perf: Invoke per-CPU variable access with disabled interrupts
	srcu: Provide internal interface to start a Tree SRCU grace period
	srcu: Provide polling interfaces for Tree SRCU grace periods
	srcu: Provide internal interface to start a Tiny SRCU grace period
	srcu: Make Tiny SRCU use multi-bit grace-period counter
	srcu: Provide polling interfaces for Tiny SRCU grace periods
	tracepoint: Use rcu get state and cond sync for static call updates
	usb: typec: ucsi: acpi: Always decode connector change information
	usb: typec: ucsi: Work around PPM losing change information
	usb: typec: ucsi: Clear pending after acking connector change
	net: dsa: mt7530: fix VLAN traffic leaks again
	lkdtm: Enable DOUBLE_FAULT on all architectures
	arm64: dts: qcom: msm8994-angler: Fix gpio-reserved-ranges 85-88
	btrfs: fix NULL pointer dereference when deleting device by invalid id
	kthread: Fix PF_KTHREAD vs to_kthread() race
	Revert "floppy: reintroduce O_NDELAY fix"
	Revert "parisc: Add assembly implementations for memset, strlen, strcpy, strncpy and strcat"
	net: don't unconditionally copy_from_user a struct ifreq for socket ioctls
	audit: move put_tree() to avoid trim_trees refcount underflow and UAF
	bpf: Fix potentially incorrect results with bpf_get_local_storage()
	Linux 5.10.62

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I5a9bf4b2c254ae21a10f838494cae1c3fa016be3
2021-09-03 10:51:56 +02:00
Petko Manolov
384dea502e net: usb: pegasus: fixes of set_register(s) return value evaluation;
[ Upstream commit ffc9c3ebb4 ]

- restore the behavior in enable_net_traffic() to avoid regressions - Jakub
    Kicinski;
  - hurried up and removed redundant assignment in pegasus_open() before yet
    another checker complains;

Fixes: 8a160e2e9a ("net: usb: pegasus: Check the return value of get_geristers() and friends;")
Reported-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Petko Manolov <petko.manolov@konsulko.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-09-03 10:09:23 +02:00
Greg Kroah-Hartman
a6777a7cee Linux 5.10.61
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE4n5dijQDou9mhzu83qZv95d3LNwFAmEnjxwACgkQ3qZv95d3
 LNxlaw//VC9rmejl9JwdZQaz3NfhNv2UwamLShlliq2aBmy8d+fGTAMXkCW7UK/M
 gS27oweL6UV6wT8BKgK8LoKJ7L1rI1KDAePpxMCSZw8Mrd8jre0FMVgkkQz/2mFQ
 w3aMmVitCX7RIeShoxP/8fmWnGRkugDx7SZ2csoqRP9Txtih7DAamiun2ttTzzra
 4dxFRtyzw1LpJBSv/pMJ3/FusPkrbwKzSv2wYIgWmfhIWjPcvmBc0ufJmGUK7Gxo
 MJGaUWk9RJ3eNSUPUP3pJlKdzeHdOhOQnydiaUA60pWcDoAyQj7qM06af5hVLsCX
 0Z9r97bzWOF+LNuEiNIGbodJ74IgFv0VTgjlRdZfeLC+5yLyIo7fXAmAA2Od0fiH
 04Ak9+n+FTkl5avUufLrEwHljAAOgcbtJX7W4F/XPW+1P1tZxG9H4ZI+uQN7ZyAB
 fXGo3O3p5J14fI/m8Zr4mXDIiq34OPxSHLx89YryubriO8kdNv69+tciLn2m5a5W
 yctpYgVQnRJt44dg5I/aIzCSOW5+FviRY8slAopdXBIAwUZAZZgW9IVGAh2uRiLS
 tCtbFa3cXUV1JoWsgUdae8BDoOp0dm69yeYrP1f5eVCLe+FHa9P/Z3qxpBLhpPEh
 QOTI14tg3wu3vwFxAA2rsFmSInkh231ryjgGq788BnoHHad3DnI=
 =Rtb5
 -----END PGP SIGNATURE-----

Merge 5.10.61 into android12-5.10-lts

Changes in 5.10.61
	ath: Use safer key clearing with key cache entries
	ath9k: Clear key cache explicitly on disabling hardware
	ath: Export ath_hw_keysetmac()
	ath: Modify ath_key_delete() to not need full key entry
	ath9k: Postpone key cache entry deletion for TXQ frames reference it
	mtd: cfi_cmdset_0002: fix crash when erasing/writing AMD cards
	media: zr364xx: propagate errors from zr364xx_start_readpipe()
	media: zr364xx: fix memory leaks in probe()
	media: drivers/media/usb: fix memory leak in zr364xx_probe
	KVM: x86: Factor out x86 instruction emulation with decoding
	KVM: X86: Fix warning caused by stale emulation context
	USB: core: Avoid WARNings for 0-length descriptor requests
	USB: core: Fix incorrect pipe calculation in do_proc_control()
	dmaengine: xilinx_dma: Fix read-after-free bug when terminating transfers
	dmaengine: usb-dmac: Fix PM reference leak in usb_dmac_probe()
	spi: spi-mux: Add module info needed for autoloading
	net: xfrm: Fix end of loop tests for list_for_each_entry
	ARM: dts: am43x-epos-evm: Reduce i2c0 bus speed for tps65218
	dmaengine: of-dma: router_xlate to return -EPROBE_DEFER if controller is not yet available
	scsi: pm80xx: Fix TMF task completion race condition
	scsi: megaraid_mm: Fix end of loop tests for list_for_each_entry()
	scsi: scsi_dh_rdac: Avoid crash during rdac_bus_attach()
	scsi: core: Avoid printing an error if target_alloc() returns -ENXIO
	scsi: core: Fix capacity set to zero after offlinining device
	drm/amdgpu: fix the doorbell missing when in CGPG issue for renoir.
	qede: fix crash in rmmod qede while automatic debug collection
	ARM: dts: nomadik: Fix up interrupt controller node names
	net: usb: pegasus: Check the return value of get_geristers() and friends;
	net: usb: lan78xx: don't modify phy_device state concurrently
	drm/amd/display: Fix Dynamic bpp issue with 8K30 with Navi 1X
	drm/amd/display: workaround for hard hang on HPD on native DP
	Bluetooth: hidp: use correct wait queue when removing ctrl_wait
	arm64: dts: qcom: c630: fix correct powerdown pin for WSA881x
	arm64: dts: qcom: msm8992-bullhead: Remove PSCI
	iommu: Check if group is NULL before remove device
	cpufreq: armada-37xx: forbid cpufreq for 1.2 GHz variant
	dccp: add do-while-0 stubs for dccp_pr_debug macros
	virtio: Protect vqs list access
	vhost-vdpa: Fix integer overflow in vhost_vdpa_process_iotlb_update()
	bus: ti-sysc: Fix error handling for sysc_check_active_timer()
	vhost: Fix the calculation in vhost_overflow()
	vdpa/mlx5: Avoid destroying MR on empty iotlb
	soc / drm: mediatek: Move DDP component defines into mtk-mmsys.h
	drm/mediatek: Fix aal size config
	drm/mediatek: Add AAL output size configuration
	bpf: Clear zext_dst of dead insns
	bnxt: don't lock the tx queue from napi poll
	bnxt: disable napi before canceling DIM
	bnxt: make sure xmit_more + errors does not miss doorbells
	bnxt: count Tx drops
	net: 6pack: fix slab-out-of-bounds in decode_data
	ptp_pch: Restore dependency on PCI
	bnxt_en: Disable aRFS if running on 212 firmware
	bnxt_en: Add missing DMA memory barriers
	vrf: Reset skb conntrack connection on VRF rcv
	virtio-net: support XDP when not more queues
	virtio-net: use NETIF_F_GRO_HW instead of NETIF_F_LRO
	net: qlcnic: add missed unlock in qlcnic_83xx_flash_read32
	ixgbe, xsk: clean up the resources in ixgbe_xsk_pool_enable error path
	sch_cake: fix srchost/dsthost hashing mode
	net: mdio-mux: Don't ignore memory allocation errors
	net: mdio-mux: Handle -EPROBE_DEFER correctly
	ovs: clear skb->tstamp in forwarding path
	iommu/vt-d: Consolidate duplicate cache invaliation code
	iommu/vt-d: Fix incomplete cache flush in intel_pasid_tear_down_entry()
	r8152: fix writing USB_BP2_EN
	i40e: Fix ATR queue selection
	iavf: Fix ping is lost after untrusted VF had tried to change MAC
	Revert "flow_offload: action should not be NULL when it is referenced"
	mmc: dw_mmc: Fix hang on data CRC error
	mmc: mmci: stm32: Check when the voltage switch procedure should be done
	mmc: sdhci-msm: Update the software timeout value for sdhc
	clk: imx6q: fix uart earlycon unwork
	clk: qcom: gdsc: Ensure regulator init state matches GDSC state
	ALSA: hda - fix the 'Capture Switch' value change notifications
	tracing / histogram: Fix NULL pointer dereference on strcmp() on NULL event name
	slimbus: messaging: start transaction ids from 1 instead of zero
	slimbus: messaging: check for valid transaction id
	slimbus: ngd: reset dma setup during runtime pm
	ipack: tpci200: fix many double free issues in tpci200_pci_probe
	ipack: tpci200: fix memory leak in the tpci200_register
	ALSA: hda/realtek: Enable 4-speaker output for Dell XPS 15 9510 laptop
	mmc: sdhci-iproc: Cap min clock frequency on BCM2711
	mmc: sdhci-iproc: Set SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN on BCM2711
	btrfs: prevent rename2 from exchanging a subvol with a directory from different parents
	ALSA: hda/via: Apply runtime PM workaround for ASUS B23E
	s390/pci: fix use after free of zpci_dev
	PCI: Increase D3 delay for AMD Renoir/Cezanne XHCI
	ALSA: hda/realtek: Limit mic boost on HP ProBook 445 G8
	ASoC: intel: atom: Fix breakage for PCM buffer address setup
	mm: memcontrol: fix occasional OOMs due to proportional memory.low reclaim
	fs: warn about impending deprecation of mandatory locks
	io_uring: fix xa_alloc_cycle() error return value check
	io_uring: only assign io_uring_enter() SQPOLL error in actual error case
	Linux 5.10.61

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I5b6e2a66b03d1cb01c8310b83dcc2a119c1bd6b3
2021-08-27 20:51:37 +02:00
Hayes Wang
e003a89219 r8152: fix writing USB_BP2_EN
[ Upstream commit a876a33d2a ]

The register of USB_BP2_EN is 16 bits, so we should use
ocp_write_word(), not ocp_write_byte().

Fixes: 9370f2d05a ("support request_firmware for RTL8153")
Signed-off-by: Hayes Wang <hayeswang@realtek.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-08-26 08:35:51 -04:00
Ivan T. Ivanov
8849a8c705 net: usb: lan78xx: don't modify phy_device state concurrently
[ Upstream commit 6b67d4d63e ]

Currently phy_device state could be left in inconsistent state shown
by following alert message[1]. This is because phy_read_status could
be called concurrently from lan78xx_delayedwork, phy_state_machine and
__ethtool_get_link. Fix this by making sure that phy_device state is
updated atomically.

[1] lan78xx 1-1.1.1:1.0 eth0: No phy led trigger registered for speed(-1)

Signed-off-by: Ivan T. Ivanov <iivanov@suse.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-08-26 08:35:38 -04:00
Petko Manolov
735e613fa5 net: usb: pegasus: Check the return value of get_geristers() and friends;
[ Upstream commit 8a160e2e9a ]

Certain call sites of get_geristers() did not do proper error handling.  This
could be a problem as get_geristers() typically return the data via pointer to a
buffer.  If an error occurred the code is carelessly manipulating the wrong data.

Signed-off-by: Petko Manolov <petkan@nucleusys.com>
Reviewed-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-08-26 08:35:38 -04:00
Tao Huang
8a8168e343 Merge remote branch 'android12-5.10-2021-08' of https://android.googlesource.com/kernel/common
* android12-5.10-2021-08: (429 commits)
  ANDROID: Update symbol list for mtk
  ANDROID: scheduler: export task_sched_runtime
  FROMLIST: mm: slub: fix slub_debug disabling for list of slabs
  FROMLIST: mm/madvise: add MADV_WILLNEED to process_madvise()
  ANDROID: Update the exynos symbol list
  FROMGIT: firmware: arm_scmi: Free mailbox channels if probe fails
  ANDROID: GKI: gki_defconfig: Enable CONFIG_NFC
  ANDROID: sched: Make uclamp changes depend on CAP_SYS_NICE
  ANDROID: GKI: update xiaomi symbol list and ABI XML
  ANDROID: ABI: update generic symbol list
  ANDROID: scsi: ufs: Enable CONFIG_SCSI_UFS_HPB
  ANDROID: scsi: ufs: Make CONFIG_SCSI_UFS_HPB compatible with the GKI
  UPSTREAM: arm64: vdso: Avoid ISB after reading from cntvct_el0
  ANDROID: GKI: Disable X86_MCE drivers
  ANDROID: GKI: Update symbols to symbol list
  ANDROID: ABI: update allowed list for exynos
  FROMGIT: sched: Skip priority checks with SCHED_FLAG_KEEP_PARAMS
  FROMGIT: sched: Don't report SCHED_FLAG_SUGOV in sched_getattr()
  FROMGIT: sched/deadline: Fix reset_on_fork reporting of DL tasks
  BACKPORT: FROMGIT: sched: Fix UCLAMP_FLAG_IDLE setting
  ...

Change-Id: I5e0600bb4ccd0333366b016b42332e1e79e56b61

Conflicts:
	drivers/usb/gadget/configfs.c
	include/linux/usb/gadget.h
2021-08-24 20:07:38 +08:00
Greg Kroah-Hartman
af3bdb4304 This is the 5.10.58 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmEVBn4ACgkQONu9yGCS
 aT5CoQ//ZpZKkAu4NzUKmFfzJjpTwRWSg4YKGHx0BSt/ovuw8SXQa3xAx12r1U9w
 5hXxkCQncCPSul1eIRNmpwVIUavRvyS2Vll//XtT695MA0e9sK9nrXoYgqwUE/gf
 hqgytJAb7DHk5pcLlyfCncXNyw//9WIl8WCNSppZgSnRRk+smfThnEVE6pcgQok5
 4vIy4RXSK12/Xs9jG+q+pqcvQ3ILscCrzQyfxBu5AWePlm8kaM+6cxuL3b+S0COH
 Gg0YLPrTQjLdQ+oNnh93s2fFk0bqeqt/KDMI9xGt00hNwaTBHxgoxj04AFQEgkft
 APwvezabNBojmDZasMq9h5sxGoloxLe2vD+fAWGA3KVTJ6vlKYmhx7+X6jtAJP5Y
 HHNUiYg58VnkYzxT1Ok8CUHocbaFhlFjCqjDUg1oo93XuZJaTgO63q8yeI49pN7S
 xZyim8X/rdouW1WG+7pubOe1E+nZudZDooWOs5CxyJmO1jb3CpMjfl3rRdWG4PI4
 7gC8IG8xmgC9CeGen5egAPqARwBW0d4AFDHT5tY4yF8ovbkO437hYHKvJjZDY919
 v8fqeI95nRrsawXH+GdIMlwOf/PzkODiZc2EwSh/uPnbwPPeZY7a7YQwMwzyxRfb
 Q3dOrapi5k1aoC7583ReIY5RPqc82a4LAdmTN7YN60hiXHkm0bg=
 =+Sab
 -----END PGP SIGNATURE-----

Merge 5.10.58 into android12-5.10-lts

Changes in 5.10.58
	Revert "ACPICA: Fix memory leak caused by _CID repair function"
	ALSA: seq: Fix racy deletion of subscriber
	bus: ti-sysc: Fix gpt12 system timer issue with reserved status
	net: xfrm: fix memory leak in xfrm_user_rcv_msg
	arm64: dts: ls1028a: fix node name for the sysclk
	ARM: imx: add missing iounmap()
	ARM: imx: add missing clk_disable_unprepare()
	ARM: dts: imx6qdl-sr-som: Increase the PHY reset duration to 10ms
	arm64: dts: ls1028: sl28: fix networking for variant 2
	ARM: dts: colibri-imx6ull: limit SDIO clock to 25MHz
	ARM: imx: fix missing 3rd argument in macro imx_mmdc_perf_init
	ARM: dts: imx: Swap M53Menlo pinctrl_power_button/pinctrl_power_out pins
	arm64: dts: armada-3720-turris-mox: fixed indices for the SDHC controllers
	arm64: dts: armada-3720-turris-mox: remove mrvl,i2c-fast-mode
	ALSA: usb-audio: fix incorrect clock source setting
	clk: stm32f4: fix post divisor setup for I2S/SAI PLLs
	ARM: dts: am437x-l4: fix typo in can@0 node
	omap5-board-common: remove not physically existing vdds_1v8_main fixed-regulator
	dmaengine: uniphier-xdmac: Use readl_poll_timeout_atomic() in atomic state
	clk: tegra: Implement disable_unused() of tegra_clk_sdmmc_mux_ops
	dmaengine: stm32-dma: Fix PM usage counter imbalance in stm32 dma ops
	dmaengine: stm32-dmamux: Fix PM usage counter unbalance in stm32 dmamux ops
	spi: imx: mx51-ecspi: Reinstate low-speed CONFIGREG delay
	spi: imx: mx51-ecspi: Fix low-speed CONFIGREG delay calculation
	scsi: sr: Return correct event when media event code is 3
	media: videobuf2-core: dequeue if start_streaming fails
	ARM: dts: stm32: Disable LAN8710 EDPD on DHCOM
	ARM: dts: stm32: Fix touchscreen IRQ line assignment on DHCOM
	dmaengine: imx-dma: configure the generic DMA type to make it work
	net, gro: Set inner transport header offset in tcp/udp GRO hook
	net: dsa: sja1105: overwrite dynamic FDB entries with static ones in .port_fdb_add
	net: dsa: sja1105: invalidate dynamic FDB entries learned concurrently with statically added ones
	net: dsa: sja1105: be stateless with FDB entries on SJA1105P/Q/R/S/SJA1110 too
	net: dsa: sja1105: match FDB entries regardless of inner/outer VLAN tag
	net: phy: micrel: Fix detection of ksz87xx switch
	net: natsemi: Fix missing pci_disable_device() in probe and remove
	gpio: tqmx86: really make IRQ optional
	RDMA/mlx5: Delay emptying a cache entry when a new MR is added to it recently
	sctp: move the active_key update after sh_keys is added
	nfp: update ethtool reporting of pauseframe control
	net: ipv6: fix returned variable type in ip6_skb_dst_mtu
	net: dsa: qca: ar9331: reorder MDIO write sequence
	net: sched: fix lockdep_set_class() typo error for sch->seqlock
	MIPS: check return value of pgtable_pmd_page_ctor
	mips: Fix non-POSIX regexp
	bnx2x: fix an error code in bnx2x_nic_load()
	net: pegasus: fix uninit-value in get_interrupt_interval
	net: fec: fix use-after-free in fec_drv_remove
	net: vxge: fix use-after-free in vxge_device_unregister
	blk-iolatency: error out if blk_get_queue() failed in iolatency_set_limit()
	Bluetooth: defer cleanup of resources in hci_unregister_dev()
	USB: usbtmc: Fix RCU stall warning
	USB: serial: option: add Telit FD980 composition 0x1056
	USB: serial: ch341: fix character loss at high transfer rates
	USB: serial: ftdi_sio: add device ID for Auto-M3 OP-COM v2
	firmware_loader: use -ETIMEDOUT instead of -EAGAIN in fw_load_sysfs_fallback
	firmware_loader: fix use-after-free in firmware_fallback_sysfs
	drm/amdgpu/display: fix DMUB firmware version info
	ALSA: pcm - fix mmap capability check for the snd-dummy driver
	ALSA: hda/realtek: add mic quirk for Acer SF314-42
	ALSA: hda/realtek: Fix headset mic for Acer SWIFT SF314-56 (ALC256)
	ALSA: usb-audio: Fix superfluous autosuspend recovery
	ALSA: usb-audio: Add registration quirk for JBL Quantum 600
	usb: dwc3: gadget: Avoid runtime resume if disabling pullup
	usb: gadget: remove leaked entry from udc driver list
	usb: cdns3: Fixed incorrect gadget state
	usb: gadget: f_hid: added GET_IDLE and SET_IDLE handlers
	usb: gadget: f_hid: fixed NULL pointer dereference
	usb: gadget: f_hid: idle uses the highest byte for duration
	usb: host: ohci-at91: suspend/resume ports after/before OHCI accesses
	usb: typec: tcpm: Keep other events when receiving FRS and Sourcing_vbus events
	usb: otg-fsm: Fix hrtimer list corruption
	clk: fix leak on devm_clk_bulk_get_all() unwind
	scripts/tracing: fix the bug that can't parse raw_trace_func
	tracing / histogram: Give calculation hist_fields a size
	tracing: Reject string operand in the histogram expression
	tracing: Fix NULL pointer dereference in start_creating
	tracepoint: static call: Compare data on transition from 2->1 callees
	tracepoint: Fix static call function vs data state mismatch
	arm64: stacktrace: avoid tracing arch_stack_walk()
	optee: Clear stale cache entries during initialization
	tee: add tee_shm_alloc_kernel_buf()
	optee: Fix memory leak when failing to register shm pages
	optee: Refuse to load the driver under the kdump kernel
	optee: fix tee out of memory failure seen during kexec reboot
	tpm_ftpm_tee: Free and unregister TEE shared memory during kexec
	staging: rtl8723bs: Fix a resource leak in sd_int_dpc
	staging: rtl8712: get rid of flush_scheduled_work
	staging: rtl8712: error handling refactoring
	drivers core: Fix oops when driver probe fails
	media: rtl28xxu: fix zero-length control request
	pipe: increase minimum default pipe size to 2 pages
	ext4: fix potential htree corruption when growing large_dir directories
	serial: tegra: Only print FIFO error message when an error occurs
	serial: 8250_mtk: fix uart corruption issue when rx power off
	serial: 8250: Mask out floating 16/32-bit bus bits
	MIPS: Malta: Do not byte-swap accesses to the CBUS UART
	serial: 8250_pci: Enumerate Elkhart Lake UARTs via dedicated driver
	serial: 8250_pci: Avoid irq sharing for MSI(-X) interrupts.
	fpga: dfl: fme: Fix cpu hotplug issue in performance reporting
	timers: Move clearing of base::timer_running under base:: Lock
	xfrm: Fix RCU vs hash_resize_mutex lock inversion
	net/xfrm/compat: Copy xfrm_spdattr_type_t atributes
	pcmcia: i82092: fix a null pointer dereference bug
	selinux: correct the return value when loads initial sids
	bus: ti-sysc: AM3: RNG is GP only
	Revert "gpio: mpc8xxx: change the gpio interrupt flags."
	ARM: omap2+: hwmod: fix potential NULL pointer access
	md/raid10: properly indicate failure when ending a failed write request
	KVM: x86: accept userspace interrupt only if no event is injected
	KVM: Do not leak memory for duplicate debugfs directories
	KVM: x86/mmu: Fix per-cpu counter corruption on 32-bit builds
	arm64: vdso: Avoid ISB after reading from cntvct_el0
	soc: ixp4xx: fix printing resources
	interconnect: Fix undersized devress_alloc allocation
	spi: meson-spicc: fix memory leak in meson_spicc_remove
	interconnect: Zero initial BW after sync-state
	interconnect: Always call pre_aggregate before aggregate
	interconnect: qcom: icc-rpmh: Ensure floor BW is enforced for all nodes
	drm/i915: Correct SFC_DONE register offset
	soc: ixp4xx/qmgr: fix invalid __iomem access
	perf/x86/amd: Don't touch the AMD64_EVENTSEL_HOSTONLY bit inside the guest
	sched/rt: Fix double enqueue caused by rt_effective_prio
	drm/i915: avoid uninitialised var in eb_parse()
	libata: fix ata_pio_sector for CONFIG_HIGHMEM
	reiserfs: add check for root_inode in reiserfs_fill_super
	reiserfs: check directory items on read from disk
	virt_wifi: fix error on connect
	net: qede: Fix end of loop tests for list_for_each_entry
	alpha: Send stop IPI to send to online CPUs
	net/qla3xxx: fix schedule while atomic in ql_wait_for_drvr_lock and ql_adapter_reset
	smb3: rc uninitialized in one fallocate path
	drm/amdgpu/display: only enable aux backlight control for OLED panels
	arm64: fix compat syscall return truncation
	Linux 5.10.58

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I2533667974c9dff419a14d63e0e8febfb3de80f1
2021-08-12 14:58:34 +02:00
Pavel Skripkin
f12b6b6bc1 net: pegasus: fix uninit-value in get_interrupt_interval
[ Upstream commit af35fc3735 ]

Syzbot reported uninit value pegasus_probe(). The problem was in missing
error handling.

get_interrupt_interval() internally calls read_eprom_word() which can
fail in some cases. For example: failed to receive usb control message.
These cases should be handled to prevent uninit value bug, since
read_eprom_word() will not initialize passed stack variable in case of
internal failure.

Fail log:

BUG: KMSAN: uninit-value in get_interrupt_interval drivers/net/usb/pegasus.c:746 [inline]
BUG: KMSAN: uninit-value in pegasus_probe+0x10e7/0x4080 drivers/net/usb/pegasus.c:1152
CPU: 1 PID: 825 Comm: kworker/1:1 Not tainted 5.12.0-rc6-syzkaller #0
...
Workqueue: usb_hub_wq hub_event
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x24c/0x2e0 lib/dump_stack.c:120
 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118
 __msan_warning+0x5c/0xa0 mm/kmsan/kmsan_instr.c:197
 get_interrupt_interval drivers/net/usb/pegasus.c:746 [inline]
 pegasus_probe+0x10e7/0x4080 drivers/net/usb/pegasus.c:1152
....

Local variable ----data.i@pegasus_probe created at:
 get_interrupt_interval drivers/net/usb/pegasus.c:1151 [inline]
 pegasus_probe+0xe57/0x4080 drivers/net/usb/pegasus.c:1152
 get_interrupt_interval drivers/net/usb/pegasus.c:1151 [inline]
 pegasus_probe+0xe57/0x4080 drivers/net/usb/pegasus.c:1152

Reported-and-tested-by: syzbot+02c9f70f3afae308464a@syzkaller.appspotmail.com
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Link: https://lore.kernel.org/r/20210804143005.439-1-paskripkin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-08-12 13:22:07 +02:00
Greg Kroah-Hartman
a15695131a This is the 5.10.57 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmEPgjkACgkQONu9yGCS
 aT4rgg//V+2igeM1O6aFCZODXLiagKe4k52bWC8N28KfjgDTo8znJSvg9wMlQ1vb
 YbUIOFqiTTM3JncZB3V260JRiT+abclyxVXlsXOkUpgZJPaBHGSINm5047Uo/Wwf
 /xLDPMmT1Yn/o8VUfRArm1+Q5wGCnb7a++2LAozElOAiCifk4S915940KDKQDs5f
 PNewMcAhSsPd8lLg+/AqFfACFFmd0CSsLQoF67Cq0fngOEd/2F0tgQkT40+7KBEM
 rd9BSHWFFG3uYE/DnkchmxqY0sJ84hdDdNf1Y3UddIiyXPRLOAenUBeBzbHhAVpb
 LelR/F5SX4BW+z2+25dj4kD4fKxwWjdESGiWse1GEijLWXRKLTTbgCfMphQOz/km
 5qf7wJ7EAfMXmIwHCtF86wHGr1ax37j9qfGSsi+TucLdqafQVTDuSRRH+0gLXCqX
 0ST4kAB/N0EjkAYrYNJSNvKqEFFW7YlWtlk9AO+hHfP52XaeOKzW7z/tgqwiGZOZ
 pfJfQyqxLpfIeVGzkANJaMwIdqcwOhge3FWScscBpuoxhIkbcdByvTYCr3s7wSzv
 jmqja1ofSXoe/7sGNrmRg6VcgnfBgbaOHWuPKvWw/tQlML6bHBflt2Pq1RkyoAsm
 LEF+IuZRfLCV/PoqatzA0PT/W9RDniQ0JEjwooOakDX5C5a91Dw=
 =X3WM
 -----END PGP SIGNATURE-----

Merge 5.10.57 into android12-5.10-lts

Changes in 5.10.57
	drm/i915: Revert "drm/i915/gem: Asynchronous cmdparser"
	Revert "drm/i915: Propagate errors on awaiting already signaled fences"
	btrfs: fix race causing unnecessary inode logging during link and rename
	btrfs: fix lost inode on log replay after mix of fsync, rename and inode eviction
	regulator: rtmv20: Fix wrong mask for strobe-polarity-high
	regulator: rt5033: Fix n_voltages settings for BUCK and LDO
	spi: stm32h7: fix full duplex irq handler handling
	ASoC: tlv320aic31xx: fix reversed bclk/wclk master bits
	r8152: Fix potential PM refcount imbalance
	qed: fix possible unpaired spin_{un}lock_bh in _qed_mcp_cmd_and_union()
	ASoC: rt5682: Fix the issue of garbled recording after powerd_dbus_suspend
	net: Fix zero-copy head len calculation.
	ASoC: ti: j721e-evm: Fix unbalanced domain activity tracking during startup
	ASoC: ti: j721e-evm: Check for not initialized parent_clk_id
	efi/mokvar: Reserve the table only if it is in boot services data
	nvme: fix nvme_setup_command metadata trace event
	drm/amd/display: Fix comparison error in dcn21 DML
	drm/amd/display: Fix max vstartup calculation for modes with borders
	ACPI: fix NULL pointer dereference
	Revert "Bluetooth: Shutdown controller after workqueues are flushed or cancelled"
	firmware: arm_scmi: Ensure drivers provide a probe function
	firmware: arm_scmi: Add delayed response status check
	Revert "watchdog: iTCO_wdt: Account for rebooting on second timeout"
	selftests/bpf: Add a test for ptr_to_map_value on stack for helper access
	selftest/bpf: Adjust expected verifier errors
	bpf, selftests: Adjust few selftest result_unpriv outcomes
	bpf: Update selftests to reflect new error states
	bpf, selftests: Adjust few selftest outcomes wrt unreachable code
	selftest/bpf: Verifier tests for var-off access
	spi: mediatek: Fix fifo transfer
	Linux 5.10.57

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ic9f65afb3ff8d01e17fa27dff20c3592910280f2
2021-08-08 09:36:33 +02:00
Takashi Iwai
f6a2ff040b r8152: Fix potential PM refcount imbalance
[ Upstream commit 9c23aa5147 ]

rtl8152_close() takes the refcount via usb_autopm_get_interface() but
it doesn't release when RTL8152_UNPLUG test hits.  This may lead to
the imbalance of PM refcount.  This patch addresses it.

Link: https://bugzilla.suse.com/show_bug.cgi?id=1186194
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-08-08 09:05:22 +02:00
Greg Kroah-Hartman
e4cac2c332 This is the 5.10.54 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmEBT00ACgkQONu9yGCS
 aT7svA/9HCRwW+pK3UpK1+0FK7gGH8DA3jSONj775zVEKhboDZNIwZsDqG0Ly+jm
 /JejWXPKZlekaDXgzBfZY3H59xgij/VwYHe8p7cdxfi1TlhmAQwFjLNZnWav8as6
 IyNkpsDJn8fMXmfHDi2u3cb8wrVi/aQDzTlwu88cUtREyZCaaYlo0Fdv9MJyhww/
 p6LWPYQoZ8TmFY+Y/2ORVxFos2UVuU0hhhMdGt9LrX2WNEGRNUZUqmbhcXYfdsX0
 ckSHbijIcWdcka3nQ6yOvdxw75rTqd8c/bP0y+yAteeJ0CykjVnI2cdK+M2ZEi4j
 /JqpGJrRWhsZf5MiO8b3k+I1K62JDa1GYBQ9Amp8FKKzjYLPTNeFAP9IsMyDc4oi
 oW98XM7XzoSEU9t/FSAIGT0hYK9k+lnPxw623LhxD6x3VPynnNAnQsLr+HirOgG6
 mZ79L4ZFu3lUvVsCuCgKn/uxwDopUNlhqo5B2/4M2kSWwe2Xu5bExpGc2bT9xCOP
 6fF9DmvmpG1UPGCXrOqaxemyEPmHqmyjKJpxDt6vZqlOL9vqHez4WmEEM1C+E2NZ
 5VKKbBk/KZDxNX9EiFOtI2HRFb1cghoI2Hcb/QjRoB9Dv3a6cHgjxDl0eKm8SiDN
 +1ytV0IFH3fT4aRiXJ7I3GBwkjKcDaX0sjYwtnCx9s5XZmm9PRQ=
 =HAyL
 -----END PGP SIGNATURE-----

Merge 5.10.54 into android12-5.10-lts

Changes in 5.10.54
	igc: Fix use-after-free error during reset
	igb: Fix use-after-free error during reset
	igc: change default return of igc_read_phy_reg()
	ixgbe: Fix an error handling path in 'ixgbe_probe()'
	igc: Fix an error handling path in 'igc_probe()'
	igb: Fix an error handling path in 'igb_probe()'
	fm10k: Fix an error handling path in 'fm10k_probe()'
	e1000e: Fix an error handling path in 'e1000_probe()'
	iavf: Fix an error handling path in 'iavf_probe()'
	igb: Check if num of q_vectors is smaller than max before array access
	igb: Fix position of assignment to *ring
	gve: Fix an error handling path in 'gve_probe()'
	net: add kcov handle to skb extensions
	bonding: fix suspicious RCU usage in bond_ipsec_add_sa()
	bonding: fix null dereference in bond_ipsec_add_sa()
	ixgbevf: use xso.real_dev instead of xso.dev in callback functions of struct xfrmdev_ops
	bonding: fix suspicious RCU usage in bond_ipsec_del_sa()
	bonding: disallow setting nested bonding + ipsec offload
	bonding: Add struct bond_ipesc to manage SA
	bonding: fix suspicious RCU usage in bond_ipsec_offload_ok()
	bonding: fix incorrect return value of bond_ipsec_offload_ok()
	ipv6: fix 'disable_policy' for fwd packets
	stmmac: platform: Fix signedness bug in stmmac_probe_config_dt()
	selftests: icmp_redirect: remove from checking for IPv6 route get
	selftests: icmp_redirect: IPv6 PMTU info should be cleared after redirect
	pwm: sprd: Ensure configuring period and duty_cycle isn't wrongly skipped
	cxgb4: fix IRQ free race during driver unload
	mptcp: fix warning in __skb_flow_dissect() when do syn cookie for subflow join
	nvme-pci: do not call nvme_dev_remove_admin from nvme_remove
	KVM: x86/pmu: Clear anythread deprecated bit when 0xa leaf is unsupported on the SVM
	perf inject: Fix dso->nsinfo refcounting
	perf map: Fix dso->nsinfo refcounting
	perf probe: Fix dso->nsinfo refcounting
	perf env: Fix sibling_dies memory leak
	perf test session_topology: Delete session->evlist
	perf test event_update: Fix memory leak of evlist
	perf dso: Fix memory leak in dso__new_map()
	perf test maps__merge_in: Fix memory leak of maps
	perf env: Fix memory leak of cpu_pmu_caps
	perf report: Free generated help strings for sort option
	perf script: Fix memory 'threads' and 'cpus' leaks on exit
	perf lzma: Close lzma stream on exit
	perf probe-file: Delete namelist in del_events() on the error path
	perf data: Close all files in close_dir()
	perf sched: Fix record failure when CONFIG_SCHEDSTATS is not set
	ASoC: wm_adsp: Correct wm_coeff_tlv_get handling
	spi: imx: add a check for speed_hz before calculating the clock
	spi: stm32: fixes pm_runtime calls in probe/remove
	regulator: hi6421: Use correct variable type for regmap api val argument
	regulator: hi6421: Fix getting wrong drvdata
	spi: mediatek: fix fifo rx mode
	ASoC: rt5631: Fix regcache sync errors on resume
	bpf, test: fix NULL pointer dereference on invalid expected_attach_type
	bpf: Fix tail_call_reachable rejection for interpreter when jit failed
	xdp, net: Fix use-after-free in bpf_xdp_link_release
	timers: Fix get_next_timer_interrupt() with no timers pending
	liquidio: Fix unintentional sign extension issue on left shift of u16
	s390/bpf: Perform r1 range checking before accessing jit->seen_reg[r1]
	bpf, sockmap: Fix potential memory leak on unlikely error case
	bpf, sockmap, tcp: sk_prot needs inuse_idx set for proc stats
	bpf, sockmap, udp: sk_prot needs inuse_idx set for proc stats
	bpftool: Check malloc return value in mount_bpffs_for_pin
	net: fix uninit-value in caif_seqpkt_sendmsg
	usb: hso: fix error handling code of hso_create_net_device
	dma-mapping: handle vmalloc addresses in dma_common_{mmap,get_sgtable}
	efi/tpm: Differentiate missing and invalid final event log table.
	net: decnet: Fix sleeping inside in af_decnet
	KVM: PPC: Book3S: Fix CONFIG_TRANSACTIONAL_MEM=n crash
	KVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak
	net: sched: fix memory leak in tcindex_partial_destroy_work
	sctp: trim optlen when it's a huge value in sctp_setsockopt
	netrom: Decrease sock refcount when sock timers expire
	scsi: iscsi: Fix iface sysfs attr detection
	scsi: target: Fix protect handling in WRITE SAME(32)
	spi: cadence: Correct initialisation of runtime PM again
	ACPI: Kconfig: Fix table override from built-in initrd
	bnxt_en: don't disable an already disabled PCI device
	bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
	bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in bnxt_fw_rset_task()
	bnxt_en: Validate vlan protocol ID on RX packets
	bnxt_en: Check abort error state in bnxt_half_open_nic()
	net: hisilicon: rename CACHE_LINE_MASK to avoid redefinition
	net/tcp_fastopen: fix data races around tfo_active_disable_stamp
	ALSA: hda: intel-dsp-cfg: add missing ElkhartLake PCI ID
	net: hns3: fix possible mismatches resp of mailbox
	net: hns3: fix rx VLAN offload state inconsistent issue
	spi: spi-bcm2835: Fix deadlock
	net/sched: act_skbmod: Skip non-Ethernet packets
	ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions
	ceph: don't WARN if we're still opening a session to an MDS
	nvme-pci: don't WARN_ON in nvme_reset_work if ctrl.state is not RESETTING
	Revert "USB: quirks: ignore remote wake-up on Fibocom L850-GL LTE modem"
	afs: Fix tracepoint string placement with built-in AFS
	r8169: Avoid duplicate sysfs entry creation error
	nvme: set the PRACT bit when using Write Zeroes with T10 PI
	sctp: update active_key for asoc when old key is being replaced
	tcp: disable TFO blackhole logic by default
	net: dsa: sja1105: make VID 4095 a bridge VLAN too
	net: sched: cls_api: Fix the the wrong parameter
	drm/panel: raspberrypi-touchscreen: Prevent double-free
	cifs: only write 64kb at a time when fallocating a small region of a file
	cifs: fix fallocate when trying to allocate a hole.
	proc: Avoid mixing integer types in mem_rw()
	mmc: core: Don't allocate IDA for OF aliases
	s390/ftrace: fix ftrace_update_ftrace_func implementation
	s390/boot: fix use of expolines in the DMA code
	ALSA: usb-audio: Add missing proc text entry for BESPOKEN type
	ALSA: usb-audio: Add registration quirk for JBL Quantum headsets
	ALSA: sb: Fix potential ABBA deadlock in CSP driver
	ALSA: hda/realtek: Fix pop noise and 2 Front Mic issues on a machine
	ALSA: hdmi: Expose all pins on MSI MS-7C94 board
	ALSA: pcm: Call substream ack() method upon compat mmap commit
	ALSA: pcm: Fix mmap capability check
	Revert "usb: renesas-xhci: Fix handling of unknown ROM state"
	usb: xhci: avoid renesas_usb_fw.mem when it's unusable
	xhci: Fix lost USB 2 remote wake
	KVM: PPC: Book3S: Fix H_RTAS rets buffer overflow
	KVM: PPC: Book3S HV Nested: Sanitise H_ENTER_NESTED TM state
	usb: hub: Disable USB 3 device initiated lpm if exit latency is too high
	usb: hub: Fix link power management max exit latency (MEL) calculations
	USB: usb-storage: Add LaCie Rugged USB3-FW to IGNORE_UAS
	usb: max-3421: Prevent corruption of freed memory
	usb: renesas_usbhs: Fix superfluous irqs happen after usb_pkt_pop()
	USB: serial: option: add support for u-blox LARA-R6 family
	USB: serial: cp210x: fix comments for GE CS1000
	USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick
	usb: gadget: Fix Unbalanced pm_runtime_enable in tegra_xudc_probe
	usb: dwc2: gadget: Fix GOUTNAK flow for Slave mode.
	usb: dwc2: gadget: Fix sending zero length packet in DDMA mode.
	usb: typec: stusb160x: register role switch before interrupt registration
	firmware/efi: Tell memblock about EFI iomem reservations
	tracepoints: Update static_call before tp_funcs when adding a tracepoint
	tracing/histogram: Rename "cpu" to "common_cpu"
	tracing: Fix bug in rb_per_cpu_empty() that might cause deadloop.
	tracing: Synthetic event field_pos is an index not a boolean
	btrfs: check for missing device in btrfs_trim_fs
	media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf()
	ixgbe: Fix packet corruption due to missing DMA sync
	bus: mhi: core: Validate channel ID when processing command completions
	posix-cpu-timers: Fix rearm racing against process tick
	selftest: use mmap instead of posix_memalign to allocate memory
	io_uring: explicitly count entries for poll reqs
	io_uring: remove double poll entry on arm failure
	userfaultfd: do not untag user pointers
	memblock: make for_each_mem_range() traverse MEMBLOCK_HOTPLUG regions
	hugetlbfs: fix mount mode command line processing
	rbd: don't hold lock_rwsem while running_list is being drained
	rbd: always kick acquire on "acquired" and "released" notifications
	misc: eeprom: at24: Always append device id even if label property is set.
	nds32: fix up stack guard gap
	driver core: Prevent warning when removing a device link from unregistered consumer
	drm: Return -ENOTTY for non-drm ioctls
	drm/amdgpu: update golden setting for sienna_cichlid
	net: dsa: mv88e6xxx: enable SerDes RX stats for Topaz
	net: dsa: mv88e6xxx: enable SerDes PCS register dump via ethtool -d on Topaz
	PCI: Mark AMD Navi14 GPU ATS as broken
	bonding: fix build issue
	skbuff: Release nfct refcount on napi stolen or re-used skbs
	Documentation: Fix intiramfs script name
	perf inject: Close inject.output on exit
	usb: ehci: Prevent missed ehci interrupts with edge-triggered MSI
	drm/i915/gvt: Clear d3_entered on elsp cmd submission.
	sfc: ensure correct number of XDP queues
	xhci: add xhci_get_virt_ep() helper
	skbuff: Fix build with SKB extensions disabled
	Linux 5.10.54

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ifd2823b47ab1544cd1f168b138624ffe060a471e
2021-07-28 15:23:47 +02:00
Dongliang Mu
115e4f5b64 usb: hso: fix error handling code of hso_create_net_device
[ Upstream commit a6ecfb39ba ]

The current error handling code of hso_create_net_device is
hso_free_net_device, no matter which errors lead to. For example,
WARNING in hso_free_net_device [1].

Fix this by refactoring the error handling code of
hso_create_net_device by handling different errors by different code.

[1] https://syzkaller.appspot.com/bug?id=66eff8d49af1b28370ad342787413e35bbe76efe

Reported-by: syzbot+44d53c7255bb1aea22d2@syzkaller.appspotmail.com
Fixes: 5fcfb6d0bf ("hso: fix bailout in error case of probe")
Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-07-28 14:35:38 +02:00
Maciej Żenczykowski
1702d2c8b7 FROMGIT: net: cdc_ncm: switch to eth%d interface naming
[ Upstream commit c1a3d40673 ]

This is meant to make the host side cdc_ncm interface consistently
named just like the older CDC protocols: cdc_ether & cdc_ecm
(and even rndis_host), which all use 'FLAG_ETHER | FLAG_POINTTOPOINT'.

include/linux/usb/usbnet.h:
  #define FLAG_ETHER	0x0020		/* maybe use "eth%d" names */
  #define FLAG_WLAN	0x0080		/* use "wlan%d" names */
  #define FLAG_WWAN	0x0400		/* use "wwan%d" names */
  #define FLAG_POINTTOPOINT 0x1000	/* possibly use "usb%d" names */

drivers/net/usb/usbnet.c @ line 1711:
  strcpy (net->name, "usb%d");
  ...
  // heuristic:  "usb%d" for links we know are two-host,
  // else "eth%d" when there's reasonable doubt.  userspace
  // can rename the link if it knows better.
  if ((dev->driver_info->flags & FLAG_ETHER) != 0 &&
      ((dev->driver_info->flags & FLAG_POINTTOPOINT) == 0 ||
       (net->dev_addr [0] & 0x02) == 0))
          strcpy (net->name, "eth%d");
  /* WLAN devices should always be named "wlan%d" */
  if ((dev->driver_info->flags & FLAG_WLAN) != 0)
          strcpy(net->name, "wlan%d");
  /* WWAN devices should always be named "wwan%d" */
  if ((dev->driver_info->flags & FLAG_WWAN) != 0)
          strcpy(net->name, "wwan%d");

So by using ETHER | POINTTOPOINT the interface naming is
either usb%d or eth%d based on the global uniqueness of the
mac address of the device.

Without this 2.5gbps ethernet dongles which all seem to use the cdc_ncm
driver end up being called usb%d instead of eth%d even though they're
definitely not two-host.  (All 1gbps & 5gbps ethernet usb dongles I've
tested don't hit this problem due to use of different drivers, primarily
r8152 and aqc111)

Fixes tag is based purely on git blame, and is really just here to make
sure this hits LTS branches newer than v4.5.

Cc: Lorenzo Colitti <lorenzo@google.com>
Fixes: 4d06dd537f ("cdc_ncm: do not call usbnet_link_change from cdc_ncm_bind")
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 11fac7e912 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-5.10.y&id=11fac7e9127078fe3275642742cf5e2336fa934a)
Bug: 181923048
Change-Id: If746c35d6a91c3071afbbca68466438fcd7d8f55
2021-07-08 04:01:26 +00:00
Greg Kroah-Hartman
194be71cc6 Linux 5.10.47
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE4n5dijQDou9mhzu83qZv95d3LNwFAmDcbDgACgkQ3qZv95d3
 LNwUuQ//VDlmBPk/3w1FYvg9N9q/t1GHkVJXmD8TY/ClLdJtgxPYeoRu1VNLR/xf
 Y2kwZEF07yMA88RME56Zwt3p+LBbacrp5MoNdzEA48kb7auGBPk1HIscBg2PXC+C
 AnlC/O4/NAW6Okb+lLFL7XFM4xrlDBkNr5yTz2HmQSQC3JFfov0FcrON3KKTL5Bi
 aeyWjhn1NnhkKCDaKUl7kKlCQ2x7buu/YmvJK2OdGmuLZVywzto76RS+Xx3X0CnK
 pPkmciZSS7Gxi6UJel/zza0UwlKg5+IhFzfYVt0nsTFMjk/4QStAoevu7TFnbVD3
 yM7nzJpAQmVLs/X9sC0rgg9rCBUyp9d4ddba8bCUqaxpPQfMObWI8S5F8tfzBnK/
 h8P5xfs8u4O1AzpRr+YSN2Hbvak47e/4c5UOvvYj6z8NaIEb7DGbaUv/JE5YRVZ0
 ZEVZ1auEpHcSVAGz6DUwuwzc8Rk0NdskES5DD53QxNLXDoF1CVdsD44xUuJH1/HA
 //3S1SWxvwF9UQ+w+sk/Z6pzUj+CdFigou3QzwB+vAZ04n0JawRSuqyijkCqFOP5
 88iCMgxZ5qAYJ1TzQ6gV7cA0tSbteBF/HERNmdadyGvse9KtxkaBAfFmvIpd9D8J
 fTepYVuneP9cGqaGDUtsqHzM5YLrIkCSxABjgIvpNTt0eJL5c2k=
 =TKhf
 -----END PGP SIGNATURE-----

Merge 5.10.47 into android12-5.10-lts

Changes in 5.10.47
	module: limit enabling module.sig_enforce
	Revert "drm/amdgpu/gfx9: fix the doorbell missing when in CGPG issue."
	Revert "drm/amdgpu/gfx10: enlarge CP_MEC_DOORBELL_RANGE_UPPER to cover full doorbell."
	drm: add a locked version of drm_is_current_master
	drm/nouveau: wait for moving fence after pinning v2
	drm/radeon: wait for moving fence after pinning
	drm/amdgpu: wait for moving fence after pinning
	ARM: 9081/1: fix gcc-10 thumb2-kernel regression
	mmc: meson-gx: use memcpy_to/fromio for dram-access-quirk
	MIPS: generic: Update node names to avoid unit addresses
	arm64: Ignore any DMA offsets in the max_zone_phys() calculation
	arm64: Force NO_BLOCK_MAPPINGS if crashkernel reservation is required
	spi: spi-nxp-fspi: move the register operation after the clock enable
	Revert "PCI: PM: Do not read power state in pci_enable_device_flags()"
	drm/vc4: hdmi: Move the HSM clock enable to runtime_pm
	drm/vc4: hdmi: Make sure the controller is powered in detect
	x86/entry: Fix noinstr fail in __do_fast_syscall_32()
	x86/xen: Fix noinstr fail in exc_xen_unknown_trap()
	locking/lockdep: Improve noinstr vs errors
	perf/x86/lbr: Remove cpuc->lbr_xsave allocation from atomic context
	perf/x86/intel/lbr: Zero the xstate buffer on allocation
	dmaengine: zynqmp_dma: Fix PM reference leak in zynqmp_dma_alloc_chan_resourc()
	dmaengine: stm32-mdma: fix PM reference leak in stm32_mdma_alloc_chan_resourc()
	dmaengine: xilinx: dpdma: Add missing dependencies to Kconfig
	dmaengine: xilinx: dpdma: Limit descriptor IDs to 16 bits
	mac80211: remove warning in ieee80211_get_sband()
	mac80211_hwsim: drop pending frames on stop
	cfg80211: call cfg80211_leave_ocb when switching away from OCB
	dmaengine: rcar-dmac: Fix PM reference leak in rcar_dmac_probe()
	dmaengine: mediatek: free the proper desc in desc_free handler
	dmaengine: mediatek: do not issue a new desc if one is still current
	dmaengine: mediatek: use GFP_NOWAIT instead of GFP_ATOMIC in prep_dma
	net: ipv4: Remove unneed BUG() function
	mac80211: drop multicast fragments
	net: ethtool: clear heap allocations for ethtool function
	inet: annotate data race in inet_send_prepare() and inet_dgram_connect()
	ping: Check return value of function 'ping_queue_rcv_skb'
	net: annotate data race in sock_error()
	inet: annotate date races around sk->sk_txhash
	net/packet: annotate data race in packet_sendmsg()
	net: phy: dp83867: perform soft reset and retain established link
	riscv32: Use medany C model for modules
	net: caif: fix memory leak in ldisc_open
	net/packet: annotate accesses to po->bind
	net/packet: annotate accesses to po->ifindex
	r8152: Avoid memcpy() over-reading of ETH_SS_STATS
	sh_eth: Avoid memcpy() over-reading of ETH_SS_STATS
	r8169: Avoid memcpy() over-reading of ETH_SS_STATS
	KVM: selftests: Fix kvm_check_cap() assertion
	net: qed: Fix memcpy() overflow of qed_dcbx_params()
	mac80211: reset profile_periodicity/ema_ap
	mac80211: handle various extensible elements correctly
	recordmcount: Correct st_shndx handling
	PCI: Add AMD RS690 quirk to enable 64-bit DMA
	net: ll_temac: Add memory-barriers for TX BD access
	net: ll_temac: Avoid ndo_start_xmit returning NETDEV_TX_BUSY
	perf/x86: Track pmu in per-CPU cpu_hw_events
	pinctrl: stm32: fix the reported number of GPIO lines per bank
	i2c: i801: Ensure that SMBHSTSTS_INUSE_STS is cleared when leaving i801_access
	gpiolib: cdev: zero padding during conversion to gpioline_info_changed
	scsi: sd: Call sd_revalidate_disk() for ioctl(BLKRRPART)
	nilfs2: fix memory leak in nilfs_sysfs_delete_device_group
	s390/stack: fix possible register corruption with stack switch helper
	KVM: do not allow mapping valid but non-reference-counted pages
	i2c: robotfuzz-osif: fix control-request directions
	ceph: must hold snap_rwsem when filling inode for async create
	kthread_worker: split code for canceling the delayed work timer
	kthread: prevent deadlock when kthread_mod_delayed_work() races with kthread_cancel_delayed_work_sync()
	x86/fpu: Preserve supervisor states in sanitize_restored_user_xstate()
	x86/fpu: Make init_fpstate correct with optimized XSAVE
	mm: add VM_WARN_ON_ONCE_PAGE() macro
	mm/rmap: remove unneeded semicolon in page_not_mapped()
	mm/rmap: use page_not_mapped in try_to_unmap()
	mm, thp: use head page in __migration_entry_wait()
	mm/thp: fix __split_huge_pmd_locked() on shmem migration entry
	mm/thp: make is_huge_zero_pmd() safe and quicker
	mm/thp: try_to_unmap() use TTU_SYNC for safe splitting
	mm/thp: fix vma_address() if virtual address below file offset
	mm/thp: fix page_address_in_vma() on file THP tails
	mm/thp: unmap_mapping_page() to fix THP truncate_cleanup_page()
	mm: thp: replace DEBUG_VM BUG with VM_WARN when unmap fails for split
	mm: page_vma_mapped_walk(): use page for pvmw->page
	mm: page_vma_mapped_walk(): settle PageHuge on entry
	mm: page_vma_mapped_walk(): use pmde for *pvmw->pmd
	mm: page_vma_mapped_walk(): prettify PVMW_MIGRATION block
	mm: page_vma_mapped_walk(): crossing page table boundary
	mm: page_vma_mapped_walk(): add a level of indentation
	mm: page_vma_mapped_walk(): use goto instead of while (1)
	mm: page_vma_mapped_walk(): get vma_address_end() earlier
	mm/thp: fix page_vma_mapped_walk() if THP mapped by ptes
	mm/thp: another PVMW_SYNC fix in page_vma_mapped_walk()
	mm, futex: fix shared futex pgoff on shmem huge page
	KVM: SVM: Call SEV Guest Decommission if ASID binding fails
	swiotlb: manipulate orig_addr when tlb_addr has offset
	netfs: fix test for whether we can skip read when writing beyond EOF
	Revert "drm: add a locked version of drm_is_current_master"
	certs: Add EFI_CERT_X509_GUID support for dbx entries
	certs: Move load_system_certificate_list to a common function
	certs: Add ability to preload revocation certs
	integrity: Load mokx variables into the blacklist keyring
	Linux 5.10.47

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I68f731ad78a5db003c41093e4faf59f6f9f2e446
2021-06-30 19:38:46 +02:00
Kees Cook
a10856ea60 r8152: Avoid memcpy() over-reading of ETH_SS_STATS
[ Upstream commit 99718abdc0 ]

In preparation for FORTIFY_SOURCE performing compile-time and run-time
field bounds checking for memcpy(), memmove(), and memset(), avoid
intentionally reading across neighboring array fields.

The memcpy() is copying the entire structure, not just the first array.
Adjust the source argument so the compiler can do appropriate bounds
checking.

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-06-30 08:47:22 -04:00
Tao Huang
582f79266f Merge remote branch 'android12-5.10' of https://android.googlesource.com/kernel/common
* android12-5.10: (2274 commits)
  FROMGIT: mm: slub: move sysfs slab alloc/free interfaces to debugfs
  ANDROID: gki - CONFIG_NET_SCH_FQ=y
  ANDROID: GKI: Kconfig.gki: Add GKI_HIDDEN_ETHERNET_CONFIGS
  FROMLIST: media: Kconfig: Fix DVB_CORE can't be selected as module
  ANDROID: Update ABI and symbol list
  Revert "net: usb: cdc_ncm: don't spew notifications"
  ANDROID: Fips 140: move fips symbols entirely in own list
  ANDROID: core of xt_IDLETIMER send_nl_msg support
  ANDROID: start to re-add xt_IDLETIMER send_nl_msg support
  ANDROID: add fips140.ko symbols to module ABI
  ANDROID: inject correct HMAC digest into fips140.ko at build time
  ANDROID: crypto: fips140 - perform load time integrity check
  FROMLIST: crypto: shash - stop comparing function pointers to avoid breaking CFI
  ANDROID: arm64: module: preserve RELA sections for FIPS140 integrity selfcheck
  ANDROID: arm64: simd: omit capability check in may_use_simd()
  ANDROID: kbuild: lto: permit the use of .a archives in LTO modules
  ANDROID: arm64: only permit certain alternatives in the FIPS140 module
  ANDROID: crypto: lib/aes - add vendor hooks for AES library routines
  ANDROID: crypto: lib/sha256 - add vendor hook for sha256() routine
  UPSTREAM: KVM: arm64: Mark the host stage-2 memory pools static
  ...

Conflicts:
	drivers/mmc/core/mmc_ops.c
	drivers/usb/gadget/function/f_uac1.c
	drivers/usb/gadget/function/f_uac2.c
	drivers/usb/gadget/function/f_uvc.c
2021-06-25 11:32:04 +08:00
Greg Kroah-Hartman
948d38f94d This is the 5.10.46 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmDTLFUACgkQONu9yGCS
 aT5eThAApQAh1A++P729NJOTeoewU5YH0/1c+ZVN4nfxxEOApeBpfA4tTDvfHJeI
 MYx10AI1UiLPHfLtHI5exvG00/Ll4lb0fs2bpVL2b/SQKCm2G3kZf7xOdJOBtoy4
 DEaTORhmZ001weapZN+G4oz+FEnNZEyR/rThqKTA0G/PS1MxNl4ZBhY9BrySpH1V
 Cq7OFX18IbTh3/XXmcPotZa2sXE6Z+jjWQb5GLZ+ZjicbzgLiWWcnrm8bzLahVC4
 N7TToeGv9zOLKgrE+HVR52UoFB1+2vRUEaRVOiFbDViLjoF5KWw5rAzioTCvfXW+
 g/ldoAuDQBNGUrYfVUrSNwj5JuWCI2Cltt//9f/xGfPPn0HNjAxSM7ExpnMNVhVK
 1gjTco+0kWzv2BGjgpNAe7+aLka5sQkLEOYlSExI6VVuF5CCcIywWjWZ6zHG0CF1
 7kW8CfINV4BFP+IYw5Gnt5K3hUTulDt+alX9WgsdPxpsZ9gbIscO1/awnRrAyDyO
 2EeCbZ3WWSuvFL6qAjJERiDbhDPRaZV0cwGPxzLZ7NN8ZPXLxTVv7Nc6QoiNXYkk
 E+LYcMua9dxFXjoHA0imKxlxqJD64mh3oUkdpTGOwIxrE5bavnKGrO2B3Nl7zWVn
 u8mazeKHWpJ+t+dDZ47CjrNTul0SOvryKmog//DCkvAIYSjRzVc=
 =WRWw
 -----END PGP SIGNATURE-----

Merge 5.10.46 into android12-5.10-lts

Changes in 5.10.46
	dmaengine: idxd: add missing dsa driver unregister
	dmaengine: fsl-dpaa2-qdma: Fix error return code in two functions
	dmaengine: xilinx: dpdma: initialize registers before request_irq
	dmaengine: ALTERA_MSGDMA depends on HAS_IOMEM
	dmaengine: QCOM_HIDMA_MGMT depends on HAS_IOMEM
	dmaengine: SF_PDMA depends on HAS_IOMEM
	dmaengine: stedma40: add missing iounmap() on error in d40_probe()
	afs: Fix an IS_ERR() vs NULL check
	mm/memory-failure: make sure wait for page writeback in memory_failure
	kvm: LAPIC: Restore guard to prevent illegal APIC register access
	fanotify: fix copy_event_to_user() fid error clean up
	batman-adv: Avoid WARN_ON timing related checks
	mac80211: fix skb length check in ieee80211_scan_rx()
	mlxsw: reg: Spectrum-3: Enforce lowest max-shaper burst size of 11
	mlxsw: core: Set thermal zone polling delay argument to real value at init
	libbpf: Fixes incorrect rx_ring_setup_done
	net: ipv4: fix memory leak in netlbl_cipsov4_add_std
	vrf: fix maximum MTU
	net: rds: fix memory leak in rds_recvmsg
	net: dsa: felix: re-enable TX flow control in ocelot_port_flush()
	net: lantiq: disable interrupt before sheduling NAPI
	netfilter: nft_fib_ipv6: skip ipv6 packets from any to link-local
	ice: add ndo_bpf callback for safe mode netdev ops
	ice: parameterize functions responsible for Tx ring management
	udp: fix race between close() and udp_abort()
	rtnetlink: Fix regression in bridge VLAN configuration
	net/sched: act_ct: handle DNAT tuple collision
	net/mlx5e: Remove dependency in IPsec initialization flows
	net/mlx5e: Fix page reclaim for dead peer hairpin
	net/mlx5: Consider RoCE cap before init RDMA resources
	net/mlx5: DR, Allow SW steering for sw_owner_v2 devices
	net/mlx5: DR, Don't use SW steering when RoCE is not supported
	net/mlx5e: Block offload of outer header csum for UDP tunnels
	netfilter: synproxy: Fix out of bounds when parsing TCP options
	mptcp: Fix out of bounds when parsing TCP options
	sch_cake: Fix out of bounds when parsing TCP options and header
	mptcp: try harder to borrow memory from subflow under pressure
	mptcp: do not warn on bad input from the network
	selftests: mptcp: enable syncookie only in absence of reorders
	alx: Fix an error handling path in 'alx_probe()'
	cxgb4: fix endianness when flashing boot image
	cxgb4: fix sleep in atomic when flashing PHY firmware
	cxgb4: halt chip before flashing PHY firmware image
	net: stmmac: dwmac1000: Fix extended MAC address registers definition
	net: make get_net_ns return error if NET_NS is disabled
	net: qualcomm: rmnet: Update rmnet device MTU based on real device
	net: qualcomm: rmnet: don't over-count statistics
	ethtool: strset: fix message length calculation
	qlcnic: Fix an error handling path in 'qlcnic_probe()'
	netxen_nic: Fix an error handling path in 'netxen_nic_probe()'
	cxgb4: fix wrong ethtool n-tuple rule lookup
	ipv4: Fix device used for dst_alloc with local routes
	net: qrtr: fix OOB Read in qrtr_endpoint_post
	bpf: Fix leakage under speculation on mispredicted branches
	ptp: improve max_adj check against unreasonable values
	net: cdc_ncm: switch to eth%d interface naming
	lantiq: net: fix duplicated skb in rx descriptor ring
	net: usb: fix possible use-after-free in smsc75xx_bind
	net: fec_ptp: fix issue caused by refactor the fec_devtype
	net: ipv4: fix memory leak in ip_mc_add1_src
	net/af_unix: fix a data-race in unix_dgram_sendmsg / unix_release_sock
	net/mlx5: E-Switch, Read PF mac address
	net/mlx5: E-Switch, Allow setting GUID for host PF vport
	net/mlx5: Reset mkey index on creation
	be2net: Fix an error handling path in 'be_probe()'
	net: hamradio: fix memory leak in mkiss_close
	net: cdc_eem: fix tx fixup skb leak
	cxgb4: fix wrong shift.
	bnxt_en: Rediscover PHY capabilities after firmware reset
	bnxt_en: Fix TQM fastpath ring backing store computation
	bnxt_en: Call bnxt_ethtool_free() in bnxt_init_one() error path
	icmp: don't send out ICMP messages with a source address of 0.0.0.0
	net: ethernet: fix potential use-after-free in ec_bhf_remove
	regulator: cros-ec: Fix error code in dev_err message
	regulator: bd70528: Fix off-by-one for buck123 .n_voltages setting
	platform/x86: thinkpad_acpi: Add X1 Carbon Gen 9 second fan support
	ASoC: rt5659: Fix the lost powers for the HDA header
	phy: phy-mtk-tphy: Fix some resource leaks in mtk_phy_init()
	ASoC: fsl-asoc-card: Set .owner attribute when registering card.
	regulator: rtmv20: Fix to make regcache value first reading back from HW
	spi: spi-zynq-qspi: Fix some wrong goto jumps & missing error code
	sched/pelt: Ensure that *_sum is always synced with *_avg
	ASoC: tas2562: Fix TDM_CFG0_SAMPRATE values
	spi: stm32-qspi: Always wait BUSY bit to be cleared in stm32_qspi_wait_cmd()
	regulator: rt4801: Fix NULL pointer dereference if priv->enable_gpios is NULL
	ASoC: rt5682: Fix the fast discharge for headset unplugging in soundwire mode
	pinctrl: ralink: rt2880: avoid to error in calls is pin is already enabled
	drm/sun4i: dw-hdmi: Make HDMI PHY into a platform device
	ASoC: qcom: lpass-cpu: Fix pop noise during audio capture begin
	radeon: use memcpy_to/fromio for UVD fw upload
	hwmon: (scpi-hwmon) shows the negative temperature properly
	mm: relocate 'write_protect_seq' in struct mm_struct
	irqchip/gic-v3: Workaround inconsistent PMR setting on NMI entry
	bpf: Inherit expanded/patched seen count from old aux data
	bpf: Do not mark insn as seen under speculative path verification
	can: bcm: fix infoleak in struct bcm_msg_head
	can: bcm/raw/isotp: use per module netdevice notifier
	can: j1939: fix Use-after-Free, hold skb ref while in use
	can: mcba_usb: fix memory leak in mcba_usb
	usb: core: hub: Disable autosuspend for Cypress CY7C65632
	usb: chipidea: imx: Fix Battery Charger 1.2 CDP detection
	tracing: Do not stop recording cmdlines when tracing is off
	tracing: Do not stop recording comms if the trace file is being read
	tracing: Do no increment trace_clock_global() by one
	PCI: Mark TI C667X to avoid bus reset
	PCI: Mark some NVIDIA GPUs to avoid bus reset
	PCI: aardvark: Fix kernel panic during PIO transfer
	PCI: Add ACS quirk for Broadcom BCM57414 NIC
	PCI: Work around Huawei Intelligent NIC VF FLR erratum
	KVM: x86: Immediately reset the MMU context when the SMM flag is cleared
	KVM: x86/mmu: Calculate and check "full" mmu_role for nested MMU
	KVM: X86: Fix x86_emulator slab cache leak
	s390/mcck: fix calculation of SIE critical section size
	s390/ap: Fix hanging ioctl caused by wrong msg counter
	ARCv2: save ABI registers across signal handling
	x86/mm: Avoid truncating memblocks for SGX memory
	x86/process: Check PF_KTHREAD and not current->mm for kernel threads
	x86/ioremap: Map EFI-reserved memory as encrypted for SEV
	x86/pkru: Write hardware init value to PKRU when xstate is init
	x86/fpu: Prevent state corruption in __fpu__restore_sig()
	x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
	x86/fpu: Reset state for all signal restore failures
	crash_core, vmcoreinfo: append 'SECTION_SIZE_BITS' to vmcoreinfo
	dmaengine: pl330: fix wrong usage of spinlock flags in dma_cyclc
	mac80211: Fix NULL ptr deref for injected rate info
	cfg80211: make certificate generation more robust
	cfg80211: avoid double free of PMSR request
	drm/amdgpu/gfx10: enlarge CP_MEC_DOORBELL_RANGE_UPPER to cover full doorbell.
	drm/amdgpu/gfx9: fix the doorbell missing when in CGPG issue.
	net: ll_temac: Make sure to free skb when it is completely used
	net: ll_temac: Fix TX BD buffer overwrite
	net: bridge: fix vlan tunnel dst null pointer dereference
	net: bridge: fix vlan tunnel dst refcnt when egressing
	mm/swap: fix pte_same_as_swp() not removing uffd-wp bit when compare
	mm/slub: clarify verification reporting
	mm/slub: fix redzoning for small allocations
	mm/slub: actually fix freelist pointer vs redzoning
	mm/slub.c: include swab.h
	net: stmmac: disable clocks in stmmac_remove_config_dt()
	net: fec_ptp: add clock rate zero check
	tools headers UAPI: Sync linux/in.h copy with the kernel sources
	perf beauty: Update copy of linux/socket.h with the kernel sources
	usb: dwc3: debugfs: Add and remove endpoint dirs dynamically
	usb: dwc3: core: fix kernel panic when do reboot
	Linux 5.10.46

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I99f37c9f257f90ccdb091306f3d4cfb7c32e3880
2021-06-23 17:53:08 +02:00
Linyu Yuan
05b2b9f7d2 net: cdc_eem: fix tx fixup skb leak
[ Upstream commit c3b26fdf1b ]

when usbnet transmit a skb, eem fixup it in eem_tx_fixup(),
if skb_copy_expand() failed, it return NULL,
usbnet_start_xmit() will have no chance to free original skb.

fix it by free orginal skb in eem_tx_fixup() first,
then check skb clone status, if failed, return NULL to usbnet.

Fixes: 9f722c0978 ("usbnet: CDC EEM support (v5)")
Signed-off-by: Linyu Yuan <linyyuan@codeaurora.org>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-06-23 14:42:47 +02:00
Dongliang Mu
570a52cf3e net: usb: fix possible use-after-free in smsc75xx_bind
[ Upstream commit 56b786d866 ]

The commit 46a8b29c63 ("net: usb: fix memory leak in smsc75xx_bind")
fails to clean up the work scheduled in smsc75xx_reset->
smsc75xx_set_multicast, which leads to use-after-free if the work is
scheduled to start after the deallocation. In addition, this patch
also removes a dangling pointer - dev->data[0].

This patch calls cancel_work_sync to cancel the scheduled work and set
the dangling pointer to NULL.

Fixes: 46a8b29c63 ("net: usb: fix memory leak in smsc75xx_bind")
Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-06-23 14:42:46 +02:00
Maciej Żenczykowski
11fac7e912 net: cdc_ncm: switch to eth%d interface naming
[ Upstream commit c1a3d40673 ]

This is meant to make the host side cdc_ncm interface consistently
named just like the older CDC protocols: cdc_ether & cdc_ecm
(and even rndis_host), which all use 'FLAG_ETHER | FLAG_POINTTOPOINT'.

include/linux/usb/usbnet.h:
  #define FLAG_ETHER	0x0020		/* maybe use "eth%d" names */
  #define FLAG_WLAN	0x0080		/* use "wlan%d" names */
  #define FLAG_WWAN	0x0400		/* use "wwan%d" names */
  #define FLAG_POINTTOPOINT 0x1000	/* possibly use "usb%d" names */

drivers/net/usb/usbnet.c @ line 1711:
  strcpy (net->name, "usb%d");
  ...
  // heuristic:  "usb%d" for links we know are two-host,
  // else "eth%d" when there's reasonable doubt.  userspace
  // can rename the link if it knows better.
  if ((dev->driver_info->flags & FLAG_ETHER) != 0 &&
      ((dev->driver_info->flags & FLAG_POINTTOPOINT) == 0 ||
       (net->dev_addr [0] & 0x02) == 0))
          strcpy (net->name, "eth%d");
  /* WLAN devices should always be named "wlan%d" */
  if ((dev->driver_info->flags & FLAG_WLAN) != 0)
          strcpy(net->name, "wlan%d");
  /* WWAN devices should always be named "wwan%d" */
  if ((dev->driver_info->flags & FLAG_WWAN) != 0)
          strcpy(net->name, "wwan%d");

So by using ETHER | POINTTOPOINT the interface naming is
either usb%d or eth%d based on the global uniqueness of the
mac address of the device.

Without this 2.5gbps ethernet dongles which all seem to use the cdc_ncm
driver end up being called usb%d instead of eth%d even though they're
definitely not two-host.  (All 1gbps & 5gbps ethernet usb dongles I've
tested don't hit this problem due to use of different drivers, primarily
r8152 and aqc111)

Fixes tag is based purely on git blame, and is really just here to make
sure this hits LTS branches newer than v4.5.

Cc: Lorenzo Colitti <lorenzo@google.com>
Fixes: 4d06dd537f ("cdc_ncm: do not call usbnet_link_change from cdc_ncm_bind")
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-06-23 14:42:45 +02:00
Greg Kroah-Hartman
1ac622485e Revert "net: usb: cdc_ncm: don't spew notifications"
This reverts commit de658a195e as it
breaks the abi at the moment.

We will bring it back in a bit, when the next kabi break happens.

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I2bfa5e180f377af552230ff170ea0a45fef1347e
2021-06-12 14:48:15 +02:00
Grant Grundler
70df000fb8 net: usb: cdc_ncm: don't spew notifications
[ Upstream commit de658a195e ]

RTL8156 sends notifications about every 32ms.
Only display/log notifications when something changes.

This issue has been reported by others:
	https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1832472
	https://lkml.org/lkml/2020/8/27/1083

...
[785962.779840] usb 1-1: new high-speed USB device number 5 using xhci_hcd
[785962.929944] usb 1-1: New USB device found, idVendor=0bda, idProduct=8156, bcdDevice=30.00
[785962.929949] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=6
[785962.929952] usb 1-1: Product: USB 10/100/1G/2.5G LAN
[785962.929954] usb 1-1: Manufacturer: Realtek
[785962.929956] usb 1-1: SerialNumber: 000000001
[785962.991755] usbcore: registered new interface driver cdc_ether
[785963.017068] cdc_ncm 1-1:2.0: MAC-Address: 00:24:27:88:08:15
[785963.017072] cdc_ncm 1-1:2.0: setting rx_max = 16384
[785963.017169] cdc_ncm 1-1:2.0: setting tx_max = 16384
[785963.017682] cdc_ncm 1-1:2.0 usb0: register 'cdc_ncm' at usb-0000:00:14.0-1, CDC NCM, 00:24:27:88:08:15
[785963.019211] usbcore: registered new interface driver cdc_ncm
[785963.023856] usbcore: registered new interface driver cdc_wdm
[785963.025461] usbcore: registered new interface driver cdc_mbim
[785963.038824] cdc_ncm 1-1:2.0 enx002427880815: renamed from usb0
[785963.089586] cdc_ncm 1-1:2.0 enx002427880815: network connection: disconnected
[785963.121673] cdc_ncm 1-1:2.0 enx002427880815: network connection: disconnected
[785963.153682] cdc_ncm 1-1:2.0 enx002427880815: network connection: disconnected
...

This is about 2KB per second and will overwrite all contents of a 1MB
dmesg buffer in under 10 minutes rendering them useless for debugging
many kernel problems.

This is also an extra 180 MB/day in /var/logs (or 1GB per week) rendering
the majority of those logs useless too.

When the link is up (expected state), spew amount is >2x higher:
...
[786139.600992] cdc_ncm 2-1:2.0 enx002427880815: network connection: connected
[786139.632997] cdc_ncm 2-1:2.0 enx002427880815: 2500 mbit/s downlink 2500 mbit/s uplink
[786139.665097] cdc_ncm 2-1:2.0 enx002427880815: network connection: connected
[786139.697100] cdc_ncm 2-1:2.0 enx002427880815: 2500 mbit/s downlink 2500 mbit/s uplink
[786139.729094] cdc_ncm 2-1:2.0 enx002427880815: network connection: connected
[786139.761108] cdc_ncm 2-1:2.0 enx002427880815: 2500 mbit/s downlink 2500 mbit/s uplink
...

Chrome OS cannot support RTL8156 until this is fixed.

Signed-off-by: Grant Grundler <grundler@chromium.org>
Reviewed-by: Hayes Wang <hayeswang@realtek.com>
Link: https://lore.kernel.org/r/20210120011208.3768105-1-grundler@chromium.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-06-10 13:39:13 +02:00
Johan Hovold
c1febac448 net: hso: bail out on interrupt URB allocation failure
commit 4d52ebc7ac upstream.

Commit 31db0dbd72 ("net: hso: check for allocation failure in
hso_create_bulk_serial_device()") recently started returning an error
when the driver fails to allocate resources for the interrupt endpoint
and tiocmget functionality.

For consistency let's bail out from probe also if the URB allocation
fails.

Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-06-03 09:00:51 +02:00
Dan Carpenter
8eaca8d1ca net: hso: check for allocation failure in hso_create_bulk_serial_device()
[ Upstream commit 31db0dbd72 ]

In current kernels, small allocations never actually fail so this
patch shouldn't affect runtime.

Originally this error handling code written with the idea that if
the "serial->tiocmget" allocation failed, then we would continue
operating instead of bailing out early.  But in later years we added
an unchecked dereference on the next line.

	serial->tiocmget->serial_state_notification = kzalloc();
        ^^^^^^^^^^^^^^^^^^

Since these allocations are never going fail in real life, this is
mostly a philosophical debate, but I think bailing out early is the
correct behavior that the user would want.  And generally it's safer to
bail as soon an error happens.

Fixes: af0de1303c ("usb: hso: obey DMA rules in tiocmget")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Johan Hovold <johan@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-06-03 09:00:47 +02:00
Pavel Skripkin
635ac38b36 net: usb: fix memory leak in smsc75xx_bind
commit 46a8b29c63 upstream.

Syzbot reported memory leak in smsc75xx_bind().
The problem was is non-freed memory in case of
errors after memory allocation.

backtrace:
  [<ffffffff84245b62>] kmalloc include/linux/slab.h:556 [inline]
  [<ffffffff84245b62>] kzalloc include/linux/slab.h:686 [inline]
  [<ffffffff84245b62>] smsc75xx_bind+0x7a/0x334 drivers/net/usb/smsc75xx.c:1460
  [<ffffffff82b5b2e6>] usbnet_probe+0x3b6/0xc30 drivers/net/usb/usbnet.c:1728

Fixes: d0cad87170 ("smsc75xx: SMSC LAN75xx USB gigabit ethernet adapter driver")
Cc: stable@kernel.vger.org
Reported-and-tested-by: syzbot+b558506ba8165425fee2@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-06-03 09:00:35 +02:00
Johan Hovold
47da4f6142 net: hso: fix control-request directions
commit 1a6e9a9c68 upstream.

The direction of the pipe argument must match the request-type direction
bit or control requests may fail depending on the host-controller-driver
implementation.

Fix the tiocmset and rfkill requests which erroneously used
usb_rcvctrlpipe().

Fixes: 72dc1c096c ("HSO: add option hso driver")
Cc: stable@vger.kernel.org      # 2.6.27
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-06-03 09:00:28 +02:00
Phillip Potter
2e68890993 net: usb: ax88179_178a: initialize local variables before use
commit bd78980be1 upstream.

Use memset to initialize local array in drivers/net/usb/ax88179_178a.c, and
also set a local u16 and u32 variable to 0. Fixes a KMSAN found uninit-value bug
reported by syzbot at:
https://syzkaller.appspot.com/bug?id=00371c73c72f72487c1d0bfe0cc9d00de339d5aa

Reported-by: syzbot+4993e4a0e237f1b53747@syzkaller.appspotmail.com
Signed-off-by: Phillip Potter <phil@philpotter.co.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-05-07 11:04:31 +02:00
Tao Huang
88c22e1beb Merge remote branch 'android12-5.10' of https://android.googlesource.com/kernel/common
* android12-5.10: (966 commits)
  ANDROID: Support disabling symbol trimming
  ANDROID: Incremental fs: Fix pseudo-file attributes
  ANDROID: sched: Fix missing RQCF_UPDATED in migrate_tasks
  FROMLIST: mm, thp: Relax the VM_DENYWRITE constraint on file-backed THPs
  ANDROID: GKI: Update the generic symbol list
  ANDROID: ABI: Add symbols for crypto
  ANDROID: ABI: Update the ABI XML
  Revert "ANDROID: GKI: Change UCLAMP_BUCKETS_COUNT to 20"
  ANDROID: vendor_hooks: Add hook for binder
  UPSTREAM: crypto: arm/blake2s - fix for big endian
  UPSTREAM: crypto: arm/blake2b - drop unnecessary return statement
  FROMGIT: kasan, arm64: tests supports for HW_TAGS async mode
  FROMGIT: arm64: mte: Report async tag faults before suspend
  FROMGIT: arm64: mte: Enable async tag check fault
  FROMGIT: arm64: mte: Conditionally compile mte_enable_kernel_*()
  ANDROID: ABI: Update the ABI xml
  ANDROID: ABI: Update the generic symbol list
  ANDROID: selinux: add vendor hook in selinux
  FROMGIT: arm64: mte: Enable TCO in functions that can read beyond buffer limits
  ANDROID: sched: Add vendor hooks for update_load_avg
  ...

Change-Id: I74731b47c1f6cd67cea9622113833b3f8c994544
2021-05-03 19:52:23 +08:00
Johan Hovold
90642ee9eb net: hso: fix NULL-deref on disconnect regression
commit 2ad5692db7 upstream.

Commit 8a12f88361 ("net: hso: fix null-ptr-deref during tty device
unregistration") fixed the racy minor allocation reported by syzbot, but
introduced an unconditional NULL-pointer dereference on every disconnect
instead.

Specifically, the serial device table must no longer be accessed after
the minor has been released by hso_serial_tty_unregister().

Fixes: 8a12f88361 ("net: hso: fix null-ptr-deref during tty device unregistration")
Cc: stable@vger.kernel.org
Cc: Anirudh Rayabharam <mail@anirudhrb.com>
Reported-by: Leonardo Antoniazzi <leoanto@aruba.it>
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Anirudh Rayabharam <mail@anirudhrb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-04-28 13:40:02 +02:00
Tao Huang
d648938407 Merge remote branch 'android12-5.10' of https://android.googlesource.com/kernel/common
* android12-5.10: (1647 commits)
  FROMGIT: mm/page_owner: record the timestamp of all pages during free
  UPSTREAM: mm/page_io: use pr_alert_ratelimited for swap read/write errors
  ANDROID: roll back xt_IDLETIMER to 5.10.21 upstream/vanilla version
  ANDROID: qcom: Add ip, rtnl and free related symbols
  FROMGIT: power: supply: Fix build error when CONFIG_POWER_SUPPLY is not enabled.
  FROMGIT: usb: dwc3: gadget: modify the scale in vbus_draw callback
  BACKPORT: FROMLIST: usb: dwc3: gadget: Clear DEP flags after stop transfers in ep disable
  FROMLIST: Makefile: fix GDB warning with CONFIG_RELR
  ANDROID: refresh ABI XML before enabling KMI enforcement
  Revert "Revert "ANDROID: GKI: Enable bounds sanitizer""
  Revert "ANDROID: Revert "f2fs: fix to tag FIEMAP_EXTENT_MERGED in f2fs_fiemap()""
  ANDROID: Enforce KMI stability
  ANDROID: enable options prior to enforcing KMI
  Revert "ANDROID: GKI: temporarily disable LTO/CFI"
  ANDROID: gki_defconfig: Enable NET_CLS_{BASIC,TCINDEX,MATCHALL} & NET_ACT_{GACT,MIRRED}
  FROMLIST: selftests: Add a MREMAP_DONTUNMAP selftest for shmem
  FROMLIST: mm: Extend MREMAP_DONTUNMAP to non-anonymous mappings
  ANDROID: GKI: enable CONFIG_CMA_SYSFS
  ANDROID: make cma_sysfs experimental
  FROMLIST: mm: cma: support sysfs
  ...

Change-Id: I6145eddeb253bea33164fc909e7790d30f17ef1f
2021-04-25 18:33:22 +08:00
Anirudh Rayabharam
dc195928d7 net: hso: fix null-ptr-deref during tty device unregistration
commit 8a12f88361 upstream.

Multiple ttys try to claim the same the minor number causing a double
unregistration of the same device. The first unregistration succeeds
but the next one results in a null-ptr-deref.

The get_free_serial_index() function returns an available minor number
but doesn't assign it immediately. The assignment is done by the caller
later. But before this assignment, calls to get_free_serial_index()
would return the same minor number.

Fix this by modifying get_free_serial_index to assign the minor number
immediately after one is found to be and rename it to obtain_minor()
to better reflect what it does. Similary, rename set_serial_by_index()
to release_minor() and modify it to free up the minor number of the
given hso_serial. Every obtain_minor() should have corresponding
release_minor() call.

Fixes: 72dc1c096c ("HSO: add option hso driver")
Reported-by: syzbot+c49fe6089f295a05e6f8@syzkaller.appspotmail.com
Tested-by: syzbot+c49fe6089f295a05e6f8@syzkaller.appspotmail.com
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Anirudh Rayabharam <mail@anirudhrb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-04-14 08:42:00 +02:00
Hayes Wang
961d9a6e47 r8152: limit the RX buffer size of RTL8153A for USB 2.0
[ Upstream commit f91a50d8b5 ]

If the USB host controller is EHCI, the throughput is reduced from
300Mb/s to 60Mb/s, when the rx buffer size is modified from 16K to
32K.

According to the EHCI spec, the maximum size of the qTD is 20K.
Therefore, when the driver uses more than 20K buffer, the latency
time of EHCI would be increased. And, it let the RTL8153A get worse
throughput.

However, the driver uses alloc_pages() for rx buffer, so I limit
the rx buffer to 16K rather than 20K.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=205923
Fixes: ec5791c202 ("r8152: separate the rx buffer size")
Reported-by: Robert Davies <robdavies1977@gmail.com>
Signed-off-by: Hayes Wang <hayeswang@realtek.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-03-30 14:32:02 +02:00
Johan Hovold
421e0d7310 net: cdc-phonet: fix data-interface release on probe failure
[ Upstream commit c79a707072 ]

Set the disconnected flag before releasing the data interface in case
netdev registration fails to avoid having the disconnect callback try to
deregister the never registered netdev (and trigger a WARN_ON()).

Fixes: 87cf65601e ("USB host CDC Phonet network interface driver")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-03-30 14:32:02 +02:00
Hayes Wang
18f27fc6bc Revert "r8152: adjust the settings about MAC clock speed down for RTL8153"
[ Upstream commit 4b5dc1a94d ]

This reverts commit 134f98bcf1.

The r8153_mac_clk_spd() is used for RTL8153A only, because the register
table of RTL8153B is different from RTL8153A. However, this function would
be called when RTL8153B calls r8153_first_init() and r8153_enter_oob().
That causes RTL8153B becomes unstable when suspending and resuming. The
worst case may let the device stop working.

Besides, revert this commit to disable MAC clock speed down for RTL8153A.
It would avoid the known issue when enabling U1. The data of the first
control transfer may be wrong when exiting U1.

Signed-off-by: Hayes Wang <hayeswang@realtek.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-03-30 14:31:48 +02:00
Daniele Palmas
6ed0a2cafd net: usb: qmi_wwan: allow qmimux add/del with master up
commit 6c59cff38e upstream.

There's no reason for preventing the creation and removal
of qmimux network interfaces when the underlying interface
is up.

This makes qmi_wwan mux implementation more similar to the
rmnet one, simplifying userspace management of the same
logical interfaces.

Fixes: c6adf77953 ("net: usb: qmi_wwan: add qmap mux protocol support")
Reported-by: Aleksander Morgado <aleksander@aleksander.es>
Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
Acked-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-03-17 17:06:15 +01:00
Tao Huang
bc69b758ef Merge remote branch 'android12-5.10' of https://android.googlesource.com/kernel/common
* android12-5.10: (176331 commits)
  ANDROID: GKI: Enable bounds sanitizer
  ANDROID: Allow HAS_LTO_CLANG with KASAN_HW_TAGS
  ANDROID: abi_gki_aarch64_qcom: Add cpufreq related symbols
  ANDROID: cpufreq: Add a restricted vendor hook for freq transition
  ANDROID: scsi: ufs: add hooks to track ufs commands
  ANDROID: Fix compilation error when CPU_FREQ is disabled
  BACKPORT: kasan, arm64: allow using KUnit tests with HW_TAGS mode
  Revert "FROMGIT: kasan, arm64: allow using KUnit tests with HW_TAGS mode"
  Revert "BACKPORT: kasan: remove redundant config option"
  UPSTREAM: arm/kasan: fix the array size of kasan_early_shadow_pte[]
  FROMGIT: KVM: arm64: Workaround firmware wrongly advertising GICv2-on-v3 compatibility
  FROMGIT: KVM: arm64: Rename __vgic_v3_get_ich_vtr_el2() to __vgic_v3_get_gic_config()
  FROMGIT: KVM: arm64: Don't access PMSELR_EL0/PMUSERENR_EL0 when no PMU is available
  FROMGIT: KVM: arm64: Turn kvm_arm_support_pmu_v3() into a static key
  FROMGIT: KVM: arm64: Fix nVHE hyp panic host context restore
  FROMGIT: KVM: arm64: Avoid corrupting vCPU context register in guest exit
  FROMLIST: arm64: cpufeatures: Fix handling of CONFIG_CMDLINE for idreg overrides
  ANDROID: sched: Add vendor hook for uclamp_eff_value
  ANDROID: abi_gki_aarch64_qcom: Add CFS scheduler symbols
  ANDROID: GKI: Add mempool APIs to the symbol list
  ...

Change-Id: I4ed13984b97bc531d1dae61920457f31b84190e9

Conflicts:
	Documentation/devicetree/bindings/nvmem/rockchip-otp.txt
	arch/arm64/boot/dts/rockchip/px30.dtsi
	arch/arm64/boot/dts/rockchip/rk3308.dtsi
	arch/arm64/boot/dts/rockchip/rk3399-rockpro64.dts
	drivers/clk/rockchip/Kconfig
	drivers/clk/rockchip/clk-rk3308.c
	drivers/gpu/drm/rockchip/rk3066_hdmi.c
	drivers/gpu/drm/rockchip/rockchip_rgb.c
	drivers/media/i2c/imx219.c
	drivers/nvmem/rockchip-otp.c
	drivers/power/supply/cw2015_battery.c
	sound/soc/codecs/cx2072x.c
	sound/soc/codecs/cx2072x.h
	sound/soc/codecs/rk3328_codec.c
2021-03-17 18:07:51 +08:00
Tao Huang
251c226c35 rk: revert to v4.19
Signed-off-by: Tao Huang <huangtao@rock-chips.com>
Change-Id: I502dce68b639df4ebf5a1688e0dc2e5c5763ebc2
2021-03-17 18:05:39 +08:00
Lech Perczak
d00a97dddc net: usb: qmi_wwan: support ZTE P685M modem
commit 88eee9b7b4 upstream.

Now that interface 3 in "option" driver is no longer mapped, add device
ID matching it to qmi_wwan.

The modem is used inside ZTE MF283+ router and carriers identify it as
such.
Interface mapping is:
0: QCDM, 1: AT (PCUI), 2: AT (Modem), 3: QMI, 4: ADB

T:  Bus=02 Lev=02 Prnt=02 Port=05 Cnt=01 Dev#=  3 Spd=480  MxCh= 0
D:  Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=19d2 ProdID=1275 Rev=f0.00
S:  Manufacturer=ZTE,Incorporated
S:  Product=ZTE Technologies MSM
S:  SerialNumber=P685M510ZTED0000CP&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&0
C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E:  Ad=83(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E:  Ad=85(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
E:  Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
E:  Ad=87(I) Atr=03(Int.) MxPS=   8 Ivl=32ms
E:  Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
E:  Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms

Acked-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
Link: https://lore.kernel.org/r/20210223183456.6377-1-lech.perczak@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-03-07 12:34:03 +01:00
Christoph Schemmel
b7e51e5ecf NET: usb: qmi_wwan: Adding support for Cinterion MV31
[ Upstream commit a4dc7eee91 ]

Adding support for Cinterion MV31 with PID 0x00B7.

T:  Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 11 Spd=5000 MxCh= 0
D:  Ver= 3.20 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs=  1
P:  Vendor=1e2d ProdID=00b7 Rev=04.14
S:  Manufacturer=Cinterion
S:  Product=Cinterion USB Mobile Broadband
S:  SerialNumber=b3246eed
C:  #Ifs= 4 Cfg#= 1 Atr=a0 MxPwr=896mA
I:  If#=0x0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
I:  If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
I:  If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
I:  If#=0x3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option

Signed-off-by: Christoph Schemmel <christoph.schemmel@gmail.com>
Link: https://lore.kernel.org/r/20210202084523.4371-1-christoph.schemmel@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-02-26 10:13:01 +01:00
Tao Huang
b50aca0c9a Merge tag 'ASB-2021-02-05_4.19-stable' of https://android.googlesource.com/kernel/common
https://source.android.com/security/bulletin/2021-02-01
CVE-2017-18509
CVE-2020-10767

* tag 'ASB-2021-02-05_4.19-stable': (809 commits)
  ANDROID: GKI: fix up abi issues with 4.19.172
  Linux 4.19.172
  fs: fix lazytime expiration handling in __writeback_single_inode()
  writeback: Drop I_DIRTY_TIME_EXPIRE
  dm integrity: conditionally disable "recalculate" feature
  tools: Factor HOSTCC, HOSTLD, HOSTAR definitions
  tracing: Fix race in trace_open and buffer resize call
  HID: wacom: Correct NULL dereference on AES pen proximity
  futex: Handle faults correctly for PI futexes
  futex: Simplify fixup_pi_state_owner()
  futex: Use pi_state_update_owner() in put_pi_state()
  rtmutex: Remove unused argument from rt_mutex_proxy_unlock()
  futex: Provide and use pi_state_update_owner()
  futex: Replace pointless printk in fixup_owner()
  futex: Ensure the correct return value from futex_lock_pi()
  futex: Prevent exit livelock
  futex: Provide distinct return value when owner is exiting
  futex: Add mutex around futex exit
  futex: Provide state handling for exec() as well
  futex: Sanitize exit state handling
  ...

Change-Id: Ieba6ee3a91a05d504e1f829a84e7d364e7d983f2

Conflicts:
	arch/arm64/boot/dts/rockchip/rk3328.dtsi
	drivers/md/Kconfig
	drivers/usb/gadget/function/f_uac2.c
2021-02-26 15:30:04 +08:00
Giacinto Cifelli
6c6bd9dd1c net: usb: qmi_wwan: added support for Thales Cinterion PLSx3 modem family
commit 7e0e63d095 upstream.

Bus 003 Device 009: ID 1e2d:006f
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass          239 Miscellaneous Device
  bDeviceSubClass         2 ?
  bDeviceProtocol         1 Interface Association
  bMaxPacketSize0        64
  idVendor           0x1e2d
  idProduct          0x006f
  bcdDevice            0.00
  iManufacturer           3 Cinterion Wireless Modules
  iProduct                2 PLSx3
  iSerial                 4 fa3c1419
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength          303
    bNumInterfaces          9
    bConfigurationValue     1
    iConfiguration          1 Cinterion Configuration
    bmAttributes         0xe0
      Self Powered
      Remote Wakeup
    MaxPower              500mA
    Interface Association:
      bLength                 8
      bDescriptorType        11
      bFirstInterface         0
      bInterfaceCount         2
      bFunctionClass          2 Communications
      bFunctionSubClass       2 Abstract (modem)
      bFunctionProtocol       1 AT-commands (v.25ter)
      iFunction               0
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         2 Communications
      bInterfaceSubClass      2 Abstract (modem)
      bInterfaceProtocol      1 AT-commands (v.25ter)
      iInterface              0
      CDC Header:
        bcdCDC               1.10
      CDC ACM:
        bmCapabilities       0x02
          line coding and serial state
      CDC Call Management:
        bmCapabilities       0x03
          call management
          use DataInterface
        bDataInterface          1
      CDC Union:
        bMasterInterface        0
        bSlaveInterface         1
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               5
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        1
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass        10 CDC Data
      bInterfaceSubClass      0 Unused
      bInterfaceProtocol      0
      iInterface              0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x82  EP 2 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
    Interface Association:
      bLength                 8
      bDescriptorType        11
      bFirstInterface         2
      bInterfaceCount         2
      bFunctionClass          2 Communications
      bFunctionSubClass       2 Abstract (modem)
      bFunctionProtocol       1 AT-commands (v.25ter)
      iFunction               0
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        2
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         2 Communications
      bInterfaceSubClass      2 Abstract (modem)
      bInterfaceProtocol      1 AT-commands (v.25ter)
      iInterface              0
      CDC Header:
        bcdCDC               1.10
      CDC ACM:
        bmCapabilities       0x02
          line coding and serial state
      CDC Call Management:
        bmCapabilities       0x03
          call management
          use DataInterface
        bDataInterface          3
      CDC Union:
        bMasterInterface        2
        bSlaveInterface         3
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x83  EP 3 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               5
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        3
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass        10 CDC Data
      bInterfaceSubClass      0 Unused
      bInterfaceProtocol      0
      iInterface              0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x84  EP 4 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x02  EP 2 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
    Interface Association:
      bLength                 8
      bDescriptorType        11
      bFirstInterface         4
      bInterfaceCount         2
      bFunctionClass          2 Communications
      bFunctionSubClass       2 Abstract (modem)
      bFunctionProtocol       1 AT-commands (v.25ter)
      iFunction               0
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        4
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         2 Communications
      bInterfaceSubClass      2 Abstract (modem)
      bInterfaceProtocol      1 AT-commands (v.25ter)
      iInterface              0
      CDC Header:
        bcdCDC               1.10
      CDC ACM:
        bmCapabilities       0x02
          line coding and serial state
      CDC Call Management:
        bmCapabilities       0x03
          call management
          use DataInterface
        bDataInterface          5
      CDC Union:
        bMasterInterface        4
        bSlaveInterface         5
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x85  EP 5 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               5
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        5
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass        10 CDC Data
      bInterfaceSubClass      0 Unused
      bInterfaceProtocol      0
      iInterface              0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x86  EP 6 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x03  EP 3 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
    Interface Association:
      bLength                 8
      bDescriptorType        11
      bFirstInterface         6
      bInterfaceCount         2
      bFunctionClass          2 Communications
      bFunctionSubClass       2 Abstract (modem)
      bFunctionProtocol       1 AT-commands (v.25ter)
      iFunction               0
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        6
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         2 Communications
      bInterfaceSubClass      2 Abstract (modem)
      bInterfaceProtocol      1 AT-commands (v.25ter)
      iInterface              0
      CDC Header:
        bcdCDC               1.10
      CDC ACM:
        bmCapabilities       0x02
          line coding and serial state
      CDC Call Management:
        bmCapabilities       0x03
          call management
          use DataInterface
        bDataInterface          7
      CDC Union:
        bMasterInterface        6
        bSlaveInterface         7
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x87  EP 7 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               5
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        7
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass        10 CDC Data
      bInterfaceSubClass      0 Unused
      bInterfaceProtocol      0
      iInterface              0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x88  EP 8 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x04  EP 4 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        8
      bAlternateSetting       0
      bNumEndpoints           3
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass    255 Vendor Specific Subclass
      bInterfaceProtocol    255 Vendor Specific Protocol
      iInterface              0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x89  EP 9 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               5
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x8a  EP 10 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x05  EP 5 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
Device Qualifier (for other device speed):
  bLength                10
  bDescriptorType         6
  bcdUSB               2.00
  bDeviceClass          239 Miscellaneous Device
  bDeviceSubClass         2 ?
  bDeviceProtocol         1 Interface Association
  bMaxPacketSize0        64
  bNumConfigurations      1
Device Status:     0x0000
  (Bus Powered)

Cc: stable@vger.kernel.org
Signed-off-by: Giacinto Cifelli <gciofono@gmail.com>
Acked-by: Bjørn Mork <bjorn@mork.no>
Link: https://lore.kernel.org/r/20210120045650.10855-1-gciofono@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-02-03 23:28:39 +01:00
Greg Kroah-Hartman
d084fe8b5d This is the 4.19.170 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmAMODkACgkQONu9yGCS
 aT5y5w/+IcTYjUeozem90e811yy0V17All0NvJyYovwvs8Jr4aapV2/P4hTAFKjl
 VbmUGHTsRq0yygv0Sqz7SqOw0C9F+pxZmCmG5SZzmfXV4IGSv9sT94cX1PI/Sqhn
 1zes2C3AYOAmypBGV27XVMFgQNH3JkqwaFmvfyYTH+YSdCPncI3mkNsQbL3J4luT
 XdZ8mlg1uiHYwTm2aeM/8eFhgK01qXpUDCJXCoxx2gm4xQjX8pnqq5xJdh8iOlpH
 6VPcuiPAFYlTaYyW2U8/tnQE9XmL+nrQh3QSFP638sSMdkCGEuTM3upUk+1QjC56
 GQSnERDR7zt4B8l414MSZOmGHMKqwXJ585Bwx6ZZW+RWlp/vDAgxUhfjoh4Ep7CM
 Zb0Ydzv/AB3zuMDxudcUBuNf1xTGd8YR39ODjWCkk2qmJORgiDNLtMcacJQmjQRo
 SjUa4BooaeOYpJ/N8L0BXkWl32AOP04VKldO0jczhtPLwZZWRHPnw+IWVRL6W91Y
 H9eElJxDQvymGRJ6H4+7Q6l7qtP3QjGHyX4gTq7Ucbn/cIJvdZmH5ooIsiOGTchn
 GWOx2lStW7fgUd+IY3Hr+LVIa9yvnXra4RIZAD9v5X8aIJ6ol6b8F9GAmrZMyP2O
 SU+z4UIs9/XG2GHenQFZDeZ9wj8p7o1PaT+D9u5z9xteje2Bqfk=
 =ptN/
 -----END PGP SIGNATURE-----

Merge 4.19.170 into android-4.19-stable

Changes in 4.19.170
	usb: ohci: Make distrust_firmware param default to false
	compiler.h: Raise minimum version of GCC to 5.1 for arm64
	dm integrity: fix flush with external metadata device
	crypto: x86/crc32c - fix building with clang ias
	nfsd4: readdirplus shouldn't return parent of export
	udp: Prevent reuseport_select_sock from reading uninitialized socks
	netxen_nic: fix MSI/MSI-x interrupts
	net: mvpp2: Remove Pause and Asym_Pause support
	rndis_host: set proper input size for OID_GEN_PHYSICAL_MEDIUM request
	esp: avoid unneeded kmap_atomic call
	net: dcb: Validate netlink message in DCB handler
	net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands
	rxrpc: Call state should be read with READ_ONCE() under some circumstances
	net: stmmac: Fixed mtu channged by cache aligned
	net: sit: unregister_netdevice on newlink's error path
	net: avoid 32 x truesize under-estimation for tiny skbs
	rxrpc: Fix handling of an unsupported token type in rxrpc_read()
	tipc: fix NULL deref in tipc_link_xmit()
	net: introduce skb_list_walk_safe for skb segment walking
	net: skbuff: disambiguate argument and member for skb_list_walk_safe helper
	net: ipv6: Validate GSO SKB before finish IPv6 processing
	spi: cadence: cache reference clock rate during probe
	Linux 4.19.170

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I4a12e49eae7097a468161952228c57c974a1b0ac
2021-01-23 16:13:31 +01:00
Andrey Zhizhikin
3c64191cad rndis_host: set proper input size for OID_GEN_PHYSICAL_MEDIUM request
[ Upstream commit e56b3d94d9 ]

MSFT ActiveSync implementation requires that the size of the response for
incoming query is to be provided in the request input length. Failure to
set the input size proper results in failed request transfer, where the
ActiveSync counterpart reports the NDIS_STATUS_INVALID_LENGTH (0xC0010014L)
error.

Set the input size for OID_GEN_PHYSICAL_MEDIUM query to the expected size
of the response in order for the ActiveSync to properly respond to the
request.

Fixes: 039ee17d1b ("rndis_host: Add RNDIS physical medium checking into generic_rndis_bind()")
Signed-off-by: Andrey Zhizhikin <andrey.zhizhikin@leica-geosystems.com>
Link: https://lore.kernel.org/r/20210108095839.3335-1-andrey.zhizhikin@leica-geosystems.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-23 16:04:01 +01:00
Andrey Zhizhikin
eaf0f23329 rndis_host: set proper input size for OID_GEN_PHYSICAL_MEDIUM request
[ Upstream commit e56b3d94d9 ]

MSFT ActiveSync implementation requires that the size of the response for
incoming query is to be provided in the request input length. Failure to
set the input size proper results in failed request transfer, where the
ActiveSync counterpart reports the NDIS_STATUS_INVALID_LENGTH (0xC0010014L)
error.

Set the input size for OID_GEN_PHYSICAL_MEDIUM query to the expected size
of the response in order for the ActiveSync to properly respond to the
request.

Fixes: 039ee17d1b ("rndis_host: Add RNDIS physical medium checking into generic_rndis_bind()")
Signed-off-by: Andrey Zhizhikin <andrey.zhizhikin@leica-geosystems.com>
Link: https://lore.kernel.org/r/20210108095839.3335-1-andrey.zhizhikin@leica-geosystems.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-23 15:49:55 +01:00
Greg Kroah-Hartman
ea0aa59740 This is the 4.19.169 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmAHFgcACgkQONu9yGCS
 aT7vaw//QfIjoGSMrv88n6b+2CBKU7yZyUqDhV1YvfLs3CwAHc0NDrBgmHanje5j
 SIBBoa0PhzhzVE2zPMLlfWisGs8dt0844R5LL+Kc8h7oa7OCSKY1tws8lm9L0qgj
 DE5/DD1ztmg9glKhiJyQxRwZfbWQlp2eAyN8TEqKCrfxrP2UOW6JNW0dMniqACvM
 CmPNgopFfnObTVSjbLYYlonJJsOE++EUue5XN+MvBQSOaamTBOB5cwr3esEG0RX7
 GGu+P0dQXpJUythkqypDCH2LVe95szOeCEwmTFnQKauFLYQijVx0s4kMSiiU/ByP
 o0sHFOSdsayi5rOYek3lnomnzqzWvQgIrs3VqkXhT//j8hcXE0+owYvNbpTbC4c6
 E8qULLht6pahtD/53MYk0XGDC6y5uIgbIQGQylWyg4+bZFfnXlz6UErrFXM/gyEp
 0uARhrwJT3BmKsNQPKsTCWuzpfVuKCTseYfpiOZMqZptyKtFyWSnCvyTRyPk4ZvS
 VeMXG46qENiWDXUrvggL9zK4bzgqsyneLbzkJ6eqEA9YxE7MPlH6I4TUhjPm4KWl
 CHMl60lDwA/N/M76WiPkHVXp1/ODpnK2ebKRXSM2goT0/jsOA2CTLVGSQ9tzH4e4
 7zrnG0JnETw6ib2w4rfKJRi/OSS49r03lO2PnrLOexA4Y+U8daI=
 =H0Tc
 -----END PGP SIGNATURE-----

Merge 4.19.169 into android-4.19-stable

Changes in 4.19.169
	ASoC: dapm: remove widget from dirty list on free
	x86/hyperv: check cpu mask after interrupt has been disabled
	tracing/kprobes: Do the notrace functions check without kprobes on ftrace
	MIPS: boot: Fix unaligned access with CONFIG_MIPS_RAW_APPENDED_DTB
	MIPS: relocatable: fix possible boot hangup with KASLR enabled
	ACPI: scan: Harden acpi_device_add() against device ID overflows
	mm/hugetlb: fix potential missing huge page size info
	dm snapshot: flush merged data before committing metadata
	dm integrity: fix the maximum number of arguments
	r8152: Add Lenovo Powered USB-C Travel Hub
	ext4: fix bug for rename with RENAME_WHITEOUT
	ARC: build: remove non-existing bootpImage from KBUILD_IMAGE
	ARC: build: add uImage.lzma to the top-level target
	ARC: build: add boot_targets to PHONY
	btrfs: fix transaction leak and crash after RO remount caused by qgroup rescan
	ethernet: ucc_geth: fix definition and size of ucc_geth_tx_global_pram
	bfq: Fix computation of shallow depth
	arch/arc: add copy_user_page() to <asm/page.h> to fix build error on ARC
	misdn: dsp: select CONFIG_BITREVERSE
	net: ethernet: fs_enet: Add missing MODULE_LICENSE
	ACPI: scan: add stub acpi_create_platform_device() for !CONFIG_ACPI
	drm/msm: Call msm_init_vram before binding the gpu
	ARM: picoxcell: fix missing interrupt-parent properties
	ima: Remove __init annotation from ima_pcrread()
	dump_common_audit_data(): fix racy accesses to ->d_name
	ASoC: meson: axg-tdm-interface: fix loopback
	ASoC: Intel: fix error code cnl_set_dsp_D0()
	NFS4: Fix use-after-free in trace_event_raw_event_nfs4_set_lock
	pNFS: Mark layout for return if return-on-close was not sent
	NFS/pNFS: Fix a leak of the layout 'plh_outstanding' counter
	NFS: nfs_igrab_and_active must first reference the superblock
	ext4: fix superblock checksum failure when setting password salt
	RDMA/usnic: Fix memleak in find_free_vf_and_create_qp_grp
	RDMA/mlx5: Fix wrong free of blue flame register on error
	mm, slub: consider rest of partial list if acquire_slab() fails
	net: sunrpc: interpret the return value of kstrtou32 correctly
	dm: eliminate potential source of excessive kernel log noise
	ALSA: firewire-tascam: Fix integer overflow in midi_port_work()
	ALSA: fireface: Fix integer overflow in transmit_midi_msg()
	netfilter: conntrack: fix reading nf_conntrack_buckets
	netfilter: nf_nat: Fix memleak in nf_nat_init
	kbuild: enforce -Werror=return-type
	Linux 4.19.169

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I74309249e2b6a77421acd7f8d19f60cc48c328db
2021-01-19 18:49:37 +01:00
Leon Schuermann
85905240bf r8152: Add Lenovo Powered USB-C Travel Hub
commit cb82a54904 upstream.

This USB-C Hub (17ef:721e) based on the Realtek RTL8153B chip used to
use the cdc_ether driver. However, using this driver, with the system
suspended the device constantly sends pause-frames as soon as the
receive buffer fills up. This causes issues with other devices, where
some Ethernet switches stop forwarding packets altogether.

Using the Realtek driver (r8152) fixes this issue. Pause frames are no
longer sent while the host system is suspended.

Signed-off-by: Leon Schuermann <leon@is.currently.online>
Tested-by: Leon Schuermann <leon@is.currently.online>
Link: https://lore.kernel.org/r/20210111190312.12589-2-leon@is.currently.online
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-19 18:27:22 +01:00
Leon Schuermann
e04f28c767 r8152: Add Lenovo Powered USB-C Travel Hub
commit cb82a54904 upstream.

This USB-C Hub (17ef:721e) based on the Realtek RTL8153B chip used to
use the cdc_ether driver. However, using this driver, with the system
suspended the device constantly sends pause-frames as soon as the
receive buffer fills up. This causes issues with other devices, where
some Ethernet switches stop forwarding packets altogether.

Using the Realtek driver (r8152) fixes this issue. Pause frames are no
longer sent while the host system is suspended.

Signed-off-by: Leon Schuermann <leon@is.currently.online>
Tested-by: Leon Schuermann <leon@is.currently.online>
Link: https://lore.kernel.org/r/20210111190312.12589-2-leon@is.currently.online
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-19 18:22:35 +01:00
Greg Kroah-Hartman
5905c14687 This is the 4.19.168 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmAENesACgkQONu9yGCS
 aT7VQg//Sr2GXQqTswXLMTMFCALNh7jSzYthMwvok9RqEeNg4bZlaXNFyylZxAgr
 q3WSPCtmJWlQ2L5mjae5qYnIvgrvf5uKRhVoiZ+piDPIaz1HLixO+oNosxsBVFc8
 Mx0OZpTP5TPRRLEyprOyQBo0fI3v4NHKQ3PYbJPzqA5jRSU+i5r1opKh8y+6pZjN
 PXdpZSinHpzs7qXWpPU3xEvmqy7TbNicD/SzJm12yoyVM3e1eB12rPDvaNMqGdLZ
 lgGhvcIunDS+rtNWrjnG4hXpKPfrpNFmH/QUK1v+/5oZDwFNn9tf1hIar5fu6T9U
 4gHhEiKlrRfJhZwgjppUTpMvt14q/XyOV3Bty3ekl6kjWalSAbffOrWongmAs5fG
 Xz/hPrhl2bO/WtXmyvuV8oQcuSc+7Ufu5lPAVALOtQcVqurOS/6KmylOWTuYaSqv
 oLzlHgHfBUf6ES1HRNb7Rn+li7c7DNzydtlr3jGxagn1ZTj6/I8GfI+UxyVPVCie
 Rq9C5ul6tE9bWnDCJEuTvEIKu11GysZqFk8nWKomXidc0pgWtr2nEtVzrsLXY+rp
 mrfmXwtHOlNmgW+kl9DFqgLUbo2kzefn62zVekbG3R7Oni3xs+YwbxZHJVkkFkXz
 G5ggw96v7M/kVRMzg/kuRaF3oYVJn6iQOueP+haX+YwoAUPjD0c=
 =zbAi
 -----END PGP SIGNATURE-----

Merge 4.19.168 into android-4.19-stable

Changes in 4.19.168
	net: cdc_ncm: correct overhead in delayed_ndp_size
	net: hns3: fix the number of queues actually used by ARQ
	net: stmmac: dwmac-sun8i: Balance internal PHY resource references
	net: stmmac: dwmac-sun8i: Balance internal PHY power
	net: vlan: avoid leaks on register_vlan_dev() failures
	net/sonic: Fix some resource leaks in error handling paths
	net: ip: always refragment ip defragmented packets
	net: fix pmtu check in nopmtudisc mode
	net: ipv6: fib: flush exceptions when purging route
	chtls: Fix hardware tid leak
	chtls: Remove invalid set_tcb call
	chtls: Fix panic when route to peer not configured
	chtls: Replace skb_dequeue with skb_peek
	chtls: Added a check to avoid NULL pointer dereference
	chtls: Fix chtls resources release sequence
	x86/resctrl: Use an IPI instead of task_work_add() to update PQR_ASSOC MSR
	x86/resctrl: Don't move a task to the same resource group
	vmlinux.lds.h: Add PGO and AutoFDO input sections
	drm/i915: Fix mismatch between misplaced vma check and vma insert
	spi: pxa2xx: Fix use-after-free on unbind
	iio: imu: st_lsm6dsx: flip irq return logic
	iio: imu: st_lsm6dsx: fix edge-trigger interrupts
	HID: wacom: Fix memory leakage caused by kfifo_alloc
	ARM: OMAP2+: omap_device: fix idling of devices during probe
	i2c: sprd: use a specific timeout to avoid system hang up issue
	cpufreq: powernow-k8: pass policy rather than use cpufreq_cpu_get()
	spi: stm32: FIFO threshold level - fix align packet size
	dmaengine: mediatek: mtk-hsdma: Fix a resource leak in the error handling path of the probe function
	dmaengine: xilinx_dma: check dma_async_device_register return value
	dmaengine: xilinx_dma: fix incompatible param warning in _child_probe()
	dmaengine: xilinx_dma: fix mixed_enum_type coverity warning
	wil6210: select CONFIG_CRC32
	block: rsxx: select CONFIG_CRC32
	lightnvm: select CONFIG_CRC32
	iommu/intel: Fix memleak in intel_irq_remapping_alloc
	net/mlx5e: Fix memleak in mlx5e_create_l2_table_groups
	net/mlx5e: Fix two double free cases
	regmap: debugfs: Fix a memory leak when calling regmap_attach_dev
	wan: ds26522: select CONFIG_BITREVERSE
	KVM: arm64: Don't access PMCR_EL0 when no PMU is available
	block: fix use-after-free in disk_part_iter_next
	net: drop bogus skb with CHECKSUM_PARTIAL and offset beyond end of trimmed packet
	regmap: debugfs: Fix a reversed if statement in regmap_debugfs_init()
	Linux 4.19.168

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ia39a78431db8bf624b3d0c0940be36c514b79a77
2021-01-17 15:40:58 +01:00