Commit Graph

68816 Commits

Author SHA1 Message Date
Tao Huang
23b123381e net: rfkill-wlan: Export rfkill_get_wifi_power_state()
Export the rfkill_get_wifi_power_state() for use by pcie-dw-rockchip.

Signed-off-by: Tao Huang <huangtao@rock-chips.com>
Change-Id: I122d74da9271f2f808fbd474386994778561cbf8
2022-02-28 18:58:36 +08:00
Tao Huang
f6909c028f Merge tag 'ASB-2021-12-05_12-5.10' of https://android.googlesource.com/kernel/common
https://source.android.com/security/bulletin/2021-12-01
CVE-2021-33909
CVE-2021-38204
CVE-2021-0961

* tag 'ASB-2021-12-05_12-5.10': (3010 commits)
  ANDROID: workqueue: export symbol of the function wq_worker_comm()
  ANDROID: GKI: Update symbols to symbol list
  ANDROID: vendor_hooks: Add hooks for binder proc transaction
  ANDROID: GKI: Add symbols abi for USB IP kernel modules.
  ANDROID: GKI: Fix file mode on mtk abi file
  UPSTREAM: erofs: fix deadlock when shrink erofs slab
  ANDROID: init_task: Init android vendor and oem data
  UPSTREAM: sched/core: Mitigate race cpus_share_cache()/update_top_cache_domain()
  ANDROID: Update symbol list for mtk
  UPSTREAM: erofs: fix unsafe pagevec reuse of hooked pclusters
  UPSTREAM: erofs: remove the occupied parameter from z_erofs_pagevec_enqueue()
  UPSTREAM: usb: dwc3: gadget: Fix null pointer exception
  ANDROID: fips140: support "evaluation testing" builds via build.sh
  FROMGIT: sched/scs: Reset task stack state in bringup_cpu()
  ANDROID: dma-buf: heaps: fix dma-buf heap pool pages stat
  ANDROID: ABI: Add several spi_mem related symbols
  UPSTREAM: spi: spi-mem: add spi_mem_dtr_supports_op()
  ANDROID: gki_defconfig: enable CONFIG_SPI_MEM
  ANDROID: ABI: Add several iio related symbols
  ANDROID: ABI: Update symbol list for IMX
  ...

Change-Id: I09cddc92fa34553b944e62cc5cbbba94a84e5437

Conflicts:
	arch/arm/boot/dts/rk322x.dtsi
	arch/arm64/boot/dts/rockchip/rk3399.dtsi
	drivers/dma-buf/heaps/system_heap.c
	drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c
	drivers/gpu/drm/rockchip/rockchip_drm_vop.c
	drivers/gpu/drm/rockchip/rockchip_lvds.c
	drivers/gpu/drm/rockchip/rockchip_vop_reg.c
	drivers/mtd/nand/spi/core.c
	drivers/pci/controller/pcie-rockchip-host.c
	drivers/soc/rockchip/Kconfig
	drivers/usb/dwc3/core.c
	drivers/usb/dwc3/core.h
2021-12-14 17:09:02 +08:00
Alex Zhao
4bfa8f90b5 net: rfkill: add wifi and bt driver
Signed-off-by: Alex Zhao <zzc@rock-chips.com>
Change-Id: I1d399641587124d2291b5b49e5538e7e490a843a
2021-11-10 16:11:47 +08:00
Johannes Berg
a7d87a08b4 UPSTREAM: cfg80211: fix management registrations locking
The management registrations locking was broken, the list was
locked for each wdev, but cfg80211_mgmt_registrations_update()
iterated it without holding all the correct spinlocks, causing
list corruption.

Rather than trying to fix it with fine-grained locking, just
move the lock to the wiphy/rdev (still need the list on each
wdev), we already need to hold the wdev lock to change it, so
there's no contention on the lock in any case. This trivially
fixes the bug since we hold one wdev's lock already, and now
will hold the lock that protects all lists.

Cc: stable@vger.kernel.org
Reported-by: Jouni Malinen <j@w1.fi>
Fixes: 6cd536fe62 ("cfg80211: change internal management frame registration API")
Link: https://lore.kernel.org/r/20211025133111.5cf733eab0f4.I7b0abb0494ab712f74e2efcd24bb31ac33f7eee9@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Bug: 204384349
(cherry picked from commit 09b1d5dc6c)
Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Id1bca68277be3a5f7c7329a8195018946f686bdb
2021-11-06 12:02:45 +00:00
Greg Kroah-Hartman
d3c86f460d This is the 5.10.66 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmFDIbAACgkQONu9yGCS
 aT7zaQ//aT/VgDrNmk5QaNnAAJlN0nsM2cbudR82bEwITkOg1bclrwAMqUXsg0dV
 d72300fSyrr9oSdD8lodPWi+Gt0OAMoYTZ4z/RE+TBRpfQYiVx1gQJ8QHqkS6oHA
 AebUrXxc/SuA50TvpLqxd+2De450X7g7ZLzprchlQQXI8T5V7ave1Co3/0nHXoAT
 rbEm8Zjp7Ge0K/mDDzMXTLVWPsEVeQ2TRmSQNdJlbfS2Fs4XCQV9lr1e1thjv3Zk
 bYSqVT92Okq/WIBbpzCwtbDNLXQSjGYuiTgsyat23Dc0De8jEg17BEwRE/NGudJa
 Lye+CTSuI95WCTYVd0JfJq4m49dizqIwxlb/7hRS4QizBnZAvcI3N4Itsqmg9Luv
 c6q5kVasIVWFBaiyLTEvpxuZJ6gGk8ekEz/qvtVrTPjxp+Y6im7VDH0+gtsaugsE
 y9ZWWQsPT2Q/S+Tuai3DPYzC53LniMg+gfKuxl3NGCsRv5Ig8G7M5qBhxK5ZglyW
 pwds2QP/Evr4VzsTMFvvEPezLsF+b8P0cD6auluSYsm1OU9Zjr1VawybqKECRNy3
 kbm3TCUL2xzJ7Iet2V2iSB4wHaxYAPLHvXbw+rg0cw1L0Yt7eEAIbJzN+vgonpF/
 uWUAA+awJqlJG8kkB5mQtB3hzI4Chh/UWZ93koW+vLXUKf8Iprc=
 =HYtp
 -----END PGP SIGNATURE-----

Merge 5.10.66 into android12-5.10-lts

Changes in 5.10.66
	Revert "Bluetooth: Move shutdown callback before flushing tx and rx queue"
	Revert "block: nbd: add sanity check for first_minor"
	Revert "posix-cpu-timers: Force next expiration recalc after itimer reset"
	Revert "time: Handle negative seconds correctly in timespec64_to_ns()"
	Linux 5.10.66

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I2e40777590f9495135a5c7f78be91c058f3bafa6
2021-09-19 10:25:11 +02:00
Sasha Levin
d3c3f4e078 Revert "Bluetooth: Move shutdown callback before flushing tx and rx queue"
This reverts commit 4711284768.

Botched backport, dropping to rework for next release.

Reported-by: Pavel Machek <pavel@denx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-09-16 12:51:23 +02:00
Greg Kroah-Hartman
2300418cc6 This is the 5.10.65 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmFBpvcACgkQONu9yGCS
 aT7JVxAAof4h5rPObKwhFBu4qOHXEtlHrFAF1xTEaQZnIbv9CkEF0LPufWXP+nKS
 mQDOdDmX3rZhWXZbnNK3ZxBADJXyHS6M0jHByuGrzQ8dmMONJtpjYUjxou6k/xg2
 4ECHqzeVbwbWuKrJrAfC1xuZofIHXZBHrkAQmLoMw8ERp309lgPS2cXDOXRzn/n/
 ri+5AhTaw1ZG1JXrXvyfoxjbdE/eEeJXx8N/zJf0sas5lYpsqeAWTgXBkNpPeJm7
 G66ISwEVp6TPxihpRSKwUhADjuM2+EAok2WXwwTvO0s00vE7LL5ijK27hhP5ual1
 +xtxBHag95oIZ+sq1t3z4BgmE1n3z/lHkQki98JQaWShABLGhMdKYPF75hMzR6Pw
 j0TvLHdkPRSrtUelc7rGtqaT9tF9+RU59I5fPGlBpGckOJ5u2IHCKdjk1WadRgrj
 JF7R8ApfP18y1X46tDfr/CIPIZfTVNJyd7hZ1zt11wdBYFmaw/oNyg81OalqzaWf
 ckUIt6AucRQ04uuFfhSaTuxLSEl5Uuh6W30HuO/0N3CoDsfD1RMc+76sXORt/JdK
 MPxTy124KM6VZADVW4tQXHMoGkLftqTAIgRKt4iRPz80rdhACJFoZJlmVON0MmKV
 tSODsqGBxIxhkLj197vQzT152G4wBkmzPtqJfJH7lkGKmBpoKZE=
 =lJCV
 -----END PGP SIGNATURE-----

Merge 5.10.65 into android12-5.10-lts

Changes in 5.10.65
	locking/mutex: Fix HANDOFF condition
	regmap: fix the offset of register error log
	regulator: tps65910: Silence deferred probe error
	crypto: mxs-dcp - Check for DMA mapping errors
	sched/deadline: Fix reset_on_fork reporting of DL tasks
	power: supply: axp288_fuel_gauge: Report register-address on readb / writeb errors
	crypto: omap-sham - clear dma flags only after omap_sham_update_dma_stop()
	sched/deadline: Fix missing clock update in migrate_task_rq_dl()
	rcu/tree: Handle VM stoppage in stall detection
	EDAC/mce_amd: Do not load edac_mce_amd module on guests
	posix-cpu-timers: Force next expiration recalc after itimer reset
	hrtimer: Avoid double reprogramming in __hrtimer_start_range_ns()
	hrtimer: Ensure timerfd notification for HIGHRES=n
	udf: Check LVID earlier
	udf: Fix iocharset=utf8 mount option
	isofs: joliet: Fix iocharset=utf8 mount option
	bcache: add proper error unwinding in bcache_device_init
	blk-throtl: optimize IOPS throttle for large IO scenarios
	nvme-tcp: don't update queue count when failing to set io queues
	nvme-rdma: don't update queue count when failing to set io queues
	nvmet: pass back cntlid on successful completion
	power: supply: smb347-charger: Add missing pin control activation
	power: supply: max17042_battery: fix typo in MAx17042_TOFF
	s390/cio: add dev_busid sysfs entry for each subchannel
	s390/zcrypt: fix wrong offset index for APKA master key valid state
	libata: fix ata_host_start()
	crypto: omap - Fix inconsistent locking of device lists
	crypto: qat - do not ignore errors from enable_vf2pf_comms()
	crypto: qat - handle both source of interrupt in VF ISR
	crypto: qat - fix reuse of completion variable
	crypto: qat - fix naming for init/shutdown VF to PF notifications
	crypto: qat - do not export adf_iov_putmsg()
	fcntl: fix potential deadlock for &fasync_struct.fa_lock
	udf_get_extendedattr() had no boundary checks.
	s390/kasan: fix large PMD pages address alignment check
	s390/pci: fix misleading rc in clp_set_pci_fn()
	s390/debug: keep debug data on resize
	s390/debug: fix debug area life cycle
	s390/ap: fix state machine hang after failure to enable irq
	power: supply: cw2015: use dev_err_probe to allow deferred probe
	m68k: emu: Fix invalid free in nfeth_cleanup()
	sched/numa: Fix is_core_idle()
	sched: Fix UCLAMP_FLAG_IDLE setting
	rcu: Fix to include first blocked task in stall warning
	rcu: Add lockdep_assert_irqs_disabled() to rcu_sched_clock_irq() and callees
	rcu: Fix stall-warning deadlock due to non-release of rcu_node ->lock
	m68k: Fix invalid RMW_INSNS on CPUs that lack CAS
	block: return ELEVATOR_DISCARD_MERGE if possible
	spi: spi-fsl-dspi: Fix issue with uninitialized dma_slave_config
	spi: spi-pic32: Fix issue with uninitialized dma_slave_config
	genirq/timings: Fix error return code in irq_timings_test_irqs()
	irqchip/loongson-pch-pic: Improve edge triggered interrupt support
	lib/mpi: use kcalloc in mpi_resize
	clocksource/drivers/sh_cmt: Fix wrong setting if don't request IRQ for clock source channel
	block: nbd: add sanity check for first_minor
	spi: coldfire-qspi: Use clk_disable_unprepare in the remove function
	irqchip/gic-v3: Fix priority comparison when non-secure priorities are used
	crypto: qat - use proper type for vf_mask
	certs: Trigger creation of RSA module signing key if it's not an RSA key
	tpm: ibmvtpm: Avoid error message when process gets signal while waiting
	x86/mce: Defer processing of early errors
	spi: davinci: invoke chipselect callback
	blk-crypto: fix check for too-large dun_bytes
	regulator: vctrl: Use locked regulator_get_voltage in probe path
	regulator: vctrl: Avoid lockdep warning in enable/disable ops
	spi: sprd: Fix the wrong WDG_LOAD_VAL
	spi: spi-zynq-qspi: use wait_for_completion_timeout to make zynq_qspi_exec_mem_op not interruptible
	EDAC/i10nm: Fix NVDIMM detection
	drm/panfrost: Fix missing clk_disable_unprepare() on error in panfrost_clk_init()
	drm/gma500: Fix end of loop tests for list_for_each_entry
	ASoC: mediatek: mt8183: Fix Unbalanced pm_runtime_enable in mt8183_afe_pcm_dev_probe
	media: TDA1997x: enable EDID support
	leds: is31fl32xx: Fix missing error code in is31fl32xx_parse_dt()
	soc: rockchip: ROCKCHIP_GRF should not default to y, unconditionally
	media: cxd2880-spi: Fix an error handling path
	drm/of: free the right object
	bpf: Fix a typo of reuseport map in bpf.h.
	bpf: Fix potential memleak and UAF in the verifier.
	drm/of: free the iterator object on failure
	gve: fix the wrong AdminQ buffer overflow check
	libbpf: Fix the possible memory leak on error
	ARM: dts: aspeed-g6: Fix HVI3C function-group in pinctrl dtsi
	arm64: dts: renesas: r8a77995: draak: Remove bogus adv7511w properties
	i40e: improve locking of mac_filter_hash
	soc: qcom: rpmhpd: Use corner in power_off
	libbpf: Fix removal of inner map in bpf_object__create_map
	gfs2: Fix memory leak of object lsi on error return path
	firmware: fix theoretical UAF race with firmware cache and resume
	driver core: Fix error return code in really_probe()
	ionic: cleanly release devlink instance
	media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init
	media: dvb-usb: fix uninit-value in vp702x_read_mac_addr
	media: dvb-usb: Fix error handling in dvb_usb_i2c_init
	media: go7007: fix memory leak in go7007_usb_probe
	media: go7007: remove redundant initialization
	media: rockchip/rga: use pm_runtime_resume_and_get()
	media: rockchip/rga: fix error handling in probe
	media: coda: fix frame_mem_ctrl for YUV420 and YVU420 formats
	media: atomisp: fix the uninitialized use and rename "retvalue"
	Bluetooth: sco: prevent information leak in sco_conn_defer_accept()
	6lowpan: iphc: Fix an off-by-one check of array index
	drm/amdgpu/acp: Make PM domain really work
	tcp: seq_file: Avoid skipping sk during tcp_seek_last_pos
	ARM: dts: meson8: Use a higher default GPU clock frequency
	ARM: dts: meson8b: odroidc1: Fix the pwm regulator supply properties
	ARM: dts: meson8b: mxq: Fix the pwm regulator supply properties
	ARM: dts: meson8b: ec100: Fix the pwm regulator supply properties
	net/mlx5e: Prohibit inner indir TIRs in IPoIB
	net/mlx5e: Block LRO if firmware asks for tunneled LRO
	cgroup/cpuset: Fix a partition bug with hotplug
	drm: mxsfb: Enable recovery on underflow
	drm: mxsfb: Increase number of outstanding requests on V4 and newer HW
	drm: mxsfb: Clear FIFO_CLEAR bit
	net: cipso: fix warnings in netlbl_cipsov4_add_std
	Bluetooth: mgmt: Fix wrong opcode in the response for add_adv cmd
	arm64: dts: renesas: rzg2: Convert EtherAVB to explicit delay handling
	arm64: dts: renesas: hihope-rzg2-ex: Add EtherAVB internal rx delay
	devlink: Break parameter notification sequence to be before/after unload/load driver
	net/mlx5: Fix missing return value in mlx5_devlink_eswitch_inline_mode_set()
	i2c: highlander: add IRQ check
	leds: lt3593: Put fwnode in any case during ->probe()
	leds: trigger: audio: Add an activate callback to ensure the initial brightness is set
	media: em28xx-input: fix refcount bug in em28xx_usb_disconnect
	media: venus: venc: Fix potential null pointer dereference on pointer fmt
	PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently
	PCI: PM: Enable PME if it can be signaled from D3cold
	bpf, samples: Add missing mprog-disable to xdp_redirect_cpu's optstring
	soc: qcom: smsm: Fix missed interrupts if state changes while masked
	debugfs: Return error during {full/open}_proxy_open() on rmmod
	Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow
	PM: EM: Increase energy calculation precision
	selftests/bpf: Fix bpf-iter-tcp4 test to print correctly the dest IP
	drm/msm/mdp4: refactor HW revision detection into read_mdp_hw_revision
	drm/msm/mdp4: move HW revision detection to earlier phase
	drm/msm/dpu: make dpu_hw_ctl_clear_all_blendstages clear necessary LMs
	arm64: dts: exynos: correct GIC CPU interfaces address range on Exynos7
	counter: 104-quad-8: Return error when invalid mode during ceiling_write
	cgroup/cpuset: Miscellaneous code cleanup
	cgroup/cpuset: Fix violation of cpuset locking rule
	ASoC: Intel: Fix platform ID matching
	Bluetooth: fix repeated calls to sco_sock_kill
	drm/msm/dsi: Fix some reference counted resource leaks
	net/mlx5: Register to devlink ingress VLAN filter trap
	net/mlx5: Fix unpublish devlink parameters
	ASoC: rt5682: Implement remove callback
	ASoC: rt5682: Properly turn off regulators if wrong device ID
	usb: dwc3: meson-g12a: add IRQ check
	usb: dwc3: qcom: add IRQ check
	usb: gadget: udc: at91: add IRQ check
	usb: gadget: udc: s3c2410: add IRQ check
	usb: phy: fsl-usb: add IRQ check
	usb: phy: twl6030: add IRQ checks
	usb: gadget: udc: renesas_usb3: Fix soc_device_match() abuse
	selftests/bpf: Fix test_core_autosize on big-endian machines
	devlink: Clear whole devlink_flash_notify struct
	samples: pktgen: add missing IPv6 option to pktgen scripts
	Bluetooth: Move shutdown callback before flushing tx and rx queue
	PM: cpu: Make notifier chain use a raw_spinlock_t
	usb: host: ohci-tmio: add IRQ check
	usb: phy: tahvo: add IRQ check
	libbpf: Re-build libbpf.so when libbpf.map changes
	mac80211: Fix insufficient headroom issue for AMSDU
	locking/lockdep: Mark local_lock_t
	locking/local_lock: Add missing owner initialization
	lockd: Fix invalid lockowner cast after vfs_test_lock
	nfsd4: Fix forced-expiry locking
	arm64: dts: marvell: armada-37xx: Extend PCIe MEM space
	clk: staging: correct reference to config IOMEM to config HAS_IOMEM
	i2c: synquacer: fix deferred probing
	firmware: raspberrypi: Keep count of all consumers
	firmware: raspberrypi: Fix a leak in 'rpi_firmware_get()'
	usb: gadget: mv_u3d: request_irq() after initializing UDC
	mm/swap: consider max pages in iomap_swapfile_add_extent
	lkdtm: replace SCSI_DISPATCH_CMD with SCSI_QUEUE_RQ
	Bluetooth: add timeout sanity check to hci_inquiry
	i2c: iop3xx: fix deferred probing
	i2c: s3c2410: fix IRQ check
	i2c: fix platform_get_irq.cocci warnings
	i2c: hix5hd2: fix IRQ check
	gfs2: init system threads before freeze lock
	rsi: fix error code in rsi_load_9116_firmware()
	rsi: fix an error code in rsi_probe()
	ASoC: Intel: kbl_da7219_max98927: Fix format selection for max98373
	ASoC: Intel: Skylake: Leave data as is when invoking TLV IPCs
	ASoC: Intel: Skylake: Fix module resource and format selection
	mmc: sdhci: Fix issue with uninitialized dma_slave_config
	mmc: dw_mmc: Fix issue with uninitialized dma_slave_config
	mmc: moxart: Fix issue with uninitialized dma_slave_config
	bpf: Fix possible out of bound write in narrow load handling
	CIFS: Fix a potencially linear read overflow
	i2c: mt65xx: fix IRQ check
	i2c: xlp9xx: fix main IRQ check
	usb: ehci-orion: Handle errors of clk_prepare_enable() in probe
	usb: bdc: Fix an error handling path in 'bdc_probe()' when no suitable DMA config is available
	usb: bdc: Fix a resource leak in the error handling path of 'bdc_probe()'
	tty: serial: fsl_lpuart: fix the wrong mapbase value
	ASoC: wcd9335: Fix a double irq free in the remove function
	ASoC: wcd9335: Fix a memory leak in the error handling path of the probe function
	ASoC: wcd9335: Disable irq on slave ports in the remove function
	iwlwifi: follow the new inclusive terminology
	iwlwifi: skip first element in the WTAS ACPI table
	ice: Only lock to update netdev dev_addr
	ath6kl: wmi: fix an error code in ath6kl_wmi_sync_point()
	atlantic: Fix driver resume flow.
	bcma: Fix memory leak for internally-handled cores
	brcmfmac: pcie: fix oops on failure to resume and reprobe
	ipv6: make exception cache less predictible
	ipv4: make exception cache less predictible
	net: sched: Fix qdisc_rate_table refcount leak when get tcf_block failed
	net: qualcomm: fix QCA7000 checksum handling
	octeontx2-af: Fix loop in free and unmap counter
	octeontx2-af: Fix static code analyzer reported issues
	octeontx2-af: Set proper errorcode for IPv4 checksum errors
	ipv4: fix endianness issue in inet_rtm_getroute_build_skb()
	ASoC: rt5682: Remove unused variable in rt5682_i2c_remove()
	iwlwifi Add support for ax201 in Samsung Galaxy Book Flex2 Alpha
	f2fs: guarantee to write dirty data when enabling checkpoint back
	time: Handle negative seconds correctly in timespec64_to_ns()
	io_uring: IORING_OP_WRITE needs hash_reg_file set
	bio: fix page leak bio_add_hw_page failure
	tty: Fix data race between tiocsti() and flush_to_ldisc()
	perf/x86/amd/ibs: Extend PERF_PMU_CAP_NO_EXCLUDE to IBS Op
	x86/resctrl: Fix a maybe-uninitialized build warning treated as error
	Revert "KVM: x86: mmu: Add guest physical address check in translate_gpa()"
	KVM: s390: index kvm->arch.idle_mask by vcpu_idx
	KVM: x86: Update vCPU's hv_clock before back to guest when tsc_offset is adjusted
	KVM: VMX: avoid running vmx_handle_exit_irqoff in case of emulation
	KVM: nVMX: Unconditionally clear nested.pi_pending on nested VM-Enter
	ARM: dts: at91: add pinctrl-{names, 0} for all gpios
	fuse: truncate pagecache on atomic_o_trunc
	fuse: flush extending writes
	IMA: remove -Wmissing-prototypes warning
	IMA: remove the dependency on CRYPTO_MD5
	fbmem: don't allow too huge resolutions
	backlight: pwm_bl: Improve bootloader/kernel device handover
	clk: kirkwood: Fix a clocking boot regression
	Linux 5.10.65

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ie0b9306ba6ee4193de3200df7cdacaeba152b83e
2021-09-15 14:16:47 +02:00
Eric Dumazet
c4f1ad3930 ipv4: fix endianness issue in inet_rtm_getroute_build_skb()
[ Upstream commit 92548b0ee2 ]

The UDP length field should be in network order.
This removes the following sparse error:

net/ipv4/route.c:3173:27: warning: incorrect type in assignment (different base types)
net/ipv4/route.c:3173:27:    expected restricted __be16 [usertype] len
net/ipv4/route.c:3173:27:    got unsigned long

Fixes: 404eb77ea7 ("ipv4: support sport, dport and ip_proto in RTM_GETROUTE")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Roopa Prabhu <roopa@nvidia.com>
Cc: David Ahern <dsahern@kernel.org>
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-09-15 09:50:46 +02:00
Xiyu Yang
f96bc82e03 net: sched: Fix qdisc_rate_table refcount leak when get tcf_block failed
[ Upstream commit c660701258 ]

The reference counting issue happens in one exception handling path of
cbq_change_class(). When failing to get tcf_block, the function forgets
to decrease the refcount of "rtab" increased by qdisc_put_rtab(),
causing a refcount leak.

Fix this issue by jumping to "failure" label when get tcf_block failed.

Fixes: 6529eaba33 ("net: sched: introduce tcf block infractructure")
Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Reviewed-by: Cong Wang <cong.wang@bytedance.com>
Link: https://lore.kernel.org/r/1630252681-71588-1-git-send-email-xiyuyang19@fudan.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-09-15 09:50:45 +02:00
Eric Dumazet
5867e20e18 ipv4: make exception cache less predictible
[ Upstream commit 67d6d681e1 ]

Even after commit 6457378fe7 ("ipv4: use siphash instead of Jenkins in
fnhe_hashfun()"), an attacker can still use brute force to learn
some secrets from a victim linux host.

One way to defeat these attacks is to make the max depth of the hash
table bucket a random value.

Before this patch, each bucket of the hash table used to store exceptions
could contain 6 items under attack.

After the patch, each bucket would contains a random number of items,
between 6 and 10. The attacker can no longer infer secrets.

This is slightly increasing memory size used by the hash table,
by 50% in average, we do not expect this to be a problem.

This patch is more complex than the prior one (IPv6 equivalent),
because IPv4 was reusing the oldest entry.
Since we need to be able to evict more than one entry per
update_or_create_fnhe() call, I had to replace
fnhe_oldest() with fnhe_remove_oldest().

Also note that we will queue extra kfree_rcu() calls under stress,
which hopefully wont be a too big issue.

Fixes: 4895c771c7 ("ipv4: Add FIB nexthop exceptions.")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Keyu Man <kman001@ucr.edu>
Cc: Willy Tarreau <w@1wt.eu>
Signed-off-by: David S. Miller <davem@davemloft.net>
Reviewed-by: David Ahern <dsahern@kernel.org>
Tested-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-09-15 09:50:45 +02:00
Eric Dumazet
8692f0bb29 ipv6: make exception cache less predictible
[ Upstream commit a00df2caff ]

Even after commit 4785305c05 ("ipv6: use siphash in rt6_exception_hash()"),
an attacker can still use brute force to learn some secrets from a victim
linux host.

One way to defeat these attacks is to make the max depth of the hash
table bucket a random value.

Before this patch, each bucket of the hash table used to store exceptions
could contain 6 items under attack.

After the patch, each bucket would contains a random number of items,
between 6 and 10. The attacker can no longer infer secrets.

This is slightly increasing memory size used by the hash table,
we do not expect this to be a problem.

Following patch is dealing with the same issue in IPv4.

Fixes: 35732d01fe ("ipv6: introduce a hash table to store dst cache")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Keyu Man <kman001@ucr.edu>
Cc: Wei Wang <weiwan@google.com>
Cc: Martin KaFai Lau <kafai@fb.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-09-15 09:50:45 +02:00
Pavel Skripkin
50e6f34499 Bluetooth: add timeout sanity check to hci_inquiry
[ Upstream commit f41a4b2b5e ]

Syzbot hit "task hung" bug in hci_req_sync(). The problem was in
unreasonable huge inquiry timeout passed from userspace.
Fix it by adding sanity check for timeout value to hci_inquiry().

Since hci_inquiry() is the only user of hci_req_sync() with user
controlled timeout value, it makes sense to check timeout value in
hci_inquiry() and don't touch hci_req_sync().

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-and-tested-by: syzbot+be2baed593ea56c6a84c@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-09-15 09:50:42 +02:00
Chih-Kang Chang
22b106df73 mac80211: Fix insufficient headroom issue for AMSDU
[ Upstream commit f50d2ff8f0 ]

ieee80211_amsdu_realloc_pad() fails to account for extra_tx_headroom,
the original reserved headroom might be eaten. Add the necessary
extra_tx_headroom.

Fixes: 6e0456b545 ("mac80211: add A-MSDU tx support")
Signed-off-by: Chih-Kang Chang <gary.chang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://lore.kernel.org/r/20210816085128.10931-2-pkshih@realtek.com
[fix indentation]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-09-15 09:50:40 +02:00
Kai-Heng Feng
4711284768 Bluetooth: Move shutdown callback before flushing tx and rx queue
[ Upstream commit 0ea53674d0 ]

Commit 0ea9fd001a ("Bluetooth: Shutdown controller after workqueues
are flushed or cancelled") introduced a regression that makes mtkbtsdio
driver stops working:
[   36.593956] Bluetooth: hci0: Firmware already downloaded
[   46.814613] Bluetooth: hci0: Execution of wmt command timed out
[   46.814619] Bluetooth: hci0: Failed to send wmt func ctrl (-110)

The shutdown callback depends on the result of hdev->rx_work, so we
should call it before flushing rx_work:
-> btmtksdio_shutdown()
 -> mtk_hci_wmt_sync()
  -> __hci_cmd_send()
   -> wait for BTMTKSDIO_TX_WAIT_VND_EVT gets cleared

-> btmtksdio_recv_event()
 -> hci_recv_frame()
  -> queue_work(hdev->workqueue, &hdev->rx_work)
   -> clears BTMTKSDIO_TX_WAIT_VND_EVT

So move the shutdown callback before flushing TX/RX queue to resolve the
issue.

Reported-and-tested-by: Mattijs Korpershoek <mkorpershoek@baylibre.com>
Tested-by: Hsin-Yi Wang <hsinyi@chromium.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Fixes: 0ea9fd001a ("Bluetooth: Shutdown controller after workqueues are flushed or cancelled")
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-09-15 09:50:40 +02:00
Leon Romanovsky
2c0b826f4a devlink: Clear whole devlink_flash_notify struct
[ Upstream commit ed43fbac71 ]

The { 0 } doesn't clear all fields in the struct, but tells to the
compiler to set all fields to zero and doesn't touch any sub-fields
if they exists.

The {} is an empty initialiser that instructs to fully initialize whole
struct including sub-fields, which is error-prone for future
devlink_flash_notify extensions.

Fixes: 6700acc5f1 ("devlink: collect flash notify params into a struct")
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-09-15 09:50:40 +02:00
Desmond Cheong Zhi Xi
059c2c09f4 Bluetooth: fix repeated calls to sco_sock_kill
[ Upstream commit e1dee2c1de ]

In commit 4e1a720d03 ("Bluetooth: avoid killing an already killed
socket"), a check was added to sco_sock_kill to skip killing a socket
if the SOCK_DEAD flag was set.

This was done after a trace for a use-after-free bug showed that the
same sock pointer was being killed twice.

Unfortunately, this check prevents sco_sock_kill from running on any
socket. sco_sock_kill kills a socket only if it's zapped and orphaned,
however sock_orphan announces that the socket is dead before detaching
it. i.e., orphaned sockets have the SOCK_DEAD flag set.

To fix this, we remove the check for SOCK_DEAD, and avoid repeated
calls to sco_sock_kill by removing incorrect calls in:

1. sco_sock_timeout. The socket should not be killed on timeout as
further processing is expected to be done. For example,
sco_sock_connect sets the timer then waits for the socket to be
connected or for an error to be returned.

2. sco_conn_del. This function should clean up resources for the
connection, but the socket itself should be cleaned up in
sco_sock_release.

3. sco_sock_close. Calls to sco_sock_close in sco_sock_cleanup_listen
and sco_sock_release are followed by sco_sock_kill. Hence the
duplicated call should be removed.

Fixes: 4e1a720d03 ("Bluetooth: avoid killing an already killed socket")
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-09-15 09:50:38 +02:00
Colin Ian King
5014a8453f Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow
[ Upstream commit 713baf3dae ]

An earlier commit replaced using batostr to using %pMR sprintf for the
construction of session->name. Static analysis detected that this new
method can use a total of 21 characters (including the trailing '\0')
so we need to increase the BTNAMSIZ from 18 to 21 to fix potential
buffer overflows.

Addresses-Coverity: ("Out-of-bounds write")
Fixes: fcb73338ed ("Bluetooth: Use %pMR in sprintf/seq_printf instead of batostr")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-09-15 09:50:37 +02:00
Leon Romanovsky
b376ae5597 devlink: Break parameter notification sequence to be before/after unload/load driver
[ Upstream commit 05a7f4a8df ]

The change of namespaces during devlink reload calls to driver unload
before it accesses devlink parameters. The commands below causes to
use-after-free bug when trying to get flow steering mode.

 * ip netns add n1
 * devlink dev reload pci/0000:00:09.0 netns n1

 ==================================================================
 BUG: KASAN: use-after-free in mlx5_devlink_fs_mode_get+0x96/0xa0 [mlx5_core]
 Read of size 4 at addr ffff888009d04308 by task devlink/275

 CPU: 6 PID: 275 Comm: devlink Not tainted 5.12.0-rc2+ #2853
 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
 Call Trace:
  dump_stack+0x93/0xc2
  print_address_description.constprop.0+0x18/0x140
  ? mlx5_devlink_fs_mode_get+0x96/0xa0 [mlx5_core]
  ? mlx5_devlink_fs_mode_get+0x96/0xa0 [mlx5_core]
  kasan_report.cold+0x7c/0xd8
  ? mlx5_devlink_fs_mode_get+0x96/0xa0 [mlx5_core]
  mlx5_devlink_fs_mode_get+0x96/0xa0 [mlx5_core]
  devlink_nl_param_fill+0x1c8/0xe80
  ? __free_pages_ok+0x37a/0x8a0
  ? devlink_flash_update_timeout_notify+0xd0/0xd0
  ? lock_acquire+0x1a9/0x6d0
  ? fs_reclaim_acquire+0xb7/0x160
  ? lock_is_held_type+0x98/0x110
  ? 0xffffffff81000000
  ? lock_release+0x1f9/0x6c0
  ? fs_reclaim_release+0xa1/0xf0
  ? lock_downgrade+0x6d0/0x6d0
  ? lock_is_held_type+0x98/0x110
  ? lock_is_held_type+0x98/0x110
  ? memset+0x20/0x40
  ? __build_skb_around+0x1f8/0x2b0
  devlink_param_notify+0x6d/0x180
  devlink_reload+0x1c3/0x520
  ? devlink_remote_reload_actions_performed+0x30/0x30
  ? mutex_trylock+0x24b/0x2d0
  ? devlink_nl_cmd_reload+0x62b/0x1070
  devlink_nl_cmd_reload+0x66d/0x1070
  ? devlink_reload+0x520/0x520
  ? devlink_get_from_attrs+0x1bc/0x260
  ? devlink_nl_pre_doit+0x64/0x4d0
  genl_family_rcv_msg_doit+0x1e9/0x2f0
  ? mutex_lock_io_nested+0x1130/0x1130
  ? genl_family_rcv_msg_attrs_parse.constprop.0+0x240/0x240
  ? security_capable+0x51/0x90
  genl_rcv_msg+0x27f/0x4a0
  ? genl_get_cmd+0x3c0/0x3c0
  ? lock_acquire+0x1a9/0x6d0
  ? devlink_reload+0x520/0x520
  ? lock_release+0x6c0/0x6c0
  netlink_rcv_skb+0x11d/0x340
  ? genl_get_cmd+0x3c0/0x3c0
  ? netlink_ack+0x9f0/0x9f0
  ? lock_release+0x1f9/0x6c0
  genl_rcv+0x24/0x40
  netlink_unicast+0x433/0x700
  ? netlink_attachskb+0x730/0x730
  ? _copy_from_iter_full+0x178/0x650
  ? __alloc_skb+0x113/0x2b0
  netlink_sendmsg+0x6f1/0xbd0
  ? netlink_unicast+0x700/0x700
  ? lock_is_held_type+0x98/0x110
  ? netlink_unicast+0x700/0x700
  sock_sendmsg+0xb0/0xe0
  __sys_sendto+0x193/0x240
  ? __x64_sys_getpeername+0xb0/0xb0
  ? do_sys_openat2+0x10b/0x370
  ? __up_read+0x1a1/0x7b0
  ? do_user_addr_fault+0x219/0xdc0
  ? __x64_sys_openat+0x120/0x1d0
  ? __x64_sys_open+0x1a0/0x1a0
  __x64_sys_sendto+0xdd/0x1b0
  ? syscall_enter_from_user_mode+0x1d/0x50
  do_syscall_64+0x2d/0x40
  entry_SYSCALL_64_after_hwframe+0x44/0xae
 RIP: 0033:0x7fc69d0af14a
 Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 76 c3 0f 1f 44 00 00 55 48 83 ec 30 44 89 4c
 RSP: 002b:00007ffc1d8292f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
 RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007fc69d0af14a
 RDX: 0000000000000038 RSI: 0000555f57c56440 RDI: 0000000000000003
 RBP: 0000555f57c56410 R08: 00007fc69d17b200 R09: 000000000000000c
 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000

 Allocated by task 146:
  kasan_save_stack+0x1b/0x40
  __kasan_kmalloc+0x99/0xc0
  mlx5_init_fs+0xf0/0x1c50 [mlx5_core]
  mlx5_load+0xd2/0x180 [mlx5_core]
  mlx5_init_one+0x2f6/0x450 [mlx5_core]
  probe_one+0x47d/0x6e0 [mlx5_core]
  pci_device_probe+0x2a0/0x4a0
  really_probe+0x20a/0xc90
  driver_probe_device+0xd8/0x380
  device_driver_attach+0x1df/0x250
  __driver_attach+0xff/0x240
  bus_for_each_dev+0x11e/0x1a0
  bus_add_driver+0x309/0x570
  driver_register+0x1ee/0x380
  0xffffffffa06b8062
  do_one_initcall+0xd5/0x410
  do_init_module+0x1c8/0x760
  load_module+0x6d8b/0x9650
  __do_sys_finit_module+0x118/0x1b0
  do_syscall_64+0x2d/0x40
  entry_SYSCALL_64_after_hwframe+0x44/0xae

 Freed by task 275:
  kasan_save_stack+0x1b/0x40
  kasan_set_track+0x1c/0x30
  kasan_set_free_info+0x20/0x30
  __kasan_slab_free+0x102/0x140
  slab_free_freelist_hook+0x74/0x1b0
  kfree+0xd7/0x2a0
  mlx5_unload+0x16/0xb0 [mlx5_core]
  mlx5_unload_one+0xae/0x120 [mlx5_core]
  mlx5_devlink_reload_down+0x1bc/0x380 [mlx5_core]
  devlink_reload+0x141/0x520
  devlink_nl_cmd_reload+0x66d/0x1070
  genl_family_rcv_msg_doit+0x1e9/0x2f0
  genl_rcv_msg+0x27f/0x4a0
  netlink_rcv_skb+0x11d/0x340
  genl_rcv+0x24/0x40
  netlink_unicast+0x433/0x700
  netlink_sendmsg+0x6f1/0xbd0
  sock_sendmsg+0xb0/0xe0
  __sys_sendto+0x193/0x240
  __x64_sys_sendto+0xdd/0x1b0
  do_syscall_64+0x2d/0x40
  entry_SYSCALL_64_after_hwframe+0x44/0xae

 The buggy address belongs to the object at ffff888009d04300
  which belongs to the cache kmalloc-128 of size 128
 The buggy address is located 8 bytes inside of
  128-byte region [ffff888009d04300, ffff888009d04380)
 The buggy address belongs to the page:
 page:0000000086a64ecc refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888009d04000 pfn:0x9d04
 head:0000000086a64ecc order:1 compound_mapcount:0
 flags: 0x4000000000010200(slab|head)
 raw: 4000000000010200 ffffea0000203980 0000000200000002 ffff8880050428c0
 raw: ffff888009d04000 000000008020001d 00000001ffffffff 0000000000000000
 page dumped because: kasan: bad access detected

 Memory state around the buggy address:
  ffff888009d04200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  ffff888009d04280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 >ffff888009d04300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                       ^
  ffff888009d04380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
  ffff888009d04400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ==================================================================

The right solution to devlink reload is to notify about deletion of
parameters, unload driver, change net namespaces, load driver and notify
about addition of parameters.

Fixes: 070c63f20f ("net: devlink: allow to change namespaces during reload")
Reviewed-by: Parav Pandit <parav@nvidia.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-09-15 09:50:36 +02:00
Tedd Ho-Jeong An
61b1db2358 Bluetooth: mgmt: Fix wrong opcode in the response for add_adv cmd
[ Upstream commit a25fca4d3c ]

This patch fixes the MGMT add_advertising command repsones with the
wrong opcode when it is trying to return the not supported error.

Fixes: cbbdfa6f33 ("Bluetooth: Enable controller RPA resolution using Experimental feature")
Signed-off-by: Tedd Ho-Jeong An <tedd.an@intel.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-09-15 09:50:35 +02:00
Pavel Skripkin
bca46d2283 net: cipso: fix warnings in netlbl_cipsov4_add_std
[ Upstream commit 8ca34a13f7 ]

Syzbot reported warning in netlbl_cipsov4_add(). The
problem was in too big doi_def->map.std->lvl.local_size
passed to kcalloc(). Since this value comes from userpace there is
no need to warn if value is not correct.

The same problem may occur with other kcalloc() calls in
this function, so, I've added __GFP_NOWARN flag to all
kcalloc() calls there.

Reported-and-tested-by: syzbot+cdd51ee2e6b0b2e18c0d@syzkaller.appspotmail.com
Fixes: 96cb8e3313 ("[NetLabel]: CIPSOv4 and Unlabeled packet integration")
Acked-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-09-15 09:50:35 +02:00
Martin KaFai Lau
a7d0a59e21 tcp: seq_file: Avoid skipping sk during tcp_seek_last_pos
[ Upstream commit 525e2f9fd0 ]

st->bucket stores the current bucket number.
st->offset stores the offset within this bucket that is the sk to be
seq_show().  Thus, st->offset only makes sense within the same
st->bucket.

These two variables are an optimization for the common no-lseek case.
When resuming the seq_file iteration (i.e. seq_start()),
tcp_seek_last_pos() tries to continue from the st->offset
at bucket st->bucket.

However, it is possible that the bucket pointed by st->bucket
has changed and st->offset may end up skipping the whole st->bucket
without finding a sk.  In this case, tcp_seek_last_pos() currently
continues to satisfy the offset condition in the next (and incorrect)
bucket.  Instead, regardless of the offset value, the first sk of the
next bucket should be returned.  Thus, "bucket == st->bucket" check is
added to tcp_seek_last_pos().

The chance of hitting this is small and the issue is a decade old,
so targeting for the next tree.

Fixes: a8b690f98b ("tcp: Fix slowness in read /proc/net/tcp")
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Acked-by: Kuniyuki Iwashima <kuniyu@amazon.co.jp>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20210701200541.1033917-1-kafai@fb.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-09-15 09:50:34 +02:00
Colin Ian King
c7ebd3622b 6lowpan: iphc: Fix an off-by-one check of array index
[ Upstream commit 9af417610b ]

The bounds check of id is off-by-one and the comparison should
be >= rather >. Currently the WARN_ON_ONCE check does not stop
the out of range indexing of &ldev->ctx.table[id] so also add
a return path if the bounds are out of range.

Addresses-Coverity: ("Illegal address computation").
Fixes: 5609c185f2 ("6lowpan: iphc: add support for stateful compression")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-09-15 09:50:34 +02:00
Dan Carpenter
def6efdf91 Bluetooth: sco: prevent information leak in sco_conn_defer_accept()
[ Upstream commit 59da0b38bc ]

Smatch complains that some of these struct members are not initialized
leading to a stack information disclosure:

    net/bluetooth/sco.c:778 sco_conn_defer_accept() warn:
    check that 'cp.retrans_effort' doesn't leak information

This seems like a valid warning.  I've added a default case to fix
this issue.

Fixes: 2f69a82acf ("Bluetooth: Use voice setting in deferred SCO connection request")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-09-15 09:50:34 +02:00
Greg Kroah-Hartman
c8de3a470a This is the 5.10.64 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmE9pRsACgkQONu9yGCS
 aT4GqRAAzjCqjeEQ+JgWzP5N9YXXqzQI6s6PNqyEZpQiQF3tak12WZh02/zYhyZf
 nLiJgB/RitgPcbvSeRLSV9gYbAhL0HGI0DZ7wA821esA3+ywuS/21D2g49YuU0Cy
 mpTh4w1wm/dES4sZchhIMN+fzx81T/xHyiHkuA+wAU+o/bn4Qf+eCevKe2+8D2UC
 vr5Oc0k+RvAF16pFRd+MKSR0JNNPEpS962KnRFYUk47hjMk/aH4FhQCSP+nqXcJW
 3WuI+FR/UTltGMDe4/WIwlxQxsf4wMOMwEwRi0v5oyhwC4oCpZD3FlcNPJ81J6MS
 GkNukV/mvIKZ/IVD2F3YY34nHLE2RMkGKMbYSc9ONYWPEgGFnxINnXQZonPkazEN
 IA7GSPjxS4ToxETmDVVErIGQx/iCYnp9FJk+wqgrJ3z/e/qKZpt8C7RUDGJFzKjC
 WeRDFHtvdZT1WcmiUfrXz8qcbf2e1dPorYJ5tRi7hztrEx4XzwARSGGeW7H5rXJT
 50Q1oGL5IHj5lBe4BMbI59v1jQxzt0Tyyenv0xq/Jfrnmk0IrmUo0DiGZGO9Zxko
 as+HR3NNGl27uvlmz+bZ+ztL1DoXvJpkaGoCXTwBimg+/TAT9cSA+bFhI9+lvigx
 Ez6vInwcWkL6Tk5DlCeR7H0dBlKFGxktWHN5+qs0gSZoXPXZfK8=
 =AflS
 -----END PGP SIGNATURE-----

Merge 5.10.64 into android12-5.10-lts

Changes in 5.10.64
	igmp: Add ip_mc_list lock in ip_check_mc_rcu
	USB: serial: mos7720: improve OOM-handling in read_mos_reg()
	net: ll_temac: Remove left-over debug message
	mm/page_alloc: speed up the iteration of max_order
	net: kcov: don't select SKB_EXTENSIONS when there is no NET
	serial: 8250: 8250_omap: Fix unused variable warning
	net: linux/skbuff.h: combine SKB_EXTENSIONS + KCOV handling
	tty: drop termiox user definitions
	Revert "r8169: avoid link-up interrupt issue on RTL8106e if user enables ASPM"
	x86/events/amd/iommu: Fix invalid Perf result due to IOMMU PMC power-gating
	blk-mq: fix kernel panic during iterating over flush request
	blk-mq: fix is_flush_rq
	netfilter: nftables: avoid potential overflows on 32bit arches
	netfilter: nf_tables: initialize set before expression setup
	netfilter: nftables: clone set element expression template
	blk-mq: clearing flush request reference in tags->rqs[]
	ALSA: usb-audio: Add registration quirk for JBL Quantum 800
	usb: host: xhci-rcar: Don't reload firmware after the completion
	usb: gadget: tegra-xudc: fix the wrong mult value for HS isoc or intr
	usb: mtu3: restore HS function when set SS/SSP
	usb: mtu3: use @mult for HS isoc or intr
	usb: mtu3: fix the wrong HS mult value
	xhci: fix even more unsafe memory usage in xhci tracing
	xhci: fix unsafe memory usage in xhci tracing
	x86/reboot: Limit Dell Optiplex 990 quirk to early BIOS versions
	PCI: Call Max Payload Size-related fixup quirks early
	Linux 5.10.64

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I2269075a6d5eb6121b6e42a28d4f3fd0c252695c
2021-09-12 09:17:13 +02:00
Pablo Neira Ayuso
e51ff3ffc3 netfilter: nftables: clone set element expression template
commit 4d8f906583 upstream.

memcpy() breaks when using connlimit in set elements. Use
nft_expr_clone() to initialize the connlimit expression list, otherwise
connlimit garbage collector crashes when walking on the list head copy.

[  493.064656] Workqueue: events_power_efficient nft_rhash_gc [nf_tables]
[  493.064685] RIP: 0010:find_or_evict+0x5a/0x90 [nf_conncount]
[  493.064694] Code: 2b 43 40 83 f8 01 77 0d 48 c7 c0 f5 ff ff ff 44 39 63 3c 75 df 83 6d 18 01 48 8b 43 08 48 89 de 48 8b 13 48 8b 3d ee 2f 00 00 <48> 89 42 08 48 89 10 48 b8 00 01 00 00 00 00 ad de 48 89 03 48 83
[  493.064699] RSP: 0018:ffffc90000417dc0 EFLAGS: 00010297
[  493.064704] RAX: 0000000000000000 RBX: ffff888134f38410 RCX: 0000000000000000
[  493.064708] RDX: 0000000000000000 RSI: ffff888134f38410 RDI: ffff888100060cc0
[  493.064711] RBP: ffff88812ce594a8 R08: ffff888134f38438 R09: 00000000ebb9025c
[  493.064714] R10: ffffffff8219f838 R11: 0000000000000017 R12: 0000000000000001
[  493.064718] R13: ffffffff82146740 R14: ffff888134f38410 R15: 0000000000000000
[  493.064721] FS:  0000000000000000(0000) GS:ffff88840e440000(0000) knlGS:0000000000000000
[  493.064725] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  493.064729] CR2: 0000000000000008 CR3: 00000001330aa002 CR4: 00000000001706e0
[  493.064733] Call Trace:
[  493.064737]  nf_conncount_gc_list+0x8f/0x150 [nf_conncount]
[  493.064746]  nft_rhash_gc+0x106/0x390 [nf_tables]

Reported-by: Laura Garcia Liebana <nevola@gmail.com>
Fixes: 4094445229 ("netfilter: nf_tables: add elements with stateful expressions")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-09-12 08:58:27 +02:00
Pablo Neira Ayuso
36983fc2f8 netfilter: nf_tables: initialize set before expression setup
commit ad9f151e56 upstream.

nft_set_elem_expr_alloc() needs an initialized set if expression sets on
the NFT_EXPR_GC flag. Move set fields initialization before expression
setup.

[4512935.019450] ==================================================================
[4512935.019456] BUG: KASAN: null-ptr-deref in nft_set_elem_expr_alloc+0x84/0xd0 [nf_tables]
[4512935.019487] Read of size 8 at addr 0000000000000070 by task nft/23532
[4512935.019494] CPU: 1 PID: 23532 Comm: nft Not tainted 5.12.0-rc4+ #48
[...]
[4512935.019502] Call Trace:
[4512935.019505]  dump_stack+0x89/0xb4
[4512935.019512]  ? nft_set_elem_expr_alloc+0x84/0xd0 [nf_tables]
[4512935.019536]  ? nft_set_elem_expr_alloc+0x84/0xd0 [nf_tables]
[4512935.019560]  kasan_report.cold.12+0x5f/0xd8
[4512935.019566]  ? nft_set_elem_expr_alloc+0x84/0xd0 [nf_tables]
[4512935.019590]  nft_set_elem_expr_alloc+0x84/0xd0 [nf_tables]
[4512935.019615]  nf_tables_newset+0xc7f/0x1460 [nf_tables]

Reported-by: syzbot+ce96ca2b1d0b37c6422d@syzkaller.appspotmail.com
Fixes: 65038428b2 ("netfilter: nf_tables: allow to specify stateful expression in set definition")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-09-12 08:58:27 +02:00
Eric Dumazet
3fda454f90 netfilter: nftables: avoid potential overflows on 32bit arches
commit 6c8774a94e upstream.

User space could ask for very large hash tables, we need to make sure
our size computations wont overflow.

nf_tables_newset() needs to double check the u64 size
will fit into size_t field.

Fixes: 0ed6389c48 ("netfilter: nf_tables: rename set implementations")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-09-12 08:58:27 +02:00
Liu Jian
ddd7e8b7b8 igmp: Add ip_mc_list lock in ip_check_mc_rcu
commit 23d2b94043 upstream.

I got below panic when doing fuzz test:

Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 4056 Comm: syz-executor.3 Tainted: G    B             5.14.0-rc1-00195-gcff5c4254439-dirty #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
Call Trace:
dump_stack_lvl+0x7a/0x9b
panic+0x2cd/0x5af
end_report.cold+0x5a/0x5a
kasan_report+0xec/0x110
ip_check_mc_rcu+0x556/0x5d0
__mkroute_output+0x895/0x1740
ip_route_output_key_hash_rcu+0x2d0/0x1050
ip_route_output_key_hash+0x182/0x2e0
ip_route_output_flow+0x28/0x130
udp_sendmsg+0x165d/0x2280
udpv6_sendmsg+0x121e/0x24f0
inet6_sendmsg+0xf7/0x140
sock_sendmsg+0xe9/0x180
____sys_sendmsg+0x2b8/0x7a0
___sys_sendmsg+0xf0/0x160
__sys_sendmmsg+0x17e/0x3c0
__x64_sys_sendmmsg+0x9e/0x100
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x462eb9
Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8
 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48>
 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3df5af1c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000462eb9
RDX: 0000000000000312 RSI: 0000000020001700 RDI: 0000000000000007
RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f3df5af26bc
R13: 00000000004c372d R14: 0000000000700b10 R15: 00000000ffffffff

It is one use-after-free in ip_check_mc_rcu.
In ip_mc_del_src, the ip_sf_list of pmc has been freed under pmc->lock protection.
But access to ip_sf_list in ip_check_mc_rcu is not protected by the lock.

Signed-off-by: Liu Jian <liujian56@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-09-12 08:58:26 +02:00
Greg Kroah-Hartman
674d2ac211 This is the 5.10.62 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmEx2IsACgkQONu9yGCS
 aT6bihAA1pqL2x40IIk7nmu3XW/lNJxt4WLRjT7kGehDYE5gNz5VTQDaccb/+PiM
 18XjLN0RcSkhiai8410A/SNoHBvPSMWrNvf093NpFcGm0WcvsZVyNUfRgdXfs1N8
 FM1DAgA5eVowL+CthZyJIIRX6VllLAg1b3Z61frNO/t1nOUsS26enoxMSeaziqjz
 BuvajftaRGtJBMA3iNB1iKR3EEHRqfuWMT4swfQGDshdHlzXbdDOs0KV4bTYRo+f
 76n1bvftiMH4vRONIR3T+ZeJWeaL6IfW01v7qYx+06hBa6TtkwDc+Ofw5zxWFtj1
 7abou5U46gHIp4Ce8ANJzmnvd7iOssFk7+6y8Z7lZgUQCdwHFLP70VX9Jd3bRlsK
 UIwG0qiIG0jdLgUvjgritDWIcxuSniWIbecLr1xfHIzJAIvVr6bjRNyOz3gXgaa/
 h16oHZRhprC3+4baUQPjPiSb54z+y0Xrx8x9ZSvgHe4gQmctjzoKMVr9Fy7NSpQv
 MVVNi9GvqRI+o+Tu7/N3yxShdXvuRvOOFgeOcyvA7BigrxMb+LvOsPcISFIBva6a
 6+vKuRY79TMwEbDJkURnSNqkVyvMuqKhH5OGiKVHkQrp3AkltpDyDuap+6i2oar4
 ba20HaVstcSdCfx8iCmiy/l0g16vOyNC8cVVdB4WoX1fU6aiv9Y=
 =g+cC
 -----END PGP SIGNATURE-----

Merge 5.10.62 into android12-5.10-lts

Changes in 5.10.62
	net: qrtr: fix another OOB Read in qrtr_endpoint_post
	bpf: Fix ringbuf helper function compatibility
	bpf: Fix NULL pointer dereference in bpf_get_local_storage() helper
	ASoC: rt5682: Adjust headset volume button threshold
	ASoC: component: Remove misplaced prefix handling in pin control functions
	ARC: Fix CONFIG_STACKDEPOT
	netfilter: conntrack: collect all entries in one cycle
	once: Fix panic when module unload
	blk-iocost: fix lockdep warning on blkcg->lock
	ovl: fix uninitialized pointer read in ovl_lookup_real_one()
	net: mscc: Fix non-GPL export of regmap APIs
	can: usb: esd_usb2: esd_usb2_rx_event(): fix the interchange of the CAN RX and TX error counters
	ceph: correctly handle releasing an embedded cap flush
	riscv: Ensure the value of FP registers in the core dump file is up to date
	Revert "btrfs: compression: don't try to compress if we don't have enough pages"
	drm/amdgpu: Cancel delayed work when GFXOFF is disabled
	Revert "USB: serial: ch341: fix character loss at high transfer rates"
	USB: serial: option: add new VID/PID to support Fibocom FG150
	usb: renesas-xhci: Prefer firmware loading on unknown ROM state
	usb: dwc3: gadget: Fix dwc3_calc_trbs_left()
	usb: dwc3: gadget: Stop EP0 transfers during pullup disable
	scsi: core: Fix hang of freezing queue between blocking and running device
	RDMA/bnxt_re: Add missing spin lock initialization
	IB/hfi1: Fix possible null-pointer dereference in _extend_sdma_tx_descs()
	RDMA/bnxt_re: Remove unpaired rtnl unlock in bnxt_re_dev_init()
	ice: do not abort devlink info if board identifier can't be found
	net: usb: pegasus: fixes of set_register(s) return value evaluation;
	igc: fix page fault when thunderbolt is unplugged
	igc: Use num_tx_queues when iterating over tx_ring queue
	e1000e: Fix the max snoop/no-snoop latency for 10M
	e1000e: Do not take care about recovery NVM checksum
	RDMA/efa: Free IRQ vectors on error flow
	ip_gre: add validation for csum_start
	xgene-v2: Fix a resource leak in the error handling path of 'xge_probe()'
	net: marvell: fix MVNETA_TX_IN_PRGRS bit number
	ucounts: Increase ucounts reference counter before the security hook
	net/sched: ets: fix crash when flipping from 'strict' to 'quantum'
	ipv6: use siphash in rt6_exception_hash()
	ipv4: use siphash instead of Jenkins in fnhe_hashfun()
	cxgb4: dont touch blocked freelist bitmap after free
	rtnetlink: Return correct error on changing device netns
	net: hns3: clear hardware resource when loading driver
	net: hns3: add waiting time before cmdq memory is released
	net: hns3: fix duplicate node in VLAN list
	net: hns3: fix get wrong pfc_en when query PFC configuration
	Revert "mmc: sdhci-iproc: Set SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN on BCM2711"
	net: stmmac: add mutex lock to protect est parameters
	net: stmmac: fix kernel panic due to NULL pointer dereference of plat->est
	drm/i915: Fix syncmap memory leak
	usb: gadget: u_audio: fix race condition on endpoint stop
	dt-bindings: sifive-l2-cache: Fix 'select' matching
	perf/x86/intel/uncore: Fix integer overflow on 23 bit left shift of a u32
	clk: renesas: rcar-usb2-clock-sel: Fix kernel NULL pointer dereference
	iwlwifi: pnvm: accept multiple HW-type TLVs
	opp: remove WARN when no valid OPPs remain
	cpufreq: blocklist Qualcomm sm8150 in cpufreq-dt-platdev
	virtio: Improve vq->broken access to avoid any compiler optimization
	virtio_pci: Support surprise removal of virtio pci device
	virtio_vdpa: reject invalid vq indices
	vringh: Use wiov->used to check for read/write desc order
	tools/virtio: fix build
	qed: qed ll2 race condition fixes
	qed: Fix null-pointer dereference in qed_rdma_create_qp()
	Revert "drm/amd/pm: fix workload mismatch on vega10"
	drm/amd/pm: change the workload type for some cards
	blk-mq: don't grab rq's refcount in blk_mq_check_expired()
	drm: Copy drm_wait_vblank to user before returning
	drm/nouveau/disp: power down unused DP links during init
	drm/nouveau/kms/nv50: workaround EFI GOP window channel format differences
	net/rds: dma_map_sg is entitled to merge entries
	btrfs: fix race between marking inode needs to be logged and log syncing
	pipe: avoid unnecessary EPOLLET wakeups under normal loads
	pipe: do FASYNC notifications for every pipe IO, not just state changes
	mtd: spinand: Fix incorrect parameters for on-die ECC
	tipc: call tipc_wait_for_connect only when dlen is not 0
	vt_kdsetmode: extend console locking
	Bluetooth: btusb: check conditions before enabling USB ALT 3 for WBS
	riscv: Fixup wrong ftrace remove cflag
	riscv: Fixup patch_text panic in ftrace
	perf env: Fix memory leak of bpf_prog_info_linear member
	perf symbol-elf: Fix memory leak by freeing sdt_note.args
	perf record: Fix memory leak in vDSO found using ASAN
	perf tools: Fix arm64 build error with gcc-11
	perf annotate: Fix jump parsing for C++ code.
	powerpc/perf: Invoke per-CPU variable access with disabled interrupts
	srcu: Provide internal interface to start a Tree SRCU grace period
	srcu: Provide polling interfaces for Tree SRCU grace periods
	srcu: Provide internal interface to start a Tiny SRCU grace period
	srcu: Make Tiny SRCU use multi-bit grace-period counter
	srcu: Provide polling interfaces for Tiny SRCU grace periods
	tracepoint: Use rcu get state and cond sync for static call updates
	usb: typec: ucsi: acpi: Always decode connector change information
	usb: typec: ucsi: Work around PPM losing change information
	usb: typec: ucsi: Clear pending after acking connector change
	net: dsa: mt7530: fix VLAN traffic leaks again
	lkdtm: Enable DOUBLE_FAULT on all architectures
	arm64: dts: qcom: msm8994-angler: Fix gpio-reserved-ranges 85-88
	btrfs: fix NULL pointer dereference when deleting device by invalid id
	kthread: Fix PF_KTHREAD vs to_kthread() race
	Revert "floppy: reintroduce O_NDELAY fix"
	Revert "parisc: Add assembly implementations for memset, strlen, strcpy, strncpy and strcat"
	net: don't unconditionally copy_from_user a struct ifreq for socket ioctls
	audit: move put_tree() to avoid trim_trees refcount underflow and UAF
	bpf: Fix potentially incorrect results with bpf_get_local_storage()
	Linux 5.10.62

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I5a9bf4b2c254ae21a10f838494cae1c3fa016be3
2021-09-03 10:51:56 +02:00
Peter Collingbourne
1890ee7ff8 net: don't unconditionally copy_from_user a struct ifreq for socket ioctls
commit d0efb16294 upstream.

A common implementation of isatty(3) involves calling a ioctl passing
a dummy struct argument and checking whether the syscall failed --
bionic and glibc use TCGETS (passing a struct termios), and musl uses
TIOCGWINSZ (passing a struct winsize). If the FD is a socket, we will
copy sizeof(struct ifreq) bytes of data from the argument and return
-EFAULT if that fails. The result is that the isatty implementations
may return a non-POSIX-compliant value in errno in the case where part
of the dummy struct argument is inaccessible, as both struct termios
and struct winsize are smaller than struct ifreq (at least on arm64).

Although there is usually enough stack space following the argument
on the stack that this did not present a practical problem up to now,
with MTE stack instrumentation it's more likely for the copy to fail,
as the memory following the struct may have a different tag.

Fix the problem by adding an early check for whether the ioctl is a
valid socket ioctl, and return -ENOTTY if it isn't.

Fixes: 44c02a2c3d ("dev_ioctl(): move copyin/copyout to callers")
Link: https://linux-review.googlesource.com/id/I869da6cf6daabc3e4b7b82ac979683ba05e27d4d
Signed-off-by: Peter Collingbourne <pcc@google.com>
Cc: <stable@vger.kernel.org> # 4.19
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-09-03 10:09:31 +02:00
Xin Long
0a178a0151 tipc: call tipc_wait_for_connect only when dlen is not 0
commit 7387a72c5f upstream.

__tipc_sendmsg() is called to send SYN packet by either tipc_sendmsg()
or tipc_connect(). The difference is in tipc_connect(), it will call
tipc_wait_for_connect() after __tipc_sendmsg() to wait until connecting
is done. So there's no need to wait in __tipc_sendmsg() for this case.

This patch is to fix it by calling tipc_wait_for_connect() only when dlen
is not 0 in __tipc_sendmsg(), which means it's called by tipc_connect().

Note this also fixes the failure in tipcutils/test/ptts/:

  # ./tipcTS &
  # ./tipcTC 9
  (hang)

Fixes: 36239dab6da7 ("tipc: fix implicit-connect for SYN+")
Reported-by: Shuang Li <shuali@redhat.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Jon Maloy <jmaloy@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-09-03 10:09:28 +02:00
Gerd Rausch
6f38d95f33 net/rds: dma_map_sg is entitled to merge entries
[ Upstream commit fb4b1373dc ]

Function "dma_map_sg" is entitled to merge adjacent entries
and return a value smaller than what was passed as "nents".

Subsequently "ib_map_mr_sg" needs to work with this value ("sg_dma_len")
rather than the original "nents" parameter ("sg_len").

This old RDS bug was exposed and reliably causes kernel panics
(using RDMA operations "rds-stress -D") on x86_64 starting with:
commit c588072bba ("iommu/vt-d: Convert intel iommu driver to the iommu ops")

Simply put: Linux 5.11 and later.

Signed-off-by: Gerd Rausch <gerd.rausch@oracle.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Link: https://lore.kernel.org/r/60efc69f-1f35-529d-a7ef-da0549cad143@oracle.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-09-03 10:09:28 +02:00
Andrey Ignatov
ad0db83855 rtnetlink: Return correct error on changing device netns
[ Upstream commit 96a6b93b69 ]

Currently when device is moved between network namespaces using
RTM_NEWLINK message type and one of netns attributes (FLA_NET_NS_PID,
IFLA_NET_NS_FD, IFLA_TARGET_NETNSID) but w/o specifying IFLA_IFNAME, and
target namespace already has device with same name, userspace will get
EINVAL what is confusing and makes debugging harder.

Fix it so that userspace gets more appropriate EEXIST instead what makes
debugging much easier.

Before:

  # ./ifname.sh
  + ip netns add ns0
  + ip netns exec ns0 ip link add l0 type dummy
  + ip netns exec ns0 ip link show l0
  8: l0: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
      link/ether 66:90:b5:d5:78:69 brd ff:ff:ff:ff:ff:ff
  + ip link add l0 type dummy
  + ip link show l0
  10: l0: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
      link/ether 6e:c6:1f:15:20:8d brd ff:ff:ff:ff:ff:ff
  + ip link set l0 netns ns0
  RTNETLINK answers: Invalid argument

After:

  # ./ifname.sh
  + ip netns add ns0
  + ip netns exec ns0 ip link add l0 type dummy
  + ip netns exec ns0 ip link show l0
  8: l0: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
      link/ether 1e:4a:72:e3:e3:8f brd ff:ff:ff:ff:ff:ff
  + ip link add l0 type dummy
  + ip link show l0
  10: l0: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
      link/ether f2:fc:fe:2b:7d:a6 brd ff:ff:ff:ff:ff:ff
  + ip link set l0 netns ns0
  RTNETLINK answers: File exists

The problem is that do_setlink() passes its `char *ifname` argument,
that it gets from a caller, to __dev_change_net_namespace() as is (as
`const char *pat`), but semantics of ifname and pat can be different.

For example, __rtnl_newlink() does this:

net/core/rtnetlink.c
    3270	char ifname[IFNAMSIZ];
     ...
    3286	if (tb[IFLA_IFNAME])
    3287		nla_strscpy(ifname, tb[IFLA_IFNAME], IFNAMSIZ);
    3288	else
    3289		ifname[0] = '\0';
     ...
    3364	if (dev) {
     ...
    3394		return do_setlink(skb, dev, ifm, extack, tb, ifname, status);
    3395	}

, i.e. do_setlink() gets ifname pointer that is always valid no matter
if user specified IFLA_IFNAME or not and then do_setlink() passes this
ifname pointer as is to __dev_change_net_namespace() as pat argument.

But the pat (pattern) in __dev_change_net_namespace() is used as:

net/core/dev.c
   11198	err = -EEXIST;
   11199	if (__dev_get_by_name(net, dev->name)) {
   11200		/* We get here if we can't use the current device name */
   11201		if (!pat)
   11202			goto out;
   11203		err = dev_get_valid_name(net, dev, pat);
   11204		if (err < 0)
   11205			goto out;
   11206	}

As the result the `goto out` path on line 11202 is neven taken and
instead of returning EEXIST defined on line 11198,
__dev_change_net_namespace() returns an error from dev_get_valid_name()
and this, in turn, will be EINVAL for ifname[0] = '\0' set earlier.

Fixes: d8a5ec6727 ("[NET]: netlink support for moving devices between network namespaces.")
Signed-off-by: Andrey Ignatov <rdna@fb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-09-03 10:09:25 +02:00
Eric Dumazet
beefd5f0c6 ipv4: use siphash instead of Jenkins in fnhe_hashfun()
[ Upstream commit 6457378fe7 ]

A group of security researchers brought to our attention
the weakness of hash function used in fnhe_hashfun().

Lets use siphash instead of Jenkins Hash, to considerably
reduce security risks.

Also remove the inline keyword, this really is distracting.

Fixes: d546c62154 ("ipv4: harden fnhe_hashfun()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Keyu Man <kman001@ucr.edu>
Cc: Willy Tarreau <w@1wt.eu>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-09-03 10:09:25 +02:00
Eric Dumazet
dced8347a7 ipv6: use siphash in rt6_exception_hash()
[ Upstream commit 4785305c05 ]

A group of security researchers brought to our attention
the weakness of hash function used in rt6_exception_hash()

Lets use siphash instead of Jenkins Hash, to considerably
reduce security risks.

Following patch deals with IPv4.

Fixes: 35732d01fe ("ipv6: introduce a hash table to store dst cache")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Keyu Man <kman001@ucr.edu>
Cc: Wei Wang <weiwan@google.com>
Cc: Martin KaFai Lau <kafai@fb.com>
Acked-by: Wei Wang <weiwan@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-09-03 10:09:24 +02:00
Davide Caratti
f517335a61 net/sched: ets: fix crash when flipping from 'strict' to 'quantum'
[ Upstream commit cd9b50adc6 ]

While running kselftests, Hangbin observed that sch_ets.sh often crashes,
and splats like the following one are seen in the output of 'dmesg':

 BUG: kernel NULL pointer dereference, address: 0000000000000000
 #PF: supervisor read access in kernel mode
 #PF: error_code(0x0000) - not-present page
 PGD 159f12067 P4D 159f12067 PUD 159f13067 PMD 0
 Oops: 0000 [#1] SMP NOPTI
 CPU: 2 PID: 921 Comm: tc Not tainted 5.14.0-rc6+ #458
 Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014
 RIP: 0010:__list_del_entry_valid+0x2d/0x50
 Code: 48 8b 57 08 48 b9 00 01 00 00 00 00 ad de 48 39 c8 0f 84 ac 6e 5b 00 48 b9 22 01 00 00 00 00 ad de 48 39 ca 0f 84 cf 6e 5b 00 <48> 8b 32 48 39 fe 0f 85 af 6e 5b 00 48 8b 50 08 48 39 f2 0f 85 94
 RSP: 0018:ffffb2da005c3890 EFLAGS: 00010217
 RAX: 0000000000000000 RBX: ffff9073ba23f800 RCX: dead000000000122
 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff9073ba23fbc8
 RBP: ffff9073ba23f890 R08: 0000000000000001 R09: 0000000000000001
 R10: 0000000000000001 R11: 0000000000000001 R12: dead000000000100
 R13: ffff9073ba23fb00 R14: 0000000000000002 R15: 0000000000000002
 FS:  00007f93e5564e40(0000) GS:ffff9073bba00000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 0000000000000000 CR3: 000000014ad34000 CR4: 0000000000350ee0
 Call Trace:
  ets_qdisc_reset+0x6e/0x100 [sch_ets]
  qdisc_reset+0x49/0x1d0
  tbf_reset+0x15/0x60 [sch_tbf]
  qdisc_reset+0x49/0x1d0
  dev_reset_queue.constprop.42+0x2f/0x90
  dev_deactivate_many+0x1d3/0x3d0
  dev_deactivate+0x56/0x90
  qdisc_graft+0x47e/0x5a0
  tc_get_qdisc+0x1db/0x3e0
  rtnetlink_rcv_msg+0x164/0x4c0
  netlink_rcv_skb+0x50/0x100
  netlink_unicast+0x1a5/0x280
  netlink_sendmsg+0x242/0x480
  sock_sendmsg+0x5b/0x60
  ____sys_sendmsg+0x1f2/0x260
  ___sys_sendmsg+0x7c/0xc0
  __sys_sendmsg+0x57/0xa0
  do_syscall_64+0x3a/0x80
  entry_SYSCALL_64_after_hwframe+0x44/0xae
 RIP: 0033:0x7f93e44b8338
 Code: 89 02 48 c7 c0 ff ff ff ff eb b5 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 8d 05 25 43 2c 00 8b 00 85 c0 75 17 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 41 54 41 89 d4 55
 RSP: 002b:00007ffc0db737a8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
 RAX: ffffffffffffffda RBX: 0000000061255c06 RCX: 00007f93e44b8338
 RDX: 0000000000000000 RSI: 00007ffc0db73810 RDI: 0000000000000003
 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
 R10: 000000000000000b R11: 0000000000000246 R12: 0000000000000001
 R13: 0000000000687880 R14: 0000000000000000 R15: 0000000000000000
 Modules linked in: sch_ets sch_tbf dummy rfkill iTCO_wdt iTCO_vendor_support intel_rapl_msr intel_rapl_common joydev i2c_i801 pcspkr i2c_smbus lpc_ich virtio_balloon ip_tables xfs libcrc32c crct10dif_pclmul crc32_pclmul crc32c_intel ahci libahci ghash_clmulni_intel libata serio_raw virtio_blk virtio_console virtio_net net_failover failover sunrpc dm_mirror dm_region_hash dm_log dm_mod
 CR2: 0000000000000000

When the change() function decreases the value of 'nstrict', we must take
into account that packets might be already enqueued on a class that flips
from 'strict' to 'quantum': otherwise that class will not be added to the
bandwidth-sharing list. Then, a call to ets_qdisc_reset() will attempt to
do list_del(&alist) with 'alist' filled with zero, hence the NULL pointer
dereference.
For classes flipping from 'strict' to 'quantum', initialize an empty list
and eventually add it to the bandwidth-sharing list, if there are packets
already enqueued. In this way, the kernel will:
 a) prevent crashing as described above.
 b) avoid retaining the backlog packets (for an arbitrarily long time) in
    case no packet is enqueued after a change from 'strict' to 'quantum'.

Reported-by: Hangbin Liu <liuhangbin@gmail.com>
Fixes: dcc68b4d80 ("net: sch_ets: Add a new Qdisc")
Signed-off-by: Davide Caratti <dcaratti@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-09-03 10:09:24 +02:00
Shreyansh Chouhan
fb45459d9d ip_gre: add validation for csum_start
[ Upstream commit 1d011c4803 ]

Validate csum_start in gre_handle_offloads before we call _gre_xmit so
that we do not crash later when the csum_start value is used in the
lco_csum function call.

This patch deals with ipv4 code.

Fixes: c544193214 ("GRE: Refactor GRE tunneling code.")
Reported-by: syzbot+ff8e1b9f2f36481e2efc@syzkaller.appspotmail.com
Signed-off-by: Shreyansh Chouhan <chouhan.shreyansh630@gmail.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-09-03 10:09:24 +02:00
Florian Westphal
f68ad168e2 netfilter: conntrack: collect all entries in one cycle
[ Upstream commit 4608fdfc07 ]

Michal Kubecek reports that conntrack gc is responsible for frequent
wakeups (every 125ms) on idle systems.

On busy systems, timed out entries are evicted during lookup.
The gc worker is only needed to remove entries after system becomes idle
after a busy period.

To resolve this, always scan the entire table.
If the scan is taking too long, reschedule so other work_structs can run
and resume from next bucket.

After a completed scan, wait for 2 minutes before the next cycle.
Heuristics for faster re-schedule are removed.

GC_SCAN_INTERVAL could be exposed as a sysctl in the future to allow
tuning this as-needed or even turn the gc worker off.

Reported-by: Michal Kubecek <mkubecek@suse.cz>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-09-03 10:09:21 +02:00
Yonghong Song
d81ddadabd bpf: Fix NULL pointer dereference in bpf_get_local_storage() helper
commit b910eaaaa4 upstream.

Jiri Olsa reported a bug ([1]) in kernel where cgroup local
storage pointer may be NULL in bpf_get_local_storage() helper.
There are two issues uncovered by this bug:
  (1). kprobe or tracepoint prog incorrectly sets cgroup local storage
       before prog run,
  (2). due to change from preempt_disable to migrate_disable,
       preemption is possible and percpu storage might be overwritten
       by other tasks.

This issue (1) is fixed in [2]. This patch tried to address issue (2).
The following shows how things can go wrong:
  task 1:   bpf_cgroup_storage_set() for percpu local storage
         preemption happens
  task 2:   bpf_cgroup_storage_set() for percpu local storage
         preemption happens
  task 1:   run bpf program

task 1 will effectively use the percpu local storage setting by task 2
which will be either NULL or incorrect ones.

Instead of just one common local storage per cpu, this patch fixed
the issue by permitting 8 local storages per cpu and each local
storage is identified by a task_struct pointer. This way, we
allow at most 8 nested preemption between bpf_cgroup_storage_set()
and bpf_cgroup_storage_unset(). The percpu local storage slot
is released (calling bpf_cgroup_storage_unset()) by the same task
after bpf program finished running.
bpf_test_run() is also fixed to use the new bpf_cgroup_storage_set()
interface.

The patch is tested on top of [2] with reproducer in [1].
Without this patch, kernel will emit error in 2-3 minutes.
With this patch, after one hour, still no error.

 [1] https://lore.kernel.org/bpf/CAKH8qBuXCfUz=w8L+Fj74OaUpbosO29niYwTki7e3Ag044_aww@mail.gmail.com/T
 [2] https://lore.kernel.org/bpf/20210309185028.3763817-1-yhs@fb.com

Signed-off-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Roman Gushchin <guro@fb.com>
Link: https://lore.kernel.org/bpf/20210323055146.3334476-1-yhs@fb.com
Cc: <stable@vger.kernel.org> # 5.10.x
Signed-off-by: Stanislav Fomichev <sdf@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-09-03 10:09:21 +02:00
Xiaolong Huang
ad41706c77 net: qrtr: fix another OOB Read in qrtr_endpoint_post
commit 7e78c597c3 upstream.

This check was incomplete, did not consider size is 0:

	if (len != ALIGN(size, 4) + hdrlen)
                    goto err;

if size from qrtr_hdr is 0, the result of ALIGN(size, 4)
will be 0, In case of len == hdrlen and size == 0
in header this check won't fail and

	if (cb->type == QRTR_TYPE_NEW_SERVER) {
                /* Remote node endpoint can bridge other distant nodes */
                const struct qrtr_ctrl_pkt *pkt = data + hdrlen;

                qrtr_node_assign(node, le32_to_cpu(pkt->server.node));
        }

will also read out of bound from data, which is hdrlen allocated block.

Fixes: 194ccc8829 ("net: qrtr: Support decoding incoming v2 packets")
Fixes: ad9d24c942 ("net: qrtr: fix OOB Read in qrtr_endpoint_post")
Signed-off-by: Xiaolong Huang <butterflyhuangxx@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-09-03 10:09:21 +02:00
Greg Kroah-Hartman
a6777a7cee Linux 5.10.61
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE4n5dijQDou9mhzu83qZv95d3LNwFAmEnjxwACgkQ3qZv95d3
 LNxlaw//VC9rmejl9JwdZQaz3NfhNv2UwamLShlliq2aBmy8d+fGTAMXkCW7UK/M
 gS27oweL6UV6wT8BKgK8LoKJ7L1rI1KDAePpxMCSZw8Mrd8jre0FMVgkkQz/2mFQ
 w3aMmVitCX7RIeShoxP/8fmWnGRkugDx7SZ2csoqRP9Txtih7DAamiun2ttTzzra
 4dxFRtyzw1LpJBSv/pMJ3/FusPkrbwKzSv2wYIgWmfhIWjPcvmBc0ufJmGUK7Gxo
 MJGaUWk9RJ3eNSUPUP3pJlKdzeHdOhOQnydiaUA60pWcDoAyQj7qM06af5hVLsCX
 0Z9r97bzWOF+LNuEiNIGbodJ74IgFv0VTgjlRdZfeLC+5yLyIo7fXAmAA2Od0fiH
 04Ak9+n+FTkl5avUufLrEwHljAAOgcbtJX7W4F/XPW+1P1tZxG9H4ZI+uQN7ZyAB
 fXGo3O3p5J14fI/m8Zr4mXDIiq34OPxSHLx89YryubriO8kdNv69+tciLn2m5a5W
 yctpYgVQnRJt44dg5I/aIzCSOW5+FviRY8slAopdXBIAwUZAZZgW9IVGAh2uRiLS
 tCtbFa3cXUV1JoWsgUdae8BDoOp0dm69yeYrP1f5eVCLe+FHa9P/Z3qxpBLhpPEh
 QOTI14tg3wu3vwFxAA2rsFmSInkh231ryjgGq788BnoHHad3DnI=
 =Rtb5
 -----END PGP SIGNATURE-----

Merge 5.10.61 into android12-5.10-lts

Changes in 5.10.61
	ath: Use safer key clearing with key cache entries
	ath9k: Clear key cache explicitly on disabling hardware
	ath: Export ath_hw_keysetmac()
	ath: Modify ath_key_delete() to not need full key entry
	ath9k: Postpone key cache entry deletion for TXQ frames reference it
	mtd: cfi_cmdset_0002: fix crash when erasing/writing AMD cards
	media: zr364xx: propagate errors from zr364xx_start_readpipe()
	media: zr364xx: fix memory leaks in probe()
	media: drivers/media/usb: fix memory leak in zr364xx_probe
	KVM: x86: Factor out x86 instruction emulation with decoding
	KVM: X86: Fix warning caused by stale emulation context
	USB: core: Avoid WARNings for 0-length descriptor requests
	USB: core: Fix incorrect pipe calculation in do_proc_control()
	dmaengine: xilinx_dma: Fix read-after-free bug when terminating transfers
	dmaengine: usb-dmac: Fix PM reference leak in usb_dmac_probe()
	spi: spi-mux: Add module info needed for autoloading
	net: xfrm: Fix end of loop tests for list_for_each_entry
	ARM: dts: am43x-epos-evm: Reduce i2c0 bus speed for tps65218
	dmaengine: of-dma: router_xlate to return -EPROBE_DEFER if controller is not yet available
	scsi: pm80xx: Fix TMF task completion race condition
	scsi: megaraid_mm: Fix end of loop tests for list_for_each_entry()
	scsi: scsi_dh_rdac: Avoid crash during rdac_bus_attach()
	scsi: core: Avoid printing an error if target_alloc() returns -ENXIO
	scsi: core: Fix capacity set to zero after offlinining device
	drm/amdgpu: fix the doorbell missing when in CGPG issue for renoir.
	qede: fix crash in rmmod qede while automatic debug collection
	ARM: dts: nomadik: Fix up interrupt controller node names
	net: usb: pegasus: Check the return value of get_geristers() and friends;
	net: usb: lan78xx: don't modify phy_device state concurrently
	drm/amd/display: Fix Dynamic bpp issue with 8K30 with Navi 1X
	drm/amd/display: workaround for hard hang on HPD on native DP
	Bluetooth: hidp: use correct wait queue when removing ctrl_wait
	arm64: dts: qcom: c630: fix correct powerdown pin for WSA881x
	arm64: dts: qcom: msm8992-bullhead: Remove PSCI
	iommu: Check if group is NULL before remove device
	cpufreq: armada-37xx: forbid cpufreq for 1.2 GHz variant
	dccp: add do-while-0 stubs for dccp_pr_debug macros
	virtio: Protect vqs list access
	vhost-vdpa: Fix integer overflow in vhost_vdpa_process_iotlb_update()
	bus: ti-sysc: Fix error handling for sysc_check_active_timer()
	vhost: Fix the calculation in vhost_overflow()
	vdpa/mlx5: Avoid destroying MR on empty iotlb
	soc / drm: mediatek: Move DDP component defines into mtk-mmsys.h
	drm/mediatek: Fix aal size config
	drm/mediatek: Add AAL output size configuration
	bpf: Clear zext_dst of dead insns
	bnxt: don't lock the tx queue from napi poll
	bnxt: disable napi before canceling DIM
	bnxt: make sure xmit_more + errors does not miss doorbells
	bnxt: count Tx drops
	net: 6pack: fix slab-out-of-bounds in decode_data
	ptp_pch: Restore dependency on PCI
	bnxt_en: Disable aRFS if running on 212 firmware
	bnxt_en: Add missing DMA memory barriers
	vrf: Reset skb conntrack connection on VRF rcv
	virtio-net: support XDP when not more queues
	virtio-net: use NETIF_F_GRO_HW instead of NETIF_F_LRO
	net: qlcnic: add missed unlock in qlcnic_83xx_flash_read32
	ixgbe, xsk: clean up the resources in ixgbe_xsk_pool_enable error path
	sch_cake: fix srchost/dsthost hashing mode
	net: mdio-mux: Don't ignore memory allocation errors
	net: mdio-mux: Handle -EPROBE_DEFER correctly
	ovs: clear skb->tstamp in forwarding path
	iommu/vt-d: Consolidate duplicate cache invaliation code
	iommu/vt-d: Fix incomplete cache flush in intel_pasid_tear_down_entry()
	r8152: fix writing USB_BP2_EN
	i40e: Fix ATR queue selection
	iavf: Fix ping is lost after untrusted VF had tried to change MAC
	Revert "flow_offload: action should not be NULL when it is referenced"
	mmc: dw_mmc: Fix hang on data CRC error
	mmc: mmci: stm32: Check when the voltage switch procedure should be done
	mmc: sdhci-msm: Update the software timeout value for sdhc
	clk: imx6q: fix uart earlycon unwork
	clk: qcom: gdsc: Ensure regulator init state matches GDSC state
	ALSA: hda - fix the 'Capture Switch' value change notifications
	tracing / histogram: Fix NULL pointer dereference on strcmp() on NULL event name
	slimbus: messaging: start transaction ids from 1 instead of zero
	slimbus: messaging: check for valid transaction id
	slimbus: ngd: reset dma setup during runtime pm
	ipack: tpci200: fix many double free issues in tpci200_pci_probe
	ipack: tpci200: fix memory leak in the tpci200_register
	ALSA: hda/realtek: Enable 4-speaker output for Dell XPS 15 9510 laptop
	mmc: sdhci-iproc: Cap min clock frequency on BCM2711
	mmc: sdhci-iproc: Set SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN on BCM2711
	btrfs: prevent rename2 from exchanging a subvol with a directory from different parents
	ALSA: hda/via: Apply runtime PM workaround for ASUS B23E
	s390/pci: fix use after free of zpci_dev
	PCI: Increase D3 delay for AMD Renoir/Cezanne XHCI
	ALSA: hda/realtek: Limit mic boost on HP ProBook 445 G8
	ASoC: intel: atom: Fix breakage for PCM buffer address setup
	mm: memcontrol: fix occasional OOMs due to proportional memory.low reclaim
	fs: warn about impending deprecation of mandatory locks
	io_uring: fix xa_alloc_cycle() error return value check
	io_uring: only assign io_uring_enter() SQPOLL error in actual error case
	Linux 5.10.61

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I5b6e2a66b03d1cb01c8310b83dcc2a119c1bd6b3
2021-08-27 20:51:37 +02:00
Greg Kroah-Hartman
83da0c0fca Revert "net: igmp: fix data-race in igmp_ifc_timer_expire()"
This reverts commit 24e1b7dbb1 which is
commit 4a2b285e7e upstream.

It breaks the kernel abi (well the fix for this fix does), and is not
needed for Android devices.

Cc: Eric Dumazet <edumazet@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I1c59c60493d216f1671b110a948f38293a0925ee
2021-08-27 18:38:54 +02:00
Greg Kroah-Hartman
a75a648f84 Revert "net: igmp: increase size of mr_ifc_count"
This reverts commit 4344440d91 which is
commit b69dd5b378 upstream.

This breaks the kernel abi and is not an issue for Android systems.

Cc: Eric Dumazet <edumazet@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I1006e8d8ca58cf07ea23404e386ba58651424eb2
2021-08-27 18:05:52 +02:00
Greg Kroah-Hartman
b558262fdc This is the 5.10.60 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmEcsVUACgkQONu9yGCS
 aT7r0xAAtwJSVAboFmw/R7pyRzsveDo8KdTATgOKRRmGk/fJIodSHXwPTcPtKSRO
 k09OnEU777t67+3pfS6PA2lNCWhE+Z3PlFVn6b8G8xR1o14vpwNg3aiGNGSqd8aL
 edA4TrqTBb7nu8Bhg1nPdSiKSK2UTPDYlBo+jF6j6YU1dVe/yMy2D4bVOGotPxTn
 WVFmlmEtHDN22q67rEjLAU+wvtn/nRJle/0b2gj32BB+CJqLyjHKH+aUmk9shMfP
 CCkzX+CjhEOz4Sooh0v3aYsyJ4N6AiCAaT4SYy/pnT1RV/b9aw4f+ddrg3xo8SnI
 2C9/i2EzsZc2UnzoFld1R15YrdZfIWOLaiU6enIis5ziBDuxZ5nd5VOHV99BzhUH
 nEY65Ob3Wr8LVSgFTo61uk5R0z0WjQMwSvW1uaauxMUQN7Q2645VJsPomPNlmp8I
 pNBSLj5uz76cxh+ciZNS4HgtwXNUHolhRHl5nvHxMKH0i1+9xQ1vKs1sKMpDYGFe
 2lqg8eGe8lGrwpg0w4oKHyVP2fgj7yk3FvU3/pXX8BleolmQ3xkwkztofKaMorJP
 s9eQIw/2U3j/xBqhXoIbTjBuXl+5MjfbOG4xeK0v/oohrDw0IvT7KuO6TYUXhlbh
 CniUBfItbgGzXyQiwgwgEbS8upz+nK6IDdNEAV5dGn6gG6w4ajk=
 =/0MF
 -----END PGP SIGNATURE-----

Merge 5.10.60 into android12-5.10-lts

Changes in 5.10.60
	iio: adc: ti-ads7950: Ensure CS is deasserted after reading channels
	iio: adis: set GPIO reset pin direction
	iio: humidity: hdc100x: Add margin to the conversion time
	iio: adc: Fix incorrect exit of for-loop
	ASoC: amd: Fix reference to PCM buffer address
	ASoC: xilinx: Fix reference to PCM buffer address
	ASoC: uniphier: Fix reference to PCM buffer address
	ASoC: tlv320aic31xx: Fix jack detection after suspend
	ASoC: intel: atom: Fix reference to PCM buffer address
	i2c: dev: zero out array used for i2c reads from userspace
	cifs: create sd context must be a multiple of 8
	scsi: lpfc: Move initialization of phba->poll_list earlier to avoid crash
	seccomp: Fix setting loaded filter count during TSYNC
	net: ethernet: ti: cpsw: fix min eth packet size for non-switch use-cases
	ARC: fp: set FPU_STATUS.FWE to enable FPU_STATUS update on context switch
	ceph: reduce contention in ceph_check_delayed_caps()
	ACPI: NFIT: Fix support for virtual SPA ranges
	libnvdimm/region: Fix label activation vs errors
	drm/amd/display: Remove invalid assert for ODM + MPC case
	drm/amd/display: use GFP_ATOMIC in amdgpu_dm_irq_schedule_work
	drm/amdgpu: don't enable baco on boco platforms in runpm
	ieee802154: hwsim: fix GPF in hwsim_set_edge_lqi
	ieee802154: hwsim: fix GPF in hwsim_new_edge_nl
	pinctrl: mediatek: Fix fallback behavior for bias_set_combo
	ASoC: cs42l42: Correct definition of ADC Volume control
	ASoC: cs42l42: Don't allow SND_SOC_DAIFMT_LEFT_J
	ASoC: SOF: Intel: hda-ipc: fix reply size checking
	ASoC: cs42l42: Fix inversion of ADC Notch Switch control
	ASoC: cs42l42: Remove duplicate control for WNF filter frequency
	netfilter: nf_conntrack_bridge: Fix memory leak when error
	pinctrl: tigerlake: Fix GPIO mapping for newer version of software
	ASoC: cs42l42: Fix LRCLK frame start edge
	net: dsa: mt7530: add the missing RxUnicast MIB counter
	net: mvvp2: fix short frame size on s390
	platform/x86: pcengines-apuv2: Add missing terminating entries to gpio-lookup tables
	libbpf: Fix probe for BPF_PROG_TYPE_CGROUP_SOCKOPT
	bpf: Fix integer overflow involving bucket_size
	net: phy: micrel: Fix link detection on ksz87xx switch"
	ppp: Fix generating ifname when empty IFLA_IFNAME is specified
	net/smc: fix wait on already cleared link
	net: sched: act_mirred: Reset ct info when mirror/redirect skb
	ice: Prevent probing virtual functions
	ice: don't remove netdev->dev_addr from uc sync list
	iavf: Set RSS LUT and key in reset handle path
	psample: Add a fwd declaration for skbuff
	bareudp: Fix invalid read beyond skb's linear data
	net/mlx5: Synchronize correct IRQ when destroying CQ
	net/mlx5: Fix return value from tracer initialization
	drm/meson: fix colour distortion from HDR set during vendor u-boot
	net: dsa: microchip: Fix ksz_read64()
	net: dsa: microchip: ksz8795: Fix VLAN filtering
	net: Fix memory leak in ieee802154_raw_deliver
	net: igmp: fix data-race in igmp_ifc_timer_expire()
	net: dsa: lan9303: fix broken backpressure in .port_fdb_dump
	net: dsa: lantiq: fix broken backpressure in .port_fdb_dump
	net: dsa: sja1105: fix broken backpressure in .port_fdb_dump
	net: bridge: validate the NUD_PERMANENT bit when adding an extern_learn FDB entry
	net: bridge: fix flags interpretation for extern learn fdb entries
	net: bridge: fix memleak in br_add_if()
	net: linkwatch: fix failure to restore device state across suspend/resume
	tcp_bbr: fix u32 wrap bug in round logic if bbr_init() called after 2B packets
	net: igmp: increase size of mr_ifc_count
	drm/i915: Only access SFC_DONE when media domain is not fused off
	xen/events: Fix race in set_evtchn_to_irq
	vsock/virtio: avoid potential deadlock when vsock device remove
	nbd: Aovid double completion of a request
	arm64: efi: kaslr: Fix occasional random alloc (and boot) failure
	efi/libstub: arm64: Force Image reallocation if BSS was not reserved
	efi/libstub: arm64: Relax 2M alignment again for relocatable kernels
	powerpc/kprobes: Fix kprobe Oops happens in booke
	x86/tools: Fix objdump version check again
	genirq: Provide IRQCHIP_AFFINITY_PRE_STARTUP
	x86/msi: Force affinity setup before startup
	x86/ioapic: Force affinity setup before startup
	x86/resctrl: Fix default monitoring groups reporting
	genirq/msi: Ensure deactivation on teardown
	genirq/timings: Prevent potential array overflow in __irq_timings_store()
	PCI/MSI: Enable and mask MSI-X early
	PCI/MSI: Mask all unused MSI-X entries
	PCI/MSI: Enforce that MSI-X table entry is masked for update
	PCI/MSI: Enforce MSI[X] entry updates to be visible
	PCI/MSI: Do not set invalid bits in MSI mask
	PCI/MSI: Correct misleading comments
	PCI/MSI: Use msi_mask_irq() in pci_msi_shutdown()
	PCI/MSI: Protect msi_desc::masked for multi-MSI
	powerpc/smp: Fix OOPS in topology_init()
	efi/libstub: arm64: Double check image alignment at entry
	KVM: VMX: Use current VMCS to query WAITPKG support for MSR emulation
	KVM: nVMX: Use vmx_need_pf_intercept() when deciding if L0 wants a #PF
	vboxsf: Add vboxsf_[create|release]_sf_handle() helpers
	vboxsf: Add support for the atomic_open directory-inode op
	ceph: add some lockdep assertions around snaprealm handling
	ceph: clean up locking annotation for ceph_get_snap_realm and __lookup_snap_realm
	ceph: take snap_empty_lock atomically with snaprealm refcount change
	vmlinux.lds.h: Handle clang's module.{c,d}tor sections
	KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl (CVE-2021-3653)
	KVM: nSVM: always intercept VMLOAD/VMSAVE when nested (CVE-2021-3656)
	net: dsa: microchip: Fix probing KSZ87xx switch with DT node for host port
	net: dsa: microchip: ksz8795: Fix PVID tag insertion
	net: dsa: microchip: ksz8795: Reject unsupported VLAN configuration
	net: dsa: microchip: ksz8795: Fix VLAN untagged flag change on deletion
	net: dsa: microchip: ksz8795: Use software untagging on CPU port
	Linux 5.10.60

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I7d55aed1883b31ba2d9b8dfad4bc33e1efbcbd2f
2021-08-27 17:14:51 +02:00
Greg Kroah-Hartman
56f751a409 Merge branch 'android12-5.10' into android12-5.10-lts
Sync up with android12-5.10 for the following commits:

49a70f3362 ANDROID: GKI: Add usb/mmc/v4l2 related symbols for i.MX
e18d6a73b9 ANDROID: GKI: Add clk/pinctrl/irq related symbols for i.MX
7652f868f4 ANDROID: GKI: Add phy/net/pci related symbols for i.MX
d587a4f210 ANDROID: GKI: Add audio/rproc related symbols for i.MX
e8ab8b22f1 ANDROID: GKI: Add display related symbols for i.MX
8cfe4f1f9e FROMLIST: usb: dwc3: gadget: Stop EP0 transfers during pullup disable
f90feddc7e ANDROID: abi_gki_aarch64_qcom: Add mmc clk scaling functions
072eded7ca FROMLIST: mmc: core: Export core functions required for clk scaling
bef08a94ff ANDROID: GKI: Update symbols to symbol list
ffa937b6db ANDROID: abi_gki_aarch64_qcom: Add irq_domain_disconnect_hierarchy symbol
34f60eead2 FROMGIT: irqchip/qcom-pdc: Trim unused levels of the interrupt hierarchy
4c9aa4c6f0 FROMGIT: irqdomain: Export irq_domain_disconnect_hierarchy()
d6f6a6cd65 ANDROID: GKI: Add devcoredump API to symbol list
db490c7269 ANDROID: Update the exynos symbol list
228d32e2d0 UPSTREAM: kfence: fix is_kfence_address() for addresses below KFENCE_POOL_SIZE
e113eb454e ANDROID: xt_quota2: set usersize in xt_match registration object
60a4c35570 ANDROID: xt_quota2: clear quota2_log message before sending
4b05a506bd ANDROID: xt_quota2: remove trailing junk which might have a digit in it
9f19de4e29 ANDROID: GKI: Update symbols to abi_gki_aarch64_oplus
5cd4b1ce23 UPSTREAM: cfi: Use rcu_read_{un}lock_sched_notrace
580b7fa7d9 ANDROID: Update symbol list for mtk
70f3f9db21 UPSTREAM: af_unix: fix garbage collect vs MSG_PEEK
4ff1a38f8d ANDROID: GKI: Add initial symbol list for i.MX
51b382a231 ANDROID: GKI: Update abi_gki_aarch64_qcom for balance reclaim symbols
d734d9dc3b ANDROID: ABI: update symbols to A12-K5.10 unisoc whitelist for the first time
205686b558 FROMGIT: rcu: Fix stall-warning deadlock due to non-release of rcu_node ->lock
2493757f88 BACKPORT: ALSA: usb-audio: fix incorrect clock source setting
d0331b15e6 ANDROID: scsi: ufs: Add more logging
62a5f8e3ac ANDROID: Update symbol list for mtk
fdc8f778e2 ANDROID: scheduler: export task_sched_runtime
3425d6179e FROMLIST: mm: slub: fix slub_debug disabling for list of slabs
2e06e5e6f8 FROMLIST: mm/madvise: add MADV_WILLNEED to process_madvise()
ff7eccee30 ANDROID: Update the exynos symbol list
e9844a46c9 FROMGIT: firmware: arm_scmi: Free mailbox channels if probe fails
c72ca115a2 ANDROID: GKI: gki_defconfig: Enable CONFIG_NFC
0ad91fe432 ANDROID: sched: Make uclamp changes depend on CAP_SYS_NICE
2950b81ead ANDROID: GKI: update xiaomi symbol list and ABI XML
8b76fc436b ANDROID: ABI: update generic symbol list

Change-Id: I89b7ccf2c98f61e2775c4b79f16342b00ec480b1
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2021-08-27 14:59:19 +02:00
kaixi.fan
eee84eafc3 ovs: clear skb->tstamp in forwarding path
[ Upstream commit 01634047bf ]

fq qdisc requires tstamp to be cleared in the forwarding path. Now ovs
doesn't clear skb->tstamp. We encountered a problem with linux
version 5.4.56 and ovs version 2.14.1, and packets failed to
dequeue from qdisc when fq qdisc was attached to ovs port.

Fixes: fb420d5d91 ("tcp/fq: move back to CLOCK_MONOTONIC")
Signed-off-by: kaixi.fan <fankaixi.li@bytedance.com>
Signed-off-by: xiexiaohui <xiexiaohui.xxh@bytedance.com>
Reviewed-by: Cong Wang <cong.wang@bytedance.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-08-26 08:35:50 -04:00
Toke Høiland-Jørgensen
df61235881 sch_cake: fix srchost/dsthost hashing mode
[ Upstream commit 86b9bbd332 ]

When adding support for using the skb->hash value as the flow hash in CAKE,
I accidentally introduced a logic error that broke the host-only isolation
modes of CAKE (srchost and dsthost keywords). Specifically, the flow_hash
variable should stay initialised to 0 in cake_hash() in pure host-based
hashing mode. Add a check for this before using the skb->hash value as
flow_hash.

Fixes: b0c19ed608 ("sch_cake: Take advantage of skb->hash where appropriate")
Reported-by: Pete Heist <pete@heistp.net>
Tested-by: Pete Heist <pete@heistp.net>
Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-08-26 08:35:49 -04:00
Randy Dunlap
9108120fbe dccp: add do-while-0 stubs for dccp_pr_debug macros
[ Upstream commit 86aab09a48 ]

GCC complains about empty macros in an 'if' statement, so convert
them to 'do {} while (0)' macros.

Fixes these build warnings:

net/dccp/output.c: In function 'dccp_xmit_packet':
../net/dccp/output.c:283:71: warning: suggest braces around empty body in an 'if' statement [-Wempty-body]
  283 |                 dccp_pr_debug("transmit_skb() returned err=%d\n", err);
net/dccp/ackvec.c: In function 'dccp_ackvec_update_old':
../net/dccp/ackvec.c:163:80: warning: suggest braces around empty body in an 'else' statement [-Wempty-body]
  163 |                                               (unsigned long long)seqno, state);

Fixes: dc841e30ea ("dccp: Extend CCID packet dequeueing interface")
Fixes: 3802408644 ("dccp ccid-2: Update code for the Ack Vector input/registration routine")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: dccp@vger.kernel.org
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-08-26 08:35:41 -04:00
Ole Bjørn Midtbø
d7d04c6749 Bluetooth: hidp: use correct wait queue when removing ctrl_wait
[ Upstream commit cca342d98b ]

A different wait queue was used when removing ctrl_wait than when adding
it. This effectively made the remove operation without locking compared
to other operations on the wait queue ctrl_wait was part of. This caused
issues like below where dead000000000100 is LIST_POISON1 and
dead000000000200 is LIST_POISON2.

 list_add corruption. next->prev should be prev (ffffffc1b0a33a08), \
	but was dead000000000200. (next=ffffffc03ac77de0).
 ------------[ cut here ]------------
 CPU: 3 PID: 2138 Comm: bluetoothd Tainted: G           O    4.4.238+ #9
 ...
 ---[ end trace 0adc2158f0646eac ]---
 Call trace:
 [<ffffffc000443f78>] __list_add+0x38/0xb0
 [<ffffffc0000f0d04>] add_wait_queue+0x4c/0x68
 [<ffffffc00020eecc>] __pollwait+0xec/0x100
 [<ffffffc000d1556c>] bt_sock_poll+0x74/0x200
 [<ffffffc000bdb8a8>] sock_poll+0x110/0x128
 [<ffffffc000210378>] do_sys_poll+0x220/0x480
 [<ffffffc0002106f0>] SyS_poll+0x80/0x138
 [<ffffffc00008510c>] __sys_trace_return+0x0/0x4

 Unable to handle kernel paging request at virtual address dead000000000100
 ...
 CPU: 4 PID: 5387 Comm: kworker/u15:3 Tainted: G        W  O    4.4.238+ #9
 ...
 Call trace:
  [<ffffffc0000f079c>] __wake_up_common+0x7c/0xa8
  [<ffffffc0000f0818>] __wake_up+0x50/0x70
  [<ffffffc000be11b0>] sock_def_wakeup+0x58/0x60
  [<ffffffc000de5e10>] l2cap_sock_teardown_cb+0x200/0x224
  [<ffffffc000d3f2ac>] l2cap_chan_del+0xa4/0x298
  [<ffffffc000d45ea0>] l2cap_conn_del+0x118/0x198
  [<ffffffc000d45f8c>] l2cap_disconn_cfm+0x6c/0x78
  [<ffffffc000d29934>] hci_event_packet+0x564/0x2e30
  [<ffffffc000d19b0c>] hci_rx_work+0x10c/0x360
  [<ffffffc0000c2218>] process_one_work+0x268/0x460
  [<ffffffc0000c2678>] worker_thread+0x268/0x480
  [<ffffffc0000c94e0>] kthread+0x118/0x128
  [<ffffffc000085070>] ret_from_fork+0x10/0x20
  ---[ end trace 0adc2158f0646ead ]---

Signed-off-by: Ole Bjørn Midtbø <omidtbo@cisco.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-08-26 08:35:40 -04:00
Harshvardhan Jha
505884a0c7 net: xfrm: Fix end of loop tests for list_for_each_entry
[ Upstream commit 480e93e12a ]

The list_for_each_entry() iterator, "pos" in this code, can never be
NULL so the warning will never be printed.

Signed-off-by: Harshvardhan Jha <harshvardhan.jha@oracle.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-08-26 08:35:35 -04:00