Commit Graph

5653 Commits

Author SHA1 Message Date
Greg Kroah-Hartman
c8de3a470a This is the 5.10.64 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmE9pRsACgkQONu9yGCS
 aT4GqRAAzjCqjeEQ+JgWzP5N9YXXqzQI6s6PNqyEZpQiQF3tak12WZh02/zYhyZf
 nLiJgB/RitgPcbvSeRLSV9gYbAhL0HGI0DZ7wA821esA3+ywuS/21D2g49YuU0Cy
 mpTh4w1wm/dES4sZchhIMN+fzx81T/xHyiHkuA+wAU+o/bn4Qf+eCevKe2+8D2UC
 vr5Oc0k+RvAF16pFRd+MKSR0JNNPEpS962KnRFYUk47hjMk/aH4FhQCSP+nqXcJW
 3WuI+FR/UTltGMDe4/WIwlxQxsf4wMOMwEwRi0v5oyhwC4oCpZD3FlcNPJ81J6MS
 GkNukV/mvIKZ/IVD2F3YY34nHLE2RMkGKMbYSc9ONYWPEgGFnxINnXQZonPkazEN
 IA7GSPjxS4ToxETmDVVErIGQx/iCYnp9FJk+wqgrJ3z/e/qKZpt8C7RUDGJFzKjC
 WeRDFHtvdZT1WcmiUfrXz8qcbf2e1dPorYJ5tRi7hztrEx4XzwARSGGeW7H5rXJT
 50Q1oGL5IHj5lBe4BMbI59v1jQxzt0Tyyenv0xq/Jfrnmk0IrmUo0DiGZGO9Zxko
 as+HR3NNGl27uvlmz+bZ+ztL1DoXvJpkaGoCXTwBimg+/TAT9cSA+bFhI9+lvigx
 Ez6vInwcWkL6Tk5DlCeR7H0dBlKFGxktWHN5+qs0gSZoXPXZfK8=
 =AflS
 -----END PGP SIGNATURE-----

Merge 5.10.64 into android12-5.10-lts

Changes in 5.10.64
	igmp: Add ip_mc_list lock in ip_check_mc_rcu
	USB: serial: mos7720: improve OOM-handling in read_mos_reg()
	net: ll_temac: Remove left-over debug message
	mm/page_alloc: speed up the iteration of max_order
	net: kcov: don't select SKB_EXTENSIONS when there is no NET
	serial: 8250: 8250_omap: Fix unused variable warning
	net: linux/skbuff.h: combine SKB_EXTENSIONS + KCOV handling
	tty: drop termiox user definitions
	Revert "r8169: avoid link-up interrupt issue on RTL8106e if user enables ASPM"
	x86/events/amd/iommu: Fix invalid Perf result due to IOMMU PMC power-gating
	blk-mq: fix kernel panic during iterating over flush request
	blk-mq: fix is_flush_rq
	netfilter: nftables: avoid potential overflows on 32bit arches
	netfilter: nf_tables: initialize set before expression setup
	netfilter: nftables: clone set element expression template
	blk-mq: clearing flush request reference in tags->rqs[]
	ALSA: usb-audio: Add registration quirk for JBL Quantum 800
	usb: host: xhci-rcar: Don't reload firmware after the completion
	usb: gadget: tegra-xudc: fix the wrong mult value for HS isoc or intr
	usb: mtu3: restore HS function when set SS/SSP
	usb: mtu3: use @mult for HS isoc or intr
	usb: mtu3: fix the wrong HS mult value
	xhci: fix even more unsafe memory usage in xhci tracing
	xhci: fix unsafe memory usage in xhci tracing
	x86/reboot: Limit Dell Optiplex 990 quirk to early BIOS versions
	PCI: Call Max Payload Size-related fixup quirks early
	Linux 5.10.64

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I2269075a6d5eb6121b6e42a28d4f3fd0c252695c
2021-09-12 09:17:13 +02:00
Pablo Neira Ayuso
e51ff3ffc3 netfilter: nftables: clone set element expression template
commit 4d8f906583 upstream.

memcpy() breaks when using connlimit in set elements. Use
nft_expr_clone() to initialize the connlimit expression list, otherwise
connlimit garbage collector crashes when walking on the list head copy.

[  493.064656] Workqueue: events_power_efficient nft_rhash_gc [nf_tables]
[  493.064685] RIP: 0010:find_or_evict+0x5a/0x90 [nf_conncount]
[  493.064694] Code: 2b 43 40 83 f8 01 77 0d 48 c7 c0 f5 ff ff ff 44 39 63 3c 75 df 83 6d 18 01 48 8b 43 08 48 89 de 48 8b 13 48 8b 3d ee 2f 00 00 <48> 89 42 08 48 89 10 48 b8 00 01 00 00 00 00 ad de 48 89 03 48 83
[  493.064699] RSP: 0018:ffffc90000417dc0 EFLAGS: 00010297
[  493.064704] RAX: 0000000000000000 RBX: ffff888134f38410 RCX: 0000000000000000
[  493.064708] RDX: 0000000000000000 RSI: ffff888134f38410 RDI: ffff888100060cc0
[  493.064711] RBP: ffff88812ce594a8 R08: ffff888134f38438 R09: 00000000ebb9025c
[  493.064714] R10: ffffffff8219f838 R11: 0000000000000017 R12: 0000000000000001
[  493.064718] R13: ffffffff82146740 R14: ffff888134f38410 R15: 0000000000000000
[  493.064721] FS:  0000000000000000(0000) GS:ffff88840e440000(0000) knlGS:0000000000000000
[  493.064725] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  493.064729] CR2: 0000000000000008 CR3: 00000001330aa002 CR4: 00000000001706e0
[  493.064733] Call Trace:
[  493.064737]  nf_conncount_gc_list+0x8f/0x150 [nf_conncount]
[  493.064746]  nft_rhash_gc+0x106/0x390 [nf_tables]

Reported-by: Laura Garcia Liebana <nevola@gmail.com>
Fixes: 4094445229 ("netfilter: nf_tables: add elements with stateful expressions")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-09-12 08:58:27 +02:00
Pablo Neira Ayuso
36983fc2f8 netfilter: nf_tables: initialize set before expression setup
commit ad9f151e56 upstream.

nft_set_elem_expr_alloc() needs an initialized set if expression sets on
the NFT_EXPR_GC flag. Move set fields initialization before expression
setup.

[4512935.019450] ==================================================================
[4512935.019456] BUG: KASAN: null-ptr-deref in nft_set_elem_expr_alloc+0x84/0xd0 [nf_tables]
[4512935.019487] Read of size 8 at addr 0000000000000070 by task nft/23532
[4512935.019494] CPU: 1 PID: 23532 Comm: nft Not tainted 5.12.0-rc4+ #48
[...]
[4512935.019502] Call Trace:
[4512935.019505]  dump_stack+0x89/0xb4
[4512935.019512]  ? nft_set_elem_expr_alloc+0x84/0xd0 [nf_tables]
[4512935.019536]  ? nft_set_elem_expr_alloc+0x84/0xd0 [nf_tables]
[4512935.019560]  kasan_report.cold.12+0x5f/0xd8
[4512935.019566]  ? nft_set_elem_expr_alloc+0x84/0xd0 [nf_tables]
[4512935.019590]  nft_set_elem_expr_alloc+0x84/0xd0 [nf_tables]
[4512935.019615]  nf_tables_newset+0xc7f/0x1460 [nf_tables]

Reported-by: syzbot+ce96ca2b1d0b37c6422d@syzkaller.appspotmail.com
Fixes: 65038428b2 ("netfilter: nf_tables: allow to specify stateful expression in set definition")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-09-12 08:58:27 +02:00
Eric Dumazet
3fda454f90 netfilter: nftables: avoid potential overflows on 32bit arches
commit 6c8774a94e upstream.

User space could ask for very large hash tables, we need to make sure
our size computations wont overflow.

nf_tables_newset() needs to double check the u64 size
will fit into size_t field.

Fixes: 0ed6389c48 ("netfilter: nf_tables: rename set implementations")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-09-12 08:58:27 +02:00
Greg Kroah-Hartman
674d2ac211 This is the 5.10.62 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmEx2IsACgkQONu9yGCS
 aT6bihAA1pqL2x40IIk7nmu3XW/lNJxt4WLRjT7kGehDYE5gNz5VTQDaccb/+PiM
 18XjLN0RcSkhiai8410A/SNoHBvPSMWrNvf093NpFcGm0WcvsZVyNUfRgdXfs1N8
 FM1DAgA5eVowL+CthZyJIIRX6VllLAg1b3Z61frNO/t1nOUsS26enoxMSeaziqjz
 BuvajftaRGtJBMA3iNB1iKR3EEHRqfuWMT4swfQGDshdHlzXbdDOs0KV4bTYRo+f
 76n1bvftiMH4vRONIR3T+ZeJWeaL6IfW01v7qYx+06hBa6TtkwDc+Ofw5zxWFtj1
 7abou5U46gHIp4Ce8ANJzmnvd7iOssFk7+6y8Z7lZgUQCdwHFLP70VX9Jd3bRlsK
 UIwG0qiIG0jdLgUvjgritDWIcxuSniWIbecLr1xfHIzJAIvVr6bjRNyOz3gXgaa/
 h16oHZRhprC3+4baUQPjPiSb54z+y0Xrx8x9ZSvgHe4gQmctjzoKMVr9Fy7NSpQv
 MVVNi9GvqRI+o+Tu7/N3yxShdXvuRvOOFgeOcyvA7BigrxMb+LvOsPcISFIBva6a
 6+vKuRY79TMwEbDJkURnSNqkVyvMuqKhH5OGiKVHkQrp3AkltpDyDuap+6i2oar4
 ba20HaVstcSdCfx8iCmiy/l0g16vOyNC8cVVdB4WoX1fU6aiv9Y=
 =g+cC
 -----END PGP SIGNATURE-----

Merge 5.10.62 into android12-5.10-lts

Changes in 5.10.62
	net: qrtr: fix another OOB Read in qrtr_endpoint_post
	bpf: Fix ringbuf helper function compatibility
	bpf: Fix NULL pointer dereference in bpf_get_local_storage() helper
	ASoC: rt5682: Adjust headset volume button threshold
	ASoC: component: Remove misplaced prefix handling in pin control functions
	ARC: Fix CONFIG_STACKDEPOT
	netfilter: conntrack: collect all entries in one cycle
	once: Fix panic when module unload
	blk-iocost: fix lockdep warning on blkcg->lock
	ovl: fix uninitialized pointer read in ovl_lookup_real_one()
	net: mscc: Fix non-GPL export of regmap APIs
	can: usb: esd_usb2: esd_usb2_rx_event(): fix the interchange of the CAN RX and TX error counters
	ceph: correctly handle releasing an embedded cap flush
	riscv: Ensure the value of FP registers in the core dump file is up to date
	Revert "btrfs: compression: don't try to compress if we don't have enough pages"
	drm/amdgpu: Cancel delayed work when GFXOFF is disabled
	Revert "USB: serial: ch341: fix character loss at high transfer rates"
	USB: serial: option: add new VID/PID to support Fibocom FG150
	usb: renesas-xhci: Prefer firmware loading on unknown ROM state
	usb: dwc3: gadget: Fix dwc3_calc_trbs_left()
	usb: dwc3: gadget: Stop EP0 transfers during pullup disable
	scsi: core: Fix hang of freezing queue between blocking and running device
	RDMA/bnxt_re: Add missing spin lock initialization
	IB/hfi1: Fix possible null-pointer dereference in _extend_sdma_tx_descs()
	RDMA/bnxt_re: Remove unpaired rtnl unlock in bnxt_re_dev_init()
	ice: do not abort devlink info if board identifier can't be found
	net: usb: pegasus: fixes of set_register(s) return value evaluation;
	igc: fix page fault when thunderbolt is unplugged
	igc: Use num_tx_queues when iterating over tx_ring queue
	e1000e: Fix the max snoop/no-snoop latency for 10M
	e1000e: Do not take care about recovery NVM checksum
	RDMA/efa: Free IRQ vectors on error flow
	ip_gre: add validation for csum_start
	xgene-v2: Fix a resource leak in the error handling path of 'xge_probe()'
	net: marvell: fix MVNETA_TX_IN_PRGRS bit number
	ucounts: Increase ucounts reference counter before the security hook
	net/sched: ets: fix crash when flipping from 'strict' to 'quantum'
	ipv6: use siphash in rt6_exception_hash()
	ipv4: use siphash instead of Jenkins in fnhe_hashfun()
	cxgb4: dont touch blocked freelist bitmap after free
	rtnetlink: Return correct error on changing device netns
	net: hns3: clear hardware resource when loading driver
	net: hns3: add waiting time before cmdq memory is released
	net: hns3: fix duplicate node in VLAN list
	net: hns3: fix get wrong pfc_en when query PFC configuration
	Revert "mmc: sdhci-iproc: Set SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN on BCM2711"
	net: stmmac: add mutex lock to protect est parameters
	net: stmmac: fix kernel panic due to NULL pointer dereference of plat->est
	drm/i915: Fix syncmap memory leak
	usb: gadget: u_audio: fix race condition on endpoint stop
	dt-bindings: sifive-l2-cache: Fix 'select' matching
	perf/x86/intel/uncore: Fix integer overflow on 23 bit left shift of a u32
	clk: renesas: rcar-usb2-clock-sel: Fix kernel NULL pointer dereference
	iwlwifi: pnvm: accept multiple HW-type TLVs
	opp: remove WARN when no valid OPPs remain
	cpufreq: blocklist Qualcomm sm8150 in cpufreq-dt-platdev
	virtio: Improve vq->broken access to avoid any compiler optimization
	virtio_pci: Support surprise removal of virtio pci device
	virtio_vdpa: reject invalid vq indices
	vringh: Use wiov->used to check for read/write desc order
	tools/virtio: fix build
	qed: qed ll2 race condition fixes
	qed: Fix null-pointer dereference in qed_rdma_create_qp()
	Revert "drm/amd/pm: fix workload mismatch on vega10"
	drm/amd/pm: change the workload type for some cards
	blk-mq: don't grab rq's refcount in blk_mq_check_expired()
	drm: Copy drm_wait_vblank to user before returning
	drm/nouveau/disp: power down unused DP links during init
	drm/nouveau/kms/nv50: workaround EFI GOP window channel format differences
	net/rds: dma_map_sg is entitled to merge entries
	btrfs: fix race between marking inode needs to be logged and log syncing
	pipe: avoid unnecessary EPOLLET wakeups under normal loads
	pipe: do FASYNC notifications for every pipe IO, not just state changes
	mtd: spinand: Fix incorrect parameters for on-die ECC
	tipc: call tipc_wait_for_connect only when dlen is not 0
	vt_kdsetmode: extend console locking
	Bluetooth: btusb: check conditions before enabling USB ALT 3 for WBS
	riscv: Fixup wrong ftrace remove cflag
	riscv: Fixup patch_text panic in ftrace
	perf env: Fix memory leak of bpf_prog_info_linear member
	perf symbol-elf: Fix memory leak by freeing sdt_note.args
	perf record: Fix memory leak in vDSO found using ASAN
	perf tools: Fix arm64 build error with gcc-11
	perf annotate: Fix jump parsing for C++ code.
	powerpc/perf: Invoke per-CPU variable access with disabled interrupts
	srcu: Provide internal interface to start a Tree SRCU grace period
	srcu: Provide polling interfaces for Tree SRCU grace periods
	srcu: Provide internal interface to start a Tiny SRCU grace period
	srcu: Make Tiny SRCU use multi-bit grace-period counter
	srcu: Provide polling interfaces for Tiny SRCU grace periods
	tracepoint: Use rcu get state and cond sync for static call updates
	usb: typec: ucsi: acpi: Always decode connector change information
	usb: typec: ucsi: Work around PPM losing change information
	usb: typec: ucsi: Clear pending after acking connector change
	net: dsa: mt7530: fix VLAN traffic leaks again
	lkdtm: Enable DOUBLE_FAULT on all architectures
	arm64: dts: qcom: msm8994-angler: Fix gpio-reserved-ranges 85-88
	btrfs: fix NULL pointer dereference when deleting device by invalid id
	kthread: Fix PF_KTHREAD vs to_kthread() race
	Revert "floppy: reintroduce O_NDELAY fix"
	Revert "parisc: Add assembly implementations for memset, strlen, strcpy, strncpy and strcat"
	net: don't unconditionally copy_from_user a struct ifreq for socket ioctls
	audit: move put_tree() to avoid trim_trees refcount underflow and UAF
	bpf: Fix potentially incorrect results with bpf_get_local_storage()
	Linux 5.10.62

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I5a9bf4b2c254ae21a10f838494cae1c3fa016be3
2021-09-03 10:51:56 +02:00
Florian Westphal
f68ad168e2 netfilter: conntrack: collect all entries in one cycle
[ Upstream commit 4608fdfc07 ]

Michal Kubecek reports that conntrack gc is responsible for frequent
wakeups (every 125ms) on idle systems.

On busy systems, timed out entries are evicted during lookup.
The gc worker is only needed to remove entries after system becomes idle
after a busy period.

To resolve this, always scan the entire table.
If the scan is taking too long, reschedule so other work_structs can run
and resume from next bucket.

After a completed scan, wait for 2 minutes before the next cycle.
Heuristics for faster re-schedule are removed.

GC_SCAN_INTERVAL could be exposed as a sysctl in the future to allow
tuning this as-needed or even turn the gc worker off.

Reported-by: Michal Kubecek <mkubecek@suse.cz>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-09-03 10:09:21 +02:00
Greg Kroah-Hartman
56f751a409 Merge branch 'android12-5.10' into android12-5.10-lts
Sync up with android12-5.10 for the following commits:

49a70f3362 ANDROID: GKI: Add usb/mmc/v4l2 related symbols for i.MX
e18d6a73b9 ANDROID: GKI: Add clk/pinctrl/irq related symbols for i.MX
7652f868f4 ANDROID: GKI: Add phy/net/pci related symbols for i.MX
d587a4f210 ANDROID: GKI: Add audio/rproc related symbols for i.MX
e8ab8b22f1 ANDROID: GKI: Add display related symbols for i.MX
8cfe4f1f9e FROMLIST: usb: dwc3: gadget: Stop EP0 transfers during pullup disable
f90feddc7e ANDROID: abi_gki_aarch64_qcom: Add mmc clk scaling functions
072eded7ca FROMLIST: mmc: core: Export core functions required for clk scaling
bef08a94ff ANDROID: GKI: Update symbols to symbol list
ffa937b6db ANDROID: abi_gki_aarch64_qcom: Add irq_domain_disconnect_hierarchy symbol
34f60eead2 FROMGIT: irqchip/qcom-pdc: Trim unused levels of the interrupt hierarchy
4c9aa4c6f0 FROMGIT: irqdomain: Export irq_domain_disconnect_hierarchy()
d6f6a6cd65 ANDROID: GKI: Add devcoredump API to symbol list
db490c7269 ANDROID: Update the exynos symbol list
228d32e2d0 UPSTREAM: kfence: fix is_kfence_address() for addresses below KFENCE_POOL_SIZE
e113eb454e ANDROID: xt_quota2: set usersize in xt_match registration object
60a4c35570 ANDROID: xt_quota2: clear quota2_log message before sending
4b05a506bd ANDROID: xt_quota2: remove trailing junk which might have a digit in it
9f19de4e29 ANDROID: GKI: Update symbols to abi_gki_aarch64_oplus
5cd4b1ce23 UPSTREAM: cfi: Use rcu_read_{un}lock_sched_notrace
580b7fa7d9 ANDROID: Update symbol list for mtk
70f3f9db21 UPSTREAM: af_unix: fix garbage collect vs MSG_PEEK
4ff1a38f8d ANDROID: GKI: Add initial symbol list for i.MX
51b382a231 ANDROID: GKI: Update abi_gki_aarch64_qcom for balance reclaim symbols
d734d9dc3b ANDROID: ABI: update symbols to A12-K5.10 unisoc whitelist for the first time
205686b558 FROMGIT: rcu: Fix stall-warning deadlock due to non-release of rcu_node ->lock
2493757f88 BACKPORT: ALSA: usb-audio: fix incorrect clock source setting
d0331b15e6 ANDROID: scsi: ufs: Add more logging
62a5f8e3ac ANDROID: Update symbol list for mtk
fdc8f778e2 ANDROID: scheduler: export task_sched_runtime
3425d6179e FROMLIST: mm: slub: fix slub_debug disabling for list of slabs
2e06e5e6f8 FROMLIST: mm/madvise: add MADV_WILLNEED to process_madvise()
ff7eccee30 ANDROID: Update the exynos symbol list
e9844a46c9 FROMGIT: firmware: arm_scmi: Free mailbox channels if probe fails
c72ca115a2 ANDROID: GKI: gki_defconfig: Enable CONFIG_NFC
0ad91fe432 ANDROID: sched: Make uclamp changes depend on CAP_SYS_NICE
2950b81ead ANDROID: GKI: update xiaomi symbol list and ABI XML
8b76fc436b ANDROID: ABI: update generic symbol list

Change-Id: I89b7ccf2c98f61e2775c4b79f16342b00ec480b1
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2021-08-27 14:59:19 +02:00
Todd Kjos
e113eb454e ANDROID: xt_quota2: set usersize in xt_match registration object
Expicitly set what is visible to userspace

Bug: 196046570
Test: passed netd test suites
Signed-off-by: Todd Kjos <tkjos@google.com>
Change-Id: Iacec0ef8ae290e01f1b60508d8abcd40a3653c83
2021-08-20 11:52:24 -07:00
Todd Kjos
60a4c35570 ANDROID: xt_quota2: clear quota2_log message before sending
Initialize message buffer for quota2_log to avoid sending
random data.

Bug: 196046570
Test: passed netd test suites
Fixes: 10cda83af9 ("ANDROID: netfilter: xt_quota2: adding the
original quota2 from xtables-addons")
Signed-off-by: Todd Kjos <tkjos@google.com>
Change-Id: Ic9f34aaa2593809b375fc649b74567190c99dc62
2021-08-20 11:52:13 -07:00
Sam Liddicott
4b05a506bd ANDROID: xt_quota2: remove trailing junk which might have a digit in it
Make sure string only contains the characters specified by userspace.

Fix cherry-picked from xtables-extensions project

Signed-off-by: Sam Liddicott <sam@liddicott.com>
Bug: 196046570
Test: passed netd test suites
Fixes: 10cda83af9 ("ANDROID: netfilter: xt_quota2: adding the
original quota2 from xtables-addons")
Signed-off-by: Todd Kjos <tkjos@google.com>
(cherry picked from https://git.code.sf.net/p/xtables-addons/xtables-addons
bc2bcc383c70b293bd816c29523a952ca8736fb5)
Change-Id: I965448564906e5fbf0fe6d6414f44d9e257ea195
2021-08-20 11:52:02 -07:00
Greg Kroah-Hartman
8b444656fa This is the 5.10.56 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmEKcCUACgkQONu9yGCS
 aT7sMw/7BNJDmX9w+p1lgTIJJzSuz8C/eNgbeZgK7CE4DovO+WL9oEm53vqYcDDo
 j5REnrRhxcBYxwG/GXl1Oniv1wHqw0SplV+5G2NH1RMy23eSFGCw+8G+YOEJnU3P
 94hJuEs/43Py7eZV/VtyO2UMdDRnGI6MlNvu18YjnRJcdqIIl2gln1G8wbyySYVb
 wR1rudvtiEdrmTQr7qGxeIrZNKGwFl0KxEl8j9X/aqxvfe8PRVYKlmtwblf5rybe
 TElQxz2XGRgk8g2yWQmnNoU6rfFHdZ4lTnCwfpFA1XE6/HBA64/1p22QTJUZvyOU
 pbQc1MRaoUncGV9UFAMY1j38JFsVar7YHHOcpp9YIJOjoyiAw4aatGDcntdWDCiG
 X1mCSLs10/xGRPaJJXulp786MH4aTR5qIeoNg8mu3Z3In4ElbBW5xr0wa3N8gs3O
 lEnK/gT2MHiQ1boa+Qy3W+XZmOjWtL69JgbOyRcOYS6lkHL4DFlGL2Nn5u8qGfL4
 hzohJzH36W5SUHDQiYTt1wLNu4iHpAECjxcnk9fCvlcHA5Yu1bqgyQ62i3C9RA6a
 /aO0B0yraHmvCAboemDsESwylxmpiRB3caqKtzlaZjoiOfPydcBwJM46ZfbzLNPh
 l+/YKK2tLOXWyRIhEv8183tVeu7mZ02xjsetPtLltZPJqR+SJKE=
 =8nLw
 -----END PGP SIGNATURE-----

Merge 5.10.56 into android12-5.10-lts

Changes in 5.10.56
	selftest: fix build error in tools/testing/selftests/vm/userfaultfd.c
	io_uring: fix null-ptr-deref in io_sq_offload_start()
	x86/asm: Ensure asm/proto.h can be included stand-alone
	pipe: make pipe writes always wake up readers
	btrfs: fix rw device counting in __btrfs_free_extra_devids
	btrfs: mark compressed range uptodate only if all bio succeed
	Revert "ACPI: resources: Add checks for ACPI IRQ override"
	ACPI: DPTF: Fix reading of attributes
	x86/kvm: fix vcpu-id indexed array sizes
	KVM: add missing compat KVM_CLEAR_DIRTY_LOG
	ocfs2: fix zero out valid data
	ocfs2: issue zeroout to EOF blocks
	can: j1939: j1939_xtp_rx_dat_one(): fix rxtimer value between consecutive TP.DT to 750ms
	can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
	can: peak_usb: pcan_usb_handle_bus_evt(): fix reading rxerr/txerr values
	can: mcba_usb_start(): add missing urb->transfer_dma initialization
	can: usb_8dev: fix memory leak
	can: ems_usb: fix memory leak
	can: esd_usb2: fix memory leak
	alpha: register early reserved memory in memblock
	HID: wacom: Re-enable touch by default for Cintiq 24HDT / 27QHDT
	NIU: fix incorrect error return, missed in previous revert
	drm/amd/display: ensure dentist display clock update finished in DCN20
	drm/amdgpu: Avoid printing of stack contents on firmware load error
	drm/amdgpu: Fix resource leak on probe error path
	blk-iocost: fix operation ordering in iocg_wake_fn()
	nfc: nfcsim: fix use after free during module unload
	cfg80211: Fix possible memory leak in function cfg80211_bss_update
	RDMA/bnxt_re: Fix stats counters
	bpf: Fix OOB read when printing XDP link fdinfo
	mac80211: fix enabling 4-address mode on a sta vif after assoc
	netfilter: conntrack: adjust stop timestamp to real expiry value
	netfilter: nft_nat: allow to specify layer 4 protocol NAT only
	i40e: Fix logic of disabling queues
	i40e: Fix firmware LLDP agent related warning
	i40e: Fix queue-to-TC mapping on Tx
	i40e: Fix log TC creation failure when max num of queues is exceeded
	tipc: fix implicit-connect for SYN+
	tipc: fix sleeping in tipc accept routine
	net: Set true network header for ECN decapsulation
	net: qrtr: fix memory leaks
	ionic: remove intr coalesce update from napi
	ionic: fix up dim accounting for tx and rx
	ionic: count csum_none when offload enabled
	tipc: do not write skb_shinfo frags when doing decrytion
	octeontx2-pf: Fix interface down flag on error
	mlx4: Fix missing error code in mlx4_load_one()
	KVM: x86: Check the right feature bit for MSR_KVM_ASYNC_PF_ACK access
	net: llc: fix skb_over_panic
	drm/msm/dpu: Fix sm8250_mdp register length
	drm/msm/dp: Initialize the INTF_CONFIG register
	skmsg: Make sk_psock_destroy() static
	net/mlx5: Fix flow table chaining
	net/mlx5e: Fix nullptr in mlx5e_hairpin_get_mdev()
	sctp: fix return value check in __sctp_rcv_asconf_lookup
	tulip: windbond-840: Fix missing pci_disable_device() in probe and remove
	sis900: Fix missing pci_disable_device() in probe and remove
	can: hi311x: fix a signedness bug in hi3110_cmd()
	bpf: Introduce BPF nospec instruction for mitigating Spectre v4
	bpf: Fix leakage due to insufficient speculative store bypass mitigation
	bpf: Remove superfluous aux sanitation on subprog rejection
	bpf: verifier: Allocate idmap scratch in verifier env
	bpf: Fix pointer arithmetic mask tightening under state pruning
	SMB3: fix readpage for large swap cache
	powerpc/pseries: Fix regression while building external modules
	Revert "perf map: Fix dso->nsinfo refcounting"
	i40e: Add additional info to PHY type error
	can: j1939: j1939_session_deactivate(): clarify lifetime of session object
	Linux 5.10.56

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ib3c9244afb7ee5d6ee8d3235efe8956898f486c4
2021-08-04 15:02:23 +02:00
Pablo Neira Ayuso
cbc8012902 netfilter: nft_nat: allow to specify layer 4 protocol NAT only
[ Upstream commit a33f387ecd ]

nft_nat reports a bogus EAFNOSUPPORT if no layer 3 information is specified.

Fixes: d07db9884a ("netfilter: nf_tables: introduce nft_validate_register_load()")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-08-04 12:46:42 +02:00
Florian Westphal
3dbda8483f netfilter: conntrack: adjust stop timestamp to real expiry value
[ Upstream commit 30a56a2b88 ]

In case the entry is evicted via garbage collection there is
delay between the timeout value and the eviction event.

This adjusts the stop value based on how much time has passed.

Fixes: b87a2f9199 ("netfilter: conntrack: add gc worker to remove timed-out entries")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-08-04 12:46:42 +02:00
Greg Kroah-Hartman
afe9ed0e13 This is the 5.10.53 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmD9WtYACgkQONu9yGCS
 aT6IkRAAnW25XGt27ELqFNo2vCXI38YFEyNpe0aN8y2A4X1MXu8EKNunQNFKYVt9
 5sGrSjt30qy0A9pbeajqXfnGmCNe5R825lRCQia08/+b/qyfaF358DdAI59q5zd1
 0IhInfBo+TJyLLxltt0f2yGQJfo2DfmRuOpr0EXrE7Mo7lTqDqrpmDbLl+fZ8Ugd
 SaXRZMHLsH18Q8XuFbbBnU57tgGsIys9ie397jf3jYZBpfnzWjfsKbM4BnBz3fAv
 bUnZ5P1G8Bwps30ES8Qpc6ZoWMYl6MkEPNc+4f57+amvJME45MePUvgDRrQV3Z0P
 bveovBal8c13aO46DIa+bW0Wevy1pR/OcNQ78r8I1Sq4gp6rIp0oj6Q3rEPNfJqf
 8s1/9FNbZVRkz/TA2vtILGhIlJfMm7QcESM8WA1kA5EN4er35DGlvN69kpspxhoh
 FBrgmAdMQQgmiCtLR1QllP5PVDaTNQlsXR3yeASc54UrEwuyFe/ELE5YEb7vvXIQ
 u7JF+zYbxVFqyUCtyoBEy6eoAe/jGAI/kiCvifitR33289lOItz5n64CQzCex54R
 WR1wX+rl9Jf/SWHuBh/JgCqS6x8O2+1WfpABmEWwT6m1leC6v0LG0CJoywGdHf1I
 +IlIsThsoPIMd0xFzd7GlV4+ot2ZHsxyhY7dDnkIfCZtFLKubuU=
 =PNDL
 -----END PGP SIGNATURE-----

Merge 5.10.53 into android12-5.10-lts

Changes in 5.10.53
	ARM: dts: gemini: rename mdio to the right name
	ARM: dts: gemini: add device_type on pci
	ARM: dts: rockchip: Fix thermal sensor cells o rk322x
	ARM: dts: rockchip: fix pinctrl sleep nodename for rk3036-kylin and rk3288
	arm64: dts: rockchip: fix pinctrl sleep nodename for rk3399.dtsi
	ARM: dts: rockchip: Fix the timer clocks order
	ARM: dts: rockchip: Fix IOMMU nodes properties on rk322x
	ARM: dts: rockchip: Fix power-controller node names for rk3066a
	ARM: dts: rockchip: Fix power-controller node names for rk3188
	ARM: dts: rockchip: Fix power-controller node names for rk3288
	arm64: dts: rockchip: Fix power-controller node names for px30
	arm64: dts: rockchip: Fix power-controller node names for rk3328
	arm64: dts: rockchip: Fix power-controller node names for rk3399
	reset: ti-syscon: fix to_ti_syscon_reset_data macro
	ARM: brcmstb: dts: fix NAND nodes names
	ARM: Cygnus: dts: fix NAND nodes names
	ARM: NSP: dts: fix NAND nodes names
	ARM: dts: BCM63xx: Fix NAND nodes names
	ARM: dts: Hurricane 2: Fix NAND nodes names
	ARM: dts: imx6: phyFLEX: Fix UART hardware flow control
	ARM: imx: pm-imx5: Fix references to imx5_cpu_suspend_info
	arm64: dts: rockchip: fix regulator-gpio states array
	ARM: dts: ux500: Fix interrupt cells
	ARM: dts: ux500: Rename gpio-controller node
	ARM: dts: ux500: Fix orientation of accelerometer
	ARM: dts: imx6dl-riotboard: configure PHY clock and set proper EEE value
	rtc: mxc_v2: add missing MODULE_DEVICE_TABLE
	kbuild: sink stdout from cmd for silent build
	ARM: dts: am57xx-cl-som-am57x: fix ti,no-reset-on-init flag for gpios
	ARM: dts: am437x-gp-evm: fix ti,no-reset-on-init flag for gpios
	ARM: dts: am335x: fix ti,no-reset-on-init flag for gpios
	ARM: dts: OMAP2+: Replace underscores in sub-mailbox node names
	arm64: dts: ti: k3-am654x/j721e/j7200-common-proc-board: Fix MCU_RGMII1_TXC direction
	ARM: tegra: wm8903: Fix polarity of headphones-detection GPIO in device-trees
	ARM: tegra: nexus7: Correct 3v3 regulator GPIO of PM269 variant
	arm64: dts: qcom: sc7180: Move rmtfs memory region
	ARM: dts: stm32: Remove extra size-cells on dhcom-pdk2
	ARM: dts: stm32: Fix touchscreen node on dhcom-pdk2
	ARM: dts: stm32: fix stm32mp157c-odyssey card detect pin
	ARM: dts: stm32: fix gpio-keys node on STM32 MCU boards
	ARM: dts: stm32: fix RCC node name on stm32f429 MCU
	ARM: dts: stm32: fix timer nodes on STM32 MCU to prevent warnings
	memory: tegra: Fix compilation warnings on 64bit platforms
	firmware: arm_scmi: Add SMCCC discovery dependency in Kconfig
	firmware: arm_scmi: Fix the build when CONFIG_MAILBOX is not selected
	ARM: dts: bcm283x: Fix up MMC node names
	ARM: dts: bcm283x: Fix up GPIO LED node names
	arm64: dts: juno: Update SCPI nodes as per the YAML schema
	ARM: dts: rockchip: fix supply properties in io-domains nodes
	ARM: dts: stm32: fix i2c node name on stm32f746 to prevent warnings
	ARM: dts: stm32: move stmmac axi config in ethernet node on stm32mp15
	ARM: dts: stm32: fix the Odyssey SoM eMMC VQMMC supply
	ARM: dts: stm32: Drop unused linux,wakeup from touchscreen node on DHCOM SoM
	ARM: dts: stm32: Rename spi-flash/mx66l51235l@N to flash@N on DHCOM SoM
	ARM: dts: stm32: fix stpmic node for stm32mp1 boards
	ARM: OMAP2+: Block suspend for am3 and am4 if PM is not configured
	soc/tegra: fuse: Fix Tegra234-only builds
	firmware: tegra: bpmp: Fix Tegra234-only builds
	arm64: dts: ls208xa: remove bus-num from dspi node
	arm64: dts: imx8mq: assign PCIe clocks
	thermal/core: Correct function name thermal_zone_device_unregister()
	thermal/drivers/rcar_gen3_thermal: Do not shadow rcar_gen3_ths_tj_1
	thermal/drivers/imx_sc: Add missing of_node_put for loop iteration
	thermal/drivers/sprd: Add missing of_node_put for loop iteration
	kbuild: mkcompile_h: consider timestamp if KBUILD_BUILD_TIMESTAMP is set
	arch/arm64/boot/dts/marvell: fix NAND partitioning scheme
	rtc: max77686: Do not enforce (incorrect) interrupt trigger type
	scsi: aic7xxx: Fix unintentional sign extension issue on left shift of u8
	scsi: libsas: Add LUN number check in .slave_alloc callback
	scsi: libfc: Fix array index out of bound exception
	scsi: qedf: Add check to synchronize abort and flush
	sched/fair: Fix CFS bandwidth hrtimer expiry type
	perf/x86/intel/uncore: Clean up error handling path of iio mapping
	thermal/core/thermal_of: Stop zone device before unregistering it
	s390/traps: do not test MONITOR CALL without CONFIG_BUG
	s390: introduce proper type handling call_on_stack() macro
	cifs: prevent NULL deref in cifs_compose_mount_options()
	firmware: turris-mox-rwtm: add marvell,armada-3700-rwtm-firmware compatible string
	arm64: dts: marvell: armada-37xx: move firmware node to generic dtsi file
	Revert "swap: fix do_swap_page() race with swapoff"
	f2fs: Show casefolding support only when supported
	mm/thp: simplify copying of huge zero page pmd when fork
	mm/userfaultfd: fix uffd-wp special cases for fork()
	mm/page_alloc: fix memory map initialization for descending nodes
	usb: cdns3: Enable TDL_CHK only for OUT ep
	net: bcmgenet: ensure EXT_ENERGY_DET_MASK is clear
	net: dsa: mv88e6xxx: enable .port_set_policy() on Topaz
	net: dsa: mv88e6xxx: use correct .stats_set_histogram() on Topaz
	net: dsa: mv88e6xxx: enable .rmu_disable() on Topaz
	net: dsa: mv88e6xxx: enable devlink ATU hash param for Topaz
	net: ipv6: fix return value of ip6_skb_dst_mtu
	netfilter: ctnetlink: suspicious RCU usage in ctnetlink_dump_helpinfo
	net/sched: act_ct: fix err check for nf_conntrack_confirm
	vmxnet3: fix cksum offload issues for tunnels with non-default udp ports
	net/sched: act_ct: remove and free nf_table callbacks
	net: bridge: sync fdb to new unicast-filtering ports
	net: netdevsim: use xso.real_dev instead of xso.dev in callback functions of struct xfrmdev_ops
	net: bcmgenet: Ensure all TX/RX queues DMAs are disabled
	net: ip_tunnel: fix mtu calculation for ETHER tunnel devices
	net: moxa: fix UAF in moxart_mac_probe
	net: qcom/emac: fix UAF in emac_remove
	net: ti: fix UAF in tlan_remove_one
	net: send SYNACK packet with accepted fwmark
	net: validate lwtstate->data before returning from skb_tunnel_info()
	Revert "mm/shmem: fix shmem_swapin() race with swapoff"
	net: dsa: properly check for the bridge_leave methods in dsa_switch_bridge_leave()
	net: fddi: fix UAF in fza_probe
	dma-buf/sync_file: Don't leak fences on merge failure
	kbuild: do not suppress Kconfig prompts for silent build
	ARM: dts: aspeed: Fix AST2600 machines line names
	ARM: dts: tacoma: Add phase corrections for eMMC
	tcp: consistently disable header prediction for mptcp
	tcp: annotate data races around tp->mtu_info
	tcp: fix tcp_init_transfer() to not reset icsk_ca_initialized
	ipv6: tcp: drop silly ICMPv6 packet too big messages
	tcp: call sk_wmem_schedule before sk_mem_charge in zerocopy path
	tools: bpf: Fix error in 'make -C tools/ bpf_install'
	bpftool: Properly close va_list 'ap' by va_end() on error
	bpf: Track subprog poke descriptors correctly and fix use-after-free
	perf test bpf: Free obj_buf
	drm/panel: nt35510: Do not fail if DSI read fails
	udp: annotate data races around unix_sk(sk)->gso_size
	Linux 5.10.53

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Iac8fe9cd2abb2d8dd993967205a97c89f01f3647
2021-07-25 15:37:14 +02:00
Vasily Averin
fc40fdefd9 netfilter: ctnetlink: suspicious RCU usage in ctnetlink_dump_helpinfo
commit c23a9fd209 upstream.

Two patches listed below removed ctnetlink_dump_helpinfo call from under
rcu_read_lock. Now its rcu_dereference generates following warning:
=============================
WARNING: suspicious RCU usage
5.13.0+ #5 Not tainted
-----------------------------
net/netfilter/nf_conntrack_netlink.c:221 suspicious rcu_dereference_check() usage!

other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
stack backtrace:
CPU: 1 PID: 2251 Comm: conntrack Not tainted 5.13.0+ #5
Call Trace:
 dump_stack+0x7f/0xa1
 ctnetlink_dump_helpinfo+0x134/0x150 [nf_conntrack_netlink]
 ctnetlink_fill_info+0x2c2/0x390 [nf_conntrack_netlink]
 ctnetlink_dump_table+0x13f/0x370 [nf_conntrack_netlink]
 netlink_dump+0x10c/0x370
 __netlink_dump_start+0x1a7/0x260
 ctnetlink_get_conntrack+0x1e5/0x250 [nf_conntrack_netlink]
 nfnetlink_rcv_msg+0x613/0x993 [nfnetlink]
 netlink_rcv_skb+0x50/0x100
 nfnetlink_rcv+0x55/0x120 [nfnetlink]
 netlink_unicast+0x181/0x260
 netlink_sendmsg+0x23f/0x460
 sock_sendmsg+0x5b/0x60
 __sys_sendto+0xf1/0x160
 __x64_sys_sendto+0x24/0x30
 do_syscall_64+0x36/0x70
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Fixes: 49ca022bcc ("netfilter: ctnetlink: don't dump ct extensions of unconfirmed conntracks")
Fixes: 0b35f6031a ("netfilter: Remove duplicated rcu_read_lock.")
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-07-25 14:36:19 +02:00
Greg Kroah-Hartman
1328352dcd Merge branch 'android12-5.10' into android12-5.10-lts
Sync up with android12-5.10 for the following commits:

870488eb07 ANDROID: GKI: 7/14/2021 KMI update
e9742a9ea5 ANDROID: Update the ABI symbol list
ec2190fd3f FROMLIST: arm64: avoid double ISB on kernel entry
98b2c1dd1c FROMLIST: arm64: mte: optimize GCR_EL1 modification on kernel entry/exit
a20103c331 BACKPORT: FROMLIST: arm64: mte: avoid TFSR related operations unless in async mode
3972be647a FROMLIST: Documentation: document the preferred tag checking mode feature
5adf29adb5 FROMLIST: arm64: mte: introduce a per-CPU tag checking mode preference
ce5ba15abc FROMLIST: arm64: move preemption disablement to prctl handlers
6c08feaa27 FROMLIST: arm64: mte: change ASYNC and SYNC TCF settings into bitfields
f438cf16cd FROMLIST: arm64: mte: rename gcr_user_excl to mte_ctrl
a4c9e551b6 BACKPORT: arm64: pac: Optimize kernel entry/exit key installation code paths
50829b8901 BACKPORT: arm64: Introduce prctl(PR_PAC_{SET,GET}_ENABLED_KEYS)
6119d18df7 ANDROID: cleancache: add oem data to cleancache_ops
a0c429e8e1 ANDROID: blkdev: add oem data to block_device_operations
26cd2564e1 FROMLIST: psi: stop relying on timer_pending for poll_work rescheduling
e85b291d7d ANDROID: GKI: Enable CONFIG_MEMCG
0ed7424fa0 ANDROID: GKI: net: add vendor hooks for 'struct sock' lifecycle
4d30956478 ANDROID: GKI: net: add vendor hooks for 'struct nf_conn' lifecycle
7786463e48 ANDROID: GKI: add vendor padding variable in struct sock
280c9b98aa ANDROID: GKI: add vendor padding variable in struct nf_conn
9d1b55d20a ANDROID: vendor_hooks: add a field in mem_cgroup
65115fdbf8 ANDROID: vendor_hooks: add a field in pglist_data
26920e0f3a FROMLIST: usb: dwc3: avoid NULL access of usb_gadget_driver
5bb2dd8d39 FROMGIT: usb: dwc3: dwc3-qcom: Enable tx-fifo-resize property by default
79274dbb00 FROMGIT: usb: dwc3: Resize TX FIFOs to meet EP bursting requirements
1e11f36199 FROMGIT: usb: gadget: configfs: Check USB configuration before adding
6da5e7afbf FROMGIT: usb: gadget: udc: core: Introduce check_config to verify USB configuration
2ed5fbf261 ANDROID: GKI: fscrypt: add OEM data to struct fscrypt_operations
194fd9239a ANDROID: GKI: fscrypt: add ABI padding to struct fscrypt_operations
8011eb2215 ANDROID: mm: provision to add shmem pages to inactive file lru head
9bb1247653 ANDROID: GKI: Enable CONFIG_CGROUP_NET_PRIO
a1ce719ca7 ANDROID: Delete the DMA-BUF attachment sysfs statistics
a2b3afb2f7 ANDROID: android: Add symbols to debug_symbols driver
914a7b14a0 UPSTREAM: USB: UDC core: Add udc_async_callbacks gadget op
9af9ef8dfa ANDROID: vendor_hooks: Add oem data to file struct
37485a3025 ANDROID: add kabi padding for structures for the android12 release
429c78f9b0 ANDROID: GKI: device.h: add Android ABI padding to some structures
aea5e1c230 ANDROID: GKI: elevator: add Android ABI padding to some structures
1b79ef2754 ANDROID: GKI: scsi: add Android ABI padding to some structures
33175403b9 ANDROID: GKI: workqueue.h: add Android ABI padding to some structures
d5c344a498 ANDROID: GKI: sched: add Android ABI padding to some structures
9c4854fa5a ANDROID: GKI: phy: add Android ABI padding to some structures
f4872b2353 ANDROID: GKI: fs.h: add Android ABI padding to some structures
48cddc7c42 ANDROID: GKI: dentry: add Android ABI padding to some structures
b9081a2925 ANDROID: GKI: bio: add Android ABI padding to some structures
99bf8cf8fa ANDROID: GKI: ufs: add Android ABI padding to some structures
9df147298f ANDROID: Update the generic symbol list
12f48605e8 ANDROID: mm: cma do not sleep for __GFP_NORETRY
0e688e972d ANDROID: mm: cma: skip problematic pageblock
9938b82be1 ANDROID: mm: bail out tlb free batching on page zapping when cma is going on
c8578a3e90 ANDROID: mm: lru_cache_disable skips lru cache drainnig
c01ce3b5ef ANDROID: mm: do not try test_page_isoalte if migration fails
675e504598 ANDROID: mm: add cma allocation statistics
b1e4543c27 UPSTREAM: mm, page_alloc: move draining pcplists to page isolation users
13bc06efd9 ANDROID: ALSA: compress: add vendor hook to support pause in draining
2faed77792 ANDROID: vendor_hooks: add vendor hook in blk_mq_rq_ctx_init()
292baba45a ANDROID: abi_gki_aarch64_qcom: Add I3C core symbols to qcom tree
eecc725a8e ANDROID: vendor_hooks: add vendor hook in blk_mq_alloc_rqs()
9c2958f454 ANDROID: GKI: Export put_task_stack symbol
288805c86a ANDROID: abi_gki_aarch64_qcom: Add idr_alloc_u32
e8516fd3af ANDROID: sound: usb: add vendor hook for cpu suspend support
d820d22b5d ANDROID: mm: page_pinner: use EXPORT_SYMBOL_GPL
efc09793ea ANDROID: GKI: update allowed GKI symbol for Exynosauto SoC
67e3e39eb1 ANDROID: GKI: sync allowed list for exynosauto SoC
d25e256373 ANDROID: ABI: add new symbols required by fips140.ko
50661975be ANDROID: fips140: add/update module help text
b7397e89db ANDROID: fips140: add power-up cryptographic self-tests
bd7d13c36e ANDROID: arm64: disable LSE when building the FIPS140 module
1061ef0493 ANDROID: jump_label: disable jump labels in fips140.ko
dcf509fea7 ANDROID: ipv6: add vendor hook for gen ipv6 link-local addr
018332e871 ANDROID: Revert "scsi: block: Do not accept any requests while suspended"
2ad2c3a25b ANDROID: abi_gki_aarch64_qcom: whitelist vm_event_states
7bcfde2601 ANDROID: ashmem: Export is_ashmem_file

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I7d60121fa9f25f007dab97dd666adcdb1964afc8
2021-07-15 17:17:09 +02:00
Vignesh Saravanaperumal
4d30956478 ANDROID: GKI: net: add vendor hooks for 'struct nf_conn' lifecycle
Some vendors want to add a field when a 'sruct nf_conn' is added so give a
hook to handle this.  Any memory allocated when
trace_android_rvh_nf_conn_alloc() is called needs to be freed when
trace_android_rvh_nf_conn_free() is called.

Note, if trace_android_rvh_nf_conn_alloc() fails, be sure to be able to
handle this in trace_android_rvh_nf_conn_free(), but that should not be
an issue as that needs to be addressed in vendor code that runs for
'struct nf_conn' objects that have been created before the vendor code
is loaded no matter what.

Bug: 171013716
Signed-off-by: Vignesh Saravanaperumal <vignesh1.s@samsung.com>
Change-Id: I4d2b025196a3df7ba4adec313c90483811cac728
2021-07-14 20:52:03 -07:00
Greg Kroah-Hartman
2df0fb4a4b This is the 5.10.50 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmDu+1UACgkQONu9yGCS
 aT7jQRAAuLDi7ejk3JUameYFMzVXGAUE6yPs392/lWJzey7IBf+2uLqz4FzqqUHp
 U1GkEKJVaCacEfi0+rpi7BxNFljUdZdg/F/P68ARtAWPvwqAeJ4QIh5u3A682UUO
 1M5h6e5/oY9F4kQIb5Kot04avqOeR6lTqrkA8jeP5h43ngyLWuS2d+5oOGmbCukS
 UgEaCC6CiKjcN51UUTj/fXMQ0X4IDHP5pD8rWwH0IvK0i7gduvk744un8LVB6aW1
 rNV88C3BEFFtkPQh2XySnXM5Ok8kYlhFoTDsqlpeAX7pA8hiUPYBoRzTg0MJtPZn
 N1L/Yqhvxmn5xs9HAw7mDOo8E8NWXzsT5FvZVaBeiCgtdKmcPszylXqmSt1oiOb0
 /EmkCWmlbG/3qWql24+LU4XP36iVPx32HQxAgg2XbnlNU5o0E1y2F98p6p/3JSWX
 NAjHtmg/MxueFQ+w8bDzhO8YzYn1dIU3V3qaXRvtpODrmaSYW+bwCyPtSjXe3/vL
 604zb3dOg9+tD/gKqfRb/UPMu24nNll8M/gnSRci05/thmIxwtYudPwoLNSejDqr
 e+a8vejISfIyp41XrpYQbUeKs1WOA+A7vgx6CZrT791afiT+6UgC/ecQfg1NFxhs
 8ayWpocaIszxyXxVGro1rfwZeQmTlbTCZ5wVdpn9sDPZfI7epts=
 =FCrA
 -----END PGP SIGNATURE-----

Merge 5.10.50 into android12-5.10-lts

Changes in 5.10.50
	Bluetooth: hci_qca: fix potential GPF
	Bluetooth: btqca: Don't modify firmware contents in-place
	Bluetooth: Remove spurious error message
	ALSA: usb-audio: fix rate on Ozone Z90 USB headset
	ALSA: usb-audio: Fix OOB access at proc output
	ALSA: firewire-motu: fix stream format for MOTU 8pre FireWire
	ALSA: usb-audio: scarlett2: Fix wrong resume call
	ALSA: intel8x0: Fix breakage at ac97 clock measurement
	ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 450 G8
	ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 445 G8
	ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 630 G8
	ALSA: hda/realtek: Add another ALC236 variant support
	ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook x360 830 G8
	ALSA: hda/realtek: Improve fixup for HP Spectre x360 15-df0xxx
	ALSA: hda/realtek: Fix bass speaker DAC mapping for Asus UM431D
	ALSA: hda/realtek: Apply LED fixup for HP Dragonfly G1, too
	ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 830 G8 Notebook PC
	media: dvb-usb: fix wrong definition
	Input: usbtouchscreen - fix control-request directions
	net: can: ems_usb: fix use-after-free in ems_usb_disconnect()
	usb: gadget: eem: fix echo command packet response issue
	usb: renesas-xhci: Fix handling of unknown ROM state
	USB: cdc-acm: blacklist Heimann USB Appset device
	usb: dwc3: Fix debugfs creation flow
	usb: typec: Add the missed altmode_id_remove() in typec_register_altmode()
	xhci: solve a double free problem while doing s4
	gfs2: Fix underflow in gfs2_page_mkwrite
	gfs2: Fix error handling in init_statfs
	ntfs: fix validity check for file name attribute
	selftests/lkdtm: Avoid needing explicit sub-shell
	copy_page_to_iter(): fix ITER_DISCARD case
	iov_iter_fault_in_readable() should do nothing in xarray case
	Input: joydev - prevent use of not validated data in JSIOCSBTNMAP ioctl
	crypto: nx - Fix memcpy() over-reading in nonce
	crypto: ccp - Annotate SEV Firmware file names
	arm_pmu: Fix write counter incorrect in ARMv7 big-endian mode
	ARM: dts: ux500: Fix LED probing
	ARM: dts: at91: sama5d4: fix pinctrl muxing
	btrfs: send: fix invalid path for unlink operations after parent orphanization
	btrfs: compression: don't try to compress if we don't have enough pages
	btrfs: clear defrag status of a root if starting transaction fails
	ext4: cleanup in-core orphan list if ext4_truncate() failed to get a transaction handle
	ext4: fix kernel infoleak via ext4_extent_header
	ext4: fix overflow in ext4_iomap_alloc()
	ext4: return error code when ext4_fill_flex_info() fails
	ext4: correct the cache_nr in tracepoint ext4_es_shrink_exit
	ext4: remove check for zero nr_to_scan in ext4_es_scan()
	ext4: fix avefreec in find_group_orlov
	ext4: use ext4_grp_locked_error in mb_find_extent
	can: bcm: delay release of struct bcm_op after synchronize_rcu()
	can: gw: synchronize rcu operations before removing gw job entry
	can: isotp: isotp_release(): omit unintended hrtimer restart on socket release
	can: j1939: j1939_sk_init(): set SOCK_RCU_FREE to call sk_destruct() after RCU is done
	can: peak_pciefd: pucan_handle_status(): fix a potential starvation issue in TX path
	mac80211: remove iwlwifi specific workaround that broke sta NDP tx
	SUNRPC: Fix the batch tasks count wraparound.
	SUNRPC: Should wake up the privileged task firstly.
	bus: mhi: Wait for M2 state during system resume
	mm/gup: fix try_grab_compound_head() race with split_huge_page()
	perf/smmuv3: Don't trample existing events with global filter
	KVM: nVMX: Handle split-lock #AC exceptions that happen in L2
	KVM: PPC: Book3S HV: Workaround high stack usage with clang
	KVM: x86/mmu: Treat NX as used (not reserved) for all !TDP shadow MMUs
	KVM: x86/mmu: Use MMU's role to detect CR4.SMEP value in nested NPT walk
	s390/cio: dont call css_wait_for_slow_path() inside a lock
	s390: mm: Fix secure storage access exception handling
	f2fs: Prevent swap file in LFS mode
	clk: agilex/stratix10/n5x: fix how the bypass_reg is handled
	clk: agilex/stratix10: remove noc_clk
	clk: agilex/stratix10: fix bypass representation
	rtc: stm32: Fix unbalanced clk_disable_unprepare() on probe error path
	iio: frequency: adf4350: disable reg and clk on error in adf4350_probe()
	iio: light: tcs3472: do not free unallocated IRQ
	iio: ltr501: mark register holding upper 8 bits of ALS_DATA{0,1} and PS_DATA as volatile, too
	iio: ltr501: ltr559: fix initialization of LTR501_ALS_CONTR
	iio: ltr501: ltr501_read_ps(): add missing endianness conversion
	iio: accel: bma180: Fix BMA25x bandwidth register values
	serial: mvebu-uart: fix calculation of clock divisor
	serial: sh-sci: Stop dmaengine transfer in sci_stop_tx()
	serial_cs: Add Option International GSM-Ready 56K/ISDN modem
	serial_cs: remove wrong GLOBETROTTER.cis entry
	ath9k: Fix kernel NULL pointer dereference during ath_reset_internal()
	ssb: sdio: Don't overwrite const buffer if block_write fails
	rsi: Assign beacon rate settings to the correct rate_info descriptor field
	rsi: fix AP mode with WPA failure due to encrypted EAPOL
	tracing/histograms: Fix parsing of "sym-offset" modifier
	tracepoint: Add tracepoint_probe_register_may_exist() for BPF tracing
	seq_buf: Make trace_seq_putmem_hex() support data longer than 8
	powerpc/stacktrace: Fix spurious "stale" traces in raise_backtrace_ipi()
	loop: Fix missing discard support when using LOOP_CONFIGURE
	evm: Execute evm_inode_init_security() only when an HMAC key is loaded
	evm: Refuse EVM_ALLOW_METADATA_WRITES only if an HMAC key is loaded
	fuse: Fix crash in fuse_dentry_automount() error path
	fuse: Fix crash if superblock of submount gets killed early
	fuse: Fix infinite loop in sget_fc()
	fuse: ignore PG_workingset after stealing
	fuse: check connected before queueing on fpq->io
	fuse: reject internal errno
	thermal/cpufreq_cooling: Update offline CPUs per-cpu thermal_pressure
	spi: Make of_register_spi_device also set the fwnode
	Add a reference to ucounts for each cred
	staging: media: rkvdec: fix pm_runtime_get_sync() usage count
	media: marvel-ccic: fix some issues when getting pm_runtime
	media: mdk-mdp: fix pm_runtime_get_sync() usage count
	media: s5p: fix pm_runtime_get_sync() usage count
	media: am437x: fix pm_runtime_get_sync() usage count
	media: sh_vou: fix pm_runtime_get_sync() usage count
	media: mtk-vcodec: fix PM runtime get logic
	media: s5p-jpeg: fix pm_runtime_get_sync() usage count
	media: sunxi: fix pm_runtime_get_sync() usage count
	media: sti/bdisp: fix pm_runtime_get_sync() usage count
	media: exynos4-is: fix pm_runtime_get_sync() usage count
	media: exynos-gsc: fix pm_runtime_get_sync() usage count
	spi: spi-loopback-test: Fix 'tx_buf' might be 'rx_buf'
	spi: spi-topcliff-pch: Fix potential double free in pch_spi_process_messages()
	spi: omap-100k: Fix the length judgment problem
	regulator: uniphier: Add missing MODULE_DEVICE_TABLE
	sched/core: Initialize the idle task with preemption disabled
	hwrng: exynos - Fix runtime PM imbalance on error
	crypto: nx - add missing MODULE_DEVICE_TABLE
	media: sti: fix obj-$(config) targets
	media: cpia2: fix memory leak in cpia2_usb_probe
	media: cobalt: fix race condition in setting HPD
	media: hevc: Fix dependent slice segment flags
	media: pvrusb2: fix warning in pvr2_i2c_core_done
	media: imx: imx7_mipi_csis: Fix logging of only error event counters
	crypto: qat - check return code of qat_hal_rd_rel_reg()
	crypto: qat - remove unused macro in FW loader
	crypto: qce: skcipher: Fix incorrect sg count for dma transfers
	arm64: perf: Convert snprintf to sysfs_emit
	sched/fair: Fix ascii art by relpacing tabs
	media: i2c: ov2659: Use clk_{prepare_enable,disable_unprepare}() to set xvclk on/off
	media: bt878: do not schedule tasklet when it is not setup
	media: em28xx: Fix possible memory leak of em28xx struct
	media: hantro: Fix .buf_prepare
	media: cedrus: Fix .buf_prepare
	media: v4l2-core: Avoid the dangling pointer in v4l2_fh_release
	media: bt8xx: Fix a missing check bug in bt878_probe
	media: st-hva: Fix potential NULL pointer dereferences
	crypto: hisilicon/sec - fixup 3des minimum key size declaration
	Makefile: fix GDB warning with CONFIG_RELR
	media: dvd_usb: memory leak in cinergyt2_fe_attach
	memstick: rtsx_usb_ms: fix UAF
	mmc: sdhci-sprd: use sdhci_sprd_writew
	mmc: via-sdmmc: add a check against NULL pointer dereference
	spi: meson-spicc: fix a wrong goto jump for avoiding memory leak.
	spi: meson-spicc: fix memory leak in meson_spicc_probe
	crypto: shash - avoid comparing pointers to exported functions under CFI
	media: dvb_net: avoid speculation from net slot
	media: siano: fix device register error path
	media: imx-csi: Skip first few frames from a BT.656 source
	hwmon: (max31790) Report correct current pwm duty cycles
	hwmon: (max31790) Fix pwmX_enable attributes
	drivers/perf: fix the missed ida_simple_remove() in ddr_perf_probe()
	KVM: PPC: Book3S HV: Fix TLB management on SMT8 POWER9 and POWER10 processors
	btrfs: fix error handling in __btrfs_update_delayed_inode
	btrfs: abort transaction if we fail to update the delayed inode
	btrfs: sysfs: fix format string for some discard stats
	btrfs: don't clear page extent mapped if we're not invalidating the full page
	btrfs: disable build on platforms having page size 256K
	locking/lockdep: Fix the dep path printing for backwards BFS
	lockding/lockdep: Avoid to find wrong lock dep path in check_irq_usage()
	KVM: s390: get rid of register asm usage
	regulator: mt6358: Fix vdram2 .vsel_mask
	regulator: da9052: Ensure enough delay time for .set_voltage_time_sel
	media: Fix Media Controller API config checks
	ACPI: video: use native backlight for GA401/GA502/GA503
	HID: do not use down_interruptible() when unbinding devices
	EDAC/ti: Add missing MODULE_DEVICE_TABLE
	ACPI: processor idle: Fix up C-state latency if not ordered
	hv_utils: Fix passing zero to 'PTR_ERR' warning
	lib: vsprintf: Fix handling of number field widths in vsscanf
	Input: goodix - platform/x86: touchscreen_dmi - Move upside down quirks to touchscreen_dmi.c
	platform/x86: touchscreen_dmi: Add an extra entry for the upside down Goodix touchscreen on Teclast X89 tablets
	platform/x86: touchscreen_dmi: Add info for the Goodix GT912 panel of TM800A550L tablets
	ACPI: EC: Make more Asus laptops use ECDT _GPE
	block_dump: remove block_dump feature in mark_inode_dirty()
	blk-mq: grab rq->refcount before calling ->fn in blk_mq_tagset_busy_iter
	blk-mq: clear stale request in tags->rq[] before freeing one request pool
	fs: dlm: cancel work sync othercon
	random32: Fix implicit truncation warning in prandom_seed_state()
	open: don't silently ignore unknown O-flags in openat2()
	drivers: hv: Fix missing error code in vmbus_connect()
	fs: dlm: fix memory leak when fenced
	ACPICA: Fix memory leak caused by _CID repair function
	ACPI: bus: Call kobject_put() in acpi_init() error path
	ACPI: resources: Add checks for ACPI IRQ override
	block: fix race between adding/removing rq qos and normal IO
	platform/x86: asus-nb-wmi: Revert "Drop duplicate DMI quirk structures"
	platform/x86: asus-nb-wmi: Revert "add support for ASUS ROG Zephyrus G14 and G15"
	platform/x86: toshiba_acpi: Fix missing error code in toshiba_acpi_setup_keyboard()
	nvme-pci: fix var. type for increasing cq_head
	nvmet-fc: do not check for invalid target port in nvmet_fc_handle_fcp_rqst()
	EDAC/Intel: Do not load EDAC driver when running as a guest
	PCI: hv: Add check for hyperv_initialized in init_hv_pci_drv()
	cifs: improve fallocate emulation
	ACPI: EC: trust DSDT GPE for certain HP laptop
	clocksource: Retry clock read if long delays detected
	clocksource: Check per-CPU clock synchronization when marked unstable
	tpm_tis_spi: add missing SPI device ID entries
	ACPI: tables: Add custom DSDT file as makefile prerequisite
	HID: wacom: Correct base usage for capacitive ExpressKey status bits
	cifs: fix missing spinlock around update to ses->status
	mailbox: qcom: Use PLATFORM_DEVID_AUTO to register platform device
	block: fix discard request merge
	kthread_worker: fix return value when kthread_mod_delayed_work() races with kthread_cancel_delayed_work_sync()
	ia64: mca_drv: fix incorrect array size calculation
	writeback, cgroup: increment isw_nr_in_flight before grabbing an inode
	spi: Allow to have all native CSs in use along with GPIOs
	spi: Avoid undefined behaviour when counting unused native CSs
	media: venus: Rework error fail recover logic
	media: s5p_cec: decrement usage count if disabled
	media: hantro: do a PM resume earlier
	crypto: ixp4xx - dma_unmap the correct address
	crypto: ixp4xx - update IV after requests
	crypto: ux500 - Fix error return code in hash_hw_final()
	sata_highbank: fix deferred probing
	pata_rb532_cf: fix deferred probing
	media: I2C: change 'RST' to "RSET" to fix multiple build errors
	sched/uclamp: Fix wrong implementation of cpu.uclamp.min
	sched/uclamp: Fix locking around cpu_util_update_eff()
	kbuild: Fix objtool dependency for 'OBJECT_FILES_NON_STANDARD_<obj> := n'
	pata_octeon_cf: avoid WARN_ON() in ata_host_activate()
	evm: fix writing <securityfs>/evm overflow
	x86/elf: Use _BITUL() macro in UAPI headers
	crypto: sa2ul - Fix leaks on failure paths with sa_dma_init()
	crypto: sa2ul - Fix pm_runtime enable in sa_ul_probe()
	crypto: ccp - Fix a resource leak in an error handling path
	media: rc: i2c: Fix an error message
	pata_ep93xx: fix deferred probing
	locking/lockdep: Reduce LOCKDEP dependency list
	media: rkvdec: Fix .buf_prepare
	media: exynos4-is: Fix a use after free in isp_video_release
	media: au0828: fix a NULL vs IS_ERR() check
	media: tc358743: Fix error return code in tc358743_probe_of()
	media: gspca/gl860: fix zero-length control requests
	m68k: atari: Fix ATARI_KBD_CORE kconfig unmet dependency warning
	media: siano: Fix out-of-bounds warnings in smscore_load_firmware_family2()
	regulator: fan53880: Fix vsel_mask setting for FAN53880_BUCK
	crypto: nitrox - fix unchecked variable in nitrox_register_interrupts
	crypto: omap-sham - Fix PM reference leak in omap sham ops
	crypto: x86/curve25519 - fix cpu feature checking logic in mod_exit
	crypto: sm2 - remove unnecessary reset operations
	crypto: sm2 - fix a memory leak in sm2
	mmc: usdhi6rol0: fix error return code in usdhi6_probe()
	arm64: consistently use reserved_pg_dir
	arm64/mm: Fix ttbr0 values stored in struct thread_info for software-pan
	media: subdev: remove VIDIOC_DQEVENT_TIME32 handling
	media: s5p-g2d: Fix a memory leak on ctx->fh.m2m_ctx
	hwmon: (lm70) Use device_get_match_data()
	hwmon: (lm70) Revert "hwmon: (lm70) Add support for ACPI"
	hwmon: (max31722) Remove non-standard ACPI device IDs
	hwmon: (max31790) Fix fan speed reporting for fan7..12
	KVM: nVMX: Sync all PGDs on nested transition with shadow paging
	KVM: nVMX: Ensure 64-bit shift when checking VMFUNC bitmap
	KVM: nVMX: Don't clobber nested MMU's A/D status on EPTP switch
	KVM: x86/mmu: Fix return value in tdp_mmu_map_handle_target_level()
	perf/arm-cmn: Fix invalid pointer when access dtc object sharing the same IRQ number
	KVM: arm64: Don't zero the cycle count register when PMCR_EL0.P is set
	regulator: hi655x: Fix pass wrong pointer to config.driver_data
	btrfs: clear log tree recovering status if starting transaction fails
	x86/sev: Make sure IRQs are disabled while GHCB is active
	x86/sev: Split up runtime #VC handler for correct state tracking
	sched/rt: Fix RT utilization tracking during policy change
	sched/rt: Fix Deadline utilization tracking during policy change
	sched/uclamp: Fix uclamp_tg_restrict()
	lockdep: Fix wait-type for empty stack
	lockdep/selftests: Fix selftests vs PROVE_RAW_LOCK_NESTING
	spi: spi-sun6i: Fix chipselect/clock bug
	crypto: nx - Fix RCU warning in nx842_OF_upd_status
	psi: Fix race between psi_trigger_create/destroy
	media: v4l2-async: Clean v4l2_async_notifier_add_fwnode_remote_subdev
	media: video-mux: Skip dangling endpoints
	PM / devfreq: Add missing error code in devfreq_add_device()
	ACPI: PM / fan: Put fan device IDs into separate header file
	block: avoid double io accounting for flush request
	nvme-pci: look for StorageD3Enable on companion ACPI device instead
	ACPI: sysfs: Fix a buffer overrun problem with description_show()
	mark pstore-blk as broken
	clocksource/drivers/timer-ti-dm: Save and restore timer TIOCP_CFG
	extcon: extcon-max8997: Fix IRQ freeing at error path
	ACPI: APEI: fix synchronous external aborts in user-mode
	blk-wbt: introduce a new disable state to prevent false positive by rwb_enabled()
	blk-wbt: make sure throttle is enabled properly
	ACPI: Use DEVICE_ATTR_<RW|RO|WO> macros
	ACPI: bgrt: Fix CFI violation
	cpufreq: Make cpufreq_online() call driver->offline() on errors
	blk-mq: update hctx->dispatch_busy in case of real scheduler
	ocfs2: fix snprintf() checking
	dax: fix ENOMEM handling in grab_mapping_entry()
	mm/debug_vm_pgtable/basic: add validation for dirtiness after write protect
	mm/debug_vm_pgtable/basic: iterate over entire protection_map[]
	mm/debug_vm_pgtable: ensure THP availability via has_transparent_hugepage()
	swap: fix do_swap_page() race with swapoff
	mm/shmem: fix shmem_swapin() race with swapoff
	mm: memcg/slab: properly set up gfp flags for objcg pointer array
	mm: page_alloc: refactor setup_per_zone_lowmem_reserve()
	mm/page_alloc: fix counting of managed_pages
	xfrm: xfrm_state_mtu should return at least 1280 for ipv6
	drm/bridge/sii8620: fix dependency on extcon
	drm/bridge: Fix the stop condition of drm_bridge_chain_pre_enable()
	drm/amd/dc: Fix a missing check bug in dm_dp_mst_detect()
	drm/ast: Fix missing conversions to managed API
	video: fbdev: imxfb: Fix an error message
	net: mvpp2: Put fwnode in error case during ->probe()
	net: pch_gbe: Propagate error from devm_gpio_request_one()
	pinctrl: renesas: r8a7796: Add missing bias for PRESET# pin
	pinctrl: renesas: r8a77990: JTAG pins do not have pull-down capabilities
	drm/vmwgfx: Mark a surface gpu-dirty after the SVGA3dCmdDXGenMips command
	drm/vmwgfx: Fix cpu updates of coherent multisample surfaces
	net: qrtr: ns: Fix error return code in qrtr_ns_init()
	clk: meson: g12a: fix gp0 and hifi ranges
	net: ftgmac100: add missing error return code in ftgmac100_probe()
	drm: rockchip: set alpha_en to 0 if it is not used
	drm/rockchip: cdn-dp-core: add missing clk_disable_unprepare() on error in cdn_dp_grf_write()
	drm/rockchip: dsi: move all lane config except LCDC mux to bind()
	drm/rockchip: lvds: Fix an error handling path
	drm/rockchip: cdn-dp: fix sign extension on an int multiply for a u64 result
	mptcp: fix pr_debug in mptcp_token_new_connect
	mptcp: generate subflow hmac after mptcp_finish_join()
	RDMA/srp: Fix a recently introduced memory leak
	RDMA/rtrs-clt: Check state of the rtrs_clt_sess before reading its stats
	RDMA/rtrs: Do not reset hb_missed_max after re-connection
	RDMA/rtrs-srv: Fix memory leak of unfreed rtrs_srv_stats object
	RDMA/rtrs-srv: Fix memory leak when having multiple sessions
	RDMA/rtrs-clt: Check if the queue_depth has changed during a reconnection
	RDMA/rtrs-clt: Fix memory leak of not-freed sess->stats and stats->pcpu_stats
	ehea: fix error return code in ehea_restart_qps()
	clk: tegra30: Use 300MHz for video decoder by default
	xfrm: remove the fragment check for ipv6 beet mode
	net/sched: act_vlan: Fix modify to allow 0
	RDMA/core: Sanitize WQ state received from the userspace
	drm/pl111: depend on CONFIG_VEXPRESS_CONFIG
	RDMA/rxe: Fix failure during driver load
	drm/pl111: Actually fix CONFIG_VEXPRESS_CONFIG depends
	drm/vc4: hdmi: Fix error path of hpd-gpios
	clk: vc5: fix output disabling when enabling a FOD
	drm: qxl: ensure surf.data is ininitialized
	tools/bpftool: Fix error return code in do_batch()
	ath10k: go to path err_unsupported when chip id is not supported
	ath10k: add missing error return code in ath10k_pci_probe()
	wireless: carl9170: fix LEDS build errors & warnings
	ieee802154: hwsim: Fix possible memory leak in hwsim_subscribe_all_others
	clk: imx8mq: remove SYS PLL 1/2 clock gates
	wcn36xx: Move hal_buf allocation to devm_kmalloc in probe
	ssb: Fix error return code in ssb_bus_scan()
	brcmfmac: fix setting of station info chains bitmask
	brcmfmac: correctly report average RSSI in station info
	brcmfmac: Fix a double-free in brcmf_sdio_bus_reset
	brcmsmac: mac80211_if: Fix a resource leak in an error handling path
	cw1200: Revert unnecessary patches that fix unreal use-after-free bugs
	ath11k: Fix an error handling path in ath11k_core_fetch_board_data_api_n()
	ath10k: Fix an error code in ath10k_add_interface()
	ath11k: send beacon template after vdev_start/restart during csa
	netlabel: Fix memory leak in netlbl_mgmt_add_common
	RDMA/mlx5: Don't add slave port to unaffiliated list
	netfilter: nft_exthdr: check for IPv6 packet before further processing
	netfilter: nft_osf: check for TCP packet before further processing
	netfilter: nft_tproxy: restrict support to TCP and UDP transport protocols
	RDMA/rxe: Fix qp reference counting for atomic ops
	selftests/bpf: Whitelist test_progs.h from .gitignore
	xsk: Fix missing validation for skb and unaligned mode
	xsk: Fix broken Tx ring validation
	bpf: Fix libelf endian handling in resolv_btfids
	RDMA/rtrs-srv: Set minimal max_send_wr and max_recv_wr
	samples/bpf: Fix Segmentation fault for xdp_redirect command
	samples/bpf: Fix the error return code of xdp_redirect's main()
	mt76: fix possible NULL pointer dereference in mt76_tx
	mt76: mt7615: fix NULL pointer dereference in tx_prepare_skb()
	net: ethernet: aeroflex: fix UAF in greth_of_remove
	net: ethernet: ezchip: fix UAF in nps_enet_remove
	net: ethernet: ezchip: fix error handling
	vrf: do not push non-ND strict packets with a source LLA through packet taps again
	net: sched: add barrier to ensure correct ordering for lockless qdisc
	tls: prevent oversized sendfile() hangs by ignoring MSG_MORE
	netfilter: nf_tables_offload: check FLOW_DISSECTOR_KEY_BASIC in VLAN transfer logic
	pkt_sched: sch_qfq: fix qfq_change_class() error path
	xfrm: Fix xfrm offload fallback fail case
	iwlwifi: increase PNVM load timeout
	rtw88: 8822c: fix lc calibration timing
	vxlan: add missing rcu_read_lock() in neigh_reduce()
	ip6_tunnel: fix GRE6 segmentation
	net/ipv4: swap flow ports when validating source
	net: ti: am65-cpsw-nuss: Fix crash when changing number of TX queues
	tc-testing: fix list handling
	ieee802154: hwsim: Fix memory leak in hwsim_add_one
	ieee802154: hwsim: avoid possible crash in hwsim_del_edge_nl()
	bpf: Fix null ptr deref with mixed tail calls and subprogs
	drm/msm: Fix error return code in msm_drm_init()
	drm/msm/dpu: Fix error return code in dpu_mdss_init()
	mac80211: remove iwlwifi specific workaround NDPs of null_response
	net: bcmgenet: Fix attaching to PYH failed on RPi 4B
	ipv6: exthdrs: do not blindly use init_net
	can: j1939: j1939_sk_setsockopt(): prevent allocation of j1939 filter for optlen == 0
	bpf: Do not change gso_size during bpf_skb_change_proto()
	i40e: Fix error handling in i40e_vsi_open
	i40e: Fix autoneg disabling for non-10GBaseT links
	i40e: Fix missing rtnl locking when setting up pf switch
	Revert "ibmvnic: remove duplicate napi_schedule call in open function"
	ibmvnic: set ltb->buff to NULL after freeing
	ibmvnic: free tx_pool if tso_pool alloc fails
	RDMA/cma: Protect RMW with qp_mutex
	net: macsec: fix the length used to copy the key for offloading
	net: phy: mscc: fix macsec key length
	net: atlantic: fix the macsec key length
	ipv6: fix out-of-bound access in ip6_parse_tlv()
	e1000e: Check the PCIm state
	net: dsa: sja1105: fix NULL pointer dereference in sja1105_reload_cbs()
	bpfilter: Specify the log level for the kmsg message
	RDMA/cma: Fix incorrect Packet Lifetime calculation
	gve: Fix swapped vars when fetching max queues
	Revert "be2net: disable bh with spin_lock in be_process_mcc"
	Bluetooth: mgmt: Fix slab-out-of-bounds in tlv_data_is_valid
	Bluetooth: Fix not sending Set Extended Scan Response
	Bluetooth: Fix Set Extended (Scan Response) Data
	Bluetooth: Fix handling of HCI_LE_Advertising_Set_Terminated event
	clk: actions: Fix UART clock dividers on Owl S500 SoC
	clk: actions: Fix SD clocks factor table on Owl S500 SoC
	clk: actions: Fix bisp_factor_table based clocks on Owl S500 SoC
	clk: actions: Fix AHPPREDIV-H-AHB clock chain on Owl S500 SoC
	clk: qcom: clk-alpha-pll: fix CAL_L write in alpha_pll_fabia_prepare
	clk: si5341: Wait for DEVICE_READY on startup
	clk: si5341: Avoid divide errors due to bogus register contents
	clk: si5341: Check for input clock presence and PLL lock on startup
	clk: si5341: Update initialization magic
	writeback: fix obtain a reference to a freeing memcg css
	net: lwtunnel: handle MTU calculation in forwading
	net: sched: fix warning in tcindex_alloc_perfect_hash
	net: tipc: fix FB_MTU eat two pages
	RDMA/mlx5: Don't access NULL-cleared mpi pointer
	RDMA/core: Always release restrack object
	MIPS: Fix PKMAP with 32-bit MIPS huge page support
	staging: fbtft: Rectify GPIO handling
	staging: fbtft: Don't spam logs when probe is deferred
	ASoC: rt5682: Disable irq on shutdown
	rcu: Invoke rcu_spawn_core_kthreads() from rcu_spawn_gp_kthread()
	serial: fsl_lpuart: don't modify arbitrary data on lpuart32
	serial: fsl_lpuart: remove RTSCTS handling from get_mctrl()
	serial: 8250_omap: fix a timeout loop condition
	tty: nozomi: Fix a resource leak in an error handling function
	mwifiex: re-fix for unaligned accesses
	iio: adis_buffer: do not return ints in irq handlers
	iio: adis16400: do not return ints in irq handlers
	iio: adis16475: do not return ints in irq handlers
	iio: accel: bma180: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: accel: bma220: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: accel: hid: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: accel: kxcjk-1013: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: accel: mxc4005: Fix overread of data and alignment issue.
	iio: accel: stk8312: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: accel: stk8ba50: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: adc: ti-ads1015: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: adc: vf610: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: gyro: bmg160: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: humidity: am2315: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: prox: srf08: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: prox: pulsed-light: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: prox: as3935: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: magn: hmc5843: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: magn: bmc150: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: light: isl29125: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: light: tcs3414: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: light: tcs3472: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: chemical: atlas: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: cros_ec_sensors: Fix alignment of buffer in iio_push_to_buffers_with_timestamp()
	iio: potentiostat: lmp91000: Fix alignment of buffer in iio_push_to_buffers_with_timestamp()
	ASoC: rk3328: fix missing clk_disable_unprepare() on error in rk3328_platform_probe()
	ASoC: hisilicon: fix missing clk_disable_unprepare() on error in hi6210_i2s_startup()
	backlight: lm3630a_bl: Put fwnode in error case during ->probe()
	ASoC: rsnd: tidyup loop on rsnd_adg_clk_query()
	Input: hil_kbd - fix error return code in hil_dev_connect()
	perf scripting python: Fix tuple_set_u64()
	mtd: partitions: redboot: seek fis-index-block in the right node
	mtd: rawnand: arasan: Ensure proper configuration for the asserted target
	staging: mmal-vchiq: Fix incorrect static vchiq_instance.
	char: pcmcia: error out if 'num_bytes_read' is greater than 4 in set_protocol()
	firmware: stratix10-svc: Fix a resource leak in an error handling path
	tty: nozomi: Fix the error handling path of 'nozomi_card_init()'
	leds: class: The -ENOTSUPP should never be seen by user space
	leds: lm3532: select regmap I2C API
	leds: lm36274: Put fwnode in error case during ->probe()
	leds: lm3692x: Put fwnode in any case during ->probe()
	leds: lm3697: Don't spam logs when probe is deferred
	leds: lp50xx: Put fwnode in error case during ->probe()
	scsi: FlashPoint: Rename si_flags field
	scsi: iscsi: Flush block work before unblock
	mfd: mp2629: Select MFD_CORE to fix build error
	mfd: rn5t618: Fix IRQ trigger by changing it to level mode
	fsi: core: Fix return of error values on failures
	fsi: scom: Reset the FSI2PIB engine for any error
	fsi: occ: Don't accept response from un-initialized OCC
	fsi/sbefifo: Clean up correct FIFO when receiving reset request from SBE
	fsi/sbefifo: Fix reset timeout
	visorbus: fix error return code in visorchipset_init()
	iommu/amd: Fix extended features logging
	s390/irq: select HAVE_IRQ_EXIT_ON_IRQ_STACK
	s390: enable HAVE_IOREMAP_PROT
	s390: appldata depends on PROC_SYSCTL
	selftests: splice: Adjust for handler fallback removal
	iommu/dma: Fix IOVA reserve dma ranges
	ASoC: max98373-sdw: use first_hw_init flag on resume
	ASoC: rt1308-sdw: use first_hw_init flag on resume
	ASoC: rt5682-sdw: use first_hw_init flag on resume
	ASoC: rt700-sdw: use first_hw_init flag on resume
	ASoC: rt711-sdw: use first_hw_init flag on resume
	ASoC: rt715-sdw: use first_hw_init flag on resume
	ASoC: rt5682: fix getting the wrong device id when the suspend_stress_test
	ASoC: rt5682-sdw: set regcache_cache_only false before reading RT5682_DEVICE_ID
	ASoC: mediatek: mtk-btcvsd: Fix an error handling path in 'mtk_btcvsd_snd_probe()'
	usb: gadget: f_fs: Fix setting of device and driver data cross-references
	usb: dwc2: Don't reset the core after setting turnaround time
	eeprom: idt_89hpesx: Put fwnode in matching case during ->probe()
	eeprom: idt_89hpesx: Restore printing the unsupported fwnode name
	thunderbolt: Bond lanes only when dual_link_port != NULL in alloc_dev_default()
	iio: adc: at91-sama5d2: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: adc: hx711: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: adc: mxs-lradc: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: adc: ti-ads8688: Fix alignment of buffer in iio_push_to_buffers_with_timestamp()
	iio: magn: rm3100: Fix alignment of buffer in iio_push_to_buffers_with_timestamp()
	iio: light: vcnl4000: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	ASoC: fsl_spdif: Fix error handler with pm_runtime_enable
	staging: gdm724x: check for buffer overflow in gdm_lte_multi_sdu_pkt()
	staging: gdm724x: check for overflow in gdm_lte_netif_rx()
	staging: rtl8712: fix error handling in r871xu_drv_init
	staging: rtl8712: fix memory leak in rtl871x_load_fw_cb
	coresight: core: Fix use of uninitialized pointer
	staging: mt7621-dts: fix pci address for PCI memory range
	serial: 8250: Actually allow UPF_MAGIC_MULTIPLIER baud rates
	iio: light: vcnl4035: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: prox: isl29501: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	ASoC: cs42l42: Correct definition of CS42L42_ADC_PDN_MASK
	of: Fix truncation of memory sizes on 32-bit platforms
	mtd: rawnand: marvell: add missing clk_disable_unprepare() on error in marvell_nfc_resume()
	habanalabs: Fix an error handling path in 'hl_pci_probe()'
	scsi: mpt3sas: Fix error return value in _scsih_expander_add()
	soundwire: stream: Fix test for DP prepare complete
	phy: uniphier-pcie: Fix updating phy parameters
	phy: ti: dm816x: Fix the error handling path in 'dm816x_usb_phy_probe()
	extcon: sm5502: Drop invalid register write in sm5502_reg_data
	extcon: max8997: Add missing modalias string
	powerpc/powernv: Fix machine check reporting of async store errors
	ASoC: atmel-i2s: Fix usage of capture and playback at the same time
	configfs: fix memleak in configfs_release_bin_file
	ASoC: Intel: sof_sdw: add SOF_RT715_DAI_ID_FIX for AlderLake
	ASoC: fsl_spdif: Fix unexpected interrupt after suspend
	leds: as3645a: Fix error return code in as3645a_parse_node()
	leds: ktd2692: Fix an error handling path
	selftests/ftrace: fix event-no-pid on 1-core machine
	serial: 8250: 8250_omap: Disable RX interrupt after DMA enable
	serial: 8250: 8250_omap: Fix possible interrupt storm on K3 SoCs
	powerpc: Offline CPU in stop_this_cpu()
	powerpc/papr_scm: Properly handle UUID types and API
	powerpc/64s: Fix copy-paste data exposure into newly created tasks
	powerpc/papr_scm: Make 'perf_stats' invisible if perf-stats unavailable
	ALSA: firewire-lib: Fix 'amdtp_domain_start()' when no AMDTP_OUT_STREAM stream is found
	serial: mvebu-uart: do not allow changing baudrate when uartclk is not available
	serial: mvebu-uart: correctly calculate minimal possible baudrate
	arm64: dts: marvell: armada-37xx: Fix reg for standard variant of UART
	vfio/pci: Handle concurrent vma faults
	mm/pmem: avoid inserting hugepage PTE entry with fsdax if hugepage support is disabled
	mm/huge_memory.c: remove dedicated macro HPAGE_CACHE_INDEX_MASK
	mm/huge_memory.c: add missing read-only THP checking in transparent_hugepage_enabled()
	mm/huge_memory.c: don't discard hugepage if other processes are mapping it
	mm/hugetlb: use helper huge_page_order and pages_per_huge_page
	mm/hugetlb: remove redundant check in preparing and destroying gigantic page
	hugetlb: remove prep_compound_huge_page cleanup
	include/linux/huge_mm.h: remove extern keyword
	mm/z3fold: fix potential memory leak in z3fold_destroy_pool()
	mm/z3fold: use release_z3fold_page_locked() to release locked z3fold page
	lib/math/rational.c: fix divide by zero
	selftests/vm/pkeys: fix alloc_random_pkey() to make it really, really random
	selftests/vm/pkeys: handle negative sys_pkey_alloc() return code
	selftests/vm/pkeys: refill shadow register after implicit kernel write
	perf llvm: Return -ENOMEM when asprintf() fails
	csky: fix syscache.c fallthrough warning
	csky: syscache: Fixup duplicate cache flush
	exfat: handle wrong stream entry size in exfat_readdir()
	scsi: fc: Correct RHBA attributes length
	scsi: target: cxgbit: Unmap DMA buffer before calling target_execute_cmd()
	mailbox: qcom-ipcc: Fix IPCC mbox channel exhaustion
	fscrypt: don't ignore minor_hash when hash is 0
	fscrypt: fix derivation of SipHash keys on big endian CPUs
	tpm: Replace WARN_ONCE() with dev_err_once() in tpm_tis_status()
	erofs: fix error return code in erofs_read_superblock()
	block: return the correct bvec when checking for gaps
	io_uring: fix blocking inline submission
	mmc: block: Disable CMDQ on the ioctl path
	mmc: vub3000: fix control-request direction
	media: exynos4-is: remove a now unused integer
	scsi: core: Retry I/O for Notify (Enable Spinup) Required error
	crypto: qce - fix error return code in qce_skcipher_async_req_handle()
	s390: preempt: Fix preempt_count initialization
	cred: add missing return error code when set_cred_ucounts() failed
	iommu/dma: Fix compile warning in 32-bit builds
	powerpc/preempt: Don't touch the idle task's preempt_count during hotplug
	Linux 5.10.50

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Iec4eab24ea8eb5a6d79739a1aec8432d93a8f82c
2021-07-14 17:35:23 +02:00
Pablo Neira Ayuso
b2ce4ebdd9 netfilter: nf_tables_offload: check FLOW_DISSECTOR_KEY_BASIC in VLAN transfer logic
[ Upstream commit ea45fdf82c ]

The VLAN transfer logic should actually check for
FLOW_DISSECTOR_KEY_BASIC, not FLOW_DISSECTOR_KEY_CONTROL. Moreover, do
not fallback to case 2) .n_proto is set to 802.1q or 802.1ad, if
FLOW_DISSECTOR_KEY_BASIC is unset.

Fixes: 783003f3bb ("netfilter: nftables_offload: special ethertype handling for VLAN")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-07-14 16:56:24 +02:00
Pablo Neira Ayuso
58da10487a netfilter: nft_tproxy: restrict support to TCP and UDP transport protocols
[ Upstream commit 52f0f4e178 ]

Add unfront check for TCP and UDP packets before performing further
processing.

Fixes: 4ed8eb6570 ("netfilter: nf_tables: Add native tproxy support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-07-14 16:56:22 +02:00
Pablo Neira Ayuso
ed3d498834 netfilter: nft_osf: check for TCP packet before further processing
[ Upstream commit 8f518d43f8 ]

The osf expression only supports for TCP packets, add a upfront sanity
check to skip packet parsing if this is not a TCP packet.

Fixes: b96af92d6e ("netfilter: nf_tables: implement Passive OS fingerprint module in nft_osf")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-07-14 16:56:22 +02:00
Pablo Neira Ayuso
cf28cb51f0 netfilter: nft_exthdr: check for IPv6 packet before further processing
[ Upstream commit cdd73cc545 ]

ipv6_find_hdr() does not validate that this is an IPv6 packet. Add a
sanity check for calling ipv6_find_hdr() to make sure an IPv6 packet
is passed for parsing.

Fixes: 96518518cc ("netfilter: add nftables")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-07-14 16:56:22 +02:00
Greg Kroah-Hartman
948d38f94d This is the 5.10.46 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmDTLFUACgkQONu9yGCS
 aT5eThAApQAh1A++P729NJOTeoewU5YH0/1c+ZVN4nfxxEOApeBpfA4tTDvfHJeI
 MYx10AI1UiLPHfLtHI5exvG00/Ll4lb0fs2bpVL2b/SQKCm2G3kZf7xOdJOBtoy4
 DEaTORhmZ001weapZN+G4oz+FEnNZEyR/rThqKTA0G/PS1MxNl4ZBhY9BrySpH1V
 Cq7OFX18IbTh3/XXmcPotZa2sXE6Z+jjWQb5GLZ+ZjicbzgLiWWcnrm8bzLahVC4
 N7TToeGv9zOLKgrE+HVR52UoFB1+2vRUEaRVOiFbDViLjoF5KWw5rAzioTCvfXW+
 g/ldoAuDQBNGUrYfVUrSNwj5JuWCI2Cltt//9f/xGfPPn0HNjAxSM7ExpnMNVhVK
 1gjTco+0kWzv2BGjgpNAe7+aLka5sQkLEOYlSExI6VVuF5CCcIywWjWZ6zHG0CF1
 7kW8CfINV4BFP+IYw5Gnt5K3hUTulDt+alX9WgsdPxpsZ9gbIscO1/awnRrAyDyO
 2EeCbZ3WWSuvFL6qAjJERiDbhDPRaZV0cwGPxzLZ7NN8ZPXLxTVv7Nc6QoiNXYkk
 E+LYcMua9dxFXjoHA0imKxlxqJD64mh3oUkdpTGOwIxrE5bavnKGrO2B3Nl7zWVn
 u8mazeKHWpJ+t+dDZ47CjrNTul0SOvryKmog//DCkvAIYSjRzVc=
 =WRWw
 -----END PGP SIGNATURE-----

Merge 5.10.46 into android12-5.10-lts

Changes in 5.10.46
	dmaengine: idxd: add missing dsa driver unregister
	dmaengine: fsl-dpaa2-qdma: Fix error return code in two functions
	dmaengine: xilinx: dpdma: initialize registers before request_irq
	dmaengine: ALTERA_MSGDMA depends on HAS_IOMEM
	dmaengine: QCOM_HIDMA_MGMT depends on HAS_IOMEM
	dmaengine: SF_PDMA depends on HAS_IOMEM
	dmaengine: stedma40: add missing iounmap() on error in d40_probe()
	afs: Fix an IS_ERR() vs NULL check
	mm/memory-failure: make sure wait for page writeback in memory_failure
	kvm: LAPIC: Restore guard to prevent illegal APIC register access
	fanotify: fix copy_event_to_user() fid error clean up
	batman-adv: Avoid WARN_ON timing related checks
	mac80211: fix skb length check in ieee80211_scan_rx()
	mlxsw: reg: Spectrum-3: Enforce lowest max-shaper burst size of 11
	mlxsw: core: Set thermal zone polling delay argument to real value at init
	libbpf: Fixes incorrect rx_ring_setup_done
	net: ipv4: fix memory leak in netlbl_cipsov4_add_std
	vrf: fix maximum MTU
	net: rds: fix memory leak in rds_recvmsg
	net: dsa: felix: re-enable TX flow control in ocelot_port_flush()
	net: lantiq: disable interrupt before sheduling NAPI
	netfilter: nft_fib_ipv6: skip ipv6 packets from any to link-local
	ice: add ndo_bpf callback for safe mode netdev ops
	ice: parameterize functions responsible for Tx ring management
	udp: fix race between close() and udp_abort()
	rtnetlink: Fix regression in bridge VLAN configuration
	net/sched: act_ct: handle DNAT tuple collision
	net/mlx5e: Remove dependency in IPsec initialization flows
	net/mlx5e: Fix page reclaim for dead peer hairpin
	net/mlx5: Consider RoCE cap before init RDMA resources
	net/mlx5: DR, Allow SW steering for sw_owner_v2 devices
	net/mlx5: DR, Don't use SW steering when RoCE is not supported
	net/mlx5e: Block offload of outer header csum for UDP tunnels
	netfilter: synproxy: Fix out of bounds when parsing TCP options
	mptcp: Fix out of bounds when parsing TCP options
	sch_cake: Fix out of bounds when parsing TCP options and header
	mptcp: try harder to borrow memory from subflow under pressure
	mptcp: do not warn on bad input from the network
	selftests: mptcp: enable syncookie only in absence of reorders
	alx: Fix an error handling path in 'alx_probe()'
	cxgb4: fix endianness when flashing boot image
	cxgb4: fix sleep in atomic when flashing PHY firmware
	cxgb4: halt chip before flashing PHY firmware image
	net: stmmac: dwmac1000: Fix extended MAC address registers definition
	net: make get_net_ns return error if NET_NS is disabled
	net: qualcomm: rmnet: Update rmnet device MTU based on real device
	net: qualcomm: rmnet: don't over-count statistics
	ethtool: strset: fix message length calculation
	qlcnic: Fix an error handling path in 'qlcnic_probe()'
	netxen_nic: Fix an error handling path in 'netxen_nic_probe()'
	cxgb4: fix wrong ethtool n-tuple rule lookup
	ipv4: Fix device used for dst_alloc with local routes
	net: qrtr: fix OOB Read in qrtr_endpoint_post
	bpf: Fix leakage under speculation on mispredicted branches
	ptp: improve max_adj check against unreasonable values
	net: cdc_ncm: switch to eth%d interface naming
	lantiq: net: fix duplicated skb in rx descriptor ring
	net: usb: fix possible use-after-free in smsc75xx_bind
	net: fec_ptp: fix issue caused by refactor the fec_devtype
	net: ipv4: fix memory leak in ip_mc_add1_src
	net/af_unix: fix a data-race in unix_dgram_sendmsg / unix_release_sock
	net/mlx5: E-Switch, Read PF mac address
	net/mlx5: E-Switch, Allow setting GUID for host PF vport
	net/mlx5: Reset mkey index on creation
	be2net: Fix an error handling path in 'be_probe()'
	net: hamradio: fix memory leak in mkiss_close
	net: cdc_eem: fix tx fixup skb leak
	cxgb4: fix wrong shift.
	bnxt_en: Rediscover PHY capabilities after firmware reset
	bnxt_en: Fix TQM fastpath ring backing store computation
	bnxt_en: Call bnxt_ethtool_free() in bnxt_init_one() error path
	icmp: don't send out ICMP messages with a source address of 0.0.0.0
	net: ethernet: fix potential use-after-free in ec_bhf_remove
	regulator: cros-ec: Fix error code in dev_err message
	regulator: bd70528: Fix off-by-one for buck123 .n_voltages setting
	platform/x86: thinkpad_acpi: Add X1 Carbon Gen 9 second fan support
	ASoC: rt5659: Fix the lost powers for the HDA header
	phy: phy-mtk-tphy: Fix some resource leaks in mtk_phy_init()
	ASoC: fsl-asoc-card: Set .owner attribute when registering card.
	regulator: rtmv20: Fix to make regcache value first reading back from HW
	spi: spi-zynq-qspi: Fix some wrong goto jumps & missing error code
	sched/pelt: Ensure that *_sum is always synced with *_avg
	ASoC: tas2562: Fix TDM_CFG0_SAMPRATE values
	spi: stm32-qspi: Always wait BUSY bit to be cleared in stm32_qspi_wait_cmd()
	regulator: rt4801: Fix NULL pointer dereference if priv->enable_gpios is NULL
	ASoC: rt5682: Fix the fast discharge for headset unplugging in soundwire mode
	pinctrl: ralink: rt2880: avoid to error in calls is pin is already enabled
	drm/sun4i: dw-hdmi: Make HDMI PHY into a platform device
	ASoC: qcom: lpass-cpu: Fix pop noise during audio capture begin
	radeon: use memcpy_to/fromio for UVD fw upload
	hwmon: (scpi-hwmon) shows the negative temperature properly
	mm: relocate 'write_protect_seq' in struct mm_struct
	irqchip/gic-v3: Workaround inconsistent PMR setting on NMI entry
	bpf: Inherit expanded/patched seen count from old aux data
	bpf: Do not mark insn as seen under speculative path verification
	can: bcm: fix infoleak in struct bcm_msg_head
	can: bcm/raw/isotp: use per module netdevice notifier
	can: j1939: fix Use-after-Free, hold skb ref while in use
	can: mcba_usb: fix memory leak in mcba_usb
	usb: core: hub: Disable autosuspend for Cypress CY7C65632
	usb: chipidea: imx: Fix Battery Charger 1.2 CDP detection
	tracing: Do not stop recording cmdlines when tracing is off
	tracing: Do not stop recording comms if the trace file is being read
	tracing: Do no increment trace_clock_global() by one
	PCI: Mark TI C667X to avoid bus reset
	PCI: Mark some NVIDIA GPUs to avoid bus reset
	PCI: aardvark: Fix kernel panic during PIO transfer
	PCI: Add ACS quirk for Broadcom BCM57414 NIC
	PCI: Work around Huawei Intelligent NIC VF FLR erratum
	KVM: x86: Immediately reset the MMU context when the SMM flag is cleared
	KVM: x86/mmu: Calculate and check "full" mmu_role for nested MMU
	KVM: X86: Fix x86_emulator slab cache leak
	s390/mcck: fix calculation of SIE critical section size
	s390/ap: Fix hanging ioctl caused by wrong msg counter
	ARCv2: save ABI registers across signal handling
	x86/mm: Avoid truncating memblocks for SGX memory
	x86/process: Check PF_KTHREAD and not current->mm for kernel threads
	x86/ioremap: Map EFI-reserved memory as encrypted for SEV
	x86/pkru: Write hardware init value to PKRU when xstate is init
	x86/fpu: Prevent state corruption in __fpu__restore_sig()
	x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
	x86/fpu: Reset state for all signal restore failures
	crash_core, vmcoreinfo: append 'SECTION_SIZE_BITS' to vmcoreinfo
	dmaengine: pl330: fix wrong usage of spinlock flags in dma_cyclc
	mac80211: Fix NULL ptr deref for injected rate info
	cfg80211: make certificate generation more robust
	cfg80211: avoid double free of PMSR request
	drm/amdgpu/gfx10: enlarge CP_MEC_DOORBELL_RANGE_UPPER to cover full doorbell.
	drm/amdgpu/gfx9: fix the doorbell missing when in CGPG issue.
	net: ll_temac: Make sure to free skb when it is completely used
	net: ll_temac: Fix TX BD buffer overwrite
	net: bridge: fix vlan tunnel dst null pointer dereference
	net: bridge: fix vlan tunnel dst refcnt when egressing
	mm/swap: fix pte_same_as_swp() not removing uffd-wp bit when compare
	mm/slub: clarify verification reporting
	mm/slub: fix redzoning for small allocations
	mm/slub: actually fix freelist pointer vs redzoning
	mm/slub.c: include swab.h
	net: stmmac: disable clocks in stmmac_remove_config_dt()
	net: fec_ptp: add clock rate zero check
	tools headers UAPI: Sync linux/in.h copy with the kernel sources
	perf beauty: Update copy of linux/socket.h with the kernel sources
	usb: dwc3: debugfs: Add and remove endpoint dirs dynamically
	usb: dwc3: core: fix kernel panic when do reboot
	Linux 5.10.46

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I99f37c9f257f90ccdb091306f3d4cfb7c32e3880
2021-06-23 17:53:08 +02:00
Maxim Mikityanskiy
9cdf299ba4 netfilter: synproxy: Fix out of bounds when parsing TCP options
[ Upstream commit 5fc177ab75 ]

The TCP option parser in synproxy (synproxy_parse_options) could read
one byte out of bounds. When the length is 1, the execution flow gets
into the loop, reads one byte of the opcode, and if the opcode is
neither TCPOPT_EOL nor TCPOPT_NOP, it reads one more byte, which exceeds
the length of 1.

This fix is inspired by commit 9609dad263 ("ipv4: tcp_input: fix stack
out of bounds when parsing TCP options.").

v2 changes:

Added an early return when length < 0 to avoid calling
skb_header_pointer with negative length.

Cc: Young Xiao <92siuyang@gmail.com>
Fixes: 48b1de4c11 ("netfilter: add SYNPROXY core/target")
Signed-off-by: Maxim Mikityanskiy <maximmi@nvidia.com>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-06-23 14:42:43 +02:00
Maciej Żenczykowski
e6c0526092 ANDROID: minor fixups of xt_IDLETIMER support
Add missing newline termination to a bunch of pr_debug()/pr_err()

Test: builds, and kernel net tests passes
Bug: 183485987
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I53eccc88c383259bc7a71ea688f728a0908fa765
2021-06-17 17:44:38 +00:00
Greg Kroah-Hartman
9e08e97ec6 Merge 5.10.43 into android12-5.10
Changes in 5.10.43
	btrfs: tree-checker: do not error out if extent ref hash doesn't match
	net: usb: cdc_ncm: don't spew notifications
	hwmon: (dell-smm-hwmon) Fix index values
	hwmon: (pmbus/isl68137) remove READ_TEMPERATURE_3 for RAA228228
	netfilter: conntrack: unregister ipv4 sockopts on error unwind
	efi/fdt: fix panic when no valid fdt found
	efi: Allow EFI_MEMORY_XP and EFI_MEMORY_RO both to be cleared
	efi/libstub: prevent read overflow in find_file_option()
	efi: cper: fix snprintf() use in cper_dimm_err_location()
	vfio/pci: Fix error return code in vfio_ecap_init()
	vfio/pci: zap_vma_ptes() needs MMU
	samples: vfio-mdev: fix error handing in mdpy_fb_probe()
	vfio/platform: fix module_put call in error flow
	ipvs: ignore IP_VS_SVC_F_HASHED flag when adding service
	HID: logitech-hidpp: initialize level variable
	HID: pidff: fix error return code in hid_pidff_init()
	HID: i2c-hid: fix format string mismatch
	devlink: Correct VIRTUAL port to not have phys_port attributes
	net/sched: act_ct: Offload connections with commit action
	net/sched: act_ct: Fix ct template allocation for zone 0
	mptcp: always parse mptcp options for MPC reqsk
	nvme-rdma: fix in-casule data send for chained sgls
	ACPICA: Clean up context mutex during object deletion
	perf probe: Fix NULL pointer dereference in convert_variable_location()
	net: dsa: tag_8021q: fix the VLAN IDs used for encoding sub-VLANs
	net: sock: fix in-kernel mark setting
	net/tls: Replace TLS_RX_SYNC_RUNNING with RCU
	net/tls: Fix use-after-free after the TLS device goes down and up
	net/mlx5e: Fix incompatible casting
	net/mlx5: Check firmware sync reset requested is set before trying to abort it
	net/mlx5e: Check for needed capability for cvlan matching
	net/mlx5: DR, Create multi-destination flow table with level less than 64
	nvmet: fix freeing unallocated p2pmem
	netfilter: nft_ct: skip expectations for confirmed conntrack
	netfilter: nfnetlink_cthelper: hit EBUSY on updates if size mismatches
	drm/i915/selftests: Fix return value check in live_breadcrumbs_smoketest()
	bpf: Simplify cases in bpf_base_func_proto
	bpf, lockdown, audit: Fix buggy SELinux lockdown permission checks
	ieee802154: fix error return code in ieee802154_add_iface()
	ieee802154: fix error return code in ieee802154_llsec_getparams()
	igb: add correct exception tracing for XDP
	ixgbevf: add correct exception tracing for XDP
	cxgb4: fix regression with HASH tc prio value update
	ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptions
	ice: Fix allowing VF to request more/less queues via virtchnl
	ice: Fix VFR issues for AVF drivers that expect ATQLEN cleared
	ice: handle the VF VSI rebuild failure
	ice: report supported and advertised autoneg using PHY capabilities
	ice: Allow all LLDP packets from PF to Tx
	i2c: qcom-geni: Add shutdown callback for i2c
	cxgb4: avoid link re-train during TC-MQPRIO configuration
	i40e: optimize for XDP_REDIRECT in xsk path
	i40e: add correct exception tracing for XDP
	ice: simplify ice_run_xdp
	ice: optimize for XDP_REDIRECT in xsk path
	ice: add correct exception tracing for XDP
	ixgbe: optimize for XDP_REDIRECT in xsk path
	ixgbe: add correct exception tracing for XDP
	arm64: dts: ti: j7200-main: Mark Main NAVSS as dma-coherent
	optee: use export_uuid() to copy client UUID
	bus: ti-sysc: Fix am335x resume hang for usb otg module
	arm64: dts: ls1028a: fix memory node
	arm64: dts: zii-ultra: fix 12V_MAIN voltage
	arm64: dts: freescale: sl28: var4: fix RGMII clock and voltage
	ARM: dts: imx7d-meerkat96: Fix the 'tuning-step' property
	ARM: dts: imx7d-pico: Fix the 'tuning-step' property
	ARM: dts: imx: emcon-avari: Fix nxp,pca8574 #gpio-cells
	bus: ti-sysc: Fix flakey idling of uarts and stop using swsup_sidle_act
	tipc: add extack messages for bearer/media failure
	tipc: fix unique bearer names sanity check
	serial: stm32: fix threaded interrupt handling
	riscv: vdso: fix and clean-up Makefile
	io_uring: fix link timeout refs
	io_uring: use better types for cflags
	drm/amdgpu/vcn3: add cancel_delayed_work_sync before power gate
	drm/amdgpu/jpeg2.5: add cancel_delayed_work_sync before power gate
	drm/amdgpu/jpeg3: add cancel_delayed_work_sync before power gate
	Bluetooth: fix the erroneous flush_work() order
	Bluetooth: use correct lock to prevent UAF of hdev object
	wireguard: do not use -O3
	wireguard: peer: allocate in kmem_cache
	wireguard: use synchronize_net rather than synchronize_rcu
	wireguard: selftests: remove old conntrack kconfig value
	wireguard: selftests: make sure rp_filter is disabled on vethc
	wireguard: allowedips: initialize list head in selftest
	wireguard: allowedips: remove nodes in O(1)
	wireguard: allowedips: allocate nodes in kmem_cache
	wireguard: allowedips: free empty intermediate nodes when removing single node
	net: caif: added cfserl_release function
	net: caif: add proper error handling
	net: caif: fix memory leak in caif_device_notify
	net: caif: fix memory leak in cfusbl_device_notify
	HID: i2c-hid: Skip ELAN power-on command after reset
	HID: magicmouse: fix NULL-deref on disconnect
	HID: multitouch: require Finger field to mark Win8 reports as MT
	gfs2: fix scheduling while atomic bug in glocks
	ALSA: timer: Fix master timer notification
	ALSA: hda: Fix for mute key LED for HP Pavilion 15-CK0xx
	ALSA: hda: update the power_state during the direct-complete
	ARM: dts: imx6dl-yapp4: Fix RGMII connection to QCA8334 switch
	ARM: dts: imx6q-dhcom: Add PU,VDD1P1,VDD2P5 regulators
	ext4: fix memory leak in ext4_fill_super
	ext4: fix bug on in ext4_es_cache_extent as ext4_split_extent_at failed
	ext4: fix fast commit alignment issues
	ext4: fix memory leak in ext4_mb_init_backend on error path.
	ext4: fix accessing uninit percpu counter variable with fast_commit
	usb: dwc2: Fix build in periphal-only mode
	pid: take a reference when initializing `cad_pid`
	ocfs2: fix data corruption by fallocate
	mm/debug_vm_pgtable: fix alignment for pmd/pud_advanced_tests()
	mm/page_alloc: fix counting of free pages after take off from buddy
	x86/cpufeatures: Force disable X86_FEATURE_ENQCMD and remove update_pasid()
	x86/sev: Check SME/SEV support in CPUID first
	nfc: fix NULL ptr dereference in llcp_sock_getname() after failed connect
	drm/amdgpu: Don't query CE and UE errors
	drm/amdgpu: make sure we unpin the UVD BO
	x86/apic: Mark _all_ legacy interrupts when IO/APIC is missing
	powerpc/kprobes: Fix validation of prefixed instructions across page boundary
	btrfs: mark ordered extent and inode with error if we fail to finish
	btrfs: fix error handling in btrfs_del_csums
	btrfs: return errors from btrfs_del_csums in cleanup_ref_head
	btrfs: fixup error handling in fixup_inode_link_counts
	btrfs: abort in rename_exchange if we fail to insert the second ref
	btrfs: fix deadlock when cloning inline extents and low on available space
	mm, hugetlb: fix simple resv_huge_pages underflow on UFFDIO_COPY
	drm/msm/dpu: always use mdp device to scale bandwidth
	btrfs: fix unmountable seed device after fstrim
	KVM: SVM: Truncate GPR value for DR and CR accesses in !64-bit mode
	KVM: arm64: Fix debug register indexing
	x86/kvm: Teardown PV features on boot CPU as well
	x86/kvm: Disable kvmclock on all CPUs on shutdown
	x86/kvm: Disable all PV features on crash
	lib/lz4: explicitly support in-place decompression
	i2c: qcom-geni: Suspend and resume the bus during SYSTEM_SLEEP_PM ops
	netfilter: nf_tables: missing error reporting for not selected expressions
	xen-netback: take a reference to the RX task thread
	neighbour: allow NUD_NOARP entries to be forced GCed
	Linux 5.10.43

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I8d7ec0878193e4e454076809b7fb71fcc4e3d810
2021-06-12 14:48:14 +02:00
Maciej Żenczykowski
3871aa16fd ANDROID: core of xt_IDLETIMER send_nl_msg support
This was reverted in ee6918c6f7 due to
conflicts with upstream, and this attempts to reapply the majority
of that change in an upstream compatible fashion.

Test: builds, and kernel net tests passes, booted on phone,
  but no real testing
Bug: 183485987
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I0fa1da3cb38d37c6888444dc36d49e6d1828a855
2021-06-11 14:54:24 +00:00
Maciej Żenczykowski
b4355a880a ANDROID: start to re-add xt_IDLETIMER send_nl_msg support
This was reverted in ee6918c6f7 due to conflicts with
upstream, this first patch is just the minimum necessary to make the netfilter
IDLETIMER target with --send_nl_msg load successfully:

  phone-5.10:/ # iptables-save | egrep IDLETIMER
  -A idletimer_raw_PREROUTING -i rmnet0 -j IDLETIMER --timeout 10 --label 0 --send_nl_msg
  -A idletimer_mangle_POSTROUTING -o rmnet0 -j IDLETIMER --timeout 10 --label 0 --send_nl_msg
  phone-5.10:/ # ip6tables-save | egrep IDLETIMER
  -A idletimer_raw_PREROUTING -i rmnet0 -j IDLETIMER --timeout 10 --label 0 --send_nl_msg
  -A idletimer_mangle_POSTROUTING -o rmnet0 -j IDLETIMER --timeout 10 --label 0 --send_nl_msg

Test: builds, and kernel net tests passes, booted on phone, observed ip{,6}tables loading rules
Bug: 183485987
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I1fe2c4e41a092cc82c3d6d49d1217798b2728bcb
2021-06-11 14:54:06 +00:00
Pablo Neira Ayuso
316de9a88c netfilter: nf_tables: missing error reporting for not selected expressions
commit c781471d67 upstream.

Sometimes users forget to turn on nftables extensions from Kconfig that
they need. In such case, the error reporting from userspace is
misleading:

 $ sudo nft add rule x y counter
 Error: Could not process rule: No such file or directory
 add rule x y counter
 ^^^^^^^^^^^^^^^^^^^^

Add missing NL_SET_BAD_ATTR() to provide a hint:

 $ nft add rule x y counter
 Error: Could not process rule: No such file or directory
 add rule x y counter
              ^^^^^^^

Fixes: 83d9dcba06 ("netfilter: nf_tables: extended netlink error reporting for expressions")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-06-10 13:39:29 +02:00
Pablo Neira Ayuso
8d614eebc0 netfilter: nfnetlink_cthelper: hit EBUSY on updates if size mismatches
[ Upstream commit 8971ee8b08 ]

The private helper data size cannot be updated. However, updates that
contain NFCTH_PRIV_DATA_LEN might bogusly hit EBUSY even if the size is
the same.

Fixes: 12f7a50533 ("netfilter: add user-space connection tracking helper infrastructure")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-06-10 13:39:19 +02:00
Pablo Neira Ayuso
5f3429c05e netfilter: nft_ct: skip expectations for confirmed conntrack
[ Upstream commit 1710eb913b ]

nft_ct_expect_obj_eval() calls nf_ct_ext_add() for a confirmed
conntrack entry. However, nf_ct_ext_add() can only be called for
!nf_ct_is_confirmed().

[ 1825.349056] WARNING: CPU: 0 PID: 1279 at net/netfilter/nf_conntrack_extend.c:48 nf_ct_xt_add+0x18e/0x1a0 [nf_conntrack]
[ 1825.351391] RIP: 0010:nf_ct_ext_add+0x18e/0x1a0 [nf_conntrack]
[ 1825.351493] Code: 41 5c 41 5d 41 5e 41 5f c3 41 bc 0a 00 00 00 e9 15 ff ff ff ba 09 00 00 00 31 f6 4c 89 ff e8 69 6c 3d e9 eb 96 45 31 ed eb cd <0f> 0b e9 b1 fe ff ff e8 86 79 14 e9 eb bf 0f 1f 40 00 0f 1f 44 00
[ 1825.351721] RSP: 0018:ffffc90002e1f1e8 EFLAGS: 00010202
[ 1825.351790] RAX: 000000000000000e RBX: ffff88814f5783c0 RCX: ffffffffc0e4f887
[ 1825.351881] RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffff88814f578440
[ 1825.351971] RBP: 0000000000000000 R08: 0000000000000000 R09: ffff88814f578447
[ 1825.352060] R10: ffffed1029eaf088 R11: 0000000000000001 R12: ffff88814f578440
[ 1825.352150] R13: ffff8882053f3a00 R14: 0000000000000000 R15: 0000000000000a20
[ 1825.352240] FS:  00007f992261c900(0000) GS:ffff889faec00000(0000) knlGS:0000000000000000
[ 1825.352343] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1825.352417] CR2: 000056070a4d1158 CR3: 000000015efe0000 CR4: 0000000000350ee0
[ 1825.352508] Call Trace:
[ 1825.352544]  nf_ct_helper_ext_add+0x10/0x60 [nf_conntrack]
[ 1825.352641]  nft_ct_expect_obj_eval+0x1b8/0x1e0 [nft_ct]
[ 1825.352716]  nft_do_chain+0x232/0x850 [nf_tables]

Add the ct helper extension only for unconfirmed conntrack. Skip rule
evaluation if the ct helper extension does not exist. Thus, you can
only create expectations from the first packet.

It should be possible to remove this limitation by adding a new action
to attach a generic ct helper to the first packet. Then, use this ct
helper extension from follow up packets to create the ct expectation.

While at it, add a missing check to skip the template conntrack too
and remove check for IPCT_UNTRACK which is implicit to !ct.

Fixes: 857b46027d ("netfilter: nft_ct: add ct expectations support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-06-10 13:39:18 +02:00
Julian Anastasov
4b1aba6536 ipvs: ignore IP_VS_SVC_F_HASHED flag when adding service
[ Upstream commit 56e4ee82e8 ]

syzbot reported memory leak [1] when adding service with
HASHED flag. We should ignore this flag both from sockopt
and netlink provided data, otherwise the service is not
hashed and not visible while releasing resources.

[1]
BUG: memory leak
unreferenced object 0xffff888115227800 (size 512):
  comm "syz-executor263", pid 8658, jiffies 4294951882 (age 12.560s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff83977188>] kmalloc include/linux/slab.h:556 [inline]
    [<ffffffff83977188>] kzalloc include/linux/slab.h:686 [inline]
    [<ffffffff83977188>] ip_vs_add_service+0x598/0x7c0 net/netfilter/ipvs/ip_vs_ctl.c:1343
    [<ffffffff8397d770>] do_ip_vs_set_ctl+0x810/0xa40 net/netfilter/ipvs/ip_vs_ctl.c:2570
    [<ffffffff838449a8>] nf_setsockopt+0x68/0xa0 net/netfilter/nf_sockopt.c:101
    [<ffffffff839ae4e9>] ip_setsockopt+0x259/0x1ff0 net/ipv4/ip_sockglue.c:1435
    [<ffffffff839fa03c>] raw_setsockopt+0x18c/0x1b0 net/ipv4/raw.c:857
    [<ffffffff83691f20>] __sys_setsockopt+0x1b0/0x360 net/socket.c:2117
    [<ffffffff836920f2>] __do_sys_setsockopt net/socket.c:2128 [inline]
    [<ffffffff836920f2>] __se_sys_setsockopt net/socket.c:2125 [inline]
    [<ffffffff836920f2>] __x64_sys_setsockopt+0x22/0x30 net/socket.c:2125
    [<ffffffff84350efa>] do_syscall_64+0x3a/0xb0 arch/x86/entry/common.c:47
    [<ffffffff84400068>] entry_SYSCALL_64_after_hwframe+0x44/0xae

Reported-and-tested-by: syzbot+e562383183e4b1766930@syzkaller.appspotmail.com
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Reviewed-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-06-10 13:39:15 +02:00
Florian Westphal
39a909a972 netfilter: conntrack: unregister ipv4 sockopts on error unwind
[ Upstream commit 22cbdbcfb6 ]

When ipv6 sockopt register fails, the ipv4 one needs to be removed.

Fixes: a0ae2562c6 ("netfilter: conntrack: remove l3proto abstraction")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-06-10 13:39:13 +02:00
Greg Kroah-Hartman
c5d480cd47 Merge 5.10.42 into android12-5.10
Changes in 5.10.42
	ALSA: hda/realtek: the bass speaker can't output sound on Yoga 9i
	ALSA: hda/realtek: Headphone volume is controlled by Front mixer
	ALSA: hda/realtek: Chain in pop reduction fixup for ThinkStation P340
	ALSA: hda/realtek: fix mute/micmute LEDs for HP 855 G8
	ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP Zbook G8
	ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP Zbook Fury 15 G8
	ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP Zbook Fury 17 G8
	ALSA: usb-audio: scarlett2: Fix device hang with ehci-pci
	ALSA: usb-audio: scarlett2: Improve driver startup messages
	cifs: set server->cipher_type to AES-128-CCM for SMB3.0
	NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return()
	iommu/vt-d: Fix sysfs leak in alloc_iommu()
	perf intel-pt: Fix sample instruction bytes
	perf intel-pt: Fix transaction abort handling
	perf scripts python: exported-sql-viewer.py: Fix copy to clipboard from Top Calls by elapsed Time report
	perf scripts python: exported-sql-viewer.py: Fix Array TypeError
	perf scripts python: exported-sql-viewer.py: Fix warning display
	proc: Check /proc/$pid/attr/ writes against file opener
	net: hso: fix control-request directions
	net/sched: fq_pie: re-factor fix for fq_pie endless loop
	net/sched: fq_pie: fix OOB access in the traffic path
	netfilter: nft_set_pipapo_avx2: Add irq_fpu_usable() check, fallback to non-AVX2 version
	mac80211: assure all fragments are encrypted
	mac80211: prevent mixed key and fragment cache attacks
	mac80211: properly handle A-MSDUs that start with an RFC 1042 header
	cfg80211: mitigate A-MSDU aggregation attacks
	mac80211: drop A-MSDUs on old ciphers
	mac80211: add fragment cache to sta_info
	mac80211: check defrag PN against current frame
	mac80211: prevent attacks on TKIP/WEP as well
	mac80211: do not accept/forward invalid EAPOL frames
	mac80211: extend protection against mixed key and fragment cache attacks
	ath10k: add CCMP PN replay protection for fragmented frames for PCIe
	ath10k: drop fragments with multicast DA for PCIe
	ath10k: drop fragments with multicast DA for SDIO
	ath10k: drop MPDU which has discard flag set by firmware for SDIO
	ath10k: Fix TKIP Michael MIC verification for PCIe
	ath10k: Validate first subframe of A-MSDU before processing the list
	ath11k: Clear the fragment cache during key install
	dm snapshot: properly fix a crash when an origin has no snapshots
	drm/amd/pm: correct MGpuFanBoost setting
	drm/amdgpu/vcn1: add cancel_delayed_work_sync before power gate
	drm/amdkfd: correct sienna_cichlid SDMA RLC register offset error
	drm/amdgpu/vcn2.0: add cancel_delayed_work_sync before power gate
	drm/amdgpu/vcn2.5: add cancel_delayed_work_sync before power gate
	drm/amdgpu/jpeg2.0: add cancel_delayed_work_sync before power gate
	selftests/gpio: Use TEST_GEN_PROGS_EXTENDED
	selftests/gpio: Move include of lib.mk up
	selftests/gpio: Fix build when source tree is read only
	kgdb: fix gcc-11 warnings harder
	Documentation: seccomp: Fix user notification documentation
	seccomp: Refactor notification handler to prepare for new semantics
	serial: core: fix suspicious security_locked_down() call
	misc/uss720: fix memory leak in uss720_probe
	thunderbolt: usb4: Fix NVM read buffer bounds and offset issue
	thunderbolt: dma_port: Fix NVM read buffer bounds and offset issue
	KVM: X86: Fix vCPU preempted state from guest's point of view
	KVM: arm64: Prevent mixed-width VM creation
	mei: request autosuspend after sending rx flow control
	staging: iio: cdc: ad7746: avoid overwrite of num_channels
	iio: gyro: fxas21002c: balance runtime power in error path
	iio: dac: ad5770r: Put fwnode in error case during ->probe()
	iio: adc: ad7768-1: Fix too small buffer passed to iio_push_to_buffers_with_timestamp()
	iio: adc: ad7124: Fix missbalanced regulator enable / disable on error.
	iio: adc: ad7124: Fix potential overflow due to non sequential channel numbers
	iio: adc: ad7923: Fix undersized rx buffer.
	iio: adc: ad7793: Add missing error code in ad7793_setup()
	iio: adc: ad7192: Avoid disabling a clock that was never enabled.
	iio: adc: ad7192: handle regulator voltage error first
	serial: 8250: Add UART_BUG_TXRACE workaround for Aspeed VUART
	serial: 8250_dw: Add device HID for new AMD UART controller
	serial: 8250_pci: Add support for new HPE serial device
	serial: 8250_pci: handle FL_NOIRQ board flag
	USB: trancevibrator: fix control-request direction
	Revert "irqbypass: do not start cons/prod when failed connect"
	USB: usbfs: Don't WARN about excessively large memory allocations
	drivers: base: Fix device link removal
	serial: tegra: Fix a mask operation that is always true
	serial: sh-sci: Fix off-by-one error in FIFO threshold register setting
	serial: rp2: use 'request_firmware' instead of 'request_firmware_nowait'
	USB: serial: ti_usb_3410_5052: add startech.com device id
	USB: serial: option: add Telit LE910-S1 compositions 0x7010, 0x7011
	USB: serial: ftdi_sio: add IDs for IDS GmbH Products
	USB: serial: pl2303: add device id for ADLINK ND-6530 GC
	thermal/drivers/intel: Initialize RW trip to THERMAL_TEMP_INVALID
	usb: dwc3: gadget: Properly track pending and queued SG
	usb: gadget: udc: renesas_usb3: Fix a race in usb3_start_pipen()
	usb: typec: mux: Fix matching with typec_altmode_desc
	net: usb: fix memory leak in smsc75xx_bind
	Bluetooth: cmtp: fix file refcount when cmtp_attach_device fails
	fs/nfs: Use fatal_signal_pending instead of signal_pending
	NFS: fix an incorrect limit in filelayout_decode_layout()
	NFS: Fix an Oopsable condition in __nfs_pageio_add_request()
	NFS: Don't corrupt the value of pg_bytes_written in nfs_do_recoalesce()
	NFSv4: Fix v4.0/v4.1 SEEK_DATA return -ENOTSUPP when set NFS_V4_2 config
	drm/meson: fix shutdown crash when component not probed
	net/mlx5e: reset XPS on error flow if netdev isn't registered yet
	net/mlx5e: Fix multipath lag activation
	net/mlx5e: Fix error path of updating netdev queues
	{net,vdpa}/mlx5: Configure interface MAC into mpfs L2 table
	net/mlx5e: Fix nullptr in add_vlan_push_action()
	net/mlx5: Set reformat action when needed for termination rules
	net/mlx5e: Fix null deref accessing lag dev
	net/mlx4: Fix EEPROM dump support
	net/mlx5: Set term table as an unmanaged flow table
	SUNRPC in case of backlog, hand free slots directly to waiting task
	Revert "net:tipc: Fix a double free in tipc_sk_mcast_rcv"
	tipc: wait and exit until all work queues are done
	tipc: skb_linearize the head skb when reassembling msgs
	spi: spi-fsl-dspi: Fix a resource leak in an error handling path
	netfilter: flowtable: Remove redundant hw refresh bit
	net: dsa: mt7530: fix VLAN traffic leaks
	net: dsa: fix a crash if ->get_sset_count() fails
	net: dsa: sja1105: update existing VLANs from the bridge VLAN list
	net: dsa: sja1105: use 4095 as the private VLAN for untagged traffic
	net: dsa: sja1105: error out on unsupported PHY mode
	net: dsa: sja1105: add error handling in sja1105_setup()
	net: dsa: sja1105: call dsa_unregister_switch when allocating memory fails
	net: dsa: sja1105: fix VL lookup command packing for P/Q/R/S
	i2c: s3c2410: fix possible NULL pointer deref on read message after write
	i2c: mediatek: Disable i2c start_en and clear intr_stat brfore reset
	i2c: i801: Don't generate an interrupt on bus reset
	i2c: sh_mobile: Use new clock calculation formulas for RZ/G2E
	afs: Fix the nlink handling of dir-over-dir rename
	perf jevents: Fix getting maximum number of fds
	nvmet-tcp: fix inline data size comparison in nvmet_tcp_queue_response
	mptcp: avoid error message on infinite mapping
	mptcp: drop unconditional pr_warn on bad opt
	mptcp: fix data stream corruption
	platform/x86: hp_accel: Avoid invoking _INI to speed up resume
	gpio: cadence: Add missing MODULE_DEVICE_TABLE
	Revert "crypto: cavium/nitrox - add an error message to explain the failure of pci_request_mem_regions"
	Revert "media: usb: gspca: add a missed check for goto_low_power"
	Revert "ALSA: sb: fix a missing check of snd_ctl_add"
	Revert "serial: max310x: pass return value of spi_register_driver"
	serial: max310x: unregister uart driver in case of failure and abort
	Revert "net: fujitsu: fix a potential NULL pointer dereference"
	net: fujitsu: fix potential null-ptr-deref
	Revert "net/smc: fix a NULL pointer dereference"
	net/smc: properly handle workqueue allocation failure
	Revert "net: caif: replace BUG_ON with recovery code"
	net: caif: remove BUG_ON(dev == NULL) in caif_xmit
	Revert "char: hpet: fix a missing check of ioremap"
	char: hpet: add checks after calling ioremap
	Revert "ALSA: gus: add a check of the status of snd_ctl_add"
	Revert "ALSA: usx2y: Fix potential NULL pointer dereference"
	Revert "isdn: mISDNinfineon: fix potential NULL pointer dereference"
	isdn: mISDNinfineon: check/cleanup ioremap failure correctly in setup_io
	Revert "ath6kl: return error code in ath6kl_wmi_set_roam_lrssi_cmd()"
	ath6kl: return error code in ath6kl_wmi_set_roam_lrssi_cmd()
	Revert "isdn: mISDN: Fix potential NULL pointer dereference of kzalloc"
	isdn: mISDN: correctly handle ph_info allocation failure in hfcsusb_ph_info
	Revert "dmaengine: qcom_hidma: Check for driver register failure"
	dmaengine: qcom_hidma: comment platform_driver_register call
	Revert "libertas: add checks for the return value of sysfs_create_group"
	libertas: register sysfs groups properly
	Revert "ASoC: cs43130: fix a NULL pointer dereference"
	ASoC: cs43130: handle errors in cs43130_probe() properly
	Revert "media: dvb: Add check on sp8870_readreg"
	media: dvb: Add check on sp8870_readreg return
	Revert "media: gspca: mt9m111: Check write_bridge for timeout"
	media: gspca: mt9m111: Check write_bridge for timeout
	Revert "media: gspca: Check the return value of write_bridge for timeout"
	media: gspca: properly check for errors in po1030_probe()
	Revert "net: liquidio: fix a NULL pointer dereference"
	net: liquidio: Add missing null pointer checks
	Revert "brcmfmac: add a check for the status of usb_register"
	brcmfmac: properly check for bus register errors
	btrfs: return whole extents in fiemap
	scsi: ufs: ufs-mediatek: Fix power down spec violation
	scsi: BusLogic: Fix 64-bit system enumeration error for Buslogic
	openrisc: Define memory barrier mb
	scsi: pm80xx: Fix drives missing during rmmod/insmod loop
	btrfs: release path before starting transaction when cloning inline extent
	btrfs: do not BUG_ON in link_to_fixup_dir
	platform/x86: hp-wireless: add AMD's hardware id to the supported list
	platform/x86: intel_punit_ipc: Append MODULE_DEVICE_TABLE for ACPI
	platform/x86: touchscreen_dmi: Add info for the Mediacom Winpad 7.0 W700 tablet
	SMB3: incorrect file id in requests compounded with open
	drm/amd/display: Disconnect non-DP with no EDID
	drm/amd/amdgpu: fix refcount leak
	drm/amdgpu: Fix a use-after-free
	drm/amd/amdgpu: fix a potential deadlock in gpu reset
	drm/amdgpu: stop touching sched.ready in the backend
	platform/x86: touchscreen_dmi: Add info for the Chuwi Hi10 Pro (CWI529) tablet
	block: fix a race between del_gendisk and BLKRRPART
	linux/bits.h: fix compilation error with GENMASK
	net: netcp: Fix an error message
	net: dsa: fix error code getting shifted with 4 in dsa_slave_get_sset_count
	interconnect: qcom: bcm-voter: add a missing of_node_put()
	interconnect: qcom: Add missing MODULE_DEVICE_TABLE
	ASoC: cs42l42: Regmap must use_single_read/write
	net: stmmac: Fix MAC WoL not working if PHY does not support WoL
	net: ipa: memory region array is variable size
	vfio-ccw: Check initialized flag in cp_init()
	spi: Assume GPIO CS active high in ACPI case
	net: really orphan skbs tied to closing sk
	net: packetmmap: fix only tx timestamp on request
	net: fec: fix the potential memory leak in fec_enet_init()
	chelsio/chtls: unlock on error in chtls_pt_recvmsg()
	net: mdio: thunder: Fix a double free issue in the .remove function
	net: mdio: octeon: Fix some double free issues
	cxgb4/ch_ktls: Clear resources when pf4 device is removed
	openvswitch: meter: fix race when getting now_ms.
	tls splice: check SPLICE_F_NONBLOCK instead of MSG_DONTWAIT
	net: sched: fix packet stuck problem for lockless qdisc
	net: sched: fix tx action rescheduling issue during deactivation
	net: sched: fix tx action reschedule issue with stopped queue
	net: hso: check for allocation failure in hso_create_bulk_serial_device()
	net: bnx2: Fix error return code in bnx2_init_board()
	bnxt_en: Include new P5 HV definition in VF check.
	bnxt_en: Fix context memory setup for 64K page size.
	mld: fix panic in mld_newpack()
	net/smc: remove device from smcd_dev_list after failed device_add()
	gve: Check TX QPL was actually assigned
	gve: Update mgmt_msix_idx if num_ntfy changes
	gve: Add NULL pointer checks when freeing irqs.
	gve: Upgrade memory barrier in poll routine
	gve: Correct SKB queue index validation.
	iommu/virtio: Add missing MODULE_DEVICE_TABLE
	net: hns3: fix incorrect resp_msg issue
	net: hns3: put off calling register_netdev() until client initialize complete
	iommu/vt-d: Use user privilege for RID2PASID translation
	cxgb4: avoid accessing registers when clearing filters
	staging: emxx_udc: fix loop in _nbu2ss_nuke()
	ASoC: cs35l33: fix an error code in probe()
	bpf, offload: Reorder offload callback 'prepare' in verifier
	bpf: Set mac_len in bpf_skb_change_head
	ixgbe: fix large MTU request from VF
	ASoC: qcom: lpass-cpu: Use optional clk APIs
	scsi: libsas: Use _safe() loop in sas_resume_port()
	net: lantiq: fix memory corruption in RX ring
	ipv6: record frag_max_size in atomic fragments in input path
	ALSA: usb-audio: scarlett2: snd_scarlett_gen2_controls_create() can be static
	net: ethernet: mtk_eth_soc: Fix packet statistics support for MT7628/88
	sch_dsmark: fix a NULL deref in qdisc_reset()
	net: hsr: fix mac_len checks
	MIPS: alchemy: xxs1500: add gpio-au1000.h header file
	MIPS: ralink: export rt_sysc_membase for rt2880_wdt.c
	net: zero-initialize tc skb extension on allocation
	net: mvpp2: add buffer header handling in RX
	i915: fix build warning in intel_dp_get_link_status()
	samples/bpf: Consider frame size in tx_only of xdpsock sample
	net: hns3: check the return of skb_checksum_help()
	bpftool: Add sock_release help info for cgroup attach/prog load command
	SUNRPC: More fixes for backlog congestion
	Revert "Revert "ALSA: usx2y: Fix potential NULL pointer dereference""
	net: hso: bail out on interrupt URB allocation failure
	scripts/clang-tools: switch explicitly to Python 3
	neighbour: Prevent Race condition in neighbour subsytem
	usb: core: reduce power-on-good delay time of root hub
	Linux 5.10.42

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I05d98d1355a080e0951b4b2ae77f0a9ccb6dfc5d
2021-06-03 18:47:38 +02:00
Roi Dayan
6d6bc8c752 netfilter: flowtable: Remove redundant hw refresh bit
commit c07531c01d upstream.

Offloading conns could fail for multiple reasons and a hw refresh bit is
set to try to reoffload it in next sw packet.
But it could be in some cases and future points that the hw refresh bit
is not set but a refresh could succeed.
Remove the hw refresh bit and do offload refresh if requested.
There won't be a new work entry if a work is already pending
anyway as there is the hw pending bit.

Fixes: 8b3646d6e0 ("net/sched: act_ct: Support refreshing the flow table entries")
Signed-off-by: Roi Dayan <roid@nvidia.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-06-03 09:00:37 +02:00
Stefano Brivio
b1f45a26bd netfilter: nft_set_pipapo_avx2: Add irq_fpu_usable() check, fallback to non-AVX2 version
commit f0b3d33806 upstream.

Arturo reported this backtrace:

[709732.358791] WARNING: CPU: 3 PID: 456 at arch/x86/kernel/fpu/core.c:128 kernel_fpu_begin_mask+0xae/0xe0
[709732.358793] Modules linked in: binfmt_misc nft_nat nft_chain_nat nf_nat nft_counter nft_ct nf_tables nf_conntrack_netlink nfnetlink 8021q garp stp mrp llc vrf intel_rapl_msr intel_rapl_common skx_edac nfit libnvdimm ipmi_ssif x86_pkg_temp_thermal intel_powerclamp coretemp crc32_pclmul mgag200 ghash_clmulni_intel drm_kms_helper cec aesni_intel drm libaes crypto_simd cryptd glue_helper mei_me dell_smbios iTCO_wdt evdev intel_pmc_bxt iTCO_vendor_support dcdbas pcspkr rapl dell_wmi_descriptor wmi_bmof sg i2c_algo_bit watchdog mei acpi_ipmi ipmi_si button nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ipmi_devintf ipmi_msghandler ip_tables x_tables autofs4 ext4 crc16 mbcache jbd2 dm_mod raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor sd_mod t10_pi crc_t10dif crct10dif_generic raid6_pq libcrc32c crc32c_generic raid1 raid0 multipath linear md_mod ahci libahci tg3 libata xhci_pci libphy xhci_hcd ptp usbcore crct10dif_pclmul crct10dif_common bnxt_en crc32c_intel scsi_mod
[709732.358941]  pps_core i2c_i801 lpc_ich i2c_smbus wmi usb_common
[709732.358957] CPU: 3 PID: 456 Comm: jbd2/dm-0-8 Not tainted 5.10.0-0.bpo.5-amd64 #1 Debian 5.10.24-1~bpo10+1
[709732.358959] Hardware name: Dell Inc. PowerEdge R440/04JN2K, BIOS 2.9.3 09/23/2020
[709732.358964] RIP: 0010:kernel_fpu_begin_mask+0xae/0xe0
[709732.358969] Code: ae 54 24 04 83 e3 01 75 38 48 8b 44 24 08 65 48 33 04 25 28 00 00 00 75 33 48 83 c4 10 5b c3 65 8a 05 5e 21 5e 76 84 c0 74 92 <0f> 0b eb 8e f0 80 4f 01 40 48 81 c7 00 14 00 00 e8 dd fb ff ff eb
[709732.358972] RSP: 0018:ffffbb9700304740 EFLAGS: 00010202
[709732.358976] RAX: 0000000000000001 RBX: 0000000000000003 RCX: 0000000000000001
[709732.358979] RDX: ffffbb9700304970 RSI: ffff922fe1952e00 RDI: 0000000000000003
[709732.358981] RBP: ffffbb9700304970 R08: ffff922fc868a600 R09: ffff922fc711e462
[709732.358984] R10: 000000000000005f R11: ffff922ff0b27180 R12: ffffbb9700304960
[709732.358987] R13: ffffbb9700304b08 R14: ffff922fc664b6c8 R15: ffff922fc664b660
[709732.358990] FS:  0000000000000000(0000) GS:ffff92371fec0000(0000) knlGS:0000000000000000
[709732.358993] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[709732.358996] CR2: 0000557a6655bdd0 CR3: 000000026020a001 CR4: 00000000007706e0
[709732.358999] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[709732.359001] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[709732.359003] PKRU: 55555554
[709732.359005] Call Trace:
[709732.359009]  <IRQ>
[709732.359035]  nft_pipapo_avx2_lookup+0x4c/0x1cba [nf_tables]
[709732.359046]  ? sched_clock+0x5/0x10
[709732.359054]  ? sched_clock_cpu+0xc/0xb0
[709732.359061]  ? record_times+0x16/0x80
[709732.359068]  ? plist_add+0xc1/0x100
[709732.359073]  ? psi_group_change+0x47/0x230
[709732.359079]  ? skb_clone+0x4d/0xb0
[709732.359085]  ? enqueue_task_rt+0x22b/0x310
[709732.359098]  ? bnxt_start_xmit+0x1e8/0xaf0 [bnxt_en]
[709732.359102]  ? packet_rcv+0x40/0x4a0
[709732.359121]  nft_lookup_eval+0x59/0x160 [nf_tables]
[709732.359133]  nft_do_chain+0x350/0x500 [nf_tables]
[709732.359152]  ? nft_lookup_eval+0x59/0x160 [nf_tables]
[709732.359163]  ? nft_do_chain+0x364/0x500 [nf_tables]
[709732.359172]  ? fib4_rule_action+0x6d/0x80
[709732.359178]  ? fib_rules_lookup+0x107/0x250
[709732.359184]  nft_nat_do_chain+0x8a/0xf2 [nft_chain_nat]
[709732.359193]  nf_nat_inet_fn+0xea/0x210 [nf_nat]
[709732.359202]  nf_nat_ipv4_out+0x14/0xa0 [nf_nat]
[709732.359207]  nf_hook_slow+0x44/0xc0
[709732.359214]  ip_output+0xd2/0x100
[709732.359221]  ? __ip_finish_output+0x210/0x210
[709732.359226]  ip_forward+0x37d/0x4a0
[709732.359232]  ? ip4_key_hashfn+0xb0/0xb0
[709732.359238]  ip_sublist_rcv_finish+0x4f/0x60
[709732.359243]  ip_sublist_rcv+0x196/0x220
[709732.359250]  ? ip_rcv_finish_core.isra.22+0x400/0x400
[709732.359255]  ip_list_rcv+0x137/0x160
[709732.359264]  __netif_receive_skb_list_core+0x29b/0x2c0
[709732.359272]  netif_receive_skb_list_internal+0x1a6/0x2d0
[709732.359280]  gro_normal_list.part.156+0x19/0x40
[709732.359286]  napi_complete_done+0x67/0x170
[709732.359298]  bnxt_poll+0x105/0x190 [bnxt_en]
[709732.359304]  ? irqentry_exit+0x29/0x30
[709732.359309]  ? asm_common_interrupt+0x1e/0x40
[709732.359315]  net_rx_action+0x144/0x3c0
[709732.359322]  __do_softirq+0xd5/0x29c
[709732.359329]  asm_call_irq_on_stack+0xf/0x20
[709732.359332]  </IRQ>
[709732.359339]  do_softirq_own_stack+0x37/0x40
[709732.359346]  irq_exit_rcu+0x9d/0xa0
[709732.359353]  common_interrupt+0x78/0x130
[709732.359358]  asm_common_interrupt+0x1e/0x40
[709732.359366] RIP: 0010:crc_41+0x0/0x1e [crc32c_intel]
[709732.359370] Code: ff ff f2 4d 0f 38 f1 93 a8 fe ff ff f2 4c 0f 38 f1 81 b0 fe ff ff f2 4c 0f 38 f1 8a b0 fe ff ff f2 4d 0f 38 f1 93 b0 fe ff ff <f2> 4c 0f 38 f1 81 b8 fe ff ff f2 4c 0f 38 f1 8a b8 fe ff ff f2 4d
[709732.359373] RSP: 0018:ffffbb97008dfcd0 EFLAGS: 00000246
[709732.359377] RAX: 000000000000002a RBX: 0000000000000400 RCX: ffff922fc591dd50
[709732.359379] RDX: ffff922fc591dea0 RSI: 0000000000000a14 RDI: ffffffffc00dddc0
[709732.359382] RBP: 0000000000001000 R08: 000000000342d8c3 R09: 0000000000000000
[709732.359384] R10: 0000000000000000 R11: ffff922fc591dff0 R12: ffffbb97008dfe58
[709732.359386] R13: 000000000000000a R14: ffff922fd2b91e80 R15: ffff922fef83fe38
[709732.359395]  ? crc_43+0x1e/0x1e [crc32c_intel]
[709732.359403]  ? crc32c_pcl_intel_update+0x97/0xb0 [crc32c_intel]
[709732.359419]  ? jbd2_journal_commit_transaction+0xaec/0x1a30 [jbd2]
[709732.359425]  ? irq_exit_rcu+0x3e/0xa0
[709732.359447]  ? kjournald2+0xbd/0x270 [jbd2]
[709732.359454]  ? finish_wait+0x80/0x80
[709732.359470]  ? commit_timeout+0x10/0x10 [jbd2]
[709732.359476]  ? kthread+0x116/0x130
[709732.359481]  ? kthread_park+0x80/0x80
[709732.359488]  ? ret_from_fork+0x1f/0x30
[709732.359494] ---[ end trace 081a19978e5f09f5 ]---

that is, nft_pipapo_avx2_lookup() uses the FPU running from a softirq
that interrupted a kthread, also using the FPU.

That's exactly the reason why irq_fpu_usable() is there: use it, and
if we can't use the FPU, fall back to the non-AVX2 version of the
lookup operation, i.e. nft_pipapo_lookup().

Reported-by: Arturo Borrero Gonzalez <arturo@netfilter.org>
Cc: <stable@vger.kernel.org> # 5.6.x
Fixes: 7400b06396 ("nft_set_pipapo: Introduce AVX2-based lookup implementation")
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-06-03 09:00:28 +02:00
Greg Kroah-Hartman
76002c201f Merge 5.10.38 into android12-5.10
Changes in 5.10.38
	KEYS: trusted: Fix memory leak on object td
	tpm: fix error return code in tpm2_get_cc_attrs_tbl()
	tpm, tpm_tis: Extend locality handling to TPM2 in tpm_tis_gen_interrupt()
	tpm, tpm_tis: Reserve locality in tpm_tis_resume()
	KVM: x86/mmu: Remove the defunct update_pte() paging hook
	KVM/VMX: Invoke NMI non-IST entry instead of IST entry
	ACPI: PM: Add ACPI ID of Alder Lake Fan
	PM: runtime: Fix unpaired parent child_count for force_resume
	cpufreq: intel_pstate: Use HWP if enabled by platform firmware
	kvm: Cap halt polling at kvm->max_halt_poll_ns
	ath11k: fix thermal temperature read
	fs: dlm: fix debugfs dump
	fs: dlm: add errno handling to check callback
	fs: dlm: check on minimum msglen size
	fs: dlm: flush swork on shutdown
	tipc: convert dest node's address to network order
	ASoC: Intel: bytcr_rt5640: Enable jack-detect support on Asus T100TAF
	net/mlx5e: Use net_prefetchw instead of prefetchw in MPWQE TX datapath
	net: stmmac: Set FIFO sizes for ipq806x
	ASoC: rsnd: core: Check convert rate in rsnd_hw_params
	Bluetooth: Fix incorrect status handling in LE PHY UPDATE event
	i2c: bail out early when RDWR parameters are wrong
	ALSA: hdsp: don't disable if not enabled
	ALSA: hdspm: don't disable if not enabled
	ALSA: rme9652: don't disable if not enabled
	ALSA: bebob: enable to deliver MIDI messages for multiple ports
	Bluetooth: Set CONF_NOT_COMPLETE as l2cap_chan default
	Bluetooth: initialize skb_queue_head at l2cap_chan_create()
	net/sched: cls_flower: use ntohs for struct flow_dissector_key_ports
	net: bridge: when suppression is enabled exclude RARP packets
	Bluetooth: check for zapped sk before connecting
	selftests/powerpc: Fix L1D flushing tests for Power10
	powerpc/32: Statically initialise first emergency context
	net: hns3: remediate a potential overflow risk of bd_num_list
	net: hns3: add handling for xmit skb with recursive fraglist
	ip6_vti: proper dev_{hold|put} in ndo_[un]init methods
	ASoC: Intel: bytcr_rt5640: Add quirk for the Chuwi Hi8 tablet
	ice: handle increasing Tx or Rx ring sizes
	Bluetooth: btusb: Enable quirk boolean flag for Mediatek Chip.
	ASoC: rt5670: Add a quirk for the Dell Venue 10 Pro 5055
	i2c: Add I2C_AQ_NO_REP_START adapter quirk
	MIPS: Loongson64: Use _CACHE_UNCACHED instead of _CACHE_UNCACHED_ACCELERATED
	coresight: Do not scan for graph if none is present
	IB/hfi1: Correct oversized ring allocation
	mac80211: clear the beacon's CRC after channel switch
	pinctrl: samsung: use 'int' for register masks in Exynos
	rtw88: 8822c: add LC calibration for RTL8822C
	mt76: mt7615: support loading EEPROM for MT7613BE
	mt76: mt76x0: disable GTK offloading
	mt76: mt7915: fix txpower init for TSSI off chips
	fuse: invalidate attrs when page writeback completes
	virtiofs: fix userns
	cuse: prevent clone
	iwlwifi: pcie: make cfg vs. trans_cfg more robust
	powerpc/mm: Add cond_resched() while removing hpte mappings
	ASoC: rsnd: call rsnd_ssi_master_clk_start() from rsnd_ssi_init()
	Revert "iommu/amd: Fix performance counter initialization"
	iommu/amd: Remove performance counter pre-initialization test
	drm/amd/display: Force vsync flip when reconfiguring MPCC
	selftests: Set CC to clang in lib.mk if LLVM is set
	kconfig: nconf: stop endless search loops
	ALSA: hda/realtek: Add quirk for Lenovo Ideapad S740
	ASoC: Intel: sof_sdw: add quirk for new ADL-P Rvp
	ALSA: hda/hdmi: fix race in handling acomp ELD notification at resume
	sctp: Fix out-of-bounds warning in sctp_process_asconf_param()
	flow_dissector: Fix out-of-bounds warning in __skb_flow_bpf_to_target()
	powerpc/smp: Set numa node before updating mask
	ASoC: rt286: Generalize support for ALC3263 codec
	ethtool: ioctl: Fix out-of-bounds warning in store_link_ksettings_for_user()
	net: sched: tapr: prevent cycle_time == 0 in parse_taprio_schedule
	samples/bpf: Fix broken tracex1 due to kprobe argument change
	powerpc/pseries: Stop calling printk in rtas_stop_self()
	drm/amd/display: fixed divide by zero kernel crash during dsc enablement
	drm/amd/display: add handling for hdcp2 rx id list validation
	drm/amdgpu: Add mem sync flag for IB allocated by SA
	mt76: mt7615: fix entering driver-own state on mt7663
	crypto: ccp: Free SEV device if SEV init fails
	wl3501_cs: Fix out-of-bounds warnings in wl3501_send_pkt
	wl3501_cs: Fix out-of-bounds warnings in wl3501_mgmt_join
	qtnfmac: Fix possible buffer overflow in qtnf_event_handle_external_auth
	powerpc/iommu: Annotate nested lock for lockdep
	iavf: remove duplicate free resources calls
	net: ethernet: mtk_eth_soc: fix RX VLAN offload
	selftests: mlxsw: Increase the tolerance of backlog buildup
	selftests: mlxsw: Fix mausezahn invocation in ERSPAN scale test
	kbuild: generate Module.symvers only when vmlinux exists
	bnxt_en: Add PCI IDs for Hyper-V VF devices.
	ia64: module: fix symbolizer crash on fdescr
	watchdog: rename __touch_watchdog() to a better descriptive name
	watchdog: explicitly update timestamp when reporting softlockup
	watchdog/softlockup: remove logic that tried to prevent repeated reports
	watchdog: fix barriers when printing backtraces from all CPUs
	ASoC: rt286: Make RT286_SET_GPIO_* readable and writable
	thermal: thermal_of: Fix error return code of thermal_of_populate_bind_params()
	f2fs: move ioctl interface definitions to separated file
	f2fs: fix compat F2FS_IOC_{MOVE,GARBAGE_COLLECT}_RANGE
	f2fs: fix to allow migrating fully valid segment
	f2fs: fix panic during f2fs_resize_fs()
	f2fs: fix a redundant call to f2fs_balance_fs if an error occurs
	remoteproc: qcom_q6v5_mss: Replace ioremap with memremap
	remoteproc: qcom_q6v5_mss: Validate p_filesz in ELF loader
	PCI: iproc: Fix return value of iproc_msi_irq_domain_alloc()
	PCI: Release OF node in pci_scan_device()'s error path
	ARM: 9064/1: hw_breakpoint: Do not directly check the event's overflow_handler hook
	f2fs: fix to align to section for fallocate() on pinned file
	f2fs: fix to update last i_size if fallocate partially succeeds
	PCI: endpoint: Make *_get_first_free_bar() take into account 64 bit BAR
	PCI: endpoint: Add helper API to get the 'next' unreserved BAR
	PCI: endpoint: Make *_free_bar() to return error codes on failure
	PCI: endpoint: Fix NULL pointer dereference for ->get_features()
	f2fs: fix to avoid touching checkpointed data in get_victim()
	f2fs: fix to cover __allocate_new_section() with curseg_lock
	f2fs: Fix a hungtask problem in atomic write
	f2fs: fix to avoid accessing invalid fio in f2fs_allocate_data_block()
	rpmsg: qcom_glink_native: fix error return code of qcom_glink_rx_data()
	NFS: nfs4_bitmask_adjust() must not change the server global bitmasks
	NFS: Fix attribute bitmask in _nfs42_proc_fallocate()
	NFSv4.2: Always flush out writes in nfs42_proc_fallocate()
	NFS: Deal correctly with attribute generation counter overflow
	PCI: endpoint: Fix missing destroy_workqueue()
	pNFS/flexfiles: fix incorrect size check in decode_nfs_fh()
	NFSv4.2 fix handling of sr_eof in SEEK's reply
	SUNRPC: Move fault injection call sites
	SUNRPC: Remove trace_xprt_transmit_queued
	SUNRPC: Handle major timeout in xprt_adjust_timeout()
	thermal/drivers/tsens: Fix missing put_device error
	NFSv4.x: Don't return NFS4ERR_NOMATCHING_LAYOUT if we're unmounting
	nfsd: ensure new clients break delegations
	rtc: fsl-ftm-alarm: add MODULE_TABLE()
	dmaengine: idxd: Fix potential null dereference on pointer status
	dmaengine: idxd: fix dma device lifetime
	dmaengine: idxd: fix cdev setup and free device lifetime issues
	SUNRPC: fix ternary sign expansion bug in tracing
	pwm: atmel: Fix duty cycle calculation in .get_state()
	xprtrdma: Avoid Receive Queue wrapping
	xprtrdma: Fix cwnd update ordering
	xprtrdma: rpcrdma_mr_pop() already does list_del_init()
	swiotlb: Fix the type of index
	ceph: fix inode leak on getattr error in __fh_to_dentry
	scsi: qla2xxx: Prevent PRLI in target mode
	scsi: ufs: core: Do not put UFS power into LPM if link is broken
	scsi: ufs: core: Cancel rpm_dev_flush_recheck_work during system suspend
	scsi: ufs: core: Narrow down fast path in system suspend path
	rtc: ds1307: Fix wday settings for rx8130
	net: hns3: fix incorrect configuration for igu_egu_hw_err
	net: hns3: initialize the message content in hclge_get_link_mode()
	net: hns3: add check for HNS3_NIC_STATE_INITED in hns3_reset_notify_up_enet()
	net: hns3: fix for vxlan gpe tx checksum bug
	net: hns3: use netif_tx_disable to stop the transmit queue
	net: hns3: disable phy loopback setting in hclge_mac_start_phy
	sctp: do asoc update earlier in sctp_sf_do_dupcook_a
	RISC-V: Fix error code returned by riscv_hartid_to_cpuid()
	sunrpc: Fix misplaced barrier in call_decode
	libbpf: Fix signed overflow in ringbuf_process_ring
	block/rnbd-clt: Change queue_depth type in rnbd_clt_session to size_t
	block/rnbd-clt: Check the return value of the function rtrs_clt_query
	ethernet:enic: Fix a use after free bug in enic_hard_start_xmit
	sctp: fix a SCTP_MIB_CURRESTAB leak in sctp_sf_do_dupcook_b
	netfilter: xt_SECMARK: add new revision to fix structure layout
	xsk: Fix for xp_aligned_validate_desc() when len == chunk_size
	net: stmmac: Clear receive all(RA) bit when promiscuous mode is off
	drm/radeon: Fix off-by-one power_state index heap overwrite
	drm/radeon: Avoid power table parsing memory leaks
	arm64: entry: factor irq triage logic into macros
	arm64: entry: always set GIC_PRIO_PSR_I_SET during entry
	khugepaged: fix wrong result value for trace_mm_collapse_huge_page_isolate()
	mm/hugeltb: handle the error case in hugetlb_fix_reserve_counts()
	mm/migrate.c: fix potential indeterminate pte entry in migrate_vma_insert_page()
	ksm: fix potential missing rmap_item for stable_node
	mm/gup: check every subpage of a compound page during isolation
	mm/gup: return an error on migration failure
	mm/gup: check for isolation errors
	ethtool: fix missing NLM_F_MULTI flag when dumping
	net: fix nla_strcmp to handle more then one trailing null character
	smc: disallow TCP_ULP in smc_setsockopt()
	netfilter: nfnetlink_osf: Fix a missing skb_header_pointer() NULL check
	netfilter: nftables: Fix a memleak from userdata error path in new objects
	can: mcp251xfd: mcp251xfd_probe(): add missing can_rx_offload_del() in error path
	can: mcp251x: fix resume from sleep before interface was brought up
	can: m_can: m_can_tx_work_queue(): fix tx_skb race condition
	sched: Fix out-of-bound access in uclamp
	sched/fair: Fix unfairness caused by missing load decay
	fs/proc/generic.c: fix incorrect pde_is_permanent check
	kernel: kexec_file: fix error return code of kexec_calculate_store_digests()
	kernel/resource: make walk_system_ram_res() find all busy IORESOURCE_SYSTEM_RAM resources
	kernel/resource: make walk_mem_res() find all busy IORESOURCE_MEM resources
	netfilter: nftables: avoid overflows in nft_hash_buckets()
	i40e: fix broken XDP support
	i40e: Fix use-after-free in i40e_client_subtask()
	i40e: fix the restart auto-negotiation after FEC modified
	i40e: Fix PHY type identifiers for 2.5G and 5G adapters
	mptcp: fix splat when closing unaccepted socket
	f2fs: avoid unneeded data copy in f2fs_ioc_move_range()
	ARC: entry: fix off-by-one error in syscall number validation
	ARC: mm: PAE: use 40-bit physical page mask
	ARC: mm: Use max_high_pfn as a HIGHMEM zone border
	powerpc/64s: Fix crashes when toggling stf barrier
	powerpc/64s: Fix crashes when toggling entry flush barrier
	hfsplus: prevent corruption in shrinking truncate
	squashfs: fix divide error in calculate_skip()
	userfaultfd: release page in error path to avoid BUG_ON
	kasan: fix unit tests with CONFIG_UBSAN_LOCAL_BOUNDS enabled
	mm/hugetlb: fix F_SEAL_FUTURE_WRITE
	blk-iocost: fix weight updates of inner active iocgs
	arm64: mte: initialize RGSR_EL1.SEED in __cpu_setup
	arm64: Fix race condition on PG_dcache_clean in __sync_icache_dcache()
	btrfs: fix race leading to unpersisted data and metadata on fsync
	drm/radeon/dpm: Disable sclk switching on Oland when two 4K 60Hz monitors are connected
	drm/amd/display: Initialize attribute for hdcp_srm sysfs file
	drm/i915: Avoid div-by-zero on gen2
	kvm: exit halt polling on need_resched() as well
	KVM: LAPIC: Accurately guarantee busy wait for timer to expire when using hv_timer
	drm/msm/dp: initialize audio_comp when audio starts
	KVM: x86: Cancel pvclock_gtod_work on module removal
	KVM: x86: Prevent deadlock against tk_core.seq
	dax: Add an enum for specifying dax wakup mode
	dax: Add a wakeup mode parameter to put_unlocked_entry()
	dax: Wake up all waiters after invalidating dax entry
	xen/unpopulated-alloc: consolidate pgmap manipulation
	xen/unpopulated-alloc: fix error return code in fill_list()
	perf tools: Fix dynamic libbpf link
	usb: dwc3: gadget: Free gadget structure only after freeing endpoints
	iio: light: gp2ap002: Fix rumtime PM imbalance on error
	iio: proximity: pulsedlight: Fix rumtime PM imbalance on error
	iio: hid-sensors: select IIO_TRIGGERED_BUFFER under HID_SENSOR_IIO_TRIGGER
	usb: fotg210-hcd: Fix an error message
	hwmon: (occ) Fix poll rate limiting
	usb: musb: Fix an error message
	ACPI: scan: Fix a memory leak in an error handling path
	kyber: fix out of bounds access when preempted
	nvmet: add lba to sect conversion helpers
	nvmet: fix inline bio check for bdev-ns
	nvmet-rdma: Fix NULL deref when SEND is completed with error
	f2fs: compress: fix to free compress page correctly
	f2fs: compress: fix race condition of overwrite vs truncate
	f2fs: compress: fix to assign cc.cluster_idx correctly
	nbd: Fix NULL pointer in flush_workqueue
	blk-mq: plug request for shared sbitmap
	blk-mq: Swap two calls in blk_mq_exit_queue()
	usb: dwc3: omap: improve extcon initialization
	usb: dwc3: pci: Enable usb2-gadget-lpm-disable for Intel Merrifield
	usb: xhci: Increase timeout for HC halt
	usb: dwc2: Fix gadget DMA unmap direction
	usb: core: hub: fix race condition about TRSMRCY of resume
	usb: dwc3: gadget: Enable suspend events
	usb: dwc3: gadget: Return success always for kick transfer in ep queue
	usb: typec: ucsi: Retrieve all the PDOs instead of just the first 4
	usb: typec: ucsi: Put fwnode in any case during ->probe()
	xhci-pci: Allow host runtime PM as default for Intel Alder Lake xHCI
	xhci: Do not use GFP_KERNEL in (potentially) atomic context
	xhci: Add reset resume quirk for AMD xhci controller.
	iio: gyro: mpu3050: Fix reported temperature value
	iio: tsl2583: Fix division by a zero lux_val
	cdc-wdm: untangle a circular dependency between callback and softint
	xen/gntdev: fix gntdev_mmap() error exit path
	KVM: x86: Emulate RDPID only if RDTSCP is supported
	KVM: x86: Move RDPID emulation intercept to its own enum
	KVM: nVMX: Always make an attempt to map eVMCS after migration
	KVM: VMX: Do not advertise RDPID if ENABLE_RDTSCP control is unsupported
	KVM: VMX: Disable preemption when probing user return MSRs
	Revert "iommu/vt-d: Remove WO permissions on second-level paging entries"
	Revert "iommu/vt-d: Preset Access/Dirty bits for IOVA over FL"
	iommu/vt-d: Preset Access/Dirty bits for IOVA over FL
	iommu/vt-d: Remove WO permissions on second-level paging entries
	mm: fix struct page layout on 32-bit systems
	MIPS: Reinstate platform `__div64_32' handler
	MIPS: Avoid DIVU in `__div64_32' is result would be zero
	MIPS: Avoid handcoded DIVU in `__div64_32' altogether
	clocksource/drivers/timer-ti-dm: Prepare to handle dra7 timer wrap issue
	clocksource/drivers/timer-ti-dm: Handle dra7 timer wrap errata i940
	ARM: 9011/1: centralize phys-to-virt conversion of DT/ATAGS address
	ARM: 9012/1: move device tree mapping out of linear region
	ARM: 9020/1: mm: use correct section size macro to describe the FDT virtual address
	ARM: 9027/1: head.S: explicitly map DT even if it lives in the first physical section
	usb: typec: tcpm: Fix error while calculating PPS out values
	kobject_uevent: remove warning in init_uevent_argv()
	drm/i915/gt: Fix a double free in gen8_preallocate_top_level_pdp
	drm/i915: Read C0DRB3/C1DRB3 as 16 bits again
	drm/i915/overlay: Fix active retire callback alignment
	drm/i915: Fix crash in auto_retire
	clk: exynos7: Mark aclk_fsys1_200 as critical
	media: rkvdec: Remove of_match_ptr()
	i2c: mediatek: Fix send master code at more than 1MHz
	dt-bindings: media: renesas,vin: Make resets optional on R-Car Gen1
	dt-bindings: serial: 8250: Remove duplicated compatible strings
	debugfs: Make debugfs_allow RO after init
	ext4: fix debug format string warning
	nvme: do not try to reconfigure APST when the controller is not live
	ASoC: rsnd: check all BUSIF status when error
	Linux 5.10.38

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ia32e01283b488a38be48015c58a0e481f09aaf65
2021-05-20 15:35:25 +02:00
Eric Dumazet
72b49dd116 netfilter: nftables: avoid overflows in nft_hash_buckets()
[ Upstream commit a54754ec98 ]

Number of buckets being stored in 32bit variables, we have to
ensure that no overflows occur in nft_hash_buckets()

syzbot injected a size == 0x40000000 and reported:

UBSAN: shift-out-of-bounds in ./include/linux/log2.h:57:13
shift exponent 64 is too large for 64-bit type 'long unsigned int'
CPU: 1 PID: 29539 Comm: syz-executor.4 Not tainted 5.12.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x141/0x1d7 lib/dump_stack.c:120
 ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
 __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:327
 __roundup_pow_of_two include/linux/log2.h:57 [inline]
 nft_hash_buckets net/netfilter/nft_set_hash.c:411 [inline]
 nft_hash_estimate.cold+0x19/0x1e net/netfilter/nft_set_hash.c:652
 nft_select_set_ops net/netfilter/nf_tables_api.c:3586 [inline]
 nf_tables_newset+0xe62/0x3110 net/netfilter/nf_tables_api.c:4322
 nfnetlink_rcv_batch+0xa09/0x24b0 net/netfilter/nfnetlink.c:488
 nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:612 [inline]
 nfnetlink_rcv+0x3af/0x420 net/netfilter/nfnetlink.c:630
 netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline]
 netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1338
 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1927
 sock_sendmsg_nosec net/socket.c:654 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:674
 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2350
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2404
 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2433
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46

Fixes: 0ed6389c48 ("netfilter: nf_tables: rename set implementations")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-05-19 10:13:09 +02:00
Pablo Neira Ayuso
2c784a500f netfilter: nftables: Fix a memleak from userdata error path in new objects
[ Upstream commit 85dfd816fa ]

Release object name if userdata allocation fails.

Fixes: b131c96496 ("netfilter: nf_tables: add userdata support for nft_object")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-05-19 10:13:08 +02:00
Pablo Neira Ayuso
403ccad066 netfilter: nfnetlink_osf: Fix a missing skb_header_pointer() NULL check
[ Upstream commit 5e024c3254 ]

Do not assume that the tcph->doff field is correct when parsing for TCP
options, skb_header_pointer() might fail to fetch these bits.

Fixes: 11eeef41d5 ("netfilter: passive OS fingerprint xtables match")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-05-19 10:13:08 +02:00
Pablo Neira Ayuso
75ea982469 netfilter: xt_SECMARK: add new revision to fix structure layout
[ Upstream commit c7d13358b6 ]

This extension breaks when trying to delete rules, add a new revision to
fix this.

Fixes: 5e6874cdb8 ("[SECMARK]: Add xtables SECMARK target")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-05-19 10:13:06 +02:00
Greg Kroah-Hartman
e054456ced Merge 5.10.37 into android12-5.10
Changes in 5.10.37
	Bluetooth: verify AMP hci_chan before amp_destroy
	bluetooth: eliminate the potential race condition when removing the HCI controller
	net/nfc: fix use-after-free llcp_sock_bind/connect
	io_uring: truncate lengths larger than MAX_RW_COUNT on provide buffers
	Revert "USB: cdc-acm: fix rounding error in TIOCSSERIAL"
	usb: roles: Call try_module_get() from usb_role_switch_find_by_fwnode()
	tty: moxa: fix TIOCSSERIAL jiffies conversions
	tty: amiserial: fix TIOCSSERIAL permission check
	USB: serial: usb_wwan: fix TIOCSSERIAL jiffies conversions
	staging: greybus: uart: fix TIOCSSERIAL jiffies conversions
	USB: serial: ti_usb_3410_5052: fix TIOCSSERIAL permission check
	staging: fwserial: fix TIOCSSERIAL jiffies conversions
	tty: moxa: fix TIOCSSERIAL permission check
	staging: fwserial: fix TIOCSSERIAL permission check
	drm: bridge: fix LONTIUM use of mipi_dsi_() functions
	usb: typec: tcpm: Address incorrect values of tcpm psy for fixed supply
	usb: typec: tcpm: Address incorrect values of tcpm psy for pps supply
	usb: typec: tcpm: update power supply once partner accepts
	usb: xhci-mtk: remove or operator for setting schedule parameters
	usb: xhci-mtk: improve bandwidth scheduling with TT
	ASoC: samsung: tm2_wm5110: check of of_parse return value
	ASoC: Intel: kbl_da7219_max98927: Fix kabylake_ssp_fixup function
	ASoC: tlv320aic32x4: Register clocks before registering component
	ASoC: tlv320aic32x4: Increase maximum register in regmap
	MIPS: pci-mt7620: fix PLL lock check
	MIPS: pci-rt2880: fix slot 0 configuration
	FDDI: defxx: Bail out gracefully with unassigned PCI resource for CSR
	PCI: Allow VPD access for QLogic ISP2722
	KVM: x86: Defer the MMU unload to the normal path on an global INVPCID
	PCI: xgene: Fix cfg resource mapping
	PCI: keystone: Let AM65 use the pci_ops defined in pcie-designware-host.c
	PM / devfreq: Unlock mutex and free devfreq struct in error path
	soc/tegra: regulators: Fix locking up when voltage-spread is out of range
	iio: inv_mpu6050: Fully validate gyro and accel scale writes
	iio:accel:adis16201: Fix wrong axis assignment that prevents loading
	iio:adc:ad7476: Fix remove handling
	sc16is7xx: Defer probe if device read fails
	phy: cadence: Sierra: Fix PHY power_on sequence
	misc: lis3lv02d: Fix false-positive WARN on various HP models
	phy: ti: j721e-wiz: Invoke wiz_init() before of_platform_device_create()
	misc: vmw_vmci: explicitly initialize vmci_notify_bm_set_msg struct
	misc: vmw_vmci: explicitly initialize vmci_datagram payload
	selinux: add proper NULL termination to the secclass_map permissions
	x86, sched: Treat Intel SNC topology as default, COD as exception
	async_xor: increase src_offs when dropping destination page
	md/bitmap: wait for external bitmap writes to complete during tear down
	md-cluster: fix use-after-free issue when removing rdev
	md: split mddev_find
	md: factor out a mddev_find_locked helper from mddev_find
	md: md_open returns -EBUSY when entering racing area
	md: Fix missing unused status line of /proc/mdstat
	mt76: mt7615: use ieee80211_free_txskb() in mt7615_tx_token_put()
	ipw2x00: potential buffer overflow in libipw_wx_set_encodeext()
	cfg80211: scan: drop entry from hidden_list on overflow
	rtw88: Fix array overrun in rtw_get_tx_power_params()
	mt76: fix potential DMA mapping leak
	FDDI: defxx: Make MMIO the configuration default except for EISA
	drm/i915/gvt: Fix virtual display setup for BXT/APL
	drm/i915/gvt: Fix vfio_edid issue for BXT/APL
	drm/qxl: use ttm bo priorities
	drm/panfrost: Clear MMU irqs before handling the fault
	drm/panfrost: Don't try to map pages that are already mapped
	drm/radeon: fix copy of uninitialized variable back to userspace
	drm/dp_mst: Revise broadcast msg lct & lcr
	drm/dp_mst: Set CLEAR_PAYLOAD_ID_TABLE as broadcast
	drm: bridge/panel: Cleanup connector on bridge detach
	drm/amd/display: Reject non-zero src_y and src_x for video planes
	drm/amdgpu: fix concurrent VM flushes on Vega/Navi v2
	ALSA: hda/realtek: Re-order ALC882 Acer quirk table entries
	ALSA: hda/realtek: Re-order ALC882 Sony quirk table entries
	ALSA: hda/realtek: Re-order ALC882 Clevo quirk table entries
	ALSA: hda/realtek: Re-order ALC269 HP quirk table entries
	ALSA: hda/realtek: Re-order ALC269 Acer quirk table entries
	ALSA: hda/realtek: Re-order ALC269 Dell quirk table entries
	ALSA: hda/realtek: Re-order ALC269 ASUS quirk table entries
	ALSA: hda/realtek: Re-order ALC269 Sony quirk table entries
	ALSA: hda/realtek: Re-order ALC269 Lenovo quirk table entries
	ALSA: hda/realtek: Re-order remaining ALC269 quirk table entries
	ALSA: hda/realtek: Re-order ALC662 quirk table entries
	ALSA: hda/realtek: Remove redundant entry for ALC861 Haier/Uniwill devices
	ALSA: hda/realtek: ALC285 Thinkpad jack pin quirk is unreachable
	ALSA: hda/realtek: Fix speaker amp on HP Envy AiO 32
	KVM: s390: VSIE: correctly handle MVPG when in VSIE
	KVM: s390: split kvm_s390_logical_to_effective
	KVM: s390: fix guarded storage control register handling
	s390: fix detection of vector enhancements facility 1 vs. vector packed decimal facility
	KVM: s390: VSIE: fix MVPG handling for prefixing and MSO
	KVM: s390: split kvm_s390_real_to_abs
	KVM: s390: extend kvm_s390_shadow_fault to return entry pointer
	KVM: x86/mmu: Alloc page for PDPTEs when shadowing 32-bit NPT with 64-bit
	KVM: x86: Remove emulator's broken checks on CR0/CR3/CR4 loads
	KVM: nSVM: Set the shadow root level to the TDP level for nested NPT
	KVM: SVM: Don't strip the C-bit from CR2 on #PF interception
	KVM: SVM: Do not allow SEV/SEV-ES initialization after vCPUs are created
	KVM: SVM: Inject #GP on guest MSR_TSC_AUX accesses if RDTSCP unsupported
	KVM: nVMX: Defer the MMU reload to the normal path on an EPTP switch
	KVM: nVMX: Truncate bits 63:32 of VMCS field on nested check in !64-bit
	KVM: nVMX: Truncate base/index GPR value on address calc in !64-bit
	KVM: arm/arm64: Fix KVM_VGIC_V3_ADDR_TYPE_REDIST read
	KVM: Destroy I/O bus devices on unregister failure _after_ sync'ing SRCU
	KVM: Stop looking for coalesced MMIO zones if the bus is destroyed
	KVM: arm64: Fully zero the vcpu state on reset
	KVM: arm64: Fix KVM_VGIC_V3_ADDR_TYPE_REDIST_REGION read
	Revert "drivers/net/wan/hdlc_fr: Fix a double free in pvc_xmit"
	Revert "i3c master: fix missing destroy_workqueue() on error in i3c_master_register"
	ovl: fix missing revert_creds() on error path
	Revert "drm/qxl: do not run release if qxl failed to init"
	usb: gadget: pch_udc: Revert d3cb25a121 completely
	Revert "tools/power turbostat: adjust for temperature offset"
	firmware: xilinx: Fix dereferencing freed memory
	firmware: xilinx: Add a blank line after function declaration
	firmware: xilinx: Remove zynqmp_pm_get_eemi_ops() in IS_REACHABLE(CONFIG_ZYNQMP_FIRMWARE)
	fpga: fpga-mgr: xilinx-spi: fix error messages on -EPROBE_DEFER
	crypto: sun8i-ss - fix result memory leak on error path
	memory: gpmc: fix out of bounds read and dereference on gpmc_cs[]
	ARM: dts: exynos: correct fuel gauge interrupt trigger level on GT-I9100
	ARM: dts: exynos: correct fuel gauge interrupt trigger level on Midas family
	ARM: dts: exynos: correct MUIC interrupt trigger level on Midas family
	ARM: dts: exynos: correct PMIC interrupt trigger level on Midas family
	ARM: dts: exynos: correct PMIC interrupt trigger level on Odroid X/U3 family
	ARM: dts: exynos: correct PMIC interrupt trigger level on SMDK5250
	ARM: dts: exynos: correct PMIC interrupt trigger level on Snow
	ARM: dts: s5pv210: correct fuel gauge interrupt trigger level on Fascinate family
	ARM: dts: renesas: Add mmc aliases into R-Car Gen2 board dts files
	arm64: dts: renesas: Add mmc aliases into board dts files
	x86/platform/uv: Set section block size for hubless architectures
	serial: stm32: fix code cleaning warnings and checks
	serial: stm32: add "_usart" prefix in functions name
	serial: stm32: fix probe and remove order for dma
	serial: stm32: Use of_device_get_match_data()
	serial: stm32: fix startup by enabling usart for reception
	serial: stm32: fix incorrect characters on console
	serial: stm32: fix TX and RX FIFO thresholds
	serial: stm32: fix a deadlock condition with wakeup event
	serial: stm32: fix wake-up flag handling
	serial: stm32: fix a deadlock in set_termios
	serial: stm32: fix tx dma completion, release channel
	serial: stm32: call stm32_transmit_chars locked
	serial: stm32: fix FIFO flush in startup and set_termios
	serial: stm32: add FIFO flush when port is closed
	serial: stm32: fix tx_empty condition
	usb: typec: tcpci: Check ROLE_CONTROL while interpreting CC_STATUS
	usb: typec: tps6598x: Fix return value check in tps6598x_probe()
	usb: typec: stusb160x: fix return value check in stusb160x_probe()
	regmap: set debugfs_name to NULL after it is freed
	spi: rockchip: avoid objtool warning
	mtd: rawnand: fsmc: Fix error code in fsmc_nand_probe()
	mtd: rawnand: brcmnand: fix OOB R/W with Hamming ECC
	mtd: Handle possible -EPROBE_DEFER from parse_mtd_partitions()
	mtd: rawnand: qcom: Return actual error code instead of -ENODEV
	mtd: don't lock when recursively deleting partitions
	mtd: maps: fix error return code of physmap_flash_remove()
	ARM: dts: stm32: fix usart 2 & 3 pinconf to wake up with flow control
	arm64: dts: qcom: sm8250: Fix level triggered PMU interrupt polarity
	arm64: dts: qcom: sm8250: Fix timer interrupt to specify EL2 physical timer
	arm64: dts: qcom: sdm845: fix number of pins in 'gpio-ranges'
	arm64: dts: qcom: sm8150: fix number of pins in 'gpio-ranges'
	arm64: dts: qcom: sm8250: fix number of pins in 'gpio-ranges'
	arm64: dts: qcom: db845c: fix correct powerdown pin for WSA881x
	crypto: sun8i-ss - Fix memory leak of object d when dma_iv fails to map
	spi: stm32: drop devres version of spi_register_master
	regulator: bd9576: Fix return from bd957x_probe()
	arm64: dts: renesas: r8a77980: Fix vin4-7 endpoint binding
	spi: stm32: Fix use-after-free on unbind
	x86/microcode: Check for offline CPUs before requesting new microcode
	devtmpfs: fix placement of complete() call
	usb: gadget: pch_udc: Replace cpu_to_le32() by lower_32_bits()
	usb: gadget: pch_udc: Check if driver is present before calling ->setup()
	usb: gadget: pch_udc: Check for DMA mapping error
	usb: gadget: pch_udc: Initialize device pointer before use
	usb: gadget: pch_udc: Provide a GPIO line used on Intel Minnowboard (v1)
	crypto: ccp - fix command queuing to TEE ring buffer
	crypto: qat - don't release uninitialized resources
	crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init
	fotg210-udc: Fix DMA on EP0 for length > max packet size
	fotg210-udc: Fix EP0 IN requests bigger than two packets
	fotg210-udc: Remove a dubious condition leading to fotg210_done
	fotg210-udc: Mask GRP2 interrupts we don't handle
	fotg210-udc: Don't DMA more than the buffer can take
	fotg210-udc: Complete OUT requests on short packets
	usb: gadget: s3c: Fix incorrect resources releasing
	usb: gadget: s3c: Fix the error handling path in 's3c2410_udc_probe()'
	dt-bindings: serial: stm32: Use 'type: object' instead of false for 'additionalProperties'
	mtd: require write permissions for locking and badblock ioctls
	arm64: dts: renesas: r8a779a0: Fix PMU interrupt
	bus: qcom: Put child node before return
	soundwire: bus: Fix device found flag correctly
	phy: ti: j721e-wiz: Delete "clk_div_sel" clk provider during cleanup
	phy: marvell: ARMADA375_USBCLUSTER_PHY should not default to y, unconditionally
	arm64: dts: mediatek: fix reset GPIO level on pumpkin
	NFSD: Fix sparse warning in nfs4proc.c
	NFSv4.2: fix copy stateid copying for the async copy
	crypto: poly1305 - fix poly1305_core_setkey() declaration
	crypto: qat - fix error path in adf_isr_resource_alloc()
	usb: gadget: aspeed: fix dma map failure
	USB: gadget: udc: fix wrong pointer passed to IS_ERR() and PTR_ERR()
	drivers: nvmem: Fix voltage settings for QTI qfprom-efuse
	driver core: platform: Declare early_platform_cleanup() prototype
	memory: pl353: fix mask of ECC page_size config register
	soundwire: stream: fix memory leak in stream config error path
	m68k: mvme147,mvme16x: Don't wipe PCC timer config bits
	firmware: qcom_scm: Make __qcom_scm_is_call_available() return bool
	firmware: qcom_scm: Reduce locking section for __get_convention()
	firmware: qcom_scm: Workaround lack of "is available" call on SC7180
	iio: adc: Kconfig: make AD9467 depend on ADI_AXI_ADC symbol
	mtd: rawnand: gpmi: Fix a double free in gpmi_nand_init
	irqchip/gic-v3: Fix OF_BAD_ADDR error handling
	staging: comedi: tests: ni_routes_test: Fix compilation error
	staging: rtl8192u: Fix potential infinite loop
	staging: fwserial: fix TIOCSSERIAL implementation
	staging: fwserial: fix TIOCGSERIAL implementation
	staging: greybus: uart: fix unprivileged TIOCCSERIAL
	soc: qcom: pdr: Fix error return code in pdr_register_listener
	PM / devfreq: Use more accurate returned new_freq as resume_freq
	clocksource/drivers/timer-ti-dm: Fix posted mode status check order
	clocksource/drivers/timer-ti-dm: Add missing set_state_oneshot_stopped
	clocksource/drivers/ingenic_ost: Fix return value check in ingenic_ost_probe()
	spi: Fix use-after-free with devm_spi_alloc_*
	spi: fsl: add missing iounmap() on error in of_fsl_spi_probe()
	soc: qcom: mdt_loader: Validate that p_filesz < p_memsz
	soc: qcom: mdt_loader: Detect truncated read of segments
	PM: runtime: Replace inline function pm_runtime_callbacks_present()
	cpuidle: Fix ARM_QCOM_SPM_CPUIDLE configuration
	ACPI: CPPC: Replace cppc_attr with kobj_attribute
	crypto: allwinner - add missing CRYPTO_ prefix
	crypto: sun8i-ss - Fix memory leak of pad
	crypto: sa2ul - Fix memory leak of rxd
	crypto: qat - Fix a double free in adf_create_ring
	cpufreq: armada-37xx: Fix setting TBG parent for load levels
	clk: mvebu: armada-37xx-periph: remove .set_parent method for CPU PM clock
	cpufreq: armada-37xx: Fix the AVS value for load L1
	clk: mvebu: armada-37xx-periph: Fix switching CPU freq from 250 Mhz to 1 GHz
	clk: mvebu: armada-37xx-periph: Fix workaround for switching from L1 to L0
	cpufreq: armada-37xx: Fix driver cleanup when registration failed
	cpufreq: armada-37xx: Fix determining base CPU frequency
	spi: spi-zynqmp-gqspi: use wait_for_completion_timeout to make zynqmp_qspi_exec_op not interruptible
	spi: spi-zynqmp-gqspi: add mutex locking for exec_op
	spi: spi-zynqmp-gqspi: transmit dummy circles by using the controller's internal functionality
	spi: spi-zynqmp-gqspi: fix incorrect operating mode in zynqmp_qspi_read_op
	spi: fsl-lpspi: Fix PM reference leak in lpspi_prepare_xfer_hardware()
	usb: gadget: r8a66597: Add missing null check on return from platform_get_resource
	USB: cdc-acm: fix unprivileged TIOCCSERIAL
	USB: cdc-acm: fix TIOCGSERIAL implementation
	tty: actually undefine superseded ASYNC flags
	tty: fix return value for unsupported ioctls
	tty: Remove dead termiox code
	tty: fix return value for unsupported termiox ioctls
	serial: core: return early on unsupported ioctls
	firmware: qcom-scm: Fix QCOM_SCM configuration
	node: fix device cleanups in error handling code
	crypto: chelsio - Read rxchannel-id from firmware
	usbip: vudc: fix missing unlock on error in usbip_sockfd_store()
	m68k: Add missing mmap_read_lock() to sys_cacheflush()
	spi: spi-zynqmp-gqspi: Fix missing unlock on error in zynqmp_qspi_exec_op()
	memory: renesas-rpc-if: fix possible NULL pointer dereference of resource
	memory: samsung: exynos5422-dmc: handle clk_set_parent() failure
	security: keys: trusted: fix TPM2 authorizations
	platform/x86: pmc_atom: Match all Beckhoff Automation baytrail boards with critclk_systems DMI table
	ARM: dts: aspeed: Rainier: Fix humidity sensor bus address
	Drivers: hv: vmbus: Use after free in __vmbus_open()
	spi: spi-zynqmp-gqspi: fix clk_enable/disable imbalance issue
	spi: spi-zynqmp-gqspi: fix hang issue when suspend/resume
	spi: spi-zynqmp-gqspi: fix use-after-free in zynqmp_qspi_exec_op
	spi: spi-zynqmp-gqspi: return -ENOMEM if dma_map_single fails
	x86/platform/uv: Fix !KEXEC build failure
	hwmon: (pmbus/pxe1610) don't bail out when not all pages are active
	Drivers: hv: vmbus: Increase wait time for VMbus unload
	PM: hibernate: x86: Use crc32 instead of md5 for hibernation e820 integrity check
	usb: dwc2: Fix host mode hibernation exit with remote wakeup flow.
	usb: dwc2: Fix hibernation between host and device modes.
	ttyprintk: Add TTY hangup callback.
	serial: omap: don't disable rs485 if rts gpio is missing
	serial: omap: fix rs485 half-duplex filtering
	xen-blkback: fix compatibility bug with single page rings
	soc: aspeed: fix a ternary sign expansion bug
	drm/tilcdc: send vblank event when disabling crtc
	drm/stm: Fix bus_flags handling
	drm/amd/display: Fix off by one in hdmi_14_process_transaction()
	drm/mcde/panel: Inverse misunderstood flag
	sched/fair: Fix shift-out-of-bounds in load_balance()
	afs: Fix updating of i_mode due to 3rd party change
	rcu: Remove spurious instrumentation_end() in rcu_nmi_enter()
	media: vivid: fix assignment of dev->fbuf_out_flags
	media: saa7134: use sg_dma_len when building pgtable
	media: saa7146: use sg_dma_len when building pgtable
	media: omap4iss: return error code when omap4iss_get() failed
	media: rkisp1: rsz: crash fix when setting src format
	media: aspeed: fix clock handling logic
	drm/probe-helper: Check epoch counter in output_poll_execute()
	media: venus: core: Fix some resource leaks in the error path of 'venus_probe()'
	media: platform: sunxi: sun6i-csi: fix error return code of sun6i_video_start_streaming()
	media: m88ds3103: fix return value check in m88ds3103_probe()
	media: docs: Fix data organization of MEDIA_BUS_FMT_RGB101010_1X30
	media: [next] staging: media: atomisp: fix memory leak of object flash
	media: atomisp: Fixed error handling path
	media: m88rs6000t: avoid potential out-of-bounds reads on arrays
	media: atomisp: Fix use after free in atomisp_alloc_css_stat_bufs()
	drm/amdkfd: fix build error with AMD_IOMMU_V2=m
	of: overlay: fix for_each_child.cocci warnings
	x86/kprobes: Fix to check non boostable prefixes correctly
	selftests: fix prepending $(OUTPUT) to $(TEST_PROGS)
	pata_arasan_cf: fix IRQ check
	pata_ipx4xx_cf: fix IRQ check
	sata_mv: add IRQ checks
	ata: libahci_platform: fix IRQ check
	seccomp: Fix CONFIG tests for Seccomp_filters
	nvme-tcp: block BH in sk state_change sk callback
	nvmet-tcp: fix incorrect locking in state_change sk callback
	clk: imx: Fix reparenting of UARTs not associated with stdout
	power: supply: bq25980: Move props from battery node
	nvme: retrigger ANA log update if group descriptor isn't found
	media: i2c: imx219: Move out locking/unlocking of vflip and hflip controls from imx219_set_stream
	media: i2c: imx219: Balance runtime PM use-count
	media: v4l2-ctrls.c: fix race condition in hdl->requests list
	vfio/fsl-mc: Re-order vfio_fsl_mc_probe()
	vfio/pci: Move VGA and VF initialization to functions
	vfio/pci: Re-order vfio_pci_probe()
	vfio/mdev: Do not allow a mdev_type to have a NULL parent pointer
	clk: zynqmp: move zynqmp_pll_set_mode out of round_rate callback
	clk: zynqmp: pll: add set_pll_mode to check condition in zynqmp_pll_enable
	drm: xlnx: zynqmp: fix a memset in zynqmp_dp_train()
	clk: qcom: a53-pll: Add missing MODULE_DEVICE_TABLE
	clk: qcom: apss-ipq-pll: Add missing MODULE_DEVICE_TABLE
	drm/amd/display: use GFP_ATOMIC in dcn20_resource_construct
	drm/radeon: Fix a missing check bug in radeon_dp_mst_detect()
	clk: uniphier: Fix potential infinite loop
	scsi: pm80xx: Increase timeout for pm80xx mpi_uninit_check()
	scsi: pm80xx: Fix potential infinite loop
	scsi: ufs: ufshcd-pltfrm: Fix deferred probing
	scsi: hisi_sas: Fix IRQ checks
	scsi: jazz_esp: Add IRQ check
	scsi: sun3x_esp: Add IRQ check
	scsi: sni_53c710: Add IRQ check
	scsi: ibmvfc: Fix invalid state machine BUG_ON()
	mailbox: sprd: Introduce refcnt when clients requests/free channels
	mfd: stm32-timers: Avoid clearing auto reload register
	nvmet-tcp: fix a segmentation fault during io parsing error
	nvme-pci: don't simple map sgl when sgls are disabled
	media: cedrus: Fix H265 status definitions
	HSI: core: fix resource leaks in hsi_add_client_from_dt()
	x86/events/amd/iommu: Fix sysfs type mismatch
	perf/amd/uncore: Fix sysfs type mismatch
	io_uring: fix overflows checks in provide buffers
	sched/debug: Fix cgroup_path[] serialization
	drivers/block/null_blk/main: Fix a double free in null_init.
	xsk: Respect device's headroom and tailroom on generic xmit path
	HID: plantronics: Workaround for double volume key presses
	perf symbols: Fix dso__fprintf_symbols_by_name() to return the number of printed chars
	ASoC: Intel: boards: sof-wm8804: add check for PLL setting
	ASoC: Intel: Skylake: Compile when any configuration is selected
	RDMA/mlx5: Fix mlx5 rates to IB rates map
	wilc1000: write value to WILC_INTR2_ENABLE register
	KVM: x86/mmu: Retry page faults that hit an invalid memslot
	Bluetooth: avoid deadlock between hci_dev->lock and socket lock
	net: lapbether: Prevent racing when checking whether the netif is running
	libbpf: Add explicit padding to bpf_xdp_set_link_opts
	bpftool: Fix maybe-uninitialized warnings
	iommu: Check dev->iommu in iommu_dev_xxx functions
	iommu/vt-d: Reject unsupported page request modes
	selftests/bpf: Re-generate vmlinux.h and BPF skeletons if bpftool changed
	libbpf: Add explicit padding to btf_dump_emit_type_decl_opts
	powerpc/fadump: Mark fadump_calculate_reserve_size as __init
	powerpc/prom: Mark identical_pvr_fixup as __init
	MIPS: fix local_irq_{disable,enable} in asmmacro.h
	ima: Fix the error code for restoring the PCR value
	inet: use bigger hash table for IP ID generation
	pinctrl: pinctrl-single: remove unused parameter
	pinctrl: pinctrl-single: fix pcs_pin_dbg_show() when bits_per_mux is not zero
	MIPS: loongson64: fix bug when PAGE_SIZE > 16KB
	ASoC: wm8960: Remove bitclk relax condition in wm8960_configure_sysclk
	iommu/arm-smmu-v3: add bit field SFM into GERROR_ERR_MASK
	RDMA/mlx5: Fix drop packet rule in egress table
	IB/isert: Fix a use after free in isert_connect_request
	powerpc: Fix HAVE_HARDLOCKUP_DETECTOR_ARCH build configuration
	MIPS/bpf: Enable bpf_probe_read{, str}() on MIPS again
	gpio: guard gpiochip_irqchip_add_domain() with GPIOLIB_IRQCHIP
	ALSA: core: remove redundant spin_lock pair in snd_card_disconnect
	net: phy: lan87xx: fix access to wrong register of LAN87xx
	udp: never accept GSO_FRAGLIST packets
	powerpc/pseries: Only register vio drivers if vio bus exists
	net/tipc: fix missing destroy_workqueue() on error in tipc_crypto_start()
	bug: Remove redundant condition check in report_bug
	RDMA/core: Fix corrupted SL on passive side
	nfc: pn533: prevent potential memory corruption
	net: hns3: Limiting the scope of vector_ring_chain variable
	mips: bmips: fix syscon-reboot nodes
	iommu/vt-d: Don't set then clear private data in prq_event_thread()
	iommu: Fix a boundary issue to avoid performance drop
	iommu/vt-d: Report right snoop capability when using FL for IOVA
	iommu/vt-d: Report the right page fault address
	iommu/vt-d: Preset Access/Dirty bits for IOVA over FL
	iommu/vt-d: Remove WO permissions on second-level paging entries
	iommu/vt-d: Invalidate PASID cache when root/context entry changed
	ALSA: usb-audio: Add error checks for usb_driver_claim_interface() calls
	HID: lenovo: Use brightness_set_blocking callback for setting LEDs brightness
	HID: lenovo: Fix lenovo_led_set_tp10ubkbd() error handling
	HID: lenovo: Check hid_get_drvdata() returns non NULL in lenovo_event()
	HID: lenovo: Map mic-mute button to KEY_F20 instead of KEY_MICMUTE
	KVM: arm64: Initialize VCPU mdcr_el2 before loading it
	ASoC: simple-card: fix possible uninitialized single_cpu local variable
	liquidio: Fix unintented sign extension of a left shift of a u16
	IB/hfi1: Use kzalloc() for mmu_rb_handler allocation
	powerpc/64s: Fix pte update for kernel memory on radix
	powerpc/perf: Fix PMU constraint check for EBB events
	powerpc: iommu: fix build when neither PCI or IBMVIO is set
	mac80211: bail out if cipher schemes are invalid
	perf vendor events amd: Fix broken L2 Cache Hits from L2 HWPF metric
	xfs: fix return of uninitialized value in variable error
	rtw88: Fix an error code in rtw_debugfs_set_rsvd_page()
	mt7601u: fix always true expression
	mt76: mt7615: fix tx skb dma unmap
	mt76: mt7915: fix tx skb dma unmap
	mt76: mt7915: fix aggr len debugfs node
	mt76: mt7615: fix mib stats counter reporting to mac80211
	mt76: mt7915: fix mib stats counter reporting to mac80211
	mt76: mt7663s: make all of packets 4-bytes aligned in sdio tx aggregation
	mt76: mt7663s: fix the possible device hang in high traffic
	KVM: PPC: Book3S HV P9: Restore host CTRL SPR after guest exit
	ovl: invalidate readdir cache on changes to dir with origin
	RDMA/qedr: Fix error return code in qedr_iw_connect()
	IB/hfi1: Fix error return code in parse_platform_config()
	RDMA/bnxt_re: Fix error return code in bnxt_qplib_cq_process_terminal()
	cxgb4: Fix unintentional sign extension issues
	net: thunderx: Fix unintentional sign extension issue
	RDMA/srpt: Fix error return code in srpt_cm_req_recv()
	RDMA/rtrs-clt: destroy sysfs after removing session from active list
	i2c: cadence: fix reference leak when pm_runtime_get_sync fails
	i2c: img-scb: fix reference leak when pm_runtime_get_sync fails
	i2c: imx-lpi2c: fix reference leak when pm_runtime_get_sync fails
	i2c: imx: fix reference leak when pm_runtime_get_sync fails
	i2c: omap: fix reference leak when pm_runtime_get_sync fails
	i2c: sprd: fix reference leak when pm_runtime_get_sync fails
	i2c: stm32f7: fix reference leak when pm_runtime_get_sync fails
	i2c: xiic: fix reference leak when pm_runtime_get_sync fails
	i2c: cadence: add IRQ check
	i2c: emev2: add IRQ check
	i2c: jz4780: add IRQ check
	i2c: mlxbf: add IRQ check
	i2c: rcar: make sure irq is not threaded on Gen2 and earlier
	i2c: rcar: protect against supurious interrupts on V3U
	i2c: rcar: add IRQ check
	i2c: sh7760: add IRQ check
	powerpc/xive: Drop check on irq_data in xive_core_debug_show()
	powerpc/xive: Fix xmon command "dxi"
	ASoC: ak5558: correct reset polarity
	net/mlx5: Fix bit-wise and with zero
	net/packet: make packet_fanout.arr size configurable up to 64K
	net/packet: remove data races in fanout operations
	drm/i915/gvt: Fix error code in intel_gvt_init_device()
	iommu/amd: Put newline after closing bracket in warning
	perf beauty: Fix fsconfig generator
	drm/amd/pm: fix error code in smu_set_power_limit()
	MIPS: pci-legacy: stop using of_pci_range_to_resource
	powerpc/pseries: extract host bridge from pci_bus prior to bus removal
	powerpc/smp: Reintroduce cpu_core_mask
	KVM: x86: dump_vmcs should not assume GUEST_IA32_EFER is valid
	rtlwifi: 8821ae: upgrade PHY and RF parameters
	wlcore: fix overlapping snprintf arguments in debugfs
	i2c: sh7760: fix IRQ error path
	i2c: mediatek: Fix wrong dma sync flag
	mwl8k: Fix a double Free in mwl8k_probe_hw
	netfilter: nft_payload: fix C-VLAN offload support
	netfilter: nftables_offload: VLAN id needs host byteorder in flow dissector
	netfilter: nftables_offload: special ethertype handling for VLAN
	vsock/vmci: log once the failed queue pair allocation
	libbpf: Initialize the bpf_seq_printf parameters array field by field
	net: ethernet: ixp4xx: Set the DMA masks explicitly
	gro: fix napi_gro_frags() Fast GRO breakage due to IP alignment check
	RDMA/cxgb4: add missing qpid increment
	RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails
	ALSA: usb: midi: don't return -ENOMEM when usb_urb_ep_type_check fails
	sfc: ef10: fix TX queue lookup in TX event handling
	vsock/virtio: free queued packets when closing socket
	net: marvell: prestera: fix port event handling on init
	net: davinci_emac: Fix incorrect masking of tx and rx error channel
	mt76: mt7615: fix memleak when mt7615_unregister_device()
	crypto: ccp: Detect and reject "invalid" addresses destined for PSP
	nfp: devlink: initialize the devlink port attribute "lanes"
	net: stmmac: fix TSO and TBS feature enabling during driver open
	net: renesas: ravb: Fix a stuck issue when a lot of frames are received
	net: phy: intel-xway: enable integrated led functions
	RDMA/rxe: Fix a bug in rxe_fill_ip_info()
	RDMA/core: Add CM to restrack after successful attachment to a device
	powerpc/64: Fix the definition of the fixmap area
	ath9k: Fix error check in ath9k_hw_read_revisions() for PCI devices
	ath10k: Fix a use after free in ath10k_htc_send_bundle
	ath10k: Fix ath10k_wmi_tlv_op_pull_peer_stats_info() unlock without lock
	wlcore: Fix buffer overrun by snprintf due to incorrect buffer size
	powerpc/perf: Fix the threshold event selection for memory events in power10
	powerpc/52xx: Fix an invalid ASM expression ('addi' used instead of 'add')
	net: phy: marvell: fix m88e1011_set_downshift
	net: phy: marvell: fix m88e1111_set_downshift
	net: enetc: fix link error again
	bnxt_en: fix ternary sign extension bug in bnxt_show_temp()
	ARM: dts: uniphier: Change phy-mode to RGMII-ID to enable delay pins for RTL8211E
	arm64: dts: uniphier: Change phy-mode to RGMII-ID to enable delay pins for RTL8211E
	net: geneve: modify IP header check in geneve6_xmit_skb and geneve_xmit_skb
	selftests: net: mirror_gre_vlan_bridge_1q: Make an FDB entry static
	selftests: mlxsw: Remove a redundant if statement in tc_flower_scale test
	bnxt_en: Fix RX consumer index logic in the error path.
	KVM: VMX: Intercept FS/GS_BASE MSR accesses for 32-bit KVM
	net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send
	selftests/bpf: Fix BPF_CORE_READ_BITFIELD() macro
	selftests/bpf: Fix field existence CO-RE reloc tests
	selftests/bpf: Fix core_reloc test runner
	bpf: Fix propagation of 32 bit unsigned bounds from 64 bit bounds
	RDMA/siw: Fix a use after free in siw_alloc_mr
	RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res
	net: bridge: mcast: fix broken length + header check for MRDv6 Adv.
	net:nfc:digital: Fix a double free in digital_tg_recv_dep_req
	perf tools: Change fields type in perf_record_time_conv
	perf jit: Let convert_timestamp() to be backwards-compatible
	perf session: Add swap operation for event TIME_CONV
	ia64: fix EFI_DEBUG build
	kfifo: fix ternary sign extension bugs
	mm/sl?b.c: remove ctor argument from kmem_cache_flags
	mm: memcontrol: slab: fix obtain a reference to a freeing memcg
	mm/sparse: add the missing sparse_buffer_fini() in error branch
	mm/memory-failure: unnecessary amount of unmapping
	afs: Fix speculative status fetches
	bpf: Fix alu32 const subreg bound tracking on bitwise operations
	bpf, ringbuf: Deny reserve of buffers larger than ringbuf
	bpf: Prevent writable memory-mapping of read-only ringbuf pages
	arm64: Remove arm64_dma32_phys_limit and its uses
	net: Only allow init netns to set default tcp cong to a restricted algo
	smp: Fix smp_call_function_single_async prototype
	Revert "net/sctp: fix race condition in sctp_destroy_sock"
	sctp: delay auto_asconf init until binding the first addr
	Linux 5.10.37

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I5bee89c285d9dd72de967b0e70d96951ae4e06ae
2021-05-15 09:28:55 +02:00
Pablo Neira Ayuso
bc2e5321d7 netfilter: nftables_offload: special ethertype handling for VLAN
[ Upstream commit 783003f3bb ]

The nftables offload parser sets FLOW_DISSECTOR_KEY_BASIC .n_proto to the
ethertype field in the ethertype frame. However:

- FLOW_DISSECTOR_KEY_BASIC .n_proto field always stores either IPv4 or IPv6
  ethertypes.
- FLOW_DISSECTOR_KEY_VLAN .vlan_tpid stores either the 802.1q and 802.1ad
  ethertypes. Same as for FLOW_DISSECTOR_KEY_CVLAN.

This function adjusts the flow dissector to handle two scenarios:

1) FLOW_DISSECTOR_KEY_VLAN .vlan_tpid is set to 802.1q or 802.1ad.
   Then, transfer:
   - the .n_proto field to FLOW_DISSECTOR_KEY_VLAN .tpid.
   - the original FLOW_DISSECTOR_KEY_VLAN .tpid to the
     FLOW_DISSECTOR_KEY_CVLAN .tpid
   - the original FLOW_DISSECTOR_KEY_CVLAN .tpid to the .n_proto field.

2) .n_proto is set to 802.1q or 802.1ad. Then, transfer:
   - the .n_proto field to FLOW_DISSECTOR_KEY_VLAN .tpid.
   - the original FLOW_DISSECTOR_KEY_VLAN .tpid to the .n_proto field.

Fixes: a82055af59 ("netfilter: nft_payload: add VLAN offload support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-05-14 09:50:40 +02:00
Pablo Neira Ayuso
a7eb38aacc netfilter: nftables_offload: VLAN id needs host byteorder in flow dissector
[ Upstream commit ff4d90a89d ]

The flow dissector representation expects the VLAN id in host byteorder.
Add the NFT_OFFLOAD_F_NETWORK2HOST flag to swap the bytes from nft_cmp.

Fixes: a82055af59 ("netfilter: nft_payload: add VLAN offload support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-05-14 09:50:40 +02:00
Pablo Neira Ayuso
cf2de861b2 netfilter: nft_payload: fix C-VLAN offload support
[ Upstream commit 14c20643ef ]

- add another struct flow_dissector_key_vlan for C-VLAN
- update layer 3 dependency to allow to match on IPv4/IPv6

Fixes: 89d8fd44ab ("netfilter: nft_payload: add C-VLAN offload support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-05-14 09:50:40 +02:00
Greg Kroah-Hartman
bfac7b85a0 Merge 5.10.35 into android12-5.10
Changes in 5.10.35
	mips: Do not include hi and lo in clobber list for R6
	netfilter: conntrack: Make global sysctls readonly in non-init netns
	net: usb: ax88179_178a: initialize local variables before use
	igb: Enable RSS for Intel I211 Ethernet Controller
	bpf: Fix masking negation logic upon negative dst register
	bpf: Fix leakage of uninitialized bpf stack under speculation
	net: qrtr: Avoid potential use after free in MHI send
	perf data: Fix error return code in perf_data__create_dir()
	capabilities: require CAP_SETFCAP to map uid 0
	perf ftrace: Fix access to pid in array when setting a pid filter
	tools/cgroup/slabinfo.py: updated to work on current kernel
	driver core: add a min_align_mask field to struct device_dma_parameters
	swiotlb: add a IO_TLB_SIZE define
	swiotlb: factor out an io_tlb_offset helper
	swiotlb: factor out a nr_slots helper
	swiotlb: clean up swiotlb_tbl_unmap_single
	swiotlb: refactor swiotlb_tbl_map_single
	swiotlb: don't modify orig_addr in swiotlb_tbl_sync_single
	swiotlb: respect min_align_mask
	nvme-pci: set min_align_mask
	ovl: fix leaked dentry
	ovl: allow upperdir inside lowerdir
	ALSA: usb-audio: Add MIDI quirk for Vox ToneLab EX
	USB: Add LPM quirk for Lenovo ThinkPad USB-C Dock Gen2 Ethernet
	USB: Add reset-resume quirk for WD19's Realtek Hub
	platform/x86: thinkpad_acpi: Correct thermal sensor allocation
	perf/core: Fix unconditional security_locked_down() call
	vfio: Depend on MMU
	Linux 5.10.35

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Iff7d5abe7b821f453bbe4d9dad94dfd35fe0a082
2021-05-08 12:45:00 +02:00
Jonathon Reinhart
d3598eb391 netfilter: conntrack: Make global sysctls readonly in non-init netns
commit 2671fa4dc0 upstream.

These sysctls point to global variables:
- NF_SYSCTL_CT_MAX (&nf_conntrack_max)
- NF_SYSCTL_CT_EXPECT_MAX (&nf_ct_expect_max)
- NF_SYSCTL_CT_BUCKETS (&nf_conntrack_htable_size_user)

Because their data pointers are not updated to point to per-netns
structures, they must be marked read-only in a non-init_net ns.
Otherwise, changes in any net namespace are reflected in (leaked into)
all other net namespaces. This problem has existed since the
introduction of net namespaces.

The current logic marks them read-only only if the net namespace is
owned by an unprivileged user (other than init_user_ns).

Commit d0febd81ae ("netfilter: conntrack: re-visit sysctls in
unprivileged namespaces") "exposes all sysctls even if the namespace is
unpriviliged." Since we need to mark them readonly in any case, we can
forego the unprivileged user check altogether.

Fixes: d0febd81ae ("netfilter: conntrack: re-visit sysctls in unprivileged namespaces")
Signed-off-by: Jonathon Reinhart <Jonathon.Reinhart@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-05-07 11:04:31 +02:00
Greg Kroah-Hartman
32b16a3a3f This is the 5.10.32 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmCACCYACgkQONu9yGCS
 aT7BkA//ZVfIoUb4EThpqWz3qjHCxQ5jqOH3XT//a2hhAFBp8wZAe4JRf76oqKyz
 G+2ZPQFU+susfhvYQVcxp2C6A9XomRSlX00MqFsKVrcOPG/IL/iBdNgBma/ajG8R
 0ARmgTBZBt+3i3nED5i26SzBR3vFx0lrwU3zaZoivAQpDkzzHFte++s4lLqSEY8i
 rxEe0sUm6HpsXiuRPkNU2yH1/2immgypbIYNaaOjPGxIO4aKouPGIMZtEm5/w3Oi
 h+eDSQH8fCN5jJjX9sGIqiK1XJEeS+hyUPsSjKypytVkRLqHEXE3Dcau24giHfEm
 iWM8Xh16Nudvh0vnWNfsMGZeghKwgLr71OnW4AcPe6dCG7fh4cKvyAuXFneL2PeZ
 NgGEFKIsFNXtaPLNn8peot3TeSemMdkuc2ORdiq2OKmU1umkczF6Y5L38JxMWEnZ
 /FoPIhigqobF0AujaFK/wKu5eznZDGiZqRpluJLF2yZYbHAEiDjwemSb+Xa6tmpe
 wXFIhu6ipQlKhqFfIGo1sIKachXkk/CvKwbFPUYh+CjZGgls9nZH0sGSNVa+p2BY
 7k+I7CfRZgAjWd1W0UM5J2oZ2uVU66zBH3SwF2RBbsWhi+btvfzMhVQIK1FJwJFQ
 bsuVegUAwR5mSVlBk2QpLIDJ55BqPXOorba7i8CuAoUjETr1MEY=
 =YPgE
 -----END PGP SIGNATURE-----

Merge 5.10.32 into android12-5.10

Changes in 5.10.32
	net/sctp: fix race condition in sctp_destroy_sock
	mtd: rawnand: mtk: Fix WAITRDY break condition and timeout
	Input: nspire-keypad - enable interrupts only when opened
	gpio: sysfs: Obey valid_mask
	dmaengine: idxd: Fix clobbering of SWERR overflow bit on writeback
	dmaengine: idxd: fix delta_rec and crc size field for completion record
	dmaengine: idxd: fix opcap sysfs attribute output
	dmaengine: idxd: fix wq size store permission state
	dmaengine: dw: Make it dependent to HAS_IOMEM
	dmaengine: Fix a double free in dma_async_device_register
	dmaengine: plx_dma: add a missing put_device() on error path
	dmaengine: idxd: fix wq cleanup of WQCFG registers
	ACPI: x86: Call acpi_boot_table_init() after acpi_table_upgrade()
	ARM: dts: Drop duplicate sha2md5_fck to fix clk_disable race
	ARM: dts: Fix moving mmc devices with aliases for omap4 & 5
	lockdep: Add a missing initialization hint to the "INFO: Trying to register non-static key" message
	arc: kernel: Return -EFAULT if copy_to_user() fails
	iwlwifi: Fix softirq/hardirq disabling in iwl_pcie_enqueue_hcmd()
	xfrm: BEET mode doesn't support fragments for inner packets
	ASoC: max98373: Changed amp shutdown register as volatile
	ASoC: max98373: Added 30ms turn on/off time delay
	gpu/xen: Fix a use after free in xen_drm_drv_init
	neighbour: Disregard DEAD dst in neigh_update
	ARM: keystone: fix integer overflow warning
	ARM: omap1: fix building with clang IAS
	drm/msm: Fix a5xx/a6xx timestamps
	ASoC: fsl_esai: Fix TDM slot setup for I2S mode
	scsi: scsi_transport_srp: Don't block target in SRP_PORT_LOST state
	iwlwifi: add support for Qu with AX201 device
	net: ieee802154: stop dump llsec keys for monitors
	net: ieee802154: forbid monitor for add llsec key
	net: ieee802154: forbid monitor for del llsec key
	net: ieee802154: stop dump llsec devs for monitors
	net: ieee802154: forbid monitor for add llsec dev
	net: ieee802154: forbid monitor for del llsec dev
	net: ieee802154: stop dump llsec devkeys for monitors
	net: ieee802154: forbid monitor for add llsec devkey
	net: ieee802154: forbid monitor for del llsec devkey
	net: ieee802154: stop dump llsec seclevels for monitors
	net: ieee802154: forbid monitor for add llsec seclevel
	pcnet32: Use pci_resource_len to validate PCI resource
	mac80211: clear sta->fast_rx when STA removed from 4-addr VLAN
	virt_wifi: Return micros for BSS TSF values
	lib: fix kconfig dependency on ARCH_WANT_FRAME_POINTERS
	Input: s6sy761 - fix coordinate read bit shift
	Input: i8042 - fix Pegatron C15B ID entry
	HID: wacom: set EV_KEY and EV_ABS only for non-HID_GENERIC type of devices
	dm verity fec: fix misaligned RS roots IO
	readdir: make sure to verify directory entry for legacy interfaces too
	arm64: fix inline asm in load_unaligned_zeropad()
	arm64: alternatives: Move length validation in alternative_{insn, endif}
	vfio/pci: Add missing range check in vfio_pci_mmap
	riscv: Fix spelling mistake "SPARSEMEM" to "SPARSMEM"
	scsi: libsas: Reset num_scatter if libata marks qc as NODATA
	ixgbe: fix unbalanced device enable/disable in suspend/resume
	netfilter: flowtable: fix NAT IPv6 offload mangling
	netfilter: conntrack: do not print icmpv6 as unknown via /proc
	ice: Fix potential infinite loop when using u8 loop counter
	libnvdimm/region: Fix nvdimm_has_flush() to handle ND_REGION_ASYNC
	netfilter: bridge: add pre_exit hooks for ebtable unregistration
	netfilter: arp_tables: add pre_exit hook for table unregister
	libbpf: Fix potential NULL pointer dereference
	net: macb: fix the restore of cmp registers
	net/mlx5e: fix ingress_ifindex check in mlx5e_flower_parse_meta
	netfilter: nft_limit: avoid possible divide error in nft_limit_init
	net/mlx5e: Fix setting of RS FEC mode
	net: davicom: Fix regulator not turned off on failed probe
	net: sit: Unregister catch-all devices
	net: ip6_tunnel: Unregister catch-all devices
	mm: ptdump: fix build failure
	net: Make tcp_allowed_congestion_control readonly in non-init netns
	i40e: fix the panic when running bpf in xdpdrv mode
	ethtool: pause: make sure we init driver stats
	ia64: remove duplicate entries in generic_defconfig
	ia64: tools: remove inclusion of ia64-specific version of errno.h header
	ibmvnic: avoid calling napi_disable() twice
	ibmvnic: remove duplicate napi_schedule call in do_reset function
	ibmvnic: remove duplicate napi_schedule call in open function
	ch_ktls: Fix kernel panic
	ch_ktls: fix device connection close
	ch_ktls: tcb close causes tls connection failure
	ch_ktls: do not send snd_una update to TCB in middle
	gro: ensure frag0 meets IP header alignment
	ARM: OMAP2+: Fix warning for omap_init_time_of()
	ARM: 9069/1: NOMMU: Fix conversion for_each_membock() to for_each_mem_range()
	ARM: footbridge: fix PCI interrupt mapping
	ARM: OMAP2+: Fix uninitialized sr_inst
	arm64: dts: allwinner: Fix SD card CD GPIO for SOPine systems
	arm64: dts: allwinner: h6: beelink-gs1: Remove ext. 32 kHz osc reference
	bpf: Use correct permission flag for mixed signed bounds arithmetic
	KVM: VMX: Convert vcpu_vmx.exit_reason to a union
	KVM: VMX: Don't use vcpu->run->internal.ndata as an array index
	r8169: tweak max read request size for newer chips also in jumbo mtu mode
	r8169: don't advertise pause in jumbo mode
	bpf: Ensure off_reg has no mixed signed bounds for all types
	bpf: Move off_reg into sanitize_ptr_alu
	ARM: 9071/1: uprobes: Don't hook on thumb instructions
	arm64: mte: Ensure TIF_MTE_ASYNC_FAULT is set atomically
	bpf: Rework ptr_limit into alu_limit and add common error path
	bpf: Improve verifier error messages for users
	bpf: Move sanitize_val_alu out of op switch
	net: phy: marvell: fix detection of PHY on Topaz switches
	Linux 5.10.32

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: If247bf8401509195e4f55f03dcc514f80d467966
2021-04-22 11:12:08 +02:00
Eric Dumazet
dc1732baa9 netfilter: nft_limit: avoid possible divide error in nft_limit_init
commit b895bdf5d6 upstream.

div_u64() divides u64 by u32.

nft_limit_init() wants to divide u64 by u64, use the appropriate
math function (div64_u64)

divide error: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 8390 Comm: syz-executor188 Not tainted 5.12.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:div_u64_rem include/linux/math64.h:28 [inline]
RIP: 0010:div_u64 include/linux/math64.h:127 [inline]
RIP: 0010:nft_limit_init+0x2a2/0x5e0 net/netfilter/nft_limit.c:85
Code: ef 4c 01 eb 41 0f 92 c7 48 89 de e8 38 a5 22 fa 4d 85 ff 0f 85 97 02 00 00 e8 ea 9e 22 fa 4c 0f af f3 45 89 ed 31 d2 4c 89 f0 <49> f7 f5 49 89 c6 e8 d3 9e 22 fa 48 8d 7d 48 48 b8 00 00 00 00 00
RSP: 0018:ffffc90009447198 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000200000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff875152e6 RDI: 0000000000000003
RBP: ffff888020f80908 R08: 0000200000000000 R09: 0000000000000000
R10: ffffffff875152d8 R11: 0000000000000000 R12: ffffc90009447270
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS:  000000000097a300(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000200001c4 CR3: 0000000026a52000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 nf_tables_newexpr net/netfilter/nf_tables_api.c:2675 [inline]
 nft_expr_init+0x145/0x2d0 net/netfilter/nf_tables_api.c:2713
 nft_set_elem_expr_alloc+0x27/0x280 net/netfilter/nf_tables_api.c:5160
 nf_tables_newset+0x1997/0x3150 net/netfilter/nf_tables_api.c:4321
 nfnetlink_rcv_batch+0x85a/0x21b0 net/netfilter/nfnetlink.c:456
 nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:580 [inline]
 nfnetlink_rcv+0x3af/0x420 net/netfilter/nfnetlink.c:598
 netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline]
 netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1338
 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1927
 sock_sendmsg_nosec net/socket.c:654 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:674
 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2350
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2404
 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2433
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Fixes: c26844eda9 ("netfilter: nf_tables: Fix nft limit burst handling")
Fixes: 3e0f64b7dd ("netfilter: nft_limit: fix packet ratelimiting")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Diagnosed-by: Luigi Rizzo <lrizzo@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-04-21 13:00:56 +02:00
Pablo Neira Ayuso
783645e65b netfilter: conntrack: do not print icmpv6 as unknown via /proc
commit fbea31808c upstream.

/proc/net/nf_conntrack shows icmpv6 as unknown.

Fixes: 09ec82f5af ("netfilter: conntrack: remove protocol name from l4proto struct")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-04-21 13:00:55 +02:00