Commit Graph

222 Commits

Author SHA1 Message Date
Greg Kroah-Hartman
b558262fdc This is the 5.10.60 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmEcsVUACgkQONu9yGCS
 aT7r0xAAtwJSVAboFmw/R7pyRzsveDo8KdTATgOKRRmGk/fJIodSHXwPTcPtKSRO
 k09OnEU777t67+3pfS6PA2lNCWhE+Z3PlFVn6b8G8xR1o14vpwNg3aiGNGSqd8aL
 edA4TrqTBb7nu8Bhg1nPdSiKSK2UTPDYlBo+jF6j6YU1dVe/yMy2D4bVOGotPxTn
 WVFmlmEtHDN22q67rEjLAU+wvtn/nRJle/0b2gj32BB+CJqLyjHKH+aUmk9shMfP
 CCkzX+CjhEOz4Sooh0v3aYsyJ4N6AiCAaT4SYy/pnT1RV/b9aw4f+ddrg3xo8SnI
 2C9/i2EzsZc2UnzoFld1R15YrdZfIWOLaiU6enIis5ziBDuxZ5nd5VOHV99BzhUH
 nEY65Ob3Wr8LVSgFTo61uk5R0z0WjQMwSvW1uaauxMUQN7Q2645VJsPomPNlmp8I
 pNBSLj5uz76cxh+ciZNS4HgtwXNUHolhRHl5nvHxMKH0i1+9xQ1vKs1sKMpDYGFe
 2lqg8eGe8lGrwpg0w4oKHyVP2fgj7yk3FvU3/pXX8BleolmQ3xkwkztofKaMorJP
 s9eQIw/2U3j/xBqhXoIbTjBuXl+5MjfbOG4xeK0v/oohrDw0IvT7KuO6TYUXhlbh
 CniUBfItbgGzXyQiwgwgEbS8upz+nK6IDdNEAV5dGn6gG6w4ajk=
 =/0MF
 -----END PGP SIGNATURE-----

Merge 5.10.60 into android12-5.10-lts

Changes in 5.10.60
	iio: adc: ti-ads7950: Ensure CS is deasserted after reading channels
	iio: adis: set GPIO reset pin direction
	iio: humidity: hdc100x: Add margin to the conversion time
	iio: adc: Fix incorrect exit of for-loop
	ASoC: amd: Fix reference to PCM buffer address
	ASoC: xilinx: Fix reference to PCM buffer address
	ASoC: uniphier: Fix reference to PCM buffer address
	ASoC: tlv320aic31xx: Fix jack detection after suspend
	ASoC: intel: atom: Fix reference to PCM buffer address
	i2c: dev: zero out array used for i2c reads from userspace
	cifs: create sd context must be a multiple of 8
	scsi: lpfc: Move initialization of phba->poll_list earlier to avoid crash
	seccomp: Fix setting loaded filter count during TSYNC
	net: ethernet: ti: cpsw: fix min eth packet size for non-switch use-cases
	ARC: fp: set FPU_STATUS.FWE to enable FPU_STATUS update on context switch
	ceph: reduce contention in ceph_check_delayed_caps()
	ACPI: NFIT: Fix support for virtual SPA ranges
	libnvdimm/region: Fix label activation vs errors
	drm/amd/display: Remove invalid assert for ODM + MPC case
	drm/amd/display: use GFP_ATOMIC in amdgpu_dm_irq_schedule_work
	drm/amdgpu: don't enable baco on boco platforms in runpm
	ieee802154: hwsim: fix GPF in hwsim_set_edge_lqi
	ieee802154: hwsim: fix GPF in hwsim_new_edge_nl
	pinctrl: mediatek: Fix fallback behavior for bias_set_combo
	ASoC: cs42l42: Correct definition of ADC Volume control
	ASoC: cs42l42: Don't allow SND_SOC_DAIFMT_LEFT_J
	ASoC: SOF: Intel: hda-ipc: fix reply size checking
	ASoC: cs42l42: Fix inversion of ADC Notch Switch control
	ASoC: cs42l42: Remove duplicate control for WNF filter frequency
	netfilter: nf_conntrack_bridge: Fix memory leak when error
	pinctrl: tigerlake: Fix GPIO mapping for newer version of software
	ASoC: cs42l42: Fix LRCLK frame start edge
	net: dsa: mt7530: add the missing RxUnicast MIB counter
	net: mvvp2: fix short frame size on s390
	platform/x86: pcengines-apuv2: Add missing terminating entries to gpio-lookup tables
	libbpf: Fix probe for BPF_PROG_TYPE_CGROUP_SOCKOPT
	bpf: Fix integer overflow involving bucket_size
	net: phy: micrel: Fix link detection on ksz87xx switch"
	ppp: Fix generating ifname when empty IFLA_IFNAME is specified
	net/smc: fix wait on already cleared link
	net: sched: act_mirred: Reset ct info when mirror/redirect skb
	ice: Prevent probing virtual functions
	ice: don't remove netdev->dev_addr from uc sync list
	iavf: Set RSS LUT and key in reset handle path
	psample: Add a fwd declaration for skbuff
	bareudp: Fix invalid read beyond skb's linear data
	net/mlx5: Synchronize correct IRQ when destroying CQ
	net/mlx5: Fix return value from tracer initialization
	drm/meson: fix colour distortion from HDR set during vendor u-boot
	net: dsa: microchip: Fix ksz_read64()
	net: dsa: microchip: ksz8795: Fix VLAN filtering
	net: Fix memory leak in ieee802154_raw_deliver
	net: igmp: fix data-race in igmp_ifc_timer_expire()
	net: dsa: lan9303: fix broken backpressure in .port_fdb_dump
	net: dsa: lantiq: fix broken backpressure in .port_fdb_dump
	net: dsa: sja1105: fix broken backpressure in .port_fdb_dump
	net: bridge: validate the NUD_PERMANENT bit when adding an extern_learn FDB entry
	net: bridge: fix flags interpretation for extern learn fdb entries
	net: bridge: fix memleak in br_add_if()
	net: linkwatch: fix failure to restore device state across suspend/resume
	tcp_bbr: fix u32 wrap bug in round logic if bbr_init() called after 2B packets
	net: igmp: increase size of mr_ifc_count
	drm/i915: Only access SFC_DONE when media domain is not fused off
	xen/events: Fix race in set_evtchn_to_irq
	vsock/virtio: avoid potential deadlock when vsock device remove
	nbd: Aovid double completion of a request
	arm64: efi: kaslr: Fix occasional random alloc (and boot) failure
	efi/libstub: arm64: Force Image reallocation if BSS was not reserved
	efi/libstub: arm64: Relax 2M alignment again for relocatable kernels
	powerpc/kprobes: Fix kprobe Oops happens in booke
	x86/tools: Fix objdump version check again
	genirq: Provide IRQCHIP_AFFINITY_PRE_STARTUP
	x86/msi: Force affinity setup before startup
	x86/ioapic: Force affinity setup before startup
	x86/resctrl: Fix default monitoring groups reporting
	genirq/msi: Ensure deactivation on teardown
	genirq/timings: Prevent potential array overflow in __irq_timings_store()
	PCI/MSI: Enable and mask MSI-X early
	PCI/MSI: Mask all unused MSI-X entries
	PCI/MSI: Enforce that MSI-X table entry is masked for update
	PCI/MSI: Enforce MSI[X] entry updates to be visible
	PCI/MSI: Do not set invalid bits in MSI mask
	PCI/MSI: Correct misleading comments
	PCI/MSI: Use msi_mask_irq() in pci_msi_shutdown()
	PCI/MSI: Protect msi_desc::masked for multi-MSI
	powerpc/smp: Fix OOPS in topology_init()
	efi/libstub: arm64: Double check image alignment at entry
	KVM: VMX: Use current VMCS to query WAITPKG support for MSR emulation
	KVM: nVMX: Use vmx_need_pf_intercept() when deciding if L0 wants a #PF
	vboxsf: Add vboxsf_[create|release]_sf_handle() helpers
	vboxsf: Add support for the atomic_open directory-inode op
	ceph: add some lockdep assertions around snaprealm handling
	ceph: clean up locking annotation for ceph_get_snap_realm and __lookup_snap_realm
	ceph: take snap_empty_lock atomically with snaprealm refcount change
	vmlinux.lds.h: Handle clang's module.{c,d}tor sections
	KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl (CVE-2021-3653)
	KVM: nSVM: always intercept VMLOAD/VMSAVE when nested (CVE-2021-3656)
	net: dsa: microchip: Fix probing KSZ87xx switch with DT node for host port
	net: dsa: microchip: ksz8795: Fix PVID tag insertion
	net: dsa: microchip: ksz8795: Reject unsupported VLAN configuration
	net: dsa: microchip: ksz8795: Fix VLAN untagged flag change on deletion
	net: dsa: microchip: ksz8795: Use software untagging on CPU port
	Linux 5.10.60

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I7d55aed1883b31ba2d9b8dfad4bc33e1efbcbd2f
2021-08-27 17:14:51 +02:00
Longpeng(Mike)
f5cefe9a52 vsock/virtio: avoid potential deadlock when vsock device remove
[ Upstream commit 49b0b6ffe2 ]

There's a potential deadlock case when remove the vsock device or
process the RESET event:

  vsock_for_each_connected_socket:
      spin_lock_bh(&vsock_table_lock) ----------- (1)
      ...
          virtio_vsock_reset_sock:
              lock_sock(sk) --------------------- (2)
      ...
      spin_unlock_bh(&vsock_table_lock)

lock_sock() may do initiative schedule when the 'sk' is owned by
other thread at the same time, we would receivce a warning message
that "scheduling while atomic".

Even worse, if the next task (selected by the scheduler) try to
release a 'sk', it need to request vsock_table_lock and the deadlock
occur, cause the system into softlockup state.
  Call trace:
   queued_spin_lock_slowpath
   vsock_remove_bound
   vsock_remove_sock
   virtio_transport_release
   __vsock_release
   vsock_release
   __sock_release
   sock_close
   __fput
   ____fput

So we should not require sk_lock in this case, just like the behavior
in vhost_vsock or vmci.

Fixes: 0ea9e1d3a9 ("VSOCK: Introduce virtio_transport.ko")
Cc: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Longpeng(Mike) <longpeng2@huawei.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Link: https://lore.kernel.org/r/20210812053056.1699-1-longpeng2@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-08-18 08:59:14 +02:00
Greg Kroah-Hartman
8db62be3c3 This is the 5.10.51 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmD1LZUACgkQONu9yGCS
 aT7gERAArjYemBSkD4/nq5HvxoVu7ueEyqI2orJCyB6b5npPrBZjlKna3SuYuNUF
 CmcX5Y2Ynxd3gWJvYFEJdAAQAEtKAzPdPv0QJ+KiLSP2bEZ4Q5grEJXfzcgxcB4L
 fUfaCZnUwjoII5xzW1+U2zCJ7YtGx5hZySLKMxSEc0IzawDlfMx4HdwlohXzczsA
 Zq3/sTJcW30PWSp6MSuMOH//lPh7sAoCnksAv4Yb8MZYZjC8JNnKFn+IwRUGWEMZ
 sFtNbq51sMgGq4TjYBIdO6wBElP4dgWJhYc4cO0667cDvgp6iod/bKlOLJSiwIVX
 uPWkyPihH9ZUvNVY0TxjjnxS1rnM0QhH+cEXNGn+SE7KaNmzsI2MaR+DVA2yWcFr
 9edqTq5x2CJJ0R/oXHP4nYFtsvlV/QcirlrF0OZHYwz84b16f37Ac7tHOQpr3kNO
 N29AW0l5XmpxbfHgo1Iaoi02seouLC47vRkvjTpS9mValGUC0ciXTb97CK4FremE
 34rskxIRWBU8HECYioFOeHTAi0+xb/9tOj87BnB5CJ28CD2Md27TTdorsISnqPb0
 /ER89QfVtlJLi17wGB0rlAm8fDF3Cy6BnA57QIql1z1NbJGc1cxenEAFiIOnbQ5G
 t6SLs3mgqpQizsKUFYimCWa04ZzY4Bg8H9bAI+M+9w7J6yujQzI=
 =dGMa
 -----END PGP SIGNATURE-----

Merge 5.10.51 into android12-5.10-lts

Changes in 5.10.51
	drm/mxsfb: Don't select DRM_KMS_FB_HELPER
	drm/zte: Don't select DRM_KMS_FB_HELPER
	drm/ast: Fixed CVE for DP501
	drm/amd/display: fix HDCP reset sequence on reinitialize
	drm/amd/amdgpu/sriov disable all ip hw status by default
	drm/vc4: fix argument ordering in vc4_crtc_get_margins()
	drm/bridge: nwl-dsi: Force a full modeset when crtc_state->active is changed to be true
	net: pch_gbe: Use proper accessors to BE data in pch_ptp_match()
	drm/amd/display: fix use_max_lb flag for 420 pixel formats
	clk: renesas: rcar-usb2-clock-sel: Fix error handling in .probe()
	hugetlb: clear huge pte during flush function on mips platform
	atm: iphase: fix possible use-after-free in ia_module_exit()
	mISDN: fix possible use-after-free in HFC_cleanup()
	atm: nicstar: Fix possible use-after-free in nicstar_cleanup()
	net: Treat __napi_schedule_irqoff() as __napi_schedule() on PREEMPT_RT
	drm/mediatek: Fix PM reference leak in mtk_crtc_ddp_hw_init()
	net: mdio: ipq8064: add regmap config to disable REGCACHE
	drm/bridge: lt9611: Add missing MODULE_DEVICE_TABLE
	reiserfs: add check for invalid 1st journal block
	drm/virtio: Fix double free on probe failure
	net: mdio: provide shim implementation of devm_of_mdiobus_register
	net/sched: cls_api: increase max_reclassify_loop
	pinctrl: equilibrium: Add missing MODULE_DEVICE_TABLE
	drm/scheduler: Fix hang when sched_entity released
	drm/sched: Avoid data corruptions
	udf: Fix NULL pointer dereference in udf_symlink function
	drm/vc4: Fix clock source for VEC PixelValve on BCM2711
	drm/vc4: hdmi: Fix PM reference leak in vc4_hdmi_encoder_pre_crtc_co()
	e100: handle eeprom as little endian
	igb: handle vlan types with checker enabled
	igb: fix assignment on big endian machines
	drm/bridge: cdns: Fix PM reference leak in cdns_dsi_transfer()
	clk: renesas: r8a77995: Add ZA2 clock
	net/mlx5e: IPsec/rep_tc: Fix rep_tc_update_skb drops IPsec packet
	net/mlx5: Fix lag port remapping logic
	drm: rockchip: add missing registers for RK3188
	drm: rockchip: add missing registers for RK3066
	net: stmmac: the XPCS obscures a potential "PHY not found" error
	RDMA/rtrs: Change MAX_SESS_QUEUE_DEPTH
	clk: tegra: Fix refcounting of gate clocks
	clk: tegra: Ensure that PLLU configuration is applied properly
	drm: bridge: cdns-mhdp8546: Fix PM reference leak in
	virtio-net: Add validation for used length
	ipv6: use prandom_u32() for ID generation
	MIPS: cpu-probe: Fix FPU detection on Ingenic JZ4760(B)
	MIPS: ingenic: Select CPU_SUPPORTS_CPUFREQ && MIPS_EXTERNAL_TIMER
	drm/amd/display: Avoid HDCP over-read and corruption
	drm/amdgpu: remove unsafe optimization to drop preamble ib
	net: tcp better handling of reordering then loss cases
	RDMA/cxgb4: Fix missing error code in create_qp()
	dm space maps: don't reset space map allocation cursor when committing
	dm writecache: don't split bios when overwriting contiguous cache content
	dm: Fix dm_accept_partial_bio() relative to zone management commands
	net: bridge: mrp: Update ring transitions.
	pinctrl: mcp23s08: fix race condition in irq handler
	ice: set the value of global config lock timeout longer
	ice: fix clang warning regarding deadcode.DeadStores
	virtio_net: Remove BUG() to avoid machine dead
	net: mscc: ocelot: check return value after calling platform_get_resource()
	net: bcmgenet: check return value after calling platform_get_resource()
	net: mvpp2: check return value after calling platform_get_resource()
	net: micrel: check return value after calling platform_get_resource()
	net: moxa: Use devm_platform_get_and_ioremap_resource()
	drm/amd/display: Fix DCN 3.01 DSCCLK validation
	drm/amd/display: Update scaling settings on modeset
	drm/amd/display: Release MST resources on switch from MST to SST
	drm/amd/display: Set DISPCLK_MAX_ERRDET_CYCLES to 7
	drm/amd/display: Fix off-by-one error in DML
	net: phy: realtek: add delay to fix RXC generation issue
	selftests: Clean forgotten resources as part of cleanup()
	net: sgi: ioc3-eth: check return value after calling platform_get_resource()
	drm/amdkfd: use allowed domain for vmbo validation
	fjes: check return value after calling platform_get_resource()
	selinux: use __GFP_NOWARN with GFP_NOWAIT in the AVC
	r8169: avoid link-up interrupt issue on RTL8106e if user enables ASPM
	drm/amd/display: Verify Gamma & Degamma LUT sizes in amdgpu_dm_atomic_check
	xfrm: Fix error reporting in xfrm_state_construct.
	dm writecache: commit just one block, not a full page
	wlcore/wl12xx: Fix wl12xx get_mac error if device is in ELP
	wl1251: Fix possible buffer overflow in wl1251_cmd_scan
	cw1200: add missing MODULE_DEVICE_TABLE
	drm/amdkfd: fix circular locking on get_wave_state
	drm/amdkfd: Fix circular lock in nocpsch path
	bpf: Fix up register-based shifts in interpreter to silence KUBSAN
	ice: fix incorrect payload indicator on PTYPE
	ice: mark PTYPE 2 as reserved
	mt76: mt7615: fix fixed-rate tx status reporting
	net: fix mistake path for netdev_features_strings
	net: ipa: Add missing of_node_put() in ipa_firmware_load()
	net: sched: fix error return code in tcf_del_walker()
	io_uring: fix false WARN_ONCE
	drm/amdgpu: fix bad address translation for sienna_cichlid
	drm/amdkfd: Walk through list with dqm lock hold
	mt76: mt7915: fix IEEE80211_HE_PHY_CAP7_MAX_NC for station mode
	rtl8xxxu: Fix device info for RTL8192EU devices
	MIPS: add PMD table accounting into MIPS'pmd_alloc_one
	net: fec: add ndo_select_queue to fix TX bandwidth fluctuations
	atm: nicstar: use 'dma_free_coherent' instead of 'kfree'
	atm: nicstar: register the interrupt handler in the right place
	vsock: notify server to shutdown when client has pending signal
	RDMA/rxe: Don't overwrite errno from ib_umem_get()
	iwlwifi: mvm: don't change band on bound PHY contexts
	iwlwifi: mvm: fix error print when session protection ends
	iwlwifi: pcie: free IML DMA memory allocation
	iwlwifi: pcie: fix context info freeing
	sfc: avoid double pci_remove of VFs
	sfc: error code if SRIOV cannot be disabled
	wireless: wext-spy: Fix out-of-bounds warning
	cfg80211: fix default HE tx bitrate mask in 2G band
	mac80211: consider per-CPU statistics if present
	mac80211_hwsim: add concurrent channels scanning support over virtio
	IB/isert: Align target max I/O size to initiator size
	media, bpf: Do not copy more entries than user space requested
	net: ip: avoid OOM kills with large UDP sends over loopback
	RDMA/cma: Fix rdma_resolve_route() memory leak
	Bluetooth: btusb: Fixed too many in-token issue for Mediatek Chip.
	Bluetooth: Fix the HCI to MGMT status conversion table
	Bluetooth: Fix alt settings for incoming SCO with transparent coding format
	Bluetooth: Shutdown controller after workqueues are flushed or cancelled
	Bluetooth: btusb: Add a new QCA_ROME device (0cf3:e500)
	Bluetooth: L2CAP: Fix invalid access if ECRED Reconfigure fails
	Bluetooth: L2CAP: Fix invalid access on ECRED Connection response
	Bluetooth: btusb: Add support USB ALT 3 for WBS
	Bluetooth: mgmt: Fix the command returns garbage parameter value
	Bluetooth: btusb: fix bt fiwmare downloading failure issue for qca btsoc.
	sched/fair: Ensure _sum and _avg values stay consistent
	bpf: Fix false positive kmemleak report in bpf_ringbuf_area_alloc()
	flow_offload: action should not be NULL when it is referenced
	sctp: validate from_addr_param return
	sctp: add size validation when walking chunks
	MIPS: loongsoon64: Reserve memory below starting pfn to prevent Oops
	MIPS: set mips32r5 for virt extensions
	selftests/resctrl: Fix incorrect parsing of option "-t"
	MIPS: MT extensions are not available on MIPS32r1
	ath11k: unlock on error path in ath11k_mac_op_add_interface()
	arm64: dts: rockchip: add rk3328 dwc3 usb controller node
	arm64: dts: rockchip: Enable USB3 for rk3328 Rock64
	loop: fix I/O error on fsync() in detached loop devices
	mm,hwpoison: return -EBUSY when migration fails
	io_uring: simplify io_remove_personalities()
	io_uring: Convert personality_idr to XArray
	io_uring: convert io_buffer_idr to XArray
	scsi: iscsi: Fix race condition between login and sync thread
	scsi: iscsi: Fix iSCSI cls conn state
	powerpc/mm: Fix lockup on kernel exec fault
	powerpc/barrier: Avoid collision with clang's __lwsync macro
	powerpc/powernv/vas: Release reference to tgid during window close
	drm/amdgpu: Update NV SIMD-per-CU to 2
	drm/amdgpu: enable sdma0 tmz for Raven/Renoir(V2)
	drm/radeon: Add the missed drm_gem_object_put() in radeon_user_framebuffer_create()
	drm/radeon: Call radeon_suspend_kms() in radeon_pci_shutdown() for Loongson64
	drm/vc4: txp: Properly set the possible_crtcs mask
	drm/vc4: crtc: Skip the TXP
	drm/vc4: hdmi: Prevent clock unbalance
	drm/dp: Handle zeroed port counts in drm_dp_read_downstream_info()
	drm/rockchip: dsi: remove extra component_del() call
	drm/amd/display: fix incorrrect valid irq check
	pinctrl/amd: Add device HID for new AMD GPIO controller
	drm/amd/display: Reject non-zero src_y and src_x for video planes
	drm/tegra: Don't set allow_fb_modifiers explicitly
	drm/msm/mdp4: Fix modifier support enabling
	drm/arm/malidp: Always list modifiers
	drm/nouveau: Don't set allow_fb_modifiers explicitly
	drm/i915/display: Do not zero past infoframes.vsc
	mmc: sdhci-acpi: Disable write protect detection on Toshiba Encore 2 WT8-B
	mmc: sdhci: Fix warning message when accessing RPMB in HS400 mode
	mmc: core: clear flags before allowing to retune
	mmc: core: Allow UHS-I voltage switch for SDSC cards if supported
	ata: ahci_sunxi: Disable DIPM
	arm64: tlb: fix the TTL value of tlb_get_level
	cpu/hotplug: Cure the cpusets trainwreck
	clocksource/arm_arch_timer: Improve Allwinner A64 timer workaround
	fpga: stratix10-soc: Add missing fpga_mgr_free() call
	ASoC: tegra: Set driver_name=tegra for all machine drivers
	i40e: fix PTP on 5Gb links
	qemu_fw_cfg: Make fw_cfg_rev_attr a proper kobj_attribute
	ipmi/watchdog: Stop watchdog timer when the current action is 'none'
	thermal/drivers/int340x/processor_thermal: Fix tcc setting
	ubifs: Fix races between xattr_{set|get} and listxattr operations
	power: supply: ab8500: Fix an old bug
	mfd: syscon: Free the allocated name field of struct regmap_config
	nvmem: core: add a missing of_node_put
	lkdtm/bugs: XFAIL UNALIGNED_LOAD_STORE_WRITE
	selftests/lkdtm: Fix expected text for CR4 pinning
	extcon: intel-mrfld: Sync hardware and software state on init
	seq_buf: Fix overflow in seq_buf_putmem_hex()
	rq-qos: fix missed wake-ups in rq_qos_throttle try two
	tracing: Simplify & fix saved_tgids logic
	tracing: Resize tgid_map to pid_max, not PID_MAX_DEFAULT
	ipack/carriers/tpci200: Fix a double free in tpci200_pci_probe
	coresight: Propagate symlink failure
	coresight: tmc-etf: Fix global-out-of-bounds in tmc_update_etf_buffer()
	dm zoned: check zone capacity
	dm writecache: flush origin device when writing and cache is full
	dm btree remove: assign new_root only when removal succeeds
	PCI: Leave Apple Thunderbolt controllers on for s2idle or standby
	PCI: aardvark: Fix checking for PIO Non-posted Request
	PCI: aardvark: Implement workaround for the readback value of VEND_ID
	media: subdev: disallow ioctl for saa6588/davinci
	media: dtv5100: fix control-request directions
	media: zr364xx: fix memory leak in zr364xx_start_readpipe
	media: gspca/sq905: fix control-request direction
	media: gspca/sunplus: fix zero-length control requests
	media: uvcvideo: Fix pixel format change for Elgato Cam Link 4K
	io_uring: fix clear IORING_SETUP_R_DISABLED in wrong function
	dm writecache: write at least 4k when committing
	pinctrl: mcp23s08: Fix missing unlock on error in mcp23s08_irq()
	drm/ast: Remove reference to struct drm_device.pdev
	jfs: fix GPF in diFree
	smackfs: restrict bytes count in smk_set_cipso()
	ext4: fix memory leak in ext4_fill_super
	f2fs: fix to avoid racing on fsync_entry_slab by multi filesystem instances
	Linux 5.10.51

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Icb10fed733a0050848ecc23db13ae3d134895acd
2021-07-19 17:29:53 +02:00
Longpeng(Mike)
ee33c042f4 vsock: notify server to shutdown when client has pending signal
[ Upstream commit c7ff9cff70 ]

The client's sk_state will be set to TCP_ESTABLISHED if the server
replay the client's connect request.

However, if the client has pending signal, its sk_state will be set
to TCP_CLOSE without notify the server, so the server will hold the
corrupt connection.

            client                        server

1. sk_state=TCP_SYN_SENT         |
2. call ->connect()              |
3. wait reply                    |
                                 | 4. sk_state=TCP_ESTABLISHED
                                 | 5. insert to connected list
                                 | 6. reply to the client
7. sk_state=TCP_ESTABLISHED      |
8. insert to connected list      |
9. *signal pending* <--------------------- the user kill client
10. sk_state=TCP_CLOSE           |
client is exiting...             |
11. call ->release()             |
     virtio_transport_close
      if (!(sk->sk_state == TCP_ESTABLISHED ||
	      sk->sk_state == TCP_CLOSING))
		return true; *return at here, the server cannot notice the connection is corrupt*

So the client should notify the peer in this case.

Cc: David S. Miller <davem@davemloft.net>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Jorgen Hansen <jhansen@vmware.com>
Cc: Norbert Slusarek <nslusarek@gmx.net>
Cc: Andra Paraschiv <andraprs@amazon.com>
Cc: Colin Ian King <colin.king@canonical.com>
Cc: David Brazdil <dbrazdil@google.com>
Cc: Alexander Popov <alex.popov@linux.com>
Suggested-by: Stefano Garzarella <sgarzare@redhat.com>
Link: https://lkml.org/lkml/2021/5/17/418
Signed-off-by: lixianming <lixianming5@huawei.com>
Signed-off-by: Longpeng(Mike) <longpeng2@huawei.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-07-19 09:44:52 +02:00
Greg Kroah-Hartman
e054456ced Merge 5.10.37 into android12-5.10
Changes in 5.10.37
	Bluetooth: verify AMP hci_chan before amp_destroy
	bluetooth: eliminate the potential race condition when removing the HCI controller
	net/nfc: fix use-after-free llcp_sock_bind/connect
	io_uring: truncate lengths larger than MAX_RW_COUNT on provide buffers
	Revert "USB: cdc-acm: fix rounding error in TIOCSSERIAL"
	usb: roles: Call try_module_get() from usb_role_switch_find_by_fwnode()
	tty: moxa: fix TIOCSSERIAL jiffies conversions
	tty: amiserial: fix TIOCSSERIAL permission check
	USB: serial: usb_wwan: fix TIOCSSERIAL jiffies conversions
	staging: greybus: uart: fix TIOCSSERIAL jiffies conversions
	USB: serial: ti_usb_3410_5052: fix TIOCSSERIAL permission check
	staging: fwserial: fix TIOCSSERIAL jiffies conversions
	tty: moxa: fix TIOCSSERIAL permission check
	staging: fwserial: fix TIOCSSERIAL permission check
	drm: bridge: fix LONTIUM use of mipi_dsi_() functions
	usb: typec: tcpm: Address incorrect values of tcpm psy for fixed supply
	usb: typec: tcpm: Address incorrect values of tcpm psy for pps supply
	usb: typec: tcpm: update power supply once partner accepts
	usb: xhci-mtk: remove or operator for setting schedule parameters
	usb: xhci-mtk: improve bandwidth scheduling with TT
	ASoC: samsung: tm2_wm5110: check of of_parse return value
	ASoC: Intel: kbl_da7219_max98927: Fix kabylake_ssp_fixup function
	ASoC: tlv320aic32x4: Register clocks before registering component
	ASoC: tlv320aic32x4: Increase maximum register in regmap
	MIPS: pci-mt7620: fix PLL lock check
	MIPS: pci-rt2880: fix slot 0 configuration
	FDDI: defxx: Bail out gracefully with unassigned PCI resource for CSR
	PCI: Allow VPD access for QLogic ISP2722
	KVM: x86: Defer the MMU unload to the normal path on an global INVPCID
	PCI: xgene: Fix cfg resource mapping
	PCI: keystone: Let AM65 use the pci_ops defined in pcie-designware-host.c
	PM / devfreq: Unlock mutex and free devfreq struct in error path
	soc/tegra: regulators: Fix locking up when voltage-spread is out of range
	iio: inv_mpu6050: Fully validate gyro and accel scale writes
	iio:accel:adis16201: Fix wrong axis assignment that prevents loading
	iio:adc:ad7476: Fix remove handling
	sc16is7xx: Defer probe if device read fails
	phy: cadence: Sierra: Fix PHY power_on sequence
	misc: lis3lv02d: Fix false-positive WARN on various HP models
	phy: ti: j721e-wiz: Invoke wiz_init() before of_platform_device_create()
	misc: vmw_vmci: explicitly initialize vmci_notify_bm_set_msg struct
	misc: vmw_vmci: explicitly initialize vmci_datagram payload
	selinux: add proper NULL termination to the secclass_map permissions
	x86, sched: Treat Intel SNC topology as default, COD as exception
	async_xor: increase src_offs when dropping destination page
	md/bitmap: wait for external bitmap writes to complete during tear down
	md-cluster: fix use-after-free issue when removing rdev
	md: split mddev_find
	md: factor out a mddev_find_locked helper from mddev_find
	md: md_open returns -EBUSY when entering racing area
	md: Fix missing unused status line of /proc/mdstat
	mt76: mt7615: use ieee80211_free_txskb() in mt7615_tx_token_put()
	ipw2x00: potential buffer overflow in libipw_wx_set_encodeext()
	cfg80211: scan: drop entry from hidden_list on overflow
	rtw88: Fix array overrun in rtw_get_tx_power_params()
	mt76: fix potential DMA mapping leak
	FDDI: defxx: Make MMIO the configuration default except for EISA
	drm/i915/gvt: Fix virtual display setup for BXT/APL
	drm/i915/gvt: Fix vfio_edid issue for BXT/APL
	drm/qxl: use ttm bo priorities
	drm/panfrost: Clear MMU irqs before handling the fault
	drm/panfrost: Don't try to map pages that are already mapped
	drm/radeon: fix copy of uninitialized variable back to userspace
	drm/dp_mst: Revise broadcast msg lct & lcr
	drm/dp_mst: Set CLEAR_PAYLOAD_ID_TABLE as broadcast
	drm: bridge/panel: Cleanup connector on bridge detach
	drm/amd/display: Reject non-zero src_y and src_x for video planes
	drm/amdgpu: fix concurrent VM flushes on Vega/Navi v2
	ALSA: hda/realtek: Re-order ALC882 Acer quirk table entries
	ALSA: hda/realtek: Re-order ALC882 Sony quirk table entries
	ALSA: hda/realtek: Re-order ALC882 Clevo quirk table entries
	ALSA: hda/realtek: Re-order ALC269 HP quirk table entries
	ALSA: hda/realtek: Re-order ALC269 Acer quirk table entries
	ALSA: hda/realtek: Re-order ALC269 Dell quirk table entries
	ALSA: hda/realtek: Re-order ALC269 ASUS quirk table entries
	ALSA: hda/realtek: Re-order ALC269 Sony quirk table entries
	ALSA: hda/realtek: Re-order ALC269 Lenovo quirk table entries
	ALSA: hda/realtek: Re-order remaining ALC269 quirk table entries
	ALSA: hda/realtek: Re-order ALC662 quirk table entries
	ALSA: hda/realtek: Remove redundant entry for ALC861 Haier/Uniwill devices
	ALSA: hda/realtek: ALC285 Thinkpad jack pin quirk is unreachable
	ALSA: hda/realtek: Fix speaker amp on HP Envy AiO 32
	KVM: s390: VSIE: correctly handle MVPG when in VSIE
	KVM: s390: split kvm_s390_logical_to_effective
	KVM: s390: fix guarded storage control register handling
	s390: fix detection of vector enhancements facility 1 vs. vector packed decimal facility
	KVM: s390: VSIE: fix MVPG handling for prefixing and MSO
	KVM: s390: split kvm_s390_real_to_abs
	KVM: s390: extend kvm_s390_shadow_fault to return entry pointer
	KVM: x86/mmu: Alloc page for PDPTEs when shadowing 32-bit NPT with 64-bit
	KVM: x86: Remove emulator's broken checks on CR0/CR3/CR4 loads
	KVM: nSVM: Set the shadow root level to the TDP level for nested NPT
	KVM: SVM: Don't strip the C-bit from CR2 on #PF interception
	KVM: SVM: Do not allow SEV/SEV-ES initialization after vCPUs are created
	KVM: SVM: Inject #GP on guest MSR_TSC_AUX accesses if RDTSCP unsupported
	KVM: nVMX: Defer the MMU reload to the normal path on an EPTP switch
	KVM: nVMX: Truncate bits 63:32 of VMCS field on nested check in !64-bit
	KVM: nVMX: Truncate base/index GPR value on address calc in !64-bit
	KVM: arm/arm64: Fix KVM_VGIC_V3_ADDR_TYPE_REDIST read
	KVM: Destroy I/O bus devices on unregister failure _after_ sync'ing SRCU
	KVM: Stop looking for coalesced MMIO zones if the bus is destroyed
	KVM: arm64: Fully zero the vcpu state on reset
	KVM: arm64: Fix KVM_VGIC_V3_ADDR_TYPE_REDIST_REGION read
	Revert "drivers/net/wan/hdlc_fr: Fix a double free in pvc_xmit"
	Revert "i3c master: fix missing destroy_workqueue() on error in i3c_master_register"
	ovl: fix missing revert_creds() on error path
	Revert "drm/qxl: do not run release if qxl failed to init"
	usb: gadget: pch_udc: Revert d3cb25a121 completely
	Revert "tools/power turbostat: adjust for temperature offset"
	firmware: xilinx: Fix dereferencing freed memory
	firmware: xilinx: Add a blank line after function declaration
	firmware: xilinx: Remove zynqmp_pm_get_eemi_ops() in IS_REACHABLE(CONFIG_ZYNQMP_FIRMWARE)
	fpga: fpga-mgr: xilinx-spi: fix error messages on -EPROBE_DEFER
	crypto: sun8i-ss - fix result memory leak on error path
	memory: gpmc: fix out of bounds read and dereference on gpmc_cs[]
	ARM: dts: exynos: correct fuel gauge interrupt trigger level on GT-I9100
	ARM: dts: exynos: correct fuel gauge interrupt trigger level on Midas family
	ARM: dts: exynos: correct MUIC interrupt trigger level on Midas family
	ARM: dts: exynos: correct PMIC interrupt trigger level on Midas family
	ARM: dts: exynos: correct PMIC interrupt trigger level on Odroid X/U3 family
	ARM: dts: exynos: correct PMIC interrupt trigger level on SMDK5250
	ARM: dts: exynos: correct PMIC interrupt trigger level on Snow
	ARM: dts: s5pv210: correct fuel gauge interrupt trigger level on Fascinate family
	ARM: dts: renesas: Add mmc aliases into R-Car Gen2 board dts files
	arm64: dts: renesas: Add mmc aliases into board dts files
	x86/platform/uv: Set section block size for hubless architectures
	serial: stm32: fix code cleaning warnings and checks
	serial: stm32: add "_usart" prefix in functions name
	serial: stm32: fix probe and remove order for dma
	serial: stm32: Use of_device_get_match_data()
	serial: stm32: fix startup by enabling usart for reception
	serial: stm32: fix incorrect characters on console
	serial: stm32: fix TX and RX FIFO thresholds
	serial: stm32: fix a deadlock condition with wakeup event
	serial: stm32: fix wake-up flag handling
	serial: stm32: fix a deadlock in set_termios
	serial: stm32: fix tx dma completion, release channel
	serial: stm32: call stm32_transmit_chars locked
	serial: stm32: fix FIFO flush in startup and set_termios
	serial: stm32: add FIFO flush when port is closed
	serial: stm32: fix tx_empty condition
	usb: typec: tcpci: Check ROLE_CONTROL while interpreting CC_STATUS
	usb: typec: tps6598x: Fix return value check in tps6598x_probe()
	usb: typec: stusb160x: fix return value check in stusb160x_probe()
	regmap: set debugfs_name to NULL after it is freed
	spi: rockchip: avoid objtool warning
	mtd: rawnand: fsmc: Fix error code in fsmc_nand_probe()
	mtd: rawnand: brcmnand: fix OOB R/W with Hamming ECC
	mtd: Handle possible -EPROBE_DEFER from parse_mtd_partitions()
	mtd: rawnand: qcom: Return actual error code instead of -ENODEV
	mtd: don't lock when recursively deleting partitions
	mtd: maps: fix error return code of physmap_flash_remove()
	ARM: dts: stm32: fix usart 2 & 3 pinconf to wake up with flow control
	arm64: dts: qcom: sm8250: Fix level triggered PMU interrupt polarity
	arm64: dts: qcom: sm8250: Fix timer interrupt to specify EL2 physical timer
	arm64: dts: qcom: sdm845: fix number of pins in 'gpio-ranges'
	arm64: dts: qcom: sm8150: fix number of pins in 'gpio-ranges'
	arm64: dts: qcom: sm8250: fix number of pins in 'gpio-ranges'
	arm64: dts: qcom: db845c: fix correct powerdown pin for WSA881x
	crypto: sun8i-ss - Fix memory leak of object d when dma_iv fails to map
	spi: stm32: drop devres version of spi_register_master
	regulator: bd9576: Fix return from bd957x_probe()
	arm64: dts: renesas: r8a77980: Fix vin4-7 endpoint binding
	spi: stm32: Fix use-after-free on unbind
	x86/microcode: Check for offline CPUs before requesting new microcode
	devtmpfs: fix placement of complete() call
	usb: gadget: pch_udc: Replace cpu_to_le32() by lower_32_bits()
	usb: gadget: pch_udc: Check if driver is present before calling ->setup()
	usb: gadget: pch_udc: Check for DMA mapping error
	usb: gadget: pch_udc: Initialize device pointer before use
	usb: gadget: pch_udc: Provide a GPIO line used on Intel Minnowboard (v1)
	crypto: ccp - fix command queuing to TEE ring buffer
	crypto: qat - don't release uninitialized resources
	crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init
	fotg210-udc: Fix DMA on EP0 for length > max packet size
	fotg210-udc: Fix EP0 IN requests bigger than two packets
	fotg210-udc: Remove a dubious condition leading to fotg210_done
	fotg210-udc: Mask GRP2 interrupts we don't handle
	fotg210-udc: Don't DMA more than the buffer can take
	fotg210-udc: Complete OUT requests on short packets
	usb: gadget: s3c: Fix incorrect resources releasing
	usb: gadget: s3c: Fix the error handling path in 's3c2410_udc_probe()'
	dt-bindings: serial: stm32: Use 'type: object' instead of false for 'additionalProperties'
	mtd: require write permissions for locking and badblock ioctls
	arm64: dts: renesas: r8a779a0: Fix PMU interrupt
	bus: qcom: Put child node before return
	soundwire: bus: Fix device found flag correctly
	phy: ti: j721e-wiz: Delete "clk_div_sel" clk provider during cleanup
	phy: marvell: ARMADA375_USBCLUSTER_PHY should not default to y, unconditionally
	arm64: dts: mediatek: fix reset GPIO level on pumpkin
	NFSD: Fix sparse warning in nfs4proc.c
	NFSv4.2: fix copy stateid copying for the async copy
	crypto: poly1305 - fix poly1305_core_setkey() declaration
	crypto: qat - fix error path in adf_isr_resource_alloc()
	usb: gadget: aspeed: fix dma map failure
	USB: gadget: udc: fix wrong pointer passed to IS_ERR() and PTR_ERR()
	drivers: nvmem: Fix voltage settings for QTI qfprom-efuse
	driver core: platform: Declare early_platform_cleanup() prototype
	memory: pl353: fix mask of ECC page_size config register
	soundwire: stream: fix memory leak in stream config error path
	m68k: mvme147,mvme16x: Don't wipe PCC timer config bits
	firmware: qcom_scm: Make __qcom_scm_is_call_available() return bool
	firmware: qcom_scm: Reduce locking section for __get_convention()
	firmware: qcom_scm: Workaround lack of "is available" call on SC7180
	iio: adc: Kconfig: make AD9467 depend on ADI_AXI_ADC symbol
	mtd: rawnand: gpmi: Fix a double free in gpmi_nand_init
	irqchip/gic-v3: Fix OF_BAD_ADDR error handling
	staging: comedi: tests: ni_routes_test: Fix compilation error
	staging: rtl8192u: Fix potential infinite loop
	staging: fwserial: fix TIOCSSERIAL implementation
	staging: fwserial: fix TIOCGSERIAL implementation
	staging: greybus: uart: fix unprivileged TIOCCSERIAL
	soc: qcom: pdr: Fix error return code in pdr_register_listener
	PM / devfreq: Use more accurate returned new_freq as resume_freq
	clocksource/drivers/timer-ti-dm: Fix posted mode status check order
	clocksource/drivers/timer-ti-dm: Add missing set_state_oneshot_stopped
	clocksource/drivers/ingenic_ost: Fix return value check in ingenic_ost_probe()
	spi: Fix use-after-free with devm_spi_alloc_*
	spi: fsl: add missing iounmap() on error in of_fsl_spi_probe()
	soc: qcom: mdt_loader: Validate that p_filesz < p_memsz
	soc: qcom: mdt_loader: Detect truncated read of segments
	PM: runtime: Replace inline function pm_runtime_callbacks_present()
	cpuidle: Fix ARM_QCOM_SPM_CPUIDLE configuration
	ACPI: CPPC: Replace cppc_attr with kobj_attribute
	crypto: allwinner - add missing CRYPTO_ prefix
	crypto: sun8i-ss - Fix memory leak of pad
	crypto: sa2ul - Fix memory leak of rxd
	crypto: qat - Fix a double free in adf_create_ring
	cpufreq: armada-37xx: Fix setting TBG parent for load levels
	clk: mvebu: armada-37xx-periph: remove .set_parent method for CPU PM clock
	cpufreq: armada-37xx: Fix the AVS value for load L1
	clk: mvebu: armada-37xx-periph: Fix switching CPU freq from 250 Mhz to 1 GHz
	clk: mvebu: armada-37xx-periph: Fix workaround for switching from L1 to L0
	cpufreq: armada-37xx: Fix driver cleanup when registration failed
	cpufreq: armada-37xx: Fix determining base CPU frequency
	spi: spi-zynqmp-gqspi: use wait_for_completion_timeout to make zynqmp_qspi_exec_op not interruptible
	spi: spi-zynqmp-gqspi: add mutex locking for exec_op
	spi: spi-zynqmp-gqspi: transmit dummy circles by using the controller's internal functionality
	spi: spi-zynqmp-gqspi: fix incorrect operating mode in zynqmp_qspi_read_op
	spi: fsl-lpspi: Fix PM reference leak in lpspi_prepare_xfer_hardware()
	usb: gadget: r8a66597: Add missing null check on return from platform_get_resource
	USB: cdc-acm: fix unprivileged TIOCCSERIAL
	USB: cdc-acm: fix TIOCGSERIAL implementation
	tty: actually undefine superseded ASYNC flags
	tty: fix return value for unsupported ioctls
	tty: Remove dead termiox code
	tty: fix return value for unsupported termiox ioctls
	serial: core: return early on unsupported ioctls
	firmware: qcom-scm: Fix QCOM_SCM configuration
	node: fix device cleanups in error handling code
	crypto: chelsio - Read rxchannel-id from firmware
	usbip: vudc: fix missing unlock on error in usbip_sockfd_store()
	m68k: Add missing mmap_read_lock() to sys_cacheflush()
	spi: spi-zynqmp-gqspi: Fix missing unlock on error in zynqmp_qspi_exec_op()
	memory: renesas-rpc-if: fix possible NULL pointer dereference of resource
	memory: samsung: exynos5422-dmc: handle clk_set_parent() failure
	security: keys: trusted: fix TPM2 authorizations
	platform/x86: pmc_atom: Match all Beckhoff Automation baytrail boards with critclk_systems DMI table
	ARM: dts: aspeed: Rainier: Fix humidity sensor bus address
	Drivers: hv: vmbus: Use after free in __vmbus_open()
	spi: spi-zynqmp-gqspi: fix clk_enable/disable imbalance issue
	spi: spi-zynqmp-gqspi: fix hang issue when suspend/resume
	spi: spi-zynqmp-gqspi: fix use-after-free in zynqmp_qspi_exec_op
	spi: spi-zynqmp-gqspi: return -ENOMEM if dma_map_single fails
	x86/platform/uv: Fix !KEXEC build failure
	hwmon: (pmbus/pxe1610) don't bail out when not all pages are active
	Drivers: hv: vmbus: Increase wait time for VMbus unload
	PM: hibernate: x86: Use crc32 instead of md5 for hibernation e820 integrity check
	usb: dwc2: Fix host mode hibernation exit with remote wakeup flow.
	usb: dwc2: Fix hibernation between host and device modes.
	ttyprintk: Add TTY hangup callback.
	serial: omap: don't disable rs485 if rts gpio is missing
	serial: omap: fix rs485 half-duplex filtering
	xen-blkback: fix compatibility bug with single page rings
	soc: aspeed: fix a ternary sign expansion bug
	drm/tilcdc: send vblank event when disabling crtc
	drm/stm: Fix bus_flags handling
	drm/amd/display: Fix off by one in hdmi_14_process_transaction()
	drm/mcde/panel: Inverse misunderstood flag
	sched/fair: Fix shift-out-of-bounds in load_balance()
	afs: Fix updating of i_mode due to 3rd party change
	rcu: Remove spurious instrumentation_end() in rcu_nmi_enter()
	media: vivid: fix assignment of dev->fbuf_out_flags
	media: saa7134: use sg_dma_len when building pgtable
	media: saa7146: use sg_dma_len when building pgtable
	media: omap4iss: return error code when omap4iss_get() failed
	media: rkisp1: rsz: crash fix when setting src format
	media: aspeed: fix clock handling logic
	drm/probe-helper: Check epoch counter in output_poll_execute()
	media: venus: core: Fix some resource leaks in the error path of 'venus_probe()'
	media: platform: sunxi: sun6i-csi: fix error return code of sun6i_video_start_streaming()
	media: m88ds3103: fix return value check in m88ds3103_probe()
	media: docs: Fix data organization of MEDIA_BUS_FMT_RGB101010_1X30
	media: [next] staging: media: atomisp: fix memory leak of object flash
	media: atomisp: Fixed error handling path
	media: m88rs6000t: avoid potential out-of-bounds reads on arrays
	media: atomisp: Fix use after free in atomisp_alloc_css_stat_bufs()
	drm/amdkfd: fix build error with AMD_IOMMU_V2=m
	of: overlay: fix for_each_child.cocci warnings
	x86/kprobes: Fix to check non boostable prefixes correctly
	selftests: fix prepending $(OUTPUT) to $(TEST_PROGS)
	pata_arasan_cf: fix IRQ check
	pata_ipx4xx_cf: fix IRQ check
	sata_mv: add IRQ checks
	ata: libahci_platform: fix IRQ check
	seccomp: Fix CONFIG tests for Seccomp_filters
	nvme-tcp: block BH in sk state_change sk callback
	nvmet-tcp: fix incorrect locking in state_change sk callback
	clk: imx: Fix reparenting of UARTs not associated with stdout
	power: supply: bq25980: Move props from battery node
	nvme: retrigger ANA log update if group descriptor isn't found
	media: i2c: imx219: Move out locking/unlocking of vflip and hflip controls from imx219_set_stream
	media: i2c: imx219: Balance runtime PM use-count
	media: v4l2-ctrls.c: fix race condition in hdl->requests list
	vfio/fsl-mc: Re-order vfio_fsl_mc_probe()
	vfio/pci: Move VGA and VF initialization to functions
	vfio/pci: Re-order vfio_pci_probe()
	vfio/mdev: Do not allow a mdev_type to have a NULL parent pointer
	clk: zynqmp: move zynqmp_pll_set_mode out of round_rate callback
	clk: zynqmp: pll: add set_pll_mode to check condition in zynqmp_pll_enable
	drm: xlnx: zynqmp: fix a memset in zynqmp_dp_train()
	clk: qcom: a53-pll: Add missing MODULE_DEVICE_TABLE
	clk: qcom: apss-ipq-pll: Add missing MODULE_DEVICE_TABLE
	drm/amd/display: use GFP_ATOMIC in dcn20_resource_construct
	drm/radeon: Fix a missing check bug in radeon_dp_mst_detect()
	clk: uniphier: Fix potential infinite loop
	scsi: pm80xx: Increase timeout for pm80xx mpi_uninit_check()
	scsi: pm80xx: Fix potential infinite loop
	scsi: ufs: ufshcd-pltfrm: Fix deferred probing
	scsi: hisi_sas: Fix IRQ checks
	scsi: jazz_esp: Add IRQ check
	scsi: sun3x_esp: Add IRQ check
	scsi: sni_53c710: Add IRQ check
	scsi: ibmvfc: Fix invalid state machine BUG_ON()
	mailbox: sprd: Introduce refcnt when clients requests/free channels
	mfd: stm32-timers: Avoid clearing auto reload register
	nvmet-tcp: fix a segmentation fault during io parsing error
	nvme-pci: don't simple map sgl when sgls are disabled
	media: cedrus: Fix H265 status definitions
	HSI: core: fix resource leaks in hsi_add_client_from_dt()
	x86/events/amd/iommu: Fix sysfs type mismatch
	perf/amd/uncore: Fix sysfs type mismatch
	io_uring: fix overflows checks in provide buffers
	sched/debug: Fix cgroup_path[] serialization
	drivers/block/null_blk/main: Fix a double free in null_init.
	xsk: Respect device's headroom and tailroom on generic xmit path
	HID: plantronics: Workaround for double volume key presses
	perf symbols: Fix dso__fprintf_symbols_by_name() to return the number of printed chars
	ASoC: Intel: boards: sof-wm8804: add check for PLL setting
	ASoC: Intel: Skylake: Compile when any configuration is selected
	RDMA/mlx5: Fix mlx5 rates to IB rates map
	wilc1000: write value to WILC_INTR2_ENABLE register
	KVM: x86/mmu: Retry page faults that hit an invalid memslot
	Bluetooth: avoid deadlock between hci_dev->lock and socket lock
	net: lapbether: Prevent racing when checking whether the netif is running
	libbpf: Add explicit padding to bpf_xdp_set_link_opts
	bpftool: Fix maybe-uninitialized warnings
	iommu: Check dev->iommu in iommu_dev_xxx functions
	iommu/vt-d: Reject unsupported page request modes
	selftests/bpf: Re-generate vmlinux.h and BPF skeletons if bpftool changed
	libbpf: Add explicit padding to btf_dump_emit_type_decl_opts
	powerpc/fadump: Mark fadump_calculate_reserve_size as __init
	powerpc/prom: Mark identical_pvr_fixup as __init
	MIPS: fix local_irq_{disable,enable} in asmmacro.h
	ima: Fix the error code for restoring the PCR value
	inet: use bigger hash table for IP ID generation
	pinctrl: pinctrl-single: remove unused parameter
	pinctrl: pinctrl-single: fix pcs_pin_dbg_show() when bits_per_mux is not zero
	MIPS: loongson64: fix bug when PAGE_SIZE > 16KB
	ASoC: wm8960: Remove bitclk relax condition in wm8960_configure_sysclk
	iommu/arm-smmu-v3: add bit field SFM into GERROR_ERR_MASK
	RDMA/mlx5: Fix drop packet rule in egress table
	IB/isert: Fix a use after free in isert_connect_request
	powerpc: Fix HAVE_HARDLOCKUP_DETECTOR_ARCH build configuration
	MIPS/bpf: Enable bpf_probe_read{, str}() on MIPS again
	gpio: guard gpiochip_irqchip_add_domain() with GPIOLIB_IRQCHIP
	ALSA: core: remove redundant spin_lock pair in snd_card_disconnect
	net: phy: lan87xx: fix access to wrong register of LAN87xx
	udp: never accept GSO_FRAGLIST packets
	powerpc/pseries: Only register vio drivers if vio bus exists
	net/tipc: fix missing destroy_workqueue() on error in tipc_crypto_start()
	bug: Remove redundant condition check in report_bug
	RDMA/core: Fix corrupted SL on passive side
	nfc: pn533: prevent potential memory corruption
	net: hns3: Limiting the scope of vector_ring_chain variable
	mips: bmips: fix syscon-reboot nodes
	iommu/vt-d: Don't set then clear private data in prq_event_thread()
	iommu: Fix a boundary issue to avoid performance drop
	iommu/vt-d: Report right snoop capability when using FL for IOVA
	iommu/vt-d: Report the right page fault address
	iommu/vt-d: Preset Access/Dirty bits for IOVA over FL
	iommu/vt-d: Remove WO permissions on second-level paging entries
	iommu/vt-d: Invalidate PASID cache when root/context entry changed
	ALSA: usb-audio: Add error checks for usb_driver_claim_interface() calls
	HID: lenovo: Use brightness_set_blocking callback for setting LEDs brightness
	HID: lenovo: Fix lenovo_led_set_tp10ubkbd() error handling
	HID: lenovo: Check hid_get_drvdata() returns non NULL in lenovo_event()
	HID: lenovo: Map mic-mute button to KEY_F20 instead of KEY_MICMUTE
	KVM: arm64: Initialize VCPU mdcr_el2 before loading it
	ASoC: simple-card: fix possible uninitialized single_cpu local variable
	liquidio: Fix unintented sign extension of a left shift of a u16
	IB/hfi1: Use kzalloc() for mmu_rb_handler allocation
	powerpc/64s: Fix pte update for kernel memory on radix
	powerpc/perf: Fix PMU constraint check for EBB events
	powerpc: iommu: fix build when neither PCI or IBMVIO is set
	mac80211: bail out if cipher schemes are invalid
	perf vendor events amd: Fix broken L2 Cache Hits from L2 HWPF metric
	xfs: fix return of uninitialized value in variable error
	rtw88: Fix an error code in rtw_debugfs_set_rsvd_page()
	mt7601u: fix always true expression
	mt76: mt7615: fix tx skb dma unmap
	mt76: mt7915: fix tx skb dma unmap
	mt76: mt7915: fix aggr len debugfs node
	mt76: mt7615: fix mib stats counter reporting to mac80211
	mt76: mt7915: fix mib stats counter reporting to mac80211
	mt76: mt7663s: make all of packets 4-bytes aligned in sdio tx aggregation
	mt76: mt7663s: fix the possible device hang in high traffic
	KVM: PPC: Book3S HV P9: Restore host CTRL SPR after guest exit
	ovl: invalidate readdir cache on changes to dir with origin
	RDMA/qedr: Fix error return code in qedr_iw_connect()
	IB/hfi1: Fix error return code in parse_platform_config()
	RDMA/bnxt_re: Fix error return code in bnxt_qplib_cq_process_terminal()
	cxgb4: Fix unintentional sign extension issues
	net: thunderx: Fix unintentional sign extension issue
	RDMA/srpt: Fix error return code in srpt_cm_req_recv()
	RDMA/rtrs-clt: destroy sysfs after removing session from active list
	i2c: cadence: fix reference leak when pm_runtime_get_sync fails
	i2c: img-scb: fix reference leak when pm_runtime_get_sync fails
	i2c: imx-lpi2c: fix reference leak when pm_runtime_get_sync fails
	i2c: imx: fix reference leak when pm_runtime_get_sync fails
	i2c: omap: fix reference leak when pm_runtime_get_sync fails
	i2c: sprd: fix reference leak when pm_runtime_get_sync fails
	i2c: stm32f7: fix reference leak when pm_runtime_get_sync fails
	i2c: xiic: fix reference leak when pm_runtime_get_sync fails
	i2c: cadence: add IRQ check
	i2c: emev2: add IRQ check
	i2c: jz4780: add IRQ check
	i2c: mlxbf: add IRQ check
	i2c: rcar: make sure irq is not threaded on Gen2 and earlier
	i2c: rcar: protect against supurious interrupts on V3U
	i2c: rcar: add IRQ check
	i2c: sh7760: add IRQ check
	powerpc/xive: Drop check on irq_data in xive_core_debug_show()
	powerpc/xive: Fix xmon command "dxi"
	ASoC: ak5558: correct reset polarity
	net/mlx5: Fix bit-wise and with zero
	net/packet: make packet_fanout.arr size configurable up to 64K
	net/packet: remove data races in fanout operations
	drm/i915/gvt: Fix error code in intel_gvt_init_device()
	iommu/amd: Put newline after closing bracket in warning
	perf beauty: Fix fsconfig generator
	drm/amd/pm: fix error code in smu_set_power_limit()
	MIPS: pci-legacy: stop using of_pci_range_to_resource
	powerpc/pseries: extract host bridge from pci_bus prior to bus removal
	powerpc/smp: Reintroduce cpu_core_mask
	KVM: x86: dump_vmcs should not assume GUEST_IA32_EFER is valid
	rtlwifi: 8821ae: upgrade PHY and RF parameters
	wlcore: fix overlapping snprintf arguments in debugfs
	i2c: sh7760: fix IRQ error path
	i2c: mediatek: Fix wrong dma sync flag
	mwl8k: Fix a double Free in mwl8k_probe_hw
	netfilter: nft_payload: fix C-VLAN offload support
	netfilter: nftables_offload: VLAN id needs host byteorder in flow dissector
	netfilter: nftables_offload: special ethertype handling for VLAN
	vsock/vmci: log once the failed queue pair allocation
	libbpf: Initialize the bpf_seq_printf parameters array field by field
	net: ethernet: ixp4xx: Set the DMA masks explicitly
	gro: fix napi_gro_frags() Fast GRO breakage due to IP alignment check
	RDMA/cxgb4: add missing qpid increment
	RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails
	ALSA: usb: midi: don't return -ENOMEM when usb_urb_ep_type_check fails
	sfc: ef10: fix TX queue lookup in TX event handling
	vsock/virtio: free queued packets when closing socket
	net: marvell: prestera: fix port event handling on init
	net: davinci_emac: Fix incorrect masking of tx and rx error channel
	mt76: mt7615: fix memleak when mt7615_unregister_device()
	crypto: ccp: Detect and reject "invalid" addresses destined for PSP
	nfp: devlink: initialize the devlink port attribute "lanes"
	net: stmmac: fix TSO and TBS feature enabling during driver open
	net: renesas: ravb: Fix a stuck issue when a lot of frames are received
	net: phy: intel-xway: enable integrated led functions
	RDMA/rxe: Fix a bug in rxe_fill_ip_info()
	RDMA/core: Add CM to restrack after successful attachment to a device
	powerpc/64: Fix the definition of the fixmap area
	ath9k: Fix error check in ath9k_hw_read_revisions() for PCI devices
	ath10k: Fix a use after free in ath10k_htc_send_bundle
	ath10k: Fix ath10k_wmi_tlv_op_pull_peer_stats_info() unlock without lock
	wlcore: Fix buffer overrun by snprintf due to incorrect buffer size
	powerpc/perf: Fix the threshold event selection for memory events in power10
	powerpc/52xx: Fix an invalid ASM expression ('addi' used instead of 'add')
	net: phy: marvell: fix m88e1011_set_downshift
	net: phy: marvell: fix m88e1111_set_downshift
	net: enetc: fix link error again
	bnxt_en: fix ternary sign extension bug in bnxt_show_temp()
	ARM: dts: uniphier: Change phy-mode to RGMII-ID to enable delay pins for RTL8211E
	arm64: dts: uniphier: Change phy-mode to RGMII-ID to enable delay pins for RTL8211E
	net: geneve: modify IP header check in geneve6_xmit_skb and geneve_xmit_skb
	selftests: net: mirror_gre_vlan_bridge_1q: Make an FDB entry static
	selftests: mlxsw: Remove a redundant if statement in tc_flower_scale test
	bnxt_en: Fix RX consumer index logic in the error path.
	KVM: VMX: Intercept FS/GS_BASE MSR accesses for 32-bit KVM
	net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send
	selftests/bpf: Fix BPF_CORE_READ_BITFIELD() macro
	selftests/bpf: Fix field existence CO-RE reloc tests
	selftests/bpf: Fix core_reloc test runner
	bpf: Fix propagation of 32 bit unsigned bounds from 64 bit bounds
	RDMA/siw: Fix a use after free in siw_alloc_mr
	RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res
	net: bridge: mcast: fix broken length + header check for MRDv6 Adv.
	net:nfc:digital: Fix a double free in digital_tg_recv_dep_req
	perf tools: Change fields type in perf_record_time_conv
	perf jit: Let convert_timestamp() to be backwards-compatible
	perf session: Add swap operation for event TIME_CONV
	ia64: fix EFI_DEBUG build
	kfifo: fix ternary sign extension bugs
	mm/sl?b.c: remove ctor argument from kmem_cache_flags
	mm: memcontrol: slab: fix obtain a reference to a freeing memcg
	mm/sparse: add the missing sparse_buffer_fini() in error branch
	mm/memory-failure: unnecessary amount of unmapping
	afs: Fix speculative status fetches
	bpf: Fix alu32 const subreg bound tracking on bitwise operations
	bpf, ringbuf: Deny reserve of buffers larger than ringbuf
	bpf: Prevent writable memory-mapping of read-only ringbuf pages
	arm64: Remove arm64_dma32_phys_limit and its uses
	net: Only allow init netns to set default tcp cong to a restricted algo
	smp: Fix smp_call_function_single_async prototype
	Revert "net/sctp: fix race condition in sctp_destroy_sock"
	sctp: delay auto_asconf init until binding the first addr
	Linux 5.10.37

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I5bee89c285d9dd72de967b0e70d96951ae4e06ae
2021-05-15 09:28:55 +02:00
Stefano Garzarella
b605673b52 vsock/virtio: free queued packets when closing socket
[ Upstream commit 8432b81149 ]

As reported by syzbot [1], there is a memory leak while closing the
socket. We partially solved this issue with commit ac03046ece
("vsock/virtio: free packets during the socket release"), but we
forgot to drain the RX queue when the socket is definitely closed by
the scheduled work.

To avoid future issues, let's use the new virtio_transport_remove_sock()
to drain the RX queue before removing the socket from the af_vsock lists
calling vsock_remove_sock().

[1] https://syzkaller.appspot.com/bug?extid=24452624fc4c571eedd9

Fixes: ac03046ece ("vsock/virtio: free packets during the socket release")
Reported-and-tested-by: syzbot+24452624fc4c571eedd9@syzkaller.appspotmail.com
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-05-14 09:50:41 +02:00
Stefano Garzarella
b9e719698f vsock/vmci: log once the failed queue pair allocation
[ Upstream commit e16edc99d6 ]

VMCI feature is not supported in conjunction with the vSphere Fault
Tolerance (FT) feature.

VMware Tools can repeatedly try to create a vsock connection. If FT is
enabled the kernel logs is flooded with the following messages:

    qp_alloc_hypercall result = -20
    Could not attach to queue pair with -20

"qp_alloc_hypercall result = -20" was hidden by commit e8266c4c33
("VMCI: Stop log spew when qp allocation isn't possible"), but "Could
not attach to queue pair with -20" is still there flooding the log.

Since the error message can be useful in some cases, print it only once.

Fixes: d021c34405 ("VSOCK: Introduce VM Sockets")
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Jorgen Hansen <jhansen@vmware.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-05-14 09:50:40 +02:00
David Brazdil
5ebb9947b4 selinux: vsock: Set SID for socket returned by accept()
[ Upstream commit 1f935e8e72 ]

For AF_VSOCK, accept() currently returns sockets that are unlabelled.
Other socket families derive the child's SID from the SID of the parent
and the SID of the incoming packet. This is typically done as the
connected socket is placed in the queue that accept() removes from.

Reuse the existing 'security_sk_clone' hook to copy the SID from the
parent (server) socket to the child. There is no packet SID in this
case.

Fixes: d021c34405 ("VSOCK: Introduce VM Sockets")
Signed-off-by: David Brazdil <dbrazdil@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-03-30 14:32:03 +02:00
David Brazdil
e26fd78761 FROMGIT: selinux: vsock: Set SID for socket returned by accept()
For AF_VSOCK, accept() currently returns sockets that are unlabelled.
Other socket families derive the child's SID from the SID of the parent
and the SID of the incoming packet. This is typically done as the
connected socket is placed in the queue that accept() removes from.

Reuse the existing 'security_sk_clone' hook to copy the SID from the
parent (server) socket to the child. There is no packet SID in this
case.

Fixes: d021c34405 ("VSOCK: Introduce VM Sockets")
Signed-off-by: David Brazdil <dbrazdil@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 1f935e8e72
 https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git master)
Link: https://lore.kernel.org/r/20210319130541.2188184-1-dbrazdil@google.com
Bug: 130668487
Change-Id: Idb656917cc600df7cb83cb15a6c0f0499045d77f
2021-03-22 08:41:33 +00:00
Greg Kroah-Hartman
b129c98dc6 Merge 5.10.17 into android12-5.10
Changes in 5.10.17
	objtool: Fix seg fault with Clang non-section symbols
	Revert "dts: phy: add GPIO number and active state used for phy reset"
	gpio: mxs: GPIO_MXS should not default to y unconditionally
	gpio: ep93xx: fix BUG_ON port F usage
	gpio: ep93xx: Fix single irqchip with multi gpiochips
	tracing: Do not count ftrace events in top level enable output
	tracing: Check length before giving out the filter buffer
	drm/i915: Fix overlay frontbuffer tracking
	arm/xen: Don't probe xenbus as part of an early initcall
	cgroup: fix psi monitor for root cgroup
	Revert "drm/amd/display: Update NV1x SR latency values"
	drm/i915/tgl+: Make sure TypeC FIA is powered up when initializing it
	drm/dp_mst: Don't report ports connected if nothing is attached to them
	dmaengine: move channel device_node deletion to driver
	tmpfs: disallow CONFIG_TMPFS_INODE64 on s390
	tmpfs: disallow CONFIG_TMPFS_INODE64 on alpha
	soc: ti: omap-prm: Fix boot time errors for rst_map_012 bits 0 and 1
	arm64: dts: rockchip: Fix PCIe DT properties on rk3399
	arm64: dts: qcom: sdm845: Reserve LPASS clocks in gcc
	ARM: OMAP2+: Fix suspcious RCU usage splats for omap_enter_idle_coupled
	arm64: dts: rockchip: remove interrupt-names property from rk3399 vdec node
	platform/x86: hp-wmi: Disable tablet-mode reporting by default
	arm64: dts: rockchip: Disable display for NanoPi R2S
	ovl: perform vfs_getxattr() with mounter creds
	cap: fix conversions on getxattr
	ovl: skip getxattr of security labels
	scsi: lpfc: Fix EEH encountering oops with NVMe traffic
	x86/split_lock: Enable the split lock feature on another Alder Lake CPU
	nvme-pci: ignore the subsysem NQN on Phison E16
	drm/amd/display: Fix DPCD translation for LTTPR AUX_RD_INTERVAL
	drm/amd/display: Add more Clock Sources to DCN2.1
	drm/amd/display: Release DSC before acquiring
	drm/amd/display: Fix dc_sink kref count in emulated_link_detect
	drm/amd/display: Free atomic state after drm_atomic_commit
	drm/amd/display: Decrement refcount of dc_sink before reassignment
	riscv: virt_addr_valid must check the address belongs to linear mapping
	bfq-iosched: Revert "bfq: Fix computation of shallow depth"
	ARM: dts: lpc32xx: Revert set default clock rate of HCLK PLL
	kallsyms: fix nonconverging kallsyms table with lld
	ARM: ensure the signal page contains defined contents
	ARM: kexec: fix oops after TLB are invalidated
	ubsan: implement __ubsan_handle_alignment_assumption
	Revert "lib: Restrict cpumask_local_spread to houskeeping CPUs"
	x86/efi: Remove EFI PGD build time checks
	lkdtm: don't move ctors to .rodata
	KVM: x86: cleanup CR3 reserved bits checks
	cgroup-v1: add disabled controller check in cgroup1_parse_param()
	dmaengine: idxd: fix misc interrupt completion
	ath9k: fix build error with LEDS_CLASS=m
	mt76: dma: fix a possible memory leak in mt76_add_fragment()
	drm/vc4: hvs: Fix buffer overflow with the dlist handling
	dmaengine: idxd: check device state before issue command
	bpf: Unbreak BPF_PROG_TYPE_KPROBE when kprobe is called via do_int3
	bpf: Check for integer overflow when using roundup_pow_of_two()
	netfilter: xt_recent: Fix attempt to update deleted entry
	selftests: netfilter: fix current year
	netfilter: nftables: fix possible UAF over chains from packet path in netns
	netfilter: flowtable: fix tcp and udp header checksum update
	xen/netback: avoid race in xenvif_rx_ring_slots_available()
	net: hdlc_x25: Return meaningful error code in x25_open
	net: ipa: set error code in gsi_channel_setup()
	hv_netvsc: Reset the RSC count if NVSP_STAT_FAIL in netvsc_receive()
	net: enetc: initialize the RFS and RSS memories
	selftests: txtimestamp: fix compilation issue
	net: stmmac: set TxQ mode back to DCB after disabling CBS
	ibmvnic: Clear failover_pending if unable to schedule
	netfilter: conntrack: skip identical origin tuple in same zone only
	scsi: scsi_debug: Fix a memory leak
	x86/build: Disable CET instrumentation in the kernel for 32-bit too
	net: dsa: felix: implement port flushing on .phylink_mac_link_down
	net: hns3: add a check for queue_id in hclge_reset_vf_queue()
	net: hns3: add a check for tqp_index in hclge_get_ring_chain_from_mbx()
	net: hns3: add a check for index in hclge_get_rss_key()
	firmware_loader: align .builtin_fw to 8
	drm/sun4i: tcon: set sync polarity for tcon1 channel
	drm/sun4i: dw-hdmi: always set clock rate
	drm/sun4i: Fix H6 HDMI PHY configuration
	drm/sun4i: dw-hdmi: Fix max. frequency for H6
	clk: sunxi-ng: mp: fix parent rate change flag check
	i2c: stm32f7: fix configuration of the digital filter
	h8300: fix PREEMPTION build, TI_PRE_COUNT undefined
	scripts: set proper OpenSSL include dir also for sign-file
	x86/pci: Create PCI/MSI irqdomain after x86_init.pci.arch_init()
	arm64: mte: Allow PTRACE_PEEKMTETAGS access to the zero page
	rxrpc: Fix clearance of Tx/Rx ring when releasing a call
	udp: fix skb_copy_and_csum_datagram with odd segment sizes
	net: dsa: call teardown method on probe failure
	cpufreq: ACPI: Extend frequency tables to cover boost frequencies
	cpufreq: ACPI: Update arch scale-invariance max perf ratio if CPPC is not there
	net: gro: do not keep too many GRO packets in napi->rx_list
	net: fix iteration for sctp transport seq_files
	net/vmw_vsock: fix NULL pointer dereference
	net/vmw_vsock: improve locking in vsock_connect_timeout()
	net: watchdog: hold device global xmit lock during tx disable
	bridge: mrp: Fix the usage of br_mrp_port_switchdev_set_state
	switchdev: mrp: Remove SWITCHDEV_ATTR_ID_MRP_PORT_STAT
	vsock/virtio: update credit only if socket is not closed
	vsock: fix locking in vsock_shutdown()
	net/rds: restrict iovecs length for RDS_CMSG_RDMA_ARGS
	net/qrtr: restrict user-controlled length in qrtr_tun_write_iter()
	ovl: expand warning in ovl_d_real()
	kcov, usb: only collect coverage from __usb_hcd_giveback_urb in softirq
	Linux 5.10.17

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Id0300681f52b51d3f466f1e66ec3a6c25f65f4d3
2021-02-18 11:21:01 +01:00
Stefano Garzarella
69e9fd9de1 vsock: fix locking in vsock_shutdown()
commit 1c5fae9c9a upstream.

In vsock_shutdown() we touched some socket fields without holding the
socket lock, such as 'state' and 'sk_flags'.

Also, after the introduction of multi-transport, we are accessing
'vsk->transport' in vsock_send_shutdown() without holding the lock
and this call can be made while the connection is in progress, so
the transport can change in the meantime.

To avoid issues, we hold the socket lock when we enter in
vsock_shutdown() and release it when we leave.

Among the transports that implement the 'shutdown' callback, only
hyperv_transport acquired the lock. Since the caller now holds it,
we no longer take it.

Fixes: d021c34405 ("VSOCK: Introduce VM Sockets")
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-02-17 11:02:30 +01:00
Stefano Garzarella
afe3170160 vsock/virtio: update credit only if socket is not closed
commit ce7536bc73 upstream.

If the socket is closed or is being released, some resources used by
virtio_transport_space_update() such as 'vsk->trans' may be released.

To avoid a use after free bug we should only update the available credit
when we are sure the socket is still open and we have the lock held.

Fixes: 06a8fc7836 ("VSOCK: Introduce virtio_vsock_common.ko")
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Link: https://lore.kernel.org/r/20210208144454.84438-1-sgarzare@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-02-17 11:02:29 +01:00
Norbert Slusarek
bc21a88465 net/vmw_vsock: improve locking in vsock_connect_timeout()
commit 3d0bc44d39 upstream.

A possible locking issue in vsock_connect_timeout() was recognized by
Eric Dumazet which might cause a null pointer dereference in
vsock_transport_cancel_pkt(). This patch assures that
vsock_transport_cancel_pkt() will be called within the lock, so a race
condition won't occur which could result in vsk->transport to be set to NULL.

Fixes: 380feae0de ("vsock: cancel packets when failing to connect")
Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Norbert Slusarek <nslusarek@gmx.net>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Link: https://lore.kernel.org/r/trinity-f8e0937a-cf0e-4d80-a76e-d9a958ba3ef1-1612535522360@3c-app-gmx-bap12
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-02-17 11:02:29 +01:00
Norbert Slusarek
fcee53dc03 net/vmw_vsock: fix NULL pointer dereference
commit 5d1cbcc990 upstream.

In vsock_stream_connect(), a thread will enter schedule_timeout().
While being scheduled out, another thread can enter vsock_stream_connect()
as well and set vsk->transport to NULL. In case a signal was sent, the
first thread can leave schedule_timeout() and vsock_transport_cancel_pkt()
will be called right after. Inside vsock_transport_cancel_pkt(), a null
dereference will happen on transport->cancel_pkt.

Fixes: c0cfa2d8a7 ("vsock: add multi-transports support")
Signed-off-by: Norbert Slusarek <nslusarek@gmx.net>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Link: https://lore.kernel.org/r/trinity-c2d6cede-bfb1-44e2-85af-1fbc7f541715-1612535117028@3c-app-gmx-bap12
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-02-17 11:02:29 +01:00
Greg Kroah-Hartman
cf5b2483a5 Merge 5.10.13 into android12-5.10
Changes in 5.10.13
	iwlwifi: provide gso_type to GSO packets
	nbd: freeze the queue while we're adding connections
	tty: avoid using vfs_iocb_iter_write() for redirected console writes
	ACPI: sysfs: Prefer "compatible" modalias
	ACPI: thermal: Do not call acpi_thermal_check() directly
	kernel: kexec: remove the lock operation of system_transition_mutex
	ALSA: hda/realtek: Enable headset of ASUS B1400CEPE with ALC256
	ALSA: hda/via: Apply the workaround generically for Clevo machines
	parisc: Enable -mlong-calls gcc option by default when !CONFIG_MODULES
	media: cec: add stm32 driver
	media: cedrus: Fix H264 decoding
	media: hantro: Fix reset_raw_fmt initialization
	media: rc: fix timeout handling after switch to microsecond durations
	media: rc: ite-cir: fix min_timeout calculation
	media: rc: ensure that uevent can be read directly after rc device register
	ARM: dts: tbs2910: rename MMC node aliases
	ARM: dts: ux500: Reserve memory carveouts
	ARM: dts: imx6qdl-gw52xx: fix duplicate regulator naming
	wext: fix NULL-ptr-dereference with cfg80211's lack of commit()
	x86/xen: avoid warning in Xen pv guest with CONFIG_AMD_MEM_ENCRYPT enabled
	ASoC: AMD Renoir - refine DMI entries for some Lenovo products
	Revert "drm/amdgpu/swsmu: drop set_fan_speed_percent (v2)"
	drm/nouveau/kms/gk104-gp1xx: Fix > 64x64 cursors
	drm/i915: Always flush the active worker before returning from the wait
	drm/i915/gt: Always try to reserve GGTT address 0x0
	drivers/nouveau/kms/nv50-: Reject format modifiers for cursor planes
	bcache: only check feature sets when sb->version >= BCACHE_SB_VERSION_CDEV_WITH_FEATURES
	net: usb: qmi_wwan: added support for Thales Cinterion PLSx3 modem family
	s390: uv: Fix sysfs max number of VCPUs reporting
	s390/vfio-ap: No need to disable IRQ after queue reset
	PM: hibernate: flush swap writer after marking
	x86/entry: Emit a symbol for register restoring thunk
	efi/apple-properties: Reinstate support for boolean properties
	crypto: marvel/cesa - Fix tdma descriptor on 64-bit
	drivers: soc: atmel: Avoid calling at91_soc_init on non AT91 SoCs
	drivers: soc: atmel: add null entry at the end of at91_soc_allowed_list[]
	btrfs: fix lockdep warning due to seqcount_mutex on 32bit arch
	btrfs: fix possible free space tree corruption with online conversion
	KVM: x86/pmu: Fix HW_REF_CPU_CYCLES event pseudo-encoding in intel_arch_events[]
	KVM: x86/pmu: Fix UBSAN shift-out-of-bounds warning in intel_pmu_refresh()
	KVM: arm64: Filter out v8.1+ events on v8.0 HW
	KVM: nSVM: cancel KVM_REQ_GET_NESTED_STATE_PAGES on nested vmexit
	KVM: x86: allow KVM_REQ_GET_NESTED_STATE_PAGES outside guest mode for VMX
	KVM: nVMX: Sync unsync'd vmcs02 state to vmcs12 on migration
	KVM: x86: get smi pending status correctly
	KVM: Forbid the use of tagged userspace addresses for memslots
	io_uring: fix wqe->lock/completion_lock deadlock
	xen: Fix XenStore initialisation for XS_LOCAL
	leds: trigger: fix potential deadlock with libata
	arm64: dts: broadcom: Fix USB DMA address translation for Stingray
	mt7601u: fix kernel crash unplugging the device
	mt76: mt7663s: fix rx buffer refcounting
	mt7601u: fix rx buffer refcounting
	iwlwifi: Fix IWL_SUBDEVICE_NO_160 macro to use the correct bit.
	drm/i915/gt: Clear CACHE_MODE prior to clearing residuals
	drm/i915/pmu: Don't grab wakeref when enabling events
	net/mlx5e: Fix IPSEC stats
	ARM: dts: imx6qdl-kontron-samx6i: fix pwms for lcd-backlight
	drm/nouveau/svm: fail NOUVEAU_SVM_INIT ioctl on unsupported devices
	drm/vc4: Correct lbm size and calculation
	drm/vc4: Correct POS1_SCL for hvs5
	drm/nouveau/dispnv50: Restore pushing of all data.
	drm/i915: Check for all subplatform bits
	drm/i915/selftest: Fix potential memory leak
	uapi: fix big endian definition of ipv6_rpl_sr_hdr
	KVM: Documentation: Fix spec for KVM_CAP_ENABLE_CAP_VM
	tee: optee: replace might_sleep with cond_resched
	xen-blkfront: allow discard-* nodes to be optional
	blk-mq: test QUEUE_FLAG_HCTX_ACTIVE for sbitmap_shared in hctx_may_queue
	clk: imx: fix Kconfig warning for i.MX SCU clk
	clk: mmp2: fix build without CONFIG_PM
	clk: qcom: gcc-sm250: Use floor ops for sdcc clks
	ARM: imx: build suspend-imx6.S with arm instruction set
	ARM: zImage: atags_to_fdt: Fix node names on added root nodes
	netfilter: nft_dynset: add timeout extension to template
	Revert "RDMA/mlx5: Fix devlink deadlock on net namespace deletion"
	Revert "block: simplify set_init_blocksize" to regain lost performance
	xfrm: Fix oops in xfrm_replay_advance_bmp
	xfrm: fix disable_xfrm sysctl when used on xfrm interfaces
	selftests: xfrm: fix test return value override issue in xfrm_policy.sh
	xfrm: Fix wraparound in xfrm_policy_addr_delta()
	arm64: dts: ls1028a: fix the offset of the reset register
	ARM: imx: fix imx8m dependencies
	ARM: dts: imx6qdl-kontron-samx6i: fix i2c_lcd/cam default status
	ARM: dts: imx6qdl-sr-som: fix some cubox-i platforms
	arm64: dts: imx8mp: Correct the gpio ranges of gpio3
	firmware: imx: select SOC_BUS to fix firmware build
	RDMA/cxgb4: Fix the reported max_recv_sge value
	ASoC: dt-bindings: lpass: Fix and common up lpass dai ids
	ASoC: qcom: Fix incorrect volatile registers
	ASoC: qcom: Fix broken support to MI2S TERTIARY and QUATERNARY
	ASoC: qcom: lpass-ipq806x: fix bitwidth regmap field
	spi: altera: Fix memory leak on error path
	ASoC: Intel: Skylake: skl-topology: Fix OOPs ib skl_tplg_complete
	powerpc/64s: prevent recursive replay_soft_interrupts causing superfluous interrupt
	pNFS/NFSv4: Fix a layout segment leak in pnfs_layout_process()
	pNFS/NFSv4: Update the layout barrier when we schedule a layoutreturn
	ASoC: SOF: Intel: soundwire: fix select/depend unmet dependencies
	ASoC: qcom: lpass: Fix out-of-bounds DAI ID lookup
	iwlwifi: pcie: avoid potential PNVM leaks
	iwlwifi: pnvm: don't skip everything when not reloading
	iwlwifi: pnvm: don't try to load after failures
	iwlwifi: pcie: set LTR on more devices
	iwlwifi: pcie: use jiffies for memory read spin time limit
	iwlwifi: pcie: reschedule in long-running memory reads
	mac80211: pause TX while changing interface type
	ice: fix FDir IPv6 flexbyte
	ice: Implement flow for IPv6 next header (extension header)
	ice: update dev_addr in ice_set_mac_address even if HW filter exists
	ice: Don't allow more channels than LAN MSI-X available
	ice: Fix MSI-X vector fallback logic
	i40e: acquire VSI pointer only after VF is initialized
	igc: fix link speed advertising
	net/mlx5: Fix memory leak on flow table creation error flow
	net/mlx5e: E-switch, Fix rate calculation for overflow
	net/mlx5e: free page before return
	net/mlx5e: Reduce tc unsupported key print level
	net/mlx5: Maintain separate page trees for ECPF and PF functions
	net/mlx5e: Disable hw-tc-offload when MLX5_CLS_ACT config is disabled
	net/mlx5e: Fix CT rule + encap slow path offload and deletion
	net/mlx5e: Correctly handle changing the number of queues when the interface is down
	net/mlx5e: Revert parameters on errors when changing trust state without reset
	net/mlx5e: Revert parameters on errors when changing MTU and LRO state without reset
	net/mlx5: CT: Fix incorrect removal of tuple_nat_node from nat rhashtable
	can: dev: prevent potential information leak in can_fill_info()
	ACPI/IORT: Do not blindly trust DMA masks from firmware
	of/device: Update dma_range_map only when dev has valid dma-ranges
	iommu/amd: Use IVHD EFR for early initialization of IOMMU features
	iommu/vt-d: Correctly check addr alignment in qi_flush_dev_iotlb_pasid()
	nvme-multipath: Early exit if no path is available
	selftests: forwarding: Specify interface when invoking mausezahn
	rxrpc: Fix memory leak in rxrpc_lookup_local
	NFC: fix resource leak when target index is invalid
	NFC: fix possible resource leak
	ASoC: mediatek: mt8183-da7219: ignore TDM DAI link by default
	ASoC: mediatek: mt8183-mt6358: ignore TDM DAI link by default
	ASoC: topology: Properly unregister DAI on removal
	ASoC: topology: Fix memory corruption in soc_tplg_denum_create_values()
	scsi: qla2xxx: Fix description for parameter ql2xenforce_iocb_limit
	team: protect features update by RCU to avoid deadlock
	tcp: make TCP_USER_TIMEOUT accurate for zero window probes
	tcp: fix TLP timer not set when CA_STATE changes from DISORDER to OPEN
	vsock: fix the race conditions in multi-transport support
	Linux 5.10.13

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I75f419b25f24da559e446d62f75ce6bb9b0a5396
2021-02-05 10:38:34 +01:00
Alexander Popov
55d900415b vsock: fix the race conditions in multi-transport support
commit c518adafa3 upstream.

There are multiple similar bugs implicitly introduced by the
commit c0cfa2d8a7 ("vsock: add multi-transports support") and
commit 6a2c096210 ("vsock: prevent transport modules unloading").

The bug pattern:
 [1] vsock_sock.transport pointer is copied to a local variable,
 [2] lock_sock() is called,
 [3] the local variable is used.
VSOCK multi-transport support introduced the race condition:
vsock_sock.transport value may change between [1] and [2].

Let's copy vsock_sock.transport pointer to local variables after
the lock_sock() call.

Fixes: c0cfa2d8a7 ("vsock: add multi-transports support")
Signed-off-by: Alexander Popov <alex.popov@linux.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Jorgen Hansen <jhansen@vmware.com>
Link: https://lore.kernel.org/r/20210201084719.2257066-1-alex.popov@linux.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-02-03 23:28:52 +01:00
Ram Muthiah
d4ff3d23ce ANDROID: Make vsock virtio packet buff size configurable
When the android virtual device stays up for long periods of time, the
SLAB sustains everincreasing fragmentation. Contributing to this
fragmentation are the virtio packet buffer allocations which are a
drain on 64Kb compound pages. Eventually these can't be allocated due to
fragmentation.

To enable successful allocations for this packet buffer, the packet
buffer's size needs to be reduced.

To enable a reduction without impacting other partners, this var is
being exposed as a command line param.

Bug: 149494272
Test: atest ManagedProfileLifecycleStressTest#testCreateStartDelete on
local cuttlefish device
Signed-off-by: Ram Muthiah <rammuthiah@google.com>
Change-Id: Ia4f9180025b64d61d9e2b882daa84460b8f08fd2
2021-02-01 19:32:29 +00:00
Stefano Garzarella
3fe356d58e vsock/virtio: discard packets only when socket is really closed
Starting from commit 8692cefc43 ("virtio_vsock: Fix race condition
in virtio_transport_recv_pkt"), we discard packets in
virtio_transport_recv_pkt() if the socket has been released.

When the socket is connected, we schedule a delayed work to wait the
RST packet from the other peer, also if SHUTDOWN_MASK is set in
sk->sk_shutdown.
This is done to complete the virtio-vsock shutdown algorithm, releasing
the port assigned to the socket definitively only when the other peer
has consumed all the packets.

If we discard the RST packet received, the socket will be closed only
when the VSOCK_CLOSE_TIMEOUT is reached.

Sergio discovered the issue while running ab(1) HTTP benchmark using
libkrun [1] and observing a latency increase with that commit.

To avoid this issue, we discard packet only if the socket is really
closed (SOCK_DONE flag is set).
We also set SOCK_DONE in virtio_transport_release() when we don't need
to wait any packets from the other peer (we didn't schedule the delayed
work). In this case we remove the socket from the vsock lists, releasing
the port assigned.

[1] https://github.com/containers/libkrun

Fixes: 8692cefc43 ("virtio_vsock: Fix race condition in virtio_transport_recv_pkt")
Cc: justin.he@arm.com
Reported-by: Sergio Lopez <slp@redhat.com>
Tested-by: Sergio Lopez <slp@redhat.com>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Acked-by: Jia He <justin.he@arm.com>
Link: https://lore.kernel.org/r/20201120104736.73749-1-sgarzare@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2020-11-23 16:36:29 -08:00
Stefano Garzarella
65b422d9b6 vsock: forward all packets to the host when no H2G is registered
Before commit c0cfa2d8a7 ("vsock: add multi-transports support"),
if a G2H transport was loaded (e.g. virtio transport), every packets
was forwarded to the host, regardless of the destination CID.
The H2G transports implemented until then (vhost-vsock, VMCI) always
responded with an error, if the destination CID was not
VMADDR_CID_HOST.

From that commit, we are using the remote CID to decide which
transport to use, so packets with remote CID > VMADDR_CID_HOST(2)
are sent only through H2G transport. If no H2G is available, packets
are discarded directly in the guest.

Some use cases (e.g. Nitro Enclaves [1]) rely on the old behaviour
to implement sibling VMs communication, so we restore the old
behavior when no H2G is registered.
It will be up to the host to discard packets if the destination is
not the right one. As it was already implemented before adding
multi-transport support.

Tested with nested QEMU/KVM by me and Nitro Enclaves by Andra.

[1] Documentation/virt/ne_overview.rst

Cc: Jorgen Hansen <jhansen@vmware.com>
Cc: Dexuan Cui <decui@microsoft.com>
Fixes: c0cfa2d8a7 ("vsock: add multi-transports support")
Reported-by: Andra Paraschiv <andraprs@amazon.com>
Tested-by: Andra Paraschiv <andraprs@amazon.com>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Link: https://lore.kernel.org/r/20201112133837.34183-1-sgarzare@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2020-11-14 11:33:39 -08:00
Jeff Vander Stoep
af545bb5ee vsock: use ns_capable_noaudit() on socket create
During __vsock_create() CAP_NET_ADMIN is used to determine if the
vsock_sock->trusted should be set to true. This value is used later
for determing if a remote connection should be allowed to connect
to a restricted VM. Unfortunately, if the caller doesn't have
CAP_NET_ADMIN, an audit message such as an selinux denial is
generated even if the caller does not want a trusted socket.

Logging errors on success is confusing. To avoid this, switch the
capable(CAP_NET_ADMIN) check to the noaudit version.

Reported-by: Roman Kiryanov <rkir@google.com>
https://android-review.googlesource.com/c/device/generic/goldfish/+/1468545/
Signed-off-by: Jeff Vander Stoep <jeffv@google.com>
Reviewed-by: James Morris <jamorris@linux.microsoft.com>
Link: https://lore.kernel.org/r/20201023143757.377574-1-jeffv@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2020-10-26 16:22:42 -07:00
Stefano Garzarella
1980c05844 vsock: fix potential null pointer dereference in vsock_poll()
syzbot reported this issue where in the vsock_poll() we find the
socket state at TCP_ESTABLISHED, but 'transport' is null:
  general protection fault, probably for non-canonical address 0xdffffc0000000012: 0000 [#1] PREEMPT SMP KASAN
  KASAN: null-ptr-deref in range [0x0000000000000090-0x0000000000000097]
  CPU: 0 PID: 8227 Comm: syz-executor.2 Not tainted 5.8.0-rc7-syzkaller #0
  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
  RIP: 0010:vsock_poll+0x75a/0x8e0 net/vmw_vsock/af_vsock.c:1038
  Call Trace:
   sock_poll+0x159/0x460 net/socket.c:1266
   vfs_poll include/linux/poll.h:90 [inline]
   do_pollfd fs/select.c:869 [inline]
   do_poll fs/select.c:917 [inline]
   do_sys_poll+0x607/0xd40 fs/select.c:1011
   __do_sys_poll fs/select.c:1069 [inline]
   __se_sys_poll fs/select.c:1057 [inline]
   __x64_sys_poll+0x18c/0x440 fs/select.c:1057
   do_syscall_64+0x60/0xe0 arch/x86/entry/common.c:384
   entry_SYSCALL_64_after_hwframe+0x44/0xa9

This issue can happen if the TCP_ESTABLISHED state is set after we read
the vsk->transport in the vsock_poll().

We could put barriers to synchronize, but this can only happen during
connection setup, so we can simply check that 'transport' is valid.

Fixes: c0cfa2d8a7 ("vsock: add multi-transports support")
Reported-and-tested-by: syzbot+a61bac2fcc1a7c6623fe@syzkaller.appspotmail.com
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Jorgen Hansen <jhansen@vmware.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-08-12 12:56:06 -07:00
David S. Miller
a57066b1a0 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
The UDP reuseport conflict was a little bit tricky.

The net-next code, via bpf-next, extracted the reuseport handling
into a helper so that the BPF sk lookup code could invoke it.

At the same time, the logic for reuseport handling of unconnected
sockets changed via commit efc6b6f6c3
which changed the logic to carry on the reuseport result into the
rest of the lookup loop if we do not return immediately.

This requires moving the reuseport_has_conns() logic into the callers.

While we are here, get rid of inline directives as they do not belong
in foo.c files.

The other changes were cases of more straightforward overlapping
modifications.

Signed-off-by: David S. Miller <davem@davemloft.net>
2020-07-25 17:49:04 -07:00
Christoph Hellwig
a7b75c5a8c net: pass a sockptr_t into ->setsockopt
Rework the remaining setsockopt code to pass a sockptr_t instead of a
plain user pointer.  This removes the last remaining set_fs(KERNEL_DS)
outside of architecture specific code.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Acked-by: Stefan Schmidt <stefan@datenfreihafen.org> [ieee802154]
Acked-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-07-24 15:41:54 -07:00
Christoph Hellwig
a44d9e7210 net: make ->{get,set}sockopt in proto_ops optional
Just check for a NULL method instead of wiring up
sock_no_{get,set}sockopt.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Acked-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-07-19 18:16:41 -07:00
Stefano Garzarella
f961134a61 vsock/virtio: annotate 'the_virtio_vsock' RCU pointer
Commit 0deab087b1 ("vsock/virtio: use RCU to avoid use-after-free
on the_virtio_vsock") starts to use RCU to protect 'the_virtio_vsock'
pointer, but we forgot to annotate it.

This patch adds the annotation to fix the following sparse errors:

    net/vmw_vsock/virtio_transport.c:73:17: error: incompatible types in comparison expression (different address spaces):
    net/vmw_vsock/virtio_transport.c:73:17:    struct virtio_vsock [noderef] __rcu *
    net/vmw_vsock/virtio_transport.c:73:17:    struct virtio_vsock *
    net/vmw_vsock/virtio_transport.c:171:17: error: incompatible types in comparison expression (different address spaces):
    net/vmw_vsock/virtio_transport.c:171:17:    struct virtio_vsock [noderef] __rcu *
    net/vmw_vsock/virtio_transport.c:171:17:    struct virtio_vsock *
    net/vmw_vsock/virtio_transport.c:207:17: error: incompatible types in comparison expression (different address spaces):
    net/vmw_vsock/virtio_transport.c:207:17:    struct virtio_vsock [noderef] __rcu *
    net/vmw_vsock/virtio_transport.c:207:17:    struct virtio_vsock *
    net/vmw_vsock/virtio_transport.c:561:13: error: incompatible types in comparison expression (different address spaces):
    net/vmw_vsock/virtio_transport.c:561:13:    struct virtio_vsock [noderef] __rcu *
    net/vmw_vsock/virtio_transport.c:561:13:    struct virtio_vsock *
    net/vmw_vsock/virtio_transport.c:612:9: error: incompatible types in comparison expression (different address spaces):
    net/vmw_vsock/virtio_transport.c:612:9:    struct virtio_vsock [noderef] __rcu *
    net/vmw_vsock/virtio_transport.c:612:9:    struct virtio_vsock *
    net/vmw_vsock/virtio_transport.c:631:9: error: incompatible types in comparison expression (different address spaces):
    net/vmw_vsock/virtio_transport.c:631:9:    struct virtio_vsock [noderef] __rcu *
    net/vmw_vsock/virtio_transport.c:631:9:    struct virtio_vsock *

Fixes: 0deab087b1 ("vsock/virtio: use RCU to avoid use-after-free on the_virtio_vsock")
Reported-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2020-07-15 17:47:15 -07:00
Stefano Garzarella
fdb4276aae vsock/vmci: make vmci_vsock_transport_cb() static
Fix the following gcc-9.3 warning when building with 'make W=1':
    net/vmw_vsock/vmci_transport.c:2058:6: warning: no previous prototype
        for ‘vmci_vsock_transport_cb’ [-Wmissing-prototypes]
     2058 | void vmci_vsock_transport_cb(bool is_host)
          |      ^~~~~~~~~~~~~~~~~~~~~~~

Fixes: b1bba80a43 ("vsock/vmci: register vmci_transport only when VMCI guest/host are active")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-06-05 13:18:26 -07:00
Jia He
8692cefc43 virtio_vsock: Fix race condition in virtio_transport_recv_pkt
When client on the host tries to connect(SOCK_STREAM, O_NONBLOCK) to the
server on the guest, there will be a panic on a ThunderX2 (armv8a server):

[  463.718844] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
[  463.718848] Mem abort info:
[  463.718849]   ESR = 0x96000044
[  463.718852]   EC = 0x25: DABT (current EL), IL = 32 bits
[  463.718853]   SET = 0, FnV = 0
[  463.718854]   EA = 0, S1PTW = 0
[  463.718855] Data abort info:
[  463.718856]   ISV = 0, ISS = 0x00000044
[  463.718857]   CM = 0, WnR = 1
[  463.718859] user pgtable: 4k pages, 48-bit VAs, pgdp=0000008f6f6e9000
[  463.718861] [0000000000000000] pgd=0000000000000000
[  463.718866] Internal error: Oops: 96000044 [#1] SMP
[...]
[  463.718977] CPU: 213 PID: 5040 Comm: vhost-5032 Tainted: G           O      5.7.0-rc7+ #139
[  463.718980] Hardware name: GIGABYTE R281-T91-00/MT91-FS1-00, BIOS F06 09/25/2018
[  463.718982] pstate: 60400009 (nZCv daif +PAN -UAO)
[  463.718995] pc : virtio_transport_recv_pkt+0x4c8/0xd40 [vmw_vsock_virtio_transport_common]
[  463.718999] lr : virtio_transport_recv_pkt+0x1fc/0xd40 [vmw_vsock_virtio_transport_common]
[  463.719000] sp : ffff80002dbe3c40
[...]
[  463.719025] Call trace:
[  463.719030]  virtio_transport_recv_pkt+0x4c8/0xd40 [vmw_vsock_virtio_transport_common]
[  463.719034]  vhost_vsock_handle_tx_kick+0x360/0x408 [vhost_vsock]
[  463.719041]  vhost_worker+0x100/0x1a0 [vhost]
[  463.719048]  kthread+0x128/0x130
[  463.719052]  ret_from_fork+0x10/0x18

The race condition is as follows:
Task1                                Task2
=====                                =====
__sock_release                       virtio_transport_recv_pkt
  __vsock_release                      vsock_find_bound_socket (found sk)
    lock_sock_nested
    vsock_remove_sock
    sock_orphan
      sk_set_socket(sk, NULL)
    sk->sk_shutdown = SHUTDOWN_MASK
    ...
    release_sock
                                    lock_sock
                                       virtio_transport_recv_connecting
                                         sk->sk_socket->state (panic!)

The root cause is that vsock_find_bound_socket can't hold the lock_sock,
so there is a small race window between vsock_find_bound_socket() and
lock_sock(). If __vsock_release() is running in another task,
sk->sk_socket will be set to NULL inadvertently.

This fixes it by checking sk->sk_shutdown(suggested by Stefano) after
lock_sock since sk->sk_shutdown is set to SHUTDOWN_MASK under the
protection of lock_sock_nested.

Signed-off-by: Jia He <justin.he@arm.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-05-30 17:44:01 -07:00
Stefano Garzarella
7e0afbdfd1 vsock: fix timeout in vsock_accept()
The accept(2) is an "input" socket interface, so we should use
SO_RCVTIMEO instead of SO_SNDTIMEO to set the timeout.

So this patch replace sock_sndtimeo() with sock_rcvtimeo() to
use the right timeout in the vsock_accept().

Fixes: d021c34405 ("VSOCK: Introduce VM Sockets")
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Jorgen Hansen <jhansen@vmware.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-05-27 11:20:23 -07:00
Stefano Garzarella
a78d163978 vsock/virtio: fix multiple packet delivery to monitoring devices
In virtio_transport.c, if the virtqueue is full, the transmitting
packet is queued up and it will be sent in the next iteration.
This causes the same packet to be delivered multiple times to
monitoring devices.

We want to continue to deliver packets to monitoring devices before
it is put in the virtqueue, to avoid that replies can appear in the
packet capture before the transmitted packet.

This patch fixes the issue, adding a new flag (tap_delivered) in
struct virtio_vsock_pkt, to check if the packet is already delivered
to monitoring devices.

In vhost/vsock.c, we are splitting packets, so we must set
'tap_delivered' to false when we queue up the same virtio_vsock_pkt
to handle the remaining bytes.

Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-04-27 10:18:01 -07:00
David S. Miller
9f6e055907 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
The mptcp conflict was overlapping additions.

The SMC conflict was an additional and removal happening at the same
time.

Signed-off-by: David S. Miller <davem@davemloft.net>
2020-02-27 18:31:39 -08:00
Stefano Garzarella
3f74957fcb vsock: fix potential deadlock in transport->release()
Some transports (hyperv, virtio) acquire the sock lock during the
.release() callback.

In the vsock_stream_connect() we call vsock_assign_transport(); if
the socket was previously assigned to another transport, the
vsk->transport->release() is called, but the sock lock is already
held in the vsock_stream_connect(), causing a deadlock reported by
syzbot:

    INFO: task syz-executor280:9768 blocked for more than 143 seconds.
      Not tainted 5.6.0-rc1-syzkaller #0
    "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
    syz-executor280 D27912  9768   9766 0x00000000
    Call Trace:
     context_switch kernel/sched/core.c:3386 [inline]
     __schedule+0x934/0x1f90 kernel/sched/core.c:4082
     schedule+0xdc/0x2b0 kernel/sched/core.c:4156
     __lock_sock+0x165/0x290 net/core/sock.c:2413
     lock_sock_nested+0xfe/0x120 net/core/sock.c:2938
     virtio_transport_release+0xc4/0xd60 net/vmw_vsock/virtio_transport_common.c:832
     vsock_assign_transport+0xf3/0x3b0 net/vmw_vsock/af_vsock.c:454
     vsock_stream_connect+0x2b3/0xc70 net/vmw_vsock/af_vsock.c:1288
     __sys_connect_file+0x161/0x1c0 net/socket.c:1857
     __sys_connect+0x174/0x1b0 net/socket.c:1874
     __do_sys_connect net/socket.c:1885 [inline]
     __se_sys_connect net/socket.c:1882 [inline]
     __x64_sys_connect+0x73/0xb0 net/socket.c:1882
     do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
     entry_SYSCALL_64_after_hwframe+0x49/0xbe

To avoid this issue, this patch remove the lock acquiring in the
.release() callback of hyperv and virtio transports, and it holds
the lock when we call vsk->transport->release() in the vsock core.

Reported-by: syzbot+731710996d79d0d58fbc@syzkaller.appspotmail.com
Fixes: 408624af4c ("vsock: use local transport when it is loaded")
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-02-27 12:03:56 -08:00
Sebastien Boeuf
df12eb6d6c net: virtio_vsock: Enhance connection semantics
Whenever the vsock backend on the host sends a packet through the RX
queue, it expects an answer on the TX queue. Unfortunately, there is one
case where the host side will hang waiting for the answer and might
effectively never recover if no timeout mechanism was implemented.

This issue happens when the guest side starts binding to the socket,
which insert a new bound socket into the list of already bound sockets.
At this time, we expect the guest to also start listening, which will
trigger the sk_state to move from TCP_CLOSE to TCP_LISTEN. The problem
occurs if the host side queued a RX packet and triggered an interrupt
right between the end of the binding process and the beginning of the
listening process. In this specific case, the function processing the
packet virtio_transport_recv_pkt() will find a bound socket, which means
it will hit the switch statement checking for the sk_state, but the
state won't be changed into TCP_LISTEN yet, which leads the code to pick
the default statement. This default statement will only free the buffer,
while it should also respond to the host side, by sending a packet on
its TX queue.

In order to simply fix this unfortunate chain of events, it is important
that in case the default statement is entered, and because at this stage
we know the host side is waiting for an answer, we must send back a
packet containing the operation VIRTIO_VSOCK_OP_RST.

One could say that a proper timeout mechanism on the host side will be
enough to avoid the backend to hang. But the point of this patch is to
ensure the normal use case will be provided with proper responsiveness
when it comes to establishing the connection.

Signed-off-by: Sebastien Boeuf <sebastien.boeuf@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-02-16 19:01:49 -08:00
David S. Miller
b3f7e3f23a Merge ra.kernel.org:/pub/scm/linux/kernel/git/netdev/net 2020-01-19 22:10:04 +01:00
Sunil Muthuswamy
c742c59e1f hv_sock: Remove the accept port restriction
Currently, hv_sock restricts the port the guest socket can accept
connections on. hv_sock divides the socket port namespace into two parts
for server side (listening socket), 0-0x7FFFFFFF & 0x80000000-0xFFFFFFFF
(there are no restrictions on client port namespace). The first part
(0-0x7FFFFFFF) is reserved for sockets where connections can be accepted.
The second part (0x80000000-0xFFFFFFFF) is reserved for allocating ports
for the peer (host) socket, once a connection is accepted.
This reservation of the port namespace is specific to hv_sock and not
known by the generic vsock library (ex: af_vsock). This is problematic
because auto-binds/ephemeral ports are handled by the generic vsock
library and it has no knowledge of this port reservation and could
allocate a port that is not compatible with hv_sock (and legitimately so).
The issue hasn't surfaced so far because the auto-bind code of vsock
(__vsock_bind_stream) prior to the change 'VSOCK: bind to random port for
VMADDR_PORT_ANY' would start walking up from LAST_RESERVED_PORT (1023) and
start assigning ports. That will take a large number of iterations to hit
0x7FFFFFFF. But, after the above change to randomize port selection, the
issue has started coming up more frequently.
There has really been no good reason to have this port reservation logic
in hv_sock from the get go. Reserving a local port for peer ports is not
how things are handled generally. Peer ports should reflect the peer port.
This fixes the issue by lifting the port reservation, and also returns the
right peer port. Since the code converts the GUID to the peer port (by
using the first 4 bytes), there is a possibility of conflicts, but that
seems like a reasonable risk to take, given this is limited to vsock and
that only applies to all local sockets.

Signed-off-by: Sunil Muthuswamy <sunilmut@microsoft.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-01-14 11:50:53 -08:00
David S. Miller
ac80010fc9 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Mere overlapping changes in the conflicts here.

Signed-off-by: David S. Miller <davem@davemloft.net>
2019-12-22 15:15:05 -08:00
Stefano Garzarella
4aaf596148 vsock/virtio: add WARN_ON check on virtio_transport_get_ops()
virtio_transport_get_ops() and virtio_transport_send_pkt_info()
can only be used on connecting/connected sockets, since a socket
assigned to a transport is required.

This patch adds a WARN_ON() on virtio_transport_get_ops() to check
this requirement, a comment and a returned error on
virtio_transport_send_pkt_info(),

Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-12-16 16:07:12 -08:00
Stefano Garzarella
df18fa1462 vsock/virtio: fix null-pointer dereference in virtio_transport_recv_listen()
With multi-transport support, listener sockets are not bound to any
transport. So, calling virtio_transport_reset(), when an error
occurs, on a listener socket produces the following null-pointer
dereference:

  BUG: kernel NULL pointer dereference, address: 00000000000000e8
  #PF: supervisor read access in kernel mode
  #PF: error_code(0x0000) - not-present page
  PGD 0 P4D 0
  Oops: 0000 [#1] SMP PTI
  CPU: 0 PID: 20 Comm: kworker/0:1 Not tainted 5.5.0-rc1-ste-00003-gb4be21f316ac-dirty #56
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014
  Workqueue: virtio_vsock virtio_transport_rx_work [vmw_vsock_virtio_transport]
  RIP: 0010:virtio_transport_send_pkt_info+0x20/0x130 [vmw_vsock_virtio_transport_common]
  Code: 1f 84 00 00 00 00 00 0f 1f 00 55 48 89 e5 41 57 41 56 41 55 49 89 f5 41 54 49 89 fc 53 48 83 ec 10 44 8b 76 20 e8 c0 ba fe ff <48> 8b 80 e8 00 00 00 e8 64 e3 7d c1 45 8b 45 00 41 8b 8c 24 d4 02
  RSP: 0018:ffffc900000b7d08 EFLAGS: 00010282
  RAX: 0000000000000000 RBX: ffff88807bf12728 RCX: 0000000000000000
  RDX: ffff88807bf12700 RSI: ffffc900000b7d50 RDI: ffff888035c84000
  RBP: ffffc900000b7d40 R08: ffff888035c84000 R09: ffffc900000b7d08
  R10: ffff8880781de800 R11: 0000000000000018 R12: ffff888035c84000
  R13: ffffc900000b7d50 R14: 0000000000000000 R15: ffff88807bf12724
  FS:  0000000000000000(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 00000000000000e8 CR3: 00000000790f4004 CR4: 0000000000160ef0
  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
  Call Trace:
   virtio_transport_reset+0x59/0x70 [vmw_vsock_virtio_transport_common]
   virtio_transport_recv_pkt+0x5bb/0xe50 [vmw_vsock_virtio_transport_common]
   ? detach_buf_split+0xf1/0x130
   virtio_transport_rx_work+0xba/0x130 [vmw_vsock_virtio_transport]
   process_one_work+0x1c0/0x300
   worker_thread+0x45/0x3c0
   kthread+0xfc/0x130
   ? current_work+0x40/0x40
   ? kthread_park+0x90/0x90
   ret_from_fork+0x35/0x40
  Modules linked in: sunrpc kvm_intel kvm vmw_vsock_virtio_transport vmw_vsock_virtio_transport_common irqbypass vsock virtio_rng rng_core
  CR2: 00000000000000e8
  ---[ end trace e75400e2ea2fa824 ]---

This happens because virtio_transport_reset() calls
virtio_transport_send_pkt_info() that can be used only on
connecting/connected sockets.

This patch fixes the issue, using virtio_transport_reset_no_sock()
instead of virtio_transport_reset() when we are handling a listener
socket.

Fixes: c0cfa2d8a7 ("vsock: add multi-transports support")
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-12-16 16:07:12 -08:00
Stefano Garzarella
bf5432b1de vsock/virtio: remove loopback handling
We can remove the loopback handling from virtio_transport,
because now the vsock core is able to handle local communication
using the new vsock_loopback device.

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-12-11 15:01:23 -08:00
Stefano Garzarella
408624af4c vsock: use local transport when it is loaded
Now that we have a transport that can handle the local communication,
we can use it when it is loaded.

A socket will use the local transport (loopback) when the remote
CID is:
- equal to VMADDR_CID_LOCAL
- or equal to transport_g2h->get_local_cid(), if transport_g2h
  is loaded (this allows us to keep the same behavior implemented
  by virtio and vmci transports)
- or equal to VMADDR_CID_HOST, if transport_g2h is not loaded

Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-12-11 15:01:23 -08:00
Stefano Garzarella
077263fba1 vsock: add vsock_loopback transport
This patch adds a new vsock_loopback transport to handle local
communication.
This transport is based on the loopback implementation of
virtio_transport, so it uses the virtio_transport_common APIs
to interface with the vsock core.

Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-12-11 15:01:23 -08:00
Stefano Garzarella
0e12190578 vsock: add local transport support in the vsock core
This patch allows to register a transport able to handle
local communication (loopback).

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-12-11 15:01:23 -08:00
Stefano Garzarella
ef343b35d4 vsock: add VMADDR_CID_LOCAL definition
The VMADDR_CID_RESERVED (1) was used by VMCI, but now it is not
used anymore, so we can reuse it for local communication
(loopback) adding the new well-know CID: VMADDR_CID_LOCAL.

Cc: Jorgen Hansen <jhansen@vmware.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Jorgen Hansen <jhansen@vmware.com>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-12-11 15:01:23 -08:00
Stefano Garzarella
c5144fcbf2 vsock/virtio_transport_common: remove unused virtio header includes
We can remove virtio header includes, because virtio_transport_common
doesn't use virtio API, but provides common functions to interface
virtio/vhost transports with the af_vsock core, and to handle
the protocol.

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-12-11 15:01:23 -08:00
Linus Torvalds
0dd0c8f7db - Support for new VMBus protocols (Andrea Parri).
- Hibernation support (Dexuan Cui).
 - Latency testing framework (Branden Bonaby).
 - Decoupling Hyper-V page size from guest page size (Himadri Pandya).
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE4n5dijQDou9mhzu83qZv95d3LNwFAl3f5YIACgkQ3qZv95d3
 LNzBww/8Cpv/BnOs2cp56OhC+2++3YlWfmxGnvQb9h52weElgr1AZF33lAynp8BZ
 YssOcDnS/G2iAkNDffbQA7s3WTwIjP1weJibOeKbtcXp4SuhNR3gnJafufNddNDv
 bw8ZReLQV7hy3sHb3OUx0aJk5Mssp0N9ZpxRilyIpLELPfVp63gFebq6s1MQYljk
 BAiNO4SKqsGQGZApt2F4Cc3hX2wU2ZfiDm6SifXiLYITGnvilIn7XFIht+2jJBWS
 CdzRoGXcwhQhlj68XWlc89SOzJb7vVUMO1sr84psfbQ2LbhJU8lfJKRJ4b4lR07Z
 Uv5FYxjr14S65fv7DkzCfWU+uPN/sObG4pPXihlfqcTraOvYLQ6/x8cw+9tGZg4H
 aTtnF40hnO81aKsvPAeIsSzVkoyPaSrt7KKhk+Bw/5EUDTTNp6EbIuL4xwnKt6Rt
 2UpA5HM9guQqNb6OZrjlpZfJgd9bNP4CZLBTfOukmnZpONKr2Wv3wubcwQJ8ibQc
 1WZ5SfN2Wmg999Ski7j9qzHk0tWJxa6SX+2NLEHRKxy2nJSJ1zlAr//bznMyMgH/
 yKPDaSkOFoy0aqiTKV2WzuOY6FGXTrSo5vq8YAgYRgp3xB+5+7zLeqlj3ipXhLYE
 HH/eqB27eSnvi0jpub4TbszGJG0o4Z1aYx3aHYYqrOfWX/A5Vls=
 =oJGE
 -----END PGP SIGNATURE-----

Merge tag 'hyperv-next-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux

Pull Hyper-V updates from Sasha Levin:

 - support for new VMBus protocols (Andrea Parri)

 - hibernation support (Dexuan Cui)

 - latency testing framework (Branden Bonaby)

 - decoupling Hyper-V page size from guest page size (Himadri Pandya)

* tag 'hyperv-next-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: (22 commits)
  Drivers: hv: vmbus: Fix crash handler reset of Hyper-V synic
  drivers/hv: Replace binary semaphore with mutex
  drivers: iommu: hyperv: Make HYPERV_IOMMU only available on x86
  HID: hyperv: Add the support of hibernation
  hv_balloon: Add the support of hibernation
  x86/hyperv: Implement hv_is_hibernation_supported()
  Drivers: hv: balloon: Remove dependencies on guest page size
  Drivers: hv: vmbus: Remove dependencies on guest page size
  x86: hv: Add function to allocate zeroed page for Hyper-V
  Drivers: hv: util: Specify ring buffer size using Hyper-V page size
  Drivers: hv: Specify receive buffer size using Hyper-V page size
  tools: hv: add vmbus testing tool
  drivers: hv: vmbus: Introduce latency testing
  video: hyperv: hyperv_fb: Support deferred IO for Hyper-V frame buffer driver
  video: hyperv: hyperv_fb: Obtain screen resolution from Hyper-V host
  hv_netvsc: Add the support of hibernation
  hv_sock: Add the support of hibernation
  video: hyperv_fb: Add the support of hibernation
  scsi: storvsc: Add the support of hibernation
  Drivers: hv: vmbus: Add module parameter to cap the VMBus version
  ...
2019-11-30 14:50:51 -08:00
Dexuan Cui
2194c2eb67 hv_sock: Add the support of hibernation
Add the necessary dummy callbacks for hibernation.

Signed-off-by: Dexuan Cui <decui@microsoft.com>
Acked-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-11-21 20:10:44 -05:00
Stefano Garzarella
039fcccaed vsock: avoid to assign transport if its initialization fails
If transport->init() fails, we can't assign the transport to the
socket, because it's not initialized correctly, and any future
calls to the transport callbacks would have an unexpected behavior.

Fixes: c0cfa2d8a7 ("vsock: add multi-transports support")
Reported-and-tested-by: syzbot+e2e5c07bf353b2f79daa@syzkaller.appspotmail.com
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Jorgen Hansen <jhansen@vmware.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-11-21 11:37:16 -08:00
Stefano Garzarella
36c5b48b91 vsock: fix bind() behaviour taking care of CID
When we are looking for a socket bound to a specific address,
we also have to take into account the CID.

This patch is useful with multi-transports support because it
allows the binding of the same port with different CID, and
it prevents a connection to a wrong socket bound to the same
port, but with different CID.

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Jorgen Hansen <jhansen@vmware.com>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-11-14 18:12:18 -08:00
Stefano Garzarella
6a2c096210 vsock: prevent transport modules unloading
This patch adds 'module' member in the 'struct vsock_transport'
in order to get/put the transport module. This prevents the
module unloading while sockets are assigned to it.

We increase the module refcnt when a socket is assigned to a
transport, and we decrease the module refcnt when the socket
is destructed.

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Jorgen Hansen <jhansen@vmware.com>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-11-14 18:12:18 -08:00
Stefano Garzarella
b1bba80a43 vsock/vmci: register vmci_transport only when VMCI guest/host are active
To allow other transports to be loaded with vmci_transport,
we register the vmci_transport as G2H or H2G only when a VMCI guest
or host is active.

To do that, this patch adds a callback registered in the vmci driver
that will be called when the host or guest becomes active.
This callback will register the vmci_transport in the VSOCK core.

Cc: Jorgen Hansen <jhansen@vmware.com>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-11-14 18:12:18 -08:00
Stefano Garzarella
c0cfa2d8a7 vsock: add multi-transports support
This patch adds the support of multiple transports in the
VSOCK core.

With the multi-transports support, we can use vsock with nested VMs
(using also different hypervisors) loading both guest->host and
host->guest transports at the same time.

Major changes:
- vsock core module can be loaded regardless of the transports
- vsock_core_init() and vsock_core_exit() are renamed to
  vsock_core_register() and vsock_core_unregister()
- vsock_core_register() has a feature parameter (H2G, G2H, DGRAM)
  to identify which directions the transport can handle and if it's
  support DGRAM (only vmci)
- each stream socket is assigned to a transport when the remote CID
  is set (during the connect() or when we receive a connection request
  on a listener socket).
  The remote CID is used to decide which transport to use:
  - remote CID <= VMADDR_CID_HOST will use guest->host transport;
  - remote CID == local_cid (guest->host transport) will use guest->host
    transport for loopback (host->guest transports don't support loopback);
  - remote CID > VMADDR_CID_HOST will use host->guest transport;
- listener sockets are not bound to any transports since no transport
  operations are done on it. In this way we can create a listener
  socket, also if the transports are not loaded or with VMADDR_CID_ANY
  to listen on all transports.
- DGRAM sockets are handled as before, since only the vmci_transport
  provides this feature.

Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-11-14 18:12:18 -08:00