Commit Graph

14482 Commits

Author SHA1 Message Date
Greg Kroah-Hartman
5b87b8d669 ANDROID: GKI: fix up abi breakage from "cfg80211: fix management registrations locking"
Commit 4c22227e39 ("cfg80211: fix management registrations locking")
in 5.10.77, which is commit 09b1d5dc6c ("cfg80211: fix management
registrations locking") upstream, moved the mgmt_registrations_lock out
of struct wireless_dev.  This did not change the structure size, but
caused a CRC change in the structure pointer, which tripped the abi
checker.

So restore the variable, and comment that this is not used anymore.  No
driver should ever be touching this so it is safe.

Note, using a __GENKSYMS__ hack would work, as the overall structure
size remains the same when this variable is removed, BUT the warning
that the field is gone is reported by libabigail correctly, which would
require a .xml update, so it's not worth it.

Bug: 161946584
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ibcfe743833860e6f75611d7ebed1036a77be0a69
2021-11-06 12:02:55 +00:00
Johannes Berg
a7d87a08b4 UPSTREAM: cfg80211: fix management registrations locking
The management registrations locking was broken, the list was
locked for each wdev, but cfg80211_mgmt_registrations_update()
iterated it without holding all the correct spinlocks, causing
list corruption.

Rather than trying to fix it with fine-grained locking, just
move the lock to the wiphy/rdev (still need the list on each
wdev), we already need to hold the wdev lock to change it, so
there's no contention on the lock in any case. This trivially
fixes the bug since we hold one wdev's lock already, and now
will hold the lock that protects all lists.

Cc: stable@vger.kernel.org
Reported-by: Jouni Malinen <j@w1.fi>
Fixes: 6cd536fe62 ("cfg80211: change internal management frame registration API")
Link: https://lore.kernel.org/r/20211025133111.5cf733eab0f4.I7b0abb0494ab712f74e2efcd24bb31ac33f7eee9@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Bug: 204384349
(cherry picked from commit 09b1d5dc6c)
Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Id1bca68277be3a5f7c7329a8195018946f686bdb
2021-11-06 12:02:45 +00:00
Greg Kroah-Hartman
a6777a7cee Linux 5.10.61
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE4n5dijQDou9mhzu83qZv95d3LNwFAmEnjxwACgkQ3qZv95d3
 LNxlaw//VC9rmejl9JwdZQaz3NfhNv2UwamLShlliq2aBmy8d+fGTAMXkCW7UK/M
 gS27oweL6UV6wT8BKgK8LoKJ7L1rI1KDAePpxMCSZw8Mrd8jre0FMVgkkQz/2mFQ
 w3aMmVitCX7RIeShoxP/8fmWnGRkugDx7SZ2csoqRP9Txtih7DAamiun2ttTzzra
 4dxFRtyzw1LpJBSv/pMJ3/FusPkrbwKzSv2wYIgWmfhIWjPcvmBc0ufJmGUK7Gxo
 MJGaUWk9RJ3eNSUPUP3pJlKdzeHdOhOQnydiaUA60pWcDoAyQj7qM06af5hVLsCX
 0Z9r97bzWOF+LNuEiNIGbodJ74IgFv0VTgjlRdZfeLC+5yLyIo7fXAmAA2Od0fiH
 04Ak9+n+FTkl5avUufLrEwHljAAOgcbtJX7W4F/XPW+1P1tZxG9H4ZI+uQN7ZyAB
 fXGo3O3p5J14fI/m8Zr4mXDIiq34OPxSHLx89YryubriO8kdNv69+tciLn2m5a5W
 yctpYgVQnRJt44dg5I/aIzCSOW5+FviRY8slAopdXBIAwUZAZZgW9IVGAh2uRiLS
 tCtbFa3cXUV1JoWsgUdae8BDoOp0dm69yeYrP1f5eVCLe+FHa9P/Z3qxpBLhpPEh
 QOTI14tg3wu3vwFxAA2rsFmSInkh231ryjgGq788BnoHHad3DnI=
 =Rtb5
 -----END PGP SIGNATURE-----

Merge 5.10.61 into android12-5.10-lts

Changes in 5.10.61
	ath: Use safer key clearing with key cache entries
	ath9k: Clear key cache explicitly on disabling hardware
	ath: Export ath_hw_keysetmac()
	ath: Modify ath_key_delete() to not need full key entry
	ath9k: Postpone key cache entry deletion for TXQ frames reference it
	mtd: cfi_cmdset_0002: fix crash when erasing/writing AMD cards
	media: zr364xx: propagate errors from zr364xx_start_readpipe()
	media: zr364xx: fix memory leaks in probe()
	media: drivers/media/usb: fix memory leak in zr364xx_probe
	KVM: x86: Factor out x86 instruction emulation with decoding
	KVM: X86: Fix warning caused by stale emulation context
	USB: core: Avoid WARNings for 0-length descriptor requests
	USB: core: Fix incorrect pipe calculation in do_proc_control()
	dmaengine: xilinx_dma: Fix read-after-free bug when terminating transfers
	dmaengine: usb-dmac: Fix PM reference leak in usb_dmac_probe()
	spi: spi-mux: Add module info needed for autoloading
	net: xfrm: Fix end of loop tests for list_for_each_entry
	ARM: dts: am43x-epos-evm: Reduce i2c0 bus speed for tps65218
	dmaengine: of-dma: router_xlate to return -EPROBE_DEFER if controller is not yet available
	scsi: pm80xx: Fix TMF task completion race condition
	scsi: megaraid_mm: Fix end of loop tests for list_for_each_entry()
	scsi: scsi_dh_rdac: Avoid crash during rdac_bus_attach()
	scsi: core: Avoid printing an error if target_alloc() returns -ENXIO
	scsi: core: Fix capacity set to zero after offlinining device
	drm/amdgpu: fix the doorbell missing when in CGPG issue for renoir.
	qede: fix crash in rmmod qede while automatic debug collection
	ARM: dts: nomadik: Fix up interrupt controller node names
	net: usb: pegasus: Check the return value of get_geristers() and friends;
	net: usb: lan78xx: don't modify phy_device state concurrently
	drm/amd/display: Fix Dynamic bpp issue with 8K30 with Navi 1X
	drm/amd/display: workaround for hard hang on HPD on native DP
	Bluetooth: hidp: use correct wait queue when removing ctrl_wait
	arm64: dts: qcom: c630: fix correct powerdown pin for WSA881x
	arm64: dts: qcom: msm8992-bullhead: Remove PSCI
	iommu: Check if group is NULL before remove device
	cpufreq: armada-37xx: forbid cpufreq for 1.2 GHz variant
	dccp: add do-while-0 stubs for dccp_pr_debug macros
	virtio: Protect vqs list access
	vhost-vdpa: Fix integer overflow in vhost_vdpa_process_iotlb_update()
	bus: ti-sysc: Fix error handling for sysc_check_active_timer()
	vhost: Fix the calculation in vhost_overflow()
	vdpa/mlx5: Avoid destroying MR on empty iotlb
	soc / drm: mediatek: Move DDP component defines into mtk-mmsys.h
	drm/mediatek: Fix aal size config
	drm/mediatek: Add AAL output size configuration
	bpf: Clear zext_dst of dead insns
	bnxt: don't lock the tx queue from napi poll
	bnxt: disable napi before canceling DIM
	bnxt: make sure xmit_more + errors does not miss doorbells
	bnxt: count Tx drops
	net: 6pack: fix slab-out-of-bounds in decode_data
	ptp_pch: Restore dependency on PCI
	bnxt_en: Disable aRFS if running on 212 firmware
	bnxt_en: Add missing DMA memory barriers
	vrf: Reset skb conntrack connection on VRF rcv
	virtio-net: support XDP when not more queues
	virtio-net: use NETIF_F_GRO_HW instead of NETIF_F_LRO
	net: qlcnic: add missed unlock in qlcnic_83xx_flash_read32
	ixgbe, xsk: clean up the resources in ixgbe_xsk_pool_enable error path
	sch_cake: fix srchost/dsthost hashing mode
	net: mdio-mux: Don't ignore memory allocation errors
	net: mdio-mux: Handle -EPROBE_DEFER correctly
	ovs: clear skb->tstamp in forwarding path
	iommu/vt-d: Consolidate duplicate cache invaliation code
	iommu/vt-d: Fix incomplete cache flush in intel_pasid_tear_down_entry()
	r8152: fix writing USB_BP2_EN
	i40e: Fix ATR queue selection
	iavf: Fix ping is lost after untrusted VF had tried to change MAC
	Revert "flow_offload: action should not be NULL when it is referenced"
	mmc: dw_mmc: Fix hang on data CRC error
	mmc: mmci: stm32: Check when the voltage switch procedure should be done
	mmc: sdhci-msm: Update the software timeout value for sdhc
	clk: imx6q: fix uart earlycon unwork
	clk: qcom: gdsc: Ensure regulator init state matches GDSC state
	ALSA: hda - fix the 'Capture Switch' value change notifications
	tracing / histogram: Fix NULL pointer dereference on strcmp() on NULL event name
	slimbus: messaging: start transaction ids from 1 instead of zero
	slimbus: messaging: check for valid transaction id
	slimbus: ngd: reset dma setup during runtime pm
	ipack: tpci200: fix many double free issues in tpci200_pci_probe
	ipack: tpci200: fix memory leak in the tpci200_register
	ALSA: hda/realtek: Enable 4-speaker output for Dell XPS 15 9510 laptop
	mmc: sdhci-iproc: Cap min clock frequency on BCM2711
	mmc: sdhci-iproc: Set SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN on BCM2711
	btrfs: prevent rename2 from exchanging a subvol with a directory from different parents
	ALSA: hda/via: Apply runtime PM workaround for ASUS B23E
	s390/pci: fix use after free of zpci_dev
	PCI: Increase D3 delay for AMD Renoir/Cezanne XHCI
	ALSA: hda/realtek: Limit mic boost on HP ProBook 445 G8
	ASoC: intel: atom: Fix breakage for PCM buffer address setup
	mm: memcontrol: fix occasional OOMs due to proportional memory.low reclaim
	fs: warn about impending deprecation of mandatory locks
	io_uring: fix xa_alloc_cycle() error return value check
	io_uring: only assign io_uring_enter() SQPOLL error in actual error case
	Linux 5.10.61

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I5b6e2a66b03d1cb01c8310b83dcc2a119c1bd6b3
2021-08-27 20:51:37 +02:00
Greg Kroah-Hartman
b558262fdc This is the 5.10.60 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmEcsVUACgkQONu9yGCS
 aT7r0xAAtwJSVAboFmw/R7pyRzsveDo8KdTATgOKRRmGk/fJIodSHXwPTcPtKSRO
 k09OnEU777t67+3pfS6PA2lNCWhE+Z3PlFVn6b8G8xR1o14vpwNg3aiGNGSqd8aL
 edA4TrqTBb7nu8Bhg1nPdSiKSK2UTPDYlBo+jF6j6YU1dVe/yMy2D4bVOGotPxTn
 WVFmlmEtHDN22q67rEjLAU+wvtn/nRJle/0b2gj32BB+CJqLyjHKH+aUmk9shMfP
 CCkzX+CjhEOz4Sooh0v3aYsyJ4N6AiCAaT4SYy/pnT1RV/b9aw4f+ddrg3xo8SnI
 2C9/i2EzsZc2UnzoFld1R15YrdZfIWOLaiU6enIis5ziBDuxZ5nd5VOHV99BzhUH
 nEY65Ob3Wr8LVSgFTo61uk5R0z0WjQMwSvW1uaauxMUQN7Q2645VJsPomPNlmp8I
 pNBSLj5uz76cxh+ciZNS4HgtwXNUHolhRHl5nvHxMKH0i1+9xQ1vKs1sKMpDYGFe
 2lqg8eGe8lGrwpg0w4oKHyVP2fgj7yk3FvU3/pXX8BleolmQ3xkwkztofKaMorJP
 s9eQIw/2U3j/xBqhXoIbTjBuXl+5MjfbOG4xeK0v/oohrDw0IvT7KuO6TYUXhlbh
 CniUBfItbgGzXyQiwgwgEbS8upz+nK6IDdNEAV5dGn6gG6w4ajk=
 =/0MF
 -----END PGP SIGNATURE-----

Merge 5.10.60 into android12-5.10-lts

Changes in 5.10.60
	iio: adc: ti-ads7950: Ensure CS is deasserted after reading channels
	iio: adis: set GPIO reset pin direction
	iio: humidity: hdc100x: Add margin to the conversion time
	iio: adc: Fix incorrect exit of for-loop
	ASoC: amd: Fix reference to PCM buffer address
	ASoC: xilinx: Fix reference to PCM buffer address
	ASoC: uniphier: Fix reference to PCM buffer address
	ASoC: tlv320aic31xx: Fix jack detection after suspend
	ASoC: intel: atom: Fix reference to PCM buffer address
	i2c: dev: zero out array used for i2c reads from userspace
	cifs: create sd context must be a multiple of 8
	scsi: lpfc: Move initialization of phba->poll_list earlier to avoid crash
	seccomp: Fix setting loaded filter count during TSYNC
	net: ethernet: ti: cpsw: fix min eth packet size for non-switch use-cases
	ARC: fp: set FPU_STATUS.FWE to enable FPU_STATUS update on context switch
	ceph: reduce contention in ceph_check_delayed_caps()
	ACPI: NFIT: Fix support for virtual SPA ranges
	libnvdimm/region: Fix label activation vs errors
	drm/amd/display: Remove invalid assert for ODM + MPC case
	drm/amd/display: use GFP_ATOMIC in amdgpu_dm_irq_schedule_work
	drm/amdgpu: don't enable baco on boco platforms in runpm
	ieee802154: hwsim: fix GPF in hwsim_set_edge_lqi
	ieee802154: hwsim: fix GPF in hwsim_new_edge_nl
	pinctrl: mediatek: Fix fallback behavior for bias_set_combo
	ASoC: cs42l42: Correct definition of ADC Volume control
	ASoC: cs42l42: Don't allow SND_SOC_DAIFMT_LEFT_J
	ASoC: SOF: Intel: hda-ipc: fix reply size checking
	ASoC: cs42l42: Fix inversion of ADC Notch Switch control
	ASoC: cs42l42: Remove duplicate control for WNF filter frequency
	netfilter: nf_conntrack_bridge: Fix memory leak when error
	pinctrl: tigerlake: Fix GPIO mapping for newer version of software
	ASoC: cs42l42: Fix LRCLK frame start edge
	net: dsa: mt7530: add the missing RxUnicast MIB counter
	net: mvvp2: fix short frame size on s390
	platform/x86: pcengines-apuv2: Add missing terminating entries to gpio-lookup tables
	libbpf: Fix probe for BPF_PROG_TYPE_CGROUP_SOCKOPT
	bpf: Fix integer overflow involving bucket_size
	net: phy: micrel: Fix link detection on ksz87xx switch"
	ppp: Fix generating ifname when empty IFLA_IFNAME is specified
	net/smc: fix wait on already cleared link
	net: sched: act_mirred: Reset ct info when mirror/redirect skb
	ice: Prevent probing virtual functions
	ice: don't remove netdev->dev_addr from uc sync list
	iavf: Set RSS LUT and key in reset handle path
	psample: Add a fwd declaration for skbuff
	bareudp: Fix invalid read beyond skb's linear data
	net/mlx5: Synchronize correct IRQ when destroying CQ
	net/mlx5: Fix return value from tracer initialization
	drm/meson: fix colour distortion from HDR set during vendor u-boot
	net: dsa: microchip: Fix ksz_read64()
	net: dsa: microchip: ksz8795: Fix VLAN filtering
	net: Fix memory leak in ieee802154_raw_deliver
	net: igmp: fix data-race in igmp_ifc_timer_expire()
	net: dsa: lan9303: fix broken backpressure in .port_fdb_dump
	net: dsa: lantiq: fix broken backpressure in .port_fdb_dump
	net: dsa: sja1105: fix broken backpressure in .port_fdb_dump
	net: bridge: validate the NUD_PERMANENT bit when adding an extern_learn FDB entry
	net: bridge: fix flags interpretation for extern learn fdb entries
	net: bridge: fix memleak in br_add_if()
	net: linkwatch: fix failure to restore device state across suspend/resume
	tcp_bbr: fix u32 wrap bug in round logic if bbr_init() called after 2B packets
	net: igmp: increase size of mr_ifc_count
	drm/i915: Only access SFC_DONE when media domain is not fused off
	xen/events: Fix race in set_evtchn_to_irq
	vsock/virtio: avoid potential deadlock when vsock device remove
	nbd: Aovid double completion of a request
	arm64: efi: kaslr: Fix occasional random alloc (and boot) failure
	efi/libstub: arm64: Force Image reallocation if BSS was not reserved
	efi/libstub: arm64: Relax 2M alignment again for relocatable kernels
	powerpc/kprobes: Fix kprobe Oops happens in booke
	x86/tools: Fix objdump version check again
	genirq: Provide IRQCHIP_AFFINITY_PRE_STARTUP
	x86/msi: Force affinity setup before startup
	x86/ioapic: Force affinity setup before startup
	x86/resctrl: Fix default monitoring groups reporting
	genirq/msi: Ensure deactivation on teardown
	genirq/timings: Prevent potential array overflow in __irq_timings_store()
	PCI/MSI: Enable and mask MSI-X early
	PCI/MSI: Mask all unused MSI-X entries
	PCI/MSI: Enforce that MSI-X table entry is masked for update
	PCI/MSI: Enforce MSI[X] entry updates to be visible
	PCI/MSI: Do not set invalid bits in MSI mask
	PCI/MSI: Correct misleading comments
	PCI/MSI: Use msi_mask_irq() in pci_msi_shutdown()
	PCI/MSI: Protect msi_desc::masked for multi-MSI
	powerpc/smp: Fix OOPS in topology_init()
	efi/libstub: arm64: Double check image alignment at entry
	KVM: VMX: Use current VMCS to query WAITPKG support for MSR emulation
	KVM: nVMX: Use vmx_need_pf_intercept() when deciding if L0 wants a #PF
	vboxsf: Add vboxsf_[create|release]_sf_handle() helpers
	vboxsf: Add support for the atomic_open directory-inode op
	ceph: add some lockdep assertions around snaprealm handling
	ceph: clean up locking annotation for ceph_get_snap_realm and __lookup_snap_realm
	ceph: take snap_empty_lock atomically with snaprealm refcount change
	vmlinux.lds.h: Handle clang's module.{c,d}tor sections
	KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl (CVE-2021-3653)
	KVM: nSVM: always intercept VMLOAD/VMSAVE when nested (CVE-2021-3656)
	net: dsa: microchip: Fix probing KSZ87xx switch with DT node for host port
	net: dsa: microchip: ksz8795: Fix PVID tag insertion
	net: dsa: microchip: ksz8795: Reject unsupported VLAN configuration
	net: dsa: microchip: ksz8795: Fix VLAN untagged flag change on deletion
	net: dsa: microchip: ksz8795: Use software untagging on CPU port
	Linux 5.10.60

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I7d55aed1883b31ba2d9b8dfad4bc33e1efbcbd2f
2021-08-27 17:14:51 +02:00
Ido Schimmel
645fd92c3e Revert "flow_offload: action should not be NULL when it is referenced"
[ Upstream commit fa05bdb89b ]

This reverts commit 9ea3e52c5b.

Cited commit added a check to make sure 'action' is not NULL, but
'action' is already dereferenced before the check, when calling
flow_offload_has_one_action().

Therefore, the check does not make any sense and results in a smatch
warning:

include/net/flow_offload.h:322 flow_action_mixed_hw_stats_check() warn:
variable dereferenced before check 'action' (see line 319)

Fix by reverting this commit.

Cc: gushengxian <gushengxian@yulong.com>
Fixes: 9ea3e52c5b ("flow_offload: action should not be NULL when it is referenced")
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://lore.kernel.org/r/20210819105842.1315705-1-idosch@idosch.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-08-26 08:35:52 -04:00
Roi Dayan
30b1fc47f7 psample: Add a fwd declaration for skbuff
[ Upstream commit beb7f2de57 ]

Without this there is a warning if source files include psample.h
before skbuff.h or doesn't include it at all.

Fixes: 6ae0a62861 ("net: Introduce psample, a new genetlink channel for packet sampling")
Signed-off-by: Roi Dayan <roid@nvidia.com>
Link: https://lore.kernel.org/r/20210808065242.1522535-1-roid@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-08-18 08:59:11 +02:00
Greg Kroah-Hartman
c80c82c899 Revert "xfrm: Fix RCU vs hash_resize_mutex lock inversion"
This reverts commit f08b2d078c which is
commit 2580d3f400 upstream.

It breaks the abi and should not be needed for Android systems.

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I13a6e3459cc2c7fb31b4cbc1185a9b463fc61c6e
2021-08-12 20:16:24 +02:00
Greg Kroah-Hartman
af3bdb4304 This is the 5.10.58 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmEVBn4ACgkQONu9yGCS
 aT5CoQ//ZpZKkAu4NzUKmFfzJjpTwRWSg4YKGHx0BSt/ovuw8SXQa3xAx12r1U9w
 5hXxkCQncCPSul1eIRNmpwVIUavRvyS2Vll//XtT695MA0e9sK9nrXoYgqwUE/gf
 hqgytJAb7DHk5pcLlyfCncXNyw//9WIl8WCNSppZgSnRRk+smfThnEVE6pcgQok5
 4vIy4RXSK12/Xs9jG+q+pqcvQ3ILscCrzQyfxBu5AWePlm8kaM+6cxuL3b+S0COH
 Gg0YLPrTQjLdQ+oNnh93s2fFk0bqeqt/KDMI9xGt00hNwaTBHxgoxj04AFQEgkft
 APwvezabNBojmDZasMq9h5sxGoloxLe2vD+fAWGA3KVTJ6vlKYmhx7+X6jtAJP5Y
 HHNUiYg58VnkYzxT1Ok8CUHocbaFhlFjCqjDUg1oo93XuZJaTgO63q8yeI49pN7S
 xZyim8X/rdouW1WG+7pubOe1E+nZudZDooWOs5CxyJmO1jb3CpMjfl3rRdWG4PI4
 7gC8IG8xmgC9CeGen5egAPqARwBW0d4AFDHT5tY4yF8ovbkO437hYHKvJjZDY919
 v8fqeI95nRrsawXH+GdIMlwOf/PzkODiZc2EwSh/uPnbwPPeZY7a7YQwMwzyxRfb
 Q3dOrapi5k1aoC7583ReIY5RPqc82a4LAdmTN7YN60hiXHkm0bg=
 =+Sab
 -----END PGP SIGNATURE-----

Merge 5.10.58 into android12-5.10-lts

Changes in 5.10.58
	Revert "ACPICA: Fix memory leak caused by _CID repair function"
	ALSA: seq: Fix racy deletion of subscriber
	bus: ti-sysc: Fix gpt12 system timer issue with reserved status
	net: xfrm: fix memory leak in xfrm_user_rcv_msg
	arm64: dts: ls1028a: fix node name for the sysclk
	ARM: imx: add missing iounmap()
	ARM: imx: add missing clk_disable_unprepare()
	ARM: dts: imx6qdl-sr-som: Increase the PHY reset duration to 10ms
	arm64: dts: ls1028: sl28: fix networking for variant 2
	ARM: dts: colibri-imx6ull: limit SDIO clock to 25MHz
	ARM: imx: fix missing 3rd argument in macro imx_mmdc_perf_init
	ARM: dts: imx: Swap M53Menlo pinctrl_power_button/pinctrl_power_out pins
	arm64: dts: armada-3720-turris-mox: fixed indices for the SDHC controllers
	arm64: dts: armada-3720-turris-mox: remove mrvl,i2c-fast-mode
	ALSA: usb-audio: fix incorrect clock source setting
	clk: stm32f4: fix post divisor setup for I2S/SAI PLLs
	ARM: dts: am437x-l4: fix typo in can@0 node
	omap5-board-common: remove not physically existing vdds_1v8_main fixed-regulator
	dmaengine: uniphier-xdmac: Use readl_poll_timeout_atomic() in atomic state
	clk: tegra: Implement disable_unused() of tegra_clk_sdmmc_mux_ops
	dmaengine: stm32-dma: Fix PM usage counter imbalance in stm32 dma ops
	dmaengine: stm32-dmamux: Fix PM usage counter unbalance in stm32 dmamux ops
	spi: imx: mx51-ecspi: Reinstate low-speed CONFIGREG delay
	spi: imx: mx51-ecspi: Fix low-speed CONFIGREG delay calculation
	scsi: sr: Return correct event when media event code is 3
	media: videobuf2-core: dequeue if start_streaming fails
	ARM: dts: stm32: Disable LAN8710 EDPD on DHCOM
	ARM: dts: stm32: Fix touchscreen IRQ line assignment on DHCOM
	dmaengine: imx-dma: configure the generic DMA type to make it work
	net, gro: Set inner transport header offset in tcp/udp GRO hook
	net: dsa: sja1105: overwrite dynamic FDB entries with static ones in .port_fdb_add
	net: dsa: sja1105: invalidate dynamic FDB entries learned concurrently with statically added ones
	net: dsa: sja1105: be stateless with FDB entries on SJA1105P/Q/R/S/SJA1110 too
	net: dsa: sja1105: match FDB entries regardless of inner/outer VLAN tag
	net: phy: micrel: Fix detection of ksz87xx switch
	net: natsemi: Fix missing pci_disable_device() in probe and remove
	gpio: tqmx86: really make IRQ optional
	RDMA/mlx5: Delay emptying a cache entry when a new MR is added to it recently
	sctp: move the active_key update after sh_keys is added
	nfp: update ethtool reporting of pauseframe control
	net: ipv6: fix returned variable type in ip6_skb_dst_mtu
	net: dsa: qca: ar9331: reorder MDIO write sequence
	net: sched: fix lockdep_set_class() typo error for sch->seqlock
	MIPS: check return value of pgtable_pmd_page_ctor
	mips: Fix non-POSIX regexp
	bnx2x: fix an error code in bnx2x_nic_load()
	net: pegasus: fix uninit-value in get_interrupt_interval
	net: fec: fix use-after-free in fec_drv_remove
	net: vxge: fix use-after-free in vxge_device_unregister
	blk-iolatency: error out if blk_get_queue() failed in iolatency_set_limit()
	Bluetooth: defer cleanup of resources in hci_unregister_dev()
	USB: usbtmc: Fix RCU stall warning
	USB: serial: option: add Telit FD980 composition 0x1056
	USB: serial: ch341: fix character loss at high transfer rates
	USB: serial: ftdi_sio: add device ID for Auto-M3 OP-COM v2
	firmware_loader: use -ETIMEDOUT instead of -EAGAIN in fw_load_sysfs_fallback
	firmware_loader: fix use-after-free in firmware_fallback_sysfs
	drm/amdgpu/display: fix DMUB firmware version info
	ALSA: pcm - fix mmap capability check for the snd-dummy driver
	ALSA: hda/realtek: add mic quirk for Acer SF314-42
	ALSA: hda/realtek: Fix headset mic for Acer SWIFT SF314-56 (ALC256)
	ALSA: usb-audio: Fix superfluous autosuspend recovery
	ALSA: usb-audio: Add registration quirk for JBL Quantum 600
	usb: dwc3: gadget: Avoid runtime resume if disabling pullup
	usb: gadget: remove leaked entry from udc driver list
	usb: cdns3: Fixed incorrect gadget state
	usb: gadget: f_hid: added GET_IDLE and SET_IDLE handlers
	usb: gadget: f_hid: fixed NULL pointer dereference
	usb: gadget: f_hid: idle uses the highest byte for duration
	usb: host: ohci-at91: suspend/resume ports after/before OHCI accesses
	usb: typec: tcpm: Keep other events when receiving FRS and Sourcing_vbus events
	usb: otg-fsm: Fix hrtimer list corruption
	clk: fix leak on devm_clk_bulk_get_all() unwind
	scripts/tracing: fix the bug that can't parse raw_trace_func
	tracing / histogram: Give calculation hist_fields a size
	tracing: Reject string operand in the histogram expression
	tracing: Fix NULL pointer dereference in start_creating
	tracepoint: static call: Compare data on transition from 2->1 callees
	tracepoint: Fix static call function vs data state mismatch
	arm64: stacktrace: avoid tracing arch_stack_walk()
	optee: Clear stale cache entries during initialization
	tee: add tee_shm_alloc_kernel_buf()
	optee: Fix memory leak when failing to register shm pages
	optee: Refuse to load the driver under the kdump kernel
	optee: fix tee out of memory failure seen during kexec reboot
	tpm_ftpm_tee: Free and unregister TEE shared memory during kexec
	staging: rtl8723bs: Fix a resource leak in sd_int_dpc
	staging: rtl8712: get rid of flush_scheduled_work
	staging: rtl8712: error handling refactoring
	drivers core: Fix oops when driver probe fails
	media: rtl28xxu: fix zero-length control request
	pipe: increase minimum default pipe size to 2 pages
	ext4: fix potential htree corruption when growing large_dir directories
	serial: tegra: Only print FIFO error message when an error occurs
	serial: 8250_mtk: fix uart corruption issue when rx power off
	serial: 8250: Mask out floating 16/32-bit bus bits
	MIPS: Malta: Do not byte-swap accesses to the CBUS UART
	serial: 8250_pci: Enumerate Elkhart Lake UARTs via dedicated driver
	serial: 8250_pci: Avoid irq sharing for MSI(-X) interrupts.
	fpga: dfl: fme: Fix cpu hotplug issue in performance reporting
	timers: Move clearing of base::timer_running under base:: Lock
	xfrm: Fix RCU vs hash_resize_mutex lock inversion
	net/xfrm/compat: Copy xfrm_spdattr_type_t atributes
	pcmcia: i82092: fix a null pointer dereference bug
	selinux: correct the return value when loads initial sids
	bus: ti-sysc: AM3: RNG is GP only
	Revert "gpio: mpc8xxx: change the gpio interrupt flags."
	ARM: omap2+: hwmod: fix potential NULL pointer access
	md/raid10: properly indicate failure when ending a failed write request
	KVM: x86: accept userspace interrupt only if no event is injected
	KVM: Do not leak memory for duplicate debugfs directories
	KVM: x86/mmu: Fix per-cpu counter corruption on 32-bit builds
	arm64: vdso: Avoid ISB after reading from cntvct_el0
	soc: ixp4xx: fix printing resources
	interconnect: Fix undersized devress_alloc allocation
	spi: meson-spicc: fix memory leak in meson_spicc_remove
	interconnect: Zero initial BW after sync-state
	interconnect: Always call pre_aggregate before aggregate
	interconnect: qcom: icc-rpmh: Ensure floor BW is enforced for all nodes
	drm/i915: Correct SFC_DONE register offset
	soc: ixp4xx/qmgr: fix invalid __iomem access
	perf/x86/amd: Don't touch the AMD64_EVENTSEL_HOSTONLY bit inside the guest
	sched/rt: Fix double enqueue caused by rt_effective_prio
	drm/i915: avoid uninitialised var in eb_parse()
	libata: fix ata_pio_sector for CONFIG_HIGHMEM
	reiserfs: add check for root_inode in reiserfs_fill_super
	reiserfs: check directory items on read from disk
	virt_wifi: fix error on connect
	net: qede: Fix end of loop tests for list_for_each_entry
	alpha: Send stop IPI to send to online CPUs
	net/qla3xxx: fix schedule while atomic in ql_wait_for_drvr_lock and ql_adapter_reset
	smb3: rc uninitialized in one fallocate path
	drm/amdgpu/display: only enable aux backlight control for OLED panels
	arm64: fix compat syscall return truncation
	Linux 5.10.58

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I2533667974c9dff419a14d63e0e8febfb3de80f1
2021-08-12 14:58:34 +02:00
Frederic Weisbecker
f08b2d078c xfrm: Fix RCU vs hash_resize_mutex lock inversion
commit 2580d3f400 upstream.

xfrm_bydst_resize() calls synchronize_rcu() while holding
hash_resize_mutex. But then on PREEMPT_RT configurations,
xfrm_policy_lookup_bytype() may acquire that mutex while running in an
RCU read side critical section. This results in a deadlock.

In fact the scope of hash_resize_mutex is way beyond the purpose of
xfrm_policy_lookup_bytype() to just fetch a coherent and stable policy
for a given destination/direction, along with other details.

The lower level net->xfrm.xfrm_policy_lock, which among other things
protects per destination/direction references to policy entries, is
enough to serialize and benefit from priority inheritance against the
write side. As a bonus, it makes it officially a per network namespace
synchronization business where a policy table resize on namespace A
shouldn't block a policy lookup on namespace B.

Fixes: 77cc278f7b (xfrm: policy: Use sequence counters with associated lock)
Cc: stable@vger.kernel.org
Cc: Ahmed S. Darwish <a.darwish@linutronix.de>
Cc: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Varad Gautam <varad.gautam@suse.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: David S. Miller <davem@davemloft.net>
Signed-off-by: Frederic Weisbecker <frederic@kernel.org>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-08-12 13:22:16 +02:00
Tetsuo Handa
f2f856b65a Bluetooth: defer cleanup of resources in hci_unregister_dev()
[ Upstream commit e04480920d ]

syzbot is hitting might_sleep() warning at hci_sock_dev_event() due to
calling lock_sock() with rw spinlock held [1].

It seems that history of this locking problem is a trial and error.

Commit b40df5743e ("[PATCH] bluetooth: fix socket locking in
hci_sock_dev_event()") in 2.6.21-rc4 changed bh_lock_sock() to
lock_sock() as an attempt to fix lockdep warning.

Then, commit 4ce61d1c7a ("[BLUETOOTH]: Fix locking in
hci_sock_dev_event().") in 2.6.22-rc2 changed lock_sock() to
local_bh_disable() + bh_lock_sock_nested() as an attempt to fix the
sleep in atomic context warning.

Then, commit 4b5dd696f8 ("Bluetooth: Remove local_bh_disable() from
hci_sock.c") in 3.3-rc1 removed local_bh_disable().

Then, commit e305509e67 ("Bluetooth: use correct lock to prevent UAF
of hdev object") in 5.13-rc5 again changed bh_lock_sock_nested() to
lock_sock() as an attempt to fix CVE-2021-3573.

This difficulty comes from current implementation that
hci_sock_dev_event(HCI_DEV_UNREG) is responsible for dropping all
references from sockets because hci_unregister_dev() immediately
reclaims resources as soon as returning from
hci_sock_dev_event(HCI_DEV_UNREG).

But the history suggests that hci_sock_dev_event(HCI_DEV_UNREG) was not
doing what it should do.

Therefore, instead of trying to detach sockets from device, let's accept
not detaching sockets from device at hci_sock_dev_event(HCI_DEV_UNREG),
by moving actual cleanup of resources from hci_unregister_dev() to
hci_cleanup_dev() which is called by bt_host_release() when all
references to this unregistered device (which is a kobject) are gone.

Since hci_sock_dev_event(HCI_DEV_UNREG) no longer resets
hci_pi(sk)->hdev, we need to check whether this device was unregistered
and return an error based on HCI_UNREGISTER flag.  There might be subtle
behavioral difference in "monitor the hdev" functionality; please report
if you found something went wrong due to this patch.

Link: https://syzkaller.appspot.com/bug?extid=a5df189917e79d5e59c9 [1]
Reported-by: syzbot <syzbot+a5df189917e79d5e59c9@syzkaller.appspotmail.com>
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Fixes: e305509e67 ("Bluetooth: use correct lock to prevent UAF of hdev object")
Acked-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-08-12 13:22:08 +02:00
Antoine Tenart
a45ee8ed0c net: ipv6: fix returned variable type in ip6_skb_dst_mtu
[ Upstream commit 4039146777 ]

The patch fixing the returned value of ip6_skb_dst_mtu (int -> unsigned
int) was rebased between its initial review and the version applied. In
the meantime fade56410c was applied, which added a new variable (int)
used as the returned value. This lead to a mismatch between the function
prototype and the variable used as the return value.

Fixes: 40fc3054b4 ("net: ipv6: fix return value of ip6_skb_dst_mtu")
Cc: Vadim Fedorenko <vfedorenko@novek.ru>
Signed-off-by: Antoine Tenart <atenart@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-08-12 13:22:07 +02:00
Greg Kroah-Hartman
8b444656fa This is the 5.10.56 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmEKcCUACgkQONu9yGCS
 aT7sMw/7BNJDmX9w+p1lgTIJJzSuz8C/eNgbeZgK7CE4DovO+WL9oEm53vqYcDDo
 j5REnrRhxcBYxwG/GXl1Oniv1wHqw0SplV+5G2NH1RMy23eSFGCw+8G+YOEJnU3P
 94hJuEs/43Py7eZV/VtyO2UMdDRnGI6MlNvu18YjnRJcdqIIl2gln1G8wbyySYVb
 wR1rudvtiEdrmTQr7qGxeIrZNKGwFl0KxEl8j9X/aqxvfe8PRVYKlmtwblf5rybe
 TElQxz2XGRgk8g2yWQmnNoU6rfFHdZ4lTnCwfpFA1XE6/HBA64/1p22QTJUZvyOU
 pbQc1MRaoUncGV9UFAMY1j38JFsVar7YHHOcpp9YIJOjoyiAw4aatGDcntdWDCiG
 X1mCSLs10/xGRPaJJXulp786MH4aTR5qIeoNg8mu3Z3In4ElbBW5xr0wa3N8gs3O
 lEnK/gT2MHiQ1boa+Qy3W+XZmOjWtL69JgbOyRcOYS6lkHL4DFlGL2Nn5u8qGfL4
 hzohJzH36W5SUHDQiYTt1wLNu4iHpAECjxcnk9fCvlcHA5Yu1bqgyQ62i3C9RA6a
 /aO0B0yraHmvCAboemDsESwylxmpiRB3caqKtzlaZjoiOfPydcBwJM46ZfbzLNPh
 l+/YKK2tLOXWyRIhEv8183tVeu7mZ02xjsetPtLltZPJqR+SJKE=
 =8nLw
 -----END PGP SIGNATURE-----

Merge 5.10.56 into android12-5.10-lts

Changes in 5.10.56
	selftest: fix build error in tools/testing/selftests/vm/userfaultfd.c
	io_uring: fix null-ptr-deref in io_sq_offload_start()
	x86/asm: Ensure asm/proto.h can be included stand-alone
	pipe: make pipe writes always wake up readers
	btrfs: fix rw device counting in __btrfs_free_extra_devids
	btrfs: mark compressed range uptodate only if all bio succeed
	Revert "ACPI: resources: Add checks for ACPI IRQ override"
	ACPI: DPTF: Fix reading of attributes
	x86/kvm: fix vcpu-id indexed array sizes
	KVM: add missing compat KVM_CLEAR_DIRTY_LOG
	ocfs2: fix zero out valid data
	ocfs2: issue zeroout to EOF blocks
	can: j1939: j1939_xtp_rx_dat_one(): fix rxtimer value between consecutive TP.DT to 750ms
	can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
	can: peak_usb: pcan_usb_handle_bus_evt(): fix reading rxerr/txerr values
	can: mcba_usb_start(): add missing urb->transfer_dma initialization
	can: usb_8dev: fix memory leak
	can: ems_usb: fix memory leak
	can: esd_usb2: fix memory leak
	alpha: register early reserved memory in memblock
	HID: wacom: Re-enable touch by default for Cintiq 24HDT / 27QHDT
	NIU: fix incorrect error return, missed in previous revert
	drm/amd/display: ensure dentist display clock update finished in DCN20
	drm/amdgpu: Avoid printing of stack contents on firmware load error
	drm/amdgpu: Fix resource leak on probe error path
	blk-iocost: fix operation ordering in iocg_wake_fn()
	nfc: nfcsim: fix use after free during module unload
	cfg80211: Fix possible memory leak in function cfg80211_bss_update
	RDMA/bnxt_re: Fix stats counters
	bpf: Fix OOB read when printing XDP link fdinfo
	mac80211: fix enabling 4-address mode on a sta vif after assoc
	netfilter: conntrack: adjust stop timestamp to real expiry value
	netfilter: nft_nat: allow to specify layer 4 protocol NAT only
	i40e: Fix logic of disabling queues
	i40e: Fix firmware LLDP agent related warning
	i40e: Fix queue-to-TC mapping on Tx
	i40e: Fix log TC creation failure when max num of queues is exceeded
	tipc: fix implicit-connect for SYN+
	tipc: fix sleeping in tipc accept routine
	net: Set true network header for ECN decapsulation
	net: qrtr: fix memory leaks
	ionic: remove intr coalesce update from napi
	ionic: fix up dim accounting for tx and rx
	ionic: count csum_none when offload enabled
	tipc: do not write skb_shinfo frags when doing decrytion
	octeontx2-pf: Fix interface down flag on error
	mlx4: Fix missing error code in mlx4_load_one()
	KVM: x86: Check the right feature bit for MSR_KVM_ASYNC_PF_ACK access
	net: llc: fix skb_over_panic
	drm/msm/dpu: Fix sm8250_mdp register length
	drm/msm/dp: Initialize the INTF_CONFIG register
	skmsg: Make sk_psock_destroy() static
	net/mlx5: Fix flow table chaining
	net/mlx5e: Fix nullptr in mlx5e_hairpin_get_mdev()
	sctp: fix return value check in __sctp_rcv_asconf_lookup
	tulip: windbond-840: Fix missing pci_disable_device() in probe and remove
	sis900: Fix missing pci_disable_device() in probe and remove
	can: hi311x: fix a signedness bug in hi3110_cmd()
	bpf: Introduce BPF nospec instruction for mitigating Spectre v4
	bpf: Fix leakage due to insufficient speculative store bypass mitigation
	bpf: Remove superfluous aux sanitation on subprog rejection
	bpf: verifier: Allocate idmap scratch in verifier env
	bpf: Fix pointer arithmetic mask tightening under state pruning
	SMB3: fix readpage for large swap cache
	powerpc/pseries: Fix regression while building external modules
	Revert "perf map: Fix dso->nsinfo refcounting"
	i40e: Add additional info to PHY type error
	can: j1939: j1939_session_deactivate(): clarify lifetime of session object
	Linux 5.10.56

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ib3c9244afb7ee5d6ee8d3235efe8956898f486c4
2021-08-04 15:02:23 +02:00
Pavel Skripkin
e6097071a4 net: llc: fix skb_over_panic
[ Upstream commit c7c9d2102c ]

Syzbot reported skb_over_panic() in llc_pdu_init_as_xid_cmd(). The
problem was in wrong LCC header manipulations.

Syzbot's reproducer tries to send XID packet. llc_ui_sendmsg() is
doing following steps:

	1. skb allocation with size = len + header size
		len is passed from userpace and header size
		is 3 since addr->sllc_xid is set.

	2. skb_reserve() for header_len = 3
	3. filling all other space with memcpy_from_msg()

Ok, at this moment we have fully loaded skb, only headers needs to be
filled.

Then code comes to llc_sap_action_send_xid_c(). This function pushes 3
bytes for LLC PDU header and initializes it. Then comes
llc_pdu_init_as_xid_cmd(). It initalizes next 3 bytes *AFTER* LLC PDU
header and call skb_push(skb, 3). This looks wrong for 2 reasons:

	1. Bytes rigth after LLC header are user data, so this function
	   was overwriting payload.

	2. skb_push(skb, 3) call can cause skb_over_panic() since
	   all free space was filled in llc_ui_sendmsg(). (This can
	   happen is user passed 686 len: 686 + 14 (eth header) + 3 (LLC
	   header) = 703. SKB_DATA_ALIGN(703) = 704)

So, in this patch I added 2 new private constansts: LLC_PDU_TYPE_U_XID
and LLC_PDU_LEN_U_XID. LLC_PDU_LEN_U_XID is used to correctly reserve
header size to handle LLC + XID case. LLC_PDU_TYPE_U_XID is used by
llc_pdu_header_init() function to push 6 bytes instead of 3. And finally
I removed skb_push() call from llc_pdu_init_as_xid_cmd().

This changes should not affect other parts of LLC, since after
all steps we just transmit buffer.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-and-tested-by: syzbot+5e5a981ad7cc54c4b2b4@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-08-04 12:46:43 +02:00
Greg Kroah-Hartman
1afedcdcf8 This is the 5.10.55 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmEE6r8ACgkQONu9yGCS
 aT54gw/7B1RbIpcTJlhtiQVYvwMJTX/ZgoxkSsffz6G7TXaBbg/x29cuc3cI9IUJ
 fr99zp8gQbQMibXqCaIPBloetSdquX9G+gOmzVSIS+ac2Wx/pH29qRz1fslWq8Mj
 hOg8t2Ce+LoAgGZzSXswhvIL1Zep8HZDlRKKcolmiGEJFBr/4nPfEVOeFNpiTUYF
 cb5RtB1nRR0DJa8wWr18S7v2/TBdR9V7TgGuwRnpVviIQjjfE/S+lmbgtzHgm5Tf
 cBtP7Ta/eIGeLQIyQEoEWV2ViJRmSGk4s2dOcQ/kUMje5de+J03Hkp4jeJbB2ndx
 UUos2Xm4D1j4jsIBZqJKV+Fzf9RzdNXQp4VJIfzvbDbZn8y9xHRcXm/ChNBz/B5L
 8oKcdM9Sf8DxiztlZ4c40IndYjwp0QxlubCYDfwYQfYB/6LLrffrgPZu/TgWw9lj
 lXOBUZq7yHuo9OSAIfGCCtKKnzA63wLv3zTmNmSO9fDoXUl0VHBrZC6apgB6AC9T
 rzvOOgRC6NfWViZl2E3Op7XfOg2jstpRXUr7a0HSaQp4QfmlLJ9HnDywQfNQeX4+
 HyAxhXo8gHPDgh8DK7yRObBhu24yQcy+ukesQwkSS2m0j2ilfQszk0uP1bfFOuq2
 G5Z8VMQPsIMsSijEyuonLRVUPfp8herhWMP0YsZZeEnxZvaSEaM=
 =li6t
 -----END PGP SIGNATURE-----

Merge 5.10.55 into android12-5.10-lts

Changes in 5.10.55
	tools: Allow proper CC/CXX/... override with LLVM=1 in Makefile.include
	io_uring: fix link timeout refs
	KVM: x86: determine if an exception has an error code only when injecting it.
	af_unix: fix garbage collect vs MSG_PEEK
	workqueue: fix UAF in pwq_unbound_release_workfn()
	cgroup1: fix leaked context root causing sporadic NULL deref in LTP
	net/802/mrp: fix memleak in mrp_request_join()
	net/802/garp: fix memleak in garp_request_join()
	net: annotate data race around sk_ll_usec
	sctp: move 198 addresses from unusable to private scope
	rcu-tasks: Don't delete holdouts within trc_inspect_reader()
	rcu-tasks: Don't delete holdouts within trc_wait_for_one_reader()
	ipv6: allocate enough headroom in ip6_finish_output2()
	drm/ttm: add a check against null pointer dereference
	hfs: add missing clean-up in hfs_fill_super
	hfs: fix high memory mapping in hfs_bnode_read
	hfs: add lock nesting notation to hfs_find_init
	firmware: arm_scmi: Fix possible scmi_linux_errmap buffer overflow
	firmware: arm_scmi: Fix range check for the maximum number of pending messages
	cifs: fix the out of range assignment to bit fields in parse_server_interfaces
	iomap: remove the length variable in iomap_seek_data
	iomap: remove the length variable in iomap_seek_hole
	ARM: dts: versatile: Fix up interrupt controller node names
	ipv6: ip6_finish_output2: set sk into newly allocated nskb
	Linux 5.10.55

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I2d673bdde784b3689af73289305091dbd4ead042
2021-07-31 08:51:04 +02:00
Xin Long
4d972881f8 sctp: move 198 addresses from unusable to private scope
[ Upstream commit 1d11fa231c ]

The doc draft-stewart-tsvwg-sctp-ipv4-00 that restricts 198 addresses
was never published. These addresses as private addresses should be
allowed to use in SCTP.

As Michael Tuexen suggested, this patch is to move 198 addresses from
unusable to private scope.

Reported-by: Sérgio <surkamp@gmail.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-07-31 08:16:11 +02:00
Eric Dumazet
915226f31f net: annotate data race around sk_ll_usec
[ Upstream commit 0dbffbb533 ]

sk_ll_usec is read locklessly from sk_can_busy_loop()
while another thread can change its value in sock_setsockopt()

This is correct but needs annotations.

BUG: KCSAN: data-race in __skb_try_recv_datagram / sock_setsockopt

write to 0xffff88814eb5f904 of 4 bytes by task 14011 on cpu 0:
 sock_setsockopt+0x1287/0x2090 net/core/sock.c:1175
 __sys_setsockopt+0x14f/0x200 net/socket.c:2100
 __do_sys_setsockopt net/socket.c:2115 [inline]
 __se_sys_setsockopt net/socket.c:2112 [inline]
 __x64_sys_setsockopt+0x62/0x70 net/socket.c:2112
 do_syscall_64+0x4a/0x90 arch/x86/entry/common.c:47
 entry_SYSCALL_64_after_hwframe+0x44/0xae

read to 0xffff88814eb5f904 of 4 bytes by task 14001 on cpu 1:
 sk_can_busy_loop include/net/busy_poll.h:41 [inline]
 __skb_try_recv_datagram+0x14f/0x320 net/core/datagram.c:273
 unix_dgram_recvmsg+0x14c/0x870 net/unix/af_unix.c:2101
 unix_seqpacket_recvmsg+0x5a/0x70 net/unix/af_unix.c:2067
 ____sys_recvmsg+0x15d/0x310 include/linux/uio.h:244
 ___sys_recvmsg net/socket.c:2598 [inline]
 do_recvmmsg+0x35c/0x9f0 net/socket.c:2692
 __sys_recvmmsg net/socket.c:2771 [inline]
 __do_sys_recvmmsg net/socket.c:2794 [inline]
 __se_sys_recvmmsg net/socket.c:2787 [inline]
 __x64_sys_recvmmsg+0xcf/0x150 net/socket.c:2787
 do_syscall_64+0x4a/0x90 arch/x86/entry/common.c:47
 entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0x00000000 -> 0x00000101

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 14001 Comm: syz-executor.3 Not tainted 5.13.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-07-31 08:16:11 +02:00
Greg Kroah-Hartman
e4cac2c332 This is the 5.10.54 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmEBT00ACgkQONu9yGCS
 aT7svA/9HCRwW+pK3UpK1+0FK7gGH8DA3jSONj775zVEKhboDZNIwZsDqG0Ly+jm
 /JejWXPKZlekaDXgzBfZY3H59xgij/VwYHe8p7cdxfi1TlhmAQwFjLNZnWav8as6
 IyNkpsDJn8fMXmfHDi2u3cb8wrVi/aQDzTlwu88cUtREyZCaaYlo0Fdv9MJyhww/
 p6LWPYQoZ8TmFY+Y/2ORVxFos2UVuU0hhhMdGt9LrX2WNEGRNUZUqmbhcXYfdsX0
 ckSHbijIcWdcka3nQ6yOvdxw75rTqd8c/bP0y+yAteeJ0CykjVnI2cdK+M2ZEi4j
 /JqpGJrRWhsZf5MiO8b3k+I1K62JDa1GYBQ9Amp8FKKzjYLPTNeFAP9IsMyDc4oi
 oW98XM7XzoSEU9t/FSAIGT0hYK9k+lnPxw623LhxD6x3VPynnNAnQsLr+HirOgG6
 mZ79L4ZFu3lUvVsCuCgKn/uxwDopUNlhqo5B2/4M2kSWwe2Xu5bExpGc2bT9xCOP
 6fF9DmvmpG1UPGCXrOqaxemyEPmHqmyjKJpxDt6vZqlOL9vqHez4WmEEM1C+E2NZ
 5VKKbBk/KZDxNX9EiFOtI2HRFb1cghoI2Hcb/QjRoB9Dv3a6cHgjxDl0eKm8SiDN
 +1ytV0IFH3fT4aRiXJ7I3GBwkjKcDaX0sjYwtnCx9s5XZmm9PRQ=
 =HAyL
 -----END PGP SIGNATURE-----

Merge 5.10.54 into android12-5.10-lts

Changes in 5.10.54
	igc: Fix use-after-free error during reset
	igb: Fix use-after-free error during reset
	igc: change default return of igc_read_phy_reg()
	ixgbe: Fix an error handling path in 'ixgbe_probe()'
	igc: Fix an error handling path in 'igc_probe()'
	igb: Fix an error handling path in 'igb_probe()'
	fm10k: Fix an error handling path in 'fm10k_probe()'
	e1000e: Fix an error handling path in 'e1000_probe()'
	iavf: Fix an error handling path in 'iavf_probe()'
	igb: Check if num of q_vectors is smaller than max before array access
	igb: Fix position of assignment to *ring
	gve: Fix an error handling path in 'gve_probe()'
	net: add kcov handle to skb extensions
	bonding: fix suspicious RCU usage in bond_ipsec_add_sa()
	bonding: fix null dereference in bond_ipsec_add_sa()
	ixgbevf: use xso.real_dev instead of xso.dev in callback functions of struct xfrmdev_ops
	bonding: fix suspicious RCU usage in bond_ipsec_del_sa()
	bonding: disallow setting nested bonding + ipsec offload
	bonding: Add struct bond_ipesc to manage SA
	bonding: fix suspicious RCU usage in bond_ipsec_offload_ok()
	bonding: fix incorrect return value of bond_ipsec_offload_ok()
	ipv6: fix 'disable_policy' for fwd packets
	stmmac: platform: Fix signedness bug in stmmac_probe_config_dt()
	selftests: icmp_redirect: remove from checking for IPv6 route get
	selftests: icmp_redirect: IPv6 PMTU info should be cleared after redirect
	pwm: sprd: Ensure configuring period and duty_cycle isn't wrongly skipped
	cxgb4: fix IRQ free race during driver unload
	mptcp: fix warning in __skb_flow_dissect() when do syn cookie for subflow join
	nvme-pci: do not call nvme_dev_remove_admin from nvme_remove
	KVM: x86/pmu: Clear anythread deprecated bit when 0xa leaf is unsupported on the SVM
	perf inject: Fix dso->nsinfo refcounting
	perf map: Fix dso->nsinfo refcounting
	perf probe: Fix dso->nsinfo refcounting
	perf env: Fix sibling_dies memory leak
	perf test session_topology: Delete session->evlist
	perf test event_update: Fix memory leak of evlist
	perf dso: Fix memory leak in dso__new_map()
	perf test maps__merge_in: Fix memory leak of maps
	perf env: Fix memory leak of cpu_pmu_caps
	perf report: Free generated help strings for sort option
	perf script: Fix memory 'threads' and 'cpus' leaks on exit
	perf lzma: Close lzma stream on exit
	perf probe-file: Delete namelist in del_events() on the error path
	perf data: Close all files in close_dir()
	perf sched: Fix record failure when CONFIG_SCHEDSTATS is not set
	ASoC: wm_adsp: Correct wm_coeff_tlv_get handling
	spi: imx: add a check for speed_hz before calculating the clock
	spi: stm32: fixes pm_runtime calls in probe/remove
	regulator: hi6421: Use correct variable type for regmap api val argument
	regulator: hi6421: Fix getting wrong drvdata
	spi: mediatek: fix fifo rx mode
	ASoC: rt5631: Fix regcache sync errors on resume
	bpf, test: fix NULL pointer dereference on invalid expected_attach_type
	bpf: Fix tail_call_reachable rejection for interpreter when jit failed
	xdp, net: Fix use-after-free in bpf_xdp_link_release
	timers: Fix get_next_timer_interrupt() with no timers pending
	liquidio: Fix unintentional sign extension issue on left shift of u16
	s390/bpf: Perform r1 range checking before accessing jit->seen_reg[r1]
	bpf, sockmap: Fix potential memory leak on unlikely error case
	bpf, sockmap, tcp: sk_prot needs inuse_idx set for proc stats
	bpf, sockmap, udp: sk_prot needs inuse_idx set for proc stats
	bpftool: Check malloc return value in mount_bpffs_for_pin
	net: fix uninit-value in caif_seqpkt_sendmsg
	usb: hso: fix error handling code of hso_create_net_device
	dma-mapping: handle vmalloc addresses in dma_common_{mmap,get_sgtable}
	efi/tpm: Differentiate missing and invalid final event log table.
	net: decnet: Fix sleeping inside in af_decnet
	KVM: PPC: Book3S: Fix CONFIG_TRANSACTIONAL_MEM=n crash
	KVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak
	net: sched: fix memory leak in tcindex_partial_destroy_work
	sctp: trim optlen when it's a huge value in sctp_setsockopt
	netrom: Decrease sock refcount when sock timers expire
	scsi: iscsi: Fix iface sysfs attr detection
	scsi: target: Fix protect handling in WRITE SAME(32)
	spi: cadence: Correct initialisation of runtime PM again
	ACPI: Kconfig: Fix table override from built-in initrd
	bnxt_en: don't disable an already disabled PCI device
	bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
	bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in bnxt_fw_rset_task()
	bnxt_en: Validate vlan protocol ID on RX packets
	bnxt_en: Check abort error state in bnxt_half_open_nic()
	net: hisilicon: rename CACHE_LINE_MASK to avoid redefinition
	net/tcp_fastopen: fix data races around tfo_active_disable_stamp
	ALSA: hda: intel-dsp-cfg: add missing ElkhartLake PCI ID
	net: hns3: fix possible mismatches resp of mailbox
	net: hns3: fix rx VLAN offload state inconsistent issue
	spi: spi-bcm2835: Fix deadlock
	net/sched: act_skbmod: Skip non-Ethernet packets
	ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions
	ceph: don't WARN if we're still opening a session to an MDS
	nvme-pci: don't WARN_ON in nvme_reset_work if ctrl.state is not RESETTING
	Revert "USB: quirks: ignore remote wake-up on Fibocom L850-GL LTE modem"
	afs: Fix tracepoint string placement with built-in AFS
	r8169: Avoid duplicate sysfs entry creation error
	nvme: set the PRACT bit when using Write Zeroes with T10 PI
	sctp: update active_key for asoc when old key is being replaced
	tcp: disable TFO blackhole logic by default
	net: dsa: sja1105: make VID 4095 a bridge VLAN too
	net: sched: cls_api: Fix the the wrong parameter
	drm/panel: raspberrypi-touchscreen: Prevent double-free
	cifs: only write 64kb at a time when fallocating a small region of a file
	cifs: fix fallocate when trying to allocate a hole.
	proc: Avoid mixing integer types in mem_rw()
	mmc: core: Don't allocate IDA for OF aliases
	s390/ftrace: fix ftrace_update_ftrace_func implementation
	s390/boot: fix use of expolines in the DMA code
	ALSA: usb-audio: Add missing proc text entry for BESPOKEN type
	ALSA: usb-audio: Add registration quirk for JBL Quantum headsets
	ALSA: sb: Fix potential ABBA deadlock in CSP driver
	ALSA: hda/realtek: Fix pop noise and 2 Front Mic issues on a machine
	ALSA: hdmi: Expose all pins on MSI MS-7C94 board
	ALSA: pcm: Call substream ack() method upon compat mmap commit
	ALSA: pcm: Fix mmap capability check
	Revert "usb: renesas-xhci: Fix handling of unknown ROM state"
	usb: xhci: avoid renesas_usb_fw.mem when it's unusable
	xhci: Fix lost USB 2 remote wake
	KVM: PPC: Book3S: Fix H_RTAS rets buffer overflow
	KVM: PPC: Book3S HV Nested: Sanitise H_ENTER_NESTED TM state
	usb: hub: Disable USB 3 device initiated lpm if exit latency is too high
	usb: hub: Fix link power management max exit latency (MEL) calculations
	USB: usb-storage: Add LaCie Rugged USB3-FW to IGNORE_UAS
	usb: max-3421: Prevent corruption of freed memory
	usb: renesas_usbhs: Fix superfluous irqs happen after usb_pkt_pop()
	USB: serial: option: add support for u-blox LARA-R6 family
	USB: serial: cp210x: fix comments for GE CS1000
	USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick
	usb: gadget: Fix Unbalanced pm_runtime_enable in tegra_xudc_probe
	usb: dwc2: gadget: Fix GOUTNAK flow for Slave mode.
	usb: dwc2: gadget: Fix sending zero length packet in DDMA mode.
	usb: typec: stusb160x: register role switch before interrupt registration
	firmware/efi: Tell memblock about EFI iomem reservations
	tracepoints: Update static_call before tp_funcs when adding a tracepoint
	tracing/histogram: Rename "cpu" to "common_cpu"
	tracing: Fix bug in rb_per_cpu_empty() that might cause deadloop.
	tracing: Synthetic event field_pos is an index not a boolean
	btrfs: check for missing device in btrfs_trim_fs
	media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf()
	ixgbe: Fix packet corruption due to missing DMA sync
	bus: mhi: core: Validate channel ID when processing command completions
	posix-cpu-timers: Fix rearm racing against process tick
	selftest: use mmap instead of posix_memalign to allocate memory
	io_uring: explicitly count entries for poll reqs
	io_uring: remove double poll entry on arm failure
	userfaultfd: do not untag user pointers
	memblock: make for_each_mem_range() traverse MEMBLOCK_HOTPLUG regions
	hugetlbfs: fix mount mode command line processing
	rbd: don't hold lock_rwsem while running_list is being drained
	rbd: always kick acquire on "acquired" and "released" notifications
	misc: eeprom: at24: Always append device id even if label property is set.
	nds32: fix up stack guard gap
	driver core: Prevent warning when removing a device link from unregistered consumer
	drm: Return -ENOTTY for non-drm ioctls
	drm/amdgpu: update golden setting for sienna_cichlid
	net: dsa: mv88e6xxx: enable SerDes RX stats for Topaz
	net: dsa: mv88e6xxx: enable SerDes PCS register dump via ethtool -d on Topaz
	PCI: Mark AMD Navi14 GPU ATS as broken
	bonding: fix build issue
	skbuff: Release nfct refcount on napi stolen or re-used skbs
	Documentation: Fix intiramfs script name
	perf inject: Close inject.output on exit
	usb: ehci: Prevent missed ehci interrupts with edge-triggered MSI
	drm/i915/gvt: Clear d3_entered on elsp cmd submission.
	sfc: ensure correct number of XDP queues
	xhci: add xhci_get_virt_ep() helper
	skbuff: Fix build with SKB extensions disabled
	Linux 5.10.54

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ifd2823b47ab1544cd1f168b138624ffe060a471e
2021-07-28 15:23:47 +02:00
Taehee Yoo
56ccdf868a bonding: Add struct bond_ipesc to manage SA
[ Upstream commit 9a5605505d ]

bonding has been supporting ipsec offload.
When SA is added, bonding just passes SA to its own active real interface.
But it doesn't manage SA.
So, when events(add/del real interface, active real interface change, etc)
occur, bonding can't handle that well because It doesn't manage SA.
So some problems(panic, UAF, refcnt leak)occur.

In order to make it stable, it should manage SA.
That's the reason why struct bond_ipsec is added.
When a new SA is added to bonding interface, it is stored in the
bond_ipsec list. And the SA is passed to a current active real interface.
If events occur, it uses bond_ipsec data to handle these events.
bond->ipsec_list is protected by bond->ipsec_lock.

If a current active real interface is changed, the following logic works.
1. delete all SAs from old active real interface
2. Add all SAs to the new active real interface.
3. If a new active real interface doesn't support ipsec offload or SA's
option, it sets real_dev to NULL.

Fixes: 18cb261afd ("bonding: support hardware encryption offload to slaves")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-07-28 14:35:33 +02:00
Greg Kroah-Hartman
afe9ed0e13 This is the 5.10.53 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmD9WtYACgkQONu9yGCS
 aT6IkRAAnW25XGt27ELqFNo2vCXI38YFEyNpe0aN8y2A4X1MXu8EKNunQNFKYVt9
 5sGrSjt30qy0A9pbeajqXfnGmCNe5R825lRCQia08/+b/qyfaF358DdAI59q5zd1
 0IhInfBo+TJyLLxltt0f2yGQJfo2DfmRuOpr0EXrE7Mo7lTqDqrpmDbLl+fZ8Ugd
 SaXRZMHLsH18Q8XuFbbBnU57tgGsIys9ie397jf3jYZBpfnzWjfsKbM4BnBz3fAv
 bUnZ5P1G8Bwps30ES8Qpc6ZoWMYl6MkEPNc+4f57+amvJME45MePUvgDRrQV3Z0P
 bveovBal8c13aO46DIa+bW0Wevy1pR/OcNQ78r8I1Sq4gp6rIp0oj6Q3rEPNfJqf
 8s1/9FNbZVRkz/TA2vtILGhIlJfMm7QcESM8WA1kA5EN4er35DGlvN69kpspxhoh
 FBrgmAdMQQgmiCtLR1QllP5PVDaTNQlsXR3yeASc54UrEwuyFe/ELE5YEb7vvXIQ
 u7JF+zYbxVFqyUCtyoBEy6eoAe/jGAI/kiCvifitR33289lOItz5n64CQzCex54R
 WR1wX+rl9Jf/SWHuBh/JgCqS6x8O2+1WfpABmEWwT6m1leC6v0LG0CJoywGdHf1I
 +IlIsThsoPIMd0xFzd7GlV4+ot2ZHsxyhY7dDnkIfCZtFLKubuU=
 =PNDL
 -----END PGP SIGNATURE-----

Merge 5.10.53 into android12-5.10-lts

Changes in 5.10.53
	ARM: dts: gemini: rename mdio to the right name
	ARM: dts: gemini: add device_type on pci
	ARM: dts: rockchip: Fix thermal sensor cells o rk322x
	ARM: dts: rockchip: fix pinctrl sleep nodename for rk3036-kylin and rk3288
	arm64: dts: rockchip: fix pinctrl sleep nodename for rk3399.dtsi
	ARM: dts: rockchip: Fix the timer clocks order
	ARM: dts: rockchip: Fix IOMMU nodes properties on rk322x
	ARM: dts: rockchip: Fix power-controller node names for rk3066a
	ARM: dts: rockchip: Fix power-controller node names for rk3188
	ARM: dts: rockchip: Fix power-controller node names for rk3288
	arm64: dts: rockchip: Fix power-controller node names for px30
	arm64: dts: rockchip: Fix power-controller node names for rk3328
	arm64: dts: rockchip: Fix power-controller node names for rk3399
	reset: ti-syscon: fix to_ti_syscon_reset_data macro
	ARM: brcmstb: dts: fix NAND nodes names
	ARM: Cygnus: dts: fix NAND nodes names
	ARM: NSP: dts: fix NAND nodes names
	ARM: dts: BCM63xx: Fix NAND nodes names
	ARM: dts: Hurricane 2: Fix NAND nodes names
	ARM: dts: imx6: phyFLEX: Fix UART hardware flow control
	ARM: imx: pm-imx5: Fix references to imx5_cpu_suspend_info
	arm64: dts: rockchip: fix regulator-gpio states array
	ARM: dts: ux500: Fix interrupt cells
	ARM: dts: ux500: Rename gpio-controller node
	ARM: dts: ux500: Fix orientation of accelerometer
	ARM: dts: imx6dl-riotboard: configure PHY clock and set proper EEE value
	rtc: mxc_v2: add missing MODULE_DEVICE_TABLE
	kbuild: sink stdout from cmd for silent build
	ARM: dts: am57xx-cl-som-am57x: fix ti,no-reset-on-init flag for gpios
	ARM: dts: am437x-gp-evm: fix ti,no-reset-on-init flag for gpios
	ARM: dts: am335x: fix ti,no-reset-on-init flag for gpios
	ARM: dts: OMAP2+: Replace underscores in sub-mailbox node names
	arm64: dts: ti: k3-am654x/j721e/j7200-common-proc-board: Fix MCU_RGMII1_TXC direction
	ARM: tegra: wm8903: Fix polarity of headphones-detection GPIO in device-trees
	ARM: tegra: nexus7: Correct 3v3 regulator GPIO of PM269 variant
	arm64: dts: qcom: sc7180: Move rmtfs memory region
	ARM: dts: stm32: Remove extra size-cells on dhcom-pdk2
	ARM: dts: stm32: Fix touchscreen node on dhcom-pdk2
	ARM: dts: stm32: fix stm32mp157c-odyssey card detect pin
	ARM: dts: stm32: fix gpio-keys node on STM32 MCU boards
	ARM: dts: stm32: fix RCC node name on stm32f429 MCU
	ARM: dts: stm32: fix timer nodes on STM32 MCU to prevent warnings
	memory: tegra: Fix compilation warnings on 64bit platforms
	firmware: arm_scmi: Add SMCCC discovery dependency in Kconfig
	firmware: arm_scmi: Fix the build when CONFIG_MAILBOX is not selected
	ARM: dts: bcm283x: Fix up MMC node names
	ARM: dts: bcm283x: Fix up GPIO LED node names
	arm64: dts: juno: Update SCPI nodes as per the YAML schema
	ARM: dts: rockchip: fix supply properties in io-domains nodes
	ARM: dts: stm32: fix i2c node name on stm32f746 to prevent warnings
	ARM: dts: stm32: move stmmac axi config in ethernet node on stm32mp15
	ARM: dts: stm32: fix the Odyssey SoM eMMC VQMMC supply
	ARM: dts: stm32: Drop unused linux,wakeup from touchscreen node on DHCOM SoM
	ARM: dts: stm32: Rename spi-flash/mx66l51235l@N to flash@N on DHCOM SoM
	ARM: dts: stm32: fix stpmic node for stm32mp1 boards
	ARM: OMAP2+: Block suspend for am3 and am4 if PM is not configured
	soc/tegra: fuse: Fix Tegra234-only builds
	firmware: tegra: bpmp: Fix Tegra234-only builds
	arm64: dts: ls208xa: remove bus-num from dspi node
	arm64: dts: imx8mq: assign PCIe clocks
	thermal/core: Correct function name thermal_zone_device_unregister()
	thermal/drivers/rcar_gen3_thermal: Do not shadow rcar_gen3_ths_tj_1
	thermal/drivers/imx_sc: Add missing of_node_put for loop iteration
	thermal/drivers/sprd: Add missing of_node_put for loop iteration
	kbuild: mkcompile_h: consider timestamp if KBUILD_BUILD_TIMESTAMP is set
	arch/arm64/boot/dts/marvell: fix NAND partitioning scheme
	rtc: max77686: Do not enforce (incorrect) interrupt trigger type
	scsi: aic7xxx: Fix unintentional sign extension issue on left shift of u8
	scsi: libsas: Add LUN number check in .slave_alloc callback
	scsi: libfc: Fix array index out of bound exception
	scsi: qedf: Add check to synchronize abort and flush
	sched/fair: Fix CFS bandwidth hrtimer expiry type
	perf/x86/intel/uncore: Clean up error handling path of iio mapping
	thermal/core/thermal_of: Stop zone device before unregistering it
	s390/traps: do not test MONITOR CALL without CONFIG_BUG
	s390: introduce proper type handling call_on_stack() macro
	cifs: prevent NULL deref in cifs_compose_mount_options()
	firmware: turris-mox-rwtm: add marvell,armada-3700-rwtm-firmware compatible string
	arm64: dts: marvell: armada-37xx: move firmware node to generic dtsi file
	Revert "swap: fix do_swap_page() race with swapoff"
	f2fs: Show casefolding support only when supported
	mm/thp: simplify copying of huge zero page pmd when fork
	mm/userfaultfd: fix uffd-wp special cases for fork()
	mm/page_alloc: fix memory map initialization for descending nodes
	usb: cdns3: Enable TDL_CHK only for OUT ep
	net: bcmgenet: ensure EXT_ENERGY_DET_MASK is clear
	net: dsa: mv88e6xxx: enable .port_set_policy() on Topaz
	net: dsa: mv88e6xxx: use correct .stats_set_histogram() on Topaz
	net: dsa: mv88e6xxx: enable .rmu_disable() on Topaz
	net: dsa: mv88e6xxx: enable devlink ATU hash param for Topaz
	net: ipv6: fix return value of ip6_skb_dst_mtu
	netfilter: ctnetlink: suspicious RCU usage in ctnetlink_dump_helpinfo
	net/sched: act_ct: fix err check for nf_conntrack_confirm
	vmxnet3: fix cksum offload issues for tunnels with non-default udp ports
	net/sched: act_ct: remove and free nf_table callbacks
	net: bridge: sync fdb to new unicast-filtering ports
	net: netdevsim: use xso.real_dev instead of xso.dev in callback functions of struct xfrmdev_ops
	net: bcmgenet: Ensure all TX/RX queues DMAs are disabled
	net: ip_tunnel: fix mtu calculation for ETHER tunnel devices
	net: moxa: fix UAF in moxart_mac_probe
	net: qcom/emac: fix UAF in emac_remove
	net: ti: fix UAF in tlan_remove_one
	net: send SYNACK packet with accepted fwmark
	net: validate lwtstate->data before returning from skb_tunnel_info()
	Revert "mm/shmem: fix shmem_swapin() race with swapoff"
	net: dsa: properly check for the bridge_leave methods in dsa_switch_bridge_leave()
	net: fddi: fix UAF in fza_probe
	dma-buf/sync_file: Don't leak fences on merge failure
	kbuild: do not suppress Kconfig prompts for silent build
	ARM: dts: aspeed: Fix AST2600 machines line names
	ARM: dts: tacoma: Add phase corrections for eMMC
	tcp: consistently disable header prediction for mptcp
	tcp: annotate data races around tp->mtu_info
	tcp: fix tcp_init_transfer() to not reset icsk_ca_initialized
	ipv6: tcp: drop silly ICMPv6 packet too big messages
	tcp: call sk_wmem_schedule before sk_mem_charge in zerocopy path
	tools: bpf: Fix error in 'make -C tools/ bpf_install'
	bpftool: Properly close va_list 'ap' by va_end() on error
	bpf: Track subprog poke descriptors correctly and fix use-after-free
	perf test bpf: Free obj_buf
	drm/panel: nt35510: Do not fail if DSI read fails
	udp: annotate data races around unix_sk(sk)->gso_size
	Linux 5.10.53

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Iac8fe9cd2abb2d8dd993967205a97c89f01f3647
2021-07-25 15:37:14 +02:00
Paolo Abeni
ea66fcb296 tcp: consistently disable header prediction for mptcp
commit 71158bb1f2 upstream.

The MPTCP receive path is hooked only into the TCP slow-path.
The DSS presence allows plain MPTCP traffic to hit that
consistently.

Since commit e1ff9e82e2 ("net: mptcp: improve fallback to TCP"),
when an MPTCP socket falls back to TCP, it can hit the TCP receive
fast-path, and delay or stop triggering the event notification.

Address the issue explicitly disabling the header prediction
for MPTCP sockets.

Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/200
Fixes: e1ff9e82e2 ("net: mptcp: improve fallback to TCP")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-07-25 14:36:21 +02:00
Taehee Yoo
2179d96ec7 net: validate lwtstate->data before returning from skb_tunnel_info()
commit 67a9c94317 upstream.

skb_tunnel_info() returns pointer of lwtstate->data as ip_tunnel_info
type without validation. lwtstate->data can have various types such as
mpls_iptunnel_encap, etc and these are not compatible.
So skb_tunnel_info() should validate before returning that pointer.

Splat looks like:
BUG: KASAN: slab-out-of-bounds in vxlan_get_route+0x418/0x4b0 [vxlan]
Read of size 2 at addr ffff888106ec2698 by task ping/811

CPU: 1 PID: 811 Comm: ping Not tainted 5.13.0+ #1195
Call Trace:
 dump_stack_lvl+0x56/0x7b
 print_address_description.constprop.8.cold.13+0x13/0x2ee
 ? vxlan_get_route+0x418/0x4b0 [vxlan]
 ? vxlan_get_route+0x418/0x4b0 [vxlan]
 kasan_report.cold.14+0x83/0xdf
 ? vxlan_get_route+0x418/0x4b0 [vxlan]
 vxlan_get_route+0x418/0x4b0 [vxlan]
 [ ... ]
 vxlan_xmit_one+0x148b/0x32b0 [vxlan]
 [ ... ]
 vxlan_xmit+0x25c5/0x4780 [vxlan]
 [ ... ]
 dev_hard_start_xmit+0x1ae/0x6e0
 __dev_queue_xmit+0x1f39/0x31a0
 [ ... ]
 neigh_xmit+0x2f9/0x940
 mpls_xmit+0x911/0x1600 [mpls_iptunnel]
 lwtunnel_xmit+0x18f/0x450
 ip_finish_output2+0x867/0x2040
 [ ... ]

Fixes: 61adedf3e3 ("route: move lwtunnel state to dst_entry")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-07-25 14:36:20 +02:00
Vadim Fedorenko
34365de508 net: ipv6: fix return value of ip6_skb_dst_mtu
commit 40fc3054b4 upstream.

Commit 628a5c5618 ("[INET]: Add IP(V6)_PMTUDISC_RPOBE") introduced
ip6_skb_dst_mtu with return value of signed int which is inconsistent
with actually returned values. Also 2 users of this function actually
assign its value to unsigned int variable and only __xfrm6_output
assigns result of this function to signed variable but actually uses
as unsigned in further comparisons and calls. Change this function
to return unsigned int value.

Fixes: 628a5c5618 ("[INET]: Add IP(V6)_PMTUDISC_RPOBE")
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: Vadim Fedorenko <vfedorenko@novek.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-07-25 14:36:18 +02:00
Greg Kroah-Hartman
8db62be3c3 This is the 5.10.51 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmD1LZUACgkQONu9yGCS
 aT7gERAArjYemBSkD4/nq5HvxoVu7ueEyqI2orJCyB6b5npPrBZjlKna3SuYuNUF
 CmcX5Y2Ynxd3gWJvYFEJdAAQAEtKAzPdPv0QJ+KiLSP2bEZ4Q5grEJXfzcgxcB4L
 fUfaCZnUwjoII5xzW1+U2zCJ7YtGx5hZySLKMxSEc0IzawDlfMx4HdwlohXzczsA
 Zq3/sTJcW30PWSp6MSuMOH//lPh7sAoCnksAv4Yb8MZYZjC8JNnKFn+IwRUGWEMZ
 sFtNbq51sMgGq4TjYBIdO6wBElP4dgWJhYc4cO0667cDvgp6iod/bKlOLJSiwIVX
 uPWkyPihH9ZUvNVY0TxjjnxS1rnM0QhH+cEXNGn+SE7KaNmzsI2MaR+DVA2yWcFr
 9edqTq5x2CJJ0R/oXHP4nYFtsvlV/QcirlrF0OZHYwz84b16f37Ac7tHOQpr3kNO
 N29AW0l5XmpxbfHgo1Iaoi02seouLC47vRkvjTpS9mValGUC0ciXTb97CK4FremE
 34rskxIRWBU8HECYioFOeHTAi0+xb/9tOj87BnB5CJ28CD2Md27TTdorsISnqPb0
 /ER89QfVtlJLi17wGB0rlAm8fDF3Cy6BnA57QIql1z1NbJGc1cxenEAFiIOnbQ5G
 t6SLs3mgqpQizsKUFYimCWa04ZzY4Bg8H9bAI+M+9w7J6yujQzI=
 =dGMa
 -----END PGP SIGNATURE-----

Merge 5.10.51 into android12-5.10-lts

Changes in 5.10.51
	drm/mxsfb: Don't select DRM_KMS_FB_HELPER
	drm/zte: Don't select DRM_KMS_FB_HELPER
	drm/ast: Fixed CVE for DP501
	drm/amd/display: fix HDCP reset sequence on reinitialize
	drm/amd/amdgpu/sriov disable all ip hw status by default
	drm/vc4: fix argument ordering in vc4_crtc_get_margins()
	drm/bridge: nwl-dsi: Force a full modeset when crtc_state->active is changed to be true
	net: pch_gbe: Use proper accessors to BE data in pch_ptp_match()
	drm/amd/display: fix use_max_lb flag for 420 pixel formats
	clk: renesas: rcar-usb2-clock-sel: Fix error handling in .probe()
	hugetlb: clear huge pte during flush function on mips platform
	atm: iphase: fix possible use-after-free in ia_module_exit()
	mISDN: fix possible use-after-free in HFC_cleanup()
	atm: nicstar: Fix possible use-after-free in nicstar_cleanup()
	net: Treat __napi_schedule_irqoff() as __napi_schedule() on PREEMPT_RT
	drm/mediatek: Fix PM reference leak in mtk_crtc_ddp_hw_init()
	net: mdio: ipq8064: add regmap config to disable REGCACHE
	drm/bridge: lt9611: Add missing MODULE_DEVICE_TABLE
	reiserfs: add check for invalid 1st journal block
	drm/virtio: Fix double free on probe failure
	net: mdio: provide shim implementation of devm_of_mdiobus_register
	net/sched: cls_api: increase max_reclassify_loop
	pinctrl: equilibrium: Add missing MODULE_DEVICE_TABLE
	drm/scheduler: Fix hang when sched_entity released
	drm/sched: Avoid data corruptions
	udf: Fix NULL pointer dereference in udf_symlink function
	drm/vc4: Fix clock source for VEC PixelValve on BCM2711
	drm/vc4: hdmi: Fix PM reference leak in vc4_hdmi_encoder_pre_crtc_co()
	e100: handle eeprom as little endian
	igb: handle vlan types with checker enabled
	igb: fix assignment on big endian machines
	drm/bridge: cdns: Fix PM reference leak in cdns_dsi_transfer()
	clk: renesas: r8a77995: Add ZA2 clock
	net/mlx5e: IPsec/rep_tc: Fix rep_tc_update_skb drops IPsec packet
	net/mlx5: Fix lag port remapping logic
	drm: rockchip: add missing registers for RK3188
	drm: rockchip: add missing registers for RK3066
	net: stmmac: the XPCS obscures a potential "PHY not found" error
	RDMA/rtrs: Change MAX_SESS_QUEUE_DEPTH
	clk: tegra: Fix refcounting of gate clocks
	clk: tegra: Ensure that PLLU configuration is applied properly
	drm: bridge: cdns-mhdp8546: Fix PM reference leak in
	virtio-net: Add validation for used length
	ipv6: use prandom_u32() for ID generation
	MIPS: cpu-probe: Fix FPU detection on Ingenic JZ4760(B)
	MIPS: ingenic: Select CPU_SUPPORTS_CPUFREQ && MIPS_EXTERNAL_TIMER
	drm/amd/display: Avoid HDCP over-read and corruption
	drm/amdgpu: remove unsafe optimization to drop preamble ib
	net: tcp better handling of reordering then loss cases
	RDMA/cxgb4: Fix missing error code in create_qp()
	dm space maps: don't reset space map allocation cursor when committing
	dm writecache: don't split bios when overwriting contiguous cache content
	dm: Fix dm_accept_partial_bio() relative to zone management commands
	net: bridge: mrp: Update ring transitions.
	pinctrl: mcp23s08: fix race condition in irq handler
	ice: set the value of global config lock timeout longer
	ice: fix clang warning regarding deadcode.DeadStores
	virtio_net: Remove BUG() to avoid machine dead
	net: mscc: ocelot: check return value after calling platform_get_resource()
	net: bcmgenet: check return value after calling platform_get_resource()
	net: mvpp2: check return value after calling platform_get_resource()
	net: micrel: check return value after calling platform_get_resource()
	net: moxa: Use devm_platform_get_and_ioremap_resource()
	drm/amd/display: Fix DCN 3.01 DSCCLK validation
	drm/amd/display: Update scaling settings on modeset
	drm/amd/display: Release MST resources on switch from MST to SST
	drm/amd/display: Set DISPCLK_MAX_ERRDET_CYCLES to 7
	drm/amd/display: Fix off-by-one error in DML
	net: phy: realtek: add delay to fix RXC generation issue
	selftests: Clean forgotten resources as part of cleanup()
	net: sgi: ioc3-eth: check return value after calling platform_get_resource()
	drm/amdkfd: use allowed domain for vmbo validation
	fjes: check return value after calling platform_get_resource()
	selinux: use __GFP_NOWARN with GFP_NOWAIT in the AVC
	r8169: avoid link-up interrupt issue on RTL8106e if user enables ASPM
	drm/amd/display: Verify Gamma & Degamma LUT sizes in amdgpu_dm_atomic_check
	xfrm: Fix error reporting in xfrm_state_construct.
	dm writecache: commit just one block, not a full page
	wlcore/wl12xx: Fix wl12xx get_mac error if device is in ELP
	wl1251: Fix possible buffer overflow in wl1251_cmd_scan
	cw1200: add missing MODULE_DEVICE_TABLE
	drm/amdkfd: fix circular locking on get_wave_state
	drm/amdkfd: Fix circular lock in nocpsch path
	bpf: Fix up register-based shifts in interpreter to silence KUBSAN
	ice: fix incorrect payload indicator on PTYPE
	ice: mark PTYPE 2 as reserved
	mt76: mt7615: fix fixed-rate tx status reporting
	net: fix mistake path for netdev_features_strings
	net: ipa: Add missing of_node_put() in ipa_firmware_load()
	net: sched: fix error return code in tcf_del_walker()
	io_uring: fix false WARN_ONCE
	drm/amdgpu: fix bad address translation for sienna_cichlid
	drm/amdkfd: Walk through list with dqm lock hold
	mt76: mt7915: fix IEEE80211_HE_PHY_CAP7_MAX_NC for station mode
	rtl8xxxu: Fix device info for RTL8192EU devices
	MIPS: add PMD table accounting into MIPS'pmd_alloc_one
	net: fec: add ndo_select_queue to fix TX bandwidth fluctuations
	atm: nicstar: use 'dma_free_coherent' instead of 'kfree'
	atm: nicstar: register the interrupt handler in the right place
	vsock: notify server to shutdown when client has pending signal
	RDMA/rxe: Don't overwrite errno from ib_umem_get()
	iwlwifi: mvm: don't change band on bound PHY contexts
	iwlwifi: mvm: fix error print when session protection ends
	iwlwifi: pcie: free IML DMA memory allocation
	iwlwifi: pcie: fix context info freeing
	sfc: avoid double pci_remove of VFs
	sfc: error code if SRIOV cannot be disabled
	wireless: wext-spy: Fix out-of-bounds warning
	cfg80211: fix default HE tx bitrate mask in 2G band
	mac80211: consider per-CPU statistics if present
	mac80211_hwsim: add concurrent channels scanning support over virtio
	IB/isert: Align target max I/O size to initiator size
	media, bpf: Do not copy more entries than user space requested
	net: ip: avoid OOM kills with large UDP sends over loopback
	RDMA/cma: Fix rdma_resolve_route() memory leak
	Bluetooth: btusb: Fixed too many in-token issue for Mediatek Chip.
	Bluetooth: Fix the HCI to MGMT status conversion table
	Bluetooth: Fix alt settings for incoming SCO with transparent coding format
	Bluetooth: Shutdown controller after workqueues are flushed or cancelled
	Bluetooth: btusb: Add a new QCA_ROME device (0cf3:e500)
	Bluetooth: L2CAP: Fix invalid access if ECRED Reconfigure fails
	Bluetooth: L2CAP: Fix invalid access on ECRED Connection response
	Bluetooth: btusb: Add support USB ALT 3 for WBS
	Bluetooth: mgmt: Fix the command returns garbage parameter value
	Bluetooth: btusb: fix bt fiwmare downloading failure issue for qca btsoc.
	sched/fair: Ensure _sum and _avg values stay consistent
	bpf: Fix false positive kmemleak report in bpf_ringbuf_area_alloc()
	flow_offload: action should not be NULL when it is referenced
	sctp: validate from_addr_param return
	sctp: add size validation when walking chunks
	MIPS: loongsoon64: Reserve memory below starting pfn to prevent Oops
	MIPS: set mips32r5 for virt extensions
	selftests/resctrl: Fix incorrect parsing of option "-t"
	MIPS: MT extensions are not available on MIPS32r1
	ath11k: unlock on error path in ath11k_mac_op_add_interface()
	arm64: dts: rockchip: add rk3328 dwc3 usb controller node
	arm64: dts: rockchip: Enable USB3 for rk3328 Rock64
	loop: fix I/O error on fsync() in detached loop devices
	mm,hwpoison: return -EBUSY when migration fails
	io_uring: simplify io_remove_personalities()
	io_uring: Convert personality_idr to XArray
	io_uring: convert io_buffer_idr to XArray
	scsi: iscsi: Fix race condition between login and sync thread
	scsi: iscsi: Fix iSCSI cls conn state
	powerpc/mm: Fix lockup on kernel exec fault
	powerpc/barrier: Avoid collision with clang's __lwsync macro
	powerpc/powernv/vas: Release reference to tgid during window close
	drm/amdgpu: Update NV SIMD-per-CU to 2
	drm/amdgpu: enable sdma0 tmz for Raven/Renoir(V2)
	drm/radeon: Add the missed drm_gem_object_put() in radeon_user_framebuffer_create()
	drm/radeon: Call radeon_suspend_kms() in radeon_pci_shutdown() for Loongson64
	drm/vc4: txp: Properly set the possible_crtcs mask
	drm/vc4: crtc: Skip the TXP
	drm/vc4: hdmi: Prevent clock unbalance
	drm/dp: Handle zeroed port counts in drm_dp_read_downstream_info()
	drm/rockchip: dsi: remove extra component_del() call
	drm/amd/display: fix incorrrect valid irq check
	pinctrl/amd: Add device HID for new AMD GPIO controller
	drm/amd/display: Reject non-zero src_y and src_x for video planes
	drm/tegra: Don't set allow_fb_modifiers explicitly
	drm/msm/mdp4: Fix modifier support enabling
	drm/arm/malidp: Always list modifiers
	drm/nouveau: Don't set allow_fb_modifiers explicitly
	drm/i915/display: Do not zero past infoframes.vsc
	mmc: sdhci-acpi: Disable write protect detection on Toshiba Encore 2 WT8-B
	mmc: sdhci: Fix warning message when accessing RPMB in HS400 mode
	mmc: core: clear flags before allowing to retune
	mmc: core: Allow UHS-I voltage switch for SDSC cards if supported
	ata: ahci_sunxi: Disable DIPM
	arm64: tlb: fix the TTL value of tlb_get_level
	cpu/hotplug: Cure the cpusets trainwreck
	clocksource/arm_arch_timer: Improve Allwinner A64 timer workaround
	fpga: stratix10-soc: Add missing fpga_mgr_free() call
	ASoC: tegra: Set driver_name=tegra for all machine drivers
	i40e: fix PTP on 5Gb links
	qemu_fw_cfg: Make fw_cfg_rev_attr a proper kobj_attribute
	ipmi/watchdog: Stop watchdog timer when the current action is 'none'
	thermal/drivers/int340x/processor_thermal: Fix tcc setting
	ubifs: Fix races between xattr_{set|get} and listxattr operations
	power: supply: ab8500: Fix an old bug
	mfd: syscon: Free the allocated name field of struct regmap_config
	nvmem: core: add a missing of_node_put
	lkdtm/bugs: XFAIL UNALIGNED_LOAD_STORE_WRITE
	selftests/lkdtm: Fix expected text for CR4 pinning
	extcon: intel-mrfld: Sync hardware and software state on init
	seq_buf: Fix overflow in seq_buf_putmem_hex()
	rq-qos: fix missed wake-ups in rq_qos_throttle try two
	tracing: Simplify & fix saved_tgids logic
	tracing: Resize tgid_map to pid_max, not PID_MAX_DEFAULT
	ipack/carriers/tpci200: Fix a double free in tpci200_pci_probe
	coresight: Propagate symlink failure
	coresight: tmc-etf: Fix global-out-of-bounds in tmc_update_etf_buffer()
	dm zoned: check zone capacity
	dm writecache: flush origin device when writing and cache is full
	dm btree remove: assign new_root only when removal succeeds
	PCI: Leave Apple Thunderbolt controllers on for s2idle or standby
	PCI: aardvark: Fix checking for PIO Non-posted Request
	PCI: aardvark: Implement workaround for the readback value of VEND_ID
	media: subdev: disallow ioctl for saa6588/davinci
	media: dtv5100: fix control-request directions
	media: zr364xx: fix memory leak in zr364xx_start_readpipe
	media: gspca/sq905: fix control-request direction
	media: gspca/sunplus: fix zero-length control requests
	media: uvcvideo: Fix pixel format change for Elgato Cam Link 4K
	io_uring: fix clear IORING_SETUP_R_DISABLED in wrong function
	dm writecache: write at least 4k when committing
	pinctrl: mcp23s08: Fix missing unlock on error in mcp23s08_irq()
	drm/ast: Remove reference to struct drm_device.pdev
	jfs: fix GPF in diFree
	smackfs: restrict bytes count in smk_set_cipso()
	ext4: fix memory leak in ext4_fill_super
	f2fs: fix to avoid racing on fsync_entry_slab by multi filesystem instances
	Linux 5.10.51

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Icb10fed733a0050848ecc23db13ae3d134895acd
2021-07-19 17:29:53 +02:00
Marcelo Ricardo Leitner
d4dbef7046 sctp: validate from_addr_param return
[ Upstream commit 0c5dc070ff ]

Ilja reported that, simply putting it, nothing was validating that
from_addr_param functions were operating on initialized memory. That is,
the parameter itself was being validated by sctp_walk_params, but it
doesn't check for types and their specific sizes and it could be a 0-length
one, causing from_addr_param to potentially work over the next parameter or
even uninitialized memory.

The fix here is to, in all calls to from_addr_param, check if enough space
is there for the wanted IP address type.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-07-19 09:44:55 +02:00
gushengxian
e83f312114 flow_offload: action should not be NULL when it is referenced
[ Upstream commit 9ea3e52c5b ]

"action" should not be NULL when it is referenced.

Signed-off-by: gushengxian <13145886936@163.com>
Signed-off-by: gushengxian <gushengxian@yulong.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-07-19 09:44:55 +02:00
Greg Kroah-Hartman
1328352dcd Merge branch 'android12-5.10' into android12-5.10-lts
Sync up with android12-5.10 for the following commits:

870488eb07 ANDROID: GKI: 7/14/2021 KMI update
e9742a9ea5 ANDROID: Update the ABI symbol list
ec2190fd3f FROMLIST: arm64: avoid double ISB on kernel entry
98b2c1dd1c FROMLIST: arm64: mte: optimize GCR_EL1 modification on kernel entry/exit
a20103c331 BACKPORT: FROMLIST: arm64: mte: avoid TFSR related operations unless in async mode
3972be647a FROMLIST: Documentation: document the preferred tag checking mode feature
5adf29adb5 FROMLIST: arm64: mte: introduce a per-CPU tag checking mode preference
ce5ba15abc FROMLIST: arm64: move preemption disablement to prctl handlers
6c08feaa27 FROMLIST: arm64: mte: change ASYNC and SYNC TCF settings into bitfields
f438cf16cd FROMLIST: arm64: mte: rename gcr_user_excl to mte_ctrl
a4c9e551b6 BACKPORT: arm64: pac: Optimize kernel entry/exit key installation code paths
50829b8901 BACKPORT: arm64: Introduce prctl(PR_PAC_{SET,GET}_ENABLED_KEYS)
6119d18df7 ANDROID: cleancache: add oem data to cleancache_ops
a0c429e8e1 ANDROID: blkdev: add oem data to block_device_operations
26cd2564e1 FROMLIST: psi: stop relying on timer_pending for poll_work rescheduling
e85b291d7d ANDROID: GKI: Enable CONFIG_MEMCG
0ed7424fa0 ANDROID: GKI: net: add vendor hooks for 'struct sock' lifecycle
4d30956478 ANDROID: GKI: net: add vendor hooks for 'struct nf_conn' lifecycle
7786463e48 ANDROID: GKI: add vendor padding variable in struct sock
280c9b98aa ANDROID: GKI: add vendor padding variable in struct nf_conn
9d1b55d20a ANDROID: vendor_hooks: add a field in mem_cgroup
65115fdbf8 ANDROID: vendor_hooks: add a field in pglist_data
26920e0f3a FROMLIST: usb: dwc3: avoid NULL access of usb_gadget_driver
5bb2dd8d39 FROMGIT: usb: dwc3: dwc3-qcom: Enable tx-fifo-resize property by default
79274dbb00 FROMGIT: usb: dwc3: Resize TX FIFOs to meet EP bursting requirements
1e11f36199 FROMGIT: usb: gadget: configfs: Check USB configuration before adding
6da5e7afbf FROMGIT: usb: gadget: udc: core: Introduce check_config to verify USB configuration
2ed5fbf261 ANDROID: GKI: fscrypt: add OEM data to struct fscrypt_operations
194fd9239a ANDROID: GKI: fscrypt: add ABI padding to struct fscrypt_operations
8011eb2215 ANDROID: mm: provision to add shmem pages to inactive file lru head
9bb1247653 ANDROID: GKI: Enable CONFIG_CGROUP_NET_PRIO
a1ce719ca7 ANDROID: Delete the DMA-BUF attachment sysfs statistics
a2b3afb2f7 ANDROID: android: Add symbols to debug_symbols driver
914a7b14a0 UPSTREAM: USB: UDC core: Add udc_async_callbacks gadget op
9af9ef8dfa ANDROID: vendor_hooks: Add oem data to file struct
37485a3025 ANDROID: add kabi padding for structures for the android12 release
429c78f9b0 ANDROID: GKI: device.h: add Android ABI padding to some structures
aea5e1c230 ANDROID: GKI: elevator: add Android ABI padding to some structures
1b79ef2754 ANDROID: GKI: scsi: add Android ABI padding to some structures
33175403b9 ANDROID: GKI: workqueue.h: add Android ABI padding to some structures
d5c344a498 ANDROID: GKI: sched: add Android ABI padding to some structures
9c4854fa5a ANDROID: GKI: phy: add Android ABI padding to some structures
f4872b2353 ANDROID: GKI: fs.h: add Android ABI padding to some structures
48cddc7c42 ANDROID: GKI: dentry: add Android ABI padding to some structures
b9081a2925 ANDROID: GKI: bio: add Android ABI padding to some structures
99bf8cf8fa ANDROID: GKI: ufs: add Android ABI padding to some structures
9df147298f ANDROID: Update the generic symbol list
12f48605e8 ANDROID: mm: cma do not sleep for __GFP_NORETRY
0e688e972d ANDROID: mm: cma: skip problematic pageblock
9938b82be1 ANDROID: mm: bail out tlb free batching on page zapping when cma is going on
c8578a3e90 ANDROID: mm: lru_cache_disable skips lru cache drainnig
c01ce3b5ef ANDROID: mm: do not try test_page_isoalte if migration fails
675e504598 ANDROID: mm: add cma allocation statistics
b1e4543c27 UPSTREAM: mm, page_alloc: move draining pcplists to page isolation users
13bc06efd9 ANDROID: ALSA: compress: add vendor hook to support pause in draining
2faed77792 ANDROID: vendor_hooks: add vendor hook in blk_mq_rq_ctx_init()
292baba45a ANDROID: abi_gki_aarch64_qcom: Add I3C core symbols to qcom tree
eecc725a8e ANDROID: vendor_hooks: add vendor hook in blk_mq_alloc_rqs()
9c2958f454 ANDROID: GKI: Export put_task_stack symbol
288805c86a ANDROID: abi_gki_aarch64_qcom: Add idr_alloc_u32
e8516fd3af ANDROID: sound: usb: add vendor hook for cpu suspend support
d820d22b5d ANDROID: mm: page_pinner: use EXPORT_SYMBOL_GPL
efc09793ea ANDROID: GKI: update allowed GKI symbol for Exynosauto SoC
67e3e39eb1 ANDROID: GKI: sync allowed list for exynosauto SoC
d25e256373 ANDROID: ABI: add new symbols required by fips140.ko
50661975be ANDROID: fips140: add/update module help text
b7397e89db ANDROID: fips140: add power-up cryptographic self-tests
bd7d13c36e ANDROID: arm64: disable LSE when building the FIPS140 module
1061ef0493 ANDROID: jump_label: disable jump labels in fips140.ko
dcf509fea7 ANDROID: ipv6: add vendor hook for gen ipv6 link-local addr
018332e871 ANDROID: Revert "scsi: block: Do not accept any requests while suspended"
2ad2c3a25b ANDROID: abi_gki_aarch64_qcom: whitelist vm_event_states
7bcfde2601 ANDROID: ashmem: Export is_ashmem_file

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I7d60121fa9f25f007dab97dd666adcdb1964afc8
2021-07-15 17:17:09 +02:00
Greg Kroah-Hartman
a3cd27f5c4 ANDROID: GKI: fix up crc change in ip.h
Commit 92071a2b8f7f ("net: lwtunnel: handle MTU calculation in
forwading") was backported to 5.10.50 and it caused a crc change in
include/net/ip.h due to a new .h file being included.

No real abi change happened here, so just #ifdef the .h file out when
doing the crc check.

Bug: 161946584
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I1bad0458bc0f9130239fc94ca982e800681cd443
2021-07-15 07:00:58 +02:00
Vignesh Saravanaperumal
7786463e48 ANDROID: GKI: add vendor padding variable in struct sock
Some vendors want to add things to 'struct sock', so give them a u64
where they can then have a pointer off to their private data and they
can do whatever they want to do without breaking or changing any abi for
anyone else.

Note, usually an android trace hook is also needed to use this properly,
so be aware that this will be required as well.

Bug: 171013716
Signed-off-by: Vignesh Saravanaperumal <vignesh1.s@samsung.com>
Change-Id: Iab0b5570753d4a9722ecf9ca9eeb9b9887e2a9d9
2021-07-14 20:52:03 -07:00
Vignesh Saravanaperumal
280c9b98aa ANDROID: GKI: add vendor padding variable in struct nf_conn
Some vendors want to add things to 'struct nf_conn', so give them a u64
where they can then have a pointer off to their private data and they
can do whatever they want to do without breaking or changing any abi for
anyone else.

Note, usually an android trace hook is also needed to use this properly,
so be aware that this will be required as well.

Bug: 171013716
Signed-off-by: Vignesh Saravanaperumal <vignesh1.s@samsung.com>
Change-Id: I245c162ee3fb083e3f39cf7bec3bd78cb624e005
2021-07-14 20:52:03 -07:00
Greg Kroah-Hartman
37485a3025 ANDROID: add kabi padding for structures for the android12 release
There are a lot of different structures that need to have a "frozen" abi
for the next 5+ years.  Add padding to a lot of them in order to be able
to handle any future changes that might be needed due to LTS and
security fixes that might come up.

It's a best guess, based on what has happened in the past from the
5.4.0..5.4.129 release (1 1/2 years).  Yes, past changes do not mean
that future changes will also be needed in the same area, but that is a
hint that those areas are both well maintained and looked after, and
there have been previous problems found in them.

Also the list of structures that are being required based on OEM usage
in the android/ symbol lists were consulted as that's a larger list than
what has been changed in the past.

Hopefully we caught everything we need to worry about, only time will
tell...

Bug: 151154716
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I880bbcda0628a7459988eeb49d18655522697664
2021-07-14 20:51:51 -07:00
Greg Kroah-Hartman
cf08d2746d Revert "Bluetooth: Fix Set Extended (Scan Response) Data"
This reverts commit 4f5fc3be2c.

It breaks the abi in a way that is not needed for the Android trees.

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I0b07da8f83077b68da09526d25b0e19b6ed28eed
2021-07-14 19:42:28 +02:00
Greg Kroah-Hartman
2df0fb4a4b This is the 5.10.50 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmDu+1UACgkQONu9yGCS
 aT7jQRAAuLDi7ejk3JUameYFMzVXGAUE6yPs392/lWJzey7IBf+2uLqz4FzqqUHp
 U1GkEKJVaCacEfi0+rpi7BxNFljUdZdg/F/P68ARtAWPvwqAeJ4QIh5u3A682UUO
 1M5h6e5/oY9F4kQIb5Kot04avqOeR6lTqrkA8jeP5h43ngyLWuS2d+5oOGmbCukS
 UgEaCC6CiKjcN51UUTj/fXMQ0X4IDHP5pD8rWwH0IvK0i7gduvk744un8LVB6aW1
 rNV88C3BEFFtkPQh2XySnXM5Ok8kYlhFoTDsqlpeAX7pA8hiUPYBoRzTg0MJtPZn
 N1L/Yqhvxmn5xs9HAw7mDOo8E8NWXzsT5FvZVaBeiCgtdKmcPszylXqmSt1oiOb0
 /EmkCWmlbG/3qWql24+LU4XP36iVPx32HQxAgg2XbnlNU5o0E1y2F98p6p/3JSWX
 NAjHtmg/MxueFQ+w8bDzhO8YzYn1dIU3V3qaXRvtpODrmaSYW+bwCyPtSjXe3/vL
 604zb3dOg9+tD/gKqfRb/UPMu24nNll8M/gnSRci05/thmIxwtYudPwoLNSejDqr
 e+a8vejISfIyp41XrpYQbUeKs1WOA+A7vgx6CZrT791afiT+6UgC/ecQfg1NFxhs
 8ayWpocaIszxyXxVGro1rfwZeQmTlbTCZ5wVdpn9sDPZfI7epts=
 =FCrA
 -----END PGP SIGNATURE-----

Merge 5.10.50 into android12-5.10-lts

Changes in 5.10.50
	Bluetooth: hci_qca: fix potential GPF
	Bluetooth: btqca: Don't modify firmware contents in-place
	Bluetooth: Remove spurious error message
	ALSA: usb-audio: fix rate on Ozone Z90 USB headset
	ALSA: usb-audio: Fix OOB access at proc output
	ALSA: firewire-motu: fix stream format for MOTU 8pre FireWire
	ALSA: usb-audio: scarlett2: Fix wrong resume call
	ALSA: intel8x0: Fix breakage at ac97 clock measurement
	ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 450 G8
	ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 445 G8
	ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 630 G8
	ALSA: hda/realtek: Add another ALC236 variant support
	ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook x360 830 G8
	ALSA: hda/realtek: Improve fixup for HP Spectre x360 15-df0xxx
	ALSA: hda/realtek: Fix bass speaker DAC mapping for Asus UM431D
	ALSA: hda/realtek: Apply LED fixup for HP Dragonfly G1, too
	ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 830 G8 Notebook PC
	media: dvb-usb: fix wrong definition
	Input: usbtouchscreen - fix control-request directions
	net: can: ems_usb: fix use-after-free in ems_usb_disconnect()
	usb: gadget: eem: fix echo command packet response issue
	usb: renesas-xhci: Fix handling of unknown ROM state
	USB: cdc-acm: blacklist Heimann USB Appset device
	usb: dwc3: Fix debugfs creation flow
	usb: typec: Add the missed altmode_id_remove() in typec_register_altmode()
	xhci: solve a double free problem while doing s4
	gfs2: Fix underflow in gfs2_page_mkwrite
	gfs2: Fix error handling in init_statfs
	ntfs: fix validity check for file name attribute
	selftests/lkdtm: Avoid needing explicit sub-shell
	copy_page_to_iter(): fix ITER_DISCARD case
	iov_iter_fault_in_readable() should do nothing in xarray case
	Input: joydev - prevent use of not validated data in JSIOCSBTNMAP ioctl
	crypto: nx - Fix memcpy() over-reading in nonce
	crypto: ccp - Annotate SEV Firmware file names
	arm_pmu: Fix write counter incorrect in ARMv7 big-endian mode
	ARM: dts: ux500: Fix LED probing
	ARM: dts: at91: sama5d4: fix pinctrl muxing
	btrfs: send: fix invalid path for unlink operations after parent orphanization
	btrfs: compression: don't try to compress if we don't have enough pages
	btrfs: clear defrag status of a root if starting transaction fails
	ext4: cleanup in-core orphan list if ext4_truncate() failed to get a transaction handle
	ext4: fix kernel infoleak via ext4_extent_header
	ext4: fix overflow in ext4_iomap_alloc()
	ext4: return error code when ext4_fill_flex_info() fails
	ext4: correct the cache_nr in tracepoint ext4_es_shrink_exit
	ext4: remove check for zero nr_to_scan in ext4_es_scan()
	ext4: fix avefreec in find_group_orlov
	ext4: use ext4_grp_locked_error in mb_find_extent
	can: bcm: delay release of struct bcm_op after synchronize_rcu()
	can: gw: synchronize rcu operations before removing gw job entry
	can: isotp: isotp_release(): omit unintended hrtimer restart on socket release
	can: j1939: j1939_sk_init(): set SOCK_RCU_FREE to call sk_destruct() after RCU is done
	can: peak_pciefd: pucan_handle_status(): fix a potential starvation issue in TX path
	mac80211: remove iwlwifi specific workaround that broke sta NDP tx
	SUNRPC: Fix the batch tasks count wraparound.
	SUNRPC: Should wake up the privileged task firstly.
	bus: mhi: Wait for M2 state during system resume
	mm/gup: fix try_grab_compound_head() race with split_huge_page()
	perf/smmuv3: Don't trample existing events with global filter
	KVM: nVMX: Handle split-lock #AC exceptions that happen in L2
	KVM: PPC: Book3S HV: Workaround high stack usage with clang
	KVM: x86/mmu: Treat NX as used (not reserved) for all !TDP shadow MMUs
	KVM: x86/mmu: Use MMU's role to detect CR4.SMEP value in nested NPT walk
	s390/cio: dont call css_wait_for_slow_path() inside a lock
	s390: mm: Fix secure storage access exception handling
	f2fs: Prevent swap file in LFS mode
	clk: agilex/stratix10/n5x: fix how the bypass_reg is handled
	clk: agilex/stratix10: remove noc_clk
	clk: agilex/stratix10: fix bypass representation
	rtc: stm32: Fix unbalanced clk_disable_unprepare() on probe error path
	iio: frequency: adf4350: disable reg and clk on error in adf4350_probe()
	iio: light: tcs3472: do not free unallocated IRQ
	iio: ltr501: mark register holding upper 8 bits of ALS_DATA{0,1} and PS_DATA as volatile, too
	iio: ltr501: ltr559: fix initialization of LTR501_ALS_CONTR
	iio: ltr501: ltr501_read_ps(): add missing endianness conversion
	iio: accel: bma180: Fix BMA25x bandwidth register values
	serial: mvebu-uart: fix calculation of clock divisor
	serial: sh-sci: Stop dmaengine transfer in sci_stop_tx()
	serial_cs: Add Option International GSM-Ready 56K/ISDN modem
	serial_cs: remove wrong GLOBETROTTER.cis entry
	ath9k: Fix kernel NULL pointer dereference during ath_reset_internal()
	ssb: sdio: Don't overwrite const buffer if block_write fails
	rsi: Assign beacon rate settings to the correct rate_info descriptor field
	rsi: fix AP mode with WPA failure due to encrypted EAPOL
	tracing/histograms: Fix parsing of "sym-offset" modifier
	tracepoint: Add tracepoint_probe_register_may_exist() for BPF tracing
	seq_buf: Make trace_seq_putmem_hex() support data longer than 8
	powerpc/stacktrace: Fix spurious "stale" traces in raise_backtrace_ipi()
	loop: Fix missing discard support when using LOOP_CONFIGURE
	evm: Execute evm_inode_init_security() only when an HMAC key is loaded
	evm: Refuse EVM_ALLOW_METADATA_WRITES only if an HMAC key is loaded
	fuse: Fix crash in fuse_dentry_automount() error path
	fuse: Fix crash if superblock of submount gets killed early
	fuse: Fix infinite loop in sget_fc()
	fuse: ignore PG_workingset after stealing
	fuse: check connected before queueing on fpq->io
	fuse: reject internal errno
	thermal/cpufreq_cooling: Update offline CPUs per-cpu thermal_pressure
	spi: Make of_register_spi_device also set the fwnode
	Add a reference to ucounts for each cred
	staging: media: rkvdec: fix pm_runtime_get_sync() usage count
	media: marvel-ccic: fix some issues when getting pm_runtime
	media: mdk-mdp: fix pm_runtime_get_sync() usage count
	media: s5p: fix pm_runtime_get_sync() usage count
	media: am437x: fix pm_runtime_get_sync() usage count
	media: sh_vou: fix pm_runtime_get_sync() usage count
	media: mtk-vcodec: fix PM runtime get logic
	media: s5p-jpeg: fix pm_runtime_get_sync() usage count
	media: sunxi: fix pm_runtime_get_sync() usage count
	media: sti/bdisp: fix pm_runtime_get_sync() usage count
	media: exynos4-is: fix pm_runtime_get_sync() usage count
	media: exynos-gsc: fix pm_runtime_get_sync() usage count
	spi: spi-loopback-test: Fix 'tx_buf' might be 'rx_buf'
	spi: spi-topcliff-pch: Fix potential double free in pch_spi_process_messages()
	spi: omap-100k: Fix the length judgment problem
	regulator: uniphier: Add missing MODULE_DEVICE_TABLE
	sched/core: Initialize the idle task with preemption disabled
	hwrng: exynos - Fix runtime PM imbalance on error
	crypto: nx - add missing MODULE_DEVICE_TABLE
	media: sti: fix obj-$(config) targets
	media: cpia2: fix memory leak in cpia2_usb_probe
	media: cobalt: fix race condition in setting HPD
	media: hevc: Fix dependent slice segment flags
	media: pvrusb2: fix warning in pvr2_i2c_core_done
	media: imx: imx7_mipi_csis: Fix logging of only error event counters
	crypto: qat - check return code of qat_hal_rd_rel_reg()
	crypto: qat - remove unused macro in FW loader
	crypto: qce: skcipher: Fix incorrect sg count for dma transfers
	arm64: perf: Convert snprintf to sysfs_emit
	sched/fair: Fix ascii art by relpacing tabs
	media: i2c: ov2659: Use clk_{prepare_enable,disable_unprepare}() to set xvclk on/off
	media: bt878: do not schedule tasklet when it is not setup
	media: em28xx: Fix possible memory leak of em28xx struct
	media: hantro: Fix .buf_prepare
	media: cedrus: Fix .buf_prepare
	media: v4l2-core: Avoid the dangling pointer in v4l2_fh_release
	media: bt8xx: Fix a missing check bug in bt878_probe
	media: st-hva: Fix potential NULL pointer dereferences
	crypto: hisilicon/sec - fixup 3des minimum key size declaration
	Makefile: fix GDB warning with CONFIG_RELR
	media: dvd_usb: memory leak in cinergyt2_fe_attach
	memstick: rtsx_usb_ms: fix UAF
	mmc: sdhci-sprd: use sdhci_sprd_writew
	mmc: via-sdmmc: add a check against NULL pointer dereference
	spi: meson-spicc: fix a wrong goto jump for avoiding memory leak.
	spi: meson-spicc: fix memory leak in meson_spicc_probe
	crypto: shash - avoid comparing pointers to exported functions under CFI
	media: dvb_net: avoid speculation from net slot
	media: siano: fix device register error path
	media: imx-csi: Skip first few frames from a BT.656 source
	hwmon: (max31790) Report correct current pwm duty cycles
	hwmon: (max31790) Fix pwmX_enable attributes
	drivers/perf: fix the missed ida_simple_remove() in ddr_perf_probe()
	KVM: PPC: Book3S HV: Fix TLB management on SMT8 POWER9 and POWER10 processors
	btrfs: fix error handling in __btrfs_update_delayed_inode
	btrfs: abort transaction if we fail to update the delayed inode
	btrfs: sysfs: fix format string for some discard stats
	btrfs: don't clear page extent mapped if we're not invalidating the full page
	btrfs: disable build on platforms having page size 256K
	locking/lockdep: Fix the dep path printing for backwards BFS
	lockding/lockdep: Avoid to find wrong lock dep path in check_irq_usage()
	KVM: s390: get rid of register asm usage
	regulator: mt6358: Fix vdram2 .vsel_mask
	regulator: da9052: Ensure enough delay time for .set_voltage_time_sel
	media: Fix Media Controller API config checks
	ACPI: video: use native backlight for GA401/GA502/GA503
	HID: do not use down_interruptible() when unbinding devices
	EDAC/ti: Add missing MODULE_DEVICE_TABLE
	ACPI: processor idle: Fix up C-state latency if not ordered
	hv_utils: Fix passing zero to 'PTR_ERR' warning
	lib: vsprintf: Fix handling of number field widths in vsscanf
	Input: goodix - platform/x86: touchscreen_dmi - Move upside down quirks to touchscreen_dmi.c
	platform/x86: touchscreen_dmi: Add an extra entry for the upside down Goodix touchscreen on Teclast X89 tablets
	platform/x86: touchscreen_dmi: Add info for the Goodix GT912 panel of TM800A550L tablets
	ACPI: EC: Make more Asus laptops use ECDT _GPE
	block_dump: remove block_dump feature in mark_inode_dirty()
	blk-mq: grab rq->refcount before calling ->fn in blk_mq_tagset_busy_iter
	blk-mq: clear stale request in tags->rq[] before freeing one request pool
	fs: dlm: cancel work sync othercon
	random32: Fix implicit truncation warning in prandom_seed_state()
	open: don't silently ignore unknown O-flags in openat2()
	drivers: hv: Fix missing error code in vmbus_connect()
	fs: dlm: fix memory leak when fenced
	ACPICA: Fix memory leak caused by _CID repair function
	ACPI: bus: Call kobject_put() in acpi_init() error path
	ACPI: resources: Add checks for ACPI IRQ override
	block: fix race between adding/removing rq qos and normal IO
	platform/x86: asus-nb-wmi: Revert "Drop duplicate DMI quirk structures"
	platform/x86: asus-nb-wmi: Revert "add support for ASUS ROG Zephyrus G14 and G15"
	platform/x86: toshiba_acpi: Fix missing error code in toshiba_acpi_setup_keyboard()
	nvme-pci: fix var. type for increasing cq_head
	nvmet-fc: do not check for invalid target port in nvmet_fc_handle_fcp_rqst()
	EDAC/Intel: Do not load EDAC driver when running as a guest
	PCI: hv: Add check for hyperv_initialized in init_hv_pci_drv()
	cifs: improve fallocate emulation
	ACPI: EC: trust DSDT GPE for certain HP laptop
	clocksource: Retry clock read if long delays detected
	clocksource: Check per-CPU clock synchronization when marked unstable
	tpm_tis_spi: add missing SPI device ID entries
	ACPI: tables: Add custom DSDT file as makefile prerequisite
	HID: wacom: Correct base usage for capacitive ExpressKey status bits
	cifs: fix missing spinlock around update to ses->status
	mailbox: qcom: Use PLATFORM_DEVID_AUTO to register platform device
	block: fix discard request merge
	kthread_worker: fix return value when kthread_mod_delayed_work() races with kthread_cancel_delayed_work_sync()
	ia64: mca_drv: fix incorrect array size calculation
	writeback, cgroup: increment isw_nr_in_flight before grabbing an inode
	spi: Allow to have all native CSs in use along with GPIOs
	spi: Avoid undefined behaviour when counting unused native CSs
	media: venus: Rework error fail recover logic
	media: s5p_cec: decrement usage count if disabled
	media: hantro: do a PM resume earlier
	crypto: ixp4xx - dma_unmap the correct address
	crypto: ixp4xx - update IV after requests
	crypto: ux500 - Fix error return code in hash_hw_final()
	sata_highbank: fix deferred probing
	pata_rb532_cf: fix deferred probing
	media: I2C: change 'RST' to "RSET" to fix multiple build errors
	sched/uclamp: Fix wrong implementation of cpu.uclamp.min
	sched/uclamp: Fix locking around cpu_util_update_eff()
	kbuild: Fix objtool dependency for 'OBJECT_FILES_NON_STANDARD_<obj> := n'
	pata_octeon_cf: avoid WARN_ON() in ata_host_activate()
	evm: fix writing <securityfs>/evm overflow
	x86/elf: Use _BITUL() macro in UAPI headers
	crypto: sa2ul - Fix leaks on failure paths with sa_dma_init()
	crypto: sa2ul - Fix pm_runtime enable in sa_ul_probe()
	crypto: ccp - Fix a resource leak in an error handling path
	media: rc: i2c: Fix an error message
	pata_ep93xx: fix deferred probing
	locking/lockdep: Reduce LOCKDEP dependency list
	media: rkvdec: Fix .buf_prepare
	media: exynos4-is: Fix a use after free in isp_video_release
	media: au0828: fix a NULL vs IS_ERR() check
	media: tc358743: Fix error return code in tc358743_probe_of()
	media: gspca/gl860: fix zero-length control requests
	m68k: atari: Fix ATARI_KBD_CORE kconfig unmet dependency warning
	media: siano: Fix out-of-bounds warnings in smscore_load_firmware_family2()
	regulator: fan53880: Fix vsel_mask setting for FAN53880_BUCK
	crypto: nitrox - fix unchecked variable in nitrox_register_interrupts
	crypto: omap-sham - Fix PM reference leak in omap sham ops
	crypto: x86/curve25519 - fix cpu feature checking logic in mod_exit
	crypto: sm2 - remove unnecessary reset operations
	crypto: sm2 - fix a memory leak in sm2
	mmc: usdhi6rol0: fix error return code in usdhi6_probe()
	arm64: consistently use reserved_pg_dir
	arm64/mm: Fix ttbr0 values stored in struct thread_info for software-pan
	media: subdev: remove VIDIOC_DQEVENT_TIME32 handling
	media: s5p-g2d: Fix a memory leak on ctx->fh.m2m_ctx
	hwmon: (lm70) Use device_get_match_data()
	hwmon: (lm70) Revert "hwmon: (lm70) Add support for ACPI"
	hwmon: (max31722) Remove non-standard ACPI device IDs
	hwmon: (max31790) Fix fan speed reporting for fan7..12
	KVM: nVMX: Sync all PGDs on nested transition with shadow paging
	KVM: nVMX: Ensure 64-bit shift when checking VMFUNC bitmap
	KVM: nVMX: Don't clobber nested MMU's A/D status on EPTP switch
	KVM: x86/mmu: Fix return value in tdp_mmu_map_handle_target_level()
	perf/arm-cmn: Fix invalid pointer when access dtc object sharing the same IRQ number
	KVM: arm64: Don't zero the cycle count register when PMCR_EL0.P is set
	regulator: hi655x: Fix pass wrong pointer to config.driver_data
	btrfs: clear log tree recovering status if starting transaction fails
	x86/sev: Make sure IRQs are disabled while GHCB is active
	x86/sev: Split up runtime #VC handler for correct state tracking
	sched/rt: Fix RT utilization tracking during policy change
	sched/rt: Fix Deadline utilization tracking during policy change
	sched/uclamp: Fix uclamp_tg_restrict()
	lockdep: Fix wait-type for empty stack
	lockdep/selftests: Fix selftests vs PROVE_RAW_LOCK_NESTING
	spi: spi-sun6i: Fix chipselect/clock bug
	crypto: nx - Fix RCU warning in nx842_OF_upd_status
	psi: Fix race between psi_trigger_create/destroy
	media: v4l2-async: Clean v4l2_async_notifier_add_fwnode_remote_subdev
	media: video-mux: Skip dangling endpoints
	PM / devfreq: Add missing error code in devfreq_add_device()
	ACPI: PM / fan: Put fan device IDs into separate header file
	block: avoid double io accounting for flush request
	nvme-pci: look for StorageD3Enable on companion ACPI device instead
	ACPI: sysfs: Fix a buffer overrun problem with description_show()
	mark pstore-blk as broken
	clocksource/drivers/timer-ti-dm: Save and restore timer TIOCP_CFG
	extcon: extcon-max8997: Fix IRQ freeing at error path
	ACPI: APEI: fix synchronous external aborts in user-mode
	blk-wbt: introduce a new disable state to prevent false positive by rwb_enabled()
	blk-wbt: make sure throttle is enabled properly
	ACPI: Use DEVICE_ATTR_<RW|RO|WO> macros
	ACPI: bgrt: Fix CFI violation
	cpufreq: Make cpufreq_online() call driver->offline() on errors
	blk-mq: update hctx->dispatch_busy in case of real scheduler
	ocfs2: fix snprintf() checking
	dax: fix ENOMEM handling in grab_mapping_entry()
	mm/debug_vm_pgtable/basic: add validation for dirtiness after write protect
	mm/debug_vm_pgtable/basic: iterate over entire protection_map[]
	mm/debug_vm_pgtable: ensure THP availability via has_transparent_hugepage()
	swap: fix do_swap_page() race with swapoff
	mm/shmem: fix shmem_swapin() race with swapoff
	mm: memcg/slab: properly set up gfp flags for objcg pointer array
	mm: page_alloc: refactor setup_per_zone_lowmem_reserve()
	mm/page_alloc: fix counting of managed_pages
	xfrm: xfrm_state_mtu should return at least 1280 for ipv6
	drm/bridge/sii8620: fix dependency on extcon
	drm/bridge: Fix the stop condition of drm_bridge_chain_pre_enable()
	drm/amd/dc: Fix a missing check bug in dm_dp_mst_detect()
	drm/ast: Fix missing conversions to managed API
	video: fbdev: imxfb: Fix an error message
	net: mvpp2: Put fwnode in error case during ->probe()
	net: pch_gbe: Propagate error from devm_gpio_request_one()
	pinctrl: renesas: r8a7796: Add missing bias for PRESET# pin
	pinctrl: renesas: r8a77990: JTAG pins do not have pull-down capabilities
	drm/vmwgfx: Mark a surface gpu-dirty after the SVGA3dCmdDXGenMips command
	drm/vmwgfx: Fix cpu updates of coherent multisample surfaces
	net: qrtr: ns: Fix error return code in qrtr_ns_init()
	clk: meson: g12a: fix gp0 and hifi ranges
	net: ftgmac100: add missing error return code in ftgmac100_probe()
	drm: rockchip: set alpha_en to 0 if it is not used
	drm/rockchip: cdn-dp-core: add missing clk_disable_unprepare() on error in cdn_dp_grf_write()
	drm/rockchip: dsi: move all lane config except LCDC mux to bind()
	drm/rockchip: lvds: Fix an error handling path
	drm/rockchip: cdn-dp: fix sign extension on an int multiply for a u64 result
	mptcp: fix pr_debug in mptcp_token_new_connect
	mptcp: generate subflow hmac after mptcp_finish_join()
	RDMA/srp: Fix a recently introduced memory leak
	RDMA/rtrs-clt: Check state of the rtrs_clt_sess before reading its stats
	RDMA/rtrs: Do not reset hb_missed_max after re-connection
	RDMA/rtrs-srv: Fix memory leak of unfreed rtrs_srv_stats object
	RDMA/rtrs-srv: Fix memory leak when having multiple sessions
	RDMA/rtrs-clt: Check if the queue_depth has changed during a reconnection
	RDMA/rtrs-clt: Fix memory leak of not-freed sess->stats and stats->pcpu_stats
	ehea: fix error return code in ehea_restart_qps()
	clk: tegra30: Use 300MHz for video decoder by default
	xfrm: remove the fragment check for ipv6 beet mode
	net/sched: act_vlan: Fix modify to allow 0
	RDMA/core: Sanitize WQ state received from the userspace
	drm/pl111: depend on CONFIG_VEXPRESS_CONFIG
	RDMA/rxe: Fix failure during driver load
	drm/pl111: Actually fix CONFIG_VEXPRESS_CONFIG depends
	drm/vc4: hdmi: Fix error path of hpd-gpios
	clk: vc5: fix output disabling when enabling a FOD
	drm: qxl: ensure surf.data is ininitialized
	tools/bpftool: Fix error return code in do_batch()
	ath10k: go to path err_unsupported when chip id is not supported
	ath10k: add missing error return code in ath10k_pci_probe()
	wireless: carl9170: fix LEDS build errors & warnings
	ieee802154: hwsim: Fix possible memory leak in hwsim_subscribe_all_others
	clk: imx8mq: remove SYS PLL 1/2 clock gates
	wcn36xx: Move hal_buf allocation to devm_kmalloc in probe
	ssb: Fix error return code in ssb_bus_scan()
	brcmfmac: fix setting of station info chains bitmask
	brcmfmac: correctly report average RSSI in station info
	brcmfmac: Fix a double-free in brcmf_sdio_bus_reset
	brcmsmac: mac80211_if: Fix a resource leak in an error handling path
	cw1200: Revert unnecessary patches that fix unreal use-after-free bugs
	ath11k: Fix an error handling path in ath11k_core_fetch_board_data_api_n()
	ath10k: Fix an error code in ath10k_add_interface()
	ath11k: send beacon template after vdev_start/restart during csa
	netlabel: Fix memory leak in netlbl_mgmt_add_common
	RDMA/mlx5: Don't add slave port to unaffiliated list
	netfilter: nft_exthdr: check for IPv6 packet before further processing
	netfilter: nft_osf: check for TCP packet before further processing
	netfilter: nft_tproxy: restrict support to TCP and UDP transport protocols
	RDMA/rxe: Fix qp reference counting for atomic ops
	selftests/bpf: Whitelist test_progs.h from .gitignore
	xsk: Fix missing validation for skb and unaligned mode
	xsk: Fix broken Tx ring validation
	bpf: Fix libelf endian handling in resolv_btfids
	RDMA/rtrs-srv: Set minimal max_send_wr and max_recv_wr
	samples/bpf: Fix Segmentation fault for xdp_redirect command
	samples/bpf: Fix the error return code of xdp_redirect's main()
	mt76: fix possible NULL pointer dereference in mt76_tx
	mt76: mt7615: fix NULL pointer dereference in tx_prepare_skb()
	net: ethernet: aeroflex: fix UAF in greth_of_remove
	net: ethernet: ezchip: fix UAF in nps_enet_remove
	net: ethernet: ezchip: fix error handling
	vrf: do not push non-ND strict packets with a source LLA through packet taps again
	net: sched: add barrier to ensure correct ordering for lockless qdisc
	tls: prevent oversized sendfile() hangs by ignoring MSG_MORE
	netfilter: nf_tables_offload: check FLOW_DISSECTOR_KEY_BASIC in VLAN transfer logic
	pkt_sched: sch_qfq: fix qfq_change_class() error path
	xfrm: Fix xfrm offload fallback fail case
	iwlwifi: increase PNVM load timeout
	rtw88: 8822c: fix lc calibration timing
	vxlan: add missing rcu_read_lock() in neigh_reduce()
	ip6_tunnel: fix GRE6 segmentation
	net/ipv4: swap flow ports when validating source
	net: ti: am65-cpsw-nuss: Fix crash when changing number of TX queues
	tc-testing: fix list handling
	ieee802154: hwsim: Fix memory leak in hwsim_add_one
	ieee802154: hwsim: avoid possible crash in hwsim_del_edge_nl()
	bpf: Fix null ptr deref with mixed tail calls and subprogs
	drm/msm: Fix error return code in msm_drm_init()
	drm/msm/dpu: Fix error return code in dpu_mdss_init()
	mac80211: remove iwlwifi specific workaround NDPs of null_response
	net: bcmgenet: Fix attaching to PYH failed on RPi 4B
	ipv6: exthdrs: do not blindly use init_net
	can: j1939: j1939_sk_setsockopt(): prevent allocation of j1939 filter for optlen == 0
	bpf: Do not change gso_size during bpf_skb_change_proto()
	i40e: Fix error handling in i40e_vsi_open
	i40e: Fix autoneg disabling for non-10GBaseT links
	i40e: Fix missing rtnl locking when setting up pf switch
	Revert "ibmvnic: remove duplicate napi_schedule call in open function"
	ibmvnic: set ltb->buff to NULL after freeing
	ibmvnic: free tx_pool if tso_pool alloc fails
	RDMA/cma: Protect RMW with qp_mutex
	net: macsec: fix the length used to copy the key for offloading
	net: phy: mscc: fix macsec key length
	net: atlantic: fix the macsec key length
	ipv6: fix out-of-bound access in ip6_parse_tlv()
	e1000e: Check the PCIm state
	net: dsa: sja1105: fix NULL pointer dereference in sja1105_reload_cbs()
	bpfilter: Specify the log level for the kmsg message
	RDMA/cma: Fix incorrect Packet Lifetime calculation
	gve: Fix swapped vars when fetching max queues
	Revert "be2net: disable bh with spin_lock in be_process_mcc"
	Bluetooth: mgmt: Fix slab-out-of-bounds in tlv_data_is_valid
	Bluetooth: Fix not sending Set Extended Scan Response
	Bluetooth: Fix Set Extended (Scan Response) Data
	Bluetooth: Fix handling of HCI_LE_Advertising_Set_Terminated event
	clk: actions: Fix UART clock dividers on Owl S500 SoC
	clk: actions: Fix SD clocks factor table on Owl S500 SoC
	clk: actions: Fix bisp_factor_table based clocks on Owl S500 SoC
	clk: actions: Fix AHPPREDIV-H-AHB clock chain on Owl S500 SoC
	clk: qcom: clk-alpha-pll: fix CAL_L write in alpha_pll_fabia_prepare
	clk: si5341: Wait for DEVICE_READY on startup
	clk: si5341: Avoid divide errors due to bogus register contents
	clk: si5341: Check for input clock presence and PLL lock on startup
	clk: si5341: Update initialization magic
	writeback: fix obtain a reference to a freeing memcg css
	net: lwtunnel: handle MTU calculation in forwading
	net: sched: fix warning in tcindex_alloc_perfect_hash
	net: tipc: fix FB_MTU eat two pages
	RDMA/mlx5: Don't access NULL-cleared mpi pointer
	RDMA/core: Always release restrack object
	MIPS: Fix PKMAP with 32-bit MIPS huge page support
	staging: fbtft: Rectify GPIO handling
	staging: fbtft: Don't spam logs when probe is deferred
	ASoC: rt5682: Disable irq on shutdown
	rcu: Invoke rcu_spawn_core_kthreads() from rcu_spawn_gp_kthread()
	serial: fsl_lpuart: don't modify arbitrary data on lpuart32
	serial: fsl_lpuart: remove RTSCTS handling from get_mctrl()
	serial: 8250_omap: fix a timeout loop condition
	tty: nozomi: Fix a resource leak in an error handling function
	mwifiex: re-fix for unaligned accesses
	iio: adis_buffer: do not return ints in irq handlers
	iio: adis16400: do not return ints in irq handlers
	iio: adis16475: do not return ints in irq handlers
	iio: accel: bma180: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: accel: bma220: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: accel: hid: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: accel: kxcjk-1013: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: accel: mxc4005: Fix overread of data and alignment issue.
	iio: accel: stk8312: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: accel: stk8ba50: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: adc: ti-ads1015: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: adc: vf610: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: gyro: bmg160: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: humidity: am2315: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: prox: srf08: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: prox: pulsed-light: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: prox: as3935: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: magn: hmc5843: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: magn: bmc150: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: light: isl29125: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: light: tcs3414: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: light: tcs3472: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: chemical: atlas: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: cros_ec_sensors: Fix alignment of buffer in iio_push_to_buffers_with_timestamp()
	iio: potentiostat: lmp91000: Fix alignment of buffer in iio_push_to_buffers_with_timestamp()
	ASoC: rk3328: fix missing clk_disable_unprepare() on error in rk3328_platform_probe()
	ASoC: hisilicon: fix missing clk_disable_unprepare() on error in hi6210_i2s_startup()
	backlight: lm3630a_bl: Put fwnode in error case during ->probe()
	ASoC: rsnd: tidyup loop on rsnd_adg_clk_query()
	Input: hil_kbd - fix error return code in hil_dev_connect()
	perf scripting python: Fix tuple_set_u64()
	mtd: partitions: redboot: seek fis-index-block in the right node
	mtd: rawnand: arasan: Ensure proper configuration for the asserted target
	staging: mmal-vchiq: Fix incorrect static vchiq_instance.
	char: pcmcia: error out if 'num_bytes_read' is greater than 4 in set_protocol()
	firmware: stratix10-svc: Fix a resource leak in an error handling path
	tty: nozomi: Fix the error handling path of 'nozomi_card_init()'
	leds: class: The -ENOTSUPP should never be seen by user space
	leds: lm3532: select regmap I2C API
	leds: lm36274: Put fwnode in error case during ->probe()
	leds: lm3692x: Put fwnode in any case during ->probe()
	leds: lm3697: Don't spam logs when probe is deferred
	leds: lp50xx: Put fwnode in error case during ->probe()
	scsi: FlashPoint: Rename si_flags field
	scsi: iscsi: Flush block work before unblock
	mfd: mp2629: Select MFD_CORE to fix build error
	mfd: rn5t618: Fix IRQ trigger by changing it to level mode
	fsi: core: Fix return of error values on failures
	fsi: scom: Reset the FSI2PIB engine for any error
	fsi: occ: Don't accept response from un-initialized OCC
	fsi/sbefifo: Clean up correct FIFO when receiving reset request from SBE
	fsi/sbefifo: Fix reset timeout
	visorbus: fix error return code in visorchipset_init()
	iommu/amd: Fix extended features logging
	s390/irq: select HAVE_IRQ_EXIT_ON_IRQ_STACK
	s390: enable HAVE_IOREMAP_PROT
	s390: appldata depends on PROC_SYSCTL
	selftests: splice: Adjust for handler fallback removal
	iommu/dma: Fix IOVA reserve dma ranges
	ASoC: max98373-sdw: use first_hw_init flag on resume
	ASoC: rt1308-sdw: use first_hw_init flag on resume
	ASoC: rt5682-sdw: use first_hw_init flag on resume
	ASoC: rt700-sdw: use first_hw_init flag on resume
	ASoC: rt711-sdw: use first_hw_init flag on resume
	ASoC: rt715-sdw: use first_hw_init flag on resume
	ASoC: rt5682: fix getting the wrong device id when the suspend_stress_test
	ASoC: rt5682-sdw: set regcache_cache_only false before reading RT5682_DEVICE_ID
	ASoC: mediatek: mtk-btcvsd: Fix an error handling path in 'mtk_btcvsd_snd_probe()'
	usb: gadget: f_fs: Fix setting of device and driver data cross-references
	usb: dwc2: Don't reset the core after setting turnaround time
	eeprom: idt_89hpesx: Put fwnode in matching case during ->probe()
	eeprom: idt_89hpesx: Restore printing the unsupported fwnode name
	thunderbolt: Bond lanes only when dual_link_port != NULL in alloc_dev_default()
	iio: adc: at91-sama5d2: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: adc: hx711: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: adc: mxs-lradc: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: adc: ti-ads8688: Fix alignment of buffer in iio_push_to_buffers_with_timestamp()
	iio: magn: rm3100: Fix alignment of buffer in iio_push_to_buffers_with_timestamp()
	iio: light: vcnl4000: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	ASoC: fsl_spdif: Fix error handler with pm_runtime_enable
	staging: gdm724x: check for buffer overflow in gdm_lte_multi_sdu_pkt()
	staging: gdm724x: check for overflow in gdm_lte_netif_rx()
	staging: rtl8712: fix error handling in r871xu_drv_init
	staging: rtl8712: fix memory leak in rtl871x_load_fw_cb
	coresight: core: Fix use of uninitialized pointer
	staging: mt7621-dts: fix pci address for PCI memory range
	serial: 8250: Actually allow UPF_MAGIC_MULTIPLIER baud rates
	iio: light: vcnl4035: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	iio: prox: isl29501: Fix buffer alignment in iio_push_to_buffers_with_timestamp()
	ASoC: cs42l42: Correct definition of CS42L42_ADC_PDN_MASK
	of: Fix truncation of memory sizes on 32-bit platforms
	mtd: rawnand: marvell: add missing clk_disable_unprepare() on error in marvell_nfc_resume()
	habanalabs: Fix an error handling path in 'hl_pci_probe()'
	scsi: mpt3sas: Fix error return value in _scsih_expander_add()
	soundwire: stream: Fix test for DP prepare complete
	phy: uniphier-pcie: Fix updating phy parameters
	phy: ti: dm816x: Fix the error handling path in 'dm816x_usb_phy_probe()
	extcon: sm5502: Drop invalid register write in sm5502_reg_data
	extcon: max8997: Add missing modalias string
	powerpc/powernv: Fix machine check reporting of async store errors
	ASoC: atmel-i2s: Fix usage of capture and playback at the same time
	configfs: fix memleak in configfs_release_bin_file
	ASoC: Intel: sof_sdw: add SOF_RT715_DAI_ID_FIX for AlderLake
	ASoC: fsl_spdif: Fix unexpected interrupt after suspend
	leds: as3645a: Fix error return code in as3645a_parse_node()
	leds: ktd2692: Fix an error handling path
	selftests/ftrace: fix event-no-pid on 1-core machine
	serial: 8250: 8250_omap: Disable RX interrupt after DMA enable
	serial: 8250: 8250_omap: Fix possible interrupt storm on K3 SoCs
	powerpc: Offline CPU in stop_this_cpu()
	powerpc/papr_scm: Properly handle UUID types and API
	powerpc/64s: Fix copy-paste data exposure into newly created tasks
	powerpc/papr_scm: Make 'perf_stats' invisible if perf-stats unavailable
	ALSA: firewire-lib: Fix 'amdtp_domain_start()' when no AMDTP_OUT_STREAM stream is found
	serial: mvebu-uart: do not allow changing baudrate when uartclk is not available
	serial: mvebu-uart: correctly calculate minimal possible baudrate
	arm64: dts: marvell: armada-37xx: Fix reg for standard variant of UART
	vfio/pci: Handle concurrent vma faults
	mm/pmem: avoid inserting hugepage PTE entry with fsdax if hugepage support is disabled
	mm/huge_memory.c: remove dedicated macro HPAGE_CACHE_INDEX_MASK
	mm/huge_memory.c: add missing read-only THP checking in transparent_hugepage_enabled()
	mm/huge_memory.c: don't discard hugepage if other processes are mapping it
	mm/hugetlb: use helper huge_page_order and pages_per_huge_page
	mm/hugetlb: remove redundant check in preparing and destroying gigantic page
	hugetlb: remove prep_compound_huge_page cleanup
	include/linux/huge_mm.h: remove extern keyword
	mm/z3fold: fix potential memory leak in z3fold_destroy_pool()
	mm/z3fold: use release_z3fold_page_locked() to release locked z3fold page
	lib/math/rational.c: fix divide by zero
	selftests/vm/pkeys: fix alloc_random_pkey() to make it really, really random
	selftests/vm/pkeys: handle negative sys_pkey_alloc() return code
	selftests/vm/pkeys: refill shadow register after implicit kernel write
	perf llvm: Return -ENOMEM when asprintf() fails
	csky: fix syscache.c fallthrough warning
	csky: syscache: Fixup duplicate cache flush
	exfat: handle wrong stream entry size in exfat_readdir()
	scsi: fc: Correct RHBA attributes length
	scsi: target: cxgbit: Unmap DMA buffer before calling target_execute_cmd()
	mailbox: qcom-ipcc: Fix IPCC mbox channel exhaustion
	fscrypt: don't ignore minor_hash when hash is 0
	fscrypt: fix derivation of SipHash keys on big endian CPUs
	tpm: Replace WARN_ONCE() with dev_err_once() in tpm_tis_status()
	erofs: fix error return code in erofs_read_superblock()
	block: return the correct bvec when checking for gaps
	io_uring: fix blocking inline submission
	mmc: block: Disable CMDQ on the ioctl path
	mmc: vub3000: fix control-request direction
	media: exynos4-is: remove a now unused integer
	scsi: core: Retry I/O for Notify (Enable Spinup) Required error
	crypto: qce - fix error return code in qce_skcipher_async_req_handle()
	s390: preempt: Fix preempt_count initialization
	cred: add missing return error code when set_cred_ucounts() failed
	iommu/dma: Fix compile warning in 32-bit builds
	powerpc/preempt: Don't touch the idle task's preempt_count during hotplug
	Linux 5.10.50

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Iec4eab24ea8eb5a6d79739a1aec8432d93a8f82c
2021-07-14 17:35:23 +02:00
Vadim Fedorenko
4476568069 net: lwtunnel: handle MTU calculation in forwading
[ Upstream commit fade56410c ]

Commit 14972cbd34 ("net: lwtunnel: Handle fragmentation") moved
fragmentation logic away from lwtunnel by carry encap headroom and
use it in output MTU calculation. But the forwarding part was not
covered and created difference in MTU for output and forwarding and
further to silent drops on ipv4 forwarding path. Fix it by taking
into account lwtunnel encap headroom.

The same commit also introduced difference in how to treat RTAX_MTU
in IPv4 and IPv6 where latter explicitly removes lwtunnel encap
headroom from route MTU. Make IPv4 version do the same.

Fixes: 14972cbd34 ("net: lwtunnel: Handle fragmentation")
Suggested-by: David Ahern <dsahern@gmail.com>
Signed-off-by: Vadim Fedorenko <vfedorenko@novek.ru>
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-07-14 16:56:32 +02:00
Luiz Augusto von Dentz
4f5fc3be2c Bluetooth: Fix Set Extended (Scan Response) Data
[ Upstream commit c9ed0a7077 ]

These command do have variable length and the length can go up to 251,
so this changes the struct to not use a fixed size and then when
creating the PDU only the actual length of the data send to the
controller.

Fixes: a0fb3726ba ("Bluetooth: Use Set ext adv/scan rsp data if controller supports")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-07-14 16:56:30 +02:00
Antoine Tenart
711a28d24d net: macsec: fix the length used to copy the key for offloading
[ Upstream commit 1f7fe51211 ]

The key length used when offloading macsec to Ethernet or PHY drivers
was set to MACSEC_KEYID_LEN (16), which is an issue as:
- This was never meant to be the key length.
- The key length can be > 16.

Fix this by using MACSEC_MAX_KEY_LEN to store the key (the max length
accepted in uAPI) and secy->key_len to copy it.

Fixes: 3cf3227a21 ("net: macsec: hardware offloading infrastructure")
Reported-by: Lior Nahmanson <liorna@nvidia.com>
Signed-off-by: Antoine Tenart <atenart@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-07-14 16:56:28 +02:00
Yunsheng Lin
e7c3ae4797 net: sched: add barrier to ensure correct ordering for lockless qdisc
[ Upstream commit 89837eb4b2 ]

The spin_trylock() was assumed to contain the implicit
barrier needed to ensure the correct ordering between
STATE_MISSED setting/clearing and STATE_MISSED checking
in commit a90c57f2ce ("net: sched: fix packet stuck
problem for lockless qdisc").

But it turns out that spin_trylock() only has load-acquire
semantic, for strongly-ordered system(like x86), the compiler
barrier implicitly contained in spin_trylock() seems enough
to ensure the correct ordering. But for weakly-orderly system
(like arm64), the store-release semantic is needed to ensure
the correct ordering as clear_bit() and test_bit() is store
operation, see queued_spin_lock().

So add the explicit barrier to ensure the correct ordering
for the above case.

Fixes: a90c57f2ce ("net: sched: fix packet stuck problem for lockless qdisc")
Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
Acked-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-07-14 16:56:24 +02:00
Magnus Karlsson
cd7877a39f xsk: Fix missing validation for skb and unaligned mode
[ Upstream commit 2f99619820 ]

Fix a missing validation of a Tx descriptor when executing in skb mode
and the umem is in unaligned mode. A descriptor could point to a
buffer straddling the end of the umem, thus effectively tricking the
kernel to read outside the allowed umem region. This could lead to a
kernel crash if that part of memory is not mapped.

In zero-copy mode, the descriptor validation code rejects such
descriptors by checking a bit in the DMA address that tells us if the
next page is physically contiguous or not. For the last page in the
umem, this bit is not set, therefore any descriptor pointing to a
packet straddling this last page boundary will be rejected. However,
the skb path does not use this bit since it copies out data and can do
so to two different pages. (It also does not have the array of DMA
address, so it cannot even store this bit.) The code just returned
that the packet is always physically contiguous. But this is
unfortunately also returned for the last page in the umem, which means
that packets that cross the end of the umem are being allowed, which
they should not be.

Fix this by introducing a check for this in the SKB path only, not
penalizing the zero-copy path.

Fixes: 2b43470add ("xsk: Introduce AF_XDP buffer allocation API")
Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Björn Töpel <bjorn@kernel.org>
Link: https://lore.kernel.org/bpf/20210617092255.3487-1-magnus.karlsson@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-07-14 16:56:23 +02:00
Boris Sukholitko
c470dd34c6 net/sched: act_vlan: Fix modify to allow 0
[ Upstream commit 9c5eee0afc ]

Currently vlan modification action checks existence of vlan priority by
comparing it to 0. Therefore it is impossible to modify existing vlan
tag to have priority 0.

For example, the following tc command will change the vlan id but will
not affect vlan priority:

tc filter add dev eth1 ingress matchall action vlan modify id 300 \
        priority 0 pipe mirred egress redirect dev eth2

The incoming packet on eth1:

ethertype 802.1Q (0x8100), vlan 200, p 4, ethertype IPv4

will be changed to:

ethertype 802.1Q (0x8100), vlan 300, p 4, ethertype IPv4

although the user has intended to have p == 0.

The fix is to add tcfv_push_prio_exists flag to struct tcf_vlan_params
and rely on it when deciding to set the priority.

Fixes: 45a497f2d1 (net/sched: act_vlan: Introduce TCA_VLAN_ACT_MODIFY vlan action)
Signed-off-by: Boris Sukholitko <boris.sukholitko@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-07-14 16:56:19 +02:00
Sabrina Dubroca
1de9425286 xfrm: xfrm_state_mtu should return at least 1280 for ipv6
[ Upstream commit b515d26372 ]

Jianwen reported that IPv6 Interoperability tests are failing in an
IPsec case where one of the links between the IPsec peers has an MTU
of 1280. The peer generates a packet larger than this MTU, the router
replies with a "Packet too big" message indicating an MTU of 1280.
When the peer tries to send another large packet, xfrm_state_mtu
returns 1280 - ipsec_overhead, which causes ip6_setup_cork to fail
with EINVAL.

We can fix this by forcing xfrm_state_mtu to return IPV6_MIN_MTU when
IPv6 is used. After going through IPsec, the packet will then be
fragmented to obey the actual network's PMTU, just before leaving the
host.

Currently, TFC padding is capped to PMTU - overhead to avoid
fragementation: after padding and encapsulation, we still fit within
the PMTU. That behavior is preserved in this patch.

Fixes: 91657eafb6 ("xfrm: take net hdr len into account for esp payload size calculation")
Reported-by: Jianwen Ji <jiji@redhat.com>
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-07-14 16:56:14 +02:00
Greg Kroah-Hartman
194be71cc6 Linux 5.10.47
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE4n5dijQDou9mhzu83qZv95d3LNwFAmDcbDgACgkQ3qZv95d3
 LNwUuQ//VDlmBPk/3w1FYvg9N9q/t1GHkVJXmD8TY/ClLdJtgxPYeoRu1VNLR/xf
 Y2kwZEF07yMA88RME56Zwt3p+LBbacrp5MoNdzEA48kb7auGBPk1HIscBg2PXC+C
 AnlC/O4/NAW6Okb+lLFL7XFM4xrlDBkNr5yTz2HmQSQC3JFfov0FcrON3KKTL5Bi
 aeyWjhn1NnhkKCDaKUl7kKlCQ2x7buu/YmvJK2OdGmuLZVywzto76RS+Xx3X0CnK
 pPkmciZSS7Gxi6UJel/zza0UwlKg5+IhFzfYVt0nsTFMjk/4QStAoevu7TFnbVD3
 yM7nzJpAQmVLs/X9sC0rgg9rCBUyp9d4ddba8bCUqaxpPQfMObWI8S5F8tfzBnK/
 h8P5xfs8u4O1AzpRr+YSN2Hbvak47e/4c5UOvvYj6z8NaIEb7DGbaUv/JE5YRVZ0
 ZEVZ1auEpHcSVAGz6DUwuwzc8Rk0NdskES5DD53QxNLXDoF1CVdsD44xUuJH1/HA
 //3S1SWxvwF9UQ+w+sk/Z6pzUj+CdFigou3QzwB+vAZ04n0JawRSuqyijkCqFOP5
 88iCMgxZ5qAYJ1TzQ6gV7cA0tSbteBF/HERNmdadyGvse9KtxkaBAfFmvIpd9D8J
 fTepYVuneP9cGqaGDUtsqHzM5YLrIkCSxABjgIvpNTt0eJL5c2k=
 =TKhf
 -----END PGP SIGNATURE-----

Merge 5.10.47 into android12-5.10-lts

Changes in 5.10.47
	module: limit enabling module.sig_enforce
	Revert "drm/amdgpu/gfx9: fix the doorbell missing when in CGPG issue."
	Revert "drm/amdgpu/gfx10: enlarge CP_MEC_DOORBELL_RANGE_UPPER to cover full doorbell."
	drm: add a locked version of drm_is_current_master
	drm/nouveau: wait for moving fence after pinning v2
	drm/radeon: wait for moving fence after pinning
	drm/amdgpu: wait for moving fence after pinning
	ARM: 9081/1: fix gcc-10 thumb2-kernel regression
	mmc: meson-gx: use memcpy_to/fromio for dram-access-quirk
	MIPS: generic: Update node names to avoid unit addresses
	arm64: Ignore any DMA offsets in the max_zone_phys() calculation
	arm64: Force NO_BLOCK_MAPPINGS if crashkernel reservation is required
	spi: spi-nxp-fspi: move the register operation after the clock enable
	Revert "PCI: PM: Do not read power state in pci_enable_device_flags()"
	drm/vc4: hdmi: Move the HSM clock enable to runtime_pm
	drm/vc4: hdmi: Make sure the controller is powered in detect
	x86/entry: Fix noinstr fail in __do_fast_syscall_32()
	x86/xen: Fix noinstr fail in exc_xen_unknown_trap()
	locking/lockdep: Improve noinstr vs errors
	perf/x86/lbr: Remove cpuc->lbr_xsave allocation from atomic context
	perf/x86/intel/lbr: Zero the xstate buffer on allocation
	dmaengine: zynqmp_dma: Fix PM reference leak in zynqmp_dma_alloc_chan_resourc()
	dmaengine: stm32-mdma: fix PM reference leak in stm32_mdma_alloc_chan_resourc()
	dmaengine: xilinx: dpdma: Add missing dependencies to Kconfig
	dmaengine: xilinx: dpdma: Limit descriptor IDs to 16 bits
	mac80211: remove warning in ieee80211_get_sband()
	mac80211_hwsim: drop pending frames on stop
	cfg80211: call cfg80211_leave_ocb when switching away from OCB
	dmaengine: rcar-dmac: Fix PM reference leak in rcar_dmac_probe()
	dmaengine: mediatek: free the proper desc in desc_free handler
	dmaengine: mediatek: do not issue a new desc if one is still current
	dmaengine: mediatek: use GFP_NOWAIT instead of GFP_ATOMIC in prep_dma
	net: ipv4: Remove unneed BUG() function
	mac80211: drop multicast fragments
	net: ethtool: clear heap allocations for ethtool function
	inet: annotate data race in inet_send_prepare() and inet_dgram_connect()
	ping: Check return value of function 'ping_queue_rcv_skb'
	net: annotate data race in sock_error()
	inet: annotate date races around sk->sk_txhash
	net/packet: annotate data race in packet_sendmsg()
	net: phy: dp83867: perform soft reset and retain established link
	riscv32: Use medany C model for modules
	net: caif: fix memory leak in ldisc_open
	net/packet: annotate accesses to po->bind
	net/packet: annotate accesses to po->ifindex
	r8152: Avoid memcpy() over-reading of ETH_SS_STATS
	sh_eth: Avoid memcpy() over-reading of ETH_SS_STATS
	r8169: Avoid memcpy() over-reading of ETH_SS_STATS
	KVM: selftests: Fix kvm_check_cap() assertion
	net: qed: Fix memcpy() overflow of qed_dcbx_params()
	mac80211: reset profile_periodicity/ema_ap
	mac80211: handle various extensible elements correctly
	recordmcount: Correct st_shndx handling
	PCI: Add AMD RS690 quirk to enable 64-bit DMA
	net: ll_temac: Add memory-barriers for TX BD access
	net: ll_temac: Avoid ndo_start_xmit returning NETDEV_TX_BUSY
	perf/x86: Track pmu in per-CPU cpu_hw_events
	pinctrl: stm32: fix the reported number of GPIO lines per bank
	i2c: i801: Ensure that SMBHSTSTS_INUSE_STS is cleared when leaving i801_access
	gpiolib: cdev: zero padding during conversion to gpioline_info_changed
	scsi: sd: Call sd_revalidate_disk() for ioctl(BLKRRPART)
	nilfs2: fix memory leak in nilfs_sysfs_delete_device_group
	s390/stack: fix possible register corruption with stack switch helper
	KVM: do not allow mapping valid but non-reference-counted pages
	i2c: robotfuzz-osif: fix control-request directions
	ceph: must hold snap_rwsem when filling inode for async create
	kthread_worker: split code for canceling the delayed work timer
	kthread: prevent deadlock when kthread_mod_delayed_work() races with kthread_cancel_delayed_work_sync()
	x86/fpu: Preserve supervisor states in sanitize_restored_user_xstate()
	x86/fpu: Make init_fpstate correct with optimized XSAVE
	mm: add VM_WARN_ON_ONCE_PAGE() macro
	mm/rmap: remove unneeded semicolon in page_not_mapped()
	mm/rmap: use page_not_mapped in try_to_unmap()
	mm, thp: use head page in __migration_entry_wait()
	mm/thp: fix __split_huge_pmd_locked() on shmem migration entry
	mm/thp: make is_huge_zero_pmd() safe and quicker
	mm/thp: try_to_unmap() use TTU_SYNC for safe splitting
	mm/thp: fix vma_address() if virtual address below file offset
	mm/thp: fix page_address_in_vma() on file THP tails
	mm/thp: unmap_mapping_page() to fix THP truncate_cleanup_page()
	mm: thp: replace DEBUG_VM BUG with VM_WARN when unmap fails for split
	mm: page_vma_mapped_walk(): use page for pvmw->page
	mm: page_vma_mapped_walk(): settle PageHuge on entry
	mm: page_vma_mapped_walk(): use pmde for *pvmw->pmd
	mm: page_vma_mapped_walk(): prettify PVMW_MIGRATION block
	mm: page_vma_mapped_walk(): crossing page table boundary
	mm: page_vma_mapped_walk(): add a level of indentation
	mm: page_vma_mapped_walk(): use goto instead of while (1)
	mm: page_vma_mapped_walk(): get vma_address_end() earlier
	mm/thp: fix page_vma_mapped_walk() if THP mapped by ptes
	mm/thp: another PVMW_SYNC fix in page_vma_mapped_walk()
	mm, futex: fix shared futex pgoff on shmem huge page
	KVM: SVM: Call SEV Guest Decommission if ASID binding fails
	swiotlb: manipulate orig_addr when tlb_addr has offset
	netfs: fix test for whether we can skip read when writing beyond EOF
	Revert "drm: add a locked version of drm_is_current_master"
	certs: Add EFI_CERT_X509_GUID support for dbx entries
	certs: Move load_system_certificate_list to a common function
	certs: Add ability to preload revocation certs
	integrity: Load mokx variables into the blacklist keyring
	Linux 5.10.47

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I68f731ad78a5db003c41093e4faf59f6f9f2e446
2021-06-30 19:38:46 +02:00
Eric Dumazet
9707960ecf inet: annotate date races around sk->sk_txhash
[ Upstream commit b71eaed8c0 ]

UDP sendmsg() path can be lockless, it is possible for another
thread to re-connect an change sk->sk_txhash under us.

There is no serious impact, but we can use READ_ONCE()/WRITE_ONCE()
pair to document the race.

BUG: KCSAN: data-race in __ip4_datagram_connect / skb_set_owner_w

write to 0xffff88813397920c of 4 bytes by task 30997 on cpu 1:
 sk_set_txhash include/net/sock.h:1937 [inline]
 __ip4_datagram_connect+0x69e/0x710 net/ipv4/datagram.c:75
 __ip6_datagram_connect+0x551/0x840 net/ipv6/datagram.c:189
 ip6_datagram_connect+0x2a/0x40 net/ipv6/datagram.c:272
 inet_dgram_connect+0xfd/0x180 net/ipv4/af_inet.c:580
 __sys_connect_file net/socket.c:1837 [inline]
 __sys_connect+0x245/0x280 net/socket.c:1854
 __do_sys_connect net/socket.c:1864 [inline]
 __se_sys_connect net/socket.c:1861 [inline]
 __x64_sys_connect+0x3d/0x50 net/socket.c:1861
 do_syscall_64+0x4a/0x90 arch/x86/entry/common.c:47
 entry_SYSCALL_64_after_hwframe+0x44/0xae

read to 0xffff88813397920c of 4 bytes by task 31039 on cpu 0:
 skb_set_hash_from_sk include/net/sock.h:2211 [inline]
 skb_set_owner_w+0x118/0x220 net/core/sock.c:2101
 sock_alloc_send_pskb+0x452/0x4e0 net/core/sock.c:2359
 sock_alloc_send_skb+0x2d/0x40 net/core/sock.c:2373
 __ip6_append_data+0x1743/0x21a0 net/ipv6/ip6_output.c:1621
 ip6_make_skb+0x258/0x420 net/ipv6/ip6_output.c:1983
 udpv6_sendmsg+0x160a/0x16b0 net/ipv6/udp.c:1527
 inet6_sendmsg+0x5f/0x80 net/ipv6/af_inet6.c:642
 sock_sendmsg_nosec net/socket.c:654 [inline]
 sock_sendmsg net/socket.c:674 [inline]
 ____sys_sendmsg+0x360/0x4d0 net/socket.c:2350
 ___sys_sendmsg net/socket.c:2404 [inline]
 __sys_sendmmsg+0x315/0x4b0 net/socket.c:2490
 __do_sys_sendmmsg net/socket.c:2519 [inline]
 __se_sys_sendmmsg net/socket.c:2516 [inline]
 __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2516
 do_syscall_64+0x4a/0x90 arch/x86/entry/common.c:47
 entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0xbca3c43d -> 0xfdb309e0

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 31039 Comm: syz-executor.2 Not tainted 5.13.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-06-30 08:47:21 -04:00
Eric Dumazet
7293f63b7b net: annotate data race in sock_error()
[ Upstream commit f13ef10059 ]

sock_error() is known to be racy. The code avoids
an atomic operation is sk_err is zero, and this field
could be changed under us, this is fine.

Sysbot reported:

BUG: KCSAN: data-race in sock_alloc_send_pskb / unix_release_sock

write to 0xffff888131855630 of 4 bytes by task 9365 on cpu 1:
 unix_release_sock+0x2e9/0x6e0 net/unix/af_unix.c:550
 unix_release+0x2f/0x50 net/unix/af_unix.c:859
 __sock_release net/socket.c:599 [inline]
 sock_close+0x6c/0x150 net/socket.c:1258
 __fput+0x25b/0x4e0 fs/file_table.c:280
 ____fput+0x11/0x20 fs/file_table.c:313
 task_work_run+0xae/0x130 kernel/task_work.c:164
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:174 [inline]
 exit_to_user_mode_prepare+0x156/0x190 kernel/entry/common.c:208
 __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline]
 syscall_exit_to_user_mode+0x20/0x40 kernel/entry/common.c:301
 do_syscall_64+0x56/0x90 arch/x86/entry/common.c:57
 entry_SYSCALL_64_after_hwframe+0x44/0xae

read to 0xffff888131855630 of 4 bytes by task 9385 on cpu 0:
 sock_error include/net/sock.h:2269 [inline]
 sock_alloc_send_pskb+0xe4/0x4e0 net/core/sock.c:2336
 unix_dgram_sendmsg+0x478/0x1610 net/unix/af_unix.c:1671
 unix_seqpacket_sendmsg+0xc2/0x100 net/unix/af_unix.c:2055
 sock_sendmsg_nosec net/socket.c:654 [inline]
 sock_sendmsg net/socket.c:674 [inline]
 ____sys_sendmsg+0x360/0x4d0 net/socket.c:2350
 __sys_sendmsg_sock+0x25/0x30 net/socket.c:2416
 io_sendmsg fs/io_uring.c:4367 [inline]
 io_issue_sqe+0x231a/0x6750 fs/io_uring.c:6135
 __io_queue_sqe+0xe9/0x360 fs/io_uring.c:6414
 __io_req_task_submit fs/io_uring.c:2039 [inline]
 io_async_task_func+0x312/0x590 fs/io_uring.c:5074
 __tctx_task_work fs/io_uring.c:1910 [inline]
 tctx_task_work+0x1d4/0x3d0 fs/io_uring.c:1924
 task_work_run+0xae/0x130 kernel/task_work.c:164
 tracehook_notify_signal include/linux/tracehook.h:212 [inline]
 handle_signal_work kernel/entry/common.c:145 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
 exit_to_user_mode_prepare+0xf8/0x190 kernel/entry/common.c:208
 __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline]
 syscall_exit_to_user_mode+0x20/0x40 kernel/entry/common.c:301
 do_syscall_64+0x56/0x90 arch/x86/entry/common.c:57
 entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0x00000000 -> 0x00000068

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 9385 Comm: syz-executor.3 Not tainted 5.13.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-06-30 08:47:21 -04:00
Greg Kroah-Hartman
948d38f94d This is the 5.10.46 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmDTLFUACgkQONu9yGCS
 aT5eThAApQAh1A++P729NJOTeoewU5YH0/1c+ZVN4nfxxEOApeBpfA4tTDvfHJeI
 MYx10AI1UiLPHfLtHI5exvG00/Ll4lb0fs2bpVL2b/SQKCm2G3kZf7xOdJOBtoy4
 DEaTORhmZ001weapZN+G4oz+FEnNZEyR/rThqKTA0G/PS1MxNl4ZBhY9BrySpH1V
 Cq7OFX18IbTh3/XXmcPotZa2sXE6Z+jjWQb5GLZ+ZjicbzgLiWWcnrm8bzLahVC4
 N7TToeGv9zOLKgrE+HVR52UoFB1+2vRUEaRVOiFbDViLjoF5KWw5rAzioTCvfXW+
 g/ldoAuDQBNGUrYfVUrSNwj5JuWCI2Cltt//9f/xGfPPn0HNjAxSM7ExpnMNVhVK
 1gjTco+0kWzv2BGjgpNAe7+aLka5sQkLEOYlSExI6VVuF5CCcIywWjWZ6zHG0CF1
 7kW8CfINV4BFP+IYw5Gnt5K3hUTulDt+alX9WgsdPxpsZ9gbIscO1/awnRrAyDyO
 2EeCbZ3WWSuvFL6qAjJERiDbhDPRaZV0cwGPxzLZ7NN8ZPXLxTVv7Nc6QoiNXYkk
 E+LYcMua9dxFXjoHA0imKxlxqJD64mh3oUkdpTGOwIxrE5bavnKGrO2B3Nl7zWVn
 u8mazeKHWpJ+t+dDZ47CjrNTul0SOvryKmog//DCkvAIYSjRzVc=
 =WRWw
 -----END PGP SIGNATURE-----

Merge 5.10.46 into android12-5.10-lts

Changes in 5.10.46
	dmaengine: idxd: add missing dsa driver unregister
	dmaengine: fsl-dpaa2-qdma: Fix error return code in two functions
	dmaengine: xilinx: dpdma: initialize registers before request_irq
	dmaengine: ALTERA_MSGDMA depends on HAS_IOMEM
	dmaengine: QCOM_HIDMA_MGMT depends on HAS_IOMEM
	dmaengine: SF_PDMA depends on HAS_IOMEM
	dmaengine: stedma40: add missing iounmap() on error in d40_probe()
	afs: Fix an IS_ERR() vs NULL check
	mm/memory-failure: make sure wait for page writeback in memory_failure
	kvm: LAPIC: Restore guard to prevent illegal APIC register access
	fanotify: fix copy_event_to_user() fid error clean up
	batman-adv: Avoid WARN_ON timing related checks
	mac80211: fix skb length check in ieee80211_scan_rx()
	mlxsw: reg: Spectrum-3: Enforce lowest max-shaper burst size of 11
	mlxsw: core: Set thermal zone polling delay argument to real value at init
	libbpf: Fixes incorrect rx_ring_setup_done
	net: ipv4: fix memory leak in netlbl_cipsov4_add_std
	vrf: fix maximum MTU
	net: rds: fix memory leak in rds_recvmsg
	net: dsa: felix: re-enable TX flow control in ocelot_port_flush()
	net: lantiq: disable interrupt before sheduling NAPI
	netfilter: nft_fib_ipv6: skip ipv6 packets from any to link-local
	ice: add ndo_bpf callback for safe mode netdev ops
	ice: parameterize functions responsible for Tx ring management
	udp: fix race between close() and udp_abort()
	rtnetlink: Fix regression in bridge VLAN configuration
	net/sched: act_ct: handle DNAT tuple collision
	net/mlx5e: Remove dependency in IPsec initialization flows
	net/mlx5e: Fix page reclaim for dead peer hairpin
	net/mlx5: Consider RoCE cap before init RDMA resources
	net/mlx5: DR, Allow SW steering for sw_owner_v2 devices
	net/mlx5: DR, Don't use SW steering when RoCE is not supported
	net/mlx5e: Block offload of outer header csum for UDP tunnels
	netfilter: synproxy: Fix out of bounds when parsing TCP options
	mptcp: Fix out of bounds when parsing TCP options
	sch_cake: Fix out of bounds when parsing TCP options and header
	mptcp: try harder to borrow memory from subflow under pressure
	mptcp: do not warn on bad input from the network
	selftests: mptcp: enable syncookie only in absence of reorders
	alx: Fix an error handling path in 'alx_probe()'
	cxgb4: fix endianness when flashing boot image
	cxgb4: fix sleep in atomic when flashing PHY firmware
	cxgb4: halt chip before flashing PHY firmware image
	net: stmmac: dwmac1000: Fix extended MAC address registers definition
	net: make get_net_ns return error if NET_NS is disabled
	net: qualcomm: rmnet: Update rmnet device MTU based on real device
	net: qualcomm: rmnet: don't over-count statistics
	ethtool: strset: fix message length calculation
	qlcnic: Fix an error handling path in 'qlcnic_probe()'
	netxen_nic: Fix an error handling path in 'netxen_nic_probe()'
	cxgb4: fix wrong ethtool n-tuple rule lookup
	ipv4: Fix device used for dst_alloc with local routes
	net: qrtr: fix OOB Read in qrtr_endpoint_post
	bpf: Fix leakage under speculation on mispredicted branches
	ptp: improve max_adj check against unreasonable values
	net: cdc_ncm: switch to eth%d interface naming
	lantiq: net: fix duplicated skb in rx descriptor ring
	net: usb: fix possible use-after-free in smsc75xx_bind
	net: fec_ptp: fix issue caused by refactor the fec_devtype
	net: ipv4: fix memory leak in ip_mc_add1_src
	net/af_unix: fix a data-race in unix_dgram_sendmsg / unix_release_sock
	net/mlx5: E-Switch, Read PF mac address
	net/mlx5: E-Switch, Allow setting GUID for host PF vport
	net/mlx5: Reset mkey index on creation
	be2net: Fix an error handling path in 'be_probe()'
	net: hamradio: fix memory leak in mkiss_close
	net: cdc_eem: fix tx fixup skb leak
	cxgb4: fix wrong shift.
	bnxt_en: Rediscover PHY capabilities after firmware reset
	bnxt_en: Fix TQM fastpath ring backing store computation
	bnxt_en: Call bnxt_ethtool_free() in bnxt_init_one() error path
	icmp: don't send out ICMP messages with a source address of 0.0.0.0
	net: ethernet: fix potential use-after-free in ec_bhf_remove
	regulator: cros-ec: Fix error code in dev_err message
	regulator: bd70528: Fix off-by-one for buck123 .n_voltages setting
	platform/x86: thinkpad_acpi: Add X1 Carbon Gen 9 second fan support
	ASoC: rt5659: Fix the lost powers for the HDA header
	phy: phy-mtk-tphy: Fix some resource leaks in mtk_phy_init()
	ASoC: fsl-asoc-card: Set .owner attribute when registering card.
	regulator: rtmv20: Fix to make regcache value first reading back from HW
	spi: spi-zynq-qspi: Fix some wrong goto jumps & missing error code
	sched/pelt: Ensure that *_sum is always synced with *_avg
	ASoC: tas2562: Fix TDM_CFG0_SAMPRATE values
	spi: stm32-qspi: Always wait BUSY bit to be cleared in stm32_qspi_wait_cmd()
	regulator: rt4801: Fix NULL pointer dereference if priv->enable_gpios is NULL
	ASoC: rt5682: Fix the fast discharge for headset unplugging in soundwire mode
	pinctrl: ralink: rt2880: avoid to error in calls is pin is already enabled
	drm/sun4i: dw-hdmi: Make HDMI PHY into a platform device
	ASoC: qcom: lpass-cpu: Fix pop noise during audio capture begin
	radeon: use memcpy_to/fromio for UVD fw upload
	hwmon: (scpi-hwmon) shows the negative temperature properly
	mm: relocate 'write_protect_seq' in struct mm_struct
	irqchip/gic-v3: Workaround inconsistent PMR setting on NMI entry
	bpf: Inherit expanded/patched seen count from old aux data
	bpf: Do not mark insn as seen under speculative path verification
	can: bcm: fix infoleak in struct bcm_msg_head
	can: bcm/raw/isotp: use per module netdevice notifier
	can: j1939: fix Use-after-Free, hold skb ref while in use
	can: mcba_usb: fix memory leak in mcba_usb
	usb: core: hub: Disable autosuspend for Cypress CY7C65632
	usb: chipidea: imx: Fix Battery Charger 1.2 CDP detection
	tracing: Do not stop recording cmdlines when tracing is off
	tracing: Do not stop recording comms if the trace file is being read
	tracing: Do no increment trace_clock_global() by one
	PCI: Mark TI C667X to avoid bus reset
	PCI: Mark some NVIDIA GPUs to avoid bus reset
	PCI: aardvark: Fix kernel panic during PIO transfer
	PCI: Add ACS quirk for Broadcom BCM57414 NIC
	PCI: Work around Huawei Intelligent NIC VF FLR erratum
	KVM: x86: Immediately reset the MMU context when the SMM flag is cleared
	KVM: x86/mmu: Calculate and check "full" mmu_role for nested MMU
	KVM: X86: Fix x86_emulator slab cache leak
	s390/mcck: fix calculation of SIE critical section size
	s390/ap: Fix hanging ioctl caused by wrong msg counter
	ARCv2: save ABI registers across signal handling
	x86/mm: Avoid truncating memblocks for SGX memory
	x86/process: Check PF_KTHREAD and not current->mm for kernel threads
	x86/ioremap: Map EFI-reserved memory as encrypted for SEV
	x86/pkru: Write hardware init value to PKRU when xstate is init
	x86/fpu: Prevent state corruption in __fpu__restore_sig()
	x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
	x86/fpu: Reset state for all signal restore failures
	crash_core, vmcoreinfo: append 'SECTION_SIZE_BITS' to vmcoreinfo
	dmaengine: pl330: fix wrong usage of spinlock flags in dma_cyclc
	mac80211: Fix NULL ptr deref for injected rate info
	cfg80211: make certificate generation more robust
	cfg80211: avoid double free of PMSR request
	drm/amdgpu/gfx10: enlarge CP_MEC_DOORBELL_RANGE_UPPER to cover full doorbell.
	drm/amdgpu/gfx9: fix the doorbell missing when in CGPG issue.
	net: ll_temac: Make sure to free skb when it is completely used
	net: ll_temac: Fix TX BD buffer overwrite
	net: bridge: fix vlan tunnel dst null pointer dereference
	net: bridge: fix vlan tunnel dst refcnt when egressing
	mm/swap: fix pte_same_as_swp() not removing uffd-wp bit when compare
	mm/slub: clarify verification reporting
	mm/slub: fix redzoning for small allocations
	mm/slub: actually fix freelist pointer vs redzoning
	mm/slub.c: include swab.h
	net: stmmac: disable clocks in stmmac_remove_config_dt()
	net: fec_ptp: add clock rate zero check
	tools headers UAPI: Sync linux/in.h copy with the kernel sources
	perf beauty: Update copy of linux/socket.h with the kernel sources
	usb: dwc3: debugfs: Add and remove endpoint dirs dynamically
	usb: dwc3: core: fix kernel panic when do reboot
	Linux 5.10.46

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I99f37c9f257f90ccdb091306f3d4cfb7c32e3880
2021-06-23 17:53:08 +02:00
Mathy Vanhoef
f74df6e086 mac80211: Fix NULL ptr deref for injected rate info
commit bddc0c411a upstream.

The commit cb17ed29a7 ("mac80211: parse radiotap header when selecting Tx
queue") moved the code to validate the radiotap header from
ieee80211_monitor_start_xmit to ieee80211_parse_tx_radiotap. This made is
possible to share more code with the new Tx queue selection code for
injected frames. But at the same time, it now required the call of
ieee80211_parse_tx_radiotap at the beginning of functions which wanted to
handle the radiotap header. And this broke the rate parser for radiotap
header parser.

The radiotap parser for rates is operating most of the time only on the
data in the actual radiotap header. But for the 802.11a/b/g rates, it must
also know the selected band from the chandef information. But this
information is only written to the ieee80211_tx_info at the end of the
ieee80211_monitor_start_xmit - long after ieee80211_parse_tx_radiotap was
already called. The info->band information was therefore always 0
(NL80211_BAND_2GHZ) when the parser code tried to access it.

For a 5GHz only device, injecting a frame with 802.11a rates would cause a
NULL pointer dereference because local->hw.wiphy->bands[NL80211_BAND_2GHZ]
would most likely have been NULL when the radiotap parser searched for the
correct rate index of the driver.

Cc: stable@vger.kernel.org
Reported-by: Ben Greear <greearb@candelatech.com>
Fixes: cb17ed29a7 ("mac80211: parse radiotap header when selecting Tx queue")
Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@kuleuven.be>
[sven@narfation.org: added commit message]
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Link: https://lore.kernel.org/r/20210530133226.40587-1-sven@narfation.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-06-23 14:42:52 +02:00
Changbin Du
4abfd597fe net: make get_net_ns return error if NET_NS is disabled
[ Upstream commit ea6932d70e ]

There is a panic in socket ioctl cmd SIOCGSKNS when NET_NS is not enabled.
The reason is that nsfs tries to access ns->ops but the proc_ns_operations
is not implemented in this case.

[7.670023] Unable to handle kernel NULL pointer dereference at virtual address 00000010
[7.670268] pgd = 32b54000
[7.670544] [00000010] *pgd=00000000
[7.671861] Internal error: Oops: 5 [#1] SMP ARM
[7.672315] Modules linked in:
[7.672918] CPU: 0 PID: 1 Comm: systemd Not tainted 5.13.0-rc3-00375-g6799d4f2da49 #16
[7.673309] Hardware name: Generic DT based system
[7.673642] PC is at nsfs_evict+0x24/0x30
[7.674486] LR is at clear_inode+0x20/0x9c

The same to tun SIOCGSKNS command.

To fix this problem, we make get_net_ns() return -EINVAL when NET_NS is
disabled. Meanwhile move it to right place net/core/net_namespace.c.

Signed-off-by: Changbin Du <changbin.du@gmail.com>
Fixes: c62cce2cae ("net: add an ioctl to get a socket network namespace")
Cc: Cong Wang <xiyou.wangcong@gmail.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: David Laight <David.Laight@ACULAB.COM>
Cc: Christian Brauner <christian.brauner@ubuntu.com>
Suggested-by: Jakub Kicinski <kuba@kernel.org>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-06-23 14:42:44 +02:00
Greg Kroah-Hartman
9e08e97ec6 Merge 5.10.43 into android12-5.10
Changes in 5.10.43
	btrfs: tree-checker: do not error out if extent ref hash doesn't match
	net: usb: cdc_ncm: don't spew notifications
	hwmon: (dell-smm-hwmon) Fix index values
	hwmon: (pmbus/isl68137) remove READ_TEMPERATURE_3 for RAA228228
	netfilter: conntrack: unregister ipv4 sockopts on error unwind
	efi/fdt: fix panic when no valid fdt found
	efi: Allow EFI_MEMORY_XP and EFI_MEMORY_RO both to be cleared
	efi/libstub: prevent read overflow in find_file_option()
	efi: cper: fix snprintf() use in cper_dimm_err_location()
	vfio/pci: Fix error return code in vfio_ecap_init()
	vfio/pci: zap_vma_ptes() needs MMU
	samples: vfio-mdev: fix error handing in mdpy_fb_probe()
	vfio/platform: fix module_put call in error flow
	ipvs: ignore IP_VS_SVC_F_HASHED flag when adding service
	HID: logitech-hidpp: initialize level variable
	HID: pidff: fix error return code in hid_pidff_init()
	HID: i2c-hid: fix format string mismatch
	devlink: Correct VIRTUAL port to not have phys_port attributes
	net/sched: act_ct: Offload connections with commit action
	net/sched: act_ct: Fix ct template allocation for zone 0
	mptcp: always parse mptcp options for MPC reqsk
	nvme-rdma: fix in-casule data send for chained sgls
	ACPICA: Clean up context mutex during object deletion
	perf probe: Fix NULL pointer dereference in convert_variable_location()
	net: dsa: tag_8021q: fix the VLAN IDs used for encoding sub-VLANs
	net: sock: fix in-kernel mark setting
	net/tls: Replace TLS_RX_SYNC_RUNNING with RCU
	net/tls: Fix use-after-free after the TLS device goes down and up
	net/mlx5e: Fix incompatible casting
	net/mlx5: Check firmware sync reset requested is set before trying to abort it
	net/mlx5e: Check for needed capability for cvlan matching
	net/mlx5: DR, Create multi-destination flow table with level less than 64
	nvmet: fix freeing unallocated p2pmem
	netfilter: nft_ct: skip expectations for confirmed conntrack
	netfilter: nfnetlink_cthelper: hit EBUSY on updates if size mismatches
	drm/i915/selftests: Fix return value check in live_breadcrumbs_smoketest()
	bpf: Simplify cases in bpf_base_func_proto
	bpf, lockdown, audit: Fix buggy SELinux lockdown permission checks
	ieee802154: fix error return code in ieee802154_add_iface()
	ieee802154: fix error return code in ieee802154_llsec_getparams()
	igb: add correct exception tracing for XDP
	ixgbevf: add correct exception tracing for XDP
	cxgb4: fix regression with HASH tc prio value update
	ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptions
	ice: Fix allowing VF to request more/less queues via virtchnl
	ice: Fix VFR issues for AVF drivers that expect ATQLEN cleared
	ice: handle the VF VSI rebuild failure
	ice: report supported and advertised autoneg using PHY capabilities
	ice: Allow all LLDP packets from PF to Tx
	i2c: qcom-geni: Add shutdown callback for i2c
	cxgb4: avoid link re-train during TC-MQPRIO configuration
	i40e: optimize for XDP_REDIRECT in xsk path
	i40e: add correct exception tracing for XDP
	ice: simplify ice_run_xdp
	ice: optimize for XDP_REDIRECT in xsk path
	ice: add correct exception tracing for XDP
	ixgbe: optimize for XDP_REDIRECT in xsk path
	ixgbe: add correct exception tracing for XDP
	arm64: dts: ti: j7200-main: Mark Main NAVSS as dma-coherent
	optee: use export_uuid() to copy client UUID
	bus: ti-sysc: Fix am335x resume hang for usb otg module
	arm64: dts: ls1028a: fix memory node
	arm64: dts: zii-ultra: fix 12V_MAIN voltage
	arm64: dts: freescale: sl28: var4: fix RGMII clock and voltage
	ARM: dts: imx7d-meerkat96: Fix the 'tuning-step' property
	ARM: dts: imx7d-pico: Fix the 'tuning-step' property
	ARM: dts: imx: emcon-avari: Fix nxp,pca8574 #gpio-cells
	bus: ti-sysc: Fix flakey idling of uarts and stop using swsup_sidle_act
	tipc: add extack messages for bearer/media failure
	tipc: fix unique bearer names sanity check
	serial: stm32: fix threaded interrupt handling
	riscv: vdso: fix and clean-up Makefile
	io_uring: fix link timeout refs
	io_uring: use better types for cflags
	drm/amdgpu/vcn3: add cancel_delayed_work_sync before power gate
	drm/amdgpu/jpeg2.5: add cancel_delayed_work_sync before power gate
	drm/amdgpu/jpeg3: add cancel_delayed_work_sync before power gate
	Bluetooth: fix the erroneous flush_work() order
	Bluetooth: use correct lock to prevent UAF of hdev object
	wireguard: do not use -O3
	wireguard: peer: allocate in kmem_cache
	wireguard: use synchronize_net rather than synchronize_rcu
	wireguard: selftests: remove old conntrack kconfig value
	wireguard: selftests: make sure rp_filter is disabled on vethc
	wireguard: allowedips: initialize list head in selftest
	wireguard: allowedips: remove nodes in O(1)
	wireguard: allowedips: allocate nodes in kmem_cache
	wireguard: allowedips: free empty intermediate nodes when removing single node
	net: caif: added cfserl_release function
	net: caif: add proper error handling
	net: caif: fix memory leak in caif_device_notify
	net: caif: fix memory leak in cfusbl_device_notify
	HID: i2c-hid: Skip ELAN power-on command after reset
	HID: magicmouse: fix NULL-deref on disconnect
	HID: multitouch: require Finger field to mark Win8 reports as MT
	gfs2: fix scheduling while atomic bug in glocks
	ALSA: timer: Fix master timer notification
	ALSA: hda: Fix for mute key LED for HP Pavilion 15-CK0xx
	ALSA: hda: update the power_state during the direct-complete
	ARM: dts: imx6dl-yapp4: Fix RGMII connection to QCA8334 switch
	ARM: dts: imx6q-dhcom: Add PU,VDD1P1,VDD2P5 regulators
	ext4: fix memory leak in ext4_fill_super
	ext4: fix bug on in ext4_es_cache_extent as ext4_split_extent_at failed
	ext4: fix fast commit alignment issues
	ext4: fix memory leak in ext4_mb_init_backend on error path.
	ext4: fix accessing uninit percpu counter variable with fast_commit
	usb: dwc2: Fix build in periphal-only mode
	pid: take a reference when initializing `cad_pid`
	ocfs2: fix data corruption by fallocate
	mm/debug_vm_pgtable: fix alignment for pmd/pud_advanced_tests()
	mm/page_alloc: fix counting of free pages after take off from buddy
	x86/cpufeatures: Force disable X86_FEATURE_ENQCMD and remove update_pasid()
	x86/sev: Check SME/SEV support in CPUID first
	nfc: fix NULL ptr dereference in llcp_sock_getname() after failed connect
	drm/amdgpu: Don't query CE and UE errors
	drm/amdgpu: make sure we unpin the UVD BO
	x86/apic: Mark _all_ legacy interrupts when IO/APIC is missing
	powerpc/kprobes: Fix validation of prefixed instructions across page boundary
	btrfs: mark ordered extent and inode with error if we fail to finish
	btrfs: fix error handling in btrfs_del_csums
	btrfs: return errors from btrfs_del_csums in cleanup_ref_head
	btrfs: fixup error handling in fixup_inode_link_counts
	btrfs: abort in rename_exchange if we fail to insert the second ref
	btrfs: fix deadlock when cloning inline extents and low on available space
	mm, hugetlb: fix simple resv_huge_pages underflow on UFFDIO_COPY
	drm/msm/dpu: always use mdp device to scale bandwidth
	btrfs: fix unmountable seed device after fstrim
	KVM: SVM: Truncate GPR value for DR and CR accesses in !64-bit mode
	KVM: arm64: Fix debug register indexing
	x86/kvm: Teardown PV features on boot CPU as well
	x86/kvm: Disable kvmclock on all CPUs on shutdown
	x86/kvm: Disable all PV features on crash
	lib/lz4: explicitly support in-place decompression
	i2c: qcom-geni: Suspend and resume the bus during SYSTEM_SLEEP_PM ops
	netfilter: nf_tables: missing error reporting for not selected expressions
	xen-netback: take a reference to the RX task thread
	neighbour: allow NUD_NOARP entries to be forced GCed
	Linux 5.10.43

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I8d7ec0878193e4e454076809b7fb71fcc4e3d810
2021-06-12 14:48:14 +02:00
Johannes Berg
259e0a28b9 UPSTREAM: nl80211: fix kernel-doc warning in the new SAE attribute
Format the items as a definition list, to avoid the warning
from the rst parsing.

Fixes: 9f0ffa4184 ("cfg80211: Add support to configure SAE PWE value to drivers")
Link: https://lore.kernel.org/r/20201110094911.bb020e863aa0.I960caf90e2a8cc23f6bf9245d77524df6a4d8f37@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
(cherry picked from commit da1e9dd3a1)
Bug: 187129171
Signed-off-by: Connor O'Brien <connoro@google.com>
Change-Id: Ia962bcdbc52f2019ff0ef957b512915bfc921fad
2021-06-10 20:25:50 -07:00
Pavel Skripkin
d6db727457 net: caif: add proper error handling
commit a2805dca51 upstream.

caif_enroll_dev() can fail in some cases. Ingnoring
these cases can lead to memory leak due to not assigning
link_support pointer to anywhere.

Fixes: 7c18d2205e ("caif: Restructure how link caif link layer enroll")
Cc: stable@vger.kernel.org
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-06-10 13:39:24 +02:00
Pavel Skripkin
dac53568c6 net: caif: added cfserl_release function
commit bce130e7f3 upstream.

Added cfserl_release() function.

Cc: stable@vger.kernel.org
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-06-10 13:39:24 +02:00
Maxim Mikityanskiy
f1d4184f12 net/tls: Fix use-after-free after the TLS device goes down and up
[ Upstream commit c55dcdd435 ]

When a netdev with active TLS offload goes down, tls_device_down is
called to stop the offload and tear down the TLS context. However, the
socket stays alive, and it still points to the TLS context, which is now
deallocated. If a netdev goes up, while the connection is still active,
and the data flow resumes after a number of TCP retransmissions, it will
lead to a use-after-free of the TLS context.

This commit addresses this bug by keeping the context alive until its
normal destruction, and implements the necessary fallbacks, so that the
connection can resume in software (non-offloaded) kTLS mode.

On the TX side tls_sw_fallback is used to encrypt all packets. The RX
side already has all the necessary fallbacks, because receiving
non-decrypted packets is supported. The thing needed on the RX side is
to block resync requests, which are normally produced after receiving
non-decrypted packets.

The necessary synchronization is implemented for a graceful teardown:
first the fallbacks are deployed, then the driver resources are released
(it used to be possible to have a tls_dev_resync after tls_dev_del).

A new flag called TLS_RX_DEV_DEGRADED is added to indicate the fallback
mode. It's used to skip the RX resync logic completely, as it becomes
useless, and some objects may be released (for example, resync_async,
which is allocated and freed by the driver).

Fixes: e8f6979981 ("net/tls: Add generic NIC offload infrastructure")
Signed-off-by: Maxim Mikityanskiy <maximmi@nvidia.com>
Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-06-10 13:39:18 +02:00