Commit Graph

105915 Commits

Author SHA1 Message Date
Greg Kroah-Hartman
d715144232 Revert "seq_buf: Avoid type mismatch for seq_buf_init"
This reverts commit d494ddccf2 which is
commit d9a9280a0d upstream.

It breaks the abi definitions, and there's no real need for it at all
other than for "correctness", so revert the thing.

Bug: 161946584
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I20ccc2690eca2c16adf507d679fa5e0a6c746e1c
2020-12-30 15:59:58 +01:00
Greg Kroah-Hartman
07ce88e9de This is the 4.19.164 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl/sVdwACgkQONu9yGCS
 aT581g/+KZ4lFcY/lAEY6/n6RjFenerl5O2a4tqO+j7eivOA8aNOzXQpvwcPXFKZ
 uCCwab3shrp0MdOJ4Ub1qLF5rZoJ/QvLNkI+8GVRztnchkWHwNlYbheZqHRows9E
 LM5w/+SUh+I7wymfjsjxr8ohSOxkvygNL9PLLTkuQMwbs/jjdizmcgqeYo54Plih
 IdtHrp/ZjxKMOu+fkp1dpTy2RUfbxxWS4RnVjSI+g3s8vaxWh90jMCwLP3fyUwpX
 a8eNCFkIV0lBCj+dYF+ry5x7wGd9mvCVAG70DmRkHd4nyc1WGnp+yz3lQlQnIzeq
 Hc7k3ts3FXmXBSRTzkqM9pmaOuyrKwqu3DoiplXxHgjeJYegP9k0jh33eohXmc/u
 qSz9XB3FhBxy7uRf8tqGLKiUsARnQUYfqzR8qgGFndvWRpIBr9egSzDKVNSF5uWu
 bPt3UQpM8O714NcnB2PGs4OUPqxSikT3BrnfurZOzEddkSveXfkItYnt3mc300bx
 MSHYY/iuLpsBeDd0U6POgf5J5RigmOWvayZrMkPSxlnm7v9diefpKo7xB7+l3AqD
 DZ5BSZMNtgKHwzck6d3RXX+GCILreL16Lj299NM1SJPm+j5SEkna7luikgi2pqrk
 r2cD31L9JHiq36L3uP5u30JoxEG6+W2Px+dqc+uyB3RXHJzRwy4=
 =TKv4
 -----END PGP SIGNATURE-----

Merge 4.19.164 into android-4.19-stable

Changes in 4.19.164
	Kbuild: do not emit debug info for assembly with LLVM_IAS=1
	x86/lib: Change .weak to SYM_FUNC_START_WEAK for arch/x86/lib/mem*_64.S
	spi: bcm2835aux: Fix use-after-free on unbind
	spi: bcm2835aux: Restore err assignment in bcm2835aux_spi_probe
	iwlwifi: pcie: limit memory read spin time
	arm64: dts: rockchip: Assign a fixed index to mmc devices on rk3399 boards.
	iwlwifi: mvm: fix kernel panic in case of assert during CSA
	powerpc: Drop -me200 addition to build flags
	ARC: stack unwinding: don't assume non-current task is sleeping
	scsi: ufs: Make sure clk scaling happens only when HBA is runtime ACTIVE
	irqchip/gic-v3-its: Unconditionally save/restore the ITS state on suspend
	soc: fsl: dpio: Get the cpumask through cpumask_of(cpu)
	platform/x86: thinkpad_acpi: Do not report SW_TABLET_MODE on Yoga 11e
	platform/x86: thinkpad_acpi: Add BAT1 is primary battery quirk for Thinkpad Yoga 11e 4th gen
	platform/x86: acer-wmi: add automatic keyboard background light toggle key as KEY_LIGHTS_TOGGLE
	platform/x86: intel-vbtn: Support for tablet mode on HP Pavilion 13 x360 PC
	Input: cm109 - do not stomp on control URB
	Input: i8042 - add Acer laptops to the i8042 reset list
	pinctrl: amd: remove debounce filter setting in IRQ type setting
	mmc: block: Fixup condition for CMD13 polling for RPMB requests
	kbuild: avoid static_assert for genksyms
	scsi: be2iscsi: Revert "Fix a theoretical leak in beiscsi_create_eqs()"
	x86/mm/mem_encrypt: Fix definition of PMD_FLAGS_DEC_WP
	x86/membarrier: Get rid of a dubious optimization
	x86/apic/vector: Fix ordering in vector assignment
	compiler.h: fix barrier_data() on clang
	PCI: qcom: Add missing reset for ipq806x
	mac80211: mesh: fix mesh_pathtbl_init() error path
	net: stmmac: free tx skb buffer in stmmac_resume()
	tcp: select sane initial rcvq_space.space for big MSS
	tcp: fix cwnd-limited bug for TSO deferral where we send nothing
	net/mlx4_en: Avoid scheduling restart task if it is already running
	lan743x: fix for potential NULL pointer dereference with bare card
	net/mlx4_en: Handle TX error CQE
	net: stmmac: delete the eee_ctrl_timer after napi disabled
	net: stmmac: dwmac-meson8b: fix mask definition of the m250_sel mux
	net: bridge: vlan: fix error return code in __vlan_add()
	ktest.pl: If size of log is too big to email, email error message
	USB: dummy-hcd: Fix uninitialized array use in init()
	USB: add RESET_RESUME quirk for Snapscan 1212
	ALSA: usb-audio: Fix potential out-of-bounds shift
	ALSA: usb-audio: Fix control 'access overflow' errors from chmap
	xhci: Give USB2 ports time to enter U3 in bus suspend
	USB: UAS: introduce a quirk to set no_write_same
	USB: sisusbvga: Make console support depend on BROKEN
	ALSA: pcm: oss: Fix potential out-of-bounds shift
	serial: 8250_omap: Avoid FIFO corruption caused by MDR1 access
	drm/xen-front: Fix misused IS_ERR_OR_NULL checks
	drm: fix drm_dp_mst_port refcount leaks in drm_dp_mst_allocate_vcpi
	arm64: lse: fix LSE atomics with LLVM's integrated assembler
	arm64: lse: Fix LSE atomics with LLVM
	arm64: Change .weak to SYM_FUNC_START_WEAK_PI for arch/arm64/lib/mem*.S
	x86/resctrl: Remove unused struct mbm_state::chunks_bw
	x86/resctrl: Fix incorrect local bandwidth when mba_sc is enabled
	pinctrl: merrifield: Set default bias in case no particular value given
	pinctrl: baytrail: Avoid clearing debounce value when turning it off
	ARM: dts: sun8i: v3s: fix GIC node memory range
	gpio: mvebu: fix potential user-after-free on probe
	scsi: bnx2i: Requires MMU
	xsk: Fix xsk_poll()'s return type
	can: softing: softing_netdev_open(): fix error handling
	clk: renesas: r9a06g032: Drop __packed for portability
	block: factor out requeue handling from dispatch code
	netfilter: x_tables: Switch synchronization to RCU
	gpio: eic-sprd: break loop when getting NULL device resource
	selftests/bpf/test_offload.py: Reset ethtool features after failed setting
	RDMA/cm: Fix an attempt to use non-valid pointer when cleaning timewait
	ixgbe: avoid premature Rx buffer reuse
	drm/tegra: replace idr_init() by idr_init_base()
	kernel/cpu: add arch override for clear_tasks_mm_cpumask() mm handling
	drm/tegra: sor: Disable clocks on error in tegra_sor_init()
	arm64: syscall: exit userspace before unmasking exceptions
	vxlan: Add needed_headroom for lower device
	vxlan: Copy needed_tailroom from lowerdev
	scsi: mpt3sas: Increase IOCInit request timeout to 30s
	dm table: Remove BUG_ON(in_interrupt())
	soc/tegra: fuse: Fix index bug in get_process_id
	USB: serial: option: add interface-number sanity check to flag handling
	USB: gadget: f_acm: add support for SuperSpeed Plus
	USB: gadget: f_midi: setup SuperSpeed Plus descriptors
	usb: gadget: f_fs: Re-use SS descriptors for SuperSpeedPlus
	USB: gadget: f_rndis: fix bitrate for SuperSpeed and above
	usb: chipidea: ci_hdrc_imx: Pass DISABLE_DEVICE_STREAMING flag to imx6ul
	ARM: dts: exynos: fix roles of USB 3.0 ports on Odroid XU
	ARM: dts: exynos: fix USB 3.0 VBUS control and over-current pins on Exynos5410
	ARM: dts: exynos: fix USB 3.0 pins supply being turned off on Odroid XU
	coresight: tmc-etr: Check if page is valid before dma_map_page()
	scsi: megaraid_sas: Check user-provided offsets
	HID: i2c-hid: add Vero K147 to descriptor override
	serial_core: Check for port state when tty is in error state
	Bluetooth: Fix slab-out-of-bounds read in hci_le_direct_adv_report_evt()
	quota: Sanity-check quota file headers on load
	media: msi2500: assign SPI bus number dynamically
	crypto: af_alg - avoid undefined behavior accessing salg_name
	md: fix a warning caused by a race between concurrent md_ioctl()s
	perf cs-etm: Change tuple from traceID-CPU# to traceID-metadata
	perf cs-etm: Move definition of 'traceid_list' global variable from header file
	drm/gma500: fix double free of gma_connector
	drm/tve200: Fix handling of platform_get_irq() error
	soc: renesas: rmobile-sysc: Fix some leaks in rmobile_init_pm_domains()
	soc: mediatek: Check if power domains can be powered on at boot time
	soc: qcom: geni: More properly switch to DMA mode
	RDMA/bnxt_re: Set queue pair state when being queried
	selinux: fix error initialization in inode_doinit_with_dentry()
	ARM: dts: aspeed: s2600wf: Fix VGA memory region location
	RDMA/rxe: Compute PSN windows correctly
	x86/mm/ident_map: Check for errors from ident_pud_init()
	ARM: p2v: fix handling of LPAE translation in BE mode
	x86/apic: Fix x2apic enablement without interrupt remapping
	sched/deadline: Fix sched_dl_global_validate()
	sched: Reenable interrupts in do_sched_yield()
	crypto: talitos - Endianess in current_desc_hdr()
	crypto: talitos - Fix return type of current_desc_hdr()
	crypto: inside-secure - Fix sizeof() mismatch
	powerpc/64: Set up a kernel stack for secondaries before cpu_restore()
	spi: img-spfi: fix reference leak in img_spfi_resume
	drm/msm/dsi_pll_10nm: restore VCO rate during restore_state
	ASoC: pcm: DRAIN support reactivation
	selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling
	arm64: dts: exynos: Include common syscon restart/poweroff for Exynos7
	arm64: dts: exynos: Correct psci compatible used on Exynos7
	Bluetooth: Fix null pointer dereference in hci_event_packet()
	Bluetooth: hci_h5: fix memory leak in h5_close
	spi: spi-ti-qspi: fix reference leak in ti_qspi_setup
	spi: tegra20-slink: fix reference leak in slink ops of tegra20
	spi: tegra20-sflash: fix reference leak in tegra_sflash_resume
	spi: tegra114: fix reference leak in tegra spi ops
	spi: bcm63xx-hsspi: fix missing clk_disable_unprepare() on error in bcm63xx_hsspi_resume
	mwifiex: fix mwifiex_shutdown_sw() causing sw reset failure
	ASoC: wm8998: Fix PM disable depth imbalance on error
	ASoC: arizona: Fix a wrong free in wm8997_probe
	RDMa/mthca: Work around -Wenum-conversion warning
	MIPS: BCM47XX: fix kconfig dependency bug for BCM47XX_BCMA
	crypto: qat - fix status check in qat_hal_put_rel_rd_xfer()
	staging: greybus: codecs: Fix reference counter leak in error handling
	staging: gasket: interrupt: fix the missed eventfd_ctx_put() in gasket_interrupt.c
	media: tm6000: Fix sizeof() mismatches
	media: mtk-vcodec: add missing put_device() call in mtk_vcodec_release_dec_pm()
	ASoC: meson: fix COMPILE_TEST error
	scsi: core: Fix VPD LUN ID designator priorities
	media: solo6x10: fix missing snd_card_free in error handling case
	video: fbdev: atmel_lcdfb: fix return error code in atmel_lcdfb_of_init()
	drm/omap: dmm_tiler: fix return error code in omap_dmm_probe()
	Input: ads7846 - fix race that causes missing releases
	Input: ads7846 - fix integer overflow on Rt calculation
	Input: ads7846 - fix unaligned access on 7845
	usb/max3421: fix return error code in max3421_probe()
	spi: mxs: fix reference leak in mxs_spi_probe
	powerpc/feature: Fix CPU_FTRS_ALWAYS by removing CPU_FTRS_GENERIC_32
	crypto: crypto4xx - Replace bitwise OR with logical OR in crypto4xx_build_pd
	crypto: omap-aes - Fix PM disable depth imbalance in omap_aes_probe
	spi: fix resource leak for drivers without .remove callback
	soc: ti: knav_qmss: fix reference leak in knav_queue_probe
	soc: ti: Fix reference imbalance in knav_dma_probe
	drivers: soc: ti: knav_qmss_queue: Fix error return code in knav_queue_probe
	Input: omap4-keypad - fix runtime PM error handling
	RDMA/cxgb4: Validate the number of CQEs
	memstick: fix a double-free bug in memstick_check
	ARM: dts: at91: sama5d4_xplained: add pincontrol for USB Host
	ARM: dts: at91: sama5d3_xplained: add pincontrol for USB Host
	orinoco: Move context allocation after processing the skb
	cw1200: fix missing destroy_workqueue() on error in cw1200_init_common
	dmaengine: mv_xor_v2: Fix error return code in mv_xor_v2_probe()
	media: siano: fix memory leak of debugfs members in smsdvb_hotplug
	platform/x86: mlx-platform: Remove PSU EEPROM from default platform configuration
	platform/x86: mlx-platform: Remove PSU EEPROM from MSN274x platform configuration
	samples: bpf: Fix lwt_len_hist reusing previous BPF map
	mips: cdmm: fix use-after-free in mips_cdmm_bus_discover
	media: max2175: fix max2175_set_csm_mode() error code
	slimbus: qcom-ngd-ctrl: Avoid sending power requests without QMI
	HSI: omap_ssi: Don't jump to free ID in ssi_add_controller()
	ARM: dts: Remove non-existent i2c1 from 98dx3236
	arm64: dts: rockchip: Set dr_mode to "host" for OTG on rk3328-roc-cc
	power: supply: axp288_charger: Fix HP Pavilion x2 10 DMI matching
	power: supply: bq24190_charger: fix reference leak
	genirq/irqdomain: Don't try to free an interrupt that has no mapping
	PCI: Bounds-check command-line resource alignment requests
	PCI: Fix overflow in command-line resource alignment requests
	PCI: iproc: Fix out-of-bound array accesses
	arm64: dts: meson: fix spi-max-frequency on Khadas VIM2
	ARM: dts: at91: at91sam9rl: fix ADC triggers
	platform/x86: dell-smbios-base: Fix error return code in dell_smbios_init
	ath10k: Fix the parsing error in service available event
	ath10k: Fix an error handling path
	ath10k: Release some resources in an error handling path
	NFSv4.2: condition READDIR's mask for security label based on LSM state
	SUNRPC: xprt_load_transport() needs to support the netid "rdma6"
	lockd: don't use interval-based rebinding over TCP
	NFS: switch nfsiod to be an UNBOUND workqueue.
	vfio-pci: Use io_remap_pfn_range() for PCI IO memory
	media: saa7146: fix array overflow in vidioc_s_audio()
	clocksource/drivers/cadence_ttc: Fix memory leak in ttc_setup_clockevent()
	ARM: dts: at91: sama5d2: map securam as device
	pinctrl: falcon: add missing put_device() call in pinctrl_falcon_probe()
	arm64: dts: rockchip: Fix UART pull-ups on rk3328
	memstick: r592: Fix error return in r592_probe()
	net/mlx5: Properly convey driver version to firmware
	ASoC: jz4740-i2s: add missed checks for clk_get()
	dm ioctl: fix error return code in target_message
	clocksource/drivers/arm_arch_timer: Correct fault programming of CNTKCTL_EL1.EVNTI
	cpufreq: highbank: Add missing MODULE_DEVICE_TABLE
	cpufreq: mediatek: Add missing MODULE_DEVICE_TABLE
	cpufreq: st: Add missing MODULE_DEVICE_TABLE
	cpufreq: loongson1: Add missing MODULE_ALIAS
	cpufreq: scpi: Add missing MODULE_ALIAS
	scsi: qedi: Fix missing destroy_workqueue() on error in __qedi_probe
	scsi: pm80xx: Fix error return in pm8001_pci_probe()
	seq_buf: Avoid type mismatch for seq_buf_init
	scsi: fnic: Fix error return code in fnic_probe()
	platform/x86: mlx-platform: Fix item counter assignment for MSN2700, MSN24xx systems
	powerpc/pseries/hibernation: drop pseries_suspend_begin() from suspend ops
	powerpc/pseries/hibernation: remove redundant cacheinfo update
	usb: ehci-omap: Fix PM disable depth umbalance in ehci_hcd_omap_probe
	usb: oxu210hp-hcd: Fix memory leak in oxu_create
	speakup: fix uninitialized flush_lock
	nfsd: Fix message level for normal termination
	nfs_common: need lock during iterate through the list
	x86/kprobes: Restore BTF if the single-stepping is cancelled
	bus: fsl-mc: fix error return code in fsl_mc_object_allocate()
	clk: tegra: Fix duplicated SE clock entry
	extcon: max77693: Fix modalias string
	mac80211: don't set set TDLS STA bandwidth wider than possible
	ASoC: wm_adsp: remove "ctl" from list on error in wm_adsp_create_control()
	irqchip/alpine-msi: Fix freeing of interrupts on allocation error path
	watchdog: sirfsoc: Add missing dependency on HAS_IOMEM
	watchdog: sprd: remove watchdog disable from resume fail path
	watchdog: sprd: check busy bit before new loading rather than after that
	watchdog: Fix potential dereferencing of null pointer
	um: Monitor error events in IRQ controller
	um: tty: Fix handling of close in tty lines
	um: chan_xterm: Fix fd leak
	nfc: s3fwrn5: Release the nfc firmware
	powerpc/ps3: use dma_mapping_error()
	checkpatch: fix unescaped left brace
	net: bcmgenet: Fix a resource leak in an error handling path in the probe functin
	net: allwinner: Fix some resources leak in the error handling path of the probe and in the remove function
	net: korina: fix return value
	libnvdimm/label: Return -ENXIO for no slot in __blk_label_update
	watchdog: qcom: Avoid context switch in restart handler
	watchdog: coh901327: add COMMON_CLK dependency
	clk: ti: Fix memleak in ti_fapll_synth_setup
	pwm: zx: Add missing cleanup in error path
	pwm: lp3943: Dynamically allocate PWM chip base
	perf record: Fix memory leak when using '--user-regs=?' to list registers
	qlcnic: Fix error code in probe
	clk: s2mps11: Fix a resource leak in error handling paths in the probe function
	clk: sunxi-ng: Make sure divider tables have sentinel
	kconfig: fix return value of do_error_if()
	ARM: sunxi: Add machine match for the Allwinner V3 SoC
	cfg80211: initialize rekey_data
	fix namespaced fscaps when !CONFIG_SECURITY
	lwt: Disable BH too in run_lwt_bpf()
	Input: cros_ec_keyb - send 'scancodes' in addition to key events
	Input: goodix - add upside-down quirk for Teclast X98 Pro tablet
	media: gspca: Fix memory leak in probe
	media: sunxi-cir: ensure IR is handled when it is continuous
	media: netup_unidvb: Don't leak SPI master in probe error path
	media: ipu3-cio2: Remove traces of returned buffers
	media: ipu3-cio2: Return actual subdev format
	media: ipu3-cio2: Serialise access to pad format
	media: ipu3-cio2: Validate mbus format in setting subdev format
	media: ipu3-cio2: Make the field on subdev format V4L2_FIELD_NONE
	Input: cyapa_gen6 - fix out-of-bounds stack access
	ALSA: hda/ca0132 - Change Input Source enum strings.
	PM: ACPI: PCI: Drop acpi_pm_set_bridge_wakeup()
	Revert "ACPI / resources: Use AE_CTRL_TERMINATE to terminate resources walks"
	ACPI: PNP: compare the string length in the matching_id()
	ALSA: hda: Fix regressions on clear and reconfig sysfs
	ALSA: hda/realtek - Enable headset mic of ASUS X430UN with ALC256
	ALSA: hda/realtek - Enable headset mic of ASUS Q524UQK with ALC255
	ALSA: pcm: oss: Fix a few more UBSAN fixes
	ALSA: hda/realtek: Add quirk for MSI-GP73
	ALSA: hda/realtek: Apply jack fixup for Quanta NL3
	ALSA: usb-audio: Add VID to support native DSD reproduction on FiiO devices
	ALSA: usb-audio: Disable sample read check if firmware doesn't give back
	s390/smp: perform initial CPU reset also for SMT siblings
	s390/kexec_file: fix diag308 subcode when loading crash kernel
	s390/dasd: fix hanging device offline processing
	s390/dasd: prevent inconsistent LCU device data
	s390/dasd: fix list corruption of pavgroup group list
	s390/dasd: fix list corruption of lcu list
	staging: comedi: mf6x4: Fix AI end-of-conversion detection
	powerpc/perf: Exclude kernel samples while counting events in user space.
	crypto: ecdh - avoid unaligned accesses in ecdh_set_secret()
	EDAC/amd64: Fix PCI component registration
	USB: serial: mos7720: fix parallel-port state restore
	USB: serial: digi_acceleport: fix write-wakeup deadlocks
	USB: serial: keyspan_pda: fix dropped unthrottle interrupts
	USB: serial: keyspan_pda: fix write deadlock
	USB: serial: keyspan_pda: fix stalled writes
	USB: serial: keyspan_pda: fix write-wakeup use-after-free
	USB: serial: keyspan_pda: fix tx-unthrottle use-after-free
	USB: serial: keyspan_pda: fix write unthrottling
	ext4: fix a memory leak of ext4_free_data
	ext4: fix deadlock with fs freezing and EA inodes
	KVM: arm64: Introduce handling of AArch32 TTBCR2 traps
	ARM: dts: pandaboard: fix pinmux for gpio user button of Pandaboard ES
	ARM: dts: at91: sama5d2: fix CAN message ram offset and size
	powerpc: Fix incorrect stw{, ux, u, x} instructions in __set_pte_at
	powerpc/rtas: Fix typo of ibm,open-errinjct in RTAS filter
	powerpc/xmon: Change printk() to pr_cont()
	powerpc/powernv/memtrace: Don't leak kernel memory to user space
	powerpc/powernv/memtrace: Fix crashing the kernel when enabling concurrently
	ima: Don't modify file descriptor mode on the fly
	ceph: fix race in concurrent __ceph_remove_cap invocations
	SMB3: avoid confusing warning message on mount to Azure
	SMB3.1.1: do not log warning message if server doesn't populate salt
	ubifs: wbuf: Don't leak kernel memory to flash
	jffs2: Fix GC exit abnormally
	jfs: Fix array index bounds check in dbAdjTree
	drm/dp_aux_dev: check aux_dev before use in drm_dp_aux_dev_get_by_minor()
	spi: spi-sh: Fix use-after-free on unbind
	spi: davinci: Fix use-after-free on unbind
	spi: pic32: Don't leak DMA channels in probe error path
	spi: rb4xx: Don't leak SPI master in probe error path
	spi: sc18is602: Don't leak SPI master in probe error path
	spi: st-ssc4: Fix unbalanced pm_runtime_disable() in probe error path
	spi: mt7621: fix missing clk_disable_unprepare() on error in mt7621_spi_probe
	soc: qcom: smp2p: Safely acquire spinlock without IRQs
	mtd: spinand: Fix OOB read
	mtd: parser: cmdline: Fix parsing of part-names with colons
	mtd: rawnand: qcom: Fix DMA sync on FLASH_STATUS register read
	scsi: lpfc: Fix invalid sleeping context in lpfc_sli4_nvmet_alloc()
	scsi: lpfc: Re-fix use after free in lpfc_rq_buf_free()
	iio: buffer: Fix demux update
	iio: adc: rockchip_saradc: fix missing clk_disable_unprepare() on error in rockchip_saradc_resume
	iio:light:rpr0521: Fix timestamp alignment and prevent data leak.
	iio:light:st_uvis25: Fix timestamp alignment and prevent data leak.
	iio:pressure:mpl3115: Force alignment of buffer
	iio:imu:bmi160: Fix too large a buffer.
	md/cluster: block reshape with remote resync job
	md/cluster: fix deadlock when node is doing resync job
	pinctrl: sunxi: Always call chained_irq_{enter, exit} in sunxi_pinctrl_irq_handler
	clk: mvebu: a3700: fix the XTAL MODE pin to MPP1_9
	xen-blkback: set ring->xenblkd to NULL after kthread_stop()
	xen/xenbus: Allow watches discard events before queueing
	xen/xenbus: Add 'will_handle' callback support in xenbus_watch_path()
	xen/xenbus/xen_bus_type: Support will_handle watch callback
	xen/xenbus: Count pending messages for each watch
	xenbus/xenbus_backend: Disallow pending watch messages
	libnvdimm/namespace: Fix reaping of invalidated block-window-namespace labels
	platform/x86: intel-vbtn: Allow switch events on Acer Switch Alpha 12
	PCI: Fix pci_slot_release() NULL pointer dereference
	platform/x86: mlx-platform: remove an unused variable
	Linux 4.19.164

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I8e2d24b45393ee2360186893d4e578e20156c7f1
2020-12-30 12:19:31 +01:00
SeongJae Park
85597c4369 xen/xenbus: Count pending messages for each watch
commit 3dc86ca6b4 upstream.

This commit adds a counter of pending messages for each watch in the
struct.  It is used to skip unnecessary pending messages lookup in
'unregister_xenbus_watch()'.  It could also be used in 'will_handle'
callback.

This is part of XSA-349

Cc: stable@vger.kernel.org
Signed-off-by: SeongJae Park <sjpark@amazon.de>
Reported-by: Michael Kurth <mku@amazon.de>
Reported-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:26:17 +01:00
SeongJae Park
3a36e4af69 xen/xenbus: Add 'will_handle' callback support in xenbus_watch_path()
commit 2e85d32b1c upstream.

Some code does not directly make 'xenbus_watch' object and call
'register_xenbus_watch()' but use 'xenbus_watch_path()' instead.  This
commit adds support of 'will_handle' callback in the
'xenbus_watch_path()' and it's wrapper, 'xenbus_watch_pathfmt()'.

This is part of XSA-349

Cc: stable@vger.kernel.org
Signed-off-by: SeongJae Park <sjpark@amazon.de>
Reported-by: Michael Kurth <mku@amazon.de>
Reported-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:26:17 +01:00
SeongJae Park
9039eb22f9 xen/xenbus: Allow watches discard events before queueing
commit fed1755b11 upstream.

If handling logics of watch events are slower than the events enqueue
logic and the events can be created from the guests, the guests could
trigger memory pressure by intensively inducing the events, because it
will create a huge number of pending events that exhausting the memory.

Fortunately, some watch events could be ignored, depending on its
handler callback.  For example, if the callback has interest in only one
single path, the watch wouldn't want multiple pending events.  Or, some
watches could ignore events to same path.

To let such watches to volutarily help avoiding the memory pressure
situation, this commit introduces new watch callback, 'will_handle'.  If
it is not NULL, it will be called for each new event just before
enqueuing it.  Then, if the callback returns false, the event will be
discarded.  No watch is using the callback for now, though.

This is part of XSA-349

Cc: stable@vger.kernel.org
Signed-off-by: SeongJae Park <sjpark@amazon.de>
Reported-by: Michael Kurth <mku@amazon.de>
Reported-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:26:16 +01:00
Rafael J. Wysocki
64a48bf566 PM: ACPI: PCI: Drop acpi_pm_set_bridge_wakeup()
commit 7482c5cb90 upstream.

The idea behind acpi_pm_set_bridge_wakeup() was to allow bridges to
be reference counted for wakeup enabling, because they may be enabled
to signal wakeup on behalf of their subordinate devices and that
may happen for multiple times in a row, whereas for the other devices
it only makes sense to enable wakeup signaling once.

However, this becomes problematic if the bridge itself is suspended,
because it is treated as a "regular" device in that case and the
reference counting doesn't work.

For instance, suppose that there are two devices below a bridge and
they both can signal wakeup.  Every time one of them is suspended,
wakeup signaling is enabled for the bridge, so when they both have
been suspended, the bridge's wakeup reference counter value is 2.

Say that the bridge is suspended subsequently and acpi_pci_wakeup()
is called for it.  Because the bridge can signal wakeup, that
function will invoke acpi_pm_set_device_wakeup() to configure it
and __acpi_pm_set_device_wakeup() will be called with the last
argument equal to 1.  This causes __acpi_device_wakeup_enable()
invoked by it to omit the reference counting, because the reference
counter of the target device (the bridge) is 2 at that time.

Now say that the bridge resumes and one of the device below it
resumes too, so the bridge's reference counter becomes 0 and
wakeup signaling is disabled for it, but there is still the other
suspended device which may need the bridge to signal wakeup on its
behalf and that is not going to work.

To address this scenario, use wakeup enable reference counting for
all devices, not just for bridges, so drop the last argument from
__acpi_device_wakeup_enable() and __acpi_pm_set_device_wakeup(),
which causes acpi_pm_set_device_wakeup() and
acpi_pm_set_bridge_wakeup() to become identical, so drop the latter
and use the former instead of it everywhere.

Fixes: 1ba51a7c14 ("ACPI / PCI / PM: Rework acpi_pci_propagate_wakeup()")
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: 4.14+ <stable@vger.kernel.org> # 4.14+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:26:08 +01:00
Serge Hallyn
9f0e4cd4ef fix namespaced fscaps when !CONFIG_SECURITY
[ Upstream commit ed9b25d197 ]

Namespaced file capabilities were introduced in 8db6c34f1d .
When userspace reads an xattr for a namespaced capability, a
virtualized representation of it is returned if the caller is
in a user namespace owned by the capability's owning rootid.
The function which performs this virtualization was not hooked
up if CONFIG_SECURITY=n.  Therefore in that case the original
xattr was shown instead of the virtualized one.

To test this using libcap-bin (*1),

$ v=$(mktemp)
$ unshare -Ur setcap cap_sys_admin-eip $v
$ unshare -Ur setcap -v cap_sys_admin-eip $v
/tmp/tmp.lSiIFRvt8Y: OK

"setcap -v" verifies the values instead of setting them, and
will check whether the rootid value is set.  Therefore, with
this bug un-fixed, and with CONFIG_SECURITY=n, setcap -v will
fail:

$ v=$(mktemp)
$ unshare -Ur setcap cap_sys_admin=eip $v
$ unshare -Ur setcap -v cap_sys_admin=eip $v
nsowner[got=1000, want=0],/tmp/tmp.HHDiOOl9fY differs in []

Fix this bug by calling cap_inode_getsecurity() in
security_inode_getsecurity() instead of returning
-EOPNOTSUPP, when CONFIG_SECURITY=n.

*1 - note, if libcap is too old for getcap to have the '-n'
option, then use verify-caps instead.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=209689
Cc: Hervé Guillemet <herve@guillemet.org>
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Serge Hallyn <shallyn@cisco.com>
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
Signed-off-by: James Morris <jamorris@linux.microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-12-30 11:26:06 +01:00
Arnd Bergmann
d494ddccf2 seq_buf: Avoid type mismatch for seq_buf_init
[ Upstream commit d9a9280a0d ]

Building with W=2 prints a number of warnings for one function that
has a pointer type mismatch:

linux/seq_buf.h: In function 'seq_buf_init':
linux/seq_buf.h:35:12: warning: pointer targets in assignment from 'unsigned char *' to 'char *' differ in signedness [-Wpointer-sign]

Change the type in the function prototype according to the type in
the structure.

Link: https://lkml.kernel.org/r/20201026161108.3707783-1-arnd@kernel.org

Fixes: 9a7777935c ("tracing: Convert seq_buf fields to be like seq_file fields")
Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-12-30 11:26:01 +01:00
Trond Myklebust
99bba78581 SUNRPC: xprt_load_transport() needs to support the netid "rdma6"
[ Upstream commit d5aa6b22e2 ]

According to RFC5666, the correct netid for an IPv6 addressed RDMA
transport is "rdma6", which we've supported as a mount option since
Linux-4.7. The problem is when we try to load the module "xprtrdma6",
that will fail, since there is no modulealias of that name.

Fixes: 181342c5eb ("xprtrdma: Add rdma6 option to support NFS/RDMA IPv6")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-12-30 11:25:59 +01:00
Eric Biggers
268a84d36e crypto: af_alg - avoid undefined behavior accessing salg_name
commit 92eb6c3060 upstream.

Commit 3f69cc6076 ("crypto: af_alg - Allow arbitrarily long algorithm
names") made the kernel start accepting arbitrarily long algorithm names
in sockaddr_alg.  However, the actual length of the salg_name field
stayed at the original 64 bytes.

This is broken because the kernel can access indices >= 64 in salg_name,
which is undefined behavior -- even though the memory that is accessed
is still located within the sockaddr structure.  It would only be
defined behavior if the array were properly marked as arbitrary-length
(either by making it a flexible array, which is the recommended way
these days, or by making it an array of length 0 or 1).

We can't simply change salg_name into a flexible array, since that would
break source compatibility with userspace programs that embed
sockaddr_alg into another struct, or (more commonly) declare a
sockaddr_alg like 'struct sockaddr_alg sa = { .salg_name = "foo" };'.

One solution would be to change salg_name into a flexible array only
when '#ifdef __KERNEL__'.  However, that would keep userspace without an
easy way to actually use the longer algorithm names.

Instead, add a new structure 'sockaddr_alg_new' that has the flexible
array field, and expose it to both userspace and the kernel.
Make the kernel use it correctly in alg_bind().

This addresses the syzbot report
"UBSAN: array-index-out-of-bounds in alg_bind"
(https://syzkaller.appspot.com/bug?extid=92ead4eb8e26a26d465e).

Reported-by: syzbot+92ead4eb8e26a26d465e@syzkaller.appspotmail.com
Fixes: 3f69cc6076 ("crypto: af_alg - Allow arbitrarily long algorithm names")
Cc: <stable@vger.kernel.org> # v4.12+
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:25:48 +01:00
Subash Abhinov Kasiviswanathan
98ab3ff5e7 netfilter: x_tables: Switch synchronization to RCU
[ Upstream commit cc00bcaa58 ]

When running concurrent iptables rules replacement with data, the per CPU
sequence count is checked after the assignment of the new information.
The sequence count is used to synchronize with the packet path without the
use of any explicit locking. If there are any packets in the packet path using
the table information, the sequence count is incremented to an odd value and
is incremented to an even after the packet process completion.

The new table value assignment is followed by a write memory barrier so every
CPU should see the latest value. If the packet path has started with the old
table information, the sequence counter will be odd and the iptables
replacement will wait till the sequence count is even prior to freeing the
old table info.

However, this assumes that the new table information assignment and the memory
barrier is actually executed prior to the counter check in the replacement
thread. If CPU decides to execute the assignment later as there is no user of
the table information prior to the sequence check, the packet path in another
CPU may use the old table information. The replacement thread would then free
the table information under it leading to a use after free in the packet
processing context-

Unable to handle kernel NULL pointer dereference at virtual
address 000000000000008e
pc : ip6t_do_table+0x5d0/0x89c
lr : ip6t_do_table+0x5b8/0x89c
ip6t_do_table+0x5d0/0x89c
ip6table_filter_hook+0x24/0x30
nf_hook_slow+0x84/0x120
ip6_input+0x74/0xe0
ip6_rcv_finish+0x7c/0x128
ipv6_rcv+0xac/0xe4
__netif_receive_skb+0x84/0x17c
process_backlog+0x15c/0x1b8
napi_poll+0x88/0x284
net_rx_action+0xbc/0x23c
__do_softirq+0x20c/0x48c

This could be fixed by forcing instruction order after the new table
information assignment or by switching to RCU for the synchronization.

Fixes: 80055dab5d ("netfilter: x_tables: make xt_replace_table wait until old rules are not used anymore")
Reported-by: Sean Tranchetti <stranche@codeaurora.org>
Reported-by: kernel test robot <lkp@intel.com>
Suggested-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-12-30 11:25:45 +01:00
Oliver Neukum
59fb80b4f2 USB: UAS: introduce a quirk to set no_write_same
commit 8010622c86 upstream.

UAS does not share the pessimistic assumption storage is making that
devices cannot deal with WRITE_SAME.  A few devices supported by UAS,
are reported to not deal well with WRITE_SAME. Those need a quirk.

Add it to the device that needs it.

Reported-by: David C. Partridge <david.partridge@perdrix.co.uk>
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201209152639.9195-1-oneukum@suse.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:25:42 +01:00
Arvind Sankar
b207caff41 compiler.h: fix barrier_data() on clang
commit 3347acc6fc upstream.

Commit 815f0ddb34 ("include/linux/compiler*.h: make compiler-*.h
mutually exclusive") neglected to copy barrier_data() from
compiler-gcc.h into compiler-clang.h.

The definition in compiler-gcc.h was really to work around clang's more
aggressive optimization, so this broke barrier_data() on clang, and
consequently memzero_explicit() as well.

For example, this results in at least the memzero_explicit() call in
lib/crypto/sha256.c:sha256_transform() being optimized away by clang.

Fix this by moving the definition of barrier_data() into compiler.h.

Also move the gcc/clang definition of barrier() into compiler.h,
__memory_barrier() is icc-specific (and barrier() is already defined
using it in compiler-intel.h) and doesn't belong in compiler.h.

[rdunlap@infradead.org: fix ALPHA builds when SMP is not enabled]

Link: https://lkml.kernel.org/r/20201101231835.4589-1-rdunlap@infradead.org
Fixes: 815f0ddb34 ("include/linux/compiler*.h: make compiler-*.h mutually exclusive")
Signed-off-by: Arvind Sankar <nivedita@alum.mit.edu>
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Tested-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/20201014212631.207844-1-nivedita@alum.mit.edu
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[nd: backport to account for missing
  commit e506ea4512 ("compiler.h: Split {READ,WRITE}_ONCE definitions out into rwonce.h")
  commit d08b9f0ca6 ("scs: Add support for Clang's Shadow Call Stack (SCS)")
  commit a3f8a30f3f ("Compiler Attributes: use feature checks instead of version checks")]
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:25:40 +01:00
Arnd Bergmann
fd2583d25c kbuild: avoid static_assert for genksyms
commit 14dc3983b5 upstream.

genksyms does not know or care about the _Static_assert() built-in, and
sometimes falls back to ignoring the later symbols, which causes
undefined behavior such as

  WARNING: modpost: EXPORT symbol "ethtool_set_ethtool_phy_ops" [vmlinux] version generation failed, symbol will not be versioned.
  ld: net/ethtool/common.o: relocation R_AARCH64_ABS32 against `__crc_ethtool_set_ethtool_phy_ops' can not be used when making a shared object
  net/ethtool/common.o:(_ftrace_annotated_branch+0x0): dangerous relocation: unsupported relocation

Redefine static_assert for genksyms to avoid that.

Link: https://lkml.kernel.org/r/20201203230955.1482058-1-arnd@kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Suggested-by: Ard Biesheuvel <ardb@kernel.org>
Cc: Masahiro Yamada <masahiroy@kernel.org>
Cc: Michal Marek <michal.lkml@markovi.net>
Cc: Kees Cook <keescook@chromium.org>
Cc: Rikard Falkeborn <rikard.falkeborn@gmail.com>
Cc: Marco Elver <elver@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-30 11:25:39 +01:00
Paul Lawrence
c18f2a956e ANDROID: Incremental fs: Change per UID timeouts to microseconds
Bug: 174495152
Test: incfs_test passes
Signed-off-by: Paul Lawrence <paullawrence@google.com>
Change-Id: Id76d2fec83a0eb7b70ad85f1fac81bf319563a66
2020-12-11 16:08:10 +00:00
Paul Lawrence
82e433b1dd ANDROID: Incremental fs: Add v2 feature flag
Roll report_uid feature flag into v2 feature flag

Bug: 174478527
Test: Feature flag present on boot
Signed-off-by: Paul Lawrence <paullawrence@google.com>
Change-Id: I41ee9715904560004e25cc83a5ccc1eb1bdd2b1f
2020-12-11 16:08:03 +00:00
Paul Lawrence
ea66b38152 ANDROID: Incremental fs: Add zstd feature flag
Bug: 174478527
Test: Boot, look for flag
Signed-off-by: Paul Lawrence <paullawrence@google.com>
Change-Id: Ib573b5420143bd177b50311a3e8cc3a7e8541b96
2020-12-11 16:07:55 +00:00
Greg Kroah-Hartman
a175946a5a This is the 4.19.163 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl/TZyUACgkQONu9yGCS
 aT6Z8Q/+It2xbx52eGrQbN1beQ4vlER+kfbyvIWGgj3GYgiTn1nBTf0COJs5ukXG
 YiKfimV7vUth1NOFkgb4/FKLaU1YkIBpKgOruFA8bxL/XIfX617Y9e3zIFU7Dhsx
 R/fuLm0+EqaIlT9nO59vf3MU1Fe6Ty8jBzwrVlgAUwSDWqtPLvvevwwpS1dJLQ77
 5O3Q8/tO9epc6r5RxSzdcaFZDAp1SeT/lIxzKQD9rBeySJeB/e0usoo00SpjcGiL
 biZSgKAbpLQ2Y5Mbev5OClNxP3zCObOy8Hj20xOl1jlUil+UNQXfbU+bLNuQKfWU
 ilPjhrqUarBaMHydsJDZ9CTHOB94dVqUPB1YJYgtDr3cC5X/yQkqZwPGoK8tEe5u
 IO2XUkCGd6bj4nnqikkodh6zYlfxMYbHaFRAUaOMkE5c5Y3mb3h+/DW8cFuEIEg3
 4dYnujItqCnqlNP3/bmT6i2uicxNzbAGYNZ/7B883WyCsBlxaPTJlY8yzFxoPk03
 HYXKxM9lY1gn0zFXttvWp0l91UWnuIuJqRyc97NuhTxKr9+ZHbnBDWXnF3Dm3iie
 262DXA+dAIc5FR9LQHG83nrrnLVk+3d1fiaduHCmaMjx/T1kJquMRuuWEUJZf/CG
 ++DecqyoGCqNJAQfbu5OUywPnakRfaCdXUo73qfCfloS4OYe5ck=
 =hIcD
 -----END PGP SIGNATURE-----

Merge 4.19.163 into android-4.19-stable

Changes in 4.19.163
	pinctrl: baytrail: Replace WARN with dev_info_once when setting direct-irq pin to output
	pinctrl: baytrail: Fix pin being driven low for a while on gpiod_get(..., GPIOD_OUT_HIGH)
	usb: gadget: f_fs: Use local copy of descriptors for userspace copy
	USB: serial: kl5kusb105: fix memleak on open
	USB: serial: ch341: add new Product ID for CH341A
	USB: serial: ch341: sort device-id entries
	USB: serial: option: add Fibocom NL668 variants
	USB: serial: option: add support for Thales Cinterion EXS82
	USB: serial: option: fix Quectel BG96 matching
	tty: Fix ->pgrp locking in tiocspgrp()
	tty: Fix ->session locking
	ALSA: hda/realtek: Add mute LED quirk to yet another HP x360 model
	ALSA: hda/realtek: Enable headset of ASUS UX482EG & B9400CEA with ALC294
	ALSA: hda/realtek - Add new codec supported for ALC897
	ALSA: hda/generic: Add option to enforce preferred_dacs pairs
	ftrace: Fix updating FTRACE_FL_TRAMP
	cifs: fix potential use-after-free in cifs_echo_request()
	i2c: imx: Don't generate STOP condition if arbitration has been lost
	scsi: mpt3sas: Fix ioctl timeout
	dm writecache: fix the maximum number of arguments
	dm: remove invalid sparse __acquires and __releases annotations
	mm: list_lru: set shrinker map bit when child nr_items is not zero
	mm/swapfile: do not sleep with a spin lock held
	x86/uprobes: Do not use prefixes.nbytes when looping over prefixes.bytes
	i2c: imx: Fix reset of I2SR_IAL flag
	i2c: imx: Check for I2SR_IAL after every byte
	speakup: Reject setting the speakup line discipline outside of speakup
	iommu/amd: Set DTE[IntTabLen] to represent 512 IRTEs
	spi: Introduce device-managed SPI controller allocation
	spi: bcm-qspi: Fix use-after-free on unbind
	spi: bcm2835: Fix use-after-free on unbind
	spi: bcm2835: Release the DMA channel if probe fails after dma_init
	tracing: Fix userstacktrace option for instances
	gfs2: check for empty rgrp tree in gfs2_ri_update
	i2c: qup: Fix error return code in qup_i2c_bam_schedule_desc()
	dm writecache: remove BUG() and fail gracefully instead
	Input: i8042 - fix error return code in i8042_setup_aux()
	netfilter: nf_tables: avoid false-postive lockdep splat
	x86/insn-eval: Use new for_each_insn_prefix() macro to loop over prefixes bytes
	Revert "geneve: pull IP header before ECN decapsulation"
	Linux 4.19.163

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I65bc0b27c576e6d5c75f0bc085cb80e9a2f0a2d3
2020-12-11 14:59:08 +01:00
Lukas Wunner
234b432c7b spi: Introduce device-managed SPI controller allocation
[ Upstream commit 5e844cc37a ]

SPI driver probing currently comprises two steps, whereas removal
comprises only one step:

    spi_alloc_master()
    spi_register_controller()

    spi_unregister_controller()

That's because spi_unregister_controller() calls device_unregister()
instead of device_del(), thereby releasing the reference on the
spi_controller which was obtained by spi_alloc_master().

An SPI driver's private data is contained in the same memory allocation
as the spi_controller struct.  Thus, once spi_unregister_controller()
has been called, the private data is inaccessible.  But some drivers
need to access it after spi_unregister_controller() to perform further
teardown steps.

Introduce devm_spi_alloc_master() and devm_spi_alloc_slave(), which
release a reference on the spi_controller struct only after the driver
has unbound, thereby keeping the memory allocation accessible.  Change
spi_unregister_controller() to not release a reference if the
spi_controller was allocated by one of these new devm functions.

The present commit is small enough to be backportable to stable.
It allows fixing drivers which use the private data in their ->remove()
hook after it's been freed.  It also allows fixing drivers which neglect
to release a reference on the spi_controller in the probe error path.

Long-term, most SPI drivers shall be moved over to the devm functions
introduced herein.  The few that can't shall be changed in a treewide
commit to explicitly release the last reference on the controller.
That commit shall amend spi_unregister_controller() to no longer release
a reference, thereby completing the migration.

As a result, the behaviour will be less surprising and more consistent
with subsystems such as IIO, which also includes the private data in the
allocation of the generic iio_dev struct, but calls device_del() in
iio_device_unregister().

Signed-off-by: Lukas Wunner <lukas@wunner.de>
Link: https://lore.kernel.org/r/272bae2ef08abd21388c98e23729886663d19192.1605121038.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-11 13:25:03 +01:00
Jann Horn
361e822b7d tty: Fix ->session locking
commit c8bcd9c5be upstream.

Currently, locking of ->session is very inconsistent; most places
protect it using the legacy tty mutex, but disassociate_ctty(),
__do_SAK(), tiocspgrp() and tiocgsid() don't.
Two of the writers hold the ctrl_lock (because they already need it for
->pgrp), but __proc_set_tty() doesn't do that yet.

On a PREEMPT=y system, an unprivileged user can theoretically abuse
this broken locking to read 4 bytes of freed memory via TIOCGSID if
tiocgsid() is preempted long enough at the right point. (Other things
might also go wrong, especially if root-only ioctls are involved; I'm
not sure about that.)

Change the locking on ->session such that:

 - tty_lock() is held by all writers: By making disassociate_ctty()
   hold it. This should be fine because the same lock can already be
   taken through the call to tty_vhangup_session().
   The tricky part is that we need to shorten the area covered by
   siglock to be able to take tty_lock() without ugly retry logic; as
   far as I can tell, this should be fine, since nothing in the
   signal_struct is touched in the `if (tty)` branch.
 - ctrl_lock is held by all writers: By changing __proc_set_tty() to
   hold the lock a little longer.
 - All readers that aren't holding tty_lock() hold ctrl_lock: By
   adding locking to tiocgsid() and __do_SAK(), and expanding the area
   covered by ctrl_lock in tiocspgrp().

Cc: stable@kernel.org
Signed-off-by: Jann Horn <jannh@google.com>
Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-11 13:25:01 +01:00
Greg Kroah-Hartman
941f0e4aa8 Merge 4.19.162 into android-4.19-stable
Changes in 4.19.162
	ipv6: addrlabel: fix possible memory leak in ip6addrlbl_net_init
	net/af_iucv: set correct sk_protocol for child sockets
	net/tls: missing received data after fast remote close
	rose: Fix Null pointer dereference in rose_send_frame()
	sock: set sk_err to ee_errno on dequeue from errq
	tcp: Set INET_ECN_xmit configuration in tcp_reinit_congestion_control
	tun: honor IOCB_NOWAIT flag
	usbnet: ipheth: fix connectivity with iOS 14
	net/tls: Protect from calling tls_dev_del for TLS RX twice
	ibmvnic: fix call_netdevice_notifiers in do_reset
	i40e: Fix removing driver while bare-metal VFs pass traffic
	bonding: wait for sysfs kobject destruction before freeing struct slave
	netfilter: bridge: reset skb->pkt_type after NF_INET_POST_ROUTING traversal
	ipv4: Fix tos mask in inet_rtm_getroute()
	ibmvnic: Ensure that SCRQ entry reads are correctly ordered
	ibmvnic: Fix TX completion error handling
	geneve: pull IP header before ECN decapsulation
	net: ip6_gre: set dev->hard_header_len when using header_ops
	net/x25: prevent a couple of overflows
	cxgb3: fix error return code in t3_sge_alloc_qset()
	net: pasemi: fix error return code in pasemi_mac_open()
	chelsio/chtls: fix a double free in chtls_setkey()
	net: mvpp2: Fix error return code in mvpp2_open()
	net/mlx5: Fix wrong address reclaim when command interface is down
	chelsio/chtls: fix panic during unload reload chtls
	dt-bindings: net: correct interrupt flags in examples
	ALSA: usb-audio: US16x08: fix value count for level meters
	Input: xpad - support Ardwiino Controllers
	Input: i8042 - add ByteSpeed touchpad to noloop table
	tracing: Remove WARN_ON in start_thread()
	RDMA/i40iw: Address an mmap handler exploit in i40iw
	Linux 4.19.162

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Idb0e720cc744d8499967a25291a6932b2b8388c6
2020-12-09 08:04:06 +01:00
Jamie Iles
8285a15cd4 bonding: wait for sysfs kobject destruction before freeing struct slave
[ Upstream commit b9ad3e9f5a ]

syzkaller found that with CONFIG_DEBUG_KOBJECT_RELEASE=y, releasing a
struct slave device could result in the following splat:

  kobject: 'bonding_slave' (00000000cecdd4fe): kobject_release, parent 0000000074ceb2b2 (delayed 1000)
  bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
  ------------[ cut here ]------------
  ODEBUG: free active (active state 0) object type: timer_list hint: workqueue_select_cpu_near kernel/workqueue.c:1549 [inline]
  ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x98 kernel/workqueue.c:1600
  WARNING: CPU: 1 PID: 842 at lib/debugobjects.c:485 debug_print_object+0x180/0x240 lib/debugobjects.c:485
  Kernel panic - not syncing: panic_on_warn set ...
  CPU: 1 PID: 842 Comm: kworker/u4:4 Tainted: G S                5.9.0-rc8+ #96
  Hardware name: linux,dummy-virt (DT)
  Workqueue: netns cleanup_net
  Call trace:
   dump_backtrace+0x0/0x4d8 include/linux/bitmap.h:239
   show_stack+0x34/0x48 arch/arm64/kernel/traps.c:142
   __dump_stack lib/dump_stack.c:77 [inline]
   dump_stack+0x174/0x1f8 lib/dump_stack.c:118
   panic+0x360/0x7a0 kernel/panic.c:231
   __warn+0x244/0x2ec kernel/panic.c:600
   report_bug+0x240/0x398 lib/bug.c:198
   bug_handler+0x50/0xc0 arch/arm64/kernel/traps.c:974
   call_break_hook+0x160/0x1d8 arch/arm64/kernel/debug-monitors.c:322
   brk_handler+0x30/0xc0 arch/arm64/kernel/debug-monitors.c:329
   do_debug_exception+0x184/0x340 arch/arm64/mm/fault.c:864
   el1_dbg+0x48/0xb0 arch/arm64/kernel/entry-common.c:65
   el1_sync_handler+0x170/0x1c8 arch/arm64/kernel/entry-common.c:93
   el1_sync+0x80/0x100 arch/arm64/kernel/entry.S:594
   debug_print_object+0x180/0x240 lib/debugobjects.c:485
   __debug_check_no_obj_freed lib/debugobjects.c:967 [inline]
   debug_check_no_obj_freed+0x200/0x430 lib/debugobjects.c:998
   slab_free_hook mm/slub.c:1536 [inline]
   slab_free_freelist_hook+0x190/0x210 mm/slub.c:1577
   slab_free mm/slub.c:3138 [inline]
   kfree+0x13c/0x460 mm/slub.c:4119
   bond_free_slave+0x8c/0xf8 drivers/net/bonding/bond_main.c:1492
   __bond_release_one+0xe0c/0xec8 drivers/net/bonding/bond_main.c:2190
   bond_slave_netdev_event drivers/net/bonding/bond_main.c:3309 [inline]
   bond_netdev_event+0x8f0/0xa70 drivers/net/bonding/bond_main.c:3420
   notifier_call_chain+0xf0/0x200 kernel/notifier.c:83
   __raw_notifier_call_chain kernel/notifier.c:361 [inline]
   raw_notifier_call_chain+0x44/0x58 kernel/notifier.c:368
   call_netdevice_notifiers_info+0xbc/0x150 net/core/dev.c:2033
   call_netdevice_notifiers_extack net/core/dev.c:2045 [inline]
   call_netdevice_notifiers net/core/dev.c:2059 [inline]
   rollback_registered_many+0x6a4/0xec0 net/core/dev.c:9347
   unregister_netdevice_many.part.0+0x2c/0x1c0 net/core/dev.c:10509
   unregister_netdevice_many net/core/dev.c:10508 [inline]
   default_device_exit_batch+0x294/0x338 net/core/dev.c:10992
   ops_exit_list.isra.0+0xec/0x150 net/core/net_namespace.c:189
   cleanup_net+0x44c/0x888 net/core/net_namespace.c:603
   process_one_work+0x96c/0x18c0 kernel/workqueue.c:2269
   worker_thread+0x3f0/0xc30 kernel/workqueue.c:2415
   kthread+0x390/0x498 kernel/kthread.c:292
   ret_from_fork+0x10/0x18 arch/arm64/kernel/entry.S:925

This is a potential use-after-free if the sysfs nodes are being accessed
whilst removing the struct slave, so wait for the object destruction to
complete before freeing the struct slave itself.

Fixes: 07699f9a7c ("bonding: add sysfs /slave dir for bond slave devices.")
Fixes: a068aab422 ("bonding: Fix reference count leak in bond_sysfs_slave_add.")
Cc: Qiushi Wu <wu000273@umn.edu>
Cc: Jay Vosburgh <j.vosburgh@gmail.com>
Cc: Veaceslav Falico <vfalico@gmail.com>
Cc: Andy Gospodarek <andy@greyhouse.net>
Signed-off-by: Jamie Iles <jamie@nuviainc.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://lore.kernel.org/r/20201120142827.879226-1-jamie@nuviainc.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-08 10:18:53 +01:00
Maxim Mikityanskiy
2ba413da62 net/tls: Protect from calling tls_dev_del for TLS RX twice
[ Upstream commit 025cc2fb6a ]

tls_device_offload_cleanup_rx doesn't clear tls_ctx->netdev after
calling tls_dev_del if TLX TX offload is also enabled. Clearing
tls_ctx->netdev gets postponed until tls_device_gc_task. It leaves a
time frame when tls_device_down may get called and call tls_dev_del for
RX one extra time, confusing the driver, which may lead to a crash.

This patch corrects this racy behavior by adding a flag to prevent
tls_device_down from calling tls_dev_del the second time.

Fixes: e8f6979981 ("net/tls: Add generic NIC offload infrastructure")
Signed-off-by: Maxim Mikityanskiy <maximmi@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Link: https://lore.kernel.org/r/20201125221810.69870-1-saeedm@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-08 10:18:52 +01:00
Greg Kroah-Hartman
1309a09163 Revert "drm/atomic_helper: Stop modesets on unregistered connectors harder"
This reverts commit 72289dc23c which is
commit de9f8eea5a upstream.

It breaks the current drm abi and for Android devices, should not be an
issue as modesetting isn't a big deal for them.

Bug: 161946584
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I74a8e98a755dcd68a79a9fe6c50d92806cb7a1f2
2020-12-03 14:58:52 +01:00
Greg Kroah-Hartman
08bed51f55 Merge 4.19.161 into android-4.19-stable
Changes in 4.19.161
	perf event: Check ref_reloc_sym before using it
	netfilter: clear skb->next in NF_HOOK_LIST()
	btrfs: don't access possibly stale fs_info data for printing duplicate device
	btrfs: fix lockdep splat when reading qgroup config on mount
	wireless: Use linux/stddef.h instead of stddef.h
	KVM: arm64: vgic-v3: Drop the reporting of GICR_TYPER.Last for userspace
	KVM: x86: handle !lapic_in_kernel case in kvm_cpu_*_extint
	KVM: x86: Fix split-irqchip vs interrupt injection window request
	arm64: pgtable: Fix pte_accessible()
	arm64: pgtable: Ensure dirty bit is preserved across pte_wrprotect()
	drm/atomic_helper: Stop modesets on unregistered connectors harder
	ALSA: hda/hdmi: fix incorrect locking in hdmi_pcm_close
	HID: cypress: Support Varmilo Keyboards' media hotkeys
	HID: add support for Sega Saturn
	Input: i8042 - allow insmod to succeed on devices without an i8042 controller
	HID: hid-sensor-hub: Fix issue with devices with no report ID
	HID: add HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE for Gamevice devices
	dmaengine: xilinx_dma: use readl_poll_timeout_atomic variant
	x86/xen: don't unbind uninitialized lock_kicker_irq
	HID: Add Logitech Dinovo Edge battery quirk
	proc: don't allow async path resolution of /proc/self components
	nvme: free sq/cq dbbuf pointers when dbbuf set fails
	dmaengine: pl330: _prep_dma_memcpy: Fix wrong burst size
	scsi: libiscsi: Fix NOP race condition
	scsi: target: iscsi: Fix cmd abort fabric stop race
	perf/x86: fix sysfs type mismatches
	xtensa: uaccess: Add missing __user to strncpy_from_user() prototype
	phy: tegra: xusb: Fix dangling pointer on probe failure
	batman-adv: set .owner to THIS_MODULE
	ARM: dts: dra76x: m_can: fix order of clocks
	scsi: ufs: Fix race between shutdown and runtime resume flow
	bnxt_en: fix error return code in bnxt_init_one()
	bnxt_en: fix error return code in bnxt_init_board()
	video: hyperv_fb: Fix the cache type when mapping the VRAM
	bnxt_en: Release PCI regions when DMA mask setup fails during probe.
	cxgb4: fix the panic caused by non smac rewrite
	s390/qeth: fix tear down of async TX buffers
	IB/mthca: fix return value of error branch in mthca_init_cq()
	nfc: s3fwrn5: use signed integer for parsing GPIO numbers
	net: ena: set initial DMA width to avoid intel iommu issue
	ibmvnic: fix NULL pointer dereference in reset_sub_crq_queues
	ibmvnic: fix NULL pointer dereference in ibmvic_reset_crq
	optee: add writeback to valid memory type
	efivarfs: revert "fix memory leak in efivarfs_create()"
	can: gs_usb: fix endianess problem with candleLight firmware
	platform/x86: thinkpad_acpi: Send tablet mode switch at wakeup time
	platform/x86: toshiba_acpi: Fix the wrong variable assignment
	can: m_can: fix nominal bitiming tseg2 min for version >= 3.1
	perf probe: Fix to die_entrypc() returns error correctly
	USB: core: Change %pK for __user pointers to %px
	usb: gadget: f_midi: Fix memleak in f_midi_alloc
	USB: quirks: Add USB_QUIRK_DISCONNECT_SUSPEND quirk for Lenovo A630Z TIO built-in usb-audio card
	usb: gadget: Fix memleak in gadgetfs_fill_super
	x86/speculation: Fix prctl() when spectre_v2_user={seccomp,prctl},ibpb
	x86/resctrl: Remove superfluous kernfs_get() calls to prevent refcount leak
	x86/resctrl: Add necessary kernfs_put() calls to prevent refcount leak
	USB: core: Fix regression in Hercules audio card
	Linux 4.19.161

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ib704b9ff60755978b272aa358d25ddb217cc37bc
2020-12-03 10:10:00 +01:00
Lee Duncan
e0172455d4 scsi: libiscsi: Fix NOP race condition
[ Upstream commit fe0a8a95e7 ]

iSCSI NOPs are sometimes "lost", mistakenly sent to the user-land iscsid
daemon instead of handled in the kernel, as they should be, resulting in a
message from the daemon like:

  iscsid: Got nop in, but kernel supports nop handling.

This can occur because of the new forward- and back-locks, and the fact
that an iSCSI NOP response can occur before processing of the NOP send is
complete. This can result in "conn->ping_task" being NULL in
iscsi_nop_out_rsp(), when the pointer is actually in the process of being
set.

To work around this, we add a new state to the "ping_task" pointer. In
addition to NULL (not assigned) and a pointer (assigned), we add the state
"being set", which is signaled with an INVALID pointer (using "-1").

Link: https://lore.kernel.org/r/20201106193317.16993-1-leeman.duncan@gmail.com
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Lee Duncan <lduncan@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-12-02 08:48:09 +01:00
Lyude Paul
72289dc23c drm/atomic_helper: Stop modesets on unregistered connectors harder
commit de9f8eea5a upstream.

Unfortunately, it appears our fix in:
commit b5d29843d8 ("drm/atomic_helper: Allow DPMS On<->Off changes
for unregistered connectors")

Which attempted to work around the problems introduced by:
commit 4d80273976 ("drm/atomic_helper: Disallow new modesets on
unregistered connectors")

Is still not the right solution, as modesets can still be triggered
outside of drm_atomic_set_crtc_for_connector().

So in order to fix this, while still being careful that we don't break
modesets that a driver may perform before being registered with
userspace, we replace connector->registered with a tristate member,
connector->registration_state. This allows us to keep track of whether
or not a connector is still initializing and hasn't been exposed to
userspace, is currently registered and exposed to userspace, or has been
legitimately removed from the system after having once been present.

Using this info, we can prevent userspace from performing new modesets
on unregistered connectors while still allowing the driver to perform
modesets on unregistered connectors before the driver has finished being
registered.

Changes since v1:
- Fix WARN_ON() in drm_connector_cleanup() that CI caught with this
  patchset in igt@drv_module_reload@basic-reload-inject and
  igt@drv_module_reload@basic-reload by checking if the connector is
  registered instead of unregistered, as calling drm_connector_cleanup()
  on a connector that hasn't been registered with userspace yet should
  stay valid.
- Remove unregistered_connector_check(), and just go back to what we
  were doing before in commit 4d80273976 ("drm/atomic_helper: Disallow
  new modesets on unregistered connectors") except replacing
  READ_ONCE(connector->registered) with drm_connector_is_unregistered().
  This gets rid of the behavior of allowing DPMS On<->Off, but that should
  be fine as it's more consistent with the UAPI we had before - danvet
- s/drm_connector_unregistered/drm_connector_is_unregistered/ - danvet
- Update documentation, fix some typos.

Fixes: b5d29843d8 ("drm/atomic_helper: Allow DPMS On<->Off changes for unregistered connectors")
Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Cc: stable@vger.kernel.org
Cc: David Airlie <airlied@linux.ie>
Signed-off-by: Lyude Paul <lyude@redhat.com>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20181016203946.9601-1-lyude@redhat.com
(cherry picked from commit 39b50c6038)
Fixes: e96550956f ("drm/atomic_helper: Disallow new modesets on unregistered connectors")
Fixes: 34ca26a98a ("drm/atomic_helper: Allow DPMS On<->Off changes for unregistered connectors")
Cc: stable@vger.kernel.org
Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Cc: Christoph Niedermaier <cniedermaier@dh-electronics.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-02 08:48:08 +01:00
Hauke Mehrtens
a6b9a7f781 wireless: Use linux/stddef.h instead of stddef.h
commit 1b9ae0c929 upstream.

When compiling inside the kernel include linux/stddef.h instead of
stddef.h. When I compile this header file in backports for power PC I
run into a conflict with ptrdiff_t. I was unable to reproduce this in
mainline kernel. I still would like to fix this problem in the kernel.

Fixes: 6989310f5d ("wireless: Use offsetof instead of custom macro.")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Link: https://lore.kernel.org/r/20200521201422.16493-1-hauke@hauke-m.de
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-02 08:48:07 +01:00
Cong Wang
5460d62d66 netfilter: clear skb->next in NF_HOOK_LIST()
NF_HOOK_LIST() uses list_del() to remove skb from the linked list,
however, it is not sufficient as skb->next still points to other
skb. We should just call skb_list_del_init() to clear skb->next,
like the rest places which using skb list.

This has been fixed in upstream by commit ca58fbe06c
("netfilter: add and use nf_hook_slow_list()").

Fixes: 9f17dbf04d ("netfilter: fix use-after-free in NF_HOOK_LIST")
Reported-by: liuzx@knownsec.com
Tested-by: liuzx@knownsec.com
Cc: Florian Westphal <fw@strlen.de>
Cc: Edward Cree <ecree@solarflare.com>
Cc: stable@vger.kernel.org # between 4.19 and 5.4
Signed-off-by: Cong Wang <cong.wang@bytedance.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-02 08:48:07 +01:00
Sami Tolvanen
442c302e2e ANDROID: vmlinux.lds.h: merge compound literal sections
After LLVM rG9e33c096476a ("[ELF] Keep orphan section names
(.rodata.foo .text.foo) unchanged if !hasSectionsCommand"), LLD splits
compound literals to separate sections with -fdata-sections, which
it always enables with LTO. Merge these sections to allow LLVM to be
upgraded.

Bug: 174047799
Change-Id: I858c5fcc48283d5528c1d3e2b2d7a3c72f9e03d6
Link: https://github.com/ClangBuiltLinux/linux/issues/958
Suggested-by: Danny Lin <danny@kdrag0n.dev>
Suggested-by: Fangrui Song <maskray@google.com>
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
2020-11-30 21:58:23 +00:00
Greg Kroah-Hartman
f8d9d560b9 This is the 4.19.160 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl+8/EkACgkQONu9yGCS
 aT6g6xAAxZs2sTi6peZpLHhzTgMUZtZYJf9rgAWeF3wwIT1DeEVi8dpOuQbu6j17
 bK65D/qJjmiZGJbFG+Mjt5GcQBOnQz+hQ+EaaADk3HOt6G9oFB99Bybmg6JP94TH
 184JkzUMBnHWj9O4wBtF9IjqPoN5iDIz07D8RArxAqXW8+IWX6BjY2Qzd/dO2vns
 UufBBoKznAC1HWwI1WGyMTki+DHtk1m8hV4+H0G4wHrux4cQRXWzxZx3Zfnmkjqh
 v7Ig90GzVegxHjreYc7RnxDi4XCgOhRqevB+0uf5jms7mzd4spxz1kaAZqO5r/DQ
 tTn/90CL2n7+LC6HGZSGnD5WdKawEZwgbimjpsAQ8uygWyzTJ23hL71ZiGxFaKPc
 Yc7UqVMsSsFCAxUc+ri7ZLrKqBEn3NFZNNjAlqZRW4k1ayjuNz7EdP6CS9T6AZih
 vqmeygmnALbKaX/VPDk/GChWtcpSOfNRA4d3XkSdANavIsNoI114tKZOwwLUQQjd
 D/8h2gng7gnX6TquMQSLyQmYTTV3UxK8UW1Ipi00KLMfmYVHMSI0gn2fGDUwOyfJ
 vkwi/15GJXKQ+GJAvkuyJEDTwFE0iU/+gM28Jv56L9Kv25vWu7vdQVcDU6vslEhY
 bbPMzkOA8zSwOkTZTWS8k6cpMMeiWbIZyxHKovXsU84n0nSf6Hs=
 =IcSi
 -----END PGP SIGNATURE-----

Merge 4.19.160 into android-4.19-stable

Changes in 4.19.160
	ah6: fix error return code in ah6_input()
	atm: nicstar: Unmap DMA on send error
	bnxt_en: read EEPROM A2h address using page 0
	devlink: Add missing genlmsg_cancel() in devlink_nl_sb_port_pool_fill()
	inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill()
	lan743x: fix issue causing intermittent kernel log warnings
	lan743x: prevent entire kernel HANG on open, for some platforms
	mlxsw: core: Use variable timeout for EMAD retries
	net: b44: fix error return code in b44_init_one()
	net: bridge: add missing counters to ndo_get_stats64 callback
	net: dsa: mv88e6xxx: Avoid VTU corruption on 6097
	net: Have netpoll bring-up DSA management interface
	netlabel: fix our progress tracking in netlbl_unlabel_staticlist()
	netlabel: fix an uninitialized warning in netlbl_unlabel_staticlist()
	net/mlx4_core: Fix init_hca fields offset
	net: qualcomm: rmnet: Fix incorrect receive packet handling during cleanup
	net: x25: Increase refcnt of "struct x25_neigh" in x25_rx_call_request
	page_frag: Recover from memory pressure
	qed: fix error return code in qed_iwarp_ll2_start()
	qlcnic: fix error return code in qlcnic_83xx_restart_hw()
	sctp: change to hold/put transport for proto_unreach_timer
	tcp: only postpone PROBE_RTT if RTT is < current min_rtt estimate
	net/mlx5: Disable QoS when min_rates on all VFs are zero
	net: usb: qmi_wwan: Set DTR quirk for MR400
	net/ncsi: Fix netlink registration
	net: ftgmac100: Fix crash when removing driver
	pinctrl: rockchip: enable gpio pclk for rockchip_gpio_to_irq
	scsi: ufs: Fix unbalanced scsi_block_reqs_cnt caused by ufshcd_hold()
	selftests: kvm: Fix the segment descriptor layout to match the actual layout
	ACPI: button: Add DMI quirk for Medion Akoya E2228T
	arm64: psci: Avoid printing in cpu_psci_cpu_die()
	vfs: remove lockdep bogosity in __sb_start_write
	arm64: dts: allwinner: a64: Pine64 Plus: Fix ethernet node
	arm64: dts: allwinner: h5: OrangePi PC2: Fix ethernet node
	ARM: dts: sun8i: r40: bananapi-m2-ultra: Fix ethernet node
	Revert "arm: sun8i: orangepi-pc-plus: Set EMAC activity LEDs to active high"
	ARM: dts: sun8i: h3: orangepi-plus2e: Enable RGMII RX/TX delay on Ethernet PHY
	ARM: dts: sun8i: a83t: Enable both RGMII RX/TX delay on Ethernet PHY
	arm64: dts: allwinner: a64: bananapi-m64: Enable RGMII RX/TX delay on PHY
	Input: adxl34x - clean up a data type in adxl34x_probe()
	MIPS: export has_transparent_hugepage() for modules
	arm64: dts: allwinner: h5: OrangePi Prime: Fix ethernet node
	arm: dts: imx6qdl-udoo: fix rgmii phy-mode for ksz9031 phy
	ARM: dts: imx50-evk: Fix the chip select 1 IOMUX
	Input: resistive-adc-touch - fix kconfig dependency on IIO_BUFFER
	perf lock: Don't free "lock_seq_stat" if read_count isn't zero
	ip_tunnels: Set tunnel option flag when tunnel metadata is present
	can: af_can: prevent potential access of uninitialized member in can_rcv()
	can: af_can: prevent potential access of uninitialized member in canfd_rcv()
	can: dev: can_restart(): post buffer from the right context
	can: ti_hecc: Fix memleak in ti_hecc_probe
	can: mcba_usb: mcba_usb_start_xmit(): first fill skb, then pass to can_put_echo_skb()
	can: peak_usb: fix potential integer overflow on shift of a int
	can: m_can: m_can_handle_state_change(): fix state change
	ASoC: qcom: lpass-platform: Fix memory leak
	MIPS: Alchemy: Fix memleak in alchemy_clk_setup_cpu
	drm/sun4i: dw-hdmi: fix error return code in sun8i_dw_hdmi_bind()
	can: kvaser_usb: kvaser_usb_hydra: Fix KCAN bittiming limits
	xfs: fix the minrecs logic when dealing with inode root child blocks
	xfs: strengthen rmap record flags checking
	regulator: ti-abb: Fix array out of bound read access on the first transition
	fail_function: Remove a redundant mutex unlock
	xfs: revert "xfs: fix rmap key and record comparison functions"
	efi/x86: Free efi_pgd with free_pages()
	libfs: fix error cast of negative value in simple_attr_write()
	speakup: Do not let the line discipline be used several times
	ALSA: firewire: Clean up a locking issue in copy_resp_to_buf()
	ALSA: usb-audio: Add delay quirk for all Logitech USB devices
	ALSA: ctl: fix error path at adding user-defined element set
	ALSA: mixart: Fix mutex deadlock
	ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220)
	tty: serial: imx: keep console clocks always on
	efivarfs: fix memory leak in efivarfs_create()
	staging: rtl8723bs: Add 024c:0627 to the list of SDIO device-ids
	ext4: fix bogus warning in ext4_update_dx_flag()
	iio: accel: kxcjk1013: Replace is_smo8500_device with an acpi_type enum
	iio: accel: kxcjk1013: Add support for KIOX010A ACPI DSM for setting tablet-mode
	regulator: pfuze100: limit pfuze-support-disable-sw to pfuze{100,200}
	regulator: fix memory leak with repeated set_machine_constraints()
	regulator: avoid resolve_supply() infinite recursion
	regulator: workaround self-referent regulators
	xtensa: disable preemption around cache alias management calls
	mac80211: minstrel: remove deferred sampling code
	mac80211: minstrel: fix tx status processing corner case
	mac80211: free sta in sta_info_insert_finish() on errors
	s390/cpum_sf.c: fix file permission for cpum_sfb_size
	s390/dasd: fix null pointer dereference for ERP requests
	ptrace: Set PF_SUPERPRIV when checking capability
	seccomp: Set PF_SUPERPRIV when checking capability
	x86/microcode/intel: Check patch signature before saving microcode for early loading
	mm/userfaultfd: do not access vma->vm_mm after calling handle_userfault()
	Linux 4.19.160

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I3a7304be6687f4ffe96f0e765da0c0ec7dcb971d
2020-11-24 14:57:17 +01:00
Yi-Hung Wei
901e04cd47 ip_tunnels: Set tunnel option flag when tunnel metadata is present
[ Upstream commit 9c2e14b481 ]

Currently, we may set the tunnel option flag when the size of metadata
is zero.  For example, we set TUNNEL_GENEVE_OPT in the receive function
no matter the geneve option is present or not.  As this may result in
issues on the tunnel flags consumers, this patch fixes the issue.

Related discussion:
* https://lore.kernel.org/netdev/1604448694-19351-1-git-send-email-yihung.wei@gmail.com/T/#u

Fixes: 256c87c17c ("net: check tunnel option type in tunnel flags")
Signed-off-by: Yi-Hung Wei <yihung.wei@gmail.com>
Link: https://lore.kernel.org/r/1605053800-74072-1-git-send-email-yihung.wei@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-11-24 13:27:21 +01:00
Paul Lawrence
41a12dfcf5 ANDROID: Incremental fs: Add zstd compression support
Bug: 160634783
Test: incfs_test passes
Signed-off-by: Paul Lawrence <paullawrence@google.com>
Change-Id: Iba28b535d2d5183859ffc721204b036434132d9b
2020-11-19 08:02:31 -08:00
Paul Lawrence
c9704ce7c9 ANDROID: Incremental fs: Add per UID read timeouts
Bug: 169056129
Test: incfs_test passes
Signed-off-by: Paul Lawrence <paullawrence@google.com>
Change-Id: I8cad9ee4095123bafba33abb65bbb339ba6ff8b5
2020-11-19 08:02:30 -08:00
Paul Lawrence
837bf5a401 ANDROID: Incremental fs: Add hash block counts to IOC_IOCTL_GET_BLOCK_COUNT
Bug: 166638631
Test: incfs_test passes
Signed-off-by: Paul Lawrence <paullawrence@google.com>
Change-Id: I0061a855ec563de8df40ba0b35292e99be33c6c0
2020-11-19 08:02:29 -08:00
Paul Lawrence
1652f2647e ANDROID: Incremental fs: Add INCFS_IOC_GET_BLOCK_COUNT
Bug: 166638631
Test: incfs_test passes
Signed-off-by: Paul Lawrence <paullawrence@google.com>
Change-Id: Ia7a8cab87688fc401f0719df84fe79ea75887692
2020-11-19 08:02:29 -08:00
Paul Lawrence
b7fb6bb4c0 ANDROID: Incremental fs: Add .blocks_written file
Bug: 162856396
Test: incfs_test passes
Signed-off-by: Paul Lawrence <paullawrence@google.com>
Change-Id: I942582218cdc7741bcff2f264960b76cdfa1bb36
2020-11-19 08:02:29 -08:00
Paul Lawrence
20ec909ffb ANDROID: Incremental fs: Add UID to pending_read
Test: incfs_test passes
Bug: 160634477
Signed-off-by: Paul Lawrence <paullawrence@google.com>
Change-Id: Iaf817cf1f7ccd0109b2114b425ea7f26718345ab
2020-11-19 08:02:28 -08:00
Paul Lawrence
0eae0d2704 ANDROID: Incremental fs: Create mapped file
Bug: 160634482
Test: incfs_test passes
Signed-off-by: Paul Lawrence <paullawrence@google.com>
Change-Id: Ic2ac8dfccd60f6c9c72c38bf323997fce7546c1c
2020-11-19 08:02:28 -08:00
Greg Kroah-Hartman
67730020fa Merge 4.19.158 into android-4.19-stable
Changes in 4.19.158
	regulator: defer probe when trying to get voltage from unresolved supply
	time: Prevent undefined behaviour in timespec64_to_ns()
	nbd: don't update block size after device is started
	usb: dwc3: gadget: Continue to process pending requests
	usb: dwc3: gadget: Reclaim extra TRBs after request completion
	btrfs: sysfs: init devices outside of the chunk_mutex
	btrfs: reschedule when cloning lots of extents
	genirq: Let GENERIC_IRQ_IPI select IRQ_DOMAIN_HIERARCHY
	hv_balloon: disable warning when floor reached
	net: xfrm: fix a race condition during allocing spi
	xfs: set xefi_discard when creating a deferred agfl free log intent item
	netfilter: ipset: Update byte and packet counters regardless of whether they match
	perf tools: Add missing swap for ino_generation
	ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link()
	can: rx-offload: don't call kfree_skb() from IRQ context
	can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context
	can: dev: __can_get_echo_skb(): fix real payload length return value for RTR frames
	can: can_create_echo_skb(): fix echo skb generation: always use skb_clone()
	can: peak_usb: add range checking in decode operations
	can: peak_usb: peak_usb_get_ts_time(): fix timestamp wrapping
	can: peak_canfd: pucan_handle_can_rx(): fix echo management when loopback is on
	can: flexcan: remove FLEXCAN_QUIRK_DISABLE_MECR quirk for LS1021A
	xfs: flush new eof page on truncate to avoid post-eof corruption
	xfs: fix scrub flagging rtinherit even if there is no rt device
	tpm: efi: Don't create binary_bios_measurements file for an empty log
	Btrfs: fix missing error return if writeback for extent buffer never started
	ath9k_htc: Use appropriate rs_datalen type
	netfilter: use actual socket sk rather than skb sk when routing harder
	crypto: arm64/aes-modes - get rid of literal load of addend vector
	usb: gadget: goku_udc: fix potential crashes in probe
	gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free
	gfs2: Add missing truncate_inode_pages_final for sd_aspace
	gfs2: check for live vs. read-only file system in gfs2_fitrim
	scsi: hpsa: Fix memory leak in hpsa_init_one()
	drm/amdgpu: perform srbm soft reset always on SDMA resume
	drm/amd/pm: perform SMC reset on suspend/hibernation
	drm/amd/pm: do not use ixFEATURE_STATUS for checking smc running
	mac80211: fix use of skb payload instead of header
	cfg80211: regulatory: Fix inconsistent format argument
	scsi: scsi_dh_alua: Avoid crash during alua_bus_detach()
	iommu/amd: Increase interrupt remapping table limit to 512 entries
	s390/smp: move rcu_cpu_starting() earlier
	vfio: platform: fix reference leak in vfio_platform_open
	selftests: proc: fix warning: _GNU_SOURCE redefined
	tpm_tis: Disable interrupts on ThinkPad T490s
	tick/common: Touch watchdog in tick_unfreeze() on all CPUs
	mfd: sprd: Add wakeup capability for PMIC IRQ
	pinctrl: intel: Set default bias in case no particular value given
	ARM: 9019/1: kprobes: Avoid fortify_panic() when copying optprobe template
	pinctrl: aspeed: Fix GPI only function problem.
	nbd: fix a block_device refcount leak in nbd_release
	xfs: fix flags argument to rmap lookup when converting shared file rmaps
	xfs: set the unwritten bit in rmap lookup flags in xchk_bmap_get_rmapextents
	xfs: fix rmap key and record comparison functions
	xfs: fix brainos in the refcount scrubber's rmap fragment processor
	lan743x: fix "BUG: invalid wait context" when setting rx mode
	xfs: fix a missing unlock on error in xfs_fs_map_blocks
	of/address: Fix of_node memory leak in of_dma_is_coherent
	cosa: Add missing kfree in error path of cosa_write
	perf: Fix get_recursion_context()
	ext4: correctly report "not supported" for {usr,grp}jquota when !CONFIG_QUOTA
	ext4: unlock xattr_sem properly in ext4_inline_data_truncate()
	btrfs: ref-verify: fix memory leak in btrfs_ref_tree_mod
	btrfs: dev-replace: fail mount if we don't have replace item with target device
	thunderbolt: Fix memory leak if ida_simple_get() fails in enumerate_services()
	thunderbolt: Add the missed ida_simple_remove() in ring_request_msix()
	uio: Fix use-after-free in uio_unregister_device()
	usb: cdc-acm: Add DISABLE_ECHO for Renesas USB Download mode
	xhci: hisilicon: fix refercence leak in xhci_histb_probe
	mei: protect mei_cl_mtu from null dereference
	futex: Don't enable IRQs unconditionally in put_pi_state()
	ocfs2: initialize ip_next_orphan
	btrfs: fix potential overflow in cluster_pages_for_defrag on 32bit arch
	selinux: Fix error return code in sel_ib_pkey_sid_slow()
	gpio: pcie-idio-24: Fix irq mask when masking
	gpio: pcie-idio-24: Fix IRQ Enable Register value
	gpio: pcie-idio-24: Enable PEX8311 interrupts
	mmc: renesas_sdhi_core: Add missing tmio_mmc_host_free() at remove
	don't dump the threads that had been already exiting when zapped.
	drm/gma500: Fix out-of-bounds access to struct drm_device.vblank[]
	pinctrl: amd: use higher precision for 512 RtcClk
	pinctrl: amd: fix incorrect way to disable debounce filter
	erofs: derive atime instead of leaving it empty
	swiotlb: fix "x86: Don't panic if can not alloc buffer for swiotlb"
	IPv6: Set SIT tunnel hard_header_len to zero
	net/af_iucv: fix null pointer dereference on shutdown
	net: Update window_clamp if SOCK_RCVBUF is set
	net/x25: Fix null-ptr-deref in x25_connect
	tipc: fix memory leak in tipc_topsrv_start()
	vrf: Fix fast path output packet handling with async Netfilter rules
	r8169: fix potential skb double free in an error path
	random32: make prandom_u32() output unpredictable
	x86/speculation: Allow IBPB to be conditionally enabled on CPUs with always-on STIBP
	perf scripting python: Avoid declaring function pointers with a visibility attribute
	perf/core: Fix race in the perf_mmap_close() function
	Revert "kernel/reboot.c: convert simple_strtoul to kstrtoint"
	reboot: fix overflow parsing reboot cpu number
	net: sch_generic: fix the missing new qdisc assignment bug
	Convert trailing spaces and periods in path components
	Linux 4.19.158

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ic626f4e05969543a701587d14bce4476cb146303
2020-11-19 12:25:33 +01:00
George Spelvin
81d7c56d6f random32: make prandom_u32() output unpredictable
commit c51f8f88d7 upstream.

Non-cryptographic PRNGs may have great statistical properties, but
are usually trivially predictable to someone who knows the algorithm,
given a small sample of their output.  An LFSR like prandom_u32() is
particularly simple, even if the sample is widely scattered bits.

It turns out the network stack uses prandom_u32() for some things like
random port numbers which it would prefer are *not* trivially predictable.
Predictability led to a practical DNS spoofing attack.  Oops.

This patch replaces the LFSR with a homebrew cryptographic PRNG based
on the SipHash round function, which is in turn seeded with 128 bits
of strong random key.  (The authors of SipHash have *not* been consulted
about this abuse of their algorithm.)  Speed is prioritized over security;
attacks are rare, while performance is always wanted.

Replacing all callers of prandom_u32() is the quick fix.
Whether to reinstate a weaker PRNG for uses which can tolerate it
is an open question.

Commit f227e3ec3b ("random32: update the net random state on interrupt
and activity") was an earlier attempt at a solution.  This patch replaces
it.

Reported-by: Amit Klein <aksecurity@gmail.com>
Cc: Willy Tarreau <w@1wt.eu>
Cc: Eric Dumazet <edumazet@google.com>
Cc: "Jason A. Donenfeld" <Jason@zx2c4.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: tytso@mit.edu
Cc: Florian Westphal <fw@strlen.de>
Cc: Marc Plumb <lkml.mplumb@gmail.com>
Fixes: f227e3ec3b ("random32: update the net random state on interrupt and activity")
Signed-off-by: George Spelvin <lkml@sdf.org>
Link: https://lore.kernel.org/netdev/20200808152628.GA27941@SDF.ORG/
[ willy: partial reversal of f227e3ec3b5c; moved SIPROUND definitions
  to prandom.h for later use; merged George's prandom_seed() proposal;
  inlined siprand_u32(); replaced the net_rand_state[] array with 4
  members to fix a build issue; cosmetic cleanups to make checkpatch
  happy; fixed RANDOM32_SELFTEST build ]
[wt: backported to 4.19 -- various context adjustments]
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-18 19:18:52 +01:00
Jason A. Donenfeld
580a117919 netfilter: use actual socket sk rather than skb sk when routing harder
commit 46d6c5ae95 upstream.

If netfilter changes the packet mark when mangling, the packet is
rerouted using the route_me_harder set of functions. Prior to this
commit, there's one big difference between route_me_harder and the
ordinary initial routing functions, described in the comment above
__ip_queue_xmit():

   /* Note: skb->sk can be different from sk, in case of tunnels */
   int __ip_queue_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,

That function goes on to correctly make use of sk->sk_bound_dev_if,
rather than skb->sk->sk_bound_dev_if. And indeed the comment is true: a
tunnel will receive a packet in ndo_start_xmit with an initial skb->sk.
It will make some transformations to that packet, and then it will send
the encapsulated packet out of a *new* socket. That new socket will
basically always have a different sk_bound_dev_if (otherwise there'd be
a routing loop). So for the purposes of routing the encapsulated packet,
the routing information as it pertains to the socket should come from
that socket's sk, rather than the packet's original skb->sk. For that
reason __ip_queue_xmit() and related functions all do the right thing.

One might argue that all tunnels should just call skb_orphan(skb) before
transmitting the encapsulated packet into the new socket. But tunnels do
*not* do this -- and this is wisely avoided in skb_scrub_packet() too --
because features like TSQ rely on skb->destructor() being called when
that buffer space is truely available again. Calling skb_orphan(skb) too
early would result in buffers filling up unnecessarily and accounting
info being all wrong. Instead, additional routing must take into account
the new sk, just as __ip_queue_xmit() notes.

So, this commit addresses the problem by fishing the correct sk out of
state->sk -- it's already set properly in the call to nf_hook() in
__ip_local_out(), which receives the sk as part of its normal
functionality. So we make sure to plumb state->sk through the various
route_me_harder functions, and then make correct use of it following the
example of __ip_queue_xmit().

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[Jason: backported to 4.19 from Sasha's 5.4 backport]
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-18 19:18:44 +01:00
Oleksij Rempel
ef02687fc7 can: can_create_echo_skb(): fix echo skb generation: always use skb_clone()
[ Upstream commit 286228d382 ]

All user space generated SKBs are owned by a socket (unless injected into the
key via AF_PACKET). If a socket is closed, all associated skbs will be cleaned
up.

This leads to a problem when a CAN driver calls can_put_echo_skb() on a
unshared SKB. If the socket is closed prior to the TX complete handler,
can_get_echo_skb() and the subsequent delivering of the echo SKB to all
registered callbacks, a SKB with a refcount of 0 is delivered.

To avoid the problem, in can_get_echo_skb() the original SKB is now always
cloned, regardless of shared SKB or not. If the process exists it can now
safely discard its SKBs, without disturbing the delivery of the echo SKB.

The problem shows up in the j1939 stack, when it clones the incoming skb, which
detects the already 0 refcount.

We can easily reproduce this with following example:

testj1939 -B -r can0: &
cansend can0 1823ff40#0123

WARNING: CPU: 0 PID: 293 at lib/refcount.c:25 refcount_warn_saturate+0x108/0x174
refcount_t: addition on 0; use-after-free.
Modules linked in: coda_vpu imx_vdoa videobuf2_vmalloc dw_hdmi_ahb_audio vcan
CPU: 0 PID: 293 Comm: cansend Not tainted 5.5.0-rc6-00376-g9e20dcb7040d #1
Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
Backtrace:
[<c010f570>] (dump_backtrace) from [<c010f90c>] (show_stack+0x20/0x24)
[<c010f8ec>] (show_stack) from [<c0c3e1a4>] (dump_stack+0x8c/0xa0)
[<c0c3e118>] (dump_stack) from [<c0127fec>] (__warn+0xe0/0x108)
[<c0127f0c>] (__warn) from [<c01283c8>] (warn_slowpath_fmt+0xa8/0xcc)
[<c0128324>] (warn_slowpath_fmt) from [<c0539c0c>] (refcount_warn_saturate+0x108/0x174)
[<c0539b04>] (refcount_warn_saturate) from [<c0ad2cac>] (j1939_can_recv+0x20c/0x210)
[<c0ad2aa0>] (j1939_can_recv) from [<c0ac9dc8>] (can_rcv_filter+0xb4/0x268)
[<c0ac9d14>] (can_rcv_filter) from [<c0aca2cc>] (can_receive+0xb0/0xe4)
[<c0aca21c>] (can_receive) from [<c0aca348>] (can_rcv+0x48/0x98)
[<c0aca300>] (can_rcv) from [<c09b1fdc>] (__netif_receive_skb_one_core+0x64/0x88)
[<c09b1f78>] (__netif_receive_skb_one_core) from [<c09b2070>] (__netif_receive_skb+0x38/0x94)
[<c09b2038>] (__netif_receive_skb) from [<c09b2130>] (netif_receive_skb_internal+0x64/0xf8)
[<c09b20cc>] (netif_receive_skb_internal) from [<c09b21f8>] (netif_receive_skb+0x34/0x19c)
[<c09b21c4>] (netif_receive_skb) from [<c0791278>] (can_rx_offload_napi_poll+0x58/0xb4)

Fixes: 0ae89beb28 ("can: add destructor for self generated skbs")
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Link: http://lore.kernel.org/r/20200124132656.22156-1-o.rempel@pengutronix.de
Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-11-18 19:18:42 +01:00
Zeng Tao
68e51bf376 time: Prevent undefined behaviour in timespec64_to_ns()
[ Upstream commit cb47755725 ]

UBSAN reports:

Undefined behaviour in ./include/linux/time64.h:127:27
signed integer overflow:
17179869187 * 1000000000 cannot be represented in type 'long long int'
Call Trace:
 timespec64_to_ns include/linux/time64.h:127 [inline]
 set_cpu_itimer+0x65c/0x880 kernel/time/itimer.c:180
 do_setitimer+0x8e/0x740 kernel/time/itimer.c:245
 __x64_sys_setitimer+0x14c/0x2c0 kernel/time/itimer.c:336
 do_syscall_64+0xa1/0x540 arch/x86/entry/common.c:295

Commit bd40a17576 ("y2038: itimer: change implementation to timespec64")
replaced the original conversion which handled time clamping correctly with
timespec64_to_ns() which has no overflow protection.

Fix it in timespec64_to_ns() as this is not necessarily limited to the
usage in itimers.

[ tglx: Added comment and adjusted the fixes tag ]

Fixes: 361a3bf005 ("time64: Add time64.h header and define struct timespec64")
Signed-off-by: Zeng Tao <prime.zeng@hisilicon.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/1598952616-6416-1-git-send-email-prime.zeng@hisilicon.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-11-18 19:18:40 +01:00
Catalin Marinas
3c5de8a1b5 UPSTREAM: vdso: Remove superfluous #ifdef __KERNEL__ in vdso/datapage.h
With the move to UAPI headers, such #ifdefs are no longer necessary.

Fixes: 361f8aee9b ("vdso: Define standardized vdso_datapage")
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Cc: linux-arch@vger.kernel.org
Cc: linux-arm-kernel@lists.infradead.org
Cc: linux-mips@vger.kernel.org
Cc: linux-kselftest@vger.kernel.org
Cc: Will Deacon <will.deacon@arm.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Russell King <linux@armlinux.org.uk>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: Paul Burton <paul.burton@mips.com>
Cc: Daniel Lezcano <daniel.lezcano@linaro.org>
Cc: Mark Salyzyn <salyzyn@android.com>
Cc: Peter Collingbourne <pcc@google.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Dmitry Safonov <0x7f454c46@gmail.com>
Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Cc: Huw Davies <huw@codeweavers.com>
Cc: Shijith Thotton <sthotton@marvell.com>
Cc: Andre Przywara <andre.przywara@arm.com>
Link: https://lkml.kernel.org/r/20190624135624.GB29120@arrakis.emea.arm.com

(cherry picked from commit ed75e8f60b)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I4e51879a0b05da1694c6cb41b0a75d52b7dbbd94
2020-11-16 09:22:35 +01:00
Arnd Bergmann
7783c5c8ec UPSTREAM: page flags: prioritize kasan bits over last-cpuid
ARM64 randdconfig builds regularly run into a build error, especially
when NUMA_BALANCING and SPARSEMEM are enabled but not SPARSEMEM_VMEMMAP:

  #error "KASAN: not enough bits in page flags for tag"

The last-cpuid bits are already contitional on the available space, so
the result of the calculation is a bit random on whether they were
already left out or not.

Adding the kasan tag bits before last-cpuid makes it much more likely to
end up with a successful build here, and should be reliable for
randconfig at least, as long as that does not randomize NR_CPUS or
NODES_SHIFT but uses the defaults.

In order for the modified check to not trigger in the x86 vdso32 code
where all constants are wrong (building with -m32), enclose all the
definitions with an #ifdef.

[arnd@arndb.de: build fix]
  Link: http://lkml.kernel.org/r/CAK8P3a3Mno1SWTcuAOT0Wa9VS15pdU6EfnkxLbDpyS55yO04+g@mail.gmail.com
Link: http://lkml.kernel.org/r/20190722115520.3743282-1-arnd@arndb.de
Link: https://lore.kernel.org/lkml/20190618095347.3850490-1-arnd@arndb.de/
Fixes: 2813b9c029 ("kasan, mm, arm64: tag non slab memory allocated via pagealloc")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Andrey Konovalov <andreyknvl@google.com>
Reviewed-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Andrey Konovalov <andreyknvl@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Will Deacon <will.deacon@arm.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit ee38d94a0a)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I71d6f45d73cea80456a0e0b256221ba62216c86c
2020-11-16 09:22:35 +01:00
Thomas Gleixner
f8fc36851c UPSTREAM: timekeeping/vsyscall: Prevent math overflow in BOOTTIME update
The VDSO update for CLOCK_BOOTTIME has a overflow issue as it shifts the
nanoseconds based boot time offset left by the clocksource shift. That
overflows once the boot time offset becomes large enough. As a consequence
CLOCK_BOOTTIME in the VDSO becomes a random number causing applications to
misbehave.

Fix it by storing a timespec64 representation of the offset when boot time
is adjusted and add that to the MONOTONIC base time value in the vdso data
page. Using the timespec64 representation avoids a 64bit division in the
update code.

Fixes: 44f57d788e ("timekeeping: Provide a generic update_vsyscall() implementation")
Reported-by: Chris Clayton <chris2553@googlemail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Chris Clayton <chris2553@googlemail.com>
Tested-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
Link: https://lkml.kernel.org/r/alpine.DEB.2.21.1908221257580.1983@nanos.tec.linutronix.de

(cherry picked from commit b99328a60a)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I61f5da6821a95b4cb855f737ef0dc94acbb1ccfe
2020-11-16 09:22:35 +01:00
Zhengyuan Liu
a3d2e129b7 UPSTREAM: raid6/test: fix a compilation error
The compilation error is redeclaration showed as following:

        In file included from ../../../include/linux/limits.h:6,
                         from /usr/include/x86_64-linux-gnu/bits/local_lim.h:38,
                         from /usr/include/x86_64-linux-gnu/bits/posix1_lim.h:161,
                         from /usr/include/limits.h:183,
                         from /usr/lib/gcc/x86_64-linux-gnu/8/include-fixed/limits.h:194,
                         from /usr/lib/gcc/x86_64-linux-gnu/8/include-fixed/syslimits.h:7,
                         from /usr/lib/gcc/x86_64-linux-gnu/8/include-fixed/limits.h:34,
                         from ../../../include/linux/raid/pq.h:30,
                         from algos.c:14:
        ../../../include/linux/types.h:114:15: error: conflicting types for ‘int64_t’
         typedef s64   int64_t;
                       ^~~~~~~
        In file included from /usr/include/stdint.h:34,
                         from /usr/lib/gcc/x86_64-linux-gnu/8/include/stdint.h:9,
                         from /usr/include/inttypes.h:27,
                         from ../../../include/linux/raid/pq.h:29,
                         from algos.c:14:
        /usr/include/x86_64-linux-gnu/bits/stdint-intn.h:27:19: note: previous \
        declaration of ‘int64_t’ was here
         typedef __int64_t int64_t;

Fixes: 54d50897d5 ("linux/kernel.h: split *_MAX and *_MIN macros into <linux/limits.h>")
Signed-off-by: Zhengyuan Liu <liuzhengyuan@kylinos.cn>
Signed-off-by: Song Liu <songliubraving@fb.com>
(cherry picked from commit 6b8651aac1)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I3e2955373c6c09fc31464055df40662344d2d347
2020-11-16 09:22:34 +01:00
Maciej Żenczykowski
afabf0a99c UPSTREAM: ipv6: ndisc: RFC-ietf-6man-ra-pref64-09 is now published as RFC8781
See:
  https://www.rfc-editor.org/authors/rfc8781.txt

Cc: Erik Kline <ek@google.com>
Cc: Jen Linkova <furry@google.com>
Cc: Lorenzo Colitti <lorenzo@google.com>
Cc: Michael Haro <mharo@google.com>
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Fixes: c24a77edc9 ("ipv6: ndisc: add support for 'PREF64' dns64 prefix identifier")
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 9175d3f388)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Id940cd32f7295d598a4d1bf1c073b7cee48cff0a
2020-11-16 07:43:08 +01:00
Greg Kroah-Hartman
bc09bee25e This is the 4.19.156 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl+qe0EACgkQONu9yGCS
 aT6MSw//TZRP6iLK2RhIrZu2jKD8jfYbHMT9JgKV2QCw7meg9q0JMj+SNP9CPbiL
 oOYtsXsRFRnAh98aBXNMFmzV7Zm0uUu0XGeFGxnf8y2X7EI1nZ6plvrCUYD8dCiF
 IPR67yyc5MojNQTfm0XDvQ3C7bKx5PuheRCLwhSuKclnrDxi8FNjS2NSBxi5G32j
 B7NzateeG7m/zE9fG1RkiJzfwu8/k0PKKecEYFwjRSC5QrXwvtEKdz/X/HkoXsck
 345wWHCTObpcDbDWkkUF5VuR36kCWMP+uYT4lNihZTV9+9b8Gz9ghhanDIuVCoU1
 biEsJnCORe/PV/xcgGJNkpEtabbDQNJ5Dn3wLKSuRAbBOkN2/nwzZa4EDoXWQSTv
 PDhzbLDjFjMu8Yb9PKrylhYGTmlNS4mA3hMszF4QNszhRyxTyDGln4MbUkpKg4sO
 HgU4JLvDOCfkCsGTBJ4XGTBcH+6ZxZwm1b+e4uy3FFZW2CEqSetZ3TCyIBxdLupa
 8JYmfqQjmaj0KUiUV9l1SJ6uHcIyg/FoNuCAdtDl7mLuzZdwtEhk3TeaZn4iwxWJ
 Ku+2qY0X6wsePOTfIA7puWBbK+IonM24Q3oIDVqjA+2yrmLJGlYuaQJrSPzEJHoh
 upHznwsU2W7MIfA6hJIcQeWIvzM4w5GSKUr3YeknVPIStP1ZqRg=
 =trRk
 -----END PGP SIGNATURE-----

Merge 4.19.156 into android-4.19-stable

Changes in 4.19.156
	drm/i915: Break up error capture compression loops with cond_resched()
	tipc: fix use-after-free in tipc_bcast_get_mode
	ptrace: fix task_join_group_stop() for the case when current is traced
	cadence: force nonlinear buffers to be cloned
	chelsio/chtls: fix memory leaks caused by a race
	chelsio/chtls: fix always leaking ctrl_skb
	gianfar: Replace skb_realloc_headroom with skb_cow_head for PTP
	gianfar: Account for Tx PTP timestamp in the skb headroom
	net: usb: qmi_wwan: add Telit LE910Cx 0x1230 composition
	sctp: Fix COMM_LOST/CANT_STR_ASSOC err reporting on big-endian platforms
	sfp: Fix error handing in sfp_probe()
	blktrace: fix debugfs use after free
	btrfs: extent_io: Kill the forward declaration of flush_write_bio
	btrfs: extent_io: Move the BUG_ON() in flush_write_bio() one level up
	Revert "btrfs: flush write bio if we loop in extent_write_cache_pages"
	btrfs: flush write bio if we loop in extent_write_cache_pages
	btrfs: extent_io: Handle errors better in extent_write_full_page()
	btrfs: extent_io: Handle errors better in btree_write_cache_pages()
	btrfs: extent_io: add proper error handling to lock_extent_buffer_for_io()
	Btrfs: fix unwritten extent buffers and hangs on future writeback attempts
	btrfs: Don't submit any btree write bio if the fs has errors
	btrfs: Move btrfs_check_chunk_valid() to tree-check.[ch] and export it
	btrfs: tree-checker: Make chunk item checker messages more readable
	btrfs: tree-checker: Make btrfs_check_chunk_valid() return EUCLEAN instead of EIO
	btrfs: tree-checker: Check chunk item at tree block read time
	btrfs: tree-checker: Verify dev item
	btrfs: tree-checker: Fix wrong check on max devid
	btrfs: tree-checker: Enhance chunk checker to validate chunk profile
	btrfs: tree-checker: Verify inode item
	btrfs: tree-checker: fix the error message for transid error
	Fonts: Replace discarded const qualifier
	ALSA: usb-audio: Add implicit feedback quirk for Zoom UAC-2
	ALSA: usb-audio: add usb vendor id as DSD-capable for Khadas devices
	ALSA: usb-audio: Add implicit feedback quirk for Qu-16
	ALSA: usb-audio: Add implicit feedback quirk for MODX
	mm: mempolicy: fix potential pte_unmap_unlock pte error
	lib/crc32test: remove extra local_irq_disable/enable
	kthread_worker: prevent queuing delayed work from timer_fn when it is being canceled
	mm: always have io_remap_pfn_range() set pgprot_decrypted()
	gfs2: Wake up when sd_glock_disposal becomes zero
	ring-buffer: Fix recursion protection transitions between interrupt context
	ftrace: Fix recursion check for NMI test
	ftrace: Handle tracing when switching between context
	tracing: Fix out of bounds write in get_trace_buf
	futex: Handle transient "ownerless" rtmutex state correctly
	ARM: dts: sun4i-a10: fix cpu_alert temperature
	x86/kexec: Use up-to-dated screen_info copy to fill boot params
	of: Fix reserved-memory overlap detection
	blk-cgroup: Fix memleak on error path
	blk-cgroup: Pre-allocate tree node on blkg_conf_prep
	scsi: core: Don't start concurrent async scan on same host
	vsock: use ns_capable_noaudit() on socket create
	drm/vc4: drv: Add error handding for bind
	ACPI: NFIT: Fix comparison to '-ENXIO'
	vt: Disable KD_FONT_OP_COPY
	fork: fix copy_process(CLONE_PARENT) race with the exiting ->real_parent
	serial: 8250_mtk: Fix uart_get_baud_rate warning
	serial: txx9: add missing platform_driver_unregister() on error in serial_txx9_init
	USB: serial: cyberjack: fix write-URB completion race
	USB: serial: option: add Quectel EC200T module support
	USB: serial: option: add LE910Cx compositions 0x1203, 0x1230, 0x1231
	USB: serial: option: add Telit FN980 composition 0x1055
	USB: Add NO_LPM quirk for Kingston flash drive
	usb: mtu3: fix panic in mtu3_gadget_stop()
	ARC: stack unwinding: avoid indefinite looping
	Revert "ARC: entry: fix potential EFA clobber when TIF_SYSCALL_TRACE"
	PM: runtime: Resume the device earlier in __device_release_driver()
	perf/core: Fix a memory leak in perf_event_parse_addr_filter()
	tools: perf: Fix build error in v4.19.y
	net: dsa: read mac address from DT for slave device
	arm64: dts: marvell: espressobin: Add ethernet switch aliases
	Linux 4.19.156

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I87af8871465f54de0332fa74bc1f342b7fe99061
2020-11-10 13:23:09 +01:00