4911 Commits

Author	SHA1	Message	Date
Todd Kjos	3af7a2f610	BACKPORT: binder: use cred instead of task for selinux checks ... Since binder was integrated with selinux, it has passed 'struct task_struct' associated with the binder_proc to represent the source and target of transactions. The conversion of task to SID was then done in the hook implementations. It turns out that there are race conditions which can result in an incorrect security context being used. Fix by using the 'struct cred' saved during binder_open and pass it to the selinux subsystem. Cc: stable@vger.kernel.org # 5.14 (need backport for earlier stables) Fixes: 79af73079d ("Add security hooks to binder and implement the hooks for SELinux.") Suggested-by: Jann Horn <jannh@google.com> Signed-off-by: Todd Kjos <tkjos@google.com> Acked-by: Casey Schaufler <casey@schaufler-ca.com> Signed-off-by: Paul Moore <paul@paul-moore.com> Bug: 200688826 (cherry picked from commit 52f8869337) [ refactored to avoid changing KMI: struct binder_proc ] Change-Id: I1664c1f0c2142c17e9ca0d6790bb94de79f531e3	2021-11-11 19:18:33 +00:00
Greg Kroah-Hartman	2300418cc6	This is the 5.10.65 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmFBpvcACgkQONu9yGCS aT7JVxAAof4h5rPObKwhFBu4qOHXEtlHrFAF1xTEaQZnIbv9CkEF0LPufWXP+nKS mQDOdDmX3rZhWXZbnNK3ZxBADJXyHS6M0jHByuGrzQ8dmMONJtpjYUjxou6k/xg2 4ECHqzeVbwbWuKrJrAfC1xuZofIHXZBHrkAQmLoMw8ERp309lgPS2cXDOXRzn/n/ ri+5AhTaw1ZG1JXrXvyfoxjbdE/eEeJXx8N/zJf0sas5lYpsqeAWTgXBkNpPeJm7 G66ISwEVp6TPxihpRSKwUhADjuM2+EAok2WXwwTvO0s00vE7LL5ijK27hhP5ual1 +xtxBHag95oIZ+sq1t3z4BgmE1n3z/lHkQki98JQaWShABLGhMdKYPF75hMzR6Pw j0TvLHdkPRSrtUelc7rGtqaT9tF9+RU59I5fPGlBpGckOJ5u2IHCKdjk1WadRgrj JF7R8ApfP18y1X46tDfr/CIPIZfTVNJyd7hZ1zt11wdBYFmaw/oNyg81OalqzaWf ckUIt6AucRQ04uuFfhSaTuxLSEl5Uuh6W30HuO/0N3CoDsfD1RMc+76sXORt/JdK MPxTy124KM6VZADVW4tQXHMoGkLftqTAIgRKt4iRPz80rdhACJFoZJlmVON0MmKV tSODsqGBxIxhkLj197vQzT152G4wBkmzPtqJfJH7lkGKmBpoKZE= =lJCV -----END PGP SIGNATURE----- Merge 5.10.65 into android12-5.10-lts Changes in 5.10.65 locking/mutex: Fix HANDOFF condition regmap: fix the offset of register error log regulator: tps65910: Silence deferred probe error crypto: mxs-dcp - Check for DMA mapping errors sched/deadline: Fix reset_on_fork reporting of DL tasks power: supply: axp288_fuel_gauge: Report register-address on readb / writeb errors crypto: omap-sham - clear dma flags only after omap_sham_update_dma_stop() sched/deadline: Fix missing clock update in migrate_task_rq_dl() rcu/tree: Handle VM stoppage in stall detection EDAC/mce_amd: Do not load edac_mce_amd module on guests posix-cpu-timers: Force next expiration recalc after itimer reset hrtimer: Avoid double reprogramming in __hrtimer_start_range_ns() hrtimer: Ensure timerfd notification for HIGHRES=n udf: Check LVID earlier udf: Fix iocharset=utf8 mount option isofs: joliet: Fix iocharset=utf8 mount option bcache: add proper error unwinding in bcache_device_init blk-throtl: optimize IOPS throttle for large IO scenarios nvme-tcp: don't update queue count when failing to set io queues nvme-rdma: don't update queue count when failing to set io queues nvmet: pass back cntlid on successful completion power: supply: smb347-charger: Add missing pin control activation power: supply: max17042_battery: fix typo in MAx17042_TOFF s390/cio: add dev_busid sysfs entry for each subchannel s390/zcrypt: fix wrong offset index for APKA master key valid state libata: fix ata_host_start() crypto: omap - Fix inconsistent locking of device lists crypto: qat - do not ignore errors from enable_vf2pf_comms() crypto: qat - handle both source of interrupt in VF ISR crypto: qat - fix reuse of completion variable crypto: qat - fix naming for init/shutdown VF to PF notifications crypto: qat - do not export adf_iov_putmsg() fcntl: fix potential deadlock for &fasync_struct.fa_lock udf_get_extendedattr() had no boundary checks. s390/kasan: fix large PMD pages address alignment check s390/pci: fix misleading rc in clp_set_pci_fn() s390/debug: keep debug data on resize s390/debug: fix debug area life cycle s390/ap: fix state machine hang after failure to enable irq power: supply: cw2015: use dev_err_probe to allow deferred probe m68k: emu: Fix invalid free in nfeth_cleanup() sched/numa: Fix is_core_idle() sched: Fix UCLAMP_FLAG_IDLE setting rcu: Fix to include first blocked task in stall warning rcu: Add lockdep_assert_irqs_disabled() to rcu_sched_clock_irq() and callees rcu: Fix stall-warning deadlock due to non-release of rcu_node ->lock m68k: Fix invalid RMW_INSNS on CPUs that lack CAS block: return ELEVATOR_DISCARD_MERGE if possible spi: spi-fsl-dspi: Fix issue with uninitialized dma_slave_config spi: spi-pic32: Fix issue with uninitialized dma_slave_config genirq/timings: Fix error return code in irq_timings_test_irqs() irqchip/loongson-pch-pic: Improve edge triggered interrupt support lib/mpi: use kcalloc in mpi_resize clocksource/drivers/sh_cmt: Fix wrong setting if don't request IRQ for clock source channel block: nbd: add sanity check for first_minor spi: coldfire-qspi: Use clk_disable_unprepare in the remove function irqchip/gic-v3: Fix priority comparison when non-secure priorities are used crypto: qat - use proper type for vf_mask certs: Trigger creation of RSA module signing key if it's not an RSA key tpm: ibmvtpm: Avoid error message when process gets signal while waiting x86/mce: Defer processing of early errors spi: davinci: invoke chipselect callback blk-crypto: fix check for too-large dun_bytes regulator: vctrl: Use locked regulator_get_voltage in probe path regulator: vctrl: Avoid lockdep warning in enable/disable ops spi: sprd: Fix the wrong WDG_LOAD_VAL spi: spi-zynq-qspi: use wait_for_completion_timeout to make zynq_qspi_exec_mem_op not interruptible EDAC/i10nm: Fix NVDIMM detection drm/panfrost: Fix missing clk_disable_unprepare() on error in panfrost_clk_init() drm/gma500: Fix end of loop tests for list_for_each_entry ASoC: mediatek: mt8183: Fix Unbalanced pm_runtime_enable in mt8183_afe_pcm_dev_probe media: TDA1997x: enable EDID support leds: is31fl32xx: Fix missing error code in is31fl32xx_parse_dt() soc: rockchip: ROCKCHIP_GRF should not default to y, unconditionally media: cxd2880-spi: Fix an error handling path drm/of: free the right object bpf: Fix a typo of reuseport map in bpf.h. bpf: Fix potential memleak and UAF in the verifier. drm/of: free the iterator object on failure gve: fix the wrong AdminQ buffer overflow check libbpf: Fix the possible memory leak on error ARM: dts: aspeed-g6: Fix HVI3C function-group in pinctrl dtsi arm64: dts: renesas: r8a77995: draak: Remove bogus adv7511w properties i40e: improve locking of mac_filter_hash soc: qcom: rpmhpd: Use corner in power_off libbpf: Fix removal of inner map in bpf_object__create_map gfs2: Fix memory leak of object lsi on error return path firmware: fix theoretical UAF race with firmware cache and resume driver core: Fix error return code in really_probe() ionic: cleanly release devlink instance media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init media: dvb-usb: fix uninit-value in vp702x_read_mac_addr media: dvb-usb: Fix error handling in dvb_usb_i2c_init media: go7007: fix memory leak in go7007_usb_probe media: go7007: remove redundant initialization media: rockchip/rga: use pm_runtime_resume_and_get() media: rockchip/rga: fix error handling in probe media: coda: fix frame_mem_ctrl for YUV420 and YVU420 formats media: atomisp: fix the uninitialized use and rename "retvalue" Bluetooth: sco: prevent information leak in sco_conn_defer_accept() 6lowpan: iphc: Fix an off-by-one check of array index drm/amdgpu/acp: Make PM domain really work tcp: seq_file: Avoid skipping sk during tcp_seek_last_pos ARM: dts: meson8: Use a higher default GPU clock frequency ARM: dts: meson8b: odroidc1: Fix the pwm regulator supply properties ARM: dts: meson8b: mxq: Fix the pwm regulator supply properties ARM: dts: meson8b: ec100: Fix the pwm regulator supply properties net/mlx5e: Prohibit inner indir TIRs in IPoIB net/mlx5e: Block LRO if firmware asks for tunneled LRO cgroup/cpuset: Fix a partition bug with hotplug drm: mxsfb: Enable recovery on underflow drm: mxsfb: Increase number of outstanding requests on V4 and newer HW drm: mxsfb: Clear FIFO_CLEAR bit net: cipso: fix warnings in netlbl_cipsov4_add_std Bluetooth: mgmt: Fix wrong opcode in the response for add_adv cmd arm64: dts: renesas: rzg2: Convert EtherAVB to explicit delay handling arm64: dts: renesas: hihope-rzg2-ex: Add EtherAVB internal rx delay devlink: Break parameter notification sequence to be before/after unload/load driver net/mlx5: Fix missing return value in mlx5_devlink_eswitch_inline_mode_set() i2c: highlander: add IRQ check leds: lt3593: Put fwnode in any case during ->probe() leds: trigger: audio: Add an activate callback to ensure the initial brightness is set media: em28xx-input: fix refcount bug in em28xx_usb_disconnect media: venus: venc: Fix potential null pointer dereference on pointer fmt PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently PCI: PM: Enable PME if it can be signaled from D3cold bpf, samples: Add missing mprog-disable to xdp_redirect_cpu's optstring soc: qcom: smsm: Fix missed interrupts if state changes while masked debugfs: Return error during {full/open}_proxy_open() on rmmod Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow PM: EM: Increase energy calculation precision selftests/bpf: Fix bpf-iter-tcp4 test to print correctly the dest IP drm/msm/mdp4: refactor HW revision detection into read_mdp_hw_revision drm/msm/mdp4: move HW revision detection to earlier phase drm/msm/dpu: make dpu_hw_ctl_clear_all_blendstages clear necessary LMs arm64: dts: exynos: correct GIC CPU interfaces address range on Exynos7 counter: 104-quad-8: Return error when invalid mode during ceiling_write cgroup/cpuset: Miscellaneous code cleanup cgroup/cpuset: Fix violation of cpuset locking rule ASoC: Intel: Fix platform ID matching Bluetooth: fix repeated calls to sco_sock_kill drm/msm/dsi: Fix some reference counted resource leaks net/mlx5: Register to devlink ingress VLAN filter trap net/mlx5: Fix unpublish devlink parameters ASoC: rt5682: Implement remove callback ASoC: rt5682: Properly turn off regulators if wrong device ID usb: dwc3: meson-g12a: add IRQ check usb: dwc3: qcom: add IRQ check usb: gadget: udc: at91: add IRQ check usb: gadget: udc: s3c2410: add IRQ check usb: phy: fsl-usb: add IRQ check usb: phy: twl6030: add IRQ checks usb: gadget: udc: renesas_usb3: Fix soc_device_match() abuse selftests/bpf: Fix test_core_autosize on big-endian machines devlink: Clear whole devlink_flash_notify struct samples: pktgen: add missing IPv6 option to pktgen scripts Bluetooth: Move shutdown callback before flushing tx and rx queue PM: cpu: Make notifier chain use a raw_spinlock_t usb: host: ohci-tmio: add IRQ check usb: phy: tahvo: add IRQ check libbpf: Re-build libbpf.so when libbpf.map changes mac80211: Fix insufficient headroom issue for AMSDU locking/lockdep: Mark local_lock_t locking/local_lock: Add missing owner initialization lockd: Fix invalid lockowner cast after vfs_test_lock nfsd4: Fix forced-expiry locking arm64: dts: marvell: armada-37xx: Extend PCIe MEM space clk: staging: correct reference to config IOMEM to config HAS_IOMEM i2c: synquacer: fix deferred probing firmware: raspberrypi: Keep count of all consumers firmware: raspberrypi: Fix a leak in 'rpi_firmware_get()' usb: gadget: mv_u3d: request_irq() after initializing UDC mm/swap: consider max pages in iomap_swapfile_add_extent lkdtm: replace SCSI_DISPATCH_CMD with SCSI_QUEUE_RQ Bluetooth: add timeout sanity check to hci_inquiry i2c: iop3xx: fix deferred probing i2c: s3c2410: fix IRQ check i2c: fix platform_get_irq.cocci warnings i2c: hix5hd2: fix IRQ check gfs2: init system threads before freeze lock rsi: fix error code in rsi_load_9116_firmware() rsi: fix an error code in rsi_probe() ASoC: Intel: kbl_da7219_max98927: Fix format selection for max98373 ASoC: Intel: Skylake: Leave data as is when invoking TLV IPCs ASoC: Intel: Skylake: Fix module resource and format selection mmc: sdhci: Fix issue with uninitialized dma_slave_config mmc: dw_mmc: Fix issue with uninitialized dma_slave_config mmc: moxart: Fix issue with uninitialized dma_slave_config bpf: Fix possible out of bound write in narrow load handling CIFS: Fix a potencially linear read overflow i2c: mt65xx: fix IRQ check i2c: xlp9xx: fix main IRQ check usb: ehci-orion: Handle errors of clk_prepare_enable() in probe usb: bdc: Fix an error handling path in 'bdc_probe()' when no suitable DMA config is available usb: bdc: Fix a resource leak in the error handling path of 'bdc_probe()' tty: serial: fsl_lpuart: fix the wrong mapbase value ASoC: wcd9335: Fix a double irq free in the remove function ASoC: wcd9335: Fix a memory leak in the error handling path of the probe function ASoC: wcd9335: Disable irq on slave ports in the remove function iwlwifi: follow the new inclusive terminology iwlwifi: skip first element in the WTAS ACPI table ice: Only lock to update netdev dev_addr ath6kl: wmi: fix an error code in ath6kl_wmi_sync_point() atlantic: Fix driver resume flow. bcma: Fix memory leak for internally-handled cores brcmfmac: pcie: fix oops on failure to resume and reprobe ipv6: make exception cache less predictible ipv4: make exception cache less predictible net: sched: Fix qdisc_rate_table refcount leak when get tcf_block failed net: qualcomm: fix QCA7000 checksum handling octeontx2-af: Fix loop in free and unmap counter octeontx2-af: Fix static code analyzer reported issues octeontx2-af: Set proper errorcode for IPv4 checksum errors ipv4: fix endianness issue in inet_rtm_getroute_build_skb() ASoC: rt5682: Remove unused variable in rt5682_i2c_remove() iwlwifi Add support for ax201 in Samsung Galaxy Book Flex2 Alpha f2fs: guarantee to write dirty data when enabling checkpoint back time: Handle negative seconds correctly in timespec64_to_ns() io_uring: IORING_OP_WRITE needs hash_reg_file set bio: fix page leak bio_add_hw_page failure tty: Fix data race between tiocsti() and flush_to_ldisc() perf/x86/amd/ibs: Extend PERF_PMU_CAP_NO_EXCLUDE to IBS Op x86/resctrl: Fix a maybe-uninitialized build warning treated as error Revert "KVM: x86: mmu: Add guest physical address check in translate_gpa()" KVM: s390: index kvm->arch.idle_mask by vcpu_idx KVM: x86: Update vCPU's hv_clock before back to guest when tsc_offset is adjusted KVM: VMX: avoid running vmx_handle_exit_irqoff in case of emulation KVM: nVMX: Unconditionally clear nested.pi_pending on nested VM-Enter ARM: dts: at91: add pinctrl-{names, 0} for all gpios fuse: truncate pagecache on atomic_o_trunc fuse: flush extending writes IMA: remove -Wmissing-prototypes warning IMA: remove the dependency on CRYPTO_MD5 fbmem: don't allow too huge resolutions backlight: pwm_bl: Improve bootloader/kernel device handover clk: kirkwood: Fix a clocking boot regression Linux 5.10.65 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ie0b9306ba6ee4193de3200df7cdacaeba152b83e	2021-09-15 14:16:47 +02:00
THOBY Simon	34d099a330	IMA: remove the dependency on CRYPTO_MD5 ... commit 8510505d55 upstream. MD5 is a weak digest algorithm that shouldn't be used for cryptographic operation. It hinders the efficiency of a patch set that aims to limit the digests allowed for the extended file attribute namely security.ima. MD5 is no longer a requirement for IMA, nor should it be used there. The sole place where we still use the MD5 algorithm inside IMA is setting the ima_hash algorithm to MD5, if the user supplies 'ima_hash=md5' parameter on the command line. With commit ab60368ab6 ("ima: Fallback to the builtin hash algorithm"), setting "ima_hash=md5" fails gracefully when CRYPTO_MD5 is not set: ima: Can not allocate md5 (reason: -2) ima: Allocating md5 failed, going to use default hash algorithm sha256 Remove the CRYPTO_MD5 dependency for IMA. Signed-off-by: THOBY Simon <Simon.THOBY@viveris.fr> Reviewed-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com> [zohar@linux.ibm.com: include commit number in patch description for stable.] Cc: stable@vger.kernel.org # 4.17 Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-09-15 09:50:48 +02:00
Austin Kim	5cc1ee3135	IMA: remove -Wmissing-prototypes warning ... commit a32ad90426 upstream. With W=1 build, the compiler throws warning message as below: security/integrity/ima/ima_mok.c:24:12: warning: no previous prototype for ‘ima_mok_init’ [-Wmissing-prototypes] __init int ima_mok_init(void) Silence the warning by adding static keyword to ima_mok_init(). Signed-off-by: Austin Kim <austin.kim@lge.com> Fixes: 41c89b64d7 ("IMA: create machine owner and blacklist keyrings") Cc: stable@vger.kernel.org Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-09-15 09:50:48 +02:00
Greg Kroah-Hartman	46f161a1b2	This is the 5.10.59 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmEZAfkACgkQONu9yGCS aT4SSQ//YEY7KT3w83wnXUP3HuN9GS5DCXNheyHjX0AdvM23HFiKbCBrmpIDBujz USJnkESAaAHp3iT22HfW5n4ZTgcv11AXUeytB6VENGoYsg+HwwT4KXtVXxWBjGAU RNBQEXyuSnEKJo4MNfaFXmhxYaToTYHXxns+JKzjsPuzKt5p4j+Gcr1DdtP/T+3w 6o94C+8tUaGd2Y4Zzs9FIp2vl7j3wKf8JQ+Yzhf7iSaZL3PBfD2wreX7lo0n2x2O rmFcnSZpXNkDmatRY0wRtNZrQrr7XJCyc53+F4m4KW/YlPvPxFDHRJ+GEAkkv6FR RUkbzfi6ym9LYC+BdMlUotEvxlLBavsh3JYuHmuZlxstXpEL4Hj1u3Dm1xVITyhZ ktmzeQZAIvOcLMghQlqLa6go0EUt4OpvbJTtLYPWp3mbwASDKHEKrD2R1XekHlOm QKRclgsbqdJff63FMMtWo0HdkDg+a3EQoXzvY+/Ecy72MeyjdvaPdmGs8kaYzYkx 4EeKluH4c9quM2K73D9qFd3JydIyoXmeZYSEy1yemBQjjumYF+AjxcohATErFvKx KyLR/VNjEQ59ZR+/M+49wnIkqRgbvr2jIMYubKouNLXy5Rzw3imJuLvcTRvn7TEu 7YBEYBaS95Q44vlWAoU25Jr4bUcBJGrPLYeZNNWU6QygsWMsbXo= =jOIx -----END PGP SIGNATURE----- Merge 5.10.59 into android12-5.10-lts Changes in 5.10.59 KVM: SVM: Fix off-by-one indexing when nullifying last used SEV VMCB tee: Correct inappropriate usage of TEE_SHM_DMA_BUF flag firmware: tee_bnxt: Release TEE shm, session, and context during kexec bpf: Add lockdown check for probe_write_user helper Revert "selftests/resctrl: Use resctrl/info for feature detection" mm: make zone_to_nid() and zone_set_nid() available for DISCONTIGMEM arm64: dts: renesas: rzg2: Add usb2_clksel to RZ/G2 M/N/H arm64: dts: renesas: beacon: Fix USB extal reference arm64: dts: renesas: beacon: Fix USB ref clock references vboxsf: Honor excl flag to the dir-inode create op vboxsf: Make vboxsf_dir_create() return the handle for the created file USB:ehci:fix Kunpeng920 ehci hardware problem ALSA: pcm: Fix mmap breakage without explicit buffer setup ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 650 G8 Notebook PC ALSA: hda: Add quirk for ASUS Flow x13 ppp: Fix generating ppp unit id when ifname is not specified ovl: prevent private clone if bind mount is not allowed net: xilinx_emaclite: Do not print real IOMEM pointer Linux 5.10.59 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ie4ba3880d1be4c29acc83453ad89a621ad046b7c	2021-08-15 14:16:00 +02:00
Daniel Borkmann	d8c3859870	bpf: Add lockdown check for probe_write_user helper ... commit 51e1bb9eea upstream. Back then, commit 96ae522795 ("bpf: Add bpf_probe_write_user BPF helper to be called in tracers") added the bpf_probe_write_user() helper in order to allow to override user space memory. Its original goal was to have a facility to "debug, divert, and manipulate execution of semi-cooperative processes" under CAP_SYS_ADMIN. Write to kernel was explicitly disallowed since it would otherwise tamper with its integrity. One use case was shown in cf9b1199de ("samples/bpf: Add test/example of using bpf_probe_write_user bpf helper") where the program DNATs traffic at the time of connect(2) syscall, meaning, it rewrites the arguments to a syscall while they're still in userspace, and before the syscall has a chance to copy the argument into kernel space. These days we have better mechanisms in BPF for achieving the same (e.g. for load-balancers), but without having to write to userspace memory. Of course the bpf_probe_write_user() helper can also be used to abuse many other things for both good or bad purpose. Outside of BPF, there is a similar mechanism for ptrace(2) such as PTRACE_PEEK{TEXT,DATA} and PTRACE_POKE{TEXT,DATA}, but would likely require some more effort. Commit 96ae522795 explicitly dedicated the helper for experimentation purpose only. Thus, move the helper's availability behind a newly added LOCKDOWN_BPF_WRITE_USER lockdown knob so that the helper is disabled under the "integrity" mode. More fine-grained control can be implemented also from LSM side with this change. Fixes: 96ae522795 ("bpf: Add bpf_probe_write_user BPF helper to be called in tracers") Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Andrii Nakryiko <andrii@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-08-15 14:00:25 +02:00
Greg Kroah-Hartman	af3bdb4304	This is the 5.10.58 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmEVBn4ACgkQONu9yGCS aT5CoQ//ZpZKkAu4NzUKmFfzJjpTwRWSg4YKGHx0BSt/ovuw8SXQa3xAx12r1U9w 5hXxkCQncCPSul1eIRNmpwVIUavRvyS2Vll//XtT695MA0e9sK9nrXoYgqwUE/gf hqgytJAb7DHk5pcLlyfCncXNyw//9WIl8WCNSppZgSnRRk+smfThnEVE6pcgQok5 4vIy4RXSK12/Xs9jG+q+pqcvQ3ILscCrzQyfxBu5AWePlm8kaM+6cxuL3b+S0COH Gg0YLPrTQjLdQ+oNnh93s2fFk0bqeqt/KDMI9xGt00hNwaTBHxgoxj04AFQEgkft APwvezabNBojmDZasMq9h5sxGoloxLe2vD+fAWGA3KVTJ6vlKYmhx7+X6jtAJP5Y HHNUiYg58VnkYzxT1Ok8CUHocbaFhlFjCqjDUg1oo93XuZJaTgO63q8yeI49pN7S xZyim8X/rdouW1WG+7pubOe1E+nZudZDooWOs5CxyJmO1jb3CpMjfl3rRdWG4PI4 7gC8IG8xmgC9CeGen5egAPqARwBW0d4AFDHT5tY4yF8ovbkO437hYHKvJjZDY919 v8fqeI95nRrsawXH+GdIMlwOf/PzkODiZc2EwSh/uPnbwPPeZY7a7YQwMwzyxRfb Q3dOrapi5k1aoC7583ReIY5RPqc82a4LAdmTN7YN60hiXHkm0bg= =+Sab -----END PGP SIGNATURE----- Merge 5.10.58 into android12-5.10-lts Changes in 5.10.58 Revert "ACPICA: Fix memory leak caused by _CID repair function" ALSA: seq: Fix racy deletion of subscriber bus: ti-sysc: Fix gpt12 system timer issue with reserved status net: xfrm: fix memory leak in xfrm_user_rcv_msg arm64: dts: ls1028a: fix node name for the sysclk ARM: imx: add missing iounmap() ARM: imx: add missing clk_disable_unprepare() ARM: dts: imx6qdl-sr-som: Increase the PHY reset duration to 10ms arm64: dts: ls1028: sl28: fix networking for variant 2 ARM: dts: colibri-imx6ull: limit SDIO clock to 25MHz ARM: imx: fix missing 3rd argument in macro imx_mmdc_perf_init ARM: dts: imx: Swap M53Menlo pinctrl_power_button/pinctrl_power_out pins arm64: dts: armada-3720-turris-mox: fixed indices for the SDHC controllers arm64: dts: armada-3720-turris-mox: remove mrvl,i2c-fast-mode ALSA: usb-audio: fix incorrect clock source setting clk: stm32f4: fix post divisor setup for I2S/SAI PLLs ARM: dts: am437x-l4: fix typo in can@0 node omap5-board-common: remove not physically existing vdds_1v8_main fixed-regulator dmaengine: uniphier-xdmac: Use readl_poll_timeout_atomic() in atomic state clk: tegra: Implement disable_unused() of tegra_clk_sdmmc_mux_ops dmaengine: stm32-dma: Fix PM usage counter imbalance in stm32 dma ops dmaengine: stm32-dmamux: Fix PM usage counter unbalance in stm32 dmamux ops spi: imx: mx51-ecspi: Reinstate low-speed CONFIGREG delay spi: imx: mx51-ecspi: Fix low-speed CONFIGREG delay calculation scsi: sr: Return correct event when media event code is 3 media: videobuf2-core: dequeue if start_streaming fails ARM: dts: stm32: Disable LAN8710 EDPD on DHCOM ARM: dts: stm32: Fix touchscreen IRQ line assignment on DHCOM dmaengine: imx-dma: configure the generic DMA type to make it work net, gro: Set inner transport header offset in tcp/udp GRO hook net: dsa: sja1105: overwrite dynamic FDB entries with static ones in .port_fdb_add net: dsa: sja1105: invalidate dynamic FDB entries learned concurrently with statically added ones net: dsa: sja1105: be stateless with FDB entries on SJA1105P/Q/R/S/SJA1110 too net: dsa: sja1105: match FDB entries regardless of inner/outer VLAN tag net: phy: micrel: Fix detection of ksz87xx switch net: natsemi: Fix missing pci_disable_device() in probe and remove gpio: tqmx86: really make IRQ optional RDMA/mlx5: Delay emptying a cache entry when a new MR is added to it recently sctp: move the active_key update after sh_keys is added nfp: update ethtool reporting of pauseframe control net: ipv6: fix returned variable type in ip6_skb_dst_mtu net: dsa: qca: ar9331: reorder MDIO write sequence net: sched: fix lockdep_set_class() typo error for sch->seqlock MIPS: check return value of pgtable_pmd_page_ctor mips: Fix non-POSIX regexp bnx2x: fix an error code in bnx2x_nic_load() net: pegasus: fix uninit-value in get_interrupt_interval net: fec: fix use-after-free in fec_drv_remove net: vxge: fix use-after-free in vxge_device_unregister blk-iolatency: error out if blk_get_queue() failed in iolatency_set_limit() Bluetooth: defer cleanup of resources in hci_unregister_dev() USB: usbtmc: Fix RCU stall warning USB: serial: option: add Telit FD980 composition 0x1056 USB: serial: ch341: fix character loss at high transfer rates USB: serial: ftdi_sio: add device ID for Auto-M3 OP-COM v2 firmware_loader: use -ETIMEDOUT instead of -EAGAIN in fw_load_sysfs_fallback firmware_loader: fix use-after-free in firmware_fallback_sysfs drm/amdgpu/display: fix DMUB firmware version info ALSA: pcm - fix mmap capability check for the snd-dummy driver ALSA: hda/realtek: add mic quirk for Acer SF314-42 ALSA: hda/realtek: Fix headset mic for Acer SWIFT SF314-56 (ALC256) ALSA: usb-audio: Fix superfluous autosuspend recovery ALSA: usb-audio: Add registration quirk for JBL Quantum 600 usb: dwc3: gadget: Avoid runtime resume if disabling pullup usb: gadget: remove leaked entry from udc driver list usb: cdns3: Fixed incorrect gadget state usb: gadget: f_hid: added GET_IDLE and SET_IDLE handlers usb: gadget: f_hid: fixed NULL pointer dereference usb: gadget: f_hid: idle uses the highest byte for duration usb: host: ohci-at91: suspend/resume ports after/before OHCI accesses usb: typec: tcpm: Keep other events when receiving FRS and Sourcing_vbus events usb: otg-fsm: Fix hrtimer list corruption clk: fix leak on devm_clk_bulk_get_all() unwind scripts/tracing: fix the bug that can't parse raw_trace_func tracing / histogram: Give calculation hist_fields a size tracing: Reject string operand in the histogram expression tracing: Fix NULL pointer dereference in start_creating tracepoint: static call: Compare data on transition from 2->1 callees tracepoint: Fix static call function vs data state mismatch arm64: stacktrace: avoid tracing arch_stack_walk() optee: Clear stale cache entries during initialization tee: add tee_shm_alloc_kernel_buf() optee: Fix memory leak when failing to register shm pages optee: Refuse to load the driver under the kdump kernel optee: fix tee out of memory failure seen during kexec reboot tpm_ftpm_tee: Free and unregister TEE shared memory during kexec staging: rtl8723bs: Fix a resource leak in sd_int_dpc staging: rtl8712: get rid of flush_scheduled_work staging: rtl8712: error handling refactoring drivers core: Fix oops when driver probe fails media: rtl28xxu: fix zero-length control request pipe: increase minimum default pipe size to 2 pages ext4: fix potential htree corruption when growing large_dir directories serial: tegra: Only print FIFO error message when an error occurs serial: 8250_mtk: fix uart corruption issue when rx power off serial: 8250: Mask out floating 16/32-bit bus bits MIPS: Malta: Do not byte-swap accesses to the CBUS UART serial: 8250_pci: Enumerate Elkhart Lake UARTs via dedicated driver serial: 8250_pci: Avoid irq sharing for MSI(-X) interrupts. fpga: dfl: fme: Fix cpu hotplug issue in performance reporting timers: Move clearing of base::timer_running under base:: Lock xfrm: Fix RCU vs hash_resize_mutex lock inversion net/xfrm/compat: Copy xfrm_spdattr_type_t atributes pcmcia: i82092: fix a null pointer dereference bug selinux: correct the return value when loads initial sids bus: ti-sysc: AM3: RNG is GP only Revert "gpio: mpc8xxx: change the gpio interrupt flags." ARM: omap2+: hwmod: fix potential NULL pointer access md/raid10: properly indicate failure when ending a failed write request KVM: x86: accept userspace interrupt only if no event is injected KVM: Do not leak memory for duplicate debugfs directories KVM: x86/mmu: Fix per-cpu counter corruption on 32-bit builds arm64: vdso: Avoid ISB after reading from cntvct_el0 soc: ixp4xx: fix printing resources interconnect: Fix undersized devress_alloc allocation spi: meson-spicc: fix memory leak in meson_spicc_remove interconnect: Zero initial BW after sync-state interconnect: Always call pre_aggregate before aggregate interconnect: qcom: icc-rpmh: Ensure floor BW is enforced for all nodes drm/i915: Correct SFC_DONE register offset soc: ixp4xx/qmgr: fix invalid __iomem access perf/x86/amd: Don't touch the AMD64_EVENTSEL_HOSTONLY bit inside the guest sched/rt: Fix double enqueue caused by rt_effective_prio drm/i915: avoid uninitialised var in eb_parse() libata: fix ata_pio_sector for CONFIG_HIGHMEM reiserfs: add check for root_inode in reiserfs_fill_super reiserfs: check directory items on read from disk virt_wifi: fix error on connect net: qede: Fix end of loop tests for list_for_each_entry alpha: Send stop IPI to send to online CPUs net/qla3xxx: fix schedule while atomic in ql_wait_for_drvr_lock and ql_adapter_reset smb3: rc uninitialized in one fallocate path drm/amdgpu/display: only enable aux backlight control for OLED panels arm64: fix compat syscall return truncation Linux 5.10.58 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I2533667974c9dff419a14d63e0e8febfb3de80f1	2021-08-12 14:58:34 +02:00
Xiu Jianfeng	f4984f60ac	selinux: correct the return value when loads initial sids ... commit 4c156084da upstream. It should not return 0 when SID 0 is assigned to isids. This patch fixes it. Cc: stable@vger.kernel.org Fixes: e3e0b582c3 ("selinux: remove unused initial SIDs and improve handling") Signed-off-by: Xiu Jianfeng <xiujianfeng@huawei.com> [PM: remove changelog from description] Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-08-12 13:22:16 +02:00
Greg Kroah-Hartman	8db62be3c3	This is the 5.10.51 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmD1LZUACgkQONu9yGCS aT7gERAArjYemBSkD4/nq5HvxoVu7ueEyqI2orJCyB6b5npPrBZjlKna3SuYuNUF CmcX5Y2Ynxd3gWJvYFEJdAAQAEtKAzPdPv0QJ+KiLSP2bEZ4Q5grEJXfzcgxcB4L fUfaCZnUwjoII5xzW1+U2zCJ7YtGx5hZySLKMxSEc0IzawDlfMx4HdwlohXzczsA Zq3/sTJcW30PWSp6MSuMOH//lPh7sAoCnksAv4Yb8MZYZjC8JNnKFn+IwRUGWEMZ sFtNbq51sMgGq4TjYBIdO6wBElP4dgWJhYc4cO0667cDvgp6iod/bKlOLJSiwIVX uPWkyPihH9ZUvNVY0TxjjnxS1rnM0QhH+cEXNGn+SE7KaNmzsI2MaR+DVA2yWcFr 9edqTq5x2CJJ0R/oXHP4nYFtsvlV/QcirlrF0OZHYwz84b16f37Ac7tHOQpr3kNO N29AW0l5XmpxbfHgo1Iaoi02seouLC47vRkvjTpS9mValGUC0ciXTb97CK4FremE 34rskxIRWBU8HECYioFOeHTAi0+xb/9tOj87BnB5CJ28CD2Md27TTdorsISnqPb0 /ER89QfVtlJLi17wGB0rlAm8fDF3Cy6BnA57QIql1z1NbJGc1cxenEAFiIOnbQ5G t6SLs3mgqpQizsKUFYimCWa04ZzY4Bg8H9bAI+M+9w7J6yujQzI= =dGMa -----END PGP SIGNATURE----- Merge 5.10.51 into android12-5.10-lts Changes in 5.10.51 drm/mxsfb: Don't select DRM_KMS_FB_HELPER drm/zte: Don't select DRM_KMS_FB_HELPER drm/ast: Fixed CVE for DP501 drm/amd/display: fix HDCP reset sequence on reinitialize drm/amd/amdgpu/sriov disable all ip hw status by default drm/vc4: fix argument ordering in vc4_crtc_get_margins() drm/bridge: nwl-dsi: Force a full modeset when crtc_state->active is changed to be true net: pch_gbe: Use proper accessors to BE data in pch_ptp_match() drm/amd/display: fix use_max_lb flag for 420 pixel formats clk: renesas: rcar-usb2-clock-sel: Fix error handling in .probe() hugetlb: clear huge pte during flush function on mips platform atm: iphase: fix possible use-after-free in ia_module_exit() mISDN: fix possible use-after-free in HFC_cleanup() atm: nicstar: Fix possible use-after-free in nicstar_cleanup() net: Treat __napi_schedule_irqoff() as __napi_schedule() on PREEMPT_RT drm/mediatek: Fix PM reference leak in mtk_crtc_ddp_hw_init() net: mdio: ipq8064: add regmap config to disable REGCACHE drm/bridge: lt9611: Add missing MODULE_DEVICE_TABLE reiserfs: add check for invalid 1st journal block drm/virtio: Fix double free on probe failure net: mdio: provide shim implementation of devm_of_mdiobus_register net/sched: cls_api: increase max_reclassify_loop pinctrl: equilibrium: Add missing MODULE_DEVICE_TABLE drm/scheduler: Fix hang when sched_entity released drm/sched: Avoid data corruptions udf: Fix NULL pointer dereference in udf_symlink function drm/vc4: Fix clock source for VEC PixelValve on BCM2711 drm/vc4: hdmi: Fix PM reference leak in vc4_hdmi_encoder_pre_crtc_co() e100: handle eeprom as little endian igb: handle vlan types with checker enabled igb: fix assignment on big endian machines drm/bridge: cdns: Fix PM reference leak in cdns_dsi_transfer() clk: renesas: r8a77995: Add ZA2 clock net/mlx5e: IPsec/rep_tc: Fix rep_tc_update_skb drops IPsec packet net/mlx5: Fix lag port remapping logic drm: rockchip: add missing registers for RK3188 drm: rockchip: add missing registers for RK3066 net: stmmac: the XPCS obscures a potential "PHY not found" error RDMA/rtrs: Change MAX_SESS_QUEUE_DEPTH clk: tegra: Fix refcounting of gate clocks clk: tegra: Ensure that PLLU configuration is applied properly drm: bridge: cdns-mhdp8546: Fix PM reference leak in virtio-net: Add validation for used length ipv6: use prandom_u32() for ID generation MIPS: cpu-probe: Fix FPU detection on Ingenic JZ4760(B) MIPS: ingenic: Select CPU_SUPPORTS_CPUFREQ && MIPS_EXTERNAL_TIMER drm/amd/display: Avoid HDCP over-read and corruption drm/amdgpu: remove unsafe optimization to drop preamble ib net: tcp better handling of reordering then loss cases RDMA/cxgb4: Fix missing error code in create_qp() dm space maps: don't reset space map allocation cursor when committing dm writecache: don't split bios when overwriting contiguous cache content dm: Fix dm_accept_partial_bio() relative to zone management commands net: bridge: mrp: Update ring transitions. pinctrl: mcp23s08: fix race condition in irq handler ice: set the value of global config lock timeout longer ice: fix clang warning regarding deadcode.DeadStores virtio_net: Remove BUG() to avoid machine dead net: mscc: ocelot: check return value after calling platform_get_resource() net: bcmgenet: check return value after calling platform_get_resource() net: mvpp2: check return value after calling platform_get_resource() net: micrel: check return value after calling platform_get_resource() net: moxa: Use devm_platform_get_and_ioremap_resource() drm/amd/display: Fix DCN 3.01 DSCCLK validation drm/amd/display: Update scaling settings on modeset drm/amd/display: Release MST resources on switch from MST to SST drm/amd/display: Set DISPCLK_MAX_ERRDET_CYCLES to 7 drm/amd/display: Fix off-by-one error in DML net: phy: realtek: add delay to fix RXC generation issue selftests: Clean forgotten resources as part of cleanup() net: sgi: ioc3-eth: check return value after calling platform_get_resource() drm/amdkfd: use allowed domain for vmbo validation fjes: check return value after calling platform_get_resource() selinux: use __GFP_NOWARN with GFP_NOWAIT in the AVC r8169: avoid link-up interrupt issue on RTL8106e if user enables ASPM drm/amd/display: Verify Gamma & Degamma LUT sizes in amdgpu_dm_atomic_check xfrm: Fix error reporting in xfrm_state_construct. dm writecache: commit just one block, not a full page wlcore/wl12xx: Fix wl12xx get_mac error if device is in ELP wl1251: Fix possible buffer overflow in wl1251_cmd_scan cw1200: add missing MODULE_DEVICE_TABLE drm/amdkfd: fix circular locking on get_wave_state drm/amdkfd: Fix circular lock in nocpsch path bpf: Fix up register-based shifts in interpreter to silence KUBSAN ice: fix incorrect payload indicator on PTYPE ice: mark PTYPE 2 as reserved mt76: mt7615: fix fixed-rate tx status reporting net: fix mistake path for netdev_features_strings net: ipa: Add missing of_node_put() in ipa_firmware_load() net: sched: fix error return code in tcf_del_walker() io_uring: fix false WARN_ONCE drm/amdgpu: fix bad address translation for sienna_cichlid drm/amdkfd: Walk through list with dqm lock hold mt76: mt7915: fix IEEE80211_HE_PHY_CAP7_MAX_NC for station mode rtl8xxxu: Fix device info for RTL8192EU devices MIPS: add PMD table accounting into MIPS'pmd_alloc_one net: fec: add ndo_select_queue to fix TX bandwidth fluctuations atm: nicstar: use 'dma_free_coherent' instead of 'kfree' atm: nicstar: register the interrupt handler in the right place vsock: notify server to shutdown when client has pending signal RDMA/rxe: Don't overwrite errno from ib_umem_get() iwlwifi: mvm: don't change band on bound PHY contexts iwlwifi: mvm: fix error print when session protection ends iwlwifi: pcie: free IML DMA memory allocation iwlwifi: pcie: fix context info freeing sfc: avoid double pci_remove of VFs sfc: error code if SRIOV cannot be disabled wireless: wext-spy: Fix out-of-bounds warning cfg80211: fix default HE tx bitrate mask in 2G band mac80211: consider per-CPU statistics if present mac80211_hwsim: add concurrent channels scanning support over virtio IB/isert: Align target max I/O size to initiator size media, bpf: Do not copy more entries than user space requested net: ip: avoid OOM kills with large UDP sends over loopback RDMA/cma: Fix rdma_resolve_route() memory leak Bluetooth: btusb: Fixed too many in-token issue for Mediatek Chip. Bluetooth: Fix the HCI to MGMT status conversion table Bluetooth: Fix alt settings for incoming SCO with transparent coding format Bluetooth: Shutdown controller after workqueues are flushed or cancelled Bluetooth: btusb: Add a new QCA_ROME device (0cf3:e500) Bluetooth: L2CAP: Fix invalid access if ECRED Reconfigure fails Bluetooth: L2CAP: Fix invalid access on ECRED Connection response Bluetooth: btusb: Add support USB ALT 3 for WBS Bluetooth: mgmt: Fix the command returns garbage parameter value Bluetooth: btusb: fix bt fiwmare downloading failure issue for qca btsoc. sched/fair: Ensure _sum and _avg values stay consistent bpf: Fix false positive kmemleak report in bpf_ringbuf_area_alloc() flow_offload: action should not be NULL when it is referenced sctp: validate from_addr_param return sctp: add size validation when walking chunks MIPS: loongsoon64: Reserve memory below starting pfn to prevent Oops MIPS: set mips32r5 for virt extensions selftests/resctrl: Fix incorrect parsing of option "-t" MIPS: MT extensions are not available on MIPS32r1 ath11k: unlock on error path in ath11k_mac_op_add_interface() arm64: dts: rockchip: add rk3328 dwc3 usb controller node arm64: dts: rockchip: Enable USB3 for rk3328 Rock64 loop: fix I/O error on fsync() in detached loop devices mm,hwpoison: return -EBUSY when migration fails io_uring: simplify io_remove_personalities() io_uring: Convert personality_idr to XArray io_uring: convert io_buffer_idr to XArray scsi: iscsi: Fix race condition between login and sync thread scsi: iscsi: Fix iSCSI cls conn state powerpc/mm: Fix lockup on kernel exec fault powerpc/barrier: Avoid collision with clang's __lwsync macro powerpc/powernv/vas: Release reference to tgid during window close drm/amdgpu: Update NV SIMD-per-CU to 2 drm/amdgpu: enable sdma0 tmz for Raven/Renoir(V2) drm/radeon: Add the missed drm_gem_object_put() in radeon_user_framebuffer_create() drm/radeon: Call radeon_suspend_kms() in radeon_pci_shutdown() for Loongson64 drm/vc4: txp: Properly set the possible_crtcs mask drm/vc4: crtc: Skip the TXP drm/vc4: hdmi: Prevent clock unbalance drm/dp: Handle zeroed port counts in drm_dp_read_downstream_info() drm/rockchip: dsi: remove extra component_del() call drm/amd/display: fix incorrrect valid irq check pinctrl/amd: Add device HID for new AMD GPIO controller drm/amd/display: Reject non-zero src_y and src_x for video planes drm/tegra: Don't set allow_fb_modifiers explicitly drm/msm/mdp4: Fix modifier support enabling drm/arm/malidp: Always list modifiers drm/nouveau: Don't set allow_fb_modifiers explicitly drm/i915/display: Do not zero past infoframes.vsc mmc: sdhci-acpi: Disable write protect detection on Toshiba Encore 2 WT8-B mmc: sdhci: Fix warning message when accessing RPMB in HS400 mode mmc: core: clear flags before allowing to retune mmc: core: Allow UHS-I voltage switch for SDSC cards if supported ata: ahci_sunxi: Disable DIPM arm64: tlb: fix the TTL value of tlb_get_level cpu/hotplug: Cure the cpusets trainwreck clocksource/arm_arch_timer: Improve Allwinner A64 timer workaround fpga: stratix10-soc: Add missing fpga_mgr_free() call ASoC: tegra: Set driver_name=tegra for all machine drivers i40e: fix PTP on 5Gb links qemu_fw_cfg: Make fw_cfg_rev_attr a proper kobj_attribute ipmi/watchdog: Stop watchdog timer when the current action is 'none' thermal/drivers/int340x/processor_thermal: Fix tcc setting ubifs: Fix races between xattr_{set|get} and listxattr operations power: supply: ab8500: Fix an old bug mfd: syscon: Free the allocated name field of struct regmap_config nvmem: core: add a missing of_node_put lkdtm/bugs: XFAIL UNALIGNED_LOAD_STORE_WRITE selftests/lkdtm: Fix expected text for CR4 pinning extcon: intel-mrfld: Sync hardware and software state on init seq_buf: Fix overflow in seq_buf_putmem_hex() rq-qos: fix missed wake-ups in rq_qos_throttle try two tracing: Simplify & fix saved_tgids logic tracing: Resize tgid_map to pid_max, not PID_MAX_DEFAULT ipack/carriers/tpci200: Fix a double free in tpci200_pci_probe coresight: Propagate symlink failure coresight: tmc-etf: Fix global-out-of-bounds in tmc_update_etf_buffer() dm zoned: check zone capacity dm writecache: flush origin device when writing and cache is full dm btree remove: assign new_root only when removal succeeds PCI: Leave Apple Thunderbolt controllers on for s2idle or standby PCI: aardvark: Fix checking for PIO Non-posted Request PCI: aardvark: Implement workaround for the readback value of VEND_ID media: subdev: disallow ioctl for saa6588/davinci media: dtv5100: fix control-request directions media: zr364xx: fix memory leak in zr364xx_start_readpipe media: gspca/sq905: fix control-request direction media: gspca/sunplus: fix zero-length control requests media: uvcvideo: Fix pixel format change for Elgato Cam Link 4K io_uring: fix clear IORING_SETUP_R_DISABLED in wrong function dm writecache: write at least 4k when committing pinctrl: mcp23s08: Fix missing unlock on error in mcp23s08_irq() drm/ast: Remove reference to struct drm_device.pdev jfs: fix GPF in diFree smackfs: restrict bytes count in smk_set_cipso() ext4: fix memory leak in ext4_fill_super f2fs: fix to avoid racing on fsync_entry_slab by multi filesystem instances Linux 5.10.51 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Icb10fed733a0050848ecc23db13ae3d134895acd	2021-07-19 17:29:53 +02:00
Tetsuo Handa	3780348c1a	smackfs: restrict bytes count in smk_set_cipso() ... commit 49ec114a6e upstream. Oops, I failed to update subject line. From 07571157c91b98ce1a4aa70967531e64b78e8346 Mon Sep 17 00:00:00 2001 From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Date: Mon, 12 Apr 2021 22:25:06 +0900 Subject: smackfs: restrict bytes count in smk_set_cipso() Commit 7ef4c19d24 ("smackfs: restrict bytes count in smackfs write functions") missed that count > SMK_CIPSOMAX check applies to only format == SMK_FIXED24_FMT case. Reported-by: syzbot <syzbot+77c53db50c9fff774e8e@syzkaller.appspotmail.com> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-07-19 09:45:03 +02:00
Minchan Kim	f38371821c	selinux: use __GFP_NOWARN with GFP_NOWAIT in the AVC ... [ Upstream commit 648f2c6100 ] In the field, we have seen lots of allocation failure from the call path below. 06-03 13:29:12.999 1010315 31557 31557 W Binder : 31542_2: page allocation failure: order:0, mode:0x800(GFP_NOWAIT), nodemask=(null),cpuset=background,mems_allowed=0 ... ... 06-03 13:29:12.999 1010315 31557 31557 W Call trace: 06-03 13:29:12.999 1010315 31557 31557 W : dump_backtrace.cfi_jt+0x0/0x8 06-03 13:29:12.999 1010315 31557 31557 W : dump_stack+0xc8/0x14c 06-03 13:29:12.999 1010315 31557 31557 W : warn_alloc+0x158/0x1c8 06-03 13:29:12.999 1010315 31557 31557 W : __alloc_pages_slowpath+0x9d8/0xb80 06-03 13:29:12.999 1010315 31557 31557 W : __alloc_pages_nodemask+0x1c4/0x430 06-03 13:29:12.999 1010315 31557 31557 W : allocate_slab+0xb4/0x390 06-03 13:29:12.999 1010315 31557 31557 W : ___slab_alloc+0x12c/0x3a4 06-03 13:29:12.999 1010315 31557 31557 W : kmem_cache_alloc+0x358/0x5e4 06-03 13:29:12.999 1010315 31557 31557 W : avc_alloc_node+0x30/0x184 06-03 13:29:12.999 1010315 31557 31557 W : avc_update_node+0x54/0x4f0 06-03 13:29:12.999 1010315 31557 31557 W : avc_has_extended_perms+0x1a4/0x460 06-03 13:29:12.999 1010315 31557 31557 W : selinux_file_ioctl+0x320/0x3d0 06-03 13:29:12.999 1010315 31557 31557 W : __arm64_sys_ioctl+0xec/0x1fc 06-03 13:29:12.999 1010315 31557 31557 W : el0_svc_common+0xc0/0x24c 06-03 13:29:12.999 1010315 31557 31557 W : el0_svc+0x28/0x88 06-03 13:29:12.999 1010315 31557 31557 W : el0_sync_handler+0x8c/0xf0 06-03 13:29:12.999 1010315 31557 31557 W : el0_sync+0x1a4/0x1c0 .. .. 06-03 13:29:12.999 1010315 31557 31557 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:12.999 1010315 31557 31557 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:12.999 1010315 31557 31557 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:12.999 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:12.999 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:12.999 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:12.999 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:12.999 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:12.999 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:12.999 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:12.999 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:12.999 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:13.000 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:13.000 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:13.000 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:13.000 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:13.000 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:13.000 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:13.000 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:13.000 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:13.000 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:13.000 10230 30892 30892 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:13.000 10230 30892 30892 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:13.000 10230 30892 30892 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:13.000 10230 30892 30892 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:13.000 10230 30892 30892 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 Based on [1], selinux is tolerate for failure of memory allocation. Then, use __GFP_NOWARN together. [1] 476accbe2f ("selinux: use GFP_NOWAIT in the AVC kmem_caches") Signed-off-by: Minchan Kim <minchan@kernel.org> [PM: subj fix, line wraps, normalized commit refs] Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-07-19 09:44:49 +02:00
Greg Kroah-Hartman	2df0fb4a4b	This is the 5.10.50 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmDu+1UACgkQONu9yGCS aT7jQRAAuLDi7ejk3JUameYFMzVXGAUE6yPs392/lWJzey7IBf+2uLqz4FzqqUHp U1GkEKJVaCacEfi0+rpi7BxNFljUdZdg/F/P68ARtAWPvwqAeJ4QIh5u3A682UUO 1M5h6e5/oY9F4kQIb5Kot04avqOeR6lTqrkA8jeP5h43ngyLWuS2d+5oOGmbCukS UgEaCC6CiKjcN51UUTj/fXMQ0X4IDHP5pD8rWwH0IvK0i7gduvk744un8LVB6aW1 rNV88C3BEFFtkPQh2XySnXM5Ok8kYlhFoTDsqlpeAX7pA8hiUPYBoRzTg0MJtPZn N1L/Yqhvxmn5xs9HAw7mDOo8E8NWXzsT5FvZVaBeiCgtdKmcPszylXqmSt1oiOb0 /EmkCWmlbG/3qWql24+LU4XP36iVPx32HQxAgg2XbnlNU5o0E1y2F98p6p/3JSWX NAjHtmg/MxueFQ+w8bDzhO8YzYn1dIU3V3qaXRvtpODrmaSYW+bwCyPtSjXe3/vL 604zb3dOg9+tD/gKqfRb/UPMu24nNll8M/gnSRci05/thmIxwtYudPwoLNSejDqr e+a8vejISfIyp41XrpYQbUeKs1WOA+A7vgx6CZrT791afiT+6UgC/ecQfg1NFxhs 8ayWpocaIszxyXxVGro1rfwZeQmTlbTCZ5wVdpn9sDPZfI7epts= =FCrA -----END PGP SIGNATURE----- Merge 5.10.50 into android12-5.10-lts Changes in 5.10.50 Bluetooth: hci_qca: fix potential GPF Bluetooth: btqca: Don't modify firmware contents in-place Bluetooth: Remove spurious error message ALSA: usb-audio: fix rate on Ozone Z90 USB headset ALSA: usb-audio: Fix OOB access at proc output ALSA: firewire-motu: fix stream format for MOTU 8pre FireWire ALSA: usb-audio: scarlett2: Fix wrong resume call ALSA: intel8x0: Fix breakage at ac97 clock measurement ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 450 G8 ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 445 G8 ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 630 G8 ALSA: hda/realtek: Add another ALC236 variant support ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook x360 830 G8 ALSA: hda/realtek: Improve fixup for HP Spectre x360 15-df0xxx ALSA: hda/realtek: Fix bass speaker DAC mapping for Asus UM431D ALSA: hda/realtek: Apply LED fixup for HP Dragonfly G1, too ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 830 G8 Notebook PC media: dvb-usb: fix wrong definition Input: usbtouchscreen - fix control-request directions net: can: ems_usb: fix use-after-free in ems_usb_disconnect() usb: gadget: eem: fix echo command packet response issue usb: renesas-xhci: Fix handling of unknown ROM state USB: cdc-acm: blacklist Heimann USB Appset device usb: dwc3: Fix debugfs creation flow usb: typec: Add the missed altmode_id_remove() in typec_register_altmode() xhci: solve a double free problem while doing s4 gfs2: Fix underflow in gfs2_page_mkwrite gfs2: Fix error handling in init_statfs ntfs: fix validity check for file name attribute selftests/lkdtm: Avoid needing explicit sub-shell copy_page_to_iter(): fix ITER_DISCARD case iov_iter_fault_in_readable() should do nothing in xarray case Input: joydev - prevent use of not validated data in JSIOCSBTNMAP ioctl crypto: nx - Fix memcpy() over-reading in nonce crypto: ccp - Annotate SEV Firmware file names arm_pmu: Fix write counter incorrect in ARMv7 big-endian mode ARM: dts: ux500: Fix LED probing ARM: dts: at91: sama5d4: fix pinctrl muxing btrfs: send: fix invalid path for unlink operations after parent orphanization btrfs: compression: don't try to compress if we don't have enough pages btrfs: clear defrag status of a root if starting transaction fails ext4: cleanup in-core orphan list if ext4_truncate() failed to get a transaction handle ext4: fix kernel infoleak via ext4_extent_header ext4: fix overflow in ext4_iomap_alloc() ext4: return error code when ext4_fill_flex_info() fails ext4: correct the cache_nr in tracepoint ext4_es_shrink_exit ext4: remove check for zero nr_to_scan in ext4_es_scan() ext4: fix avefreec in find_group_orlov ext4: use ext4_grp_locked_error in mb_find_extent can: bcm: delay release of struct bcm_op after synchronize_rcu() can: gw: synchronize rcu operations before removing gw job entry can: isotp: isotp_release(): omit unintended hrtimer restart on socket release can: j1939: j1939_sk_init(): set SOCK_RCU_FREE to call sk_destruct() after RCU is done can: peak_pciefd: pucan_handle_status(): fix a potential starvation issue in TX path mac80211: remove iwlwifi specific workaround that broke sta NDP tx SUNRPC: Fix the batch tasks count wraparound. SUNRPC: Should wake up the privileged task firstly. bus: mhi: Wait for M2 state during system resume mm/gup: fix try_grab_compound_head() race with split_huge_page() perf/smmuv3: Don't trample existing events with global filter KVM: nVMX: Handle split-lock #AC exceptions that happen in L2 KVM: PPC: Book3S HV: Workaround high stack usage with clang KVM: x86/mmu: Treat NX as used (not reserved) for all !TDP shadow MMUs KVM: x86/mmu: Use MMU's role to detect CR4.SMEP value in nested NPT walk s390/cio: dont call css_wait_for_slow_path() inside a lock s390: mm: Fix secure storage access exception handling f2fs: Prevent swap file in LFS mode clk: agilex/stratix10/n5x: fix how the bypass_reg is handled clk: agilex/stratix10: remove noc_clk clk: agilex/stratix10: fix bypass representation rtc: stm32: Fix unbalanced clk_disable_unprepare() on probe error path iio: frequency: adf4350: disable reg and clk on error in adf4350_probe() iio: light: tcs3472: do not free unallocated IRQ iio: ltr501: mark register holding upper 8 bits of ALS_DATA{0,1} and PS_DATA as volatile, too iio: ltr501: ltr559: fix initialization of LTR501_ALS_CONTR iio: ltr501: ltr501_read_ps(): add missing endianness conversion iio: accel: bma180: Fix BMA25x bandwidth register values serial: mvebu-uart: fix calculation of clock divisor serial: sh-sci: Stop dmaengine transfer in sci_stop_tx() serial_cs: Add Option International GSM-Ready 56K/ISDN modem serial_cs: remove wrong GLOBETROTTER.cis entry ath9k: Fix kernel NULL pointer dereference during ath_reset_internal() ssb: sdio: Don't overwrite const buffer if block_write fails rsi: Assign beacon rate settings to the correct rate_info descriptor field rsi: fix AP mode with WPA failure due to encrypted EAPOL tracing/histograms: Fix parsing of "sym-offset" modifier tracepoint: Add tracepoint_probe_register_may_exist() for BPF tracing seq_buf: Make trace_seq_putmem_hex() support data longer than 8 powerpc/stacktrace: Fix spurious "stale" traces in raise_backtrace_ipi() loop: Fix missing discard support when using LOOP_CONFIGURE evm: Execute evm_inode_init_security() only when an HMAC key is loaded evm: Refuse EVM_ALLOW_METADATA_WRITES only if an HMAC key is loaded fuse: Fix crash in fuse_dentry_automount() error path fuse: Fix crash if superblock of submount gets killed early fuse: Fix infinite loop in sget_fc() fuse: ignore PG_workingset after stealing fuse: check connected before queueing on fpq->io fuse: reject internal errno thermal/cpufreq_cooling: Update offline CPUs per-cpu thermal_pressure spi: Make of_register_spi_device also set the fwnode Add a reference to ucounts for each cred staging: media: rkvdec: fix pm_runtime_get_sync() usage count media: marvel-ccic: fix some issues when getting pm_runtime media: mdk-mdp: fix pm_runtime_get_sync() usage count media: s5p: fix pm_runtime_get_sync() usage count media: am437x: fix pm_runtime_get_sync() usage count media: sh_vou: fix pm_runtime_get_sync() usage count media: mtk-vcodec: fix PM runtime get logic media: s5p-jpeg: fix pm_runtime_get_sync() usage count media: sunxi: fix pm_runtime_get_sync() usage count media: sti/bdisp: fix pm_runtime_get_sync() usage count media: exynos4-is: fix pm_runtime_get_sync() usage count media: exynos-gsc: fix pm_runtime_get_sync() usage count spi: spi-loopback-test: Fix 'tx_buf' might be 'rx_buf' spi: spi-topcliff-pch: Fix potential double free in pch_spi_process_messages() spi: omap-100k: Fix the length judgment problem regulator: uniphier: Add missing MODULE_DEVICE_TABLE sched/core: Initialize the idle task with preemption disabled hwrng: exynos - Fix runtime PM imbalance on error crypto: nx - add missing MODULE_DEVICE_TABLE media: sti: fix obj-$(config) targets media: cpia2: fix memory leak in cpia2_usb_probe media: cobalt: fix race condition in setting HPD media: hevc: Fix dependent slice segment flags media: pvrusb2: fix warning in pvr2_i2c_core_done media: imx: imx7_mipi_csis: Fix logging of only error event counters crypto: qat - check return code of qat_hal_rd_rel_reg() crypto: qat - remove unused macro in FW loader crypto: qce: skcipher: Fix incorrect sg count for dma transfers arm64: perf: Convert snprintf to sysfs_emit sched/fair: Fix ascii art by relpacing tabs media: i2c: ov2659: Use clk_{prepare_enable,disable_unprepare}() to set xvclk on/off media: bt878: do not schedule tasklet when it is not setup media: em28xx: Fix possible memory leak of em28xx struct media: hantro: Fix .buf_prepare media: cedrus: Fix .buf_prepare media: v4l2-core: Avoid the dangling pointer in v4l2_fh_release media: bt8xx: Fix a missing check bug in bt878_probe media: st-hva: Fix potential NULL pointer dereferences crypto: hisilicon/sec - fixup 3des minimum key size declaration Makefile: fix GDB warning with CONFIG_RELR media: dvd_usb: memory leak in cinergyt2_fe_attach memstick: rtsx_usb_ms: fix UAF mmc: sdhci-sprd: use sdhci_sprd_writew mmc: via-sdmmc: add a check against NULL pointer dereference spi: meson-spicc: fix a wrong goto jump for avoiding memory leak. spi: meson-spicc: fix memory leak in meson_spicc_probe crypto: shash - avoid comparing pointers to exported functions under CFI media: dvb_net: avoid speculation from net slot media: siano: fix device register error path media: imx-csi: Skip first few frames from a BT.656 source hwmon: (max31790) Report correct current pwm duty cycles hwmon: (max31790) Fix pwmX_enable attributes drivers/perf: fix the missed ida_simple_remove() in ddr_perf_probe() KVM: PPC: Book3S HV: Fix TLB management on SMT8 POWER9 and POWER10 processors btrfs: fix error handling in __btrfs_update_delayed_inode btrfs: abort transaction if we fail to update the delayed inode btrfs: sysfs: fix format string for some discard stats btrfs: don't clear page extent mapped if we're not invalidating the full page btrfs: disable build on platforms having page size 256K locking/lockdep: Fix the dep path printing for backwards BFS lockding/lockdep: Avoid to find wrong lock dep path in check_irq_usage() KVM: s390: get rid of register asm usage regulator: mt6358: Fix vdram2 .vsel_mask regulator: da9052: Ensure enough delay time for .set_voltage_time_sel media: Fix Media Controller API config checks ACPI: video: use native backlight for GA401/GA502/GA503 HID: do not use down_interruptible() when unbinding devices EDAC/ti: Add missing MODULE_DEVICE_TABLE ACPI: processor idle: Fix up C-state latency if not ordered hv_utils: Fix passing zero to 'PTR_ERR' warning lib: vsprintf: Fix handling of number field widths in vsscanf Input: goodix - platform/x86: touchscreen_dmi - Move upside down quirks to touchscreen_dmi.c platform/x86: touchscreen_dmi: Add an extra entry for the upside down Goodix touchscreen on Teclast X89 tablets platform/x86: touchscreen_dmi: Add info for the Goodix GT912 panel of TM800A550L tablets ACPI: EC: Make more Asus laptops use ECDT _GPE block_dump: remove block_dump feature in mark_inode_dirty() blk-mq: grab rq->refcount before calling ->fn in blk_mq_tagset_busy_iter blk-mq: clear stale request in tags->rq[] before freeing one request pool fs: dlm: cancel work sync othercon random32: Fix implicit truncation warning in prandom_seed_state() open: don't silently ignore unknown O-flags in openat2() drivers: hv: Fix missing error code in vmbus_connect() fs: dlm: fix memory leak when fenced ACPICA: Fix memory leak caused by _CID repair function ACPI: bus: Call kobject_put() in acpi_init() error path ACPI: resources: Add checks for ACPI IRQ override block: fix race between adding/removing rq qos and normal IO platform/x86: asus-nb-wmi: Revert "Drop duplicate DMI quirk structures" platform/x86: asus-nb-wmi: Revert "add support for ASUS ROG Zephyrus G14 and G15" platform/x86: toshiba_acpi: Fix missing error code in toshiba_acpi_setup_keyboard() nvme-pci: fix var. type for increasing cq_head nvmet-fc: do not check for invalid target port in nvmet_fc_handle_fcp_rqst() EDAC/Intel: Do not load EDAC driver when running as a guest PCI: hv: Add check for hyperv_initialized in init_hv_pci_drv() cifs: improve fallocate emulation ACPI: EC: trust DSDT GPE for certain HP laptop clocksource: Retry clock read if long delays detected clocksource: Check per-CPU clock synchronization when marked unstable tpm_tis_spi: add missing SPI device ID entries ACPI: tables: Add custom DSDT file as makefile prerequisite HID: wacom: Correct base usage for capacitive ExpressKey status bits cifs: fix missing spinlock around update to ses->status mailbox: qcom: Use PLATFORM_DEVID_AUTO to register platform device block: fix discard request merge kthread_worker: fix return value when kthread_mod_delayed_work() races with kthread_cancel_delayed_work_sync() ia64: mca_drv: fix incorrect array size calculation writeback, cgroup: increment isw_nr_in_flight before grabbing an inode spi: Allow to have all native CSs in use along with GPIOs spi: Avoid undefined behaviour when counting unused native CSs media: venus: Rework error fail recover logic media: s5p_cec: decrement usage count if disabled media: hantro: do a PM resume earlier crypto: ixp4xx - dma_unmap the correct address crypto: ixp4xx - update IV after requests crypto: ux500 - Fix error return code in hash_hw_final() sata_highbank: fix deferred probing pata_rb532_cf: fix deferred probing media: I2C: change 'RST' to "RSET" to fix multiple build errors sched/uclamp: Fix wrong implementation of cpu.uclamp.min sched/uclamp: Fix locking around cpu_util_update_eff() kbuild: Fix objtool dependency for 'OBJECT_FILES_NON_STANDARD_<obj> := n' pata_octeon_cf: avoid WARN_ON() in ata_host_activate() evm: fix writing <securityfs>/evm overflow x86/elf: Use _BITUL() macro in UAPI headers crypto: sa2ul - Fix leaks on failure paths with sa_dma_init() crypto: sa2ul - Fix pm_runtime enable in sa_ul_probe() crypto: ccp - Fix a resource leak in an error handling path media: rc: i2c: Fix an error message pata_ep93xx: fix deferred probing locking/lockdep: Reduce LOCKDEP dependency list media: rkvdec: Fix .buf_prepare media: exynos4-is: Fix a use after free in isp_video_release media: au0828: fix a NULL vs IS_ERR() check media: tc358743: Fix error return code in tc358743_probe_of() media: gspca/gl860: fix zero-length control requests m68k: atari: Fix ATARI_KBD_CORE kconfig unmet dependency warning media: siano: Fix out-of-bounds warnings in smscore_load_firmware_family2() regulator: fan53880: Fix vsel_mask setting for FAN53880_BUCK crypto: nitrox - fix unchecked variable in nitrox_register_interrupts crypto: omap-sham - Fix PM reference leak in omap sham ops crypto: x86/curve25519 - fix cpu feature checking logic in mod_exit crypto: sm2 - remove unnecessary reset operations crypto: sm2 - fix a memory leak in sm2 mmc: usdhi6rol0: fix error return code in usdhi6_probe() arm64: consistently use reserved_pg_dir arm64/mm: Fix ttbr0 values stored in struct thread_info for software-pan media: subdev: remove VIDIOC_DQEVENT_TIME32 handling media: s5p-g2d: Fix a memory leak on ctx->fh.m2m_ctx hwmon: (lm70) Use device_get_match_data() hwmon: (lm70) Revert "hwmon: (lm70) Add support for ACPI" hwmon: (max31722) Remove non-standard ACPI device IDs hwmon: (max31790) Fix fan speed reporting for fan7..12 KVM: nVMX: Sync all PGDs on nested transition with shadow paging KVM: nVMX: Ensure 64-bit shift when checking VMFUNC bitmap KVM: nVMX: Don't clobber nested MMU's A/D status on EPTP switch KVM: x86/mmu: Fix return value in tdp_mmu_map_handle_target_level() perf/arm-cmn: Fix invalid pointer when access dtc object sharing the same IRQ number KVM: arm64: Don't zero the cycle count register when PMCR_EL0.P is set regulator: hi655x: Fix pass wrong pointer to config.driver_data btrfs: clear log tree recovering status if starting transaction fails x86/sev: Make sure IRQs are disabled while GHCB is active x86/sev: Split up runtime #VC handler for correct state tracking sched/rt: Fix RT utilization tracking during policy change sched/rt: Fix Deadline utilization tracking during policy change sched/uclamp: Fix uclamp_tg_restrict() lockdep: Fix wait-type for empty stack lockdep/selftests: Fix selftests vs PROVE_RAW_LOCK_NESTING spi: spi-sun6i: Fix chipselect/clock bug crypto: nx - Fix RCU warning in nx842_OF_upd_status psi: Fix race between psi_trigger_create/destroy media: v4l2-async: Clean v4l2_async_notifier_add_fwnode_remote_subdev media: video-mux: Skip dangling endpoints PM / devfreq: Add missing error code in devfreq_add_device() ACPI: PM / fan: Put fan device IDs into separate header file block: avoid double io accounting for flush request nvme-pci: look for StorageD3Enable on companion ACPI device instead ACPI: sysfs: Fix a buffer overrun problem with description_show() mark pstore-blk as broken clocksource/drivers/timer-ti-dm: Save and restore timer TIOCP_CFG extcon: extcon-max8997: Fix IRQ freeing at error path ACPI: APEI: fix synchronous external aborts in user-mode blk-wbt: introduce a new disable state to prevent false positive by rwb_enabled() blk-wbt: make sure throttle is enabled properly ACPI: Use DEVICE_ATTR_<RW|RO|WO> macros ACPI: bgrt: Fix CFI violation cpufreq: Make cpufreq_online() call driver->offline() on errors blk-mq: update hctx->dispatch_busy in case of real scheduler ocfs2: fix snprintf() checking dax: fix ENOMEM handling in grab_mapping_entry() mm/debug_vm_pgtable/basic: add validation for dirtiness after write protect mm/debug_vm_pgtable/basic: iterate over entire protection_map[] mm/debug_vm_pgtable: ensure THP availability via has_transparent_hugepage() swap: fix do_swap_page() race with swapoff mm/shmem: fix shmem_swapin() race with swapoff mm: memcg/slab: properly set up gfp flags for objcg pointer array mm: page_alloc: refactor setup_per_zone_lowmem_reserve() mm/page_alloc: fix counting of managed_pages xfrm: xfrm_state_mtu should return at least 1280 for ipv6 drm/bridge/sii8620: fix dependency on extcon drm/bridge: Fix the stop condition of drm_bridge_chain_pre_enable() drm/amd/dc: Fix a missing check bug in dm_dp_mst_detect() drm/ast: Fix missing conversions to managed API video: fbdev: imxfb: Fix an error message net: mvpp2: Put fwnode in error case during ->probe() net: pch_gbe: Propagate error from devm_gpio_request_one() pinctrl: renesas: r8a7796: Add missing bias for PRESET# pin pinctrl: renesas: r8a77990: JTAG pins do not have pull-down capabilities drm/vmwgfx: Mark a surface gpu-dirty after the SVGA3dCmdDXGenMips command drm/vmwgfx: Fix cpu updates of coherent multisample surfaces net: qrtr: ns: Fix error return code in qrtr_ns_init() clk: meson: g12a: fix gp0 and hifi ranges net: ftgmac100: add missing error return code in ftgmac100_probe() drm: rockchip: set alpha_en to 0 if it is not used drm/rockchip: cdn-dp-core: add missing clk_disable_unprepare() on error in cdn_dp_grf_write() drm/rockchip: dsi: move all lane config except LCDC mux to bind() drm/rockchip: lvds: Fix an error handling path drm/rockchip: cdn-dp: fix sign extension on an int multiply for a u64 result mptcp: fix pr_debug in mptcp_token_new_connect mptcp: generate subflow hmac after mptcp_finish_join() RDMA/srp: Fix a recently introduced memory leak RDMA/rtrs-clt: Check state of the rtrs_clt_sess before reading its stats RDMA/rtrs: Do not reset hb_missed_max after re-connection RDMA/rtrs-srv: Fix memory leak of unfreed rtrs_srv_stats object RDMA/rtrs-srv: Fix memory leak when having multiple sessions RDMA/rtrs-clt: Check if the queue_depth has changed during a reconnection RDMA/rtrs-clt: Fix memory leak of not-freed sess->stats and stats->pcpu_stats ehea: fix error return code in ehea_restart_qps() clk: tegra30: Use 300MHz for video decoder by default xfrm: remove the fragment check for ipv6 beet mode net/sched: act_vlan: Fix modify to allow 0 RDMA/core: Sanitize WQ state received from the userspace drm/pl111: depend on CONFIG_VEXPRESS_CONFIG RDMA/rxe: Fix failure during driver load drm/pl111: Actually fix CONFIG_VEXPRESS_CONFIG depends drm/vc4: hdmi: Fix error path of hpd-gpios clk: vc5: fix output disabling when enabling a FOD drm: qxl: ensure surf.data is ininitialized tools/bpftool: Fix error return code in do_batch() ath10k: go to path err_unsupported when chip id is not supported ath10k: add missing error return code in ath10k_pci_probe() wireless: carl9170: fix LEDS build errors & warnings ieee802154: hwsim: Fix possible memory leak in hwsim_subscribe_all_others clk: imx8mq: remove SYS PLL 1/2 clock gates wcn36xx: Move hal_buf allocation to devm_kmalloc in probe ssb: Fix error return code in ssb_bus_scan() brcmfmac: fix setting of station info chains bitmask brcmfmac: correctly report average RSSI in station info brcmfmac: Fix a double-free in brcmf_sdio_bus_reset brcmsmac: mac80211_if: Fix a resource leak in an error handling path cw1200: Revert unnecessary patches that fix unreal use-after-free bugs ath11k: Fix an error handling path in ath11k_core_fetch_board_data_api_n() ath10k: Fix an error code in ath10k_add_interface() ath11k: send beacon template after vdev_start/restart during csa netlabel: Fix memory leak in netlbl_mgmt_add_common RDMA/mlx5: Don't add slave port to unaffiliated list netfilter: nft_exthdr: check for IPv6 packet before further processing netfilter: nft_osf: check for TCP packet before further processing netfilter: nft_tproxy: restrict support to TCP and UDP transport protocols RDMA/rxe: Fix qp reference counting for atomic ops selftests/bpf: Whitelist test_progs.h from .gitignore xsk: Fix missing validation for skb and unaligned mode xsk: Fix broken Tx ring validation bpf: Fix libelf endian handling in resolv_btfids RDMA/rtrs-srv: Set minimal max_send_wr and max_recv_wr samples/bpf: Fix Segmentation fault for xdp_redirect command samples/bpf: Fix the error return code of xdp_redirect's main() mt76: fix possible NULL pointer dereference in mt76_tx mt76: mt7615: fix NULL pointer dereference in tx_prepare_skb() net: ethernet: aeroflex: fix UAF in greth_of_remove net: ethernet: ezchip: fix UAF in nps_enet_remove net: ethernet: ezchip: fix error handling vrf: do not push non-ND strict packets with a source LLA through packet taps again net: sched: add barrier to ensure correct ordering for lockless qdisc tls: prevent oversized sendfile() hangs by ignoring MSG_MORE netfilter: nf_tables_offload: check FLOW_DISSECTOR_KEY_BASIC in VLAN transfer logic pkt_sched: sch_qfq: fix qfq_change_class() error path xfrm: Fix xfrm offload fallback fail case iwlwifi: increase PNVM load timeout rtw88: 8822c: fix lc calibration timing vxlan: add missing rcu_read_lock() in neigh_reduce() ip6_tunnel: fix GRE6 segmentation net/ipv4: swap flow ports when validating source net: ti: am65-cpsw-nuss: Fix crash when changing number of TX queues tc-testing: fix list handling ieee802154: hwsim: Fix memory leak in hwsim_add_one ieee802154: hwsim: avoid possible crash in hwsim_del_edge_nl() bpf: Fix null ptr deref with mixed tail calls and subprogs drm/msm: Fix error return code in msm_drm_init() drm/msm/dpu: Fix error return code in dpu_mdss_init() mac80211: remove iwlwifi specific workaround NDPs of null_response net: bcmgenet: Fix attaching to PYH failed on RPi 4B ipv6: exthdrs: do not blindly use init_net can: j1939: j1939_sk_setsockopt(): prevent allocation of j1939 filter for optlen == 0 bpf: Do not change gso_size during bpf_skb_change_proto() i40e: Fix error handling in i40e_vsi_open i40e: Fix autoneg disabling for non-10GBaseT links i40e: Fix missing rtnl locking when setting up pf switch Revert "ibmvnic: remove duplicate napi_schedule call in open function" ibmvnic: set ltb->buff to NULL after freeing ibmvnic: free tx_pool if tso_pool alloc fails RDMA/cma: Protect RMW with qp_mutex net: macsec: fix the length used to copy the key for offloading net: phy: mscc: fix macsec key length net: atlantic: fix the macsec key length ipv6: fix out-of-bound access in ip6_parse_tlv() e1000e: Check the PCIm state net: dsa: sja1105: fix NULL pointer dereference in sja1105_reload_cbs() bpfilter: Specify the log level for the kmsg message RDMA/cma: Fix incorrect Packet Lifetime calculation gve: Fix swapped vars when fetching max queues Revert "be2net: disable bh with spin_lock in be_process_mcc" Bluetooth: mgmt: Fix slab-out-of-bounds in tlv_data_is_valid Bluetooth: Fix not sending Set Extended Scan Response Bluetooth: Fix Set Extended (Scan Response) Data Bluetooth: Fix handling of HCI_LE_Advertising_Set_Terminated event clk: actions: Fix UART clock dividers on Owl S500 SoC clk: actions: Fix SD clocks factor table on Owl S500 SoC clk: actions: Fix bisp_factor_table based clocks on Owl S500 SoC clk: actions: Fix AHPPREDIV-H-AHB clock chain on Owl S500 SoC clk: qcom: clk-alpha-pll: fix CAL_L write in alpha_pll_fabia_prepare clk: si5341: Wait for DEVICE_READY on startup clk: si5341: Avoid divide errors due to bogus register contents clk: si5341: Check for input clock presence and PLL lock on startup clk: si5341: Update initialization magic writeback: fix obtain a reference to a freeing memcg css net: lwtunnel: handle MTU calculation in forwading net: sched: fix warning in tcindex_alloc_perfect_hash net: tipc: fix FB_MTU eat two pages RDMA/mlx5: Don't access NULL-cleared mpi pointer RDMA/core: Always release restrack object MIPS: Fix PKMAP with 32-bit MIPS huge page support staging: fbtft: Rectify GPIO handling staging: fbtft: Don't spam logs when probe is deferred ASoC: rt5682: Disable irq on shutdown rcu: Invoke rcu_spawn_core_kthreads() from rcu_spawn_gp_kthread() serial: fsl_lpuart: don't modify arbitrary data on lpuart32 serial: fsl_lpuart: remove RTSCTS handling from get_mctrl() serial: 8250_omap: fix a timeout loop condition tty: nozomi: Fix a resource leak in an error handling function mwifiex: re-fix for unaligned accesses iio: adis_buffer: do not return ints in irq handlers iio: adis16400: do not return ints in irq handlers iio: adis16475: do not return ints in irq handlers iio: accel: bma180: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: accel: bma220: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: accel: hid: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: accel: kxcjk-1013: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: accel: mxc4005: Fix overread of data and alignment issue. iio: accel: stk8312: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: accel: stk8ba50: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: adc: ti-ads1015: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: adc: vf610: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: gyro: bmg160: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: humidity: am2315: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: prox: srf08: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: prox: pulsed-light: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: prox: as3935: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: magn: hmc5843: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: magn: bmc150: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: light: isl29125: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: light: tcs3414: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: light: tcs3472: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: chemical: atlas: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: cros_ec_sensors: Fix alignment of buffer in iio_push_to_buffers_with_timestamp() iio: potentiostat: lmp91000: Fix alignment of buffer in iio_push_to_buffers_with_timestamp() ASoC: rk3328: fix missing clk_disable_unprepare() on error in rk3328_platform_probe() ASoC: hisilicon: fix missing clk_disable_unprepare() on error in hi6210_i2s_startup() backlight: lm3630a_bl: Put fwnode in error case during ->probe() ASoC: rsnd: tidyup loop on rsnd_adg_clk_query() Input: hil_kbd - fix error return code in hil_dev_connect() perf scripting python: Fix tuple_set_u64() mtd: partitions: redboot: seek fis-index-block in the right node mtd: rawnand: arasan: Ensure proper configuration for the asserted target staging: mmal-vchiq: Fix incorrect static vchiq_instance. char: pcmcia: error out if 'num_bytes_read' is greater than 4 in set_protocol() firmware: stratix10-svc: Fix a resource leak in an error handling path tty: nozomi: Fix the error handling path of 'nozomi_card_init()' leds: class: The -ENOTSUPP should never be seen by user space leds: lm3532: select regmap I2C API leds: lm36274: Put fwnode in error case during ->probe() leds: lm3692x: Put fwnode in any case during ->probe() leds: lm3697: Don't spam logs when probe is deferred leds: lp50xx: Put fwnode in error case during ->probe() scsi: FlashPoint: Rename si_flags field scsi: iscsi: Flush block work before unblock mfd: mp2629: Select MFD_CORE to fix build error mfd: rn5t618: Fix IRQ trigger by changing it to level mode fsi: core: Fix return of error values on failures fsi: scom: Reset the FSI2PIB engine for any error fsi: occ: Don't accept response from un-initialized OCC fsi/sbefifo: Clean up correct FIFO when receiving reset request from SBE fsi/sbefifo: Fix reset timeout visorbus: fix error return code in visorchipset_init() iommu/amd: Fix extended features logging s390/irq: select HAVE_IRQ_EXIT_ON_IRQ_STACK s390: enable HAVE_IOREMAP_PROT s390: appldata depends on PROC_SYSCTL selftests: splice: Adjust for handler fallback removal iommu/dma: Fix IOVA reserve dma ranges ASoC: max98373-sdw: use first_hw_init flag on resume ASoC: rt1308-sdw: use first_hw_init flag on resume ASoC: rt5682-sdw: use first_hw_init flag on resume ASoC: rt700-sdw: use first_hw_init flag on resume ASoC: rt711-sdw: use first_hw_init flag on resume ASoC: rt715-sdw: use first_hw_init flag on resume ASoC: rt5682: fix getting the wrong device id when the suspend_stress_test ASoC: rt5682-sdw: set regcache_cache_only false before reading RT5682_DEVICE_ID ASoC: mediatek: mtk-btcvsd: Fix an error handling path in 'mtk_btcvsd_snd_probe()' usb: gadget: f_fs: Fix setting of device and driver data cross-references usb: dwc2: Don't reset the core after setting turnaround time eeprom: idt_89hpesx: Put fwnode in matching case during ->probe() eeprom: idt_89hpesx: Restore printing the unsupported fwnode name thunderbolt: Bond lanes only when dual_link_port != NULL in alloc_dev_default() iio: adc: at91-sama5d2: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: adc: hx711: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: adc: mxs-lradc: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: adc: ti-ads8688: Fix alignment of buffer in iio_push_to_buffers_with_timestamp() iio: magn: rm3100: Fix alignment of buffer in iio_push_to_buffers_with_timestamp() iio: light: vcnl4000: Fix buffer alignment in iio_push_to_buffers_with_timestamp() ASoC: fsl_spdif: Fix error handler with pm_runtime_enable staging: gdm724x: check for buffer overflow in gdm_lte_multi_sdu_pkt() staging: gdm724x: check for overflow in gdm_lte_netif_rx() staging: rtl8712: fix error handling in r871xu_drv_init staging: rtl8712: fix memory leak in rtl871x_load_fw_cb coresight: core: Fix use of uninitialized pointer staging: mt7621-dts: fix pci address for PCI memory range serial: 8250: Actually allow UPF_MAGIC_MULTIPLIER baud rates iio: light: vcnl4035: Fix buffer alignment in iio_push_to_buffers_with_timestamp() iio: prox: isl29501: Fix buffer alignment in iio_push_to_buffers_with_timestamp() ASoC: cs42l42: Correct definition of CS42L42_ADC_PDN_MASK of: Fix truncation of memory sizes on 32-bit platforms mtd: rawnand: marvell: add missing clk_disable_unprepare() on error in marvell_nfc_resume() habanalabs: Fix an error handling path in 'hl_pci_probe()' scsi: mpt3sas: Fix error return value in _scsih_expander_add() soundwire: stream: Fix test for DP prepare complete phy: uniphier-pcie: Fix updating phy parameters phy: ti: dm816x: Fix the error handling path in 'dm816x_usb_phy_probe() extcon: sm5502: Drop invalid register write in sm5502_reg_data extcon: max8997: Add missing modalias string powerpc/powernv: Fix machine check reporting of async store errors ASoC: atmel-i2s: Fix usage of capture and playback at the same time configfs: fix memleak in configfs_release_bin_file ASoC: Intel: sof_sdw: add SOF_RT715_DAI_ID_FIX for AlderLake ASoC: fsl_spdif: Fix unexpected interrupt after suspend leds: as3645a: Fix error return code in as3645a_parse_node() leds: ktd2692: Fix an error handling path selftests/ftrace: fix event-no-pid on 1-core machine serial: 8250: 8250_omap: Disable RX interrupt after DMA enable serial: 8250: 8250_omap: Fix possible interrupt storm on K3 SoCs powerpc: Offline CPU in stop_this_cpu() powerpc/papr_scm: Properly handle UUID types and API powerpc/64s: Fix copy-paste data exposure into newly created tasks powerpc/papr_scm: Make 'perf_stats' invisible if perf-stats unavailable ALSA: firewire-lib: Fix 'amdtp_domain_start()' when no AMDTP_OUT_STREAM stream is found serial: mvebu-uart: do not allow changing baudrate when uartclk is not available serial: mvebu-uart: correctly calculate minimal possible baudrate arm64: dts: marvell: armada-37xx: Fix reg for standard variant of UART vfio/pci: Handle concurrent vma faults mm/pmem: avoid inserting hugepage PTE entry with fsdax if hugepage support is disabled mm/huge_memory.c: remove dedicated macro HPAGE_CACHE_INDEX_MASK mm/huge_memory.c: add missing read-only THP checking in transparent_hugepage_enabled() mm/huge_memory.c: don't discard hugepage if other processes are mapping it mm/hugetlb: use helper huge_page_order and pages_per_huge_page mm/hugetlb: remove redundant check in preparing and destroying gigantic page hugetlb: remove prep_compound_huge_page cleanup include/linux/huge_mm.h: remove extern keyword mm/z3fold: fix potential memory leak in z3fold_destroy_pool() mm/z3fold: use release_z3fold_page_locked() to release locked z3fold page lib/math/rational.c: fix divide by zero selftests/vm/pkeys: fix alloc_random_pkey() to make it really, really random selftests/vm/pkeys: handle negative sys_pkey_alloc() return code selftests/vm/pkeys: refill shadow register after implicit kernel write perf llvm: Return -ENOMEM when asprintf() fails csky: fix syscache.c fallthrough warning csky: syscache: Fixup duplicate cache flush exfat: handle wrong stream entry size in exfat_readdir() scsi: fc: Correct RHBA attributes length scsi: target: cxgbit: Unmap DMA buffer before calling target_execute_cmd() mailbox: qcom-ipcc: Fix IPCC mbox channel exhaustion fscrypt: don't ignore minor_hash when hash is 0 fscrypt: fix derivation of SipHash keys on big endian CPUs tpm: Replace WARN_ONCE() with dev_err_once() in tpm_tis_status() erofs: fix error return code in erofs_read_superblock() block: return the correct bvec when checking for gaps io_uring: fix blocking inline submission mmc: block: Disable CMDQ on the ioctl path mmc: vub3000: fix control-request direction media: exynos4-is: remove a now unused integer scsi: core: Retry I/O for Notify (Enable Spinup) Required error crypto: qce - fix error return code in qce_skcipher_async_req_handle() s390: preempt: Fix preempt_count initialization cred: add missing return error code when set_cred_ucounts() failed iommu/dma: Fix compile warning in 32-bit builds powerpc/preempt: Don't touch the idle task's preempt_count during hotplug Linux 5.10.50 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Iec4eab24ea8eb5a6d79739a1aec8432d93a8f82c	2021-07-14 17:35:23 +02:00
Mimi Zohar	912d16a2d7	evm: fix writing <securityfs>/evm overflow ... [ Upstream commit 49219d9b87 ] EVM_SETUP_COMPLETE is defined as 0x80000000, which is larger than INT_MAX. The "-fno-strict-overflow" compiler option properly prevents signaling EVM that the EVM policy setup is complete. Define and read an unsigned int. Fixes: f00d797507 ("EVM: Allow userspace to signal an RSA key has been loaded") Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-07-14 16:56:04 +02:00
Roberto Sassu	53124265fc	evm: Refuse EVM_ALLOW_METADATA_WRITES only if an HMAC key is loaded ... commit 9acc89d31f upstream. EVM_ALLOW_METADATA_WRITES is an EVM initialization flag that can be set to temporarily disable metadata verification until all xattrs/attrs necessary to verify an EVM portable signature are copied to the file. This flag is cleared when EVM is initialized with an HMAC key, to avoid that the HMAC is calculated on unverified xattrs/attrs. Currently EVM unnecessarily denies setting this flag if EVM is initialized with a public key, which is not a concern as it cannot be used to trust xattrs/attrs updates. This patch removes this limitation. Fixes: ae1ba1676b ("EVM: Allow userland to permit modification of EVM-protected metadata") Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> Cc: stable@vger.kernel.org # 4.16.x Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-07-14 16:55:46 +02:00
Roberto Sassu	7b84c7d7e2	evm: Execute evm_inode_init_security() only when an HMAC key is loaded ... commit 9eea290429 upstream. evm_inode_init_security() requires an HMAC key to calculate the HMAC on initial xattrs provided by LSMs. However, it checks generically whether a key has been loaded, including also public keys, which is not correct as public keys are not suitable to calculate the HMAC. Originally, support for signature verification was introduced to verify a possibly immutable initial ram disk, when no new files are created, and to switch to HMAC for the root filesystem. By that time, an HMAC key should have been loaded and usable to calculate HMACs for new files. More recently support for requiring an HMAC key was removed from the kernel, so that signature verification can be used alone. Since this is a legitimate use case, evm_inode_init_security() should not return an error when no HMAC key has been loaded. This patch fixes this problem by replacing the evm_key_loaded() check with a check of the EVM_INIT_HMAC flag in evm_initialized. Fixes: 26ddabfe96 ("evm: enable EVM when X509 certificate is loaded") Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> Cc: stable@vger.kernel.org # 4.5.x Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-07-14 16:55:46 +02:00
Greg Kroah-Hartman	194be71cc6	Linux 5.10.47 ... -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE4n5dijQDou9mhzu83qZv95d3LNwFAmDcbDgACgkQ3qZv95d3 LNwUuQ//VDlmBPk/3w1FYvg9N9q/t1GHkVJXmD8TY/ClLdJtgxPYeoRu1VNLR/xf Y2kwZEF07yMA88RME56Zwt3p+LBbacrp5MoNdzEA48kb7auGBPk1HIscBg2PXC+C AnlC/O4/NAW6Okb+lLFL7XFM4xrlDBkNr5yTz2HmQSQC3JFfov0FcrON3KKTL5Bi aeyWjhn1NnhkKCDaKUl7kKlCQ2x7buu/YmvJK2OdGmuLZVywzto76RS+Xx3X0CnK pPkmciZSS7Gxi6UJel/zza0UwlKg5+IhFzfYVt0nsTFMjk/4QStAoevu7TFnbVD3 yM7nzJpAQmVLs/X9sC0rgg9rCBUyp9d4ddba8bCUqaxpPQfMObWI8S5F8tfzBnK/ h8P5xfs8u4O1AzpRr+YSN2Hbvak47e/4c5UOvvYj6z8NaIEb7DGbaUv/JE5YRVZ0 ZEVZ1auEpHcSVAGz6DUwuwzc8Rk0NdskES5DD53QxNLXDoF1CVdsD44xUuJH1/HA //3S1SWxvwF9UQ+w+sk/Z6pzUj+CdFigou3QzwB+vAZ04n0JawRSuqyijkCqFOP5 88iCMgxZ5qAYJ1TzQ6gV7cA0tSbteBF/HERNmdadyGvse9KtxkaBAfFmvIpd9D8J fTepYVuneP9cGqaGDUtsqHzM5YLrIkCSxABjgIvpNTt0eJL5c2k= =TKhf -----END PGP SIGNATURE----- Merge 5.10.47 into android12-5.10-lts Changes in 5.10.47 module: limit enabling module.sig_enforce Revert "drm/amdgpu/gfx9: fix the doorbell missing when in CGPG issue." Revert "drm/amdgpu/gfx10: enlarge CP_MEC_DOORBELL_RANGE_UPPER to cover full doorbell." drm: add a locked version of drm_is_current_master drm/nouveau: wait for moving fence after pinning v2 drm/radeon: wait for moving fence after pinning drm/amdgpu: wait for moving fence after pinning ARM: 9081/1: fix gcc-10 thumb2-kernel regression mmc: meson-gx: use memcpy_to/fromio for dram-access-quirk MIPS: generic: Update node names to avoid unit addresses arm64: Ignore any DMA offsets in the max_zone_phys() calculation arm64: Force NO_BLOCK_MAPPINGS if crashkernel reservation is required spi: spi-nxp-fspi: move the register operation after the clock enable Revert "PCI: PM: Do not read power state in pci_enable_device_flags()" drm/vc4: hdmi: Move the HSM clock enable to runtime_pm drm/vc4: hdmi: Make sure the controller is powered in detect x86/entry: Fix noinstr fail in __do_fast_syscall_32() x86/xen: Fix noinstr fail in exc_xen_unknown_trap() locking/lockdep: Improve noinstr vs errors perf/x86/lbr: Remove cpuc->lbr_xsave allocation from atomic context perf/x86/intel/lbr: Zero the xstate buffer on allocation dmaengine: zynqmp_dma: Fix PM reference leak in zynqmp_dma_alloc_chan_resourc() dmaengine: stm32-mdma: fix PM reference leak in stm32_mdma_alloc_chan_resourc() dmaengine: xilinx: dpdma: Add missing dependencies to Kconfig dmaengine: xilinx: dpdma: Limit descriptor IDs to 16 bits mac80211: remove warning in ieee80211_get_sband() mac80211_hwsim: drop pending frames on stop cfg80211: call cfg80211_leave_ocb when switching away from OCB dmaengine: rcar-dmac: Fix PM reference leak in rcar_dmac_probe() dmaengine: mediatek: free the proper desc in desc_free handler dmaengine: mediatek: do not issue a new desc if one is still current dmaengine: mediatek: use GFP_NOWAIT instead of GFP_ATOMIC in prep_dma net: ipv4: Remove unneed BUG() function mac80211: drop multicast fragments net: ethtool: clear heap allocations for ethtool function inet: annotate data race in inet_send_prepare() and inet_dgram_connect() ping: Check return value of function 'ping_queue_rcv_skb' net: annotate data race in sock_error() inet: annotate date races around sk->sk_txhash net/packet: annotate data race in packet_sendmsg() net: phy: dp83867: perform soft reset and retain established link riscv32: Use medany C model for modules net: caif: fix memory leak in ldisc_open net/packet: annotate accesses to po->bind net/packet: annotate accesses to po->ifindex r8152: Avoid memcpy() over-reading of ETH_SS_STATS sh_eth: Avoid memcpy() over-reading of ETH_SS_STATS r8169: Avoid memcpy() over-reading of ETH_SS_STATS KVM: selftests: Fix kvm_check_cap() assertion net: qed: Fix memcpy() overflow of qed_dcbx_params() mac80211: reset profile_periodicity/ema_ap mac80211: handle various extensible elements correctly recordmcount: Correct st_shndx handling PCI: Add AMD RS690 quirk to enable 64-bit DMA net: ll_temac: Add memory-barriers for TX BD access net: ll_temac: Avoid ndo_start_xmit returning NETDEV_TX_BUSY perf/x86: Track pmu in per-CPU cpu_hw_events pinctrl: stm32: fix the reported number of GPIO lines per bank i2c: i801: Ensure that SMBHSTSTS_INUSE_STS is cleared when leaving i801_access gpiolib: cdev: zero padding during conversion to gpioline_info_changed scsi: sd: Call sd_revalidate_disk() for ioctl(BLKRRPART) nilfs2: fix memory leak in nilfs_sysfs_delete_device_group s390/stack: fix possible register corruption with stack switch helper KVM: do not allow mapping valid but non-reference-counted pages i2c: robotfuzz-osif: fix control-request directions ceph: must hold snap_rwsem when filling inode for async create kthread_worker: split code for canceling the delayed work timer kthread: prevent deadlock when kthread_mod_delayed_work() races with kthread_cancel_delayed_work_sync() x86/fpu: Preserve supervisor states in sanitize_restored_user_xstate() x86/fpu: Make init_fpstate correct with optimized XSAVE mm: add VM_WARN_ON_ONCE_PAGE() macro mm/rmap: remove unneeded semicolon in page_not_mapped() mm/rmap: use page_not_mapped in try_to_unmap() mm, thp: use head page in __migration_entry_wait() mm/thp: fix __split_huge_pmd_locked() on shmem migration entry mm/thp: make is_huge_zero_pmd() safe and quicker mm/thp: try_to_unmap() use TTU_SYNC for safe splitting mm/thp: fix vma_address() if virtual address below file offset mm/thp: fix page_address_in_vma() on file THP tails mm/thp: unmap_mapping_page() to fix THP truncate_cleanup_page() mm: thp: replace DEBUG_VM BUG with VM_WARN when unmap fails for split mm: page_vma_mapped_walk(): use page for pvmw->page mm: page_vma_mapped_walk(): settle PageHuge on entry mm: page_vma_mapped_walk(): use pmde for *pvmw->pmd mm: page_vma_mapped_walk(): prettify PVMW_MIGRATION block mm: page_vma_mapped_walk(): crossing page table boundary mm: page_vma_mapped_walk(): add a level of indentation mm: page_vma_mapped_walk(): use goto instead of while (1) mm: page_vma_mapped_walk(): get vma_address_end() earlier mm/thp: fix page_vma_mapped_walk() if THP mapped by ptes mm/thp: another PVMW_SYNC fix in page_vma_mapped_walk() mm, futex: fix shared futex pgoff on shmem huge page KVM: SVM: Call SEV Guest Decommission if ASID binding fails swiotlb: manipulate orig_addr when tlb_addr has offset netfs: fix test for whether we can skip read when writing beyond EOF Revert "drm: add a locked version of drm_is_current_master" certs: Add EFI_CERT_X509_GUID support for dbx entries certs: Move load_system_certificate_list to a common function certs: Add ability to preload revocation certs integrity: Load mokx variables into the blacklist keyring Linux 5.10.47 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I68f731ad78a5db003c41093e4faf59f6f9f2e446	2021-06-30 19:38:46 +02:00
Eric Snowberg	1573d595e2	integrity: Load mokx variables into the blacklist keyring ... [ Upstream commit ebd9c2ae36 ] During boot the Secure Boot Forbidden Signature Database, dbx, is loaded into the blacklist keyring. Systems booted with shim have an equivalent Forbidden Signature Database called mokx. Currently mokx is only used by shim and grub, the contents are ignored by the kernel. Add the ability to load mokx into the blacklist keyring during boot. Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com> Suggested-by: James Bottomley <James.Bottomley@HansenPartnership.com> Signed-off-by: David Howells <dhowells@redhat.com> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> cc: keyrings@vger.kernel.org Link: https://lore.kernel.org/r/c33c8e3839a41e9654f41cc92c7231104931b1d7.camel@HansenPartnership.com/ Link: https://lore.kernel.org/r/20210122181054.32635-5-eric.snowberg@oracle.com/ # v5 Link: https://lore.kernel.org/r/161428674320.677100.12637282414018170743.stgit@warthog.procyon.org.uk/ Link: https://lore.kernel.org/r/161433313205.902181.2502803393898221637.stgit@warthog.procyon.org.uk/ # v2 Link: https://lore.kernel.org/r/161529607422.163428.13530426573612578854.stgit@warthog.procyon.org.uk/ # v3 Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-06-30 08:47:30 -04:00
Eric Snowberg	45109066f6	certs: Add EFI_CERT_X509_GUID support for dbx entries ... [ Upstream commit 56c5812623 ] This fixes CVE-2020-26541. The Secure Boot Forbidden Signature Database, dbx, contains a list of now revoked signatures and keys previously approved to boot with UEFI Secure Boot enabled. The dbx is capable of containing any number of EFI_CERT_X509_SHA256_GUID, EFI_CERT_SHA256_GUID, and EFI_CERT_X509_GUID entries. Currently when EFI_CERT_X509_GUID are contained in the dbx, the entries are skipped. Add support for EFI_CERT_X509_GUID dbx entries. When a EFI_CERT_X509_GUID is found, it is added as an asymmetrical key to the .blacklist keyring. Anytime the .platform keyring is used, the keys in the .blacklist keyring are referenced, if a matching key is found, the key will be rejected. [DH: Made the following changes: - Added to have a config option to enable the facility. This allows a Kconfig solution to make sure that pkcs7_validate_trust() is enabled.[1][2] - Moved the functions out from the middle of the blacklist functions. - Added kerneldoc comments.] Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com> Signed-off-by: David Howells <dhowells@redhat.com> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> cc: Randy Dunlap <rdunlap@infradead.org> cc: Mickaël Salaün <mic@digikod.net> cc: Arnd Bergmann <arnd@kernel.org> cc: keyrings@vger.kernel.org Link: https://lore.kernel.org/r/20200901165143.10295-1-eric.snowberg@oracle.com/ # rfc Link: https://lore.kernel.org/r/20200909172736.73003-1-eric.snowberg@oracle.com/ # v2 Link: https://lore.kernel.org/r/20200911182230.62266-1-eric.snowberg@oracle.com/ # v3 Link: https://lore.kernel.org/r/20200916004927.64276-1-eric.snowberg@oracle.com/ # v4 Link: https://lore.kernel.org/r/20210122181054.32635-2-eric.snowberg@oracle.com/ # v5 Link: https://lore.kernel.org/r/161428672051.677100.11064981943343605138.stgit@warthog.procyon.org.uk/ Link: https://lore.kernel.org/r/161433310942.902181.4901864302675874242.stgit@warthog.procyon.org.uk/ # v2 Link: https://lore.kernel.org/r/161529605075.163428.14625520893961300757.stgit@warthog.procyon.org.uk/ # v3 Link: https://lore.kernel.org/r/bc2c24e3-ed68-2521-0bf4-a1f6be4a895d@infradead.org/ [1] Link: https://lore.kernel.org/r/20210225125638.1841436-1-arnd@kernel.org/ [2] Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-06-30 08:47:30 -04:00
Bram Bonné	9d55580966	ANDROID: selinux: modify RTM_GETNEIGH{TBL} ... Map the permission gating RTM_GETNEIGH/RTM_GETNEIGHTBL messages to a new permission so that it can be distinguished from the other netlink route permissions in selinux policy. The new permission is triggered by a flag set in system images T and up. This change is intended to be backported to all kernels that a T system image can run on top of. Bug: 171572148 Test: atest NetworkInterfaceTest Test: atest CtsSelinuxTargetSdkCurrentTestCases Test: atest bionic-unit-tests-static Test: On Cuttlefish, run combinations of: - Policy bit set or omitted (see https://r.android.com/1701847) - This patch applied or omitted - App having nlmsg_readneigh permission or not Verify that only the combination of this patch + the policy bit being set + the app not having the nlmsg_readneigh permission prevents the app from sending RTM_GETNEIGH messages. Change-Id: I4bcfce4decb34ea9388eeedfc4be67403de8a980 Signed-off-by: Bram Bonné <brambonne@google.com> (cherry picked from commit fac07550bd)	2021-06-23 14:06:26 +00:00
Minchan Kim	46e579716d	FROMGIT: selinux: use __GFP_NOWARN with GFP_NOWAIT ... In the field, we have seen lots of allocation failure from the call path below. 06-03 13:29:12.999 1010315 31557 31557 W Binder : 31542_2: page allocation failure: order:0, mode:0x800(GFP_NOWAIT), nodemask=(null),cpuset=background,mems_allowed=0 ... ... 06-03 13:29:12.999 1010315 31557 31557 W Call trace: 06-03 13:29:12.999 1010315 31557 31557 W : dump_backtrace.cfi_jt+0x0/0x8 06-03 13:29:12.999 1010315 31557 31557 W : dump_stack+0xc8/0x14c 06-03 13:29:12.999 1010315 31557 31557 W : warn_alloc+0x158/0x1c8 06-03 13:29:12.999 1010315 31557 31557 W : __alloc_pages_slowpath+0x9d8/0xb80 06-03 13:29:12.999 1010315 31557 31557 W : __alloc_pages_nodemask+0x1c4/0x430 06-03 13:29:12.999 1010315 31557 31557 W : allocate_slab+0xb4/0x390 06-03 13:29:12.999 1010315 31557 31557 W : ___slab_alloc+0x12c/0x3a4 06-03 13:29:12.999 1010315 31557 31557 W : kmem_cache_alloc+0x358/0x5e4 06-03 13:29:12.999 1010315 31557 31557 W : avc_alloc_node+0x30/0x184 06-03 13:29:12.999 1010315 31557 31557 W : avc_update_node+0x54/0x4f0 06-03 13:29:12.999 1010315 31557 31557 W : avc_has_extended_perms+0x1a4/0x460 06-03 13:29:12.999 1010315 31557 31557 W : selinux_file_ioctl+0x320/0x3d0 06-03 13:29:12.999 1010315 31557 31557 W : __arm64_sys_ioctl+0xec/0x1fc 06-03 13:29:12.999 1010315 31557 31557 W : el0_svc_common+0xc0/0x24c 06-03 13:29:12.999 1010315 31557 31557 W : el0_svc+0x28/0x88 06-03 13:29:12.999 1010315 31557 31557 W : el0_sync_handler+0x8c/0xf0 06-03 13:29:12.999 1010315 31557 31557 W : el0_sync+0x1a4/0x1c0 .. .. 06-03 13:29:12.999 1010315 31557 31557 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:12.999 1010315 31557 31557 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:12.999 1010315 31557 31557 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:12.999 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:12.999 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:12.999 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:12.999 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:12.999 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:12.999 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:12.999 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:12.999 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:12.999 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:13.000 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:13.000 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:13.000 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:13.000 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:13.000 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:13.000 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:13.000 1010161 10686 10686 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:13.000 1010161 10686 10686 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:13.000 1010161 10686 10686 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:13.000 10230 30892 30892 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:13.000 10230 30892 30892 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 06-03 13:29:13.000 10230 30892 30892 W node 0 : slabs: 57, objs: 2907, free: 0 06-03 13:29:13.000 10230 30892 30892 W SLUB : Unable to allocate memory on node -1, gfp=0x900(GFP_NOWAIT|__GFP_ZERO) 06-03 13:29:13.000 10230 30892 30892 W cache : avc_node, object size: 72, buffer size: 80, default order: 0, min order: 0 Based on [1], selinux is tolerate for failure of memory allocation. Then, use __GFP_NOWARN together. [1] 476accbe2f, selinux: use GFP_NOWAIT in the AVC kmem_caches Signed-off-by: Minchan Kim <minchan@kernel.org> Signed-off-by: Minchan Kim <minchan@google.com> (cherry picked from commit 648f2c6100 https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux.git for next) Change-Id: I1d45e662363ace6131453f8854071e2ff018f445 Bug: 190615082	2021-06-18 11:01:08 -07:00
Greg Kroah-Hartman	76002c201f	Merge 5.10.38 into android12-5.10 ... Changes in 5.10.38 KEYS: trusted: Fix memory leak on object td tpm: fix error return code in tpm2_get_cc_attrs_tbl() tpm, tpm_tis: Extend locality handling to TPM2 in tpm_tis_gen_interrupt() tpm, tpm_tis: Reserve locality in tpm_tis_resume() KVM: x86/mmu: Remove the defunct update_pte() paging hook KVM/VMX: Invoke NMI non-IST entry instead of IST entry ACPI: PM: Add ACPI ID of Alder Lake Fan PM: runtime: Fix unpaired parent child_count for force_resume cpufreq: intel_pstate: Use HWP if enabled by platform firmware kvm: Cap halt polling at kvm->max_halt_poll_ns ath11k: fix thermal temperature read fs: dlm: fix debugfs dump fs: dlm: add errno handling to check callback fs: dlm: check on minimum msglen size fs: dlm: flush swork on shutdown tipc: convert dest node's address to network order ASoC: Intel: bytcr_rt5640: Enable jack-detect support on Asus T100TAF net/mlx5e: Use net_prefetchw instead of prefetchw in MPWQE TX datapath net: stmmac: Set FIFO sizes for ipq806x ASoC: rsnd: core: Check convert rate in rsnd_hw_params Bluetooth: Fix incorrect status handling in LE PHY UPDATE event i2c: bail out early when RDWR parameters are wrong ALSA: hdsp: don't disable if not enabled ALSA: hdspm: don't disable if not enabled ALSA: rme9652: don't disable if not enabled ALSA: bebob: enable to deliver MIDI messages for multiple ports Bluetooth: Set CONF_NOT_COMPLETE as l2cap_chan default Bluetooth: initialize skb_queue_head at l2cap_chan_create() net/sched: cls_flower: use ntohs for struct flow_dissector_key_ports net: bridge: when suppression is enabled exclude RARP packets Bluetooth: check for zapped sk before connecting selftests/powerpc: Fix L1D flushing tests for Power10 powerpc/32: Statically initialise first emergency context net: hns3: remediate a potential overflow risk of bd_num_list net: hns3: add handling for xmit skb with recursive fraglist ip6_vti: proper dev_{hold|put} in ndo_[un]init methods ASoC: Intel: bytcr_rt5640: Add quirk for the Chuwi Hi8 tablet ice: handle increasing Tx or Rx ring sizes Bluetooth: btusb: Enable quirk boolean flag for Mediatek Chip. ASoC: rt5670: Add a quirk for the Dell Venue 10 Pro 5055 i2c: Add I2C_AQ_NO_REP_START adapter quirk MIPS: Loongson64: Use _CACHE_UNCACHED instead of _CACHE_UNCACHED_ACCELERATED coresight: Do not scan for graph if none is present IB/hfi1: Correct oversized ring allocation mac80211: clear the beacon's CRC after channel switch pinctrl: samsung: use 'int' for register masks in Exynos rtw88: 8822c: add LC calibration for RTL8822C mt76: mt7615: support loading EEPROM for MT7613BE mt76: mt76x0: disable GTK offloading mt76: mt7915: fix txpower init for TSSI off chips fuse: invalidate attrs when page writeback completes virtiofs: fix userns cuse: prevent clone iwlwifi: pcie: make cfg vs. trans_cfg more robust powerpc/mm: Add cond_resched() while removing hpte mappings ASoC: rsnd: call rsnd_ssi_master_clk_start() from rsnd_ssi_init() Revert "iommu/amd: Fix performance counter initialization" iommu/amd: Remove performance counter pre-initialization test drm/amd/display: Force vsync flip when reconfiguring MPCC selftests: Set CC to clang in lib.mk if LLVM is set kconfig: nconf: stop endless search loops ALSA: hda/realtek: Add quirk for Lenovo Ideapad S740 ASoC: Intel: sof_sdw: add quirk for new ADL-P Rvp ALSA: hda/hdmi: fix race in handling acomp ELD notification at resume sctp: Fix out-of-bounds warning in sctp_process_asconf_param() flow_dissector: Fix out-of-bounds warning in __skb_flow_bpf_to_target() powerpc/smp: Set numa node before updating mask ASoC: rt286: Generalize support for ALC3263 codec ethtool: ioctl: Fix out-of-bounds warning in store_link_ksettings_for_user() net: sched: tapr: prevent cycle_time == 0 in parse_taprio_schedule samples/bpf: Fix broken tracex1 due to kprobe argument change powerpc/pseries: Stop calling printk in rtas_stop_self() drm/amd/display: fixed divide by zero kernel crash during dsc enablement drm/amd/display: add handling for hdcp2 rx id list validation drm/amdgpu: Add mem sync flag for IB allocated by SA mt76: mt7615: fix entering driver-own state on mt7663 crypto: ccp: Free SEV device if SEV init fails wl3501_cs: Fix out-of-bounds warnings in wl3501_send_pkt wl3501_cs: Fix out-of-bounds warnings in wl3501_mgmt_join qtnfmac: Fix possible buffer overflow in qtnf_event_handle_external_auth powerpc/iommu: Annotate nested lock for lockdep iavf: remove duplicate free resources calls net: ethernet: mtk_eth_soc: fix RX VLAN offload selftests: mlxsw: Increase the tolerance of backlog buildup selftests: mlxsw: Fix mausezahn invocation in ERSPAN scale test kbuild: generate Module.symvers only when vmlinux exists bnxt_en: Add PCI IDs for Hyper-V VF devices. ia64: module: fix symbolizer crash on fdescr watchdog: rename __touch_watchdog() to a better descriptive name watchdog: explicitly update timestamp when reporting softlockup watchdog/softlockup: remove logic that tried to prevent repeated reports watchdog: fix barriers when printing backtraces from all CPUs ASoC: rt286: Make RT286_SET_GPIO_* readable and writable thermal: thermal_of: Fix error return code of thermal_of_populate_bind_params() f2fs: move ioctl interface definitions to separated file f2fs: fix compat F2FS_IOC_{MOVE,GARBAGE_COLLECT}_RANGE f2fs: fix to allow migrating fully valid segment f2fs: fix panic during f2fs_resize_fs() f2fs: fix a redundant call to f2fs_balance_fs if an error occurs remoteproc: qcom_q6v5_mss: Replace ioremap with memremap remoteproc: qcom_q6v5_mss: Validate p_filesz in ELF loader PCI: iproc: Fix return value of iproc_msi_irq_domain_alloc() PCI: Release OF node in pci_scan_device()'s error path ARM: 9064/1: hw_breakpoint: Do not directly check the event's overflow_handler hook f2fs: fix to align to section for fallocate() on pinned file f2fs: fix to update last i_size if fallocate partially succeeds PCI: endpoint: Make *_get_first_free_bar() take into account 64 bit BAR PCI: endpoint: Add helper API to get the 'next' unreserved BAR PCI: endpoint: Make *_free_bar() to return error codes on failure PCI: endpoint: Fix NULL pointer dereference for ->get_features() f2fs: fix to avoid touching checkpointed data in get_victim() f2fs: fix to cover __allocate_new_section() with curseg_lock f2fs: Fix a hungtask problem in atomic write f2fs: fix to avoid accessing invalid fio in f2fs_allocate_data_block() rpmsg: qcom_glink_native: fix error return code of qcom_glink_rx_data() NFS: nfs4_bitmask_adjust() must not change the server global bitmasks NFS: Fix attribute bitmask in _nfs42_proc_fallocate() NFSv4.2: Always flush out writes in nfs42_proc_fallocate() NFS: Deal correctly with attribute generation counter overflow PCI: endpoint: Fix missing destroy_workqueue() pNFS/flexfiles: fix incorrect size check in decode_nfs_fh() NFSv4.2 fix handling of sr_eof in SEEK's reply SUNRPC: Move fault injection call sites SUNRPC: Remove trace_xprt_transmit_queued SUNRPC: Handle major timeout in xprt_adjust_timeout() thermal/drivers/tsens: Fix missing put_device error NFSv4.x: Don't return NFS4ERR_NOMATCHING_LAYOUT if we're unmounting nfsd: ensure new clients break delegations rtc: fsl-ftm-alarm: add MODULE_TABLE() dmaengine: idxd: Fix potential null dereference on pointer status dmaengine: idxd: fix dma device lifetime dmaengine: idxd: fix cdev setup and free device lifetime issues SUNRPC: fix ternary sign expansion bug in tracing pwm: atmel: Fix duty cycle calculation in .get_state() xprtrdma: Avoid Receive Queue wrapping xprtrdma: Fix cwnd update ordering xprtrdma: rpcrdma_mr_pop() already does list_del_init() swiotlb: Fix the type of index ceph: fix inode leak on getattr error in __fh_to_dentry scsi: qla2xxx: Prevent PRLI in target mode scsi: ufs: core: Do not put UFS power into LPM if link is broken scsi: ufs: core: Cancel rpm_dev_flush_recheck_work during system suspend scsi: ufs: core: Narrow down fast path in system suspend path rtc: ds1307: Fix wday settings for rx8130 net: hns3: fix incorrect configuration for igu_egu_hw_err net: hns3: initialize the message content in hclge_get_link_mode() net: hns3: add check for HNS3_NIC_STATE_INITED in hns3_reset_notify_up_enet() net: hns3: fix for vxlan gpe tx checksum bug net: hns3: use netif_tx_disable to stop the transmit queue net: hns3: disable phy loopback setting in hclge_mac_start_phy sctp: do asoc update earlier in sctp_sf_do_dupcook_a RISC-V: Fix error code returned by riscv_hartid_to_cpuid() sunrpc: Fix misplaced barrier in call_decode libbpf: Fix signed overflow in ringbuf_process_ring block/rnbd-clt: Change queue_depth type in rnbd_clt_session to size_t block/rnbd-clt: Check the return value of the function rtrs_clt_query ethernet:enic: Fix a use after free bug in enic_hard_start_xmit sctp: fix a SCTP_MIB_CURRESTAB leak in sctp_sf_do_dupcook_b netfilter: xt_SECMARK: add new revision to fix structure layout xsk: Fix for xp_aligned_validate_desc() when len == chunk_size net: stmmac: Clear receive all(RA) bit when promiscuous mode is off drm/radeon: Fix off-by-one power_state index heap overwrite drm/radeon: Avoid power table parsing memory leaks arm64: entry: factor irq triage logic into macros arm64: entry: always set GIC_PRIO_PSR_I_SET during entry khugepaged: fix wrong result value for trace_mm_collapse_huge_page_isolate() mm/hugeltb: handle the error case in hugetlb_fix_reserve_counts() mm/migrate.c: fix potential indeterminate pte entry in migrate_vma_insert_page() ksm: fix potential missing rmap_item for stable_node mm/gup: check every subpage of a compound page during isolation mm/gup: return an error on migration failure mm/gup: check for isolation errors ethtool: fix missing NLM_F_MULTI flag when dumping net: fix nla_strcmp to handle more then one trailing null character smc: disallow TCP_ULP in smc_setsockopt() netfilter: nfnetlink_osf: Fix a missing skb_header_pointer() NULL check netfilter: nftables: Fix a memleak from userdata error path in new objects can: mcp251xfd: mcp251xfd_probe(): add missing can_rx_offload_del() in error path can: mcp251x: fix resume from sleep before interface was brought up can: m_can: m_can_tx_work_queue(): fix tx_skb race condition sched: Fix out-of-bound access in uclamp sched/fair: Fix unfairness caused by missing load decay fs/proc/generic.c: fix incorrect pde_is_permanent check kernel: kexec_file: fix error return code of kexec_calculate_store_digests() kernel/resource: make walk_system_ram_res() find all busy IORESOURCE_SYSTEM_RAM resources kernel/resource: make walk_mem_res() find all busy IORESOURCE_MEM resources netfilter: nftables: avoid overflows in nft_hash_buckets() i40e: fix broken XDP support i40e: Fix use-after-free in i40e_client_subtask() i40e: fix the restart auto-negotiation after FEC modified i40e: Fix PHY type identifiers for 2.5G and 5G adapters mptcp: fix splat when closing unaccepted socket f2fs: avoid unneeded data copy in f2fs_ioc_move_range() ARC: entry: fix off-by-one error in syscall number validation ARC: mm: PAE: use 40-bit physical page mask ARC: mm: Use max_high_pfn as a HIGHMEM zone border powerpc/64s: Fix crashes when toggling stf barrier powerpc/64s: Fix crashes when toggling entry flush barrier hfsplus: prevent corruption in shrinking truncate squashfs: fix divide error in calculate_skip() userfaultfd: release page in error path to avoid BUG_ON kasan: fix unit tests with CONFIG_UBSAN_LOCAL_BOUNDS enabled mm/hugetlb: fix F_SEAL_FUTURE_WRITE blk-iocost: fix weight updates of inner active iocgs arm64: mte: initialize RGSR_EL1.SEED in __cpu_setup arm64: Fix race condition on PG_dcache_clean in __sync_icache_dcache() btrfs: fix race leading to unpersisted data and metadata on fsync drm/radeon/dpm: Disable sclk switching on Oland when two 4K 60Hz monitors are connected drm/amd/display: Initialize attribute for hdcp_srm sysfs file drm/i915: Avoid div-by-zero on gen2 kvm: exit halt polling on need_resched() as well KVM: LAPIC: Accurately guarantee busy wait for timer to expire when using hv_timer drm/msm/dp: initialize audio_comp when audio starts KVM: x86: Cancel pvclock_gtod_work on module removal KVM: x86: Prevent deadlock against tk_core.seq dax: Add an enum for specifying dax wakup mode dax: Add a wakeup mode parameter to put_unlocked_entry() dax: Wake up all waiters after invalidating dax entry xen/unpopulated-alloc: consolidate pgmap manipulation xen/unpopulated-alloc: fix error return code in fill_list() perf tools: Fix dynamic libbpf link usb: dwc3: gadget: Free gadget structure only after freeing endpoints iio: light: gp2ap002: Fix rumtime PM imbalance on error iio: proximity: pulsedlight: Fix rumtime PM imbalance on error iio: hid-sensors: select IIO_TRIGGERED_BUFFER under HID_SENSOR_IIO_TRIGGER usb: fotg210-hcd: Fix an error message hwmon: (occ) Fix poll rate limiting usb: musb: Fix an error message ACPI: scan: Fix a memory leak in an error handling path kyber: fix out of bounds access when preempted nvmet: add lba to sect conversion helpers nvmet: fix inline bio check for bdev-ns nvmet-rdma: Fix NULL deref when SEND is completed with error f2fs: compress: fix to free compress page correctly f2fs: compress: fix race condition of overwrite vs truncate f2fs: compress: fix to assign cc.cluster_idx correctly nbd: Fix NULL pointer in flush_workqueue blk-mq: plug request for shared sbitmap blk-mq: Swap two calls in blk_mq_exit_queue() usb: dwc3: omap: improve extcon initialization usb: dwc3: pci: Enable usb2-gadget-lpm-disable for Intel Merrifield usb: xhci: Increase timeout for HC halt usb: dwc2: Fix gadget DMA unmap direction usb: core: hub: fix race condition about TRSMRCY of resume usb: dwc3: gadget: Enable suspend events usb: dwc3: gadget: Return success always for kick transfer in ep queue usb: typec: ucsi: Retrieve all the PDOs instead of just the first 4 usb: typec: ucsi: Put fwnode in any case during ->probe() xhci-pci: Allow host runtime PM as default for Intel Alder Lake xHCI xhci: Do not use GFP_KERNEL in (potentially) atomic context xhci: Add reset resume quirk for AMD xhci controller. iio: gyro: mpu3050: Fix reported temperature value iio: tsl2583: Fix division by a zero lux_val cdc-wdm: untangle a circular dependency between callback and softint xen/gntdev: fix gntdev_mmap() error exit path KVM: x86: Emulate RDPID only if RDTSCP is supported KVM: x86: Move RDPID emulation intercept to its own enum KVM: nVMX: Always make an attempt to map eVMCS after migration KVM: VMX: Do not advertise RDPID if ENABLE_RDTSCP control is unsupported KVM: VMX: Disable preemption when probing user return MSRs Revert "iommu/vt-d: Remove WO permissions on second-level paging entries" Revert "iommu/vt-d: Preset Access/Dirty bits for IOVA over FL" iommu/vt-d: Preset Access/Dirty bits for IOVA over FL iommu/vt-d: Remove WO permissions on second-level paging entries mm: fix struct page layout on 32-bit systems MIPS: Reinstate platform `__div64_32' handler MIPS: Avoid DIVU in `__div64_32' is result would be zero MIPS: Avoid handcoded DIVU in `__div64_32' altogether clocksource/drivers/timer-ti-dm: Prepare to handle dra7 timer wrap issue clocksource/drivers/timer-ti-dm: Handle dra7 timer wrap errata i940 ARM: 9011/1: centralize phys-to-virt conversion of DT/ATAGS address ARM: 9012/1: move device tree mapping out of linear region ARM: 9020/1: mm: use correct section size macro to describe the FDT virtual address ARM: 9027/1: head.S: explicitly map DT even if it lives in the first physical section usb: typec: tcpm: Fix error while calculating PPS out values kobject_uevent: remove warning in init_uevent_argv() drm/i915/gt: Fix a double free in gen8_preallocate_top_level_pdp drm/i915: Read C0DRB3/C1DRB3 as 16 bits again drm/i915/overlay: Fix active retire callback alignment drm/i915: Fix crash in auto_retire clk: exynos7: Mark aclk_fsys1_200 as critical media: rkvdec: Remove of_match_ptr() i2c: mediatek: Fix send master code at more than 1MHz dt-bindings: media: renesas,vin: Make resets optional on R-Car Gen1 dt-bindings: serial: 8250: Remove duplicated compatible strings debugfs: Make debugfs_allow RO after init ext4: fix debug format string warning nvme: do not try to reconfigure APST when the controller is not live ASoC: rsnd: check all BUSIF status when error Linux 5.10.38 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ia32e01283b488a38be48015c58a0e481f09aaf65	2021-05-20 15:35:25 +02:00
Colin Ian King	31c9a4b24d	KEYS: trusted: Fix memory leak on object td ... commit 83a775d5f9 upstream. Two error return paths are neglecting to free allocated object td, causing a memory leak. Fix this by returning via the error return path that securely kfree's td. Fixes clang scan-build warning: security/keys/trusted-keys/trusted_tpm1.c:496:10: warning: Potential memory leak [unix.Malloc] Cc: stable@vger.kernel.org Fixes: 5df16caada ("KEYS: trusted: Fix incorrect handling of tpm_get_random()") Signed-off-by: Colin Ian King <colin.king@canonical.com> Reviewed-by: Nick Desaulniers <ndesaulniers@google.com> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-05-19 10:12:50 +02:00
Greg Kroah-Hartman	e054456ced	Merge 5.10.37 into android12-5.10 ... Changes in 5.10.37 Bluetooth: verify AMP hci_chan before amp_destroy bluetooth: eliminate the potential race condition when removing the HCI controller net/nfc: fix use-after-free llcp_sock_bind/connect io_uring: truncate lengths larger than MAX_RW_COUNT on provide buffers Revert "USB: cdc-acm: fix rounding error in TIOCSSERIAL" usb: roles: Call try_module_get() from usb_role_switch_find_by_fwnode() tty: moxa: fix TIOCSSERIAL jiffies conversions tty: amiserial: fix TIOCSSERIAL permission check USB: serial: usb_wwan: fix TIOCSSERIAL jiffies conversions staging: greybus: uart: fix TIOCSSERIAL jiffies conversions USB: serial: ti_usb_3410_5052: fix TIOCSSERIAL permission check staging: fwserial: fix TIOCSSERIAL jiffies conversions tty: moxa: fix TIOCSSERIAL permission check staging: fwserial: fix TIOCSSERIAL permission check drm: bridge: fix LONTIUM use of mipi_dsi_() functions usb: typec: tcpm: Address incorrect values of tcpm psy for fixed supply usb: typec: tcpm: Address incorrect values of tcpm psy for pps supply usb: typec: tcpm: update power supply once partner accepts usb: xhci-mtk: remove or operator for setting schedule parameters usb: xhci-mtk: improve bandwidth scheduling with TT ASoC: samsung: tm2_wm5110: check of of_parse return value ASoC: Intel: kbl_da7219_max98927: Fix kabylake_ssp_fixup function ASoC: tlv320aic32x4: Register clocks before registering component ASoC: tlv320aic32x4: Increase maximum register in regmap MIPS: pci-mt7620: fix PLL lock check MIPS: pci-rt2880: fix slot 0 configuration FDDI: defxx: Bail out gracefully with unassigned PCI resource for CSR PCI: Allow VPD access for QLogic ISP2722 KVM: x86: Defer the MMU unload to the normal path on an global INVPCID PCI: xgene: Fix cfg resource mapping PCI: keystone: Let AM65 use the pci_ops defined in pcie-designware-host.c PM / devfreq: Unlock mutex and free devfreq struct in error path soc/tegra: regulators: Fix locking up when voltage-spread is out of range iio: inv_mpu6050: Fully validate gyro and accel scale writes iio:accel:adis16201: Fix wrong axis assignment that prevents loading iio:adc:ad7476: Fix remove handling sc16is7xx: Defer probe if device read fails phy: cadence: Sierra: Fix PHY power_on sequence misc: lis3lv02d: Fix false-positive WARN on various HP models phy: ti: j721e-wiz: Invoke wiz_init() before of_platform_device_create() misc: vmw_vmci: explicitly initialize vmci_notify_bm_set_msg struct misc: vmw_vmci: explicitly initialize vmci_datagram payload selinux: add proper NULL termination to the secclass_map permissions x86, sched: Treat Intel SNC topology as default, COD as exception async_xor: increase src_offs when dropping destination page md/bitmap: wait for external bitmap writes to complete during tear down md-cluster: fix use-after-free issue when removing rdev md: split mddev_find md: factor out a mddev_find_locked helper from mddev_find md: md_open returns -EBUSY when entering racing area md: Fix missing unused status line of /proc/mdstat mt76: mt7615: use ieee80211_free_txskb() in mt7615_tx_token_put() ipw2x00: potential buffer overflow in libipw_wx_set_encodeext() cfg80211: scan: drop entry from hidden_list on overflow rtw88: Fix array overrun in rtw_get_tx_power_params() mt76: fix potential DMA mapping leak FDDI: defxx: Make MMIO the configuration default except for EISA drm/i915/gvt: Fix virtual display setup for BXT/APL drm/i915/gvt: Fix vfio_edid issue for BXT/APL drm/qxl: use ttm bo priorities drm/panfrost: Clear MMU irqs before handling the fault drm/panfrost: Don't try to map pages that are already mapped drm/radeon: fix copy of uninitialized variable back to userspace drm/dp_mst: Revise broadcast msg lct & lcr drm/dp_mst: Set CLEAR_PAYLOAD_ID_TABLE as broadcast drm: bridge/panel: Cleanup connector on bridge detach drm/amd/display: Reject non-zero src_y and src_x for video planes drm/amdgpu: fix concurrent VM flushes on Vega/Navi v2 ALSA: hda/realtek: Re-order ALC882 Acer quirk table entries ALSA: hda/realtek: Re-order ALC882 Sony quirk table entries ALSA: hda/realtek: Re-order ALC882 Clevo quirk table entries ALSA: hda/realtek: Re-order ALC269 HP quirk table entries ALSA: hda/realtek: Re-order ALC269 Acer quirk table entries ALSA: hda/realtek: Re-order ALC269 Dell quirk table entries ALSA: hda/realtek: Re-order ALC269 ASUS quirk table entries ALSA: hda/realtek: Re-order ALC269 Sony quirk table entries ALSA: hda/realtek: Re-order ALC269 Lenovo quirk table entries ALSA: hda/realtek: Re-order remaining ALC269 quirk table entries ALSA: hda/realtek: Re-order ALC662 quirk table entries ALSA: hda/realtek: Remove redundant entry for ALC861 Haier/Uniwill devices ALSA: hda/realtek: ALC285 Thinkpad jack pin quirk is unreachable ALSA: hda/realtek: Fix speaker amp on HP Envy AiO 32 KVM: s390: VSIE: correctly handle MVPG when in VSIE KVM: s390: split kvm_s390_logical_to_effective KVM: s390: fix guarded storage control register handling s390: fix detection of vector enhancements facility 1 vs. vector packed decimal facility KVM: s390: VSIE: fix MVPG handling for prefixing and MSO KVM: s390: split kvm_s390_real_to_abs KVM: s390: extend kvm_s390_shadow_fault to return entry pointer KVM: x86/mmu: Alloc page for PDPTEs when shadowing 32-bit NPT with 64-bit KVM: x86: Remove emulator's broken checks on CR0/CR3/CR4 loads KVM: nSVM: Set the shadow root level to the TDP level for nested NPT KVM: SVM: Don't strip the C-bit from CR2 on #PF interception KVM: SVM: Do not allow SEV/SEV-ES initialization after vCPUs are created KVM: SVM: Inject #GP on guest MSR_TSC_AUX accesses if RDTSCP unsupported KVM: nVMX: Defer the MMU reload to the normal path on an EPTP switch KVM: nVMX: Truncate bits 63:32 of VMCS field on nested check in !64-bit KVM: nVMX: Truncate base/index GPR value on address calc in !64-bit KVM: arm/arm64: Fix KVM_VGIC_V3_ADDR_TYPE_REDIST read KVM: Destroy I/O bus devices on unregister failure _after_ sync'ing SRCU KVM: Stop looking for coalesced MMIO zones if the bus is destroyed KVM: arm64: Fully zero the vcpu state on reset KVM: arm64: Fix KVM_VGIC_V3_ADDR_TYPE_REDIST_REGION read Revert "drivers/net/wan/hdlc_fr: Fix a double free in pvc_xmit" Revert "i3c master: fix missing destroy_workqueue() on error in i3c_master_register" ovl: fix missing revert_creds() on error path Revert "drm/qxl: do not run release if qxl failed to init" usb: gadget: pch_udc: Revert d3cb25a121 completely Revert "tools/power turbostat: adjust for temperature offset" firmware: xilinx: Fix dereferencing freed memory firmware: xilinx: Add a blank line after function declaration firmware: xilinx: Remove zynqmp_pm_get_eemi_ops() in IS_REACHABLE(CONFIG_ZYNQMP_FIRMWARE) fpga: fpga-mgr: xilinx-spi: fix error messages on -EPROBE_DEFER crypto: sun8i-ss - fix result memory leak on error path memory: gpmc: fix out of bounds read and dereference on gpmc_cs[] ARM: dts: exynos: correct fuel gauge interrupt trigger level on GT-I9100 ARM: dts: exynos: correct fuel gauge interrupt trigger level on Midas family ARM: dts: exynos: correct MUIC interrupt trigger level on Midas family ARM: dts: exynos: correct PMIC interrupt trigger level on Midas family ARM: dts: exynos: correct PMIC interrupt trigger level on Odroid X/U3 family ARM: dts: exynos: correct PMIC interrupt trigger level on SMDK5250 ARM: dts: exynos: correct PMIC interrupt trigger level on Snow ARM: dts: s5pv210: correct fuel gauge interrupt trigger level on Fascinate family ARM: dts: renesas: Add mmc aliases into R-Car Gen2 board dts files arm64: dts: renesas: Add mmc aliases into board dts files x86/platform/uv: Set section block size for hubless architectures serial: stm32: fix code cleaning warnings and checks serial: stm32: add "_usart" prefix in functions name serial: stm32: fix probe and remove order for dma serial: stm32: Use of_device_get_match_data() serial: stm32: fix startup by enabling usart for reception serial: stm32: fix incorrect characters on console serial: stm32: fix TX and RX FIFO thresholds serial: stm32: fix a deadlock condition with wakeup event serial: stm32: fix wake-up flag handling serial: stm32: fix a deadlock in set_termios serial: stm32: fix tx dma completion, release channel serial: stm32: call stm32_transmit_chars locked serial: stm32: fix FIFO flush in startup and set_termios serial: stm32: add FIFO flush when port is closed serial: stm32: fix tx_empty condition usb: typec: tcpci: Check ROLE_CONTROL while interpreting CC_STATUS usb: typec: tps6598x: Fix return value check in tps6598x_probe() usb: typec: stusb160x: fix return value check in stusb160x_probe() regmap: set debugfs_name to NULL after it is freed spi: rockchip: avoid objtool warning mtd: rawnand: fsmc: Fix error code in fsmc_nand_probe() mtd: rawnand: brcmnand: fix OOB R/W with Hamming ECC mtd: Handle possible -EPROBE_DEFER from parse_mtd_partitions() mtd: rawnand: qcom: Return actual error code instead of -ENODEV mtd: don't lock when recursively deleting partitions mtd: maps: fix error return code of physmap_flash_remove() ARM: dts: stm32: fix usart 2 & 3 pinconf to wake up with flow control arm64: dts: qcom: sm8250: Fix level triggered PMU interrupt polarity arm64: dts: qcom: sm8250: Fix timer interrupt to specify EL2 physical timer arm64: dts: qcom: sdm845: fix number of pins in 'gpio-ranges' arm64: dts: qcom: sm8150: fix number of pins in 'gpio-ranges' arm64: dts: qcom: sm8250: fix number of pins in 'gpio-ranges' arm64: dts: qcom: db845c: fix correct powerdown pin for WSA881x crypto: sun8i-ss - Fix memory leak of object d when dma_iv fails to map spi: stm32: drop devres version of spi_register_master regulator: bd9576: Fix return from bd957x_probe() arm64: dts: renesas: r8a77980: Fix vin4-7 endpoint binding spi: stm32: Fix use-after-free on unbind x86/microcode: Check for offline CPUs before requesting new microcode devtmpfs: fix placement of complete() call usb: gadget: pch_udc: Replace cpu_to_le32() by lower_32_bits() usb: gadget: pch_udc: Check if driver is present before calling ->setup() usb: gadget: pch_udc: Check for DMA mapping error usb: gadget: pch_udc: Initialize device pointer before use usb: gadget: pch_udc: Provide a GPIO line used on Intel Minnowboard (v1) crypto: ccp - fix command queuing to TEE ring buffer crypto: qat - don't release uninitialized resources crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init fotg210-udc: Fix DMA on EP0 for length > max packet size fotg210-udc: Fix EP0 IN requests bigger than two packets fotg210-udc: Remove a dubious condition leading to fotg210_done fotg210-udc: Mask GRP2 interrupts we don't handle fotg210-udc: Don't DMA more than the buffer can take fotg210-udc: Complete OUT requests on short packets usb: gadget: s3c: Fix incorrect resources releasing usb: gadget: s3c: Fix the error handling path in 's3c2410_udc_probe()' dt-bindings: serial: stm32: Use 'type: object' instead of false for 'additionalProperties' mtd: require write permissions for locking and badblock ioctls arm64: dts: renesas: r8a779a0: Fix PMU interrupt bus: qcom: Put child node before return soundwire: bus: Fix device found flag correctly phy: ti: j721e-wiz: Delete "clk_div_sel" clk provider during cleanup phy: marvell: ARMADA375_USBCLUSTER_PHY should not default to y, unconditionally arm64: dts: mediatek: fix reset GPIO level on pumpkin NFSD: Fix sparse warning in nfs4proc.c NFSv4.2: fix copy stateid copying for the async copy crypto: poly1305 - fix poly1305_core_setkey() declaration crypto: qat - fix error path in adf_isr_resource_alloc() usb: gadget: aspeed: fix dma map failure USB: gadget: udc: fix wrong pointer passed to IS_ERR() and PTR_ERR() drivers: nvmem: Fix voltage settings for QTI qfprom-efuse driver core: platform: Declare early_platform_cleanup() prototype memory: pl353: fix mask of ECC page_size config register soundwire: stream: fix memory leak in stream config error path m68k: mvme147,mvme16x: Don't wipe PCC timer config bits firmware: qcom_scm: Make __qcom_scm_is_call_available() return bool firmware: qcom_scm: Reduce locking section for __get_convention() firmware: qcom_scm: Workaround lack of "is available" call on SC7180 iio: adc: Kconfig: make AD9467 depend on ADI_AXI_ADC symbol mtd: rawnand: gpmi: Fix a double free in gpmi_nand_init irqchip/gic-v3: Fix OF_BAD_ADDR error handling staging: comedi: tests: ni_routes_test: Fix compilation error staging: rtl8192u: Fix potential infinite loop staging: fwserial: fix TIOCSSERIAL implementation staging: fwserial: fix TIOCGSERIAL implementation staging: greybus: uart: fix unprivileged TIOCCSERIAL soc: qcom: pdr: Fix error return code in pdr_register_listener PM / devfreq: Use more accurate returned new_freq as resume_freq clocksource/drivers/timer-ti-dm: Fix posted mode status check order clocksource/drivers/timer-ti-dm: Add missing set_state_oneshot_stopped clocksource/drivers/ingenic_ost: Fix return value check in ingenic_ost_probe() spi: Fix use-after-free with devm_spi_alloc_* spi: fsl: add missing iounmap() on error in of_fsl_spi_probe() soc: qcom: mdt_loader: Validate that p_filesz < p_memsz soc: qcom: mdt_loader: Detect truncated read of segments PM: runtime: Replace inline function pm_runtime_callbacks_present() cpuidle: Fix ARM_QCOM_SPM_CPUIDLE configuration ACPI: CPPC: Replace cppc_attr with kobj_attribute crypto: allwinner - add missing CRYPTO_ prefix crypto: sun8i-ss - Fix memory leak of pad crypto: sa2ul - Fix memory leak of rxd crypto: qat - Fix a double free in adf_create_ring cpufreq: armada-37xx: Fix setting TBG parent for load levels clk: mvebu: armada-37xx-periph: remove .set_parent method for CPU PM clock cpufreq: armada-37xx: Fix the AVS value for load L1 clk: mvebu: armada-37xx-periph: Fix switching CPU freq from 250 Mhz to 1 GHz clk: mvebu: armada-37xx-periph: Fix workaround for switching from L1 to L0 cpufreq: armada-37xx: Fix driver cleanup when registration failed cpufreq: armada-37xx: Fix determining base CPU frequency spi: spi-zynqmp-gqspi: use wait_for_completion_timeout to make zynqmp_qspi_exec_op not interruptible spi: spi-zynqmp-gqspi: add mutex locking for exec_op spi: spi-zynqmp-gqspi: transmit dummy circles by using the controller's internal functionality spi: spi-zynqmp-gqspi: fix incorrect operating mode in zynqmp_qspi_read_op spi: fsl-lpspi: Fix PM reference leak in lpspi_prepare_xfer_hardware() usb: gadget: r8a66597: Add missing null check on return from platform_get_resource USB: cdc-acm: fix unprivileged TIOCCSERIAL USB: cdc-acm: fix TIOCGSERIAL implementation tty: actually undefine superseded ASYNC flags tty: fix return value for unsupported ioctls tty: Remove dead termiox code tty: fix return value for unsupported termiox ioctls serial: core: return early on unsupported ioctls firmware: qcom-scm: Fix QCOM_SCM configuration node: fix device cleanups in error handling code crypto: chelsio - Read rxchannel-id from firmware usbip: vudc: fix missing unlock on error in usbip_sockfd_store() m68k: Add missing mmap_read_lock() to sys_cacheflush() spi: spi-zynqmp-gqspi: Fix missing unlock on error in zynqmp_qspi_exec_op() memory: renesas-rpc-if: fix possible NULL pointer dereference of resource memory: samsung: exynos5422-dmc: handle clk_set_parent() failure security: keys: trusted: fix TPM2 authorizations platform/x86: pmc_atom: Match all Beckhoff Automation baytrail boards with critclk_systems DMI table ARM: dts: aspeed: Rainier: Fix humidity sensor bus address Drivers: hv: vmbus: Use after free in __vmbus_open() spi: spi-zynqmp-gqspi: fix clk_enable/disable imbalance issue spi: spi-zynqmp-gqspi: fix hang issue when suspend/resume spi: spi-zynqmp-gqspi: fix use-after-free in zynqmp_qspi_exec_op spi: spi-zynqmp-gqspi: return -ENOMEM if dma_map_single fails x86/platform/uv: Fix !KEXEC build failure hwmon: (pmbus/pxe1610) don't bail out when not all pages are active Drivers: hv: vmbus: Increase wait time for VMbus unload PM: hibernate: x86: Use crc32 instead of md5 for hibernation e820 integrity check usb: dwc2: Fix host mode hibernation exit with remote wakeup flow. usb: dwc2: Fix hibernation between host and device modes. ttyprintk: Add TTY hangup callback. serial: omap: don't disable rs485 if rts gpio is missing serial: omap: fix rs485 half-duplex filtering xen-blkback: fix compatibility bug with single page rings soc: aspeed: fix a ternary sign expansion bug drm/tilcdc: send vblank event when disabling crtc drm/stm: Fix bus_flags handling drm/amd/display: Fix off by one in hdmi_14_process_transaction() drm/mcde/panel: Inverse misunderstood flag sched/fair: Fix shift-out-of-bounds in load_balance() afs: Fix updating of i_mode due to 3rd party change rcu: Remove spurious instrumentation_end() in rcu_nmi_enter() media: vivid: fix assignment of dev->fbuf_out_flags media: saa7134: use sg_dma_len when building pgtable media: saa7146: use sg_dma_len when building pgtable media: omap4iss: return error code when omap4iss_get() failed media: rkisp1: rsz: crash fix when setting src format media: aspeed: fix clock handling logic drm/probe-helper: Check epoch counter in output_poll_execute() media: venus: core: Fix some resource leaks in the error path of 'venus_probe()' media: platform: sunxi: sun6i-csi: fix error return code of sun6i_video_start_streaming() media: m88ds3103: fix return value check in m88ds3103_probe() media: docs: Fix data organization of MEDIA_BUS_FMT_RGB101010_1X30 media: [next] staging: media: atomisp: fix memory leak of object flash media: atomisp: Fixed error handling path media: m88rs6000t: avoid potential out-of-bounds reads on arrays media: atomisp: Fix use after free in atomisp_alloc_css_stat_bufs() drm/amdkfd: fix build error with AMD_IOMMU_V2=m of: overlay: fix for_each_child.cocci warnings x86/kprobes: Fix to check non boostable prefixes correctly selftests: fix prepending $(OUTPUT) to $(TEST_PROGS) pata_arasan_cf: fix IRQ check pata_ipx4xx_cf: fix IRQ check sata_mv: add IRQ checks ata: libahci_platform: fix IRQ check seccomp: Fix CONFIG tests for Seccomp_filters nvme-tcp: block BH in sk state_change sk callback nvmet-tcp: fix incorrect locking in state_change sk callback clk: imx: Fix reparenting of UARTs not associated with stdout power: supply: bq25980: Move props from battery node nvme: retrigger ANA log update if group descriptor isn't found media: i2c: imx219: Move out locking/unlocking of vflip and hflip controls from imx219_set_stream media: i2c: imx219: Balance runtime PM use-count media: v4l2-ctrls.c: fix race condition in hdl->requests list vfio/fsl-mc: Re-order vfio_fsl_mc_probe() vfio/pci: Move VGA and VF initialization to functions vfio/pci: Re-order vfio_pci_probe() vfio/mdev: Do not allow a mdev_type to have a NULL parent pointer clk: zynqmp: move zynqmp_pll_set_mode out of round_rate callback clk: zynqmp: pll: add set_pll_mode to check condition in zynqmp_pll_enable drm: xlnx: zynqmp: fix a memset in zynqmp_dp_train() clk: qcom: a53-pll: Add missing MODULE_DEVICE_TABLE clk: qcom: apss-ipq-pll: Add missing MODULE_DEVICE_TABLE drm/amd/display: use GFP_ATOMIC in dcn20_resource_construct drm/radeon: Fix a missing check bug in radeon_dp_mst_detect() clk: uniphier: Fix potential infinite loop scsi: pm80xx: Increase timeout for pm80xx mpi_uninit_check() scsi: pm80xx: Fix potential infinite loop scsi: ufs: ufshcd-pltfrm: Fix deferred probing scsi: hisi_sas: Fix IRQ checks scsi: jazz_esp: Add IRQ check scsi: sun3x_esp: Add IRQ check scsi: sni_53c710: Add IRQ check scsi: ibmvfc: Fix invalid state machine BUG_ON() mailbox: sprd: Introduce refcnt when clients requests/free channels mfd: stm32-timers: Avoid clearing auto reload register nvmet-tcp: fix a segmentation fault during io parsing error nvme-pci: don't simple map sgl when sgls are disabled media: cedrus: Fix H265 status definitions HSI: core: fix resource leaks in hsi_add_client_from_dt() x86/events/amd/iommu: Fix sysfs type mismatch perf/amd/uncore: Fix sysfs type mismatch io_uring: fix overflows checks in provide buffers sched/debug: Fix cgroup_path[] serialization drivers/block/null_blk/main: Fix a double free in null_init. xsk: Respect device's headroom and tailroom on generic xmit path HID: plantronics: Workaround for double volume key presses perf symbols: Fix dso__fprintf_symbols_by_name() to return the number of printed chars ASoC: Intel: boards: sof-wm8804: add check for PLL setting ASoC: Intel: Skylake: Compile when any configuration is selected RDMA/mlx5: Fix mlx5 rates to IB rates map wilc1000: write value to WILC_INTR2_ENABLE register KVM: x86/mmu: Retry page faults that hit an invalid memslot Bluetooth: avoid deadlock between hci_dev->lock and socket lock net: lapbether: Prevent racing when checking whether the netif is running libbpf: Add explicit padding to bpf_xdp_set_link_opts bpftool: Fix maybe-uninitialized warnings iommu: Check dev->iommu in iommu_dev_xxx functions iommu/vt-d: Reject unsupported page request modes selftests/bpf: Re-generate vmlinux.h and BPF skeletons if bpftool changed libbpf: Add explicit padding to btf_dump_emit_type_decl_opts powerpc/fadump: Mark fadump_calculate_reserve_size as __init powerpc/prom: Mark identical_pvr_fixup as __init MIPS: fix local_irq_{disable,enable} in asmmacro.h ima: Fix the error code for restoring the PCR value inet: use bigger hash table for IP ID generation pinctrl: pinctrl-single: remove unused parameter pinctrl: pinctrl-single: fix pcs_pin_dbg_show() when bits_per_mux is not zero MIPS: loongson64: fix bug when PAGE_SIZE > 16KB ASoC: wm8960: Remove bitclk relax condition in wm8960_configure_sysclk iommu/arm-smmu-v3: add bit field SFM into GERROR_ERR_MASK RDMA/mlx5: Fix drop packet rule in egress table IB/isert: Fix a use after free in isert_connect_request powerpc: Fix HAVE_HARDLOCKUP_DETECTOR_ARCH build configuration MIPS/bpf: Enable bpf_probe_read{, str}() on MIPS again gpio: guard gpiochip_irqchip_add_domain() with GPIOLIB_IRQCHIP ALSA: core: remove redundant spin_lock pair in snd_card_disconnect net: phy: lan87xx: fix access to wrong register of LAN87xx udp: never accept GSO_FRAGLIST packets powerpc/pseries: Only register vio drivers if vio bus exists net/tipc: fix missing destroy_workqueue() on error in tipc_crypto_start() bug: Remove redundant condition check in report_bug RDMA/core: Fix corrupted SL on passive side nfc: pn533: prevent potential memory corruption net: hns3: Limiting the scope of vector_ring_chain variable mips: bmips: fix syscon-reboot nodes iommu/vt-d: Don't set then clear private data in prq_event_thread() iommu: Fix a boundary issue to avoid performance drop iommu/vt-d: Report right snoop capability when using FL for IOVA iommu/vt-d: Report the right page fault address iommu/vt-d: Preset Access/Dirty bits for IOVA over FL iommu/vt-d: Remove WO permissions on second-level paging entries iommu/vt-d: Invalidate PASID cache when root/context entry changed ALSA: usb-audio: Add error checks for usb_driver_claim_interface() calls HID: lenovo: Use brightness_set_blocking callback for setting LEDs brightness HID: lenovo: Fix lenovo_led_set_tp10ubkbd() error handling HID: lenovo: Check hid_get_drvdata() returns non NULL in lenovo_event() HID: lenovo: Map mic-mute button to KEY_F20 instead of KEY_MICMUTE KVM: arm64: Initialize VCPU mdcr_el2 before loading it ASoC: simple-card: fix possible uninitialized single_cpu local variable liquidio: Fix unintented sign extension of a left shift of a u16 IB/hfi1: Use kzalloc() for mmu_rb_handler allocation powerpc/64s: Fix pte update for kernel memory on radix powerpc/perf: Fix PMU constraint check for EBB events powerpc: iommu: fix build when neither PCI or IBMVIO is set mac80211: bail out if cipher schemes are invalid perf vendor events amd: Fix broken L2 Cache Hits from L2 HWPF metric xfs: fix return of uninitialized value in variable error rtw88: Fix an error code in rtw_debugfs_set_rsvd_page() mt7601u: fix always true expression mt76: mt7615: fix tx skb dma unmap mt76: mt7915: fix tx skb dma unmap mt76: mt7915: fix aggr len debugfs node mt76: mt7615: fix mib stats counter reporting to mac80211 mt76: mt7915: fix mib stats counter reporting to mac80211 mt76: mt7663s: make all of packets 4-bytes aligned in sdio tx aggregation mt76: mt7663s: fix the possible device hang in high traffic KVM: PPC: Book3S HV P9: Restore host CTRL SPR after guest exit ovl: invalidate readdir cache on changes to dir with origin RDMA/qedr: Fix error return code in qedr_iw_connect() IB/hfi1: Fix error return code in parse_platform_config() RDMA/bnxt_re: Fix error return code in bnxt_qplib_cq_process_terminal() cxgb4: Fix unintentional sign extension issues net: thunderx: Fix unintentional sign extension issue RDMA/srpt: Fix error return code in srpt_cm_req_recv() RDMA/rtrs-clt: destroy sysfs after removing session from active list i2c: cadence: fix reference leak when pm_runtime_get_sync fails i2c: img-scb: fix reference leak when pm_runtime_get_sync fails i2c: imx-lpi2c: fix reference leak when pm_runtime_get_sync fails i2c: imx: fix reference leak when pm_runtime_get_sync fails i2c: omap: fix reference leak when pm_runtime_get_sync fails i2c: sprd: fix reference leak when pm_runtime_get_sync fails i2c: stm32f7: fix reference leak when pm_runtime_get_sync fails i2c: xiic: fix reference leak when pm_runtime_get_sync fails i2c: cadence: add IRQ check i2c: emev2: add IRQ check i2c: jz4780: add IRQ check i2c: mlxbf: add IRQ check i2c: rcar: make sure irq is not threaded on Gen2 and earlier i2c: rcar: protect against supurious interrupts on V3U i2c: rcar: add IRQ check i2c: sh7760: add IRQ check powerpc/xive: Drop check on irq_data in xive_core_debug_show() powerpc/xive: Fix xmon command "dxi" ASoC: ak5558: correct reset polarity net/mlx5: Fix bit-wise and with zero net/packet: make packet_fanout.arr size configurable up to 64K net/packet: remove data races in fanout operations drm/i915/gvt: Fix error code in intel_gvt_init_device() iommu/amd: Put newline after closing bracket in warning perf beauty: Fix fsconfig generator drm/amd/pm: fix error code in smu_set_power_limit() MIPS: pci-legacy: stop using of_pci_range_to_resource powerpc/pseries: extract host bridge from pci_bus prior to bus removal powerpc/smp: Reintroduce cpu_core_mask KVM: x86: dump_vmcs should not assume GUEST_IA32_EFER is valid rtlwifi: 8821ae: upgrade PHY and RF parameters wlcore: fix overlapping snprintf arguments in debugfs i2c: sh7760: fix IRQ error path i2c: mediatek: Fix wrong dma sync flag mwl8k: Fix a double Free in mwl8k_probe_hw netfilter: nft_payload: fix C-VLAN offload support netfilter: nftables_offload: VLAN id needs host byteorder in flow dissector netfilter: nftables_offload: special ethertype handling for VLAN vsock/vmci: log once the failed queue pair allocation libbpf: Initialize the bpf_seq_printf parameters array field by field net: ethernet: ixp4xx: Set the DMA masks explicitly gro: fix napi_gro_frags() Fast GRO breakage due to IP alignment check RDMA/cxgb4: add missing qpid increment RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails ALSA: usb: midi: don't return -ENOMEM when usb_urb_ep_type_check fails sfc: ef10: fix TX queue lookup in TX event handling vsock/virtio: free queued packets when closing socket net: marvell: prestera: fix port event handling on init net: davinci_emac: Fix incorrect masking of tx and rx error channel mt76: mt7615: fix memleak when mt7615_unregister_device() crypto: ccp: Detect and reject "invalid" addresses destined for PSP nfp: devlink: initialize the devlink port attribute "lanes" net: stmmac: fix TSO and TBS feature enabling during driver open net: renesas: ravb: Fix a stuck issue when a lot of frames are received net: phy: intel-xway: enable integrated led functions RDMA/rxe: Fix a bug in rxe_fill_ip_info() RDMA/core: Add CM to restrack after successful attachment to a device powerpc/64: Fix the definition of the fixmap area ath9k: Fix error check in ath9k_hw_read_revisions() for PCI devices ath10k: Fix a use after free in ath10k_htc_send_bundle ath10k: Fix ath10k_wmi_tlv_op_pull_peer_stats_info() unlock without lock wlcore: Fix buffer overrun by snprintf due to incorrect buffer size powerpc/perf: Fix the threshold event selection for memory events in power10 powerpc/52xx: Fix an invalid ASM expression ('addi' used instead of 'add') net: phy: marvell: fix m88e1011_set_downshift net: phy: marvell: fix m88e1111_set_downshift net: enetc: fix link error again bnxt_en: fix ternary sign extension bug in bnxt_show_temp() ARM: dts: uniphier: Change phy-mode to RGMII-ID to enable delay pins for RTL8211E arm64: dts: uniphier: Change phy-mode to RGMII-ID to enable delay pins for RTL8211E net: geneve: modify IP header check in geneve6_xmit_skb and geneve_xmit_skb selftests: net: mirror_gre_vlan_bridge_1q: Make an FDB entry static selftests: mlxsw: Remove a redundant if statement in tc_flower_scale test bnxt_en: Fix RX consumer index logic in the error path. KVM: VMX: Intercept FS/GS_BASE MSR accesses for 32-bit KVM net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send selftests/bpf: Fix BPF_CORE_READ_BITFIELD() macro selftests/bpf: Fix field existence CO-RE reloc tests selftests/bpf: Fix core_reloc test runner bpf: Fix propagation of 32 bit unsigned bounds from 64 bit bounds RDMA/siw: Fix a use after free in siw_alloc_mr RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res net: bridge: mcast: fix broken length + header check for MRDv6 Adv. net:nfc:digital: Fix a double free in digital_tg_recv_dep_req perf tools: Change fields type in perf_record_time_conv perf jit: Let convert_timestamp() to be backwards-compatible perf session: Add swap operation for event TIME_CONV ia64: fix EFI_DEBUG build kfifo: fix ternary sign extension bugs mm/sl?b.c: remove ctor argument from kmem_cache_flags mm: memcontrol: slab: fix obtain a reference to a freeing memcg mm/sparse: add the missing sparse_buffer_fini() in error branch mm/memory-failure: unnecessary amount of unmapping afs: Fix speculative status fetches bpf: Fix alu32 const subreg bound tracking on bitwise operations bpf, ringbuf: Deny reserve of buffers larger than ringbuf bpf: Prevent writable memory-mapping of read-only ringbuf pages arm64: Remove arm64_dma32_phys_limit and its uses net: Only allow init netns to set default tcp cong to a restricted algo smp: Fix smp_call_function_single_async prototype Revert "net/sctp: fix race condition in sctp_destroy_sock" sctp: delay auto_asconf init until binding the first addr Linux 5.10.37 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I5bee89c285d9dd72de967b0e70d96951ae4e06ae	2021-05-15 09:28:55 +02:00
Li Huafei	6b4b3b8404	ima: Fix the error code for restoring the PCR value ... [ Upstream commit 7990ccafaa ] In ima_restore_measurement_list(), hdr[HDR_PCR].data is pointing to a buffer of type u8, which contains the dumped 32-bit pcr value. Currently, only the least significant byte is used to restore the pcr value. We should convert hdr[HDR_PCR].data to a pointer of type u32 before fetching the value to restore the correct pcr value. Fixes: 47fdee60b4 ("ima: use ima_parse_buf() to parse measurements headers") Signed-off-by: Li Huafei <lihuafei1@huawei.com> Reviewed-by: Roberto Sassu <roberto.sassu@huawei.com> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-05-14 09:50:30 +02:00
James Bottomley	09a119a2d4	security: keys: trusted: fix TPM2 authorizations ... [ Upstream commit de66514d93 ] In TPM 1.2 an authorization was a 20 byte number. The spec actually recommended you to hash variable length passwords and use the sha1 hash as the authorization. Because the spec doesn't require this hashing, the current authorization for trusted keys is a 40 digit hex number. For TPM 2.0 the spec allows the passing in of variable length passwords and passphrases directly, so we should allow that in trusted keys for ease of use. Update the 'blobauth' parameter to take this into account, so we can now use plain text passwords for the keys. so before keyctl add trusted kmk "new 32 blobauth=f572d396fae9206628714fb2ce00f72e94f2258fkeyhandle=81000001" @u after we will accept both the old hex sha1 form as well as a new directly supplied password: keyctl add trusted kmk "new 32 blobauth=hello keyhandle=81000001" @u Since a sha1 hex code must be exactly 40 bytes long and a direct password must be 20 or less, we use the length as the discriminator for which form is input. Note this is both and enhancement and a potential bug fix. The TPM 2.0 spec requires us to strip leading zeros, meaning empyty authorization is a zero length HMAC whereas we're currently passing in 20 bytes of zeros. A lot of TPMs simply accept this as OK, but the Microsoft TPM emulator rejects it with TPM_RC_BAD_AUTH, so this patch makes the Microsoft TPM emulator work with trusted keys. Fixes: 0fe5480303 ("keys, trusted: seal/unseal with TPM 2.0 chips") Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> Tested-by: Jarkko Sakkinen <jarkko@kernel.org> Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-05-14 09:50:20 +02:00
Paul Moore	4c0ddc8712	selinux: add proper NULL termination to the secclass_map permissions ... commit e4c82eafb6 upstream. This patch adds the missing NULL termination to the "bpf" and "perf_event" object class permission lists. This missing NULL termination should really only affect the tools under scripts/selinux, with the most important being genheaders.c, although in practice this has not been an issue on any of my dev/test systems. If the problem were to manifest itself it would likely result in bogus permissions added to the end of the object class; thankfully with no access control checks using these bogus permissions and no policies defining these permissions the impact would likely be limited to some noise about undefined permissions during policy load. Cc: stable@vger.kernel.org Fixes: ec27c3568a ("selinux: bpf: Add selinux check for eBPF syscall operations") Fixes: da97e18458 ("perf_event: Add support for LSM and SELinux checks") Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-05-14 09:49:59 +02:00
Greg Kroah-Hartman	a1ac3f3093	Merge 5.10.36 into android12-5.10 ... Changes in 5.10.36 bus: mhi: core: Fix check for syserr at power_up bus: mhi: core: Clear configuration from channel context during reset bus: mhi: core: Sanity check values from remote device before use nitro_enclaves: Fix stale file descriptors on failed usercopy dyndbg: fix parsing file query without a line-range suffix s390/disassembler: increase ebpf disasm buffer size s390/zcrypt: fix zcard and zqueue hot-unplug memleak vhost-vdpa: fix vm_flags for virtqueue doorbell mapping tpm: acpi: Check eventlog signature before using it ACPI: custom_method: fix potential use-after-free issue ACPI: custom_method: fix a possible memory leak ftrace: Handle commands when closing set_ftrace_filter file ARM: 9056/1: decompressor: fix BSS size calculation for LLVM ld.lld arm64: dts: marvell: armada-37xx: add syscon compatible to NB clk node arm64: dts: mt8173: fix property typo of 'phys' in dsi node ecryptfs: fix kernel panic with null dev_name fs/epoll: restore waking from ep_done_scan() mtd: spi-nor: core: Fix an issue of releasing resources during read/write Revert "mtd: spi-nor: macronix: Add support for mx25l51245g" mtd: spinand: core: add missing MODULE_DEVICE_TABLE() mtd: rawnand: atmel: Update ecc_stats.corrected counter mtd: physmap: physmap-bt1-rom: Fix unintentional stack access erofs: add unsupported inode i_format check spi: stm32-qspi: fix pm_runtime usage_count counter spi: spi-ti-qspi: Free DMA resources scsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand() scsi: mpt3sas: Block PCI config access from userspace during reset mmc: uniphier-sd: Fix an error handling path in uniphier_sd_probe() mmc: uniphier-sd: Fix a resource leak in the remove function mmc: sdhci: Check for reset prior to DMA address unmap mmc: sdhci-pci: Fix initialization of some SD cards for Intel BYT-based controllers mmc: sdhci-tegra: Add required callbacks to set/clear CQE_EN bit mmc: block: Update ext_csd.cache_ctrl if it was written mmc: block: Issue a cache flush only when it's enabled mmc: core: Do a power cycle when the CMD11 fails mmc: core: Set read only for SD cards with permanent write protect bit mmc: core: Fix hanging on I/O during system suspend for removable cards irqchip/gic-v3: Do not enable irqs when handling spurious interrups cifs: Return correct error code from smb2_get_enc_key cifs: fix out-of-bound memory access when calling smb3_notify() at mount point cifs: detect dead connections only when echoes are enabled. smb2: fix use-after-free in smb2_ioctl_query_info() btrfs: handle remount to no compress during compression x86/build: Disable HIGHMEM64G selection for M486SX btrfs: fix metadata extent leak after failure to create subvolume intel_th: pci: Add Rocket Lake CPU support btrfs: fix race between transaction aborts and fsyncs leading to use-after-free posix-timers: Preserve return value in clock_adjtime32() fbdev: zero-fill colormap in fbcmap.c cpuidle: tegra: Fix C7 idling state on Tegra114 bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first staging: wimax/i2400m: fix byte-order issue spi: ath79: always call chipselect function spi: ath79: remove spi-master setup and cleanup assignment bus: mhi: core: Destroy SBL devices when moving to mission mode crypto: api - check for ERR pointers in crypto_destroy_tfm() crypto: qat - fix unmap invalid dma address usb: gadget: uvc: add bInterval checking for HS mode usb: webcam: Invalid size of Processing Unit Descriptor x86/sev: Do not require Hypervisor CPUID bit for SEV guests crypto: hisilicon/sec - fixes a printing error genirq/matrix: Prevent allocation counter corruption usb: gadget: f_uac2: validate input parameters usb: gadget: f_uac1: validate input parameters usb: dwc3: gadget: Ignore EP queue requests during bus reset usb: xhci: Fix port minor revision kselftest/arm64: mte: Fix compilation with native compiler ARM: tegra: acer-a500: Rename avdd to vdda of touchscreen node PCI: PM: Do not read power state in pci_enable_device_flags() kselftest/arm64: mte: Fix MTE feature detection ARM: dts: BCM5301X: fix "reg" formatting in /memory node ARM: dts: ux500: Fix up TVK R3 sensors x86/build: Propagate $(CLANG_FLAGS) to $(REALMODE_FLAGS) x86/boot: Add $(CLANG_FLAGS) to compressed KBUILD_CFLAGS efi/libstub: Add $(CLANG_FLAGS) to x86 flags soc/tegra: pmc: Fix completion of power-gate toggling arm64: dts: imx8mq-librem5-r3: Mark buck3 as always on tee: optee: do not check memref size on return from Secure World soundwire: cadence: only prepare attached devices on clock stop perf/arm_pmu_platform: Use dev_err_probe() for IRQ errors perf/arm_pmu_platform: Fix error handling random: initialize ChaCha20 constants with correct endianness usb: xhci-mtk: support quirk to disable usb2 lpm fpga: dfl: pci: add DID for D5005 PAC cards xhci: check port array allocation was successful before dereferencing it xhci: check control context is valid before dereferencing it. xhci: fix potential array out of bounds with several interrupters bus: mhi: core: Clear context for stopped channels from remove() ARM: dts: at91: change the key code of the gpio key tools/power/x86/intel-speed-select: Increase string size platform/x86: ISST: Account for increased timeout in some cases spi: dln2: Fix reference leak to master spi: omap-100k: Fix reference leak to master spi: qup: fix PM reference leak in spi_qup_remove() usb: gadget: tegra-xudc: Fix possible use-after-free in tegra_xudc_remove() usb: musb: fix PM reference leak in musb_irq_work() usb: core: hub: Fix PM reference leak in usb_port_resume() usb: dwc3: gadget: Check for disabled LPM quirk tty: n_gsm: check error while registering tty devices intel_th: Consistency and off-by-one fix phy: phy-twl4030-usb: Fix possible use-after-free in twl4030_usb_remove() crypto: sun8i-ss - Fix PM reference leak when pm_runtime_get_sync() fails crypto: sun8i-ce - Fix PM reference leak in sun8i_ce_probe() crypto: stm32/hash - Fix PM reference leak on stm32-hash.c crypto: stm32/cryp - Fix PM reference leak on stm32-cryp.c crypto: sa2ul - Fix PM reference leak in sa_ul_probe() crypto: omap-aes - Fix PM reference leak on omap-aes.c platform/x86: intel_pmc_core: Don't use global pmcdev in quirks spi: sync up initial chipselect state btrfs: do proper error handling in create_reloc_root btrfs: do proper error handling in btrfs_update_reloc_root btrfs: convert logic BUG_ON()'s in replace_path to ASSERT()'s drm: Added orientation quirk for OneGX1 Pro drm/qxl: do not run release if qxl failed to init drm/qxl: release shadow on shutdown drm/ast: Fix invalid usage of AST_MAX_HWC_WIDTH in cursor atomic_check drm/amd/display: changing sr exit latency drm/ast: fix memory leak when unload the driver drm/amd/display: Check for DSC support instead of ASIC revision drm/amd/display: Don't optimize bandwidth before disabling planes drm/amdgpu/display: buffer INTERRUPT_LOW_IRQ_CONTEXT interrupt work drm/amd/display/dc/dce/dce_aux: Remove duplicate line causing 'field overwritten' issue scsi: lpfc: Fix incorrect dbde assignment when building target abts wqe scsi: lpfc: Fix pt2pt connection does not recover after LOGO drm/amdgpu: Fix some unload driver issues sched/pelt: Fix task util_est update filtering kvfree_rcu: Use same set of GFP flags as does single-argument scsi: target: pscsi: Fix warning in pscsi_complete_cmd() media: ite-cir: check for receive overflow media: drivers: media: pci: sta2x11: fix Kconfig dependency on GPIOLIB media: imx: capture: Return -EPIPE from __capture_legacy_try_fmt() atomisp: don't let it go past pipes array power: supply: bq27xxx: fix power_avg for newer ICs extcon: arizona: Fix some issues when HPDET IRQ fires after the jack has been unplugged extcon: arizona: Fix various races on driver unbind media: media/saa7164: fix saa7164_encoder_register() memory leak bugs media: gspca/sq905.c: fix uninitialized variable power: supply: Use IRQF_ONESHOT backlight: qcom-wled: Use sink_addr for sync toggle backlight: qcom-wled: Fix FSC update issue for WLED5 drm/amdgpu: mask the xgmi number of hops reported from psp to kfd drm/amdkfd: Fix UBSAN shift-out-of-bounds warning drm/amdgpu : Fix asic reset regression issue introduce by 8f211fe8ac drm/amd/pm: fix workload mismatch on vega10 drm/amd/display: Fix UBSAN warning for not a valid value for type '_Bool' drm/amd/display: DCHUB underflow counter increasing in some scenarios drm/amd/display: fix dml prefetch validation scsi: qla2xxx: Always check the return value of qla24xx_get_isp_stats() drm/vkms: fix misuse of WARN_ON scsi: qla2xxx: Fix use after free in bsg mmc: sdhci-esdhc-imx: validate pinctrl before use it mmc: sdhci-pci: Add PCI IDs for Intel LKF mmc: sdhci-brcmstb: Remove CQE quirk ata: ahci: Disable SXS for Hisilicon Kunpeng920 drm/komeda: Fix bit check to import to value of proper type nvmet: return proper error code from discovery ctrl selftests/resctrl: Enable gcc checks to detect buffer overflows selftests/resctrl: Fix compilation issues for global variables selftests/resctrl: Fix compilation issues for other global variables selftests/resctrl: Clean up resctrl features check selftests/resctrl: Fix missing options "-n" and "-p" selftests/resctrl: Use resctrl/info for feature detection selftests/resctrl: Fix incorrect parsing of iMC counters selftests/resctrl: Fix checking for < 0 for unsigned values power: supply: cpcap-charger: Add usleep to cpcap charger to avoid usb plug bounce scsi: smartpqi: Use host-wide tag space scsi: smartpqi: Correct request leakage during reset operations scsi: smartpqi: Add new PCI IDs scsi: scsi_dh_alua: Remove check for ASC 24h in alua_rtpg() media: em28xx: fix memory leak media: vivid: update EDID drm/msm/dp: Fix incorrect NULL check kbot warnings in DP driver clk: socfpga: arria10: Fix memory leak of socfpga_clk on error return power: supply: generic-adc-battery: fix possible use-after-free in gab_remove() power: supply: s3c_adc_battery: fix possible use-after-free in s3c_adc_bat_remove() media: tc358743: fix possible use-after-free in tc358743_remove() media: adv7604: fix possible use-after-free in adv76xx_remove() media: i2c: adv7511-v4l2: fix possible use-after-free in adv7511_remove() media: i2c: tda1997: Fix possible use-after-free in tda1997x_remove() media: i2c: adv7842: fix possible use-after-free in adv7842_remove() media: platform: sti: Fix runtime PM imbalance in regs_show media: sun8i-di: Fix runtime PM imbalance in deinterlace_start_streaming media: dvb-usb: fix memory leak in dvb_usb_adapter_init media: gscpa/stv06xx: fix memory leak sched/fair: Ignore percpu threads for imbalance pulls drm/msm/mdp5: Configure PP_SYNC_HEIGHT to double the vtotal drm/msm/mdp5: Do not multiply vclk line count by 100 drm/amdgpu/ttm: Fix memory leak userptr pages drm/radeon/ttm: Fix memory leak userptr pages drm/amd/display: Fix debugfs link_settings entry drm/amd/display: Fix UBSAN: shift-out-of-bounds warning drm/amdkfd: Fix cat debugfs hang_hws file causes system crash bug amdgpu: avoid incorrect %hu format string drm/amd/display: Try YCbCr420 color when YCbCr444 fails drm/amdgpu: fix NULL pointer dereference scsi: lpfc: Fix crash when a REG_RPI mailbox fails triggering a LOGO response scsi: lpfc: Fix error handling for mailboxes completed in MBX_POLL mode scsi: lpfc: Remove unsupported mbox PORT_CAPABILITIES logic mfd: intel-m10-bmc: Fix the register access range mfd: da9063: Support SMBus and I2C mode mfd: arizona: Fix rumtime PM imbalance on error scsi: libfc: Fix a format specifier perf: Rework perf_event_exit_event() sched,fair: Alternative sched_slice() block/rnbd-clt: Fix missing a memory free when unloading the module s390/archrandom: add parameter check for s390_arch_random_generate sched,psi: Handle potential task count underflow bugs more gracefully power: supply: cpcap-battery: fix invalid usage of list cursor ALSA: emu8000: Fix a use after free in snd_emu8000_create_mixer ALSA: hda/conexant: Re-order CX5066 quirk table entries ALSA: sb: Fix two use after free in snd_sb_qsound_build ALSA: usb-audio: Explicitly set up the clock selector ALSA: usb-audio: Add dB range mapping for Sennheiser Communications Headset PC 8 ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 445 G7 ALSA: hda/realtek: GA503 use same quirks as GA401 ALSA: hda/realtek: fix mic boost on Intel NUC 8 ALSA: hda/realtek - Headset Mic issue on HP platform ALSA: hda/realtek: fix static noise on ALC285 Lenovo laptops ALSA: hda/realtek: Add quirk for Intel Clevo PCx0Dx tools/power/turbostat: Fix turbostat for AMD Zen CPUs btrfs: fix race when picking most recent mod log operation for an old root arm64/vdso: Discard .note.gnu.property sections in vDSO Makefile: Move -Wno-unused-but-set-variable out of GCC only block fs: fix reporting supported extra file attributes for statx() virtiofs: fix memory leak in virtio_fs_probe() kcsan, debugfs: Move debugfs file creation out of early init ubifs: Only check replay with inode type to judge if inode linked f2fs: fix error handling in f2fs_end_enable_verity() f2fs: fix to avoid out-of-bounds memory access mlxsw: spectrum_mr: Update egress RIF list before route's action openvswitch: fix stack OOB read while fragmenting IPv4 packets ACPI: GTDT: Don't corrupt interrupt mappings on watchdow probe failure NFS: fs_context: validate UDP retrans to prevent shift out-of-bounds NFS: Don't discard pNFS layout segments that are marked for return NFSv4: Don't discard segments marked for return in _pnfs_return_layout() Input: ili210x - add missing negation for touch indication on ili210x jffs2: Fix kasan slab-out-of-bounds problem jffs2: Hook up splice_write callback powerpc/powernv: Enable HAIL (HV AIL) for ISA v3.1 processors powerpc/eeh: Fix EEH handling for hugepages in ioremap space. powerpc/kexec_file: Use current CPU info while setting up FDT powerpc/32: Fix boot failure with CONFIG_STACKPROTECTOR powerpc: fix EDEADLOCK redefinition error in uapi/asm/errno.h intel_th: pci: Add Alder Lake-M support tpm: efi: Use local variable for calculating final log size tpm: vtpm_proxy: Avoid reading host log when using a virtual device crypto: arm/curve25519 - Move '.fpu' after '.arch' crypto: rng - fix crypto_rng_reset() refcounting when !CRYPTO_STATS md/raid1: properly indicate failure when ending a failed write request dm raid: fix inconclusive reshape layout on fast raid4/5/6 table reload sequences fuse: fix write deadlock exfat: fix erroneous discard when clear cluster bit sfc: farch: fix TX queue lookup in TX flush done handling sfc: farch: fix TX queue lookup in TX event handling security: commoncap: fix -Wstringop-overread warning Fix misc new gcc warnings jffs2: check the validity of dstlen in jffs2_zlib_compress() smb3: when mounting with multichannel include it in requested capabilities smb3: do not attempt multichannel to server which does not support it Revert 337f13046f ("futex: Allow FUTEX_CLOCK_REALTIME with FUTEX_WAIT op") futex: Do not apply time namespace adjustment on FUTEX_LOCK_PI x86/cpu: Initialize MSR_TSC_AUX if RDTSCP *or* RDPID is supported kbuild: update config_data.gz only when the content of .config is changed ext4: annotate data race in start_this_handle() ext4: annotate data race in jbd2_journal_dirty_metadata() ext4: fix check to prevent false positive report of incorrect used inodes ext4: do not set SB_ACTIVE in ext4_orphan_cleanup() ext4: fix error code in ext4_commit_super ext4: fix ext4_error_err save negative errno into superblock ext4: fix error return code in ext4_fc_perform_commit() ext4: allow the dax flag to be set and cleared on inline directories ext4: Fix occasional generic/418 failure media: dvbdev: Fix memory leak in dvb_media_device_free() media: dvb-usb: Fix use-after-free access media: dvb-usb: Fix memory leak at error in dvb_usb_device_init() media: staging/intel-ipu3: Fix memory leak in imu_fmt media: staging/intel-ipu3: Fix set_fmt error handling media: staging/intel-ipu3: Fix race condition during set_fmt media: v4l2-ctrls: fix reference to freed memory media: venus: hfi_parser: Don't initialize parser on v1 usb: gadget: dummy_hcd: fix gpf in gadget_setup usb: gadget: Fix double free of device descriptor pointers usb: gadget/function/f_fs string table fix for multiple languages usb: dwc3: gadget: Remove FS bInterval_m1 limitation usb: dwc3: gadget: Fix START_TRANSFER link state check usb: dwc3: core: Do core softreset when switch mode usb: dwc2: Fix session request interrupt handler tty: fix memory leak in vc_deallocate rsi: Use resume_noirq for SDIO tools/power turbostat: Fix offset overflow issue in index converting tracing: Map all PIDs to command lines tracing: Restructure trace_clock_global() to never block dm persistent data: packed struct should have an aligned() attribute too dm space map common: fix division bug in sm_ll_find_free_block() dm integrity: fix missing goto in bitmap_flush_interval error handling dm rq: fix double free of blk_mq_tag_set in dev remove after table load fails lib/vsprintf.c: remove leftover 'f' and 'F' cases from bstr_printf() thermal/drivers/cpufreq_cooling: Fix slab OOB issue thermal/core/fair share: Lock the thermal zone while looping over instances Linux 5.10.36 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I7b8075de5edd8de69205205cddb9a3273d7d0810	2021-05-13 14:22:11 +02:00
Arnd Bergmann	f37b9c142e	security: commoncap: fix -Wstringop-overread warning ... commit 82e5d8cc76 upstream. gcc-11 introdces a harmless warning for cap_inode_getsecurity: security/commoncap.c: In function ‘cap_inode_getsecurity’: security/commoncap.c:440:33: error: ‘memcpy’ reading 16 bytes from a region of size 0 [-Werror=stringop-overread] 440 | memcpy(&nscap->data, &cap->data, sizeof(__le32) * 2 * VFS_CAP_U32); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The problem here is that tmpbuf is initialized to NULL, so gcc assumes it is not accessible unless it gets set by vfs_getxattr_alloc(). This is a legitimate warning as far as I can tell, but the code is correct since it correctly handles the error when that function fails. Add a separate NULL check to tell gcc about it as well. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: James Morris <jamorris@linux.microsoft.com> Cc: Andrey Zhizhikin <andrey.z@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-05-11 14:47:36 +02:00
Greg Kroah-Hartman	0907114be2	Merge 5.10.33 into android12-5.10 ... Changes in 5.10.33 vhost-vdpa: protect concurrent access to vhost device iotlb gpio: omap: Save and restore sysconfig KEYS: trusted: Fix TPM reservation for seal/unseal vdpa/mlx5: Set err = -ENOMEM in case dma_map_sg_attrs fails pinctrl: lewisburg: Update number of pins in community block: return -EBUSY when there are open partitions in blkdev_reread_part pinctrl: core: Show pin numbers for the controllers with base = 0 arm64: dts: allwinner: Revert SD card CD GPIO for Pine64-LTS bpf: Permits pointers on stack for helper calls bpf: Allow variable-offset stack access bpf: Refactor and streamline bounds check into helper bpf: Tighten speculative pointer arithmetic mask locking/qrwlock: Fix ordering in queued_write_lock_slowpath() perf/x86/intel/uncore: Remove uncore extra PCI dev HSWEP_PCI_PCU_3 perf/x86/kvm: Fix Broadwell Xeon stepping in isolation_ucodes[] perf auxtrace: Fix potential NULL pointer dereference perf map: Fix error return code in maps__clone() HID: google: add don USB id HID: alps: fix error return code in alps_input_configured() HID cp2112: fix support for multiple gpiochips HID: wacom: Assign boolean values to a bool variable soc: qcom: geni: shield geni_icc_get() for ACPI boot dmaengine: xilinx: dpdma: Fix descriptor issuing on video group dmaengine: xilinx: dpdma: Fix race condition in done IRQ ARM: dts: Fix swapped mmc order for omap3 net: geneve: check skb is large enough for IPv4/IPv6 header dmaengine: tegra20: Fix runtime PM imbalance on error s390/entry: save the caller of psw_idle arm64: kprobes: Restore local irqflag if kprobes is cancelled xen-netback: Check for hotplug-status existence before watching cavium/liquidio: Fix duplicate argument kasan: fix hwasan build for gcc csky: change a Kconfig symbol name to fix e1000 build error ia64: fix discontig.c section mismatches ia64: tools: remove duplicate definition of ia64_mf() on ia64 x86/crash: Fix crash_setup_memmap_entries() out-of-bounds access net: hso: fix NULL-deref on disconnect regression USB: CDC-ACM: fix poison/unpoison imbalance Linux 5.10.33 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I638db3c919ad938eaaaac3d687175252edcd7990	2021-04-29 13:57:47 +02:00
James Bottomley	bf84ef2dd2	KEYS: trusted: Fix TPM reservation for seal/unseal ... [ Upstream commit 9d5171eab4 ] The original patch 8c657a0590 ("KEYS: trusted: Reserve TPM for seal and unseal operations") was correct on the mailing list: https://lore.kernel.org/linux-integrity/20210128235621.127925-4-jarkko@kernel.org/ But somehow got rebased so that the tpm_try_get_ops() in tpm2_seal_trusted() got lost. This causes an imbalanced put of the TPM ops and causes oopses on TIS based hardware. This fix puts back the lost tpm_try_get_ops() Fixes: 8c657a0590 ("KEYS: trusted: Reserve TPM for seal and unseal operations") Reported-by: Mimi Zohar <zohar@linux.ibm.com> Acked-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-04-28 13:39:59 +02:00
Kuan-Ying Lee	546252f29c	ANDROID: selinux: add vendor hook in selinux ... Add vendor hook for selinux_state, so we can know if the selinux_state is initialized Bug: 186363840 Signed-off-by: Kuan-Ying Lee <Kuan-Ying.Lee@mediatek.com> Change-Id: Ideed051a1d53ed1bce7d7915e38366264a7d77eb	2021-04-26 10:27:58 -07:00
Greg Kroah-Hartman	9a705f0463	Merge 5.10.30 into android12-5.10 ... Changes in 5.10.30 xfrm/compat: Cleanup WARN()s that can be user-triggered ALSA: aloop: Fix initialization of controls ALSA: hda/realtek: Fix speaker amp setup on Acer Aspire E1 ALSA: hda/conexant: Apply quirk for another HP ZBook G5 model ASoC: intel: atom: Stop advertising non working S24LE support nfc: fix refcount leak in llcp_sock_bind() nfc: fix refcount leak in llcp_sock_connect() nfc: fix memory leak in llcp_sock_connect() nfc: Avoid endless loops caused by repeated llcp_sock_connect() selinux: make nslot handling in avtab more robust selinux: fix cond_list corruption when changing booleans selinux: fix race between old and new sidtab xen/evtchn: Change irq_info lock to raw_spinlock_t net: ipv6: check for validity before dereferencing cfg->fc_nlinfo.nlh net: dsa: lantiq_gswip: Let GSWIP automatically set the xMII clock net: dsa: lantiq_gswip: Don't use PHY auto polling net: dsa: lantiq_gswip: Configure all remaining GSWIP_MII_CFG bits drm/i915: Fix invalid access to ACPI _DSM objects ACPI: processor: Fix build when CONFIG_ACPI_PROCESSOR=m IB/hfi1: Fix probe time panic when AIP is enabled with a buggy BIOS LOOKUP_MOUNTPOINT: we are cleaning "jumped" flag too late gcov: re-fix clang-11+ support ia64: fix user_stack_pointer() for ptrace() nds32: flush_dcache_page: use page_mapping_file to avoid races with swapoff ocfs2: fix deadlock between setattr and dio_end_io_write fs: direct-io: fix missing sdio->boundary ethtool: fix incorrect datatype in set_eee ops of: property: fw_devlink: do not link ".*,nr-gpios" parisc: parisc-agp requires SBA IOMMU driver parisc: avoid a warning on u8 cast for cmpxchg on u8 pointers ARM: dts: turris-omnia: configure LED[2]/INTn pin as interrupt pin batman-adv: initialize "struct batadv_tvlv_tt_vlan_data"->reserved field ice: Continue probe on link/PHY errors ice: Increase control queue timeout ice: prevent ice_open and ice_stop during reset ice: fix memory allocation call ice: remove DCBNL_DEVRESET bit from PF state ice: Fix for dereference of NULL pointer ice: Use port number instead of PF ID for WoL ice: Cleanup fltr list in case of allocation issues iwlwifi: pcie: properly set LTR workarounds on 22000 devices ice: fix memory leak of aRFS after resuming from suspend net: hso: fix null-ptr-deref during tty device unregistration libbpf: Fix bail out from 'ringbuf_process_ring()' on error bpf: Enforce that struct_ops programs be GPL-only bpf: link: Refuse non-O_RDWR flags in BPF_OBJ_GET ethernet/netronome/nfp: Fix a use after free in nfp_bpf_ctrl_msg_rx libbpf: Ensure umem pointer is non-NULL before dereferencing libbpf: Restore umem state after socket create failure libbpf: Only create rx and tx XDP rings when necessary bpf: Refcount task stack in bpf_get_task_stack bpf, sockmap: Fix sk->prot unhash op reset bpf, sockmap: Fix incorrect fwd_alloc accounting net: ensure mac header is set in virtio_net_hdr_to_skb() i40e: Fix sparse warning: missing error code 'err' i40e: Fix sparse error: 'vsi->netdev' could be null i40e: Fix sparse error: uninitialized symbol 'ring' i40e: Fix sparse errors in i40e_txrx.c vdpa/mlx5: Fix suspend/resume index restoration net: sched: sch_teql: fix null-pointer dereference net: sched: fix action overwrite reference counting nl80211: fix beacon head validation nl80211: fix potential leak of ACL params cfg80211: check S1G beacon compat element length mac80211: fix time-is-after bug in mlme mac80211: fix TXQ AC confusion net: hsr: Reset MAC header for Tx path net-ipv6: bugfix - raw & sctp - switch to ipv6_can_nonlocal_bind() net: let skb_orphan_partial wake-up waiters. thunderbolt: Fix a leak in tb_retimer_add() thunderbolt: Fix off by one in tb_port_find_retimer() usbip: add sysfs_lock to synchronize sysfs code paths usbip: stub-dev synchronize sysfs code paths usbip: vudc synchronize sysfs code paths usbip: synchronize event handler with sysfs code paths driver core: Fix locking bug in deferred_probe_timeout_work_func() scsi: pm80xx: Fix chip initialization failure scsi: target: iscsi: Fix zero tag inside a trace event percpu: make pcpu_nr_empty_pop_pages per chunk type i2c: turn recovery error on init to debug KVM: x86/mmu: change TDP MMU yield function returns to match cond_resched KVM: x86/mmu: Merge flush and non-flush tdp_mmu_iter_cond_resched KVM: x86/mmu: Rename goal_gfn to next_last_level_gfn KVM: x86/mmu: Ensure forward progress when yielding in TDP MMU iter KVM: x86/mmu: Yield in TDU MMU iter even if no SPTES changed KVM: x86/mmu: Ensure TLBs are flushed when yielding during GFN range zap KVM: x86/mmu: Ensure TLBs are flushed for TDP MMU during NX zapping KVM: x86/mmu: Don't allow TDP MMU to yield when recovering NX pages KVM: x86/mmu: preserve pending TLB flush across calls to kvm_tdp_mmu_zap_sp net: sched: fix err handler in tcf_action_init() ice: Refactor DCB related variables out of the ice_port_info struct ice: Recognize 860 as iSCSI port in CEE mode xfrm: interface: fix ipv4 pmtu check to honor ip header df xfrm: Use actual socket sk instead of skb socket for xfrm_output_resume remoteproc: qcom: pil_info: avoid 64-bit division regulator: bd9571mwv: Fix AVS and DVFS voltage range ARM: OMAP4: Fix PMIC voltage domains for bionic ARM: OMAP4: PM: update ROM return address for OSWR and OFF net: xfrm: Localize sequence counter per network namespace esp: delete NETIF_F_SCTP_CRC bit from features for esp offload ASoC: SOF: Intel: HDA: fix core status verification ASoC: wm8960: Fix wrong bclk and lrclk with pll enabled for some chips xfrm: Fix NULL pointer dereference on policy lookup virtchnl: Fix layout of RSS structures i40e: Added Asym_Pause to supported link modes i40e: Fix kernel oops when i40e driver removes VF's hostfs: fix memory handling in follow_link() amd-xgbe: Update DMA coherency values vxlan: do not modify the shared tunnel info when PMTU triggers an ICMP reply geneve: do not modify the shared tunnel info when PMTU triggers an ICMP reply sch_red: fix off-by-one checks in red_check_params() drivers/net/wan/hdlc_fr: Fix a double free in pvc_xmit arm64: dts: imx8mm/q: Fix pad control of SD1_DATA0 xfrm: Provide private skb extensions for segmented and hw offloaded ESP packets can: bcm/raw: fix msg_namelen values depending on CAN_REQUIRED_SIZE can: isotp: fix msg_namelen values depending on CAN_REQUIRED_SIZE mlxsw: spectrum: Fix ECN marking in tunnel decapsulation ethernet: myri10ge: Fix a use after free in myri10ge_sw_tso gianfar: Handle error code at MAC address change net: dsa: Fix type was not set for devlink port cxgb4: avoid collecting SGE_QBASE regs during traffic net:tipc: Fix a double free in tipc_sk_mcast_rcv ARM: dts: imx6: pbab01: Set vmmc supply for both SD interfaces net/ncsi: Avoid channel_monitor hrtimer deadlock net: qrtr: Fix memory leak on qrtr_tx_wait failure nfp: flower: ignore duplicate merge hints from FW net: phy: broadcom: Only advertise EEE for supported modes I2C: JZ4780: Fix bug for Ingenic X1000. ASoC: sunxi: sun4i-codec: fill ASoC card owner net/mlx5e: Fix mapping of ct_label zero net/mlx5e: Fix ethtool indication of connector type net/mlx5: Don't request more than supported EQs net/rds: Fix a use after free in rds_message_map_pages xdp: fix xdp_return_frame() kernel BUG throw for page_pool memory model soc/fsl: qbman: fix conflicting alignment attributes i40e: Fix display statistics for veb_tc RDMA/rtrs-clt: Close rtrs client conn before destroying rtrs clt session files drm/msm: Set drvdata to NULL when msm_drm_init() fails net: udp: Add support for getsockopt(..., ..., UDP_GRO, ..., ...); mptcp: forbit mcast-related sockopt on MPTCP sockets scsi: ufs: core: Fix task management request completion timeout scsi: ufs: core: Fix wrong Task Tag used in task management request UPIUs net: cls_api: Fix uninitialised struct field bo->unlocked_driver_cb net: macb: restore cmp registers on resume path clk: fix invalid usage of list cursor in register clk: fix invalid usage of list cursor in unregister workqueue: Move the position of debug_work_activate() in __queue_work() s390/cpcmd: fix inline assembly register clobbering perf inject: Fix repipe usage net: openvswitch: conntrack: simplify the return expression of ovs_ct_limit_get_default_limit() openvswitch: fix send of uninitialized stack memory in ct limit reply i2c: designware: Adjust bus_freq_hz when refuse high speed mode set iwlwifi: fix 11ax disabled bit in the regulatory capability flags can: mcp251x: fix support for half duplex SPI host controllers tipc: increment the tmp aead refcnt before attaching it net: hns3: clear VF down state bit before request link status net/mlx5: Fix placement of log_max_flow_counter net/mlx5: Fix PPLM register mapping net/mlx5: Fix PBMC register mapping RDMA/cxgb4: check for ipv6 address properly while destroying listener perf report: Fix wrong LBR block sorting RDMA/qedr: Fix kernel panic when trying to access recv_cq drm/vc4: crtc: Reduce PV fifo threshold on hvs4 i40e: Fix parameters in aq_get_phy_register() RDMA/addr: Be strict with gid size vdpa/mlx5: should exclude header length and fcs from mtu vdpa/mlx5: Fix wrong use of bit numbers RAS/CEC: Correct ce_add_elem()'s returned values clk: socfpga: fix iomem pointer cast on 64-bit lockdep: Address clang -Wformat warning printing for %hd dt-bindings: net: ethernet-controller: fix typo in NVMEM net: sched: bump refcount for new action in ACT replace mode gpiolib: Read "gpio-line-names" from a firmware node cfg80211: remove WARN_ON() in cfg80211_sme_connect net: tun: set tun->dev->addr_len during TUNSETLINK processing drivers: net: fix memory leak in atusb_probe drivers: net: fix memory leak in peak_usb_create_dev net: mac802154: Fix general protection fault net: ieee802154: nl-mac: fix check on panid net: ieee802154: fix nl802154 del llsec key net: ieee802154: fix nl802154 del llsec dev net: ieee802154: fix nl802154 add llsec key net: ieee802154: fix nl802154 del llsec devkey net: ieee802154: forbid monitor for set llsec params net: ieee802154: forbid monitor for del llsec seclevel net: ieee802154: stop dump llsec params for monitors Revert "net: sched: bump refcount for new action in ACT replace mode" Linux 5.10.30 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ie8754a2e4dfef03bf1f2b878843cde19a4adab21	2021-04-15 14:23:41 +02:00
Ondrej Mosnacek	a28124e8ad	selinux: fix race between old and new sidtab ... commit 9ad6e9cb39 upstream. Since commit 1b8b31a2e6 ("selinux: convert policy read-write lock to RCU"), there is a small window during policy load where the new policy pointer has already been installed, but some threads may still be holding the old policy pointer in their read-side RCU critical sections. This means that there may be conflicting attempts to add a new SID entry to both tables via sidtab_context_to_sid(). See also (and the rest of the thread): https://lore.kernel.org/selinux/CAFqZXNvfux46_f8gnvVvRYMKoes24nwm2n3sPbMjrB8vKTW00g@mail.gmail.com/ Fix this by installing the new policy pointer under the old sidtab's spinlock along with marking the old sidtab as "frozen". Then, if an attempt to add new entry to a "frozen" sidtab is detected, make sidtab_context_to_sid() return -ESTALE to indicate that a new policy has been installed and that the caller will have to abort the policy transaction and try again after re-taking the policy pointer (which is guaranteed to be a newer policy). This requires adding a retry-on-ESTALE logic to all callers of sidtab_context_to_sid(), but fortunately these are easy to determine and aren't that many. This seems to be the simplest solution for this problem, even if it looks somewhat ugly. Note that other places in the kernel (e.g. do_mknodat() in fs/namei.c) use similar stale-retry patterns, so I think it's reasonable. Cc: stable@vger.kernel.org Fixes: 1b8b31a2e6 ("selinux: convert policy read-write lock to RCU") Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-04-14 08:41:57 +02:00
Ondrej Mosnacek	fd75d73aa2	selinux: fix cond_list corruption when changing booleans ... commit d8f5f0ea5b upstream. Currently, duplicate_policydb_cond_list() first copies the whole conditional avtab and then tries to link to the correct entries in cond_dup_av_list() using avtab_search(). However, since the conditional avtab may contain multiple entries with the same key, this approach often fails to find the right entry, potentially leading to wrong rules being activated/deactivated when booleans are changed. To fix this, instead start with an empty conditional avtab and add the individual entries one-by-one while building the new av_lists. This approach leads to the correct result, since each entry is present in the av_lists exactly once. The issue can be reproduced with Fedora policy as follows: # sesearch -s ftpd_t -t public_content_rw_t -c dir -p create -A allow ftpd_t non_security_file_type:dir { add_name create getattr ioctl link lock open read remove_name rename reparent rmdir search setattr unlink watch watch_reads write }; [ ftpd_full_access ]:True allow ftpd_t public_content_rw_t:dir { add_name create link remove_name rename reparent rmdir setattr unlink watch watch_reads write }; [ ftpd_anon_write ]:True # setsebool ftpd_anon_write=off ftpd_connect_all_unreserved=off ftpd_connect_db=off ftpd_full_access=off On fixed kernels, the sesearch output is the same after the setsebool command: # sesearch -s ftpd_t -t public_content_rw_t -c dir -p create -A allow ftpd_t non_security_file_type:dir { add_name create getattr ioctl link lock open read remove_name rename reparent rmdir search setattr unlink watch watch_reads write }; [ ftpd_full_access ]:True allow ftpd_t public_content_rw_t:dir { add_name create link remove_name rename reparent rmdir setattr unlink watch watch_reads write }; [ ftpd_anon_write ]:True While on the broken kernels, it will be different: # sesearch -s ftpd_t -t public_content_rw_t -c dir -p create -A allow ftpd_t non_security_file_type:dir { add_name create getattr ioctl link lock open read remove_name rename reparent rmdir search setattr unlink watch watch_reads write }; [ ftpd_full_access ]:True allow ftpd_t non_security_file_type:dir { add_name create getattr ioctl link lock open read remove_name rename reparent rmdir search setattr unlink watch watch_reads write }; [ ftpd_full_access ]:True allow ftpd_t non_security_file_type:dir { add_name create getattr ioctl link lock open read remove_name rename reparent rmdir search setattr unlink watch watch_reads write }; [ ftpd_full_access ]:True While there, also simplify the computation of nslots. This changes the nslots values for nrules 2 or 3 to just two slots instead of 4, which makes the sequence more consistent. Cc: stable@vger.kernel.org Fixes: c7c556f1e8 ("selinux: refactor changing booleans") Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-04-14 08:41:57 +02:00
Ondrej Mosnacek	4f29b08e23	selinux: make nslot handling in avtab more robust ... commit 442dc00f82 upstream. 1. Make sure all fileds are initialized in avtab_init(). 2. Slightly refactor avtab_alloc() to use the above fact. 3. Use h->nslot == 0 as a sentinel in the access functions to prevent dereferencing h->htable when it's not allocated. Cc: stable@vger.kernel.org Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-04-14 08:41:57 +02:00
Greg Kroah-Hartman	b9a61f9a56	Merge 5.10.27 into android12-5.10 ... Changes in 5.10.27 mm/memcg: rename mem_cgroup_split_huge_fixup to split_page_memcg and add nr_pages argument mm/memcg: set memcg when splitting page mt76: fix tx skb error handling in mt76_dma_tx_queue_skb net: stmmac: fix dma physical address of descriptor when display ring net: fec: ptp: avoid register access when ipg clock is disabled powerpc/4xx: Fix build errors from mfdcr() atm: eni: dont release is never initialized atm: lanai: dont run lanai_dev_close if not open Revert "r8152: adjust the settings about MAC clock speed down for RTL8153" ALSA: hda: ignore invalid NHLT table ixgbe: Fix memleak in ixgbe_configure_clsu32 scsi: ufs: ufs-qcom: Disable interrupt in reset path blk-cgroup: Fix the recursive blkg rwstat net: tehuti: fix error return code in bdx_probe() net: intel: iavf: fix error return code of iavf_init_get_resources() sun/niu: fix wrong RXMAC_BC_FRM_CNT_COUNT count gianfar: fix jumbo packets+napi+rx overrun crash cifs: ask for more credit on async read/write code paths gfs2: fix use-after-free in trans_drain cpufreq: blacklist Arm Vexpress platforms in cpufreq-dt-platdev gpiolib: acpi: Add missing IRQF_ONESHOT nfs: fix PNFS_FLEXFILE_LAYOUT Kconfig default NFS: Correct size calculation for create reply length net: hisilicon: hns: fix error return code of hns_nic_clear_all_rx_fetch() net: wan: fix error return code of uhdlc_init() net: davicom: Use platform_get_irq_optional() net: enetc: set MAC RX FIFO to recommended value atm: uPD98402: fix incorrect allocation atm: idt77252: fix null-ptr-dereference cifs: change noisy error message to FYI irqchip/ingenic: Add support for the JZ4760 kbuild: add image_name to no-sync-config-targets kbuild: dummy-tools: fix inverted tests for gcc umem: fix error return code in mm_pci_probe() sparc64: Fix opcode filtering in handling of no fault loads habanalabs: Call put_pid() when releasing control device staging: rtl8192e: fix kconfig dependency on CRYPTO u64_stats,lockdep: Fix u64_stats_init() vs lockdep kselftest: arm64: Fix exit code of sve-ptrace regulator: qcom-rpmh: Correct the pmic5_hfsmps515 buck block: Fix REQ_OP_ZONE_RESET_ALL handling drm/amd/display: Revert dram_clock_change_latency for DCN2.1 drm/amdgpu: fb BO should be ttm_bo_type_device drm/radeon: fix AGP dependency nvme: simplify error logic in nvme_validate_ns() nvme: add NVME_REQ_CANCELLED flag in nvme_cancel_request() nvme-fc: set NVME_REQ_CANCELLED in nvme_fc_terminate_exchange() nvme-fc: return NVME_SC_HOST_ABORTED_CMD when a command has been aborted nvme-core: check ctrl css before setting up zns nvme-rdma: Fix a use after free in nvmet_rdma_write_data_done nvme-pci: add the DISABLE_WRITE_ZEROES quirk for a Samsung PM1725a nfs: we don't support removing system.nfs4_acl block: Suppress uevent for hidden device when removed mm/fork: clear PASID for new mm ia64: fix ia64_syscall_get_set_arguments() for break-based syscalls ia64: fix ptrace(PTRACE_SYSCALL_INFO_EXIT) sign static_call: Pull some static_call declarations to the type headers static_call: Allow module use without exposing static_call_key static_call: Fix the module key fixup static_call: Fix static_call_set_init() KVM: x86: Protect userspace MSR filter with SRCU, and set atomically-ish btrfs: fix sleep while in non-sleep context during qgroup removal selinux: don't log MAC_POLICY_LOAD record on failed policy load selinux: fix variable scope issue in live sidtab conversion netsec: restore phy power state after controller reset platform/x86: intel-vbtn: Stop reporting SW_DOCK events psample: Fix user API breakage z3fold: prevent reclaim/free race for headless pages squashfs: fix inode lookup sanity checks squashfs: fix xattr id and id lookup sanity checks hugetlb_cgroup: fix imbalanced css_get and css_put pair for shared mappings kasan: fix per-page tags for non-page_alloc pages gcov: fix clang-11+ support ACPI: video: Add missing callback back for Sony VPCEH3U1E ACPICA: Always create namespace nodes using acpi_ns_create_node() arm64: stacktrace: don't trace arch_stack_walk() arm64: dts: ls1046a: mark crypto engine dma coherent arm64: dts: ls1012a: mark crypto engine dma coherent arm64: dts: ls1043a: mark crypto engine dma coherent ARM: dts: at91: sam9x60: fix mux-mask for PA7 so it can be set to A, B and C ARM: dts: at91: sam9x60: fix mux-mask to match product's datasheet ARM: dts: at91-sama5d27_som1: fix phy address to 7 integrity: double check iint_cache was initialized drm/etnaviv: Use FOLL_FORCE for userptr drm/amd/pm: workaround for audio noise issue drm/amdgpu/display: restore AUX_DPHY_TX_CONTROL for DCN2.x drm/amdgpu: Add additional Sienna Cichlid PCI ID drm/i915: Fix the GT fence revocation runtime PM logic dm verity: fix DM_VERITY_OPTS_MAX value dm ioctl: fix out of bounds array access when no devices bus: omap_l3_noc: mark l3 irqs as IRQF_NO_THREAD ARM: OMAP2+: Fix smartreflex init regression after dropping legacy data soc: ti: omap-prm: Fix occasional abort on reset deassert for dra7 iva veth: Store queue_mapping independently of XDP prog presence bpf: Change inode_storage's lookup_elem return value from NULL to -EBADF libbpf: Fix INSTALL flag order net/mlx5e: RX, Mind the MPWQE gaps when calculating offsets net/mlx5e: When changing XDP program without reset, take refs for XSK RQs net/mlx5e: Don't match on Geneve options in case option masks are all zero ipv6: fix suspecious RCU usage warning drop_monitor: Perform cleanup upon probe registration failure macvlan: macvlan_count_rx() needs to be aware of preemption net: sched: validate stab values net: dsa: bcm_sf2: Qualify phydev->dev_flags based on port igc: reinit_locked() should be called with rtnl_lock igc: Fix Pause Frame Advertising igc: Fix Supported Pause Frame Link Setting igc: Fix igc_ptp_rx_pktstamp() e1000e: add rtnl_lock() to e1000_reset_task e1000e: Fix error handling in e1000_set_d0_lplu_state_82571 net/qlcnic: Fix a use after free in qlcnic_83xx_get_minidump_template net: phy: broadcom: Add power down exit reset state delay ftgmac100: Restart MAC HW once clk: qcom: gcc-sc7180: Use floor ops for the correct sdcc1 clk net: ipa: terminate message handler arrays net: qrtr: fix a kernel-infoleak in qrtr_recvmsg() flow_dissector: fix byteorder of dissected ICMP ID selftests/bpf: Set gopt opt_class to 0 if get tunnel opt failed netfilter: ctnetlink: fix dump of the expect mask attribute net: hdlc_x25: Prevent racing between "x25_close" and "x25_xmit"/"x25_rx" net: phylink: Fix phylink_err() function name error in phylink_major_config tipc: better validate user input in tipc_nl_retrieve_key() tcp: relookup sock for RST+ACK packets handled by obsolete req sock can: isotp: isotp_setsockopt(): only allow to set low level TX flags for CAN-FD can: isotp: TX-path: ensure that CAN frame flags are initialized can: peak_usb: add forgotten supported devices can: flexcan: flexcan_chip_freeze(): fix chip freeze for missing bitrate can: kvaser_pciefd: Always disable bus load reporting can: c_can_pci: c_can_pci_remove(): fix use-after-free can: c_can: move runtime PM enable/disable to c_can_platform can: m_can: m_can_do_rx_poll(): fix extraneous msg loss warning can: m_can: m_can_rx_peripheral(): fix RX being blocked by errors mac80211: fix rate mask reset mac80211: Allow HE operation to be longer than expected. selftests/net: fix warnings on reuseaddr_ports_exhausted nfp: flower: fix unsupported pre_tunnel flows nfp: flower: add ipv6 bit to pre_tunnel control message nfp: flower: fix pre_tun mask id allocation ftrace: Fix modify_ftrace_direct. drm/msm/dsi: fix check-before-set in the 7nm dsi_pll code ionic: linearize tso skb with too many frags net/sched: cls_flower: fix only mask bit check in the validate_ct_state netfilter: nftables: report EOPNOTSUPP on unsupported flowtable flags netfilter: nftables: allow to update flowtable flags netfilter: flowtable: Make sure GC works periodically in idle system libbpf: Fix error path in bpf_object__elf_init() libbpf: Use SOCK_CLOEXEC when opening the netlink socket ARM: dts: imx6ull: fix ubi filesystem mount failed ipv6: weaken the v4mapped source check octeontx2-af: Formatting debugfs entry rsrc_alloc. octeontx2-af: Modify default KEX profile to extract TX packet fields octeontx2-af: Remove TOS field from MKEX TX octeontx2-af: Fix irq free in rvu teardown octeontx2-pf: Clear RSS enable flag on interace down octeontx2-af: fix infinite loop in unmapping NPC counter net: check all name nodes in __dev_alloc_name net: cdc-phonet: fix data-interface release on probe failure igb: check timestamp validity r8152: limit the RX buffer size of RTL8153A for USB 2.0 net: stmmac: dwmac-sun8i: Provide TX and RX fifo sizes selinux: vsock: Set SID for socket returned by accept() selftests: forwarding: vxlan_bridge_1d: Fix vxlan ecn decapsulate value libbpf: Fix BTF dump of pointer-to-array-of-struct bpf: Fix umd memory leak in copy_process() can: isotp: tx-path: zero initialize outgoing CAN frames drm/msm: fix shutdown hook in case GPU components failed to bind drm/msm: Fix suspend/resume on i.MX5 arm64: kdump: update ppos when reading elfcorehdr PM: runtime: Defer suspending suppliers net/mlx5: Add back multicast stats for uplink representor net/mlx5e: Allow to match on MPLS parameters only for MPLS over UDP net/mlx5e: Offload tuple rewrite for non-CT flows net/mlx5e: Fix error path for ethtool set-priv-flag PM: EM: postpone creating the debugfs dir till fs_initcall net: bridge: don't notify switchdev for local FDB addresses octeontx2-af: Fix memory leak of object buf xen/x86: make XEN_BALLOON_MEMORY_HOTPLUG_LIMIT depend on MEMORY_HOTPLUG RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server bpf: Don't do bpf_cgroup_storage_set() for kuprobe/tp programs net: Consolidate common blackhole dst ops net, bpf: Fix ip6ip6 crash with collect_md populated skbs igb: avoid premature Rx buffer reuse net: axienet: Properly handle PCS/PMA PHY for 1000BaseX mode net: axienet: Fix probe error cleanup net: phy: introduce phydev->port net: phy: broadcom: Avoid forward for bcm54xx_config_clock_delay() net: phy: broadcom: Set proper 1000BaseX/SGMII interface mode for BCM54616S net: phy: broadcom: Fix RGMII delays for BCM50160 and BCM50610M Revert "netfilter: x_tables: Switch synchronization to RCU" netfilter: x_tables: Use correct memory barriers. dm table: Fix zoned model check and zone sectors check mm/mmu_notifiers: ensure range_end() is paired with range_start() Revert "netfilter: x_tables: Update remaining dereference to RCU" ACPI: scan: Rearrange memory allocation in acpi_device_add() ACPI: scan: Use unique number for instance_no perf auxtrace: Fix auxtrace queue conflict perf synthetic events: Avoid write of uninitialized memory when generating PERF_RECORD_MMAP* records io_uring: fix provide_buffers sign extension block: recalculate segment count for multi-segment discards correctly scsi: Revert "qla2xxx: Make sure that aborted commands are freed" scsi: qedi: Fix error return code of qedi_alloc_global_queues() scsi: mpt3sas: Fix error return code of mpt3sas_base_attach() smb3: fix cached file size problems in duplicate extents (reflink) cifs: Adjust key sizes and key generation routines for AES256 encryption locking/mutex: Fix non debug version of mutex_lock_io_nested() x86/mem_encrypt: Correct physical address calculation in __set_clr_pte_enc() mm/memcg: fix 5.10 backport of splitting page memcg fs/cachefiles: Remove wait_bit_key layout dependency ch_ktls: fix enum-conversion warning can: dev: Move device back to init netns on owning netns delete r8169: fix DMA being used after buffer free if WoL is enabled net: dsa: b53: VLAN filtering is global to all users mac80211: fix double free in ibss_leave ext4: add reclaim checks to xattr code fs/ext4: fix integer overflow in s_log_groups_per_flex Revert "xen: fix p2m size in dom0 for disabled memory hotplug case" Revert "net: bonding: fix error return code of bond_neigh_init()" nvme: fix the nsid value to print in nvme_validate_or_alloc_ns can: peak_usb: Revert "can: peak_usb: add forgotten supported devices" xen-blkback: don't leak persistent grants from xen_blkbk_map() Linux 5.10.27 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I7eafe976fd6bf33db6db4adb8ebf2ff087294a23	2021-04-02 15:25:50 +02:00
Mimi Zohar	546f7fcc45	integrity: double check iint_cache was initialized ... commit 92063f3ca7 upstream. The kernel may be built with multiple LSMs, but only a subset may be enabled on the boot command line by specifying "lsm=". Not including "integrity" on the ordered LSM list may result in a NULL deref. As reported by Dmitry Vyukov: in qemu: qemu-system-x86_64 -enable-kvm -machine q35,nvdimm -cpu max,migratable=off -smp 4 -m 4G,slots=4,maxmem=16G -hda wheezy.img -kernel arch/x86/boot/bzImage -nographic -vga std -soundhw all -usb -usbdevice tablet -bt hci -bt device:keyboard -net user,host=10.0.2.10,hostfwd=tcp::10022-:22 -net nic,model=virtio-net-pci -object memory-backend-file,id=pmem1,share=off,mem-path=/dev/zero,size=64M -device nvdimm,id=nvdimm1,memdev=pmem1 -append "console=ttyS0 root=/dev/sda earlyprintk=serial rodata=n oops=panic panic_on_warn=1 panic=86400 lsm=smack numa=fake=2 nopcid dummy_hcd.num=8" -pidfile vm_pid -m 2G -cpu host But it crashes on NULL deref in integrity_inode_get during boot: Run /sbin/init as init process BUG: kernel NULL pointer dereference, address: 000000000000001c PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP KASAN CPU: 3 PID: 1 Comm: swapper/0 Not tainted 5.12.0-rc2+ #97 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-44-g88ab0c15525c-prebuilt.qemu.org 04/01/2014 RIP: 0010:kmem_cache_alloc+0x2b/0x370 mm/slub.c:2920 Code: 57 41 56 41 55 41 54 41 89 f4 55 48 89 fd 53 48 83 ec 10 44 8b 3d d9 1f 90 0b 65 48 8b 04 25 28 00 00 00 48 89 44 24 08 31 c0 <8b> 5f 1c 4cf RSP: 0000:ffffc9000032f9d8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff888017fc4f00 RCX: 0000000000000000 RDX: ffff888040220000 RSI: 0000000000000c40 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: ffff888019263627 R10: ffffffff83937cd1 R11: 0000000000000000 R12: 0000000000000c40 R13: ffff888019263538 R14: 0000000000000000 R15: 0000000000ffffff FS: 0000000000000000(0000) GS:ffff88802d180000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000001c CR3: 000000000b48e000 CR4: 0000000000750ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: integrity_inode_get+0x47/0x260 security/integrity/iint.c:105 process_measurement+0x33d/0x17e0 security/integrity/ima/ima_main.c:237 ima_bprm_check+0xde/0x210 security/integrity/ima/ima_main.c:474 security_bprm_check+0x7d/0xa0 security/security.c:845 search_binary_handler fs/exec.c:1708 [inline] exec_binprm fs/exec.c:1761 [inline] bprm_execve fs/exec.c:1830 [inline] bprm_execve+0x764/0x19a0 fs/exec.c:1792 kernel_execve+0x370/0x460 fs/exec.c:1973 try_to_run_init_process+0x14/0x4e init/main.c:1366 kernel_init+0x11d/0x1b8 init/main.c:1477 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294 Modules linked in: CR2: 000000000000001c ---[ end trace 22d601a500de7d79 ]--- Since LSMs and IMA may be configured at build time, but not enabled at run time, panic the system if "integrity" was not initialized before use. Reported-by: Dmitry Vyukov <dvyukov@google.com> Fixes: 79f7865d84 ("LSM: Introduce "lsm=" for boottime LSM selection") Cc: stable@vger.kernel.org Signed-off-by: Mimi Zohar <zohar@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-03-30 14:31:55 +02:00
Ondrej Mosnacek	19c9967e49	selinux: fix variable scope issue in live sidtab conversion ... commit 6406887a12 upstream. Commit 02a52c5c8c ("selinux: move policy commit after updating selinuxfs") moved the selinux_policy_commit() call out of security_load_policy() into sel_write_load(), which caused a subtle yet rather serious bug. The problem is that security_load_policy() passes a reference to the convert_params local variable to sidtab_convert(), which stores it in the sidtab, where it may be accessed until the policy is swapped over and RCU synchronized. Before 02a52c5c8c, selinux_policy_commit() was called directly from security_load_policy(), so the convert_params pointer remained valid all the way until the old sidtab was destroyed, but now that's no longer the case and calls to sidtab_context_to_sid() on the old sidtab after security_load_policy() returns may cause invalid memory accesses. This can be easily triggered using the stress test from commit ee1a84fdfe ("selinux: overhaul sidtab to fix bug and improve performance"): ``` function rand_cat() { echo $(( $RANDOM % 1024 )) } function do_work() { while true; do echo -n "system_u:system_r:kernel_t:s0:c$(rand_cat),c$(rand_cat)" \ >/sys/fs/selinux/context 2>/dev/null || true done } do_work >/dev/null & do_work >/dev/null & do_work >/dev/null & while load_policy; do echo -n .; sleep 0.1; done kill %1 kill %2 kill %3 ``` Fix this by allocating the temporary sidtab convert structures dynamically and passing them among the selinux_policy_{load,cancel,commit} functions. Fixes: 02a52c5c8c ("selinux: move policy commit after updating selinuxfs") Cc: stable@vger.kernel.org Tested-by: Tyler Hicks <tyhicks@linux.microsoft.com> Reviewed-by: Tyler Hicks <tyhicks@linux.microsoft.com> Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> [PM: merge fuzz in security.h and services.c] Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-03-30 14:31:53 +02:00
Ondrej Mosnacek	9731e08a33	selinux: don't log MAC_POLICY_LOAD record on failed policy load ... commit 519dad3bcd upstream. If sel_make_policy_nodes() fails, we should jump to 'out', not 'out1', as the latter would incorrectly log an MAC_POLICY_LOAD audit record, even though the policy hasn't actually been reloaded. The 'out1' jump label now becomes unused and can be removed. Fixes: 02a52c5c8c ("selinux: move policy commit after updating selinuxfs") Cc: stable@vger.kernel.org Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-03-30 14:31:53 +02:00
Greg Kroah-Hartman	99941e23f7	Merge branch 'android12-5.10-lts' into 'android12-5.10' ... Updates the branch to the 5.10.26 upstream kernel version. Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I84aa29bf4e4e809051eb346830c4c4b5acb78c8c	2021-03-26 08:25:46 +01:00
Walter Wu	86a1ff2750	BACKPORT: kasan: remove redundant config option ... CONFIG_KASAN_STACK and CONFIG_KASAN_STACK_ENABLE both enable KASAN stack instrumentation, but we should only need one config, so that we remove CONFIG_KASAN_STACK_ENABLE and make CONFIG_KASAN_STACK workable. see [1]. When enable KASAN stack instrumentation, then for gcc we could do no prompt and default value y, and for clang prompt and default value n. [1]: https://bugzilla.kernel.org/show_bug.cgi?id=210221 Link: https://lkml.kernel.org/r/20210226012531.29231-1-walter-zh.wu@mediatek.com Signed-off-by: Walter Wu <walter-zh.wu@mediatek.com> Suggested-by: Dmitry Vyukov <dvyukov@google.com> Reviewed-by: Nathan Chancellor <natechancellor@gmail.com> Acked-by: Arnd Bergmann <arnd@arndb.de> Reviewed-by: Andrey Konovalov <andreyknvl@google.com> Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com> Cc: Dmitry Vyukov <dvyukov@google.com> Cc: Alexander Potapenko <glider@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au> (cherry picked from commit 3bc29a8e251a9469ce69e62118d70eaf0caa5acb https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git akpm) (cherry picked from commit 0d9e60b66271414a18a1d4f1fe2c923245f1e3a8 https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git akpm) [glider: resolved a minor merge conflict, squashed two patches together] Bug: 182930667 Signed-off-by: Alexander Potapenko <glider@google.com> Change-Id: I1b3d2cdcf45727a25d36ac7f417a4f026152d6a8	2021-03-24 15:09:15 -07:00
Greg Kroah-Hartman	e8f79d9cbb	Merge branch 'android12-5.10' into branch 'android12-5.10-lts' ... Sync up with the android12-5.10 branch for the following commit: c4bd1c03ba ANDROID: qcom: Add is_dma_buf_file to ABI 268088c42e ANDROID: GKI: update .xml file a7f3a36529 ANDROID: GKI: enable KFENCE by setting the sample interval to 500ms 9d1c78d623 ANDROID: abi_gki_aarch64_qcom: Add xhci symbols to list 5896d00f9c ANDROID: vmlinux.lds.h: Define SANITIZER_DISCARDS with CONFIG_CFI_CLANG ffacd097fc ANDROID: usb: typec: tcpci: Add vendor hook to mask vbus present 1a93d556d7 ANDROID: usb: typce: tcpci: Add vendor hook for chip specific features 08879ea0d6 ANDROID: usb: typec: tcpci: Add vendor hooks for tcpci interface 892e618852 FROMGIT: f2fs: add sysfs nodes to get runtime compression stat 58f0e25d0d ANDROID: dma-buf: Fix error path on system heaps use of the page pool 958c19b19b ANDROID: usb: typec: tcpm: Fix event storm caused by error in backport 0b6fadd02e ANDROID: GKI: USB: XHCI: add Android ABI padding to lots of xhci structures 6f00446c76 FROMGIT: KVM: arm64: Fix host's ZCR_EL2 restore on nVHE b0671cd753 FROMGIT: KVM: arm64: Force SCTLR_EL2.WXN when running nVHE 8f25c7432f FROMGIT: KVM: arm64: Turn SCTLR_ELx_FLAGS into INIT_SCTLR_EL2_MMU_ON f47a4d91e5 FROMGIT: KVM: arm64: Use INIT_SCTLR_EL2_MMU_OFF to disable the MMU on KVM teardown 3ff7250562 FROMGIT: arm64: Use INIT_SCTLR_EL1_MMU_OFF to disable the MMU on CPU restart a8a9fadaf8 FROMGIT: KVM: arm64: Enable SVE support for nVHE b0e15c8c44 FROMGIT: KVM: arm64: Save/restore SVE state for nVHE 194fd166b5 BACKPORT: FROMGIT: KVM: arm64: Trap host SVE accesses when the FPSIMD state is dirty 507e10616c FROMGIT: KVM: arm64: Save guest's ZCR_EL1 before saving the FPSIMD state 4cb78b26ea FROMGIT: KVM: arm64: Map SVE context at EL2 when available 1105b4d1ce BACKPORT: FROMGIT: KVM: arm64: Rework SVE host-save/guest-restore 57171b3636 FROMGIT: arm64: sve: Provide a conditional update accessor for ZCR_ELx ac5f5708bb FROMGIT: KVM: arm64: Introduce vcpu_sve_vq() helper f9bab75599 FROMGIT: KVM: arm64: Let vcpu_sve_pffr() handle HYP VAs c2469fa4b4 FROMGIT: KVM: arm64: Use {read,write}_sysreg_el1 to access ZCR_EL1 f5e060d65e FROMGIT: KVM: arm64: Provide KVM's own save/restore SVE primitives af855ca1c9 ANDROID: GKI: USB: Gadget: add Android ABI padding to struct usb_gadget 24149445ad ANDROID: vendor_hooks: Add hooks for memory when debug 00185a421a ANDROID: vendor_hooks: Add hooks for ufs scheduler b8981993c2 ANDROID: GKI: sound/usb/card.h: add Android ABI padding to struct snd_usb_endpoint 5a56f5119e ANDROID: GKI: user_namespace.h: add Android ABI padding to a structure 599e75fcfd ANDROID: GKI: timer.h: add Android ABI padding to a structure 303a28f485 ANDROID: GKI: quota.h: add Android ABI padding to some structures a06d91262a ANDROID: GKI: mmu_notifier.h: add Android ABI padding to some structures 8faaa07702 ANDROID: GKI: mm.h: add Android ABI padding to a structure f21777c57f ANDROID: GKI: kobject.h: add Android ABI padding to some structures 31f6b7a1ae ANDROID: GKI: kernfs.h: add Android ABI padding to some structures 1a517d8668 ANDROID: GKI: irqdomain.h: add Android ABI padding to a structure c6adf0c7b9 ANDROID: GKI: ioport.h: add Android ABI padding to a structure c469de24a1 ANDROID: GKI: iomap.h: add Android ABI padding to a structure 3cb5c28964 ANDROID: GKI: hrtimer.h: add Android ABI padding to a structure eff6517b1e ANDROID: GKI: genhd.h: add Android ABI padding to some structures 9a92773dc8 ANDROID: GKI: ethtool.h: add Android ABI padding to a structure 774168de67 ANDROID: GKI: dma-mapping.h: add Android ABI padding to a structure 73ff58b01f ANDROID: GKI: networking: add Android ABI padding to a lot of networking structures f0688df6b5 ANDROID: GKI: blk_types.h: add Android ABI padding to a structure 4a895f1f2b ANDROID: GKI: scsi.h: add Android ABI padding to a structure 48691266ca ANDROID: GKI: pci: add Android ABI padding to some structures 4c95a92b84 ANDROID: GKI: add Android ABI padding to struct nf_conn e6f5502bc3 UPSTREAM: usb: typec: tcpm: Skip sink_cap query only when VDM sm is busy 36547f2f6d FROMGIT: usb: typec: tcpm: PD3.0 sinks can send Discover Identity even in device mode 3f7ada406d UPSTREAM: usb: gadget: configfs: Fix KASAN use-after-free 9bd96584f4 UPSTREAM: usb: typec: Remove vdo[3] part of tps6598x_rx_identity_reg struct f2e7bdcdfa UPSTREAM: usb: dwc3: gadget: Prevent EP queuing while stopping transfers 462c92e8f2 FROMGIT: usb: typec: tcpci: Added few missing TCPCI register definitions 6f85b7e0f8 UPSTREAM: usb: typec: tcpm: Invoke power_supply_changed for tcpm-source-psy- 8cf94785bb Revert "ANDROID: GKI: Enable bounds sanitizer" 0eecc2aa30 ANDROID: GKI: temporarily disable LTO/CFI 3520187422 ANDROID: Revert "f2fs: fix to tag FIEMAP_EXTENT_MERGED in f2fs_fiemap()" 16982b6a18 FROMLIST: KVM: arm64: Disable FWB in host stage-2 3a16a9e7be FROMLIST: KVM: arm64: Introduce KVM_PGTABLE_S2_NOFWB Stage-2 flag bcdcab0253 FROMLIST: KVM: arm64: Protect the .hyp sections from the host 317d5a5030 FROMLIST: KVM: arm64: Disable PMU support in protected mode 6697310c08 FROMLIST: KVM: arm64: Page-align the .hyp sections 68bd98a28a FROMLIST: KVM: arm64: Wrap the host with a stage 2 5a128f0626 FROMLIST: KVM: arm64: Provide sanitized mmfr* registers at EL2 0af83133e3 FROMLIST: KVM: arm64: Add kvm_pgtable_stage2_find_range() c3f49047ca FROMLIST: KVM: arm64: Refactor the *_map_set_prot_attr() helpers 9349978462 FROMLIST: KVM: arm64: Use page-table to track page ownership 845457f549 FROMLIST: KVM: arm64: Always zero invalid PTEs 1d349d64ba FROMLIST: KVM: arm64: Sort the hypervisor memblocks 1e798d4121 FROMLIST: KVM: arm64: Reserve memory for host stage 2 6fddc52e50 FROMLIST: KVM: arm64: Make memcache anonymous in pgtable allocator a20c8e1c48 FROMLIST: KVM: arm64: Refactor __populate_fault_info() 21a1f89953 FROMLIST: KVM: arm64: Refactor __load_guest_stage2() 1a9bba9121 FROMLIST: KVM: arm64: Refactor kvm_arm_setup_stage2() 6d3f5c07aa FROMLIST: KVM: arm64: Set host stage 2 using kvm_nvhe_init_params eef107d42a FROMLIST: KVM: arm64: Use kvm_arch in kvm_s2_mmu 1a76f891e1 FROMLIST: KVM: arm64: Use kvm_arch for stage 2 pgtable d8eb170aa9 FROMLIST: KVM: arm64: Elevate hypervisor mappings creation at EL2 ae1ed8a984 FROMLIST: KVM: arm64: Prepare the creation of s1 mappings at EL2 364f0639db FROMLIST: arm64: asm: Provide set_sctlr_el2 macro ca52b29511 FROMLIST: KVM: arm64: Factor out vector address calculation a1180dd384 FROMLIST: KVM: arm64: Provide __flush_dcache_area at EL2 37b5552dfb FROMLIST: KVM: arm64: Enable access to sanitized CPU features at EL2 75fba96057 FROMLIST: KVM: arm64: Introduce a Hyp buddy page allocator f6e834486a FROMLIST: KVM: arm64: Stub CONFIG_DEBUG_LIST at Hyp 01253f8e2c FROMLIST: KVM: arm64: Introduce an early Hyp page allocator a3aad4cf4a FROMLIST: KVM: arm64: Allow using kvm_nvhe_sym() in hyp code 81181250ba FROMLIST: KVM: arm64: Make kvm_call_hyp() a function call at Hyp 542dace0bc FROMLIST: KVM: arm64: Introduce a BSS section for use at Hyp 4a4beb1005 FROMLIST: KVM: arm64: Factor memory allocation out of pgtable.c 620bb5f9c9 FROMLIST: KVM: arm64: Avoid free_page() in page-table allocator c758e8e4b1 FROMLIST: KVM: arm64: Initialize kvm_nvhe_init_params early ce5e848201 FROMLIST: arm64: kvm: Add standalone ticket spinlock implementation for use at hyp 9833905e2d FROMLIST: KVM: arm64: Link position-independent string routines into .hyp.text 0f63237470 FROMLIST: arm64: lib: Annotate {clear, copy}_page() as position-independent edab6a7245 Revert "ANDROID: sched: cpufreq_schedutil: add sugov tracepoints" 187306ab1a ANDROID: Partial revert of 06881e01b5 ("ANDROID: sched: Add vendor hooks for override sugov behavior") b542f4c389 Revert "ANDROID: sched: Add vendor hooks for skipping sugov update" 27d6dac0df Revert "ANDROID: sched: cpufreq_schedutil: move sugov traces to sched" cc574f0d36 ANDROID: thermal: Add logic for filter on-die tz genl event. 6c6fac8f39 ANDROID: mmc: support hardware that takes key directly e4636b47ef UPSTREAM: zram: fix broken page writeback 542d1937ba UPSTREAM: zram: fix return value on writeback_store 475aea007d ANDROID: sched: Add vendor hook for util_est_update 89ea2f1eca ANDROID: GKI: Enable DTPM framework a3a580961b ANDROID: GKI: Add remoteproc framework symbols to symbol list 53e8099784 ANDROID: vendor_hooks: Add hooks for scheduler 7e2c33ac0e FROMGIT: configfs: fix a use-after-free in __configfs_open_file 7656aa0f48 ANDROID: lib/plist.c: Export plist-related APIs 4d63efb9ae ANDROID: module: Add vendor hook 2ff446fc4d ANDROID: bpf: Add vendor hook dccee128b7 ANDROID: kernel: Add vendor hook in creds 0a3b407463 ANDROID: security: selinux: Add vendor hook in avc a128ec2b2e UPSTREAM: KVM: arm64: Fix exclusive limit for IPA size ac821b6257 UPSTREAM: KVM: arm64: Reject VM creation when the default IPA size is unsupported d2eb8b0028 ANDROID: GKI: add android_kabi.h 45021f7679 UPSTREAM: MAINTAINERS: add entry for KFENCE 90d03f6fcf ANDROID: Clang LTO: Comment on symbol visibility workaround 169ddec367 FROMLIST: mm: fs: Invalidate BH LRU during page migration 3039d8580c BACKPORT: FROMLIST: mm: disable LRU pagevec during the migration temporarily 134ac2d4dc FROMLIST: mm: replace migrate_prep with lru_add_drain_all a71a3e1ce6 UPSTREAM: mm: migrate: initialize err in do_migrate_pages 059eaf82c0 UPSTREAM: mm: migrate: clean up migrate_prep{_local} be409db652 ANDROID: Clang LTO: Only set -fvisibility=hidden for x86 02efd18b77 UPSTREAM: usb: typec: tcpci: Refactor tcpc_presenting_cc1_rd macro 8d03e49505 ANDROID: mm: build alloc_contig_dump_pages in page_alloc.o 28f6641041 FROMLIST: mm: page_alloc: dump migrate-failed pages cc1f93cb20 ANDROID: sched: Add vendor hook for uclamp_eff_get 5e1e3e9387 ANDROID: cpu/hotplug: failure to offline 2nd to last cpu 2c728929c1 ANDROID: qcom: Add devm_blk_ksm_init to ABI 9108e9ba66 ANDROID: arm64: add vendor hooks for unusal abort cases 5f1e1f42a5 UPSTREAM: powercap/drivers/dtpm: Fix size of object being allocated fd2c659694 UPSTREAM: powercap/drivers/dtpm: Fix an IS_ERR() vs NULL check 2a1cd71862 UPSTREAM: powercap/drivers/dtpm: Fix some missing unlock bugs 7112d4320f UPSTREAM: powercap/drivers/dtpm: Fix a double shift bug 578572c48c UPSTREAM: powercap/drivers/dtpm: Fix __udivdi3 and __aeabi_uldivmod unresolved symbols 7f17016dc8 UPSTREAM: powercap/drivers/dtpm: Add CPU energy model based support 082e8dcea9 UPSTREAM: powercap/drivers/dtpm: Add API for dynamic thermal power management Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: If05a0d9902893cd29e8bb5eb175bd4ce30250697	2021-03-21 15:02:08 +01:00
Greg Kroah-Hartman	3ccfc59f82	This is the 5.10.24 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmBSKS0ACgkQONu9yGCS aT7Ngg//c4C1WnWC0sNWzP3xT2paCkLnUUyjQTmrkbPvLtr2DvehW5Bvp/32pGiS 8mDMoTLq3QxNrfrU6SY3KavZRC9Pa+migAsVmuujygQwNphqv95/XxnFemFEAYTl b8b5OJPyomzMMEwHzx1Tr+7/d58czrqXo97QI0lmaDlHl+9JKTg2SMX9AkHkU8pK zYjbtzdhd9UZCTdVYY1ZFkQ1ik1iAWo3Xv0G2aMeQQpuGcZIh/Y66xBuyH+8g+Yz 3mInhPQvhkb+c+m4ZJ9NhOUVEW4Fl0fq0mVrrYkfHqXe0D36Vj/yYvO/yTSBqb4+ XQ5PLXX3KFVDFl1id94unXGgP3c0zBe30JZPqKdpSET+PzOlGiZTxMCfjPeTgu/Z 7xc2qSX1zn273HMTRrT1daO4/NXQ85kE04mZMzq7cqDpum7ltfKrEMum/Gma+dJz Knn47oZHbSW4Er/WcAwHSeZpxvD7AahG/GlsQRy+IVPu/jMXJHmo2/Nv1fLJWp+G 7VVWRXug69hywGr7hFiT3USG2C5g5cV3/dEO8NFFjGKRa5CbLbQD6B3+Dz3dXyBH jE3MGIoqoNk+SvJOAf2ogu7SS6wLynZWOchmAVvIQ4QEzcP2jroeFHKD49MYxDUE dKcq0dtfMc4nUaUZ/XRfWtS9fSm+T4XonmvEY4yXnAyfZ0aeEM8= =FdFm -----END PGP SIGNATURE----- Merge 5.10.24 into android12-5.10-lts Changes in 5.10.24 uapi: nfnetlink_cthelper.h: fix userspace compilation error powerpc/perf: Fix handling of privilege level checks in perf interrupt context powerpc/pseries: Don't enforce MSI affinity with kdump ethernet: alx: fix order of calls on resume crypto: mips/poly1305 - enable for all MIPS processors ath9k: fix transmitting to stations in dynamic SMPS mode net: Fix gro aggregation for udp encaps with zero csum net: check if protocol extracted by virtio_net_hdr_set_proto is correct net: avoid infinite loop in mpls_gso_segment when mpls_hlen == 0 net: l2tp: reduce log level of messages in receive path, add counter instead can: skb: can_skb_set_owner(): fix ref counting if socket was closed before setting skb ownership can: flexcan: assert FRZ bit in flexcan_chip_freeze() can: flexcan: enable RX FIFO after FRZ/HALT valid can: flexcan: invoke flexcan_chip_freeze() to enter freeze mode can: tcan4x5x: tcan4x5x_init(): fix initialization - clear MRAM before entering Normal Mode tcp: Fix sign comparison bug in getsockopt(TCP_ZEROCOPY_RECEIVE) tcp: add sanity tests to TCP_QUEUE_SEQ netfilter: nf_nat: undo erroneous tcp edemux lookup netfilter: x_tables: gpf inside xt_find_revision() net: always use icmp{,v6}_ndo_send from ndo_start_xmit net: phy: fix save wrong speed and duplex problem if autoneg is on selftests/bpf: Use the last page in test_snprintf_btf on s390 selftests/bpf: No need to drop the packet when there is no geneve opt selftests/bpf: Mask bpf_csum_diff() return value to 16 bits in test_verifier samples, bpf: Add missing munmap in xdpsock libbpf: Clear map_info before each bpf_obj_get_info_by_fd ibmvnic: Fix possibly uninitialized old_num_tx_queues variable warning. ibmvnic: always store valid MAC address mt76: dma: do not report truncated frames to mac80211 powerpc/603: Fix protection of user pages mapped with PROT_NONE mount: fix mounting of detached mounts onto targets that reside on shared mounts cifs: return proper error code in statfs(2) Revert "mm, slub: consider rest of partial list if acquire_slab() fails" docs: networking: drop special stable handling net: dsa: tag_rtl4_a: fix egress tags sh_eth: fix TRSCER mask for SH771x net: enetc: don't overwrite the RSS indirection table when initializing net: enetc: take the MDIO lock only once per NAPI poll cycle net: enetc: fix incorrect TPID when receiving 802.1ad tagged packets net: enetc: don't disable VLAN filtering in IFF_PROMISC mode net: enetc: force the RGMII speed and duplex instead of operating in inband mode net: enetc: remove bogus write to SIRXIDR from enetc_setup_rxbdr net: enetc: keep RX ring consumer index in sync with hardware net: ethernet: mtk-star-emac: fix wrong unmap in RX handling net/mlx4_en: update moderation when config reset net: stmmac: fix incorrect DMA channel intr enable setting of EQoS v4.10 nexthop: Do not flush blackhole nexthops when loopback goes down net: sched: avoid duplicates in classes dump net: mscc: ocelot: properly reject destination IP keys in VCAP IS1 net: dsa: sja1105: fix SGMII PCS being forced to SPEED_UNKNOWN instead of SPEED_10 net: usb: qmi_wwan: allow qmimux add/del with master up netdevsim: init u64 stats for 32bit hardware cipso,calipso: resolve a number of problems with the DOI refcounts net: stmmac: Fix VLAN filter delete timeout issue in Intel mGBE SGMII stmmac: intel: Fixes clock registration error seen for multiple interfaces net: lapbether: Remove netif_start_queue / netif_stop_queue net: davicom: Fix regulator not turned off on failed probe net: davicom: Fix regulator not turned off on driver removal net: enetc: allow hardware timestamping on TX queues with tc-etf enabled net: qrtr: fix error return code of qrtr_sendmsg() s390/qeth: fix memory leak after failed TX Buffer allocation r8169: fix r8168fp_adjust_ocp_cmd function ixgbe: fail to create xfrm offload of IPsec tunnel mode SA tools/resolve_btfids: Fix build error with older host toolchains perf build: Fix ccache usage in $(CC) when generating arch errno table net: stmmac: stop each tx channel independently net: stmmac: fix watchdog timeout during suspend/resume stress test net: stmmac: fix wrongly set buffer2 valid when sph unsupport ethtool: fix the check logic of at least one channel for RX/TX net: phy: make mdio_bus_phy_suspend/resume as __maybe_unused selftests: forwarding: Fix race condition in mirror installation mlxsw: spectrum_ethtool: Add an external speed to PTYS register perf traceevent: Ensure read cmdlines are null terminated. perf report: Fix -F for branch & mem modes net: hns3: fix query vlan mask value error for flow director net: hns3: fix bug when calculating the TCAM table info s390/cio: return -EFAULT if copy_to_user() fails again bnxt_en: reliably allocate IRQ table on reset to avoid crash gpiolib: acpi: Add ACPI_GPIO_QUIRK_ABSOLUTE_NUMBER quirk gpiolib: acpi: Allow to find GpioInt() resource by name and index gpio: pca953x: Set IRQ type when handle Intel Galileo Gen 2 gpio: fix gpio-device list corruption drm/compat: Clear bounce structures drm/amd/display: Add a backlight module option drm/amdgpu/display: use GFP_ATOMIC in dcn21_validate_bandwidth_fp() drm/amd/display: Fix nested FPU context in dcn21_validate_bandwidth() drm/amd/pm: bug fix for pcie dpm drm/amdgpu/display: simplify backlight setting drm/amdgpu/display: don't assert in set backlight function drm/amdgpu/display: handle aux backlight in backlight_get_brightness drm/shmem-helper: Check for purged buffers in fault handler drm/shmem-helper: Don't remove the offset in vm_area_struct pgoff drm: Use USB controller's DMA mask when importing dmabufs drm: meson_drv add shutdown function drm/shmem-helpers: vunmap: Don't put pages for dma-buf drm/i915: Wedge the GPU if command parser setup fails s390/cio: return -EFAULT if copy_to_user() fails s390/crypto: return -EFAULT if copy_to_user() fails qxl: Fix uninitialised struct field head.surface_id sh_eth: fix TRSCER mask for R7S9210 media: usbtv: Fix deadlock on suspend media: rkisp1: params: fix wrong bits settings media: v4l: vsp1: Fix uif null pointer access media: v4l: vsp1: Fix bru null pointer access media: rc: compile rc-cec.c into rc-core cifs: fix credit accounting for extra channel net: hns3: fix error mask definition of flow director s390/qeth: don't replace a fully completed async TX buffer s390/qeth: remove QETH_QDIO_BUF_HANDLED_DELAYED state s390/qeth: improve completion of pending TX buffers s390/qeth: fix notification for pending buffers during teardown net: dsa: implement a central TX reallocation procedure net: dsa: tag_ksz: don't allocate additional memory for padding/tagging net: dsa: trailer: don't allocate additional memory for padding/tagging net: dsa: tag_qca: let DSA core deal with TX reallocation net: dsa: tag_ocelot: let DSA core deal with TX reallocation net: dsa: tag_mtk: let DSA core deal with TX reallocation net: dsa: tag_lan9303: let DSA core deal with TX reallocation net: dsa: tag_edsa: let DSA core deal with TX reallocation net: dsa: tag_brcm: let DSA core deal with TX reallocation net: dsa: tag_dsa: let DSA core deal with TX reallocation net: dsa: tag_gswip: let DSA core deal with TX reallocation net: dsa: tag_ar9331: let DSA core deal with TX reallocation net: dsa: tag_mtk: fix 802.1ad VLAN egress enetc: Fix unused var build warning for CONFIG_OF net: enetc: initialize RFS/RSS memories for unused ports too ath11k: peer delete synchronization with firmware ath11k: start vdev if a bss peer is already created ath11k: fix AP mode for QCA6390 i2c: rcar: faster irq code to minimize HW race condition i2c: rcar: optimize cacheline to minimize HW race condition scsi: ufs: WB is only available on LUN #0 to #7 udf: fix silent AED tagLocation corruption iommu/vt-d: Clear PRQ overflow only when PRQ is empty mmc: mxs-mmc: Fix a resource leak in an error handling path in 'mxs_mmc_probe()' mmc: mediatek: fix race condition between msdc_request_timeout and irq mmc: sdhci-iproc: Add ACPI bindings for the RPi Platform: OLPC: Fix probe error handling powerpc/pci: Add ppc_md.discover_phbs() spi: stm32: make spurious and overrun interrupts visible powerpc: improve handling of unrecoverable system reset powerpc/perf: Record counter overflow always if SAMPLE_IP is unset HID: logitech-dj: add support for the new lightspeed connection iteration powerpc/64: Fix stack trace not displaying final frame iommu/amd: Fix performance counter initialization clk: qcom: gdsc: Implement NO_RET_PERIPH flag sparc32: Limit memblock allocation to low memory sparc64: Use arch_validate_flags() to validate ADI flag Input: applespi - don't wait for responses to commands indefinitely. PCI: xgene-msi: Fix race in installing chained irq handler PCI: mediatek: Add missing of_node_put() to fix reference leak drivers/base: build kunit tests without structleak plugin PCI/LINK: Remove bandwidth notification ext4: don't try to processed freed blocks until mballoc is initialized kbuild: clamp SUBLEVEL to 255 PCI: Fix pci_register_io_range() memory leak i40e: Fix memory leak in i40e_probe kasan: fix memory corruption in kasan_bitops_tags test s390/smp: __smp_rescan_cpus() - move cpumask away from stack drivers/base/memory: don't store phys_device in memory blocks sysctl.c: fix underflow value setting risk in vm_table scsi: libiscsi: Fix iscsi_prep_scsi_cmd_pdu() error handling scsi: target: core: Add cmd length set before cmd complete scsi: target: core: Prevent underflow for service actions clk: qcom: gpucc-msm8998: Add resets, cxc, fix flags on gpu_gx_gdsc mmc: sdhci: Update firmware interface API ARM: 9029/1: Make iwmmxt.S support Clang's integrated assembler ARM: assembler: introduce adr_l, ldr_l and str_l macros ARM: efistub: replace adrl pseudo-op with adr_l macro invocation ALSA: usb: Add Plantronics C320-M USB ctrl msg delay quirk ALSA: hda/hdmi: Cancel pending works before suspend ALSA: hda/conexant: Add quirk for mute LED control on HP ZBook G5 ALSA: hda/ca0132: Add Sound BlasterX AE-5 Plus support ALSA: hda: Drop the BATCH workaround for AMD controllers ALSA: hda: Flush pending unsolicited events before suspend ALSA: hda: Avoid spurious unsol event handling during S3/S4 ALSA: usb-audio: Fix "cannot get freq eq" errors on Dell AE515 sound bar ALSA: usb-audio: Apply the control quirk to Plantronics headsets ALSA: usb-audio: Disable USB autosuspend properly in setup_disable_autosuspend() ALSA: usb-audio: fix NULL ptr dereference in usb_audio_probe ALSA: usb-audio: fix use after free in usb_audio_disconnect Revert 95ebabde38 ("capabilities: Don't allow writing ambiguous v3 file capabilities") block: Discard page cache of zone reset target range block: Try to handle busy underlying device on discard arm64: kasan: fix page_alloc tagging with DEBUG_VIRTUAL arm64: mte: Map hotplugged memory as Normal Tagged arm64: perf: Fix 64-bit event counter read truncation s390/dasd: fix hanging DASD driver unbind s390/dasd: fix hanging IO request during DASD driver unbind software node: Fix node registration xen/events: reset affinity of 2-level event when tearing it down mmc: mmci: Add MMC_CAP_NEED_RSP_BUSY for the stm32 variants mmc: core: Fix partition switch time for eMMC mmc: cqhci: Fix random crash when remove mmc module/card cifs: do not send close in compound create+close requests Goodix Fingerprint device is not a modem USB: gadget: udc: s3c2410_udc: fix return value check in s3c2410_udc_probe() USB: gadget: u_ether: Fix a configfs return code usb: gadget: f_uac2: always increase endpoint max_packet_size by one audio slot usb: gadget: f_uac1: stop playback on function disable usb: dwc3: qcom: Add missing DWC3 OF node refcount decrement usb: dwc3: qcom: add URS Host support for sdm845 ACPI boot usb: dwc3: qcom: add ACPI device id for sc8180x usb: dwc3: qcom: Honor wakeup enabled/disabled state USB: usblp: fix a hang in poll() if disconnected usb: renesas_usbhs: Clear PIPECFG for re-enabling pipe with other EPNUM usb: xhci: do not perform Soft Retry for some xHCI hosts xhci: Improve detection of device initiated wake signal. usb: xhci: Fix ASMedia ASM1042A and ASM3242 DMA addressing xhci: Fix repeated xhci wake after suspend due to uncleared internal wake state USB: serial: io_edgeport: fix memory leak in edge_startup USB: serial: ch341: add new Product ID USB: serial: cp210x: add ID for Acuity Brands nLight Air Adapter USB: serial: cp210x: add some more GE USB IDs usbip: fix stub_dev to check for stream socket usbip: fix vhci_hcd to check for stream socket usbip: fix vudc to check for stream socket usbip: fix stub_dev usbip_sockfd_store() races leading to gpf usbip: fix vhci_hcd attach_store() races leading to gpf usbip: fix vudc usbip_sockfd_store races leading to gpf Revert "serial: max310x: rework RX interrupt handling" misc/pvpanic: Export module FDT device table misc: fastrpc: restrict user apps from sending kernel RPC messages staging: rtl8192u: fix ->ssid overflow in r8192_wx_set_scan() staging: rtl8188eu: prevent ->ssid overflow in rtw_wx_set_scan() staging: rtl8712: unterminated string leads to read overflow staging: rtl8188eu: fix potential memory corruption in rtw_check_beacon_data() staging: ks7010: prevent buffer overflow in ks_wlan_set_scan() staging: rtl8712: Fix possible buffer overflow in r8712_sitesurvey_cmd staging: rtl8192e: Fix possible buffer overflow in _rtl92e_wx_set_scan staging: comedi: addi_apci_1032: Fix endian problem for COS sample staging: comedi: addi_apci_1500: Fix endian problem for command sample staging: comedi: adv_pci1710: Fix endian problem for AI command data staging: comedi: das6402: Fix endian problem for AI command data staging: comedi: das800: Fix endian problem for AI command data staging: comedi: dmm32at: Fix endian problem for AI command data staging: comedi: me4000: Fix endian problem for AI command data staging: comedi: pcl711: Fix endian problem for AI command data staging: comedi: pcl818: Fix endian problem for AI command data sh_eth: fix TRSCER mask for R7S72100 cpufreq: qcom-hw: fix dereferencing freed memory 'data' cpufreq: qcom-hw: Fix return value check in qcom_cpufreq_hw_cpu_init() arm64/mm: Fix pfn_valid() for ZONE_DEVICE based memory SUNRPC: Set memalloc_nofs_save() for sync tasks NFS: Don't revalidate the directory permissions on a lookup failure NFS: Don't gratuitously clear the inode cache when lookup failed NFSv4.2: fix return value of _nfs4_get_security_label() block: rsxx: fix error return code of rsxx_pci_probe() nvme-fc: fix racing controller reset and create association configfs: fix a use-after-free in __configfs_open_file arm64: mm: use a 48-bit ID map when possible on 52-bit VA builds perf/core: Flush PMU internal buffers for per-CPU events perf/x86/intel: Set PERF_ATTACH_SCHED_CB for large PEBS and LBR hrtimer: Update softirq_expires_next correctly after __hrtimer_get_next_event() powerpc/64s/exception: Clean up a missed SRR specifier seqlock,lockdep: Fix seqcount_latch_init() stop_machine: mark helpers __always_inline include/linux/sched/mm.h: use rcu_dereference in in_vfork() zram: fix return value on writeback_store linux/compiler-clang.h: define HAVE_BUILTIN_BSWAP* sched/membarrier: fix missing local execution of ipi_sync_rq_state() efi: stub: omit SetVirtualAddressMap() if marked unsupported in RT_PROP table powerpc/64s: Fix instruction encoding for lis in ppc_function_entry() powerpc: Fix inverted SET_FULL_REGS bitop powerpc: Fix missing declaration of [en/dis]able_kernel_vsx() binfmt_misc: fix possible deadlock in bm_register_write x86/unwind/orc: Disable KASAN checking in the ORC unwinder, part 2 x86/sev-es: Introduce ip_within_syscall_gap() helper x86/sev-es: Check regs->sp is trusted before adjusting #VC IST stack x86/entry: Move nmi entry/exit into common code x86/sev-es: Correctly track IRQ states in runtime #VC handler x86/sev-es: Use __copy_from_user_inatomic() x86/entry: Fix entry/exit mismatch on failed fast 32-bit syscalls KVM: x86: Ensure deadline timer has truly expired before posting its IRQ KVM: kvmclock: Fix vCPUs > 64 can't be online/hotpluged KVM: arm64: Fix range alignment when walking page tables KVM: arm64: Avoid corrupting vCPU context register in guest exit KVM: arm64: nvhe: Save the SPE context early KVM: arm64: Reject VM creation when the default IPA size is unsupported KVM: arm64: Fix exclusive limit for IPA size mm/userfaultfd: fix memory corruption due to writeprotect mm/madvise: replace ptrace attach requirement for process_madvise KVM: arm64: Ensure I-cache isolation between vcpus of a same VM mm/page_alloc.c: refactor initialization of struct page for holes in memory layout xen/events: don't unmask an event channel when an eoi is pending xen/events: avoid handling the same event on two cpus at the same time KVM: arm64: Fix nVHE hyp panic host context restore RDMA/umem: Use ib_dma_max_seg_size instead of dma_get_max_seg_size Linux 5.10.24 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ie53a3c1963066a18d41357b6be41cff00690bd40	2021-03-19 09:42:56 +01:00
Eric W. Biederman	5d5422a294	Revert 95ebabde38 ("capabilities: Don't allow writing ambiguous v3 file capabilities") ... commit 3b0c2d3eaa upstream. It turns out that there are in fact userspace implementations that care and this recent change caused a regression. https://github.com/containers/buildah/issues/3071 As the motivation for the original change was future development, and the impact is existing real world code just revert this change and allow the ambiguity in v3 file caps. Cc: stable@vger.kernel.org Fixes: 95ebabde38 ("capabilities: Don't allow writing ambiguous v3 file capabilities") Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-03-17 17:06:27 +01:00
Kuan-Ying Lee	0a3b407463	ANDROID: security: selinux: Add vendor hook in avc ... Add vendor hook for avc, so we can get avc_node information to monitor avc lifetime. Bug: 181639260 Signed-off-by: Kuan-Ying Lee <Kuan-Ying.Lee@mediatek.com> Change-Id: Idbebeca926c2cb407264f2872b032e1f18462697	2021-03-15 15:37:18 +00:00
Greg Kroah-Hartman	6bd3d0211c	Merge 5.10.22 into android12-5.10 ... Changes in 5.10.22 ALSA: hda/realtek: Enable headset mic of Acer SWIFT with ALC256 ALSA: usb-audio: use Corsair Virtuoso mapping for Corsair Virtuoso SE ALSA: usb-audio: Drop bogus dB range in too low level tpm, tpm_tis: Decorate tpm_tis_gen_interrupt() with request_locality() tpm, tpm_tis: Decorate tpm_get_timeouts() with request_locality() btrfs: avoid double put of block group when emptying cluster btrfs: fix raid6 qstripe kmap btrfs: fix race between writes to swap files and scrub btrfs: fix race between swap file activation and snapshot creation btrfs: fix stale data exposure after cloning a hole with NO_HOLES enabled btrfs: fix race between extent freeing/allocation when using bitmaps btrfs: validate qgroup inherit for SNAP_CREATE_V2 ioctl btrfs: free correct amount of space in btrfs_delayed_inode_reserve_metadata btrfs: unlock extents in btrfs_zero_range in case of quota reservation errors btrfs: fix warning when creating a directory with smack enabled PM: runtime: Update device status before letting suppliers suspend ring-buffer: Force before_stamp and write_stamp to be different on discard io_uring: ignore double poll add on the same waitqueue head dm bufio: subtract the number of initial sectors in dm_bufio_get_device_size dm verity: fix FEC for RS roots unaligned to block size drm/amdgpu:disable VCN for Navi12 SKU drm/amdgpu: fix parameter error of RREG32_PCIE() in amdgpu_regs_pcie crypto - shash: reduce minimum alignment of shash_desc structure arm64: mm: Move reserve_crashkernel() into mem_init() arm64: mm: Move zone_dma_bits initialization into zone_sizes_init() of/address: Introduce of_dma_get_max_cpu_address() of: unittest: Add test for of_dma_get_max_cpu_address() arm64: mm: Set ZONE_DMA size based on devicetree's dma-ranges arm64: mm: Set ZONE_DMA size based on early IORT scan mm: Remove examples from enum zone_type comment ALSA: ctxfi: cthw20k2: fix mask on conf to allow 4 bits RDMA/cm: Fix IRQ restore in ib_send_cm_sidr_rep RDMA/rxe: Fix missing kconfig dependency on CRYPTO IB/mlx5: Add missing error code ALSA: hda: intel-nhlt: verify config type ftrace: Have recordmcount use w8 to read relp->r_info in arm64_is_fake_mcount rsxx: Return -EFAULT if copy_to_user() fails iommu/vt-d: Fix status code for Allocate/Free PASID command Revert "arm64: dts: amlogic: add missing ethernet reset ID" of: unittest: Fix build on architectures without CONFIG_OF_ADDRESS tomoyo: recognize kernel threads correctly r8169: fix resuming from suspend on RTL8105e if machine runs on battery Linux 5.10.22 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I6adb109dd12fde9737f46fe7b496c94999e5c335	2021-03-11 19:35:01 +01:00
Tetsuo Handa	aa40f5e33c	tomoyo: recognize kernel threads correctly ... commit 9c83465f32 upstream. Commit db68ce10c4 ("new helper: uaccess_kernel()") replaced segment_eq(get_fs(), KERNEL_DS) with uaccess_kernel(). But the correct method for tomoyo to check whether current is a kernel thread in order to assume that kernel threads are privileged for socket operations was (current->flags & PF_KTHREAD). Now that uaccess_kernel() became 0 on x86, tomoyo has to fix this problem. Do like commit 942cb357ae ("Smack: Handle io_uring kernel thread privileges") does. Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-03-09 11:11:15 +01:00
Greg Kroah-Hartman	28454baf9c	This is the 5.10.21 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmBEulcACgkQONu9yGCS aT5+8BAAtgxUCbSKsQOd8wObQSeasrc0DD3r3pAmf08gxVRAwtzupxmeJvNcxU6G XSIeKJZ0c/3JVQhh7390mZKS5IYtEFWaBjbbkwogrx9Vsn12ewDKEjfTqeOjli7B iaOI8qaRN/zYhEgi2J6wWn81WBKlmjWh+bB2LnX7LzOATguVehMAmLsF6KHrHBne ERml4aRXxrj2EwiG55BqDY1jMD6sPPECEqMhQYdSeEJR9jCkvUdpa0SCQ7UwBOav nS/Rmxnx35LjIPUIO4Jk+CLQJnFlsCJjjdW222yJIgFW5NeBbuN4xyONVWwXUddj X6prMXjKMf1fCfxQ124JwiIp98mSz+1nIhu7zMQuALbDh/S1GMufKEq/cHg57Jlh vliQcO4kv9Vq0GPcn667P1OAL+DXAgSyTk8Hajv+do9Cb5c3897LpuiDPgadh+F6 c6xO6MT8zX5L54xRu2ITtaFh8LRaCgMHEFrDcBwIKGvlGwrzIvYxxuoAFIyiN/yL ZIfZWbs1y8XHsHC69f0B7MTC99+TPr/M+a1gnQ9c9B7HBlzGEjoTTgFFhkvKs1lr dLe63Z2NF5ZQhHOSW47lqBkEHhYVW+cSQdPcEUFJu5qs/xuzXyzVZWf0443nHOMN RLgMvIR1DgrLSoWIl8A0cfBVWd2+FUa7IBBtrz6P+RyRLe+ybQ8= =ZowT -----END PGP SIGNATURE----- Merge 5.10.21 into android12-5.10 Changes in 5.10.21 net: usb: qmi_wwan: support ZTE P685M modem Input: elantech - fix protocol errors for some trackpoints in SMBus mode Input: elan_i2c - add new trackpoint report type 0x5F drm/virtio: use kvmalloc for large allocations x86/build: Treat R_386_PLT32 relocation as R_386_PC32 JFS: more checks for invalid superblock sched/core: Allow try_invoke_on_locked_down_task() with irqs disabled udlfb: Fix memory leak in dlfb_usb_probe media: mceusb: sanity check for prescaler value erofs: fix shift-out-of-bounds of blkszbits media: v4l2-ctrls.c: fix shift-out-of-bounds in std_validate xfs: Fix assert failure in xfs_setattr_size() net/af_iucv: remove WARN_ONCE on malformed RX packets smackfs: restrict bytes count in smackfs write functions tomoyo: ignore data race while checking quota net: fix up truesize of cloned skb in skb_prepare_for_shift() riscv: Get rid of MAX_EARLY_MAPPING_SIZE nbd: handle device refs for DESTROY_ON_DISCONNECT properly mm/hugetlb.c: fix unnecessary address expansion of pmd sharing RDMA/rtrs: Do not signal for heatbeat RDMA/rtrs-clt: Use bitmask to check sess->flags RDMA/rtrs-srv: Do not signal REG_MR tcp: fix tcp_rmem documentation mptcp: do not wakeup listener for MPJ subflows net: bridge: use switchdev for port flags set through sysfs too net/sched: cls_flower: Reject invalid ct_state flags rules net: dsa: tag_rtl4_a: Support also egress tags net: ag71xx: remove unnecessary MTU reservation net: hsr: add support for EntryForgetTime net: psample: Fix netlink skb length with tunnel info net: fix dev_ifsioc_locked() race condition dt-bindings: ethernet-controller: fix fixed-link specification dt-bindings: net: btusb: DT fix s/interrupt-name/interrupt-names/ ASoC: qcom: Remove useless debug print rsi: Fix TX EAPOL packet handling against iwlwifi AP rsi: Move card interrupt handling to RX thread EDAC/amd64: Do not load on family 0x15, model 0x13 staging: fwserial: Fix error handling in fwserial_create x86/reboot: Add Zotac ZBOX CI327 nano PCI reboot quirk vt/consolemap: do font sum unsigned wlcore: Fix command execute failure 19 for wl12xx Bluetooth: hci_h5: Set HCI_QUIRK_SIMULTANEOUS_DISCOVERY for btrtl Bluetooth: btusb: fix memory leak on suspend and resume mt76: mt7615: reset token when mac_reset happens pktgen: fix misuse of BUG_ON() in pktgen_thread_worker() ath10k: fix wmi mgmt tx queue full due to race condition net: sfp: add mode quirk for GPON module Ubiquiti U-Fiber Instant Bluetooth: Add new HCI_QUIRK_NO_SUSPEND_NOTIFIER quirk Bluetooth: Fix null pointer dereference in amp_read_loc_assoc_final_data staging: most: sound: add sanity check for function argument staging: bcm2835-audio: Replace unsafe strcpy() with strscpy() brcmfmac: Add DMI nvram filename quirk for Predia Basic tablet brcmfmac: Add DMI nvram filename quirk for Voyo winpad A15 tablet drm/hisilicon: Fix use-after-free crypto: tcrypt - avoid signed overflow in byte count fs: make unlazy_walk() error handling consistent drm/amdgpu: Add check to prevent IH overflow PCI: Add a REBAR size quirk for Sapphire RX 5600 XT Pulse ASoC: Intel: bytcr_rt5640: Add new BYT_RT5640_NO_SPEAKERS quirk-flag drm/amd/display: Guard against NULL pointer deref when get_i2c_info fails drm/amd/amdgpu: add error handling to amdgpu_virt_read_pf2vf_data media: uvcvideo: Allow entities with no pads f2fs: handle unallocated section and zone on pinned/atgc f2fs: fix to set/clear I_LINKABLE under i_lock nvme-core: add cancel tagset helpers nvme-rdma: add clean action for failed reconnection nvme-tcp: add clean action for failed reconnection ASoC: Intel: Add DMI quirk table to soc_intel_is_byt_cr() btrfs: fix error handling in commit_fs_roots perf/x86/kvm: Add Cascade Lake Xeon steppings to isolation_ucodes[] ASoC: Intel: sof-sdw: indent and add quirks consistently ASoC: Intel: sof_sdw: detect DMIC number based on mach params parisc: Bump 64-bit IRQ stack size to 64 KB sched/features: Fix hrtick reprogramming ASoC: Intel: bytcr_rt5640: Add quirk for the Estar Beauty HD MID 7316R tablet ASoC: Intel: bytcr_rt5640: Add quirk for the Voyo Winpad A15 tablet ASoC: Intel: bytcr_rt5651: Add quirk for the Jumper EZpad 7 tablet ASoC: Intel: bytcr_rt5640: Add quirk for the Acer One S1002 tablet scsi: iscsi: Restrict sessions and handles to admin capabilities scsi: iscsi: Ensure sysfs attributes are limited to PAGE_SIZE scsi: iscsi: Verify lengths on passthrough PDUs Xen/gnttab: handle p2m update errors on a per-slot basis xen-netback: respect gnttab_map_refs()'s return value xen: fix p2m size in dom0 for disabled memory hotplug case zsmalloc: account the number of compacted pages correctly remoteproc/mediatek: Fix kernel test robot warning swap: fix swapfile read/write offset powerpc/sstep: Check instruction validity against ISA version before emulation powerpc/sstep: Fix incorrect return from analyze_instr() tty: fix up iterate_tty_read() EOVERFLOW handling tty: fix up hung_up_tty_read() conversion tty: clean up legacy leftovers from n_tty line discipline tty: teach n_tty line discipline about the new "cookie continuations" tty: teach the n_tty ICANON case about the new "cookie continuations" too media: v4l: ioctl: Fix memory leak in video_usercopy ALSA: hda/realtek: Add quirk for Clevo NH55RZQ ALSA: hda/realtek: Add quirk for Intel NUC 10 ALSA: hda/realtek: Apply dual codec quirks for MSI Godlike X570 board net: sfp: VSOL V2801F / CarlitoxxPro CPGOS03-0490 v2.0 workaround net: sfp: add workaround for Realtek RTL8672 and RTL9601C chips Linux 5.10.21 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I52b1105b73d893779b3886b577accfabe9f83a16	2021-03-07 12:53:30 +01:00
Tetsuo Handa	e00420943a	tomoyo: ignore data race while checking quota ... commit 5797e861e4 upstream. syzbot is reporting that tomoyo's quota check is racy [1]. But this check is tolerant of some degree of inaccuracy. Thus, teach KCSAN to ignore this data race. [1] https://syzkaller.appspot.com/bug?id=999533deec7ba6337f8aa25d8bd1a4d5f7e50476 Reported-by: syzbot <syzbot+0789a72b46fd91431bd8@syzkaller.appspotmail.com> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-03-07 12:34:05 +01:00
Sabyrzhan Tasbolatov	fa5b656092	smackfs: restrict bytes count in smackfs write functions ... commit 7ef4c19d24 upstream. syzbot found WARNINGs in several smackfs write operations where bytes count is passed to memdup_user_nul which exceeds GFP MAX_ORDER. Check count size if bigger than PAGE_SIZE. Per smackfs doc, smk_write_net4addr accepts any label or -CIPSO, smk_write_net6addr accepts any label or -DELETE. I couldn't find any general rule for other label lengths except SMK_LABELLEN, SMK_LONGLABEL, SMK_CIPSOMAX which are documented. Let's constrain, in general, smackfs label lengths for PAGE_SIZE. Although fuzzer crashes write to smackfs/netlabel on 0x400000 length. Here is a quick way to reproduce the WARNING: python -c "print('A' * 0x400000)" > /sys/fs/smackfs/netlabel Reported-by: syzbot+a71a442385a0b2815497@syzkaller.appspotmail.com Signed-off-by: Sabyrzhan Tasbolatov <snovitoll@gmail.com> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-03-07 12:34:05 +01:00