Commit Graph

12220 Commits

Author SHA1 Message Date
Dmitry Safonov
0f1aab4b37 BACKPORT: xfrm/compat: Translate 32-bit user_policy from sockptr
Provide compat_xfrm_userpolicy_info translation for xfrm setsocketopt().
Reallocate buffer and put the missing padding for 64-bit message.

Signed-off-by: Dmitry Safonov <dima@arista.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
(cherry picked from commit 96392ee5a1)
[adelva: Edited around removed compat check in Android kernels]
Bug: 163141236
Signed-off-by: Alistair Delva <adelva@google.com>
Change-Id: I32a6495cd92fa13c956fca88aa5d80716155b8ae
2020-11-01 20:38:04 -08:00
Dmitry Safonov
77d2c7b99a BACKPORT: xfrm/compat: Add 32=>64-bit messages translator
Provide the user-to-kernel translator under XFRM_USER_COMPAT, that
creates for 32-bit xfrm-user message a 64-bit translation.
The translation is afterwards reused by xfrm_user code just as if
userspace had sent 64-bit message.

Signed-off-by: Dmitry Safonov <dima@arista.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
(cherry picked from commit 5106f4a8ac)
[adelva: nlmsg_parse_deprecated -> nlmsg_parse]
Bug: 163141236
Signed-off-by: Alistair Delva <adelva@google.com>
Change-Id: If15999b86e4704b75307fbcc3d7f0c8d8bc89e7a
2020-11-01 17:06:09 +00:00
Dmitry Safonov
00260df47d UPSTREAM: xfrm/compat: Add 64=>32-bit messages translator
Provide the kernel-to-user translator under XFRM_USER_COMPAT, that
creates for 64-bit xfrm-user message a 32-bit translation and puts it
in skb's frag_list. net/compat.c layer provides MSG_CMSG_COMPAT to
decide if the message should be taken from skb or frag_list.
(used by wext-core which has also an ABI difference)

Kernel sends 64-bit xfrm messages to the userspace for:
- multicast (monitor events)
- netlink dumps

Wire up the translator to xfrm_nlmsg_multicast().

Signed-off-by: Dmitry Safonov <dima@arista.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
(cherry picked from commit 5461fc0c8d)
Bug: 163141236
Signed-off-by: Alistair Delva <adelva@google.com>
Change-Id: Id8b59587d60feb9b9f0ce96be9d140d694573fe3
2020-11-01 17:05:51 +00:00
Dmitry Safonov
9ae4da45c5 BACKPORT: xfrm: Provide API to register translator module
Add a skeleton for xfrm_compat module and provide API to register it in
xfrm_state.ko. struct xfrm_translator will have function pointers to
translate messages received from 32-bit userspace or to be sent to it
from 64-bit kernel.
module_get()/module_put() are used instead of rcu_read_lock() as the
module will vmalloc() memory for translation.
The new API is registered with xfrm_state module, not with xfrm_user as
the former needs translator for user_policy set by setsockopt() and
xfrm_user already uses functions from xfrm_state.

Signed-off-by: Dmitry Safonov <dima@arista.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
(cherry picked from commit c9e7c76d70)
[adelva: Edited around some context changes]
Bug: 163141236
Signed-off-by: Alistair Delva <adelva@google.com>
Change-Id: Ic825c6a0367fa192cc3f7af6b7d2682ef8f9d58b
2020-11-01 17:05:43 +00:00
Greg Kroah-Hartman
b9a942466b This is the 4.19.153 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl+ag5UACgkQONu9yGCS
 aT5O3w//RaOcwQdi47/UJz8zyja1ZG8MSSCGibpwvaDwrsXu9es1QtqLAC38H10o
 ygxNLBZQHxhScsRpicNc+Dy87+lcSj8cF1ed7sd1LU8rvmQ18uIeFUZxfzYth8jW
 i6erzas0Ojw8IMy566GDxkfAC6n5GhJuJTVFQWUQpoEbsb5rXcGCLx3u+S3Ew+5t
 Xb9qE6r5cImYymvMkMy7RQ4Db2qgOwjkaCj+Ol+4BSR0bF4OweMQLPJs9gN8pJpr
 o2nxHg7wdO8SKJZCBVw8ZmfO4zF6czcKy+KzFajn+4LA2oT5mgiV8y21cd9CWYeQ
 JQK1jZGwwl/xljrM1yLd+crG8i11DhCStY90+4bxD68r8H+g1kwZ8jELmCwuuyx6
 dk1s7jOxyKl9qAnMt6r2HqrjgxGD+2hL+2S84jPGRBow5IYjrdD0REXZjyk1R7Rp
 8k00lRk1ATEy7H2lj4JW34tcsTEEDcn8PqUFx7MRKtCUI2uo4Gr5HXqf6wTJDp6S
 BsDe8mm77jd81vtw/AZ8Fv7Fg42QIPt7G1QV9wBbFvDmKmDa7Gj6SuQqTeu75oU9
 M++aWSwyOb08wZEE0y94wsm6r4raN3A8o70Df9FltNFTALowuIcR+CVtOnQfHEuL
 BUBJcWg3SDsIxkXYgvQ9jO5h38i6dhAIVGAcU4VB0rgP/ePKMQs=
 =GiLo
 -----END PGP SIGNATURE-----

Merge 4.19.153 into android-4.19-stable

Changes in 4.19.153
	ibmveth: Switch order of ibmveth_helper calls.
	ibmveth: Identify ingress large send packets.
	ipv4: Restore flowi4_oif update before call to xfrm_lookup_route
	mlx4: handle non-napi callers to napi_poll
	net: fec: Fix phy_device lookup for phy_reset_after_clk_enable()
	net: fec: Fix PHY init after phy_reset_after_clk_enable()
	net: fix pos incrementment in ipv6_route_seq_next
	net/smc: fix valid DMBE buffer sizes
	net: usb: qmi_wwan: add Cellient MPL200 card
	tipc: fix the skb_unshare() in tipc_buf_append()
	net/ipv4: always honour route mtu during forwarding
	r8169: fix data corruption issue on RTL8402
	net/tls: sendfile fails with ktls offload
	binder: fix UAF when releasing todo list
	ALSA: bebob: potential info leak in hwdep_read()
	chelsio/chtls: fix socket lock
	chelsio/chtls: correct netdevice for vlan interface
	chelsio/chtls: correct function return and return type
	net: hdlc: In hdlc_rcv, check to make sure dev is an HDLC device
	net: hdlc_raw_eth: Clear the IFF_TX_SKB_SHARING flag after calling ether_setup
	net/sched: act_tunnel_key: fix OOB write in case of IPv6 ERSPAN tunnels
	nfc: Ensure presence of NFC_ATTR_FIRMWARE_NAME attribute in nfc_genl_fw_download()
	tcp: fix to update snd_wl1 in bulk receiver fast path
	r8169: fix operation under forced interrupt threading
	icmp: randomize the global rate limiter
	ALSA: hda/realtek: Enable audio jacks of ASUS D700SA with ALC887
	cifs: remove bogus debug code
	cifs: Return the error from crypt_message when enc/dec key not found.
	KVM: x86/mmu: Commit zap of remaining invalid pages when recovering lpages
	KVM: SVM: Initialize prev_ga_tag before use
	ima: Don't ignore errors from crypto_shash_update()
	crypto: algif_aead - Do not set MAY_BACKLOG on the async path
	EDAC/i5100: Fix error handling order in i5100_init_one()
	EDAC/ti: Fix handling of platform_get_irq() error
	x86/fpu: Allow multiple bits in clearcpuid= parameter
	drivers/perf: xgene_pmu: Fix uninitialized resource struct
	x86/nmi: Fix nmi_handle() duration miscalculation
	x86/events/amd/iommu: Fix sizeof mismatch
	crypto: algif_skcipher - EBUSY on aio should be an error
	crypto: mediatek - Fix wrong return value in mtk_desc_ring_alloc()
	crypto: ixp4xx - Fix the size used in a 'dma_free_coherent()' call
	crypto: picoxcell - Fix potential race condition bug
	media: tuner-simple: fix regression in simple_set_radio_freq
	media: Revert "media: exynos4-is: Add missed check for pinctrl_lookup_state()"
	media: m5mols: Check function pointer in m5mols_sensor_power
	media: uvcvideo: Set media controller entity functions
	media: uvcvideo: Silence shift-out-of-bounds warning
	media: omap3isp: Fix memleak in isp_probe
	crypto: omap-sham - fix digcnt register handling with export/import
	hwmon: (pmbus/max34440) Fix status register reads for MAX344{51,60,61}
	cypto: mediatek - fix leaks in mtk_desc_ring_alloc
	media: mx2_emmaprp: Fix memleak in emmaprp_probe
	media: tc358743: initialize variable
	media: tc358743: cleanup tc358743_cec_isr
	media: rcar-vin: Fix a reference count leak.
	media: rockchip/rga: Fix a reference count leak.
	media: platform: fcp: Fix a reference count leak.
	media: camss: Fix a reference count leak.
	media: s5p-mfc: Fix a reference count leak
	media: stm32-dcmi: Fix a reference count leak
	media: ti-vpe: Fix a missing check and reference count leak
	regulator: resolve supply after creating regulator
	pinctrl: bcm: fix kconfig dependency warning when !GPIOLIB
	spi: spi-s3c64xx: swap s3c64xx_spi_set_cs() and s3c64xx_enable_datapath()
	spi: spi-s3c64xx: Check return values
	ath10k: provide survey info as accumulated data
	Bluetooth: hci_uart: Cancel init work before unregistering
	ath6kl: prevent potential array overflow in ath6kl_add_new_sta()
	ath9k: Fix potential out of bounds in ath9k_htc_txcompletion_cb()
	ath10k: Fix the size used in a 'dma_free_coherent()' call in an error handling path
	wcn36xx: Fix reported 802.11n rx_highest rate wcn3660/wcn3680
	ASoC: qcom: lpass-platform: fix memory leak
	ASoC: qcom: lpass-cpu: fix concurrency issue
	brcmfmac: check ndev pointer
	mwifiex: Do not use GFP_KERNEL in atomic context
	staging: rtl8192u: Do not use GFP_KERNEL in atomic context
	drm/gma500: fix error check
	scsi: qla4xxx: Fix an error handling path in 'qla4xxx_get_host_stats()'
	scsi: qla2xxx: Fix wrong return value in qla_nvme_register_hba()
	scsi: csiostor: Fix wrong return value in csio_hw_prep_fw()
	backlight: sky81452-backlight: Fix refcount imbalance on error
	VMCI: check return value of get_user_pages_fast() for errors
	tty: serial: earlycon dependency
	tty: hvcs: Don't NULL tty->driver_data until hvcs_cleanup()
	pty: do tty_flip_buffer_push without port->lock in pty_write
	pwm: lpss: Fix off by one error in base_unit math in pwm_lpss_prepare()
	pwm: lpss: Add range limit check for the base_unit register value
	drivers/virt/fsl_hypervisor: Fix error handling path
	video: fbdev: vga16fb: fix setting of pixclock because a pass-by-value error
	video: fbdev: sis: fix null ptr dereference
	video: fbdev: radeon: Fix memleak in radeonfb_pci_register
	HID: roccat: add bounds checking in kone_sysfs_write_settings()
	pinctrl: mcp23s08: Fix mcp23x17_regmap initialiser
	pinctrl: mcp23s08: Fix mcp23x17 precious range
	net/mlx5: Don't call timecounter cyc2time directly from 1PPS flow
	net: stmmac: use netif_tx_start|stop_all_queues() function
	cpufreq: armada-37xx: Add missing MODULE_DEVICE_TABLE
	net: dsa: rtl8366: Check validity of passed VLANs
	net: dsa: rtl8366: Refactor VLAN/PVID init
	net: dsa: rtl8366: Skip PVID setting if not requested
	net: dsa: rtl8366rb: Support all 4096 VLANs
	ath6kl: wmi: prevent a shift wrapping bug in ath6kl_wmi_delete_pstream_cmd()
	misc: mic: scif: Fix error handling path
	ALSA: seq: oss: Avoid mutex lock for a long-time ioctl
	usb: dwc2: Fix parameter type in function pointer prototype
	quota: clear padding in v2r1_mem2diskdqb()
	slimbus: core: check get_addr before removing laddr ida
	slimbus: core: do not enter to clock pause mode in core
	slimbus: qcom-ngd-ctrl: disable ngd in qmi server down callback
	HID: hid-input: fix stylus battery reporting
	qtnfmac: fix resource leaks on unsupported iftype error return path
	net: enic: Cure the enic api locking trainwreck
	mfd: sm501: Fix leaks in probe()
	iwlwifi: mvm: split a print to avoid a WARNING in ROC
	usb: gadget: f_ncm: fix ncm_bitrate for SuperSpeed and above.
	usb: gadget: u_ether: enable qmult on SuperSpeed Plus as well
	nl80211: fix non-split wiphy information
	usb: dwc2: Fix INTR OUT transfers in DDMA mode.
	scsi: target: tcmu: Fix warning: 'page' may be used uninitialized
	scsi: be2iscsi: Fix a theoretical leak in beiscsi_create_eqs()
	platform/x86: mlx-platform: Remove PSU EEPROM configuration
	mwifiex: fix double free
	ipvs: clear skb->tstamp in forwarding path
	net: korina: fix kfree of rx/tx descriptor array
	netfilter: nf_log: missing vlan offload tag and proto
	mm/memcg: fix device private memcg accounting
	mm, oom_adj: don't loop through tasks in __set_oom_adj when not necessary
	IB/mlx4: Fix starvation in paravirt mux/demux
	IB/mlx4: Adjust delayed work when a dup is observed
	powerpc/pseries: Fix missing of_node_put() in rng_init()
	powerpc/icp-hv: Fix missing of_node_put() in success path
	RDMA/ucma: Fix locking for ctx->events_reported
	RDMA/ucma: Add missing locking around rdma_leave_multicast()
	mtd: lpddr: fix excessive stack usage with clang
	powerpc/pseries: explicitly reschedule during drmem_lmb list traversal
	mtd: mtdoops: Don't write panic data twice
	ARM: 9007/1: l2c: fix prefetch bits init in L2X0_AUX_CTRL using DT values
	arc: plat-hsdk: fix kconfig dependency warning when !RESET_CONTROLLER
	xfs: limit entries returned when counting fsmap records
	xfs: fix high key handling in the rt allocator's query_range function
	RDMA/qedr: Fix use of uninitialized field
	RDMA/qedr: Fix inline size returned for iWARP
	powerpc/tau: Use appropriate temperature sample interval
	powerpc/tau: Convert from timer to workqueue
	powerpc/tau: Remove duplicated set_thresholds() call
	Linux 4.19.153

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I9e85e8ca67ab8e28d04a77339f80fdbf3c568956
2020-10-29 11:36:20 +01:00
Pablo Neira Ayuso
d74d61d90b netfilter: nf_log: missing vlan offload tag and proto
[ Upstream commit 0d9826bc18 ]

Dump vlan tag and proto for the usual vlan offload case if the
NF_LOG_MACDECODE flag is set on. Without this information the logging is
misleading as there is no reference to the VLAN header.

[12716.993704] test: IN=veth0 OUT= MACSRC=86:6c:92:ea:d6:73 MACDST=0e:3b:eb:86:73:76 VPROTO=8100 VID=10 MACPROTO=0800 SRC=192.168.10.2 DST=172.217.168.163 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=2548 DF PROTO=TCP SPT=55848 DPT=80 WINDOW=501 RES=0x00 ACK FIN URGP=0
[12721.157643] test: IN=veth0 OUT= MACSRC=86:6c:92:ea:d6:73 MACDST=0e:3b:eb:86:73:76 VPROTO=8100 VID=10 MACPROTO=0806 ARP HTYPE=1 PTYPE=0x0800 OPCODE=2 MACSRC=86:6c:92:ea:d6:73 IPSRC=192.168.10.2 MACDST=0e:3b:eb:86:73:76 IPDST=192.168.10.1

Fixes: 83e96d443b ("netfilter: log: split family specific code to nf_log_{ip,ip6,common}.c files")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-10-29 09:55:15 +01:00
Maciej Żenczykowski
9db62b7591 net/ipv4: always honour route mtu during forwarding
[ Upstream commit 02a1b175b0 ]

Documentation/networking/ip-sysctl.txt:46 says:
  ip_forward_use_pmtu - BOOLEAN
    By default we don't trust protocol path MTUs while forwarding
    because they could be easily forged and can lead to unwanted
    fragmentation by the router.
    You only need to enable this if you have user-space software
    which tries to discover path mtus by itself and depends on the
    kernel honoring this information. This is normally not the case.
    Default: 0 (disabled)
    Possible values:
    0 - disabled
    1 - enabled

Which makes it pretty clear that setting it to 1 is a potential
security/safety/DoS issue, and yet it is entirely reasonable to want
forwarded traffic to honour explicitly administrator configured
route mtus (instead of defaulting to device mtu).

Indeed, I can't think of a single reason why you wouldn't want to.
Since you configured a route mtu you probably know better...

It is pretty common to have a higher device mtu to allow receiving
large (jumbo) frames, while having some routes via that interface
(potentially including the default route to the internet) specify
a lower mtu.

Note that ipv6 forwarding uses device mtu unless the route is locked
(in which case it will use the route mtu).

This approach is not usable for IPv4 where an 'mtu lock' on a route
also has the side effect of disabling TCP path mtu discovery via
disabling the IPv4 DF (don't frag) bit on all outgoing frames.

I'm not aware of a way to lock a route from an IPv6 RA, so that also
potentially seems wrong.

Signed-off-by: Maciej Żenczykowski <maze@google.com>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Cc: Lorenzo Colitti <lorenzo@google.com>
Cc: Sunmeet Gill (Sunny) <sgill@quicinc.com>
Cc: Vinay Paradkar <vparadka@qti.qualcomm.com>
Cc: Tyler Wear <twear@quicinc.com>
Cc: David Ahern <dsahern@kernel.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-10-29 09:54:56 +01:00
Jason A. Donenfeld
675f727a5d UPSTREAM: net: ip_tunnel: add header_ops for layer 3 devices
Some devices that take straight up layer 3 packets benefit from having a
shared header_ops so that AF_PACKET sockets can inject packets that are
recognized. This shared infrastructure will be used by other drivers
that currently can't inject packets using AF_PACKET. It also exposes the
parser function, as it is useful in standalone form too.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[Jason: no parse_protocol in ip_tunnel_header_ops]
(cherry picked from commit 2606aff916)
Bug: 152722841
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ib255de1683387e8adfa5042cf11ea004a06cd78f
2020-10-25 13:40:26 +01:00
Jason A. Donenfeld
f34aa80c85 UPSTREAM: icmp: introduce helper for nat'd source address in network device context
This introduces a helper function to be called only by network drivers
that wraps calls to icmp[v6]_send in a conntrack transformation, in case
NAT has been used. We don't want to pollute the non-driver path, though,
so we introduce this as a helper to be called by places that actually
make use of this, as suggested by Florian.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Cc: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 0b41713b60)
Bug: 152722841
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ic11fe236d0c404a389017a713b972954ae067439
2020-10-25 11:48:10 +01:00
Greg Kroah-Hartman
13abe23636 This is the 4.19.152 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl+Kp6UACgkQONu9yGCS
 aT7aQxAAgsJSnontvgETbOzYuZl46DJlJtp+Ao9ex9zP/ptTH0SytDVL2zum+FBT
 MMwrrDKHaDzHXqfLChGGswo48XqDwAjGhPWmcYWw99PjcCHk4xYlilw3kC6CSRZq
 7k1c8DBX1zBkheBbz3GJYQ+U1B4bASVrpBKLxccXwf4if5gDj/36zkZs/YxEwR/l
 6PQa57klYPXs269E5n28vMZCVs+sZ2DLZ5odnf1AaGZBYYYi54mNTAtQ/RoAKtcN
 bDfmvq+4eVDl34feLwEZLQzWcYi51h6rXvdju4CVih99JDHv42gz2BHDXcp4C86Z
 kYI0BzCIiww6/QcVGL4sb/VdVFo+NwSqbHhyIFWRKej2N4l6djdba1RJ4m1tUb6o
 Ta0tARqlSGmk1SIWVfgIKhvXX8TMp6pYtNsTSsn7EHsztGIYtuY6yU2Ql/YGg7rM
 fJ0tZa8rswRgD2sl9JTTlNmgTRQhv9/3h6xKaMzpYl7m85fvrXKXnJ7NyxLr2iUK
 /h7jPh4QXY9BaNus4qKKLPRcX0FC0X+QOFexTuqAdnR5iD4wrIpgICSxRqL5ScAY
 kB9kjmB8fNLwyolbkTXd7TYQHECsjQ56tCAiXl4zhgjDyr5Ae6gfU7HN8bC1y74d
 IZM2V4Jbb2o7JpF267KfHUhGqEr9DLZSLini8u5DiEPtE+grpR0=
 =zOUG
 -----END PGP SIGNATURE-----

Merge 4.19.152 into android-4.19-stable

Changes in 4.19.152
	perf cs-etm: Move definition of 'traceid_list' global variable from header file
	ARM: 8858/1: vdso: use $(LD) instead of $(CC) to link VDSO
	ARM: 8939/1: kbuild: use correct nm executable
	ARM: 8867/1: vdso: pass --be8 to linker if necessary
	Bluetooth: A2MP: Fix not initializing all members
	Bluetooth: L2CAP: Fix calling sk_filter on non-socket based channel
	Bluetooth: MGMT: Fix not checking if BT_HS is enabled
	Bluetooth: Consolidate encryption handling in hci_encrypt_cfm
	Bluetooth: Fix update of connection state in `hci_encrypt_cfm`
	Bluetooth: Disconnect if E0 is used for Level 4
	media: usbtv: Fix refcounting mixup
	USB: serial: option: add Cellient MPL200 card
	USB: serial: option: Add Telit FT980-KS composition
	staging: comedi: check validity of wMaxPacketSize of usb endpoints found
	USB: serial: pl2303: add device-id for HP GC device
	USB: serial: ftdi_sio: add support for FreeCalypso JTAG+UART adapters
	reiserfs: Initialize inode keys properly
	reiserfs: Fix oops during mount
	drivers/net/ethernet/marvell/mvmdio.c: Fix non OF case
	crypto: bcm - Verify GCM/CCM key length in setkey
	crypto: qat - check cipher length for aead AES-CBC-HMAC-SHA
	Linux 4.19.152

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I220620fba6634de064782836b2738a9651edd299
2020-10-17 10:26:40 +02:00
Luiz Augusto von Dentz
c1ad9bb3b0 Bluetooth: Disconnect if E0 is used for Level 4
commit 8746f135bb upstream.

E0 is not allowed with Level 4:

BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 3, Part C page 1319:

  '128-bit equivalent strength for link and encryption keys
   required using FIPS approved algorithms (E0 not allowed,
   SAFER+ not allowed, and P-192 not allowed; encryption key
   not shortened'

SC enabled:

> HCI Event: Read Remote Extended Features (0x23) plen 13
        Status: Success (0x00)
        Handle: 256
        Page: 1/2
        Features: 0x0b 0x00 0x00 0x00 0x00 0x00 0x00 0x00
          Secure Simple Pairing (Host Support)
          LE Supported (Host)
          Secure Connections (Host Support)
> HCI Event: Encryption Change (0x08) plen 4
        Status: Success (0x00)
        Handle: 256
        Encryption: Enabled with AES-CCM (0x02)

SC disabled:

> HCI Event: Read Remote Extended Features (0x23) plen 13
        Status: Success (0x00)
        Handle: 256
        Page: 1/2
        Features: 0x03 0x00 0x00 0x00 0x00 0x00 0x00 0x00
          Secure Simple Pairing (Host Support)
          LE Supported (Host)
> HCI Event: Encryption Change (0x08) plen 4
        Status: Success (0x00)
        Handle: 256
        Encryption: Enabled with E0 (0x01)
[May 8 20:23] Bluetooth: hci0: Invalid security: expect AES but E0 was used
< HCI Command: Disconnect (0x01|0x0006) plen 3
        Handle: 256
        Reason: Authentication Failure (0x05)

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: Hans-Christian Noren Egtvedt <hegtvedt@cisco.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-10-17 10:12:57 +02:00
Patrick Steinhardt
3882085f1f Bluetooth: Fix update of connection state in hci_encrypt_cfm
commit 339ddaa626 upstream.

Starting with the upgrade to v5.8-rc3, I've noticed I wasn't able to
connect to my Bluetooth headset properly anymore. While connecting to
the device would eventually succeed, bluetoothd seemed to be confused
about the current connection state where the state was flapping hence
and forth. Bisecting this issue led to commit 3ca44c16b0 (Bluetooth:
Consolidate encryption handling in hci_encrypt_cfm, 2020-05-19), which
refactored `hci_encrypt_cfm` to also handle updating the connection
state.

The commit in question changed the code to call `hci_connect_cfm` inside
`hci_encrypt_cfm` and to change the connection state. But with the
conversion, we now only update the connection state if a status was set
already. In fact, the reverse should be true: the status should be
updated if no status is yet set. So let's fix the isuse by reversing the
condition.

Fixes: 3ca44c16b0 ("Bluetooth: Consolidate encryption handling in hci_encrypt_cfm")
Signed-off-by: Patrick Steinhardt <ps@pks.im>
Acked-by:  Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-10-17 10:12:57 +02:00
Luiz Augusto von Dentz
0c75831bc1 Bluetooth: Consolidate encryption handling in hci_encrypt_cfm
commit 3ca44c16b0 upstream.

This makes hci_encrypt_cfm calls hci_connect_cfm in case the connection
state is BT_CONFIG so callers don't have to check the state.

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: Hans-Christian Noren Egtvedt <hegtvedt@cisco.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-10-17 10:12:57 +02:00
Luiz Augusto von Dentz
360f80e342 Bluetooth: L2CAP: Fix calling sk_filter on non-socket based channel
commit f19425641c upstream.

Only sockets will have the chan->data set to an actual sk, channels
like A2MP would have its own data which would likely cause a crash when
calling sk_filter, in order to fix this a new callback has been
introduced so channels can implement their own filtering if necessary.

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-10-17 10:12:56 +02:00
Greg Kroah-Hartman
9f80205d66 This is the 4.19.151 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl+Gt3oACgkQONu9yGCS
 aT4MAQ/+NmMSJHbPu5DRX4qfg+toj9SRdDJfv0H6+dmJ/Wabeogq3GF6VB5ku8fJ
 N5uJLVb+iz/n4cbvTvE1sI+5WEPzK/nRVRnwUUH3SDycB+tCk4loKbGwV+gZTvYi
 PsHqHQ9UUKpdBs4gJm9I/FCOlA4mtcdK2W0JDMfdCmZc3ACyCWo+y83ESAfjOcO9
 vda/1xaeqNPaPFxteVKpmXujlHQw3meH8ZzpkQi7t1HeZ6bnpoObMIy8c1gtYjSt
 jeLvw9pnvgQEpAidIZb3MwVyxHE/mFGRcoQmI0WYoWWXOnRAHUfFQTsK7ZWbTYAF
 MUvJlGg3zchhBetfo2523rdGM9/AHMnwmGAuTs5PkZdPDRwLaWjeFs2u8njmjEk9
 R8SrtF+2zxuO92SPp37jXqRUb7G69vPnlZ6IIcMpr61qeUAf78dWN67VW0kVMs/K
 hMHsl0E1Ax3K9GV9ZSQc7oe7/fMj+xXabpeuDZ/5lxvbBKrIP/UZLMJeZg28y+91
 0JbFhMfEN71sTfCHXpxe9bAvmI1XKlYh37RLAOJtNQRqwKsP2Tuim5C+tJsREmF9
 eAPZq0QrjjTb1t8wii7HKXyjnrSfTpOS7HUPsGbeiU4JSVmWGeLy6IxmjZh1fjY+
 WLr+Hn0Q62w5OGXBxS7rEfq3FMnAEkT/27a5IwrDPoGje+rO6WY=
 =TSOP
 -----END PGP SIGNATURE-----

Merge 4.19.151 into android-4.19-stable

Changes in 4.19.151
	fbdev, newport_con: Move FONT_EXTRA_WORDS macros into linux/font.h
	Fonts: Support FONT_EXTRA_WORDS macros for built-in fonts
	fbcon: Fix global-out-of-bounds read in fbcon_get_font()
	Revert "ravb: Fixed to be able to unload modules"
	net: wireless: nl80211: fix out-of-bounds access in nl80211_del_key()
	drm/nouveau/mem: guard against NULL pointer access in mem_del
	usermodehelper: reset umask to default before executing user process
	platform/x86: intel-vbtn: Fix SW_TABLET_MODE always reporting 1 on the HP Pavilion 11 x360
	platform/x86: thinkpad_acpi: initialize tp_nvram_state variable
	platform/x86: intel-vbtn: Switch to an allow-list for SW_TABLET_MODE reporting
	platform/x86: thinkpad_acpi: re-initialize ACPI buffer size when reuse
	driver core: Fix probe_count imbalance in really_probe()
	perf top: Fix stdio interface input handling with glibc 2.28+
	i2c: i801: Exclude device from suspend direct complete optimization
	mtd: rawnand: sunxi: Fix the probe error path
	arm64: dts: stratix10: add status to qspi dts node
	nvme-core: put ctrl ref when module ref get fail
	macsec: avoid use-after-free in macsec_handle_frame()
	mm/khugepaged: fix filemap page_to_pgoff(page) != offset
	xfrmi: drop ignore_df check before updating pmtu
	cifs: Fix incomplete memory allocation on setxattr path
	i2c: meson: fix clock setting overwrite
	i2c: meson: fixup rate calculation with filter delay
	i2c: owl: Clear NACK and BUS error bits
	sctp: fix sctp_auth_init_hmacs() error path
	team: set dev->needed_headroom in team_setup_by_port()
	net: team: fix memory leak in __team_options_register
	openvswitch: handle DNAT tuple collision
	drm/amdgpu: prevent double kfree ttm->sg
	xfrm: clone XFRMA_SET_MARK in xfrm_do_migrate
	xfrm: clone XFRMA_REPLAY_ESN_VAL in xfrm_do_migrate
	xfrm: clone XFRMA_SEC_CTX in xfrm_do_migrate
	xfrm: clone whole liftime_cur structure in xfrm_do_migrate
	net: stmmac: removed enabling eee in EEE set callback
	platform/x86: fix kconfig dependency warning for FUJITSU_LAPTOP
	xfrm: Use correct address family in xfrm_state_find
	bonding: set dev->needed_headroom in bond_setup_by_slave()
	mdio: fix mdio-thunder.c dependency & build error
	net: usb: ax88179_178a: fix missing stop entry in driver_info
	net/mlx5e: Fix VLAN cleanup flow
	net/mlx5e: Fix VLAN create flow
	rxrpc: Fix rxkad token xdr encoding
	rxrpc: Downgrade the BUG() for unsupported token type in rxrpc_read()
	rxrpc: Fix some missing _bh annotations on locking conn->state_lock
	rxrpc: Fix server keyring leak
	perf: Fix task_function_call() error handling
	mmc: core: don't set limits.discard_granularity as 0
	mm: khugepaged: recalculate min_free_kbytes after memory hotplug as expected by khugepaged
	net: usb: rtl8150: set random MAC address when set_ethernet_addr() fails
	Linux 4.19.151

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I9ee2b0fc4fc39f27be6ae680529e1046f249a3e6
2020-10-14 12:11:08 +02:00
Antony Antony
fb48241729 xfrm: clone XFRMA_REPLAY_ESN_VAL in xfrm_do_migrate
[ Upstream commit 91a46c6d1b ]

XFRMA_REPLAY_ESN_VAL was not cloned completely from the old to the new.
Migrate this attribute during XFRMA_MSG_MIGRATE

v1->v2:
 - move curleft cloning to a separate patch

Fixes: af2f464e32 ("xfrm: Assign esn pointers when cloning a state")
Signed-off-by: Antony Antony <antony.antony@secunet.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-10-14 10:31:24 +02:00
Greg Kroah-Hartman
9ce79d9bed This is the 4.19.149 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl91ulMACgkQONu9yGCS
 aT7ezhAArTOQxPGkhktgdGfCMYgjvIHdny8o4pNGumnxW6TG7FCiJHoZuj8OLkdx
 2x5brOOvSGgcGTOwJXyUjL6opQzD5syTCuzbgEpGB2Tyd1x5q8vgqvI2XPxZeYHy
 x+mUDgacT+4m7FNbFDhNMZoTS4KCiJ3IcTevjeQexDtIs6R38HhxNl0Ee67gkqxZ
 p7c6L3kbUuR5T9EWGE1DPPLhOFGeOMk592qzkFsCGERsuswQOpXrxyw6zkik/0UG
 6Losmo2i+OtQFeiDz0WYJZNO9ySI511j+7R2Ewch/nFuTp6yFzy9kJZnP0YWK/KE
 U4BLmopgzCs9q+TQ/QNjxlCltl4eOrrjkFXF3Zz8o5ddbKwrugEsJUdUUDIpva71
 qEUgSw7vguGKoCttBenCDwyYOcjIVJRBFSWTVDzkgw5pXrz3m7qePF1Kj+KzG0pN
 8gTqosXPlYPzH1mh+2vRVntiCpZRMJYo18CX+ifqN20dHH3dsM4vA5NiWwjTJVY8
 JddRXfujxBQ0jxs2jFKvPZNrgqeY3Mh51L0a5G+HbHCIb+4kgD+2jl+C/X38TKch
 osTM1/qQriFVxtlH9TkTa8opYvrYBWO+G+XhNVc2tSpmd8T2EaKokMAVVvGiK3l9
 ZPq06SytJyKDPsSLvk4BKxCUv5CY0VT18k6mCYd1fq4oxTR92A4=
 =5bC5
 -----END PGP SIGNATURE-----

Merge 4.19.149 into android-4.19-stable

Changes in 4.19.149
	selinux: allow labeling before policy is loaded
	media: mc-device.c: fix memleak in media_device_register_entity
	dma-fence: Serialise signal enabling (dma_fence_enable_sw_signaling)
	ath10k: fix array out-of-bounds access
	ath10k: fix memory leak for tpc_stats_final
	mm: fix double page fault on arm64 if PTE_AF is cleared
	scsi: aacraid: fix illegal IO beyond last LBA
	m68k: q40: Fix info-leak in rtc_ioctl
	gma/gma500: fix a memory disclosure bug due to uninitialized bytes
	ASoC: kirkwood: fix IRQ error handling
	media: smiapp: Fix error handling at NVM reading
	arch/x86/lib/usercopy_64.c: fix __copy_user_flushcache() cache writeback
	x86/ioapic: Unbreak check_timer()
	ALSA: usb-audio: Add delay quirk for H570e USB headsets
	ALSA: hda/realtek - Couldn't detect Mic if booting with headset plugged
	ALSA: hda/realtek: Enable front panel headset LED on Lenovo ThinkStation P520
	lib/string.c: implement stpcpy
	leds: mlxreg: Fix possible buffer overflow
	PM / devfreq: tegra30: Fix integer overflow on CPU's freq max out
	scsi: fnic: fix use after free
	scsi: lpfc: Fix kernel crash at lpfc_nvme_info_show during remote port bounce
	net: silence data-races on sk_backlog.tail
	clk/ti/adpll: allocate room for terminating null
	drm/amdgpu/powerplay: fix AVFS handling with custom powerplay table
	mtd: cfi_cmdset_0002: don't free cfi->cfiq in error path of cfi_amdstd_setup()
	mfd: mfd-core: Protect against NULL call-back function pointer
	drm/amdgpu/powerplay/smu7: fix AVFS handling with custom powerplay table
	tpm_crb: fix fTPM on AMD Zen+ CPUs
	tracing: Adding NULL checks for trace_array descriptor pointer
	bcache: fix a lost wake-up problem caused by mca_cannibalize_lock
	dmaengine: mediatek: hsdma_probe: fixed a memory leak when devm_request_irq fails
	RDMA/qedr: Fix potential use after free
	RDMA/i40iw: Fix potential use after free
	fix dget_parent() fastpath race
	xfs: fix attr leaf header freemap.size underflow
	RDMA/iw_cgxb4: Fix an error handling path in 'c4iw_connect()'
	ubi: Fix producing anchor PEBs
	mmc: core: Fix size overflow for mmc partitions
	gfs2: clean up iopen glock mess in gfs2_create_inode
	scsi: pm80xx: Cleanup command when a reset times out
	debugfs: Fix !DEBUG_FS debugfs_create_automount
	CIFS: Properly process SMB3 lease breaks
	ASoC: max98090: remove msleep in PLL unlocked workaround
	kernel/sys.c: avoid copying possible padding bytes in copy_to_user
	KVM: arm/arm64: vgic: Fix potential double free dist->spis in __kvm_vgic_destroy()
	xfs: fix log reservation overflows when allocating large rt extents
	neigh_stat_seq_next() should increase position index
	rt_cpu_seq_next should increase position index
	ipv6_route_seq_next should increase position index
	seqlock: Require WRITE_ONCE surrounding raw_seqcount_barrier
	media: ti-vpe: cal: Restrict DMA to avoid memory corruption
	sctp: move trace_sctp_probe_path into sctp_outq_sack
	ACPI: EC: Reference count query handlers under lock
	scsi: ufs: Make ufshcd_add_command_trace() easier to read
	scsi: ufs: Fix a race condition in the tracing code
	dmaengine: zynqmp_dma: fix burst length configuration
	s390/cpum_sf: Use kzalloc and minor changes
	powerpc/eeh: Only dump stack once if an MMIO loop is detected
	Bluetooth: btrtl: Use kvmalloc for FW allocations
	tracing: Set kernel_stack's caller size properly
	ARM: 8948/1: Prevent OOB access in stacktrace
	ar5523: Add USB ID of SMCWUSBT-G2 wireless adapter
	ceph: ensure we have a new cap before continuing in fill_inode
	selftests/ftrace: fix glob selftest
	tools/power/x86/intel_pstate_tracer: changes for python 3 compatibility
	Bluetooth: Fix refcount use-after-free issue
	mm/swapfile.c: swap_next should increase position index
	mm: pagewalk: fix termination condition in walk_pte_range()
	Bluetooth: prefetch channel before killing sock
	KVM: fix overflow of zero page refcount with ksm running
	ALSA: hda: Clear RIRB status before reading WP
	skbuff: fix a data race in skb_queue_len()
	audit: CONFIG_CHANGE don't log internal bookkeeping as an event
	selinux: sel_avc_get_stat_idx should increase position index
	scsi: lpfc: Fix RQ buffer leakage when no IOCBs available
	scsi: lpfc: Fix coverity errors in fmdi attribute handling
	drm/omap: fix possible object reference leak
	clk: stratix10: use do_div() for 64-bit calculation
	crypto: chelsio - This fixes the kernel panic which occurs during a libkcapi test
	mt76: clear skb pointers from rx aggregation reorder buffer during cleanup
	ALSA: usb-audio: Don't create a mixer element with bogus volume range
	perf test: Fix test trace+probe_vfs_getname.sh on s390
	RDMA/rxe: Fix configuration of atomic queue pair attributes
	KVM: x86: fix incorrect comparison in trace event
	dmaengine: stm32-mdma: use vchan_terminate_vdesc() in .terminate_all
	media: staging/imx: Missing assignment in imx_media_capture_device_register()
	x86/pkeys: Add check for pkey "overflow"
	bpf: Remove recursion prevention from rcu free callback
	dmaengine: stm32-dma: use vchan_terminate_vdesc() in .terminate_all
	dmaengine: tegra-apb: Prevent race conditions on channel's freeing
	drm/amd/display: dal_ddc_i2c_payloads_create can fail causing panic
	firmware: arm_sdei: Use cpus_read_lock() to avoid races with cpuhp
	random: fix data races at timer_rand_state
	bus: hisi_lpc: Fixup IO ports addresses to avoid use-after-free in host removal
	media: go7007: Fix URB type for interrupt handling
	Bluetooth: guard against controllers sending zero'd events
	timekeeping: Prevent 32bit truncation in scale64_check_overflow()
	ext4: fix a data race at inode->i_disksize
	perf jevents: Fix leak of mapfile memory
	mm: avoid data corruption on CoW fault into PFN-mapped VMA
	drm/amdgpu: increase atombios cmd timeout
	drm/amd/display: Stop if retimer is not available
	ath10k: use kzalloc to read for ath10k_sdio_hif_diag_read
	scsi: aacraid: Disabling TM path and only processing IOP reset
	Bluetooth: L2CAP: handle l2cap config request during open state
	media: tda10071: fix unsigned sign extension overflow
	xfs: don't ever return a stale pointer from __xfs_dir3_free_read
	xfs: mark dir corrupt when lookup-by-hash fails
	ext4: mark block bitmap corrupted when found instead of BUGON
	tpm: ibmvtpm: Wait for buffer to be set before proceeding
	rtc: sa1100: fix possible race condition
	rtc: ds1374: fix possible race condition
	nfsd: Don't add locks to closed or closing open stateids
	RDMA/cm: Remove a race freeing timewait_info
	KVM: PPC: Book3S HV: Treat TM-related invalid form instructions on P9 like the valid ones
	drm/msm: fix leaks if initialization fails
	drm/msm/a5xx: Always set an OPP supported hardware value
	tracing: Use address-of operator on section symbols
	thermal: rcar_thermal: Handle probe error gracefully
	perf parse-events: Fix 3 use after frees found with clang ASAN
	serial: 8250_port: Don't service RX FIFO if throttled
	serial: 8250_omap: Fix sleeping function called from invalid context during probe
	serial: 8250: 8250_omap: Terminate DMA before pushing data on RX timeout
	perf cpumap: Fix snprintf overflow check
	cpufreq: powernv: Fix frame-size-overflow in powernv_cpufreq_work_fn
	tools: gpio-hammer: Avoid potential overflow in main
	nvme-multipath: do not reset on unknown status
	nvme: Fix controller creation races with teardown flow
	RDMA/rxe: Set sys_image_guid to be aligned with HW IB devices
	scsi: hpsa: correct race condition in offload enabled
	SUNRPC: Fix a potential buffer overflow in 'svc_print_xprts()'
	svcrdma: Fix leak of transport addresses
	PCI: Use ioremap(), not phys_to_virt() for platform ROM
	ubifs: Fix out-of-bounds memory access caused by abnormal value of node_len
	ALSA: usb-audio: Fix case when USB MIDI interface has more than one extra endpoint descriptor
	PCI: pciehp: Fix MSI interrupt race
	NFS: Fix races nfs_page_group_destroy() vs nfs_destroy_unlinked_subrequests()
	mm/kmemleak.c: use address-of operator on section symbols
	mm/filemap.c: clear page error before actual read
	mm/vmscan.c: fix data races using kswapd_classzone_idx
	nvmet-rdma: fix double free of rdma queue
	mm/mmap.c: initialize align_offset explicitly for vm_unmapped_area
	scsi: qedi: Fix termination timeouts in session logout
	serial: uartps: Wait for tx_empty in console setup
	KVM: Remove CREATE_IRQCHIP/SET_PIT2 race
	bdev: Reduce time holding bd_mutex in sync in blkdev_close()
	drivers: char: tlclk.c: Avoid data race between init and interrupt handler
	KVM: arm64: vgic-its: Fix memory leak on the error path of vgic_add_lpi()
	net: openvswitch: use u64 for meter bucket
	scsi: aacraid: Fix error handling paths in aac_probe_one()
	staging:r8188eu: avoid skb_clone for amsdu to msdu conversion
	sparc64: vcc: Fix error return code in vcc_probe()
	arm64: cpufeature: Relax checks for AArch32 support at EL[0-2]
	dt-bindings: sound: wm8994: Correct required supplies based on actual implementaion
	atm: fix a memory leak of vcc->user_back
	perf mem2node: Avoid double free related to realloc
	power: supply: max17040: Correct voltage reading
	phy: samsung: s5pv210-usb2: Add delay after reset
	Bluetooth: Handle Inquiry Cancel error after Inquiry Complete
	USB: EHCI: ehci-mv: fix error handling in mv_ehci_probe()
	tipc: fix memory leak in service subscripting
	tty: serial: samsung: Correct clock selection logic
	ALSA: hda: Fix potential race in unsol event handler
	powerpc/traps: Make unrecoverable NMIs die instead of panic
	fuse: don't check refcount after stealing page
	USB: EHCI: ehci-mv: fix less than zero comparison of an unsigned int
	scsi: cxlflash: Fix error return code in cxlflash_probe()
	arm64/cpufeature: Drop TraceFilt feature exposure from ID_DFR0 register
	e1000: Do not perform reset in reset_task if we are already down
	drm/nouveau/debugfs: fix runtime pm imbalance on error
	drm/nouveau: fix runtime pm imbalance on error
	drm/nouveau/dispnv50: fix runtime pm imbalance on error
	printk: handle blank console arguments passed in.
	usb: dwc3: Increase timeout for CmdAct cleared by device controller
	btrfs: don't force read-only after error in drop snapshot
	vfio/pci: fix memory leaks of eventfd ctx
	perf evsel: Fix 2 memory leaks
	perf trace: Fix the selection for architectures to generate the errno name tables
	perf stat: Fix duration_time value for higher intervals
	perf util: Fix memory leak of prefix_if_not_in
	perf metricgroup: Free metric_events on error
	perf kcore_copy: Fix module map when there are no modules loaded
	ASoC: img-i2s-out: Fix runtime PM imbalance on error
	wlcore: fix runtime pm imbalance in wl1271_tx_work
	wlcore: fix runtime pm imbalance in wlcore_regdomain_config
	mtd: rawnand: omap_elm: Fix runtime PM imbalance on error
	PCI: tegra: Fix runtime PM imbalance on error
	ceph: fix potential race in ceph_check_caps
	mm/swap_state: fix a data race in swapin_nr_pages
	rapidio: avoid data race between file operation callbacks and mport_cdev_add().
	mtd: parser: cmdline: Support MTD names containing one or more colons
	x86/speculation/mds: Mark mds_user_clear_cpu_buffers() __always_inline
	vfio/pci: Clear error and request eventfd ctx after releasing
	cifs: Fix double add page to memcg when cifs_readpages
	nvme: fix possible deadlock when I/O is blocked
	scsi: libfc: Handling of extra kref
	scsi: libfc: Skip additional kref updating work event
	selftests/x86/syscall_nt: Clear weird flags after each test
	vfio/pci: fix racy on error and request eventfd ctx
	btrfs: qgroup: fix data leak caused by race between writeback and truncate
	ubi: fastmap: Free unused fastmap anchor peb during detach
	perf parse-events: Use strcmp() to compare the PMU name
	net: openvswitch: use div_u64() for 64-by-32 divisions
	nvme: explicitly update mpath disk capacity on revalidation
	ASoC: wm8994: Skip setting of the WM8994_MICBIAS register for WM1811
	ASoC: wm8994: Ensure the device is resumed in wm89xx_mic_detect functions
	ASoC: Intel: bytcr_rt5640: Add quirk for MPMAN Converter9 2-in-1
	RISC-V: Take text_mutex in ftrace_init_nop()
	s390/init: add missing __init annotations
	lockdep: fix order in trace_hardirqs_off_caller()
	drm/amdkfd: fix a memory leak issue
	i2c: core: Call i2c_acpi_install_space_handler() before i2c_acpi_register_devices()
	objtool: Fix noreturn detection for ignored functions
	ieee802154: fix one possible memleak in ca8210_dev_com_init
	ieee802154/adf7242: check status of adf7242_read_reg
	clocksource/drivers/h8300_timer8: Fix wrong return value in h8300_8timer_init()
	mwifiex: Increase AES key storage size to 256 bits
	batman-adv: bla: fix type misuse for backbone_gw hash indexing
	atm: eni: fix the missed pci_disable_device() for eni_init_one()
	batman-adv: mcast/TT: fix wrongly dropped or rerouted packets
	mac802154: tx: fix use-after-free
	bpf: Fix clobbering of r2 in bpf_gen_ld_abs
	drm/vc4/vc4_hdmi: fill ASoC card owner
	net: qed: RDMA personality shouldn't fail VF load
	drm/sun4i: sun8i-csc: Secondary CSC register correction
	batman-adv: Add missing include for in_interrupt()
	batman-adv: mcast: fix duplicate mcast packets in BLA backbone from mesh
	batman-adv: mcast: fix duplicate mcast packets from BLA backbone to mesh
	bpf: Fix a rcu warning for bpffs map pretty-print
	ALSA: asihpi: fix iounmap in error handler
	regmap: fix page selection for noinc reads
	MIPS: Add the missing 'CPU_1074K' into __get_cpu_type()
	KVM: x86: Reset MMU context if guest toggles CR4.SMAP or CR4.PKE
	KVM: SVM: Add a dedicated INVD intercept routine
	tracing: fix double free
	s390/dasd: Fix zero write for FBA devices
	kprobes: Fix to check probe enabled before disarm_kprobe_ftrace()
	mm, THP, swap: fix allocating cluster for swapfile by mistake
	s390/zcrypt: Fix ZCRYPT_PERDEV_REQCNT ioctl
	kprobes: Fix compiler warning for !CONFIG_KPROBES_ON_FTRACE
	ata: define AC_ERR_OK
	ata: make qc_prep return ata_completion_errors
	ata: sata_mv, avoid trigerrable BUG_ON
	KVM: arm64: Assume write fault on S1PTW permission fault on instruction fetch
	Linux 4.19.149

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Idfc1b35ec63b4b464aeb6e32709102bee0efc872
2020-10-01 16:49:05 +02:00
Eric Dumazet
08f4fc4c85 net: silence data-races on sk_backlog.tail
[ Upstream commit 9ed498c628 ]

sk->sk_backlog.tail might be read without holding the socket spinlock,
we need to add proper READ_ONCE()/WRITE_ONCE() to silence the warnings.

KCSAN reported :

BUG: KCSAN: data-race in tcp_add_backlog / tcp_recvmsg

write to 0xffff8881265109f8 of 8 bytes by interrupt on cpu 1:
 __sk_add_backlog include/net/sock.h:907 [inline]
 sk_add_backlog include/net/sock.h:938 [inline]
 tcp_add_backlog+0x476/0xce0 net/ipv4/tcp_ipv4.c:1759
 tcp_v4_rcv+0x1a70/0x1bd0 net/ipv4/tcp_ipv4.c:1947
 ip_protocol_deliver_rcu+0x4d/0x420 net/ipv4/ip_input.c:204
 ip_local_deliver_finish+0x110/0x140 net/ipv4/ip_input.c:231
 NF_HOOK include/linux/netfilter.h:305 [inline]
 NF_HOOK include/linux/netfilter.h:299 [inline]
 ip_local_deliver+0x133/0x210 net/ipv4/ip_input.c:252
 dst_input include/net/dst.h:442 [inline]
 ip_rcv_finish+0x121/0x160 net/ipv4/ip_input.c:413
 NF_HOOK include/linux/netfilter.h:305 [inline]
 NF_HOOK include/linux/netfilter.h:299 [inline]
 ip_rcv+0x18f/0x1a0 net/ipv4/ip_input.c:523
 __netif_receive_skb_one_core+0xa7/0xe0 net/core/dev.c:4929
 __netif_receive_skb+0x37/0xf0 net/core/dev.c:5043
 netif_receive_skb_internal+0x59/0x190 net/core/dev.c:5133
 napi_skb_finish net/core/dev.c:5596 [inline]
 napi_gro_receive+0x28f/0x330 net/core/dev.c:5629
 receive_buf+0x284/0x30b0 drivers/net/virtio_net.c:1061
 virtnet_receive drivers/net/virtio_net.c:1323 [inline]
 virtnet_poll+0x436/0x7d0 drivers/net/virtio_net.c:1428
 napi_poll net/core/dev.c:6311 [inline]
 net_rx_action+0x3ae/0xa90 net/core/dev.c:6379
 __do_softirq+0x115/0x33f kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0xbb/0xe0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:536 [inline]
 do_IRQ+0xa6/0x180 arch/x86/kernel/irq.c:263
 ret_from_intr+0x0/0x19
 native_safe_halt+0xe/0x10 arch/x86/kernel/paravirt.c:71
 arch_cpu_idle+0x1f/0x30 arch/x86/kernel/process.c:571
 default_idle_call+0x1e/0x40 kernel/sched/idle.c:94
 cpuidle_idle_call kernel/sched/idle.c:154 [inline]
 do_idle+0x1af/0x280 kernel/sched/idle.c:263
 cpu_startup_entry+0x1b/0x20 kernel/sched/idle.c:355
 start_secondary+0x208/0x260 arch/x86/kernel/smpboot.c:264
 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:241

read to 0xffff8881265109f8 of 8 bytes by task 8057 on cpu 0:
 tcp_recvmsg+0x46e/0x1b40 net/ipv4/tcp.c:2050
 inet_recvmsg+0xbb/0x250 net/ipv4/af_inet.c:838
 sock_recvmsg_nosec net/socket.c:871 [inline]
 sock_recvmsg net/socket.c:889 [inline]
 sock_recvmsg+0x92/0xb0 net/socket.c:885
 sock_read_iter+0x15f/0x1e0 net/socket.c:967
 call_read_iter include/linux/fs.h:1889 [inline]
 new_sync_read+0x389/0x4f0 fs/read_write.c:414
 __vfs_read+0xb1/0xc0 fs/read_write.c:427
 vfs_read fs/read_write.c:461 [inline]
 vfs_read+0x143/0x2c0 fs/read_write.c:446
 ksys_read+0xd5/0x1b0 fs/read_write.c:587
 __do_sys_read fs/read_write.c:597 [inline]
 __se_sys_read fs/read_write.c:595 [inline]
 __x64_sys_read+0x4c/0x60 fs/read_write.c:595
 do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 8057 Comm: syz-fuzzer Not tainted 5.4.0-rc6+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-10-01 13:14:26 +02:00
Greg Kroah-Hartman
5d5e582aab This is the 4.19.148 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl9vZgoACgkQONu9yGCS
 aT6CSBAAqsWMXD4MWA35hVDaFmbMOQkZzdDPTIYzRSDIDMqkbtL+4XAPzqfP7yJH
 CvQwqSi5XxqBFnlZwIMvY9cbhEumYUyWbFT0rK07ZJApT2uDBcfdZiFxDP/I0vQk
 Fj5uuFFORs39Kv2CUYWHgkyS0KcrSul5kwfxWblJADZNq5eJp6vnOBHMc59uRP14
 SaWWXac9ltGecIn2yKkVz28lW0iI8gSnIf5Bj1/kWC8vcRcaWP2biwflwz6PjFi6
 dfKWYN4t7wNK/cM0RigRp7suuIcpvcNv5yu+al2Ul0vi4zn5Po8Kt8Bancn/iWR5
 5aCtvhT6OyuQfD67HxSMLZLcEH9X/C7pv+0sEIYlOb1j1IiEec4XrEs8ivlFpl0/
 weG+fEM6gyd4+IxTBkLAHQah8s4kSM9fWmyrLFqMyw3O1ImvImjrQmWMnZdDWBtO
 BGe5IuCMaFbCzbTGZRNZ7PG8EF3ayGYl16rE2FsHawDACp97p6Tih5Y6suwp9vYM
 Ph4IhNWNYTs1DcgOhqKLTnhbbF1IeJ8kJiVU3nOA7xyLwzdAxwHWk8NEN2yxhz5D
 aM8YS75gAqRp6km9OPKWG+M9THgT4RtI1O/fAA26CRMc505LRi+w4qPtEMJUPocU
 v6oJwB3T5BJdkdHPGcJi84hjqea2VGzG5x/cTI2a985DaoNtvc8=
 =uvGG
 -----END PGP SIGNATURE-----

Merge 4.19.148 into android-4.19-stable

Changes in 4.19.148
	af_key: pfkey_dump needs parameter validation
	KVM: fix memory leak in kvm_io_bus_unregister_dev()
	kprobes: fix kill kprobe which has been marked as gone
	mm/thp: fix __split_huge_pmd_locked() for migration PMD
	cxgb4: Fix offset when clearing filter byte counters
	geneve: add transport ports in route lookup for geneve
	hdlc_ppp: add range checks in ppp_cp_parse_cr()
	ip: fix tos reflection in ack and reset packets
	ipv6: avoid lockdep issue in fib6_del()
	net: DCB: Validate DCB_ATTR_DCB_BUFFER argument
	net: dsa: rtl8366: Properly clear member config
	net: ipv6: fix kconfig dependency warning for IPV6_SEG6_HMAC
	net: sch_generic: aviod concurrent reset and enqueue op for lockless qdisc
	nfp: use correct define to return NONE fec
	tipc: Fix memory leak in tipc_group_create_member()
	tipc: fix shutdown() of connection oriented socket
	tipc: use skb_unshare() instead in tipc_buf_append()
	bnxt_en: return proper error codes in bnxt_show_temp
	bnxt_en: Protect bnxt_set_eee() and bnxt_set_pauseparam() with mutex.
	net: phy: Avoid NPD upon phy_detach() when driver is unbound
	net: qrtr: check skb_put_padto() return value
	net: add __must_check to skb_put_padto()
	ipv4: Update exception handling for multipath routes via same device
	MAINTAINERS: add CLANG/LLVM BUILD SUPPORT info
	kbuild: add OBJSIZE variable for the size tool
	Documentation/llvm: add documentation on building w/ Clang/LLVM
	Documentation/llvm: fix the name of llvm-size
	net: wan: wanxl: use allow to pass CROSS_COMPILE_M68k for rebuilding firmware
	net: wan: wanxl: use $(M68KCC) instead of $(M68KAS) for rebuilding firmware
	x86/boot: kbuild: allow readelf executable to be specified
	kbuild: remove AS variable
	kbuild: replace AS=clang with LLVM_IAS=1
	kbuild: support LLVM=1 to switch the default tools to Clang/LLVM
	mm: memcg: fix memcg reclaim soft lockup
	tcp_bbr: refactor bbr_target_cwnd() for general inflight provisioning
	tcp_bbr: adapt cwnd based on ack aggregation estimation
	serial: 8250: Avoid error message on reprobe
	Linux 4.19.148

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I5077093f58ae882547e3b23c5bbd4dfe78116071
2020-09-27 07:58:48 +02:00
Priyaranjan Jha
610058f519 tcp_bbr: adapt cwnd based on ack aggregation estimation
commit 78dc70ebaa upstream.

Aggregation effects are extremely common with wifi, cellular, and cable
modem link technologies, ACK decimation in middleboxes, and LRO and GRO
in receiving hosts. The aggregation can happen in either direction,
data or ACKs, but in either case the aggregation effect is visible
to the sender in the ACK stream.

Previously BBR's sending was often limited by cwnd under severe ACK
aggregation/decimation because BBR sized the cwnd at 2*BDP. If packets
were acked in bursts after long delays (e.g. one ACK acking 5*BDP after
5*RTT), BBR's sending was halted after sending 2*BDP over 2*RTT, leaving
the bottleneck idle for potentially long periods. Note that loss-based
congestion control does not have this issue because when facing
aggregation it continues increasing cwnd after bursts of ACKs, growing
cwnd until the buffer is full.

To achieve good throughput in the presence of aggregation effects, this
algorithm allows the BBR sender to put extra data in flight to keep the
bottleneck utilized during silences in the ACK stream that it has evidence
to suggest were caused by aggregation.

A summary of the algorithm: when a burst of packets are acked by a
stretched ACK or a burst of ACKs or both, BBR first estimates the expected
amount of data that should have been acked, based on its estimated
bandwidth. Then the surplus ("extra_acked") is recorded in a windowed-max
filter to estimate the recent level of observed ACK aggregation. Then cwnd
is increased by the ACK aggregation estimate. The larger cwnd avoids BBR
being cwnd-limited in the face of ACK silences that recent history suggests
were caused by aggregation. As a sanity check, the ACK aggregation degree
is upper-bounded by the cwnd (at the time of measurement) and a global max
of BW * 100ms. The algorithm is further described by the following
presentation:
https://datatracker.ietf.org/meeting/101/materials/slides-101-iccrg-an-update-on-bbr-work-at-google-00

In our internal testing, we observed a significant increase in BBR
throughput (measured using netperf), in a basic wifi setup.
- Host1 (sender on ethernet) -> AP -> Host2 (receiver on wifi)
- 2.4 GHz -> BBR before: ~73 Mbps; BBR after: ~102 Mbps; CUBIC: ~100 Mbps
- 5.0 GHz -> BBR before: ~362 Mbps; BBR after: ~593 Mbps; CUBIC: ~601 Mbps

Also, this code is running globally on YouTube TCP connections and produced
significant bandwidth increases for YouTube traffic.

This is based on Ian Swett's max_ack_height_ algorithm from the
QUIC BBR implementation.

Signed-off-by: Priyaranjan Jha <priyarjha@google.com>
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-26 18:01:32 +02:00
Greg Kroah-Hartman
009b982d9c This is the 4.19.144 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl9ZCzcACgkQONu9yGCS
 aT6VCw//aRDPlJMx+LHqasSImMs3lCHnMcHVxE09knu30mQNpJXv05piJ70/Ct/S
 ukE4e6NEv2L9wgE/Ti4q7Hk5ahTeMqE3fxewtsJcoTnswa6LwL7X0iPtdFs3aVSa
 u6nwlkkz5uXE4xFD1fE8WudizglSqFc6cSD+3AJvtI4DAM+it920EGvAX6yzk9Gi
 7wF5lsqX0xm6Jn2XZ+ZnI8f49cKE+7n8aKpkXFGyrPVqrVotXdJUcovz2eEXxO3E
 vo95Z1FksBqY7gMOCbrLiBXspMujaIduphKmWUIeNccAsexMVJjfJqO5GTZA/siW
 GxdauwbMWWAOcw9RAnjt5crmPU7gtUcaXr32ST42BmZtDWW0frj4hN6jcsvfW6KO
 uyWKIi6SidQJui/dcDyzTwhJlUzUhxY1bj/hWMwLmJznfNMqeS1wFF/5xewWShwG
 dxmhuZAsoI8CrpHG4kvJiZ2vvHvS7zNDdXWQyHE9GOh6xcAdhRc9nhkPd9ugubDf
 3wuHuSpQg7fbsq98QxTKM1irlsBXNXBpw/VbiYhhbfN5n9VCFj82KSJZf321/BVk
 PoETRPFnrYU3/85xDxvEbAX9EYCWHQaJWq49kZRBAQ9yMOUFYrcRmzfRtDvNdNzs
 dE+kGJhgu90wrJYkywOqBHsi/7jNIqjRG6/lDYxICaRI9NEbaa4=
 =aozR
 -----END PGP SIGNATURE-----

Merge 4.19.144 into android-4.19-stable

Changes in 4.19.144
	HID: core: Correctly handle ReportSize being zero
	HID: core: Sanitize event code and type when mapping input
	perf record/stat: Explicitly call out event modifiers in the documentation
	scsi: target: tcmu: Fix size in calls to tcmu_flush_dcache_range
	scsi: target: tcmu: Optimize use of flush_dcache_page
	tty: serial: qcom_geni_serial: Drop __init from qcom_geni_console_setup
	drm/msm: add shutdown support for display platform_driver
	hwmon: (applesmc) check status earlier.
	nvmet: Disable keep-alive timer when kato is cleared to 0h
	drm/msm/a6xx: fix gmu start on newer firmware
	ceph: don't allow setlease on cephfs
	cpuidle: Fixup IRQ state
	s390: don't trace preemption in percpu macros
	xen/xenbus: Fix granting of vmalloc'd memory
	dmaengine: of-dma: Fix of_dma_router_xlate's of_dma_xlate handling
	batman-adv: Avoid uninitialized chaddr when handling DHCP
	batman-adv: Fix own OGM check in aggregated OGMs
	batman-adv: bla: use netif_rx_ni when not in interrupt context
	dmaengine: at_hdmac: check return value of of_find_device_by_node() in at_dma_xlate()
	MIPS: mm: BMIPS5000 has inclusive physical caches
	MIPS: BMIPS: Also call bmips_cpu_setup() for secondary cores
	netfilter: nf_tables: add NFTA_SET_USERDATA if not null
	netfilter: nf_tables: incorrect enum nft_list_attributes definition
	netfilter: nf_tables: fix destination register zeroing
	net: hns: Fix memleak in hns_nic_dev_probe
	net: systemport: Fix memleak in bcm_sysport_probe
	ravb: Fixed to be able to unload modules
	net: arc_emac: Fix memleak in arc_mdio_probe
	dmaengine: pl330: Fix burst length if burst size is smaller than bus width
	gtp: add GTPA_LINK info to msg sent to userspace
	bnxt_en: Don't query FW when netif_running() is false.
	bnxt_en: Check for zero dir entries in NVRAM.
	bnxt_en: Fix PCI AER error recovery flow
	bnxt_en: fix HWRM error when querying VF temperature
	xfs: fix boundary test in xfs_attr_shortform_verify
	bnxt: don't enable NAPI until rings are ready
	selftests/bpf: Fix massive output from test_maps
	netfilter: nfnetlink: nfnetlink_unicast() reports EAGAIN instead of ENOBUFS
	nvmet-fc: Fix a missed _irqsave version of spin_lock in 'nvmet_fc_fod_op_done()'
	perf tools: Correct SNOOPX field offset
	net: ethernet: mlx4: Fix memory allocation in mlx4_buddy_init()
	fix regression in "epoll: Keep a reference on files added to the check list"
	net: gemini: Fix another missing clk_disable_unprepare() in probe
	xfs: fix xfs_bmap_validate_extent_raw when checking attr fork of rt files
	perf jevents: Fix suspicious code in fixregex()
	tg3: Fix soft lockup when tg3_reset_task() fails.
	x86, fakenuma: Fix invalid starting node ID
	iommu/vt-d: Serialize IOMMU GCMD register modifications
	thermal: ti-soc-thermal: Fix bogus thermal shutdowns for omap4430
	include/linux/log2.h: add missing () around n in roundup_pow_of_two()
	ext2: don't update mtime on COW faults
	xfs: don't update mtime on COW faults
	btrfs: drop path before adding new uuid tree entry
	vfio/type1: Support faulting PFNMAP vmas
	vfio-pci: Fault mmaps to enable vma tracking
	vfio-pci: Invalidate mmaps and block MMIO access on disabled memory
	btrfs: Remove redundant extent_buffer_get in get_old_root
	btrfs: Remove extraneous extent_buffer_get from tree_mod_log_rewind
	btrfs: set the lockdep class for log tree extent buffers
	uaccess: Add non-pagefault user-space read functions
	uaccess: Add non-pagefault user-space write function
	btrfs: fix potential deadlock in the search ioctl
	net: usb: qmi_wwan: add Telit 0x1050 composition
	usb: qmi_wwan: add D-Link DWM-222 A2 device ID
	ALSA: ca0106: fix error code handling
	ALSA: pcm: oss: Remove superfluous WARN_ON() for mulaw sanity check
	ALSA: hda/hdmi: always check pin power status in i915 pin fixup
	ALSA: firewire-digi00x: exclude Avid Adrenaline from detection
	ALSA: hda - Fix silent audio output and corrupted input on MSI X570-A PRO
	media: rc: do not access device via sysfs after rc_unregister_device()
	media: rc: uevent sysfs file races with rc_unregister_device()
	affs: fix basic permission bits to actually work
	block: allow for_each_bvec to support zero len bvec
	libata: implement ATA_HORKAGE_MAX_TRIM_128M and apply to Sandisks
	dm writecache: handle DAX to partitions on persistent memory correctly
	dm cache metadata: Avoid returning cmd->bm wild pointer on error
	dm thin metadata: Avoid returning cmd->bm wild pointer on error
	mm: slub: fix conversion of freelist_corrupted()
	KVM: arm64: Add kvm_extable for vaxorcism code
	KVM: arm64: Defer guest entry when an asynchronous exception is pending
	KVM: arm64: Survive synchronous exceptions caused by AT instructions
	KVM: arm64: Set HCR_EL2.PTW to prevent AT taking synchronous exception
	vfio/pci: Fix SR-IOV VF handling with MMIO blocking
	checkpatch: fix the usage of capture group ( ... )
	mm/hugetlb: fix a race between hugetlb sysctl handlers
	cfg80211: regulatory: reject invalid hints
	net: usb: Fix uninit-was-stored issue in asix_read_phy_addr()
	Linux 4.19.144

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I81d6b3f044fe0dd919d1ece16d131c2185c00bb3
2020-09-09 19:48:58 +02:00
Florian Westphal
86c4599155 netfilter: nf_tables: fix destination register zeroing
[ Upstream commit 1e105e6afa ]

Following bug was reported via irc:
nft list ruleset
   set knock_candidates_ipv4 {
      type ipv4_addr . inet_service
      size 65535
      elements = { 127.0.0.1 . 123,
                   127.0.0.1 . 123 }
      }
 ..
   udp dport 123 add @knock_candidates_ipv4 { ip saddr . 123 }
   udp dport 123 add @knock_candidates_ipv4 { ip saddr . udp dport }

It should not have been possible to add a duplicate set entry.

After some debugging it turned out that the problem is the immediate
value (123) in the second-to-last rule.

Concatenations use 32bit registers, i.e. the elements are 8 bytes each,
not 6 and it turns out the kernel inserted

inet firewall @knock_candidates_ipv4
        element 0100007f ffff7b00  : 0 [end]
        element 0100007f 00007b00  : 0 [end]

Note the non-zero upper bits of the first element.  It turns out that
nft_immediate doesn't zero the destination register, but this is needed
when the length isn't a multiple of 4.

Furthermore, the zeroing in nft_payload is broken.  We can't use
[len / 4] = 0 -- if len is a multiple of 4, index is off by one.

Skip zeroing in this case and use a conditional instead of (len -1) / 4.

Fixes: 49499c3e6e ("netfilter: nf_tables: switch registers to 32 bit addressing")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-09-09 19:04:25 +02:00
Greg Kroah-Hartman
369c9d2963 This is the 4.19.141 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl8/jnoACgkQONu9yGCS
 aT54fA//azItNUOsY1HujeNfINHWCqCLV7OHpdxa9MEeixSpP/ufsGcgyZBTslNw
 WOENkdUPGYxUQt9yyZjSY5CEneH6a007idCfUWIuHRZ9nxKbDZm312xDDcDkeZI7
 P4TGvIdpDq7Czk2c+OCSUnmp/+fCJdPCpCYJZp0kBDVbUsKeUwpBJ42Dca8f/2iM
 lWVlGR2KwMIV+NSVArpu8EUOpw7X4rPsGz72kEvVhCkcXa9GFxGbs65AVNG5NTzt
 9sHBlja7PZTqt844/6UBM5EgTR43uJT5z8sSV5N5s6j2d07m/T+2f73PyKqr6+jQ
 SXKpIp/J6Po7tCej5u4B9LO+ePpasuxbNAXmn1GLuiP7qzKRAriFxK2RfXXxqIuE
 aP9DB6P/wbr/MszFjIFFg9nrr9G/biriRNPWtnzD2hbUk1mfM8WNCCSIt90MZh0f
 CT85JiEBFlU5cZhgUJfqJcfZcckE8gbdUGOBvZ5NOq0hxqN2S6+/phespwkd4h/a
 A4QyhER6eI9zT/StBoSLejs8c/lHKHjqyMARNjXLPF+bkkR90L9WDgocB1KiV0jn
 YOY+j4tjXGnn/QAsuW/uhYVvzETtkQ5oSyeV5uTcgYvU3iw+QFo9H//y83yB5Q0o
 pdDRNmMTtdYwrwkzt73xsjKGlVXaA8kB5kRCuBwGb5kzr0G8baE=
 =Txdz
 -----END PGP SIGNATURE-----

Merge 4.19.141 into android-4.19-stable

Changes in 4.19.141
	smb3: warn on confusing error scenario with sec=krb5
	genirq/affinity: Make affinity setting if activated opt-in
	PCI: hotplug: ACPI: Fix context refcounting in acpiphp_grab_context()
	PCI: Mark AMD Navi10 GPU rev 0x00 ATS as broken
	PCI: Add device even if driver attach failed
	PCI: qcom: Define some PARF params needed for ipq8064 SoC
	PCI: qcom: Add support for tx term offset for rev 2.1.0
	PCI: Probe bridge window attributes once at enumeration-time
	btrfs: free anon block device right after subvolume deletion
	btrfs: don't allocate anonymous block device for user invisible roots
	btrfs: ref-verify: fix memory leak in add_block_entry
	btrfs: don't traverse into the seed devices in show_devname
	btrfs: open device without device_list_mutex
	btrfs: fix messages after changing compression level by remount
	btrfs: only search for left_info if there is no right_info in try_merge_free_space
	btrfs: fix memory leaks after failure to lookup checksums during inode logging
	btrfs: fix return value mixup in btrfs_get_extent
	dt-bindings: iio: io-channel-mux: Fix compatible string in example code
	iio: dac: ad5592r: fix unbalanced mutex unlocks in ad5592r_read_raw()
	xtensa: fix xtensa_pmu_setup prototype
	cifs: Fix leak when handling lease break for cached root fid
	powerpc: Allow 4224 bytes of stack expansion for the signal frame
	powerpc: Fix circular dependency between percpu.h and mmu.h
	media: vsp1: dl: Fix NULL pointer dereference on unbind
	net: ethernet: stmmac: Disable hardware multicast filter
	net: stmmac: dwmac1000: provide multicast filter fallback
	net/compat: Add missing sock updates for SCM_RIGHTS
	md/raid5: Fix Force reconstruct-write io stuck in degraded raid5
	bcache: allocate meta data pages as compound pages
	bcache: fix overflow in offset_to_stripe()
	mac80211: fix misplaced while instead of if
	driver core: Avoid binding drivers to dead devices
	MIPS: CPU#0 is not hotpluggable
	ext2: fix missing percpu_counter_inc
	ocfs2: change slot number type s16 to u16
	mm/page_counter.c: fix protection usage propagation
	ftrace: Setup correct FTRACE_FL_REGS flags for module
	kprobes: Fix NULL pointer dereference at kprobe_ftrace_handler
	tracing/hwlat: Honor the tracing_cpumask
	tracing: Use trace_sched_process_free() instead of exit() for pid tracing
	watchdog: f71808e_wdt: indicate WDIOF_CARDRESET support in watchdog_info.options
	watchdog: f71808e_wdt: remove use of wrong watchdog_info option
	watchdog: f71808e_wdt: clear watchdog timeout occurred flag
	pseries: Fix 64 bit logical memory block panic
	module: Correctly truncate sysfs sections output
	perf intel-pt: Fix FUP packet state
	remoteproc: qcom: q6v5: Update running state before requesting stop
	drm/imx: imx-ldb: Disable both channels for split mode in enc->disable()
	mfd: arizona: Ensure 32k clock is put on driver unbind and error
	RDMA/ipoib: Return void from ipoib_ib_dev_stop()
	RDMA/ipoib: Fix ABBA deadlock with ipoib_reap_ah()
	media: rockchip: rga: Introduce color fmt macros and refactor CSC mode logic
	media: rockchip: rga: Only set output CSC mode for RGB input
	USB: serial: ftdi_sio: make process-packet buffer unsigned
	USB: serial: ftdi_sio: clean up receive processing
	mmc: renesas_sdhi_internal_dmac: clean up the code for dma complete
	gpu: ipu-v3: image-convert: Combine rotate/no-rotate irq handlers
	dm rq: don't call blk_mq_queue_stopped() in dm_stop_queue()
	selftests/powerpc: ptrace-pkey: Rename variables to make it easier to follow code
	selftests/powerpc: ptrace-pkey: Update the test to mark an invalid pkey correctly
	selftests/powerpc: ptrace-pkey: Don't update expected UAMOR value
	iommu/omap: Check for failure of a call to omap_iommu_dump_ctx
	iommu/vt-d: Enforce PASID devTLB field mask
	i2c: rcar: slave: only send STOP event when we have been addressed
	clk: clk-atlas6: fix return value check in atlas6_clk_init()
	pwm: bcm-iproc: handle clk_get_rate() return
	tools build feature: Use CC and CXX from parent
	i2c: rcar: avoid race when unregistering slave
	openrisc: Fix oops caused when dumping stack
	scsi: lpfc: nvmet: Avoid hang / use-after-free again when destroying targetport
	watchdog: initialize device before misc_register
	Input: sentelic - fix error return when fsp_reg_write fails
	drm/vmwgfx: Use correct vmw_legacy_display_unit pointer
	drm/vmwgfx: Fix two list_for_each loop exit tests
	net: qcom/emac: add missed clk_disable_unprepare in error path of emac_clks_phase1_init
	nfs: Fix getxattr kernel panic and memory overflow
	fs/minix: set s_maxbytes correctly
	fs/minix: fix block limit check for V1 filesystems
	fs/minix: remove expected error message in block_to_path()
	fs/ufs: avoid potential u32 multiplication overflow
	test_kmod: avoid potential double free in trigger_config_run_type()
	mfd: dln2: Run event handler loop under spinlock
	ALSA: echoaudio: Fix potential Oops in snd_echo_resume()
	perf bench mem: Always memset source before memcpy
	tools build feature: Quote CC and CXX for their arguments
	sh: landisk: Add missing initialization of sh_io_port_base
	khugepaged: retract_page_tables() remember to test exit
	arm64: dts: marvell: espressobin: add ethernet alias
	drm: Added orientation quirk for ASUS tablet model T103HAF
	drm/amdgpu: Fix bug where DPM is not enabled after hibernate and resume
	Linux 4.19.141

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I0800f8e03919fd8f054c1bcda87efd70a6e5db6b
2020-08-21 13:01:46 +02:00
Kees Cook
f90339a4ec net/compat: Add missing sock updates for SCM_RIGHTS
commit d9539752d2 upstream.

Add missed sock updates to compat path via a new helper, which will be
used more in coming patches. (The net/core/scm.c code is left as-is here
to assist with -stable backports for the compat path.)

Cc: Christoph Hellwig <hch@lst.de>
Cc: Sargun Dhillon <sargun@sargun.me>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: stable@vger.kernel.org
Fixes: 48a87cc26c ("net: netprio: fd passed in SCM_RIGHTS datagram not set correctly")
Fixes: d84295067f ("net: net_cls: fd passed in SCM_RIGHTS datagram not set correctly")
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-08-21 11:05:32 +02:00
Greg Kroah-Hartman
7086849b9c This is the 4.19.140 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl88w3UACgkQONu9yGCS
 aT4fZQ/+NYyfbsgFARqld2HbOIDSYyua90k42Xj7nlHXa3UcbPCsNEWIWn2k5SXU
 kvzwXSUuI14AOyqBOp/swKkEZh7Dh5c6q8QBHA6YJnNaJBQQxv2tjMpA4TngMifG
 oUSnxgHKNHtiD/6D7ZZ36l8u83sXfE6qPiginJAECdC2bVjpdfT7EqK5bY2lFd1s
 yiz9RxEDXSlrVMXqew75XBEj+304RYhZcJEVPQrqFb/q2Q+rSYs1mAkCazFvAkX+
 6Yooyp0tYlfUlkF2ItDpWmuKDcbGtWDd/I9LVGwZ0J67uAN86ZhNGbqlI8bpig9o
 qNW0FXAN2TNjpBvKXwg1qavfs5xYQu2E0OrRpCUleL1yD/kWu2vfK4HqyIardsVq
 63ffUvMJnJaWPnIvB2gx5f5tRt3Ca7uqvoM4LlYR1fwNZwVaU1fyWNEfeID4MAkr
 jBhC8x3n40TF1ngdaZ/XETiAJbjiYve2uEVuvdCtnp1fFbQ892QD5A8MQYsOVFuh
 6aR4f6bsR23F/h+tOMJc89wZTRYsCrFxbjwjye+tsWPcBm2GR7hgvCxo1JFqHgrz
 elY15u+AWj4pjVhiQcsnXLL8pGKkZTvPrq+iwg12AE23gvE4ww1lpYbxO46GUWuw
 q6L8oaHYA6cZiEnIde6yTUpkm6zag0MK+HDutiFUrEAmJTmeWds=
 =9oFP
 -----END PGP SIGNATURE-----

Merge 4.19.140 into android-4.19-stable

Changes in 4.19.140
	tracepoint: Mark __tracepoint_string's __used
	HID: input: Fix devices that return multiple bytes in battery report
	cgroup: add missing skcd->no_refcnt check in cgroup_sk_clone()
	x86/mce/inject: Fix a wrong assignment of i_mce.status
	sched/fair: Fix NOHZ next idle balance
	sched: correct SD_flags returned by tl->sd_flags()
	arm64: dts: rockchip: fix rk3368-lion gmac reset gpio
	arm64: dts: rockchip: fix rk3399-puma vcc5v0-host gpio
	arm64: dts: rockchip: fix rk3399-puma gmac reset gpio
	EDAC: Fix reference count leaks
	arm64: dts: qcom: msm8916: Replace invalid bias-pull-none property
	crypto: ccree - fix resource leak on error path
	firmware: arm_scmi: Fix SCMI genpd domain probing
	arm64: dts: exynos: Fix silent hang after boot on Espresso
	clk: scmi: Fix min and max rate when registering clocks with discrete rates
	m68k: mac: Don't send IOP message until channel is idle
	m68k: mac: Fix IOP status/control register writes
	platform/x86: intel-hid: Fix return value check in check_acpi_dev()
	platform/x86: intel-vbtn: Fix return value check in check_acpi_dev()
	ARM: dts: gose: Fix ports node name for adv7180
	ARM: dts: gose: Fix ports node name for adv7612
	ARM: at91: pm: add missing put_device() call in at91_pm_sram_init()
	spi: lantiq: fix: Rx overflow error in full duplex mode
	ARM: socfpga: PM: add missing put_device() call in socfpga_setup_ocram_self_refresh()
	drm/tilcdc: fix leak & null ref in panel_connector_get_modes
	soc: qcom: rpmh-rsc: Set suppress_bind_attrs flag
	Bluetooth: add a mutex lock to avoid UAF in do_enale_set
	loop: be paranoid on exit and prevent new additions / removals
	fs/btrfs: Add cond_resched() for try_release_extent_mapping() stalls
	drm/amdgpu: avoid dereferencing a NULL pointer
	drm/radeon: Fix reference count leaks caused by pm_runtime_get_sync
	crypto: aesni - Fix build with LLVM_IAS=1
	video: fbdev: neofb: fix memory leak in neo_scan_monitor()
	md-cluster: fix wild pointer of unlock_all_bitmaps()
	arm64: dts: hisilicon: hikey: fixes to comply with adi, adv7533 DT binding
	drm/etnaviv: fix ref count leak via pm_runtime_get_sync
	drm/nouveau: fix multiple instances of reference count leaks
	usb: mtu3: clear dual mode of u3port when disable device
	drm/debugfs: fix plain echo to connector "force" attribute
	drm/radeon: disable AGP by default
	irqchip/irq-mtk-sysirq: Replace spinlock with raw_spinlock
	mm/mmap.c: Add cond_resched() for exit_mmap() CPU stalls
	brcmfmac: keep SDIO watchdog running when console_interval is non-zero
	brcmfmac: To fix Bss Info flag definition Bug
	brcmfmac: set state of hanger slot to FREE when flushing PSQ
	iwlegacy: Check the return value of pcie_capability_read_*()
	gpu: host1x: debug: Fix multiple channels emitting messages simultaneously
	usb: gadget: net2280: fix memory leak on probe error handling paths
	bdc: Fix bug causing crash after multiple disconnects
	usb: bdc: Halt controller on suspend
	dyndbg: fix a BUG_ON in ddebug_describe_flags
	bcache: fix super block seq numbers comparision in register_cache_set()
	ACPICA: Do not increment operation_region reference counts for field units
	drm/msm: ratelimit crtc event overflow error
	agp/intel: Fix a memory leak on module initialisation failure
	video: fbdev: sm712fb: fix an issue about iounmap for a wrong address
	console: newport_con: fix an issue about leak related system resources
	video: pxafb: Fix the function used to balance a 'dma_alloc_coherent()' call
	ath10k: Acquire tx_lock in tx error paths
	iio: improve IIO_CONCENTRATION channel type description
	drm/etnaviv: Fix error path on failure to enable bus clk
	drm/arm: fix unintentional integer overflow on left shift
	leds: lm355x: avoid enum conversion warning
	media: omap3isp: Add missed v4l2_ctrl_handler_free() for preview_init_entities()
	ASoC: Intel: bxt_rt298: add missing .owner field
	scsi: cumana_2: Fix different dev_id between request_irq() and free_irq()
	drm/mipi: use dcs write for mipi_dsi_dcs_set_tear_scanline
	cxl: Fix kobject memleak
	drm/radeon: fix array out-of-bounds read and write issues
	scsi: powertec: Fix different dev_id between request_irq() and free_irq()
	scsi: eesox: Fix different dev_id between request_irq() and free_irq()
	ipvs: allow connection reuse for unconfirmed conntrack
	media: firewire: Using uninitialized values in node_probe()
	media: exynos4-is: Add missed check for pinctrl_lookup_state()
	xfs: don't eat an EIO/ENOSPC writeback error when scrubbing data fork
	xfs: fix reflink quota reservation accounting error
	RDMA/rxe: Skip dgid check in loopback mode
	PCI: Fix pci_cfg_wait queue locking problem
	leds: core: Flush scheduled work for system suspend
	drm: panel: simple: Fix bpc for LG LB070WV8 panel
	phy: exynos5-usbdrd: Calibrating makes sense only for USB2.0 PHY
	drm/bridge: sil_sii8620: initialize return of sii8620_readb
	scsi: scsi_debug: Add check for sdebug_max_queue during module init
	mwifiex: Prevent memory corruption handling keys
	powerpc/vdso: Fix vdso cpu truncation
	RDMA/qedr: SRQ's bug fixes
	RDMA/rxe: Prevent access to wr->next ptr afrer wr is posted to send queue
	staging: rtl8192u: fix a dubious looking mask before a shift
	PCI/ASPM: Add missing newline in sysfs 'policy'
	powerpc/book3s64/pkeys: Use PVR check instead of cpu feature
	drm/imx: tve: fix regulator_disable error path
	USB: serial: iuu_phoenix: fix led-activity helpers
	usb: core: fix quirks_param_set() writing to a const pointer
	thermal: ti-soc-thermal: Fix reversed condition in ti_thermal_expose_sensor()
	coresight: tmc: Fix TMC mode read in tmc_read_unprepare_etb()
	MIPS: OCTEON: add missing put_device() call in dwc3_octeon_device_init()
	usb: dwc2: Fix error path in gadget registration
	scsi: mesh: Fix panic after host or bus reset
	net: dsa: mv88e6xxx: MV88E6097 does not support jumbo configuration
	PCI: cadence: Fix updating Vendor ID and Subsystem Vendor ID register
	RDMA/core: Fix return error value in _ib_modify_qp() to negative
	Smack: fix another vsscanf out of bounds
	Smack: prevent underflow in smk_set_cipso()
	power: supply: check if calc_soc succeeded in pm860x_init_battery
	Bluetooth: hci_h5: Set HCI_UART_RESET_ON_INIT to correct flags
	Bluetooth: hci_serdev: Only unregister device if it was registered
	net: dsa: rtl8366: Fix VLAN semantics
	net: dsa: rtl8366: Fix VLAN set-up
	powerpc/boot: Fix CONFIG_PPC_MPC52XX references
	selftests/powerpc: Fix CPU affinity for child process
	PCI: Release IVRS table in AMD ACS quirk
	selftests/powerpc: Fix online CPU selection
	ASoC: meson: axg-tdm-interface: fix link fmt setup
	s390/qeth: don't process empty bridge port events
	wl1251: fix always return 0 error
	tools, build: Propagate build failures from tools/build/Makefile.build
	net: ethernet: aquantia: Fix wrong return value
	liquidio: Fix wrong return value in cn23xx_get_pf_num()
	net: spider_net: Fix the size used in a 'dma_free_coherent()' call
	fsl/fman: use 32-bit unsigned integer
	fsl/fman: fix dereference null return value
	fsl/fman: fix unreachable code
	fsl/fman: check dereferencing null pointer
	fsl/fman: fix eth hash table allocation
	dlm: Fix kobject memleak
	ocfs2: fix unbalanced locking
	pinctrl-single: fix pcs_parse_pinconf() return value
	svcrdma: Fix page leak in svc_rdma_recv_read_chunk()
	x86/fsgsbase/64: Fix NULL deref in 86_fsgsbase_read_task
	crypto: aesni - add compatibility with IAS
	af_packet: TPACKET_V3: fix fill status rwlock imbalance
	drivers/net/wan/lapbether: Added needed_headroom and a skb->len check
	net/nfc/rawsock.c: add CAP_NET_RAW check.
	net: Set fput_needed iff FDPUT_FPUT is set
	net/tls: Fix kmap usage
	net: refactor bind_bucket fastreuse into helper
	net: initialize fastreuse on inet_inherit_port
	USB: serial: cp210x: re-enable auto-RTS on open
	USB: serial: cp210x: enable usb generic throttle/unthrottle
	ALSA: hda - fix the micmute led status for Lenovo ThinkCentre AIO
	ALSA: usb-audio: Creative USB X-Fi Pro SB1095 volume knob support
	ALSA: usb-audio: fix overeager device match for MacroSilicon MS2109
	ALSA: usb-audio: work around streaming quirk for MacroSilicon MS2109
	pstore: Fix linking when crypto API disabled
	crypto: hisilicon - don't sleep of CRYPTO_TFM_REQ_MAY_SLEEP was not specified
	crypto: qat - fix double free in qat_uclo_create_batch_init_list
	crypto: ccp - Fix use of merged scatterlists
	crypto: cpt - don't sleep of CRYPTO_TFM_REQ_MAY_SLEEP was not specified
	bitfield.h: don't compile-time validate _val in FIELD_FIT
	fs/minix: check return value of sb_getblk()
	fs/minix: don't allow getting deleted inodes
	fs/minix: reject too-large maximum file size
	ALSA: usb-audio: add quirk for Pioneer DDJ-RB
	9p: Fix memory leak in v9fs_mount
	drm/ttm/nouveau: don't call tt destroy callback on alloc failure.
	NFS: Don't move layouts to plh_return_segs list while in use
	NFS: Don't return layout segments that are in use
	cpufreq: dt: fix oops on armada37xx
	include/asm-generic/vmlinux.lds.h: align ro_after_init
	spi: spidev: Align buffers for DMA
	mtd: rawnand: qcom: avoid write to unavailable register
	parisc: Implement __smp_store_release and __smp_load_acquire barriers
	parisc: mask out enable and reserved bits from sba imask
	ARM: 8992/1: Fix unwind_frame for clang-built kernels
	irqdomain/treewide: Free firmware node after domain removal
	xen/balloon: fix accounting in alloc_xenballooned_pages error path
	xen/balloon: make the balloon wait interruptible
	xen/gntdev: Fix dmabuf import with non-zero sgt offset
	Linux 4.19.140

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I6b0d8dcf9ded022f62d9c62605388f1c1e9112d1
2020-08-19 08:43:22 +02:00
Tim Froidcoeur
42f4480a37 net: refactor bind_bucket fastreuse into helper
[ Upstream commit 62ffc589ab ]

Refactor the fastreuse update code in inet_csk_get_port into a small
helper function that can be called from other places.

Acked-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: Tim Froidcoeur <tim.froidcoeur@tessares.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-08-19 08:15:03 +02:00
Julian Anastasov
7106f94330 ipvs: allow connection reuse for unconfirmed conntrack
[ Upstream commit f0a5e4d7a5 ]

YangYuxi is reporting that connection reuse
is causing one-second delay when SYN hits
existing connection in TIME_WAIT state.
Such delay was added to give time to expire
both the IPVS connection and the corresponding
conntrack. This was considered a rare case
at that time but it is causing problem for
some environments such as Kubernetes.

As nf_conntrack_tcp_packet() can decide to
release the conntrack in TIME_WAIT state and
to replace it with a fresh NEW conntrack, we
can use this to allow rescheduling just by
tuning our check: if the conntrack is
confirmed we can not schedule it to different
real server and the one-second delay still
applies but if new conntrack was created,
we are free to select new real server without
any delays.

YangYuxi lists some of the problem reports:

- One second connection delay in masquerading mode:
https://marc.info/?t=151683118100004&r=1&w=2

- IPVS low throughput #70747
https://github.com/kubernetes/kubernetes/issues/70747

- Apache Bench can fill up ipvs service proxy in seconds #544
https://github.com/cloudnativelabs/kube-router/issues/544

- Additional 1s latency in `host -> service IP -> pod`
https://github.com/kubernetes/kubernetes/issues/90854

Fixes: f719e3754e ("ipvs: drop first packet to redirect conntrack")
Co-developed-by: YangYuxi <yx.atom1@gmail.com>
Signed-off-by: YangYuxi <yx.atom1@gmail.com>
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Reviewed-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-08-19 08:14:56 +02:00
Greg Kroah-Hartman
c519a68e3a This is the 4.19.139 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl8ynf8ACgkQONu9yGCS
 aT7/9hAAoTxKWdbp0peN5sGh6GqDix6M3H9Z5dexW/XIVk9Eg+pzBLOT0BWoM/qB
 xnTOxu5yu2pYkMIoYSQc1cTNXeFeHU5qKiltgLmUTFFEolNcEHzWvSOb/uSUcvGR
 x6r78cGm30qSyu7PCPcotzu/J95JUtzWraIB4sy1qVeU+rastRIcRDz7ZcUjFQ/b
 PhDUusGY+d7ZA6+7vgLlT9LTmIlr/vQQA2kGxCkXZiKRLbJMmwm/IsS0G7NQMKMn
 nnMg+qzrveaTDnuKYhsTSSTLn2WOQmYZmevYOZjrrwiBaksCW8ygaq9UGArUcsnq
 PLgZGfhhoERmDp0mXxV9kngTkkgZ4OIlXP4sZiVbKiKNTnqTrMxCFPLpBqS2t0Eo
 RPoGyjcIkKHGKq1KwnrX5esMyaZb76aYUhO3tFZrgDhIDa193SxH9Znyp7tr5Znz
 3b5oH53wIA4k1kBkpA9ibhIhPjYeCDughI/oWC0ExcQAbWkPhIYqbmgWfbfzKVxo
 Yq8VBlqfuZply1POmkgoge1oDD0A0LBk2mSLOl6wpzDN1umS0HtQLjWpbdEuugCq
 S7wF+zDKJAz+O76ufyqv81KO5vAH4QcVSOBCH/HVGvsPZKwWvnWFQJ3cfXSm5iiA
 Uj++z6jI4suc1Y4unjLHmr3EdXEUSSq7Kbi+mXj1GL1gi1qM8rE=
 =ZQmS
 -----END PGP SIGNATURE-----

Merge 4.19.139 into android-4.19-stable

Changes in 4.19.139
	USB: serial: qcserial: add EM7305 QDL product ID
	USB: iowarrior: fix up report size handling for some devices
	usb: xhci: define IDs for various ASMedia host controllers
	usb: xhci: Fix ASMedia ASM1142 DMA addressing
	Revert "ALSA: hda: call runtime_allow() for all hda controllers"
	ALSA: seq: oss: Serialize ioctls
	staging: android: ashmem: Fix lockdep warning for write operation
	Bluetooth: Fix slab-out-of-bounds read in hci_extended_inquiry_result_evt()
	Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_evt()
	Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_with_rssi_evt()
	omapfb: dss: Fix max fclk divider for omap36xx
	binder: Prevent context manager from incrementing ref 0
	vgacon: Fix for missing check in scrollback handling
	mtd: properly check all write ioctls for permissions
	leds: wm831x-status: fix use-after-free on unbind
	leds: da903x: fix use-after-free on unbind
	leds: lm3533: fix use-after-free on unbind
	leds: 88pm860x: fix use-after-free on unbind
	net/9p: validate fds in p9_fd_open
	drm/nouveau/fbcon: fix module unload when fbcon init has failed for some reason
	drm/nouveau/fbcon: zero-initialise the mode_cmd2 structure
	i2c: slave: improve sanity check when registering
	i2c: slave: add sanity check when unregistering
	usb: hso: check for return value in hso_serial_common_create()
	firmware: Fix a reference count leak.
	cfg80211: check vendor command doit pointer before use
	igb: reinit_locked() should be called with rtnl_lock
	atm: fix atm_dev refcnt leaks in atmtcp_remove_persistent
	tools lib traceevent: Fix memory leak in process_dynamic_array_len
	Drivers: hv: vmbus: Ignore CHANNELMSG_TL_CONNECT_RESULT(23)
	xattr: break delegations in {set,remove}xattr
	ipv4: Silence suspicious RCU usage warning
	ipv6: fix memory leaks on IPV6_ADDRFORM path
	net: ethernet: mtk_eth_soc: fix MTU warnings
	vxlan: Ensure FDB dump is performed under RCU
	net: lan78xx: replace bogus endpoint lookup
	hv_netvsc: do not use VF device if link is down
	net: gre: recompute gre csum for sctp over gre tunnels
	net: thunderx: use spin_lock_bh in nicvf_set_rx_mode_task()
	openvswitch: Prevent kernel-infoleak in ovs_ct_put_key()
	Revert "vxlan: fix tos value before xmit"
	selftests/net: relax cpu affinity requirement in msg_zerocopy test
	rxrpc: Fix race between recvmsg and sendmsg on immediate call failure
	i40e: add num_vectors checker in iwarp handler
	i40e: Wrong truncation from u16 to u8
	i40e: Fix of memory leak and integer truncation in i40e_virtchnl.c
	i40e: Memory leak in i40e_config_iwarp_qvlist
	Smack: fix use-after-free in smk_write_relabel_self()
	Linux 4.19.139

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: If64996b6bc365365c5f06165ed8c7648336731bf
2020-08-11 17:03:22 +02:00
Cong Wang
9c8652db5c ipv6: fix memory leaks on IPV6_ADDRFORM path
[ Upstream commit 8c0de6e96c ]

IPV6_ADDRFORM causes resource leaks when converting an IPv6 socket
to IPv4, particularly struct ipv6_ac_socklist. Similar to
struct ipv6_mc_socklist, we should just close it on this path.

This bug can be easily reproduced with the following C program:

  #include <stdio.h>
  #include <string.h>
  #include <sys/types.h>
  #include <sys/socket.h>
  #include <arpa/inet.h>

  int main()
  {
    int s, value;
    struct sockaddr_in6 addr;
    struct ipv6_mreq m6;

    s = socket(AF_INET6, SOCK_DGRAM, 0);
    addr.sin6_family = AF_INET6;
    addr.sin6_port = htons(5000);
    inet_pton(AF_INET6, "::ffff:192.168.122.194", &addr.sin6_addr);
    connect(s, (struct sockaddr *)&addr, sizeof(addr));

    inet_pton(AF_INET6, "fe80::AAAA", &m6.ipv6mr_multiaddr);
    m6.ipv6mr_interface = 5;
    setsockopt(s, SOL_IPV6, IPV6_JOIN_ANYCAST, &m6, sizeof(m6));

    value = AF_INET;
    setsockopt(s, SOL_IPV6, IPV6_ADDRFORM, &value, sizeof(value));

    close(s);
    return 0;
  }

Reported-by: ch3332xr@gmail.com
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-08-11 15:32:34 +02:00
Greg Kroah-Hartman
a5218b3636 This is the 4.19.137 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl8qaHIACgkQONu9yGCS
 aT62TxAAwZ04yMUrjhm9TpAYUGJXcZ77AL2fliW4Ep8VRE1umCoKhmp8kB6JV5TD
 U/hxqufydvFbuRJK0hmrPhRPCkQfsTD6xKITjq1JgvEz5abGbrPXi7VZtJPQaiUN
 LxcNLwYfe2j8cRMWOpPQ10V/HvFpvlyrGF5TYpCT/5h1Y48FdBFTywNzmbL/J55O
 v7LMDgg2KB5SMPVsVktThWR5nsATiWBmJWb+4d0+GNkRX0idhu+XIKkNVWW8GAQa
 zjaUP9E7ysNU+YBwgD6uaRu0sgIxxqi9eITqqk+46b4gy1S/n5iorIkddkMoaySN
 ttLOiZZal9TDs1CTXXCPrw/14b+go9irEpwtYXGMdkmtOV28022m6YF7IkYHpX4I
 IsEPfLRlulB0i8DddNguOhHKVkD6Kuf934+sYV447QyqlPSszaGGxh+EK+aOk4/4
 PdwvUJlS90ExND0ID4whMgl50MOf6YcQxZ2oykDyNeVqU8USwdo0c6tYatNvdiu9
 DRzV6AU9CwnA0rYpCSpXY89j1uWeJCgKvYH3rTBIqUPKWT3LMfshu8xJioxP+29R
 eooKvy3I5miPv47s9cQKw+5dae0kH/8boR2flLBkGV/VB5VvnBBswP6Z0CCwMcT0
 M5+z7oLnbJdPIJ58kAKDvg6Fu9S/8Y5KVwUiZp3KkNRl9L5lDQY=
 =bZTL
 -----END PGP SIGNATURE-----

Merge 4.19.137 into android-4.19-stable

Changes in 4.19.137
	crypto: ccp - Release all allocated memory if sha type is invalid
	media: rc: prevent memory leak in cx23888_ir_probe
	iio: imu: adis16400: fix memory leak
	drm/amdgpu: fix multiple memory leaks in acp_hw_init
	tracing: Have error path in predicate_parse() free its allocated memory
	ath9k_htc: release allocated buffer if timed out
	ath9k: release allocated buffer if timed out
	drm/amd/display: prevent memory leak
	btrfs: inode: Verify inode mode to avoid NULL pointer dereference
	sctp: implement memory accounting on tx path
	Btrfs: fix selftests failure due to uninitialized i_mode in test inodes
	PCI/ASPM: Disable ASPM on ASMedia ASM1083/1085 PCIe-to-PCI bridge
	9p/trans_fd: Fix concurrency del of req_list in p9_fd_cancelled/p9_read_work
	wireless: Use offsetof instead of custom macro.
	ARM: 8986/1: hw_breakpoint: Don't invoke overflow handler on uaccess watchpoints
	Revert "drm/amdgpu: Fix NULL dereference in dpm sysfs handlers"
	drm/amdgpu: Prevent kernel-infoleak in amdgpu_info_ioctl()
	drm: hold gem reference until object is no longer accessed
	rds: Prevent kernel-infoleak in rds_notify_queue_get()
	xfs: fix missed wakeup on l_flush_wait
	net/x25: Fix x25_neigh refcnt leak when x25 disconnect
	net/x25: Fix null-ptr-deref in x25_disconnect
	xfrm: Fix crash when the hold queue is used.
	selftests/net: rxtimestamp: fix clang issues for target arch PowerPC
	selftests/net: psock_fanout: fix clang issues for target arch PowerPC
	sh: Fix validation of system call number
	net/mlx5: Verify Hardware supports requested ptp function on a given pin
	net: lan78xx: add missing endpoint sanity check
	net: lan78xx: fix transfer-buffer memory leak
	mlx4: disable device on shutdown
	mlxsw: core: Increase scope of RCU read-side critical section
	mlxsw: core: Free EMAD transactions using kfree_rcu()
	ibmvnic: Fix IRQ mapping disposal in error path
	bpf: Fix map leak in HASH_OF_MAPS map
	mac80211: mesh: Free ie data when leaving mesh
	mac80211: mesh: Free pending skb when destroying a mpath
	arm64/alternatives: move length validation inside the subsection
	arm64: csum: Fix handling of bad packets
	Bluetooth: fix kernel oops in store_pending_adv_report
	net: gemini: Fix missing clk_disable_unprepare() in error path of gemini_ethernet_port_probe()
	net/mlx5e: fix bpf_prog reference count leaks in mlx5e_alloc_rq
	usb: hso: Fix debug compile warning on sparc32
	qed: Disable "MFW indication via attention" SPAM every 5 minutes
	nfc: s3fwrn5: add missing release on skb in s3fwrn5_recv_frame
	parisc: add support for cmpxchg on u8 pointers
	net: ethernet: ravb: exit if re-initialization fails in tx timeout
	Revert "i2c: cadence: Fix the hold bit setting"
	x86/unwind/orc: Fix ORC for newly forked tasks
	cxgb4: add missing release on skb in uld_send()
	xen-netfront: fix potential deadlock in xennet_remove()
	KVM: LAPIC: Prevent setting the tscdeadline timer if the lapic is hw disabled
	x86/i8259: Use printk_deferred() to prevent deadlock
	Linux 4.19.137

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ic57c1620f2febb595f4f764757b1792ffc866643
2020-08-05 12:07:48 +02:00
Steffen Klassert
8b2a6581c8 xfrm: Fix crash when the hold queue is used.
[ Upstream commit 101dde4207 ]

The commits "xfrm: Move dst->path into struct xfrm_dst"
and "net: Create and use new helper xfrm_dst_child()."
changed xfrm bundle handling under the assumption
that xdst->path and dst->child are not a NULL pointer
only if dst->xfrm is not a NULL pointer. That is true
with one exception. If the xfrm hold queue is used
to wait until a SA is installed by the key manager,
we create a dummy bundle without a valid dst->xfrm
pointer. The current xfrm bundle handling crashes
in that case. Fix this by extending the NULL check
of dst->xfrm with a test of the DST_XFRM_QUEUE flag.

Fixes: 0f6c480f23 ("xfrm: Move dst->path into struct xfrm_dst")
Fixes: b92cf4aab8 ("net: Create and use new helper xfrm_dst_child().")
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-08-05 10:06:02 +02:00
Greg Kroah-Hartman
e80ce97d57 Revert "genetlink: remove genl_bind"
This reverts commit 0845447d9c which is
commit 1e82a62fec upstream.

It breaks the API and isn't something we should really have to worry
about in android devices.

Cc: Sean Tranchetti <stranche@codeaurora.org>
Change-Id: I4ec83063705a9f0fe449ff46803f6594b69efd08
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Signed-off-by: Will McVicker <willmcvicker@google.com>
2020-07-23 10:12:18 -07:00
Greg Kroah-Hartman
b41585fc93 This is the 4.19.134 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl8X634ACgkQONu9yGCS
 aT5sNBAA0JUGRrRlbQMgMtjR7ua+OLi3e07A0QNzD9xHqCc6NEXPuk4yYF8Pcs3g
 1ARyEDXybdfUFciChoH0zfBxEbXuB/8+3M3ikE6XV3V/aySzHpfXU/zrepq4kB4G
 JOqtAxHaLF1tHzsdSZiT3Qj8k8QCcyN9kB08g67JKAe7vd03SKg7CAbBb0JLEUGF
 6s7AxohupSJLBWaaQsgYiYMzkH8WceyGMGYydNUNtHLTbHPaj1f5KaRBuHA0Ls57
 35ba0suCL3pTbOZ+dF7CqO3mfQgLAY3/vE0jZpoNn3s7BMgOwr3d3cEUhRxI9GPl
 fO4Ua7Q9NZ67blLwD/fhcua8CeQUXSxqH5YcgDNqQHnZLx7CJW6kEKbFMlqWNaxf
 yhJbmgZJl+BqTkrIaAbz5FCXO6zAnRehh9L54SzZEdBpp5Y5Ep5nuSkwyZra1KWd
 b0YK5Yy7dzkZLgPsUc4JrC0o1859IrbvC84fPOk4nuovtCfugnSoIXYjmGQHPFH1
 Y5qt/DazsVdzpZIrg2Nvr/LrKh0BOPBjj3SYiCPfZkQDWkKF6ABWSggBxFEqn690
 dbJL2A0j+mvuYxUJnkNt0NR3qzXZewHJSqFpCPkN2/TbMNmr9FvKeox9HUIo4qq4
 7fqMPs4JNGZHPU7CqxIPJ3s9fjluhkkUtOXZmpzCV/58xI5ZzN0=
 =3LQn
 -----END PGP SIGNATURE-----

Merge 4.19.134 into android-4.19-stable

Changes in 4.19.134
	perf: Make perf able to build with latest libbfd
	net: rmnet: fix lower interface leak
	genetlink: remove genl_bind
	ipv4: fill fl4_icmp_{type,code} in ping_v4_sendmsg
	l2tp: remove skb_dst_set() from l2tp_xmit_skb()
	llc: make sure applications use ARPHRD_ETHER
	net: Added pointer check for dst->ops->neigh_lookup in dst_neigh_lookup_skb
	net_sched: fix a memory leak in atm_tc_init()
	net: usb: qmi_wwan: add support for Quectel EG95 LTE modem
	tcp: fix SO_RCVLOWAT possible hangs under high mem pressure
	tcp: make sure listeners don't initialize congestion-control state
	tcp: md5: add missing memory barriers in tcp_md5_do_add()/tcp_md5_hash_key()
	tcp: md5: do not send silly options in SYNCOOKIES
	tcp: md5: refine tcp_md5_do_add()/tcp_md5_hash_key() barriers
	tcp: md5: allow changing MD5 keys in all socket states
	cgroup: fix cgroup_sk_alloc() for sk_clone_lock()
	cgroup: Fix sock_cgroup_data on big-endian.
	sched: consistently handle layer3 header accesses in the presence of VLANs
	vlan: consolidate VLAN parsing code and limit max parsing depth
	drm/msm: fix potential memleak in error branch
	drm/exynos: fix ref count leak in mic_pre_enable
	m68k: nommu: register start of the memory with memblock
	m68k: mm: fix node memblock init
	arm64/alternatives: use subsections for replacement sequences
	tpm_tis: extra chip->ops check on error path in tpm_tis_core_init
	gfs2: read-only mounts should grab the sd_freeze_gl glock
	i2c: eg20t: Load module automatically if ID matches
	arm64/alternatives: don't patch up internal branches
	iio:magnetometer:ak8974: Fix alignment and data leak issues
	iio:humidity:hdc100x Fix alignment and data leak issues
	iio: magnetometer: ak8974: Fix runtime PM imbalance on error
	iio: mma8452: Add missed iio_device_unregister() call in mma8452_probe()
	iio: pressure: zpa2326: handle pm_runtime_get_sync failure
	iio:humidity:hts221 Fix alignment and data leak issues
	iio:pressure:ms5611 Fix buffer element alignment
	iio:health:afe4403 Fix timestamp alignment and prevent data leak.
	spi: fix initial SPI_SR value in spi-fsl-dspi
	spi: spi-fsl-dspi: Fix lockup if device is shutdown during SPI transfer
	net: dsa: bcm_sf2: Fix node reference count
	of: of_mdio: Correct loop scanning logic
	Revert "usb/ohci-platform: Fix a warning when hibernating"
	Revert "usb/xhci-plat: Set PM runtime as active on resume"
	Revert "usb/ehci-platform: Set PM runtime as active on resume"
	net: sfp: add support for module quirks
	net: sfp: add some quirks for GPON modules
	HID: quirks: Remove ITE 8595 entry from hid_have_special_driver
	ARM: at91: pm: add quirk for sam9x60's ulp1
	scsi: sr: remove references to BLK_DEV_SR_VENDOR, leave it enabled
	ALSA: usb-audio: Create a registration quirk for Kingston HyperX Amp (0951:16d8)
	doc: dt: bindings: usb: dwc3: Update entries for disabling SS instances in park mode
	mmc: sdhci: do not enable card detect interrupt for gpio cd type
	ALSA: usb-audio: Rewrite registration quirk handling
	ACPI: video: Use native backlight on Acer Aspire 5783z
	ALSA: usb-audio: Add registration quirk for Kingston HyperX Cloud Alpha S
	Input: mms114 - add extra compatible for mms345l
	ACPI: video: Use native backlight on Acer TravelMate 5735Z
	ALSA: usb-audio: Add registration quirk for Kingston HyperX Cloud Flight S
	iio:health:afe4404 Fix timestamp alignment and prevent data leak.
	phy: sun4i-usb: fix dereference of pointer phy0 before it is null checked
	arm64: dts: meson: add missing gxl rng clock
	spi: spi-sun6i: sun6i_spi_transfer_one(): fix setting of clock rate
	usb: gadget: udc: atmel: fix uninitialized read in debug printk
	staging: comedi: verify array index is correct before using it
	Revert "thermal: mediatek: fix register index error"
	ARM: dts: socfpga: Align L2 cache-controller nodename with dtschema
	regmap: debugfs: Don't sleep while atomic for fast_io regmaps
	copy_xstate_to_kernel: Fix typo which caused GDB regression
	apparmor: ensure that dfa state tables have entries
	perf stat: Zero all the 'ena' and 'run' array slot stats for interval mode
	soc: qcom: rpmh: Update dirty flag only when data changes
	soc: qcom: rpmh: Invalidate SLEEP and WAKE TCSes before flushing new data
	soc: qcom: rpmh-rsc: Clear active mode configuration for wake TCS
	soc: qcom: rpmh-rsc: Allow using free WAKE TCS for active request
	mtd: rawnand: marvell: Use nand_cleanup() when the device is not yet registered
	mtd: rawnand: marvell: Fix probe error path
	mtd: rawnand: timings: Fix default tR_max and tCCS_min timings
	mtd: rawnand: brcmnand: fix CS0 layout
	mtd: rawnand: oxnas: Keep track of registered devices
	mtd: rawnand: oxnas: Unregister all devices on error
	mtd: rawnand: oxnas: Release all devices in the _remove() path
	slimbus: core: Fix mismatch in of_node_get/put
	HID: magicmouse: do not set up autorepeat
	HID: quirks: Always poll Obins Anne Pro 2 keyboard
	HID: quirks: Ignore Simply Automated UPB PIM
	ALSA: line6: Perform sanity check for each URB creation
	ALSA: line6: Sync the pending work cancel at disconnection
	ALSA: usb-audio: Fix race against the error recovery URB submission
	ALSA: hda/realtek - change to suitable link model for ASUS platform
	ALSA: hda/realtek - Enable Speaker for ASUS UX533 and UX534
	USB: c67x00: fix use after free in c67x00_giveback_urb
	usb: dwc2: Fix shutdown callback in platform
	usb: chipidea: core: add wakeup support for extcon
	usb: gadget: function: fix missing spinlock in f_uac1_legacy
	USB: serial: iuu_phoenix: fix memory corruption
	USB: serial: cypress_m8: enable Simply Automated UPB PIM
	USB: serial: ch341: add new Product ID for CH340
	USB: serial: option: add GosunCn GM500 series
	USB: serial: option: add Quectel EG95 LTE modem
	virt: vbox: Fix VBGL_IOCTL_VMMDEV_REQUEST_BIG and _LOG req numbers to match upstream
	virt: vbox: Fix guest capabilities mask check
	virtio: virtio_console: add missing MODULE_DEVICE_TABLE() for rproc serial
	serial: mxs-auart: add missed iounmap() in probe failure and remove
	ovl: inode reference leak in ovl_is_inuse true case.
	ovl: relax WARN_ON() when decoding lower directory file handle
	ovl: fix unneeded call to ovl_change_flags()
	fuse: Fix parameter for FS_IOC_{GET,SET}FLAGS
	Revert "zram: convert remaining CLASS_ATTR() to CLASS_ATTR_RO()"
	mei: bus: don't clean driver pointer
	Input: i8042 - add Lenovo XiaoXin Air 12 to i8042 nomux list
	uio_pdrv_genirq: fix use without device tree and no interrupt
	timer: Prevent base->clk from moving backward
	timer: Fix wheel index calculation on last level
	MIPS: Fix build for LTS kernel caused by backporting lpj adjustment
	riscv: use 16KB kernel stack on 64-bit
	hwmon: (emc2103) fix unable to change fan pwm1_enable attribute
	powerpc/book3s64/pkeys: Fix pkey_access_permitted() for execute disable pkey
	intel_th: pci: Add Jasper Lake CPU support
	intel_th: pci: Add Tiger Lake PCH-H support
	intel_th: pci: Add Emmitsburg PCH support
	intel_th: Fix a NULL dereference when hub driver is not loaded
	dmaengine: fsl-edma: Fix NULL pointer exception in fsl_edma_tx_handler
	misc: atmel-ssc: lock with mutex instead of spinlock
	thermal/drivers/cpufreq_cooling: Fix wrong frequency converted from power
	arm64: ptrace: Override SPSR.SS when single-stepping is enabled
	arm64: ptrace: Consistently use pseudo-singlestep exceptions
	arm64: compat: Ensure upper 32 bits of x0 are zero on syscall return
	sched: Fix unreliable rseq cpu_id for new tasks
	sched/fair: handle case of task_h_load() returning 0
	genirq/affinity: Handle affinity setting on inactive interrupts correctly
	printk: queue wake_up_klogd irq_work only if per-CPU areas are ready
	libceph: don't omit recovery_deletes in target_copy()
	rxrpc: Fix trace string
	spi: sprd: switch the sequence of setting WDG_LOAD_LOW and _HIGH
	Linux 4.19.134

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ieeb9e03f4a2d51aeebe3a3eadd9c1b93a26088a0
2020-07-22 13:03:12 +02:00
Toke Høiland-Jørgensen
9fd235ff00 sched: consistently handle layer3 header accesses in the presence of VLANs
[ Upstream commit d7bf2ebebc ]

There are a couple of places in net/sched/ that check skb->protocol and act
on the value there. However, in the presence of VLAN tags, the value stored
in skb->protocol can be inconsistent based on whether VLAN acceleration is
enabled. The commit quoted in the Fixes tag below fixed the users of
skb->protocol to use a helper that will always see the VLAN ethertype.

However, most of the callers don't actually handle the VLAN ethertype, but
expect to find the IP header type in the protocol field. This means that
things like changing the ECN field, or parsing diffserv values, stops
working if there's a VLAN tag, or if there are multiple nested VLAN
tags (QinQ).

To fix this, change the helper to take an argument that indicates whether
the caller wants to skip the VLAN tags or not. When skipping VLAN tags, we
make sure to skip all of them, so behaviour is consistent even in QinQ
mode.

To make the helper usable from the ECN code, move it to if_vlan.h instead
of pkt_sched.h.

v3:
- Remove empty lines
- Move vlan variable definitions inside loop in skb_protocol()
- Also use skb_protocol() helper in IP{,6}_ECN_decapsulate() and
  bpf_skb_ecn_set_ce()

v2:
- Use eth_type_vlan() helper in skb_protocol()
- Also fix code that reads skb->protocol directly
- Change a couple of 'if/else if' statements to switch constructs to avoid
  calling the helper twice

Reported-by: Ilya Ponetayev <i.ponetaev@ndmsystems.com>
Fixes: d8b9605d26 ("net: sched: fix skb->protocol use in case of accelerated vlan path")
Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-07-22 09:32:00 +02:00
Martin Varghese
5c6e5496a7 net: Added pointer check for dst->ops->neigh_lookup in dst_neigh_lookup_skb
[ Upstream commit 394de110a7 ]

The packets from tunnel devices (eg bareudp) may have only
metadata in the dst pointer of skb. Hence a pointer check of
neigh_lookup is needed in dst_neigh_lookup_skb

Kernel crashes when packets from bareudp device is processed in
the kernel neighbour subsytem.

[  133.384484] BUG: kernel NULL pointer dereference, address: 0000000000000000
[  133.385240] #PF: supervisor instruction fetch in kernel mode
[  133.385828] #PF: error_code(0x0010) - not-present page
[  133.386603] PGD 0 P4D 0
[  133.386875] Oops: 0010 [#1] SMP PTI
[  133.387275] CPU: 0 PID: 5045 Comm: ping Tainted: G        W         5.8.0-rc2+ #15
[  133.388052] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
[  133.391076] RIP: 0010:0x0
[  133.392401] Code: Bad RIP value.
[  133.394029] RSP: 0018:ffffb79980003d50 EFLAGS: 00010246
[  133.396656] RAX: 0000000080000102 RBX: ffff9de2fe0d6600 RCX: ffff9de2fe5e9d00
[  133.399018] RDX: 0000000000000000 RSI: ffff9de2fe5e9d00 RDI: ffff9de2fc21b400
[  133.399685] RBP: ffff9de2fe5e9d00 R08: 0000000000000000 R09: 0000000000000000
[  133.400350] R10: ffff9de2fbc6be22 R11: ffff9de2fe0d6600 R12: ffff9de2fc21b400
[  133.401010] R13: ffff9de2fe0d6628 R14: 0000000000000001 R15: 0000000000000003
[  133.401667] FS:  00007fe014918740(0000) GS:ffff9de2fec00000(0000) knlGS:0000000000000000
[  133.402412] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  133.402948] CR2: ffffffffffffffd6 CR3: 000000003bb72000 CR4: 00000000000006f0
[  133.403611] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  133.404270] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  133.404933] Call Trace:
[  133.405169]  <IRQ>
[  133.405367]  __neigh_update+0x5a4/0x8f0
[  133.405734]  arp_process+0x294/0x820
[  133.406076]  ? __netif_receive_skb_core+0x866/0xe70
[  133.406557]  arp_rcv+0x129/0x1c0
[  133.406882]  __netif_receive_skb_one_core+0x95/0xb0
[  133.407340]  process_backlog+0xa7/0x150
[  133.407705]  net_rx_action+0x2af/0x420
[  133.408457]  __do_softirq+0xda/0x2a8
[  133.408813]  asm_call_on_stack+0x12/0x20
[  133.409290]  </IRQ>
[  133.409519]  do_softirq_own_stack+0x39/0x50
[  133.410036]  do_softirq+0x50/0x60
[  133.410401]  __local_bh_enable_ip+0x50/0x60
[  133.410871]  ip_finish_output2+0x195/0x530
[  133.411288]  ip_output+0x72/0xf0
[  133.411673]  ? __ip_finish_output+0x1f0/0x1f0
[  133.412122]  ip_send_skb+0x15/0x40
[  133.412471]  raw_sendmsg+0x853/0xab0
[  133.412855]  ? insert_pfn+0xfe/0x270
[  133.413827]  ? vvar_fault+0xec/0x190
[  133.414772]  sock_sendmsg+0x57/0x80
[  133.415685]  __sys_sendto+0xdc/0x160
[  133.416605]  ? syscall_trace_enter+0x1d4/0x2b0
[  133.417679]  ? __audit_syscall_exit+0x1d9/0x280
[  133.418753]  ? __prepare_exit_to_usermode+0x5d/0x1a0
[  133.419819]  __x64_sys_sendto+0x24/0x30
[  133.420848]  do_syscall_64+0x4d/0x90
[  133.421768]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[  133.422833] RIP: 0033:0x7fe013689c03
[  133.423749] Code: Bad RIP value.
[  133.424624] RSP: 002b:00007ffc7288f418 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
[  133.425940] RAX: ffffffffffffffda RBX: 000056151fc63720 RCX: 00007fe013689c03
[  133.427225] RDX: 0000000000000040 RSI: 000056151fc63720 RDI: 0000000000000003
[  133.428481] RBP: 00007ffc72890b30 R08: 000056151fc60500 R09: 0000000000000010
[  133.429757] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000040
[  133.431041] R13: 000056151fc636e0 R14: 000056151fc616bc R15: 0000000000000080
[  133.432481] Modules linked in: mpls_iptunnel act_mirred act_tunnel_key cls_flower sch_ingress veth mpls_router ip_tunnel bareudp ip6_udp_tunnel udp_tunnel macsec udp_diag inet_diag unix_diag af_packet_diag netlink_diag binfmt_misc xt_MASQUERADE iptable_nat xt_addrtype xt_conntrack nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 br_netfilter bridge stp llc ebtable_filter ebtables overlay ip6table_filter ip6_tables iptable_filter sunrpc ext4 mbcache jbd2 pcspkr i2c_piix4 virtio_balloon joydev ip_tables xfs libcrc32c ata_generic qxl pata_acpi drm_ttm_helper ttm drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm ata_piix libata virtio_net net_failover virtio_console failover virtio_blk i2c_core virtio_pci virtio_ring serio_raw floppy virtio dm_mirror dm_region_hash dm_log dm_mod
[  133.444045] CR2: 0000000000000000
[  133.445082] ---[ end trace f4aeee1958fd1638 ]---
[  133.446236] RIP: 0010:0x0
[  133.447180] Code: Bad RIP value.
[  133.448152] RSP: 0018:ffffb79980003d50 EFLAGS: 00010246
[  133.449363] RAX: 0000000080000102 RBX: ffff9de2fe0d6600 RCX: ffff9de2fe5e9d00
[  133.450835] RDX: 0000000000000000 RSI: ffff9de2fe5e9d00 RDI: ffff9de2fc21b400
[  133.452237] RBP: ffff9de2fe5e9d00 R08: 0000000000000000 R09: 0000000000000000
[  133.453722] R10: ffff9de2fbc6be22 R11: ffff9de2fe0d6600 R12: ffff9de2fc21b400
[  133.455149] R13: ffff9de2fe0d6628 R14: 0000000000000001 R15: 0000000000000003
[  133.456520] FS:  00007fe014918740(0000) GS:ffff9de2fec00000(0000) knlGS:0000000000000000
[  133.458046] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  133.459342] CR2: ffffffffffffffd6 CR3: 000000003bb72000 CR4: 00000000000006f0
[  133.460782] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  133.462240] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  133.463697] Kernel panic - not syncing: Fatal exception in interrupt
[  133.465226] Kernel Offset: 0xfa00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
[  133.467025] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---

Fixes: aaa0c23cb9 ("Fix dst_neigh_lookup/dst_neigh_lookup_skb return value handling bug")
Signed-off-by: Martin Varghese <martin.varghese@nokia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-07-22 09:31:59 +02:00
Sean Tranchetti
0845447d9c genetlink: remove genl_bind
[ Upstream commit 1e82a62fec ]

A potential deadlock can occur during registering or unregistering a
new generic netlink family between the main nl_table_lock and the
cb_lock where each thread wants the lock held by the other, as
demonstrated below.

1) Thread 1 is performing a netlink_bind() operation on a socket. As part
   of this call, it will call netlink_lock_table(), incrementing the
   nl_table_users count to 1.
2) Thread 2 is registering (or unregistering) a genl_family via the
   genl_(un)register_family() API. The cb_lock semaphore will be taken for
   writing.
3) Thread 1 will call genl_bind() as part of the bind operation to handle
   subscribing to GENL multicast groups at the request of the user. It will
   attempt to take the cb_lock semaphore for reading, but it will fail and
   be scheduled away, waiting for Thread 2 to finish the write.
4) Thread 2 will call netlink_table_grab() during the (un)registration
   call. However, as Thread 1 has incremented nl_table_users, it will not
   be able to proceed, and both threads will be stuck waiting for the
   other.

genl_bind() is a noop, unless a genl_family implements the mcast_bind()
function to handle setting up family-specific multicast operations. Since
no one in-tree uses this functionality as Cong pointed out, simply removing
the genl_bind() function will remove the possibility for deadlock, as there
is no attempt by Thread 1 above to take the cb_lock semaphore.

Fixes: c380d9a7af ("genetlink: pass multicast bind/unbind to families")
Suggested-by: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: Johannes Berg <johannes.berg@intel.com>
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Sean Tranchetti <stranche@codeaurora.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-07-22 09:31:58 +02:00
Greg Kroah-Hartman
b3293788b9 Linux 4.19.131
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE4n5dijQDou9mhzu83qZv95d3LNwFAl78APEACgkQ3qZv95d3
 LNyt+w/+PkFP8++ZsiI6GegXraxVbGuY4ndXroXAiTYa0uZjdsIhqJpgyVsJ/pbq
 jU/Hcfv8a0UGme7Hqy61KwN6aaCpM27zxE3aV/N9othtJWn59hiB51CyCcKMrjxK
 Mj6PN+yHxLPzCNBszEvOsICsBQt9HtJB11gcbJQPJ2skriVxSER0QrZi2s5jJuoS
 vVbxfRngXCnzTsxmpbYjMh1sE9/z/dNpCuyQ13f1MPAPpWFP1SxmMUfknXEO8gkF
 ThRIhI6uHDucAQxhP42McBsuoP64KfB90fKzFEuWmlit4OCmqW9subTeaI8V1muK
 CxkPqwRnyYmqbAM9auRwbJxtYfT0ONtDZj4zbLulq4qMTJF650968RQNIW+B1K3C
 jika93Am0YbNPOyq3m9Ac96NaTFjjhpIzu13P6xUQNf3/ydPKY9PHif2CnWCHPsX
 BO9fap7gsWHa88khjEGYXwcQCOC+UzQlcsT6CsWPTUTmcLObHiv863Rqm7LpXjit
 9gjKlNHdP6U0q+bz5aiiEtoNJ/2ZDwoz1I+srbrk7QMdVzAn+uRRtLRQxmJtryw1
 oTnJJu0iv9Zspn/PFXwlrpsYDDEBFfXFWvC+izfz8nm8CPFKgH9G96XNefcXlI9e
 3qxjDpkFb74R6ovnWKtJY8pR1qX/5TRC0/+/WpbZBILqW4Z0k5w=
 =YVa/
 -----END PGP SIGNATURE-----

Merge 4.19.131 into android-4.19-stable

Changes in 4.19.131
	net: be more gentle about silly gso requests coming from user
	block/bio-integrity: don't free 'buf' if bio_integrity_add_page() failed
	fanotify: fix ignore mask logic for events on child and on dir
	mtd: rawnand: marvell: Fix the condition on a return code
	net: bcmgenet: remove HFB_CTRL access
	net: sched: export __netdev_watchdog_up()
	EDAC/amd64: Add Family 17h Model 30h PCI IDs
	i2c: tegra: Cleanup kerneldoc comments
	i2c: tegra: Add missing kerneldoc for some fields
	i2c: tegra: Fix Maximum transfer size
	fix a braino in "sparc32: fix register window handling in genregs32_[gs]et()"
	ALSA: hda/realtek - Enable the headset of ASUS B9450FA with ALC294
	ALSA: hda/realtek: Enable mute LED on an HP system
	ALSA: hda/realtek - Enable micmute LED on and HP system
	apparmor: don't try to replace stale label in ptraceme check
	ibmveth: Fix max MTU limit
	mld: fix memory leak in ipv6_mc_destroy_dev()
	net: bridge: enfore alignment for ethernet address
	net: fix memleak in register_netdevice()
	net: place xmit recursion in softnet data
	net: use correct this_cpu primitive in dev_recursion_level
	net: increment xmit_recursion level in dev_direct_xmit()
	net: usb: ax88179_178a: fix packet alignment padding
	rocker: fix incorrect error handling in dma_rings_init
	rxrpc: Fix notification call on completion of discarded calls
	sctp: Don't advertise IPv4 addresses if ipv6only is set on the socket
	tcp: don't ignore ECN CWR on pure ACK
	tcp: grow window for OOO packets only for SACK flows
	tg3: driver sleeps indefinitely when EEH errors exceed eeh_max_freezes
	ip6_gre: fix use-after-free in ip6gre_tunnel_lookup()
	net: phy: Check harder for errors in get_phy_id()
	ip_tunnel: fix use-after-free in ip_tunnel_lookup()
	sch_cake: don't try to reallocate or unshare skb unconditionally
	sch_cake: fix a few style nits
	tcp_cubic: fix spurious HYSTART_DELAY exit upon drop in min RTT
	sch_cake: don't call diffserv parsing code when it is not needed
	net: Fix the arp error in some cases
	net: Do not clear the sock TX queue in sk_set_socket()
	net: core: reduce recursion limit value
	USB: ohci-sm501: Add missed iounmap() in remove
	usb: dwc2: Postponed gadget registration to the udc class driver
	usb: add USB_QUIRK_DELAY_INIT for Logitech C922
	USB: ehci: reopen solution for Synopsys HC bug
	usb: host: xhci-mtk: avoid runtime suspend when removing hcd
	xhci: Poll for U0 after disabling USB2 LPM
	usb: host: ehci-exynos: Fix error check in exynos_ehci_probe()
	usb: typec: tcpci_rt1711h: avoid screaming irq causing boot hangs
	ALSA: usb-audio: add quirk for Denon DCD-1500RE
	ALSA: usb-audio: add quirk for Samsung USBC Headset (AKG)
	ALSA: usb-audio: Fix OOB access of mixer element list
	scsi: zfcp: Fix panic on ERP timeout for previously dismissed ERP action
	xhci: Fix incorrect EP_STATE_MASK
	xhci: Fix enumeration issue when setting max packet size for FS devices.
	xhci: Return if xHCI doesn't support LPM
	cdc-acm: Add DISABLE_ECHO quirk for Microchip/SMSC chip
	loop: replace kill_bdev with invalidate_bdev
	IB/mad: Fix use after free when destroying MAD agent
	cifs/smb3: Fix data inconsistent when punch hole
	cifs/smb3: Fix data inconsistent when zero file range
	xfrm: Fix double ESP trailer insertion in IPsec crypto offload.
	ASoC: q6asm: handle EOS correctly
	efi/esrt: Fix reference count leak in esre_create_sysfs_entry.
	regualtor: pfuze100: correct sw1a/sw2 on pfuze3000
	ASoC: fsl_ssi: Fix bclk calculation for mono channel
	ARM: dts: Fix duovero smsc interrupt for suspend
	x86/resctrl: Fix a NULL vs IS_ERR() static checker warning in rdt_cdp_peer_get()
	regmap: Fix memory leak from regmap_register_patch
	ARM: dts: NSP: Correct FA2 mailbox node
	rxrpc: Fix handling of rwind from an ACK packet
	RDMA/qedr: Fix KASAN: use-after-free in ucma_event_handler+0x532
	RDMA/cma: Protect bind_list and listen_list while finding matching cm id
	ASoC: rockchip: Fix a reference count leak.
	RDMA/mad: Fix possible memory leak in ib_mad_post_receive_mads()
	net: qed: fix left elements count calculation
	net: qed: fix NVMe login fails over VFs
	net: qed: fix excessive QM ILT lines consumption
	cxgb4: move handling L2T ARP failures to caller
	ARM: imx5: add missing put_device() call in imx_suspend_alloc_ocram()
	usb: gadget: udc: Potential Oops in error handling code
	netfilter: ipset: fix unaligned atomic access
	net: bcmgenet: use hardware padding of runt frames
	i2c: fsi: Fix the port number field in status register
	i2c: core: check returned size of emulated smbus block read
	sched/deadline: Initialize ->dl_boosted
	sched/core: Fix PI boosting between RT and DEADLINE tasks
	sata_rcar: handle pm_runtime_get_sync failure cases
	ata/libata: Fix usage of page address by page_address in ata_scsi_mode_select_xlat function
	drm/amd/display: Use kfree() to free rgb_user in calculate_user_regamma_ramp()
	riscv/atomic: Fix sign extension for RV64I
	hwrng: ks-sa - Fix runtime PM imbalance on error
	ibmvnic: Harden device login requests
	net: alx: fix race condition in alx_remove
	s390/ptrace: fix setting syscall number
	s390/vdso: fix vDSO clock_getres()
	arm64: sve: Fix build failure when ARM64_SVE=y and SYSCTL=n
	kbuild: improve cc-option to clean up all temporary files
	blktrace: break out of blktrace setup on concurrent calls
	RISC-V: Don't allow write+exec only page mapping request in mmap
	ALSA: hda: Add NVIDIA codec IDs 9a & 9d through a0 to patch table
	ALSA: hda/realtek - Add quirk for MSI GE63 laptop
	ACPI: sysfs: Fix pm_profile_attr type
	erofs: fix partially uninitialized misuse in z_erofs_onlinepage_fixup
	KVM: X86: Fix MSR range of APIC registers in X2APIC mode
	KVM: nVMX: Plumb L2 GPA through to PML emulation
	x86/asm/64: Align start of __clear_user() loop to 16-bytes
	btrfs: fix data block group relocation failure due to concurrent scrub
	btrfs: fix failure of RWF_NOWAIT write into prealloc extent beyond eof
	mm/slab: use memzero_explicit() in kzfree()
	ocfs2: avoid inode removal while nfsd is accessing it
	ocfs2: load global_inode_alloc
	ocfs2: fix value of OCFS2_INVALID_SLOT
	ocfs2: fix panic on nfs server over ocfs2
	arm64: perf: Report the PC value in REGS_ABI_32 mode
	tracing: Fix event trigger to accept redundant spaces
	ring-buffer: Zero out time extend if it is nested and not absolute
	drm: rcar-du: Fix build error
	drm/radeon: fix fb_div check in ni_init_smc_spll_table()
	Staging: rtl8723bs: prevent buffer overflow in update_sta_support_rate()
	sunrpc: fixed rollback in rpc_gssd_dummy_populate()
	SUNRPC: Properly set the @subbuf parameter of xdr_buf_subsegment()
	pNFS/flexfiles: Fix list corruption if the mirror count changes
	NFSv4 fix CLOSE not waiting for direct IO compeletion
	dm writecache: correct uncommitted_block when discarding uncommitted entry
	dm writecache: add cond_resched to loop in persistent_memory_claim()
	xfs: add agf freeblocks verify in xfs_agf_verify
	Revert "tty: hvc: Fix data abort due to race in hvc_open"
	Linux 4.19.131

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I2c5abdfc2979e50d441bb0e0bcd499e03c61cefd
2020-07-01 13:11:06 +02:00
Huy Nguyen
855150a762 xfrm: Fix double ESP trailer insertion in IPsec crypto offload.
[ Upstream commit 94579ac3f6 ]

During IPsec performance testing, we see bad ICMP checksum. The error packet
has duplicated ESP trailer due to double validate_xmit_xfrm calls. The first call
is from ip_output, but the packet cannot be sent because
netif_xmit_frozen_or_stopped is true and the packet gets dev_requeue_skb. The second
call is from NET_TX softirq. However after the first call, the packet already
has the ESP trailer.

Fix by marking the skb with XFRM_XMIT bit after the packet is handled by
validate_xmit_xfrm to avoid duplicate ESP trailer insertion.

Fixes: f6e27114a6 ("net: Add a xfrm validate function to validate_xmit_skb")
Signed-off-by: Huy Nguyen <huyn@mellanox.com>
Reviewed-by: Boris Pismenny <borisp@mellanox.com>
Reviewed-by: Raed Salem <raeds@mellanox.com>
Reviewed-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-06-30 23:17:10 -04:00
Tariq Toukan
5104916360 net: Do not clear the sock TX queue in sk_set_socket()
[ Upstream commit 41b14fb872 ]

Clearing the sock TX queue in sk_set_socket() might cause unexpected
out-of-order transmit when called from sock_orphan(), as outstanding
packets can pick a different TX queue and bypass the ones already queued.

This is undesired in general. More specifically, it breaks the in-order
scheduling property guarantee for device-offloaded TLS sockets.

Remove the call to sk_tx_queue_clear() in sk_set_socket(), and add it
explicitly only where needed.

Fixes: e022f0b4a0 ("net: Introduce sk_tx_queue_mapping")
Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
Reviewed-by: Boris Pismenny <borisp@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-06-30 23:17:06 -04:00
Marcelo Ricardo Leitner
8a3839c747 sctp: Don't advertise IPv4 addresses if ipv6only is set on the socket
[ Upstream commit 471e39df96 ]

If a socket is set ipv6only, it will still send IPv4 addresses in the
INIT and INIT_ACK packets. This potentially misleads the peer into using
them, which then would cause association termination.

The fix is to not add IPv4 addresses to ipv6only sockets.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: Corey Minyard <cminyard@mvista.com>
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Tested-by: Corey Minyard <cminyard@mvista.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-06-30 23:17:05 -04:00
Will McVicker
0c2900f1aa ANDROID: GKI: cfg80211: add ABI changes for CONFIG_NL80211_TESTMODE
This change adds the ABI requirements for CONFIG_NL80211_TESTMODE. This
allows vendors to enable the config without breaking ABI compatibility.

Bug: 159371702
Bug: 159417269
Change-Id: I6f8968d3be0c5e58bf921a93ae421882078edca9
Signed-off-by: Will McVicker <willmcvicker@google.com>
2020-06-23 10:00:16 -07:00
Greg Kroah-Hartman
beb44e8562 This is the 4.19.126 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl7XQQYACgkQONu9yGCS
 aT4vwQ/9EZxtWUPh/JSsl+eImHuZjCwa/gzdLh0kUvr4Tgqxv+3KkTZ+7/TyPvID
 UgbxxY6qtIP3o4W3kysLAFbOJl+I4IWkEpfCn7vKLzV0BxHjx5Krodo38zT/Ll8S
 Vqi62nRpiYiqD0qrr/dZSnlY1SUyMYnQ04NKKyZokyj392ErEE2TWNGhN4m3369A
 2Dm46WDKckMudkUElXvu2rQkIpVMJACr/aUaFWmmGsfZt+TGQtjRozlKkkq1vokW
 WJEdCVjQwmeWW5T/OZdfM5VmuqspgtU4BhAmzxTVHGGWw+MIEcNU7LIz3s7cpBdr
 7ykY4NcXxvPO5Mn/P5usOZFT/TncZQ65ZqxAEgPoF089D0uXkVTOV9dCLqPzej+g
 /druvsu6bJqsbi8sd5mftXi5KKH/VDPrxnkEEvhIcuc9GCAKCQjtYz8Vtmkek30U
 Mz/UcqhtUTzOJU6yZg7zV/JQ6jrzrXm4VFDdiUHoNe3LuWtFsExMXhokV9TBsScY
 LtDYfe9qIq345BHsKah46VKEIa0Sb53eJFKRrEUK+4EVNr8Rp13afdXPlweX41O+
 ecBlHfpRsi6MB2/fY6lBlE0uHIYSIlV78wV0wHC4czbROCYY2XSCCS2MoEXu5kD4
 KMqXE6nM4tYqgV3arc2nHzth7GaEnbyCPSMMOq+2on6XB4LCRQc=
 =rO6H
 -----END PGP SIGNATURE-----

Merge 4.19.126 into android-4.19-stable

Changes in 4.19.126
	ax25: fix setsockopt(SO_BINDTODEVICE)
	dpaa_eth: fix usage as DSA master, try 3
	net: dsa: mt7530: fix roaming from DSA user ports
	__netif_receive_skb_core: pass skb by reference
	net: inet_csk: Fix so_reuseport bind-address cache in tb->fast*
	net: ipip: fix wrong address family in init error path
	net/mlx5: Add command entry handling completion
	net: qrtr: Fix passing invalid reference to qrtr_local_enqueue()
	net: revert "net: get rid of an signed integer overflow in ip_idents_reserve()"
	net sched: fix reporting the first-time use timestamp
	r8152: support additional Microsoft Surface Ethernet Adapter variant
	sctp: Don't add the shutdown timer if its already been added
	sctp: Start shutdown on association restart if in SHUTDOWN-SENT state and socket is closed
	net/mlx5e: Update netdev txq on completions during closure
	net/mlx5: Annotate mutex destroy for root ns
	net: sun: fix missing release regions in cas_init_one().
	net/mlx4_core: fix a memory leak bug.
	mlxsw: spectrum: Fix use-after-free of split/unsplit/type_set in case reload fails
	ARM: dts: rockchip: fix phy nodename for rk3228-evb
	arm64: dts: rockchip: fix status for &gmac2phy in rk3328-evb.dts
	arm64: dts: rockchip: swap interrupts interrupt-names rk3399 gpu node
	ARM: dts: rockchip: swap clock-names of gpu nodes
	ARM: dts: rockchip: fix pinctrl sub nodename for spi in rk322x.dtsi
	gpio: tegra: mask GPIO IRQs during IRQ shutdown
	ALSA: usb-audio: add mapping for ASRock TRX40 Creator
	net: microchip: encx24j600: add missed kthread_stop
	gfs2: move privileged user check to gfs2_quota_lock_check
	cachefiles: Fix race between read_waiter and read_copier involving op->to_do
	usb: dwc3: pci: Enable extcon driver for Intel Merrifield
	usb: gadget: legacy: fix redundant initialization warnings
	net: freescale: select CONFIG_FIXED_PHY where needed
	IB/i40iw: Remove bogus call to netdev_master_upper_dev_get()
	riscv: stacktrace: Fix undefined reference to `walk_stackframe'
	cifs: Fix null pointer check in cifs_read
	samples: bpf: Fix build error
	Input: usbtouchscreen - add support for BonXeon TP
	Input: evdev - call input_flush_device() on release(), not flush()
	Input: xpad - add custom init packet for Xbox One S controllers
	Input: dlink-dir685-touchkeys - fix a typo in driver name
	Input: i8042 - add ThinkPad S230u to i8042 reset list
	Input: synaptics-rmi4 - really fix attn_data use-after-free
	Input: synaptics-rmi4 - fix error return code in rmi_driver_probe()
	ARM: 8970/1: decompressor: increase tag size
	ARM: 8843/1: use unified assembler in headers
	ARM: uaccess: consolidate uaccess asm to asm/uaccess-asm.h
	ARM: uaccess: integrate uaccess_save and uaccess_restore
	ARM: uaccess: fix DACR mismatch with nested exceptions
	gpio: exar: Fix bad handling for ida_simple_get error path
	IB/qib: Call kobject_put() when kobject_init_and_add() fails
	ARM: dts/imx6q-bx50v3: Set display interface clock parents
	ARM: dts: bcm2835-rpi-zero-w: Fix led polarity
	ARM: dts: bcm: HR2: Fix PPI interrupt types
	mmc: block: Fix use-after-free issue for rpmb
	RDMA/pvrdma: Fix missing pci disable in pvrdma_pci_probe()
	ALSA: hwdep: fix a left shifting 1 by 31 UB bug
	ALSA: hda/realtek - Add a model for Thinkpad T570 without DAC workaround
	ALSA: usb-audio: mixer: volume quirk for ESS Technology Asus USB DAC
	exec: Always set cap_ambient in cap_bprm_set_creds
	ALSA: usb-audio: Quirks for Gigabyte TRX40 Aorus Master onboard audio
	ALSA: hda/realtek - Add new codec supported for ALC287
	libceph: ignore pool overlay and cache logic on redirects
	IB/ipoib: Fix double free of skb in case of multicast traffic in CM mode
	mm: remove VM_BUG_ON(PageSlab()) from page_mapcount()
	fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info()
	include/asm-generic/topology.h: guard cpumask_of_node() macro argument
	iommu: Fix reference count leak in iommu_group_alloc.
	parisc: Fix kernel panic in mem_init()
	mmc: core: Fix recursive locking issue in CQE recovery path
	RDMA/core: Fix double destruction of uobject
	mac80211: mesh: fix discovery timer re-arming issue / crash
	x86/dma: Fix max PFN arithmetic overflow on 32 bit systems
	copy_xstate_to_kernel(): don't leave parts of destination uninitialized
	xfrm: allow to accept packets with ipv6 NEXTHDR_HOP in xfrm_input
	xfrm: call xfrm_output_gso when inner_protocol is set in xfrm_output
	xfrm interface: fix oops when deleting a x-netns interface
	xfrm: fix a warning in xfrm_policy_insert_list
	xfrm: fix a NULL-ptr deref in xfrm_local_error
	xfrm: fix error in comment
	vti4: eliminated some duplicate code.
	ip_vti: receive ipip packet by calling ip_tunnel_rcv
	netfilter: nft_reject_bridge: enable reject with bridge vlan
	netfilter: ipset: Fix subcounter update skip
	netfilter: nfnetlink_cthelper: unbreak userspace helper support
	netfilter: nf_conntrack_pptp: prevent buffer overflows in debug code
	esp6: get the right proto for transport mode in esp6_gso_encap
	bnxt_en: Fix accumulation of bp->net_stats_prev.
	xsk: Add overflow check for u64 division, stored into u32
	qlcnic: fix missing release in qlcnic_83xx_interrupt_test.
	crypto: chelsio/chtls: properly set tp->lsndtime
	bonding: Fix reference count leak in bond_sysfs_slave_add.
	netfilter: nf_conntrack_pptp: fix compilation warning with W=1 build
	mm/vmalloc.c: don't dereference possible NULL pointer in __vunmap()
	Linux 4.19.126

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ic7ffeb4cbc4d3f1b49c60d97a5d113fcad1d098a
2020-06-03 09:23:15 +02:00
Roman Mashak
5d878dd4ba net sched: fix reporting the first-time use timestamp
[ Upstream commit b15e62631c ]

When a new action is installed, firstuse field of 'tcf_t' is explicitly set
to 0. Value of zero means "new action, not yet used"; as a packet hits the
action, 'firstuse' is stamped with the current jiffies value.

tcf_tm_dump() should return 0 for firstuse if action has not yet been hit.

Fixes: 48d8ee1694 ("net sched actions: aggregate dumping of actions timeinfo")
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Roman Mashak <mrv@mojatatu.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-06-03 08:19:15 +02:00
Greg Kroah-Hartman
91d4544b24 This is the 4.19.124 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl7Ey84ACgkQONu9yGCS
 aT4enA/+JsigMJOLeEtEZ4Gf97S0HnxOIqvuz7759s07vTzwPV1BfQm2eafcS8Cl
 8//BO73tDe+m5shH0mFCeFsy0p1qC4+ewIyLPnjulxls1BCZ86xK44/WD6N0DgX9
 Fi0HACcObuNZD7814yIyrWaI9QHZO+OwJlmjCXBiZGC4gZwAnGcgY2+ffYf/hRv2
 wgEyJF2Td0rORCOM3qp8Ipdt1S8inm2yZodGC5htSPajfBLPe8narmkOXxcN+tuB
 BvOwdTJoplmhNwpimWacytL+jQJYKHS/izPX0JYkFDfQ/bgOYXz3CWwa2DMOVsGd
 CQOHp4rK/Rl/caAANe3nD87jstRbaRKp7HZELCJ+KZrHpGfefAZs6g5j+LNC7KQt
 6YloSnTQsnRC6nqu+b2ieI5KoZAfwWoyHrQf7obJi6PJF4Ge4XUbaLEDH9TuxZTN
 tZX5ZOGZ8/i32VgYqBA4mDAbV+n5TyEYl722XxXzgim73VUDl67F7JqtDxMMb4Ic
 KW98luDDXgoq+kM2FqWgXtjxoP4TpjRREjwCpNDEa03ydKW+dwM21D7IoQNtXUgT
 uE6aFPVuhRt5MAhOdSHtkSsbOjiJZjKuPKvYyUFvAQT5JMaYZg9pabnH89E6URQ9
 x7M2JOvR/GMOmPRykQoewqV0027K37TYxBfRAzLbNFv8Iol/a7I=
 =pHmd
 -----END PGP SIGNATURE-----

Merge 4.19.124 into android-4.19-stable

Changes in 4.19.124
	net: dsa: Do not make user port errors fatal
	shmem: fix possible deadlocks on shmlock_user_lock
	net/sonic: Fix a resource leak in an error handling path in 'jazz_sonic_probe()'
	net: moxa: Fix a potential double 'free_irq()'
	drop_monitor: work around gcc-10 stringop-overflow warning
	virtio-blk: handle block_device_operations callbacks after hot unplug
	scsi: sg: add sg_remove_request in sg_write
	mmc: sdhci-acpi: Add SDHCI_QUIRK2_BROKEN_64_BIT_DMA for AMDI0040
	net: fix a potential recursive NETDEV_FEAT_CHANGE
	netlabel: cope with NULL catmap
	net: phy: fix aneg restart in phy_ethtool_set_eee
	pppoe: only process PADT targeted at local interfaces
	Revert "ipv6: add mtu lock check in __ip6_rt_update_pmtu"
	tcp: fix error recovery in tcp_zerocopy_receive()
	virtio_net: fix lockdep warning on 32 bit
	hinic: fix a bug of ndo_stop
	net: dsa: loop: Add module soft dependency
	net: ipv4: really enforce backoff for redirects
	netprio_cgroup: Fix unlimited memory leak of v2 cgroups
	net: tcp: fix rx timestamp behavior for tcp_recvmsg
	tcp: fix SO_RCVLOWAT hangs with fat skbs
	riscv: fix vdso build with lld
	dmaengine: pch_dma.c: Avoid data race between probe and irq handler
	dmaengine: mmp_tdma: Reset channel error on release
	cpufreq: intel_pstate: Only mention the BIOS disabling turbo mode once
	ALSA: hda/hdmi: fix race in monitor detection during probe
	drm/qxl: lost qxl_bo_kunmap_atomic_page in qxl_image_init_helper()
	ipc/util.c: sysvipc_find_ipc() incorrectly updates position index
	ALSA: hda/realtek - Fix S3 pop noise on Dell Wyse
	gfs2: Another gfs2_walk_metadata fix
	pinctrl: baytrail: Enable pin configuration setting for GPIO chip
	pinctrl: cherryview: Add missing spinlock usage in chv_gpio_irq_handler
	i40iw: Fix error handling in i40iw_manage_arp_cache()
	mmc: core: Check request type before completing the request
	mmc: block: Fix request completion in the CQE timeout path
	NFS: Fix fscache super_cookie index_key from changing after umount
	nfs: fscache: use timespec64 in inode auxdata
	NFSv4: Fix fscache cookie aux_data to ensure change_attr is included
	netfilter: conntrack: avoid gcc-10 zero-length-bounds warning
	arm64: fix the flush_icache_range arguments in machine_kexec
	netfilter: nft_set_rbtree: Introduce and use nft_rbtree_interval_start()
	IB/mlx4: Test return value of calls to ib_get_cached_pkey
	hwmon: (da9052) Synchronize access with mfd
	pnp: Use list_for_each_entry() instead of open coding
	gcc-10 warnings: fix low-hanging fruit
	kbuild: compute false-positive -Wmaybe-uninitialized cases in Kconfig
	Stop the ad-hoc games with -Wno-maybe-initialized
	gcc-10: disable 'zero-length-bounds' warning for now
	gcc-10: disable 'array-bounds' warning for now
	gcc-10: disable 'stringop-overflow' warning for now
	gcc-10: disable 'restrict' warning for now
	gcc-10: avoid shadowing standard library 'free()' in crypto
	ALSA: hda/realtek - Limit int mic boost for Thinkpad T530
	ALSA: rawmidi: Fix racy buffer resize under concurrent accesses
	ALSA: usb-audio: Add control message quirk delay for Kingston HyperX headset
	usb: core: hub: limit HUB_QUIRK_DISABLE_AUTOSUSPEND to USB5534B
	usb: host: xhci-plat: keep runtime active when removing host
	USB: gadget: fix illegal array access in binding with UDC
	usb: xhci: Fix NULL pointer dereference when enqueuing trbs from urb sg list
	ARM: dts: dra7: Fix bus_dma_limit for PCIe
	ARM: dts: imx27-phytec-phycard-s-rdk: Fix the I2C1 pinctrl entries
	cifs: fix leaked reference on requeued write
	x86: Fix early boot crash on gcc-10, third try
	x86/unwind/orc: Fix error handling in __unwind_start()
	exec: Move would_dump into flush_old_exec
	clk: rockchip: fix incorrect configuration of rk3228 aclk_gpu* clocks
	dwc3: Remove check for HWO flag in dwc3_gadget_ep_reclaim_trb_sg()
	usb: gadget: net2272: Fix a memory leak in an error handling path in 'net2272_plat_probe()'
	usb: gadget: audio: Fix a missing error return value in audio_bind()
	usb: gadget: legacy: fix error return code in gncm_bind()
	usb: gadget: legacy: fix error return code in cdc_bind()
	Revert "ALSA: hda/realtek: Fix pop noise on ALC225"
	clk: Unlink clock if failed to prepare or enable
	arm64: dts: rockchip: Replace RK805 PMIC node name with "pmic" on rk3328 boards
	arm64: dts: rockchip: Rename dwc3 device nodes on rk3399 to make dtc happy
	ARM: dts: r8a73a4: Add missing CMT1 interrupts
	arm64: dts: renesas: r8a77980: Fix IPMMU VIP[01] nodes
	ARM: dts: r8a7740: Add missing extal2 to CPG node
	KVM: x86: Fix off-by-one error in kvm_vcpu_ioctl_x86_setup_mce
	Makefile: disallow data races on gcc-10 as well
	Linux 4.19.124

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I3d253f677cc08337e64d316005a0ec0c33717940
2020-05-20 11:37:46 +02:00
Arnd Bergmann
d2413ec1f7 netfilter: conntrack: avoid gcc-10 zero-length-bounds warning
[ Upstream commit 2c407aca64 ]

gcc-10 warns around a suspicious access to an empty struct member:

net/netfilter/nf_conntrack_core.c: In function '__nf_conntrack_alloc':
net/netfilter/nf_conntrack_core.c:1522:9: warning: array subscript 0 is outside the bounds of an interior zero-length array 'u8[0]' {aka 'unsigned char[0]'} [-Wzero-length-bounds]
 1522 |  memset(&ct->__nfct_init_offset[0], 0,
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from net/netfilter/nf_conntrack_core.c:37:
include/net/netfilter/nf_conntrack.h:90:5: note: while referencing '__nfct_init_offset'
   90 |  u8 __nfct_init_offset[0];
      |     ^~~~~~~~~~~~~~~~~~

The code is correct but a bit unusual. Rework it slightly in a way that
does not trigger the warning, using an empty struct instead of an empty
array. There are probably more elegant ways to do this, but this is the
smallest change.

Fixes: c41884ce05 ("netfilter: conntrack: avoid zeroing timer")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-05-20 08:18:43 +02:00
Eric Dumazet
99779c24bf tcp: fix SO_RCVLOWAT hangs with fat skbs
[ Upstream commit 24adbc1676 ]

We autotune rcvbuf whenever SO_RCVLOWAT is set to account for 100%
overhead in tcp_set_rcvlowat()

This works well when skb->len/skb->truesize ratio is bigger than 0.5

But if we receive packets with small MSS, we can end up in a situation
where not enough bytes are available in the receive queue to satisfy
RCVLOWAT setting.
As our sk_rcvbuf limit is hit, we send zero windows in ACK packets,
preventing remote peer from sending more data.

Even autotuning does not help, because it only triggers at the time
user process drains the queue. If no EPOLLIN is generated, this
can not happen.

Note poll() has a similar issue, after commit
c7004482e8 ("tcp: Respect SO_RCVLOWAT in tcp_poll().")

Fixes: 03f45c883c ("tcp: avoid extra wakeups for SO_RCVLOWAT users")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-05-20 08:18:38 +02:00
Greg Kroah-Hartman
071fbc0683 ANDROID: GKI: sock.h: add Android ABI padding to some structures
Try to mitigate potential future driver core api changes by adding a
padding to struct sock.

Based on a patch from Michal Marek <mmarek@suse.cz> from the SLES kernel

Bug: 151154716
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I61c3d6cf12c087345db71fc6d93ee6bd58969003
2020-05-01 15:18:11 +02:00
Vidyullatha Kanchanapally
f18ae83998 ANDROID: GKI: cfg80211: Include length of kek in rekey data
With support for new AKM suites (example FILS-SHA256), the KEK length
can now be more than NL80211_KEK_LEN and the KCK length can be zero.
Add changes in cfg80211 to specify the length of KEK, and make KCK
optional. Make NL80211_REKEY_DATA_KEK as NLA_BINARY to enforce a maximum
length check.
Also add macro CFG80211_REKEY_DATA_KEK_LEN to indicate support for
including KEK length in rekey data.

CRs-Fixed: 2087759
Change-Id: Ica8dbb8614e0a9c3905e125b4a5254e43821984e
Signed-off-by: Vidyullatha Kanchanapally <vidyullatha@codeaurora.org>
Signed-off-by: Ankita Bajaj <bankita@codeaurora.org>
Signed-off-by: Hardik Kantilal Patel <hkpatel@codeaurora.org>
(cherry picked from commit 1daf1a378a61ab77a9497e81b1c0de2bbeca70c1)
Bug: 154523213
Signed-off-by: Connor O'Brien <connoro@google.com>
2020-04-30 21:32:15 +00:00
Greg Kroah-Hartman
be3bb0daac This is the 4.19.119 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl6pj8gACgkQONu9yGCS
 aT5mKxAAvzC4s4XHwDDckvvu57/sED2oEtp7MgmLuyK4Ih55GyyLGx9zg1A2z+rs
 wQSsVW+/WeurCj4CuVciakkCvgBeY494cbnghr2lohhJZ918/XnYmPODLJhlvtcV
 gZ4vxk5euNqpWGsmu+X+DRBG6QuU5GYf4ox39NZdtKm5I+kt5Lw44AHSNlFP0q3y
 drRFc49cqSxa4WkVRixJJOTQbSHARNWiayOG4uLb4zoZFvJOTDAp7+yX5LYD7lxY
 3FsQLVMSp7c/whppeGySVX0oJF/12weR9OQJZVxxhlMNggmGREwDxayBaPYqA4pa
 0OO83rO1aP9j2VK3HFiK4OwatKHcu0GvGV9I4rP3u8hWvJyUzTAfdcVUXHl6of12
 6hXG7F3f0TVY/OP6J2WepcQG5IbkiiAY1J0wlqbqo5MvOqESJZ/J0pGuFD1qzQ8n
 zaMnj2zhJHkJEfyP7Dvjo4y72eM9tWnFxKfm/PtuHWGovpP15rrsuHcs343U92Z7
 zQ/Ak10tA8FpSM7dXaTd98/3FkVdQbkImkEUOpWzPjiJFGyuk8j6/ZE9rCWtlNR1
 HP9cLgKB/PF/a3+kwtgGAhAHBVIA8trhSm1jRqEU7ki9sBQnV/2iR5b7UJ8xn4uA
 dl9HlxpiDYvIjRhHfMh6GXIhdO2T8coFzxKRztjxrM0dbaQeVKQ=
 =31Y5
 -----END PGP SIGNATURE-----

Merge 4.19.119 into android-4.19

Changes in 4.19.119
	ext4: fix extent_status fragmentation for plain files
	drm/msm: Use the correct dma_sync calls harder
	bpftool: Fix printing incorrect pointer in btf_dump_ptr
	crypto: mxs-dcp - make symbols 'sha1_null_hash' and 'sha256_null_hash' static
	vti4: removed duplicate log message.
	arm64: Add part number for Neoverse N1
	arm64: errata: Hide CTR_EL0.DIC on systems affected by Neoverse-N1 #1542419
	arm64: Fake the IminLine size on systems affected by Neoverse-N1 #1542419
	arm64: compat: Workaround Neoverse-N1 #1542419 for compat user-space
	arm64: Silence clang warning on mismatched value/register sizes
	watchdog: reset last_hw_keepalive time at start
	scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login
	scsi: lpfc: Fix crash in target side cable pulls hitting WAIT_FOR_UNREG
	ceph: return ceph_mdsc_do_request() errors from __get_parent()
	ceph: don't skip updating wanted caps when cap is stale
	pwm: rcar: Fix late Runtime PM enablement
	scsi: iscsi: Report unbind session event when the target has been removed
	ASoC: Intel: atom: Take the drv->lock mutex before calling sst_send_slot_map()
	nvme: fix deadlock caused by ANA update wrong locking
	kernel/gcov/fs.c: gcov_seq_next() should increase position index
	selftests: kmod: fix handling test numbers above 9
	ipc/util.c: sysvipc_find_ipc() should increase position index
	kconfig: qconf: Fix a few alignment issues
	s390/cio: avoid duplicated 'ADD' uevents
	loop: Better discard support for block devices
	Revert "powerpc/64: irq_work avoid interrupt when called with hardware irqs enabled"
	pwm: renesas-tpu: Fix late Runtime PM enablement
	pwm: bcm2835: Dynamically allocate base
	perf/core: Disable page faults when getting phys address
	ASoC: Intel: bytcr_rt5640: Add quirk for MPMAN MPWIN895CL tablet
	xhci: Ensure link state is U3 after setting USB_SS_PORT_LS_U3
	drm/amd/display: Not doing optimize bandwidth if flip pending.
	tracing/selftests: Turn off timeout setting
	virtio-blk: improve virtqueue error to BLK_STS
	scsi: smartpqi: fix call trace in device discovery
	PCI/ASPM: Allow re-enabling Clock PM
	net: ipv6: add net argument to ip6_dst_lookup_flow
	net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup
	blktrace: Protect q->blk_trace with RCU
	blktrace: fix dereference after null check
	f2fs: fix to avoid memory leakage in f2fs_listxattr
	KVM: VMX: Zero out *all* general purpose registers after VM-Exit
	KVM: nVMX: Always sync GUEST_BNDCFGS when it comes from vmcs01
	KVM: Introduce a new guest mapping API
	kvm: fix compilation on aarch64
	kvm: fix compilation on s390
	kvm: fix compile on s390 part 2
	KVM: Properly check if "page" is valid in kvm_vcpu_unmap
	x86/kvm: Introduce kvm_(un)map_gfn()
	x86/kvm: Cache gfn to pfn translation
	x86/KVM: Make sure KVM_VCPU_FLUSH_TLB flag is not missed
	x86/KVM: Clean up host's steal time structure
	cxgb4: fix adapter crash due to wrong MC size
	cxgb4: fix large delays in PTP synchronization
	ipv6: fix restrict IPV6_ADDRFORM operation
	macsec: avoid to set wrong mtu
	macvlan: fix null dereference in macvlan_device_event()
	net: bcmgenet: correct per TX/RX ring statistics
	net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node
	net: stmmac: dwmac-meson8b: Add missing boundary to RGMII TX clock array
	net/x25: Fix x25_neigh refcnt leak when receiving frame
	sched: etf: do not assume all sockets are full blown
	tcp: cache line align MAX_TCP_HEADER
	team: fix hang in team_mode_get()
	vrf: Fix IPv6 with qdisc and xfrm
	net: dsa: b53: Lookup VID in ARL searches when VLAN is enabled
	net: dsa: b53: Fix ARL register definitions
	net: dsa: b53: Rework ARL bin logic
	net: dsa: b53: b53_arl_rw_op() needs to select IVL or SVL
	xfrm: Always set XFRM_TRANSFORMED in xfrm{4,6}_output_finish
	vrf: Check skb for XFRM_TRANSFORMED flag
	mlxsw: Fix some IS_ERR() vs NULL bugs
	KEYS: Avoid false positive ENOMEM error on key read
	ALSA: hda: Remove ASUS ROG Zenith from the blacklist
	ALSA: usb-audio: Add static mapping table for ALC1220-VB-based mobos
	ALSA: usb-audio: Add connector notifier delegation
	iio: core: remove extra semi-colon from devm_iio_device_register() macro
	iio: st_sensors: rely on odr mask to know if odr can be set
	iio: adc: stm32-adc: fix sleep in atomic context
	iio: xilinx-xadc: Fix ADC-B powerdown
	iio: xilinx-xadc: Fix clearing interrupt when enabling trigger
	iio: xilinx-xadc: Fix sequencer configuration for aux channels in simultaneous mode
	iio: xilinx-xadc: Make sure not exceed maximum samplerate
	fs/namespace.c: fix mountpoint reference counter race
	USB: sisusbvga: Change port variable from signed to unsigned
	USB: Add USB_QUIRK_DELAY_CTRL_MSG and USB_QUIRK_DELAY_INIT for Corsair K70 RGB RAPIDFIRE
	USB: early: Handle AMD's spec-compliant identifiers, too
	USB: core: Fix free-while-in-use bug in the USB S-Glibrary
	USB: hub: Fix handling of connect changes during sleep
	vmalloc: fix remap_vmalloc_range() bounds checks
	mm/hugetlb: fix a addressing exception caused by huge_pte_offset
	mm/ksm: fix NULL pointer dereference when KSM zero page is enabled
	tools/vm: fix cross-compile build
	ALSA: usx2y: Fix potential NULL dereference
	ALSA: hda/realtek - Fix unexpected init_amp override
	ALSA: hda/realtek - Add new codec supported for ALC245
	ALSA: usb-audio: Fix usb audio refcnt leak when getting spdif
	ALSA: usb-audio: Filter out unsupported sample rates on Focusrite devices
	tpm/tpm_tis: Free IRQ if probing fails
	tpm: ibmvtpm: retry on H_CLOSED in tpm_ibmvtpm_send()
	KVM: s390: Return last valid slot if approx index is out-of-bounds
	KVM: Check validity of resolved slot when searching memslots
	KVM: VMX: Enable machine check support for 32bit targets
	tty: hvc: fix buffer overflow during hvc_alloc().
	tty: rocket, avoid OOB access
	usb-storage: Add unusual_devs entry for JMicron JMS566
	audit: check the length of userspace generated audit records
	ASoC: dapm: fixup dapm kcontrol widget
	iwlwifi: pcie: actually release queue memory in TVQM
	iwlwifi: mvm: beacon statistics shouldn't go backwards
	ARM: imx: provide v7_cpu_resume() only on ARM_CPU_SUSPEND=y
	powerpc/setup_64: Set cache-line-size based on cache-block-size
	staging: comedi: dt2815: fix writing hi byte of analog output
	staging: comedi: Fix comedi_device refcnt leak in comedi_open
	vt: don't hardcode the mem allocation upper bound
	vt: don't use kmalloc() for the unicode screen buffer
	staging: vt6656: Don't set RCR_MULTICAST or RCR_BROADCAST by default.
	staging: vt6656: Fix calling conditions of vnt_set_bss_mode
	staging: vt6656: Fix drivers TBTT timing counter.
	staging: vt6656: Fix pairwise key entry save.
	staging: vt6656: Power save stop wake_up_count wrap around.
	cdc-acm: close race betrween suspend() and acm_softint
	cdc-acm: introduce a cool down
	UAS: no use logging any details in case of ENODEV
	UAS: fix deadlock in error handling and PM flushing work
	usb: dwc3: gadget: Fix request completion check
	usb: f_fs: Clear OS Extended descriptor counts to zero in ffs_data_reset()
	xhci: prevent bus suspend if a roothub port detected a over-current condition
	serial: sh-sci: Make sure status register SCxSR is read in correct sequence
	xfs: Fix deadlock between AGI and AGF with RENAME_WHITEOUT
	s390/mm: fix page table upgrade vs 2ndary address mode accesses
	Linux 4.19.119

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I4b16db8472367d135a4ff68d2863c634bf093ef5
2020-04-29 17:26:17 +02:00
Eric Dumazet
3405bf51f6 tcp: cache line align MAX_TCP_HEADER
[ Upstream commit 9bacd256f1 ]

TCP stack is dumb in how it cooks its output packets.

Depending on MAX_HEADER value, we might chose a bad ending point
for the headers.

If we align the end of TCP headers to cache line boundary, we
make sure to always use the smallest number of cache lines,
which always help.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Soheil Hassas Yeganeh <soheil@google.com>
Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-29 16:31:21 +02:00