14440 Commits

Author	SHA1	Message	Date
Vignesh Saravanaperumal	7786463e48	ANDROID: GKI: add vendor padding variable in struct sock ... Some vendors want to add things to 'struct sock', so give them a u64 where they can then have a pointer off to their private data and they can do whatever they want to do without breaking or changing any abi for anyone else. Note, usually an android trace hook is also needed to use this properly, so be aware that this will be required as well. Bug: 171013716 Signed-off-by: Vignesh Saravanaperumal <vignesh1.s@samsung.com> Change-Id: Iab0b5570753d4a9722ecf9ca9eeb9b9887e2a9d9	2021-07-14 20:52:03 -07:00
Vignesh Saravanaperumal	280c9b98aa	ANDROID: GKI: add vendor padding variable in struct nf_conn ... Some vendors want to add things to 'struct nf_conn', so give them a u64 where they can then have a pointer off to their private data and they can do whatever they want to do without breaking or changing any abi for anyone else. Note, usually an android trace hook is also needed to use this properly, so be aware that this will be required as well. Bug: 171013716 Signed-off-by: Vignesh Saravanaperumal <vignesh1.s@samsung.com> Change-Id: I245c162ee3fb083e3f39cf7bec3bd78cb624e005	2021-07-14 20:52:03 -07:00
Greg Kroah-Hartman	37485a3025	ANDROID: add kabi padding for structures for the android12 release ... There are a lot of different structures that need to have a "frozen" abi for the next 5+ years. Add padding to a lot of them in order to be able to handle any future changes that might be needed due to LTS and security fixes that might come up. It's a best guess, based on what has happened in the past from the 5.4.0..5.4.129 release (1 1/2 years). Yes, past changes do not mean that future changes will also be needed in the same area, but that is a hint that those areas are both well maintained and looked after, and there have been previous problems found in them. Also the list of structures that are being required based on OEM usage in the android/ symbol lists were consulted as that's a larger list than what has been changed in the past. Hopefully we caught everything we need to worry about, only time will tell... Bug: 151154716 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I880bbcda0628a7459988eeb49d18655522697664	2021-07-14 20:51:51 -07:00
Greg Kroah-Hartman	9e08e97ec6	Merge 5.10.43 into android12-5.10 ... Changes in 5.10.43 btrfs: tree-checker: do not error out if extent ref hash doesn't match net: usb: cdc_ncm: don't spew notifications hwmon: (dell-smm-hwmon) Fix index values hwmon: (pmbus/isl68137) remove READ_TEMPERATURE_3 for RAA228228 netfilter: conntrack: unregister ipv4 sockopts on error unwind efi/fdt: fix panic when no valid fdt found efi: Allow EFI_MEMORY_XP and EFI_MEMORY_RO both to be cleared efi/libstub: prevent read overflow in find_file_option() efi: cper: fix snprintf() use in cper_dimm_err_location() vfio/pci: Fix error return code in vfio_ecap_init() vfio/pci: zap_vma_ptes() needs MMU samples: vfio-mdev: fix error handing in mdpy_fb_probe() vfio/platform: fix module_put call in error flow ipvs: ignore IP_VS_SVC_F_HASHED flag when adding service HID: logitech-hidpp: initialize level variable HID: pidff: fix error return code in hid_pidff_init() HID: i2c-hid: fix format string mismatch devlink: Correct VIRTUAL port to not have phys_port attributes net/sched: act_ct: Offload connections with commit action net/sched: act_ct: Fix ct template allocation for zone 0 mptcp: always parse mptcp options for MPC reqsk nvme-rdma: fix in-casule data send for chained sgls ACPICA: Clean up context mutex during object deletion perf probe: Fix NULL pointer dereference in convert_variable_location() net: dsa: tag_8021q: fix the VLAN IDs used for encoding sub-VLANs net: sock: fix in-kernel mark setting net/tls: Replace TLS_RX_SYNC_RUNNING with RCU net/tls: Fix use-after-free after the TLS device goes down and up net/mlx5e: Fix incompatible casting net/mlx5: Check firmware sync reset requested is set before trying to abort it net/mlx5e: Check for needed capability for cvlan matching net/mlx5: DR, Create multi-destination flow table with level less than 64 nvmet: fix freeing unallocated p2pmem netfilter: nft_ct: skip expectations for confirmed conntrack netfilter: nfnetlink_cthelper: hit EBUSY on updates if size mismatches drm/i915/selftests: Fix return value check in live_breadcrumbs_smoketest() bpf: Simplify cases in bpf_base_func_proto bpf, lockdown, audit: Fix buggy SELinux lockdown permission checks ieee802154: fix error return code in ieee802154_add_iface() ieee802154: fix error return code in ieee802154_llsec_getparams() igb: add correct exception tracing for XDP ixgbevf: add correct exception tracing for XDP cxgb4: fix regression with HASH tc prio value update ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptions ice: Fix allowing VF to request more/less queues via virtchnl ice: Fix VFR issues for AVF drivers that expect ATQLEN cleared ice: handle the VF VSI rebuild failure ice: report supported and advertised autoneg using PHY capabilities ice: Allow all LLDP packets from PF to Tx i2c: qcom-geni: Add shutdown callback for i2c cxgb4: avoid link re-train during TC-MQPRIO configuration i40e: optimize for XDP_REDIRECT in xsk path i40e: add correct exception tracing for XDP ice: simplify ice_run_xdp ice: optimize for XDP_REDIRECT in xsk path ice: add correct exception tracing for XDP ixgbe: optimize for XDP_REDIRECT in xsk path ixgbe: add correct exception tracing for XDP arm64: dts: ti: j7200-main: Mark Main NAVSS as dma-coherent optee: use export_uuid() to copy client UUID bus: ti-sysc: Fix am335x resume hang for usb otg module arm64: dts: ls1028a: fix memory node arm64: dts: zii-ultra: fix 12V_MAIN voltage arm64: dts: freescale: sl28: var4: fix RGMII clock and voltage ARM: dts: imx7d-meerkat96: Fix the 'tuning-step' property ARM: dts: imx7d-pico: Fix the 'tuning-step' property ARM: dts: imx: emcon-avari: Fix nxp,pca8574 #gpio-cells bus: ti-sysc: Fix flakey idling of uarts and stop using swsup_sidle_act tipc: add extack messages for bearer/media failure tipc: fix unique bearer names sanity check serial: stm32: fix threaded interrupt handling riscv: vdso: fix and clean-up Makefile io_uring: fix link timeout refs io_uring: use better types for cflags drm/amdgpu/vcn3: add cancel_delayed_work_sync before power gate drm/amdgpu/jpeg2.5: add cancel_delayed_work_sync before power gate drm/amdgpu/jpeg3: add cancel_delayed_work_sync before power gate Bluetooth: fix the erroneous flush_work() order Bluetooth: use correct lock to prevent UAF of hdev object wireguard: do not use -O3 wireguard: peer: allocate in kmem_cache wireguard: use synchronize_net rather than synchronize_rcu wireguard: selftests: remove old conntrack kconfig value wireguard: selftests: make sure rp_filter is disabled on vethc wireguard: allowedips: initialize list head in selftest wireguard: allowedips: remove nodes in O(1) wireguard: allowedips: allocate nodes in kmem_cache wireguard: allowedips: free empty intermediate nodes when removing single node net: caif: added cfserl_release function net: caif: add proper error handling net: caif: fix memory leak in caif_device_notify net: caif: fix memory leak in cfusbl_device_notify HID: i2c-hid: Skip ELAN power-on command after reset HID: magicmouse: fix NULL-deref on disconnect HID: multitouch: require Finger field to mark Win8 reports as MT gfs2: fix scheduling while atomic bug in glocks ALSA: timer: Fix master timer notification ALSA: hda: Fix for mute key LED for HP Pavilion 15-CK0xx ALSA: hda: update the power_state during the direct-complete ARM: dts: imx6dl-yapp4: Fix RGMII connection to QCA8334 switch ARM: dts: imx6q-dhcom: Add PU,VDD1P1,VDD2P5 regulators ext4: fix memory leak in ext4_fill_super ext4: fix bug on in ext4_es_cache_extent as ext4_split_extent_at failed ext4: fix fast commit alignment issues ext4: fix memory leak in ext4_mb_init_backend on error path. ext4: fix accessing uninit percpu counter variable with fast_commit usb: dwc2: Fix build in periphal-only mode pid: take a reference when initializing `cad_pid` ocfs2: fix data corruption by fallocate mm/debug_vm_pgtable: fix alignment for pmd/pud_advanced_tests() mm/page_alloc: fix counting of free pages after take off from buddy x86/cpufeatures: Force disable X86_FEATURE_ENQCMD and remove update_pasid() x86/sev: Check SME/SEV support in CPUID first nfc: fix NULL ptr dereference in llcp_sock_getname() after failed connect drm/amdgpu: Don't query CE and UE errors drm/amdgpu: make sure we unpin the UVD BO x86/apic: Mark _all_ legacy interrupts when IO/APIC is missing powerpc/kprobes: Fix validation of prefixed instructions across page boundary btrfs: mark ordered extent and inode with error if we fail to finish btrfs: fix error handling in btrfs_del_csums btrfs: return errors from btrfs_del_csums in cleanup_ref_head btrfs: fixup error handling in fixup_inode_link_counts btrfs: abort in rename_exchange if we fail to insert the second ref btrfs: fix deadlock when cloning inline extents and low on available space mm, hugetlb: fix simple resv_huge_pages underflow on UFFDIO_COPY drm/msm/dpu: always use mdp device to scale bandwidth btrfs: fix unmountable seed device after fstrim KVM: SVM: Truncate GPR value for DR and CR accesses in !64-bit mode KVM: arm64: Fix debug register indexing x86/kvm: Teardown PV features on boot CPU as well x86/kvm: Disable kvmclock on all CPUs on shutdown x86/kvm: Disable all PV features on crash lib/lz4: explicitly support in-place decompression i2c: qcom-geni: Suspend and resume the bus during SYSTEM_SLEEP_PM ops netfilter: nf_tables: missing error reporting for not selected expressions xen-netback: take a reference to the RX task thread neighbour: allow NUD_NOARP entries to be forced GCed Linux 5.10.43 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I8d7ec0878193e4e454076809b7fb71fcc4e3d810	2021-06-12 14:48:14 +02:00
Johannes Berg	259e0a28b9	UPSTREAM: nl80211: fix kernel-doc warning in the new SAE attribute ... Format the items as a definition list, to avoid the warning from the rst parsing. Fixes: 9f0ffa4184 ("cfg80211: Add support to configure SAE PWE value to drivers") Link: https://lore.kernel.org/r/20201110094911.bb020e863aa0.I960caf90e2a8cc23f6bf9245d77524df6a4d8f37@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com> (cherry picked from commit da1e9dd3a1) Bug: 187129171 Signed-off-by: Connor O'Brien <connoro@google.com> Change-Id: Ia962bcdbc52f2019ff0ef957b512915bfc921fad	2021-06-10 20:25:50 -07:00
Pavel Skripkin	d6db727457	net: caif: add proper error handling ... commit a2805dca51 upstream. caif_enroll_dev() can fail in some cases. Ingnoring these cases can lead to memory leak due to not assigning link_support pointer to anywhere. Fixes: 7c18d2205e ("caif: Restructure how link caif link layer enroll") Cc: stable@vger.kernel.org Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-06-10 13:39:24 +02:00
Pavel Skripkin	dac53568c6	net: caif: added cfserl_release function ... commit bce130e7f3 upstream. Added cfserl_release() function. Cc: stable@vger.kernel.org Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-06-10 13:39:24 +02:00
Maxim Mikityanskiy	f1d4184f12	net/tls: Fix use-after-free after the TLS device goes down and up ... [ Upstream commit c55dcdd435 ] When a netdev with active TLS offload goes down, tls_device_down is called to stop the offload and tear down the TLS context. However, the socket stays alive, and it still points to the TLS context, which is now deallocated. If a netdev goes up, while the connection is still active, and the data flow resumes after a number of TCP retransmissions, it will lead to a use-after-free of the TLS context. This commit addresses this bug by keeping the context alive until its normal destruction, and implements the necessary fallbacks, so that the connection can resume in software (non-offloaded) kTLS mode. On the TX side tls_sw_fallback is used to encrypt all packets. The RX side already has all the necessary fallbacks, because receiving non-decrypted packets is supported. The thing needed on the RX side is to block resync requests, which are normally produced after receiving non-decrypted packets. The necessary synchronization is implemented for a graceful teardown: first the fallbacks are deployed, then the driver resources are released (it used to be possible to have a tls_dev_resync after tls_dev_del). A new flag called TLS_RX_DEV_DEGRADED is added to indicate the fallback mode. It's used to skip the RX resync logic completely, as it becomes useless, and some objects may be released (for example, resync_async, which is allocated and freed by the driver). Fixes: e8f6979981 ("net/tls: Add generic NIC offload infrastructure") Signed-off-by: Maxim Mikityanskiy <maximmi@nvidia.com> Reviewed-by: Tariq Toukan <tariqt@nvidia.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-06-10 13:39:18 +02:00
Maxim Mikityanskiy	874ece252e	net/tls: Replace TLS_RX_SYNC_RUNNING with RCU ... [ Upstream commit 05fc8b6cbd ] RCU synchronization is guaranteed to finish in finite time, unlike a busy loop that polls a flag. This patch is a preparation for the bugfix in the next patch, where the same synchronize_net() call will also be used to sync with the TX datapath. Signed-off-by: Maxim Mikityanskiy <maximmi@nvidia.com> Reviewed-by: Tariq Toukan <tariqt@nvidia.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-06-10 13:39:17 +02:00
Greg Kroah-Hartman	556758235b	Revert "Revert "mm: fix struct page layout on 32-bit systems"" ... This reverts commit c34cd7750e. Bring back the commit in 5.10.38 that broke the kabi. Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I570fc31f9e1f196136bbbef479fb2413011ddf0e	2021-06-04 11:15:16 -07:00
Greg Kroah-Hartman	c5d480cd47	Merge 5.10.42 into android12-5.10 ... Changes in 5.10.42 ALSA: hda/realtek: the bass speaker can't output sound on Yoga 9i ALSA: hda/realtek: Headphone volume is controlled by Front mixer ALSA: hda/realtek: Chain in pop reduction fixup for ThinkStation P340 ALSA: hda/realtek: fix mute/micmute LEDs for HP 855 G8 ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP Zbook G8 ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP Zbook Fury 15 G8 ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP Zbook Fury 17 G8 ALSA: usb-audio: scarlett2: Fix device hang with ehci-pci ALSA: usb-audio: scarlett2: Improve driver startup messages cifs: set server->cipher_type to AES-128-CCM for SMB3.0 NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return() iommu/vt-d: Fix sysfs leak in alloc_iommu() perf intel-pt: Fix sample instruction bytes perf intel-pt: Fix transaction abort handling perf scripts python: exported-sql-viewer.py: Fix copy to clipboard from Top Calls by elapsed Time report perf scripts python: exported-sql-viewer.py: Fix Array TypeError perf scripts python: exported-sql-viewer.py: Fix warning display proc: Check /proc/$pid/attr/ writes against file opener net: hso: fix control-request directions net/sched: fq_pie: re-factor fix for fq_pie endless loop net/sched: fq_pie: fix OOB access in the traffic path netfilter: nft_set_pipapo_avx2: Add irq_fpu_usable() check, fallback to non-AVX2 version mac80211: assure all fragments are encrypted mac80211: prevent mixed key and fragment cache attacks mac80211: properly handle A-MSDUs that start with an RFC 1042 header cfg80211: mitigate A-MSDU aggregation attacks mac80211: drop A-MSDUs on old ciphers mac80211: add fragment cache to sta_info mac80211: check defrag PN against current frame mac80211: prevent attacks on TKIP/WEP as well mac80211: do not accept/forward invalid EAPOL frames mac80211: extend protection against mixed key and fragment cache attacks ath10k: add CCMP PN replay protection for fragmented frames for PCIe ath10k: drop fragments with multicast DA for PCIe ath10k: drop fragments with multicast DA for SDIO ath10k: drop MPDU which has discard flag set by firmware for SDIO ath10k: Fix TKIP Michael MIC verification for PCIe ath10k: Validate first subframe of A-MSDU before processing the list ath11k: Clear the fragment cache during key install dm snapshot: properly fix a crash when an origin has no snapshots drm/amd/pm: correct MGpuFanBoost setting drm/amdgpu/vcn1: add cancel_delayed_work_sync before power gate drm/amdkfd: correct sienna_cichlid SDMA RLC register offset error drm/amdgpu/vcn2.0: add cancel_delayed_work_sync before power gate drm/amdgpu/vcn2.5: add cancel_delayed_work_sync before power gate drm/amdgpu/jpeg2.0: add cancel_delayed_work_sync before power gate selftests/gpio: Use TEST_GEN_PROGS_EXTENDED selftests/gpio: Move include of lib.mk up selftests/gpio: Fix build when source tree is read only kgdb: fix gcc-11 warnings harder Documentation: seccomp: Fix user notification documentation seccomp: Refactor notification handler to prepare for new semantics serial: core: fix suspicious security_locked_down() call misc/uss720: fix memory leak in uss720_probe thunderbolt: usb4: Fix NVM read buffer bounds and offset issue thunderbolt: dma_port: Fix NVM read buffer bounds and offset issue KVM: X86: Fix vCPU preempted state from guest's point of view KVM: arm64: Prevent mixed-width VM creation mei: request autosuspend after sending rx flow control staging: iio: cdc: ad7746: avoid overwrite of num_channels iio: gyro: fxas21002c: balance runtime power in error path iio: dac: ad5770r: Put fwnode in error case during ->probe() iio: adc: ad7768-1: Fix too small buffer passed to iio_push_to_buffers_with_timestamp() iio: adc: ad7124: Fix missbalanced regulator enable / disable on error. iio: adc: ad7124: Fix potential overflow due to non sequential channel numbers iio: adc: ad7923: Fix undersized rx buffer. iio: adc: ad7793: Add missing error code in ad7793_setup() iio: adc: ad7192: Avoid disabling a clock that was never enabled. iio: adc: ad7192: handle regulator voltage error first serial: 8250: Add UART_BUG_TXRACE workaround for Aspeed VUART serial: 8250_dw: Add device HID for new AMD UART controller serial: 8250_pci: Add support for new HPE serial device serial: 8250_pci: handle FL_NOIRQ board flag USB: trancevibrator: fix control-request direction Revert "irqbypass: do not start cons/prod when failed connect" USB: usbfs: Don't WARN about excessively large memory allocations drivers: base: Fix device link removal serial: tegra: Fix a mask operation that is always true serial: sh-sci: Fix off-by-one error in FIFO threshold register setting serial: rp2: use 'request_firmware' instead of 'request_firmware_nowait' USB: serial: ti_usb_3410_5052: add startech.com device id USB: serial: option: add Telit LE910-S1 compositions 0x7010, 0x7011 USB: serial: ftdi_sio: add IDs for IDS GmbH Products USB: serial: pl2303: add device id for ADLINK ND-6530 GC thermal/drivers/intel: Initialize RW trip to THERMAL_TEMP_INVALID usb: dwc3: gadget: Properly track pending and queued SG usb: gadget: udc: renesas_usb3: Fix a race in usb3_start_pipen() usb: typec: mux: Fix matching with typec_altmode_desc net: usb: fix memory leak in smsc75xx_bind Bluetooth: cmtp: fix file refcount when cmtp_attach_device fails fs/nfs: Use fatal_signal_pending instead of signal_pending NFS: fix an incorrect limit in filelayout_decode_layout() NFS: Fix an Oopsable condition in __nfs_pageio_add_request() NFS: Don't corrupt the value of pg_bytes_written in nfs_do_recoalesce() NFSv4: Fix v4.0/v4.1 SEEK_DATA return -ENOTSUPP when set NFS_V4_2 config drm/meson: fix shutdown crash when component not probed net/mlx5e: reset XPS on error flow if netdev isn't registered yet net/mlx5e: Fix multipath lag activation net/mlx5e: Fix error path of updating netdev queues {net,vdpa}/mlx5: Configure interface MAC into mpfs L2 table net/mlx5e: Fix nullptr in add_vlan_push_action() net/mlx5: Set reformat action when needed for termination rules net/mlx5e: Fix null deref accessing lag dev net/mlx4: Fix EEPROM dump support net/mlx5: Set term table as an unmanaged flow table SUNRPC in case of backlog, hand free slots directly to waiting task Revert "net:tipc: Fix a double free in tipc_sk_mcast_rcv" tipc: wait and exit until all work queues are done tipc: skb_linearize the head skb when reassembling msgs spi: spi-fsl-dspi: Fix a resource leak in an error handling path netfilter: flowtable: Remove redundant hw refresh bit net: dsa: mt7530: fix VLAN traffic leaks net: dsa: fix a crash if ->get_sset_count() fails net: dsa: sja1105: update existing VLANs from the bridge VLAN list net: dsa: sja1105: use 4095 as the private VLAN for untagged traffic net: dsa: sja1105: error out on unsupported PHY mode net: dsa: sja1105: add error handling in sja1105_setup() net: dsa: sja1105: call dsa_unregister_switch when allocating memory fails net: dsa: sja1105: fix VL lookup command packing for P/Q/R/S i2c: s3c2410: fix possible NULL pointer deref on read message after write i2c: mediatek: Disable i2c start_en and clear intr_stat brfore reset i2c: i801: Don't generate an interrupt on bus reset i2c: sh_mobile: Use new clock calculation formulas for RZ/G2E afs: Fix the nlink handling of dir-over-dir rename perf jevents: Fix getting maximum number of fds nvmet-tcp: fix inline data size comparison in nvmet_tcp_queue_response mptcp: avoid error message on infinite mapping mptcp: drop unconditional pr_warn on bad opt mptcp: fix data stream corruption platform/x86: hp_accel: Avoid invoking _INI to speed up resume gpio: cadence: Add missing MODULE_DEVICE_TABLE Revert "crypto: cavium/nitrox - add an error message to explain the failure of pci_request_mem_regions" Revert "media: usb: gspca: add a missed check for goto_low_power" Revert "ALSA: sb: fix a missing check of snd_ctl_add" Revert "serial: max310x: pass return value of spi_register_driver" serial: max310x: unregister uart driver in case of failure and abort Revert "net: fujitsu: fix a potential NULL pointer dereference" net: fujitsu: fix potential null-ptr-deref Revert "net/smc: fix a NULL pointer dereference" net/smc: properly handle workqueue allocation failure Revert "net: caif: replace BUG_ON with recovery code" net: caif: remove BUG_ON(dev == NULL) in caif_xmit Revert "char: hpet: fix a missing check of ioremap" char: hpet: add checks after calling ioremap Revert "ALSA: gus: add a check of the status of snd_ctl_add" Revert "ALSA: usx2y: Fix potential NULL pointer dereference" Revert "isdn: mISDNinfineon: fix potential NULL pointer dereference" isdn: mISDNinfineon: check/cleanup ioremap failure correctly in setup_io Revert "ath6kl: return error code in ath6kl_wmi_set_roam_lrssi_cmd()" ath6kl: return error code in ath6kl_wmi_set_roam_lrssi_cmd() Revert "isdn: mISDN: Fix potential NULL pointer dereference of kzalloc" isdn: mISDN: correctly handle ph_info allocation failure in hfcsusb_ph_info Revert "dmaengine: qcom_hidma: Check for driver register failure" dmaengine: qcom_hidma: comment platform_driver_register call Revert "libertas: add checks for the return value of sysfs_create_group" libertas: register sysfs groups properly Revert "ASoC: cs43130: fix a NULL pointer dereference" ASoC: cs43130: handle errors in cs43130_probe() properly Revert "media: dvb: Add check on sp8870_readreg" media: dvb: Add check on sp8870_readreg return Revert "media: gspca: mt9m111: Check write_bridge for timeout" media: gspca: mt9m111: Check write_bridge for timeout Revert "media: gspca: Check the return value of write_bridge for timeout" media: gspca: properly check for errors in po1030_probe() Revert "net: liquidio: fix a NULL pointer dereference" net: liquidio: Add missing null pointer checks Revert "brcmfmac: add a check for the status of usb_register" brcmfmac: properly check for bus register errors btrfs: return whole extents in fiemap scsi: ufs: ufs-mediatek: Fix power down spec violation scsi: BusLogic: Fix 64-bit system enumeration error for Buslogic openrisc: Define memory barrier mb scsi: pm80xx: Fix drives missing during rmmod/insmod loop btrfs: release path before starting transaction when cloning inline extent btrfs: do not BUG_ON in link_to_fixup_dir platform/x86: hp-wireless: add AMD's hardware id to the supported list platform/x86: intel_punit_ipc: Append MODULE_DEVICE_TABLE for ACPI platform/x86: touchscreen_dmi: Add info for the Mediacom Winpad 7.0 W700 tablet SMB3: incorrect file id in requests compounded with open drm/amd/display: Disconnect non-DP with no EDID drm/amd/amdgpu: fix refcount leak drm/amdgpu: Fix a use-after-free drm/amd/amdgpu: fix a potential deadlock in gpu reset drm/amdgpu: stop touching sched.ready in the backend platform/x86: touchscreen_dmi: Add info for the Chuwi Hi10 Pro (CWI529) tablet block: fix a race between del_gendisk and BLKRRPART linux/bits.h: fix compilation error with GENMASK net: netcp: Fix an error message net: dsa: fix error code getting shifted with 4 in dsa_slave_get_sset_count interconnect: qcom: bcm-voter: add a missing of_node_put() interconnect: qcom: Add missing MODULE_DEVICE_TABLE ASoC: cs42l42: Regmap must use_single_read/write net: stmmac: Fix MAC WoL not working if PHY does not support WoL net: ipa: memory region array is variable size vfio-ccw: Check initialized flag in cp_init() spi: Assume GPIO CS active high in ACPI case net: really orphan skbs tied to closing sk net: packetmmap: fix only tx timestamp on request net: fec: fix the potential memory leak in fec_enet_init() chelsio/chtls: unlock on error in chtls_pt_recvmsg() net: mdio: thunder: Fix a double free issue in the .remove function net: mdio: octeon: Fix some double free issues cxgb4/ch_ktls: Clear resources when pf4 device is removed openvswitch: meter: fix race when getting now_ms. tls splice: check SPLICE_F_NONBLOCK instead of MSG_DONTWAIT net: sched: fix packet stuck problem for lockless qdisc net: sched: fix tx action rescheduling issue during deactivation net: sched: fix tx action reschedule issue with stopped queue net: hso: check for allocation failure in hso_create_bulk_serial_device() net: bnx2: Fix error return code in bnx2_init_board() bnxt_en: Include new P5 HV definition in VF check. bnxt_en: Fix context memory setup for 64K page size. mld: fix panic in mld_newpack() net/smc: remove device from smcd_dev_list after failed device_add() gve: Check TX QPL was actually assigned gve: Update mgmt_msix_idx if num_ntfy changes gve: Add NULL pointer checks when freeing irqs. gve: Upgrade memory barrier in poll routine gve: Correct SKB queue index validation. iommu/virtio: Add missing MODULE_DEVICE_TABLE net: hns3: fix incorrect resp_msg issue net: hns3: put off calling register_netdev() until client initialize complete iommu/vt-d: Use user privilege for RID2PASID translation cxgb4: avoid accessing registers when clearing filters staging: emxx_udc: fix loop in _nbu2ss_nuke() ASoC: cs35l33: fix an error code in probe() bpf, offload: Reorder offload callback 'prepare' in verifier bpf: Set mac_len in bpf_skb_change_head ixgbe: fix large MTU request from VF ASoC: qcom: lpass-cpu: Use optional clk APIs scsi: libsas: Use _safe() loop in sas_resume_port() net: lantiq: fix memory corruption in RX ring ipv6: record frag_max_size in atomic fragments in input path ALSA: usb-audio: scarlett2: snd_scarlett_gen2_controls_create() can be static net: ethernet: mtk_eth_soc: Fix packet statistics support for MT7628/88 sch_dsmark: fix a NULL deref in qdisc_reset() net: hsr: fix mac_len checks MIPS: alchemy: xxs1500: add gpio-au1000.h header file MIPS: ralink: export rt_sysc_membase for rt2880_wdt.c net: zero-initialize tc skb extension on allocation net: mvpp2: add buffer header handling in RX i915: fix build warning in intel_dp_get_link_status() samples/bpf: Consider frame size in tx_only of xdpsock sample net: hns3: check the return of skb_checksum_help() bpftool: Add sock_release help info for cgroup attach/prog load command SUNRPC: More fixes for backlog congestion Revert "Revert "ALSA: usx2y: Fix potential NULL pointer dereference"" net: hso: bail out on interrupt URB allocation failure scripts/clang-tools: switch explicitly to Python 3 neighbour: Prevent Race condition in neighbour subsytem usb: core: reduce power-on-good delay time of root hub Linux 5.10.42 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I05d98d1355a080e0951b4b2ae77f0a9ccb6dfc5d	2021-06-03 18:47:38 +02:00
Vlad Buslov	ac493452e9	net: zero-initialize tc skb extension on allocation ... [ Upstream commit 9453d45ecb ] Function skb_ext_add() doesn't initialize created skb extension with any value and leaves it up to the user. However, since extension of type TC_SKB_EXT originally contained only single value tc_skb_ext->chain its users used to just assign the chain value without setting whole extension memory to zero first. This assumption changed when TC_SKB_EXT extension was extended with additional fields but not all users were updated to initialize the new fields which leads to use of uninitialized memory afterwards. UBSAN log: [ 778.299821] UBSAN: invalid-load in net/openvswitch/flow.c:899:28 [ 778.301495] load of value 107 is not a valid value for type '_Bool' [ 778.303215] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.12.0-rc7+ #2 [ 778.304933] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 778.307901] Call Trace: [ 778.308680] <IRQ> [ 778.309358] dump_stack+0xbb/0x107 [ 778.310307] ubsan_epilogue+0x5/0x40 [ 778.311167] __ubsan_handle_load_invalid_value.cold+0x43/0x48 [ 778.312454] ? memset+0x20/0x40 [ 778.313230] ovs_flow_key_extract.cold+0xf/0x14 [openvswitch] [ 778.314532] ovs_vport_receive+0x19e/0x2e0 [openvswitch] [ 778.315749] ? ovs_vport_find_upcall_portid+0x330/0x330 [openvswitch] [ 778.317188] ? create_prof_cpu_mask+0x20/0x20 [ 778.318220] ? arch_stack_walk+0x82/0xf0 [ 778.319153] ? secondary_startup_64_no_verify+0xb0/0xbb [ 778.320399] ? stack_trace_save+0x91/0xc0 [ 778.321362] ? stack_trace_consume_entry+0x160/0x160 [ 778.322517] ? lock_release+0x52e/0x760 [ 778.323444] netdev_frame_hook+0x323/0x610 [openvswitch] [ 778.324668] ? ovs_netdev_get_vport+0xe0/0xe0 [openvswitch] [ 778.325950] __netif_receive_skb_core+0x771/0x2db0 [ 778.327067] ? lock_downgrade+0x6e0/0x6f0 [ 778.328021] ? lock_acquire+0x565/0x720 [ 778.328940] ? generic_xdp_tx+0x4f0/0x4f0 [ 778.329902] ? inet_gro_receive+0x2a7/0x10a0 [ 778.330914] ? lock_downgrade+0x6f0/0x6f0 [ 778.331867] ? udp4_gro_receive+0x4c4/0x13e0 [ 778.332876] ? lock_release+0x52e/0x760 [ 778.333808] ? dev_gro_receive+0xcc8/0x2380 [ 778.334810] ? lock_downgrade+0x6f0/0x6f0 [ 778.335769] __netif_receive_skb_list_core+0x295/0x820 [ 778.336955] ? process_backlog+0x780/0x780 [ 778.337941] ? mlx5e_rep_tc_netdevice_event_unregister+0x20/0x20 [mlx5_core] [ 778.339613] ? seqcount_lockdep_reader_access.constprop.0+0xa7/0xc0 [ 778.341033] ? kvm_clock_get_cycles+0x14/0x20 [ 778.342072] netif_receive_skb_list_internal+0x5f5/0xcb0 [ 778.343288] ? __kasan_kmalloc+0x7a/0x90 [ 778.344234] ? mlx5e_handle_rx_cqe_mpwrq+0x9e0/0x9e0 [mlx5_core] [ 778.345676] ? mlx5e_xmit_xdp_frame_mpwqe+0x14d0/0x14d0 [mlx5_core] [ 778.347140] ? __netif_receive_skb_list_core+0x820/0x820 [ 778.348351] ? mlx5e_post_rx_mpwqes+0xa6/0x25d0 [mlx5_core] [ 778.349688] ? napi_gro_flush+0x26c/0x3c0 [ 778.350641] napi_complete_done+0x188/0x6b0 [ 778.351627] mlx5e_napi_poll+0x373/0x1b80 [mlx5_core] [ 778.352853] __napi_poll+0x9f/0x510 [ 778.353704] ? mlx5_flow_namespace_set_mode+0x260/0x260 [mlx5_core] [ 778.355158] net_rx_action+0x34c/0xa40 [ 778.356060] ? napi_threaded_poll+0x3d0/0x3d0 [ 778.357083] ? sched_clock_cpu+0x18/0x190 [ 778.358041] ? __common_interrupt+0x8e/0x1a0 [ 778.359045] __do_softirq+0x1ce/0x984 [ 778.359938] __irq_exit_rcu+0x137/0x1d0 [ 778.360865] irq_exit_rcu+0xa/0x20 [ 778.361708] common_interrupt+0x80/0xa0 [ 778.362640] </IRQ> [ 778.363212] asm_common_interrupt+0x1e/0x40 [ 778.364204] RIP: 0010:native_safe_halt+0xe/0x10 [ 778.365273] Code: 4f ff ff ff 4c 89 e7 e8 50 3f 40 fe e9 dc fe ff ff 48 89 df e8 43 3f 40 fe eb 90 cc e9 07 00 00 00 0f 00 2d 74 05 62 00 fb f4 <c3> 90 e9 07 00 00 00 0f 00 2d 64 05 62 00 f4 c3 cc cc 0f 1f 44 00 [ 778.369355] RSP: 0018:ffffffff84407e48 EFLAGS: 00000246 [ 778.370570] RAX: ffff88842de46a80 RBX: ffffffff84425840 RCX: ffffffff83418468 [ 778.372143] RDX: 000000000026f1da RSI: 0000000000000004 RDI: ffffffff8343af5e [ 778.373722] RBP: fffffbfff0884b08 R08: 0000000000000000 R09: ffff88842de46bcb [ 778.375292] R10: ffffed1085bc8d79 R11: 0000000000000001 R12: 0000000000000000 [ 778.376860] R13: ffffffff851124a0 R14: 0000000000000000 R15: dffffc0000000000 [ 778.378491] ? rcu_eqs_enter.constprop.0+0xb8/0xe0 [ 778.379606] ? default_idle_call+0x5e/0xe0 [ 778.380578] default_idle+0xa/0x10 [ 778.381406] default_idle_call+0x96/0xe0 [ 778.382350] do_idle+0x3d4/0x550 [ 778.383153] ? arch_cpu_idle_exit+0x40/0x40 [ 778.384143] cpu_startup_entry+0x19/0x20 [ 778.385078] start_kernel+0x3c7/0x3e5 [ 778.385978] secondary_startup_64_no_verify+0xb0/0xbb Fix the issue by providing new function tc_skb_ext_alloc() that allocates tc skb extension and initializes its memory to 0 before returning it to the caller. Change all existing users to use new API instead of calling skb_ext_add() directly. Fixes: 038ebb1a71 ("net/sched: act_ct: fix miss set mru for ovs after defrag in act_ct") Fixes: d29334c15d ("net/sched: act_api: fix miss set post_ct for ovs after do conntrack in act_ct") Signed-off-by: Vlad Buslov <vladbu@nvidia.com> Acked-by: Cong Wang <cong.wang@bytedance.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-06-03 09:00:51 +02:00
Yunsheng Lin	2f23d5bcd9	net: sched: fix tx action rescheduling issue during deactivation ... [ Upstream commit 102b55ee92 ] Currently qdisc_run() checks the STATE_DEACTIVATED of lockless qdisc before calling __qdisc_run(), which ultimately clear the STATE_MISSED when all the skb is dequeued. If STATE_DEACTIVATED is set before clearing STATE_MISSED, there may be rescheduling of net_tx_action() at the end of qdisc_run_end(), see below: CPU0(net_tx_atcion) CPU1(__dev_xmit_skb) CPU2(dev_deactivate) . . . . set STATE_MISSED . . __netif_schedule() . . . set STATE_DEACTIVATED . . qdisc_reset() . . . .<--------------- . synchronize_net() clear __QDISC_STATE_SCHED | . . . | . . . | . some_qdisc_is_busy() . | . return *false* . | . . test STATE_DEACTIVATED | . . __qdisc_run() *not* called | . . . | . . test STATE_MISS | . . __netif_schedule()--------| . . . . . . . . __qdisc_run() is not called by net_tx_atcion() in CPU0 because CPU2 has set STATE_DEACTIVATED flag during dev_deactivate(), and STATE_MISSED is only cleared in __qdisc_run(), __netif_schedule is called at the end of qdisc_run_end(), causing tx action rescheduling problem. qdisc_run() called by net_tx_action() runs in the softirq context, which should has the same semantic as the qdisc_run() called by __dev_xmit_skb() protected by rcu_read_lock_bh(). And there is a synchronize_net() between STATE_DEACTIVATED flag being set and qdisc_reset()/some_qdisc_is_busy in dev_deactivate(), we can safely bail out for the deactived lockless qdisc in net_tx_action(), and qdisc_reset() will reset all skb not dequeued yet. So add the rcu_read_lock() explicitly to protect the qdisc_run() and do the STATE_DEACTIVATED checking in net_tx_action() before calling qdisc_run_begin(). Another option is to do the checking in the qdisc_run_end(), but it will add unnecessary overhead for non-tx_action case, because __dev_queue_xmit() will not see qdisc with STATE_DEACTIVATED after synchronize_net(), the qdisc with STATE_DEACTIVATED can only be seen by net_tx_action() because of __netif_schedule(). The STATE_DEACTIVATED checking in qdisc_run() is to avoid race between net_tx_action() and qdisc_reset(), see: commit d518d2ed86 ("net/sched: fix race between deactivation and dequeue for NOLOCK qdisc"). As the bailout added above for deactived lockless qdisc in net_tx_action() provides better protection for the race without calling qdisc_run() at all, so remove the STATE_DEACTIVATED checking in qdisc_run(). After qdisc_reset(), there is no skb in qdisc to be dequeued, so clear the STATE_MISSED in dev_reset_queue() too. Fixes: 6b3ba9146f ("net: sched: allow qdiscs to handle locking") Acked-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com> V8: Clearing STATE_MISSED before calling __netif_schedule() has avoid the endless rescheduling problem, but there may still be a unnecessary rescheduling, so adjust the commit log. Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-06-03 09:00:47 +02:00
Yunsheng Lin	21c7151092	net: sched: fix packet stuck problem for lockless qdisc ... [ Upstream commit a90c57f2ce ] Lockless qdisc has below concurrent problem: cpu0 cpu1 . . q->enqueue . . . qdisc_run_begin() . . . dequeue_skb() . . . sch_direct_xmit() . . . . q->enqueue . qdisc_run_begin() . return and do nothing . . qdisc_run_end() . cpu1 enqueue a skb without calling __qdisc_run() because cpu0 has not released the lock yet and spin_trylock() return false for cpu1 in qdisc_run_begin(), and cpu0 do not see the skb enqueued by cpu1 when calling dequeue_skb() because cpu1 may enqueue the skb after cpu0 calling dequeue_skb() and before cpu0 calling qdisc_run_end(). Lockless qdisc has below another concurrent problem when tx_action is involved: cpu0(serving tx_action) cpu1 cpu2 . . . . q->enqueue . . qdisc_run_begin() . . dequeue_skb() . . . q->enqueue . . . . sch_direct_xmit() . . . qdisc_run_begin() . . return and do nothing . . . clear __QDISC_STATE_SCHED . . qdisc_run_begin() . . return and do nothing . . . . . . qdisc_run_end() . This patch fixes the above data race by: 1. If the first spin_trylock() return false and STATE_MISSED is not set, set STATE_MISSED and retry another spin_trylock() in case other CPU may not see STATE_MISSED after it releases the lock. 2. reschedule if STATE_MISSED is set after the lock is released at the end of qdisc_run_end(). For tx_action case, STATE_MISSED is also set when cpu1 is at the end if qdisc_run_end(), so tx_action will be rescheduled again to dequeue the skb enqueued by cpu2. Clear STATE_MISSED before retrying a dequeuing when dequeuing returns NULL in order to reduce the overhead of the second spin_trylock() and __netif_schedule() calling. Also clear the STATE_MISSED before calling __netif_schedule() at the end of qdisc_run_end() to avoid doing another round of dequeuing in the pfifo_fast_dequeue(). The performance impact of this patch, tested using pktgen and dummy netdev with pfifo_fast qdisc attached: threads without+this_patch with+this_patch delta 1 2.61Mpps 2.60Mpps -0.3% 2 3.97Mpps 3.82Mpps -3.7% 4 5.62Mpps 5.59Mpps -0.5% 8 2.78Mpps 2.77Mpps -0.3% 16 2.22Mpps 2.22Mpps -0.0% Fixes: 6b3ba9146f ("net: sched: allow qdiscs to handle locking") Acked-by: Jakub Kicinski <kuba@kernel.org> Tested-by: Juergen Gross <jgross@suse.com> Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-06-03 09:00:47 +02:00
Paolo Abeni	1f1b431a4f	net: really orphan skbs tied to closing sk ... [ Upstream commit 098116e7e6 ] If the owing socket is shutting down - e.g. the sock reference count already dropped to 0 and only sk_wmem_alloc is keeping the sock alive, skb_orphan_partial() becomes a no-op. When forwarding packets over veth with GRO enabled, the above causes refcount errors. This change addresses the issue with a plain skb_orphan() call in the critical scenario. Fixes: 9adc89af72 ("net: let skb_orphan_partial wake-up waiters.") Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-06-03 09:00:46 +02:00
Roi Dayan	6d6bc8c752	netfilter: flowtable: Remove redundant hw refresh bit ... commit c07531c01d upstream. Offloading conns could fail for multiple reasons and a hw refresh bit is set to try to reoffload it in next sw packet. But it could be in some cases and future points that the hw refresh bit is not set but a refresh could succeed. Remove the hw refresh bit and do offload refresh if requested. There won't be a new work entry if a work is already pending anyway as there is the hw pending bit. Fixes: 8b3646d6e0 ("net/sched: act_ct: Support refreshing the flow table entries") Signed-off-by: Roi Dayan <roid@nvidia.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-06-03 09:00:37 +02:00
Mathy Vanhoef	e3561d5af0	mac80211: properly handle A-MSDUs that start with an RFC 1042 header ... commit a1d5ff5651 upstream. Properly parse A-MSDUs whose first 6 bytes happen to equal a rfc1042 header. This can occur in practice when the destination MAC address equals AA:AA:03:00:00:00. More importantly, this simplifies the next patch to mitigate A-MSDU injection attacks. Cc: stable@vger.kernel.org Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@kuleuven.be> Link: https://lore.kernel.org/r/20210511200110.0b2b886492f0.I23dd5d685fe16d3b0ec8106e8f01b59f499dffed@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-06-03 09:00:29 +02:00
Greg Kroah-Hartman	12b1e5746c	This is the 5.10.41 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmCw0WEACgkQONu9yGCS aT5K6RAAphIxwnUhvm1gBe+lzNOsp6ZURXMIT6hANhUdCU21Tw6agLGRELOJ+YNQ agLdWb3auH1ufGV0wUtUJYbLa3lYF6uuU53BZb2i9iJ+1X2igzGwtVN/lEdcZs4G R6hD8W5Rxiam5K7KAgYZLpSA5bS3ETrfsbJ2kddIGGSH1BHnwrManXOan1U9mY99 HDf+ksPCF2iA8Zqqq5Hx2g9Nuf0x0vyZ+6cob2QdJVq5ZnZXwamC498zmi/vGkGj fPSxjaBMR9kDMQhUmvgSmAieM0UrrsPIkOxsWWCz/Lo4qhTG8+ccyHmplnsvvsyz R3LEdq0YK3vMTypi7RfdxaEeB1a5d8cTV4JYZBs/eOU45lBVKZ+IKp1KJjTqtshy Oj7LnNtONUfPNfXki+AgW7zGTPUJqK3hxW5j87Qg0MKe1i7CrAxmKhDcWX23acYG 5jBlUGX8vrYycdjvGCC7m/+T1NptVi/9UbcTi22au8hSwtKokn6AdTifTNfjst7H 4UMslyD5EA1Js17eObk/04kB0iMp9RSIEtc8DOV3cHZWAu3gK6pKe+RBL4uZ/K7Q Wr8+gqlGyjg89NMjwoyXYaCTRkEwDcSSjKXzbfX1Pqjbujc/I7MLiLlPoen4Pe2i v4aftEYPa4SHznutCQmLqRghFUfsxkRJKYVoo+SvKbhK7dE92O4= =KKY2 -----END PGP SIGNATURE----- Merge 5.10.41 into android12-5.10 Changes in 5.10.41 bpf: Wrap aux data inside bpf_sanitize_info container bpf: Fix mask direction swap upon off reg sign change bpf: No need to simulate speculative domain for immediates context_tracking: Move guest exit context tracking to separate helpers context_tracking: Move guest exit vtime accounting to separate helpers KVM: x86: Defer vtime accounting 'til after IRQ handling perf unwind: Fix separate debug info files when using elfutils' libdw's unwinder perf unwind: Set userdata for all __report_module() paths NFC: nci: fix memory leak in nci_allocate_device Linux 5.10.41 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ie9f14d4b9960fb923eb01303517012fe6274d5ef	2021-05-28 13:28:25 +02:00
Dongliang Mu	b34cb7ac32	NFC: nci: fix memory leak in nci_allocate_device ... commit e0652f8bb4 upstream. nfcmrvl_disconnect fails to free the hci_dev field in struct nci_dev. Fix this by freeing hci_dev in nci_free_device. BUG: memory leak unreferenced object 0xffff888111ea6800 (size 1024): comm "kworker/1:0", pid 19, jiffies 4294942308 (age 13.580s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 60 fd 0c 81 88 ff ff .........`...... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000004bc25d43>] kmalloc include/linux/slab.h:552 [inline] [<000000004bc25d43>] kzalloc include/linux/slab.h:682 [inline] [<000000004bc25d43>] nci_hci_allocate+0x21/0xd0 net/nfc/nci/hci.c:784 [<00000000c59cff92>] nci_allocate_device net/nfc/nci/core.c:1170 [inline] [<00000000c59cff92>] nci_allocate_device+0x10b/0x160 net/nfc/nci/core.c:1132 [<00000000006e0a8e>] nfcmrvl_nci_register_dev+0x10a/0x1c0 drivers/nfc/nfcmrvl/main.c:153 [<000000004da1b57e>] nfcmrvl_probe+0x223/0x290 drivers/nfc/nfcmrvl/usb.c:345 [<00000000d506aed9>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396 [<00000000bc632c92>] really_probe+0x159/0x4a0 drivers/base/dd.c:554 [<00000000f5009125>] driver_probe_device+0x84/0x100 drivers/base/dd.c:740 [<000000000ce658ca>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:846 [<000000007067d05f>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431 [<00000000f8e13372>] __device_attach+0x122/0x250 drivers/base/dd.c:914 [<000000009cf68860>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491 [<00000000359c965a>] device_add+0x5be/0xc30 drivers/base/core.c:3109 [<00000000086e4bd3>] usb_set_configuration+0x9d9/0xb90 drivers/usb/core/message.c:2164 [<00000000ca036872>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238 [<00000000d40d36f6>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293 [<00000000bc632c92>] really_probe+0x159/0x4a0 drivers/base/dd.c:554 Reported-by: syzbot+19bcfc64a8df1318d1c3@syzkaller.appspotmail.com Fixes: 11f54f2286 ("NFC: nci: Add HCI over NCI protocol support") Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-05-28 13:17:43 +02:00
Greg Kroah-Hartman	c34cd7750e	Revert "mm: fix struct page layout on 32-bit systems" ... This reverts commit cfddf6a685 as it breaks the kernel abi at the moment. It will be restored at a later point in time. Bug: 161946584 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ic4dd11b89bcfd8ded25e4cb39f16967b22f5fa88	2021-05-20 15:35:26 +02:00
Greg Kroah-Hartman	76002c201f	Merge 5.10.38 into android12-5.10 ... Changes in 5.10.38 KEYS: trusted: Fix memory leak on object td tpm: fix error return code in tpm2_get_cc_attrs_tbl() tpm, tpm_tis: Extend locality handling to TPM2 in tpm_tis_gen_interrupt() tpm, tpm_tis: Reserve locality in tpm_tis_resume() KVM: x86/mmu: Remove the defunct update_pte() paging hook KVM/VMX: Invoke NMI non-IST entry instead of IST entry ACPI: PM: Add ACPI ID of Alder Lake Fan PM: runtime: Fix unpaired parent child_count for force_resume cpufreq: intel_pstate: Use HWP if enabled by platform firmware kvm: Cap halt polling at kvm->max_halt_poll_ns ath11k: fix thermal temperature read fs: dlm: fix debugfs dump fs: dlm: add errno handling to check callback fs: dlm: check on minimum msglen size fs: dlm: flush swork on shutdown tipc: convert dest node's address to network order ASoC: Intel: bytcr_rt5640: Enable jack-detect support on Asus T100TAF net/mlx5e: Use net_prefetchw instead of prefetchw in MPWQE TX datapath net: stmmac: Set FIFO sizes for ipq806x ASoC: rsnd: core: Check convert rate in rsnd_hw_params Bluetooth: Fix incorrect status handling in LE PHY UPDATE event i2c: bail out early when RDWR parameters are wrong ALSA: hdsp: don't disable if not enabled ALSA: hdspm: don't disable if not enabled ALSA: rme9652: don't disable if not enabled ALSA: bebob: enable to deliver MIDI messages for multiple ports Bluetooth: Set CONF_NOT_COMPLETE as l2cap_chan default Bluetooth: initialize skb_queue_head at l2cap_chan_create() net/sched: cls_flower: use ntohs for struct flow_dissector_key_ports net: bridge: when suppression is enabled exclude RARP packets Bluetooth: check for zapped sk before connecting selftests/powerpc: Fix L1D flushing tests for Power10 powerpc/32: Statically initialise first emergency context net: hns3: remediate a potential overflow risk of bd_num_list net: hns3: add handling for xmit skb with recursive fraglist ip6_vti: proper dev_{hold|put} in ndo_[un]init methods ASoC: Intel: bytcr_rt5640: Add quirk for the Chuwi Hi8 tablet ice: handle increasing Tx or Rx ring sizes Bluetooth: btusb: Enable quirk boolean flag for Mediatek Chip. ASoC: rt5670: Add a quirk for the Dell Venue 10 Pro 5055 i2c: Add I2C_AQ_NO_REP_START adapter quirk MIPS: Loongson64: Use _CACHE_UNCACHED instead of _CACHE_UNCACHED_ACCELERATED coresight: Do not scan for graph if none is present IB/hfi1: Correct oversized ring allocation mac80211: clear the beacon's CRC after channel switch pinctrl: samsung: use 'int' for register masks in Exynos rtw88: 8822c: add LC calibration for RTL8822C mt76: mt7615: support loading EEPROM for MT7613BE mt76: mt76x0: disable GTK offloading mt76: mt7915: fix txpower init for TSSI off chips fuse: invalidate attrs when page writeback completes virtiofs: fix userns cuse: prevent clone iwlwifi: pcie: make cfg vs. trans_cfg more robust powerpc/mm: Add cond_resched() while removing hpte mappings ASoC: rsnd: call rsnd_ssi_master_clk_start() from rsnd_ssi_init() Revert "iommu/amd: Fix performance counter initialization" iommu/amd: Remove performance counter pre-initialization test drm/amd/display: Force vsync flip when reconfiguring MPCC selftests: Set CC to clang in lib.mk if LLVM is set kconfig: nconf: stop endless search loops ALSA: hda/realtek: Add quirk for Lenovo Ideapad S740 ASoC: Intel: sof_sdw: add quirk for new ADL-P Rvp ALSA: hda/hdmi: fix race in handling acomp ELD notification at resume sctp: Fix out-of-bounds warning in sctp_process_asconf_param() flow_dissector: Fix out-of-bounds warning in __skb_flow_bpf_to_target() powerpc/smp: Set numa node before updating mask ASoC: rt286: Generalize support for ALC3263 codec ethtool: ioctl: Fix out-of-bounds warning in store_link_ksettings_for_user() net: sched: tapr: prevent cycle_time == 0 in parse_taprio_schedule samples/bpf: Fix broken tracex1 due to kprobe argument change powerpc/pseries: Stop calling printk in rtas_stop_self() drm/amd/display: fixed divide by zero kernel crash during dsc enablement drm/amd/display: add handling for hdcp2 rx id list validation drm/amdgpu: Add mem sync flag for IB allocated by SA mt76: mt7615: fix entering driver-own state on mt7663 crypto: ccp: Free SEV device if SEV init fails wl3501_cs: Fix out-of-bounds warnings in wl3501_send_pkt wl3501_cs: Fix out-of-bounds warnings in wl3501_mgmt_join qtnfmac: Fix possible buffer overflow in qtnf_event_handle_external_auth powerpc/iommu: Annotate nested lock for lockdep iavf: remove duplicate free resources calls net: ethernet: mtk_eth_soc: fix RX VLAN offload selftests: mlxsw: Increase the tolerance of backlog buildup selftests: mlxsw: Fix mausezahn invocation in ERSPAN scale test kbuild: generate Module.symvers only when vmlinux exists bnxt_en: Add PCI IDs for Hyper-V VF devices. ia64: module: fix symbolizer crash on fdescr watchdog: rename __touch_watchdog() to a better descriptive name watchdog: explicitly update timestamp when reporting softlockup watchdog/softlockup: remove logic that tried to prevent repeated reports watchdog: fix barriers when printing backtraces from all CPUs ASoC: rt286: Make RT286_SET_GPIO_* readable and writable thermal: thermal_of: Fix error return code of thermal_of_populate_bind_params() f2fs: move ioctl interface definitions to separated file f2fs: fix compat F2FS_IOC_{MOVE,GARBAGE_COLLECT}_RANGE f2fs: fix to allow migrating fully valid segment f2fs: fix panic during f2fs_resize_fs() f2fs: fix a redundant call to f2fs_balance_fs if an error occurs remoteproc: qcom_q6v5_mss: Replace ioremap with memremap remoteproc: qcom_q6v5_mss: Validate p_filesz in ELF loader PCI: iproc: Fix return value of iproc_msi_irq_domain_alloc() PCI: Release OF node in pci_scan_device()'s error path ARM: 9064/1: hw_breakpoint: Do not directly check the event's overflow_handler hook f2fs: fix to align to section for fallocate() on pinned file f2fs: fix to update last i_size if fallocate partially succeeds PCI: endpoint: Make *_get_first_free_bar() take into account 64 bit BAR PCI: endpoint: Add helper API to get the 'next' unreserved BAR PCI: endpoint: Make *_free_bar() to return error codes on failure PCI: endpoint: Fix NULL pointer dereference for ->get_features() f2fs: fix to avoid touching checkpointed data in get_victim() f2fs: fix to cover __allocate_new_section() with curseg_lock f2fs: Fix a hungtask problem in atomic write f2fs: fix to avoid accessing invalid fio in f2fs_allocate_data_block() rpmsg: qcom_glink_native: fix error return code of qcom_glink_rx_data() NFS: nfs4_bitmask_adjust() must not change the server global bitmasks NFS: Fix attribute bitmask in _nfs42_proc_fallocate() NFSv4.2: Always flush out writes in nfs42_proc_fallocate() NFS: Deal correctly with attribute generation counter overflow PCI: endpoint: Fix missing destroy_workqueue() pNFS/flexfiles: fix incorrect size check in decode_nfs_fh() NFSv4.2 fix handling of sr_eof in SEEK's reply SUNRPC: Move fault injection call sites SUNRPC: Remove trace_xprt_transmit_queued SUNRPC: Handle major timeout in xprt_adjust_timeout() thermal/drivers/tsens: Fix missing put_device error NFSv4.x: Don't return NFS4ERR_NOMATCHING_LAYOUT if we're unmounting nfsd: ensure new clients break delegations rtc: fsl-ftm-alarm: add MODULE_TABLE() dmaengine: idxd: Fix potential null dereference on pointer status dmaengine: idxd: fix dma device lifetime dmaengine: idxd: fix cdev setup and free device lifetime issues SUNRPC: fix ternary sign expansion bug in tracing pwm: atmel: Fix duty cycle calculation in .get_state() xprtrdma: Avoid Receive Queue wrapping xprtrdma: Fix cwnd update ordering xprtrdma: rpcrdma_mr_pop() already does list_del_init() swiotlb: Fix the type of index ceph: fix inode leak on getattr error in __fh_to_dentry scsi: qla2xxx: Prevent PRLI in target mode scsi: ufs: core: Do not put UFS power into LPM if link is broken scsi: ufs: core: Cancel rpm_dev_flush_recheck_work during system suspend scsi: ufs: core: Narrow down fast path in system suspend path rtc: ds1307: Fix wday settings for rx8130 net: hns3: fix incorrect configuration for igu_egu_hw_err net: hns3: initialize the message content in hclge_get_link_mode() net: hns3: add check for HNS3_NIC_STATE_INITED in hns3_reset_notify_up_enet() net: hns3: fix for vxlan gpe tx checksum bug net: hns3: use netif_tx_disable to stop the transmit queue net: hns3: disable phy loopback setting in hclge_mac_start_phy sctp: do asoc update earlier in sctp_sf_do_dupcook_a RISC-V: Fix error code returned by riscv_hartid_to_cpuid() sunrpc: Fix misplaced barrier in call_decode libbpf: Fix signed overflow in ringbuf_process_ring block/rnbd-clt: Change queue_depth type in rnbd_clt_session to size_t block/rnbd-clt: Check the return value of the function rtrs_clt_query ethernet:enic: Fix a use after free bug in enic_hard_start_xmit sctp: fix a SCTP_MIB_CURRESTAB leak in sctp_sf_do_dupcook_b netfilter: xt_SECMARK: add new revision to fix structure layout xsk: Fix for xp_aligned_validate_desc() when len == chunk_size net: stmmac: Clear receive all(RA) bit when promiscuous mode is off drm/radeon: Fix off-by-one power_state index heap overwrite drm/radeon: Avoid power table parsing memory leaks arm64: entry: factor irq triage logic into macros arm64: entry: always set GIC_PRIO_PSR_I_SET during entry khugepaged: fix wrong result value for trace_mm_collapse_huge_page_isolate() mm/hugeltb: handle the error case in hugetlb_fix_reserve_counts() mm/migrate.c: fix potential indeterminate pte entry in migrate_vma_insert_page() ksm: fix potential missing rmap_item for stable_node mm/gup: check every subpage of a compound page during isolation mm/gup: return an error on migration failure mm/gup: check for isolation errors ethtool: fix missing NLM_F_MULTI flag when dumping net: fix nla_strcmp to handle more then one trailing null character smc: disallow TCP_ULP in smc_setsockopt() netfilter: nfnetlink_osf: Fix a missing skb_header_pointer() NULL check netfilter: nftables: Fix a memleak from userdata error path in new objects can: mcp251xfd: mcp251xfd_probe(): add missing can_rx_offload_del() in error path can: mcp251x: fix resume from sleep before interface was brought up can: m_can: m_can_tx_work_queue(): fix tx_skb race condition sched: Fix out-of-bound access in uclamp sched/fair: Fix unfairness caused by missing load decay fs/proc/generic.c: fix incorrect pde_is_permanent check kernel: kexec_file: fix error return code of kexec_calculate_store_digests() kernel/resource: make walk_system_ram_res() find all busy IORESOURCE_SYSTEM_RAM resources kernel/resource: make walk_mem_res() find all busy IORESOURCE_MEM resources netfilter: nftables: avoid overflows in nft_hash_buckets() i40e: fix broken XDP support i40e: Fix use-after-free in i40e_client_subtask() i40e: fix the restart auto-negotiation after FEC modified i40e: Fix PHY type identifiers for 2.5G and 5G adapters mptcp: fix splat when closing unaccepted socket f2fs: avoid unneeded data copy in f2fs_ioc_move_range() ARC: entry: fix off-by-one error in syscall number validation ARC: mm: PAE: use 40-bit physical page mask ARC: mm: Use max_high_pfn as a HIGHMEM zone border powerpc/64s: Fix crashes when toggling stf barrier powerpc/64s: Fix crashes when toggling entry flush barrier hfsplus: prevent corruption in shrinking truncate squashfs: fix divide error in calculate_skip() userfaultfd: release page in error path to avoid BUG_ON kasan: fix unit tests with CONFIG_UBSAN_LOCAL_BOUNDS enabled mm/hugetlb: fix F_SEAL_FUTURE_WRITE blk-iocost: fix weight updates of inner active iocgs arm64: mte: initialize RGSR_EL1.SEED in __cpu_setup arm64: Fix race condition on PG_dcache_clean in __sync_icache_dcache() btrfs: fix race leading to unpersisted data and metadata on fsync drm/radeon/dpm: Disable sclk switching on Oland when two 4K 60Hz monitors are connected drm/amd/display: Initialize attribute for hdcp_srm sysfs file drm/i915: Avoid div-by-zero on gen2 kvm: exit halt polling on need_resched() as well KVM: LAPIC: Accurately guarantee busy wait for timer to expire when using hv_timer drm/msm/dp: initialize audio_comp when audio starts KVM: x86: Cancel pvclock_gtod_work on module removal KVM: x86: Prevent deadlock against tk_core.seq dax: Add an enum for specifying dax wakup mode dax: Add a wakeup mode parameter to put_unlocked_entry() dax: Wake up all waiters after invalidating dax entry xen/unpopulated-alloc: consolidate pgmap manipulation xen/unpopulated-alloc: fix error return code in fill_list() perf tools: Fix dynamic libbpf link usb: dwc3: gadget: Free gadget structure only after freeing endpoints iio: light: gp2ap002: Fix rumtime PM imbalance on error iio: proximity: pulsedlight: Fix rumtime PM imbalance on error iio: hid-sensors: select IIO_TRIGGERED_BUFFER under HID_SENSOR_IIO_TRIGGER usb: fotg210-hcd: Fix an error message hwmon: (occ) Fix poll rate limiting usb: musb: Fix an error message ACPI: scan: Fix a memory leak in an error handling path kyber: fix out of bounds access when preempted nvmet: add lba to sect conversion helpers nvmet: fix inline bio check for bdev-ns nvmet-rdma: Fix NULL deref when SEND is completed with error f2fs: compress: fix to free compress page correctly f2fs: compress: fix race condition of overwrite vs truncate f2fs: compress: fix to assign cc.cluster_idx correctly nbd: Fix NULL pointer in flush_workqueue blk-mq: plug request for shared sbitmap blk-mq: Swap two calls in blk_mq_exit_queue() usb: dwc3: omap: improve extcon initialization usb: dwc3: pci: Enable usb2-gadget-lpm-disable for Intel Merrifield usb: xhci: Increase timeout for HC halt usb: dwc2: Fix gadget DMA unmap direction usb: core: hub: fix race condition about TRSMRCY of resume usb: dwc3: gadget: Enable suspend events usb: dwc3: gadget: Return success always for kick transfer in ep queue usb: typec: ucsi: Retrieve all the PDOs instead of just the first 4 usb: typec: ucsi: Put fwnode in any case during ->probe() xhci-pci: Allow host runtime PM as default for Intel Alder Lake xHCI xhci: Do not use GFP_KERNEL in (potentially) atomic context xhci: Add reset resume quirk for AMD xhci controller. iio: gyro: mpu3050: Fix reported temperature value iio: tsl2583: Fix division by a zero lux_val cdc-wdm: untangle a circular dependency between callback and softint xen/gntdev: fix gntdev_mmap() error exit path KVM: x86: Emulate RDPID only if RDTSCP is supported KVM: x86: Move RDPID emulation intercept to its own enum KVM: nVMX: Always make an attempt to map eVMCS after migration KVM: VMX: Do not advertise RDPID if ENABLE_RDTSCP control is unsupported KVM: VMX: Disable preemption when probing user return MSRs Revert "iommu/vt-d: Remove WO permissions on second-level paging entries" Revert "iommu/vt-d: Preset Access/Dirty bits for IOVA over FL" iommu/vt-d: Preset Access/Dirty bits for IOVA over FL iommu/vt-d: Remove WO permissions on second-level paging entries mm: fix struct page layout on 32-bit systems MIPS: Reinstate platform `__div64_32' handler MIPS: Avoid DIVU in `__div64_32' is result would be zero MIPS: Avoid handcoded DIVU in `__div64_32' altogether clocksource/drivers/timer-ti-dm: Prepare to handle dra7 timer wrap issue clocksource/drivers/timer-ti-dm: Handle dra7 timer wrap errata i940 ARM: 9011/1: centralize phys-to-virt conversion of DT/ATAGS address ARM: 9012/1: move device tree mapping out of linear region ARM: 9020/1: mm: use correct section size macro to describe the FDT virtual address ARM: 9027/1: head.S: explicitly map DT even if it lives in the first physical section usb: typec: tcpm: Fix error while calculating PPS out values kobject_uevent: remove warning in init_uevent_argv() drm/i915/gt: Fix a double free in gen8_preallocate_top_level_pdp drm/i915: Read C0DRB3/C1DRB3 as 16 bits again drm/i915/overlay: Fix active retire callback alignment drm/i915: Fix crash in auto_retire clk: exynos7: Mark aclk_fsys1_200 as critical media: rkvdec: Remove of_match_ptr() i2c: mediatek: Fix send master code at more than 1MHz dt-bindings: media: renesas,vin: Make resets optional on R-Car Gen1 dt-bindings: serial: 8250: Remove duplicated compatible strings debugfs: Make debugfs_allow RO after init ext4: fix debug format string warning nvme: do not try to reconfigure APST when the controller is not live ASoC: rsnd: check all BUSIF status when error Linux 5.10.38 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ia32e01283b488a38be48015c58a0e481f09aaf65	2021-05-20 15:35:25 +02:00
Matthew Wilcox (Oracle)	cfddf6a685	mm: fix struct page layout on 32-bit systems ... commit 9ddb3c14af upstream. 32-bit architectures which expect 8-byte alignment for 8-byte integers and need 64-bit DMA addresses (arm, mips, ppc) had their struct page inadvertently expanded in 2019. When the dma_addr_t was added, it forced the alignment of the union to 8 bytes, which inserted a 4 byte gap between 'flags' and the union. Fix this by storing the dma_addr_t in one or two adjacent unsigned longs. This restores the alignment to that of an unsigned long. We always store the low bits in the first word to prevent the PageTail bit from being inadvertently set on a big endian platform. If that happened, get_user_pages_fast() racing against a page which was freed and reallocated to the page_pool could dereference a bogus compound_head(), which would be hard to trace back to this cause. Link: https://lkml.kernel.org/r/20210510153211.1504886-1-willy@infradead.org Fixes: c25fff7171 ("mm: add dma_addr_t to struct page") Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org> Acked-by: Jesper Dangaard Brouer <brouer@redhat.com> Acked-by: Vlastimil Babka <vbabka@suse.cz> Tested-by: Matteo Croce <mcroce@linux.microsoft.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-05-19 10:13:17 +02:00
Greg Kroah-Hartman	e054456ced	Merge 5.10.37 into android12-5.10 ... Changes in 5.10.37 Bluetooth: verify AMP hci_chan before amp_destroy bluetooth: eliminate the potential race condition when removing the HCI controller net/nfc: fix use-after-free llcp_sock_bind/connect io_uring: truncate lengths larger than MAX_RW_COUNT on provide buffers Revert "USB: cdc-acm: fix rounding error in TIOCSSERIAL" usb: roles: Call try_module_get() from usb_role_switch_find_by_fwnode() tty: moxa: fix TIOCSSERIAL jiffies conversions tty: amiserial: fix TIOCSSERIAL permission check USB: serial: usb_wwan: fix TIOCSSERIAL jiffies conversions staging: greybus: uart: fix TIOCSSERIAL jiffies conversions USB: serial: ti_usb_3410_5052: fix TIOCSSERIAL permission check staging: fwserial: fix TIOCSSERIAL jiffies conversions tty: moxa: fix TIOCSSERIAL permission check staging: fwserial: fix TIOCSSERIAL permission check drm: bridge: fix LONTIUM use of mipi_dsi_() functions usb: typec: tcpm: Address incorrect values of tcpm psy for fixed supply usb: typec: tcpm: Address incorrect values of tcpm psy for pps supply usb: typec: tcpm: update power supply once partner accepts usb: xhci-mtk: remove or operator for setting schedule parameters usb: xhci-mtk: improve bandwidth scheduling with TT ASoC: samsung: tm2_wm5110: check of of_parse return value ASoC: Intel: kbl_da7219_max98927: Fix kabylake_ssp_fixup function ASoC: tlv320aic32x4: Register clocks before registering component ASoC: tlv320aic32x4: Increase maximum register in regmap MIPS: pci-mt7620: fix PLL lock check MIPS: pci-rt2880: fix slot 0 configuration FDDI: defxx: Bail out gracefully with unassigned PCI resource for CSR PCI: Allow VPD access for QLogic ISP2722 KVM: x86: Defer the MMU unload to the normal path on an global INVPCID PCI: xgene: Fix cfg resource mapping PCI: keystone: Let AM65 use the pci_ops defined in pcie-designware-host.c PM / devfreq: Unlock mutex and free devfreq struct in error path soc/tegra: regulators: Fix locking up when voltage-spread is out of range iio: inv_mpu6050: Fully validate gyro and accel scale writes iio:accel:adis16201: Fix wrong axis assignment that prevents loading iio:adc:ad7476: Fix remove handling sc16is7xx: Defer probe if device read fails phy: cadence: Sierra: Fix PHY power_on sequence misc: lis3lv02d: Fix false-positive WARN on various HP models phy: ti: j721e-wiz: Invoke wiz_init() before of_platform_device_create() misc: vmw_vmci: explicitly initialize vmci_notify_bm_set_msg struct misc: vmw_vmci: explicitly initialize vmci_datagram payload selinux: add proper NULL termination to the secclass_map permissions x86, sched: Treat Intel SNC topology as default, COD as exception async_xor: increase src_offs when dropping destination page md/bitmap: wait for external bitmap writes to complete during tear down md-cluster: fix use-after-free issue when removing rdev md: split mddev_find md: factor out a mddev_find_locked helper from mddev_find md: md_open returns -EBUSY when entering racing area md: Fix missing unused status line of /proc/mdstat mt76: mt7615: use ieee80211_free_txskb() in mt7615_tx_token_put() ipw2x00: potential buffer overflow in libipw_wx_set_encodeext() cfg80211: scan: drop entry from hidden_list on overflow rtw88: Fix array overrun in rtw_get_tx_power_params() mt76: fix potential DMA mapping leak FDDI: defxx: Make MMIO the configuration default except for EISA drm/i915/gvt: Fix virtual display setup for BXT/APL drm/i915/gvt: Fix vfio_edid issue for BXT/APL drm/qxl: use ttm bo priorities drm/panfrost: Clear MMU irqs before handling the fault drm/panfrost: Don't try to map pages that are already mapped drm/radeon: fix copy of uninitialized variable back to userspace drm/dp_mst: Revise broadcast msg lct & lcr drm/dp_mst: Set CLEAR_PAYLOAD_ID_TABLE as broadcast drm: bridge/panel: Cleanup connector on bridge detach drm/amd/display: Reject non-zero src_y and src_x for video planes drm/amdgpu: fix concurrent VM flushes on Vega/Navi v2 ALSA: hda/realtek: Re-order ALC882 Acer quirk table entries ALSA: hda/realtek: Re-order ALC882 Sony quirk table entries ALSA: hda/realtek: Re-order ALC882 Clevo quirk table entries ALSA: hda/realtek: Re-order ALC269 HP quirk table entries ALSA: hda/realtek: Re-order ALC269 Acer quirk table entries ALSA: hda/realtek: Re-order ALC269 Dell quirk table entries ALSA: hda/realtek: Re-order ALC269 ASUS quirk table entries ALSA: hda/realtek: Re-order ALC269 Sony quirk table entries ALSA: hda/realtek: Re-order ALC269 Lenovo quirk table entries ALSA: hda/realtek: Re-order remaining ALC269 quirk table entries ALSA: hda/realtek: Re-order ALC662 quirk table entries ALSA: hda/realtek: Remove redundant entry for ALC861 Haier/Uniwill devices ALSA: hda/realtek: ALC285 Thinkpad jack pin quirk is unreachable ALSA: hda/realtek: Fix speaker amp on HP Envy AiO 32 KVM: s390: VSIE: correctly handle MVPG when in VSIE KVM: s390: split kvm_s390_logical_to_effective KVM: s390: fix guarded storage control register handling s390: fix detection of vector enhancements facility 1 vs. vector packed decimal facility KVM: s390: VSIE: fix MVPG handling for prefixing and MSO KVM: s390: split kvm_s390_real_to_abs KVM: s390: extend kvm_s390_shadow_fault to return entry pointer KVM: x86/mmu: Alloc page for PDPTEs when shadowing 32-bit NPT with 64-bit KVM: x86: Remove emulator's broken checks on CR0/CR3/CR4 loads KVM: nSVM: Set the shadow root level to the TDP level for nested NPT KVM: SVM: Don't strip the C-bit from CR2 on #PF interception KVM: SVM: Do not allow SEV/SEV-ES initialization after vCPUs are created KVM: SVM: Inject #GP on guest MSR_TSC_AUX accesses if RDTSCP unsupported KVM: nVMX: Defer the MMU reload to the normal path on an EPTP switch KVM: nVMX: Truncate bits 63:32 of VMCS field on nested check in !64-bit KVM: nVMX: Truncate base/index GPR value on address calc in !64-bit KVM: arm/arm64: Fix KVM_VGIC_V3_ADDR_TYPE_REDIST read KVM: Destroy I/O bus devices on unregister failure _after_ sync'ing SRCU KVM: Stop looking for coalesced MMIO zones if the bus is destroyed KVM: arm64: Fully zero the vcpu state on reset KVM: arm64: Fix KVM_VGIC_V3_ADDR_TYPE_REDIST_REGION read Revert "drivers/net/wan/hdlc_fr: Fix a double free in pvc_xmit" Revert "i3c master: fix missing destroy_workqueue() on error in i3c_master_register" ovl: fix missing revert_creds() on error path Revert "drm/qxl: do not run release if qxl failed to init" usb: gadget: pch_udc: Revert d3cb25a121 completely Revert "tools/power turbostat: adjust for temperature offset" firmware: xilinx: Fix dereferencing freed memory firmware: xilinx: Add a blank line after function declaration firmware: xilinx: Remove zynqmp_pm_get_eemi_ops() in IS_REACHABLE(CONFIG_ZYNQMP_FIRMWARE) fpga: fpga-mgr: xilinx-spi: fix error messages on -EPROBE_DEFER crypto: sun8i-ss - fix result memory leak on error path memory: gpmc: fix out of bounds read and dereference on gpmc_cs[] ARM: dts: exynos: correct fuel gauge interrupt trigger level on GT-I9100 ARM: dts: exynos: correct fuel gauge interrupt trigger level on Midas family ARM: dts: exynos: correct MUIC interrupt trigger level on Midas family ARM: dts: exynos: correct PMIC interrupt trigger level on Midas family ARM: dts: exynos: correct PMIC interrupt trigger level on Odroid X/U3 family ARM: dts: exynos: correct PMIC interrupt trigger level on SMDK5250 ARM: dts: exynos: correct PMIC interrupt trigger level on Snow ARM: dts: s5pv210: correct fuel gauge interrupt trigger level on Fascinate family ARM: dts: renesas: Add mmc aliases into R-Car Gen2 board dts files arm64: dts: renesas: Add mmc aliases into board dts files x86/platform/uv: Set section block size for hubless architectures serial: stm32: fix code cleaning warnings and checks serial: stm32: add "_usart" prefix in functions name serial: stm32: fix probe and remove order for dma serial: stm32: Use of_device_get_match_data() serial: stm32: fix startup by enabling usart for reception serial: stm32: fix incorrect characters on console serial: stm32: fix TX and RX FIFO thresholds serial: stm32: fix a deadlock condition with wakeup event serial: stm32: fix wake-up flag handling serial: stm32: fix a deadlock in set_termios serial: stm32: fix tx dma completion, release channel serial: stm32: call stm32_transmit_chars locked serial: stm32: fix FIFO flush in startup and set_termios serial: stm32: add FIFO flush when port is closed serial: stm32: fix tx_empty condition usb: typec: tcpci: Check ROLE_CONTROL while interpreting CC_STATUS usb: typec: tps6598x: Fix return value check in tps6598x_probe() usb: typec: stusb160x: fix return value check in stusb160x_probe() regmap: set debugfs_name to NULL after it is freed spi: rockchip: avoid objtool warning mtd: rawnand: fsmc: Fix error code in fsmc_nand_probe() mtd: rawnand: brcmnand: fix OOB R/W with Hamming ECC mtd: Handle possible -EPROBE_DEFER from parse_mtd_partitions() mtd: rawnand: qcom: Return actual error code instead of -ENODEV mtd: don't lock when recursively deleting partitions mtd: maps: fix error return code of physmap_flash_remove() ARM: dts: stm32: fix usart 2 & 3 pinconf to wake up with flow control arm64: dts: qcom: sm8250: Fix level triggered PMU interrupt polarity arm64: dts: qcom: sm8250: Fix timer interrupt to specify EL2 physical timer arm64: dts: qcom: sdm845: fix number of pins in 'gpio-ranges' arm64: dts: qcom: sm8150: fix number of pins in 'gpio-ranges' arm64: dts: qcom: sm8250: fix number of pins in 'gpio-ranges' arm64: dts: qcom: db845c: fix correct powerdown pin for WSA881x crypto: sun8i-ss - Fix memory leak of object d when dma_iv fails to map spi: stm32: drop devres version of spi_register_master regulator: bd9576: Fix return from bd957x_probe() arm64: dts: renesas: r8a77980: Fix vin4-7 endpoint binding spi: stm32: Fix use-after-free on unbind x86/microcode: Check for offline CPUs before requesting new microcode devtmpfs: fix placement of complete() call usb: gadget: pch_udc: Replace cpu_to_le32() by lower_32_bits() usb: gadget: pch_udc: Check if driver is present before calling ->setup() usb: gadget: pch_udc: Check for DMA mapping error usb: gadget: pch_udc: Initialize device pointer before use usb: gadget: pch_udc: Provide a GPIO line used on Intel Minnowboard (v1) crypto: ccp - fix command queuing to TEE ring buffer crypto: qat - don't release uninitialized resources crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init fotg210-udc: Fix DMA on EP0 for length > max packet size fotg210-udc: Fix EP0 IN requests bigger than two packets fotg210-udc: Remove a dubious condition leading to fotg210_done fotg210-udc: Mask GRP2 interrupts we don't handle fotg210-udc: Don't DMA more than the buffer can take fotg210-udc: Complete OUT requests on short packets usb: gadget: s3c: Fix incorrect resources releasing usb: gadget: s3c: Fix the error handling path in 's3c2410_udc_probe()' dt-bindings: serial: stm32: Use 'type: object' instead of false for 'additionalProperties' mtd: require write permissions for locking and badblock ioctls arm64: dts: renesas: r8a779a0: Fix PMU interrupt bus: qcom: Put child node before return soundwire: bus: Fix device found flag correctly phy: ti: j721e-wiz: Delete "clk_div_sel" clk provider during cleanup phy: marvell: ARMADA375_USBCLUSTER_PHY should not default to y, unconditionally arm64: dts: mediatek: fix reset GPIO level on pumpkin NFSD: Fix sparse warning in nfs4proc.c NFSv4.2: fix copy stateid copying for the async copy crypto: poly1305 - fix poly1305_core_setkey() declaration crypto: qat - fix error path in adf_isr_resource_alloc() usb: gadget: aspeed: fix dma map failure USB: gadget: udc: fix wrong pointer passed to IS_ERR() and PTR_ERR() drivers: nvmem: Fix voltage settings for QTI qfprom-efuse driver core: platform: Declare early_platform_cleanup() prototype memory: pl353: fix mask of ECC page_size config register soundwire: stream: fix memory leak in stream config error path m68k: mvme147,mvme16x: Don't wipe PCC timer config bits firmware: qcom_scm: Make __qcom_scm_is_call_available() return bool firmware: qcom_scm: Reduce locking section for __get_convention() firmware: qcom_scm: Workaround lack of "is available" call on SC7180 iio: adc: Kconfig: make AD9467 depend on ADI_AXI_ADC symbol mtd: rawnand: gpmi: Fix a double free in gpmi_nand_init irqchip/gic-v3: Fix OF_BAD_ADDR error handling staging: comedi: tests: ni_routes_test: Fix compilation error staging: rtl8192u: Fix potential infinite loop staging: fwserial: fix TIOCSSERIAL implementation staging: fwserial: fix TIOCGSERIAL implementation staging: greybus: uart: fix unprivileged TIOCCSERIAL soc: qcom: pdr: Fix error return code in pdr_register_listener PM / devfreq: Use more accurate returned new_freq as resume_freq clocksource/drivers/timer-ti-dm: Fix posted mode status check order clocksource/drivers/timer-ti-dm: Add missing set_state_oneshot_stopped clocksource/drivers/ingenic_ost: Fix return value check in ingenic_ost_probe() spi: Fix use-after-free with devm_spi_alloc_* spi: fsl: add missing iounmap() on error in of_fsl_spi_probe() soc: qcom: mdt_loader: Validate that p_filesz < p_memsz soc: qcom: mdt_loader: Detect truncated read of segments PM: runtime: Replace inline function pm_runtime_callbacks_present() cpuidle: Fix ARM_QCOM_SPM_CPUIDLE configuration ACPI: CPPC: Replace cppc_attr with kobj_attribute crypto: allwinner - add missing CRYPTO_ prefix crypto: sun8i-ss - Fix memory leak of pad crypto: sa2ul - Fix memory leak of rxd crypto: qat - Fix a double free in adf_create_ring cpufreq: armada-37xx: Fix setting TBG parent for load levels clk: mvebu: armada-37xx-periph: remove .set_parent method for CPU PM clock cpufreq: armada-37xx: Fix the AVS value for load L1 clk: mvebu: armada-37xx-periph: Fix switching CPU freq from 250 Mhz to 1 GHz clk: mvebu: armada-37xx-periph: Fix workaround for switching from L1 to L0 cpufreq: armada-37xx: Fix driver cleanup when registration failed cpufreq: armada-37xx: Fix determining base CPU frequency spi: spi-zynqmp-gqspi: use wait_for_completion_timeout to make zynqmp_qspi_exec_op not interruptible spi: spi-zynqmp-gqspi: add mutex locking for exec_op spi: spi-zynqmp-gqspi: transmit dummy circles by using the controller's internal functionality spi: spi-zynqmp-gqspi: fix incorrect operating mode in zynqmp_qspi_read_op spi: fsl-lpspi: Fix PM reference leak in lpspi_prepare_xfer_hardware() usb: gadget: r8a66597: Add missing null check on return from platform_get_resource USB: cdc-acm: fix unprivileged TIOCCSERIAL USB: cdc-acm: fix TIOCGSERIAL implementation tty: actually undefine superseded ASYNC flags tty: fix return value for unsupported ioctls tty: Remove dead termiox code tty: fix return value for unsupported termiox ioctls serial: core: return early on unsupported ioctls firmware: qcom-scm: Fix QCOM_SCM configuration node: fix device cleanups in error handling code crypto: chelsio - Read rxchannel-id from firmware usbip: vudc: fix missing unlock on error in usbip_sockfd_store() m68k: Add missing mmap_read_lock() to sys_cacheflush() spi: spi-zynqmp-gqspi: Fix missing unlock on error in zynqmp_qspi_exec_op() memory: renesas-rpc-if: fix possible NULL pointer dereference of resource memory: samsung: exynos5422-dmc: handle clk_set_parent() failure security: keys: trusted: fix TPM2 authorizations platform/x86: pmc_atom: Match all Beckhoff Automation baytrail boards with critclk_systems DMI table ARM: dts: aspeed: Rainier: Fix humidity sensor bus address Drivers: hv: vmbus: Use after free in __vmbus_open() spi: spi-zynqmp-gqspi: fix clk_enable/disable imbalance issue spi: spi-zynqmp-gqspi: fix hang issue when suspend/resume spi: spi-zynqmp-gqspi: fix use-after-free in zynqmp_qspi_exec_op spi: spi-zynqmp-gqspi: return -ENOMEM if dma_map_single fails x86/platform/uv: Fix !KEXEC build failure hwmon: (pmbus/pxe1610) don't bail out when not all pages are active Drivers: hv: vmbus: Increase wait time for VMbus unload PM: hibernate: x86: Use crc32 instead of md5 for hibernation e820 integrity check usb: dwc2: Fix host mode hibernation exit with remote wakeup flow. usb: dwc2: Fix hibernation between host and device modes. ttyprintk: Add TTY hangup callback. serial: omap: don't disable rs485 if rts gpio is missing serial: omap: fix rs485 half-duplex filtering xen-blkback: fix compatibility bug with single page rings soc: aspeed: fix a ternary sign expansion bug drm/tilcdc: send vblank event when disabling crtc drm/stm: Fix bus_flags handling drm/amd/display: Fix off by one in hdmi_14_process_transaction() drm/mcde/panel: Inverse misunderstood flag sched/fair: Fix shift-out-of-bounds in load_balance() afs: Fix updating of i_mode due to 3rd party change rcu: Remove spurious instrumentation_end() in rcu_nmi_enter() media: vivid: fix assignment of dev->fbuf_out_flags media: saa7134: use sg_dma_len when building pgtable media: saa7146: use sg_dma_len when building pgtable media: omap4iss: return error code when omap4iss_get() failed media: rkisp1: rsz: crash fix when setting src format media: aspeed: fix clock handling logic drm/probe-helper: Check epoch counter in output_poll_execute() media: venus: core: Fix some resource leaks in the error path of 'venus_probe()' media: platform: sunxi: sun6i-csi: fix error return code of sun6i_video_start_streaming() media: m88ds3103: fix return value check in m88ds3103_probe() media: docs: Fix data organization of MEDIA_BUS_FMT_RGB101010_1X30 media: [next] staging: media: atomisp: fix memory leak of object flash media: atomisp: Fixed error handling path media: m88rs6000t: avoid potential out-of-bounds reads on arrays media: atomisp: Fix use after free in atomisp_alloc_css_stat_bufs() drm/amdkfd: fix build error with AMD_IOMMU_V2=m of: overlay: fix for_each_child.cocci warnings x86/kprobes: Fix to check non boostable prefixes correctly selftests: fix prepending $(OUTPUT) to $(TEST_PROGS) pata_arasan_cf: fix IRQ check pata_ipx4xx_cf: fix IRQ check sata_mv: add IRQ checks ata: libahci_platform: fix IRQ check seccomp: Fix CONFIG tests for Seccomp_filters nvme-tcp: block BH in sk state_change sk callback nvmet-tcp: fix incorrect locking in state_change sk callback clk: imx: Fix reparenting of UARTs not associated with stdout power: supply: bq25980: Move props from battery node nvme: retrigger ANA log update if group descriptor isn't found media: i2c: imx219: Move out locking/unlocking of vflip and hflip controls from imx219_set_stream media: i2c: imx219: Balance runtime PM use-count media: v4l2-ctrls.c: fix race condition in hdl->requests list vfio/fsl-mc: Re-order vfio_fsl_mc_probe() vfio/pci: Move VGA and VF initialization to functions vfio/pci: Re-order vfio_pci_probe() vfio/mdev: Do not allow a mdev_type to have a NULL parent pointer clk: zynqmp: move zynqmp_pll_set_mode out of round_rate callback clk: zynqmp: pll: add set_pll_mode to check condition in zynqmp_pll_enable drm: xlnx: zynqmp: fix a memset in zynqmp_dp_train() clk: qcom: a53-pll: Add missing MODULE_DEVICE_TABLE clk: qcom: apss-ipq-pll: Add missing MODULE_DEVICE_TABLE drm/amd/display: use GFP_ATOMIC in dcn20_resource_construct drm/radeon: Fix a missing check bug in radeon_dp_mst_detect() clk: uniphier: Fix potential infinite loop scsi: pm80xx: Increase timeout for pm80xx mpi_uninit_check() scsi: pm80xx: Fix potential infinite loop scsi: ufs: ufshcd-pltfrm: Fix deferred probing scsi: hisi_sas: Fix IRQ checks scsi: jazz_esp: Add IRQ check scsi: sun3x_esp: Add IRQ check scsi: sni_53c710: Add IRQ check scsi: ibmvfc: Fix invalid state machine BUG_ON() mailbox: sprd: Introduce refcnt when clients requests/free channels mfd: stm32-timers: Avoid clearing auto reload register nvmet-tcp: fix a segmentation fault during io parsing error nvme-pci: don't simple map sgl when sgls are disabled media: cedrus: Fix H265 status definitions HSI: core: fix resource leaks in hsi_add_client_from_dt() x86/events/amd/iommu: Fix sysfs type mismatch perf/amd/uncore: Fix sysfs type mismatch io_uring: fix overflows checks in provide buffers sched/debug: Fix cgroup_path[] serialization drivers/block/null_blk/main: Fix a double free in null_init. xsk: Respect device's headroom and tailroom on generic xmit path HID: plantronics: Workaround for double volume key presses perf symbols: Fix dso__fprintf_symbols_by_name() to return the number of printed chars ASoC: Intel: boards: sof-wm8804: add check for PLL setting ASoC: Intel: Skylake: Compile when any configuration is selected RDMA/mlx5: Fix mlx5 rates to IB rates map wilc1000: write value to WILC_INTR2_ENABLE register KVM: x86/mmu: Retry page faults that hit an invalid memslot Bluetooth: avoid deadlock between hci_dev->lock and socket lock net: lapbether: Prevent racing when checking whether the netif is running libbpf: Add explicit padding to bpf_xdp_set_link_opts bpftool: Fix maybe-uninitialized warnings iommu: Check dev->iommu in iommu_dev_xxx functions iommu/vt-d: Reject unsupported page request modes selftests/bpf: Re-generate vmlinux.h and BPF skeletons if bpftool changed libbpf: Add explicit padding to btf_dump_emit_type_decl_opts powerpc/fadump: Mark fadump_calculate_reserve_size as __init powerpc/prom: Mark identical_pvr_fixup as __init MIPS: fix local_irq_{disable,enable} in asmmacro.h ima: Fix the error code for restoring the PCR value inet: use bigger hash table for IP ID generation pinctrl: pinctrl-single: remove unused parameter pinctrl: pinctrl-single: fix pcs_pin_dbg_show() when bits_per_mux is not zero MIPS: loongson64: fix bug when PAGE_SIZE > 16KB ASoC: wm8960: Remove bitclk relax condition in wm8960_configure_sysclk iommu/arm-smmu-v3: add bit field SFM into GERROR_ERR_MASK RDMA/mlx5: Fix drop packet rule in egress table IB/isert: Fix a use after free in isert_connect_request powerpc: Fix HAVE_HARDLOCKUP_DETECTOR_ARCH build configuration MIPS/bpf: Enable bpf_probe_read{, str}() on MIPS again gpio: guard gpiochip_irqchip_add_domain() with GPIOLIB_IRQCHIP ALSA: core: remove redundant spin_lock pair in snd_card_disconnect net: phy: lan87xx: fix access to wrong register of LAN87xx udp: never accept GSO_FRAGLIST packets powerpc/pseries: Only register vio drivers if vio bus exists net/tipc: fix missing destroy_workqueue() on error in tipc_crypto_start() bug: Remove redundant condition check in report_bug RDMA/core: Fix corrupted SL on passive side nfc: pn533: prevent potential memory corruption net: hns3: Limiting the scope of vector_ring_chain variable mips: bmips: fix syscon-reboot nodes iommu/vt-d: Don't set then clear private data in prq_event_thread() iommu: Fix a boundary issue to avoid performance drop iommu/vt-d: Report right snoop capability when using FL for IOVA iommu/vt-d: Report the right page fault address iommu/vt-d: Preset Access/Dirty bits for IOVA over FL iommu/vt-d: Remove WO permissions on second-level paging entries iommu/vt-d: Invalidate PASID cache when root/context entry changed ALSA: usb-audio: Add error checks for usb_driver_claim_interface() calls HID: lenovo: Use brightness_set_blocking callback for setting LEDs brightness HID: lenovo: Fix lenovo_led_set_tp10ubkbd() error handling HID: lenovo: Check hid_get_drvdata() returns non NULL in lenovo_event() HID: lenovo: Map mic-mute button to KEY_F20 instead of KEY_MICMUTE KVM: arm64: Initialize VCPU mdcr_el2 before loading it ASoC: simple-card: fix possible uninitialized single_cpu local variable liquidio: Fix unintented sign extension of a left shift of a u16 IB/hfi1: Use kzalloc() for mmu_rb_handler allocation powerpc/64s: Fix pte update for kernel memory on radix powerpc/perf: Fix PMU constraint check for EBB events powerpc: iommu: fix build when neither PCI or IBMVIO is set mac80211: bail out if cipher schemes are invalid perf vendor events amd: Fix broken L2 Cache Hits from L2 HWPF metric xfs: fix return of uninitialized value in variable error rtw88: Fix an error code in rtw_debugfs_set_rsvd_page() mt7601u: fix always true expression mt76: mt7615: fix tx skb dma unmap mt76: mt7915: fix tx skb dma unmap mt76: mt7915: fix aggr len debugfs node mt76: mt7615: fix mib stats counter reporting to mac80211 mt76: mt7915: fix mib stats counter reporting to mac80211 mt76: mt7663s: make all of packets 4-bytes aligned in sdio tx aggregation mt76: mt7663s: fix the possible device hang in high traffic KVM: PPC: Book3S HV P9: Restore host CTRL SPR after guest exit ovl: invalidate readdir cache on changes to dir with origin RDMA/qedr: Fix error return code in qedr_iw_connect() IB/hfi1: Fix error return code in parse_platform_config() RDMA/bnxt_re: Fix error return code in bnxt_qplib_cq_process_terminal() cxgb4: Fix unintentional sign extension issues net: thunderx: Fix unintentional sign extension issue RDMA/srpt: Fix error return code in srpt_cm_req_recv() RDMA/rtrs-clt: destroy sysfs after removing session from active list i2c: cadence: fix reference leak when pm_runtime_get_sync fails i2c: img-scb: fix reference leak when pm_runtime_get_sync fails i2c: imx-lpi2c: fix reference leak when pm_runtime_get_sync fails i2c: imx: fix reference leak when pm_runtime_get_sync fails i2c: omap: fix reference leak when pm_runtime_get_sync fails i2c: sprd: fix reference leak when pm_runtime_get_sync fails i2c: stm32f7: fix reference leak when pm_runtime_get_sync fails i2c: xiic: fix reference leak when pm_runtime_get_sync fails i2c: cadence: add IRQ check i2c: emev2: add IRQ check i2c: jz4780: add IRQ check i2c: mlxbf: add IRQ check i2c: rcar: make sure irq is not threaded on Gen2 and earlier i2c: rcar: protect against supurious interrupts on V3U i2c: rcar: add IRQ check i2c: sh7760: add IRQ check powerpc/xive: Drop check on irq_data in xive_core_debug_show() powerpc/xive: Fix xmon command "dxi" ASoC: ak5558: correct reset polarity net/mlx5: Fix bit-wise and with zero net/packet: make packet_fanout.arr size configurable up to 64K net/packet: remove data races in fanout operations drm/i915/gvt: Fix error code in intel_gvt_init_device() iommu/amd: Put newline after closing bracket in warning perf beauty: Fix fsconfig generator drm/amd/pm: fix error code in smu_set_power_limit() MIPS: pci-legacy: stop using of_pci_range_to_resource powerpc/pseries: extract host bridge from pci_bus prior to bus removal powerpc/smp: Reintroduce cpu_core_mask KVM: x86: dump_vmcs should not assume GUEST_IA32_EFER is valid rtlwifi: 8821ae: upgrade PHY and RF parameters wlcore: fix overlapping snprintf arguments in debugfs i2c: sh7760: fix IRQ error path i2c: mediatek: Fix wrong dma sync flag mwl8k: Fix a double Free in mwl8k_probe_hw netfilter: nft_payload: fix C-VLAN offload support netfilter: nftables_offload: VLAN id needs host byteorder in flow dissector netfilter: nftables_offload: special ethertype handling for VLAN vsock/vmci: log once the failed queue pair allocation libbpf: Initialize the bpf_seq_printf parameters array field by field net: ethernet: ixp4xx: Set the DMA masks explicitly gro: fix napi_gro_frags() Fast GRO breakage due to IP alignment check RDMA/cxgb4: add missing qpid increment RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails ALSA: usb: midi: don't return -ENOMEM when usb_urb_ep_type_check fails sfc: ef10: fix TX queue lookup in TX event handling vsock/virtio: free queued packets when closing socket net: marvell: prestera: fix port event handling on init net: davinci_emac: Fix incorrect masking of tx and rx error channel mt76: mt7615: fix memleak when mt7615_unregister_device() crypto: ccp: Detect and reject "invalid" addresses destined for PSP nfp: devlink: initialize the devlink port attribute "lanes" net: stmmac: fix TSO and TBS feature enabling during driver open net: renesas: ravb: Fix a stuck issue when a lot of frames are received net: phy: intel-xway: enable integrated led functions RDMA/rxe: Fix a bug in rxe_fill_ip_info() RDMA/core: Add CM to restrack after successful attachment to a device powerpc/64: Fix the definition of the fixmap area ath9k: Fix error check in ath9k_hw_read_revisions() for PCI devices ath10k: Fix a use after free in ath10k_htc_send_bundle ath10k: Fix ath10k_wmi_tlv_op_pull_peer_stats_info() unlock without lock wlcore: Fix buffer overrun by snprintf due to incorrect buffer size powerpc/perf: Fix the threshold event selection for memory events in power10 powerpc/52xx: Fix an invalid ASM expression ('addi' used instead of 'add') net: phy: marvell: fix m88e1011_set_downshift net: phy: marvell: fix m88e1111_set_downshift net: enetc: fix link error again bnxt_en: fix ternary sign extension bug in bnxt_show_temp() ARM: dts: uniphier: Change phy-mode to RGMII-ID to enable delay pins for RTL8211E arm64: dts: uniphier: Change phy-mode to RGMII-ID to enable delay pins for RTL8211E net: geneve: modify IP header check in geneve6_xmit_skb and geneve_xmit_skb selftests: net: mirror_gre_vlan_bridge_1q: Make an FDB entry static selftests: mlxsw: Remove a redundant if statement in tc_flower_scale test bnxt_en: Fix RX consumer index logic in the error path. KVM: VMX: Intercept FS/GS_BASE MSR accesses for 32-bit KVM net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send selftests/bpf: Fix BPF_CORE_READ_BITFIELD() macro selftests/bpf: Fix field existence CO-RE reloc tests selftests/bpf: Fix core_reloc test runner bpf: Fix propagation of 32 bit unsigned bounds from 64 bit bounds RDMA/siw: Fix a use after free in siw_alloc_mr RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res net: bridge: mcast: fix broken length + header check for MRDv6 Adv. net:nfc:digital: Fix a double free in digital_tg_recv_dep_req perf tools: Change fields type in perf_record_time_conv perf jit: Let convert_timestamp() to be backwards-compatible perf session: Add swap operation for event TIME_CONV ia64: fix EFI_DEBUG build kfifo: fix ternary sign extension bugs mm/sl?b.c: remove ctor argument from kmem_cache_flags mm: memcontrol: slab: fix obtain a reference to a freeing memcg mm/sparse: add the missing sparse_buffer_fini() in error branch mm/memory-failure: unnecessary amount of unmapping afs: Fix speculative status fetches bpf: Fix alu32 const subreg bound tracking on bitwise operations bpf, ringbuf: Deny reserve of buffers larger than ringbuf bpf: Prevent writable memory-mapping of read-only ringbuf pages arm64: Remove arm64_dma32_phys_limit and its uses net: Only allow init netns to set default tcp cong to a restricted algo smp: Fix smp_call_function_single_async prototype Revert "net/sctp: fix race condition in sctp_destroy_sock" sctp: delay auto_asconf init until binding the first addr Linux 5.10.37 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I5bee89c285d9dd72de967b0e70d96951ae4e06ae	2021-05-15 09:28:55 +02:00
Linus Lüssing	e2c34cacff	net: bridge: mcast: fix broken length + header check for MRDv6 Adv. ... [ Upstream commit 9901408815 ] The IPv6 Multicast Router Advertisements parsing has the following two issues: For one thing, ICMPv6 MRD Advertisements are smaller than ICMPv6 MLD messages (ICMPv6 MRD Adv.: 8 bytes vs. ICMPv6 MLDv1/2: >= 24 bytes, assuming MLDv2 Reports with at least one multicast address entry). When ipv6_mc_check_mld_msg() tries to parse an Multicast Router Advertisement its MLD length check will fail - and it will wrongly return -EINVAL, even if we have a valid MRD Advertisement. With the returned -EINVAL the bridge code will assume a broken packet and will wrongly discard it, potentially leading to multicast packet loss towards multicast routers. The second issue is the MRD header parsing in br_ip6_multicast_mrd_rcv(): It wrongly checks for an ICMPv6 header immediately after the IPv6 header (IPv6 next header type). However according to RFC4286, section 2 all MRD messages contain a Router Alert option (just like MLD). So instead there is an IPv6 Hop-by-Hop option for the Router Alert between the IPv6 and ICMPv6 header, again leading to the bridge wrongly discarding Multicast Router Advertisements. To fix these two issues, introduce a new return value -ENODATA to ipv6_mc_check_mld() to indicate a valid ICMPv6 packet with a hop-by-hop option which is not an MLD but potentially an MRD packet. This also simplifies further parsing in the bridge code, as ipv6_mc_check_mld() already fully checks the ICMPv6 header and hop-by-hop option. These issues were found and fixed with the help of the mrdisc tool (https://github.com/troglobit/mrdisc). Fixes: 4b3087c7e3 ("bridge: Snoop Multicast Router Advertisements") Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-05-14 09:50:44 +02:00
Pablo Neira Ayuso	a7eb38aacc	netfilter: nftables_offload: VLAN id needs host byteorder in flow dissector ... [ Upstream commit ff4d90a89d ] The flow dissector representation expects the VLAN id in host byteorder. Add the NFT_OFFLOAD_F_NETWORK2HOST flag to swap the bytes from nft_cmp. Fixes: a82055af59 ("netfilter: nft_payload: add VLAN offload support") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-05-14 09:50:40 +02:00
Pablo Neira Ayuso	cf2de861b2	netfilter: nft_payload: fix C-VLAN offload support ... [ Upstream commit 14c20643ef ] - add another struct flow_dissector_key_vlan for C-VLAN - update layer 3 dependency to allow to match on IPv4/IPv6 Fixes: 89d8fd44ab ("netfilter: nft_payload: add C-VLAN offload support") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-05-14 09:50:40 +02:00
Archie Pusaka	1d7bd87a2c	Bluetooth: verify AMP hci_chan before amp_destroy ... commit 5c4c8c9544 upstream. hci_chan can be created in 2 places: hci_loglink_complete_evt() if it is an AMP hci_chan, or l2cap_conn_add() otherwise. In theory, Only AMP hci_chan should be removed by a call to hci_disconn_loglink_complete_evt(). However, the controller might mess up, call that function, and destroy an hci_chan which is not initiated by hci_loglink_complete_evt(). This patch adds a verification that the destroyed hci_chan must have been init'd by hci_loglink_complete_evt(). Example crash call trace: Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xe3/0x144 lib/dump_stack.c:118 print_address_description+0x67/0x22a mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report mm/kasan/report.c:412 [inline] kasan_report+0x251/0x28f mm/kasan/report.c:396 hci_send_acl+0x3b/0x56e net/bluetooth/hci_core.c:4072 l2cap_send_cmd+0x5af/0x5c2 net/bluetooth/l2cap_core.c:877 l2cap_send_move_chan_cfm_icid+0x8e/0xb1 net/bluetooth/l2cap_core.c:4661 l2cap_move_fail net/bluetooth/l2cap_core.c:5146 [inline] l2cap_move_channel_rsp net/bluetooth/l2cap_core.c:5185 [inline] l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:5464 [inline] l2cap_sig_channel net/bluetooth/l2cap_core.c:5799 [inline] l2cap_recv_frame+0x1d12/0x51aa net/bluetooth/l2cap_core.c:7023 l2cap_recv_acldata+0x2ea/0x693 net/bluetooth/l2cap_core.c:7596 hci_acldata_packet net/bluetooth/hci_core.c:4606 [inline] hci_rx_work+0x2bd/0x45e net/bluetooth/hci_core.c:4796 process_one_work+0x6f8/0xb50 kernel/workqueue.c:2175 worker_thread+0x4fc/0x670 kernel/workqueue.c:2321 kthread+0x2f0/0x304 kernel/kthread.c:253 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:415 Allocated by task 38: set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc+0x8d/0x9a mm/kasan/kasan.c:553 kmem_cache_alloc_trace+0x102/0x129 mm/slub.c:2787 kmalloc include/linux/slab.h:515 [inline] kzalloc include/linux/slab.h:709 [inline] hci_chan_create+0x86/0x26d net/bluetooth/hci_conn.c:1674 l2cap_conn_add.part.0+0x1c/0x814 net/bluetooth/l2cap_core.c:7062 l2cap_conn_add net/bluetooth/l2cap_core.c:7059 [inline] l2cap_connect_cfm+0x134/0x852 net/bluetooth/l2cap_core.c:7381 hci_connect_cfm+0x9d/0x122 include/net/bluetooth/hci_core.h:1404 hci_remote_ext_features_evt net/bluetooth/hci_event.c:4161 [inline] hci_event_packet+0x463f/0x72fa net/bluetooth/hci_event.c:5981 hci_rx_work+0x197/0x45e net/bluetooth/hci_core.c:4791 process_one_work+0x6f8/0xb50 kernel/workqueue.c:2175 worker_thread+0x4fc/0x670 kernel/workqueue.c:2321 kthread+0x2f0/0x304 kernel/kthread.c:253 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:415 Freed by task 1732: set_track mm/kasan/kasan.c:460 [inline] __kasan_slab_free mm/kasan/kasan.c:521 [inline] __kasan_slab_free+0x106/0x128 mm/kasan/kasan.c:493 slab_free_hook mm/slub.c:1409 [inline] slab_free_freelist_hook+0xaa/0xf6 mm/slub.c:1436 slab_free mm/slub.c:3009 [inline] kfree+0x182/0x21e mm/slub.c:3972 hci_disconn_loglink_complete_evt net/bluetooth/hci_event.c:4891 [inline] hci_event_packet+0x6a1c/0x72fa net/bluetooth/hci_event.c:6050 hci_rx_work+0x197/0x45e net/bluetooth/hci_core.c:4791 process_one_work+0x6f8/0xb50 kernel/workqueue.c:2175 worker_thread+0x4fc/0x670 kernel/workqueue.c:2321 kthread+0x2f0/0x304 kernel/kthread.c:253 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:415 The buggy address belongs to the object at ffff8881d7af9180 which belongs to the cache kmalloc-128 of size 128 The buggy address is located 24 bytes inside of 128-byte region [ffff8881d7af9180, ffff8881d7af9200) The buggy address belongs to the page: page:ffffea00075ebe40 count:1 mapcount:0 mapping:ffff8881da403200 index:0x0 flags: 0x8000000000000200(slab) raw: 8000000000000200 dead000000000100 dead000000000200 ffff8881da403200 raw: 0000000000000000 0000000080150015 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8881d7af9080: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb ffff8881d7af9100: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc >ffff8881d7af9180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8881d7af9200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8881d7af9280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc Signed-off-by: Archie Pusaka <apusaka@chromium.org> Reported-by: syzbot+98228e7407314d2d4ba2@syzkaller.appspotmail.com Reviewed-by: Alain Michaud <alainm@chromium.org> Reviewed-by: Abhishek Pandit-Subedi <abhishekpandit@chromium.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Cc: George Kennedy <george.kennedy@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-05-14 09:49:55 +02:00
Howard Chen	ac75369368	Revert "xfrm: Use actual socket sk instead of skb socket for xfrm_output_resume" ... The reverted CL makes CtsnetTestCases fails on CtsNetTestCases:android.net.cts.IpSecManagerTest#testAesGcm128Tcp6 Bug: 186608065 Test: CtsNetTestCases Change-Id: I65eb4e45623af5d6ff8ec634ac11aa039f5cceef Signed-off-by: Howard Chen <howardsoc@google.com>	2021-05-13 20:27:08 +00:00
Greg Kroah-Hartman	a629454175	Revert "Revert "net: xfrm: Localize sequence counter per network namespace"" ... This reverts commit 1aff922933 as we are free to update the ABI at this point in time. Bug: 161946584 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Iba293953586fd78503ef5f47db40ccdc03b098f5	2021-04-23 18:42:38 -07:00
Greg Kroah-Hartman	1aff922933	Revert "net: xfrm: Localize sequence counter per network namespace" ... This reverts commit 0224432a8f as it breaks the abi and we can't allow that at this point in time. Bug: 161946584 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I21e6c33ac7011d8489e766fd9b5e32bd528dc456	2021-04-15 14:24:14 +02:00
Greg Kroah-Hartman	9a705f0463	Merge 5.10.30 into android12-5.10 ... Changes in 5.10.30 xfrm/compat: Cleanup WARN()s that can be user-triggered ALSA: aloop: Fix initialization of controls ALSA: hda/realtek: Fix speaker amp setup on Acer Aspire E1 ALSA: hda/conexant: Apply quirk for another HP ZBook G5 model ASoC: intel: atom: Stop advertising non working S24LE support nfc: fix refcount leak in llcp_sock_bind() nfc: fix refcount leak in llcp_sock_connect() nfc: fix memory leak in llcp_sock_connect() nfc: Avoid endless loops caused by repeated llcp_sock_connect() selinux: make nslot handling in avtab more robust selinux: fix cond_list corruption when changing booleans selinux: fix race between old and new sidtab xen/evtchn: Change irq_info lock to raw_spinlock_t net: ipv6: check for validity before dereferencing cfg->fc_nlinfo.nlh net: dsa: lantiq_gswip: Let GSWIP automatically set the xMII clock net: dsa: lantiq_gswip: Don't use PHY auto polling net: dsa: lantiq_gswip: Configure all remaining GSWIP_MII_CFG bits drm/i915: Fix invalid access to ACPI _DSM objects ACPI: processor: Fix build when CONFIG_ACPI_PROCESSOR=m IB/hfi1: Fix probe time panic when AIP is enabled with a buggy BIOS LOOKUP_MOUNTPOINT: we are cleaning "jumped" flag too late gcov: re-fix clang-11+ support ia64: fix user_stack_pointer() for ptrace() nds32: flush_dcache_page: use page_mapping_file to avoid races with swapoff ocfs2: fix deadlock between setattr and dio_end_io_write fs: direct-io: fix missing sdio->boundary ethtool: fix incorrect datatype in set_eee ops of: property: fw_devlink: do not link ".*,nr-gpios" parisc: parisc-agp requires SBA IOMMU driver parisc: avoid a warning on u8 cast for cmpxchg on u8 pointers ARM: dts: turris-omnia: configure LED[2]/INTn pin as interrupt pin batman-adv: initialize "struct batadv_tvlv_tt_vlan_data"->reserved field ice: Continue probe on link/PHY errors ice: Increase control queue timeout ice: prevent ice_open and ice_stop during reset ice: fix memory allocation call ice: remove DCBNL_DEVRESET bit from PF state ice: Fix for dereference of NULL pointer ice: Use port number instead of PF ID for WoL ice: Cleanup fltr list in case of allocation issues iwlwifi: pcie: properly set LTR workarounds on 22000 devices ice: fix memory leak of aRFS after resuming from suspend net: hso: fix null-ptr-deref during tty device unregistration libbpf: Fix bail out from 'ringbuf_process_ring()' on error bpf: Enforce that struct_ops programs be GPL-only bpf: link: Refuse non-O_RDWR flags in BPF_OBJ_GET ethernet/netronome/nfp: Fix a use after free in nfp_bpf_ctrl_msg_rx libbpf: Ensure umem pointer is non-NULL before dereferencing libbpf: Restore umem state after socket create failure libbpf: Only create rx and tx XDP rings when necessary bpf: Refcount task stack in bpf_get_task_stack bpf, sockmap: Fix sk->prot unhash op reset bpf, sockmap: Fix incorrect fwd_alloc accounting net: ensure mac header is set in virtio_net_hdr_to_skb() i40e: Fix sparse warning: missing error code 'err' i40e: Fix sparse error: 'vsi->netdev' could be null i40e: Fix sparse error: uninitialized symbol 'ring' i40e: Fix sparse errors in i40e_txrx.c vdpa/mlx5: Fix suspend/resume index restoration net: sched: sch_teql: fix null-pointer dereference net: sched: fix action overwrite reference counting nl80211: fix beacon head validation nl80211: fix potential leak of ACL params cfg80211: check S1G beacon compat element length mac80211: fix time-is-after bug in mlme mac80211: fix TXQ AC confusion net: hsr: Reset MAC header for Tx path net-ipv6: bugfix - raw & sctp - switch to ipv6_can_nonlocal_bind() net: let skb_orphan_partial wake-up waiters. thunderbolt: Fix a leak in tb_retimer_add() thunderbolt: Fix off by one in tb_port_find_retimer() usbip: add sysfs_lock to synchronize sysfs code paths usbip: stub-dev synchronize sysfs code paths usbip: vudc synchronize sysfs code paths usbip: synchronize event handler with sysfs code paths driver core: Fix locking bug in deferred_probe_timeout_work_func() scsi: pm80xx: Fix chip initialization failure scsi: target: iscsi: Fix zero tag inside a trace event percpu: make pcpu_nr_empty_pop_pages per chunk type i2c: turn recovery error on init to debug KVM: x86/mmu: change TDP MMU yield function returns to match cond_resched KVM: x86/mmu: Merge flush and non-flush tdp_mmu_iter_cond_resched KVM: x86/mmu: Rename goal_gfn to next_last_level_gfn KVM: x86/mmu: Ensure forward progress when yielding in TDP MMU iter KVM: x86/mmu: Yield in TDU MMU iter even if no SPTES changed KVM: x86/mmu: Ensure TLBs are flushed when yielding during GFN range zap KVM: x86/mmu: Ensure TLBs are flushed for TDP MMU during NX zapping KVM: x86/mmu: Don't allow TDP MMU to yield when recovering NX pages KVM: x86/mmu: preserve pending TLB flush across calls to kvm_tdp_mmu_zap_sp net: sched: fix err handler in tcf_action_init() ice: Refactor DCB related variables out of the ice_port_info struct ice: Recognize 860 as iSCSI port in CEE mode xfrm: interface: fix ipv4 pmtu check to honor ip header df xfrm: Use actual socket sk instead of skb socket for xfrm_output_resume remoteproc: qcom: pil_info: avoid 64-bit division regulator: bd9571mwv: Fix AVS and DVFS voltage range ARM: OMAP4: Fix PMIC voltage domains for bionic ARM: OMAP4: PM: update ROM return address for OSWR and OFF net: xfrm: Localize sequence counter per network namespace esp: delete NETIF_F_SCTP_CRC bit from features for esp offload ASoC: SOF: Intel: HDA: fix core status verification ASoC: wm8960: Fix wrong bclk and lrclk with pll enabled for some chips xfrm: Fix NULL pointer dereference on policy lookup virtchnl: Fix layout of RSS structures i40e: Added Asym_Pause to supported link modes i40e: Fix kernel oops when i40e driver removes VF's hostfs: fix memory handling in follow_link() amd-xgbe: Update DMA coherency values vxlan: do not modify the shared tunnel info when PMTU triggers an ICMP reply geneve: do not modify the shared tunnel info when PMTU triggers an ICMP reply sch_red: fix off-by-one checks in red_check_params() drivers/net/wan/hdlc_fr: Fix a double free in pvc_xmit arm64: dts: imx8mm/q: Fix pad control of SD1_DATA0 xfrm: Provide private skb extensions for segmented and hw offloaded ESP packets can: bcm/raw: fix msg_namelen values depending on CAN_REQUIRED_SIZE can: isotp: fix msg_namelen values depending on CAN_REQUIRED_SIZE mlxsw: spectrum: Fix ECN marking in tunnel decapsulation ethernet: myri10ge: Fix a use after free in myri10ge_sw_tso gianfar: Handle error code at MAC address change net: dsa: Fix type was not set for devlink port cxgb4: avoid collecting SGE_QBASE regs during traffic net:tipc: Fix a double free in tipc_sk_mcast_rcv ARM: dts: imx6: pbab01: Set vmmc supply for both SD interfaces net/ncsi: Avoid channel_monitor hrtimer deadlock net: qrtr: Fix memory leak on qrtr_tx_wait failure nfp: flower: ignore duplicate merge hints from FW net: phy: broadcom: Only advertise EEE for supported modes I2C: JZ4780: Fix bug for Ingenic X1000. ASoC: sunxi: sun4i-codec: fill ASoC card owner net/mlx5e: Fix mapping of ct_label zero net/mlx5e: Fix ethtool indication of connector type net/mlx5: Don't request more than supported EQs net/rds: Fix a use after free in rds_message_map_pages xdp: fix xdp_return_frame() kernel BUG throw for page_pool memory model soc/fsl: qbman: fix conflicting alignment attributes i40e: Fix display statistics for veb_tc RDMA/rtrs-clt: Close rtrs client conn before destroying rtrs clt session files drm/msm: Set drvdata to NULL when msm_drm_init() fails net: udp: Add support for getsockopt(..., ..., UDP_GRO, ..., ...); mptcp: forbit mcast-related sockopt on MPTCP sockets scsi: ufs: core: Fix task management request completion timeout scsi: ufs: core: Fix wrong Task Tag used in task management request UPIUs net: cls_api: Fix uninitialised struct field bo->unlocked_driver_cb net: macb: restore cmp registers on resume path clk: fix invalid usage of list cursor in register clk: fix invalid usage of list cursor in unregister workqueue: Move the position of debug_work_activate() in __queue_work() s390/cpcmd: fix inline assembly register clobbering perf inject: Fix repipe usage net: openvswitch: conntrack: simplify the return expression of ovs_ct_limit_get_default_limit() openvswitch: fix send of uninitialized stack memory in ct limit reply i2c: designware: Adjust bus_freq_hz when refuse high speed mode set iwlwifi: fix 11ax disabled bit in the regulatory capability flags can: mcp251x: fix support for half duplex SPI host controllers tipc: increment the tmp aead refcnt before attaching it net: hns3: clear VF down state bit before request link status net/mlx5: Fix placement of log_max_flow_counter net/mlx5: Fix PPLM register mapping net/mlx5: Fix PBMC register mapping RDMA/cxgb4: check for ipv6 address properly while destroying listener perf report: Fix wrong LBR block sorting RDMA/qedr: Fix kernel panic when trying to access recv_cq drm/vc4: crtc: Reduce PV fifo threshold on hvs4 i40e: Fix parameters in aq_get_phy_register() RDMA/addr: Be strict with gid size vdpa/mlx5: should exclude header length and fcs from mtu vdpa/mlx5: Fix wrong use of bit numbers RAS/CEC: Correct ce_add_elem()'s returned values clk: socfpga: fix iomem pointer cast on 64-bit lockdep: Address clang -Wformat warning printing for %hd dt-bindings: net: ethernet-controller: fix typo in NVMEM net: sched: bump refcount for new action in ACT replace mode gpiolib: Read "gpio-line-names" from a firmware node cfg80211: remove WARN_ON() in cfg80211_sme_connect net: tun: set tun->dev->addr_len during TUNSETLINK processing drivers: net: fix memory leak in atusb_probe drivers: net: fix memory leak in peak_usb_create_dev net: mac802154: Fix general protection fault net: ieee802154: nl-mac: fix check on panid net: ieee802154: fix nl802154 del llsec key net: ieee802154: fix nl802154 del llsec dev net: ieee802154: fix nl802154 add llsec key net: ieee802154: fix nl802154 del llsec devkey net: ieee802154: forbid monitor for set llsec params net: ieee802154: forbid monitor for del llsec seclevel net: ieee802154: stop dump llsec params for monitors Revert "net: sched: bump refcount for new action in ACT replace mode" Linux 5.10.30 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ie8754a2e4dfef03bf1f2b878843cde19a4adab21	2021-04-15 14:23:41 +02:00
Eric Dumazet	d38bce5adc	sch_red: fix off-by-one checks in red_check_params() ... [ Upstream commit 3a87571f0f ] This fixes following syzbot report: UBSAN: shift-out-of-bounds in ./include/net/red.h:237:23 shift exponent 32 is too large for 32-bit type 'unsigned int' CPU: 1 PID: 8418 Comm: syz-executor170 Not tainted 5.12.0-rc4-next-20210324-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x141/0x1d7 lib/dump_stack.c:120 ubsan_epilogue+0xb/0x5a lib/ubsan.c:148 __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:327 red_set_parms include/net/red.h:237 [inline] choke_change.cold+0x3c/0xc8 net/sched/sch_choke.c:414 qdisc_create+0x475/0x12f0 net/sched/sch_api.c:1247 tc_modify_qdisc+0x4c8/0x1a50 net/sched/sch_api.c:1663 rtnetlink_rcv_msg+0x44e/0xad0 net/core/rtnetlink.c:5553 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2502 netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline] netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1338 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1927 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:674 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2350 ___sys_sendmsg+0xf3/0x170 net/socket.c:2404 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2433 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x43f039 Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffdfa725168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000400488 RCX: 000000000043f039 RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000004 RBP: 0000000000403020 R08: 0000000000400488 R09: 0000000000400488 R10: 0000000000400488 R11: 0000000000000246 R12: 00000000004030b0 R13: 0000000000000000 R14: 00000000004ac018 R15: 0000000000400488 Fixes: 8afa10cbe2 ("net_sched: red: Avoid illegal values") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-04-14 08:42:07 +02:00
Steffen Klassert	95d58bf5ed	xfrm: Fix NULL pointer dereference on policy lookup ... [ Upstream commit b1e3a56070 ] When xfrm interfaces are used in combination with namespaces and ESP offload, we get a dst_entry NULL pointer dereference. This is because we don't have a dst_entry attached in the ESP offloading case and we need to do a policy lookup before the namespace transition. Fix this by expicit checking of skb_dst(skb) before accessing it. Fixes: f203b76d78 ("xfrm: Add virtual xfrm interfaces") Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-04-14 08:42:06 +02:00
Ahmed S. Darwish	0224432a8f	net: xfrm: Localize sequence counter per network namespace ... [ Upstream commit e88add19f6 ] A sequence counter write section must be serialized or its internal state can get corrupted. The "xfrm_state_hash_generation" seqcount is global, but its write serialization lock (net->xfrm.xfrm_state_lock) is instantiated per network namespace. The write protection is thus insufficient. To provide full protection, localize the sequence counter per network namespace instead. This should be safe as both the seqcount read and write sections access data exclusively within the network namespace. It also lays the foundation for transforming "xfrm_state_hash_generation" data type from seqcount_t to seqcount_LOCKNAME_t in further commits. Fixes: b65e3d7be0 ("xfrm: state: add sequence count to detect hash resizes") Signed-off-by: Ahmed S. Darwish <a.darwish@linutronix.de> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-04-14 08:42:05 +02:00
Evan Nimmo	c7a175a24b	xfrm: Use actual socket sk instead of skb socket for xfrm_output_resume ... [ Upstream commit 9ab1265d52 ] A situation can occur where the interface bound to the sk is different to the interface bound to the sk attached to the skb. The interface bound to the sk is the correct one however this information is lost inside xfrm_output2 and instead the sk on the skb is used in xfrm_output_resume instead. This assumes that the sk bound interface and the bound interface attached to the sk within the skb are the same which can lead to lookup failures inside ip_route_me_harder resulting in the packet being dropped. We have an l2tp v3 tunnel with ipsec protection. The tunnel is in the global VRF however we have an encapsulated dot1q tunnel interface that is within a different VRF. We also have a mangle rule that marks the packets causing them to be processed inside ip_route_me_harder. Prior to commit 31c70d5956 ("l2tp: keep original skb ownership") this worked fine as the sk attached to the skb was changed from the dot1q encapsulated interface to the sk for the tunnel which meant the interface bound to the sk and the interface bound to the skb were identical. Commit 46d6c5ae95 ("netfilter: use actual socket sk rather than skb sk when routing harder") fixed some of these issues however a similar problem existed in the xfrm code. Fixes: 31c70d5956 ("l2tp: keep original skb ownership") Signed-off-by: Evan Nimmo <evan.nimmo@alliedtelesis.co.nz> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-04-14 08:42:05 +02:00
Vlad Buslov	4a78ae1278	net: sched: fix err handler in tcf_action_init() ... [ Upstream commit b3650bf76a ] With recent changes that separated action module load from action initialization tcf_action_init() function error handling code was modified to manually release the loaded modules if loading/initialization of any further action in same batch failed. For the case when all modules successfully loaded and some of the actions were initialized before one of them failed in init handler. In this case for all previous actions the module will be released twice by the error handler: First time by the loop that manually calls module_put() for all ops, and second time by the action destroy code that puts the module after destroying the action. Reproduction: $ sudo tc actions add action simple sdata \"2\" index 2 $ sudo tc actions add action simple sdata \"1\" index 1 \ action simple sdata \"2\" index 2 RTNETLINK answers: File exists We have an error talking to the kernel $ sudo tc actions ls action simple total acts 1 action order 0: Simple <"2"> index 2 ref 1 bind 0 $ sudo tc actions flush action simple $ sudo tc actions ls action simple $ sudo tc actions add action simple sdata \"2\" index 2 Error: Failed to load TC action module. We have an error talking to the kernel $ lsmod | grep simple act_simple 20480 -1 Fix the issue by modifying module reference counting handling in action initialization code: - Get module reference in tcf_idr_create() and put it in tcf_idr_release() instead of taking over the reference held by the caller. - Modify users of tcf_action_init_1() to always release the module reference which they obtain before calling init function instead of assuming that created action takes over the reference. - Finally, modify tcf_action_init_1() to not release the module reference when overwriting existing action as this is no longer necessary since both upper and lower layers obtain and manage their own module references independently. Fixes: d349f99768 ("net_sched: fix RTNL deadlock again caused by request_module()") Suggested-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: Vlad Buslov <vladbu@nvidia.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-04-14 08:42:05 +02:00
Paolo Abeni	b830650c1a	net: let skb_orphan_partial wake-up waiters. ... commit 9adc89af72 upstream. Currently the mentioned helper can end-up freeing the socket wmem without waking-up any processes waiting for more write memory. If the partially orphaned skb is attached to an UDP (or raw) socket, the lack of wake-up can hang the user-space. Even for TCP sockets not calling the sk destructor could have bad effects on TSQ. Address the issue using skb_orphan to release the sk wmem before setting the new sock_efree destructor. Additionally bundle the whole ownership update in a new helper, so that later other potential users could avoid duplicate code. v1 -> v2: - use skb_orphan() instead of sort of open coding it (Eric) - provide an helper for the ownership change (Eric) Fixes: f6ba8d33cf ("netem: fix skb_orphan_partial()") Suggested-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Paolo Abeni <pabeni@redhat.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-04-14 08:42:03 +02:00
Vlad Buslov	81692c6add	net: sched: fix action overwrite reference counting ... commit 87c750e8c3 upstream. Action init code increments reference counter when it changes an action. This is the desired behavior for cls API which needs to obtain action reference for every classifier that points to action. However, act API just needs to change the action and releases the reference before returning. This sequence breaks when the requested action doesn't exist, which causes act API init code to create new action with specified index, but action is still released before returning and is deleted (unless it was referenced concurrently by cls API). Reproduction: $ sudo tc actions ls action gact $ sudo tc actions change action gact drop index 1 $ sudo tc actions ls action gact Extend tcf_action_init() to accept 'init_res' array and initialize it with action->ops->init() result. In tcf_action_add() remove pointers to created actions from actions array before passing it to tcf_action_put_many(). Fixes: cae422f379 ("net: sched: use reference counting action init") Reported-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Signed-off-by: Vlad Buslov <vladbu@nvidia.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-04-14 08:42:02 +02:00
Greg Kroah-Hartman	421e0ec416	Revert "Revert "can: dev: Move device back to init netns on owning netns delete"" ... This reverts commit 4ca012d8ea as the kabi can be updated at this point in time. Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I5f2d693199b3bf04eb00c0380c4b426c1749f62e	2021-04-09 21:09:04 -07:00
Greg Kroah-Hartman	4ca012d8ea	Revert "can: dev: Move device back to init netns on owning netns delete" ... This reverts commit 8dc08a2962 which is commit 3a5ca85707 upstream. It breaks the networking api and we do not care about CAN devices in Android systems at this point in time. Bug: 161946584 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I5d5de8fccb077249478b7d1e136f91d6be0b20cd	2021-04-02 15:25:51 +02:00
Greg Kroah-Hartman	b9a61f9a56	Merge 5.10.27 into android12-5.10 ... Changes in 5.10.27 mm/memcg: rename mem_cgroup_split_huge_fixup to split_page_memcg and add nr_pages argument mm/memcg: set memcg when splitting page mt76: fix tx skb error handling in mt76_dma_tx_queue_skb net: stmmac: fix dma physical address of descriptor when display ring net: fec: ptp: avoid register access when ipg clock is disabled powerpc/4xx: Fix build errors from mfdcr() atm: eni: dont release is never initialized atm: lanai: dont run lanai_dev_close if not open Revert "r8152: adjust the settings about MAC clock speed down for RTL8153" ALSA: hda: ignore invalid NHLT table ixgbe: Fix memleak in ixgbe_configure_clsu32 scsi: ufs: ufs-qcom: Disable interrupt in reset path blk-cgroup: Fix the recursive blkg rwstat net: tehuti: fix error return code in bdx_probe() net: intel: iavf: fix error return code of iavf_init_get_resources() sun/niu: fix wrong RXMAC_BC_FRM_CNT_COUNT count gianfar: fix jumbo packets+napi+rx overrun crash cifs: ask for more credit on async read/write code paths gfs2: fix use-after-free in trans_drain cpufreq: blacklist Arm Vexpress platforms in cpufreq-dt-platdev gpiolib: acpi: Add missing IRQF_ONESHOT nfs: fix PNFS_FLEXFILE_LAYOUT Kconfig default NFS: Correct size calculation for create reply length net: hisilicon: hns: fix error return code of hns_nic_clear_all_rx_fetch() net: wan: fix error return code of uhdlc_init() net: davicom: Use platform_get_irq_optional() net: enetc: set MAC RX FIFO to recommended value atm: uPD98402: fix incorrect allocation atm: idt77252: fix null-ptr-dereference cifs: change noisy error message to FYI irqchip/ingenic: Add support for the JZ4760 kbuild: add image_name to no-sync-config-targets kbuild: dummy-tools: fix inverted tests for gcc umem: fix error return code in mm_pci_probe() sparc64: Fix opcode filtering in handling of no fault loads habanalabs: Call put_pid() when releasing control device staging: rtl8192e: fix kconfig dependency on CRYPTO u64_stats,lockdep: Fix u64_stats_init() vs lockdep kselftest: arm64: Fix exit code of sve-ptrace regulator: qcom-rpmh: Correct the pmic5_hfsmps515 buck block: Fix REQ_OP_ZONE_RESET_ALL handling drm/amd/display: Revert dram_clock_change_latency for DCN2.1 drm/amdgpu: fb BO should be ttm_bo_type_device drm/radeon: fix AGP dependency nvme: simplify error logic in nvme_validate_ns() nvme: add NVME_REQ_CANCELLED flag in nvme_cancel_request() nvme-fc: set NVME_REQ_CANCELLED in nvme_fc_terminate_exchange() nvme-fc: return NVME_SC_HOST_ABORTED_CMD when a command has been aborted nvme-core: check ctrl css before setting up zns nvme-rdma: Fix a use after free in nvmet_rdma_write_data_done nvme-pci: add the DISABLE_WRITE_ZEROES quirk for a Samsung PM1725a nfs: we don't support removing system.nfs4_acl block: Suppress uevent for hidden device when removed mm/fork: clear PASID for new mm ia64: fix ia64_syscall_get_set_arguments() for break-based syscalls ia64: fix ptrace(PTRACE_SYSCALL_INFO_EXIT) sign static_call: Pull some static_call declarations to the type headers static_call: Allow module use without exposing static_call_key static_call: Fix the module key fixup static_call: Fix static_call_set_init() KVM: x86: Protect userspace MSR filter with SRCU, and set atomically-ish btrfs: fix sleep while in non-sleep context during qgroup removal selinux: don't log MAC_POLICY_LOAD record on failed policy load selinux: fix variable scope issue in live sidtab conversion netsec: restore phy power state after controller reset platform/x86: intel-vbtn: Stop reporting SW_DOCK events psample: Fix user API breakage z3fold: prevent reclaim/free race for headless pages squashfs: fix inode lookup sanity checks squashfs: fix xattr id and id lookup sanity checks hugetlb_cgroup: fix imbalanced css_get and css_put pair for shared mappings kasan: fix per-page tags for non-page_alloc pages gcov: fix clang-11+ support ACPI: video: Add missing callback back for Sony VPCEH3U1E ACPICA: Always create namespace nodes using acpi_ns_create_node() arm64: stacktrace: don't trace arch_stack_walk() arm64: dts: ls1046a: mark crypto engine dma coherent arm64: dts: ls1012a: mark crypto engine dma coherent arm64: dts: ls1043a: mark crypto engine dma coherent ARM: dts: at91: sam9x60: fix mux-mask for PA7 so it can be set to A, B and C ARM: dts: at91: sam9x60: fix mux-mask to match product's datasheet ARM: dts: at91-sama5d27_som1: fix phy address to 7 integrity: double check iint_cache was initialized drm/etnaviv: Use FOLL_FORCE for userptr drm/amd/pm: workaround for audio noise issue drm/amdgpu/display: restore AUX_DPHY_TX_CONTROL for DCN2.x drm/amdgpu: Add additional Sienna Cichlid PCI ID drm/i915: Fix the GT fence revocation runtime PM logic dm verity: fix DM_VERITY_OPTS_MAX value dm ioctl: fix out of bounds array access when no devices bus: omap_l3_noc: mark l3 irqs as IRQF_NO_THREAD ARM: OMAP2+: Fix smartreflex init regression after dropping legacy data soc: ti: omap-prm: Fix occasional abort on reset deassert for dra7 iva veth: Store queue_mapping independently of XDP prog presence bpf: Change inode_storage's lookup_elem return value from NULL to -EBADF libbpf: Fix INSTALL flag order net/mlx5e: RX, Mind the MPWQE gaps when calculating offsets net/mlx5e: When changing XDP program without reset, take refs for XSK RQs net/mlx5e: Don't match on Geneve options in case option masks are all zero ipv6: fix suspecious RCU usage warning drop_monitor: Perform cleanup upon probe registration failure macvlan: macvlan_count_rx() needs to be aware of preemption net: sched: validate stab values net: dsa: bcm_sf2: Qualify phydev->dev_flags based on port igc: reinit_locked() should be called with rtnl_lock igc: Fix Pause Frame Advertising igc: Fix Supported Pause Frame Link Setting igc: Fix igc_ptp_rx_pktstamp() e1000e: add rtnl_lock() to e1000_reset_task e1000e: Fix error handling in e1000_set_d0_lplu_state_82571 net/qlcnic: Fix a use after free in qlcnic_83xx_get_minidump_template net: phy: broadcom: Add power down exit reset state delay ftgmac100: Restart MAC HW once clk: qcom: gcc-sc7180: Use floor ops for the correct sdcc1 clk net: ipa: terminate message handler arrays net: qrtr: fix a kernel-infoleak in qrtr_recvmsg() flow_dissector: fix byteorder of dissected ICMP ID selftests/bpf: Set gopt opt_class to 0 if get tunnel opt failed netfilter: ctnetlink: fix dump of the expect mask attribute net: hdlc_x25: Prevent racing between "x25_close" and "x25_xmit"/"x25_rx" net: phylink: Fix phylink_err() function name error in phylink_major_config tipc: better validate user input in tipc_nl_retrieve_key() tcp: relookup sock for RST+ACK packets handled by obsolete req sock can: isotp: isotp_setsockopt(): only allow to set low level TX flags for CAN-FD can: isotp: TX-path: ensure that CAN frame flags are initialized can: peak_usb: add forgotten supported devices can: flexcan: flexcan_chip_freeze(): fix chip freeze for missing bitrate can: kvaser_pciefd: Always disable bus load reporting can: c_can_pci: c_can_pci_remove(): fix use-after-free can: c_can: move runtime PM enable/disable to c_can_platform can: m_can: m_can_do_rx_poll(): fix extraneous msg loss warning can: m_can: m_can_rx_peripheral(): fix RX being blocked by errors mac80211: fix rate mask reset mac80211: Allow HE operation to be longer than expected. selftests/net: fix warnings on reuseaddr_ports_exhausted nfp: flower: fix unsupported pre_tunnel flows nfp: flower: add ipv6 bit to pre_tunnel control message nfp: flower: fix pre_tun mask id allocation ftrace: Fix modify_ftrace_direct. drm/msm/dsi: fix check-before-set in the 7nm dsi_pll code ionic: linearize tso skb with too many frags net/sched: cls_flower: fix only mask bit check in the validate_ct_state netfilter: nftables: report EOPNOTSUPP on unsupported flowtable flags netfilter: nftables: allow to update flowtable flags netfilter: flowtable: Make sure GC works periodically in idle system libbpf: Fix error path in bpf_object__elf_init() libbpf: Use SOCK_CLOEXEC when opening the netlink socket ARM: dts: imx6ull: fix ubi filesystem mount failed ipv6: weaken the v4mapped source check octeontx2-af: Formatting debugfs entry rsrc_alloc. octeontx2-af: Modify default KEX profile to extract TX packet fields octeontx2-af: Remove TOS field from MKEX TX octeontx2-af: Fix irq free in rvu teardown octeontx2-pf: Clear RSS enable flag on interace down octeontx2-af: fix infinite loop in unmapping NPC counter net: check all name nodes in __dev_alloc_name net: cdc-phonet: fix data-interface release on probe failure igb: check timestamp validity r8152: limit the RX buffer size of RTL8153A for USB 2.0 net: stmmac: dwmac-sun8i: Provide TX and RX fifo sizes selinux: vsock: Set SID for socket returned by accept() selftests: forwarding: vxlan_bridge_1d: Fix vxlan ecn decapsulate value libbpf: Fix BTF dump of pointer-to-array-of-struct bpf: Fix umd memory leak in copy_process() can: isotp: tx-path: zero initialize outgoing CAN frames drm/msm: fix shutdown hook in case GPU components failed to bind drm/msm: Fix suspend/resume on i.MX5 arm64: kdump: update ppos when reading elfcorehdr PM: runtime: Defer suspending suppliers net/mlx5: Add back multicast stats for uplink representor net/mlx5e: Allow to match on MPLS parameters only for MPLS over UDP net/mlx5e: Offload tuple rewrite for non-CT flows net/mlx5e: Fix error path for ethtool set-priv-flag PM: EM: postpone creating the debugfs dir till fs_initcall net: bridge: don't notify switchdev for local FDB addresses octeontx2-af: Fix memory leak of object buf xen/x86: make XEN_BALLOON_MEMORY_HOTPLUG_LIMIT depend on MEMORY_HOTPLUG RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server bpf: Don't do bpf_cgroup_storage_set() for kuprobe/tp programs net: Consolidate common blackhole dst ops net, bpf: Fix ip6ip6 crash with collect_md populated skbs igb: avoid premature Rx buffer reuse net: axienet: Properly handle PCS/PMA PHY for 1000BaseX mode net: axienet: Fix probe error cleanup net: phy: introduce phydev->port net: phy: broadcom: Avoid forward for bcm54xx_config_clock_delay() net: phy: broadcom: Set proper 1000BaseX/SGMII interface mode for BCM54616S net: phy: broadcom: Fix RGMII delays for BCM50160 and BCM50610M Revert "netfilter: x_tables: Switch synchronization to RCU" netfilter: x_tables: Use correct memory barriers. dm table: Fix zoned model check and zone sectors check mm/mmu_notifiers: ensure range_end() is paired with range_start() Revert "netfilter: x_tables: Update remaining dereference to RCU" ACPI: scan: Rearrange memory allocation in acpi_device_add() ACPI: scan: Use unique number for instance_no perf auxtrace: Fix auxtrace queue conflict perf synthetic events: Avoid write of uninitialized memory when generating PERF_RECORD_MMAP* records io_uring: fix provide_buffers sign extension block: recalculate segment count for multi-segment discards correctly scsi: Revert "qla2xxx: Make sure that aborted commands are freed" scsi: qedi: Fix error return code of qedi_alloc_global_queues() scsi: mpt3sas: Fix error return code of mpt3sas_base_attach() smb3: fix cached file size problems in duplicate extents (reflink) cifs: Adjust key sizes and key generation routines for AES256 encryption locking/mutex: Fix non debug version of mutex_lock_io_nested() x86/mem_encrypt: Correct physical address calculation in __set_clr_pte_enc() mm/memcg: fix 5.10 backport of splitting page memcg fs/cachefiles: Remove wait_bit_key layout dependency ch_ktls: fix enum-conversion warning can: dev: Move device back to init netns on owning netns delete r8169: fix DMA being used after buffer free if WoL is enabled net: dsa: b53: VLAN filtering is global to all users mac80211: fix double free in ibss_leave ext4: add reclaim checks to xattr code fs/ext4: fix integer overflow in s_log_groups_per_flex Revert "xen: fix p2m size in dom0 for disabled memory hotplug case" Revert "net: bonding: fix error return code of bond_neigh_init()" nvme: fix the nsid value to print in nvme_validate_or_alloc_ns can: peak_usb: Revert "can: peak_usb: add forgotten supported devices" xen-blkback: don't leak persistent grants from xen_blkbk_map() Linux 5.10.27 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I7eafe976fd6bf33db6db4adb8ebf2ff087294a23	2021-04-02 15:25:50 +02:00
Martin Willi	8dc08a2962	can: dev: Move device back to init netns on owning netns delete ... commit 3a5ca85707 upstream. When a non-initial netns is destroyed, the usual policy is to delete all virtual network interfaces contained, but move physical interfaces back to the initial netns. This keeps the physical interface visible on the system. CAN devices are somewhat special, as they define rtnl_link_ops even if they are physical devices. If a CAN interface is moved into a non-initial netns, destroying that netns lets the interface vanish instead of moving it back to the initial netns. default_device_exit() skips CAN interfaces due to having rtnl_link_ops set. Reproducer: ip netns add foo ip link set can0 netns foo ip netns delete foo WARNING: CPU: 1 PID: 84 at net/core/dev.c:11030 ops_exit_list+0x38/0x60 CPU: 1 PID: 84 Comm: kworker/u4:2 Not tainted 5.10.19 #1 Workqueue: netns cleanup_net [<c010e700>] (unwind_backtrace) from [<c010a1d8>] (show_stack+0x10/0x14) [<c010a1d8>] (show_stack) from [<c086dc10>] (dump_stack+0x94/0xa8) [<c086dc10>] (dump_stack) from [<c086b938>] (__warn+0xb8/0x114) [<c086b938>] (__warn) from [<c086ba10>] (warn_slowpath_fmt+0x7c/0xac) [<c086ba10>] (warn_slowpath_fmt) from [<c0629f20>] (ops_exit_list+0x38/0x60) [<c0629f20>] (ops_exit_list) from [<c062a5c4>] (cleanup_net+0x230/0x380) [<c062a5c4>] (cleanup_net) from [<c0142c20>] (process_one_work+0x1d8/0x438) [<c0142c20>] (process_one_work) from [<c0142ee4>] (worker_thread+0x64/0x5a8) [<c0142ee4>] (worker_thread) from [<c0148a98>] (kthread+0x148/0x14c) [<c0148a98>] (kthread) from [<c0100148>] (ret_from_fork+0x14/0x2c) To properly restore physical CAN devices to the initial netns on owning netns exit, introduce a flag on rtnl_link_ops that can be set by drivers. For CAN devices setting this flag, default_device_exit() considers them non-virtual, applying the usual namespace move. The issue was introduced in the commit mentioned below, as at that time CAN devices did not have a dellink() operation. Fixes: e008b5fc8d ("net: Simplfy default_device_exit and improve batching.") Link: https://lore.kernel.org/r/20210302122423.872326-1-martin@strongswan.org Signed-off-by: Martin Willi <martin@strongswan.org> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-03-30 14:32:08 +02:00
Daniel Borkmann	0a245acbce	net: Consolidate common blackhole dst ops ... [ Upstream commit c4c877b273 ] Move generic blackhole dst ops to the core and use them from both ipv4_dst_blackhole_ops and ip6_dst_blackhole_ops where possible. No functional change otherwise. We need these also in other locations and having to define them over and over again is not great. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-03-30 14:32:05 +02:00
Pablo Neira Ayuso	186d8dc40a	netfilter: nftables: allow to update flowtable flags ... [ Upstream commit 7b35582cd0 ] Honor flowtable flags from the control update path. Disallow disabling to toggle hardware offload support though. Fixes: 8bb69f3b29 ("netfilter: nf_tables: add flowtable offload control plane") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-03-30 14:32:01 +02:00
Alexander Ovechkin	63f2a9bd31	tcp: relookup sock for RST+ACK packets handled by obsolete req sock ... [ Upstream commit 7233da8669 ] Currently tcp_check_req can be called with obsolete req socket for which big socket have been already created (because of CPU race or early demux assigning req socket to multiple packets in gro batch). Commit e0f9759f53 ("tcp: try to keep packet if SYN_RCV race is lost") added retry in case when tcp_check_req is called for PSH|ACK packet. But if client sends RST+ACK immediatly after connection being established (it is performing healthcheck, for example) retry does not occur. In that case tcp_check_req tries to close req socket, leaving big socket active. Fixes: e0f9759f53 ("tcp: try to keep packet if SYN_RCV race is lost") Signed-off-by: Alexander Ovechkin <ovov@yandex-team.ru> Reported-by: Oleg Senin <olegsenin@yandex-team.ru> Reviewed-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-03-30 14:31:59 +02:00
Eric Dumazet	f642700279	net: sched: validate stab values ... [ Upstream commit e323d865b3 ] iproute2 package is well behaved, but malicious user space can provide illegal shift values and trigger UBSAN reports. Add stab parameter to red_check_params() to validate user input. syzbot reported: UBSAN: shift-out-of-bounds in ./include/net/red.h:312:18 shift exponent 111 is too large for 64-bit type 'long unsigned int' CPU: 1 PID: 14662 Comm: syz-executor.3 Not tainted 5.12.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x141/0x1d7 lib/dump_stack.c:120 ubsan_epilogue+0xb/0x5a lib/ubsan.c:148 __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:327 red_calc_qavg_from_idle_time include/net/red.h:312 [inline] red_calc_qavg include/net/red.h:353 [inline] choke_enqueue.cold+0x18/0x3dd net/sched/sch_choke.c:221 __dev_xmit_skb net/core/dev.c:3837 [inline] __dev_queue_xmit+0x1943/0x2e00 net/core/dev.c:4150 neigh_hh_output include/net/neighbour.h:499 [inline] neigh_output include/net/neighbour.h:508 [inline] ip6_finish_output2+0x911/0x1700 net/ipv6/ip6_output.c:117 __ip6_finish_output net/ipv6/ip6_output.c:182 [inline] __ip6_finish_output+0x4c1/0xe10 net/ipv6/ip6_output.c:161 ip6_finish_output+0x35/0x200 net/ipv6/ip6_output.c:192 NF_HOOK_COND include/linux/netfilter.h:290 [inline] ip6_output+0x1e4/0x530 net/ipv6/ip6_output.c:215 dst_output include/net/dst.h:448 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] NF_HOOK include/linux/netfilter.h:295 [inline] ip6_xmit+0x127e/0x1eb0 net/ipv6/ip6_output.c:320 inet6_csk_xmit+0x358/0x630 net/ipv6/inet6_connection_sock.c:135 dccp_transmit_skb+0x973/0x12c0 net/dccp/output.c:138 dccp_send_reset+0x21b/0x2b0 net/dccp/output.c:535 dccp_finish_passive_close net/dccp/proto.c:123 [inline] dccp_finish_passive_close+0xed/0x140 net/dccp/proto.c:118 dccp_terminate_connection net/dccp/proto.c:958 [inline] dccp_close+0xb3c/0xe60 net/dccp/proto.c:1028 inet_release+0x12e/0x280 net/ipv4/af_inet.c:431 inet6_release+0x4c/0x70 net/ipv6/af_inet6.c:478 __sock_release+0xcd/0x280 net/socket.c:599 sock_close+0x18/0x20 net/socket.c:1258 __fput+0x288/0x920 fs/file_table.c:280 task_work_run+0xdd/0x1a0 kernel/task_work.c:140 tracehook_notify_resume include/linux/tracehook.h:189 [inline] Fixes: 8afa10cbe2 ("net_sched: red: Avoid illegal values") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-03-30 14:31:57 +02:00
Wei Wang	7f041ee8ef	ipv6: fix suspecious RCU usage warning ... [ Upstream commit 28259bac7f ] Syzbot reported the suspecious RCU usage in nexthop_fib6_nh() when called from ipv6_route_seq_show(). The reason is ipv6_route_seq_start() calls rcu_read_lock_bh(), while nexthop_fib6_nh() calls rcu_dereference_rtnl(). The fix proposed is to add a variant of nexthop_fib6_nh() to use rcu_dereference_bh_rtnl() for ipv6_route_seq_show(). The reported trace is as follows: ./include/net/nexthop.h:416 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 2 locks held by syz-executor.0/17895: at: seq_read+0x71/0x12a0 fs/seq_file.c:169 at: seq_file_net include/linux/seq_file_net.h:19 [inline] at: ipv6_route_seq_start+0xaf/0x300 net/ipv6/ip6_fib.c:2616 stack backtrace: CPU: 1 PID: 17895 Comm: syz-executor.0 Not tainted 4.15.0-syzkaller #0 Call Trace: [<ffffffff849edf9e>] __dump_stack lib/dump_stack.c:17 [inline] [<ffffffff849edf9e>] dump_stack+0xd8/0x147 lib/dump_stack.c:53 [<ffffffff8480b7fa>] lockdep_rcu_suspicious+0x153/0x15d kernel/locking/lockdep.c:5745 [<ffffffff8459ada6>] nexthop_fib6_nh include/net/nexthop.h:416 [inline] [<ffffffff8459ada6>] ipv6_route_native_seq_show net/ipv6/ip6_fib.c:2488 [inline] [<ffffffff8459ada6>] ipv6_route_seq_show+0x436/0x7a0 net/ipv6/ip6_fib.c:2673 [<ffffffff81c556df>] seq_read+0xccf/0x12a0 fs/seq_file.c:276 [<ffffffff81dbc62c>] proc_reg_read+0x10c/0x1d0 fs/proc/inode.c:231 [<ffffffff81bc28ae>] do_loop_readv_writev fs/read_write.c:714 [inline] [<ffffffff81bc28ae>] do_loop_readv_writev fs/read_write.c:701 [inline] [<ffffffff81bc28ae>] do_iter_read+0x49e/0x660 fs/read_write.c:935 [<ffffffff81bc81ab>] vfs_readv+0xfb/0x170 fs/read_write.c:997 [<ffffffff81c88847>] kernel_readv fs/splice.c:361 [inline] [<ffffffff81c88847>] default_file_splice_read+0x487/0x9c0 fs/splice.c:416 [<ffffffff81c86189>] do_splice_to+0x129/0x190 fs/splice.c:879 [<ffffffff81c86f66>] splice_direct_to_actor+0x256/0x890 fs/splice.c:951 [<ffffffff81c8777d>] do_splice_direct+0x1dd/0x2b0 fs/splice.c:1060 [<ffffffff81bc4747>] do_sendfile+0x597/0xce0 fs/read_write.c:1459 [<ffffffff81bca205>] SYSC_sendfile64 fs/read_write.c:1520 [inline] [<ffffffff81bca205>] SyS_sendfile64+0x155/0x170 fs/read_write.c:1506 [<ffffffff81015fcf>] do_syscall_64+0x1ff/0x310 arch/x86/entry/common.c:305 [<ffffffff84a00076>] entry_SYSCALL_64_after_hwframe+0x42/0xb7 Fixes: f88d8ea67f ("ipv6: Plumb support for nexthop object in a fib6_info") Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: Wei Wang <weiwan@google.com> Cc: David Ahern <dsahern@kernel.org> Cc: Ido Schimmel <idosch@idosch.org> Cc: Petr Machata <petrm@nvidia.com> Cc: Eric Dumazet <edumazet@google.com> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Reviewed-by: David Ahern <dsahern@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-03-30 14:31:57 +02:00
Greg Kroah-Hartman	4732d8cf82	ANDROID: GKI: sock.h: add Android ABI padding to some structures ... Try to mitigate potential future driver core api changes by adding a padding to struct sock. Based on a patch from Michal Marek <mmarek@suse.cz> from the SLES kernel Leaf changes summary: 1 artifact changed Changed leaf types summary: 1 leaf type changed Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 0 Added function Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variable 'struct sock at sock.h:324:1' changed: type size changed from 6016 to 6528 (in bits) 8 data member insertions: 'u64 sock::android_kabi_reserved1', at offset 6016 (in bits) at sock.h:516:1 'u64 sock::android_kabi_reserved2', at offset 6080 (in bits) at sock.h:517:1 'u64 sock::android_kabi_reserved3', at offset 6144 (in bits) at sock.h:518:1 'u64 sock::android_kabi_reserved4', at offset 6208 (in bits) at sock.h:519:1 'u64 sock::android_kabi_reserved5', at offset 6272 (in bits) at sock.h:520:1 'u64 sock::android_kabi_reserved6', at offset 6336 (in bits) at sock.h:521:1 'u64 sock::android_kabi_reserved7', at offset 6400 (in bits) at sock.h:522:1 'u64 sock::android_kabi_reserved8', at offset 6464 (in bits) at sock.h:523:1 Bug: 151154716 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I61c3d6cf12c087345db71fc6d93ee6bd58969003	2021-03-22 15:05:31 +00:00
Greg Kroah-Hartman	73ff58b01f	ANDROID: GKI: networking: add Android ABI padding to a lot of networking structures ... Try to mitigate potential future driver core api changes by adding a padding to a lot of different networking structures: struct ipv6_devconf struct proto_ops struct header_ops struct napi_struct struct netdev_queue struct netdev_rx_queue struct xfrmdev_ops struct net_device_ops struct net_device struct packet_type struct sk_buff struct tlsdev_ops Based on a change made to the RHEL/CENTOS 8 kernel. Bug: 151154716 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I590f004754dbc8beafa40e71cac70a0938c38b4a	2021-03-18 16:04:29 +01:00
Greg Kroah-Hartman	4c95a92b84	ANDROID: GKI: add Android ABI padding to struct nf_conn ... Try to mitigate potential future driver core api changes by adding padding to struct nf_conn; Bug: 151154716 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ib18a9a929d351c66556f1f27b217cbf22b733a10	2021-03-18 14:54:15 +01:00