645 Commits

Author	SHA1	Message	Date
Greg Kroah-Hartman	8026d5839b	Merge 5.10.195 into android12-5.10-lts ... Changes in 5.10.195 erofs: ensure that the post-EOF tails are all zeroed ARM: pxa: remove use of symbol_get() mmc: au1xmmc: force non-modular build and remove symbol_get usage net: enetc: use EXPORT_SYMBOL_GPL for enetc_phc_index rtc: ds1685: use EXPORT_SYMBOL_GPL for ds1685_rtc_poweroff modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules USB: serial: option: add Quectel EM05G variant (0x030e) USB: serial: option: add FOXCONN T99W368/T99W373 product usb: dwc3: meson-g12a: do post init to fix broken usb after resumption usb: chipidea: imx: improve logic if samsung,picophy-* parameter is 0 HID: wacom: remove the battery when the EKR is off staging: rtl8712: fix race condition Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition configfs: fix a race in configfs_lookup() serial: qcom-geni: fix opp vote on shutdown serial: sc16is7xx: fix broken port 0 uart init serial: sc16is7xx: fix bug when first setting GPIO direction firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe fsi: master-ast-cf: Add MODULE_FIRMWARE macro nilfs2: fix general protection fault in nilfs_lookup_dirty_data_buffers() nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse pinctrl: amd: Don't show `Invalid config param` errors ASoC: rt5682: Fix a problem with error handling in the io init function of the soundwire ARM: dts: imx: update sdma node name format ARM: dts: imx7s: Drop dma-apb interrupt-names ARM: dts: imx: Adjust dma-apbh node name ARM: dts: imx: Set default tuning step for imx7d usdhc phy: qcom-snps-femto-v2: use qcom_snps_hsphy_suspend/resume error code media: pulse8-cec: handle possible ping error media: pci: cx23885: fix error handling for cx23885 ATSC boards 9p: virtio: make sure 'offs' is initialized in zc_request ASoC: da7219: Flush pending AAD IRQ when suspending ASoC: da7219: Check for failure reading AAD IRQ events ethernet: atheros: fix return value check in atl1c_tso_csum() vxlan: generalize vxlan_parse_gpe_hdr and remove unused args m68k: Fix invalid .section syntax s390/dasd: use correct number of retries for ERP requests s390/dasd: fix hanging device after request requeue fs/nls: make load_nls() take a const parameter ASoc: codecs: ES8316: Fix DMIC config ASoC: atmel: Fix the 8K sample parameter in I2SC master platform/x86: intel: hid: Always call BTNL ACPI method platform/x86: huawei-wmi: Silence ambient light sensor drm/amd/display: Exit idle optimizations before attempt to access PHY ovl: Always reevaluate the file signature for IMA ata: pata_arasan_cf: Use dev_err_probe() instead dev_err() in data_xfer() security: keys: perform capable check only on privileged operations kprobes: Prohibit probing on CFI preamble symbol clk: fixed-mmio: make COMMON_CLK_FIXED_MMIO depend on HAS_IOMEM vmbus_testing: fix wrong python syntax for integer value comparison net: usb: qmi_wwan: add Quectel EM05GV2 idmaengine: make FSL_EDMA and INTEL_IDMA64 depends on HAS_IOMEM scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock netlabel: fix shift wrapping bug in netlbl_catmap_setlong() bnx2x: fix page fault following EEH recovery sctp: handle invalid error codes without calling BUG() scsi: storvsc: Always set no_report_opcodes ALSA: seq: oss: Fix racy open/close of MIDI devices tracing: Introduce pipe_cpumask to avoid race on trace_pipes platform/mellanox: Fix mlxbf-tmfifo not handling all virtio CONSOLE notifications net: Avoid address overwrite in kernel_connect udf: Check consistency of Space Bitmap Descriptor udf: Handle error when adding extent to a file Revert "net: macsec: preserve ingress frame ordering" reiserfs: Check the return value from __getblk() eventfd: Export eventfd_ctx_do_read() eventfd: prevent underflow for eventfd semaphores fs: Fix error checking for d_hash_and_lookup() tmpfs: verify {g,u}id mount options correctly selftests/harness: Actually report SKIP for signal tests refscale: Fix uninitalized use of wait_queue_head_t OPP: Fix passing 0 to PTR_ERR in _opp_attach_genpd() selftests/resctrl: Don't leak buffer in fill_cache() selftests/resctrl: Unmount resctrl FS if child fails to run benchmark selftests/resctrl: Close perf value read fd on errors x86/decompressor: Don't rely on upper 32 bits of GPRs being preserved perf/imx_ddr: don't enable counter0 if none of 4 counters are used s390/pkey: fix/harmonize internal keyblob headers s390/paes: fix PKEY_TYPE_EP11_AES handling for secure keyblobs x86/efistub: Fix PCI ROM preservation in mixed mode cpufreq: powernow-k8: Use related_cpus instead of cpus in driver.exit() bpftool: Use a local bpf_perf_event_value to fix accessing its fields bpf: Clear the probe_addr for uprobe tcp: tcp_enter_quickack_mode() should be static hwrng: nomadik - keep clock enabled while hwrng is registered regmap: rbtree: Use alloc_flags for memory allocations udp: re-score reuseport groups when connected sockets are present bpf: reject unhashed sockets in bpf_sk_assign wifi: mt76: testmode: add nla_policy for MT76_TM_ATTR_TX_LENGTH spi: tegra20-sflash: fix to check return value of platform_get_irq() in tegra_sflash_probe() can: gs_usb: gs_usb_receive_bulk_callback(): count RX overflow errors also in case of OOM wifi: mwifiex: Fix OOB and integer underflow when rx packets wifi: mwifiex: fix error recovery in PCIE buffer descriptor management selftests/bpf: fix static assert compilation issue for test_cls_*.c crypto: stm32 - Properly handle pm_runtime_get failing crypto: api - Use work queue in crypto_destroy_instance Bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe() Bluetooth: Fix potential use-after-free when clear keys net: tcp: fix unexcepted socket die when snd_wnd is 0 selftests/bpf: Clean up fmod_ret in bench_rename test script ice: ice_aq_check_events: fix off-by-one check when filling buffer crypto: caam - fix unchecked return value error hwrng: iproc-rng200 - Implement suspend and resume calls lwt: Fix return values of BPF xmit ops lwt: Check LWTUNNEL_XMIT_CONTINUE strictly fs: ocfs2: namei: check return value of ocfs2_add_entry() wifi: mwifiex: fix memory leak in mwifiex_histogram_read() wifi: mwifiex: Fix missed return in oob checks failed path samples/bpf: fix broken map lookup probe wifi: ath9k: fix races between ath9k_wmi_cmd and ath9k_wmi_ctrl_rx wifi: ath9k: protect WMI command response buffer replacement with a lock wifi: mwifiex: avoid possible NULL skb pointer dereference Bluetooth: btusb: Do not call kfree_skb() under spin_lock_irqsave() wifi: ath9k: use IS_ERR() with debugfs_create_dir() net: arcnet: Do not call kfree_skb() under local_irq_disable() mlxsw: i2c: Fix chunk size setting in output mailbox buffer mlxsw: i2c: Limit single transaction buffer size hwmon: (tmp513) Fix the channel number in tmp51x_is_visible() net/sched: sch_hfsc: Ensure inner classes have fsc curve netrom: Deny concurrent connect(). drm/bridge: tc358764: Fix debug print parameter order quota: factor out dquot_write_dquot() quota: rename dquot_active() to inode_quota_active() quota: add new helper dquot_active() quota: fix dqput() to follow the guarantees dquot_srcu should provide ASoC: stac9766: fix build errors with REGMAP_AC97 soc: qcom: ocmem: Add OCMEM hardware version print soc: qcom: ocmem: Fix NUM_PORTS & NUM_MACROS macros arm64: dts: qcom: msm8996: Add missing interrupt to the USB2 controller drm/amdgpu: avoid integer overflow warning in amdgpu_device_resize_fb_bar() ARM: dts: BCM5301X: Harmonize EHCI/OHCI DT nodes name ARM: dts: BCM53573: Describe on-SoC BCM53125 rev 4 switch ARM: dts: BCM53573: Drop nonexistent #usb-cells ARM: dts: BCM53573: Add cells sizes to PCIe node ARM: dts: BCM53573: Use updated "spi-gpio" binding properties drm/etnaviv: fix dumping of active MMU context x86/mm: Fix PAT bit missing from page protection modify mask ARM: dts: s3c64xx: align pinctrl with dtschema ARM: dts: samsung: s3c6410-mini6410: correct ethernet reg addresses (split) ARM: dts: s5pv210: adjust node names to DT spec ARM: dts: s5pv210: add dummy 5V regulator for backlight on SMDKv210 ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split) drm: adv7511: Fix low refresh rate register for ADV7533/5 ARM: dts: BCM53573: Fix Ethernet info for Luxul devices arm64: dts: qcom: sdm845: Add missing RPMh power domain to GCC arm64: dts: qcom: sdm845: Fix the min frequency of "ice_core_clk" drm/amdgpu: Update min() to min_t() in 'amdgpu_info_ioctl' md/bitmap: don't set max_write_behind if there is no write mostly device md/md-bitmap: hold 'reconfig_mutex' in backlog_store() drm/tegra: Remove superfluous error messages around platform_get_irq() drm/tegra: dpaux: Fix incorrect return value of platform_get_irq of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name() drm/armada: Fix off-by-one error in armada_overlay_get_property() drm/panel: simple: Add missing connector type and pixel format for AUO T215HVN01 ima: Remove deprecated IMA_TRUSTED_KEYRING Kconfig drm: xlnx: zynqmp_dpsub: Add missing check for dma_set_mask drm/msm/mdp5: Don't leak some plane state firmware: meson_sm: fix to avoid potential NULL pointer dereference smackfs: Prevent underflow in smk_set_cipso() drm/amd/pm: fix variable dereferenced issue in amdgpu_device_attr_create() drm/msm/a2xx: Call adreno_gpu_init() earlier audit: fix possible soft lockup in __audit_inode_child() bus: ti-sysc: Fix build warning for 64-bit build drm/mediatek: Fix potential memory leak if vmap() fail bus: ti-sysc: Fix cast to enum warning of: unittest: Fix overlay type in apply/revert check ALSA: ac97: Fix possible error value of *rac97 ipmi:ssif: Add check for kstrdup ipmi:ssif: Fix a memory leak when scanning for an adapter drivers: clk: keystone: Fix parameter judgment in _of_pll_clk_init() clk: sunxi-ng: Modify mismatched function name clk: qcom: gcc-sc7180: use ARRAY_SIZE instead of specifying num_parents clk: qcom: gcc-sc7180: Fix up gcc_sdcc2_apps_clk_src ext4: correct grp validation in ext4_mb_good_group clk: qcom: gcc-sm8250: use ARRAY_SIZE instead of specifying num_parents clk: qcom: gcc-sm8250: Fix gcc_sdcc2_apps_clk_src clk: qcom: reset: Use the correct type of sleep/delay based on length PCI: Mark NVIDIA T4 GPUs to avoid bus reset pinctrl: mcp23s08: check return value of devm_kasprintf() PCI: pciehp: Use RMW accessors for changing LNKCTL PCI/ASPM: Use RMW accessors for changing LNKCTL clk: imx8mp: fix sai4 clock clk: imx: composite-8m: fix clock pauses when set_rate would be a no-op vfio/type1: fix cap_migration information leak powerpc/fadump: reset dump area size if fadump memory reserve fails powerpc/perf: Convert fsl_emb notifier to state machine callbacks drm/amdgpu: Use RMW accessors for changing LNKCTL drm/radeon: Use RMW accessors for changing LNKCTL net/mlx5: Use RMW accessors for changing LNKCTL wifi: ath10k: Use RMW accessors for changing LNKCTL powerpc: Don't include lppaca.h in paca.h powerpc/pseries: Rework lppaca_shared_proc() to avoid DEBUG_PREEMPT nfs/blocklayout: Use the passed in gfp flags powerpc/iommu: Fix notifiers being shared by PCI and VIO buses jfs: validate max amount of blocks before allocation. fs: lockd: avoid possible wrong NULL parameter NFSD: da_addr_body field missing in some GETDEVICEINFO replies NFS: Guard against READDIR loop when entry names exceed MAXNAMELEN NFSv4.2: fix handling of COPY ERR_OFFLOAD_NO_REQ media: ad5820: Drop unsupported ad5823 from i2c_ and of_device_id tables media: i2c: tvp5150: check return value of devm_kasprintf() media: v4l2-core: Fix a potential resource leak in v4l2_fwnode_parse_link() drivers: usb: smsusb: fix error handling code in smsusb_init_device media: dib7000p: Fix potential division by zero media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer() media: cx24120: Add retval check for cx24120_message_send() scsi: hisi_sas: Print SAS address for v3 hw erroneous completion print scsi: libsas: Introduce more SAM status code aliases in enum exec_status scsi: hisi_sas: Modify v3 HW SSP underflow error processing scsi: hisi_sas: Modify v3 HW SATA completion error processing scsi: hisi_sas: Fix warnings detected by sparse scsi: hisi_sas: Fix normally completed I/O analysed as failed media: rkvdec: increase max supported height for H.264 media: mediatek: vcodec: Return NULL if no vdec_fb is found usb: phy: mxs: fix getting wrong state with mxs_phy_is_otg_host() scsi: RDMA/srp: Fix residual handling scsi: iscsi: Rename iscsi_set_param() to iscsi_if_set_param() scsi: iscsi: Add length check for nlattr payload scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param() scsi: be2iscsi: Add length check when parsing nlattrs scsi: qla4xxx: Add length check when parsing nlattrs serial: sprd: Assign sprd_port after initialized to avoid wrong access serial: sprd: Fix DMA buffer leak issue x86/APM: drop the duplicate APM_MINOR_DEV macro scsi: qedf: Do not touch __user pointer in qedf_dbg_stop_io_on_error_cmd_read() directly scsi: qedf: Do not touch __user pointer in qedf_dbg_debug_cmd_read() directly scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read() directly coresight: tmc: Explicit type conversions to prevent integer overflow dma-buf/sync_file: Fix docs syntax driver core: test_async: fix an error code IB/uverbs: Fix an potential error pointer dereference fsi: aspeed: Reset master errors after CFAM reset iommu/qcom: Disable and reset context bank before programming iommu/vt-d: Fix to flush cache of PASID directory table media: go7007: Remove redundant if statement USB: gadget: f_mass_storage: Fix unused variable warning media: ov5640: Enable MIPI interface in ov5640_set_power_mipi() media: i2c: ov2680: Set V4L2_CTRL_FLAG_MODIFY_LAYOUT on flips media: ov2680: Remove auto-gain and auto-exposure controls media: ov2680: Fix ov2680_bayer_order() media: ov2680: Fix vflip / hflip set functions media: ov2680: Fix regulators being left enabled on ov2680_power_on() errors cgroup:namespace: Remove unused cgroup_namespaces_init() scsi: core: Use 32-bit hostnum in scsi_host_lookup() scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock serial: tegra: handle clk prepare error in tegra_uart_hw_init() amba: bus: fix refcount leak Revert "IB/isert: Fix incorrect release of isert connection" RDMA/siw: Balance the reference of cep->kref in the error path RDMA/siw: Correct wrong debug message HID: logitech-dj: Fix error handling in logi_dj_recv_switch_to_dj_mode() HID: multitouch: Correct devm device reference for hidinput input_dev name x86/speculation: Mark all Skylake CPUs as vulnerable to GDS tracing: Fix race issue between cpu buffer write and swap mtd: rawnand: brcmnand: Fix mtd oobsize phy/rockchip: inno-hdmi: use correct vco_div_5 macro on rk3328 phy/rockchip: inno-hdmi: round fractal pixclock in rk3328 recalc_rate phy/rockchip: inno-hdmi: do not power on rk3328 post pll on reg write rpmsg: glink: Add check for kstrdup mtd: spi-nor: Check bus width while setting QE bit mtd: rawnand: fsmc: handle clk prepare error in fsmc_nand_resume() um: Fix hostaudio build errors dmaengine: ste_dma40: Add missing IRQ check in d40_probe cpufreq: Fix the race condition while updating the transition_task of policy virtio_ring: fix avail_wrap_counter in virtqueue_add_packed igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c netfilter: xt_u32: validate user space input netfilter: xt_sctp: validate the flag_info count skbuff: skb_segment, Call zero copy functions before using skbuff frags igb: set max size RX buffer when store bad packet is enabled PM / devfreq: Fix leak in devfreq_dev_release() ALSA: pcm: Fix missing fixup call in compat hw_refine ioctl printk: ringbuffer: Fix truncating buffer size min_t cast scsi: core: Fix the scsi_set_resid() documentation ipmi_si: fix a memleak in try_smi_init() ARM: OMAP2+: Fix -Warray-bounds warning in _pwrdm_state_switch() backlight/gpio_backlight: Compare against struct fb_info.device backlight/bd6107: Compare against struct fb_info.device backlight/lv5207lp: Compare against struct fb_info.device xtensa: PMU: fix base address for the newer hardware arm64: csum: Fix OoB access in IP checksum code for negative lengths media: dvb: symbol fixup for dvb_attach() Revert "scsi: qla2xxx: Fix buffer overrun" scsi: mpt3sas: Perform additional retries if doorbell read returns 0 ntb: Drop packets when qp link is down ntb: Clean up tx tail index on link down ntb: Fix calculation ntb_transport_tx_free_entry() Revert "PCI: Mark NVIDIA T4 GPUs to avoid bus reset" procfs: block chmod on /proc/thread-self/comm parisc: Fix /proc/cpuinfo output for lscpu dlm: fix plock lookup when using multiple lockspaces dccp: Fix out of bounds access in DCCP error handler X.509: if signature is unsupported skip validation net: handle ARPHRD_PPP in dev_is_mac_header_xmit() fsverity: skip PKCS#7 parser when keyring is empty pstore/ram: Check start of empty przs during init s390/ipl: add missing secure/has_secure file to ipl type 'unknown' crypto: stm32 - fix loop iterating through scatterlist for DMA cpufreq: brcmstb-avs-cpufreq: Fix -Warray-bounds bug usb: typec: bus: verify partner exists in typec_altmode_attention USB: core: Unite old scheme and new scheme descriptor reads USB: core: Change usb_get_device_descriptor() API USB: core: Fix race by not overwriting udev->descriptor in hub_port_init() USB: core: Fix oversight in SuperSpeed initialization usb: typec: tcpci: clear the fault status bit tracing: Zero the pipe cpumask on alloc to avoid spurious -EBUSY md/md-bitmap: remove unnecessary local variable in backlog_store() udf: initialize newblock to 0 net/ipv6: SKB symmetric hash should incorporate transport ports io_uring: always lock in io_apoll_task_func io_uring: break out of iowq iopoll on teardown io_uring: break iopolling on signal scsi: qla2xxx: Fix deletion race condition scsi: qla2xxx: fix inconsistent TMF timeout scsi: qla2xxx: Fix erroneous link up failure scsi: qla2xxx: Turn off noisy message log scsi: qla2xxx: Remove unsupported ql2xenabledif option fbdev/ep93xx-fb: Do not assign to struct fb_info.dev drm/ast: Fix DRAM init on AST2200 lib/test_meminit: allocate pages up to order MAX_ORDER parisc: led: Fix LAN receive and transmit LEDs parisc: led: Reduce CPU overhead for disk & lan LED computation pinctrl: cherryview: fix address_space_handler() argument dt-bindings: clock: xlnx,versal-clk: drop select:false clk: imx: pll14xx: dynamically configure PLL for 393216000/361267200Hz clk: qcom: gcc-mdm9615: use proper parent for pll0_vote clock soc: qcom: qmi_encdec: Restrict string length in decode NFS: Fix a potential data corruption NFSv4/pnfs: minor fix for cleanup path in nfs4_get_device_info kconfig: fix possible buffer overflow backlight: gpio_backlight: Drop output GPIO direction check for initial power state perf annotate bpf: Don't enclose non-debug code with an assert() x86/virt: Drop unnecessary check on extended CPUID level in cpu_has_svm() perf top: Don't pass an ERR_PTR() directly to perf_session__delete() watchdog: intel-mid_wdt: add MODULE_ALIAS() to allow auto-load pwm: lpc32xx: Remove handling of PWM channels net/sched: fq_pie: avoid stalls in fq_pie_timer() sctp: annotate data-races around sk->sk_wmem_queued ipv4: annotate data-races around fi->fib_dead net: read sk->sk_family once in sk_mc_loop() drm/i915/gvt: Save/restore HW status to support GVT suspend/resume drm/i915/gvt: Drop unused helper intel_vgpu_reset_gtt() ipv4: ignore dst hint for multipath routes igb: disable virtualization features on 82580 veth: Fixing transmit return status for dropped packets net: ipv6/addrconf: avoid integer underflow in ipv6_create_tempaddr af_unix: Fix data-races around user->unix_inflight. af_unix: Fix data-race around unix_tot_inflight. af_unix: Fix data-races around sk->sk_shutdown. af_unix: Fix data race around sk->sk_err. net: sched: sch_qfq: Fix UAF in qfq_dequeue() kcm: Destroy mutex in kcm_exit_net() igc: Change IGC_MIN to allow set rx/tx value between 64 and 80 igbvf: Change IGBVF_MIN to allow set rx/tx value between 64 and 80 igb: Change IGB_MIN to allow set rx/tx value between 64 and 80 s390/zcrypt: don't leak memory if dev_set_name() fails idr: fix param name in idr_alloc_cyclic() doc ip_tunnels: use DEV_STATS_INC() net: dsa: sja1105: fix bandwidth discrepancy between tc-cbs software and offload net: dsa: sja1105: fix -ENOSPC when replacing the same tc-cbs too many times netfilter: nfnetlink_osf: avoid OOB read net: hns3: fix the port information display when sfp is absent sh: boards: Fix CEU buffer size passed to dma_declare_coherent_memory() ext4: add correct group descriptors and reserved GDT blocks to system zone ata: sata_gemini: Add missing MODULE_DESCRIPTION ata: pata_ftide010: Add missing MODULE_DESCRIPTION fuse: nlookup missing decrement in fuse_direntplus_link btrfs: don't start transaction when joining with TRANS_JOIN_NOSTART btrfs: use the correct superblock to compare fsid in btrfs_validate_super mtd: rawnand: brcmnand: Fix crash during the panic_write mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write mtd: rawnand: brcmnand: Fix potential false time out warning drm/amd/display: prevent potential division by zero errors perf hists browser: Fix hierarchy mode header perf tools: Handle old data in PERF_RECORD_ATTR perf hists browser: Fix the number of entries for 'e' key ACPI: APEI: explicit init of HEST and GHES in apci_init() arm64: sdei: abort running SDEI handlers during crash scsi: qla2xxx: If fcport is undergoing deletion complete I/O with retry scsi: qla2xxx: Consolidate zio threshold setting for both FCP & NVMe scsi: qla2xxx: Fix crash in PCIe error handling scsi: qla2xxx: Flush mailbox commands on chip reset ARM: dts: samsung: exynos4210-i9100: Fix LCD screen's physical size ARM: dts: BCM5301X: Extend RAM to full 256MB for Linksys EA6500 V2 bus: mhi: host: Skip MHI reset if device is in RDDM net: ipv4: fix one memleak in __inet_del_ifa() selftests/kselftest/runner/run_one(): allow running non-executable files kselftest/runner.sh: Propagate SIGTERM to runner child net/smc: use smc_lgr_list.lock to protect smc_lgr_list.list iterate in smcr_port_add net: ethernet: mvpp2_main: fix possible OOB write in mvpp2_ethtool_get_rxnfc() net: ethernet: mtk_eth_soc: fix possible NULL pointer dereference in mtk_hwlro_get_fdir_all() hsr: Fix uninit-value access in fill_frame_info() r8152: check budget for r8152_poll() kcm: Fix memory leak in error path of kcm_sendmsg() platform/mellanox: mlxbf-tmfifo: Drop the Rx packet if no more descriptors platform/mellanox: mlxbf-tmfifo: Drop jumbo frames net/tls: do not free tls_rec on async operation in bpf_exec_tx_verdict() ipv6: fix ip6_sock_set_addr_preferences() typo ixgbe: fix timestamp configuration code kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg(). drm/amd/display: Fix a bug when searching for insert_above_mpcc parisc: Drop loops_per_jiffy from per_cpu struct Linux 5.10.195 Change-Id: I4eef618f573b6d4201e05c9cf56088d77d712d97 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-09-19 11:32:32 +00:00
Lorenz Bauer	4d271804f5	udp: re-score reuseport groups when connected sockets are present ... [ Upstream commit f0ea27e7bf ] Contrary to TCP, UDP reuseport groups can contain TCP_ESTABLISHED sockets. To support these properly we remember whether a group has a connected socket and skip the fast reuseport early-return. In effect we continue scoring all reuseport sockets and then choose the one with the highest score. The current code fails to re-calculate the score for the result of lookup_reuseport. According to Kuniyuki Iwashima: 1) SO_INCOMING_CPU is set -> selected sk might have +1 score 2) BPF prog returns ESTABLISHED and/or SO_INCOMING_CPU sk -> selected sk will have more than 8 Using the old score could trigger more lookups depending on the order that sockets are created. sk -> sk (SO_INCOMING_CPU) -> sk (ESTABLISHED) | | `-> select the next SO_INCOMING_CPU sk | `-> select itself (We should save this lookup) Fixes: efc6b6f6c3 ("udp: Improve load balancing for SO_REUSEPORT.") Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com> Signed-off-by: Lorenz Bauer <lmb@isovalent.com> Link: https://lore.kernel.org/r/20230720-so-reuseport-v6-1-7021b683cdae@isovalent.com Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-09-19 12:20:08 +02:00
Greg Kroah-Hartman	4c20c2c837	Merge 5.10.179 into android12-5.10-lts ... Changes in 5.10.179 ARM: dts: rockchip: fix a typo error for rk3288 spdif node arm64: dts: qcom: ipq8074-hk01: enable QMP device, not the PHY node arm64: dts: meson-g12-common: specify full DMC range arm64: dts: imx8mm-evk: correct pmic clock source netfilter: br_netfilter: fix recent physdev match breakage regulator: fan53555: Explicitly include bits header net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg virtio_net: bugfix overflow inside xdp_linearize_page() sfc: Split STATE_READY in to STATE_NET_DOWN and STATE_NET_UP. sfc: Fix use-after-free due to selftest_work netfilter: nf_tables: fix ifdef to also consider nf_tables=m i40e: fix accessing vsi->active_filters without holding lock i40e: fix i40e_setup_misc_vector() error handling mlxfw: fix null-ptr-deref in mlxfw_mfa2_tlv_next() net: rpl: fix rpl header size calculation mlxsw: pci: Fix possible crash during initialization bpf: Fix incorrect verifier pruning due to missing register precision taints e1000e: Disable TSO on i219-LM card to increase speed f2fs: Fix f2fs_truncate_partial_nodes ftrace event Input: i8042 - add quirk for Fujitsu Lifebook A574/H selftests: sigaltstack: fix -Wuninitialized scsi: megaraid_sas: Fix fw_crash_buffer_show() scsi: core: Improve scsi_vpd_inquiry() checks net: dsa: b53: mmap: add phy ops s390/ptrace: fix PTRACE_GET_LAST_BREAK error handling nvme-tcp: fix a possible UAF when failing to allocate an io queue xen/netback: use same error messages for same errors powerpc/doc: Fix htmldocs errors xfs: drop submit side trans alloc for append ioends iio: light: tsl2772: fix reading proximity-diodes from device tree nilfs2: initialize unused bytes in segment summary blocks memstick: fix memory leak if card device is never registered kernel/sys.c: fix and improve control flow in __sys_setres[ug]id() mmc: sdhci_am654: Set HIGH_SPEED_ENA for SDR12 and SDR25 mm/khugepaged: check again on anon uffd-wp during isolation sched/uclamp: Make task_fits_capacity() use util_fits_cpu() sched/uclamp: Fix fits_capacity() check in feec() sched/uclamp: Make select_idle_capacity() use util_fits_cpu() sched/uclamp: Make asym_fits_capacity() use util_fits_cpu() sched/uclamp: Make cpu_overutilized() use util_fits_cpu() sched/uclamp: Cater for uclamp in find_energy_efficient_cpu()'s early exit condition sched/fair: Detect capacity inversion sched/fair: Consider capacity inversion in util_fits_cpu() sched/uclamp: Fix a uninitialized variable warnings sched/fair: Fixes for capacity inversion detection MIPS: Define RUNTIME_DISCARD_EXIT in LD script docs: futex: Fix kernel-doc references after code split-up preparation purgatory: fix disabling debug info virtiofs: clean up error handling in virtio_fs_get_tree() virtiofs: split requests that exceed virtqueue size fuse: check s_root when destroying sb fuse: fix attr version comparison in fuse_read_update_size() fuse: always revalidate rename target dentry fuse: fix deadlock between atomic O_TRUNC and page invalidation Revert "ext4: fix use-after-free in ext4_xattr_set_entry" ext4: remove duplicate definition of ext4_xattr_ibody_inline_set() ext4: fix use-after-free in ext4_xattr_set_entry udp: Call inet6_destroy_sock() in setsockopt(IPV6_ADDRFORM). tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct(). inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy(). dccp: Call inet6_destroy_sock() via sk->sk_destruct(). sctp: Call inet6_destroy_sock() via sk->sk_destruct(). pwm: meson: Explicitly set .polarity in .get_state() pwm: iqs620a: Explicitly set .polarity in .get_state() pwm: hibvt: Explicitly set .polarity in .get_state() iio: adc: at91-sama5d2_adc: fix an error code in at91_adc_allocate_trigger() ASoC: fsl_asrc_dma: fix potential null-ptr-deref ASN.1: Fix check for strdup() success Linux 5.10.179 Change-Id: I54e476aa9b199a4711a091c77583739ed82af5ad Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-06-16 09:49:29 +00:00
Kuniyuki Iwashima	b1f06ab985	tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct(). ... commit d38afeec26 upstream. Originally, inet6_sk(sk)->XXX were changed under lock_sock(), so we were able to clean them up by calling inet6_destroy_sock() during the IPv6 -> IPv4 conversion by IPV6_ADDRFORM. However, commit 03485f2adc ("udpv6: Add lockless sendmsg() support") added a lockless memory allocation path, which could cause a memory leak: setsockopt(IPV6_ADDRFORM) sendmsg() +-----------------------+ +-------+ - do_ipv6_setsockopt(sk, ...) - udpv6_sendmsg(sk, ...) - sockopt_lock_sock(sk) ^._ called via udpv6_prot - lock_sock(sk) before WRITE_ONCE() - WRITE_ONCE(sk->sk_prot, &tcp_prot) - inet6_destroy_sock() - if (!corkreq) - sockopt_release_sock(sk) - ip6_make_skb(sk, ...) - release_sock(sk) ^._ lockless fast path for the non-corking case - __ip6_append_data(sk, ...) - ipv6_local_rxpmtu(sk, ...) - xchg(&np->rxpmtu, skb) ^._ rxpmtu is never freed. - goto out_no_dst; - lock_sock(sk) For now, rxpmtu is only the case, but not to miss the future change and a similar bug fixed in commit e27326009a ("net: ping6: Fix memleak in ipv6_renew_options()."), let's set a new function to IPv6 sk->sk_destruct() and call inet6_cleanup_sock() there. Since the conversion does not change sk->sk_destruct(), we can guarantee that we can clean up IPv6 resources finally. We can now remove all inet6_destroy_sock() calls from IPv6 protocol specific ->destroy() functions, but such changes are invasive to backport. So they can be posted as a follow-up later for net-next. Fixes: 03485f2adc ("udpv6: Add lockless sendmsg() support") Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-04-26 11:27:41 +02:00
Greg Kroah-Hartman	27b36ba7c2	Merge 5.10.152 into android12-5.10-lts ... Changes in 5.10.152 ocfs2: clear dinode links count in case of error ocfs2: fix BUG when iput after ocfs2_mknod fails selinux: enable use of both GFP_KERNEL and GFP_ATOMIC in convert_context() cpufreq: qcom: fix writes in read-only memory region i2c: qcom-cci: Fix ordering of pm_runtime_xx and i2c_add_adapter x86/microcode/AMD: Apply the patch early on every logical thread hwmon/coretemp: Handle large core ID value ata: ahci-imx: Fix MODULE_ALIAS ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS cpufreq: qcom: fix memory leak in error path kvm: Add support for arch compat vm ioctls KVM: arm64: vgic: Fix exit condition in scan_its_table() media: mceusb: set timeout to at least timeout provided media: venus: dec: Handle the case where find_format fails block: wbt: Remove unnecessary invoking of wbt_update_limits in wbt_init blk-wbt: call rq_qos_add() after wb_normal is initialized arm64: errata: Remove AES hwcap for COMPAT tasks r8152: add PID for the Lenovo OneLink+ Dock btrfs: fix processing of delayed data refs during backref walking btrfs: fix processing of delayed tree block refs during backref walking ACPI: extlog: Handle multiple records tipc: Fix recognition of trial period tipc: fix an information leak in tipc_topsrv_kern_subscr i40e: Fix DMA mappings leak HID: magicmouse: Do not set BTN_MOUSE on double report sfc: Change VF mac via PF as first preference if available. net/atm: fix proc_mpc_write incorrect return value net: phy: dp83867: Extend RX strap quirk for SGMII mode cifs: Fix xid leak in cifs_copy_file_range() cifs: Fix xid leak in cifs_flock() cifs: Fix xid leak in cifs_ses_add_channel() net: hsr: avoid possible NULL deref in skb_clone() ionic: catch NULL pointer issue on reconfig nvme-hwmon: rework to avoid devm allocation nvme-hwmon: Return error code when registration fails nvme-hwmon: consistently ignore errors from nvme_hwmon_init nvme-hwmon: kmalloc the NVME SMART log buffer net: sched: cake: fix null pointer access issue when cake_init() fails net: sched: delete duplicate cleanup of backlog and qlen net: sched: sfb: fix null pointer access issue when sfb_init() fails sfc: include vport_id in filter spec hash and equal() net: hns: fix possible memory leak in hnae_ae_register() net: sched: fix race condition in qdisc_graft() net: phy: dp83822: disable MDI crossover status change interrupt iommu/vt-d: Allow NVS regions in arch_rmrr_sanity_check() iommu/vt-d: Clean up si_domain in the init_dmars() error path drm/virtio: Use appropriate atomic state in virtio_gpu_plane_cleanup_fb() dmaengine: mxs-dma: Remove the unused .id_table dmaengine: mxs: use platform_driver_register tracing: Simplify conditional compilation code in tracing_set_tracer() tracing: Do not free snapshot if tracer is on cmdline xen: assume XENFEAT_gnttab_map_avail_bits being set for pv guests xen/gntdev: Accommodate VMA splitting mmc: sdhci-tegra: Use actual clock rate for SW tuning correction riscv: Add machine name to kernel boot log and stack dump output riscv: always honor the CONFIG_CMDLINE_FORCE when parsing dtb perf pmu: Validate raw event with sysfs exported format bits perf: Skip and warn on unknown format 'configN' attrs fcntl: make F_GETOWN(EX) return 0 on dead owner task fcntl: fix potential deadlocks for &fown_struct.lock arm64: dts: qcom: sc7180-trogdor: Fixup modem memory region arm64: topology: move store_cpu_topology() to shared code riscv: topology: fix default topology reporting perf/x86/intel/pt: Relax address filter validation hv_netvsc: Fix race between VF offering and VF association message from host ACPI: video: Force backlight native for more TongFang devices x86/Kconfig: Drop check for -mabi=ms for CONFIG_EFI_STUB Makefile.debug: re-enable debug info for .S files mmc: core: Add SD card quirk for broken discard blk-wbt: fix that 'rwb->wc' is always set to 1 in wbt_init() mm: /proc/pid/smaps_rollup: fix no vma's null-deref udp: Update reuse->has_conns under reuseport_lock. Linux 5.10.152 Change-Id: I2c75b6fd3ae205968bcc3133ebf71b82ff2a19b6 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2022-11-21 15:46:22 +00:00
Greg Kroah-Hartman	0b500f5b16	Merge 5.10.150 into android12-5.10-lts ... Changes in 5.10.150 ALSA: oss: Fix potential deadlock at unregistration ALSA: rawmidi: Drop register_mutex in snd_rawmidi_free() ALSA: usb-audio: Fix potential memory leaks ALSA: usb-audio: Fix NULL dererence at error path ALSA: hda/realtek: remove ALC289_FIXUP_DUAL_SPK for Dell 5530 ALSA: hda/realtek: Correct pin configs for ASUS G533Z ALSA: hda/realtek: Add quirk for ASUS GV601R laptop ALSA: hda/realtek: Add Intel Reference SSID to support headset keys mtd: rawnand: atmel: Unmap streaming DMA mappings cifs: destage dirty pages before re-reading them for cache=none cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message iio: dac: ad5593r: Fix i2c read protocol requirements iio: ltc2497: Fix reading conversion results iio: adc: ad7923: fix channel readings for some variants iio: pressure: dps310: Refactor startup procedure iio: pressure: dps310: Reset chip after timeout usb: add quirks for Lenovo OneLink+ Dock can: kvaser_usb: Fix use of uninitialized completion can: kvaser_usb_leaf: Fix overread with an invalid command can: kvaser_usb_leaf: Fix TX queue out of sync after restart can: kvaser_usb_leaf: Fix CAN state after restart mmc: sdhci-sprd: Fix minimum clock limit fs: dlm: fix race between test_bit() and queue_work() fs: dlm: handle -EBUSY first in lock arg validation HID: multitouch: Add memory barriers quota: Check next/prev free block number after reading from quota file platform/chrome: cros_ec_proto: Update version on GET_NEXT_EVENT failure ASoC: wcd9335: fix order of Slimbus unprepare/disable ASoC: wcd934x: fix order of Slimbus unprepare/disable hwmon: (gsc-hwmon) Call of_node_get() before of_find_xxx API regulator: qcom_rpm: Fix circular deferral regression RISC-V: Make port I/O string accessors actually work parisc: fbdev/stifb: Align graphics memory size to 4MB riscv: Allow PROT_WRITE-only mmap() riscv: Make VM_WRITE imply VM_READ riscv: Pass -mno-relax only on lld < 15.0.0 UM: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK nvme-pci: set min_align_mask before calculating max_hw_sectors drm/virtio: Check whether transferred 2D BO is shmem drm/udl: Restore display mode on resume block: fix inflight statistics of part0 mm/mmap: undo ->mmap() when arch_validate_flags() fails PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge powercap: intel_rapl: Use standard Energy Unit for SPR Dram RAPL domain powerpc/boot: Explicitly disable usage of SPE instructions scsi: qedf: Populate sysfs attributes for vport fbdev: smscufx: Fix use-after-free in ufx_ops_open() btrfs: fix race between quota enable and quota rescan ioctl f2fs: increase the limit for reserve_root f2fs: fix to do sanity check on destination blkaddr during recovery f2fs: fix to do sanity check on summary info hardening: Clarify Kconfig text for auto-var-init hardening: Avoid harmless Clang option under CONFIG_INIT_STACK_ALL_ZERO hardening: Remove Clang's enable flag for -ftrivial-auto-var-init=zero jbd2: wake up journal waiters in FIFO order, not LIFO jbd2: fix potential buffer head reference count leak jbd2: fix potential use-after-free in jbd2_fc_wait_bufs jbd2: add miss release buffer head in fc_do_one_pass() ext4: avoid crash when inline data creation follows DIO write ext4: fix null-ptr-deref in ext4_write_info ext4: make ext4_lazyinit_thread freezable ext4: fix check for block being out of directory size ext4: don't increase iversion counter for ea_inodes ext4: ext4_read_bh_lock() should submit IO if the buffer isn't uptodate ext4: place buffer head allocation before handle start ext4: fix miss release buffer head in ext4_fc_write_inode ext4: fix potential memory leak in ext4_fc_record_modified_inode() ext4: fix potential memory leak in ext4_fc_record_regions() ext4: update 'state->fc_regions_size' after successful memory allocation livepatch: fix race between fork and KLP transition ftrace: Properly unset FTRACE_HASH_FL_MOD ring-buffer: Allow splice to read previous partially read pages ring-buffer: Have the shortest_full queue be the shortest not longest ring-buffer: Check pending waiters when doing wake ups as well ring-buffer: Add ring_buffer_wake_waiters() ring-buffer: Fix race between reset page and reading page tracing: Disable interrupt or preemption before acquiring arch_spinlock_t thunderbolt: Explicitly enable lane adapter hotplug events at startup efi: libstub: drop pointless get_memory_map() call media: cedrus: Set the platform driver data earlier KVM: x86/emulator: Fix handing of POP SS to correctly set interruptibility KVM: nVMX: Unconditionally purge queued/injected events on nested "exit" KVM: VMX: Drop bits 31:16 when shoving exception error code into VMCS staging: greybus: audio_helper: remove unused and wrong debugfs usage drm/nouveau/kms/nv140-: Disable interlacing drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table() drm/i915: Fix watermark calculations for gen12+ RC CCS modifier drm/i915: Fix watermark calculations for gen12+ MC CCS modifier smb3: must initialize two ACL struct fields to zero selinux: use "grep -E" instead of "egrep" userfaultfd: open userfaultfds with O_RDONLY sh: machvec: Use char[] for section boundaries MIPS: SGI-IP27: Free some unused memory MIPS: SGI-IP27: Fix platform-device leak in bridge_platform_create() ARM: 9244/1: dump: Fix wrong pg_level in walk_pmd() ARM: 9247/1: mm: set readonly for MT_MEMORY_RO with ARM_LPAE objtool: Preserve special st_shndx indexes in elf_update_symbol nfsd: Fix a memory leak in an error handling path wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state() leds: lm3601x: Don't use mutex after it was destroyed wifi: mac80211: allow bw change during channel switch in mesh bpftool: Fix a wrong type cast in btf_dumper_int spi: mt7621: Fix an error message in mt7621_spi_probe() x86/resctrl: Fix to restore to original value when re-enabling hardware prefetch register Bluetooth: btusb: Fine-tune mt7663 mechanism. Bluetooth: btusb: fix excessive stack usage Bluetooth: btusb: mediatek: fix WMT failure during runtime suspend wifi: rtl8xxxu: tighten bounds checking in rtl8xxxu_read_efuse() selftests/xsk: Avoid use-after-free on ctx spi: qup: add missing clk_disable_unprepare on error in spi_qup_resume() spi: qup: add missing clk_disable_unprepare on error in spi_qup_pm_resume_runtime() wifi: rtl8xxxu: Fix skb misuse in TX queue selection spi: meson-spicc: do not rely on busy flag in pow2 clk ops bpf: btf: fix truncated last_member_type_id in btf_struct_resolve wifi: rtl8xxxu: gen2: Fix mistake in path B IQ calibration wifi: rtl8xxxu: Remove copy-paste leftover in gen2_update_rate_mask net: fs_enet: Fix wrong check in do_pd_setup bpf: Ensure correct locking around vulnerable function find_vpid() Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure wifi: ath11k: fix number of VHT beamformee spatial streams x86/microcode/AMD: Track patch allocation size explicitly x86/cpu: Include the header of init_ia32_feat_ctl()'s prototype spi: dw: Fix PM disable depth imbalance in dw_spi_bt1_probe spi/omap100k:Fix PM disable depth imbalance in omap1_spi100k_probe i2c: mlxbf: support lock mechanism Bluetooth: hci_core: Fix not handling link timeouts propertly netfilter: nft_fib: Fix for rpath check with VRF devices spi: s3c64xx: Fix large transfers with DMA wifi: rtl8xxxu: Fix AIFS written to REG_EDCA_*_PARAM vhost/vsock: Use kvmalloc/kvfree for larger packets. mISDN: fix use-after-free bugs in l1oip timer handlers sctp: handle the error returned from sctp_auth_asoc_init_active_key tcp: fix tcp_cwnd_validate() to not forget is_cwnd_limited spi: Ensure that sg_table won't be used after being freed net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks() bnx2x: fix potential memory leak in bnx2x_tpa_stop() net/ieee802154: reject zero-sized raw_sendmsg() once: add DO_ONCE_SLOW() for sleepable contexts net: mvpp2: fix mvpp2 debugfs leak drm: bridge: adv7511: fix CEC power down control register offset drm/bridge: Avoid uninitialized variable warning drm/mipi-dsi: Detach devices when removing the host drm/bridge: parade-ps8640: Fix regulator supply order drm/dp_mst: fix drm_dp_dpcd_read return value checks drm:pl111: Add of_node_put() when breaking out of for_each_available_child_of_node() platform/chrome: fix double-free in chromeos_laptop_prepare() platform/chrome: fix memory corruption in ioctl ASoC: tas2764: Allow mono streams ASoC: tas2764: Drop conflicting set_bias_level power setting ASoC: tas2764: Fix mute/unmute platform/x86: msi-laptop: Fix old-ec check for backlight registering platform/x86: msi-laptop: Fix resource cleanup drm: fix drm_mipi_dbi build errors drm/bridge: megachips: Fix a null pointer dereference bug ASoC: rsnd: Add check for rsnd_mod_power_on ALSA: hda: beep: Simplify keep-power-at-enable behavior drm/omap: dss: Fix refcount leak bugs mmc: au1xmmc: Fix an error handling path in au1xmmc_probe() ASoC: eureka-tlv320: Hold reference returned from of_find_xxx API drm/msm/dpu: index dpu_kms->hw_vbif using vbif_idx drm/msm/dp: correct 1.62G link rate at dp_catalog_ctrl_config_msa() ASoC: da7219: Fix an error handling path in da7219_register_dai_clks() ALSA: dmaengine: increment buffer pointer atomically mmc: wmt-sdmmc: Fix an error handling path in wmt_mci_probe() ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe ASoC: mt6660: Fix PM disable depth imbalance in mt6660_i2c_probe ALSA: hda/hdmi: Don't skip notification handling during PM operation memory: pl353-smc: Fix refcount leak bug in pl353_smc_probe() memory: of: Fix refcount leak bug in of_get_ddr_timings() memory: of: Fix refcount leak bug in of_lpddr3_get_ddr_timings() soc: qcom: smsm: Fix refcount leak bugs in qcom_smsm_probe() soc: qcom: smem_state: Add refcounting for the 'state->of_node' ARM: dts: turris-omnia: Fix mpp26 pin name and comment ARM: dts: kirkwood: lsxl: fix serial line ARM: dts: kirkwood: lsxl: remove first ethernet port ia64: export memory_add_physaddr_to_nid to fix cxl build error soc/tegra: fuse: Drop Kconfig dependency on TEGRA20_APB_DMA ARM: dts: exynos: correct s5k6a3 reset polarity on Midas family ARM: Drop CMDLINE_* dependency on ATAGS arm64: ftrace: fix module PLTs with mcount ARM: dts: exynos: fix polarity of VBUS GPIO of Origen iio: adc: at91-sama5d2_adc: fix AT91_SAMA5D2_MR_TRACKTIM_MAX iio: adc: at91-sama5d2_adc: check return status for pressure and touch iio: adc: at91-sama5d2_adc: lock around oversampling and sample freq iio: adc: at91-sama5d2_adc: disable/prepare buffer on suspend/resume iio: inkern: only release the device node when done with it iio: ABI: Fix wrong format of differential capacitance channel ABI. usb: ch9: Add USB 3.2 SSP attributes usb: common: Parse for USB SSP genXxY usb: common: add function to get interval expressed in us unit usb: common: move function's kerneldoc next to its definition usb: common: debug: Check non-standard control requests clk: meson: Hold reference returned by of_get_parent() clk: oxnas: Hold reference returned by of_get_parent() clk: qoriq: Hold reference returned by of_get_parent() clk: berlin: Add of_node_put() for of_get_parent() clk: sprd: Hold reference returned by of_get_parent() clk: tegra: Fix refcount leak in tegra210_clock_init clk: tegra: Fix refcount leak in tegra114_clock_init clk: tegra20: Fix refcount leak in tegra20_clock_init HSI: omap_ssi: Fix refcount leak in ssi_probe HSI: omap_ssi_port: Fix dma_map_sg error check media: exynos4-is: fimc-is: Add of_node_put() when breaking out of loop tty: xilinx_uartps: Fix the ignore_status media: meson: vdec: add missing clk_disable_unprepare on error in vdec_hevc_start() media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init RDMA/rxe: Fix "kernel NULL pointer dereference" error RDMA/rxe: Fix the error caused by qp->sk misc: ocxl: fix possible refcount leak in afu_ioctl() fpga: prevent integer overflow in dfl_feature_ioctl_set_irq() dmaengine: hisilicon: Disable channels when unregister hisi_dma dmaengine: hisilicon: Fix CQ head update dmaengine: hisilicon: Add multi-thread support for a DMA channel dyndbg: fix static_branch manipulation dyndbg: fix module.dyndbg handling dyndbg: let query-modname override actual module name dyndbg: drop EXPORTed dynamic_debug_exec_queries mtd: devices: docg3: check the return value of devm_ioremap() in the probe mtd: rawnand: fsl_elbc: Fix none ECC mode RDMA/siw: Always consume all skbuf data in sk_data_ready() upcall. ata: fix ata_id_sense_reporting_enabled() and ata_id_has_sense_reporting() ata: fix ata_id_has_devslp() ata: fix ata_id_has_ncq_autosense() ata: fix ata_id_has_dipm() mtd: rawnand: meson: fix bit map use in meson_nfc_ecc_correct() md: Replace snprintf with scnprintf md/raid5: Ensure stripe_fill happens on non-read IO with journal RDMA/cm: Use SLID in the work completion as the DLID in responder side IB: Set IOVA/LENGTH on IB_MR in core/uverbs layers xhci: Don't show warning for reinit on known broken suspend usb: gadget: function: fix dangling pnp_string in f_printer.c drivers: serial: jsm: fix some leaks in probe serial: 8250: Add an empty line and remove some useless {} serial: 8250: Toggle IER bits on only after irq has been set up tty: serial: fsl_lpuart: disable dma rx/tx use flags in lpuart_dma_shutdown phy: qualcomm: call clk_disable_unprepare in the error handling staging: vt6655: fix some erroneous memory clean-up loops firmware: google: Test spinlock on panic path to avoid lockups serial: 8250: Fix restoring termios speed after suspend scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername() clk: qcom: apss-ipq6018: mark apcs_alias0_core_clk as critical fsi: core: Check error number after calling ida_simple_get mfd: intel_soc_pmic: Fix an error handling path in intel_soc_pmic_i2c_probe() mfd: fsl-imx25: Fix an error handling path in mx25_tsadc_setup_irq() mfd: lp8788: Fix an error handling path in lp8788_probe() mfd: lp8788: Fix an error handling path in lp8788_irq_init() and lp8788_irq_init() mfd: fsl-imx25: Fix check for platform_get_irq() errors mfd: sm501: Add check for platform_driver_register() clk: mediatek: mt8183: mfgcfg: Propagate rate changes to parent dmaengine: ioat: stop mod_timer from resurrecting deleted timer in __cleanup() spmi: pmic-arb: correct duplicate APID to PPID mapping logic clk: vc5: Fix 5P49V6901 outputs disabling when enabling FOD clk: baikal-t1: Fix invalid xGMAC PTP clock divider clk: baikal-t1: Add shared xGMAC ref/ptp clocks internal parent clk: baikal-t1: Add SATA internal ref clock buffer clk: bcm2835: fix bcm2835_clock_rate_from_divisor declaration clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe clk: ast2600: BCLK comes from EPLL mailbox: bcm-ferxrm-mailbox: Fix error check for dma_map_sg powerpc/math_emu/efp: Include module.h powerpc/sysdev/fsl_msi: Add missing of_node_put() powerpc/pci_dn: Add missing of_node_put() powerpc/powernv: add missing of_node_put() in opal_export_attrs() x86/hyperv: Fix 'struct hv_enlightened_vmcs' definition powerpc/64s: Fix GENERIC_CPU build flags for PPC970 / G5 powerpc: Fix SPE Power ISA properties for e500v1 platforms crypto: sahara - don't sleep when in softirq crypto: hisilicon/zip - fix mismatch in get/set sgl_sge_nr hwrng: imx-rngc - Moving IRQ handler registering after imx_rngc_irq_mask_clear() cgroup/cpuset: Enable update_tasks_cpumask() on top_cpuset iommu/omap: Fix buffer overflow in debugfs crypto: akcipher - default implementation for setting a private key crypto: ccp - Release dma channels before dmaengine unrgister crypto: inside-secure - Change swab to swab32 crypto: qat - fix use of 'dma_map_single' crypto: qat - use pre-allocated buffers in datapath crypto: qat - fix DMA transfer direction iommu/iova: Fix module config properly tracing: kprobe: Fix kprobe event gen test module on exit tracing: kprobe: Make gen test module work in arm and riscv kbuild: remove the target in signal traps when interrupted kbuild: rpm-pkg: fix breakage when V=1 is used crypto: marvell/octeontx - prevent integer overflows crypto: cavium - prevent integer overflow loading firmware thermal/drivers/qcom/tsens-v0_1: Fix MSM8939 fourth sensor hw_id ACPI: APEI: do not add task_work to kernel thread to avoid memory leak f2fs: fix race condition on setting FI_NO_EXTENT flag f2fs: fix to avoid REQ_TIME and CP_TIME collision f2fs: fix to account FS_CP_DATA_IO correctly selftest: tpm2: Add Client.__del__() to close /dev/tpm* handle rcu: Back off upon fill_page_cache_func() allocation failure rcu-tasks: Convert RCU_LOCKDEP_WARN() to WARN_ONCE() ACPI: video: Add Toshiba Satellite/Portege Z830 quirk MIPS: BCM47XX: Cast memcmp() of function to (void *) powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash x86/entry: Work around Clang __bdos() bug NFSD: Return nfserr_serverfault if splice_ok but buf->pages have data NFSD: fix use-after-free on source server when doing inter-server copy wifi: brcmfmac: fix invalid address access when enabling SCAN log level bpftool: Clear errno after libcap's checks openvswitch: Fix double reporting of drops in dropwatch openvswitch: Fix overreporting of drops in dropwatch tcp: annotate data-race around tcp_md5sig_pool_populated wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg() xfrm: Update ipcomp_scratches with NULL when freed wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() regulator: core: Prevent integer underflow Bluetooth: L2CAP: initialize delayed works at l2cap_chan_create() Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times can: bcm: check the result of can_send() in bcm_can_tx() wifi: rt2x00: don't run Rt5592 IQ calibration on MT7620 wifi: rt2x00: set correct TX_SW_CFG1 MAC register for MT7620 wifi: rt2x00: set VGC gain for both chains of MT7620 wifi: rt2x00: set SoC wmac clock register wifi: rt2x00: correctly set BBP register 86 for MT7620 net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory Bluetooth: L2CAP: Fix user-after-free r8152: Rate limit overflow messages drm/nouveau/nouveau_bo: fix potential memory leak in nouveau_bo_alloc() drm: Use size_t type for len variable in drm_copy_field() drm: Prevent drm_copy_field() to attempt copying a NULL pointer gpu: lontium-lt9611: Fix NULL pointer dereference in lt9611_connector_init() drm/amd/display: fix overflow on MIN_I64 definition udmabuf: Set ubuf->sg = NULL if the creation of sg table fails drm: bridge: dw_hdmi: only trigger hotplug event on link change drm/vc4: vec: Fix timings for VEC modes drm: panel-orientation-quirks: Add quirk for Anbernic Win600 platform/chrome: cros_ec: Notify the PM of wake events during resume platform/x86: msi-laptop: Change DMI match / alias strings to fix module autoloading ASoC: SOF: pci: Change DMI match info to support all Chrome platforms drm/amdgpu: fix initial connector audio value drm/meson: explicitly remove aggregate driver at module unload time mmc: sdhci-msm: add compatible string check for sdm670 drm/dp: Don't rewrite link config when setting phy test pattern drm/amd/display: Remove interface for periodic interrupt 1 ARM: dts: imx7d-sdb: config the max pressure for tsc2046 ARM: dts: imx6q: add missing properties for sram ARM: dts: imx6dl: add missing properties for sram ARM: dts: imx6qp: add missing properties for sram ARM: dts: imx6sl: add missing properties for sram ARM: dts: imx6sll: add missing properties for sram ARM: dts: imx6sx: add missing properties for sram kselftest/arm64: Fix validatation termination record after EXTRA_CONTEXT arm64: dts: imx8mq-librem5: Add bq25895 as max17055's power supply btrfs: scrub: try to fix super block errors clk: zynqmp: Fix stack-out-of-bounds in strncpy` media: cx88: Fix a null-ptr-deref bug in buffer_prepare() clk: zynqmp: pll: rectify rate rounding in zynqmp_pll_round_rate usb: host: xhci-plat: suspend and resume clocks usb: host: xhci-plat: suspend/resume clks for brcm scsi: 3w-9xxx: Avoid disabling device if failing to enable it nbd: Fix hung when signal interrupts nbd_start_device_ioctl() power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type() staging: vt6655: fix potential memory leak blk-throttle: prevent overflow while calculating wait time ata: libahci_platform: Sanity check the DT child nodes number bcache: fix set_at_max_writeback_rate() for multiple attached devices soundwire: cadence: Don't overwrite msg->buf during write commands soundwire: intel: fix error handling on dai registration issues HID: roccat: Fix use-after-free in roccat_read() md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info() usb: musb: Fix musb_gadget.c rxstate overflow bug Revert "usb: storage: Add quirk for Samsung Fit flash" staging: rtl8723bs: fix a potential memory leak in rtw_init_cmd_priv() nvme: copy firmware_rev on each init nvmet-tcp: add bounds check on Transfer Tag usb: idmouse: fix an uninit-value in idmouse_open clk: bcm2835: Make peripheral PLLC critical perf intel-pt: Fix segfault in intel_pt_print_info() with uClibc arm64: topology: fix possible overflow in amu_fie_setup() io_uring: correct pinned_vm accounting io_uring/af_unix: defer registered files gc to io_uring release mm: hugetlb: fix UAF in hugetlb_handle_userfault net: ieee802154: return -EINVAL for unknown addr type Revert "net/ieee802154: reject zero-sized raw_sendmsg()" net/ieee802154: don't warn zero-sized raw_sendmsg() Revert "drm/amdgpu: move nbio sdma_doorbell_range() into sdma code for vega" Revert "drm/amdgpu: use dirty framebuffer helper" ext4: continue to expand file system when the target size doesn't reach inet: fully convert sk->sk_rx_dst to RCU rules thermal: intel_powerclamp: Use first online CPU as control_cpu f2fs: fix wrong condition to trigger background checkpoint correctly gcov: support GCC 12.1 and newer compilers Revert "drm/amdgpu: make sure to init common IP before gmc" Linux 5.10.150 Change-Id: I54f32f1f0149ec614c8bc7944e15adb5d80cd51a Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2022-11-15 19:14:08 +00:00
Kuniyuki Iwashima	43d5109296	udp: Update reuse->has_conns under reuseport_lock. ... commit 69421bf984 upstream. When we call connect() for a UDP socket in a reuseport group, we have to update sk->sk_reuseport_cb->has_conns to 1. Otherwise, the kernel could select a unconnected socket wrongly for packets sent to the connected socket. However, the current way to set has_conns is illegal and possible to trigger that problem. reuseport_has_conns() changes has_conns under rcu_read_lock(), which upgrades the RCU reader to the updater. Then, it must do the update under the updater's lock, reuseport_lock, but it doesn't for now. For this reason, there is a race below where we fail to set has_conns resulting in the wrong socket selection. To avoid the race, let's split the reader and updater with proper locking. cpu1 cpu2 +----+ +----+ __ip[46]_datagram_connect() reuseport_grow() . . |- reuseport_has_conns(sk, true) |- more_reuse = __reuseport_alloc(more_socks_size) | . | | |- rcu_read_lock() | |- reuse = rcu_dereference(sk->sk_reuseport_cb) | | | | | /* reuse->has_conns == 0 here */ | | |- more_reuse->has_conns = reuse->has_conns | |- reuse->has_conns = 1 | /* more_reuse->has_conns SHOULD BE 1 HERE */ | | | | | |- rcu_assign_pointer(reuse->socks[i]->sk_reuseport_cb, | | | more_reuse) | `- rcu_read_unlock() `- kfree_rcu(reuse, rcu) | |- sk->sk_state = TCP_ESTABLISHED Note the likely(reuse) in reuseport_has_conns_set() is always true, but we put the test there for ease of review. [0] For the record, usually, sk_reuseport_cb is changed under lock_sock(). The only exception is reuseport_grow() & TCP reqsk migration case. 1) shutdown() TCP listener, which is moved into the latter part of reuse->socks[] to migrate reqsk. 2) New listen() overflows reuse->socks[] and call reuseport_grow(). 3) reuse->max_socks overflows u16 with the new listener. 4) reuseport_grow() pops the old shutdown()ed listener from the array and update its sk->sk_reuseport_cb as NULL without lock_sock(). shutdown()ed TCP sk->sk_reuseport_cb can be changed without lock_sock(), but, reuseport_has_conns_set() is called only for UDP under lock_sock(), so likely(reuse) never be false in reuseport_has_conns_set(). [0]: https://lore.kernel.org/netdev/CANn89iLja=eQHbsM_Ta2sQF0tOGU8vAGrh_izRuuHjuO1ouUag@mail.gmail.com/ Fixes: acdcecc612 ("udp: correct reuseport selection with connected sockets") Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Link: https://lore.kernel.org/r/20221014182625.89913-1-kuniyu@amazon.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-10-30 09:41:19 +01:00
Eric Dumazet	f039b43cba	inet: fully convert sk->sk_rx_dst to RCU rules ... commit 8f905c0e73 upstream. syzbot reported various issues around early demux, one being included in this changelog [1] sk->sk_rx_dst is using RCU protection without clearly documenting it. And following sequences in tcp_v4_do_rcv()/tcp_v6_do_rcv() are not following standard RCU rules. [a] dst_release(dst); [b] sk->sk_rx_dst = NULL; They look wrong because a delete operation of RCU protected pointer is supposed to clear the pointer before the call_rcu()/synchronize_rcu() guarding actual memory freeing. In some cases indeed, dst could be freed before [b] is done. We could cheat by clearing sk_rx_dst before calling dst_release(), but this seems the right time to stick to standard RCU annotations and debugging facilities. [1] BUG: KASAN: use-after-free in dst_check include/net/dst.h:470 [inline] BUG: KASAN: use-after-free in tcp_v4_early_demux+0x95b/0x960 net/ipv4/tcp_ipv4.c:1792 Read of size 2 at addr ffff88807f1cb73a by task syz-executor.5/9204 CPU: 0 PID: 9204 Comm: syz-executor.5 Not tainted 5.16.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0x8d/0x320 mm/kasan/report.c:247 __kasan_report mm/kasan/report.c:433 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:450 dst_check include/net/dst.h:470 [inline] tcp_v4_early_demux+0x95b/0x960 net/ipv4/tcp_ipv4.c:1792 ip_rcv_finish_core.constprop.0+0x15de/0x1e80 net/ipv4/ip_input.c:340 ip_list_rcv_finish.constprop.0+0x1b2/0x6e0 net/ipv4/ip_input.c:583 ip_sublist_rcv net/ipv4/ip_input.c:609 [inline] ip_list_rcv+0x34e/0x490 net/ipv4/ip_input.c:644 __netif_receive_skb_list_ptype net/core/dev.c:5508 [inline] __netif_receive_skb_list_core+0x549/0x8e0 net/core/dev.c:5556 __netif_receive_skb_list net/core/dev.c:5608 [inline] netif_receive_skb_list_internal+0x75e/0xd80 net/core/dev.c:5699 gro_normal_list net/core/dev.c:5853 [inline] gro_normal_list net/core/dev.c:5849 [inline] napi_complete_done+0x1f1/0x880 net/core/dev.c:6590 virtqueue_napi_complete drivers/net/virtio_net.c:339 [inline] virtnet_poll+0xca2/0x11b0 drivers/net/virtio_net.c:1557 __napi_poll+0xaf/0x440 net/core/dev.c:7023 napi_poll net/core/dev.c:7090 [inline] net_rx_action+0x801/0xb40 net/core/dev.c:7177 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 invoke_softirq kernel/softirq.c:432 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637 irq_exit_rcu+0x5/0x20 kernel/softirq.c:649 common_interrupt+0x52/0xc0 arch/x86/kernel/irq.c:240 asm_common_interrupt+0x1e/0x40 arch/x86/include/asm/idtentry.h:629 RIP: 0033:0x7f5e972bfd57 Code: 39 d1 73 14 0f 1f 80 00 00 00 00 48 8b 50 f8 48 83 e8 08 48 39 ca 77 f3 48 39 c3 73 3e 48 89 13 48 8b 50 f8 48 89 38 49 8b 0e <48> 8b 3e 48 83 c3 08 48 83 c6 08 eb bc 48 39 d1 72 9e 48 39 d0 73 RSP: 002b:00007fff8a413210 EFLAGS: 00000283 RAX: 00007f5e97108990 RBX: 00007f5e97108338 RCX: ffffffff81d3aa45 RDX: ffffffff81d3aa45 RSI: 00007f5e97108340 RDI: ffffffff81d3aa45 RBP: 00007f5e97107eb8 R08: 00007f5e97108d88 R09: 0000000093c2e8d9 R10: 0000000000000000 R11: 0000000000000000 R12: 00007f5e97107eb0 R13: 00007f5e97108338 R14: 00007f5e97107ea8 R15: 0000000000000019 </TASK> Allocated by task 13: kasan_save_stack+0x1e/0x50 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:434 [inline] __kasan_slab_alloc+0x90/0xc0 mm/kasan/common.c:467 kasan_slab_alloc include/linux/kasan.h:259 [inline] slab_post_alloc_hook mm/slab.h:519 [inline] slab_alloc_node mm/slub.c:3234 [inline] slab_alloc mm/slub.c:3242 [inline] kmem_cache_alloc+0x202/0x3a0 mm/slub.c:3247 dst_alloc+0x146/0x1f0 net/core/dst.c:92 rt_dst_alloc+0x73/0x430 net/ipv4/route.c:1613 ip_route_input_slow+0x1817/0x3a20 net/ipv4/route.c:2340 ip_route_input_rcu net/ipv4/route.c:2470 [inline] ip_route_input_noref+0x116/0x2a0 net/ipv4/route.c:2415 ip_rcv_finish_core.constprop.0+0x288/0x1e80 net/ipv4/ip_input.c:354 ip_list_rcv_finish.constprop.0+0x1b2/0x6e0 net/ipv4/ip_input.c:583 ip_sublist_rcv net/ipv4/ip_input.c:609 [inline] ip_list_rcv+0x34e/0x490 net/ipv4/ip_input.c:644 __netif_receive_skb_list_ptype net/core/dev.c:5508 [inline] __netif_receive_skb_list_core+0x549/0x8e0 net/core/dev.c:5556 __netif_receive_skb_list net/core/dev.c:5608 [inline] netif_receive_skb_list_internal+0x75e/0xd80 net/core/dev.c:5699 gro_normal_list net/core/dev.c:5853 [inline] gro_normal_list net/core/dev.c:5849 [inline] napi_complete_done+0x1f1/0x880 net/core/dev.c:6590 virtqueue_napi_complete drivers/net/virtio_net.c:339 [inline] virtnet_poll+0xca2/0x11b0 drivers/net/virtio_net.c:1557 __napi_poll+0xaf/0x440 net/core/dev.c:7023 napi_poll net/core/dev.c:7090 [inline] net_rx_action+0x801/0xb40 net/core/dev.c:7177 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 Freed by task 13: kasan_save_stack+0x1e/0x50 mm/kasan/common.c:38 kasan_set_track+0x21/0x30 mm/kasan/common.c:46 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370 ____kasan_slab_free mm/kasan/common.c:366 [inline] ____kasan_slab_free mm/kasan/common.c:328 [inline] __kasan_slab_free+0xff/0x130 mm/kasan/common.c:374 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:1723 [inline] slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1749 slab_free mm/slub.c:3513 [inline] kmem_cache_free+0xbd/0x5d0 mm/slub.c:3530 dst_destroy+0x2d6/0x3f0 net/core/dst.c:127 rcu_do_batch kernel/rcu/tree.c:2506 [inline] rcu_core+0x7ab/0x1470 kernel/rcu/tree.c:2741 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 Last potentially related work creation: kasan_save_stack+0x1e/0x50 mm/kasan/common.c:38 __kasan_record_aux_stack+0xf5/0x120 mm/kasan/generic.c:348 __call_rcu kernel/rcu/tree.c:2985 [inline] call_rcu+0xb1/0x740 kernel/rcu/tree.c:3065 dst_release net/core/dst.c:177 [inline] dst_release+0x79/0xe0 net/core/dst.c:167 tcp_v4_do_rcv+0x612/0x8d0 net/ipv4/tcp_ipv4.c:1712 sk_backlog_rcv include/net/sock.h:1030 [inline] __release_sock+0x134/0x3b0 net/core/sock.c:2768 release_sock+0x54/0x1b0 net/core/sock.c:3300 tcp_sendmsg+0x36/0x40 net/ipv4/tcp.c:1441 inet_sendmsg+0x99/0xe0 net/ipv4/af_inet.c:819 sock_sendmsg_nosec net/socket.c:704 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:724 sock_write_iter+0x289/0x3c0 net/socket.c:1057 call_write_iter include/linux/fs.h:2162 [inline] new_sync_write+0x429/0x660 fs/read_write.c:503 vfs_write+0x7cd/0xae0 fs/read_write.c:590 ksys_write+0x1ee/0x250 fs/read_write.c:643 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae The buggy address belongs to the object at ffff88807f1cb700 which belongs to the cache ip_dst_cache of size 176 The buggy address is located 58 bytes inside of 176-byte region [ffff88807f1cb700, ffff88807f1cb7b0) The buggy address belongs to the page: page:ffffea0001fc72c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7f1cb flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000200 dead000000000100 dead000000000122 ffff8881413bb780 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_HARDWALL), pid 5, ts 108466983062, free_ts 108048976062 prep_new_page mm/page_alloc.c:2418 [inline] get_page_from_freelist+0xa72/0x2f50 mm/page_alloc.c:4149 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5369 alloc_pages+0x1a7/0x300 mm/mempolicy.c:2191 alloc_slab_page mm/slub.c:1793 [inline] allocate_slab mm/slub.c:1930 [inline] new_slab+0x32d/0x4a0 mm/slub.c:1993 ___slab_alloc+0x918/0xfe0 mm/slub.c:3022 __slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3109 slab_alloc_node mm/slub.c:3200 [inline] slab_alloc mm/slub.c:3242 [inline] kmem_cache_alloc+0x35c/0x3a0 mm/slub.c:3247 dst_alloc+0x146/0x1f0 net/core/dst.c:92 rt_dst_alloc+0x73/0x430 net/ipv4/route.c:1613 __mkroute_output net/ipv4/route.c:2564 [inline] ip_route_output_key_hash_rcu+0x921/0x2d00 net/ipv4/route.c:2791 ip_route_output_key_hash+0x18b/0x300 net/ipv4/route.c:2619 __ip_route_output_key include/net/route.h:126 [inline] ip_route_output_flow+0x23/0x150 net/ipv4/route.c:2850 ip_route_output_key include/net/route.h:142 [inline] geneve_get_v4_rt+0x3a6/0x830 drivers/net/geneve.c:809 geneve_xmit_skb drivers/net/geneve.c:899 [inline] geneve_xmit+0xc4a/0x3540 drivers/net/geneve.c:1082 __netdev_start_xmit include/linux/netdevice.h:4994 [inline] netdev_start_xmit include/linux/netdevice.h:5008 [inline] xmit_one net/core/dev.c:3590 [inline] dev_hard_start_xmit+0x1eb/0x920 net/core/dev.c:3606 __dev_queue_xmit+0x299a/0x3650 net/core/dev.c:4229 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1338 [inline] free_pcp_prepare+0x374/0x870 mm/page_alloc.c:1389 free_unref_page_prepare mm/page_alloc.c:3309 [inline] free_unref_page+0x19/0x690 mm/page_alloc.c:3388 qlink_free mm/kasan/quarantine.c:146 [inline] qlist_free_all+0x5a/0xc0 mm/kasan/quarantine.c:165 kasan_quarantine_reduce+0x180/0x200 mm/kasan/quarantine.c:272 __kasan_slab_alloc+0xa2/0xc0 mm/kasan/common.c:444 kasan_slab_alloc include/linux/kasan.h:259 [inline] slab_post_alloc_hook mm/slab.h:519 [inline] slab_alloc_node mm/slub.c:3234 [inline] kmem_cache_alloc_node+0x255/0x3f0 mm/slub.c:3270 __alloc_skb+0x215/0x340 net/core/skbuff.c:414 alloc_skb include/linux/skbuff.h:1126 [inline] alloc_skb_with_frags+0x93/0x620 net/core/skbuff.c:6078 sock_alloc_send_pskb+0x783/0x910 net/core/sock.c:2575 mld_newpack+0x1df/0x770 net/ipv6/mcast.c:1754 add_grhead+0x265/0x330 net/ipv6/mcast.c:1857 add_grec+0x1053/0x14e0 net/ipv6/mcast.c:1995 mld_send_initial_cr.part.0+0xf6/0x230 net/ipv6/mcast.c:2242 mld_send_initial_cr net/ipv6/mcast.c:1232 [inline] mld_dad_work+0x1d3/0x690 net/ipv6/mcast.c:2268 process_one_work+0x9b2/0x1690 kernel/workqueue.c:2298 worker_thread+0x658/0x11f0 kernel/workqueue.c:2445 Memory state around the buggy address: ffff88807f1cb600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88807f1cb680: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc >ffff88807f1cb700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88807f1cb780: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc ffff88807f1cb800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb Fixes: 41063e9dd1 ("ipv4: Early TCP socket demux.") Signed-off-by: Eric Dumazet <edumazet@google.com> Link: https://lore.kernel.org/r/20211220143330.680945-1-eric.dumazet@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> [cmllamas: fixed trivial merge conflict] Signed-off-by: Carlos Llamas <cmllamas@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-10-26 13:25:56 +02:00
Greg Kroah-Hartman	fbe6a13851	Merge 5.10.137 into android12-5.10-lts ... Changes in 5.10.137 Makefile: link with -z noexecstack --no-warn-rwx-segments x86: link vdso and boot with -z noexecstack --no-warn-rwx-segments Revert "pNFS: nfs3_set_ds_client should set NFS_CS_NOPING" scsi: Revert "scsi: qla2xxx: Fix disk failure to rediscover" ALSA: bcd2000: Fix a UAF bug on the error path of probing ALSA: hda/realtek: Add quirk for Clevo NV45PZ ALSA: hda/realtek: Add quirk for HP Spectre x360 15-eb0xxx wifi: mac80211_hwsim: fix race condition in pending packet wifi: mac80211_hwsim: add back erroneously removed cast wifi: mac80211_hwsim: use 32-bit skb cookie add barriers to buffer_uptodate and set_buffer_uptodate HID: wacom: Only report rotation for art pen HID: wacom: Don't register pad_input for touch switch KVM: nVMX: Snapshot pre-VM-Enter BNDCFGS for !nested_run_pending case KVM: nVMX: Snapshot pre-VM-Enter DEBUGCTL for !nested_run_pending case KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 KVM: s390: pv: don't present the ecall interrupt twice KVM: nVMX: Let userspace set nVMX MSR to any _host_ supported value KVM: x86: Mark TSS busy during LTR emulation _after_ all fault checks KVM: x86: Set error code to segment selector on LLDT/LTR non-canonical #GP KVM: x86: Tag kvm_mmu_x86_module_init() with __init riscv: set default pm_power_off to NULL mm: Add kvrealloc() xfs: only set IOMAP_F_SHARED when providing a srcmap to a write xfs: fix I_DONTCACHE mm/mremap: hold the rmap lock in write mode when moving page table entries. ALSA: hda/conexant: Add quirk for LENOVO 20149 Notebook model ALSA: hda/cirrus - support for iMac 12,1 model ALSA: hda/realtek: Add quirk for another Asus K42JZ model ALSA: hda/realtek: Add a quirk for HP OMEN 15 (8786) mute LED tty: vt: initialize unicode screen buffer vfs: Check the truncate maximum size in inode_newsize_ok() fs: Add missing umask strip in vfs_tmpfile thermal: sysfs: Fix cooling_device_stats_setup() error code path fbcon: Fix boundary checks for fbcon=vc:n1-n2 parameters fbcon: Fix accelerated fbdev scrolling while logo is still shown usbnet: Fix linkwatch use-after-free on disconnect ovl: drop WARN_ON() dentry is NULL in ovl_encode_fh() parisc: Fix device names in /proc/iomem parisc: Check the return value of ioremap() in lba_driver_probe() parisc: io_pgetevents_time64() needs compat syscall in 32-bit compat mode drm/gem: Properly annotate WW context on drm_gem_lock_reservations() error drm/vc4: hdmi: Disable audio if dmas property is present but empty drm/nouveau: fix another off-by-one in nvbios_addr drm/nouveau: Don't pm_runtime_put_sync(), only pm_runtime_put_autosuspend() drm/nouveau/acpi: Don't print error when we get -EINPROGRESS from pm_runtime drm/amdgpu: Check BO's requested pinning domains against its preferred_domains mtd: rawnand: arasan: Update NAND bus clock instead of system clock iio: light: isl29028: Fix the warning in isl29028_remove() scsi: sg: Allow waiting for commands to complete on removed device scsi: qla2xxx: Fix incorrect display of max frame size scsi: qla2xxx: Zero undefined mailbox IN registers fuse: limit nsec serial: mvebu-uart: uart2 error bits clearing md-raid: destroy the bitmap after destroying the thread md-raid10: fix KASAN warning media: [PATCH] pci: atomisp_cmd: fix three missing checks on list iterator ia64, processor: fix -Wincompatible-pointer-types in ia64_get_irr() PCI: Add defines for normal and subtractive PCI bridges powerpc/fsl-pci: Fix Class Code of PCIe Root Port powerpc/ptdump: Fix display of RW pages on FSL_BOOK3E powerpc/powernv: Avoid crashing if rng is NULL MIPS: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK coresight: Clear the connection field properly usb: typec: ucsi: Acknowledge the GET_ERROR_STATUS command completion USB: HCD: Fix URB giveback issue in tasklet function ARM: dts: uniphier: Fix USB interrupts for PXs2 SoC arm64: dts: uniphier: Fix USB interrupts for PXs3 SoC usb: dwc3: gadget: refactor dwc3_repare_one_trb usb: dwc3: gadget: fix high speed multiplier setting lockdep: Allow tuning tracing capacity constants. netfilter: nf_tables: do not allow SET_ID to refer to another table netfilter: nf_tables: do not allow CHAIN_ID to refer to another table netfilter: nf_tables: do not allow RULE_ID to refer to another chain netfilter: nf_tables: fix null deref due to zeroed list head epoll: autoremove wakers even more aggressively x86: Handle idle=nomwait cmdline properly for x86_idle arm64: Do not forget syscall when starting a new thread. arm64: fix oops in concurrently setting insn_emulation sysctls ext2: Add more validity checks for inode counts genirq: Don't return error on missing optional irq_request_resources() irqchip/mips-gic: Only register IPI domain when SMP is enabled genirq: GENERIC_IRQ_IPI depends on SMP irqchip/mips-gic: Check the return value of ioremap() in gic_of_init() wait: Fix __wait_event_hrtimeout for RT/DL tasks ARM: dts: imx6ul: add missing properties for sram ARM: dts: imx6ul: change operating-points to uint32-matrix ARM: dts: imx6ul: fix keypad compatible ARM: dts: imx6ul: fix csi node compatible ARM: dts: imx6ul: fix lcdif node compatible ARM: dts: imx6ul: fix qspi node compatible ARM: dts: BCM5301X: Add DT for Meraki MR26 spi: synquacer: Add missing clk_disable_unprepare() ARM: OMAP2+: display: Fix refcount leak bug ACPI: EC: Remove duplicate ThinkPad X1 Carbon 6th entry from DMI quirks ACPI: EC: Drop the EC_FLAGS_IGNORE_DSDT_GPE quirk ACPI: PM: save NVS memory for Lenovo G40-45 ACPI: LPSS: Fix missing check in register_device_clock() arm64: dts: qcom: ipq8074: fix NAND node name arm64: dts: allwinner: a64: orangepi-win: Fix LED node name ARM: shmobile: rcar-gen2: Increase refcount for new reference firmware: tegra: Fix error check return value of debugfs_create_file() PM: hibernate: defer device probing when resuming from hibernation selinux: Add boundary check in put_entry() powerpc/64s: Disable stack variable initialisation for prom_init spi: spi-rspi: Fix PIO fallback on RZ platforms ARM: findbit: fix overflowing offset meson-mx-socinfo: Fix refcount leak in meson_mx_socinfo_init arm64: dts: renesas: beacon: Fix regulator node names ARM: bcm: Fix refcount leak in bcm_kona_smc_init ACPI: processor/idle: Annotate more functions to live in cpuidle section ARM: dts: imx7d-colibri-emmc: add cpu1 supply Input: atmel_mxt_ts - fix up inverted RESET handler soc: renesas: r8a779a0-sysc: Fix A2DP1 and A2CV[2357] PDR values soc: amlogic: Fix refcount leak in meson-secure-pwrc.c arm64: dts: renesas: Fix thermal-sensors on single-zone sensors x86/pmem: Fix platform-device leak in error path ARM: dts: ast2500-evb: fix board compatible ARM: dts: ast2600-evb: fix board compatible hexagon: select ARCH_WANT_LD_ORPHAN_WARN arm64: cpufeature: Allow different PMU versions in ID_DFR0_EL1 locking/lockdep: Fix lockdep_init_map_*() confusion soc: fsl: guts: machine variable might be unset block: fix infinite loop for invalid zone append ARM: dts: qcom: mdm9615: add missing PMIC GPIO reg ARM: OMAP2+: Fix refcount leak in omapdss_init_of ARM: OMAP2+: Fix refcount leak in omap3xxx_prm_late_init cpufreq: zynq: Fix refcount leak in zynq_get_revision regulator: qcom_smd: Fix pm8916_pldo range ACPI: APEI: Fix _EINJ vs EFI_MEMORY_SP soc: qcom: ocmem: Fix refcount leak in of_get_ocmem soc: qcom: aoss: Fix refcount leak in qmp_cooling_devices_register ARM: dts: qcom: pm8841: add required thermal-sensor-cells bus: hisi_lpc: fix missing platform_device_put() in hisi_lpc_acpi_probe() arm64: dts: mt7622: fix BPI-R64 WPS button arm64: tegra: Fix SDMMC1 CD on P2888 erofs: avoid consecutive detection for Highmem memory blk-mq: don't create hctx debugfs dir until q->debugfs_dir is created hwmon: (drivetemp) Add module alias block: remove the request_queue to argument request based tracepoints blktrace: Trace remapped requests correctly regulator: of: Fix refcount leak bug in of_get_regulation_constraints() soc: qcom: Make QCOM_RPMPD depend on PM arm64: dts: qcom: qcs404: Fix incorrect USB2 PHYs assignment drivers/perf: arm_spe: Fix consistency of SYS_PMSCR_EL1.CX nohz/full, sched/rt: Fix missed tick-reenabling bug in dequeue_task_rt() selftests/seccomp: Fix compile warning when CC=clang thermal/tools/tmon: Include pthread and time headers in tmon.h dm: return early from dm_pr_call() if DM device is suspended pwm: sifive: Don't check the return code of pwmchip_remove() pwm: sifive: Simplify offset calculation for PWMCMP registers pwm: sifive: Ensure the clk is enabled exactly once per running PWM pwm: sifive: Shut down hardware only after pwmchip_remove() completed pwm: lpc18xx-sct: Convert to devm_platform_ioremap_resource() drm/bridge: tc358767: Move (e)DP bridge endpoint parsing into dedicated function drm/bridge: tc358767: Make sure Refclk clock are enabled ath10k: do not enforce interrupt trigger type drm/st7735r: Fix module autoloading for Okaya RH128128T wifi: rtlwifi: fix error codes in rtl_debugfs_set_write_h2c() ath11k: fix netdev open race drm/mipi-dbi: align max_chunk to 2 in spi_transfer ath11k: Fix incorrect debug_mask mappings drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers() drm/mediatek: Modify dsi funcs to atomic operations drm/mediatek: Separate poweron/poweroff from enable/disable and define new funcs drm/mediatek: Add pull-down MIPI operation in mtk_dsi_poweroff function i2c: npcm: Remove own slave addresses 2:10 i2c: npcm: Correct slave role behavior virtio-gpu: fix a missing check to avoid NULL dereference drm: adv7511: override i2c address of cec before accessing it crypto: sun8i-ss - do not allocate memory when handling hash requests crypto: sun8i-ss - fix error codes in allocate_flows() net: fix sk_wmem_schedule() and sk_rmem_schedule() errors i2c: Fix a potential use after free crypto: sun8i-ss - fix infinite loop in sun8i_ss_setup_ivs() media: tw686x: Register the irq at the end of probe ath9k: fix use-after-free in ath9k_hif_usb_rx_cb wifi: iwlegacy: 4965: fix potential off-by-one overflow in il4965_rs_fill_link_cmd() drm/radeon: fix incorrrect SPDX-License-Identifiers test_bpf: fix incorrect netdev features crypto: ccp - During shutdown, check SEV data pointer before using drm: bridge: adv7511: Add check for mipi_dsi_driver_register drm/mcde: Fix refcount leak in mcde_dsi_bind media: hdpvr: fix error value returns in hdpvr_read media: v4l2-mem2mem: prevent pollerr when last_buffer_dequeued is set media: tw686x: Fix memory leak in tw686x_video_init drm/vc4: plane: Remove subpixel positioning check drm/vc4: plane: Fix margin calculations for the right/bottom edges drm/vc4: dsi: Correct DSI divider calculations drm/vc4: dsi: Correct pixel order for DSI0 drm/vc4: drv: Remove the DSI pointer in vc4_drv drm/vc4: dsi: Use snprintf for the PHY clocks instead of an array drm/vc4: dsi: Introduce a variant structure drm/vc4: dsi: Register dsi0 as the correct vc4 encoder type drm/vc4: dsi: Fix dsi0 interrupt support drm/vc4: dsi: Add correct stop condition to vc4_dsi_encoder_disable iteration drm/vc4: hdmi: Remove firmware logic for MAI threshold setting drm/vc4: hdmi: Avoid full hdmi audio fifo writes drm/vc4: hdmi: Don't access the connector state in reset if kmalloc fails drm/vc4: hdmi: Limit the BCM2711 to the max without scrambling drm/vc4: hdmi: Fix timings for interlaced modes drm/vc4: hdmi: Correct HDMI timing registers for interlaced modes crypto: arm64/gcm - Select AEAD for GHASH_ARM64_CE selftests/xsk: Destroy BPF resources only when ctx refcount drops to 0 drm/rockchip: vop: Don't crash for invalid duplicate_state() drm/rockchip: Fix an error handling path rockchip_dp_probe() drm/mediatek: dpi: Remove output format of YUV drm/mediatek: dpi: Only enable dpi after the bridge is enabled drm: bridge: sii8620: fix possible off-by-one lib: bitmap: order includes alphabetically lib: bitmap: provide devm_bitmap_alloc() and devm_bitmap_zalloc() hinic: Use the bitmap API when applicable net: hinic: fix bug that ethtool get wrong stats net: hinic: avoid kernel hung in hinic_get_stats64() drm/msm/mdp5: Fix global state lock backoff crypto: hisilicon/sec - fixes some coding style crypto: hisilicon/sec - don't sleep when in softirq crypto: hisilicon - Kunpeng916 crypto driver don't sleep when in softirq media: platform: mtk-mdp: Fix mdp_ipi_comm structure alignment mt76: mt76x02u: fix possible memory leak in __mt76x02u_mcu_send_msg mediatek: mt76: mac80211: Fix missing of_node_put() in mt76_led_init() drm/exynos/exynos7_drm_decon: free resources when clk_set_parent() failed. tcp: make retransmitted SKB fit into the send window libbpf: Fix the name of a reused map selftests: timers: valid-adjtimex: build fix for newer toolchains selftests: timers: clocksource-switch: fix passing errors from child bpf: Fix subprog names in stack traces. fs: check FMODE_LSEEK to control internal pipe splicing wifi: wil6210: debugfs: fix info leak in wil_write_file_wmi() wifi: p54: Fix an error handling path in p54spi_probe() wifi: p54: add missing parentheses in p54_flush() selftests/bpf: fix a test for snprintf() overflow can: pch_can: do not report txerr and rxerr during bus-off can: rcar_can: do not report txerr and rxerr during bus-off can: sja1000: do not report txerr and rxerr during bus-off can: hi311x: do not report txerr and rxerr during bus-off can: sun4i_can: do not report txerr and rxerr during bus-off can: kvaser_usb_hydra: do not report txerr and rxerr during bus-off can: kvaser_usb_leaf: do not report txerr and rxerr during bus-off can: usb_8dev: do not report txerr and rxerr during bus-off can: error: specify the values of data[5..7] of CAN error frames can: pch_can: pch_can_error(): initialize errc before using it Bluetooth: hci_intel: Add check for platform_driver_register i2c: cadence: Support PEC for SMBus block read i2c: mux-gpmux: Add of_node_put() when breaking out of loop wifi: wil6210: debugfs: fix uninitialized variable use in `wil_write_file_wmi()` wifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue wifi: libertas: Fix possible refcount leak in if_usb_probe() media: cedrus: hevc: Add check for invalid timestamp net/mlx5e: Remove WARN_ON when trying to offload an unsupported TLS cipher/version net/mlx5e: Fix the value of MLX5E_MAX_RQ_NUM_MTTS crypto: hisilicon/hpre - don't use GFP_KERNEL to alloc mem during softirq crypto: inside-secure - Add missing MODULE_DEVICE_TABLE for of crypto: hisilicon/sec - fix auth key size error inet: add READ_ONCE(sk->sk_bound_dev_if) in INET_MATCH() tcp: sk->sk_bound_dev_if once in inet_request_bound_dev_if() ipv6: add READ_ONCE(sk->sk_bound_dev_if) in INET6_MATCH() tcp: Fix data-races around sysctl_tcp_l3mdev_accept. net: allow unbound socket for packets in VRF when tcp_l3mdev_accept set iavf: Fix max_rate limiting netdevsim: Avoid allocation warnings triggered from user space net: rose: fix netdev reference changes net: ionic: fix error check for vlan flags in ionic_set_nic_features() dccp: put dccp_qpolicy_full() and dccp_qpolicy_push() in the same lock wireguard: ratelimiter: use hrtimer in selftest wireguard: allowedips: don't corrupt stack when detecting overflow clk: renesas: r9a06g032: Fix UART clkgrp bitsel mtd: maps: Fix refcount leak in of_flash_probe_versatile mtd: maps: Fix refcount leak in ap_flash_init mtd: rawnand: meson: Fix a potential double free issue PCI: tegra194: Fix PM error handling in tegra_pcie_config_ep() HID: cp2112: prevent a buffer overflow in cp2112_xfer() mtd: sm_ftl: Fix deadlock caused by cancel_work_sync in sm_release mtd: partitions: Fix refcount leak in parse_redboot_of mtd: st_spi_fsm: Add a clk_disable_unprepare() in .probe()'s error path fpga: altera-pr-ip: fix unsigned comparison with less than zero usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe usb: ohci-nxp: Fix refcount leak in ohci_hcd_nxp_probe usb: gadget: tegra-xudc: Fix error check in tegra_xudc_powerdomain_init() usb: xhci: tegra: Fix error check netfilter: xtables: Bring SPDX identifier back iio: accel: bma400: Fix the scale min and max macro values platform/chrome: cros_ec: Always expose last resume result iio: accel: bma400: Reordering of header files clk: mediatek: reset: Fix written reset bit offset KVM: Don't set Accessed/Dirty bits for ZERO_PAGE mwifiex: Ignore BTCOEX events from the 88W8897 firmware mwifiex: fix sleep in atomic context bugs caused by dev_coredumpv dmaengine: dw-edma: Fix eDMA Rd/Wr-channels and DMA-direction semantics misc: rtsx: Fix an error handling path in rtsx_pci_probe() driver core: fix potential deadlock in __driver_attach clk: qcom: clk-krait: unlock spin after mux completion usb: host: xhci: use snprintf() in xhci_decode_trb() clk: qcom: ipq8074: fix NSS core PLL-s clk: qcom: ipq8074: SW workaround for UBI32 PLL lock clk: qcom: ipq8074: fix NSS port frequency tables clk: qcom: ipq8074: set BRANCH_HALT_DELAY flag for UBI clocks clk: qcom: camcc-sdm845: Fix topology around titan_top power domain PCI: dwc: Add unroll iATU space support to dw_pcie_disable_atu() PCI: dwc: Deallocate EPC memory on dw_pcie_ep_init() errors PCI: dwc: Always enable CDM check if "snps,enable-cdm-check" exists soundwire: bus_type: fix remove and shutdown support KVM: arm64: Don't return from void function dmaengine: sf-pdma: apply proper spinlock flags in sf_pdma_prep_dma_memcpy() dmaengine: sf-pdma: Add multithread support for a DMA channel PCI: endpoint: Don't stop controller when unbinding endpoint function intel_th: Fix a resource leak in an error handling path intel_th: msu-sink: Potential dereference of null pointer intel_th: msu: Fix vmalloced buffers staging: rtl8192u: Fix sleep in atomic context bug in dm_fsync_timer_callback mmc: sdhci-of-esdhc: Fix refcount leak in esdhc_signal_voltage_switch memstick/ms_block: Fix some incorrect memory allocation memstick/ms_block: Fix a memory leak mmc: sdhci-of-at91: fix set_uhs_signaling rewriting of MC1R mmc: block: Add single read for 4k sector cards KVM: s390: pv: leak the topmost page table when destroy fails PCI/portdrv: Don't disable AER reporting in get_port_device_capability() PCI: qcom: Set up rev 2.1.0 PARF_PHY before enabling clocks scsi: smartpqi: Fix DMA direction for RAID requests xtensa: iss/network: provide release() callback xtensa: iss: fix handling error cases in iss_net_configure() usb: gadget: udc: amd5536 depends on HAS_DMA usb: aspeed-vhub: Fix refcount leak bug in ast_vhub_init_desc() usb: dwc3: core: Deprecate GCTL.CORESOFTRESET usb: dwc3: core: Do not perform GCTL_CORE_SOFTRESET during bootup usb: dwc3: qcom: fix missing optional irq warnings eeprom: idt_89hpesx: uninitialized data in idt_dbgfs_csr_write() interconnect: imx: fix max_node_id um: random: Don't initialise hwrng struct with zero RDMA/rtrs: Define MIN_CHUNK_SIZE RDMA/rtrs: Avoid Wtautological-constant-out-of-range-compare RDMA/rtrs-srv: Fix modinfo output for stringify RDMA/qedr: Improve error logs for rdma_alloc_tid error return RDMA/qedr: Fix potential memory leak in __qedr_alloc_mr() RDMA/hns: Fix incorrect clearing of interrupt status register RDMA/siw: Fix duplicated reported IW_CM_EVENT_CONNECT_REPLY event RDMA/hfi1: fix potential memory leak in setup_base_ctxt() gpio: gpiolib-of: Fix refcount bugs in of_mm_gpiochip_add_data() HID: mcp2221: prevent a buffer overflow in mcp_smbus_write() mmc: cavium-octeon: Add of_node_put() when breaking out of loop mmc: cavium-thunderx: Add of_node_put() when breaking out of loop HID: alps: Declare U1_UNICORN_LEGACY support PCI: tegra194: Fix Root Port interrupt handling PCI: tegra194: Fix link up retry sequence USB: serial: fix tty-port initialized comments usb: cdns3: change place of 'priv_ep' assignment in cdns3_gadget_ep_dequeue(), cdns3_gadget_ep_enable() platform/olpc: Fix uninitialized data in debugfs write RDMA/srpt: Duplicate port name members RDMA/srpt: Introduce a reference count in struct srpt_device RDMA/srpt: Fix a use-after-free mm/mmap.c: fix missing call to vm_unacct_memory in mmap_region selftests: kvm: set rax before vmcall RDMA/mlx5: Add missing check for return value in get namespace flow RDMA/rxe: Fix error unwind in rxe_create_qp() null_blk: fix ida error handling in null_add_dev() nvme: use command_id instead of req->tag in trace_nvme_complete_rq() jbd2: fix outstanding credits assert in jbd2_journal_commit_transaction() ext4: recover csum seed of tmp_inode after migrating to extents jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted usb: cdns3: Don't use priv_dev uninitialized in cdns3_gadget_ep_enable() opp: Fix error check in dev_pm_opp_attach_genpd() ASoC: cros_ec_codec: Fix refcount leak in cros_ec_codec_platform_probe ASoC: samsung: Fix error handling in aries_audio_probe ASoC: mediatek: mt8173: Fix refcount leak in mt8173_rt5650_rt5676_dev_probe ASoC: mt6797-mt6351: Fix refcount leak in mt6797_mt6351_dev_probe ASoC: codecs: da7210: add check for i2c_add_driver ASoC: mediatek: mt8173-rt5650: Fix refcount leak in mt8173_rt5650_dev_probe serial: 8250: Export ICR access helpers for internal use serial: 8250_dw: Store LSR into lsr_saved_flags in dw8250_tx_wait_empty() ASoC: codecs: msm8916-wcd-digital: move gains from SX_TLV to S8_TLV ASoC: codecs: wcd9335: move gains from SX_TLV to S8_TLV rpmsg: mtk_rpmsg: Fix circular locking dependency remoteproc: k3-r5: Fix refcount leak in k3_r5_cluster_of_init selftests/livepatch: better synchronize test_klp_callbacks_busy profiling: fix shift too large makes kernel panic ASoC: samsung: h1940_uda1380: include proepr GPIO consumer header powerpc/perf: Optimize clearing the pending PMI and remove WARN_ON for PMI check in power_pmu_disable ASoC: samsung: change gpiod_speaker_power and rx1950_audio from global to static variables tty: n_gsm: Delete gsmtty open SABM frame when config requester tty: n_gsm: fix user open not possible at responder until initiator open tty: n_gsm: fix wrong queuing behavior in gsm_dlci_data_output() tty: n_gsm: fix non flow control frames during mux flow off tty: n_gsm: fix packet re-transmission without open control channel tty: n_gsm: fix race condition in gsmld_write() ASoC: qcom: Fix missing of_node_put() in asoc_qcom_lpass_cpu_platform_probe() remoteproc: qcom: wcnss: Fix handling of IRQs vfio: Remove extra put/gets around vfio_device->group vfio: Simplify the lifetime logic for vfio_device vfio: Split creation of a vfio_device into init and register ops vfio/mdev: Make to_mdev_device() into a static inline vfio/ccw: Do not change FSM state in subchannel event tty: n_gsm: fix wrong T1 retry count handling tty: n_gsm: fix DM command tty: n_gsm: fix missing corner cases in gsmld_poll() iommu/exynos: Handle failed IOMMU device registration properly rpmsg: qcom_smd: Fix refcount leak in qcom_smd_parse_edge kfifo: fix kfifo_to_user() return type lib/smp_processor_id: fix imbalanced instrumentation_end() call remoteproc: sysmon: Wait for SSCTL service to come up mfd: t7l66xb: Drop platform disable callback mfd: max77620: Fix refcount leak in max77620_initialise_fps iommu/arm-smmu: qcom_iommu: Add of_node_put() when breaking out of loop perf tools: Fix dso_id inode generation comparison s390/dump: fix old lowcore virtual vs physical address confusion s390/zcore: fix race when reading from hardware system area ASoC: fsl_easrc: use snd_pcm_format_t type for sample_format ASoC: qcom: q6dsp: Fix an off-by-one in q6adm_alloc_copp() fuse: Remove the control interface for virtio-fs ASoC: audio-graph-card: Add of_node_put() in fail path watchdog: armada_37xx_wdt: check the return value of devm_ioremap() in armada_37xx_wdt_probe() video: fbdev: amba-clcd: Fix refcount leak bugs video: fbdev: sis: fix typos in SiS_GetModeID() ASoC: mchp-spdifrx: disable end of block interrupt on failures powerpc/32: Do not allow selection of e5500 or e6500 CPUs on PPC32 powerpc/pci: Prefer PCI domain assignment via DT 'linux,pci-domain' and alias f2fs: don't set GC_FAILURE_PIN for background GC f2fs: write checkpoint during FG_GC f2fs: fix to remove F2FS_COMPR_FL and tag F2FS_NOCOMP_FL at the same time powerpc/spufs: Fix refcount leak in spufs_init_isolated_loader powerpc/xive: Fix refcount leak in xive_get_max_prio powerpc/cell/axon_msi: Fix refcount leak in setup_msi_msg_address perf symbol: Fail to read phdr workaround kprobes: Forbid probing on trampoline and BPF code areas powerpc/pci: Fix PHB numbering when using opal-phbid genelf: Use HAVE_LIBCRYPTO_SUPPORT, not the never defined HAVE_LIBCRYPTO scripts/faddr2line: Fix vmlinux detection on arm64 sched/deadline: Merge dl_task_can_attach() and dl_cpu_busy() sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed x86/numa: Use cpumask_available instead of hardcoded NULL check video: fbdev: arkfb: Fix a divide-by-zero bug in ark_set_pixclock() tools/thermal: Fix possible path truncations sched: Fix the check of nr_running at queue wakelist x86/entry: Build thunk_$(BITS) only if CONFIG_PREEMPTION=y video: fbdev: vt8623fb: Check the size of screen before memset_io() video: fbdev: arkfb: Check the size of screen before memset_io() video: fbdev: s3fb: Check the size of screen before memset_io() scsi: zfcp: Fix missing auto port scan and thus missing target ports scsi: qla2xxx: Fix discovery issues in FC-AL topology scsi: qla2xxx: Turn off multi-queue for 8G adapters scsi: qla2xxx: Fix erroneous mailbox timeout after PCI error injection scsi: qla2xxx: Fix losing FCP-2 targets on long port disable with I/Os scsi: qla2xxx: Fix losing FCP-2 targets during port perturbation tests x86/bugs: Enable STIBP for IBPB mitigated RETBleed ftrace/x86: Add back ftrace_expected assignment x86/olpc: fix 'logical not is only applied to the left hand side' posix-cpu-timers: Cleanup CPU timers before freeing them during exec Input: gscps2 - check return value of ioremap() in gscps2_probe() __follow_mount_rcu(): verify that mount_lock remains unchanged spmi: trace: fix stack-out-of-bound access in SPMI tracing functions drm/i915/dg1: Update DMC_DEBUG3 register drm/mediatek: Allow commands to be sent during video mode drm/mediatek: Keep dsi as LP00 before dcs cmds transfer HID: Ignore battery for Elan touchscreen on HP Spectre X360 15-df0xxx HID: hid-input: add Surface Go battery quirk drm/vc4: drv: Adopt the dma configuration from the HVS or V3D component mtd: rawnand: Add a helper to clarify the interface configuration mtd: rawnand: arasan: Check the proposed data interface is supported mtd: rawnand: Add NV-DDR timings mtd: rawnand: arasan: Fix a macro parameter mtd: rawnand: arasan: Support NV-DDR interface mtd: rawnand: arasan: Fix clock rate in NV-DDR usbnet: smsc95xx: Don't clear read-only PHY interrupt usbnet: smsc95xx: Avoid link settings race on interrupt reception firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails intel_th: pci: Add Meteor Lake-P support intel_th: pci: Add Raptor Lake-S PCH support intel_th: pci: Add Raptor Lake-S CPU support KVM: set_msr_mce: Permit guests to ignore single-bit ECC errors KVM: x86: Signal #GP, not -EPERM, on bad WRMSR(MCi_CTL/STATUS) iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) PCI/AER: Write AER Capability only when we control it PCI/ERR: Bind RCEC devices to the Root Port driver PCI/ERR: Rename reset_link() to reset_subordinates() PCI/ERR: Simplify by using pci_upstream_bridge() PCI/ERR: Simplify by computing pci_pcie_type() once PCI/ERR: Use "bridge" for clarity in pcie_do_recovery() PCI/ERR: Avoid negated conditional for clarity PCI/ERR: Add pci_walk_bridge() to pcie_do_recovery() PCI/ERR: Recover from RCEC AER errors PCI/AER: Iterate over error counters instead of error strings serial: 8250: Dissociate 4MHz Titan ports from Oxford ports serial: 8250: Correct the clock for OxSemi PCIe devices serial: 8250_pci: Refactor the loop in pci_ite887x_init() serial: 8250_pci: Replace dev_*() by pci_*() macros serial: 8250: Fold EndRun device support into OxSemi Tornado code dm writecache: set a default MAX_WRITEBACK_JOBS kexec, KEYS, s390: Make use of built-in and secondary keyring for signature verification dm thin: fix use-after-free crash in dm_sm_register_threshold_callback timekeeping: contribute wall clock to rng on time change um: Allow PM with suspend-to-idle btrfs: reject log replay if there is unsupported RO compat flag btrfs: reset block group chunk force if we have to wait ACPI: CPPC: Do not prevent CPPC from working in the future KVM: VMX: Drop guest CPUID check for VMXE in vmx_set_cr4() KVM: VMX: Drop explicit 'nested' check from vmx_set_cr4() KVM: SVM: Drop VMXE check from svm_set_cr4() KVM: x86: Move vendor CR4 validity check to dedicated kvm_x86_ops hook KVM: nVMX: Inject #UD if VMXON is attempted with incompatible CR0/CR4 KVM: x86/pmu: preserve IA32_PERF_CAPABILITIES across CPUID refresh KVM: x86/pmu: Use binary search to check filtered events KVM: x86/pmu: Use different raw event masks for AMD and Intel KVM: x86/pmu: Introduce the ctrl_mask value for fixed counter KVM: VMX: Mark all PERF_GLOBAL_(OVF)_CTRL bits reserved if there's no vPMU KVM: x86/pmu: Ignore pmu->global_ctrl check if vPMU doesn't support global_ctrl xen-blkback: fix persistent grants negotiation xen-blkback: Apply 'feature_persistent' parameter when connect xen-blkfront: Apply 'feature_persistent' parameter when connect KEYS: asymmetric: enforce SM2 signature use pkey algo tpm: eventlog: Fix section mismatch for DEBUG_SECTION_MISMATCH tracing: Use a struct alignof to determine trace event field alignment ext4: check if directory block is within i_size ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h ext4: fix warning in ext4_iomap_begin as race between bmap and write ext4: make sure ext4_append() always allocates new block ext4: fix use-after-free in ext4_xattr_set_entry ext4: update s_overhead_clusters in the superblock during an on-line resize ext4: fix extent status tree race in writeback error recovery path ext4: correct max_inline_xattr_value_size computing ext4: correct the misjudgment in ext4_iget_extra_inode dm raid: fix address sanitizer warning in raid_resume dm raid: fix address sanitizer warning in raid_status net_sched: cls_route: remove from list when handle is 0 KVM: Add infrastructure and macro to mark VM as bugged KVM: x86: Check lapic_in_kernel() before attempting to set a SynIC irq KVM: x86: Avoid theoretical NULL pointer dereference in kvm_irq_delivery_to_apic_fast() mac80211: fix a memory leak where sta_info is not freed tcp: fix over estimation in sk_forced_mem_schedule() Revert "mwifiex: fix sleep in atomic context bugs caused by dev_coredumpv" drm/bridge: tc358767: Fix (e)DP bridge endpoint parsing in dedicated function drm/vc4: change vc4_dma_range_matches from a global to static Revert "net: usb: ax88179_178a needs FLAG_SEND_ZLP" Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression mtd: rawnand: arasan: Prevent an unsupported configuration kvm: x86/pmu: Fix the compare function used by the pmu event filter tee: add overflow check in register_shm_helper() net/9p: Initialize the iounit field during fid creation net_sched: cls_route: disallow handle of 0 sched/fair: Fix fault in reweight_entity btrfs: only write the sectors in the vertical stripe which has data stripes btrfs: raid56: don't trust any cached sector in __raid56_parity_recover() Linux 5.10.137 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I5775ddfad6460c5a737b1ad3f8e0b8f798338786	2022-08-29 16:53:14 +02:00
Eric Dumazet	f7884d9500	inet: add READ_ONCE(sk->sk_bound_dev_if) in INET_MATCH() ... [ Upstream commit 4915d50e30 ] INET_MATCH() runs without holding a lock on the socket. We probably need to annotate most reads. This patch makes INET_MATCH() an inline function to ease our changes. v2: We remove the 32bit version of it, as modern compilers should generate the same code really, no need to try to be smarter. Also make 'struct net *net' the first argument. Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-08-21 15:15:50 +02:00
Greg Kroah-Hartman	0e8e989142	Merge 5.10.121 into android12-5.10-lts ... Changes in 5.10.121 binfmt_flat: do not stop relocating GOT entries prematurely on riscv parisc/stifb: Implement fb_is_primary_device() riscv: Initialize thread pointer before calling C functions riscv: Fix irq_work when SMP is disabled ALSA: hda/realtek: Enable 4-speaker output for Dell XPS 15 9520 laptop ALSA: hda/realtek - Fix microphone noise on ASUS TUF B550M-PLUS ALSA: usb-audio: Cancel pending work at closing a MIDI substream USB: serial: option: add Quectel BG95 modem USB: new quirk for Dell Gen 2 devices usb: dwc3: gadget: Move null pinter check to proper place usb: core: hcd: Add support for deferring roothub registration cifs: when extending a file with falloc we should make files not-sparse xhci: Allow host runtime PM as default for Intel Alder Lake N xHCI Fonts: Make font size unsigned in font_desc parisc/stifb: Keep track of hardware path of graphics card x86/MCE/AMD: Fix memory leak when threshold_create_bank() fails perf/x86/intel: Fix event constraints for ICL ptrace/um: Replace PT_DTRACE with TIF_SINGLESTEP ptrace/xtensa: Replace PT_SINGLESTEP with TIF_SINGLESTEP ptrace: Reimplement PTRACE_KILL by always sending SIGKILL btrfs: add "0x" prefix for unsupported optional features btrfs: repair super block num_devices automatically iommu/vt-d: Add RPLS to quirk list to skip TE disabling drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes mwifiex: add mutex lock for call in mwifiex_dfs_chan_sw_work_queue b43legacy: Fix assigning negative value to unsigned variable b43: Fix assigning negative value to unsigned variable ipw2x00: Fix potential NULL dereference in libipw_xmit() ipv6: fix locking issues with loops over idev->addr_list fbcon: Consistently protect deferred_takeover with console_lock() x86/platform/uv: Update TSC sync state for UV5 ACPICA: Avoid cache flush inside virtual machines drm/komeda: return early if drm_universal_plane_init() fails. rcu-tasks: Fix race in schedule and flush work rcu: Make TASKS_RUDE_RCU select IRQ_WORK sfc: ef10: Fix assigning negative value to unsigned variable ALSA: jack: Access input_dev under mutex spi: spi-rspi: Remove setting {src,dst}_{addr,addr_width} based on DMA direction tools/power turbostat: fix ICX DRAM power numbers drm/amd/pm: fix double free in si_parse_power_table() ath9k: fix QCA9561 PA bias level media: venus: hfi: avoid null dereference in deinit media: pci: cx23885: Fix the error handling in cx23885_initdev() media: cx25821: Fix the warning when removing the module md/bitmap: don't set sb values if can't pass sanity check mmc: jz4740: Apply DMA engine limits to maximum segment size drivers: mmc: sdhci_am654: Add the quirk to set TESTCD bit scsi: megaraid: Fix error check return value of register_chrdev() scsi: ufs: Use pm_runtime_resume_and_get() instead of pm_runtime_get_sync() scsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp() ath11k: disable spectral scan during spectral deinit ASoC: Intel: bytcr_rt5640: Add quirk for the HP Pro Tablet 408 drm/plane: Move range check for format_count earlier drm/amd/pm: fix the compile warning ath10k: skip ath10k_halt during suspend for driver state RESTARTING arm64: compat: Do not treat syscall number as ESR_ELx for a bad syscall drm: msm: fix error check return value of irq_of_parse_and_map() ipv6: Don't send rs packets to the interface of ARPHRD_TUNNEL net/mlx5: fs, delete the FTE when there are no rules attached to it ASoC: dapm: Don't fold register value changes into notifications mlxsw: spectrum_dcb: Do not warn about priority changes mlxsw: Treat LLDP packets as control drm/amdgpu/ucode: Remove firmware load type check in amdgpu_ucode_free_bo HID: bigben: fix slab-out-of-bounds Write in bigben_probe ASoC: tscs454: Add endianness flag in snd_soc_component_driver net: remove two BUG() from skb_checksum_help() s390/preempt: disable __preempt_count_add() optimization for PROFILE_ALL_BRANCHES perf/amd/ibs: Cascade pmu init functions' return value spi: stm32-qspi: Fix wait_cmd timeout in APM mode dma-debug: change allocation mode from GFP_NOWAIT to GFP_ATIOMIC ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default ipmi:ssif: Check for NULL msg when handling events and messages ipmi: Fix pr_fmt to avoid compilation issues rtlwifi: Use pr_warn instead of WARN_ONCE media: rga: fix possible memory leak in rga_probe media: coda: limit frame interval enumeration to supported encoder frame sizes media: imon: reorganize serialization media: cec-adap.c: fix is_configuring state openrisc: start CPU timer early in boot nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags ASoC: rt5645: Fix errorenous cleanup order nbd: Fix hung on disconnect request if socket is closed before net: phy: micrel: Allow probing without .driver_data media: exynos4-is: Fix compile warning ASoC: max98357a: remove dependency on GPIOLIB ASoC: rt1015p: remove dependency on GPIOLIB can: mcp251xfd: silence clang's -Wunaligned-access warning x86/microcode: Add explicit CPU vendor dependency m68k: atari: Make Atari ROM port I/O write macros return void rxrpc: Return an error to sendmsg if call failed rxrpc, afs: Fix selection of abort codes eth: tg3: silence the GCC 12 array-bounds warning selftests/bpf: fix btf_dump/btf_dump due to recent clang change gfs2: use i_lock spin_lock for inode qadata IB/rdmavt: add missing locks in rvt_ruc_loopback ARM: dts: ox820: align interrupt controller node name with dtschema ARM: dts: s5pv210: align DMA channels with dtschema arm64: dts: qcom: msm8994: Fix BLSP[12]_DMA channels count PM / devfreq: rk3399_dmc: Disable edev on remove() crypto: ccree - use fine grained DMA mapping dir soc: ti: ti_sci_pm_domains: Check for null return of devm_kcalloc fs: jfs: fix possible NULL pointer dereference in dbFree() ARM: OMAP1: clock: Fix UART rate reporting algorithm powerpc/fadump: Fix fadump to work with a different endian capture kernel fat: add ratelimit to fat*_ent_bread() pinctrl: renesas: rzn1: Fix possible null-ptr-deref in sh_pfc_map_resources() ARM: versatile: Add missing of_node_put in dcscb_init ARM: dts: exynos: add atmel,24c128 fallback to Samsung EEPROM ARM: hisi: Add missing of_node_put after of_find_compatible_node PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() tracing: incorrect isolate_mote_t cast in mm_vmscan_lru_isolate powerpc/powernv/vas: Assign real address to rx_fifo in vas_rx_win_attr powerpc/xics: fix refcount leak in icp_opal_init() powerpc/powernv: fix missing of_node_put in uv_init() macintosh/via-pmu: Fix build failure when CONFIG_INPUT is disabled powerpc/iommu: Add missing of_node_put in iommu_init_early_dart RDMA/hfi1: Prevent panic when SDMA is disabled drm: fix EDID struct for old ARM OABI format dt-bindings: display: sitronix, st7735r: Fix backlight in example ath11k: acquire ab->base_lock in unassign when finding the peer by addr ath9k: fix ar9003_get_eepmisc drm/edid: fix invalid EDID extension block filtering drm/bridge: adv7511: clean up CEC adapter when probe fails spi: qcom-qspi: Add minItems to interconnect-names ASoC: mediatek: Fix error handling in mt8173_max98090_dev_probe ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe x86/delay: Fix the wrong asm constraint in delay_loop() drm/ingenic: Reset pixclock rate when parent clock rate changes drm/mediatek: Fix mtk_cec_mask() drm/vc4: hvs: Reset muxes at probe time drm/vc4: txp: Don't set TXP_VSTART_AT_EOF drm/vc4: txp: Force alpha to be 0xff if it's disabled libbpf: Don't error out on CO-RE relos for overriden weak subprogs bpf: Fix excessive memory allocation in stack_map_alloc() nl80211: show SSID for P2P_GO interfaces drm/komeda: Fix an undefined behavior bug in komeda_plane_add() drm: mali-dp: potential dereference of null pointer spi: spi-ti-qspi: Fix return value handling of wait_for_completion_timeout scftorture: Fix distribution of short handler delays net: dsa: mt7530: 1G can also support 1000BASE-X link mode NFC: NULL out the dev->rfkill to prevent UAF efi: Add missing prototype for efi_capsule_setup_info target: remove an incorrect unmap zeroes data deduction drbd: fix duplicate array initializer EDAC/dmc520: Don't print an error for each unconfigured interrupt line mtd: rawnand: denali: Use managed device resources HID: hid-led: fix maximum brightness for Dream Cheeky HID: elan: Fix potential double free in elan_input_configured drm/bridge: Fix error handling in analogix_dp_probe sched/fair: Fix cfs_rq_clock_pelt() for throttled cfs_rq spi: img-spfi: Fix pm_runtime_get_sync() error checking cpufreq: Fix possible race in cpufreq online error path ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix media: hantro: Empty encoder capture buffers by default drm/panel: simple: Add missing bus flags for Innolux G070Y2-L01 ALSA: pcm: Check for null pointer of pointer substream before dereferencing it inotify: show inotify mask flags in proc fdinfo fsnotify: fix wrong lockdep annotations of: overlay: do not break notify on NOTIFY_{OK|STOP} drm/msm/dpu: adjust display_v_end for eDP and DP scsi: ufs: qcom: Fix ufs_qcom_resume() scsi: ufs: core: Exclude UECxx from SFR dump list selftests/resctrl: Fix null pointer dereference on open failed libbpf: Fix logic for finding matching program for CO-RE relocation mtd: spi-nor: core: Check written SR value in spi_nor_write_16bit_sr_and_check() x86/pm: Fix false positive kmemleak report in msr_build_context() mtd: rawnand: cadence: fix possible null-ptr-deref in cadence_nand_dt_probe() x86/speculation: Add missing prototype for unpriv_ebpf_notify() ASoC: rk3328: fix disabling mclk on pclk probe failure perf tools: Add missing headers needed by util/data.h drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime resume drm/msm/dp: stop event kernel thread when DP unbind drm/msm/dp: fix error check return value of irq_of_parse_and_map() drm/msm/dsi: fix error checks and return values for DSI xmit functions drm/msm/hdmi: check return value after calling platform_get_resource_byname() drm/msm/hdmi: fix error check return value of irq_of_parse_and_map() drm/msm: add missing include to msm_drv.c drm/panel: panel-simple: Fix proper bpc for AM-1280800N3TZQW-T00H drm/rockchip: vop: fix possible null-ptr-deref in vop_bind() perf tools: Use Python devtools for version autodetection rather than runtime virtio_blk: fix the discard_granularity and discard_alignment queue limits x86: Fix return value of __setup handlers irqchip/exiu: Fix acknowledgment of edge triggered interrupts irqchip/aspeed-i2c-ic: Fix irq_of_parse_and_map() return value irqchip/aspeed-scu-ic: Fix irq_of_parse_and_map() return value x86/mm: Cleanup the control_va_addr_alignment() __setup handler arm64: fix types in copy_highpage() regulator: core: Fix enable_count imbalance with EXCLUSIVE_GET drm/msm/dp: fix event thread stuck in wait_event after kthread_stop() drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is detected drm/msm/mdp5: Return error code in mdp5_mixer_release when deadlock is detected drm/msm: return an error pointer in msm_gem_prime_get_sg_table() media: uvcvideo: Fix missing check to determine if element is found in list iomap: iomap_write_failed fix spi: spi-fsl-qspi: check return value after calling platform_get_resource_byname() Revert "cpufreq: Fix possible race in cpufreq online error path" regulator: qcom_smd: Fix up PM8950 regulator configuration perf/amd/ibs: Use interrupt regs ip for stack unwinding ath11k: Don't check arvif->is_started before sending management frames ASoC: fsl: Fix refcount leak in imx_sgtl5000_probe ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt ASoC: samsung: Use dev_err_probe() helper ASoC: samsung: Fix refcount leak in aries_audio_probe kselftest/cgroup: fix test_stress.sh to use OUTPUT dir scripts/faddr2line: Fix overlapping text section failures media: aspeed: Fix an error handling path in aspeed_video_probe() media: exynos4-is: Fix PM disable depth imbalance in fimc_is_probe media: st-delta: Fix PM disable depth imbalance in delta_probe media: exynos4-is: Change clk_disable to clk_disable_unprepare media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init media: vsp1: Fix offset calculation for plane cropping Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout Bluetooth: Interleave with allowlist scan Bluetooth: L2CAP: Rudimentary typo fixes Bluetooth: LL privacy allow RPA Bluetooth: use inclusive language in HCI role comments Bluetooth: use inclusive language when filtering devices Bluetooth: use hdev lock for accept_list and reject_list in conn req nvme: set dma alignment to dword m68k: math-emu: Fix dependencies of math emulation support lsm,selinux: pass flowi_common instead of flowi to the LSM hooks sctp: read sk->sk_bound_dev_if once in sctp_rcv() net: hinic: add missing destroy_workqueue in hinic_pf_to_mgmt_init ASoC: ti: j721e-evm: Fix refcount leak in j721e_soc_probe_* media: ov7670: remove ov7670_power_off from ov7670_remove media: staging: media: rkvdec: Make use of the helper function devm_platform_ioremap_resource() media: rkvdec: h264: Fix dpb_valid implementation media: rkvdec: h264: Fix bit depth wrap in pps packet ext4: reject the 'commit' option on ext2 filesystems drm/msm/a6xx: Fix refcount leak in a6xx_gpu_init drm: msm: fix possible memory leak in mdp5_crtc_cursor_set() x86/sev: Annotate stack change in the #VC handler drm/msm/dpu: handle pm_runtime_get_sync() errors in bind path drm/i915: Fix CFI violation with show_dynamic_id() thermal/drivers/bcm2711: Don't clamp temperature at zero thermal/drivers/broadcom: Fix potential NULL dereference in sr_thermal_probe thermal/drivers/core: Use a char pointer for the cooling device name thermal/core: Fix memory leak in __thermal_cooling_device_register() thermal/drivers/imx_sc_thermal: Fix refcount leak in imx_sc_thermal_probe ASoC: wm2000: fix missing clk_disable_unprepare() on error in wm2000_anc_transition() NFC: hci: fix sleep in atomic context bugs in nfc_hci_hcp_message_tx ASoC: max98090: Move check for invalid values before casting in max98090_put_enab_tlv() net: stmmac: selftests: Use kcalloc() instead of kzalloc() net: stmmac: fix out-of-bounds access in a selftest hv_netvsc: Fix potential dereference of NULL pointer rxrpc: Fix listen() setting the bar too high for the prealloc rings rxrpc: Don't try to resend the request if we're receiving the reply rxrpc: Fix overlapping ACK accounting rxrpc: Don't let ack.previousPacket regress rxrpc: Fix decision on when to generate an IDLE ACK net: huawei: hinic: Use devm_kcalloc() instead of devm_kzalloc() hinic: Avoid some over memory allocation net/smc: postpone sk_refcnt increment in connect() arm64: dts: rockchip: Move drive-impedance-ohm to emmc phy on rk3399 memory: samsung: exynos5422-dmc: Avoid some over memory allocation ARM: dts: suniv: F1C100: fix watchdog compatible soc: qcom: smp2p: Fix missing of_node_put() in smp2p_parse_ipc soc: qcom: smsm: Fix missing of_node_put() in smsm_parse_ipc PCI: cadence: Fix find_first_zero_bit() limit PCI: rockchip: Fix find_first_zero_bit() limit PCI: dwc: Fix setting error return on MSI DMA mapping failure ARM: dts: ci4x10: Adapt to changes in imx6qdl.dtsi regarding fec clocks soc: qcom: llcc: Add MODULE_DEVICE_TABLE() KVM: nVMX: Leave most VM-Exit info fields unmodified on failed VM-Entry KVM: nVMX: Clear IDT vectoring on nested VM-Exit for double/triple fault platform/chrome: cros_ec: fix error handling in cros_ec_register() ARM: dts: imx6dl-colibri: Fix I2C pinmuxing platform/chrome: Re-introduce cros_ec_cmd_xfer and use it for ioctls can: xilinx_can: mark bit timing constants as const ARM: dts: stm32: Fix PHY post-reset delay on Avenger96 ARM: dts: bcm2835-rpi-zero-w: Fix GPIO line name for Wifi/BT ARM: dts: bcm2837-rpi-cm3-io3: Fix GPIO line names for SMPS I2C ARM: dts: bcm2837-rpi-3-b-plus: Fix GPIO line name of power LED ARM: dts: bcm2835-rpi-b: Fix GPIO line names misc: ocxl: fix possible double free in ocxl_file_register_afu crypto: marvell/cesa - ECB does not IV gpiolib: of: Introduce hook for missing gpio-ranges pinctrl: bcm2835: implement hook for missing gpio-ranges arm: mediatek: select arch timer for mt7629 powerpc/fadump: fix PT_LOAD segment for boot memory area mfd: ipaq-micro: Fix error check return value of platform_get_irq() scsi: fcoe: Fix Wstringop-overflow warnings in fcoe_wwn_from_mac() firmware: arm_scmi: Fix list protocols enumeration in the base protocol nvdimm: Fix firmware activation deadlock scenarios nvdimm: Allow overwrite in the presence of disabled dimms pinctrl: mvebu: Fix irq_of_parse_and_map() return value drivers/base/node.c: fix compaction sysfs file leak dax: fix cache flush on PMD-mapped pages drivers/base/memory: fix an unlikely reference counting issue in __add_memory_block() powerpc/8xx: export 'cpm_setbrg' for modules pinctrl: renesas: core: Fix possible null-ptr-deref in sh_pfc_map_resources() powerpc/idle: Fix return value of __setup() handler powerpc/4xx/cpm: Fix return value of __setup() handler ASoC: atmel-pdmic: Remove endianness flag on pdmic component ASoC: atmel-classd: Remove endianness flag on class d component proc: fix dentry/inode overinstantiating under /proc/${pid}/net ipc/mqueue: use get_tree_nodev() in mqueue_get_tree() PCI: imx6: Fix PERST# start-up sequence tty: fix deadlock caused by calling printk() under tty_port->lock crypto: sun8i-ss - rework handling of IV crypto: sun8i-ss - handle zero sized sg crypto: cryptd - Protect per-CPU resource by disabling BH. Input: sparcspkr - fix refcount leak in bbc_beep_probe PCI/AER: Clear MULTI_ERR_COR/UNCOR_RCV bits hwrng: omap3-rom - fix using wrong clk_disable() in omap_rom_rng_runtime_resume() powerpc/64: Only WARN if __pa()/__va() called with bad addresses powerpc/perf: Fix the threshold compare group constraint for power9 macintosh: via-pmu and via-cuda need RTC_LIB powerpc/fsl_rio: Fix refcount leak in fsl_rio_setup mfd: davinci_voicecodec: Fix possible null-ptr-deref davinci_vc_probe() mailbox: forward the hrtimer if not queued and under a lock RDMA/hfi1: Prevent use of lock before it is initialized Input: stmfts - do not leave device disabled in stmfts_input_open OPP: call of_node_put() on error path in _bandwidth_supported() f2fs: fix dereference of stale list iterator after loop body iommu/mediatek: Add list_del in mtk_iommu_remove i2c: at91: use dma safe buffers cpufreq: mediatek: add missing platform_driver_unregister() on error in mtk_cpufreq_driver_init cpufreq: mediatek: Use module_init and add module_exit cpufreq: mediatek: Unregister platform device on exit MIPS: Loongson: Use hwmon_device_register_with_groups() to register hwmon i2c: at91: Initialize dma_buf in at91_twi_xfer() dmaengine: idxd: Fix the error handling path in idxd_cdev_register() NFS: Do not report EINTR/ERESTARTSYS as mapping errors NFS: fsync() should report filesystem errors over EINTR/ERESTARTSYS NFS: Do not report flush errors in nfs_write_end() NFS: Don't report errors from nfs_pageio_complete() more than once NFSv4/pNFS: Do not fail I/O when we fail to allocate the pNFS layout video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup dmaengine: stm32-mdma: remove GISR1 register dmaengine: stm32-mdma: rework interrupt handler dmaengine: stm32-mdma: fix chan initialization in stm32_mdma_irq_handler() iommu/amd: Increase timeout waiting for GA log enablement i2c: npcm: Fix timeout calculation i2c: npcm: Correct register access width i2c: npcm: Handle spurious interrupts i2c: rcar: fix PM ref counts in probe error paths perf c2c: Use stdio interface if slang is not supported perf jevents: Fix event syntax error caused by ExtSel f2fs: fix to avoid f2fs_bug_on() in dec_valid_node_count() f2fs: fix to do sanity check on block address in f2fs_do_zero_range() f2fs: fix to clear dirty inode in f2fs_evict_inode() f2fs: fix deadloop in foreground GC f2fs: don't need inode lock for system hidden quota f2fs: fix to do sanity check on total_data_blocks f2fs: fix fallocate to use file_modified to update permissions consistently f2fs: fix to do sanity check for inline inode wifi: mac80211: fix use-after-free in chanctx code iwlwifi: mvm: fix assert 1F04 upon reconfig fs-writeback: writeback_sb_inodes：Recalculate 'wrote' according skipped pages efi: Do not import certificates from UEFI Secure Boot for T2 Macs bfq: Split shared queues on move between cgroups bfq: Update cgroup information before merging bio bfq: Track whether bfq_group is still online ext4: fix use-after-free in ext4_rename_dir_prepare ext4: fix warning in ext4_handle_inode_extension ext4: fix bug_on in ext4_writepages ext4: filter out EXT4_FC_REPLAY from on-disk superblock field s_state ext4: fix bug_on in __es_tree_search ext4: verify dir block before splitting it ext4: avoid cycles in directory h-tree ACPI: property: Release subnode properties with data nodes tracing: Fix potential double free in create_var_ref() PCI/PM: Fix bridge_d3_blacklist[] Elo i2 overwrite of Gigabyte X299 PCI: qcom: Fix runtime PM imbalance on probe errors PCI: qcom: Fix unbalanced PHY init on probe errors mm, compaction: fast_find_migrateblock() should return pfn in the target zone s390/perf: obtain sie_block from the right address dlm: fix plock invalid read dlm: fix missing lkb refcount handling ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock scsi: dc395x: Fix a missing check on list iterator scsi: ufs: qcom: Add a readl() to make sure ref_clk gets enabled drm/amdgpu/cs: make commands with 0 chunks illegal behaviour. drm/etnaviv: check for reaped mapping in etnaviv_iommu_unmap_gem drm/nouveau/clk: Fix an incorrect NULL check on list iterator drm/nouveau/kms/nv50-: atom: fix an incorrect NULL check on list iterator drm/bridge: analogix_dp: Grab runtime PM reference for DP-AUX drm/i915/dsi: fix VBT send packet port selection for ICL+ md: fix an incorrect NULL check in does_sb_need_changing md: fix an incorrect NULL check in md_reload_sb mtd: cfi_cmdset_0002: Move and rename chip_check/chip_ready/chip_good_for_write mtd: cfi_cmdset_0002: Use chip_ready() for write on S29GL064N media: coda: Fix reported H264 profile media: coda: Add more H264 levels for CODA960 ima: remove the IMA_TEMPLATE Kconfig option Kconfig: Add option for asm goto w/ tied outputs to workaround clang-13 bug RDMA/hfi1: Fix potential integer multiplication overflow errors csky: patch_text: Fixup last cpu should be master irqchip/armada-370-xp: Do not touch Performance Counter Overflow on A375, A38x, A39x irqchip: irq-xtensa-mx: fix initial IRQ affinity cfg80211: declare MODULE_FIRMWARE for regulatory.db mac80211: upgrade passive scan to active scan on DFS channels after beacon rx um: chan_user: Fix winch_tramp() return value um: Fix out-of-bounds read in LDT setup kexec_file: drop weak attribute from arch_kexec_apply_relocations[_add] ftrace: Clean up hash direct_functions on register failures iommu/msm: Fix an incorrect NULL check on list iterator nodemask.h: fix compilation error with GCC12 hugetlb: fix huge_pmd_unshare address update xtensa/simdisk: fix proc_read_simdisk() rtl818x: Prevent using not initialized queues ASoC: rt5514: Fix event generation for "DSP Voice Wake Up" control carl9170: tx: fix an incorrect use of list iterator stm: ltdc: fix two incorrect NULL checks on list iterator bcache: improve multithreaded bch_btree_check() bcache: improve multithreaded bch_sectors_dirty_init() bcache: remove incremental dirty sector counting for bch_sectors_dirty_init() bcache: avoid journal no-space deadlock by reserving 1 journal bucket serial: pch: don't overwrite xmit->buf[0] by x_char tilcdc: tilcdc_external: fix an incorrect NULL check on list iterator gma500: fix an incorrect NULL check on list iterator arm64: dts: qcom: ipq8074: fix the sleep clock frequency phy: qcom-qmp: fix struct clk leak on probe errors ARM: dts: s5pv210: Remove spi-cs-high on panel in Aries ARM: pxa: maybe fix gpio lookup tables SMB3: EBADF/EIO errors in rename/open caused by race condition in smb2_compound_op docs/conf.py: Cope with removal of language=None in Sphinx 5.0.0 dt-bindings: gpio: altera: correct interrupt-cells vdpasim: allow to enable a vq repeatedly blk-iolatency: Fix inflight count imbalances and IO hangs on offline coresight: core: Fix coresight device probe failure issue phy: qcom-qmp: fix reset-controller leak on probe errors net: ipa: fix page free in ipa_endpoint_trans_release() net: ipa: fix page free in ipa_endpoint_replenish_one() xfs: set inode size after creating symlink xfs: sync lazy sb accounting on quiesce of read-only mounts xfs: fix chown leaking delalloc quota blocks when fssetxattr fails xfs: fix incorrect root dquot corruption error when switching group/project quota types xfs: restore shutdown check in mapped write fault path xfs: force log and push AIL to clear pinned inodes when aborting mount xfs: consider shutdown in bmapbt cursor delete assert xfs: assert in xfs_btree_del_cursor should take into account error kseltest/cgroup: Make test_stress.sh work if run interactively thermal/core: fix a UAF bug in __thermal_cooling_device_register() thermal/core: Fix memory leak in the error path bfq: Avoid merging queues with different parents bfq: Drop pointless unlock-lock pair bfq: Remove pointless bfq_init_rq() calls bfq: Get rid of __bio_blkcg() usage bfq: Make sure bfqg for which we are queueing requests is online block: fix bio_clone_blkg_association() to associate with proper blkcg_gq Revert "random: use static branch for crng_ready()" RDMA/rxe: Generate a completion for unsupported/invalid opcode MIPS: IP27: Remove incorrect `cpu_has_fpu' override MIPS: IP30: Remove incorrect `cpu_has_fpu' override ext4: only allow test_dummy_encryption when supported md: bcache: check the return value of kzalloc() in detached_dev_do_request() Linux 5.10.121 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I52dd11dc43acfa0ebddd2b6e277c823b96b07327	2022-07-23 16:10:22 +02:00
Paul Moore	6950ee32c1	lsm,selinux: pass flowi_common instead of flowi to the LSM hooks ... [ Upstream commit 3df98d7921 ] As pointed out by Herbert in a recent related patch, the LSM hooks do not have the necessary address family information to use the flowi struct safely. As none of the LSMs currently use any of the protocol specific flowi information, replace the flowi pointers with pointers to the address family independent flowi_common struct. Reported-by: Herbert Xu <herbert@gondor.apana.org.au> Acked-by: James Morris <jamorris@linux.microsoft.com> Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-06-09 10:21:09 +02:00
Greg Kroah-Hartman	95f4203fc9	Merge 5.10.110 into android12-5.10-lts ... Changes in 5.10.110 swiotlb: fix info leak with DMA_FROM_DEVICE USB: serial: pl2303: add IBM device IDs USB: serial: simple: add Nokia phone driver hv: utils: add PTP_1588_CLOCK to Kconfig to fix build netdevice: add the case if dev is NULL HID: logitech-dj: add new lightspeed receiver id xfrm: fix tunnel model fragmentation behavior ARM: mstar: Select HAVE_ARM_ARCH_TIMER virtio_console: break out of buf poll on remove vdpa/mlx5: should verify CTRL_VQ feature exists for MQ tools/virtio: fix virtio_test execution ethernet: sun: Free the coherent when failing in probing gpio: Revert regression in sysfs-gpio (gpiolib.c) spi: Fix invalid sgs value net:mcf8390: Use platform_get_irq() to get the interrupt Revert "gpio: Revert regression in sysfs-gpio (gpiolib.c)" spi: Fix erroneous sgs value with min_t() Input: zinitix - do not report shadow fingers af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register net: dsa: microchip: add spi_device_id tables locking/lockdep: Avoid potential access of invalid memory in lock_class iommu/iova: Improve 32-bit free space estimate tpm: fix reference counting for struct tpm_chip virtio-blk: Use blk_validate_block_size() to validate block size USB: usb-storage: Fix use of bitfields for hardware data in ene_ub6250.c xhci: fix garbage USBSTS being logged in some cases xhci: fix runtime PM imbalance in USB2 resume xhci: make xhci_handshake timeout for xhci_reset() adjustable xhci: fix uninitialized string returned by xhci_decode_ctrl_ctx() mei: me: add Alder Lake N device id. mei: avoid iterator usage outside of list_for_each_entry coresight: Fix TRCCONFIGR.QE sysfs interface iio: afe: rescale: use s64 for temporary scale calculations iio: inkern: apply consumer scale on IIO_VAL_INT cases iio: inkern: apply consumer scale when no channel scale is available iio: inkern: make a best effort on offset calculation greybus: svc: fix an error handling bug in gb_svc_hello() clk: uniphier: Fix fixed-rate initialization ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE KEYS: fix length validation in keyctl_pkey_params_get_2() Documentation: add link to stable release candidate tree Documentation: update stable tree link firmware: stratix10-svc: add missing callback parameter on RSU HID: intel-ish-hid: Use dma_alloc_coherent for firmware update SUNRPC: avoid race between mod_timer() and del_timer_sync() NFSD: prevent underflow in nfssvc_decode_writeargs() NFSD: prevent integer overflow on 32 bit systems f2fs: fix to unlock page correctly in error path of is_alive() f2fs: quota: fix loop condition at f2fs_quota_sync() f2fs: fix to do sanity check on .cp_pack_total_block_count remoteproc: Fix count check in rproc_coredump_write() pinctrl: samsung: drop pin banks references on error paths spi: mxic: Fix the transmit path mtd: rawnand: protect access to rawnand devices while in suspend can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path jffs2: fix use-after-free in jffs2_clear_xattr_subsystem jffs2: fix memory leak in jffs2_do_mount_fs jffs2: fix memory leak in jffs2_scan_medium mm/pages_alloc.c: don't create ZONE_MOVABLE beyond the end of a node mm: invalidate hwpoison page cache page in fault path mempolicy: mbind_range() set_policy() after vma_merge() scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands qed: display VF trust config qed: validate and restrict untrusted VFs vlan promisc mode riscv: Fix fill_callchain return value riscv: Increase stack size under KASAN Revert "Input: clear BTN_RIGHT/MIDDLE on buttonpads" cifs: prevent bad output lengths in smb2_ioctl_query_info() cifs: fix NULL ptr dereference in smb2_ioctl_query_info() ALSA: cs4236: fix an incorrect NULL check on list iterator ALSA: hda: Avoid unsol event during RPM suspending ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock ALSA: hda/realtek: Fix audio regression on Mi Notebook Pro 2020 mm: madvise: skip unmapped vma holes passed to process_madvise mm: madvise: return correct bytes advised with process_madvise Revert "mm: madvise: skip unmapped vma holes passed to process_madvise" mm,hwpoison: unmap poisoned page before invalidation mm/kmemleak: reset tag when compare object pointer dm integrity: set journal entry unused when shrinking device drbd: fix potential silent data corruption can: isotp: sanitize CAN ID checks in isotp_bind() powerpc/kvm: Fix kvm_use_magic_page udp: call udp_encap_enable for v6 sockets when enabling encap arm64: signal: nofpsimd: Do not allocate fp/simd context when not available arm64: dts: ti: k3-am65: Fix gic-v3 compatible regs arm64: dts: ti: k3-j721e: Fix gic-v3 compatible regs arm64: dts: ti: k3-j7200: Fix gic-v3 compatible regs ACPI: properties: Consistently return -ENOENT if there are no more references coredump: Also dump first pages of non-executable ELF libraries ext4: fix ext4_fc_stats trace point ext4: fix fs corruption when tring to remove a non-empty directory with IO error drivers: hamradio: 6pack: fix UAF bug caused by mod_timer() mailbox: tegra-hsp: Flush whole channel block: limit request dispatch loop duration block: don't merge across cgroup boundaries if blkcg is enabled drm/edid: check basic audio support on CEA extension block video: fbdev: sm712fb: Fix crash in smtcfb_read() video: fbdev: atari: Atari 2 bpp (STe) palette bugfix ARM: dts: at91: sama5d2: Fix PMERRLOC resource size ARM: dts: exynos: fix UART3 pins configuration in Exynos5250 ARM: dts: exynos: add missing HDMI supplies on SMDK5250 ARM: dts: exynos: add missing HDMI supplies on SMDK5420 mgag200 fix memmapsl configuration in GCTL6 register carl9170: fix missing bit-wise or operator for tx_params pstore: Don't use semaphores in always-atomic-context code thermal: int340x: Increase bitmap size lib/raid6/test: fix multiple definition linking error exec: Force single empty string when argv is empty crypto: rsa-pkcs1pad - only allow with rsa crypto: rsa-pkcs1pad - correctly get hash from source scatterlist crypto: rsa-pkcs1pad - restore signature length check crypto: rsa-pkcs1pad - fix buffer overread in pkcs1pad_verify_complete() bcache: fixup multiple threads crash DEC: Limit PMAX memory probing to R3k systems media: gpio-ir-tx: fix transmit with long spaces on Orange Pi PC media: davinci: vpif: fix unbalanced runtime PM get media: davinci: vpif: fix unbalanced runtime PM enable xtensa: fix stop_machine_cpuslocked call in patch_text xtensa: fix xtensa_wsr always writing 0 brcmfmac: firmware: Allocate space for default boardrev in nvram brcmfmac: pcie: Release firmwares in the brcmf_pcie_setup error path brcmfmac: pcie: Replace brcmf_pcie_copy_mem_todev with memcpy_toio brcmfmac: pcie: Fix crashes due to early IRQs drm/i915/opregion: check port number bounds for SWSCI display power state drm/i915/gem: add missing boundary check in vm_access PCI: pciehp: Clear cmd_busy bit in polling mode PCI: xgene: Revert "PCI: xgene: Fix IB window setup" regulator: qcom_smd: fix for_each_child.cocci warnings selinux: check return value of sel_make_avc_files hwrng: cavium - Check health status while reading random data hwrng: cavium - HW_RANDOM_CAVIUM should depend on ARCH_THUNDER crypto: sun8i-ss - really disable hash on A80 crypto: authenc - Fix sleep in atomic context in decrypt_tail crypto: mxs-dcp - Fix scatterlist processing thermal: int340x: Check for NULL after calling kmemdup() spi: tegra114: Add missing IRQ check in tegra_spi_probe arm64/mm: avoid fixmap race condition when create pud mapping selftests/x86: Add validity check and allow field splitting crypto: rockchip - ECB does not need IV audit: log AUDIT_TIME_* records only from rules EVM: fix the evm= __setup handler return value crypto: ccree - don't attempt 0 len DMA mappings spi: pxa2xx-pci: Balance reference count for PCI DMA device hwmon: (pmbus) Add mutex to regulator ops hwmon: (sch56xx-common) Replace WDOG_ACTIVE with WDOG_HW_RUNNING nvme: cleanup __nvme_check_ids block: don't delete queue kobject before its children PM: hibernate: fix __setup handler error handling PM: suspend: fix return value of __setup handler spi: spi-zynqmp-gqspi: Handle error for dma_set_mask hwrng: atmel - disable trng on failure path crypto: sun8i-ss - call finalize with bh disabled crypto: sun8i-ce - call finalize with bh disabled crypto: amlogic - call finalize with bh disabled crypto: vmx - add missing dependencies clocksource/drivers/timer-ti-dm: Fix regression from errata i940 fix clocksource/drivers/exynos_mct: Refactor resources allocation clocksource/drivers/exynos_mct: Handle DTS with higher number of interrupts clocksource/drivers/timer-microchip-pit64b: Use notrace clocksource/drivers/timer-of: Check return value of of_iomap in timer_of_base_init() ACPI: APEI: fix return value of __setup handlers crypto: ccp - ccp_dmaengine_unregister release dma channels crypto: ccree - Fix use after free in cc_cipher_exit() vfio: platform: simplify device removal amba: Make the remove callback return void hwrng: nomadik - Change clk_disable to clk_disable_unprepare hwmon: (pmbus) Add Vin unit off handling clocksource: acpi_pm: fix return value of __setup handler io_uring: terminate manual loop iterator loop correctly for non-vecs watch_queue: Fix NULL dereference in error cleanup watch_queue: Actually free the watch f2fs: fix to enable ATGC correctly via gc_idle sysfs interface sched/debug: Remove mpol_get/put and task_lock/unlock from sched_show_numa sched/core: Export pelt_thermal_tp rseq: Optimise rseq_get_rseq_cs() and clear_rseq_cs() rseq: Remove broken uapi field layout on 32-bit little endian perf/core: Fix address filter parser for multiple filters perf/x86/intel/pt: Fix address filter config for 32-bit kernel f2fs: fix missing free nid in f2fs_handle_failed_inode nfsd: more robust allocation failure handling in nfsd_file_cache_init f2fs: fix to avoid potential deadlock btrfs: fix unexpected error path when reflinking an inline extent f2fs: compress: remove unneeded read when rewrite whole cluster f2fs: fix compressed file start atomic write may cause data corruption selftests, x86: fix how check_cc.sh is being invoked kunit: make kunit_test_timeout compatible with comment media: staging: media: zoran: fix usage of vb2_dma_contig_set_max_seg_size media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across ioctls media: mtk-vcodec: potential dereference of null pointer media: bttv: fix WARNING regression on tunerless devices ASoC: xilinx: xlnx_formatter_pcm: Handle sysclk setting ASoC: generic: simple-card-utils: remove useless assignment media: coda: Fix missing put_device() call in coda_get_vdoa_data media: meson: vdec: potential dereference of null pointer media: hantro: Fix overfill bottom register field name media: aspeed: Correct value for h-total-pixels video: fbdev: matroxfb: set maxvram of vbG200eW to the same as vbG200 to avoid black screen video: fbdev: controlfb: Fix set but not used warnings video: fbdev: controlfb: Fix COMPILE_TEST build video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe() video: fbdev: atmel_lcdfb: fix an error code in atmel_lcdfb_probe() video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name() firmware: qcom: scm: Remove reassignment to desc following initializer ARM: dts: qcom: ipq4019: fix sleep clock soc: qcom: rpmpd: Check for null return of devm_kcalloc soc: qcom: ocmem: Fix missing put_device() call in of_get_ocmem soc: qcom: aoss: remove spurious IRQF_ONESHOT flags arm64: dts: qcom: sdm845: fix microphone bias properties and values arm64: dts: qcom: sm8150: Correct TCS configuration for apps rsc firmware: ti_sci: Fix compilation failure when CONFIG_TI_SCI_PROTOCOL is not defined soc: ti: wkup_m3_ipc: Fix IRQ check in wkup_m3_ipc_probe ARM: dts: sun8i: v3s: Move the csi1 block to follow address order ARM: dts: imx: Add missing LVDS decoder on M53Menlo media: video/hdmi: handle short reads of hdmi info frame. media: em28xx: initialize refcount before kref_get media: usb: go7007: s2250-board: fix leak in probe() media: cedrus: H265: Fix neighbour info buffer size media: cedrus: h264: Fix neighbour info buffer size ASoC: codecs: wcd934x: fix return value of wcd934x_rx_hph_mode_put uaccess: fix nios2 and microblaze get_user_8() ASoC: rt5663: check the return value of devm_kzalloc() in rt5663_parse_dp() ASoC: ti: davinci-i2s: Add check for clk_enable() ALSA: spi: Add check for clk_enable() arm64: dts: ns2: Fix spi-cpol and spi-cpha property arm64: dts: broadcom: Fix sata nodename printk: fix return value of printk.devkmsg __setup handler ASoC: mxs-saif: Handle errors for clk_enable ASoC: atmel_ssc_dai: Handle errors for clk_enable ASoC: dwc-i2s: Handle errors for clk_enable ASoC: soc-compress: prevent the potentially use of null pointer memory: emif: Add check for setup_interrupts memory: emif: check the pointer temp in get_device_details() ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction arm64: dts: rockchip: Fix SDIO regulator supply properties on rk3399-firefly m68k: coldfire/device.c: only build for MCF_EDMA when h/w macros are defined media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED media: vidtv: Check for null return of vzalloc ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe ASoC: wm8350: Handle error for wm8350_register_irq ASoC: fsi: Add check for clk_enable video: fbdev: omapfb: Add missing of_node_put() in dvic_probe_of media: saa7134: convert list_for_each to entry variant media: saa7134: fix incorrect use to determine if list is empty ivtv: fix incorrect device_caps for ivtvfb ASoC: rockchip: i2s: Use devm_platform_get_and_ioremap_resource() ASoC: rockchip: i2s: Fix missing clk_disable_unprepare() in rockchip_i2s_probe ASoC: SOF: Add missing of_node_put() in imx8m_probe ASoC: dmaengine: do not use a NULL prepare_slave_config() callback ASoC: mxs: Fix error handling in mxs_sgtl5000_probe ASoC: fsl_spdif: Disable TX clock when stop ASoC: imx-es8328: Fix error return code in imx_es8328_probe() ASoC: msm8916-wcd-digital: Fix missing clk_disable_unprepare() in msm8916_wcd_digital_probe mmc: davinci_mmc: Handle error for clk_enable ASoC: atmel: sam9x5_wm8731: use devm_snd_soc_register_card() ASoC: atmel: Fix error handling in sam9x5_wm8731_driver_probe ASoC: msm8916-wcd-analog: Fix error handling in pm8916_wcd_analog_spmi_probe ASoC: codecs: wcd934x: Add missing of_node_put() in wcd934x_codec_parse_data ARM: configs: multi_v5_defconfig: re-enable CONFIG_V4L_PLATFORM_DRIVERS drm/meson: osd_afbcd: Add an exit callback to struct meson_afbcd_ops drm/bridge: Fix free wrong object in sii8620_init_rcp_input_dev drm/bridge: Add missing pm_runtime_disable() in __dw_mipi_dsi_probe drm/bridge: nwl-dsi: Fix PM disable depth imbalance in nwl_dsi_probe drm: bridge: adv7511: Fix ADV7535 HPD enablement ath10k: fix memory overwrite of the WoWLAN wakeup packet pattern drm/panfrost: Check for error num after setting mask libbpf: Fix possible NULL pointer dereference when destroying skeleton udmabuf: validate ubuf->pagecount Bluetooth: hci_serdev: call init_rwsem() before p->open() mtd: onenand: Check for error irq mtd: rawnand: gpmi: fix controller timings setting drm/edid: Don't clear formats if using deep color ionic: fix type complaint in ionic_dev_cmd_clean() drm/nouveau/acr: Fix undefined behavior in nvkm_acr_hsfw_load_bl() drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes() drm/amd/pm: return -ENOTSUPP if there is no get_dpm_ultimate_freq function ath9k_htc: fix uninit value bugs RDMA/core: Set MR type in ib_reg_user_mr KVM: PPC: Fix vmx/vsx mixup in mmio emulation i40e: don't reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb i40e: respect metadata on XSK Rx to skb power: reset: gemini-poweroff: Fix IRQ check in gemini_poweroff_probe ray_cs: Check ioremap return value powerpc: dts: t1040rdb: fix ports names for Seville Ethernet switch KVM: PPC: Book3S HV: Check return value of kvmppc_radix_init powerpc/perf: Don't use perf_hw_context for trace IMC PMU mt76: mt7915: use proper aid value in mt7915_mcu_wtbl_generic_tlv in sta mode mt76: mt7915: use proper aid value in mt7915_mcu_sta_basic_tlv mt76: mt7603: check sta_rates pointer in mt7603_sta_rate_tbl_update mt76: mt7615: check sta_rates pointer in mt7615_sta_rate_tbl_update net: dsa: mv88e6xxx: Enable port policy support on 6097 scripts/dtc: Call pkg-config POSIXly correct livepatch: Fix build failure on 32 bits processors PCI: aardvark: Fix reading PCI_EXP_RTSTA_PME bit on emulated bridge drm/bridge: dw-hdmi: use safe format when first in bridge chain power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports iommu/ipmmu-vmsa: Check for error num after setting mask drm/amd/pm: enable pm sysfs write for one VF mode drm/amd/display: Add affected crtcs to atomic state for dsc mst unplug IB/cma: Allow XRC INI QPs to set their local ACK timeout dax: make sure inodes are flushed before destroy cache iwlwifi: Fix -EIO error code that is never returned iwlwifi: mvm: Fix an error code in iwl_mvm_up() drm/msm/dp: populate connector of struct dp_panel drm/msm/dpu: add DSPP blocks teardown drm/msm/dpu: fix dp audio condition dm crypt: fix get_key_size compiler warning if !CONFIG_KEYS scsi: pm8001: Fix command initialization in pm80XX_send_read_log() scsi: pm8001: Fix command initialization in pm8001_chip_ssp_tm_req() scsi: pm8001: Fix payload initialization in pm80xx_set_thermal_config() scsi: pm8001: Fix le32 values handling in pm80xx_set_sas_protocol_timer_config() scsi: pm8001: Fix payload initialization in pm80xx_encrypt_update() scsi: pm8001: Fix le32 values handling in pm80xx_chip_ssp_io_req() scsi: pm8001: Fix le32 values handling in pm80xx_chip_sata_req() scsi: pm8001: Fix NCQ NON DATA command task initialization scsi: pm8001: Fix NCQ NON DATA command completion handling scsi: pm8001: Fix abort all task initialization RDMA/mlx5: Fix the flow of a miss in the allocation of a cache ODP MR drm/amd/display: Remove vupdate_int_entry definition TOMOYO: fix __setup handlers return values ext2: correct max file size computing drm/tegra: Fix reference leak in tegra_dsi_ganged_probe power: supply: bq24190_charger: Fix bq24190_vbus_is_enabled() wrong false return scsi: hisi_sas: Change permission of parameter prot_mask drm/bridge: cdns-dsi: Make sure to to create proper aliases for dt bpf, arm64: Call build_prologue() first in first JIT pass bpf, arm64: Feed byte-offset into bpf line info gpu: host1x: Fix a memory leak in 'host1x_remove()' libbpf: Skip forward declaration when counting duplicated type names powerpc/mm/numa: skip NUMA_NO_NODE onlining in parse_numa_properties() powerpc/Makefile: Don't pass -mcpu=powerpc64 when building 32-bit KVM: x86: Fix emulation in writing cr8 KVM: x86/emulator: Defer not-present segment check in __load_segment_descriptor() hv_balloon: rate-limit "Unhandled message" warning i2c: xiic: Make bus names unique power: supply: wm8350-power: Handle error for wm8350_register_irq power: supply: wm8350-power: Add missing free in free_charger_irq IB/hfi1: Allow larger MTU without AIP PCI: Reduce warnings on possible RW1C corruption net: axienet: fix RX ring refill allocation failure handling mips: DEC: honor CONFIG_MIPS_FP_SUPPORT=n powerpc/sysdev: fix incorrect use to determine if list is empty mfd: mc13xxx: Add check for mc13xxx_irq_request libbpf: Unmap rings when umem deleted selftests/bpf: Make test_lwt_ip_encap more stable and faster platform/x86: huawei-wmi: check the return value of device_create_file() powerpc: 8xx: fix a return value error in mpc8xx_pic_init vxcan: enable local echo for sent CAN frames ath10k: Fix error handling in ath10k_setup_msa_resources mips: cdmm: Fix refcount leak in mips_cdmm_phys_base MIPS: RB532: fix return value of __setup handler MIPS: pgalloc: fix memory leak caused by pgd_free() mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init RDMA/mlx5: Fix memory leak in error flow for subscribe event routine bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full bpf, sockmap: Fix more uncharged while msg has more_data bpf, sockmap: Fix double uncharge the mem of sk_msg samples/bpf, xdpsock: Fix race when running for fix duration of time USB: storage: ums-realtek: fix error code in rts51x_read_mem() can: isotp: return -EADDRNOTAVAIL when reading from unbound socket can: isotp: support MSG_TRUNC flag when reading from socket bareudp: use ipv6_mod_enabled to check if IPv6 enabled selftests/bpf: Fix error reporting from sock_fields programs Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt ipv4: Fix route lookups when handling ICMP redirects and PMTU updates af_netlink: Fix shift out of bounds in group mask calculation i2c: meson: Fix wrong speed use from probe i2c: mux: demux-pinctrl: do not deactivate a master that is not active selftests/bpf/test_lirc_mode2.sh: Exit with proper code PCI: Avoid broken MSI on SB600 USB devices net: bcmgenet: Use stronger register read/writes to assure ordering tcp: ensure PMTU updates are processed during fastopen openvswitch: always update flow key after nat tipc: fix the timer expires after interval 100ms mfd: asic3: Add missing iounmap() on error asic3_mfd_probe mxser: fix xmit_buf leak in activate when LSR == 0xff pwm: lpc18xx-sct: Initialize driver data and hardware before pwmchip_add() fsi: aspeed: convert to devm_platform_ioremap_resource fsi: Aspeed: Fix a potential double free misc: alcor_pci: Fix an error handling path cpufreq: qcom-cpufreq-nvmem: fix reading of PVS Valid fuse soundwire: intel: fix wrong register name in intel_shim_wake clk: qcom: ipq8074: fix PCI-E clock oops iio: mma8452: Fix probe failing when an i2c_device_id is used staging:iio:adc:ad7280a: Fix handing of device address bit reversing. pinctrl: renesas: r8a77470: Reduce size for narrow VIN1 channel pinctrl: renesas: checker: Fix miscalculation of number of states clk: qcom: ipq8074: Use floor ops for SDCC1 clock phy: dphy: Correct lpx parameter and its derivatives(ta_{get,go,sure}) serial: 8250_mid: Balance reference count for PCI DMA device serial: 8250_lpss: Balance reference count for PCI DMA device NFS: Use of mapping_set_error() results in spurious errors serial: 8250: Fix race condition in RTS-after-send handling iio: adc: Add check for devm_request_threaded_irq habanalabs: Add check for pci_enable_device NFS: Return valid errors from nfs2/3_decode_dirent() dma-debug: fix return value of __setup handlers clk: imx7d: Remove audio_mclk_root_clk clk: at91: sama7g5: fix parents of PDMCs' GCLK clk: qcom: clk-rcg2: Update logic to calculate D value for RCG clk: qcom: clk-rcg2: Update the frac table for pixel clock dmaengine: hisi_dma: fix MSI allocate fail when reload hisi_dma remoteproc: qcom: Fix missing of_node_put in adsp_alloc_memory_region remoteproc: qcom_wcnss: Add missing of_node_put() in wcnss_alloc_memory_region remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region nvdimm/region: Fix default alignment for small regions clk: actions: Terminate clk_div_table with sentinel element clk: loongson1: Terminate clk_div_table with sentinel element clk: clps711x: Terminate clk_div_table with sentinel element clk: tegra: tegra124-emc: Fix missing put_device() call in emc_ensure_emc_driver NFS: remove unneeded check in decode_devicenotify_args() staging: mt7621-dts: fix LEDs and pinctrl on GB-PC1 devicetree staging: mt7621-dts: fix formatting staging: mt7621-dts: fix pinctrl properties for ethernet staging: mt7621-dts: fix GB-PC2 devicetree pinctrl: mediatek: Fix missing of_node_put() in mtk_pctrl_init pinctrl: mediatek: paris: Fix PIN_CONFIG_BIAS_* readback pinctrl: mediatek: paris: Fix "argument" argument type for mtk_pinconf_get() pinctrl: mediatek: paris: Fix pingroup pin config state readback pinctrl: mediatek: paris: Skip custom extra pin config dump for virtual GPIOs pinctrl: nomadik: Add missing of_node_put() in nmk_pinctrl_probe pinctrl/rockchip: Add missing of_node_put() in rockchip_pinctrl_probe tty: hvc: fix return value of __setup handler kgdboc: fix return value of __setup handler serial: 8250: fix XOFF/XON sending when DMA is used kgdbts: fix return value of __setup handler firmware: google: Properly state IOMEM dependency driver core: dd: fix return value of __setup handler jfs: fix divide error in dbNextAG netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options NFSv4.1: don't retry BIND_CONN_TO_SESSION on session error kdb: Fix the putarea helper function clk: qcom: gcc-msm8994: Fix gpll4 width clk: Initialize orphan req_rate xen: fix is_xen_pmu() net: enetc: report software timestamping via SO_TIMESTAMPING net: hns3: fix bug when PF set the duplicate MAC address for VFs net: phy: broadcom: Fix brcm_fet_config_init() selftests: test_vxlan_under_vrf: Fix broken test case qlcnic: dcb: default to returning -EOPNOTSUPP net/x25: Fix null-ptr-deref caused by x25_disconnect NFSv4/pNFS: Fix another issue with a list iterator pointing to the head net: dsa: bcm_sf2_cfp: fix an incorrect NULL check on list iterator fs: fd tables have to be multiples of BITS_PER_LONG lib/test: use after free in register_test_dev_kmod() fs: fix fd table size alignment properly LSM: general protection fault in legacy_parse_param regulator: rpi-panel: Handle I2C errors/timing to the Atmel gcc-plugins/stackleak: Exactly match strings instead of prefixes pinctrl: npcm: Fix broken references to chip->parent_device block, bfq: don't move oom_bfqq selinux: use correct type for context length selinux: allow FIOCLEX and FIONCLEX with policy capability loop: use sysfs_emit() in the sysfs xxx show() Fix incorrect type in assignment of ipv6 port for audit irqchip/qcom-pdc: Fix broken locking irqchip/nvic: Release nvic_base upon failure fs/binfmt_elf: Fix AT_PHDR for unusual ELF files bfq: fix use-after-free in bfq_dispatch_request ACPICA: Avoid walking the ACPI Namespace if it is not there lib/raid6/test/Makefile: Use $(pound) instead of \# for Make 4.3 Revert "Revert "block, bfq: honor already-setup queue merges"" ACPI/APEI: Limit printable size of BERT table data PM: core: keep irq flags in device_pm_check_callbacks() parisc: Fix handling off probe non-access faults nvme-tcp: lockdep: annotate in-kernel sockets spi: tegra20: Use of_device_get_match_data() locking/lockdep: Iterate lock_classes directly when reading lockdep files ext4: correct cluster len and clusters changed accounting in ext4_mb_mark_bb ext4: fix ext4_mb_mark_bb() with flex_bg with fast_commit ext4: don't BUG if someone dirty pages without asking ext4 first f2fs: fix to do sanity check on curseg->alloc_type NFSD: Fix nfsd_breaker_owns_lease() return values f2fs: compress: fix to print raw data size in error path of lz4 decompression ntfs: add sanity check on allocation size media: staging: media: zoran: move videodev alloc media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com media: staging: media: zoran: fix various V4L2 compliance errors media: ir_toy: free before error exiting video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow video: fbdev: w100fb: Reset global state video: fbdev: cirrusfb: check pixclock to avoid divide by zero video: fbdev: omapfb: acx565akm: replace snprintf with sysfs_emit ARM: dts: qcom: fix gic_irq_domain_translate warnings for msm8960 ARM: dts: bcm2837: Add the missing L1/L2 cache information ASoC: madera: Add dependencies on MFD media: atomisp_gmin_platform: Add DMI quirk to not turn AXP ELDO2 regulator off on some boards media: atomisp: fix dummy_ptr check to avoid duplicate active_bo ARM: ftrace: avoid redundant loads or clobbering IP ARM: dts: imx7: Use audio_mclk_post_div instead audio_mclk_root_clk arm64: defconfig: build imx-sdma as a module video: fbdev: omapfb: panel-dsi-cm: Use sysfs_emit() instead of snprintf() video: fbdev: omapfb: panel-tpo-td043mtea1: Use sysfs_emit() instead of snprintf() video: fbdev: udlfb: replace snprintf in show functions with sysfs_emit ARM: dts: bcm2711: Add the missing L1/L2 cache information ASoC: soc-core: skip zero num_dai component in searching dai name media: cx88-mpeg: clear interrupt status register before streaming video uaccess: fix type mismatch warnings from access_ok() lib/test_lockup: fix kernel pointer check for separate address spaces ARM: tegra: tamonten: Fix I2C3 pad setting ARM: mmp: Fix failure to remove sram device video: fbdev: sm712fb: Fix crash in smtcfb_write() media: Revert "media: em28xx: add missing em28xx_close_extension" media: hdpvr: initialize dev->worker at hdpvr_register_videodev mmc: host: Return an error when ->enable_sdio_irq() ops is missing media: atomisp: fix bad usage at error handling logic ALSA: hda/realtek: Add alc256-samsung-headphone fixup KVM: x86/mmu: Check for present SPTE when clearing dirty bit in TDP MMU powerpc/kasan: Fix early region not updated correctly powerpc/lib/sstep: Fix 'sthcx' instruction powerpc/lib/sstep: Fix build errors with newer binutils powerpc: Fix build errors with newer binutils scsi: qla2xxx: Fix stuck session in gpdb scsi: qla2xxx: Fix scheduling while atomic scsi: qla2xxx: Fix wrong FDMI data for 64G adapter scsi: qla2xxx: Fix warning for missing error code scsi: qla2xxx: Fix device reconnect in loop topology scsi: qla2xxx: Add devids and conditionals for 28xx scsi: qla2xxx: Check for firmware dump already collected scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair() scsi: qla2xxx: Fix disk failure to rediscover scsi: qla2xxx: Fix incorrect reporting of task management failure scsi: qla2xxx: Fix hang due to session stuck scsi: qla2xxx: Fix missed DMA unmap for NVMe ls requests scsi: qla2xxx: Fix N2N inconsistent PLOGI scsi: qla2xxx: Reduce false trigger to login scsi: qla2xxx: Use correct feature type field during RFF_ID processing platform: chrome: Split trace include file KVM: x86: Forbid VMM to set SYNIC/STIMER MSRs when SynIC wasn't activated KVM: Prevent module exit until all VMs are freed KVM: x86: fix sending PV IPI KVM: SVM: fix panic on out-of-bounds guest IRQ ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM ubifs: rename_whiteout: Fix double free for whiteout_ui->data ubifs: Fix deadlock in concurrent rename whiteout and inode writeback ubifs: Add missing iput if do_tmpfile() failed in rename whiteout ubifs: setflags: Make dirtied_ino_d 8 bytes aligned ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock() ubifs: Fix to add refcount once page is set private ubifs: rename_whiteout: correct old_dir size computing wireguard: queueing: use CFI-safe ptr_ring cleanup function wireguard: socket: free skb in send6 when ipv6 is disabled wireguard: socket: ignore v6 endpoints when ipv6 is disabled XArray: Fix xas_create_range() when multi-order entry present can: mcba_usb: mcba_usb_start_xmit(): fix double dev_kfree_skb in error path can: mcba_usb: properly check endpoint type can: mcp251xfd: mcp251xfd_register_get_dev_id(): fix return of error value XArray: Update the LRU list in xas_split() rtc: check if __rtc_read_time was successful gfs2: Make sure FITRIM minlen is rounded up to fs block size net: hns3: fix software vlan talbe of vlan 0 inconsistent with hardware rxrpc: Fix call timer start racing with call destruction mailbox: imx: fix wakeup failure from freeze mode crypto: arm/aes-neonbs-cbc - Select generic cbc and aes watch_queue: Free the page array when watch_queue is dismantled pinctrl: pinconf-generic: Print arguments for bias-pull-* watchdog: rti-wdt: Add missing pm_runtime_disable() in probe function pinctrl: nuvoton: npcm7xx: Rename DS() macro to DSTR() pinctrl: nuvoton: npcm7xx: Use %zu printk format for ARRAY_SIZE() ASoC: mediatek: mt6358: add missing EXPORT_SYMBOLs ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl ARM: iop32x: offset IRQ numbers by 1 io_uring: fix memory leak of uid in files registration riscv module: remove (NOLOAD) ACPI: CPPC: Avoid out of bounds access when parsing _CPC data platform/chrome: cros_ec_typec: Check for EC device can: isotp: restore accidentally removed MSG_PEEK feature proc: bootconfig: Add null pointer check staging: mt7621-dts: fix pinctrl-0 items to be size-1 items on ethernet ASoC: soc-compress: Change the check for codec_dai batman-adv: Check ptr for NULL before reducing its refcnt mm/mmap: return 1 from stack_guard_gap __setup() handler ARM: 9187/1: JIVE: fix return value of __setup handler mm/memcontrol: return 1 from cgroup.memory __setup() handler mm/usercopy: return 1 from hardened_usercopy __setup() handler bpf: Adjust BPF stack helper functions to accommodate skip > 0 bpf: Fix comment for helper bpf_current_task_under_cgroup() dt-bindings: mtd: nand-controller: Fix the reg property description dt-bindings: mtd: nand-controller: Fix a comment in the examples dt-bindings: spi: mxic: The interrupt property is not mandatory ubi: fastmap: Return error code if memory allocation fails in add_aeb() ASoC: topology: Allow TLV control to be either read or write ARM: dts: spear1340: Update serial node properties ARM: dts: spear13xx: Update SPI dma properties um: Fix uml_mconsole stop/go docs: sysctl/kernel: add missing bit to panic_print openvswitch: Fixed nd target mask field in the flow dump. KVM: x86/mmu: do compare-and-exchange of gPTE via the user address can: m_can: m_can_tx_handler(): fix use after free of skb can: usb_8dev: usb_8dev_start_xmit(): fix double dev_kfree_skb() in error path coredump: Snapshot the vmas in do_coredump coredump: Remove the WARN_ON in dump_vma_snapshot coredump/elf: Pass coredump_params into fill_note_info coredump: Use the vma snapshot in fill_files_note arm64: Do not defer reserve_crashkernel() for platforms with no DMA memory zones PCI: xgene: Revert "PCI: xgene: Use inbound resources for setup" Linux 5.10.110 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I12fbe227793dd40c0582588e1700cf88cafd0ac6	2022-04-18 17:41:18 +02:00
Xin Long	210e7b43d4	udp: call udp_encap_enable for v6 sockets when enabling encap ... commit a4a600dd30 upstream. When enabling encap for a ipv6 socket without udp_encap_needed_key increased, UDP GRO won't work for v4 mapped v6 address packets as sk will be NULL in udp4_gro_receive(). This patch is to enable it by increasing udp_encap_needed_key for v6 sockets in udp_tunnel_encap_enable(), and correspondingly decrease udp_encap_needed_key in udpv6_destroy_sock(). v1->v2: - add udp_encap_disable() and export it. v2->v3: - add the change for rxrpc and bareudp into one patch, as Alex suggested. v3->v4: - move rxrpc part to another patch. Acked-by: Willem de Bruijn <willemb@google.com> Signed-off-by: Xin Long <lucien.xin@gmail.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org> Tested-by: Antonio Quartulli <antonio@openvpn.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-04-08 14:39:54 +02:00
Greg Kroah-Hartman	d605f2f30d	Merge 5.10.91 into android12-5.10-lts ... Changes in 5.10.91 f2fs: quota: fix potential deadlock selftests: x86: fix [-Wstringop-overread] warn in test_process_vm_readv() tracing: Fix check for trace_percpu_buffer validity in get_trace_buf() tracing: Tag trace_percpu_buffer as a percpu pointer ieee802154: atusb: fix uninit value in atusb_set_extended_addr i40e: Fix to not show opcode msg on unsuccessful VF MAC change iavf: Fix limit of total number of queues to active queues of VF RDMA/core: Don't infoleak GRH fields netrom: fix copying in user data in nr_setsockopt RDMA/uverbs: Check for null return of kmalloc_array mac80211: initialize variable have_higher_than_11mbit sfc: The RX page_ring is optional i40e: fix use-after-free in i40e_sync_filters_subtask() i40e: Fix for displaying message regarding NVM version i40e: Fix incorrect netdev's real number of RX/TX queues ftrace/samples: Add missing prototypes direct functions ipv4: Check attribute length for RTA_GATEWAY in multipath route ipv4: Check attribute length for RTA_FLOW in multipath route ipv6: Check attribute length for RTA_GATEWAY in multipath route ipv6: Check attribute length for RTA_GATEWAY when deleting multipath route lwtunnel: Validate RTA_ENCAP_TYPE attribute length batman-adv: mcast: don't send link-local multicast to mcast routers sch_qfq: prevent shift-out-of-bounds in qfq_init_qdisc net: ena: Fix undefined state when tx request id is out of bounds net: ena: Fix error handling when calculating max IO queues number xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate power: supply: core: Break capacity loop power: reset: ltc2952: Fix use of floating point literals rndis_host: support Hytera digital radios phonet: refcount leak in pep_sock_accep power: bq25890: Enable continuous conversion for ADC at charging ipv6: Continue processing multipath route even if gateway attribute is invalid ipv6: Do cleanup if attribute validation fails in multipath route usb: mtu3: fix interval value for intr and isoc scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown() ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate net: udp: fix alignment problem in udp4_seq_show() atlantic: Fix buff_ring OOB in aq_ring_rx_clean mISDN: change function names to avoid conflicts drm/amd/display: Added power down for DCN10 ipv6: raw: check passed optlen before reading ARM: dts: gpio-ranges property is now required Input: zinitix - make sure the IRQ is allocated before it gets enabled Linux 5.10.91 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Iea6f28f738081085f9c5df020ebdee6583b38dfb	2022-01-11 15:46:18 +01:00
yangxingwu	c2f4bb251e	net: udp: fix alignment problem in udp4_seq_show() ... [ Upstream commit 6c25449e1a ] $ cat /pro/net/udp before: sl local_address rem_address st tx_queue rx_queue tr tm->when 26050: 0100007F:0035 00000000:0000 07 00000000:00000000 00:00000000 26320: 0100007F:0143 00000000:0000 07 00000000:00000000 00:00000000 27135: 00000000:8472 00000000:0000 07 00000000:00000000 00:00000000 after: sl local_address rem_address st tx_queue rx_queue tr tm->when 26050: 0100007F:0035 00000000:0000 07 00000000:00000000 00:00000000 26320: 0100007F:0143 00000000:0000 07 00000000:00000000 00:00000000 27135: 00000000:8472 00000000:0000 07 00000000:00000000 00:00000000 Signed-off-by: yangxingwu <xingwu.yang@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-01-11 15:25:02 +01:00
Greg Kroah-Hartman	afc997898e	Merge 5.10.85 into android12-5.10-lts ... Changes in 5.10.85 usb: gadget: uvc: fix multiple opens gcc-plugins: simplify GCC plugin-dev capability test gcc-plugins: fix gcc 11 indigestion with plugins... HID: quirks: Add quirk for the Microsoft Surface 3 type-cover HID: google: add eel USB id HID: add hid_is_usb() function to make it simpler for USB detection HID: add USB_HID dependancy to hid-prodikeys HID: add USB_HID dependancy to hid-chicony HID: add USB_HID dependancy on some USB HID drivers HID: bigbenff: prevent null pointer dereference HID: wacom: fix problems when device is not a valid USB device HID: check for valid USB device for many HID drivers nft_set_pipapo: Fix bucket load in AVX2 lookup routine for six 8-bit groups IB/hfi1: Insure use of smp_processor_id() is preempt disabled IB/hfi1: Fix early init panic IB/hfi1: Fix leak of rcvhdrtail_dummy_kvaddr can: kvaser_usb: get CAN clock frequency from device can: kvaser_pciefd: kvaser_pciefd_rx_error_frame(): increase correct stats->{rx,tx}_errors counter can: sja1000: fix use after free in ems_pcmcia_add_card() x86/sme: Explicitly map new EFI memmap table as encrypted drm/amd/amdkfd: adjust dummy functions' placement drm/amdkfd: separate kfd_iommu_resume from kfd_resume drm/amdgpu: add amdgpu_amdkfd_resume_iommu drm/amdgpu: move iommu_resume before ip init/resume drm/amdgpu: init iommu after amdkfd device init drm/amdkfd: fix boot failure when iommu is disabled in Picasso. nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done selftests: netfilter: add a vrf+conntrack testcase vrf: don't run conntrack on vrf with !dflt qdisc bpf, x86: Fix "no previous prototype" warning bpf: Fix the off-by-two error in range markings ice: ignore dropped packets during init bonding: make tx_rebalance_counter an atomic nfp: Fix memory leak in nfp_cpp_area_cache_add() seg6: fix the iif in the IPv6 socket control block udp: using datalen to cap max gso segments netfilter: conntrack: annotate data-races around ct->timeout iavf: restore MSI state on reset iavf: Fix reporting when setting descriptor count IB/hfi1: Correct guard on eager buffer deallocation devlink: fix netns refcount leak in devlink_nl_cmd_reload() net/sched: fq_pie: prevent dismantle issue KVM: x86: Wait for IPIs to be delivered when handling Hyper-V TLB flush hypercall mm: bdi: initialize bdi_min_ratio when bdi is unregistered ALSA: ctl: Fix copy of updated id with element read/write ALSA: hda/realtek - Add headset Mic support for Lenovo ALC897 platform ALSA: hda/realtek: Fix quirk for TongFang PHxTxX1 ALSA: pcm: oss: Fix negative period/buffer sizes ALSA: pcm: oss: Limit the period size to 16MB ALSA: pcm: oss: Handle missing errors in snd_pcm_oss_change_params*() scsi: qla2xxx: Format log strings only if needed btrfs: clear extent buffer uptodate when we fail to write it btrfs: replace the BUG_ON in btrfs_del_root_ref with proper error handling md: fix update super 1.0 on rdev size change nfsd: fix use-after-free due to delegation race nfsd: Fix nsfd startup race (again) tracefs: Have new files inherit the ownership of their parent mmc: renesas_sdhi: initialize variable properly when tuning clk: qcom: regmap-mux: fix parent clock lookup drm/syncobj: Deal with signalled fences in drm_syncobj_find_fence. can: pch_can: pch_can_rx_normal: fix use after free can: m_can: Disable and ignore ELO interrupt libata: add horkage for ASMedia 1092 wait: add wake_up_pollfree() binder: use wake_up_pollfree() signalfd: use wake_up_pollfree() aio: keep poll requests on waitqueue until completed aio: fix use-after-free due to missing POLLFREE handling net: mvpp2: fix XDP rx queues registering tracefs: Set all files to the same group ownership as the mount option block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2) scsi: pm80xx: Do not call scsi_remove_host() in pm8001_alloc() scsi: scsi_debug: Fix buffer size of REPORT ZONES command qede: validate non LSO skb length PM: runtime: Fix pm_runtime_active() kerneldoc comment ASoC: rt5682: Fix crash due to out of scope stack vars ASoC: qdsp6: q6routing: Fix return value from msm_routing_put_audio_mixer ASoC: codecs: wsa881x: fix return values from kcontrol put ASoC: codecs: wcd934x: handle channel mappping list correctly ASoC: codecs: wcd934x: return correct value from mixer put RDMA/hns: Do not halt commands during reset until later RDMA/hns: Do not destroy QP resources in the hw resetting phase clk: imx: use module_platform_driver i40e: Fix failed opcode appearing if handling messages from VF i40e: Fix pre-set max number of queues for VF mtd: rawnand: fsmc: Take instruction delay into account mtd: rawnand: fsmc: Fix timing computation i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc Revert "PCI: aardvark: Fix support for PCI_ROM_ADDRESS1 on emulated bridge" perf tools: Fix SMT detection fast read path Documentation/locking/locktypes: Update migrate_disable() bits. dt-bindings: net: Reintroduce PHY no lane swap binding tools build: Remove needless libpython-version feature check that breaks test-all fast path net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero net: altera: set a couple error code in probe() net: fec: only clear interrupt of handling queue in fec_enet_rx_queue() net, neigh: clear whole pneigh_entry at alloc time net/qla3xxx: fix an error code in ql_adapter_up() selftests/fib_tests: Rework fib_rp_filter_test() USB: gadget: detect too-big endpoint 0 requests USB: gadget: zero allocate endpoint 0 buffers usb: core: config: fix validation of wMaxPacketValue entries xhci: Remove CONFIG_USB_DEFAULT_PERSIST to prevent xHCI from runtime suspending usb: core: config: using bit mask instead of individual bits xhci: avoid race between disable slot command and host runtime suspend iio: gyro: adxrs290: fix data signedness iio: trigger: Fix reference counting iio: trigger: stm32-timer: fix MODULE_ALIAS iio: stk3310: Don't return error code in interrupt handler iio: mma8452: Fix trigger reference couting iio: ltr501: Don't return error code in trigger handler iio: kxsd9: Don't return error code in trigger handler iio: itg3200: Call iio_trigger_notify_done() on error iio: dln2-adc: Fix lockdep complaint iio: dln2: Check return value of devm_iio_trigger_register() iio: at91-sama5d2: Fix incorrect sign extension iio: adc: stm32: fix a current leak by resetting pcsel before disabling vdda iio: adc: axp20x_adc: fix charging current reporting on AXP22x iio: ad7768-1: Call iio_trigger_notify_done() on error iio: accel: kxcjk-1013: Fix possible memory leak in probe and remove csky: fix typo of fpu config macro irqchip/aspeed-scu: Replace update_bits with write_bits. irqchip/armada-370-xp: Fix return value of armada_370_xp_msi_alloc() irqchip/armada-370-xp: Fix support for Multi-MSI interrupts irqchip/irq-gic-v3-its.c: Force synchronisation when issuing INVALL irqchip: nvic: Fix offset for Interrupt Priority Offsets misc: fastrpc: fix improper packet size calculation bpf: Add selftests to cover packet access corner cases kbuild: simplify GCC_PLUGINS enablement in dummy-tools/gcc doc: gcc-plugins: update gcc-plugins.rst MAINTAINERS: adjust GCC PLUGINS after gcc-plugin.sh removal Documentation/Kbuild: Remove references to gcc-plugin.sh Linux 5.10.85 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I351da1b00f30a370b021125180a48b1c1ecb97ce	2021-12-14 15:11:46 +01:00
Jianguo Wu	5e39de85b7	udp: using datalen to cap max gso segments ... commit 158390e456 upstream. The max number of UDP gso segments is intended to cap to UDP_MAX_SEGMENTS, this is checked in udp_send_skb(): if (skb->len > cork->gso_size * UDP_MAX_SEGMENTS) { kfree_skb(skb); return -EINVAL; } skb->len contains network and transport header len here, we should use only data len instead. Fixes: bec1f6f697 ("udp: generate gso with UDP_SEGMENT") Signed-off-by: Jianguo Wu <wujianguo@chinatelecom.cn> Reviewed-by: Willem de Bruijn <willemb@google.com> Link: https://lore.kernel.org/r/900742e5-81fb-30dc-6e0b-375c6cdd7982@163.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-12-14 11:32:37 +01:00
Greg Kroah-Hartman	4b3fd2a81e	Merge 5.10.73 into android12-5.10-lts ... Changes in 5.10.73 Partially revert "usb: Kconfig: using select for USB_COMMON dependency" usb: chipidea: ci_hdrc_imx: Also search for 'phys' phandle USB: cdc-acm: fix racy tty buffer accesses USB: cdc-acm: fix break reporting usb: typec: tcpm: handle SRC_STARTUP state if cc changes drm/nouveau/kms/tu102-: delay enabling cursor until after assign_windows xen/privcmd: fix error handling in mmap-resource processing mmc: meson-gx: do not use memcpy_to/fromio for dram-access-quirk mmc: sdhci-of-at91: wait for calibration done before proceed mmc: sdhci-of-at91: replace while loop with read_poll_timeout ovl: fix missing negative dentry check in ovl_rename() ovl: fix IOCB_DIRECT if underlying fs doesn't support direct IO nfsd: fix error handling of register_pernet_subsys() in init_nfsd() nfsd4: Handle the NFSv4 READDIR 'dircount' hint being zero SUNRPC: fix sign error causing rpcsec_gss drops xen/balloon: fix cancelled balloon action ARM: dts: omap3430-sdp: Fix NAND device node ARM: dts: imx6dl-yapp4: Fix lp5562 LED driver probe ARM: dts: qcom: apq8064: use compatible which contains chipid riscv: Flush current cpu icache before other cpus bus: ti-sysc: Add break in switch statement in sysc_init_soc() soc: qcom: socinfo: Fixed argument passed to platform_set_data() ARM: dts: qcom: apq8064: Use 27MHz PXO clock as DSI PLL reference ARM: at91: pm: do not panic if ram controllers are not enabled soc: qcom: mdt_loader: Drop PT_LOAD check on hash segment ARM: dts: imx: Add missing pinctrl-names for panel on M53Menlo ARM: dts: imx: Fix USB host power regulator polarity on M53Menlo ARM: dts: imx6qdl-pico: Fix Ethernet support PCI: hv: Fix sleep while in non-sleep context when removing child devices from the bus ath5k: fix building with LEDS=m arm64: dts: qcom: pm8150: use qcom,pm8998-pon binding xtensa: use CONFIG_USE_OF instead of CONFIG_OF xtensa: call irqchip_init only when CONFIG_USE_OF is selected iwlwifi: pcie: add configuration of a Wi-Fi adapter on Dell XPS 15 bpf, arm: Fix register clobbering in div/mod implementation soc: ti: omap-prm: Fix external abort for am335x pruss bpf: Fix integer overflow in prealloc_elems_and_freelist() net/mlx5e: IPSEC RX, enable checksum complete net/mlx5: E-Switch, Fix double allocation of acl flow counter phy: mdio: fix memory leak net_sched: fix NULL deref in fifo_set_limit() powerpc/fsl/dts: Fix phy-connection-type for fm1mac3 ptp_pch: Load module automatically if ID matches arm64: dts: ls1028a: add missing CAN nodes dt-bindings: drm/bridge: ti-sn65dsi86: Fix reg value ARM: imx6: disable the GIC CPU interface before calling stby-poweroff sequence net: bridge: use nla_total_size_64bit() in br_get_linkxstats_size() net: bridge: fix under estimation in br_get_linkxstats_size() net/sched: sch_taprio: properly cancel timer from taprio_destroy() net: sfp: Fix typo in state machine debug string netlink: annotate data races around nlk->bound perf jevents: Tidy error handling bus: ti-sysc: Use CLKDM_NOAUTO for dra7 dcan1 for errata i893 drm/sun4i: dw-hdmi: Fix HDMI PHY clock setup video: fbdev: gbefb: Only instantiate device when built for IP32 drm/nouveau: avoid a use-after-free when BO init fails drm/nouveau/kms/nv50-: fix file release memory leak drm/nouveau/debugfs: fix file release memory leak gve: Correct available tx qpl check gve: Avoid freeing NULL pointer rtnetlink: fix if_nlmsg_stats_size() under estimation gve: fix gve_get_stats() gve: report 64bit tx_bytes counter from gve_handle_report_stats() i40e: fix endless loop under rtnl i40e: Fix freeing of uninitialized misc IRQ vector net: prefer socket bound to interface when not in VRF powerpc/iommu: Report the correct most efficient DMA mask for PCI devices i2c: acpi: fix resource leak in reconfiguration device addition i2c: mediatek: Add OFFSET_EXT_CONF setting back riscv/vdso: make arch_setup_additional_pages wait for mmap_sem for write killable bpf, s390: Fix potential memory leak about jit_data RISC-V: Include clone3() on rv32 powerpc/bpf: Fix BPF_SUB when imm == 0x80000000 powerpc/64s: fix program check interrupt emergency stack path pseries/eeh: Fix the kdump kernel crash during eeh_pseries_init x86/platform/olpc: Correct ifdef symbol to intended CONFIG_OLPC_XO15_SCI x86/Kconfig: Correct reference to MWINCHIP3D x86/sev: Return an error on a returned non-zero SW_EXITINFO1[31:0] x86/entry: Correct reference to intended CONFIG_64_BIT x86/entry: Clear X86_FEATURE_SMAP when CONFIG_X86_SMAP=n x86/hpet: Use another crystalball to evaluate HPET usability Linux 5.10.73 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ib837d28b5ab0510121c16791823806a287c81926	2021-10-13 10:28:21 +02:00
Mike Manning	985cca1ad1	net: prefer socket bound to interface when not in VRF ... [ Upstream commit 8d6c414cd2 ] The commit 6da5b0f027 ("net: ensure unbound datagram socket to be chosen when not in a VRF") modified compute_score() so that a device match is always made, not just in the case of an l3mdev skb, then increments the score also for unbound sockets. This ensures that sockets bound to an l3mdev are never selected when not in a VRF. But as unbound and bound sockets are now scored equally, this results in the last opened socket being selected if there are matches in the default VRF for an unbound socket and a socket bound to a dev that is not an l3mdev. However, handling prior to this commit was to always select the bound socket in this case. Reinstate this handling by incrementing the score only for bound sockets. The required isolation due to choosing between an unbound socket and a socket bound to an l3mdev remains in place due to the device match always being made. The same approach is taken for compute_score() for stream sockets. Fixes: 6da5b0f027 ("net: ensure unbound datagram socket to be chosen when not in a VRF") Fixes: e78190581a ("net: ensure unbound stream socket to be chosen when not in a VRF") Signed-off-by: Mike Manning <mmanning@vyatta.att-mail.com> Reviewed-by: David Ahern <dsahern@kernel.org> Link: https://lore.kernel.org/r/cf0a8523-b362-1edf-ee78-eef63cbbb428@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-10-13 10:04:29 +02:00
Greg Kroah-Hartman	c23269dad5	Merge 5.10.71 into android12-5.10-lts ... Changes in 5.10.71 tty: Fix out-of-bound vmalloc access in imageblit cpufreq: schedutil: Use kobject release() method to free sugov_tunables scsi: qla2xxx: Changes to support kdump kernel for NVMe BFS cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory usb: cdns3: fix race condition before setting doorbell ALSA: hda/realtek: Quirks to enable speaker output for Lenovo Legion 7i 15IMHG05, Yoga 7i 14ITL5/15ITL5, and 13s Gen2 laptops. ACPI: NFIT: Use fallback node id when numa info in NFIT table is incorrect fs-verity: fix signed integer overflow with i_size near S64_MAX hwmon: (tmp421) handle I2C errors hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field gpio: pca953x: do not ignore i2c errors scsi: ufs: Fix illegal offset in UPIU event trace mac80211: fix use-after-free in CCMP/GCMP RX x86/kvmclock: Move this_cpu_pvti into kvmclock.h KVM: x86: Fix stack-out-of-bounds memory access from ioapic_write_indirect() KVM: x86: nSVM: don't copy virt_ext from vmcb12 KVM: nVMX: Filter out all unsupported controls when eVMCS was activated KVM: rseq: Update rseq when processing NOTIFY_RESUME on xfer to KVM guest media: ir_toy: prevent device from hanging during transmit RDMA/cma: Do not change route.addr.src_addr.ss_family drm/amd/display: Pass PCI deviceid into DC drm/amdgpu: correct initial cp_hqd_quantum for gfx9 ipvs: check that ip_vs_conn_tab_bits is between 8 and 20 bpf: Handle return value of BPF_PROG_TYPE_STRUCT_OPS prog IB/cma: Do not send IGMP leaves for sendonly Multicast groups RDMA/cma: Fix listener leak in rdma_cma_listen_on_all() failure bpf, mips: Validate conditional branch offsets hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug mac80211: limit injected vht mcs/nss in ieee80211_parse_tx_radiotap mac80211: mesh: fix potentially unaligned access mac80211-hwsim: fix late beacon hrtimer handling sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb mptcp: don't return sockets in foreign netns hwmon: (tmp421) report /PVLD condition as fault hwmon: (tmp421) fix rounding for negative values net: enetc: fix the incorrect clearing of IF_MODE bits net: ipv4: Fix rtnexthop len when RTA_FLOW is present smsc95xx: fix stalled rx after link change drm/i915/request: fix early tracepoints dsa: mv88e6xxx: 6161: Use chip wide MAX MTU dsa: mv88e6xxx: Fix MTU definition dsa: mv88e6xxx: Include tagger overhead when setting MTU for DSA and CPU ports e100: fix length calculation in e100_get_regs_len e100: fix buffer overrun in e100_get_regs RDMA/hns: Fix inaccurate prints bpf: Exempt CAP_BPF from checks against bpf_jit_limit selftests, bpf: Fix makefile dependencies on libbpf selftests, bpf: test_lwt_ip_encap: Really disable rp_filter net: ks8851: fix link error Revert "block, bfq: honor already-setup queue merges" scsi: csiostor: Add module softdep on cxgb4 ixgbe: Fix NULL pointer dereference in ixgbe_xdp_setup net: hns3: do not allow call hns3_nic_net_open repeatedly net: hns3: keep MAC pause mode when multiple TCs are enabled net: hns3: fix mixed flag HCLGE_FLAG_MQPRIO_ENABLE and HCLGE_FLAG_DCB_ENABLE net: hns3: fix show wrong state when add existing uc mac address net: hns3: fix prototype warning net: hns3: reconstruct function hns3_self_test net: hns3: fix always enable rx vlan filter problem after selftest net: phy: bcm7xxx: Fixed indirect MMD operations net: sched: flower: protect fl_walk() with rcu af_unix: fix races in sk_peer_pid and sk_peer_cred accesses perf/x86/intel: Update event constraints for ICX hwmon: (pmbus/mp2975) Add missed POUT attribute for page 1 mp2975 controller nvme: add command id quirk for apple controllers elf: don't use MAP_FIXED_NOREPLACE for elf interpreter mappings debugfs: debugfs_create_file_size(): use IS_ERR to check for error ipack: ipoctal: fix stack information leak ipack: ipoctal: fix tty registration race ipack: ipoctal: fix tty-registration error handling ipack: ipoctal: fix missing allocation-failure check ipack: ipoctal: fix module reference leak ext4: fix loff_t overflow in ext4_max_bitmap_size() ext4: limit the number of blocks in one ADD_RANGE TLV ext4: fix reserved space counter leakage ext4: add error checking to ext4_ext_replay_set_iblocks() ext4: fix potential infinite loop in ext4_dx_readdir() HID: u2fzero: ignore incomplete packets without data net: udp: annotate data race around udp_sk(sk)->corkflag ASoC: dapm: use component prefix when checking widget names usb: hso: remove the bailout parameter crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd() HID: betop: fix slab-out-of-bounds Write in betop_probe netfilter: ipset: Fix oversized kvmalloc() calls mm: don't allow oversized kvmalloc() calls HID: usbhid: free raw_report buffers in usbhid_stop KVM: x86: Handle SRCU initialization failure during page track init netfilter: conntrack: serialize hash resizes and cleanups netfilter: nf_tables: Fix oversized kvmalloc() calls Linux 5.10.71 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I238c3de739c3d4ba0a04a484460356161899f222	2021-10-06 17:33:06 +02:00
Eric Dumazet	5c3a90b6ff	net: udp: annotate data race around udp_sk(sk)->corkflag ... commit a9f5970767 upstream. up->corkflag field can be read or written without any lock. Annotate accesses to avoid possible syzbot/KCSAN reports. Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-10-06 15:56:02 +02:00
Greg Kroah-Hartman	0482d070e7	Merge branch 'android12-5.10' into android12-5.10-lts ... Sync up with android12-5.10 for the following commits: bd50b5dc98 ANDROID: GKI: update allowed GKI symbol for Exynosauto SoC d67fe0a88e ANDROID: GKI: sync allowed list for exynosauto SoC 7a686fd9a5 ANDROID: ABI: update allowed list for galaxy 3f153f7642 ANDROID: Update symbol list for mtk 81c8161bed ANDROID: vendor_hooks: Add hooks to tcp/udp send/recv msg functions. 76879a1964 ANDROID: fs: pipe: wakeup readers on small writes even if pipe had data 989fb724d5 ANDROID: GKI: sort the list of symbol lists 6d737c9d03 Revert "ANDROID: ABI: update symbols to unisoc whitelist for the fifth time" 4d9d100eea ANDROID: Update the exynos symbol list c2af3663a8 ANDROID: GKI: Add some symbols to symbol list 24ceda42e2 ANDROID: abi_gki_aarch64_qcom: Add additional symbols for show_cpufinfo_max_freq f3e3a45d2b ANDROID: sched: add restricted hook to override show_cpufinfo_max_freq e30728e4ff ANDROID: ABI: initial update allowed list for galaxy 13fe7b9964 ANDROID: abi_gki_aarch64_qcom: Add I3C interface symbols to qcom tree 1321fef6b8 ANDROID: Update symbol list for mtk 0050b3de97 ANDROID: abi_gki_aarch64_qcom: Add additional symbols for after hooks 583eba64fe FROMGIT: usb: gadget: composite: Allow bMaxPower=0 if self-powered e33cf9dd43 FROMGIT: f2fs: let's keep writing IOs on SBI_NEED_FSCK Change-Id: I046d733f093bf8810e21b4153f9bc6ca3d78cf4e Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2021-07-28 14:44:30 +02:00
Liangliang Li	81c8161bed	ANDROID: vendor_hooks: Add hooks to tcp/udp send/recv msg functions. ... Add hook to tcp/udp to collect network info and do performance tuning. Bug: 190523684 Change-Id: Id790a381d5ce6c35a747697510f14678ccf3ff2f Signed-off-by: Liangliang Li <liliangliang@vivo.com>	2021-07-28 09:53:04 +08:00
Eric Dumazet	6cd9bd2a2d	udp: annotate data races around unix_sk(sk)->gso_size ... commit 18a419bad6 upstream. Accesses to unix_sk(sk)->gso_size are lockless. Add READ_ONCE()/WRITE_ONCE() around them. BUG: KCSAN: data-race in udp_lib_setsockopt / udpv6_sendmsg write to 0xffff88812d78f47c of 2 bytes by task 10849 on cpu 1: udp_lib_setsockopt+0x3b3/0x710 net/ipv4/udp.c:2696 udpv6_setsockopt+0x63/0x90 net/ipv6/udp.c:1630 sock_common_setsockopt+0x5d/0x70 net/core/sock.c:3265 __sys_setsockopt+0x18f/0x200 net/socket.c:2104 __do_sys_setsockopt net/socket.c:2115 [inline] __se_sys_setsockopt net/socket.c:2112 [inline] __x64_sys_setsockopt+0x62/0x70 net/socket.c:2112 do_syscall_64+0x4a/0x90 arch/x86/entry/common.c:47 entry_SYSCALL_64_after_hwframe+0x44/0xae read to 0xffff88812d78f47c of 2 bytes by task 10852 on cpu 0: udpv6_sendmsg+0x161/0x16b0 net/ipv6/udp.c:1299 inet6_sendmsg+0x5f/0x80 net/ipv6/af_inet6.c:642 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg net/socket.c:674 [inline] ____sys_sendmsg+0x360/0x4d0 net/socket.c:2337 ___sys_sendmsg net/socket.c:2391 [inline] __sys_sendmmsg+0x315/0x4b0 net/socket.c:2477 __do_sys_sendmmsg net/socket.c:2506 [inline] __se_sys_sendmmsg net/socket.c:2503 [inline] __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2503 do_syscall_64+0x4a/0x90 arch/x86/entry/common.c:47 entry_SYSCALL_64_after_hwframe+0x44/0xae value changed: 0x0000 -> 0x0005 Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 10852 Comm: syz-executor.0 Not tainted 5.13.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Fixes: bec1f6f697 ("udp: generate gso with UDP_SEGMENT") Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Willem de Bruijn <willemb@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-07-25 14:36:22 +02:00
Paolo Abeni	8729ec8a22	udp: fix race between close() and udp_abort() ... [ Upstream commit a8b897c7bc ] Kaustubh reported and diagnosed a panic in udp_lib_lookup(). The root cause is udp_abort() racing with close(). Both racing functions acquire the socket lock, but udp{v6}_destroy_sock() release it before performing destructive actions. We can't easily extend the socket lock scope to avoid the race, instead use the SOCK_DEAD flag to prevent udp_abort from doing any action when the critical race happens. Diagnosed-and-tested-by: Kaustubh Pandey <kapandey@codeaurora.org> Fixes: 5d77dca828 ("net: diag: support SOCK_DESTROY for UDP sockets") Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-06-23 14:42:42 +02:00
Paolo Abeni	4877c4a523	udp: never accept GSO_FRAGLIST packets ... [ Upstream commit 78352f73dc ] Currently the UDP protocol delivers GSO_FRAGLIST packets to the sockets without the expected segmentation. This change addresses the issue introducing and maintaining a couple of new fields to explicitly accept SKB_GSO_UDP_L4 or GSO_FRAGLIST packets. Additionally updates udp_unexpected_gso() accordingly. UDP sockets enabling UDP_GRO stil keep accept_udp_fraglist zeroed. v1 -> v2: - use 2 bits instead of a whole GSO bitmask (Willem) Fixes: 9fd1ff5d2a ("udp: Support UDP fraglist GRO/GSO.") Signed-off-by: Paolo Abeni <pabeni@redhat.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-05-14 09:50:31 +02:00
Norman Maurer	24bbfe89b1	net: udp: Add support for getsockopt(..., ..., UDP_GRO, ..., ...); ... [ Upstream commit 98184612ac ] Support for UDP_GRO was added in the past but the implementation for getsockopt was missed which did lead to an error when we tried to retrieve the setting for UDP_GRO. This patch adds the missing switch case for UDP_GRO Fixes: e20cf8d3f1 ("udp: implement GRO for plain UDP sockets.") Signed-off-by: Norman Maurer <norman_maurer@apple.com> Reviewed-by: David Ahern <dsahern@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-04-14 08:42:09 +02:00
Guillaume Nault	e5f323b7ab	udp: mask TOS bits in udp_v4_early_demux() ... commit 8d2b51b008 upstream. udp_v4_early_demux() is the only function that calls ip_mc_validate_source() with a TOS that hasn't been masked with IPTOS_RT_MASK. This results in different behaviours for incoming multicast UDPv4 packets, depending on if ip_mc_validate_source() is called from the early-demux path (udp_v4_early_demux) or from the regular input path (ip_route_input_noref). ECN would normally not be used with UDP multicast packets, so the practical consequences should be limited on that side. However, IPTOS_RT_MASK is used to also masks the TOS' high order bits, to align with the non-early-demux path behaviour. Reproducer: Setup two netns, connected with veth: $ ip netns add ns0 $ ip netns add ns1 $ ip -netns ns0 link set dev lo up $ ip -netns ns1 link set dev lo up $ ip link add name veth01 netns ns0 type veth peer name veth10 netns ns1 $ ip -netns ns0 link set dev veth01 up $ ip -netns ns1 link set dev veth10 up $ ip -netns ns0 address add 192.0.2.10 peer 192.0.2.11/32 dev veth01 $ ip -netns ns1 address add 192.0.2.11 peer 192.0.2.10/32 dev veth10 In ns0, add route to multicast address 224.0.2.0/24 using source address 198.51.100.10: $ ip -netns ns0 address add 198.51.100.10/32 dev lo $ ip -netns ns0 route add 224.0.2.0/24 dev veth01 src 198.51.100.10 In ns1, define route to 198.51.100.10, only for packets with TOS 4: $ ip -netns ns1 route add 198.51.100.10/32 tos 4 dev veth10 Also activate rp_filter in ns1, so that incoming packets not matching the above route get dropped: $ ip netns exec ns1 sysctl -wq net.ipv4.conf.veth10.rp_filter=1 Now try to receive packets on 224.0.2.11: $ ip netns exec ns1 socat UDP-RECVFROM:1111,ip-add-membership=224.0.2.11:veth10,ignoreeof - In ns0, send packet to 224.0.2.11 with TOS 4 and ECT(0) (that is, tos 6 for socat): $ echo test0 | ip netns exec ns0 socat - UDP-DATAGRAM:224.0.2.11:1111,bind=:1111,tos=6 The "test0" message is properly received by socat in ns1, because early-demux has no cached dst to use, so source address validation is done by ip_route_input_mc(), which receives a TOS that has the ECN bits masked. Now send another packet to 224.0.2.11, still with TOS 4 and ECT(0): $ echo test1 | ip netns exec ns0 socat - UDP-DATAGRAM:224.0.2.11:1111,bind=:1111,tos=6 The "test1" message isn't received by socat in ns1, because, now, early-demux has a cached dst to use and calls ip_mc_validate_source() immediately, without masking the ECN bits. Fixes: bc044e8db7 ("udp: perform source validation for mcast early demux") Signed-off-by: Guillaume Nault <gnault@redhat.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-01-27 11:55:24 +01:00
Xin Long	10c678bd0a	udp: fix the proto value passed to ip_protocol_deliver_rcu for the segments ... Guillaume noticed that: for segments udp_queue_rcv_one_skb() returns the proto, and it should pass "ret" unmodified to ip_protocol_deliver_rcu(). Otherwize, with a negtive value passed, it will underflow inet_protos. This can be reproduced with IPIP FOU: # ip fou add port 5555 ipproto 4 # ethtool -K eth1 rx-gro-list on Fixes: cf329aa42b ("udp: cope with UDP GRO packet misdirection") Reported-by: Guillaume Nault <gnault@redhat.com> Signed-off-by: Xin Long <lucien.xin@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2020-12-07 00:32:11 -08:00
Randy Dunlap	2bdcc73c88	net: ipv4: delete repeated words ... Drop duplicate words in comments in net/ipv4/. Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Cc: "David S. Miller" <davem@davemloft.net> Cc: Jakub Kicinski <kuba@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>	2020-08-24 17:31:20 -07:00
Jakub Sitnicki	c64c9c282a	udp, bpf: Ignore connections in reuseport group after BPF sk lookup ... When BPF sk lookup invokes reuseport handling for the selected socket, it should ignore the fact that reuseport group can contain connected UDP sockets. With BPF sk lookup this is not relevant as we are not scoring sockets to find the best match, which might be a connected UDP socket. Fix it by unconditionally accepting the socket selected by reuseport. This fixes the following two failures reported by test_progs. # ./test_progs -t sk_lookup ... #73/14 UDP IPv4 redir and reuseport with conns:FAIL ... #73/20 UDP IPv6 redir and reuseport with conns:FAIL ... Fixes: a57066b1a0 ("Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net") Reported-by: Alexei Starovoitov <alexei.starovoitov@gmail.com> Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20200726120228.1414348-1-jakub@cloudflare.com	2020-07-31 02:00:48 +02:00
Yonghong Song	f9c7927295	bpf: Refactor to provide aux info to bpf_iter_init_seq_priv_t ... This patch refactored target bpf_iter_init_seq_priv_t callback function to accept additional information. This will be needed in later patches for map element targets since a particular map should be passed to traverse elements for that particular map. In the future, other information may be passed to target as well, e.g., pid, cgroup id, etc. to customize the iterator. Signed-off-by: Yonghong Song <yhs@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/20200723184110.590156-1-yhs@fb.com	2020-07-25 20:16:32 -07:00
Yonghong Song	14fc6bd6b7	bpf: Refactor bpf_iter_reg to have separate seq_info member ... There is no functionality change for this patch. Struct bpf_iter_reg is used to register a bpf_iter target, which includes information for both prog_load, link_create and seq_file creation. This patch puts fields related seq_file creation into a different structure. This will be useful for map elements iterator where one iterator covers different map types and different map types may have different seq_ops, init/fini private_data function and private_data size. Signed-off-by: Yonghong Song <yhs@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/20200723184109.590030-1-yhs@fb.com	2020-07-25 20:16:32 -07:00
David S. Miller	a57066b1a0	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net ... The UDP reuseport conflict was a little bit tricky. The net-next code, via bpf-next, extracted the reuseport handling into a helper so that the BPF sk lookup code could invoke it. At the same time, the logic for reuseport handling of unconnected sockets changed via commit efc6b6f6c3 which changed the logic to carry on the reuseport result into the rest of the lookup loop if we do not return immediately. This requires moving the reuseport_has_conns() logic into the callers. While we are here, get rid of inline directives as they do not belong in foo.c files. The other changes were cases of more straightforward overlapping modifications. Signed-off-by: David S. Miller <davem@davemloft.net>	2020-07-25 17:49:04 -07:00
Christoph Hellwig	a7b75c5a8c	net: pass a sockptr_t into ->setsockopt ... Rework the remaining setsockopt code to pass a sockptr_t instead of a plain user pointer. This removes the last remaining set_fs(KERNEL_DS) outside of architecture specific code. Signed-off-by: Christoph Hellwig <hch@lst.de> Acked-by: Stefan Schmidt <stefan@datenfreihafen.org> [ieee802154] Acked-by: Matthieu Baerts <matthieu.baerts@tessares.net> Signed-off-by: David S. Miller <davem@davemloft.net>	2020-07-24 15:41:54 -07:00
Christoph Hellwig	91ac1ccaff	net/udp: switch udp_lib_setsockopt to sockptr_t ... Pass a sockptr_t to prepare for set_fs-less handling of the kernel pointer from bpf-cgroup. Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: David S. Miller <davem@davemloft.net>	2020-07-24 15:41:54 -07:00
David S. Miller	dee72f8a0c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next ... Alexei Starovoitov says: ==================== pull-request: bpf-next 2020-07-21 The following pull-request contains BPF updates for your *net-next* tree. We've added 46 non-merge commits during the last 6 day(s) which contain a total of 68 files changed, 4929 insertions(+), 526 deletions(-). The main changes are: 1) Run BPF program on socket lookup, from Jakub. 2) Introduce cpumap, from Lorenzo. 3) s390 JIT fixes, from Ilya. 4) teach riscv JIT to emit compressed insns, from Luke. 5) use build time computed BTF ids in bpf iter, from Yonghong. ==================== Purely independent overlapping changes in both filter.h and xdp.h Signed-off-by: David S. Miller <davem@davemloft.net>	2020-07-22 12:35:33 -07:00
Miaohe Lin	b0a422772f	net: udp: Fix wrong clean up for IS_UDPLITE macro ... We can't use IS_UDPLITE to replace udp_sk->pcflag when UDPLITE_RECV_CC is checked. Fixes: b2bf1e2659 ("[UDP]: Clean up for IS_UDPLITE macro") Signed-off-by: Miaohe Lin <linmiaohe@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2020-07-21 15:41:49 -07:00
Kuniyuki Iwashima	efc6b6f6c3	udp: Improve load balancing for SO_REUSEPORT. ... Currently, SO_REUSEPORT does not work well if connected sockets are in a UDP reuseport group. Then reuseport_has_conns() returns true and the result of reuseport_select_sock() is discarded. Also, unconnected sockets have the same score, hence only does the first unconnected socket in udp_hslot always receive all packets sent to unconnected sockets. So, the result of reuseport_select_sock() should be used for load balancing. The noteworthy point is that the unconnected sockets placed after connected sockets in sock_reuseport.socks will receive more packets than others because of the algorithm in reuseport_select_sock(). index | connected | reciprocal_scale | result --------------------------------------------- 0 | no | 20% | 40% 1 | no | 20% | 20% 2 | yes | 20% | 0% 3 | no | 20% | 40% 4 | yes | 20% | 0% If most of the sockets are connected, this can be a problem, but it still works better than now. Fixes: acdcecc612 ("udp: correct reuseport selection with connected sockets") CC: Willem de Bruijn <willemb@google.com> Reviewed-by: Benjamin Herrenschmidt <benh@amazon.com> Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.co.jp> Acked-by: Willem de Bruijn <willemb@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2020-07-21 15:31:02 -07:00
Yonghong Song	951cf368bc	bpf: net: Use precomputed btf_id for bpf iterators ... One additional field btf_id is added to struct bpf_ctx_arg_aux to store the precomputed btf_ids. The btf_id is computed at build time with BTF_ID_LIST or BTF_ID_LIST_GLOBAL macro definitions. All existing bpf iterators are changed to used pre-compute btf_ids. Signed-off-by: Yonghong Song <yhs@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/20200720163403.1393551-1-yhs@fb.com	2020-07-21 13:26:26 -07:00
Christoph Hellwig	b6238c04c0	net/ipv4: remove compat_ip_{get,set}sockopt ... Handle the few cases that need special treatment in-line using in_compat_syscall(). Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: David S. Miller <davem@davemloft.net>	2020-07-19 18:16:41 -07:00
Jakub Sitnicki	72f7e9440e	udp: Run SK_LOOKUP BPF program on socket lookup ... Following INET/TCP socket lookup changes, modify UDP socket lookup to let BPF program select a receiving socket before searching for a socket by destination address and port as usual. Lookup of connected sockets that match packet 4-tuple is unaffected by this change. BPF program runs, and potentially overrides the lookup result, only if a 4-tuple match was not found. Suggested-by: Marek Majkowski <marek@cloudflare.com> Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Andrii Nakryiko <andriin@fb.com> Link: https://lore.kernel.org/bpf/20200717103536.397595-9-jakub@cloudflare.com	2020-07-17 20:18:17 -07:00
Jakub Sitnicki	7629c73a14	udp: Extract helper for selecting socket from reuseport group ... Prepare for calling into reuseport from __udp4_lib_lookup as well. Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Andrii Nakryiko <andriin@fb.com> Link: https://lore.kernel.org/bpf/20200717103536.397595-8-jakub@cloudflare.com	2020-07-17 20:18:17 -07:00
Andrew Lunn	3628e3cbf9	net: ipv4: kerneldoc fixes ... Simple fixes which require no deep knowledge of the code. Cc: Paul Moore <paul@paul-moore.com> Cc: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru> Cc: Eric Dumazet <edumazet@google.com> Signed-off-by: Andrew Lunn <andrew@lunn.ch> Acked-by: Paul Moore <paul@paul-moore.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2020-07-13 17:20:39 -07:00
Yonghong Song	5788b3a07f	net: bpf: Implement bpf iterator for udp ... The bpf iterator for udp is implemented. Both udp4 and udp6 sockets will be traversed. It is up to bpf program to filter for udp4 or udp6 only, or both families of sockets. Signed-off-by: Yonghong Song <yhs@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Martin KaFai Lau <kafai@fb.com> Link: https://lore.kernel.org/bpf/20200623230813.3988404-1-yhs@fb.com	2020-06-24 18:37:59 -07:00
Yonghong Song	9e8ca27afa	net: bpf: Add bpf_seq_afinfo in udp_iter_state ... Similar to tcp_iter_state, a new field bpf_seq_afinfo is added to udp_iter_state to provide bpf udp iterator afinfo. This does not change /proc/net/{udp, udp6} behavior. But it enables bpf iterator to avoid get afinfo from PDE_DATA and iterate through all udp and udp6 sockets in one pass. Signed-off-by: Yonghong Song <yhs@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Martin KaFai Lau <kafai@fb.com> Link: https://lore.kernel.org/bpf/20200623230812.3988347-1-yhs@fb.com	2020-06-24 18:37:59 -07:00
Sabrina Dubroca	0146dca70b	xfrm: add support for UDPv6 encapsulation of ESP ... This patch adds support for encapsulation of ESP over UDPv6. The code is very similar to the IPv4 encapsulation implementation, and allows to easily add espintcp on IPv6 as a follow-up. Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>	2020-04-28 11:28:36 +02:00
David S. Miller	ed52f2c608	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next ... Signed-off-by: David S. Miller <davem@davemloft.net>	2020-03-30 19:52:37 -07:00
Joe Stringer	71489e21d7	net: Track socket refcounts in skb_steal_sock() ... Refactor the UDP/TCP handlers slightly to allow skb_steal_sock() to make the determination of whether the socket is reference counted in the case where it is prefetched by earlier logic such as early_demux. Signed-off-by: Joe Stringer <joe@wand.net.nz> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Martin KaFai Lau <kafai@fb.com> Link: https://lore.kernel.org/bpf/20200329225342.16317-3-joe@wand.net.nz	2020-03-30 13:45:04 -07:00