571 Commits

Author	SHA1	Message	Date
Greg Kroah-Hartman	3e7bedcc0e	Merge 5.10.198 into android12-5.10-lts ... Changes in 5.10.198 NFS: Use the correct commit info in nfs_join_page_group() NFS/pNFS: Report EINVAL errors from connect() to the server SUNRPC: Mark the cred for revalidation if the server rejects it tracing: Increase trace array ref count on enable and filter files ata: ahci: Drop pointless VPRINTK() calls and convert the remaining ones ata: libahci: clear pending interrupt status ext4: remove the 'group' parameter of ext4_trim_extent ext4: add new helper interface ext4_try_to_trim_range() ext4: scope ret locally in ext4_try_to_trim_range() ext4: change s_last_trim_minblks type to unsigned long ext4: mark group as trimmed only if it was fully scanned ext4: replace the traditional ternary conditional operator with with max()/min() ext4: move setting of trimmed bit into ext4_try_to_trim_range() ext4: do not let fstrim block system suspend tracing: Have event inject files inc the trace array ref count netfilter: nf_tables: integrate pipapo into commit protocol netfilter: nf_tables: don't skip expired elements during walk netfilter: nf_tables: GC transaction API to avoid race with control plane netfilter: nf_tables: adapt set backend to use GC transaction API netfilter: nft_set_hash: mark set element as dead when deleting from packet path netfilter: nf_tables: remove busy mark and gc batch API netfilter: nf_tables: don't fail inserts if duplicate has expired netfilter: nf_tables: fix GC transaction races with netns and netlink event exit path netfilter: nf_tables: GC transaction race with netns dismantle netfilter: nf_tables: GC transaction race with abort path netfilter: nf_tables: use correct lock to protect gc_list netfilter: nf_tables: defer gc run if previous batch is still pending netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction netfilter: nft_set_rbtree: use read spinlock to avoid datapath contention netfilter: nft_set_pipapo: stop GC iteration if GC transaction allocation fails netfilter: nft_set_hash: try later when GC hits EAGAIN on iteration netfilter: nf_tables: fix memleak when more than 255 elements expired ASoC: meson: spdifin: start hw on dai probe netfilter: nf_tables: disallow element removal on anonymous sets bpf: Avoid deadlock when using queue and stack maps from NMI selftests/tls: Add {} to avoid static checker warning selftests: tls: swap the TX and RX sockets in some tests ASoC: imx-audmix: Fix return error with devm_clk_get() i40e: Fix VF VLAN offloading when port VLAN is configured ipv4: fix null-deref in ipv4_link_failure powerpc/perf/hv-24x7: Update domain value check dccp: fix dccp_v4_err()/dccp_v6_err() again platform/x86: intel_scu_ipc: Check status after timeout in busy_loop() platform/x86: intel_scu_ipc: Check status upon timeout in ipc_wait_for_interrupt() platform/x86: intel_scu_ipc: Don't override scu in intel_scu_ipc_dev_simple_command() platform/x86: intel_scu_ipc: Fail IPC send if still busy x86/srso: Fix srso_show_state() side effect x86/srso: Fix SBPB enablement for spec_rstack_overflow=off net: hns3: only enable unicast promisc when mac table full net: hns3: add 5ms delay before clear firmware reset irq source net: bridge: use DEV_STATS_INC() team: fix null-ptr-deref when team device type is changed netfilter: ipset: Fix race between IPSET_CMD_CREATE and IPSET_CMD_SWAP seqlock: avoid -Wshadow warnings seqlock: Rename __seqprop() users seqlock: Prefix internal seqcount_t-only macros with a "do_" locking/seqlock: Do the lockdep annotation before locking in do_write_seqcount_begin_nested() bnxt_en: Flush XDP for bnxt_poll_nitroa0()'s NAPI net: rds: Fix possible NULL-pointer dereference gpio: tb10x: Fix an error handling path in tb10x_gpio_probe() i2c: mux: demux-pinctrl: check the return value of devm_kstrdup() netfilter: nf_tables: unregister flowtable hooks on netns exit netfilter: nf_tables: double hook unregistration in netns path Input: i8042 - rename i8042-x86ia64io.h to i8042-acpipnpio.h Input: i8042 - add quirk for TUXEDO Gemini 17 Gen1/Clevo PD70PN mmc: renesas_sdhi: probe into TMIO after SCC parameters have been setup mmc: renesas_sdhi: populate SCC pointer at the proper place mmc: tmio: support custom irq masks mmc: renesas_sdhi: register irqs before registering controller media: venus: core: Add io base variables for each block media: venus: hfi,pm,firmware: Convert to block relative addressing media: venus: hfi: Define additional 6xx registers media: venus: core: Add differentiator IS_V6(core) media: venus: hfi: Add a 6xx boot logic media: venus: hfi_venus: Write to VIDC_CTRL_INIT after unmasking interrupts netfilter: use actual socket sk for REJECT action netfilter: nft_exthdr: Support SCTP chunks netfilter: nf_tables: add and use nft_sk helper netfilter: nf_tables: add and use nft_thoff helper netfilter: nft_exthdr: break evaluation if setting TCP option fails netfilter: exthdr: add support for tcp option removal netfilter: nft_exthdr: Fix non-linear header modification ata: libata: Rename link flag ATA_LFLAG_NO_DB_DELAY ata: ahci: Add support for AMD A85 FCH (Hudson D4) ata: ahci: Rename board_ahci_mobile ata: ahci: Add Elkhart Lake AHCI controller btrfs: reset destination buffer when read_extent_buffer() gets invalid range MIPS: Alchemy: only build mmc support helpers if au1xmmc is enabled bus: ti-sysc: Use fsleep() instead of usleep_range() in sysc_reset() bus: ti-sysc: Fix missing AM35xx SoC matching clk: tegra: fix error return case for recalc_rate ARM: dts: omap: correct indentation ARM: dts: ti: omap: Fix bandgap thermal cells addressing for omap3/4 ARM: dts: motorola-mapphone: Configure lower temperature passive cooling ARM: dts: motorola-mapphone: Add 1.2GHz OPP ARM: dts: motorola-mapphone: Drop second ti,wlcore compatible value ARM: dts: am335x: Guardian: Update beeper label ARM: dts: Unify pwm-omap-dmtimer node names ARM: dts: ti: omap: motorola-mapphone: Fix abe_clkctrl warning on boot bus: ti-sysc: Fix SYSC_QUIRK_SWSUP_SIDLE_ACT handling for uart wake-up power: supply: ucs1002: fix error code in ucs1002_get_property() xtensa: add default definition for XCHAL_HAVE_DIV32 xtensa: iss/network: make functions static xtensa: boot: don't add include-dirs xtensa: boot/lib: fix function prototypes gpio: pmic-eic-sprd: Add can_sleep flag for PMIC EIC chip i2c: npcm7xx: Fix callback completion ordering dma-debug: don't call __dma_entry_alloc_check_leak() under free_entries_lock parisc: sba: Fix compile warning wrt list of SBA devices parisc: iosapic.c: Fix sparse warnings parisc: drivers: Fix sparse warning parisc: irq: Make irq_stack_union static to avoid sparse warning scsi: qedf: Add synchronization between I/O completions and abort selftests/ftrace: Correctly enable event in instance-event.tc ring-buffer: Avoid softlockup in ring_buffer_resize() selftests: fix dependency checker script ring-buffer: Do not attempt to read past "commit" platform/mellanox: mlxbf-bootctl: add NET dependency into Kconfig scsi: pm80xx: Use phy-specific SAS address when sending PHY_START command scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command ata: libata-eh: do not clear ATA_PFLAG_EH_PENDING in ata_eh_reset() spi: nxp-fspi: reset the FLSHxCR1 registers bpf: Clarify error expectations from bpf_clone_redirect media: vb2: frame_vector.c: replace WARN_ONCE with a comment powerpc/watchpoints: Disable preemption in thread_change_pc() ncsi: Propagate carrier gain/loss events to the NCSI controller fbdev/sh7760fb: Depend on FB=y perf build: Define YYNOMEM as YYNOABORT for bison < 3.81 sched/cpuacct: Fix user/system in shown cpuacct.usage* sched/cpuacct: Fix charge percpu cpuusage sched/cpuacct: Optimize away RCU read lock cgroup: Fix suspicious rcu_dereference_check() usage warning ACPI: Check StorageD3Enable _DSD property in ACPI code nvme-pci: factor the iod mempool creation into a helper nvme-pci: factor out a nvme_pci_alloc_dev helper nvme-pci: do not set the NUMA node of device if it has none watchdog: iTCO_wdt: No need to stop the timer in probe watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running netfilter: nft_exthdr: Search chunks in SCTP packets only netfilter: nft_exthdr: Fix for unsafe packet data read nvme-pci: always return an ERR_PTR from nvme_pci_alloc_dev smack: Record transmuting in smk_transmuted smack: Retrieve transmuting information in smack_inode_getsecurity() Smack:- Use overlay inode label in smack_inode_copy_up() Revert "tty: n_gsm: fix UAF in gsm_cleanup_mux" serial: 8250_port: Check IRQ data before use nilfs2: fix potential use after free in nilfs_gccache_submit_read_data() netfilter: nf_tables: disallow rule removal from chain binding ALSA: hda: Disable power save for solving pop issue on Lenovo ThinkCentre M70q ata: libata-scsi: ignore reserved bits for REPORT SUPPORTED OPERATION CODES i2c: i801: unregister tco_pdev in i801_probe() error path Revert "SUNRPC dont update timeout value on connection reset" proc: nommu: /proc/<pid>/maps: release mmap read lock ring-buffer: Update "shortest_full" in polling btrfs: properly report 0 avail for very full file systems bpf: Fix BTF_ID symbol generation collision bpf: Fix BTF_ID symbol generation collision in tools/ net: thunderbolt: Fix TCPv6 GSO checksum calculation ata: libata-core: Fix ata_port_request_pm() locking ata: libata-core: Fix port and device removal ata: libata-core: Do not register PM operations for SAS ports ata: libata-sata: increase PMP SRST timeout to 10s fs: binfmt_elf_efpic: fix personality for ELF-FDPIC spi: spi-zynqmp-gqspi: Fix runtime PM imbalance in zynqmp_qspi_probe spi: zynqmp-gqspi: fix clock imbalance on probe failure NFS: Cleanup unused rpc_clnt variable NFS: rename nfs_client_kset to nfs_kset NFSv4: Fix a state manager thread deadlock regression ring-buffer: remove obsolete comment for free_buffer_page() ring-buffer: Fix bytes info in per_cpu buffer stats drm/mediatek: Fix backport issue in mtk_drm_gem_prime_vmap() rbd: move rbd_dev_refresh() definition rbd: decouple header read-in from updating rbd_dev->header rbd: decouple parent info read-in from updating rbd_dev rbd: take header_rwsem in rbd_dev_refresh() only when updating block: fix use-after-free of q->q_usage_counter Revert "clk: imx: pll14xx: dynamically configure PLL for 393216000/361267200Hz" Revert "PCI: qcom: Disable write access to read only registers for IP v2.3.3" scsi: zfcp: Fix a double put in zfcp_port_enqueue() qed/red_ll2: Fix undefined behavior bug in struct qed_ll2_info wifi: mwifiex: Fix tlv_buf_left calculation net: replace calls to sock->ops->connect() with kernel_connect() net: prevent rewrite of msg_name in sock_sendmsg() arm64: Add Cortex-A520 CPU part definition ubi: Refuse attaching if mtd's erasesize is 0 wifi: iwlwifi: dbg_ini: fix structure packing wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet bpf: Fix tr dereferencing drivers/net: process the result of hdlc_open() and add call of hdlc_close() in uhdlc_close() wifi: mt76: mt76x02: fix MT76x0 external LNA gain handling regmap: rbtree: Fix wrong register marked as in-cache when creating new node ima: Finish deprecation of IMA_TRUSTED_KEYRING Kconfig scsi: target: core: Fix deadlock due to recursive locking ima: rework CONFIG_IMA dependency block NFSv4: Fix a nfs4_state_manager() race modpost: add missing else to the "of" check net: fix possible store tearing in neigh_periodic_work() ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data() net: dsa: mv88e6xxx: Avoid EEPROM timeout when EEPROM is absent net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg net: nfc: llcp: Add lock when modifying device list net: ethernet: ti: am65-cpsw: Fix error code in am65_cpsw_nuss_init_tx_chns() netfilter: handle the connecting collision properly in nf_conntrack_proto_sctp netfilter: nf_tables: nft_set_rbtree: fix spurious insertion failure net: stmmac: dwmac-stm32: fix resume on STM32 MCU tipc: fix a potential deadlock on &tx->lock tcp: fix quick-ack counting to count actual ACKs of new data tcp: fix delayed ACKs for MSS boundary condition sctp: update transport state when processing a dupcook packet sctp: update hb timer immediately after users change hb_interval cpupower: add Makefile dependencies for install targets dm zoned: free dmz->ddev array in dmz_put_zoned_devices RDMA/core: Require admin capabilities to set system parameters of: dynamic: Fix potential memory leak in of_changeset_action() IB/mlx4: Fix the size of a buffer in add_port_entries() gpio: aspeed: fix the GPIO number passed to pinctrl_gpio_set_config() gpio: pxa: disable pinctrl calls for MMP_GPIO RDMA/cma: Initialize ib_sa_multicast structure to 0 when join RDMA/cma: Fix truncation compilation warning in make_cma_ports RDMA/uverbs: Fix typo of sizeof argument RDMA/siw: Fix connection failure handling RDMA/mlx5: Fix NULL string error parisc: Restore __ldcw_align for PA-RISC 2.0 processors netfilter: nf_tables: fix kdoc warnings after gc rework netfilter: nftables: exthdr: fix 4-byte stack OOB write mmc: renesas_sdhi: only reset SCC when its pointer is populated xen/events: replace evtchn_rwlock with RCU Linux 5.10.198 Change-Id: Iabfdf919ae63e41a565e523087d800ebc20e5448 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-10-26 17:54:46 +00:00
Jordan Rife	81d03e2518	net: prevent rewrite of msg_name in sock_sendmsg() ... commit 86a7e0b69b upstream. Callers of sock_sendmsg(), and similarly kernel_sendmsg(), in kernel space may observe their value of msg_name change in cases where BPF sendmsg hooks rewrite the send address. This has been confirmed to break NFS mounts running in UDP mode and has the potential to break other systems. This patch: 1) Creates a new function called __sock_sendmsg() with same logic as the old sock_sendmsg() function. 2) Replaces calls to sock_sendmsg() made by __sys_sendto() and __sys_sendmsg() with __sock_sendmsg() to avoid an unnecessary copy, as these system calls are already protected. 3) Modifies sock_sendmsg() so that it makes a copy of msg_name if present before passing it down the stack to insulate callers from changes to the send address. Link: https://lore.kernel.org/netdev/20230912013332.2048422-1-jrife@google.com/ Fixes: 1cedee13d2 ("bpf: Hooks for sys_sendmsg") Cc: stable@vger.kernel.org Reviewed-by: Willem de Bruijn <willemb@google.com> Signed-off-by: Jordan Rife <jrife@google.com> Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-10-10 21:53:37 +02:00
Greg Kroah-Hartman	8026d5839b	Merge 5.10.195 into android12-5.10-lts ... Changes in 5.10.195 erofs: ensure that the post-EOF tails are all zeroed ARM: pxa: remove use of symbol_get() mmc: au1xmmc: force non-modular build and remove symbol_get usage net: enetc: use EXPORT_SYMBOL_GPL for enetc_phc_index rtc: ds1685: use EXPORT_SYMBOL_GPL for ds1685_rtc_poweroff modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules USB: serial: option: add Quectel EM05G variant (0x030e) USB: serial: option: add FOXCONN T99W368/T99W373 product usb: dwc3: meson-g12a: do post init to fix broken usb after resumption usb: chipidea: imx: improve logic if samsung,picophy-* parameter is 0 HID: wacom: remove the battery when the EKR is off staging: rtl8712: fix race condition Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition configfs: fix a race in configfs_lookup() serial: qcom-geni: fix opp vote on shutdown serial: sc16is7xx: fix broken port 0 uart init serial: sc16is7xx: fix bug when first setting GPIO direction firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe fsi: master-ast-cf: Add MODULE_FIRMWARE macro nilfs2: fix general protection fault in nilfs_lookup_dirty_data_buffers() nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse pinctrl: amd: Don't show `Invalid config param` errors ASoC: rt5682: Fix a problem with error handling in the io init function of the soundwire ARM: dts: imx: update sdma node name format ARM: dts: imx7s: Drop dma-apb interrupt-names ARM: dts: imx: Adjust dma-apbh node name ARM: dts: imx: Set default tuning step for imx7d usdhc phy: qcom-snps-femto-v2: use qcom_snps_hsphy_suspend/resume error code media: pulse8-cec: handle possible ping error media: pci: cx23885: fix error handling for cx23885 ATSC boards 9p: virtio: make sure 'offs' is initialized in zc_request ASoC: da7219: Flush pending AAD IRQ when suspending ASoC: da7219: Check for failure reading AAD IRQ events ethernet: atheros: fix return value check in atl1c_tso_csum() vxlan: generalize vxlan_parse_gpe_hdr and remove unused args m68k: Fix invalid .section syntax s390/dasd: use correct number of retries for ERP requests s390/dasd: fix hanging device after request requeue fs/nls: make load_nls() take a const parameter ASoc: codecs: ES8316: Fix DMIC config ASoC: atmel: Fix the 8K sample parameter in I2SC master platform/x86: intel: hid: Always call BTNL ACPI method platform/x86: huawei-wmi: Silence ambient light sensor drm/amd/display: Exit idle optimizations before attempt to access PHY ovl: Always reevaluate the file signature for IMA ata: pata_arasan_cf: Use dev_err_probe() instead dev_err() in data_xfer() security: keys: perform capable check only on privileged operations kprobes: Prohibit probing on CFI preamble symbol clk: fixed-mmio: make COMMON_CLK_FIXED_MMIO depend on HAS_IOMEM vmbus_testing: fix wrong python syntax for integer value comparison net: usb: qmi_wwan: add Quectel EM05GV2 idmaengine: make FSL_EDMA and INTEL_IDMA64 depends on HAS_IOMEM scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock netlabel: fix shift wrapping bug in netlbl_catmap_setlong() bnx2x: fix page fault following EEH recovery sctp: handle invalid error codes without calling BUG() scsi: storvsc: Always set no_report_opcodes ALSA: seq: oss: Fix racy open/close of MIDI devices tracing: Introduce pipe_cpumask to avoid race on trace_pipes platform/mellanox: Fix mlxbf-tmfifo not handling all virtio CONSOLE notifications net: Avoid address overwrite in kernel_connect udf: Check consistency of Space Bitmap Descriptor udf: Handle error when adding extent to a file Revert "net: macsec: preserve ingress frame ordering" reiserfs: Check the return value from __getblk() eventfd: Export eventfd_ctx_do_read() eventfd: prevent underflow for eventfd semaphores fs: Fix error checking for d_hash_and_lookup() tmpfs: verify {g,u}id mount options correctly selftests/harness: Actually report SKIP for signal tests refscale: Fix uninitalized use of wait_queue_head_t OPP: Fix passing 0 to PTR_ERR in _opp_attach_genpd() selftests/resctrl: Don't leak buffer in fill_cache() selftests/resctrl: Unmount resctrl FS if child fails to run benchmark selftests/resctrl: Close perf value read fd on errors x86/decompressor: Don't rely on upper 32 bits of GPRs being preserved perf/imx_ddr: don't enable counter0 if none of 4 counters are used s390/pkey: fix/harmonize internal keyblob headers s390/paes: fix PKEY_TYPE_EP11_AES handling for secure keyblobs x86/efistub: Fix PCI ROM preservation in mixed mode cpufreq: powernow-k8: Use related_cpus instead of cpus in driver.exit() bpftool: Use a local bpf_perf_event_value to fix accessing its fields bpf: Clear the probe_addr for uprobe tcp: tcp_enter_quickack_mode() should be static hwrng: nomadik - keep clock enabled while hwrng is registered regmap: rbtree: Use alloc_flags for memory allocations udp: re-score reuseport groups when connected sockets are present bpf: reject unhashed sockets in bpf_sk_assign wifi: mt76: testmode: add nla_policy for MT76_TM_ATTR_TX_LENGTH spi: tegra20-sflash: fix to check return value of platform_get_irq() in tegra_sflash_probe() can: gs_usb: gs_usb_receive_bulk_callback(): count RX overflow errors also in case of OOM wifi: mwifiex: Fix OOB and integer underflow when rx packets wifi: mwifiex: fix error recovery in PCIE buffer descriptor management selftests/bpf: fix static assert compilation issue for test_cls_*.c crypto: stm32 - Properly handle pm_runtime_get failing crypto: api - Use work queue in crypto_destroy_instance Bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe() Bluetooth: Fix potential use-after-free when clear keys net: tcp: fix unexcepted socket die when snd_wnd is 0 selftests/bpf: Clean up fmod_ret in bench_rename test script ice: ice_aq_check_events: fix off-by-one check when filling buffer crypto: caam - fix unchecked return value error hwrng: iproc-rng200 - Implement suspend and resume calls lwt: Fix return values of BPF xmit ops lwt: Check LWTUNNEL_XMIT_CONTINUE strictly fs: ocfs2: namei: check return value of ocfs2_add_entry() wifi: mwifiex: fix memory leak in mwifiex_histogram_read() wifi: mwifiex: Fix missed return in oob checks failed path samples/bpf: fix broken map lookup probe wifi: ath9k: fix races between ath9k_wmi_cmd and ath9k_wmi_ctrl_rx wifi: ath9k: protect WMI command response buffer replacement with a lock wifi: mwifiex: avoid possible NULL skb pointer dereference Bluetooth: btusb: Do not call kfree_skb() under spin_lock_irqsave() wifi: ath9k: use IS_ERR() with debugfs_create_dir() net: arcnet: Do not call kfree_skb() under local_irq_disable() mlxsw: i2c: Fix chunk size setting in output mailbox buffer mlxsw: i2c: Limit single transaction buffer size hwmon: (tmp513) Fix the channel number in tmp51x_is_visible() net/sched: sch_hfsc: Ensure inner classes have fsc curve netrom: Deny concurrent connect(). drm/bridge: tc358764: Fix debug print parameter order quota: factor out dquot_write_dquot() quota: rename dquot_active() to inode_quota_active() quota: add new helper dquot_active() quota: fix dqput() to follow the guarantees dquot_srcu should provide ASoC: stac9766: fix build errors with REGMAP_AC97 soc: qcom: ocmem: Add OCMEM hardware version print soc: qcom: ocmem: Fix NUM_PORTS & NUM_MACROS macros arm64: dts: qcom: msm8996: Add missing interrupt to the USB2 controller drm/amdgpu: avoid integer overflow warning in amdgpu_device_resize_fb_bar() ARM: dts: BCM5301X: Harmonize EHCI/OHCI DT nodes name ARM: dts: BCM53573: Describe on-SoC BCM53125 rev 4 switch ARM: dts: BCM53573: Drop nonexistent #usb-cells ARM: dts: BCM53573: Add cells sizes to PCIe node ARM: dts: BCM53573: Use updated "spi-gpio" binding properties drm/etnaviv: fix dumping of active MMU context x86/mm: Fix PAT bit missing from page protection modify mask ARM: dts: s3c64xx: align pinctrl with dtschema ARM: dts: samsung: s3c6410-mini6410: correct ethernet reg addresses (split) ARM: dts: s5pv210: adjust node names to DT spec ARM: dts: s5pv210: add dummy 5V regulator for backlight on SMDKv210 ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split) drm: adv7511: Fix low refresh rate register for ADV7533/5 ARM: dts: BCM53573: Fix Ethernet info for Luxul devices arm64: dts: qcom: sdm845: Add missing RPMh power domain to GCC arm64: dts: qcom: sdm845: Fix the min frequency of "ice_core_clk" drm/amdgpu: Update min() to min_t() in 'amdgpu_info_ioctl' md/bitmap: don't set max_write_behind if there is no write mostly device md/md-bitmap: hold 'reconfig_mutex' in backlog_store() drm/tegra: Remove superfluous error messages around platform_get_irq() drm/tegra: dpaux: Fix incorrect return value of platform_get_irq of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name() drm/armada: Fix off-by-one error in armada_overlay_get_property() drm/panel: simple: Add missing connector type and pixel format for AUO T215HVN01 ima: Remove deprecated IMA_TRUSTED_KEYRING Kconfig drm: xlnx: zynqmp_dpsub: Add missing check for dma_set_mask drm/msm/mdp5: Don't leak some plane state firmware: meson_sm: fix to avoid potential NULL pointer dereference smackfs: Prevent underflow in smk_set_cipso() drm/amd/pm: fix variable dereferenced issue in amdgpu_device_attr_create() drm/msm/a2xx: Call adreno_gpu_init() earlier audit: fix possible soft lockup in __audit_inode_child() bus: ti-sysc: Fix build warning for 64-bit build drm/mediatek: Fix potential memory leak if vmap() fail bus: ti-sysc: Fix cast to enum warning of: unittest: Fix overlay type in apply/revert check ALSA: ac97: Fix possible error value of *rac97 ipmi:ssif: Add check for kstrdup ipmi:ssif: Fix a memory leak when scanning for an adapter drivers: clk: keystone: Fix parameter judgment in _of_pll_clk_init() clk: sunxi-ng: Modify mismatched function name clk: qcom: gcc-sc7180: use ARRAY_SIZE instead of specifying num_parents clk: qcom: gcc-sc7180: Fix up gcc_sdcc2_apps_clk_src ext4: correct grp validation in ext4_mb_good_group clk: qcom: gcc-sm8250: use ARRAY_SIZE instead of specifying num_parents clk: qcom: gcc-sm8250: Fix gcc_sdcc2_apps_clk_src clk: qcom: reset: Use the correct type of sleep/delay based on length PCI: Mark NVIDIA T4 GPUs to avoid bus reset pinctrl: mcp23s08: check return value of devm_kasprintf() PCI: pciehp: Use RMW accessors for changing LNKCTL PCI/ASPM: Use RMW accessors for changing LNKCTL clk: imx8mp: fix sai4 clock clk: imx: composite-8m: fix clock pauses when set_rate would be a no-op vfio/type1: fix cap_migration information leak powerpc/fadump: reset dump area size if fadump memory reserve fails powerpc/perf: Convert fsl_emb notifier to state machine callbacks drm/amdgpu: Use RMW accessors for changing LNKCTL drm/radeon: Use RMW accessors for changing LNKCTL net/mlx5: Use RMW accessors for changing LNKCTL wifi: ath10k: Use RMW accessors for changing LNKCTL powerpc: Don't include lppaca.h in paca.h powerpc/pseries: Rework lppaca_shared_proc() to avoid DEBUG_PREEMPT nfs/blocklayout: Use the passed in gfp flags powerpc/iommu: Fix notifiers being shared by PCI and VIO buses jfs: validate max amount of blocks before allocation. fs: lockd: avoid possible wrong NULL parameter NFSD: da_addr_body field missing in some GETDEVICEINFO replies NFS: Guard against READDIR loop when entry names exceed MAXNAMELEN NFSv4.2: fix handling of COPY ERR_OFFLOAD_NO_REQ media: ad5820: Drop unsupported ad5823 from i2c_ and of_device_id tables media: i2c: tvp5150: check return value of devm_kasprintf() media: v4l2-core: Fix a potential resource leak in v4l2_fwnode_parse_link() drivers: usb: smsusb: fix error handling code in smsusb_init_device media: dib7000p: Fix potential division by zero media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer() media: cx24120: Add retval check for cx24120_message_send() scsi: hisi_sas: Print SAS address for v3 hw erroneous completion print scsi: libsas: Introduce more SAM status code aliases in enum exec_status scsi: hisi_sas: Modify v3 HW SSP underflow error processing scsi: hisi_sas: Modify v3 HW SATA completion error processing scsi: hisi_sas: Fix warnings detected by sparse scsi: hisi_sas: Fix normally completed I/O analysed as failed media: rkvdec: increase max supported height for H.264 media: mediatek: vcodec: Return NULL if no vdec_fb is found usb: phy: mxs: fix getting wrong state with mxs_phy_is_otg_host() scsi: RDMA/srp: Fix residual handling scsi: iscsi: Rename iscsi_set_param() to iscsi_if_set_param() scsi: iscsi: Add length check for nlattr payload scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param() scsi: be2iscsi: Add length check when parsing nlattrs scsi: qla4xxx: Add length check when parsing nlattrs serial: sprd: Assign sprd_port after initialized to avoid wrong access serial: sprd: Fix DMA buffer leak issue x86/APM: drop the duplicate APM_MINOR_DEV macro scsi: qedf: Do not touch __user pointer in qedf_dbg_stop_io_on_error_cmd_read() directly scsi: qedf: Do not touch __user pointer in qedf_dbg_debug_cmd_read() directly scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read() directly coresight: tmc: Explicit type conversions to prevent integer overflow dma-buf/sync_file: Fix docs syntax driver core: test_async: fix an error code IB/uverbs: Fix an potential error pointer dereference fsi: aspeed: Reset master errors after CFAM reset iommu/qcom: Disable and reset context bank before programming iommu/vt-d: Fix to flush cache of PASID directory table media: go7007: Remove redundant if statement USB: gadget: f_mass_storage: Fix unused variable warning media: ov5640: Enable MIPI interface in ov5640_set_power_mipi() media: i2c: ov2680: Set V4L2_CTRL_FLAG_MODIFY_LAYOUT on flips media: ov2680: Remove auto-gain and auto-exposure controls media: ov2680: Fix ov2680_bayer_order() media: ov2680: Fix vflip / hflip set functions media: ov2680: Fix regulators being left enabled on ov2680_power_on() errors cgroup:namespace: Remove unused cgroup_namespaces_init() scsi: core: Use 32-bit hostnum in scsi_host_lookup() scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock serial: tegra: handle clk prepare error in tegra_uart_hw_init() amba: bus: fix refcount leak Revert "IB/isert: Fix incorrect release of isert connection" RDMA/siw: Balance the reference of cep->kref in the error path RDMA/siw: Correct wrong debug message HID: logitech-dj: Fix error handling in logi_dj_recv_switch_to_dj_mode() HID: multitouch: Correct devm device reference for hidinput input_dev name x86/speculation: Mark all Skylake CPUs as vulnerable to GDS tracing: Fix race issue between cpu buffer write and swap mtd: rawnand: brcmnand: Fix mtd oobsize phy/rockchip: inno-hdmi: use correct vco_div_5 macro on rk3328 phy/rockchip: inno-hdmi: round fractal pixclock in rk3328 recalc_rate phy/rockchip: inno-hdmi: do not power on rk3328 post pll on reg write rpmsg: glink: Add check for kstrdup mtd: spi-nor: Check bus width while setting QE bit mtd: rawnand: fsmc: handle clk prepare error in fsmc_nand_resume() um: Fix hostaudio build errors dmaengine: ste_dma40: Add missing IRQ check in d40_probe cpufreq: Fix the race condition while updating the transition_task of policy virtio_ring: fix avail_wrap_counter in virtqueue_add_packed igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c netfilter: xt_u32: validate user space input netfilter: xt_sctp: validate the flag_info count skbuff: skb_segment, Call zero copy functions before using skbuff frags igb: set max size RX buffer when store bad packet is enabled PM / devfreq: Fix leak in devfreq_dev_release() ALSA: pcm: Fix missing fixup call in compat hw_refine ioctl printk: ringbuffer: Fix truncating buffer size min_t cast scsi: core: Fix the scsi_set_resid() documentation ipmi_si: fix a memleak in try_smi_init() ARM: OMAP2+: Fix -Warray-bounds warning in _pwrdm_state_switch() backlight/gpio_backlight: Compare against struct fb_info.device backlight/bd6107: Compare against struct fb_info.device backlight/lv5207lp: Compare against struct fb_info.device xtensa: PMU: fix base address for the newer hardware arm64: csum: Fix OoB access in IP checksum code for negative lengths media: dvb: symbol fixup for dvb_attach() Revert "scsi: qla2xxx: Fix buffer overrun" scsi: mpt3sas: Perform additional retries if doorbell read returns 0 ntb: Drop packets when qp link is down ntb: Clean up tx tail index on link down ntb: Fix calculation ntb_transport_tx_free_entry() Revert "PCI: Mark NVIDIA T4 GPUs to avoid bus reset" procfs: block chmod on /proc/thread-self/comm parisc: Fix /proc/cpuinfo output for lscpu dlm: fix plock lookup when using multiple lockspaces dccp: Fix out of bounds access in DCCP error handler X.509: if signature is unsupported skip validation net: handle ARPHRD_PPP in dev_is_mac_header_xmit() fsverity: skip PKCS#7 parser when keyring is empty pstore/ram: Check start of empty przs during init s390/ipl: add missing secure/has_secure file to ipl type 'unknown' crypto: stm32 - fix loop iterating through scatterlist for DMA cpufreq: brcmstb-avs-cpufreq: Fix -Warray-bounds bug usb: typec: bus: verify partner exists in typec_altmode_attention USB: core: Unite old scheme and new scheme descriptor reads USB: core: Change usb_get_device_descriptor() API USB: core: Fix race by not overwriting udev->descriptor in hub_port_init() USB: core: Fix oversight in SuperSpeed initialization usb: typec: tcpci: clear the fault status bit tracing: Zero the pipe cpumask on alloc to avoid spurious -EBUSY md/md-bitmap: remove unnecessary local variable in backlog_store() udf: initialize newblock to 0 net/ipv6: SKB symmetric hash should incorporate transport ports io_uring: always lock in io_apoll_task_func io_uring: break out of iowq iopoll on teardown io_uring: break iopolling on signal scsi: qla2xxx: Fix deletion race condition scsi: qla2xxx: fix inconsistent TMF timeout scsi: qla2xxx: Fix erroneous link up failure scsi: qla2xxx: Turn off noisy message log scsi: qla2xxx: Remove unsupported ql2xenabledif option fbdev/ep93xx-fb: Do not assign to struct fb_info.dev drm/ast: Fix DRAM init on AST2200 lib/test_meminit: allocate pages up to order MAX_ORDER parisc: led: Fix LAN receive and transmit LEDs parisc: led: Reduce CPU overhead for disk & lan LED computation pinctrl: cherryview: fix address_space_handler() argument dt-bindings: clock: xlnx,versal-clk: drop select:false clk: imx: pll14xx: dynamically configure PLL for 393216000/361267200Hz clk: qcom: gcc-mdm9615: use proper parent for pll0_vote clock soc: qcom: qmi_encdec: Restrict string length in decode NFS: Fix a potential data corruption NFSv4/pnfs: minor fix for cleanup path in nfs4_get_device_info kconfig: fix possible buffer overflow backlight: gpio_backlight: Drop output GPIO direction check for initial power state perf annotate bpf: Don't enclose non-debug code with an assert() x86/virt: Drop unnecessary check on extended CPUID level in cpu_has_svm() perf top: Don't pass an ERR_PTR() directly to perf_session__delete() watchdog: intel-mid_wdt: add MODULE_ALIAS() to allow auto-load pwm: lpc32xx: Remove handling of PWM channels net/sched: fq_pie: avoid stalls in fq_pie_timer() sctp: annotate data-races around sk->sk_wmem_queued ipv4: annotate data-races around fi->fib_dead net: read sk->sk_family once in sk_mc_loop() drm/i915/gvt: Save/restore HW status to support GVT suspend/resume drm/i915/gvt: Drop unused helper intel_vgpu_reset_gtt() ipv4: ignore dst hint for multipath routes igb: disable virtualization features on 82580 veth: Fixing transmit return status for dropped packets net: ipv6/addrconf: avoid integer underflow in ipv6_create_tempaddr af_unix: Fix data-races around user->unix_inflight. af_unix: Fix data-race around unix_tot_inflight. af_unix: Fix data-races around sk->sk_shutdown. af_unix: Fix data race around sk->sk_err. net: sched: sch_qfq: Fix UAF in qfq_dequeue() kcm: Destroy mutex in kcm_exit_net() igc: Change IGC_MIN to allow set rx/tx value between 64 and 80 igbvf: Change IGBVF_MIN to allow set rx/tx value between 64 and 80 igb: Change IGB_MIN to allow set rx/tx value between 64 and 80 s390/zcrypt: don't leak memory if dev_set_name() fails idr: fix param name in idr_alloc_cyclic() doc ip_tunnels: use DEV_STATS_INC() net: dsa: sja1105: fix bandwidth discrepancy between tc-cbs software and offload net: dsa: sja1105: fix -ENOSPC when replacing the same tc-cbs too many times netfilter: nfnetlink_osf: avoid OOB read net: hns3: fix the port information display when sfp is absent sh: boards: Fix CEU buffer size passed to dma_declare_coherent_memory() ext4: add correct group descriptors and reserved GDT blocks to system zone ata: sata_gemini: Add missing MODULE_DESCRIPTION ata: pata_ftide010: Add missing MODULE_DESCRIPTION fuse: nlookup missing decrement in fuse_direntplus_link btrfs: don't start transaction when joining with TRANS_JOIN_NOSTART btrfs: use the correct superblock to compare fsid in btrfs_validate_super mtd: rawnand: brcmnand: Fix crash during the panic_write mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write mtd: rawnand: brcmnand: Fix potential false time out warning drm/amd/display: prevent potential division by zero errors perf hists browser: Fix hierarchy mode header perf tools: Handle old data in PERF_RECORD_ATTR perf hists browser: Fix the number of entries for 'e' key ACPI: APEI: explicit init of HEST and GHES in apci_init() arm64: sdei: abort running SDEI handlers during crash scsi: qla2xxx: If fcport is undergoing deletion complete I/O with retry scsi: qla2xxx: Consolidate zio threshold setting for both FCP & NVMe scsi: qla2xxx: Fix crash in PCIe error handling scsi: qla2xxx: Flush mailbox commands on chip reset ARM: dts: samsung: exynos4210-i9100: Fix LCD screen's physical size ARM: dts: BCM5301X: Extend RAM to full 256MB for Linksys EA6500 V2 bus: mhi: host: Skip MHI reset if device is in RDDM net: ipv4: fix one memleak in __inet_del_ifa() selftests/kselftest/runner/run_one(): allow running non-executable files kselftest/runner.sh: Propagate SIGTERM to runner child net/smc: use smc_lgr_list.lock to protect smc_lgr_list.list iterate in smcr_port_add net: ethernet: mvpp2_main: fix possible OOB write in mvpp2_ethtool_get_rxnfc() net: ethernet: mtk_eth_soc: fix possible NULL pointer dereference in mtk_hwlro_get_fdir_all() hsr: Fix uninit-value access in fill_frame_info() r8152: check budget for r8152_poll() kcm: Fix memory leak in error path of kcm_sendmsg() platform/mellanox: mlxbf-tmfifo: Drop the Rx packet if no more descriptors platform/mellanox: mlxbf-tmfifo: Drop jumbo frames net/tls: do not free tls_rec on async operation in bpf_exec_tx_verdict() ipv6: fix ip6_sock_set_addr_preferences() typo ixgbe: fix timestamp configuration code kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg(). drm/amd/display: Fix a bug when searching for insert_above_mpcc parisc: Drop loops_per_jiffy from per_cpu struct Linux 5.10.195 Change-Id: I4eef618f573b6d4201e05c9cf56088d77d712d97 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-09-19 11:32:32 +00:00
Jordan Rife	42714d3d70	net: Avoid address overwrite in kernel_connect ... commit 0bdf399342 upstream. BPF programs that run on connect can rewrite the connect address. For the connect system call this isn't a problem, because a copy of the address is made when it is moved into kernel space. However, kernel_connect simply passes through the address it is given, so the caller may observe its address value unexpectedly change. A practical example where this is problematic is where NFS is combined with a system such as Cilium which implements BPF-based load balancing. A common pattern in software-defined storage systems is to have an NFS mount that connects to a persistent virtual IP which in turn maps to an ephemeral server IP. This is usually done to achieve high availability: if your server goes down you can quickly spin up a replacement and remap the virtual IP to that endpoint. With BPF-based load balancing, mounts will forget the virtual IP address when the address rewrite occurs because a pointer to the only copy of that address is passed down the stack. Server failover then breaks, because clients have forgotten the virtual IP address. Reconnects fail and mounts remain broken. This patch was tested by setting up a scenario like this and ensuring that NFS reconnects worked after applying the patch. Signed-off-by: Jordan Rife <jrife@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-09-19 12:20:06 +02:00
Greg Kroah-Hartman	49c25af89c	Revert "bpf: Remove extra lock_sock for TCP_ZEROCOPY_RECEIVE" ... This reverts commit 08f61a3491 which is commit 9cacf81f81 upstream. It breaks the Android abi. If it is required in the future, it can come back in an abi-safe way. Bug: 161946584 Change-Id: I83c4a094c650eee44a2f7160aab6ccc6e442e726 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-08-04 11:36:48 +00:00
Greg Kroah-Hartman	477f5e6b9e	Merge 5.10.188 into android12-5.10-lts ... Changes in 5.10.188 media: atomisp: fix "variable dereferenced before check 'asd'" x86/smp: Use dedicated cache-line for mwait_play_dead() can: isotp: isotp_sendmsg(): fix return error fix on TX path video: imsttfb: check for ioremap() failures fbdev: imsttfb: Fix use after free bug in imsttfb_probe HID: wacom: Use ktime_t rather than int when dealing with timestamps HID: logitech-hidpp: add HIDPP_QUIRK_DELAYED_INIT for the T651. Revert "thermal/drivers/mediatek: Use devm_of_iomap to avoid resource leak in mtk_thermal_probe" scripts/tags.sh: Resolve gtags empty index generation drm/amdgpu: Validate VM ioctl flags. nubus: Partially revert proc_create_single_data() conversion fs: pipe: reveal missing function protoypes x86/resctrl: Only show tasks' pid in current pid namespace blk-iocost: use spin_lock_irqsave in adjust_inuse_and_calc_cost md/raid10: check slab-out-of-bounds in md_bitmap_get_counter md/raid10: fix overflow of md/safe_mode_delay md/raid10: fix wrong setting of max_corr_read_errors md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request md/raid10: fix io loss while replacement replace rdev irqchip/jcore-aic: Kill use of irq_create_strict_mappings() irqchip/jcore-aic: Fix missing allocation of IRQ descriptors posix-timers: Prevent RT livelock in itimer_delete() tracing/timer: Add missing hrtimer modes to decode_hrtimer_mode(). clocksource/drivers/cadence-ttc: Fix memory leak in ttc_timer_probe PM: domains: fix integer overflow issues in genpd_parse_state() perf/arm-cmn: Fix DTC reset powercap: RAPL: Fix CONFIG_IOSF_MBI dependency ARM: 9303/1: kprobes: avoid missing-declaration warnings cpufreq: intel_pstate: Fix energy_performance_preference for passive thermal/drivers/sun8i: Fix some error handling paths in sun8i_ths_probe() rcuscale: Console output claims too few grace periods rcuscale: Always log error message rcuscale: Move shutdown from wait_event() to wait_event_idle() rcu/rcuscale: Move rcu_scale_*() after kfree_scale_cleanup() rcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading rcuscale perf/ibs: Fix interface via core pmu events x86/mm: Fix __swp_entry_to_pte() for Xen PV guests evm: Complete description of evm_inode_setattr() ima: Fix build warnings pstore/ram: Add check for kstrdup igc: Enable and fix RX hash usage by netstack wifi: ath9k: fix AR9003 mac hardware hang check register offset calculation wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx samples/bpf: Fix buffer overflow in tcp_basertt spi: spi-geni-qcom: Correct CS_TOGGLE bit in SPI_TRANS_CFG wifi: wilc1000: fix for absent RSN capabilities WFA testcase wifi: mwifiex: Fix the size of a memory allocation in mwifiex_ret_802_11_scan() bpf: Remove extra lock_sock for TCP_ZEROCOPY_RECEIVE sctp: add bpf_bypass_getsockopt proto callback libbpf: fix offsetof() and container_of() to work with CO-RE nfc: constify several pointers to u8, char and sk_buff nfc: llcp: fix possible use of uninitialized variable in nfc_llcp_send_connect() bpftool: JIT limited misreported as negative value on aarch64 regulator: core: Fix more error checking for debugfs_create_dir() regulator: core: Streamline debugfs operations wifi: orinoco: Fix an error handling path in spectrum_cs_probe() wifi: orinoco: Fix an error handling path in orinoco_cs_probe() wifi: atmel: Fix an error handling path in atmel_probe() wl3501_cs: Fix misspelling and provide missing documentation net: create netdev->dev_addr assignment helpers wl3501_cs: use eth_hw_addr_set() wifi: wl3501_cs: Fix an error handling path in wl3501_probe() wifi: ray_cs: Utilize strnlen() in parse_addr() wifi: ray_cs: Drop useless status variable in parse_addr() wifi: ray_cs: Fix an error handling path in ray_probe() wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes wifi: rsi: Do not configure WoWlan in shutdown hook if not enabled wifi: rsi: Do not set MMC_PM_KEEP_POWER in shutdown watchdog/perf: define dummy watchdog_update_hrtimer_threshold() on correct config watchdog/perf: more properly prevent false positives with turbo modes kexec: fix a memory leak in crash_shrink_memory() memstick r592: make memstick_debug_get_tpc_name() static wifi: ath9k: Fix possible stall on ath9k_txq_list_has_key() rtnetlink: extend RTEXT_FILTER_SKIP_STATS to IFLA_VF_INFO wifi: iwlwifi: pull from TXQs with softirqs disabled wifi: cfg80211: rewrite merging of inherited elements wifi: ath9k: convert msecs to jiffies where needed igc: Fix race condition in PTP tx code net: stmmac: fix double serdes powerdown netlink: fix potential deadlock in netlink_set_err() netlink: do not hard code device address lenth in fdb dumps selftests: rtnetlink: remove netdevsim device after ipsec offload test gtp: Fix use-after-free in __gtp_encap_destroy(). net: axienet: Move reset before 64-bit DMA detection sfc: fix crash when reading stats while NIC is resetting nfc: llcp: simplify llcp_sock_connect() error paths net: nfc: Fix use-after-free caused by nfc_llcp_find_local lib/ts_bm: reset initial match offset for every block of text netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one netfilter: nf_conntrack_sip: fix the ct_sip_parse_numerical_param() return value. ipvlan: Fix return value of ipvlan_queue_xmit() netlink: Add __sock_i_ino() for __netlink_diag_dump(). radeon: avoid double free in ci_dpm_init() drm/amd/display: Explicitly specify update type per plane info change Input: drv260x - sleep between polling GO bit drm/bridge: tc358768: always enable HS video mode drm/bridge: tc358768: fix PLL parameters computation drm/bridge: tc358768: fix PLL target frequency drm/bridge: tc358768: fix TCLK_ZEROCNT computation drm/bridge: tc358768: Add atomic_get_input_bus_fmts() implementation drm/bridge: tc358768: fix TCLK_TRAILCNT computation drm/bridge: tc358768: fix THS_ZEROCNT computation drm/bridge: tc358768: fix TXTAGOCNT computation drm/bridge: tc358768: fix THS_TRAILCNT computation drm/vram-helper: fix function names in vram helper doc ARM: dts: BCM5301X: Drop "clock-names" from the SPI node ARM: dts: meson8b: correct uart_B and uart_C clock references Input: adxl34x - do not hardcode interrupt trigger type drm: sun4i_tcon: use devm_clk_get_enabled in `sun4i_tcon_init_clocks` drm/panel: sharp-ls043t1le01: adjust mode settings ARM: dts: stm32: Move ethernet MAC EEPROM from SoM to carrier boards bus: ti-sysc: Fix dispc quirk masking bool variables arm64: dts: microchip: sparx5: do not use PSCI on reference boards RDMA/bnxt_re: Disable/kill tasklet only if it is enabled RDMA/bnxt_re: Fix to remove unnecessary return labels RDMA/bnxt_re: Use unique names while registering interrupts RDMA/bnxt_re: Remove a redundant check inside bnxt_re_update_gid RDMA/bnxt_re: Fix to remove an unnecessary log ARM: dts: gta04: Move model property out of pinctrl node arm64: dts: qcom: msm8916: correct camss unit address arm64: dts: qcom: msm8994: correct SPMI unit address arm64: dts: qcom: msm8996: correct camss unit address drm/panel: simple: fix active size for Ampire AM-480272H3TMQW-T01H ARM: ep93xx: fix missing-prototype warnings ARM: omap2: fix missing tick_broadcast() prototype arm64: dts: qcom: apq8096: fix fixed regulator name property ARM: dts: stm32: Shorten the AV96 HDMI sound card name memory: brcmstb_dpfe: fix testing array offset after use ASoC: es8316: Increment max value for ALC Capture Target Volume control ASoC: es8316: Do not set rate constraints for unsupported MCLKs ARM: dts: meson8: correct uart_B and uart_C clock references soc/fsl/qe: fix usb.c build errors IB/hfi1: Use bitmap_zalloc() when applicable IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors IB/hfi1: Fix wrong mmu_node used for user SDMA packet after invalidate RDMA: Remove uverbs_ex_cmd_mask values that are linked to functions RDMA/hns: Fix coding style issues RDMA/hns: Use refcount_t APIs for HEM RDMA/hns: Clean the hardware related code for HEM RDMA/hns: Fix hns_roce_table_get return value ARM: dts: iwg20d-q7-common: Fix backlight pwm specifier arm64: dts: renesas: ulcb-kf: Remove flow control for SCIF1 fbdev: omapfb: lcd_mipid: Fix an error handling path in mipid_spi_probe() arm64: dts: ti: k3-j7200: Fix physical address of pin ARM: dts: stm32: Fix audio routing on STM32MP15xx DHCOM PDK2 ARM: dts: stm32: fix i2s endpoint format property for stm32mp15xx-dkx hwmon: (gsc-hwmon) fix fan pwm temperature scaling hwmon: (adm1275) enable adm1272 temperature reporting hwmon: (adm1275) Allow setting sample averaging hwmon: (pmbus/adm1275) Fix problems with temperature monitoring on ADM1272 ARM: dts: BCM5301X: fix duplex-full => full-duplex drm/amdkfd: Fix potential deallocation of previously deallocated memory. drm/radeon: fix possible division-by-zero errors amdgpu: validate offset_in_bo of drm_amdgpu_gem_va RDMA/bnxt_re: wraparound mbox producer index RDMA/bnxt_re: Avoid calling wake_up threads from spin_lock context clk: imx: clk-imx8mn: fix memory leak in imx8mn_clocks_probe clk: imx: clk-imx8mp: improve error handling in imx8mp_clocks_probe() clk: tegra: tegra124-emc: Fix potential memory leak ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer drm/msm/dpu: do not enable color-management if DSPPs are not available drm/msm/dp: Free resources after unregistering them clk: vc5: check memory returned by kasprintf() clk: cdce925: check return value of kasprintf() clk: si5341: Allow different output VDD_SEL values clk: si5341: Add sysfs properties to allow checking/resetting device faults clk: si5341: return error if one synth clock registration fails clk: si5341: check return value of {devm_}kasprintf() clk: si5341: free unused memory on probe failure clk: keystone: sci-clk: check return value of kasprintf() clk: ti: clkctrl: check return value of kasprintf() drivers: meson: secure-pwrc: always enable DMA domain ovl: update of dentry revalidate flags after copy up ASoC: imx-audmix: check return value of devm_kasprintf() PCI: cadence: Fix Gen2 Link Retraining process scsi: qedf: Fix NULL dereference in error handling pinctrl: bcm2835: Handle gpiochip_add_pin_range() errors PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free scsi: 3w-xxxx: Add error handling for initialization failure in tw_probe() PCI: pciehp: Cancel bringup sequence if card is not present PCI: ftpci100: Release the clock resources PCI: Add pci_clear_master() stub for non-CONFIG_PCI perf bench: Use unbuffered output when pipe/tee'ing to a file perf bench: Add missing setlocale() call to allow usage of %'d style formatting pinctrl: cherryview: Return correct value if pin in push-pull mode kcsan: Don't expect 64 bits atomic builtins from 32 bits architectures perf script: Fixup 'struct evsel_script' method prefix perf script: Fix allocation of evsel->priv related to per-event dump files perf dwarf-aux: Fix off-by-one in die_get_varname() pinctrl: at91-pio4: check return value of devm_kasprintf() powerpc/powernv/sriov: perform null check on iov before dereferencing iov mm: rename pud_page_vaddr to pud_pgtable and make it return pmd_t * mm: rename p4d_page_vaddr to p4d_pgtable and make it return pud_t * powerpc/book3s64/mm: Fix DirectMap stats in /proc/meminfo powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary hwrng: virtio - add an internal buffer hwrng: virtio - don't wait on cleanup hwrng: virtio - don't waste entropy hwrng: virtio - always add a pending request hwrng: virtio - Fix race on data_avail and actual data crypto: nx - fix build warnings when DEBUG_FS is not enabled modpost: fix section mismatch message for R_ARM_ABS32 modpost: fix section mismatch message for R_ARM_{PC24,CALL,JUMP24} crypto: marvell/cesa - Fix type mismatch warning modpost: fix off by one in is_executable_section() ARC: define ASM_NL and __ALIGN(_STR) outside #ifdef __ASSEMBLY__ guard NFSv4.1: freeze the session table upon receiving NFS4ERR_BADSESSION dax: Fix dax_mapping_release() use after free dax: Introduce alloc_dev_dax_id() hwrng: st - keep clock enabled while hwrng is registered io_uring: ensure IOPOLL locks around deferred work USB: serial: option: add LARA-R6 01B PIDs usb: dwc3: gadget: Propagate core init errors to UDC during pullup phy: tegra: xusb: Clear the driver reference in usb-phy dev block: fix signed int overflow in Amiga partition support block: change all __u32 annotations to __be32 in affs_hardblocks.h SUNRPC: Fix UAF in svc_tcp_listen_data_ready() w1: w1_therm: fix locking behavior in convert_t w1: fix loop in w1_fini() sh: j2: Use ioremap() to translate device tree address into kernel memory serial: 8250: omap: Fix freeing of resources on failed register clk: qcom: gcc-ipq6018: Use floor ops for sdcc clocks media: usb: Check az6007_read() return value media: videodev2.h: Fix struct v4l2_input tuner index comment media: usb: siano: Fix warning due to null work_func_t function pointer clk: qcom: reset: Allow specifying custom reset delay clk: qcom: reset: support resetting multiple bits clk: qcom: ipq6018: fix networking resets usb: dwc3: qcom: Fix potential memory leak usb: gadget: u_serial: Add null pointer check in gserial_suspend extcon: Fix kernel doc of property fields to avoid warnings extcon: Fix kernel doc of property capability fields to avoid warnings usb: phy: phy-tahvo: fix memory leak in tahvo_usb_probe() usb: hide unused usbfs_notify_suspend/resume functions serial: 8250: lock port for stop_rx() in omap8250_irq() serial: 8250: lock port for UART_IER access in omap8250_irq() kernfs: fix missing kernfs_idr_lock to remove an ID from the IDR coresight: Fix loss of connection info when a module is unloaded mfd: rt5033: Drop rt5033-battery sub-device media: venus: helpers: Fix ALIGN() of non power of two media: atomisp: gmin_platform: fix out_len in gmin_get_config_dsm_var() KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes usb: dwc3: qcom: Release the correct resources in dwc3_qcom_remove() usb: dwc3: qcom: Fix an error handling path in dwc3_qcom_probe() usb: common: usb-conn-gpio: Set last role to unknown before initial detection usb: dwc3-meson-g12a: Fix an error handling path in dwc3_meson_g12a_probe() mfd: intel-lpss: Add missing check for platform_get_resource Revert "usb: common: usb-conn-gpio: Set last role to unknown before initial detection" serial: 8250_omap: Use force_suspend and resume for system suspend test_firmware: return ENOMEM instead of ENOSPC on failed memory allocation mfd: stmfx: Fix error path in stmfx_chip_init mfd: stmfx: Nullify stmfx->vdd in case of error KVM: s390: vsie: fix the length of APCB bitmap mfd: stmpe: Only disable the regulators if they are enabled phy: tegra: xusb: check return value of devm_kzalloc() pwm: imx-tpm: force 'real_period' to be zero in suspend pwm: sysfs: Do not apply state to already disabled PWMs rtc: st-lpc: Release some resources in st_rtc_probe() in case of error media: cec: i2c: ch7322: also select REGMAP sctp: fix potential deadlock on &net->sctp.addr_wq_lock Add MODULE_FIRMWARE() for FIRMWARE_TG357766. net: dsa: vsc73xx: fix MTU configuration spi: bcm-qspi: return error if neither hif_mspi nor mspi is available mailbox: ti-msgmgr: Fill non-message tx data fields with 0x0 f2fs: fix error path handling in truncate_dnode() octeontx2-af: Fix mapping for NIX block from CGX connection powerpc: allow PPC_EARLY_DEBUG_CPM only when SERIAL_CPM=y net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode tcp: annotate data races in __tcp_oow_rate_limited() xsk: Honor SO_BINDTODEVICE on bind net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX pptp: Fix fib lookup calls. net: dsa: tag_sja1105: fix MAC DA patching from meta frames s390/qeth: Fix vipa deletion sh: dma: Fix DMA channel offset calculation apparmor: fix missing error check for rhashtable_insert_fast i2c: xiic: Defer xiic_wakeup() and __xiic_start_xfer() in xiic_process() i2c: xiic: Don't try to handle more interrupt events after error ALSA: jack: Fix mutex call in snd_jack_report() i2c: qup: Add missing unwind goto in qup_i2c_probe() NFSD: add encoding of op_recall flag for write delegation io_uring: wait interruptibly for request completions on exit mmc: core: disable TRIM on Kingston EMMC04G-M627 mmc: core: disable TRIM on Micron MTFC4GACAJCN-1M mmc: mmci: Set PROBE_PREFER_ASYNCHRONOUS mmc: sdhci: fix DMA configure compatibility issue when 64bit DMA mode is used. bcache: fixup btree_cache_wait list damage bcache: Remove unnecessary NULL point check in node allocations bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent um: Use HOST_DIR for mrproper integrity: Fix possible multiple allocation in integrity_inode_get() autofs: use flexible array in ioctl structure shmem: use ramfs_kill_sb() for kill_sb method of ramfs-based tmpfs jffs2: reduce stack usage in jffs2_build_xattr_subsystem() fs: avoid empty option when generating legacy mount string ext4: Remove ext4 locking of moved directory Revert "f2fs: fix potential corruption when moving a directory" fs: Establish locking order for unrelated directories fs: Lock moved directories btrfs: add handling for RAID1C23/DUP to btrfs_reduce_alloc_profile btrfs: fix race when deleting quota root from the dirty cow roots list ASoC: mediatek: mt8173: Fix irq error path ASoC: mediatek: mt8173: Fix snd_soc_component_initialize error path ARM: orion5x: fix d2net gpio initialization leds: trigger: netdev: Recheck NETDEV_LED_MODE_LINKUP on dev rename fs: no need to check source fanotify: disallow mount/sb marks on kernel internal pseudo fs tpm, tpm_tis: Claim locality in interrupt handler selftests/bpf: Add verifier test for PTR_TO_MEM spill block: add overflow checks for Amiga partition support sh: pgtable-3level: Fix cast to pointer from integer of different size netfilter: nf_tables: use net_generic infra for transaction data netfilter: nf_tables: add rescheduling points during loop detection walks netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE netfilter: nf_tables: fix chain binding transaction logic netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain netfilter: nf_tables: reject unbound anonymous set before commit phase netfilter: nf_tables: reject unbound chain set before commit phase netfilter: nftables: rename set element data activation/deactivation functions netfilter: nf_tables: drop map element references from preparation phase netfilter: nf_tables: unbind non-anonymous set if rule construction fails netfilter: nf_tables: fix scheduling-while-atomic splat netfilter: conntrack: Avoid nf_ct_helper_hash uses after free netfilter: nf_tables: do not ignore genmask when looking up chain by id netfilter: nf_tables: prevent OOB access in nft_byteorder_eval wireguard: queueing: use saner cpu selection wrapping wireguard: netlink: send staged packets when setting initial private key tty: serial: fsl_lpuart: add earlycon for imx8ulp platform rcu-tasks: Mark ->trc_reader_nesting data races rcu-tasks: Mark ->trc_reader_special.b.need_qs data races rcu-tasks: Simplify trc_read_check_handler() atomic operations block/partition: fix signedness issue for Amiga partitions io_uring: Use io_schedule* in cqring wait io_uring: add reschedule point to handle_tw_list() net: lan743x: Don't sleep in atomic context workqueue: clean up WORK_* constant types, clarify masking drm/panel: simple: Add connector_type for innolux_at043tn24 drm/panel: simple: Add Powertip PH800480T013 drm_display_mode flags igc: Remove delay during TX ring configuration net/mlx5e: fix double free in mlx5e_destroy_flow_table net/mlx5e: Check for NOT_READY flag state after locking igc: set TP bit in 'supported' and 'advertising' fields of ethtool_link_ksettings scsi: qla2xxx: Fix error code in qla2x00_start_sp() net: mvneta: fix txq_map in case of txq_number==1 net/sched: cls_fw: Fix improper refcount update leads to use-after-free gve: Set default duplex configuration to full ionic: remove WARN_ON to prevent panic_on_warn net: bgmac: postpone turning IRQs off to avoid SoC hangs net: prevent skb corruption on frag list segmentation icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev(). udp6: fix udp6_ehashfn() typo ntb: idt: Fix error handling in idt_pci_driver_init() NTB: amd: Fix error handling in amd_ntb_pci_driver_init() ntb: intel: Fix error handling in intel_ntb_pci_driver_init() NTB: ntb_transport: fix possible memory leak while device_register() fails NTB: ntb_tool: Add check for devm_kcalloc ipv6/addrconf: fix a potential refcount underflow for idev platform/x86: wmi: remove unnecessary argument platform/x86: wmi: use guid_t and guid_equal() platform/x86: wmi: move variables platform/x86: wmi: Break possible infinite loop when parsing GUID igc: Fix launchtime before start of cycle igc: Fix inserting of empty frame for launchtime riscv: bpf: Move bpf_jit_alloc_exec() and bpf_jit_free_exec() to core riscv: bpf: Avoid breaking W^X bpf, riscv: Support riscv jit to provide bpf_line_info riscv, bpf: Fix inconsistent JIT image generation erofs: avoid infinite loop in z_erofs_do_read_page() when reading beyond EOF wifi: airo: avoid uninitialized warning in airo_get_rate() net/sched: flower: Ensure both minimum and maximum ports are specified netdevsim: fix uninitialized data in nsim_dev_trap_fa_cookie_write() net/sched: make psched_mtu() RTNL-less safe net/sched: sch_qfq: refactor parsing of netlink parameters net/sched: sch_qfq: account for stab overhead in qfq_enqueue nvme-pci: fix DMA direction of unmapping integrity data f2fs: fix to avoid NULL pointer dereference f2fs_write_end_io() pinctrl: amd: Fix mistake in handling clearing pins at startup pinctrl: amd: Detect internal GPIO0 debounce handling pinctrl: amd: Only use special debounce behavior for GPIO 0 tpm: tpm_vtpm_proxy: fix a race condition in /dev/vtpmx creation mtd: rawnand: meson: fix unaligned DMA buffers handling net: bcmgenet: Ensure MDIO unregistration has clocks enabled powerpc: Fail build if using recordmcount with binutils v2.37 misc: fastrpc: Create fastrpc scalar with correct buffer count erofs: fix compact 4B support for 16k block size MIPS: Loongson: Fix cpu_probe_loongson() again ext4: Fix reusing stale buffer heads from last failed mounting ext4: fix wrong unit use in ext4_mb_clear_bb ext4: get block from bh in ext4_free_blocks for fast commit replay ext4: fix wrong unit use in ext4_mb_new_blocks ext4: only update i_reserved_data_blocks on successful block allocation jfs: jfs_dmap: Validate db_l2nbperpage while mounting hwrng: imx-rngc - fix the timeout for init and self check PCI/PM: Avoid putting EloPOS E2/S2/H2 PCIe Ports in D3cold PCI: Add function 1 DMA alias quirk for Marvell 88SE9235 PCI: qcom: Disable write access to read only registers for IP v2.3.3 PCI: rockchip: Assert PCI Configuration Enable bit after probe PCI: rockchip: Write PCI Device ID to correct register PCI: rockchip: Add poll and timeout to wait for PHY PLLs to be locked PCI: rockchip: Fix legacy IRQ generation for RK3399 PCIe endpoint core PCI: rockchip: Use u32 variable to access 32-bit registers PCI: rockchip: Set address alignment for endpoint mode misc: pci_endpoint_test: Free IRQs before removing the device misc: pci_endpoint_test: Re-init completion for every test md/raid0: add discard support for the 'original' layout fs: dlm: return positive pid value for F_GETLK drm/atomic: Allow vblank-enabled + self-refresh "disable" drm/rockchip: vop: Leave vblank enabled in self-refresh drm/amd/display: Correct `DMUB_FW_VERSION` macro serial: atmel: don't enable IRQs prematurely tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() in case of error tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() when iterating clk firmware: stratix10-svc: Fix a potential resource leak in svc_create_memory_pool() ceph: don't let check_caps skip sending responses for revoke msgs xhci: Fix resume issue of some ZHAOXIN hosts xhci: Fix TRB prefetch issue of ZHAOXIN hosts xhci: Show ZHAOXIN xHCI root hub speed correctly meson saradc: fix clock divider mask length Revert "8250: add support for ASIX devices with a FIFO bug" s390/decompressor: fix misaligned symbol build error tracing/histograms: Add histograms to hist_vars if they have referenced variables samples: ftrace: Save required argument registers in sample trampolines net: ena: fix shift-out-of-bounds in exponential backoff ring-buffer: Fix deadloop issue on reading trace_pipe xtensa: ISS: fix call to split_if_spec tracing: Fix null pointer dereference in tracing_err_log_open() tracing/probes: Fix not to count error code to total length scsi: qla2xxx: Wait for io return on terminate rport scsi: qla2xxx: Array index may go out of bound scsi: qla2xxx: Fix buffer overrun scsi: qla2xxx: Fix potential NULL pointer dereference scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport() scsi: qla2xxx: Correct the index of array scsi: qla2xxx: Pointer may be dereferenced scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue net/sched: sch_qfq: reintroduce lmax bound check for MTU RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests drm/atomic: Fix potential use-after-free in nonblocking commits ALSA: hda/realtek - remove 3k pull low procedure ALSA: hda/realtek: Enable Mute LED on HP Laptop 15s-eq2xxx keys: Fix linking a duplicate key to a keyring's assoc_array perf probe: Add test for regression introduced by switch to die_get_decl_file() btrfs: fix warning when putting transaction with qgroups enabled after abort fuse: revalidate: don't invalidate if interrupted selftests: tc: set timeout to 15 minutes selftests: tc: add 'ct' action kconfig dep regmap: Drop initial version of maximum transfer length fixes regmap: Account for register length in SMBus I/O limits can: bcm: Fix UAF in bcm_proc_show() drm/client: Fix memory leak in drm_client_target_cloned drm/client: Fix memory leak in drm_client_modeset_probe ASoC: fsl_sai: Disable bit clock with transmitter ext4: correct inline offset when handling xattrs in inode body debugobjects: Recheck debug_objects_enabled before reporting nbd: Add the maximum limit of allocated index in nbd_dev_add md: fix data corruption for raid456 when reshape restart while grow up md/raid10: prevent soft lockup while flush writes posix-timers: Ensure timer ID search-loop limit is valid btrfs: add xxhash to fast checksum implementations ACPI: button: Add lid disable DMI quirk for Nextbook Ares 8A ACPI: video: Add backlight=native DMI quirk for Apple iMac11,3 ACPI: video: Add backlight=native DMI quirk for Lenovo ThinkPad X131e (3371 AMD version) arm64: set __exception_irq_entry with __irq_entry as a default arm64: mm: fix VA-range sanity check sched/fair: Don't balance task to its current running CPU wifi: ath11k: fix registration of 6Ghz-only phy without the full channel range bpf: Address KCSAN report on bpf_lru_list devlink: report devlink_port_type_warn source device wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point() wifi: iwlwifi: mvm: avoid baid size integer overflow igb: Fix igb_down hung on surprise removal spi: bcm63xx: fix max prepend length fbdev: imxfb: warn about invalid left/right margin pinctrl: amd: Use amd_pinconf_set() for all config options net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()/cpsw_ale_set_field() bridge: Add extack warning when enabling STP in netns. iavf: Fix use-after-free in free_netdev iavf: Fix out-of-bounds when setting channels on remove security: keys: Modify mismatched function name octeontx2-pf: Dont allocate BPIDs for LBK interfaces tcp: annotate data-races around tcp_rsk(req)->ts_recent net: ipv4: Use kfree_sensitive instead of kfree net:ipv6: check return value of pskb_trim() Revert "tcp: avoid the lookup process failing to get sk in ehash table" fbdev: au1200fb: Fix missing IRQ check in au1200fb_drv_probe llc: Don't drop packet from non-root netns. netfilter: nf_tables: fix spurious set element insertion failure netfilter: nf_tables: can't schedule in nft_chain_validate netfilter: nft_set_pipapo: fix improper element removal netfilter: nf_tables: skip bound chain in netns release path netfilter: nf_tables: skip bound chain on rule flush tcp: annotate data-races around tp->tcp_tx_delay tcp: annotate data-races around tp->keepalive_time tcp: annotate data-races around tp->keepalive_intvl tcp: annotate data-races around tp->keepalive_probes net: Introduce net.ipv4.tcp_migrate_req. tcp: Fix data-races around sysctl_tcp_syn(ack)?_retries. tcp: annotate data-races around icsk->icsk_syn_retries tcp: annotate data-races around tp->linger2 tcp: annotate data-races around rskq_defer_accept tcp: annotate data-races around tp->notsent_lowat tcp: annotate data-races around icsk->icsk_user_timeout tcp: annotate data-races around fastopenq.max_qlen net: phy: prevent stale pointer dereference in phy_init() tracing/histograms: Return an error if we fail to add histogram to hist_vars list tracing: Fix memory leak of iter->temp when reading trace_pipe ftrace: Store the order of pages allocated in ftrace_page ftrace: Fix possible warning on checking all pages used in ftrace_process_locs() Linux 5.10.188 Change-Id: Ibcc1adc43df5b8f649b12078eedd5d4f57de4578 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-08-03 11:23:27 +00:00
Stanislav Fomichev	08f61a3491	bpf: Remove extra lock_sock for TCP_ZEROCOPY_RECEIVE ... [ Upstream commit 9cacf81f81 ] Add custom implementation of getsockopt hook for TCP_ZEROCOPY_RECEIVE. We skip generic hooks for TCP_ZEROCOPY_RECEIVE and have a custom call in do_tcp_getsockopt using the on-stack data. This removes 3% overhead for locking/unlocking the socket. Without this patch: 3.38% 0.07% tcp_mmap [kernel.kallsyms] [k] __cgroup_bpf_run_filter_getsockopt | --3.30%--__cgroup_bpf_run_filter_getsockopt | --0.81%--__kmalloc With the patch applied: 0.52% 0.12% tcp_mmap [kernel.kallsyms] [k] __cgroup_bpf_run_filter_getsockopt_kern Note, exporting uapi/tcp.h requires removing netinet/tcp.h from test_progs.h because those headers have confliciting definitions. Signed-off-by: Stanislav Fomichev <sdf@google.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Martin KaFai Lau <kafai@fb.com> Link: https://lore.kernel.org/bpf/20210115163501.805133-2-sdf@google.com Stable-dep-of: 2598619e01 ("sctp: add bpf_bypass_getsockopt proto callback") Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-07-27 08:43:37 +02:00
Greg Kroah-Hartman	6d62ca19a7	Merge 5.10.181 into android12-5.10-lts ... Changes in 5.10.181 driver core: add a helper to setup both the of_node and fwnode of a device drm/mipi-dsi: Set the fwnode for mipi_dsi_device ARM: 9296/1: HP Jornada 7XX: fix kernel-doc warnings net: mdio: mvusb: Fix an error handling path in mvusb_mdio_probe() linux/dim: Do nothing if no time delta between samples net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs(). netfilter: conntrack: fix possible bug_on with enable_hooks=1 netlink: annotate accesses to nlk->cb_running net: annotate sk->sk_err write from do_recvmmsg() net: deal with most data-races in sk_wait_event() net: tap: check vlan with eth_type_vlan() method net: add vlan_get_protocol_and_depth() helper tcp: factor out __tcp_close() helper tcp: add annotations around sk->sk_shutdown accesses ipvlan:Fix out-of-bounds caused by unclear skb->cb net: datagram: fix data-races in datagram_poll() af_unix: Fix a data race of sk->sk_receive_queue->qlen. af_unix: Fix data races around sk->sk_shutdown. drm/i915/dp: prevent potential div-by-zero fbdev: arcfb: Fix error handling in arcfb_probe() ext4: remove an unused variable warning with CONFIG_QUOTA=n ext4: reflect error codes from ext4_multi_mount_protect() to its callers ext4: don't clear SB_RDONLY when remounting r/w until quota is re-enabled ext4: fix lockdep warning when enabling MMP ext4: remove redundant mb_regenerate_buddy() ext4: drop s_mb_bal_lock and convert protected fields to atomic ext4: add mballoc stats proc file ext4: allow to find by goal if EXT4_MB_HINT_GOAL_ONLY is set ext4: allow ext4_get_group_info() to fail refscale: Move shutdown from wait_event() to wait_event_idle() rcu: Protect rcu_print_task_exp_stall() ->exp_tasks access fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode() drm/amd/display: Use DC_LOG_DC in the trasform pixel function regmap: cache: Return error in cache sync operations for REGCACHE_NONE arm64: dts: qcom: msm8996: Add missing DWC3 quirks memstick: r592: Fix UAF bug in r592_remove due to race condition firmware: arm_sdei: Fix sleep from invalid context BUG ACPI: EC: Fix oops when removing custom query handlers remoteproc: stm32_rproc: Add mutex protection for workqueue drm/tegra: Avoid potential 32-bit integer overflow ACPICA: Avoid undefined behavior: applying zero offset to null pointer ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects drm/amd: Fix an out of bounds error in BIOS parser wifi: ath: Silence memcpy run-time false positive warning bpf: Annotate data races in bpf_local_storage wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex ext2: Check block size validity during mount scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow net: pasemi: Fix return type of pasemi_mac_start_tx() net: Catch invalid index in XPS mapping scsi: target: iscsit: Free cmds before session free lib: cpu_rmap: Avoid use after free on rmap->obj array entries scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race condition gfs2: Fix inode height consistency check ext4: set goal start correctly in ext4_mb_normalize_request ext4: Fix best extent lstart adjustment logic in ext4_mb_new_inode_pa() f2fs: fix to drop all dirty pages during umount() if cp_error is set samples/bpf: Fix fout leak in hbm's run_bpf_prog wifi: iwlwifi: pcie: fix possible NULL pointer dereference wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf null_blk: Always check queue mode setting from configfs wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace wifi: ath11k: Fix SKB corruption in REO destination ring ipvs: Update width of source for ip_vs_sync_conn_options Bluetooth: hci_bcm: Fall back to getting bdaddr from EFI if not set Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE HID: logitech-hidpp: Don't use the USB serial for USB devices HID: logitech-hidpp: Reconcile USB and Unifying serials spi: spi-imx: fix MX51_ECSPI_* macros when cs > 3 HID: wacom: generic: Set battery quirk only when we see battery data usb: typec: tcpm: fix multiple times discover svids error serial: 8250: Reinit port->pm on port specific driver unbind mcb-pci: Reallocate memory region to avoid memory overlapping sched: Fix KCSAN noinstr violation recordmcount: Fix memory leaks in the uwrite function RDMA/core: Fix multiple -Warray-bounds warnings iommu/arm-smmu-qcom: Limit the SMR groups to 128 clk: tegra20: fix gcc-7 constant overflow warning iommu/arm-smmu-v3: Acknowledge pri/event queue overflow if any Input: xpad - add constants for GIP interface numbers phy: st: miphy28lp: use _poll_timeout functions for waits mfd: dln2: Fix memory leak in dln2_probe() btrfs: move btrfs_find_highest_objectid/btrfs_find_free_objectid to disk-io.c btrfs: replace calls to btrfs_find_free_ino with btrfs_find_free_objectid btrfs: fix space cache inconsistency after error loading it from disk xfrm: don't check the default policy if the policy allows the packet Revert "Fix XFRM-I support for nested ESP tunnels" drm/msm/dp: unregister audio driver during unbind drm/msm/dpu: Remove duplicate register defines from INTF cpupower: Make TSC read per CPU for Mperf monitor af_key: Reject optional tunnel/BEET mode templates in outbound policies net: fec: Better handle pm_runtime_get() failing in .remove() net: phy: dp83867: add w/a for packet errors seen with short cables ALSA: firewire-digi00x: prevent potential use after free ALSA: hda/realtek: Apply HP B&O top speaker profile to Pavilion 15 vsock: avoid to close connected socket after the timeout ipv4/tcp: do not use per netns ctl sockets net: Find dst with sk's xfrm policy not ctl_sk tcp: fix possible sk_priority leak in tcp_v4_send_reset() serial: arc_uart: fix of_iomap leak in `arc_serial_probe` erspan: get the proto with the md version for collect_md net: hns3: fix sending pfc frames after reset issue net: hns3: fix reset delay time to avoid configuration timeout media: netup_unidvb: fix use-after-free at del_timer() SUNRPC: Fix trace_svc_register() call site drm/exynos: fix g2d_open/close helper function definitions net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() net/tipc: fix tipc header files for kernel-doc tipc: add tipc_bearer_min_mtu to calculate min mtu tipc: do not update mtu if msg_max is too small in mtu negotiation tipc: check the bearer min mtu properly when setting it by netlink net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop() net: bcmgenet: Restore phy_stop() depending upon suspend/close wifi: mac80211: fix min center freq offset tracing wifi: iwlwifi: mvm: don't trust firmware n_channels scsi: storvsc: Don't pass unused PFNs to Hyper-V host cassini: Fix a memory leak in the error handling path of cas_init_one() igb: fix bit_shift to be in [1..8] range vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit() netfilter: nft_set_rbtree: fix null deref on element insertion bridge: always declare tunnel functions ALSA: usb-audio: Add a sample rate workaround for Line6 Pod Go USB: usbtmc: Fix direction for 0-length ioctl control messages usb-storage: fix deadlock when a scsi command timeouts more than once USB: UHCI: adjust zhaoxin UHCI controllers OverCurrent bit value usb: dwc3: debugfs: Resume dwc3 before accessing registers usb: gadget: u_ether: Fix host MAC address case usb: typec: altmodes/displayport: fix pin_assignment_show ALSA: hda: Fix Oops by 9.1 surround channel names ALSA: hda: Add NVIDIA codec IDs a3 through a7 to patch table ALSA: hda/realtek: Add quirk for Clevo L140AU ALSA: hda/realtek: Add a quirk for HP EliteDesk 805 ALSA: hda/realtek: Add quirk for 2nd ASUS GU603 can: j1939: recvmsg(): allow MSG_CMSG_COMPAT flag can: isotp: recvmsg(): allow MSG_CMSG_COMPAT flag can: kvaser_pciefd: Set CAN_STATE_STOPPED in kvaser_pciefd_stop() can: kvaser_pciefd: Call request_irq() before enabling interrupts can: kvaser_pciefd: Empty SRB buffer in probe can: kvaser_pciefd: Clear listen-only bit if not explicitly requested can: kvaser_pciefd: Do not send EFLUSH command on TFD interrupt can: kvaser_pciefd: Disable interrupts in probe error path statfs: enforce statfs[64] structure initialization serial: Add support for Advantech PCI-1611U card vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF ceph: force updating the msg pointer in non-split case tpm/tpm_tis: Disable interrupts for more Lenovo devices powerpc/64s/radix: Fix soft dirty tracking nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode() HID: wacom: Force pen out of prox if no events have been received in a while HID: wacom: Add new Intuos Pro Small (PTH-460) device IDs HID: wacom: add three styli to wacom_intuos_get_tool_type KVM: arm64: Link position-independent string routines into .hyp.text serial: 8250_exar: derive nr_ports from PCI ID for Acces I/O cards serial: exar: Add support for Sealevel 7xxxC serial cards serial: 8250_exar: Add support for USR298x PCI Modems s390/qdio: get rid of register asm s390/qdio: fix do_sqbs() inline assembly constraint watchdog: sp5100_tco: Immediately trigger upon starting. ARM: dts: stm32: fix AV96 board SAI2 pin muxing on stm32mp15 writeback, cgroup: remove extra percpu_ref_exit() net/sched: act_mirred: refactor the handle of xmit net/sched: act_mirred: better wording on protection against excessive stack growth act_mirred: use the backlog for nested calls to mirred ingress spi: fsl-spi: Re-organise transfer bits_per_word adaptation spi: fsl-cpm: Use 16 bit mode for large transfers with even size ocfs2: Switch to security_inode_init_security() ALSA: hda/ca0132: add quirk for EVGA X299 DARK ALSA: hda: Fix unhandled register update during auto-suspend period ALSA: hda/realtek: Enable headset onLenovo M70/M90 net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize m68k: Move signal frame following exception on 68020/030 parisc: Handle kgdb breakpoints only in kernel context parisc: Allow to reboot machine after system halt gpio: mockup: Fix mode of debugfs files btrfs: use nofs when cleaning up aborted transactions dt-binding: cdns,usb3: Fix cdns,on-chip-buff-size type x86/mm: Avoid incomplete Global INVLPG flushes selftests/memfd: Fix unknown type name build failure parisc: Fix flush_dcache_page() for usage from irq context x86/topology: Fix erroneous smp_num_siblings on Intel Hybrid platforms debugobjects: Don't wake up kswapd from fill_pool() fbdev: udlfb: Fix endpoint check net: fix stack overflow when LRO is disabled for virtual interfaces udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated(). USB: core: Add routines for endpoint checks in old drivers USB: sisusbvga: Add endpoint checks media: radio-shark: Add endpoint checks net: fix skb leak in __skb_tstamp_tx() selftests: fib_tests: mute cleanup error message octeontx2-pf: Fix TSOv6 offload bpf: Fix mask generation for 32-bit narrow loads of 64-bit fields ipv6: Fix out-of-bounds access in ipv6_find_tlv() power: supply: leds: Fix blink to LED on transition power: supply: bq27xxx: Fix bq27xxx_battery_update() race condition power: supply: bq27xxx: Fix I2C IRQ race on remove power: supply: bq27xxx: Fix poll_interval handling and races on remove power: supply: sbs-charger: Fix INHIBITED bit for Status reg fs: fix undefined behavior in bit shift for SB_NOUSER coresight: Fix signedness bug in tmc_etr_buf_insert_barrier_packet() xen/pvcalls-back: fix double frees with pvcalls_new_active_socket() x86/show_trace_log_lvl: Ensure stack pointer is aligned, again ASoC: Intel: Skylake: Fix declaration of enum skl_ch_cfg forcedeth: Fix an error handling path in nv_probe() net/mlx5e: do as little as possible in napi poll when budget is 0 net/mlx5: DR, Fix crc32 calculation to work on big-endian (BE) CPUs net/mlx5: Fix error message when failing to allocate device memory net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device arm64: dts: imx8mn-var-som: fix PHY detection bug by adding deassert delay 3c589_cs: Fix an error handling path in tc589_probe() net: phy: mscc: add VSC8502 to MODULE_DEVICE_TABLE Linux 5.10.181 Change-Id: Iaad0b0bb7c1ad061b28ad4ee16e03db935241177 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-06-27 08:23:11 +00:00
Eric Dumazet	1b33bdd766	net: annotate sk->sk_err write from do_recvmmsg() ... [ Upstream commit e05a5f510f ] do_recvmmsg() can write to sk->sk_err from multiple threads. As said before, many other points reading or writing sk_err need annotations. Fixes: 34b88a68f2 ("net: Fix use after free in the recvmmsg exit path") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-05-30 12:57:46 +01:00
Greg Kroah-Hartman	8596b99884	Merge 5.10.162 into android12-5.10-lts ... Changes in 5.10.162 kernel: provide create_io_thread() helper iov_iter: add helper to save iov_iter state saner calling conventions for unlazy_child() fs: add support for LOOKUP_CACHED fix handling of nd->depth on LOOKUP_CACHED failures in try_to_unlazy* Make sure nd->path.mnt and nd->path.dentry are always valid pointers fs: expose LOOKUP_CACHED through openat2() RESOLVE_CACHED tools headers UAPI: Sync openat2.h with the kernel sources net: provide __sys_shutdown_sock() that takes a socket net: add accept helper not installing fd signal: Add task_sigpending() helper fs: make do_renameat2() take struct filename file: Rename __close_fd_get_file close_fd_get_file fs: provide locked helper variant of close_fd_get_file() entry: Add support for TIF_NOTIFY_SIGNAL task_work: Use TIF_NOTIFY_SIGNAL if available x86: Wire up TIF_NOTIFY_SIGNAL arc: add support for TIF_NOTIFY_SIGNAL arm64: add support for TIF_NOTIFY_SIGNAL m68k: add support for TIF_NOTIFY_SIGNAL nios32: add support for TIF_NOTIFY_SIGNAL parisc: add support for TIF_NOTIFY_SIGNAL powerpc: add support for TIF_NOTIFY_SIGNAL mips: add support for TIF_NOTIFY_SIGNAL s390: add support for TIF_NOTIFY_SIGNAL um: add support for TIF_NOTIFY_SIGNAL sh: add support for TIF_NOTIFY_SIGNAL openrisc: add support for TIF_NOTIFY_SIGNAL csky: add support for TIF_NOTIFY_SIGNAL hexagon: add support for TIF_NOTIFY_SIGNAL microblaze: add support for TIF_NOTIFY_SIGNAL arm: add support for TIF_NOTIFY_SIGNAL xtensa: add support for TIF_NOTIFY_SIGNAL alpha: add support for TIF_NOTIFY_SIGNAL c6x: add support for TIF_NOTIFY_SIGNAL h8300: add support for TIF_NOTIFY_SIGNAL ia64: add support for TIF_NOTIFY_SIGNAL nds32: add support for TIF_NOTIFY_SIGNAL riscv: add support for TIF_NOTIFY_SIGNAL sparc: add support for TIF_NOTIFY_SIGNAL ia64: don't call handle_signal() unless there's actually a signal queued ARC: unbork 5.11 bootup: fix snafu in _TIF_NOTIFY_SIGNAL handling alpha: fix TIF_NOTIFY_SIGNAL handling task_work: remove legacy TWA_SIGNAL path kernel: remove checking for TIF_NOTIFY_SIGNAL coredump: Limit what can interrupt coredumps kernel: allow fork with TIF_NOTIFY_SIGNAL pending entry/kvm: Exit to user mode when TIF_NOTIFY_SIGNAL is set arch: setup PF_IO_WORKER threads like PF_KTHREAD arch: ensure parisc/powerpc handle PF_IO_WORKER in copy_thread() x86/process: setup io_threads more like normal user space threads kernel: stop masking signals in create_io_thread() kernel: don't call do_exit() for PF_IO_WORKER threads task_work: add helper for more targeted task_work canceling io_uring: import 5.15-stable io_uring signal: kill JOBCTL_TASK_WORK task_work: unconditionally run task_work from get_signal() net: remove cmsg restriction from io_uring based send/recvmsg calls Revert "proc: don't allow async path resolution of /proc/thread-self components" Revert "proc: don't allow async path resolution of /proc/self components" eventpoll: add EPOLL_URING_WAKE poll wakeup flag eventfd: provide a eventfd_signal_mask() helper io_uring: pass in EPOLL_URING_WAKE for eventfd signaling and wakeups Linux 5.10.162 Change-Id: I50a7b8bc8d38fac612113281b218cf5323b0af5e Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-02-01 16:13:18 +00:00
Jens Axboe	a3025359ff	net: remove cmsg restriction from io_uring based send/recvmsg calls ... [ Upstream commit e54937963f ] No need to restrict these anymore, as the worker threads are direct clones of the original task. Hence we know for a fact that we can support anything that the regular task can. Since the only user of proto_ops->flags was to flag PROTO_CMSG_DATA_ONLY, kill the member and the flag definition too. Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-01-04 11:39:24 +01:00
Pavel Begunkov	ad0b013795	net: add accept helper not installing fd ... [ Upstream commit d32f89da7f ] Introduce and reuse a helper that acts similarly to __sys_accept4_file() but returns struct file instead of installing file descriptor. Will be used by io_uring. Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Acked-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Jens Axboe <axboe@kernel.dk> Acked-by: David S. Miller <davem@davemloft.net> Link: https://lore.kernel.org/r/c57b9e8e818d93683a3d24f8ca50ca038d1da8c4.1629888991.git.asml.silence@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-01-04 11:39:17 +01:00
Jens Axboe	069ac28d92	net: provide __sys_shutdown_sock() that takes a socket ... [ Upstream commit b713c195d5 ] No functional changes in this patch, needed to provide io_uring support for shutdown(2). Cc: netdev@vger.kernel.org Cc: David S. Miller <davem@davemloft.net> Acked-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-01-04 11:39:17 +01:00
Greg Kroah-Hartman	5939035887	Merge 5.10.140 into android12-5.10-lts ... Changes in 5.10.140 audit: fix potential double free on error path from fsnotify_add_inode_mark parisc: Fix exception handler for fldw and fstw instructions kernel/sys_ni: add compat entry for fadvise64_64 pinctrl: amd: Don't save/restore interrupt status and wake status bits xfs: prevent a WARN_ONCE() in xfs_ioc_attr_list() xfs: reject crazy array sizes being fed to XFS_IOC_GETBMAP* fs: remove __sync_filesystem vfs: make sync_filesystem return errors from ->sync_fs xfs: return errors in xfs_fs_sync_fs xfs: only bother with sync_filesystem during readonly remount kernel/sched: Remove dl_boosted flag comment xfrm: fix refcount leak in __xfrm_policy_check() xfrm: clone missing x->lastused in xfrm_do_migrate af_key: Do not call xfrm_probe_algs in parallel xfrm: policy: fix metadata dst->dev xmit null pointer dereference NFS: Don't allocate nfs_fattr on the stack in __nfs42_ssc_open() NFSv4.2 fix problems with __nfs42_ssc_open SUNRPC: RPC level errors should set task->tk_rpc_status mm/huge_memory.c: use helper function migration_entry_to_page() mm/smaps: don't access young/dirty bit if pte unpresent rose: check NULL rose_loopback_neigh->loopback nfc: pn533: Fix use-after-free bugs caused by pn532_cmd_timeout ice: xsk: Force rings to be sized to power of 2 ice: xsk: prohibit usage of non-balanced queue id net/mlx5e: Properly disable vlan strip on non-UL reps net: ipa: don't assume SMEM is page-aligned net: moxa: get rid of asymmetry in DMA mapping/unmapping bonding: 802.3ad: fix no transmission of LACPDUs net: ipvtap - add __init/__exit annotations to module init/exit funcs netfilter: ebtables: reject blobs that don't provide all entry points bnxt_en: fix NQ resource accounting during vf creation on 57500 chips netfilter: nft_payload: report ERANGE for too long offset and length netfilter: nft_payload: do not truncate csum_offset and csum_type netfilter: nf_tables: do not leave chain stats enabled on error netfilter: nft_osf: restrict osf to ipv4, ipv6 and inet families netfilter: nft_tunnel: restrict it to netdev family netfilter: nftables: remove redundant assignment of variable err netfilter: nf_tables: consolidate rule verdict trace call netfilter: nft_cmp: optimize comparison for 16-bytes netfilter: bitwise: improve error goto labels netfilter: nf_tables: upfront validation of data via nft_data_init() netfilter: nf_tables: disallow jump to implicit chain from set element netfilter: nf_tables: disallow binding to already bound chain tcp: tweak len/truesize ratio for coalesce candidates net: Fix data-races around sysctl_[rw]mem(_offset)?. net: Fix data-races around sysctl_[rw]mem_(max|default). net: Fix data-races around weight_p and dev_weight_[rt]x_bias. net: Fix data-races around netdev_max_backlog. net: Fix data-races around netdev_tstamp_prequeue. ratelimit: Fix data-races in ___ratelimit(). bpf: Folding omem_charge() into sk_storage_charge() net: Fix data-races around sysctl_optmem_max. net: Fix a data-race around sysctl_tstamp_allow_data. net: Fix a data-race around sysctl_net_busy_poll. net: Fix a data-race around sysctl_net_busy_read. net: Fix a data-race around netdev_budget. net: Fix a data-race around netdev_budget_usecs. net: Fix data-races around sysctl_fb_tunnels_only_for_init_net. net: Fix data-races around sysctl_devconf_inherit_init_net. net: Fix a data-race around sysctl_somaxconn. ixgbe: stop resetting SYSTIME in ixgbe_ptp_start_cyclecounter rxrpc: Fix locking in rxrpc's sendmsg ionic: fix up issues with handling EAGAIN on FW cmds btrfs: fix silent failure when deleting root reference btrfs: replace: drop assert for suspended replace btrfs: add info when mount fails due to stale replace target btrfs: check if root is readonly while setting security xattr perf/x86/lbr: Enable the branch type for the Arch LBR by default x86/unwind/orc: Unwind ftrace trampolines with correct ORC entry x86/bugs: Add "unknown" reporting for MMIO Stale Data loop: Check for overflow while configuring loop asm-generic: sections: refactor memory_intersects s390: fix double free of GS and RI CBs on fork() failure ACPI: processor: Remove freq Qos request for all CPUs xen/privcmd: fix error exit of privcmd_ioctl_dm_op() mm/hugetlb: fix hugetlb not supporting softdirty tracking Revert "md-raid: destroy the bitmap after destroying the thread" md: call __md_stop_writes in md_stop arm64: Fix match_list for erratum 1286807 on Arm Cortex-A76 Documentation/ABI: Mention retbleed vulnerability info file for sysfs blk-mq: fix io hung due to missing commit_rqs perf python: Fix build when PYTHON_CONFIG is user supplied perf/x86/intel/uncore: Fix broken read_counter() for SNB IMC PMU scsi: ufs: core: Enable link lost interrupt scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq bpf: Don't use tnum_range on array range checking for poke descriptors Linux 5.10.140 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I29f4b4af2a584dc2f2789aac613583603002464a	2022-08-31 18:52:48 +02:00
Kuniyuki Iwashima	23cf93bb32	net: Fix a data-race around sysctl_somaxconn. ... [ Upstream commit 3c9ba81d72 ] While reading sysctl_somaxconn, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-08-31 17:15:21 +02:00
Greg Kroah-Hartman	08ed4cb090	Merge 5.10.67 into android12-5.10-lts ... Changes in 5.10.67 rtc: tps65910: Correct driver module alias io_uring: limit fixed table size by RLIMIT_NOFILE io_uring: place fixed tables under memcg limits io_uring: add ->splice_fd_in checks io_uring: fail links of cancelled timeouts io-wq: fix wakeup race when adding new work btrfs: wake up async_delalloc_pages waiters after submit btrfs: reset replace target device to allocation state on close blk-zoned: allow zone management send operations without CAP_SYS_ADMIN blk-zoned: allow BLKREPORTZONE without CAP_SYS_ADMIN PCI/MSI: Skip masking MSI-X on Xen PV powerpc/perf/hv-gpci: Fix counter value parsing xen: fix setting of max_pfn in shared_info 9p/xen: Fix end of loop tests for list_for_each_entry ceph: fix dereference of null pointer cf selftests/ftrace: Fix requirement check of README file tools/thermal/tmon: Add cross compiling support clk: socfpga: agilex: fix the parents of the psi_ref_clk clk: socfpga: agilex: fix up s2f_user0_clk representation clk: socfpga: agilex: add the bypass register for s2f_usr0 clock pinctrl: stmfx: Fix hazardous u8[] to unsigned long cast pinctrl: ingenic: Fix incorrect pull up/down info soc: qcom: aoss: Fix the out of bound usage of cooling_devs soc: aspeed: lpc-ctrl: Fix boundary check for mmap soc: aspeed: p2a-ctrl: Fix boundary check for mmap arm64: mm: Fix TLBI vs ASID rollover arm64: head: avoid over-mapping in map_memory iio: ltc2983: fix device probe wcn36xx: Ensure finish scan is not requested before start scan crypto: public_key: fix overflow during implicit conversion block: bfq: fix bfq_set_next_ioprio_data() power: supply: max17042: handle fails of reading status register dm crypt: Avoid percpu_counter spinlock contention in crypt_page_alloc() crypto: ccp - shutdown SEV firmware on kexec VMCI: fix NULL pointer dereference when unmapping queue pair media: uvc: don't do DMA on stack media: rc-loopback: return number of emitters rather than error s390/qdio: fix roll-back after timeout on ESTABLISH ccw s390/qdio: cancel the ESTABLISH ccw after timeout Revert "dmaengine: imx-sdma: refine to load context only once" dmaengine: imx-sdma: remove duplicated sdma_load_context libata: add ATA_HORKAGE_NO_NCQ_TRIM for Samsung 860 and 870 SSDs ARM: 9105/1: atags_to_fdt: don't warn about stack size f2fs: fix to do sanity check for sb/cp fields correctly PCI/portdrv: Enable Bandwidth Notification only if port supports it PCI: Restrict ASMedia ASM1062 SATA Max Payload Size Supported PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure PCI: xilinx-nwl: Enable the clock through CCF PCI: aardvark: Configure PCIe resources from 'ranges' DT property PCI: Export pci_pio_to_address() for module use PCI: aardvark: Fix checking for PIO status PCI: aardvark: Fix masking and unmasking legacy INTx interrupts HID: input: do not report stylus battery state as "full" f2fs: quota: fix potential deadlock pinctrl: remove empty lines in pinctrl subsystem pinctrl: armada-37xx: Correct PWM pins definitions scsi: bsg: Remove support for SCSI_IOCTL_SEND_COMMAND clk: rockchip: drop GRF dependency for rk3328/rk3036 pll types IB/hfi1: Adjust pkey entry in index 0 RDMA/iwcm: Release resources if iw_cm module initialization fails docs: Fix infiniband uverbs minor number scsi: BusLogic: Use %X for u32 sized integer rather than %lX pinctrl: samsung: Fix pinctrl bank pin count vfio: Use config not menuconfig for VFIO_NOIOMMU scsi: ufs: Fix memory corruption by ufshcd_read_desc_param() cpuidle: pseries: Fixup CEDE0 latency only for POWER10 onwards powerpc/stacktrace: Include linux/delay.h RDMA/efa: Remove double QP type assignment RDMA/mlx5: Delete not-available udata check cpuidle: pseries: Mark pseries_idle_proble() as __init f2fs: reduce the scope of setting fsck tag when de->name_len is zero openrisc: don't printk() unconditionally dma-debug: fix debugfs initialization order NFSv4/pNFS: Fix a layoutget livelock loop NFSv4/pNFS: Always allow update of a zero valued layout barrier NFSv4/pnfs: The layout barrier indicate a minimal value for the seqid SUNRPC: Fix potential memory corruption SUNRPC/xprtrdma: Fix reconnection locking SUNRPC query transport's source port sunrpc: Fix return value of get_srcport() scsi: fdomain: Fix error return code in fdomain_probe() pinctrl: single: Fix error return code in pcs_parse_bits_in_pinctrl_entry() powerpc/numa: Consider the max NUMA node for migratable LPAR scsi: smartpqi: Fix an error code in pqi_get_raid_map() scsi: qedi: Fix error codes in qedi_alloc_global_queues() scsi: qedf: Fix error codes in qedf_alloc_global_queues() powerpc/config: Renable MTD_PHYSMAP_OF iommu/vt-d: Update the virtual command related registers HID: i2c-hid: Fix Elan touchpad regression clk: imx8m: fix clock tree update of TF-A managed clocks KVM: PPC: Book3S HV: Fix copy_tofrom_guest routines scsi: ufs: ufs-exynos: Fix static checker warning KVM: PPC: Book3S HV Nested: Reflect guest PMU in-use to L0 when guest SPRs are live platform/x86: dell-smbios-wmi: Add missing kfree in error-exit from run_smbios_call powerpc/smp: Update cpu_core_map on all PowerPc systems RDMA/hns: Fix QP's resp incomplete assignment fscache: Fix cookie key hashing clk: at91: clk-generated: Limit the requested rate to our range KVM: PPC: Fix clearing never mapped TCEs in realmode soc: mediatek: cmdq: add address shift in jump f2fs: fix to account missing .skipped_gc_rwsem f2fs: fix unexpected ENOENT comes from f2fs_map_blocks() f2fs: fix to unmap pages from userspace process in punch_hole() f2fs: deallocate compressed pages when error happens f2fs: should put a page beyond EOF when preparing a write MIPS: Malta: fix alignment of the devicetree buffer kbuild: Fix 'no symbols' warning when CONFIG_TRIM_UNUSD_KSYMS=y userfaultfd: prevent concurrent API initialization drm/vc4: hdmi: Set HD_CTL_WHOLSMP and HD_CTL_CHALIGN_SET drm/amdgpu: Fix amdgpu_ras_eeprom_init() ASoC: atmel: ATMEL drivers don't need HAS_DMA media: dib8000: rewrite the init prbs logic libbpf: Fix reuse of pinned map on older kernel x86/hyperv: fix for unwanted manipulation of sched_clock when TSC marked unstable crypto: mxs-dcp - Use sg_mapping_iter to copy data PCI: Use pci_update_current_state() in pci_enable_device_flags() tipc: keep the skb in rcv queue until the whole data is read net: phy: Fix data type in DP83822 dp8382x_disable_wol() iio: dac: ad5624r: Fix incorrect handling of an optional regulator. iavf: do not override the adapter state in the watchdog task iavf: fix locking of critical sections ARM: dts: qcom: apq8064: correct clock names video: fbdev: kyro: fix a DoS bug by restricting user input netlink: Deal with ESRCH error in nlmsg_notify() Smack: Fix wrong semantics in smk_access_entry() drm: avoid blocking in drm_clients_info's rcu section drm: serialize drm_file.master with a new spinlock drm: protect drm_master pointers in drm_lease.c rcu: Fix macro name CONFIG_TASKS_RCU_TRACE igc: Check if num of q_vectors is smaller than max before array access usb: host: fotg210: fix the endpoint's transactional opportunities calculation usb: host: fotg210: fix the actual_length of an iso packet usb: gadget: u_ether: fix a potential null pointer dereference USB: EHCI: ehci-mv: improve error handling in mv_ehci_enable() usb: gadget: composite: Allow bMaxPower=0 if self-powered staging: board: Fix uninitialized spinlock when attaching genpd tty: serial: jsm: hold port lock when reporting modem line changes bus: fsl-mc: fix mmio base address for child DPRCs selftests: firmware: Fix ignored return val of asprintf() warn drm/amd/display: Fix timer_per_pixel unit error media: hantro: vp8: Move noisy WARN_ON to vpu_debug media: platform: stm32: unprepare clocks at handling errors in probe media: atomisp: Fix runtime PM imbalance in atomisp_pci_probe media: atomisp: pci: fix error return code in atomisp_pci_probe() nfp: fix return statement in nfp_net_parse_meta() ethtool: improve compat ioctl handling drm/amdgpu: Fix a printing message drm/amd/amdgpu: Update debugfs link_settings output link_rate field in hex bpf/tests: Fix copy-and-paste error in double word test bpf/tests: Do not PASS tests without actually testing the result drm/bridge: nwl-dsi: Avoid potential multiplication overflow on 32-bit arm64: dts: allwinner: h6: tanix-tx6: Fix regulator node names video: fbdev: asiliantfb: Error out if 'pixclock' equals zero video: fbdev: kyro: Error out if 'pixclock' equals zero video: fbdev: riva: Error out if 'pixclock' equals zero ipv4: ip_output.c: Fix out-of-bounds warning in ip_copy_addrs() flow_dissector: Fix out-of-bounds warnings s390/jump_label: print real address in a case of a jump label bug s390: make PCI mio support a machine flag serial: 8250: Define RX trigger levels for OxSemi 950 devices xtensa: ISS: don't panic in rs_init hvsi: don't panic on tty_register_driver failure serial: 8250_pci: make setup_port() parameters explicitly unsigned staging: ks7010: Fix the initialization of the 'sleep_status' structure samples: bpf: Fix tracex7 error raised on the missing argument libbpf: Fix race when pinning maps in parallel ata: sata_dwc_460ex: No need to call phy_exit() befre phy_init() Bluetooth: skip invalid hci_sync_conn_complete_evt workqueue: Fix possible memory leaks in wq_numa_init() ARM: dts: stm32: Set {bitclock,frame}-master phandles on DHCOM SoM ARM: dts: stm32: Set {bitclock,frame}-master phandles on ST DKx ARM: dts: stm32: Update AV96 adv7513 node per dtbs_check bonding: 3ad: fix the concurrency between __bond_release_one() and bond_3ad_state_machine_handler() ARM: dts: at91: use the right property for shutdown controller arm64: tegra: Fix Tegra194 PCIe EP compatible string ASoC: Intel: bytcr_rt5640: Move "Platform Clock" routes to the maps for the matching in-/output ASoC: Intel: update sof_pcm512x quirks media: imx258: Rectify mismatch of VTS value media: imx258: Limit the max analogue gain to 480 media: v4l2-dv-timings.c: fix wrong condition in two for-loops media: TDA1997x: fix tda1997x_query_dv_timings() return value media: tegra-cec: Handle errors of clk_prepare_enable() gfs2: Fix glock recursion in freeze_go_xmote_bh arm64: dts: qcom: sdm630: Rewrite memory map arm64: dts: qcom: sdm630: Fix TLMM node and pinctrl configuration serial: 8250_omap: Handle optional overrun-throttle-ms property ARM: dts: imx53-ppd: Fix ACHC entry arm64: dts: qcom: ipq8074: fix pci node reg property arm64: dts: qcom: sdm660: use reg value for memory node arm64: dts: qcom: ipq6018: drop '0x' from unit address arm64: dts: qcom: sdm630: don't use underscore in node name arm64: dts: qcom: msm8994: don't use underscore in node name arm64: dts: qcom: msm8996: don't use underscore in node name arm64: dts: qcom: sm8250: Fix epss_l3 unit address nvmem: qfprom: Fix up qfprom_disable_fuse_blowing() ordering net: ethernet: stmmac: Do not use unreachable() in ipq806x_gmac_probe() drm/msm: mdp4: drop vblank get/put from prepare/complete_commit drm/msm/dsi: Fix DSI and DSI PHY regulator config from SDM660 drm: xlnx: zynqmp_dpsub: Call pm_runtime_get_sync before setting pixel clock drm: xlnx: zynqmp: release reset to DP controller before accessing DP registers thunderbolt: Fix port linking by checking all adapters drm/amd/display: fix missing writeback disablement if plane is removed drm/amd/display: fix incorrect CM/TF programming sequence in dwb selftests/bpf: Fix xdp_tx.c prog section name drm/vmwgfx: fix potential UAF in vmwgfx_surface.c Bluetooth: schedule SCO timeouts with delayed_work Bluetooth: avoid circular locks in sco_sock_connect drm/msm/dp: return correct edid checksum after corrupted edid checksum read net/mlx5: Fix variable type to match 64bit gpu: drm: amd: amdgpu: amdgpu_i2c: fix possible uninitialized-variable access in amdgpu_i2c_router_select_ddc_port() drm/display: fix possible null-pointer dereference in dcn10_set_clock() mac80211: Fix monitor MTU limit so that A-MSDUs get through ARM: tegra: acer-a500: Remove bogus USB VBUS regulators ARM: tegra: tamonten: Fix UART pad setting arm64: tegra: Fix compatible string for Tegra132 CPUs arm64: dts: ls1046a: fix eeprom entries nvme-tcp: don't check blk_mq_tag_to_rq when receiving pdu data nvme: code command_id with a genctr for use-after-free validation Bluetooth: Fix handling of LE Enhanced Connection Complete opp: Don't print an error if required-opps is missing serial: sh-sci: fix break handling for sysrq iomap: pass writeback errors to the mapping tcp: enable data-less, empty-cookie SYN with TFO_SERVER_COOKIE_NOT_REQD rpc: fix gss_svc_init cleanup on failure selftests/bpf: Fix flaky send_signal test hwmon: (pmbus/ibm-cffps) Fix write bits for LED control staging: rts5208: Fix get_ms_information() heap buffer size net: Fix offloading indirect devices dependency on qdisc order creation kselftest/arm64: mte: Fix misleading output when skipping tests kselftest/arm64: pac: Fix skipping of tests on systems without PAC gfs2: Don't call dlm after protocol is unmounted usb: chipidea: host: fix port index underflow and UBSAN complains lockd: lockd server-side shouldn't set fl_ops drm/exynos: Always initialize mapping in exynos_drm_register_dma() rtl8xxxu: Fix the handling of TX A-MPDU aggregation rtw88: use read_poll_timeout instead of fixed sleep rtw88: wow: build wow function only if CONFIG_PM is on rtw88: wow: fix size access error of probe request octeontx2-pf: Fix NIX1_RX interface backpressure m68knommu: only set CONFIG_ISA_DMA_API for ColdFire sub-arch btrfs: tree-log: check btrfs_lookup_data_extent return value soundwire: intel: fix potential race condition during power down ASoC: Intel: Skylake: Fix module configuration for KPB and MIXER ASoC: Intel: Skylake: Fix passing loadable flag for module of: Don't allow __of_attached_node_sysfs() without CONFIG_SYSFS mmc: sdhci-of-arasan: Modified SD default speed to 19MHz for ZynqMP mmc: sdhci-of-arasan: Check return value of non-void funtions mmc: rtsx_pci: Fix long reads when clock is prescaled selftests/bpf: Enlarge select() timeout for test_maps mmc: core: Return correct emmc response in case of ioctl error cifs: fix wrong release in sess_alloc_buffer() failed path Revert "USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk set" usb: musb: musb_dsps: request_irq() after initializing musb usbip: give back URBs for unsent unlink requests during cleanup usbip:vhci_hcd USB port can get stuck in the disabled state ASoC: rockchip: i2s: Fix regmap_ops hang ASoC: rockchip: i2s: Fixup config for DAIFMT_DSP_A/B drm/amdkfd: Account for SH/SE count when setting up cu masks. nfsd: fix crash on LOCKT on reexported NFSv3 iwlwifi: pcie: free RBs during configure iwlwifi: mvm: fix a memory leak in iwl_mvm_mac_ctxt_beacon_changed iwlwifi: mvm: avoid static queue number aliasing iwlwifi: mvm: fix access to BSS elements iwlwifi: fw: correctly limit to monitor dump iwlwifi: mvm: Fix scan channel flags settings net/mlx5: DR, fix a potential use-after-free bug net/mlx5: DR, Enable QP retransmission parport: remove non-zero check on count selftests/bpf: Fix potential unreleased lock wcn36xx: Fix missing frame timestamp for beacon/probe-resp ath9k: fix OOB read ar9300_eeprom_restore_internal ath9k: fix sleeping in atomic context net: fix NULL pointer reference in cipso_v4_doi_free fix array-index-out-of-bounds in taprio_change net: w5100: check return value after calling platform_get_resource() net: hns3: clean up a type mismatch warning fs/io_uring Don't use the return value from import_iovec(). io_uring: remove duplicated io_size from rw parisc: fix crash with signals and alloca ovl: fix BUG_ON() in may_delete() when called from ovl_cleanup() scsi: BusLogic: Fix missing pr_cont() use scsi: qla2xxx: Changes to support kdump kernel scsi: qla2xxx: Sync queue idx with queue_pair_map idx cpufreq: powernv: Fix init_chip_info initialization in numa=off s390/pv: fix the forcing of the swiotlb hugetlb: fix hugetlb cgroup refcounting during vma split mm/hmm: bypass devmap pte when all pfn requested flags are fulfilled mm/hugetlb: initialize hugetlb_usage in mm_init mm,vmscan: fix divide by zero in get_scan_count memcg: enable accounting for pids in nested pid namespaces libnvdimm/pmem: Fix crash triggered when I/O in-flight during unbind platform/chrome: cros_ec_proto: Send command again when timeout occurs lib/test_stackinit: Fix static initializer test net: dsa: lantiq_gswip: fix maximum frame length drm/mgag200: Select clock in PLL update functions drm/msi/mdp4: populate priv->kms in mdp4_kms_init drm/dp_mst: Fix return code on sideband message failure drm/panfrost: Make sure MMU context lifetime is not bound to panfrost_priv drm/amdgpu: Fix BUG_ON assert drm/amd/display: Update number of DCN3 clock states drm/amd/display: Update bounding box states (v2) drm/panfrost: Simplify lock_region calculation drm/panfrost: Use u64 for size in lock_region drm/panfrost: Clamp lock region to Bifrost minimum fanotify: limit number of event merge attempts Linux 5.10.67 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ic8df59518265d0cdf724e93e8922cde48fc85ce9	2021-09-30 12:21:03 +02:00
Arnd Bergmann	5b3a45eedd	ethtool: improve compat ioctl handling ... [ Upstream commit dd98d2895d ] The ethtool compat ioctl handling is hidden away in net/socket.c, which introduces a couple of minor oddities: - The implementation may end up diverging, as seen in the RXNFC extension in commit 84a1d9c482 ("net: ethtool: extend RXNFC API to support RSS spreading of filter matches") that does not work in compat mode. - Most architectures do not need the compat handling at all because u64 and compat_u64 have the same alignment. - On x86, the conversion is done for both x32 and i386 user space, but it's actually wrong to do it for x32 and cannot work there. - On 32-bit Arm, it never worked for compat oabi user space, since that needs to do the same conversion but does not. - It would be nice to get rid of both compat_alloc_user_space() and copy_in_user() throughout the kernel. None of these actually seems to be a serious problem that real users are likely to encounter, but fixing all of them actually leads to code that is both shorter and more readable. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-09-18 13:40:21 +02:00
Greg Kroah-Hartman	674d2ac211	Merge 5.10.62 into android12-5.10-lts ... Changes in 5.10.62 net: qrtr: fix another OOB Read in qrtr_endpoint_post bpf: Fix ringbuf helper function compatibility bpf: Fix NULL pointer dereference in bpf_get_local_storage() helper ASoC: rt5682: Adjust headset volume button threshold ASoC: component: Remove misplaced prefix handling in pin control functions ARC: Fix CONFIG_STACKDEPOT netfilter: conntrack: collect all entries in one cycle once: Fix panic when module unload blk-iocost: fix lockdep warning on blkcg->lock ovl: fix uninitialized pointer read in ovl_lookup_real_one() net: mscc: Fix non-GPL export of regmap APIs can: usb: esd_usb2: esd_usb2_rx_event(): fix the interchange of the CAN RX and TX error counters ceph: correctly handle releasing an embedded cap flush riscv: Ensure the value of FP registers in the core dump file is up to date Revert "btrfs: compression: don't try to compress if we don't have enough pages" drm/amdgpu: Cancel delayed work when GFXOFF is disabled Revert "USB: serial: ch341: fix character loss at high transfer rates" USB: serial: option: add new VID/PID to support Fibocom FG150 usb: renesas-xhci: Prefer firmware loading on unknown ROM state usb: dwc3: gadget: Fix dwc3_calc_trbs_left() usb: dwc3: gadget: Stop EP0 transfers during pullup disable scsi: core: Fix hang of freezing queue between blocking and running device RDMA/bnxt_re: Add missing spin lock initialization IB/hfi1: Fix possible null-pointer dereference in _extend_sdma_tx_descs() RDMA/bnxt_re: Remove unpaired rtnl unlock in bnxt_re_dev_init() ice: do not abort devlink info if board identifier can't be found net: usb: pegasus: fixes of set_register(s) return value evaluation; igc: fix page fault when thunderbolt is unplugged igc: Use num_tx_queues when iterating over tx_ring queue e1000e: Fix the max snoop/no-snoop latency for 10M e1000e: Do not take care about recovery NVM checksum RDMA/efa: Free IRQ vectors on error flow ip_gre: add validation for csum_start xgene-v2: Fix a resource leak in the error handling path of 'xge_probe()' net: marvell: fix MVNETA_TX_IN_PRGRS bit number ucounts: Increase ucounts reference counter before the security hook net/sched: ets: fix crash when flipping from 'strict' to 'quantum' ipv6: use siphash in rt6_exception_hash() ipv4: use siphash instead of Jenkins in fnhe_hashfun() cxgb4: dont touch blocked freelist bitmap after free rtnetlink: Return correct error on changing device netns net: hns3: clear hardware resource when loading driver net: hns3: add waiting time before cmdq memory is released net: hns3: fix duplicate node in VLAN list net: hns3: fix get wrong pfc_en when query PFC configuration Revert "mmc: sdhci-iproc: Set SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN on BCM2711" net: stmmac: add mutex lock to protect est parameters net: stmmac: fix kernel panic due to NULL pointer dereference of plat->est drm/i915: Fix syncmap memory leak usb: gadget: u_audio: fix race condition on endpoint stop dt-bindings: sifive-l2-cache: Fix 'select' matching perf/x86/intel/uncore: Fix integer overflow on 23 bit left shift of a u32 clk: renesas: rcar-usb2-clock-sel: Fix kernel NULL pointer dereference iwlwifi: pnvm: accept multiple HW-type TLVs opp: remove WARN when no valid OPPs remain cpufreq: blocklist Qualcomm sm8150 in cpufreq-dt-platdev virtio: Improve vq->broken access to avoid any compiler optimization virtio_pci: Support surprise removal of virtio pci device virtio_vdpa: reject invalid vq indices vringh: Use wiov->used to check for read/write desc order tools/virtio: fix build qed: qed ll2 race condition fixes qed: Fix null-pointer dereference in qed_rdma_create_qp() Revert "drm/amd/pm: fix workload mismatch on vega10" drm/amd/pm: change the workload type for some cards blk-mq: don't grab rq's refcount in blk_mq_check_expired() drm: Copy drm_wait_vblank to user before returning drm/nouveau/disp: power down unused DP links during init drm/nouveau/kms/nv50: workaround EFI GOP window channel format differences net/rds: dma_map_sg is entitled to merge entries btrfs: fix race between marking inode needs to be logged and log syncing pipe: avoid unnecessary EPOLLET wakeups under normal loads pipe: do FASYNC notifications for every pipe IO, not just state changes mtd: spinand: Fix incorrect parameters for on-die ECC tipc: call tipc_wait_for_connect only when dlen is not 0 vt_kdsetmode: extend console locking Bluetooth: btusb: check conditions before enabling USB ALT 3 for WBS riscv: Fixup wrong ftrace remove cflag riscv: Fixup patch_text panic in ftrace perf env: Fix memory leak of bpf_prog_info_linear member perf symbol-elf: Fix memory leak by freeing sdt_note.args perf record: Fix memory leak in vDSO found using ASAN perf tools: Fix arm64 build error with gcc-11 perf annotate: Fix jump parsing for C++ code. powerpc/perf: Invoke per-CPU variable access with disabled interrupts srcu: Provide internal interface to start a Tree SRCU grace period srcu: Provide polling interfaces for Tree SRCU grace periods srcu: Provide internal interface to start a Tiny SRCU grace period srcu: Make Tiny SRCU use multi-bit grace-period counter srcu: Provide polling interfaces for Tiny SRCU grace periods tracepoint: Use rcu get state and cond sync for static call updates usb: typec: ucsi: acpi: Always decode connector change information usb: typec: ucsi: Work around PPM losing change information usb: typec: ucsi: Clear pending after acking connector change net: dsa: mt7530: fix VLAN traffic leaks again lkdtm: Enable DOUBLE_FAULT on all architectures arm64: dts: qcom: msm8994-angler: Fix gpio-reserved-ranges 85-88 btrfs: fix NULL pointer dereference when deleting device by invalid id kthread: Fix PF_KTHREAD vs to_kthread() race Revert "floppy: reintroduce O_NDELAY fix" Revert "parisc: Add assembly implementations for memset, strlen, strcpy, strncpy and strcat" net: don't unconditionally copy_from_user a struct ifreq for socket ioctls audit: move put_tree() to avoid trim_trees refcount underflow and UAF bpf: Fix potentially incorrect results with bpf_get_local_storage() Linux 5.10.62 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I5a9bf4b2c254ae21a10f838494cae1c3fa016be3	2021-09-03 10:51:56 +02:00
Peter Collingbourne	1890ee7ff8	net: don't unconditionally copy_from_user a struct ifreq for socket ioctls ... commit d0efb16294 upstream. A common implementation of isatty(3) involves calling a ioctl passing a dummy struct argument and checking whether the syscall failed -- bionic and glibc use TCGETS (passing a struct termios), and musl uses TIOCGWINSZ (passing a struct winsize). If the FD is a socket, we will copy sizeof(struct ifreq) bytes of data from the argument and return -EFAULT if that fails. The result is that the isatty implementations may return a non-POSIX-compliant value in errno in the case where part of the dummy struct argument is inaccessible, as both struct termios and struct winsize are smaller than struct ifreq (at least on arm64). Although there is usually enough stack space following the argument on the stack that this did not present a practical problem up to now, with MTE stack instrumentation it's more likely for the copy to fail, as the memory following the struct may have a different tag. Fix the problem by adding an early check for whether the ioctl is a valid socket ioctl, and return -ENOTTY if it isn't. Fixes: 44c02a2c3d ("dev_ioctl(): move copyin/copyout to callers") Link: https://linux-review.googlesource.com/id/I869da6cf6daabc3e4b7b82ac979683ba05e27d4d Signed-off-by: Peter Collingbourne <pcc@google.com> Cc: <stable@vger.kernel.org> # 4.19 Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-09-03 10:09:31 +02:00
Greg Kroah-Hartman	948d38f94d	Merge 5.10.46 into android12-5.10-lts ... Changes in 5.10.46 dmaengine: idxd: add missing dsa driver unregister dmaengine: fsl-dpaa2-qdma: Fix error return code in two functions dmaengine: xilinx: dpdma: initialize registers before request_irq dmaengine: ALTERA_MSGDMA depends on HAS_IOMEM dmaengine: QCOM_HIDMA_MGMT depends on HAS_IOMEM dmaengine: SF_PDMA depends on HAS_IOMEM dmaengine: stedma40: add missing iounmap() on error in d40_probe() afs: Fix an IS_ERR() vs NULL check mm/memory-failure: make sure wait for page writeback in memory_failure kvm: LAPIC: Restore guard to prevent illegal APIC register access fanotify: fix copy_event_to_user() fid error clean up batman-adv: Avoid WARN_ON timing related checks mac80211: fix skb length check in ieee80211_scan_rx() mlxsw: reg: Spectrum-3: Enforce lowest max-shaper burst size of 11 mlxsw: core: Set thermal zone polling delay argument to real value at init libbpf: Fixes incorrect rx_ring_setup_done net: ipv4: fix memory leak in netlbl_cipsov4_add_std vrf: fix maximum MTU net: rds: fix memory leak in rds_recvmsg net: dsa: felix: re-enable TX flow control in ocelot_port_flush() net: lantiq: disable interrupt before sheduling NAPI netfilter: nft_fib_ipv6: skip ipv6 packets from any to link-local ice: add ndo_bpf callback for safe mode netdev ops ice: parameterize functions responsible for Tx ring management udp: fix race between close() and udp_abort() rtnetlink: Fix regression in bridge VLAN configuration net/sched: act_ct: handle DNAT tuple collision net/mlx5e: Remove dependency in IPsec initialization flows net/mlx5e: Fix page reclaim for dead peer hairpin net/mlx5: Consider RoCE cap before init RDMA resources net/mlx5: DR, Allow SW steering for sw_owner_v2 devices net/mlx5: DR, Don't use SW steering when RoCE is not supported net/mlx5e: Block offload of outer header csum for UDP tunnels netfilter: synproxy: Fix out of bounds when parsing TCP options mptcp: Fix out of bounds when parsing TCP options sch_cake: Fix out of bounds when parsing TCP options and header mptcp: try harder to borrow memory from subflow under pressure mptcp: do not warn on bad input from the network selftests: mptcp: enable syncookie only in absence of reorders alx: Fix an error handling path in 'alx_probe()' cxgb4: fix endianness when flashing boot image cxgb4: fix sleep in atomic when flashing PHY firmware cxgb4: halt chip before flashing PHY firmware image net: stmmac: dwmac1000: Fix extended MAC address registers definition net: make get_net_ns return error if NET_NS is disabled net: qualcomm: rmnet: Update rmnet device MTU based on real device net: qualcomm: rmnet: don't over-count statistics ethtool: strset: fix message length calculation qlcnic: Fix an error handling path in 'qlcnic_probe()' netxen_nic: Fix an error handling path in 'netxen_nic_probe()' cxgb4: fix wrong ethtool n-tuple rule lookup ipv4: Fix device used for dst_alloc with local routes net: qrtr: fix OOB Read in qrtr_endpoint_post bpf: Fix leakage under speculation on mispredicted branches ptp: improve max_adj check against unreasonable values net: cdc_ncm: switch to eth%d interface naming lantiq: net: fix duplicated skb in rx descriptor ring net: usb: fix possible use-after-free in smsc75xx_bind net: fec_ptp: fix issue caused by refactor the fec_devtype net: ipv4: fix memory leak in ip_mc_add1_src net/af_unix: fix a data-race in unix_dgram_sendmsg / unix_release_sock net/mlx5: E-Switch, Read PF mac address net/mlx5: E-Switch, Allow setting GUID for host PF vport net/mlx5: Reset mkey index on creation be2net: Fix an error handling path in 'be_probe()' net: hamradio: fix memory leak in mkiss_close net: cdc_eem: fix tx fixup skb leak cxgb4: fix wrong shift. bnxt_en: Rediscover PHY capabilities after firmware reset bnxt_en: Fix TQM fastpath ring backing store computation bnxt_en: Call bnxt_ethtool_free() in bnxt_init_one() error path icmp: don't send out ICMP messages with a source address of 0.0.0.0 net: ethernet: fix potential use-after-free in ec_bhf_remove regulator: cros-ec: Fix error code in dev_err message regulator: bd70528: Fix off-by-one for buck123 .n_voltages setting platform/x86: thinkpad_acpi: Add X1 Carbon Gen 9 second fan support ASoC: rt5659: Fix the lost powers for the HDA header phy: phy-mtk-tphy: Fix some resource leaks in mtk_phy_init() ASoC: fsl-asoc-card: Set .owner attribute when registering card. regulator: rtmv20: Fix to make regcache value first reading back from HW spi: spi-zynq-qspi: Fix some wrong goto jumps & missing error code sched/pelt: Ensure that *_sum is always synced with *_avg ASoC: tas2562: Fix TDM_CFG0_SAMPRATE values spi: stm32-qspi: Always wait BUSY bit to be cleared in stm32_qspi_wait_cmd() regulator: rt4801: Fix NULL pointer dereference if priv->enable_gpios is NULL ASoC: rt5682: Fix the fast discharge for headset unplugging in soundwire mode pinctrl: ralink: rt2880: avoid to error in calls is pin is already enabled drm/sun4i: dw-hdmi: Make HDMI PHY into a platform device ASoC: qcom: lpass-cpu: Fix pop noise during audio capture begin radeon: use memcpy_to/fromio for UVD fw upload hwmon: (scpi-hwmon) shows the negative temperature properly mm: relocate 'write_protect_seq' in struct mm_struct irqchip/gic-v3: Workaround inconsistent PMR setting on NMI entry bpf: Inherit expanded/patched seen count from old aux data bpf: Do not mark insn as seen under speculative path verification can: bcm: fix infoleak in struct bcm_msg_head can: bcm/raw/isotp: use per module netdevice notifier can: j1939: fix Use-after-Free, hold skb ref while in use can: mcba_usb: fix memory leak in mcba_usb usb: core: hub: Disable autosuspend for Cypress CY7C65632 usb: chipidea: imx: Fix Battery Charger 1.2 CDP detection tracing: Do not stop recording cmdlines when tracing is off tracing: Do not stop recording comms if the trace file is being read tracing: Do no increment trace_clock_global() by one PCI: Mark TI C667X to avoid bus reset PCI: Mark some NVIDIA GPUs to avoid bus reset PCI: aardvark: Fix kernel panic during PIO transfer PCI: Add ACS quirk for Broadcom BCM57414 NIC PCI: Work around Huawei Intelligent NIC VF FLR erratum KVM: x86: Immediately reset the MMU context when the SMM flag is cleared KVM: x86/mmu: Calculate and check "full" mmu_role for nested MMU KVM: X86: Fix x86_emulator slab cache leak s390/mcck: fix calculation of SIE critical section size s390/ap: Fix hanging ioctl caused by wrong msg counter ARCv2: save ABI registers across signal handling x86/mm: Avoid truncating memblocks for SGX memory x86/process: Check PF_KTHREAD and not current->mm for kernel threads x86/ioremap: Map EFI-reserved memory as encrypted for SEV x86/pkru: Write hardware init value to PKRU when xstate is init x86/fpu: Prevent state corruption in __fpu__restore_sig() x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer x86/fpu: Reset state for all signal restore failures crash_core, vmcoreinfo: append 'SECTION_SIZE_BITS' to vmcoreinfo dmaengine: pl330: fix wrong usage of spinlock flags in dma_cyclc mac80211: Fix NULL ptr deref for injected rate info cfg80211: make certificate generation more robust cfg80211: avoid double free of PMSR request drm/amdgpu/gfx10: enlarge CP_MEC_DOORBELL_RANGE_UPPER to cover full doorbell. drm/amdgpu/gfx9: fix the doorbell missing when in CGPG issue. net: ll_temac: Make sure to free skb when it is completely used net: ll_temac: Fix TX BD buffer overwrite net: bridge: fix vlan tunnel dst null pointer dereference net: bridge: fix vlan tunnel dst refcnt when egressing mm/swap: fix pte_same_as_swp() not removing uffd-wp bit when compare mm/slub: clarify verification reporting mm/slub: fix redzoning for small allocations mm/slub: actually fix freelist pointer vs redzoning mm/slub.c: include swab.h net: stmmac: disable clocks in stmmac_remove_config_dt() net: fec_ptp: add clock rate zero check tools headers UAPI: Sync linux/in.h copy with the kernel sources perf beauty: Update copy of linux/socket.h with the kernel sources usb: dwc3: debugfs: Add and remove endpoint dirs dynamically usb: dwc3: core: fix kernel panic when do reboot Linux 5.10.46 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I99f37c9f257f90ccdb091306f3d4cfb7c32e3880	2021-06-23 17:53:08 +02:00
Changbin Du	4abfd597fe	net: make get_net_ns return error if NET_NS is disabled ... [ Upstream commit ea6932d70e ] There is a panic in socket ioctl cmd SIOCGSKNS when NET_NS is not enabled. The reason is that nsfs tries to access ns->ops but the proc_ns_operations is not implemented in this case. [7.670023] Unable to handle kernel NULL pointer dereference at virtual address 00000010 [7.670268] pgd = 32b54000 [7.670544] [00000010] *pgd=00000000 [7.671861] Internal error: Oops: 5 [#1] SMP ARM [7.672315] Modules linked in: [7.672918] CPU: 0 PID: 1 Comm: systemd Not tainted 5.13.0-rc3-00375-g6799d4f2da49 #16 [7.673309] Hardware name: Generic DT based system [7.673642] PC is at nsfs_evict+0x24/0x30 [7.674486] LR is at clear_inode+0x20/0x9c The same to tun SIOCGSKNS command. To fix this problem, we make get_net_ns() return -EINVAL when NET_NS is disabled. Meanwhile move it to right place net/core/net_namespace.c. Signed-off-by: Changbin Du <changbin.du@gmail.com> Fixes: c62cce2cae ("net: add an ioctl to get a socket network namespace") Cc: Cong Wang <xiyou.wangcong@gmail.com> Cc: Jakub Kicinski <kuba@kernel.org> Cc: David Laight <David.Laight@ACULAB.COM> Cc: Christian Brauner <christian.brauner@ubuntu.com> Suggested-by: Jakub Kicinski <kuba@kernel.org> Acked-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-06-23 14:42:44 +02:00
Greg Kroah-Hartman	5a8acc99f7	Merge 9ff9b0d392 ("Merge tag 'net-next-5.10' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next") into android-mainline ... Steps on the way to 5.10-rc1 Resolves merge issues in: drivers/net/virtio_net.c net/xfrm/xfrm_state.c net/xfrm/xfrm_user.c Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I3132e7802f25cb775eb02d0b3a03068da39a6fe2	2020-10-26 09:20:21 +01:00
Greg Kroah-Hartman	8de87f4d1c	Merge 5.9 into android-mainline ... Linux 5.9 Change-Id: Ic4308a3e2a4015058efdac52bd51794b604c8435 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2020-10-12 09:12:41 +02:00
David S. Miller	8b0308fe31	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net ... Rejecting non-native endian BTF overlapped with the addition of support for it. The rest were more simple overlapping changes, except the renesas ravb binding update, which had to follow a file move as well as a YAML conversion. Signed-off-by: David S. Miller <davem@davemloft.net>	2020-10-05 18:40:01 -07:00
Coly Li	7b62d31d3f	net: add WARN_ONCE in kernel_sendpage() for improper zero-copy send ... If a page sent into kernel_sendpage() is a slab page or it doesn't have ref_count, this page is improper to send by the zero copy sendpage() method. Otherwise such page might be unexpected released in network code path and causes impredictable panic due to kernel memory management data structure corruption. This path adds a WARN_ON() on the sending page before sends it into the concrete zero-copy sendpage() method, if the page is improper for the zero-copy sendpage() method, a warning message can be observed before the consequential unpredictable kernel panic. This patch does not change existing kernel_sendpage() behavior for the improper page zero-copy send, it just provides hint warning message for following potential panic due the kernel memory heap corruption. Signed-off-by: Coly Li <colyli@suse.de> Cc: Cong Wang <amwang@redhat.com> Cc: Christoph Hellwig <hch@lst.de> Cc: David S. Miller <davem@davemloft.net> Cc: Sridhar Samudrala <sri@us.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2020-10-02 15:27:08 -07:00
Greg Kroah-Hartman	3d3ef2a059	Merge 5.9-rc4 into android-mainline ... Linux 5.9-rc4 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I3d041935cae5e8f3421edcdee4892f17e2c776ad	2020-09-07 09:24:58 +02:00
Jakub Kicinski	44a8c4f33c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net ... We got slightly different patches removing a double word in a comment in net/ipv4/raw.c - picked the version from net. Simple conflict in drivers/net/ethernet/ibm/ibmvnic.c. Use cached values instead of VNIC login response buffer (following what commit 507ebe6444 ("ibmvnic: Fix use-after-free of VNIC login response buffer") did). Signed-off-by: Jakub Kicinski <kuba@kernel.org>	2020-09-04 21:28:59 -07:00
Miaohe Lin	645f08975f	net: Fix some comments ... Fix some comments, including wrong function name, duplicated word and so on. Signed-off-by: Miaohe Lin <linmiaohe@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2020-08-27 07:55:59 -07:00
Luke Hsiao	583bbf0624	io_uring: allow tcp ancillary data for __sys_recvmsg_sock() ... For TCP tx zero-copy, the kernel notifies the process of completions by queuing completion notifications on the socket error queue. This patch allows reading these notifications via recvmsg to support TCP tx zero-copy. Ancillary data was originally disallowed due to privilege escalation via io_uring's offloading of sendmsg() onto a kernel thread with kernel credentials (https://crbug.com/project-zero/1975). So, we must ensure that the socket type is one where the ancillary data types that are delivered on recvmsg are plain data (no file descriptors or values that are translated based on the identity of the calling process). This was tested by using io_uring to call recvmsg on the MSG_ERRQUEUE with tx zero-copy enabled. Before this patch, we received -EINVALID from this specific code path. After this patch, we could read tcp tx zero-copy completion notifications from the MSG_ERRQUEUE. Signed-off-by: Soheil Hassas Yeganeh <soheil@google.com> Signed-off-by: Arjun Roy <arjunroy@google.com> Acked-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Jann Horn <jannh@google.com> Reviewed-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Luke Hsiao <lukehsiao@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2020-08-24 16:16:06 -07:00
Greg Kroah-Hartman	682b15d471	Merge a1d21081a6 ("Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net") into android-mainline ... Steps on the way to 5.9-rc1 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I927040e73701d3ed235f871edd336beaa575ad96	2020-08-14 09:19:34 +02:00
Christoph Hellwig	0895708c5c	FROMGIT: net: Revert "net: optimize the sockptr_t for unified kernel/user address spaces" ... This reverts commits 6d04fe15f7 and a31edb2059. It turns out the idea to share a single pointer for both kernel and user space address causes various kinds of problems. So use the slightly less optimal version that uses an extra bit, but which is guaranteed to be safe everywhere. Fixes: 6d04fe15f7 ("net: optimize the sockptr_t for unified kernel/user address spaces") Reported-by: Eric Dumazet <edumazet@google.com> Reported-by: John Stultz <john.stultz@linaro.org> Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: David S. Miller <davem@davemloft.net> (cherry picked from commit 519a8a6cf9 https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git master) Signed-off-by: John Stultz <john.stultz@linaro.org> Change-Id: I645a8226be732b72cf8a404957754e3408dfc4bc	2020-08-11 10:02:52 +00:00
Christoph Hellwig	519a8a6cf9	net: Revert "net: optimize the sockptr_t for unified kernel/user address spaces" ... This reverts commits 6d04fe15f7 and a31edb2059. It turns out the idea to share a single pointer for both kernel and user space address causes various kinds of problems. So use the slightly less optimal version that uses an extra bit, but which is guaranteed to be safe everywhere. Fixes: 6d04fe15f7 ("net: optimize the sockptr_t for unified kernel/user address spaces") Reported-by: Eric Dumazet <edumazet@google.com> Reported-by: John Stultz <john.stultz@linaro.org> Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: David S. Miller <davem@davemloft.net>	2020-08-10 12:06:44 -07:00
Miaohe Lin	7c7ab580db	net: Convert to use the fallthrough macro ... Convert the uses of fallthrough comments to fallthrough macro. Signed-off-by: Miaohe Lin <linmiaohe@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2020-08-08 14:29:09 -07:00
Miaohe Lin	47260ba937	net: Remove meaningless jump label out_fs ... The out_fs jump label has nothing to do but goto out. Signed-off-by: Miaohe Lin <linmiaohe@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2020-08-08 14:23:21 -07:00
Miaohe Lin	ce787a5a07	net: Set fput_needed iff FDPUT_FPUT is set ... We should fput() file iff FDPUT_FPUT is set. So we should set fput_needed accordingly. Fixes: 00e188ef6a ("sockfd_lookup_light(): switch to fdget^W^Waway from fget_light") Signed-off-by: Miaohe Lin <linmiaohe@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2020-08-08 14:21:42 -07:00
Miaohe Lin	6b07edebe6	net: Use helper function fdput() ... Use helper function fdput() to fput() the file iff FDPUT_FPUT is set. Signed-off-by: Miaohe Lin <linmiaohe@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2020-08-08 14:19:16 -07:00
Greg Kroah-Hartman	f04a11ac99	Merge 7b4ea9456d ("Revert "x86/mm/64: Do not sync vmalloc/ioremap mappings"") into android-mainline ... Steps on the way to 5.9-rc1 Resolves conflicts in: drivers/irqchip/qcom-pdc.c include/linux/device.h net/xfrm/xfrm_state.c security/lsm_audit.c Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I4aeb3d04f4717714a421721eb3ce690c099bb30a	2020-08-07 16:01:35 +02:00
Christoph Hellwig	a31edb2059	net: improve the user pointer check in init_user_sockptr ... Make sure not just the pointer itself but the whole range lies in the user address space. For that pass the length and then use the access_ok helper to do the check. Fixes: 6d04fe15f7 ("net: optimize the sockptr_t for unified kernel/user address spaces") Reported-by: David Laight <David.Laight@ACULAB.COM> Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: David S. Miller <davem@davemloft.net>	2020-07-28 13:43:40 -07:00
Christoph Hellwig	6d04fe15f7	net: optimize the sockptr_t for unified kernel/user address spaces ... For architectures like x86 and arm64 we don't need the separate bit to indicate that a pointer is a kernel pointer as the address spaces are unified. That way the sockptr_t can be reduced to a union of two pointers, which leads to nicer calling conventions. The only caveat is that we need to check that users don't pass in kernel address and thus gain access to kernel memory. Thus the USER_SOCKPTR helper is replaced with a init_user_sockptr function that does this check and returns an error if it fails. Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: David S. Miller <davem@davemloft.net>	2020-07-24 15:41:54 -07:00
Christoph Hellwig	a7b75c5a8c	net: pass a sockptr_t into ->setsockopt ... Rework the remaining setsockopt code to pass a sockptr_t instead of a plain user pointer. This removes the last remaining set_fs(KERNEL_DS) outside of architecture specific code. Signed-off-by: Christoph Hellwig <hch@lst.de> Acked-by: Stefan Schmidt <stefan@datenfreihafen.org> [ieee802154] Acked-by: Matthieu Baerts <matthieu.baerts@tessares.net> Signed-off-by: David S. Miller <davem@davemloft.net>	2020-07-24 15:41:54 -07:00
Christoph Hellwig	c8c1bbb6eb	net: switch sock_set_timeout to sockptr_t ... Pass a sockptr_t to prepare for set_fs-less handling of the kernel pointer from bpf-cgroup. Signed-off-by: Christoph Hellwig <hch@lst.de> Acked-by: Matthieu Baerts <matthieu.baerts@tessares.net> Signed-off-by: David S. Miller <davem@davemloft.net>	2020-07-24 15:41:53 -07:00
Christoph Hellwig	a44d9e7210	net: make ->{get,set}sockopt in proto_ops optional ... Just check for a NULL method instead of wiring up sock_no_{get,set}sockopt. Signed-off-by: Christoph Hellwig <hch@lst.de> Acked-by: Marc Kleine-Budde <mkl@pengutronix.de> Signed-off-by: David S. Miller <davem@davemloft.net>	2020-07-19 18:16:41 -07:00
Christoph Hellwig	55db9c0e85	net: remove compat_sys_{get,set}sockopt ... Now that the ->compat_{get,set}sockopt proto_ops methods are gone there is no good reason left to keep the compat syscalls separate. This fixes the odd use of unsigned int for the compat_setsockopt optlen and the missing sock_use_custom_sol_socket. It would also easily allow running the eBPF hooks for the compat syscalls, but such a large change in behavior does not belong into a consolidation patch like this one. Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: David S. Miller <davem@davemloft.net>	2020-07-19 18:16:40 -07:00
Christoph Hellwig	d8a9b38f83	net: streamline __sys_getsockopt ... Return early when sockfd_lookup_light fails to reduce a level of indentation for most of the function body. Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: David S. Miller <davem@davemloft.net>	2020-07-19 18:16:40 -07:00
Christoph Hellwig	4a3672993f	net: streamline __sys_setsockopt ... Return early when sockfd_lookup_light fails to reduce a level of indentation for most of the function body. Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: David S. Miller <davem@davemloft.net>	2020-07-19 18:16:40 -07:00
Andrew Lunn	9a8ad9ac81	net: socket: Move kerneldoc next to function it documents ... Fix the warning "Function parameter or member 'inode' not described in '__sock_release'' due to the kerneldoc being placed before __sock_release() not sock_release(), which does not take an inode parameter. Signed-off-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: David S. Miller <davem@davemloft.net>	2020-07-13 17:20:40 -07:00
Florian Westphal	83f0c10bc3	net: use mptcp setsockopt function for SOL_SOCKET on mptcp sockets ... setsockopt(mptcp_fd, SOL_SOCKET, ...)... appears to work (returns 0), but it has no effect -- this is because the MPTCP layer never has a chance to copy the settings to the subflow socket. Skip the generic handling for the mptcp case and instead call the mptcp specific handler instead for SOL_SOCKET too. Next patch adds more specific handling for SOL_SOCKET to mptcp. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: David S. Miller <davem@davemloft.net>	2020-07-04 17:56:22 -07:00
Greg Kroah-Hartman	8a8d41512f	Merge cb8e59cc87 ("Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next") into android-mainline ... Steps along the way to 5.8-rc1. Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I280c0a50b5e137596b1c327759c6a18675908179	2020-06-22 14:58:18 +02:00
Christoph Hellwig	5a892ff2fa	net: remove kernel_setsockopt ... No users left. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2020-05-29 13:10:39 -07:00
Christoph Hellwig	7a15b2e013	net: remove kernel_getsockopt ... No users left. Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: David S. Miller <davem@davemloft.net>	2020-05-27 15:11:33 -07:00