This is the 5.4.51 stable release

-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl8GyVUACgkQONu9yGCS
 aT6MCBAAxQpPQYQ8XNq40G2U3rENx2gIOgSA9WjkGsCij6Ad8VjkbA2KqqJ6v0GF
 McIomgdR+bviZKYPJHfdVlOGWGGTtDe1hi6GVoXuc/CTOPK386/v/vMTumdQ2bLb
 5fkuvpFGNdxGmhi+Vpu6zajvF8CVHmCggQQGlrIyIIOXPwN/DB/7XK6lmtx0vcff
 YYZI3L1+q1rJz6vV5K5xTwpPwCQDsdYW93KQpcccVKMAmnAzFolaWyvWitvqOgT5
 xrnelzjrIy5v2BST0S7jL0nzEeXB6bq1tmJHbd+cTvIaKJx4NR8yx2cXzvospi3l
 TpwuycBo/0LRWAiFZ+29+HOHkvUx7sa+BFCLiZEu1dLAxRXdi/W0a/i0QFGb0ex/
 YO8dBVEdHVRm0aXlfnipJYuNdTxzSzUG0GHOvZB11h/zxybiLWjJGutofX0tZXYj
 JuO9UhP0eSldtfuATrXRPsSsTWWen1igVTWFVHEZPWGvR4TiU8jpFPOTFcrraglM
 07M3ooA6FlWrTt7n9YdGLaQY6w2z+pREMgnUesNY9yQeRxY2EAsa95Lu+Y6aTeYP
 YfTPQHhbbz3XggFljGYIbvM6wlzgghSLH09CX8zxFqeYyTSFsNDKBuLslmTMS/21
 zwpG81hm7fE58N3uUHqSU3/bN8kzCH6GsU78bFAXb+jaNKgG5Qg=
 =0uVY
 -----END PGP SIGNATURE-----

Merge 5.4.51 into android11-5.4

Changes in 5.4.51
	io_uring: make sure async workqueue is canceled on exit
	mm: fix swap cache node allocation mask
	EDAC/amd64: Read back the scrub rate PCI register on F15h
	usbnet: smsc95xx: Fix use-after-free after removal
	sched/debug: Make sd->flags sysctl read-only
	mm/slub.c: fix corrupted freechain in deactivate_slab()
	mm/slub: fix stack overruns with SLUB_STATS
	rxrpc: Fix race between incoming ACK parser and retransmitter
	usb: usbtest: fix missing kfree(dev->buf) in usbtest_disconnect
	tools lib traceevent: Add append() function helper for appending strings
	tools lib traceevent: Handle __attribute__((user)) in field names
	s390/debug: avoid kernel warning on too large number of pages
	nvme-multipath: set bdi capabilities once
	nvme-multipath: fix deadlock between ana_work and scan_work
	nvme-multipath: fix deadlock due to head->lock
	nvme-multipath: fix bogus request queue reference put
	kgdb: Avoid suspicious RCU usage warning
	selftests: tpm: Use /bin/sh instead of /bin/bash
	tpm: Fix TIS locality timeout problems
	crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock()
	drm/msm/dpu: fix error return code in dpu_encoder_init
	rxrpc: Fix afs large storage transmission performance drop
	RDMA/counter: Query a counter before release
	cxgb4: use unaligned conversion for fetching timestamp
	cxgb4: parse TC-U32 key values and masks natively
	cxgb4: fix endian conversions for L4 ports in filters
	cxgb4: use correct type for all-mask IP address comparison
	cxgb4: fix SGE queue dump destination buffer context
	hwmon: (max6697) Make sure the OVERT mask is set correctly
	hwmon: (acpi_power_meter) Fix potential memory leak in acpi_power_meter_add()
	thermal/drivers/mediatek: Fix bank number settings on mt8183
	thermal/drivers/rcar_gen3: Fix undefined temperature if negative
	nfsd4: fix nfsdfs reference count loop
	nfsd: fix nfsdfs inode reference count leak
	drm: sun4i: hdmi: Remove extra HPD polling
	virtio-blk: free vblk-vqs in error path of virtblk_probe()
	SMB3: Honor 'posix' flag for multiuser mounts
	nvme: fix identify error status silent ignore
	nvme: fix a crash in nvme_mpath_add_disk
	samples/vfs: avoid warning in statx override
	i2c: algo-pca: Add 0x78 as SCL stuck low status for PCA9665
	i2c: mlxcpld: check correct size of maximum RECV_LEN packet
	spi: spi-fsl-dspi: Fix external abort on interrupt in resume or exit paths
	nfsd: apply umask on fs without ACL support
	Revert "ALSA: usb-audio: Improve frames size computation"
	SMB3: Honor 'seal' flag for multiuser mounts
	SMB3: Honor persistent/resilient handle flags for multiuser mounts
	SMB3: Honor lease disabling for multiuser mounts
	SMB3: Honor 'handletimeout' flag for multiuser mounts
	cifs: Fix the target file was deleted when rename failed.
	MIPS: lantiq: xway: sysctrl: fix the GPHY clock alias names
	MIPS: Add missing EHB in mtc0 -> mfc0 sequence for DSPen
	drm/amd/display: Only revalidate bandwidth on medium and fast updates
	drm/amdgpu: use %u rather than %d for sclk/mclk
	drm/amdgpu/atomfirmware: fix vram_info fetching for renoir
	dma-buf: Move dma_buf_release() from fops to dentry_ops
	irqchip/gic: Atomically update affinity
	mm, compaction: fully assume capture is not NULL in compact_zone_order()
	mm, compaction: make capture control handling safe wrt interrupts
	x86/resctrl: Fix memory bandwidth counter width for AMD
	dm zoned: assign max_io_len correctly
	efi: Make it possible to disable efivar_ssdt entirely
	Linux 5.4.51

Signed-off-by: Greg Kroah-Hartman <[email protected]>
Change-Id: Ib29e1b61540451995ee757cf90c9ba24e6b8d6b3

mm/compaction.c

@@ -2310,16 +2310,26 @@ static enum compact_result compact_zone_order(struct zone *zone, int order,
 		.page = NULL,
 	};
 
-	if (capture)
-		current->capture_control = &capc;
+	/*
+	 * Make sure the structs are really initialized before we expose the
+	 * capture control, in case we are interrupted and the interrupt handler
+	 * frees a page.
+	 */
+	barrier();
+	WRITE_ONCE(current->capture_control, &capc);
 
 	ret = compact_zone(&cc, &capc);
 
 	VM_BUG_ON(!list_empty(&cc.freepages));
 	VM_BUG_ON(!list_empty(&cc.migratepages));
 
-	*capture = capc.page;
-	current->capture_control = NULL;
+	/*
+	 * Make sure we hide capture control first before we read the captured
+	 * page pointer, otherwise an interrupt could free and capture a page
+	 * and we would leak it.
+	 */
+	WRITE_ONCE(current->capture_control, NULL);
+	*capture = READ_ONCE(capc.page);
 
 	return ret;
 }
@@ -2333,6 +2343,7 @@ int sysctl_extfrag_threshold = 500;
  * @alloc_flags: The allocation flags of the current allocation
  * @ac: The context of current allocation
  * @prio: Determines how hard direct compaction should try to succeed
+ * @capture: Pointer to free page created by compaction will be stored here
  *
  * This is the main entry point for direct page compaction.
  */

mm/slub.c

@@ -644,6 +644,20 @@ static void slab_fix(struct kmem_cache *s, char *fmt, ...)
 	va_end(args);
 }
 
+static bool freelist_corrupted(struct kmem_cache *s, struct page *page,
+			       void *freelist, void *nextfree)
+{
+	if ((s->flags & SLAB_CONSISTENCY_CHECKS) &&
+	    !check_valid_pointer(s, page, nextfree)) {
+		object_err(s, page, freelist, "Freechain corrupt");
+		freelist = NULL;
+		slab_fix(s, "Isolate corrupted freechain");
+		return true;
+	}
+
+	return false;
+}
+
 static void print_trailer(struct kmem_cache *s, struct page *page, u8 *p)
 {
 	unsigned int off;	/* Offset of last byte */
@@ -1379,6 +1393,11 @@ static inline void inc_slabs_node(struct kmem_cache *s, int node,
 static inline void dec_slabs_node(struct kmem_cache *s, int node,
 							int objects) {}
 
+static bool freelist_corrupted(struct kmem_cache *s, struct page *page,
+			       void *freelist, void *nextfree)
+{
+	return false;
+}
 #endif /* CONFIG_SLUB_DEBUG */
 
 /*
@@ -2062,6 +2081,14 @@ static void deactivate_slab(struct kmem_cache *s, struct page *page,
 		void *prior;
 		unsigned long counters;
 
+		/*
+		 * If 'nextfree' is invalid, it is possible that the object at
+		 * 'freelist' is already corrupted.  So isolate all objects
+		 * starting at 'freelist'.
+		 */
+		if (freelist_corrupted(s, page, freelist, nextfree))
+			break;
+
 		do {
 			prior = page->freelist;
 			counters = page->counters;
@@ -5621,7 +5648,8 @@ static void memcg_propagate_slab_attrs(struct kmem_cache *s)
 		 */
 		if (buffer)
 			buf = buffer;
-		else if (root_cache->max_attr_size < ARRAY_SIZE(mbuf))
+		else if (root_cache->max_attr_size < ARRAY_SIZE(mbuf) &&
+			 !IS_ENABLED(CONFIG_SLUB_STATS))
 			buf = mbuf;
 		else {
 			buffer = (char *) get_zeroed_page(GFP_KERNEL);

mm/swap_state.c

@@ -23,6 +23,7 @@
 #include <linux/huge_mm.h>
 
 #include <asm/pgtable.h>
+#include "internal.h"
 
 /*
  * swapper_space is a fiction, retained to simplify the path through
@@ -418,7 +419,8 @@ struct page *__read_swap_cache_async(swp_entry_t entry, gfp_t gfp_mask,
 		/* May fail (-ENOMEM) if XArray node allocation failed. */
 		__SetPageLocked(new_page);
 		__SetPageSwapBacked(new_page);
-		err = add_to_swap_cache(new_page, entry, gfp_mask & GFP_KERNEL);
+		err = add_to_swap_cache(new_page, entry,
+					gfp_mask & GFP_RECLAIM_MASK);
 		if (likely(!err)) {
 			/* Initiate read into locked page */
 			SetPageWorkingset(new_page);