Merge 5.4.259 into android11-5.4-lts

Changes in 5.4.259
	RDMA/cxgb4: Check skb value for failure to allocate
	lib/test_meminit: fix off-by-one error in test_pages()
	pwm: hibvt: Explicitly set .polarity in .get_state()
	HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect
	quota: Fix slow quotaoff
	net: prevent address rewrite in kernel_bind()
	drm: etvnaviv: fix bad backport leading to warning
	drm/msm/dsi: skip the wait for video mode done if not applicable
	ravb: Fix up dma_free_coherent() call in ravb_remove()
	ieee802154: ca8210: Fix a potential UAF in ca8210_probe
	mlxsw: fix mlxsw_sp2_nve_vxlan_learning_set() return type
	xen-netback: use default TX queue size for vifs
	drm/vmwgfx: fix typo of sizeof argument
	ixgbe: fix crash with empty VF macvlan list
	net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()
	nfc: nci: assert requested protocol is valid
	workqueue: Override implicit ordered attribute in workqueue_apply_unbound_cpumask()
	dmaengine: stm32-mdma: abort resume if no ongoing transfer
	usb: xhci: xhci-ring: Use sysdev for mapping bounce buffer
	net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read
	usb: dwc3: Soft reset phy on probe for host
	usb: musb: Get the musb_qh poniter after musb_giveback
	usb: musb: Modify the "HWVers" register address
	iio: pressure: bmp280: Fix NULL pointer exception
	iio: pressure: dps310: Adjust Timeout Settings
	iio: pressure: ms5611: ms5611_prom_is_valid false negative bug
	mcb: remove is_added flag from mcb_device struct
	libceph: use kernel_connect()
	ceph: fix incorrect revoked caps assert in ceph_fill_file_size()
	Input: powermate - fix use-after-free in powermate_config_complete
	Input: psmouse - fix fast_reconnect function for PS/2 mode
	Input: xpad - add PXN V900 support
	cgroup: Remove duplicates in cgroup v1 tasks file
	pinctrl: avoid unsafe code pattern in find_pinctrl()
	usb: gadget: udc-xilinx: replace memcpy with memcpy_toio
	usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call
	x86/cpu: Fix AMD erratum #1485 on Zen4-based CPUs
	dmaengine: mediatek: Fix deadlock caused by synchronize_irq()
	powerpc/8xx: Fix pte_access_permitted() for PAGE_NONE
	powerpc/64e: Fix wrong test in __ptep_test_and_clear_young()
	ravb: Fix use-after-free issue in ravb_tx_timeout_work()
	dev_forward_skb: do not scrub skb mark within the same name space
	Documentation: sysctl: align cells in second content column
	usb: hub: Guard against accesses to uninitialized BOS descriptors
	Bluetooth: hci_event: Ignore NULL link key
	Bluetooth: Reject connection with the device which has same BD_ADDR
	Bluetooth: Fix a refcnt underflow problem for hci_conn
	Bluetooth: vhci: Fix race when opening vhci device
	Bluetooth: hci_event: Fix coding style
	Bluetooth: avoid memcmp() out of bounds warning
	ice: fix over-shifted variable
	nfc: nci: fix possible NULL pointer dereference in send_acknowledge()
	regmap: fix NULL deref on lookup
	KVM: x86: Mask LVTPC when handling a PMI
	netfilter: nft_payload: fix wrong mac header matching
	qed: fix LL2 RX buffer allocation
	xfrm: fix a data-race in xfrm_gen_index()
	xfrm: interface: use DEV_STATS_INC()
	net: ipv4: fix return value check in esp_remove_trailer
	net: ipv6: fix return value check in esp_remove_trailer
	net: rfkill: gpio: prevent value glitch during probe
	tcp: fix excessive TLP and RACK timeouts from HZ rounding
	tcp: tsq: relax tcp_small_queue_check() when rtx queue contains a single skb
	tun: prevent negative ifindex
	ipv4: fib: annotate races around nh->nh_saddr_genid and nh->nh_saddr
	net: usb: smsc95xx: Fix an error code in smsc95xx_reset()
	i40e: prevent crash on probe if hw registers have invalid values
	net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve
	neighbor: tracing: Move pin6 inside CONFIG_IPV6=y section
	netfilter: nft_set_rbtree: .deactivate fails if element has expired
	net: pktgen: Fix interface flags printing
	resource: Add irqresource_disabled()
	ACPI: Drop acpi_dev_irqresource_disabled()
	ACPI: resources: Add DMI-based legacy IRQ override quirk
	ACPI: resource: Skip IRQ override on Asus Vivobook K3402ZA/K3502ZA
	ACPI: resource: Add ASUS model S5402ZA to quirks
	ACPI: resource: Skip IRQ override on Asus Vivobook S5602ZA
	ACPI: resource: Add Asus ExpertBook B2502 to Asus quirks
	ACPI: resource: Skip IRQ override on Asus Expertbook B2402CBA
	ACPI: resource: Skip IRQ override on ASUS ExpertBook B1502CBA
	ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA
	ARM: dts: ti: omap: Fix noisy serial with overrun-throttle-ms for mapphone
	btrfs: return -EUCLEAN for delayed tree ref with a ref count not equals to 1
	btrfs: initialize start_slot in btrfs_log_prealloc_extents
	i2c: mux: Avoid potential false error message in i2c_mux_add_adapter
	overlayfs: set ctime when setting mtime and atime
	gpio: timberdale: Fix potential deadlock on &tgpio->lock
	ata: libata-eh: Fix compilation warning in ata_eh_link_report()
	tracing: relax trace_event_eval_update() execution with cond_resched()
	HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event
	Bluetooth: Avoid redundant authentication
	Bluetooth: hci_core: Fix build warnings
	wifi: mac80211: allow transmitting EAPOL frames with tainted key
	wifi: cfg80211: avoid leaking stack data into trace
	regulator/core: Revert "fix kobject release warning and memory leak in regulator_register()"
	sky2: Make sure there is at least one frag_addr available
	drm: panel-orientation-quirks: Add quirk for One Mix 2S
	btrfs: fix some -Wmaybe-uninitialized warnings in ioctl.c
	HID: multitouch: Add required quirk for Synaptics 0xcd7e device
	Bluetooth: hci_event: Fix using memcmp when comparing keys
	mtd: rawnand: qcom: Unmap the right resource upon probe failure
	mtd: spinand: micron: correct bitmask for ecc status
	mtd: physmap-core: Restore map_rom fallback
	mmc: core: sdio: hold retuning if sdio in 1-bit mode
	mmc: core: Capture correct oemid-bits for eMMC cards
	Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()"
	ACPI: irq: Fix incorrect return value in acpi_register_gsi()
	USB: serial: option: add Telit LE910C4-WWX 0x1035 composition
	USB: serial: option: add entry for Sierra EM9191 with new firmware
	USB: serial: option: add Fibocom to DELL custom modem FM101R-GL
	perf: Disallow mis-matched inherited group reads
	s390/pci: fix iommu bitmap allocation
	gpio: vf610: set value before the direction to avoid a glitch
	ASoC: pxa: fix a memory leak in probe()
	phy: mapphone-mdm6600: Fix runtime disable on probe
	phy: mapphone-mdm6600: Fix runtime PM for remove
	phy: mapphone-mdm6600: Fix pinctrl_pm handling for sleep pins
	Bluetooth: hci_sock: fix slab oob read in create_monitor_event
	Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name
	xfrm6: fix inet6_dev refcount underflow problem
	Linux 5.4.259

Change-Id: I413388a8527327650b234e3f14fce5ca6137c6c8
Signed-off-by: Greg Kroah-Hartman <[email protected]>
This commit is contained in:
Greg Kroah-Hartman 2023-10-26 08:52:11 +00:00
commit 6b5f21afc2
115 changed files with 724 additions and 310 deletions

View file

@ -368,10 +368,9 @@ static int pidlist_array_load(struct cgroup *cgrp, enum cgroup_filetype type,
}
css_task_iter_end(&it);
length = n;
/* now sort & (if procs) strip out duplicates */
/* now sort & strip out duplicates (tgids or recycled thread PIDs) */
sort(array, length, sizeof(pid_t), cmppid, NULL);
if (type == CGROUP_FILE_PROCS)
length = pidlist_uniq(array, length);
length = pidlist_uniq(array, length);
l = cgroup_pidlist_find_create(cgrp, type);
if (!l) {

View file

@ -1849,6 +1849,7 @@ static void perf_group_attach(struct perf_event *event)
list_add_tail(&event->sibling_list, &group_leader->sibling_list);
group_leader->nr_siblings++;
group_leader->group_generation++;
perf_event__header_size(group_leader);
@ -2004,6 +2005,7 @@ static void perf_group_detach(struct perf_event *event)
if (event->group_leader != event) {
list_del_init(&event->sibling_list);
event->group_leader->nr_siblings--;
event->group_leader->group_generation++;
goto out;
}
@ -4857,7 +4859,7 @@ static int __perf_read_group_add(struct perf_event *leader,
u64 read_format, u64 *values)
{
struct perf_event_context *ctx = leader->ctx;
struct perf_event *sub;
struct perf_event *sub, *parent;
unsigned long flags;
int n = 1; /* skip @nr */
int ret;
@ -4867,6 +4869,33 @@ static int __perf_read_group_add(struct perf_event *leader,
return ret;
raw_spin_lock_irqsave(&ctx->lock, flags);
/*
* Verify the grouping between the parent and child (inherited)
* events is still in tact.
*
* Specifically:
* - leader->ctx->lock pins leader->sibling_list
* - parent->child_mutex pins parent->child_list
* - parent->ctx->mutex pins parent->sibling_list
*
* Because parent->ctx != leader->ctx (and child_list nests inside
* ctx->mutex), group destruction is not atomic between children, also
* see perf_event_release_kernel(). Additionally, parent can grow the
* group.
*
* Therefore it is possible to have parent and child groups in a
* different configuration and summing over such a beast makes no sense
* what so ever.
*
* Reject this.
*/
parent = leader->parent;
if (parent &&
(parent->group_generation != leader->group_generation ||
parent->nr_siblings != leader->nr_siblings)) {
ret = -ECHILD;
goto unlock;
}
/*
* Since we co-schedule groups, {enabled,running} times of siblings
@ -4896,8 +4925,9 @@ static int __perf_read_group_add(struct perf_event *leader,
values[n++] = primary_event_id(sub);
}
unlock:
raw_spin_unlock_irqrestore(&ctx->lock, flags);
return 0;
return ret;
}
static int perf_read_group(struct perf_event *event,
@ -4916,10 +4946,6 @@ static int perf_read_group(struct perf_event *event,
values[0] = 1 + leader->nr_siblings;
/*
* By locking the child_mutex of the leader we effectively
* lock the child list of all siblings.. XXX explain how.
*/
mutex_lock(&leader->child_mutex);
ret = __perf_read_group_add(leader, read_format, values);
@ -12024,6 +12050,7 @@ static int inherit_group(struct perf_event *parent_event,
!perf_get_aux_event(child_ctr, leader))
return -EINVAL;
}
leader->group_generation = parent_event->group_generation;
return 0;
}

View file

@ -2236,6 +2236,7 @@ void trace_event_eval_update(struct trace_eval_map **map, int len)
update_event_printk(call, map[i]);
}
}
cond_resched();
}
up_write(&trace_event_sem);
}

View file

@ -5279,9 +5279,13 @@ static int workqueue_apply_unbound_cpumask(void)
list_for_each_entry(wq, &workqueues, list) {
if (!(wq->flags & WQ_UNBOUND))
continue;
/* creating multiple pwqs breaks ordering guarantee */
if (wq->flags & __WQ_ORDERED)
continue;
if (!list_empty(&wq->pwqs)) {
if (wq->flags & __WQ_ORDERED_EXPLICIT)
continue;
wq->flags &= ~__WQ_ORDERED;
}
ctx = apply_wqattrs_prepare(wq, wq->unbound_attrs);
if (!ctx) {