mirror of
https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git
synced 2026-10-30 11:41:38 -04:00
Merge 5.4.259 into android11-5.4-lts
Changes in 5.4.259 RDMA/cxgb4: Check skb value for failure to allocate lib/test_meminit: fix off-by-one error in test_pages() pwm: hibvt: Explicitly set .polarity in .get_state() HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect quota: Fix slow quotaoff net: prevent address rewrite in kernel_bind() drm: etvnaviv: fix bad backport leading to warning drm/msm/dsi: skip the wait for video mode done if not applicable ravb: Fix up dma_free_coherent() call in ravb_remove() ieee802154: ca8210: Fix a potential UAF in ca8210_probe mlxsw: fix mlxsw_sp2_nve_vxlan_learning_set() return type xen-netback: use default TX queue size for vifs drm/vmwgfx: fix typo of sizeof argument ixgbe: fix crash with empty VF macvlan list net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() nfc: nci: assert requested protocol is valid workqueue: Override implicit ordered attribute in workqueue_apply_unbound_cpumask() dmaengine: stm32-mdma: abort resume if no ongoing transfer usb: xhci: xhci-ring: Use sysdev for mapping bounce buffer net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read usb: dwc3: Soft reset phy on probe for host usb: musb: Get the musb_qh poniter after musb_giveback usb: musb: Modify the "HWVers" register address iio: pressure: bmp280: Fix NULL pointer exception iio: pressure: dps310: Adjust Timeout Settings iio: pressure: ms5611: ms5611_prom_is_valid false negative bug mcb: remove is_added flag from mcb_device struct libceph: use kernel_connect() ceph: fix incorrect revoked caps assert in ceph_fill_file_size() Input: powermate - fix use-after-free in powermate_config_complete Input: psmouse - fix fast_reconnect function for PS/2 mode Input: xpad - add PXN V900 support cgroup: Remove duplicates in cgroup v1 tasks file pinctrl: avoid unsafe code pattern in find_pinctrl() usb: gadget: udc-xilinx: replace memcpy with memcpy_toio usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call x86/cpu: Fix AMD erratum #1485 on Zen4-based CPUs dmaengine: mediatek: Fix deadlock caused by synchronize_irq() powerpc/8xx: Fix pte_access_permitted() for PAGE_NONE powerpc/64e: Fix wrong test in __ptep_test_and_clear_young() ravb: Fix use-after-free issue in ravb_tx_timeout_work() dev_forward_skb: do not scrub skb mark within the same name space Documentation: sysctl: align cells in second content column usb: hub: Guard against accesses to uninitialized BOS descriptors Bluetooth: hci_event: Ignore NULL link key Bluetooth: Reject connection with the device which has same BD_ADDR Bluetooth: Fix a refcnt underflow problem for hci_conn Bluetooth: vhci: Fix race when opening vhci device Bluetooth: hci_event: Fix coding style Bluetooth: avoid memcmp() out of bounds warning ice: fix over-shifted variable nfc: nci: fix possible NULL pointer dereference in send_acknowledge() regmap: fix NULL deref on lookup KVM: x86: Mask LVTPC when handling a PMI netfilter: nft_payload: fix wrong mac header matching qed: fix LL2 RX buffer allocation xfrm: fix a data-race in xfrm_gen_index() xfrm: interface: use DEV_STATS_INC() net: ipv4: fix return value check in esp_remove_trailer net: ipv6: fix return value check in esp_remove_trailer net: rfkill: gpio: prevent value glitch during probe tcp: fix excessive TLP and RACK timeouts from HZ rounding tcp: tsq: relax tcp_small_queue_check() when rtx queue contains a single skb tun: prevent negative ifindex ipv4: fib: annotate races around nh->nh_saddr_genid and nh->nh_saddr net: usb: smsc95xx: Fix an error code in smsc95xx_reset() i40e: prevent crash on probe if hw registers have invalid values net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve neighbor: tracing: Move pin6 inside CONFIG_IPV6=y section netfilter: nft_set_rbtree: .deactivate fails if element has expired net: pktgen: Fix interface flags printing resource: Add irqresource_disabled() ACPI: Drop acpi_dev_irqresource_disabled() ACPI: resources: Add DMI-based legacy IRQ override quirk ACPI: resource: Skip IRQ override on Asus Vivobook K3402ZA/K3502ZA ACPI: resource: Add ASUS model S5402ZA to quirks ACPI: resource: Skip IRQ override on Asus Vivobook S5602ZA ACPI: resource: Add Asus ExpertBook B2502 to Asus quirks ACPI: resource: Skip IRQ override on Asus Expertbook B2402CBA ACPI: resource: Skip IRQ override on ASUS ExpertBook B1502CBA ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA ARM: dts: ti: omap: Fix noisy serial with overrun-throttle-ms for mapphone btrfs: return -EUCLEAN for delayed tree ref with a ref count not equals to 1 btrfs: initialize start_slot in btrfs_log_prealloc_extents i2c: mux: Avoid potential false error message in i2c_mux_add_adapter overlayfs: set ctime when setting mtime and atime gpio: timberdale: Fix potential deadlock on &tgpio->lock ata: libata-eh: Fix compilation warning in ata_eh_link_report() tracing: relax trace_event_eval_update() execution with cond_resched() HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event Bluetooth: Avoid redundant authentication Bluetooth: hci_core: Fix build warnings wifi: mac80211: allow transmitting EAPOL frames with tainted key wifi: cfg80211: avoid leaking stack data into trace regulator/core: Revert "fix kobject release warning and memory leak in regulator_register()" sky2: Make sure there is at least one frag_addr available drm: panel-orientation-quirks: Add quirk for One Mix 2S btrfs: fix some -Wmaybe-uninitialized warnings in ioctl.c HID: multitouch: Add required quirk for Synaptics 0xcd7e device Bluetooth: hci_event: Fix using memcmp when comparing keys mtd: rawnand: qcom: Unmap the right resource upon probe failure mtd: spinand: micron: correct bitmask for ecc status mtd: physmap-core: Restore map_rom fallback mmc: core: sdio: hold retuning if sdio in 1-bit mode mmc: core: Capture correct oemid-bits for eMMC cards Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()" ACPI: irq: Fix incorrect return value in acpi_register_gsi() USB: serial: option: add Telit LE910C4-WWX 0x1035 composition USB: serial: option: add entry for Sierra EM9191 with new firmware USB: serial: option: add Fibocom to DELL custom modem FM101R-GL perf: Disallow mis-matched inherited group reads s390/pci: fix iommu bitmap allocation gpio: vf610: set value before the direction to avoid a glitch ASoC: pxa: fix a memory leak in probe() phy: mapphone-mdm6600: Fix runtime disable on probe phy: mapphone-mdm6600: Fix runtime PM for remove phy: mapphone-mdm6600: Fix pinctrl_pm handling for sleep pins Bluetooth: hci_sock: fix slab oob read in create_monitor_event Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name xfrm6: fix inet6_dev refcount underflow problem Linux 5.4.259 Change-Id: I413388a8527327650b234e3f14fce5ca6137c6c8 Signed-off-by: Greg Kroah-Hartman <[email protected]>
This commit is contained in:
Greg Kroah-Hartman
commit
6b5f21afc2
115 changed files with 724 additions and 310 deletions
|
|
@ -1207,6 +1207,15 @@ struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst,
|
|||
return ERR_PTR(-EOPNOTSUPP);
|
||||
}
|
||||
|
||||
/* Reject outgoing connection to device with same BD ADDR against
|
||||
* CVE-2020-26555
|
||||
*/
|
||||
if (!bacmp(&hdev->bdaddr, dst)) {
|
||||
bt_dev_dbg(hdev, "Reject connection with same BD_ADDR %pMR\n",
|
||||
dst);
|
||||
return ERR_PTR(-ECONNREFUSED);
|
||||
}
|
||||
|
||||
acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
|
||||
if (!acl) {
|
||||
acl = hci_conn_add(hdev, ACL_LINK, dst, HCI_ROLE_MASTER);
|
||||
|
|
@ -1382,34 +1391,41 @@ int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type,
|
|||
if (!test_bit(HCI_CONN_AUTH, &conn->flags))
|
||||
goto auth;
|
||||
|
||||
/* An authenticated FIPS approved combination key has sufficient
|
||||
* security for security level 4. */
|
||||
if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256 &&
|
||||
sec_level == BT_SECURITY_FIPS)
|
||||
goto encrypt;
|
||||
|
||||
/* An authenticated combination key has sufficient security for
|
||||
security level 3. */
|
||||
if ((conn->key_type == HCI_LK_AUTH_COMBINATION_P192 ||
|
||||
conn->key_type == HCI_LK_AUTH_COMBINATION_P256) &&
|
||||
sec_level == BT_SECURITY_HIGH)
|
||||
goto encrypt;
|
||||
|
||||
/* An unauthenticated combination key has sufficient security for
|
||||
security level 1 and 2. */
|
||||
if ((conn->key_type == HCI_LK_UNAUTH_COMBINATION_P192 ||
|
||||
conn->key_type == HCI_LK_UNAUTH_COMBINATION_P256) &&
|
||||
(sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW))
|
||||
goto encrypt;
|
||||
|
||||
/* A combination key has always sufficient security for the security
|
||||
levels 1 or 2. High security level requires the combination key
|
||||
is generated using maximum PIN code length (16).
|
||||
For pre 2.1 units. */
|
||||
if (conn->key_type == HCI_LK_COMBINATION &&
|
||||
(sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW ||
|
||||
conn->pin_length == 16))
|
||||
goto encrypt;
|
||||
switch (conn->key_type) {
|
||||
case HCI_LK_AUTH_COMBINATION_P256:
|
||||
/* An authenticated FIPS approved combination key has
|
||||
* sufficient security for security level 4 or lower.
|
||||
*/
|
||||
if (sec_level <= BT_SECURITY_FIPS)
|
||||
goto encrypt;
|
||||
break;
|
||||
case HCI_LK_AUTH_COMBINATION_P192:
|
||||
/* An authenticated combination key has sufficient security for
|
||||
* security level 3 or lower.
|
||||
*/
|
||||
if (sec_level <= BT_SECURITY_HIGH)
|
||||
goto encrypt;
|
||||
break;
|
||||
case HCI_LK_UNAUTH_COMBINATION_P192:
|
||||
case HCI_LK_UNAUTH_COMBINATION_P256:
|
||||
/* An unauthenticated combination key has sufficient security
|
||||
* for security level 2 or lower.
|
||||
*/
|
||||
if (sec_level <= BT_SECURITY_MEDIUM)
|
||||
goto encrypt;
|
||||
break;
|
||||
case HCI_LK_COMBINATION:
|
||||
/* A combination key has always sufficient security for the
|
||||
* security levels 2 or lower. High security level requires the
|
||||
* combination key is generated using maximum PIN code length
|
||||
* (16). For pre 2.1 units.
|
||||
*/
|
||||
if (sec_level <= BT_SECURITY_MEDIUM || conn->pin_length == 16)
|
||||
goto encrypt;
|
||||
break;
|
||||
default:
|
||||
break;
|
||||
}
|
||||
|
||||
auth:
|
||||
if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
|
||||
|
|
|
|||
|
|
@ -3317,7 +3317,11 @@ int hci_register_dev(struct hci_dev *hdev)
|
|||
if (id < 0)
|
||||
return id;
|
||||
|
||||
snprintf(hdev->name, sizeof(hdev->name), "hci%d", id);
|
||||
error = dev_set_name(&hdev->dev, "hci%u", id);
|
||||
if (error)
|
||||
return error;
|
||||
|
||||
hdev->name = dev_name(&hdev->dev);
|
||||
hdev->id = id;
|
||||
|
||||
BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
|
||||
|
|
@ -3339,8 +3343,6 @@ int hci_register_dev(struct hci_dev *hdev)
|
|||
if (!IS_ERR_OR_NULL(bt_debugfs))
|
||||
hdev->debugfs = debugfs_create_dir(hdev->name, bt_debugfs);
|
||||
|
||||
dev_set_name(&hdev->dev, "%s", hdev->name);
|
||||
|
||||
error = device_add(&hdev->dev);
|
||||
if (error < 0)
|
||||
goto err_wqueue;
|
||||
|
|
|
|||
|
|
@ -25,6 +25,8 @@
|
|||
/* Bluetooth HCI event handling. */
|
||||
|
||||
#include <asm/unaligned.h>
|
||||
#include <linux/crypto.h>
|
||||
#include <crypto/algapi.h>
|
||||
|
||||
#include <net/bluetooth/bluetooth.h>
|
||||
#include <net/bluetooth/hci_core.h>
|
||||
|
|
@ -2594,6 +2596,16 @@ static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
|
|||
BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
|
||||
ev->link_type);
|
||||
|
||||
/* Reject incoming connection from device with same BD ADDR against
|
||||
* CVE-2020-26555
|
||||
*/
|
||||
if (hdev && !bacmp(&hdev->bdaddr, &ev->bdaddr)) {
|
||||
bt_dev_dbg(hdev, "Reject connection with same BD_ADDR %pMR\n",
|
||||
&ev->bdaddr);
|
||||
hci_reject_conn(hdev, &ev->bdaddr);
|
||||
return;
|
||||
}
|
||||
|
||||
mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
|
||||
&flags);
|
||||
|
||||
|
|
@ -3935,6 +3947,15 @@ static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
|
|||
if (!conn)
|
||||
goto unlock;
|
||||
|
||||
/* Ignore NULL link key against CVE-2020-26555 */
|
||||
if (!crypto_memneq(ev->link_key, ZERO_KEY, HCI_LINK_KEY_SIZE)) {
|
||||
bt_dev_dbg(hdev, "Ignore NULL link key (ZERO KEY) for %pMR",
|
||||
&ev->bdaddr);
|
||||
hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
|
||||
hci_conn_drop(conn);
|
||||
goto unlock;
|
||||
}
|
||||
|
||||
hci_conn_hold(conn);
|
||||
conn->disc_timeout = HCI_DISCONN_TIMEOUT;
|
||||
hci_conn_drop(conn);
|
||||
|
|
@ -4426,8 +4447,8 @@ static u8 bredr_oob_data_present(struct hci_conn *conn)
|
|||
* available, then do not declare that OOB data is
|
||||
* present.
|
||||
*/
|
||||
if (!memcmp(data->rand256, ZERO_KEY, 16) ||
|
||||
!memcmp(data->hash256, ZERO_KEY, 16))
|
||||
if (!crypto_memneq(data->rand256, ZERO_KEY, 16) ||
|
||||
!crypto_memneq(data->hash256, ZERO_KEY, 16))
|
||||
return 0x00;
|
||||
|
||||
return 0x02;
|
||||
|
|
@ -4437,8 +4458,8 @@ static u8 bredr_oob_data_present(struct hci_conn *conn)
|
|||
* not supported by the hardware, then check that if
|
||||
* P-192 data values are present.
|
||||
*/
|
||||
if (!memcmp(data->rand192, ZERO_KEY, 16) ||
|
||||
!memcmp(data->hash192, ZERO_KEY, 16))
|
||||
if (!crypto_memneq(data->rand192, ZERO_KEY, 16) ||
|
||||
!crypto_memneq(data->hash192, ZERO_KEY, 16))
|
||||
return 0x00;
|
||||
|
||||
return 0x01;
|
||||
|
|
@ -4454,7 +4475,7 @@ static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
|
|||
hci_dev_lock(hdev);
|
||||
|
||||
conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
|
||||
if (!conn)
|
||||
if (!conn || !hci_conn_ssp_enabled(conn))
|
||||
goto unlock;
|
||||
|
||||
hci_conn_hold(conn);
|
||||
|
|
@ -4689,7 +4710,7 @@ static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
|
|||
hci_dev_lock(hdev);
|
||||
|
||||
conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
|
||||
if (!conn)
|
||||
if (!conn || !hci_conn_ssp_enabled(conn))
|
||||
goto unlock;
|
||||
|
||||
/* Reset the authentication requirement to unknown */
|
||||
|
|
|
|||
|
|
@ -430,7 +430,8 @@ static struct sk_buff *create_monitor_event(struct hci_dev *hdev, int event)
|
|||
ni->type = hdev->dev_type;
|
||||
ni->bus = hdev->bus;
|
||||
bacpy(&ni->bdaddr, &hdev->bdaddr);
|
||||
memcpy(ni->name, hdev->name, 8);
|
||||
memcpy_and_pad(ni->name, sizeof(ni->name), hdev->name,
|
||||
strnlen(hdev->name, sizeof(ni->name)), '\0');
|
||||
|
||||
opcode = cpu_to_le16(HCI_MON_NEW_INDEX);
|
||||
break;
|
||||
|
|
|
|||
|
|
@ -477,8 +477,8 @@ static int ceph_tcp_connect(struct ceph_connection *con)
|
|||
dout("connect %s\n", ceph_pr_addr(&con->peer_addr));
|
||||
|
||||
con_sock_state_connecting(con);
|
||||
ret = sock->ops->connect(sock, (struct sockaddr *)&ss, sizeof(ss),
|
||||
O_NONBLOCK);
|
||||
ret = kernel_connect(sock, (struct sockaddr *)&ss, sizeof(ss),
|
||||
O_NONBLOCK);
|
||||
if (ret == -EINPROGRESS) {
|
||||
dout("connect %s EINPROGRESS sk_state = %u\n",
|
||||
ceph_pr_addr(&con->peer_addr),
|
||||
|
|
|
|||
|
|
@ -645,19 +645,19 @@ static int pktgen_if_show(struct seq_file *seq, void *v)
|
|||
seq_puts(seq, " Flags: ");
|
||||
|
||||
for (i = 0; i < NR_PKT_FLAGS; i++) {
|
||||
if (i == F_FLOW_SEQ)
|
||||
if (i == FLOW_SEQ_SHIFT)
|
||||
if (!pkt_dev->cflows)
|
||||
continue;
|
||||
|
||||
if (pkt_dev->flags & (1 << i))
|
||||
if (pkt_dev->flags & (1 << i)) {
|
||||
seq_printf(seq, "%s ", pkt_flag_names[i]);
|
||||
else if (i == F_FLOW_SEQ)
|
||||
seq_puts(seq, "FLOW_RND ");
|
||||
|
||||
#ifdef CONFIG_XFRM
|
||||
if (i == F_IPSEC && pkt_dev->spi)
|
||||
seq_printf(seq, "spi:%u", pkt_dev->spi);
|
||||
if (i == IPSEC_SHIFT && pkt_dev->spi)
|
||||
seq_printf(seq, "spi:%u ", pkt_dev->spi);
|
||||
#endif
|
||||
} else if (i == FLOW_SEQ_SHIFT) {
|
||||
seq_puts(seq, "FLOW_RND ");
|
||||
}
|
||||
}
|
||||
|
||||
seq_puts(seq, "\n");
|
||||
|
|
|
|||
|
|
@ -567,7 +567,9 @@ static inline int esp_remove_trailer(struct sk_buff *skb)
|
|||
skb->csum = csum_block_sub(skb->csum, csumdiff,
|
||||
skb->len - trimlen);
|
||||
}
|
||||
pskb_trim(skb, skb->len - trimlen);
|
||||
ret = pskb_trim(skb, skb->len - trimlen);
|
||||
if (unlikely(ret))
|
||||
return ret;
|
||||
|
||||
ret = nexthdr[1];
|
||||
|
||||
|
|
|
|||
|
|
@ -1333,15 +1333,18 @@ __be32 fib_info_update_nhc_saddr(struct net *net, struct fib_nh_common *nhc,
|
|||
unsigned char scope)
|
||||
{
|
||||
struct fib_nh *nh;
|
||||
__be32 saddr;
|
||||
|
||||
if (nhc->nhc_family != AF_INET)
|
||||
return inet_select_addr(nhc->nhc_dev, 0, scope);
|
||||
|
||||
nh = container_of(nhc, struct fib_nh, nh_common);
|
||||
nh->nh_saddr = inet_select_addr(nh->fib_nh_dev, nh->fib_nh_gw4, scope);
|
||||
nh->nh_saddr_genid = atomic_read(&net->ipv4.dev_addr_genid);
|
||||
saddr = inet_select_addr(nh->fib_nh_dev, nh->fib_nh_gw4, scope);
|
||||
|
||||
return nh->nh_saddr;
|
||||
WRITE_ONCE(nh->nh_saddr, saddr);
|
||||
WRITE_ONCE(nh->nh_saddr_genid, atomic_read(&net->ipv4.dev_addr_genid));
|
||||
|
||||
return saddr;
|
||||
}
|
||||
|
||||
__be32 fib_result_prefsrc(struct net *net, struct fib_result *res)
|
||||
|
|
@ -1355,8 +1358,9 @@ __be32 fib_result_prefsrc(struct net *net, struct fib_result *res)
|
|||
struct fib_nh *nh;
|
||||
|
||||
nh = container_of(nhc, struct fib_nh, nh_common);
|
||||
if (nh->nh_saddr_genid == atomic_read(&net->ipv4.dev_addr_genid))
|
||||
return nh->nh_saddr;
|
||||
if (READ_ONCE(nh->nh_saddr_genid) ==
|
||||
atomic_read(&net->ipv4.dev_addr_genid))
|
||||
return READ_ONCE(nh->nh_saddr);
|
||||
}
|
||||
|
||||
return fib_info_update_nhc_saddr(net, nhc, res->fi->fib_scope);
|
||||
|
|
|
|||
|
|
@ -2259,6 +2259,18 @@ static bool tcp_pacing_check(struct sock *sk)
|
|||
return true;
|
||||
}
|
||||
|
||||
static bool tcp_rtx_queue_empty_or_single_skb(const struct sock *sk)
|
||||
{
|
||||
const struct rb_node *node = sk->tcp_rtx_queue.rb_node;
|
||||
|
||||
/* No skb in the rtx queue. */
|
||||
if (!node)
|
||||
return true;
|
||||
|
||||
/* Only one skb in rtx queue. */
|
||||
return !node->rb_left && !node->rb_right;
|
||||
}
|
||||
|
||||
/* TCP Small Queues :
|
||||
* Control number of packets in qdisc/devices to two packets / or ~1 ms.
|
||||
* (These limits are doubled for retransmits)
|
||||
|
|
@ -2296,12 +2308,12 @@ static bool tcp_small_queue_check(struct sock *sk, const struct sk_buff *skb,
|
|||
limit += extra_bytes;
|
||||
}
|
||||
if (refcount_read(&sk->sk_wmem_alloc) > limit) {
|
||||
/* Always send skb if rtx queue is empty.
|
||||
/* Always send skb if rtx queue is empty or has one skb.
|
||||
* No need to wait for TX completion to call us back,
|
||||
* after softirq/tasklet schedule.
|
||||
* This helps when TX completions are delayed too much.
|
||||
*/
|
||||
if (tcp_rtx_queue_empty(sk))
|
||||
if (tcp_rtx_queue_empty_or_single_skb(sk))
|
||||
return false;
|
||||
|
||||
set_bit(TSQ_THROTTLED, &sk->sk_tsq_flags);
|
||||
|
|
@ -2504,7 +2516,7 @@ bool tcp_schedule_loss_probe(struct sock *sk, bool advancing_rto)
|
|||
{
|
||||
struct inet_connection_sock *icsk = inet_csk(sk);
|
||||
struct tcp_sock *tp = tcp_sk(sk);
|
||||
u32 timeout, rto_delta_us;
|
||||
u32 timeout, timeout_us, rto_delta_us;
|
||||
int early_retrans;
|
||||
|
||||
/* Don't do any loss probe on a Fast Open connection before 3WHS
|
||||
|
|
@ -2528,11 +2540,12 @@ bool tcp_schedule_loss_probe(struct sock *sk, bool advancing_rto)
|
|||
* sample is available then probe after TCP_TIMEOUT_INIT.
|
||||
*/
|
||||
if (tp->srtt_us) {
|
||||
timeout = usecs_to_jiffies(tp->srtt_us >> 2);
|
||||
timeout_us = tp->srtt_us >> 2;
|
||||
if (tp->packets_out == 1)
|
||||
timeout += TCP_RTO_MIN;
|
||||
timeout_us += tcp_rto_min_us(sk);
|
||||
else
|
||||
timeout += TCP_TIMEOUT_MIN;
|
||||
timeout_us += TCP_TIMEOUT_MIN_US;
|
||||
timeout = usecs_to_jiffies(timeout_us);
|
||||
} else {
|
||||
timeout = TCP_TIMEOUT_INIT;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -123,7 +123,7 @@ bool tcp_rack_mark_lost(struct sock *sk)
|
|||
tp->rack.advanced = 0;
|
||||
tcp_rack_detect_loss(sk, &timeout);
|
||||
if (timeout) {
|
||||
timeout = usecs_to_jiffies(timeout) + TCP_TIMEOUT_MIN;
|
||||
timeout = usecs_to_jiffies(timeout + TCP_TIMEOUT_MIN_US);
|
||||
inet_csk_reset_xmit_timer(sk, ICSK_TIME_REO_TIMEOUT,
|
||||
timeout, inet_csk(sk)->icsk_rto);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -506,7 +506,9 @@ static inline int esp_remove_trailer(struct sk_buff *skb)
|
|||
skb->csum = csum_block_sub(skb->csum, csumdiff,
|
||||
skb->len - trimlen);
|
||||
}
|
||||
pskb_trim(skb, skb->len - trimlen);
|
||||
ret = pskb_trim(skb, skb->len - trimlen);
|
||||
if (unlikely(ret))
|
||||
return ret;
|
||||
|
||||
ret = nexthdr[1];
|
||||
|
||||
|
|
|
|||
|
|
@ -120,11 +120,11 @@ static void xfrm6_dst_destroy(struct dst_entry *dst)
|
|||
{
|
||||
struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
|
||||
|
||||
if (likely(xdst->u.rt6.rt6i_idev))
|
||||
in6_dev_put(xdst->u.rt6.rt6i_idev);
|
||||
dst_destroy_metrics_generic(dst);
|
||||
if (xdst->u.rt6.rt6i_uncached_list)
|
||||
rt6_uncached_list_del(&xdst->u.rt6);
|
||||
if (likely(xdst->u.rt6.rt6i_idev))
|
||||
in6_dev_put(xdst->u.rt6.rt6i_idev);
|
||||
xfrm_dst_destroy(xdst);
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -651,7 +651,8 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
|
|||
}
|
||||
|
||||
if (unlikely(tx->key && tx->key->flags & KEY_FLAG_TAINTED &&
|
||||
!ieee80211_is_deauth(hdr->frame_control)))
|
||||
!ieee80211_is_deauth(hdr->frame_control)) &&
|
||||
tx->skb->protocol != tx->sdata->control_port_protocol)
|
||||
return TX_DROP;
|
||||
|
||||
if (!skip_hw && tx->key &&
|
||||
|
|
|
|||
|
|
@ -1444,7 +1444,7 @@ static int bind_mcastif_addr(struct socket *sock, struct net_device *dev)
|
|||
sin.sin_addr.s_addr = addr;
|
||||
sin.sin_port = 0;
|
||||
|
||||
return sock->ops->bind(sock, (struct sockaddr*)&sin, sizeof(sin));
|
||||
return kernel_bind(sock, (struct sockaddr *)&sin, sizeof(sin));
|
||||
}
|
||||
|
||||
static void get_mcast_sockaddr(union ipvs_sockaddr *sa, int *salen,
|
||||
|
|
@ -1551,7 +1551,7 @@ static int make_receive_sock(struct netns_ipvs *ipvs, int id,
|
|||
|
||||
get_mcast_sockaddr(&mcast_addr, &salen, &ipvs->bcfg, id);
|
||||
sock->sk->sk_bound_dev_if = dev->ifindex;
|
||||
result = sock->ops->bind(sock, (struct sockaddr *)&mcast_addr, salen);
|
||||
result = kernel_bind(sock, (struct sockaddr *)&mcast_addr, salen);
|
||||
if (result < 0) {
|
||||
pr_err("Error binding to the multicast addr\n");
|
||||
goto error;
|
||||
|
|
|
|||
|
|
@ -84,7 +84,7 @@ void nft_payload_eval(const struct nft_expr *expr,
|
|||
|
||||
switch (priv->base) {
|
||||
case NFT_PAYLOAD_LL_HEADER:
|
||||
if (!skb_mac_header_was_set(skb))
|
||||
if (!skb_mac_header_was_set(skb) || skb_mac_header_len(skb) == 0)
|
||||
goto err;
|
||||
|
||||
if (skb_vlan_tag_present(skb)) {
|
||||
|
|
|
|||
|
|
@ -338,6 +338,8 @@ static void *nft_rbtree_deactivate(const struct net *net,
|
|||
nft_rbtree_interval_end(this)) {
|
||||
parent = parent->rb_right;
|
||||
continue;
|
||||
} else if (nft_set_elem_expired(&rbe->ext)) {
|
||||
break;
|
||||
} else if (!nft_set_elem_active(&rbe->ext, genmask)) {
|
||||
parent = parent->rb_left;
|
||||
continue;
|
||||
|
|
|
|||
|
|
@ -205,17 +205,13 @@ static struct nfc_llcp_sock *nfc_llcp_sock_get(struct nfc_llcp_local *local,
|
|||
|
||||
if (tmp_sock->ssap == ssap && tmp_sock->dsap == dsap) {
|
||||
llcp_sock = tmp_sock;
|
||||
sock_hold(&llcp_sock->sk);
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
read_unlock(&local->sockets.lock);
|
||||
|
||||
if (llcp_sock == NULL)
|
||||
return NULL;
|
||||
|
||||
sock_hold(&llcp_sock->sk);
|
||||
|
||||
return llcp_sock;
|
||||
}
|
||||
|
||||
|
|
@ -348,7 +344,8 @@ static int nfc_llcp_wks_sap(const char *service_name, size_t service_name_len)
|
|||
|
||||
static
|
||||
struct nfc_llcp_sock *nfc_llcp_sock_from_sn(struct nfc_llcp_local *local,
|
||||
const u8 *sn, size_t sn_len)
|
||||
const u8 *sn, size_t sn_len,
|
||||
bool needref)
|
||||
{
|
||||
struct sock *sk;
|
||||
struct nfc_llcp_sock *llcp_sock, *tmp_sock;
|
||||
|
|
@ -384,6 +381,8 @@ struct nfc_llcp_sock *nfc_llcp_sock_from_sn(struct nfc_llcp_local *local,
|
|||
|
||||
if (memcmp(sn, tmp_sock->service_name, sn_len) == 0) {
|
||||
llcp_sock = tmp_sock;
|
||||
if (needref)
|
||||
sock_hold(&llcp_sock->sk);
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
|
@ -425,7 +424,8 @@ u8 nfc_llcp_get_sdp_ssap(struct nfc_llcp_local *local,
|
|||
* to this service name.
|
||||
*/
|
||||
if (nfc_llcp_sock_from_sn(local, sock->service_name,
|
||||
sock->service_name_len) != NULL) {
|
||||
sock->service_name_len,
|
||||
false) != NULL) {
|
||||
mutex_unlock(&local->sdp_lock);
|
||||
|
||||
return LLCP_SAP_MAX;
|
||||
|
|
@ -833,16 +833,7 @@ out:
|
|||
static struct nfc_llcp_sock *nfc_llcp_sock_get_sn(struct nfc_llcp_local *local,
|
||||
const u8 *sn, size_t sn_len)
|
||||
{
|
||||
struct nfc_llcp_sock *llcp_sock;
|
||||
|
||||
llcp_sock = nfc_llcp_sock_from_sn(local, sn, sn_len);
|
||||
|
||||
if (llcp_sock == NULL)
|
||||
return NULL;
|
||||
|
||||
sock_hold(&llcp_sock->sk);
|
||||
|
||||
return llcp_sock;
|
||||
return nfc_llcp_sock_from_sn(local, sn, sn_len, true);
|
||||
}
|
||||
|
||||
static const u8 *nfc_llcp_connect_sn(const struct sk_buff *skb, size_t *sn_len)
|
||||
|
|
@ -1307,7 +1298,8 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local,
|
|||
}
|
||||
|
||||
llcp_sock = nfc_llcp_sock_from_sn(local, service_name,
|
||||
service_name_len);
|
||||
service_name_len,
|
||||
true);
|
||||
if (!llcp_sock) {
|
||||
sap = 0;
|
||||
goto add_snl;
|
||||
|
|
@ -1327,6 +1319,7 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local,
|
|||
|
||||
if (sap == LLCP_SAP_MAX) {
|
||||
sap = 0;
|
||||
nfc_llcp_sock_put(llcp_sock);
|
||||
goto add_snl;
|
||||
}
|
||||
|
||||
|
|
@ -1344,6 +1337,7 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local,
|
|||
|
||||
pr_debug("%p %d\n", llcp_sock, sap);
|
||||
|
||||
nfc_llcp_sock_put(llcp_sock);
|
||||
add_snl:
|
||||
sdp = nfc_llcp_build_sdres_tlv(tid, sap);
|
||||
if (sdp == NULL)
|
||||
|
|
|
|||
|
|
@ -894,6 +894,11 @@ static int nci_activate_target(struct nfc_dev *nfc_dev,
|
|||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (protocol >= NFC_PROTO_MAX) {
|
||||
pr_err("the requested nfc protocol is invalid\n");
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (!(nci_target->supported_protocols & (1 << protocol))) {
|
||||
pr_err("target does not support the requested protocol 0x%x\n",
|
||||
protocol);
|
||||
|
|
|
|||
|
|
@ -150,6 +150,8 @@ static int send_acknowledge(struct nci_spi *nspi, u8 acknowledge)
|
|||
int ret;
|
||||
|
||||
skb = nci_skb_alloc(nspi->ndev, 0, GFP_KERNEL);
|
||||
if (!skb)
|
||||
return -ENOMEM;
|
||||
|
||||
/* add the NCI SPI header to the start of the buffer */
|
||||
hdr = skb_push(skb, NCI_SPI_HDR_LEN);
|
||||
|
|
|
|||
|
|
@ -141,7 +141,7 @@ int rds_tcp_conn_path_connect(struct rds_conn_path *cp)
|
|||
addrlen = sizeof(sin);
|
||||
}
|
||||
|
||||
ret = sock->ops->bind(sock, addr, addrlen);
|
||||
ret = kernel_bind(sock, addr, addrlen);
|
||||
if (ret) {
|
||||
rdsdebug("bind failed with %d at address %pI6c\n",
|
||||
ret, &conn->c_laddr);
|
||||
|
|
|
|||
|
|
@ -332,7 +332,7 @@ struct socket *rds_tcp_listen_init(struct net *net, bool isv6)
|
|||
addr_len = sizeof(*sin);
|
||||
}
|
||||
|
||||
ret = sock->ops->bind(sock, (struct sockaddr *)&ss, addr_len);
|
||||
ret = kernel_bind(sock, (struct sockaddr *)&ss, addr_len);
|
||||
if (ret < 0) {
|
||||
rdsdebug("could not bind %s listener socket: %d\n",
|
||||
isv6 ? "IPv6" : "IPv4", ret);
|
||||
|
|
|
|||
|
|
@ -98,13 +98,13 @@ static int rfkill_gpio_probe(struct platform_device *pdev)
|
|||
|
||||
rfkill->clk = devm_clk_get(&pdev->dev, NULL);
|
||||
|
||||
gpio = devm_gpiod_get_optional(&pdev->dev, "reset", GPIOD_OUT_LOW);
|
||||
gpio = devm_gpiod_get_optional(&pdev->dev, "reset", GPIOD_ASIS);
|
||||
if (IS_ERR(gpio))
|
||||
return PTR_ERR(gpio);
|
||||
|
||||
rfkill->reset_gpio = gpio;
|
||||
|
||||
gpio = devm_gpiod_get_optional(&pdev->dev, "shutdown", GPIOD_OUT_LOW);
|
||||
gpio = devm_gpiod_get_optional(&pdev->dev, "shutdown", GPIOD_ASIS);
|
||||
if (IS_ERR(gpio))
|
||||
return PTR_ERR(gpio);
|
||||
|
||||
|
|
|
|||
|
|
@ -903,6 +903,14 @@ hfsc_change_usc(struct hfsc_class *cl, struct tc_service_curve *usc,
|
|||
cl->cl_flags |= HFSC_USC;
|
||||
}
|
||||
|
||||
static void
|
||||
hfsc_upgrade_rt(struct hfsc_class *cl)
|
||||
{
|
||||
cl->cl_fsc = cl->cl_rsc;
|
||||
rtsc_init(&cl->cl_virtual, &cl->cl_fsc, cl->cl_vt, cl->cl_total);
|
||||
cl->cl_flags |= HFSC_FSC;
|
||||
}
|
||||
|
||||
static const struct nla_policy hfsc_policy[TCA_HFSC_MAX + 1] = {
|
||||
[TCA_HFSC_RSC] = { .len = sizeof(struct tc_service_curve) },
|
||||
[TCA_HFSC_FSC] = { .len = sizeof(struct tc_service_curve) },
|
||||
|
|
@ -1012,10 +1020,6 @@ hfsc_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
|
|||
if (parent == NULL)
|
||||
return -ENOENT;
|
||||
}
|
||||
if (!(parent->cl_flags & HFSC_FSC) && parent != &q->root) {
|
||||
NL_SET_ERR_MSG(extack, "Invalid parent - parent class must have FSC");
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (classid == 0 || TC_H_MAJ(classid ^ sch->handle) != 0)
|
||||
return -EINVAL;
|
||||
|
|
@ -1068,6 +1072,12 @@ hfsc_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
|
|||
cl->cf_tree = RB_ROOT;
|
||||
|
||||
sch_tree_lock(sch);
|
||||
/* Check if the inner class is a misconfigured 'rt' */
|
||||
if (!(parent->cl_flags & HFSC_FSC) && parent != &q->root) {
|
||||
NL_SET_ERR_MSG(extack,
|
||||
"Forced curve change on parent 'rt' to 'sc'");
|
||||
hfsc_upgrade_rt(parent);
|
||||
}
|
||||
qdisc_class_hash_insert(&q->clhash, &cl->cl_common);
|
||||
list_add_tail(&cl->siblings, &parent->children);
|
||||
if (parent->level == 0)
|
||||
|
|
|
|||
|
|
@ -3585,7 +3585,11 @@ static long compat_sock_ioctl(struct file *file, unsigned int cmd,
|
|||
|
||||
int kernel_bind(struct socket *sock, struct sockaddr *addr, int addrlen)
|
||||
{
|
||||
return sock->ops->bind(sock, addr, addrlen);
|
||||
struct sockaddr_storage address;
|
||||
|
||||
memcpy(&address, addr, addrlen);
|
||||
|
||||
return sock->ops->bind(sock, (struct sockaddr *)&address, addrlen);
|
||||
}
|
||||
EXPORT_SYMBOL(kernel_bind);
|
||||
|
||||
|
|
|
|||
|
|
@ -7128,7 +7128,7 @@ static int nl80211_update_mesh_config(struct sk_buff *skb,
|
|||
struct cfg80211_registered_device *rdev = info->user_ptr[0];
|
||||
struct net_device *dev = info->user_ptr[1];
|
||||
struct wireless_dev *wdev = dev->ieee80211_ptr;
|
||||
struct mesh_config cfg;
|
||||
struct mesh_config cfg = {};
|
||||
u32 mask;
|
||||
int err;
|
||||
|
||||
|
|
|
|||
|
|
@ -219,8 +219,8 @@ static int xfrmi_rcv_cb(struct sk_buff *skb, int err)
|
|||
skb->dev = dev;
|
||||
|
||||
if (err) {
|
||||
dev->stats.rx_errors++;
|
||||
dev->stats.rx_dropped++;
|
||||
DEV_STATS_INC(dev, rx_errors);
|
||||
DEV_STATS_INC(dev, rx_dropped);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
|
@ -260,7 +260,6 @@ static int
|
|||
xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
|
||||
{
|
||||
struct xfrm_if *xi = netdev_priv(dev);
|
||||
struct net_device_stats *stats = &xi->dev->stats;
|
||||
struct dst_entry *dst = skb_dst(skb);
|
||||
unsigned int length = skb->len;
|
||||
struct net_device *tdev;
|
||||
|
|
@ -286,7 +285,7 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
|
|||
tdev = dst->dev;
|
||||
|
||||
if (tdev == dev) {
|
||||
stats->collisions++;
|
||||
DEV_STATS_INC(dev, collisions);
|
||||
net_warn_ratelimited("%s: Local routing loop detected!\n",
|
||||
dev->name);
|
||||
goto tx_err_dst_release;
|
||||
|
|
@ -329,13 +328,13 @@ xmit:
|
|||
tstats->tx_packets++;
|
||||
u64_stats_update_end(&tstats->syncp);
|
||||
} else {
|
||||
stats->tx_errors++;
|
||||
stats->tx_aborted_errors++;
|
||||
DEV_STATS_INC(dev, tx_errors);
|
||||
DEV_STATS_INC(dev, tx_aborted_errors);
|
||||
}
|
||||
|
||||
return 0;
|
||||
tx_err_link_failure:
|
||||
stats->tx_carrier_errors++;
|
||||
DEV_STATS_INC(dev, tx_carrier_errors);
|
||||
dst_link_failure(skb);
|
||||
tx_err_dst_release:
|
||||
dst_release(dst);
|
||||
|
|
@ -345,7 +344,6 @@ tx_err_dst_release:
|
|||
static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
|
||||
{
|
||||
struct xfrm_if *xi = netdev_priv(dev);
|
||||
struct net_device_stats *stats = &xi->dev->stats;
|
||||
struct dst_entry *dst = skb_dst(skb);
|
||||
struct flowi fl;
|
||||
int ret;
|
||||
|
|
@ -362,7 +360,7 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
|
|||
dst = ip6_route_output(dev_net(dev), NULL, &fl.u.ip6);
|
||||
if (dst->error) {
|
||||
dst_release(dst);
|
||||
stats->tx_carrier_errors++;
|
||||
DEV_STATS_INC(dev, tx_carrier_errors);
|
||||
goto tx_err;
|
||||
}
|
||||
skb_dst_set(skb, dst);
|
||||
|
|
@ -378,7 +376,7 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
|
|||
fl.u.ip4.flowi4_flags |= FLOWI_FLAG_ANYSRC;
|
||||
rt = __ip_route_output_key(dev_net(dev), &fl.u.ip4);
|
||||
if (IS_ERR(rt)) {
|
||||
stats->tx_carrier_errors++;
|
||||
DEV_STATS_INC(dev, tx_carrier_errors);
|
||||
goto tx_err;
|
||||
}
|
||||
skb_dst_set(skb, &rt->dst);
|
||||
|
|
@ -397,8 +395,8 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
|
|||
return NETDEV_TX_OK;
|
||||
|
||||
tx_err:
|
||||
stats->tx_errors++;
|
||||
stats->tx_dropped++;
|
||||
DEV_STATS_INC(dev, tx_errors);
|
||||
DEV_STATS_INC(dev, tx_dropped);
|
||||
kfree_skb(skb);
|
||||
return NETDEV_TX_OK;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1373,8 +1373,6 @@ EXPORT_SYMBOL(xfrm_policy_hash_rebuild);
|
|||
* of an absolute inpredictability of ordering of rules. This will not pass. */
|
||||
static u32 xfrm_gen_index(struct net *net, int dir, u32 index)
|
||||
{
|
||||
static u32 idx_generator;
|
||||
|
||||
for (;;) {
|
||||
struct hlist_head *list;
|
||||
struct xfrm_policy *p;
|
||||
|
|
@ -1382,8 +1380,8 @@ static u32 xfrm_gen_index(struct net *net, int dir, u32 index)
|
|||
int found;
|
||||
|
||||
if (!index) {
|
||||
idx = (idx_generator | dir);
|
||||
idx_generator += 8;
|
||||
idx = (net->xfrm.idx_generator | dir);
|
||||
net->xfrm.idx_generator += 8;
|
||||
} else {
|
||||
idx = index;
|
||||
index = 0;
|
||||
|
|
|
|||
Loading…
Reference in a new issue