This is the 5.4.232 stable release

-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmP2AZoACgkQONu9yGCS
 aT4Kog//cMOCPvc+9yam5NCZj76k9jzIfteKMZzvSyxjV/ShPGynLIwcR26vE4j1
 CtEB0aknuxgpqthfCahjjf51POhYLJD62H62UtTfxgIkWxnETd8F6y2xvuVXsds5
 mC0LUzQ9md6slgTTIobQF9ilIGAt/yKPOg89fUXNYzNsO2us46XZCmZOXg5MVwlI
 hXYQuVBze1VhWt40J8TYDFckjoQLUgH6lBawWHC8/r2MBBydzX1cZEyL2TXhDfFS
 7t9gWXKteAFE6GWfgAY6MrtqGx+X25Xe7qds4V8v6FgxR2MFeo94+k3DbhXRnjjY
 gA6czJBurGzhiXWo2E4laYlEMfsY0qkl17M49C/LwkJhZCSjF60b0Vo0dNfLLogZ
 cWsG6qcrfV8/js5h97kFSluWZ4VM7xTgcJQ/qtU/O8IprRQioCERjvm4Dl+/emXI
 ycFaiZOP3RvYdHxADIsItm46C7WzpzqZpjjs+9jHEaACrnOQfepGGFmgImMd9P8r
 kkU5KUtPQoAgSFfPz1tvJgyQiazONRAKtg1UprPOnLN0PsBQrE8ekCOk9lDoW60l
 t+G2lC0dJBYkcKC+4jHa9y18U7wz/eYdYE+K/u8kUENYFLSBfYxIqbXPxQZcq6aO
 TnyVr1n+Dd3HXtLX58+vDE2RUjosvCXctBGrE6Q56d8AKXh6FvM=
 =rk4j
 -----END PGP SIGNATURE-----

Merge 5.4.232 into android11-5.4-lts

Changes in 5.4.232
	firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region
	bus: sunxi-rsb: Fix error handling in sunxi_rsb_init()
	ASoC: Intel: bytcr_rt5651: Drop reference count of ACPI device after use
	ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
	arm64: dts: imx8mm: Fix pad control for UART1_DTE_RX
	scsi: Revert "scsi: core: map PQ=1, PDT=other values to SCSI_SCAN_TARGET_PRESENT"
	WRITE is "data source", not destination...
	fix iov_iter_bvec() "direction" argument
	fix "direction" argument of iov_iter_kvec()
	netrom: Fix use-after-free caused by accept on already connected socket
	netfilter: br_netfilter: disable sabotage_in hook after first suppression
	squashfs: harden sanity check in squashfs_read_xattr_id_table
	net: phy: meson-gxl: Add generic dummy stubs for MMD register access
	can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate
	ata: libata: Fix sata_down_spd_limit() when no link speed is reported
	selftests: net: udpgso_bench_rx: Fix 'used uninitialized' compiler warning
	selftests: net: udpgso_bench_rx/tx: Stop when wrong CLI args are provided
	selftests: net: udpgso_bench: Fix racing bug between the rx/tx programs
	selftests: net: udpgso_bench_tx: Cater for pending datagrams zerocopy benchmarking
	virtio-net: Keep stop() to follow mirror sequence of open()
	net: openvswitch: fix flow memory leak in ovs_flow_cmd_new
	efi: fix potential NULL deref in efi_mem_reserve_persistent
	scsi: target: core: Fix warning on RT kernels
	scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress
	i2c: rk3x: fix a bunch of kernel-doc warnings
	net/x25: Fix to not accept on connected socket
	iio: adc: stm32-dfsdm: fill module aliases
	usb: dwc3: dwc3-qcom: Fix typo in the dwc3 vbus override API
	usb: dwc3: qcom: enable vbus override when in OTG dr-mode
	usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait
	vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
	Input: i8042 - move __initconst to fix code styling warning
	Input: i8042 - merge quirk tables
	Input: i8042 - add TUXEDO devices to i8042 quirk tables
	Input: i8042 - add Clevo PCX0DX to i8042 quirk table
	fbcon: Check font dimension limits
	watchdog: diag288_wdt: do not use stack buffers for hardware data
	watchdog: diag288_wdt: fix __diag288() inline assembly
	efi: Accept version 2 of memory attributes table
	iio: hid: fix the retval in accel_3d_capture_sample
	iio: adc: berlin2-adc: Add missing of_node_put() in error path
	iio:adc:twl6030: Enable measurements of VUSB, VBAT and others
	parisc: Fix return code of pdc_iodc_print()
	parisc: Wire up PTRACE_GETREGS/PTRACE_SETREGS for compat case
	riscv: disable generation of unwind tables
	mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps
	fpga: stratix10-soc: Fix return value check in s10_ops_write_init()
	mm/swapfile: add cond_resched() in get_swap_pages()
	Squashfs: fix handling and sanity checking of xattr_ids count
	nvmem: core: fix cell removal on error
	mm: swap: properly update readahead statistics in unuse_pte_range()
	xprtrdma: Fix regbuf data not freed in rpcrdma_req_create()
	serial: 8250_dma: Fix DMA Rx completion race
	serial: 8250_dma: Fix DMA Rx rearm race
	powerpc/imc-pmu: Revert nest_init_lock to being a mutex
	fbdev: smscufx: fix error handling code in ufx_usb_probe
	f2fs: fix to do sanity check on i_extra_isize in is_alive()
	wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
	iio:adc:twl6030: Enable measurement of VAC
	btrfs: limit device extents to the device size
	btrfs: zlib: zero-initialize zlib workspace
	ALSA: emux: Avoid potential array out-of-bound in snd_emux_xg_control()
	tracing: Fix poll() and select() do not work on per_cpu trace_pipe and trace_pipe_raw
	can: j1939: do not wait 250 ms if the same addr was already claimed
	IB/hfi1: Restore allocated resources on failed copyout
	IB/IPoIB: Fix legacy IPoIB due to wrong number of queues
	iommu: Add gfp parameter to iommu_ops::map
	RDMA/usnic: use iommu_map_atomic() under spin_lock()
	xfrm: fix bug with DSCP copy to v6 from v4 tunnel
	bonding: fix error checking in bond_debug_reregister()
	net: phy: meson-gxl: use MMD access dummy stubs for GXL, internal PHY
	ionic: clean interrupt before enabling queue to avoid credit race
	ice: Do not use WQ_MEM_RECLAIM flag for workqueue
	rds: rds_rm_zerocopy_callback() use list_first_entry()
	selftests: forwarding: lib: quote the sysctl values
	ALSA: pci: lx6464es: fix a debug loop
	pinctrl: aspeed: Fix confusing types in return value
	pinctrl: single: fix potential NULL dereference
	pinctrl: intel: Restore the pins that used to be in Direct IRQ mode
	net: USB: Fix wrong-direction WARNING in plusb.c
	usb: core: add quirk for Alcor Link AK9563 smartcard reader
	usb: typec: altmodes/displayport: Fix probe pin assign check
	ceph: flush cap releases when the session is flushed
	riscv: Fixup race condition on PG_dcache_clean in flush_icache_pte
	arm64: dts: meson-gx: Make mmc host controller interrupts level-sensitive
	arm64: dts: meson-g12-common: Make mmc host controller interrupts level-sensitive
	arm64: dts: meson-axg: Make mmc host controller interrupts level-sensitive
	nvme-pci: Move enumeration by class to be last in the table
	bpf: Always return target ifindex in bpf_fib_lookup
	migrate: hugetlb: check for hugetlb shared PMD in node migration
	selftests/bpf: Verify copy_register_state() preserves parent/live fields
	ASoC: cs42l56: fix DT probe
	tools/virtio: fix the vringh test for virtio ring changes
	net/rose: Fix to not accept on connected socket
	net: stmmac: do not stop RX_CLK in Rx LPI state for qcs404 SoC
	net: sched: sch: Bounds check priority
	s390/decompressor: specify __decompress() buf len to avoid overflow
	nvme-fc: fix a missing queue put in nvmet_fc_ls_create_association
	aio: fix mremap after fork null-deref
	btrfs: free device in btrfs_close_devices for a single device filesystem
	netfilter: nft_tproxy: restrict to prerouting hook
	xfs: remove the xfs_efi_log_item_t typedef
	xfs: remove the xfs_efd_log_item_t typedef
	xfs: remove the xfs_inode_log_item_t typedef
	xfs: factor out a xfs_defer_create_intent helper
	xfs: merge the ->log_item defer op into ->create_intent
	xfs: merge the ->diff_items defer op into ->create_intent
	xfs: turn dfp_intent into a xfs_log_item
	xfs: refactor xfs_defer_finish_noroll
	xfs: log new intent items created as part of finishing recovered intent items
	xfs: fix finobt btree block recovery ordering
	xfs: proper replay of deferred ops queued during log recovery
	xfs: xfs_defer_capture should absorb remaining block reservations
	xfs: xfs_defer_capture should absorb remaining transaction reservation
	xfs: clean up bmap intent item recovery checking
	xfs: clean up xfs_bui_item_recover iget/trans_alloc/ilock ordering
	xfs: fix an incore inode UAF in xfs_bui_recover
	xfs: change the order in which child and parent defer ops are finished
	xfs: periodically relog deferred intent items
	xfs: expose the log push threshold
	xfs: only relog deferred intent items if free space in the log gets low
	xfs: fix missing CoW blocks writeback conversion retry
	xfs: ensure inobt record walks always make forward progress
	xfs: fix the forward progress assertion in xfs_iwalk_run_callbacks
	xfs: prevent UAF in xfs_log_item_in_current_chkpt
	xfs: sync lazy sb accounting on quiesce of read-only mounts
	Revert "ipv4: Fix incorrect route flushing when source address is deleted"
	ipv4: Fix incorrect route flushing when source address is deleted
	mmc: sdio: fix possible resource leaks in some error paths
	mmc: mmc_spi: fix error handling in mmc_spi_probe()
	ALSA: hda/conexant: add a new hda codec SN6180
	ALSA: hda/realtek - fixed wrong gpio assigned
	sched/psi: Fix use-after-free in ep_remove_wait_queue()
	hugetlb: check for undefined shift on 32 bit architectures
	Revert "mm: Always release pages to the buddy allocator in memblock_free_late()."
	net: Fix unwanted sign extension in netdev_stats_to_stats64()
	revert "squashfs: harden sanity check in squashfs_read_xattr_id_table"
	ixgbe: allow to increase MTU to 3K with XDP enabled
	i40e: add double of VLAN header when computing the max MTU
	net: bgmac: fix BCM5358 support by setting correct flags
	sctp: sctp_sock_filter(): avoid list_entry() on possibly empty list
	dccp/tcp: Avoid negative sk_forward_alloc by ipv6_pinfo.pktoptions.
	net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path
	net: stmmac: fix order of dwmac5 FlexPPS parametrization sequence
	bnxt_en: Fix mqprio and XDP ring checking logic
	net: stmmac: Restrict warning on disabling DMA store and fwd mode
	net: mpls: fix stale pointer if allocation fails during device rename
	ixgbe: add double of VLAN header when computing the max MTU
	ipv6: Fix datagram socket connection with DSCP.
	ipv6: Fix tcp socket connection with DSCP.
	i40e: Add checking for null for nlmsg_find_attr()
	kvm: initialize all of the kvm_debugregs structure before sending it to userspace
	nilfs2: fix underflow in second superblock position calculations
	ASoC: SOF: Intel: hda-dai: fix possible stream_tag leak
	net: sched: sch: Fix off by one in htb_activate_prios()
	iommu/amd: Pass gfp flags to iommu_map_page() in amd_iommu_map()
	Linux 5.4.232

Change-Id: I607aaac0f8477eb9a0f059e0a9d2f5c037fb19fc
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

tools/testing/selftests/bpf/verifier/search_pruning.c

@@ -154,3 +154,39 @@
 	.result_unpriv = ACCEPT,
 	.insn_processed = 15,
 },
+/* The test performs a conditional 64-bit write to a stack location
+ * fp[-8], this is followed by an unconditional 8-bit write to fp[-8],
+ * then data is read from fp[-8]. This sequence is unsafe.
+ *
+ * The test would be mistakenly marked as safe w/o dst register parent
+ * preservation in verifier.c:copy_register_state() function.
+ *
+ * Note the usage of BPF_F_TEST_STATE_FREQ to force creation of the
+ * checkpoint state after conditional 64-bit assignment.
+ */
+{
+	"write tracking and register parent chain bug",
+	.insns = {
+	/* r6 = ktime_get_ns() */
+	BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns),
+	BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
+	/* r0 = ktime_get_ns() */
+	BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns),
+	/* if r0 > r6 goto +1 */
+	BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_6, 1),
+	/* *(u64 *)(r10 - 8) = 0xdeadbeef */
+	BPF_ST_MEM(BPF_DW, BPF_REG_FP, -8, 0xdeadbeef),
+	/* r1 = 42 */
+	BPF_MOV64_IMM(BPF_REG_1, 42),
+	/* *(u8 *)(r10 - 8) = r1 */
+	BPF_STX_MEM(BPF_B, BPF_REG_FP, BPF_REG_1, -8),
+	/* r2 = *(u64 *)(r10 - 8) */
+	BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_FP, -8),
+	/* exit(0) */
+	BPF_MOV64_IMM(BPF_REG_0, 0),
+	BPF_EXIT_INSN(),
+	},
+	.flags = BPF_F_TEST_STATE_FREQ,
+	.errstr = "invalid read from stack off -8+1 size 8",
+	.result = REJECT,
+},

tools/testing/selftests/net/forwarding/lib.sh

@@ -562,14 +562,14 @@ sysctl_set()
 	local value=$1; shift
 
 	SYSCTL_ORIG[$key]=$(sysctl -n $key)
-	sysctl -qw $key=$value
+	sysctl -qw $key="$value"
 }
 
 sysctl_restore()
 {
 	local key=$1; shift
 
-	sysctl -qw $key=${SYSCTL_ORIG["$key"]}
+	sysctl -qw $key="${SYSCTL_ORIG[$key]}"
 }
 
 forwarding_enable()

tools/testing/selftests/net/udpgso_bench.sh

@@ -7,6 +7,7 @@ readonly GREEN='\033[0;92m'
 readonly YELLOW='\033[0;33m'
 readonly RED='\033[0;31m'
 readonly NC='\033[0m' # No Color
+readonly TESTPORT=8000
 
 readonly KSFT_PASS=0
 readonly KSFT_FAIL=1
@@ -56,11 +57,26 @@ trap wake_children EXIT
 
 run_one() {
 	local -r args=$@
+	local nr_socks=0
+	local i=0
+	local -r timeout=10
 
-	./udpgso_bench_rx &
-	./udpgso_bench_rx -t &
+	./udpgso_bench_rx -p "$TESTPORT" &
+	./udpgso_bench_rx -p "$TESTPORT" -t &
 
-	./udpgso_bench_tx ${args}
+	# Wait for the above test program to get ready to receive connections.
+	while [ "$i" -lt "$timeout" ]; do
+		nr_socks="$(ss -lnHi | grep -c "\*:${TESTPORT}")"
+		[ "$nr_socks" -eq 2 ] && break
+		i=$((i + 1))
+		sleep 1
+	done
+	if [ "$nr_socks" -ne 2 ]; then
+		echo "timed out while waiting for udpgso_bench_rx"
+		exit 1
+	fi
+
+	./udpgso_bench_tx -p "$TESTPORT" ${args}
 }
 
 run_in_netns() {

tools/testing/selftests/net/udpgso_bench_rx.c

@@ -250,7 +250,7 @@ static int recv_msg(int fd, char *buf, int len, int *gso_size)
 static void do_flush_udp(int fd)
 {
 	static char rbuf[ETH_MAX_MTU];
-	int ret, len, gso_size, budget = 256;
+	int ret, len, gso_size = 0, budget = 256;
 
 	len = cfg_read_all ? sizeof(rbuf) : 0;
 	while (budget--) {
@@ -336,6 +336,8 @@ static void parse_opts(int argc, char **argv)
 			cfg_verify = true;
 			cfg_read_all = true;
 			break;
+		default:
+			exit(1);
 		}
 	}
 

tools/testing/selftests/net/udpgso_bench_tx.c

@@ -62,6 +62,7 @@ static int	cfg_payload_len	= (1472 * 42);
 static int	cfg_port	= 8000;
 static int	cfg_runtime_ms	= -1;
 static bool	cfg_poll;
+static int	cfg_poll_loop_timeout_ms = 2000;
 static bool	cfg_segment;
 static bool	cfg_sendmmsg;
 static bool	cfg_tcp;
@@ -235,16 +236,17 @@ static void flush_errqueue_recv(int fd)
 	}
 }
 
-static void flush_errqueue(int fd, const bool do_poll)
+static void flush_errqueue(int fd, const bool do_poll,
+			   unsigned long poll_timeout, const bool poll_err)
 {
 	if (do_poll) {
 		struct pollfd fds = {0};
 		int ret;
 
 		fds.fd = fd;
-		ret = poll(&fds, 1, 500);
+		ret = poll(&fds, 1, poll_timeout);
 		if (ret == 0) {
-			if (cfg_verbose)
+			if ((cfg_verbose) && (poll_err))
 				fprintf(stderr, "poll timeout\n");
 		} else if (ret < 0) {
 			error(1, errno, "poll");
@@ -254,6 +256,20 @@ static void flush_errqueue(int fd, const bool do_poll)
 	flush_errqueue_recv(fd);
 }
 
+static void flush_errqueue_retry(int fd, unsigned long num_sends)
+{
+	unsigned long tnow, tstop;
+	bool first_try = true;
+
+	tnow = gettimeofday_ms();
+	tstop = tnow + cfg_poll_loop_timeout_ms;
+	do {
+		flush_errqueue(fd, true, tstop - tnow, first_try);
+		first_try = false;
+		tnow = gettimeofday_ms();
+	} while ((stat_zcopies != num_sends) && (tnow < tstop));
+}
+
 static int send_tcp(int fd, char *data)
 {
 	int ret, done = 0, count = 0;
@@ -413,7 +429,8 @@ static int send_udp_segment(int fd, char *data)
 
 static void usage(const char *filepath)
 {
-	error(1, 0, "Usage: %s [-46acmHPtTuvz] [-C cpu] [-D dst ip] [-l secs] [-M messagenr] [-p port] [-s sendsize] [-S gsosize]",
+	error(1, 0, "Usage: %s [-46acmHPtTuvz] [-C cpu] [-D dst ip] [-l secs] "
+		    "[-L secs] [-M messagenr] [-p port] [-s sendsize] [-S gsosize]",
 		    filepath);
 }
 
@@ -423,7 +440,7 @@ static void parse_opts(int argc, char **argv)
 	int max_len, hdrlen;
 	int c;
 
-	while ((c = getopt(argc, argv, "46acC:D:Hl:mM:p:s:PS:tTuvz")) != -1) {
+	while ((c = getopt(argc, argv, "46acC:D:Hl:L:mM:p:s:PS:tTuvz")) != -1) {
 		switch (c) {
 		case '4':
 			if (cfg_family != PF_UNSPEC)
@@ -452,6 +469,9 @@ static void parse_opts(int argc, char **argv)
 		case 'l':
 			cfg_runtime_ms = strtoul(optarg, NULL, 10) * 1000;
 			break;
+		case 'L':
+			cfg_poll_loop_timeout_ms = strtoul(optarg, NULL, 10) * 1000;
+			break;
 		case 'm':
 			cfg_sendmmsg = true;
 			break;
@@ -490,6 +510,8 @@ static void parse_opts(int argc, char **argv)
 		case 'z':
 			cfg_zerocopy = true;
 			break;
+		default:
+			exit(1);
 		}
 	}
 
@@ -677,7 +699,7 @@ int main(int argc, char **argv)
 			num_sends += send_udp(fd, buf[i]);
 		num_msgs++;
 		if ((cfg_zerocopy && ((num_msgs & 0xF) == 0)) || cfg_tx_tstamp)
-			flush_errqueue(fd, cfg_poll);
+			flush_errqueue(fd, cfg_poll, 500, true);
 
 		if (cfg_msg_nr && num_msgs >= cfg_msg_nr)
 			break;
@@ -696,7 +718,7 @@ int main(int argc, char **argv)
 	} while (!interrupted && (cfg_runtime_ms == -1 || tnow < tstop));
 
 	if (cfg_zerocopy || cfg_tx_tstamp)
-		flush_errqueue(fd, true);
+		flush_errqueue_retry(fd, num_sends);
 
 	if (close(fd))
 		error(1, errno, "close");