From 476c942d9b3efdfd2c7246225793d56568b42f40 Mon Sep 17 00:00:00 2001 From: Neal Liu Date: Thu, 23 Jul 2020 12:48:00 -0700 Subject: [PATCH 01/31] BACKPORT: FROMLIST: cpuidle: change enter_s2idle() prototype Control Flow Integrity(CFI) is a security mechanism that disallows changes to the original control flow graph of a compiled binary, making it significantly harder to perform such attacks. init_state_node() assign same function callback to different function pointer declarations. static int init_state_node(struct cpuidle_state *idle_state, const struct of_device_id *matches, struct device_node *state_node) { ... idle_state->enter = match_id->data; ... idle_state->enter_s2idle = match_id->data; } Function declarations: struct cpuidle_state { ... int (*enter) (struct cpuidle_device *dev, struct cpuidle_driver *drv, int index); void (*enter_s2idle) (struct cpuidle_device *dev, struct cpuidle_driver *drv, int index); }; In this case, either enter() or enter_s2idle() would cause CFI check failed since they use same callee. Align function prototype of enter() since it needs return value for some use cases. The return value of enter_s2idle() is no need currently. Bug: 159445192 Bug: 159672235 Change-Id: Iffc9e1b6a17471ca4291865ab3dc8803303a38ce Link: https://lore.kernel.org/lkml/1595820346-4361-2-git-send-email-neal.liu@mediatek.com/ Signed-off-by: Neal Liu Signed-off-by: Sami Tolvanen --- arch/arm/mach-tegra/cpuidle-tegra114.c | 4 +++- drivers/acpi/processor_idle.c | 10 ++++++---- drivers/idle/intel_idle.c | 6 ++++-- include/linux/cpuidle.h | 9 ++++++--- 4 files changed, 19 insertions(+), 10 deletions(-) diff --git a/arch/arm/mach-tegra/cpuidle-tegra114.c b/arch/arm/mach-tegra/cpuidle-tegra114.c index 5118f777fd66..0ccdcc89eeb9 100644 --- a/arch/arm/mach-tegra/cpuidle-tegra114.c +++ b/arch/arm/mach-tegra/cpuidle-tegra114.c @@ -51,11 +51,13 @@ static int tegra114_idle_power_down(struct cpuidle_device *dev, return index; } -static void tegra114_idle_enter_s2idle(struct cpuidle_device *dev, +static int tegra114_idle_enter_s2idle(struct cpuidle_device *dev, struct cpuidle_driver *drv, int index) { tegra114_idle_power_down(dev, drv, index); + + return 0; } #endif diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c index ed56c6d20b08..53b6c3bb2f90 100644 --- a/drivers/acpi/processor_idle.c +++ b/drivers/acpi/processor_idle.c @@ -791,8 +791,8 @@ static int acpi_idle_enter(struct cpuidle_device *dev, return index; } -static void acpi_idle_enter_s2idle(struct cpuidle_device *dev, - struct cpuidle_driver *drv, int index) +static int acpi_idle_enter_s2idle(struct cpuidle_device *dev, + struct cpuidle_driver *drv, int index) { struct acpi_processor_cx *cx = per_cpu(acpi_cstate[index], dev->cpu); @@ -800,16 +800,18 @@ static void acpi_idle_enter_s2idle(struct cpuidle_device *dev, struct acpi_processor *pr = __this_cpu_read(processors); if (unlikely(!pr)) - return; + return 0; if (pr->flags.bm_check) { acpi_idle_enter_bm(pr, cx, false); - return; + return 0; } else { ACPI_FLUSH_CPU_CACHE(); } } acpi_idle_do_entry(cx); + + return 0; } static int acpi_processor_setup_cpuidle_cx(struct acpi_processor *pr, diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c index 347b08b56042..a5d6adc5b399 100644 --- a/drivers/idle/intel_idle.c +++ b/drivers/idle/intel_idle.c @@ -85,7 +85,7 @@ static const struct idle_cpu *icpu; static struct cpuidle_device __percpu *intel_idle_cpuidle_devices; static int intel_idle(struct cpuidle_device *dev, struct cpuidle_driver *drv, int index); -static void intel_idle_s2idle(struct cpuidle_device *dev, +static int intel_idle_s2idle(struct cpuidle_device *dev, struct cpuidle_driver *drv, int index); static struct cpuidle_state *cpuidle_state_table; @@ -935,13 +935,15 @@ static __cpuidle int intel_idle(struct cpuidle_device *dev, * @drv: cpuidle driver * @index: state index */ -static void intel_idle_s2idle(struct cpuidle_device *dev, +static int intel_idle_s2idle(struct cpuidle_device *dev, struct cpuidle_driver *drv, int index) { unsigned long ecx = 1; /* break on interrupt flag */ unsigned long eax = flg2MWAIT(drv->states[index].flags); mwait_idle_with_hints(eax, ecx); + + return 0; } static void __setup_broadcast_timer(bool on) diff --git a/include/linux/cpuidle.h b/include/linux/cpuidle.h index 4b6b5bea8f79..cc3a188ce82f 100644 --- a/include/linux/cpuidle.h +++ b/include/linux/cpuidle.h @@ -61,10 +61,13 @@ struct cpuidle_state { * CPUs execute ->enter_s2idle with the local tick or entire timekeeping * suspended, so it must not re-enable interrupts at any point (even * temporarily) or attempt to change states of clock event devices. + * + * This callback may point to the same function as ->enter if all of + * the above requirements are met by it. */ - void (*enter_s2idle) (struct cpuidle_device *dev, - struct cpuidle_driver *drv, - int index); + int (*enter_s2idle)(struct cpuidle_device *dev, + struct cpuidle_driver *drv, + int index); }; /* Idle State Flags */ From 22082e3e54da14645bc999a41926cb42985af700 Mon Sep 17 00:00:00 2001 From: Todd Kjos Date: Thu, 30 Jul 2020 23:53:11 +0000 Subject: [PATCH 02/31] Revert "ANDROID: ALSA: jack: Update supported jack switch types" Revert submission 144587-1572027951673-b7d38b4 Reason for revert: See b/142489397 Reverted Changes: Ia6d475540:ANDROID: ASoC: compress: fix unsigned integer over... If77f8b37b:ANDROID: ALSA: jack: Update supported jack switch ... Change-Id: Ifd73cf33379ff4893cf17ea447f1031bde796434 Signed-off-by: Todd Kjos Signed-off-by: Greg Kroah-Hartman --- include/linux/mod_devicetable.h | 2 +- include/sound/jack.h | 3 +++ include/uapi/linux/input-event-codes.h | 5 +---- sound/core/jack.c | 7 ++----- 4 files changed, 7 insertions(+), 10 deletions(-) diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h index 9bc3d989845a..4c56404e53a7 100644 --- a/include/linux/mod_devicetable.h +++ b/include/linux/mod_devicetable.h @@ -318,7 +318,7 @@ struct pcmcia_device_id { #define INPUT_DEVICE_ID_LED_MAX 0x0f #define INPUT_DEVICE_ID_SND_MAX 0x07 #define INPUT_DEVICE_ID_FF_MAX 0x7f -#define INPUT_DEVICE_ID_SW_MAX 0x20 +#define INPUT_DEVICE_ID_SW_MAX 0x10 #define INPUT_DEVICE_ID_PROP_MAX 0x1f #define INPUT_DEVICE_ID_MATCH_BUS 1 diff --git a/include/sound/jack.h b/include/sound/jack.h index 9c2ed0aa7948..9eb2b5ec1ec4 100644 --- a/include/sound/jack.h +++ b/include/sound/jack.h @@ -53,6 +53,9 @@ enum snd_jack_types { SND_JACK_BTN_5 = 0x0200, }; +/* Keep in sync with definitions above */ +#define SND_JACK_SWITCH_TYPES 6 + struct snd_jack { struct list_head kctl_list; struct snd_card *card; diff --git a/include/uapi/linux/input-event-codes.h b/include/uapi/linux/input-event-codes.h index 76b1de5e909f..472cd5bc5567 100644 --- a/include/uapi/linux/input-event-codes.h +++ b/include/uapi/linux/input-event-codes.h @@ -809,10 +809,7 @@ #define SW_MUTE_DEVICE 0x0e /* set = device disabled */ #define SW_PEN_INSERTED 0x0f /* set = pen inserted */ #define SW_MACHINE_COVER 0x10 /* set = cover closed */ -#define SW_HPHL_OVERCURRENT 0x11 /* set = over current on left hph */ -#define SW_HPHR_OVERCURRENT 0x12 /* set = over current on right hph */ -#define SW_UNSUPPORT_INSERT 0x13 /* set = unsupported device inserted */ -#define SW_MAX 0x20 +#define SW_MAX 0x10 #define SW_CNT (SW_MAX+1) /* diff --git a/sound/core/jack.c b/sound/core/jack.c index e1594d0ca61f..fb26196571a7 100644 --- a/sound/core/jack.c +++ b/sound/core/jack.c @@ -19,16 +19,13 @@ struct snd_jack_kctl { }; #ifdef CONFIG_SND_JACK_INPUT_DEV -static int jack_switch_types[] = { +static int jack_switch_types[SND_JACK_SWITCH_TYPES] = { SW_HEADPHONE_INSERT, SW_MICROPHONE_INSERT, SW_LINEOUT_INSERT, SW_JACK_PHYSICAL_INSERT, SW_VIDEOOUT_INSERT, SW_LINEIN_INSERT, - SW_HPHL_OVERCURRENT, - SW_HPHR_OVERCURRENT, - SW_UNSUPPORT_INSERT, }; #endif /* CONFIG_SND_JACK_INPUT_DEV */ @@ -239,7 +236,7 @@ int snd_jack_new(struct snd_card *card, const char *id, int type, jack->type = type; - for (i = 0; i < ARRAY_SIZE(jack_switch_types); i++) + for (i = 0; i < SND_JACK_SWITCH_TYPES; i++) if (type & (1 << i)) input_set_capability(jack->input_dev, EV_SW, jack_switch_types[i]); From ea0bb61dedb01f42faa9d3dfc2ac00fd4ed268a0 Mon Sep 17 00:00:00 2001 From: Todd Kjos Date: Thu, 30 Jul 2020 23:53:11 +0000 Subject: [PATCH 03/31] Revert "ANDROID: ASoC: compress: fix unsigned integer overflow check" Revert submission 144587-1572027951673-b7d38b4 Reason for revert: See b/142489397 Reverted Changes: Ia6d475540:ANDROID: ASoC: compress: fix unsigned integer over... If77f8b37b:ANDROID: ALSA: jack: Update supported jack switch ... Change-Id: I514458a88b3b96bc2da6d1558b41fd3ccf0aafbd Signed-off-by: Todd Kjos Signed-off-by: Greg Kroah-Hartman --- sound/core/compress_offload.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c index f34ce564d92c..41905afada63 100644 --- a/sound/core/compress_offload.c +++ b/sound/core/compress_offload.c @@ -528,7 +528,7 @@ static int snd_compress_check_input(struct snd_compr_params *params) { /* first let's check the buffer parameter's */ if (params->buffer.fragment_size == 0 || - params->buffer.fragments > U32_MAX / params->buffer.fragment_size || + params->buffer.fragments > INT_MAX / params->buffer.fragment_size || params->buffer.fragments == 0) return -EINVAL; From df4e0843881c7b8d76f124463e3c42c41f4b67f4 Mon Sep 17 00:00:00 2001 From: Jeehong Kim Date: Mon, 13 Jul 2020 23:42:58 +0900 Subject: [PATCH 04/31] FROMLIST: power: add "Wireless" to power_supply_type and power_supply_type_text In android platform(BatteryMonitor.cpp), SysfsStringEnumMap supplyTypeMap[] is declred for communication with kernel(sysfs) and there is "Wireless". But, no type for "Wireless" in kernel. So, we suggest to add "Wireless" to power_supply_type and power_supply_type_text to use "Wireless" on android platform. This will help ensure that text values are kept in sync with BatteryMonitor.cpp. Bug: 160750558 Signed-off-by: Do Hyoung Kim Signed-off-by: Jeehong Kim Link: https://lore.kernel.org/lkml/20200730000946.15327-1-jhez.kim@samsung.com/T/#u Change-Id: I486bef98ac785d6352370b8e9c4865ed2351f6d4 --- drivers/power/supply/power_supply_sysfs.c | 1 + include/linux/power_supply.h | 1 + 2 files changed, 2 insertions(+) diff --git a/drivers/power/supply/power_supply_sysfs.c b/drivers/power/supply/power_supply_sysfs.c index 4d6e1d5015d6..51a1383a7f23 100644 --- a/drivers/power/supply/power_supply_sysfs.c +++ b/drivers/power/supply/power_supply_sysfs.c @@ -56,6 +56,7 @@ static const char * const POWER_SUPPLY_TYPE_TEXT[] = { [POWER_SUPPLY_TYPE_USB_PD] = "USB_PD", [POWER_SUPPLY_TYPE_USB_PD_DRP] = "USB_PD_DRP", [POWER_SUPPLY_TYPE_APPLE_BRICK_ID] = "BrickID", + [POWER_SUPPLY_TYPE_WIRELESS] = "Wireless", }; static const char * const POWER_SUPPLY_USB_TYPE_TEXT[] = { diff --git a/include/linux/power_supply.h b/include/linux/power_supply.h index 4dcdbfb36357..f4473c233dab 100644 --- a/include/linux/power_supply.h +++ b/include/linux/power_supply.h @@ -185,6 +185,7 @@ enum power_supply_type { POWER_SUPPLY_TYPE_USB_PD, /* Power Delivery Port */ POWER_SUPPLY_TYPE_USB_PD_DRP, /* PD Dual Role Port */ POWER_SUPPLY_TYPE_APPLE_BRICK_ID, /* Apple Charging Method */ + POWER_SUPPLY_TYPE_WIRELESS, /* Wireless */ }; enum power_supply_usb_type { From 6d423415efa7707e3837b6ca40354a6f07fae938 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 31 Jul 2020 16:50:56 +0200 Subject: [PATCH 05/31] ANDROID: GKI: enable CONFIG_VIDEO_V4L2_SUBDEV_API It's needed by drivers that some boards need, so build it into the kernel core for everyone to use. Bug: 162449887 Signed-off-by: Greg Kroah-Hartman Change-Id: Id486baec2f3c5b5dfbf18352d940dcf4ac701b67 --- arch/arm64/configs/gki_defconfig | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm64/configs/gki_defconfig b/arch/arm64/configs/gki_defconfig index 8f4e4c3e0f4a..26dd42c286ba 100644 --- a/arch/arm64/configs/gki_defconfig +++ b/arch/arm64/configs/gki_defconfig @@ -342,6 +342,7 @@ CONFIG_REGULATOR=y CONFIG_REGULATOR_FIXED_VOLTAGE=y CONFIG_MEDIA_CAMERA_SUPPORT=y CONFIG_MEDIA_CONTROLLER=y +CONFIG_VIDEO_V4L2_SUBDEV_API=y CONFIG_V4L_PLATFORM_DRIVERS=y # CONFIG_VGA_ARB is not set CONFIG_DRM=y From dc23881999336335030a9b23c880093941ad2f37 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 31 Jul 2020 18:31:11 +0200 Subject: [PATCH 06/31] Revert "Revert "ANDROID: ASoC: compress: fix unsigned integer overflow check"" This reverts commit ea0bb61dedb01f42faa9d3dfc2ac00fd4ed268a0. Shouldn't have been dropped from this branch. Cc: Todd Kjos Signed-off-by: Greg Kroah-Hartman Change-Id: Id757beae312e21816b923636c812107099279985 --- sound/core/compress_offload.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c index 41905afada63..f34ce564d92c 100644 --- a/sound/core/compress_offload.c +++ b/sound/core/compress_offload.c @@ -528,7 +528,7 @@ static int snd_compress_check_input(struct snd_compr_params *params) { /* first let's check the buffer parameter's */ if (params->buffer.fragment_size == 0 || - params->buffer.fragments > INT_MAX / params->buffer.fragment_size || + params->buffer.fragments > U32_MAX / params->buffer.fragment_size || params->buffer.fragments == 0) return -EINVAL; From 006f2d92c269b1a820958e1faeddd81df2426dd5 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 31 Jul 2020 18:31:50 +0200 Subject: [PATCH 07/31] Revert "Revert "ANDROID: ALSA: jack: Update supported jack switch types"" This reverts commit 22082e3e54da14645bc999a41926cb42985af700. Shouldn't have been reverted from this branch. Cc: Todd Kjos Signed-off-by: Greg Kroah-Hartman Change-Id: Ie71a68da01b80d3d8ff770dcf68135fbeb5c847f --- include/linux/mod_devicetable.h | 2 +- include/sound/jack.h | 3 --- include/uapi/linux/input-event-codes.h | 5 ++++- sound/core/jack.c | 7 +++++-- 4 files changed, 10 insertions(+), 7 deletions(-) diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h index 4c56404e53a7..9bc3d989845a 100644 --- a/include/linux/mod_devicetable.h +++ b/include/linux/mod_devicetable.h @@ -318,7 +318,7 @@ struct pcmcia_device_id { #define INPUT_DEVICE_ID_LED_MAX 0x0f #define INPUT_DEVICE_ID_SND_MAX 0x07 #define INPUT_DEVICE_ID_FF_MAX 0x7f -#define INPUT_DEVICE_ID_SW_MAX 0x10 +#define INPUT_DEVICE_ID_SW_MAX 0x20 #define INPUT_DEVICE_ID_PROP_MAX 0x1f #define INPUT_DEVICE_ID_MATCH_BUS 1 diff --git a/include/sound/jack.h b/include/sound/jack.h index 9eb2b5ec1ec4..9c2ed0aa7948 100644 --- a/include/sound/jack.h +++ b/include/sound/jack.h @@ -53,9 +53,6 @@ enum snd_jack_types { SND_JACK_BTN_5 = 0x0200, }; -/* Keep in sync with definitions above */ -#define SND_JACK_SWITCH_TYPES 6 - struct snd_jack { struct list_head kctl_list; struct snd_card *card; diff --git a/include/uapi/linux/input-event-codes.h b/include/uapi/linux/input-event-codes.h index 472cd5bc5567..76b1de5e909f 100644 --- a/include/uapi/linux/input-event-codes.h +++ b/include/uapi/linux/input-event-codes.h @@ -809,7 +809,10 @@ #define SW_MUTE_DEVICE 0x0e /* set = device disabled */ #define SW_PEN_INSERTED 0x0f /* set = pen inserted */ #define SW_MACHINE_COVER 0x10 /* set = cover closed */ -#define SW_MAX 0x10 +#define SW_HPHL_OVERCURRENT 0x11 /* set = over current on left hph */ +#define SW_HPHR_OVERCURRENT 0x12 /* set = over current on right hph */ +#define SW_UNSUPPORT_INSERT 0x13 /* set = unsupported device inserted */ +#define SW_MAX 0x20 #define SW_CNT (SW_MAX+1) /* diff --git a/sound/core/jack.c b/sound/core/jack.c index fb26196571a7..e1594d0ca61f 100644 --- a/sound/core/jack.c +++ b/sound/core/jack.c @@ -19,13 +19,16 @@ struct snd_jack_kctl { }; #ifdef CONFIG_SND_JACK_INPUT_DEV -static int jack_switch_types[SND_JACK_SWITCH_TYPES] = { +static int jack_switch_types[] = { SW_HEADPHONE_INSERT, SW_MICROPHONE_INSERT, SW_LINEOUT_INSERT, SW_JACK_PHYSICAL_INSERT, SW_VIDEOOUT_INSERT, SW_LINEIN_INSERT, + SW_HPHL_OVERCURRENT, + SW_HPHR_OVERCURRENT, + SW_UNSUPPORT_INSERT, }; #endif /* CONFIG_SND_JACK_INPUT_DEV */ @@ -236,7 +239,7 @@ int snd_jack_new(struct snd_card *card, const char *id, int type, jack->type = type; - for (i = 0; i < SND_JACK_SWITCH_TYPES; i++) + for (i = 0; i < ARRAY_SIZE(jack_switch_types); i++) if (type & (1 << i)) input_set_capability(jack->input_dev, EV_SW, jack_switch_types[i]); From 2f1624faf647dfc96bf20b7fd94bdd46902d82fd Mon Sep 17 00:00:00 2001 From: Peilin Ye Date: Wed, 22 Jul 2020 11:19:01 -0400 Subject: [PATCH 08/31] AX.25: Fix out-of-bounds read in ax25_connect() [ Upstream commit 2f2a7ffad5c6cbf3d438e813cfdc88230e185ba6 ] Checks on `addr_len` and `fsa->fsa_ax25.sax25_ndigis` are insufficient. ax25_connect() can go out of bounds when `fsa->fsa_ax25.sax25_ndigis` equals to 7 or 8. Fix it. This issue has been reported as a KMSAN uninit-value bug, because in such a case, ax25_connect() reaches into the uninitialized portion of the `struct sockaddr_storage` statically allocated in __sys_connect(). It is safe to remove `fsa->fsa_ax25.sax25_ndigis > AX25_MAX_DIGIS` because `addr_len` is guaranteed to be less than or equal to `sizeof(struct full_sockaddr_ax25)`. Reported-by: syzbot+c82752228ed975b0a623@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?id=55ef9d629f3b3d7d70b69558015b63b48d01af66 Signed-off-by: Peilin Ye Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/ax25/af_ax25.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c index e5a3dc28116d..085a6631eb22 100644 --- a/net/ax25/af_ax25.c +++ b/net/ax25/af_ax25.c @@ -1187,7 +1187,9 @@ static int __must_check ax25_connect(struct socket *sock, if (addr_len > sizeof(struct sockaddr_ax25) && fsa->fsa_ax25.sax25_ndigis != 0) { /* Valid number of digipeaters ? */ - if (fsa->fsa_ax25.sax25_ndigis < 1 || fsa->fsa_ax25.sax25_ndigis > AX25_MAX_DIGIS) { + if (fsa->fsa_ax25.sax25_ndigis < 1 || + addr_len < sizeof(struct sockaddr_ax25) + + sizeof(ax25_address) * fsa->fsa_ax25.sax25_ndigis) { err = -EINVAL; goto out_release; } From 52aeeec1a6359a9bb885a3bd9a1ad740873bf0bf Mon Sep 17 00:00:00 2001 From: Peilin Ye Date: Wed, 22 Jul 2020 12:05:12 -0400 Subject: [PATCH 09/31] AX.25: Prevent out-of-bounds read in ax25_sendmsg() [ Upstream commit 8885bb0621f01a6c82be60a91e5fc0f6e2f71186 ] Checks on `addr_len` and `usax->sax25_ndigis` are insufficient. ax25_sendmsg() can go out of bounds when `usax->sax25_ndigis` equals to 7 or 8. Fix it. It is safe to remove `usax->sax25_ndigis > AX25_MAX_DIGIS`, since `addr_len` is guaranteed to be less than or equal to `sizeof(struct full_sockaddr_ax25)` Signed-off-by: Peilin Ye Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/ax25/af_ax25.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c index 085a6631eb22..dbe7ef2c7e75 100644 --- a/net/ax25/af_ax25.c +++ b/net/ax25/af_ax25.c @@ -1509,7 +1509,8 @@ static int ax25_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) struct full_sockaddr_ax25 *fsa = (struct full_sockaddr_ax25 *)usax; /* Valid number of digipeaters ? */ - if (usax->sax25_ndigis < 1 || usax->sax25_ndigis > AX25_MAX_DIGIS) { + if (usax->sax25_ndigis < 1 || addr_len < sizeof(struct sockaddr_ax25) + + sizeof(ax25_address) * usax->sax25_ndigis) { err = -EINVAL; goto out; } From d109acd58052ce4affc01e931765045c368ed31e Mon Sep 17 00:00:00 2001 From: Subash Abhinov Kasiviswanathan Date: Thu, 23 Jul 2020 11:31:48 -0600 Subject: [PATCH 10/31] dev: Defer free of skbs in flush_backlog [ Upstream commit 7df5cb75cfb8acf96c7f2342530eb41e0c11f4c3 ] IRQs are disabled when freeing skbs in input queue. Use the IRQ safe variant to free skbs here. Fixes: 145dd5f9c88f ("net: flush the softnet backlog in process context") Signed-off-by: Subash Abhinov Kasiviswanathan Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/core/dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/core/dev.c b/net/core/dev.c index 727965565d31..25858f1f67cf 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -5229,7 +5229,7 @@ static void flush_backlog(struct work_struct *work) skb_queue_walk_safe(&sd->input_pkt_queue, skb, tmp) { if (skb->dev->reg_state == NETREG_UNREGISTERING) { __skb_unlink(skb, &sd->input_pkt_queue); - kfree_skb(skb); + dev_kfree_skb_irq(skb); input_queue_head_incr(sd); } } From fbcd85cd11de98117f9c4855e79c4f2ed333dae3 Mon Sep 17 00:00:00 2001 From: Xie He Date: Thu, 16 Jul 2020 16:44:33 -0700 Subject: [PATCH 11/31] drivers/net/wan/x25_asy: Fix to make it work [ Upstream commit 8fdcabeac39824fe67480fd9508d80161c541854 ] This driver is not working because of problems of its receiving code. This patch fixes it to make it work. When the driver receives an LAPB frame, it should first pass the frame to the LAPB module to process. After processing, the LAPB module passes the data (the packet) back to the driver, the driver should then add a one-byte pseudo header and pass the data to upper layers. The changes to the "x25_asy_bump" function and the "x25_asy_data_indication" function are to correctly implement this procedure. Also, the "x25_asy_unesc" function ignores any frame that is shorter than 3 bytes. However the shortest frames are 2-byte long. So we need to change it to allow 2-byte frames to pass. Cc: Eric Dumazet Cc: Martin Schiller Signed-off-by: Xie He Reviewed-by: Martin Schiller Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- drivers/net/wan/x25_asy.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/drivers/net/wan/x25_asy.c b/drivers/net/wan/x25_asy.c index 914be5847386..cdcc380b4c26 100644 --- a/drivers/net/wan/x25_asy.c +++ b/drivers/net/wan/x25_asy.c @@ -183,7 +183,7 @@ static inline void x25_asy_unlock(struct x25_asy *sl) netif_wake_queue(sl->dev); } -/* Send one completely decapsulated IP datagram to the IP layer. */ +/* Send an LAPB frame to the LAPB module to process. */ static void x25_asy_bump(struct x25_asy *sl) { @@ -195,13 +195,12 @@ static void x25_asy_bump(struct x25_asy *sl) count = sl->rcount; dev->stats.rx_bytes += count; - skb = dev_alloc_skb(count+1); + skb = dev_alloc_skb(count); if (skb == NULL) { netdev_warn(sl->dev, "memory squeeze, dropping packet\n"); dev->stats.rx_dropped++; return; } - skb_push(skb, 1); /* LAPB internal control */ skb_put_data(skb, sl->rbuff, count); skb->protocol = x25_type_trans(skb, sl->dev); err = lapb_data_received(skb->dev, skb); @@ -209,7 +208,6 @@ static void x25_asy_bump(struct x25_asy *sl) kfree_skb(skb); printk(KERN_DEBUG "x25_asy: data received err - %d\n", err); } else { - netif_rx(skb); dev->stats.rx_packets++; } } @@ -356,12 +354,21 @@ static netdev_tx_t x25_asy_xmit(struct sk_buff *skb, */ /* - * Called when I frame data arrives. We did the work above - throw it - * at the net layer. + * Called when I frame data arrive. We add a pseudo header for upper + * layers and pass it to upper layers. */ static int x25_asy_data_indication(struct net_device *dev, struct sk_buff *skb) { + if (skb_cow(skb, 1)) { + kfree_skb(skb); + return NET_RX_DROP; + } + skb_push(skb, 1); + skb->data[0] = X25_IFACE_DATA; + + skb->protocol = x25_type_trans(skb, dev); + return netif_rx(skb); } @@ -657,7 +664,7 @@ static void x25_asy_unesc(struct x25_asy *sl, unsigned char s) switch (s) { case X25_END: if (!test_and_clear_bit(SLF_ERROR, &sl->flags) && - sl->rcount > 2) + sl->rcount >= 2) x25_asy_bump(sl); clear_bit(SLF_ESCAPE, &sl->flags); sl->rcount = 0; From 8d9f13dd400cfdb260b6424941a82ec0e9892803 Mon Sep 17 00:00:00 2001 From: Wei Yongjun Date: Mon, 13 Jul 2020 23:59:50 +0800 Subject: [PATCH 12/31] ip6_gre: fix null-ptr-deref in ip6gre_init_net() [ Upstream commit 46ef5b89ec0ecf290d74c4aee844f063933c4da4 ] KASAN report null-ptr-deref error when register_netdev() failed: KASAN: null-ptr-deref in range [0x00000000000003c0-0x00000000000003c7] CPU: 2 PID: 422 Comm: ip Not tainted 5.8.0-rc4+ #12 Call Trace: ip6gre_init_net+0x4ab/0x580 ? ip6gre_tunnel_uninit+0x3f0/0x3f0 ops_init+0xa8/0x3c0 setup_net+0x2de/0x7e0 ? rcu_read_lock_bh_held+0xb0/0xb0 ? ops_init+0x3c0/0x3c0 ? kasan_unpoison_shadow+0x33/0x40 ? __kasan_kmalloc.constprop.0+0xc2/0xd0 copy_net_ns+0x27d/0x530 create_new_namespaces+0x382/0xa30 unshare_nsproxy_namespaces+0xa1/0x1d0 ksys_unshare+0x39c/0x780 ? walk_process_tree+0x2a0/0x2a0 ? trace_hardirqs_on+0x4a/0x1b0 ? _raw_spin_unlock_irq+0x1f/0x30 ? syscall_trace_enter+0x1a7/0x330 ? do_syscall_64+0x1c/0xa0 __x64_sys_unshare+0x2d/0x40 do_syscall_64+0x56/0xa0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 ip6gre_tunnel_uninit() has set 'ign->fb_tunnel_dev' to NULL, later access to ign->fb_tunnel_dev cause null-ptr-deref. Fix it by saving 'ign->fb_tunnel_dev' to local variable ndev. Fixes: dafabb6590cb ("ip6_gre: fix use-after-free in ip6gre_tunnel_lookup()") Reported-by: Hulk Robot Signed-off-by: Wei Yongjun Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/ipv6/ip6_gre.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c index 04d76f043e18..44876509d215 100644 --- a/net/ipv6/ip6_gre.c +++ b/net/ipv6/ip6_gre.c @@ -1560,17 +1560,18 @@ static void ip6gre_destroy_tunnels(struct net *net, struct list_head *head) static int __net_init ip6gre_init_net(struct net *net) { struct ip6gre_net *ign = net_generic(net, ip6gre_net_id); + struct net_device *ndev; int err; if (!net_has_fallback_tunnels(net)) return 0; - ign->fb_tunnel_dev = alloc_netdev(sizeof(struct ip6_tnl), "ip6gre0", - NET_NAME_UNKNOWN, - ip6gre_tunnel_setup); - if (!ign->fb_tunnel_dev) { + ndev = alloc_netdev(sizeof(struct ip6_tnl), "ip6gre0", + NET_NAME_UNKNOWN, ip6gre_tunnel_setup); + if (!ndev) { err = -ENOMEM; goto err_alloc_dev; } + ign->fb_tunnel_dev = ndev; dev_net_set(ign->fb_tunnel_dev, net); /* FB netdevice is special: we have one, and only one per netns. * Allowing to move it to another netns is clearly unsafe. @@ -1590,7 +1591,7 @@ static int __net_init ip6gre_init_net(struct net *net) return 0; err_reg_dev: - free_netdev(ign->fb_tunnel_dev); + free_netdev(ndev); err_alloc_dev: return err; } From 274b40b6df6cea30f794b83eb04198f1acca15b0 Mon Sep 17 00:00:00 2001 From: Xiongfeng Wang Date: Tue, 21 Jul 2020 15:02:57 +0800 Subject: [PATCH 13/31] net-sysfs: add a newline when printing 'tx_timeout' by sysfs [ Upstream commit 9bb5fbea59f36a589ef886292549ca4052fe676c ] When I cat 'tx_timeout' by sysfs, it displays as follows. It's better to add a newline for easy reading. root@syzkaller:~# cat /sys/devices/virtual/net/lo/queues/tx-0/tx_timeout 0root@syzkaller:~# Signed-off-by: Xiongfeng Wang Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/core/net-sysfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c index 4c826b8bf9b1..2ebf9b252779 100644 --- a/net/core/net-sysfs.c +++ b/net/core/net-sysfs.c @@ -1036,7 +1036,7 @@ static ssize_t tx_timeout_show(struct netdev_queue *queue, char *buf) trans_timeout = queue->trans_timeout; spin_unlock_irq(&queue->_xmit_lock); - return sprintf(buf, "%lu", trans_timeout); + return sprintf(buf, fmt_ulong, trans_timeout); } static unsigned int get_netdev_queue_index(struct netdev_queue *queue) From 2bf797a8691a806f58e0bb6f2cb80fbbe4b8d6d1 Mon Sep 17 00:00:00 2001 From: Miaohe Lin Date: Tue, 21 Jul 2020 17:11:44 +0800 Subject: [PATCH 14/31] net: udp: Fix wrong clean up for IS_UDPLITE macro [ Upstream commit b0a422772fec29811e293c7c0e6f991c0fd9241d ] We can't use IS_UDPLITE to replace udp_sk->pcflag when UDPLITE_RECV_CC is checked. Fixes: b2bf1e2659b1 ("[UDP]: Clean up for IS_UDPLITE macro") Signed-off-by: Miaohe Lin Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/ipv4/udp.c | 2 +- net/ipv6/udp.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c index f3b7cb725c1b..b3320e42cbcb 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -2045,7 +2045,7 @@ static int udp_queue_rcv_one_skb(struct sock *sk, struct sk_buff *skb) /* * UDP-Lite specific tests, ignored on UDP sockets */ - if ((is_udplite & UDPLITE_RECV_CC) && UDP_SKB_CB(skb)->partial_cov) { + if ((up->pcflag & UDPLITE_RECV_CC) && UDP_SKB_CB(skb)->partial_cov) { /* * MIB statistics other than incrementing the error count are diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c index 9fec580c968e..ede3bed354a8 100644 --- a/net/ipv6/udp.c +++ b/net/ipv6/udp.c @@ -643,7 +643,7 @@ static int udpv6_queue_rcv_one_skb(struct sock *sk, struct sk_buff *skb) /* * UDP-Lite specific tests, ignored on UDP sockets (see net/ipv4/udp.c). */ - if ((is_udplite & UDPLITE_RECV_CC) && UDP_SKB_CB(skb)->partial_cov) { + if ((up->pcflag & UDPLITE_RECV_CC) && UDP_SKB_CB(skb)->partial_cov) { if (up->pcrlen == 0) { /* full coverage was set */ net_dbg_ratelimited("UDPLITE6: partial coverage %d while full coverage %d requested\n", From b7d3d6df72a85552a4c6f3a8e5611a7847425314 Mon Sep 17 00:00:00 2001 From: Cong Wang Date: Fri, 24 Jul 2020 09:45:51 -0700 Subject: [PATCH 15/31] qrtr: orphan socket in qrtr_release() [ Upstream commit af9f691f0f5bdd1ade65a7b84927639882d7c3e5 ] We have to detach sock from socket in qrtr_release(), otherwise skb->sk may still reference to this socket when the skb is released in tun->queue, particularly sk->sk_wq still points to &sock->wq, which leads to a UAF. Reported-and-tested-by: syzbot+6720d64f31c081c2f708@syzkaller.appspotmail.com Fixes: 28fb4e59a47d ("net: qrtr: Expose tunneling endpoint to user space") Cc: Bjorn Andersson Cc: Eric Dumazet Signed-off-by: Cong Wang Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/qrtr/qrtr.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c index 14c101e104ce..1ce1e710d025 100644 --- a/net/qrtr/qrtr.c +++ b/net/qrtr/qrtr.c @@ -1004,6 +1004,7 @@ static int qrtr_release(struct socket *sock) sk->sk_state_change(sk); sock_set_flag(sk, SOCK_DEAD); + sock_orphan(sk); sock->sk = NULL; if (!sock_flag(sk, SOCK_ZAPPED)) From 01c928350641cee51b96d9b0a6bfcff1cde18321 Mon Sep 17 00:00:00 2001 From: Weilong Chen Date: Wed, 15 Jul 2020 20:58:10 +0800 Subject: [PATCH 16/31] rtnetlink: Fix memory(net_device) leak when ->newlink fails [ Upstream commit cebb69754f37d68e1355a5e726fdac317bcda302 ] When vlan_newlink call register_vlan_dev fails, it might return error with dev->reg_state = NETREG_UNREGISTERED. The rtnl_newlink should free the memory. But currently rtnl_newlink only free the memory which state is NETREG_UNINITIALIZED. BUG: memory leak unreferenced object 0xffff8881051de000 (size 4096): comm "syz-executor139", pid 560, jiffies 4294745346 (age 32.445s) hex dump (first 32 bytes): 76 6c 61 6e 32 00 00 00 00 00 00 00 00 00 00 00 vlan2........... 00 45 28 03 81 88 ff ff 00 00 00 00 00 00 00 00 .E(............. backtrace: [<0000000047527e31>] kmalloc_node include/linux/slab.h:578 [inline] [<0000000047527e31>] kvmalloc_node+0x33/0xd0 mm/util.c:574 [<000000002b59e3bc>] kvmalloc include/linux/mm.h:753 [inline] [<000000002b59e3bc>] kvzalloc include/linux/mm.h:761 [inline] [<000000002b59e3bc>] alloc_netdev_mqs+0x83/0xd90 net/core/dev.c:9929 [<000000006076752a>] rtnl_create_link+0x2c0/0xa20 net/core/rtnetlink.c:3067 [<00000000572b3be5>] __rtnl_newlink+0xc9c/0x1330 net/core/rtnetlink.c:3329 [<00000000e84ea553>] rtnl_newlink+0x66/0x90 net/core/rtnetlink.c:3397 [<0000000052c7c0a9>] rtnetlink_rcv_msg+0x540/0x990 net/core/rtnetlink.c:5460 [<000000004b5cb379>] netlink_rcv_skb+0x12b/0x3a0 net/netlink/af_netlink.c:2469 [<00000000c71c20d3>] netlink_unicast_kernel net/netlink/af_netlink.c:1303 [inline] [<00000000c71c20d3>] netlink_unicast+0x4c6/0x690 net/netlink/af_netlink.c:1329 [<00000000cca72fa9>] netlink_sendmsg+0x735/0xcc0 net/netlink/af_netlink.c:1918 [<000000009221ebf7>] sock_sendmsg_nosec net/socket.c:652 [inline] [<000000009221ebf7>] sock_sendmsg+0x109/0x140 net/socket.c:672 [<000000001c30ffe4>] ____sys_sendmsg+0x5f5/0x780 net/socket.c:2352 [<00000000b71ca6f3>] ___sys_sendmsg+0x11d/0x1a0 net/socket.c:2406 [<0000000007297384>] __sys_sendmsg+0xeb/0x1b0 net/socket.c:2439 [<000000000eb29b11>] do_syscall_64+0x56/0xa0 arch/x86/entry/common.c:359 [<000000006839b4d0>] entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fixes: cb626bf566eb ("net-sysfs: Fix reference count leak") Reported-by: Hulk Robot Signed-off-by: Weilong Chen Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/core/rtnetlink.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c index 944acb1a9f29..b0c06a063776 100644 --- a/net/core/rtnetlink.c +++ b/net/core/rtnetlink.c @@ -3231,7 +3231,8 @@ replay: */ if (err < 0) { /* If device is not registered at all, free it now */ - if (dev->reg_state == NETREG_UNINITIALIZED) + if (dev->reg_state == NETREG_UNINITIALIZED || + dev->reg_state == NETREG_UNREGISTERED) free_netdev(dev); goto out; } From e2f904fd79a00e5f24df09799443f010affff73e Mon Sep 17 00:00:00 2001 From: David Howells Date: Mon, 20 Jul 2020 12:41:46 +0100 Subject: [PATCH 17/31] rxrpc: Fix sendmsg() returning EPIPE due to recvmsg() returning ENODATA [ Upstream commit 639f181f0ee20d3249dbc55f740f0167267180f0 ] rxrpc_sendmsg() returns EPIPE if there's an outstanding error, such as if rxrpc_recvmsg() indicating ENODATA if there's nothing for it to read. Change rxrpc_recvmsg() to return EAGAIN instead if there's nothing to read as this particular error doesn't get stored in ->sk_err by the networking core. Also change rxrpc_sendmsg() so that it doesn't fail with delayed receive errors (there's no way for it to report which call, if any, the error was caused by). Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both") Signed-off-by: David Howells Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/rxrpc/recvmsg.c | 2 +- net/rxrpc/sendmsg.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c index 8578c39ec839..6896a33ef842 100644 --- a/net/rxrpc/recvmsg.c +++ b/net/rxrpc/recvmsg.c @@ -464,7 +464,7 @@ try_again: list_empty(&rx->recvmsg_q) && rx->sk.sk_state != RXRPC_SERVER_LISTENING) { release_sock(&rx->sk); - return -ENODATA; + return -EAGAIN; } if (list_empty(&rx->recvmsg_q)) { diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c index 5e9c43d4a314..49d03c8c64da 100644 --- a/net/rxrpc/sendmsg.c +++ b/net/rxrpc/sendmsg.c @@ -306,7 +306,7 @@ static int rxrpc_send_data(struct rxrpc_sock *rx, /* this should be in poll */ sk_clear_bit(SOCKWQ_ASYNC_NOSPACE, sk); - if (sk->sk_err || (sk->sk_shutdown & SEND_SHUTDOWN)) + if (sk->sk_shutdown & SEND_SHUTDOWN) return -EPIPE; more = msg->msg_flags & MSG_MORE; From 182ffc66456b20530def3b2d4f6b9a07545ac475 Mon Sep 17 00:00:00 2001 From: Yuchung Cheng Date: Thu, 23 Jul 2020 12:00:06 -0700 Subject: [PATCH 18/31] tcp: allow at most one TLP probe per flight [ Upstream commit 76be93fc0702322179bb0ea87295d820ee46ad14 ] Previously TLP may send multiple probes of new data in one flight. This happens when the sender is cwnd limited. After the initial TLP containing new data is sent, the sender receives another ACK that acks partial inflight. It may re-arm another TLP timer to send more, if no further ACK returns before the next TLP timeout (PTO) expires. The sender may send in theory a large amount of TLP until send queue is depleted. This only happens if the sender sees such irregular uncommon ACK pattern. But it is generally undesirable behavior during congestion especially. The original TLP design restrict only one TLP probe per inflight as published in "Reducing Web Latency: the Virtue of Gentle Aggression", SIGCOMM 2013. This patch changes TLP to send at most one probe per inflight. Note that if the sender is app-limited, TLP retransmits old data and did not have this issue. Signed-off-by: Yuchung Cheng Signed-off-by: Neal Cardwell Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- include/linux/tcp.h | 4 +++- net/ipv4/tcp_input.c | 11 ++++++----- net/ipv4/tcp_output.c | 13 ++++++++----- 3 files changed, 17 insertions(+), 11 deletions(-) diff --git a/include/linux/tcp.h b/include/linux/tcp.h index 668e25a76d69..358deb4ff830 100644 --- a/include/linux/tcp.h +++ b/include/linux/tcp.h @@ -216,6 +216,8 @@ struct tcp_sock { } rack; u16 advmss; /* Advertised MSS */ u8 compressed_ack; + u8 tlp_retrans:1, /* TLP is a retransmission */ + unused_1:7; u32 chrono_start; /* Start time in jiffies of a TCP chrono */ u32 chrono_stat[3]; /* Time in jiffies for chrono_stat stats */ u8 chrono_type:2, /* current chronograph type */ @@ -238,7 +240,7 @@ struct tcp_sock { save_syn:1, /* Save headers of SYN packet */ is_cwnd_limited:1,/* forward progress limited by snd_cwnd? */ syn_smc:1; /* SYN includes SMC */ - u32 tlp_high_seq; /* snd_nxt at the time of TLP retransmit. */ + u32 tlp_high_seq; /* snd_nxt at the time of TLP */ u32 tcp_tx_delay; /* delay (in usec) added to TX packets */ u64 tcp_wstamp_ns; /* departure time for next sent data packet */ diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index 6d331307beca..5040f7ca37ec 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -3505,10 +3505,8 @@ static void tcp_replace_ts_recent(struct tcp_sock *tp, u32 seq) } } -/* This routine deals with acks during a TLP episode. - * We mark the end of a TLP episode on receiving TLP dupack or when - * ack is after tlp_high_seq. - * Ref: loss detection algorithm in draft-dukkipati-tcpm-tcp-loss-probe. +/* This routine deals with acks during a TLP episode and ends an episode by + * resetting tlp_high_seq. Ref: TLP algorithm in draft-ietf-tcpm-rack */ static void tcp_process_tlp_ack(struct sock *sk, u32 ack, int flag) { @@ -3517,7 +3515,10 @@ static void tcp_process_tlp_ack(struct sock *sk, u32 ack, int flag) if (before(ack, tp->tlp_high_seq)) return; - if (flag & FLAG_DSACKING_ACK) { + if (!tp->tlp_retrans) { + /* TLP of new data has been acknowledged */ + tp->tlp_high_seq = 0; + } else if (flag & FLAG_DSACKING_ACK) { /* This DSACK means original and TLP probe arrived; no loss */ tp->tlp_high_seq = 0; } else if (after(ack, tp->tlp_high_seq)) { diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index 5dc7485c4076..4407193bd702 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -2564,6 +2564,11 @@ void tcp_send_loss_probe(struct sock *sk) int pcount; int mss = tcp_current_mss(sk); + /* At most one outstanding TLP */ + if (tp->tlp_high_seq) + goto rearm_timer; + + tp->tlp_retrans = 0; skb = tcp_send_head(sk); if (skb && tcp_snd_wnd_test(tp, skb, mss)) { pcount = tp->packets_out; @@ -2581,10 +2586,6 @@ void tcp_send_loss_probe(struct sock *sk) return; } - /* At most one outstanding TLP retransmission. */ - if (tp->tlp_high_seq) - goto rearm_timer; - if (skb_still_in_host_queue(sk, skb)) goto rearm_timer; @@ -2606,10 +2607,12 @@ void tcp_send_loss_probe(struct sock *sk) if (__tcp_retransmit_skb(sk, skb, 1)) goto rearm_timer; + tp->tlp_retrans = 1; + +probe_sent: /* Record snd_nxt for loss detection. */ tp->tlp_high_seq = tp->snd_nxt; -probe_sent: NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPLOSSPROBES); /* Reset s.t. tcp_rearm_rto will restart timer from now */ inet_csk(sk)->icsk_pending = 0; From bbf6af4a938a4b6f139440e6d8cd8cb76379962d Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Thu, 23 Jul 2020 17:49:57 +0300 Subject: [PATCH 19/31] AX.25: Prevent integer overflows in connect and sendmsg [ Upstream commit 17ad73e941b71f3bec7523ea4e9cbc3752461c2d ] We recently added some bounds checking in ax25_connect() and ax25_sendmsg() and we so we removed the AX25_MAX_DIGIS checks because they were no longer required. Unfortunately, I believe they are required to prevent integer overflows so I have added them back. Fixes: 8885bb0621f0 ("AX.25: Prevent out-of-bounds read in ax25_sendmsg()") Fixes: 2f2a7ffad5c6 ("AX.25: Fix out-of-bounds read in ax25_connect()") Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/ax25/af_ax25.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c index dbe7ef2c7e75..2fdb1b573e8c 100644 --- a/net/ax25/af_ax25.c +++ b/net/ax25/af_ax25.c @@ -1188,6 +1188,7 @@ static int __must_check ax25_connect(struct socket *sock, fsa->fsa_ax25.sax25_ndigis != 0) { /* Valid number of digipeaters ? */ if (fsa->fsa_ax25.sax25_ndigis < 1 || + fsa->fsa_ax25.sax25_ndigis > AX25_MAX_DIGIS || addr_len < sizeof(struct sockaddr_ax25) + sizeof(ax25_address) * fsa->fsa_ax25.sax25_ndigis) { err = -EINVAL; @@ -1509,7 +1510,9 @@ static int ax25_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) struct full_sockaddr_ax25 *fsa = (struct full_sockaddr_ax25 *)usax; /* Valid number of digipeaters ? */ - if (usax->sax25_ndigis < 1 || addr_len < sizeof(struct sockaddr_ax25) + + if (usax->sax25_ndigis < 1 || + usax->sax25_ndigis > AX25_MAX_DIGIS || + addr_len < sizeof(struct sockaddr_ax25) + sizeof(ax25_address) * usax->sax25_ndigis) { err = -EINVAL; goto out; From 46e7c7efc30d97f47df4e814205e876a13f1999f Mon Sep 17 00:00:00 2001 From: Xin Long Date: Wed, 22 Jul 2020 23:52:11 +0800 Subject: [PATCH 20/31] sctp: shrink stream outq only when new outcnt < old outcnt [ Upstream commit 8f13399db22f909a35735bf8ae2f932e0c8f0e30 ] It's not necessary to go list_for_each for outq->out_chunk_list when new outcnt >= old outcnt, as no chunk with higher sid than new (outcnt - 1) exists in the outqueue. While at it, also move the list_for_each code in a new function sctp_stream_shrink_out(), which will be used in the next patch. Signed-off-by: Xin Long Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/sctp/stream.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/net/sctp/stream.c b/net/sctp/stream.c index c1a100d2fed3..9caa0f6e31bd 100644 --- a/net/sctp/stream.c +++ b/net/sctp/stream.c @@ -22,17 +22,11 @@ #include #include -/* Migrates chunks from stream queues to new stream queues if needed, - * but not across associations. Also, removes those chunks to streams - * higher than the new max. - */ -static void sctp_stream_outq_migrate(struct sctp_stream *stream, - struct sctp_stream *new, __u16 outcnt) +static void sctp_stream_shrink_out(struct sctp_stream *stream, __u16 outcnt) { struct sctp_association *asoc; struct sctp_chunk *ch, *temp; struct sctp_outq *outq; - int i; asoc = container_of(stream, struct sctp_association, stream); outq = &asoc->outqueue; @@ -56,6 +50,19 @@ static void sctp_stream_outq_migrate(struct sctp_stream *stream, sctp_chunk_free(ch); } +} + +/* Migrates chunks from stream queues to new stream queues if needed, + * but not across associations. Also, removes those chunks to streams + * higher than the new max. + */ +static void sctp_stream_outq_migrate(struct sctp_stream *stream, + struct sctp_stream *new, __u16 outcnt) +{ + int i; + + if (stream->outcnt > outcnt) + sctp_stream_shrink_out(stream, outcnt); if (new) { /* Here we actually move the old ext stuff into the new From 86512c6938a9b56bc82bc24a5b61b527ee5fe6b7 Mon Sep 17 00:00:00 2001 From: Xin Long Date: Wed, 22 Jul 2020 23:52:12 +0800 Subject: [PATCH 21/31] sctp: shrink stream outq when fails to do addstream reconf [ Upstream commit 3ecdda3e9ad837cf9cb41b6faa11b1af3a5abc0c ] When adding a stream with stream reconf, the new stream firstly is in CLOSED state but new out chunks can still be enqueued. Then once gets the confirmation from the peer, the state will change to OPEN. However, if the peer denies, it needs to roll back the stream. But when doing that, it only sets the stream outcnt back, and the chunks already in the new stream don't get purged. It caused these chunks can still be dequeued in sctp_outq_dequeue_data(). As its stream is still in CLOSE, the chunk will be enqueued to the head again by sctp_outq_head_data(). This chunk will never be sent out, and the chunks after it can never be dequeued. The assoc will be 'hung' in a dead loop of sending this chunk. To fix it, this patch is to purge these chunks already in the new stream by calling sctp_stream_shrink_out() when failing to do the addstream reconf. Fixes: 11ae76e67a17 ("sctp: implement receiver-side procedures for the Reconf Response Parameter") Reported-by: Ying Xu Signed-off-by: Xin Long Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/sctp/stream.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/sctp/stream.c b/net/sctp/stream.c index 9caa0f6e31bd..e13cbd5c0193 100644 --- a/net/sctp/stream.c +++ b/net/sctp/stream.c @@ -1045,11 +1045,13 @@ struct sctp_chunk *sctp_process_strreset_resp( nums = ntohs(addstrm->number_of_streams); number = stream->outcnt - nums; - if (result == SCTP_STRRESET_PERFORMED) + if (result == SCTP_STRRESET_PERFORMED) { for (i = number; i < stream->outcnt; i++) SCTP_SO(stream, i)->state = SCTP_STREAM_OPEN; - else + } else { + sctp_stream_shrink_out(stream, number); stream->outcnt = number; + } *evp = sctp_ulpevent_make_stream_change_event(asoc, flags, 0, nums, GFP_ATOMIC); From 6735c126d27200db85c338410ffd34649dd572ff Mon Sep 17 00:00:00 2001 From: Kuniyuki Iwashima Date: Tue, 21 Jul 2020 15:15:30 +0900 Subject: [PATCH 22/31] udp: Copy has_conns in reuseport_grow(). [ Upstream commit f2b2c55e512879a05456eaf5de4d1ed2f7757509 ] If an unconnected socket in a UDP reuseport group connect()s, has_conns is set to 1. Then, when a packet is received, udp[46]_lib_lookup2() scans all sockets in udp_hslot looking for the connected socket with the highest score. However, when the number of sockets bound to the port exceeds max_socks, reuseport_grow() resets has_conns to 0. It can cause udp[46]_lib_lookup2() to return without scanning all sockets, resulting in that packets sent to connected sockets may be distributed to unconnected sockets. Therefore, reuseport_grow() should copy has_conns. Fixes: acdcecc61285 ("udp: correct reuseport selection with connected sockets") CC: Willem de Bruijn Reviewed-by: Benjamin Herrenschmidt Signed-off-by: Kuniyuki Iwashima Acked-by: Willem de Bruijn Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/core/sock_reuseport.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/core/sock_reuseport.c b/net/core/sock_reuseport.c index f3ceec93f392..40829111fe00 100644 --- a/net/core/sock_reuseport.c +++ b/net/core/sock_reuseport.c @@ -112,6 +112,7 @@ static struct sock_reuseport *reuseport_grow(struct sock_reuseport *reuse) more_reuse->prog = reuse->prog; more_reuse->reuseport_id = reuse->reuseport_id; more_reuse->bind_inany = reuse->bind_inany; + more_reuse->has_conns = reuse->has_conns; memcpy(more_reuse->socks, reuse->socks, reuse->num_socks * sizeof(struct sock *)); From df89c1ee034ce11fa14dbbfe53d5b91ce70de5a6 Mon Sep 17 00:00:00 2001 From: Kuniyuki Iwashima Date: Tue, 21 Jul 2020 15:15:31 +0900 Subject: [PATCH 23/31] udp: Improve load balancing for SO_REUSEPORT. [ Upstream commit efc6b6f6c3113e8b203b9debfb72d81e0f3dcace ] Currently, SO_REUSEPORT does not work well if connected sockets are in a UDP reuseport group. Then reuseport_has_conns() returns true and the result of reuseport_select_sock() is discarded. Also, unconnected sockets have the same score, hence only does the first unconnected socket in udp_hslot always receive all packets sent to unconnected sockets. So, the result of reuseport_select_sock() should be used for load balancing. The noteworthy point is that the unconnected sockets placed after connected sockets in sock_reuseport.socks will receive more packets than others because of the algorithm in reuseport_select_sock(). index | connected | reciprocal_scale | result --------------------------------------------- 0 | no | 20% | 40% 1 | no | 20% | 20% 2 | yes | 20% | 0% 3 | no | 20% | 40% 4 | yes | 20% | 0% If most of the sockets are connected, this can be a problem, but it still works better than now. Fixes: acdcecc61285 ("udp: correct reuseport selection with connected sockets") CC: Willem de Bruijn Reviewed-by: Benjamin Herrenschmidt Signed-off-by: Kuniyuki Iwashima Acked-by: Willem de Bruijn Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/ipv4/udp.c | 15 +++++++++------ net/ipv6/udp.c | 15 +++++++++------ 2 files changed, 18 insertions(+), 12 deletions(-) diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c index b3320e42cbcb..5d016bbdf16e 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -413,7 +413,7 @@ static struct sock *udp4_lib_lookup2(struct net *net, struct udp_hslot *hslot2, struct sk_buff *skb) { - struct sock *sk, *result; + struct sock *sk, *result, *reuseport_result; int score, badness; u32 hash = 0; @@ -423,17 +423,20 @@ static struct sock *udp4_lib_lookup2(struct net *net, score = compute_score(sk, net, saddr, sport, daddr, hnum, dif, sdif); if (score > badness) { + reuseport_result = NULL; + if (sk->sk_reuseport && sk->sk_state != TCP_ESTABLISHED) { hash = udp_ehashfn(net, daddr, hnum, saddr, sport); - result = reuseport_select_sock(sk, hash, skb, - sizeof(struct udphdr)); - if (result && !reuseport_has_conns(sk, false)) - return result; + reuseport_result = reuseport_select_sock(sk, hash, skb, + sizeof(struct udphdr)); + if (reuseport_result && !reuseport_has_conns(sk, false)) + return reuseport_result; } + + result = reuseport_result ? : sk; badness = score; - result = sk; } } return result; diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c index ede3bed354a8..6762430280f5 100644 --- a/net/ipv6/udp.c +++ b/net/ipv6/udp.c @@ -148,7 +148,7 @@ static struct sock *udp6_lib_lookup2(struct net *net, int dif, int sdif, struct udp_hslot *hslot2, struct sk_buff *skb) { - struct sock *sk, *result; + struct sock *sk, *result, *reuseport_result; int score, badness; u32 hash = 0; @@ -158,17 +158,20 @@ static struct sock *udp6_lib_lookup2(struct net *net, score = compute_score(sk, net, saddr, sport, daddr, hnum, dif, sdif); if (score > badness) { + reuseport_result = NULL; + if (sk->sk_reuseport && sk->sk_state != TCP_ESTABLISHED) { hash = udp6_ehashfn(net, daddr, hnum, saddr, sport); - result = reuseport_select_sock(sk, hash, skb, - sizeof(struct udphdr)); - if (result && !reuseport_has_conns(sk, false)) - return result; + reuseport_result = reuseport_select_sock(sk, hash, skb, + sizeof(struct udphdr)); + if (reuseport_result && !reuseport_has_conns(sk, false)) + return reuseport_result; } - result = sk; + + result = reuseport_result ? : sk; badness = score; } } From 59242fa1d2ba07a0748740aa63c64bfb6841639e Mon Sep 17 00:00:00 2001 From: Peng Fan Date: Fri, 13 Mar 2020 09:58:07 +0800 Subject: [PATCH 24/31] regmap: debugfs: check count when read regmap file commit 74edd08a4fbf51d65fd8f4c7d8289cd0f392bd91 upstream. When executing the following command, we met kernel dump. dmesg -c > /dev/null; cd /sys; for i in `ls /sys/kernel/debug/regmap/* -d`; do echo "Checking regmap in $i"; cat $i/registers; done && grep -ri "0x02d0" *; It is because the count value is too big, and kmalloc fails. So add an upper bound check to allow max size `PAGE_SIZE << (MAX_ORDER - 1)`. Signed-off-by: Peng Fan Link: https://lore.kernel.org/r/1584064687-12964-1-git-send-email-peng.fan@nxp.com Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman --- drivers/base/regmap/regmap-debugfs.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c index e16afa27700d..f58baff2be0a 100644 --- a/drivers/base/regmap/regmap-debugfs.c +++ b/drivers/base/regmap/regmap-debugfs.c @@ -227,6 +227,9 @@ static ssize_t regmap_read_debugfs(struct regmap *map, unsigned int from, if (*ppos < 0 || !count) return -EINVAL; + if (count > (PAGE_SIZE << (MAX_ORDER - 1))) + count = PAGE_SIZE << (MAX_ORDER - 1); + buf = kmalloc(count, GFP_KERNEL); if (!buf) return -ENOMEM; @@ -371,6 +374,9 @@ static ssize_t regmap_reg_ranges_read_file(struct file *file, if (*ppos < 0 || !count) return -EINVAL; + if (count > (PAGE_SIZE << (MAX_ORDER - 1))) + count = PAGE_SIZE << (MAX_ORDER - 1); + buf = kmalloc(count, GFP_KERNEL); if (!buf) return -ENOMEM; From 4918285a6c7ddf0e3bbda163314030c3642dd08f Mon Sep 17 00:00:00 2001 From: zhuguangqing Date: Mon, 9 Dec 2019 17:35:23 +0800 Subject: [PATCH 25/31] PM: wakeup: Show statistics for deleted wakeup sources again commit e976eb4b91e906f20ec25b20c152d53c472fc3fd upstream. After commit 00ee22c28915 (PM / wakeup: Use seq_open() to show wakeup stats), print_wakeup_source_stats(m, &deleted_ws) is not called from wakeup_sources_stats_seq_show() any more. Because deleted_ws is one of the wakeup sources, it should be shown too, so add it to the end of all other wakeup sources. Signed-off-by: zhuguangqing [ rjw: Subject & changelog ] Signed-off-by: Rafael J. Wysocki Signed-off-by: Florian Fainelli Signed-off-by: Greg Kroah-Hartman --- drivers/base/power/wakeup.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c index 0bd9b291bb29..92f0960e9014 100644 --- a/drivers/base/power/wakeup.c +++ b/drivers/base/power/wakeup.c @@ -1073,6 +1073,9 @@ static void *wakeup_sources_stats_seq_next(struct seq_file *m, break; } + if (!next_ws) + print_wakeup_source_stats(m, &deleted_ws); + return next_ws; } From 909dbf09cd018ab6ddd853f23061394d437777a6 Mon Sep 17 00:00:00 2001 From: Vladimir Oltean Date: Wed, 24 Jun 2020 15:45:17 +0300 Subject: [PATCH 26/31] Revert "dpaa_eth: fix usage as DSA master, try 3" This reverts commit 40a904b1c2e57b22dd002dfce73688871cb0bac8. The patch is not wrong, but the Fixes: tag is. It should have been: Fixes: 060ad66f9795 ("dpaa_eth: change DMA device") which means that it's fixing a commit which was introduced in: git tag --contains 060ad66f97954 v5.5 which then means it should have not been backported to linux-5.4.y, where things _were_ working and now they're not. Reported-by: Joakim Tjernlund Signed-off-by: Vladimir Oltean Signed-off-by: Greg Kroah-Hartman --- drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c index cd9d08695cc1..00c4beb760c3 100644 --- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c @@ -2802,7 +2802,7 @@ static int dpaa_eth_probe(struct platform_device *pdev) } /* Do this here, so we can be verbose early */ - SET_NETDEV_DEV(net_dev, dev->parent); + SET_NETDEV_DEV(net_dev, dev); dev_set_drvdata(dev, net_dev); priv = netdev_priv(net_dev); From 169b93899c7dfb93a2b57da8e3505da9b2afcf5c Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 31 Jul 2020 18:39:32 +0200 Subject: [PATCH 27/31] Linux 5.4.55 Signed-off-by: Greg Kroah-Hartman --- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile b/Makefile index ea711f30de29..072fe0eaa740 100644 --- a/Makefile +++ b/Makefile @@ -1,7 +1,7 @@ # SPDX-License-Identifier: GPL-2.0 VERSION = 5 PATCHLEVEL = 4 -SUBLEVEL = 54 +SUBLEVEL = 55 EXTRAVERSION = NAME = Kleptomaniac Octopus From fc1058d29350107ce6721de944c53d8a96464c57 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 31 Jul 2020 18:48:41 +0200 Subject: [PATCH 28/31] ANDROID: GKI: remove symbols from sunxi for uas driver The driver is built into the kernel image, no need to list them here anymore. Bug: 157965270 Signed-off-by: Greg Kroah-Hartman Change-Id: Ie270cf7edf65fe866712e71bf8c4932c1d6cb3f2 --- android/abi_gki_aarch64_sunxi | 14 -------------- 1 file changed, 14 deletions(-) diff --git a/android/abi_gki_aarch64_sunxi b/android/abi_gki_aarch64_sunxi index d8b8c1998f29..81091a19b7a6 100644 --- a/android/abi_gki_aarch64_sunxi +++ b/android/abi_gki_aarch64_sunxi @@ -39,20 +39,6 @@ iommu_group_alloc iommu_group_register_notifier -# required by uas.ko - int_to_scsilun - scmd_printk - scsi_block_requests - scsi_change_queue_depth - scsi_print_command - scsi_unblock_requests - usb_alloc_streams - usb_free_streams - usb_kill_anchored_urbs - usb_unanchor_urb - usb_wait_anchor_empty_timeout - usb_set_interface - # required by ums-realtek.ko usb_bulk_msg From 59fd4b22d794c74804196be352969a20c3a935e0 Mon Sep 17 00:00:00 2001 From: Todd Kjos Date: Fri, 31 Jul 2020 19:07:52 +0000 Subject: [PATCH 29/31] Revert "ANDROID: GKI: Enable CONFIG_USB_DWC3" This reverts commit 91632070d01948566aa8b05acb9357a2a8c17f78. Reason for revert: Breaks downstream partners Bug: 162570532 Change-Id: Ifa109eacbcd8da7b7e3ca93500957907451ce3f6 Signed-off-by: Todd Kjos --- arch/arm64/configs/gki_defconfig | 1 - arch/x86/configs/gki_defconfig | 1 - 2 files changed, 2 deletions(-) diff --git a/arch/arm64/configs/gki_defconfig b/arch/arm64/configs/gki_defconfig index 26dd42c286ba..976cd97dfaba 100644 --- a/arch/arm64/configs/gki_defconfig +++ b/arch/arm64/configs/gki_defconfig @@ -383,7 +383,6 @@ CONFIG_USB_EHCI_HCD=y CONFIG_USB_EHCI_HCD_PLATFORM=y CONFIG_USB_STORAGE=y CONFIG_USB_UAS=y -CONFIG_USB_DWC3=y CONFIG_USB_GADGET=y CONFIG_USB_DUMMY_HCD=y CONFIG_USB_CONFIGFS=y diff --git a/arch/x86/configs/gki_defconfig b/arch/x86/configs/gki_defconfig index 9467df156b89..6e31f9849f67 100644 --- a/arch/x86/configs/gki_defconfig +++ b/arch/x86/configs/gki_defconfig @@ -339,7 +339,6 @@ CONFIG_USB_EHCI_HCD=y CONFIG_USB_EHCI_HCD_PLATFORM=y CONFIG_USB_STORAGE=y CONFIG_USB_UAS=y -CONFIG_USB_DWC3=y CONFIG_USB_GADGET=y CONFIG_USB_DUMMY_HCD=y CONFIG_USB_CONFIGFS=y From 763a90d27e950440d4192bdd08f639b2256ccdab Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sat, 1 Aug 2020 11:40:18 +0200 Subject: [PATCH 30/31] ANDROID: GKI: fix up abi definition files Something went wrong with TH and it was not catching these changes over the past few days :( So update the abi definition files. These changes are due to a number of different previous commits for config option requests by partners. Leaf changes summary: 108 artifacts changed (14 filtered out) Changed leaf types summary: 2 (1 filtered out) leaf types changed Removed/Changed/Added functions summary: 0 Removed, 105 Changed (13 filtered out), 0 Added function Removed/Changed/Added variables summary: 0 Removed, 1 Changed, 0 Added variable 105 functions with some sub-type change: 1 Changed variable: [C] 'const v4l2_subdev_ops v4l2_subdev_call_wrappers' was changed at v4l2-subdev.c:321:1: CRC value (modversions) changed from 0x58d0c3c0 to 0xc38e0511 'struct dma_buf at dma-buf.h:382:1' changed: type size changed from 1984 to 2048 (in bits) 1 data member insertion: 'spinlock_t dma_buf::name_lock', at offset 832 (in bits) at dma-buf.h:392:1 there are data member changes: 'module* dma_buf::owner' offset changed from 832 to 896 (in bits) (by +64 bits) 'list_head dma_buf::list_node' offset changed from 896 to 960 (in bits) (by +64 bits) 'void* dma_buf::priv' offset changed from 1024 to 1088 (in bits) (by +64 bits) 'dma_resv* dma_buf::resv' offset changed from 1088 to 1152 (in bits) (by +64 bits) 'wait_queue_head_t dma_buf::poll' offset changed from 1152 to 1216 (in bits) (by +64 bits) 'dma_buf_poll_cb_t dma_buf::cb_excl' offset changed from 1344 to 1408 (in bits) (by +64 bits) 'dma_buf_poll_cb_t dma_buf::cb_shared' offset changed from 1664 to 1728 (in bits) (by +64 bits) 87 impacted interfaces 'struct v4l2_subdev_fh at v4l2-subdev.h:906:1' changed: type size changed from 1216 to 1280 (in bits) 1 data member insertion: 'v4l2_subdev_pad_config* v4l2_subdev_fh::pad', at offset 1216 (in bits) at v4l2-subdev.h:910:1 14 impacted interfaces Bug: 161946584 Signed-off-by: Greg Kroah-Hartman Change-Id: I0d1b931cbfbcfe938360f71d1d34ca6d10347bfb --- android/abi_gki_aarch64.xml | 2514 ++++++++++++++++++----------------- 1 file changed, 1279 insertions(+), 1235 deletions(-) diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml index 84154e5670d3..b6c4d207f0e3 100644 --- a/android/abi_gki_aarch64.xml +++ b/android/abi_gki_aarch64.xml @@ -104,7 +104,7 @@ - + @@ -226,7 +226,7 @@ - + @@ -921,8 +921,8 @@ - - + + @@ -967,25 +967,25 @@ - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + @@ -1213,37 +1213,37 @@ - - + + - - - - - - - - - - - - - - + + + + + + + + + + + + + + - - - - - - - - - - - - - + + + + + + + + + + + + + @@ -1327,7 +1327,7 @@ - + @@ -1773,7 +1773,6 @@ - @@ -1820,14 +1819,14 @@ - - - - - - - - + + + + + + + + @@ -2612,22 +2611,22 @@ - + - - - - + + + + - - - + + + - - + + - + @@ -2887,24 +2886,21 @@ - - - - + + + + - - - @@ -2916,7 +2912,6 @@ - @@ -2924,7 +2919,6 @@ - @@ -3011,13 +3005,13 @@ - + - + @@ -3626,7 +3620,6 @@ - @@ -3673,7 +3666,6 @@ - @@ -3712,7 +3704,6 @@ - @@ -3746,11 +3737,9 @@ - - @@ -3803,15 +3792,15 @@ - - - - - - - - - + + + + + + + + + @@ -3827,17 +3816,17 @@ - - + + - - - + + + - - - - + + + + @@ -3851,23 +3840,23 @@ - - - - - - - - - - - - - + + + + + + + + + + + + + - - - + + + @@ -3888,12 +3877,12 @@ - - - - + + + + - + @@ -3953,7 +3942,7 @@ - + @@ -4154,7 +4143,7 @@ - + @@ -14975,7 +14964,6 @@ - @@ -14984,6 +14972,14 @@ + + + + + + + + @@ -16540,7 +16536,7 @@ - + @@ -21575,6 +21571,17 @@ + + + + + + + + + + + @@ -21673,47 +21680,8 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - @@ -22138,6 +22106,17 @@ + + + + + + + + + + + @@ -22286,7 +22265,7 @@ - + @@ -22344,7 +22323,7 @@ - + @@ -23514,7 +23493,7 @@ - + @@ -24309,7 +24288,7 @@ - + @@ -26091,8 +26070,14 @@ + + + + + + @@ -26109,6 +26094,11 @@ + + + + + @@ -26707,6 +26697,10 @@ + + + + @@ -27568,55 +27562,55 @@ - - - + + + - - - - - + + + + + - - - + + + - - - - - + + + + + - - - + + + - - - - + + + + - - - - + + + + - - - + + + - - - + + + @@ -28024,6 +28018,18 @@ + + + + + + + + + + + + @@ -28857,13 +28863,13 @@ - + - + @@ -29954,7 +29960,6 @@ - @@ -30011,7 +30016,7 @@ - + @@ -30246,7 +30251,7 @@ - + @@ -30544,7 +30549,7 @@ - + @@ -33158,7 +33163,7 @@ - + @@ -33665,7 +33670,7 @@ - + @@ -33937,7 +33942,7 @@ - + @@ -35013,7 +35018,7 @@ - + @@ -35097,7 +35102,7 @@ - + @@ -35143,8 +35148,9 @@ - + + @@ -35170,7 +35176,7 @@ - + @@ -35184,12 +35190,6 @@ - - - - - - @@ -35259,14 +35259,6 @@ - - - - - - - - @@ -35305,7 +35297,7 @@ - + @@ -35400,7 +35392,7 @@ - + @@ -35440,7 +35432,7 @@ - + @@ -35773,23 +35765,6 @@ - - - - - - - - - - - - - - - - - @@ -36304,6 +36279,14 @@ + + + + + + + + @@ -36357,27 +36340,27 @@ - + - + - + - + - + - + - + - + @@ -36417,7 +36400,7 @@ - + @@ -36428,7 +36411,7 @@ - + @@ -36445,7 +36428,7 @@ - + @@ -36465,23 +36448,23 @@ - + - + - + - + @@ -37066,7 +37049,7 @@ - + @@ -37976,128 +37959,128 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -38114,8 +38097,9 @@ + - + @@ -38206,32 +38190,32 @@ - + - + - + - + - + - + - + - + - + - + @@ -38259,7 +38243,7 @@ - + @@ -38285,18 +38269,18 @@ - + - + - + @@ -38394,11 +38378,11 @@ - + - + @@ -39908,7 +39892,7 @@ - + @@ -39927,7 +39911,7 @@ - + @@ -40600,6 +40584,11 @@ + + + + + @@ -40628,6 +40617,11 @@ + + + + + @@ -41202,7 +41196,7 @@ - + @@ -41219,7 +41213,7 @@ - + @@ -41819,7 +41813,7 @@ - + @@ -44460,7 +44454,7 @@ - + @@ -44475,7 +44469,7 @@ - + @@ -46284,20 +46278,23 @@ - + + + + - + @@ -46313,7 +46310,7 @@ - + @@ -48925,7 +48922,7 @@ - + @@ -50069,7 +50066,7 @@ - + @@ -50456,7 +50453,7 @@ - + @@ -50728,7 +50725,7 @@ - + @@ -50890,6 +50887,8 @@ + + @@ -50923,6 +50922,9 @@ + + + @@ -51030,7 +51032,7 @@ - + @@ -51492,7 +51494,7 @@ - + @@ -51505,6 +51507,25 @@ + + + + + + + + + + + + + + + + + + + @@ -51512,7 +51533,7 @@ - + @@ -51520,15 +51541,12 @@ - + - + - - - - + @@ -51558,6 +51576,17 @@ + + + + + + + + + + + @@ -52072,7 +52101,7 @@ - + @@ -53413,6 +53442,25 @@ + + + + + + + + + + + + + + + + + + + @@ -53429,7 +53477,7 @@ - + @@ -53765,7 +53813,7 @@ - + @@ -55627,7 +55675,7 @@ - + @@ -56170,7 +56218,7 @@ - + @@ -56200,7 +56248,7 @@ - + @@ -56664,7 +56712,7 @@ - + @@ -60960,7 +61008,7 @@ - + @@ -61011,7 +61059,7 @@ - + @@ -61300,7 +61348,7 @@ - + @@ -61533,6 +61581,35 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -62931,6 +63008,35 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -62953,6 +63059,13 @@ + + + + + + + @@ -62975,8 +63088,8 @@ - - + + @@ -63071,13 +63184,13 @@ - - + + - - - + + + @@ -63088,6 +63201,30 @@ + + + + + + + + + + + + + + + + + + + + + + + + @@ -63174,43 +63311,7 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - @@ -63283,30 +63384,6 @@ - - - - - - - - - - - - - - - - - - - - - - - - @@ -64489,64 +64566,64 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -65883,6 +65960,10 @@ + + + + @@ -66126,10 +66207,10 @@ - + - + @@ -66410,6 +66491,20 @@ + + + + + + + + + + + + + + @@ -67281,6 +67376,7 @@ + @@ -67435,7 +67531,7 @@ - + @@ -67451,7 +67547,7 @@ - + @@ -69078,10 +69174,10 @@ - + - + @@ -70540,7 +70636,7 @@ - + @@ -70549,7 +70645,7 @@ - + @@ -71070,7 +71166,7 @@ - + @@ -71099,36 +71195,39 @@ - + - + - - + + - + - + - - + + - - + + + + + - + - + - + - + @@ -71148,7 +71247,7 @@ - + @@ -71195,7 +71294,7 @@ - + @@ -71206,27 +71305,27 @@ - + - + - + - + - + - + - + - + @@ -71455,7 +71554,7 @@ - + @@ -72750,7 +72849,7 @@ - + @@ -72771,7 +72870,7 @@ - + @@ -75600,6 +75699,13 @@ + + + + + + + @@ -75608,6 +75714,10 @@ + + + + @@ -76214,162 +76324,6 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - @@ -78958,7 +78912,7 @@ - + @@ -79159,12 +79113,25 @@ + + + + + + + + + + + + + @@ -79242,6 +79209,7 @@ + @@ -79385,6 +79353,41 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -79788,6 +79791,7 @@ + @@ -79825,6 +79829,7 @@ + @@ -79842,6 +79847,17 @@ + + + + + + + + + + + @@ -79974,7 +79990,7 @@ - + @@ -80143,6 +80159,18 @@ + + + + + + + + + + + + @@ -80151,39 +80179,17 @@ + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - @@ -80205,32 +80211,10 @@ - - - - - - - - - - - - - - - - - - - - - - @@ -80247,31 +80231,10 @@ - - - - - - - - - - - - - - - - - - - - - @@ -80281,15 +80244,6 @@ - - - - - - - - - @@ -80316,11 +80270,6 @@ - - - - - @@ -82598,6 +82547,23 @@ + + + + + + + + + + + + + + + + + @@ -82761,7 +82727,7 @@ - + @@ -82780,7 +82746,7 @@ - + @@ -83282,14 +83248,6 @@ - - - - - - - - @@ -83528,7 +83486,6 @@ - @@ -83929,20 +83886,6 @@ - - - - - - - - - - - - - - @@ -84324,10 +84267,10 @@ - + - + @@ -84577,7 +84520,7 @@ - + @@ -84679,7 +84622,7 @@ - + @@ -84975,7 +84918,7 @@ - + @@ -84995,7 +84938,7 @@ - + @@ -85140,14 +85083,6 @@ - - - - - - - - @@ -86517,8 +86452,6 @@ - - @@ -87847,49 +87780,6 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - @@ -88480,7 +88370,7 @@ - + @@ -89255,7 +89145,7 @@ - + @@ -89355,7 +89245,7 @@ - + @@ -90782,7 +90672,7 @@ - + @@ -90806,7 +90696,7 @@ - + @@ -91406,51 +91296,51 @@ - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -91476,33 +91366,33 @@ - + - + - + - + - + - + - + - + - + - + @@ -97165,7 +97055,7 @@ - + @@ -97531,7 +97421,7 @@ - + @@ -97584,7 +97474,6 @@ - @@ -98219,12 +98108,6 @@ - - - - - - @@ -98503,7 +98386,7 @@ - + @@ -98611,7 +98494,7 @@ - + @@ -100335,6 +100218,10 @@ + + + + @@ -100759,8 +100646,6 @@ - - @@ -100910,7 +100795,7 @@ - + @@ -100921,7 +100806,7 @@ - + @@ -100999,7 +100884,7 @@ - + @@ -101016,28 +100901,6 @@ - - - - - - - - - - - - - - - - - - - - - - @@ -101255,7 +101118,50 @@ - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -101274,6 +101180,25 @@ + + + + + + + + + + + + + + + + + + + @@ -101376,7 +101301,7 @@ - + @@ -101465,7 +101390,7 @@ - + @@ -101483,10 +101408,10 @@ - + - + @@ -101567,15 +101492,15 @@ - - - - - + + + + + - - + + @@ -101620,23 +101545,6 @@ - - - - - - - - - - - - - - - - - @@ -101788,15 +101696,7 @@ - - - - - - - - - + @@ -102050,7 +101950,7 @@ - + @@ -102075,17 +101975,6 @@ - - - - - - - - - - - @@ -102576,39 +102465,6 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - @@ -102938,25 +102794,6 @@ - - - - - - - - - - - - - - - - - - - @@ -103039,6 +102876,20 @@ + + + + + + + + + + + + + + @@ -103677,7 +103528,7 @@ - + @@ -103740,7 +103591,7 @@ - + @@ -104324,15 +104175,7 @@ - - - - - - - - - + @@ -104351,22 +104194,6 @@ - - - - - - - - - - - - - - - - @@ -104543,6 +104370,49 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -104568,7 +104438,7 @@ - + @@ -105266,7 +105136,7 @@ - + @@ -105288,7 +105158,7 @@ - + @@ -105321,6 +105191,25 @@ + + + + + + + + + + + + + + + + + + + @@ -106341,7 +106230,7 @@ - + @@ -106351,7 +106240,7 @@ - + @@ -107057,7 +106946,7 @@ - + @@ -107135,84 +107024,6 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - @@ -107235,7 +107046,7 @@ - + @@ -107248,9 +107059,9 @@ - - - + + + @@ -107305,25 +107116,6 @@ - - - - - - - - - - - - - - - - - - - @@ -108449,10 +108241,10 @@ - + - + @@ -108816,6 +108608,17 @@ + + + + + + + + + + + @@ -108896,7 +108699,36 @@ - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -108925,10 +108757,10 @@ - + - + @@ -108936,7 +108768,7 @@ - + @@ -108950,6 +108782,7 @@ + @@ -108960,18 +108793,7 @@ - - - - - - - - - - - - + @@ -108979,7 +108801,7 @@ - + @@ -109118,23 +108940,12 @@ - - - - - - - - - - - - + - + @@ -109149,7 +108960,7 @@ - + @@ -109247,7 +109058,7 @@ - + @@ -109355,17 +109166,6 @@ - - - - - - - - - - - @@ -109475,6 +109275,17 @@ + + + + + + + + + + + @@ -109483,7 +109294,7 @@ - + @@ -109886,6 +109697,128 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -109995,7 +109928,7 @@ - + @@ -110296,7 +110229,7 @@ - + @@ -111459,9 +111392,9 @@ - + - + @@ -111470,7 +111403,26 @@ - + + + + + + + + + + + + + + + + + + + + @@ -111489,10 +111441,10 @@ - + - + @@ -112102,10 +112054,10 @@ - + - + @@ -113050,7 +113002,7 @@ - + @@ -113062,7 +113014,7 @@ - + @@ -114576,7 +114528,7 @@ - + @@ -114584,15 +114536,96 @@ - + - + - + + + + + + - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -115408,19 +115441,19 @@ - + - + - + - + - + @@ -115452,12 +115485,12 @@ - + - + @@ -115468,7 +115501,7 @@ - + @@ -115482,7 +115515,7 @@ - + @@ -115539,10 +115572,10 @@ - + - + @@ -116270,6 +116303,17 @@ + + + + + + + + + + + @@ -116284,13 +116328,13 @@ - + - + @@ -116414,7 +116458,7 @@ - + @@ -117211,7 +117255,7 @@ - + @@ -117223,10 +117267,10 @@ - + - + @@ -117243,7 +117287,7 @@ - + @@ -117254,7 +117298,7 @@ - + @@ -117271,7 +117315,7 @@ - + @@ -117288,7 +117332,7 @@ - + @@ -117297,15 +117341,15 @@ - + - + - + @@ -117314,7 +117358,7 @@ - + @@ -117330,7 +117374,7 @@ - + @@ -117439,13 +117483,13 @@ - + - + @@ -117930,8 +117974,8 @@ - - + + @@ -117940,24 +117984,24 @@ - - - - + + + + - - - - + + + + - - - - - - + + + + + + @@ -119196,7 +119240,7 @@ - + @@ -119401,10 +119445,10 @@ - + - + @@ -119423,10 +119467,10 @@ - + - + @@ -120274,7 +120318,7 @@ - + @@ -121474,11 +121518,11 @@ - - - - - + + + + + From b1f8486a62b6d676c0993c68ada3029599aef846 Mon Sep 17 00:00:00 2001 From: Chris Lew Date: Sat, 1 Aug 2020 09:47:54 -0700 Subject: [PATCH 31/31] Revert "qrtr: orphan socket in qrtr_release()" This reverts commit b7d3d6df72a85552a4c6f3a8e5611a7847425314. This is a preparation change for merging android11-5.4.55 into msm-5.4 branch. Equivalent change was already merged into downstream via: 0d116bcb6a net: qrtr: Detach socket from sock during release Change-Id: Ic028abd16de40c7e0b93ec7f6cf45303103eb087 Signed-off-by: Blagovest Kolenichev --- net/qrtr/qrtr.c | 1 - 1 file changed, 1 deletion(-) diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c index 1ce1e710d025..14c101e104ce 100644 --- a/net/qrtr/qrtr.c +++ b/net/qrtr/qrtr.c @@ -1004,7 +1004,6 @@ static int qrtr_release(struct socket *sock) sk->sk_state_change(sk); sock_set_flag(sk, SOCK_DEAD); - sock_orphan(sk); sock->sk = NULL; if (!sock_flag(sk, SOCK_ZAPPED))