mirror of
https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git
synced 2026-10-05 19:31:57 -04:00
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Tashfin Shakeer Rhythm
|
69c7394469 |
tcp: fix an incorrect __user annotation on tcp_use_userconfig_sysctl_handler
No user pointers for sysctls anymore.
Fixes: c3f877ec98a12 ("BACKPORT: sysctl: pass kernel pointers to ->proc_handler")
Change-Id: Ia9c27a7308aad6fb9b6476f1000d2588d0367014
Signed-off-by: Tashfin Shakeer Rhythm <tashfinshakeerrhythm@gmail.com>
|
||
|
Tashfin Shakeer Rhythm
|
a1535b0667 |
tcp: fix an incorrect __user annotation on tcp_proc_delayed_ack_control
No user pointers for sysctls anymore.
Fixes: c3f877ec98a12 ("BACKPORT: sysctl: pass kernel pointers to ->proc_handler")
Change-Id: Ie7d47a3bb5ed4238cea83a493937f38a3fee2571
Signed-off-by: Tashfin Shakeer Rhythm <tashfinshakeerrhythm@gmail.com>
|
||
Michael Bestas
|
1df27edaaf |
Revert "wifi: cfg80211: Increase akm_suites array size in"
This reverts commit
|
||
|
Michael Bestas
|
9f0d3e60bc |
Merge tag 'LA.UM.9.14.1.r1-21100-QCM6490.QISI15.0' of https://git.codelinaro.org/clo/la/kernel/msm-5.4 into android13-5.4-lahaina
LA.UM.9.14.1.r1-21100-QCM6490.QISI15.0 * tag 'LA.UM.9.14.1.r1-21100-QCM6490.QISI15.0' of https://git.codelinaro.org/clo/la/kernel/msm-5.4: msm:kgsl: Prevent sign extension on alignments reverting all USB patches msm: eva: OOB write issue in fence processing kgsl: gmu: Use num_vma for safe GMU VMAs array access net: Add netdevice notification for bridge activity bridge: port structure members from 5.4 kernel net: bridge: Fix for co-located mode UPSTREAM: usb: gadget: configfs: Add frame-based frame format support kgsl: Add buffer overflow check for perfcounter dynamic list usb: gadget: uvc: Add grey and I420 YUV UVC format support mtd: msm_qpic_nand: Use flash device ECC capability for erase page mtd: msm_qpic_nand: check for page_erased bit along with op_err UPSTREAM: usb: dwc3: Wait for EndXfer command completion netfilter: fix NATTYPE refresh timeout issue usb: gadget: uvc: Modify UVC_NUM_REQUESTS reverting enum-conversion, Handle CPU state and all USB patches msm: cvp: Fix for kernel address exposure vulnerability to user cnss: Init reserved memory device cnss: Dump stack by stack_trace_print cnss: Add support for building CNSS as a loadable module FROMLIST: media: venus: Add a check for packet size Add configures to enable CNSS platform driver FROMLIST: media: venus: Fix OOB read due to missing payload bound check dma-mapping-fast: Fix PMD offset calculation for non-2M aligned start aperture crypto: qcedev - fix UAF in crypto-qti driver msm: adsprpc: Prevent refcount increment for duplicate dmahandles dmaengine: msm_gpi: fix to avoid null pointer access mdm: ipa3: support IPoGRE new IOCTL and proc params msm: mhi_dev: Workqueue to handle host wakeup in M3+D0 iommu: Fix invalid access in av8l_fast_unmap_public msm: mhi_dev: Handle host wakeup in M3/D0 msm: ep_pcie: Wake host in D3cold handling if wake is pending FROMGIT: media: venus: hfi: add a check to handle OOB in sfr region FROMGIT: media: venus: hfi: add check to handle incorrect queue size FROMGIT: media: venus: hfi_parser: add check to avoid out of bound access Revert "msm_ipa: Install exception rule for PPPoE-MPLS" firmware: qcom_scm: do not clear dump mode from shutdown msm: adsprpc: Avoid taking reference for group_info adsprpc: Handle UAF scenario in put_args msm: eva: Adding kref count for cvp_get_inst_from_id wifi: cfg80211: Increase akm_suites array size in cfg80211_crypto_settings thermal: qcom: Add support to update tsens trip based on nvmem data Conflicts: Makefile arch/arm64/include/asm/cputype.h drivers/char/adsprpc.c drivers/hid/hid-ids.h drivers/net/usb/rtl8150.c drivers/platform/Kconfig drivers/platform/Makefile drivers/soc/qcom/mdt_loader.c drivers/soc/qcom/rpmh-rsc.c drivers/usb/core/quirks.c drivers/usb/dwc3/dwc3-qcom.c drivers/usb/dwc3/gadget.c drivers/usb/gadget/function/f_fs.c drivers/usb/gadget/function/f_ncm.c mm/slub.c mm/zsmalloc.c net/ipv4/tcp_output.c scripts/Makefile.extrawarn Change-Id: Ia4f3356ed4a105a2f3b0feda3e78725a01a970b2 |
||
Linux Build Service Account
|
2aeceac738 |
Merge f1b974d142 on remote branch
Change-Id: If973c515e7540989893d8e8f17039174b47453f0 |
||
Paul Chaignon
|
2ec8753738 |
UPSTREAM: net: Fix checksum update for ILA adj-transport
commit 6043b794c7668c19dabc4a93c75b924a19474d59 upstream.
During ILA address translations, the L4 checksums can be handled in
different ways. One of them, adj-transport, consist in parsing the
transport layer and updating any found checksum. This logic relies on
inet_proto_csum_replace_by_diff and produces an incorrect skb->csum when
in state CHECKSUM_COMPLETE.
This bug can be reproduced with a simple ILA to SIR mapping, assuming
packets are received with CHECKSUM_COMPLETE:
$ ip a show dev eth0
14: eth0@if15: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether 62:ae:35:9e:0f:8d brd ff:ff:ff:ff:ff:ff link-netnsid 0
inet6 3333:0:0:1::c078/64 scope global
valid_lft forever preferred_lft forever
inet6 fd00:10:244:1::c078/128 scope global nodad
valid_lft forever preferred_lft forever
inet6 fe80::60ae:35ff:fe9e:f8d/64 scope link proto kernel_ll
valid_lft forever preferred_lft forever
$ ip ila add loc_match fd00:10:244:1 loc 3333:0:0:1 \
csum-mode adj-transport ident-type luid dev eth0
Then I hit [fd00:10:244:1::c078]:8000 with a server listening only on
[3333:0:0:1::c078]:8000. With the bug, the SYN packet is dropped with
SKB_DROP_REASON_TCP_CSUM after inet_proto_csum_replace_by_diff changed
skb->csum. The translation and drop are visible on pwru [1] traces:
IFACE TUPLE FUNC
eth0:9 [fd00:10:244:3::3d8]:51420->[fd00:10:244:1::c078]:8000(tcp) ipv6_rcv
eth0:9 [fd00:10:244:3::3d8]:51420->[fd00:10:244:1::c078]:8000(tcp) ip6_rcv_core
eth0:9 [fd00:10:244:3::3d8]:51420->[fd00:10:244:1::c078]:8000(tcp) nf_hook_slow
eth0:9 [fd00:10:244:3::3d8]:51420->[fd00:10:244:1::c078]:8000(tcp) inet_proto_csum_replace_by_diff
eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) tcp_v6_early_demux
eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) ip6_route_input
eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) ip6_input
eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) ip6_input_finish
eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) ip6_protocol_deliver_rcu
eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) raw6_local_deliver
eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) ipv6_raw_deliver
eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) tcp_v6_rcv
eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) __skb_checksum_complete
eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) kfree_skb_reason(SKB_DROP_REASON_TCP_CSUM)
eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) skb_release_head_state
eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) skb_release_data
eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) skb_free_head
eth0:9 [fd00:10:244:3::3d8]:51420->[3333:0:0:1::c078]:8000(tcp) kfree_skbmem
This is happening because inet_proto_csum_replace_by_diff is updating
skb->csum when it shouldn't. The L4 checksum is updated such that it
"cancels" the IPv6 address change in terms of checksum computation, so
the impact on skb->csum is null.
Note this would be different for an IPv4 packet since three fields
would be updated: the IPv4 address, the IP checksum, and the L4
checksum. Two would cancel each other and skb->csum would still need
to be updated to take the L4 checksum change into account.
This patch fixes it by passing an ipv6 flag to
inet_proto_csum_replace_by_diff, to skip the skb->csum update if we're
in the IPv6 case. Note the behavior of the only other user of
inet_proto_csum_replace_by_diff, the BPF subsystem, is left as is in
this patch and fixed in the subsequent patch.
With the fix, using the reproduction from above, I can confirm
skb->csum is not touched by inet_proto_csum_replace_by_diff and the TCP
SYN proceeds to the application after the ILA translation.
Link: https://github.com/cilium/pwru [1]
Fixes:
|
||
Lorenz Bauer
|
fc9963be18 |
BACKPORT: net: sk_msg: Simplify sk_psock initialization
Initializing psock->sk_proto and other saved callbacks is only done in sk_psock_update_proto, after sk_psock_init has returned. The logic for this is difficult to follow, and needlessly complex. Instead, initialize psock->sk_proto whenever we allocate a new psock. Additionally, assert the following invariants: * The SK has no ULP: ULP does it's own finagling of sk->sk_prot * sk_user_data is unused: we need it to store sk_psock Protect our access to sk_user_data with sk_callback_lock, which is what other users like reuseport arrays, etc. do. The result is that an sk_psock is always fully initialized, and that psock->sk_proto is always the "original" struct proto. The latter allows us to use psock->sk_proto when initializing IPv6 TCP / UDP callbacks for sockmap. Change-Id: I4d3d18c6dfba2e72c125b946b2f036a17563e23b Signed-off-by: Lorenz Bauer <lmb@cloudflare.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: John Fastabend <john.fastabend@gmail.com> Link: https://lore.kernel.org/bpf/20200821102948.21918-2-lmb@cloudflare.com Signed-off-by: Tashfin Shakeer Rhythm <tashfinshakeerrhythm@gmail.com> |
||
YueHaibing
|
fcc0ffa7a3 |
UPSTREAM: bpf, tcp: Make tcp_bpf_recvmsg static
After commit f747632b608f ("bpf: sockmap: Move generic sockmap
hooks from BPF TCP"), tcp_bpf_recvmsg() is not used out of
tcp_bpf.c, so make it static and remove it from tcp.h. Also move
it to BPF_STREAM_PARSER #ifdef to fix unused function warnings.
Fixes: f747632b608f ("bpf: sockmap: Move generic sockmap hooks from BPF TCP")
Change-Id: I17bbfeb60955ae4f868944861dd5bc3c03ab9f71
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20200320023426.60684-3-yuehaibing@huawei.com
Signed-off-by: Tashfin Shakeer Rhythm <tashfinshakeerrhythm@gmail.com>
|
||
Cong Wang
|
5d7cd6bef6 |
BACKPORT: bpf: Clean up sockmap related Kconfigs
[ Upstream commit 887596095ec2a9ea39ffcf98f27bf2e77c5eb512 ] As suggested by John, clean up sockmap related Kconfigs: Reduce the scope of CONFIG_BPF_STREAM_PARSER down to TCP stream parser, to reflect its name. Make the rest sockmap code simply depend on CONFIG_BPF_SYSCALL and CONFIG_INET, the latter is still needed at this point because of TCP/UDP proto update. And leave CONFIG_NET_SOCK_MSG untouched, as it is used by non-sockmap cases. Change-Id: I92d53e4edb7c56a0b60a8c1eefb50fb16db4533f Signed-off-by: Cong Wang <cong.wang@bytedance.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Reviewed-by: Lorenz Bauer <lmb@cloudflare.com> Acked-by: John Fastabend <john.fastabend@gmail.com> Acked-by: Jakub Sitnicki <jakub@cloudflare.com> Link: https://lore.kernel.org/bpf/20210223184934.6054-2-xiyou.wangcong@gmail.com Stable-dep-of: 2660a544fdc0 ("net: Fix TOCTOU issue in sk_is_readable()") Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Tashfin Shakeer Rhythm <tashfinshakeerrhythm@gmail.com> |
||
|
Lorenz Bauer
|
c97a4fd857 |
UPSTREAM: bpf: Add sockmap hooks for UDP sockets
Add basic psock hooks for UDP sockets. This allows adding and removing sockets, as well as automatic removal on unhash and close. Change-Id: Id0e35e63672540015a1789d7b0cee7cc24c597ab Signed-off-by: Lorenz Bauer <lmb@cloudflare.com> Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: John Fastabend <john.fastabend@gmail.com> Link: https://lore.kernel.org/bpf/20200309111243.6982-8-lmb@cloudflare.com Signed-off-by: Tashfin Shakeer Rhythm <tashfinshakeerrhythm@gmail.com> |
||
Tobias Klauser
|
4934b0322d |
ipv6: ndisc: adjust ndisc_ifinfo_sysctl_change prototype
Commit 32927393dc1c ("sysctl: pass kernel pointers to ->proc_handler")
changed ndisc_ifinfo_sysctl_change to take a kernel pointer. Adjust its
prototype in net/ndisc.h as well to fix the following sparse warning:
net/ipv6/ndisc.c:1838:5: error: symbol 'ndisc_ifinfo_sysctl_change' redeclared with different type (incompatible argument 3 (different address spaces)):
net/ipv6/ndisc.c:1838:5: int extern [addressable] [signed] [toplevel] ndisc_ifinfo_sysctl_change( ... )
net/ipv6/ndisc.c: note: in included file (through include/net/ipv6.h):
./include/net/ndisc.h:496:5: note: previously declared as:
./include/net/ndisc.h:496:5: int extern [addressable] [signed] [toplevel] ndisc_ifinfo_sysctl_change( ... )
net/ipv6/ndisc.c: note: in included file (through include/net/ip6_route.h):
Fixes: 32927393dc1c ("sysctl: pass kernel pointers to ->proc_handler")
Cc: Christoph Hellwig <hch@lst.de>
Change-Id: I980874a277dca1eec7d701bd28ce027e112dfd79
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Tashfin Shakeer Rhythm <tashfinshakeerrhythm@gmail.com>
|
||
Christoph Hellwig
|
02eeb85efb |
net/sysctl: remove leftover __user annotations on neigh_proc_dointvec*
Remove the leftover __user annotation on the prototypes for
neigh_proc_dointvec*. The implementations already got this right, but
the headers kept the __user tags around.
Fixes: 32927393dc1c ("sysctl: pass kernel pointers to ->proc_handler")
Reported-by: build test robot <lkp@intel.com>
Change-Id: I2c2d27a3f7939861dbf2ee89f98f57cbcf2c9234
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Tashfin Shakeer Rhythm <tashfinshakeerrhythm@gmail.com>
|
||
kamasali Satyanarayan
|
d4844f38c0 |
Merge android11-5.4.302(91d385eb) into msm-5.4
reverting all USB patches
Linux 5.4.302
Input: pegasus-notetaker - fix potential out-of-bounds access
Input: remove third argument of usb_maxpacket()
usb: deprecate the third argument of usb_maxpacket()
ata: libata-scsi: Fix system suspend for a security locked drive
fs/proc: fix uaf in proc_readdir_de()
pmdomain: imx: Fix reference count leak in imx_gpc_remove
pmdomain: arm: scmi: Fix genpd leak on provider registration failure
net: netpoll: fix incorrect refcount handling causing incorrect cleanup
net: qede: Initialize qede_ll_ops with designated initializer
uio_hv_generic: Set event for all channels on the device
net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error
ALSA: usb-audio: fix uac2 clock source at terminal parser
mm/page_alloc: fix hash table order logging in alloc_large_system_hash()
kconfig/nconf: Initialize the default locale at startup
kconfig/mconf: Initialize the default locale at startup
vsock: Ignore signal/timeout on connect() if already established
s390/ctcm: Fix double-kfree
net: openvswitch: remove never-working support for setting nsh fields
mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats()
MIPS: Malta: Fix !EVA SOC-it PCI MMIO
scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()
scsi: sg: Do not sleep in atomic context
Input: cros_ec_keyb - fix an invalid memory access
be2net: pass wrb_params in case of OS2BMC
HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155
isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe()
EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection
EDAC/altera: Handle OCRAM ECC enable after warm reset
spi: Try to get ACPI GPIO IRQ earlier
ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe
strparser: Fix signed/unsigned mismatch bug
gcov: add support for GCC 15
mm/ksm: fix flag-dropping behavior in ksm_madvise
ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd
drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE
ASoC: cs4271: Fix regulator leak on probe failure
regulator: fixed: fix GPIO descriptor leak on register failure
regulator: fixed: use dev_err_probe for register
Bluetooth: L2CAP: export l2cap_chan_hold for modules
net_sched: limit try_bulk_dequeue_skb() batches
net_sched: remove need_resched() from qdisc_run()
net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps
net/mlx5e: Fix maxrate wraparound in threshold between units
net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak
wifi: mac80211: skip rate verification for not captured PSDUs
net: mdio: fix resource leak in mdiobus_register_device()
tipc: Fix use-after-free in tipc_mon_reinit_self().
tipc: simplify the finalize work queue
sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto
sctp: get netns from asoc and ep base
Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions
Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion
Bluetooth: 6lowpan: reset link-local header on ipv6 recv path
Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF
net: fec: correct rx_bytes statistic for the case SHIFT16 is set
ASoC: max98090/91: fixed max98091 ALSA widget powering up/down
HID: quirks: avoid Cooler Master MM712 dongle wakeup bug
NFS4: Fix state renewals missing after boot
compiler_types: Move unused static inline functions warning to W=2
extcon: adc-jack: Cleanup wakeup source only if it was enabled
tracing: Fix memory leaks in create_field_var()
net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup
sctp: Prevent TOCTOU out-of-bounds write
sctp: Hold RCU read lock while iterating over address list
net: dsa: b53: stop reading ARL entries if search is done
net: dsa: b53: fix enabling ip multicast
net: dsa: b53: fix resetting speed and pause on forced link
net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325
net: dsa/b53: change b53_force_port_config() pause argument
net: vlan: sync VLAN features with lower device
ceph: add checking of wait_for_completion_killable() return value
fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
ACPI: property: Return present device nodes only on fwnode interface
9p: sysfs_init: don't hardcode error to ENOMEM
9p: fix /sys/fs/9p/caches overwriting itself
fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink
ACPICA: Update dsmethod.c to get rid of unused variable warning
orangefs: fix xattr related buffer overflow...
page_pool: Clamp pool size to max 16K pages
Bluetooth: bcsp: receive data only if registered
Bluetooth: SCO: Fix UAF on sco_conn_free
net: macb: avoid dealing with endianness in macb_set_hwaddr()
nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing
NFSv4.1: fix mount hang after CREATE_SESSION failure
NFSv4: handle ERR_GRACE on delegation recalls
remoteproc: qcom: q6v5: Avoid handling handover twice
sparc/module: Add R_SPARC_UA64 relocation handling
net: intel: fm10k: Fix parameter idx set but not used
jfs: fix uninitialized waitqueue in transaction manager
jfs: Verify inode mode when loading from disk
ipv6: np->rxpmtu race annotation
usb: xhci: plat: Facilitate using autosuspend for xhci plat devices
usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs
allow finish_no_open(file, ERR_PTR(-E...))
scsi: lpfc: Define size of debugfs entry for xri rebalancing
scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET
selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency
net/cls_cgroup: Fix task_get_classid() during qdisc run
selftests: Replace sleep with slowwait
selftests: Disable dad for ipv6 in fcnal-test.sh
media: redrat3: use int type to store negative error codes
net: sh_eth: Disable WoL if system can not suspend
phy: cadence: cdns-dphy: Enable lower resolutions in dphy
usb: gadget: f_hid: Fix zero length packet transfer
net: call cond_resched() less often in __release_sock()
ALSA: usb-audio: apply quirk for MOONDROP Quark2
net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms
dmaengine: dw-edma: Set status for callback_result
dmaengine: mv_xor: match alloc_wc and free_wc
dmaengine: sh: setup_xref error handling
scsi: pm8001: Use int instead of u32 to store error codes
mips: lantiq: xway: sysctrl: rename stp clock
mips: lantiq: danube: add missing device_type in pci node
mips: lantiq: danube: add missing properties to cpu node
media: fix uninitialized symbol warnings
drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption
extcon: adc-jack: Fix wakeup source leaks on device unbind
rds: Fix endianness annotation for RDS_MPATH_HASH
PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call
net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV.
net: When removing nexthops, don't call synchronize_net if it is not necessary
char: misc: Does not request module for miscdevice with dynamic minor
usb: gadget: f_ncm: Fix MAC assignment NCM ethernet
iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register
media: imon: make send_packet() more robust
net: ipv6: fix field-spanning memcpy warning in AH output
bridge: Redirect to backup port when port is administratively down
powerpc/eeh: Use result of error_detected() in uevent
x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall
media: pci: ivtv: Don't create fake v4l2_fh
drm/amdkfd: return -ENOTTY for unsupported IOCTLs
selftests/net: Ensure assert() triggers in psock_tpacket.c
selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8
PCI: Disable MSI on RDC PCI to PCIe bridges
drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf()
mfd: madera: Work around false-positive -Wininitialized warning
mfd: stmpe-i2c: Add missing MODULE_LICENSE
mfd: stmpe: Remove IRQ domain upon removal
tools/power x86_energy_perf_policy: Prefer driver HWP limits
tools/power x86_energy_perf_policy: Enhance HWP enable
tools/cpupower: Fix incorrect size in cpuidle_state_disable()
hwmon: (dell-smm) Add support for Dell OptiPlex 7040
uprobe: Do not emulate/sstep original instruction when ip is changed
clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel
video: backlight: lp855x_bl: Set correct EPROM start for LP8556
tee: allow a driver to allocate a tee_device without a pool
ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method()
mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
arc: Fix __fls() const-foldability via __builtin_clzl()
cpufreq/longhaul: handle NULL policy in longhaul_exit
selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2
ACPI: video: force native for Lenovo 82K8
memstick: Add timeout to prevent indefinite waiting
mmc: host: renesas_sdhi: Fix the actual clock
bpf: Don't use %pK through printk
spi: loopback-test: Don't use %pK through printk
soc: qcom: smem: Fix endian-unaware access of num_entries
usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
serial: 8250_dw: handle reset control deassert error
serial: 8250_dw: Use devm_add_action_or_reset()
serial: 8250_dw: Use devm_clk_get_optional() to get the input clock
can: gs_usb: increase max interface to U8_MAX
devcoredump: Fix circular locking dependency with devcd->mutex.
net: ravb: Enforce descriptor type ordering
x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID
wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode
net: phy: dp83867: Disable EEE support as not implemented
regmap: slimbus: fix bus_context pointer in regmap init calls
drm/etnaviv: fix flush sequence logic
usbnet: Prevents free active kevent
wifi: ath10k: Fix memory leak on unsupported WMI command
ASoC: qdsp6: q6asm: do not sleep while atomic
fbdev: valkyriefb: Fix reference count leak in valkyriefb_init
fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS
fbdev: bitblit: bound-check glyph index in bit_putcs*
ACPI: video: Fix use-after-free in acpi_video_switch_brightness()
fbdev: atyfb: Check if pll_ops->init_pll failed
net: usb: asix_devices: Check return value of usbnet_get_endpoints
btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot()
x86/bugs: Fix reporting of LFENCE retpoline
net/sched: sch_qfq: Fix null-deref in agg_dequeue
UPSTREAM: crypto: essiv - Check ssize for decryption and in-place encryption
ANDROID: GKI: fix up build break where timer_delete_sync() was used
Revert "net: rtnetlink: remove redundant assignment to variable err"
Revert "net: rtnetlink: add msg kind names"
Revert "net: rtnetlink: add helper to extract msg type's kind"
Revert "net: rtnetlink: use BIT for flag values"
Revert "net: netlink: add NLM_F_BULK delete request modifier"
Revert "net: rtnetlink: add bulk delete support flag"
Revert "net: rtnetlink: fix module reference count leak issue in rtnetlink_rcv_msg"
Revert "net: add ndo_fdb_del_bulk"
Revert "net: rtnetlink: add NLM_F_BULK support to rtnl_fdb_del"
Revert "rtnetlink: Allow deleting FDB entries in user namespace"
Linux 5.4.301
net: rtnetlink: fix module reference count leak issue in rtnetlink_rcv_msg
media: s5p-mfc: remove an unused/uninitialized variable
NFSD: Fix last write offset handling in layoutcommit
NFSD: Minor cleanup in layoutcommit processing
padata: Reset next CPU when reorder sequence wraps around
KEYS: trusted_tpm1: Compare HMAC values in constant time
NFSD: Define a proc_layoutcommit for the FlexFiles layout type
vfs: Don't leak disconnected dentries on umount
jbd2: ensure that all ongoing I/O complete before freeing blocks
ext4: detect invalid INLINE_DATA + EXTENTS flag combination
drm/amdgpu: use atomic functions with memory barriers for vm fault info
ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()
spi: cadence-quadspi: Flush posted register writes before DAC access
spi: cadence-quadspi: Flush posted register writes before INDAC access
memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe
memory: samsung: exynos-srom: Correct alignment
arm64: errata: Apply workarounds for Neoverse-V3AE
arm64: cputype: Add Neoverse-V3AE definitions
comedi: fix divide-by-zero in comedi_buf_munge()
binder: remove "invalid inc weak" check
xhci: dbc: enable back DbC in resume if it was enabled before suspend
usb/core/quirks: Add Huawei ME906S to wakeup quirk
USB: serial: option: add Telit FN920C04 ECM compositions
USB: serial: option: add Quectel RG255C
USB: serial: option: add UNISOC UIS7720
net: ravb: Ensure memory write completes before ringing TX doorbell
net: usb: rtl8150: Fix frame padding
ocfs2: clear extent cache after moving/defragmenting extents
MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering
Revert "cpuidle: menu: Avoid discarding useful information"
net: bonding: fix possible peer notify event loss or dup issue
sctp: avoid NULL dereference when chunk data buffer is missing
arm64, mm: avoid always making PTE dirty in pte_mkwrite()
net: enetc: correct the value of ENETC_RXB_TRUESIZE
rtnetlink: Allow deleting FDB entries in user namespace
net: rtnetlink: add NLM_F_BULK support to rtnl_fdb_del
net: add ndo_fdb_del_bulk
net: rtnetlink: add bulk delete support flag
net: netlink: add NLM_F_BULK delete request modifier
net: rtnetlink: use BIT for flag values
net: rtnetlink: add helper to extract msg type's kind
net: rtnetlink: add msg kind names
net: rtnetlink: remove redundant assignment to variable err
m68k: bitops: Fix find_*_bit() signatures
hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super()
hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()
dlm: check for defined force value in dlm_lockspace_release
hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat()
hfs: validate record offset in hfsplus_bmap_alloc
hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent()
hfs: make proper initalization of struct hfs_find_data
hfs: clear offset and space out of valid records in b-tree node
exec: Fix incorrect type for ret
hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp()
ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings
sched/fair: Fix pelt lost idle time detection
sched/balancing: Rename newidle_balance() => sched_balance_newidle()
sched/fair: Trivial correction of the newidle_balance() comment
sched: Make newidle_balance() static again
tls: don't rely on tx_work during send()
tls: always set record_type in tls_process_cmsg
tg3: prevent use of uninitialized remote_adv and local_adv variables
tcp: fix tcp_tso_should_defer() vs large RTT
amd-xgbe: Avoid spurious link down messages during interface toggle
net/ip6_tunnel: Prevent perpetual tunnel growth
net: dlink: handle dma_map_single() failure properly
net: dl2k: switch from 'pci_' to 'dma_' API
media: pci: ivtv: Add missing check after DMA map
media: pci/ivtv: switch from 'pci_' to 'dma_' API
xen/events: Update virq_to_irq on migration
media: lirc: Fix error handling in lirc_register()
media: rc: Directly use ida_free()
drm/exynos: exynos7_drm_decon: remove ctx->suspended
btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
pwm: berlin: Fix wrong register in suspend/resume
media: cx18: Add missing check after DMA map
xen/events: Cleanup find_virq() return codes
cramfs: Verify inode mode when loading from disk
fs: Add 'initramfs_options' to set initramfs mount options
pid: Add a judgment for ns null in pid_nr_ns
minixfs: Verify inode mode when loading from disk
tracing: Fix race condition in kprobe initialization causing NULL pointer dereference
dm: fix NULL pointer dereference in __dm_suspend()
mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag
mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type
mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value
Squashfs: reject negative file sizes in squashfs_read_inode()
Squashfs: add additional inode sanity checking
media: mc: Clear minor number before put device
mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data()
fs: udf: fix OOB read in lengthAllocDescs handling
KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O
net/9p: fix double req put in p9_fd_cancelled
ext4: guard against EA inode refcount underflow in xattr update
ext4: correctly handle queries for metadata mappings
ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch()
nfsd: nfserr_jukebox in nlm_fopen should lead to a retry
x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases)
x86/umip: Check that the instruction opcode is at least two bytes
PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit
PCI/AER: Fix missing uevent on recovery when a reset is requested
PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV
rseq/selftests: Use weak symbol reference, not definition, to link with glibc
rtc: interface: Fix long-standing race when setting alarm
rtc: interface: Ensure alarm irq is enabled when UIE is enabled
mmc: core: SPI mode remove cmd7
mtd: rawnand: fsmc: Default to autodetect buswidth
sparc: fix error handling in scan_one_device()
sparc64: fix hugetlb for sun4u
sctp: Fix MAC comparison to be constant-time
scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()
parisc: don't reference obsolete termio struct for TC* constants
lib/genalloc: fix device leak in of_gen_pool_get()
iio: frequency: adf4350: Fix prescaler usage.
iio: dac: ad5421: use int type to store negative error codes
iio: dac: ad5360: use int type to store negative error codes
crypto: atmel - Fix dma_unmap_sg() direction
cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()
drm/nouveau: fix bad ret code in nouveau_bo_move_prep
media: i2c: mt9v111: fix incorrect type for ret
firmware: meson_sm: fix device leak at probe
xen/manage: Fix suspend error path
arm64: dts: qcom: msm8916: Add missing MDSS reset
ACPI: debug: fix signedness issues in read/write helpers
ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT
tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
tpm, tpm_tis: Claim locality before writing interrupt registers
crypto: essiv - Check ssize for decryption and in-place encryption
mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes
mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call
tools build: Align warning options with perf
net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe
tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
drm/vmwgfx: Fix Use-after-free in validation
net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
scsi: mvsas: Use sas_task_find_rq() for tagging
scsi: mvsas: Delete mvs_tag_init()
scsi: libsas: Add sas_task_find_rq()
clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver
clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate()
perf session: Fix handling when buffer exceeds 2 GiB
rtc: x1205: Fix Xicor X1205 vendor prefix
perf util: Fix compression checks returning -1 as bool
iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
clocksource/drivers/clps711x: Fix resource leaks in error paths
pinctrl: check the return value of pinmux_ops::get_function_name()
Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
mm: hugetlb: avoid soft lockup when mprotect to large memory area
uio_hv_generic: Let userspace take care of interrupt mask
Squashfs: fix uninit-value in squashfs_get_parent
Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"
net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable
nfp: fix RSS hash key size when RSS is not supported
drivers/base/node: fix double free in register_one_node()
ocfs2: fix double free in user_cluster_connect()
net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
RDMA/siw: Always report immediate post SQ errors
usb: vhci-hcd: Prevent suspending virtually attached devices
scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
ipvs: Defer ip_vs_ftp unregister during netns cleanup
NFSv4.1: fix backchannel max_resp_sz verification check
remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
sparc: fix accurate exception reporting in copy_{from,to}_user for M7
sparc: fix accurate exception reporting in copy_to_user for Niagara 4
sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara
sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III
sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC
IB/sa: Fix sa_local_svc_timeout_ms read race
RDMA/core: Resolve MAC of next-hop device without ARP support
wifi: mt76: fix potential memory leak in mt76_wmac_probe()
drivers/base/node: handle error properly in register_one_node()
watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog
netfilter: ipset: Remove unused htable_bits in macro ahash_region
iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
pps: fix warning in pps_register_cdev when register device fail
misc: genwqe: Fix incorrect cmd field being reported in error
usb: gadget: configfs: Correctly set use_os_string at bind
usb: phy: twl6030: Fix incorrect type for ret
tcp: fix __tcp_close() to only send RST when required
PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation
wifi: mwifiex: send world regulatory domain to driver
ALSA: lx_core: use int type to store negative error codes
media: rj54n1cb0c: Fix memleak in rj54n1_probe()
scsi: myrs: Fix dma_alloc_coherent() error check
scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
serial: max310x: Add error checking in probe()
usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup
drm/radeon/r600_cs: clean up of dead code in r600_cs
i2c: designware: Add disabling clocks when probe fails
i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
bpf: Explicitly check accesses to bpf_sock_addr
selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported
pwm: tiehrpwm: Fix corner case in clock divisor calculation
block: use int to store blk_stack_limits() return value
blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx
pinctrl: meson-gxl: add missing i2c_d pinmux
soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
ACPI: processor: idle: Fix memory leak when register cpuidle device failed
regmap: Remove superfluous check for !config in __regmap_init()
x86/vdso: Fix output operand size of RDPID
perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
driver core/PM: Set power.no_callbacks along with power.no_pm
staging: axis-fifo: flush RX FIFO on read errors
staging: axis-fifo: fix maximum TX packet length check
perf subcmd: avoid crash in exclude_cmds when excludes is empty
dm-integrity: limit MAX_TAG_SIZE to 255
wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188
USB: serial: option: add SIMCom 8230C compositions
media: rc: fix races with imon_disconnect()
media: imon: grab lock earlier in imon_ir_change_protocol()
media: imon: reorganize serialization
media: rc: Add support for another iMON 0xffdc device
media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe
media: tuner: xc5000: Fix use-after-free in xc5000_release
media: tunner: xc5000: Refactor firmware load
udp: Fix memory accounting leak.
media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove
scsi: target: target_core_configfs: Add length check to avoid buffer overflow
UPSTREAM: soc: qcom: mdt_loader: Deal with zero e_shentsize
Revert "genirq: Provide new interfaces for affinity hints"
Revert "i40e: Use irq_update_affinity_hint()"
Revert "i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path"
Linux 5.4.300
mm/hugetlb: fix folio is still mapped when deleted
i40e: add mask to apply valid bits for itr_idx
i40e: fix validation of VF state in get resources
i40e: fix idx validation in config queues msg
i40e: add validation for ring_len param
i40e: increase max descriptors for XL710
mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize()
fbcon: Fix OOB access in font allocation
fbcon: fix integer overflow in fbcon_do_set_font
i40e: add max boundary check for VF filters
i40e: fix input validation logic for action_meta
i40e: fix idx validation in i40e_validate_queue_map
drm/gma500: Fix null dereference in hdmi teardown
can: peak_usb: fix shift-out-of-bounds issue
can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow
can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow
can: hi311x: populate ndo_change_mtu() to prevent buffer overflow
can: rcar_can: rcar_can_resume(): fix s2ram with PSCI
IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions
usb: core: Add 0x prefix to quirks debug output
ALSA: usb-audio: Fix build with CONFIG_INPUT=n
ALSA: usb-audio: Convert comma to semicolon
ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5
ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks
ALSA: usb-audio: Simplify NULL comparison in mixer_quirks
ALSA: usb-audio: Avoid multiple assignments in mixer_quirks
ALSA: usb-audio: Fix block comments in mixer_quirks
KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active
net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer
net: rfkill: gpio: add DT support
serial: sc16is7xx: fix bug in flow control levels init
USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels
usb: gadget: dummy_hcd: remove usage of list iterator past the loop body
ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message
ASoC: wm8974: Correct PLL rate rounding
ASoC: wm8940: Correct typo in control name
rds: ib: Increment i_fastreg_wrs before bailing out
mmc: mvsdio: Fix dma_unmap_sg() nents value
power: supply: bq27xxx: restrict no-battery detection to bq27000
power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery
nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/*
cnic: Fix use-after-free bugs in cnic_delete_task
net: liquidio: fix overflow in octeon_init_instr_queue()
Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set"
tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().
i40e: remove redundant memory barrier when cleaning Tx descs
net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure
cgroup: split cgroup_destroy_wq into 3 workqueues
pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch
wifi: mac80211: fix incorrect type for ret
ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported
mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory
soc: qcom: mdt_loader: Deal with zero e_shentsize
phy: ti-pipe3: fix device leak at unbind
dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees
dmaengine: ti: edma: Fix memory allocation size for queue_priority_map
can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails
can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed
i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path
i40e: Use irq_update_affinity_hint()
genirq: Provide new interfaces for affinity hints
genirq: Export affinity setter for modules
genirq/affinity: Add irq_update_affinity_desc()
igb: fix link test skipping when interface is admin down
net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable()
USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions
USB: serial: option: add Telit Cinterion FN990A w/audio compositions
tty: hvc_console: Call hvc_kick in hvc_write unconditionally
mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing
mtd: nand: raw: atmel: Fix comment in timings preparation
mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer
mm/khugepaged: fix the address passed to notifier on testing young
fuse: prevent overflow in copy_file_range return value
fuse: check if copy_file_range() returns larger than requested size
mtd: rawnand: stm32_fmc2: fix ECC overwrite
ocfs2: fix recursive semaphore deadlock in fiemap call
EDAC/altera: Delete an inappropriate dma_free_coherent() call
tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork.
NFSv4: Don't clear capabilities that won't be reset
net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod.
usb: hub: Fix flushing of delayed work used for post resume purposes
UPSTREAM: vsock: Do not allow binding to VMADDR_PORT_ANY
Linux 5.4.299
dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status()
cifs: fix integer overflow in match_server()
spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort
spi: spi-fsl-lpspi: Set correct chip-select polarity bit
spi: spi-fsl-lpspi: Fix transmissions when using CONT
pcmcia: Add error handling for add_interval() in do_validate_mem()
ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model
randstruct: gcc-plugin: Fix attribute addition
randstruct: gcc-plugin: Remove bogus void member
vmxnet3: update MTU after device quiesce
net: dsa: microchip: linearize skb for tail-tagging switches
net: dsa: microchip: update tag_ksz masks for KSZ9477 family
dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status()
ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup
gpio: pca953x: fix IRQ storm on system wake up
iio: light: opt3001: fix deadlock due to concurrent flag access
iio: chemical: pms7003: use aligned_s64 for timestamp
KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer
cpufreq/sched: Explicitly synchronize limits_changed flag handling
mm/slub: avoid accessing metadata when pointer is invalid in object_err()
scsi: lpfc: Fix buffer free/clear order in deferred receive path
mm/khugepaged: fix ->anon_vma race
e1000e: fix heap overflow in e1000_set_eeprom
batman-adv: fix OOB read/write in network-coding decode
drm/amdgpu: drop hw access in non-DC audio fini
wifi: mwifiex: Initialize the chan_stats array to zero
pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region()
ALSA: usb-audio: Add mute TLV for playback volumes on some devices
ppp: fix memory leak in pad_compress_skb
net: atm: fix memory leak in atm_register_sysfs when device_register fail
ax25: properly unshare skbs in ax25_kiss_rcv()
ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init()
net: thunder_bgx: decrement cleanup index before use
net: thunder_bgx: add a missing of_node_put
wifi: libertas: cap SSID len in lbs_associate()
wifi: cw1200: cap SSID length in cw1200_do_join()
net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets
i40e: Fix potential invalid access when MAC list is empty
icmp: fix icmp_ndo_send address translation for reply direction
mISDN: Fix memory leak in dsp_hwec_enable()
xirc2ps_cs: fix register access when enabling FullDuplex
Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()
netfilter: conntrack: helper: Replace -EEXIST by -EBUSY
wifi: cfg80211: fix use-after-free in cmp_bss()
powerpc: boot: Remove leading zero in label in udelay()
Linux 5.4.298
Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS"
net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions
Revert "drm/amdgpu: fix incorrect vm flags to map bo"
HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()
HID: wacom: Add a new Art Pen 2
HID: asus: fix UAF via HID_CLAIMED_INPUT validation
KVM: x86: use array_index_nospec with indices that come from guest
efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare
sctp: initialize more fields in sctp_v6_from_sk()
net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts
net/mlx5e: Set local Xoff after FW update
net/mlx5e: Update and set Xon/Xoff upon port speed set
net/mlx5e: Update and set Xon/Xoff upon MTU set
net: dlink: fix multicast stats being counted incorrectly
atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().
net/atm: remove the atmdev_ops {get, set}sockopt methods
Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced
powerpc/kvm: Fix ifdef to remove build warning
net: ipv4: fix regression in local-broadcast routes
vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put()
scsi: core: sysfs: Correct sysfs attributes access rights
ftrace: Fix potential warning in trace_printk_seq during ftrace_dump
pinctrl: STMFX: add missing HAS_IOMEM dependency
Revert "PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports"
Revert "PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit()"
UPSTREAM: perf/core: Fix potential NULL deref
UPSTREAM: net/packet: fix a race in packet_set_ring() and packet_notifier()
Linux 5.4.297
alloc_fdtable(): change calling conventions.
s390/hypfs: Enable limited access during lockdown
s390/hypfs: Avoid unnecessary ioctl registration in debugfs
ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation
net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate
net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit
ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc
ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add
ALSA: usb-audio: Fix size validation in convert_chmap_v3()
scsi: qla4xxx: Prevent a potential error pointer dereference
usb: xhci: Fix slot_id resource race conflict
nfs: fix UAF in direct writes
NFS: Fix up commit deadlocks
cifs: Fix UAF in cifs_demultiplex_thread()
Bluetooth: fix use-after-free in device_for_each_child()
act_mirred: use the backlog for nested calls to mirred ingress
net/sched: act_mirred: better wording on protection against excessive stack growth
net/sched: act_mirred: refactor the handle of xmit
selftests: forwarding: tc_actions.sh: add matchall mirror test
net: sched: don't expose action qstats to skb_tc_reinsert()
net: sched: extract qstats update code into functions
net: sched: extract bstats update code into function
net: sched: extract common action counters update code into function
mm: perform the mapping_map_writable() check after call_mmap()
mm: update memfd seal write check to include F_SEAL_WRITE
mm: drop the assumption that VM_SHARED always implies writable
codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()
sch_qfq: make qfq_qlen_notify() idempotent
sch_hfsc: make hfsc_qlen_notify() idempotent
sch_drr: make drr_qlen_notify() idempotent
btrfs: populate otime when logging an inode item
media: venus: hfi: explicitly release IRQ during teardown
f2fs: fix to avoid out-of-boundary access in dnode page
media: venus: protect against spurious interrupts during probe
media: qcom: camss: cleanup media device allocated resource on error path
media: venus: vdec: Clamp param smaller than 1fps and bigger than 240.
drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS
pwm: mediatek: Fix duty and period setting
pwm: mediatek: Handle hardware enable and clock enable separately
pwm: mediatek: Implement .apply() callback
media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()
media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free()
media: v4l2-ctrls: always copy the controls on completion
ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig
soc: qcom: mdt_loader: Ensure we don't read past the ELF header
rtc: ds1307: handle oscillator stop flag (OSF) for ds1341
usb: musb: omap2430: fix device leak at unbind
NFS: Fix the setting of capabilities when automounting a new filesystem
NFS: Fix up handling of outstanding layoutcommit in nfs_update_inode()
NFSv4: Fix nfs4_bitmap_copy_adjust()
usb: typec: fusb302: cache PD RX state
cdc-acm: fix race between initial clearing halt and open
USB: cdc-acm: do not log successful probe on later errors
mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock
mm/kmemleak: turn kmemleak_lock and object->lock to raw_spinlock_t
ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx()
x86/fpu: Delay instruction pointer fixup until after warning
mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery
nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()
pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov
tracing: Add down_write(trace_event_sem) when adding trace event
usb: hub: Don't try to recover devices lost during warm reset.
usb: hub: avoid warm port reset during USB3 disconnect
x86/mce/amd: Add default names for MCA banks and blocks
iio: hid-sensor-prox: Fix incorrect OFFSET calculation
f2fs: fix to do sanity check on ino and xnid
mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n
mm/zsmalloc.c: convert to use kmem_cache_zalloc in cache_alloc_zspage()
drm/sched: Remove optimization that causes hang when killing dependent jobs
ice: Fix a null pointer dereference in ice_copy_and_init_pkg()
net: usbnet: Fix the wrong netif_carrier_on() call
net: usbnet: Avoid potential RCU stall on LINK_CHANGE event
PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports
ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value
comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large
comedi: Fix initialization of data for instructions that write to subdevice
kbuild: Add KBUILD_CPPFLAGS to as-option invocation
kbuild: add $(CLANG_FLAGS) to KBUILD_CPPFLAGS
kbuild: Add CLANG_FLAGS to as-instr
mips: Include KBUILD_CPPFLAGS in CHECKFLAGS invocation
kbuild: Update assembler calls to use proper flags and language target
ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS
usb: dwc3: Ignore late xferNotReady event to prevent halt timeout
USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles
usb: storage: realtek_cr: Use correct byte order for bcs->Residue
USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera
usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive
iio: proximity: isl29501: fix buffered read on big-endian systems
ftrace: Also allocate and copy hash for reading of filter files
fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable()
use uniform permission checks for all mount propagation changes
move_mount: allow to add a mount into an existing group
fs/buffer: fix use-after-free when call bh_read() helper
drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs
drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3
squashfs: fix memory leak in squashfs_fill_super
memstick: Fix deadlock by moving removing flag earlier
media: venus: Add a check for packet size after reading from shared memory
media: ov2659: Fix memory leaks in ov2659_probe()
media: usbtv: Lock resolution while streaming
media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init()
media: gspca: Add bounds checking to firmware parser
soc/tegra: pmc: Ensure power-domains are in a known state
jbd2: prevent softlockup in jbd2_log_do_checkpoint()
PCI: endpoint: Fix configfs group removal on driver teardown
PCI: endpoint: Fix configfs group list head handling
mtd: rawnand: fsmc: Add missing check after DMA map
pwm: imx-tpm: Reset counter if CMOD is 0
wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table()
zynq_fpga: use sgtable-based scatterlist wrappers
ata: libata-scsi: Fix ata_to_sense_error() status handling
ext4: fix reserved gdt blocks handling in fsmap
ext4: fix fsmap end of range reporting with bigalloc
ext4: check fast symlink for ea_inode correctly
Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()"
vt: defkeymap: Map keycodes above 127 to K_HOLE
vt: keyboard: Don't process Unicode characters in K_OFF mode
usb: dwc3: meson-g12a: fix device leaks at unbind
usb: gadget: udc: renesas_usb3: fix device leak at unbind
usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init()
m68k: Fix lost column on framebuffer debug console
cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table()
serial: 8250: fix panic due to PSLVERR
media: uvcvideo: Do not mark valid metadata as invalid
media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()
mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup()
parisc: Makefile: fix a typo in palo.conf
btrfs: fix log tree replay failure due to file with 0 links and extents
thunderbolt: Fix copy+paste error in match_service_id()
comedi: fix race between polling and detaching
misc: rtsx: usb: Ensure mmc child device is active when card is present
drm/amdgpu: fix incorrect vm flags to map bo
scsi: lpfc: Remove redundant assignment to avoid memory leak
rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe
pNFS: Fix uninited ptr deref in block/scsi layout
pNFS: Handle RPC size limit for layoutcommits
pNFS: Fix disk addr range check in block/scsi layout
pNFS: Fix stripe mapping in block/scsi layout
net: phy: smsc: add proper reset flags for LAN8710A
ipmi: Fix strcpy source and destination the same
kconfig: lxdialog: fix 'space' to (de)select options
kconfig: gconf: fix potential memory leak in renderer_edited()
kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed()
ipmi: Use dev_warn_ratelimited() for incorrect message warnings
scsi: aacraid: Stop using PCI_IRQ_AFFINITY
scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans
kconfig: nconf: Ensure null termination where strncpy is used
kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c
i3c: don't fail if GETHDRCAP is unsupported
PCI: pnv_php: Work around switches with broken presence detection
i3c: add missing include to internal header
media: uvcvideo: Fix bandwidth issue for Alcor camera
media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar
media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb()
media: usb: hdpvr: disable zero-length read messages
media: tc358743: Increase FIFO trigger level to 374
media: tc358743: Return an appropriate colorspace from tc358743_set_fmt
media: tc358743: Check I2C succeeded during probe
pinctrl: stm32: Manage irq affinity settings
scsi: mpt3sas: Correctly handle ATA device errors
scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure
RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask()
MIPS: Don't crash in stack_top() for tasks without ABI or vDSO
jfs: upper bound check of tree index in dbAllocAG
jfs: Regular file corruption check
jfs: truncate good inode pages when hard link is 0
scsi: bfa: Double-free fix
MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free}
watchdog: dw_wdt: Fix default timeout
fs/orangefs: use snprintf() instead of sprintf()
scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated
ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr
cifs: Fix calling CIFSFindFirst() for root path without msearch
vhost: fail early when __vhost_add_used() fails
net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325
uapi: in6: restore visibility of most IPv6 socket options
net: ncsi: Fix buffer overflow in fetching version id
net: dsa: b53: prevent SWITCH_CTRL access on BCM5325
net: dsa: b53: fix b53_imp_vlan_setup for BCM5325
net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs
wifi: iwlegacy: Check rate_idx range after addition
netmem: fix skb_frag_address_safe with unreadable skbs
wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`.
wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect
wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd()
net: fec: allow disable coalescing
(powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer
s390/stp: Remove udelay from stp_sync_clock()
wifi: iwlwifi: mvm: fix scan request validation
net: thunderx: Fix format-truncation warning in bgx_acpi_match_id()
net: ipv4: fix incorrect MTU in broadcast routes
wifi: cfg80211: Fix interface type validation
rcu: Protect ->defer_qs_iw_pending from data race
net: ag71xx: Add missing check after DMA map
et131x: Add missing check after DMA map
be2net: Use correct byte order and format string for TCP seq and ack_seq
s390/time: Use monotonic clock in get_cycles()
wifi: cfg80211: reject HTC bit for management frames
ktest.pl: Prevent recursion of default variable options
ASoC: codecs: rt5640: Retry DEVICE_ID verification
ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros
ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control
platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches
pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop()
usb: core: usb_submit_urb: downgrade type check
ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4
ASoC: hdac_hdmi: Rate limit logging on connection and disconnection
mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode()
ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path
ACPI: processor: fix acpi_object initialization
PM: sleep: console: Fix the black screen issue
thermal: sysfs: Return ENODATA instead of EAGAIN for reads
PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit()
selftests: tracing: Use mutex_unlock for testing glob filter
ARM: tegra: Use I/O memcpy to write to IRAM
gpio: tps65912: check the return value of regmap_update_bits()
ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed
ARM: rockchip: fix kernel hang during smp initialization
cpufreq: Exit governor when failed to start old governor
usb: xhci: Avoid showing errors during surprise removal
usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command
usb: xhci: Avoid showing warnings for dying controller
selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t
usb: xhci: print xhci->xhc_state when queue_command failed
securityfs: don't pin dentries twice, once is enough...
hfs: fix not erasing deleted b-tree node issue
drbd: add missing kref_get in handle_write_conflicts
udf: Verify partition map count
arm64: Handle KCOV __init vs inline mismatches
hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file()
hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()
hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read()
hfs: fix slab-out-of-bounds in hfs_bnode_read()
sctp: linearize cloned gso packets in sctp_rcv
netfilter: ctnetlink: fix refcount leak on table dump
udp: also consider secpath when evaluating ipsec use for checksumming
ACPI: processor: perflib: Move problematic pr->performance check
ACPI: processor: perflib: Fix initial _PPC limit application
Documentation: ACPI: Fix parent device references
fs: Prevent file descriptor table allocations exceeding INT_MAX
sunvdc: Balance device refcount in vdc_port_mpgroup_check
NFSD: detect mismatch of file handle and delegation stateid in OPEN op
net: dpaa: fix device leak when querying time stamp info
net: gianfar: fix device leak when querying time stamp info
netlink: avoid infinite retry looping in netlink_unicast()
ALSA: usb-audio: Validate UAC3 cluster segment descriptors
ALSA: usb-audio: Validate UAC3 power domain descriptors, too
io_uring: don't use int for ABI
usb: gadget : fix use-after-free in composite_dev_cleanup()
MIPS: mm: tlb-r4k: Uniquify TLB entries on init
USB: serial: option: add Foxconn T99W709
vsock: Do not allow binding to VMADDR_PORT_ANY
net/packet: fix a race in packet_set_ring() and packet_notifier()
perf/core: Prevent VMA split of buffer mappings
perf/core: Exit early on perf_mmap() fail
perf/core: Don't leak AUX buffer refcount on allocation failure
pptp: fix pptp_xmit() error path
smb: client: let recv_done() cleanup before notifying the callers.
benet: fix BUG when creating VFs
net: drop UFO packets in udp_rcv_segment()
ipv6: reject malicious packets in ipv6_gso_segment()
pptp: ensure minimal skb length in pptp_xmit()
netpoll: prevent hanging NAPI when netcons gets enabled
NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()
pci/hotplug/pnv-php: Wrap warnings in macro
pci/hotplug/pnv-php: Improve error msg on power state change failure
usb: chipidea: udc: fix sleeping function called from invalid context
f2fs: fix to avoid out-of-boundary access in devs.path
f2fs: fix to avoid panic in f2fs_evict_inode
f2fs: fix to avoid UAF in f2fs_sync_inode_meta()
rtc: pcf8563: fix incorrect maximum clock rate handling
rtc: hym8563: fix incorrect maximum clock rate handling
rtc: ds1307: fix incorrect maximum clock rate handling
module: Restore the moduleparam prefix length check
bpf: Check flow_dissector ctx accesses are aligned
mtd: rawnand: atmel: set pmecc data setup time
mtd: rawnand: atmel: Fix dma_mapping_error() address
jfs: fix metapage reference count leak in dbAllocCtl
fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref
crypto: qat - fix seq_file position update in adf_ring_next()
dmaengine: nbpfaxi: Add missing check after DMA map
dmaengine: mv_xor: Fix missing check after DMA map and missing unmap
fs/orangefs: Allow 2 more characters in do_c_string()
soundwire: stream: restore params when prepare ports fail
crypto: img-hash - Fix dma_unmap_sg() nents value
hwrng: mtk - handle devm_pm_runtime_enable errors
watchdog: ziirave_wdt: check record length in ziirave_firm_verify()
scsi: isci: Fix dma_unmap_sg() nents value
scsi: mvsas: Fix dma_unmap_sg() nents value
scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value
clk: sunxi-ng: v3s: Fix de clock definition
perf tests bp_account: Fix leaked file descriptor
crypto: ccp - Fix crash when rebind ccp device for ccp.ko
pinctrl: sunxi: Fix memory leak on krealloc failure
power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set
clk: davinci: Add NULL check in davinci_lpsc_clk_register()
mtd: fix possible integer overflow in erase_xfer()
crypto: marvell/cesa - Fix engine load inaccuracy
PCI: rockchip-host: Fix "Unexpected Completion" log message
vrf: Drop existing dst reference in vrf_ip6_input_dst
selftests: rtnetlink.sh: remove esp4_offload after test
netfilter: xt_nfacct: don't assume acct name is null-terminated
can: kvaser_usb: Assign netdev.dev_port based on device channel index
can: kvaser_pciefd: Store device channel index
wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE
Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()"
mwl8k: Add missing check after DMA map
wifi: rtl8xxxu: Fix RX skb size for aggregation disabled
net/sched: Restrict conditions for adding duplicating netems to qdisc tree
arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX
netfilter: nf_tables: adjust lockdep assertions handling
drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value
m68k: Don't unregister boot console needlessly
tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range
iwlwifi: Add missing check for alloc_ordered_workqueue
wifi: iwlwifi: Fix memory leak in iwl_mvm_init()
wifi: rtl818x: Kill URBs before clearing tx status queue
caif: reduce stack size, again
bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure
bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
staging: nvec: Fix incorrect null termination of battery manufacturer
samples: mei: Fix building on musl libc
cpufreq: Init policy->rwsem before it may be possibly used
ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface
usb: early: xhci-dbc: Fix early_ioremap leak
Revert "vmci: Prevent the dispatching of uninitialized payloads"
pps: fix poll support
vmci: Prevent the dispatching of uninitialized payloads
staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc()
ARM: dts: vfxxx: Correctly use two tuples for timer address
ASoC: ops: dynamically allocate struct snd_ctl_elem_value
hfsplus: remove mutex_lock check in hfsplus_free_extents
ASoC: Intel: fix SND_SOC_SOF dependencies
ethernet: intel: fix building with large NR_CPUS
usb: phy: mxs: disconnect line when USB charger is attached
usb: chipidea: add USB PHY event
usb: chipidea: introduce CI_HDRC_CONTROLLER_VBUS_EVENT glue layer use
usb: chipidea: udc: protect usb interrupt enable
usb: chipidea: udc: add new API ci_hdrc_gadget_connect
ALSA: hda: Add missing NVIDIA HDA codec IDs
comedi: comedi_test: Fix possible deletion of uninitialized timers
nilfs2: reject invalid file types when reading inodes
i2c: qup: jump out of the loop in case of timeout
net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class
net: appletalk: Fix use-after-free in AARP proxy probe
net: appletalk: fix kerneldoc warnings
RDMA/core: Rate limit GID cache warning messages
regulator: core: fix NULL dereference on unbind due to stale coupling data
usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm
usb: hub: fix detection of high tier USB3 devices behind suspended hubs
net_sched: sch_sfq: reject invalid perturb period
net_sched: sch_sfq: move the limit validation
net_sched: sch_sfq: use a temporary work area for validating configuration
net_sched: sch_sfq: don't allow 1 packet limit
net_sched: sch_sfq: handle bigger packets
net_sched: sch_sfq: annotate data-races around q->perturb_period
power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition
power: supply: bq24190_charger: using pm_runtime_resume_and_get instead of pm_runtime_get_sync
power: supply: bq24190_charger: Fix runtime PM imbalance on error
xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS
virtio-net: ensure the received length does not exceed allocated size
ASoC: fsl_sai: Force a software reset when starting in consumer mode
usb: dwc3: qcom: Don't leave BCR asserted
usb: musb: fix gadget state on disconnect
net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree
net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU
Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout
Bluetooth: SMP: If an unallowed command is received consider it a failure
Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb()
usb: net: sierra: check for no status endpoint
net/sched: sch_qfq: Fix race condition on qfq_aggregate
net: emaclite: Fix missing pointer increment in aligned_read()
comedi: Fix use of uninitialized data in insn_rw_emulate_bits()
comedi: Fix some signed shift left operations
comedi: das6402: Fix bit shift out of bounds
comedi: das16m1: Fix bit shift out of bounds
comedi: aio_iiro_16: Fix bit shift out of bounds
comedi: pcl812: Fix bit shift out of bounds
iio: adc: stm32-adc: Fix race in installing chained IRQ handler
iio: adc: max1363: Reorder mode_list[] entries
iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[]
soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled
soc: aspeed: lpc-snoop: Cleanup resources in stack-order
mmc: sdhci_am654: Workaround for Errata i2312
mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models
mmc: bcm2835: Fix dma_unmap_sg() nents value
memstick: core: Zero initialize id_reg in h_memstick_read_dev_id()
isofs: Verify inode mode when loading from disk
dmaengine: nbpfaxi: Fix memory corruption in probe()
af_packet: fix soft lockup issue caused by tpacket_snd()
af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd()
phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept()
HID: core: do not bypass hid_hw_raw_request
HID: core: ensure __hid_request reserves the report ID as the first byte
HID: core: ensure the allocated report buffer can contain the reserved report ID
pch_uart: Fix dma_sync_sg_for_device() nents value
Input: xpad - set correct controller type for Acer NGR200
i2c: stm32: fix the device used for the DMA map
usb: gadget: configfs: Fix OOB read on empty string write
USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI
USB: serial: option: add Foxconn T99W640
USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition
ANDROID: 16K: Allocate pad vma on the stack
ANDROID: 16K: Don't copy data vma for maps/smaps output
ANDROID: GKI: update Trimble symbol list
UPSTREAM: net/sched: Always pass notifications when child class becomes empty
Revert "drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling"
Linux 5.4.296
net: ipv6: Discard next-hop MTU less than minimum link MTU
x86/mm: Disable hugetlb page table sharing on 32-bit
Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID
HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras
HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY
vt: add missing notification when switching back to text mode
net: usb: qmi_wwan: add SIMCom 8230C composition
atm: idt77252: Add missing `dma_map_error()`
bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT
bnxt_en: Fix DCB ETS validation
can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level
net: phy: microchip: limit 100M workaround to link-down events on LAN88xx
net: appletalk: Fix device refcount leak in atrtr_create()
md/raid1: Fix stack memory use after return in raid1_reshape
wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev()
dma-buf: fix timeout handling in dma_resv_wait_timeout v2
Input: xpad - support Acer NGR 200 Controller
Input: xpad - add VID for Turtle Beach controllers
Input: xpad - add support for Amazon Game Controller
NFSv4/flexfiles: Fix handling of NFS level errors in I/O
flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes
RDMA/mlx5: Fix vport loopback for MPV device
netlink: Fix rmem check in netlink_broadcast_deliver().
netlink: make sure we allow at least one dump skb
pwm: mediatek: Ensure to disable clocks in error path
Revert "ACPI: battery: negate current when discharging"
usb: gadget: u_serial: Fix race condition in TTY wakeup
drm/sched: Increment job count before swapping tail spsc queue
pinctrl: qcom: msm: mark certain pins as invalid for interrupts
x86/mce: Make sure CMCI banks are cleared during shutdown on Intel
x86/mce: Don't remove sysfs if thresholding sysfs init fails
x86/mce/amd: Fix threshold limit reset
rxrpc: Fix oops due to non-existence of prealloc backlog struct
net/sched: Abort __tc_modify_qdisc if parent class does not exist
atm: clip: Fix NULL pointer dereference in vcc_sendmsg()
atm: clip: Fix infinite recursive call of clip_push().
atm: clip: Fix memory leak of struct clip_vcc.
atm: clip: Fix potential null-ptr-deref in to_atmarpd().
tipc: Fix use-after-free in tipc_conn_close().
netlink: Fix wraparounds of sk->sk_rmem_alloc.
fix proc_sys_compare() handling of in-lookup dentries
proc: Clear the pieces of proc_inode that proc_evict_inode cares about
drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling
staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher()
media: uvcvideo: Rollback non processed entities on error
media: uvcvideo: Send control events for partial succeeds
media: uvcvideo: Return the number of processed controls
ACPI: PAD: fix crash in exit_round_robin()
usb: typec: displayport: Fix potential deadlock
Logitech C-270 even more broken
rose: fix dangling neighbour pointers in rose_rt_device_down()
net: rose: Fix fall-through warnings for Clang
drm/i915/gt: Fix timeline left held on VMA alloc error
drm/i915/selftests: Change mock_request() to return error pointers
spi: spi-fsl-dspi: Clear completion counter before initiating transfer
spi: spi-fsl-dspi: Fix interrupt-less DMA mode taking an XSPI code path
spi: spi-fsl-dspi: Rename fifo_{read,write} and {tx,cmd}_fifo_write
dpaa2-eth: fix xdp_rxq_info leak
ethernet: atl1: Add missing DMA mapping error checks and count errors
btrfs: use btrfs_record_snapshot_destroy() during rmdir
btrfs: propagate last_unlink_trans earlier when doing a rmdir
RDMA/mlx5: Fix CC counters query for MPV
RDMA/core: Create and destroy counters in the ib_core
scsi: ufs: core: Fix spelling of a sysfs attribute name
drm/v3d: Disable interrupts before resetting the GPU
mtk-sd: reset host->mrq on prepare_data() error
mtk-sd: Prevent memory corruption from DMA map failure
mmc: mediatek: use data instead of mrq parameter from msdc_{un}prepare_data()
regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods
regulator: gpio: Add input_supply support in gpio_regulator_config
ACPICA: Refuse to evaluate a method if arguments are missing
wifi: ath6kl: remove WARN on bad firmware input
wifi: mac80211: drop invalid source address OCB frames
powerpc: Fix struct termio related ioctl macros
ata: pata_cs5536: fix build on 32-bit UML
ALSA: sb: Force to disable DMAs once when DMA mode is changed
net/sched: Always pass notifications when child class becomes empty
nui: Fix dma_mapping_error() check
enic: fix incorrect MTU comparison in enic_change_mtu()
amd-xgbe: align CL37 AN sequence as per databook
lib: test_objagg: Set error message in check_expect_hints_stats()
drm/exynos: fimd: Guard display clock control with runtime PM calls
btrfs: fix missing error handling when searching for inode refs during log replay
scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu()
nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.
RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert
platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment
mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data
usb: typec: altmodes/displayport: do not index invalid pin_assignments
Revert "mmc: sdhci: Disable SD card clock before changing parameters"
mmc: sdhci: Add a helper function for dump register in dynamic debug mode
vsock/vmci: Clear the vmci transport packet properly when initializing it
btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
arm64: Restrict pagetable teardown to avoid false warning
s390: Add '-std=gnu11' to decompressor and purgatory CFLAGS
drm/bridge: cdns-dsi: Check return value when getting default PHY config
drm/bridge: cdns-dsi: Fix connecting to next bridge
drm/bridge: cdns-dsi: Fix the clock variable for mode_valid()
drm/tegra: Assign plane type before registration
HID: wacom: fix kobject reference count leak
HID: wacom: fix memory leak on sysfs attribute creation failure
HID: wacom: fix memory leak on kobject creation failure
dm-raid: fix variable in journal device check
Bluetooth: L2CAP: Fix L2CAP MTU negotiation
atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister().
net: enetc: Correct endianness handling in _enetc_rd_reg64
um: ubd: Add missing error check in start_io_thread()
vsock/uapi: fix linux/vm_sockets.h userspace compilation errors
wifi: mac80211: fix beacon interval calculation overflow
attach_recursive_mnt(): do not lock the covering tree when sliding something under it
ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3()
i2c: robotfuzz-osif: disable zero-length read messages
i2c: tiny-usb: disable zero-length read messages
RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction
RDMA/core: Use refcount_t instead of atomic_t on refcount of iwcm_id_private
media: vivid: Change the siize of the composing
media: omap3isp: use sgtable-based scatterlist wrappers
media: cxusb: no longer judge rbuf when the write fails
media: cxusb: use dev_dbg() rather than hand-rolled debug
jfs: validate AG parameters in dbMount() to prevent crashes
fs/jfs: consolidate sanity checking in dbMount
ASoC: meson: meson-card-utils: use of_property_present() for DT parsing
of: Add of_property_present() helper
of: property: define of_property_read_u{8,16,32,64}_array() unconditionally
kbuild: hdrcheck: fix cross build with clang
kbuild: add --target to correctly cross-compile UAPI headers with Clang
bpfilter: match bit size of bpfilter_umh to that of the kernel
kbuild: use -MMD instead of -MD to exclude system headers from dependency
VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify
VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF
ovl: Check for NULL d_inode() in ovl_dentry_upper()
ceph: fix possible integer overflow in ceph_zero_objects()
ALSA: hda: Ignore unsol events for cards being shut down
usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode
usb: cdc-wdm: avoid setting WDM_READ for ZLP-s
usb: Add checks for snprintf() calls in usb_alloc_dev()
tty: serial: uartlite: register uart driver in init
usb: potential integer overflow in usbg_make_tpg()
iio: pressure: zpa2326: Use aligned_s64 for the timestamp
md/md-bitmap: fix dm-raid max_write_behind setting
dmaengine: xilinx_dma: Set dma_device directions
mfd: max14577: Fix wakeup source leaks on device unbind
mailbox: Not protect module_put with spin_lock_irqsave
cifs: Fix cifs_query_path_info() for Windows NT servers
Change-Id: Iab323692f4cd5b0f16e981f8f4c1fbcdc4458aa5
Signed-off-by: kamasali Satyanarayan <kamasali@qti.qualcomm.com>
|
||
Lorenz Bauer
|
284d78b2e2 |
UPSTREAM: net: export inet_lookup_reuseport and inet6_lookup_reuseport
[ Upstream commit ce796e60b3b196b61fcc565df195443cbb846ef0 ] Rename the existing reuseport helpers for IPv4 and IPv6 so that they can be invoked in the follow up commit. Export them so that building DCCP and IPv6 as a module works. No change in functionality. Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com> Change-Id: If94e947663d80dc163813b736d81658a0e910660 Signed-off-by: Lorenz Bauer <lmb@isovalent.com> Link: https://lore.kernel.org/r/20230720-so-reuseport-v6-3-7021b683cdae@isovalent.com Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org> Stable-dep-of: 50aee97d1511 ("udp: Avoid call to compute_score on multiple sites") Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
|
Christoph Hellwig
|
75d0191fd1 |
UPSTREAM: net/udp: switch udp_lib_setsockopt to sockptr_t
Pass a sockptr_t to prepare for set_fs-less handling of the kernel pointer from bpf-cgroup. Change-Id: I52a7b51c25c679a672d967abf5195e4f82524840 Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: David S. Miller <davem@davemloft.net> |
||
Maciej Żenczykowski
|
c705a91305 |
BACKPORT: ANDROID: fix ABI by undoing atomic64_t -> u64 type conversion
This is pretty much a no-op, but avoids changing struct net ABI. Bug: 274789652 Test: builds, net_test Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: Ia744bdf0a026adccaef8382aaecc771a8d0763a6 |
||
Eric Dumazet
|
a4bd8ebc0a |
UPSTREAM: net: initialize net->net_cookie at netns setup
It is simpler to make net->net_cookie a plain u64 written once in setup_net() instead of looping and using atomic64 helpers. Lorenz Bauer wants to add SO_NETNS_COOKIE socket option and this patch would makes his patch series simpler. Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Daniel Borkmann <daniel@iogearbox.net> Cc: Lorenz Bauer <lmb@cloudflare.com> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Tested-by: Lorenz Bauer <lmb@cloudflare.com> Signed-off-by: David S. Miller <davem@davemloft.net> (cherry picked from commit 3d368ab87cf6681f928de1ddf804d69600671bb2) Bug: 274789652 Tested: builds, net_test passes Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: Ia4d018b37af2792f0a21de028f724193797c5138 |
||
|
Christoph Hellwig
|
ea043b3895 |
BACKPORT: net: add a new ndo_tunnel_ioctl method
This method is used to properly allow kernel callers of the IPv4 route management ioctls. The exsting ip_tunnel_ioctl helper is renamed to ip_tunnel_ctl to better reflect that it doesn't directly implement ioctls touching user memory, and is used for the guts of ndo_tunnel_ctl implementations. A new ip_tunnel_ioctl helper is added that can be wired up directly to the ndo_do_ioctl method and takes care of the copy to and from userspace. Change-Id: Iafa234e869ede811bc5f25ab3221151064156ac1 Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: David S. Miller <davem@davemloft.net> |
||
Daniel Borkmann
|
677fbf13cd |
UPSTREAM: bpf, net: Rework cookie generator as per-cpu one
With its use in BPF, the cookie generator can be called very frequently
in particular when used out of cgroup v2 hooks (e.g. connect / sendmsg)
and attached to the root cgroup, for example, when used in v1/v2 mixed
environments. In particular, when there's a high churn on sockets in the
system there can be many parallel requests to the bpf_get_socket_cookie()
and bpf_get_netns_cookie() helpers which then cause contention on the
atomic counter.
As similarly done in
|
||
|
Daniel Borkmann
|
92074107e8 |
UPSTREAM: bpf, net: Fix build issue when net ns not configured
Fix a redefinition of 'net_gen_cookie' error that was overlooked
when net ns is not configured.
Fixes: f318903c0bf4 ("bpf: Add netns cookie and enable it for bpf cgroup hooks")
Reported-by: kbuild test robot <lkp@intel.com>
Change-Id: Icec4b9f3709553111048d3389f6cd28e8e05f68e
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
|
||
Martin KaFai Lau
|
43e31c273d |
UPSTREAM: bpf: Change bpf_sk_storage_*() to accept ARG_PTR_TO_BTF_ID_SOCK_COMMON
This patch changes the bpf_sk_storage_*() to take ARG_PTR_TO_BTF_ID_SOCK_COMMON such that they will work with the pointer returned by the bpf_skc_to_*() helpers also. A micro benchmark has been done on a "cgroup_skb/egress" bpf program which does a bpf_sk_storage_get(). It was driven by netperf doing a 4096 connected UDP_STREAM test with 64bytes packet. The stats from "kernel.bpf_stats_enabled" shows no meaningful difference. The sk_storage_get_btf_proto, sk_storage_delete_btf_proto, btf_sk_storage_get_proto, and btf_sk_storage_delete_proto are no longer needed, so they are removed. Change-Id: I4547813f0fe3b60b277c508d02acc6d783a309ed Signed-off-by: Martin KaFai Lau <kafai@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Lorenz Bauer <lmb@cloudflare.com> Link: https://lore.kernel.org/bpf/20200925000402.3856307-1-kafai@fb.com |
||
|
Christoph Hellwig
|
a13a4c9122 |
BACKPORT: net: simplify cBPF setsockopt compat handling
Add a helper that copies either a native or compat bpf_fprog from userspace after verifying the length, and remove the compat setsockopt handlers that now aren't required. Change-Id: Ie62fb625ef94ad6d2148531c279e87e82524aae0 Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: David S. Miller <davem@davemloft.net> |
||
Neal Cardwell
|
2a7fa4a40c |
UPSTREAM: tcp: simplify tcp_set_congestion_control(): Always reinitialize
Now that the previous patches ensure that all call sites for tcp_set_congestion_control() want to initialize congestion control, we can simplify tcp_set_congestion_control() by removing the reinit argument and the code to support it. Change-Id: I540be122f644b05c35887358aee1484b8d04f65f Signed-off-by: Neal Cardwell <ncardwell@google.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Yuchung Cheng <ycheng@google.com> Acked-by: Kevin Yang <yyd@google.com> Cc: Lawrence Brakmo <brakmo@fb.com> |
||
KP Singh
|
e17091619f |
UPSTREAM: bpf: Allow local storage to be used from LSM programs
Adds support for both bpf_{sk, inode}_storage_{get, delete} to be used
in LSM programs. These helpers are not used for tracing programs
(currently) as their usage is tied to the life-cycle of the object and
should only be used where the owning object won't be freed (when the
owning object is passed as an argument to the LSM hook). Thus, they
are safer to use in LSM hooks than tracing. Usage of local storage in
tracing programs will probably follow a per function based whitelist
approach.
Since the UAPI helper signature for bpf_sk_storage expect a bpf_sock,
it, leads to a compilation warning for LSM programs, it's also updated
to accept a void * pointer instead.
Change-Id: I3b20b62f47095265fd8e00aa97032886edf3e407
Signed-off-by: KP Singh <kpsingh@google.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/20200825182919.1118197-7-kpsingh@chromium.org
|
||
|
KP Singh
|
7529ced097 |
UPSTREAM: bpf: Split bpf_local_storage to bpf_sk_storage
A purely mechanical change: bpf_sk_storage.c = bpf_sk_storage.c + bpf_local_storage.c bpf_sk_storage.h = bpf_sk_storage.h + bpf_local_storage.h Change-Id: Ie2a4690a8943b94a891dd2e34e47a0d4d9af692c Signed-off-by: KP Singh <kpsingh@google.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Martin KaFai Lau <kafai@fb.com> Link: https://lore.kernel.org/bpf/20200825182919.1118197-5-kpsingh@chromium.org |
||
|
KP Singh
|
b15c43f2c4 |
UPSTREAM: bpf: Generalize bpf_sk_storage
Refactor the functionality in bpf_sk_storage.c so that concept of storage linked to kernel objects can be extended to other objects like inode, task_struct etc. Each new local storage will still be a separate map and provide its own set of helpers. This allows for future object specific extensions and still share a lot of the underlying implementation. This includes the changes suggested by Martin in: https://lore.kernel.org/bpf/20200725013047.4006241-1-kafai@fb.com/ adding new map operations to support bpf_local_storage maps: * storages for different kernel objects to optionally have different memory charging strategy (map_local_storage_charge, map_local_storage_uncharge) * Functionality to extract the storage pointer from a pointer to the owning object (map_owner_storage_ptr) Co-developed-by: Martin KaFai Lau <kafai@fb.com> Change-Id: I22aaa39c14ea35eedea195c7d040757c243fbb56 Signed-off-by: Martin KaFai Lau <kafai@fb.com> Signed-off-by: KP Singh <kpsingh@google.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/20200825182919.1118197-4-kpsingh@chromium.org |
||
|
KP Singh
|
6976cda6d2 |
UPSTREAM: bpf: Generalize caching for sk_storage.
Provide the a ability to define local storage caches on a per-object type basis. The caches and caching indices for different objects should not be inter-mixed as suggested in: https://lore.kernel.org/bpf/20200630193441.kdwnkestulg5erii@kafai-mbp.dhcp.thefacebook.com/ "Caching a sk-storage at idx=0 of a sk should not stop an inode-storage to be cached at the same idx of a inode." Change-Id: I3c3405101365fe62960b104084a77274da0cc912 Signed-off-by: KP Singh <kpsingh@google.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Martin KaFai Lau <kafai@fb.com> Link: https://lore.kernel.org/bpf/20200825182919.1118197-3-kpsingh@chromium.org |
||
|
KP Singh
|
8bcac7418f |
BACKPORT: bpf: Renames in preparation for bpf_local_storage
A purely mechanical change to split the renaming from the actual generalization. Flags/consts: SK_STORAGE_CREATE_FLAG_MASK BPF_LOCAL_STORAGE_CREATE_FLAG_MASK BPF_SK_STORAGE_CACHE_SIZE BPF_LOCAL_STORAGE_CACHE_SIZE MAX_VALUE_SIZE BPF_LOCAL_STORAGE_MAX_VALUE_SIZE Structs: bucket bpf_local_storage_map_bucket bpf_sk_storage_map bpf_local_storage_map bpf_sk_storage_data bpf_local_storage_data bpf_sk_storage_elem bpf_local_storage_elem bpf_sk_storage bpf_local_storage The "sk" member in bpf_local_storage is also updated to "owner" in preparation for changing the type to void * in a subsequent patch. Functions: selem_linked_to_sk selem_linked_to_storage selem_alloc bpf_selem_alloc __selem_unlink_sk bpf_selem_unlink_storage_nolock __selem_link_sk bpf_selem_link_storage_nolock selem_unlink_sk __bpf_selem_unlink_storage sk_storage_update bpf_local_storage_update __sk_storage_lookup bpf_local_storage_lookup bpf_sk_storage_map_free bpf_local_storage_map_free bpf_sk_storage_map_alloc bpf_local_storage_map_alloc bpf_sk_storage_map_alloc_check bpf_local_storage_map_alloc_check bpf_sk_storage_map_check_btf bpf_local_storage_map_check_btf Change-Id: I282ab51390db10efbfccf54cd25896abbd6582cb Signed-off-by: KP Singh <kpsingh@google.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Martin KaFai Lau <kafai@fb.com> Link: https://lore.kernel.org/bpf/20200825182919.1118197-2-kpsingh@chromium.org |
||
|
Martin KaFai Lau
|
b9aaf9a4a6 |
BACKPORT: tcp: bpf: Optionally store mac header in TCP_SAVE_SYN
This patch is adapted from Eric's patch in an earlier discussion [1]. The TCP_SAVE_SYN currently only stores the network header and tcp header. This patch allows it to optionally store the mac header also if the setsockopt's optval is 2. It requires one more bit for the "save_syn" bit field in tcp_sock. This patch achieves this by moving the syn_smc bit next to the is_mptcp. The syn_smc is currently used with the TCP experimental option. Since syn_smc is only used when CONFIG_SMC is enabled, this patch also puts the "IS_ENABLED(CONFIG_SMC)" around it like the is_mptcp did with "IS_ENABLED(CONFIG_MPTCP)". The mac_hdrlen is also stored in the "struct saved_syn" to allow a quick offset from the bpf prog if it chooses to start getting from the network header or the tcp header. [1]: https://lore.kernel.org/netdev/CANn89iLJNWh6bkH7DNhy_kmcAexuUCccqERqe7z2QsvPhGrYPQ@mail.gmail.com/ Suggested-by: Eric Dumazet <edumazet@google.com> Change-Id: Ib5dd358e17dbc89275dbbdef4eff1fb9fc2c318c Signed-off-by: Martin KaFai Lau <kafai@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://lore.kernel.org/bpf/20200820190123.2886935-1-kafai@fb.com |
||
|
Martin KaFai Lau
|
fde321706d |
UPSTREAM: bpf: tcp: Allow bpf prog to write and parse TCP header option
[ Note: The TCP changes here is mainly to implement the bpf
pieces into the bpf_skops_*() functions introduced
in the earlier patches. ]
The earlier effort in BPF-TCP-CC allows the TCP Congestion Control
algorithm to be written in BPF. It opens up opportunities to allow
a faster turnaround time in testing/releasing new congestion control
ideas to production environment.
The same flexibility can be extended to writing TCP header option.
It is not uncommon that people want to test new TCP header option
to improve the TCP performance. Another use case is for data-center
that has a more controlled environment and has more flexibility in
putting header options for internal only use.
For example, we want to test the idea in putting maximum delay
ACK in TCP header option which is similar to a draft RFC proposal [1].
This patch introduces the necessary BPF API and use them in the
TCP stack to allow BPF_PROG_TYPE_SOCK_OPS program to parse
and write TCP header options. It currently supports most of
the TCP packet except RST.
Supported TCP header option:
───────────────────────────
This patch allows the bpf-prog to write any option kind.
Different bpf-progs can write its own option by calling the new helper
bpf_store_hdr_opt(). The helper will ensure there is no duplicated
option in the header.
By allowing bpf-prog to write any option kind, this gives a lot of
flexibility to the bpf-prog. Different bpf-prog can write its
own option kind. It could also allow the bpf-prog to support a
recently standardized option on an older kernel.
Sockops Callback Flags:
──────────────────────
The bpf program will only be called to parse/write tcp header option
if the following newly added callback flags are enabled
in tp->bpf_sock_ops_cb_flags:
BPF_SOCK_OPS_PARSE_UNKNOWN_HDR_OPT_CB_FLAG
BPF_SOCK_OPS_PARSE_ALL_HDR_OPT_CB_FLAG
BPF_SOCK_OPS_WRITE_HDR_OPT_CB_FLAG
A few words on the PARSE CB flags. When the above PARSE CB flags are
turned on, the bpf-prog will be called on packets received
at a sk that has at least reached the ESTABLISHED state.
The parsing of the SYN-SYNACK-ACK will be discussed in the
"3 Way HandShake" section.
The default is off for all of the above new CB flags, i.e. the bpf prog
will not be called to parse or write bpf hdr option. There are
details comment on these new cb flags in the UAPI bpf.h.
sock_ops->skb_data and bpf_load_hdr_opt()
─────────────────────────────────────────
sock_ops->skb_data and sock_ops->skb_data_end covers the whole
TCP header and its options. They are read only.
The new bpf_load_hdr_opt() helps to read a particular option "kind"
from the skb_data.
Please refer to the comment in UAPI bpf.h. It has details
on what skb_data contains under different sock_ops->op.
3 Way HandShake
───────────────
The bpf-prog can learn if it is sending SYN or SYNACK by reading the
sock_ops->skb_tcp_flags.
* Passive side
When writing SYNACK (i.e. sock_ops->op == BPF_SOCK_OPS_WRITE_HDR_OPT_CB),
the received SYN skb will be available to the bpf prog. The bpf prog can
use the SYN skb (which may carry the header option sent from the remote bpf
prog) to decide what bpf header option should be written to the outgoing
SYNACK skb. The SYN packet can be obtained by getsockopt(TCP_BPF_SYN*).
More on this later. Also, the bpf prog can learn if it is in syncookie
mode (by checking sock_ops->args[0] == BPF_WRITE_HDR_TCP_SYNACK_COOKIE).
The bpf prog can store the received SYN pkt by using the existing
bpf_setsockopt(TCP_SAVE_SYN). The example in a later patch does it.
[ Note that the fullsock here is a listen sk, bpf_sk_storage
is not very useful here since the listen sk will be shared
by many concurrent connection requests.
Extending bpf_sk_storage support to request_sock will add weight
to the minisock and it is not necessary better than storing the
whole ~100 bytes SYN pkt. ]
When the connection is established, the bpf prog will be called
in the existing PASSIVE_ESTABLISHED_CB callback. At that time,
the bpf prog can get the header option from the saved syn and
then apply the needed operation to the newly established socket.
The later patch will use the max delay ack specified in the SYN
header and set the RTO of this newly established connection
as an example.
The received ACK (that concludes the 3WHS) will also be available to
the bpf prog during PASSIVE_ESTABLISHED_CB through the sock_ops->skb_data.
It could be useful in syncookie scenario. More on this later.
There is an existing getsockopt "TCP_SAVED_SYN" to return the whole
saved syn pkt which includes the IP[46] header and the TCP header.
A few "TCP_BPF_SYN*" getsockopt has been added to allow specifying where to
start getting from, e.g. starting from TCP header, or from IP[46] header.
The new getsockopt(TCP_BPF_SYN*) will also know where it can get
the SYN's packet from:
- (a) the just received syn (available when the bpf prog is writing SYNACK)
and it is the only way to get SYN during syncookie mode.
or
- (b) the saved syn (available in PASSIVE_ESTABLISHED_CB and also other
existing CB).
The bpf prog does not need to know where the SYN pkt is coming from.
The getsockopt(TCP_BPF_SYN*) will hide this details.
Similarly, a flags "BPF_LOAD_HDR_OPT_TCP_SYN" is also added to
bpf_load_hdr_opt() to read a particular header option from the SYN packet.
* Fastopen
Fastopen should work the same as the regular non fastopen case.
This is a test in a later patch.
* Syncookie
For syncookie, the later example patch asks the active
side's bpf prog to resend the header options in ACK. The server
can use bpf_load_hdr_opt() to look at the options in this
received ACK during PASSIVE_ESTABLISHED_CB.
* Active side
The bpf prog will get a chance to write the bpf header option
in the SYN packet during WRITE_HDR_OPT_CB. The received SYNACK
pkt will also be available to the bpf prog during the existing
ACTIVE_ESTABLISHED_CB callback through the sock_ops->skb_data
and bpf_load_hdr_opt().
* Turn off header CB flags after 3WHS
If the bpf prog does not need to write/parse header options
beyond the 3WHS, the bpf prog can clear the bpf_sock_ops_cb_flags
to avoid being called for header options.
Or the bpf-prog can select to leave the UNKNOWN_HDR_OPT_CB_FLAG on
so that the kernel will only call it when there is option that
the kernel cannot handle.
[1]: draft-wang-tcpm-low-latency-opt-00
https://tools.ietf.org/html/draft-wang-tcpm-low-latency-opt-00
Change-Id: Ib7471831fda8cfc0a33638b4e35b39307af82c55
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20200820190104.2885895-1-kafai@fb.com
|
||
|
Martin KaFai Lau
|
6f2dbfbdf8 |
BACKPORT: bpf: tcp: Add bpf_skops_hdr_opt_len() and bpf_skops_write_hdr_opt()
The bpf prog needs to parse the SYN header to learn what options have been sent by the peer's bpf-prog before writing its options into SYNACK. This patch adds a "syn_skb" arg to tcp_make_synack() and send_synack(). This syn_skb will eventually be made available (as read-only) to the bpf prog. This will be the only SYN packet available to the bpf prog during syncookie. For other regular cases, the bpf prog can also use the saved_syn. When writing options, the bpf prog will first be called to tell the kernel its required number of bytes. It is done by the new bpf_skops_hdr_opt_len(). The bpf prog will only be called when the new BPF_SOCK_OPS_WRITE_HDR_OPT_CB_FLAG is set in tp->bpf_sock_ops_cb_flags. When the bpf prog returns, the kernel will know how many bytes are needed and then update the "*remaining" arg accordingly. 4 byte alignment will be included in the "*remaining" before this function returns. The 4 byte aligned number of bytes will also be stored into the opts->bpf_opt_len. "bpf_opt_len" is a newly added member to the struct tcp_out_options. Then the new bpf_skops_write_hdr_opt() will call the bpf prog to write the header options. The bpf prog is only called if it has reserved spaces before (opts->bpf_opt_len > 0). The bpf prog is the last one getting a chance to reserve header space and writing the header option. These two functions are half implemented to highlight the changes in TCP stack. The actual codes preparing the bpf running context and invoking the bpf prog will be added in the later patch with other necessary bpf pieces. Change-Id: Ic9a465606f58b70179be9d60b30c212528238766 Signed-off-by: Martin KaFai Lau <kafai@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://lore.kernel.org/bpf/20200820190052.2885316-1-kafai@fb.com |
||
|
Martin KaFai Lau
|
4cbcd7d560 |
UPSTREAM: bpf: tcp: Add bpf_skops_established()
In tcp_init_transfer(), it currently calls the bpf prog to give it a chance to handle the just "ESTABLISHED" event (e.g. do setsockopt on the newly established sk). Right now, it is done by calling the general purpose tcp_call_bpf(). In the later patch, it also needs to pass the just-received skb which concludes the 3 way handshake. E.g. the SYNACK received at the active side. The bpf prog can then learn some specific header options written by the peer's bpf-prog and potentially do setsockopt on the newly established sk. Thus, instead of reusing the general purpose tcp_call_bpf(), a new function bpf_skops_established() is added to allow passing the "skb" to the bpf prog. The actual skb passing from bpf_skops_established() to the bpf prog will happen together in a later patch which has the necessary bpf pieces. A "skb" arg is also added to tcp_init_transfer() such that it can then be passed to bpf_skops_established(). Calling the new bpf_skops_established() instead of tcp_call_bpf() should be a noop in this patch. Change-Id: I9347e4608ca3c5d6927f7116cad9948c05227b3f Signed-off-by: Martin KaFai Lau <kafai@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: John Fastabend <john.fastabend@gmail.com> Link: https://lore.kernel.org/bpf/20200820190039.2884750-1-kafai@fb.com |
||
|
Martin KaFai Lau
|
a26e10aa1c |
UPSTREAM: tcp: bpf: Add TCP_BPF_RTO_MIN for bpf_setsockopt
This patch adds bpf_setsockopt(TCP_BPF_RTO_MIN) to allow bpf prog to set the min rto of a connection. It could be used together with the earlier patch which has added bpf_setsockopt(TCP_BPF_DELACK_MAX). A later selftest patch will communicate the max delay ack in a bpf tcp header option and then the receiving side can use bpf_setsockopt(TCP_BPF_RTO_MIN) to set a shorter rto. Change-Id: Ifd2e4b1660283ba7f582d1894c8ffd9a12817fac Signed-off-by: Martin KaFai Lau <kafai@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Reviewed-by: Eric Dumazet <edumazet@google.com> Acked-by: John Fastabend <john.fastabend@gmail.com> Link: https://lore.kernel.org/bpf/20200820190027.2884170-1-kafai@fb.com |
||
|
Martin KaFai Lau
|
9768c9f10c |
UPSTREAM: tcp: bpf: Add TCP_BPF_DELACK_MAX setsockopt
This change is mostly from an internal patch and adapts it from sysctl config to the bpf_setsockopt setup. The bpf_prog can set the max delay ack by using bpf_setsockopt(TCP_BPF_DELACK_MAX). This max delay ack can be communicated to its peer through bpf header option. The receiving peer can then use this max delay ack and set a potentially lower rto by using bpf_setsockopt(TCP_BPF_RTO_MIN) which will be introduced in the next patch. Another later selftest patch will also use it like the above to show how to write and parse bpf tcp header option. Change-Id: Ia2591a16e948ced059df4b1e1447360e7aab9e0f Signed-off-by: Martin KaFai Lau <kafai@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Reviewed-by: Eric Dumazet <edumazet@google.com> Acked-by: John Fastabend <john.fastabend@gmail.com> Link: https://lore.kernel.org/bpf/20200820190021.2884000-1-kafai@fb.com |
||
|
Martin KaFai Lau
|
65c272f187 |
BACKPORT: tcp: Use a struct to represent a saved_syn
The TCP_SAVE_SYN has both the network header and tcp header. The total length of the saved syn packet is currently stored in the first 4 bytes (u32) of an array and the actual packet data is stored after that. A later patch will add a bpf helper that allows to get the tcp header alone from the saved syn without the network header. It will be more convenient to have a direct offset to a specific header instead of re-parsing it. This requires to separately store the network hdrlen. The total header length (i.e. network + tcp) is still needed for the current usage in getsockopt. Although this total length can be obtained by looking into the tcphdr and then get the (th->doff << 2), this patch chooses to directly store the tcp hdrlen in the second four bytes of this newly created "struct saved_syn". By using a new struct, it can give a readable name to each individual header length. Change-Id: I4ba88ba12fed185f61c74c01b4eaf7f09d26299b Signed-off-by: Martin KaFai Lau <kafai@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Reviewed-by: Eric Dumazet <edumazet@google.com> Acked-by: John Fastabend <john.fastabend@gmail.com> Link: https://lore.kernel.org/bpf/20200820190014.2883694-1-kafai@fb.com |
||
Jakub Kicinski
|
2b19312f62 |
BACKPORT: udp_tunnel: add central NIC RX port offload infrastructure
Cater to devices which: (a) may want to sleep in the callbacks; (b) only have IPv4 support; (c) need all the programming to happen while the netdev is up. Drivers attach UDP tunnel offload info struct to their netdevs, where they declare how many UDP ports of various tunnel types they support. Core takes care of tracking which ports to offload. Use a fixed-size array since this matches what almost all drivers do, and avoids a complexity and uncertainty around memory allocations in an atomic context. Make sure that tunnel drivers don't try to replay the ports when new NIC netdev is registered. Automatic replays would mess up reference counting, and will be removed completely once all drivers are converted. v4: - use a #define NULL to avoid build issues with CONFIG_INET=n. Change-Id: I1e704ed5de90fb40f7e9091f08a69e4f7432bd05 Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net> |
||
Jiri Pirko
|
4ba1380aff |
UPSTREAM: net: push loops and nb calls into helper functions
Push iterations over net namespaces and netdevices from register_netdevice_notifier() and unregister_netdevice_notifier() into helper functions. Along with that introduce continue_reverse macros to make the code a bit nicer allowing to get rid of "last" marks. Change-Id: I419ca079d08b5123c3897ac7cef67b08f1feb418 Signed-off-by: Jiri Pirko <jiri@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net> |
||
|
Jiri Pirko
|
bd321d3765 |
BACKPORT: net: introduce per-netns netdevice notifiers
Often the code for example in drivers is interested in getting notifier call only from certain network namespace. In addition to the existing global netdevice notifier chain introduce per-netns chains and allow users to register to that. Eventually this would eliminate unnecessary overhead in case there are many netdevices in many network namespaces. Change-Id: I38034dcf12b8d373039ae147425baf433ac3aed4 Signed-off-by: Jiri Pirko <jiri@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net> |
||
Yonghong Song
|
dc0e88fef3 |
UPSTREAM: net: bpf: Add bpf_seq_afinfo in udp_iter_state
Similar to tcp_iter_state, a new field bpf_seq_afinfo is
added to udp_iter_state to provide bpf udp iterator
afinfo.
This does not change /proc/net/{udp, udp6} behavior. But
it enables bpf iterator to avoid get afinfo from PDE_DATA
and iterate through all udp and udp6 sockets in one pass.
Change-Id: I75e4639ec944f57ce0f05c2b4a4d728f69aa806f
Signed-off-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/20200623230812.3988347-1-yhs@fb.com
|
||
|
Yonghong Song
|
b02622b77e |
UPSTREAM: net: bpf: Add bpf_seq_afinfo in tcp_iter_state
A new field bpf_seq_afinfo is added to tcp_iter_state
to provide bpf tcp iterator afinfo. There are two
reasons on why we did this.
First, the current way to get afinfo from PDE_DATA
does not work for bpf iterator as its seq_file
inode does not conform to /proc/net/{tcp,tcp6}
inode structures. More specifically, anonymous
bpf iterator will use an anonymous inode which
is shared in the system and we cannot change inode
private data structure at all.
Second, bpf iterator for tcp/tcp6 wants to
traverse all tcp and tcp6 sockets in one pass
and bpf program can control whether they want
to skip one sk_family or not. Having a different
afinfo with family AF_UNSPEC make it easier
to understand in the code.
This patch does not change /proc/net/{tcp,tcp6} behavior
as the bpf_seq_afinfo will be NULL for these two proc files.
Change-Id: I6bc5c311247e884bf76c8d133bf9b820706a1ce0
Signed-off-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/20200623230804.3987829-1-yhs@fb.com
|
||
Lorenzo Bianconi
|
8dc9e8ccbe |
UPSTREAM: bpf: cpumap: Add the possibility to attach an eBPF program to cpumap
Introduce the capability to attach an eBPF program to cpumap entries. The idea behind this feature is to add the possibility to define on which CPU run the eBPF program if the underlying hw does not support RSS. Current supported verdicts are XDP_DROP and XDP_PASS. This patch has been tested on Marvell ESPRESSObin using xdp_redirect_cpu sample available in the kernel tree to identify possible performance regressions. Results show there are no observable differences in packet-per-second: $./xdp_redirect_cpu --progname xdp_cpu_map0 --dev eth0 --cpu 1 rx: 354.8 Kpps rx: 356.0 Kpps rx: 356.8 Kpps rx: 356.3 Kpps rx: 356.6 Kpps rx: 356.6 Kpps rx: 356.7 Kpps rx: 355.8 Kpps rx: 356.8 Kpps rx: 356.8 Kpps Co-developed-by: Jesper Dangaard Brouer <brouer@redhat.com> Change-Id: Ib09a822f483667441e6b287a3ac694a82e9e3e0f Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Jesper Dangaard Brouer <brouer@redhat.com> Link: https://lore.kernel.org/bpf/5c9febdf903d810b3415732e5cd98491d7d9067a.1594734381.git.lorenzo@kernel.org |
||
David Ahern
|
f05c0811f0 |
BACKPORT: net: Refactor xdp_convert_buff_to_frame
Move the guts of xdp_convert_buff_to_frame to a new helper, xdp_update_frame_from_buff so it can be reused removing code duplication Suggested-by: Jesper Dangaard Brouer <brouer@redhat.com> Co-developed-by: Lorenzo Bianconi <lorenzo@kernel.org> Change-Id: Iafc031ea7f715930756839d27a82160548820c09 Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: David Ahern <dsahern@kernel.org> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Jesper Dangaard Brouer <brouer@redhat.com> Link: https://lore.kernel.org/bpf/90a68c283d7ebeb48924934c9b7ac79492300472.1594734381.git.lorenzo@kernel.org |
||
|
Lorenzo Bianconi
|
35048d912b |
UPSTREAM: xdp: Introduce xdp_convert_frame_to_buff utility routine
Introduce xdp_convert_frame_to_buff utility routine to initialize xdp_buff fields from xdp_frames ones. Rely on xdp_convert_frame_to_buff in veth xdp code. Suggested-by: Jesper Dangaard Brouer <brouer@redhat.com> Change-Id: I109367622d05333bcdd41ea460986776114a949a Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Jesper Dangaard Brouer <brouer@redhat.com> Link: https://lore.kernel.org/bpf/87acf133073c4b2d4cbb8097e8c2480c0a0fac32.1590698295.git.lorenzo@kernel.org |
||
|
Martin KaFai Lau
|
f1662945b5 |
UPSTREAM: bpf: net: Avoid incorrect bpf_sk_reuseport_detach call
bpf_sk_reuseport_detach is currently called when sk->sk_user_data
is not NULL. It is incorrect because sk->sk_user_data may not be
managed by the bpf's reuseport_array. It has been reported in [1] that,
the bpf_sk_reuseport_detach() which is called from udp_lib_unhash() has
corrupted the sk_user_data managed by l2tp.
This patch solves it by using another bit (defined as SK_USER_DATA_BPF)
of the sk_user_data pointer value. It marks that a sk_user_data is
managed/owned by BPF.
The patch depends on a PTRMASK introduced in
commit f1ff5ce2cd5e ("net, sk_msg: Clear sk_user_data pointer on clone if tagged").
[ Note: sk->sk_user_data is used by bpf's reuseport_array only when a sk is
added to the bpf's reuseport_array.
i.e. doing setsockopt(SO_REUSEPORT) and having "sk->sk_reuseport == 1"
alone will not stop sk->sk_user_data being used by other means. ]
[1]: https://lore.kernel.org/netdev/20200706121259.GA20199@katalix.com/
Fixes:
|
||
Jakub Sitnicki
|
f4e72872b3 |
UPSTREAM: net, sk_msg: Clear sk_user_data pointer on clone if tagged
sk_user_data can hold a pointer to an object that is not intended to be
shared between the parent socket and the child that gets a pointer copy on
clone. This is the case when sk_user_data points at reference-counted
object, like struct sk_psock.
One way to resolve it is to tag the pointer with a no-copy flag by
repurposing its lowest bit. Based on the bit-flag value we clear the child
sk_user_data pointer after cloning the parent socket.
The no-copy flag is stored in the pointer itself as opposed to externally,
say in socket flags, to guarantee that the pointer and the flag are copied
from parent to child socket in an atomic fashion. Parent socket state is
subject to change while copying, we don't hold any locks at that time.
This approach relies on an assumption that sk_user_data holds a pointer to
an object aligned at least 2 bytes. A manual audit of existing users of
rcu_dereference_sk_user_data helper confirms our assumption.
Also, an RCU-protected sk_user_data is not likely to hold a pointer to a
char value or a pathological case of "struct { char c; }". To be safe, warn
when the flag-bit is set when setting sk_user_data to catch any future
misuses.
It is worth considering why clearing sk_user_data unconditionally is not an
option. There exist users, DRBD, NVMe, and Xen drivers being among them,
that rely on the pointer being copied when cloning the listening socket.
Potentially we could distinguish these users by checking if the listening
socket has been created in kernel-space via sock_create_kern, and hence has
sk_kern_sock flag set. However, this is not the case for NVMe and Xen
drivers, which create sockets without marking them as belonging to the
kernel.
Change-Id: I9b5d753faa1e1c3e105cb9071b22080831cbf061
Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/20200218171023.844439-3-jakub@cloudflare.com
|
||
|
Jakub Sitnicki
|
0cf06755da |
UPSTREAM: bpf, netns: Keep a list of attached bpf_link's
To support multi-prog link-based attachments for new netns attach types, we need to keep track of more than one bpf_link per attach type. Hence, convert net->bpf.links into a list, that currently can be either empty or have just one item. Instead of reusing bpf_prog_list from bpf-cgroup, we link together bpf_netns_link's themselves. This makes list management simpler as we don't have to allocate, initialize, and later release list elements. We can do this because multi-prog attachment will be available only for bpf_link, and we don't need to build a list of programs attached directly and indirectly via links. No functional changes intended. Change-Id: I64d0c6fe7c9fa3a50b81071345bb7e9458df1aff Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Andrii Nakryiko <andriin@fb.com> Acked-by: Martin KaFai Lau <kafai@fb.com> Link: https://lore.kernel.org/bpf/20200625141357.910330-4-jakub@cloudflare.com |
||
|
Jakub Sitnicki
|
b033823934 |
UPSTREAM: bpf, netns: Keep attached programs in bpf_prog_array
Prepare for having multi-prog attachments for new netns attach types by storing programs to run in a bpf_prog_array, which is well suited for iterating over programs and running them in sequence. After this change bpf(PROG_QUERY) may block to allocate memory in bpf_prog_array_copy_to_user() for collected program IDs. This forces a change in how we protect access to the attached program in the query callback. Because bpf_prog_array_copy_to_user() can sleep, we switch from an RCU read lock to holding a mutex that serializes updaters. Because we allow only one BPF flow_dissector program to be attached to netns at all times, the bpf_prog_array pointed by net->bpf.run_array is always either detached (null) or one element long. No functional changes intended. Change-Id: I9c35fccef7fc323a73f49ba3066b60baa7d1fb03 Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Martin KaFai Lau <kafai@fb.com> Acked-by: Andrii Nakryiko <andriin@fb.com> Link: https://lore.kernel.org/bpf/20200625141357.910330-3-jakub@cloudflare.com |
||
|
Jakub Sitnicki
|
7aee29d442 |
UPSTREAM: flow_dissector: Pull BPF program assignment up to bpf-netns
Prepare for using bpf_prog_array to store attached programs by moving out code that updates the attached program out of flow dissector. Managing bpf_prog_array is more involved than updating a single bpf_prog pointer. This will let us do it all from one place, bpf/net_namespace.c, in the subsequent patch. No functional change intended. Change-Id: I3e347b0401b328c2bf355c6559c4fe43ee5cd19d Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Andrii Nakryiko <andriin@fb.com> Acked-by: Martin KaFai Lau <kafai@fb.com> Link: https://lore.kernel.org/bpf/20200625141357.910330-2-jakub@cloudflare.com |
||
Dmitry Yakunin
|
55cc20722d |
BACKPORT: sock: Move sock_valbool_flag to header
This is preparation for usage in bpf_setsockopt. Change-Id: I13c4392ffff4c19f40bdf36b22f6bf0ed760de2a Signed-off-by: Dmitry Yakunin <zeil@yandex-team.ru> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Martin KaFai Lau <kafai@fb.com> Link: https://lore.kernel.org/bpf/20200620153052.9439-1-zeil@yandex-team.ru |
||
Ahmed Abdelsalam
|
86527f07f5 |
UPSTREAM: seg6: fix seg6_validate_srh() to avoid slab-out-of-bounds
The seg6_validate_srh() is used to validate SRH for three cases: case1: SRH of data-plane SRv6 packets to be processed by the Linux kernel. Case2: SRH of the netlink message received from user-space (iproute2) Case3: SRH injected into packets through setsockopt In case1, the SRH can be encoded in the Reduced way (i.e., first SID is carried in DA only and not represented as SID in the SRH) and the seg6_validate_srh() now handles this case correctly. In case2 and case3, the SRH shouldn’t be encoded in the Reduced way otherwise we lose the first segment (i.e., the first hop). The current implementation of the seg6_validate_srh() allow SRH of case2 and case3 to be encoded in the Reduced way. This leads a slab-out-of-bounds problem. This patch verifies SRH of case1, case2 and case3. Allowing case1 to be reduced while preventing SRH of case2 and case3 from being reduced . Reported-by: syzbot+e8c028b62439eac42073@syzkaller.appspotmail.com Reported-by: YueHaibing <yuehaibing@huawei.com> Fixes: 0cb7498f234e ("seg6: fix SRH processing to comply with RFC8754") Change-Id: I2917c075b16c8887f80f74f380e2f26b12d1c19c Signed-off-by: Ahmed Abdelsalam <ahabdels@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> |