As INIT_WORK during suspend resume path is
only supported with bus scaling support
hence use the same check for flush_work.
Change-Id: I5172d574a2bc33a1cdba1fead7e6c4208648448c
Signed-off-by: Monika Singh <monising@codeaurora.org>
Checkpatch tool generates some errors and warnings due to added PM QoS feature
This change fixes these issues.
Change-Id: I0843ecd33144d7ac65649ee90ed156e97a1a2f8a
Signed-off-by: George Gao <georgao@codeaurora.org>
They're used only in their own source files so just mark them static.
Change-Id: Ie8699f97074a5838af4bc6eab4c1108258b97e4c
Signed-off-by: Alexander Winkowski <dereference23@outlook.com>
Cross-checked with msm-5.15 tag. The change does not exist as a separate
commit and is squashed into the initial import.
Change-Id: I8ba245606f8b538c9bf3dbdc9dfb621fea721de8
Signed-off-by: Alexander Winkowski <dereference23@outlook.com>
Cross-checked with msm-5.15 tag. The change does not exist as a separate
commit and is squashed into the initial import.
Change-Id: Ie922c512d7ea24661d3179cfd156ab8eb6fcc363
Signed-off-by: Alexander Winkowski <dereference23@outlook.com>
Caused by upstream patch applied on top of 87ebbd27e9
("usb: dwc3: gadget: Ignore ENDXFER completion for GSI endpoints").
Change-Id: Icf843d03752496c6c8ad214ad7b8c02b8d3b6a9b
Signed-off-by: Alexander Winkowski <dereference23@outlook.com>
Cross-checked with msm-4.14 and msm-5.15 tags. The change does not exist
as a separate commit and is squashed into the initial import.
Change-Id: Ib3defedf0fbd5b7cdccdfba26383313ff05b4ef0
Signed-off-by: Alexander Winkowski <dereference23@outlook.com>
It was disabled in aa30ee3b61. Let's fix these warnings instead.
Change-Id: Id3f9b4a5f7eed17f7fb10633e3dc378923b80a60
Signed-off-by: Alexander Winkowski <dereference23@outlook.com>
Suspend attempts can abort when the FUSE daemon is already frozen
and a client is waiting uninterruptibly for a response, causing
freezing of tasks to fail.
Use the freeze-friendly wait API, but disregard other signals.
Change-Id: Icefb7e4bbc718ccb76bf3c04daaa5eeea7e0e63c
Signed-off-by: Todd Poynor <toddpoynor@google.com>
Signed-off-by: Tashfin Shakeer Rhythm <tashfinshakeerrhythm@gmail.com>
When FUSE passthrough is used, the lower file system file is manipulated
directly, but neither mtime, atime or ctime of the referencing FUSE file
is updated.
Fix by updating the file times when passthrough operations are
performed.
Bug: 200779468
Bug: 201730208
Reported-by: Fengnan Chang <changfengnan@vivo.com>
Reported-by: Ed Tsai <ed.tsai@mediatek.com>
Signed-off-by: Alessio Balsini <balsini@google.com>
Change-Id: I35b72196b2cc1d79a9f62ddb32e2cfa934c3b6d3
With commit f8425c939663 ("fuse: 32-bit user space ioctl compat for fuse
device") the matching constraints for the FUSE_DEV_IOC_CLONE ioctl command
are relaxed, limited to the testing of command type and number. As Arnd
noticed, this is wrong as it wouldn't ensure the correctness of the data
size or direction for the received FUSE device ioctl.
Fix by bringing back the comparison of the ioctl received by the FUSE
device to the originally generated FUSE_DEV_IOC_CLONE.
Fixes: f8425c939663 ("fuse: 32-bit user space ioctl compat for fuse device")
Reported-by: Arnd Bergmann <arnd@kernel.org>
Signed-off-by: Alessio Balsini <balsini@android.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Alessio Balsini <balsini@android.com>
Change-Id: I372d8399db6d603ba20ef50528acf6645e4d3c66
(cherry picked from commit 6076f5f341e612152879bfda99f0b76c1953bf0b)
The initial FUSE passthrough interface has the issue of introducing an
ioctl which receives as a parameter a data structure containing a
pointer. What happens is that, depending on the architecture, the size
of this struct might change, and especially for 32-bit userspace running
on 64-bit kernel, the size mismatch results into different a single
ioctl the behavior of which depends on the data that is passed (e.g.,
with an enum). This is just a poor ioctl design as mentioned by Arnd
Bergmann [1].
Introduce the new FUSE_PASSTHROUGH_OPEN ioctl which only gets the fd of
the lower file system, which is a fixed-size __u32, dropping the
confusing fuse_passthrough_out data structure.
[1] https://lore.kernel.org/lkml/CAK8P3a2K2FzPvqBYL9W=Yut58SFXyetXwU4Fz50G5O3TsS0pPQ@mail.gmail.com/
Bug: 175195837
Signed-off-by: Alessio Balsini <balsini@google.com>
Change-Id: I486d71cbe20f3c0c87544fa75da4e2704fe57c7c
If the system doesn't have enough memory when fuse_passthrough_read_iter
is requested in asynchronous IO, an error is directly returned without
restoring the caller's credentials.
Fix by always ensuring credentials are restored.
Fixes: aa29f32988c1f84c96e2457b049dea437601f2cc ("FROMLIST: fuse: Use daemon creds in passthrough mode")
Link: https://lore.kernel.org/lkml/YB0qPHVORq7bJy6G@google.com/
Reported-by: Peng Tao <bergwolf@gmail.com>
Signed-off-by: Alessio Balsini <balsini@android.com>
Signed-off-by: Alessio Balsini <balsini@google.com>
Change-Id: I4aff43f5dd8ddab2cc8871cd9f81438963ead5b6
The current UAPI interface for FUSE passthrough is still under
discussion upstream, thus we are reserving this ioctl number to avoid
future conflicts with user space binaries.
The user space implementation in Android will take care of doing all the
checking to fall into the most appropriate ioctl number.
Bug: 167695973
Link: https://lore.kernel.org/lkml/20210125153057.3623715-3-balsini@android.com/
Fixes: 9655e27a40d2 ("FROMLIST: fuse: Definitions and ioctl for passthrough")
Test: manual test with additional printks
Signed-off-by: Alessio Balsini <balsini@google.com>
Change-Id: I658c5ab2ebfe2b76d20685a099ac1b1fee3549cc
Enabling FUSE passthrough for mmap-ed operations not only affects
performance, but has also been shown as mandatory for the correct
functioning of FUSE passthrough.
yanwu noticed [1] that a FUSE file with passthrough enabled may suffer
data inconsistencies if the same file is also accessed with mmap. What
happens is that read/write operations are directly applied to the lower
file system (and its cache), while mmap-ed operations are affecting the
FUSE cache.
Extend the FUSE passthrough implementation to also handle memory-mapped
FUSE file, to both fix the cache inconsistencies and extend the
passthrough performance benefits to mmap-ed operations.
[1] https://lore.kernel.org/lkml/20210119110654.11817-1-wu-yan@tcl.com/
Bug: 168023149
Link: https://lore.kernel.org/lkml/20210125153057.3623715-9-balsini@android.com/
Signed-off-by: Alessio Balsini <balsini@android.com>
Change-Id: Ifad4698b0380f6e004c487940ac6907b9a9f2964
Signed-off-by: Alessio Balsini <balsini@google.com>
When using FUSE passthrough, read/write operations are directly
forwarded to the lower file system file through VFS, but there is no
guarantee that the process that is triggering the request has the right
permissions to access the lower file system. This would cause the
read/write access to fail.
In passthrough file systems, where the FUSE daemon is responsible for
the enforcement of the lower file system access policies, often happens
that the process dealing with the FUSE file system doesn't have access
to the lower file system.
Being the FUSE daemon in charge of implementing the FUSE file
operations, that in the case of read/write operations usually simply
results in the copy of memory buffers from/to the lower file system
respectively, these operations are executed with the FUSE daemon
privileges.
This patch adds a reference to the FUSE daemon credentials, referenced
at FUSE_DEV_IOC_PASSTHROUGH_OPEN ioctl() time so that they can be used
to temporarily raise the user credentials when accessing lower file
system files in passthrough.
The process accessing the FUSE file with passthrough enabled temporarily
receives the privileges of the FUSE daemon while performing read/write
operations. Similar behavior is implemented in overlayfs.
These privileges will be reverted as soon as the IO operation completes.
This feature does not provide any higher security privileges to those
processes accessing the FUSE file system with passthrough enabled. This
is because it is still the FUSE daemon responsible for enabling or not
the passthrough feature at file open time, and should enable the feature
only after appropriate access policy checks.
Bug: 168023149
Link: https://lore.kernel.org/lkml/20210125153057.3623715-8-balsini@android.com/
Signed-off-by: Alessio Balsini <balsini@android.com>
Change-Id: Idb4f03a2ce7c536691e5eaf8fadadfcf002e1677
Signed-off-by: Alessio Balsini <balsini@google.com>
Extend the passthrough feature by handling asynchronous IO both for read
and write operations.
When an AIO request is received, if the request targets a FUSE file with
the passthrough functionality enabled, a new identical AIO request is
created. The new request targets the lower file system file and gets
assigned a special FUSE passthrough AIO completion callback.
When the lower file system AIO request is completed, the FUSE
passthrough AIO completion callback is executed and propagates the
completion signal to the FUSE AIO request by triggering its completion
callback as well.
Bug: 168023149
Link: https://lore.kernel.org/lkml/20210125153057.3623715-7-balsini@android.com/
Signed-off-by: Alessio Balsini <balsini@android.com>
Change-Id: I47671ef36211102da6dd3ee8b2f226d1e6cd9d5c
Signed-off-by: Alessio Balsini <balsini@google.com>
All the read and write operations performed on fuse_files which have the
passthrough feature enabled are forwarded to the associated lower file
system file via VFS.
Sending the request directly to the lower file system avoids the
userspace round-trip that, because of possible context switches and
additional operations might reduce the overall performance, especially
in those cases where caching doesn't help, for example in reads at
random offsets.
Verifying if a fuse_file has a lower file system file associated with
can be done by checking the validity of its passthrough_filp pointer.
This pointer is not NULL only if passthrough has been successfully
enabled via the appropriate ioctl().
When a read/write operation is requested for a FUSE file with
passthrough enabled, a new equivalent VFS request is generated, which
instead targets the lower file system file.
The VFS layer performs additional checks that allow for safer operations
but may cause the operation to fail if the process accessing the FUSE
file system does not have access to the lower file system.
This change only implements synchronous requests in passthrough,
returning an error in the case of asynchronous operations, yet covering
the majority of the use cases.
Bug: 168023149
Link: https://lore.kernel.org/lkml/20210125153057.3623715-6-balsini@android.com/
Signed-off-by: Alessio Balsini <balsini@android.com>
Change-Id: Ifbe6a247fe7338f87d078fde923f0252eeaeb668
Signed-off-by: Alessio Balsini <balsini@google.com>
Implement the FUSE passthrough ioctl that associates the lower
(passthrough) file system file with the fuse_file.
The file descriptor passed to the ioctl by the FUSE daemon is used to
access the relative file pointer, that will be copied to the fuse_file
data structure to consolidate the link between the FUSE and lower file
system.
To enable the passthrough mode, user space triggers the
FUSE_DEV_IOC_PASSTHROUGH_OPEN ioctl and, if the call succeeds, receives
back an identifier that will be used at open/create response time in the
fuse_open_out field to associate the FUSE file to the lower file system
file.
The value returned by the ioctl to user space can be:
- > 0: success, the identifier can be used as part of an open/create
reply.
- <= 0: an error occurred.
The value 0 represents an error to preserve backward compatibility: the
fuse_open_out field that is used to pass the passthrough_fh back to the
kernel uses the same bits that were previously as struct padding, and is
commonly zero-initialized (e.g., in the libfuse implementation).
Removing 0 from the correct values fixes the ambiguity between the case
in which 0 corresponds to a real passthrough_fh, a missing
implementation of FUSE passthrough or a request for a normal FUSE file,
simplifying the user space implementation.
For the passthrough mode to be successfully activated, the lower file
system file must implement both read_iter and write_iter file
operations. This extra check avoids special pseudo files to be targeted
for this feature.
Passthrough comes with another limitation: no further file system
stacking is allowed for those FUSE file systems using passthrough.
Bug: 168023149
Link: https://lore.kernel.org/lkml/20210125153057.3623715-5-balsini@android.com/
Signed-off-by: Alessio Balsini <balsini@android.com>
Change-Id: I4d8290012302fb4547bce9bb261a03cc4f66b5aa
Signed-off-by: Alessio Balsini <balsini@google.com>
Expose the FUSE_PASSTHROUGH interface to user space and declare all the
basic data structures and functions as the skeleton on top of which the
FUSE passthrough functionality will be built.
As part of this, introduce the new FUSE passthrough ioctl, which allows
the FUSE daemon to specify a direct connection between a FUSE file and a
lower file system file. Such ioctl requires user space to pass the file
descriptor of one of its opened files through the fuse_passthrough_out
data structure introduced in this patch. This structure includes extra
fields for possible future extensions.
Also, add the passthrough functions for the set-up and tear-down of the
data structures and locks that will be used both when fuse_conns and
fuse_files are created/deleted.
Bug: 168023149
Link: https://lore.kernel.org/lkml/20210125153057.3623715-4-balsini@android.com/
Signed-off-by: Alessio Balsini <balsini@android.com>
Change-Id: I732532581348adadda5b5048a9346c2b0868d539
Signed-off-by: Alessio Balsini <balsini@google.com>
With a 64-bit kernel build the FUSE device cannot handle ioctl requests
coming from 32-bit user space.
This is due to the ioctl command translation that generates different
command identifiers that thus cannot be used for direct comparisons
without proper manipulation.
Explicitly extract type and number from the ioctl command to enable
32-bit user space compatibility on 64-bit kernel builds.
Bug: 168023149
Link: https://lore.kernel.org/lkml/20210125153057.3623715-3-balsini@android.com/
Signed-off-by: Alessio Balsini <balsini@android.com>
Change-Id: I595517c54d551be70e83c7fcb4b62397a3615004
Signed-off-by: Alessio Balsini <balsini@google.com>
OverlayFS implements its own function to translate iocb flags into rw
flags, so that they can be passed into another vfs call.
With commit ce71bfea207b4 ("fs: align IOCB_* flags with RWF_* flags")
Jens created a 1:1 matching between the iocb flags and rw flags,
simplifying the conversion.
Reduce the OverlayFS code by making the flag conversion function generic
and reusable.
Bug: 168023149
Link: https://lore.kernel.org/lkml/20210125153057.3623715-2-balsini@android.com/
Signed-off-by: Alessio Balsini <balsini@android.com>
Change-Id: I74aefeafd6ebbda2fbabee9024474dfe4cc6c2a7
Signed-off-by: Alessio Balsini <balsini@google.com>
https://source.android.com/docs/security/bulletin/2023-11-01
* tag 'ASB-2023-11-05_11-5.4' of https://android.googlesource.com/kernel/common:
UPSTREAM: netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c
BACKPORT: ravb: Fix use-after-free issue in ravb_tx_timeout_work()
UPSTREAM: ravb: Fix up dma_free_coherent() call in ravb_remove()
UPSTREAM: netfilter: ipset: Fix race between IPSET_CMD_CREATE and IPSET_CMD_SWAP
UPSTREAM: net: xfrm: Fix xfrm_address_filter OOB read
UPSTREAM: igb: set max size RX buffer when store bad packet is enabled
UPSTREAM: netfilter: xt_sctp: validate the flag_info count
UPSTREAM: netfilter: xt_u32: validate user space input
UPSTREAM: netfilter: nfnetlink_osf: avoid OOB read
UPSTREAM: net/sched: Retire rsvp classifier
UPSTREAM: ipv4: fix null-deref in ipv4_link_failure
Change-Id: I26b182a8dd67864a2a4421feb25b878e98478a62
"LA.UM.9.14.r1-23100-LAHAINA.QSSI14.0"
* tag 'LA.UM.9.14.r1-23100-LAHAINA.QSSI14.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/audio-kernel:
Revert "asoc: msm-compress : Fix for CTS-on-gsi with gki"
asoc: msm-compress : Fix for CTS-on-gsi with gki
ASoC: msm-pcm-host-voice: Handle mutex lock-unlock
Change-Id: I84217298ebd04c41daa978fcd3321a3c1bd2670b
"LA.UM.9.14.r1-23100-LAHAINA.QSSI14.0"
* tag 'LA.UM.9.14.r1-23100-LAHAINA.QSSI14.0' of https://git.codelinaro.org/clo/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0:
Release 2.0.8.33V
qcacld-3.0: Do not allow SAP SCC on non-PSC/non-VLP channels
Release 2.0.8.33U
qcacld-3.0: Fix cb mode calculation for 2.4 GHz
qcacld-3.0: Add extended capabilities IE length check
qcacld-3.0: Modify condition to send 6GHz HE caps
qcacld-3.0: Send 6G HE caps to userspace
Release 2.0.8.33T
qcacld-3.0: Allow SAP to move to unsafe channel if ini allows
Release 2.0.8.33S
qcacld-3.0: Fix possible overflow for pcl weight list
Release 2.0.8.33R
qcacld-3.0: Skip FISA aggregation if RDI is zero
Release 2.0.8.33Q
qcacld-3.0: Fix read current country code
Release 2.0.8.33P
qcacld-3.0: Issue disconnect on STA while start/stop SAP
Release 2.0.8.33O
qcacld-3.0: Update VHT Channel width in assoc resp
Release 2.0.8.33N
qcacld-3.0: Fill proper SGI for VHT Rx data packet
Change-Id: Ie2fdb0163d03e7733878579b33929bc027757eca
"LA.UM.9.14.r1-23100-LAHAINA.QSSI14.0"
* tag 'LA.UM.9.14.r1-23100-LAHAINA.QSSI14.0' of https://git.codelinaro.org/clo/la/platform/vendor/qcom-opensource/wlan/qca-wifi-host-cmn:
qcacmn: Consider gindoor_channel_support ini to decide ap_power_type
qcacmn: Fix OOB issue
qcacmn: handle integer underflow in util_gen_new_ie
qcacmn: add new counter to fisa stats
qcacmn: Extract Rx data packet SGI from WMI_VDEV_SMART_MONITOR_EVENTID
Change-Id: Ie9380449beee36ba953010870e7de50ae17cd397
"LA.UM.9.14.r1-23100-LAHAINA.QSSI14.0"
* tag 'LA.UM.9.14.r1-23100-LAHAINA.QSSI14.0' of https://git.codelinaro.org/clo/la/kernel/msm-5.4:
Revert "ALSA: compress: Allow pause and resume during draining"
ALSA: compress: Allow pause and resume during draining
msm: kgsl: Prevent wrap around during user address mapping
msm: kgsl: Limit the syncpoint count for AUX commands
msm: kgsl: Prevent wrap around during user address mapping
Configured process_madvise with upstream syscall number
iommu: Fix missing return check of arm_lpae_init_pte
usb: gadget: cdev: Don't use spinlock with sleeping functions
securemsm-kernel: Fix multiple listener registration on same fd
msm: kgsl: Limit the syncpoint count for AUX commands
net: qrtr: use new update_marker api
char: virtio_eavb: use new update_marker api
usb: kpi: update_marker api for USB suspend resume
Change-Id: Id82b63ff555fbc7101b41a10c1ffbef3762627bd
commit 050d91c03b28ca479df13dfb02bcd2c60dd6a878 upstream.
The missing IP_SET_HASH_WITH_NET0 macro in ip_set_hash_netportnet can
lead to the use of wrong `CIDR_POS(c)` for calculating array offsets,
which can lead to integer underflow. As a result, it leads to slab
out-of-bound access.
This patch adds back the IP_SET_HASH_WITH_NET0 macro to
ip_set_hash_netportnet to address the issue.
Bug: 302199939
Fixes: 886503f34d ("netfilter: ipset: actually allow allowable CIDR 0 in hash:net,port,net")
Suggested-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Kyle Zeng <zengyhkyle@gmail.com>
Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit a9e6142e5f8f6ac7d1bca45c1b2b13b084ea9e14)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I11cc1650e7df9d54041164b6bdb01f3a0de46de4
[ Upstream commit 3971442870713de527684398416970cf025b4f89 ]
The ravb_stop() should call cancel_work_sync(). Otherwise,
ravb_tx_timeout_work() is possible to use the freed priv after
ravb_remove() was called like below:
CPU0 CPU1
ravb_tx_timeout()
ravb_remove()
unregister_netdev()
free_netdev(ndev)
// free priv
ravb_tx_timeout_work()
// use priv
unregister_netdev() will call .ndo_stop() so that ravb_stop() is
called. And, after phy_stop() is called, netif_carrier_off()
is also called. So that .ndo_tx_timeout() will not be called
after phy_stop().
Bug: 289003868
Fixes: c156633f13 ("Renesas Ethernet AVB driver proper")
Reported-by: Zheng Wang <zyytlz.wz@163.com>
Closes: https://lore.kernel.org/netdev/20230725030026.1664873-1-zyytlz.wz@163.com/
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Reviewed-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Link: https://lore.kernel.org/r/20231005011201.14368-3-yoshihiro.shimoda.uh@renesas.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 6f6fa8061f756aedb93af12a8a5d3cf659127965)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I36fcd769d93817adaa04162cae0b54b1addbb9bf
[ Upstream commit e6864af61493113558c502b5cd0d754c19b93277 ]
In ravb_remove(), dma_free_coherent() should be call after
unregister_netdev(). Otherwise, this controller is possible to use
the freed buffer.
Bug: 289003868
Fixes: c156633f13 ("Renesas Ethernet AVB driver proper")
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Reviewed-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Link: https://lore.kernel.org/r/20231005011201.14368-2-yoshihiro.shimoda.uh@renesas.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 3f9295ad7f9478e65debcef496da4e4eb83db5ea)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I8e7da5816f715307c7d8bcd881a2a5ecb52439bb
CONFIG_DRM_MSM_DP is disabled on holi, making this function undefined
and breaking compilation. Like all other inline functions, make this one
return 0.
Change-Id: I1ae0eeab563c3a67fb35d92e8ad2c391458778e6
Newer clang builds complain about old-style function declarations
not having any prototype assigned. The missing `void` is triggering
the Wstrict-prototype warns. Explicitly add the `void` keyword to
satisfy the compiler.
This fixes the following warnings:
drivers/staging/qca-wifi-host-cmn/hif/src/ce/ce_service_legacy.c:
1288:34: error: a function declaration without a prototype is
deprecated in all versions of C [-Werror,-Wstrict-prototypes]
struct ce_ops *ce_services_legacy()
^
void
drivers/staging/qca-wifi-host-cmn/hif/src/ce/ce_service_srng.c:1017:32:
error: a function declaration without a prototype is deprecated in all
versions of C [-Werror,-Wstrict-prototypes]
struct ce_ops *ce_services_srng()
^
void
drivers/staging/qca-wifi-host-cmn/target_if/core/src/target_if_main.c:
88:40: error: a function declaration without a prototype is
deprecated in all versions of C [-Werror,-Wstrict-prototypes]
struct target_if_ctx *target_if_get_ctx()
^
void
drivers/staging/qca-wifi-host-cmn/umac/scan/dispatcher/src/wlan_extscan_api.c:
103:27: error: a function declaration without a prototype is
deprecated in all versions of C [-Werror,-Wstrict-prototypes]
wlan_extscan_global_deinit()
^
void
Change-Id: Ifd95b57d19a25f0932e5de8ec4de2f2c1e7e1259
Signed-off-by: Tashfin Shakeer Rhythm <tashfinshakeerrhythm@gmail.com>
[ Upstream commit 7433b6d2afd512d04398c73aa984d1e285be125b ]
Kyle Zeng reported that there is a race between IPSET_CMD_ADD and IPSET_CMD_SWAP
in netfilter/ip_set, which can lead to the invocation of `__ip_set_put` on a
wrong `set`, triggering the `BUG_ON(set->ref == 0);` check in it.
The race is caused by using the wrong reference counter, i.e. the ref counter instead
of ref_netlink.
Bug: 303172721
Fixes: 24e227896bbf ("netfilter: ipset: Add schedule point in call_ad().")
Reported-by: Kyle Zeng <zengyhkyle@gmail.com>
Closes: https://lore.kernel.org/netfilter-devel/ZPZqetxOmH+w%2Fmyc@westworld/#r
Tested-by: Kyle Zeng <zengyhkyle@gmail.com>
Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit ea5a61d58886ae875f1b4a371999f2a8b58cf26d)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I33a6a6234830c600a4ebd62ed1fee3a48876b98d
commit bb5ed01cd2428cd25b1c88a3a9cba87055eb289f upstream.
Increase the RX buffer size to 3K when the SBP bit is on. The size of
the RX buffer determines the number of pages allocated which may not
be sufficient for receive frames larger than the set MTU size.
Bug: 306483516
Cc: stable@vger.kernel.org
Fixes: 89eaefb61d ("igb: Support RX-ALL feature flag.")
Reported-by: Manfred Rudigier <manfred.rudigier@omicronenergy.com>
Signed-off-by: Radoslaw Tyl <radoslawx.tyl@intel.com>
Tested-by: Arpana Arland <arpanax.arland@intel.com> (A Contingent worker at Intel)
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit be7353af5b35c8f4a11573a38b997f74f8c2ae4b)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I3f05b369cd9ac24643af3e37e2ce1d099c63bc02
commit e99476497687ef9e850748fe6d232264f30bc8f9 upstream.
sctp_mt_check doesn't validate the flag_count field. An attacker can
take advantage of that to trigger a OOB read and leak memory
information.
Add the field validation in the checkentry function.
Bug: 304913898
Fixes: 2e4e6a17af ("[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables")
Cc: stable@vger.kernel.org
Reported-by: Lucas Leong <wmliang@infosec.exchange>
Signed-off-by: Wander Lairson Costa <wander@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 4921f9349b66da7c5a2b6418fe45e9ae0ae72924)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ife4e69f6218fdaca2a8647b5ed00d875a5ed0d34
commit 69c5d284f67089b4750d28ff6ac6f52ec224b330 upstream.
The xt_u32 module doesn't validate the fields in the xt_u32 structure.
An attacker may take advantage of this to trigger an OOB read by setting
the size fields with a value beyond the arrays boundaries.
Add a checkentry function to validate the structure.
This was originally reported by the ZDI project (ZDI-CAN-18408).
Bug: 304913716
Fixes: 1b50b8a371 ("[NETFILTER]: Add u32 match")
Cc: stable@vger.kernel.org
Signed-off-by: Wander Lairson Costa <wander@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 1c164c1e9e93b0a72a03a7edb754e3857d4e4302)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ic2ff70b303f55f9c3c5db24295bcb223ed7175a7
