Commit graph

883,640 commits

Author SHA1 Message Date
Greg Kroah-Hartman
33dffcb6ef Merge branch 'android11-5.4' into 'android11-5.4-lts'
Sync up with android11-5.4 for the following commits:

e83321764f ANDROID: KMI symbol lists: migrate section name
ba4ec0ee1b ANDROID: ABI: Update allowed list for GALAXY
f82716d6b7 ANDROID: hikey960_gki.fragment: Remove UFS and USB bits
5d5378d608 ANDROID: lkdtm/usercopy: Use __va_function to find proper vm_mmap address
a3cb7a0327 ANDROID: mm: add generic __va_function and __pa_function
802f342713 ANDROID: vendor_hooks: Add hooks for debugging exception context
40f057fb2d FROMGIT: mm, oom_adj: don't loop through tasks in __set_oom_adj when not necessary

Change-Id: Icccde6e1c6380b07df854f12472041f4b1b5612c
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2020-09-18 13:25:48 +02:00
Matthias Maennich
e83321764f ANDROID: KMI symbol lists: migrate section name
Libabigail learned to accept 'symbol_list' as a valid suffix for symbol
list sections. Hence make use of it consistently.

Bug: 162536543
Signed-off-by: Matthias Maennich <maennich@google.com>
Change-Id: I1454b0068769c9e57a533dafb6267e63adb7ceb0
2020-09-17 13:14:10 +00:00
Jeehong Kim
ba4ec0ee1b ANDROID: ABI: Update allowed list for GALAXY
Leaf changes summary: 10 artifacts changed
Changed leaf types summary: 0 leaf type changed
Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 8 Added functions
Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 2 Added variables

8 Added functions:

  [A] 'function void __napi_schedule_irqoff(napi_struct*)'
  [A] 'function void drm_edid_get_monitor_name(edid*, char*, int)'
  [A] 'function char* get_options(const char*, int, int*)'
  [A] 'function packet_offload* gro_find_complete_by_type(unsigned short int)'
  [A] 'function packet_offload* gro_find_receive_by_type(unsigned short int)'
  [A] 'function __be32 in_aton(const char*)'
  [A] 'function void kfree_skb_partial(sk_buff*, bool)'
  [A] 'function int smp_call_function_single_async(int, __call_single_data*)'

2 Added variables:

  [A] 'tracepoint __tracepoint_android_vh_kfree_skb'
  [A] 'tracepoint __tracepoint_android_vh_ptype_head'

Bug: 168666995

Signed-off-by: Jeehong Kim <jhez.kim@samsung.com>
Change-Id: Ie93e39ef988e2287741819a81cd44d41d7f0fcd7
2020-09-16 15:14:34 +00:00
John Stultz
f82716d6b7 ANDROID: hikey960_gki.fragment: Remove UFS and USB bits
Remove CONFIG_SCSI_UFS_HISI=m and CONFIG_TYPEC_TCPM=m
from the hikey960_gki.fragment, as those configs have
been added to the gki_defconfig

Fixes: bb765ef8427e ("ANDROID: GKI: enable QCOM and HISI UFS drivers")
Fixes: 5625a6460e96 ("ANDROID: GKI: enable CONFIG_TYPEC_TCPM")
Signed-off-by: John Stultz <john.stultz@linaro.org>
Change-Id: I124a0d050c7170557d9672968729af196ad2f81c
(cherry picked from commit ae78c73104aa2fa957cbb7b4524c3e3e862174fd)
2020-09-16 03:32:40 +00:00
Prasad Sodagudi
5d5378d608 ANDROID: lkdtm/usercopy: Use __va_function to find proper vm_mmap address
With CFI enabled compiler replacing the reference to vm_mmap
passed to copy_to_user with a pointer to the CFI jump table
in the module itself. So use the __va_function API for
finding the proper address of vm_mmap.

Bug: 166220312
Suggested-by: Sami Tolvanen <samitolvanen@google.com>
Change-Id: Id5bd96cc9bfa1aa99f34bd4785792e0a4eeae5b1
Signed-off-by: Prasad Sodagudi <psodagud@codeaurora.org>
2020-09-15 13:01:00 -07:00
Sami Tolvanen
a3cb7a0327 ANDROID: mm: add generic __va_function and __pa_function
We use non-canonical CFI jump tables with CONFIG_CFI_CLANG, which
means the compiler replaces function address references with the
address of the function's CFI jump table entry. This results in
__pa_symbol(function), for example, returning the physical address
of the jump table entry, which can lead to address space confusion
since the jump table itself points to a virtual address.

This change adds generic definitions for __pa/va_function, which
architectures that support CFI can override.

Bug: 166220312
Change-Id: If4a162de7854547d8437bf59be03eb6d16220832
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
2020-09-15 18:20:31 +00:00
yong qian
802f342713 ANDROID: vendor_hooks: Add hooks for debugging exception context
When some processes crashed, we want to save cpu regs(x0-x30、pc、sp),
and context(task_struct、thread_info) to log for debugging

Bug: 166228327

Signed-off-by: yong qian <qianyong@oppo.com>
Change-Id: I4f49ffed583a0e20f1aaa7e445e85a0cbb603bbe
2020-09-15 18:02:49 +00:00
Suren Baghdasaryan
40f057fb2d FROMGIT: mm, oom_adj: don't loop through tasks in __set_oom_adj when not necessary
Currently __set_oom_adj loops through all processes in the system to
keep oom_score_adj and oom_score_adj_min in sync between processes
sharing their mm. This is done for any task with more that one mm_users,
which includes processes with multiple threads (sharing mm and signals).
However for such processes the loop is unnecessary because their signal
structure is shared as well.
Android updates oom_score_adj whenever a tasks changes its role
(background/foreground/...) or binds to/unbinds from a service, making
it more/less important. Such operation can happen frequently.
We noticed that updates to oom_score_adj became more expensive and after
further investigation found out that the patch mentioned in "Fixes"
introduced a regression. Using Pixel 4 with a typical Android workload,
write time to oom_score_adj increased from ~3.57us to ~362us. Moreover
this regression linearly depends on the number of multi-threaded
processes running on the system.
Mark the mm with a new MMF_MULTIPROCESS flag bit when task is created with
(CLONE_VM && !CLONE_THREAD && !CLONE_VFORK). Change __set_oom_adj to use
MMF_MULTIPROCESS instead of mm_users to decide whether oom_score_adj
update should be synchronized between multiple processes. To prevent
races between clone() and __set_oom_adj(), when oom_score_adj of the
process being cloned might be modified from userspace, we use
oom_adj_mutex. Its scope is changed to global. The combination of
(CLONE_VM && !CLONE_THREAD) is rarely used except for the case of vfork().
To prevent performance regressions of vfork(), we skip taking oom_adj_mutex
and setting MMF_MULTIPROCESS when CLONE_VFORK is specified. Clearing the
MMF_MULTIPROCESS flag (when the last process sharing the mm exits) is left
out of this patch to keep it simple and because it is believed that this
threading model is rare. Should there ever be a need for optimizing that
case as well, it can be done by hooking into the exit path, likely
following the mm_update_next_owner pattern.
With the combination of (CLONE_VM && !CLONE_THREAD && !CLONE_VFORK) being
quite rare, the regression is gone after the change is applied.

Fixes: 44a70adec9 ("mm, oom_adj: make sure processes sharing mm have same view of oom_score_adj")
Reported-by: Tim Murray <timmurray@google.com>
Debugged-by: Minchan Kim <minchan@kernel.org>
Suggested-by: Michal Hocko <mhocko@kernel.org>
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Bug: 168521639
Link: https://lore.kernel.org/linux-fsdevel/20200902012558.2335613-1-surenb@google.com/
[isaacm: upstream bound, no cherry-pick info because patch is in mm tree]
Change-Id: I20352a77815fbc358c36e686bb1503fdeea658ed
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
2020-09-15 09:34:00 -07:00
Greg Kroah-Hartman
aab1b68b41 Merge branch 'android11-5.4' into 'android11-5.4-lts'
Sync up with android11-5.4 for the following commits:

      ANDROID: vendor_hooks: Add vendor hooks for getting printk messages
      ANDROID: ABI: refresh with latest libabigail 94f5d4ae
      ANDROID: ABI: add already existing symbols of mali_gondul.ko to unisoc

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I1a9415ac9e453a6d4f5df19a215ab7dcc02856b8
2020-09-15 13:32:09 +02:00
Giuliano Procida
45adb8186e ANDROID: ABI: refresh with latest libabigail 94f5d4ae
This is a one-off change that updates the type ids of anonymous
structs and unions to a more stable id.

Bug: 163532421
Change-Id: I2ae8b1fa19fab489412fca3f83fa9e2c7361c2b7
Signed-off-by: Giuliano Procida <gprocida@google.com>
2020-09-15 10:56:02 +00:00
Changki Kim
bad091cc4b ANDROID: vendor_hooks: Add vendor hooks for getting printk messages
When sudden reset by watchdog occurs, kernel log is very helpful.
But the log has saved structure type in log_buf.
So we want to collect the log on runtime to string format at other
reserved memory.

Bug: 167766040

Change-Id: Ic9686acc7c284e2ab81395fb9cc076fafe142bf9
Signed-off-by: Changki Kim <changki.kim@samsung.com>
2020-09-14 14:42:20 +00:00
Greg Kroah-Hartman
ed0ef96777 This is the 5.4.65 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl9cvPIACgkQONu9yGCS
 aT5Rxw/9H2IC+FNJGLjUdKaOJzBCLBlxx8jQjnuUve67y0+bcNnk2oUxKVslWNUj
 wR7vSntN5iFQeGgAmjgVBxg2RrGQJrOIxxQLoBOnfrlb+s8gxs+dxH6ZpjNQO85e
 2InAVp/AQMstQiMuNC3bJvsmD08hXgg8inea2dW4nX/n9DVOvBJ2RMm4Gsi75YvB
 FysT+dIql4lZRvCHuG6lgrjBp1qQG2hhBaLFn/YyT2+/PUP8NcCWY2aNchO8g64x
 8HYvphpS7JjxS9Q86MZLuHnfmm8voGySp90kxW8YiQCBa2pgJVwSxpt6+b4xcyLu
 IJtfSXKC/1IxsirmWboDSuAK1T6ldRStzPzdxIYtaXLdexzs1iDnuW7NQlZvnMdT
 0jJ1tUA2XZmevBMdOBVZqNpLlzK/yaiyd2d1X8QdgYIpSp6vJT9W7VIAdDMOMZX5
 y+7oHFANoEw++DhvQmI1WJydjhpdH9el2PkZoPZdT+cpRaaioNjFKwM7PlpXs0+M
 dKKxbyklxNr4pjJU3A9/EcxHq5eRSfOh5n5HugRH2IhJG5vimmqr2hvh6xGqtLfd
 JQmEqlusNrZLjzAuYi2nmtHar7DdOzjXLeWDI+Oxtj+KCvcUGx2fAv4Nc7hgYc0i
 vzjh38nY4KofA1SKVenhkw6p6B2TzLfk9CyyBxNkCx2vefIDzlI=
 =AvYo
 -----END PGP SIGNATURE-----

Merge 5.4.65 into android11-5.4-lts

Changes in 5.4.65
	ipv4: Silence suspicious RCU usage warning
	ipv6: Fix sysctl max for fib_multipath_hash_policy
	netlabel: fix problems with mapping removal
	net: usb: dm9601: Add USB ID of Keenetic Plus DSL
	sctp: not disable bh in the whole sctp_get_port_local()
	taprio: Fix using wrong queues in gate mask
	tipc: fix shutdown() of connectionless socket
	net: disable netpoll on fresh napis
	Linux 5.4.65

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ie8ba6eb931d756c125c2966594061b4f9edb1795
2020-09-14 13:02:20 +02:00
Greg Kroah-Hartman
a3775e2a89 This is the 5.4.64 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl9ZDSIACgkQONu9yGCS
 aT5GkA/+I3VF/vpyQXLEY3lCOxUPWsbsU+NTx5x6g4ujFLPzzXISvxaQT3FdyTez
 73nRDbEUwGX8b1Ruylg6PoRjNAilwvYB8gS/4TVxJQ/VtIyG7uFqjDK7vuGJT5xW
 +Pf+PSoJjJLfQfu6TzSZwMit5K8wfTk4egESeZ7KUH3IsLvlNs4Xegkpm1pkl8nZ
 jb3FT5vTPd425Qld6odkfVTj0QJ8JniL8U54YTBXjw6uEMRGsjMGsy91gXNQbgjf
 fhhhRrpFhnDE9rJFtLEVaXUbQ2j3+mjS5lSH/2erpXO+U19yeNLElwpltnHPFrJF
 vDjkvlWdoQKs1+JXNzVQZF9H+omQbTcU8gcRB+s8EbSV2+bcpIdNeas00GaumJW1
 l6660A74mKPN4Vii5YioD9GcsJHgKRkbgJkoxu7QnegiHGoHTfToNVgwz2bQgT34
 JXbZXyhfLOTR5zpczJ3gyBHX+Va3dyHJypyRMgvgyvDW+TZS9By8iAaqXs14eGjG
 8nm5dlaiZyAeburIUyi8vFZZT/5BA42b1xyUZcduKmqlMjRu9fxCHlBCwj5rjcy5
 Psin0EYZcwOtA4mKzIH+w1ZB0qsPLYtLYQZaJzPUsUfzoNvYtU7pbQZEVLtUPMf4
 5MbOPLjT+aki4TGQOR+et29kusapeLEfrc3SgfLwYODmDXmR3cE=
 =N3oJ
 -----END PGP SIGNATURE-----

Merge 5.4.64 into android11-5.4-lts

Changes in 5.4.64
	HID: quirks: Always poll three more Lenovo PixArt mice
	drm/msm/dpu: Fix scale params in plane validation
	tty: serial: qcom_geni_serial: Drop __init from qcom_geni_console_setup
	drm/msm: add shutdown support for display platform_driver
	hwmon: (applesmc) check status earlier.
	nvmet: Disable keep-alive timer when kato is cleared to 0h
	drm/msm: enable vblank during atomic commits
	habanalabs: validate FW file size
	habanalabs: check correct vmalloc return code
	drm/msm/a6xx: fix gmu start on newer firmware
	ceph: don't allow setlease on cephfs
	drm/omap: fix incorrect lock state
	cpuidle: Fixup IRQ state
	nbd: restore default timeout when setting it to zero
	s390: don't trace preemption in percpu macros
	drm/amd/display: Reject overlay plane configurations in multi-display scenarios
	drivers: gpu: amd: Initialize amdgpu_dm_backlight_caps object to 0 in amdgpu_dm_update_backlight_caps
	drm/amd/display: Retry AUX write when fail occurs
	drm/amd/display: Fix memleak in amdgpu_dm_mode_config_init
	xen/xenbus: Fix granting of vmalloc'd memory
	fsldma: fix very broken 32-bit ppc ioread64 functionality
	dmaengine: of-dma: Fix of_dma_router_xlate's of_dma_xlate handling
	batman-adv: Avoid uninitialized chaddr when handling DHCP
	batman-adv: Fix own OGM check in aggregated OGMs
	batman-adv: bla: use netif_rx_ni when not in interrupt context
	dmaengine: at_hdmac: check return value of of_find_device_by_node() in at_dma_xlate()
	rxrpc: Keep the ACK serial in a var in rxrpc_input_ack()
	rxrpc: Make rxrpc_kernel_get_srtt() indicate validity
	MIPS: mm: BMIPS5000 has inclusive physical caches
	MIPS: BMIPS: Also call bmips_cpu_setup() for secondary cores
	mmc: sdhci-acpi: Fix HS400 tuning for AMDI0040
	netfilter: nf_tables: add NFTA_SET_USERDATA if not null
	netfilter: nf_tables: incorrect enum nft_list_attributes definition
	netfilter: nf_tables: fix destination register zeroing
	net: hns: Fix memleak in hns_nic_dev_probe
	net: systemport: Fix memleak in bcm_sysport_probe
	ravb: Fixed to be able to unload modules
	net: arc_emac: Fix memleak in arc_mdio_probe
	dmaengine: pl330: Fix burst length if burst size is smaller than bus width
	gtp: add GTPA_LINK info to msg sent to userspace
	net: ethernet: ti: cpsw: fix clean up of vlan mc entries for host port
	bnxt_en: Don't query FW when netif_running() is false.
	bnxt_en: Check for zero dir entries in NVRAM.
	bnxt_en: Fix PCI AER error recovery flow
	bnxt_en: Fix possible crash in bnxt_fw_reset_task().
	bnxt_en: fix HWRM error when querying VF temperature
	xfs: fix boundary test in xfs_attr_shortform_verify
	bnxt: don't enable NAPI until rings are ready
	media: vicodec: add missing v4l2_ctrl_request_hdl_put()
	media: cedrus: Add missing v4l2_ctrl_request_hdl_put()
	selftests/bpf: Fix massive output from test_maps
	net: dsa: mt7530: fix advertising unsupported 1000baseT_Half
	netfilter: nfnetlink: nfnetlink_unicast() reports EAGAIN instead of ENOBUFS
	nvmet-fc: Fix a missed _irqsave version of spin_lock in 'nvmet_fc_fod_op_done()'
	nvme: fix controller instance leak
	cxgb4: fix thermal zone device registration
	perf tools: Correct SNOOPX field offset
	net: ethernet: mlx4: Fix memory allocation in mlx4_buddy_init()
	fix regression in "epoll: Keep a reference on files added to the check list"
	net: gemini: Fix another missing clk_disable_unprepare() in probe
	MIPS: add missing MSACSR and upper MSA initialization
	xfs: fix xfs_bmap_validate_extent_raw when checking attr fork of rt files
	perf jevents: Fix suspicious code in fixregex()
	tg3: Fix soft lockup when tg3_reset_task() fails.
	x86, fakenuma: Fix invalid starting node ID
	iommu/vt-d: Serialize IOMMU GCMD register modifications
	thermal: ti-soc-thermal: Fix bogus thermal shutdowns for omap4430
	thermal: qcom-spmi-temp-alarm: Don't suppress negative temp
	iommu/amd: Restore IRTE.RemapEn bit after programming IRTE
	net/packet: fix overflow in tpacket_rcv
	include/linux/log2.h: add missing () around n in roundup_pow_of_two()
	vfio/type1: Support faulting PFNMAP vmas
	vfio-pci: Fault mmaps to enable vma tracking
	vfio-pci: Invalidate mmaps and block MMIO access on disabled memory
	iommu/vt-d: Handle 36bit addressing for x86-32
	tracing/kprobes, x86/ptrace: Fix regs argument order for i386
	ext2: don't update mtime on COW faults
	xfs: don't update mtime on COW faults
	ARC: perf: don't bail setup if pct irq missing in device-tree
	btrfs: drop path before adding new uuid tree entry
	btrfs: allocate scrub workqueues outside of locks
	btrfs: set the correct lockdep class for new nodes
	btrfs: set the lockdep class for log tree extent buffers
	btrfs: tree-checker: fix the error message for transid error
	net: core: use listified Rx for GRO_NORMAL in napi_gro_receive()
	btrfs: fix potential deadlock in the search ioctl
	Revert "net: dsa: microchip: set the correct number of ports"
	Revert "ALSA: hda: Add support for Loongson 7A1000 controller"
	ALSA: ca0106: fix error code handling
	ALSA: usb-audio: Add implicit feedback quirk for UR22C
	ALSA: pcm: oss: Remove superfluous WARN_ON() for mulaw sanity check
	ALSA: hda/hdmi: always check pin power status in i915 pin fixup
	ALSA: firewire-digi00x: exclude Avid Adrenaline from detection
	ALSA: hda - Fix silent audio output and corrupted input on MSI X570-A PRO
	ALSA; firewire-tascam: exclude Tascam FE-8 from detection
	ALSA: hda/realtek: Add quirk for Samsung Galaxy Book Ion NT950XCJ-X716A
	ALSA: hda/realtek - Improved routing for Thinkpad X1 7th/8th Gen
	arm64: dts: mt7622: add reset node for mmc device
	mmc: mediatek: add optional module reset property
	mmc: dt-bindings: Add resets/reset-names for Mediatek MMC bindings
	mmc: cqhci: Add cqhci_deactivate()
	mmc: sdhci-pci: Fix SDHCI_RESET_ALL for CQHCI for Intel GLK-based controllers
	media: rc: do not access device via sysfs after rc_unregister_device()
	media: rc: uevent sysfs file races with rc_unregister_device()
	affs: fix basic permission bits to actually work
	block: allow for_each_bvec to support zero len bvec
	block: ensure bdi->io_pages is always initialized
	libata: implement ATA_HORKAGE_MAX_TRIM_128M and apply to Sandisks
	blk-iocost: ioc_pd_free() shouldn't assume irq disabled
	dmaengine: dw-edma: Fix scatter-gather address calculation
	drm/amd/pm: avoid false alarm due to confusing softwareshutdowntemp setting
	dm writecache: handle DAX to partitions on persistent memory correctly
	dm mpath: fix racey management of PG initialization
	dm integrity: fix error reporting in bitmap mode after creation
	dm crypt: Initialize crypto wait structures
	dm cache metadata: Avoid returning cmd->bm wild pointer on error
	dm thin metadata: Avoid returning cmd->bm wild pointer on error
	dm thin metadata: Fix use-after-free in dm_bm_set_read_only
	mm: slub: fix conversion of freelist_corrupted()
	mm: madvise: fix vma user-after-free
	vfio/pci: Fix SR-IOV VF handling with MMIO blocking
	perf record: Correct the help info of option "--no-bpf-event"
	sdhci: tegra: Add missing TMCLK for data timeout
	checkpatch: fix the usage of capture group ( ... )
	mm/hugetlb: fix a race between hugetlb sysctl handlers
	mm/khugepaged.c: fix khugepaged's request size in collapse_file
	cfg80211: regulatory: reject invalid hints
	net: usb: Fix uninit-was-stored issue in asix_read_phy_addr()
	Linux 5.4.64

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I34f83b15e9f9a59529f8d67a434577becf25d1a6
2020-09-14 13:00:56 +02:00
Greg Kroah-Hartman
ffcfdcc24e This is the 5.4.63 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl9TWQYACgkQONu9yGCS
 aT6DJhAAyDsKzxQrxAnWSRkhbKb1pRJe+a6gz9B41iYo1aPzgW07feZixyKWHHBb
 qDF+Ws8LC1WiJNM5jmYLvJidNWzm6BX2EUL+0IFnR6txdGgscaSGdXt4Crs3FBku
 uo47dcy70sDGa7lEfe5kgqGnPGVCZGt6GOWg+ktb5jw7zUxgXQLRPG+ea5Pcxw+6
 uXEcfWYNOwu2+ggbOE+DRAoA06tZp3SbPLPjB9bcCcs7TxhvJnCieOSA+w52tc1/
 4e38JTcH1BM3Dbe29Z8gXazzoMvlUXgVWtGhAybivVxMW2OEta2mrDjIkfvv/zI8
 2miaOZY93iXozk82qPkQL9/tSjN0Nuii90VnK4TIvP5ohLDGfPVMiQH7MCWXnr4J
 Nm45jcKrK2MQo5ECI495A1682gueY0oYm2bWUwUsQ0voSRe3HR66YEJZj/Ae1Ry5
 AYDNvSvcaavtYPOm6iTDaOhydN6WOvja4dllQFPeW+y9PJYlDYuHzpqbnIuiej0u
 qkXO1+9DHXZjyOeO0Y9Te2XlKmOLqzKPG2UiJJHKHn7mpGnZqUaxbUewyzcMKSe7
 ifyroeEFuzKEQ1IqSjaEkY2cJ31Q25OmInI2Oze9DEqJSY3JIdTM6G9UdB8RodVl
 pR/ET8bToVAVDGiixouzo/7cDZpPO0lM24dRzg+ORZLe/HZYI94=
 =kTUr
 -----END PGP SIGNATURE-----

Merge 5.4.63 into android11-5.4-lts

Changes in 5.4.63
	HID: core: Correctly handle ReportSize being zero
	HID: core: Sanitize event code and type when mapping input
	perf record/stat: Explicitly call out event modifiers in the documentation
	drm/sched: Fix passing zero to 'PTR_ERR' warning v2
	drm/etnaviv: fix TS cache flushing on GPUs with BLT engine
	KVM: arm64: Add kvm_extable for vaxorcism code
	KVM: arm64: Survive synchronous exceptions caused by AT instructions
	KVM: arm64: Set HCR_EL2.PTW to prevent AT taking synchronous exception
	dt-bindings: mmc: tegra: Add tmclk for Tegra210 and later
	arm64: tegra: Add missing timeout clock to Tegra194 SDMMC nodes
	arm64: tegra: Add missing timeout clock to Tegra186 SDMMC nodes
	arm64: tegra: Add missing timeout clock to Tegra210 SDMMC
	sdhci: tegra: Remove SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK for Tegra210
	sdhci: tegra: Remove SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK for Tegra186
	scsi: target: tcmu: Fix size in calls to tcmu_flush_dcache_range
	scsi: target: tcmu: Optimize use of flush_dcache_page
	Linux 5.4.63

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I703abbc41e97cd1732a1fb3cf3f7d8e4b2a33766
2020-09-14 11:20:20 +02:00
Greg Kroah-Hartman
7ea7cc9f8b This is the 5.4.62 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl9Qtz8ACgkQONu9yGCS
 aT7xMw/9H2aAnbYRKpq4NX95OcfujmE1S4zv99TGOus2SPO+C6JiAo4WE40OYfWj
 H4q2XKa2jAKAvxLwf5zfUKdWNTqTpz+9NiCeF7QUEbGZ+fj7d39s1Quo6KNhCfUX
 pyQX7oa9nsaIbwzCz5RB0AqRGVzTMwh4lGdhtxTQfl/LMYWtub9UOkUvWimxlO5i
 bWqiqIOZWOzIoPj9KHEOg4KsE6L5D69PjfT2M/qfuOd4TWUw5i1Dv2ckRG1A5r3H
 q8oGrNwgMcco1mpC7lG0IZteNfNZHZqVeOGVdF54HsY+tpLBE9G6HbvfDQknyOPy
 BP3zBcPovWz3S2wRwHyZHjJdQdIprWW+zwikVoqMbTXt8VkNh0qXDgrfScEn6Fah
 hi6oOYvKOCb9YlD6IH7zfvZJzwRdmhIV26dztk1vI51dyvWUh+lmeWuFeGWCYUy6
 PYc9O1RjpzZqNezdHz4ZoueX+4G63fXJ1pTwYhReS4Wj7AYTqUgwIV+ZYKcTmmuD
 bXiWzQXt+4sbR2Mhah5E9wdJlIOc46i+ui6VEUxqZBq8UH0t5C8xxTjO61EAtd4F
 vlfs57jI8/VwWMxUPI4Qni933h1B4zBUlhvTqK7W0QQgEUsO6mIQQB5bDy0A0HOT
 3lImaFt4f+HI7vEltqE1qds1IXK7c0HvFbGC1fRI1ZdS0VdUiY8=
 =F1JD
 -----END PGP SIGNATURE-----

Merge 5.4.62 into android11-5.4-lts

Changes in 5.4.62
	powerpc/64s: Don't init FSCR_DSCR in __init_FSCR()
	binfmt_flat: revert "binfmt_flat: don't offset the data start"
	gre6: Fix reception with IP6_TNL_F_RCV_DSCP_COPY
	net: Fix potential wrong skb->protocol in skb_vlan_untag()
	net: nexthop: don't allow empty NHA_GROUP
	net: qrtr: fix usage of idr in port assignment to socket
	net: sctp: Fix negotiation of the number of data streams.
	net/smc: Prevent kernel-infoleak in __smc_diag_dump()
	tipc: fix uninit skb->data in tipc_nl_compat_dumpit()
	net: ena: Make missed_tx stat incremental
	net/sched: act_ct: Fix skb double-free in tcf_ct_handle_fragments() error flow
	ipvlan: fix device features
	ALSA: hda/hdmi: Add quirk to force connectivity
	ALSA: pci: delete repeated words in comments
	ALSA: hda/realtek: Fix pin default on Intel NUC 8 Rugged
	ALSA: hda/hdmi: Use force connectivity quirk on another HP desktop
	ASoC: img: Fix a reference count leak in img_i2s_in_set_fmt
	ASoC: img-parallel-out: Fix a reference count leak
	ASoC: tegra: Fix reference count leaks.
	mfd: intel-lpss: Add Intel Emmitsburg PCH PCI IDs
	arm64: dts: qcom: msm8916: Pull down PDM GPIOs during sleep
	powerpc/xive: Ignore kmemleak false positives
	media: pci: ttpci: av7110: fix possible buffer overflow caused by bad DMA value in debiirq()
	blktrace: ensure our debugfs dir exists
	scsi: target: tcmu: Fix crash on ARM during cmd completion
	mfd: intel-lpss: Add Intel Tiger Lake PCH-H PCI IDs
	iommu/iova: Don't BUG on invalid PFNs
	drm/amdkfd: Fix reference count leaks.
	drm/radeon: fix multiple reference count leak
	drm/amdgpu: fix ref count leak in amdgpu_driver_open_kms
	drm/amd/display: fix ref count leak in amdgpu_drm_ioctl
	drm/amdgpu: fix ref count leak in amdgpu_display_crtc_set_config
	drm/amdgpu/display: fix ref count leak when pm_runtime_get_sync fails
	scsi: lpfc: Fix shost refcount mismatch when deleting vport
	xfs: Don't allow logging of XFS_ISTALE inodes
	scsi: target: Fix xcopy sess release leak
	selftests/powerpc: Purge extra count_pmc() calls of ebb selftests
	f2fs: fix error path in do_recover_data()
	omapfb: fix multiple reference count leaks due to pm_runtime_get_sync
	PCI: Fix pci_create_slot() reference count leak
	ARM: dts: ls1021a: output PPS signal on FIPER2
	rtlwifi: rtl8192cu: Prevent leaking urb
	mips/vdso: Fix resource leaks in genvdso.c
	ALSA: hda: Add support for Loongson 7A1000 controller
	cec-api: prevent leaking memory through hole in structure
	HID: quirks: add NOGET quirk for Logitech GROUP
	f2fs: fix use-after-free issue
	drm/nouveau/drm/noveau: fix reference count leak in nouveau_fbcon_open
	drm/nouveau: fix reference count leak in nv50_disp_atomic_commit
	drm/nouveau: Fix reference count leak in nouveau_connector_detect
	locking/lockdep: Fix overflow in presentation of average lock-time
	btrfs: file: reserve qgroup space after the hole punch range is locked
	btrfs: make btrfs_qgroup_check_reserved_leak take btrfs_inode
	scsi: iscsi: Do not put host in iscsi_set_flashnode_param()
	ceph: fix potential mdsc use-after-free crash
	ceph: do not access the kiocb after aio requests
	scsi: fcoe: Memory leak fix in fcoe_sysfs_fcf_del()
	EDAC/ie31200: Fallback if host bridge device is already initialized
	hugetlbfs: prevent filesystem stacking of hugetlbfs
	media: davinci: vpif_capture: fix potential double free
	KVM: arm64: Fix symbol dependency in __hyp_call_panic_nvhe
	powerpc/spufs: add CONFIG_COREDUMP dependency
	USB: sisusbvga: Fix a potential UB casued by left shifting a negative value
	brcmfmac: Set timeout value when configuring power save
	efi: provide empty efi_enter_virtual_mode implementation
	arm64: Fix __cpu_logical_map undefined issue
	Revert "ath10k: fix DMA related firmware crashes on multiple devices"
	sched/uclamp: Protect uclamp fast path code with static key
	sched/uclamp: Fix a deadlock when enabling uclamp static key
	usb: cdns3: gadget: always zeroed TRB buffer when enable endpoint
	PM / devfreq: rk3399_dmc: Add missing of_node_put()
	PM / devfreq: rk3399_dmc: Disable devfreq-event device when fails
	PM / devfreq: rk3399_dmc: Fix kernel oops when rockchip,pmu is absent
	drm/xen: fix passing zero to 'PTR_ERR' warning
	drm/xen-front: Fix misused IS_ERR_OR_NULL checks
	s390/numa: set node distance to LOCAL_DISTANCE
	btrfs: factor out inode items copy loop from btrfs_log_inode()
	btrfs: only commit the delayed inode when doing a full fsync
	btrfs: only commit delayed items at fsync if we are logging a directory
	mm/shuffle: don't move pages between zones and don't read garbage memmaps
	mm: fix kthread_use_mm() vs TLB invalidate
	mm/cma.c: switch to bitmap_zalloc() for cma bitmap allocation
	cma: don't quit at first error when activating reserved areas
	gpu/drm: ingenic: Use the plane's src_[x,y] to configure DMA length
	drm/ingenic: Fix incorrect assumption about plane->index
	drm/amd/display: Trigger modesets on MST DSC connectors
	drm/amd/display: Add additional config guards for DCN
	drm/amd/display: Fix dmesg warning from setting abm level
	mm/vunmap: add cond_resched() in vunmap_pmd_range
	EDAC: sb_edac: get rid of unused vars
	EDAC: skx_common: get rid of unused type var
	EDAC/{i7core,sb,pnd2,skx}: Fix error event severity
	PCI: qcom: Add missing ipq806x clocks in PCIe driver
	PCI: qcom: Change duplicate PCI reset to phy reset
	PCI: qcom: Add missing reset for ipq806x
	cpufreq: intel_pstate: Fix EPP setting via sysfs in active mode
	ALSA: usb-audio: Add capture support for Saffire 6 (USB 1.1)
	media: gpio-ir-tx: improve precision of transmitted signal due to scheduling
	block: respect queue limit of max discard segment
	block: virtio_blk: fix handling single range discard request
	drm/msm/adreno: fix updating ring fence
	block: Fix page_is_mergeable() for compound pages
	bfq: fix blkio cgroup leakage v4
	hwmon: (nct7904) Correct divide by 0
	blk-mq: insert request not through ->queue_rq into sw/scheduler queue
	blkcg: fix memleak for iolatency
	nvme-fc: Fix wrong return value in __nvme_fc_init_request()
	nvme: multipath: round-robin: fix single non-optimized path case
	null_blk: fix passing of REQ_FUA flag in null_handle_rq
	i2c: core: Don't fail PRP0001 enumeration when no ID table exist
	i2c: rcar: in slave mode, clear NACK earlier
	usb: gadget: f_tcm: Fix some resource leaks in some error paths
	spi: stm32: clear only asserted irq flags on interrupt
	jbd2: make sure jh have b_transaction set in refile/unfile_buffer
	ext4: don't BUG on inconsistent journal feature
	ext4: handle read only external journal device
	jbd2: abort journal if free a async write error metadata buffer
	ext4: handle option set by mount flags correctly
	ext4: handle error of ext4_setup_system_zone() on remount
	ext4: correctly restore system zone info when remount fails
	fs: prevent BUG_ON in submit_bh_wbc()
	spi: stm32h7: fix race condition at end of transfer
	spi: stm32: fix fifo threshold level in case of short transfer
	spi: stm32: fix stm32_spi_prepare_mbr in case of odd clk_rate
	spi: stm32: always perform registers configuration prior to transfer
	drm/amd/powerplay: correct Vega20 cached smu feature state
	drm/amd/powerplay: correct UVD/VCE PG state on custom pptable uploading
	drm/amd/display: Switch to immediate mode for updating infopackets
	netfilter: avoid ipv6 -> nf_defrag_ipv6 module dependency
	can: j1939: transport: j1939_xtp_rx_dat_one(): compare own packets to detect corruptions
	ALSA: hda/realtek: Add model alc298-samsung-headphone
	s390/cio: add cond_resched() in the slow_eval_known_fn() loop
	ASoC: wm8994: Avoid attempts to read unreadable registers
	selftests: disable rp_filter for icmp_redirect.sh
	scsi: fcoe: Fix I/O path allocation
	scsi: ufs: Fix possible infinite loop in ufshcd_hold
	scsi: ufs: Improve interrupt handling for shared interrupts
	scsi: ufs: Clean up completed request without interrupt notification
	scsi: qla2xxx: Fix login timeout
	scsi: qla2xxx: Check if FW supports MQ before enabling
	scsi: qla2xxx: Fix null pointer access during disconnect from subsystem
	Revert "scsi: qla2xxx: Fix crash on qla2x00_mailbox_command"
	macvlan: validate setting of multiple remote source MAC addresses
	net: gianfar: Add of_node_put() before goto statement
	powerpc/perf: Fix soft lockups due to missed interrupt accounting
	arm64: Move handling of erratum 1418040 into C code
	arm64: Allow booting of late CPUs affected by erratum 1418040
	block: fix get_max_io_size()
	block: loop: set discard granularity and alignment for block device backed loop
	HID: i2c-hid: Always sleep 60ms after I2C_HID_PWR_ON commands
	blk-mq: order adding requests to hctx->dispatch and checking SCHED_RESTART
	btrfs: reset compression level for lzo on remount
	btrfs: check the right error variable in btrfs_del_dir_entries_in_log
	btrfs: fix space cache memory leak after transaction abort
	btrfs: detect nocow for swap after snapshot delete
	fbcon: prevent user font height or width change from causing potential out-of-bounds access
	USB: lvtest: return proper error code in probe
	vt: defer kfree() of vc_screenbuf in vc_do_resize()
	vt_ioctl: change VT_RESIZEX ioctl to check for error return from vc_resize()
	serial: samsung: Removes the IRQ not found warning
	serial: pl011: Fix oops on -EPROBE_DEFER
	serial: pl011: Don't leak amba_ports entry on driver register error
	serial: stm32: avoid kernel warning on absence of optional IRQ
	serial: 8250_exar: Fix number of ports for Commtech PCIe cards
	serial: 8250: change lock order in serial8250_do_startup()
	writeback: Protect inode->i_io_list with inode->i_lock
	writeback: Avoid skipping inode writeback
	writeback: Fix sync livelock due to b_dirty_time processing
	XEN uses irqdesc::irq_data_common::handler_data to store a per interrupt XEN data pointer which contains XEN specific information.
	usb: host: xhci: fix ep context print mismatch in debugfs
	xhci: Do warm-reset when both CAS and XDEV_RESUME are set
	xhci: Always restore EP_SOFT_CLEAR_TOGGLE even if ep reset failed
	arm64: vdso32: make vdso32 install conditional
	PM: sleep: core: Fix the handling of pending runtime resume requests
	powerpc/perf: Fix crashes with generic_compat_pmu & BHRB
	device property: Fix the secondary firmware node handling in set_primary_fwnode()
	crypto: af_alg - Work around empty control messages without MSG_MORE
	genirq/matrix: Deal with the sillyness of for_each_cpu() on UP
	irqchip/stm32-exti: Avoid losing interrupts due to clearing pending bits by mistake
	x86/hotplug: Silence APIC only after all interrupts are migrated
	drm/amdgpu: Fix buffer overflow in INFO ioctl
	drm/amdgpu/gfx10: refine mgcg setting
	drm/amd/powerplay: Fix hardmins not being sent to SMU for RV
	drm/amd/pm: correct Vega10 swctf limit setting
	drm/amd/pm: correct Vega12 swctf limit setting
	drm/amd/pm: correct Vega20 swctf limit setting
	drm/amd/pm: correct the thermal alert temperature limit settings
	USB: yurex: Fix bad gfp argument
	usb: uas: Add quirk for PNY Pro Elite
	USB: quirks: Add no-lpm quirk for another Raydium touchscreen
	USB: quirks: Ignore duplicate endpoint on Sound Devices MixPre-D
	USB: Ignore UAS for JMicron JMS567 ATA/ATAPI Bridge
	usb: host: ohci-exynos: Fix error handling in exynos_ohci_probe()
	USB: gadget: u_f: add overflow checks to VLA macros
	USB: gadget: f_ncm: add bounds checks to ncm_unwrap_ntb()
	USB: gadget: u_f: Unbreak offset calculation in VLAs
	USB: cdc-acm: rework notification_buffer resizing
	usb: storage: Add unusual_uas entry for Sony PSZ drives
	drm/i915: Fix cmd parser desc matching with masks
	usb: dwc3: gadget: Don't setup more than requested
	usb: dwc3: gadget: Fix handling ZLP
	usb: dwc3: gadget: Handle ZLP for sg requests
	fbmem: pull fbcon_update_vcs() out of fb_set_var()
	kheaders: remove unneeded 'cat' command piped to 'head' / 'tail'
	kheaders: optimize md5sum calculation for in-tree builds
	kheaders: optimize header copy for in-tree builds
	kheaders: remove the last bashism to allow sh to run it
	kheaders: explain why include/config/autoconf.h is excluded from md5sum
	kbuild: add variables for compression tools
	kbuild: fix broken builds because of GZIP,BZIP2,LZOP variables
	HID: hiddev: Fix slab-out-of-bounds write in hiddev_ioctl_usage()
	ALSA: usb-audio: Update documentation comment for MS2109 quirk
	io_uring: Fix NULL pointer dereference in io_sq_wq_submit_work()
	Linux 5.4.62

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I7cac9619b0d3edfee94fc6f31efa5d5b545cfeb5
2020-09-14 11:09:54 +02:00
Liangcai Fan
8a8be5c013 ANDROID: ABI: add already existing symbols of mali_gondul.ko to unisoc
Bug: 160255258
Change-Id: I891eab1de6d3f0973501ee1199566978475fafff
Signed-off-by: Liangcai Fan <liangcai.fan@unisoc.com>
2020-09-14 11:28:08 +08:00
Greg Kroah-Hartman
6c3d34dea2 Linux 5.4.65
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-12 14:18:56 +02:00
Jakub Kicinski
ddb279d64b net: disable netpoll on fresh napis
[ Upstream commit 96e97bc07e90f175a8980a22827faf702ca4cb30 ]

napi_disable() makes sure to set the NAPI_STATE_NPSVC bit to prevent
netpoll from accessing rings before init is complete. However, the
same is not done for fresh napi instances in netif_napi_add(),
even though we expect NAPI instances to be added as disabled.

This causes crashes during driver reconfiguration (enabling XDP,
changing the channel count) - if there is any printk() after
netif_napi_add() but before napi_enable().

To ensure memory ordering is correct we need to use RCU accessors.

Reported-by: Rob Sherwood <rsher@fb.com>
Fixes: 2d8bff1269 ("netpoll: Close race condition between poll_one_napi and napi_disable")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-12 14:18:55 +02:00
Tetsuo Handa
09c4506525 tipc: fix shutdown() of connectionless socket
[ Upstream commit 2a63866c8b51a3f72cea388dfac259d0e14c4ba6 ]

syzbot is reporting hung task at nbd_ioctl() [1], for there are two
problems regarding TIPC's connectionless socket's shutdown() operation.

----------
#include <fcntl.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <linux/nbd.h>
#include <unistd.h>

int main(int argc, char *argv[])
{
        const int fd = open("/dev/nbd0", 3);
        alarm(5);
        ioctl(fd, NBD_SET_SOCK, socket(PF_TIPC, SOCK_DGRAM, 0));
        ioctl(fd, NBD_DO_IT, 0); /* To be interrupted by SIGALRM. */
        return 0;
}
----------

One problem is that wait_for_completion() from flush_workqueue() from
nbd_start_device_ioctl() from nbd_ioctl() cannot be completed when
nbd_start_device_ioctl() received a signal at wait_event_interruptible(),
for tipc_shutdown() from kernel_sock_shutdown(SHUT_RDWR) from
nbd_mark_nsock_dead() from sock_shutdown() from nbd_start_device_ioctl()
is failing to wake up a WQ thread sleeping at wait_woken() from
tipc_wait_for_rcvmsg() from sock_recvmsg() from sock_xmit() from
nbd_read_stat() from recv_work() scheduled by nbd_start_device() from
nbd_start_device_ioctl(). Fix this problem by always invoking
sk->sk_state_change() (like inet_shutdown() does) when tipc_shutdown() is
called.

The other problem is that tipc_wait_for_rcvmsg() cannot return when
tipc_shutdown() is called, for tipc_shutdown() sets sk->sk_shutdown to
SEND_SHUTDOWN (despite "how" is SHUT_RDWR) while tipc_wait_for_rcvmsg()
needs sk->sk_shutdown set to RCV_SHUTDOWN or SHUTDOWN_MASK. Fix this
problem by setting sk->sk_shutdown to SHUTDOWN_MASK (like inet_shutdown()
does) when the socket is connectionless.

[1] https://syzkaller.appspot.com/bug?id=3fe51d307c1f0a845485cf1798aa059d12bf18b2

Reported-by: syzbot <syzbot+e36f41d207137b5d12f7@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-12 14:18:55 +02:00
Vinicius Costa Gomes
b95eb482c2 taprio: Fix using wrong queues in gate mask
[ Upstream commit 09e31cf0c528dac3358a081dc4e773d1b3de1bc9 ]

Since commit 9c66d15646 ("taprio: Add support for hardware
offloading") there's a bit of inconsistency when offloading schedules
to the hardware:

In software mode, the gate masks are specified in terms of traffic
classes, so if say "sched-entry S 03 20000", it means that the traffic
classes 0 and 1 are open for 20us; when taprio is offloaded to
hardware, the gate masks are specified in terms of hardware queues.

The idea here is to fix hardware offloading, so schedules in hardware
and software mode have the same behavior. What's needed to do is to
map traffic classes to queues when applying the offload to the driver.

Fixes: 9c66d15646 ("taprio: Add support for hardware offloading")
Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-12 14:18:55 +02:00
Xin Long
20f8c87478 sctp: not disable bh in the whole sctp_get_port_local()
[ Upstream commit 3106ecb43a05dc3e009779764b9da245a5d082de ]

With disabling bh in the whole sctp_get_port_local(), when
snum == 0 and too many ports have been used, the do-while
loop will take the cpu for a long time and cause cpu stuck:

  [ ] watchdog: BUG: soft lockup - CPU#11 stuck for 22s!
  [ ] RIP: 0010:native_queued_spin_lock_slowpath+0x4de/0x940
  [ ] Call Trace:
  [ ]  _raw_spin_lock+0xc1/0xd0
  [ ]  sctp_get_port_local+0x527/0x650 [sctp]
  [ ]  sctp_do_bind+0x208/0x5e0 [sctp]
  [ ]  sctp_autobind+0x165/0x1e0 [sctp]
  [ ]  sctp_connect_new_asoc+0x355/0x480 [sctp]
  [ ]  __sctp_connect+0x360/0xb10 [sctp]

There's no need to disable bh in the whole function of
sctp_get_port_local. So fix this cpu stuck by removing
local_bh_disable() called at the beginning, and using
spin_lock_bh() instead.

The same thing was actually done for inet_csk_get_port() in
Commit ea8add2b19 ("tcp/dccp: better use of ephemeral
ports in bind()").

Thanks to Marcelo for pointing the buggy code out.

v1->v2:
  - use cond_resched() to yield cpu to other tasks if needed,
    as Eric noticed.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: Ying Xu <yinxu@redhat.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-12 14:18:55 +02:00
Kamil Lorenc
8b61bb0b2d net: usb: dm9601: Add USB ID of Keenetic Plus DSL
[ Upstream commit a609d0259183a841621f252e067f40f8cc25d6f6 ]

Keenetic Plus DSL is a xDSL modem that uses dm9620 as its USB interface.

Signed-off-by: Kamil Lorenc <kamil@re-ws.pl>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-12 14:18:55 +02:00
Paul Moore
346fefa823 netlabel: fix problems with mapping removal
[ Upstream commit d3b990b7f327e2afa98006e7666fb8ada8ed8683 ]

This patch fixes two main problems seen when removing NetLabel
mappings: memory leaks and potentially extra audit noise.

The memory leaks are caused by not properly free'ing the mapping's
address selector struct when free'ing the entire entry as well as
not properly cleaning up a temporary mapping entry when adding new
address selectors to an existing entry.  This patch fixes both these
problems such that kmemleak reports no NetLabel associated leaks
after running the SELinux test suite.

The potentially extra audit noise was caused by the auditing code in
netlbl_domhsh_remove_entry() being called regardless of the entry's
validity.  If another thread had already marked the entry as invalid,
but not removed/free'd it from the list of mappings, then it was
possible that an additional mapping removal audit record would be
generated.  This patch fixes this by returning early from the removal
function when the entry was previously marked invalid.  This change
also had the side benefit of improving the code by decreasing the
indentation level of large chunk of code by one (accounting for most
of the diffstat).

Fixes: 63c4168874 ("netlabel: Add network address selectors to the NetLabel/LSM domain mapping")
Reported-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-12 14:18:55 +02:00
Ido Schimmel
3f73dbf94f ipv6: Fix sysctl max for fib_multipath_hash_policy
[ Upstream commit 05d4487197b2b71d5363623c28924fd58c71c0b6 ]

Cited commit added the possible value of '2', but it cannot be set. Fix
it by adjusting the maximum value to '2'. This is consistent with the
corresponding IPv4 sysctl.

Before:

# sysctl -w net.ipv6.fib_multipath_hash_policy=2
sysctl: setting key "net.ipv6.fib_multipath_hash_policy": Invalid argument
net.ipv6.fib_multipath_hash_policy = 2
# sysctl net.ipv6.fib_multipath_hash_policy
net.ipv6.fib_multipath_hash_policy = 0

After:

# sysctl -w net.ipv6.fib_multipath_hash_policy=2
net.ipv6.fib_multipath_hash_policy = 2
# sysctl net.ipv6.fib_multipath_hash_policy
net.ipv6.fib_multipath_hash_policy = 2

Fixes: d8f74f0975 ("ipv6: Support multipath hashing on inner IP pkts")
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Stephen Suryaputra <ssuryaextr@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-12 14:18:55 +02:00
Ido Schimmel
263e463358 ipv4: Silence suspicious RCU usage warning
[ Upstream commit 7f6f32bb7d3355cd78ebf1dece9a6ea7a0ca8158 ]

fib_info_notify_update() is always called with RTNL held, but not from
an RCU read-side critical section. This leads to the following warning
[1] when the FIB table list is traversed with
hlist_for_each_entry_rcu(), but without a proper lockdep expression.

Since modification of the list is protected by RTNL, silence the warning
by adding a lockdep expression which verifies RTNL is held.

[1]
 =============================
 WARNING: suspicious RCU usage
 5.9.0-rc1-custom-14233-g2f26e122d62f #129 Not tainted
 -----------------------------
 net/ipv4/fib_trie.c:2124 RCU-list traversed in non-reader section!!

 other info that might help us debug this:

 rcu_scheduler_active = 2, debug_locks = 1
 1 lock held by ip/834:
  #0: ffffffff85a3b6b0 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x49a/0xbd0

 stack backtrace:
 CPU: 0 PID: 834 Comm: ip Not tainted 5.9.0-rc1-custom-14233-g2f26e122d62f #129
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-2.fc32 04/01/2014
 Call Trace:
  dump_stack+0x100/0x184
  lockdep_rcu_suspicious+0x143/0x14d
  fib_info_notify_update+0x8d1/0xa60
  __nexthop_replace_notify+0xd2/0x290
  rtm_new_nexthop+0x35e2/0x5946
  rtnetlink_rcv_msg+0x4f7/0xbd0
  netlink_rcv_skb+0x17a/0x480
  rtnetlink_rcv+0x22/0x30
  netlink_unicast+0x5ae/0x890
  netlink_sendmsg+0x98a/0xf40
  ____sys_sendmsg+0x879/0xa00
  ___sys_sendmsg+0x122/0x190
  __sys_sendmsg+0x103/0x1d0
  __x64_sys_sendmsg+0x7d/0xb0
  do_syscall_64+0x32/0x50
  entry_SYSCALL_64_after_hwframe+0x44/0xa9
 RIP: 0033:0x7fde28c3be57
 Code: 0c 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51
c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
RSP: 002b:00007ffc09330028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fde28c3be57
RDX: 0000000000000000 RSI: 00007ffc09330090 RDI: 0000000000000003
RBP: 000000005f45f911 R08: 0000000000000001 R09: 00007ffc0933012c
R10: 0000000000000076 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffc09330290 R14: 00007ffc09330eee R15: 00005610e48ed020

Fixes: 1bff1a0c9b ("ipv4: Add function to send route updates")
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-12 14:18:54 +02:00
Greg Kroah-Hartman
215e998966 Merge branch 'android11-5.4' into 'android11-5.4-lts'
Sync up with the latest changes in 'android11-5.4'

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ia6cb40b5c15dd009b4cd8d3a9db48e8b9af5b9d0
2020-09-12 14:16:51 +02:00
Changki Kim
bb168ca180 Revert "ANDROID: vendor_hooks: Add vendor hooks for key combination"
This reverts commit 72f2bc5fc2.

You can use input_handle_event instead of this vendor hook.

Change-Id: I8c6c5705f07181710c99a01239d75ecf43f9c5bf
Signed-off-by: Changki Kim <changki.kim@samsung.com>
2020-09-11 11:47:54 +09:00
Haitao Shan
a52bcdb85f ANDROID: Setting up GS before calling __restore_processor_state.
Android Common Kernel compiled by clang with Shadow Call Stack will
use GS segment. However, __restore_processor_state is called when
system wakes up from S3 and at the moment GS is not restored yet.

This is a hack by copying a small code snippet(setting gs base) from
__restore_processor_state to restore_processor_state. It prepares GS
before __restore_processor_state is called. At the same time,
restore_processor_state is still small enough so that SCS is not on,
as SCS seems to be on only for large functions.

Bug: 166163480
Change-Id: I3bfe4ac61dee876da57de6578c9a7f01431a1743
Signed-off-by: Haitao Shan <hshan@google.com>
2020-09-10 20:16:24 +00:00
Martijn Coenen
dea54268fb FROMGIT: binder: print warnings when detecting oneway spamming.
The most common cause of the binder transaction buffer filling up is a
client rapidly firing oneway transactions into a process, before it has
a chance to handle them. Yet the root cause of this is often hard to
debug, because either the system or the app will stop, and by that time
binder debug information we dump in bugreports is no longer relevant.

This change warns as soon as a process dips below 80% of its oneway
space (less than 100kB available in the configuration), when any one
process is responsible for either more than 50 transactions, or more
than 50% of the oneway space.

Signed-off-by: Martijn Coenen <maco@android.com>
Signed-off-by: Martijn Coenen <maco@google.com>
Acked-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20200821122544.1277051-1-maco@android.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 261e7818f06ec51e488e007f787ccd7e77272918
git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git/
char-misc-next)
Signed-off-by: Martijn Coenen <maco@android.com>

Bug: 147795659
Change-Id: Idc2b03ddc779880ca4716fdae47a70df43211f25
2020-09-10 15:52:35 +00:00
Matthias Maennich
415c56cf53 ANDROID: Address flaky behaviour in genksyms affecting CRC stability.
Commit 1278a5bf16 ("ANDROID: ABI: Added symbols for allwinner")
introduced ehci_* symbols to the symbol list. Due to a bug in genksyms,
the CRC of those is not resilient to whether other symbols are exported
as well. In particular, the CRC changes with the export/trimming of
ehci_handshake. Add an artificial symbol list to contain ehci_handshake
to make this stable.

Also update the ABI representation accordingly:

1 Added function:

  [A] 'function int ehci_handshake(ehci_hcd*, void*, u32, u32, int)'

Bug: 167230325
Signed-off-by: Matthias Maennich <maennich@google.com>
Change-Id: I58d3a93f49e70a66f34b66f9f8784b9c19c5a58b
2020-09-10 13:46:00 +00:00
Greg Kroah-Hartman
54d9896ccd Revert "Revert "BACKPORT: net: core: use listified Rx for GRO_NORMAL in napi_gro_receive()""
This reverts commit a81a69408b as it is needed, and is in the upstream 5.4.y tree now.

Bug: 167477898
Change-Id: Ica5a915027546a7f6f655c336db2489897b007f0
Cc: Hyunsoon Kim <h10.kim@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2020-09-10 11:56:32 +00:00
Subbaraman Narayanamurthy
1869fba86a ANDROID: ABI: update allowed list for QCOM
Leaf changes summary: 2 artifacts changed
Changed leaf types summary: 0 leaf type changed
Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 2 Added functions
Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variable

2 Added functions:

  [A] 'function int led_classdev_flash_register_ext(device*, led_classdev_flash*, led_init_data*)'
  [A] 'function void led_classdev_flash_unregister(led_classdev_flash*)'

Bug: 168090628
Change-Id: I4006604af3341a67a253ca4184ed9daff2990cba
Signed-off-by: Subbaraman Narayanamurthy <subbaram@codeaurora.org>
2020-09-09 10:31:50 -07:00
Greg Kroah-Hartman
6ffabce36f Linux 5.4.64
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-09 19:12:37 +02:00
Himadri Pandya
beaf13ed8e net: usb: Fix uninit-was-stored issue in asix_read_phy_addr()
commit a092b7233f0e000cc6f2c71a49e2ecc6f917a5fc upstream.

The buffer size is 2 Bytes and we expect to receive the same amount of
data. But sometimes we receive less data and run into uninit-was-stored
issue upon read. Hence modify the error check on the return value to match
with the buffer size as a prevention.

Reported-and-tested by: syzbot+a7e220df5a81d1ab400e@syzkaller.appspotmail.com
Signed-off-by: Himadri Pandya <himadrispandya@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-09 19:12:37 +02:00
Johannes Berg
58c3e86d42 cfg80211: regulatory: reject invalid hints
commit 47caf685a6854593348f216e0b489b71c10cbe03 upstream.

Reject invalid hints early in order to not cause a kernel
WARN later if they're restored to or similar.

Reported-by: syzbot+d451401ffd00a60677ee@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=d451401ffd00a60677ee
Link: https://lore.kernel.org/r/20200819084648.13956-1-johannes@sipsolutions.net
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-09 19:12:37 +02:00
David Howells
08eeec4452 mm/khugepaged.c: fix khugepaged's request size in collapse_file
commit e5a59d308f52bb0052af5790c22173651b187465 upstream.

collapse_file() in khugepaged passes PAGE_SIZE as the number of pages to
be read to page_cache_sync_readahead().  The intent was probably to read
a single page.  Fix it to use the number of pages to the end of the
window instead.

Fixes: 99cb0dbd47 ("mm,thp: add read-only THP support for (non-shmem) FS")
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Acked-by: Song Liu <songliubraving@fb.com>
Acked-by: Yang Shi <shy828301@gmail.com>
Acked-by: Pankaj Gupta <pankaj.gupta.linux@gmail.com>
Cc: Eric Biggers <ebiggers@google.com>
Link: https://lkml.kernel.org/r/20200903140844.14194-2-willy@infradead.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-09 19:12:37 +02:00
Muchun Song
af7786b20c mm/hugetlb: fix a race between hugetlb sysctl handlers
commit 17743798d81238ab13050e8e2833699b54e15467 upstream.

There is a race between the assignment of `table->data` and write value
to the pointer of `table->data` in the __do_proc_doulongvec_minmax() on
the other thread.

  CPU0:                                 CPU1:
                                        proc_sys_write
  hugetlb_sysctl_handler                  proc_sys_call_handler
  hugetlb_sysctl_handler_common             hugetlb_sysctl_handler
    table->data = &tmp;                       hugetlb_sysctl_handler_common
                                                table->data = &tmp;
      proc_doulongvec_minmax
        do_proc_doulongvec_minmax           sysctl_head_finish
          __do_proc_doulongvec_minmax         unuse_table
            i = table->data;
            *i = val;  // corrupt CPU1's stack

Fix this by duplicating the `table`, and only update the duplicate of
it.  And introduce a helper of proc_hugetlb_doulongvec_minmax() to
simplify the code.

The following oops was seen:

    BUG: kernel NULL pointer dereference, address: 0000000000000000
    #PF: supervisor instruction fetch in kernel mode
    #PF: error_code(0x0010) - not-present page
    Code: Bad RIP value.
    ...
    Call Trace:
     ? set_max_huge_pages+0x3da/0x4f0
     ? alloc_pool_huge_page+0x150/0x150
     ? proc_doulongvec_minmax+0x46/0x60
     ? hugetlb_sysctl_handler_common+0x1c7/0x200
     ? nr_hugepages_store+0x20/0x20
     ? copy_fd_bitmaps+0x170/0x170
     ? hugetlb_sysctl_handler+0x1e/0x20
     ? proc_sys_call_handler+0x2f1/0x300
     ? unregister_sysctl_table+0xb0/0xb0
     ? __fd_install+0x78/0x100
     ? proc_sys_write+0x14/0x20
     ? __vfs_write+0x4d/0x90
     ? vfs_write+0xef/0x240
     ? ksys_write+0xc0/0x160
     ? __ia32_sys_read+0x50/0x50
     ? __close_fd+0x129/0x150
     ? __x64_sys_write+0x43/0x50
     ? do_syscall_64+0x6c/0x200
     ? entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fixes: e5ff215941 ("hugetlb: multiple hstates for multiple page sizes")
Signed-off-by: Muchun Song <songmuchun@bytedance.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Andi Kleen <ak@linux.intel.com>
Link: http://lkml.kernel.org/r/20200828031146.43035-1-songmuchun@bytedance.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-09 19:12:37 +02:00
Mrinal Pandey
f2cd86225c checkpatch: fix the usage of capture group ( ... )
commit 13e45417cedbfc44b1926124b1846f5ee8c6ba4a upstream.

The usage of "capture group (...)" in the immediate condition after `&&`
results in `$1` being uninitialized.  This issues a warning "Use of
uninitialized value $1 in regexp compilation at ./scripts/checkpatch.pl
line 2638".

I noticed this bug while running checkpatch on the set of commits from
v5.7 to v5.8-rc1 of the kernel on the commits with a diff content in
their commit message.

This bug was introduced in the script by commit e518e9a59e
("checkpatch: emit an error when there's a diff in a changelog").  It
has been in the script since then.

The author intended to store the match made by capture group in variable
`$1`.  This should have contained the name of the file as `[\w/]+`
matched.  However, this couldn't be accomplished due to usage of capture
group and `$1` in the same regular expression.

Fix this by placing the capture group in the condition before `&&`.
Thus, `$1` can be initialized to the text that capture group matches
thereby setting it to the desired and required value.

Fixes: e518e9a59e ("checkpatch: emit an error when there's a diff in a changelog")
Signed-off-by: Mrinal Pandey <mrinalmni@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Tested-by: Lukas Bulwahn <lukas.bulwahn@gmail.com>
Reviewed-by: Lukas Bulwahn <lukas.bulwahn@gmail.com>
Cc: Joe Perches <joe@perches.com>
Link: https://lkml.kernel.org/r/20200714032352.f476hanaj2dlmiot@mrinalpandey
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-09 19:12:37 +02:00
Sowjanya Komatineni
59ac5bfa82 sdhci: tegra: Add missing TMCLK for data timeout
commit 8048822bac01936fda2c7b924a52131da81e6198 upstream.

commit b5a84ecf02 ("mmc: tegra: Add Tegra210 support")

Tegra210 and later has a separate sdmmc_legacy_tm (TMCLK) used by Tegra
SDMMC hawdware for data timeout to achive better timeout than using
SDCLK and using TMCLK is recommended.

USE_TMCLK_FOR_DATA_TIMEOUT bit in Tegra SDMMC register
SDHCI_TEGRA_VENDOR_SYS_SW_CTRL can be used to choose either TMCLK or
SDCLK for data timeout.

Default USE_TMCLK_FOR_DATA_TIMEOUT bit is set to 1 and TMCLK is used
for data timeout by Tegra SDMMC hardware and having TMCLK not enabled
is not recommended.

So, this patch adds quirk NVQUIRK_HAS_TMCLK for SoC having separate
timeout clock and keeps TMCLK enabled all the time.

Fixes: b5a84ecf02 ("mmc: tegra: Add Tegra210 support")
Cc: stable <stable@vger.kernel.org> # 5.4
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Sowjanya Komatineni <skomatineni@nvidia.com>
Link: https://lore.kernel.org/r/1598548861-32373-8-git-send-email-skomatineni@nvidia.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-09 19:12:36 +02:00
Wei Li
e915b3b63d perf record: Correct the help info of option "--no-bpf-event"
commit a060c1f12b525ba828f871eff3127dabf8daa1e6 upstream.

The help info of option "--no-bpf-event" is wrongly described as "record
bpf events", correct it.

Committer testing:

  $ perf record -h bpf

   Usage: perf record [<options>] [<command>]
      or: perf record [<options>] -- <command> [<options>]

          --clang-opt <clang options>
                            options passed to clang when compiling BPF scriptlets
          --clang-path <clang path>
                            clang binary to use for compiling BPF scriptlets
          --no-bpf-event    do not record bpf events

  $

Fixes: 71184c6ab7 ("perf record: Replace option --bpf-event with --no-bpf-event")
Signed-off-by: Wei Li <liwei391@huawei.com>
Acked-by: Song Liu <songliubraving@fb.com>
Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Hanjun Guo <guohanjun@huawei.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Li Bin <huawei.libin@huawei.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Link: http://lore.kernel.org/lkml/20200819031947.12115-1-liwei391@huawei.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-09 19:12:36 +02:00
Alex Williamson
894a6f0be3 vfio/pci: Fix SR-IOV VF handling with MMIO blocking
commit ebfa440ce38b7e2e04c3124aa89c8a9f4094cf21 upstream.

SR-IOV VFs do not implement the memory enable bit of the command
register, therefore this bit is not set in config space after
pci_enable_device().  This leads to an unintended difference
between PF and VF in hand-off state to the user.  We can correct
this by setting the initial value of the memory enable bit in our
virtualized config space.  There's really no need however to
ever fault a user on a VF though as this would only indicate an
error in the user's management of the enable bit, versus a PF
where the same access could trigger hardware faults.

Fixes: abafbc551fdd ("vfio-pci: Invalidate mmaps and block MMIO access on disabled memory")
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-09 19:12:36 +02:00
Yang Shi
f4fa8d937e mm: madvise: fix vma user-after-free
commit 7867fd7cc44e63c6673cd0f8fea155456d34d0de upstream.

The syzbot reported the below use-after-free:

  BUG: KASAN: use-after-free in madvise_willneed mm/madvise.c:293 [inline]
  BUG: KASAN: use-after-free in madvise_vma mm/madvise.c:942 [inline]
  BUG: KASAN: use-after-free in do_madvise.part.0+0x1c8b/0x1cf0 mm/madvise.c:1145
  Read of size 8 at addr ffff8880a6163eb0 by task syz-executor.0/9996

  CPU: 0 PID: 9996 Comm: syz-executor.0 Not tainted 5.9.0-rc1-syzkaller #0
  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
  Call Trace:
    __dump_stack lib/dump_stack.c:77 [inline]
    dump_stack+0x18f/0x20d lib/dump_stack.c:118
    print_address_description.constprop.0.cold+0xae/0x497 mm/kasan/report.c:383
    __kasan_report mm/kasan/report.c:513 [inline]
    kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530
    madvise_willneed mm/madvise.c:293 [inline]
    madvise_vma mm/madvise.c:942 [inline]
    do_madvise.part.0+0x1c8b/0x1cf0 mm/madvise.c:1145
    do_madvise mm/madvise.c:1169 [inline]
    __do_sys_madvise mm/madvise.c:1171 [inline]
    __se_sys_madvise mm/madvise.c:1169 [inline]
    __x64_sys_madvise+0xd9/0x110 mm/madvise.c:1169
    do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
    entry_SYSCALL_64_after_hwframe+0x44/0xa9

  Allocated by task 9992:
    kmem_cache_alloc+0x138/0x3a0 mm/slab.c:3482
    vm_area_alloc+0x1c/0x110 kernel/fork.c:347
    mmap_region+0x8e5/0x1780 mm/mmap.c:1743
    do_mmap+0xcf9/0x11d0 mm/mmap.c:1545
    vm_mmap_pgoff+0x195/0x200 mm/util.c:506
    ksys_mmap_pgoff+0x43a/0x560 mm/mmap.c:1596
    do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
    entry_SYSCALL_64_after_hwframe+0x44/0xa9

  Freed by task 9992:
    kmem_cache_free.part.0+0x67/0x1f0 mm/slab.c:3693
    remove_vma+0x132/0x170 mm/mmap.c:184
    remove_vma_list mm/mmap.c:2613 [inline]
    __do_munmap+0x743/0x1170 mm/mmap.c:2869
    do_munmap mm/mmap.c:2877 [inline]
    mmap_region+0x257/0x1780 mm/mmap.c:1716
    do_mmap+0xcf9/0x11d0 mm/mmap.c:1545
    vm_mmap_pgoff+0x195/0x200 mm/util.c:506
    ksys_mmap_pgoff+0x43a/0x560 mm/mmap.c:1596
    do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
    entry_SYSCALL_64_after_hwframe+0x44/0xa9

It is because vma is accessed after releasing mmap_lock, but someone
else acquired the mmap_lock and the vma is gone.

Releasing mmap_lock after accessing vma should fix the problem.

Fixes: 692fe62433 ("mm: Handle MADV_WILLNEED through vfs_fadvise()")
Reported-by: syzbot+b90df26038d1d5d85c97@syzkaller.appspotmail.com
Signed-off-by: Yang Shi <shy828301@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Jan Kara <jack@suse.cz>
Cc: <stable@vger.kernel.org>	[5.4+]
Link: https://lkml.kernel.org/r/20200816141204.162624-1-shy828301@gmail.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-09 19:12:36 +02:00
Eugeniu Rosca
87fb7b0c52 mm: slub: fix conversion of freelist_corrupted()
commit dc07a728d49cf025f5da2c31add438d839d076c0 upstream.

Commit 52f23478081ae0 ("mm/slub.c: fix corrupted freechain in
deactivate_slab()") suffered an update when picked up from LKML [1].

Specifically, relocating 'freelist = NULL' into 'freelist_corrupted()'
created a no-op statement.  Fix it by sticking to the behavior intended
in the original patch [1].  In addition, make freelist_corrupted()
immune to passing NULL instead of &freelist.

The issue has been spotted via static analysis and code review.

[1] https://lore.kernel.org/linux-mm/20200331031450.12182-1-dongli.zhang@oracle.com/

Fixes: 52f23478081ae0 ("mm/slub.c: fix corrupted freechain in deactivate_slab()")
Signed-off-by: Eugeniu Rosca <erosca@de.adit-jv.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Dongli Zhang <dongli.zhang@oracle.com>
Cc: Joe Jin <joe.jin@oracle.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: David Rientjes <rientjes@google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/20200824130643.10291-1-erosca@de.adit-jv.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-09 19:12:36 +02:00
Ye Bin
291144f111 dm thin metadata: Fix use-after-free in dm_bm_set_read_only
commit 3a653b205f29b3f9827a01a0c88bfbcb0d169494 upstream.

The following error ocurred when testing disk online/offline:

[  301.798344] device-mapper: thin: 253:5: aborting current metadata transaction
[  301.848441] device-mapper: thin: 253:5: failed to abort metadata transaction
[  301.849206] Aborting journal on device dm-26-8.
[  301.850489] EXT4-fs error (device dm-26) in __ext4_new_inode:943: Journal has aborted
[  301.851095] EXT4-fs (dm-26): Delayed block allocation failed for inode 398742 at logical offset 181 with max blocks 19 with error 30
[  301.854476] BUG: KASAN: use-after-free in dm_bm_set_read_only+0x3a/0x40 [dm_persistent_data]

Reason is:

 metadata_operation_failed
    abort_transaction
        dm_pool_abort_metadata
	    __create_persistent_data_objects
	        r = __open_or_format_metadata
	        if (r) --> If failed will free pmd->bm but pmd->bm not set NULL
		    dm_block_manager_destroy(pmd->bm);
    set_pool_mode
	dm_pool_metadata_read_only(pool->pmd);
	dm_bm_set_read_only(pmd->bm);  --> use-after-free

Add checks to see if pmd->bm is NULL in dm_bm_set_read_only and
dm_bm_set_read_write functions.  If bm is NULL it means creating the
bm failed and so dm_bm_is_read_only must return true.

Signed-off-by: Ye Bin <yebin10@huawei.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-09 19:12:36 +02:00
Ye Bin
cfe85a4a85 dm thin metadata: Avoid returning cmd->bm wild pointer on error
commit 219403d7e56f9b716ad80ab87db85d29547ee73e upstream.

Maybe __create_persistent_data_objects() caller will use PTR_ERR as a
pointer, it will lead to some strange things.

Signed-off-by: Ye Bin <yebin10@huawei.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-09 19:12:36 +02:00
Ye Bin
392a6afcbf dm cache metadata: Avoid returning cmd->bm wild pointer on error
commit d16ff19e69ab57e08bf908faaacbceaf660249de upstream.

Maybe __create_persistent_data_objects() caller will use PTR_ERR as a
pointer, it will lead to some strange things.

Signed-off-by: Ye Bin <yebin10@huawei.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-09 19:12:35 +02:00
Damien Le Moal
9dd74db0bf dm crypt: Initialize crypto wait structures
commit 7785a9e4c228db6d01086a52d5685cd7336a08b7 upstream.

Use the DECLARE_CRYPTO_WAIT() macro to properly initialize the crypto
wait structures declared on stack before their use with
crypto_wait_req().

Fixes: 39d13a1ac4 ("dm crypt: reuse eboiv skcipher for IV generation")
Fixes: bbb1658461ac ("dm crypt: Implement Elephant diffuser for Bitlocker compatibility")
Cc: stable@vger.kernel.org
Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-09 19:12:35 +02:00
Mikulas Patocka
e6ddb1d45c dm integrity: fix error reporting in bitmap mode after creation
commit e27fec66f0a94e35a35548bd0b29ae616e62ec62 upstream.

The dm-integrity target did not report errors in bitmap mode just after
creation. The reason is that the function integrity_recalc didn't clean up
ic->recalc_bitmap as it proceeded with recalculation.

Fix this by updating the bitmap accordingly -- the double shift serves
to rounddown.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Fixes: 468dfca38b ("dm integrity: add a bitmap mode")
Cc: stable@vger.kernel.org # v5.2+
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-09 19:12:35 +02:00
Mike Snitzer
b30f628bee dm mpath: fix racey management of PG initialization
commit c322ee9320eaa4013ca3620b1130992916b19b31 upstream.

Commit 935fcc56ab ("dm mpath: only flush workqueue when needed")
changed flush_multipath_work() to avoid needless workqueue
flushing (of a multipath global workqueue). But that change didn't
realize the surrounding flush_multipath_work() code should also only
run if 'pg_init_in_progress' is set.

Fix this by only doing all of flush_multipath_work()'s PG init related
work if 'pg_init_in_progress' is set.

Otherwise multipath_wait_for_pg_init_completion() will run
unconditionally but the preceeding flush_workqueue(kmpath_handlerd)
may not. This could lead to deadlock (though only if kmpath_handlerd
never runs a corresponding work to decrement 'pg_init_in_progress').

It could also be, though highly unlikely, that the kmpath_handlerd
work that does PG init completes before 'pg_init_in_progress' is set,
and then an intervening DM table reload's multipath_postsuspend()
triggers flush_multipath_work().

Fixes: 935fcc56ab ("dm mpath: only flush workqueue when needed")
Cc: stable@vger.kernel.org
Reported-by: Ben Marzinski <bmarzins@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-09 19:12:35 +02:00
Mikulas Patocka
226fb99eb5 dm writecache: handle DAX to partitions on persistent memory correctly
commit f9e040efcc28309e5c592f7e79085a9a52e31f58 upstream.

The function dax_direct_access doesn't take partitions into account,
it always maps pages from the beginning of the device. Therefore,
persistent_memory_claim() must get the partition offset using
get_start_sect() and add it to the page offsets passed to
dax_direct_access().

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Fixes: 48debafe4f ("dm: add writecache target")
Cc: stable@vger.kernel.org # 4.18+
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-09 19:12:35 +02:00