Author	SHA1	Message	Date
Greg Kroah-Hartman	c0b1779755	This is the 5.4.59 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl88xTwACgkQONu9yGCS aT60Lw/9HV3JZ0KDYKHRRS/n4UWh2w7jHe5hwFTfX8/KibexzGzgV3gTaXsyQx75 Bj2ruJTGZKDvy+a9/IsjTe1v1/HPwPydDyfABNl/Rn8vQuyHzyyGzQo2owqGb57w 4wVuoqhPASn0n2QAMG05caAx1uqPlXcT/I4H8vpzieNEHbB/2TbwFiWvrDC2d+nw mw1PkRmaFp2GSMOHSb68n2oYUv19EBHDtxF9WkwyftdKALQYz5x4O/n4lhpzMSmO OeiUg/dpLi0bptL1SQAfaY/Lxa1gFb62YvP47WbWp/P6zespOInk2n8kmpoHxol3 MMZelRCdl9NtIKVXMEOFEv/asXPlF2wARGmNejGCYLaRqal1bH67yG4eja7biIJe gr5OBOFVPol83sPAnb6V4P2SEs650WR95hshYpRL9lbmcHY4q5zoXVm9ul/Hp49R qjjfxHDNQQoQgX4ZhEJLp2a5AEJUM4Kz28pZXHyczKYc2R6/AZWqHfnbQVURf+au 0xJ/tOFxn3yqRtTkmuuifkZcUTJ5iRnzxUUYiGyhTqZOTNZTD0FgiI+S7gckI//K idoWGTszHZb6YkNBEwz4WJFtxCGpO95xgD95jOpJVxFcJ5f5PpfZE7RkXUDLR5UO XzJopB3nOT1h3EoI3xq7aPDF1hKbkp+VRMWcVrBeP9KgcpLisS4= =Tk2c -----END PGP SIGNATURE----- Merge 5.4.59 into android11-5.4 Changes in 5.4.59 tracepoint: Mark __tracepoint_string's __used HID: input: Fix devices that return multiple bytes in battery report nvme: add a Identify Namespace Identification Descriptor list quirk fs/io_uring.c: Fix uninitialized variable is referenced in io_submit_sqe clk: qcom: clk-rpmh: Wait for completion when enabling clocks x86/mce/inject: Fix a wrong assignment of i_mce.status sched/fair: Fix NOHZ next idle balance sched: correct SD_flags returned by tl->sd_flags() arm64: dts: rockchip: fix rk3368-lion gmac reset gpio arm64: dts: rockchip: fix rk3399-puma vcc5v0-host gpio arm64: dts: rockchip: fix rk3399-puma gmac reset gpio EDAC: Fix reference count leaks crc-t10dif: Fix potential crypto notify dead-lock arm64: dts: qcom: msm8916: Replace invalid bias-pull-none property blktrace: fix debugfs use after free crypto: ccree - fix resource leak on error path ARM: exynos: MCPM: Restore big.LITTLE cpuidle support firmware: arm_scmi: Fix SCMI genpd domain probing arm64: dts: exynos: Fix silent hang after boot on Espresso sched/uclamp: Fix initialization of struct uclamp_rq clk: scmi: Fix min and max rate when registering clocks with discrete rates m68k: mac: Don't send IOP message until channel is idle m68k: mac: Fix IOP status/control register writes platform/x86: intel-hid: Fix return value check in check_acpi_dev() platform/x86: intel-vbtn: Fix return value check in check_acpi_dev() ARM: dts: gose: Fix ports node name for adv7180 ARM: dts: gose: Fix ports node name for adv7612 ARM: at91: pm: add missing put_device() call in at91_pm_sram_init() ARM: dts: sunxi: bananapi-m2-plus-v1.2: Add regulator supply to all CPU cores ARM: dts: sunxi: bananapi-m2-plus-v1.2: Fix CPU supply voltages spi: lantiq: fix: Rx overflow error in full duplex mode tpm: Require that all digests are present in TCG_PCR_EVENT2 structures recordmcount: only record relocation of type R_AARCH64_CALL26 on arm64. regulator: fix memory leak on error path of regulator_register() io_uring: fix sq array offset calculation spi: rockchip: Fix error in SPI slave pio read ARM: socfpga: PM: add missing put_device() call in socfpga_setup_ocram_self_refresh() iocost: Fix check condition of iocg abs_vdebt irqchip/ti-sci-inta: Fix return value about devm_ioremap_resource() seccomp: Fix ioctl number for SECCOMP_IOCTL_NOTIF_ID_VALID md: raid0/linear: fix dereference before null check on pointer mddev nvme-tcp: fix controller reset hang during traffic nvme-rdma: fix controller reset hang during traffic nvme-multipath: fix logic for non-optimized paths nvme-multipath: do not fall back to __nvme_find_path() for non-optimized paths drm/tilcdc: fix leak & null ref in panel_connector_get_modes soc: qcom: rpmh-rsc: Set suppress_bind_attrs flag Bluetooth: add a mutex lock to avoid UAF in do_enale_set loop: be paranoid on exit and prevent new additions / removals fs/btrfs: Add cond_resched() for try_release_extent_mapping() stalls drm/amdgpu: avoid dereferencing a NULL pointer drm/radeon: Fix reference count leaks caused by pm_runtime_get_sync crypto: aesni - Fix build with LLVM_IAS=1 video: fbdev: savage: fix memory leak on error handling path in probe video: fbdev: neofb: fix memory leak in neo_scan_monitor() bus: ti-sysc: Add missing quirk flags for usb_host_hs md-cluster: fix wild pointer of unlock_all_bitmaps() drm/nouveau/kms/nv50-: Fix disabling dithering arm64: dts: hisilicon: hikey: fixes to comply with adi, adv7533 DT binding drm/etnaviv: fix ref count leak via pm_runtime_get_sync drm/nouveau: fix reference count leak in nouveau_debugfs_strap_peek drm/nouveau: fix multiple instances of reference count leaks mmc: sdhci-cadence: do not use hardware tuning for SD mode btrfs: fix lockdep splat from btrfs_dump_space_info usb: mtu3: clear dual mode of u3port when disable device drm: msm: a6xx: fix gpu failure after system resume drm/msm: Fix a null pointer access in msm_gem_shrinker_count() drm/debugfs: fix plain echo to connector "force" attribute drm/radeon: disable AGP by default irqchip/irq-mtk-sysirq: Replace spinlock with raw_spinlock mm/mmap.c: Add cond_resched() for exit_mmap() CPU stalls drm/amdgpu/display bail early in dm_pp_get_static_clocks drm/amd/powerplay: fix compile error with ARCH=arc bpf: Fix fds_example SIGSEGV error brcmfmac: keep SDIO watchdog running when console_interval is non-zero brcmfmac: To fix Bss Info flag definition Bug brcmfmac: set state of hanger slot to FREE when flushing PSQ platform/x86: asus-nb-wmi: add support for ASUS ROG Zephyrus G14 and G15 iwlegacy: Check the return value of pcie_capability_read_*() gpu: host1x: debug: Fix multiple channels emitting messages simultaneously ionic: update eid test for overflow mmc: sdhci-pci-o2micro: Bug fix for O2 host controller Seabird1 usb: gadget: net2280: fix memory leak on probe error handling paths bdc: Fix bug causing crash after multiple disconnects usb: bdc: Halt controller on suspend dyndbg: fix a BUG_ON in ddebug_describe_flags bcache: fix super block seq numbers comparision in register_cache_set() ACPICA: Do not increment operation_region reference counts for field units drm/msm: ratelimit crtc event overflow error drm/gem: Fix a leak in drm_gem_objects_lookup() drm/bridge: ti-sn65dsi86: Clear old error bits before AUX transfers agp/intel: Fix a memory leak on module initialisation failure mwifiex: Fix firmware filename for sd8977 chipset mwifiex: Fix firmware filename for sd8997 chipset btmrvl: Fix firmware filename for sd8977 chipset btmrvl: Fix firmware filename for sd8997 chipset video: fbdev: sm712fb: fix an issue about iounmap for a wrong address console: newport_con: fix an issue about leak related system resources video: pxafb: Fix the function used to balance a 'dma_alloc_coherent()' call ath10k: Acquire tx_lock in tx error paths iio: improve IIO_CONCENTRATION channel type description drm/etnaviv: Fix error path on failure to enable bus clk drm/arm: fix unintentional integer overflow on left shift clk: bcm63xx-gate: fix last clock availability leds: lm355x: avoid enum conversion warning Bluetooth: btusb: fix up firmware download sequence Bluetooth: btmtksdio: fix up firmware download sequence media: cxusb-analog: fix V4L2 dependency media: marvell-ccic: Add missed v4l2_async_notifier_cleanup() media: omap3isp: Add missed v4l2_ctrl_handler_free() for preview_init_entities() ASoC: SOF: nocodec: add missing .owner field ASoC: Intel: bxt_rt298: add missing .owner field scsi: cumana_2: Fix different dev_id between request_irq() and free_irq() drm/mipi: use dcs write for mipi_dsi_dcs_set_tear_scanline cxl: Fix kobject memleak drm/radeon: fix array out-of-bounds read and write issues staging: vchiq_arm: Add a matching unregister call iavf: fix error return code in iavf_init_get_resources() iavf: Fix updating statistics RDMA/core: Fix bogus WARN_ON during ib_unregister_device_queued() scsi: powertec: Fix different dev_id between request_irq() and free_irq() scsi: eesox: Fix different dev_id between request_irq() and free_irq() ipvs: allow connection reuse for unconfirmed conntrack media: firewire: Using uninitialized values in node_probe() media: exynos4-is: Add missed check for pinctrl_lookup_state() media: cros-ec-cec: do not bail on device_init_wakeup failure xfs: don't eat an EIO/ENOSPC writeback error when scrubbing data fork xfs: fix reflink quota reservation accounting error RDMA/rxe: Skip dgid check in loopback mode PCI: Fix pci_cfg_wait queue locking problem drm/stm: repair runtime power management kobject: Avoid premature parent object freeing in kobject_cleanup() leds: core: Flush scheduled work for system suspend drm: panel: simple: Fix bpc for LG LB070WV8 panel phy: exynos5-usbdrd: Calibrating makes sense only for USB2.0 PHY drm/bridge: sil_sii8620: initialize return of sii8620_readb scsi: scsi_debug: Add check for sdebug_max_queue during module init mwifiex: Prevent memory corruption handling keys kernfs: do not call fsnotify() with name without a parent powerpc/rtas: don't online CPUs for partition suspend powerpc/vdso: Fix vdso cpu truncation RDMA/qedr: SRQ's bug fixes RDMA/rxe: Prevent access to wr->next ptr afrer wr is posted to send queue ima: Have the LSM free its audit rule staging: rtl8192u: fix a dubious looking mask before a shift ASoC: meson: fixes the missed kfree() for axg_card_add_tdm_loopback PCI/ASPM: Add missing newline in sysfs 'policy' phy: renesas: rcar-gen3-usb2: move irq registration to init powerpc/book3s64/pkeys: Use PVR check instead of cpu feature drm/imx: fix use after free drm/imx: tve: fix regulator_disable error path gpu: ipu-v3: Restore RGB32, BGR32 spi: lantiq-ssc: Fix warning by using WQ_MEM_RECLAIM USB: serial: iuu_phoenix: fix led-activity helpers usb: core: fix quirks_param_set() writing to a const pointer thermal: ti-soc-thermal: Fix reversed condition in ti_thermal_expose_sensor() coresight: tmc: Fix TMC mode read in tmc_read_unprepare_etb() powerpc/perf: Fix missing is_sier_aviable() during build mt76: mt7615: fix potential memory leak in mcu message handler phy: armada-38x: fix NETA lockup when repeatedly switching speeds MIPS: OCTEON: add missing put_device() call in dwc3_octeon_device_init() usb: dwc2: Fix error path in gadget registration usb: gadget: f_uac2: fix AC Interface Header Descriptor wTotalLength scsi: megaraid_sas: Clear affinity hint scsi: mesh: Fix panic after host or bus reset net: dsa: mv88e6xxx: MV88E6097 does not support jumbo configuration macintosh/via-macii: Access autopoll_devs when inside lock PCI: cadence: Fix updating Vendor ID and Subsystem Vendor ID register RDMA/core: Fix return error value in _ib_modify_qp() to negative Smack: fix another vsscanf out of bounds Smack: prevent underflow in smk_set_cipso() power: supply: check if calc_soc succeeded in pm860x_init_battery Bluetooth: hci_h5: Set HCI_UART_RESET_ON_INIT to correct flags Bluetooth: hci_serdev: Only unregister device if it was registered net: dsa: rtl8366: Fix VLAN semantics net: dsa: rtl8366: Fix VLAN set-up xfs: fix inode allocation block res calculation precedence selftests/powerpc: Squash spurious errors due to device removal powerpc/32s: Fix CONFIG_BOOK3S_601 uses powerpc/boot: Fix CONFIG_PPC_MPC52XX references selftests/powerpc: Fix CPU affinity for child process RDMA/netlink: Remove CAP_NET_RAW check when dump a raw QP PCI: Release IVRS table in AMD ACS quirk cpufreq: ap806: fix cpufreq driver needs ap cpu clk selftests/powerpc: Fix online CPU selection ASoC: meson: axg-tdm-interface: fix link fmt setup ASoC: meson: axg-tdmin: fix g12a skew ASoC: meson: axg-tdm-formatters: fix sclk inversion ASoC: fsl_sai: Fix value of FSL_SAI_CR1_RFW_MASK s390/qeth: don't process empty bridge port events ice: Graceful error handling in HW table calloc failure rtw88: fix LDPC field for RA info rtw88: fix short GI capability based on current bandwidth rtw88: coex: only skip coex triggered by BT info wl1251: fix always return 0 error tools, build: Propagate build failures from tools/build/Makefile.build tools, bpftool: Fix wrong return value in do_dump() net/mlx5: DR, Change push vlan action sequence net/mlx5: Delete extra dump stack that gives nothing net: ethernet: aquantia: Fix wrong return value liquidio: Fix wrong return value in cn23xx_get_pf_num() net: spider_net: Fix the size used in a 'dma_free_coherent()' call fsl/fman: use 32-bit unsigned integer fsl/fman: fix dereference null return value fsl/fman: fix unreachable code fsl/fman: check dereferencing null pointer fsl/fman: fix eth hash table allocation net: thunderx: initialize VF's mailbox mutex before first usage dlm: Fix kobject memleak ocfs2: fix unbalanced locking pinctrl-single: fix pcs_parse_pinconf() return value svcrdma: Fix page leak in svc_rdma_recv_read_chunk() SUNRPC: Fix ("SUNRPC: Add "@len" parameter to gss_unwrap()") x86/fsgsbase/64: Fix NULL deref in 86_fsgsbase_read_task crypto: aesni - add compatibility with IAS af_packet: TPACKET_V3: fix fill status rwlock imbalance drivers/net/wan/lapbether: Added needed_headroom and a skb->len check net: Fix potential memory leak in proto_register() net/nfc/rawsock.c: add CAP_NET_RAW check. net: phy: fix memory leak in device-create error path net: Set fput_needed iff FDPUT_FPUT is set net/tls: Fix kmap usage tcp: correct read of TFO keys on big endian systems vmxnet3: use correct tcp hdr length when packet is encapsulated net: refactor bind_bucket fastreuse into helper net: initialize fastreuse on inet_inherit_port USB: serial: cp210x: re-enable auto-RTS on open USB: serial: cp210x: enable usb generic throttle/unthrottle ALSA: hda - fix the micmute led status for Lenovo ThinkCentre AIO ALSA: usb-audio: Creative USB X-Fi Pro SB1095 volume knob support ALSA: usb-audio: fix overeager device match for MacroSilicon MS2109 ALSA: usb-audio: work around streaming quirk for MacroSilicon MS2109 9p: Fix memory leak in v9fs_mount media: media-request: Fix crash if memory allocation fails drm/ttm/nouveau: don't call tt destroy callback on alloc failure. io_uring: set ctx sq/cq entry count earlier NFS: Don't move layouts to plh_return_segs list while in use NFS: Don't return layout segments that are in use cpufreq: Fix locking issues with governors cpufreq: dt: fix oops on armada37xx include/asm-generic/vmlinux.lds.h: align ro_after_init spi: spidev: Align buffers for DMA mtd: rawnand: qcom: avoid write to unavailable register erofs: fix extended inode could cross boundary Revert "parisc: Drop LDCW barrier in CAS code when running UP" Revert "parisc: Use ldcw instruction for SMP spinlock release barrier" Revert "parisc: Revert "Release spinlocks using ordered store"" parisc: Do not use an ordered store in pa_tlb_lock() parisc: Implement __smp_store_release and __smp_load_acquire barriers parisc: mask out enable and reserved bits from sba imask ARM: 8992/1: Fix unwind_frame for clang-built kernels irqdomain/treewide: Free firmware node after domain removal ALSA: usb-audio: add quirk for Pioneer DDJ-RB tpm: Unify the mismatching TPM space buffer sizes pstore: Fix linking when crypto API disabled crypto: hisilicon - don't sleep of CRYPTO_TFM_REQ_MAY_SLEEP was not specified crypto: qat - fix double free in qat_uclo_create_batch_init_list crypto: ccp - Fix use of merged scatterlists crypto: cpt - don't sleep of CRYPTO_TFM_REQ_MAY_SLEEP was not specified bitfield.h: don't compile-time validate _val in FIELD_FIT fs/minix: check return value of sb_getblk() fs/minix: don't allow getting deleted inodes fs/minix: reject too-large maximum file size xen/balloon: fix accounting in alloc_xenballooned_pages error path xen/balloon: make the balloon wait interruptible xen/gntdev: Fix dmabuf import with non-zero sgt offset s390/dasd: fix inability to use DASD with DIAG driver s390/gmap: improve THP splitting io_uring: Fix NULL pointer dereference in loop_rw_iter() Linux 5.4.59 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I4bc685ec9234d8f72a9c66ee2d509a2975f6d711	2020-08-19 08:40:57 +02:00
Tim Froidcoeur	dcedddbc7b	net: refactor bind_bucket fastreuse into helper ... [ Upstream commit 62ffc589abb176821662efc4525ee4ac0b9c3894 ] Refactor the fastreuse update code in inet_csk_get_port into a small helper function that can be called from other places. Acked-by: Matthieu Baerts <matthieu.baerts@tessares.net> Signed-off-by: Tim Froidcoeur <tim.froidcoeur@tessares.net> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2020-08-19 08:16:23 +02:00
Jason Baron	e07d0ccd7f	tcp: correct read of TFO keys on big endian systems ... [ Upstream commit f19008e676366c44e9241af57f331b6c6edf9552 ] When TFO keys are read back on big endian systems either via the global sysctl interface or via getsockopt() using TCP_FASTOPEN_KEY, the values don't match what was written. For example, on s390x: # echo "1-2-3-4" > /proc/sys/net/ipv4/tcp_fastopen_key # cat /proc/sys/net/ipv4/tcp_fastopen_key 02000000-01000000-04000000-03000000 Instead of: # cat /proc/sys/net/ipv4/tcp_fastopen_key 00000001-00000002-00000003-00000004 Fix this by converting to the correct endianness on read. This was reported by Colin Ian King when running the 'tcp_fastopen_backup_key' net selftest on s390x, which depends on the read value matching what was written. I've confirmed that the test now passes on big and little endian systems. Signed-off-by: Jason Baron <jbaron@akamai.com> Fixes: 438ac88009 ("net: fastopen: robustness and endianness fixes for SipHash") Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Eric Dumazet <edumazet@google.com> Reported-and-tested-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2020-08-19 08:16:23 +02:00
Julian Anastasov	0c122fc90d	ipvs: allow connection reuse for unconfirmed conntrack ... [ Upstream commit f0a5e4d7a594e0fe237d3dfafb069bb82f80f42f ] YangYuxi is reporting that connection reuse is causing one-second delay when SYN hits existing connection in TIME_WAIT state. Such delay was added to give time to expire both the IPVS connection and the corresponding conntrack. This was considered a rare case at that time but it is causing problem for some environments such as Kubernetes. As nf_conntrack_tcp_packet() can decide to release the conntrack in TIME_WAIT state and to replace it with a fresh NEW conntrack, we can use this to allow rescheduling just by tuning our check: if the conntrack is confirmed we can not schedule it to different real server and the one-second delay still applies but if new conntrack was created, we are free to select new real server without any delays. YangYuxi lists some of the problem reports: - One second connection delay in masquerading mode: https://marc.info/?t=151683118100004&r=1&w=2 - IPVS low throughput #70747 https://github.com/kubernetes/kubernetes/issues/70747 - Apache Bench can fill up ipvs service proxy in seconds #544 https://github.com/cloudnativelabs/kube-router/issues/544 - Additional 1s latency in `host -> service IP -> pod` https://github.com/kubernetes/kubernetes/issues/90854 Fixes: f719e3754e ("ipvs: drop first packet to redirect conntrack") Co-developed-by: YangYuxi <yx.atom1@gmail.com> Signed-off-by: YangYuxi <yx.atom1@gmail.com> Signed-off-by: Julian Anastasov <ja@ssi.bg> Reviewed-by: Simon Horman <horms@verge.net.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2020-08-19 08:16:10 +02:00
Greg Kroah-Hartman	6e8e201587	Revert "Revert "genetlink: remove genl_bind"" ... This reverts commit 68815d5b7e which was commit 0845447d9c783a502bd3e13af0f38aa4c7655a77 in 4.19.y and is commit 1e82a62fec613844da9e558f3493540a5b7a7b67 upstream. It was reported that this issue affects Android devices and a vendor wishes it to be applied back, ABI is not an issue here. Leaf changes summary: 5 artifacts changed Changed leaf types summary: 1 leaf type changed Removed/Changed/Added functions summary: 0 Removed, 4 Changed, 0 Added function Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variable 4 functions with some sub-type change: [C] 'function void genl_notify(const genl_family*, sk_buff*, genl_info*, u32, gfp_t)' at genetlink.c:1109:1 has some sub-type changes: [C] 'function int genl_register_family(genl_family*)' at genetlink.h:145:1 has some sub-type changes: [C] 'function int genl_unregister_family(const genl_family*)' at genetlink.h:146:1 has some sub-type changes: [C] 'function void* genlmsg_put(sk_buff*, unsigned int, unsigned int, const genl_family*, int, unsigned char)' at genetlink.h:150:1 has some sub-type changes: 'struct genl_family at genetlink.h:52:1' changed: type size changed from 1024 to 896 (in bits) 2 data member deletions: 'int (net*, int)* genl_family::mcast_bind', at offset 512 (in bits) at genetlink.h:67:1 'void (net*, int)* genl_family::mcast_unbind', at offset 576 (in bits) at genetlink.h:68:1 there are data member changes: 'nlattr** genl_family::attrbuf' offset changed from 640 to 512 (in bits) (by -128 bits) 'const genl_ops* genl_family::ops' offset changed from 704 to 576 (in bits) (by -128 bits) 'const genl_multicast_group* genl_family::mcgrps' offset changed from 768 to 640 (in bits) (by -128 bits) 'unsigned int genl_family::n_ops' offset changed from 832 to 704 (in bits) (by -128 bits) 'unsigned int genl_family::n_mcgrps' offset changed from 864 to 736 (in bits) (by -128 bits) 'unsigned int genl_family::mcgrp_offset' offset changed from 896 to 768 (in bits) (by -128 bits) 'module* genl_family::module' offset changed from 960 to 832 (in bits) (by -128 bits) 4 impacted interfaces Bug: 163861691 Cc: Sean Tranchetti <stranche@codeaurora.org> Cc: Will McVicker <willmcvicker@google.com> Cc: Saravana Kannan <saravanak@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ieaa81ed2445ff12a9a8e00f69d64c78baeec07e5	2020-08-13 15:45:33 +02:00
Greg Kroah-Hartman	3a9b53bc89	This is the 5.4.58 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl8ynngACgkQONu9yGCS aT5cPw/9GiiNZCLyjB3jVyalmN9uDYKQ+eS8H97GG7IBVYyg9whOKIrOCZHcLINH DV5s/qnhRWJPzmQ47410ySuPb6QMvkhWTK7i5Xf+K7BOvoz/snfFGcmdu1CA4KxR CuuH449Y4l3sH+5fPv7+EToovBqA2cfeiz/i5d5Di/N4yODWBCbHHAsZIt0oGvuK sI1aI1K//R7vKZQvQo85tvENbWJWQwDN7eYVQj3aSbvnq8JqVpwTKTBpKfshzgzB RmMSOVpQoQYNivW9oleG0NTQeHqj7alG8anFs3Drgu1hs5dzQhqAFlKddhtRS69j mtrSJuf0GgJEYA6n+PfacoM4l7kHUZcQH9+bglbCXTA3nH24DLT7h0Lybm+ETPXc ZAYo7cHqrS1BWv8VHZggSbqPr6YNKvgeflgS394wAgNEFcaJmaPfS6+elmc0qf2t VPSas7QQruRS1Bqwb6CF2tHsl4N+VdvxX1a2JjHHcF5N3z5aqDm1qaVVQHxAg2rE gXepFNGkEIBhWRxPz+5quxN1XBcUDiQYrzdoaKHxwY+OcdCf635P5Ob+1WK3w1oa qhl/2scs44D67wZSgXHo5N4vMi9HhPOSV77jklgFcg75IzM9YWwYnJADQRHxo7nT 25XEgUlMfxm0ngw+CZWR0ssaP6rB9V1rRLDqb1W5HbqA7lp2YE8= =Fe6H -----END PGP SIGNATURE----- Merge 5.4.58 into android11-5.4 Changes in 5.4.58 USB: serial: qcserial: add EM7305 QDL product ID perf/core: Fix endless multiplex timer USB: iowarrior: fix up report size handling for some devices usb: xhci: define IDs for various ASMedia host controllers usb: xhci: Fix ASMedia ASM1142 DMA addressing io_uring: prevent re-read of sqe->opcode io_uring: Fix use-after-free in io_sq_wq_submit_work() Revert "ALSA: hda: call runtime_allow() for all hda controllers" ALSA: hda/realtek: Add alc269/alc662 pin-tables for Loongson-3 laptops ALSA: hda/ca0132 - Add new quirk ID for Recon3D. ALSA: hda/ca0132 - Fix ZxR Headphone gain control get value. ALSA: hda/ca0132 - Fix AE-5 microphone selection commands. ALSA: seq: oss: Serialize ioctls staging: android: ashmem: Fix lockdep warning for write operation staging: rtl8712: handle firmware load failure Staging: rtl8188eu: rtw_mlme: Fix uninitialized variable authmode Bluetooth: Fix slab-out-of-bounds read in hci_extended_inquiry_result_evt() Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_evt() Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_with_rssi_evt() omapfb: dss: Fix max fclk divider for omap36xx binder: Prevent context manager from incrementing ref 0 Smack: fix use-after-free in smk_write_relabel_self() scripts: add dummy report mode to add_namespace.cocci vgacon: Fix for missing check in scrollback handling mtd: properly check all write ioctls for permissions leds: wm831x-status: fix use-after-free on unbind leds: lm36274: fix use-after-free on unbind leds: da903x: fix use-after-free on unbind leds: lm3533: fix use-after-free on unbind leds: 88pm860x: fix use-after-free on unbind net/9p: validate fds in p9_fd_open drm/nouveau/fbcon: fix module unload when fbcon init has failed for some reason drm/nouveau/fbcon: zero-initialise the mode_cmd2 structure nvme-pci: prevent SK hynix PC400 from using Write Zeroes command drm/drm_fb_helper: fix fbdev with sparc64 i2c: slave: improve sanity check when registering i2c: slave: add sanity check when unregistering usb: hso: check for return value in hso_serial_common_create() net: ethernet: mtk_eth_soc: Always call mtk_gmac0_rgmii_adjust() for mt7623 ALSA: hda: fix NULL pointer dereference during suspend firmware: Fix a reference count leak. cfg80211: check vendor command doit pointer before use igb: reinit_locked() should be called with rtnl_lock atm: fix atm_dev refcnt leaks in atmtcp_remove_persistent tools lib traceevent: Fix memory leak in process_dynamic_array_len Drivers: hv: vmbus: Ignore CHANNELMSG_TL_CONNECT_RESULT(23) xattr: break delegations in {set,remove}xattr Revert "powerpc/kasan: Fix shadow pages allocation failure" PCI: tegra: Revert tegra124 raw_violation_fixup ipv4: Silence suspicious RCU usage warning ipv6: fix memory leaks on IPV6_ADDRFORM path ipv6: Fix nexthop refcnt leak when creating ipv6 route info net: ethernet: mtk_eth_soc: fix MTU warnings rxrpc: Fix race between recvmsg and sendmsg on immediate call failure vxlan: Ensure FDB dump is performed under RCU net: lan78xx: replace bogus endpoint lookup appletalk: Fix atalk_proc_init() return path dpaa2-eth: Fix passing zero to 'PTR_ERR' warning hv_netvsc: do not use VF device if link is down net: gre: recompute gre csum for sctp over gre tunnels net: thunderx: use spin_lock_bh in nicvf_set_rx_mode_task() openvswitch: Prevent kernel-infoleak in ovs_ct_put_key() Revert "vxlan: fix tos value before xmit" selftests/net: relax cpu affinity requirement in msg_zerocopy test tcp: apply a floor of 1 for RTT samples from TCP timestamps ima: move APPRAISE_BOOTPARAM dependency on ARCH_POLICY to runtime nfsd: Fix NFSv4 READ on RDMA when using readv Linux 5.4.58 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I0e89e2c0faf90bdf1f6ac37f9a2c2395cacab054	2020-08-11 18:37:58 +02:00
Cong Wang	89c12bc362	ipv6: fix memory leaks on IPV6_ADDRFORM path ... [ Upstream commit 8c0de6e96c9794cb523a516c465991a70245da1c ] IPV6_ADDRFORM causes resource leaks when converting an IPv6 socket to IPv4, particularly struct ipv6_ac_socklist. Similar to struct ipv6_mc_socklist, we should just close it on this path. This bug can be easily reproduced with the following C program: #include <stdio.h> #include <string.h> #include <sys/types.h> #include <sys/socket.h> #include <arpa/inet.h> int main() { int s, value; struct sockaddr_in6 addr; struct ipv6_mreq m6; s = socket(AF_INET6, SOCK_DGRAM, 0); addr.sin6_family = AF_INET6; addr.sin6_port = htons(5000); inet_pton(AF_INET6, "::ffff:192.168.122.194", &addr.sin6_addr); connect(s, (struct sockaddr *)&addr, sizeof(addr)); inet_pton(AF_INET6, "fe80::AAAA", &m6.ipv6mr_multiaddr); m6.ipv6mr_interface = 5; setsockopt(s, SOL_IPV6, IPV6_JOIN_ANYCAST, &m6, sizeof(m6)); value = AF_INET; setsockopt(s, SOL_IPV6, IPV6_ADDRFORM, &value, sizeof(value)); close(s); return 0; } Reported-by: ch3332xr@gmail.com Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2020-08-11 15:33:39 +02:00
Ilan Peer	2a3f0f7a0c	BACKPORT: mac80211: Add HE 6GHz capabilities element to probe request ... On 6 GHz, the 6 GHz capabilities element should be added, do that. Bug: 163110886 Signed-off-by: Ilan Peer <ilan.peer@intel.com> [add commit message] Link: https://lore.kernel.org/r/20200528213443.8ee764f0cde0.I2b0c66b60e11818c97c9803e04a6a197c6376243@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com> Change-Id: Iba5daa73817072fdea78cd37c1f30b0323deca6f (cherry picked from commit 2ad2274c58ee2dcaf9ccde5c63ff30f59b138f77) Signed-off-by: Vamsi Krishna <vamsin@codeaurora.org> Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2020-08-11 12:53:39 +02:00
Johannes Berg	9a579df196	BACKPORT: cfg80211: add and expose HE 6 GHz band capabilities ... These capabilities cover what would otherwise be transported in HT/VHT capabilities, but only a subset thereof that is actually needed on 6 GHz with HE already present. Expose the capabilities to userspace, drivers are expected to set them as using the 6 GHz band (currently) requires HE capability. Bug: 163110886 Link: https://lore.kernel.org/r/20200528213443.244cd5cb9db8.Icd8c773277a88c837e7e3af1d4d1013cc3b66543@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com> Change-Id: I08e42cb07c3cb1faacb325888ca77bcd2c91507b (cherry picked from commit 223952177296c34d9c8de9cde33204caffe55725) Signed-off-by: Vamsi Krishna <vamsin@codeaurora.org> Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2020-08-11 12:53:32 +02:00
Rajkumar Manoharan	9e4ff996eb	BACKPORT: cfg80211: handle 6 GHz capability of new station ... Handle 6 GHz HE capability while adding new station. It will be used later in mac80211 station processing. Bug: 163110886 Signed-off-by: Rajkumar Manoharan <rmanohar@codeaurora.org> Link: https://lore.kernel.org/r/1589399105-25472-2-git-send-email-rmanohar@codeaurora.org [handle nl80211_set_station, require WME, remove NL80211_HE_6GHZ_CAPABILITY_LEN] Link: https://lore.kernel.org/r/20200528213443.b6b711fd4312.Ic9b97d57b6c4f2b28d4b2d23d2849d8bc20bd8cc@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com> Change-Id: I1407f9a72e2790da31a308e2d834185d229efc96 (cherry picked from commit 43e64bf301fd8c54f0082d91c6ffd4de861baf96) Signed-off-by: Vamsi Krishna <vamsin@codeaurora.org> Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2020-08-11 12:53:30 +02:00
Johannes Berg	bdb178cf07	BACKPORT: cfg80211: add a helper to identify 6 GHz PSCs ... This allows identifying whether or not a channel is a PSC (preferred scanning channel). Bug: 163110886 Link: https://lore.kernel.org/r/20200528213443.414363ecf62c.Ic15e681a0e249eab7350a06ceb582cca8bb9a080@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com> Change-Id: Ia0b369ead18ce1d1e585df9467d680be4aa8adef (cherry picked from commit afbc9c9e8bfe71e8bd12a8c01bedd969fbab8f0e) Signed-off-by: Vamsi Krishna <vamsin@codeaurora.org> Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2020-08-11 12:53:22 +02:00
Thomas Pedersen	ac2e6c2e7e	BACKPORT: cfg80211: express channels with a KHz component ... Some bands (S1G) define channels centered on a non-integer MHz. Give ieee80211_channel and cfg80211_chan_def a freq_offset component where the final frequency can be expressed as: MHZ_TO_KHZ(chan->center_freq) + chan->freq_offset; Also provide some helper functions to do the frequency conversion and test for equality. Retain the existing interface to frequency and channel conversion helpers, and expose new ones which handle frequencies in units of KHz. Some internal functions (net/wireless/chan.c) pass around a frequency value. Convert these to units of KHz. mesh, ibss, wext, etc. are currently ignored. Bug: 163110886 Signed-off-by: Thomas Pedersen <thomas@adapt-ip.com> Link: https://lore.kernel.org/r/20200402011810.22947-3-thomas@adapt-ip.com Signed-off-by: Johannes Berg <johannes.berg@intel.com> Change-Id: I058afb696c69e7047d5573bda334d04f684f1215 (cherry picked from commit 934f4c7dd3a544bb8000f7436f1f0e12e04ebc37) Signed-off-by: Vamsi Krishna <vamsin@codeaurora.org> Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2020-08-11 12:53:01 +02:00
Greg Kroah-Hartman	fcb0d3ef9b	This is the 5.4.56 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl8qZwoACgkQONu9yGCS aT4gVA//ZuAjdnvfTBp3wvPu4D507HBz2hPqsJXVzJrt+Icw5qOqG5kn9icDfgVF VUNAFD3evDkESFe2OV/gZR3Qu9JNyJk0GVQGkzFPnxCX7FP+XaIHHNBDALBem1SA 8e3coFTMaqf1W8ualF/gpogYVz8SkbzqU+GOOA/+y8dQwyXtRrbIv8XuxQfmbMfD +ttaqeytm6deBYNL/Ok2Lxl3H01ShchdmKLFn5L3M6GiKzucp7NYWOz0luEF1Uak jsShFl+DfKT3Lq666CmecoyvLug5VWGPLvNm/UeJHwHZBr2KFWmTbMTIo/6gB9Ud YNv5xwZXKflUZlV3i0jeAVYQ4vNrtsCpOTqnkw8JpW78sJPfb9Ozlvk/XgnXEtpl ojv2eX5R+5yxPp8yJoxwBmuaoYYEsngTXsgTzQ2T+bvSWtUK8qyoTCa+6FEG6ylv DkMIMSvdb9AC80KbfN5cCNEloryoaEPp4aXgqX0E6ZKAWvuAfnS+7ohPCw1x12D6 VqwAinq0gnie8TD9E3Bcn3m2COFwF/Ow38uO4F/gQ9zcOXS6+QiqrpQwCzSVdumU NQHJbvMFwfMR35yN2lo87Xk8MvHLhloKIIBhmxAMaGR2NRwg9w2vDkxfjuZUiElz YKOhNw51jFwCkMUtLJmn6pon/DGnDH23+/2LC0oqGNLASG7sUjQ= =A5pn -----END PGP SIGNATURE----- Merge 5.4.56 into android11-5.4 Changes in 5.4.56 crypto: ccp - Release all allocated memory if sha type is invalid media: rc: prevent memory leak in cx23888_ir_probe sunrpc: check that domain table is empty at module unload. ath10k: enable transmit data ack RSSI for QCA9884 PCI/ASPM: Disable ASPM on ASMedia ASM1083/1085 PCIe-to-PCI bridge mm/filemap.c: don't bother dropping mmap_sem for zero size readahead ALSA: usb-audio: Add implicit feedback quirk for SSL2 ALSA: hda/realtek: enable headset mic of ASUS ROG Zephyrus G15(GA502) series with ALC289 ALSA: hda/realtek: typo_fix: enable headset mic of ASUS ROG Zephyrus G14(GA401) series with ALC289 ALSA: hda/realtek: Fix add a "ultra_low_power" function for intel reference board (alc256) ALSA: hda/realtek - Fixed HP right speaker no sound ALSA: hda/hdmi: Fix keep_power assignment for non-component devices IB/rdmavt: Fix RQ counting issues causing use of an invalid RWQE vhost/scsi: fix up req type endian-ness 9p/trans_fd: Fix concurrency del of req_list in p9_fd_cancelled/p9_read_work wireless: Use offsetof instead of custom macro. ARM: 8986/1: hw_breakpoint: Don't invoke overflow handler on uaccess watchpoints ARM: dts: imx6sx-sabreauto: Fix the phy-mode on fec2 ARM: dts: imx6sx-sdb: Fix the phy-mode on fec2 ARM: dts: imx6qdl-icore: Fix OTG_ID pin and sdcard detect virtio_balloon: fix up endian-ness for free cmd id Revert "drm/amdgpu: Fix NULL dereference in dpm sysfs handlers" drm/amd/display: Clear dm_state for fast updates drm/amdgpu: Prevent kernel-infoleak in amdgpu_info_ioctl() drm/dbi: Fix SPI Type 1 (9-bit) transfer drm: hold gem reference until object is no longer accessed rds: Prevent kernel-infoleak in rds_notify_queue_get() libtraceevent: Fix build with binutils 2.35 net/x25: Fix x25_neigh refcnt leak when x25 disconnect net/x25: Fix null-ptr-deref in x25_disconnect xfrm: policy: match with both mark and mask on user interfaces ARM: dts sunxi: Relax a bit the CMA pool allocation range xfrm: Fix crash when the hold queue is used. ARM: dts: armada-38x: fix NETA lockup when repeatedly switching speeds nvme-tcp: fix possible hang waiting for icresp response selftests/net: rxtimestamp: fix clang issues for target arch PowerPC selftests/net: psock_fanout: fix clang issues for target arch PowerPC selftests/net: so_txtime: fix clang issues for target arch PowerPC sh/tlb: Fix PGTABLE_LEVELS > 2 sh: Fix validation of system call number net: hns3: fix a TX timeout issue net: hns3: fix aRFS FD rules leftover after add a user FD rule net/mlx5: E-switch, Destroy TSAR when fail to enable the mode net/mlx5e: Fix error path of device attach net/mlx5: Verify Hardware supports requested ptp function on a given pin net/mlx5e: Modify uplink state on interface up/down net/mlx5e: Fix kernel crash when setting vf VLANID on a VF dev net: lan78xx: add missing endpoint sanity check net: lan78xx: fix transfer-buffer memory leak rhashtable: Fix unprotected RCU dereference in __rht_ptr mlx4: disable device on shutdown mlxsw: core: Increase scope of RCU read-side critical section mlxsw: core: Free EMAD transactions using kfree_rcu() ibmvnic: Fix IRQ mapping disposal in error path bpf: Fix map leak in HASH_OF_MAPS map mac80211: mesh: Free ie data when leaving mesh mac80211: mesh: Free pending skb when destroying a mpath arm64/alternatives: move length validation inside the subsection arm64: csum: Fix handling of bad packets Bluetooth: fix kernel oops in store_pending_adv_report net: nixge: fix potential memory leak in nixge_probe() net: gemini: Fix missing clk_disable_unprepare() in error path of gemini_ethernet_port_probe() net/mlx5e: fix bpf_prog reference count leaks in mlx5e_alloc_rq perf tools: Fix record failure when mixed with ARM SPE event vxlan: fix memleak of fdb usb: hso: Fix debug compile warning on sparc32 selftests: fib_nexthop_multiprefix: fix cleanup() netns deletion qed: Disable "MFW indication via attention" SPAM every 5 minutes selftests: net: ip_defrag: modprobe missing nf_defrag_ipv6 support nfc: s3fwrn5: add missing release on skb in s3fwrn5_recv_frame scsi: core: Run queue in case of I/O resource contention failure parisc: add support for cmpxchg on u8 pointers net: ethernet: ravb: exit if re-initialization fails in tx timeout Revert "i2c: cadence: Fix the hold bit setting" x86/unwind/orc: Fix ORC for newly forked tasks x86/stacktrace: Fix reliable check for empty user task stacks cxgb4: add missing release on skb in uld_send() xen-netfront: fix potential deadlock in xennet_remove() RISC-V: Set maximum number of mapped pages correctly drivers/net/wan: lapb: Corrected the usage of skb_cow KVM: arm64: Don't inherit exec permission across page-table levels KVM: LAPIC: Prevent setting the tscdeadline timer if the lapic is hw disabled x86/i8259: Use printk_deferred() to prevent deadlock perf tests bp_account: Make global variable static perf env: Do not return pointers to local variables perf bench: Share some global variables to fix build with gcc 10 Linux 5.4.56 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I06b0147860242cfcac3dd8a7acefdb211020cab1	2020-08-05 11:19:16 +02:00
Steffen Klassert	731e013e33	xfrm: Fix crash when the hold queue is used. ... [ Upstream commit 101dde4207f1daa1fda57d714814a03835dccc3f ] The commits "xfrm: Move dst->path into struct xfrm_dst" and "net: Create and use new helper xfrm_dst_child()." changed xfrm bundle handling under the assumption that xdst->path and dst->child are not a NULL pointer only if dst->xfrm is not a NULL pointer. That is true with one exception. If the xfrm hold queue is used to wait until a SA is installed by the key manager, we create a dummy bundle without a valid dst->xfrm pointer. The current xfrm bundle handling crashes in that case. Fix this by extending the NULL check of dst->xfrm with a test of the DST_XFRM_QUEUE flag. Fixes: 0f6c480f23 ("xfrm: Move dst->path into struct xfrm_dst") Fixes: b92cf4aab8 ("net: Create and use new helper xfrm_dst_child().") Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2020-08-05 09:59:45 +02:00
Xin Long	0307da6866	xfrm: policy: match with both mark and mask on user interfaces ... [ Upstream commit 4f47e8ab6ab796b5380f74866fa5287aca4dcc58 ] In commit ed17b8d377ea ("xfrm: fix a warning in xfrm_policy_insert_list"), it would take 'priority' to make a policy unique, and allow duplicated policies with different 'priority' to be added, which is not expected by userland, as Tobias reported in strongswan. To fix this duplicated policies issue, and also fix the issue in commit ed17b8d377ea ("xfrm: fix a warning in xfrm_policy_insert_list"), when doing add/del/get/update on user interfaces, this patch is to change to look up a policy with both mark and mask by doing: mark.v == pol->mark.v && mark.m == pol->mark.m and leave the check: (mark & pol->mark.m) == pol->mark.v for tx/rx path only. As the userland expects an exact mark and mask match to manage policies. v1->v2: - make xfrm_policy_mark_match inline and fix the changelog as Tobias suggested. Fixes: 295fae5688 ("xfrm: Allow user space manipulation of SPD mark") Fixes: ed17b8d377ea ("xfrm: fix a warning in xfrm_policy_insert_list") Reported-by: Tobias Brunner <tobias@strongswan.org> Tested-by: Tobias Brunner <tobias@strongswan.org> Signed-off-by: Xin Long <lucien.xin@gmail.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2020-08-05 09:59:44 +02:00
Greg Kroah-Hartman	68815d5b7e	Revert "genetlink: remove genl_bind" ... This reverts commit 7b42410d35 which is commit 1e82a62fec613844da9e558f3493540a5b7a7b67 upstream. It breaks the API and isn't something we should really have to worry about in android devices. Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I4ec83063705a9f0fe449ff46803f6594b69efd08	2020-07-23 12:38:44 +02:00
Greg Kroah-Hartman	171202d5b0	This is the 5.4.53 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl8X674ACgkQONu9yGCS aT5F9g/+PdG5XSPhoGEhO2FW43cQKuGp5vWJ3IhVFyEXFdboWIa5laWNBh1ZC/Kg Ua0vxBGGJDTGZNTJAQd6Re1RfAbptEstrNlwC3BaxUQn5Qn4YQMCNbAeFEj7D2nw Tez3r3gjpGc9uo0EqfeJStqhFZfh+D3apHz1/RFZ/12T5d4dIEtCXDUAP89zib0w lHBOH37Mc0WqXSUPLdabIbemlbZv4prYn7gnzIeoxl3h+TKzdjM4pGjrjzKJwy2D 9XDB3Dw9BA225uoextJl3GCOm7IF+TGaR10YxuHCtxJAkdPSt2BUUAFC0XrV7KPw fGMy8/a8EZj5PoNNjKHzDD2IJf9PhLZgcn7AjOW6x9XXu7lJls4Wx4/k5TpIO1I1 paO8kGex8jk751X4U1Bu8LowLPjiL3fKp0lSeysSw9IIzTBW1DlhSR9Mf/CEihib xbS6k8/uF9HGtYJKIW4o/iL/3D0MGKTuOX18tlhnZ92Hp5WcAEZKrUKgYTY/exvF WDYDRSFv17tw6XT7Jfey3veP1z+3kVMZ3KD0CnpJ7poS/f8H730yyEgIDO0dRO3I Rd1r/uCmgr0GkeNDp46eoTYCgvhCQruxWul0/6/pw4VdzIBSRlPjsZBR+2Frnmuw dRim972ocnvVzxKe1N2fD+whfjok85h30Xg7uvFgZGEZ7/wOUL8= =mqst -----END PGP SIGNATURE----- Merge 5.4.53 into android11-5.4 Changes in 5.4.53 crypto: atmel - Fix selection of CRYPTO_AUTHENC crypto: atmel - Fix build error of CRYPTO_AUTHENC net: atlantic: fix ip dst and ipv6 address filters net: rmnet: fix lower interface leak bridge: mcast: Fix MLD2 Report IPv6 payload length check genetlink: remove genl_bind ipv4: fill fl4_icmp_{type,code} in ping_v4_sendmsg ipv6: fib6_select_path can not use out path for nexthop objects ipv6: Fix use of anycast address with loopback l2tp: remove skb_dst_set() from l2tp_xmit_skb() llc: make sure applications use ARPHRD_ETHER net: Added pointer check for dst->ops->neigh_lookup in dst_neigh_lookup_skb net: dsa: microchip: set the correct number of ports net_sched: fix a memory leak in atm_tc_init() net: usb: qmi_wwan: add support for Quectel EG95 LTE modem sched: consistently handle layer3 header accesses in the presence of VLANs tcp: fix SO_RCVLOWAT possible hangs under high mem pressure tcp: make sure listeners don't initialize congestion-control state tcp: md5: add missing memory barriers in tcp_md5_do_add()/tcp_md5_hash_key() tcp: md5: do not send silly options in SYNCOOKIES vlan: consolidate VLAN parsing code and limit max parsing depth tcp: md5: refine tcp_md5_do_add()/tcp_md5_hash_key() barriers tcp: md5: allow changing MD5 keys in all socket states cgroup: fix cgroup_sk_alloc() for sk_clone_lock() cgroup: Fix sock_cgroup_data on big-endian. ip: Fix SO_MARK in RST, ACK and ICMP packets arm64: Introduce a way to disable the 32bit vdso arm64: arch_timer: Allow an workaround descriptor to disable compat vdso arm64: arch_timer: Disable the compat vdso for cores affected by ARM64_WORKAROUND_1418040 drm/msm: fix potential memleak in error branch drm/msm/dpu: allow initialization of encoder locks during encoder init drm/exynos: Properly propagate return value in drm_iommu_attach_device() drm/exynos: fix ref count leak in mic_pre_enable x86/fpu: Reset MXCSR to default in kernel_fpu_begin() thermal/drivers: imx: Fix missing of_node_put() at probe time blk-mq-debugfs: update blk_queue_flag_name[] accordingly for new flags m68k: nommu: register start of the memory with memblock m68k: mm: fix node memblock init dt-bindings: mailbox: zynqmp_ipi: fix unit address cifs: prevent truncation from long to int in wait_for_free_credits arm64/alternatives: use subsections for replacement sequences tpm_tis: extra chip->ops check on error path in tpm_tis_core_init gfs2: read-only mounts should grab the sd_freeze_gl glock i2c: eg20t: Load module automatically if ID matches arm64/alternatives: don't patch up internal branches iio:magnetometer:ak8974: Fix alignment and data leak issues iio:humidity:hdc100x Fix alignment and data leak issues iio: magnetometer: ak8974: Fix runtime PM imbalance on error iio: core: add missing IIO_MOD_H2/ETHANOL string identifiers iio: mma8452: Add missed iio_device_unregister() call in mma8452_probe() iio: pressure: zpa2326: handle pm_runtime_get_sync failure iio:humidity:hts221 Fix alignment and data leak issues iio:pressure:ms5611 Fix buffer element alignment iio:health:afe4403 Fix timestamp alignment and prevent data leak. spi: spi-fsl-dspi: Fix lockup if device is shutdown during SPI transfer net: dsa: bcm_sf2: Fix node reference count of: of_mdio: Correct loop scanning logic net: macb: call pm_runtime_put_sync on failure path net: ethernet: mvneta: Do not error out in non serdes modes net: ethernet: mvneta: Add back interface mode validation Revert "usb/ohci-platform: Fix a warning when hibernating" Revert "usb/ehci-platform: Set PM runtime as active on resume" Revert "usb/xhci-plat: Set PM runtime as active on resume" net: sfp: add support for module quirks net: sfp: add some quirks for GPON modules ARM: OMAP4+: remove pdata quirks for omap4+ iommus ARM: OMAP2+: Add workaround for DRA7 DSP MStandby errata i879 ARM: OMAP2+: use separate IOMMU pdata to fix DRA7 IPU1 boot mmc: mmci: Support any block sizes for ux500v2 and qcom variant HID: quirks: Remove ITE 8595 entry from hid_have_special_driver ARM: at91: pm: add quirk for sam9x60's ulp1 drm/sun4i: tcon: Separate quirks for tcon0 and tcon1 on A20 scsi: sr: remove references to BLK_DEV_SR_VENDOR, leave it enabled bus: ti-sysc: Rename clk related quirks to pre_reset and post_reset quirks bus: ti-sysc: Consider non-existing registers too when matching quirks bus: ti-sysc: Handle module unlock quirk needed for some RTC bus: ti-sysc: Detect display subsystem related devices arm64: dts: g12-common: add parkmode_disable_ss_quirk on DWC3 controller bus: ti-sysc: Detect EDMA and set quirk flags for tptc ALSA: usb-audio: Add support for MOTU MicroBook IIc Input: goodix - fix touch coordinates on Cube I15-TC ALSA: usb-audio: Create a registration quirk for Kingston HyperX Amp (0951:16d8) doc: dt: bindings: usb: dwc3: Update entries for disabling SS instances in park mode mmc: sdhci: do not enable card detect interrupt for gpio cd type ALSA: usb-audio: Rewrite registration quirk handling ACPI: video: Use native backlight on Acer Aspire 5783z ALSA: usb-audio: Add registration quirk for Kingston HyperX Cloud Alpha S ALSA: usb-audio: Add quirk for Focusrite Scarlett 2i2 Input: mms114 - add extra compatible for mms345l ACPI: video: Use native backlight on Acer TravelMate 5735Z bus: ti-sysc: Use optional clocks on for enable and wait for softreset bit ALSA: usb-audio: Add registration quirk for Kingston HyperX Cloud Flight S iio:health:afe4404 Fix timestamp alignment and prevent data leak. soundwire: intel: fix memory leak with devm_kasprintf dmaengine: sh: usb-dmac: set tx_result parameters phy: sun4i-usb: fix dereference of pointer phy0 before it is null checked arm64: dts: meson: add missing gxl rng clock arm64: dts: meson-gxl-s805x: reduce initial Mali450 core frequency bus: ti-sysc: Fix wakeirq sleeping function called from invalid context bus: ti-sysc: Fix sleeping function called from invalid context for RTC quirk bus: ti-sysc: Do not disable on suspend for no-idle iio: adc: ad7780: Fix a resource handling path in 'ad7780_probe()' dmaengine: dw: Initialize channel before each transfer dmaengine: dmatest: stop completed threads when running without set channel spi: spi-sun6i: sun6i_spi_transfer_one(): fix setting of clock rate usb: gadget: udc: atmel: fix uninitialized read in debug printk staging: comedi: verify array index is correct before using it clk: mvebu: ARMADA_AP_CPU_CLK needs to select ARMADA_AP_CP_HELPER clk: AST2600: Add mux for EMMC clock NFS: Fix interrupted slots by sending a solo SEQUENCE operation fuse: don't ignore errors from fuse_writepages_fill() ARM: dts: Fix dcan driver probe failed on am437x platform Revert "thermal: mediatek: fix register index error" xprtrdma: fix incorrect header size calculations ARM: dts: socfpga: Align L2 cache-controller nodename with dtschema arm64: dts: spcfpga: Align GIC, NAND and UART nodenames with dtschema keys: asymmetric: fix error return code in software_key_query() regmap: debugfs: Don't sleep while atomic for fast_io regmaps copy_xstate_to_kernel: Fix typo which caused GDB regression arm: dts: mt7623: add phy-mode property for gmac2 soc: qcom: socinfo: add missing soc_id sysfs entry apparmor: ensure that dfa state tables have entries habanalabs: Align protection bits configuration of all TPCs PCI/PM: Call .bridge_d3() hook only if non-NULL perf stat: Zero all the 'ena' and 'run' array slot stats for interval mode soc: qcom: rpmh: Update dirty flag only when data changes soc: qcom: rpmh: Invalidate SLEEP and WAKE TCSes before flushing new data soc: qcom: rpmh-rsc: Clear active mode configuration for wake TCS soc: qcom: rpmh-rsc: Allow using free WAKE TCS for active request RDMA/mlx5: Verify that QP is created with RQ or SQ mtd: rawnand: marvell: Fix the condition on a return code mtd: rawnand: marvell: Use nand_cleanup() when the device is not yet registered mtd: rawnand: marvell: Fix probe error path mtd: rawnand: timings: Fix default tR_max and tCCS_min timings mtd: rawnand: brcmnand: correctly verify erased pages mtd: rawnand: brcmnand: fix CS0 layout mtd: rawnand: oxnas: Keep track of registered devices mtd: rawnand: oxnas: Unregister all devices on error mtd: rawnand: oxnas: Release all devices in the _remove() path clk: qcom: gcc: Add GPU and NPU clocks for SM8150 clk: qcom: gcc: Add missing UFS clocks for SM8150 slimbus: core: Fix mismatch in of_node_get/put HID: logitech-hidpp: avoid repeated "multiplier = " log messages HID: magicmouse: do not set up autorepeat HID: quirks: Always poll Obins Anne Pro 2 keyboard HID: quirks: Ignore Simply Automated UPB PIM ALSA: line6: Perform sanity check for each URB creation ALSA: line6: Sync the pending work cancel at disconnection ALSA: usb-audio: Fix race against the error recovery URB submission ALSA: hda/realtek - change to suitable link model for ASUS platform ALSA: hda/realtek: enable headset mic of ASUS ROG Zephyrus G14(G401) series with ALC289 ALSA: hda/realtek: Enable headset mic of Acer TravelMate B311R-31 with ALC256 ALSA: hda/realtek - Enable Speaker for ASUS UX533 and UX534 ALSA: hda/realtek - Enable Speaker for ASUS UX563 USB: c67x00: fix use after free in c67x00_giveback_urb usb: dwc2: Fix shutdown callback in platform usb: chipidea: core: add wakeup support for extcon usb: gadget: function: fix missing spinlock in f_uac1_legacy USB: serial: iuu_phoenix: fix memory corruption USB: serial: cypress_m8: enable Simply Automated UPB PIM USB: serial: ch341: add new Product ID for CH340 USB: serial: option: add GosunCn GM500 series USB: serial: option: add Quectel EG95 LTE modem virt: vbox: Fix VBGL_IOCTL_VMMDEV_REQUEST_BIG and _LOG req numbers to match upstream virt: vbox: Fix guest capabilities mask check Revert "tty: xilinx_uartps: Fix missing id assignment to the console" virtio: virtio_console: add missing MODULE_DEVICE_TABLE() for rproc serial serial: mxs-auart: add missed iounmap() in probe failure and remove ovl: fix regression with re-formatted lower squashfs ovl: inode reference leak in ovl_is_inuse true case. ovl: relax WARN_ON() when decoding lower directory file handle ovl: fix unneeded call to ovl_change_flags() fuse: ignore 'data' argument of mount(..., MS_REMOUNT) fuse: use ->reconfigure() instead of ->remount_fs() fuse: Fix parameter for FS_IOC_{GET,SET}FLAGS Revert "zram: convert remaining CLASS_ATTR() to CLASS_ATTR_RO()" mei: bus: don't clean driver pointer Input: i8042 - add Lenovo XiaoXin Air 12 to i8042 nomux list Input: elan_i2c - add more hardware ID for Lenovo laptops uio_pdrv_genirq: Remove warning when irq is not specified uio_pdrv_genirq: fix use without device tree and no interrupt scsi: megaraid_sas: Remove undefined ENABLE_IRQ_POLL macro timer: Prevent base->clk from moving backward timer: Fix wheel index calculation on last level riscv: use 16KB kernel stack on 64-bit hwmon: (emc2103) fix unable to change fan pwm1_enable attribute powerpc/book3s64/pkeys: Fix pkey_access_permitted() for execute disable pkey powerpc/pseries/svm: Fix incorrect check for shared_lppaca_size intel_th: pci: Add Jasper Lake CPU support intel_th: pci: Add Tiger Lake PCH-H support intel_th: pci: Add Emmitsburg PCH support intel_th: Fix a NULL dereference when hub driver is not loaded dmaengine: fsl-edma: Fix NULL pointer exception in fsl_edma_tx_handler dmaengine: mcf-edma: Fix NULL pointer exception in mcf_edma_tx_handler dmaengine: fsl-edma-common: correct DSIZE_32BYTE misc: atmel-ssc: lock with mutex instead of spinlock thermal: int3403_thermal: Downgrade error message thermal/drivers/cpufreq_cooling: Fix wrong frequency converted from power arm64: ptrace: Override SPSR.SS when single-stepping is enabled arm64: ptrace: Consistently use pseudo-singlestep exceptions arm64: compat: Ensure upper 32 bits of x0 are zero on syscall return sched: Fix unreliable rseq cpu_id for new tasks sched/fair: handle case of task_h_load() returning 0 genirq/affinity: Handle affinity setting on inactive interrupts correctly drm/amdgpu/sdma5: fix wptr overwritten in ->get_wptr() drm/i915/gt: Ignore irq enabling on the virtual engines block: fix splitting segments on boundary masks block: fix get_max_segment_size() overflow on 32bit arch libceph: don't omit recovery_deletes in target_copy() rxrpc: Fix trace string spi: sprd: switch the sequence of setting WDG_LOAD_LOW and _HIGH ionic: export features for vlans to use iommu/vt-d: Make Intel SVM code 64-bit only drm/i915/gvt: Fix two CFL MMIO handling caused by regression. gpio: pca953x: disable regmap locking for automatic address incrementing Linux 5.4.53 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I2347f0f12d1e95a90cff2f3999940e1f82231df2	2020-07-23 12:36:54 +02:00
Toke Høiland-Jørgensen	9b7fd81cf9	sched: consistently handle layer3 header accesses in the presence of VLANs ... [ Upstream commit d7bf2ebebc2bd61ab95e2a8e33541ef282f303d4 ] There are a couple of places in net/sched/ that check skb->protocol and act on the value there. However, in the presence of VLAN tags, the value stored in skb->protocol can be inconsistent based on whether VLAN acceleration is enabled. The commit quoted in the Fixes tag below fixed the users of skb->protocol to use a helper that will always see the VLAN ethertype. However, most of the callers don't actually handle the VLAN ethertype, but expect to find the IP header type in the protocol field. This means that things like changing the ECN field, or parsing diffserv values, stops working if there's a VLAN tag, or if there are multiple nested VLAN tags (QinQ). To fix this, change the helper to take an argument that indicates whether the caller wants to skip the VLAN tags or not. When skipping VLAN tags, we make sure to skip all of them, so behaviour is consistent even in QinQ mode. To make the helper usable from the ECN code, move it to if_vlan.h instead of pkt_sched.h. v3: - Remove empty lines - Move vlan variable definitions inside loop in skb_protocol() - Also use skb_protocol() helper in IP{,6}_ECN_decapsulate() and bpf_skb_ecn_set_ce() v2: - Use eth_type_vlan() helper in skb_protocol() - Also fix code that reads skb->protocol directly - Change a couple of 'if/else if' statements to switch constructs to avoid calling the helper twice Reported-by: Ilya Ponetayev <i.ponetaev@ndmsystems.com> Fixes: d8b9605d26 ("net: sched: fix skb->protocol use in case of accelerated vlan path") Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2020-07-22 09:32:48 +02:00
Martin Varghese	64d7822126	net: Added pointer check for dst->ops->neigh_lookup in dst_neigh_lookup_skb ... [ Upstream commit 394de110a73395de2ca4516b0de435e91b11b604 ] The packets from tunnel devices (eg bareudp) may have only metadata in the dst pointer of skb. Hence a pointer check of neigh_lookup is needed in dst_neigh_lookup_skb Kernel crashes when packets from bareudp device is processed in the kernel neighbour subsytem. [ 133.384484] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 133.385240] #PF: supervisor instruction fetch in kernel mode [ 133.385828] #PF: error_code(0x0010) - not-present page [ 133.386603] PGD 0 P4D 0 [ 133.386875] Oops: 0010 [#1] SMP PTI [ 133.387275] CPU: 0 PID: 5045 Comm: ping Tainted: G W 5.8.0-rc2+ #15 [ 133.388052] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 133.391076] RIP: 0010:0x0 [ 133.392401] Code: Bad RIP value. [ 133.394029] RSP: 0018:ffffb79980003d50 EFLAGS: 00010246 [ 133.396656] RAX: 0000000080000102 RBX: ffff9de2fe0d6600 RCX: ffff9de2fe5e9d00 [ 133.399018] RDX: 0000000000000000 RSI: ffff9de2fe5e9d00 RDI: ffff9de2fc21b400 [ 133.399685] RBP: ffff9de2fe5e9d00 R08: 0000000000000000 R09: 0000000000000000 [ 133.400350] R10: ffff9de2fbc6be22 R11: ffff9de2fe0d6600 R12: ffff9de2fc21b400 [ 133.401010] R13: ffff9de2fe0d6628 R14: 0000000000000001 R15: 0000000000000003 [ 133.401667] FS: 00007fe014918740(0000) GS:ffff9de2fec00000(0000) knlGS:0000000000000000 [ 133.402412] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 133.402948] CR2: ffffffffffffffd6 CR3: 000000003bb72000 CR4: 00000000000006f0 [ 133.403611] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 133.404270] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 133.404933] Call Trace: [ 133.405169] <IRQ> [ 133.405367] __neigh_update+0x5a4/0x8f0 [ 133.405734] arp_process+0x294/0x820 [ 133.406076] ? __netif_receive_skb_core+0x866/0xe70 [ 133.406557] arp_rcv+0x129/0x1c0 [ 133.406882] __netif_receive_skb_one_core+0x95/0xb0 [ 133.407340] process_backlog+0xa7/0x150 [ 133.407705] net_rx_action+0x2af/0x420 [ 133.408457] __do_softirq+0xda/0x2a8 [ 133.408813] asm_call_on_stack+0x12/0x20 [ 133.409290] </IRQ> [ 133.409519] do_softirq_own_stack+0x39/0x50 [ 133.410036] do_softirq+0x50/0x60 [ 133.410401] __local_bh_enable_ip+0x50/0x60 [ 133.410871] ip_finish_output2+0x195/0x530 [ 133.411288] ip_output+0x72/0xf0 [ 133.411673] ? __ip_finish_output+0x1f0/0x1f0 [ 133.412122] ip_send_skb+0x15/0x40 [ 133.412471] raw_sendmsg+0x853/0xab0 [ 133.412855] ? insert_pfn+0xfe/0x270 [ 133.413827] ? vvar_fault+0xec/0x190 [ 133.414772] sock_sendmsg+0x57/0x80 [ 133.415685] __sys_sendto+0xdc/0x160 [ 133.416605] ? syscall_trace_enter+0x1d4/0x2b0 [ 133.417679] ? __audit_syscall_exit+0x1d9/0x280 [ 133.418753] ? __prepare_exit_to_usermode+0x5d/0x1a0 [ 133.419819] __x64_sys_sendto+0x24/0x30 [ 133.420848] do_syscall_64+0x4d/0x90 [ 133.421768] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 133.422833] RIP: 0033:0x7fe013689c03 [ 133.423749] Code: Bad RIP value. [ 133.424624] RSP: 002b:00007ffc7288f418 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 133.425940] RAX: ffffffffffffffda RBX: 000056151fc63720 RCX: 00007fe013689c03 [ 133.427225] RDX: 0000000000000040 RSI: 000056151fc63720 RDI: 0000000000000003 [ 133.428481] RBP: 00007ffc72890b30 R08: 000056151fc60500 R09: 0000000000000010 [ 133.429757] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000040 [ 133.431041] R13: 000056151fc636e0 R14: 000056151fc616bc R15: 0000000000000080 [ 133.432481] Modules linked in: mpls_iptunnel act_mirred act_tunnel_key cls_flower sch_ingress veth mpls_router ip_tunnel bareudp ip6_udp_tunnel udp_tunnel macsec udp_diag inet_diag unix_diag af_packet_diag netlink_diag binfmt_misc xt_MASQUERADE iptable_nat xt_addrtype xt_conntrack nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 br_netfilter bridge stp llc ebtable_filter ebtables overlay ip6table_filter ip6_tables iptable_filter sunrpc ext4 mbcache jbd2 pcspkr i2c_piix4 virtio_balloon joydev ip_tables xfs libcrc32c ata_generic qxl pata_acpi drm_ttm_helper ttm drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm ata_piix libata virtio_net net_failover virtio_console failover virtio_blk i2c_core virtio_pci virtio_ring serio_raw floppy virtio dm_mirror dm_region_hash dm_log dm_mod [ 133.444045] CR2: 0000000000000000 [ 133.445082] ---[ end trace f4aeee1958fd1638 ]--- [ 133.446236] RIP: 0010:0x0 [ 133.447180] Code: Bad RIP value. [ 133.448152] RSP: 0018:ffffb79980003d50 EFLAGS: 00010246 [ 133.449363] RAX: 0000000080000102 RBX: ffff9de2fe0d6600 RCX: ffff9de2fe5e9d00 [ 133.450835] RDX: 0000000000000000 RSI: ffff9de2fe5e9d00 RDI: ffff9de2fc21b400 [ 133.452237] RBP: ffff9de2fe5e9d00 R08: 0000000000000000 R09: 0000000000000000 [ 133.453722] R10: ffff9de2fbc6be22 R11: ffff9de2fe0d6600 R12: ffff9de2fc21b400 [ 133.455149] R13: ffff9de2fe0d6628 R14: 0000000000000001 R15: 0000000000000003 [ 133.456520] FS: 00007fe014918740(0000) GS:ffff9de2fec00000(0000) knlGS:0000000000000000 [ 133.458046] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 133.459342] CR2: ffffffffffffffd6 CR3: 000000003bb72000 CR4: 00000000000006f0 [ 133.460782] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 133.462240] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 133.463697] Kernel panic - not syncing: Fatal exception in interrupt [ 133.465226] Kernel Offset: 0xfa00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 133.467025] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- Fixes: aaa0c23cb9 ("Fix dst_neigh_lookup/dst_neigh_lookup_skb return value handling bug") Signed-off-by: Martin Varghese <martin.varghese@nokia.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2020-07-22 09:32:47 +02:00
Sean Tranchetti	7b42410d35	genetlink: remove genl_bind ... [ Upstream commit 1e82a62fec613844da9e558f3493540a5b7a7b67 ] A potential deadlock can occur during registering or unregistering a new generic netlink family between the main nl_table_lock and the cb_lock where each thread wants the lock held by the other, as demonstrated below. 1) Thread 1 is performing a netlink_bind() operation on a socket. As part of this call, it will call netlink_lock_table(), incrementing the nl_table_users count to 1. 2) Thread 2 is registering (or unregistering) a genl_family via the genl_(un)register_family() API. The cb_lock semaphore will be taken for writing. 3) Thread 1 will call genl_bind() as part of the bind operation to handle subscribing to GENL multicast groups at the request of the user. It will attempt to take the cb_lock semaphore for reading, but it will fail and be scheduled away, waiting for Thread 2 to finish the write. 4) Thread 2 will call netlink_table_grab() during the (un)registration call. However, as Thread 1 has incremented nl_table_users, it will not be able to proceed, and both threads will be stuck waiting for the other. genl_bind() is a noop, unless a genl_family implements the mcast_bind() function to handle setting up family-specific multicast operations. Since no one in-tree uses this functionality as Cong pointed out, simply removing the genl_bind() function will remove the possibility for deadlock, as there is no attempt by Thread 1 above to take the cb_lock semaphore. Fixes: c380d9a7af ("genetlink: pass multicast bind/unbind to families") Suggested-by: Cong Wang <xiyou.wangcong@gmail.com> Acked-by: Johannes Berg <johannes.berg@intel.com> Reported-by: kernel test robot <lkp@intel.com> Signed-off-by: Sean Tranchetti <stranche@codeaurora.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2020-07-22 09:32:46 +02:00
Greg Kroah-Hartman	a200ad52ff	Linux 5.4.50 ... -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE4n5dijQDou9mhzu83qZv95d3LNwFAl77nuMACgkQ3qZv95d3 LNw0EA//UhQOd/8ZlP33Iis58gUfuGU9sWmej6A8Tio2gdkG4g2c/dQjbxrMQT8b Vr1DJCthisT7pBJpQbhejwsfl5qRsrjBYFyUomCjeM8/0fF0+8JX0tSXX0/JM5Bg vOE4tV/kga+c5cbOD/FbLGH0vX4j20BnGXjHb9hyWY/gVp2gEcRzO3Ou0shZCXKJ 9NnhNB2gIm7BCRgz+cClPmZQjG59WazJu9I/Fk58ojdOp+E5gFibyBoeOylGR/W/ tjRm3Sz6D3uF0RSpGfAilqt2duwfjHTh0LxWlBX9C4OBWdJjYh1uUZ24tTvjxnCm lbgL4BbkOsVMp02jWhDDCe+pEPfT7EpLD6USivj8XFDLh8FK0eoaRQZRQ/hGK/Yj ZmVJRzNavf3xbz72Hz6aHdHmaxp180P8X8KtRDLT4ik+Kkf8gJVps3T5wTR9C60R htFVTDxEF+jE/EUCRh3sD4MrV114lpoJ5LlTPzJ87WCMHMjTZ8As/Ty/PLPg7KO6 ngI3y72cnvW/UfLPmdtaLx40gzEAYnw9+E30ebyKU6b8kY5idhuzd0AZnidsmeZa CzmZFZSCqqMO9vLo24VKxfKk3ufRiHxDU/nHqdGgOG18RlCmhWD0GXamsmeku3PB 1et/jXilpW9aIp/BJozeOdlGr82otk/4Ss+z/RtvvIkTbppgXlY= =6X7m -----END PGP SIGNATURE----- Merge 5.4.50 into android-5.4-stable Changes in 5.4.50 block/bio-integrity: don't free 'buf' if bio_integrity_add_page() failed enetc: Fix tx rings bitmap iteration range, irq handling geneve: allow changing DF behavior after creation ibmveth: Fix max MTU limit mld: fix memory leak in ipv6_mc_destroy_dev() mvpp2: ethtool rxtx stats fix net: bridge: enfore alignment for ethernet address net: core: reduce recursion limit value net: Do not clear the sock TX queue in sk_set_socket() net: fix memleak in register_netdevice() net: Fix the arp error in some cases net: increment xmit_recursion level in dev_direct_xmit() net: usb: ax88179_178a: fix packet alignment padding openvswitch: take into account de-fragmentation/gso_size in execute_check_pkt_len rocker: fix incorrect error handling in dma_rings_init rxrpc: Fix notification call on completion of discarded calls sctp: Don't advertise IPv4 addresses if ipv6only is set on the socket tcp: don't ignore ECN CWR on pure ACK tcp: grow window for OOO packets only for SACK flows tg3: driver sleeps indefinitely when EEH errors exceed eeh_max_freezes ip6_gre: fix use-after-free in ip6gre_tunnel_lookup() net: phy: Check harder for errors in get_phy_id() ip_tunnel: fix use-after-free in ip_tunnel_lookup() sch_cake: don't try to reallocate or unshare skb unconditionally sch_cake: don't call diffserv parsing code when it is not needed sch_cake: fix a few style nits tcp_cubic: fix spurious HYSTART_DELAY exit upon drop in min RTT Revert "i2c: tegra: Fix suspending in active runtime PM state" btrfs: fix a block group ref counter leak after failure to remove block group net: sched: export __netdev_watchdog_up() fix a braino in "sparc32: fix register window handling in genregs32_[gs]et()" ALSA: usb-audio: Fix potential use-after-free of streams binder: fix null deref of proc->context USB: ohci-sm501: Add missed iounmap() in remove usb: dwc2: Postponed gadget registration to the udc class driver usb: add USB_QUIRK_DELAY_INIT for Logitech C922 USB: ehci: reopen solution for Synopsys HC bug usb: host: xhci-mtk: avoid runtime suspend when removing hcd xhci: Poll for U0 after disabling USB2 LPM usb: host: ehci-exynos: Fix error check in exynos_ehci_probe() usb: typec: tcpci_rt1711h: avoid screaming irq causing boot hangs ALSA: usb-audio: Add implicit feedback quirk for SSL2+. ALSA: usb-audio: add quirk for Denon DCD-1500RE ALSA: usb-audio: add quirk for Samsung USBC Headset (AKG) ALSA: usb-audio: Fix OOB access of mixer element list usb: cdns3: trace: using correct dir value usb: cdns3: ep0: fix the test mode set incorrectly usb: cdns3: ep0: add spinlock for cdns3_check_new_setup scsi: qla2xxx: Keep initiator ports after RSCN scsi: zfcp: Fix panic on ERP timeout for previously dismissed ERP action cifs: Fix cached_fid refcnt leak in open_shroot cifs/smb3: Fix data inconsistent when punch hole cifs/smb3: Fix data inconsistent when zero file range xhci: Fix incorrect EP_STATE_MASK xhci: Fix enumeration issue when setting max packet size for FS devices. xhci: Return if xHCI doesn't support LPM cdc-acm: Add DISABLE_ECHO quirk for Microchip/SMSC chip loop: replace kill_bdev with invalidate_bdev IB/mad: Fix use after free when destroying MAD agent IB/hfi1: Fix module use count flaw due to leftover module put calls bus: ti-sysc: Flush posted write on enable and disable bus: ti-sysc: Ignore clockactivity unless specified as a quirk ARM: OMAP2+: Fix legacy mode dss_reset xfrm: Fix double ESP trailer insertion in IPsec crypto offload. ASoC: q6asm: handle EOS correctly efi/tpm: Verify event log header before parsing efi/esrt: Fix reference count leak in esre_create_sysfs_entry. ASoc: q6afe: add support to get port direction ASoC: qcom: common: set correct directions for dailinks regualtor: pfuze100: correct sw1a/sw2 on pfuze3000 RDMA/siw: Fix pointer-to-int-cast warning in siw_rx_pbl() ASoC: fsl_ssi: Fix bclk calculation for mono channel samples/bpf: xdp_redirect_cpu: Set MAX_CPUS according to NR_CPUS bpf, xdp, samples: Fix null pointer dereference in *_user code ARM: dts: am335x-pocketbeagle: Fix mmc0 Write Protect ARM: dts: Fix duovero smsc interrupt for suspend x86/resctrl: Fix a NULL vs IS_ERR() static checker warning in rdt_cdp_peer_get() regmap: Fix memory leak from regmap_register_patch devmap: Use bpf_map_area_alloc() for allocating hash buckets bpf: Don't return EINVAL from {get,set}sockopt when optlen > PAGE_SIZE ARM: dts: NSP: Correct FA2 mailbox node rxrpc: Fix handling of rwind from an ACK packet RDMA/rvt: Fix potential memory leak caused by rvt_alloc_rq RDMA/qedr: Fix KASAN: use-after-free in ucma_event_handler+0x532 RDMA/cma: Protect bind_list and listen_list while finding matching cm id ASoC: rockchip: Fix a reference count leak. s390/qeth: fix error handling for isolation mode cmds RDMA/mad: Fix possible memory leak in ib_mad_post_receive_mads() selftests/net: report etf errors correctly iommu/vt-d: Enable PCI ACS for platform opt in hint iommu/vt-d: Update scalable mode paging structure coherency net: qed: fix left elements count calculation net: qed: fix async event callbacks unregistering net: qede: stop adding events on an already destroyed workqueue net: qed: fix NVMe login fails over VFs net: qed: fix excessive QM ILT lines consumption net: qede: fix PTP initialization on recovery net: qede: fix use-after-free on recovery and AER handling cxgb4: move handling L2T ARP failures to caller ARM: imx5: add missing put_device() call in imx_suspend_alloc_ocram() scsi: lpfc: Avoid another null dereference in lpfc_sli4_hba_unset() usb: gadget: udc: Potential Oops in error handling code usb: renesas_usbhs: getting residue from callback_result nvme: don't protect ns mutation with ns->head->lock netfilter: ipset: fix unaligned atomic access net: bcmgenet: use hardware padding of runt frames clk: sifive: allocate sufficient memory for struct __prci_data i2c: fsi: Fix the port number field in status register i2c: core: check returned size of emulated smbus block read afs: Fix storage of cell names sched/deadline: Initialize ->dl_boosted sched/core: Fix PI boosting between RT and DEADLINE tasks sata_rcar: handle pm_runtime_get_sync failure cases ata/libata: Fix usage of page address by page_address in ata_scsi_mode_select_xlat function drm/amd/display: Use kfree() to free rgb_user in calculate_user_regamma_ramp() riscv/atomic: Fix sign extension for RV64I hwrng: ks-sa - Fix runtime PM imbalance on error ibmvnic: Harden device login requests net: alx: fix race condition in alx_remove test_objagg: Fix potential memory leak in error handling pinctrl: qcom: spmi-gpio: fix warning about irq chip reusage pinctrl: tegra: Use noirq suspend/resume callbacks s390/ptrace: pass invalid syscall numbers to tracing s390/ptrace: fix setting syscall number s390/vdso: Use $(LD) instead of $(CC) to link vDSO s390/vdso: fix vDSO clock_getres() arm64: sve: Fix build failure when ARM64_SVE=y and SYSCTL=n kbuild: improve cc-option to clean up all temporary files recordmcount: support >64k sections kprobes: Suppress the suspicious RCU warning on kprobes blktrace: break out of blktrace setup on concurrent calls block: update hctx map when use multiple maps RISC-V: Don't allow write+exec only page mapping request in mmap ALSA: hda: Add NVIDIA codec IDs 9a & 9d through a0 to patch table ALSA: hda/realtek - Add quirk for MSI GE63 laptop ALSA: hda/realtek: Add mute LED and micmute LED support for HP systems ACPI: sysfs: Fix pm_profile_attr type ACPI: configfs: Disallow loading ACPI tables when locked down erofs: fix partially uninitialized misuse in z_erofs_onlinepage_fixup KVM: X86: Fix MSR range of APIC registers in X2APIC mode KVM: nVMX: Plumb L2 GPA through to PML emulation KVM: VMX: Stop context switching MSR_IA32_UMWAIT_CONTROL x86/cpu: Use pinning mask for CR4 bits needing to be 0 x86/asm/64: Align start of __clear_user() loop to 16-bytes btrfs: fix bytes_may_use underflow when running balance and scrub in parallel btrfs: fix data block group relocation failure due to concurrent scrub btrfs: check if a log root exists before locking the log_mutex on unlink btrfs: fix failure of RWF_NOWAIT write into prealloc extent beyond eof mm/slab: use memzero_explicit() in kzfree() ocfs2: avoid inode removal while nfsd is accessing it ocfs2: load global_inode_alloc ocfs2: fix value of OCFS2_INVALID_SLOT ocfs2: fix panic on nfs server over ocfs2 mm/memcontrol.c: add missed css_put() arm64: perf: Report the PC value in REGS_ABI_32 mode arm64: dts: imx8mm-evk: correct ldo1/ldo2 voltage range arm64: dts: imx8mn-ddr4-evk: correct ldo1/ldo2 voltage range tracing: Fix event trigger to accept redundant spaces ring-buffer: Zero out time extend if it is nested and not absolute drm/amd: fix potential memleak in err branch drm: rcar-du: Fix build error drm/radeon: fix fb_div check in ni_init_smc_spll_table() drm/amdgpu: add fw release for sdma v5_0 Staging: rtl8723bs: prevent buffer overflow in update_sta_support_rate() sunrpc: fixed rollback in rpc_gssd_dummy_populate() SUNRPC: Properly set the @subbuf parameter of xdr_buf_subsegment() pNFS/flexfiles: Fix list corruption if the mirror count changes NFSv4 fix CLOSE not waiting for direct IO compeletion xprtrdma: Fix handling of RDMA_ERROR replies dm writecache: correct uncommitted_block when discarding uncommitted entry dm writecache: add cond_resched to loop in persistent_memory_claim() xfs: add agf freeblocks verify in xfs_agf_verify Revert "tty: hvc: Fix data abort due to race in hvc_open" Linux 5.4.50 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I3bfeaba86876d3c2f91979d3e98d894a2b70fe1a	2020-07-01 12:46:09 +02:00
Huy Nguyen	41b2debf35	xfrm: Fix double ESP trailer insertion in IPsec crypto offload. ... [ Upstream commit 94579ac3f6d0820adc83b5dc5358ead0158101e9 ] During IPsec performance testing, we see bad ICMP checksum. The error packet has duplicated ESP trailer due to double validate_xmit_xfrm calls. The first call is from ip_output, but the packet cannot be sent because netif_xmit_frozen_or_stopped is true and the packet gets dev_requeue_skb. The second call is from NET_TX softirq. However after the first call, the packet already has the ESP trailer. Fix by marking the skb with XFRM_XMIT bit after the packet is handled by validate_xmit_xfrm to avoid duplicate ESP trailer insertion. Fixes: f6e27114a6 ("net: Add a xfrm validate function to validate_xmit_skb") Signed-off-by: Huy Nguyen <huyn@mellanox.com> Reviewed-by: Boris Pismenny <borisp@mellanox.com> Reviewed-by: Raed Salem <raeds@mellanox.com> Reviewed-by: Saeed Mahameed <saeedm@mellanox.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2020-06-30 15:36:53 -04:00
Marcelo Ricardo Leitner	dc43f7e807	sctp: Don't advertise IPv4 addresses if ipv6only is set on the socket ... [ Upstream commit 471e39df96b9a4c4ba88a2da9e25a126624d7a9c ] If a socket is set ipv6only, it will still send IPv4 addresses in the INIT and INIT_ACK packets. This potentially misleads the peer into using them, which then would cause association termination. The fix is to not add IPv4 addresses to ipv6only sockets. Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Reported-by: Corey Minyard <cminyard@mvista.com> Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Tested-by: Corey Minyard <cminyard@mvista.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2020-06-30 15:36:45 -04:00
Tariq Toukan	9e693934cd	net: Do not clear the sock TX queue in sk_set_socket() ... [ Upstream commit 41b14fb8724d5a4b382a63cb4a1a61880347ccb8 ] Clearing the sock TX queue in sk_set_socket() might cause unexpected out-of-order transmit when called from sock_orphan(), as outstanding packets can pick a different TX queue and bypass the ones already queued. This is undesired in general. More specifically, it breaks the in-order scheduling property guarantee for device-offloaded TLS sockets. Remove the call to sk_tx_queue_clear() in sk_set_socket(), and add it explicitly only where needed. Fixes: e022f0b4a0 ("net: Introduce sk_tx_queue_mapping") Signed-off-by: Tariq Toukan <tariqt@mellanox.com> Reviewed-by: Boris Pismenny <borisp@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2020-06-30 15:36:44 -04:00
Veerendranath Jakkam	e1f28e7d04	BACKPORT: cfg80211: Configure PMK lifetime and reauth threshold for PMKSA entries ... Drivers that trigger roaming need to know the lifetime of the configured PMKSA for deciding whether to trigger the full or PMKSA cache based authentication. The configured PMKSA is invalid after the PMK lifetime has expired and must not be used after that and the STA needs to disassociate if the PMK expires. Hence the STA is expected to refresh the PMK with a full authentication before this happens (e.g., when reassociating to a new BSS the next time or by performing EAPOL reauthentication depending on the AKM) to avoid unnecessary disconnection. The PMK reauthentication threshold is the percentage of the PMK lifetime value and indicates to the driver to trigger a full authentication roam (without PMKSA caching) after the reauthentication threshold time, but before the PMK timer has expired. Authentication methods like SAE need to be able to generate a new PMKSA entry without having to force a disconnection after this threshold timeout. If no roaming occurs between the reauthentication threshold time and PMK lifetime expiration, disassociation is still forced. The new attributes for providing these values correspond to the dot11 MIB variables dot11RSNAConfigPMKLifetime and dot11RSNAConfigPMKReauthThreshold. This type of functionality is already available in cases where user space component is in control of roaming. This commit extends that same capability into cases where parts or all of this functionality is offloaded to the driver. Bug: 154782456 Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org> Signed-off-by: Jouni Malinen <jouni@codeaurora.org> Link: https://lore.kernel.org/r/20200312235903.18462-1-jouni@codeaurora.org Signed-off-by: Johannes Berg <johannes.berg@intel.com> Change-Id: I899c14543653d3620e63dbf40f1dfde7b1b48512 (cherry picked from commit 7fc82af856d6bc26910902f8f42659b162864955) Signed-off-by: Vamsi Krishna <vamsin@codeaurora.org> Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2020-06-30 14:28:41 +02:00
Johannes Berg	dc58762f12	BACKPORT: nl80211: modify TID-config API ... Make some changes to the TID-config API: * use u16 in nl80211 (only, and restrict to using 8 bits for now), to avoid issues in the future if we ever want to use higher TIDs. * reject empty TIDs mask (via netlink policy) * change feature advertising to not use extended feature flags but have own mechanism for this, which simplifies the code * fix all variable names from 'tid' to 'tids' since it's a mask * change to cfg80211_ name prefixes, not ieee80211_ * fix some minor docs/spelling things. Bug: 154782456 Change-Id: Ia234d464b3f914cdeab82f540e018855be580dce Signed-off-by: Johannes Berg <johannes.berg@intel.com> (cherry picked from commit 3710a8a6284f58a78ba4fe9c4b6672207636a223) Signed-off-by: Vamsi Krishna <vamsin@codeaurora.org> Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2020-06-30 14:28:41 +02:00
Tamizh chelvam	7a59f8cab6	BACKPORT: nl80211: Add NL command to support TID speicific configurations ... Add the new NL80211_CMD_SET_TID_CONFIG command to support data TID specific configuration. Per TID configuration is passed in the nested NL80211_ATTR_TID_CONFIG attribute. This patch adds support to configure per TID noack policy through the NL80211_TID_CONFIG_ATTR_NOACK attribute. Bug: 154782456 Signed-off-by: Tamizh chelvam <tamizhr@codeaurora.org> Link: https://lore.kernel.org/r/1579506687-18296-2-git-send-email-tamizhr@codeaurora.org Signed-off-by: Johannes Berg <johannes.berg@intel.com> Change-Id: Ia2e2c125aaba64571453838baac052014e386cd6 (cherry picked from commit 77f576deaa393b54a0f2ca8ab1ab5b2d3c6b971b) Signed-off-by: Vamsi Krishna <vamsin@codeaurora.org> Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2020-06-30 14:28:41 +02:00
Jouni Malinen	02d9f7e316	BACKPORT: cfg80211: Support key configuration for Beacon protection (BIGTK) ... IEEE P802.11-REVmd/D3.0 adds support for protecting Beacon frames using a new set of keys (BIGTK; key index 6..7) similarly to the way group-addressed Robust Management frames are protected (IGTK; key index 4..5). Extend cfg80211 and nl80211 to allow the new BIGTK to be configured. Add an extended feature flag to indicate driver support for the new key index values to avoid array overflows in driver implementations and also to indicate to user space when this functionality is available. Bug: 154782456 Signed-off-by: Jouni Malinen <jouni@codeaurora.org> Link: https://lore.kernel.org/r/20200222132548.20835-2-jouni@codeaurora.org Signed-off-by: Johannes Berg <johannes.berg@intel.com> Change-Id: I108164b597c46d0f94fc44cbb030cb8c5cd21773 (cherry picked from commit 56be393fa8b40db2d4f54f97614f645eb8d3c32e) Signed-off-by: Vamsi Krishna <vamsin@codeaurora.org> Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2020-06-30 14:28:41 +02:00
Veerendranath Jakkam	67a67ac328	BACKPORT: cfg80211: Enhance the AKM advertizement to support per interface. ... Commit ab4dfa2053 ("cfg80211: Allow drivers to advertise supported AKM suites") introduces the support to advertize supported AKMs to userspace. This needs an enhancement to advertize the AKM support per interface type, specifically for the cfg80211-based drivers that implement SME and use different mechanisms to support the AKM's for each interface type (e.g., the support for SAE, OWE AKM's take different paths for such drivers on STA/AP mode). This commit aims the same and enhances the earlier mechanism of advertizing the AKMs per wiphy. Add new nl80211 attributes and data structure to provide supported AKMs per interface type to userspace. the AKMs advertized in akm_suites are default capabilities if not advertized for a specific interface type in iftype_akm_suites. Bug: 154782456 Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org> Link: https://lore.kernel.org/r/20200126203032.21934-1-vjakkam@codeaurora.org Signed-off-by: Johannes Berg <johannes.berg@intel.com> Change-Id: I928d355e6cfd85609261e0efbf2e9272da65ba2c (cherry picked from commit d6039a3416f7af37c04f22c411f120ad46f51663) Signed-off-by: Vamsi Krishna <vamsin@codeaurora.org> Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2020-06-30 14:28:41 +02:00
John Crispin	92a63a3d99	BACKPORT: nl80211: add handling for BSS color ... This patch adds the attributes, policy and parsing code to allow userland to send the info about the BSS coloring settings to the kernel. Bug: 154782456 Signed-off-by: John Crispin <john@phrozen.org> Link: https://lore.kernel.org/r/20191217141921.8114-1-john@phrozen.org [johannes: remove the strict policy parsing, that was a misunderstanding] Signed-off-by: Johannes Berg <johannes.berg@intel.com> Change-Id: Ib24133d6825ef455819f697de6d9d67c856c315e (cherry picked from commit 5c5e52d1bb962510fecdc1ebecdde89694d1b223) Signed-off-by: Vamsi Krishna <vamsin@codeaurora.org> Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2020-06-30 14:28:41 +02:00
Gurumoorthi Gnanasambandhan	50635d9eba	BACKPORT: cfg80211: VLAN offload support for set_key and set_sta_vlan ... This provides an alternative mechanism for AP VLAN support where a single netdev is used with VLAN tagged frames instead of separate netdevs for each VLAN without tagged frames from the WLAN driver. By setting NL80211_EXT_FEATURE_VLAN_OFFLOAD flag the driver indicates support for a single netdev with VLAN tagged frames. Separate VLAN-specific netdevs can be added using RTM_NEWLINK/IFLA_VLAN_ID similarly to Ethernet. NL80211_CMD_NEW_KEY (for group keys), NL80211_CMD_NEW_STATION, and NL80211_CMD_SET_STATION will optionally specify vlan_id using NL80211_ATTR_VLAN_ID. Bug: 154782456 Signed-off-by: Gurumoorthi Gnanasambandhan <gguru@codeaurora.org> Signed-off-by: Jouni Malinen <jouni@codeaurora.org> Link: https://lore.kernel.org/r/20191031214640.5012-1-jouni@codeaurora.org Signed-off-by: Johannes Berg <johannes.berg@intel.com> Change-Id: I74c0d2664b1dbe5846a62a433754693a2ead9f2a (cherry picked from commit 14f34e36b36ceede9877ca422a62fcac17b52023) Signed-off-by: Vamsi Krishna <vamsin@codeaurora.org> Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2020-06-30 14:28:41 +02:00
Greg Kroah-Hartman	fa46997961	This is the 5.4.48 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl7wXk8ACgkQONu9yGCS aT5uyhAA1EoV9ROPRt8Vw1fzlDIrRA5X2T+FCGXskg2kKWehVHAvge4U76nZ16+i aYcBX3lAmN7GGVw+/GiRHf9QpiwOUF5f3ZUQZ0KuLS1gcuaXx+VC1h5yyunx3tm1 CI01B2p+GQ3jABWopnhsujMVAeWjbD18NqY+a+xOzTn8CCyLAli+LiviWCR/apQp p4r6++eevWo1yMDlJGNGoMYsFcxChWhtlnDQKWCsIDCN3I1cinGz8wopiv93WqRH Sz3wb1YMuhXb10usNZcZFaSvDGf5XSaMxpRkyNSxN7CLv8LzbovXQOE+fFDGAYxd lUCjRK0wFBMzRSeZ2iGYqqQf5xyYKb6hNmViGprdqwR2c3MBHN/Xs5aDLqJEgHkr OXzZLyHUngRfp3GpagFGV6q06S6fgb9ca/7FuT4Hn8Z3tb5Xt7b/KlPcW3VymiSt I37itASNA/Qs6Njl4tDd9GjwbcOAs+s/XabasU+pXscOkf3o8fYMy2krisy176D/ AXtRTLq4pc42I8c3tv5uCNz7Zje/qytKSPErNRBAedvOu5JX7ab6hgULPH4N7r0N Di/LyKqYw+ZBa4AfzcsvlR3wJLWqni+aFj5yppSrNkH7kNzZGLmlw8xIo8v1CFYw T86b13WmHPqvyFWQLpX5WCEYu0OCw5YCUyQXSsLZN5oC7gAwC7U= =FSdI -----END PGP SIGNATURE----- Merge 5.4.48 into android-5.4-stable Changes in 5.4.48 ACPI: GED: use correct trigger type field in _Exx / _Lxx handling drm/amdgpu: fix and cleanup amdgpu_gem_object_close v4 ath10k: Fix the race condition in firmware dump work queue drm: bridge: adv7511: Extend list of audio sample rates media: staging: imgu: do not hold spinlock during freeing mmu page table media: imx: imx7-mipi-csis: Cleanup and fix subdev pad format handling crypto: ccp -- don't "select" CONFIG_DMADEVICES media: vicodec: Fix error codes in probe function media: si2157: Better check for running tuner in init objtool: Ignore empty alternatives spi: spi-mem: Fix Dual/Quad modes on Octal-capable devices drm/amdgpu: Init data to avoid oops while reading pp_num_states. arm64/kernel: Fix range on invalidating dcache for boot page tables libbpf: Fix memory leak and possible double-free in hashmap__clear spi: pxa2xx: Apply CS clk quirk to BXT x86,smap: Fix smap_{save,restore}() alternatives sched/fair: Refill bandwidth before scaling net: atlantic: make hw_get_regs optional net: ena: fix error returning in ena_com_get_hash_function() efi/libstub/x86: Work around LLVM ELF quirk build regression ath10k: remove the max_sched_scan_reqs value arm64: cacheflush: Fix KGDB trap detection media: staging: ipu3: Fix stale list entries on parameter queue failure rtw88: fix an issue about leak system resources spi: dw: Zero DMA Tx and Rx configurations on stack ACPICA: Dispatcher: add status checks block: alloc map and request for new hardware queue arm64: insn: Fix two bugs in encoding 32-bit logical immediates block: reset mapping if failed to update hardware queue count drm: rcar-du: Set primary plane zpos immutably at initializing lockdown: Allow unprivileged users to see lockdown status ixgbe: Fix XDP redirect on archs with PAGE_SIZE above 4K platform/x86: dell-laptop: don't register micmute LED if there is no token MIPS: Loongson: Build ATI Radeon GPU driver as module Bluetooth: Add SCO fallback for invalid LMP parameters error kgdb: Disable WARN_CONSOLE_UNLOCKED for all kgdb kgdb: Prevent infinite recursive entries to the debugger pmu/smmuv3: Clear IRQ affinity hint on device removal ACPI/IORT: Fix PMCG node single ID mapping handling mips: Fix cpu_has_mips64r1/2 activation for MIPS32 CPUs spi: dw: Enable interrupts in accordance with DMA xfer mode clocksource: dw_apb_timer: Make CPU-affiliation being optional clocksource: dw_apb_timer_of: Fix missing clockevent timers media: dvbdev: Fix tuner->demod media controller link btrfs: account for trans_block_rsv in may_commit_transaction btrfs: do not ignore error from btrfs_next_leaf() when inserting checksums ARM: 8978/1: mm: make act_mm() respect THREAD_SIZE batman-adv: Revert "disable ethtool link speed detection when auto negotiation off" ice: Fix memory leak ice: Fix for memory leaks and modify ICE_FREE_CQ_BUFS mmc: meson-mx-sdio: trigger a soft reset after a timeout or CRC error Bluetooth: btmtkuart: Improve exception handling in btmtuart_probe() spi: dw: Fix Rx-only DMA transfers x86/kvm/hyper-v: Explicitly align hcall param for kvm_hyperv_exit net: vmxnet3: fix possible buffer overflow caused by bad DMA value in vmxnet3_get_rss() x86: fix vmap arguments in map_irq_stack staging: android: ion: use vmap instead of vm_map_ram ath10k: fix kernel null pointer dereference media: staging/intel-ipu3: Implement lock for stream on/off operations spi: Respect DataBitLength field of SpiSerialBusV2() ACPI resource brcmfmac: fix wrong location to get firmware feature regulator: qcom-rpmh: Fix typos in pm8150 and pm8150l tools api fs: Make xxx__mountpoint() more scalable e1000: Distribute switch variables for initialization dt-bindings: display: mediatek: control dpi pins mode to avoid leakage drm/mediatek: set dpi pin mode to gpio low to avoid leakage current audit: fix a net reference leak in audit_send_reply() media: dvb: return -EREMOTEIO on i2c transfer failure. media: platform: fcp: Set appropriate DMA parameters MIPS: Make sparse_init() using top-down allocation ath10k: add flush tx packets for SDIO chip Bluetooth: btbcm: Add 2 missing models to subver tables audit: fix a net reference leak in audit_list_rules_send() Drivers: hv: vmbus: Always handle the VMBus messages on CPU0 dpaa2-eth: fix return codes used in ndo_setup_tc netfilter: nft_nat: return EOPNOTSUPP if type or flags are not supported selftests/bpf: Fix memory leak in extract_build_id() net: bcmgenet: set Rx mode before starting netif net: bcmgenet: Fix WoL with password after deep sleep lib/mpi: Fix 64-bit MIPS build with Clang exit: Move preemption fixup up, move blocking operations down sched/core: Fix illegal RCU from offline CPUs drivers/perf: hisi: Fix typo in events attribute array iocost_monitor: drop string wrap around numbers when outputting json net: lpc-enet: fix error return code in lpc_mii_init() selinux: fix error return code in policydb_read() drivers: net: davinci_mdio: fix potential NULL dereference in davinci_mdio_probe() media: cec: silence shift wrapping warning in __cec_s_log_addrs() net: allwinner: Fix use correct return type for ndo_start_xmit() powerpc/spufs: fix copy_to_user while atomic libertas_tf: avoid a null dereference in pointer priv xfs: clean up the error handling in xfs_swap_extents Crypto/chcr: fix for ccm(aes) failed test MIPS: Truncate link address into 32bit for 32bit kernel mips: cm: Fix an invalid error code of INTVN_*_ERR kgdb: Fix spurious true from in_dbg_master() xfs: reset buffer write failure state on successful completion xfs: fix duplicate verification from xfs_qm_dqflush() platform/x86: intel-vbtn: Use acpi_evaluate_integer() platform/x86: intel-vbtn: Split keymap into buttons and switches parts platform/x86: intel-vbtn: Do not advertise switches to userspace if they are not there platform/x86: intel-vbtn: Also handle tablet-mode switch on "Detachable" and "Portable" chassis-types iwlwifi: avoid debug max amsdu config overwriting itself nvme: refine the Qemu Identify CNS quirk nvme-pci: align io queue count with allocted nvme_queue in nvme_probe nvme-tcp: use bh_lock in data_ready ath10k: Remove msdu from idr when management pkt send fails wcn36xx: Fix error handling path in 'wcn36xx_probe()' net: qed*: Reduce RX and TX default ring count when running inside kdump kernel drm/mcde: dsi: Fix return value check in mcde_dsi_bind() mt76: avoid rx reorder buffer overflow md: don't flush workqueue unconditionally in md_open raid5: remove gfp flags from scribble_alloc() iocost: don't let vrate run wild while there's no saturation signal veth: Adjust hard_start offset on redirect XDP frames net/mlx5e: IPoIB, Drop multicast packets that this interface sent rtlwifi: Fix a double free in _rtl_usb_tx_urb_setup() mwifiex: Fix memory corruption in dump_station kgdboc: Use a platform device to handle tty drivers showing up late x86/boot: Correct relocation destination on old linkers sched: Defend cfs and rt bandwidth quota against overflow mips: MAAR: Use more precise address mask mips: Add udelay lpj numbers adjustment crypto: stm32/crc32 - fix ext4 chksum BUG_ON() crypto: stm32/crc32 - fix run-time self test issue. crypto: stm32/crc32 - fix multi-instance drm/amd/powerpay: Disable gfxoff when setting manual mode on picasso and raven drm/amdgpu: Sync with VM root BO when switching VM to CPU update mode selftests/bpf: CONFIG_IPV6_SEG6_BPF required for test_seg6_loop.o x86/mm: Stop printing BRK addresses MIPS: tools: Fix resource leak in elf-entry.c m68k: mac: Don't call via_flush_cache() on Mac IIfx btrfs: improve global reserve stealing logic btrfs: qgroup: mark qgroup inconsistent if we're inherting snapshot to a new qgroup macvlan: Skip loopback packets in RX handler PCI: Don't disable decoding when mmio_always_on is set MIPS: Fix IRQ tracing when call handle_fpe() and handle_msa_fpe() bcache: fix refcount underflow in bcache_device_free() mmc: sdhci-msm: Set SDHCI_QUIRK_MULTIBLOCK_READ_ACMD12 quirk staging: greybus: sdio: Respect the cmd->busy_timeout from the mmc core mmc: via-sdmmc: Respect the cmd->busy_timeout from the mmc core ice: fix potential double free in probe unrolling ixgbe: fix signed-integer-overflow warning iwlwifi: mvm: fix aux station leak mmc: sdhci-esdhc-imx: fix the mask for tuning start point spi: dw: Return any value retrieved from the dma_transfer callback cpuidle: Fix three reference count leaks platform/x86: hp-wmi: Convert simple_strtoul() to kstrtou32() platform/x86: intel-hid: Add a quirk to support HP Spectre X2 (2015) platform/x86: intel-vbtn: Only blacklist SW_TABLET_MODE on the 9 / "Laptop" chasis-type platform/x86: asus_wmi: Reserve more space for struct bias_args libbpf: Fix perf_buffer__free() API for sparse allocs bpf: Fix map permissions check bpf: Refactor sockmap redirect code so its easy to reuse bpf: Fix running sk_skb program types with ktls selftests/bpf, flow_dissector: Close TAP device FD after the test kasan: stop tests being eliminated as dead code with FORTIFY_SOURCE string.h: fix incompatibility between FORTIFY_SOURCE and KASAN btrfs: free alien device after device add btrfs: include non-missing as a qualifier for the latest_bdev btrfs: send: emit file capabilities after chown btrfs: force chunk allocation if our global rsv is larger than metadata btrfs: fix error handling when submitting direct I/O bio btrfs: fix wrong file range cleanup after an error filling dealloc range btrfs: fix space_info bytes_may_use underflow after nocow buffered write btrfs: fix space_info bytes_may_use underflow during space cache writeout powerpc/mm: Fix conditions to perform MMU specific management by blocks on PPC32. mm: thp: make the THP mapcount atomic against __split_huge_pmd_locked() mm: initialize deferred pages with interrupts enabled mm/pagealloc.c: call touch_nmi_watchdog() on max order boundaries in deferred init mm: call cond_resched() from deferred_init_memmap() ima: Fix ima digest hash table key calculation ima: Switch to ima_hash_algo for boot aggregate ima: Evaluate error in init_ima() ima: Directly assign the ima_default_policy pointer to ima_rules ima: Call ima_calc_boot_aggregate() in ima_eventdigest_init() ima: Remove __init annotation from ima_pcrread() evm: Fix possible memory leak in evm_calc_hmac_or_hash() ext4: fix EXT_MAX_EXTENT/INDEX to check for zeroed eh_max ext4: fix error pointer dereference ext4: fix race between ext4_sync_parent() and rename() PCI: Avoid Pericom USB controller OHCI/EHCI PME# defect PCI: Avoid FLR for AMD Matisse HD Audio & USB 3.0 PCI: Avoid FLR for AMD Starship USB 3.0 PCI: Add ACS quirk for Intel Root Complex Integrated Endpoints PCI: vmd: Add device id for VMD device 8086:9A0B x86/amd_nb: Add Family 19h PCI IDs PCI: Add Loongson vendor ID serial: 8250_pci: Move Pericom IDs to pci_ids.h x86/amd_nb: Add AMD family 17h model 60h PCI IDs ima: Remove redundant policy rule set in add_rules() ima: Set again build_ima_appraise variable PCI: Program MPS for RCiEP devices e1000e: Disable TSO for buffer overrun workaround e1000e: Relax condition to trigger reset for ME workaround carl9170: remove P2P_GO support media: go7007: fix a miss of snd_card_free media: cedrus: Program output format during each run serial: 8250: Avoid error message on reprobe Bluetooth: hci_bcm: fix freeing not-requested IRQ b43legacy: Fix case where channel status is corrupted b43: Fix connection problem with WPA3 b43_legacy: Fix connection problem with WPA3 media: ov5640: fix use of destroyed mutex clk: mediatek: assign the initial value to clk_init_data of mtk_mux igb: Report speed and duplex as unknown when device is runtime suspended hwmon: (k10temp) Add AMD family 17h model 60h PCI match EDAC/amd64: Add AMD family 17h model 60h PCI IDs power: vexpress: add suppress_bind_attrs to true power: supply: core: fix HWMON temperature labels power: supply: core: fix memory leak in HWMON error path pinctrl: samsung: Correct setting of eint wakeup mask on s5pv210 pinctrl: samsung: Save/restore eint_mask over suspend for EINT_TYPE GPIOs gnss: sirf: fix error return code in sirf_probe() sparc32: fix register window handling in genregs32_[gs]et() sparc64: fix misuses of access_process_vm() in genregs32_[sg]et() dm crypt: avoid truncating the logical block size alpha: fix memory barriers so that they conform to the specification powerpc/fadump: use static allocation for reserved memory ranges powerpc/fadump: consider reserved ranges while reserving memory powerpc/fadump: Account for memory_limit while reserving memory kernel/cpu_pm: Fix uninitted local in cpu_pm ARM: tegra: Correct PL310 Auxiliary Control Register initialization soc/tegra: pmc: Select GENERIC_PINCONF ARM: dts: exynos: Fix GPIO polarity for thr GalaxyS3 CM36651 sensor's bus ARM: dts: at91: sama5d2_ptc_ek: fix vbus pin ARM: dts: s5pv210: Set keep-power-in-suspend for SDHCI1 on Aries drivers/macintosh: Fix memleak in windfarm_pm112 driver powerpc/32s: Fix another build failure with CONFIG_PPC_KUAP_DEBUG powerpc/kasan: Fix issues by lowering KASAN_SHADOW_END powerpc/kasan: Fix shadow pages allocation failure powerpc/32: Disable KASAN with pages bigger than 16k powerpc/64s: Don't let DT CPU features set FSCR_DSCR powerpc/64s: Save FSCR to init_task.thread.fscr after feature init kbuild: force to build vmlinux if CONFIG_MODVERSION=y sunrpc: svcauth_gss_register_pseudoflavor must reject duplicate registrations. sunrpc: clean up properly in gss_mech_unregister() mtd: rawnand: Fix nand_gpio_waitrdy() mtd: rawnand: onfi: Fix redundancy detection check mtd: rawnand: brcmnand: fix hamming oob layout mtd: rawnand: diskonchip: Fix the probe error path mtd: rawnand: sharpsl: Fix the probe error path mtd: rawnand: ingenic: Fix the probe error path mtd: rawnand: xway: Fix the probe error path mtd: rawnand: orion: Fix the probe error path mtd: rawnand: socrates: Fix the probe error path mtd: rawnand: oxnas: Fix the probe error path mtd: rawnand: sunxi: Fix the probe error path mtd: rawnand: plat_nand: Fix the probe error path mtd: rawnand: pasemi: Fix the probe error path mtd: rawnand: mtk: Fix the probe error path mtd: rawnand: tmio: Fix the probe error path w1: omap-hdq: cleanup to add missing newline for some dev_dbg f2fs: fix checkpoint=disable:%u%% perf probe: Do not show the skipped events perf probe: Fix to check blacklist address correctly perf probe: Check address correctness by map instead of _etext perf symbols: Fix debuginfo search for Ubuntu perf symbols: Fix kernel maps for kcore and eBPF Linux 5.4.48 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I9954fb3f08956419e8586bcb9078e604df207fb9	2020-06-22 11:43:59 +02:00
John Fastabend	e7b1564a24	bpf: Fix running sk_skb program types with ktls ... [ Upstream commit e91de6afa81c10e9f855c5695eb9a53168d96b73 ] KTLS uses a stream parser to collect TLS messages and send them to the upper layer tls receive handler. This ensures the tls receiver has a full TLS header to parse when it is run. However, when a socket has BPF_SK_SKB_STREAM_VERDICT program attached before KTLS is enabled we end up with two stream parsers running on the same socket. The result is both try to run on the same socket. First the KTLS stream parser runs and calls read_sock() which will tcp_read_sock which in turn calls tcp_rcv_skb(). This dequeues the skb from the sk_receive_queue. When this is done KTLS code then data_ready() callback which because we stacked KTLS on top of the bpf stream verdict program has been replaced with sk_psock_start_strp(). This will in turn kick the stream parser again and eventually do the same thing KTLS did above calling into tcp_rcv_skb() and dequeuing a skb from the sk_receive_queue. At this point the data stream is broke. Part of the stream was handled by the KTLS side some other bytes may have been handled by the BPF side. Generally this results in either missing data or more likely a "Bad Message" complaint from the kTLS receive handler as the BPF program steals some bytes meant to be in a TLS header and/or the TLS header length is no longer correct. We've already broke the idealized model where we can stack ULPs in any order with generic callbacks on the TX side to handle this. So in this patch we do the same thing but for RX side. We add a sk_psock_strp_enabled() helper so TLS can learn a BPF verdict program is running and add a tls_sw_has_ctx_rx() helper so BPF side can learn there is a TLS ULP on the socket. Then on BPF side we omit calling our stream parser to avoid breaking the data stream for the KTLS receiver. Then on the KTLS side we call BPF_SK_SKB_STREAM_VERDICT once the KTLS receiver is done with the packet but before it posts the msg to userspace. This gives us symmetry between the TX and RX halfs and IMO makes it usable again. On the TX side we process packets in this order BPF -> TLS -> TCP and on the receive side in the reverse order TCP -> TLS -> BPF. Discovered while testing OpenSSL 3.0 Alpha2.0 release. Fixes: d829e9c411 ("tls: convert to generic sk_msg interface") Signed-off-by: John Fastabend <john.fastabend@gmail.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/159079361946.5745.605854335665044485.stgit@john-Precision-5820-Tower Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2020-06-22 09:31:12 +02:00
Greg Kroah-Hartman	eaaa29ec5a	This is the 5.4.47 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl7qK2gACgkQONu9yGCS aT4kaw/8Cknc9G64S1SWchxFj4LnSYzrpeFGXOZBlHBtcCyD12JNGjA6SG6DoGLY /s/1fjBwJWrWpkI36CGNZowNPYtzRMOhyBGj7QHTpEj0vjMTKYXhVieMquQSHwRP zcrYl8f/xWJKo6XNjR1YLh5PWeD6B9dWD1RcvBZ0jCez84jyVT1EyWMWGiodkLMx gmJITO2DBaekelU0yyZJIFePO5DJpcXspf5lrPgkPG9u/U4hZf94AAGMYbXJZ5Rn BDcqGEGQe+mtcG6lq6DGRDH5VVMG4k13MrZJBfrVAhkGU+g6nKQbOXCcdcRjoM6N 9NL8RbcpL0NhphNmrKwjNcYd4kZxYgTQb87FZi+qDxwGQIWIxcET6gL5t/vqAev1 v/uKFLlt5x/2tNtpC8aY8EwdyGcXfeBXEl9AjP7HUWC/KzB8I9vLnokcMvOMYDIg 3wNIsKMYLcLzuLL8oJ7FvDkBO+H/RjSvF4UvQyLOPOJtWSV5uKbLfKIU9sw90G3i t8qo3lNC/J4saJ+jx+O7XoHjFw6biJFATvs0+HtpCkwi0aJm2SGW+OvXuZCGZPnz TW2YsGFCCwL/RPtceJVkGfV3kr7SUB5AGXjueXdC+4QWfmi3POWojjgheQrleS+3 OLxRsUVbQ6hOqEgLAaV6HhzvykkTjDj2Gq8P3I+1Y/eiRHjlpdU= =WYnW -----END PGP SIGNATURE----- Merge 5.4.47 into android-5.4-stable Changes in 5.4.47 ipv6: fix IPV6_ADDRFORM operation logic mlxsw: core: Use different get_trend() callbacks for different thermal zones net_failover: fixed rollback in net_failover_open() tun: correct header offsets in napi frags mode bridge: Avoid infinite loop when suppressing NS messages with invalid options vxlan: Avoid infinite loop when suppressing NS messages with invalid options bpf: Support llvm-objcopy for vmlinux BTF elfnote: mark all .note sections SHF_ALLOC Input: mms114 - fix handling of mms345l ARM: 8977/1: ptrace: Fix mask for thumb breakpoint hook sched/fair: Don't NUMA balance for kthreads Input: synaptics - add a second working PNP_ID for Lenovo T470s csky: Fixup abiv2 syscall_trace break a4 & a5 gfs2: Even more gfs2_find_jhead fixes drivers/net/ibmvnic: Update VNIC protocol version reporting powerpc/xive: Clear the page tables for the ESB IO mapping spi: dw: Fix native CS being unset ath9k_htc: Silence undersized packet warnings smack: avoid unused 'sip' variable warning RDMA/uverbs: Make the event_queue fds return POLLERR when disassociated padata: add separate cpuhp node for CPUHP_PADATA_DEAD s390/pci: Log new handle in clp_disable_fh() x86/cpu/amd: Make erratum #1054 a legacy erratum KVM: x86: only do L1TF workaround on affected processors PCI/PM: Adjust pcie_wait_for_link_delay() for caller delay perf probe: Accept the instance number of kretprobe event mm: add kvfree_sensitive() for freeing sensitive data objects selftests: fix flower parent qdisc fanotify: fix ignore mask logic for events on child and on dir aio: fix async fsync creds ipv4: fix a RCU-list lock in fib_triestat_seq_show iwlwifi: mvm: fix NVM check for 3168 devices sctp: fix possibly using a bad saddr with a given dst sctp: fix refcount bug in sctp_wfree x86_64: Fix jiffies ODR violation x86/PCI: Mark Intel C620 MROMs as having non-compliant BARs x86/speculation: Prevent rogue cross-process SSBD shutdown x86/speculation: Avoid force-disabling IBPB based on STIBP and enhanced IBRS. x86/speculation: PR_SPEC_FORCE_DISABLE enforcement for indirect branches. x86/reboot/quirks: Add MacBook6,1 reboot quirk perf/x86/intel: Add more available bits for OFFCORE_RESPONSE of Intel Tremont KVM: x86/mmu: Set mmio_value to '0' if reserved #PF can't be generated KVM: x86: respect singlestep when emulating instruction KVM: x86: Fix APIC page invalidation race powerpc/ptdump: Properly handle non standard page size ASoC: max9867: fix volume controls io_uring: use kvfree() in io_sqe_buffer_register() efi/efivars: Add missing kobject_put() in sysfs entry creation error path smb3: fix incorrect number of credits when ioctl MaxOutputResponse > 64K smb3: add indatalen that can be a non-zero value to calculation of credit charge in smb2 ioctl watchdog: imx_sc_wdt: Fix reboot on crash ALSA: es1688: Add the missed snd_card_free() ALSA: fireface: fix configuration error for nominal sampling transfer frequency ALSA: hda/realtek - add a pintbl quirk for several Lenovo machines ALSA: pcm: disallow linking stream to itself ALSA: pcm: fix snd_pcm_link() lockdep splat ALSA: usb-audio: Fix inconsistent card PM state after resume ALSA: usb-audio: Add vendor, product and profile name for HP Thunderbolt Dock ACPI: sysfs: Fix reference count leak in acpi_sysfs_add_hotplug_profile() ACPI: CPPC: Fix reference count leak in acpi_cppc_processor_probe() ACPI: GED: add support for _Exx / _Lxx handler methods ACPI: PM: Avoid using power resources if there are none for D0 arm64: acpi: fix UBSAN warning lib/lzo: fix ambiguous encoding bug in lzo-rle nilfs2: fix null pointer dereference at nilfs_segctor_do_construct() spi: dw: Fix controller unregister order spi: Fix controller unregister order spi: pxa2xx: Fix controller unregister order spi: pxa2xx: Fix runtime PM ref imbalance on probe error spi: bcm2835: Fix controller unregister order spi: bcm2835aux: Fix controller unregister order spi: bcm-qspi: Handle clock probe deferral spi: bcm-qspi: when tx/rx buffer is NULL set to 0 PM: runtime: clk: Fix clk_pm_runtime_get() error path gup: document and work around "COW can break either way" issue crypto: cavium/nitrox - Fix 'nitrox_get_first_device()' when ndevlist is fully iterated crypto: algapi - Avoid spurious modprobe on LOADED crypto: drbg - fix error return code in drbg_alloc_state() x86/{mce,mm}: Unmap the entire page if the whole page is affected and poisoned firmware: imx: warn on unexpected RX firmware: imx-scu: Support one TX and one RX firmware: imx: scu: Fix corruption of header crypto: virtio: Fix use-after-free in virtio_crypto_skcipher_finalize_req() crypto: virtio: Fix src/dst scatterlist calculation in __virtio_crypto_skcipher_do_req() crypto: virtio: Fix dest length calculation in __virtio_crypto_skcipher_do_req() dccp: Fix possible memleak in dccp_init and dccp_fini selftests/net: in rxtimestamp getopt_long needs terminating null entry net/mlx5: drain health workqueue in case of driver load error net/mlx5: Fix fatal error handling during device load net/mlx5e: Fix repeated XSK usage on one channel ovl: initialize error in ovl_copy_xattr proc: Use new_inode not new_inode_pseudo remoteproc: Fall back to using parent memory pool if no dedicated available remoteproc: Fix and restore the parenting hierarchy for vdev cpufreq: Fix up cpufreq_boost_set_sw() EDAC/skx: Use the mcmtr register to retrieve close_pg/bank_xor_enable video: vt8500lcdfb: fix fallthrough warning video: fbdev: w100fb: Fix a potential double free. KVM: nVMX: Skip IBPB when switching between vmcs01 and vmcs02 KVM: nSVM: fix condition for filtering async PF KVM: nSVM: leave ASID aside in copy_vmcb_control_area KVM: nVMX: Consult only the "basic" exit reason when routing nested exit KVM: MIPS: Define KVM_ENTRYHI_ASID to cpu_asid_mask(&boot_cpu_data) KVM: MIPS: Fix VPN2_MASK definition for variable cpu_vmbits KVM: arm64: Stop writing aarch32's CSSELR into ACTLR KVM: arm64: Make vcpu_cp1x() work on Big Endian hosts scsi: megaraid_sas: TM command refire leads to controller firmware crash scsi: lpfc: Fix negation of else clause in lpfc_prep_node_fc4type selftests/ftrace: Return unsupported if no error_log file ath9k: Fix use-after-free Read in htc_connect_service ath9k: Fix use-after-free Read in ath9k_wmi_ctrl_rx ath9k: Fix use-after-free Write in ath9k_htc_rx_msg ath9x: Fix stack-out-of-bounds Write in ath9k_hif_usb_rx_cb ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb Smack: slab-out-of-bounds in vsscanf drm/vkms: Hold gem object while still in-use mm/slub: fix a memory leak in sysfs_slab_add() fat: don't allow to mount if the FAT length == 0 perf: Add cond_resched() to task_function_call() agp/intel: Reinforce the barrier after GTT updates mmc: sdhci-msm: Clear tuning done flag while hs400 tuning mmc: mmci_sdmmc: fix DMA API warning overlapping mappings mmc: tmio: Further fixup runtime PM management at remove mmc: uniphier-sd: call devm_request_irq() after tmio_mmc_host_probe() ARM: dts: at91: sama5d2_ptc_ek: fix sdmmc0 node description mmc: sdio: Fix potential NULL pointer error in mmc_sdio_init_card() mmc: sdio: Fix several potential memory leaks in mmc_sdio_init_card() block/floppy: fix contended case in floppy_queue_rq() xen/pvcalls-back: test for errors when calling backend_connect() KVM: arm64: Synchronize sysreg state on injecting an AArch32 exception KVM: arm64: Save the host's PtrAuth keys in non-preemptible context Linux 5.4.47 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I3fb3216abdbc080b4ac7b827b35ff6a813e28eb8	2020-06-18 10:05:17 +02:00
Wang Hai	05e275d874	dccp: Fix possible memleak in dccp_init and dccp_fini ... [ Upstream commit c96b6acc8f89a4a7f6258dfe1d077654c11415be ] There are some memory leaks in dccp_init() and dccp_fini(). In dccp_fini() and the error handling path in dccp_init(), free lhash2 is missing. Add inet_hashinfo2_free_mod() to do it. If inet_hashinfo2_init_mod() failed in dccp_init(), percpu_counter_destroy() should be called to destroy dccp_orphan_count. It need to goto out_free_percpu when inet_hashinfo2_init_mod() failed. Fixes: c92c81df93 ("net: dccp: fix kernel crash on module load") Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: Wang Hai <wanghai38@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2020-06-17 16:40:32 +02:00
Greg Kroah-Hartman	f520ca124c	This is the 5.4.44 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl7XQXMACgkQONu9yGCS aT4OHw//YYuI/61rkff6/3qAE4gDwTZolVywu5HHzT5W7t7qeHPzJin2u04RBiS8 4S8Mut0RUSK/0IyB0B3S342ntia1v41Q04veWm0K90iAScScjjUapLDXC/P3StA0 iitGKJ8QFDS49+PFKFYkyXEsv6HYlDbtTmS0yxVoooSr+uqeR7m6rS1jsDsfUTaR T4tvfX8VPHkgfkfkOKCUq8/rM3uDW3lSk3JflIbPwRBQo9KvNPnfBetU9p//dCHG CB1K9K3sB6xLkKe7Ut7PlwoTq/Lc8qOma535xy3A8Iv6fVq4+hPE2jsB93WGI270 WoEZbHpon7W6g/bU+C+CGfov2zBtz1dKHfWNcK5+dEkEQjjzKvvigfUvaKjyUUKB Vo5rQ3GZQ4JsMkHEJaLOlp3/SkdRd6RV/E0YErBISNeswzqsOgTrX8mz6wfQInwd Ww7V9LKdwSD6h2DuzutUbEm1X8i8glXammWEOUuh6zzQ3+WS57R1L+Nkr/6WxpgN w2g7F0+5enUbE1kIdq5OCzY1D0gBpT1o5YlrZgdL2GF5lU1b/lhsGhV6P83fl2Mf rTGFtg5M1pNgjbUkSH3VHHof35PM9vQZ6lrYbKMCjwymVY+BcR6nsCadfLqjMGnW NCYeiAmoIVCJX7q0hONww+TevZ3T+SLUjQ2os3WzooPC51MPOAQ= =5p6V -----END PGP SIGNATURE----- Merge 5.4.44 into android-5.4-stable Changes in 5.4.44 ax25: fix setsockopt(SO_BINDTODEVICE) dpaa_eth: fix usage as DSA master, try 3 net: don't return invalid table id error when we fall back to PF_UNSPEC net: dsa: mt7530: fix roaming from DSA user ports net: ethernet: ti: cpsw: fix ASSERT_RTNL() warning during suspend __netif_receive_skb_core: pass skb by reference net: inet_csk: Fix so_reuseport bind-address cache in tb->fast* net: ipip: fix wrong address family in init error path net/mlx5: Add command entry handling completion net: mvpp2: fix RX hashing for non-10G ports net: nlmsg_cancel() if put fails for nhmsg net: qrtr: Fix passing invalid reference to qrtr_local_enqueue() net: revert "net: get rid of an signed integer overflow in ip_idents_reserve()" net sched: fix reporting the first-time use timestamp net/tls: fix race condition causing kernel panic nexthop: Fix attribute checking for groups r8152: support additional Microsoft Surface Ethernet Adapter variant sctp: Don't add the shutdown timer if its already been added sctp: Start shutdown on association restart if in SHUTDOWN-SENT state and socket is closed tipc: block BH before using dst_cache net/mlx5e: kTLS, Destroy key object after destroying the TIS net/mlx5e: Fix inner tirs handling net/mlx5: Fix memory leak in mlx5_events_init net/mlx5e: Update netdev txq on completions during closure net/mlx5: Fix error flow in case of function_setup failure net/mlx5: Annotate mutex destroy for root ns net/tls: fix encryption error checking net/tls: free record only on encryption error net: sun: fix missing release regions in cas_init_one(). net/mlx4_core: fix a memory leak bug. mlxsw: spectrum: Fix use-after-free of split/unsplit/type_set in case reload fails ARM: dts: rockchip: fix phy nodename for rk3228-evb ARM: dts: rockchip: fix phy nodename for rk3229-xms6 arm64: dts: rockchip: fix status for &gmac2phy in rk3328-evb.dts arm64: dts: rockchip: swap interrupts interrupt-names rk3399 gpu node ARM: dts: rockchip: swap clock-names of gpu nodes ARM: dts: rockchip: fix pinctrl sub nodename for spi in rk322x.dtsi gpio: tegra: mask GPIO IRQs during IRQ shutdown ALSA: usb-audio: add mapping for ASRock TRX40 Creator net: microchip: encx24j600: add missed kthread_stop gfs2: move privileged user check to gfs2_quota_lock_check gfs2: Grab glock reference sooner in gfs2_add_revoke drm/amdgpu: drop unnecessary cancel_delayed_work_sync on PG ungate drm/amd/powerplay: perform PG ungate prior to CG ungate drm/amdgpu: Use GEM obj reference for KFD BOs cachefiles: Fix race between read_waiter and read_copier involving op->to_do usb: dwc3: pci: Enable extcon driver for Intel Merrifield usb: phy: twl6030-usb: Fix a resource leak in an error handling path in 'twl6030_usb_probe()' usb: gadget: legacy: fix redundant initialization warnings net: freescale: select CONFIG_FIXED_PHY where needed IB/i40iw: Remove bogus call to netdev_master_upper_dev_get() riscv: stacktrace: Fix undefined reference to `walk_stackframe' clk: ti: am33xx: fix RTC clock parent csky: Fixup msa highest 3 bits mask csky: Fixup perf callchain unwind csky: Fixup remove duplicate irq_disable hwmon: (nct7904) Fix incorrect range of temperature limit registers cifs: Fix null pointer check in cifs_read csky: Fixup raw_copy_from_user() samples: bpf: Fix build error drivers: net: hamradio: Fix suspicious RCU usage warning in bpqether.c Input: usbtouchscreen - add support for BonXeon TP Input: evdev - call input_flush_device() on release(), not flush() Input: xpad - add custom init packet for Xbox One S controllers Input: dlink-dir685-touchkeys - fix a typo in driver name Input: i8042 - add ThinkPad S230u to i8042 reset list Input: synaptics-rmi4 - really fix attn_data use-after-free Input: synaptics-rmi4 - fix error return code in rmi_driver_probe() ARM: 8970/1: decompressor: increase tag size ARM: uaccess: consolidate uaccess asm to asm/uaccess-asm.h ARM: uaccess: integrate uaccess_save and uaccess_restore ARM: uaccess: fix DACR mismatch with nested exceptions gpio: exar: Fix bad handling for ida_simple_get error path arm64: dts: mt8173: fix vcodec-enc clock soc: mediatek: cmdq: return send msg error code gpu/drm: Ingenic: Fix opaque pointer casted to wrong type IB/qib: Call kobject_put() when kobject_init_and_add() fails ARM: dts/imx6q-bx50v3: Set display interface clock parents ARM: dts: bcm2835-rpi-zero-w: Fix led polarity ARM: dts: bcm: HR2: Fix PPI interrupt types mmc: block: Fix use-after-free issue for rpmb gpio: pxa: Fix return value of pxa_gpio_probe() gpio: bcm-kona: Fix return value of bcm_kona_gpio_probe() RDMA/pvrdma: Fix missing pci disable in pvrdma_pci_probe() ALSA: hwdep: fix a left shifting 1 by 31 UB bug ALSA: hda/realtek - Add a model for Thinkpad T570 without DAC workaround ALSA: usb-audio: mixer: volume quirk for ESS Technology Asus USB DAC exec: Always set cap_ambient in cap_bprm_set_creds clk: qcom: gcc: Fix parent for gpll0_out_even ALSA: usb-audio: Quirks for Gigabyte TRX40 Aorus Master onboard audio ALSA: hda/realtek - Add new codec supported for ALC287 libceph: ignore pool overlay and cache logic on redirects ceph: flush release queue when handling caps for unknown inode RDMA/core: Fix double destruction of uobject drm/amd/display: drop cursor position check in atomic test IB/ipoib: Fix double free of skb in case of multicast traffic in CM mode mm,thp: stop leaking unreleased file pages mm: remove VM_BUG_ON(PageSlab()) from page_mapcount() fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info() include/asm-generic/topology.h: guard cpumask_of_node() macro argument Revert "block: end bio with BLK_STS_AGAIN in case of non-mq devs and REQ_NOWAIT" gpio: fix locking open drain IRQ lines iommu: Fix reference count leak in iommu_group_alloc. parisc: Fix kernel panic in mem_init() cfg80211: fix debugfs rename crash x86/syscalls: Revert "x86/syscalls: Make __X32_SYSCALL_BIT be unsigned long" mac80211: mesh: fix discovery timer re-arming issue / crash x86/dma: Fix max PFN arithmetic overflow on 32 bit systems copy_xstate_to_kernel(): don't leave parts of destination uninitialized xfrm: allow to accept packets with ipv6 NEXTHDR_HOP in xfrm_input xfrm: do pskb_pull properly in __xfrm_transport_prep xfrm: remove the xfrm_state_put call becofe going to out_reset xfrm: call xfrm_output_gso when inner_protocol is set in xfrm_output xfrm interface: fix oops when deleting a x-netns interface xfrm: fix a warning in xfrm_policy_insert_list xfrm: fix a NULL-ptr deref in xfrm_local_error xfrm: fix error in comment ip_vti: receive ipip packet by calling ip_tunnel_rcv netfilter: nft_reject_bridge: enable reject with bridge vlan netfilter: ipset: Fix subcounter update skip netfilter: conntrack: make conntrack userspace helpers work again netfilter: nfnetlink_cthelper: unbreak userspace helper support netfilter: nf_conntrack_pptp: prevent buffer overflows in debug code esp6: get the right proto for transport mode in esp6_gso_encap bnxt_en: Fix accumulation of bp->net_stats_prev. ieee80211: Fix incorrect mask for default PE duration xsk: Add overflow check for u64 division, stored into u32 qlcnic: fix missing release in qlcnic_83xx_interrupt_test. crypto: chelsio/chtls: properly set tp->lsndtime nexthops: Move code from remove_nexthop_from_groups to remove_nh_grp_entry nexthops: don't modify published nexthop groups nexthop: Expand nexthop_is_multipath in a few places ipv4: nexthop version of fib_info_nh_uses_dev net: dsa: declare lockless TX feature for slave ports bonding: Fix reference count leak in bond_sysfs_slave_add. netfilter: conntrack: comparison of unsigned in cthelper confirmation netfilter: conntrack: Pass value of ctinfo to __nf_conntrack_update netfilter: nf_conntrack_pptp: fix compilation warning with W=1 build perf: Make perf able to build with latest libbfd Linux 5.4.44 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Idd547df1abb0bea116f30e3224a80387529adb0b	2020-06-04 08:23:35 +02:00
David Ahern	35c0a6e7ef	ipv4: nexthop version of fib_info_nh_uses_dev ... commit 1fd1c768f3624a5e66766e7b4ddb9b607cd834a5 upstream. Similar to the last path, need to fix fib_info_nh_uses_dev for external nexthops to avoid referencing multiple nh_grp structs. Move the device check in fib_info_nh_uses_dev to a helper and create a nexthop version that is called if the fib_info uses an external nexthop. Fixes: 430a049190 ("nexthop: Add support for nexthop groups") Signed-off-by: David Ahern <dsahern@gmail.com> Acked-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2020-06-03 08:21:37 +02:00
David Ahern	568c159356	nexthop: Expand nexthop_is_multipath in a few places ... commit 0b5e2e39739e861fa5fc84ab27a35dbe62a15330 upstream. I got too fancy consolidating checks on multipath type. The result is that path lookups can access 2 different nh_grp structs as exposed by Nik's torture tests. Expand nexthop_is_multipath within nexthop.h to avoid multiple, nh_grp dereferences and make decisions based on the consistent struct. Only 2 places left using nexthop_is_multipath are within IPv6, both only check that the nexthop is a multipath for a branching decision which are acceptable. Fixes: 430a049190 ("nexthop: Add support for nexthop groups") Signed-off-by: David Ahern <dsahern@gmail.com> Acked-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2020-06-03 08:21:37 +02:00
Nikolay Aleksandrov	88e81db550	nexthops: don't modify published nexthop groups ... commit 90f33bffa382598a32cc82abfeb20adc92d041b6 upstream. We must avoid modifying published nexthop groups while they might be in use, otherwise we might see NULL ptr dereferences. In order to do that we allocate 2 nexthoup group structures upon nexthop creation and swap between them when we have to delete an entry. The reason is that we can't fail nexthop group removal, so we can't handle allocation failure thus we move the extra allocation on creation where we can safely fail and return ENOMEM. Fixes: 430a049190 ("nexthop: Add support for nexthop groups") Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com> Signed-off-by: David Ahern <dsahern@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2020-06-03 08:21:37 +02:00
Vinay Kumar Yadav	cf4cc95a15	net/tls: fix race condition causing kernel panic ... [ Upstream commit 0cada33241d9de205522e3858b18e506ca5cce2c ] tls_sw_recvmsg() and tls_decrypt_done() can be run concurrently. // tls_sw_recvmsg() if (atomic_read(&ctx->decrypt_pending)) crypto_wait_req(-EINPROGRESS, &ctx->async_wait); else reinit_completion(&ctx->async_wait.completion); //tls_decrypt_done() pending = atomic_dec_return(&ctx->decrypt_pending); if (!pending && READ_ONCE(ctx->async_notify)) complete(&ctx->async_wait.completion); Consider the scenario tls_decrypt_done() is about to run complete() if (!pending && READ_ONCE(ctx->async_notify)) and tls_sw_recvmsg() reads decrypt_pending == 0, does reinit_completion(), then tls_decrypt_done() runs complete(). This sequence of execution results in wrong completion. Consequently, for next decrypt request, it will not wait for completion, eventually on connection close, crypto resources freed, there is no way to handle pending decrypt response. This race condition can be avoided by having atomic_read() mutually exclusive with atomic_dec_return(),complete().Intoduced spin lock to ensure the mutual exclution. Addressed similar problem in tx direction. v1->v2: - More readable commit message. - Corrected the lock to fix new race scenario. - Removed barrier which is not needed now. Fixes: a42055e8d2 ("net/tls: Add support for async encryption of records for performance") Signed-off-by: Vinay Kumar Yadav <vinay.yadav@chelsio.com> Reviewed-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2020-06-03 08:21:01 +02:00
Roman Mashak	587e13469c	net sched: fix reporting the first-time use timestamp ... [ Upstream commit b15e62631c5f19fea9895f7632dae9c1b27fe0cd ] When a new action is installed, firstuse field of 'tcf_t' is explicitly set to 0. Value of zero means "new action, not yet used"; as a packet hits the action, 'firstuse' is stamped with the current jiffies value. tcf_tm_dump() should return 0 for firstuse if action has not yet been hit. Fixes: 48d8ee1694 ("net sched actions: aggregate dumping of actions timeinfo") Cc: Jamal Hadi Salim <jhs@mojatatu.com> Signed-off-by: Roman Mashak <mrv@mojatatu.com> Acked-by: Jamal Hadi Salim <jhs@mojatatu.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2020-06-03 08:21:01 +02:00
Sabrina Dubroca	b853a13bb2	net: don't return invalid table id error when we fall back to PF_UNSPEC ... [ Upstream commit 41b4bd986f86331efc599b9a3f5fb86ad92e9af9 ] In case we can't find a ->dumpit callback for the requested (family,type) pair, we fall back to (PF_UNSPEC,type). In effect, we're in the same situation as if userspace had requested a PF_UNSPEC dump. For RTM_GETROUTE, that handler is rtnl_dump_all, which calls all the registered RTM_GETROUTE handlers. The requested table id may or may not exist for all of those families. commit ae677bbb44 ("net: Don't return invalid table id error when dumping all families") fixed the problem when userspace explicitly requests a PF_UNSPEC dump, but missed the fallback case. For example, when we pass ipv6.disable=1 to a kernel with CONFIG_IP_MROUTE=y and CONFIG_IP_MROUTE_MULTIPLE_TABLES=y, the (PF_INET6, RTM_GETROUTE) handler isn't registered, so we end up in rtnl_dump_all, and listing IPv6 routes will unexpectedly print: # ip -6 r Error: ipv4: MR table does not exist. Dump terminated commit ae677bbb44 introduced the dump_all_families variable, which gets set when userspace requests a PF_UNSPEC dump. However, we can't simply set the family to PF_UNSPEC in rtnetlink_rcv_msg in the fallback case to get dump_all_families == true, because some messages types (for example RTM_GETRULE and RTM_GETNEIGH) only register the PF_UNSPEC handler and use the family to filter in the kernel what is dumped to userspace. We would then export more entries, that userspace would have to filter. iproute does that, but other programs may not. Instead, this patch removes dump_all_families and updates the RTM_GETROUTE handlers to check if the family that is being dumped is their own. When it's not, which covers both the intentional PF_UNSPEC dumps (as dump_all_families did) and the fallback case, ignore the missing table id error. Fixes: cb167893f4 ("net: Plumb support for filtering ipv4 and ipv6 multicast route dumps") Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Reviewed-by: David Ahern <dsahern@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2020-06-03 08:20:41 +02:00
Greg Kroah-Hartman	f7b4f375c7	This is the 5.4.43 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl7Oi20ACgkQONu9yGCS aT4ipBAA1Kqh2mLEcDBISubrU4CuOl/iHmkCXyF1FeF9+vJKz25whbfYO/FNYweP 2HYxGyuqLTQ0OnsfrXeEoImlxdAcWp3TjAFPgJdonLBvnVDmvlPe6Pzk1NRPhvce zU/Y1leE+LoQ7xDfICPJ9BwuwwYTRzRqMQHmIuVlsHLSiN+rextPj6vkzD+7h4ux i9VKoDvzmWuLrHmc9RYNoGxuZ5tGogBaCxI8tnzHGcm21bNVvsKZiANQ2J+6G2bJ sJwqq5tH2gZ6cJxmJ1tVyMbXLIJanNKLeBC5sDQN4rss9pU4gtyEARqVG+9RlglQ FeSlBuoaISJYYejo6aSH7nw81bTQrXexd0sH94qYqnqPlZo+OXN8vxHTaIapYEfd fjqyEblZXqpnMNVQcZOxbrYaefuIrZ9Q8pWUFTwVj34P8RNJLBIvg5gy2dlRvHbC PGLJewOXySZaXVpD5gFU349L32d4QPw9MmMU5php+LOl4idN8RlVY0pOaUuO0idH ewO+6vijLgHq/5HBO6BBToRlNUvLauoUeAaQwoHfPiuuYnGGFCZ9GEjPRsHnCBok IAKQ2Uj+IqlMy7gKVtG1ryekil7TVktrZQ1JBokRLWQPZiED84r7P1lQqPaH/4f4 GFFRhx3tekJs4LMMUEaUR019Q9ZcQMWkikT1/HpVOYUjQd55pc4= =jmiq -----END PGP SIGNATURE----- Merge 5.4.43 into android-5.4-stable Changes in 5.4.43 i2c: dev: Fix the race between the release of i2c_dev and cdev KVM: SVM: Fix potential memory leak in svm_cpu_init() ima: Set file->f_mode instead of file->f_flags in ima_calc_file_hash() evm: Check also if *tfm is an error pointer in init_desc() ima: Fix return value of ima_write_policy() ubifs: fix wrong use of crypto_shash_descsize() ACPI: EC: PM: Avoid flushing EC work when EC GPE is inactive mtd: spinand: Propagate ECC information to the MTD structure fix multiplication overflow in copy_fdtable() ubifs: remove broken lazytime support i2c: fix missing pm_runtime_put_sync in i2c_device_probe iommu/amd: Fix over-read of ACPI UID from IVRS table evm: Fix a small race in init_desc() i2c: mux: demux-pinctrl: Fix an error handling path in 'i2c_demux_pinctrl_probe()' ubi: Fix seq_file usage in detailed_erase_block_info debugfs file afs: Don't unlock fetched data pages until the op completes successfully mtd: Fix mtd not registered due to nvmem name collision kbuild: avoid concurrency issue in parallel building dtbs and dtbs_check net: drop_monitor: use IS_REACHABLE() to guard net_dm_hw_report() gcc-common.h: Update for GCC 10 HID: multitouch: add eGalaxTouch P80H84 support HID: alps: Add AUI1657 device ID HID: alps: ALPS_1657 is too specific; use U1_UNICORN_LEGACY instead scsi: qla2xxx: Fix hang when issuing nvme disconnect-all in NPIV scsi: qla2xxx: Delete all sessions before unregister local nvme port configfs: fix config_item refcnt leak in configfs_rmdir() vhost/vsock: fix packet delivery order to monitoring devices aquantia: Fix the media type of AQC100 ethernet controller in the driver component: Silence bind error on -EPROBE_DEFER net/ena: Fix build warning in ena_xdp_set() scsi: ibmvscsi: Fix WARN_ON during event pool release HID: i2c-hid: reset Synaptics SYNA2393 on resume x86/mm/cpa: Flush direct map alias during cpa ibmvnic: Skip fatal error reset after passive init ftrace/selftest: make unresolved cases cause failure if --fail-unresolved set x86/apic: Move TSC deadline timer debug printk gtp: set NLM_F_MULTI flag in gtp_genl_dump_pdp() HID: quirks: Add HID_QUIRK_NO_INIT_REPORTS quirk for Dell K12A keyboard-dock ceph: fix double unlock in handle_cap_export() stmmac: fix pointer check after utilization in stmmac_interrupt USB: core: Fix misleading driver bug report platform/x86: asus-nb-wmi: Do not load on Asus T100TA and T200TA iommu/amd: Call domain_flush_complete() in update_domain() drm/amd/display: Prevent dpcd reads with passive dongles KVM: selftests: Fix build for evmcs.h ARM: futex: Address build warning scripts/gdb: repair rb_first() and rb_last() ALSA: hda - constify and cleanup static NodeID tables ALSA: hda: patch_realtek: fix empty macro usage in if block ALSA: hda: Manage concurrent reg access more properly ALSA: hda/realtek - Add supported new mute Led for HP ALSA: hda/realtek - Add HP new mute led supported for ALC236 ALSA: hda/realtek: Add quirk for Samsung Notebook ALSA: hda/realtek - Enable headset mic of ASUS GL503VM with ALC295 ALSA: hda/realtek - Enable headset mic of ASUS UX550GE with ALC295 ALSA: hda/realtek: Enable headset mic of ASUS UX581LV with ALC295 KVM: x86: Fix pkru save/restore when guest CR4.PKE=0, move it to x86.c ALSA: iec1712: Initialize STDSP24 properly when using the model=staudio option ALSA: pcm: fix incorrect hw_base increase ALSA: hda/realtek - Fix silent output on Gigabyte X570 Aorus Xtreme ALSA: hda/realtek - Add more fixup entries for Clevo machines scsi: qla2xxx: Do not log message when reading port speed via sysfs scsi: target: Put lun_ref at end of tmr processing arm64: Fix PTRACE_SYSEMU semantics drm/etnaviv: fix perfmon domain interation apparmor: Fix use-after-free in aa_audit_rule_init apparmor: fix potential label refcnt leak in aa_change_profile apparmor: Fix aa_label refcnt leak in policy_update dmaengine: tegra210-adma: Fix an error handling path in 'tegra_adma_probe()' drm/etnaviv: Fix a leak in submit_pin_objects() dmaengine: dmatest: Restore default for channel dmaengine: owl: Use correct lock in owl_dma_get_pchan() vsprintf: don't obfuscate NULL and error pointers drm/i915/gvt: Init DPLL/DDI vreg for virtual display instead of inheritance. drm/i915: Propagate error from completed fences powerpc: Remove STRICT_KERNEL_RWX incompatibility with RELOCATABLE powerpc/64s: Disable STRICT_KERNEL_RWX bpf: Avoid setting bpf insns pages read-only when prog is jited kbuild: Remove debug info from kallsyms linking Revert "gfs2: Don't demote a glock until its revokes are written" media: fdp1: Fix R-Car M3-N naming in debug message staging: iio: ad2s1210: Fix SPI reading staging: kpc2000: fix error return code in kp2000_pcie_probe() staging: greybus: Fix uninitialized scalar variable iio: sca3000: Remove an erroneous 'get_device()' iio: dac: vf610: Fix an error handling path in 'vf610_dac_probe()' iio: adc: ti-ads8344: Fix channel selection misc: rtsx: Add short delay after exit from ASPM tty: serial: add missing spin_lock_init for SiFive serial console mei: release me_cl object reference ipack: tpci200: fix error return code in tpci200_register() s390/pci: Fix s390_mmio_read/write with MIO s390/kaslr: add support for R_390_JMP_SLOT relocation type device-dax: don't leak kernel memory to user space after unloading kmem rapidio: fix an error in get_user_pages_fast() error handling kasan: disable branch tracing for core runtime rxrpc: Fix the excessive initial retransmission timeout rxrpc: Fix a memory leak in rxkad_verify_response() s390/kexec_file: fix initrd location for kdump kernel flow_dissector: Drop BPF flow dissector prog ref on netns cleanup x86/unwind/orc: Fix unwind_get_return_address_ptr() for inactive tasks iio: adc: stm32-adc: Use dma_request_chan() instead dma_request_slave_channel() iio: adc: stm32-adc: fix device used to request dma iio: adc: stm32-dfsdm: Use dma_request_chan() instead dma_request_slave_channel() iio: adc: stm32-dfsdm: fix device used to request dma rxrpc: Trace discarded ACKs rxrpc: Fix ack discard tpm: check event log version before reading final events sched/fair: Reorder enqueue/dequeue_task_fair path sched/fair: Fix reordering of enqueue/dequeue_task_fair() sched/fair: Fix enqueue_task_fair() warning some more Linux 5.4.43 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I1582df67569f34c4455c482ed0eaf10fc1a34e03	2020-05-28 12:26:15 +02:00
David Howells	23ae6e3e8a	rxrpc: Fix the excessive initial retransmission timeout ... commit c410bf01933e5e09d142c66c3df9ad470a7eec13 upstream. rxrpc currently uses a fixed 4s retransmission timeout until the RTT is sufficiently sampled. This can cause problems with some fileservers with calls to the cache manager in the afs filesystem being dropped from the fileserver because a packet goes missing and the retransmission timeout is greater than the call expiry timeout. Fix this by: (1) Copying the RTT/RTO calculation code from Linux's TCP implementation and altering it to fit rxrpc. (2) Altering the various users of the RTT to make use of the new SRTT value. (3) Replacing the use of rxrpc_resend_timeout to use the calculated RTO value instead (which is needed in jiffies), along with a backoff. Notes: (1) rxrpc provides RTT samples by matching the serial numbers on outgoing DATA packets that have the RXRPC_REQUEST_ACK set and PING ACK packets against the reference serial number in incoming REQUESTED ACK and PING-RESPONSE ACK packets. (2) Each packet that is transmitted on an rxrpc connection gets a new per-connection serial number, even for retransmissions, so an ACK can be cross-referenced to a specific trigger packet. This allows RTT information to be drawn from retransmitted DATA packets also. (3) rxrpc maintains the RTT/RTO state on the rxrpc_peer record rather than on an rxrpc_call because many RPC calls won't live long enough to generate more than one sample. (4) The calculated SRTT value is in units of 8ths of a microsecond rather than nanoseconds. The (S)RTT and RTO values are displayed in /proc/net/rxrpc/peers. Fixes: 17926a7932 ([AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both"") Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2020-05-27 17:46:48 +02:00
Masahiro Yamada	3c140d22e3	net: drop_monitor: use IS_REACHABLE() to guard net_dm_hw_report() ... [ Upstream commit 1cd9b3abf5332102d4d967555e7ed861a75094bf ] In net/Kconfig, NET_DEVLINK implies NET_DROP_MONITOR. The original behavior of the 'imply' keyword prevents NET_DROP_MONITOR from being 'm' when NET_DEVLINK=y. With the planned Kconfig change that relaxes the 'imply', the combination of NET_DEVLINK=y and NET_DROP_MONITOR=m would be allowed. Use IS_REACHABLE() to avoid the vmlinux link error for this case. Reported-by: Stephen Rothwell <sfr@canb.auug.org.au> Signed-off-by: Masahiro Yamada <masahiroy@kernel.org> Acked-by: Neil Horman <nhorman@tuxdriver.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2020-05-27 17:46:24 +02:00
Greg Kroah-Hartman	a93d8ad9ba	This is the 5.4.42 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl7EzDkACgkQONu9yGCS aT6E0Q//dzSQiIdz+a06TLKzcXyxzY+FIIy/OVZAYSGxeM3Kt6GDUzUWnlAPOSbo 9UVcQdHllNKuJXXBOTkjEmFLEdJ+AFaJ2M7tjh5PKd7Y1am5xY2t7w4z5ohFaJto lPxakRXXPh4Yrf8n+ANyR9Dz69uLC+qfHi2wbQ6v8ly07Fgr034X7Pl+BMewNYM8 QCcsS2a7+qmsvRGTheWhiFTZhEbHzEK5GB4EWIaYTEEsrTet1htwvtRLZ7TEvAma 2jnapJBQBGkxxMoo9D1GAzA9MI7p7XqUvCmRpMtXiMaPUhFmOgHYtGZ4x3Iu/TmK dIeWOZjyHlosIHtbf7m2hrNPedaErjnZCM97gjOi9TjupndBveikYuynnbLthfbZ 1mrrXHJew/FjILFE1GL1zVI6LMsFRUyWA7H3R8xQkBUXBKhoIzGl4263bugSO2Hk Gvn+cSTUBvou15yZPEm0WFqUiM0kBO3A1x9YcF9yKYuzGtpGF5GEQlriNCLLvfWf kihgOM4yIaFFYVL+CCbN6uHBVFhfI+Ts9/7PzLgoGtwshw9EK2Gn/FBn2NJetC1Q 1wHlNlavLoYvI9RZ0kCuD/jcVxG2hvOjvo/RCYg+ETujjhkhWwcWZxhZQsG1Kel3 a2/DMrx52RnhNMVDGecgRGKIADtqI4x6XZzk0gvgDG1ib3u77Ng= =dmPo -----END PGP SIGNATURE----- Merge 5.4.42 into android-5.4-stable Changes in 5.4.42 net: dsa: Do not make user port errors fatal shmem: fix possible deadlocks on shmlock_user_lock net: phy: microchip_t1: add lan87xx_phy_init to initialize the lan87xx phy. KVM: arm: vgic: Synchronize the whole guest on GIC{D,R}_I{S,C}ACTIVER read gpio: pca953x: Fix pca953x_gpio_set_config SUNRPC: Add "@len" parameter to gss_unwrap() SUNRPC: Fix GSS privacy computation of auth->au_ralign net/sonic: Fix a resource leak in an error handling path in 'jazz_sonic_probe()' net: moxa: Fix a potential double 'free_irq()' ftrace/selftests: workaround cgroup RT scheduling issues drop_monitor: work around gcc-10 stringop-overflow warning virtio-blk: handle block_device_operations callbacks after hot unplug sun6i: dsi: fix gcc-4.8 net_sched: fix tcm_parent in tc filter dump scsi: sg: add sg_remove_request in sg_write selftests/bpf: fix goto cleanup label not defined mmc: sdhci-acpi: Add SDHCI_QUIRK2_BROKEN_64_BIT_DMA for AMDI0040 dpaa2-eth: properly handle buffer size restrictions net: fix a potential recursive NETDEV_FEAT_CHANGE netlabel: cope with NULL catmap net: phy: fix aneg restart in phy_ethtool_set_eee net: stmmac: fix num_por initialization pppoe: only process PADT targeted at local interfaces Revert "ipv6: add mtu lock check in __ip6_rt_update_pmtu" tcp: fix error recovery in tcp_zerocopy_receive() tcp: fix SO_RCVLOWAT hangs with fat skbs virtio_net: fix lockdep warning on 32 bit dpaa2-eth: prevent array underflow in update_cls_rule() hinic: fix a bug of ndo_stop net: dsa: loop: Add module soft dependency net: ipv4: really enforce backoff for redirects netprio_cgroup: Fix unlimited memory leak of v2 cgroups net: tcp: fix rx timestamp behavior for tcp_recvmsg nfp: abm: fix error return code in nfp_abm_vnic_alloc() r8169: re-establish support for RTL8401 chip version umh: fix memory leak on execve failure riscv: fix vdso build with lld dmaengine: pch_dma.c: Avoid data race between probe and irq handler dmaengine: mmp_tdma: Do not ignore slave config validation errors dmaengine: mmp_tdma: Reset channel error on release selftests/ftrace: Check the first record for kprobe_args_type.tc cpufreq: intel_pstate: Only mention the BIOS disabling turbo mode once ALSA: hda/hdmi: fix race in monitor detection during probe drm/amd/powerplay: avoid using pm_en before it is initialized revised drm/amd/display: check if REFCLK_CNTL register is present drm/amd/display: Update downspread percent to match spreadsheet for DCN2.1 drm/qxl: lost qxl_bo_kunmap_atomic_page in qxl_image_init_helper() drm/amdgpu: simplify padding calculations (v2) drm/amdgpu: invalidate L2 before SDMA IBs (v2) ipc/util.c: sysvipc_find_ipc() incorrectly updates position index ALSA: hda/realtek - Fix S3 pop noise on Dell Wyse gfs2: Another gfs2_walk_metadata fix mmc: sdhci-pci-gli: Fix no irq handler from suspend IB/hfi1: Fix another case where pq is left on waitlist ACPI: EC: PM: Avoid premature returns from acpi_s2idle_wake() pinctrl: sunrisepoint: Fix PAD lock register offset for SPT-H pinctrl: baytrail: Enable pin configuration setting for GPIO chip pinctrl: qcom: fix wrong write in update_dual_edge pinctrl: cherryview: Add missing spinlock usage in chv_gpio_irq_handler bpf: Fix error return code in map_lookup_and_delete_elem() ALSA: firewire-lib: fix 'function sizeof not defined' error of tracepoints format i40iw: Fix error handling in i40iw_manage_arp_cache() drm/i915: Don't enable WaIncreaseLatencyIPCEnabled when IPC is disabled bpf, sockmap: msg_pop_data can incorrecty set an sge length bpf, sockmap: bpf_tcp_ingress needs to subtract bytes from sg.size mmc: alcor: Fix a resource leak in the error path for ->probe() mmc: sdhci-pci-gli: Fix can not access GL9750 after reboot from Windows 10 mmc: core: Check request type before completing the request mmc: core: Fix recursive locking issue in CQE recovery path mmc: block: Fix request completion in the CQE timeout path gfs2: More gfs2_find_jhead fixes fork: prevent accidental access to clone3 features drm/amdgpu: force fbdev into vram NFS: Fix fscache super_cookie index_key from changing after umount nfs: fscache: use timespec64 in inode auxdata NFSv4: Fix fscache cookie aux_data to ensure change_attr is included netfilter: conntrack: avoid gcc-10 zero-length-bounds warning drm/i915/gvt: Fix kernel oops for 3-level ppgtt guest arm64: fix the flush_icache_range arguments in machine_kexec nfs: fix NULL deference in nfs4_get_valid_delegation SUNRPC: Signalled ASYNC tasks need to exit netfilter: nft_set_rbtree: Introduce and use nft_rbtree_interval_start() netfilter: nft_set_rbtree: Add missing expired checks RDMA/rxe: Always return ERR_PTR from rxe_create_mmap_info() IB/mlx4: Test return value of calls to ib_get_cached_pkey IB/core: Fix potential NULL pointer dereference in pkey cache RDMA/core: Fix double put of resource RDMA/iw_cxgb4: Fix incorrect function parameters hwmon: (da9052) Synchronize access with mfd s390/ism: fix error return code in ism_probe() mm, memcg: fix inconsistent oom event behavior NFSv3: fix rpc receive buffer size for MOUNT call pnp: Use list_for_each_entry() instead of open coding net/rds: Use ERR_PTR for rds_message_alloc_sgs() Stop the ad-hoc games with -Wno-maybe-initialized gcc-10: disable 'zero-length-bounds' warning for now gcc-10: disable 'array-bounds' warning for now gcc-10: disable 'stringop-overflow' warning for now gcc-10: disable 'restrict' warning for now gcc-10 warnings: fix low-hanging fruit gcc-10: mark more functions __init to avoid section mismatch warnings gcc-10: avoid shadowing standard library 'free()' in crypto usb: usbfs: correct kernel->user page attribute mismatch USB: usbfs: fix mmap dma mismatch ALSA: hda/realtek - Limit int mic boost for Thinkpad T530 ALSA: hda/realtek - Add COEF workaround for ASUS ZenBook UX431DA ALSA: rawmidi: Fix racy buffer resize under concurrent accesses ALSA: usb-audio: Add control message quirk delay for Kingston HyperX headset usb: core: hub: limit HUB_QUIRK_DISABLE_AUTOSUSPEND to USB5534B usb: host: xhci-plat: keep runtime active when removing host usb: cdns3: gadget: prev_req->trb is NULL for ep0 USB: gadget: fix illegal array access in binding with UDC usb: xhci: Fix NULL pointer dereference when enqueuing trbs from urb sg list Make the "Reducing compressed framebufer size" message be DRM_INFO_ONCE() ARM: dts: dra7: Fix bus_dma_limit for PCIe ARM: dts: imx27-phytec-phycard-s-rdk: Fix the I2C1 pinctrl entries ARM: dts: imx6dl-yapp4: Fix Ursa board Ethernet connection drm/amd/display: add basic atomic check for cursor plane powerpc/32s: Fix build failure with CONFIG_PPC_KUAP_DEBUG cifs: fix leaked reference on requeued write x86: Fix early boot crash on gcc-10, third try x86/unwind/orc: Fix error handling in __unwind_start() exec: Move would_dump into flush_old_exec clk: rockchip: fix incorrect configuration of rk3228 aclk_gpu* clocks dwc3: Remove check for HWO flag in dwc3_gadget_ep_reclaim_trb_sg() fanotify: fix merging marks masks with FAN_ONDIR usb: gadget: net2272: Fix a memory leak in an error handling path in 'net2272_plat_probe()' usb: gadget: audio: Fix a missing error return value in audio_bind() usb: gadget: legacy: fix error return code in gncm_bind() usb: gadget: legacy: fix error return code in cdc_bind() Revert "ALSA: hda/realtek: Fix pop noise on ALC225" clk: Unlink clock if failed to prepare or enable arm64: dts: meson-g12b-khadas-vim3: add missing frddr_a status property arm64: dts: meson-g12-common: fix dwc2 clock names arm64: dts: rockchip: Replace RK805 PMIC node name with "pmic" on rk3328 boards arm64: dts: rockchip: Rename dwc3 device nodes on rk3399 to make dtc happy arm64: dts: imx8mn: Change SDMA1 ahb clock for imx8mn ARM: dts: r8a73a4: Add missing CMT1 interrupts arm64: dts: renesas: r8a77980: Fix IPMMU VIP[01] nodes ARM: dts: r8a7740: Add missing extal2 to CPG node SUNRPC: Revert 241b1f419f ("SUNRPC: Remove xdr_buf_trim()") bpf: Fix sk_psock refcnt leak when receiving message KVM: x86: Fix off-by-one error in kvm_vcpu_ioctl_x86_setup_mce Makefile: disallow data races on gcc-10 as well libbpf: Extract and generalize CPU mask parsing logic selftest/bpf: fix backported test_select_reuseport selftest changes bpf: Test_progs, fix test_get_stack_rawtp_err.c build Linux 5.4.42 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I15318d0b2611dec3962b1db1cbca8ae5dea2ff60	2020-05-20 12:49:59 +02:00
Arnd Bergmann	a308d6e686	netfilter: conntrack: avoid gcc-10 zero-length-bounds warning ... [ Upstream commit 2c407aca64977ede9b9f35158e919773cae2082f ] gcc-10 warns around a suspicious access to an empty struct member: net/netfilter/nf_conntrack_core.c: In function '__nf_conntrack_alloc': net/netfilter/nf_conntrack_core.c:1522:9: warning: array subscript 0 is outside the bounds of an interior zero-length array 'u8[0]' {aka 'unsigned char[0]'} [-Wzero-length-bounds] 1522 | memset(&ct->__nfct_init_offset[0], 0, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from net/netfilter/nf_conntrack_core.c:37: include/net/netfilter/nf_conntrack.h:90:5: note: while referencing '__nfct_init_offset' 90 | u8 __nfct_init_offset[0]; | ^~~~~~~~~~~~~~~~~~ The code is correct but a bit unusual. Rework it slightly in a way that does not trigger the warning, using an empty struct instead of an empty array. There are probably more elegant ways to do this, but this is the smallest change. Fixes: c41884ce05 ("netfilter: conntrack: avoid zeroing timer") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2020-05-20 08:20:23 +02:00
Eric Dumazet	23300d6a39	tcp: fix SO_RCVLOWAT hangs with fat skbs ... [ Upstream commit 24adbc1676af4e134e709ddc7f34cf2adc2131e4 ] We autotune rcvbuf whenever SO_RCVLOWAT is set to account for 100% overhead in tcp_set_rcvlowat() This works well when skb->len/skb->truesize ratio is bigger than 0.5 But if we receive packets with small MSS, we can end up in a situation where not enough bytes are available in the receive queue to satisfy RCVLOWAT setting. As our sk_rcvbuf limit is hit, we send zero windows in ACK packets, preventing remote peer from sending more data. Even autotuning does not help, because it only triggers at the time user process drains the queue. If no EPOLLIN is generated, this can not happen. Note poll() has a similar issue, after commit c7004482e8 ("tcp: Respect SO_RCVLOWAT in tcp_poll().") Fixes: 03f45c883c ("tcp: avoid extra wakeups for SO_RCVLOWAT users") Signed-off-by: Eric Dumazet <edumazet@google.com> Acked-by: Soheil Hassas Yeganeh <soheil@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2020-05-20 08:20:10 +02:00
Cong Wang	7d8da6d7d9	net_sched: fix tcm_parent in tc filter dump ... [ Upstream commit a7df4870d79b00742da6cc93ca2f336a71db77f7 ] When we tell kernel to dump filters from root (ffff:ffff), those filters on ingress (ffff:0000) are matched, but their true parents must be dumped as they are. However, kernel dumps just whatever we tell it, that is either ffff:ffff or ffff:0000: $ nl-cls-list --dev=dummy0 --parent=root cls basic dev dummy0 id none parent root prio 49152 protocol ip match-all cls basic dev dummy0 id :1 parent root prio 49152 protocol ip match-all $ nl-cls-list --dev=dummy0 --parent=ffff: cls basic dev dummy0 id none parent ffff: prio 49152 protocol ip match-all cls basic dev dummy0 id :1 parent ffff: prio 49152 protocol ip match-all This is confusing and misleading, more importantly this is a regression since 4.15, so the old behavior must be restored. And, when tc filters are installed on a tc class, the parent should be the classid, rather than the qdisc handle. Commit edf6711c98 ("net: sched: remove classid and q fields from tcf_proto") removed the classid we save for filters, we can just restore this classid in tcf_block. Steps to reproduce this: ip li set dev dummy0 up tc qd add dev dummy0 ingress tc filter add dev dummy0 parent ffff: protocol arp basic action pass tc filter show dev dummy0 root Before this patch: filter protocol arp pref 49152 basic filter protocol arp pref 49152 basic handle 0x1 action order 1: gact action pass random type none pass val 0 index 1 ref 1 bind 1 After this patch: filter parent ffff: protocol arp pref 49152 basic filter parent ffff: protocol arp pref 49152 basic handle 0x1 action order 1: gact action pass random type none pass val 0 index 1 ref 1 bind 1 Fixes: a10fa20101 ("net: sched: propagate q and parent from caller down to tcf_fill_node") Fixes: edf6711c98 ("net: sched: remove classid and q fields from tcf_proto") Cc: Jamal Hadi Salim <jhs@mojatatu.com> Cc: Jiri Pirko <jiri@resnulli.us> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Acked-by: Jamal Hadi Salim <jhs@mojatatu.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>	2020-05-20 08:20:07 +02:00
Greg Kroah-Hartman	5e169f689f	This is the 5.4.41 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl683gYACgkQONu9yGCS aT4UrQ/+OWH+sgNXQW2TtBAtDt+b6WCPCwsAe74YdsbqzVf/mxVGVpHKvFJCEXxA KDRrBqdICgrjZ+L8Y2MPzNhyD2/nLHwB8M99ARx4B6mvOu4pT0+/xATViGmotqDN tzpQ3HvnFLlR/z74/xDanXgXrTAv591hpSQlpUmf6NCiBZNlhndId4qnh/z8Eumn wVLseK1r2CY3s3mMZTw6BXmHmj6zGA70Ckuvhp9JmxiKs9fg+pmDlUaRPHex91Xh LtSJd7CdpVr5YrMIC9DcQ2TN46KsZZkoo+l/W8jVNVG3ggqWUrHn7wGamwTHafd1 TkoU7eQt9ps15p7Sj4Z19de30Y1m/g+Qq7L4NrgGcX8bhnCHdgfdbAj40GINOaB2 WLHRVu3PgEUCbLCSixE5BRLmBTECjWapIiW50fp/jogGmeRiBbJFFnWbVtiEwyme KU7ZJRw/sfKNzIN0QioJ/EadK7ZkvIfr/ajinpXdxIA+4gteyKRrNb0323FRG3Ev JoStdR2g+dv+yEJYLmsCl3N0eEETzHK8fRJbp0lkSKjEaxW/yDRpIdhREXmWGd2V Hprcoiyknae0MEIFFnTvA4Oj7wOYezxP0tQg14nOdtXZX5afry5qP/lryE0kYxiV JcI4BrwfWI8hOwdaFd413qp+JG7eKV3RhanhaPimroQJn0WKB9Q= =Ipyc -----END PGP SIGNATURE----- Merge 5.4.41 into android-5.4-stable Changes in 5.4.41 USB: serial: qcserial: Add DW5816e support nvme: refactor nvme_identify_ns_descs error handling nvme: fix possible hang when ns scanning fails during error recovery tracing/kprobes: Fix a double initialization typo net: macb: Fix runtime PM refcounting drm/amdgpu: move kfd suspend after ip_suspend_phase1 drm/amdgpu: drop redundant cg/pg ungate on runpm enter vt: fix unicode console freeing with a common interface tty: xilinx_uartps: Fix missing id assignment to the console devlink: fix return value after hitting end in region read dp83640: reverse arguments to list_add_tail fq_codel: fix TCA_FQ_CODEL_DROP_BATCH_SIZE sanity checks ipv6: Use global sernum for dst validation with nexthop objects mlxsw: spectrum_acl_tcam: Position vchunk in a vregion list properly neigh: send protocol value in neighbor create notification net: dsa: Do not leave DSA master with NULL netdev_ops net: macb: fix an issue about leak related system resources net: macsec: preserve ingress frame ordering net/mlx4_core: Fix use of ENOSPC around mlx4_counter_alloc() net_sched: sch_skbprio: add message validation to skbprio_change() net: stricter validation of untrusted gso packets net: tc35815: Fix phydev supported/advertising mask net/tls: Fix sk_psock refcnt leak in bpf_exec_tx_verdict() net/tls: Fix sk_psock refcnt leak when in tls_data_ready() net: usb: qmi_wwan: add support for DW5816e nfp: abm: fix a memory leak bug sch_choke: avoid potential panic in choke_reset() sch_sfq: validate silly quantum values tipc: fix partial topology connection closure tunnel: Propagate ECT(1) when decapsulating as recommended by RFC6040 bnxt_en: Fix VF anti-spoof filter setup. bnxt_en: Reduce BNXT_MSIX_VEC_MAX value to supported CQs per PF. bnxt_en: Improve AER slot reset. bnxt_en: Return error when allocating zero size context memory. bnxt_en: Fix VLAN acceleration handling in bnxt_fix_features(). net/mlx5: DR, On creation set CQ's arm_db member to right value net/mlx5: Fix forced completion access non initialized command entry net/mlx5: Fix command entry leak in Internal Error State net: mvpp2: prevent buffer overflow in mvpp22_rss_ctx() net: mvpp2: cls: Prevent buffer overflow in mvpp2_ethtool_cls_rule_del() HID: wacom: Read HID_DG_CONTACTMAX directly for non-generic devices sctp: Fix bundling of SHUTDOWN with COOKIE-ACK Revert "HID: wacom: generic: read the number of expected touches on a per collection basis" HID: usbhid: Fix race between usbhid_close() and usbhid_stop() HID: wacom: Report 2nd-gen Intuos Pro S center button status over BT USB: uas: add quirk for LaCie 2Big Quadra usb: chipidea: msm: Ensure proper controller reset using role switch API USB: serial: garmin_gps: add sanity checking for data length tracing: Add a vmalloc_sync_mappings() for safe measure crypto: arch/nhpoly1305 - process in explicit 4k chunks KVM: s390: Remove false WARN_ON_ONCE for the PQAP instruction KVM: VMX: Explicitly clear RFLAGS.CF and RFLAGS.ZF in VM-Exit RSB path KVM: arm: vgic: Fix limit condition when writing to GICD_I[CS]ACTIVER KVM: arm64: Fix 32bit PC wrap-around arm64: hugetlb: avoid potential NULL dereference drm: ingenic-drm: add MODULE_DEVICE_TABLE ipc/mqueue.c: change __do_notify() to bypass check_kill_permission() epoll: atomically remove wait entry on wake up eventpoll: fix missing wakeup for ovflist in ep_poll_callback mm/page_alloc: fix watchdog soft lockups during set_zone_contiguous() mm: limit boost_watermark on small zones ceph: fix endianness bug when handling MDS session feature bits ceph: demote quotarealm lookup warning to a debug message staging: gasket: Check the return value of gasket_get_bar_index() coredump: fix crash when umh is disabled riscv: set max_pfn to the PFN of the last page iocost: protect iocg->abs_vdebt with iocg->waitq.lock batman-adv: fix batadv_nc_random_weight_tq batman-adv: Fix refcnt leak in batadv_show_throughput_override batman-adv: Fix refcnt leak in batadv_store_throughput_override batman-adv: Fix refcnt leak in batadv_v_ogm_process x86/entry/64: Fix unwind hints in register clearing code x86/entry/64: Fix unwind hints in kernel exit path x86/entry/64: Fix unwind hints in rewind_stack_do_exit() x86/unwind/orc: Don't skip the first frame for inactive tasks x86/unwind/orc: Prevent unwinding before ORC initialization x86/unwind/orc: Fix error path for bad ORC entry type x86/unwind/orc: Fix premature unwind stoppage due to IRET frames KVM: x86: Fixes posted interrupt check for IRQs delivery modes arch/x86/kvm/svm/sev.c: change flag passed to GUP fast in sev_pin_memory() netfilter: nat: never update the UDP checksum when it's 0 netfilter: nf_osf: avoid passing pointer to local var objtool: Fix stack offset tracking for indirect CFAs iommu/virtio: Reverse arguments to list_add scripts/decodecode: fix trapping instruction formatting mm, memcg: fix error return value of mem_cgroup_css_alloc() bdi: move bdi_dev_name out of line bdi: add a ->dev_name field to struct backing_dev_info fsnotify: replace inode pointer with an object id fanotify: merge duplicate events on parent and child Linux 5.4.41 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ie6695b1dace8ca62579a57084608e9268e52fde9	2020-05-14 08:55:48 +02:00