Enabling FUSE passthrough for mmap-ed operations not only affects
performance, but has also been shown as mandatory for the correct
functioning of FUSE passthrough.
yanwu noticed [1] that a FUSE file with passthrough enabled may suffer
data inconsistencies if the same file is also accessed with mmap. What
happens is that read/write operations are directly applied to the lower
file system (and its cache), while mmap-ed operations are affecting the
FUSE cache.
Extend the FUSE passthrough implementation to also handle memory-mapped
FUSE file, to both fix the cache inconsistencies and extend the
passthrough performance benefits to mmap-ed operations.
[1] https://lore.kernel.org/lkml/20210119110654.11817-1-wu-yan@tcl.com/
Bug: 168023149
Link: https://lore.kernel.org/lkml/20210125153057.3623715-9-balsini@android.com/
Signed-off-by: Alessio Balsini <balsini@android.com>
Change-Id: Ifad4698b0380f6e004c487940ac6907b9a9f2964
Signed-off-by: Alessio Balsini <balsini@google.com>
When using FUSE passthrough, read/write operations are directly
forwarded to the lower file system file through VFS, but there is no
guarantee that the process that is triggering the request has the right
permissions to access the lower file system. This would cause the
read/write access to fail.
In passthrough file systems, where the FUSE daemon is responsible for
the enforcement of the lower file system access policies, often happens
that the process dealing with the FUSE file system doesn't have access
to the lower file system.
Being the FUSE daemon in charge of implementing the FUSE file
operations, that in the case of read/write operations usually simply
results in the copy of memory buffers from/to the lower file system
respectively, these operations are executed with the FUSE daemon
privileges.
This patch adds a reference to the FUSE daemon credentials, referenced
at FUSE_DEV_IOC_PASSTHROUGH_OPEN ioctl() time so that they can be used
to temporarily raise the user credentials when accessing lower file
system files in passthrough.
The process accessing the FUSE file with passthrough enabled temporarily
receives the privileges of the FUSE daemon while performing read/write
operations. Similar behavior is implemented in overlayfs.
These privileges will be reverted as soon as the IO operation completes.
This feature does not provide any higher security privileges to those
processes accessing the FUSE file system with passthrough enabled. This
is because it is still the FUSE daemon responsible for enabling or not
the passthrough feature at file open time, and should enable the feature
only after appropriate access policy checks.
Bug: 168023149
Link: https://lore.kernel.org/lkml/20210125153057.3623715-8-balsini@android.com/
Signed-off-by: Alessio Balsini <balsini@android.com>
Change-Id: Idb4f03a2ce7c536691e5eaf8fadadfcf002e1677
Signed-off-by: Alessio Balsini <balsini@google.com>
Extend the passthrough feature by handling asynchronous IO both for read
and write operations.
When an AIO request is received, if the request targets a FUSE file with
the passthrough functionality enabled, a new identical AIO request is
created. The new request targets the lower file system file and gets
assigned a special FUSE passthrough AIO completion callback.
When the lower file system AIO request is completed, the FUSE
passthrough AIO completion callback is executed and propagates the
completion signal to the FUSE AIO request by triggering its completion
callback as well.
Bug: 168023149
Link: https://lore.kernel.org/lkml/20210125153057.3623715-7-balsini@android.com/
Signed-off-by: Alessio Balsini <balsini@android.com>
Change-Id: I47671ef36211102da6dd3ee8b2f226d1e6cd9d5c
Signed-off-by: Alessio Balsini <balsini@google.com>
All the read and write operations performed on fuse_files which have the
passthrough feature enabled are forwarded to the associated lower file
system file via VFS.
Sending the request directly to the lower file system avoids the
userspace round-trip that, because of possible context switches and
additional operations might reduce the overall performance, especially
in those cases where caching doesn't help, for example in reads at
random offsets.
Verifying if a fuse_file has a lower file system file associated with
can be done by checking the validity of its passthrough_filp pointer.
This pointer is not NULL only if passthrough has been successfully
enabled via the appropriate ioctl().
When a read/write operation is requested for a FUSE file with
passthrough enabled, a new equivalent VFS request is generated, which
instead targets the lower file system file.
The VFS layer performs additional checks that allow for safer operations
but may cause the operation to fail if the process accessing the FUSE
file system does not have access to the lower file system.
This change only implements synchronous requests in passthrough,
returning an error in the case of asynchronous operations, yet covering
the majority of the use cases.
Bug: 168023149
Link: https://lore.kernel.org/lkml/20210125153057.3623715-6-balsini@android.com/
Signed-off-by: Alessio Balsini <balsini@android.com>
Change-Id: Ifbe6a247fe7338f87d078fde923f0252eeaeb668
Signed-off-by: Alessio Balsini <balsini@google.com>
Implement the FUSE passthrough ioctl that associates the lower
(passthrough) file system file with the fuse_file.
The file descriptor passed to the ioctl by the FUSE daemon is used to
access the relative file pointer, that will be copied to the fuse_file
data structure to consolidate the link between the FUSE and lower file
system.
To enable the passthrough mode, user space triggers the
FUSE_DEV_IOC_PASSTHROUGH_OPEN ioctl and, if the call succeeds, receives
back an identifier that will be used at open/create response time in the
fuse_open_out field to associate the FUSE file to the lower file system
file.
The value returned by the ioctl to user space can be:
- > 0: success, the identifier can be used as part of an open/create
reply.
- <= 0: an error occurred.
The value 0 represents an error to preserve backward compatibility: the
fuse_open_out field that is used to pass the passthrough_fh back to the
kernel uses the same bits that were previously as struct padding, and is
commonly zero-initialized (e.g., in the libfuse implementation).
Removing 0 from the correct values fixes the ambiguity between the case
in which 0 corresponds to a real passthrough_fh, a missing
implementation of FUSE passthrough or a request for a normal FUSE file,
simplifying the user space implementation.
For the passthrough mode to be successfully activated, the lower file
system file must implement both read_iter and write_iter file
operations. This extra check avoids special pseudo files to be targeted
for this feature.
Passthrough comes with another limitation: no further file system
stacking is allowed for those FUSE file systems using passthrough.
Bug: 168023149
Link: https://lore.kernel.org/lkml/20210125153057.3623715-5-balsini@android.com/
Signed-off-by: Alessio Balsini <balsini@android.com>
Change-Id: I4d8290012302fb4547bce9bb261a03cc4f66b5aa
Signed-off-by: Alessio Balsini <balsini@google.com>
Expose the FUSE_PASSTHROUGH interface to user space and declare all the
basic data structures and functions as the skeleton on top of which the
FUSE passthrough functionality will be built.
As part of this, introduce the new FUSE passthrough ioctl, which allows
the FUSE daemon to specify a direct connection between a FUSE file and a
lower file system file. Such ioctl requires user space to pass the file
descriptor of one of its opened files through the fuse_passthrough_out
data structure introduced in this patch. This structure includes extra
fields for possible future extensions.
Also, add the passthrough functions for the set-up and tear-down of the
data structures and locks that will be used both when fuse_conns and
fuse_files are created/deleted.
Bug: 168023149
Link: https://lore.kernel.org/lkml/20210125153057.3623715-4-balsini@android.com/
Signed-off-by: Alessio Balsini <balsini@android.com>
Change-Id: I732532581348adadda5b5048a9346c2b0868d539
Signed-off-by: Alessio Balsini <balsini@google.com>
With a 64-bit kernel build the FUSE device cannot handle ioctl requests
coming from 32-bit user space.
This is due to the ioctl command translation that generates different
command identifiers that thus cannot be used for direct comparisons
without proper manipulation.
Explicitly extract type and number from the ioctl command to enable
32-bit user space compatibility on 64-bit kernel builds.
Bug: 168023149
Link: https://lore.kernel.org/lkml/20210125153057.3623715-3-balsini@android.com/
Signed-off-by: Alessio Balsini <balsini@android.com>
Change-Id: I595517c54d551be70e83c7fcb4b62397a3615004
Signed-off-by: Alessio Balsini <balsini@google.com>
OverlayFS implements its own function to translate iocb flags into rw
flags, so that they can be passed into another vfs call.
With commit ce71bfea207b4 ("fs: align IOCB_* flags with RWF_* flags")
Jens created a 1:1 matching between the iocb flags and rw flags,
simplifying the conversion.
Reduce the OverlayFS code by making the flag conversion function generic
and reusable.
Bug: 168023149
Link: https://lore.kernel.org/lkml/20210125153057.3623715-2-balsini@android.com/
Signed-off-by: Alessio Balsini <balsini@android.com>
Change-Id: I74aefeafd6ebbda2fbabee9024474dfe4cc6c2a7
Signed-off-by: Alessio Balsini <balsini@google.com>
https://source.android.com/docs/security/bulletin/2023-11-01
* tag 'ASB-2023-11-05_11-5.4' of https://android.googlesource.com/kernel/common:
UPSTREAM: netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c
BACKPORT: ravb: Fix use-after-free issue in ravb_tx_timeout_work()
UPSTREAM: ravb: Fix up dma_free_coherent() call in ravb_remove()
UPSTREAM: netfilter: ipset: Fix race between IPSET_CMD_CREATE and IPSET_CMD_SWAP
UPSTREAM: net: xfrm: Fix xfrm_address_filter OOB read
UPSTREAM: igb: set max size RX buffer when store bad packet is enabled
UPSTREAM: netfilter: xt_sctp: validate the flag_info count
UPSTREAM: netfilter: xt_u32: validate user space input
UPSTREAM: netfilter: nfnetlink_osf: avoid OOB read
UPSTREAM: net/sched: Retire rsvp classifier
UPSTREAM: ipv4: fix null-deref in ipv4_link_failure
Change-Id: I26b182a8dd67864a2a4421feb25b878e98478a62
"LA.UM.9.14.r1-23100-LAHAINA.QSSI14.0"
* tag 'LA.UM.9.14.r1-23100-LAHAINA.QSSI14.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/audio-kernel:
Revert "asoc: msm-compress : Fix for CTS-on-gsi with gki"
asoc: msm-compress : Fix for CTS-on-gsi with gki
ASoC: msm-pcm-host-voice: Handle mutex lock-unlock
Change-Id: I84217298ebd04c41daa978fcd3321a3c1bd2670b
"LA.UM.9.14.r1-23100-LAHAINA.QSSI14.0"
* tag 'LA.UM.9.14.r1-23100-LAHAINA.QSSI14.0' of https://git.codelinaro.org/clo/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0:
Release 2.0.8.33V
qcacld-3.0: Do not allow SAP SCC on non-PSC/non-VLP channels
Release 2.0.8.33U
qcacld-3.0: Fix cb mode calculation for 2.4 GHz
qcacld-3.0: Add extended capabilities IE length check
qcacld-3.0: Modify condition to send 6GHz HE caps
qcacld-3.0: Send 6G HE caps to userspace
Release 2.0.8.33T
qcacld-3.0: Allow SAP to move to unsafe channel if ini allows
Release 2.0.8.33S
qcacld-3.0: Fix possible overflow for pcl weight list
Release 2.0.8.33R
qcacld-3.0: Skip FISA aggregation if RDI is zero
Release 2.0.8.33Q
qcacld-3.0: Fix read current country code
Release 2.0.8.33P
qcacld-3.0: Issue disconnect on STA while start/stop SAP
Release 2.0.8.33O
qcacld-3.0: Update VHT Channel width in assoc resp
Release 2.0.8.33N
qcacld-3.0: Fill proper SGI for VHT Rx data packet
Change-Id: Ie2fdb0163d03e7733878579b33929bc027757eca
"LA.UM.9.14.r1-23100-LAHAINA.QSSI14.0"
* tag 'LA.UM.9.14.r1-23100-LAHAINA.QSSI14.0' of https://git.codelinaro.org/clo/la/platform/vendor/qcom-opensource/wlan/qca-wifi-host-cmn:
qcacmn: Consider gindoor_channel_support ini to decide ap_power_type
qcacmn: Fix OOB issue
qcacmn: handle integer underflow in util_gen_new_ie
qcacmn: add new counter to fisa stats
qcacmn: Extract Rx data packet SGI from WMI_VDEV_SMART_MONITOR_EVENTID
Change-Id: Ie9380449beee36ba953010870e7de50ae17cd397
"LA.UM.9.14.r1-23100-LAHAINA.QSSI14.0"
* tag 'LA.UM.9.14.r1-23100-LAHAINA.QSSI14.0' of https://git.codelinaro.org/clo/la/kernel/msm-5.4:
Revert "ALSA: compress: Allow pause and resume during draining"
ALSA: compress: Allow pause and resume during draining
msm: kgsl: Prevent wrap around during user address mapping
msm: kgsl: Limit the syncpoint count for AUX commands
msm: kgsl: Prevent wrap around during user address mapping
Configured process_madvise with upstream syscall number
iommu: Fix missing return check of arm_lpae_init_pte
usb: gadget: cdev: Don't use spinlock with sleeping functions
securemsm-kernel: Fix multiple listener registration on same fd
msm: kgsl: Limit the syncpoint count for AUX commands
net: qrtr: use new update_marker api
char: virtio_eavb: use new update_marker api
usb: kpi: update_marker api for USB suspend resume
Change-Id: Id82b63ff555fbc7101b41a10c1ffbef3762627bd
commit 050d91c03b28ca479df13dfb02bcd2c60dd6a878 upstream.
The missing IP_SET_HASH_WITH_NET0 macro in ip_set_hash_netportnet can
lead to the use of wrong `CIDR_POS(c)` for calculating array offsets,
which can lead to integer underflow. As a result, it leads to slab
out-of-bound access.
This patch adds back the IP_SET_HASH_WITH_NET0 macro to
ip_set_hash_netportnet to address the issue.
Bug: 302199939
Fixes: 886503f34d ("netfilter: ipset: actually allow allowable CIDR 0 in hash:net,port,net")
Suggested-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Kyle Zeng <zengyhkyle@gmail.com>
Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit a9e6142e5f8f6ac7d1bca45c1b2b13b084ea9e14)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I11cc1650e7df9d54041164b6bdb01f3a0de46de4
[ Upstream commit 3971442870713de527684398416970cf025b4f89 ]
The ravb_stop() should call cancel_work_sync(). Otherwise,
ravb_tx_timeout_work() is possible to use the freed priv after
ravb_remove() was called like below:
CPU0 CPU1
ravb_tx_timeout()
ravb_remove()
unregister_netdev()
free_netdev(ndev)
// free priv
ravb_tx_timeout_work()
// use priv
unregister_netdev() will call .ndo_stop() so that ravb_stop() is
called. And, after phy_stop() is called, netif_carrier_off()
is also called. So that .ndo_tx_timeout() will not be called
after phy_stop().
Bug: 289003868
Fixes: c156633f13 ("Renesas Ethernet AVB driver proper")
Reported-by: Zheng Wang <zyytlz.wz@163.com>
Closes: https://lore.kernel.org/netdev/20230725030026.1664873-1-zyytlz.wz@163.com/
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Reviewed-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Link: https://lore.kernel.org/r/20231005011201.14368-3-yoshihiro.shimoda.uh@renesas.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 6f6fa8061f756aedb93af12a8a5d3cf659127965)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I36fcd769d93817adaa04162cae0b54b1addbb9bf
[ Upstream commit e6864af61493113558c502b5cd0d754c19b93277 ]
In ravb_remove(), dma_free_coherent() should be call after
unregister_netdev(). Otherwise, this controller is possible to use
the freed buffer.
Bug: 289003868
Fixes: c156633f13 ("Renesas Ethernet AVB driver proper")
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Reviewed-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Link: https://lore.kernel.org/r/20231005011201.14368-2-yoshihiro.shimoda.uh@renesas.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 3f9295ad7f9478e65debcef496da4e4eb83db5ea)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I8e7da5816f715307c7d8bcd881a2a5ecb52439bb
CONFIG_DRM_MSM_DP is disabled on holi, making this function undefined
and breaking compilation. Like all other inline functions, make this one
return 0.
Change-Id: I1ae0eeab563c3a67fb35d92e8ad2c391458778e6
Newer clang builds complain about old-style function declarations
not having any prototype assigned. The missing `void` is triggering
the Wstrict-prototype warns. Explicitly add the `void` keyword to
satisfy the compiler.
This fixes the following warnings:
drivers/staging/qca-wifi-host-cmn/hif/src/ce/ce_service_legacy.c:
1288:34: error: a function declaration without a prototype is
deprecated in all versions of C [-Werror,-Wstrict-prototypes]
struct ce_ops *ce_services_legacy()
^
void
drivers/staging/qca-wifi-host-cmn/hif/src/ce/ce_service_srng.c:1017:32:
error: a function declaration without a prototype is deprecated in all
versions of C [-Werror,-Wstrict-prototypes]
struct ce_ops *ce_services_srng()
^
void
drivers/staging/qca-wifi-host-cmn/target_if/core/src/target_if_main.c:
88:40: error: a function declaration without a prototype is
deprecated in all versions of C [-Werror,-Wstrict-prototypes]
struct target_if_ctx *target_if_get_ctx()
^
void
drivers/staging/qca-wifi-host-cmn/umac/scan/dispatcher/src/wlan_extscan_api.c:
103:27: error: a function declaration without a prototype is
deprecated in all versions of C [-Werror,-Wstrict-prototypes]
wlan_extscan_global_deinit()
^
void
Change-Id: Ifd95b57d19a25f0932e5de8ec4de2f2c1e7e1259
Signed-off-by: Tashfin Shakeer Rhythm <tashfinshakeerrhythm@gmail.com>
[ Upstream commit 7433b6d2afd512d04398c73aa984d1e285be125b ]
Kyle Zeng reported that there is a race between IPSET_CMD_ADD and IPSET_CMD_SWAP
in netfilter/ip_set, which can lead to the invocation of `__ip_set_put` on a
wrong `set`, triggering the `BUG_ON(set->ref == 0);` check in it.
The race is caused by using the wrong reference counter, i.e. the ref counter instead
of ref_netlink.
Bug: 303172721
Fixes: 24e227896bbf ("netfilter: ipset: Add schedule point in call_ad().")
Reported-by: Kyle Zeng <zengyhkyle@gmail.com>
Closes: https://lore.kernel.org/netfilter-devel/ZPZqetxOmH+w%2Fmyc@westworld/#r
Tested-by: Kyle Zeng <zengyhkyle@gmail.com>
Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit ea5a61d58886ae875f1b4a371999f2a8b58cf26d)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I33a6a6234830c600a4ebd62ed1fee3a48876b98d
commit bb5ed01cd2428cd25b1c88a3a9cba87055eb289f upstream.
Increase the RX buffer size to 3K when the SBP bit is on. The size of
the RX buffer determines the number of pages allocated which may not
be sufficient for receive frames larger than the set MTU size.
Bug: 306483516
Cc: stable@vger.kernel.org
Fixes: 89eaefb61d ("igb: Support RX-ALL feature flag.")
Reported-by: Manfred Rudigier <manfred.rudigier@omicronenergy.com>
Signed-off-by: Radoslaw Tyl <radoslawx.tyl@intel.com>
Tested-by: Arpana Arland <arpanax.arland@intel.com> (A Contingent worker at Intel)
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit be7353af5b35c8f4a11573a38b997f74f8c2ae4b)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I3f05b369cd9ac24643af3e37e2ce1d099c63bc02
commit e99476497687ef9e850748fe6d232264f30bc8f9 upstream.
sctp_mt_check doesn't validate the flag_count field. An attacker can
take advantage of that to trigger a OOB read and leak memory
information.
Add the field validation in the checkentry function.
Bug: 304913898
Fixes: 2e4e6a17af ("[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables")
Cc: stable@vger.kernel.org
Reported-by: Lucas Leong <wmliang@infosec.exchange>
Signed-off-by: Wander Lairson Costa <wander@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 4921f9349b66da7c5a2b6418fe45e9ae0ae72924)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ife4e69f6218fdaca2a8647b5ed00d875a5ed0d34
commit 69c5d284f67089b4750d28ff6ac6f52ec224b330 upstream.
The xt_u32 module doesn't validate the fields in the xt_u32 structure.
An attacker may take advantage of this to trigger an OOB read by setting
the size fields with a value beyond the arrays boundaries.
Add a checkentry function to validate the structure.
This was originally reported by the ZDI project (ZDI-CAN-18408).
Bug: 304913716
Fixes: 1b50b8a371 ("[NETFILTER]: Add u32 match")
Cc: stable@vger.kernel.org
Signed-off-by: Wander Lairson Costa <wander@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 1c164c1e9e93b0a72a03a7edb754e3857d4e4302)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ic2ff70b303f55f9c3c5db24295bcb223ed7175a7
[ Upstream commit f4f8a7803119005e87b716874bec07c751efafec ]
The opt_num field is controlled by user mode and is not currently
validated inside the kernel. An attacker can take advantage of this to
trigger an OOB read and potentially leak information.
BUG: KASAN: slab-out-of-bounds in nf_osf_match_one+0xbed/0xd10 net/netfilter/nfnetlink_osf.c:88
Read of size 2 at addr ffff88804bc64272 by task poc/6431
CPU: 1 PID: 6431 Comm: poc Not tainted 6.0.0-rc4 #1
Call Trace:
nf_osf_match_one+0xbed/0xd10 net/netfilter/nfnetlink_osf.c:88
nf_osf_find+0x186/0x2f0 net/netfilter/nfnetlink_osf.c:281
nft_osf_eval+0x37f/0x590 net/netfilter/nft_osf.c:47
expr_call_ops_eval net/netfilter/nf_tables_core.c:214
nft_do_chain+0x2b0/0x1490 net/netfilter/nf_tables_core.c:264
nft_do_chain_ipv4+0x17c/0x1f0 net/netfilter/nft_chain_filter.c:23
[..]
Also add validation to genre, subtype and version fields.
Bug: 304913642
Fixes: 11eeef41d5 ("netfilter: passive OS fingerprint xtables match")
Reported-by: Lucas Leong <wmliang@infosec.exchange>
Signed-off-by: Wander Lairson Costa <wander@redhat.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 7bb8d52b4271be7527b6e3120ae6ce4c6cdf6e34)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: If79c79e3f55de8c81b70c19661cb0084b02c3da2
commit 265b4da82dbf5df04bee5a5d46b7474b1aaf326a upstream.
The rsvp classifier has served us well for about a quarter of a century but has
has not been getting much maintenance attention due to lack of known users.
Bug: 304913975
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Acked-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Kyle Zeng <zengyhkyle@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 08569c92f7f339de21b7a68d43d6795fc0aa24f2)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I4716954c5e8d5414a580eb34c699908028aa754b
[ Upstream commit 0113d9c9d1ccc07f5a3710dac4aa24b6d711278c ]
Currently, we assume the skb is associated with a device before calling
__ip_options_compile, which is not always the case if it is re-routed by
ipvs.
When skb->dev is NULL, dev_net(skb->dev) will become null-dereference.
This patch adds a check for the edge case and switch to use the net_device
from the rtable when skb->dev is NULL.
Bug: 304913674
Fixes: ed0de45a10 ("ipv4: recompile ip options in ipv4_link_failure")
Suggested-by: David Ahern <dsahern@kernel.org>
Signed-off-by: Kyle Zeng <zengyhkyle@gmail.com>
Cc: Stephen Suryaputra <ssuryaextr@gmail.com>
Cc: Vadim Fedorenko <vfedorenko@novek.ru>
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 2712545e535d7a2e4c53b9c9658a9c88c6055862)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ie840ff3351e487f7095c49fac4fdd1e81021a982
"LA.UM.9.14.r1-22900.01-LAHAINA.QSSI14.0"
* tag 'LA.UM.9.14.r1-22900.01-LAHAINA.QSSI14.0' of https://git.codelinaro.org/clo/la/kernel/msm-5.4:
virt: haven: Correct max_buf_size for a connection
Change-Id: I37f3978594962ec64c921172d190a5b4aa107305
https://source.android.com/docs/security/bulletin/2023-10-01
* tag 'ASB-2023-10-06_11-5.4' of https://android.googlesource.com/kernel/common:
UPSTREAM: arm64: efi: Make efi_rt_lock a raw_spinlock
UPSTREAM: net: sched: sch_qfq: Fix UAF in qfq_dequeue()
UPSTREAM: net/sched: sch_hfsc: Ensure inner classes have fsc curve
UPSTREAM: net/sched: sch_qfq: account for stab overhead in qfq_enqueue
UPSTREAM: netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
UPSTREAM: af_unix: Fix null-ptr-deref in unix_stream_sendpage().
Linux 5.4.254
sch_netem: fix issues in netem_change() vs get_dist_table()
alpha: remove __init annotation from exported page_is_ram()
scsi: core: Fix possible memory leak if device_add() fails
scsi: snic: Fix possible memory leak if device_add() fails
scsi: 53c700: Check that command slot is not NULL
scsi: storvsc: Fix handling of virtual Fibre Channel timeouts
scsi: core: Fix legacy /proc parsing buffer overflow
netfilter: nf_tables: report use refcount overflow
nvme-rdma: fix potential unbalanced freeze & unfreeze
nvme-tcp: fix potential unbalanced freeze & unfreeze
btrfs: set cache_block_group_error if we find an error
btrfs: don't stop integrity writeback too early
ibmvnic: Handle DMA unmapping of login buffs in release functions
net/mlx5: Allow 0 for total host VFs
dmaengine: mcf-edma: Fix a potential un-allocated memory access
wifi: cfg80211: fix sband iftype data lookup for AP_VLAN
IB/hfi1: Fix possible panic during hotplug remove
drivers: net: prevent tun_build_skb() to exceed the packet size limit
dccp: fix data-race around dp->dccps_mss_cache
bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
net/packet: annotate data-races around tp->status
mISDN: Update parameter type of dsp_cmx_send()
selftests/rseq: Fix build with undefined __weak
drm/nouveau/disp: Revert a NULL check inside nouveau_connector_get_modes
x86: Move gds_ucode_mitigated() declaration to header
x86/mm: Fix VDSO and VVAR placement on 5-level paging machines
x86/cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405
usb: common: usb-conn-gpio: Prevent bailing out if initial role is none
usb: dwc3: Properly handle processing of pending events
usb-storage: alauda: Fix uninit-value in alauda_check_media()
binder: fix memory leak in binder_init()
iio: cros_ec: Fix the allocation size for cros_ec_command
nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput
x86/pkeys: Revert a5eff72597 ("x86/pkeys: Add PKRU value to init_fpstate")
radix tree test suite: fix incorrect allocation size for pthreads
drm/nouveau/gr: enable memory loads on helper invocation on all channels
dmaengine: pl330: Return DMA_PAUSED when transaction is paused
ipv6: adjust ndisc_is_useropt() to also return true for PIO
mmc: moxart: read scr register without changing byte order
Linux 5.4.253
Revert "driver core: Annotate dev_err_probe() with __must_check"
drivers: core: fix kernel-doc markup for dev_err_probe()
driver code: print symbolic error code
driver core: Annotate dev_err_probe() with __must_check
ARM: dts: nxp/imx6sll: fix wrong property name in usbphy node
ARM: dts: imx6sll: fixup of operating points
ARM: dts: imx: add usb alias
ARM: dts: imx: Align L2 cache-controller nodename with dtschema
ARM: dts: imx6sll: Make ssi node name same as other platforms
arm64: dts: stratix10: fix incorrect I2C property for SCL signal
ceph: defer stopping mdsc delayed_work
ceph: use kill_anon_super helper
ceph: show tasks waiting on caps in debugfs caps file
PM: sleep: wakeirq: fix wake irq arming
PM / wakeirq: support enabling wake-up irq after runtime_suspend called
selftests/rseq: Play nice with binaries statically linked against glibc 2.35+
selftests/rseq: check if libc rseq support is registered
powerpc/mm/altmap: Fix altmap boundary check
mtd: rawnand: omap_elm: Fix incorrect type in assignment
test_firmware: return ENOMEM instead of ENOSPC on failed memory allocation
test_firmware: prevent race conditions by a correct implementation of locking
ext2: Drop fragment support
fs: Protect reconfiguration of sb read-write from racing writes
net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb
Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb
fs/sysv: Null check to prevent null-ptr-deref bug
net: tap_open(): set sk_uid from current_fsuid()
net: tun_chr_open(): set sk_uid from current_fsuid()
mtd: rawnand: meson: fix OOB available bytes for ECC
mtd: spinand: toshiba: Fix ecc_get_status
USB: zaurus: Add ID for A-300/B-500/C-700
libceph: fix potential hang in ceph_osdc_notify()
scsi: zfcp: Defer fc_rport blocking until after ADISC response
tcp_metrics: fix data-race in tcpm_suck_dst() vs fastopen
tcp_metrics: annotate data-races around tm->tcpm_net
tcp_metrics: annotate data-races around tm->tcpm_vals[]
tcp_metrics: annotate data-races around tm->tcpm_lock
tcp_metrics: annotate data-races around tm->tcpm_stamp
tcp_metrics: fix addr_same() helper
ip6mr: Fix skb_under_panic in ip6mr_cache_report()
net: dcb: choose correct policy to parse DCB_ATTR_BCN
net: ll_temac: fix error checking of irq_of_parse_and_map()
net: ll_temac: Switch to use dev_err_probe() helper
driver core: add device probe log helper
bpf: sockmap: Remove preempt_disable in sock_map_sk_acquire
net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free
net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free
net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free
net: add missing data-race annotation for sk_ll_usec
net: add missing data-race annotations around sk->sk_peek_off
net: add missing READ_ONCE(sk->sk_rcvbuf) annotation
net: add missing READ_ONCE(sk->sk_sndbuf) annotation
net: add missing READ_ONCE(sk->sk_rcvlowat) annotation
net: annotate data-races around sk->sk_max_pacing_rate
mISDN: hfcpci: Fix potential deadlock on &hc->lock
net: sched: cls_u32: Fix match key mis-addressing
perf test uprobe_from_different_cu: Skip if there is no gcc
rtnetlink: let rtnl_bridge_setlink checks IFLA_BRIDGE_MODE length
net/mlx5e: fix return value check in mlx5e_ipsec_remove_trailer()
net/mlx5: DR, fix memory leak in mlx5dr_cmd_create_reformat_ctx
KVM: s390: fix sthyi error handling
word-at-a-time: use the same return type for has_zero regardless of endianness
loop: Select I/O scheduler 'none' from inside add_disk()
perf: Fix function pointer case
arm64: Fix bit-shifting UB in the MIDR_CPU_MODEL() macro
arm64: Add AMPERE1 to the Spectre-BHB affected list
ASoC: cs42l51: fix driver to properly autoload with automatic module loading
net/sched: sch_qfq: account for stab overhead in qfq_enqueue
btrfs: fix race between quota disable and quota assign ioctls
btrfs: qgroup: return ENOTCONN instead of EINVAL when quotas are not enabled
btrfs: qgroup: remove one-time use variables for quota_root checks
cpufreq: intel_pstate: Drop ACPI _PSS states table patching
ACPI: processor: perflib: Avoid updating frequency QoS unnecessarily
ACPI: processor: perflib: Use the "no limit" frequency QoS
dm cache policy smq: ensure IO doesn't prevent cleaner policy progress
ASoC: wm8904: Fill the cache for WM8904_ADC_TEST_0 register
s390/dasd: fix hanging device after quiesce/resume
virtio-net: fix race between set queues and probe
btrfs: check if the transaction was aborted at btrfs_wait_for_commit()
irq-bcm6345-l1: Do not assume a fixed block to cpu mapping
tpm_tis: Explicitly check for error code
btrfs: check for commit error at btrfs_attach_transaction_barrier()
hwmon: (nct7802) Fix for temp6 (PECI1) processed even if PECI1 disabled
staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext()
Documentation: security-bugs.rst: clarify CVE handling
Documentation: security-bugs.rst: update preferences when dealing with the linux-distros group
Revert "usb: xhci: tegra: Fix error check"
usb: xhci-mtk: set the dma max_seg_size
USB: quirks: add quirk for Focusrite Scarlett
usb: ohci-at91: Fix the unhandle interrupt when resume
usb: dwc3: don't reset device side if dwc3 was configured as host-only
usb: dwc3: pci: skip BYT GPIO lookup table for hardwired phy
Revert "usb: dwc3: core: Enable AutoRetry feature in the controller"
can: gs_usb: gs_can_close(): add missing set of CAN state to CAN_STATE_STOPPED
USB: serial: simple: sort driver entries
USB: serial: simple: add Kaufmann RKS+CAN VCP
USB: serial: option: add Quectel EC200A module support
USB: serial: option: support Quectel EM060K_128
serial: sifive: Fix sifive_serial_console_setup() section
serial: 8250_dw: Preserve original value of DLF register
tracing: Fix warning in trace_buffered_event_disable()
ring-buffer: Fix wrong stat of cpu_buffer->read
ata: pata_ns87415: mark ns87560_tf_read static
dm raid: fix missing reconfig_mutex unlock in raid_ctr() error paths
block: Fix a source code comment in include/uapi/linux/blkzoned.h
ASoC: fsl_spdif: Silence output on stop
drm/msm: Fix IS_ERR_OR_NULL() vs NULL check in a5xx_submit_in_rb()
drm/msm/adreno: Fix snapshot BINDLESS_DATA size
drm/msm/dpu: drop enum dpu_core_perf_data_bus_id
RDMA/mlx4: Make check for invalid flags stricter
benet: fix return value check in be_lancer_xmit_workarounds()
net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64
net/sched: mqprio: add extack to mqprio_parse_nlattr()
net/sched: mqprio: refactor nlattr parsing to a separate function
platform/x86: msi-laptop: Fix rfkill out-of-sync on MSI Wind U100
team: reset team's flags when down link is P2P device
bonding: reset bond's flags when down link is P2P device
tcp: Reduce chance of collisions in inet6_hashfn().
ipv6 addrconf: fix bug where deleting a mngtmpaddr can create a new temporary address
ethernet: atheros: fix return value check in atl1e_tso_csum()
phy: hisilicon: Fix an out of bounds check in hisi_inno_phy_probe()
vxlan: calculate correct header length for GPE
i40e: Fix an NULL vs IS_ERR() bug for debugfs_create_dir()
ext4: fix to check return value of freeze_bdev() in ext4_shutdown()
keys: Fix linking a duplicate key to a keyring's assoc_array
uapi: General notification queue definitions
scsi: qla2xxx: Array index may go out of bound
scsi: qla2xxx: Fix inconsistent format argument type in qla_os.c
pwm: meson: fix handling of period/duty if greater than UINT_MAX
pwm: meson: Simplify duplicated per-channel tracking
pwm: meson: Remove redundant assignment to variable fin_freq
ftrace: Fix possible warning on checking all pages used in ftrace_process_locs()
ftrace: Store the order of pages allocated in ftrace_page
ftrace: Check if pages were allocated before calling free_pages()
ftrace: Add information on number of page groups allocated
fs: dlm: interrupt posix locks only when process is killed
dlm: rearrange async condition return
dlm: cleanup plock_op vs plock_xop
PCI/ASPM: Avoid link retraining race
PCI/ASPM: Factor out pcie_wait_for_retrain()
PCI/ASPM: Return 0 or -ETIMEDOUT from pcie_retrain_link()
ext4: Fix reusing stale buffer heads from last failed mounting
ext4: rename journal_dev to s_journal_dev inside ext4_sb_info
btrfs: fix extent buffer leak after tree mod log failure at split_node()
btrfs: fix race between quota disable and relocation
btrfs: qgroup: catch reserved space leaks at unmount time
bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent
bcache: remove 'int n' from parameter list of bch_bucket_alloc_set()
gpio: tps68470: Make tps68470_gpio_output() always set the initial value
jbd2: Fix wrongly judgement for buffer head removing while doing checkpoint
jbd2: recheck chechpointing non-dirty buffer
jbd2: remove redundant buffer io error checks
jbd2: fix kernel-doc markups
jbd2: fix incorrect code style
Linux 5.4.252
x86: fix backwards merge of GDS/SRSO bit
xen/netback: Fix buffer overrun triggered by unusual packet
x86/cpu, kvm: Add support for CPUID_80000021_EAX
x86/bugs: Increase the x86 bugs vector size to two u32s
tools headers cpufeatures: Sync with the kernel sources
x86/cpufeatures: Assign dedicated feature word for CPUID_0x8000001F[EAX]
x86/cpu: Add VM page flush MSR availablility as a CPUID feature
x86/cpufeatures: Add SEV-ES CPU feature
Documentation/x86: Fix backwards on/off logic about YMM support
x86/mm: Initialize text poking earlier
mm: Move mm_cachep initialization to mm_init()
x86/mm: Use mm_alloc() in poking_init()
x86/mm: fix poking_init() for Xen PV guests
x86/xen: Fix secondary processors' FPU initialization
KVM: Add GDS_NO support to KVM
x86/speculation: Add Kconfig option for GDS
x86/speculation: Add force option to GDS mitigation
x86/speculation: Add Gather Data Sampling mitigation
x86/fpu: Move FPU initialization into arch_cpu_finalize_init()
x86/fpu: Mark init functions __init
x86/fpu: Remove cpuinfo argument from init functions
init, x86: Move mem_encrypt_init() into arch_cpu_finalize_init()
init: Invoke arch_cpu_finalize_init() earlier
init: Remove check_bugs() leftovers
um/cpu: Switch to arch_cpu_finalize_init()
sparc/cpu: Switch to arch_cpu_finalize_init()
sh/cpu: Switch to arch_cpu_finalize_init()
mips/cpu: Switch to arch_cpu_finalize_init()
m68k/cpu: Switch to arch_cpu_finalize_init()
ia64/cpu: Switch to arch_cpu_finalize_init()
ARM: cpu: Switch to arch_cpu_finalize_init()
x86/cpu: Switch to arch_cpu_finalize_init()
init: Provide arch_cpu_finalize_init()
Revert "posix-timers: Ensure timer ID search-loop limit is valid"
Revert "drm/panel: Initialise panel dev and funcs through drm_panel_init()"
Revert "drm/panel: Add and fill drm_panel type field"
Revert "drm/panel: simple: Add connector_type for innolux_at043tn24"
Revert "Revert "8250: add support for ASIX devices with a FIFO bug""
Linux 5.4.251
tracing/histograms: Return an error if we fail to add histogram to hist_vars list
tcp: annotate data-races around fastopenq.max_qlen
tcp: annotate data-races around tp->notsent_lowat
tcp: annotate data-races around rskq_defer_accept
tcp: annotate data-races around tp->linger2
net: Replace the limit of TCP_LINGER2 with TCP_FIN_TIMEOUT_MAX
tcp: annotate data-races around tp->tcp_tx_delay
netfilter: nf_tables: can't schedule in nft_chain_validate
netfilter: nf_tables: fix spurious set element insertion failure
llc: Don't drop packet from non-root netns.
fbdev: au1200fb: Fix missing IRQ check in au1200fb_drv_probe
Revert "tcp: avoid the lookup process failing to get sk in ehash table"
net:ipv6: check return value of pskb_trim()
iavf: Fix use-after-free in free_netdev
net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()/cpsw_ale_set_field()
pinctrl: amd: Use amd_pinconf_set() for all config options
fbdev: imxfb: warn about invalid left/right margin
spi: bcm63xx: fix max prepend length
igb: Fix igb_down hung on surprise removal
wifi: iwlwifi: mvm: avoid baid size integer overflow
wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point()
devlink: report devlink_port_type_warn source device
bpf: Address KCSAN report on bpf_lru_list
sched/fair: Don't balance task to its current running CPU
arm64: mm: fix VA-range sanity check
posix-timers: Ensure timer ID search-loop limit is valid
md/raid10: prevent soft lockup while flush writes
md: fix data corruption for raid456 when reshape restart while grow up
nbd: Add the maximum limit of allocated index in nbd_dev_add
debugobjects: Recheck debug_objects_enabled before reporting
ext4: correct inline offset when handling xattrs in inode body
drm/client: Fix memory leak in drm_client_modeset_probe
drm/client: Fix memory leak in drm_client_target_cloned
can: bcm: Fix UAF in bcm_proc_show()
selftests: tc: set timeout to 15 minutes
fuse: revalidate: don't invalidate if interrupted
btrfs: fix warning when putting transaction with qgroups enabled after abort
perf probe: Add test for regression introduced by switch to die_get_decl_file()
drm/atomic: Fix potential use-after-free in nonblocking commits
scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue
scsi: qla2xxx: Pointer may be dereferenced
scsi: qla2xxx: Correct the index of array
scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport()
scsi: qla2xxx: Fix potential NULL pointer dereference
scsi: qla2xxx: Wait for io return on terminate rport
tracing/probes: Fix not to count error code to total length
tracing: Fix null pointer dereference in tracing_err_log_open()
xtensa: ISS: fix call to split_if_spec
ring-buffer: Fix deadloop issue on reading trace_pipe
tracing/histograms: Add histograms to hist_vars if they have referenced variables
tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() when iterating clk
tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() in case of error
Revert "8250: add support for ASIX devices with a FIFO bug"
meson saradc: fix clock divider mask length
ceph: don't let check_caps skip sending responses for revoke msgs
hwrng: imx-rngc - fix the timeout for init and self check
firmware: stratix10-svc: Fix a potential resource leak in svc_create_memory_pool()
serial: atmel: don't enable IRQs prematurely
drm/rockchip: vop: Leave vblank enabled in self-refresh
drm/atomic: Allow vblank-enabled + self-refresh "disable"
fs: dlm: return positive pid value for F_GETLK
md/raid0: add discard support for the 'original' layout
misc: pci_endpoint_test: Re-init completion for every test
misc: pci_endpoint_test: Free IRQs before removing the device
PCI: rockchip: Set address alignment for endpoint mode
PCI: rockchip: Use u32 variable to access 32-bit registers
PCI: rockchip: Fix legacy IRQ generation for RK3399 PCIe endpoint core
PCI: rockchip: Add poll and timeout to wait for PHY PLLs to be locked
PCI: rockchip: Write PCI Device ID to correct register
PCI: rockchip: Assert PCI Configuration Enable bit after probe
PCI: qcom: Disable write access to read only registers for IP v2.3.3
PCI: Add function 1 DMA alias quirk for Marvell 88SE9235
PCI/PM: Avoid putting EloPOS E2/S2/H2 PCIe Ports in D3cold
jfs: jfs_dmap: Validate db_l2nbperpage while mounting
ext4: only update i_reserved_data_blocks on successful block allocation
ext4: fix wrong unit use in ext4_mb_clear_bb
erofs: fix compact 4B support for 16k block size
SUNRPC: Fix UAF in svc_tcp_listen_data_ready()
misc: fastrpc: Create fastrpc scalar with correct buffer count
powerpc: Fail build if using recordmcount with binutils v2.37
net: bcmgenet: Ensure MDIO unregistration has clocks enabled
mtd: rawnand: meson: fix unaligned DMA buffers handling
tpm: tpm_vtpm_proxy: fix a race condition in /dev/vtpmx creation
pinctrl: amd: Only use special debounce behavior for GPIO 0
pinctrl: amd: Detect internal GPIO0 debounce handling
pinctrl: amd: Fix mistake in handling clearing pins at startup
net/sched: make psched_mtu() RTNL-less safe
net/sched: flower: Ensure both minimum and maximum ports are specified
cls_flower: Add extack support for src and dst port range options
wifi: airo: avoid uninitialized warning in airo_get_rate()
erofs: avoid infinite loop in z_erofs_do_read_page() when reading beyond EOF
platform/x86: wmi: Break possible infinite loop when parsing GUID
platform/x86: wmi: move variables
platform/x86: wmi: use guid_t and guid_equal()
platform/x86: wmi: remove unnecessary argument
platform/x86: wmi: Fix indentation in some cases
platform/x86: wmi: Replace UUID redefinitions by their originals
ipv6/addrconf: fix a potential refcount underflow for idev
NTB: ntb_tool: Add check for devm_kcalloc
NTB: ntb_transport: fix possible memory leak while device_register() fails
ntb: intel: Fix error handling in intel_ntb_pci_driver_init()
NTB: amd: Fix error handling in amd_ntb_pci_driver_init()
ntb: idt: Fix error handling in idt_pci_driver_init()
udp6: fix udp6_ehashfn() typo
icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev().
ionic: remove WARN_ON to prevent panic_on_warn
ionic: ionic_intr_free parameter change
ionic: move irq request to qcq alloc
ionic: clean irq affinity on queue deinit
ionic: improve irq numa locality
net/sched: cls_fw: Fix improper refcount update leads to use-after-free
net: mvneta: fix txq_map in case of txq_number==1
scsi: qla2xxx: Fix error code in qla2x00_start_sp()
igc: set TP bit in 'supported' and 'advertising' fields of ethtool_link_ksettings
igc: Remove delay during TX ring configuration
drm/panel: simple: Add connector_type for innolux_at043tn24
drm/panel: Add and fill drm_panel type field
drm/panel: Initialise panel dev and funcs through drm_panel_init()
workqueue: clean up WORK_* constant types, clarify masking
net: lan743x: Don't sleep in atomic context
block/partition: fix signedness issue for Amiga partitions
tty: serial: fsl_lpuart: add earlycon for imx8ulp platform
netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
netfilter: conntrack: Avoid nf_ct_helper_hash uses after free
netfilter: nf_tables: fix scheduling-while-atomic splat
netfilter: nf_tables: unbind non-anonymous set if rule construction fails
netfilter: nf_tables: reject unbound anonymous set before commit phase
netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain
netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE
netfilter: nf_tables: add rescheduling points during loop detection walks
netfilter: nf_tables: use net_generic infra for transaction data
netfilter: add helper function to set up the nfnetlink header and use it
netfilter: nftables: add helper function to set the base sequence number
netfilter: nf_tables: fix nat hook table deletion
block: add overflow checks for Amiga partition support
fanotify: disallow mount/sb marks on kernel internal pseudo fs
fs: no need to check source
ARM: orion5x: fix d2net gpio initialization
btrfs: fix race when deleting quota root from the dirty cow roots list
fs: Lock moved directories
fs: Establish locking order for unrelated directories
Revert "f2fs: fix potential corruption when moving a directory"
ext4: Remove ext4 locking of moved directory
fs: avoid empty option when generating legacy mount string
jffs2: reduce stack usage in jffs2_build_xattr_subsystem()
integrity: Fix possible multiple allocation in integrity_inode_get()
bcache: Remove unnecessary NULL point check in node allocations
mmc: sdhci: fix DMA configure compatibility issue when 64bit DMA mode is used.
mmc: core: disable TRIM on Micron MTFC4GACAJCN-1M
mmc: core: disable TRIM on Kingston EMMC04G-M627
NFSD: add encoding of op_recall flag for write delegation
ALSA: jack: Fix mutex call in snd_jack_report()
i2c: xiic: Don't try to handle more interrupt events after error
i2c: xiic: Defer xiic_wakeup() and __xiic_start_xfer() in xiic_process()
sh: dma: Fix DMA channel offset calculation
net: dsa: tag_sja1105: fix MAC DA patching from meta frames
net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX
xsk: Honor SO_BINDTODEVICE on bind
xsk: Improve documentation for AF_XDP
tcp: annotate data races in __tcp_oow_rate_limited()
net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode
powerpc: allow PPC_EARLY_DEBUG_CPM only when SERIAL_CPM=y
f2fs: fix error path handling in truncate_dnode()
mailbox: ti-msgmgr: Fill non-message tx data fields with 0x0
spi: bcm-qspi: return error if neither hif_mspi nor mspi is available
Add MODULE_FIRMWARE() for FIRMWARE_TG357766.
sctp: fix potential deadlock on &net->sctp.addr_wq_lock
rtc: st-lpc: Release some resources in st_rtc_probe() in case of error
pwm: sysfs: Do not apply state to already disabled PWMs
pwm: imx-tpm: force 'real_period' to be zero in suspend
mfd: stmpe: Only disable the regulators if they are enabled
KVM: s390: vsie: fix the length of APCB bitmap
mfd: stmfx: Fix error path in stmfx_chip_init
serial: 8250_omap: Use force_suspend and resume for system suspend
mfd: intel-lpss: Add missing check for platform_get_resource
usb: dwc3: qcom: Release the correct resources in dwc3_qcom_remove()
KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes
mfd: rt5033: Drop rt5033-battery sub-device
usb: hide unused usbfs_notify_suspend/resume functions
usb: phy: phy-tahvo: fix memory leak in tahvo_usb_probe()
extcon: Fix kernel doc of property capability fields to avoid warnings
extcon: Fix kernel doc of property fields to avoid warnings
usb: dwc3: qcom: Fix potential memory leak
media: usb: siano: Fix warning due to null work_func_t function pointer
media: videodev2.h: Fix struct v4l2_input tuner index comment
media: usb: Check az6007_read() return value
sh: j2: Use ioremap() to translate device tree address into kernel memory
w1: fix loop in w1_fini()
block: change all __u32 annotations to __be32 in affs_hardblocks.h
block: fix signed int overflow in Amiga partition support
usb: dwc3: gadget: Propagate core init errors to UDC during pullup
USB: serial: option: add LARA-R6 01B PIDs
hwrng: st - keep clock enabled while hwrng is registered
hwrng: st - Fix W=1 unused variable warning
NFSv4.1: freeze the session table upon receiving NFS4ERR_BADSESSION
ARC: define ASM_NL and __ALIGN(_STR) outside #ifdef __ASSEMBLY__ guard
modpost: fix off by one in is_executable_section()
crypto: marvell/cesa - Fix type mismatch warning
modpost: fix section mismatch message for R_ARM_{PC24,CALL,JUMP24}
modpost: fix section mismatch message for R_ARM_ABS32
crypto: nx - fix build warnings when DEBUG_FS is not enabled
hwrng: virtio - Fix race on data_avail and actual data
hwrng: virtio - always add a pending request
hwrng: virtio - don't waste entropy
hwrng: virtio - don't wait on cleanup
hwrng: virtio - add an internal buffer
powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary
pinctrl: at91-pio4: check return value of devm_kasprintf()
perf dwarf-aux: Fix off-by-one in die_get_varname()
pinctrl: cherryview: Return correct value if pin in push-pull mode
PCI: Add pci_clear_master() stub for non-CONFIG_PCI
PCI: ftpci100: Release the clock resources
PCI: pciehp: Cancel bringup sequence if card is not present
scsi: 3w-xxxx: Add error handling for initialization failure in tw_probe()
PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free
scsi: qedf: Fix NULL dereference in error handling
ASoC: imx-audmix: check return value of devm_kasprintf()
clk: keystone: sci-clk: check return value of kasprintf()
clk: cdce925: check return value of kasprintf()
ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer
clk: tegra: tegra124-emc: Fix potential memory leak
drm/radeon: fix possible division-by-zero errors
drm/amdkfd: Fix potential deallocation of previously deallocated memory.
fbdev: omapfb: lcd_mipid: Fix an error handling path in mipid_spi_probe()
arm64: dts: renesas: ulcb-kf: Remove flow control for SCIF1
IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors
soc/fsl/qe: fix usb.c build errors
ASoC: es8316: Do not set rate constraints for unsupported MCLKs
ASoC: es8316: Increment max value for ALC Capture Target Volume control
memory: brcmstb_dpfe: fix testing array offset after use
ARM: ep93xx: fix missing-prototype warnings
drm/panel: simple: fix active size for Ampire AM-480272H3TMQW-T01H
arm64: dts: qcom: msm8916: correct camss unit address
ARM: dts: gta04: Move model property out of pinctrl node
RDMA/bnxt_re: Fix to remove an unnecessary log
drm: sun4i_tcon: use devm_clk_get_enabled in `sun4i_tcon_init_clocks`
Input: adxl34x - do not hardcode interrupt trigger type
ARM: dts: BCM5301X: Drop "clock-names" from the SPI node
Input: drv260x - sleep between polling GO bit
radeon: avoid double free in ci_dpm_init()
netlink: Add __sock_i_ino() for __netlink_diag_dump().
ipvlan: Fix return value of ipvlan_queue_xmit()
netfilter: nf_conntrack_sip: fix the ct_sip_parse_numerical_param() return value.
netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one
lib/ts_bm: reset initial match offset for every block of text
net: nfc: Fix use-after-free caused by nfc_llcp_find_local
nfc: llcp: simplify llcp_sock_connect() error paths
gtp: Fix use-after-free in __gtp_encap_destroy().
selftests: rtnetlink: remove netdevsim device after ipsec offload test
netlink: do not hard code device address lenth in fdb dumps
netlink: fix potential deadlock in netlink_set_err()
wifi: ath9k: convert msecs to jiffies where needed
wifi: cfg80211: rewrite merging of inherited elements
wifi: iwlwifi: pull from TXQs with softirqs disabled
rtnetlink: extend RTEXT_FILTER_SKIP_STATS to IFLA_VF_INFO
wifi: ath9k: Fix possible stall on ath9k_txq_list_has_key()
memstick r592: make memstick_debug_get_tpc_name() static
kexec: fix a memory leak in crash_shrink_memory()
watchdog/perf: more properly prevent false positives with turbo modes
watchdog/perf: define dummy watchdog_update_hrtimer_threshold() on correct config
wifi: rsi: Do not set MMC_PM_KEEP_POWER in shutdown
wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes
wifi: ray_cs: Fix an error handling path in ray_probe()
wifi: ray_cs: Drop useless status variable in parse_addr()
wifi: ray_cs: Utilize strnlen() in parse_addr()
wifi: wl3501_cs: Fix an error handling path in wl3501_probe()
wl3501_cs: use eth_hw_addr_set()
net: create netdev->dev_addr assignment helpers
wl3501_cs: Fix misspelling and provide missing documentation
wl3501_cs: Remove unnecessary NULL check
wl3501_cs: Fix a bunch of formatting issues related to function docs
wifi: atmel: Fix an error handling path in atmel_probe()
wifi: orinoco: Fix an error handling path in orinoco_cs_probe()
wifi: orinoco: Fix an error handling path in spectrum_cs_probe()
regulator: core: Streamline debugfs operations
regulator: core: Fix more error checking for debugfs_create_dir()
nfc: llcp: fix possible use of uninitialized variable in nfc_llcp_send_connect()
nfc: constify several pointers to u8, char and sk_buff
wifi: mwifiex: Fix the size of a memory allocation in mwifiex_ret_802_11_scan()
spi: spi-geni-qcom: Correct CS_TOGGLE bit in SPI_TRANS_CFG
samples/bpf: Fix buffer overflow in tcp_basertt
wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx
wifi: ath9k: fix AR9003 mac hardware hang check register offset calculation
ima: Fix build warnings
pstore/ram: Add check for kstrdup
evm: Complete description of evm_inode_setattr()
ARM: 9303/1: kprobes: avoid missing-declaration warnings
powercap: RAPL: Fix CONFIG_IOSF_MBI dependency
PM: domains: fix integer overflow issues in genpd_parse_state()
clocksource/drivers/cadence-ttc: Fix memory leak in ttc_timer_probe
clocksource/drivers/cadence-ttc: Use ttc driver as platform driver
tracing/timer: Add missing hrtimer modes to decode_hrtimer_mode().
irqchip/jcore-aic: Fix missing allocation of IRQ descriptors
irqchip/jcore-aic: Kill use of irq_create_strict_mappings()
md/raid10: fix io loss while replacement replace rdev
md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request
md/raid10: fix wrong setting of max_corr_read_errors
md/raid10: fix overflow of md/safe_mode_delay
md/raid10: check slab-out-of-bounds in md_bitmap_get_counter
x86/resctrl: Only show tasks' pid in current pid namespace
x86/resctrl: Use is_closid_match() in more places
bgmac: fix *initial* chip reset to support BCM5358
drm/amdgpu: Validate VM ioctl flags.
scripts/tags.sh: Resolve gtags empty index generation
drm/i915: Initialise outparam for error return from wait_for_register
HID: wacom: Use ktime_t rather than int when dealing with timestamps
fbdev: imsttfb: Fix use after free bug in imsttfb_probe
video: imsttfb: check for ioremap() failures
x86/smp: Use dedicated cache-line for mwait_play_dead()
gfs2: Don't deref jdesc in evict
Linux 5.4.250
x86/cpu/amd: Add a Zenbleed fix
x86/cpu/amd: Move the errata checking functionality up
x86/microcode/AMD: Load late on both threads too
Conflicts:
drivers/usb/dwc3/gadget.c
Change-Id: Ibd4bab8255496e4640f2eaf4eb7836209dd7cbfb
With a stream with low bitrate, user can't pause or resume the stream
near the end of the stream because current ALSA doesn't allow it.
If the stream has very low bitrate enough to store whole stream into
the buffer, user can't do anything except stop the stream and then
restart it from the first because most of applications call draining
after sending last frame to the kernel.
If pause, resume are allowed during draining, user experience can be
enhanced.
To prevent malfunction in HW drivers which don't support pause
during draining, pause during draining will only work if HW driver
enable this feature explicitly by calling
snd_compr_use_pause_in_draining().
Signed-off-by: Gyeongtaek Lee <gt82.lee@samsung.com>
Acked-by: Vinod Koul <vkoul@kernel.org>
Link: https://lore.kernel.org/r/000101d6c3f0$89b312b0$9d193810$@samsung.com
Change-Id: I480caca000544c4033cdf2d445598e31754d8e5e
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Git-commit: 9be9f2d3d073ef42127475f4fb6a392ab133f629
Git-repo: https://android.googlesource.com/kernel/common/
[quic_c_smanag@quicinc.com: resolve trivial merge conflicts]
Signed-off-by: Soumya Managoli <quic_c_smanag@quicinc.com>
compress_pause was failing on gki mode due to change in
stream state. The change is done to enable pausing even
when the stream state is in the draining state.
Change-Id: I3c29236298f4257f3606827cd82f1b962b6ad802
Signed-off-by: Vaibhav Raut <quic_vraut@quicinc.com>
