Commit graph android_kernel_motorola_sm6375/include/net
Author SHA1 Message Date
Maciej Żenczykowski
223c666145 UPSTREAM: ipv6: ndisc: RFC-ietf-6man-ra-pref64-09 is now published as RFC8781
See:
  https://www.rfc-editor.org/authors/rfc8781.txt

Cc: Erik Kline <ek@google.com>
Cc: Jen Linkova <furry@google.com>
Cc: Lorenzo Colitti <lorenzo@google.com>
Cc: Michael Haro <mharo@google.com>
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Fixes: c24a77edc9a7 ("ipv6: ndisc: add support for 'PREF64' dns64 prefix identifier")
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 9175d3f38816835b0801bacbf4f6aff1a1672b71)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I9ac8f0e2d500846e4a545434583bda3f671e00bb
2020-11-14 16:55:48 +01:00
Dmitry Safonov
a7982ced0c BACKPORT: xfrm/compat: Translate 32-bit user_policy from sockptr
Provide compat_xfrm_userpolicy_info translation for xfrm setsocketopt().
Reallocate buffer and put the missing padding for 64-bit message.

Signed-off-by: Dmitry Safonov <dima@arista.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
(cherry picked from commit 96392ee5a13b992563cfe07d23ee30d333b89126)
[adelva: Edited around removed compat check in Android kernels]
Bug: 163141236
Signed-off-by: Alistair Delva <adelva@google.com>
Change-Id: I32a6495cd92fa13c956fca88aa5d80716155b8ae
2020-11-02 15:48:58 +00:00
Dmitry Safonov
6a2b428110 UPSTREAM: xfrm/compat: Add 32=>64-bit messages translator
Provide the user-to-kernel translator under XFRM_USER_COMPAT, that
creates for 32-bit xfrm-user message a 64-bit translation.
The translation is afterwards reused by xfrm_user code just as if
userspace had sent 64-bit message.

Signed-off-by: Dmitry Safonov <dima@arista.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
(cherry picked from commit 5106f4a8acff480e244300bc5097c0ad7048c3a2)
Bug: 163141236
Signed-off-by: Alistair Delva <adelva@google.com>
Change-Id: If15999b86e4704b75307fbcc3d7f0c8d8bc89e7a
2020-11-02 15:48:50 +00:00
Dmitry Safonov
1d5f89e524 UPSTREAM: xfrm/compat: Add 64=>32-bit messages translator
Provide the kernel-to-user translator under XFRM_USER_COMPAT, that
creates for 64-bit xfrm-user message a 32-bit translation and puts it
in skb's frag_list. net/compat.c layer provides MSG_CMSG_COMPAT to
decide if the message should be taken from skb or frag_list.
(used by wext-core which has also an ABI difference)

Kernel sends 64-bit xfrm messages to the userspace for:
- multicast (monitor events)
- netlink dumps

Wire up the translator to xfrm_nlmsg_multicast().

Signed-off-by: Dmitry Safonov <dima@arista.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
(cherry picked from commit 5461fc0c8d9f23956b99f5907f69726a293ccb67)
Bug: 163141236
Signed-off-by: Alistair Delva <adelva@google.com>
Change-Id: Id8b59587d60feb9b9f0ce96be9d140d694573fe3
2020-11-02 15:48:33 +00:00
Dmitry Safonov
1fa8e68398 BACKPORT: xfrm: Provide API to register translator module
Add a skeleton for xfrm_compat module and provide API to register it in
xfrm_state.ko. struct xfrm_translator will have function pointers to
translate messages received from 32-bit userspace or to be sent to it
from 64-bit kernel.
module_get()/module_put() are used instead of rcu_read_lock() as the
module will vmalloc() memory for translation.
The new API is registered with xfrm_state module, not with xfrm_user as
the former needs translator for user_policy set by setsockopt() and
xfrm_user already uses functions from xfrm_state.

Signed-off-by: Dmitry Safonov <dima@arista.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
(cherry picked from commit c9e7c76d70fa50582ca96759829c93d0dd024662)
[adelva: Edited around some context changes]
Bug: 163141236
Signed-off-by: Alistair Delva <adelva@google.com>
Change-Id: Ic825c6a0367fa192cc3f7af6b7d2682ef8f9d58b
2020-11-02 15:48:23 +00:00
Greg Kroah-Hartman
95dc566101 ANDROID: GKI: add Android ABI padding to struct nf_conn
Try to mitigate potential future driver core api changes by adding
padding to struct nf_conn;

Bug: 151154716
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ib18a9a929d351c66556f1f27b217cbf22b733a10
2020-10-31 09:30:20 +01:00
Greg Kroah-Hartman
0bc7257c7f ANDROID: GKI: add vendor padding variable in struct nf_conn
Some vendors want to add things to 'struct nf_conn', so give them a u64
where they can then have a pointer off to their private data and they
can do whatever they want to do without breaking or changing any abi for
anyone else.

Note, usually an android trace hook is also needed to use this properly,
so be aware that this will be required as well.

Bug: 171013716
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I303d237116f2f1ef6035af98f00436278ec1c23b
2020-10-30 10:02:26 +01:00
Greg Kroah-Hartman
b3d5bbd878 ANDROID: GKI: add vendor padding variable in struct sock
Some vendors want to add things to 'struct sock', so give them a u64
where they can then have a pointer off to their private data and they
can do whatever they want to do without breaking or changing any abi for
anyone else.

Note, usually an android trace hook is also needed to use this properly,
so be aware that this will be required as well.

Bug: 171013716
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I8fdea13b185fba26010e2a2bf397d7982a8fa16e
2020-10-30 10:02:26 +01:00
Steffen Klassert
88ca8b3fc2 UPSTREAM: udp: Support UDP fraglist GRO/GSO.
This patch extends UDP GRO to support fraglist GRO/GSO
by using the previously introduced infrastructure.
If the feature is enabled, all UDP packets are going to
fraglist GRO (local input and forward).

After validating the csum,  we mark ip_summed as
CHECKSUM_UNNECESSARY for fraglist GRO packets to
make sure that the csum is not touched.

Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Bug: 167707933
Change-Id: I7756cb47212713efde64a246a42c88d0b0f5521a
(cherry picked from commit 9fd1ff5d2ac7181844735806b0a703c942365291)
Signed-off-by: Hyunsoon Kim <h10.kim@samsung.com>
2020-09-09 08:48:03 +00:00
Greg Kroah-Hartman
2669cd8a3e Revert "ANDROID: Revert: Merge 5.4.60 into android11-5.4"
This reverts commit f553ed04bc and really
does merge v5.4.60 into the tree.

Bug: 161946584
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I164a49d7930e441b52c8a80b2fa5aa2b7ec41ed9
2020-08-23 13:12:51 +02:00
Greg Kroah-Hartman
f553ed04bc ANDROID: Revert: Merge 5.4.60 into android11-5.4
Something is going flaky with the ABI checker, so back this merge out at
the moment so that we can fix things up first before merging this back
in.

Bug: 161946584
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I41ada004b1596b4961f95d9de48ca7b677d05226
2020-08-21 16:42:01 +00:00
Greg Kroah-Hartman
8ae87ad4df This is the 5.4.60 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl8/qpIACgkQONu9yGCS
 aT5hfA//ek4lJ5SLezgiHiVS4XdQHbpHUmB+nQ2I9SjJpcABoCa3aNcgfIjlbwf/
 x/t2ON/LDyQaSehMs5S11HxXaYMveI1ejC2tmoEbaezxibFdTHttXGG8sbbc1TPD
 CMjbtPyY1kVDs8iyTTW4uS+xhJQNpk37OmUvlcWLY2H3SCUy882hfzseLSdMvW9v
 AziVOYfQNxeoFtSw0mLX9lV8qSzv4dMLwWcIB6H4umIwIpqmFpD1P5HgG3mjeVuM
 bBk0xnwIijgongFMEsFzzXV9spC5fHJbD4j13IeUjU8zkdvcD2s/8MOGvsFXwLKD
 qVrNb31O9ztdyWKKyhDvmqCM4GEGFgAQF5JM4uM6oqITLfrUmDESP6rFyJQt522X
 qV/xerYK80zwL+V8LmVrDfLSlHxDa2Awa1ywYyfOqoggNGzT2sPv5Snop8jvr2Ut
 eKF9EmoCwkKoHzTItp2jb7tNJ/MpZwfdyZGIcB7QUEUc8czAdGxUFlnv63xGPooS
 /w18H8s7/czpuqEq+TxzKDtKpjvPEM3Nc7O//VduR4cL/7u5ZwCvD68T92d1Whk0
 tjBVojVWlf3DVD+o5FSIfbU2dR0JuilVA2YYVZPhKSY8sfr7cYmb2f3ilR3sBjpR
 W/2cykwmSNPK9kb2+uLd2s6o2EYPH/i57+x1i/x/dloxfXS1ctU=
 =Tae3
 -----END PGP SIGNATURE-----

Merge 5.4.60 into android11-5.4

Changes in 5.4.60
	smb3: warn on confusing error scenario with sec=krb5
	genirq/affinity: Make affinity setting if activated opt-in
	genirq/PM: Always unlock IRQ descriptor in rearm_wake_irq()
	PCI: hotplug: ACPI: Fix context refcounting in acpiphp_grab_context()
	PCI: Mark AMD Navi10 GPU rev 0x00 ATS as broken
	PCI: Add device even if driver attach failed
	PCI: qcom: Define some PARF params needed for ipq8064 SoC
	PCI: qcom: Add support for tx term offset for rev 2.1.0
	btrfs: allow use of global block reserve for balance item deletion
	btrfs: free anon block device right after subvolume deletion
	btrfs: don't allocate anonymous block device for user invisible roots
	btrfs: ref-verify: fix memory leak in add_block_entry
	btrfs: stop incremening log_batch for the log root tree when syncing log
	btrfs: remove no longer needed use of log_writers for the log root tree
	btrfs: don't traverse into the seed devices in show_devname
	btrfs: open device without device_list_mutex
	btrfs: move the chunk_mutex in btrfs_read_chunk_tree
	btrfs: relocation: review the call sites which can be interrupted by signal
	btrfs: add missing check for nocow and compression inode flags
	btrfs: avoid possible signal interruption of btrfs_drop_snapshot() on relocation tree
	btrfs: sysfs: use NOFS for device creation
	btrfs: don't WARN if we abort a transaction with EROFS
	btrfs: fix race between page release and a fast fsync
	btrfs: fix messages after changing compression level by remount
	btrfs: only search for left_info if there is no right_info in try_merge_free_space
	btrfs: inode: fix NULL pointer dereference if inode doesn't need compression
	btrfs: fix memory leaks after failure to lookup checksums during inode logging
	btrfs: make sure SB_I_VERSION doesn't get unset by remount
	btrfs: fix return value mixup in btrfs_get_extent
	arm64: perf: Correct the event index in sysfs
	dt-bindings: iio: io-channel-mux: Fix compatible string in example code
	iio: dac: ad5592r: fix unbalanced mutex unlocks in ad5592r_read_raw()
	xtensa: add missing exclusive access state management
	xtensa: fix xtensa_pmu_setup prototype
	cifs: Fix leak when handling lease break for cached root fid
	powerpc/ptdump: Fix build failure in hashpagetable.c
	powerpc: Allow 4224 bytes of stack expansion for the signal frame
	powerpc: Fix circular dependency between percpu.h and mmu.h
	pinctrl: ingenic: Enhance support for IRQ_TYPE_EDGE_BOTH
	media: vsp1: dl: Fix NULL pointer dereference on unbind
	net: ethernet: stmmac: Disable hardware multicast filter
	net: stmmac: dwmac1000: provide multicast filter fallback
	net/compat: Add missing sock updates for SCM_RIGHTS
	md/raid5: Fix Force reconstruct-write io stuck in degraded raid5
	bcache: allocate meta data pages as compound pages
	bcache: fix overflow in offset_to_stripe()
	mac80211: fix misplaced while instead of if
	driver core: Avoid binding drivers to dead devices
	MIPS: CPU#0 is not hotpluggable
	MIPS: qi_lb60: Fix routing to audio amplifier
	ext2: fix missing percpu_counter_inc
	khugepaged: collapse_pte_mapped_thp() flush the right range
	khugepaged: collapse_pte_mapped_thp() protect the pmd lock
	ocfs2: change slot number type s16 to u16
	mm/page_counter.c: fix protection usage propagation
	mm/memory_hotplug: fix unpaired mem_hotplug_begin/done
	ftrace: Setup correct FTRACE_FL_REGS flags for module
	kprobes: Fix NULL pointer dereference at kprobe_ftrace_handler
	tracing/hwlat: Honor the tracing_cpumask
	tracing: Use trace_sched_process_free() instead of exit() for pid tracing
	tracing: Move pipe reference to trace array instead of current_tracer
	watchdog: f71808e_wdt: indicate WDIOF_CARDRESET support in watchdog_info.options
	watchdog: f71808e_wdt: remove use of wrong watchdog_info option
	watchdog: f71808e_wdt: clear watchdog timeout occurred flag
	ceph: set sec_context xattr on symlink creation
	ceph: handle zero-length feature mask in session messages
	pseries: Fix 64 bit logical memory block panic
	module: Correctly truncate sysfs sections output
	perf intel-pt: Fix FUP packet state
	perf intel-pt: Fix duplicate branch after CBR
	remoteproc: qcom: q6v5: Update running state before requesting stop
	remoteproc: qcom_q6v5_mss: Validate MBA firmware size before load
	remoteproc: qcom_q6v5_mss: Validate modem blob firmware size before load
	drm/imx: imx-ldb: Disable both channels for split mode in enc->disable()
	orangefs: get rid of knob code...
	pinctrl: ingenic: Properly detect GPIO direction when configured for IRQ
	crypto: algif_aead - Only wake up when ctx->more is zero
	mfd: arizona: Ensure 32k clock is put on driver unbind and error
	octeontx2-af: change (struct qmem)->entry_sz from u8 to u16
	mtd: rawnand: fsl_upm: Remove unused mtd var
	platform/chrome: cros_ec_ishtp: Fix a double-unlock issue
	RDMA/ipoib: Return void from ipoib_ib_dev_stop()
	RDMA/ipoib: Fix ABBA deadlock with ipoib_reap_ah()
	media: rockchip: rga: Introduce color fmt macros and refactor CSC mode logic
	media: rockchip: rga: Only set output CSC mode for RGB input
	IB/uverbs: Set IOVA on IB MR in uverbs layer
	selftests/bpf: Test_progs indicate to shell on non-actions
	selftests/bpf: test_progs use another shell exit on non-actions
	USB: serial: ftdi_sio: make process-packet buffer unsigned
	USB: serial: ftdi_sio: clean up receive processing
	crypto: af_alg - Fix regression on empty requests
	devres: keep both device name and resource name in pretty name
	RDMA/counter: Only bind user QPs in auto mode
	RDMA/counter: Allow manually bind QPs with different pids to same counter
	mmc: renesas_sdhi_internal_dmac: clean up the code for dma complete
	crypto: caam - Remove broken arc4 support
	gpu: ipu-v3: image-convert: Combine rotate/no-rotate irq handlers
	gpu: ipu-v3: image-convert: Wait for all EOFs before completing a tile
	dm rq: don't call blk_mq_queue_stopped() in dm_stop_queue()
	clk: actions: Fix h_clk for Actions S500 SoC
	selftests/powerpc: ptrace-pkey: Rename variables to make it easier to follow code
	selftests/powerpc: ptrace-pkey: Update the test to mark an invalid pkey correctly
	selftests/powerpc: ptrace-pkey: Don't update expected UAMOR value
	iommu/omap: Check for failure of a call to omap_iommu_dump_ctx
	clk: qcom: gcc: fix sm8150 GPU and NPU clocks
	clk: qcom: clk-alpha-pll: remove unused/incorrect PLL_CAL_VAL
	iommu/vt-d: Enforce PASID devTLB field mask
	i2c: rcar: slave: only send STOP event when we have been addressed
	clk: qcom: gcc-sdm660: Fix up gcc_mss_mnoc_bimc_axi_clk
	clk: clk-atlas6: fix return value check in atlas6_clk_init()
	pwm: bcm-iproc: handle clk_get_rate() return
	tools build feature: Use CC and CXX from parent
	i2c: rcar: avoid race when unregistering slave
	nfs: ensure correct writeback errors are returned on close()
	ubifs: Fix wrong orphan node deletion in ubifs_jnl_update|rename
	clk: bcm2835: Do not use prediv with bcm2711's PLLs
	libnvdimm/security: fix a typo
	libnvdimm/security: ensure sysfs poll thread woke up and fetch updated attr
	openrisc: Fix oops caused when dumping stack
	scsi: lpfc: nvmet: Avoid hang / use-after-free again when destroying targetport
	nfs: nfs_file_write() should check for writeback errors
	watchdog: initialize device before misc_register
	md-cluster: Fix potential error pointer dereference in resize_bitmaps()
	x86/tsr: Fix tsc frequency enumeration bug on Lightning Mountain SoC
	Input: sentelic - fix error return when fsp_reg_write fails
	recordmcount: Fix build failure on non arm64
	drm/vmwgfx: Use correct vmw_legacy_display_unit pointer
	drm/vmwgfx: Fix two list_for_each loop exit tests
	net: qcom/emac: add missed clk_disable_unprepare in error path of emac_clks_phase1_init
	nfs: Fix getxattr kernel panic and memory overflow
	fs/minix: set s_maxbytes correctly
	fs/minix: fix block limit check for V1 filesystems
	fs/minix: remove expected error message in block_to_path()
	fs/ufs: avoid potential u32 multiplication overflow
	test_kmod: avoid potential double free in trigger_config_run_type()
	i2c: iproc: fix race between client unreg and isr
	mfd: dln2: Run event handler loop under spinlock
	crypto: algif_aead - fix uninitialized ctx->init
	ALSA: echoaudio: Fix potential Oops in snd_echo_resume()
	perf bench mem: Always memset source before memcpy
	tools build feature: Quote CC and CXX for their arguments
	perf/x86/rapl: Fix missing psys sysfs attributes
	sh: landisk: Add missing initialization of sh_io_port_base
	khugepaged: retract_page_tables() remember to test exit
	arm64: dts: marvell: espressobin: add ethernet alias
	drm/panfrost: Use kvfree() to free bo->sgts
	drm: Added orientation quirk for ASUS tablet model T103HAF
	drm: fix drm_dp_mst_port refcount leaks in drm_dp_mst_allocate_vcpi
	drm/amdgpu: Fix bug where DPM is not enabled after hibernate and resume
	drm/amd/display: dchubbub p-state warning during surface planes switch
	Linux 5.4.60

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: If9b3be06ad0a415687928ffc5dc951b21cabc80b
2020-08-21 13:34:23 +02:00
Kees Cook
2816386853 net/compat: Add missing sock updates for SCM_RIGHTS
commit d9539752d23283db4692384a634034f451261e29 upstream.

Add missed sock updates to compat path via a new helper, which will be
used more in coming patches. (The net/core/scm.c code is left as-is here
to assist with -stable backports for the compat path.)

Cc: Christoph Hellwig <hch@lst.de>
Cc: Sargun Dhillon <sargun@sargun.me>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: stable@vger.kernel.org
Fixes: 48a87cc26c ("net: netprio: fd passed in SCM_RIGHTS datagram not set correctly")
Fixes: d84295067f ("net: net_cls: fd passed in SCM_RIGHTS datagram not set correctly")
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-08-21 13:05:25 +02:00
Greg Kroah-Hartman
c0b1779755 This is the 5.4.59 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl88xTwACgkQONu9yGCS
 aT60Lw/9HV3JZ0KDYKHRRS/n4UWh2w7jHe5hwFTfX8/KibexzGzgV3gTaXsyQx75
 Bj2ruJTGZKDvy+a9/IsjTe1v1/HPwPydDyfABNl/Rn8vQuyHzyyGzQo2owqGb57w
 4wVuoqhPASn0n2QAMG05caAx1uqPlXcT/I4H8vpzieNEHbB/2TbwFiWvrDC2d+nw
 mw1PkRmaFp2GSMOHSb68n2oYUv19EBHDtxF9WkwyftdKALQYz5x4O/n4lhpzMSmO
 OeiUg/dpLi0bptL1SQAfaY/Lxa1gFb62YvP47WbWp/P6zespOInk2n8kmpoHxol3
 MMZelRCdl9NtIKVXMEOFEv/asXPlF2wARGmNejGCYLaRqal1bH67yG4eja7biIJe
 gr5OBOFVPol83sPAnb6V4P2SEs650WR95hshYpRL9lbmcHY4q5zoXVm9ul/Hp49R
 qjjfxHDNQQoQgX4ZhEJLp2a5AEJUM4Kz28pZXHyczKYc2R6/AZWqHfnbQVURf+au
 0xJ/tOFxn3yqRtTkmuuifkZcUTJ5iRnzxUUYiGyhTqZOTNZTD0FgiI+S7gckI//K
 idoWGTszHZb6YkNBEwz4WJFtxCGpO95xgD95jOpJVxFcJ5f5PpfZE7RkXUDLR5UO
 XzJopB3nOT1h3EoI3xq7aPDF1hKbkp+VRMWcVrBeP9KgcpLisS4=
 =Tk2c
 -----END PGP SIGNATURE-----

Merge 5.4.59 into android11-5.4

Changes in 5.4.59
	tracepoint: Mark __tracepoint_string's __used
	HID: input: Fix devices that return multiple bytes in battery report
	nvme: add a Identify Namespace Identification Descriptor list quirk
	fs/io_uring.c: Fix uninitialized variable is referenced in io_submit_sqe
	clk: qcom: clk-rpmh: Wait for completion when enabling clocks
	x86/mce/inject: Fix a wrong assignment of i_mce.status
	sched/fair: Fix NOHZ next idle balance
	sched: correct SD_flags returned by tl->sd_flags()
	arm64: dts: rockchip: fix rk3368-lion gmac reset gpio
	arm64: dts: rockchip: fix rk3399-puma vcc5v0-host gpio
	arm64: dts: rockchip: fix rk3399-puma gmac reset gpio
	EDAC: Fix reference count leaks
	crc-t10dif: Fix potential crypto notify dead-lock
	arm64: dts: qcom: msm8916: Replace invalid bias-pull-none property
	blktrace: fix debugfs use after free
	crypto: ccree - fix resource leak on error path
	ARM: exynos: MCPM: Restore big.LITTLE cpuidle support
	firmware: arm_scmi: Fix SCMI genpd domain probing
	arm64: dts: exynos: Fix silent hang after boot on Espresso
	sched/uclamp: Fix initialization of struct uclamp_rq
	clk: scmi: Fix min and max rate when registering clocks with discrete rates
	m68k: mac: Don't send IOP message until channel is idle
	m68k: mac: Fix IOP status/control register writes
	platform/x86: intel-hid: Fix return value check in check_acpi_dev()
	platform/x86: intel-vbtn: Fix return value check in check_acpi_dev()
	ARM: dts: gose: Fix ports node name for adv7180
	ARM: dts: gose: Fix ports node name for adv7612
	ARM: at91: pm: add missing put_device() call in at91_pm_sram_init()
	ARM: dts: sunxi: bananapi-m2-plus-v1.2: Add regulator supply to all CPU cores
	ARM: dts: sunxi: bananapi-m2-plus-v1.2: Fix CPU supply voltages
	spi: lantiq: fix: Rx overflow error in full duplex mode
	tpm: Require that all digests are present in TCG_PCR_EVENT2 structures
	recordmcount: only record relocation of type R_AARCH64_CALL26 on arm64.
	regulator: fix memory leak on error path of regulator_register()
	io_uring: fix sq array offset calculation
	spi: rockchip: Fix error in SPI slave pio read
	ARM: socfpga: PM: add missing put_device() call in socfpga_setup_ocram_self_refresh()
	iocost: Fix check condition of iocg abs_vdebt
	irqchip/ti-sci-inta: Fix return value about devm_ioremap_resource()
	seccomp: Fix ioctl number for SECCOMP_IOCTL_NOTIF_ID_VALID
	md: raid0/linear: fix dereference before null check on pointer mddev
	nvme-tcp: fix controller reset hang during traffic
	nvme-rdma: fix controller reset hang during traffic
	nvme-multipath: fix logic for non-optimized paths
	nvme-multipath: do not fall back to __nvme_find_path() for non-optimized paths
	drm/tilcdc: fix leak & null ref in panel_connector_get_modes
	soc: qcom: rpmh-rsc: Set suppress_bind_attrs flag
	Bluetooth: add a mutex lock to avoid UAF in do_enale_set
	loop: be paranoid on exit and prevent new additions / removals
	fs/btrfs: Add cond_resched() for try_release_extent_mapping() stalls
	drm/amdgpu: avoid dereferencing a NULL pointer
	drm/radeon: Fix reference count leaks caused by pm_runtime_get_sync
	crypto: aesni - Fix build with LLVM_IAS=1
	video: fbdev: savage: fix memory leak on error handling path in probe
	video: fbdev: neofb: fix memory leak in neo_scan_monitor()
	bus: ti-sysc: Add missing quirk flags for usb_host_hs
	md-cluster: fix wild pointer of unlock_all_bitmaps()
	drm/nouveau/kms/nv50-: Fix disabling dithering
	arm64: dts: hisilicon: hikey: fixes to comply with adi, adv7533 DT binding
	drm/etnaviv: fix ref count leak via pm_runtime_get_sync
	drm/nouveau: fix reference count leak in nouveau_debugfs_strap_peek
	drm/nouveau: fix multiple instances of reference count leaks
	mmc: sdhci-cadence: do not use hardware tuning for SD mode
	btrfs: fix lockdep splat from btrfs_dump_space_info
	usb: mtu3: clear dual mode of u3port when disable device
	drm: msm: a6xx: fix gpu failure after system resume
	drm/msm: Fix a null pointer access in msm_gem_shrinker_count()
	drm/debugfs: fix plain echo to connector "force" attribute
	drm/radeon: disable AGP by default
	irqchip/irq-mtk-sysirq: Replace spinlock with raw_spinlock
	mm/mmap.c: Add cond_resched() for exit_mmap() CPU stalls
	drm/amdgpu/display bail early in dm_pp_get_static_clocks
	drm/amd/powerplay: fix compile error with ARCH=arc
	bpf: Fix fds_example SIGSEGV error
	brcmfmac: keep SDIO watchdog running when console_interval is non-zero
	brcmfmac: To fix Bss Info flag definition Bug
	brcmfmac: set state of hanger slot to FREE when flushing PSQ
	platform/x86: asus-nb-wmi: add support for ASUS ROG Zephyrus G14 and G15
	iwlegacy: Check the return value of pcie_capability_read_*()
	gpu: host1x: debug: Fix multiple channels emitting messages simultaneously
	ionic: update eid test for overflow
	mmc: sdhci-pci-o2micro: Bug fix for O2 host controller Seabird1
	usb: gadget: net2280: fix memory leak on probe error handling paths
	bdc: Fix bug causing crash after multiple disconnects
	usb: bdc: Halt controller on suspend
	dyndbg: fix a BUG_ON in ddebug_describe_flags
	bcache: fix super block seq numbers comparision in register_cache_set()
	ACPICA: Do not increment operation_region reference counts for field units
	drm/msm: ratelimit crtc event overflow error
	drm/gem: Fix a leak in drm_gem_objects_lookup()
	drm/bridge: ti-sn65dsi86: Clear old error bits before AUX transfers
	agp/intel: Fix a memory leak on module initialisation failure
	mwifiex: Fix firmware filename for sd8977 chipset
	mwifiex: Fix firmware filename for sd8997 chipset
	btmrvl: Fix firmware filename for sd8977 chipset
	btmrvl: Fix firmware filename for sd8997 chipset
	video: fbdev: sm712fb: fix an issue about iounmap for a wrong address
	console: newport_con: fix an issue about leak related system resources
	video: pxafb: Fix the function used to balance a 'dma_alloc_coherent()' call
	ath10k: Acquire tx_lock in tx error paths
	iio: improve IIO_CONCENTRATION channel type description
	drm/etnaviv: Fix error path on failure to enable bus clk
	drm/arm: fix unintentional integer overflow on left shift
	clk: bcm63xx-gate: fix last clock availability
	leds: lm355x: avoid enum conversion warning
	Bluetooth: btusb: fix up firmware download sequence
	Bluetooth: btmtksdio: fix up firmware download sequence
	media: cxusb-analog: fix V4L2 dependency
	media: marvell-ccic: Add missed v4l2_async_notifier_cleanup()
	media: omap3isp: Add missed v4l2_ctrl_handler_free() for preview_init_entities()
	ASoC: SOF: nocodec: add missing .owner field
	ASoC: Intel: bxt_rt298: add missing .owner field
	scsi: cumana_2: Fix different dev_id between request_irq() and free_irq()
	drm/mipi: use dcs write for mipi_dsi_dcs_set_tear_scanline
	cxl: Fix kobject memleak
	drm/radeon: fix array out-of-bounds read and write issues
	staging: vchiq_arm: Add a matching unregister call
	iavf: fix error return code in iavf_init_get_resources()
	iavf: Fix updating statistics
	RDMA/core: Fix bogus WARN_ON during ib_unregister_device_queued()
	scsi: powertec: Fix different dev_id between request_irq() and free_irq()
	scsi: eesox: Fix different dev_id between request_irq() and free_irq()
	ipvs: allow connection reuse for unconfirmed conntrack
	media: firewire: Using uninitialized values in node_probe()
	media: exynos4-is: Add missed check for pinctrl_lookup_state()
	media: cros-ec-cec: do not bail on device_init_wakeup failure
	xfs: don't eat an EIO/ENOSPC writeback error when scrubbing data fork
	xfs: fix reflink quota reservation accounting error
	RDMA/rxe: Skip dgid check in loopback mode
	PCI: Fix pci_cfg_wait queue locking problem
	drm/stm: repair runtime power management
	kobject: Avoid premature parent object freeing in kobject_cleanup()
	leds: core: Flush scheduled work for system suspend
	drm: panel: simple: Fix bpc for LG LB070WV8 panel
	phy: exynos5-usbdrd: Calibrating makes sense only for USB2.0 PHY
	drm/bridge: sil_sii8620: initialize return of sii8620_readb
	scsi: scsi_debug: Add check for sdebug_max_queue during module init
	mwifiex: Prevent memory corruption handling keys
	kernfs: do not call fsnotify() with name without a parent
	powerpc/rtas: don't online CPUs for partition suspend
	powerpc/vdso: Fix vdso cpu truncation
	RDMA/qedr: SRQ's bug fixes
	RDMA/rxe: Prevent access to wr->next ptr afrer wr is posted to send queue
	ima: Have the LSM free its audit rule
	staging: rtl8192u: fix a dubious looking mask before a shift
	ASoC: meson: fixes the missed kfree() for axg_card_add_tdm_loopback
	PCI/ASPM: Add missing newline in sysfs 'policy'
	phy: renesas: rcar-gen3-usb2: move irq registration to init
	powerpc/book3s64/pkeys: Use PVR check instead of cpu feature
	drm/imx: fix use after free
	drm/imx: tve: fix regulator_disable error path
	gpu: ipu-v3: Restore RGB32, BGR32
	spi: lantiq-ssc: Fix warning by using WQ_MEM_RECLAIM
	USB: serial: iuu_phoenix: fix led-activity helpers
	usb: core: fix quirks_param_set() writing to a const pointer
	thermal: ti-soc-thermal: Fix reversed condition in ti_thermal_expose_sensor()
	coresight: tmc: Fix TMC mode read in tmc_read_unprepare_etb()
	powerpc/perf: Fix missing is_sier_aviable() during build
	mt76: mt7615: fix potential memory leak in mcu message handler
	phy: armada-38x: fix NETA lockup when repeatedly switching speeds
	MIPS: OCTEON: add missing put_device() call in dwc3_octeon_device_init()
	usb: dwc2: Fix error path in gadget registration
	usb: gadget: f_uac2: fix AC Interface Header Descriptor wTotalLength
	scsi: megaraid_sas: Clear affinity hint
	scsi: mesh: Fix panic after host or bus reset
	net: dsa: mv88e6xxx: MV88E6097 does not support jumbo configuration
	macintosh/via-macii: Access autopoll_devs when inside lock
	PCI: cadence: Fix updating Vendor ID and Subsystem Vendor ID register
	RDMA/core: Fix return error value in _ib_modify_qp() to negative
	Smack: fix another vsscanf out of bounds
	Smack: prevent underflow in smk_set_cipso()
	power: supply: check if calc_soc succeeded in pm860x_init_battery
	Bluetooth: hci_h5: Set HCI_UART_RESET_ON_INIT to correct flags
	Bluetooth: hci_serdev: Only unregister device if it was registered
	net: dsa: rtl8366: Fix VLAN semantics
	net: dsa: rtl8366: Fix VLAN set-up
	xfs: fix inode allocation block res calculation precedence
	selftests/powerpc: Squash spurious errors due to device removal
	powerpc/32s: Fix CONFIG_BOOK3S_601 uses
	powerpc/boot: Fix CONFIG_PPC_MPC52XX references
	selftests/powerpc: Fix CPU affinity for child process
	RDMA/netlink: Remove CAP_NET_RAW check when dump a raw QP
	PCI: Release IVRS table in AMD ACS quirk
	cpufreq: ap806: fix cpufreq driver needs ap cpu clk
	selftests/powerpc: Fix online CPU selection
	ASoC: meson: axg-tdm-interface: fix link fmt setup
	ASoC: meson: axg-tdmin: fix g12a skew
	ASoC: meson: axg-tdm-formatters: fix sclk inversion
	ASoC: fsl_sai: Fix value of FSL_SAI_CR1_RFW_MASK
	s390/qeth: don't process empty bridge port events
	ice: Graceful error handling in HW table calloc failure
	rtw88: fix LDPC field for RA info
	rtw88: fix short GI capability based on current bandwidth
	rtw88: coex: only skip coex triggered by BT info
	wl1251: fix always return 0 error
	tools, build: Propagate build failures from tools/build/Makefile.build
	tools, bpftool: Fix wrong return value in do_dump()
	net/mlx5: DR, Change push vlan action sequence
	net/mlx5: Delete extra dump stack that gives nothing
	net: ethernet: aquantia: Fix wrong return value
	liquidio: Fix wrong return value in cn23xx_get_pf_num()
	net: spider_net: Fix the size used in a 'dma_free_coherent()' call
	fsl/fman: use 32-bit unsigned integer
	fsl/fman: fix dereference null return value
	fsl/fman: fix unreachable code
	fsl/fman: check dereferencing null pointer
	fsl/fman: fix eth hash table allocation
	net: thunderx: initialize VF's mailbox mutex before first usage
	dlm: Fix kobject memleak
	ocfs2: fix unbalanced locking
	pinctrl-single: fix pcs_parse_pinconf() return value
	svcrdma: Fix page leak in svc_rdma_recv_read_chunk()
	SUNRPC: Fix ("SUNRPC: Add "@len" parameter to gss_unwrap()")
	x86/fsgsbase/64: Fix NULL deref in 86_fsgsbase_read_task
	crypto: aesni - add compatibility with IAS
	af_packet: TPACKET_V3: fix fill status rwlock imbalance
	drivers/net/wan/lapbether: Added needed_headroom and a skb->len check
	net: Fix potential memory leak in proto_register()
	net/nfc/rawsock.c: add CAP_NET_RAW check.
	net: phy: fix memory leak in device-create error path
	net: Set fput_needed iff FDPUT_FPUT is set
	net/tls: Fix kmap usage
	tcp: correct read of TFO keys on big endian systems
	vmxnet3: use correct tcp hdr length when packet is encapsulated
	net: refactor bind_bucket fastreuse into helper
	net: initialize fastreuse on inet_inherit_port
	USB: serial: cp210x: re-enable auto-RTS on open
	USB: serial: cp210x: enable usb generic throttle/unthrottle
	ALSA: hda - fix the micmute led status for Lenovo ThinkCentre AIO
	ALSA: usb-audio: Creative USB X-Fi Pro SB1095 volume knob support
	ALSA: usb-audio: fix overeager device match for MacroSilicon MS2109
	ALSA: usb-audio: work around streaming quirk for MacroSilicon MS2109
	9p: Fix memory leak in v9fs_mount
	media: media-request: Fix crash if memory allocation fails
	drm/ttm/nouveau: don't call tt destroy callback on alloc failure.
	io_uring: set ctx sq/cq entry count earlier
	NFS: Don't move layouts to plh_return_segs list while in use
	NFS: Don't return layout segments that are in use
	cpufreq: Fix locking issues with governors
	cpufreq: dt: fix oops on armada37xx
	include/asm-generic/vmlinux.lds.h: align ro_after_init
	spi: spidev: Align buffers for DMA
	mtd: rawnand: qcom: avoid write to unavailable register
	erofs: fix extended inode could cross boundary
	Revert "parisc: Drop LDCW barrier in CAS code when running UP"
	Revert "parisc: Use ldcw instruction for SMP spinlock release barrier"
	Revert "parisc: Revert "Release spinlocks using ordered store""
	parisc: Do not use an ordered store in pa_tlb_lock()
	parisc: Implement __smp_store_release and __smp_load_acquire barriers
	parisc: mask out enable and reserved bits from sba imask
	ARM: 8992/1: Fix unwind_frame for clang-built kernels
	irqdomain/treewide: Free firmware node after domain removal
	ALSA: usb-audio: add quirk for Pioneer DDJ-RB
	tpm: Unify the mismatching TPM space buffer sizes
	pstore: Fix linking when crypto API disabled
	crypto: hisilicon - don't sleep of CRYPTO_TFM_REQ_MAY_SLEEP was not specified
	crypto: qat - fix double free in qat_uclo_create_batch_init_list
	crypto: ccp - Fix use of merged scatterlists
	crypto: cpt - don't sleep of CRYPTO_TFM_REQ_MAY_SLEEP was not specified
	bitfield.h: don't compile-time validate _val in FIELD_FIT
	fs/minix: check return value of sb_getblk()
	fs/minix: don't allow getting deleted inodes
	fs/minix: reject too-large maximum file size
	xen/balloon: fix accounting in alloc_xenballooned_pages error path
	xen/balloon: make the balloon wait interruptible
	xen/gntdev: Fix dmabuf import with non-zero sgt offset
	s390/dasd: fix inability to use DASD with DIAG driver
	s390/gmap: improve THP splitting
	io_uring: Fix NULL pointer dereference in loop_rw_iter()
	Linux 5.4.59

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I4bc685ec9234d8f72a9c66ee2d509a2975f6d711
2020-08-19 08:40:57 +02:00
Tim Froidcoeur
dcedddbc7b net: refactor bind_bucket fastreuse into helper
[ Upstream commit 62ffc589abb176821662efc4525ee4ac0b9c3894 ]

Refactor the fastreuse update code in inet_csk_get_port into a small
helper function that can be called from other places.

Acked-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: Tim Froidcoeur <tim.froidcoeur@tessares.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-08-19 08:16:23 +02:00
Jason Baron
e07d0ccd7f tcp: correct read of TFO keys on big endian systems
[ Upstream commit f19008e676366c44e9241af57f331b6c6edf9552 ]

When TFO keys are read back on big endian systems either via the global
sysctl interface or via getsockopt() using TCP_FASTOPEN_KEY, the values
don't match what was written.

For example, on s390x:

# echo "1-2-3-4" > /proc/sys/net/ipv4/tcp_fastopen_key
# cat /proc/sys/net/ipv4/tcp_fastopen_key
02000000-01000000-04000000-03000000

Instead of:

# cat /proc/sys/net/ipv4/tcp_fastopen_key
00000001-00000002-00000003-00000004

Fix this by converting to the correct endianness on read. This was
reported by Colin Ian King when running the 'tcp_fastopen_backup_key' net
selftest on s390x, which depends on the read value matching what was
written. I've confirmed that the test now passes on big and little endian
systems.

Signed-off-by: Jason Baron <jbaron@akamai.com>
Fixes: 438ac88009 ("net: fastopen: robustness and endianness fixes for SipHash")
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Eric Dumazet <edumazet@google.com>
Reported-and-tested-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-08-19 08:16:23 +02:00
Julian Anastasov
0c122fc90d ipvs: allow connection reuse for unconfirmed conntrack
[ Upstream commit f0a5e4d7a594e0fe237d3dfafb069bb82f80f42f ]

YangYuxi is reporting that connection reuse
is causing one-second delay when SYN hits
existing connection in TIME_WAIT state.
Such delay was added to give time to expire
both the IPVS connection and the corresponding
conntrack. This was considered a rare case
at that time but it is causing problem for
some environments such as Kubernetes.

As nf_conntrack_tcp_packet() can decide to
release the conntrack in TIME_WAIT state and
to replace it with a fresh NEW conntrack, we
can use this to allow rescheduling just by
tuning our check: if the conntrack is
confirmed we can not schedule it to different
real server and the one-second delay still
applies but if new conntrack was created,
we are free to select new real server without
any delays.

YangYuxi lists some of the problem reports:

- One second connection delay in masquerading mode:
https://marc.info/?t=151683118100004&r=1&w=2

- IPVS low throughput #70747
https://github.com/kubernetes/kubernetes/issues/70747

- Apache Bench can fill up ipvs service proxy in seconds #544
https://github.com/cloudnativelabs/kube-router/issues/544

- Additional 1s latency in `host -> service IP -> pod`
https://github.com/kubernetes/kubernetes/issues/90854

Fixes: f719e3754e ("ipvs: drop first packet to redirect conntrack")
Co-developed-by: YangYuxi <yx.atom1@gmail.com>
Signed-off-by: YangYuxi <yx.atom1@gmail.com>
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Reviewed-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-08-19 08:16:10 +02:00
Greg Kroah-Hartman
6e8e201587 Revert "Revert "genetlink: remove genl_bind""
This reverts commit 68815d5b7e which was
commit 0845447d9c783a502bd3e13af0f38aa4c7655a77 in 4.19.y and is commit
1e82a62fec613844da9e558f3493540a5b7a7b67 upstream.

It was reported that this issue affects Android devices and a vendor
wishes it to be applied back, ABI is not an issue here.

Leaf changes summary: 5 artifacts changed
Changed leaf types summary: 1 leaf type changed
Removed/Changed/Added functions summary: 0 Removed, 4 Changed, 0 Added function
Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variable

4 functions with some sub-type change:
  [C] 'function void genl_notify(const genl_family*, sk_buff*, genl_info*, u32, gfp_t)' at genetlink.c:1109:1 has some sub-type changes:
  [C] 'function int genl_register_family(genl_family*)' at genetlink.h:145:1 has some sub-type changes:
  [C] 'function int genl_unregister_family(const genl_family*)' at genetlink.h:146:1 has some sub-type changes:
  [C] 'function void* genlmsg_put(sk_buff*, unsigned int, unsigned int, const genl_family*, int, unsigned char)' at genetlink.h:150:1 has some sub-type changes:

'struct genl_family at genetlink.h:52:1' changed:
  type size changed from 1024 to 896 (in bits)
  2 data member deletions:
    'int (net*, int)* genl_family::mcast_bind', at offset 512 (in bits) at genetlink.h:67:1
    'void (net*, int)* genl_family::mcast_unbind', at offset 576 (in bits) at genetlink.h:68:1
  there are data member changes:
    'nlattr** genl_family::attrbuf' offset changed from 640 to 512 (in bits) (by -128 bits)
    'const genl_ops* genl_family::ops' offset changed from 704 to 576 (in bits) (by -128 bits)
    'const genl_multicast_group* genl_family::mcgrps' offset changed from 768 to 640 (in bits) (by -128 bits)
    'unsigned int genl_family::n_ops' offset changed from 832 to 704 (in bits) (by -128 bits)
    'unsigned int genl_family::n_mcgrps' offset changed from 864 to 736 (in bits) (by -128 bits)
    'unsigned int genl_family::mcgrp_offset' offset changed from 896 to 768 (in bits) (by -128 bits)
    'module* genl_family::module' offset changed from 960 to 832 (in bits) (by -128 bits)
  4 impacted interfaces

Bug: 163861691
Cc: Sean Tranchetti <stranche@codeaurora.org>
Cc: Will McVicker <willmcvicker@google.com>
Cc: Saravana Kannan <saravanak@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ieaa81ed2445ff12a9a8e00f69d64c78baeec07e5
2020-08-13 15:45:33 +02:00
Greg Kroah-Hartman
3a9b53bc89 This is the 5.4.58 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl8ynngACgkQONu9yGCS
 aT5cPw/9GiiNZCLyjB3jVyalmN9uDYKQ+eS8H97GG7IBVYyg9whOKIrOCZHcLINH
 DV5s/qnhRWJPzmQ47410ySuPb6QMvkhWTK7i5Xf+K7BOvoz/snfFGcmdu1CA4KxR
 CuuH449Y4l3sH+5fPv7+EToovBqA2cfeiz/i5d5Di/N4yODWBCbHHAsZIt0oGvuK
 sI1aI1K//R7vKZQvQo85tvENbWJWQwDN7eYVQj3aSbvnq8JqVpwTKTBpKfshzgzB
 RmMSOVpQoQYNivW9oleG0NTQeHqj7alG8anFs3Drgu1hs5dzQhqAFlKddhtRS69j
 mtrSJuf0GgJEYA6n+PfacoM4l7kHUZcQH9+bglbCXTA3nH24DLT7h0Lybm+ETPXc
 ZAYo7cHqrS1BWv8VHZggSbqPr6YNKvgeflgS394wAgNEFcaJmaPfS6+elmc0qf2t
 VPSas7QQruRS1Bqwb6CF2tHsl4N+VdvxX1a2JjHHcF5N3z5aqDm1qaVVQHxAg2rE
 gXepFNGkEIBhWRxPz+5quxN1XBcUDiQYrzdoaKHxwY+OcdCf635P5Ob+1WK3w1oa
 qhl/2scs44D67wZSgXHo5N4vMi9HhPOSV77jklgFcg75IzM9YWwYnJADQRHxo7nT
 25XEgUlMfxm0ngw+CZWR0ssaP6rB9V1rRLDqb1W5HbqA7lp2YE8=
 =Fe6H
 -----END PGP SIGNATURE-----

Merge 5.4.58 into android11-5.4

Changes in 5.4.58
	USB: serial: qcserial: add EM7305 QDL product ID
	perf/core: Fix endless multiplex timer
	USB: iowarrior: fix up report size handling for some devices
	usb: xhci: define IDs for various ASMedia host controllers
	usb: xhci: Fix ASMedia ASM1142 DMA addressing
	io_uring: prevent re-read of sqe->opcode
	io_uring: Fix use-after-free in io_sq_wq_submit_work()
	Revert "ALSA: hda: call runtime_allow() for all hda controllers"
	ALSA: hda/realtek: Add alc269/alc662 pin-tables for Loongson-3 laptops
	ALSA: hda/ca0132 - Add new quirk ID for Recon3D.
	ALSA: hda/ca0132 - Fix ZxR Headphone gain control get value.
	ALSA: hda/ca0132 - Fix AE-5 microphone selection commands.
	ALSA: seq: oss: Serialize ioctls
	staging: android: ashmem: Fix lockdep warning for write operation
	staging: rtl8712: handle firmware load failure
	Staging: rtl8188eu: rtw_mlme: Fix uninitialized variable authmode
	Bluetooth: Fix slab-out-of-bounds read in hci_extended_inquiry_result_evt()
	Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_evt()
	Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_with_rssi_evt()
	omapfb: dss: Fix max fclk divider for omap36xx
	binder: Prevent context manager from incrementing ref 0
	Smack: fix use-after-free in smk_write_relabel_self()
	scripts: add dummy report mode to add_namespace.cocci
	vgacon: Fix for missing check in scrollback handling
	mtd: properly check all write ioctls for permissions
	leds: wm831x-status: fix use-after-free on unbind
	leds: lm36274: fix use-after-free on unbind
	leds: da903x: fix use-after-free on unbind
	leds: lm3533: fix use-after-free on unbind
	leds: 88pm860x: fix use-after-free on unbind
	net/9p: validate fds in p9_fd_open
	drm/nouveau/fbcon: fix module unload when fbcon init has failed for some reason
	drm/nouveau/fbcon: zero-initialise the mode_cmd2 structure
	nvme-pci: prevent SK hynix PC400 from using Write Zeroes command
	drm/drm_fb_helper: fix fbdev with sparc64
	i2c: slave: improve sanity check when registering
	i2c: slave: add sanity check when unregistering
	usb: hso: check for return value in hso_serial_common_create()
	net: ethernet: mtk_eth_soc: Always call mtk_gmac0_rgmii_adjust() for mt7623
	ALSA: hda: fix NULL pointer dereference during suspend
	firmware: Fix a reference count leak.
	cfg80211: check vendor command doit pointer before use
	igb: reinit_locked() should be called with rtnl_lock
	atm: fix atm_dev refcnt leaks in atmtcp_remove_persistent
	tools lib traceevent: Fix memory leak in process_dynamic_array_len
	Drivers: hv: vmbus: Ignore CHANNELMSG_TL_CONNECT_RESULT(23)
	xattr: break delegations in {set,remove}xattr
	Revert "powerpc/kasan: Fix shadow pages allocation failure"
	PCI: tegra: Revert tegra124 raw_violation_fixup
	ipv4: Silence suspicious RCU usage warning
	ipv6: fix memory leaks on IPV6_ADDRFORM path
	ipv6: Fix nexthop refcnt leak when creating ipv6 route info
	net: ethernet: mtk_eth_soc: fix MTU warnings
	rxrpc: Fix race between recvmsg and sendmsg on immediate call failure
	vxlan: Ensure FDB dump is performed under RCU
	net: lan78xx: replace bogus endpoint lookup
	appletalk: Fix atalk_proc_init() return path
	dpaa2-eth: Fix passing zero to 'PTR_ERR' warning
	hv_netvsc: do not use VF device if link is down
	net: gre: recompute gre csum for sctp over gre tunnels
	net: thunderx: use spin_lock_bh in nicvf_set_rx_mode_task()
	openvswitch: Prevent kernel-infoleak in ovs_ct_put_key()
	Revert "vxlan: fix tos value before xmit"
	selftests/net: relax cpu affinity requirement in msg_zerocopy test
	tcp: apply a floor of 1 for RTT samples from TCP timestamps
	ima: move APPRAISE_BOOTPARAM dependency on ARCH_POLICY to runtime
	nfsd: Fix NFSv4 READ on RDMA when using readv
	Linux 5.4.58

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I0e89e2c0faf90bdf1f6ac37f9a2c2395cacab054
2020-08-11 18:37:58 +02:00
Cong Wang
89c12bc362 ipv6: fix memory leaks on IPV6_ADDRFORM path
[ Upstream commit 8c0de6e96c9794cb523a516c465991a70245da1c ]

IPV6_ADDRFORM causes resource leaks when converting an IPv6 socket
to IPv4, particularly struct ipv6_ac_socklist. Similar to
struct ipv6_mc_socklist, we should just close it on this path.

This bug can be easily reproduced with the following C program:

  #include <stdio.h>
  #include <string.h>
  #include <sys/types.h>
  #include <sys/socket.h>
  #include <arpa/inet.h>

  int main()
  {
    int s, value;
    struct sockaddr_in6 addr;
    struct ipv6_mreq m6;

    s = socket(AF_INET6, SOCK_DGRAM, 0);
    addr.sin6_family = AF_INET6;
    addr.sin6_port = htons(5000);
    inet_pton(AF_INET6, "::ffff:192.168.122.194", &addr.sin6_addr);
    connect(s, (struct sockaddr *)&addr, sizeof(addr));

    inet_pton(AF_INET6, "fe80::AAAA", &m6.ipv6mr_multiaddr);
    m6.ipv6mr_interface = 5;
    setsockopt(s, SOL_IPV6, IPV6_JOIN_ANYCAST, &m6, sizeof(m6));

    value = AF_INET;
    setsockopt(s, SOL_IPV6, IPV6_ADDRFORM, &value, sizeof(value));

    close(s);
    return 0;
  }

Reported-by: ch3332xr@gmail.com
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-08-11 15:33:39 +02:00
Ilan Peer
2a3f0f7a0c BACKPORT: mac80211: Add HE 6GHz capabilities element to probe request
On 6 GHz, the 6 GHz capabilities element should be added, do that.

Bug: 163110886

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
[add commit message]
Link: https://lore.kernel.org/r/20200528213443.8ee764f0cde0.I2b0c66b60e11818c97c9803e04a6a197c6376243@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Change-Id: Iba5daa73817072fdea78cd37c1f30b0323deca6f
(cherry picked from commit 2ad2274c58ee2dcaf9ccde5c63ff30f59b138f77)
Signed-off-by: Vamsi Krishna <vamsin@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2020-08-11 12:53:39 +02:00
Johannes Berg
9a579df196 BACKPORT: cfg80211: add and expose HE 6 GHz band capabilities
These capabilities cover what would otherwise be transported
in HT/VHT capabilities, but only a subset thereof that is
actually needed on 6 GHz with HE already present. Expose the
capabilities to userspace, drivers are expected to set them
as using the 6 GHz band (currently) requires HE capability.

Bug: 163110886

Link: https://lore.kernel.org/r/20200528213443.244cd5cb9db8.Icd8c773277a88c837e7e3af1d4d1013cc3b66543@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Change-Id: I08e42cb07c3cb1faacb325888ca77bcd2c91507b
(cherry picked from commit 223952177296c34d9c8de9cde33204caffe55725)
Signed-off-by: Vamsi Krishna <vamsin@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2020-08-11 12:53:32 +02:00
Rajkumar Manoharan
9e4ff996eb BACKPORT: cfg80211: handle 6 GHz capability of new station
Handle 6 GHz HE capability while adding new station. It will be used
later in mac80211 station processing.

Bug: 163110886

Signed-off-by: Rajkumar Manoharan <rmanohar@codeaurora.org>
Link: https://lore.kernel.org/r/1589399105-25472-2-git-send-email-rmanohar@codeaurora.org
[handle nl80211_set_station, require WME,
 remove NL80211_HE_6GHZ_CAPABILITY_LEN]
Link: https://lore.kernel.org/r/20200528213443.b6b711fd4312.Ic9b97d57b6c4f2b28d4b2d23d2849d8bc20bd8cc@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Change-Id: I1407f9a72e2790da31a308e2d834185d229efc96
(cherry picked from commit 43e64bf301fd8c54f0082d91c6ffd4de861baf96)
Signed-off-by: Vamsi Krishna <vamsin@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2020-08-11 12:53:30 +02:00
Johannes Berg
bdb178cf07 BACKPORT: cfg80211: add a helper to identify 6 GHz PSCs
This allows identifying whether or not a channel is a PSC
(preferred scanning channel).

Bug: 163110886

Link: https://lore.kernel.org/r/20200528213443.414363ecf62c.Ic15e681a0e249eab7350a06ceb582cca8bb9a080@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Change-Id: Ia0b369ead18ce1d1e585df9467d680be4aa8adef
(cherry picked from commit afbc9c9e8bfe71e8bd12a8c01bedd969fbab8f0e)
Signed-off-by: Vamsi Krishna <vamsin@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2020-08-11 12:53:22 +02:00
Thomas Pedersen
ac2e6c2e7e BACKPORT: cfg80211: express channels with a KHz component
Some bands (S1G) define channels centered on a non-integer
MHz. Give ieee80211_channel and cfg80211_chan_def a
freq_offset component where the final frequency can be
expressed as:

MHZ_TO_KHZ(chan->center_freq) + chan->freq_offset;

Also provide some helper functions to do the frequency
conversion and test for equality.

Retain the existing interface to frequency and channel
conversion helpers, and expose new ones which handle
frequencies in units of KHz.

Some internal functions (net/wireless/chan.c) pass around
a frequency value. Convert these to units of KHz.

mesh, ibss, wext, etc. are currently ignored.

Bug: 163110886

Signed-off-by: Thomas Pedersen <thomas@adapt-ip.com>
Link: https://lore.kernel.org/r/20200402011810.22947-3-thomas@adapt-ip.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Change-Id: I058afb696c69e7047d5573bda334d04f684f1215
(cherry picked from commit 934f4c7dd3a544bb8000f7436f1f0e12e04ebc37)
Signed-off-by: Vamsi Krishna <vamsin@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2020-08-11 12:53:01 +02:00
Greg Kroah-Hartman
fcb0d3ef9b This is the 5.4.56 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl8qZwoACgkQONu9yGCS
 aT4gVA//ZuAjdnvfTBp3wvPu4D507HBz2hPqsJXVzJrt+Icw5qOqG5kn9icDfgVF
 VUNAFD3evDkESFe2OV/gZR3Qu9JNyJk0GVQGkzFPnxCX7FP+XaIHHNBDALBem1SA
 8e3coFTMaqf1W8ualF/gpogYVz8SkbzqU+GOOA/+y8dQwyXtRrbIv8XuxQfmbMfD
 +ttaqeytm6deBYNL/Ok2Lxl3H01ShchdmKLFn5L3M6GiKzucp7NYWOz0luEF1Uak
 jsShFl+DfKT3Lq666CmecoyvLug5VWGPLvNm/UeJHwHZBr2KFWmTbMTIo/6gB9Ud
 YNv5xwZXKflUZlV3i0jeAVYQ4vNrtsCpOTqnkw8JpW78sJPfb9Ozlvk/XgnXEtpl
 ojv2eX5R+5yxPp8yJoxwBmuaoYYEsngTXsgTzQ2T+bvSWtUK8qyoTCa+6FEG6ylv
 DkMIMSvdb9AC80KbfN5cCNEloryoaEPp4aXgqX0E6ZKAWvuAfnS+7ohPCw1x12D6
 VqwAinq0gnie8TD9E3Bcn3m2COFwF/Ow38uO4F/gQ9zcOXS6+QiqrpQwCzSVdumU
 NQHJbvMFwfMR35yN2lo87Xk8MvHLhloKIIBhmxAMaGR2NRwg9w2vDkxfjuZUiElz
 YKOhNw51jFwCkMUtLJmn6pon/DGnDH23+/2LC0oqGNLASG7sUjQ=
 =A5pn
 -----END PGP SIGNATURE-----

Merge 5.4.56 into android11-5.4

Changes in 5.4.56
	crypto: ccp - Release all allocated memory if sha type is invalid
	media: rc: prevent memory leak in cx23888_ir_probe
	sunrpc: check that domain table is empty at module unload.
	ath10k: enable transmit data ack RSSI for QCA9884
	PCI/ASPM: Disable ASPM on ASMedia ASM1083/1085 PCIe-to-PCI bridge
	mm/filemap.c: don't bother dropping mmap_sem for zero size readahead
	ALSA: usb-audio: Add implicit feedback quirk for SSL2
	ALSA: hda/realtek: enable headset mic of ASUS ROG Zephyrus G15(GA502) series with ALC289
	ALSA: hda/realtek: typo_fix: enable headset mic of ASUS ROG Zephyrus G14(GA401) series with ALC289
	ALSA: hda/realtek: Fix add a "ultra_low_power" function for intel reference board (alc256)
	ALSA: hda/realtek - Fixed HP right speaker no sound
	ALSA: hda/hdmi: Fix keep_power assignment for non-component devices
	IB/rdmavt: Fix RQ counting issues causing use of an invalid RWQE
	vhost/scsi: fix up req type endian-ness
	9p/trans_fd: Fix concurrency del of req_list in p9_fd_cancelled/p9_read_work
	wireless: Use offsetof instead of custom macro.
	ARM: 8986/1: hw_breakpoint: Don't invoke overflow handler on uaccess watchpoints
	ARM: dts: imx6sx-sabreauto: Fix the phy-mode on fec2
	ARM: dts: imx6sx-sdb: Fix the phy-mode on fec2
	ARM: dts: imx6qdl-icore: Fix OTG_ID pin and sdcard detect
	virtio_balloon: fix up endian-ness for free cmd id
	Revert "drm/amdgpu: Fix NULL dereference in dpm sysfs handlers"
	drm/amd/display: Clear dm_state for fast updates
	drm/amdgpu: Prevent kernel-infoleak in amdgpu_info_ioctl()
	drm/dbi: Fix SPI Type 1 (9-bit) transfer
	drm: hold gem reference until object is no longer accessed
	rds: Prevent kernel-infoleak in rds_notify_queue_get()
	libtraceevent: Fix build with binutils 2.35
	net/x25: Fix x25_neigh refcnt leak when x25 disconnect
	net/x25: Fix null-ptr-deref in x25_disconnect
	xfrm: policy: match with both mark and mask on user interfaces
	ARM: dts sunxi: Relax a bit the CMA pool allocation range
	xfrm: Fix crash when the hold queue is used.
	ARM: dts: armada-38x: fix NETA lockup when repeatedly switching speeds
	nvme-tcp: fix possible hang waiting for icresp response
	selftests/net: rxtimestamp: fix clang issues for target arch PowerPC
	selftests/net: psock_fanout: fix clang issues for target arch PowerPC
	selftests/net: so_txtime: fix clang issues for target arch PowerPC
	sh/tlb: Fix PGTABLE_LEVELS > 2
	sh: Fix validation of system call number
	net: hns3: fix a TX timeout issue
	net: hns3: fix aRFS FD rules leftover after add a user FD rule
	net/mlx5: E-switch, Destroy TSAR when fail to enable the mode
	net/mlx5e: Fix error path of device attach
	net/mlx5: Verify Hardware supports requested ptp function on a given pin
	net/mlx5e: Modify uplink state on interface up/down
	net/mlx5e: Fix kernel crash when setting vf VLANID on a VF dev
	net: lan78xx: add missing endpoint sanity check
	net: lan78xx: fix transfer-buffer memory leak
	rhashtable: Fix unprotected RCU dereference in __rht_ptr
	mlx4: disable device on shutdown
	mlxsw: core: Increase scope of RCU read-side critical section
	mlxsw: core: Free EMAD transactions using kfree_rcu()
	ibmvnic: Fix IRQ mapping disposal in error path
	bpf: Fix map leak in HASH_OF_MAPS map
	mac80211: mesh: Free ie data when leaving mesh
	mac80211: mesh: Free pending skb when destroying a mpath
	arm64/alternatives: move length validation inside the subsection
	arm64: csum: Fix handling of bad packets
	Bluetooth: fix kernel oops in store_pending_adv_report
	net: nixge: fix potential memory leak in nixge_probe()
	net: gemini: Fix missing clk_disable_unprepare() in error path of gemini_ethernet_port_probe()
	net/mlx5e: fix bpf_prog reference count leaks in mlx5e_alloc_rq
	perf tools: Fix record failure when mixed with ARM SPE event
	vxlan: fix memleak of fdb
	usb: hso: Fix debug compile warning on sparc32
	selftests: fib_nexthop_multiprefix: fix cleanup() netns deletion
	qed: Disable "MFW indication via attention" SPAM every 5 minutes
	selftests: net: ip_defrag: modprobe missing nf_defrag_ipv6 support
	nfc: s3fwrn5: add missing release on skb in s3fwrn5_recv_frame
	scsi: core: Run queue in case of I/O resource contention failure
	parisc: add support for cmpxchg on u8 pointers
	net: ethernet: ravb: exit if re-initialization fails in tx timeout
	Revert "i2c: cadence: Fix the hold bit setting"
	x86/unwind/orc: Fix ORC for newly forked tasks
	x86/stacktrace: Fix reliable check for empty user task stacks
	cxgb4: add missing release on skb in uld_send()
	xen-netfront: fix potential deadlock in xennet_remove()
	RISC-V: Set maximum number of mapped pages correctly
	drivers/net/wan: lapb: Corrected the usage of skb_cow
	KVM: arm64: Don't inherit exec permission across page-table levels
	KVM: LAPIC: Prevent setting the tscdeadline timer if the lapic is hw disabled
	x86/i8259: Use printk_deferred() to prevent deadlock
	perf tests bp_account: Make global variable static
	perf env: Do not return pointers to local variables
	perf bench: Share some global variables to fix build with gcc 10
	Linux 5.4.56

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I06b0147860242cfcac3dd8a7acefdb211020cab1
2020-08-05 11:19:16 +02:00
Steffen Klassert
731e013e33 xfrm: Fix crash when the hold queue is used.
[ Upstream commit 101dde4207f1daa1fda57d714814a03835dccc3f ]

The commits "xfrm: Move dst->path into struct xfrm_dst"
and "net: Create and use new helper xfrm_dst_child()."
changed xfrm bundle handling under the assumption
that xdst->path and dst->child are not a NULL pointer
only if dst->xfrm is not a NULL pointer. That is true
with one exception. If the xfrm hold queue is used
to wait until a SA is installed by the key manager,
we create a dummy bundle without a valid dst->xfrm
pointer. The current xfrm bundle handling crashes
in that case. Fix this by extending the NULL check
of dst->xfrm with a test of the DST_XFRM_QUEUE flag.

Fixes: 0f6c480f23 ("xfrm: Move dst->path into struct xfrm_dst")
Fixes: b92cf4aab8 ("net: Create and use new helper xfrm_dst_child().")
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-08-05 09:59:45 +02:00
Xin Long
0307da6866 xfrm: policy: match with both mark and mask on user interfaces
[ Upstream commit 4f47e8ab6ab796b5380f74866fa5287aca4dcc58 ]

In commit ed17b8d377ea ("xfrm: fix a warning in xfrm_policy_insert_list"),
it would take 'priority' to make a policy unique, and allow duplicated
policies with different 'priority' to be added, which is not expected
by userland, as Tobias reported in strongswan.

To fix this duplicated policies issue, and also fix the issue in
commit ed17b8d377ea ("xfrm: fix a warning in xfrm_policy_insert_list"),
when doing add/del/get/update on user interfaces, this patch is to change
to look up a policy with both mark and mask by doing:

  mark.v == pol->mark.v && mark.m == pol->mark.m

and leave the check:

  (mark & pol->mark.m) == pol->mark.v

for tx/rx path only.

As the userland expects an exact mark and mask match to manage policies.

v1->v2:
  - make xfrm_policy_mark_match inline and fix the changelog as
    Tobias suggested.

Fixes: 295fae5688 ("xfrm: Allow user space manipulation of SPD mark")
Fixes: ed17b8d377ea ("xfrm: fix a warning in xfrm_policy_insert_list")
Reported-by: Tobias Brunner <tobias@strongswan.org>
Tested-by: Tobias Brunner <tobias@strongswan.org>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-08-05 09:59:44 +02:00
Greg Kroah-Hartman
68815d5b7e Revert "genetlink: remove genl_bind"
This reverts commit 7b42410d35 which is
commit 1e82a62fec613844da9e558f3493540a5b7a7b67 upstream.

It breaks the API and isn't something we should really have to worry
about in android devices.

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I4ec83063705a9f0fe449ff46803f6594b69efd08
2020-07-23 12:38:44 +02:00
Greg Kroah-Hartman
171202d5b0 This is the 5.4.53 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl8X674ACgkQONu9yGCS
 aT5F9g/+PdG5XSPhoGEhO2FW43cQKuGp5vWJ3IhVFyEXFdboWIa5laWNBh1ZC/Kg
 Ua0vxBGGJDTGZNTJAQd6Re1RfAbptEstrNlwC3BaxUQn5Qn4YQMCNbAeFEj7D2nw
 Tez3r3gjpGc9uo0EqfeJStqhFZfh+D3apHz1/RFZ/12T5d4dIEtCXDUAP89zib0w
 lHBOH37Mc0WqXSUPLdabIbemlbZv4prYn7gnzIeoxl3h+TKzdjM4pGjrjzKJwy2D
 9XDB3Dw9BA225uoextJl3GCOm7IF+TGaR10YxuHCtxJAkdPSt2BUUAFC0XrV7KPw
 fGMy8/a8EZj5PoNNjKHzDD2IJf9PhLZgcn7AjOW6x9XXu7lJls4Wx4/k5TpIO1I1
 paO8kGex8jk751X4U1Bu8LowLPjiL3fKp0lSeysSw9IIzTBW1DlhSR9Mf/CEihib
 xbS6k8/uF9HGtYJKIW4o/iL/3D0MGKTuOX18tlhnZ92Hp5WcAEZKrUKgYTY/exvF
 WDYDRSFv17tw6XT7Jfey3veP1z+3kVMZ3KD0CnpJ7poS/f8H730yyEgIDO0dRO3I
 Rd1r/uCmgr0GkeNDp46eoTYCgvhCQruxWul0/6/pw4VdzIBSRlPjsZBR+2Frnmuw
 dRim972ocnvVzxKe1N2fD+whfjok85h30Xg7uvFgZGEZ7/wOUL8=
 =mqst
 -----END PGP SIGNATURE-----

Merge 5.4.53 into android11-5.4

Changes in 5.4.53
	crypto: atmel - Fix selection of CRYPTO_AUTHENC
	crypto: atmel - Fix build error of CRYPTO_AUTHENC
	net: atlantic: fix ip dst and ipv6 address filters
	net: rmnet: fix lower interface leak
	bridge: mcast: Fix MLD2 Report IPv6 payload length check
	genetlink: remove genl_bind
	ipv4: fill fl4_icmp_{type,code} in ping_v4_sendmsg
	ipv6: fib6_select_path can not use out path for nexthop objects
	ipv6: Fix use of anycast address with loopback
	l2tp: remove skb_dst_set() from l2tp_xmit_skb()
	llc: make sure applications use ARPHRD_ETHER
	net: Added pointer check for dst->ops->neigh_lookup in dst_neigh_lookup_skb
	net: dsa: microchip: set the correct number of ports
	net_sched: fix a memory leak in atm_tc_init()
	net: usb: qmi_wwan: add support for Quectel EG95 LTE modem
	sched: consistently handle layer3 header accesses in the presence of VLANs
	tcp: fix SO_RCVLOWAT possible hangs under high mem pressure
	tcp: make sure listeners don't initialize congestion-control state
	tcp: md5: add missing memory barriers in tcp_md5_do_add()/tcp_md5_hash_key()
	tcp: md5: do not send silly options in SYNCOOKIES
	vlan: consolidate VLAN parsing code and limit max parsing depth
	tcp: md5: refine tcp_md5_do_add()/tcp_md5_hash_key() barriers
	tcp: md5: allow changing MD5 keys in all socket states
	cgroup: fix cgroup_sk_alloc() for sk_clone_lock()
	cgroup: Fix sock_cgroup_data on big-endian.
	ip: Fix SO_MARK in RST, ACK and ICMP packets
	arm64: Introduce a way to disable the 32bit vdso
	arm64: arch_timer: Allow an workaround descriptor to disable compat vdso
	arm64: arch_timer: Disable the compat vdso for cores affected by ARM64_WORKAROUND_1418040
	drm/msm: fix potential memleak in error branch
	drm/msm/dpu: allow initialization of encoder locks during encoder init
	drm/exynos: Properly propagate return value in drm_iommu_attach_device()
	drm/exynos: fix ref count leak in mic_pre_enable
	x86/fpu: Reset MXCSR to default in kernel_fpu_begin()
	thermal/drivers: imx: Fix missing of_node_put() at probe time
	blk-mq-debugfs: update blk_queue_flag_name[] accordingly for new flags
	m68k: nommu: register start of the memory with memblock
	m68k: mm: fix node memblock init
	dt-bindings: mailbox: zynqmp_ipi: fix unit address
	cifs: prevent truncation from long to int in wait_for_free_credits
	arm64/alternatives: use subsections for replacement sequences
	tpm_tis: extra chip->ops check on error path in tpm_tis_core_init
	gfs2: read-only mounts should grab the sd_freeze_gl glock
	i2c: eg20t: Load module automatically if ID matches
	arm64/alternatives: don't patch up internal branches
	iio:magnetometer:ak8974: Fix alignment and data leak issues
	iio:humidity:hdc100x Fix alignment and data leak issues
	iio: magnetometer: ak8974: Fix runtime PM imbalance on error
	iio: core: add missing IIO_MOD_H2/ETHANOL string identifiers
	iio: mma8452: Add missed iio_device_unregister() call in mma8452_probe()
	iio: pressure: zpa2326: handle pm_runtime_get_sync failure
	iio:humidity:hts221 Fix alignment and data leak issues
	iio:pressure:ms5611 Fix buffer element alignment
	iio:health:afe4403 Fix timestamp alignment and prevent data leak.
	spi: spi-fsl-dspi: Fix lockup if device is shutdown during SPI transfer
	net: dsa: bcm_sf2: Fix node reference count
	of: of_mdio: Correct loop scanning logic
	net: macb: call pm_runtime_put_sync on failure path
	net: ethernet: mvneta: Do not error out in non serdes modes
	net: ethernet: mvneta: Add back interface mode validation
	Revert "usb/ohci-platform: Fix a warning when hibernating"
	Revert "usb/ehci-platform: Set PM runtime as active on resume"
	Revert "usb/xhci-plat: Set PM runtime as active on resume"
	net: sfp: add support for module quirks
	net: sfp: add some quirks for GPON modules
	ARM: OMAP4+: remove pdata quirks for omap4+ iommus
	ARM: OMAP2+: Add workaround for DRA7 DSP MStandby errata i879
	ARM: OMAP2+: use separate IOMMU pdata to fix DRA7 IPU1 boot
	mmc: mmci: Support any block sizes for ux500v2 and qcom variant
	HID: quirks: Remove ITE 8595 entry from hid_have_special_driver
	ARM: at91: pm: add quirk for sam9x60's ulp1
	drm/sun4i: tcon: Separate quirks for tcon0 and tcon1 on A20
	scsi: sr: remove references to BLK_DEV_SR_VENDOR, leave it enabled
	bus: ti-sysc: Rename clk related quirks to pre_reset and post_reset quirks
	bus: ti-sysc: Consider non-existing registers too when matching quirks
	bus: ti-sysc: Handle module unlock quirk needed for some RTC
	bus: ti-sysc: Detect display subsystem related devices
	arm64: dts: g12-common: add parkmode_disable_ss_quirk on DWC3 controller
	bus: ti-sysc: Detect EDMA and set quirk flags for tptc
	ALSA: usb-audio: Add support for MOTU MicroBook IIc
	Input: goodix - fix touch coordinates on Cube I15-TC
	ALSA: usb-audio: Create a registration quirk for Kingston HyperX Amp (0951:16d8)
	doc: dt: bindings: usb: dwc3: Update entries for disabling SS instances in park mode
	mmc: sdhci: do not enable card detect interrupt for gpio cd type
	ALSA: usb-audio: Rewrite registration quirk handling
	ACPI: video: Use native backlight on Acer Aspire 5783z
	ALSA: usb-audio: Add registration quirk for Kingston HyperX Cloud Alpha S
	ALSA: usb-audio: Add quirk for Focusrite Scarlett 2i2
	Input: mms114 - add extra compatible for mms345l
	ACPI: video: Use native backlight on Acer TravelMate 5735Z
	bus: ti-sysc: Use optional clocks on for enable and wait for softreset bit
	ALSA: usb-audio: Add registration quirk for Kingston HyperX Cloud Flight S
	iio:health:afe4404 Fix timestamp alignment and prevent data leak.
	soundwire: intel: fix memory leak with devm_kasprintf
	dmaengine: sh: usb-dmac: set tx_result parameters
	phy: sun4i-usb: fix dereference of pointer phy0 before it is null checked
	arm64: dts: meson: add missing gxl rng clock
	arm64: dts: meson-gxl-s805x: reduce initial Mali450 core frequency
	bus: ti-sysc: Fix wakeirq sleeping function called from invalid context
	bus: ti-sysc: Fix sleeping function called from invalid context for RTC quirk
	bus: ti-sysc: Do not disable on suspend for no-idle
	iio: adc: ad7780: Fix a resource handling path in 'ad7780_probe()'
	dmaengine: dw: Initialize channel before each transfer
	dmaengine: dmatest: stop completed threads when running without set channel
	spi: spi-sun6i: sun6i_spi_transfer_one(): fix setting of clock rate
	usb: gadget: udc: atmel: fix uninitialized read in debug printk
	staging: comedi: verify array index is correct before using it
	clk: mvebu: ARMADA_AP_CPU_CLK needs to select ARMADA_AP_CP_HELPER
	clk: AST2600: Add mux for EMMC clock
	NFS: Fix interrupted slots by sending a solo SEQUENCE operation
	fuse: don't ignore errors from fuse_writepages_fill()
	ARM: dts: Fix dcan driver probe failed on am437x platform
	Revert "thermal: mediatek: fix register index error"
	xprtrdma: fix incorrect header size calculations
	ARM: dts: socfpga: Align L2 cache-controller nodename with dtschema
	arm64: dts: spcfpga: Align GIC, NAND and UART nodenames with dtschema
	keys: asymmetric: fix error return code in software_key_query()
	regmap: debugfs: Don't sleep while atomic for fast_io regmaps
	copy_xstate_to_kernel: Fix typo which caused GDB regression
	arm: dts: mt7623: add phy-mode property for gmac2
	soc: qcom: socinfo: add missing soc_id sysfs entry
	apparmor: ensure that dfa state tables have entries
	habanalabs: Align protection bits configuration of all TPCs
	PCI/PM: Call .bridge_d3() hook only if non-NULL
	perf stat: Zero all the 'ena' and 'run' array slot stats for interval mode
	soc: qcom: rpmh: Update dirty flag only when data changes
	soc: qcom: rpmh: Invalidate SLEEP and WAKE TCSes before flushing new data
	soc: qcom: rpmh-rsc: Clear active mode configuration for wake TCS
	soc: qcom: rpmh-rsc: Allow using free WAKE TCS for active request
	RDMA/mlx5: Verify that QP is created with RQ or SQ
	mtd: rawnand: marvell: Fix the condition on a return code
	mtd: rawnand: marvell: Use nand_cleanup() when the device is not yet registered
	mtd: rawnand: marvell: Fix probe error path
	mtd: rawnand: timings: Fix default tR_max and tCCS_min timings
	mtd: rawnand: brcmnand: correctly verify erased pages
	mtd: rawnand: brcmnand: fix CS0 layout
	mtd: rawnand: oxnas: Keep track of registered devices
	mtd: rawnand: oxnas: Unregister all devices on error
	mtd: rawnand: oxnas: Release all devices in the _remove() path
	clk: qcom: gcc: Add GPU and NPU clocks for SM8150
	clk: qcom: gcc: Add missing UFS clocks for SM8150
	slimbus: core: Fix mismatch in of_node_get/put
	HID: logitech-hidpp: avoid repeated "multiplier = " log messages
	HID: magicmouse: do not set up autorepeat
	HID: quirks: Always poll Obins Anne Pro 2 keyboard
	HID: quirks: Ignore Simply Automated UPB PIM
	ALSA: line6: Perform sanity check for each URB creation
	ALSA: line6: Sync the pending work cancel at disconnection
	ALSA: usb-audio: Fix race against the error recovery URB submission
	ALSA: hda/realtek - change to suitable link model for ASUS platform
	ALSA: hda/realtek: enable headset mic of ASUS ROG Zephyrus G14(G401) series with ALC289
	ALSA: hda/realtek: Enable headset mic of Acer TravelMate B311R-31 with ALC256
	ALSA: hda/realtek - Enable Speaker for ASUS UX533 and UX534
	ALSA: hda/realtek - Enable Speaker for ASUS UX563
	USB: c67x00: fix use after free in c67x00_giveback_urb
	usb: dwc2: Fix shutdown callback in platform
	usb: chipidea: core: add wakeup support for extcon
	usb: gadget: function: fix missing spinlock in f_uac1_legacy
	USB: serial: iuu_phoenix: fix memory corruption
	USB: serial: cypress_m8: enable Simply Automated UPB PIM
	USB: serial: ch341: add new Product ID for CH340
	USB: serial: option: add GosunCn GM500 series
	USB: serial: option: add Quectel EG95 LTE modem
	virt: vbox: Fix VBGL_IOCTL_VMMDEV_REQUEST_BIG and _LOG req numbers to match upstream
	virt: vbox: Fix guest capabilities mask check
	Revert "tty: xilinx_uartps: Fix missing id assignment to the console"
	virtio: virtio_console: add missing MODULE_DEVICE_TABLE() for rproc serial
	serial: mxs-auart: add missed iounmap() in probe failure and remove
	ovl: fix regression with re-formatted lower squashfs
	ovl: inode reference leak in ovl_is_inuse true case.
	ovl: relax WARN_ON() when decoding lower directory file handle
	ovl: fix unneeded call to ovl_change_flags()
	fuse: ignore 'data' argument of mount(..., MS_REMOUNT)
	fuse: use ->reconfigure() instead of ->remount_fs()
	fuse: Fix parameter for FS_IOC_{GET,SET}FLAGS
	Revert "zram: convert remaining CLASS_ATTR() to CLASS_ATTR_RO()"
	mei: bus: don't clean driver pointer
	Input: i8042 - add Lenovo XiaoXin Air 12 to i8042 nomux list
	Input: elan_i2c - add more hardware ID for Lenovo laptops
	uio_pdrv_genirq: Remove warning when irq is not specified
	uio_pdrv_genirq: fix use without device tree and no interrupt
	scsi: megaraid_sas: Remove undefined ENABLE_IRQ_POLL macro
	timer: Prevent base->clk from moving backward
	timer: Fix wheel index calculation on last level
	riscv: use 16KB kernel stack on 64-bit
	hwmon: (emc2103) fix unable to change fan pwm1_enable attribute
	powerpc/book3s64/pkeys: Fix pkey_access_permitted() for execute disable pkey
	powerpc/pseries/svm: Fix incorrect check for shared_lppaca_size
	intel_th: pci: Add Jasper Lake CPU support
	intel_th: pci: Add Tiger Lake PCH-H support
	intel_th: pci: Add Emmitsburg PCH support
	intel_th: Fix a NULL dereference when hub driver is not loaded
	dmaengine: fsl-edma: Fix NULL pointer exception in fsl_edma_tx_handler
	dmaengine: mcf-edma: Fix NULL pointer exception in mcf_edma_tx_handler
	dmaengine: fsl-edma-common: correct DSIZE_32BYTE
	misc: atmel-ssc: lock with mutex instead of spinlock
	thermal: int3403_thermal: Downgrade error message
	thermal/drivers/cpufreq_cooling: Fix wrong frequency converted from power
	arm64: ptrace: Override SPSR.SS when single-stepping is enabled
	arm64: ptrace: Consistently use pseudo-singlestep exceptions
	arm64: compat: Ensure upper 32 bits of x0 are zero on syscall return
	sched: Fix unreliable rseq cpu_id for new tasks
	sched/fair: handle case of task_h_load() returning 0
	genirq/affinity: Handle affinity setting on inactive interrupts correctly
	drm/amdgpu/sdma5: fix wptr overwritten in ->get_wptr()
	drm/i915/gt: Ignore irq enabling on the virtual engines
	block: fix splitting segments on boundary masks
	block: fix get_max_segment_size() overflow on 32bit arch
	libceph: don't omit recovery_deletes in target_copy()
	rxrpc: Fix trace string
	spi: sprd: switch the sequence of setting WDG_LOAD_LOW and _HIGH
	ionic: export features for vlans to use
	iommu/vt-d: Make Intel SVM code 64-bit only
	drm/i915/gvt: Fix two CFL MMIO handling caused by regression.
	gpio: pca953x: disable regmap locking for automatic address incrementing
	Linux 5.4.53

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I2347f0f12d1e95a90cff2f3999940e1f82231df2
2020-07-23 12:36:54 +02:00
Toke Høiland-Jørgensen
9b7fd81cf9 sched: consistently handle layer3 header accesses in the presence of VLANs
[ Upstream commit d7bf2ebebc2bd61ab95e2a8e33541ef282f303d4 ]

There are a couple of places in net/sched/ that check skb->protocol and act
on the value there. However, in the presence of VLAN tags, the value stored
in skb->protocol can be inconsistent based on whether VLAN acceleration is
enabled. The commit quoted in the Fixes tag below fixed the users of
skb->protocol to use a helper that will always see the VLAN ethertype.

However, most of the callers don't actually handle the VLAN ethertype, but
expect to find the IP header type in the protocol field. This means that
things like changing the ECN field, or parsing diffserv values, stops
working if there's a VLAN tag, or if there are multiple nested VLAN
tags (QinQ).

To fix this, change the helper to take an argument that indicates whether
the caller wants to skip the VLAN tags or not. When skipping VLAN tags, we
make sure to skip all of them, so behaviour is consistent even in QinQ
mode.

To make the helper usable from the ECN code, move it to if_vlan.h instead
of pkt_sched.h.

v3:
- Remove empty lines
- Move vlan variable definitions inside loop in skb_protocol()
- Also use skb_protocol() helper in IP{,6}_ECN_decapsulate() and
  bpf_skb_ecn_set_ce()

v2:
- Use eth_type_vlan() helper in skb_protocol()
- Also fix code that reads skb->protocol directly
- Change a couple of 'if/else if' statements to switch constructs to avoid
  calling the helper twice

Reported-by: Ilya Ponetayev <i.ponetaev@ndmsystems.com>
Fixes: d8b9605d26 ("net: sched: fix skb->protocol use in case of accelerated vlan path")
Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-07-22 09:32:48 +02:00
Martin Varghese
64d7822126 net: Added pointer check for dst->ops->neigh_lookup in dst_neigh_lookup_skb
[ Upstream commit 394de110a73395de2ca4516b0de435e91b11b604 ]

The packets from tunnel devices (eg bareudp) may have only
metadata in the dst pointer of skb. Hence a pointer check of
neigh_lookup is needed in dst_neigh_lookup_skb

Kernel crashes when packets from bareudp device is processed in
the kernel neighbour subsytem.

[  133.384484] BUG: kernel NULL pointer dereference, address: 0000000000000000
[  133.385240] #PF: supervisor instruction fetch in kernel mode
[  133.385828] #PF: error_code(0x0010) - not-present page
[  133.386603] PGD 0 P4D 0
[  133.386875] Oops: 0010 [#1] SMP PTI
[  133.387275] CPU: 0 PID: 5045 Comm: ping Tainted: G        W         5.8.0-rc2+ #15
[  133.388052] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
[  133.391076] RIP: 0010:0x0
[  133.392401] Code: Bad RIP value.
[  133.394029] RSP: 0018:ffffb79980003d50 EFLAGS: 00010246
[  133.396656] RAX: 0000000080000102 RBX: ffff9de2fe0d6600 RCX: ffff9de2fe5e9d00
[  133.399018] RDX: 0000000000000000 RSI: ffff9de2fe5e9d00 RDI: ffff9de2fc21b400
[  133.399685] RBP: ffff9de2fe5e9d00 R08: 0000000000000000 R09: 0000000000000000
[  133.400350] R10: ffff9de2fbc6be22 R11: ffff9de2fe0d6600 R12: ffff9de2fc21b400
[  133.401010] R13: ffff9de2fe0d6628 R14: 0000000000000001 R15: 0000000000000003
[  133.401667] FS:  00007fe014918740(0000) GS:ffff9de2fec00000(0000) knlGS:0000000000000000
[  133.402412] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  133.402948] CR2: ffffffffffffffd6 CR3: 000000003bb72000 CR4: 00000000000006f0
[  133.403611] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  133.404270] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  133.404933] Call Trace:
[  133.405169]  <IRQ>
[  133.405367]  __neigh_update+0x5a4/0x8f0
[  133.405734]  arp_process+0x294/0x820
[  133.406076]  ? __netif_receive_skb_core+0x866/0xe70
[  133.406557]  arp_rcv+0x129/0x1c0
[  133.406882]  __netif_receive_skb_one_core+0x95/0xb0
[  133.407340]  process_backlog+0xa7/0x150
[  133.407705]  net_rx_action+0x2af/0x420
[  133.408457]  __do_softirq+0xda/0x2a8
[  133.408813]  asm_call_on_stack+0x12/0x20
[  133.409290]  </IRQ>
[  133.409519]  do_softirq_own_stack+0x39/0x50
[  133.410036]  do_softirq+0x50/0x60
[  133.410401]  __local_bh_enable_ip+0x50/0x60
[  133.410871]  ip_finish_output2+0x195/0x530
[  133.411288]  ip_output+0x72/0xf0
[  133.411673]  ? __ip_finish_output+0x1f0/0x1f0
[  133.412122]  ip_send_skb+0x15/0x40
[  133.412471]  raw_sendmsg+0x853/0xab0
[  133.412855]  ? insert_pfn+0xfe/0x270
[  133.413827]  ? vvar_fault+0xec/0x190
[  133.414772]  sock_sendmsg+0x57/0x80
[  133.415685]  __sys_sendto+0xdc/0x160
[  133.416605]  ? syscall_trace_enter+0x1d4/0x2b0
[  133.417679]  ? __audit_syscall_exit+0x1d9/0x280
[  133.418753]  ? __prepare_exit_to_usermode+0x5d/0x1a0
[  133.419819]  __x64_sys_sendto+0x24/0x30
[  133.420848]  do_syscall_64+0x4d/0x90
[  133.421768]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[  133.422833] RIP: 0033:0x7fe013689c03
[  133.423749] Code: Bad RIP value.
[  133.424624] RSP: 002b:00007ffc7288f418 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
[  133.425940] RAX: ffffffffffffffda RBX: 000056151fc63720 RCX: 00007fe013689c03
[  133.427225] RDX: 0000000000000040 RSI: 000056151fc63720 RDI: 0000000000000003
[  133.428481] RBP: 00007ffc72890b30 R08: 000056151fc60500 R09: 0000000000000010
[  133.429757] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000040
[  133.431041] R13: 000056151fc636e0 R14: 000056151fc616bc R15: 0000000000000080
[  133.432481] Modules linked in: mpls_iptunnel act_mirred act_tunnel_key cls_flower sch_ingress veth mpls_router ip_tunnel bareudp ip6_udp_tunnel udp_tunnel macsec udp_diag inet_diag unix_diag af_packet_diag netlink_diag binfmt_misc xt_MASQUERADE iptable_nat xt_addrtype xt_conntrack nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 br_netfilter bridge stp llc ebtable_filter ebtables overlay ip6table_filter ip6_tables iptable_filter sunrpc ext4 mbcache jbd2 pcspkr i2c_piix4 virtio_balloon joydev ip_tables xfs libcrc32c ata_generic qxl pata_acpi drm_ttm_helper ttm drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm ata_piix libata virtio_net net_failover virtio_console failover virtio_blk i2c_core virtio_pci virtio_ring serio_raw floppy virtio dm_mirror dm_region_hash dm_log dm_mod
[  133.444045] CR2: 0000000000000000
[  133.445082] ---[ end trace f4aeee1958fd1638 ]---
[  133.446236] RIP: 0010:0x0
[  133.447180] Code: Bad RIP value.
[  133.448152] RSP: 0018:ffffb79980003d50 EFLAGS: 00010246
[  133.449363] RAX: 0000000080000102 RBX: ffff9de2fe0d6600 RCX: ffff9de2fe5e9d00
[  133.450835] RDX: 0000000000000000 RSI: ffff9de2fe5e9d00 RDI: ffff9de2fc21b400
[  133.452237] RBP: ffff9de2fe5e9d00 R08: 0000000000000000 R09: 0000000000000000
[  133.453722] R10: ffff9de2fbc6be22 R11: ffff9de2fe0d6600 R12: ffff9de2fc21b400
[  133.455149] R13: ffff9de2fe0d6628 R14: 0000000000000001 R15: 0000000000000003
[  133.456520] FS:  00007fe014918740(0000) GS:ffff9de2fec00000(0000) knlGS:0000000000000000
[  133.458046] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  133.459342] CR2: ffffffffffffffd6 CR3: 000000003bb72000 CR4: 00000000000006f0
[  133.460782] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  133.462240] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  133.463697] Kernel panic - not syncing: Fatal exception in interrupt
[  133.465226] Kernel Offset: 0xfa00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
[  133.467025] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---

Fixes: aaa0c23cb9 ("Fix dst_neigh_lookup/dst_neigh_lookup_skb return value handling bug")
Signed-off-by: Martin Varghese <martin.varghese@nokia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-07-22 09:32:47 +02:00
Sean Tranchetti
7b42410d35 genetlink: remove genl_bind
[ Upstream commit 1e82a62fec613844da9e558f3493540a5b7a7b67 ]

A potential deadlock can occur during registering or unregistering a
new generic netlink family between the main nl_table_lock and the
cb_lock where each thread wants the lock held by the other, as
demonstrated below.

1) Thread 1 is performing a netlink_bind() operation on a socket. As part
   of this call, it will call netlink_lock_table(), incrementing the
   nl_table_users count to 1.
2) Thread 2 is registering (or unregistering) a genl_family via the
   genl_(un)register_family() API. The cb_lock semaphore will be taken for
   writing.
3) Thread 1 will call genl_bind() as part of the bind operation to handle
   subscribing to GENL multicast groups at the request of the user. It will
   attempt to take the cb_lock semaphore for reading, but it will fail and
   be scheduled away, waiting for Thread 2 to finish the write.
4) Thread 2 will call netlink_table_grab() during the (un)registration
   call. However, as Thread 1 has incremented nl_table_users, it will not
   be able to proceed, and both threads will be stuck waiting for the
   other.

genl_bind() is a noop, unless a genl_family implements the mcast_bind()
function to handle setting up family-specific multicast operations. Since
no one in-tree uses this functionality as Cong pointed out, simply removing
the genl_bind() function will remove the possibility for deadlock, as there
is no attempt by Thread 1 above to take the cb_lock semaphore.

Fixes: c380d9a7af ("genetlink: pass multicast bind/unbind to families")
Suggested-by: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: Johannes Berg <johannes.berg@intel.com>
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Sean Tranchetti <stranche@codeaurora.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-07-22 09:32:46 +02:00
Greg Kroah-Hartman
a200ad52ff Linux 5.4.50
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE4n5dijQDou9mhzu83qZv95d3LNwFAl77nuMACgkQ3qZv95d3
 LNw0EA//UhQOd/8ZlP33Iis58gUfuGU9sWmej6A8Tio2gdkG4g2c/dQjbxrMQT8b
 Vr1DJCthisT7pBJpQbhejwsfl5qRsrjBYFyUomCjeM8/0fF0+8JX0tSXX0/JM5Bg
 vOE4tV/kga+c5cbOD/FbLGH0vX4j20BnGXjHb9hyWY/gVp2gEcRzO3Ou0shZCXKJ
 9NnhNB2gIm7BCRgz+cClPmZQjG59WazJu9I/Fk58ojdOp+E5gFibyBoeOylGR/W/
 tjRm3Sz6D3uF0RSpGfAilqt2duwfjHTh0LxWlBX9C4OBWdJjYh1uUZ24tTvjxnCm
 lbgL4BbkOsVMp02jWhDDCe+pEPfT7EpLD6USivj8XFDLh8FK0eoaRQZRQ/hGK/Yj
 ZmVJRzNavf3xbz72Hz6aHdHmaxp180P8X8KtRDLT4ik+Kkf8gJVps3T5wTR9C60R
 htFVTDxEF+jE/EUCRh3sD4MrV114lpoJ5LlTPzJ87WCMHMjTZ8As/Ty/PLPg7KO6
 ngI3y72cnvW/UfLPmdtaLx40gzEAYnw9+E30ebyKU6b8kY5idhuzd0AZnidsmeZa
 CzmZFZSCqqMO9vLo24VKxfKk3ufRiHxDU/nHqdGgOG18RlCmhWD0GXamsmeku3PB
 1et/jXilpW9aIp/BJozeOdlGr82otk/4Ss+z/RtvvIkTbppgXlY=
 =6X7m
 -----END PGP SIGNATURE-----

Merge 5.4.50 into android-5.4-stable

Changes in 5.4.50
	block/bio-integrity: don't free 'buf' if bio_integrity_add_page() failed
	enetc: Fix tx rings bitmap iteration range, irq handling
	geneve: allow changing DF behavior after creation
	ibmveth: Fix max MTU limit
	mld: fix memory leak in ipv6_mc_destroy_dev()
	mvpp2: ethtool rxtx stats fix
	net: bridge: enfore alignment for ethernet address
	net: core: reduce recursion limit value
	net: Do not clear the sock TX queue in sk_set_socket()
	net: fix memleak in register_netdevice()
	net: Fix the arp error in some cases
	net: increment xmit_recursion level in dev_direct_xmit()
	net: usb: ax88179_178a: fix packet alignment padding
	openvswitch: take into account de-fragmentation/gso_size in execute_check_pkt_len
	rocker: fix incorrect error handling in dma_rings_init
	rxrpc: Fix notification call on completion of discarded calls
	sctp: Don't advertise IPv4 addresses if ipv6only is set on the socket
	tcp: don't ignore ECN CWR on pure ACK
	tcp: grow window for OOO packets only for SACK flows
	tg3: driver sleeps indefinitely when EEH errors exceed eeh_max_freezes
	ip6_gre: fix use-after-free in ip6gre_tunnel_lookup()
	net: phy: Check harder for errors in get_phy_id()
	ip_tunnel: fix use-after-free in ip_tunnel_lookup()
	sch_cake: don't try to reallocate or unshare skb unconditionally
	sch_cake: don't call diffserv parsing code when it is not needed
	sch_cake: fix a few style nits
	tcp_cubic: fix spurious HYSTART_DELAY exit upon drop in min RTT
	Revert "i2c: tegra: Fix suspending in active runtime PM state"
	btrfs: fix a block group ref counter leak after failure to remove block group
	net: sched: export __netdev_watchdog_up()
	fix a braino in "sparc32: fix register window handling in genregs32_[gs]et()"
	ALSA: usb-audio: Fix potential use-after-free of streams
	binder: fix null deref of proc->context
	USB: ohci-sm501: Add missed iounmap() in remove
	usb: dwc2: Postponed gadget registration to the udc class driver
	usb: add USB_QUIRK_DELAY_INIT for Logitech C922
	USB: ehci: reopen solution for Synopsys HC bug
	usb: host: xhci-mtk: avoid runtime suspend when removing hcd
	xhci: Poll for U0 after disabling USB2 LPM
	usb: host: ehci-exynos: Fix error check in exynos_ehci_probe()
	usb: typec: tcpci_rt1711h: avoid screaming irq causing boot hangs
	ALSA: usb-audio: Add implicit feedback quirk for SSL2+.
	ALSA: usb-audio: add quirk for Denon DCD-1500RE
	ALSA: usb-audio: add quirk for Samsung USBC Headset (AKG)
	ALSA: usb-audio: Fix OOB access of mixer element list
	usb: cdns3: trace: using correct dir value
	usb: cdns3: ep0: fix the test mode set incorrectly
	usb: cdns3: ep0: add spinlock for cdns3_check_new_setup
	scsi: qla2xxx: Keep initiator ports after RSCN
	scsi: zfcp: Fix panic on ERP timeout for previously dismissed ERP action
	cifs: Fix cached_fid refcnt leak in open_shroot
	cifs/smb3: Fix data inconsistent when punch hole
	cifs/smb3: Fix data inconsistent when zero file range
	xhci: Fix incorrect EP_STATE_MASK
	xhci: Fix enumeration issue when setting max packet size for FS devices.
	xhci: Return if xHCI doesn't support LPM
	cdc-acm: Add DISABLE_ECHO quirk for Microchip/SMSC chip
	loop: replace kill_bdev with invalidate_bdev
	IB/mad: Fix use after free when destroying MAD agent
	IB/hfi1: Fix module use count flaw due to leftover module put calls
	bus: ti-sysc: Flush posted write on enable and disable
	bus: ti-sysc: Ignore clockactivity unless specified as a quirk
	ARM: OMAP2+: Fix legacy mode dss_reset
	xfrm: Fix double ESP trailer insertion in IPsec crypto offload.
	ASoC: q6asm: handle EOS correctly
	efi/tpm: Verify event log header before parsing
	efi/esrt: Fix reference count leak in esre_create_sysfs_entry.
	ASoc: q6afe: add support to get port direction
	ASoC: qcom: common: set correct directions for dailinks
	regualtor: pfuze100: correct sw1a/sw2 on pfuze3000
	RDMA/siw: Fix pointer-to-int-cast warning in siw_rx_pbl()
	ASoC: fsl_ssi: Fix bclk calculation for mono channel
	samples/bpf: xdp_redirect_cpu: Set MAX_CPUS according to NR_CPUS
	bpf, xdp, samples: Fix null pointer dereference in *_user code
	ARM: dts: am335x-pocketbeagle: Fix mmc0 Write Protect
	ARM: dts: Fix duovero smsc interrupt for suspend
	x86/resctrl: Fix a NULL vs IS_ERR() static checker warning in rdt_cdp_peer_get()
	regmap: Fix memory leak from regmap_register_patch
	devmap: Use bpf_map_area_alloc() for allocating hash buckets
	bpf: Don't return EINVAL from {get,set}sockopt when optlen > PAGE_SIZE
	ARM: dts: NSP: Correct FA2 mailbox node
	rxrpc: Fix handling of rwind from an ACK packet
	RDMA/rvt: Fix potential memory leak caused by rvt_alloc_rq
	RDMA/qedr: Fix KASAN: use-after-free in ucma_event_handler+0x532
	RDMA/cma: Protect bind_list and listen_list while finding matching cm id
	ASoC: rockchip: Fix a reference count leak.
	s390/qeth: fix error handling for isolation mode cmds
	RDMA/mad: Fix possible memory leak in ib_mad_post_receive_mads()
	selftests/net: report etf errors correctly
	iommu/vt-d: Enable PCI ACS for platform opt in hint
	iommu/vt-d: Update scalable mode paging structure coherency
	net: qed: fix left elements count calculation
	net: qed: fix async event callbacks unregistering
	net: qede: stop adding events on an already destroyed workqueue
	net: qed: fix NVMe login fails over VFs
	net: qed: fix excessive QM ILT lines consumption
	net: qede: fix PTP initialization on recovery
	net: qede: fix use-after-free on recovery and AER handling
	cxgb4: move handling L2T ARP failures to caller
	ARM: imx5: add missing put_device() call in imx_suspend_alloc_ocram()
	scsi: lpfc: Avoid another null dereference in lpfc_sli4_hba_unset()
	usb: gadget: udc: Potential Oops in error handling code
	usb: renesas_usbhs: getting residue from callback_result
	nvme: don't protect ns mutation with ns->head->lock
	netfilter: ipset: fix unaligned atomic access
	net: bcmgenet: use hardware padding of runt frames
	clk: sifive: allocate sufficient memory for struct __prci_data
	i2c: fsi: Fix the port number field in status register
	i2c: core: check returned size of emulated smbus block read
	afs: Fix storage of cell names
	sched/deadline: Initialize ->dl_boosted
	sched/core: Fix PI boosting between RT and DEADLINE tasks
	sata_rcar: handle pm_runtime_get_sync failure cases
	ata/libata: Fix usage of page address by page_address in ata_scsi_mode_select_xlat function
	drm/amd/display: Use kfree() to free rgb_user in calculate_user_regamma_ramp()
	riscv/atomic: Fix sign extension for RV64I
	hwrng: ks-sa - Fix runtime PM imbalance on error
	ibmvnic: Harden device login requests
	net: alx: fix race condition in alx_remove
	test_objagg: Fix potential memory leak in error handling
	pinctrl: qcom: spmi-gpio: fix warning about irq chip reusage
	pinctrl: tegra: Use noirq suspend/resume callbacks
	s390/ptrace: pass invalid syscall numbers to tracing
	s390/ptrace: fix setting syscall number
	s390/vdso: Use $(LD) instead of $(CC) to link vDSO
	s390/vdso: fix vDSO clock_getres()
	arm64: sve: Fix build failure when ARM64_SVE=y and SYSCTL=n
	kbuild: improve cc-option to clean up all temporary files
	recordmcount: support >64k sections
	kprobes: Suppress the suspicious RCU warning on kprobes
	blktrace: break out of blktrace setup on concurrent calls
	block: update hctx map when use multiple maps
	RISC-V: Don't allow write+exec only page mapping request in mmap
	ALSA: hda: Add NVIDIA codec IDs 9a & 9d through a0 to patch table
	ALSA: hda/realtek - Add quirk for MSI GE63 laptop
	ALSA: hda/realtek: Add mute LED and micmute LED support for HP systems
	ACPI: sysfs: Fix pm_profile_attr type
	ACPI: configfs: Disallow loading ACPI tables when locked down
	erofs: fix partially uninitialized misuse in z_erofs_onlinepage_fixup
	KVM: X86: Fix MSR range of APIC registers in X2APIC mode
	KVM: nVMX: Plumb L2 GPA through to PML emulation
	KVM: VMX: Stop context switching MSR_IA32_UMWAIT_CONTROL
	x86/cpu: Use pinning mask for CR4 bits needing to be 0
	x86/asm/64: Align start of __clear_user() loop to 16-bytes
	btrfs: fix bytes_may_use underflow when running balance and scrub in parallel
	btrfs: fix data block group relocation failure due to concurrent scrub
	btrfs: check if a log root exists before locking the log_mutex on unlink
	btrfs: fix failure of RWF_NOWAIT write into prealloc extent beyond eof
	mm/slab: use memzero_explicit() in kzfree()
	ocfs2: avoid inode removal while nfsd is accessing it
	ocfs2: load global_inode_alloc
	ocfs2: fix value of OCFS2_INVALID_SLOT
	ocfs2: fix panic on nfs server over ocfs2
	mm/memcontrol.c: add missed css_put()
	arm64: perf: Report the PC value in REGS_ABI_32 mode
	arm64: dts: imx8mm-evk: correct ldo1/ldo2 voltage range
	arm64: dts: imx8mn-ddr4-evk: correct ldo1/ldo2 voltage range
	tracing: Fix event trigger to accept redundant spaces
	ring-buffer: Zero out time extend if it is nested and not absolute
	drm/amd: fix potential memleak in err branch
	drm: rcar-du: Fix build error
	drm/radeon: fix fb_div check in ni_init_smc_spll_table()
	drm/amdgpu: add fw release for sdma v5_0
	Staging: rtl8723bs: prevent buffer overflow in update_sta_support_rate()
	sunrpc: fixed rollback in rpc_gssd_dummy_populate()
	SUNRPC: Properly set the @subbuf parameter of xdr_buf_subsegment()
	pNFS/flexfiles: Fix list corruption if the mirror count changes
	NFSv4 fix CLOSE not waiting for direct IO compeletion
	xprtrdma: Fix handling of RDMA_ERROR replies
	dm writecache: correct uncommitted_block when discarding uncommitted entry
	dm writecache: add cond_resched to loop in persistent_memory_claim()
	xfs: add agf freeblocks verify in xfs_agf_verify
	Revert "tty: hvc: Fix data abort due to race in hvc_open"
	Linux 5.4.50

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I3bfeaba86876d3c2f91979d3e98d894a2b70fe1a
2020-07-01 12:46:09 +02:00
Huy Nguyen
41b2debf35 xfrm: Fix double ESP trailer insertion in IPsec crypto offload.
[ Upstream commit 94579ac3f6d0820adc83b5dc5358ead0158101e9 ]

During IPsec performance testing, we see bad ICMP checksum. The error packet
has duplicated ESP trailer due to double validate_xmit_xfrm calls. The first call
is from ip_output, but the packet cannot be sent because
netif_xmit_frozen_or_stopped is true and the packet gets dev_requeue_skb. The second
call is from NET_TX softirq. However after the first call, the packet already
has the ESP trailer.

Fix by marking the skb with XFRM_XMIT bit after the packet is handled by
validate_xmit_xfrm to avoid duplicate ESP trailer insertion.

Fixes: f6e27114a6 ("net: Add a xfrm validate function to validate_xmit_skb")
Signed-off-by: Huy Nguyen <huyn@mellanox.com>
Reviewed-by: Boris Pismenny <borisp@mellanox.com>
Reviewed-by: Raed Salem <raeds@mellanox.com>
Reviewed-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-06-30 15:36:53 -04:00
Marcelo Ricardo Leitner
dc43f7e807 sctp: Don't advertise IPv4 addresses if ipv6only is set on the socket
[ Upstream commit 471e39df96b9a4c4ba88a2da9e25a126624d7a9c ]

If a socket is set ipv6only, it will still send IPv4 addresses in the
INIT and INIT_ACK packets. This potentially misleads the peer into using
them, which then would cause association termination.

The fix is to not add IPv4 addresses to ipv6only sockets.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: Corey Minyard <cminyard@mvista.com>
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Tested-by: Corey Minyard <cminyard@mvista.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-06-30 15:36:45 -04:00
Tariq Toukan
9e693934cd net: Do not clear the sock TX queue in sk_set_socket()
[ Upstream commit 41b14fb8724d5a4b382a63cb4a1a61880347ccb8 ]

Clearing the sock TX queue in sk_set_socket() might cause unexpected
out-of-order transmit when called from sock_orphan(), as outstanding
packets can pick a different TX queue and bypass the ones already queued.

This is undesired in general. More specifically, it breaks the in-order
scheduling property guarantee for device-offloaded TLS sockets.

Remove the call to sk_tx_queue_clear() in sk_set_socket(), and add it
explicitly only where needed.

Fixes: e022f0b4a0 ("net: Introduce sk_tx_queue_mapping")
Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
Reviewed-by: Boris Pismenny <borisp@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-06-30 15:36:44 -04:00
Veerendranath Jakkam
e1f28e7d04 BACKPORT: cfg80211: Configure PMK lifetime and reauth threshold for PMKSA entries
Drivers that trigger roaming need to know the lifetime of the configured
PMKSA for deciding whether to trigger the full or PMKSA cache based
authentication. The configured PMKSA is invalid after the PMK lifetime
has expired and must not be used after that and the STA needs to
disassociate if the PMK expires. Hence the STA is expected to refresh
the PMK with a full authentication before this happens (e.g., when
reassociating to a new BSS the next time or by performing EAPOL
reauthentication depending on the AKM) to avoid unnecessary
disconnection.

The PMK reauthentication threshold is the percentage of the PMK lifetime
value and indicates to the driver to trigger a full authentication roam
(without PMKSA caching) after the reauthentication threshold time, but
before the PMK timer has expired. Authentication methods like SAE need
to be able to generate a new PMKSA entry without having to force a
disconnection after this threshold timeout. If no roaming occurs between
the reauthentication threshold time and PMK lifetime expiration,
disassociation is still forced.

The new attributes for providing these values correspond to the dot11
MIB variables dot11RSNAConfigPMKLifetime and
dot11RSNAConfigPMKReauthThreshold.

This type of functionality is already available in cases where user
space component is in control of roaming. This commit extends that same
capability into cases where parts or all of this functionality is
offloaded to the driver.

Bug: 154782456
Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Link: https://lore.kernel.org/r/20200312235903.18462-1-jouni@codeaurora.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Change-Id: I899c14543653d3620e63dbf40f1dfde7b1b48512
(cherry picked from commit 7fc82af856d6bc26910902f8f42659b162864955)
Signed-off-by: Vamsi Krishna <vamsin@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2020-06-30 14:28:41 +02:00
Johannes Berg
dc58762f12 BACKPORT: nl80211: modify TID-config API
Make some changes to the TID-config API:
 * use u16 in nl80211 (only, and restrict to using 8 bits for now),
   to avoid issues in the future if we ever want to use higher TIDs.
 * reject empty TIDs mask (via netlink policy)
 * change feature advertising to not use extended feature flags but
   have own mechanism for this, which simplifies the code
 * fix all variable names from 'tid' to 'tids' since it's a mask
 * change to cfg80211_ name prefixes, not ieee80211_
 * fix some minor docs/spelling things.

Bug: 154782456
Change-Id: Ia234d464b3f914cdeab82f540e018855be580dce
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
(cherry picked from commit 3710a8a6284f58a78ba4fe9c4b6672207636a223)
Signed-off-by: Vamsi Krishna <vamsin@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2020-06-30 14:28:41 +02:00
Tamizh chelvam
7a59f8cab6 BACKPORT: nl80211: Add NL command to support TID speicific configurations
Add the new NL80211_CMD_SET_TID_CONFIG command to support
data TID specific configuration. Per TID configuration is
passed in the nested NL80211_ATTR_TID_CONFIG attribute.

This patch adds support to configure per TID noack policy
through the NL80211_TID_CONFIG_ATTR_NOACK attribute.

Bug: 154782456
Signed-off-by: Tamizh chelvam <tamizhr@codeaurora.org>
Link: https://lore.kernel.org/r/1579506687-18296-2-git-send-email-tamizhr@codeaurora.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Change-Id: Ia2e2c125aaba64571453838baac052014e386cd6
(cherry picked from commit 77f576deaa393b54a0f2ca8ab1ab5b2d3c6b971b)
Signed-off-by: Vamsi Krishna <vamsin@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2020-06-30 14:28:41 +02:00
Jouni Malinen
02d9f7e316 BACKPORT: cfg80211: Support key configuration for Beacon protection (BIGTK)
IEEE P802.11-REVmd/D3.0 adds support for protecting Beacon frames using
a new set of keys (BIGTK; key index 6..7) similarly to the way
group-addressed Robust Management frames are protected (IGTK; key index
4..5). Extend cfg80211 and nl80211 to allow the new BIGTK to be
configured. Add an extended feature flag to indicate driver support for
the new key index values to avoid array overflows in driver
implementations and also to indicate to user space when this
functionality is available.

Bug: 154782456
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Link: https://lore.kernel.org/r/20200222132548.20835-2-jouni@codeaurora.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Change-Id: I108164b597c46d0f94fc44cbb030cb8c5cd21773
(cherry picked from commit 56be393fa8b40db2d4f54f97614f645eb8d3c32e)
Signed-off-by: Vamsi Krishna <vamsin@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2020-06-30 14:28:41 +02:00
Veerendranath Jakkam
67a67ac328 BACKPORT: cfg80211: Enhance the AKM advertizement to support per interface.
Commit ab4dfa2053 ("cfg80211: Allow drivers to advertise supported AKM
suites") introduces the support to advertize supported AKMs to userspace.

This needs an enhancement to advertize the AKM support per interface type,
specifically for the cfg80211-based drivers that implement SME and use
different mechanisms to support the AKM's for each interface type (e.g.,
the support for SAE, OWE AKM's take different paths for such drivers on
STA/AP mode).

This commit aims the same and enhances the earlier mechanism of advertizing
the AKMs per wiphy. Add new nl80211 attributes and data structure to
provide supported AKMs per interface type to userspace.

the AKMs advertized in akm_suites are default capabilities if not
advertized for a specific interface type in iftype_akm_suites.

Bug: 154782456
Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
Link: https://lore.kernel.org/r/20200126203032.21934-1-vjakkam@codeaurora.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Change-Id: I928d355e6cfd85609261e0efbf2e9272da65ba2c
(cherry picked from commit d6039a3416f7af37c04f22c411f120ad46f51663)
Signed-off-by: Vamsi Krishna <vamsin@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2020-06-30 14:28:41 +02:00
John Crispin
92a63a3d99 BACKPORT: nl80211: add handling for BSS color
This patch adds the attributes, policy and parsing code to allow userland
to send the info about the BSS coloring settings to the kernel.

Bug: 154782456
Signed-off-by: John Crispin <john@phrozen.org>
Link: https://lore.kernel.org/r/20191217141921.8114-1-john@phrozen.org
[johannes: remove the strict policy parsing, that was a misunderstanding]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Change-Id: Ib24133d6825ef455819f697de6d9d67c856c315e
(cherry picked from commit 5c5e52d1bb962510fecdc1ebecdde89694d1b223)
Signed-off-by: Vamsi Krishna <vamsin@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2020-06-30 14:28:41 +02:00
Gurumoorthi Gnanasambandhan
50635d9eba BACKPORT: cfg80211: VLAN offload support for set_key and set_sta_vlan
This provides an alternative mechanism for AP VLAN support where a
single netdev is used with VLAN tagged frames instead of separate
netdevs for each VLAN without tagged frames from the WLAN driver.

By setting NL80211_EXT_FEATURE_VLAN_OFFLOAD flag the driver indicates
support for a single netdev with VLAN tagged frames. Separate
VLAN-specific netdevs can be added using RTM_NEWLINK/IFLA_VLAN_ID
similarly to Ethernet. NL80211_CMD_NEW_KEY (for group keys),
NL80211_CMD_NEW_STATION, and NL80211_CMD_SET_STATION will optionally
specify vlan_id using NL80211_ATTR_VLAN_ID.

Bug: 154782456
Signed-off-by: Gurumoorthi Gnanasambandhan <gguru@codeaurora.org>
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Link: https://lore.kernel.org/r/20191031214640.5012-1-jouni@codeaurora.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Change-Id: I74c0d2664b1dbe5846a62a433754693a2ead9f2a
(cherry picked from commit 14f34e36b36ceede9877ca422a62fcac17b52023)
Signed-off-by: Vamsi Krishna <vamsin@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2020-06-30 14:28:41 +02:00
Greg Kroah-Hartman
fa46997961 This is the 5.4.48 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl7wXk8ACgkQONu9yGCS
 aT5uyhAA1EoV9ROPRt8Vw1fzlDIrRA5X2T+FCGXskg2kKWehVHAvge4U76nZ16+i
 aYcBX3lAmN7GGVw+/GiRHf9QpiwOUF5f3ZUQZ0KuLS1gcuaXx+VC1h5yyunx3tm1
 CI01B2p+GQ3jABWopnhsujMVAeWjbD18NqY+a+xOzTn8CCyLAli+LiviWCR/apQp
 p4r6++eevWo1yMDlJGNGoMYsFcxChWhtlnDQKWCsIDCN3I1cinGz8wopiv93WqRH
 Sz3wb1YMuhXb10usNZcZFaSvDGf5XSaMxpRkyNSxN7CLv8LzbovXQOE+fFDGAYxd
 lUCjRK0wFBMzRSeZ2iGYqqQf5xyYKb6hNmViGprdqwR2c3MBHN/Xs5aDLqJEgHkr
 OXzZLyHUngRfp3GpagFGV6q06S6fgb9ca/7FuT4Hn8Z3tb5Xt7b/KlPcW3VymiSt
 I37itASNA/Qs6Njl4tDd9GjwbcOAs+s/XabasU+pXscOkf3o8fYMy2krisy176D/
 AXtRTLq4pc42I8c3tv5uCNz7Zje/qytKSPErNRBAedvOu5JX7ab6hgULPH4N7r0N
 Di/LyKqYw+ZBa4AfzcsvlR3wJLWqni+aFj5yppSrNkH7kNzZGLmlw8xIo8v1CFYw
 T86b13WmHPqvyFWQLpX5WCEYu0OCw5YCUyQXSsLZN5oC7gAwC7U=
 =FSdI
 -----END PGP SIGNATURE-----

Merge 5.4.48 into android-5.4-stable

Changes in 5.4.48
	ACPI: GED: use correct trigger type field in _Exx / _Lxx handling
	drm/amdgpu: fix and cleanup amdgpu_gem_object_close v4
	ath10k: Fix the race condition in firmware dump work queue
	drm: bridge: adv7511: Extend list of audio sample rates
	media: staging: imgu: do not hold spinlock during freeing mmu page table
	media: imx: imx7-mipi-csis: Cleanup and fix subdev pad format handling
	crypto: ccp -- don't "select" CONFIG_DMADEVICES
	media: vicodec: Fix error codes in probe function
	media: si2157: Better check for running tuner in init
	objtool: Ignore empty alternatives
	spi: spi-mem: Fix Dual/Quad modes on Octal-capable devices
	drm/amdgpu: Init data to avoid oops while reading pp_num_states.
	arm64/kernel: Fix range on invalidating dcache for boot page tables
	libbpf: Fix memory leak and possible double-free in hashmap__clear
	spi: pxa2xx: Apply CS clk quirk to BXT
	x86,smap: Fix smap_{save,restore}() alternatives
	sched/fair: Refill bandwidth before scaling
	net: atlantic: make hw_get_regs optional
	net: ena: fix error returning in ena_com_get_hash_function()
	efi/libstub/x86: Work around LLVM ELF quirk build regression
	ath10k: remove the max_sched_scan_reqs value
	arm64: cacheflush: Fix KGDB trap detection
	media: staging: ipu3: Fix stale list entries on parameter queue failure
	rtw88: fix an issue about leak system resources
	spi: dw: Zero DMA Tx and Rx configurations on stack
	ACPICA: Dispatcher: add status checks
	block: alloc map and request for new hardware queue
	arm64: insn: Fix two bugs in encoding 32-bit logical immediates
	block: reset mapping if failed to update hardware queue count
	drm: rcar-du: Set primary plane zpos immutably at initializing
	lockdown: Allow unprivileged users to see lockdown status
	ixgbe: Fix XDP redirect on archs with PAGE_SIZE above 4K
	platform/x86: dell-laptop: don't register micmute LED if there is no token
	MIPS: Loongson: Build ATI Radeon GPU driver as module
	Bluetooth: Add SCO fallback for invalid LMP parameters error
	kgdb: Disable WARN_CONSOLE_UNLOCKED for all kgdb
	kgdb: Prevent infinite recursive entries to the debugger
	pmu/smmuv3: Clear IRQ affinity hint on device removal
	ACPI/IORT: Fix PMCG node single ID mapping handling
	mips: Fix cpu_has_mips64r1/2 activation for MIPS32 CPUs
	spi: dw: Enable interrupts in accordance with DMA xfer mode
	clocksource: dw_apb_timer: Make CPU-affiliation being optional
	clocksource: dw_apb_timer_of: Fix missing clockevent timers
	media: dvbdev: Fix tuner->demod media controller link
	btrfs: account for trans_block_rsv in may_commit_transaction
	btrfs: do not ignore error from btrfs_next_leaf() when inserting checksums
	ARM: 8978/1: mm: make act_mm() respect THREAD_SIZE
	batman-adv: Revert "disable ethtool link speed detection when auto negotiation off"
	ice: Fix memory leak
	ice: Fix for memory leaks and modify ICE_FREE_CQ_BUFS
	mmc: meson-mx-sdio: trigger a soft reset after a timeout or CRC error
	Bluetooth: btmtkuart: Improve exception handling in btmtuart_probe()
	spi: dw: Fix Rx-only DMA transfers
	x86/kvm/hyper-v: Explicitly align hcall param for kvm_hyperv_exit
	net: vmxnet3: fix possible buffer overflow caused by bad DMA value in vmxnet3_get_rss()
	x86: fix vmap arguments in map_irq_stack
	staging: android: ion: use vmap instead of vm_map_ram
	ath10k: fix kernel null pointer dereference
	media: staging/intel-ipu3: Implement lock for stream on/off operations
	spi: Respect DataBitLength field of SpiSerialBusV2() ACPI resource
	brcmfmac: fix wrong location to get firmware feature
	regulator: qcom-rpmh: Fix typos in pm8150 and pm8150l
	tools api fs: Make xxx__mountpoint() more scalable
	e1000: Distribute switch variables for initialization
	dt-bindings: display: mediatek: control dpi pins mode to avoid leakage
	drm/mediatek: set dpi pin mode to gpio low to avoid leakage current
	audit: fix a net reference leak in audit_send_reply()
	media: dvb: return -EREMOTEIO on i2c transfer failure.
	media: platform: fcp: Set appropriate DMA parameters
	MIPS: Make sparse_init() using top-down allocation
	ath10k: add flush tx packets for SDIO chip
	Bluetooth: btbcm: Add 2 missing models to subver tables
	audit: fix a net reference leak in audit_list_rules_send()
	Drivers: hv: vmbus: Always handle the VMBus messages on CPU0
	dpaa2-eth: fix return codes used in ndo_setup_tc
	netfilter: nft_nat: return EOPNOTSUPP if type or flags are not supported
	selftests/bpf: Fix memory leak in extract_build_id()
	net: bcmgenet: set Rx mode before starting netif
	net: bcmgenet: Fix WoL with password after deep sleep
	lib/mpi: Fix 64-bit MIPS build with Clang
	exit: Move preemption fixup up, move blocking operations down
	sched/core: Fix illegal RCU from offline CPUs
	drivers/perf: hisi: Fix typo in events attribute array
	iocost_monitor: drop string wrap around numbers when outputting json
	net: lpc-enet: fix error return code in lpc_mii_init()
	selinux: fix error return code in policydb_read()
	drivers: net: davinci_mdio: fix potential NULL dereference in davinci_mdio_probe()
	media: cec: silence shift wrapping warning in __cec_s_log_addrs()
	net: allwinner: Fix use correct return type for ndo_start_xmit()
	powerpc/spufs: fix copy_to_user while atomic
	libertas_tf: avoid a null dereference in pointer priv
	xfs: clean up the error handling in xfs_swap_extents
	Crypto/chcr: fix for ccm(aes) failed test
	MIPS: Truncate link address into 32bit for 32bit kernel
	mips: cm: Fix an invalid error code of INTVN_*_ERR
	kgdb: Fix spurious true from in_dbg_master()
	xfs: reset buffer write failure state on successful completion
	xfs: fix duplicate verification from xfs_qm_dqflush()
	platform/x86: intel-vbtn: Use acpi_evaluate_integer()
	platform/x86: intel-vbtn: Split keymap into buttons and switches parts
	platform/x86: intel-vbtn: Do not advertise switches to userspace if they are not there
	platform/x86: intel-vbtn: Also handle tablet-mode switch on "Detachable" and "Portable" chassis-types
	iwlwifi: avoid debug max amsdu config overwriting itself
	nvme: refine the Qemu Identify CNS quirk
	nvme-pci: align io queue count with allocted nvme_queue in nvme_probe
	nvme-tcp: use bh_lock in data_ready
	ath10k: Remove msdu from idr when management pkt send fails
	wcn36xx: Fix error handling path in 'wcn36xx_probe()'
	net: qed*: Reduce RX and TX default ring count when running inside kdump kernel
	drm/mcde: dsi: Fix return value check in mcde_dsi_bind()
	mt76: avoid rx reorder buffer overflow
	md: don't flush workqueue unconditionally in md_open
	raid5: remove gfp flags from scribble_alloc()
	iocost: don't let vrate run wild while there's no saturation signal
	veth: Adjust hard_start offset on redirect XDP frames
	net/mlx5e: IPoIB, Drop multicast packets that this interface sent
	rtlwifi: Fix a double free in _rtl_usb_tx_urb_setup()
	mwifiex: Fix memory corruption in dump_station
	kgdboc: Use a platform device to handle tty drivers showing up late
	x86/boot: Correct relocation destination on old linkers
	sched: Defend cfs and rt bandwidth quota against overflow
	mips: MAAR: Use more precise address mask
	mips: Add udelay lpj numbers adjustment
	crypto: stm32/crc32 - fix ext4 chksum BUG_ON()
	crypto: stm32/crc32 - fix run-time self test issue.
	crypto: stm32/crc32 - fix multi-instance
	drm/amd/powerpay: Disable gfxoff when setting manual mode on picasso and raven
	drm/amdgpu: Sync with VM root BO when switching VM to CPU update mode
	selftests/bpf: CONFIG_IPV6_SEG6_BPF required for test_seg6_loop.o
	x86/mm: Stop printing BRK addresses
	MIPS: tools: Fix resource leak in elf-entry.c
	m68k: mac: Don't call via_flush_cache() on Mac IIfx
	btrfs: improve global reserve stealing logic
	btrfs: qgroup: mark qgroup inconsistent if we're inherting snapshot to a new qgroup
	macvlan: Skip loopback packets in RX handler
	PCI: Don't disable decoding when mmio_always_on is set
	MIPS: Fix IRQ tracing when call handle_fpe() and handle_msa_fpe()
	bcache: fix refcount underflow in bcache_device_free()
	mmc: sdhci-msm: Set SDHCI_QUIRK_MULTIBLOCK_READ_ACMD12 quirk
	staging: greybus: sdio: Respect the cmd->busy_timeout from the mmc core
	mmc: via-sdmmc: Respect the cmd->busy_timeout from the mmc core
	ice: fix potential double free in probe unrolling
	ixgbe: fix signed-integer-overflow warning
	iwlwifi: mvm: fix aux station leak
	mmc: sdhci-esdhc-imx: fix the mask for tuning start point
	spi: dw: Return any value retrieved from the dma_transfer callback
	cpuidle: Fix three reference count leaks
	platform/x86: hp-wmi: Convert simple_strtoul() to kstrtou32()
	platform/x86: intel-hid: Add a quirk to support HP Spectre X2 (2015)
	platform/x86: intel-vbtn: Only blacklist SW_TABLET_MODE on the 9 / "Laptop" chasis-type
	platform/x86: asus_wmi: Reserve more space for struct bias_args
	libbpf: Fix perf_buffer__free() API for sparse allocs
	bpf: Fix map permissions check
	bpf: Refactor sockmap redirect code so its easy to reuse
	bpf: Fix running sk_skb program types with ktls
	selftests/bpf, flow_dissector: Close TAP device FD after the test
	kasan: stop tests being eliminated as dead code with FORTIFY_SOURCE
	string.h: fix incompatibility between FORTIFY_SOURCE and KASAN
	btrfs: free alien device after device add
	btrfs: include non-missing as a qualifier for the latest_bdev
	btrfs: send: emit file capabilities after chown
	btrfs: force chunk allocation if our global rsv is larger than metadata
	btrfs: fix error handling when submitting direct I/O bio
	btrfs: fix wrong file range cleanup after an error filling dealloc range
	btrfs: fix space_info bytes_may_use underflow after nocow buffered write
	btrfs: fix space_info bytes_may_use underflow during space cache writeout
	powerpc/mm: Fix conditions to perform MMU specific management by blocks on PPC32.
	mm: thp: make the THP mapcount atomic against __split_huge_pmd_locked()
	mm: initialize deferred pages with interrupts enabled
	mm/pagealloc.c: call touch_nmi_watchdog() on max order boundaries in deferred init
	mm: call cond_resched() from deferred_init_memmap()
	ima: Fix ima digest hash table key calculation
	ima: Switch to ima_hash_algo for boot aggregate
	ima: Evaluate error in init_ima()
	ima: Directly assign the ima_default_policy pointer to ima_rules
	ima: Call ima_calc_boot_aggregate() in ima_eventdigest_init()
	ima: Remove __init annotation from ima_pcrread()
	evm: Fix possible memory leak in evm_calc_hmac_or_hash()
	ext4: fix EXT_MAX_EXTENT/INDEX to check for zeroed eh_max
	ext4: fix error pointer dereference
	ext4: fix race between ext4_sync_parent() and rename()
	PCI: Avoid Pericom USB controller OHCI/EHCI PME# defect
	PCI: Avoid FLR for AMD Matisse HD Audio & USB 3.0
	PCI: Avoid FLR for AMD Starship USB 3.0
	PCI: Add ACS quirk for Intel Root Complex Integrated Endpoints
	PCI: vmd: Add device id for VMD device 8086:9A0B
	x86/amd_nb: Add Family 19h PCI IDs
	PCI: Add Loongson vendor ID
	serial: 8250_pci: Move Pericom IDs to pci_ids.h
	x86/amd_nb: Add AMD family 17h model 60h PCI IDs
	ima: Remove redundant policy rule set in add_rules()
	ima: Set again build_ima_appraise variable
	PCI: Program MPS for RCiEP devices
	e1000e: Disable TSO for buffer overrun workaround
	e1000e: Relax condition to trigger reset for ME workaround
	carl9170: remove P2P_GO support
	media: go7007: fix a miss of snd_card_free
	media: cedrus: Program output format during each run
	serial: 8250: Avoid error message on reprobe
	Bluetooth: hci_bcm: fix freeing not-requested IRQ
	b43legacy: Fix case where channel status is corrupted
	b43: Fix connection problem with WPA3
	b43_legacy: Fix connection problem with WPA3
	media: ov5640: fix use of destroyed mutex
	clk: mediatek: assign the initial value to clk_init_data of mtk_mux
	igb: Report speed and duplex as unknown when device is runtime suspended
	hwmon: (k10temp) Add AMD family 17h model 60h PCI match
	EDAC/amd64: Add AMD family 17h model 60h PCI IDs
	power: vexpress: add suppress_bind_attrs to true
	power: supply: core: fix HWMON temperature labels
	power: supply: core: fix memory leak in HWMON error path
	pinctrl: samsung: Correct setting of eint wakeup mask on s5pv210
	pinctrl: samsung: Save/restore eint_mask over suspend for EINT_TYPE GPIOs
	gnss: sirf: fix error return code in sirf_probe()
	sparc32: fix register window handling in genregs32_[gs]et()
	sparc64: fix misuses of access_process_vm() in genregs32_[sg]et()
	dm crypt: avoid truncating the logical block size
	alpha: fix memory barriers so that they conform to the specification
	powerpc/fadump: use static allocation for reserved memory ranges
	powerpc/fadump: consider reserved ranges while reserving memory
	powerpc/fadump: Account for memory_limit while reserving memory
	kernel/cpu_pm: Fix uninitted local in cpu_pm
	ARM: tegra: Correct PL310 Auxiliary Control Register initialization
	soc/tegra: pmc: Select GENERIC_PINCONF
	ARM: dts: exynos: Fix GPIO polarity for thr GalaxyS3 CM36651 sensor's bus
	ARM: dts: at91: sama5d2_ptc_ek: fix vbus pin
	ARM: dts: s5pv210: Set keep-power-in-suspend for SDHCI1 on Aries
	drivers/macintosh: Fix memleak in windfarm_pm112 driver
	powerpc/32s: Fix another build failure with CONFIG_PPC_KUAP_DEBUG
	powerpc/kasan: Fix issues by lowering KASAN_SHADOW_END
	powerpc/kasan: Fix shadow pages allocation failure
	powerpc/32: Disable KASAN with pages bigger than 16k
	powerpc/64s: Don't let DT CPU features set FSCR_DSCR
	powerpc/64s: Save FSCR to init_task.thread.fscr after feature init
	kbuild: force to build vmlinux if CONFIG_MODVERSION=y
	sunrpc: svcauth_gss_register_pseudoflavor must reject duplicate registrations.
	sunrpc: clean up properly in gss_mech_unregister()
	mtd: rawnand: Fix nand_gpio_waitrdy()
	mtd: rawnand: onfi: Fix redundancy detection check
	mtd: rawnand: brcmnand: fix hamming oob layout
	mtd: rawnand: diskonchip: Fix the probe error path
	mtd: rawnand: sharpsl: Fix the probe error path
	mtd: rawnand: ingenic: Fix the probe error path
	mtd: rawnand: xway: Fix the probe error path
	mtd: rawnand: orion: Fix the probe error path
	mtd: rawnand: socrates: Fix the probe error path
	mtd: rawnand: oxnas: Fix the probe error path
	mtd: rawnand: sunxi: Fix the probe error path
	mtd: rawnand: plat_nand: Fix the probe error path
	mtd: rawnand: pasemi: Fix the probe error path
	mtd: rawnand: mtk: Fix the probe error path
	mtd: rawnand: tmio: Fix the probe error path
	w1: omap-hdq: cleanup to add missing newline for some dev_dbg
	f2fs: fix checkpoint=disable:%u%%
	perf probe: Do not show the skipped events
	perf probe: Fix to check blacklist address correctly
	perf probe: Check address correctness by map instead of _etext
	perf symbols: Fix debuginfo search for Ubuntu
	perf symbols: Fix kernel maps for kcore and eBPF
	Linux 5.4.48

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I9954fb3f08956419e8586bcb9078e604df207fb9
2020-06-22 11:43:59 +02:00
John Fastabend
e7b1564a24 bpf: Fix running sk_skb program types with ktls
[ Upstream commit e91de6afa81c10e9f855c5695eb9a53168d96b73 ]

KTLS uses a stream parser to collect TLS messages and send them to
the upper layer tls receive handler. This ensures the tls receiver
has a full TLS header to parse when it is run. However, when a
socket has BPF_SK_SKB_STREAM_VERDICT program attached before KTLS
is enabled we end up with two stream parsers running on the same
socket.

The result is both try to run on the same socket. First the KTLS
stream parser runs and calls read_sock() which will tcp_read_sock
which in turn calls tcp_rcv_skb(). This dequeues the skb from the
sk_receive_queue. When this is done KTLS code then data_ready()
callback which because we stacked KTLS on top of the bpf stream
verdict program has been replaced with sk_psock_start_strp(). This
will in turn kick the stream parser again and eventually do the
same thing KTLS did above calling into tcp_rcv_skb() and dequeuing
a skb from the sk_receive_queue.

At this point the data stream is broke. Part of the stream was
handled by the KTLS side some other bytes may have been handled
by the BPF side. Generally this results in either missing data
or more likely a "Bad Message" complaint from the kTLS receive
handler as the BPF program steals some bytes meant to be in a
TLS header and/or the TLS header length is no longer correct.

We've already broke the idealized model where we can stack ULPs
in any order with generic callbacks on the TX side to handle this.
So in this patch we do the same thing but for RX side. We add
a sk_psock_strp_enabled() helper so TLS can learn a BPF verdict
program is running and add a tls_sw_has_ctx_rx() helper so BPF
side can learn there is a TLS ULP on the socket.

Then on BPF side we omit calling our stream parser to avoid
breaking the data stream for the KTLS receiver. Then on the
KTLS side we call BPF_SK_SKB_STREAM_VERDICT once the KTLS
receiver is done with the packet but before it posts the
msg to userspace. This gives us symmetry between the TX and
RX halfs and IMO makes it usable again. On the TX side we
process packets in this order BPF -> TLS -> TCP and on
the receive side in the reverse order TCP -> TLS -> BPF.

Discovered while testing OpenSSL 3.0 Alpha2.0 release.

Fixes: d829e9c411 ("tls: convert to generic sk_msg interface")
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/159079361946.5745.605854335665044485.stgit@john-Precision-5820-Tower
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-06-22 09:31:12 +02:00
Greg Kroah-Hartman
eaaa29ec5a This is the 5.4.47 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl7qK2gACgkQONu9yGCS
 aT4kaw/8Cknc9G64S1SWchxFj4LnSYzrpeFGXOZBlHBtcCyD12JNGjA6SG6DoGLY
 /s/1fjBwJWrWpkI36CGNZowNPYtzRMOhyBGj7QHTpEj0vjMTKYXhVieMquQSHwRP
 zcrYl8f/xWJKo6XNjR1YLh5PWeD6B9dWD1RcvBZ0jCez84jyVT1EyWMWGiodkLMx
 gmJITO2DBaekelU0yyZJIFePO5DJpcXspf5lrPgkPG9u/U4hZf94AAGMYbXJZ5Rn
 BDcqGEGQe+mtcG6lq6DGRDH5VVMG4k13MrZJBfrVAhkGU+g6nKQbOXCcdcRjoM6N
 9NL8RbcpL0NhphNmrKwjNcYd4kZxYgTQb87FZi+qDxwGQIWIxcET6gL5t/vqAev1
 v/uKFLlt5x/2tNtpC8aY8EwdyGcXfeBXEl9AjP7HUWC/KzB8I9vLnokcMvOMYDIg
 3wNIsKMYLcLzuLL8oJ7FvDkBO+H/RjSvF4UvQyLOPOJtWSV5uKbLfKIU9sw90G3i
 t8qo3lNC/J4saJ+jx+O7XoHjFw6biJFATvs0+HtpCkwi0aJm2SGW+OvXuZCGZPnz
 TW2YsGFCCwL/RPtceJVkGfV3kr7SUB5AGXjueXdC+4QWfmi3POWojjgheQrleS+3
 OLxRsUVbQ6hOqEgLAaV6HhzvykkTjDj2Gq8P3I+1Y/eiRHjlpdU=
 =WYnW
 -----END PGP SIGNATURE-----

Merge 5.4.47 into android-5.4-stable

Changes in 5.4.47
	ipv6: fix IPV6_ADDRFORM operation logic
	mlxsw: core: Use different get_trend() callbacks for different thermal zones
	net_failover: fixed rollback in net_failover_open()
	tun: correct header offsets in napi frags mode
	bridge: Avoid infinite loop when suppressing NS messages with invalid options
	vxlan: Avoid infinite loop when suppressing NS messages with invalid options
	bpf: Support llvm-objcopy for vmlinux BTF
	elfnote: mark all .note sections SHF_ALLOC
	Input: mms114 - fix handling of mms345l
	ARM: 8977/1: ptrace: Fix mask for thumb breakpoint hook
	sched/fair: Don't NUMA balance for kthreads
	Input: synaptics - add a second working PNP_ID for Lenovo T470s
	csky: Fixup abiv2 syscall_trace break a4 & a5
	gfs2: Even more gfs2_find_jhead fixes
	drivers/net/ibmvnic: Update VNIC protocol version reporting
	powerpc/xive: Clear the page tables for the ESB IO mapping
	spi: dw: Fix native CS being unset
	ath9k_htc: Silence undersized packet warnings
	smack: avoid unused 'sip' variable warning
	RDMA/uverbs: Make the event_queue fds return POLLERR when disassociated
	padata: add separate cpuhp node for CPUHP_PADATA_DEAD
	s390/pci: Log new handle in clp_disable_fh()
	x86/cpu/amd: Make erratum #1054 a legacy erratum
	KVM: x86: only do L1TF workaround on affected processors
	PCI/PM: Adjust pcie_wait_for_link_delay() for caller delay
	perf probe: Accept the instance number of kretprobe event
	mm: add kvfree_sensitive() for freeing sensitive data objects
	selftests: fix flower parent qdisc
	fanotify: fix ignore mask logic for events on child and on dir
	aio: fix async fsync creds
	ipv4: fix a RCU-list lock in fib_triestat_seq_show
	iwlwifi: mvm: fix NVM check for 3168 devices
	sctp: fix possibly using a bad saddr with a given dst
	sctp: fix refcount bug in sctp_wfree
	x86_64: Fix jiffies ODR violation
	x86/PCI: Mark Intel C620 MROMs as having non-compliant BARs
	x86/speculation: Prevent rogue cross-process SSBD shutdown
	x86/speculation: Avoid force-disabling IBPB based on STIBP and enhanced IBRS.
	x86/speculation: PR_SPEC_FORCE_DISABLE enforcement for indirect branches.
	x86/reboot/quirks: Add MacBook6,1 reboot quirk
	perf/x86/intel: Add more available bits for OFFCORE_RESPONSE of Intel Tremont
	KVM: x86/mmu: Set mmio_value to '0' if reserved #PF can't be generated
	KVM: x86: respect singlestep when emulating instruction
	KVM: x86: Fix APIC page invalidation race
	powerpc/ptdump: Properly handle non standard page size
	ASoC: max9867: fix volume controls
	io_uring: use kvfree() in io_sqe_buffer_register()
	efi/efivars: Add missing kobject_put() in sysfs entry creation error path
	smb3: fix incorrect number of credits when ioctl MaxOutputResponse > 64K
	smb3: add indatalen that can be a non-zero value to calculation of credit charge in smb2 ioctl
	watchdog: imx_sc_wdt: Fix reboot on crash
	ALSA: es1688: Add the missed snd_card_free()
	ALSA: fireface: fix configuration error for nominal sampling transfer frequency
	ALSA: hda/realtek - add a pintbl quirk for several Lenovo machines
	ALSA: pcm: disallow linking stream to itself
	ALSA: pcm: fix snd_pcm_link() lockdep splat
	ALSA: usb-audio: Fix inconsistent card PM state after resume
	ALSA: usb-audio: Add vendor, product and profile name for HP Thunderbolt Dock
	ACPI: sysfs: Fix reference count leak in acpi_sysfs_add_hotplug_profile()
	ACPI: CPPC: Fix reference count leak in acpi_cppc_processor_probe()
	ACPI: GED: add support for _Exx / _Lxx handler methods
	ACPI: PM: Avoid using power resources if there are none for D0
	arm64: acpi: fix UBSAN warning
	lib/lzo: fix ambiguous encoding bug in lzo-rle
	nilfs2: fix null pointer dereference at nilfs_segctor_do_construct()
	spi: dw: Fix controller unregister order
	spi: Fix controller unregister order
	spi: pxa2xx: Fix controller unregister order
	spi: pxa2xx: Fix runtime PM ref imbalance on probe error
	spi: bcm2835: Fix controller unregister order
	spi: bcm2835aux: Fix controller unregister order
	spi: bcm-qspi: Handle clock probe deferral
	spi: bcm-qspi: when tx/rx buffer is NULL set to 0
	PM: runtime: clk: Fix clk_pm_runtime_get() error path
	gup: document and work around "COW can break either way" issue
	crypto: cavium/nitrox - Fix 'nitrox_get_first_device()' when ndevlist is fully iterated
	crypto: algapi - Avoid spurious modprobe on LOADED
	crypto: drbg - fix error return code in drbg_alloc_state()
	x86/{mce,mm}: Unmap the entire page if the whole page is affected and poisoned
	firmware: imx: warn on unexpected RX
	firmware: imx-scu: Support one TX and one RX
	firmware: imx: scu: Fix corruption of header
	crypto: virtio: Fix use-after-free in virtio_crypto_skcipher_finalize_req()
	crypto: virtio: Fix src/dst scatterlist calculation in __virtio_crypto_skcipher_do_req()
	crypto: virtio: Fix dest length calculation in __virtio_crypto_skcipher_do_req()
	dccp: Fix possible memleak in dccp_init and dccp_fini
	selftests/net: in rxtimestamp getopt_long needs terminating null entry
	net/mlx5: drain health workqueue in case of driver load error
	net/mlx5: Fix fatal error handling during device load
	net/mlx5e: Fix repeated XSK usage on one channel
	ovl: initialize error in ovl_copy_xattr
	proc: Use new_inode not new_inode_pseudo
	remoteproc: Fall back to using parent memory pool if no dedicated available
	remoteproc: Fix and restore the parenting hierarchy for vdev
	cpufreq: Fix up cpufreq_boost_set_sw()
	EDAC/skx: Use the mcmtr register to retrieve close_pg/bank_xor_enable
	video: vt8500lcdfb: fix fallthrough warning
	video: fbdev: w100fb: Fix a potential double free.
	KVM: nVMX: Skip IBPB when switching between vmcs01 and vmcs02
	KVM: nSVM: fix condition for filtering async PF
	KVM: nSVM: leave ASID aside in copy_vmcb_control_area
	KVM: nVMX: Consult only the "basic" exit reason when routing nested exit
	KVM: MIPS: Define KVM_ENTRYHI_ASID to cpu_asid_mask(&boot_cpu_data)
	KVM: MIPS: Fix VPN2_MASK definition for variable cpu_vmbits
	KVM: arm64: Stop writing aarch32's CSSELR into ACTLR
	KVM: arm64: Make vcpu_cp1x() work on Big Endian hosts
	scsi: megaraid_sas: TM command refire leads to controller firmware crash
	scsi: lpfc: Fix negation of else clause in lpfc_prep_node_fc4type
	selftests/ftrace: Return unsupported if no error_log file
	ath9k: Fix use-after-free Read in htc_connect_service
	ath9k: Fix use-after-free Read in ath9k_wmi_ctrl_rx
	ath9k: Fix use-after-free Write in ath9k_htc_rx_msg
	ath9x: Fix stack-out-of-bounds Write in ath9k_hif_usb_rx_cb
	ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb
	Smack: slab-out-of-bounds in vsscanf
	drm/vkms: Hold gem object while still in-use
	mm/slub: fix a memory leak in sysfs_slab_add()
	fat: don't allow to mount if the FAT length == 0
	perf: Add cond_resched() to task_function_call()
	agp/intel: Reinforce the barrier after GTT updates
	mmc: sdhci-msm: Clear tuning done flag while hs400 tuning
	mmc: mmci_sdmmc: fix DMA API warning overlapping mappings
	mmc: tmio: Further fixup runtime PM management at remove
	mmc: uniphier-sd: call devm_request_irq() after tmio_mmc_host_probe()
	ARM: dts: at91: sama5d2_ptc_ek: fix sdmmc0 node description
	mmc: sdio: Fix potential NULL pointer error in mmc_sdio_init_card()
	mmc: sdio: Fix several potential memory leaks in mmc_sdio_init_card()
	block/floppy: fix contended case in floppy_queue_rq()
	xen/pvcalls-back: test for errors when calling backend_connect()
	KVM: arm64: Synchronize sysreg state on injecting an AArch32 exception
	KVM: arm64: Save the host's PtrAuth keys in non-preemptible context
	Linux 5.4.47

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I3fb3216abdbc080b4ac7b827b35ff6a813e28eb8
2020-06-18 10:05:17 +02:00
Wang Hai
05e275d874 dccp: Fix possible memleak in dccp_init and dccp_fini
[ Upstream commit c96b6acc8f89a4a7f6258dfe1d077654c11415be ]

There are some memory leaks in dccp_init() and dccp_fini().

In dccp_fini() and the error handling path in dccp_init(), free lhash2
is missing. Add inet_hashinfo2_free_mod() to do it.

If inet_hashinfo2_init_mod() failed in dccp_init(),
percpu_counter_destroy() should be called to destroy dccp_orphan_count.
It need to goto out_free_percpu when inet_hashinfo2_init_mod() failed.

Fixes: c92c81df93 ("net: dccp: fix kernel crash on module load")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-06-17 16:40:32 +02:00
Greg Kroah-Hartman
f520ca124c This is the 5.4.44 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl7XQXMACgkQONu9yGCS
 aT4OHw//YYuI/61rkff6/3qAE4gDwTZolVywu5HHzT5W7t7qeHPzJin2u04RBiS8
 4S8Mut0RUSK/0IyB0B3S342ntia1v41Q04veWm0K90iAScScjjUapLDXC/P3StA0
 iitGKJ8QFDS49+PFKFYkyXEsv6HYlDbtTmS0yxVoooSr+uqeR7m6rS1jsDsfUTaR
 T4tvfX8VPHkgfkfkOKCUq8/rM3uDW3lSk3JflIbPwRBQo9KvNPnfBetU9p//dCHG
 CB1K9K3sB6xLkKe7Ut7PlwoTq/Lc8qOma535xy3A8Iv6fVq4+hPE2jsB93WGI270
 WoEZbHpon7W6g/bU+C+CGfov2zBtz1dKHfWNcK5+dEkEQjjzKvvigfUvaKjyUUKB
 Vo5rQ3GZQ4JsMkHEJaLOlp3/SkdRd6RV/E0YErBISNeswzqsOgTrX8mz6wfQInwd
 Ww7V9LKdwSD6h2DuzutUbEm1X8i8glXammWEOUuh6zzQ3+WS57R1L+Nkr/6WxpgN
 w2g7F0+5enUbE1kIdq5OCzY1D0gBpT1o5YlrZgdL2GF5lU1b/lhsGhV6P83fl2Mf
 rTGFtg5M1pNgjbUkSH3VHHof35PM9vQZ6lrYbKMCjwymVY+BcR6nsCadfLqjMGnW
 NCYeiAmoIVCJX7q0hONww+TevZ3T+SLUjQ2os3WzooPC51MPOAQ=
 =5p6V
 -----END PGP SIGNATURE-----

Merge 5.4.44 into android-5.4-stable

Changes in 5.4.44
	ax25: fix setsockopt(SO_BINDTODEVICE)
	dpaa_eth: fix usage as DSA master, try 3
	net: don't return invalid table id error when we fall back to PF_UNSPEC
	net: dsa: mt7530: fix roaming from DSA user ports
	net: ethernet: ti: cpsw: fix ASSERT_RTNL() warning during suspend
	__netif_receive_skb_core: pass skb by reference
	net: inet_csk: Fix so_reuseport bind-address cache in tb->fast*
	net: ipip: fix wrong address family in init error path
	net/mlx5: Add command entry handling completion
	net: mvpp2: fix RX hashing for non-10G ports
	net: nlmsg_cancel() if put fails for nhmsg
	net: qrtr: Fix passing invalid reference to qrtr_local_enqueue()
	net: revert "net: get rid of an signed integer overflow in ip_idents_reserve()"
	net sched: fix reporting the first-time use timestamp
	net/tls: fix race condition causing kernel panic
	nexthop: Fix attribute checking for groups
	r8152: support additional Microsoft Surface Ethernet Adapter variant
	sctp: Don't add the shutdown timer if its already been added
	sctp: Start shutdown on association restart if in SHUTDOWN-SENT state and socket is closed
	tipc: block BH before using dst_cache
	net/mlx5e: kTLS, Destroy key object after destroying the TIS
	net/mlx5e: Fix inner tirs handling
	net/mlx5: Fix memory leak in mlx5_events_init
	net/mlx5e: Update netdev txq on completions during closure
	net/mlx5: Fix error flow in case of function_setup failure
	net/mlx5: Annotate mutex destroy for root ns
	net/tls: fix encryption error checking
	net/tls: free record only on encryption error
	net: sun: fix missing release regions in cas_init_one().
	net/mlx4_core: fix a memory leak bug.
	mlxsw: spectrum: Fix use-after-free of split/unsplit/type_set in case reload fails
	ARM: dts: rockchip: fix phy nodename for rk3228-evb
	ARM: dts: rockchip: fix phy nodename for rk3229-xms6
	arm64: dts: rockchip: fix status for &gmac2phy in rk3328-evb.dts
	arm64: dts: rockchip: swap interrupts interrupt-names rk3399 gpu node
	ARM: dts: rockchip: swap clock-names of gpu nodes
	ARM: dts: rockchip: fix pinctrl sub nodename for spi in rk322x.dtsi
	gpio: tegra: mask GPIO IRQs during IRQ shutdown
	ALSA: usb-audio: add mapping for ASRock TRX40 Creator
	net: microchip: encx24j600: add missed kthread_stop
	gfs2: move privileged user check to gfs2_quota_lock_check
	gfs2: Grab glock reference sooner in gfs2_add_revoke
	drm/amdgpu: drop unnecessary cancel_delayed_work_sync on PG ungate
	drm/amd/powerplay: perform PG ungate prior to CG ungate
	drm/amdgpu: Use GEM obj reference for KFD BOs
	cachefiles: Fix race between read_waiter and read_copier involving op->to_do
	usb: dwc3: pci: Enable extcon driver for Intel Merrifield
	usb: phy: twl6030-usb: Fix a resource leak in an error handling path in 'twl6030_usb_probe()'
	usb: gadget: legacy: fix redundant initialization warnings
	net: freescale: select CONFIG_FIXED_PHY where needed
	IB/i40iw: Remove bogus call to netdev_master_upper_dev_get()
	riscv: stacktrace: Fix undefined reference to `walk_stackframe'
	clk: ti: am33xx: fix RTC clock parent
	csky: Fixup msa highest 3 bits mask
	csky: Fixup perf callchain unwind
	csky: Fixup remove duplicate irq_disable
	hwmon: (nct7904) Fix incorrect range of temperature limit registers
	cifs: Fix null pointer check in cifs_read
	csky: Fixup raw_copy_from_user()
	samples: bpf: Fix build error
	drivers: net: hamradio: Fix suspicious RCU usage warning in bpqether.c
	Input: usbtouchscreen - add support for BonXeon TP
	Input: evdev - call input_flush_device() on release(), not flush()
	Input: xpad - add custom init packet for Xbox One S controllers
	Input: dlink-dir685-touchkeys - fix a typo in driver name
	Input: i8042 - add ThinkPad S230u to i8042 reset list
	Input: synaptics-rmi4 - really fix attn_data use-after-free
	Input: synaptics-rmi4 - fix error return code in rmi_driver_probe()
	ARM: 8970/1: decompressor: increase tag size
	ARM: uaccess: consolidate uaccess asm to asm/uaccess-asm.h
	ARM: uaccess: integrate uaccess_save and uaccess_restore
	ARM: uaccess: fix DACR mismatch with nested exceptions
	gpio: exar: Fix bad handling for ida_simple_get error path
	arm64: dts: mt8173: fix vcodec-enc clock
	soc: mediatek: cmdq: return send msg error code
	gpu/drm: Ingenic: Fix opaque pointer casted to wrong type
	IB/qib: Call kobject_put() when kobject_init_and_add() fails
	ARM: dts/imx6q-bx50v3: Set display interface clock parents
	ARM: dts: bcm2835-rpi-zero-w: Fix led polarity
	ARM: dts: bcm: HR2: Fix PPI interrupt types
	mmc: block: Fix use-after-free issue for rpmb
	gpio: pxa: Fix return value of pxa_gpio_probe()
	gpio: bcm-kona: Fix return value of bcm_kona_gpio_probe()
	RDMA/pvrdma: Fix missing pci disable in pvrdma_pci_probe()
	ALSA: hwdep: fix a left shifting 1 by 31 UB bug
	ALSA: hda/realtek - Add a model for Thinkpad T570 without DAC workaround
	ALSA: usb-audio: mixer: volume quirk for ESS Technology Asus USB DAC
	exec: Always set cap_ambient in cap_bprm_set_creds
	clk: qcom: gcc: Fix parent for gpll0_out_even
	ALSA: usb-audio: Quirks for Gigabyte TRX40 Aorus Master onboard audio
	ALSA: hda/realtek - Add new codec supported for ALC287
	libceph: ignore pool overlay and cache logic on redirects
	ceph: flush release queue when handling caps for unknown inode
	RDMA/core: Fix double destruction of uobject
	drm/amd/display: drop cursor position check in atomic test
	IB/ipoib: Fix double free of skb in case of multicast traffic in CM mode
	mm,thp: stop leaking unreleased file pages
	mm: remove VM_BUG_ON(PageSlab()) from page_mapcount()
	fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info()
	include/asm-generic/topology.h: guard cpumask_of_node() macro argument
	Revert "block: end bio with BLK_STS_AGAIN in case of non-mq devs and REQ_NOWAIT"
	gpio: fix locking open drain IRQ lines
	iommu: Fix reference count leak in iommu_group_alloc.
	parisc: Fix kernel panic in mem_init()
	cfg80211: fix debugfs rename crash
	x86/syscalls: Revert "x86/syscalls: Make __X32_SYSCALL_BIT be unsigned long"
	mac80211: mesh: fix discovery timer re-arming issue / crash
	x86/dma: Fix max PFN arithmetic overflow on 32 bit systems
	copy_xstate_to_kernel(): don't leave parts of destination uninitialized
	xfrm: allow to accept packets with ipv6 NEXTHDR_HOP in xfrm_input
	xfrm: do pskb_pull properly in __xfrm_transport_prep
	xfrm: remove the xfrm_state_put call becofe going to out_reset
	xfrm: call xfrm_output_gso when inner_protocol is set in xfrm_output
	xfrm interface: fix oops when deleting a x-netns interface
	xfrm: fix a warning in xfrm_policy_insert_list
	xfrm: fix a NULL-ptr deref in xfrm_local_error
	xfrm: fix error in comment
	ip_vti: receive ipip packet by calling ip_tunnel_rcv
	netfilter: nft_reject_bridge: enable reject with bridge vlan
	netfilter: ipset: Fix subcounter update skip
	netfilter: conntrack: make conntrack userspace helpers work again
	netfilter: nfnetlink_cthelper: unbreak userspace helper support
	netfilter: nf_conntrack_pptp: prevent buffer overflows in debug code
	esp6: get the right proto for transport mode in esp6_gso_encap
	bnxt_en: Fix accumulation of bp->net_stats_prev.
	ieee80211: Fix incorrect mask for default PE duration
	xsk: Add overflow check for u64 division, stored into u32
	qlcnic: fix missing release in qlcnic_83xx_interrupt_test.
	crypto: chelsio/chtls: properly set tp->lsndtime
	nexthops: Move code from remove_nexthop_from_groups to remove_nh_grp_entry
	nexthops: don't modify published nexthop groups
	nexthop: Expand nexthop_is_multipath in a few places
	ipv4: nexthop version of fib_info_nh_uses_dev
	net: dsa: declare lockless TX feature for slave ports
	bonding: Fix reference count leak in bond_sysfs_slave_add.
	netfilter: conntrack: comparison of unsigned in cthelper confirmation
	netfilter: conntrack: Pass value of ctinfo to __nf_conntrack_update
	netfilter: nf_conntrack_pptp: fix compilation warning with W=1 build
	perf: Make perf able to build with latest libbfd
	Linux 5.4.44

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Idd547df1abb0bea116f30e3224a80387529adb0b
2020-06-04 08:23:35 +02:00
David Ahern
35c0a6e7ef ipv4: nexthop version of fib_info_nh_uses_dev
commit 1fd1c768f3624a5e66766e7b4ddb9b607cd834a5 upstream.

Similar to the last path, need to fix fib_info_nh_uses_dev for
external nexthops to avoid referencing multiple nh_grp structs.
Move the device check in fib_info_nh_uses_dev to a helper and
create a nexthop version that is called if the fib_info uses an
external nexthop.

Fixes: 430a049190 ("nexthop: Add support for nexthop groups")
Signed-off-by: David Ahern <dsahern@gmail.com>
Acked-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-06-03 08:21:37 +02:00