Author	SHA1	Message	Date
Blagovest Kolenichev	e79e029826	Merge android-5.4.5 (9cdc723) into msm-5.4 ... * refs/heads/tmp-9cdc723: Revert "usb: dwc3: gadget: Fix logical condition" Revert "FROMLIST: scsi: ufs-qcom: Adjust bus bandwidth voting and unvoting" Linux 5.4.5 r8169: add missing RX enabling for WoL on RTL8125 net: mscc: ocelot: unregister the PTP clock on deinit ionic: keep users rss hash across lif reset xdp: obtain the mem_id mutex before trying to remove an entry. page_pool: do not release pool until inflight == 0. net/mlx5e: ethtool, Fix analysis of speed setting net/mlx5e: Fix translation of link mode into speed net/mlx5e: Fix freeing flow with kfree() and not kvfree() net/mlx5e: Fix SFF 8472 eeprom length act_ct: support asymmetric conntrack net/mlx5e: Fix TXQ indices to be sequential net: Fixed updating of ethertype in skb_mpls_push() hsr: fix a NULL pointer dereference in hsr_dev_xmit() Fixed updating of ethertype in function skb_mpls_pop gre: refetch erspan header from skb->data after pskb_may_pull() cls_flower: Fix the behavior using port ranges with hw-offload net: sched: allow indirect blocks to bind to clsact in TC net: core: rename indirect block ingress cb function tcp: Protect accesses to .ts_recent_stamp with {READ,WRITE}_ONCE() tcp: tighten acceptance of ACKs not matching a child socket tcp: fix rejected syncookies due to stale timestamps net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup net: ipv6: add net argument to ip6_dst_lookup_flow net/mlx5e: Query global pause state before setting prio2buffer tipc: fix ordering of tipc module init and exit routine tcp: md5: fix potential overestimation of TCP option space openvswitch: support asymmetric conntrack net/tls: Fix return values to avoid ENOTSUPP net: thunderx: start phy before starting autonegotiation net_sched: validate TCA_KIND attribute in tc_chain_tmplt_add() net: sched: fix dump qlen for sch_mq/sch_mqprio with NOLOCK subqueues net: ethernet: ti: cpsw: fix extra rx interrupt net: dsa: fix flow dissection on Tx path net: bridge: deny dev_set_mac_address() when unregistering mqprio: Fix out-of-bounds access in mqprio_dump inet: protect against too small mtu values. ANDROID: add initial ABI whitelist for android-5.4 ANDROID: abi update for 5.4.4 ANDROID: mm: Throttle rss_stat tracepoint FROMLIST: vsprintf: Inline call to ptr_to_hashval UPSTREAM: rss_stat: Add support to detect RSS updates of external mm UPSTREAM: mm: emit tracepoint when RSS changes Linux 5.4.4 EDAC/ghes: Do not warn when incrementing refcount on 0 r8169: fix rtl_hw_jumbo_disable for RTL8168evl workqueue: Fix missing kfree(rescuer) in destroy_workqueue() blk-mq: make sure that line break can be printed ext4: fix leak of quota reservations ext4: fix a bug in ext4_wait_for_tail_page_commit splice: only read in as much information as there is pipe buffer space rtc: disable uie before setting time and enable after USB: dummy-hcd: increase max number of devices to 32 powerpc: Define arch_is_kernel_initmem_freed() for lockdep mm/shmem.c: cast the type of unmap_start to u64 s390/kaslr: store KASLR offset for early dumps s390/smp,vdso: fix ASCE handling firmware: qcom: scm: Ensure 'a0' status code is treated as signed ext4: work around deleting a file with i_nlink == 0 safely mm: memcg/slab: wait for !root kmem_cache refcnt killing on root kmem_cache destruction mfd: rk808: Fix RK818 ID template mm, memfd: fix COW issue on MAP_PRIVATE and F_SEAL_FUTURE_WRITE mappings powerpc: Fix vDSO clock_getres() powerpc: Avoid clang warnings around setjmp and longjmp omap: pdata-quirks: remove openpandora quirks for mmc3 and wl1251 omap: pdata-quirks: revert pandora specific gpiod additions iio: ad7949: fix channels mixups iio: ad7949: kill pointless "readback"-handling code Revert "scsi: qla2xxx: Fix memory leak when sending I/O fails" scsi: qla2xxx: Fix a dma_pool_free() call scsi: qla2xxx: Fix SRB leak on switch command timeout reiserfs: fix extended attributes on the root directory ext4: Fix credit estimate for final inode freeing quota: fix livelock in dquot_writeback_dquots seccomp: avoid overflow in implicit constant conversion ext2: check err when partial != NULL quota: Check that quota is not dirty before release video/hdmi: Fix AVI bar unpack powerpc/xive: Skip ioremap() of ESB pages for LSI interrupts powerpc: Allow flush_icache_range to work across ranges >4GB powerpc/xive: Prevent page fault issues in the machine crash handler powerpc: Allow 64bit VDSO __kernel_sync_dicache to work across ranges >4GB coresight: Serialize enabling/disabling a link device. stm class: Lose the protocol driver when dropping its reference ppdev: fix PPGETTIME/PPSETTIME ioctls RDMA/core: Fix ib_dma_max_seg_size() ARM: dts: omap3-tao3530: Fix incorrect MMC card detection GPIO polarity mmc: host: omap_hsmmc: add code for special init of wl1251 to get rid of pandora_wl1251_init_card pinctrl: samsung: Fix device node refcount leaks in S3C64xx wakeup controller init pinctrl: samsung: Fix device node refcount leaks in init code pinctrl: samsung: Fix device node refcount leaks in S3C24xx wakeup controller init pinctrl: samsung: Fix device node refcount leaks in Exynos wakeup controller init pinctrl: samsung: Add of_node_put() before return in error path pinctrl: armada-37xx: Fix irq mask access in armada_37xx_irq_set_type() pinctrl: rza2: Fix gpio name typos ACPI: PM: Avoid attaching ACPI PM domain to certain devices ACPI: EC: Rework flushing of pending work ACPI: bus: Fix NULL pointer check in acpi_bus_get_private_data() ACPI: OSL: only free map once in osl.c ACPI / hotplug / PCI: Allocate resources directly under the non-hotplug bridge ACPI: LPSS: Add dmi quirk for skipping _DEP check for some device-links ACPI: LPSS: Add LNXVIDEO -> BYT I2C1 to lpss_device_links ACPI: LPSS: Add LNXVIDEO -> BYT I2C7 to lpss_device_links ACPI / utils: Move acpi_dev_get_first_match_dev() under CONFIG_ACPI ALSA: hda/realtek - Line-out jack doesn't work on a Dell AIO ALSA: oxfw: fix return value in error path of isochronous resources reservation ALSA: fireface: fix return value in error path of isochronous resources reservation cpufreq: powernv: fix stack bloat and hard limit on number of CPUs PM / devfreq: Lock devfreq in trans_stat_show intel_th: pci: Add Tiger Lake CPU support intel_th: pci: Add Ice Lake CPU support intel_th: Fix a double put_device() in error path powerpc/perf: Disable trace_imc pmu drm/panfrost: Open/close the perfcnt BO perf tests: Fix out of bounds memory access erofs: zero out when listxattr is called with no xattr cpuidle: use first valid target residency as poll time cpuidle: teo: Fix "early hits" handling for disabled idle states cpuidle: teo: Consider hits and misses metrics of disabled states cpuidle: teo: Rename local variable in teo_select() cpuidle: teo: Ignore disabled idle states that are too deep cpuidle: Do not unset the driver if it is there already media: cec.h: CEC_OP_REC_FLAG_ values were swapped media: radio: wl1273: fix interrupt masking on release media: bdisp: fix memleak on release media: vimc: sen: remove unused kthread_sen field media: hantro: Fix picture order count table enable media: hantro: Fix motion vectors usage condition media: hantro: Fix s_fmt for dynamic resolution changes s390/mm: properly clear _PAGE_NOEXEC bit when it is not supported ar5523: check NULL before memcpy() in ar5523_cmd() wil6210: check len before memcpy() calls cgroup: pids: use atomic64_t for pids->limit blk-mq: avoid sysfs buffer overflow with too many CPU cores md: improve handling of bio with REQ_PREFLUSH in md_flush_request() ASoC: fsl_audmix: Add spin lock to protect tdms ASoC: Jack: Fix NULL pointer dereference in snd_soc_jack_report ASoC: rt5645: Fixed typo for buddy jack support. ASoC: rt5645: Fixed buddy jack support. workqueue: Fix pwq ref leak in rescuer_thread() workqueue: Fix spurious sanity check failures in destroy_workqueue() dm zoned: reduce overhead of backing device checks dm writecache: handle REQ_FUA hwrng: omap - Fix RNG wait loop timeout ovl: relax WARN_ON() on rename to self ovl: fix corner case of non-unique st_dev;st_ino ovl: fix lookup failure on multi lower squashfs lib: raid6: fix awk build warnings rtlwifi: rtl8192de: Fix missing enable interrupt flag rtlwifi: rtl8192de: Fix missing callback that tests for hw release of buffer rtlwifi: rtl8192de: Fix missing code to retrieve RX buffer address btrfs: record all roots for rename exchange on a subvol Btrfs: send, skip backreference walking for extents with many references btrfs: Remove btrfs_bio::flags member btrfs: Avoid getting stuck during cyclic writebacks Btrfs: fix negative subv_writers counter and data space leak after buffered write Btrfs: fix metadata space leak on fixup worker failure to set range as delalloc btrfs: use refcount_inc_not_zero in kill_all_nodes btrfs: use btrfs_block_group_cache_done in update_block_group btrfs: check page->mapping when loading free space cache iwlwifi: pcie: fix support for transmitting SKBs with fraglist usb: typec: fix use after free in typec_register_port() phy: renesas: rcar-gen3-usb2: Fix sysfs interface of "role" usb: dwc3: ep0: Clear started flag on completion usb: dwc3: gadget: Clear started flag for non-IOC usb: dwc3: gadget: Fix logical condition usb: dwc3: pci: add ID for the Intel Comet Lake -H variant virtio-balloon: fix managed page counts when migrating pages between zones virt_wifi: fix use-after-free in virt_wifi_newlink() mtd: rawnand: Change calculating of position page containing BBM mtd: spear_smi: Fix Write Burst mode brcmfmac: disable PCIe interrupts before bus reset EDAC/altera: Use fast register IO for S10 IRQs tpm: Switch to platform_get_irq_optional() tpm: add check after commands attribs tab allocation usb: mon: Fix a deadlock in usbmon between mmap and read usb: core: urb: fix URB structure initialization function USB: adutux: fix interface sanity check usb: roles: fix a potential use after free USB: serial: io_edgeport: fix epic endpoint lookup USB: idmouse: fix interface sanity checks USB: atm: ueagle-atm: add missing endpoint check iio: adc: ad7124: Enable internal reference iio: adc: ad7606: fix reading unnecessary data from device iio: imu: inv_mpu6050: fix temperature reporting using bad unit iio: humidity: hdc100x: fix IIO_HUMIDITYRELATIVE channel reporting iio: adis16480: Fix scales factors iio: imu: st_lsm6dsx: fix ODR check in st_lsm6dsx_write_raw iio: adis16480: Add debugfs_reg_access entry ARM: dts: pandora-common: define wl1251 as child node of mmc3 usb: common: usb-conn-gpio: Don't log an error on probe deferral interconnect: qcom: qcs404: Walk the list safely on node removal interconnect: qcom: sdm845: Walk the list safely on node removal xhci: make sure interrupts are restored to correct state xhci: handle some XHCI_TRUST_TX_LENGTH quirks cases as default behaviour. xhci: Increase STS_HALT timeout in xhci_suspend() xhci: fix USB3 device initiated resume race with roothub autosuspend xhci: Fix memory leak in xhci_add_in_port() usb: xhci: only set D3hot for pci device staging: gigaset: add endpoint-type sanity check staging: gigaset: fix illegal free on probe errors staging: gigaset: fix general protection fault on probe staging: vchiq: call unregister_chrdev_region() when driver registration fails staging: rtl8712: fix interface sanity check staging: rtl8188eu: fix interface sanity check staging: exfat: fix multiple definition error of `rename_file' binder: fix incorrect calculation for num_valid usb: host: xhci-tegra: Correct phy enable sequence usb: Allow USB device to be warm reset in suspended state USB: documentation: flags on usb-storage versus UAS USB: uas: heed CAPACITY_HEURISTICS USB: uas: honor flag to avoid CAPACITY16 media: venus: remove invalid compat_ioctl32 handler ceph: fix compat_ioctl for ceph_dir_operations compat_ioctl: add compat_ptr_ioctl() scsi: qla2xxx: Fix memory leak when sending I/O fails scsi: qla2xxx: Fix double scsi_done for abort path scsi: qla2xxx: Fix driver unload hang scsi: qla2xxx: Do command completion on abort timeout scsi: zfcp: trace channel log even for FCP command responses scsi: lpfc: Fix bad ndlp ptr in xri aborted handling Revert "nvme: Add quirk for Kingston NVME SSD running FW E8FK11.T" nvme: Namepace identification descriptor list is optional usb: gadget: pch_udc: fix use after free usb: gadget: configfs: Fix missing spin_lock_init() BACKPORT: FROMLIST: scsi: ufs: Export query request interfaces ANDROID: update abi with unbindable_ports sysctl BACKPORT: FROMLIST: net: introduce ip_local_unbindable_ports sysctl ANDROID: update abi for 5.4.3 merge ANDROID: update abi_gki_aarch64.xml for ion, drm changes ANDROID: drivers: gpu: drm: export drm_mode_convert_umode symbol ANDROID: ion: flush cache before exporting non-cached buffers Linux 5.4.3 kselftest: Fix NULL INSTALL_PATH for TARGETS runlist perf script: Fix invalid LBR/binary mismatch error EDAC/ghes: Fix locking and memory barrier issues watchdog: aspeed: Fix clock behaviour for ast2600 drm/mcde: Fix an error handling path in 'mcde_probe()' md/raid0: Fix an error message in raid0_make_request() cpufreq: imx-cpufreq-dt: Correct i.MX8MN's default speed grade value ALSA: hda - Fix pending unsol events at shutdown KVM: x86: fix out-of-bounds write in KVM_GET_EMULATED_CPUID (CVE-2019-19332) binder: Handle start==NULL in binder_update_page_range() binder: Prevent repeated use of ->mmap() via NULL mapping binder: Fix race between mmap() and binder_alloc_print_pages() Revert "serial/8250: Add support for NI-Serial PXI/PXIe+485 devices" vcs: prevent write access to vcsu devices thermal: Fix deadlock in thermal thermal_zone_device_check iomap: Fix pipe page leakage during splicing bdev: Refresh bdev size for disks without partitioning bdev: Factor out bdev revalidation into a common helper rfkill: allocate static minor RDMA/qib: Validate ->show()/store() callbacks before calling them can: ucan: fix non-atomic allocation in completion handler spi: Fix NULL pointer when setting SPI_CS_HIGH for GPIO CS spi: Fix SPI_CS_HIGH setting when using native and GPIO CS spi: atmel: Fix CS high support spi: stm32-qspi: Fix kernel oops when unbinding driver spi: spi-fsl-qspi: Clear TDH bits in FLSHCR register crypto: user - fix memory leak in crypto_reportstat crypto: user - fix memory leak in crypto_report crypto: ecdh - fix big endian bug in ECC library crypto: ccp - fix uninitialized list head crypto: geode-aes - switch to skcipher for cbc(aes) fallback crypto: af_alg - cast ki_complete ternary op to int crypto: atmel-aes - Fix IV handling when req->nbytes < ivsize crypto: crypto4xx - fix double-free in crypto4xx_destroy_sdr KVM: x86: Grab KVM's srcu lock when setting nested state KVM: x86: Remove a spurious export of a static function KVM: x86: fix presentation of TSX feature in ARCH_CAPABILITIES KVM: x86: do not modify masked bits of shared MSRs KVM: arm/arm64: vgic: Don't rely on the wrong pending table KVM: nVMX: Always write vmcs02.GUEST_CR3 during nested VM-Enter KVM: PPC: Book3S HV: XIVE: Set kvm->arch.xive when VPs are allocated KVM: PPC: Book3S HV: XIVE: Fix potential page leak on error path KVM: PPC: Book3S HV: XIVE: Free previous EQ page when setting up a new one arm64: dts: exynos: Revert "Remove unneeded address space mapping for soc node" arm64: Validate tagged addresses in access_ok() called from kernel threads drm/i810: Prevent underflow in ioctl drm: damage_helper: Fix race checking plane->state->fb drm/msm: fix memleak on release jbd2: Fix possible overflow in jbd2_log_space_left() kernfs: fix ino wrap-around detection nfsd: restore NFSv3 ACL support nfsd: Ensure CLONE persists data and metadata changes to the target file can: slcan: Fix use-after-free Read in slcan_open tty: vt: keyboard: reject invalid keycodes CIFS: Fix SMB2 oplock break processing CIFS: Fix NULL-pointer dereference in smb2_push_mandatory_locks x86/PCI: Avoid AMD FCH XHCI USB PME# from D0 defect x86/mm/32: Sync only to VMALLOC_END in vmalloc_sync_all() media: rc: mark input device as pointing stick Input: Fix memory leak in psxpad_spi_probe coresight: etm4x: Fix input validation for sysfs. Input: goodix - add upside-down quirk for Teclast X89 tablet Input: synaptics-rmi4 - don't increment rmiaddr for SMBus transfers Input: synaptics-rmi4 - re-enable IRQs in f34v7_do_reflash Input: synaptics - switch another X1 Carbon 6 to RMI/SMbus soc: mediatek: cmdq: fixup wrong input order of write api ALSA: hda: Modify stream stripe mask only when needed ALSA: hda - Add mute led support for HP ProBook 645 G4 ALSA: pcm: oss: Avoid potential buffer overflows ALSA: hda/realtek - Fix inverted bass GPIO pin on Acer 8951G ALSA: hda/realtek - Dell headphone has noise on unmute for ALC236 ALSA: hda/realtek - Enable the headset-mic on a Xiaomi's laptop ALSA: hda/realtek - Enable internal speaker of ASUS UX431FLC SUNRPC: Avoid RPC delays when exiting suspend io_uring: ensure req->submit is copied when req is deferred io_uring: fix missing kmap() declaration on powerpc fuse: verify attributes fuse: verify write return fuse: verify nlink fuse: fix leak of fuse_io_priv io_uring: transform send/recvmsg() -ERESTARTSYS to -EINTR io_uring: fix dead-hung for non-iter fixed rw mwifiex: Re-work support for SDIO HW reset serial: ifx6x60: add missed pm_runtime_disable serial: 8250_dw: Avoid double error messaging when IRQ absent serial: stm32: fix clearing interrupt error flags serial: serial_core: Perform NULL checks for break_ctl ops serial: pl011: Fix DMA ->flush_buffer() tty: serial: msm_serial: Fix flow control tty: serial: fsl_lpuart: use the sg count from dma_map_sg serial: 8250-mtk: Use platform_get_irq_optional() for optional irq usb: gadget: u_serial: add missing port entry locking staging/octeon: Use stubs for MIPS && !CAVIUM_OCTEON_SOC mailbox: tegra: Fix superfluous IRQ error message time: Zero the upper 32-bits in __kernel_timespec on 32-bit lp: fix sparc64 LPSETTIMEOUT ioctl sparc64: implement ioremap_uc perf scripts python: exported-sql-viewer.py: Fix use of TRUE with SQLite arm64: tegra: Fix 'active-low' warning for Jetson Xavier regulator arm64: tegra: Fix 'active-low' warning for Jetson TX1 regulator rsi: release skb if rsi_prepare_beacon fails FROMLIST: scsi: ufs: Fix ufshcd_hold() caused scheduling while atomic FROMLIST: scsi: ufs: Add dev ref clock gating wait time support FROMLIST: scsi: ufs-qcom: Adjust bus bandwidth voting and unvoting FROMLIST: scsi: ufs: Remove the check before call setup clock notify vops FROMLIST: scsi: ufs: set load before setting voltage in regulators FROMLIST: scsi: ufs: Flush exception event before suspend FROMLIST: scsi: ufs: Do not rely on prefetched data FROMLIST: scsi: ufs: Fix up clock scaling FROMGIT: scsi: ufs: Do not free irq in suspend FROMGIT: scsi: ufs: Do not clear the DL layer timers FROMGIT: scsi: ufs: Release clock if DMA map fails FROMGIT: scsi: ufs: Use DBD setting in mode sense FROMGIT: scsi: core: Adjust DBD setting in MODE SENSE for caching mode page per LLD FROMGIT: scsi: ufs: Complete pending requests in host reset and restore path FROMGIT: scsi: ufs: Avoid messing up the compl_time_stamp of lrbs FROMGIT: scsi: ufs: Update VCCQ2 and VCCQ min/max voltage hard codes FROMGIT: scsi: ufs: Recheck bkops level if bkops is disabled ANDROID: update abi_gki_aarch64.xml for LTO, CFI, and SCS ANDROID: gki_defconfig: enable LTO, CFI, and SCS ANDROID: update abi_gki_aarch64.xml for CONFIG_GNSS ANDROID: cuttlefish_defconfig: Enable CONFIG_GNSS ANDROID: gki_defconfig: enable HID configs UPSTREAM: arm64: Validate tagged addresses in access_ok() called from kernel threads ANDROID: kbuild: limit LTO inlining ANDROID: kbuild: merge module sections with LTO ANDROID: f2fs: fix possible merge of unencrypted with encrypted I/O ANDROID: gki_defconfig: Enable UCLAMP by default ANDROID: make sure proc mount options are applied ANDROID: sound: usb: Add helper APIs to enable audio stream ANDROID: Update ABI representation ANDROID: Don't base allmodconfig on gki_defconfig ANDROID: Disable UNWINDER_ORC for allmodconfig ANDROID: ASoC: Fix 'allmodconfig' build break Linux 5.4.2 platform/x86: hp-wmi: Fix ACPI errors caused by passing 0 as input size platform/x86: hp-wmi: Fix ACPI errors caused by too small buffer HID: core: check whether Usage Page item is after Usage ID items crypto: talitos - Fix build error by selecting LIB_DES Revert "jffs2: Fix possible null-pointer dereferences in jffs2_add_frag_to_fragtree()" ext4: add more paranoia checking in ext4_expand_extra_isize handling r8169: fix resume on cable plug-in r8169: fix jumbo configuration for RTL8168evl selftests: pmtu: use -oneline for ip route list cache tipc: fix link name length check selftests: bpf: correct perror strings selftests: bpf: test_sockmap: handle file creation failures gracefully net/tls: use sg_next() to walk sg entries net/tls: remove the dead inplace_crypto code selftests/tls: add a test for fragmented messages net: skmsg: fix TLS 1.3 crash with full sk_msg net/tls: free the record on encryption error net/tls: take into account that bpf_exec_tx_verdict() may free the record openvswitch: remove another BUG_ON() openvswitch: drop unneeded BUG_ON() in ovs_flow_cmd_build_info() sctp: cache netns in sctp_ep_common slip: Fix use-after-free Read in slip_open sctp: Fix memory leak in sctp_sf_do_5_2_4_dupcook openvswitch: fix flow command message size net: sched: fix `tc -s class show` no bstats on class with nolock subqueues net: psample: fix skb_over_panic net: macb: add missed tasklet_kill net: dsa: sja1105: fix sja1105_parse_rgmii_delays() mdio_bus: don't use managed reset-controller macvlan: schedule bc_work even if error gve: Fix the queue page list allocated pages count x86/fpu: Don't cache access to fpu_fpregs_owner_ctx thunderbolt: Power cycle the router if NVM authentication fails mei: me: add comet point V device id mei: bus: prefix device names on bus with the bus name USB: serial: ftdi_sio: add device IDs for U-Blox C099-F9P staging: rtl8723bs: Add 024c:0525 to the list of SDIO device-ids staging: rtl8723bs: Drop ACPI device ids staging: rtl8192e: fix potential use after free staging: wilc1000: fix illegal memory access in wilc_parse_join_bss_param() usb: dwc2: use a longer core rest timeout in dwc2_core_reset() driver core: platform: use the correct callback type for bus_find_device crypto: inside-secure - Fix stability issue with Macchiatobin net: disallow ancillary data for __sys_{send,recv}msg_file() net: separate out the msghdr copy from ___sys_{send,recv}msg() io_uring: async workers should inherit the user creds ANDROID: Update ABI representation UPSTREAM: of: property: Add device link support for interrupt-parent, dmas and -gpio(s) UPSTREAM: of: property: Fix the semantics of of_is_ancestor_of() UPSTREAM: i2c: of: Populate fwnode in of_i2c_get_board_info() UPSTREAM: regulator: core: Don't try to remove device links if add failed UPSTREAM: driver core: Clarify documentation for fwnode_operations.add_links() ANDROID: Update ABI representation ANDROID: gki_defconfig: IIO=y ANDROID: Update ABI representation ANDROID: ASoC: core - add hostless DAI support ANDROID: gki_defconfig: =m's applied for virtio configs in arm64 ANDROID: Update ABI representation after 5.4.1 merge Linux 5.4.1 KVM: PPC: Book3S HV: Flush link stack on guest exit to host kernel powerpc/book3s64: Fix link stack flush on context switch staging: comedi: usbduxfast: usbduxfast_ai_cmdtest rounding error USB: serial: option: add support for Foxconn T77W968 LTE modules USB: serial: option: add support for DW5821e with eSIM support USB: serial: mos7840: fix remote wakeup USB: serial: mos7720: fix remote wakeup USB: serial: mos7840: add USB ID to support Moxa UPort 2210 appledisplay: fix error handling in the scheduled work USB: chaoskey: fix error case of a timeout usb-serial: cp201x: support Mark-10 digital force gauge usbip: Fix uninitialized symbol 'nents' in stub_recv_cmd_submit() usbip: tools: fix fd leakage in the function of read_attr_usbip_status USBIP: add config dependency for SGL_ALLOC ALSA: hda - Disable audio component for legacy Nvidia HDMI codecs media: mceusb: fix out of bounds read in MCE receiver buffer media: imon: invalid dereference in imon_touch_event media: cxusb: detect cxusb_ctrl_msg error in query media: b2c2-flexcop-usb: add sanity checking media: uvcvideo: Fix error path in control parsing failure futex: Prevent exit livelock futex: Provide distinct return value when owner is exiting futex: Add mutex around futex exit futex: Provide state handling for exec() as well futex: Sanitize exit state handling futex: Mark the begin of futex exit explicitly futex: Set task::futex_state to DEAD right after handling futex exit futex: Split futex_mm_release() for exit/exec exit/exec: Seperate mm_release() futex: Replace PF_EXITPIDONE with a state futex: Move futex exit handling into futex code cpufreq: Add NULL checks to show() and store() methods of cpufreq media: usbvision: Fix races among open, close, and disconnect media: usbvision: Fix invalid accesses after device disconnect media: vivid: Fix wrong locking that causes race conditions on streaming stop media: vivid: Set vid_cap_streaming and vid_out_streaming to true ALSA: usb-audio: Fix Scarlett 6i6 Gen 2 port data ALSA: usb-audio: Fix NULL dereference at parsing BADD futex: Prevent robust futex exit race x86/entry/32: Fix FIXUP_ESPFIX_STACK with user CR3 x86/pti/32: Calculate the various PTI cpu_entry_area sizes correctly, make the CPU_ENTRY_AREA_PAGES assert precise selftests/x86/sigreturn/32: Invalidate DS and ES when abusing the kernel selftests/x86/mov_ss_trap: Fix the SYSENTER test x86/entry/32: Fix NMI vs ESPFIX x86/entry/32: Unwind the ESPFIX stack earlier on exception entry x86/entry/32: Move FIXUP_FRAME after pushing %fs in SAVE_ALL x86/entry/32: Use %ss segment where required x86/entry/32: Fix IRET exception x86/cpu_entry_area: Add guard page for entry stack on 32bit x86/pti/32: Size initial_page_table correctly x86/doublefault/32: Fix stack canaries in the double fault handler x86/xen/32: Simplify ring check in xen_iret_crit_fixup() x86/xen/32: Make xen_iret_crit_fixup() independent of frame layout x86/stackframe/32: Repair 32-bit Xen PV nbd: prevent memory leak x86/speculation: Fix redundant MDS mitigation message x86/speculation: Fix incorrect MDS/TAA mitigation status x86/insn: Fix awk regexp warnings md/raid10: prevent access of uninitialized resync_pages offset Revert "dm crypt: use WQ_HIGHPRI for the IO and crypt workqueues" Revert "Bluetooth: hci_ll: set operational frequency earlier" ath10k: restore QCA9880-AR1A (v1) detection ath10k: Fix HOST capability QMI incompatibility ath10k: Fix a NULL-ptr-deref bug in ath10k_usb_alloc_urb_from_pipe ath9k_hw: fix uninitialized variable data Bluetooth: Fix invalid-free in bcsp_close() ANDROID: gki_defconfig: enable CONFIG_REGULATOR_FIXED_VOLTAGE FROMLIST: crypto: arm64/sha: fix function types ANDROID: arm64: kvm: disable CFI ANDROID: arm64: add __nocfi to __apply_alternatives ANDROID: arm64: add __pa_function ANDROID: arm64: add __nocfi to functions that jump to a physical address ANDROID: arm64: bpf: implement arch_bpf_jit_check_func ANDROID: bpf: validate bpf_func when BPF_JIT is enabled with CFI ANDROID: add support for Clang's Control Flow Integrity (CFI) ANDROID: arm64: allow LTO_CLANG and THINLTO to be selected FROMLIST: arm64: fix alternatives with LLVM's integrated assembler FROMLIST: arm64: lse: fix LSE atomics with LLVM's integrated assembler ANDROID: arm64: disable HAVE_ARCH_PREL32_RELOCATIONS with LTO_CLANG ANDROID: arm64: vdso: disable LTO ANDROID: irqchip/gic-v3: rename gic_of_init to work around a ThinLTO+CFI bug ANDROID: soc/tegra: disable ARCH_TEGRA_210_SOC with LTO ANDROID: init: ensure initcall ordering with LTO ANDROID: drivers/misc/lkdtm: disable LTO for rodata.o ANDROID: efi/libstub: disable LTO ANDROID: scripts/mod: disable LTO for empty.c ANDROID: kbuild: fix dynamic ftrace with clang LTO ANDROID: kbuild: add support for Clang LTO ANDROID: kbuild: add CONFIG_LD_IS_LLD FROMGIT: driver core: platform: use the correct callback type for bus_find_device FROMLIST: arm64: implement Shadow Call Stack FROMLIST: arm64: disable SCS for hypervisor code FROMLIST: arm64: vdso: disable Shadow Call Stack FROMLIST: arm64: efi: restore x18 if it was corrupted FROMLIST: arm64: preserve x18 when CPU is suspended FROMLIST: arm64: reserve x18 from general allocation with SCS FROMLIST: arm64: disable function graph tracing with SCS FROMLIST: scs: add support for stack usage debugging FROMLIST: scs: add accounting FROMLIST: add support for Clang's Shadow Call Stack (SCS) FROMLIST: arm64: kernel: avoid x18 in __cpu_soft_restart FROMLIST: arm64: kvm: stop treating register x18 as caller save FROMLIST: arm64/lib: copy_page: avoid x18 register in assembler code FROMLIST: arm64: mm: avoid x18 in idmap_kpti_install_ng_mappings ANDROID: clang: update to 10.0.1 ANDROID: update ABI representation Conflicts: Documentation/devicetree/bindings Documentation/devicetree/bindings/net/wireless/qcom,ath10k.txt arch/arm64/Kconfig drivers/firmware/qcom_scm-64.c drivers/hwtracing/coresight/coresight.c drivers/scsi/ufs/ufs.h drivers/scsi/ufs/ufshcd.c drivers/scsi/ufs/ufshcd.h drivers/scsi/ufs/unipro.h drivers/staging/android/ion/heaps/ion_cma_heap.c drivers/staging/android/ion/heaps/ion_system_heap.c drivers/usb/dwc3/ep0.c drivers/usb/dwc3/gadget.c include/sound/pcm.h include/sound/soc.h kernel/exit.c kernel/sched/core.c Change-Id: I66ea973ddcafd352ba999a1dc98e04df33397e3b Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>	2020-01-23 04:00:53 -08:00
Jordan Crouse	c7f16608d4	include: Fixup headers to pass KERNEL_HEADER_TEST ... Fix up a bunch of headers so that they pass KERNEL_HEADER_TEST to ensure that they are self-contained. Change-Id: Ic0dedbad91f70263452c9a809333fe93c8ee2266 Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>	2020-01-15 09:01:08 -07:00
Greg Kroah-Hartman	09cdc723de	This is the 5.4.5 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl36QR4ACgkQONu9yGCS aT4prg/9Eiypkpf0V1QtxGLmE1M0ylsXhwwvl8YfED2ku/zqzFxm3ht+IQkGBFl9 x7Y4LMkPJenfbQYV3iMk5hgjPJ4CNJiqXI+uD6le2SSp+vRi7U9DzH/JPNgd80qp JSSuAeK43l3dTUx+zNOfziLnnczf8X1gT4V00LArIFQHF+kATZKAaKcRx7Wqouw8 mCt+UoJgGa9Et+yKjDbBIlmALs9e2xPR0ltwxBNCgJO99KE+qDZAXeLAOsPppA7K h2zWpMSczbq9X4MejN2Jbj3aGZueHoXwmtlbXiSglMefAJF1vEt7NmJzdZ4TCWCw ajVOhiW7+PGqmV46nMuSLxDef2osITHR+x8TOUlLMYsqNywUluHnf44GHmzqurzY 6vI1y+nCWKes6Xb2nV5XofphOUNJEMcHXmwntKWicnuexTeBiWWS06UYdxn+ECEY VRwt4rsWmTGwNQpKHG8Kwyi+OLy85JC7iWJORKhpRKrHd1mTNRFNkUtH1BKpkd9b QokoL3YIeyA8pCWYFzCjT5WJy+YvDKI2pp3edByKilg3z2pRPr5c6VYU5mERSIuw EKDuVYHfo/m6mKHfdoBW8LugOB33bbe2Y446b8J+ELwwlv/SnRVIadzzZeQcHudg +FG7jwN+vTBSD1TuPSKg6WzbirM6R4HnGaMyYOdAd6Bzlkg0/CU= =MihI -----END PGP SIGNATURE----- Merge 5.4.5 into android-5.4 Changes in 5.4.5 inet: protect against too small mtu values. mqprio: Fix out-of-bounds access in mqprio_dump net: bridge: deny dev_set_mac_address() when unregistering net: dsa: fix flow dissection on Tx path net: ethernet: ti: cpsw: fix extra rx interrupt net: sched: fix dump qlen for sch_mq/sch_mqprio with NOLOCK subqueues net_sched: validate TCA_KIND attribute in tc_chain_tmplt_add() net: thunderx: start phy before starting autonegotiation net/tls: Fix return values to avoid ENOTSUPP openvswitch: support asymmetric conntrack tcp: md5: fix potential overestimation of TCP option space tipc: fix ordering of tipc module init and exit routine net/mlx5e: Query global pause state before setting prio2buffer net: ipv6: add net argument to ip6_dst_lookup_flow net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup tcp: fix rejected syncookies due to stale timestamps tcp: tighten acceptance of ACKs not matching a child socket tcp: Protect accesses to .ts_recent_stamp with {READ,WRITE}_ONCE() net: core: rename indirect block ingress cb function net: sched: allow indirect blocks to bind to clsact in TC cls_flower: Fix the behavior using port ranges with hw-offload gre: refetch erspan header from skb->data after pskb_may_pull() Fixed updating of ethertype in function skb_mpls_pop hsr: fix a NULL pointer dereference in hsr_dev_xmit() net: Fixed updating of ethertype in skb_mpls_push() net/mlx5e: Fix TXQ indices to be sequential act_ct: support asymmetric conntrack net/mlx5e: Fix SFF 8472 eeprom length net/mlx5e: Fix freeing flow with kfree() and not kvfree() net/mlx5e: Fix translation of link mode into speed net/mlx5e: ethtool, Fix analysis of speed setting page_pool: do not release pool until inflight == 0. xdp: obtain the mem_id mutex before trying to remove an entry. ionic: keep users rss hash across lif reset net: mscc: ocelot: unregister the PTP clock on deinit r8169: add missing RX enabling for WoL on RTL8125 Linux 5.4.5 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I65207949c27553e0bdc8d10740c9f11d97ff8ebf	2019-12-18 16:54:08 +01:00
Jonathan Lemon	05f646cb21	page_pool: do not release pool until inflight == 0. ... [ Upstream commit c3f812cea0d7006469d1cf33a4a9f0a12bb4b3a3 ] The page pool keeps track of the number of pages in flight, and it isn't safe to remove the pool until all pages are returned. Disallow removing the pool until all pages are back, so the pool is always available for page producers. Make the page pool responsible for its own delayed destruction instead of relying on XDP, so the page pool can be used without the xdp memory model. When all pages are returned, free the pool and notify xdp if the pool is registered with the xdp memory system. Have the callback perform a table walk since some drivers (cpsw) may share the pool among multiple xdp_rxq_info. Note that the increment of pages_state_release_cnt may result in inflight == 0, resulting in the pool being released. Fixes: d956a048cd ("xdp: force mem allocator removal and periodic warning") Signed-off-by: Jonathan Lemon <jonathan.lemon@gmail.com> Acked-by: Jesper Dangaard Brouer <brouer@redhat.com> Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2019-12-18 16:09:07 +01:00
Yoshiki Komachi	71bc12b1fb	cls_flower: Fix the behavior using port ranges with hw-offload ... [ Upstream commit 8ffb055beae58574d3e77b4bf9d4d15eace1ca27 ] The recent commit 5c72299fba ("net: sched: cls_flower: Classify packets using port ranges") had added filtering based on port ranges to tc flower. However the commit missed necessary changes in hw-offload code, so the feature gave rise to generating incorrect offloaded flow keys in NIC. One more detailed example is below: $ tc qdisc add dev eth0 ingress $ tc filter add dev eth0 ingress protocol ip flower ip_proto tcp \ dst_port 100-200 action drop With the setup above, an exact match filter with dst_port == 0 will be installed in NIC by hw-offload. IOW, the NIC will have a rule which is equivalent to the following one. $ tc qdisc add dev eth0 ingress $ tc filter add dev eth0 ingress protocol ip flower ip_proto tcp \ dst_port 0 action drop The behavior was caused by the flow dissector which extracts packet data into the flow key in the tc flower. More specifically, regardless of exact match or specified port ranges, fl_init_dissector() set the FLOW_DISSECTOR_KEY_PORTS flag in struct flow_dissector to extract port numbers from skb in skb_flow_dissect() called by fl_classify(). Note that device drivers received the same struct flow_dissector object as used in skb_flow_dissect(). Thus, offloaded drivers could not identify which of these is used because the FLOW_DISSECTOR_KEY_PORTS flag was set to struct flow_dissector in either case. This patch adds the new FLOW_DISSECTOR_KEY_PORTS_RANGE flag and the new tp_range field in struct fl_flow_key to recognize which filters are applied to offloaded drivers. At this point, when filters based on port ranges passed to drivers, drivers return the EOPNOTSUPP error because they do not support the feature (the newly created FLOW_DISSECTOR_KEY_PORTS_RANGE flag). Fixes: 5c72299fba ("net: sched: cls_flower: Classify packets using port ranges") Signed-off-by: Yoshiki Komachi <komachi.yoshiki@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2019-12-18 16:08:49 +01:00
John Hurley	1b511a9d2c	net: core: rename indirect block ingress cb function ... [ Upstream commit dbad3408896c3c5722ec9cda065468b3df16c5bf ] With indirect blocks, a driver can register for callbacks from a device that is does not 'own', for example, a tunnel device. When registering to or unregistering from a new device, a callback is triggered to generate a bind/unbind event. This, in turn, allows the driver to receive any existing rules or to properly clean up installed rules. When first added, it was assumed that all indirect block registrations would be for ingress offloads. However, the NFP driver can, in some instances, support clsact qdisc binds for egress offload. Change the name of the indirect block callback command in flow_offload to remove the 'ingress' identifier from it. While this does not change functionality, a follow up patch will implement a more more generic callback than just those currently just supporting ingress offload. Fixes: 4d12ba4278 ("nfp: flower: allow offloading of matches on 'internal' ports") Signed-off-by: John Hurley <john.hurley@netronome.com> Acked-by: Jakub Kicinski <jakub.kicinski@netronome.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2019-12-18 16:08:47 +01:00
Guillaume Nault	ee0dc0c3f3	tcp: Protect accesses to .ts_recent_stamp with {READ,WRITE}_ONCE() ... [ Upstream commit 721c8dafad26ccfa90ff659ee19755e3377b829d ] Syncookies borrow the ->rx_opt.ts_recent_stamp field to store the timestamp of the last synflood. Protect them with READ_ONCE() and WRITE_ONCE() since reads and writes aren't serialised. Use of .rx_opt.ts_recent_stamp for storing the synflood timestamp was introduced by a0f82f64e2 ("syncookies: remove last_synq_overflow from struct tcp_sock"). But unprotected accesses were already there when timestamp was stored in .last_synq_overflow. Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Signed-off-by: Guillaume Nault <gnault@redhat.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2019-12-18 16:08:45 +01:00
Guillaume Nault	e70ee16481	tcp: tighten acceptance of ACKs not matching a child socket ... [ Upstream commit cb44a08f8647fd2e8db5cc9ac27cd8355fa392d8 ] When no synflood occurs, the synflood timestamp isn't updated. Therefore it can be so old that time_after32() can consider it to be in the future. That's a problem for tcp_synq_no_recent_overflow() as it may report that a recent overflow occurred while, in fact, it's just that jiffies has grown past 'last_overflow' + TCP_SYNCOOKIE_VALID + 2^31. Spurious detection of recent overflows lead to extra syncookie verification in cookie_v[46]_check(). At that point, the verification should fail and the packet dropped. But we should have dropped the packet earlier as we didn't even send a syncookie. Let's refine tcp_synq_no_recent_overflow() to report a recent overflow only if jiffies is within the [last_overflow, last_overflow + TCP_SYNCOOKIE_VALID] interval. This way, no spurious recent overflow is reported when jiffies wraps and 'last_overflow' becomes in the future from the point of view of time_after32(). However, if jiffies wraps and enters the [last_overflow, last_overflow + TCP_SYNCOOKIE_VALID] interval (with 'last_overflow' being a stale synflood timestamp), then tcp_synq_no_recent_overflow() still erroneously reports an overflow. In such cases, we have to rely on syncookie verification to drop the packet. We unfortunately have no way to differentiate between a fresh and a stale syncookie timestamp. In practice, using last_overflow as lower bound is problematic. If the synflood timestamp is concurrently updated between the time we read jiffies and the moment we store the timestamp in 'last_overflow', then 'now' becomes smaller than 'last_overflow' and tcp_synq_no_recent_overflow() returns true, potentially dropping a valid syncookie. Reading jiffies after loading the timestamp could fix the problem, but that'd require a memory barrier. Let's just accommodate for potential timestamp growth instead and extend the interval using 'last_overflow - HZ' as lower bound. Signed-off-by: Guillaume Nault <gnault@redhat.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2019-12-18 16:08:43 +01:00
Guillaume Nault	9afe690185	tcp: fix rejected syncookies due to stale timestamps ... [ Upstream commit 04d26e7b159a396372646a480f4caa166d1b6720 ] If no synflood happens for a long enough period of time, then the synflood timestamp isn't refreshed and jiffies can advance so much that time_after32() can't accurately compare them any more. Therefore, we can end up in a situation where time_after32(now, last_overflow + HZ) returns false, just because these two values are too far apart. In that case, the synflood timestamp isn't updated as it should be, which can trick tcp_synq_no_recent_overflow() into rejecting valid syncookies. For example, let's consider the following scenario on a system with HZ=1000: * The synflood timestamp is 0, either because that's the timestamp of the last synflood or, more commonly, because we're working with a freshly created socket. * We receive a new SYN, which triggers synflood protection. Let's say that this happens when jiffies == 2147484649 (that is, 'synflood timestamp' + HZ + 2^31 + 1). * Then tcp_synq_overflow() doesn't update the synflood timestamp, because time_after32(2147484649, 1000) returns false. With: - 2147484649: the value of jiffies, aka. 'now'. - 1000: the value of 'last_overflow' + HZ. * A bit later, we receive the ACK completing the 3WHS. But cookie_v[46]_check() rejects it because tcp_synq_no_recent_overflow() says that we're not under synflood. That's because time_after32(2147484649, 120000) returns false. With: - 2147484649: the value of jiffies, aka. 'now'. - 120000: the value of 'last_overflow' + TCP_SYNCOOKIE_VALID. Of course, in reality jiffies would have increased a bit, but this condition will last for the next 119 seconds, which is far enough to accommodate for jiffie's growth. Fix this by updating the overflow timestamp whenever jiffies isn't within the [last_overflow, last_overflow + HZ] range. That shouldn't have any performance impact since the update still happens at most once per second. Now we're guaranteed to have fresh timestamps while under synflood, so tcp_synq_no_recent_overflow() can safely use it with time_after32() in such situations. Stale timestamps can still make tcp_synq_no_recent_overflow() return the wrong verdict when not under synflood. This will be handled in the next patch. For 64 bits architectures, the problem was introduced with the conversion of ->tw_ts_recent_stamp to 32 bits integer by commit cca9bab1b7 ("tcp: use monotonic timestamps for PAWS"). The problem has always been there on 32 bits architectures. Fixes: cca9bab1b7 ("tcp: use monotonic timestamps for PAWS") Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Signed-off-by: Guillaume Nault <gnault@redhat.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2019-12-18 16:08:43 +01:00
Sabrina Dubroca	48d58ae9e8	net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup ... [ Upstream commit 6c8991f41546c3c472503dff1ea9daaddf9331c2 ] ipv6_stub uses the ip6_dst_lookup function to allow other modules to perform IPv6 lookups. However, this function skips the XFRM layer entirely. All users of ipv6_stub->ip6_dst_lookup use ip_route_output_flow (via the ip_route_output_key and ip_route_output helpers) for their IPv4 lookups, which calls xfrm_lookup_route(). This patch fixes this inconsistent behavior by switching the stub to ip6_dst_lookup_flow, which also calls xfrm_lookup_route(). This requires some changes in all the callers, as these two functions take different arguments and have different return types. Fixes: 5f81bd2e5d ("ipv6: export a stub for IPv6 symbols used by vxlan") Reported-by: Xiumei Mu <xmu@redhat.com> Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2019-12-18 16:08:42 +01:00
Sabrina Dubroca	8cadbd146a	net: ipv6: add net argument to ip6_dst_lookup_flow ... [ Upstream commit c4e85f73afb6384123e5ef1bba3315b2e3ad031e ] This will be used in the conversion of ipv6_stub to ip6_dst_lookup_flow, as some modules currently pass a net argument without a socket to ip6_dst_lookup. This is equivalent to commit 343d60aada ("ipv6: change ipv6_stub_impl.ipv6_dst_lookup to take net argument"). Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2019-12-18 16:08:40 +01:00
Eric Dumazet	20f72aae9b	inet: protect against too small mtu values. ... [ Upstream commit 501a90c945103e8627406763dac418f20f3837b2 ] syzbot was once again able to crash a host by setting a very small mtu on loopback device. Let's make inetdev_valid_mtu() available in include/net/ip.h, and use it in ip_setup_cork(), so that we protect both ip_append_page() and __ip_append_data() Also add a READ_ONCE() when the device mtu is read. Pairs this lockless read with one WRITE_ONCE() in __dev_set_mtu(), even if other code paths might write over this field. Add a big comment in include/linux/netdevice.h about dev->mtu needing READ_ONCE()/WRITE_ONCE() annotations. Hopefully we will add the missing ones in followup patches. [1] refcount_t: saturated; leaking memory. WARNING: CPU: 0 PID: 9464 at lib/refcount.c:22 refcount_warn_saturate+0x138/0x1f0 lib/refcount.c:22 Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 9464 Comm: syz-executor850 Not tainted 5.4.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x197/0x210 lib/dump_stack.c:118 panic+0x2e3/0x75c kernel/panic.c:221 __warn.cold+0x2f/0x3e kernel/panic.c:582 report_bug+0x289/0x300 lib/bug.c:195 fixup_bug arch/x86/kernel/traps.c:174 [inline] fixup_bug arch/x86/kernel/traps.c:169 [inline] do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:267 do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:286 invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1027 RIP: 0010:refcount_warn_saturate+0x138/0x1f0 lib/refcount.c:22 Code: 06 31 ff 89 de e8 c8 f5 e6 fd 84 db 0f 85 6f ff ff ff e8 7b f4 e6 fd 48 c7 c7 e0 71 4f 88 c6 05 56 a6 a4 06 01 e8 c7 a8 b7 fd <0f> 0b e9 50 ff ff ff e8 5c f4 e6 fd 0f b6 1d 3d a6 a4 06 31 ff 89 RSP: 0018:ffff88809689f550 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff815e4336 RDI: ffffed1012d13e9c RBP: ffff88809689f560 R08: ffff88809c50a3c0 R09: fffffbfff15d31b1 R10: fffffbfff15d31b0 R11: ffffffff8ae98d87 R12: 0000000000000001 R13: 0000000000040100 R14: ffff888099041104 R15: ffff888218d96e40 refcount_add include/linux/refcount.h:193 [inline] skb_set_owner_w+0x2b6/0x410 net/core/sock.c:1999 sock_wmalloc+0xf1/0x120 net/core/sock.c:2096 ip_append_page+0x7ef/0x1190 net/ipv4/ip_output.c:1383 udp_sendpage+0x1c7/0x480 net/ipv4/udp.c:1276 inet_sendpage+0xdb/0x150 net/ipv4/af_inet.c:821 kernel_sendpage+0x92/0xf0 net/socket.c:3794 sock_sendpage+0x8b/0xc0 net/socket.c:936 pipe_to_sendpage+0x2da/0x3c0 fs/splice.c:458 splice_from_pipe_feed fs/splice.c:512 [inline] __splice_from_pipe+0x3ee/0x7c0 fs/splice.c:636 splice_from_pipe+0x108/0x170 fs/splice.c:671 generic_splice_sendpage+0x3c/0x50 fs/splice.c:842 do_splice_from fs/splice.c:861 [inline] direct_splice_actor+0x123/0x190 fs/splice.c:1035 splice_direct_to_actor+0x3b4/0xa30 fs/splice.c:990 do_splice_direct+0x1da/0x2a0 fs/splice.c:1078 do_sendfile+0x597/0xd00 fs/read_write.c:1464 __do_sys_sendfile64 fs/read_write.c:1525 [inline] __se_sys_sendfile64 fs/read_write.c:1511 [inline] __x64_sys_sendfile64+0x1dd/0x220 fs/read_write.c:1511 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x441409 Code: e8 ac e8 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb 08 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fffb64c4f78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441409 RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000005 RBP: 0000000000073b8a R08: 0000000000000010 R09: 0000000000000010 R10: 0000000000010001 R11: 0000000000000246 R12: 0000000000402180 R13: 0000000000402210 R14: 0000000000000000 R15: 0000000000000000 Kernel Offset: disabled Rebooting in 86400 seconds.. Fixes: 1470ddf7f8 ("inet: Remove explicit write references to sk/inet in ip_append_data") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2019-12-18 16:08:17 +01:00
Yue Ma	9e70a33492	net: cnss2: Update CNSS2 driver ... This is a update of the CNSS2 driver and associated files as of msm-4.19 commit c3714c8e90ab ("cnss2: fix memory leaks"). Change-Id: I09119dac5294a6cfd12b0a519d173f46ba6beffe Signed-off-by: Yue Ma <yuem@codeaurora.org>	2019-12-13 16:43:44 -08:00
Maciej Żenczykowski	05665fed98	BACKPORT: FROMLIST: net: introduce ip_local_unbindable_ports sysctl ... and associated inet_is_local_unbindable_port() helper function: use it to make explicitly binding to an unbindable port return -EPERM 'Operation not permitted'. Autobind doesn't honour this new sysctl since: (a) you can simply set both if that's the behaviour you desire (b) there could be a use for preventing explicit while allowing auto (c) it's faster in the relatively critical path of doing port selection during connect() to only check one bitmap instead of both Various ports may have special use cases which are not suitable for use by general userspace applications. Currently, ports specified in ip_local_reserved_ports sysctl will not be returned only in case of automatic port assignment, but nothing prevents you from explicitly binding to them - even from an entirely unprivileged process. In certain cases it is desirable to prevent the host from assigning the ports even in case of explicit binds, even from superuser processes. Example use cases might be: - a port being stolen by the nic for remote serial console, remote power management or some other sort of debugging functionality (crash collection, gdb, direct access to some other microcontroller on the nic or motherboard, remote management of the nic itself). - a transparent proxy where packets are being redirected: in case a socket matches this connection, packets from this application would be incorrectly sent to one of the endpoints. Initially I wanted to solve this problem via the simple one line: static inline bool inet_port_requires_bind_service(struct net *net, unsigned short port) { - return port < net->ipv4.sysctl_ip_prot_sock; + return port < net->ipv4.sysctl_ip_prot_sock || inet_is_local_reserved_port(net, port); } However, this doesn't work for two reasons: (a) it changes userspace visible behaviour of the existing local reserved ports sysctl, and there appears to be enough documentation on the internet talking about setting it to make this a bad idea (b) it doesn't prevent privileged apps from using these ports, CAP_BIND_SERVICE is relatively likely to be available to, for example, a recursive DNS server so it can listed on port 53, which also needs to do src port randomization for outgoing queries due to security reasons (and it thus does manual port binding). If we *know* that certain ports are simply unusable, then it's better nothing even gets the opportunity to try to use them. This way we at least get a quick failure, instead of some sort of timeout (or possibly even corruption of the data stream of the non-kernel based use case). Test: vm:~# cat /proc/sys/net/ipv4/ip_local_unbindable_ports vm:~# python -c 'import socket; s = socket.socket(socket.AF_INET6, socket.SOCK_STREAM, 0); s.bind(("::", 3967))' vm:~# python -c 'import socket; s = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM, 0); s.bind(("::", 3967))' vm:~# echo 3967 > /proc/sys/net/ipv4/ip_local_unbindable_ports vm:~# cat /proc/sys/net/ipv4/ip_local_unbindable_ports 3967 vm:~# python -c 'import socket; s = socket.socket(socket.AF_INET6, socket.SOCK_STREAM, 0); s.bind(("::", 3967))' socket.error: (1, 'Operation not permitted') vm:~# python -c 'import socket; s = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM, 0); s.bind(("::", 3967))' socket.error: (1, 'Operation not permitted') Cc: Sean Tranchetti <stranche@codeaurora.org> Cc: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org> Cc: Eric Dumazet <edumazet@google.com> Cc: Linux SCTP <linux-sctp@vger.kernel.org> Signed-off-by: Maciej Żenczykowski <maze@google.com> Bug: 140404597 Link: https://patchwork.ozlabs.org/patch/1206704/ Change-Id: Ie96207bea90ae1345adf7b45724d0caf4d6e52c2 Signed-off-by: Todd Kjos <tkjos@google.com>	2019-12-13 09:50:32 -08:00
Greg Kroah-Hartman	164bf1a6c4	This is the 5.4.2 stable release ... -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl3oJb4ACgkQONu9yGCS aT6BbA/+JvPxr4dvUq6KwkWQykskDEWMxSFaFiPEhJF6FCtPDC+tleFJ/jDtxHHp 9BiF22ykQlWW+S5NJIhiWZ0fiP9I1kTCQuSpUOPyIL1wAnA2EPFASJWXB38nbvpD x2adWTPgpWQP6AFxysR06/JiWblmSF+ZKTsIrKLI1e4dqJ7c7/ts9ZCUegve3Kyt aQqeDxzD+Gqu1e2LxK0hmTokVnUwKvoXYZydWnfCqu4PotOuklzg2Tf9dolQTXtn aDLLcRVMUfKbWL5Nx+Acjgd2WbocEP4q0orQWsWCiVWZkQ77SjzWzEY1aI0LnVSg XdWE3ccErtnuMsYQh9Z2QkMNlR9AVRgbqCgGyx92H9hbCnRJko7z8qinxrSy9Iaw xTj9W5/KTd9nTJepoQxNImk4BP/6lVF6e04tOIWrdks04VumOe/yrSyQwamm4By0 HcT8iSyVsC7u8jY8AwZ1qPMlHWCUoBvBqei+TMC9kwGUnpfK+dFeAxxBoBQQXUy8 uCjqKcQFh/KkKNv0jaCflmInqEglL+bDNEBgiY+krzhKuGXF+nntE4meZsLI+qGh zhKzo9sAUFtMiSmsNH5zSS7nGyEZVdW5ulBEM7BKEaj0Lzn9VhByYeim9aU+5zaR CYlyFcpb1ZisEOA4Gv+XuQ7UPLrUOyjJq2WM0Z1Lt77wGAugl5I= =gaiC -----END PGP SIGNATURE----- Merge 5.4.2 into android-5.4 Changes in 5.4.2 io_uring: async workers should inherit the user creds net: separate out the msghdr copy from ___sys_{send,recv}msg() net: disallow ancillary data for __sys_{send,recv}msg_file() crypto: inside-secure - Fix stability issue with Macchiatobin driver core: platform: use the correct callback type for bus_find_device usb: dwc2: use a longer core rest timeout in dwc2_core_reset() staging: wilc1000: fix illegal memory access in wilc_parse_join_bss_param() staging: rtl8192e: fix potential use after free staging: rtl8723bs: Drop ACPI device ids staging: rtl8723bs: Add 024c:0525 to the list of SDIO device-ids USB: serial: ftdi_sio: add device IDs for U-Blox C099-F9P mei: bus: prefix device names on bus with the bus name mei: me: add comet point V device id thunderbolt: Power cycle the router if NVM authentication fails x86/fpu: Don't cache access to fpu_fpregs_owner_ctx gve: Fix the queue page list allocated pages count macvlan: schedule bc_work even if error mdio_bus: don't use managed reset-controller net: dsa: sja1105: fix sja1105_parse_rgmii_delays() net: macb: add missed tasklet_kill net: psample: fix skb_over_panic net: sched: fix `tc -s class show` no bstats on class with nolock subqueues openvswitch: fix flow command message size sctp: Fix memory leak in sctp_sf_do_5_2_4_dupcook slip: Fix use-after-free Read in slip_open sctp: cache netns in sctp_ep_common openvswitch: drop unneeded BUG_ON() in ovs_flow_cmd_build_info() openvswitch: remove another BUG_ON() net/tls: take into account that bpf_exec_tx_verdict() may free the record net/tls: free the record on encryption error net: skmsg: fix TLS 1.3 crash with full sk_msg selftests/tls: add a test for fragmented messages net/tls: remove the dead inplace_crypto code net/tls: use sg_next() to walk sg entries selftests: bpf: test_sockmap: handle file creation failures gracefully selftests: bpf: correct perror strings tipc: fix link name length check selftests: pmtu: use -oneline for ip route list cache r8169: fix jumbo configuration for RTL8168evl r8169: fix resume on cable plug-in ext4: add more paranoia checking in ext4_expand_extra_isize handling Revert "jffs2: Fix possible null-pointer dereferences in jffs2_add_frag_to_fragtree()" crypto: talitos - Fix build error by selecting LIB_DES HID: core: check whether Usage Page item is after Usage ID items platform/x86: hp-wmi: Fix ACPI errors caused by too small buffer platform/x86: hp-wmi: Fix ACPI errors caused by passing 0 as input size Linux 5.4.2 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I8d695c1db60112decd0939927ccb472eb6c5286c	2019-12-04 23:46:13 +01:00
Jakub Kicinski	569cac5a50	net/tls: use sg_next() to walk sg entries ... [ Upstream commit c5daa6cccdc2f94aca2c9b3fa5f94e4469997293 ] Partially sent record cleanup path increments an SG entry directly instead of using sg_next(). This should not be a problem today, as encrypted messages should be always allocated as arrays. But given this is a cleanup path it's easy to miss was this ever to change. Use sg_next(), and simplify the code. Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com> Reviewed-by: Simon Horman <simon.horman@netronome.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2019-12-04 22:31:02 +01:00
Jakub Kicinski	a58365a79a	net/tls: remove the dead inplace_crypto code ... [ Upstream commit 9e5ffed37df68d0ccfb2fdc528609e23a1e70ebe ] Looks like when BPF support was added by commit d3b18ad31f ("tls: add bpf support to sk_msg handling") and commit d829e9c411 ("tls: convert to generic sk_msg interface") it broke/removed the support for in-place crypto as added by commit 4e6d47206c ("tls: Add support for inplace records encryption"). The inplace_crypto member of struct tls_rec is dead, inited to zero, and sometimes set to zero again. It used to be set to 1 when record was allocated, but the skmsg code doesn't seem to have been written with the idea of in-place crypto in mind. Since non trivial effort is required to bring the feature back and we don't really have the HW to measure the benefit just remove the left over support for now to avoid confusing readers. Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com> Reviewed-by: Simon Horman <simon.horman@netronome.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2019-12-04 22:31:02 +01:00
Xin Long	0111438d7c	sctp: cache netns in sctp_ep_common ... [ Upstream commit 312434617cb16be5166316cf9d08ba760b1042a1 ] This patch is to fix a data-race reported by syzbot: BUG: KCSAN: data-race in sctp_assoc_migrate / sctp_hash_obj write to 0xffff8880b67c0020 of 8 bytes by task 18908 on cpu 1: sctp_assoc_migrate+0x1a6/0x290 net/sctp/associola.c:1091 sctp_sock_migrate+0x8aa/0x9b0 net/sctp/socket.c:9465 sctp_accept+0x3c8/0x470 net/sctp/socket.c:4916 inet_accept+0x7f/0x360 net/ipv4/af_inet.c:734 __sys_accept4+0x224/0x430 net/socket.c:1754 __do_sys_accept net/socket.c:1795 [inline] __se_sys_accept net/socket.c:1792 [inline] __x64_sys_accept+0x4e/0x60 net/socket.c:1792 do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x44/0xa9 read to 0xffff8880b67c0020 of 8 bytes by task 12003 on cpu 0: sctp_hash_obj+0x4f/0x2d0 net/sctp/input.c:894 rht_key_get_hash include/linux/rhashtable.h:133 [inline] rht_key_hashfn include/linux/rhashtable.h:159 [inline] rht_head_hashfn include/linux/rhashtable.h:174 [inline] head_hashfn lib/rhashtable.c:41 [inline] rhashtable_rehash_one lib/rhashtable.c:245 [inline] rhashtable_rehash_chain lib/rhashtable.c:276 [inline] rhashtable_rehash_table lib/rhashtable.c:316 [inline] rht_deferred_worker+0x468/0xab0 lib/rhashtable.c:420 process_one_work+0x3d4/0x890 kernel/workqueue.c:2269 worker_thread+0xa0/0x800 kernel/workqueue.c:2415 kthread+0x1d4/0x200 drivers/block/aoe/aoecmd.c:1253 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352 It was caused by rhashtable access asoc->base.sk when sctp_assoc_migrate is changing its value. However, what rhashtable wants is netns from asoc base.sk, and for an asoc, its netns won't change once set. So we can simply fix it by caching netns since created. Fixes: d6c0256a60 ("sctp: add the rhashtable apis for sctp global transport hashtable") Reported-by: syzbot+e3b35fe7918ff0ee474e@syzkaller.appspotmail.com Signed-off-by: Xin Long <lucien.xin@gmail.com> Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2019-12-04 22:30:57 +01:00
Raghavendra Rao Ananta	43dee37fa9	Merge remote-tracking branch 'remotes/origin/tmp-0453f563cce0' into msm-5.4 ... * remotes/origin/tmp-0453f563cce0: FROMLIST: pwm: Convert period and duty cycle to u64 ANDROID: gki_defconfig: FW_CACHE to no FROMGIT: firmware_class: make firmware caching configurable ANDROID: gki_defconfig: removed CONFIG_PM_WAKELOCKS ANDROID: gki_defconfig: enable CONFIG_IKHEADERS as m ANDROID: update ABI representation FROMLIST: reboot: Export reboot_mode FROMLIST: iommu/arm-smmu: Update my email address in MODULE_AUTHOR() FROMLIST: iommu/arm-smmu: Allow building as a module FROMLIST: iommu/arm-smmu: Unregister IOMMU and bus ops on device removal FROMLIST: iommu/arm-smmu-v3: Allow building as a module FROMLIST: iommu/arm-smmu-v3: Unregister IOMMU and bus ops on device removal FROMLIST: iommu/arm-smmu: Prevent forced unbinding of Arm SMMU drivers FROMLIST: Revert "iommu/arm-smmu: Make arm-smmu explicitly non-modular" FROMLIST: Revert "iommu/arm-smmu: Make arm-smmu-v3 explicitly non-modular" FROMLIST: drivers/iommu: Allow IOMMU bus ops to be unregistered FROMLIST: iommu/of: Take a ref to the IOMMU driver during ->of_xlate() FROMLIST: drivers/iommu: Take a ref to the IOMMU driver prior to ->add_device() FROMLIST: PCI: Export pci_ats_disabled() as a GPL symbol to modules FROMLIST: iommu/of: Request ACS from the PCI core when configuring IOMMU linkage FROMLIST: drivers/iommu: Export core IOMMU API symbols to permit modular drivers FROMGIT: of: property: Add device link support for "iommu-map" Revert "FROMLIST: iommu: Export core IOMMU functions to kernel modules" Revert "FROMLIST: PCI: Export PCI ACS and DMA searching functions to modules" Revert "FROMLIST: of: Export of_phandle_iterator_args() to modules" ANDROID: initial branch preparations for 5.4 Linux 5.4 cramfs: fix usage on non-MTD device Revert "Input: synaptics - enable RMI mode for X1 Extreme 2nd Generation" afs: Fix large file support afs: Fix possible assert with callbacks from yfs servers r8152: avoid to call napi_disable twice MAINTAINERS: Add myself as maintainer of virtio-vsock udp: drop skb extensions before marking skb stateless net: rtnetlink: prevent underflows in do_setvfinfo() mm/ksm.c: don't WARN if page is still mapped in remove_stable_node() mm/memory_hotplug: don't access uninitialized memmaps in shrink_zone_span() Revert "fs: ocfs2: fix possible null-pointer dereferences in ocfs2_xa_prepare_entry()" can: m_can_platform: remove unnecessary m_can_class_resume() call can: m_can_platform: set net_device structure as driver data hv_netvsc: Fix send_table offset in case of a host bug hv_netvsc: Fix offset usage in netvsc_send_table() net-ipv6: IPV6_TRANSPARENT - check NET_RAW prior to NET_ADMIN ANDROID: gki_defconfig: disable FUNCTION_TRACER sfc: Only cancel the PPS workqueue if it exists nfc: port100: handle command failure cleanly drm/i915/fbdev: Restore physical addresses for fb_mmap() net-sysfs: fix netdev_queue_add_kobject() breakage ANDROID: update ABI representation ANDROID: add unstripped modules to the distribution Revert "drm/amd/display: enable S/G for RAVEN chip" drm/amdgpu: disable gfxoff on original raven drm/amdgpu: disable gfxoff when using register read interface drm/amd/powerplay: correct fine grained dpm force level setting drm/amd/powerplay: issue no PPSMC_MSG_GetCurrPkgPwr on unsupported ASICs drm/amdgpu: remove experimental flag for Navi14 r8152: Re-order napi_disable in rtl8152_close net: qca_spi: Move reset_count to struct qcaspi net: qca_spi: fix receive buffer size check net/ibmvnic: Ignore H_FUNCTION return from H_EOI to tolerate XIVE mode Revert "net/ibmvnic: Fix EOI when running in XIVE mode" net/mlxfw: Verify FSM error code translation doesn't exceed array size net/mlx5: Update the list of the PCI supported devices net/mlx5: Fix auto group size calculation net/mlx5e: Add missing capability bit check for IP-in-IP net/mlx5e: Do not use non-EXT link modes in EXT mode net/mlx5e: Fix set vf link state error flow net/mlx5: DR, Limit STE hash table enlarge based on bytemask net/mlx5: DR, Skip rehash for tables with byte mask zero net/mlx5: DR, Fix invalid EQ vector number on CQ creation net/mlx5e: Reorder mirrer action parsing to check for encap first net/mlx5e: Fix ingress rate configuration for representors net/mlx5e: Fix error flow cleanup in mlx5e_tc_tun_create_header_ipv4/6 s390/qeth: return proper errno on IO error s390/qeth: fix potential deadlock on workqueue flush ipv6/route: return if there is no fib_nh_gw_family net-sysfs: Fix reference count leak in rx|netdev_queue_add_kobject arm64: uaccess: Remove uaccess_*_not_uao asm macros arm64: uaccess: Ensure PAN is re-enabled after unhandled uaccess fault BACKPORT: FROMLIST: pwm: Add support for different PWM output types ANDROID: SoC: core: Introduce macro SOC_SINGLE_MULTI_EXT ANDROID: usb: gadget: configfs: fix compiler warning fork: fix pidfd_poll()'s return type PM: QoS: Invalidate frequency QoS requests after removal virtio_balloon: fix shrinker count virtio_balloon: fix shrinker scan number of pages mdio_bus: Fix init if CONFIG_RESET_CONTROLLER=n Revert "mdio_bus: fix mdio_register_device when RESET_CONTROLLER is disabled" net: hns3: fix a wrong reset interrupt status mask net: fec: fix clock count mis-match net/sched: act_pedit: fix WARN() in the traffic path net: phylink: fix link mode modification in PHY mode net: phylink: update documentation on create and destroy r8169: disable TSO on a single version of RTL8168c to fix performance MAINTAINERS: forcedeth: Change Zhu Yanjun's email address taprio: don't reject same mqprio settings net/tls: enable sk_msg redirect to tls socket egress afs: Fix missing timeout reset ANDROID: drivers: gpu: drm: add support to batch commands gve: fix dma sync bug where not all pages synced drm/i915: make pool objects read-only mdio_bus: Fix init if CONFIG_RESET_CONTROLLER=n nbd:fix memory leak in nbd_get_socket() virtio_console: allocate inbufs in add_port() only if it is needed virtio_ring: fix return code on DMA mapping fails mdio_bus: fix mdio_register_device when RESET_CONTROLLER is disabled net/ipv4: fix sysctl max for fib_multipath_hash_policy phy: mdio-sun4i: add missed regulator_disable in remove net/mlx4_en: Fix wrong limitation for number of TX rings net: sched: ensure opts_len <= IP_TUNNEL_OPTS_MAX in act_tunnel_key mlxsw: spectrum_router: Fix determining underlay for a GRE tunnel net: atm: Reduce the severity of logging in unlink_clip_vcc ANDROID: virtio_blk: Remove BUG_ON for discard/zero ops drm/i915: Protect request peeking with RCU drm/i915/userptr: Try to acquire the page lock around set_page_dirty() drm/i915/pmu: "Frequency" is reported as accumulated cycles drm/i915: Preload LUTs if the hw isn't currently using them drm/i915: Don't oops in dumb_create ioctl if we have no crtcs ANDROID: usb: gadget: configfs: Support multiple android instances Linux 5.4-rc8 net/mlx4_en: fix mlx4 ethtool -N insertion Revert "hwrng: core - Freeze khwrng thread during suspend" ipmr: Fix skb headroom in ipmr_get_route(). net: hns3: cleanup of stray struct hns3_link_mode_mapping net/smc: fix fastopen for non-blocking connect() rds: ib: update WR sizes when bringing up connection net: gemini: add missed free_netdev net: dsa: tag_8021q: Fix dsa_8021q_restore_pvid for an absent pvid seg6: fix skb transport_header after decap_and_validate() seg6: fix srh pointer in get_srh() net: stmmac: Use the correct style for SPDX License Identifier octeontx2-af: Use the correct style for SPDX License Identifier mm/debug.c: PageAnon() is true for PageKsm() pages mm/debug.c: __dump_page() prints an extra line mm/page_io.c: do not free shared swap slots mm/memory_hotplug: fix try_offline_node() mm,thp: recheck each page before collapsing file THP mm: slub: really fix slab walking for init_on_free mm: hugetlb: switch to css_tryget() in hugetlb_cgroup_charge_cgroup() mm: memcg: switch to css_tryget() in get_mem_cgroup_from_mm() lib/xz: fix XZ_DYNALLOC to avoid useless memory reallocations mm: fix trying to reclaim unevictable lru page when calling madvise_pageout mm: mempolicy: fix the wrong return value and potential pages leak of mbind ANDROID: ion: Fix buffer_lock mutex initialization Input: synaptics - enable RMI mode for X1 Extreme 2nd Generation i2c: core: fix use after free in of_i2c_notify i2c: acpi: Force bus speed to 400KHz if a Silead touchscreen is present ptp: Extend the test program to check the external time stamp flags. mlx5: Reject requests to enable time stamping on both edges. igb: Reject requests that fail to enable time stamping on both edges. dp83640: Reject requests to enable time stamping on both edges. mv88e6xxx: Reject requests to enable time stamping on both edges. ptp: Introduce strict checking of external time stamp options. renesas: reject unsupported external timestamp flags mlx5: reject unsupported external timestamp flags igb: reject unsupported external timestamp flags dp83640: reject unsupported external timestamp flags mv88e6xxx: reject unsupported external timestamp flags net: reject PTP periodic output requests with unsupported flags ptp: Validate requests to enable time stamping of external signals. net: ep93xx_eth: fix mismatch of request_mem_region in remove ax88172a: fix information leak on short answers selftests: mlxsw: Adjust test to recent changes Input: synaptics-rmi4 - destroy F54 poller workqueue when removing Input: ff-memless - kill timer in destroy() FROMGIT: driver core: Allow device link operations inside sync_state() afs: Fix race in commit bulk status fetch Revert "ANDROID: Revert "Merge tag 'modules-for-v5.4' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux"" sched/uclamp: Fix incorrect condition KVM: Add a comment describing the /dev/kvm no_compat handling net: hns3: fix ETS bandwidth validation bug net: hns3: reallocate SSU' buffer size when pfc_en changes net: hns3: add compatible handling for MAC VLAN switch parameter configuration ravb: implement MTU change while device is up tipc: add back tipc prefix to log messages ANDROID: uid_sys_stats: avoid double accounting of dying threads ANDROID: drm: edid: add support for additional CEA extension blocks ANDROID: include: uapi: drm: add additional drm mode flags ANDROID: drivers: gpu: drm: fix bugs encountered while fuzzing ANDROID: driver: gpu: drm: add notifier for panel related events ANDROID: include: drm: add the definitions for DP Link Compliance tests ANDROID: drm: dsi: add two DSI mode flags for BLLP ANDROID: include: drm: support unicasting mipi cmds to dsi ctrls ANDROID: include: drm: increase DRM max property count to 64 ANDROID: drivers: gpu: drm: add support for secure framebuffer ANDROID: include: uapi: drm: add additional QCOM modifiers ANDROID: build kernels with llvm-nm and llvm-objcopy drm/amdgpu: fix null pointer deref in firmware header printing rsxx: add missed destroy_workqueue calls in remove iocost: check active_list of all the ancestors in iocg_activate() rbd: silence bogus uninitialized warning in rbd_object_map_update_finish() ceph: increment/decrement dio counter on async requests ceph: take the inode lock before acquiring cap refs ALSA: usb-audio: Fix incorrect size check for processing/extension units KVM: x86/mmu: Take slots_lock when using kvm_mmu_zap_all_fast() kbuild: tell sparse about the $ARCH sparc: vdso: fix build error of vdso32 block, bfq: deschedule empty bfq_queues not referred by any process mmc: sdhci-of-at91: fix quirk2 overwrite ALSA: usb-audio: Fix incorrect NULL check in create_yamaha_midi_quirk() slcan: Fix memory leak in error path io_uring: ensure registered buffer import returns the IO length net: cdc_ncm: Signedness bug in cdc_ncm_set_dgram_size() io_uring: Fix getting file for timeout ANDROID: scsi: ufs-qcom: Enable BROKEN_CRYPTO quirk flag ANDROID: scsi: ufs-hisi: Enable BROKEN_CRYPTO quirk flag ANDROID: scsi: ufs: Add quirk bit for controllers that don't play well with inline crypto ANDROID: scsi: ufs: UFS init should not require inline crypto gpiolib: acpi: Add Terra Pad 1061 to the run_edge_events_on_boot_blacklist drm/i915/tgl: MOCS table update Revert "drm/i915/ehl: Update MOCS table for EHL" slip: Fix memory leak in slip_open error path net: usb: qmi_wwan: add support for Foxconn T77W968 LTE modules KVM: Forbid /dev/kvm being opened by a compat task when CONFIG_KVM_COMPAT=n KVM: X86: Reset the three MSR list number variables to 0 in kvm_init_msr_list() selftests: kvm: fix build with glibc >= 2.30 kvm: x86: disable shattered huge page recovery for PREEMPT_RT. drm/sun4i: tcon: Set min division of TCON0_DCLK to 1. tools: gpio: Correctly add make dependencies for gpio_utils x86/resctrl: Fix potential lockdep warning scripts/tools-support-relr.sh: un-quote variables Revert "ANDROID: Revert "Merge tag 'modules-for-v5.4' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux"" ALSA: pcm: Fix stream lock usage in snd_pcm_period_elapsed() ALSA: usb-audio: not submit urb for stopped endpoint can: j1939: warn if resources are still linked on destroy can: j1939: j1939_can_recv(): add priv refcounting can: j1939: transport: j1939_cancel_active_session(): use hrtimer_try_to_cancel() instead of hrtimer_cancel() can: j1939: make sure socket is held as long as session exists can: j1939: transport: make sure the aborted session will be deactivated only once can: j1939: socket: rework socket locking for j1939_sk_release() and j1939_sk_sendmsg() can: j1939: main: j1939_ndev_to_priv(): avoid crash if can_ml_priv is NULL can: j1939: move j1939_priv_put() into sk_destruct callback can: af_can: export can_sock_destruct() perf/core: Fix missing static inline on perf_cgroup_switch() perf/core: Consistently fail fork on allocation failures perf/aux: Disallow aux_output for kernel events perf/core: Reattach a misplaced comment perf/aux: Fix the aux_output group inheritance fix perf/core: Disallow uncore-cgroup events sched/pelt: Fix update of blocked PELT ordering sched/core: Avoid spurious lock dependencies dpaa2-eth: free already allocated channels on probe defer Input: cyttsp4_core - fix use after free bug Input: synaptics-rmi4 - clear IRQ enables for F54 Remove VirtualBox guest shared folders filesystem net/smc: fix refcount non-blocking connect() -part 2 drm/i915: update rawclk also on resume x86/quirks: Disable HPET on Intel Coffe Lake platforms block: check bi_size overflow before merge gpio: bd70528: Use correct unit for debounce times gpio: max77620: Fixup debounce delays KVM: MMU: Do not treat ZONE_DEVICE pages as being reserved KVM: VMX: Introduce pi_is_pir_empty() helper KVM: VMX: Do not change PID.NDST when loading a blocked vCPU KVM: VMX: Consider PID.PIR to determine if vCPU has pending interrupts KVM: VMX: Fix comment to specify PID.ON instead of PIR.ON KVM: X86: Fix initialization of MSR lists xfrm: release device reference for invalid state io_uring: make timeout sequence == 0 mean no sequence ntp/y2038: Remove incorrect time_t truncation mdio_bus: Fix PTR_ERR applied after initialization to constant NFC: nxp-nci: Fix NULL pointer dereference after I2C communication error mlxsw: core: Enable devlink reload only on probe FROMGIT: of: property: Add device link support for iommus, mboxes and io-channels FROMGIT: of: property: Make it easy to add device links from DT properties FROMGIT: of: property: Minor style clean up of of_link_to_phandle() Revert "ANDROID: of/property: Add device link support for iommus" devlink: Add method for time-stamp on reporter's dump net: ethernet: dwmac-sun8i: Use the correct function in exit path Btrfs: fix log context list corruption after rename exchange operation drm/i915/cmdparser: Fix jump whitelist clearing iommu/vt-d: Fix QI_DEV_IOTLB_PFSID and QI_DEV_EIOTLB_PFSID macros MAINTAINERS: Update for INTEL IOMMU (VT-d) entry KVM: fix placement of refcount initialization KVM: Fix NULL-ptr deref after kvm_create_vm fails ALSA: hda: hdmi - fix pin setup on Tigerlake ALSA: hda: Add Cometlake-S PCI ID Revert "Revert "sched: Rework pick_next_task() slow-path"" Linux 5.4-rc7 lib: Remove select of inexistant GENERIC_IO ecryptfs_lookup_interpose(): lower_dentry->d_parent is not stable either ecryptfs_lookup_interpose(): lower_dentry->d_inode is not stable ecryptfs: fix unlink and rmdir in face of underlying fs modifications audit_get_nd(): don't unlock parent too early exportfs_decode_fh(): negative pinned may become positive without the parent locked cgroup: don't put ERR_PTR() into fc->root tcp: remove redundant new line from tcp_event_sk_skb devlink: disallow reload operation during device cleanup ALSA: usb-audio: Fix missing error check at mixer resolution test ixgbe: need_wakeup flag might not be set for Tx i40e: need_wakeup flag might not be set for Tx igb/igc: use ktime accessors for skb->tstamp i40e: Fix for ethtool -m issue on X722 NIC iavf: initialize ITRN registers with correct values ice: fix potential infinite loop because loop counter being too small qede: fix NULL pointer deref in __qede_remove() net: fix data-race in neigh_event_send() sched: Fix pick_next_task() vs 'change' pattern race sched/core: Fix compilation error when cgroup not selected cgroup,writeback: don't switch wbs immediately on dead wbs if the memcg is dead vsock/virtio: fix sock refcnt holding during the shutdown iwlwifi: pcie: don't consider IV len in A-MSDU net: ethernet: octeon_mgmt: Account for second possible VLAN header pwm: bcm-iproc: Prevent unloading the driver module while in use block: drbd: remove a stray unlock in __drbd_send_protocol() cpufreq: intel_pstate: Fix invalid EPB setting mac80211: fix station inactive_time shortly after boot net/fq_impl: Switch to kvmalloc() for memory allocation mac80211: fix ieee80211_txq_setup_flows() failure path drm/i915/gvt: fix dropping obj reference twice ANDROID: Kconfig.gki: Add SND_SOC_COMPRESS ipv4: Fix table id reference in fib_sync_down_addr ipv6: fixes rt6_probe() and fib6_nh->last_probe init net: hns: Fix the stray netpoll locks causing deadlock in NAPI path Revert "ANDROID: Kconfig.gki: Add SND_SOC_COMPRESS" net: usb: qmi_wwan: add support for DW5821e with eSIM support CDC-NCM: handle incomplete transfer of MTU nfc: netlink: fix double device reference drop ANDROID: Kconfig.gki: Add SND_SOC_COMPRESS ceph: return -EINVAL if given fsc mount option on kernel w/o support staging: Fix error return code in vboxsf_fill_super() staging: vboxsf: fix dereference of pointer dentry before it is null checked staging: vboxsf: Remove unused including <linux/version.h> x86/speculation/taa: Fix printing of TAA_MSG_SMT on IBRS_ALL CPUs xfrm: Fix memleak on xfrm state destroy pinctrl: stmfx: fix valid_mask init sequence NFC: st21nfca: fix double free net: hns3: add compatible handling for command HCLGE_OPC_PF_RST_DONE r8169: fix page read in r8168g_mdio_read net: stmmac: Fix the TX IOC in xmit path net: stmmac: Fix TSO descriptor with Enhanced Addressing net: stmmac: Fix the packet count in stmmac_rx() net: stmmac: xgmac: Disable MMC interrupts by default net: stmmac: xgmac: Disable Flow Control when 1 or more queues are in AV net: stmmac: xgmac: Fix AV Feature detection net: stmmac: xgmac: Fix TSA selection net: stmmac: xgmac: Only get SPH header len if available net: stmmac: selftests: Prevent false positives in filter tests net: stmmac: xgmac: bitrev32 returns u32 net: stmmac: gmac4: bitrev32 returns u32 SMB3: Fix persistent handles reconnect drm/radeon: fix si_enable_smc_cac() failed issue drm/amdgpu/renoir: move gfxoff handling into gfx9 module drm/amdgpu: add warning for GRBM 1-cycle delay issue in gfx9 drm/amdgpu: add dummy read by engines for some GCVM status registers in gfx10 drm/amdgpu: register gpu instance before fan boost feature enablment drm/amd/swSMU: fix smu workload bit map error net/smc: fix ethernet interface refcounting selftests/tls: add test for concurrent recv and send net/tls: add a TX lock net/tls: don't pay attention to sk_write_pending when pushing partial records blkcg: make blkcg_print_stat() print stats only for online blkgs drm/shmem: Add docbook comments for drm_gem_shmem_object madvise fields net: mscc: ocelot: fix __ocelot_rmw_ix prototype bpf, offload: Unlock on error in bpf_offload_dev_create() net: mscc: ocelot: fix NULL pointer on LAG slave removal net: mscc: ocelot: don't handle netdev events for other netdevs net/mlx5e: Use correct enum to determine uplink port net/mlx5: DR, Fix memory leak during rule creation net/mlx5: DR, Fix memory leak in modify action destroy net/mlx5e: Fix eswitch debug print of max fdb flow HID: wacom: generic: Treat serial number and related fields as unsigned drm/amdgpu: add navi14 PCI ID Revert "drm/amd/display: setting the DIG_MODE to the correct value." drm/amd/display: Add ENGINE_ID_DIGD condition check for Navi14 drm/amdgpu: dont schedule jobs while in reset drm/amdgpu/arcturus: properly set BANK_SELECT and FRAGMENT_SIZE arm64: Do not mask out PTE_RDONLY in pte_same() ANDROID: nf: IDLETIMER: Fix possible use before initialization in idletimer_resume ANDROID: gki_defconfig: enable FW_LOADER configs net: bcmgenet: reapply manual settings to the PHY Revert "net: bcmgenet: soft reset 40nm EPHYs before MAC init" net: bcmgenet: use RGMII loopback for MAC reset drm/atomic: fix self-refresh helpers crtc state dereference RDMA/hns: Correct the value of srq_desc_size RDMA/hns: Correct the value of HNS_ROCE_HEM_CHUNK_LEN configfs: calculate the depth of parent item IB/hfi1: TID RDMA WRITE should not return IB_WC_RNR_RETRY_EXC_ERR IB/hfi1: Calculate flow weight based on QP MTU for TID RDMA IB/hfi1: Ensure r_tid_ack is valid before building TID RDMA ACK packet IB/hfi1: Ensure full Gen3 speed in a Gen4 system ALSA: timer: Fix incorrectly assigned timer instance mm: memcontrol: fix network errors from failing __GFP_ATOMIC charges mm/memory_hotplug: fix updating the node span scripts/gdb: fix debugging modules compiled with hot/cold partitioning mm: slab: make page_cgroup_ino() to recognize non-compound slab pages properly MAINTAINERS: update information for "MEMORY MANAGEMENT" dump_stack: avoid the livelock of the dump_lock zswap: add Vitaly to the maintainers list mm/page_alloc.c: ratelimit allocation failure warnings more aggressively mm/khugepaged: fix might_sleep() warn with CONFIG_HIGHPTE=y mm, vmstat: reduce zone->lock holding time by /proc/pagetypeinfo mm, vmstat: hide /proc/pagetypeinfo from normal users mm/mmu_notifiers: use the right return code for WARN_ON ocfs2: protect extent tree in ocfs2_prepare_inode_for_write() mm: thp: handle page cache THP correctly in PageTransCompoundMap mm, meminit: recalculate pcpu batch and high limits after init completes mm/gup_benchmark: fix MAP_HUGETLB case mm: memcontrol: fix NULL-ptr deref in percpu stats flush MAINTAINERS: update Cavium ThunderX2 maintainers ASoC: SOF: topology: Fix bytes control size checks ARM: dts: stm32: change joystick pinctrl definition on stm32mp157c-ev1 ARM: dts: stm32: remove OV5640 pinctrl definition on stm32mp157c-ev1 ARM: dts: stm32: Fix CAN RAM mapping on stm32mp157c ARM: dts: stm32: relax qspi pins slew-rate for stm32mp157 scsi: core: Handle drivers which set sg_tablesize to zero scsi: qla2xxx: fix NPIV tear down process scsi: sd_zbc: Fix sd_zbc_complete() Documentation: TLS: Add missing counter description NFC: fdp: fix incorrect free object net: prevent load/store tearing on sk->sk_stamp net: qualcomm: rmnet: Fix potential UAF when unregistering net/tls: fix sk_msg trim on fallback to copy mode mlx4_core: fix wrong comment about the reason of subtract one from the max_cqes net: dsa: bcm_sf2: Fix driver removal net: sched: prevent duplicate flower rules from tcf_proto destroy race net: hns3: Use the correct style for SPDX License Identifier bonding: fix state transition issue in link monitoring taprio: fix panic while hw offload sched list swap FROMLIST: overlayfs: override_creds=off option bypass creator_cred FROMLIST: overlayfs: internal getxattr operations without sepolicy checking FROMLIST: overlayfs: handle XATTR_NOSECURITY flag for get xattr method FROMLIST: Add flags option to get xattr method paired to __vfs_getxattr FROMLIST: afs: xattr: use scnprintf nvme: change nvme_passthru_cmd64 to explicitly mark rsvd drm/i915/gen8+: Add RC6 CTX corruption WA drm/i915: Lower RM timeout to avoid DSI hard hangs drm/i915/cmdparser: Ignore Length operands during command matching drm/i915/cmdparser: Add support for backward jumps drm/i915/cmdparser: Use explicit goto for error paths drm/i915: Add gen9 BCS cmdparsing drm/i915: Allow parsing of unsized batches drm/i915: Support ro ppgtt mapped cmdparser shadow buffers drm/i915: Add support for mandatory cmdparsing drm/i915: Remove Master tables from cmdparser drm/i915: Disable Secure Batches for gen6+ drm/i915: Rename gen7 cmdparser tables ALSA: hda: hdmi - add Tigerlake support ASoC: max98373: replace gpio_request with devm_gpio_request ASoC: stm32: sai: add restriction on mmap support watchdog: bd70528: Add MODULE_ALIAS to allow module auto loading watchdog: imx_sc_wdt: Pretimeout should follow SCU firmware format watchdog: meson: Fix the wrong value of left time watchdog: pm8916_wdt: fix pretimeout registration flow watchdog: cpwd: fix build regression nvme-multipath: fix crash in nvme_mpath_clear_ctrl_paths nvme-rdma: fix a segmentation fault during module unload clone3: validate stack arguments ceph: don't allow copy_file_range when stripe_count != 1 ceph: don't try to handle hashed dentries in non-O_CREAT atomic_open ALSA: hda/ca0132 - Fix possible workqueue stall scripts/nsdeps: make sure to pass all module source files to spatch perf tools: Fix time sorting can: don't use deprecated license identifiers can: mcp251x: mcp251x_restart_work_handler(): Fix potential force_quit race condition perf tools: Remove unused trace_find_next_event() perf scripting engines: Iterate on tep event arrays directly FROMGIT: of: property: Skip adding device links to suppliers that aren't devices x86/tsc: Respect tsc command line paraemeter for clocksource_tsc_early Input: synaptics-rmi4 - remove unused result_bits mask Input: synaptics-rmi4 - do not consume more data than we have (F11, F12) Input: synaptics-rmi4 - disable the relative position IRQ in the F12 driver Input: synaptics-rmi4 - fix video buffer size x86/dumpstack/64: Don't evaluate exception stacks before setup irq/irqdomain: Update __irq_domain_alloc_fwnode() function documentation x86/apic/32: Avoid bogus LDR warnings timekeeping/vsyscall: Update VDSO data unconditionally drm/i915/dp: Do not switch aux to TBT mode for non-TC ports drm/i915: Avoid HPD poll detect triggering a new detect cycle can: j1939: transport: j1939_xtp_rx_eoma_one(): Add sanity check for correct total message size can: j1939: transport: j1939_session_fresh_new(): make sure EOMA is send with the total message size set can: j1939: fix memory leak if filters was set can: j1939: fix resource leak of skb on error return paths can: ti_hecc: add missing state changes can: ti_hecc: properly report state changes can: ti_hecc: add fifo overflow error reporting can: ti_hecc: release the mailbox a bit earlier can: ti_hecc: keep MIM and MD set can: ti_hecc: ti_hecc_stop(): stop the CPK on down can: ti_hecc: ti_hecc_error(): increase error counters if skb enqueueing via can_rx_offload_queue_sorted() fails can: flexcan: increase error counters if skb enqueueing via can_rx_offload_queue_sorted() fails can: rx-offload: can_rx_offload_irq_offload_fifo(): continue on error can: rx-offload: can_rx_offload_irq_offload_timestamp(): continue on error can: rx-offload: can_rx_offload_offload_one(): use ERR_PTR() to propagate error value in case of errors can: rx-offload: can_rx_offload_offload_one(): increment rx_fifo_errors on queue overflow or OOM can: rx-offload: can_rx_offload_offload_one(): do not increase the skb_queue beyond skb_queue_len_max can: rx-offload: can_rx_offload_queue_tail(): fix error handling, avoid skb mem leak can: rx-offload: can_rx_offload_queue_sorted(): fix error handling, avoid skb mem leak can: xilinx_can: Fix flags field initialization for axi can can: c_can: C_CAN: add bus recovery events can: c_can: D_CAN: c_can_chip_config(): perform a sofware reset on open can: c_can: c_can_poll(): only read status register after status IRQ can: peak_usb: report bus recovery as well can: peak_usb: fix slab info leak can: peak_usb: fix a potential out-of-sync while decoding packets can: flexcan: disable completely the ECC mechanism can: usb_8dev: fix use-after-free on disconnect can: mcba_usb: fix use-after-free on disconnect can: gs_usb: gs_can_open(): prevent memory leak can: dev: add missing of_node_put() after calling of_get_child_by_name() btrfs: un-deprecate ioctls START_SYNC and WAIT_SYNC btrfs: save i_size to avoid double evaluation of i_size_read in compress_file_range stacktrace: Don't skip first entry on noncurrent tasks netfilter: nf_tables_offload: skip EBUSY on chain update netfilter: nf_tables: bogus EOPNOTSUPP on basechain update bridge: ebtables: don't crash when using dnat target in output chains netfilter: nf_tables: fix unexpected EOPNOTSUPP error netfilter: nf_tables: Align nft_expr private data to 64-bit netfilter: ipset: Fix nla_policies to fully support NL_VALIDATE_STRICT netfilter: ipset: Copy the right MAC address in hash:ip,mac IPv6 sets netfilter: ipset: Fix an error code in ip_set_sockfn_get() dccp: do not leak jiffies on the wire net: fec: add missed clk_disable_unprepare in remove Documentation: Add ITLB_MULTIHIT documentation kvm: x86: mmu: Recovery of shattered NX large pages MAINTAINERS: Remove Kevin as maintainer of BMIPS generic platforms clk: ti: clkctrl: Fix failed to enable error with double udelay timeout clk: ti: dra7-atl-clock: Remove ti_clk_add_alias call netfilter: nf_tables_offload: check for register data length mismatches intel_th: pci: Add Jasper Lake PCH support intel_th: pci: Add Comet Lake PCH support intel_th: msu: Fix possible memory leak in mode_store() intel_th: msu: Fix overflow in shift of an unsigned int intel_th: msu: Fix missing allocation failure check on a kstrndup intel_th: msu: Fix an uninitialized mutex intel_th: gth: Fix the window switching sequence ASoC: hdac_hda: fix race in device removal kvm: Add helper function for creating VM worker threads kvm: mmu: ITLB_MULTIHIT mitigation cpu/speculation: Uninline and export CPU mitigations helpers x86/cpu: Add Tremont to the cpu vulnerability whitelist x86/bugs: Add ITLB_MULTIHIT bug infrastructure fbdev: c2p: Fix link failure on non-inlining ALSA: bebob: fix to detect configured source of sampling clock for Focusrite Saffire Pro i/o series arm64: dts: zii-ultra: fix ARM regulator GPIO handle Revert "gpio: merrifield: Pass irqchip when adding gpiochip" Revert "gpio: merrifield: Restore use of irq_base" Revert "gpio: merrifield: Move hardware initialization to callback" x86/resctrl: Prevent NULL pointer dereference when reading mondata idr: Fix idr_alloc_u32 on 32-bit systems idr: Fix integer overflow in idr_for_each_entry HID: i2c-hid: Send power-on command after reset radix tree: Remove radix_tree_iter_find idr: Fix idr_get_next_ul race with idr_remove powerpc/bpf: Fix tail call implementation MIPS: SGI-IP27: fix exception handler replication bpf: Change size to u64 for bpf_map_{area_alloc, charge_init}() samples/bpf: fix build by setting HAVE_ATTR_TEST to zero perf tools: Make usage of test_attr__* optional for perf-sys.h bpf: Allow narrow loads of bpf_sysctl fields with offset > 0 staging: Add VirtualBox guest shared folder (vboxsf) support ceph: add missing check in d_revalidate snapdir handling ceph: fix RCU case handling in ceph_d_revalidate() ceph: fix use-after-free in __ceph_remove_cap() bpf, doc: Add Andrii as official reviewer to BPF subsystem ARM: sunxi: Fix CPU powerdown on A83T ARM: dts: sun8i-a83t-tbs-a711: Fix WiFi resume from suspend clk: sunxi-ng: a80: fix the zero'ing of bits 16 and 18 clk: sunxi: Fix operator precedence in sunxi_divs_clk_setup clk: ast2600: Fix enabling of clocks clk: at91: avoid sleeping early ASoC: rockchip: rockchip_max98090: Enable SHDN to fix headset detection ASoC: ti: sdma-pcm: Add back the flags parameter for non standard dma names ASoC: SOF: ipc: Fix memory leak in sof_set_get_large_ctrl_data ASoC: SOF: Fix memory leak in sof_dfsentry_write ASoC: SOF: Intel: hda-stream: fix the CONFIG_ prefix missing arm64: dts: imx8mn: fix compatible string for sdma arm64: dts: imx8mm: fix compatible string for sdma reset: fix reset_control_ops kerneldoc comment clk: imx8m: Use SYS_PLL1_800M as intermediate parent of CLK_ARM x86/tsx: Add config options to set tsx=on|off|auto x86/speculation/taa: Add documentation for TSX Async Abort x86/tsx: Add "auto" option to the tsx= cmdline parameter kvm/x86: Export MDS_NO=0 to guests when TSX is enabled x86/speculation/taa: Add sysfs reporting for TSX Async Abort x86/speculation/taa: Add mitigation for TSX Async Abort x86/cpu: Add a "tsx=" cmdline option with TSX disabled by default x86/cpu: Add a helper function x86_read_arch_cap_msr() x86/msr: Add the IA32_TSX_CTRL MSR ARM: dts: imx6-logicpd: Re-enable SNVS power key iio: adc: stm32-adc: fix stopping dma soc: imx: gpc: fix initialiser format ARM: dts: imx6qdl-sabreauto: Fix storm of accelerometer interrupts Btrfs: fix race leading to metadata space leak after task received signal btrfs: tree-checker: Fix wrong check on max devid btrfs: Consider system chunk array size for new SYSTEM chunks pinctrl: cherryview: Allocate IRQ chip dynamic clk: samsung: exynos5420: Preserve PLL configuration during suspend/resume arm64: dts: ls1028a: fix a compatible issue autofs: fix a leak in autofs_expire_indirect() soundwire: slave: fix scanf format reset: fix reset_control_get_exclusive kerneldoc comment reset: fix reset_control_lookup kerneldoc comment reset: fix of_reset_control_get_count kerneldoc comment reset: fix of_reset_simple_xlate kerneldoc comment ASoC: kirkwood: fix device remove ordering ASoC: rsnd: dma: fix SSI9 4/5/6/7 busif dma address ASoC: hdmi-codec: drop mutex locking again ASoC: kirkwood: fix external clock probe defer clk: samsung: exynos542x: Move G3D subsystem clocks to its sub-CMU clk: samsung: exynos5433: Fix error paths tools: gpio: Use !building_out_of_srctree to determine srctree iio: imu: inv_mpu6050: fix no data on MPU6050 reset: Fix memory leak in reset_control_array_put() aio: Fix io_pgetevents() struct __compat_aio_sigset layout pinctrl: cherryview: Fix irq_valid_mask calculation ASoC: compress: fix unsigned integer overflow check ASoC: msm8916-wcd-analog: Fix RX1 selection in RDAC2 MUX pinctrl: intel: Avoid potential glitches if pin is in GPIO mode soundwire: intel: fix intel_register_dai PDI offsets and numbers interconnect: Add locking in icc_set_tag() interconnect: qcom: Fix icc_onecell_data allocation clocksource/drivers/sh_mtu2: Do not loop using platform_get_irq_by_name() fs/namespace.c: fix use-after-free of mount in mnt_warn_timestamp_expiry() clocksource/drivers/mediatek: Fix error handling soundwire: depend on ACPI || OF soundwire: depend on ACPI iio: srf04: fix wrong limitation in distance measuring iio: imu: adis16480: make sure provided frequency is positive cgroup: freezer: call cgroup_enter_frozen() with preemption disabled in ptrace_stop() thunderbolt: Drop unnecessary read when writing LC command in Ice Lake thunderbolt: Fix lockdep circular locking depedency warning thunderbolt: Read DP IN adapter first two dwords in one go clk: at91: sam9x60: fix programmable clock clk: meson: g12a: set CLK_MUX_ROUND_CLOSEST on the cpu clock muxes clk: meson: g12a: fix cpu clock rate setting clk: meson: gxbb: let sar_adc_clk_div set the parent clock rate XArray: Fix xas_next() with a single entry at 0 Change-Id: I594a629aca56b3ff5a224d65f0d8d79fe4f4f34b Signed-off-by: Raghavendra Rao Ananta <rananta@codeaurora.org>	2019-11-27 09:46:55 -08:00
Greg Kroah-Hartman	54e301676a	Linux 5.4 ... -----BEGIN PGP SIGNATURE----- iQFSBAABCAA8FiEEq68RxlopcLEwq+PEeb4+QwBBGIYFAl3bIQceHHRvcnZhbGRz QGxpbnV4LWZvdW5kYXRpb24ub3JnAAoJEHm+PkMAQRiG8mUIAIjMARdI6Fc6Hrwo oVAFQU8BY/OB49NbKYCaXMi1AbMv0+f32jEmdcHj4AQa+Dq8owc1pOB2o+iTLrCq PWf6t1wjHtPVmkZ+lWGDFT74IBMCZ8M0dgN9rYBUbno09/B9cqN4ttjTrGjTgkGe yw4qTzeflZaMSIzvy+nZD8RM9bXsFJUncD/M759ElPj1p7Tdx29c05+e46pYOh7i A6QaSMZT2xKHDIDfU1rQhvyrzAX4cF1LtbSNu7GAG7Ajnn3jfxXqUzZdl5r5j04W ee+AXER4VXDlq+2fN7/jlGa4kxiZZDX/FqRnS6dsrb+2sNCKlnETI+6a9/dO0zsI wzBh36o= =0TWn -----END PGP SIGNATURE----- Merge 5.4 into android-mainline Linux 5.4 Here we go! Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Iee409f3bbf65b93fa419e5b09818efb8e56569fd	2019-11-25 09:57:21 +01:00
Willem de Bruijn	d4ffb02dee	net/tls: enable sk_msg redirect to tls socket egress ... Bring back tls_sw_sendpage_locked. sk_msg redirection into a socket with TLS_TX takes the following path: tcp_bpf_sendmsg_redir tcp_bpf_push_locked tcp_bpf_push kernel_sendpage_locked sock->ops->sendpage_locked Also update the flags test in tls_sw_sendpage_locked to allow flag MSG_NO_SHARED_FRAGS. bpf_tcp_sendmsg sets this. Link: https://lore.kernel.org/netdev/CA+FuTSdaAawmZ2N8nfDDKu3XLpXBbMtcCT0q4FntDD2gn8ASUw@mail.gmail.com/T/#t Link: https://github.com/wdebruij/kerneltools/commits/icept.2 Fixes: 0608c69c9a ("bpf: sk_msg, sock{map|hash} redirect through ULP") Fixes: f3de19af0f ("Revert \"net/tls: remove unused function tls_sw_sendpage_locked\"") Signed-off-by: Willem de Bruijn <willemb@google.com> Acked-by: John Fastabend <john.fastabend@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2019-11-19 15:03:02 -08:00
Greg Kroah-Hartman	ad5859c6ae	Linux 5.4-rc8 ... -----BEGIN PGP SIGNATURE----- iQFSBAABCAA8FiEEq68RxlopcLEwq+PEeb4+QwBBGIYFAl3RzgkeHHRvcnZhbGRz QGxpbnV4LWZvdW5kYXRpb24ub3JnAAoJEHm+PkMAQRiGN18H/0JZbfIpy8/4Irol 0va7Aj2fBi1a5oxfqYsMKN0u3GKbN3OV9tQ+7w1eBNGvL72TGadgVTzTY+Im7A9U UjboAc7jDPCG+YhIwXFufMiIAq5jDIj6h0LDas7ALsMfsnI/RhTwgNtLTAkyI3dH YV/6ljFULwueJHCxzmrYbd1x39PScj3kCNL2pOe6On7rXMKOemY/nbbYYISxY30E GMgKApSS+li7VuSqgrKoq5Qaox26LyR2wrXB1ij4pqEJ9xgbnKRLdHuvXZnE+/5p 46EMirt+yeSkltW3d2/9MoCHaA76ESzWMMDijLx7tPgoTc3RB3/3ZLsm3rYVH+cR cRlNNSk= =0+Cg -----END PGP SIGNATURE----- Merge 5.4-rc8 into android-mainline Linux 5.4-rc8 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I1f55e5d34dc78ddb064910ce1e1b7a7b5b39aaba	2019-11-18 08:31:11 +01:00
Greg Kroah-Hartman	682d8bf784	Linux 5.4-rc7 ... -----BEGIN PGP SIGNATURE----- iQFSBAABCAA8FiEEq68RxlopcLEwq+PEeb4+QwBBGIYFAl3IqJQeHHRvcnZhbGRz QGxpbnV4LWZvdW5kYXRpb24ub3JnAAoJEHm+PkMAQRiGOiUH+gOEDwid5OODaFAd CggXugdFIlBZefKqGVNW5sjgX8pxFWHXuEMC8iNb6QXtQZdFrI6LFf9hhUDmzQtm 6y1LPxxEiTZjObMEsBNylb7tyzgujFHcAlp0Zro3w/HLCqmYTSP3FF46i2u6KZfL XhkpM4X7R7qxlfpdhlfESv/ElRGocZe6SwXfC7pcPo5flFcmkdu9ijqhNd/6CZ/h Nf9rTsD/wEDVUelFbgVN+LJzlaB0tsyc4Zbof07n8OsFZjhdEOop8gfM/kTBLcyY 6bh66SfDScdsNnC/l8csbPjSZRx+i+nQs67DyhGNnsSAFgHBZdC4Tb/2mDCwhCLR dUvuYZc= =1N6F -----END PGP SIGNATURE----- Merge tag 'v5.4-rc7' into android-mainline Linux 5.4-rc7 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I505207a0a6f68ccc3519d7f190d8faf25d9d479a	2019-11-11 06:10:55 +01:00
Jiri Pirko	5a508a254b	devlink: disallow reload operation during device cleanup ... There is a race between driver code that does setup/cleanup of device and devlink reload operation that in some drivers works with the same code. Use after free could we easily obtained by running: while true; do echo "0000:00:10.0" >/sys/bus/pci/drivers/mlxsw_spectrum2/bind devlink dev reload pci/0000:00:10.0 & echo "0000:00:10.0" >/sys/bus/pci/drivers/mlxsw_spectrum2/unbind done Fix this by enabling reload only after setup of device is complete and disabling it at the beginning of the cleanup process. Reported-by: Ido Schimmel <idosch@mellanox.com> Fixes: 2d8dc5bbf4 ("devlink: Add support for reload") Signed-off-by: Jiri Pirko <jiri@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2019-11-09 19:38:36 -08:00
Eric Dumazet	1b53d64435	net: fix data-race in neigh_event_send() ... KCSAN reported the following data-race [1] The fix will also prevent the compiler from optimizing out the condition. [1] BUG: KCSAN: data-race in neigh_resolve_output / neigh_resolve_output write to 0xffff8880a41dba78 of 8 bytes by interrupt on cpu 1: neigh_event_send include/net/neighbour.h:443 [inline] neigh_resolve_output+0x78/0x480 net/core/neighbour.c:1474 neigh_output include/net/neighbour.h:511 [inline] ip_finish_output2+0x4af/0xe40 net/ipv4/ip_output.c:228 __ip_finish_output net/ipv4/ip_output.c:308 [inline] __ip_finish_output+0x23a/0x490 net/ipv4/ip_output.c:290 ip_finish_output+0x41/0x160 net/ipv4/ip_output.c:318 NF_HOOK_COND include/linux/netfilter.h:294 [inline] ip_output+0xdf/0x210 net/ipv4/ip_output.c:432 dst_output include/net/dst.h:436 [inline] ip_local_out+0x74/0x90 net/ipv4/ip_output.c:125 __ip_queue_xmit+0x3a8/0xa40 net/ipv4/ip_output.c:532 ip_queue_xmit+0x45/0x60 include/net/ip.h:237 __tcp_transmit_skb+0xe81/0x1d60 net/ipv4/tcp_output.c:1169 tcp_transmit_skb net/ipv4/tcp_output.c:1185 [inline] __tcp_retransmit_skb+0x4bd/0x15f0 net/ipv4/tcp_output.c:2976 tcp_retransmit_skb+0x36/0x1a0 net/ipv4/tcp_output.c:2999 tcp_retransmit_timer+0x719/0x16d0 net/ipv4/tcp_timer.c:515 tcp_write_timer_handler+0x42d/0x510 net/ipv4/tcp_timer.c:598 tcp_write_timer+0xd1/0xf0 net/ipv4/tcp_timer.c:618 read to 0xffff8880a41dba78 of 8 bytes by interrupt on cpu 0: neigh_event_send include/net/neighbour.h:442 [inline] neigh_resolve_output+0x57/0x480 net/core/neighbour.c:1474 neigh_output include/net/neighbour.h:511 [inline] ip_finish_output2+0x4af/0xe40 net/ipv4/ip_output.c:228 __ip_finish_output net/ipv4/ip_output.c:308 [inline] __ip_finish_output+0x23a/0x490 net/ipv4/ip_output.c:290 ip_finish_output+0x41/0x160 net/ipv4/ip_output.c:318 NF_HOOK_COND include/linux/netfilter.h:294 [inline] ip_output+0xdf/0x210 net/ipv4/ip_output.c:432 dst_output include/net/dst.h:436 [inline] ip_local_out+0x74/0x90 net/ipv4/ip_output.c:125 __ip_queue_xmit+0x3a8/0xa40 net/ipv4/ip_output.c:532 ip_queue_xmit+0x45/0x60 include/net/ip.h:237 __tcp_transmit_skb+0xe81/0x1d60 net/ipv4/tcp_output.c:1169 tcp_transmit_skb net/ipv4/tcp_output.c:1185 [inline] __tcp_retransmit_skb+0x4bd/0x15f0 net/ipv4/tcp_output.c:2976 tcp_retransmit_skb+0x36/0x1a0 net/ipv4/tcp_output.c:2999 tcp_retransmit_timer+0x719/0x16d0 net/ipv4/tcp_timer.c:515 tcp_write_timer_handler+0x42d/0x510 net/ipv4/tcp_timer.c:598 Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.4.0-rc3+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2019-11-08 13:59:53 -08:00
Toke Høiland-Jørgensen	71e67c3bd1	net/fq_impl: Switch to kvmalloc() for memory allocation ... The FQ implementation used by mac80211 allocates memory using kmalloc(), which can fail; and Johannes reported that this actually happens in practice. To avoid this, switch the allocation to kvmalloc() instead; this also brings fq_impl in line with all the FQ qdiscs. Fixes: 557fc4a098 ("fq: add fair queuing framework") Reported-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com> Link: https://lore.kernel.org/r/20191105155750.547379-1-toke@redhat.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>	2019-11-08 09:11:49 +01:00
David S. Miller	53ba60afb1	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf ... Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Missing register size validation in bitwise and cmp offloads. 2) Fix error code in ip_set_sockfn_get() when copy_to_user() fails, from Dan Carpenter. 3) Oneliner to copy MAC address in IPv6 hash:ip,mac sets, from Stefano Brivio. 4) Missing policy validation in ipset with NL_VALIDATE_STRICT, from Jozsef Kadlecsik. 5) Fix unaligned access to private data area of nf_tables instructions, from Lukas Wunner. 6) Relax check for object updates, reported as a regression by Eric Garver, patch from Fernando Fernandez Mancera. 7) Crash on ebtables dnat extension when used from the output path. From Florian Westphal. 8) Fix bogus EOPNOTSUPP when updating basechain flags. 9) Fix bogus EBUSY when updating a basechain that is already offloaded. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>	2019-11-06 21:16:55 -08:00
Jakub Kicinski	79ffe6087e	net/tls: add a TX lock ... TLS TX needs to release and re-acquire the socket lock if send buffer fills up. TLS SW TX path currently depends on only allowing one thread to enter the function by the abuse of sk_write_pending. If another writer is already waiting for memory no new ones are allowed in. This has two problems: - writers don't wake other threads up when they leave the kernel; meaning that this scheme works for single extra thread (second application thread or delayed work) because memory becoming available will send a wake up request, but as Mallesham and Pooja report with larger number of threads it leads to threads being put to sleep indefinitely; - the delayed work does not get _scheduled_ but it may _run_ when other writers are present leading to crashes as writers don't expect state to change under their feet (same records get pushed and freed multiple times); it's hard to reliably bail from the work, however, because the mere presence of a writer does not guarantee that the writer will push pending records before exiting. Ensuring wakeups always happen will make the code basically open code a mutex. Just use a mutex. The TLS HW TX path does not have any locking (not even the sk_write_pending hack), yet it uses a per-socket sg_tx_data array to push records. Fixes: a42055e8d2 ("net/tls: Add support for async encryption of records for performance") Reported-by: Mallesham Jatharakonda <mallesh537@gmail.com> Reported-by: Pooja Trivedi <poojatrivedi@gmail.com> Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com> Reviewed-by: Simon Horman <simon.horman@netronome.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2019-11-06 17:33:32 -08:00
Eric Dumazet	f75359f3ac	net: prevent load/store tearing on sk->sk_stamp ... Add a couple of READ_ONCE() and WRITE_ONCE() to prevent load-tearing and store-tearing in sock_read_timestamp() and sock_write_timestamp() This might prevent another KCSAN report. Fixes: 3a0ed3e961 ("sock: Make sock->sk_stamp thread-safe") Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Deepa Dinamani <deepa.kernel@gmail.com> Acked-by: Deepa Dinamani <deepa.kernel@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2019-11-05 18:22:30 -08:00
John Hurley	59eb87cb52	net: sched: prevent duplicate flower rules from tcf_proto destroy race ... When a new filter is added to cls_api, the function tcf_chain_tp_insert_unique() looks up the protocol/priority/chain to determine if the tcf_proto is duplicated in the chain's hashtable. It then creates a new entry or continues with an existing one. In cls_flower, this allows the function fl_ht_insert_unque to determine if a filter is a duplicate and reject appropriately, meaning that the duplicate will not be passed to drivers via the offload hooks. However, when a tcf_proto is destroyed it is removed from its chain before a hardware remove hook is hit. This can lead to a race whereby the driver has not received the remove message but duplicate flows can be accepted. This, in turn, can lead to the offload driver receiving incorrect duplicate flows and out of order add/delete messages. Prevent duplicates by utilising an approach suggested by Vlad Buslov. A hash table per block stores each unique chain/protocol/prio being destroyed. This entry is only removed when the full destroy (and hardware offload) has completed. If a new flow is being added with the same identiers as a tc_proto being detroyed, then the add request is replayed until the destroy is complete. Fixes: 8b64678e0a ("net: sched: refactor tp insert/delete for concurrent execution") Signed-off-by: John Hurley <john.hurley@netronome.com> Signed-off-by: Vlad Buslov <vladbu@mellanox.com> Reviewed-by: Simon Horman <simon.horman@netronome.com> Reported-by: Louis Peens <louis.peens@netronome.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2019-11-05 17:47:26 -08:00
Jay Vosburgh	1899bb3251	bonding: fix state transition issue in link monitoring ... Since de77ecd4ef ("bonding: improve link-status update in mii-monitoring"), the bonding driver has utilized two separate variables to indicate the next link state a particular slave should transition to. Each is used to communicate to a different portion of the link state change commit logic; one to the bond_miimon_commit function itself, and another to the state transition logic. Unfortunately, the two variables can become unsynchronized, resulting in incorrect link state transitions within bonding. This can cause slaves to become stuck in an incorrect link state until a subsequent carrier state transition. The issue occurs when a special case in bond_slave_netdev_event sets slave->link directly to BOND_LINK_FAIL. On the next pass through bond_miimon_inspect after the slave goes carrier up, the BOND_LINK_FAIL case will set the proposed next state (link_new_state) to BOND_LINK_UP, but the new_link to BOND_LINK_DOWN. The setting of the final link state from new_link comes after that from link_new_state, and so the slave will end up incorrectly in _DOWN state. Resolve this by combining the two variables into one. Reported-by: Aleksei Zakharov <zakharov.a.g@yandex.ru> Reported-by: Sha Zhang <zhangsha.zhang@huawei.com> Cc: Mahesh Bandewar <maheshb@google.com> Fixes: de77ecd4ef ("bonding: improve link-status update in mii-monitoring") Signed-off-by: Jay Vosburgh <jay.vosburgh@canonical.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2019-11-05 17:40:16 -08:00
Raghavendra Rao Ananta	c249464a77	Merge remote-tracking branch 'remotes/origin/tmp-aefd2d632eb0' into msm-lahaina ... * remotes/origin/tmp-aefd2d632eb0: ANDROID: binder: fix sleeping from invalid function caused by RT inheritance FROMGIT: scsi: ufs: override auto suspend tunables for ufs FROMGIT: scsi: core: allow auto suspend override by low-level driver Linux 5.4-rc6 net: fix installing orphaned programs net: cls_bpf: fix NULL deref on offload filter removal selftests: bpf: Skip write only files in debugfs selftests: net: reuseport_dualstack: fix uninitalized parameter r8169: fix wrong PHY ID issue with RTL8168dp net: dsa: bcm_sf2: Fix IMP setup for port different than 8 net: phylink: Fix phylink_dbg() macro gve: Fixes DMA synchronization. inet: stop leaking jiffies on the wire ixgbe: Remove duplicate clear_bit() call Documentation: networking: device drivers: Remove stray asterisks e1000: fix memory leaks i40e: Fix receive buffer starvation for AF_XDP igb: Fix constant media auto sense switching when no cable is connected net: ethernet: arc: add the missed clk_disable_unprepare ANDROID: gki_defconfig: enable CONFIG_KEYBOARD_GPIO NFS: Fix an RCU lock leak in nfs4_refresh_delegation_stateid() NFSv4: Don't allow a cached open with a revoked delegation arm64: apply ARM64_ERRATUM_843419 workaround for Brahma-B53 core arm64: Brahma-B53 is SSB and spectre v2 safe arm64: apply ARM64_ERRATUM_845719 workaround for Brahma-B53 core igb: Enable media autosense for the i350. igb/igc: Don't warn on fatal read failures when the device is removed tcp: increase tcp_max_syn_backlog max value net: increase SOMAXCONN to 4096 netdevsim: Fix use-after-free during device dismantle rxrpc: Fix handling of last subpacket of jumbo packet usb: dwc3: gadget: fix race when disabling ep with cancelled xfers ANDROID: Remove KVM_INTEL allmodconfig workaround ANDROID: Fix x86_64 allmodconfig build iocost: don't nest spin_lock_irq in ioc_weight_write() s390/idle: fix cpu idle time calculation s390/unwind: fix mixing regs and sp s390/cmm: fix information leak in cmm_timeout_handler() arm64: cpufeature: Enable Qualcomm Falkor errata 1009 for Kryo KVM: vmx, svm: always run with EFER.NXE=1 when shadow paging is active kvm: call kvm_arch_destroy_vm if vm creation fails efi/efi_test: Lock down /dev/efi_test and require CAP_SYS_ADMIN x86, efi: Never relocate kernel below lowest acceptable address efi: libstub/arm: Account for firmware reserved memory at the base of RAM efi/random: Treat EFI_RNG_PROTOCOL output as bootloader randomness efi/tpm: Return -EINVAL when determining tpm final events log size fails efi: Make CONFIG_EFI_RCI2_TABLE selectable on x86 only hv_netvsc: Fix error handling in netvsc_attach() hv_netvsc: Fix error handling in netvsc_set_features() cxgb4: fix panic when attaching to ULD fail net: annotate lockless accesses to sk->sk_napi_id FROMLIST: scsi: ufs-qcom: enter and exit hibern8 during clock scaling FROMLIST: scsi: ufs: export hibern8 entry and exit ANDROID: scsi: ufs: UFS crypto variant operations API ANDROID: gki_defconfig: enable inline encryption FROMLIST: ext4: add inline encryption support FROMLIST: f2fs: add inline encryption support FROMLIST: fscrypt: add inline encryption support FROMLIST: scsi: ufs: Add inline encryption support to UFS FROMLIST: scsi: ufs: UFS crypto API FROMLIST: scsi: ufs: UFS driver v2.1 spec crypto additions FROMLIST: block: blk-crypto for Inline Encryption ANDROID: block: Fix bio_crypt_should_process WARN_ON ALSA: timer: Fix mutex deadlock at releasing card FROMLIST: block: Add encryption context to struct bio io_uring: ensure we clear io_kiocb->result before each issue parisc: fix frame pointer in ftrace_regs_caller() net: annotate accesses to sk->sk_incoming_cpu FROMLIST: block: Keyslot Manager for Inline Encryption FROMLIST: f2fs: add support for IV_INO_LBLK_64 encryption policies FROMLIST: ext4: add support for IV_INO_LBLK_64 encryption policies FROMLIST: fscrypt: add support for IV_INO_LBLK_64 policies FROMLIST: docs: ioctl-number: document fscrypt ioctl numbers FROMLIST: fscrypt: zeroize fscrypt_info before freeing FROMLIST: fscrypt: remove struct fscrypt_ctx FROMLIST: fscrypt: invoke crypto API for ESSIV handling mlxsw: core: Unpublish devlink parameters during reload qed: Optimize execution time for nvm attributes configuration. vxlan: fix unexpected failure of vxlan_changelink() qed: fix spelling mistake "queuess" -> "queues" SUNRPC: Destroy the back channel when we destroy the host transport SUNRPC: The RDMA back channel mustn't disappear while requests are outstanding SUNRPC: The TCP back channel mustn't disappear while requests are outstanding drm/amdgpu: enable -msse2 for GCC 7.1+ users drm/amdgpu: fix stack alignment ABI mismatch for GCC 7.1+ drm/amdgpu: fix stack alignment ABI mismatch for Clang drm/radeon: Fix EEH during kexec drm/amdgpu/gmc10: properly set BANK_SELECT and FRAGMENT_SIZE drm/amdgpu/powerplay/vega10: allow undervolting in p7 dc.c:use kzalloc without test drm/amd/display: setting the DIG_MODE to the correct value. drm/amd/display: Passive DP->HDMI dongle detection fix drm/amd/display: add 50us buffer as WA for pstate switch in active drm/amd/display: Allow inverted gamma drm/amd/display: do not synchronize "drr" displays drm/amdgpu: If amdgpu_ib_schedule fails return back the error. drm/sched: Set error to s_fence if HW job submission failed. drm/amdgpu/gfx10: update gfx golden settings for navi12 drm/amdgpu/gfx10: update gfx golden settings for navi14 drm/amdgpu/gfx10: update gfx golden settings drm/amd/display: Change Navi14's DWB flag to 1 drm/amdgpu/sdma5: do not execute 0-sized IBs (v2) drm/amdgpu: Fix SDMA hang when performing VKexample test iwlwifi: fw api: support new API for scan config cmd mt76: dma: fix buffer unmap with non-linear skbs mt76: mt76x2e: disable pcie_aspm by default ALSA: hda - Fix mutex deadlock in HDMI codec driver usb: cdns3: gadget: Fix g_audio use case when connected to Super-Speed host usb: cdns3: gadget: reset EP_CLAIMED flag while unloading gfs2: Fix initialisation of args for remount iommu/vt-d: Fix panic after kexec -p for kdump iommu/amd: Apply the same IVRS IOAPIC workaround to Acer Aspire A315-41 iommu/ipmmu-vmsa: Remove dev_err() on platform_get_irq() failure nl80211: fix validation of mesh path nexthop nl80211: Disallow setting of HT for channel 14 USB: serial: whiteheat: fix line-speed endianness USB: serial: whiteheat: fix potential slab corruption MAINTAINERS: Change to my personal email address drm/i915: Fix PCH reference clock for FDI on HSW/BDW net: rtnetlink: fix a typo fbd -> fdb net/smc: fix refcounting for non-blocking connect() bonding: fix using uninitialized mode_lock net: fec_ptp: Use platform_get_irq_xxx_optional() to avoid error message net: fec_main: Use platform_get_irq_byname_optional() to avoid error message MAINTAINERS: remove Dave Watson as TLS maintainer vxlan: check tun_info options_len properly erspan: fix the tun_info options_len check for erspan net: hisilicon: Fix ping latency when deal with high throughput net/mlx4_core: Dynamically set guaranteed amount of counters per VF net/mlx5e: Initialize on stack link modes bitmap net/mlx5e: Fix ethtool self test: link speed net/mlx5e: Fix handling of compressed CQEs in case of low NAPI budget net/mlx5e: Don't store direct pointer to action's tunnel info net/mlx5: Fix NULL pointer dereference in extended destination net/mlx5: Fix rtable reference leak net/mlx5e: Only skip encap flows update when encap init failed net/mlx5e: Replace kfree with kvfree when free vhca stats net/mlx5e: Remove incorrect match criteria assignment line net/mlx5e: Determine source port properly for vlan push action net/mlx5: Fix flow counter list auto bits struct net: mscc: ocelot: refuse to overwrite the port's native vlan net: mscc: ocelot: fix vlan_filtering when enslaving to bridge before link is up wimax: i2400: Fix memory leak in i2400m_op_rfkill_sw_toggle drm/i915/tgl: Fix doc not corresponding to code ANDROID: staging: ion: Fix dynamic heap ID assignment ANDROID: Fix typo for FROMLIST: section drm/panfrost: Don't dereference bogus MMU pointers ANDROID: media: increase video max frame number drm/panfrost: fix -Wmissing-prototypes warnings net: hisilicon: Fix "Trying to free already-free IRQ" fjes: Handle workqueue allocation failure Revert "sched: Rework pick_next_task() slow-path" arm64: cpufeature: Enable Qualcomm Falkor/Kryo errata 1003 drm/etnaviv: fix dumping of iommuv2 drm/etnaviv: reinstate MMUv1 command buffer window check drm/etnaviv: fix deadlock in GPU coredump arm64: Ensure VM_WRITE|VM_SHARED ptes are clean by default um-ubd: Entrust re-queue to the upper layers nvme-multipath: remove unused groups_only mode in ana log nvme-multipath: fix possible io hang after ctrl reconnect powerpc/powernv: Fix CPU idle to be called with IRQs disabled sched/topology: Allow sched_asym_cpucapacity to be disabled sched/topology: Don't try to build empty sched domains USB: gadget: Reject endpoints with 0 maxpacket value powerpc/prom_init: Undo relocation before entering secure mode ANDROID: dummy_cpufreq: Implement get() ANDROID: gki_defconfig: enable CONFIG_CPUSETS ANDROID: virtio: virtio_input: Set the amount of multitouch slots in virtio input scsi: qla2xxx: stop timer in shutdown path hwmon: (ina3221) Fix read timeout issue net: usb: lan78xx: Disable interrupts before calling generic_handle_irq() Revert "ANDROID: Revert "kheaders: make headers archive reproducible"" net: dsa: sja1105: improve NET_DSA_SJA1105_TAS dependency net: ethernet: ftgmac100: Fix DMA coherency issue with SW checksum net: fix sk_page_frag() recursion from memory reclaim udp: fix data-race in udp_set_dev_scratch() net: dpaa2: Use the correct style for SPDX License Identifier net: add READ_ONCE() annotation in __skb_wait_for_more_packets() net: use skb_queue_empty_lockless() in busy poll contexts net: use skb_queue_empty_lockless() in poll() handlers udp: use skb_queue_empty_lockless() net: add skb_queue_empty_lockless() ANDROID: gki_defconfig: enable CONFIG_CPU_FREQ_GOV_CONSERVATIVE RDMA/hns: Prevent memory leaks of eq->buf_list RISC-V: Add PCIe I/O BAR memory mapping RDMA/iw_cxgb4: Avoid freeing skb twice in arp failure case RDMA/mlx5: Use irq xarray locking for mkey_table ANDROID: fix VIDEOBUF2_CORE dependency in 'allmodconfig' builds UAS: Revert commit 3ae62a4209 ("UAS: fix alignment of scatter/gather segments") usb-storage: Revert commit 747668dbc0 ("usb-storage: Set virt_boundary_mask to avoid SG overflows") usbip: Fix free of unallocated memory in vhci tx usbip: tools: Fix read_usb_vudc_device() error path handling usb: xhci: fix __le32/__le64 accessors in debugfs code usb: xhci: fix Immediate Data Transfer endianness xhci: Fix use-after-free regression in xhci clear hub TT implementation USB: ldusb: fix control-message timeout USB: ldusb: use unsigned size format specifiers USB: ldusb: fix ring-buffer locking USB: Skip endpoints with 0 maxpacket length io_uring: don't touch ctx in setup after ring fd install ANDROID: modpost: fix up merge issues due to namespace removal Revert "ALSA: hda: Flush interrupts on disabling" perf/headers: Fix spelling s/EACCESS/EACCES/, s/privilidge/privilege/ perf/x86/uncore: Fix event group support perf/x86/amd/ibs: Handle erratum #420 only on the affected CPU family (10h) perf/x86/amd/ibs: Fix reading of the IBS OpData register and thus precise RIP validity perf/core: Start rejecting the syscall with attr.__reserved_2 set vringh: fix copy direction of vringh_iov_push_kern() vsock/virtio: remove unused 'work' field from 'struct virtio_vsock_pkt' virtio_ring: fix stalls for packed rings riscv: for C functions called only from assembly, mark with __visible riscv: fp: add missing __user pointer annotations riscv: add missing header file includes riscv: mark some code and data as file-static riscv: init: merge split string literals in preprocessor directive riscv: add prototypes for assembly language functions from head.S io_uring: Fix leaked shadow_req fix memory leak in large read decrypt offload Linux 5.4-rc5 usb: cdns3: gadget: Don't manage pullups usb: dwc3: remove the call trace of USBx_GFLADJ usb: gadget: configfs: fix concurrent issue between composite APIs usb: dwc3: pci: prevent memory leak in dwc3_pci_probe usb: gadget: composite: Fix possible double free memory bug usb: gadget: udc: atmel: Fix interrupt storm in FIFO mode. usb: renesas_usbhs: fix type of buf usb: renesas_usbhs: Fix warnings in usbhsg_recip_handler_std_set_device() usb: gadget: udc: renesas_usb3: Fix __le16 warnings usb: renesas_usbhs: fix __le16 warnings usb: cdns3: include host-export,h for cdns3_host_init usb: mtu3: fix missing include of mtu3_dr.h usb: fsl: Check memory resource before releasing it usb: dwc3: select CONFIG_REGMAP_MMIO ANDROID: add README.md selftests: fib_tests: add more tests for metric update ipv4: fix route update on metric change. net: Zeroing the structure ethtool_wolinfo in ethtool_get_wol() ALSA: bebob: Fix prototype of helper function to return negative value cxgb4: request the TX CIDX updates to status page netns: fix GFP flags in rtnl_net_notifyid() net: ethernet: Use the correct style for SPDX License Identifier net/smc: keep vlan_id for SMC-R in smc_listen_work() net/smc: fix closing of fallback SMC sockets ANDROID: virt_wifi: Add data ops for scan data simulation ANDROID: Allow DRM_IOCTL_MODE_*_DUMB for render clients. riscv: cleanup do_trap_break net: hwbm: if CONFIG_NET_HWBM unset, make stub functions static ANDROID: cpufreq: create dummy cpufreq driver net: mvneta: make stub functions static inline net: sch_generic: Use pfifo_fast as fallback scheduler for CAN hardware nbd: verify socket is supported during setup ata: libahci_platform: Fix regulator_get_optional() misuse nbd: handle racing with error'ed out commands nbd: protect cmd->status with cmd->lock Revert "ANDROID: x86: Remove a useless warning message" ANDROID: init: GKI: enable hidden configs for media ANDROID: gki_defconfig: add FORTIFY_SOURCE, remove SPMI_MSM_PMIC_ARB Revert "Revert "Revert "Revert "x86/mm: Identify the end of the kernel area to be reserved"""" build.config.*: Link android-mainline kernels with LLD ANDROID: ALSA: jack: Update supported jack switch types ANDROID: ASoC: compress: fix unsigned integer overflow check io_uring: fix bad inflight accounting for SETUP_IOPOLL|SETUP_SQTHREAD io_uring: used cached copies of sq->dropped and cq->overflow FROMLIST: iommu: Export core IOMMU functions to kernel modules FROMLIST: PCI: Export PCI ACS and DMA searching functions to modules FROMLIST: of: Export of_phandle_iterator_args() to modules ARM: dts: stm32: relax qspi pins slew-rate for stm32mp157 io_uring: Fix race for sqes with userspace io_uring: Fix broken links with offloading io_uring: Fix corrupted user_data xen: issue deprecation warning for 32-bit pv guest kvm: Allocate memslots and buses before calling kvm_arch_init_vm powerpc/powernv/eeh: Fix oops when probing cxl devices irqchip/sifive-plic: Skip contexts except supervisor in plic_init() ANDROID: soc: qcom: Add required header to irq.h ACPI: processor: Add QoS requests for all CPUs cifs: Fix cifsInodeInfo lock_sem deadlock when reconnect occurs CIFS: Fix use after free of file info structures CIFS: Fix retry mid list corruption on reconnects scsi: sd: define variable dif as unsigned int instead of bool ANDROID: v4l2-compat-ioctl32.c: copy reserved fields scsi: target: cxgbit: Fix cxgbit_fw4_ack() IB/core: Avoid deadlock during netlink message handling ANDROID: of: property: Enable of_devlink by default virt_wifi: fix refcnt leak in module exit routine net: remove unnecessary variables and callback vxlan: add adjacent link to limit depth level net: core: add ignore flag to netdev_adjacent structure macsec: fix refcnt leak in module exit routine team: fix nested locking lockdep warning bonding: use dynamic lockdep key instead of subclass bonding: fix unexpected IFF_BONDING bit unset net: core: add generic lockdep keys net: core: limit nested device depth keys: Fix memory leak in copy_net_ns ANDROID: of: property: Make sure child dependencies don't block probing of parent ANDROID: driver core: Allow fwnode_operations.add_links to differentiate errors ANDROID: driver core: Allow a device to wait on optional suppliers ANDROID: driver core: Add device link support for SYNC_STATE_ONLY flag FROMGIT: docs: driver-model: Add documentation for sync_state FROMGIT: driver: core: Improve documentation for fwnode_operations.add_links() FROMGIT: of: property: Minor code formatting/style clean ups i2c: stm32f7: remove warning when compiling with W=1 i2c: stm32f7: fix a race in slave mode with arbitration loss irq i2c: stm32f7: fix first byte to send in slave mode i2c: mt65xx: fix NULL ptr dereference RDMA/nldev: Skip counter if port doesn't match irqchip/gic-v3-its: Use the exact ITSList for VMOVP FROMLIST: drivers: pinctrl: msm: setup GPIO chip in hierarchy FROMLIST: drivers: irqchip: pdc: Add irqchip set/get state calls FROMLIST: genirq: Introduce irq_chip_get/set_parent_state calls FROMLIST: drivers: irqchip: pdc: additionally set type in SPI config registers FROMLIST: dt-bindings/interrupt-controller: pdc: add SPI config register FROMLIST: of: irq: document properties for wakeup interrupt parent FROMLIST: drivers: irqchip: add PDC irqdomain for wakeup capable GPIOs FROMLIST: drivers: irqchip: pdc: Do not toggle IRQ_ENABLE during mask/unmask FROMLIST: drivers: irqchip: qcom-pdc: update max PDC interrupts FROMLIST: irqdomain: add bus token DOMAIN_BUS_WAKEUP gfs2: Fix memory leak when gfs2meta's fs_context is freed ALSA: hda/realtek - Fix 2 front mics of codec 0x623 ALSA: hda/realtek - Add support for ALC623 ALSA: usb-audio: Add DSD support for Gustard U16/X26 USB Interface netfilter: nft_payload: fix missing check for matching length in offloads ipvs: move old_secure_tcp into struct netns_ipvs ipvs: don't ignore errors in case refcounting ip_vs module fails ANDROID: drop patches/ symbolic link mfd: mt6397: Fix probe after changing mt6397-core net: phy: smsc: LAN8740: add PHY_RST_AFTER_CLK_EN flag MIPS: tlbex: Fix build_restore_pagemask KScratch restore io_uring: correct timeout req sequence when inserting a new entry io_uring : correct timeout req sequence when waiting timeout io_uring: revert "io_uring: optimize submit_and_wait API" MIPS: bmips: mark exception vectors as char arrays xsk: Fix registration of Rx-only sockets net/flow_dissector: switch to siphash MAINTAINERS: Update the Spreadtrum SoC maintainer ANDROID: Revert "ANDROID: Removed check for asm-goto" riscv: cleanup <asm/bug.h> riscv: Fix undefined reference to vmemmap_populate_basepages riscv: Fix implicit declaration of 'page_to_section' riscv: fix fs/proc/kcore.c compilation with sparsemem enabled ANDROID: sdcardfs: evict dentries on fscrypt key removal ANDROID: fscrypt: add key removal notifier chain ANDROID: move up spin_unlock_bh() ahead of remove_proc_entry() ANDROID: Kconfig.gki: Add hidden MMC config support ANDROID: Kconfig.gki: Add Hidden QCOM configs ANDROID: Kconfig.gki: Add SND_PCM_ELD to HIDDEN_DRM configs ANDROID: Kconfig.gki: Add extra audio selections ANDROID: Kconfig.gki: Add extra GKI_HIDDEN_REGMAP_CONFIGS selections ANDROID: Four part re-add of asm-goto usage [4/4] ANDROID: Four part re-add of asm-goto usage [3/4] ANDROID: Four part re-add of asm-goto usage [2/4] ANDROID: Four part re-add of asm-goto usage [1/4] ANDROID: Move out patches/ and replace by link to kernel/common-patches project of: reserved_mem: add missing of_node_put() for proper ref-counting of: unittest: fix memory leak in unittest_data_add dt-bindings: riscv: Fix CPU schema errors MAINTAINERS: Remove Gregory and Brian for ARCH_BRCMSTB drm/v3d: Fix memory leak in v3d_submit_cl_ioctl panfrost: Properly undo pm_runtime_enable when deferring a probe dmaengine: cppi41: Fix cppi41_dma_prep_slave_sg() when idle posix-cpu-timers: Fix two trivial comments timers/sched_clock: Include local timekeeping.h for missing declarations lib/vdso: Make clock_getres() POSIX compliant again fuse: redundant get_fuse_inode() calls in fuse_writepages_fill() fuse: Add changelog entries for protocols 7.1 - 7.8 fuse: truncate pending writes on O_TRUNC fuse: flush dirty data/metadata before non-truncate setattr netfilter: nf_tables_offload: restore basechain deletion netfilter: nf_flow_table: set timeout before insertion into hashes rtlwifi: rtl_pci: Fix problem of too small skb->len iwlwifi: pcie: 0x2720 is qu and 0x30DC is not iwlwifi: pcie: add workaround for power gating in integrated 22000 iwlwifi: mvm: handle iwl_mvm_tvqm_enable_txq() error return iwlwifi: pcie: fix all 9460 entries for qnj iwlwifi: pcie: fix PCI ID 0x2720 configs that should be soc rtlwifi: Fix potential overflow on P2P code iwlwifi: pcie: fix merge damage on making QnJ exclusive scripts/nsdeps: use alternative sed delimiter virtiofs: Remove set but not used variable 'fc' fs/dax: Fix pmd vs pte conflict detection opp: Reinitialize the list_kref before adding the static OPPs again bpf: Fix use after free in bpf_get_prog_name ALSA: hda: Add Tigerlake/Jasperlake PCI ID scsi: qla2xxx: Fix partial flash write of MBI scsi: qla2xxx: Initialized mailbox to prevent driver load failure scsi: lpfc: Honor module parameter lpfc_use_adisc ipv6: include <net/addrconf.h> for missing declarations net: openvswitch: free vport unless register_netdevice() succeeds selftests: Make l2tp.sh executable net: sched: taprio: fix -Wmissing-prototypes warnings bnxt_en: Avoid disabling pci device in bnxt_remove_one() for already disabled device. bnxt_en: Minor formatting changes in FW devlink_health_reporter bnxt_en: Adjust the time to wait before polling firmware readiness. bnxt_en: Fix devlink NVRAM related byte order related issues. bnxt_en: Fix the size of devlink MSIX parameters. net: stmmac: Fix the problem of tso_xmit dynamic_debug: provide dynamic_hex_dump stub bpf: Fix use after free in subprog's jited symbol removal RDMA/uverbs: Prevent potential underflow KVM: nVMX: Don't leak L1 MMIO regions to L2 ARC: perf: Accommodate big-endian CPU ARC: [plat-hsdk]: Enable on-boardi SPI ADC IC ARC: [plat-hsdk]: Enable on-board SPI NOR flash IC KVM: SVM: Fix potential wrong physical id in avic_handle_ldr_update cpufreq: Cancel policy update work scheduled before freeing s390/kaslr: add support for R_390_GLOB_DAT relocation type s390/zcrypt: fix memleak at release ALSA: usb-audio: Fix copy&paste error in the validator perf/aux: Fix AUX output stopping kvm: clear kvmclock MSR on reset KVM: x86: fix bugon.cocci warnings KVM: VMX: Remove specialized handling of unexpected exit-reasons selftests: kvm: fix sync_regs_test with newer gccs selftests: kvm: vmx_dirty_log_test: skip the test when VMX is not supported selftests: kvm: consolidate VMX support checks selftests: kvm: vmx_set_nested_state_test: don't check for VMX support twice KVM: Don't shrink/grow vCPU halt_poll_ns if host side polling is disabled selftests: kvm: synchronize .gitignore to Makefile kvm: x86: Expose RDPID in KVM_GET_SUPPORTED_CPUID cpuidle: haltpoll: Take 'idle=' override into account ACPI: NFIT: Fix unlock on error in scrub_show() tracing: Fix race in perf_trace_buf initialization x86/cpu/vmware: Fix platform detection VMWARE_PORT macro x86/cpu/vmware: Use the full form of INL in VMWARE_HYPERCALL, for clang/llvm xdp: Handle device unregister for devmap_hash map type r8152: add device id for Lenovo ThinkPad USB-C Dock Gen 2 ipv4: fix IPSKB_FRAG_PMTU handling with fragmentation ARM: 8926/1: v7m: remove register save to stack before svc Input: st1232 - fix reporting multitouch coordinates Revert "pwm: Let pwm_get_state() return the last implemented state" mmc: mxs: fix flags passed to dmaengine_prep_slave_sg virtiofs: Retry request submission from worker context virtiofs: Count pending forgets as in_flight forgets virtiofs: Set FR_SENT flag only after request has been sent virtiofs: No need to check fpq->connected state virtiofs: Do not end request in submission context fuse: don't advise readdirplus for negative lookup drm/komeda: Fix typos in komeda_splitter_validate drm/komeda: Don't flush inactive pipes i2c: aspeed: fix master pending state handling mmc: cqhci: Commit descriptors before setting the doorbell mmc: sdhci-omap: Fix Tuning procedure for temperatures < -20C ALSA: hda/realtek - Add support for ALC711 perf/aux: Fix tracking of auxiliary trace buffer allocation fuse: don't dereference req->args on finished request opp: core: Revert "add regulators enable and disable" cifs: Fix missed free operations CIFS: avoid using MID 0xFFFF cifs: clarify comment about timestamp granularity for old servers cifs: Handle -EINPROGRESS only when noblockcnt is set PM: QoS: Drop frequency QoS types from device PM QoS cpufreq: Use per-policy frequency QoS PM: QoS: Introduce frequency QoS Linux 5.4-rc4 hwmon: (nct7904) Fix the incorrect value of vsen_mask & tcpu_mask & temp_mode in nct7904_data struct. perf/x86/intel/pt: Fix base for single entry topa KVM: arm64: pmu: Reset sample period on overflow handling KVM: arm64: pmu: Set the CHAINED attribute before creating the in-kernel event arm64: KVM: Handle PMCR_EL0.LC as RES1 on pure AArch64 systems KVM: arm64: pmu: Fix cycle counter truncation net: reorder 'struct net' fields to avoid false sharing net: dsa: fix switch tree list net: ethernet: dwmac-sun8i: show message only when switching to promisc net: aquantia: add an error handling in aq_nic_set_multicast_list net: netem: correct the parent's backlog when corrupted packet was dropped net: netem: fix error path for corrupted GSO frames macb: propagate errors when getting optional clocks xen/netback: fix error path of xenvif_connect_data() net: hns3: fix mis-counting IRQ vector numbers issue scripts/gdb: fix debugging modules on s390 kernel/events/uprobes.c: only do FOLL_SPLIT_PMD for uprobe register mm/thp: allow dropping THP from page cache mm/vmscan.c: support removing arbitrary sized pages from mapping mm/thp: fix node page state in split_huge_page_to_list() proc/meminfo: fix output alignment mm/init-mm.c: include <linux/mman.h> for vm_committed_as_batch mm/filemap.c: include <linux/ramfs.h> for generic_file_vm_ops definition mm: include <linux/huge_mm.h> for is_vma_temporary_stack zram: fix race between backing_dev_show and backing_dev_store mm/memcontrol: update lruvec counters in mem_cgroup_move_account ocfs2: fix panic due to ocfs2_wq is null hugetlbfs: don't access uninitialized memmaps in pfn_range_valid_gigantic() mm: memblock: do not enforce current limit for memblock_phys* family mm: memcg: get number of pages on the LRU list in memcgroup base on lru_zone_size mm/gup: fix a misnamed "write" argument, and a related bug mm/gup_benchmark: add a missing "w" to getopt string ocfs2: fix error handling in ocfs2_setattr() mm: memcg/slab: fix panic in __free_slab() caused by premature memcg pointer release mm/memunmap: don't access uninitialized memmap in memunmap_pages() mm/memory_hotplug: don't access uninitialized memmaps in shrink_pgdat_span() mm/page_owner: don't access uninitialized memmaps when reading /proc/pagetypeinfo scripts/gdb: fix lx-dmesg when CONFIG_PRINTK_CALLER is set mm/memory-failure.c: don't access uninitialized memmaps in memory_failure() fs/proc/page.c: don't access uninitialized memmaps in fs/proc/page.c drivers/base/memory.c: don't access uninitialized memmaps in soft_offline_page_store() xdp: Prevent overflow in devmap_hash cost calculation for 32-bit builds filldir[64]: remove WARN_ON_ONCE() for bad directory entries scsi: ufs-bsg: Wake the device before sending raw upiu commands scsi: lpfc: Check queue pointer before use mips: vdso: Fix __arch_get_hw_counter() MAINTAINERS: Use @kernel.org address for Paul Burton scsi: qla2xxx: fixup incorrect usage of host_byte selftests/bpf: More compatible nc options in test_tc_edt net/mlx5: fix memory leak in mlx5_fw_fatal_reporter_dump net/mlx5: prevent memory leak in mlx5_fpga_conn_create_cq net/mlx5e: TX, Fix consumer index of error cqe dump net/mlx5e: kTLS, Enhance TX resync flow net/mlx5e: kTLS, Save a copy of the crypto info net/mlx5e: kTLS, Remove unneeded cipher type checks net/mlx5e: kTLS, Limit DUMP wqe size net/mlx5e: kTLS, Fix missing SQ edge fill net/mlx5e: kTLS, Fix page refcnt leak in TX resync error flow net/mlx5e: kTLS, Save by-value copy of the record frags net/mlx5e: kTLS, Save only the frag page to release at completion net/mlx5e: kTLS, Size of a Dump WQE is fixed net/mlx5e: kTLS, Release reference on DUMPed fragments in shutdown flow net/mlx5e: Tx, Zero-memset WQE info struct upon update net/mlx5e: Tx, Fix assumption of single WQEBB of NOP in cleanup flow usb: cdns3: Error out if USB_DR_MODE_UNKNOWN in cdns3_core_init_role() ARM: dts: bcm2837-rpi-cm3: Avoid leds-gpio probing issue USB: ldusb: fix read info leaks IB/core: Use rdma_read_gid_l2_fields to compare GID L2 fields RDMA/qedr: Fix reported firmware version RDMA/siw: free siw_base_qp in kref release routine tracing: Fix "gfp_t" format for synthetic events RDMA/iwcm: move iw_rem_ref() calls out of spinlock iw_cxgb4: fix ECN check on the passive accept net: usb: lan78xx: Connect PHY before registering MAC vsock/virtio: discard packets if credit is not respected vsock/virtio: send a credit update when buffer size is changed mlxsw: spectrum_trap: Push Ethernet header before reporting trap ASoC: SOF: control: return true when kcontrol values change ASoC: stm32: sai: fix sysclk management on shutdown ASoC: Intel: sof-rt5682: add a check for devm_clk_get ASoC: rsnd: Reinitialize bit clock inversion flag for every format setting net: ensure correct skb->tstamp in various fragmenters net: bcmgenet: reset 40nm EPHY on energy detect net: bcmgenet: soft reset 40nm EPHYs before MAC init net: phy: bcm7xxx: define soft_reset for 40nm EPHY net: bcmgenet: don't set phydev->link from MAC bus: ti-sysc: Fix watchdog quirk handling ARM: OMAP2+: Add pdata for OMAP3 ISP IOMMU ARM: OMAP2+: Plug in device_enable/idle ops for IOMMUs iommu/vt-d: Return the correct dma mask when we are bypassing the IOMMU iommu/amd: Check PM_LEVEL_SIZE() condition in locked section nvme-pci: Set the prp2 correctly when using more than 4k page HID: i2c-hid: add Trekstor Primebook C11B to descriptor override symbol namespaces: revert to previous __ksymtab name scheme modpost: make updating the symbol namespace explicit modpost: delegate updating namespaces to separate function HID: logitech-hidpp: do all FF cleanup in hidpp_ff_destroy() HID: logitech-hidpp: rework device validation HID: logitech-hidpp: split g920_get_config() HID: i2c-hid: Remove runtime power management x86/boot/acpi: Move get_cmdline_acpi_rsdp() under #ifdef guard x86/hyperv: Set pv_info.name to "Hyper-V" ACPI: CPPC: Set pcc_data[pcc_ss_id] to NULL in acpi_cppc_processor_exit() dmaengine: qcom: bam_dma: Fix resource leak scsi: lpfc: remove left-over BUILD_NVME defines scsi: core: try to get module before removing device scsi: hpsa: add missing hunks in reset-patch scsi: target: core: Do not overwrite CDB byte 1 net: Update address for MediaTek ethernet driver in MAINTAINERS ipv4: fix race condition between route lookup and invalidation ipv4: Return -ENETUNREACH if we can't create route but saddr is valid net: phy: micrel: Update KSZ87xx PHY name net: phy: micrel: Discern KSZ8051 and KSZ8795 PHYs io_uring: fix logic error in io_timeout io_uring: fix up O_NONBLOCK handling for sockets drm/amdgpu/vce: fix allocation size in enc ring test drm/amdgpu: fix error handling in amdgpu_bo_list_create drm/amdgpu: fix potential VM faults drm/amdgpu: user pages array memory leak fix drm/amdgpu/vcn: fix allocation size in enc ring test drm/amdgpu/uvd7: fix allocation size in enc ring test (v2) drm/amdgpu/uvd6: fix allocation size in enc ring test (v2) IB/hfi1: Use a common pad buffer for 9B and 16B packets IB/hfi1: Avoid excessive retry for TID RDMA READ request RDMA/mlx5: Clear old rate limit when closing QP net: dsa: microchip: Add shared regmap mutex net: dsa: microchip: Do not reinit mutexes on KSZ87xx net: stmmac: fix argument to stmmac_pcs_ctrl_ane() dpaa2-eth: Fix TX FQID values dpaa2-eth: add irq for the dpmac connect/disconnect event usb: hso: obey DMA rules in tiocmget Btrfs: check for the full sync flag while holding the inode lock during fsync Btrfs: fix qgroup double free after failure to reserve metadata for delalloc coccinelle: api/devm_platform_ioremap_resource: remove useless script ALSA: hda - Force runtime PM on Nvidia HDMI codecs dm cache: fix bugs when a GFP_NOWAIT allocation fails ARM: davinci_all_defconfig: enable GPIO backlight ARM: davinci: dm365: Fix McBSP dma_slave_map entry binder: Don't modify VMA bounds in ->mmap handler btrfs: tracepoints: Fix bad entry members of qgroup events btrfs: tracepoints: Fix wrong parameter order for qgroup events stop_machine: Avoid potential race behaviour EDAC/ghes: Fix Use after free in ghes_edac remove path ALSA: hda/realtek - Enable headset mic on Asus MJ401TA ALSA: usb-audio: Disable quirks for BOSS Katana amplifiers kheaders: substituting --sort in archive creation powerpc/32s: fix allow/prevent_user_access() when crossing segment boundaries. net: stmmac: disable/enable ptp_ref_clk in suspend/resume flow net: phy: Fix "link partner" information disappear issue rxrpc: use rcu protection while reading sk->sk_user_data drm/i915: Fixup preempt-to-busy vs resubmission of a virtual request drm/i915/userptr: Never allow userptr into the mappable GGTT drm/i915: Favor last VBT child device with conflicting AUX ch/DDC pin drm/i915/execlists: Refactor -EIO markup of hung requests Revert "blackhole_netdev: fix syzkaller reported issue" arm64: tags: Preserve tags for addresses translated via TTBR1 arm64: mm: fix inverted PAR_EL1.F check arm64: sysreg: fix incorrect definition of SYS_PAR_EL1_F arm64: entry.S: Do not preempt from IRQ before all cpufeatures are enabled md/raid0: fix warning message for parameter default_layout kthread: make __kthread_queue_delayed_work static pinctrl: aspeed-g6: Rename SD3 to EMMC and rework pin groups pinctrl: aspeed-g6: Fix UART13 group pinmux pinctrl: aspeed-g6: Make SIG_DESC_CLEAR() behave intuitively pinctrl: aspeed-g6: Fix I3C3/I3C4 pinmux configuration pinctrl: aspeed-g6: Fix I2C14 SDA description pinctrl: aspeed-g6: Sort pins for sanity dt-bindings: pinctrl: aspeed-g6: Rework SD3 function and groups perf kmem: Fix memory leak in compact_gfp_flags() usercopy: Avoid soft lockups in test_check_nonzero_user() pinctrl: berlin: as370: fix a typo s/spififib/spdifib ACPI: processor: Avoid NULL pointer dereferences at init time USB: serial: ti_usb_3410_5052: clean up serial data access USB: serial: ti_usb_3410_5052: fix port-close races xtensa: fix change_bit in exclusive access option HID: intel-ish-hid: fix wrong error handling in ishtp_cl_alloc_tx_ring() RISC-V: fix virtual address overlapped in FIXADDR_START and VMEMMAP_START net: usb: sr9800: fix uninitialized local variable net: bcmgenet: Fix RGMII_MODE_EN value for GENET v1/2/3 net: stmmac: make tc_flow_parsers static davinci_cpdma: make cpdma_chan_split_pool static net: i82596: fix dma_alloc_attr for sni_82596 sctp: change sctp_prot .no_autobind with true sched: etf: Fix ordering of packets with same txtime net: avoid potential infinite loop in tc_ctl_action() net: dsa: sja1105: Use the correct style for SPDX License Identifier tcp: fix a possible lockdep splat in tcp_done() arm: dts: mediatek: Update mt7629 dts to reflect the latest dt-binding net: ethernet: mediatek: Fix MT7629 missing GMII mode support Revert "Input: elantech - enable SMBus on new (2018+) systems" net/sched: fix corrupted L2 header with MPLS 'push' and 'pop' actions net: avoid errors when trying to pop MLPS header on non-MPLS packets net: cavium: Use the correct style for SPDX License Identifier net: dsa: microchip: Use the correct style for SPDX License Identifier PCI: PM: Fix pci_power_up() xtensa: virt: fix PCI IO ports mapping libata/ahci: Fix PCS quirk application vfio/type1: Initialize resv_msi_base 8250-men-mcb: fix error checking when get_num_ports returns -ENODEV USB: usblp: fix use-after-free on disconnect usb: udc: lpc32xx: fix bad bit shift operation usb: cdns3: Fix dequeue implementation. USB: legousbtower: fix a signedness bug in tower_probe() USB: legousbtower: fix memleak on disconnect USB: ldusb: fix memleak on disconnect net: ethernet: broadcom: have drivers select DIMLIB as needed net: Update address for vrf and l3mdev in MAINTAINERS net: bcmgenet: Set phydev->dev_flags only for internal PHYs blackhole_netdev: fix syzkaller reported issue ARM: dts: bcm2835-rpi-zero-w: Fix bus-width of sdhci sparc64: disable fast-GUP due to unexplained oopses btrfs: qgroup: Always free PREALLOC META reserve in btrfs_delalloc_release_extents() drm/panfrost: Handle resetting on timeout better blk-rq-qos: fix first node deletion of rq_qos_del() blkcg: Fix multiple bugs in blkcg_activate_policy() xfs: change the seconds fields in xfs_bulkstat to signed tools headers UAPI: Sync sched.h with the kernel rbd: cancel lock_dwork if the wait is interrupted ceph: just skip unrecognized info in ceph_reply_info_extra tools headers kvm: Sync kvm.h headers with the kernel sources tools headers kvm: Sync kvm headers with the kernel sources tools headers kvm: Sync kvm headers with the kernel sources perf c2c: Fix memory leak in build_cl_output() perf tools: Fix mode setting in copyfile_mode_ns() perf annotate: Fix multiple memory and file descriptor leaks io_uring: consider the overflow of sequence for timeout req perf tools: Fix resource leak of closedir() on the error paths perf evlist: Fix fix for freed id arrays perf jvmti: Link against tools/lib/ctype.h to have weak strlcpy() scripts: setlocalversion: fix a bashism kbuild: update comment about KBUILD_ALLDIRS virtio-fs: don't show mount options nvme-tcp: fix possible leakage during error flow nvmet-loop: fix possible leakage during error flow btrfs: don't needlessly create extent-refs kernel thread iommu/amd: Fix incorrect PASID decoding from event log iommu/ipmmu-vmsa: Only call platform_get_irq() when interrupt is mandatory iommu/rockchip: Don't use platform_get_irq to implicitly count irqs dmaengine: sprd: Fix the possible memory leak issue dmaengine: xilinx_dma: Fix control reg update in vdma_channel_set_config dmaengine: xilinx_dma: Fix 64-bit simple AXIDMA transfer x86/apic/x2apic: Fix a NULL pointer deref when handling a dying cpu x86/hyperv: Make vapic support x2apic mode KVM: PPC: Book3S HV: XIVE: Ensure VP isn't already in use arm64: hibernate: check pgd table allocation arm64: cpufeature: Treat ID_AA64ZFR0_EL1 as RAZ when SVE is not enabled net: aquantia: correctly handle macvlan and multicast coexistence net: aquantia: do not pass lro session with invalid tcp checksum net: aquantia: when cleaning hw cache it should be toggled net: aquantia: temperature retrieval fix gpio: lynxpoint: set default handler to be handle_bad_irq() gpio: merrifield: Move hardware initialization to callback gpio: lynxpoint: Move hardware initialization to callback gpio: intel-mid: Move hardware initialization to callback gpiolib: Initialize the hardware with a callback gpio: merrifield: Restore use of irq_base xtensa: drop EXPORT_SYMBOL for outs*/ins* mm/memory-failure: poison read receives SIGKILL instead of SIGBUS if mmaped more than once mm/slab.c: fix kernel-doc warning for __ksize() xarray.h: fix kernel-doc warning bitmap.h: fix kernel-doc warning and typo fs/fs-writeback.c: fix kernel-doc warning fs/libfs.c: fix kernel-doc warning fs/direct-io.c: fix kernel-doc warning mm, compaction: fix wrong pfn handling in __reset_isolation_pfn() mm, hugetlb: allow hugepage allocations to reclaim as needed lib/test_meminit: add a kmem_cache_alloc_bulk() test mm/slub.c: init_on_free=1 should wipe freelist ptr for bulk allocations lib/generic-radix-tree.c: add kmemleak annotations mm/slub: fix a deadlock in show_slab_objects() mm, page_owner: rename flag indicating that page is allocated mm, page_owner: decouple freeing stack trace from debug_pagealloc mm, page_owner: fix off-by-one error in __set_page_owner_handle() xtensa: fix type conversion in __get_user_[no]check xtensa: clean up assembly arguments in uaccess macros block: Fix elv_support_iosched() parisc: Remove 32-bit DMA enforcement from sba_iommu parisc: Fix vmap memory leak in ioremap()/iounmap() parisc: prefer __section from compiler_attributes.h parisc: sysctl.c: Use CONFIG_PARISC instead of __hppa_ define firmware: dmi: Fix unlikely out-of-bounds read in save_mem_devices riscv: tlbflush: remove confusing comment on local_flush_tlb_all() riscv: dts: HiFive Unleashed: add default chosen/stdout-path riscv: remove the switch statement in do_trap_break() drm/panfrost: Add missing GPU feature registers bpf: lwtunnel: Fix reroute supplying invalid dst xtensa: fix {get,put}_user() for 64bit values kmemleak: Do not corrupt the object_list during clean-up nvme-tcp: Initialize sk->sk_ll_usec only with NET_RX_BUSY_POLL nvme: Wait for reset state when required nvme: Prevent resets during paused controller state nvme: Restart request timers in resetting state nvme: Remove ADMIN_ONLY state nvme-pci: Free tagset if no IO queues hrtimer: Annotate lockless access to timer->base staging: wlan-ng: fix exit return when sme->key_idx >= NUM_WEPKEYS ARM: imx_v6_v7_defconfig: Enable CONFIG_DRM_MSM arm64: dts: imx8mn: Use correct clock for usdhc's ipg clk arm64: dts: imx8mm: Use correct clock for usdhc's ipg clk arm64: dts: imx8mq: Use correct clock for usdhc's ipg clk platform/x86: i2c-multi-instantiate: Fail the probe if no IRQ provided ARM: dts: imx7s: Correct GPT's ipg clock source ARM: dts: vf610-zii-scu4-aib: Specify 'i2c-mux-idle-disconnect' drm/ttm: fix handling in ttm_bo_add_mem_to_lru drm/ttm: Restore ttm prefaulting drm/ttm: fix busy reference in ttm_mem_evict_first ARM: dts: imx6q-logicpd: Re-Enable SNVS power key ath10k: fix latency issue for QCA988x virtio-fs: Change module name to virtiofs.ko dmaengine: imx-sdma: fix size check for sdma script_number dmaengine: tegra210-adma: fix transfer failure arm64: dts: lx2160a: Correct CPU core idle state name dmaengine: sprd: Fix the link-list pointer register configuration issue batman-adv: Avoid free/alloc race when handling OGM buffer batman-adv: Avoid free/alloc race when handling OGM2 buffer netdevsim: Fix error handling in nsim_fib_init and nsim_fib_exit net/ibmvnic: Fix EOI when running in XIVE mode. net: lpc_eth: avoid resetting twice tcp: annotate sk->sk_wmem_queued lockless reads tcp: annotate sk->sk_sndbuf lockless reads tcp: annotate sk->sk_rcvbuf lockless reads tcp: annotate tp->urg_seq lockless reads tcp: annotate tp->snd_nxt lockless reads tcp: annotate tp->write_seq lockless reads tcp: annotate tp->copied_seq lockless reads tcp: annotate tp->rcv_nxt lockless reads tcp: add rcu protection around tp->fastopen_rsk vhost/test: stop device before reset tools/virtio: xen stub mailmap: Add Simon Arlott (replacement for expired email address) rxrpc: Fix possible NULL pointer access in ICMP handling drm/amdgpu/sdma5: fix mask value of POLL_REGMEM packet for pipe sync drm/amdgpu: Bail earlier when amdgpu.cik_/si_support is not set to 1 Revert "drm/radeon: Fix EEH during kexec" Input: synaptics-rmi4 - avoid processing unknown IRQs btrfs: block-group: Fix a memory leak due to missing btrfs_put_block_group() drm/msm/dsi: Implement reset correctly Btrfs: add missing extents release on file extent cluster relocation error x86/boot/64: Round memory hole size up to next PMD page x86/boot/64: Make level2_kernel_pgt pages invalid outside kernel area arm64: Fix kcore macros after 52-bit virtual addressing fallout tools/virtio: more stubs net/smc: receive pending data after RCV_SHUTDOWN net/smc: receive returns without data net/smc: fix SMCD link group creation with VLAN id net: update net_dim documentation after rename r8169: fix jumbo packet handling on resume from suspend arm64: dts: rockchip: Fix override mode for rk3399-kevin panel arm64: dts: rockchip: Fix usb-c on Hugsun X99 TV Box arm64: dts: rockchip: fix RockPro64 sdmmc settings ARM: 8914/1: NOMMU: Fix exc_ret for XIP ARM: 8908/1: add __always_inline to functions called from __get_user_check() HID: google: add magnemite/masterball USB ids MAINTAINERS: Add BCM2711 to BCM2835 ARCH dma-buf/resv: fix exclusive fence get drm/edid: Add 6 bpc quirk for SDC panel in Lenovo G50 dm snapshot: rework COW throttling to fix deadlock dm snapshot: introduce account_start_copy() and account_end_copy() drm/tiny: Kconfig: Remove always-y THERMAL dep. from TINYDRM_REPAPER platform/x86: intel_punit_ipc: Avoid error message when retrieving IRQ platform/x86: classmate-laptop: remove unused variable opp: of: drop incorrect lockdep_assert_held() PM: sleep: include <linux/pm_runtime.h> for pm_wq cpufreq: Avoid cpufreq_suspend() deadlock on system shutdown ACPI: PM: Drop Dell XPS13 9360 from LPS0 Idle _DSM blacklist net: silence KCSAN warnings about sk->sk_backlog.len reads net: annotate sk->sk_rcvlowat lockless reads net: silence KCSAN warnings around sk_add_backlog() calls tcp: annotate lockless access to tcp_memory_pressure net: add {READ|WRITE}_ONCE() annotations on ->rskq_accept_head net: avoid possible false sharing in sk_leave_memory_pressure() tun: remove possible false sharing in tun_flow_update() netfilter: conntrack: avoid possible false sharing netns: fix NLM_F_ECHO mechanism for RTM_NEWNSID scsi: ch: Make it possible to open a ch device multiple times again scsi: fix kconfig dependency warning related to 53C700_LE_ON_BE scsi: sni_53c710: fix compilation error scsi: scsi_dh_alua: handle RTPG sense code correctly during state transitions scsi: qla2xxx: fix a potential NULL pointer dereference net: usb: qmi_wwan: add Telit 0x1050 composition act_mirred: Fix mirred_init_module error handling net: taprio: Fix returning EINVAL when configuring without flags s390/qeth: Fix initialization of vnicc cmd masks during set online s390/qeth: Fix error handling during VNICC initialization phylink: fix kernel-doc warnings sctp: add chunks to sk_backlog when the newsk sk_socket is not set bonding: fix potential NULL deref in bond_update_slave_arr net: stmmac: fix disabling flexible PPS output net: stmmac: fix length of PTP clock's name string ARM: mm: alignment: use "u32" for 32-bit instructions ARM: mm: fix alignment handler faults under memory pressure ARM: dts: Use level interrupt for omap4 & 5 wlcore drivers/amba: fix reset control error handling ASoC: simple_card_utils.h: Fix potential multiple redefinition error ASoC: msm8916-wcd-digital: add missing MIX2 path for RX1/2 drm/amdgpu/powerplay: fix typo in mvdd table setup iwlwifi: pcie: change qu with jf devices to use qu configuration iwlwifi: exclude GEO SAR support for 3168 iwlwifi: pcie: fix memory leaks in iwl_pcie_ctxt_info_gen3_init iwlwifi: dbg_ini: fix memory leak in alloc_sgtable iwlwifi: pcie: fix rb_allocator workqueue allocation iwlwifi: pcie: fix indexing in command dump for new HW iwlwifi: mvm: fix race in sync rx queue notification iwlwifi: mvm: force single phy init iwlwifi: fix ACPI table revision checks iwlwifi: don't access trans_cfg via cfg memstick: jmb38x_ms: Fix an error handling path in 'jmb38x_ms_probe()' mmc: sdhci-iproc: fix spurious interrupts on Multiblock reads with bcm2711 pinctrl: armada-37xx: swap polarity on LED group arm64: dts: armada-3720-turris-mox: convert usb-phy to phy-supply ip6erspan: remove the incorrect mtu limit for ip6erspan Doc: networking/device_drivers/pensando: fix ionic.rst warnings NFC: pn533: fix use-after-free and memleaks Input: soc_button_array - partial revert of support for newer surface devices net_sched: fix backward compatibility for TCA_ACT_KIND net_sched: fix backward compatibility for TCA_KIND net/mlx5: DR, Allow insertion of duplicate rules selftests/bpf: More compatible nc options in test_lwt_ip_encap selftests/bpf: Set rp_filter in test_flow_dissector llc: fix sk_buff refcounting in llc_conn_state_process() llc: fix another potential sk_buff leak in llc_ui_sendmsg() llc: fix sk_buff leak in llc_conn_service() llc: fix sk_buff leak in llc_sap_state_process() dm clone: Make __hash_find static rt2x00: remove input-polldev.h header ARM: dts: am3874-iceboard: Fix 'i2c-mux-idle-disconnect' usage ARM: dts: omap5: fix gpu_cm clock provider name arm64: Allow CAVIUM_TX2_ERRATUM_219 to be selected arm64: Avoid Cavium TX2 erratum 219 when switching TTBR arm64: Enable workaround for Cavium TX2 erratum 219 when running SMT arm64: KVM: Trap VM ops when ARM64_WORKAROUND_CAVIUM_TX2_219_TVM is set mac80211: fix scan when operating on DFS channels in ETSI domains mac80211: accept deauth frames in IBSS mode cfg80211: fix a bunch of RCU issues in multi-bssid code nl80211: fix memory leak in nl80211_get_ftm_responder_stats ptp: fix typo of "mechanism" in Kconfig help text ionic: fix stats memory dereference ASoC: core: Fix pcm code debugfs error ARM: dts: sun7i: Drop the module clock from the device tree dt-bindings: media: sun4i-csi: Drop the module clock rxrpc: Fix call crypto state cleanup rxrpc: rxrpc_peer needs to hold a ref on the rxrpc_local record rxrpc: Fix trace-after-put looking at the put call record rxrpc: Fix trace-after-put looking at the put connection record rxrpc: Fix trace-after-put looking at the put peer record media: dt-bindings: Fix building error for dt_binding_check rxrpc: Fix call ref leak ALSA: hdac: clear link output stream mapping ALSA: hda/realtek: Reduce the Headphone static noise on XPS 9350/9360 lib: test_user_copy: style cleanup net: stmmac: selftests: Fix L2 Hash Filter test net: stmmac: gmac4+: Not all Unicast addresses may be available net: stmmac: selftests: Check if filtering is available before running net: dsa: b53: Do not clear existing mirrored port mask arm64: dts: zii-ultra: fix ARM regulator states soc: imx: imx-scu: Getting UID from SCU should have response pinctrl: stmfx: fix null pointer on remove pinctrl: iproc: allow for error from platform_get_irq() nvme: retain split access workaround for capability reads nvme: fix possible deadlock when nvme_update_formats fails pinctrl: ns2: Fix off by one bugs in ns2_pinmux_enable() pinctrl: bcm-iproc: Use SPDX header pinctrl: armada-37xx: fix control of pins 32 and up arm64: dts: rockchip: fix RockPro64 sdhci settings arm64: dts: rockchip: fix RockPro64 vdd-log regulator settings regulator: qcom-rpmh: Fix PMIC5 BoB min voltage ARM: dts: logicpd-torpedo-som: Remove twl_keypad cfg80211: wext: avoid copying malformed SSIDs mac80211: Reject malformed SSID elements mac80211_hwsim: fix incorrect dev_alloc_name failure goto MAINTAINERS: Add hp_sdc drivers to parisc arch scsi: MAINTAINERS: Update qla2xxx driver scsi: zfcp: fix reaction on bit error threshold notification scsi: core: save/restore command resid for error handling dt-bindings: arm: rockchip: fix Theobroma-System board bindings arm64: dts: rockchip: fix Rockpro64 RK808 interrupt line HID: Fix assumption that devices have inputs ARM: omap2plus_defconfig: Fix selected panels after generic panel changes samples/bpf: Add a workaround for asm_inline xsk: Fix crash in poll when device does not support ndo_xsk_wakeup samples/bpf: Fix build for task_fd_query_user.c ASoc: rockchip: i2s: Fix RPM imbalance mmc: sh_mmcif: Use platform_get_irq_optional() for optional interrupt mmc: renesas_sdhi: Do not use platform_get_irq() to count interrupts ACPI: HMAT: ACPI_HMAT_MEMORY_PD_VALID is deprecated since ACPI-6.3 Input: goodix - add support for 9-bytes reports Input: da9063 - fix capability and drop KEY_SLEEP ASoC: wm_adsp: Don't generate kcontrols without READ flags sysfs: Fixes __BIN_ATTR_WO() macro rt2x00: initialize last_reset selftests/bpf: test_progs: Don't leak server_fd in test_sockopt_inherit selftests/bpf: test_progs: Don't leak server_fd in tcp_rtt regulator: pfuze100-regulator: Variable "val" in pfuze100_regulator_probe() could be uninitialized ASoC: intel: bytcr_rt5651: add null check to support_button_press ASoC: intel: sof_rt5682: add remove function to disable jack ASoC: rt5682: add NULL handler to set_jack function ASoC: intel: sof_rt5682: use separate route map for dmic ASoC: SOF: Intel: hda: Disable DMI L1 entry during capture ASoC: SOF: Intel: initialise and verify FW crash dump data. ASoC: SOF: Intel: hda: fix warnings during FW load ASoC: SOF: pcm: harden PCM STOP sequence ASoC: SOF: pcm: fix resource leak in hw_free ASoC: SOF: topology: fix parse fail issue for byte/bool tuple types ASoC: SOF: loader: fix kernel oops on firmware boot failure regulator: lochnagar: Add on_off_delay for VDDCORE ASoC: wm_adsp: Fix theoretical NULL pointer for alg_region pinctrl: cherryview: restore Strago DMI workaround for all versions pinctrl: intel: Allocate IRQ chip dynamic HID: prodikeys: make array keys static const, makes object smaller HID: fix error message in hid_open_report() ASoC: max98373: check for device node before parsing regulator: ti-abb: Fix timeout in ti_abb_wait_txdone/ti_abb_clear_all_txdone iommu/io-pgtable-arm: Support all Mali configurations iommu/io-pgtable-arm: Correct Mali attributes iommu/arm-smmu: Free context bitmap in the err path of arm_smmu_init_domain_context scsi: qla2xxx: Remove WARN_ON_ONCE in qla2x00_status_cont_entry() scsi: sd: Ignore a failure to sync cache due to lack of authorization arm64: dts: Fix gpio to pinmux mapping libbpf: handle symbol versioning properly for libbpf.a arm64: dts: allwinner: a64: sopine-baseboard: Add PHY regulator delay arm64: dts: allwinner: a64: Drop PMU node arm64: dts: allwinner: a64: pine64-plus: Add PHY regulator delay tools: bpf: Use !building_out_of_srctree to determine srctree ASoC: topology: Fix a signedness bug in soc_tplg_dapm_widget_create() scsi: core: fix dh and multipathing for SCSI hosts without request batching scsi: core: fix missing .cleanup_rq for SCSI hosts without request batching regulator: da9062: fix suspend_enable/disable preparation dt-bindings: fixed-regulator: fix compatible enum regulator: fixed: Prevent NULL pointer dereference when !CONFIG_OF ASoC: soc-component: fix a couple missing error assignments ASoC: wm8994: Do not register inapplicable controls for WM1811 ASoC: samsung: arndale: Add missing OF node dereferencing irqchip/sifive-plic: Switch to fasteoi flow irqchip/gic-v3: Fix GIC_LINE_NR accessor regulator: core: make regulator_register() EPROBE_DEFER aware regulator: of: fix suspend-min/max-voltage parsing irqchip/atmel-aic5: Add support for sam9x60 irqchip irqchip/al-fic: Add support for irq retrigger Change-Id: I5e7fd941c93a36889378f480cc27d8ea77d11b39 Signed-off-by: Raghavendra Rao Ananta <rananta@codeaurora.org>	2019-11-04 17:30:19 -08:00
Lukas Wunner	250367c59e	netfilter: nf_tables: Align nft_expr private data to 64-bit ... Invoking the following commands on a 32-bit architecture with strict alignment requirements (such as an ARMv7-based Raspberry Pi) results in an alignment exception: # nft add table ip test-ip4 # nft add chain ip test-ip4 output { type filter hook output priority 0; } # nft add rule ip test-ip4 output quota 1025 bytes Alignment trap: not handling instruction e1b26f9f at [<7f4473f8>] Unhandled fault: alignment exception (0x001) at 0xb832e824 Internal error: : 1 [#1] PREEMPT SMP ARM Hardware name: BCM2835 [<7f4473fc>] (nft_quota_do_init [nft_quota]) [<7f447448>] (nft_quota_init [nft_quota]) [<7f4260d0>] (nf_tables_newrule [nf_tables]) [<7f4168dc>] (nfnetlink_rcv_batch [nfnetlink]) [<7f416bd0>] (nfnetlink_rcv [nfnetlink]) [<8078b334>] (netlink_unicast) [<8078b664>] (netlink_sendmsg) [<8071b47c>] (sock_sendmsg) [<8071bd18>] (___sys_sendmsg) [<8071ce3c>] (__sys_sendmsg) [<8071ce94>] (sys_sendmsg) The reason is that nft_quota_do_init() calls atomic64_set() on an atomic64_t which is only aligned to 32-bit, not 64-bit, because it succeeds struct nft_expr in memory which only contains a 32-bit pointer. Fix by aligning the nft_expr private data to 64-bit. Fixes: 96518518cc ("netfilter: add nftables") Signed-off-by: Lukas Wunner <lukas@wunner.de> Cc: stable@vger.kernel.org # v3.13+ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>	2019-11-04 20:58:32 +01:00
Greg Kroah-Hartman	2a71bdee3f	Linux 5.4-rc6 ... -----BEGIN PGP SIGNATURE----- iQFSBAABCAA8FiEEq68RxlopcLEwq+PEeb4+QwBBGIYFAl2/T6oeHHRvcnZhbGRz QGxpbnV4LWZvdW5kYXRpb24ub3JnAAoJEHm+PkMAQRiGB7kH/2asrl7RylHPQfsI pkjPPq32MHLq6Zmr8y0N0hyJCm1Dxu8qCIktqrEV5vsbKdv5pb8EMdQRlhJUtR8e TZdYDGHiL0sFb2HYiEvL0qD9BNeI+Kftw/kUffVXRzyMWex/f5S6mW5QNTuv9SQT Zfa+sXreFPCCyd3jhQFRyguogaCXBmTYvO6glmc96Yi4nA1URtIxNXhXumoklElF 8Ka7UqtoJk2nPns+oV9I5xohghgJHHjA3A96WURku1UdO9dRoHiyS05RjnijBxsk ffenk09qbGvnvvgP93Q23CoTO8ndIm12ZL8C9jX49CS21j5SVG0PLPhS08f70vEf h5K/OtE= =nmDP -----END PGP SIGNATURE----- Merge 5.4-rc6 into android-mainline Linux 5.4-rc6 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I211f7159a46cf2a3dbb18afe56777cae1c13ac73	2019-11-04 06:51:47 +01:00
Eric Dumazet	ee8d153d46	net: annotate lockless accesses to sk->sk_napi_id ... We already annotated most accesses to sk->sk_napi_id We missed sk_mark_napi_id() and sk_mark_napi_id_once() which might be called without socket lock held in UDP stack. KCSAN reported : BUG: KCSAN: data-race in udpv6_queue_rcv_one_skb / udpv6_queue_rcv_one_skb write to 0xffff888121c6d108 of 4 bytes by interrupt on cpu 0: sk_mark_napi_id include/net/busy_poll.h:125 [inline] __udpv6_queue_rcv_skb net/ipv6/udp.c:571 [inline] udpv6_queue_rcv_one_skb+0x70c/0xb40 net/ipv6/udp.c:672 udpv6_queue_rcv_skb+0xb5/0x400 net/ipv6/udp.c:689 udp6_unicast_rcv_skb.isra.0+0xd7/0x180 net/ipv6/udp.c:832 __udp6_lib_rcv+0x69c/0x1770 net/ipv6/udp.c:913 udpv6_rcv+0x2b/0x40 net/ipv6/udp.c:1015 ip6_protocol_deliver_rcu+0x22a/0xbe0 net/ipv6/ip6_input.c:409 ip6_input_finish+0x30/0x50 net/ipv6/ip6_input.c:450 NF_HOOK include/linux/netfilter.h:305 [inline] NF_HOOK include/linux/netfilter.h:299 [inline] ip6_input+0x177/0x190 net/ipv6/ip6_input.c:459 dst_input include/net/dst.h:442 [inline] ip6_rcv_finish+0x110/0x140 net/ipv6/ip6_input.c:76 NF_HOOK include/linux/netfilter.h:305 [inline] NF_HOOK include/linux/netfilter.h:299 [inline] ipv6_rcv+0x1a1/0x1b0 net/ipv6/ip6_input.c:284 __netif_receive_skb_one_core+0xa7/0xe0 net/core/dev.c:5010 __netif_receive_skb+0x37/0xf0 net/core/dev.c:5124 process_backlog+0x1d3/0x420 net/core/dev.c:5955 napi_poll net/core/dev.c:6392 [inline] net_rx_action+0x3ae/0xa90 net/core/dev.c:6460 write to 0xffff888121c6d108 of 4 bytes by interrupt on cpu 1: sk_mark_napi_id include/net/busy_poll.h:125 [inline] __udpv6_queue_rcv_skb net/ipv6/udp.c:571 [inline] udpv6_queue_rcv_one_skb+0x70c/0xb40 net/ipv6/udp.c:672 udpv6_queue_rcv_skb+0xb5/0x400 net/ipv6/udp.c:689 udp6_unicast_rcv_skb.isra.0+0xd7/0x180 net/ipv6/udp.c:832 __udp6_lib_rcv+0x69c/0x1770 net/ipv6/udp.c:913 udpv6_rcv+0x2b/0x40 net/ipv6/udp.c:1015 ip6_protocol_deliver_rcu+0x22a/0xbe0 net/ipv6/ip6_input.c:409 ip6_input_finish+0x30/0x50 net/ipv6/ip6_input.c:450 NF_HOOK include/linux/netfilter.h:305 [inline] NF_HOOK include/linux/netfilter.h:299 [inline] ip6_input+0x177/0x190 net/ipv6/ip6_input.c:459 dst_input include/net/dst.h:442 [inline] ip6_rcv_finish+0x110/0x140 net/ipv6/ip6_input.c:76 NF_HOOK include/linux/netfilter.h:305 [inline] NF_HOOK include/linux/netfilter.h:299 [inline] ipv6_rcv+0x1a1/0x1b0 net/ipv6/ip6_input.c:284 __netif_receive_skb_one_core+0xa7/0xe0 net/core/dev.c:5010 __netif_receive_skb+0x37/0xf0 net/core/dev.c:5124 process_backlog+0x1d3/0x420 net/core/dev.c:5955 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 10890 Comm: syz-executor.0 Not tainted 5.4.0-rc3+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Fixes: e68b6e50fa ("udp: enable busy polling for all sockets") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2019-10-30 17:34:35 -07:00
Eric Dumazet	7170a97774	net: annotate accesses to sk->sk_incoming_cpu ... This socket field can be read and written by concurrent cpus. Use READ_ONCE() and WRITE_ONCE() annotations to document this, and avoid some compiler 'optimizations'. KCSAN reported : BUG: KCSAN: data-race in tcp_v4_rcv / tcp_v4_rcv write to 0xffff88812220763c of 4 bytes by interrupt on cpu 0: sk_incoming_cpu_update include/net/sock.h:953 [inline] tcp_v4_rcv+0x1b3c/0x1bb0 net/ipv4/tcp_ipv4.c:1934 ip_protocol_deliver_rcu+0x4d/0x420 net/ipv4/ip_input.c:204 ip_local_deliver_finish+0x110/0x140 net/ipv4/ip_input.c:231 NF_HOOK include/linux/netfilter.h:305 [inline] NF_HOOK include/linux/netfilter.h:299 [inline] ip_local_deliver+0x133/0x210 net/ipv4/ip_input.c:252 dst_input include/net/dst.h:442 [inline] ip_rcv_finish+0x121/0x160 net/ipv4/ip_input.c:413 NF_HOOK include/linux/netfilter.h:305 [inline] NF_HOOK include/linux/netfilter.h:299 [inline] ip_rcv+0x18f/0x1a0 net/ipv4/ip_input.c:523 __netif_receive_skb_one_core+0xa7/0xe0 net/core/dev.c:5010 __netif_receive_skb+0x37/0xf0 net/core/dev.c:5124 process_backlog+0x1d3/0x420 net/core/dev.c:5955 napi_poll net/core/dev.c:6392 [inline] net_rx_action+0x3ae/0xa90 net/core/dev.c:6460 __do_softirq+0x115/0x33f kernel/softirq.c:292 do_softirq_own_stack+0x2a/0x40 arch/x86/entry/entry_64.S:1082 do_softirq.part.0+0x6b/0x80 kernel/softirq.c:337 do_softirq kernel/softirq.c:329 [inline] __local_bh_enable_ip+0x76/0x80 kernel/softirq.c:189 read to 0xffff88812220763c of 4 bytes by interrupt on cpu 1: sk_incoming_cpu_update include/net/sock.h:952 [inline] tcp_v4_rcv+0x181a/0x1bb0 net/ipv4/tcp_ipv4.c:1934 ip_protocol_deliver_rcu+0x4d/0x420 net/ipv4/ip_input.c:204 ip_local_deliver_finish+0x110/0x140 net/ipv4/ip_input.c:231 NF_HOOK include/linux/netfilter.h:305 [inline] NF_HOOK include/linux/netfilter.h:299 [inline] ip_local_deliver+0x133/0x210 net/ipv4/ip_input.c:252 dst_input include/net/dst.h:442 [inline] ip_rcv_finish+0x121/0x160 net/ipv4/ip_input.c:413 NF_HOOK include/linux/netfilter.h:305 [inline] NF_HOOK include/linux/netfilter.h:299 [inline] ip_rcv+0x18f/0x1a0 net/ipv4/ip_input.c:523 __netif_receive_skb_one_core+0xa7/0xe0 net/core/dev.c:5010 __netif_receive_skb+0x37/0xf0 net/core/dev.c:5124 process_backlog+0x1d3/0x420 net/core/dev.c:5955 napi_poll net/core/dev.c:6392 [inline] net_rx_action+0x3ae/0xa90 net/core/dev.c:6460 __do_softirq+0x115/0x33f kernel/softirq.c:292 run_ksoftirqd+0x46/0x60 kernel/softirq.c:603 smpboot_thread_fn+0x37d/0x4a0 kernel/smpboot.c:165 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 16 Comm: ksoftirqd/1 Not tainted 5.4.0-rc3+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2019-10-30 13:24:25 -07:00
Tejun Heo	20eb4f29b6	net: fix sk_page_frag() recursion from memory reclaim ... sk_page_frag() optimizes skb_frag allocations by using per-task skb_frag cache when it knows it's the only user. The condition is determined by seeing whether the socket allocation mask allows blocking - if the allocation may block, it obviously owns the task's context and ergo exclusively owns current->task_frag. Unfortunately, this misses recursion through memory reclaim path. Please take a look at the following backtrace. [2] RIP: 0010:tcp_sendmsg_locked+0xccf/0xe10 ... tcp_sendmsg+0x27/0x40 sock_sendmsg+0x30/0x40 sock_xmit.isra.24+0xa1/0x170 [nbd] nbd_send_cmd+0x1d2/0x690 [nbd] nbd_queue_rq+0x1b5/0x3b0 [nbd] __blk_mq_try_issue_directly+0x108/0x1b0 blk_mq_request_issue_directly+0xbd/0xe0 blk_mq_try_issue_list_directly+0x41/0xb0 blk_mq_sched_insert_requests+0xa2/0xe0 blk_mq_flush_plug_list+0x205/0x2a0 blk_flush_plug_list+0xc3/0xf0 [1] blk_finish_plug+0x21/0x2e _xfs_buf_ioapply+0x313/0x460 __xfs_buf_submit+0x67/0x220 xfs_buf_read_map+0x113/0x1a0 xfs_trans_read_buf_map+0xbf/0x330 xfs_btree_read_buf_block.constprop.42+0x95/0xd0 xfs_btree_lookup_get_block+0x95/0x170 xfs_btree_lookup+0xcc/0x470 xfs_bmap_del_extent_real+0x254/0x9a0 __xfs_bunmapi+0x45c/0xab0 xfs_bunmapi+0x15/0x30 xfs_itruncate_extents_flags+0xca/0x250 xfs_free_eofblocks+0x181/0x1e0 xfs_fs_destroy_inode+0xa8/0x1b0 destroy_inode+0x38/0x70 dispose_list+0x35/0x50 prune_icache_sb+0x52/0x70 super_cache_scan+0x120/0x1a0 do_shrink_slab+0x120/0x290 shrink_slab+0x216/0x2b0 shrink_node+0x1b6/0x4a0 do_try_to_free_pages+0xc6/0x370 try_to_free_mem_cgroup_pages+0xe3/0x1e0 try_charge+0x29e/0x790 mem_cgroup_charge_skmem+0x6a/0x100 __sk_mem_raise_allocated+0x18e/0x390 __sk_mem_schedule+0x2a/0x40 [0] tcp_sendmsg_locked+0x8eb/0xe10 tcp_sendmsg+0x27/0x40 sock_sendmsg+0x30/0x40 ___sys_sendmsg+0x26d/0x2b0 __sys_sendmsg+0x57/0xa0 do_syscall_64+0x42/0x100 entry_SYSCALL_64_after_hwframe+0x44/0xa9 In [0], tcp_send_msg_locked() was using current->page_frag when it called sk_wmem_schedule(). It already calculated how many bytes can be fit into current->page_frag. Due to memory pressure, sk_wmem_schedule() called into memory reclaim path which called into xfs and then IO issue path. Because the filesystem in question is backed by nbd, the control goes back into the tcp layer - back into tcp_sendmsg_locked(). nbd sets sk_allocation to (GFP_NOIO | __GFP_MEMALLOC) which makes sense - it's in the process of freeing memory and wants to be able to, e.g., drop clean pages to make forward progress. However, this confused sk_page_frag() called from [2]. Because it only tests whether the allocation allows blocking which it does, it now thinks current->page_frag can be used again although it already was being used in [0]. After [2] used current->page_frag, the offset would be increased by the used amount. When the control returns to [0], current->page_frag's offset is increased and the previously calculated number of bytes now may overrun the end of allocated memory leading to silent memory corruptions. Fix it by adding gfpflags_normal_context() which tests sleepable && !reclaim and use it to determine whether to use current->task_frag. v2: Eric didn't like gfp flags being tested twice. Introduce a new helper gfpflags_normal_context() and combine the two tests. Signed-off-by: Tejun Heo <tj@kernel.org> Cc: Josef Bacik <josef@toxicpanda.com> Cc: Eric Dumazet <eric.dumazet@gmail.com> Cc: stable@vger.kernel.org Signed-off-by: David S. Miller <davem@davemloft.net>	2019-10-28 16:17:31 -07:00
David S. Miller	fc11078dd3	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf ... Pablo Neira Ayuso says: ==================== Netfilter/IPVS fixes for net The following patchset contains Netfilter/IPVS fixes for net: 1) Fix crash on flowtable due to race between garbage collection and insertion. 2) Restore callback unbinding in netfilter offloads. 3) Fix races on IPVS module removal, from Davide Caratti. 4) Make old_secure_tcp per-netns to fix sysbot report, from Eric Dumazet. 5) Validate matching length in netfilter offloads, from wenxu. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>	2019-10-27 12:13:16 -07:00
Greg Kroah-Hartman	9be46ff3b6	Linux 5.4-rc4 ... -----BEGIN PGP SIGNATURE----- iQFSBAABCAA8FiEEq68RxlopcLEwq+PEeb4+QwBBGIYFAl2su/AeHHRvcnZhbGRz QGxpbnV4LWZvdW5kYXRpb24ub3JnAAoJEHm+PkMAQRiGvm4H/1jkheCrvB/GJS69 wd18vizAg+eFmNCzxlGVhpQTKGymNRy+g6clnoli3cNJ3pSVKcYgVyB3oXaONIhp g/ANudnBjTdjqYgJzfLij5AGecrGwDpF3YL0kuKrCB63s2I/HwQGYy/aPrYY8emy gAYdaf1DGRu5/DIIB6soTo/TnpKoAyTE+XY5MaPSug++t/Flov19tlU40IZxXW94 bjTXbm0yklrsIx+LL5mYYGGnygSTCF66JjFg1qhDCBQaS2MZ21h1ZgaOtGZTwZcc WgEiqLC5S1Iyj96zir1t78RcVQ4RzgvDbhUOgIqUFsYAO2wOicvxyFE3Hj8rPOKd uGgVPRM= =xgZa -----END PGP SIGNATURE----- Merge 5.4-rc4 into android-mainline Linux 5.4-rc4 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I0edccd72fad8b6443b24c8c1005b66d6b8f532ce	2019-10-26 19:24:41 +02:00
Guillaume Nault	d4e4fdf9e4	netns: fix GFP flags in rtnl_net_notifyid() ... In rtnl_net_notifyid(), we certainly can't pass a null GFP flag to rtnl_notify(). A GFP_KERNEL flag would be fine in most circumstances, but there are a few paths calling rtnl_net_notifyid() from atomic context or from RCU critical sections. The later also precludes the use of gfp_any() as it wouldn't detect the RCU case. Also, the nlmsg_new() call is wrong too, as it uses GFP_KERNEL unconditionally. Therefore, we need to pass the GFP flags as parameter and propagate it through function calls until the proper flags can be determined. In most cases, GFP_KERNEL is fine. The exceptions are: * openvswitch: ovs_vport_cmd_get() and ovs_vport_cmd_dump() indirectly call rtnl_net_notifyid() from RCU critical section, * rtnetlink: rtmsg_ifinfo_build_skb() already receives GFP flags as parameter. Also, in ovs_vport_cmd_build_info(), let's change the GFP flags used by nlmsg_new(). The function is allowed to sleep, so better make the flags consistent with the ones used in the following ovs_vport_cmd_fill_info() call. Found by code inspection. Fixes: 9a9634545c ("netns: notify netns id events") Signed-off-by: Guillaume Nault <gnault@redhat.com> Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Acked-by: Pravin B Shelar <pshelar@ovn.org> Signed-off-by: David S. Miller <davem@davemloft.net>	2019-10-25 20:14:42 -07:00
lesl	39bb6b4242	ANDROID: virt_wifi: Add data ops for scan data simulation ... Bug: 139421123 Signed-off-by: lesl <lesl@google.com> Change-Id: Ib686dffe23cc234937af7e383182834721f01d78 Signed-off-by: Alistair Delva <adelva@google.com>	2019-10-26 01:16:30 +00:00
Ben Dooks (Codethink)	91e2e57636	net: hwbm: if CONFIG_NET_HWBM unset, make stub functions static ... If CONFIG_NET_HWBM is not set, then these stub functions in <net/hwbm.h> should be declared static to avoid trying to export them from any driver that includes this. Fixes the following sparse warnings: ./include/net/hwbm.h:24:6: warning: symbol 'hwbm_buf_free' was not declared. Should it be static? ./include/net/hwbm.h:25:5: warning: symbol 'hwbm_pool_refill' was not declared. Should it be static? ./include/net/hwbm.h:26:5: warning: symbol 'hwbm_pool_add' was not declared. Should it be static? Signed-off-by: Ben Dooks (Codethink) <ben.dooks@codethink.co.uk> Signed-off-by: David S. Miller <davem@davemloft.net>	2019-10-25 16:24:32 -07:00
Taehee Yoo	f3b0a18bb6	net: remove unnecessary variables and callback ... This patch removes variables and callback these are related to the nested device structure. devices that can be nested have their own nest_level variable that represents the depth of nested devices. In the previous patch, new {lower/upper}_level variables are added and they replace old private nest_level variable. So, this patch removes all 'nest_level' variables. In order to avoid lockdep warning, ->ndo_get_lock_subclass() was added to get lockdep subclass value, which is actually lower nested depth value. But now, they use the dynamic lockdep key to avoid lockdep warning instead of the subclass. So, this patch removes ->ndo_get_lock_subclass() callback. Signed-off-by: Taehee Yoo <ap420073@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2019-10-24 14:53:49 -07:00
Taehee Yoo	0ce1822c2a	vxlan: add adjacent link to limit depth level ... Current vxlan code doesn't limit the number of nested devices. Nested devices would be handled recursively and this routine needs huge stack memory. So, unlimited nested devices could make stack overflow. In order to fix this issue, this patch adds adjacent links. The adjacent link APIs internally check the depth level. Test commands: ip link add dummy0 type dummy ip link add vxlan0 type vxlan id 0 group 239.1.1.1 dev dummy0 \ dstport 4789 for i in {1..100} do let A=$i-1 ip link add vxlan$i type vxlan id $i group 239.1.1.1 \ dev vxlan$A dstport 4789 done ip link del dummy0 The top upper link is vxlan100 and the lowest link is vxlan0. When vxlan0 is deleting, the upper devices will be deleted recursively. It needs huge stack memory so it makes stack overflow. Splat looks like: [ 229.628477] ============================================================================= [ 229.629785] BUG page->ptl (Not tainted): Padding overwritten. 0x0000000026abf214-0x0000000091f6abb2 [ 229.629785] ----------------------------------------------------------------------------- [ 229.629785] [ 229.655439] ================================================================== [ 229.629785] INFO: Slab 0x00000000ff7cfda8 objects=19 used=19 fp=0x00000000fe33776c flags=0x200000000010200 [ 229.655688] BUG: KASAN: stack-out-of-bounds in unmap_single_vma+0x25a/0x2e0 [ 229.655688] Read of size 8 at addr ffff888113076928 by task vlan-network-in/2334 [ 229.655688] [ 229.629785] Padding 0000000026abf214: 00 80 14 0d 81 88 ff ff 68 91 81 14 81 88 ff ff ........h....... [ 229.629785] Padding 0000000001e24790: 38 91 81 14 81 88 ff ff 68 91 81 14 81 88 ff ff 8.......h....... [ 229.629785] Padding 00000000b39397c8: 33 30 62 a7 ff ff ff ff ff eb 60 22 10 f1 ff 1f 30b.......`".... [ 229.629785] Padding 00000000bc98f53a: 80 60 07 13 81 88 ff ff 00 80 14 0d 81 88 ff ff .`.............. [ 229.629785] Padding 000000002aa8123d: 68 91 81 14 81 88 ff ff f7 21 17 a7 ff ff ff ff h........!...... [ 229.629785] Padding 000000001c8c2369: 08 81 14 0d 81 88 ff ff 03 02 00 00 00 00 00 00 ................ [ 229.629785] Padding 000000004e290c5d: 21 90 a2 21 10 ed ff ff 00 00 00 00 00 fc ff df !..!............ [ 229.629785] Padding 000000000e25d731: 18 60 07 13 81 88 ff ff c0 8b 13 05 81 88 ff ff .`.............. [ 229.629785] Padding 000000007adc7ab3: b3 8a b5 41 00 00 00 00 ...A.... [ 229.629785] FIX page->ptl: Restoring 0x0000000026abf214-0x0000000091f6abb2=0x5a [ ... ] Fixes: acaf4e7099 ("net: vxlan: when lower dev unregisters remove vxlan dev as well") Signed-off-by: Taehee Yoo <ap420073@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2019-10-24 14:53:49 -07:00
Taehee Yoo	089bca2cae	bonding: use dynamic lockdep key instead of subclass ... All bonding device has same lockdep key and subclass is initialized with nest_level. But actual nest_level value can be changed when a lower device is attached. And at this moment, the subclass should be updated but it seems to be unsafe. So this patch makes bonding use dynamic lockdep key instead of the subclass. Test commands: ip link add bond0 type bond for i in {1..5} do let A=$i-1 ip link add bond$i type bond ip link set bond$i master bond$A done ip link set bond5 master bond0 Splat looks like: [ 307.992912] WARNING: possible recursive locking detected [ 307.993656] 5.4.0-rc3+ #96 Tainted: G W [ 307.994367] -------------------------------------------- [ 307.995092] ip/761 is trying to acquire lock: [ 307.995710] ffff8880513aac60 (&(&bond->stats_lock)->rlock#2/2){+.+.}, at: bond_get_stats+0xb8/0x500 [bonding] [ 307.997045] but task is already holding lock: [ 307.997923] ffff88805fcbac60 (&(&bond->stats_lock)->rlock#2/2){+.+.}, at: bond_get_stats+0xb8/0x500 [bonding] [ 307.999215] other info that might help us debug this: [ 308.000251] Possible unsafe locking scenario: [ 308.001137] CPU0 [ 308.001533] ---- [ 308.001915] lock(&(&bond->stats_lock)->rlock#2/2); [ 308.002609] lock(&(&bond->stats_lock)->rlock#2/2); [ 308.003302] *** DEADLOCK *** [ 308.004310] May be due to missing lock nesting notation [ 308.005319] 3 locks held by ip/761: [ 308.005830] #0: ffffffff9fcc42b0 (rtnl_mutex){+.+.}, at: rtnetlink_rcv_msg+0x466/0x8a0 [ 308.006894] #1: ffff88805fcbac60 (&(&bond->stats_lock)->rlock#2/2){+.+.}, at: bond_get_stats+0xb8/0x500 [bonding] [ 308.008243] #2: ffffffff9f9219c0 (rcu_read_lock){....}, at: bond_get_stats+0x9f/0x500 [bonding] [ 308.009422] stack backtrace: [ 308.010124] CPU: 0 PID: 761 Comm: ip Tainted: G W 5.4.0-rc3+ #96 [ 308.011097] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 308.012179] Call Trace: [ 308.012601] dump_stack+0x7c/0xbb [ 308.013089] __lock_acquire+0x269d/0x3de0 [ 308.013669] ? register_lock_class+0x14d0/0x14d0 [ 308.014318] lock_acquire+0x164/0x3b0 [ 308.014858] ? bond_get_stats+0xb8/0x500 [bonding] [ 308.015520] _raw_spin_lock_nested+0x2e/0x60 [ 308.016129] ? bond_get_stats+0xb8/0x500 [bonding] [ 308.017215] bond_get_stats+0xb8/0x500 [bonding] [ 308.018454] ? bond_arp_rcv+0xf10/0xf10 [bonding] [ 308.019710] ? rcu_read_lock_held+0x90/0xa0 [ 308.020605] ? rcu_read_lock_sched_held+0xc0/0xc0 [ 308.021286] ? bond_get_stats+0x9f/0x500 [bonding] [ 308.021953] dev_get_stats+0x1ec/0x270 [ 308.022508] bond_get_stats+0x1d1/0x500 [bonding] Fixes: d3fff6c443 ("net: add netdev_lockdep_set_classes() helper") Signed-off-by: Taehee Yoo <ap420073@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2019-10-24 14:53:48 -07:00
Eric Dumazet	c24b75e0f9	ipvs: move old_secure_tcp into struct netns_ipvs ... syzbot reported the following issue : BUG: KCSAN: data-race in update_defense_level / update_defense_level read to 0xffffffff861a6260 of 4 bytes by task 3006 on cpu 1: update_defense_level+0x621/0xb30 net/netfilter/ipvs/ip_vs_ctl.c:177 defense_work_handler+0x3d/0xd0 net/netfilter/ipvs/ip_vs_ctl.c:225 process_one_work+0x3d4/0x890 kernel/workqueue.c:2269 worker_thread+0xa0/0x800 kernel/workqueue.c:2415 kthread+0x1d4/0x200 drivers/block/aoe/aoecmd.c:1253 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352 write to 0xffffffff861a6260 of 4 bytes by task 7333 on cpu 0: update_defense_level+0xa62/0xb30 net/netfilter/ipvs/ip_vs_ctl.c:205 defense_work_handler+0x3d/0xd0 net/netfilter/ipvs/ip_vs_ctl.c:225 process_one_work+0x3d4/0x890 kernel/workqueue.c:2269 worker_thread+0xa0/0x800 kernel/workqueue.c:2415 kthread+0x1d4/0x200 drivers/block/aoe/aoecmd.c:1253 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352 Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 7333 Comm: kworker/0:5 Not tainted 5.4.0-rc3+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events defense_work_handler Indeed, old_secure_tcp is currently a static variable, while it needs to be a per netns variable. Fixes: a0840e2e16 ("IPVS: netns, ip_vs_ctl local vars moved to ipvs struct.") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: Simon Horman <horms@verge.net.au>	2019-10-24 11:56:02 +02:00
Eric Dumazet	55667441c8	net/flow_dissector: switch to siphash ... UDP IPv6 packets auto flowlabels are using a 32bit secret (static u32 hashrnd in net/core/flow_dissector.c) and apply jhash() over fields known by the receivers. Attackers can easily infer the 32bit secret and use this information to identify a device and/or user, since this 32bit secret is only set at boot time. Really, using jhash() to generate cookies sent on the wire is a serious security concern. Trying to change the rol32(hash, 16) in ip6_make_flowlabel() would be a dead end. Trying to periodically change the secret (like in sch_sfq.c) could change paths taken in the network for long lived flows. Let's switch to siphash, as we did in commit df453700e8 ("inet: switch IP ID generator to siphash") Using a cryptographically strong pseudo random function will solve this privacy issue and more generally remove other weak points in the stack. Packet schedulers using skb_get_hash_perturb() benefit from this change. Fixes: b56774163f ("ipv6: Enable auto flow labels by default") Fixes: 42240901f7 ("ipv6: Implement different admin modes for automatic flow labels") Fixes: 67800f9b1f ("ipv6: Call skb_get_hash_flowi6 to get skb->hash in ip6_make_flowlabel") Fixes: cb1ce2ef38 ("ipv6: Implement automatic flow label generation on transmit") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: Jonathan Berger <jonathann1@walla.com> Reported-by: Amit Klein <aksecurity@gmail.com> Reported-by: Benny Pinkas <benny@pinkas.net> Cc: Tom Herbert <tom@herbertland.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2019-10-23 20:13:22 -07:00
Eric Dumazet	e7a409c3f4	ipv4: fix IPSKB_FRAG_PMTU handling with fragmentation ... This patch removes the iph field from the state structure, which is not properly initialized. Instead, add a new field to make the "do we want to set DF" be the state bit and move the code to set the DF flag from ip_frag_next(). Joint work with Pablo and Linus. Fixes: 19c3401a91 ("net: ipv4: place control buffer handling away from fragmentation iterators") Reported-by: Patrick Schönthaler <patrick@notvads.ovh> Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: David S. Miller <davem@davemloft.net>	2019-10-21 10:46:42 -07:00
Eric Dumazet	2a06b8982f	net: reorder 'struct net' fields to avoid false sharing ... Intel test robot reported a ~7% regression on TCP_CRR tests that they bisected to the cited commit. Indeed, every time a new TCP socket is created or deleted, the atomic counter net->count is touched (via get_net(net) and put_net(net) calls) So cpus might have to reload a contended cache line in net_hash_mix(net) calls. We need to reorder 'struct net' fields to move @hash_mix in a read mostly cache line. We move in the first cache line fields that can be dirtied often. We probably will have to address in a followup patch the __randomize_layout that was added in linux-4.13, since this might break our placement choices. Fixes: 355b985537 ("netns: provide pure entropy for net_hash_mix()") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: kernel test robot <oliver.sang@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2019-10-19 12:21:53 -07:00
Eric Dumazet	ab4e846a82	tcp: annotate sk->sk_wmem_queued lockless reads ... For the sake of tcp_poll(), there are few places where we fetch sk->sk_wmem_queued while this field can change from IRQ or other cpu. We need to add READ_ONCE() annotations, and also make sure write sides use corresponding WRITE_ONCE() to avoid store-tearing. sk_wmem_queued_add() helper is added so that we can in the future convert to ADD_ONCE() or equivalent if/when available. Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2019-10-13 10:13:08 -07:00