android_kernel_asus_sm8350/net/ipv4/udp_offload.c
Greg Kroah-Hartman 5b84549191 Merge tag 'android11-5.4.147_r00' android11-5.4
This is the merge of the upstream LTS release of 5.4.147 into the
android11-5.4 branch.

It contains the following commits:

5e10f36746 Merge 5.4.147 into android11-5.4-lts
48a24510c3 Linux 5.4.147
1f8ee02449 Revert "time: Handle negative seconds correctly in timespec64_to_ns()"
dc15f641c6 Revert "posix-cpu-timers: Force next expiration recalc after itimer reset"
541e757944 Revert "block: nbd: add sanity check for first_minor"
5f3ecbf4d5 Revert "Bluetooth: Move shutdown callback before flushing tx and rx queue"
d756462d85 Merge 5.4.146 into android11-5.4-lts
245f15a48c Linux 5.4.146
b40facee46 clk: kirkwood: Fix a clocking boot regression
8810c51077 backlight: pwm_bl: Improve bootloader/kernel device handover
5de2ee621b fbmem: don't allow too huge resolutions
4a95b04afa IMA: remove the dependency on CRYPTO_MD5
c69935f0b0 IMA: remove -Wmissing-prototypes warning
85b0726d5b fuse: flush extending writes
8a98ced6e1 fuse: truncate pagecache on atomic_o_trunc
06dad664d4 KVM: nVMX: Unconditionally clear nested.pi_pending on nested VM-Enter
1735cec1e8 KVM: x86: Update vCPU's hv_clock before back to guest when tsc_offset is adjusted
20fff3ef33 KVM: s390: index kvm->arch.idle_mask by vcpu_idx
0323ab5b25 x86/resctrl: Fix a maybe-uninitialized build warning treated as error
51f4575ca1 perf/x86/amd/ibs: Extend PERF_PMU_CAP_NO_EXCLUDE to IBS Op
03c3e977ee tty: Fix data race between tiocsti() and flush_to_ldisc()
7a25a0a94c time: Handle negative seconds correctly in timespec64_to_ns()
ae968e270f bpf: Fix pointer arithmetic mask tightening under state pruning
a0a4778fea bpf: verifier: Allocate idmap scratch in verifier env
f5893af270 bpf: Fix leakage due to insufficient speculative store bypass mitigation
e80c3533c3 bpf: Introduce BPF nospec instruction for mitigating Spectre v4
1c9424a765 ipv4: fix endianness issue in inet_rtm_getroute_build_skb()
b3fe6d1921 octeontx2-af: Fix loop in free and unmap counter
8216d7157b net: qualcomm: fix QCA7000 checksum handling
4648917e49 net: sched: Fix qdisc_rate_table refcount leak when get tcf_block failed
e46e23c289 ipv4: make exception cache less predictible
f73cbdd1b8 ipv6: make exception cache less predictible
aa167dcde4 brcmfmac: pcie: fix oops on failure to resume and reprobe
5debec63a2 bcma: Fix memory leak for internally-handled cores
574e563649 ath6kl: wmi: fix an error code in ath6kl_wmi_sync_point()
d946e685d6 ASoC: wcd9335: Disable irq on slave ports in the remove function
f3ec07f832 ASoC: wcd9335: Fix a memory leak in the error handling path of the probe function
a6088f4ed3 ASoC: wcd9335: Fix a double irq free in the remove function
7bfa680f3b tty: serial: fsl_lpuart: fix the wrong mapbase value
0f1375fa69 usb: bdc: Fix an error handling path in 'bdc_probe()' when no suitable DMA config is available
06203abb72 usb: ehci-orion: Handle errors of clk_prepare_enable() in probe
a0a9ecca2d i2c: mt65xx: fix IRQ check
b444064a0e CIFS: Fix a potencially linear read overflow
e37eeaf950 bpf: Fix possible out of bound write in narrow load handling
fb8e695e9c mmc: moxart: Fix issue with uninitialized dma_slave_config
48b1f117e8 mmc: dw_mmc: Fix issue with uninitialized dma_slave_config
57314d8414 ASoC: Intel: Skylake: Fix module resource and format selection
92397571c2 ASoC: Intel: Skylake: Leave data as is when invoking TLV IPCs
b58cf18e38 rsi: fix an error code in rsi_probe()
d82fe3dd0b rsi: fix error code in rsi_load_9116_firmware()
4be8deab6f i2c: s3c2410: fix IRQ check
da3e5f3204 i2c: iop3xx: fix deferred probing
2da3272ae0 Bluetooth: add timeout sanity check to hci_inquiry
70d71611eb mm/swap: consider max pages in iomap_swapfile_add_extent
8f5e26053c usb: gadget: mv_u3d: request_irq() after initializing UDC
eb3c6a2501 nfsd4: Fix forced-expiry locking
81e69d3fdd lockd: Fix invalid lockowner cast after vfs_test_lock
e1c02e2e6a mac80211: Fix insufficient headroom issue for AMSDU
606668e24a usb: phy: tahvo: add IRQ check
ecf18ac8ff usb: host: ohci-tmio: add IRQ check
abbcd61d09 Bluetooth: Move shutdown callback before flushing tx and rx queue
93ec1fd04f usb: gadget: udc: renesas_usb3: Fix soc_device_match() abuse
30d9607bcd usb: phy: twl6030: add IRQ checks
e1473ac285 usb: phy: fsl-usb: add IRQ check
9535f55d0c usb: gadget: udc: at91: add IRQ check
05e5b16b79 drm/msm/dsi: Fix some reference counted resource leaks
5ccb04c6e1 Bluetooth: fix repeated calls to sco_sock_kill
c2451d5439 counter: 104-quad-8: Return error when invalid mode during ceiling_write
a1194b805c arm64: dts: exynos: correct GIC CPU interfaces address range on Exynos7
1b6fcd1037 drm/msm/dpu: make dpu_hw_ctl_clear_all_blendstages clear necessary LMs
156eaacba3 PM: EM: Increase energy calculation precision
5537dc810b Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow
c0faa638f0 debugfs: Return error during {full/open}_proxy_open() on rmmod
f44714b4eb soc: qcom: smsm: Fix missed interrupts if state changes while masked
e7997fe3e9 PCI: PM: Enable PME if it can be signaled from D3cold
9e570f3d47 PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently
f865b316cc media: venus: venc: Fix potential null pointer dereference on pointer fmt
d2ea2f0725 media: em28xx-input: fix refcount bug in em28xx_usb_disconnect
ebf570042b leds: trigger: audio: Add an activate callback to ensure the initial brightness is set
0a01dc7766 leds: lt3593: Put fwnode in any case during ->probe()
e39c73563a i2c: highlander: add IRQ check
fba783ddd9 net: cipso: fix warnings in netlbl_cipsov4_add_std
9fdac650c4 cgroup/cpuset: Fix a partition bug with hotplug
ffde058199 net/mlx5e: Prohibit inner indir TIRs in IPoIB
87f817c560 ARM: dts: meson8b: ec100: Fix the pwm regulator supply properties
e55d7cbe1f ARM: dts: meson8b: mxq: Fix the pwm regulator supply properties
4b0bbc412b ARM: dts: meson8b: odroidc1: Fix the pwm regulator supply properties
f7058060c0 ARM: dts: meson8: Use a higher default GPU clock frequency
37ed461b52 tcp: seq_file: Avoid skipping sk during tcp_seek_last_pos
9521362753 drm/amdgpu/acp: Make PM domain really work
252fad3d02 netns: protect netns ID lookups with RCU
bd1cd32caa 6lowpan: iphc: Fix an off-by-one check of array index
c4895cf45f Bluetooth: sco: prevent information leak in sco_conn_defer_accept()
a96eb96ce4 media: coda: fix frame_mem_ctrl for YUV420 and YVU420 formats
7163014d7d media: go7007: remove redundant initialization
8101492879 media: dvb-usb: Fix error handling in dvb_usb_i2c_init
fa8aaa7690 media: dvb-usb: fix uninit-value in vp702x_read_mac_addr
88933f9c93 media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init
f81c89614e soc: qcom: rpmhpd: Use corner in power_off
5b3987f583 arm64: dts: renesas: r8a77995: draak: Remove bogus adv7511w properties
6c106c7320 ARM: dts: aspeed-g6: Fix HVI3C function-group in pinctrl dtsi
004778bf39 bpf: Fix potential memleak and UAF in the verifier.
fa4802c54e bpf: Fix a typo of reuseport map in bpf.h.
9a193caf9d media: cxd2880-spi: Fix an error handling path
34106f5260 soc: rockchip: ROCKCHIP_GRF should not default to y, unconditionally
b928930530 media: TDA1997x: enable EDID support
43282ca83a drm/panfrost: Fix missing clk_disable_unprepare() on error in panfrost_clk_init()
fc9cf22290 EDAC/i10nm: Fix NVDIMM detection
32d8a3684b spi: spi-zynq-qspi: use wait_for_completion_timeout to make zynq_qspi_exec_mem_op not interruptible
4206dbc985 spi: sprd: Fix the wrong WDG_LOAD_VAL
1f70517eac regulator: vctrl: Avoid lockdep warning in enable/disable ops
d255d6a645 regulator: vctrl: Use locked regulator_get_voltage in probe path
013177ccc4 certs: Trigger creation of RSA module signing key if it's not an RSA key
cc74533a47 crypto: qat - use proper type for vf_mask
b3fa499d72 block: nbd: add sanity check for first_minor
c60a31db39 clocksource/drivers/sh_cmt: Fix wrong setting if don't request IRQ for clock source channel
6b10d3d3a9 lib/mpi: use kcalloc in mpi_resize
57c8e2ea47 genirq/timings: Fix error return code in irq_timings_test_irqs()
2d00b22c8b spi: spi-pic32: Fix issue with uninitialized dma_slave_config
b29593d069 spi: spi-fsl-dspi: Fix issue with uninitialized dma_slave_config
449884aeb3 sched: Fix UCLAMP_FLAG_IDLE setting
67da2d9c9e m68k: emu: Fix invalid free in nfeth_cleanup()
c68ba4a708 s390/debug: fix debug area life cycle
7a67a00ea8 s390/kasan: fix large PMD pages address alignment check
98296eb3de udf_get_extendedattr() had no boundary checks.
ae4240d1f4 fcntl: fix potential deadlock for &fasync_struct.fa_lock
a6273c8c2a crypto: qat - do not export adf_iov_putmsg()
7dfa7bb69e crypto: qat - fix naming for init/shutdown VF to PF notifications
843b4e713a crypto: qat - fix reuse of completion variable
4a98826455 crypto: qat - handle both source of interrupt in VF ISR
c2b3f81125 crypto: qat - do not ignore errors from enable_vf2pf_comms()
1c189ccef0 libata: fix ata_host_start()
e55b627d6e s390/cio: add dev_busid sysfs entry for each subchannel
0423517520 power: supply: max17042_battery: fix typo in MAx17042_TOFF
eb45ae88bf nvmet: pass back cntlid on successful completion
6cb5d6ae68 nvme-rdma: don't update queue count when failing to set io queues
3073ec7f06 nvme-tcp: don't update queue count when failing to set io queues
93cf19b4d9 bcache: add proper error unwinding in bcache_device_init
e55f20798f isofs: joliet: Fix iocharset=utf8 mount option
0f5cd92e5e udf: Fix iocharset=utf8 mount option
86987cf0fb udf: Check LVID earlier
cc608af36e hrtimer: Ensure timerfd notification for HIGHRES=n
a845787830 hrtimer: Avoid double reprogramming in __hrtimer_start_range_ns()
c322a963d5 posix-cpu-timers: Force next expiration recalc after itimer reset
28996dbb8a rcu/tree: Handle VM stoppage in stall detection
b7c560ae51 sched/deadline: Fix missing clock update in migrate_task_rq_dl()
40db13e3ef crypto: omap-sham - clear dma flags only after omap_sham_update_dma_stop()
ebf0f71ae3 power: supply: axp288_fuel_gauge: Report register-address on readb / writeb errors
bba2b82d1b sched/deadline: Fix reset_on_fork reporting of DL tasks
53a6ef40c6 crypto: mxs-dcp - Check for DMA mapping errors
344a38789a regmap: fix the offset of register error log
a5e42516a6 locking/mutex: Fix HANDOFF condition
f019fa5605 Merge branch 'android11-5.4' into 'android11-5.4-lts'
80833b7bc2 ANDROID: GKI: db845c: Update symbols list and ABI for lts v5.4.144
9ccfa71ab0 Merge 5.4.145 into android11-5.4-lts
a0f68fb55e Linux 5.4.145
d83f0b39e7 PCI: Call Max Payload Size-related fixup quirks early
0c8277e334 x86/reboot: Limit Dell Optiplex 990 quirk to early BIOS versions
d31a4c35b9 xhci: fix unsafe memory usage in xhci tracing
e00d39ca92 usb: mtu3: fix the wrong HS mult value
c3ffd35014 usb: mtu3: use @mult for HS isoc or intr
00b6325590 usb: host: xhci-rcar: Don't reload firmware after the completion
7a74ae301c ALSA: usb-audio: Add registration quirk for JBL Quantum 800
c1ea74f642 Revert "btrfs: compression: don't try to compress if we don't have enough pages"
f05c74e104 x86/events/amd/iommu: Fix invalid Perf result due to IOMMU PMC power-gating
b1ca1665e6 Revert "r8169: avoid link-up interrupt issue on RTL8106e if user enables ASPM"
cf1222b877 mm/page_alloc: speed up the iteration of max_order
17d409c83e net: ll_temac: Remove left-over debug message
ccadb91437 powerpc/boot: Delete unneeded .globl _zimage_start
295501c77c ipv4/icmp: l3mdev: Perform icmp error route lookup on source device routing table (v2)
6dec8e17b8 USB: serial: mos7720: improve OOM-handling in read_mos_reg()
d84708451d igmp: Add ip_mc_list lock in ip_check_mc_rcu
cd8ad6ed9a media: stkwebcam: fix memory leak in stk_camera_probe
9febc9153f ARC: wireup clone3 syscall
417b11d325 ALSA: pcm: fix divide error in snd_pcm_lib_ioctl
cf28619cd9 ALSA: hda/realtek: Workaround for conflicting SSID on ASUS ROG Strix G17
a8146f1490 ARM: 8918/2: only build return_address() if needed
ebad44b643 cryptoloop: add a deprecation warning
d12526ddf5 perf/x86/amd/power: Assign pmu.module
be1f76fcee perf/x86/amd/ibs: Work around erratum #1197
861118d64e perf/x86/intel/pt: Fix mask of num_address_ranges
40d23de514 qede: Fix memset corruption
468623f696 net: macb: Add a NULL check on desc_ptp
50f73f31ae qed: Fix the VF msix vectors flow
92abb09f7a reset: reset-zynqmp: Fixed the argument data type
b820c4c651 gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for (semi)planar U/V formats
48051387fa xtensa: fix kconfig unmet dependency warning for HAVE_FUTEX_CMPXCHG
56c77c1b52 kthread: Fix PF_KTHREAD vs to_kthread() race
af3cf928b9 ubifs: report correct st_size for encrypted symlinks
aa4e216156 f2fs: report correct st_size for encrypted symlinks
52d8e5b0ab ext4: report correct st_size for encrypted symlinks
228a4203d8 fscrypt: add fscrypt_symlink_getattr() for computing st_size
9b3849ba66 ext4: fix race writing to an inline_data file while its xattrs are changing
8ac6727e49 Revert "once: Fix panic when module unload"
2e0ca55ea4 Merge 5.4.144 into android11-5.4-lts
c6bf0ed9d1 Linux 5.4.144
0634c0f919 audit: move put_tree() to avoid trim_trees refcount underflow and UAF
cab0003311 net: don't unconditionally copy_from_user a struct ifreq for socket ioctls
6752b3b062 Revert "parisc: Add assembly implementations for memset, strlen, strcpy, strncpy and strcat"
67871ada3a Revert "floppy: reintroduce O_NDELAY fix"
d7f7eca72e btrfs: fix NULL pointer dereference when deleting device by invalid id
e644da7ace arm64: dts: qcom: msm8994-angler: Fix gpio-reserved-ranges 85-88
4f76285f6d KVM: x86/mmu: Treat NX as used (not reserved) for all !TDP shadow MMUs
620681d720 net: dsa: mt7530: fix VLAN traffic leaks again
38adbf21f3 bpf: Fix cast to pointer from integer of different size warning
812ee47ad7 bpf: Track contents of read-only maps as scalars
f441801520 vt_kdsetmode: extend console locking
8a19e00450 btrfs: fix race between marking inode needs to be logged and log syncing
f3a1ac258e net/rds: dma_map_sg is entitled to merge entries
ad6a2bc758 drm/nouveau/disp: power down unused DP links during init
689179c462 drm: Copy drm_wait_vblank to user before returning
18ceb99f84 qed: Fix null-pointer dereference in qed_rdma_create_qp()
f1a0db49ab qed: qed ll2 race condition fixes
73ba9e4ece vringh: Use wiov->used to check for read/write desc order
ee52acae6f virtio_pci: Support surprise removal of virtio pci device
be9b79e841 virtio: Improve vq->broken access to avoid any compiler optimization
0d4ba693db opp: remove WARN when no valid OPPs remain
baf56a1d81 perf/x86/intel/uncore: Fix integer overflow on 23 bit left shift of a u32
0ad96094ab usb: gadget: u_audio: fix race condition on endpoint stop
c5c2b4ca50 drm/i915: Fix syncmap memory leak
2f3cefa6ab net: hns3: fix get wrong pfc_en when query PFC configuration
6f0c0b35e2 net: hns3: fix duplicate node in VLAN list
951805c23d net: hns3: clear hardware resource when loading driver
08162f6564 rtnetlink: Return correct error on changing device netns
f58e42d192 net: marvell: fix MVNETA_TX_IN_PRGRS bit number
45454400a6 xgene-v2: Fix a resource leak in the error handling path of 'xge_probe()'
53b480e68c ip_gre: add validation for csum_start
bb8ca7e2e6 RDMA/efa: Free IRQ vectors on error flow
e29565b451 e1000e: Fix the max snoop/no-snoop latency for 10M
8a21e84334 IB/hfi1: Fix possible null-pointer dereference in _extend_sdma_tx_descs()
944a50f56f RDMA/bnxt_re: Add missing spin lock initialization
28b1895410 scsi: core: Fix hang of freezing queue between blocking and running device
628c582854 usb: dwc3: gadget: Stop EP0 transfers during pullup disable
d9da281c8f usb: dwc3: gadget: Fix dwc3_calc_trbs_left()
21880abf19 USB: serial: option: add new VID/PID to support Fibocom FG150
2e098e91ee Revert "USB: serial: ch341: fix character loss at high transfer rates"
16b281a70a can: usb: esd_usb2: esd_usb2_rx_event(): fix the interchange of the CAN RX and TX error counters
765437d1f0 mm, oom: make the calculation of oom badness more accurate
1cccf5c030 mmc: sdhci-msm: Update the software timeout value for sdhc
aec1e470d9 ovl: fix uninitialized pointer read in ovl_lookup_real_one()
57bd5b59f1 once: Fix panic when module unload
5892f910f4 netfilter: conntrack: collect all entries in one cycle
7c95c89b69 ARC: Fix CONFIG_STACKDEPOT
a6b049aeef net: qrtr: fix another OOB Read in qrtr_endpoint_post
feaf47115a Merge branch 'android11-5.4' into 'android11-5.4-lts'
4a23ba6f12 Merge branch 'android11-5.4' into 'android11-5.4-lts'
406300927b Revert "virtio: Protect vqs list access"
874997f95f Merge 5.4.143 into android11-5.4-lts
2d724dbd16 Revert "net: igmp: fix data-race in igmp_ifc_timer_expire()"
50637be299 Revert "net: igmp: increase size of mr_ifc_count"
f5f155f4d6 Revert "PCI/MSI: Protect msi_desc::masked for multi-MSI"
5395faca89 Merge 5.4.142 into android11-5.4-lts
48266f7c1b Merge branch 'android11-5.4' into 'android11-5.4-lts'
fd80923202 Linux 5.4.143
4bf1941581 netfilter: nft_exthdr: fix endianness of tcp option cast
e4fd994f02 fs: warn about impending deprecation of mandatory locks
41c7f46c89 mm: memcontrol: fix occasional OOMs due to proportional memory.low reclaim
1a3aa81444 mm, memcg: avoid stale protection values when cgroup is above protection
9c1c449dcc ASoC: intel: atom: Fix breakage for PCM buffer address setup
846ba58a7c PCI: Increase D3 delay for AMD Renoir/Cezanne XHCI
548b75f490 btrfs: prevent rename2 from exchanging a subvol with a directory from different parents
0fc6a9c202 ipack: tpci200: fix memory leak in the tpci200_register
280d66b317 ipack: tpci200: fix many double free issues in tpci200_pci_probe
cb7aa51031 slimbus: ngd: reset dma setup during runtime pm
abce32d0f7 slimbus: messaging: check for valid transaction id
0786d315f5 slimbus: messaging: start transaction ids from 1 instead of zero
20c2f141b1 tracing / histogram: Fix NULL pointer dereference on strcmp() on NULL event name
8fbfebe188 ALSA: hda - fix the 'Capture Switch' value change notifications
85e60614d1 mmc: dw_mmc: Fix hang on data CRC error
4f6c9caf7b ovl: add splice file read write helper
85813f1f9e iavf: Fix ping is lost after untrusted VF had tried to change MAC
a498115dcd i40e: Fix ATR queue selection
1b8a8fba78 ovs: clear skb->tstamp in forwarding path
84dbbf5482 net: mdio-mux: Handle -EPROBE_DEFER correctly
453486e79e net: mdio-mux: Don't ignore memory allocation errors
6b70c67849 net: qlcnic: add missed unlock in qlcnic_83xx_flash_read32
da92ce3645 virtio-net: use NETIF_F_GRO_HW instead of NETIF_F_LRO
9aeadce8e3 virtio-net: support XDP when not more queues
3ed7cf8386 vrf: Reset skb conntrack connection on VRF rcv
447b160289 bnxt_en: Add missing DMA memory barriers
c9566df334 ptp_pch: Restore dependency on PCI
a73b9aa142 net: 6pack: fix slab-out-of-bounds in decode_data
2bc7571343 bnxt: disable napi before canceling DIM
a9fb0f1559 bnxt: don't lock the tx queue from napi poll
1fe038030c bpf: Clear zext_dst of dead insns
73a45f75a0 vhost: Fix the calculation in vhost_overflow()
b9a59636c4 virtio: Protect vqs list access
b264e37b35 dccp: add do-while-0 stubs for dccp_pr_debug macros
9112ebc299 cpufreq: armada-37xx: forbid cpufreq for 1.2 GHz variant
cb9a9d5fe6 iommu: Check if group is NULL before remove device
911a8141ef Bluetooth: hidp: use correct wait queue when removing ctrl_wait
5b14c1f16e drm/amd/display: Fix Dynamic bpp issue with 8K30 with Navi 1X
f92dc3a89d net: usb: lan78xx: don't modify phy_device state concurrently
be70436799 ARM: dts: nomadik: Fix up interrupt controller node names
69aa1a1a56 scsi: core: Fix capacity set to zero after offlinining device
935de7ec7a scsi: core: Avoid printing an error if target_alloc() returns -ENXIO
7a721a1e18 scsi: scsi_dh_rdac: Avoid crash during rdac_bus_attach()
9900e06ae6 scsi: megaraid_mm: Fix end of loop tests for list_for_each_entry()
e37cf26bd5 dmaengine: of-dma: router_xlate to return -EPROBE_DEFER if controller is not yet available
12d1322d93 ARM: dts: am43x-epos-evm: Reduce i2c0 bus speed for tps65218
11145efd29 dmaengine: usb-dmac: Fix PM reference leak in usb_dmac_probe()
9c97a05392 dmaengine: xilinx_dma: Fix read-after-free bug when terminating transfers
fc566b5a21 USB: core: Avoid WARNings for 0-length descriptor requests
1bd505c814 media: drivers/media/usb: fix memory leak in zr364xx_probe
705660a6d9 media: zr364xx: fix memory leaks in probe()
79dff2a3f4 media: zr364xx: propagate errors from zr364xx_start_readpipe()
7305d6d407 mtd: cfi_cmdset_0002: fix crash when erasing/writing AMD cards
23f77ad13f ath9k: Postpone key cache entry deletion for TXQ frames reference it
c6feaf806d ath: Modify ath_key_delete() to not need full key entry
b7d593705e ath: Export ath_hw_keysetmac()
add283e251 ath9k: Clear key cache explicitly on disabling hardware
0c049ce432 ath: Use safer key clearing with key cache entries
172b91bbbb x86/fpu: Make init_fpstate correct with optimized XSAVE
81d152c8da ext4: fix EXT4_MAX_LOGICAL_BLOCK macro
62d24bac60 Merge branch 'android11-5.4' into 'android11-5.4-lts'
c15b830f7c Linux 5.4.142
a17f2f2c89 KVM: nSVM: always intercept VMLOAD/VMSAVE when nested (CVE-2021-3656)
7c1c96ffb6 KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl (CVE-2021-3653)
456fd88922 iommu/vt-d: Fix agaw for a supported 48 bit guest address width
5b5f855a79 vmlinux.lds.h: Handle clang's module.{c,d}tor sections
e9b2b2b29c ceph: take snap_empty_lock atomically with snaprealm refcount change
95ff775df6 ceph: clean up locking annotation for ceph_get_snap_realm and __lookup_snap_realm
1d8c232afb ceph: add some lockdep assertions around snaprealm handling
a6ff0f3f9f KVM: VMX: Use current VMCS to query WAITPKG support for MSR emulation
ec25d05e18 PCI/MSI: Protect msi_desc::masked for multi-MSI
48d2439c6f PCI/MSI: Use msi_mask_irq() in pci_msi_shutdown()
386ead1d35 PCI/MSI: Correct misleading comments
76d81dec16 PCI/MSI: Do not set invalid bits in MSI mask
6b4bcbf133 PCI/MSI: Enforce MSI[X] entry updates to be visible
4495a41fbc PCI/MSI: Enforce that MSI-X table entry is masked for update
1866c8f6d4 PCI/MSI: Mask all unused MSI-X entries
3b4220c2bf PCI/MSI: Enable and mask MSI-X early
0c8dea3fd5 genirq/timings: Prevent potential array overflow in __irq_timings_store()
4dfe809271 genirq/msi: Ensure deactivation on teardown
e3e54a9300 x86/resctrl: Fix default monitoring groups reporting
a6b594ad74 x86/ioapic: Force affinity setup before startup
db5e266694 x86/msi: Force affinity setup before startup
eda32c2188 genirq: Provide IRQCHIP_AFFINITY_PRE_STARTUP
06b3477436 x86/tools: Fix objdump version check again
74451dd8bf powerpc/kprobes: Fix kprobe Oops happens in booke
b74145d858 nbd: Aovid double completion of a request
ad9550114d vsock/virtio: avoid potential deadlock when vsock device remove
b9cd73cce5 xen/events: Fix race in set_evtchn_to_irq
4d3c5c319b net: igmp: increase size of mr_ifc_count
721ff564cc tcp_bbr: fix u32 wrap bug in round logic if bbr_init() called after 2B packets
2ce8a68a31 net: linkwatch: fix failure to restore device state across suspend/resume
33597972a2 net: bridge: fix memleak in br_add_if()
f6eee53beb net: dsa: sja1105: fix broken backpressure in .port_fdb_dump
1e6a570d37 net: dsa: lantiq: fix broken backpressure in .port_fdb_dump
564f6bbd0e net: dsa: lan9303: fix broken backpressure in .port_fdb_dump
a9243455e8 net: igmp: fix data-race in igmp_ifc_timer_expire()
ed957c77b3 net: Fix memory leak in ieee802154_raw_deliver
13a381b8bc net: dsa: microchip: Fix ksz_read64()
991117eeee drm/meson: fix colour distortion from HDR set during vendor u-boot
e114f15de8 net/mlx5: Fix return value from tracer initialization
f99aa76bb8 psample: Add a fwd declaration for skbuff
9dc8e396c1 iavf: Set RSS LUT and key in reset handle path
23436edae3 net: sched: act_mirred: Reset ct info when mirror/redirect skb
9636fbfe7b ppp: Fix generating ifname when empty IFLA_IFNAME is specified
1c31ee907f net: phy: micrel: Fix link detection on ksz87xx switch"
dfeb64f6e2 platform/x86: pcengines-apuv2: Add missing terminating entries to gpio-lookup tables
699db2bb96 platform/x86: pcengines-apuv2: revert wiring up simswitch GPIO as LED
af7f1539cf net: dsa: mt7530: add the missing RxUnicast MIB counter
d353a61860 ASoC: cs42l42: Fix LRCLK frame start edge
b036452082 netfilter: nf_conntrack_bridge: Fix memory leak when error
cd36a36ea4 ASoC: cs42l42: Remove duplicate control for WNF filter frequency
eb789cc917 ASoC: cs42l42: Fix inversion of ADC Notch Switch control
6a33813363 ASoC: cs42l42: Don't allow SND_SOC_DAIFMT_LEFT_J
55e86f07b8 ASoC: cs42l42: Correct definition of ADC Volume control
22d2e3c6a1 ieee802154: hwsim: fix GPF in hwsim_new_edge_nl
5bac8c2a30 ieee802154: hwsim: fix GPF in hwsim_set_edge_lqi
ddcf807fbb libnvdimm/region: Fix label activation vs errors
bc97fde4c6 ACPI: NFIT: Fix support for virtual SPA ranges
a753e3f334 ceph: reduce contention in ceph_check_delayed_caps()
aa04486c41 i2c: dev: zero out array used for i2c reads from userspace
c18b28e5ad ASoC: intel: atom: Fix reference to PCM buffer address
aab3fa5446 ASoC: xilinx: Fix reference to PCM buffer address
60e2854acf iio: adc: Fix incorrect exit of for-loop
bcac522592 iio: humidity: hdc100x: Add margin to the conversion time
da7cb80905 iio: adc: ti-ads7950: Ensure CS is deasserted after reading channels
7116e6b9d8 Merge 5.4.141 into android11-5.4-lts
b704883aa8 Linux 5.4.141
983d6a6b7e btrfs: don't flush from btrfs_delayed_inode_reserve_metadata
ea13f678a3 btrfs: export and rename qgroup_reserve_meta
41a9b8f36d btrfs: qgroup: don't commit transaction when we already hold the handle
38b8485b72 net: xilinx_emaclite: Do not print real IOMEM pointer
654c19a7e8 btrfs: fix lockdep splat when enabling and disabling qgroups
c55442cdfd btrfs: qgroup: remove ASYNC_COMMIT mechanism in favor of reserve retry-after-EDQUOT
fdaf6a322f btrfs: transaction: Cleanup unused TRANS_STATE_BLOCKED
36af2de520 btrfs: qgroup: try to flush qgroup space when we get -EDQUOT
5c79287c2b btrfs: qgroup: allow to unreserve range without releasing other ranges
b7a722fd75 btrfs: make btrfs_qgroup_reserve_data take btrfs_inode
dfadea4061 btrfs: make qgroup_free_reserved_data take btrfs_inode
812f39ed5b ovl: prevent private clone if bind mount is not allowed
eeb4742501 ppp: Fix generating ppp unit id when ifname is not specified
3460f3959d ALSA: hda: Add quirk for ASUS Flow x13
81d1a3f976 USB:ehci:fix Kunpeng920 ehci hardware problem
d28adaabbb KVM: X86: MMU: Use the correct inherited permissions to get shadow page
5f4ab7e25f usb: dwc3: gadget: Avoid runtime resume if disabling pullup
1782c4af6b usb: dwc3: gadget: Disable gadget IRQ during pullup disable
54b7022f28 usb: dwc3: gadget: Clear DEP flags after stop transfers in ep disable
e36245a68e usb: dwc3: gadget: Prevent EP queuing while stopping transfers
823f692508 usb: dwc3: gadget: Restart DWC3 gadget when enabling pullup
25a0625fa9 usb: dwc3: gadget: Allow runtime suspend if UDC unbinded
5f081a928d usb: dwc3: Stop active transfers before halting the controller
396f29ea0c tracing: Reject string operand in the histogram expression
28276c280f media: v4l2-mem2mem: always consider OUTPUT queue during poll
236aca7092 tee: Correct inappropriate usage of TEE_SHM_DMA_BUF flag
5b774238e8 KVM: SVM: Fix off-by-one indexing when nullifying last used SEV VMCB
c33130b10f Merge 5.4.140 into android11-5.4-lts
ac1d54ea63 Merge branch 'android11-5.4' into 'android11-5.4-lts'
a998faa9c4 Linux 5.4.140
3c197fdd07 arm64: fix compat syscall return truncation
72fcaf6952 net/qla3xxx: fix schedule while atomic in ql_wait_for_drvr_lock and ql_adapter_reset
742e85fa9e alpha: Send stop IPI to send to online CPUs
26946d2139 virt_wifi: fix error on connect
17d7c9c940 reiserfs: check directory items on read from disk
bcad6ece2a reiserfs: add check for root_inode in reiserfs_fill_super
e30a88f1f5 libata: fix ata_pio_sector for CONFIG_HIGHMEM
a2671d96a3 bpf, selftests: Adjust few selftest result_unpriv outcomes
4892b4f324 perf/x86/amd: Don't touch the AMD64_EVENTSEL_HOSTONLY bit inside the guest
d6cf5342fa soc: ixp4xx/qmgr: fix invalid __iomem access
a5bf7ef13e spi: meson-spicc: fix memory leak in meson_spicc_remove
27991c78d6 soc: ixp4xx: fix printing resources
07fd256d53 arm64: vdso: Avoid ISB after reading from cntvct_el0
90e498ef3f KVM: x86/mmu: Fix per-cpu counter corruption on 32-bit builds
2e1a80b934 KVM: Do not leak memory for duplicate debugfs directories
43486cd739 KVM: x86: accept userspace interrupt only if no event is injected
1b7b9713a5 md/raid10: properly indicate failure when ending a failed write request
790cb68d35 pcmcia: i82092: fix a null pointer dereference bug
42ac2c6348 timers: Move clearing of base::timer_running under base:: Lock
8211bb20da serial: 8250_pci: Avoid irq sharing for MSI(-X) interrupts.
f73dcb5d63 serial: 8250_pci: Enumerate Elkhart Lake UARTs via dedicated driver
607460d386 MIPS: Malta: Do not byte-swap accesses to the CBUS UART
3eb686d01c serial: 8250: Mask out floating 16/32-bit bus bits
3b73a69962 serial: 8250_mtk: fix uart corruption issue when rx power off
afdef443a8 serial: tegra: Only print FIFO error message when an error occurs
097a183f9c ext4: fix potential htree corruption when growing large_dir directories
ac23a17381 pipe: increase minimum default pipe size to 2 pages
f3cae04bd4 media: rtl28xxu: fix zero-length control request
e2f6d5b038 staging: rtl8712: get rid of flush_scheduled_work
8f241df0e6 staging: rtl8723bs: Fix a resource leak in sd_int_dpc
bbdd4a5162 tpm_ftpm_tee: Free and unregister TEE shared memory during kexec
3c712f14d8 optee: Fix memory leak when failing to register shm pages
0572199b78 tee: add tee_shm_alloc_kernel_buf()
b247bf412c optee: Clear stale cache entries during initialization
7da261e6bb tracing / histogram: Give calculation hist_fields a size
ba22053f5d scripts/tracing: fix the bug that can't parse raw_trace_func
8d1191f924 clk: fix leak on devm_clk_bulk_get_all() unwind
ed5c9a49e6 usb: otg-fsm: Fix hrtimer list corruption
449a705fba usb: gadget: f_hid: idle uses the highest byte for duration
02f336cee5 usb: gadget: f_hid: fixed NULL pointer dereference
f780a9580c usb: gadget: f_hid: added GET_IDLE and SET_IDLE handlers
134e27da54 usb: cdns3: Fixed incorrect gadget state
df1c6eec4e ALSA: usb-audio: Add registration quirk for JBL Quantum 600
639b45456e ALSA: hda/realtek: add mic quirk for Acer SF314-42
d09639528b firmware_loader: fix use-after-free in firmware_fallback_sysfs
1deb6b9030 firmware_loader: use -ETIMEDOUT instead of -EAGAIN in fw_load_sysfs_fallback
0ee687e672 USB: serial: ftdi_sio: add device ID for Auto-M3 OP-COM v2
01b2c35b05 USB: serial: ch341: fix character loss at high transfer rates
9ed43cfaa7 USB: serial: option: add Telit FD980 composition 0x1056
518e81874c USB: usbtmc: Fix RCU stall warning
ff29fe26ab Bluetooth: defer cleanup of resources in hci_unregister_dev()
580c10a40c blk-iolatency: error out if blk_get_queue() failed in iolatency_set_limit()
ed169b054b net: vxge: fix use-after-free in vxge_device_unregister
c5549876a9 net: fec: fix use-after-free in fec_drv_remove
3fed6dee16 net: pegasus: fix uninit-value in get_interrupt_interval
75cef4fc07 bnx2x: fix an error code in bnx2x_nic_load()
437ee90d7b mips: Fix non-POSIX regexp
b1fa6747b9 net: ipv6: fix returned variable type in ip6_skb_dst_mtu
3e63b566d9 nfp: update ethtool reporting of pauseframe control
d333503de1 sctp: move the active_key update after sh_keys is added
de30346dd3 gpio: tqmx86: really make IRQ optional
9d440b5c1d net: natsemi: Fix missing pci_disable_device() in probe and remove
6934040698 net: phy: micrel: Fix detection of ksz87xx switch
2b8ab7aec0 net: dsa: sja1105: invalidate dynamic FDB entries learned concurrently with statically added ones
71b0a935db net: dsa: sja1105: overwrite dynamic FDB entries with static ones in .port_fdb_add
88b7781609 net, gro: Set inner transport header offset in tcp/udp GRO hook
ba3abe3f82 dmaengine: imx-dma: configure the generic DMA type to make it work
ee2f81330a media: videobuf2-core: dequeue if start_streaming fails
3377f2f8c6 scsi: sr: Return correct event when media event code is 3
f588d4b7be spi: imx: mx51-ecspi: Fix low-speed CONFIGREG delay calculation
b58e3d59a5 spi: imx: mx51-ecspi: Reinstate low-speed CONFIGREG delay
2c1065d40a omap5-board-common: remove not physically existing vdds_1v8_main fixed-regulator
299e3968c0 ARM: dts: am437x-l4: fix typo in can@0 node
9cbe7e21dd clk: stm32f4: fix post divisor setup for I2S/SAI PLLs
3f9eed4462 ALSA: usb-audio: fix incorrect clock source setting
16db40fc4a arm64: dts: armada-3720-turris-mox: remove mrvl,i2c-fast-mode
7c08460773 ARM: dts: imx: Swap M53Menlo pinctrl_power_button/pinctrl_power_out pins
1b1f1aa225 ARM: imx: fix missing 3rd argument in macro imx_mmdc_perf_init
aecff98c3e ARM: dts: colibri-imx6ull: limit SDIO clock to 25MHz
c39907335b ARM: dts: imx6qdl-sr-som: Increase the PHY reset duration to 10ms
61b71c5f51 ARM: imx: add missing clk_disable_unprepare()
d88d6bba3b ARM: imx: add missing iounmap()
6c629cd023 arm64: dts: ls1028a: fix node name for the sysclk
4a830a37d3 ALSA: seq: Fix racy deletion of subscriber
0658a45335 Revert "ACPICA: Fix memory leak caused by _CID repair function"
ea224455dd Merge 5.4.139 into android11-5.4-lts
8ab681fd3f ANDROID: GKI: fix up android/abi_gki_aarch64.xml merge
1d03502d2e Merge branch 'android11-5.4' into 'android11-5.4-lts'
e350cd02e2 Linux 5.4.139
03ff8a4f9d spi: mediatek: Fix fifo transfer
a0f66ddf05 bpf, selftests: Adjust few selftest outcomes wrt unreachable code
d3796e8f6b bpf, selftests: Add a verifier test for assigning 32bit reg states to 64bit ones
8dec99abcd bpf: Test_verifier, add alu32 bounds tracking tests
fd568de580 bpf: Fix leakage under speculation on mispredicted branches
d2f790327f bpf: Do not mark insn as seen under speculative path verification
283d742988 bpf: Inherit expanded/patched seen count from old aux data
a0a9546aae Revert "watchdog: iTCO_wdt: Account for rebooting on second timeout"
76f5314d78 firmware: arm_scmi: Add delayed response status check
1b38f70bbc firmware: arm_scmi: Ensure drivers provide a probe function
44f522298c Revert "Bluetooth: Shutdown controller after workqueues are flushed or cancelled"
38f54217b4 ACPI: fix NULL pointer dereference
0ea2f55bab nvme: fix nvme_setup_command metadata trace event
b508b652d4 net: Fix zero-copy head len calculation.
bf692e7ef6 qed: fix possible unpaired spin_{un}lock_bh in _qed_mcp_cmd_and_union()
6bc48348ec r8152: Fix potential PM refcount imbalance
a57c75ff07 ASoC: tlv320aic31xx: fix reversed bclk/wclk master bits
e2cccb839a spi: stm32h7: fix full duplex irq handler handling
b72f2d9e91 regulator: rt5033: Fix n_voltages settings for BUCK and LDO
86f2a3e9aa btrfs: fix lost inode on log replay after mix of fsync, rename and inode eviction
b7f0fa2192 btrfs: fix race causing unnecessary inode logging during link and rename
cb006da62a btrfs: do not commit logs and transactions during link and rename operations
174c27d0f9 btrfs: delete duplicated words + other fixes in comments
ae7ff75631 Merge 5.4.138 into android11-5.4-lts
7b90d57b09 Linux 5.4.138
7eef18c047 can: j1939: j1939_session_deactivate(): clarify lifetime of session object
18b536de3b i40e: Add additional info to PHY type error
d21eb93110 Revert "perf map: Fix dso->nsinfo refcounting"
16447b2f5c powerpc/pseries: Fix regression while building external modules
265883d1d8 PCI: mvebu: Setup BAR0 in order to fix MSI
21734a31c9 can: hi311x: fix a signedness bug in hi3110_cmd()
f4fa45b0f9 sis900: Fix missing pci_disable_device() in probe and remove
dff00ce448 tulip: windbond-840: Fix missing pci_disable_device() in probe and remove
e0310bbeaa sctp: fix return value check in __sctp_rcv_asconf_lookup
408614108a net/mlx5e: Fix nullptr in mlx5e_hairpin_get_mdev()
ac49832306 net/mlx5: Fix flow table chaining
527feae56f net: llc: fix skb_over_panic
ede4c93860 mlx4: Fix missing error code in mlx4_load_one()
acb97d4b2d net: Set true network header for ECN decapsulation
851946a681 tipc: fix sleeping in tipc accept routine
194b71d28b i40e: Fix log TC creation failure when max num of queues is exceeded
834af62212 i40e: Fix queue-to-TC mapping on Tx
74aea4b715 i40e: Fix firmware LLDP agent related warning
b2ab34e862 i40e: Fix logic of disabling queues
519582e44e netfilter: nft_nat: allow to specify layer 4 protocol NAT only
3a7a4cee7b netfilter: conntrack: adjust stop timestamp to real expiry value
1c04378340 cfg80211: Fix possible memory leak in function cfg80211_bss_update
6cf2abea10 nfc: nfcsim: fix use after free during module unload
6b313d0ffa NIU: fix incorrect error return, missed in previous revert
c4663c1627 HID: wacom: Re-enable touch by default for Cintiq 24HDT / 27QHDT
e9e2ce00ae can: esd_usb2: fix memory leak
43726620b2 can: ems_usb: fix memory leak
8198673892 can: usb_8dev: fix memory leak
a051dbd17b can: mcba_usb_start(): add missing urb->transfer_dma initialization
793581441b can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
c621638d0e can: j1939: j1939_xtp_rx_dat_one(): fix rxtimer value between consecutive TP.DT to 750ms
a24d87b429 ocfs2: issue zeroout to EOF blocks
eaaa4284e2 ocfs2: fix zero out valid data
9bd1092148 KVM: add missing compat KVM_CLEAR_DIRTY_LOG
7a94dfe5e2 x86/kvm: fix vcpu-id indexed array sizes
2dc291582c Revert "ACPI: resources: Add checks for ACPI IRQ override"
a8eec69797 btrfs: mark compressed range uptodate only if all bio succeed
57429c1ec7 btrfs: fix rw device counting in __btrfs_free_extra_devids
61f2cbc792 x86/asm: Ensure asm/proto.h can be included stand-alone
99372c38a9 net_sched: check error pointer in tcf_dump_walker()
758a7acf8b Merge 5.4.137 into android11-5.4-lts
911bc13b3a Merge branch 'android11-5.4' into 'android11-5.4-lts'
5b1de8e15f Linux 5.4.137
ebb1b38be0 ipv6: ip6_finish_output2: set sk into newly allocated nskb
6c04123962 ARM: dts: versatile: Fix up interrupt controller node names
befa900533 iomap: remove the length variable in iomap_seek_hole
83fb41b2f6 iomap: remove the length variable in iomap_seek_data
302e1acd4c cifs: fix the out of range assignment to bit fields in parse_server_interfaces
02a470e3c6 firmware: arm_scmi: Fix range check for the maximum number of pending messages
289dd58431 firmware: arm_scmi: Fix possible scmi_linux_errmap buffer overflow
e3acb292f0 hfs: add lock nesting notation to hfs_find_init
af1178296d hfs: fix high memory mapping in hfs_bnode_read
89136a47e2 hfs: add missing clean-up in hfs_fill_super
ded37d0344 ipv6: allocate enough headroom in ip6_finish_output2()
f65b7f377c sctp: move 198 addresses from unusable to private scope
c8d32973ee net: annotate data race around sk_ll_usec
c23b9a5610 net/802/garp: fix memleak in garp_request_join()
88c4cae3ed net/802/mrp: fix memleak in mrp_request_join()
eef99860c6 cgroup1: fix leaked context root causing sporadic NULL deref in LTP
7f0365b4da workqueue: fix UAF in pwq_unbound_release_workfn()
85abe0d47f af_unix: fix garbage collect vs MSG_PEEK
af45f3527a KVM: x86: determine if an exception has an error code only when injecting it.
828cab3c8c tools: Allow proper CC/CXX/... override with LLVM=1 in Makefile.include
525c5513b6 selftest: fix build error in tools/testing/selftests/vm/userfaultfd.c
fab7e04ebb ANDROID: Update android/abi_gki_aarch64.xml
c1b1b25ee2 ANDROID: Update android/abi_gki_aarch64_goldfish
ccc19b14a1 Merge 5.4.136 into android11-5.4-lts
253dccefb5 Linux 5.4.136
587f86b7a2 xhci: add xhci_get_virt_ep() helper
f9d0c35556 perf inject: Close inject.output on exit
a9c103fa91 PCI: Mark AMD Navi14 GPU ATS as broken
11561d2f7b btrfs: compression: don't try to compress if we don't have enough pages
4980301e1c iio: accel: bma180: Fix BMA25x bandwidth register values
d04f2582c4 iio: accel: bma180: Use explicit member assignment
4e0afa8895 net: bcmgenet: ensure EXT_ENERGY_DET_MASK is clear
2a4865d154 net: dsa: mv88e6xxx: use correct .stats_set_histogram() on Topaz
7d8c06b8d2 drm: Return -ENOTTY for non-drm ioctls
b5d7bebd96 nds32: fix up stack guard gap
ba378b7960 rbd: always kick acquire on "acquired" and "released" notifications
13066d6628 rbd: don't hold lock_rwsem while running_list is being drained
b12ead825f hugetlbfs: fix mount mode command line processing
60dbbd76f1 userfaultfd: do not untag user pointers
540eee8cbb selftest: use mmap instead of posix_memalign to allocate memory
e706ac3fc8 ixgbe: Fix packet corruption due to missing DMA sync
e617fa62f6 media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf()
77713fb336 btrfs: check for missing device in btrfs_trim_fs
f899f24d34 tracing: Fix bug in rb_per_cpu_empty() that might cause deadloop.
59a9f75fb2 tracing/histogram: Rename "cpu" to "common_cpu"
379d8da335 firmware/efi: Tell memblock about EFI iomem reservations
281a94362b usb: dwc2: gadget: Fix sending zero length packet in DDMA mode.
167079fbfa USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick
811c4cdf29 USB: serial: cp210x: fix comments for GE CS1000
f54ee7e16d USB: serial: option: add support for u-blox LARA-R6 family
e28d28eb9b usb: renesas_usbhs: Fix superfluous irqs happen after usb_pkt_pop()
863d071dbc usb: max-3421: Prevent corruption of freed memory
e4077a90e6 USB: usb-storage: Add LaCie Rugged USB3-FW to IGNORE_UAS
da6f6769ee usb: hub: Fix link power management max exit latency (MEL) calculations
fea6b53e63 usb: hub: Disable USB 3 device initiated lpm if exit latency is too high
962ce043ef KVM: PPC: Book3S HV Nested: Sanitise H_ENTER_NESTED TM state
2b9ffddd70 KVM: PPC: Book3S: Fix H_RTAS rets buffer overflow
c968f563cc xhci: Fix lost USB 2 remote wake
a660ecde5c ALSA: hdmi: Expose all pins on MSI MS-7C94 board
f73696354d ALSA: sb: Fix potential ABBA deadlock in CSP driver
7aa2dfbc6b ALSA: usb-audio: Add registration quirk for JBL Quantum headsets
46d62c3fe2 ALSA: usb-audio: Add missing proc text entry for BESPOKEN type
f1754f96ab s390/boot: fix use of expolines in the DMA code
8eb521d192 s390/ftrace: fix ftrace_update_ftrace_func implementation
268132b070 Revert "MIPS: add PMD table accounting into MIPS'pmd_alloc_one"
f323809e31 proc: Avoid mixing integer types in mem_rw()
b71a75209f drm/panel: raspberrypi-touchscreen: Prevent double-free
2e6ab87f8e net: sched: cls_api: Fix the the wrong parameter
b60461696a sctp: update active_key for asoc when old key is being replaced
9fa89c2cae nvme: set the PRACT bit when using Write Zeroes with T10 PI
c50141b3d7 r8169: Avoid duplicate sysfs entry creation error
f726817d6b afs: Fix tracepoint string placement with built-in AFS
b22c9e433b Revert "USB: quirks: ignore remote wake-up on Fibocom L850-GL LTE modem"
69a49e7b5b nvme-pci: don't WARN_ON in nvme_reset_work if ctrl.state is not RESETTING
8302513614 ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions
a88414fb11 net/sched: act_skbmod: Skip non-Ethernet packets
c278b954cc net: hns3: fix rx VLAN offload state inconsistent issue
006ed6f4d0 net/tcp_fastopen: fix data races around tfo_active_disable_stamp
3942ba2356 net: hisilicon: rename CACHE_LINE_MASK to avoid redefinition
f11f12decd bnxt_en: Check abort error state in bnxt_half_open_nic()
16ce6cb786 bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in bnxt_fw_rset_task()
c993e7aadc bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
6ee8e6be30 bnxt_en: Improve bnxt_ulp_stop()/bnxt_ulp_start() call sequence.
35637acc98 spi: cadence: Correct initialisation of runtime PM again
2f2150bf41 scsi: target: Fix protect handling in WRITE SAME(32)
a6cb717f85 scsi: iscsi: Fix iface sysfs attr detection
25df44e90f netrom: Decrease sock refcount when sock timers expire
8d7924ce85 net: sched: fix memory leak in tcindex_partial_destroy_work
f38527f189 KVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak
b85dadd434 KVM: PPC: Book3S: Fix CONFIG_TRANSACTIONAL_MEM=n crash
b3224bd318 net: decnet: Fix sleeping inside in af_decnet
bd2b3b13aa efi/tpm: Differentiate missing and invalid final event log table.
9413c0abb5 net: fix uninit-value in caif_seqpkt_sendmsg
6d56299ff9 bpftool: Check malloc return value in mount_bpffs_for_pin
edec100986 bpf, sockmap, tcp: sk_prot needs inuse_idx set for proc stats
58259e8b6e s390/bpf: Perform r1 range checking before accessing jit->seen_reg[r1]
cc876a5618 liquidio: Fix unintentional sign extension issue on left shift of u16
42fe8f433b ASoC: rt5631: Fix regcache sync errors on resume
d99aaf0736 spi: mediatek: fix fifo rx mode
08cdda8d89 regulator: hi6421: Fix getting wrong drvdata
b25be6bf64 regulator: hi6421: Use correct variable type for regmap api val argument
a1ade24ccc spi: stm32: fixes pm_runtime calls in probe/remove
40e203ce74 spi: stm32: Use dma_request_chan() instead dma_request_slave_channel()
24b78097a8 spi: imx: add a check for speed_hz before calculating the clock
52cff6123a perf data: Close all files in close_dir()
0f63857d10 perf probe-file: Delete namelist in del_events() on the error path
8b92ea243b perf lzma: Close lzma stream on exit
51351c6d5a perf script: Fix memory 'threads' and 'cpus' leaks on exit
d2bfc3eda9 perf dso: Fix memory leak in dso__new_map()
05804a7d22 perf test event_update: Fix memory leak of evlist
d257f3abdc perf test session_topology: Delete session->evlist
89d1762a4a perf env: Fix sibling_dies memory leak
fd335143be perf probe: Fix dso->nsinfo refcounting
6513dee46f perf map: Fix dso->nsinfo refcounting
ff9fc81fa8 nvme-pci: do not call nvme_dev_remove_admin from nvme_remove
d029df83c6 cxgb4: fix IRQ free race during driver unload
ae9b644344 pwm: sprd: Ensure configuring period and duty_cycle isn't wrongly skipped
a37ca2a076 selftests: icmp_redirect: IPv6 PMTU info should be cleared after redirect
05364a2794 selftests: icmp_redirect: remove from checking for IPv6 route get
7f4848229e ipv6: fix 'disable_policy' for fwd packets
c67fb96f54 gve: Fix an error handling path in 'gve_probe()'
e33da4eeaa igb: Fix position of assignment to *ring
7dd8977736 igb: Check if num of q_vectors is smaller than max before array access
d3d7cceee8 iavf: Fix an error handling path in 'iavf_probe()'
7a13a8a8a5 e1000e: Fix an error handling path in 'e1000_probe()'
9fc381db75 fm10k: Fix an error handling path in 'fm10k_probe()'
5d6a04927b igb: Fix an error handling path in 'igb_probe()'
cddd53237d igc: Fix an error handling path in 'igc_probe()'
47f69d8828 igc: Prefer to use the pci_release_mem_regions method
83b2d55a51 ixgbe: Fix an error handling path in 'ixgbe_probe()'
ba4fbb68fc igc: change default return of igc_read_phy_reg()
88e0720133 igb: Fix use-after-free error during reset
a9508e0edf igc: Fix use-after-free error during reset
f40a4f7a60 Merge 5.4.135 into android11-5.4-lts
0a0beb1f91 Linux 5.4.135
d2f7b384a7 udp: annotate data races around unix_sk(sk)->gso_size
c72374978b perf test bpf: Free obj_buf
17bc942c0b bpftool: Properly close va_list 'ap' by va_end() on error
84ed834094 ipv6: tcp: drop silly ICMPv6 packet too big messages
315033cab3 tcp: annotate data races around tp->mtu_info
41f45e91c9 dma-buf/sync_file: Don't leak fences on merge failure
04b0671683 net: fddi: fix UAF in fza_probe
8aa13a8696 net: validate lwtstate->data before returning from skb_tunnel_info()
8cff7b28ab net: send SYNACK packet with accepted fwmark
b7e5563f2a net: ti: fix UAF in tlan_remove_one
2b70ca9284 net: qcom/emac: fix UAF in emac_remove
463c0addb4 net: moxa: fix UAF in moxart_mac_probe
7ac4a6a74e net: ip_tunnel: fix mtu calculation for ETHER tunnel devices
d5dc50ca1f net: bcmgenet: Ensure all TX/RX queues DMAs are disabled
7ecd40801e net: bridge: sync fdb to new unicast-filtering ports
813d45499f net/sched: act_ct: fix err check for nf_conntrack_confirm
2497307356 netfilter: ctnetlink: suspicious RCU usage in ctnetlink_dump_helpinfo
c6f4a71153 net: ipv6: fix return value of ip6_skb_dst_mtu
9872273b67 net: dsa: mv88e6xxx: enable .rmu_disable() on Topaz
6148ddff2d net: dsa: mv88e6xxx: enable .port_set_policy() on Topaz
d73c180e6a dm writecache: return the exact table values that were set
8a85afc662 mm: slab: fix kmem_cache_create failed when sysfs node not destroyed
f53729b828 usb: cdns3: Enable TDL_CHK only for OUT ep
52b01a8086 f2fs: Show casefolding support only when supported
91d8460167 arm64: dts: marvell: armada-37xx: move firmware node to generic dtsi file
f696cc7f1b firmware: turris-mox-rwtm: add marvell,armada-3700-rwtm-firmware compatible string
e2b28026b8 arm64: dts: armada-3720-turris-mox: add firmware node
f7d1fa65e7 cifs: prevent NULL deref in cifs_compose_mount_options()
06d8a7eb58 s390: introduce proper type handling call_on_stack() macro
2a47e0719a sched/fair: Fix CFS bandwidth hrtimer expiry type
5b7d065868 scsi: qedf: Add check to synchronize abort and flush
0fe70c15f9 scsi: libfc: Fix array index out of bound exception
d7b647d055 scsi: libsas: Add LUN number check in .slave_alloc callback
863c4bc883 scsi: aic7xxx: Fix unintentional sign extension issue on left shift of u8
712e9ed613 rtc: max77686: Do not enforce (incorrect) interrupt trigger type
199d8ea4c7 kbuild: mkcompile_h: consider timestamp if KBUILD_BUILD_TIMESTAMP is set
484193b635 thermal/core: Correct function name thermal_zone_device_unregister()
556cf02830 arm64: dts: imx8mq: assign PCIe clocks
9d3eb68a53 arm64: dts: ls208xa: remove bus-num from dspi node
e054b361ca firmware: tegra: bpmp: Fix Tegra234-only builds
94d0095770 soc/tegra: fuse: Fix Tegra234-only builds
270a2e9faf ARM: dts: stm32: move stmmac axi config in ethernet node on stm32mp15
4bc66215bc ARM: dts: stm32: fix i2c node name on stm32f746 to prevent warnings
856c753237 ARM: dts: rockchip: fix supply properties in io-domains nodes
c5bb9cc2ce arm64: dts: juno: Update SCPI nodes as per the YAML schema
f572a91393 ARM: dts: stm32: fix timer nodes on STM32 MCU to prevent warnings
95e795474c ARM: dts: stm32: fix RCC node name on stm32f429 MCU
a898aa9f88 ARM: dts: stm32: fix gpio-keys node on STM32 MCU boards
5c17edaaea ARM: dts: am437x-gp-evm: fix ti,no-reset-on-init flag for gpios
3446233096 ARM: dts: am57xx-cl-som-am57x: fix ti,no-reset-on-init flag for gpios
e79e29a4e1 kbuild: sink stdout from cmd for silent build
f817d46775 rtc: mxc_v2: add missing MODULE_DEVICE_TABLE
0a22b51782 ARM: imx: pm-imx5: Fix references to imx5_cpu_suspend_info
e20e85639e ARM: dts: imx6: phyFLEX: Fix UART hardware flow control
a5b19d33ae ARM: dts: Hurricane 2: Fix NAND nodes names
f83535a47f ARM: dts: BCM63xx: Fix NAND nodes names
cb05b84ad7 ARM: NSP: dts: fix NAND nodes names
14e3bad3b5 ARM: Cygnus: dts: fix NAND nodes names
587a757afe ARM: brcmstb: dts: fix NAND nodes names
a9c32c7aee reset: ti-syscon: fix to_ti_syscon_reset_data macro
b400afa427 arm64: dts: rockchip: Fix power-controller node names for rk3328
dfb4e8ed07 arm64: dts: rockchip: Fix power-controller node names for px30
789070f178 ARM: dts: rockchip: Fix power-controller node names for rk3288
6aaffe6ce8 ARM: dts: rockchip: Fix power-controller node names for rk3188
439115ee56 ARM: dts: rockchip: Fix power-controller node names for rk3066a
3b4c347283 ARM: dts: rockchip: Fix IOMMU nodes properties on rk322x
c9d29d62da ARM: dts: rockchip: Fix the timer clocks order
d105e15de6 arm64: dts: rockchip: fix pinctrl sleep nodename for rk3399.dtsi
cfe3d29e5c ARM: dts: rockchip: fix pinctrl sleep nodename for rk3036-kylin and rk3288
79573c6441 ARM: dts: gemini: add device_type on pci
7037876393 ARM: dts: gemini: rename mdio to the right name
2a9f50cc6e Merge branch 'android11-5.4' into 'android11-5.4-lts'

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I1dfe5c5858c0c1f38ccb32e253ff7ff7f509eced
2021-10-20 10:32:16 +02:00

693 lines
18 KiB
C

// SPDX-License-Identifier: GPL-2.0-or-later
/*
* IPV4 GSO/GRO offload support
* Linux INET implementation
*
* UDPv4 GSO support
*/
#include <linux/skbuff.h>
#include <net/udp.h>
#include <net/protocol.h>
#include <net/inet_common.h>
static struct sk_buff *__skb_udp_tunnel_segment(struct sk_buff *skb,
netdev_features_t features,
struct sk_buff *(*gso_inner_segment)(struct sk_buff *skb,
netdev_features_t features),
__be16 new_protocol, bool is_ipv6)
{
int tnl_hlen = skb_inner_mac_header(skb) - skb_transport_header(skb);
bool remcsum, need_csum, offload_csum, gso_partial;
struct sk_buff *segs = ERR_PTR(-EINVAL);
struct udphdr *uh = udp_hdr(skb);
u16 mac_offset = skb->mac_header;
__be16 protocol = skb->protocol;
u16 mac_len = skb->mac_len;
int udp_offset, outer_hlen;
__wsum partial;
bool need_ipsec;
if (unlikely(!pskb_may_pull(skb, tnl_hlen)))
goto out;
/* Adjust partial header checksum to negate old length.
* We cannot rely on the value contained in uh->len as it is
* possible that the actual value exceeds the boundaries of the
* 16 bit length field due to the header being added outside of an
* IP or IPv6 frame that was already limited to 64K - 1.
*/
if (skb_shinfo(skb)->gso_type & SKB_GSO_PARTIAL)
partial = (__force __wsum)uh->len;
else
partial = (__force __wsum)htonl(skb->len);
partial = csum_sub(csum_unfold(uh->check), partial);
/* setup inner skb. */
skb->encapsulation = 0;
SKB_GSO_CB(skb)->encap_level = 0;
__skb_pull(skb, tnl_hlen);
skb_reset_mac_header(skb);
skb_set_network_header(skb, skb_inner_network_offset(skb));
skb->mac_len = skb_inner_network_offset(skb);
skb->protocol = new_protocol;
need_csum = !!(skb_shinfo(skb)->gso_type & SKB_GSO_UDP_TUNNEL_CSUM);
skb->encap_hdr_csum = need_csum;
remcsum = !!(skb_shinfo(skb)->gso_type & SKB_GSO_TUNNEL_REMCSUM);
skb->remcsum_offload = remcsum;
need_ipsec = skb_dst(skb) && dst_xfrm(skb_dst(skb));
/* Try to offload checksum if possible */
offload_csum = !!(need_csum &&
!need_ipsec &&
(skb->dev->features &
(is_ipv6 ? (NETIF_F_HW_CSUM | NETIF_F_IPV6_CSUM) :
(NETIF_F_HW_CSUM | NETIF_F_IP_CSUM))));
features &= skb->dev->hw_enc_features;
/* The only checksum offload we care about from here on out is the
* outer one so strip the existing checksum feature flags and
* instead set the flag based on our outer checksum offload value.
*/
if (remcsum) {
features &= ~NETIF_F_CSUM_MASK;
if (!need_csum || offload_csum)
features |= NETIF_F_HW_CSUM;
}
/* segment inner packet. */
segs = gso_inner_segment(skb, features);
if (IS_ERR_OR_NULL(segs)) {
skb_gso_error_unwind(skb, protocol, tnl_hlen, mac_offset,
mac_len);
goto out;
}
gso_partial = !!(skb_shinfo(segs)->gso_type & SKB_GSO_PARTIAL);
outer_hlen = skb_tnl_header_len(skb);
udp_offset = outer_hlen - tnl_hlen;
skb = segs;
do {
unsigned int len;
if (remcsum)
skb->ip_summed = CHECKSUM_NONE;
/* Set up inner headers if we are offloading inner checksum */
if (skb->ip_summed == CHECKSUM_PARTIAL) {
skb_reset_inner_headers(skb);
skb->encapsulation = 1;
}
skb->mac_len = mac_len;
skb->protocol = protocol;
__skb_push(skb, outer_hlen);
skb_reset_mac_header(skb);
skb_set_network_header(skb, mac_len);
skb_set_transport_header(skb, udp_offset);
len = skb->len - udp_offset;
uh = udp_hdr(skb);
/* If we are only performing partial GSO the inner header
* will be using a length value equal to only one MSS sized
* segment instead of the entire frame.
*/
if (gso_partial && skb_is_gso(skb)) {
uh->len = htons(skb_shinfo(skb)->gso_size +
SKB_GSO_CB(skb)->data_offset +
skb->head - (unsigned char *)uh);
} else {
uh->len = htons(len);
}
if (!need_csum)
continue;
uh->check = ~csum_fold(csum_add(partial,
(__force __wsum)htonl(len)));
if (skb->encapsulation || !offload_csum) {
uh->check = gso_make_checksum(skb, ~uh->check);
if (uh->check == 0)
uh->check = CSUM_MANGLED_0;
} else {
skb->ip_summed = CHECKSUM_PARTIAL;
skb->csum_start = skb_transport_header(skb) - skb->head;
skb->csum_offset = offsetof(struct udphdr, check);
}
} while ((skb = skb->next));
out:
return segs;
}
struct sk_buff *skb_udp_tunnel_segment(struct sk_buff *skb,
netdev_features_t features,
bool is_ipv6)
{
__be16 protocol = skb->protocol;
const struct net_offload **offloads;
const struct net_offload *ops;
struct sk_buff *segs = ERR_PTR(-EINVAL);
struct sk_buff *(*gso_inner_segment)(struct sk_buff *skb,
netdev_features_t features);
rcu_read_lock();
switch (skb->inner_protocol_type) {
case ENCAP_TYPE_ETHER:
protocol = skb->inner_protocol;
gso_inner_segment = skb_mac_gso_segment;
break;
case ENCAP_TYPE_IPPROTO:
offloads = is_ipv6 ? inet6_offloads : inet_offloads;
ops = rcu_dereference(offloads[skb->inner_ipproto]);
if (!ops || !ops->callbacks.gso_segment)
goto out_unlock;
gso_inner_segment = ops->callbacks.gso_segment;
break;
default:
goto out_unlock;
}
segs = __skb_udp_tunnel_segment(skb, features, gso_inner_segment,
protocol, is_ipv6);
out_unlock:
rcu_read_unlock();
return segs;
}
EXPORT_SYMBOL(skb_udp_tunnel_segment);
static void __udpv4_gso_segment_csum(struct sk_buff *seg,
__be32 *oldip, __be32 *newip,
__be16 *oldport, __be16 *newport)
{
struct udphdr *uh;
struct iphdr *iph;
if (*oldip == *newip && *oldport == *newport)
return;
uh = udp_hdr(seg);
iph = ip_hdr(seg);
if (uh->check) {
inet_proto_csum_replace4(&uh->check, seg, *oldip, *newip,
true);
inet_proto_csum_replace2(&uh->check, seg, *oldport, *newport,
false);
if (!uh->check)
uh->check = CSUM_MANGLED_0;
}
*oldport = *newport;
csum_replace4(&iph->check, *oldip, *newip);
*oldip = *newip;
}
static struct sk_buff *__udpv4_gso_segment_list_csum(struct sk_buff *segs)
{
struct sk_buff *seg;
struct udphdr *uh, *uh2;
struct iphdr *iph, *iph2;
seg = segs;
uh = udp_hdr(seg);
iph = ip_hdr(seg);
if ((udp_hdr(seg)->dest == udp_hdr(seg->next)->dest) &&
(udp_hdr(seg)->source == udp_hdr(seg->next)->source) &&
(ip_hdr(seg)->daddr == ip_hdr(seg->next)->daddr) &&
(ip_hdr(seg)->saddr == ip_hdr(seg->next)->saddr))
return segs;
while ((seg = seg->next)) {
uh2 = udp_hdr(seg);
iph2 = ip_hdr(seg);
__udpv4_gso_segment_csum(seg,
&iph2->saddr, &iph->saddr,
&uh2->source, &uh->source);
__udpv4_gso_segment_csum(seg,
&iph2->daddr, &iph->daddr,
&uh2->dest, &uh->dest);
}
return segs;
}
static struct sk_buff *__udp_gso_segment_list(struct sk_buff *skb,
netdev_features_t features,
bool is_ipv6)
{
unsigned int mss = skb_shinfo(skb)->gso_size;
skb = skb_segment_list(skb, features, skb_mac_header_len(skb));
if (IS_ERR(skb))
return skb;
udp_hdr(skb)->len = htons(sizeof(struct udphdr) + mss);
return is_ipv6 ? skb : __udpv4_gso_segment_list_csum(skb);
}
struct sk_buff *__udp_gso_segment(struct sk_buff *gso_skb,
netdev_features_t features, bool is_ipv6)
{
struct sock *sk = gso_skb->sk;
unsigned int sum_truesize = 0;
struct sk_buff *segs, *seg;
struct udphdr *uh;
unsigned int mss;
bool copy_dtor;
__sum16 check;
__be16 newlen;
if (skb_shinfo(gso_skb)->gso_type & SKB_GSO_FRAGLIST)
return __udp_gso_segment_list(gso_skb, features, is_ipv6);
mss = skb_shinfo(gso_skb)->gso_size;
if (gso_skb->len <= sizeof(*uh) + mss)
return ERR_PTR(-EINVAL);
skb_pull(gso_skb, sizeof(*uh));
/* clear destructor to avoid skb_segment assigning it to tail */
copy_dtor = gso_skb->destructor == sock_wfree;
if (copy_dtor)
gso_skb->destructor = NULL;
segs = skb_segment(gso_skb, features);
if (IS_ERR_OR_NULL(segs)) {
if (copy_dtor)
gso_skb->destructor = sock_wfree;
return segs;
}
/* GSO partial and frag_list segmentation only requires splitting
* the frame into an MSS multiple and possibly a remainder, both
* cases return a GSO skb. So update the mss now.
*/
if (skb_is_gso(segs))
mss *= skb_shinfo(segs)->gso_segs;
seg = segs;
uh = udp_hdr(seg);
/* preserve TX timestamp flags and TS key for first segment */
skb_shinfo(seg)->tskey = skb_shinfo(gso_skb)->tskey;
skb_shinfo(seg)->tx_flags |=
(skb_shinfo(gso_skb)->tx_flags & SKBTX_ANY_TSTAMP);
/* compute checksum adjustment based on old length versus new */
newlen = htons(sizeof(*uh) + mss);
check = csum16_add(csum16_sub(uh->check, uh->len), newlen);
for (;;) {
if (copy_dtor) {
seg->destructor = sock_wfree;
seg->sk = sk;
sum_truesize += seg->truesize;
}
if (!seg->next)
break;
uh->len = newlen;
uh->check = check;
if (seg->ip_summed == CHECKSUM_PARTIAL)
gso_reset_checksum(seg, ~check);
else
uh->check = gso_make_checksum(seg, ~check) ? :
CSUM_MANGLED_0;
seg = seg->next;
uh = udp_hdr(seg);
}
/* last packet can be partial gso_size, account for that in checksum */
newlen = htons(skb_tail_pointer(seg) - skb_transport_header(seg) +
seg->data_len);
check = csum16_add(csum16_sub(uh->check, uh->len), newlen);
uh->len = newlen;
uh->check = check;
if (seg->ip_summed == CHECKSUM_PARTIAL)
gso_reset_checksum(seg, ~check);
else
uh->check = gso_make_checksum(seg, ~check) ? : CSUM_MANGLED_0;
/* update refcount for the packet */
if (copy_dtor) {
int delta = sum_truesize - gso_skb->truesize;
/* In some pathological cases, delta can be negative.
* We need to either use refcount_add() or refcount_sub_and_test()
*/
if (likely(delta >= 0))
refcount_add(delta, &sk->sk_wmem_alloc);
else
WARN_ON_ONCE(refcount_sub_and_test(-delta, &sk->sk_wmem_alloc));
}
return segs;
}
EXPORT_SYMBOL_GPL(__udp_gso_segment);
static struct sk_buff *udp4_ufo_fragment(struct sk_buff *skb,
netdev_features_t features)
{
struct sk_buff *segs = ERR_PTR(-EINVAL);
unsigned int mss;
__wsum csum;
struct udphdr *uh;
struct iphdr *iph;
if (skb->encapsulation &&
(skb_shinfo(skb)->gso_type &
(SKB_GSO_UDP_TUNNEL|SKB_GSO_UDP_TUNNEL_CSUM))) {
segs = skb_udp_tunnel_segment(skb, features, false);
goto out;
}
if (!(skb_shinfo(skb)->gso_type & (SKB_GSO_UDP | SKB_GSO_UDP_L4)))
goto out;
if (!pskb_may_pull(skb, sizeof(struct udphdr)))
goto out;
if (skb_shinfo(skb)->gso_type & SKB_GSO_UDP_L4)
return __udp_gso_segment(skb, features, false);
mss = skb_shinfo(skb)->gso_size;
if (unlikely(skb->len <= mss))
goto out;
/* Do software UFO. Complete and fill in the UDP checksum as
* HW cannot do checksum of UDP packets sent as multiple
* IP fragments.
*/
uh = udp_hdr(skb);
iph = ip_hdr(skb);
uh->check = 0;
csum = skb_checksum(skb, 0, skb->len, 0);
uh->check = udp_v4_check(skb->len, iph->saddr, iph->daddr, csum);
if (uh->check == 0)
uh->check = CSUM_MANGLED_0;
skb->ip_summed = CHECKSUM_UNNECESSARY;
/* If there is no outer header we can fake a checksum offload
* due to the fact that we have already done the checksum in
* software prior to segmenting the frame.
*/
if (!skb->encap_hdr_csum)
features |= NETIF_F_HW_CSUM;
/* Fragment the skb. IP headers of the fragments are updated in
* inet_gso_segment()
*/
segs = skb_segment(skb, features);
out:
return segs;
}
#define UDP_GRO_CNT_MAX 64
static struct sk_buff *udp_gro_receive_segment(struct list_head *head,
struct sk_buff *skb)
{
struct udphdr *uh = udp_gro_udphdr(skb);
struct sk_buff *pp = NULL;
struct udphdr *uh2;
struct sk_buff *p;
unsigned int ulen;
int ret = 0;
/* requires non zero csum, for symmetry with GSO */
if (!uh->check) {
NAPI_GRO_CB(skb)->flush = 1;
return NULL;
}
/* Do not deal with padded or malicious packets, sorry ! */
ulen = ntohs(uh->len);
if (ulen <= sizeof(*uh) || ulen != skb_gro_len(skb)) {
NAPI_GRO_CB(skb)->flush = 1;
return NULL;
}
/* pull encapsulating udp header */
skb_gro_pull(skb, sizeof(struct udphdr));
list_for_each_entry(p, head, list) {
if (!NAPI_GRO_CB(p)->same_flow)
continue;
uh2 = udp_hdr(p);
/* Match ports only, as csum is always non zero */
if ((*(u32 *)&uh->source != *(u32 *)&uh2->source)) {
NAPI_GRO_CB(p)->same_flow = 0;
continue;
}
if (NAPI_GRO_CB(skb)->is_flist != NAPI_GRO_CB(p)->is_flist) {
NAPI_GRO_CB(skb)->flush = 1;
return p;
}
/* Terminate the flow on len mismatch or if it grow "too much".
* Under small packet flood GRO count could elsewhere grow a lot
* leading to excessive truesize values.
* On len mismatch merge the first packet shorter than gso_size,
* otherwise complete the GRO packet.
*/
if (ulen > ntohs(uh2->len)) {
pp = p;
} else {
if (NAPI_GRO_CB(skb)->is_flist) {
if (!pskb_may_pull(skb, skb_gro_offset(skb))) {
NAPI_GRO_CB(skb)->flush = 1;
return NULL;
}
if ((skb->ip_summed != p->ip_summed) ||
(skb->csum_level != p->csum_level)) {
NAPI_GRO_CB(skb)->flush = 1;
return NULL;
}
ret = skb_gro_receive_list(p, skb);
} else {
skb_gro_postpull_rcsum(skb, uh,
sizeof(struct udphdr));
ret = skb_gro_receive(p, skb);
}
}
if (ret || ulen != ntohs(uh2->len) ||
NAPI_GRO_CB(p)->count >= UDP_GRO_CNT_MAX)
pp = p;
return pp;
}
/* mismatch, but we never need to flush */
return NULL;
}
struct sk_buff *udp_gro_receive(struct list_head *head, struct sk_buff *skb,
struct udphdr *uh, struct sock *sk)
{
struct sk_buff *pp = NULL;
struct sk_buff *p;
struct udphdr *uh2;
unsigned int off = skb_gro_offset(skb);
int flush = 1;
/* we can do L4 aggregation only if the packet can't land in a tunnel
* otherwise we could corrupt the inner stream
*/
NAPI_GRO_CB(skb)->is_flist = 0;
if (!sk || !udp_sk(sk)->gro_receive) {
if (skb->dev->features & NETIF_F_GRO_FRAGLIST)
NAPI_GRO_CB(skb)->is_flist = sk ? !udp_sk(sk)->gro_enabled : 1;
if ((sk && udp_sk(sk)->gro_enabled) || NAPI_GRO_CB(skb)->is_flist)
return call_gro_receive(udp_gro_receive_segment, head, skb);
/* no GRO, be sure flush the current packet */
goto out;
}
if (NAPI_GRO_CB(skb)->encap_mark ||
(uh->check && skb->ip_summed != CHECKSUM_PARTIAL &&
NAPI_GRO_CB(skb)->csum_cnt == 0 &&
!NAPI_GRO_CB(skb)->csum_valid))
goto out;
/* mark that this skb passed once through the tunnel gro layer */
NAPI_GRO_CB(skb)->encap_mark = 1;
flush = 0;
list_for_each_entry(p, head, list) {
if (!NAPI_GRO_CB(p)->same_flow)
continue;
uh2 = (struct udphdr *)(p->data + off);
/* Match ports and either checksums are either both zero
* or nonzero.
*/
if ((*(u32 *)&uh->source != *(u32 *)&uh2->source) ||
(!uh->check ^ !uh2->check)) {
NAPI_GRO_CB(p)->same_flow = 0;
continue;
}
}
skb_gro_pull(skb, sizeof(struct udphdr)); /* pull encapsulating udp header */
skb_gro_postpull_rcsum(skb, uh, sizeof(struct udphdr));
pp = call_gro_receive_sk(udp_sk(sk)->gro_receive, sk, head, skb);
out:
skb_gro_flush_final(skb, pp, flush);
return pp;
}
EXPORT_SYMBOL(udp_gro_receive);
INDIRECT_CALLABLE_SCOPE
struct sk_buff *udp4_gro_receive(struct list_head *head, struct sk_buff *skb)
{
struct udphdr *uh = udp_gro_udphdr(skb);
struct sk_buff *pp;
struct sock *sk;
if (unlikely(!uh))
goto flush;
/* Don't bother verifying checksum if we're going to flush anyway. */
if (NAPI_GRO_CB(skb)->flush)
goto skip;
if (skb_gro_checksum_validate_zero_check(skb, IPPROTO_UDP, uh->check,
inet_gro_compute_pseudo))
goto flush;
else if (uh->check)
skb_gro_checksum_try_convert(skb, IPPROTO_UDP, uh->check,
inet_gro_compute_pseudo);
skip:
NAPI_GRO_CB(skb)->is_ipv6 = 0;
rcu_read_lock();
sk = static_branch_unlikely(&udp_encap_needed_key) ? udp4_lib_lookup_skb(skb, uh->source, uh->dest) : NULL;
pp = udp_gro_receive(head, skb, uh, sk);
rcu_read_unlock();
return pp;
flush:
NAPI_GRO_CB(skb)->flush = 1;
return NULL;
}
static int udp_gro_complete_segment(struct sk_buff *skb)
{
struct udphdr *uh = udp_hdr(skb);
skb->csum_start = (unsigned char *)uh - skb->head;
skb->csum_offset = offsetof(struct udphdr, check);
skb->ip_summed = CHECKSUM_PARTIAL;
skb_shinfo(skb)->gso_segs = NAPI_GRO_CB(skb)->count;
skb_shinfo(skb)->gso_type |= SKB_GSO_UDP_L4;
if (skb->encapsulation)
skb->inner_transport_header = skb->transport_header;
return 0;
}
int udp_gro_complete(struct sk_buff *skb, int nhoff,
udp_lookup_t lookup)
{
__be16 newlen = htons(skb->len - nhoff);
struct udphdr *uh = (struct udphdr *)(skb->data + nhoff);
int err = -ENOSYS;
struct sock *sk;
uh->len = newlen;
rcu_read_lock();
sk = INDIRECT_CALL_INET(lookup, udp6_lib_lookup_skb,
udp4_lib_lookup_skb, skb, uh->source, uh->dest);
if (sk && udp_sk(sk)->gro_complete) {
skb_shinfo(skb)->gso_type = uh->check ? SKB_GSO_UDP_TUNNEL_CSUM
: SKB_GSO_UDP_TUNNEL;
/* Set encapsulation before calling into inner gro_complete()
* functions to make them set up the inner offsets.
*/
skb->encapsulation = 1;
err = udp_sk(sk)->gro_complete(sk, skb,
nhoff + sizeof(struct udphdr));
} else {
err = udp_gro_complete_segment(skb);
}
rcu_read_unlock();
if (skb->remcsum_offload)
skb_shinfo(skb)->gso_type |= SKB_GSO_TUNNEL_REMCSUM;
return err;
}
EXPORT_SYMBOL(udp_gro_complete);
INDIRECT_CALLABLE_SCOPE int udp4_gro_complete(struct sk_buff *skb, int nhoff)
{
const struct iphdr *iph = ip_hdr(skb);
struct udphdr *uh = (struct udphdr *)(skb->data + nhoff);
if (NAPI_GRO_CB(skb)->is_flist) {
uh->len = htons(skb->len - nhoff);
skb_shinfo(skb)->gso_type |= (SKB_GSO_FRAGLIST|SKB_GSO_UDP_L4);
skb_shinfo(skb)->gso_segs = NAPI_GRO_CB(skb)->count;
if (skb->ip_summed == CHECKSUM_UNNECESSARY) {
if (skb->csum_level < SKB_MAX_CSUM_LEVEL)
skb->csum_level++;
} else {
skb->ip_summed = CHECKSUM_UNNECESSARY;
skb->csum_level = 0;
}
return 0;
}
if (uh->check)
uh->check = ~udp_v4_check(skb->len - nhoff, iph->saddr,
iph->daddr, 0);
return udp_gro_complete(skb, nhoff, udp4_lib_lookup_skb);
}
static const struct net_offload udpv4_offload = {
.callbacks = {
.gso_segment = udp4_ufo_fragment,
.gro_receive = udp4_gro_receive,
.gro_complete = udp4_gro_complete,
},
};
int __init udpv4_offload_init(void)
{
return inet_add_offload(&udpv4_offload, IPPROTO_UDP);
}