android/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,035,723 Commits 2 Branches 0 Tags 2.3 GiB
lineage-22.0
Commit Graph

1842 Commits

Author SHA1 Message Date
Greg Kroah-Hartman
b48eba851f Merge 1ebfa66638 ("drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream") into android12-5.10-lts 
Steps on the way to 5.10.227

Change-Id: I5e69192f2ecbbda523c18c2749bb1f181837e99c
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-14 11:32:05 +00:00
Greg Kroah-Hartman
9e57ad4546 Merge 0ce9d89343 ("clk: ti: dra7-atl: Fix leak of of_nodes") into android12-5.10-lts 
Steps on the way to 5.10.226

Resolves merge conflicts in:
	drivers/dma-buf/heaps/heap-helpers.c
	drivers/usb/dwc3/core.h
	fs/ext4/inline.c

Change-Id: Id7ab496884e549fc85b6fff8254fb56d6785d78c
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-11-12 17:29:46 +00:00
Simon Horman
e2b2558971 tipc: guard against string buffer overrun 
[ Upstream commit 6555a2a9212be6983d2319d65276484f7c5f431a ]

Smatch reports that copying media_name and if_name to name_parts may
overwrite the destination.

 .../bearer.c:166 bearer_name_validate() error: strcpy() 'media_name' too large for 'name_parts->media_name' (32 vs 16)
 .../bearer.c:167 bearer_name_validate() error: strcpy() 'if_name' too large for 'name_parts->if_name' (1010102 vs 16)

This does seem to be the case so guard against this possibility by using
strscpy() and failing if truncation occurs.

Introduced by commit b97bf3fd8f ("[TIPC] Initial merge")

Compile tested only.

Reviewed-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20240801-tipic-overrun-v2-1-c5b869d1f074@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2024-10-17 15:08:11 +02:00
Su Hui
cab9ff7fe8 net: tipc: avoid possible garbage value 
[ Upstream commit 99655a304e450baaae6b396cb942b9e47659d644 ]

Clang static checker (scan-build) warning:
net/tipc/bcast.c:305:4:
The expression is an uninitialized value. The computed value will also
be garbage [core.uninitialized.Assign]
  305 |                         (*cong_link_cnt)++;
      |                         ^~~~~~~~~~~~~~~~~~

tipc_rcast_xmit() will increase cong_link_cnt's value, but cong_link_cnt
is uninitialized. Although it won't really cause a problem, it's better
to fix it.

Fixes: dca4a17d24 ("tipc: fix potential hanging after b/rcast changing")
Signed-off-by: Su Hui <suhui@nfschina.com>
Reviewed-by: Justin Stitt <justinstitt@google.com>
Link: https://patch.msgid.link/20240912110119.2025503-1-suhui@nfschina.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2024-10-17 15:07:42 +02:00
Greg Kroah-Hartman
b84ad15be5 This is the 5.10.224 stable release 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmbCv24ACgkQONu9yGCS
 aT7lNRAAzP2lSCUHROaMTldoQdahqoWqwFSiMI9p32HYLTerpg1GHVsi1IUvD+pv
 zhmUG9w+ACbSbZ9337G61FeEDCIBzgqaIXLCtbK2Be9nWMa9I1ZtMSFUKoSmVJBw
 YbrI/UOscJmAf44G6DeMp+N+/S2o7INK463u51SYjufo/zhFF8KsYElm23p06kgn
 lTkkUAoo9mSVvEr64zbjwLrWyBWTlcvYH/xrkWeJWXl+hBv0K5Ig9IBm0sc0DSQR
 fErADzDLFkmD9pduZbMwbzUUzC8ST41KKjTgClaHQhSMeoLoWT8CJM5Swwds4XVE
 JkoClkqnj3+stYFpLFm9UUgZ12wu/9slzgRCN6fTraSNT8gE9F9BRJXFGL+3S5OO
 oHKZYEEPTZDsD3PihgufJ4Ft27+KpMUzAgQUmVH/y47wrVJ2pf4fCK8LKT0MbjBi
 pjZaDRCxwo1aORL3+jYJBVRecrNqQ0DhacYOKznhb2KKeaHojIwLaE6k/W/0Q8U5
 1uMYv+NJ3LWDNzGcNUTCfNtuDELOpkp24Xc8RN0MK2iMMMyfjMpgKssjSBZtz0QW
 NH0UVpfiWKECKH+m03NeFnYdMuK8/VyM8vatkcemz0FfgJP2UazeiVwSujfS2r2S
 0TtsCMPP3kgKa9mAnni7lQs4wkG+OTNDNZqbuDqFZ1rHUS2Usrg=
 =8i2e
 -----END PGP SIGNATURE-----

Merge 5.10.224 into android12-5.10-lts

Changes in 5.10.224
	EDAC/skx_common: Add new ADXL components for 2-level memory
	EDAC, i10nm: make skx_common.o a separate module
	platform/chrome: cros_ec_debugfs: fix wrong EC message version
	hfsplus: fix to avoid false alarm of circular locking
	x86/of: Return consistent error type from x86_of_pci_irq_enable()
	x86/pci/intel_mid_pci: Fix PCIBIOS_* return code handling
	x86/pci/xen: Fix PCIBIOS_* return code handling
	x86/platform/iosf_mbi: Convert PCIBIOS_* return codes to errnos
	hwmon: (adt7475) Fix default duty on fan is disabled
	pwm: stm32: Always do lazy disabling
	hwmon: (max6697) Fix underflow when writing limit attributes
	hwmon: (max6697) Fix swapped temp{1,8} critical alarms
	arm64: dts: qcom: sdm845: add power-domain to UFS PHY
	soc: qcom: rpmh-rsc: Ensure irqs aren't disabled by rpmh_rsc_send_data() callers
	arm64: dts: qcom: msm8996: specify UFS core_clk frequencies
	soc: qcom: pdr: protect locator_addr with the main mutex
	soc: qcom: pdr: fix parsing of domains lists
	arm64: dts: rockchip: Increase VOP clk rate on RK3328
	ARM: dts: imx6qdl-kontron-samx6i: move phy reset into phy-node
	ARM: dts: imx6qdl-kontron-samx6i: fix PHY reset
	ARM: dts: imx6qdl-kontron-samx6i: fix board reset
	ARM: dts: imx6qdl-kontron-samx6i: fix SPI0 chip selects
	ARM: dts: imx6qdl-kontron-samx6i: fix PCIe reset polarity
	arm64: dts: mediatek: mt8183-kukui: Drop bogus output-enable property
	arm64: dts: mediatek: mt7622: fix "emmc" pinctrl mux
	arm64: dts: amlogic: gx: correct hdmi clocks
	m68k: atari: Fix TT bootup freeze / unexpected (SCU) interrupt messages
	x86/xen: Convert comma to semicolon
	m68k: cmpxchg: Fix return value for default case in __arch_xchg()
	ARM: pxa: spitz: use gpio descriptors for audio
	ARM: spitz: fix GPIO assignment for backlight
	firmware: turris-mox-rwtm: Fix checking return value of wait_for_completion_timeout()
	firmware: turris-mox-rwtm: Initialize completion before mailbox
	wifi: brcmsmac: LCN PHY code is used for BCM4313 2G-only device
	selftests/bpf: Fix prog numbers in test_sockmap
	net: esp: cleanup esp_output_tail_tcp() in case of unsupported ESPINTCP
	net/smc: Allow SMC-D 1MB DMB allocations
	net/smc: set rmb's SG_MAX_SINGLE_ALLOC limitation only when CONFIG_ARCH_NO_SG_CHAIN is defined
	selftests/bpf: Check length of recv in test_sockmap
	lib: objagg: Fix general protection fault
	mlxsw: spectrum_acl_erp: Fix object nesting warning
	mlxsw: spectrum_acl_bloom_filter: Make mlxsw_sp_acl_bf_key_encode() more flexible
	mlxsw: spectrum_acl: Fix ACL scale regression and firmware errors
	ath11k: dp: stop rx pktlog before suspend
	wifi: ath11k: fix wrong handling of CCMP256 and GCMP ciphers
	wifi: cfg80211: fix typo in cfg80211_calculate_bitrate_he()
	wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he()
	net: fec: Refactor: #define magic constants
	net: fec: Fix FEC_ECR_EN1588 being cleared on link-down
	ipvs: Avoid unnecessary calls to skb_is_gso_sctp
	netfilter: nf_tables: rise cap on SELinux secmark context
	perf/x86/intel/pt: Fix pt_topa_entry_for_page() address calculation
	perf: Fix perf_aux_size() for greater-than 32-bit size
	perf: Prevent passing zero nr_pages to rb_alloc_aux()
	qed: Improve the stack space of filter_config()
	wifi: virt_wifi: avoid reporting connection success with wrong SSID
	gss_krb5: Fix the error handling path for crypto_sync_skcipher_setkey
	wifi: virt_wifi: don't use strlen() in const context
	selftests/bpf: Close fd in error path in drop_on_reuseport
	bpf: annotate BTF show functions with __printf
	bna: adjust 'name' buf size of bna_tcb and bna_ccb structures
	bpf: Eliminate remaining "make W=1" warnings in kernel/bpf/btf.o
	selftests: forwarding: devlink_lib: Wait for udev events after reloading
	xdp: fix invalid wait context of page_pool_destroy()
	drm/panel: boe-tv101wum-nl6: If prepare fails, disable GPIO before regulators
	drm/panel: boe-tv101wum-nl6: Check for errors on the NOP in prepare()
	media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()
	media: imon: Fix race getting ictx->lock
	saa7134: Unchecked i2c_transfer function result fixed
	media: uvcvideo: Allow entity-defined get_info and get_cur
	media: uvcvideo: Override default flags
	media: renesas: vsp1: Fix _irqsave and _irq mix
	media: renesas: vsp1: Store RPF partition configuration per RPF instance
	leds: trigger: Unregister sysfs attributes before calling deactivate()
	perf report: Fix condition in sort__sym_cmp()
	drm/etnaviv: fix DMA direction handling for cached RW buffers
	drm/qxl: Add check for drm_cvt_mode
	Revert "leds: led-core: Fix refcount leak in of_led_get()"
	ext4: fix infinite loop when replaying fast_commit
	media: venus: flush all buffers in output plane streamoff
	mfd: omap-usb-tll: Use struct_size to allocate tll
	xprtrdma: Rename frwr_release_mr()
	xprtrdma: Fix rpcrdma_reqs_reset()
	SUNRPC: avoid soft lockup when transmitting UDP to reachable server.
	ext4: avoid writing unitialized memory to disk in EA inodes
	sparc64: Fix incorrect function signature and add prototype for prom_cif_init
	SUNRPC: Fixup gss_status tracepoint error output
	PCI: Fix resource double counting on remove & rescan
	coresight: Fix ref leak when of_coresight_parse_endpoint() fails
	Input: qt1050 - handle CHIP_ID reading error
	RDMA/mlx4: Fix truncated output warning in mad.c
	RDMA/mlx4: Fix truncated output warning in alias_GUID.c
	RDMA/rxe: Don't set BTH_ACK_MASK for UC or UD QPs
	ASoC: max98088: Check for clk_prepare_enable() error
	mtd: make mtd_test.c a separate module
	RDMA/device: Return error earlier if port in not valid
	Input: elan_i2c - do not leave interrupt disabled on suspend failure
	MIPS: Octeron: remove source file executable bit
	powerpc/xmon: Fix disassembly CPU feature checks
	macintosh/therm_windtunnel: fix module unload.
	RDMA/hns: Fix missing pagesize and alignment check in FRMR
	bnxt_re: Fix imm_data endianness
	netfilter: ctnetlink: use helper function to calculate expect ID
	net: dsa: mv88e6xxx: Limit chip-wide frame size config to CPU ports
	net: dsa: b53: Limit chip-wide jumbo frame config to CPU ports
	pinctrl: rockchip: update rk3308 iomux routes
	pinctrl: core: fix possible memory leak when pinctrl_enable() fails
	pinctrl: single: fix possible memory leak when pinctrl_enable() fails
	pinctrl: ti: ti-iodelay: Drop if block with always false condition
	pinctrl: ti: ti-iodelay: fix possible memory leak when pinctrl_enable() fails
	pinctrl: freescale: mxs: Fix refcount of child
	fs/proc/task_mmu: indicate PM_FILE for PMD-mapped file THP
	fs/nilfs2: remove some unused macros to tame gcc
	nilfs2: avoid undefined behavior in nilfs_cnt32_ge macro
	rtc: interface: Add RTC offset to alarm after fix-up
	dt-bindings: thermal: correct thermal zone node name limit
	tick/broadcast: Make takeover of broadcast hrtimer reliable
	net: netconsole: Disable target before netpoll cleanup
	af_packet: Handle outgoing VLAN packets without hardware offloading
	ipv6: take care of scope when choosing the src addr
	sched/fair: set_load_weight() must also call reweight_task() for SCHED_IDLE tasks
	char: tpm: Fix possible memory leak in tpm_bios_measurements_open()
	media: venus: fix use after free in vdec_close
	hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
	ext2: Verify bitmap and itable block numbers before using them
	drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes
	drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes
	scsi: qla2xxx: Fix optrom version displayed in FDMI
	drm/amd/display: Check for NULL pointer
	sched/fair: Use all little CPUs for CPU-bound workloads
	apparmor: use kvfree_sensitive to free data->data
	task_work: s/task_work_cancel()/task_work_cancel_func()/
	task_work: Introduce task_work_cancel() again
	udf: Avoid using corrupted block bitmap buffer
	m68k: amiga: Turn off Warp1260 interrupts during boot
	ext4: check dot and dotdot of dx_root before making dir indexed
	ext4: make sure the first directory block is not a hole
	wifi: mwifiex: Fix interface type change
	leds: ss4200: Convert PCIBIOS_* return codes to errnos
	jbd2: make jbd2_journal_get_max_txn_bufs() internal
	KVM: VMX: Split out the non-virtualization part of vmx_interrupt_blocked()
	tools/memory-model: Fix bug in lock.cat
	hwrng: amd - Convert PCIBIOS_* return codes to errnos
	PCI: hv: Return zero, not garbage, when reading PCI_INTERRUPT_PIN
	PCI: rockchip: Use GPIOD_OUT_LOW flag while requesting ep_gpio
	binder: fix hang of unregistered readers
	dev/parport: fix the array out-of-bounds risk
	scsi: qla2xxx: Return ENOBUFS if sg_cnt is more than one for ELS cmds
	f2fs: fix to don't dirty inode for readonly filesystem
	clk: davinci: da8xx-cfgchip: Initialize clk_init_data before use
	ubi: eba: properly rollback inside self_check_eba
	decompress_bunzip2: fix rare decompression failure
	kbuild: Fix '-S -c' in x86 stack protector scripts
	kobject_uevent: Fix OOB access within zap_modalias_env()
	devres: Fix devm_krealloc() wasting memory
	rtc: cmos: Fix return value of nvmem callbacks
	scsi: qla2xxx: During vport delete send async logout explicitly
	scsi: qla2xxx: Fix for possible memory corruption
	scsi: qla2xxx: Fix flash read failure
	scsi: qla2xxx: Complete command early within lock
	scsi: qla2xxx: validate nvme_local_port correctly
	perf/x86/intel/pt: Fix topa_entry base length
	perf/x86/intel/pt: Fix a topa_entry base address calculation
	rtc: isl1208: Fix return value of nvmem callbacks
	watchdog/perf: properly initialize the turbo mode timestamp and rearm counter
	platform: mips: cpu_hwmon: Disable driver on unsupported hardware
	RDMA/iwcm: Fix a use-after-free related to destroying CM IDs
	selftests/sigaltstack: Fix ppc64 GCC build
	rbd: don't assume rbd_is_lock_owner() for exclusive mappings
	MIPS: ip30: ip30-console: Add missing include
	MIPS: Loongson64: env: Hook up Loongsson-2K
	drm/panfrost: Mark simple_ondemand governor as softdep
	rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait
	rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings
	Bluetooth: btusb: Add RTL8852BE device 0489:e125 to device tables
	Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x13d3:0x3591
	nilfs2: handle inconsistent state in nilfs_btnode_create_block()
	io_uring/io-wq: limit retrying worker initialisation
	kernel: rerun task_work while freezing in get_signal()
	kdb: address -Wformat-security warnings
	kdb: Use the passed prompt in kdb_position_cursor()
	jfs: Fix array-index-out-of-bounds in diFree
	um: time-travel: fix time-travel-start option
	f2fs: fix start segno of large section
	libbpf: Fix no-args func prototype BTF dumping syntax
	dma: fix call order in dmam_free_coherent
	MIPS: SMP-CPS: Fix address for GCR_ACCESS register for CM3 and later
	ipv4: Fix incorrect source address in Record Route option
	net: bonding: correctly annotate RCU in bond_should_notify_peers()
	netfilter: nft_set_pipapo_avx2: disable softinterrupts
	tipc: Return non-zero value from tipc_udp_addr2str() on error
	net: stmmac: Correct byte order of perfect_match
	net: nexthop: Initialize all fields in dumped nexthops
	bpf: Fix a segment issue when downgrading gso_size
	mISDN: Fix a use after free in hfcmulti_tx()
	apparmor: Fix null pointer deref when receiving skb during sock creation
	powerpc: fix a file leak in kvm_vcpu_ioctl_enable_cap()
	lirc: rc_dev_get_from_fd(): fix file leak
	ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is reachable
	ceph: fix incorrect kmalloc size of pagevec mempool
	nvme: split command copy into a helper
	nvme-pci: add missing condition check for existence of mapped data
	fs: don't allow non-init s_user_ns for filesystems without FS_USERNS_MOUNT
	powerpc/configs: Update defconfig with now user-visible CONFIG_FSL_IFC
	fuse: name fs_context consistently
	fuse: verify {g,u}id mount options correctly
	sysctl: always initialize i_uid/i_gid
	ext4: factor out a common helper to query extent map
	ext4: check the extent status again before inserting delalloc block
	soc: xilinx: move PM_INIT_FINALIZE to zynqmp_pm_domains driver
	drivers: soc: xilinx: check return status of get_api_version()
	driver core: Cast to (void *) with __force for __percpu pointer
	devres: Fix memory leakage caused by driver API devm_free_percpu()
	genirq: Allow the PM device to originate from irq domain
	irqchip/imx-irqsteer: Constify irq_chip struct
	irqchip/imx-irqsteer: Add runtime PM support
	irqchip/imx-irqsteer: Handle runtime power management correctly
	remoteproc: imx_rproc: ignore mapping vdev regions
	remoteproc: imx_rproc: Fix ignoring mapping vdev regions
	remoteproc: imx_rproc: Skip over memory region when node value is NULL
	drm/nouveau: prime: fix refcount underflow
	drm/vmwgfx: Fix overlay when using Screen Targets
	sched: act_ct: take care of padding in struct zones_ht_key
	net/iucv: fix use after free in iucv_sock_close()
	net/mlx5e: Add a check for the return value from mlx5_port_set_eth_ptys
	ipv6: fix ndisc_is_useropt() handling for PIO
	riscv/mm: Add handling for VM_FAULT_SIGSEGV in mm_fault_error()
	platform/chrome: cros_ec_proto: Lock device when updating MKBP version
	HID: wacom: Modify pen IDs
	protect the fetch of ->fd[fd] in do_dup2() from mispredictions
	ALSA: usb-audio: Correct surround channels in UAC1 channel map
	ALSA: hda/realtek: Add quirk for Acer Aspire E5-574G
	net: usb: sr9700: fix uninitialized variable use in sr_mdio_read
	r8169: don't increment tx_dropped in case of NETDEV_TX_BUSY
	mptcp: fix duplicate data handling
	netfilter: ipset: Add list flush to cancel_gc
	genirq: Allow irq_chip registration functions to take a const irq_chip
	irqchip/mbigen: Fix mbigen node address layout
	x86/mm: Fix pti_clone_pgtable() alignment assumption
	x86/mm: Fix pti_clone_entry_text() for i386
	sctp: move hlist_node and hashent out of sctp_ep_common
	sctp: Fix null-ptr-deref in reuseport_add_sock().
	net: usb: qmi_wwan: fix memory leak for not ip packets
	net: linkwatch: use system_unbound_wq
	Bluetooth: l2cap: always unlock channel in l2cap_conless_channel()
	net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register()
	l2tp: fix lockdep splat
	net: fec: Stop PPS on driver remove
	rcutorture: Fix rcu_torture_fwd_cb_cr() data race
	md: do not delete safemode_timer in mddev_suspend
	md/raid5: avoid BUG_ON() while continue reshape after reassembling
	clocksource/drivers/sh_cmt: Address race condition for clock events
	ACPI: battery: create alarm sysfs attribute atomically
	ACPI: SBS: manage alarm sysfs attribute through psy core
	selftests/bpf: Fix send_signal test with nested CONFIG_PARAVIRT
	PCI: Add Edimax Vendor ID to pci_ids.h
	udf: prevent integer overflow in udf_bitmap_free_blocks()
	wifi: nl80211: don't give key data to userspace
	btrfs: fix bitmap leak when loading free space cache on duplicate entry
	drm/amdgpu: Fix the null pointer dereference to ras_manager
	drm/amdgpu/pm: Fix the null pointer dereference in apply_state_adjust_rules
	media: uvcvideo: Ignore empty TS packets
	media: uvcvideo: Fix the bandwdith quirk on USB 3.x
	jbd2: avoid memleak in jbd2_journal_write_metadata_buffer
	s390/sclp: Prevent release of buffer in I/O
	SUNRPC: Fix a race to wake a sync task
	sched/cputime: Fix mul_u64_u64_div_u64() precision for cputime
	ext4: fix wrong unit use in ext4_mb_find_by_goal
	arm64: cpufeature: Force HWCAP to be based on the sysreg visible to user-space
	arm64: Add Neoverse-V2 part
	arm64: cputype: Add Cortex-X4 definitions
	arm64: cputype: Add Neoverse-V3 definitions
	arm64: errata: Add workaround for Arm errata 3194386 and 3312417
	arm64: cputype: Add Cortex-X3 definitions
	arm64: cputype: Add Cortex-A720 definitions
	arm64: cputype: Add Cortex-X925 definitions
	arm64: errata: Unify speculative SSBS errata logic
	arm64: errata: Expand speculative SSBS workaround
	arm64: cputype: Add Cortex-X1C definitions
	arm64: cputype: Add Cortex-A725 definitions
	arm64: errata: Expand speculative SSBS workaround (again)
	i2c: smbus: Improve handling of stuck alerts
	ASoC: codecs: wsa881x: Correct Soundwire ports mask
	i2c: smbus: Send alert notifications to all devices if source not found
	bpf: kprobe: remove unused declaring of bpf_kprobe_override
	kprobes: Fix to check symbol prefixes correctly
	spi: spi-fsl-lpspi: Fix scldiv calculation
	ALSA: usb-audio: Re-add ScratchAmp quirk entries
	drm/client: fix null pointer dereference in drm_client_modeset_probe
	ALSA: line6: Fix racy access to midibuf
	ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list
	ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4
	usb: vhci-hcd: Do not drop references before new references are gained
	USB: serial: debug: do not echo input by default
	usb: gadget: core: Check for unset descriptor
	usb: gadget: u_serial: Set start_delayed during suspend
	scsi: ufs: core: Fix hba->last_dme_cmd_tstamp timestamp updating logic
	tick/broadcast: Move per CPU pointer access into the atomic section
	ntp: Clamp maxerror and esterror to operating range
	driver core: Fix uevent_show() vs driver detach race
	ntp: Safeguard against time_constant overflow
	scsi: mpt3sas: Remove scsi_dma_map() error messages
	scsi: mpt3sas: Avoid IOMMU page faults on REPORT ZONES
	irqchip/meson-gpio: support more than 8 channels gpio irq
	irqchip/meson-gpio: Convert meson_gpio_irq_controller::lock to 'raw_spinlock_t'
	serial: core: check uartclk for zero to avoid divide by zero
	irqchip/xilinx: Fix shift out of bounds
	genirq/irqdesc: Honor caller provided affinity in alloc_desc()
	power: supply: axp288_charger: Fix constant_charge_voltage writes
	power: supply: axp288_charger: Round constant_charge_voltage writes down
	tracing: Fix overflow in get_free_elt()
	padata: Fix possible divide-by-0 panic in padata_mt_helper()
	x86/mtrr: Check if fixed MTRRs exist before saving them
	drm/bridge: analogix_dp: properly handle zero sized AUX transactions
	drm/mgag200: Set DDC timeout in milliseconds
	mptcp: sched: check both directions for backup
	mptcp: distinguish rcv vs sent backup flag in requests
	mptcp: fix NL PM announced address accounting
	mptcp: mib: count MPJ with backup flag
	mptcp: export local_address
	mptcp: pm: fix backup support in signal endpoints
	samples: Add fs error monitoring example
	samples: Make fs-monitor depend on libc and headers
	Add gitignore file for samples/fanotify/ subdirectory
	Fix gcc 4.9 build issue in 5.10.y
	PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal
	netfilter: nf_tables: set element extended ACK reporting support
	netfilter: nf_tables: use timestamp to check for set element timeout
	netfilter: nf_tables: allow clone callbacks to sleep
	netfilter: nf_tables: prefer nft_chain_validate
	drm/i915/gem: Fix Virtual Memory mapping boundaries calculation
	powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt.
	arm64: cpufeature: Fix the visibility of compat hwcaps
	media: uvcvideo: Use entity get_cur in uvc_ctrl_set
	exec: Fix ToCToU between perm check and set-uid/gid usage
	nvme/pci: Add APST quirk for Lenovo N60z laptop
	vdpa: Make use of PFN_PHYS/PFN_UP/PFN_DOWN helper macro
	vhost-vdpa: switch to use vmf_insert_pfn() in the fault handler
	wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
	ARM: dts: imx6qdl-kontron-samx6i: fix phy-mode
	media: Revert "media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()"
	Linux 5.10.224

Change-Id: I7cd19d506c4c86df918a280598946060a494a161
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-09-04 11:06:25 +00:00
Shigeru Yoshida
aa38bf7489 tipc: Return non-zero value from tipc_udp_addr2str() on error 
[ Upstream commit fa96c6baef1b5385e2f0c0677b32b3839e716076 ]

tipc_udp_addr2str() should return non-zero value if the UDP media
address is invalid. Otherwise, a buffer overflow access can occur in
tipc_media_addr_printf(). Fix this by returning 1 on an invalid UDP
media address.

Fixes: d0f91938be ("tipc: add ip/udp media type")
Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
Reviewed-by: Tung Nguyen <tung.q.nguyen@endava.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2024-08-19 05:41:04 +02:00
Greg Kroah-Hartman
2ebd481b31 Merge 5.10.221 into android12-5.10-lts 
Changes in 5.10.221
	tracing/selftests: Fix kprobe event name test for .isra. functions
	null_blk: Print correct max open zones limit in null_init_zoned_dev()
	wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects
	wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()
	wifi: cfg80211: pmsr: use correct nla_get_uX functions
	wifi: iwlwifi: mvm: revert gen2 TX A-MPDU size to 64
	wifi: iwlwifi: dbg_ini: move iwl_dbg_tlv_free outside of debugfs ifdef
	wifi: iwlwifi: mvm: check n_ssids before accessing the ssids
	wifi: iwlwifi: mvm: don't read past the mfuart notifcation
	wifi: mac80211: correctly parse Spatial Reuse Parameter Set element
	net/ncsi: add NCSI Intel OEM command to keep PHY up
	net/ncsi: Simplify Kconfig/dts control flow
	net/ncsi: Fix the multi thread manner of NCSI driver
	ipv6: sr: block BH in seg6_output_core() and seg6_input_core()
	net: sched: sch_multiq: fix possible OOB write in multiq_tune()
	vxlan: Fix regression when dropping packets due to invalid src addresses
	tcp: count CLOSE-WAIT sockets for TCP_MIB_CURRESTAB
	net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP
	ptp: Fix error message on failed pin verification
	af_unix: Annotate data-race of sk->sk_state in unix_inq_len().
	af_unix: Annotate data-races around sk->sk_state in unix_write_space() and poll().
	af_unix: Annotate data-races around sk->sk_state in sendmsg() and recvmsg().
	af_unix: Annotate data-races around sk->sk_state in UNIX_DIAG.
	af_unix: Annotate data-race of net->unx.sysctl_max_dgram_qlen.
	af_unix: Use unix_recvq_full_lockless() in unix_stream_connect().
	af_unix: Use skb_queue_len_lockless() in sk_diag_show_rqlen().
	af_unix: Annotate data-race of sk->sk_shutdown in sk_diag_fill().
	ipv6: fix possible race in __fib6_drop_pcpu_from()
	usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete
	drm/amd/display: Handle Y carry-over in VCP X.Y calculation
	serial: sc16is7xx: replace hardcoded divisor value with BIT() macro
	serial: sc16is7xx: fix bug in sc16is7xx_set_baud() when using prescaler
	mmc: davinci: Don't strip remove function when driver is builtin
	selftests/mm: compaction_test: fix incorrect write of zero to nr_hugepages
	selftests/mm: conform test to TAP format output
	selftests/mm: compaction_test: fix bogus test success on Aarch64
	btrfs: fix leak of qgroup extent records after transaction abort
	nilfs2: Remove check for PageError
	nilfs2: return the mapped address from nilfs_get_page()
	nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors
	USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
	mei: me: release irq in mei_me_pci_resume error path
	jfs: xattr: fix buffer overflow for invalid xattr
	xhci: Set correct transferred length for cancelled bulk transfers
	xhci: Apply reset resume quirk to Etron EJ188 xHCI host
	xhci: Apply broken streams quirk to Etron EJ188 xHCI host
	scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory
	powerpc/uaccess: Fix build errors seen with GCC 13/14
	Input: try trimming too long modalias strings
	SUNRPC: return proper error from gss_wrap_req_priv
	gpio: tqmx86: fix typo in Kconfig label
	HID: core: remove unnecessary WARN_ON() in implement()
	gpio: tqmx86: store IRQ trigger type and unmask status separately
	iommu/amd: Introduce pci segment structure
	iommu/amd: Fix sysfs leak in iommu init
	iommu: Return right value in iommu_sva_bind_device()
	HID: logitech-dj: Fix memory leak in logi_dj_recv_switch_to_dj_mode()
	drm/vmwgfx: 3D disabled should not effect STDU memory limits
	net: sfp: Always call `sfp_sm_mod_remove()` on remove
	net: hns3: add cond_resched() to hns3 ring buffer init process
	liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet
	drm/komeda: check for error-valued pointer
	drm/bridge/panel: Fix runtime warning on panel bridge release
	tcp: fix race in tcp_v6_syn_recv_sock()
	net/mlx5e: Fix features validation check for tunneled UDP (non-VXLAN) packets
	Bluetooth: L2CAP: Fix rejecting L2CAP_CONN_PARAM_UPDATE_REQ
	netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type
	net: stmmac: replace priv->speed with the portTransmitRate from the tc-cbs parameters
	net/ipv6: Fix the RT cache flush via sysctl using a previous delay
	ionic: fix use after netif_napi_del()
	iio: adc: ad9467: fix scan type sign
	iio: dac: ad5592r: fix temperature channel scaling value
	iio: imu: inv_icm42600: delete unneeded update watermark call
	drivers: core: synchronize really_probe() and dev_uevent()
	drm/exynos/vidi: fix memory leak in .get_modes()
	drm/exynos: hdmi: report safe 640x480 mode as a fallback when no EDID found
	vmci: prevent speculation leaks by sanitizing event in event_deliver()
	fs/proc: fix softlockup in __read_vmcore
	ocfs2: use coarse time for new created files
	ocfs2: fix races between hole punching and AIO+DIO
	PCI: rockchip-ep: Remove wrong mask on subsys_vendor_id
	dmaengine: axi-dmac: fix possible race in remove()
	remoteproc: k3-r5: Do not allow core1 to power up before core0 via sysfs
	intel_th: pci: Add Granite Rapids support
	intel_th: pci: Add Granite Rapids SOC support
	intel_th: pci: Add Sapphire Rapids SOC support
	intel_th: pci: Add Meteor Lake-S support
	intel_th: pci: Add Lunar Lake support
	nilfs2: fix potential kernel bug due to lack of writeback flag waiting
	tick/nohz_full: Don't abuse smp_call_function_single() in tick_setup_device()
	serial: 8250_pxa: Configure tx_loadsz to match FIFO IRQ level
	hugetlb_encode.h: fix undefined behaviour (34 << 26)
	mptcp: ensure snd_una is properly initialized on connect
	mptcp: pm: inc RmAddr MIB counter once per RM_ADDR ID
	mptcp: pm: update add_addr counters after connect
	remoteproc: k3-r5: Jump to error handling labels in start/stop errors
	greybus: Fix use-after-free bug in gb_interface_release due to race condition.
	usb-storage: alauda: Check whether the media is initialized
	i2c: at91: Fix the functionality flags of the slave-only interface
	i2c: designware: Fix the functionality flags of the slave-only interface
	zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING
	padata: Disable BH when taking works lock on MT path
	rcutorture: Fix rcu_torture_one_read() pipe_count overflow comment
	rcutorture: Fix invalid context warning when enable srcu barrier testing
	block/ioctl: prefer different overflow check
	selftests/bpf: Prevent client connect before server bind in test_tc_tunnel.sh
	selftests/bpf: Fix flaky test btf_map_in_map/lookup_update
	batman-adv: bypass empty buckets in batadv_purge_orig_ref()
	wifi: ath9k: work around memset overflow warning
	af_packet: avoid a false positive warning in packet_setsockopt()
	drop_monitor: replace spin_lock by raw_spin_lock
	scsi: qedi: Fix crash while reading debugfs attribute
	kselftest: arm64: Add a null pointer check
	netpoll: Fix race condition in netpoll_owner_active
	HID: Add quirk for Logitech Casa touchpad
	ACPI: video: Add backlight=native quirk for Lenovo Slim 7 16ARH7
	Bluetooth: ath3k: Fix multiple issues reported by checkpatch.pl
	drm/amd/display: Exit idle optimizations before HDCP execution
	ASoC: Intel: sof_sdw: add JD2 quirk for HP Omen 14
	drm/lima: add mask irq callback to gp and pp
	drm/lima: mask irqs in timeout path before hard reset
	powerpc/pseries: Enforce hcall result buffer validity and size
	powerpc/io: Avoid clang null pointer arithmetic warnings
	power: supply: cros_usbpd: provide ID table for avoiding fallback match
	iommu/arm-smmu-v3: Free MSIs in case of ENOMEM
	f2fs: remove clear SB_INLINECRYPT flag in default_options
	usb: misc: uss720: check for incompatible versions of the Belkin F5U002
	udf: udftime: prevent overflow in udf_disk_stamp_to_time()
	PCI/PM: Avoid D3cold for HP Pavilion 17 PC/1972 PCIe Ports
	MIPS: Octeon: Add PCIe link status check
	serial: exar: adding missing CTI and Exar PCI ids
	MIPS: Routerboard 532: Fix vendor retry check code
	mips: bmips: BCM6358: make sure CBR is correctly set
	tracing: Build event generation tests only as modules
	cipso: fix total option length computation
	netrom: Fix a memory leak in nr_heartbeat_expiry()
	ipv6: prevent possible NULL deref in fib6_nh_init()
	ipv6: prevent possible NULL dereference in rt6_probe()
	xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()
	netns: Make get_net_ns() handle zero refcount net
	qca_spi: Make interrupt remembering atomic
	net/sched: act_api: rely on rcu in tcf_idr_check_alloc
	net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()
	tipc: force a dst refcount before doing decryption
	net/sched: act_ct: set 'net' pointer when creating new nf_flow_table
	sched: act_ct: add netns into the key of tcf_ct_flow_table
	net: stmmac: No need to calculate speed divider when offload is disabled
	virtio_net: checksum offloading handling fix
	netfilter: ipset: Fix suspicious rcu_dereference_protected()
	net: usb: rtl8150 fix unintiatilzed variables in rtl8150_get_link_ksettings
	regulator: core: Fix modpost error "regulator_get_regmap" undefined
	dmaengine: ioat: switch from 'pci_' to 'dma_' API
	dmaengine: ioat: Drop redundant pci_enable_pcie_error_reporting()
	dmaengine: ioatdma: Fix leaking on version mismatch
	dmaengine: ioat: use PCI core macros for PCIe Capability
	dmaengine: ioatdma: Fix error path in ioat3_dma_probe()
	dmaengine: ioatdma: Fix kmemleak in ioat_pci_probe()
	dmaengine: ioatdma: Fix missing kmem_cache_destroy()
	ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine."
	RDMA/mlx5: Add check for srq max_sge attribute
	ALSA: hda/realtek: Limit mic boost on N14AP7
	drm/radeon: fix UBSAN warning in kv_dpm.c
	gcov: add support for GCC 14
	kcov: don't lose track of remote references during softirqs
	i2c: ocores: set IACK bit after core is enabled
	dt-bindings: i2c: google,cros-ec-i2c-tunnel: correct path to i2c-controller schema
	drm/amd/display: revert Exit idle optimizations before HDCP execution
	ARM: dts: samsung: smdkv310: fix keypad no-autorepeat
	ARM: dts: samsung: exynos4412-origen: fix keypad no-autorepeat
	ARM: dts: samsung: smdk4412: fix keypad no-autorepeat
	rtlwifi: rtl8192de: Style clean-ups
	wifi: rtlwifi: rtl8192de: Fix 5 GHz TX power
	pmdomain: ti-sci: Fix duplicate PD referrals
	knfsd: LOOKUP can return an illegal error value
	spmi: hisi-spmi-controller: Do not override device identifier
	bcache: fix variable length array abuse in btree_iter
	tracing: Add MODULE_DESCRIPTION() to preemptirq_delay_test
	x86/cpu/vfm: Add new macros to work with (vendor/family/model) values
	x86/cpu: Fix x86_match_cpu() to match just X86_VENDOR_INTEL
	r8169: remove unneeded memory barrier in rtl_tx
	r8169: improve rtl_tx
	r8169: improve rtl8169_start_xmit
	r8169: remove nr_frags argument from rtl_tx_slots_avail
	r8169: remove not needed check in rtl8169_start_xmit
	r8169: Fix possible ring buffer corruption on fragmented Tx packets.
	Revert "kheaders: substituting --sort in archive creation"
	kheaders: explicitly define file modes for archived headers
	perf/core: Fix missing wakeup when waiting for context reference
	PCI: Add PCI_ERROR_RESPONSE and related definitions
	x86/amd_nb: Check for invalid SMN reads
	cifs: missed ref-counting smb session in find
	smb: client: fix deadlock in smb2_find_smb_tcon()
	ACPI: Add quirks for AMD Renoir/Lucienne CPUs to force the D3 hint
	ACPI: x86: Add a quirk for Dell Inspiron 14 2-in-1 for StorageD3Enable
	ACPI: x86: Add another system to quirk list for forcing StorageD3Enable
	ACPI: x86: utils: Add Cezanne to the list for forcing StorageD3Enable
	ACPI: x86: utils: Add Picasso to the list for forcing StorageD3Enable
	ACPI: x86: Force StorageD3Enable on more products
	Input: ili210x - fix ili251x_read_touch_data() return value
	pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER
	pinctrl: rockchip: fix pinmux bits for RK3328 GPIO2-B pins
	pinctrl: rockchip: fix pinmux bits for RK3328 GPIO3-B pins
	pinctrl/rockchip: separate struct rockchip_pin_bank to a head file
	pinctrl: rockchip: use dedicated pinctrl type for RK3328
	pinctrl: rockchip: fix pinmux reset in rockchip_pmx_set
	drm/amdgpu: fix UBSAN warning in kv_dpm.c
	netfilter: nf_tables: validate family when identifying table via handle
	SUNRPC: Fix null pointer dereference in svc_rqst_free()
	SUNRPC: Fix a NULL pointer deref in trace_svc_stats_latency()
	SUNRPC: Fix svcxdr_init_decode's end-of-buffer calculation
	SUNRPC: Fix svcxdr_init_encode's buflen calculation
	nfsd: hold a lighter-weight client reference over CB_RECALL_ANY
	ASoC: fsl-asoc-card: set priv->pdev before using it
	net: dsa: microchip: fix initial port flush problem
	net: phy: micrel: add Microchip KSZ 9477 to the device table
	xdp: Move the rxq_info.mem clearing to unreg_mem_model()
	xdp: Allow registering memory model without rxq reference
	xdp: Remove WARN() from __xdp_reg_mem_model()
	sparc: fix old compat_sys_select()
	sparc: fix compat recv/recvfrom syscalls
	parisc: use correct compat recv/recvfrom syscalls
	netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers
	drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep
	mtd: partitions: redboot: Added conversion of operands to a larger type
	bpf: Add a check for struct bpf_fib_lookup size
	net/iucv: Avoid explicit cpumask var allocation on stack
	net/dpaa2: Avoid explicit cpumask var allocation on stack
	ALSA: emux: improve patch ioctl data validation
	media: dvbdev: Initialize sbuf
	soc: ti: wkup_m3_ipc: Send NULL dummy message instead of pointer message
	drm/radeon/radeon_display: Decrease the size of allocated memory
	nvme: fixup comment for nvme RDMA Provider Type
	drm/panel: simple: Add missing display timing flags for KOE TX26D202VM0BWA
	gpio: davinci: Validate the obtained number of IRQs
	gpiolib: cdev: Disallow reconfiguration without direction (uAPI v1)
	x86: stop playing stack games in profile_pc()
	ocfs2: fix DIO failure due to insufficient transaction credits
	mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
	mmc: sdhci: Do not invert write-protect twice
	mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
	counter: ti-eqep: enable clock at probe
	iio: adc: ad7266: Fix variable checking bug
	iio: chemical: bme680: Fix pressure value output
	iio: chemical: bme680: Fix calibration data variable
	iio: chemical: bme680: Fix overflows in compensate() functions
	iio: chemical: bme680: Fix sensor data read operation
	net: usb: ax88179_178a: improve link status logs
	usb: gadget: printer: SS+ support
	usb: gadget: printer: fix races against disable
	usb: musb: da8xx: fix a resource leak in probe()
	usb: atm: cxacru: fix endpoint checking in cxacru_bind()
	serial: 8250_omap: Implementation of Errata i2310
	tty: mcf: MCF54418 has 10 UARTS
	net: can: j1939: Initialize unused data in j1939_send_one()
	net: can: j1939: recover socket queue on CAN bus error during BAM transmission
	net: can: j1939: enhanced error handling for tightly received RTS messages in xtp_rx_rts_session_new
	kbuild: Install dtb files as 0644 in Makefile.dtbinst
	csky, hexagon: fix broken sys_sync_file_range
	hexagon: fix fadvise64_64 calling conventions
	drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes
	drm/i915/gt: Fix potential UAF by revoke of fence registers
	drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes
	batman-adv: Don't accept TT entries for out-of-spec VIDs
	ata: ahci: Clean up sysfs file on error
	ata: libata-core: Fix double free on error
	ftruncate: pass a signed offset
	syscalls: fix compat_sys_io_pgetevents_time64 usage
	mtd: spinand: macronix: Add support for serial NAND flash
	pwm: stm32: Refuse too small period requests
	nfs: Leave pages in the pagecache if readpage failed
	ipv6: annotate some data-races around sk->sk_prot
	ipv6: Fix data races around sk->sk_prot.
	tcp: Fix data races around icsk->icsk_af_ops.
	drivers: fix typo in firmware/efi/memmap.c
	efi: Correct comment on efi_memmap_alloc
	efi: memmap: Move manipulation routines into x86 arch tree
	efi: xen: Set EFI_PARAVIRT for Xen dom0 boot on all architectures
	efi/x86: Free EFI memory map only when installing a new one.
	KVM: arm64: vgic-v4: Make the doorbell request robust w.r.t preemption
	ARM: dts: rockchip: rk3066a: add #sound-dai-cells to hdmi node
	arm64: dts: rockchip: Add sound-dai-cells for RK3368
	xdp: xdp_mem_allocator can be NULL in trace_mem_connect().
	serial: 8250_omap: Fix Errata i2310 with RX FIFO level check
	tracing/net_sched: NULL pointer dereference in perf_trace_qdisc_reset()
	Linux 5.10.221

Change-Id: Icac1c62fcbda5102be7ea031121f28d6fee36875
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-07-17 09:08:09 +00:00
Xin Long
3eb1b39627 tipc: force a dst refcount before doing decryption 
[ Upstream commit 2ebe8f840c7450ecbfca9d18ac92e9ce9155e269 ]

As it says in commit 3bc07321cc ("xfrm: Force a dst refcount before
entering the xfrm type handlers"):

"Crypto requests might return asynchronous. In this case we leave the
 rcu protected region, so force a refcount on the skb's destination
 entry before we enter the xfrm type input/output handlers."

On TIPC decryption path it has the same problem, and skb_dst_force()
should be called before doing decryption to avoid a possible crash.

Shuang reported this issue when this warning is triggered:

  [] WARNING: include/net/dst.h:337 tipc_sk_rcv+0x1055/0x1ea0 [tipc]
  [] Kdump: loaded Tainted: G W --------- - - 4.18.0-496.el8.x86_64+debug
  [] Workqueue: crypto cryptd_queue_worker
  [] RIP: 0010:tipc_sk_rcv+0x1055/0x1ea0 [tipc]
  [] Call Trace:
  [] tipc_sk_mcast_rcv+0x548/0xea0 [tipc]
  [] tipc_rcv+0xcf5/0x1060 [tipc]
  [] tipc_aead_decrypt_done+0x215/0x2e0 [tipc]
  [] cryptd_aead_crypt+0xdb/0x190
  [] cryptd_queue_worker+0xed/0x190
  [] process_one_work+0x93d/0x17e0

Fixes: fc1b6d6de2 ("tipc: introduce TIPC encryption & authentication")
Reported-by: Shuang Li <shuali@redhat.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Link: https://lore.kernel.org/r/fbe3195fad6997a4eec62d9bf076b2ad03ac336b.1718476040.git.lucien.xin@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2024-07-05 09:12:38 +02:00
Greg Kroah-Hartman
dde5ece421 Merge 5.10.217 into android12-5.10-lts 
Changes in 5.10.217
	dmaengine: pl330: issue_pending waits until WFP state
	dmaengine: Revert "dmaengine: pl330: issue_pending waits until WFP state"
	wifi: nl80211: don't free NULL coalescing rule
	eeprom: at24: Use dev_err_probe for nvmem register failure
	eeprom: at24: Probe for DDR3 thermal sensor in the SPD case
	eeprom: at24: fix memory corruption race condition
	pinctrl: pinctrl-aspeed-g6: Fix register offset for pinconf of GPIOR-T
	pinctrl/meson: fix typo in PDM's pin name
	pinctrl: core: delete incorrect free in pinctrl_enable()
	pinctrl: mediatek: paris: Rework mtk_pinconf_{get,set} switch/case logic
	pinctrl: mediatek: paris: Fix PIN_CONFIG_INPUT_SCHMITT_ENABLE readback
	pinctrl: mediatek: paris: Rework support for PIN_CONFIG_{INPUT,OUTPUT}_ENABLE
	sunrpc: add a struct rpc_stats arg to rpc_create_args
	nfs: expose /proc/net/sunrpc/nfs in net namespaces
	nfs: make the rpc_stat per net namespace
	nfs: Handle error of rpc_proc_register() in nfs_net_init().
	power: rt9455: hide unused rt9455_boost_voltage_values
	pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
	regulator: mt6360: De-capitalize devicetree regulator subnodes
	s390/mm: Fix storage key clearing for guest huge pages
	s390/mm: Fix clearing storage keys for huge pages
	bna: ensure the copied buf is NUL terminated
	octeontx2-af: avoid off-by-one read from userspace
	nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().
	net l2tp: drop flow hash on forward
	s390/vdso: Add CFI for RA register to asm macro vdso_func
	net: qede: sanitize 'rc' in qede_add_tc_flower_fltr()
	net: qede: use return from qede_parse_flow_attr() for flower
	net: qede: use return from qede_parse_flow_attr() for flow_spec
	net: qede: use return from qede_parse_actions()
	ASoC: Fix 7/8 spaces indentation in Kconfig
	ASoC: meson: cards: select SND_DYNAMIC_MINORS
	cxgb4: Properly lock TX queue for the selftest.
	net: dsa: mv88e6xxx: Fix number of databases for 88E6141 / 88E6341
	net: bridge: fix multicast-to-unicast with fraglist GSO
	net: core: reject skb_copy(_expand) for fraglist GSO skbs
	tipc: fix a possible memleak in tipc_buf_append
	net: gro: add flush check in udp_gro_receive_segment
	clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
	KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id
	KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()
	scsi: lpfc: Update lpfc_ramp_down_queue_handler() logic
	gfs2: Fix invalid metadata access in punch_hole
	wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc
	wifi: cfg80211: fix rdev_dump_mpp() arguments order
	net: mark racy access on sk->sk_rcvbuf
	scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
	btrfs: return accurate error code on open failure in open_fs_devices()
	ALSA: line6: Zero-initialize message buffers
	net: bcmgenet: Reset RBUF on first open
	ata: sata_gemini: Check clk_enable() result
	firewire: ohci: mask bus reset interrupts between ISR and bottom half
	tools/power turbostat: Fix added raw MSR output
	tools/power turbostat: Fix Bzy_MHz documentation typo
	btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve
	btrfs: always clear PERTRANS metadata during commit
	scsi: target: Fix SELinux error when systemd-modules loads the target module
	blk-iocost: avoid out of bounds shift
	gpu: host1x: Do not setup DMA for virtual devices
	MIPS: scall: Save thread_info.syscall unconditionally on entry
	selftests: timers: Fix valid-adjtimex signed left-shift undefined behavior
	fs/9p: only translate RWX permissions for plain 9P2000
	fs/9p: translate O_TRUNC into OTRUNC
	9p: explicitly deny setlease attempts
	gpio: wcove: Use -ENOTSUPP consistently
	gpio: crystalcove: Use -ENOTSUPP consistently
	clk: Don't hold prepare_lock when calling kref_put()
	fs/9p: drop inodes immediately on non-.L too
	drm/nouveau/dp: Don't probe eDP ports twice harder
	net:usb:qmi_wwan: support Rolling modules
	xfrm: Preserve vlan tags for transport mode software GRO
	tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets
	tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
	Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout
	Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
	rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
	hwmon: (corsair-cpro) Use a separate buffer for sending commands
	hwmon: (corsair-cpro) Use complete_all() instead of complete() in ccp_raw_event()
	hwmon: (corsair-cpro) Protect ccp->wait_input_report with a spinlock
	phonet: fix rtm_phonet_notify() skb allocation
	kcov: Remove kcov include from sched.h and move it to its users.
	net: bridge: fix corrupted ethernet header on multicast-to-unicast
	ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
	net: hns3: use appropriate barrier function after setting a bit value
	btrfs: fix kvcalloc() arguments order in btrfs_ioctl_send()
	firewire: nosy: ensure user_length is taken into account when fetching packet contents
	arm64: dts: qcom: Fix 'interrupt-map' parent address cells
	usb: typec: ucsi: Check for notifications after init
	usb: typec: ucsi: Fix connector check on init
	usb: Fix regression caused by invalid ep0 maxpacket in virtual SuperSpeed device
	usb: ohci: Prevent missed ohci interrupts
	usb: gadget: composite: fix OS descriptors w_value logic
	usb: gadget: f_fs: Fix a race condition when processing setup packets.
	usb: xhci-plat: Don't include xhci.h
	usb: dwc3: core: Prevent phy suspend during init
	ALSA: hda/realtek: Fix mute led of HP Laptop 15-da3001TU
	iio:imu: adis16475: Fix sync mode setting
	iio: accel: mxc4005: Interrupt handling fixes
	tipc: fix UAF in error path
	net: bcmgenet: synchronize use of bcmgenet_set_rx_mode()
	ASoC: tegra: Fix DSPK 16-bit playback
	dyndbg: fix old BUG_ON in >control parser
	mei: me: add lunar lake point M DID
	drm/vmwgfx: Fix invalid reads in fence signaled events
	net: fix out-of-bounds access in ops_init
	hwmon: (pmbus/ucd9000) Increase delay from 250 to 500us
	regulator: core: fix debugfs creation regression
	keys: Fix overwrite of key expiration on instantiation
	md: fix kmemleak of rdev->serial
	Linux 5.10.217

Change-Id: I63eef00187948953d29febc26cc4c2c30166f7aa
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-06-14 13:21:33 +00:00
Paolo Abeni
367766ff9e tipc: fix UAF in error path 
commit 080cbb890286cd794f1ee788bbc5463e2deb7c2b upstream.

Sam Page (sam4k) working with Trend Micro Zero Day Initiative reported
a UAF in the tipc_buf_append() error path:

BUG: KASAN: slab-use-after-free in kfree_skb_list_reason+0x47e/0x4c0
linux/net/core/skbuff.c:1183
Read of size 8 at addr ffff88804d2a7c80 by task poc/8034

CPU: 1 PID: 8034 Comm: poc Not tainted 6.8.2 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.16.0-debian-1.16.0-5 04/01/2014
Call Trace:
 <IRQ>
 __dump_stack linux/lib/dump_stack.c:88
 dump_stack_lvl+0xd9/0x1b0 linux/lib/dump_stack.c:106
 print_address_description linux/mm/kasan/report.c:377
 print_report+0xc4/0x620 linux/mm/kasan/report.c:488
 kasan_report+0xda/0x110 linux/mm/kasan/report.c:601
 kfree_skb_list_reason+0x47e/0x4c0 linux/net/core/skbuff.c:1183
 skb_release_data+0x5af/0x880 linux/net/core/skbuff.c:1026
 skb_release_all linux/net/core/skbuff.c:1094
 __kfree_skb linux/net/core/skbuff.c:1108
 kfree_skb_reason+0x12d/0x210 linux/net/core/skbuff.c:1144
 kfree_skb linux/./include/linux/skbuff.h:1244
 tipc_buf_append+0x425/0xb50 linux/net/tipc/msg.c:186
 tipc_link_input+0x224/0x7c0 linux/net/tipc/link.c:1324
 tipc_link_rcv+0x76e/0x2d70 linux/net/tipc/link.c:1824
 tipc_rcv+0x45f/0x10f0 linux/net/tipc/node.c:2159
 tipc_udp_recv+0x73b/0x8f0 linux/net/tipc/udp_media.c:390
 udp_queue_rcv_one_skb+0xad2/0x1850 linux/net/ipv4/udp.c:2108
 udp_queue_rcv_skb+0x131/0xb00 linux/net/ipv4/udp.c:2186
 udp_unicast_rcv_skb+0x165/0x3b0 linux/net/ipv4/udp.c:2346
 __udp4_lib_rcv+0x2594/0x3400 linux/net/ipv4/udp.c:2422
 ip_protocol_deliver_rcu+0x30c/0x4e0 linux/net/ipv4/ip_input.c:205
 ip_local_deliver_finish+0x2e4/0x520 linux/net/ipv4/ip_input.c:233
 NF_HOOK linux/./include/linux/netfilter.h:314
 NF_HOOK linux/./include/linux/netfilter.h:308
 ip_local_deliver+0x18e/0x1f0 linux/net/ipv4/ip_input.c:254
 dst_input linux/./include/net/dst.h:461
 ip_rcv_finish linux/net/ipv4/ip_input.c:449
 NF_HOOK linux/./include/linux/netfilter.h:314
 NF_HOOK linux/./include/linux/netfilter.h:308
 ip_rcv+0x2c5/0x5d0 linux/net/ipv4/ip_input.c:569
 __netif_receive_skb_one_core+0x199/0x1e0 linux/net/core/dev.c:5534
 __netif_receive_skb+0x1f/0x1c0 linux/net/core/dev.c:5648
 process_backlog+0x101/0x6b0 linux/net/core/dev.c:5976
 __napi_poll.constprop.0+0xba/0x550 linux/net/core/dev.c:6576
 napi_poll linux/net/core/dev.c:6645
 net_rx_action+0x95a/0xe90 linux/net/core/dev.c:6781
 __do_softirq+0x21f/0x8e7 linux/kernel/softirq.c:553
 do_softirq linux/kernel/softirq.c:454
 do_softirq+0xb2/0xf0 linux/kernel/softirq.c:441
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x100/0x120 linux/kernel/softirq.c:381
 local_bh_enable linux/./include/linux/bottom_half.h:33
 rcu_read_unlock_bh linux/./include/linux/rcupdate.h:851
 __dev_queue_xmit+0x871/0x3ee0 linux/net/core/dev.c:4378
 dev_queue_xmit linux/./include/linux/netdevice.h:3169
 neigh_hh_output linux/./include/net/neighbour.h:526
 neigh_output linux/./include/net/neighbour.h:540
 ip_finish_output2+0x169f/0x2550 linux/net/ipv4/ip_output.c:235
 __ip_finish_output linux/net/ipv4/ip_output.c:313
 __ip_finish_output+0x49e/0x950 linux/net/ipv4/ip_output.c:295
 ip_finish_output+0x31/0x310 linux/net/ipv4/ip_output.c:323
 NF_HOOK_COND linux/./include/linux/netfilter.h:303
 ip_output+0x13b/0x2a0 linux/net/ipv4/ip_output.c:433
 dst_output linux/./include/net/dst.h:451
 ip_local_out linux/net/ipv4/ip_output.c:129
 ip_send_skb+0x3e5/0x560 linux/net/ipv4/ip_output.c:1492
 udp_send_skb+0x73f/0x1530 linux/net/ipv4/udp.c:963
 udp_sendmsg+0x1a36/0x2b40 linux/net/ipv4/udp.c:1250
 inet_sendmsg+0x105/0x140 linux/net/ipv4/af_inet.c:850
 sock_sendmsg_nosec linux/net/socket.c:730
 __sock_sendmsg linux/net/socket.c:745
 __sys_sendto+0x42c/0x4e0 linux/net/socket.c:2191
 __do_sys_sendto linux/net/socket.c:2203
 __se_sys_sendto linux/net/socket.c:2199
 __x64_sys_sendto+0xe0/0x1c0 linux/net/socket.c:2199
 do_syscall_x64 linux/arch/x86/entry/common.c:52
 do_syscall_64+0xd8/0x270 linux/arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x6f/0x77 linux/arch/x86/entry/entry_64.S:120
RIP: 0033:0x7f3434974f29
Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48
89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d
01 f0 ff ff 73 01 c3 48 8b 0d 37 8f 0d 00 f7 d8 64 89 01 48
RSP: 002b:00007fff9154f2b8 EFLAGS: 00000212 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f3434974f29
RDX: 00000000000032c8 RSI: 00007fff9154f300 RDI: 0000000000000003
RBP: 00007fff915532e0 R08: 00007fff91553360 R09: 0000000000000010
R10: 0000000000000000 R11: 0000000000000212 R12: 000055ed86d261d0
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>

In the critical scenario, either the relevant skb is freed or its
ownership is transferred into a frag_lists. In both cases, the cleanup
code must not free it again: we need to clear the skb reference earlier.

Fixes: 1149557d64 ("tipc: eliminate unnecessary linearization of incoming buffers")
Cc: stable@vger.kernel.org
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-23852
Acked-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/752f1ccf762223d109845365d07f55414058e5a3.1714484273.git.pabeni@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2024-05-17 11:48:10 +02:00
Xin Long
adbce6d20d tipc: fix a possible memleak in tipc_buf_append 
[ Upstream commit 97bf6f81b29a8efaf5d0983251a7450e5794370d ]

__skb_linearize() doesn't free the skb when it fails, so move
'*buf = NULL' after __skb_linearize(), so that the skb can be
freed on the err path.

Fixes: b7df21cf1b79 ("tipc: skb_linearize the head skb when reassembling msgs")
Reported-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Tung Nguyen <tung.q.nguyen@dektech.com.au>
Link: https://lore.kernel.org/r/90710748c29a1521efac4f75ea01b3b7e61414cf.1714485818.git.lucien.xin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2024-05-17 11:48:01 +02:00
Greg Kroah-Hartman
66e91da883 This is the 5.10.210 stable release 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmXYTLkACgkQONu9yGCS
 aT4+fhAAqqR/Cvx53ZKMQ8GZTCudAZnr/Dz6kWYwxhhhIbQjDpCaf9mgsrEDaQS2
 ancSZjzYaOUIXq/IsthXxQIUhiZbuM3iuSEi7+odWgSYdkFyzuUt8MWLBGSaB5Er
 ojn+APtq7vPXTSnp7uMwqMC3/BHCKkeYIjRVevhhHBKG5d3lzkV1xU8NcvMkLaly
 CIRxpWXD3w2b7K0GEbb/zN1GQEHDCQcxjuaJoe/5FKGJkqd3T31eyiJTRumCCMcz
 j8vkGkYmcMJpWf04iLgVA1p13I5/HGrXdEBI/GutN8IABIC3Cp42jW8phHYKW5ZM
 a4R25LZG5buND1Ubpq+EDrYn3EaPek5XRki0w8ZAXfNa3rYc+N6mQjkzNSOzhJ/5
 VNsn3EAE1Dwtar5Z3ASe9ugDbh+0bgx85PbfaADK88V+qWb3DVr1TBWmDNu2vfVP
 rv4I0EKu9r3vOE8aNMEBuhAVkIK3mEQUxwab6RKNrMby/5Uwa+ugrrUtQd8V+T1S
 j6r6v7u7aZ8mhYO7d6WSvAKL85lCWGbs3WRIKCJZmDRyqWrWW9tVWRN9wrZ2QnRr
 iaCQKk8P474P7/j1zwnmih8l4wS1oszveNziWwd0fi1Nn/WQYM+JKYQvpuQijmQ+
 J9jLyWo7a59zffIE6mzJdNwFy9hlw9X+VnJmExk/Q88Z7Bt5wPQ=
 =laYd
 -----END PGP SIGNATURE-----

Merge 5.10.210 into android12-5.10-lts

Changes in 5.10.210
	usb: cdns3: Fixes for sparse warnings
	usb: cdns3: fix uvc failure work since sg support enabled
	usb: cdns3: fix incorrect calculation of ep_buf_size when more than one config
	usb: cdns3: fix iso transfer error when mult is not zero
	usb: cdns3: Fix uvc fail when DMA cross 4k boundery since sg enabled
	PCI: mediatek: Clear interrupt status before dispatching handler
	units: change from 'L' to 'UL'
	units: add the HZ macros
	serial: sc16is7xx: set safe default SPI clock frequency
	spi: introduce SPI_MODE_X_MASK macro
	serial: sc16is7xx: add check for unsupported SPI modes during probe
	iio: adc: ad7091r: Set alert bit in config register
	iio: adc: ad7091r: Allow users to configure device events
	iio: adc: ad7091r: Enable internal vref if external vref is not supplied
	dmaengine: fix NULL pointer in channel unregistration function
	iio:adc:ad7091r: Move exports into IIO_AD7091R namespace.
	ext4: allow for the last group to be marked as trimmed
	crypto: api - Disallow identical driver names
	PM: hibernate: Enforce ordering during image compression/decompression
	hwrng: core - Fix page fault dead lock on mmap-ed hwrng
	crypto: s390/aes - Fix buffer overread in CTR mode
	rpmsg: virtio: Free driver_override when rpmsg_remove()
	bus: mhi: host: Drop chan lock before queuing buffers
	parisc/firmware: Fix F-extend for PDC addresses
	async: Split async_schedule_node_domain()
	async: Introduce async_schedule_dev_nocall()
	arm64: dts: qcom: sdm845: fix USB wakeup interrupt types
	arm64: dts: qcom: sdm845: fix USB DP/DM HS PHY interrupts
	lsm: new security_file_ioctl_compat() hook
	scripts/get_abi: fix source path leak
	mmc: core: Use mrq.sbc in close-ended ffu
	mmc: mmc_spi: remove custom DMA mapped buffers
	rtc: Adjust failure return code for cmos_set_alarm()
	nouveau/vmm: don't set addr on the fail path to avoid warning
	ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
	rename(): fix the locking of subdirectories
	block: Remove special-casing of compound pages
	stddef: Introduce DECLARE_FLEX_ARRAY() helper
	smb3: Replace smb2pdu 1-element arrays with flex-arrays
	mm: vmalloc: introduce array allocation functions
	KVM: use __vcalloc for very large allocations
	net/smc: fix illegal rmb_desc access in SMC-D connection dump
	tcp: make sure init the accept_queue's spinlocks once
	bnxt_en: Wait for FLR to complete during probe
	vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING
	llc: make llc_ui_sendmsg() more robust against bonding changes
	llc: Drop support for ETH_P_TR_802_2.
	net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv
	tracing: Ensure visibility when inserting an element into tracing_map
	afs: Hide silly-rename files from userspace
	tcp: Add memory barrier to tcp_push()
	netlink: fix potential sleeping issue in mqueue_flush_file
	ipv6: init the accept_queue's spinlocks in inet6_create
	net/mlx5: DR, Use the right GVMI number for drop action
	net/mlx5e: fix a double-free in arfs_create_groups
	netfilter: nf_tables: restrict anonymous set and map names to 16 bytes
	netfilter: nf_tables: validate NFPROTO_* family
	net: mvpp2: clear BM pool before initialization
	selftests: netdevsim: fix the udp_tunnel_nic test
	fjes: fix memleaks in fjes_hw_setup
	net: fec: fix the unhandled context fault from smmu
	btrfs: ref-verify: free ref cache before clearing mount opt
	btrfs: tree-checker: fix inline ref size in error messages
	btrfs: don't warn if discard range is not aligned to sector
	btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args
	btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
	rbd: don't move requests to the running list on errors
	exec: Fix error handling in begin_new_exec()
	wifi: iwlwifi: fix a memory corruption
	netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain
	netfilter: nf_tables: reject QUEUE/DROP verdict parameters
	gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-04
	drm: Don't unref the same fb many times by mistake due to deadlock handling
	drm/bridge: nxp-ptn3460: fix i2c_master_send() error checking
	drm/tidss: Fix atomic_flush check
	drm/bridge: nxp-ptn3460: simplify some error checking
	PM: sleep: Use dev_printk() when possible
	PM: sleep: Avoid calling put_device() under dpm_list_mtx
	PM: core: Remove unnecessary (void *) conversions
	PM: sleep: Fix possible deadlocks in core system-wide PM code
	fs/pipe: move check to pipe_has_watch_queue()
	pipe: wakeup wr_wait after setting max_usage
	ARM: dts: samsung: exynos4210-i9100: Unconditionally enable LDO12
	arm64: dts: qcom: sc7180: Use pdc interrupts for USB instead of GIC interrupts
	arm64: dts: qcom: sc7180: fix USB wakeup interrupt types
	media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run
	mm: use __pfn_to_section() instead of open coding it
	mm/sparsemem: fix race in accessing memory_section->usage
	btrfs: remove err variable from btrfs_delete_subvolume
	btrfs: avoid copying BTRFS_ROOT_SUBVOL_DEAD flag to snapshot of subvolume being deleted
	drm: panel-simple: add missing bus flags for Tianma tm070jvhg[30/33]
	drm/exynos: fix accidental on-stack copy of exynos_drm_plane
	drm/exynos: gsc: minor fix for loop iteration in gsc_runtime_resume
	gpio: eic-sprd: Clear interrupt after set the interrupt type
	spi: bcm-qspi: fix SFDP BFPT read by usig mspi read
	mips: Call lose_fpu(0) before initializing fcr31 in mips_set_personality_nan
	tick/sched: Preserve number of idle sleeps across CPU hotplug events
	x86/entry/ia32: Ensure s32 is sign extended to s64
	powerpc/mm: Fix null-pointer dereference in pgtable_cache_add
	drivers/perf: pmuv3: don't expose SW_INCR event in sysfs
	powerpc: Fix build error due to is_valid_bugaddr()
	powerpc/mm: Fix build failures due to arch_reserved_kernel_pages()
	x86/boot: Ignore NMIs during very early boot
	powerpc: pmd_move_must_withdraw() is only needed for CONFIG_TRANSPARENT_HUGEPAGE
	powerpc/lib: Validate size for vector operations
	x86/mce: Mark fatal MCE's page as poison to avoid panic in the kdump kernel
	perf/core: Fix narrow startup race when creating the perf nr_addr_filters sysfs file
	debugobjects: Stop accessing objects after releasing hash bucket lock
	regulator: core: Only increment use_count when enable_count changes
	audit: Send netlink ACK before setting connection in auditd_set
	ACPI: video: Add quirk for the Colorful X15 AT 23 Laptop
	PNP: ACPI: fix fortify warning
	ACPI: extlog: fix NULL pointer dereference check
	PM / devfreq: Synchronize devfreq_monitor_[start/stop]
	ACPI: APEI: set memory failure flags as MF_ACTION_REQUIRED on synchronous events
	FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
	UBSAN: array-index-out-of-bounds in dtSplitRoot
	jfs: fix slab-out-of-bounds Read in dtSearch
	jfs: fix array-index-out-of-bounds in dbAdjTree
	jfs: fix uaf in jfs_evict_inode
	pstore/ram: Fix crash when setting number of cpus to an odd number
	crypto: stm32/crc32 - fix parsing list of devices
	afs: fix the usage of read_seqbegin_or_lock() in afs_lookup_volume_rcu()
	afs: fix the usage of read_seqbegin_or_lock() in afs_find_server*()
	rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock()
	jfs: fix array-index-out-of-bounds in diNewExt
	s390/ptrace: handle setting of fpc register correctly
	KVM: s390: fix setting of fpc register
	SUNRPC: Fix a suspicious RCU usage warning
	ecryptfs: Reject casefold directory inodes
	ext4: fix inconsistent between segment fstrim and full fstrim
	ext4: unify the type of flexbg_size to unsigned int
	ext4: remove unnecessary check from alloc_flex_gd()
	ext4: avoid online resizing failures due to oversized flex bg
	wifi: rt2x00: restart beacon queue when hardware reset
	selftests/bpf: satisfy compiler by having explicit return in btf test
	selftests/bpf: Fix pyperf180 compilation failure with clang18
	scsi: lpfc: Fix possible file string name overflow when updating firmware
	PCI: Add no PM reset quirk for NVIDIA Spectrum devices
	bonding: return -ENOMEM instead of BUG in alb_upper_dev_walk
	scsi: arcmsr: Support new PCI device IDs 1883 and 1886
	ARM: dts: imx7d: Fix coresight funnel ports
	ARM: dts: imx7s: Fix lcdif compatible
	ARM: dts: imx7s: Fix nand-controller #size-cells
	wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
	bpf: Add map and need_defer parameters to .map_fd_put_ptr()
	scsi: libfc: Don't schedule abort twice
	scsi: libfc: Fix up timeout error in fc_fcp_rec_error()
	bpf: Set uattr->batch.count as zero before batched update or deletion
	ARM: dts: rockchip: fix rk3036 hdmi ports node
	ARM: dts: imx25/27-eukrea: Fix RTC node name
	ARM: dts: imx: Use flash@0,0 pattern
	ARM: dts: imx27: Fix sram node
	ARM: dts: imx1: Fix sram node
	ionic: pass opcode to devcmd_wait
	block/rnbd-srv: Check for unlikely string overflow
	ARM: dts: imx25: Fix the iim compatible string
	ARM: dts: imx25/27: Pass timing0
	ARM: dts: imx27-apf27dev: Fix LED name
	ARM: dts: imx23-sansa: Use preferred i2c-gpios properties
	ARM: dts: imx23/28: Fix the DMA controller node name
	net: dsa: mv88e6xxx: Fix mv88e6352_serdes_get_stats error path
	block: prevent an integer overflow in bvec_try_merge_hw_page
	md: Whenassemble the array, consult the superblock of the freshest device
	arm64: dts: qcom: msm8996: Fix 'in-ports' is a required property
	arm64: dts: qcom: msm8998: Fix 'out-ports' is a required property
	wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices
	wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift()
	wifi: cfg80211: free beacon_ies when overridden from hidden BSS
	Bluetooth: qca: Set both WIDEBAND_SPEECH and LE_STATES quirks for QCA2066
	Bluetooth: L2CAP: Fix possible multiple reject send
	i40e: Fix VF disable behavior to block all traffic
	f2fs: fix to check return value of f2fs_reserve_new_block()
	ALSA: hda: Refer to correct stream index at loops
	ASoC: doc: Fix undefined SND_SOC_DAPM_NOPM argument
	fast_dput(): handle underflows gracefully
	RDMA/IPoIB: Fix error code return in ipoib_mcast_join
	drm/amd/display: Fix tiled display misalignment
	f2fs: fix write pointers on zoned device after roll forward
	drm/drm_file: fix use of uninitialized variable
	drm/framebuffer: Fix use of uninitialized variable
	drm/mipi-dsi: Fix detach call without attach
	media: stk1160: Fixed high volume of stk1160_dbg messages
	media: rockchip: rga: fix swizzling for RGB formats
	PCI: add INTEL_HDA_ARL to pci_ids.h
	ALSA: hda: Intel: add HDA_ARL PCI ID support
	ALSA: hda: intel-dspcfg: add filters for ARL-S and ARL
	drm/exynos: Call drm_atomic_helper_shutdown() at shutdown/unbind time
	IB/ipoib: Fix mcast list locking
	media: ddbridge: fix an error code problem in ddb_probe
	drm/msm/dpu: Ratelimit framedone timeout msgs
	clk: hi3620: Fix memory leak in hi3620_mmc_clk_init()
	clk: mmp: pxa168: Fix memory leak in pxa168_clk_init()
	watchdog: it87_wdt: Keep WDTCTRL bit 3 unmodified for IT8784/IT8786
	drm/amdgpu: Let KFD sync with VM fences
	drm/amdgpu: Drop 'fence' check in 'to_amdgpu_amdkfd_fence()'
	leds: trigger: panic: Don't register panic notifier if creating the trigger failed
	um: Fix naming clash between UML and scheduler
	um: Don't use vfprintf() for os_info()
	um: net: Fix return type of uml_net_start_xmit()
	i3c: master: cdns: Update maximum prescaler value for i2c clock
	xen/gntdev: Fix the abuse of underlying struct page in DMA-buf import
	mfd: ti_am335x_tscadc: Fix TI SoC dependencies
	PCI: Only override AMD USB controller if required
	PCI: switchtec: Fix stdev_release() crash after surprise hot remove
	usb: hub: Replace hardcoded quirk value with BIT() macro
	tty: allow TIOCSLCKTRMIOS with CAP_CHECKPOINT_RESTORE
	fs/kernfs/dir: obey S_ISGID
	PCI/AER: Decode Requester ID when no error info found
	libsubcmd: Fix memory leak in uniq()
	virtio_net: Fix "‘%d’ directive writing between 1 and 11 bytes into a region of size 10" warnings
	blk-mq: fix IO hang from sbitmap wakeup race
	ceph: fix deadlock or deadcode of misusing dget()
	drm/amd/powerplay: Fix kzalloc parameter 'ATOM_Tonga_PPM_Table' in 'get_platform_power_management_table()'
	drm/amdgpu: Release 'adev->pm.fw' before return in 'amdgpu_device_need_post()'
	perf: Fix the nr_addr_filters fix
	wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update
	drm: using mul_u32_u32() requires linux/math64.h
	scsi: isci: Fix an error code problem in isci_io_request_build()
	scsi: core: Introduce enum scsi_disposition
	scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler
	ip6_tunnel: use dev_sw_netstats_rx_add()
	ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()
	net-zerocopy: Refactor frag-is-remappable test.
	tcp: add sanity checks to rx zerocopy
	ixgbe: Remove non-inclusive language
	ixgbe: Refactor returning internal error codes
	ixgbe: Refactor overtemp event handling
	ixgbe: Fix an error handling path in ixgbe_read_iosf_sb_reg_x550()
	ipv6: Ensure natural alignment of const ipv6 loopback and router addresses
	llc: call sock_orphan() at release time
	netfilter: nf_log: replace BUG_ON by WARN_ON_ONCE when putting logger
	netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations
	net: ipv4: fix a memleak in ip_setup_cork
	af_unix: fix lockdep positive in sk_diag_dump_icons()
	net: sysfs: Fix /sys/class/net/<iface> path
	HID: apple: Add support for the 2021 Magic Keyboard
	HID: apple: Add 2021 magic keyboard FN key mapping
	bonding: remove print in bond_verify_device_path
	uapi: stddef.h: Fix __DECLARE_FLEX_ARRAY for C++
	PM: sleep: Fix error handling in dpm_prepare()
	dmaengine: fsl-dpaa2-qdma: Fix the size of dma pools
	dmaengine: ti: k3-udma: Report short packet errors
	dmaengine: fsl-qdma: Fix a memory leak related to the status queue DMA
	dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA
	phy: renesas: rcar-gen3-usb2: Fix returning wrong error code
	dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV
	phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
	drm/msm/dp: return correct Colorimetry for DP_TEST_DYNAMIC_RANGE_CEA case
	net: stmmac: xgmac: fix handling of DPP safety error for DMA channels
	selftests: net: avoid just another constant wait
	tunnels: fix out of bounds access when building IPv6 PMTU error
	atm: idt77252: fix a memleak in open_card_ubr0
	hwmon: (aspeed-pwm-tacho) mutex for tach reading
	hwmon: (coretemp) Fix out-of-bounds memory access
	hwmon: (coretemp) Fix bogus core_id to attr name mapping
	inet: read sk->sk_family once in inet_recv_error()
	rxrpc: Fix response to PING RESPONSE ACKs to a dead call
	tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()
	ppp_async: limit MRU to 64K
	netfilter: nft_compat: reject unused compat flag
	netfilter: nft_compat: restrict match/target protocol to u16
	netfilter: nft_ct: reject direction for ct id
	netfilter: nft_set_pipapo: store index in scratch maps
	netfilter: nft_set_pipapo: add helper to release pcpu scratch area
	netfilter: nft_set_pipapo: remove scratch_aligned pointer
	scsi: core: Move scsi_host_busy() out of host lock if it is for per-command
	blk-iocost: Fix an UBSAN shift-out-of-bounds warning
	net/af_iucv: clean up a try_then_request_module()
	USB: serial: qcserial: add new usb-id for Dell Wireless DW5826e
	USB: serial: option: add Fibocom FM101-GL variant
	USB: serial: cp210x: add ID for IMST iM871A-USB
	usb: host: xhci-plat: Add support for XHCI_SG_TRB_CACHE_SIZE_QUIRK
	hrtimer: Report offline hrtimer enqueue
	Input: i8042 - fix strange behavior of touchpad on Clevo NS70PU
	Input: atkbd - skip ATKBD_CMD_SETLEDS when skipping ATKBD_CMD_GETID
	vhost: use kzalloc() instead of kmalloc() followed by memset()
	clocksource: Skip watchdog check for large watchdog intervals
	net: stmmac: xgmac: use #define for string constants
	net: stmmac: xgmac: fix a typo of register name in DPP safety handling
	netfilter: nft_set_rbtree: skip end interval element from gc
	btrfs: forbid creating subvol qgroups
	btrfs: do not ASSERT() if the newly created subvolume already got read
	btrfs: forbid deleting live subvol qgroup
	btrfs: send: return EOPNOTSUPP on unknown flags
	of: unittest: Fix compile in the non-dynamic case
	net: openvswitch: limit the number of recursions from action sets
	spi: ppc4xx: Drop write-only variable
	ASoC: rt5645: Fix deadlock in rt5645_jack_detect_work()
	net: sysfs: Fix /sys/class/net/<iface> path for statistics
	MIPS: Add 'memory' clobber to csum_ipv6_magic() inline assembler
	i40e: Fix waiting for queues of all VSIs to be disabled
	tracing/trigger: Fix to return error if failed to alloc snapshot
	mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again
	ALSA: hda/realtek: Fix the external mic not being recognised for Acer Swift 1 SF114-32
	ALSA: hda/realtek: Enable Mute LED on HP Laptop 14-fq0xxx
	HID: wacom: generic: Avoid reporting a serial of '0' to userspace
	HID: wacom: Do not register input devices until after hid_hw_start
	usb: ucsi_acpi: Fix command completion handling
	USB: hub: check for alternate port before enabling A_ALT_HNP_SUPPORT
	usb: f_mass_storage: forbid async queue when shutdown happen
	media: ir_toy: fix a memleak in irtoy_tx
	powerpc/kasan: Fix addr error caused by page alignment
	i2c: i801: Remove i801_set_block_buffer_mode
	i2c: i801: Fix block process call transactions
	modpost: trim leading spaces when processing source files list
	scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock"
	lsm: fix the logic in security_inode_getsecctx()
	firewire: core: correct documentation of fw_csr_string() kernel API
	kbuild: Fix changing ELF file type for output of gen_btf for big endian
	nfc: nci: free rx_data_reassembly skb on NCI device cleanup
	net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame()
	xen-netback: properly sync TX responses
	ALSA: hda/realtek: Enable headset mic on Vaio VJFE-ADL
	binder: signal epoll threads of self-work
	misc: fastrpc: Mark all sessions as invalid in cb_remove
	ext4: fix double-free of blocks due to wrong extents moved_len
	tracing: Fix wasted memory in saved_cmdlines logic
	staging: iio: ad5933: fix type mismatch regression
	iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC
	iio: accel: bma400: Fix a compilation problem
	media: rc: bpf attach/detach requires write permission
	hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove
	ring-buffer: Clean ring_buffer_poll_wait() error return
	serial: max310x: set default value when reading clock ready bit
	serial: max310x: improve crystal stable clock detection
	x86/Kconfig: Transmeta Crusoe is CPU family 5, not 6
	x86/mm/ident_map: Use gbpages only where full GB page should be mapped.
	mmc: slot-gpio: Allow non-sleeping GPIO ro
	ALSA: hda/conexant: Add quirk for SWS JS201D
	nilfs2: fix data corruption in dsync block recovery for small block sizes
	nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
	crypto: ccp - Fix null pointer dereference in __sev_platform_shutdown_locked
	nfp: use correct macro for LengthSelect in BAR config
	nfp: flower: prevent re-adding mac index for bonded port
	wifi: mac80211: reload info pointer in ieee80211_tx_dequeue()
	irqchip/irq-brcmstb-l2: Add write memory barrier before exit
	irqchip/gic-v3-its: Fix GICv4.1 VPE affinity update
	s390/qeth: Fix potential loss of L3-IP@ in case of network issues
	ceph: prevent use-after-free in encode_cap_msg()
	of: property: fix typo in io-channels
	can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)
	pmdomain: core: Move the unused cleanup to a _sync initcall
	tracing: Inform kmemleak of saved_cmdlines allocation
	Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"
	bus: moxtet: Add spi device table
	PCI: dwc: endpoint: Fix dw_pcie_ep_raise_msix_irq() alignment support
	mips: Fix max_mapnr being uninitialized on early stages
	crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init
	serial: Add rs485_supported to uart_port
	serial: 8250_exar: Fill in rs485_supported
	serial: 8250_exar: Set missing rs485_supported flag
	scripts/decode_stacktrace.sh: silence stderr messages from addr2line/nm
	scripts/decode_stacktrace.sh: support old bash version
	scripts: decode_stacktrace: demangle Rust symbols
	scripts/decode_stacktrace.sh: optionally use LLVM utilities
	netfilter: ipset: fix performance regression in swap operation
	netfilter: ipset: Missing gc cancellations fixed
	hrtimer: Ignore slack time for RT tasks in schedule_hrtimeout_range()
	Revert "arm64: Stash shadow stack pointer in the task struct on interrupt"
	net: prevent mss overflow in skb_segment()
	sched/membarrier: reduce the ability to hammer on sys_membarrier
	nilfs2: fix potential bug in end_buffer_async_write
	nilfs2: replace WARN_ONs for invalid DAT metadata block requests
	dm: limit the number of targets and parameter size area
	PM: runtime: add devm_pm_runtime_enable helper
	PM: runtime: Have devm_pm_runtime_enable() handle pm_runtime_dont_use_autosuspend()
	drm/msm/dsi: Enable runtime PM
	netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval()
	net: bcmgenet: Fix EEE implementation
	PCI: dwc: Fix a 64bit bug in dw_pcie_ep_raise_msix_irq()
	Linux 5.10.210

Change-Id: I5e7327f58dd6abd26ac2b1e328a81c1010d1147c
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2024-04-10 07:10:03 +00:00
Shigeru Yoshida
19d7314f2f tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() 
[ Upstream commit 3871aa01e1a779d866fa9dfdd5a836f342f4eb87 ]

syzbot reported the following general protection fault [1]:

general protection fault, probably for non-canonical address 0xdffffc0000000010: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000080-0x0000000000000087]
...
RIP: 0010:tipc_udp_is_known_peer+0x9c/0x250 net/tipc/udp_media.c:291
...
Call Trace:
 <TASK>
 tipc_udp_nl_bearer_add+0x212/0x2f0 net/tipc/udp_media.c:646
 tipc_nl_bearer_add+0x21e/0x360 net/tipc/bearer.c:1089
 genl_family_rcv_msg_doit+0x1fc/0x2e0 net/netlink/genetlink.c:972
 genl_family_rcv_msg net/netlink/genetlink.c:1052 [inline]
 genl_rcv_msg+0x561/0x800 net/netlink/genetlink.c:1067
 netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2544
 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1076
 netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]
 netlink_unicast+0x53b/0x810 net/netlink/af_netlink.c:1367
 netlink_sendmsg+0x8b7/0xd70 net/netlink/af_netlink.c:1909
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg+0xd5/0x180 net/socket.c:745
 ____sys_sendmsg+0x6ac/0x940 net/socket.c:2584
 ___sys_sendmsg+0x135/0x1d0 net/socket.c:2638
 __sys_sendmsg+0x117/0x1e0 net/socket.c:2667
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x63/0x6b

The cause of this issue is that when tipc_nl_bearer_add() is called with
the TIPC_NLA_BEARER_UDP_OPTS attribute, tipc_udp_nl_bearer_add() is called
even if the bearer is not UDP.

tipc_udp_is_known_peer() called by tipc_udp_nl_bearer_add() assumes that
the media_ptr field of the tipc_bearer has an udp_bearer type object, so
the function goes crazy for non-UDP bearers.

This patch fixes the issue by checking the bearer type before calling
tipc_udp_nl_bearer_add() in tipc_nl_bearer_add().

Fixes: ef20cd4dd1 ("tipc: introduce UDP replicast")
Reported-and-tested-by: syzbot+5142b87a9abc510e14fa@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=5142b87a9abc510e14fa [1]
Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
Reviewed-by: Tung Nguyen <tung.q.nguyen@dektech.com.au>
Link: https://lore.kernel.org/r/20240131152310.4089541-1-syoshida@redhat.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2024-02-23 08:42:20 +01:00
Greg Kroah-Hartman
7999a9a70d This is the 5.10.202 stable release 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmVmG20ACgkQONu9yGCS
 aT6dzg/7BnCP2SpVmgEaD7FdPvGO/A6O5VrC9zu3sQE6g2gAwirZhdgE8NRn+ggm
 WSQ1kIA+HEcY23FKpq46pBED4P1irudiW7DkLw8nyOGp+XLb4wGkF5lBBP5z+B2P
 ga2RgwqKvYWeDaUW4n1Uy7m2Cz+wqCg/EvnITo40glSWPh20gM532/CSnA5akoje
 9mjZYZ0rKHKTZGu65aNScNR7XnXHIivJU6C1jF6L9N1+Xn679nUHKQP4KM/RcjpX
 g1WQMWFC3mGIn5IX28W1wvKS320D5HLmTLnLqJvFpJN9+13DUnUoXcX469zvQoxJ
 GL3S94goWN/0BPOgr5KcKvTj00b4O+EWhQuQt+x8NLdydzRQuyFu2UpLNhIKKSou
 sT+BcxzeuqJhEh1tZItcZkZBptpLEkb0ezT11u5McnU5FjPzzzP8CtEetKKmEaBU
 AUoEP/lQQlVyk1I6xAeuzu53smncNQt6CqnXJxYXOBGgJ2txAM5kroMKXPin5C8k
 BCpUIqghhKmBd1hwuKyaOBKF99eLKKZsuvXppoPD0Yz7/Nq5TgdBw0qbNt2iLr05
 XSM7WIIeCBROaV+ZiVxgtcXDR51FpMr7CLTbkBQ6IgLwircHeHSK7rQn7kFO3fCg
 OezhWAuh72qDZ2PCJ84fj21IhZ49a5oCLbUdBew+KzZervVpSo0=
 =eW67
 -----END PGP SIGNATURE-----

Merge 5.10.202 into android12-5.10-lts

Changes in 5.10.202
	locking/ww_mutex/test: Fix potential workqueue corruption
	perf/core: Bail out early if the request AUX area is out of bound
	clocksource/drivers/timer-imx-gpt: Fix potential memory leak
	clocksource/drivers/timer-atmel-tcb: Fix initialization on SAM9 hardware
	x86/mm: Drop the 4 MB restriction on minimal NUMA node memory size
	wifi: mac80211_hwsim: fix clang-specific fortify warning
	wifi: mac80211: don't return unset power in ieee80211_get_tx_power()
	bpf: Detect IP == ksym.end as part of BPF program
	wifi: ath9k: fix clang-specific fortify warnings
	wifi: ath10k: fix clang-specific fortify warning
	net: annotate data-races around sk->sk_tx_queue_mapping
	net: annotate data-races around sk->sk_dst_pending_confirm
	wifi: ath10k: Don't touch the CE interrupt registers after power up
	Bluetooth: btusb: Add date->evt_skb is NULL check
	Bluetooth: Fix double free in hci_conn_cleanup
	platform/x86: thinkpad_acpi: Add battery quirk for Thinkpad X120e
	drm/komeda: drop all currently held locks if deadlock happens
	drm/msm/dp: skip validity check for DP CTS EDID checksum
	drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7
	drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga
	drm/amdgpu: Fix potential null pointer derefernce
	drm/panel: fix a possible null pointer dereference
	drm/panel/panel-tpo-tpg110: fix a possible null pointer dereference
	drm/panel: st7703: Pick different reset sequence
	drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL
	selftests/efivarfs: create-read: fix a resource leak
	ASoC: soc-card: Add storage for PCI SSID
	crypto: pcrypt - Fix hungtask for PADATA_RESET
	RDMA/hfi1: Use FIELD_GET() to extract Link Width
	fs/jfs: Add check for negative db_l2nbperpage
	fs/jfs: Add validity check for db_maxag and db_agpref
	jfs: fix array-index-out-of-bounds in dbFindLeaf
	jfs: fix array-index-out-of-bounds in diAlloc
	HID: lenovo: Detect quirk-free fw on cptkbd and stop applying workaround
	ARM: 9320/1: fix stack depot IRQ stack filter
	ALSA: hda: Fix possible null-ptr-deref when assigning a stream
	PCI: tegra194: Use FIELD_GET()/FIELD_PREP() with Link Width fields
	atm: iphase: Do PCI error checks on own line
	scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup()
	misc: pci_endpoint_test: Add Device ID for R-Car S4-8 PCIe controller
	HID: Add quirk for Dell Pro Wireless Keyboard and Mouse KM5221W
	exfat: support handle zero-size directory
	tty: vcc: Add check for kstrdup() in vcc_probe()
	usb: gadget: f_ncm: Always set current gadget in ncm_bind()
	9p/trans_fd: Annotate data-racy writes to file::f_flags
	i2c: sun6i-p2wi: Prevent potential division by zero
	media: gspca: cpia1: shift-out-of-bounds in set_flicker
	media: vivid: avoid integer overflow
	gfs2: ignore negated quota changes
	gfs2: fix an oops in gfs2_permission
	media: cobalt: Use FIELD_GET() to extract Link Width
	media: imon: fix access to invalid resource for the second interface
	drm/amd/display: Avoid NULL dereference of timing generator
	kgdb: Flush console before entering kgdb on panic
	ASoC: ti: omap-mcbsp: Fix runtime PM underflow warnings
	drm/amdgpu: fix software pci_unplug on some chips
	pwm: Fix double shift bug
	wifi: iwlwifi: Use FW rate for non-data frames
	xhci: turn cancelled td cleanup to its own function
	SUNRPC: ECONNRESET might require a rebind
	SUNRPC: Add an IS_ERR() check back to where it was
	NFSv4.1: fix SP4_MACH_CRED protection for pnfs IO
	SUNRPC: Fix RPC client cleaned up the freed pipefs dentries
	gfs2: Silence "suspicious RCU usage in gfs2_permission" warning
	ipvlan: add ipvlan_route_v6_outbound() helper
	tty: Fix uninit-value access in ppp_sync_receive()
	net: hns3: fix variable may not initialized problem in hns3_init_mac_addr()
	net: hns3: fix VF reset fail issue
	tipc: Fix kernel-infoleak due to uninitialized TLV value
	ppp: limit MRU to 64K
	xen/events: fix delayed eoi list handling
	ptp: annotate data-race around q->head and q->tail
	bonding: stop the device in bond_setup_by_slave()
	net: ethernet: cortina: Fix max RX frame define
	net: ethernet: cortina: Handle large frames
	net: ethernet: cortina: Fix MTU max setting
	netfilter: nf_conntrack_bridge: initialize err to 0
	net: stmmac: fix rx budget limit check
	net/mlx5e: fix double free of encap_header
	net/mlx5_core: Clean driver version and name
	net/mlx5e: Check return value of snprintf writing to fw_version buffer for representors
	macvlan: Don't propagate promisc change to lower dev in passthru
	tools/power/turbostat: Fix a knl bug
	cifs: spnego: add ';' in HOST_KEY_LEN
	cifs: fix check of rc in function generate_smb3signingkey
	media: venus: hfi: add checks to perform sanity on queue pointers
	powerpc/perf: Fix disabling BHRB and instruction sampling
	randstruct: Fix gcc-plugin performance mode to stay in group
	bpf: Fix check_stack_write_fixed_off() to correctly spill imm
	bpf: Fix precision tracking for BPF_ALU | BPF_TO_BE | BPF_END
	scsi: mpt3sas: Fix loop logic
	scsi: megaraid_sas: Increase register read retry rount from 3 to 30 for selected registers
	x86/cpu/hygon: Fix the CPU topology evaluation for real
	KVM: x86: hyper-v: Don't auto-enable stimer on write from user-space
	KVM: x86: Ignore MSR_AMD64_TW_CFG access
	audit: don't take task_lock() in audit_exe_compare() code path
	audit: don't WARN_ON_ONCE(!current->mm) in audit_exe_compare()
	tty/sysrq: replace smp_processor_id() with get_cpu()
	hvc/xen: fix console unplug
	hvc/xen: fix error path in xen_hvc_init() to always register frontend driver
	PCI/sysfs: Protect driver's D3cold preference from user space
	watchdog: move softlockup_panic back to early_param
	ACPI: resource: Do IRQ override on TongFang GMxXGxx
	arm64: Restrict CPU_BIG_ENDIAN to GNU as or LLVM IAS 15.x or newer
	parisc/pdc: Add width field to struct pdc_model
	clk: qcom: ipq8074: drop the CLK_SET_RATE_PARENT flag from PLL clocks
	clk: qcom: ipq6018: drop the CLK_SET_RATE_PARENT flag from PLL clocks
	mmc: vub300: fix an error code
	mmc: sdhci_am654: fix start loop index for TAP value parsing
	PCI/ASPM: Fix L1 substate handling in aspm_attr_store_common()
	arm64: dts: qcom: ipq6018: Fix hwlock index for SMEM
	PM: hibernate: Use __get_safe_page() rather than touching the list
	PM: hibernate: Clean up sync_read handling in snapshot_write_next()
	rcu: kmemleak: Ignore kmemleak false positives when RCU-freeing objects
	btrfs: don't arbitrarily slow down delalloc if we're committing
	firmware: qcom_scm: use 64-bit calling convention only when client is 64-bit
	ima: detect changes to the backing overlay file
	wifi: ath11k: fix temperature event locking
	wifi: ath11k: fix dfs radar event locking
	wifi: ath11k: fix htt pktlog locking
	mmc: meson-gx: Remove setting of CMD_CFG_ERROR
	genirq/generic_chip: Make irq_remove_generic_chip() irqdomain aware
	PCI: keystone: Don't discard .remove() callback
	PCI: keystone: Don't discard .probe() callback
	jbd2: fix potential data lost in recovering journal raced with synchronizing fs bdev
	quota: explicitly forbid quota files from being encrypted
	kernel/reboot: emergency_restart: Set correct system_state
	i2c: core: Run atomic i2c xfer when !preemptible
	mcb: fix error handling for different scenarios when parsing
	dmaengine: stm32-mdma: correct desc prep when channel running
	mm/cma: use nth_page() in place of direct struct page manipulation
	mm/memory_hotplug: use pfn math in place of direct struct page manipulation
	mtd: cfi_cmdset_0001: Byte swap OTP info
	i3c: master: cdns: Fix reading status register
	parisc: Prevent booting 64-bit kernels on PA1.x machines
	parisc/pgtable: Do not drop upper 5 address bits of physical address
	xhci: Enable RPM on controllers that support low-power states
	ALSA: info: Fix potential deadlock at disconnection
	ALSA: hda/realtek - Add Dell ALC295 to pin fall back table
	ALSA: hda/realtek - Enable internal speaker of ASUS K6500ZC
	serial: meson: remove redundant initialization of variable id
	tty: serial: meson: retrieve port FIFO size from DT
	serial: meson: Use platform_get_irq() to get the interrupt
	tty: serial: meson: fix hard LOCKUP on crtscts mode
	cpufreq: stats: Fix buffer overflow detection in trans_stats()
	Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0cb8:0xc559
	bluetooth: Add device 0bda:887b to device tables
	bluetooth: Add device 13d3:3571 to device tables
	Bluetooth: btusb: Add RTW8852BE device 13d3:3570 to device tables
	Bluetooth: btusb: Add 0bda:b85b for Fn-Link RTL8852BE
	PCI: exynos: Don't discard .remove() callback
	arm64: dts: qcom: ipq6018: switch TCSR mutex to MMIO
	arm64: dts: qcom: ipq6018: Fix tcsr_mutex register size
	Revert ncsi: Propagate carrier gain/loss events to the NCSI controller
	lsm: fix default return value for vm_enough_memory
	lsm: fix default return value for inode_getsecctx
	i2c: designware: Disable TX_EMPTY irq while waiting for block length byte
	net: dsa: lan9303: consequently nested-lock physical MDIO
	net: phylink: initialize carrier state at creation
	i2c: i801: fix potential race in i801_block_transaction_byte_by_byte
	f2fs: avoid format-overflow warning
	media: lirc: drop trailing space from scancode transmit
	media: sharp: fix sharp encoding
	media: venus: hfi_parser: Add check to keep the number of codecs within range
	media: venus: hfi: fix the check to handle session buffer requirement
	media: venus: hfi: add checks to handle capabilities from firmware
	nfsd: fix file memleak on client_opens_release
	mm: kmem: drop __GFP_NOFAIL when allocating objcg vectors
	media: qcom: camss: Fix vfe_get() error jump
	Revert "net: r8169: Disable multicast filter for RTL8168H and RTL8107E"
	ext4: apply umask if ACL support is disabled
	ext4: correct offset of gdb backup in non meta_bg group to update_backups
	ext4: correct return value of ext4_convert_meta_bg
	ext4: correct the start block of counting reserved clusters
	ext4: remove gdb backup copy for meta bg in setup_new_flex_group_blocks
	drm/amd/pm: Handle non-terminated overdrive commands.
	drm/amdgpu: fix error handling in amdgpu_bo_list_get()
	drm/amd/display: Change the DMCUB mailbox memory location from FB to inbox
	io_uring/fdinfo: lock SQ thread while retrieving thread cpu/pid
	tracing: Have trace_event_file have ref counters
	netfilter: nftables: update table flags from the commit phase
	netfilter: nf_tables: fix table flag updates
	netfilter: nf_tables: disable toggling dormant table state more than once
	interconnect: qcom: Add support for mask-based BCMs
	Linux 5.10.202

Change-Id: I762bcd4848d9b87cbb4efe4104fe1685999dc0f7
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2023-12-08 16:26:36 +00:00
Greg Kroah-Hartman
cf3a19d56e Merge 5.10.201 into android12-5.10-lts 
Changes in 5.10.201
	iov_iter, x86: Be consistent about the __user tag on copy_mc_to_user()
	sched/uclamp: Ignore (util == 0) optimization in feec() when p_util_max = 0
	vfs: fix readahead(2) on block devices
	x86/srso: Fix SBPB enablement for (possible) future fixed HW
	futex: Don't include process MM in futex key on no-MMU
	x86/boot: Fix incorrect startup_gdt_descr.size
	pstore/platform: Add check for kstrdup
	genirq/matrix: Exclude managed interrupts in irq_matrix_allocated()
	i40e: fix potential memory leaks in i40e_remove()
	udp: add missing WRITE_ONCE() around up->encap_rcv
	tcp: call tcp_try_undo_recovery when an RTOd TFO SYNACK is ACKed
	overflow: Implement size_t saturating arithmetic helpers
	gve: Use size_add() in call to struct_size()
	mlxsw: Use size_mul() in call to struct_size()
	tipc: Use size_add() in calls to struct_size()
	net: spider_net: Use size_add() in call to struct_size()
	wifi: rtw88: debug: Fix the NULL vs IS_ERR() bug for debugfs_create_file()
	wifi: mt76: mt7603: rework/fix rx pse hang check
	tcp_metrics: add missing barriers on delete
	tcp_metrics: properly set tp->snd_ssthresh in tcp_init_metrics()
	tcp_metrics: do not create an entry from tcp_init_metrics()
	wifi: rtlwifi: fix EDCA limit set by BT coexistence
	can: dev: can_restart(): don't crash kernel if carrier is OK
	can: dev: can_restart(): fix race condition between controller restart and netif_carrier_on()
	PM / devfreq: rockchip-dfi: Make pmu regmap mandatory
	thermal: core: prevent potential string overflow
	r8169: use tp_to_dev instead of open code
	r8169: fix rare issue with broken rx after link-down on RTL8125
	chtls: fix tp->rcv_tstamp initialization
	tcp: fix cookie_init_timestamp() overflows
	ACPI: sysfs: Fix create_pnp_modalias() and create_of_modalias()
	ipv6: avoid atomic fragment on GSO packets
	net: add DEV_STATS_READ() helper
	ipvlan: properly track tx_errors
	regmap: debugfs: Fix a erroneous check after snprintf()
	clk: qcom: clk-rcg2: Fix clock rate overflow for high parent frequencies
	clk: qcom: mmcc-msm8998: Add hardware clockgating registers to some clks
	clk: qcom: mmcc-msm8998: Don't check halt bit on some branch clks
	clk: qcom: mmcc-msm8998: Set bimc_smmu_gdsc always on
	clk: qcom: mmcc-msm8998: Fix the SMMU GDSC
	clk: qcom: gcc-sm8150: use ARRAY_SIZE instead of specifying num_parents
	clk: qcom: gcc-sm8150: Fix gcc_sdcc2_apps_clk_src
	clk: imx: Select MXC_CLK for CLK_IMX8QXP
	clk: imx: imx8mq: correct error handling path
	clk: asm9260: use parent index to link the reference clock
	clk: linux/clk-provider.h: fix kernel-doc warnings and typos
	spi: nxp-fspi: use the correct ioremap function
	clk: keystone: pll: fix a couple NULL vs IS_ERR() checks
	clk: ti: Add ti_dt_clk_name() helper to use clock-output-names
	clk: ti: Update pll and clockdomain clocks to use ti_dt_clk_name()
	clk: ti: Update component clocks to use ti_dt_clk_name()
	clk: ti: change ti_clk_register[_omap_hw]() API
	clk: ti: fix double free in of_ti_divider_clk_setup()
	clk: npcm7xx: Fix incorrect kfree
	clk: mediatek: clk-mt6765: Add check for mtk_alloc_clk_data
	clk: mediatek: clk-mt6779: Add check for mtk_alloc_clk_data
	clk: mediatek: clk-mt6797: Add check for mtk_alloc_clk_data
	clk: mediatek: clk-mt7629-eth: Add check for mtk_alloc_clk_data
	clk: mediatek: clk-mt7629: Add check for mtk_alloc_clk_data
	clk: mediatek: clk-mt2701: Add check for mtk_alloc_clk_data
	clk: qcom: config IPQ_APSS_6018 should depend on QCOM_SMEM
	platform/x86: wmi: Fix probe failure when failing to register WMI devices
	platform/x86: wmi: remove unnecessary initializations
	platform/x86: wmi: Fix opening of char device
	hwmon: (axi-fan-control) Support temperature vs pwm points
	hwmon: (axi-fan-control) Fix possible NULL pointer dereference
	hwmon: (coretemp) Fix potentially truncated sysfs attribute name
	drm/rockchip: vop: Fix reset of state in duplicate state crtc funcs
	drm/rockchip: vop: Fix call to crtc reset helper
	drm/radeon: possible buffer overflow
	drm/bridge: tc358768: Fix use of uninitialized variable
	drm/bridge: tc358768: Disable non-continuous clock mode
	drm/bridge: tc358768: Fix bit updates
	drm/mediatek: Fix iommu fault during crtc enabling
	drm/rockchip: cdn-dp: Fix some error handling paths in cdn_dp_probe()
	arm64/arm: xen: enlighten: Fix KPTI checks
	drm/rockchip: Fix type promotion bug in rockchip_gem_iommu_map()
	xen-pciback: Consider INTx disabled when MSI/MSI-X is enabled
	arm64: dts: qcom: msm8916: Fix iommu local address range
	arm64: dts: qcom: sdm845-mtp: fix WiFi configuration
	ARM: dts: qcom: mdm9615: populate vsdcc fixed regulator
	soc: qcom: llcc: Handle a second device without data corruption
	firmware: ti_sci: Mark driver as non removable
	clk: scmi: Free scmi_clk allocated when the clocks with invalid info are skipped
	selftests/pidfd: Fix ksft print formats
	selftests/resctrl: Ensure the benchmark commands fits to its array
	crypto: hisilicon/hpre - Fix a erroneous check after snprintf()
	hwrng: geode - fix accessing registers
	libnvdimm/of_pmem: Use devm_kstrdup instead of kstrdup and check its return value
	nd_btt: Make BTT lanes preemptible
	crypto: caam/qi2 - fix Chacha20 + Poly1305 self test failure
	crypto: caam/jr - fix Chacha20 + Poly1305 self test failure
	crypto: qat - mask device capabilities with soft straps
	crypto: qat - increase size of buffers
	hid: cp2112: Fix duplicate workqueue initialization
	ARM: 9321/1: memset: cast the constant byte to unsigned char
	ext4: move 'ix' sanity check to corrent position
	ASoC: fsl: mpc5200_dma.c: Fix warning of Function parameter or member not described
	IB/mlx5: Fix rdma counter binding for RAW QP
	RDMA/hns: Fix uninitialized ucmd in hns_roce_create_qp_common()
	RDMA/hns: Fix signed-unsigned mixed comparisons
	ASoC: fsl: Fix PM disable depth imbalance in fsl_easrc_probe
	scsi: ufs: core: Leave space for '\0' in utf8 desc string
	RDMA/hfi1: Workaround truncation compilation error
	hid: cp2112: Fix IRQ shutdown stopping polling for all IRQs on chip
	sh: bios: Revive earlyprintk support
	Revert "HID: logitech-hidpp: add a module parameter to keep firmware gestures"
	HID: logitech-hidpp: Remove HIDPP_QUIRK_NO_HIDINPUT quirk
	HID: logitech-hidpp: Don't restart IO, instead defer hid_connect() only
	HID: logitech-hidpp: Revert "Don't restart communication if not necessary"
	HID: logitech-hidpp: Move get_wireless_feature_index() check to hidpp_connect_event()
	ASoC: Intel: Skylake: Fix mem leak when parsing UUIDs fails
	padata: Convert from atomic_t to refcount_t on parallel_data->refcnt
	padata: Fix refcnt handling in padata_free_shell()
	ASoC: ams-delta.c: use component after check
	mfd: core: Un-constify mfd_cell.of_reg
	mfd: core: Ensure disabled devices are skipped without aborting
	mfd: dln2: Fix double put in dln2_probe
	leds: pwm: Don't disable the PWM when the LED should be off
	leds: trigger: ledtrig-cpu:: Fix 'output may be truncated' issue for 'cpu'
	tty: tty_jobctrl: fix pid memleak in disassociate_ctty()
	livepatch: Fix missing newline character in klp_resolve_symbols()
	usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency
	dmaengine: ti: edma: handle irq_of_parse_and_map() errors
	misc: st_core: Do not call kfree_skb() under spin_lock_irqsave()
	tools: iio: privatize globals and functions in iio_generic_buffer.c file
	tools: iio: iio_generic_buffer: Fix some integer type and calculation
	tools: iio: iio_generic_buffer ensure alignment
	USB: usbip: fix stub_dev hub disconnect
	dmaengine: pxa_dma: Remove an erroneous BUG_ON() in pxad_free_desc()
	f2fs: fix to initialize map.m_pblk in f2fs_precache_extents()
	interconnect: qcom: sc7180: Retire DEFINE_QBCM
	interconnect: qcom: sc7180: Set ACV enable_mask
	modpost: fix tee MODULE_DEVICE_TABLE built on big-endian host
	powerpc/40x: Remove stale PTE_ATOMIC_UPDATES macro
	powerpc/xive: Fix endian conversion size
	powerpc/imc-pmu: Use the correct spinlock initializer.
	powerpc/pseries: fix potential memory leak in init_cpu_associativity()
	xhci: Loosen RPM as default policy to cover for AMD xHC 1.1
	usb: host: xhci-plat: fix possible kernel oops while resuming
	perf machine: Avoid out of bounds LBR memory read
	perf hist: Add missing puts to hist__account_cycles
	i3c: Fix potential refcount leak in i3c_master_register_new_i3c_devs
	rtc: pcf85363: fix wrong mask/val parameters in regmap_update_bits call
	pcmcia: cs: fix possible hung task and memory leak pccardd()
	pcmcia: ds: fix refcount leak in pcmcia_device_add()
	pcmcia: ds: fix possible name leak in error path in pcmcia_device_add()
	media: i2c: max9286: Fix some redundant of_node_put() calls
	media: bttv: fix use after free error due to btv->timeout timer
	media: s3c-camif: Avoid inappropriate kfree()
	media: vidtv: psi: Add check for kstrdup
	media: vidtv: mux: Add check and kfree for kstrdup
	media: cedrus: Fix clock/reset sequence
	media: dvb-usb-v2: af9035: fix missing unlock
	regmap: prevent noinc writes from clobbering cache
	pwm: sti: Avoid conditional gotos
	pwm: sti: Reduce number of allocations and drop usage of chip_data
	pwm: brcmstb: Utilize appropriate clock APIs in suspend/resume
	Input: synaptics-rmi4 - fix use after free in rmi_unregister_function()
	llc: verify mac len before reading mac header
	hsr: Prevent use after free in prp_create_tagged_frame()
	tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING
	inet: shrink struct flowi_common
	dccp: Call security_inet_conn_request() after setting IPv4 addresses.
	dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses.
	net: r8169: Disable multicast filter for RTL8168H and RTL8107E
	Fix termination state for idr_for_each_entry_ul()
	net: stmmac: xgmac: Enable support for multiple Flexible PPS outputs
	net/smc: fix dangling sock under state SMC_APPFINCLOSEWAIT
	net/smc: allow cdc msg send rather than drop it with NULL sndbuf_desc
	net/smc: put sk reference if close work was canceled
	tg3: power down device only on SYSTEM_POWER_OFF
	r8169: respect userspace disabling IFF_MULTICAST
	netfilter: xt_recent: fix (increase) ipv6 literal buffer length
	netfilter: nft_redir: use `struct nf_nat_range2` throughout and deduplicate eval call-backs
	netfilter: nat: fix ipv6 nat redirect with mapped and scoped addresses
	x86: Share definition of __is_canonical_address()
	x86/sev-es: Allow copy_from_kernel_nofault() in earlier boot
	drm/syncobj: fix DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE
	spi: spi-zynq-qspi: add spi-mem to driver kconfig dependencies
	fbdev: imsttfb: Fix error path of imsttfb_probe()
	fbdev: imsttfb: fix a resource leak in probe
	fbdev: fsl-diu-fb: mark wr_reg_wa() static
	tracing/kprobes: Fix the order of argument descriptions
	Revert "mmc: core: Capture correct oemid-bits for eMMC cards"
	btrfs: use u64 for buffer sizes in the tree search ioctls
	Linux 5.10.201

Change-Id: I0ce874e25eb6aeebf5826d6ef843fdbbf55d7c7d
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2023-11-29 14:46:51 +00:00
Shigeru Yoshida
3ee249a3b9 tipc: Fix kernel-infoleak due to uninitialized TLV value 
[ Upstream commit fb317eb23b5ee4c37b0656a9a52a3db58d9dd072 ]

KMSAN reported the following kernel-infoleak issue:

=====================================================
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]
BUG: KMSAN: kernel-infoleak in copy_to_user_iter lib/iov_iter.c:24 [inline]
BUG: KMSAN: kernel-infoleak in iterate_ubuf include/linux/iov_iter.h:29 [inline]
BUG: KMSAN: kernel-infoleak in iterate_and_advance2 include/linux/iov_iter.h:245 [inline]
BUG: KMSAN: kernel-infoleak in iterate_and_advance include/linux/iov_iter.h:271 [inline]
BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x4ec/0x2bc0 lib/iov_iter.c:186
 instrument_copy_to_user include/linux/instrumented.h:114 [inline]
 copy_to_user_iter lib/iov_iter.c:24 [inline]
 iterate_ubuf include/linux/iov_iter.h:29 [inline]
 iterate_and_advance2 include/linux/iov_iter.h:245 [inline]
 iterate_and_advance include/linux/iov_iter.h:271 [inline]
 _copy_to_iter+0x4ec/0x2bc0 lib/iov_iter.c:186
 copy_to_iter include/linux/uio.h:197 [inline]
 simple_copy_to_iter net/core/datagram.c:532 [inline]
 __skb_datagram_iter.5+0x148/0xe30 net/core/datagram.c:420
 skb_copy_datagram_iter+0x52/0x210 net/core/datagram.c:546
 skb_copy_datagram_msg include/linux/skbuff.h:3960 [inline]
 netlink_recvmsg+0x43d/0x1630 net/netlink/af_netlink.c:1967
 sock_recvmsg_nosec net/socket.c:1044 [inline]
 sock_recvmsg net/socket.c:1066 [inline]
 __sys_recvfrom+0x476/0x860 net/socket.c:2246
 __do_sys_recvfrom net/socket.c:2264 [inline]
 __se_sys_recvfrom net/socket.c:2260 [inline]
 __x64_sys_recvfrom+0x130/0x200 net/socket.c:2260
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x63/0x6b

Uninit was created at:
 slab_post_alloc_hook+0x103/0x9e0 mm/slab.h:768
 slab_alloc_node mm/slub.c:3478 [inline]
 kmem_cache_alloc_node+0x5f7/0xb50 mm/slub.c:3523
 kmalloc_reserve+0x13c/0x4a0 net/core/skbuff.c:560
 __alloc_skb+0x2fd/0x770 net/core/skbuff.c:651
 alloc_skb include/linux/skbuff.h:1286 [inline]
 tipc_tlv_alloc net/tipc/netlink_compat.c:156 [inline]
 tipc_get_err_tlv+0x90/0x5d0 net/tipc/netlink_compat.c:170
 tipc_nl_compat_recv+0x1042/0x15d0 net/tipc/netlink_compat.c:1324
 genl_family_rcv_msg_doit net/netlink/genetlink.c:972 [inline]
 genl_family_rcv_msg net/netlink/genetlink.c:1052 [inline]
 genl_rcv_msg+0x1220/0x12c0 net/netlink/genetlink.c:1067
 netlink_rcv_skb+0x4a4/0x6a0 net/netlink/af_netlink.c:2545
 genl_rcv+0x41/0x60 net/netlink/genetlink.c:1076
 netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline]
 netlink_unicast+0xf4b/0x1230 net/netlink/af_netlink.c:1368
 netlink_sendmsg+0x1242/0x1420 net/netlink/af_netlink.c:1910
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg net/socket.c:745 [inline]
 ____sys_sendmsg+0x997/0xd60 net/socket.c:2588
 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2642
 __sys_sendmsg net/socket.c:2671 [inline]
 __do_sys_sendmsg net/socket.c:2680 [inline]
 __se_sys_sendmsg net/socket.c:2678 [inline]
 __x64_sys_sendmsg+0x2fa/0x4a0 net/socket.c:2678
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x63/0x6b

Bytes 34-35 of 36 are uninitialized
Memory access of size 36 starts at ffff88802d464a00
Data copied to user address 00007ff55033c0a0

CPU: 0 PID: 30322 Comm: syz-executor.0 Not tainted 6.6.0-14500-g1c41041124bd #10
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-1.fc38 04/01/2014
=====================================================

tipc_add_tlv() puts TLV descriptor and value onto `skb`. This size is
calculated with TLV_SPACE() macro. It adds the size of struct tlv_desc and
the length of TLV value passed as an argument, and aligns the result to a
multiple of TLV_ALIGNTO, i.e., a multiple of 4 bytes.

If the size of struct tlv_desc plus the length of TLV value is not aligned,
the current implementation leaves the remaining bytes uninitialized. This
is the cause of the above kernel-infoleak issue.

This patch resolves this issue by clearing data up to an aligned size.

Fixes: d0796d1ef6 ("tipc: convert legacy nl bearer dump to nl compat")
Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2023-11-28 16:54:54 +00:00
Shigeru Yoshida
b33d130f07 tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING 
[ Upstream commit 19b3f72a41a8751e26bffc093bb7e1cef29ad579 ]

syzbot reported the following uninit-value access issue [1]:

=====================================================
BUG: KMSAN: uninit-value in strlen lib/string.c:418 [inline]
BUG: KMSAN: uninit-value in strstr+0xb8/0x2f0 lib/string.c:756
 strlen lib/string.c:418 [inline]
 strstr+0xb8/0x2f0 lib/string.c:756
 tipc_nl_node_reset_link_stats+0x3ea/0xb50 net/tipc/node.c:2595
 genl_family_rcv_msg_doit net/netlink/genetlink.c:971 [inline]
 genl_family_rcv_msg net/netlink/genetlink.c:1051 [inline]
 genl_rcv_msg+0x11ec/0x1290 net/netlink/genetlink.c:1066
 netlink_rcv_skb+0x371/0x650 net/netlink/af_netlink.c:2545
 genl_rcv+0x40/0x60 net/netlink/genetlink.c:1075
 netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline]
 netlink_unicast+0xf47/0x1250 net/netlink/af_netlink.c:1368
 netlink_sendmsg+0x1238/0x13d0 net/netlink/af_netlink.c:1910
 sock_sendmsg_nosec net/socket.c:730 [inline]
 sock_sendmsg net/socket.c:753 [inline]
 ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2541
 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2595
 __sys_sendmsg net/socket.c:2624 [inline]
 __do_sys_sendmsg net/socket.c:2633 [inline]
 __se_sys_sendmsg net/socket.c:2631 [inline]
 __x64_sys_sendmsg+0x307/0x490 net/socket.c:2631
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Uninit was created at:
 slab_post_alloc_hook+0x12f/0xb70 mm/slab.h:767
 slab_alloc_node mm/slub.c:3478 [inline]
 kmem_cache_alloc_node+0x577/0xa80 mm/slub.c:3523
 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:559
 __alloc_skb+0x318/0x740 net/core/skbuff.c:650
 alloc_skb include/linux/skbuff.h:1286 [inline]
 netlink_alloc_large_skb net/netlink/af_netlink.c:1214 [inline]
 netlink_sendmsg+0xb34/0x13d0 net/netlink/af_netlink.c:1885
 sock_sendmsg_nosec net/socket.c:730 [inline]
 sock_sendmsg net/socket.c:753 [inline]
 ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2541
 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2595
 __sys_sendmsg net/socket.c:2624 [inline]
 __do_sys_sendmsg net/socket.c:2633 [inline]
 __se_sys_sendmsg net/socket.c:2631 [inline]
 __x64_sys_sendmsg+0x307/0x490 net/socket.c:2631
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

TIPC bearer-related names including link names must be null-terminated
strings. If a link name which is not null-terminated is passed through
netlink, strstr() and similar functions can cause buffer overrun. This
causes the above issue.

This patch changes the nla_policy for bearer-related names from NLA_STRING
to NLA_NUL_STRING. This resolves the issue by ensuring that only
null-terminated strings are accepted as bearer-related names.

syzbot reported similar uninit-value issue related to bearer names [2]. The
root cause of this issue is that a non-null-terminated bearer name was
passed. This patch also resolved this issue.

Fixes: 7be57fc691 ("tipc: add link get/dump to new netlink api")
Fixes: 0655f6a863 ("tipc: add bearer disable/enable to new netlink api")
Reported-and-tested-by: syzbot+5138ca807af9d2b42574@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=5138ca807af9d2b42574 [1]
Reported-and-tested-by: syzbot+9425c47dccbcb4c17d51@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9425c47dccbcb4c17d51 [2]
Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Link: https://lore.kernel.org/r/20231030075540.3784537-1-syoshida@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2023-11-20 11:06:55 +01:00
Gustavo A. R. Silva
9b8486fdad tipc: Use size_add() in calls to struct_size() 
[ Upstream commit 2506a91734754de690869824fb0d1ac592ec1266 ]

If, for any reason, the open-coded arithmetic causes a wraparound,
the protection that `struct_size()` adds against potential integer
overflows is defeated. Fix this by hardening call to `struct_size()`
with `size_add()`.

Fixes: e034c6d23b ("tipc: Use struct_size() helper")
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2023-11-20 11:06:44 +01:00
Greg Kroah-Hartman
3e7bedcc0e This is the 5.10.198 stable release 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmUlq8kACgkQONu9yGCS
 aT5GiA//fiURwpUcawIhvgYewMVp+ovJ+mpX5IT+bMbW9Ur0sBhtiiU+WDNYxMru
 34xbSQ/+o2a6N2tmK1JF7o76e2sHw/aRgaoDHkN5oEG+lbRH7TdCv6O0QRFAthcd
 sJL+SX/GclcKW0ZHDjJX9Wt5Lq3gqVYlqJlCsw6gI/1JrQTxStrSQh7yRbrYSqpY
 wGWEq19IrE/ToZFTBuPEEvlBswszGrI88lVtjvRzIdczQVyFLAoEQ2GNPWl3XNBh
 ygGnwiHjk3a+QhZ30evIv2LX+tlGmpLy7gdLDsdZF7RfEkNHQ92IgaHvFDs8JqDg
 QnRE8KCrC2V45OIQRRnA5NVtD3LBYM0bUhbqqLiNvTMiSIBWge4efJwxyYcTTfkX
 MTmbo9z/bIVFdpgCQtneRw3eUyfbRKQ1cUvtmkuXIVLzvZUQaVMpXVZ6pz864E54
 3nJrl2HJtIdJsRX5M4unL+AXNLRoJUbfb4hbzAD0Tg8Wbdgrn7vL/z6JmIzA2ssQ
 +R/52ghimOThGTUbCi2pJx/cpKhegkJEJ7+JwUhS9L9ybA93g/bD0n9zy6JXpd/H
 Cct0JWbiukbDp1CTLQ6Qm9TK5HANW2fXMHoR3H5ltPojNZwN7/pgYqN6ppjtBKVe
 gA3k8KYkZoXjbF6VS1B5Y83wJ+H+39Luk/DSmm1ZNvYPHxmz+q0=
 =2MQy
 -----END PGP SIGNATURE-----

Merge 5.10.198 into android12-5.10-lts

Changes in 5.10.198
	NFS: Use the correct commit info in nfs_join_page_group()
	NFS/pNFS: Report EINVAL errors from connect() to the server
	SUNRPC: Mark the cred for revalidation if the server rejects it
	tracing: Increase trace array ref count on enable and filter files
	ata: ahci: Drop pointless VPRINTK() calls and convert the remaining ones
	ata: libahci: clear pending interrupt status
	ext4: remove the 'group' parameter of ext4_trim_extent
	ext4: add new helper interface ext4_try_to_trim_range()
	ext4: scope ret locally in ext4_try_to_trim_range()
	ext4: change s_last_trim_minblks type to unsigned long
	ext4: mark group as trimmed only if it was fully scanned
	ext4: replace the traditional ternary conditional operator with with max()/min()
	ext4: move setting of trimmed bit into ext4_try_to_trim_range()
	ext4: do not let fstrim block system suspend
	tracing: Have event inject files inc the trace array ref count
	netfilter: nf_tables: integrate pipapo into commit protocol
	netfilter: nf_tables: don't skip expired elements during walk
	netfilter: nf_tables: GC transaction API to avoid race with control plane
	netfilter: nf_tables: adapt set backend to use GC transaction API
	netfilter: nft_set_hash: mark set element as dead when deleting from packet path
	netfilter: nf_tables: remove busy mark and gc batch API
	netfilter: nf_tables: don't fail inserts if duplicate has expired
	netfilter: nf_tables: fix GC transaction races with netns and netlink event exit path
	netfilter: nf_tables: GC transaction race with netns dismantle
	netfilter: nf_tables: GC transaction race with abort path
	netfilter: nf_tables: use correct lock to protect gc_list
	netfilter: nf_tables: defer gc run if previous batch is still pending
	netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction
	netfilter: nft_set_rbtree: use read spinlock to avoid datapath contention
	netfilter: nft_set_pipapo: stop GC iteration if GC transaction allocation fails
	netfilter: nft_set_hash: try later when GC hits EAGAIN on iteration
	netfilter: nf_tables: fix memleak when more than 255 elements expired
	ASoC: meson: spdifin: start hw on dai probe
	netfilter: nf_tables: disallow element removal on anonymous sets
	bpf: Avoid deadlock when using queue and stack maps from NMI
	selftests/tls: Add {} to avoid static checker warning
	selftests: tls: swap the TX and RX sockets in some tests
	ASoC: imx-audmix: Fix return error with devm_clk_get()
	i40e: Fix VF VLAN offloading when port VLAN is configured
	ipv4: fix null-deref in ipv4_link_failure
	powerpc/perf/hv-24x7: Update domain value check
	dccp: fix dccp_v4_err()/dccp_v6_err() again
	platform/x86: intel_scu_ipc: Check status after timeout in busy_loop()
	platform/x86: intel_scu_ipc: Check status upon timeout in ipc_wait_for_interrupt()
	platform/x86: intel_scu_ipc: Don't override scu in intel_scu_ipc_dev_simple_command()
	platform/x86: intel_scu_ipc: Fail IPC send if still busy
	x86/srso: Fix srso_show_state() side effect
	x86/srso: Fix SBPB enablement for spec_rstack_overflow=off
	net: hns3: only enable unicast promisc when mac table full
	net: hns3: add 5ms delay before clear firmware reset irq source
	net: bridge: use DEV_STATS_INC()
	team: fix null-ptr-deref when team device type is changed
	netfilter: ipset: Fix race between IPSET_CMD_CREATE and IPSET_CMD_SWAP
	seqlock: avoid -Wshadow warnings
	seqlock: Rename __seqprop() users
	seqlock: Prefix internal seqcount_t-only macros with a "do_"
	locking/seqlock: Do the lockdep annotation before locking in do_write_seqcount_begin_nested()
	bnxt_en: Flush XDP for bnxt_poll_nitroa0()'s NAPI
	net: rds: Fix possible NULL-pointer dereference
	gpio: tb10x: Fix an error handling path in tb10x_gpio_probe()
	i2c: mux: demux-pinctrl: check the return value of devm_kstrdup()
	netfilter: nf_tables: unregister flowtable hooks on netns exit
	netfilter: nf_tables: double hook unregistration in netns path
	Input: i8042 - rename i8042-x86ia64io.h to i8042-acpipnpio.h
	Input: i8042 - add quirk for TUXEDO Gemini 17 Gen1/Clevo PD70PN
	mmc: renesas_sdhi: probe into TMIO after SCC parameters have been setup
	mmc: renesas_sdhi: populate SCC pointer at the proper place
	mmc: tmio: support custom irq masks
	mmc: renesas_sdhi: register irqs before registering controller
	media: venus: core: Add io base variables for each block
	media: venus: hfi,pm,firmware: Convert to block relative addressing
	media: venus: hfi: Define additional 6xx registers
	media: venus: core: Add differentiator IS_V6(core)
	media: venus: hfi: Add a 6xx boot logic
	media: venus: hfi_venus: Write to VIDC_CTRL_INIT after unmasking interrupts
	netfilter: use actual socket sk for REJECT action
	netfilter: nft_exthdr: Support SCTP chunks
	netfilter: nf_tables: add and use nft_sk helper
	netfilter: nf_tables: add and use nft_thoff helper
	netfilter: nft_exthdr: break evaluation if setting TCP option fails
	netfilter: exthdr: add support for tcp option removal
	netfilter: nft_exthdr: Fix non-linear header modification
	ata: libata: Rename link flag ATA_LFLAG_NO_DB_DELAY
	ata: ahci: Add support for AMD A85 FCH (Hudson D4)
	ata: ahci: Rename board_ahci_mobile
	ata: ahci: Add Elkhart Lake AHCI controller
	btrfs: reset destination buffer when read_extent_buffer() gets invalid range
	MIPS: Alchemy: only build mmc support helpers if au1xmmc is enabled
	bus: ti-sysc: Use fsleep() instead of usleep_range() in sysc_reset()
	bus: ti-sysc: Fix missing AM35xx SoC matching
	clk: tegra: fix error return case for recalc_rate
	ARM: dts: omap: correct indentation
	ARM: dts: ti: omap: Fix bandgap thermal cells addressing for omap3/4
	ARM: dts: motorola-mapphone: Configure lower temperature passive cooling
	ARM: dts: motorola-mapphone: Add 1.2GHz OPP
	ARM: dts: motorola-mapphone: Drop second ti,wlcore compatible value
	ARM: dts: am335x: Guardian: Update beeper label
	ARM: dts: Unify pwm-omap-dmtimer node names
	ARM: dts: ti: omap: motorola-mapphone: Fix abe_clkctrl warning on boot
	bus: ti-sysc: Fix SYSC_QUIRK_SWSUP_SIDLE_ACT handling for uart wake-up
	power: supply: ucs1002: fix error code in ucs1002_get_property()
	xtensa: add default definition for XCHAL_HAVE_DIV32
	xtensa: iss/network: make functions static
	xtensa: boot: don't add include-dirs
	xtensa: boot/lib: fix function prototypes
	gpio: pmic-eic-sprd: Add can_sleep flag for PMIC EIC chip
	i2c: npcm7xx: Fix callback completion ordering
	dma-debug: don't call __dma_entry_alloc_check_leak() under free_entries_lock
	parisc: sba: Fix compile warning wrt list of SBA devices
	parisc: iosapic.c: Fix sparse warnings
	parisc: drivers: Fix sparse warning
	parisc: irq: Make irq_stack_union static to avoid sparse warning
	scsi: qedf: Add synchronization between I/O completions and abort
	selftests/ftrace: Correctly enable event in instance-event.tc
	ring-buffer: Avoid softlockup in ring_buffer_resize()
	selftests: fix dependency checker script
	ring-buffer: Do not attempt to read past "commit"
	platform/mellanox: mlxbf-bootctl: add NET dependency into Kconfig
	scsi: pm80xx: Use phy-specific SAS address when sending PHY_START command
	scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command
	ata: libata-eh: do not clear ATA_PFLAG_EH_PENDING in ata_eh_reset()
	spi: nxp-fspi: reset the FLSHxCR1 registers
	bpf: Clarify error expectations from bpf_clone_redirect
	media: vb2: frame_vector.c: replace WARN_ONCE with a comment
	powerpc/watchpoints: Disable preemption in thread_change_pc()
	ncsi: Propagate carrier gain/loss events to the NCSI controller
	fbdev/sh7760fb: Depend on FB=y
	perf build: Define YYNOMEM as YYNOABORT for bison < 3.81
	sched/cpuacct: Fix user/system in shown cpuacct.usage*
	sched/cpuacct: Fix charge percpu cpuusage
	sched/cpuacct: Optimize away RCU read lock
	cgroup: Fix suspicious rcu_dereference_check() usage warning
	ACPI: Check StorageD3Enable _DSD property in ACPI code
	nvme-pci: factor the iod mempool creation into a helper
	nvme-pci: factor out a nvme_pci_alloc_dev helper
	nvme-pci: do not set the NUMA node of device if it has none
	watchdog: iTCO_wdt: No need to stop the timer in probe
	watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running
	netfilter: nft_exthdr: Search chunks in SCTP packets only
	netfilter: nft_exthdr: Fix for unsafe packet data read
	nvme-pci: always return an ERR_PTR from nvme_pci_alloc_dev
	smack: Record transmuting in smk_transmuted
	smack: Retrieve transmuting information in smack_inode_getsecurity()
	Smack:- Use overlay inode label in smack_inode_copy_up()
	Revert "tty: n_gsm: fix UAF in gsm_cleanup_mux"
	serial: 8250_port: Check IRQ data before use
	nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
	netfilter: nf_tables: disallow rule removal from chain binding
	ALSA: hda: Disable power save for solving pop issue on Lenovo ThinkCentre M70q
	ata: libata-scsi: ignore reserved bits for REPORT SUPPORTED OPERATION CODES
	i2c: i801: unregister tco_pdev in i801_probe() error path
	Revert "SUNRPC dont update timeout value on connection reset"
	proc: nommu: /proc/<pid>/maps: release mmap read lock
	ring-buffer: Update "shortest_full" in polling
	btrfs: properly report 0 avail for very full file systems
	bpf: Fix BTF_ID symbol generation collision
	bpf: Fix BTF_ID symbol generation collision in tools/
	net: thunderbolt: Fix TCPv6 GSO checksum calculation
	ata: libata-core: Fix ata_port_request_pm() locking
	ata: libata-core: Fix port and device removal
	ata: libata-core: Do not register PM operations for SAS ports
	ata: libata-sata: increase PMP SRST timeout to 10s
	fs: binfmt_elf_efpic: fix personality for ELF-FDPIC
	spi: spi-zynqmp-gqspi: Fix runtime PM imbalance in zynqmp_qspi_probe
	spi: zynqmp-gqspi: fix clock imbalance on probe failure
	NFS: Cleanup unused rpc_clnt variable
	NFS: rename nfs_client_kset to nfs_kset
	NFSv4: Fix a state manager thread deadlock regression
	ring-buffer: remove obsolete comment for free_buffer_page()
	ring-buffer: Fix bytes info in per_cpu buffer stats
	drm/mediatek: Fix backport issue in mtk_drm_gem_prime_vmap()
	rbd: move rbd_dev_refresh() definition
	rbd: decouple header read-in from updating rbd_dev->header
	rbd: decouple parent info read-in from updating rbd_dev
	rbd: take header_rwsem in rbd_dev_refresh() only when updating
	block: fix use-after-free of q->q_usage_counter
	Revert "clk: imx: pll14xx: dynamically configure PLL for 393216000/361267200Hz"
	Revert "PCI: qcom: Disable write access to read only registers for IP v2.3.3"
	scsi: zfcp: Fix a double put in zfcp_port_enqueue()
	qed/red_ll2: Fix undefined behavior bug in struct qed_ll2_info
	wifi: mwifiex: Fix tlv_buf_left calculation
	net: replace calls to sock->ops->connect() with kernel_connect()
	net: prevent rewrite of msg_name in sock_sendmsg()
	arm64: Add Cortex-A520 CPU part definition
	ubi: Refuse attaching if mtd's erasesize is 0
	wifi: iwlwifi: dbg_ini: fix structure packing
	wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet
	bpf: Fix tr dereferencing
	drivers/net: process the result of hdlc_open() and add call of hdlc_close() in uhdlc_close()
	wifi: mt76: mt76x02: fix MT76x0 external LNA gain handling
	regmap: rbtree: Fix wrong register marked as in-cache when creating new node
	ima: Finish deprecation of IMA_TRUSTED_KEYRING Kconfig
	scsi: target: core: Fix deadlock due to recursive locking
	ima: rework CONFIG_IMA dependency block
	NFSv4: Fix a nfs4_state_manager() race
	modpost: add missing else to the "of" check
	net: fix possible store tearing in neigh_periodic_work()
	ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data()
	net: dsa: mv88e6xxx: Avoid EEPROM timeout when EEPROM is absent
	net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg
	net: nfc: llcp: Add lock when modifying device list
	net: ethernet: ti: am65-cpsw: Fix error code in am65_cpsw_nuss_init_tx_chns()
	netfilter: handle the connecting collision properly in nf_conntrack_proto_sctp
	netfilter: nf_tables: nft_set_rbtree: fix spurious insertion failure
	net: stmmac: dwmac-stm32: fix resume on STM32 MCU
	tipc: fix a potential deadlock on &tx->lock
	tcp: fix quick-ack counting to count actual ACKs of new data
	tcp: fix delayed ACKs for MSS boundary condition
	sctp: update transport state when processing a dupcook packet
	sctp: update hb timer immediately after users change hb_interval
	cpupower: add Makefile dependencies for install targets
	dm zoned: free dmz->ddev array in dmz_put_zoned_devices
	RDMA/core: Require admin capabilities to set system parameters
	of: dynamic: Fix potential memory leak in of_changeset_action()
	IB/mlx4: Fix the size of a buffer in add_port_entries()
	gpio: aspeed: fix the GPIO number passed to pinctrl_gpio_set_config()
	gpio: pxa: disable pinctrl calls for MMP_GPIO
	RDMA/cma: Initialize ib_sa_multicast structure to 0 when join
	RDMA/cma: Fix truncation compilation warning in make_cma_ports
	RDMA/uverbs: Fix typo of sizeof argument
	RDMA/siw: Fix connection failure handling
	RDMA/mlx5: Fix NULL string error
	parisc: Restore __ldcw_align for PA-RISC 2.0 processors
	netfilter: nf_tables: fix kdoc warnings after gc rework
	netfilter: nftables: exthdr: fix 4-byte stack OOB write
	mmc: renesas_sdhi: only reset SCC when its pointer is populated
	xen/events: replace evtchn_rwlock with RCU
	Linux 5.10.198

Change-Id: Iabfdf919ae63e41a565e523087d800ebc20e5448
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2023-10-26 17:54:46 +00:00
Chengfeng Ye
6a24d0661f tipc: fix a potential deadlock on &tx->lock 
[ Upstream commit 08e50cf071847323414df0835109b6f3560d44f5 ]

It seems that tipc_crypto_key_revoke() could be be invoked by
wokequeue tipc_crypto_work_rx() under process context and
timer/rx callback under softirq context, thus the lock acquisition
on &tx->lock seems better use spin_lock_bh() to prevent possible
deadlock.

This flaw was found by an experimental static analysis tool I am
developing for irq-related deadlock.

tipc_crypto_work_rx() <workqueue>
--> tipc_crypto_key_distr()
--> tipc_bcast_xmit()
--> tipc_bcbase_xmit()
--> tipc_bearer_bc_xmit()
--> tipc_crypto_xmit()
--> tipc_ehdr_build()
--> tipc_crypto_key_revoke()
--> spin_lock(&tx->lock)
<timer interrupt>
   --> tipc_disc_timeout()
   --> tipc_bearer_xmit_skb()
   --> tipc_crypto_xmit()
   --> tipc_ehdr_build()
   --> tipc_crypto_key_revoke()
   --> spin_lock(&tx->lock) <deadlock here>

Signed-off-by: Chengfeng Ye <dg573847474@gmail.com>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Acked-by: Jon Maloy <jmaloy@redhat.com>
Fixes: fc1b6d6de2 ("tipc: introduce TIPC encryption & authentication")
Link: https://lore.kernel.org/r/20230927181414.59928-1-dg573847474@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2023-10-10 21:53:38 +02:00
Greg Kroah-Hartman
df0f5bd7a8 This is the 5.10.190 stable release 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmTWBikACgkQONu9yGCS
 aT7+sBAAgFSUVSAURxIgHfi1XvXnGI/eZI/0ub8AqkWRdMUVbpqXR0hsq1/KP5sj
 zz6l4QTfFyGm5EQPv3dEDi3Nztsb2dQEaJTIKQV6N4kY133fn6sYIxQE9Rb1jHcp
 UoI/WbiOAwRqKd5glsPANByen6U4871Y1h2drBgMXYzP1fVEhPCVxz1XhAyZlVTw
 n94774DCiSXaVUt82r5IPOV2HfZAnik4BThCD3oE1v9qN2ugow51GA11R9Mf49lR
 mthPqsMhOHl+IPgB+3VaL+DCDDbs6b+izBCNSy5Jdupqsd22RuuLE3a8gSgZSoYB
 3NrIqwOPUuVX3yUsvaTfklXMDU8RyKGEAIK/njW2NSFv8ccMa1lymhXnrkjSd7AP
 BdHVfpB9k3WJQt6ElMfH6S8KszWFyLgolsT7cG3osi7VgsbDuGW30ApTl7WI7nDB
 QgoM3X2FfYYZ8uc7+fT0PU8tk098VqB0c4PQbigN7i0l0J6o1PPrg4Ke9++qaSAs
 PZ+rUha4+9whgjjyF05sWSScgwo0Az4qEx5r1Igf3lfDOUnfIPy3cKd+O1zpjrt5
 6ZO3CQkYM4IO8mP5ps2t4rJvZuPfAVBi3Ndgtt/JbLlkxbkuhNzTE1TKA7UOZRAW
 RK6YlzhHsR5LQEOZb6pVJtO2HTaJSBjTrp4W+xj/e6k51z+I4Co=
 =RCz+
 -----END PGP SIGNATURE-----

Merge 5.10.190 into android12-5.10-lts

Changes in 5.10.190
	KVM: s390: pv: fix index value of replaced ASCE
	io_uring: don't audit the capability check in io_uring_create()
	gpio: tps68470: Make tps68470_gpio_output() always set the initial value
	btrfs: fix race between quota disable and relocation
	btrfs: fix extent buffer leak after tree mod log failure at split_node()
	i2c: Delete error messages for failed memory allocations
	i2c: Improve size determinations
	i2c: nomadik: Remove unnecessary goto label
	i2c: nomadik: Use devm_clk_get_enabled()
	i2c: nomadik: Remove a useless call in the remove function
	PCI/ASPM: Return 0 or -ETIMEDOUT from pcie_retrain_link()
	PCI/ASPM: Factor out pcie_wait_for_retrain()
	PCI/ASPM: Avoid link retraining race
	dlm: cleanup plock_op vs plock_xop
	dlm: rearrange async condition return
	fs: dlm: interrupt posix locks only when process is killed
	drm/ttm: add ttm_bo_pin()/ttm_bo_unpin() v2
	drm/ttm: never consider pinned BOs for eviction&swap
	tracing: Show real address for trace event arguments
	pwm: meson: Simplify duplicated per-channel tracking
	pwm: meson: fix handling of period/duty if greater than UINT_MAX
	ext4: fix to check return value of freeze_bdev() in ext4_shutdown()
	phy: qcom-snps: Use dev_err_probe() to simplify code
	phy: qcom-snps: correct struct qcom_snps_hsphy kerneldoc
	phy: qcom-snps-femto-v2: keep cfg_ahb_clk enabled during runtime suspend
	phy: qcom-snps-femto-v2: properly enable ref clock
	media: staging: atomisp: select V4L2_FWNODE
	i40e: Fix an NULL vs IS_ERR() bug for debugfs_create_dir()
	net: phy: marvell10g: fix 88x3310 power up
	net: hns3: reconstruct function hclge_ets_validate()
	net: hns3: fix wrong bw weight of disabled tc issue
	vxlan: move to its own directory
	vxlan: calculate correct header length for GPE
	phy: hisilicon: Fix an out of bounds check in hisi_inno_phy_probe()
	ethernet: atheros: fix return value check in atl1e_tso_csum()
	ipv6 addrconf: fix bug where deleting a mngtmpaddr can create a new temporary address
	tcp: Reduce chance of collisions in inet6_hashfn().
	ice: Fix memory management in ice_ethtool_fdir.c
	bonding: reset bond's flags when down link is P2P device
	team: reset team's flags when down link is P2P device
	platform/x86: msi-laptop: Fix rfkill out-of-sync on MSI Wind U100
	netfilter: nft_set_rbtree: fix overlap expiration walk
	netfilter: nftables: add helper function to validate set element data
	netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR
	netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID
	net/sched: mqprio: refactor nlattr parsing to a separate function
	net/sched: mqprio: add extack to mqprio_parse_nlattr()
	net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64
	benet: fix return value check in be_lancer_xmit_workarounds()
	tipc: check return value of pskb_trim()
	tipc: stop tipc crypto on failure in tipc_node_create
	RDMA/mlx4: Make check for invalid flags stricter
	drm/msm/dpu: drop enum dpu_core_perf_data_bus_id
	drm/msm/adreno: Fix snapshot BINDLESS_DATA size
	RDMA/mthca: Fix crash when polling CQ for shared QPs
	drm/msm: Fix IS_ERR_OR_NULL() vs NULL check in a5xx_submit_in_rb()
	ASoC: fsl_spdif: Silence output on stop
	block: Fix a source code comment in include/uapi/linux/blkzoned.h
	dm raid: fix missing reconfig_mutex unlock in raid_ctr() error paths
	dm raid: clean up four equivalent goto tags in raid_ctr()
	dm raid: protect md_stop() with 'reconfig_mutex'
	ata: pata_ns87415: mark ns87560_tf_read static
	ring-buffer: Fix wrong stat of cpu_buffer->read
	tracing: Fix warning in trace_buffered_event_disable()
	Revert "usb: gadget: tegra-xudc: Fix error check in tegra_xudc_powerdomain_init()"
	USB: gadget: Fix the memory leak in raw_gadget driver
	serial: qcom-geni: drop bogus runtime pm state update
	serial: 8250_dw: Preserve original value of DLF register
	serial: sifive: Fix sifive_serial_console_setup() section
	USB: serial: option: support Quectel EM060K_128
	USB: serial: option: add Quectel EC200A module support
	USB: serial: simple: add Kaufmann RKS+CAN VCP
	USB: serial: simple: sort driver entries
	can: gs_usb: gs_can_close(): add missing set of CAN state to CAN_STATE_STOPPED
	Revert "usb: dwc3: core: Enable AutoRetry feature in the controller"
	usb: dwc3: pci: skip BYT GPIO lookup table for hardwired phy
	usb: dwc3: don't reset device side if dwc3 was configured as host-only
	usb: ohci-at91: Fix the unhandle interrupt when resume
	USB: quirks: add quirk for Focusrite Scarlett
	usb: xhci-mtk: set the dma max_seg_size
	Revert "usb: xhci: tegra: Fix error check"
	Documentation: security-bugs.rst: update preferences when dealing with the linux-distros group
	Documentation: security-bugs.rst: clarify CVE handling
	staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext()
	tty: n_gsm: fix UAF in gsm_cleanup_mux
	ALSA: hda/relatek: Enable Mute LED on HP 250 G8
	hwmon: (nct7802) Fix for temp6 (PECI1) processed even if PECI1 disabled
	btrfs: check for commit error at btrfs_attach_transaction_barrier()
	file: always lock position for FMODE_ATOMIC_POS
	nfsd: Remove incorrect check in nfsd4_validate_stateid
	tpm_tis: Explicitly check for error code
	irq-bcm6345-l1: Do not assume a fixed block to cpu mapping
	irqchip/gic-v4.1: Properly lock VPEs when doing a directLPI invalidation
	KVM: VMX: Invert handling of CR0.WP for EPT without unrestricted guest
	KVM: VMX: Fold ept_update_paging_mode_cr0() back into vmx_set_cr0()
	KVM: nVMX: Do not clear CR3 load/store exiting bits if L1 wants 'em
	KVM: VMX: Don't fudge CR0 and CR4 for restricted L2 guest
	staging: rtl8712: Use constants from <linux/ieee80211.h>
	staging: r8712: Fix memory leak in _r8712_init_xmit_priv()
	btrfs: check if the transaction was aborted at btrfs_wait_for_commit()
	virtio-net: fix race between set queues and probe
	s390/dasd: fix hanging device after quiesce/resume
	ASoC: wm8904: Fill the cache for WM8904_ADC_TEST_0 register
	ceph: never send metrics if disable_send_metrics is set
	dm cache policy smq: ensure IO doesn't prevent cleaner policy progress
	drm/ttm: make ttm_bo_unpin more defensive
	ACPI: processor: perflib: Use the "no limit" frequency QoS
	ACPI: processor: perflib: Avoid updating frequency QoS unnecessarily
	cpufreq: intel_pstate: Drop ACPI _PSS states table patching
	selftests: mptcp: depend on SYN_COOKIES
	io_uring: treat -EAGAIN for REQ_F_NOWAIT as final for io-wq
	ASoC: cs42l51: fix driver to properly autoload with automatic module loading
	kprobes/x86: Fix fall-through warnings for Clang
	x86/kprobes: Do not decode opcode in resume_execution()
	x86/kprobes: Retrieve correct opcode for group instruction
	x86/kprobes: Identify far indirect JMP correctly
	x86/kprobes: Use int3 instead of debug trap for single-step
	x86/kprobes: Fix to identify indirect jmp and others using range case
	x86/kprobes: Move 'inline' to the beginning of the kprobe_is_ss() declaration
	x86/kprobes: Update kcb status flag after singlestepping
	x86/kprobes: Fix JNG/JNLE emulation
	io_uring: gate iowait schedule on having pending requests
	perf: Fix function pointer case
	loop: Select I/O scheduler 'none' from inside add_disk()
	arm64: dts: imx8mn-var-som: add missing pull-up for onboard PHY reset pinmux
	word-at-a-time: use the same return type for has_zero regardless of endianness
	KVM: s390: fix sthyi error handling
	wifi: cfg80211: Fix return value in scan logic
	net/mlx5: DR, fix memory leak in mlx5dr_cmd_create_reformat_ctx
	net/mlx5e: fix return value check in mlx5e_ipsec_remove_trailer()
	bpf: Add length check for SK_DIAG_BPF_STORAGE_REQ_MAP_FD parsing
	rtnetlink: let rtnl_bridge_setlink checks IFLA_BRIDGE_MODE length
	net: dsa: fix value check in bcm_sf2_sw_probe()
	perf test uprobe_from_different_cu: Skip if there is no gcc
	net: sched: cls_u32: Fix match key mis-addressing
	mISDN: hfcpci: Fix potential deadlock on &hc->lock
	net: annotate data-races around sk->sk_max_pacing_rate
	net: add missing READ_ONCE(sk->sk_rcvlowat) annotation
	net: add missing READ_ONCE(sk->sk_sndbuf) annotation
	net: add missing READ_ONCE(sk->sk_rcvbuf) annotation
	net: add missing data-race annotations around sk->sk_peek_off
	net: add missing data-race annotation for sk_ll_usec
	net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free
	net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free
	net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free
	bpf: sockmap: Remove preempt_disable in sock_map_sk_acquire
	net: ll_temac: Switch to use dev_err_probe() helper
	net: ll_temac: fix error checking of irq_of_parse_and_map()
	net: netsec: Ignore 'phy-mode' on SynQuacer in DT mode
	net: dcb: choose correct policy to parse DCB_ATTR_BCN
	s390/qeth: Don't call dev_close/dev_open (DOWN/UP)
	ip6mr: Fix skb_under_panic in ip6mr_cache_report()
	vxlan: Fix nexthop hash size
	net/mlx5: fs_core: Make find_closest_ft more generic
	net/mlx5: fs_core: Skip the FTs in the same FS_TYPE_PRIO_CHAINS fs_prio
	tcp_metrics: fix addr_same() helper
	tcp_metrics: annotate data-races around tm->tcpm_stamp
	tcp_metrics: annotate data-races around tm->tcpm_lock
	tcp_metrics: annotate data-races around tm->tcpm_vals[]
	tcp_metrics: annotate data-races around tm->tcpm_net
	tcp_metrics: fix data-race in tcpm_suck_dst() vs fastopen
	scsi: zfcp: Defer fc_rport blocking until after ADISC response
	libceph: fix potential hang in ceph_osdc_notify()
	USB: zaurus: Add ID for A-300/B-500/C-700
	ceph: defer stopping mdsc delayed_work
	exfat: use kvmalloc_array/kvfree instead of kmalloc_array/kfree
	exfat: release s_lock before calling dir_emit()
	mtd: spinand: toshiba: Fix ecc_get_status
	mtd: rawnand: meson: fix OOB available bytes for ECC
	arm64: dts: stratix10: fix incorrect I2C property for SCL signal
	net: tun_chr_open(): set sk_uid from current_fsuid()
	net: tap_open(): set sk_uid from current_fsuid()
	bpf: Disable preemption in bpf_event_output
	open: make RESOLVE_CACHED correctly test for O_TMPFILE
	drm/ttm: check null pointer before accessing when swapping
	file: reinstate f_pos locking optimization for regular files
	tracing: Fix sleeping while atomic in kdb ftdump
	fs/sysv: Null check to prevent null-ptr-deref bug
	Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb
	net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb
	fs: Protect reconfiguration of sb read-write from racing writes
	ext2: Drop fragment support
	mtd: rawnand: omap_elm: Fix incorrect type in assignment
	mtd: rawnand: fsl_upm: Fix an off-by one test in fun_exec_op()
	powerpc/mm/altmap: Fix altmap boundary check
	selftests/rseq: check if libc rseq support is registered
	selftests/rseq: Play nice with binaries statically linked against glibc 2.35+
	soundwire: bus: add better dev_dbg to track complete() calls
	soundwire: bus: pm_runtime_request_resume on peripheral attachment
	soundwire: fix enumeration completion
	PM / wakeirq: support enabling wake-up irq after runtime_suspend called
	PM: sleep: wakeirq: fix wake irq arming
	exfat: speed up iterate/lookup by fixing start point of traversing cluster chain
	exfat: support dynamic allocate bh for exfat_entry_set_cache
	exfat: check if filename entries exceeds max filename length
	mt76: move band capabilities in mt76_phy
	mt76: mt7615: Fix fall-through warnings for Clang
	wifi: mt76: mt7615: do not advertise 5 GHz on first phy of MT7615D (DBDC)
	ARM: dts: imx: add usb alias
	ARM: dts: imx6sll: fixup of operating points
	ARM: dts: nxp/imx6sll: fix wrong property name in usbphy node
	x86/CPU/AMD: Do not leak quotient data after a division by 0
	Linux 5.10.190

Fix up build problem in ext4 due to merge of ed3d841f2f ("ext4: fix to
check return value of freeze_bdev() in ext4_shutdown()") conflicting
with a previous block layer core change coming in through the f2fs tree
in the past, that is not upstream, but ANDROID specific.

Change-Id: Ib95e59ce8ba653bcc791802735afafcd26bd996f
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2023-08-25 12:26:58 +00:00
Fedor Pchelkin
9d1fd118bc tipc: stop tipc crypto on failure in tipc_node_create 
[ Upstream commit de52e17326c3e9a719c9ead4adb03467b8fae0ef ]

If tipc_link_bc_create() fails inside tipc_node_create() for a newly
allocated tipc node then we should stop its tipc crypto and free the
resources allocated with a call to tipc_crypto_start().

As the node ref is initialized to one to that point, just put the ref on
tipc_link_bc_create() error case that would lead to tipc_node_free() be
eventually executed and properly clean the node and its crypto resources.

Found by Linux Verification Center (linuxtesting.org).

Fixes: cb8092d70a6f ("tipc: move bc link creation back to tipc_node_create")
Suggested-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Reviewed-by: Xin Long <lucien.xin@gmail.com>
Link: https://lore.kernel.org/r/20230725214628.25246-1-pchelkin@ispras.ru
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2023-08-11 11:57:37 +02:00
Yuanjun Gong
d03de93776 tipc: check return value of pskb_trim() 
[ Upstream commit e46e06ffc6d667a89b979701288e2264f45e6a7b ]

goto free_skb if an unexpected result is returned by pskb_tirm()
in tipc_crypto_rcv_complete().

Fixes: fc1b6d6de2 ("tipc: introduce TIPC encryption & authentication")
Signed-off-by: Yuanjun Gong <ruc_gongyuanjun@163.com>
Reviewed-by: Tung Nguyen <tung.q.nguyen@dektech.com.au>
Link: https://lore.kernel.org/r/20230725064810.5820-1-ruc_gongyuanjun@163.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2023-08-11 11:57:37 +02:00
Greg Kroah-Hartman
c6ac900e26 Merge 5.10.185 into android12-5.10-lts 
Changes in 5.10.185
	lib: cleanup kstrto*() usage
	kernel.h: split out kstrtox() and simple_strtox() to a separate header
	test_firmware: Use kstrtobool() instead of strtobool()
	test_firmware: prevent race conditions by a correct implementation of locking
	test_firmware: fix a memory leak with reqs buffer
	power: supply: ab8500: Fix external_power_changed race
	power: supply: sc27xx: Fix external_power_changed race
	power: supply: bq27xxx: Use mod_delayed_work() instead of cancel() + schedule()
	ARM: dts: vexpress: add missing cache properties
	tools: gpio: fix debounce_period_us output of lsgpio
	power: supply: Ratelimit no data debug output
	platform/x86: asus-wmi: Ignore WMI events with codes 0x7B, 0xC0
	regulator: Fix error checking for debugfs_create_dir
	irqchip/gic-v3: Disable pseudo NMIs on Mediatek devices w/ firmware issues
	power: supply: Fix logic checking if system is running from battery
	btrfs: scrub: try harder to mark RAID56 block groups read-only
	btrfs: handle memory allocation failure in btrfs_csum_one_bio
	ASoC: soc-pcm: test if a BE can be prepared
	parisc: Improve cache flushing for PCXL in arch_sync_dma_for_cpu()
	parisc: Flush gatt writes and adjust gatt mask in parisc_agp_mask_memory()
	MIPS: Alchemy: fix dbdma2
	mips: Move initrd_start check after initrd address sanitisation.
	ASoC: dwc: move DMA init to snd_soc_dai_driver probe()
	xen/blkfront: Only check REQ_FUA for writes
	drm:amd:amdgpu: Fix missing buffer object unlock in failure path
	irqchip/gic: Correctly validate OF quirk descriptors
	io_uring: hold uring mutex around poll removal
	epoll: ep_autoremove_wake_function should use list_del_init_careful
	ocfs2: fix use-after-free when unmounting read-only filesystem
	ocfs2: check new file size on fallocate call
	nios2: dts: Fix tse_mac "max-frame-size" property
	nilfs2: fix incomplete buffer cleanup in nilfs_btnode_abort_change_key()
	nilfs2: fix possible out-of-bounds segment allocation in resize ioctl
	kexec: support purgatories with .text.hot sections
	x86/purgatory: remove PGO flags
	powerpc/purgatory: remove PGO flags
	nouveau: fix client work fence deletion race
	RDMA/uverbs: Restrict usage of privileged QKEYs
	net: usb: qmi_wwan: add support for Compal RXM-G1
	ALSA: hda/realtek: Add a quirk for Compaq N14JP6
	Remove DECnet support from kernel
	USB: serial: option: add Quectel EM061KGL series
	serial: lantiq: add missing interrupt ack
	usb: dwc3: gadget: Reset num TRBs before giving back the request
	RDMA/rtrs: Fix the last iu->buf leak in err path
	spi: fsl-dspi: avoid SCK glitches with continuous transfers
	netfilter: nfnetlink: skip error delivery on batch in case of ENOMEM
	net: enetc: correct the indexes of highest and 2nd highest TCs
	ping6: Fix send to link-local addresses with VRF.
	net/sched: cls_u32: Fix reference counter leak leading to overflow
	RDMA/rxe: Remove the unused variable obj
	RDMA/rxe: Removed unused name from rxe_task struct
	RDMA/rxe: Fix the use-before-initialization error of resp_pkts
	iavf: remove mask from iavf_irq_enable_queues()
	octeontx2-af: fixed resource availability check
	RDMA/mlx5: Initiate dropless RQ for RAW Ethernet functions
	RDMA/cma: Always set static rate to 0 for RoCE
	IB/uverbs: Fix to consider event queue closing also upon non-blocking mode
	IB/isert: Fix dead lock in ib_isert
	IB/isert: Fix possible list corruption in CMA handler
	IB/isert: Fix incorrect release of isert connection
	ipvlan: fix bound dev checking for IPv6 l3s mode
	sctp: fix an error code in sctp_sf_eat_auth()
	igb: fix nvm.ops.read() error handling
	drm/nouveau: don't detect DSM for non-NVIDIA device
	drm/nouveau/dp: check for NULL nv_connector->native_mode
	drm/nouveau: add nv_encoder pointer check for NULL
	ext4: drop the call to ext4_error() from ext4_get_group_info()
	net/sched: cls_api: Fix lockup on flushing explicitly created chain
	net: lapbether: only support ethernet devices
	net: tipc: resize nlattr array to correct size
	selftests/ptp: Fix timestamp printf format for PTP_SYS_OFFSET
	afs: Fix vlserver probe RTT handling
	cgroup: always put cset in cgroup_css_set_put_fork
	rcu/kvfree: Avoid freeing new kfree_rcu() memory after old grace period
	neighbour: Remove unused inline function neigh_key_eq16()
	net: Remove unused inline function dst_hold_and_use()
	net: Remove DECnet leftovers from flow.h.
	neighbour: delete neigh_lookup_nodev as not used
	batman-adv: Switch to kstrtox.h for kstrtou64
	mmc: block: ensure error propagation for non-blk
	mm/memory_hotplug: extend offline_and_remove_memory() to handle more than one memory block
	nilfs2: reject devices with insufficient block count
	media: dvbdev: Fix memleak in dvb_register_device
	media: dvbdev: fix error logic at dvb_register_device()
	media: dvb-core: Fix use-after-free due to race at dvb_register_device()
	drm/i915/dg1: Wait for pcode/uncore handshake at startup
	drm/i915/gen11+: Only load DRAM information from pcode
	um: Fix build w/o CONFIG_PM_SLEEP
	Linux 5.10.185

Change-Id: I05ba9c2e38c013c553c9f89e2a6b71ec9bdb0bd3
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2023-06-28 10:31:14 +00:00
Greg Kroah-Hartman
f8e9848656 Revert "tipc: add tipc_bearer_min_mtu to calculate min mtu" 
This reverts commit 097ea78d8c which is
commit 3ae6d66b605be604644d4bb5708a7ffd9cf1abe8 upstream.

It breaks the Android kernel ABI and is not needed for Android devices,
so it is safe to revert for now.  If it is determined that it is needed
in the future, it can be brought back in an abi-preserving way.

Bug: 161946584
Change-Id: I0b32b3b8d7c81895dd1680f7aec65d38cace080d
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2023-06-27 12:12:21 +00:00
Greg Kroah-Hartman
7ae5626406 Revert "tipc: do not update mtu if msg_max is too small in mtu negotiation" 
This reverts commit 2bd4ff4ffb which is
commit 56077b56cd3fb78e1c8619e29581ba25a5c55e86 upstream.

It breaks the Android kernel ABI and is not needed for Android devices,
so it is safe to revert for now.  If it is determined that it is needed
in the future, it can be brought back in an abi-preserving way.

Bug: 161946584
Change-Id: I5fc048bf94f78a38691e3b27cf225536200bcd49
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2023-06-27 12:12:09 +00:00
Greg Kroah-Hartman
4a7c41b710 Revert "tipc: check the bearer min mtu properly when setting it by netlink" 
This reverts commit 2937127d24 which is
commit 35a089b5d793d2bfd2cc7cfa6104545184de2ce7 upstream.

It breaks the Android kernel ABI and is not needed for Android devices,
so it is safe to revert for now.  If it is determined that it is needed
in the future, it can be brought back in an abi-preserving way.

Bug: 161946584
Change-Id: Iac2aaf58f7e53317626d0f7f125b55e72228c770
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2023-06-27 12:11:55 +00:00
Greg Kroah-Hartman
6d62ca19a7 Merge 5.10.181 into android12-5.10-lts 
Changes in 5.10.181
	driver core: add a helper to setup both the of_node and fwnode of a device
	drm/mipi-dsi: Set the fwnode for mipi_dsi_device
	ARM: 9296/1: HP Jornada 7XX: fix kernel-doc warnings
	net: mdio: mvusb: Fix an error handling path in mvusb_mdio_probe()
	linux/dim: Do nothing if no time delta between samples
	net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs().
	netfilter: conntrack: fix possible bug_on with enable_hooks=1
	netlink: annotate accesses to nlk->cb_running
	net: annotate sk->sk_err write from do_recvmmsg()
	net: deal with most data-races in sk_wait_event()
	net: tap: check vlan with eth_type_vlan() method
	net: add vlan_get_protocol_and_depth() helper
	tcp: factor out __tcp_close() helper
	tcp: add annotations around sk->sk_shutdown accesses
	ipvlan:Fix out-of-bounds caused by unclear skb->cb
	net: datagram: fix data-races in datagram_poll()
	af_unix: Fix a data race of sk->sk_receive_queue->qlen.
	af_unix: Fix data races around sk->sk_shutdown.
	drm/i915/dp: prevent potential div-by-zero
	fbdev: arcfb: Fix error handling in arcfb_probe()
	ext4: remove an unused variable warning with CONFIG_QUOTA=n
	ext4: reflect error codes from ext4_multi_mount_protect() to its callers
	ext4: don't clear SB_RDONLY when remounting r/w until quota is re-enabled
	ext4: fix lockdep warning when enabling MMP
	ext4: remove redundant mb_regenerate_buddy()
	ext4: drop s_mb_bal_lock and convert protected fields to atomic
	ext4: add mballoc stats proc file
	ext4: allow to find by goal if EXT4_MB_HINT_GOAL_ONLY is set
	ext4: allow ext4_get_group_info() to fail
	refscale: Move shutdown from wait_event() to wait_event_idle()
	rcu: Protect rcu_print_task_exp_stall() ->exp_tasks access
	fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode()
	drm/amd/display: Use DC_LOG_DC in the trasform pixel function
	regmap: cache: Return error in cache sync operations for REGCACHE_NONE
	arm64: dts: qcom: msm8996: Add missing DWC3 quirks
	memstick: r592: Fix UAF bug in r592_remove due to race condition
	firmware: arm_sdei: Fix sleep from invalid context BUG
	ACPI: EC: Fix oops when removing custom query handlers
	remoteproc: stm32_rproc: Add mutex protection for workqueue
	drm/tegra: Avoid potential 32-bit integer overflow
	ACPICA: Avoid undefined behavior: applying zero offset to null pointer
	ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects
	drm/amd: Fix an out of bounds error in BIOS parser
	wifi: ath: Silence memcpy run-time false positive warning
	bpf: Annotate data races in bpf_local_storage
	wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex
	ext2: Check block size validity during mount
	scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow
	net: pasemi: Fix return type of pasemi_mac_start_tx()
	net: Catch invalid index in XPS mapping
	scsi: target: iscsit: Free cmds before session free
	lib: cpu_rmap: Avoid use after free on rmap->obj array entries
	scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race condition
	gfs2: Fix inode height consistency check
	ext4: set goal start correctly in ext4_mb_normalize_request
	ext4: Fix best extent lstart adjustment logic in ext4_mb_new_inode_pa()
	f2fs: fix to drop all dirty pages during umount() if cp_error is set
	samples/bpf: Fix fout leak in hbm's run_bpf_prog
	wifi: iwlwifi: pcie: fix possible NULL pointer dereference
	wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf
	null_blk: Always check queue mode setting from configfs
	wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace
	wifi: ath11k: Fix SKB corruption in REO destination ring
	ipvs: Update width of source for ip_vs_sync_conn_options
	Bluetooth: hci_bcm: Fall back to getting bdaddr from EFI if not set
	Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp
	staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE
	HID: logitech-hidpp: Don't use the USB serial for USB devices
	HID: logitech-hidpp: Reconcile USB and Unifying serials
	spi: spi-imx: fix MX51_ECSPI_* macros when cs > 3
	HID: wacom: generic: Set battery quirk only when we see battery data
	usb: typec: tcpm: fix multiple times discover svids error
	serial: 8250: Reinit port->pm on port specific driver unbind
	mcb-pci: Reallocate memory region to avoid memory overlapping
	sched: Fix KCSAN noinstr violation
	recordmcount: Fix memory leaks in the uwrite function
	RDMA/core: Fix multiple -Warray-bounds warnings
	iommu/arm-smmu-qcom: Limit the SMR groups to 128
	clk: tegra20: fix gcc-7 constant overflow warning
	iommu/arm-smmu-v3: Acknowledge pri/event queue overflow if any
	Input: xpad - add constants for GIP interface numbers
	phy: st: miphy28lp: use _poll_timeout functions for waits
	mfd: dln2: Fix memory leak in dln2_probe()
	btrfs: move btrfs_find_highest_objectid/btrfs_find_free_objectid to disk-io.c
	btrfs: replace calls to btrfs_find_free_ino with btrfs_find_free_objectid
	btrfs: fix space cache inconsistency after error loading it from disk
	xfrm: don't check the default policy if the policy allows the packet
	Revert "Fix XFRM-I support for nested ESP tunnels"
	drm/msm/dp: unregister audio driver during unbind
	drm/msm/dpu: Remove duplicate register defines from INTF
	cpupower: Make TSC read per CPU for Mperf monitor
	af_key: Reject optional tunnel/BEET mode templates in outbound policies
	net: fec: Better handle pm_runtime_get() failing in .remove()
	net: phy: dp83867: add w/a for packet errors seen with short cables
	ALSA: firewire-digi00x: prevent potential use after free
	ALSA: hda/realtek: Apply HP B&O top speaker profile to Pavilion 15
	vsock: avoid to close connected socket after the timeout
	ipv4/tcp: do not use per netns ctl sockets
	net: Find dst with sk's xfrm policy not ctl_sk
	tcp: fix possible sk_priority leak in tcp_v4_send_reset()
	serial: arc_uart: fix of_iomap leak in `arc_serial_probe`
	erspan: get the proto with the md version for collect_md
	net: hns3: fix sending pfc frames after reset issue
	net: hns3: fix reset delay time to avoid configuration timeout
	media: netup_unidvb: fix use-after-free at del_timer()
	SUNRPC: Fix trace_svc_register() call site
	drm/exynos: fix g2d_open/close helper function definitions
	net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment()
	net/tipc: fix tipc header files for kernel-doc
	tipc: add tipc_bearer_min_mtu to calculate min mtu
	tipc: do not update mtu if msg_max is too small in mtu negotiation
	tipc: check the bearer min mtu properly when setting it by netlink
	net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop()
	net: bcmgenet: Restore phy_stop() depending upon suspend/close
	wifi: mac80211: fix min center freq offset tracing
	wifi: iwlwifi: mvm: don't trust firmware n_channels
	scsi: storvsc: Don't pass unused PFNs to Hyper-V host
	cassini: Fix a memory leak in the error handling path of cas_init_one()
	igb: fix bit_shift to be in [1..8] range
	vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit()
	netfilter: nft_set_rbtree: fix null deref on element insertion
	bridge: always declare tunnel functions
	ALSA: usb-audio: Add a sample rate workaround for Line6 Pod Go
	USB: usbtmc: Fix direction for 0-length ioctl control messages
	usb-storage: fix deadlock when a scsi command timeouts more than once
	USB: UHCI: adjust zhaoxin UHCI controllers OverCurrent bit value
	usb: dwc3: debugfs: Resume dwc3 before accessing registers
	usb: gadget: u_ether: Fix host MAC address case
	usb: typec: altmodes/displayport: fix pin_assignment_show
	ALSA: hda: Fix Oops by 9.1 surround channel names
	ALSA: hda: Add NVIDIA codec IDs a3 through a7 to patch table
	ALSA: hda/realtek: Add quirk for Clevo L140AU
	ALSA: hda/realtek: Add a quirk for HP EliteDesk 805
	ALSA: hda/realtek: Add quirk for 2nd ASUS GU603
	can: j1939: recvmsg(): allow MSG_CMSG_COMPAT flag
	can: isotp: recvmsg(): allow MSG_CMSG_COMPAT flag
	can: kvaser_pciefd: Set CAN_STATE_STOPPED in kvaser_pciefd_stop()
	can: kvaser_pciefd: Call request_irq() before enabling interrupts
	can: kvaser_pciefd: Empty SRB buffer in probe
	can: kvaser_pciefd: Clear listen-only bit if not explicitly requested
	can: kvaser_pciefd: Do not send EFLUSH command on TFD interrupt
	can: kvaser_pciefd: Disable interrupts in probe error path
	statfs: enforce statfs[64] structure initialization
	serial: Add support for Advantech PCI-1611U card
	vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF
	ceph: force updating the msg pointer in non-split case
	tpm/tpm_tis: Disable interrupts for more Lenovo devices
	powerpc/64s/radix: Fix soft dirty tracking
	nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode()
	HID: wacom: Force pen out of prox if no events have been received in a while
	HID: wacom: Add new Intuos Pro Small (PTH-460) device IDs
	HID: wacom: add three styli to wacom_intuos_get_tool_type
	KVM: arm64: Link position-independent string routines into .hyp.text
	serial: 8250_exar: derive nr_ports from PCI ID for Acces I/O cards
	serial: exar: Add support for Sealevel 7xxxC serial cards
	serial: 8250_exar: Add support for USR298x PCI Modems
	s390/qdio: get rid of register asm
	s390/qdio: fix do_sqbs() inline assembly constraint
	watchdog: sp5100_tco: Immediately trigger upon starting.
	ARM: dts: stm32: fix AV96 board SAI2 pin muxing on stm32mp15
	writeback, cgroup: remove extra percpu_ref_exit()
	net/sched: act_mirred: refactor the handle of xmit
	net/sched: act_mirred: better wording on protection against excessive stack growth
	act_mirred: use the backlog for nested calls to mirred ingress
	spi: fsl-spi: Re-organise transfer bits_per_word adaptation
	spi: fsl-cpm: Use 16 bit mode for large transfers with even size
	ocfs2: Switch to security_inode_init_security()
	ALSA: hda/ca0132: add quirk for EVGA X299 DARK
	ALSA: hda: Fix unhandled register update during auto-suspend period
	ALSA: hda/realtek: Enable headset onLenovo M70/M90
	net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize
	m68k: Move signal frame following exception on 68020/030
	parisc: Handle kgdb breakpoints only in kernel context
	parisc: Allow to reboot machine after system halt
	gpio: mockup: Fix mode of debugfs files
	btrfs: use nofs when cleaning up aborted transactions
	dt-binding: cdns,usb3: Fix cdns,on-chip-buff-size type
	x86/mm: Avoid incomplete Global INVLPG flushes
	selftests/memfd: Fix unknown type name build failure
	parisc: Fix flush_dcache_page() for usage from irq context
	x86/topology: Fix erroneous smp_num_siblings on Intel Hybrid platforms
	debugobjects: Don't wake up kswapd from fill_pool()
	fbdev: udlfb: Fix endpoint check
	net: fix stack overflow when LRO is disabled for virtual interfaces
	udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated().
	USB: core: Add routines for endpoint checks in old drivers
	USB: sisusbvga: Add endpoint checks
	media: radio-shark: Add endpoint checks
	net: fix skb leak in __skb_tstamp_tx()
	selftests: fib_tests: mute cleanup error message
	octeontx2-pf: Fix TSOv6 offload
	bpf: Fix mask generation for 32-bit narrow loads of 64-bit fields
	ipv6: Fix out-of-bounds access in ipv6_find_tlv()
	power: supply: leds: Fix blink to LED on transition
	power: supply: bq27xxx: Fix bq27xxx_battery_update() race condition
	power: supply: bq27xxx: Fix I2C IRQ race on remove
	power: supply: bq27xxx: Fix poll_interval handling and races on remove
	power: supply: sbs-charger: Fix INHIBITED bit for Status reg
	fs: fix undefined behavior in bit shift for SB_NOUSER
	coresight: Fix signedness bug in tmc_etr_buf_insert_barrier_packet()
	xen/pvcalls-back: fix double frees with pvcalls_new_active_socket()
	x86/show_trace_log_lvl: Ensure stack pointer is aligned, again
	ASoC: Intel: Skylake: Fix declaration of enum skl_ch_cfg
	forcedeth: Fix an error handling path in nv_probe()
	net/mlx5e: do as little as possible in napi poll when budget is 0
	net/mlx5: DR, Fix crc32 calculation to work on big-endian (BE) CPUs
	net/mlx5: Fix error message when failing to allocate device memory
	net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device
	arm64: dts: imx8mn-var-som: fix PHY detection bug by adding deassert delay
	3c589_cs: Fix an error handling path in tc589_probe()
	net: phy: mscc: add VSC8502 to MODULE_DEVICE_TABLE
	Linux 5.10.181

Change-Id: Iaad0b0bb7c1ad061b28ad4ee16e03db935241177
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2023-06-27 08:23:11 +00:00
Lin Ma
08899e8d5a net: tipc: resize nlattr array to correct size 
[ Upstream commit 44194cb1b6045dea33ae9a0d54fb7e7cd93a2e09 ]

According to nla_parse_nested_deprecated(), the tb[] is supposed to the
destination array with maxtype+1 elements. In current
tipc_nl_media_get() and __tipc_nl_media_set(), a larger array is used
which is unnecessary. This patch resize them to a proper size.

Fixes: 1e55417d8f ("tipc: add media set to new netlink api")
Fixes: 46f15c6794 ("tipc: add media get/dump to new netlink api")
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Reviewed-by: Florian Westphal <fw@strlen.de>
Reviewed-by: Tung Nguyen <tung.q.nguyen@dektech.com.au>
Link: https://lore.kernel.org/r/20230614120604.1196377-1-linma@zju.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2023-06-21 15:45:40 +02:00
Xin Long
2937127d24 tipc: check the bearer min mtu properly when setting it by netlink 
[ Upstream commit 35a089b5d793d2bfd2cc7cfa6104545184de2ce7 ]

Checking the bearer min mtu with tipc_udp_mtu_bad() only works for
IPv4 UDP bearer, and IPv6 UDP bearer has a different value for the
min mtu. This patch checks with encap_hlen + TIPC_MIN_BEARER_MTU
for min mtu, which works for both IPv4 and IPv6 UDP bearer.

Note that tipc_udp_mtu_bad() is still used to check media min mtu
in __tipc_nl_media_set(), as m->mtu currently is only used by the
IPv4 UDP bearer as its default mtu value.

Fixes: 682cd3cf94 ("tipc: confgiure and apply UDP bearer MTU on running links")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Jon Maloy <jmaloy@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2023-05-30 12:57:52 +01:00
Xin Long
2bd4ff4ffb tipc: do not update mtu if msg_max is too small in mtu negotiation 
[ Upstream commit 56077b56cd3fb78e1c8619e29581ba25a5c55e86 ]

When doing link mtu negotiation, a malicious peer may send Activate msg
with a very small mtu, e.g. 4 in Shuang's testing, without checking for
the minimum mtu, l->mtu will be set to 4 in tipc_link_proto_rcv(), then
n->links[bearer_id].mtu is set to 4294967228, which is a overflow of
'4 - INT_H_SIZE - EMSG_OVERHEAD' in tipc_link_mss().

With tipc_link.mtu = 4, tipc_link_xmit() kept printing the warning:

 tipc: Too large msg, purging xmit list 1 5 0 40 4!
 tipc: Too large msg, purging xmit list 1 15 0 60 4!

And with tipc_link_entry.mtu 4294967228, a huge skb was allocated in
named_distribute(), and when purging it in tipc_link_xmit(), a crash
was even caused:

  general protection fault, probably for non-canonical address 0x2100001011000dd: 0000 [#1] PREEMPT SMP PTI
  CPU: 0 PID: 0 Comm: swapper/0 Kdump: loaded Not tainted 6.3.0.neta #19
  RIP: 0010:kfree_skb_list_reason+0x7e/0x1f0
  Call Trace:
   <IRQ>
   skb_release_data+0xf9/0x1d0
   kfree_skb_reason+0x40/0x100
   tipc_link_xmit+0x57a/0x740 [tipc]
   tipc_node_xmit+0x16c/0x5c0 [tipc]
   tipc_named_node_up+0x27f/0x2c0 [tipc]
   tipc_node_write_unlock+0x149/0x170 [tipc]
   tipc_rcv+0x608/0x740 [tipc]
   tipc_udp_recv+0xdc/0x1f0 [tipc]
   udp_queue_rcv_one_skb+0x33e/0x620
   udp_unicast_rcv_skb.isra.72+0x75/0x90
   __udp4_lib_rcv+0x56d/0xc20
   ip_protocol_deliver_rcu+0x100/0x2d0

This patch fixes it by checking the new mtu against tipc_bearer_min_mtu(),
and not updating mtu if it is too small.

Fixes: ed193ece26 ("tipc: simplify link mtu negotiation")
Reported-by: Shuang Li <shuali@redhat.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Jon Maloy <jmaloy@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2023-05-30 12:57:52 +01:00
Xin Long
097ea78d8c tipc: add tipc_bearer_min_mtu to calculate min mtu 
[ Upstream commit 3ae6d66b605be604644d4bb5708a7ffd9cf1abe8 ]

As different media may requires different min mtu, and even the
same media with different net family requires different min mtu,
add tipc_bearer_min_mtu() to calculate min mtu accordingly.

This API will be used to check the new mtu when doing the link
mtu negotiation in the next patch.

Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Jon Maloy <jmaloy@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: 56077b56cd3f ("tipc: do not update mtu if msg_max is too small in mtu negotiation")
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2023-05-30 12:57:52 +01:00
Randy Dunlap
76ea144a35 net/tipc: fix tipc header files for kernel-doc 
[ Upstream commit ff10527e89826aaf76480ee47e6fd05213189963 ]

Fix tipc header files for adding to the networking docbook.

Remove some uses of "/**" that were not kernel-doc notation.

Fix some source formatting to eliminate Sphinx warnings.

Add missing struct member and function argument kernel-doc descriptions.

Correct the description of a couple of struct members that were
marked as "(FIXME)".

Documentation/networking/tipc:18: ../net/tipc/name_table.h:65: WARNING: Unexpected indentation.
Documentation/networking/tipc:18: ../net/tipc/name_table.h:66: WARNING: Block quote ends without a blank line; unexpected unindent.

../net/tipc/bearer.h:128: warning: Function parameter or member 'min_win' not described in 'tipc_media'
../net/tipc/bearer.h:128: warning: Function parameter or member 'max_win' not described in 'tipc_media'

../net/tipc/bearer.h:171: warning: Function parameter or member 'min_win' not described in 'tipc_bearer'
../net/tipc/bearer.h:171: warning: Function parameter or member 'max_win' not described in 'tipc_bearer'
../net/tipc/bearer.h:171: warning: Function parameter or member 'disc' not described in 'tipc_bearer'
../net/tipc/bearer.h:171: warning: Function parameter or member 'up' not described in 'tipc_bearer'
../net/tipc/bearer.h:171: warning: Function parameter or member 'refcnt' not described in 'tipc_bearer'

../net/tipc/name_distr.h:68: warning: Function parameter or member 'port' not described in 'distr_item'

../net/tipc/name_table.h:111: warning: Function parameter or member 'services' not described in 'name_table'
../net/tipc/name_table.h:111: warning: Function parameter or member 'cluster_scope_lock' not described in 'name_table'
../net/tipc/name_table.h:111: warning: Function parameter or member 'rc_dests' not described in 'name_table'
../net/tipc/name_table.h:111: warning: Function parameter or member 'snd_nxt' not described in 'name_table'

../net/tipc/subscr.h:67: warning: Function parameter or member 'kref' not described in 'tipc_subscription'
../net/tipc/subscr.h:67: warning: Function parameter or member 'net' not described in 'tipc_subscription'
../net/tipc/subscr.h:67: warning: Function parameter or member 'service_list' not described in 'tipc_subscription'
../net/tipc/subscr.h:67: warning: Function parameter or member 'conid' not described in 'tipc_subscription'
../net/tipc/subscr.h:67: warning: Function parameter or member 'inactive' not described in 'tipc_subscription'
../net/tipc/subscr.h:67: warning: Function parameter or member 'lock' not described in 'tipc_subscription'

Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 56077b56cd3f ("tipc: do not update mtu if msg_max is too small in mtu negotiation")
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2023-05-30 12:57:52 +01:00
Eric Dumazet
4493914009 net: deal with most data-races in sk_wait_event() 
[ Upstream commit d0ac89f6f9879fae316c155de77b5173b3e2c9c9 ]

__condition is evaluated twice in sk_wait_event() macro.

First invocation is lockless, and reads can race with writes,
as spotted by syzbot.

BUG: KCSAN: data-race in sk_stream_wait_connect / tcp_disconnect

write to 0xffff88812d83d6a0 of 4 bytes by task 9065 on cpu 1:
tcp_disconnect+0x2cd/0xdb0
inet_shutdown+0x19e/0x1f0 net/ipv4/af_inet.c:911
__sys_shutdown_sock net/socket.c:2343 [inline]
__sys_shutdown net/socket.c:2355 [inline]
__do_sys_shutdown net/socket.c:2363 [inline]
__se_sys_shutdown+0xf8/0x140 net/socket.c:2361
__x64_sys_shutdown+0x31/0x40 net/socket.c:2361
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

read to 0xffff88812d83d6a0 of 4 bytes by task 9040 on cpu 0:
sk_stream_wait_connect+0x1de/0x3a0 net/core/stream.c:75
tcp_sendmsg_locked+0x2e4/0x2120 net/ipv4/tcp.c:1266
tcp_sendmsg+0x30/0x50 net/ipv4/tcp.c:1484
inet6_sendmsg+0x63/0x80 net/ipv6/af_inet6.c:651
sock_sendmsg_nosec net/socket.c:724 [inline]
sock_sendmsg net/socket.c:747 [inline]
__sys_sendto+0x246/0x300 net/socket.c:2142
__do_sys_sendto net/socket.c:2154 [inline]
__se_sys_sendto net/socket.c:2150 [inline]
__x64_sys_sendto+0x78/0x90 net/socket.c:2150
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

value changed: 0x00000000 -> 0x00000068

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2023-05-30 12:57:46 +01:00
Greg Kroah-Hartman
b0d4a37a43 This is the 5.10.164 stable release 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmPHzb8ACgkQONu9yGCS
 aT5DUxAAvqTdbbizm4D4EV4ZtdE/N0IJ63VhREMdR1Y21hCuvv5V4Zeh0gpGFKKy
 RljvUXxDXaZjVzJsTPgsmPaEJOrftzZNU1Mq3ucviCXYFl3tWFiJy/FuTaCNCY+r
 YhvjnZWFjwh+mvHyV3wzFdn41XG2GKxq2vgqUFI9BGCM9tw5T4Z6moLPTvcibt2X
 yldJ9U76NgxNDVV0IYilQrMjPe3Pm819Z3ZP9S0O6LJEPjmssB6omlFHyLxUcpC+
 8DiRb49Iild6HJsrbqqv0oHMNSiykx+VDMid/vQtTk4HrAL+eD2Ym17yRnlLzots
 dmuUSdZEpZriH2bCIbNeBDV300x8atLhELtA885wEYj0BKe1QBJMyA0q1PFdKip3
 73wPyi/MCVtCxv752O//PaxynUwZaWlQFH1G8Ry2VpSeiK5A7ZiWWkBDTqLhkRJL
 b0e3crODlZM0ng4nRRMrXZZAw+FKzghVSO8ae/4+q5Y9vyj6iadd7UcwXG4cmZXN
 ZYXT3+3O7P08dyHW4EL8tD7AmxprP7ccePyKsMu6T7wQPuEgFltaJUDHsGnJ68Jx
 I+5QzrVED3OTjt9jpYVbYjJ1HjL0jQHxfuBNKCgC34wMzwdlZhHUQVbi0DECk2Qf
 40MCrjEsAXJWlX/Rr2bsVeYFSyi4aCI1kckXKxRQznOnFZirA5M=
 =WjXh
 -----END PGP SIGNATURE-----

Merge 5.10.164 into android12-5.10-lts

Changes in 5.10.164
	netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits
	ALSA: hda/realtek: Enable mute/micmute LEDs on HP Spectre x360 13-aw0xxx
	KVM: arm64: Fix S1PTW handling on RO memslots
	efi: tpm: Avoid READ_ONCE() for accessing the event log
	docs: Fix the docs build with Sphinx 6.0
	perf auxtrace: Fix address filter duplicate symbol selection
	s390/kexec: fix ipl report address for kdump
	ASoC: qcom: lpass-cpu: Fix fallback SD line index handling
	s390/cpum_sf: add READ_ONCE() semantics to compare and swap loops
	s390/percpu: add READ_ONCE() to arch_this_cpu_to_op_simple()
	cifs: Fix uninitialized memory read for smb311 posix symlink create
	drm/msm/adreno: Make adreno quirks not overwrite each other
	drm/msm/dp: do not complete dp_aux_cmd_fifo_tx() if irq is not for aux transfer
	platform/x86: sony-laptop: Don't turn off 0x153 keyboard backlight during probe
	ixgbe: fix pci device refcount leak
	ipv6: raw: Deduct extension header length in rawv6_push_pending_frames
	bus: mhi: host: Fix race between channel preparation and M0 event
	iommu/amd: Add PCI segment support for ivrs_[ioapic/hpet/acpihid] commands
	iommu/amd: Fix ill-formed ivrs_ioapic, ivrs_hpet and ivrs_acpihid options
	clk: imx8mp: Add DISP2 pixel clock
	clk: imx8mp: add clkout1/2 support
	dt-bindings: clocks: imx8mp: Add ID for usb suspend clock
	clk: imx: imx8mp: add shared clk gate for usb suspend clk
	xhci: Avoid parsing transfer events several times
	xhci: get isochronous ring directly from endpoint structure
	xhci: adjust parameters passed to cleanup_halted_endpoint()
	xhci: Add xhci_reset_halted_ep() helper function
	xhci: move xhci_td_cleanup so it can be called by more functions
	xhci: store TD status in the td struct instead of passing it along
	xhci: move and rename xhci_cleanup_halted_endpoint()
	xhci: Prevent infinite loop in transaction errors recovery for streams
	usb: ulpi: defer ulpi_register on ulpi_read_id timeout
	ext4: fix uninititialized value in 'ext4_evict_inode'
	xfrm: fix rcu lock in xfrm_notify_userpolicy()
	netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
	powerpc/imc-pmu: Fix use of mutex in IRQs disabled section
	x86/boot: Avoid using Intel mnemonics in AT&T syntax asm
	EDAC/device: Fix period calculation in edac_device_reset_delay_period()
	regulator: da9211: Use irq handler when ready
	ASoC: wm8904: fix wrong outputs volume after power reactivation
	tipc: fix unexpected link reset due to discovery messages
	octeontx2-af: Update get/set resource count functions
	octeontx2-af: Map NIX block from CGX connection
	octeontx2-af: Fix LMAC config in cgx_lmac_rx_tx_enable
	hvc/xen: lock console list traversal
	nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame()
	net/sched: act_mpls: Fix warning during failed attribute validation
	net/mlx5: Fix ptp max frequency adjustment range
	net/mlx5e: Don't support encap rules with gbp option
	mm: Always release pages to the buddy allocator in memblock_free_late().
	iommu/mediatek-v1: Add error handle for mtk_iommu_probe
	iommu/mediatek-v1: Fix an error handling path in mtk_iommu_v1_probe()
	Documentation: KVM: add API issues section
	KVM: x86: Do not return host topology information from KVM_GET_SUPPORTED_CPUID
	x86/resctrl: Use task_curr() instead of task_struct->on_cpu to prevent unnecessary IPI
	x86/resctrl: Fix task CLOSID/RMID update race
	arm64: atomics: format whitespace consistently
	arm64: atomics: remove LL/SC trampolines
	arm64: cmpxchg_double*: hazard against entire exchange variable
	efi: fix NULL-deref in init error path
	drm/virtio: Fix GEM handle creation UAF
	io_uring/io-wq: free worker if task_work creation is canceled
	io_uring/io-wq: only free worker if it was allocated for creation
	Revert "usb: ulpi: defer ulpi_register on ulpi_read_id timeout"
	Linux 5.10.164

Change-Id: I049d9a56837b18c20b2245687f03eb75d3413e0f
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2023-02-16 13:59:20 +00:00
Tung Nguyen
0d0675bc33 tipc: fix unexpected link reset due to discovery messages 
[ Upstream commit c244c092f1ed2acfb5af3d3da81e22367d3dd733 ]

This unexpected behavior is observed:

node 1                    | node 2
------                    | ------
link is established       | link is established
reboot                    | link is reset
up                        | send discovery message
receive discovery message |
link is established       | link is established
send discovery message    |
                          | receive discovery message
                          | link is reset (unexpected)
                          | send reset message
link is reset             |

It is due to delayed re-discovery as described in function
tipc_node_check_dest(): "this link endpoint has already reset
and re-established contact with the peer, before receiving a
discovery message from that node."

However, commit 598411d70f has changed the condition for calling
tipc_node_link_down() which was the acceptance of new media address.

This commit fixes this by restoring the old and correct behavior.

Fixes: 598411d70f ("tipc: make resetting of links non-atomic")
Acked-by: Jon Maloy <jmaloy@redhat.com>
Signed-off-by: Tung Nguyen <tung.q.nguyen@dektech.com.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2023-01-18 11:44:58 +01:00
Greg Kroah-Hartman
01ef2d0b53 This is the 5.10.159 stable release 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmOZpiwACgkQONu9yGCS
 aT6whRAArWRCd5yEvuYtdCIPQh70Yz3vhHKkeqKU3AzAOYxYB+UbmRf8i6Cgv5S7
 b0Mmla4vV1w+tRZcwdPHXoNrwxQ+r6b89mywResfp+FLAti/Ak1wMNR1l0FGQTeM
 z2dIeuhNtVIatvpBw7E1KKGXpSRYfJuzbkT3npKRmWqv1hmcwcqkQ9uZSkFCf3dO
 YETpGjOk6Z8/Ml4z6gEWy54+W3nLf3X8G0i1CfDwxkxcCf4fqIgNCaGaT26Q+Yv1
 GDKtAzmF/FfxwwIdwxx+Y/Iq3+ccEf2WTRQEDWb8K62TBbNjR+q1+Y3IJCfrBj+H
 6sVfnyQm9fTQd7gKLy3gipJxphS4sAZ+OcwY+gMfRQBBHSmccHOC9MhQFgd+wN39
 vBnCG0g6x+9J/DESPOXwrTDnWuGW1Grv7avYlJo2L4WTUFsAuDrtGdCRJ+Bwd9PH
 VVD6eSmXQdrFe9ttf8CQUERlWmNkAmFvT135Hf+qclNsvp7PbtCX2rjgo27NxVbo
 mdOkLLNXBwMNcHjhWhN7MDzoEw7gUqvWWC6vdRgQicrLJphrcV82+C0QIW3A/Uft
 tp/HEsHhGCX6mTXN0x9faz9WMXrfI+j6rUs0UoSVBfP+rwtCqweX5qgz5eUj2jjJ
 v+edcnh/2t4dVwK2dbsniw8y19tI/VHfyfMJiGSY18LsLlMrHiw=
 =QY26
 -----END PGP SIGNATURE-----

Merge 5.10.159 into android12-5.10-lts

Changes in 5.10.159
	arm64: dts: rockchip: keep I2S1 disabled for GPIO function on ROCK Pi 4 series
	arm: dts: rockchip: fix node name for hym8563 rtc
	ARM: dts: rockchip: fix ir-receiver node names
	arm64: dts: rockchip: fix ir-receiver node names
	ARM: dts: rockchip: rk3188: fix lcdc1-rgb24 node name
	ARM: 9251/1: perf: Fix stacktraces for tracepoint events in THUMB2 kernels
	ARM: 9266/1: mm: fix no-MMU ZERO_PAGE() implementation
	ASoC: wm8962: Wait for updated value of WM8962_CLOCKING1 register
	ARM: dts: rockchip: disable arm_global_timer on rk3066 and rk3188
	9p/fd: Use P9_HDRSZ for header size
	regulator: slg51000: Wait after asserting CS pin
	ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event
	btrfs: send: avoid unaligned encoded writes when attempting to clone range
	ASoC: soc-pcm: Add NULL check in BE reparenting
	regulator: twl6030: fix get status of twl6032 regulators
	fbcon: Use kzalloc() in fbcon_prepare_logo()
	usb: dwc3: gadget: Disable GUSB2PHYCFG.SUSPHY for End Transfer
	9p/xen: check logical size for buffer size
	net: usb: qmi_wwan: add u-blox 0x1342 composition
	mm/khugepaged: take the right locks for page table retraction
	mm/khugepaged: fix GUP-fast interaction by sending IPI
	mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths
	rtc: mc146818: Prevent reading garbage
	rtc: mc146818: Detect and handle broken RTCs
	rtc: mc146818: Dont test for bit 0-5 in Register D
	rtc: cmos: remove stale REVISIT comments
	rtc: mc146818-lib: change return values of mc146818_get_time()
	rtc: Check return value from mc146818_get_time()
	rtc: mc146818-lib: fix RTC presence check
	rtc: mc146818-lib: extract mc146818_avoid_UIP
	rtc: cmos: avoid UIP when writing alarm time
	rtc: cmos: avoid UIP when reading alarm time
	rtc: cmos: Replace spin_lock_irqsave with spin_lock in hard IRQ
	rtc: mc146818: Reduce spinlock section in mc146818_set_time()
	xen/netback: Ensure protocol headers don't fall in the non-linear area
	xen/netback: do some code cleanup
	xen/netback: don't call kfree_skb() with interrupts disabled
	media: videobuf2-core: take mmap_lock in vb2_get_unmapped_area()
	Revert "ARM: dts: imx7: Fix NAND controller size-cells"
	media: v4l2-dv-timings.c: fix too strict blanking sanity checks
	memcg: fix possible use-after-free in memcg_write_event_control()
	mm/gup: fix gup_pud_range() for dax
	Bluetooth: btusb: Add debug message for CSR controllers
	Bluetooth: Fix crash when replugging CSR fake controllers
	KVM: s390: vsie: Fix the initialization of the epoch extension (epdx) field
	drm/vmwgfx: Don't use screen objects when SEV is active
	drm/shmem-helper: Remove errant put in error path
	drm/shmem-helper: Avoid vm_open error paths
	HID: usbhid: Add ALWAYS_POLL quirk for some mice
	HID: hid-lg4ff: Add check for empty lbuf
	HID: core: fix shift-out-of-bounds in hid_report_raw_event
	can: af_can: fix NULL pointer dereference in can_rcv_filter
	mm/hugetlb: fix races when looking up a CONT-PTE/PMD size hugetlb page
	rtc: cmos: Disable irq around direct invocation of cmos_interrupt()
	rtc: mc146818-lib: fix locking in mc146818_set_time
	rtc: mc146818-lib: fix signedness bug in mc146818_get_time()
	netfilter: nft_set_pipapo: Actually validate intervals in fields after the first one
	ieee802154: cc2520: Fix error return code in cc2520_hw_init()
	ca8210: Fix crash by zero initializing data
	netfilter: ctnetlink: fix compilation warning after data race fixes in ct mark
	drm/bridge: ti-sn65dsi86: Fix output polarity setting bug
	gpio: amd8111: Fix PCI device reference count leak
	e1000e: Fix TX dispatch condition
	igb: Allocate MSI-X vector when testing
	drm: bridge: dw_hdmi: fix preference of RGB modes over YUV420
	af_unix: Get user_ns from in_skb in unix_diag_get_exact().
	vmxnet3: correctly report encapsulated LRO packet
	Bluetooth: 6LoWPAN: add missing hci_dev_put() in get_l2cap_conn()
	Bluetooth: Fix not cleanup led when bt_init fails
	net: dsa: ksz: Check return value
	selftests: rtnetlink: correct xfrm policy rule in kci_test_ipsec_offload
	mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()
	net: encx24j600: Add parentheses to fix precedence
	net: encx24j600: Fix invalid logic in reading of MISTAT register
	xen-netfront: Fix NULL sring after live migration
	net: mvneta: Prevent out of bounds read in mvneta_config_rss()
	i40e: Fix not setting default xps_cpus after reset
	i40e: Fix for VF MAC address 0
	i40e: Disallow ip4 and ip6 l4_4_bytes
	NFC: nci: Bounds check struct nfc_target arrays
	nvme initialize core quirks before calling nvme_init_subsystem
	net: stmmac: fix "snps,axi-config" node property parsing
	ip_gre: do not report erspan version on GRE interface
	net: thunderx: Fix missing destroy_workqueue of nicvf_rx_mode_wq
	net: hisilicon: Fix potential use-after-free in hisi_femac_rx()
	net: hisilicon: Fix potential use-after-free in hix5hd2_rx()
	tipc: Fix potential OOB in tipc_link_proto_rcv()
	ipv4: Fix incorrect route flushing when source address is deleted
	ipv4: Fix incorrect route flushing when table ID 0 is used
	net: dsa: sja1105: fix memory leak in sja1105_setup_devlink_regions()
	tipc: call tipc_lxc_xmit without holding node_read_lock
	ethernet: aeroflex: fix potential skb leak in greth_init_rings()
	xen/netback: fix build warning
	net: plip: don't call kfree_skb/dev_kfree_skb() under spin_lock_irq()
	ipv6: avoid use-after-free in ip6_fragment()
	net: mvneta: Fix an out of bounds check
	macsec: add missing attribute validation for offload
	can: esd_usb: Allow REC and TEC to return to zero
	Linux 5.10.159

Change-Id: I3ec26473c358ffda0ea8a8dd91ee265f58739029
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2022-12-14 13:11:31 +01:00
Xin Long
cc668fddde tipc: call tipc_lxc_xmit without holding node_read_lock 
[ Upstream commit 88956177db179e4eba7cd590971961857d1565b8 ]

When sending packets between nodes in netns, it calls tipc_lxc_xmit() for
peer node to receive the packets where tipc_sk_mcast_rcv()/tipc_sk_rcv()
might be called, and it's pretty much like in tipc_rcv().

Currently the local 'node rw lock' is held during calling tipc_lxc_xmit()
to protect the peer_net not being freed by another thread. However, when
receiving these packets, tipc_node_add_conn() might be called where the
peer 'node rw lock' is acquired. Then a dead lock warning is triggered by
lockdep detector, although it is not a real dead lock:

    WARNING: possible recursive locking detected
    --------------------------------------------
    conn_server/1086 is trying to acquire lock:
    ffff8880065cb020 (&n->lock#2){++--}-{2:2}, \
                     at: tipc_node_add_conn.cold.76+0xaa/0x211 [tipc]

    but task is already holding lock:
    ffff8880065cd020 (&n->lock#2){++--}-{2:2}, \
                     at: tipc_node_xmit+0x285/0xb30 [tipc]

    other info that might help us debug this:
     Possible unsafe locking scenario:

           CPU0
           ----
      lock(&n->lock#2);
      lock(&n->lock#2);

     *** DEADLOCK ***

     May be due to missing lock nesting notation

    4 locks held by conn_server/1086:
     #0: ffff8880036d1e40 (sk_lock-AF_TIPC){+.+.}-{0:0}, \
                          at: tipc_accept+0x9c0/0x10b0 [tipc]
     #1: ffff8880036d5f80 (sk_lock-AF_TIPC/1){+.+.}-{0:0}, \
                          at: tipc_accept+0x363/0x10b0 [tipc]
     #2: ffff8880065cd020 (&n->lock#2){++--}-{2:2}, \
                          at: tipc_node_xmit+0x285/0xb30 [tipc]
     #3: ffff888012e13370 (slock-AF_TIPC){+...}-{2:2}, \
                          at: tipc_sk_rcv+0x2da/0x1b40 [tipc]

    Call Trace:
     <TASK>
     dump_stack_lvl+0x44/0x5b
     __lock_acquire.cold.77+0x1f2/0x3d7
     lock_acquire+0x1d2/0x610
     _raw_write_lock_bh+0x38/0x80
     tipc_node_add_conn.cold.76+0xaa/0x211 [tipc]
     tipc_sk_finish_conn+0x21e/0x640 [tipc]
     tipc_sk_filter_rcv+0x147b/0x3030 [tipc]
     tipc_sk_rcv+0xbb4/0x1b40 [tipc]
     tipc_lxc_xmit+0x225/0x26b [tipc]
     tipc_node_xmit.cold.82+0x4a/0x102 [tipc]
     __tipc_sendstream+0x879/0xff0 [tipc]
     tipc_accept+0x966/0x10b0 [tipc]
     do_accept+0x37d/0x590

This patch avoids this warning by not holding the 'node rw lock' before
calling tipc_lxc_xmit(). As to protect the 'peer_net', rcu_read_lock()
should be enough, as in cleanup_net() when freeing the netns, it calls
synchronize_rcu() before the free is continued.

Also since tipc_lxc_xmit() is like the RX path in tipc_rcv(), it makes
sense to call it under rcu_read_lock(). Note that the right lock order
must be:

   rcu_read_lock();
   tipc_node_read_lock(n);
   tipc_node_read_unlock(n);
   tipc_lxc_xmit();
   rcu_read_unlock();

instead of:

   tipc_node_read_lock(n);
   rcu_read_lock();
   tipc_node_read_unlock(n);
   tipc_lxc_xmit();
   rcu_read_unlock();

and we have to call tipc_node_read_lock/unlock() twice in
tipc_node_xmit().

Fixes: f73b12812a ("tipc: improve throughput between nodes in netns")
Reported-by: Shuang Li <shuali@redhat.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Link: https://lore.kernel.org/r/5bdd1f8fee9db695cfff4528a48c9b9d0523fb00.1670110641.git.lucien.xin@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2022-12-14 11:32:04 +01:00
YueHaibing
36e248269a tipc: Fix potential OOB in tipc_link_proto_rcv() 
[ Upstream commit 743117a997bbd4840e827295c07e59bcd7f7caa3 ]

Fix the potential risk of OOB if skb_linearize() fails in
tipc_link_proto_rcv().

Fixes: 5cbb28a4bf ("tipc: linearize arriving NAME_DISTR and LINK_PROTO buffers")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Link: https://lore.kernel.org/r/20221203094635.29024-1-yuehaibing@huawei.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2022-12-14 11:32:03 +01:00
Greg Kroah-Hartman
5ab4c6b843 This is the 5.10.158 stable release 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmORvAIACgkQONu9yGCS
 aT6OMhAAkxn/BD0mYER+XMJK+z5KIgusOh2TbHJGIkHUmj1u6Fse8VfR1xAjTk5q
 y3J0uX5Bung1FIsA8iVF7no1D4ungqsyXUt6cclO8X3dVQAV8ikNDRTu2FFLiywY
 4QxJ/h1Nhl+6lb1lqHT+iSEuMAjlUr6DtAq4hb9Xxgbn9hOghTMzg4dZYjXI3cr4
 Bxk/tunrp8Rc5ad/I9Gwba0ar23cFDLYNxT6VKn+FBJ2jcj/74ULjwPvT3SyAm2U
 hONKAQQZNtGPmGsUXkjdjhz7VaceNlLp0bA92AqCvNEmbnJzjb21qAklfdNAvEGH
 yP4GOdxDvmwzPxkxpZfa0I3OYpfxAwT2bG6mVSl7+Ok8LNIiKvvD+TlL0p+nqoe1
 LogxV309xqpN+D3EgUnX03lLkJDfWfrZyhEIPgEuRdW7OjixqYOs0hWLmkF0QCi6
 vLYRSPnsoxragShq8HrdC/QlLmLCckMy8i7bcCiwpSwcsL/1vVUnb05O6iaFoIc4
 56nTifRT5p3nJlnjQhCyPVbxmF8CRlhsRwbOsA+0pklkTQx5qHaYMFLuXsd7nSFG
 +le0Kuc+xTMdP/ABgs2s3UdZFh3Zevovt4gaOnYjC6EDbmoeG6DNTTzIbNEwa1vw
 D6+Zrw3HePytwJcUNRHthXuTUN2V68YvsXu7zVhKU8mlyj+UXpE=
 =Zr7b
 -----END PGP SIGNATURE-----

Merge 5.10.158 into android12-5.10-lts

Changes in 5.10.158
	btrfs: sink iterator parameter to btrfs_ioctl_logical_to_ino
	btrfs: free btrfs_path before copying inodes to userspace
	spi: spi-imx: Fix spi_bus_clk if requested clock is higher than input clock
	btrfs: move QUOTA_ENABLED check to rescan_should_stop from btrfs_qgroup_rescan_worker
	drm/display/dp_mst: Fix drm_dp_mst_add_affected_dsc_crtcs() return code
	drm/amdgpu: update drm_display_info correctly when the edid is read
	drm/amdgpu: Partially revert "drm/amdgpu: update drm_display_info correctly when the edid is read"
	btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit()
	iio: health: afe4403: Fix oob read in afe4403_read_raw
	iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw
	iio: light: rpr0521: add missing Kconfig dependencies
	bpf, perf: Use subprog name when reporting subprog ksymbol
	scripts/faddr2line: Fix regression in name resolution on ppc64le
	ARM: at91: rm9200: fix usb device clock id
	libbpf: Handle size overflow for ringbuf mmap
	hwmon: (ltc2947) fix temperature scaling
	hwmon: (ina3221) Fix shunt sum critical calculation
	hwmon: (i5500_temp) fix missing pci_disable_device()
	hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails
	bpf: Do not copy spin lock field from user in bpf_selem_alloc
	of: property: decrement node refcount in of_fwnode_get_reference_args()
	ixgbevf: Fix resource leak in ixgbevf_init_module()
	i40e: Fix error handling in i40e_init_module()
	fm10k: Fix error handling in fm10k_init_module()
	iavf: remove redundant ret variable
	iavf: Fix error handling in iavf_init_module()
	e100: switch from 'pci_' to 'dma_' API
	e100: Fix possible use after free in e100_xmit_prepare
	net/mlx5: Fix uninitialized variable bug in outlen_write()
	net/mlx5e: Fix use-after-free when reverting termination table
	can: sja1000_isa: sja1000_isa_probe(): add missing free_sja1000dev()
	can: cc770: cc770_isa_probe(): add missing free_cc770dev()
	qlcnic: fix sleep-in-atomic-context bugs caused by msleep
	aquantia: Do not purge addresses when setting the number of rings
	wifi: cfg80211: fix buffer overflow in elem comparison
	wifi: cfg80211: don't allow multi-BSSID in S1G
	wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration
	net: phy: fix null-ptr-deref while probe() failed
	net: net_netdev: Fix error handling in ntb_netdev_init_module()
	net/9p: Fix a potential socket leak in p9_socket_open
	net: ethernet: nixge: fix NULL dereference
	dsa: lan9303: Correct stat name
	tipc: re-fetch skb cb after tipc_msg_validate
	net: hsr: Fix potential use-after-free
	afs: Fix fileserver probe RTT handling
	net: tun: Fix use-after-free in tun_detach()
	packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE
	sctp: fix memory leak in sctp_stream_outq_migrate()
	net: ethernet: renesas: ravb: Fix promiscuous mode after system resumed
	hwmon: (coretemp) Check for null before removing sysfs attrs
	hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()
	net/mlx5: DR, Fix uninitialized var warning
	riscv: vdso: fix section overlapping under some conditions
	error-injection: Add prompt for function error injection
	tools/vm/slabinfo-gnuplot: use "grep -E" instead of "egrep"
	nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()
	x86/bugs: Make sure MSR_SPEC_CTRL is updated properly upon resume from S3
	pinctrl: intel: Save and restore pins in "direct IRQ" mode
	net: stmmac: Set MAC's flow control register to reflect current settings
	mmc: mmc_test: Fix removal of debugfs file
	mmc: core: Fix ambiguous TRIM and DISCARD arg
	mmc: sdhci-esdhc-imx: correct CQHCI exit halt state check
	mmc: sdhci-sprd: Fix no reset data and command after voltage switch
	mmc: sdhci: Fix voltage switch delay
	drm/amdgpu: temporarily disable broken Clang builds due to blown stack-frame
	drm/i915: Never return 0 if not all requests retired
	tracing: Free buffers when a used dynamic event is removed
	io_uring: don't hold uring_lock when calling io_run_task_work*
	ASoC: ops: Fix bounds check for _sx controls
	pinctrl: single: Fix potential division by zero
	iommu/vt-d: Fix PCI device refcount leak in has_external_pci()
	iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init()
	parisc: Increase size of gcc stack frame check
	xtensa: increase size of gcc stack frame check
	parisc: Increase FRAME_WARN to 2048 bytes on parisc
	Kconfig.debug: provide a little extra FRAME_WARN leeway when KASAN is enabled
	selftests: net: add delete nexthop route warning test
	selftests: net: fix nexthop warning cleanup double ip typo
	ipv4: Handle attempt to delete multipath route when fib_info contains an nh reference
	ipv4: Fix route deletion when nexthop info is not specified
	Revert "tty: n_gsm: avoid call of sleeping functions from atomic context"
	x86/tsx: Add a feature bit for TSX control MSR support
	x86/pm: Add enumeration check before spec MSRs save/restore setup
	i2c: npcm7xx: Fix error handling in npcm_i2c_init()
	i2c: imx: Only DMA messages with I2C_M_DMA_SAFE flag set
	ACPI: HMAT: remove unnecessary variable initialization
	ACPI: HMAT: Fix initiator registration for single-initiator systems
	Revert "clocksource/drivers/riscv: Events are stopped during CPU suspend"
	char: tpm: Protect tpm_pm_suspend with locks
	Input: raydium_ts_i2c - fix memory leak in raydium_i2c_send()
	block: unhash blkdev part inode when the part is deleted
	proc: avoid integer type confusion in get_proc_long
	proc: proc_skip_spaces() shouldn't think it is working on C strings
	v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() fails
	ipc/sem: Fix dangling sem_array access in semtimedop race
	Linux 5.10.158

Change-Id: I8db196fa535e260ed31965b52ed53ef0b6bd526b
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2022-12-08 16:39:44 +00:00
Xin Long
a1ba595e35 tipc: re-fetch skb cb after tipc_msg_validate 
[ Upstream commit 3067bc61fcfe3081bf4807ce65560f499e895e77 ]

As the call trace shows, the original skb was freed in tipc_msg_validate(),
and dereferencing the old skb cb would cause an use-after-free crash.

  BUG: KASAN: use-after-free in tipc_crypto_rcv_complete+0x1835/0x2240 [tipc]
  Call Trace:
   <IRQ>
   tipc_crypto_rcv_complete+0x1835/0x2240 [tipc]
   tipc_crypto_rcv+0xd32/0x1ec0 [tipc]
   tipc_rcv+0x744/0x1150 [tipc]
  ...
  Allocated by task 47078:
   kmem_cache_alloc_node+0x158/0x4d0
   __alloc_skb+0x1c1/0x270
   tipc_buf_acquire+0x1e/0xe0 [tipc]
   tipc_msg_create+0x33/0x1c0 [tipc]
   tipc_link_build_proto_msg+0x38a/0x2100 [tipc]
   tipc_link_timeout+0x8b8/0xef0 [tipc]
   tipc_node_timeout+0x2a1/0x960 [tipc]
   call_timer_fn+0x2d/0x1c0
  ...
  Freed by task 47078:
   tipc_msg_validate+0x7b/0x440 [tipc]
   tipc_crypto_rcv_complete+0x4b5/0x2240 [tipc]
   tipc_crypto_rcv+0xd32/0x1ec0 [tipc]
   tipc_rcv+0x744/0x1150 [tipc]

This patch fixes it by re-fetching the skb cb from the new allocated skb
after calling tipc_msg_validate().

Fixes: fc1b6d6de2 ("tipc: introduce TIPC encryption & authentication")
Reported-by: Shuang Li <shuali@redhat.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Link: https://lore.kernel.org/r/1b1cdba762915325bd8ef9a98d0276eb673df2a5.1669398403.git.lucien.xin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2022-12-08 11:23:56 +01:00
Greg Kroah-Hartman
982d7f3eb8 This is the 5.10.157 stable release 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmOKKmsACgkQONu9yGCS
 aT73ixAAwyEk1kuY9T0i4JfjPViD9Kg+v64lGLnM88CuGjkxcT4kv2Lg/hURDD+K
 pObBEaOWduKVxqH/4GqpeEpqrw3bxxQJUchw1F5C2ZsLjB5mA4u9U0dqExTPIeY2
 GSLdkBY/3yWBgDlpWsEHRjhzqx16ZuvHyvMGegHLG5+hNbfmfiFBhVpn8knTFaqv
 fXRyC9MAt072thjjuPG6QcWpWAFFTG0PWsEkNWGLw0U07FF+V7O9sWLontHi93sn
 seIEUPbjgGEFND2NqLfiLOLZ9m2fBB3P32L66b9rrZNZ2DPmyrNCD0WSLhlzb1OV
 8yXiVEkDUozkI6W8fzVtUUjH3gYvB9e37zCYPO6WnAl5cwGhCJz1cpQfN7g7hk9H
 iKpetcKf7XFBRmUq2Ftnaq7KPc81dVrQ5mYfrtsT9IYDnWMdF7AcOctN+dKkCS15
 QoiJklSeE28b4PZtdt7Uv7OF2qW6w+tMKSD3PJyiBHB46rcQjuuOy7ifa8VqaXHI
 ZO+mWUjMMUdo3q0lXoy2i5PMNrul41QMsdnrGaZxXU+LfaCVIubpHghSBHFhnFTY
 3r2Fko3ZOsuAOQXX5iCTCstCEev5LH0v74bou355Y0uteueCqpnc/GSEZ8KhP+M0
 kqpcyf3e6KAL7TA7eqQdptpFyDW732IgcbU4bQKUMd038Hb5I4o=
 =1JWA
 -----END PGP SIGNATURE-----

Merge 5.10.157 into android12-5.10-lts

Changes in 5.10.157
	scsi: scsi_transport_sas: Fix error handling in sas_phy_add()
	ata: libata-scsi: simplify __ata_scsi_queuecmd()
	ata: libata-core: do not issue non-internal commands once EH is pending
	bridge: switchdev: Notify about VLAN protocol changes
	bridge: switchdev: Fix memory leaks when changing VLAN protocol
	drm/display: Don't assume dual mode adaptors support i2c sub-addressing
	nvme: add a bogus subsystem NQN quirk for Micron MTFDKBA2T0TFH
	nvme-pci: add NVME_QUIRK_BOGUS_NID for Micron Nitro
	iio: ms5611: Simplify IO callback parameters
	iio: pressure: ms5611: fixed value compensation bug
	ceph: do not update snapshot context when there is no new snapshot
	ceph: avoid putting the realm twice when decoding snaps fails
	wifi: mac80211: fix memory free error when registering wiphy fail
	wifi: mac80211_hwsim: fix debugfs attribute ps with rc table support
	riscv: dts: sifive unleashed: Add PWM controlled LEDs
	audit: fix undefined behavior in bit shift for AUDIT_BIT
	wifi: airo: do not assign -1 to unsigned char
	wifi: mac80211: Fix ack frame idr leak when mesh has no route
	spi: stm32: fix stm32_spi_prepare_mbr() that halves spi clk for every run
	selftests/bpf: Add verifier test for release_reference()
	Revert "net: macsec: report real_dev features when HW offloading is enabled"
	platform/x86: touchscreen_dmi: Add info for the RCA Cambio W101 v2 2-in-1
	scsi: ibmvfc: Avoid path failures during live migration
	scsi: scsi_debug: Make the READ CAPACITY response compliant with ZBC
	drm: panel-orientation-quirks: Add quirk for Acer Switch V 10 (SW5-017)
	block, bfq: fix null pointer dereference in bfq_bio_bfqg()
	arm64/syscall: Include asm/ptrace.h in syscall_wrapper header.
	RISC-V: vdso: Do not add missing symbols to version section in linker script
	MIPS: pic32: treat port as signed integer
	xfrm: fix "disable_policy" on ipv4 early demux
	xfrm: replay: Fix ESN wrap around for GSO
	af_key: Fix send_acquire race with pfkey_register
	ARM: dts: am335x-pcm-953: Define fixed regulators in root node
	ASoC: hdac_hda: fix hda pcm buffer overflow issue
	ASoC: sgtl5000: Reset the CHIP_CLK_CTRL reg on remove
	ASoC: soc-pcm: Don't zero TDM masks in __soc_pcm_open()
	scsi: storvsc: Fix handling of srb_status and capacity change events
	regulator: core: fix kobject release warning and memory leak in regulator_register()
	spi: dw-dma: decrease reference count in dw_spi_dma_init_mfld()
	regulator: core: fix UAF in destroy_regulator()
	bus: sunxi-rsb: Support atomic transfers
	tee: optee: fix possible memory leak in optee_register_device()
	ARM: dts: at91: sam9g20ek: enable udc vbus gpio pinctrl
	net: liquidio: simplify if expression
	rxrpc: Allow list of in-use local UDP endpoints to be viewed in /proc
	rxrpc: Use refcount_t rather than atomic_t
	rxrpc: Fix race between conn bundle lookup and bundle removal [ZDI-CAN-15975]
	nfc/nci: fix race with opening and closing
	net: pch_gbe: fix potential memleak in pch_gbe_tx_queue()
	9p/fd: fix issue of list_del corruption in p9_fd_cancel()
	netfilter: conntrack: Fix data-races around ct mark
	ARM: mxs: fix memory leak in mxs_machine_init()
	ARM: dts: imx6q-prti6q: Fix ref/tcxo-clock-frequency properties
	net: ethernet: mtk_eth_soc: fix error handling in mtk_open()
	net/mlx4: Check retval of mlx4_bitmap_init
	net/qla3xxx: fix potential memleak in ql3xxx_send()
	net: pch_gbe: fix pci device refcount leak while module exiting
	nfp: fill splittable of devlink_port_attrs correctly
	nfp: add port from netdev validation for EEPROM access
	macsec: Fix invalid error code set
	Drivers: hv: vmbus: fix double free in the error path of vmbus_add_channel_work()
	Drivers: hv: vmbus: fix possible memory leak in vmbus_device_register()
	netfilter: ipset: Limit the maximal range of consecutive elements to add/delete
	netfilter: ipset: regression in ip_set_hash_ip.c
	net/mlx5: Fix FW tracer timestamp calculation
	net/mlx5: Fix handling of entry refcount when command is not issued to FW
	tipc: set con sock in tipc_conn_alloc
	tipc: add an extra conn_get in tipc_conn_alloc
	tipc: check skb_linearize() return value in tipc_disc_rcv()
	xfrm: Fix ignored return value in xfrm6_init()
	sfc: fix potential memleak in __ef100_hard_start_xmit()
	net: sched: allow act_ct to be built without NF_NAT
	NFC: nci: fix memory leak in nci_rx_data_packet()
	regulator: twl6030: re-add TWL6032_SUBCLASS
	bnx2x: fix pci device refcount leak in bnx2x_vf_is_pcie_pending()
	dma-buf: fix racing conflict of dma_heap_add()
	netfilter: flowtable_offload: add missing locking
	dccp/tcp: Reset saddr on failure after inet6?_hash_connect().
	ipv4: Fix error return code in fib_table_insert()
	s390/dasd: fix no record found for raw_track_access
	net: arcnet: Fix RESET flag handling
	arcnet: fix potential memory leak in com20020_probe()
	nfc: st-nci: fix incorrect validating logic in EVT_TRANSACTION
	nfc: st-nci: fix memory leaks in EVT_TRANSACTION
	net: thunderx: Fix the ACPI memory leak
	s390/crashdump: fix TOD programmable field size
	net: enetc: manage ENETC_F_QBV in priv->active_offloads only when enabled
	net: enetc: cache accesses to &priv->si->hw
	net: enetc: preserve TX ring priority across reconfiguration
	lib/vdso: use "grep -E" instead of "egrep"
	usb: dwc3: exynos: Fix remove() function
	ext4: fix use-after-free in ext4_ext_shift_extents
	arm64: dts: rockchip: lower rk3399-puma-haikou SD controller clock frequency
	iio: light: apds9960: fix wrong register for gesture gain
	iio: core: Fix entry not deleted when iio_register_sw_trigger_type() fails
	init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash
	nios2: add FORCE for vmlinuz.gz
	mmc: sdhci-brcmstb: Re-organize flags
	mmc: sdhci-brcmstb: Enable Clock Gating to save power
	mmc: sdhci-brcmstb: Fix SDHCI_RESET_ALL for CQHCI
	usb: cdns3: Add support for DRD CDNSP
	ceph: make ceph_create_session_msg a global symbol
	ceph: make iterate_sessions a global symbol
	ceph: flush mdlog before umounting
	ceph: flush the mdlog before waiting on unsafe reqs
	ceph: fix off by one bugs in unsafe_request_wait()
	ceph: put the requests/sessions when it fails to alloc memory
	ceph: fix possible NULL pointer dereference for req->r_session
	ceph: Use kcalloc for allocating multiple elements
	ceph: fix NULL pointer dereference for req->r_session
	usb: dwc3: gadget: conditionally remove requests
	usb: dwc3: gadget: Return -ESHUTDOWN on ep disable
	usb: dwc3: gadget: Clear ep descriptor last
	nilfs2: fix nilfs_sufile_mark_dirty() not set segment usage as dirty
	gcov: clang: fix the buffer overflow issue
	mm: vmscan: fix extreme overreclaim and swap floods
	KVM: x86: nSVM: leave nested mode on vCPU free
	KVM: x86: remove exit_int_info warning in svm_handle_exit
	x86/ioremap: Fix page aligned size calculation in __ioremap_caller()
	binder: avoid potential data leakage when copying txn
	binder: read pre-translated fds from sender buffer
	binder: defer copies of pre-patched txn data
	binder: fix pointer cast warning
	binder: Address corner cases in deferred copy and fixup
	binder: Gracefully handle BINDER_TYPE_FDA objects with num_fds=0
	Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode
	ASoC: Intel: bytcht_es8316: Add quirk for the Nanote UMPC-01
	serial: 8250: 8250_omap: Avoid RS485 RTS glitch on ->set_termios()
	Input: goodix - try resetting the controller when no config is set
	Input: soc_button_array - add use_low_level_irq module parameter
	Input: soc_button_array - add Acer Switch V 10 to dmi_use_low_level_irq[]
	xen-pciback: Allow setting PCI_MSIX_FLAGS_MASKALL too
	xen/platform-pci: add missing free_irq() in error path
	platform/x86: asus-wmi: add missing pci_dev_put() in asus_wmi_set_xusb2pr()
	platform/x86: acer-wmi: Enable SW_TABLET_MODE on Switch V 10 (SW5-017)
	zonefs: fix zone report size in __zonefs_io_error()
	platform/x86: hp-wmi: Ignore Smart Experience App event
	tcp: configurable source port perturb table size
	net: usb: qmi_wwan: add Telit 0x103a composition
	gpu: host1x: Avoid trying to use GART on Tegra20
	dm integrity: flush the journal on suspend
	dm integrity: clear the journal on suspend
	wifi: wilc1000: validate pairwise and authentication suite offsets
	wifi: wilc1000: validate length of IEEE80211_P2P_ATTR_OPER_CHANNEL attribute
	wifi: wilc1000: validate length of IEEE80211_P2P_ATTR_CHANNEL_LIST attribute
	wifi: wilc1000: validate number of channels
	genirq/msi: Shutdown managed interrupts with unsatifiable affinities
	genirq: Always limit the affinity to online CPUs
	irqchip/gic-v3: Always trust the managed affinity provided by the core code
	genirq: Take the proposed affinity at face value if force==true
	btrfs: free btrfs_path before copying root refs to userspace
	btrfs: free btrfs_path before copying fspath to userspace
	btrfs: free btrfs_path before copying subvol info to userspace
	btrfs: sysfs: normalize the error handling branch in btrfs_init_sysfs()
	drm/amd/dc/dce120: Fix audio register mapping, stop triggering KASAN
	drm/amdgpu: always register an MMU notifier for userptr
	drm/i915: fix TLB invalidation for Gen12 video and compute engines
	fuse: lock inode unconditionally in fuse_fallocate()
	Linux 5.10.157

Change-Id: Ie53a7379c392879de240237eb8258857b59564a6
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2022-12-04 12:51:21 +00:00
YueHaibing
c7788361a6 tipc: check skb_linearize() return value in tipc_disc_rcv() 
[ Upstream commit cd0f6421162201e4b22ce757a1966729323185eb ]

If skb_linearize() fails in tipc_disc_rcv(), we need to free the skb instead of
handle it.

Fixes: 25b0b9c4e8 ("tipc: handle collisions of 32-bit node address hash values")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Acked-by: Jon Maloy <jmaloy@redhat.com>
Link: https://lore.kernel.org/r/20221119072832.7896-1-yuehaibing@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2022-12-02 17:40:01 +01:00
Xin Long
4058e3b74a tipc: add an extra conn_get in tipc_conn_alloc 
[ Upstream commit a7b42969d63f47320853a802efd879fbdc4e010e ]

One extra conn_get() is needed in tipc_conn_alloc(), as after
tipc_conn_alloc() is called, tipc_conn_close() may free this
con before deferencing it in tipc_topsrv_accept():

   tipc_conn_alloc();
   newsk = newsock->sk;
                                 <---- tipc_conn_close();
   write_lock_bh(&sk->sk_callback_lock);
   newsk->sk_data_ready = tipc_conn_data_ready;

Then an uaf issue can be triggered:

  BUG: KASAN: use-after-free in tipc_topsrv_accept+0x1e7/0x370 [tipc]
  Call Trace:
   <TASK>
   dump_stack_lvl+0x33/0x46
   print_report+0x178/0x4b0
   kasan_report+0x8c/0x100
   kasan_check_range+0x179/0x1e0
   tipc_topsrv_accept+0x1e7/0x370 [tipc]
   process_one_work+0x6a3/0x1030
   worker_thread+0x8a/0xdf0

This patch fixes it by holding it in tipc_conn_alloc(), then after
all accessing in tipc_topsrv_accept() releasing it. Note when does
this in tipc_topsrv_kern_subscr(), as tipc_conn_rcv_sub() returns
0 or -1 only, we don't need to check for "> 0".

Fixes: c5fa7b3cf3 ("tipc: introduce new TIPC server infrastructure")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Jon Maloy <jmaloy@redhat.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2022-12-02 17:40:01 +01:00
Xin Long
e87a077d09 tipc: set con sock in tipc_conn_alloc 
[ Upstream commit 0e5d56c64afcd6fd2d132ea972605b66f8a7d3c4 ]

A crash was reported by Wei Chen:

  BUG: kernel NULL pointer dereference, address: 0000000000000018
  RIP: 0010:tipc_conn_close+0x12/0x100
  Call Trace:
   tipc_topsrv_exit_net+0x139/0x320
   ops_exit_list.isra.9+0x49/0x80
   cleanup_net+0x31a/0x540
   process_one_work+0x3fa/0x9f0
   worker_thread+0x42/0x5c0

It was caused by !con->sock in tipc_conn_close(). In tipc_topsrv_accept(),
con is allocated in conn_idr then its sock is set:

  con = tipc_conn_alloc();
  ...                    <----[1]
  con->sock = newsock;

If tipc_conn_close() is called in anytime of [1], the null-pointer-def
is triggered by con->sock->sk due to con->sock is not yet set.

This patch fixes it by moving the con->sock setting to tipc_conn_alloc()
under s->idr_lock. So that con->sock can never be NULL when getting the
con from s->conn_idr. It will be also safer to move con->server and flag
CF_CONNECTED setting under s->idr_lock, as they should all be set before
tipc_conn_alloc() is called.

Fixes: c5fa7b3cf3 ("tipc: introduce new TIPC server infrastructure")
Reported-by: Wei Chen <harperchen1110@gmail.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Jon Maloy <jmaloy@redhat.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2022-12-02 17:40:01 +01:00
Greg Kroah-Hartman
25af5a11f1 Merge 5.10.155 into android12-5.10-lts 
Changes in 5.10.155
	fuse: fix readdir cache race
	hwspinlock: qcom: correct MMIO max register for newer SoCs
	phy: stm32: fix an error code in probe
	wifi: cfg80211: silence a sparse RCU warning
	wifi: cfg80211: fix memory leak in query_regdb_file()
	bpf, sockmap: Fix the sk->sk_forward_alloc warning of sk_stream_kill_queues
	bpftool: Fix NULL pointer dereference when pin {PROG, MAP, LINK} without FILE
	HID: hyperv: fix possible memory leak in mousevsc_probe()
	bpf: Support for pointers beyond pkt_end.
	bpf: Add helper macro bpf_for_each_reg_in_vstate
	bpf: Fix wrong reg type conversion in release_reference()
	net: gso: fix panic on frag_list with mixed head alloc types
	macsec: delete new rxsc when offload fails
	macsec: fix secy->n_rx_sc accounting
	macsec: fix detection of RXSCs when toggling offloading
	macsec: clear encryption keys from the stack after setting up offload
	net: tun: Fix memory leaks of napi_get_frags
	bnxt_en: Fix possible crash in bnxt_hwrm_set_coal()
	bnxt_en: fix potentially incorrect return value for ndo_rx_flow_steer
	net: fman: Unregister ethernet device on removal
	capabilities: fix undefined behavior in bit shift for CAP_TO_MASK
	KVM: s390x: fix SCK locking
	KVM: s390: pv: don't allow userspace to set the clock under PV
	net: lapbether: fix issue of dev reference count leakage in lapbeth_device_event()
	hamradio: fix issue of dev reference count leakage in bpq_device_event()
	drm/vc4: Fix missing platform_unregister_drivers() call in vc4_drm_register()
	tcp: prohibit TCP_REPAIR_OPTIONS if data was already sent
	ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network
	can: af_can: fix NULL pointer dereference in can_rx_register()
	net: stmmac: dwmac-meson8b: fix meson8b_devm_clk_prepare_enable()
	net: broadcom: Fix BCMGENET Kconfig
	tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header
	dmaengine: pxa_dma: use platform_get_irq_optional
	dmaengine: mv_xor_v2: Fix a resource leak in mv_xor_v2_remove()
	drivers: net: xgene: disable napi when register irq failed in xgene_enet_open()
	perf stat: Fix printing os->prefix in CSV metrics output
	net: marvell: prestera: fix memory leak in prestera_rxtx_switch_init()
	net: nixge: disable napi when enable interrupts failed in nixge_open()
	net/mlx5: Allow async trigger completion execution on single CPU systems
	net/mlx5e: E-Switch, Fix comparing termination table instance
	net: cpsw: disable napi in cpsw_ndo_open()
	net: cxgb3_main: disable napi when bind qsets failed in cxgb_up()
	cxgb4vf: shut down the adapter when t4vf_update_port_info() failed in cxgb4vf_open()
	net: phy: mscc: macsec: clear encryption keys when freeing a flow
	net: atlantic: macsec: clear encryption keys from the stack
	ethernet: s2io: disable napi when start nic failed in s2io_card_up()
	net: mv643xx_eth: disable napi when init rxq or txq failed in mv643xx_eth_open()
	ethernet: tundra: free irq when alloc ring failed in tsi108_open()
	net: macvlan: fix memory leaks of macvlan_common_newlink
	riscv: process: fix kernel info leakage
	riscv: vdso: fix build with llvm
	riscv: Enable CMA support
	riscv: Separate memory init from paging init
	riscv: fix reserved memory setup
	arm64: efi: Fix handling of misaligned runtime regions and drop warning
	MIPS: jump_label: Fix compat branch range check
	mmc: cqhci: Provide helper for resetting both SDHCI and CQHCI
	mmc: sdhci-of-arasan: Fix SDHCI_RESET_ALL for CQHCI
	mmc: sdhci_am654: Fix SDHCI_RESET_ALL for CQHCI
	mmc: sdhci-tegra: Fix SDHCI_RESET_ALL for CQHCI
	ALSA: hda/hdmi - enable runtime pm for more AMD display audio
	ALSA: hda/ca0132: add quirk for EVGA Z390 DARK
	ALSA: hda: fix potential memleak in 'add_widget_node'
	ALSA: hda/realtek: Add Positivo C6300 model quirk
	ALSA: usb-audio: Add quirk entry for M-Audio Micro
	ALSA: usb-audio: Add DSD support for Accuphase DAC-60
	vmlinux.lds.h: Fix placement of '.data..decrypted' section
	ata: libata-scsi: fix SYNCHRONIZE CACHE (16) command failure
	nilfs2: fix deadlock in nilfs_count_free_blocks()
	nilfs2: fix use-after-free bug of ns_writer on remount
	drm/i915/dmabuf: fix sg_table handling in map_dma_buf
	platform/x86: hp_wmi: Fix rfkill causing soft blocked wifi
	btrfs: selftests: fix wrong error check in btrfs_free_dummy_root()
	mms: sdhci-esdhc-imx: Fix SDHCI_RESET_ALL for CQHCI
	udf: Fix a slab-out-of-bounds write bug in udf_find_entry()
	mm/memremap.c: map FS_DAX device memory as decrypted
	can: j1939: j1939_send_one(): fix missing CAN header initialization
	cert host tools: Stop complaining about deprecated OpenSSL functions
	dmaengine: at_hdmac: Fix at_lli struct definition
	dmaengine: at_hdmac: Don't start transactions at tx_submit level
	dmaengine: at_hdmac: Start transfer for cyclic channels in issue_pending
	dmaengine: at_hdmac: Fix premature completion of desc in issue_pending
	dmaengine: at_hdmac: Do not call the complete callback on device_terminate_all
	dmaengine: at_hdmac: Protect atchan->status with the channel lock
	dmaengine: at_hdmac: Fix concurrency problems by removing atc_complete_all()
	dmaengine: at_hdmac: Fix concurrency over descriptor
	dmaengine: at_hdmac: Free the memset buf without holding the chan lock
	dmaengine: at_hdmac: Fix concurrency over the active list
	dmaengine: at_hdmac: Fix descriptor handling when issuing it to hardware
	dmaengine: at_hdmac: Fix completion of unissued descriptor in case of errors
	dmaengine: at_hdmac: Don't allow CPU to reorder channel enable
	dmaengine: at_hdmac: Fix impossible condition
	dmaengine: at_hdmac: Check return code of dma_async_device_register
	net: tun: call napi_schedule_prep() to ensure we own a napi
	mmc: sdhci-esdhc-imx: Convert the driver to DT-only
	x86/cpu: Restore AMD's DE_CFG MSR after resume
	io_uring: kill goto error handling in io_sqpoll_wait_sq()
	Linux 5.10.155

Change-Id: Id7d803ed2db044ef465aab7e80fca8b4b07df258
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2022-12-02 08:40:37 +00:00
Greg Kroah-Hartman
673a7341bd This is the 5.10.153 stable release 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmNj1woACgkQONu9yGCS
 aT5mQw/+IG2zLoH79zTzQDZF+DYZ+J5WRGVLfx+5mM2j1fGgXWmxADdlzMZTSSAc
 XP1hDxHBYQSnQi/kRPuJOKJbV9TysdOV2SSvwzblq6UE4B7tw3q4YE9calfYPaiF
 AhvMMAEaXGVHAVSgliRqcgnlq5Yj6nrxjr73O3kuyCWvfv6XToCd6LKFJyHdVniw
 kJ7gbkgiOVH/caKyzJxW3uSZ11t4uZ10nu4q+rd3JOLDecPLcPLM28pDTL/znqS0
 ECiPypmIrd10UL+V4aiHsBR9wHEJdZULb/SLLwy85EuUeEhmx4i1ylu5JosY77cQ
 2CkxHIt8nCKxJ3BziMUbutY40VBs/MP74t1kB5Th/3JK8gsw2+JdUJ7b9RXzb60k
 vbFjc3lJugmNsAXqOnibAu/PdoWYi4IC7A2D/gJcWzsEKgVWQptZizJpn5Se3F3+
 OCWdqgOiTZiegK55W3w2xbNqSLkuvAfbx18UEWltHhzS1UT7cqGVxx7qcsFhWGfV
 rG1yzzF1Skx2BcnBf+6yTczOUcOyLrMyyek3tRD00EWn8o1ik9lKARNKd+b7IUW4
 57NUvaGsBp/BRrJobrdx5r7AkTg5AfEWQAM69+vbDUxjKRM02FQlfEycGxcTT2GD
 nUUzJMgobd0GW4HU/2rpmMk67QCnJ9guJxRCpcp7ocGkX0x2WYs=
 =n9Bi
 -----END PGP SIGNATURE-----

Merge 5.10.153 into android12-5.10-lts

Changes in 5.10.153
	can: j1939: transport: j1939_session_skb_drop_old(): spin_unlock_irqrestore() before kfree_skb()
	can: kvaser_usb: Fix possible completions during init_completion
	ALSA: Use del_timer_sync() before freeing timer
	ALSA: au88x0: use explicitly signed char
	ALSA: rme9652: use explicitly signed char
	USB: add RESET_RESUME quirk for NVIDIA Jetson devices in RCM
	usb: dwc3: gadget: Stop processing more requests on IMI
	usb: dwc3: gadget: Don't set IMI for no_interrupt
	usb: bdc: change state when port disconnected
	usb: xhci: add XHCI_SPURIOUS_SUCCESS to ASM1042 despite being a V0.96 controller
	mtd: rawnand: marvell: Use correct logic for nand-keep-config
	xhci: Add quirk to reset host back to default state at shutdown
	xhci: Remove device endpoints from bandwidth list when freeing the device
	tools: iio: iio_utils: fix digit calculation
	iio: light: tsl2583: Fix module unloading
	iio: temperature: ltc2983: allocate iio channels once
	fbdev: smscufx: Fix several use-after-free bugs
	fs/binfmt_elf: Fix memory leak in load_elf_binary()
	exec: Copy oldsighand->action under spin-lock
	mac802154: Fix LQI recording
	scsi: qla2xxx: Use transport-defined speed mask for supported_speeds
	drm/msm/dsi: fix memory corruption with too many bridges
	drm/msm/hdmi: fix memory corruption with too many bridges
	drm/msm/dp: fix IRQ lifetime
	mmc: sdhci_am654: 'select', not 'depends' REGMAP_MMIO
	mmc: core: Fix kernel panic when remove non-standard SDIO card
	counter: microchip-tcb-capture: Handle Signal1 read and Synapse
	kernfs: fix use-after-free in __kernfs_remove
	perf auxtrace: Fix address filter symbol name match for modules
	s390/futex: add missing EX_TABLE entry to __futex_atomic_op()
	s390/pci: add missing EX_TABLE entries to __pcistg_mio_inuser()/__pcilg_mio_inuser()
	Xen/gntdev: don't ignore kernel unmapping error
	xen/gntdev: Prevent leaking grants
	mm/memory: add non-anonymous page check in the copy_present_page()
	mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages
	net: ieee802154: fix error return code in dgram_bind()
	media: v4l2: Fix v4l2_i2c_subdev_set_name function documentation
	drm/msm: Fix return type of mdp4_lvds_connector_mode_valid
	ASoC: qcom: lpass-cpu: mark HDMI TX registers as volatile
	arc: iounmap() arg is volatile
	ASoC: qcom: lpass-cpu: Mark HDMI TX parity register as volatile
	ALSA: ac97: fix possible memory leak in snd_ac97_dev_register()
	perf/x86/intel/lbr: Use setup_clear_cpu_cap() instead of clear_cpu_cap()
	tipc: fix a null-ptr-deref in tipc_topsrv_accept
	net: netsec: fix error handling in netsec_register_mdio()
	net: hinic: fix incorrect assignment issue in hinic_set_interrupt_cfg()
	net: hinic: fix memory leak when reading function table
	net: hinic: fix the issue of CMDQ memory leaks
	net: hinic: fix the issue of double release MBOX callback of VF
	x86/unwind/orc: Fix unreliable stack dump with gcov
	amd-xgbe: fix the SFP compliance codes check for DAC cables
	amd-xgbe: add the bit rate quirk for Molex cables
	atlantic: fix deadlock at aq_nic_stop
	kcm: annotate data-races around kcm->rx_psock
	kcm: annotate data-races around kcm->rx_wait
	net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed
	net: lantiq_etop: don't free skb when returning NETDEV_TX_BUSY
	tcp: minor optimization in tcp_add_backlog()
	tcp: fix a signed-integer-overflow bug in tcp_add_backlog()
	tcp: fix indefinite deferral of RTO with SACK reneging
	can: mscan: mpc5xxx: mpc5xxx_can_probe(): add missing put_clock() in error path
	can: mcp251x: mcp251x_can_probe(): add missing unregister_candev() in error path
	PM: hibernate: Allow hybrid sleep to work with s2idle
	media: vivid: s_fbuf: add more sanity checks
	media: vivid: dev->bitmap_cap wasn't freed in all cases
	media: v4l2-dv-timings: add sanity checks for blanking values
	media: videodev2.h: V4L2_DV_BT_BLANKING_HEIGHT should check 'interlaced'
	media: vivid: set num_in/outputs to 0 if not supported
	ipv6: ensure sane device mtu in tunnels
	i40e: Fix ethtool rx-flow-hash setting for X722
	i40e: Fix VF hang when reset is triggered on another VF
	i40e: Fix flow-type by setting GL_HASH_INSET registers
	net: ksz884x: fix missing pci_disable_device() on error in pcidev_init()
	PM: domains: Fix handling of unavailable/disabled idle states
	net: fec: limit register access on i.MX6UL
	ALSA: aoa: i2sbus: fix possible memory leak in i2sbus_add_dev()
	ALSA: aoa: Fix I2S device accounting
	openvswitch: switch from WARN to pr_warn
	net: ehea: fix possible memory leak in ehea_register_port()
	nh: fix scope used to find saddr when adding non gw nh
	net/mlx5e: Do not increment ESN when updating IPsec ESN state
	net/mlx5: Fix possible use-after-free in async command interface
	net/mlx5: Fix crash during sync firmware reset
	net: enetc: survive memory pressure without crashing
	arm64: Add AMPERE1 to the Spectre-BHB affected list
	scsi: sd: Revert "scsi: sd: Remove a local variable"
	arm64/mm: Fix __enable_mmu() for new TGRAN range values
	arm64/kexec: Test page size support with new TGRAN range values
	can: rcar_canfd: rcar_canfd_handle_global_receive(): fix IRQ storm on global FIFO receive
	serial: core: move RS485 configuration tasks from drivers into core
	serial: Deassert Transmit Enable on probe in driver-specific way
	Linux 5.10.153

Change-Id: I1cbca2c5cbaaab34ccd6e055f13c35d900d4ce25
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2022-11-21 15:47:06 +00:00
Greg Kroah-Hartman
27b36ba7c2 This is the 5.10.152 stable release 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmNeOLQACgkQONu9yGCS
 aT5iwg/9H+n2ReIVRksj51PM2scTLYY/BqBJorvOPDyJx7pmq8X7wOK2wBxdkoeN
 11+SnTEanx8pO0tLx6W+ekl1vf/iOAuHRsroBzNoJxhfMrTwyvh/Nq/vaGtiLr/e
 PXr0d0SAR/XW0aKz8l3NMHDEmhXJv42ryOuEdGkOcKaOGp50gnPFLHpnbhZWVuWx
 QlA/ise0uwdUf9aK8VGnoqmvGmFYrspoEmrGdbAPXebzBDEpMM6SZO4FByy7N1+w
 ZyhkL1I12kXYHa1Apyqp+MTu0bYzXO1Lx0W4Hsnhwad/mA8f9A/hOYRh4h0TEudz
 Pla9O4qXmmx00UNyWm7nOl9T6y0Q2UbbHBzi1anv9PDeVQLtUgGIjqeaZiQ7usC5
 QYbz1pSlfRxLKbKtTGito0+QHVi/u363v+WrlaOA5v2qYKGsR9JCvF24gtMEEuYI
 jxh13PccgIiT5C1jGiqbKDjBIxY55mBsD/NjC3Bb8lw/3cXhePU2SNECDsJk/X/8
 P4OZxAMdgvGUewqB9Qd3WFMrQVIeOxJpIpZlYLVNB8V7CjHPouOh+dZQApqRd6bE
 alddAVmrI5UCJOTTsNiQgm5caBuhBcLIGe6ihMNCq3UOvOxxbVdYfhA+4kYgsqtV
 H//XSUOKEA6lRiOov6brui9BL6/hj+UszCxIHxERl1iKX+biGag=
 =cy7p
 -----END PGP SIGNATURE-----

Merge 5.10.152 into android12-5.10-lts

Changes in 5.10.152
	ocfs2: clear dinode links count in case of error
	ocfs2: fix BUG when iput after ocfs2_mknod fails
	selinux: enable use of both GFP_KERNEL and GFP_ATOMIC in convert_context()
	cpufreq: qcom: fix writes in read-only memory region
	i2c: qcom-cci: Fix ordering of pm_runtime_xx and i2c_add_adapter
	x86/microcode/AMD: Apply the patch early on every logical thread
	hwmon/coretemp: Handle large core ID value
	ata: ahci-imx: Fix MODULE_ALIAS
	ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS
	cpufreq: qcom: fix memory leak in error path
	kvm: Add support for arch compat vm ioctls
	KVM: arm64: vgic: Fix exit condition in scan_its_table()
	media: mceusb: set timeout to at least timeout provided
	media: venus: dec: Handle the case where find_format fails
	block: wbt: Remove unnecessary invoking of wbt_update_limits in wbt_init
	blk-wbt: call rq_qos_add() after wb_normal is initialized
	arm64: errata: Remove AES hwcap for COMPAT tasks
	r8152: add PID for the Lenovo OneLink+ Dock
	btrfs: fix processing of delayed data refs during backref walking
	btrfs: fix processing of delayed tree block refs during backref walking
	ACPI: extlog: Handle multiple records
	tipc: Fix recognition of trial period
	tipc: fix an information leak in tipc_topsrv_kern_subscr
	i40e: Fix DMA mappings leak
	HID: magicmouse: Do not set BTN_MOUSE on double report
	sfc: Change VF mac via PF as first preference if available.
	net/atm: fix proc_mpc_write incorrect return value
	net: phy: dp83867: Extend RX strap quirk for SGMII mode
	cifs: Fix xid leak in cifs_copy_file_range()
	cifs: Fix xid leak in cifs_flock()
	cifs: Fix xid leak in cifs_ses_add_channel()
	net: hsr: avoid possible NULL deref in skb_clone()
	ionic: catch NULL pointer issue on reconfig
	nvme-hwmon: rework to avoid devm allocation
	nvme-hwmon: Return error code when registration fails
	nvme-hwmon: consistently ignore errors from nvme_hwmon_init
	nvme-hwmon: kmalloc the NVME SMART log buffer
	net: sched: cake: fix null pointer access issue when cake_init() fails
	net: sched: delete duplicate cleanup of backlog and qlen
	net: sched: sfb: fix null pointer access issue when sfb_init() fails
	sfc: include vport_id in filter spec hash and equal()
	net: hns: fix possible memory leak in hnae_ae_register()
	net: sched: fix race condition in qdisc_graft()
	net: phy: dp83822: disable MDI crossover status change interrupt
	iommu/vt-d: Allow NVS regions in arch_rmrr_sanity_check()
	iommu/vt-d: Clean up si_domain in the init_dmars() error path
	drm/virtio: Use appropriate atomic state in virtio_gpu_plane_cleanup_fb()
	dmaengine: mxs-dma: Remove the unused .id_table
	dmaengine: mxs: use platform_driver_register
	tracing: Simplify conditional compilation code in tracing_set_tracer()
	tracing: Do not free snapshot if tracer is on cmdline
	xen: assume XENFEAT_gnttab_map_avail_bits being set for pv guests
	xen/gntdev: Accommodate VMA splitting
	mmc: sdhci-tegra: Use actual clock rate for SW tuning correction
	riscv: Add machine name to kernel boot log and stack dump output
	riscv: always honor the CONFIG_CMDLINE_FORCE when parsing dtb
	perf pmu: Validate raw event with sysfs exported format bits
	perf: Skip and warn on unknown format 'configN' attrs
	fcntl: make F_GETOWN(EX) return 0 on dead owner task
	fcntl: fix potential deadlocks for &fown_struct.lock
	arm64: dts: qcom: sc7180-trogdor: Fixup modem memory region
	arm64: topology: move store_cpu_topology() to shared code
	riscv: topology: fix default topology reporting
	perf/x86/intel/pt: Relax address filter validation
	hv_netvsc: Fix race between VF offering and VF association message from host
	ACPI: video: Force backlight native for more TongFang devices
	x86/Kconfig: Drop check for -mabi=ms for CONFIG_EFI_STUB
	Makefile.debug: re-enable debug info for .S files
	mmc: core: Add SD card quirk for broken discard
	blk-wbt: fix that 'rwb->wc' is always set to 1 in wbt_init()
	mm: /proc/pid/smaps_rollup: fix no vma's null-deref
	udp: Update reuse->has_conns under reuseport_lock.
	Linux 5.10.152

Change-Id: I2c75b6fd3ae205968bcc3133ebf71b82ff2a19b6
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2022-11-21 15:46:22 +00:00
Xin Long
f31dd15858 tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header 
[ Upstream commit 1c075b192fe41030457cd4a5f7dea730412bca40 ]

This is a follow-up for commit 974cb0e3e7 ("tipc: fix uninit-value
in tipc_nl_compat_name_table_dump") where it should have type casted
sizeof(..) to int to work when TLV_GET_DATA_LEN() returns a negative
value.

syzbot reported a call trace because of it:

  BUG: KMSAN: uninit-value in ...
   tipc_nl_compat_name_table_dump+0x841/0xea0 net/tipc/netlink_compat.c:934
   __tipc_nl_compat_dumpit+0xab2/0x1320 net/tipc/netlink_compat.c:238
   tipc_nl_compat_dumpit+0x991/0xb50 net/tipc/netlink_compat.c:321
   tipc_nl_compat_recv+0xb6e/0x1640 net/tipc/netlink_compat.c:1324
   genl_family_rcv_msg_doit net/netlink/genetlink.c:731 [inline]
   genl_family_rcv_msg net/netlink/genetlink.c:775 [inline]
   genl_rcv_msg+0x103f/0x1260 net/netlink/genetlink.c:792
   netlink_rcv_skb+0x3a5/0x6c0 net/netlink/af_netlink.c:2501
   genl_rcv+0x3c/0x50 net/netlink/genetlink.c:803
   netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
   netlink_unicast+0xf3b/0x1270 net/netlink/af_netlink.c:1345
   netlink_sendmsg+0x1288/0x1440 net/netlink/af_netlink.c:1921
   sock_sendmsg_nosec net/socket.c:714 [inline]
   sock_sendmsg net/socket.c:734 [inline]

Reported-by: syzbot+e5dbaaa238680ce206ea@syzkaller.appspotmail.com
Fixes: 974cb0e3e7 ("tipc: fix uninit-value in tipc_nl_compat_name_table_dump")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Link: https://lore.kernel.org/r/ccd6a7ea801b15aec092c3b532a883b4c5708695.1667594933.git.lucien.xin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2022-11-16 09:57:11 +01:00
Xin Long
32a3d4660b tipc: fix a null-ptr-deref in tipc_topsrv_accept 
[ Upstream commit 82cb4e4612c633a9ce320e1773114875604a3cce ]

syzbot found a crash in tipc_topsrv_accept:

  KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
  Workqueue: tipc_rcv tipc_topsrv_accept
  RIP: 0010:kernel_accept+0x22d/0x350 net/socket.c:3487
  Call Trace:
   <TASK>
   tipc_topsrv_accept+0x197/0x280 net/tipc/topsrv.c:460
   process_one_work+0x991/0x1610 kernel/workqueue.c:2289
   worker_thread+0x665/0x1080 kernel/workqueue.c:2436
   kthread+0x2e4/0x3a0 kernel/kthread.c:376
   ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306

It was caused by srv->listener that might be set to null by
tipc_topsrv_stop() in net .exit whereas it's still used in
tipc_topsrv_accept() worker.

srv->listener is protected by srv->idr_lock in tipc_topsrv_stop(), so add
a check for srv->listener under srv->idr_lock in tipc_topsrv_accept() to
avoid the null-ptr-deref. To ensure the lsock is not released during the
tipc_topsrv_accept(), move sock_release() after tipc_topsrv_work_stop()
where it's waiting until the tipc_topsrv_accept worker to be done.

Note that sk_callback_lock is used to protect sk->sk_user_data instead of
srv->listener, and it should check srv in tipc_topsrv_listener_data_ready()
instead. This also ensures that no more tipc_topsrv_accept worker will be
started after tipc_conn_close() is called in tipc_topsrv_stop() where it
sets sk->sk_user_data to null.

Fixes: 0ef897be12 ("tipc: separate topology server listener socket from subcsriber sockets")
Reported-by: syzbot+c5ce866a8d30f4be0651@syzkaller.appspotmail.com
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Jon Maloy <jmaloy@redhat.com>
Link: https://lore.kernel.org/r/4eee264380c409c61c6451af1059b7fb271a7e7b.1666120790.git.lucien.xin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2022-11-03 23:57:51 +09:00