android_kernel_xiaomi_sm8450

Author	SHA1	Message	Date
Greg Kroah-Hartman	c761121f9a	Merge tag 'android12-5.10.218_r00' into android12-5.10 This merges the 5.10.218 LTS kernel into the android12-5.10 branch. Included in here are the following commits: * `3a2d2273f6` Merge 5.10.218 into android12-5.10-lts \|\ \| * `61458c864c` Linux 5.10.218 \| * `04a5842ed7` docs: kernel_include.py: Cope with docutils 0.21 \| * `b5fb355c9f` serial: kgdboc: Fix NMI-safety problems from keyboard reset code \| * `7ed7748c94` usb: typec: ucsi: displayport: Fix potential deadlock \| * `0eb296233f` drm/amdgpu: Fix possible NULL dereference in amdgpu_ras_query_error_status_helper() \| * `c48ab6a4cd` btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks() \| * `99951b62bf` mptcp: ensure snd_nxt is properly initialized on connect \| * `f2277d9e2a` firmware: arm_scmi: Harden accesses to the reset domains \| * `546751d9d4` KVM: x86: Clear "has_error_code", not "error_code", for RM exception injection \| * `05c9e3fc93` netlink: annotate lockless accesses to nlk->max_recvmsg_len \| * `eb15243bc9` ima: fix deadlock when traversing "ima_default_rules". \| * `db7aa45c71` net: bcmgenet: synchronize UMAC_CMD access \| * `b8d75bb01c` net: bcmgenet: synchronize EXT_RGMII_OOB_CTRL access \| * `719225b0f9` Revert "selftests: mm: fix map_hugetlb failure on 64K page size systems" \| * `1424ab4bb3` x86/xen: Drop USERGS_SYSRET64 paravirt call \| * `8869c2916d` pinctrl: core: handle radix_tree_insert() errors in pinctrl_register_one_pin() * \| `dde5ece421` Merge 5.10.217 into android12-5.10-lts \|\\| \| * `ce3838dbef` Linux 5.10.217 \| * `fb5b347efd` md: fix kmemleak of rdev->serial \| * `ad2011ea78` keys: Fix overwrite of key expiration on instantiation \| * `324be157e0` regulator: core: fix debugfs creation regression \| * `7788fc8a8b` hwmon: (pmbus/ucd9000) Increase delay from 250 to 500us \| * `0c3248bc70` net: fix out-of-bounds access in ops_init \| * `3cd682357c` drm/vmwgfx: Fix invalid reads in fence signaled events \| * `49e0911887` mei: me: add lunar lake point M DID \| * `41d8ac238a` dyndbg: fix old BUG_ON in >control parser \| * `7fbcbb96ae` ASoC: tegra: Fix DSPK 16-bit playback \| * `f6c807e853` net: bcmgenet: synchronize use of bcmgenet_set_rx_mode() \| * `367766ff9e` tipc: fix UAF in error path \| * `e2648b3d17` iio: accel: mxc4005: Interrupt handling fixes \| * `0ba169bb80` iio:imu: adis16475: Fix sync mode setting \| * `e6ba44f832` ALSA: hda/realtek: Fix mute led of HP Laptop 15-da3001TU \| * `72410925c8` usb: dwc3: core: Prevent phy suspend during init \| * `15165b5258` usb: xhci-plat: Don't include xhci.h \| * `ffb06cb324` usb: gadget: f_fs: Fix a race condition when processing setup packets. \| * `31cfe4e156` usb: gadget: composite: fix OS descriptors w_value logic \| * `3afc842e66` usb: ohci: Prevent missed ohci interrupts \| * `399ca46db7` usb: Fix regression caused by invalid ep0 maxpacket in virtual SuperSpeed device \| * `3a970e41c3` usb: typec: ucsi: Fix connector check on init \| * `3b0b6b3276` usb: typec: ucsi: Check for notifications after init \| * `09b3536d98` arm64: dts: qcom: Fix 'interrupt-map' parent address cells \| * `cca330c59c` firewire: nosy: ensure user_length is taken into account when fetching packet contents \| * `a2fb0eefa4` btrfs: fix kvcalloc() arguments order in btrfs_ioctl_send() \| * `3284447d66` net: hns3: use appropriate barrier function after setting a bit value \| * `674c951ab8` ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() \| * `9a2a5cd84f` net: bridge: fix corrupted ethernet header on multicast-to-unicast \| * `e7eb0737c6` kcov: Remove kcov include from sched.h and move it to its users. \| * `f085e02f0a` phonet: fix rtm_phonet_notify() skb allocation \| * `b33ae32b6d` hwmon: (corsair-cpro) Protect ccp->wait_input_report with a spinlock \| * `5b37ce7bb2` hwmon: (corsair-cpro) Use complete_all() instead of complete() in ccp_raw_event() \| * `549e740bad` hwmon: (corsair-cpro) Use a separate buffer for sending commands \| * `6c8f44b025` rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation \| * `06acb75e7e` Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout \| * `33a6e92161` Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout \| * `1d9cf07810` tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). \| * `413c33b9f3` tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets \| * `a4b7606732` xfrm: Preserve vlan tags for transport mode software GRO \| * `17f8b8d432` net:usb:qmi_wwan: support Rolling modules \| * `e09096291f` drm/nouveau/dp: Don't probe eDP ports twice harder \| * `09be6fa6af` fs/9p: drop inodes immediately on non-.L too \| * `c43463fa3f` clk: Don't hold prepare_lock when calling kref_put() \| * `c8e9cc2fa9` gpio: crystalcove: Use -ENOTSUPP consistently \| * `09c733cde5` gpio: wcove: Use -ENOTSUPP consistently \| * `dca2b31cf4` 9p: explicitly deny setlease attempts \| * `c38c45304b` fs/9p: translate O_TRUNC into OTRUNC \| * `5a605930e1` fs/9p: only translate RWX permissions for plain 9P2000 \| * `a79b53d0d9` selftests: timers: Fix valid-adjtimex signed left-shift undefined behavior \| * `7c355faad0` MIPS: scall: Save thread_info.syscall unconditionally on entry \| * `09888cff32` gpu: host1x: Do not setup DMA for virtual devices \| * `62accf6c1d` blk-iocost: avoid out of bounds shift \| * `7ba3962c9e` scsi: target: Fix SELinux error when systemd-modules loads the target module \| * `b34fdb24ab` btrfs: always clear PERTRANS metadata during commit \| * `e2a3a1df2f` btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve \| * `2214d3a5d9` tools/power turbostat: Fix Bzy_MHz documentation typo \| * `413dbd60ea` tools/power turbostat: Fix added raw MSR output \| * `fa273f3123` firewire: ohci: mask bus reset interrupts between ISR and bottom half \| * `e8b125df34` ata: sata_gemini: Check clk_enable() result \| * `1fb7ab9a6e` net: bcmgenet: Reset RBUF on first open \| * `602dd9d99a` ALSA: line6: Zero-initialize message buffers \| * `e2f5d61b5a` btrfs: return accurate error code on open failure in open_fs_devices() \| * `ad498539dd` scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload \| * `d21475d29d` net: mark racy access on sk->sk_rcvbuf \| * `a762b8e041` wifi: cfg80211: fix rdev_dump_mpp() arguments order \| * `a21712550a` wifi: mac80211: fix ieee80211_bss__flags kernel-doc \| `a7fb16ff62` gfs2: Fix invalid metadata access in punch_hole \| * `e7e50ac5f4` scsi: lpfc: Update lpfc_ramp_down_queue_handler() logic \| * `4404465a1b` KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() \| * `4563a0afd9` KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id \| * `bfc78b4628` clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change \| * `7df798dd59` net: gro: add flush check in udp_gro_receive_segment \| * `adbce6d20d` tipc: fix a possible memleak in tipc_buf_append \| * `faa83a7797` net: core: reject skb_copy(_expand) for fraglist GSO skbs \| * `48ab384d2b` net: bridge: fix multicast-to-unicast with fraglist GSO \| * `a0e3faf29e` net: dsa: mv88e6xxx: Fix number of databases for 88E6141 / 88E6341 \| * `ea6213141e` cxgb4: Properly lock TX queue for the selftest. \| * `aa50658c70` ASoC: meson: cards: select SND_DYNAMIC_MINORS \| * `f25b4c829e` ASoC: Fix 7/8 spaces indentation in Kconfig \| * `bf9e84ae15` net: qede: use return from qede_parse_actions() \| * `99c9baffcf` net: qede: use return from qede_parse_flow_attr() for flow_spec \| * `fff2c7a02b` net: qede: use return from qede_parse_flow_attr() for flower \| * `4a0c24cc14` net: qede: sanitize 'rc' in qede_add_tc_flower_fltr() \| * `96a592f160` s390/vdso: Add CFI for RA register to asm macro vdso_func \| * `553b2f6c34` net l2tp: drop flow hash on forward \| * `bbccf0caef` nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). \| * `bcdac70adc` octeontx2-af: avoid off-by-one read from userspace \| * `6f0f19b79c` bna: ensure the copied buf is NUL terminated \| * `78ad3b01ca` s390/mm: Fix clearing storage keys for huge pages \| * `e93c82fa96` s390/mm: Fix storage key clearing for guest huge pages \| * `3994f81ab6` regulator: mt6360: De-capitalize devicetree regulator subnodes \| * `35ab679e8b` pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map() \| * `5ea5d06197` power: rt9455: hide unused rt9455_boost_voltage_values \| * `d4891d8173` nfs: Handle error of rpc_proc_register() in nfs_net_init(). \| * `afdbc21a92` nfs: make the rpc_stat per net namespace \| * `6eef21eb7a` nfs: expose /proc/net/sunrpc/nfs in net namespaces \| * `95ebd5fc15` sunrpc: add a struct rpc_stats arg to rpc_create_args \| * `a3f1a38733` pinctrl: mediatek: paris: Rework support for PIN_CONFIG_{INPUT,OUTPUT}_ENABLE \| * `e0e916a21e` pinctrl: mediatek: paris: Fix PIN_CONFIG_INPUT_SCHMITT_ENABLE readback \| * `d676152a7b` pinctrl: mediatek: paris: Rework mtk_pinconf_{get,set} switch/case logic \| * `288bc4aa75` pinctrl: core: delete incorrect free in pinctrl_enable() \| * `734d2dad60` pinctrl/meson: fix typo in PDM's pin name \| * `20c91ac14b` pinctrl: pinctrl-aspeed-g6: Fix register offset for pinconf of GPIOR-T \| * `c850f71fca` eeprom: at24: fix memory corruption race condition \| * `ec9dbddea2` eeprom: at24: Probe for DDR3 thermal sensor in the SPD case \| * `b2643d2532` eeprom: at24: Use dev_err_probe for nvmem register failure \| * `5a730a161a` wifi: nl80211: don't free NULL coalescing rule \| * `00d09857f8` dmaengine: Revert "dmaengine: pl330: issue_pending waits until WFP state" \| * `db6740b4e1` dmaengine: pl330: issue_pending waits until WFP state * \| `d39363d4d0` ANDROID: update .xml file due to struct clk_core abi change * \| `c15c1199d6` Merge 5.10.216 into android12-5.10-lts \|\\| \| * `39fbb15b4a` Linux 5.10.216 \| * `1897993bb8` riscv: Disable STACKPROTECTOR_PER_TASK if GCC_PLUGIN_RANDSTRUCT is enabled \| * `ba7bc80da3` serial: core: fix kernel-doc for uart_port_unlock_irqrestore() \| * `16affc4d73` udp: preserve the connected status if only UDP cmsg \| * `66297b2ced` bounds: Use the right number of bits for power-of-two CONFIG_NR_CPUS \| * `5095b93021` HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up \| * `5fd7240458` i2c: smbus: fix NULL function pointer dereference \| * `04bf2e5f95` riscv: Fix TASK_SIZE on 64-bit NOMMU \| * `d5cc3498f0` riscv: fix VMALLOC_START definition \| * `fcdd5bb4a8` dma: xilinx_dpdma: Fix locking \| * `5129f84bc3` idma64: Don't try to serve interrupts when device is powered off \| * `4d051d6f9c` dmaengine: owl: fix register access functions \| * `ab31bc5022` tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge() \| * `74e5e5601d` tcp: Clean up kernel listener's reqsk in inet_twsk_purge() \| * `179a890ee4` mtd: diskonchip: work around ubsan link failure \| * `f99de42b80` stackdepot: respect __GFP_NOLOCKDEP allocation flag \| * `c9d5f3b5af` net: b44: set pause params only when interface is up \| * `f3a2f186a1` ethernet: Add helper for assigning packet type when dest address does not match device address \| * `aa44d21574` irqchip/gic-v3-its: Prevent double free on error \| * `5ab19dc55c` drm/amdgpu: Fix leak when GPU memory allocation fails \| * `48a92487db` drm/amdgpu/sdma5.2: use legacy HDP flush for SDMA2/3 \| * `b2d5ef07dd` arm64: dts: rockchip: enable internal pull-up for Q7_THRM# on RK3399 Puma \| * `af6d6a923b` cpu: Re-enable CPU mitigations by default for !X86 architectures \| * `30189e54ba` btrfs: fix information leak in btrfs_ioctl_logical_to_ino() \| * `6dc5afe8f2` Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0bda:0x4853 \| * `de657b2109` Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old() \| * `087de000e4` PM / devfreq: Fix buffer overflow in trans_stat_show \| * `772a23d60a` tracing: Increase PERF_MAX_TRACE_SIZE to handle Sentinel1 and docker together \| * `ffbeb5d4f9` tracing: Show size of requested perf buffer \| * `98f282c351` net/mlx5e: Fix a race in command alloc flow \| * `2862578fcd` Revert "crypto: api - Disallow identical driver names" \| * `0dc0637e6b` serial: mxs-auart: add spinlock around changing cts state \| * `fc955bdeba` serial: core: Provide port lock wrappers \| * `ae7c8f52aa` af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc(). \| * `dd0eb1dab9` net: ethernet: ti: am65-cpts: Fix PTPv1 message type on TX packets \| * `d51037994f` iavf: Fix TC config comparison with existing adapter TC config \| * `3a4677b219` i40e: Report MFS in decimal base instead of hex \| * `fbbb240434` i40e: Do not use WQ_MEM_RECLAIM flag for workqueue \| * `e4bb6da24d` netfilter: nf_tables: honor table dormant flag from netdev release event path \| * `857ed80013` mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work \| * `09846c2309` mlxsw: spectrum_acl_tcam: Fix incorrect list API usage \| * `1d76bd2a00` mlxsw: spectrum_acl_tcam: Fix warning during rehash \| * `617e98ba4c` mlxsw: spectrum_acl_tcam: Fix memory leak during rehash \| * `3c443a34a0` mlxsw: spectrum_acl_tcam: Rate limit error message \| * `a429a912d6` mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash \| * `e24d248742` mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update \| * `e1ad8eaa80` mlxsw: spectrum_acl_tcam: Fix race during rehash delayed work \| * `35880c3fa6` net: openvswitch: Fix Use-After-Free in ovs_ct_exit \| * `aca5dadab1` ipvs: Fix checksumming on GSO of SCTP packets \| * `0caff3e639` net: gtp: Fix Use-After-Free in gtp_dellink \| * `9bda5e2f62` net: usb: ax88179_178a: stop lying about skb->truesize \| * `7da0f91681` ipv4: check for NULL idev in ip_route_use_hint() \| * `c676c68e48` NFC: trf7970a: disable all regulators on removal \| * `6496fadf2a` mlxsw: core: Unregister EMAD trap using FORWARD action \| * `e860a87054` vxlan: drop packets from invalid src-address \| * `4dc8beb887` wifi: iwlwifi: mvm: remove old PASN station when adding a new one \| * `b4a29e1835` ARC: [plat-hsdk]: Remove misplaced interrupt-cells property \| * `4c7a2f71b5` arm64: dts: mediatek: mt2712: fix validation errors \| * `755703e68d` arm64: dts: mediatek: mt7622: drop "reset-names" from thermal block \| * `ed993f7448` arm64: dts: mediatek: mt7622: fix ethernet controller "compatible" \| * `819da78e4c` arm64: dts: mediatek: mt7622: fix IR nodename \| * `55d07efd38` arm64: dts: mediatek: mt7622: fix clock controllers \| * `136c8e0169` arm64: dts: mediatek: mt7622: introduce nodes for Wireless Ethernet Dispatch \| * `57ff09043f` arm64: dts: mediatek: mt7622: add support for coherent DMA \| * `f993087135` arm64: dts: rockchip: Remove unsupported node from the Pinebook Pro dts \| * `759796d768` arm64: dts: rockchip: enable internal pull-up on PCIE_WAKE# for RK3399 Puma \| * `38db853f7c` arm64: dts: rockchip: fix alphabetical ordering RK3399 puma \| * `7061c7efbb` nilfs2: fix OOB in nilfs_set_de_type \| * `13d76b2f44` nouveau: fix instmem race condition around ptr stores \| * `1fd7db5c16` drm/amdgpu: validate the parameters of bo mapping operations more clearly \| * `2ef607ea10` init/main.c: Fix potential static_command_line memory overflow \| * `84bd4c2ae9` fs: sysfs: Fix reference leak in sysfs_break_active_protection() \| * `6401038acf` speakup: Avoid crash on very long word \| * `bf786df6bd` mei: me: disable RPL-S on SPS and IGN firmwares \| * `5160b4bd4d` usb: Disable USB3 LPM at shutdown \| * `26fde0ea40` usb: dwc2: host: Fix dereference issue in DDMA completion flow. \| * `ab92e11b73` Revert "usb: cdc-wdm: close race between read and workqueue" \| * `ba11df453e` USB: serial: option: add Telit FN920C04 rmnet compositions \| * `33b29a5007` USB: serial: option: add Rolling RW101-GL and RW135-GL support \| * `6e7cdfd6c7` USB: serial: option: support Quectel EM060K sub-models \| * `b5c3eceec2` USB: serial: option: add Lonsung U8300/U9300 product \| * `e32faa0e9d` USB: serial: option: add support for Fibocom FM650/FG650 \| * `3366e4fdfe` USB: serial: option: add Fibocom FM135-GL variants \| * `ab86cf6f8d` serial/pmac_zilog: Remove flawed mitigation for rx irq flood \| * `f15370e315` comedi: vmk80xx: fix incomplete endpoint checking \| * `5a7e30d9be` thunderbolt: Fix wake configurations after device unplug \| * `e6245ed822` thunderbolt: Avoid notify PM core about runtime PM resume \| * `48a1f83ca9` binder: check offset alignment in binder_get_object() \| * `2e212ae066` x86/cpufeatures: Fix dependencies for GFNI, VAES, and VPCLMULQDQ \| * `4af115f1a2` clk: Get runtime PM before walking tree during disable_unused \| * `d339ce2739` clk: Initialize struct clk_core kref earlier \| * `83e6e77f68` clk: Print an info line before disabling unused clocks \| * `c04fc24403` clk: remove extra empty line \| * `f5591ad6e2` clk: Mark 'all_lists' as const \| * `bde446f167` clk: Remove prepare_lock hold assertion in __clk_release() \| * `f3d4f01737` drm/panel: visionox-rm69299: don't unregister DSI device \| * `097c7918fc` drm: nv04: Fix out of bounds access \| * `5ebbbeb295` RDMA/mlx5: Fix port number for counter query in multi-port configuration \| * `40c4858623` RDMA/cm: Print the old state when cm_destroy_id gets timeout \| * `2e45acd12c` RDMA/rxe: Fix the problem "mutex_destroy missing" \| * `14cdb43dbc` tun: limit printing rate when illegal packet received by tun dev \| * `e3b887a9c1` netfilter: nft_set_pipapo: do not free live element \| * `934e66e231` netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() \| * `26ebeffff2` Revert "tracing/trigger: Fix to return error if failed to alloc snapshot" \| * `5062d1f4f0` kprobes: Fix possible use-after-free issue on kprobe registration \| * `1d9ff61160` selftests/ftrace: Limit length in subsystem-enable tests \| * `9abc3e6f11` riscv: process: Fix kernel gp leakage \| * `11a821ee5e` riscv: Enable per-task stack canaries \| * `4c5e9eaa70` btrfs: record delayed inode root in transaction \| * `c38ea6f1ea` irqflags: Explicitly ignore lockdep_hrtimer_exit() argument \| * `85df831dc5` x86/apic: Force native_apic_mem_read() to use the MOV instruction \| * `4979a581c7` selftests: timers: Fix abs() warning in posix_timers test \| * `30da4180fd` x86/cpu: Actually turn off mitigations by default for SPECULATION_MITIGATIONS=n \| * `a75a785dbe` vhost: Add smp_rmb() in vhost_vq_avail_empty() \| * `4158648776` drm/client: Fully protect modes[] with dev->mode_config.mutex \| * `fb9f76b2a2` btrfs: qgroup: correctly model root qgroup rsv in convert \| * `b43ff11736` mailbox: imx: fix suspend failue \| * `5ef15c06ac` iommu/vt-d: Allocate local memory for page request queue \| * `b26aa765f7` net: ena: Fix incorrect descriptor free behavior \| * `c3b3b0c1ac` net: ena: Wrong missing IO completions check order \| * `02c42a2774` net: ena: Fix potential sign extension issue \| * `2e2a03787f` af_unix: Fix garbage collector racing against connect() \| * `14bea27d1c` af_unix: Do not use atomic ops for unix_sk(sk)->inflight. \| * `3d90ca9145` net/mlx5: Properly link new fs rules into the tree \| * `cf4bc359b7` netfilter: complete validation of user input \| * `b0e30c3769` Bluetooth: SCO: Fix not validating setsockopt user input \| * `3fb02ec57e` ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr \| * `9e55a650ac` ipv4/route: avoid unused-but-set-variable warning \| * `1afc86bcfb` ipv6: fib: hide unused 'pn' variable \| * `434aabb6c1` octeontx2-af: Fix NIX SQ mode and BP config \| * `10204df9be` geneve: fix header validation in geneve[6]_xmit_skb \| * `a82984b3c6` xsk: validate user input for XDP_{UMEM\|COMPLETION}_FILL_RING \| * `69fbe5bf31` u64_stats: fix u64_stats_init() for lockdep when used repeatedly in one file \| * `583b7b856f` net: openvswitch: fix unwanted error log on timeout policy probing \| * `e252fc8279` nouveau: fix function cast warning \| * `7dc2f7b2c3` media: cec: core: remove length check of Timer Status \| * `8478394f76` Bluetooth: Fix memory leak in hci_req_sync_complete() \| * `70a8be9dc2` batman-adv: Avoid infinite loop trying to resize local TT * \| `ce4609a54d` ANDROID: mark DRM_VMWGFX as BROKEN * \| `48fcb2dadf` Revert "ANDROID: Setting up GS before calling __restore_processor_state." * \| `be9f128eaf` Revert "block: introduce zone_write_granularity limit" * \| `767bb1b3ae` Revert "block: Clear zone limits for a non-zoned stacked queue" * \| `213d8963dc` Revert "scsi: sd: Fix wrong zone_write_granularity value during revalidate" * \| `eaaff97d11` Revert "PCI/ERR: Cache RCEC EA Capability offset in pci_init_capabilities()" * \| `60f9b585da` Revert "PCI: Cache PCIe Device Capabilities register" * \| `54292b6722` Revert "PCI: Work around Intel I210 ROM BAR overlap defect" * \| `a4a9cf2ab5` Revert "PCI/ASPM: Make Intel DG2 L1 acceptable latency unlimited" * \| `49a81ed542` Revert "PCI/DPC: Quirk PIO log size for certain Intel Root Ports" * \| `478632cd90` Revert "PCI/DPC: Quirk PIO log size for Intel Ice Lake Root Ports" * \| `58574fb618` Revert "PCI/DPC: Quirk PIO log size for Intel Raptor Lake Root Ports" * \| `3f602a77d6` Revert "timers: Rename del_timer_sync() to timer_delete_sync()" * \| `9100d24dfd` Merge 5.10.215 into android12-5.10-lts \|\\| \| * `e2e4e7b4ae` Linux 5.10.215 \| * `cea750c99d` x86/head/64: Re-enable stack protection \| * `0bdc64e9e7` x86/retpoline: Add NOENDBR annotation to the SRSO dummy return thunk \| * `85d11ded2d` scsi: sd: Fix wrong zone_write_granularity value during revalidate \| * `44900a8bec` kbuild: dummy-tools: adjust to stricter stackprotector check \| * `682f6ca967` VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() \| * `f7d846acf9` Bluetooth: btintel: Fixe build regression \| * `fe34587acc` drm/i915/gt: Reset queue_priority_hint on parking \| * `c2b2430b48` x86/mm/pat: fix VM_PAT handling in COW mappings \| * `3b29694dde` virtio: reenable config if freezing device failed \| * `ada28eb4b9` tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc \| * `b58d0ac35f` netfilter: nf_tables: discard table flag update with pending basechain deletion \| * `2cee2ff7f8` netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path \| * `453c8da7ef` netfilter: nf_tables: release batch on table validation from abort path \| * `951838fee4` fbmon: prevent division by zero in fb_videomode_from_videomode() \| * `c6e0de1e07` drivers/nvme: Add quirks for device 126f:2262 \| * `19536fe420` fbdev: viafb: fix typo in hw_bitblt_1 and hw_bitblt_2 \| * `e9efe31e6b` usb: sl811-hcd: only defined function checkdone if QUIRK2 is defined \| * `8406161fbe` usb: typec: tcpci: add generic tcpci fallback compatible \| * `e0184c95aa` tools: iio: replace seekdir() in iio_generic_buffer \| * `91698804bb` ring-buffer: use READ_ONCE() to read cpu_buffer->commit_page in concurrent environment \| * `694b7fa79e` ktest: force $buildonly = 1 for 'make_warnings_file' test type \| * `804ed6c3ac` platform/x86: touchscreen_dmi: Add an extra entry for a variant of the Chuwi Vi8 tablet \| * `95bd7e317d` Input: allocate keycode for Display refresh rate toggle \| * `d4b856aaaa` RDMA/cm: add timeout to cm_destroy_id wait \| * `b0cb5564c3` block: prevent division by zero in blk_rq_stat_sum() \| * `d2341dc41a` libperf evlist: Avoid out-of-bounds access \| * `5e0a89c49f` Revert "ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default" \| * `4b676584d0` SUNRPC: increase size of rpc_wait_queue.qlen from unsigned short to unsigned int \| * `0b5668a87c` drm/amd/display: Fix nanosec stat overflow \| * `48882b489f` ext4: forbid commit inconsistent quota data when errors=remount-ro \| * `6545e1307a` ext4: add a hint for block bitmap corrupt state in mb_groups \| * `2fef005985` media: sta2x11: fix irq handler cast \| * `bd12d39aaf` isofs: handle CDs with bad root inode but good Joliet root directory \| * `c473288f27` scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc() \| * `674c1c4229` sysv: don't call sb_bread() with pointers_lock held \| * `94b01bdf49` pinctrl: renesas: checker: Limit cfg reg enum checks to provided IDs \| * `fd238540fb` Input: synaptics-rmi4 - fail probing if memory allocation for "phys" fails \| * `86e9b47e8a` Bluetooth: btintel: Fix null ptr deref in btintel_read_version \| * `bc4d1ebca1` net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() \| * `4720d590c4` btrfs: send: handle path ref underflow in header iterate_inode_ref() \| * `0002df7380` btrfs: export: handle invalid inode or root reference in btrfs_get_parent() \| * `87299cdaae` btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() \| * `a2e43c53b8` tools/power x86_energy_perf_policy: Fix file leak in get_pkg_num() \| * `98e2b97acb` pstore/zone: Add a null pointer check to the psz_kmsg_read \| * `a3cd110463` ionic: set adminq irq affinity \| * `bd365f0644` arm64: dts: rockchip: fix rk3399 hdmi ports node \| * `3ea4717296` arm64: dts: rockchip: fix rk3328 hdmi ports node \| * `5b71a921db` panic: Flush kernel log buffer at the end \| * `ad78c5047d` VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() \| * `46e219d886` wifi: ath9k: fix LNA selection in ath_ant_try_scan() \| * `1a038ea9f9` objtool: Add asm version of STACK_FRAME_NON_STANDARD \| * `bb5fb12c50` x86/cpufeatures: Add CPUID_LNX_5 to track recently added Linux-defined word \| * `c137ee44c5` mptcp: don't account accept() of non-MPC client as fallback to TCP \| * `aae6464684` x86/retpoline: Do the necessary fixup to the Zen3/4 srso return thunk for !SRSO \| * `f5e9b93fbe` x86/bugs: Fix the SRSO mitigation on Zen3/4 \| * `2cba2ba2a8` riscv: Fix spurious errors from __get/put_kernel_nofault \| * `9fd381feaf` s390/entry: align system call table on 8 bytes \| * `f5e65b782f` x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() \| * `3127b2ee50` of: dynamic: Synchronize of_changeset_destroy() with the devlink removals \| * `7f62d985e9` driver core: Introduce device_link_wait_removal() \| * `976b0215f6` ALSA: hda/realtek: Update Panasonic CF-SZ6 quirk to support headset with microphone \| * `75c3348796` ata: sata_mv: Fix PCI device ID table declaration compilation warning \| * `ca22295535` scsi: mylex: Fix sysfs buffer lengths \| * `dff4cd7de1` ata: sata_sx4: fix pdc20621_get_from_dimm() on 64-bit \| * `aa5936f5ec` ASoC: ops: Fix wraparound for mask in snd_soc_get_volsw \| * `21d2994c74` arm64: dts: qcom: sc7180-trogdor: mark bluetooth address as broken \| * `a6186caf17` arm64: dts: qcom: sc7180: Remove clock for bluetooth on Trogdor \| * `ae5f35ff24` net: ravb: Always process TX descriptor ring \| * `3391b15778` udp: do not accept non-tunnel GSO skbs landing in a tunnel \| * `43183be84a` Revert "usb: phy: generic: Get the vbus supply" \| * `00810a2464` scsi: qla2xxx: Update manufacturer detail \| * `20414bdc32` scsi: qla2xxx: Update manufacturer details \| * `b8e82128b4` i40e: fix vf may be used uninitialized in this function warning \| * `a88765b0a5` i40e: fix i40e_count_filters() to count only active/new filters \| * `6ebcf688ae` octeontx2-pf: check negative error code in otx2_open() \| * `360edeb621` udp: do not transition UDP GRO fraglist partial checksums to unnecessary \| * `fd307f2d91` ipv6: Fix infinite recursion in fib6_dump_done(). \| * `ed2bdbf5d2` selftests: reuseaddr_conflict: add missing new line at the end of the output \| * `b14b9f9503` erspan: make sure erspan_base_hdr is present in skb->head \| * `42852763a0` net: stmmac: fix rx queue priority assignment \| * `5e45dc4408` net/sched: act_skbmod: prevent kernel-infoleak \| * `dd54b48db0` bpf, sockmap: Prevent lock inversion deadlock in map delete elem \| * `aedc6cfb71` vboxsf: Avoid an spurious warning if load_nls_xxx() fails \| * `0f038242b7` netfilter: validate user input for expected length \| * `940d41caa7` netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() \| * `46c4481938` netfilter: nf_tables: flush pending destroy work before exit_net release \| * `7b6fba6918` netfilter: nf_tables: reject new basechain after table flag update \| * `8f6dfa1f1e` block: add check that partition length needs to be aligned with block size \| * `e7ea043bc3` x86/srso: Add SRSO mitigation for Hygon processors \| * `af47e6a95e` mm, vmscan: prevent infinite loop for costly GFP_NOIO \| __GFP_RETRY_MAYFAIL allocations \| * `a15bcaa75d` Revert "x86/mm/ident_map: Use gbpages only where full GB page should be mapped." \| * `1eff09acc8` io_uring: ensure '0' is returned on file registration success \| * `a563fc1858` vfio/fsl-mc: Block calling interrupt handler without trigger \| * `09452c8fcb` vfio/platform: Create persistent IRQ handlers \| * `27d40bf72d` vfio/pci: Create persistent INTx handler \| * `d6f77b5e47` vfio: Introduce interface to flush virqfd inject workqueue \| * `3dd9be6cb5` vfio/pci: Lock external INTx masking ops \| * `561d5e1998` vfio/pci: Disable auto-enable of exclusive INTx IRQ \| * `cfb786b03b` net/rds: fix possible cp null dereference \| * `6f3ae02bbb` netfilter: nf_tables: disallow timeout for anonymous sets \| * `e470880754` Bluetooth: Fix TOCTOU in HCI debugfs implementation \| * `7160569281` Bluetooth: hci_event: set the conn encrypted before conn establishes \| * `89583ff143` x86/cpufeatures: Add new word for scattered features \| * `77a82b9611` r8169: fix issue caused by buggy BIOS on certain boards with RTL8168d \| * `e4be2df1b1` dm integrity: fix out-of-range warning \| * `c583066909` Octeontx2-af: fix pause frame configuration in GMP mode \| * `9970e059af` bpf: Protect against int overflow for stack access size \| * `e8ed357a6f` ACPICA: debugger: check status of acpi_evaluate_object() in acpi_db_walk_for_fields() \| * `e3e27d2b44` tcp: properly terminate timers for kernel sockets \| * `10b1273d8a` ixgbe: avoid sleeping allocation in ixgbe_ipsec_vf_add_sa() \| * `755e53bbc6` nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet \| * `e451709573` USB: core: Fix deadlock in usb_deauthorize_interface() \| * `bb22d3689e` scsi: lpfc: Correct size for wqe for memset() \| * `f49642661f` PCI/DPC: Quirk PIO log size for Intel Ice Lake Root Ports \| * `34a81f5259` x86/cpu: Enable STIBP on AMD if Automatic IBRS is enabled \| * `72ba168746` scsi: qla2xxx: Delay I/O Abort on PCI error \| * `67b2d35853` scsi: qla2xxx: Fix command flush on cable pull \| * `a56b2033f1` scsi: qla2xxx: Split FCE\|EFT trace control \| * `db0f08a6b6` usb: typec: ucsi: Clear UCSI_CCI_RESET_COMPLETE before reset \| * `e9042f4e71` usb: typec: ucsi: Ack unsupported commands \| * `3e944ddc17` usb: udc: remove warning when queue disabled ep \| * `fd84c4eb4d` usb: dwc2: gadget: LPM flow fix \| * `db4fa0c8e8` usb: dwc2: host: Fix ISOC flow in DDMA mode \| * `85ebae7707` usb: dwc2: host: Fix hibernation flow \| * `c63869e990` usb: dwc2: host: Fix remote wakeup from hibernation \| * `8e047bc5a5` USB: core: Add hub_get() and hub_put() routines \| * `6f4953255b` staging: vc04_services: fix information leak in create_component() \| * `3be3809b5d` staging: vc04_services: changen strncpy() to strscpy_pad() \| * `5c2386ba80` scsi: core: Fix unremoved procfs host directory regression \| * `aa39e6878f` ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs \| * `9b319f4a88` usb: cdc-wdm: close race between read and workqueue \| * `6d9395ba7f` net: ll_temac: platform_get_resource replaced by wrong function \| * `2b539c8894` mmc: core: Avoid negative index with array access \| * `bce3a98352` mmc: core: Initialize mmc_blk_ioc_data \| * `51c99c6795` hexagon: vmlinux.lds.S: handle attributes section \| * `73b3ea4673` exec: Fix NOMMU linux_binprm::exec in transfer_args_to_stack() \| * `e8b067c405` wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes \| * `f8f76b7574` init: open /initrd.image with O_LARGEFILE \| * `2e5fe74034` mm/migrate: set swap entry values of THP tail pages properly. \| * `38753f1ada` mm/memory-failure: fix an incorrect use of tail pages \| * `4e37416e4e` serial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO \| * `9c5f4014f6` powerpc: xor_vmx: Add '-mhard-float' to CFLAGS \| * `f33255ccbb` efivarfs: Request at most 512 bytes for variable names \| * `33414e560f` perf/core: Fix reentry problem in perf_output_read_group() \| * `91cf85f753` KVM/x86: Export RFDS_NO and RFDS_CLEAR to guests \| * `66d5260fc7` x86/rfds: Mitigate Register File Data Sampling (RFDS) \| * `5fbd9f6c39` Documentation/hw-vuln: Add documentation for RFDS \| * `6e04cae36b` x86/mmio: Disable KVM mitigation when X86_FEATURE_CLEAR_CPU_BUF is set \| * `b9a97767c6` KVM/VMX: Move VERW closer to VMentry for MDS mitigation \| * `52aad34ee3` KVM/VMX: Use BT+JNC, i.e. EFLAGS.CF to select VMRESUME vs. VMLAUNCH \| * `6192d9ed31` x86/bugs: Use ALTERNATIVE() instead of mds_user_clear static key \| * `50f021f0b9` x86/entry_32: Add VERW just before userspace transition \| * `edc702b4a8` x86/entry_64: Add VERW just before userspace transition \| * `35e36eac88` x86/bugs: Add asm helpers for executing VERW \| * `8b20c6f894` x86/asm: Add _ASM_RIP() macro for x86-64 (%rip) suffix \| * `b422358490` btrfs: allocate btrfs_ioctl_defrag_range_args on stack \| * `3377090b81` printk: Update @console_may_schedule in console_trylock_spinning() \| * `0fc88aeb2e` xen/events: close evtchn after mapping cleanup \| * `bc40ded92a` tee: optee: Fix kernel panic caused by incorrect error handling \| * `94eb029370` fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion \| * `1ce408f75c` vt: fix unicode buffer corruption when deleting characters \| * `28924c43ce` mei: me: add arrow lake point H DID \| * `4ba385d29e` mei: me: add arrow lake point S DID \| * `bb664ed988` tty: serial: fsl_lpuart: avoid idle preamble pending if CTS is enabled \| * `1d14247972` usb: port: Don't try to peer unused USB ports based on location \| * `ef846cdbd1` usb: gadget: ncm: Fix handling of zero block length packets \| * `284fb1003d` USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command \| * `24427b02bf` ALSA: hda/realtek - Fix headset Mic no show at resume back for Lenovo ALC897 platform \| * `2d13b79640` KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() \| * `6406c55fdc` xfrm: Avoid clang fortify warning in copy_to_user_tmpl() \| * `d2951b72ea` Drivers: hv: vmbus: Calculate ring buffer size for more efficient use of memory \| * `2863e2f062` netfilter: nf_tables: reject constant set with timeout \| * `fe40ffbca1` netfilter: nf_tables: disallow anonymous set with timeout flag \| * `e2d45f4670` netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout \| * `449b8bdcde` cpufreq: brcmstb-avs-cpufreq: fix up "add check for cpufreq_cpu_get's return value" \| * `ac816bbb10` comedi: comedi_test: Prevent timers rescheduling during deletion \| * `d430e29854` scripts: kernel-doc: Fix syntax error due to undeclared args variable \| * `d0838b0729` x86/pm: Work around false positive kmemleak report in msr_build_context() \| * `f594871732` x86/stackprotector/32: Make the canary into a regular percpu variable \| * `6d22547437` vxge: remove unnecessary cast in kfree() \| * `9759ff196e` dm snapshot: fix lockup in dm_exception_table_exit \| * `b074a76cbd` drm/amd/display: Fix noise issue on HDMI AV mute \| * `1a77ee0f06` drm/amd/display: Return the correct HDCP error code \| * `2f83291543` ahci: asm1064: asm1166: don't limit reported ports \| * `ce4c5d2787` ahci: asm1064: correct count of reported ports \| * `493aa6bdcf` wireguard: netlink: access device through ctx instead of peer \| * `f52be46e3e` wireguard: netlink: check for dangling peer via is_dead instead of empty list \| * `ec5098d4c8` net: hns3: tracing: fix hclgevf trace event strings \| * `bce7345ee0` x86/CPU/AMD: Update the Zenbleed microcode revisions \| * `224ec95f63` cpufreq: dt: always allocate zeroed cpumask \| * `f0fe7ad5af` nilfs2: prevent kernel bug at submit_bh_wbc() \| * `c3b5c5c31e` nilfs2: fix failure to detect DAT corruption in btree and direct mappings \| * `7607860ae4` memtest: use {READ,WRITE}_ONCE in memory scanning \| * `c734f9c198` drm/vc4: hdmi: do not return negative values from .get_modes() \| * `51c519d79f` drm/imx/ipuv3: do not return negative values from .get_modes() \| * `a8cb3b0724` drm/exynos: do not return negative values from .get_modes() \| * `9aaa60f35b` drm/panel: do not return negative error codes from drm_panel_get_modes() \| * `6470078ab3` s390/zcrypt: fix reference counting on zcrypt card objects \| * `32edca2f03` soc: fsl: qbman: Use raw spinlock for cgr_lock \| * `39ed969a7a` soc: fsl: qbman: Add CGR update function \| * `c542f3a705` soc: fsl: qbman: Add helper for sanity checking cgr ops \| * `dd199e5b75` soc: fsl: qbman: Always disable interrupts when taking cgr_lock \| * `47ad5c133e` ring-buffer: Fix full_waiters_pending in poll \| * `616a78bd68` ring-buffer: Fix resetting of shortest_full \| * `756934d840` ring-buffer: Do not set shortest_full when full target is hit \| * `3d4873cf80` ring-buffer: Fix waking up ring buffer readers \| * `ad68ce4936` vfio/platform: Disable virqfds on cleanup \| * `ef73db1cc8` PCI: dwc: endpoint: Fix advertised resizable BAR size \| * `70077e0af5` kbuild: Move -Wenum-{compare-conditional,enum-conversion} into W=1 \| * `4595d90b5d` nfs: fix UAF in direct writes \| * `7e55155db0` PCI/AER: Block runtime suspend when handling errors \| * `648906b645` PCI/ERR: Clear AER status only when we control AER \| * `bb317bba5b` speakup: Fix 8bit characters from direct synth \| * `92eac4c00d` usb: gadget: tegra-xudc: Fix USB3 PHY retrieval logic \| * `a799864b9e` usb: gadget: tegra-xudc: Use dev_err_probe() \| * `350aeb14aa` phy: tegra: xusb: Add API to retrieve the port number of phy \| * `0213b8bf71` slimbus: core: Remove usage of the deprecated ida_simple_xx() API \| * `b45970fc0a` nvmem: meson-efuse: fix function pointer type mismatch \| * `e8e8b19731` ext4: fix corruption during on-line resize \| * `89bc7ed740` hwmon: (amc6821) add of_match table \| * `37005a1b85` drm/etnaviv: Restore some id values \| * `a1d62c0651` mmc: core: Fix switch on gp3 partition \| * `d85c11c97e` mm: swap: fix race between free_swap_and_cache() and swapoff() \| * `068ab2759b` mac802154: fix llsec key resources release in mac802154_llsec_key_del \| * `1302344f8a` dm-raid: fix lockdep waring in "pers->hot_add_disk" \| * `b073267479` Revert "Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"" \| * `be7f399e3f` PCI/DPC: Quirk PIO log size for Intel Raptor Lake Root Ports \| * `a654d0a186` PCI/DPC: Quirk PIO log size for certain Intel Root Ports \| * `51411a4d0a` PCI/ASPM: Make Intel DG2 L1 acceptable latency unlimited \| * `81d9ca1597` PCI: Work around Intel I210 ROM BAR overlap defect \| * `619013d797` PCI: Cache PCIe Device Capabilities register \| * `1f5ea9e3ae` PCI/ERR: Cache RCEC EA Capability offset in pci_init_capabilities() \| * `bbe068b244` PCI/PM: Drain runtime-idle callbacks before driver removal \| * `39f7310eaa` PCI: Drop pci_device_remove() test of pci_dev->driver \| * `d2a9709728` btrfs: fix off-by-one chunk length calculation at contains_pending_extent() \| * `d7800338a2` serial: Lock console when calling into driver before registration \| * `590326a5d4` printk/console: Split out code that enables default console \| * `a0e8272533` usb: typec: ucsi: Clean up UCSI_CABLE_PROP macros \| * `c71ac0596e` fuse: don't unhash root \| * `853f0c0d34` fuse: fix root lookup with nonzero generation \| * `ab166a9445` mmc: tmio: avoid concurrent runs of mmc_request_done() \| * `40dda05486` PM: sleep: wakeirq: fix wake irq warning in system suspend \| * `ad5b7fc6a7` USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M \| * `fec4dea54d` USB: serial: option: add MeiG Smart SLM320 product \| * `76b4979096` USB: serial: cp210x: add ID for MGP Instruments PDS100 \| * `cc235a4b8a` USB: serial: add device ID for VeriFone adapter \| * `dccd649747` USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB \| * `a51a65d33e` powerpc/fsl: Fix mfpmr build errors with newer binutils \| * `3ff4a0f6a8` clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays \| * `a09aecb6cb` clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays \| * `851cc19bdb` clk: qcom: gcc-ipq8074: fix terminating of frequency table arrays \| * `ae60e33422` clk: qcom: gcc-ipq6018: fix terminating of frequency table arrays \| * `0aa06ebe69` PM: suspend: Set mem_sleep_current during kernel command line setup \| * `47cad45f8b` parisc: Strip upper 32 bit of sum in csum_ipv6_magic for 64-bit builds \| * `d4a20501dd` parisc: Fix csum_ipv6_magic on 64-bit systems \| * `2a318f10d4` parisc: Fix csum_ipv6_magic on 32-bit systems \| * `27b0db8def` parisc: Fix ip_fast_csum \| * `8b8019f9d7` parisc: Avoid clobbering the C/B bits in the PSW with tophys and tovirt macros \| * `c2f8af101c` mtd: rawnand: meson: fix scrambling mode value in command macro \| * `7a9337af5b` ubi: correct the calculation of fastmap size \| * `0a16a633a2` ubi: Check for too small LEB size in VTBL code \| * `8f599ab6fa` ubifs: Set page uptodate in the correct place \| * `a276c595c3` fat: fix uninitialized field in nostale filehandles \| * `83a2275f9d` bounds: support non-power-of-two CONFIG_NR_CPUS \| * `96661f8c3d` block: Clear zone limits for a non-zoned stacked queue \| * `6b4bb49e34` block: introduce zone_write_granularity limit \| * `0eb348f4d7` ext4: correct best extent lstart adjustment logic \| * `8f5dfcbf96` selftests/mqueue: Set timeout to 180 seconds \| * `d03092550f` crypto: qat - resolve race condition during AER recovery \| * `02fa834fb4` crypto: qat - fix double free during reset \| * `6796844c05` sparc: vDSO: fix return value of __setup handler \| * `308b721d69` sparc64: NMI watchdog: fix return value of __setup handler \| * `f8730d6335` KVM: Always flush async #PF workqueue when vCPU is being destroyed \| * `7936e5c8da` media: xc4000: Fix atomicity violation in xc4000_get_frequency \| * `c45e53c27b` serial: max310x: fix NULL pointer dereference in I2C instantiation \| * `c560327d90` drm/vmwgfx: Fix possible null pointer derefence with invalid contexts \| * `675ebda69c` drm/vmwgfx: Fix some static checker warnings \| * `dc7cd107ce` drm/vmwgfx/vmwgfx_cmdbuf_res: Remove unused variable 'ret' \| * `b6fc792bf8` drm/vmwgfx: switch over to the new pin interface v2 \| * `1502b87c65` drm/vmwgfx: stop using ttm_bo_create v2 \| * `7f0de642ac` arm: dts: marvell: Fix maxium->maxim typo in brownstone dts \| * `fbda83d03f` smack: Handle SMACK64TRANSMUTE in smack_inode_setsecurity() \| * `a354d9e3b6` smack: Set SMACK64TRANSMUTE only for dirs in smack_inode_setxattr() \| * `1c18c1541f` clk: qcom: gcc-sdm845: Add soft dependency on rpmhpd \| * `b3afaa407d` media: staging: ipu3-imgu: Set fields before media_entity_pads_init() \| * `bacb8c3ab8` wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach \| * `d8166e8adb` timers: Rename del_timer_sync() to timer_delete_sync() \| * `fa576cdd4d` timers: Use del_timer_sync() even on UP \| * `127dbb3d8b` timers: Update kernel-doc for various functions \| * `6487fb01b7` x86/bugs: Use sysfs_emit() \| * `d3084b0309` x86/cpu: Support AMD Automatic IBRS \| * `2c1a504931` Documentation/hw-vuln: Update spectre doc \| * `fcbd99b3c7` amdkfd: use calloc instead of kzalloc to avoid integer overflow * `e9b3e47f65` Merge branch 'android12-5.10' into branch 'android12-5.10-lts' Change-Id: If920bf57647a5b27994daf5704a4cb27f1d651bb Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-07-20 13:37:42 +00:00
Greg Kroah-Hartman	b07354bd32	Merge tag 'android12-5.10.214_r00' into android12-5.10 This catches the android12-5.10 branch up to the 5.10.214 LTS release. Included in here are the following commits: * `ca0eb54113` ANDROID: cpufreq: brcmstb-avs-cpufreq: fix build error * `8215d23ef6` Revert "remoteproc: Add new get_loaded_rsc_table() to rproc_ops" * `453106487d` Revert "remoteproc: stm32: Move resource table setup to rproc_ops" * `14fe873d43` Revert "remoteproc: stm32: Fix incorrect type assignment returned by stm32_rproc_get_loaded_rsc_tablef" * `7cb2a3c384` Revert "remoteproc: stm32: fix phys_addr_t format string" * `a626900b07` Revert "remoteproc: stm32: use correct format strings on 64-bit" * `b05356dd8a` Revert "remoteproc: stm32: Fix incorrect type in assignment for va" * `f21d21f05e` Revert "block: add a new set_read_only method" * `560f181cad` Revert "md: implement ->set_read_only to hook into BLKROSET processing" * `2c7d369ecc` Revert "md: Don't clear MD_CLOSING when the raid is about to stop" * `e2ddf25269` Revert "bpf: Defer the free of inner map when necessary" * `38a24db1c2` Revert "net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()" * `dd27b89022` Merge 5.10.214 into android12-5.10-lts \|\ \| * `dfa3825910` Linux 5.10.214 \| * `5148026b65` remoteproc: stm32: fix phys_addr_t format string \| * `a943eb8283` regmap: Add missing map->bus check \| * `bcfcdf1969` spi: spi-mt65xx: Fix NULL pointer access in interrupt handler \| * `6c46d680e4` bpf: report RCU QS in cpumap kthread \| * `aad6bb260b` rcu: add a helper to report consolidated flavor QS \| * `fcf32a5bfc` netfilter: nf_tables: do not compare internal table flags on updates \| * `096245bb7f` ARM: dts: sun8i-h2-plus-bananapi-m2-zero: add regulator nodes vcc-dram and vcc1v2 \| * `f205ed8d9e` scsi: fc: Update formal FPIN descriptor definitions \| * `b36b83297f` netfilter: nft_set_pipapo: release elements in clone only from destroy path \| * `766c2627ac` octeontx2-af: Use separate handlers for interrupts \| * `8eebff95ce` net/bnx2x: Prevent access to a freed page in page_pool \| * `f6c6ca618e` hsr: Handle failures in module init \| * `1e1e4316fc` rds: introduce acquire/release ordering in acquire/release_in_xmit() \| * `f87884e0df` wireguard: receive: annotate data-race around receiving_counter.counter \| * `d0ab075e34` net: dsa: mt7530: prevent possible incorrect XTAL frequency selection \| * `68e8412031` packet: annotate data-races around ignore_outgoing \| * `7fb2d4d6bb` hsr: Fix uninit-value access in hsr_get_node() \| * `cdff6144b0` soc: fsl: dpio: fix kcalloc() argument order \| * `76d1394d9b` s390/vtime: fix average steal time calculation \| * `ce061bf4ef` octeontx2-af: Use matching wake_up API variant in CGX command interface \| * `2ddc931ccc` io_uring: don't save/restore iowait state \| * `ed71e73693` usb: gadget: net2272: Use irqflags in the call to net2272_probe_fin \| * `745c27184b` staging: greybus: fix get_channel_from_mode() failure path \| * `a4d503856a` serial: 8250_exar: Don't remove GPIO device on suspend \| * `864f17c134` rtc: mt6397: select IRQ_DOMAIN instead of depending on it \| * `87ddba29e7` kconfig: fix infinite loop when expanding a macro at the end of file \| * `1639e9c7a3` tty: serial: samsung: fix tx_empty() to return TIOCSER_TEMT \| * `1eb9ab1f9f` serial: max310x: fix syntax error in IRQ error message \| * `6199e1942e` tty: vt: fix 20 vs 0x20 typo in EScsiignore \| * `40260d0649` remoteproc: stm32: Fix incorrect type assignment returned by stm32_rproc_get_loaded_rsc_tablef \| * `0dd5b63ae2` remoteproc: stm32: Fix incorrect type in assignment for va \| * `f0b0a4de78` remoteproc: stm32: use correct format strings on 64-bit \| * `9d057eacf8` remoteproc: stm32: Move resource table setup to rproc_ops \| * `7b95472049` remoteproc: Add new get_loaded_rsc_table() to rproc_ops \| * `1d7e9bc40a` remoteproc: stm32: Constify st_rproc_ops \| * `b94f434fe9` afs: Revert "afs: Hide silly-rename files from userspace" \| * `b8c52f7d08` NFS: Fix an off by one in root_nfs_cat() \| * `32903ecf21` watchdog: stm32_iwdg: initialize default timeout \| * `916ee6deae` NFSv4.2: fix listxattr maximum XDR buffer size \| * `4403438eac` NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 \| * `84ec5c0a7f` net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr() \| * `a2b74f35ee` scsi: bfa: Fix function pointer type mismatch for hcb_qe->cbfn \| * `11adfabee1` RDMA/device: Fix a race between mad_client and cm_client init \| * `3ac85382bc` scsi: csiostor: Avoid function pointer casts \| * `6370d070e2` f2fs: compress: fix to check unreleased compressed cluster \| * `bdd895e019` RDMA/srpt: Do not register event handler until srpt device is fully setup \| * `5cd466673b` ALSA: usb-audio: Stop parsing channels bits when all channels are found. \| * `4266f6e726` ALSA: hda/realtek: fix ALC285 issues on HP Envy x360 laptops \| * `239174535d` clk: Fix clk_core_get NULL dereference \| * `e55a601463` sparc32: Fix section mismatch in leon_pci_grpci \| * `6ec49d0790` backlight: lp8788: Fully initialize backlight_properties during probe \| * `ad70a7888e` backlight: lm3639: Fully initialize backlight_properties during probe \| * `f3bd1e36f0` backlight: da9052: Fully initialize backlight_properties during probe \| * `f58ce2bed9` backlight: lm3630a: Don't set bl->props.brightness in get_brightness \| * `fc43d668c9` backlight: lm3630a: Initialize backlight_properties on init \| * `97b397aa3f` leds: sgm3140: Add missing timer cleanup and flash gpio control \| * `b9040d5746` leds: aw2013: Unlock mutex before destroying it \| * `72f9bf6ddb` powerpc/embedded6xx: Fix no previous prototype for avr_uart_send() etc. \| * `cfb3a57e7b` drm/msm/dpu: add division of drm_display_mode's hskew parameter \| * `fd639cb8fa` powerpc/hv-gpci: Fix the H_GET_PERF_COUNTER_INFO hcall return value checks \| * `4688be96d2` drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip \| * `6c5a15622e` media: mediatek: vcodec: avoid -Wcast-function-type-strict warning \| * `910363473e` media: ttpci: fix two memleaks in budget_av_attach \| * `b49fe84c6c` media: go7007: fix a memleak in go7007_load_encoder \| * `fb07104a02` media: dvb-frontends: avoid stack overflow warnings with clang \| * `ab896d93fd` media: pvrusb2: fix uaf in pvr2_context_set_notify \| * `1c5620f99a` drm/amdgpu: Fix missing break in ATOM_ARG_IMM Case of atom_get_src_int() \| * `24d71c7e46` ASoC: meson: axg-tdm-interface: add frame rate constraint \| * `4bc8e7f3a1` ASoC: meson: axg-tdm-interface: fix mclk setup without mclk-fs \| * `fe9796edda` mtd: rawnand: lpc32xx_mlc: fix irq handler prototype \| * `2c8a6d2bef` mtd: maps: physmap-core: fix flash size larger than 32-bit \| * `858839c64b` drm/tidss: Fix initial plane zpos values \| * `9e42bebd4b` crypto: arm/sha - fix function cast warnings \| * `9883ac6894` mfd: altera-sysmgr: Call of_node_put() only when of_parse_phandle() takes a ref \| * `df6924449f` mfd: syscon: Call of_node_put() only when of_parse_phandle() takes a ref \| * `bd5f2747e3` drm/tegra: put drm_gem_object ref on error in tegra_fb_create \| * `2d476959f2` clk: hisilicon: hi3519: Release the correct number of gates in hi3519_clk_unregister() \| * `7057b8fa76` PCI: Mark 3ware-9650SE Root Port Extended Tags as broken \| * `792e642859` drm/mediatek: dsi: Fix DSI RGB666 formats and definitions \| * `85e2d91660` clk: qcom: dispcc-sdm845: Adjust internal GDSC wait times \| * `0680a58e2d` media: pvrusb2: fix pvr2_stream_callback casts \| * `964f45a784` media: pvrusb2: remove redundant NULL check \| * `1f8d45cd0e` media: go7007: add check of return value of go7007_read_addr() \| * `5d9fe604bf` media: imx: csc/scaler: fix v4l2_ctrl_handler memory leak \| * `c753ca1e5a` media: sun8i-di: Fix chroma difference threshold \| * `6b5791c540` media: sun8i-di: Fix power on/off sequences \| * `d2f806664c` media: sun8i-di: Fix coefficient writes \| * `47588154b1` ASoC: meson: t9015: fix function pointer type mismatch \| * `3df9cd610b` ASoC: meson: aiu: fix function pointer type mismatch \| * `ac85b84241` ASoC: meson: Use dev_err_probe() helper \| * `bae8577ea7` perf stat: Avoid metric-only segv \| * `eca94a4b07` ALSA: seq: fix function cast warnings \| * `33a44d8759` drm/radeon/ni: Fix wrong firmware size logging in ni_init_microcode() \| * `89526d7728` perf thread_map: Free strlist on normal path in thread_map__new_by_tid_str() \| * `8a01335aed` crypto: xilinx - call finalize with bh disabled \| * `38e61b7511` PCI: switchtec: Fix an error handling path in switchtec_pci_probe() \| * `ca1cd5605a` quota: Fix rcu annotations of inode dquot pointers \| * `61380537aa` quota: Fix potential NULL pointer dereference \| * `00684e9328` quota: simplify drop_dquot_ref() \| * `2e005642a6` clk: qcom: reset: Ensure write completion on reset de/assertion \| * `b30800467c` clk: qcom: reset: Commonize the de/assert functions \| * `160095aada` pinctrl: mediatek: Drop bogus slew rate register range for MT8192 \| * `096237039d` media: edia: dvbdev: fix a use-after-free \| * `afd2a82fe3` media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity \| * `94303a06e1` media: v4l2-tpg: fix some memleaks in tpg_alloc \| * `19cb33fa22` media: em28xx: annotate unchecked call to media_device_register() \| * `892d955f8e` perf evsel: Fix duplicate initialization of data->id in evsel__parse_sample() \| * `330caa061a` drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()' \| * `ff28893c96` drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()' \| * `53dea95c23` HID: lenovo: Add middleclick_workaround sysfs knob for cptkbd \| * `7007354d0c` perf record: Fix possible incorrect free in record__switch_output() \| * `ed2be47b8d` PCI/DPC: Print all TLP Prefixes, not just the first \| * `610f20e5cf` media: tc358743: register v4l2 async device only after successful setup \| * `2c58c4dda2` dmaengine: tegra210-adma: Update dependency to ARCH_TEGRA \| * `f2e80ac934` drm/lima: fix a memleak in lima_heap_alloc \| * `e0d4850ecd` drm/rockchip: lvds: do not print scary message when probing defer \| * `375a60fce4` drm/rockchip: lvds: do not overwrite error code \| * `2cb881069e` drm: Don't treat 0 as -1 in drm_fixp2int_ceil \| * `fbb37b3977` drm/rockchip: inno_hdmi: Fix video timing \| * `b7a82cfb85` drm/tegra: output: Fix missing i2c_put_adapter() in the error handling paths of tegra_output_probe() \| * `f95401a509` drm/tegra: dsi: Fix missing pm_runtime_disable() in the error handling path of tegra_dsi_probe() \| * `317155c5fa` drm/tegra: dsi: Fix some error handling paths in tegra_dsi_probe() \| * `0e8c9283e5` drm/tegra: dsi: Make use of the helper function dev_err_probe() \| * `92003981a6` drm/tegra: dsi: Add missing check for of_find_device_by_node \| * `f89bd27709` dm: call the resume method on internal suspend \| * `94a6a9cfbf` dm raid: fix false positive for requeue needed during reshape \| * `928705e341` nfp: flower: handle acti_netdevs allocation failure \| * `e9b72f729d` net/x25: fix incorrect parameter validation in the x25_getsockopt() function \| * `3627f21b9e` net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function \| * `03c74f548f` udp: fix incorrect parameter validation in the udp_lib_getsockopt() function \| * `b42e564358` l2tp: fix incorrect parameter validation in the pppol2tp_getsockopt() function \| * `5a98fa3332` ipmr: fix incorrect parameter validation in the ip_mroute_getsockopt() function \| * `8693e3cf0c` bpf: net: Change do_ip_getsockopt() to take the sockptr_t argument \| * `415edd2d66` net/ipv4/ipv6: Replace one-element arraya with flexible-array members \| * `7394669d59` net/ipv4: Revert use of struct_size() helper \| * `1ebd0d898f` net/ipv4: Replace one-element array with flexible-array member \| * `c805987631` tcp: fix incorrect parameter validation in the do_tcp_getsockopt() function \| * `1f6244e995` OPP: debugfs: Fix warning around icc_get_name() \| * `6cf2e53315` net: phy: dp83822: Fix RGMII TX delay configuration \| * `c44a5aa4be` net: phy: DP83822: enable rgmii mode if phy_interface_is_rgmii \| * `a352d039ff` net: hns3: fix port duplex configure error in IMP reset \| * `06dd21045a` net: phy: fix phy_get_internal_delay accessing an empty array \| * `77fd5294ea` net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv() \| * `edcec23634` ipv6: fib6_rules: flush route cache when rule is changed \| * `15641007df` bpf: Fix stackmap overflow check on 32-bit arches \| * `64f00b4df0` bpf: Fix hashtab overflow check on 32-bit arches \| * `225da02acd` bpf: Fix DEVMAP_HASH overflow check on 32-bit arches \| * `70294d8bc3` bpf: Eliminate rlimit-based memory accounting for devmap maps \| * `6b4a39acaf` sr9800: Add check for usbnet_get_endpoints \| * `d47e6c1932` Bluetooth: hci_core: Fix possible buffer overflow \| * `69d9425b88` Bluetooth: Remove superfluous call to hci_conn_check_pending() \| * `cbe742db8b` igb: Fix missing time sync events \| * `02cba67662` igb: move PEROUT and EXTTS isr logic to separate functions \| * `f873b85ec7` iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected \| * `f858c084eb` PCI: Make pci_dev_is_disconnected() helper public for other drivers \| * `722c24cddc` wifi: rtw88: 8821c: Fix false alarm count \| * `c55cc63638` mmc: wmt-sdmmc: remove an incorrect release_mem_region() call in the .remove function \| * `bb336cd8d5` SUNRPC: fix some memleaks in gssx_dec_option_array \| * `a4e7ff1a74` x86, relocs: Ignore relocations in .notes section \| * `47a429a524` ACPI: scan: Fix device check notification handling \| * `5f99b46dce` arm64: dts: marvell: reorder crypto interrupts on Armada SoCs \| * `46792f9ba3` ARM: dts: imx6dl-yapp4: Move the internal switch PHYs under the switch node \| * `2d1e515789` ARM: dts: imx6dl-yapp4: Fix typo in the QCA switch register address \| * `23d0549448` ARM: dts: imx6dl-yapp4: Move phy reset into switch node \| * `229563e216` ARM: dts: arm: realview: Fix development chip ROM compatible value \| * `2478026f94` net: ena: Remove ena_select_queue \| * `98d186a142` wifi: brcmsmac: avoid function pointer casts \| * `fb7601ebf6` iommu/amd: Mark interrupt as managed \| * `be8c53390a` bus: tegra-aconnect: Update dependency to ARCH_TEGRA \| * `c2a30c81bf` ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() \| * `5956f4203b` wifi: wilc1000: prevent use-after-free on vif when cleaning up all interfaces \| * `115252fc61` wireless: Remove redundant 'flush_workqueue()' calls \| * `23278c845a` bpf: Mark bpf_spin_{lock,unlock}() helpers with notrace correctly \| * `c5f2076aaa` bpf: Factor out bpf_spin_lock into helpers. \| * `dfd8a62a10` arm64: dts: mediatek: mt7622: add missing "device_type" to memory nodes \| * `f0dd27314c` wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer() \| * `7d4b47f20f` net: blackhole_dev: fix build warning for ethh set but not used \| * `918d7f0d3e` wifi: iwlwifi: fix EWRD table validity check \| * `fabe2db7de` wifi: iwlwifi: dbg-tlv: ensure NUL termination \| * `1bc5461a21` wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete \| * `bdaf08b472` af_unix: Annotate data-race of gc_in_progress in wait_for_unix_gc(). \| * `1524f46376` bpftool: Silence build warning about calloc() \| * `926d95eb39` inet_diag: annotate data-races around inet_diag_table[] \| * `784412247e` sock_diag: annotate data-races around sock_diag_handlers[family] \| * `9127599c07` cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value \| * `11824d6a8a` wifi: mwifiex: debugfs: Drop unnecessary error check for debugfs_create_dir() \| * `5aa586bf80` wifi: wilc1000: fix multi-vif management when deleting a vif \| * `dddedfa3b2` wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work \| * `b4bbf38c35` wifi: wilc1000: fix RCU usage in connect path \| * `fd86efb897` wifi: wilc1000: fix declarations ordering \| * `caa839d40e` wifi: b43: Disable QoS for bcm4331 \| * `39c915a323` wifi: b43: Stop correct queue in DMA worker when QoS is disabled \| * `871788995c` wifi: b43: Stop/wake correct queue in PIO Tx path when QoS is disabled \| * `49f067726a` wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled \| * `e1dc7aa814` wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() \| * `c6fd906c3c` timekeeping: Fix cross-timestamp interpolation for non-x86 \| * `763a009228` timekeeping: Fix cross-timestamp interpolation corner case decision \| * `fe90806209` timekeeping: Fix cross-timestamp interpolation on counter wrap \| * `faf0b4c5e0` aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts \| * `bb567cb5cd` md: Don't clear MD_CLOSING when the raid is about to stop \| * `ab25f7cd49` md: implement ->set_read_only to hook into BLKROSET processing \| * `2a0f8202f7` block: add a new set_read_only method \| * `a0bccba5f5` fs/select: rework stack allocation hack for clang \| * `4af837db0f` nbd: null check for nla_nest_start \| * `cde76b3af2` do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak \| * `cc6ddd6fa9` x86/paravirt: Fix build due to __text_gen_insn() backport \| * `0344b12a97` ASoC: wm8962: Fix up incorrect error message in wm8962_set_fll \| * `cd72f7de5b` ASoC: wm8962: Enable both SPKOUTR_ENA and SPKOUTL_ENA in mono mode \| * `423d747fa3` ASoC: wm8962: Enable oscillator if selecting WM8962_FLL_OSC \| * `442864752b` Input: gpio_keys_polled - suppress deferred probe error for gpio \| * `020601445f` ASoC: Intel: bytcr_rt5640: Add an extra entry for the Chuwi Vi8 tablet \| * `713eaf5c51` firewire: core: use long bus reset on gap count error \| * `81d7d920a2` Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security \| * `ba3a55d118` scsi: mpt3sas: Prevent sending diag_reset when the controller is ready \| * `e30b8525e1` dm-verity, dm-crypt: align "struct bvec_iter" correctly \| * `87221877ed` block: sed-opal: handle empty atoms when parsing response \| * `d2e2cb5258` parisc/ftrace: add missing CONFIG_DYNAMIC_FTRACE check \| * `3e0f73be40` net/iucv: fix the allocation size of iucv_path_table array \| * `6e4694e65b` x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() \| * `aa64355c45` x86/mm: Move is_vsyscall_vaddr() into asm/vsyscall.h \| * `434a709df1` RDMA/mlx5: Relax DEVX access upon modify commands \| * `d27c48dc30` RDMA/mlx5: Fix fortify source warning while accessing Eth segment \| * `0f9fa4e6b2` gen_compile_commands: fix invalid escape sequence warning \| * `a8fee6674b` HID: multitouch: Add required quirk for Synaptics 0xcddc device \| * `df14e946ea` MIPS: Clear Cause.BD in instruction_pointer_set \| * `eb279074ba` x86/xen: Add some null pointer checking to smp.c \| * `eddf7e95b8` ASoC: rt5645: Make LattePanda board DMI match more precise \| * `8e2113f61d` selftests: tls: use exact comparison in recv_partial \| * `90c445799f` bpf: Defer the free of inner map when necessary \| * `93c37f1c63` rcu-tasks: Provide rcu_trace_implies_rcu_gp() \| * `a6771f343a` io_uring: drop any code related to SCM_RIGHTS \| * `875f5fed30` io_uring/unix: drop usage of io_uring socket * \| `4a3d04deae` Revert "regmap: allow to define reg_update_bits for no bus configuration" * \| `d499d2888d` Revert "regmap: Add bulk read/write callbacks into regmap_config" * \| `2f6cd4ffaf` Revert "serial: max310x: make accessing revision id interface-agnostic" * \| `505653748e` Revert "serial: max310x: implement I2C support" * \| `d845bebb84` Revert "serial: max310x: fix IO data corruption in batched operations" * \| `bbcfe35f4e` Revert "geneve: make sure to pull inner header in geneve_rx()" * \| `578a3af78b` Merge 5.10.213 into android12-5.10-lts \|\\| \| * `d35f38551c` Linux 5.10.213 \| * `738845b022` serial: max310x: fix IO data corruption in batched operations \| * `85d7947871` serial: max310x: implement I2C support \| * `8082cc992d` serial: max310x: make accessing revision id interface-agnostic \| * `f36ef837a7` regmap: Add bulk read/write callbacks into regmap_config \| * `915848be2f` regmap: allow to define reg_update_bits for no bus configuration \| * `82a62478b9` Drivers: hv: vmbus: Drop error message when 'No request id available' \| * `74d83d0fe0` serial: max310x: Unprepare and disable clock in error path \| * `f610023e67` getrusage: use sig->stats_lock rather than lock_task_sighand() \| * `9ca9786820` getrusage: use __for_each_thread() \| * `21677f35e1` getrusage: move thread_group_cputime_adjusted() outside of lock_task_sighand() \| * `811415fe76` getrusage: add the "signal_struct sig" local variable \| `14136bed41` mm: hugetlb pages should not be reserved by shmat() if SHM_NORESERVE \| * `05edf43452` mm/hugetlb: change hugetlb_reserve_pages() to type bool \| * `5b10a88f64` hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed \| * `8f41b33d24` hv_netvsc: use netif_is_bond_master() instead of open code \| * `0d54d2240d` hv_netvsc: Make netvsc/VF binding check both MAC and serial number \| * `3cfee5668b` hv_netvsc: Process NETDEV_GOING_DOWN on VF hot remove \| * `0db98ee09b` hv_netvsc: Wait for completion on request SWITCH_DATA_PATH \| * `cdba035680` hv_netvsc: Use vmbus_requestor to generate transaction IDs for VMBus hardening \| * `2ce3663500` Drivers: hv: vmbus: Add vmbus_requestor data structure for VMBus hardening \| * `58bf67d524` ext4: convert to exclusive lock while inserting delalloc extents \| * `5b69dabd7e` ext4: refactor ext4_da_map_blocks() \| * `b3bca5e8c7` ext4: make ext4_es_insert_extent() return void \| * `c09ffff246` lsm: fix default return value of the socket_getpeersec_() hooks \| `ea6e87db90` lsm: make security_socket_getpeersec_stream() sockptr_t safe \| * `a9482f3b48` bpf: net: Change sk_getsockopt() to take the sockptr_t argument \| * `be155e9466` net: Change sock_getsockopt() to take the sk ptr instead of the sock ptr \| * `518ec3da99` serial: max310x: prevent infinite while() loop in port startup \| * `fe0d16b3a3` serial: max310x: use a separate regmap for each port \| * `c1ecaadbcd` serial: max310x: use regmap methods for SPI batch operations \| * `32e32ab1da` serial: max310x: Make use of device properties \| * `c7e9e6d5ee` serial: max310x: fail probe if clock crystal is unstable \| * `c2b9cbf09e` serial: max310x: Try to get crystal clock rate from property \| * `569154b29a` serial: max310x: Use devm_clk_get_optional() to get the input clock \| * `696e4112e5` xhci: handle isoc Babble and Buffer Overrun events properly \| * `fe2322caa0` xhci: process isoc TD properly when there was a transaction error mid TD. \| * `fa5aaf31e5` xhci: prevent double-fetch of transfer and transfer event TRBs \| * `89ed7ebae4` xhci: remove extra loop in interrupt context \| * `9c398afd49` um: allow not setting extra rpaths in the linux binary \| * `c9c3cc6a13` selftests: mm: fix map_hugetlb failure on 64K page size systems \| * `1dee72c021` selftests/mm: switch to bash from sh \| * `bbf950a6e9` netrom: Fix data-races around sysctl_net_busy_read \| * `cfe0f73fb3` netrom: Fix a data-race around sysctl_netrom_link_fails_count \| * `b7d33e083f` netrom: Fix a data-race around sysctl_netrom_routing_control \| * `01d4e3afe2` netrom: Fix a data-race around sysctl_netrom_transport_no_activity_timeout \| * `652b0b3581` netrom: Fix a data-race around sysctl_netrom_transport_requested_window_size \| * `f3315a6eda` netrom: Fix a data-race around sysctl_netrom_transport_busy_delay \| * `34c84e0036` netrom: Fix a data-race around sysctl_netrom_transport_acknowledge_delay \| * `34a164d244` netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries \| * `291d36d772` netrom: Fix a data-race around sysctl_netrom_transport_timeout \| * `d1261bde59` netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser \| * `18c95d11c3` netrom: Fix a data-race around sysctl_netrom_obsolescence_count_initialiser \| * `e041df5dc9` netrom: Fix a data-race around sysctl_netrom_default_path_quality \| * `ccd1108b16` netfilter: nf_conntrack_h323: Add protection for bmp length out of range \| * `2b4e7cb7d5` netfilter: nft_ct: fix l3num expectations with inet pseudo family \| * `9dfc15a10d` net/rds: fix WARNING in rds_conn_connect_if_down \| * `5f4e51abfb` cpumap: Zero-initialise xdp_rxq_info struct before running XDP program \| * `79ce2e54cc` net/ipv6: avoid possible UAF in ip6_route_mpath_notify() \| * `37fe99016b` net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() \| * `c713790069` geneve: make sure to pull inner header in geneve_rx() \| * `fdb63c179f` tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string \| * `71e21eb1f8` i40e: disable NAPI right after disabling irqs when handling xsk_pool \| * `ad91d5d1b6` ixgbe: {dis, en}able irqs in ixgbe_txrx_ring_{dis, en}able \| * `336261af04` net: lan78xx: fix runtime PM count underflow on link stop \| * `11a3c9f489` lan78xx: Fix race conditions in suspend/resume handling \| * `69215f8eda` lan78xx: Fix partial packet errors on suspend/resume \| * `e5d7f43c4c` lan78xx: Add missing return code checks \| * `061336268e` lan78xx: Fix white space and style issues \| * `0224cbc53b` mmc: mmci: stm32: fix DMA API overlapping mappings warning \| * `abda366ece` mmc: mmci: stm32: use a buffer for unaligned DMA requests * \| `52795b4903` Merge 5.10.212 into android12-5.10-lts \|\\| \| * `7cfcd0ed92` Linux 5.10.212 \| * `f74362a004` mptcp: fix double-free on socket dismantle \| * `30d84d87c3` mtd: spinand: gigadevice: fix Quad IO for GD5F1GQ5UExxG \| * `1805131d8f` gpio: fix resource unwinding order in error path \| * `51f7044d10` gpiolib: Fix the error path order in gpiochip_add_data_with_key() \| * `947baae185` gpio: 74x164: Enable output pins after registers are reset \| * `80d8522999` fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super \| * `43eccc5823` cachefiles: fix memory leak in cachefiles_add_cache() \| * `2871728127` ext4: avoid bb_free and bb_fragments inconsistency in mb_free_blocks() \| * `70e5b01353` mptcp: fix possible deadlock in subflow diag \| * `36103f8cb9` x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers \| * `7a7cb5266b` pmdomain: qcom: rpmhpd: Fix enabled_corner aggregation \| * `36b02df0a6` mmc: sdhci-xenon: fix PHY init clock stability \| * `d3c703c22b` mmc: sdhci-xenon: add timeout for PHY init complete \| * `3fd14520dd` mmc: core: Fix eMMC initialization with 1-bit bus connection \| * `9579a21e99` dmaengine: fsl-qdma: init irq after reg initialization \| * `bb3a06e9b9` dmaengine: fsl-qdma: fix SoC may hang on 16 byte unaligned read \| * `2886fe308a` btrfs: dev-replace: properly validate device names \| * `99eb215968` wifi: nl80211: reject iftype change with mesh ID change \| * `e668b92a3a` gtp: fix use-after-free and null-ptr-deref in gtp_newlink() \| * `a23ac1788e` tomoyo: fix UAF write bug in tomoyo_write_control() \| * `8af1c121b0` riscv: Sparse-Memory/vmemmap out-of-bounds fix \| * `96370ba395` afs: Fix endless loop in directory parsing \| * `14aacfcd73` ALSA: Drop leftover snd-rtctimer stuff from Makefile \| * `d7acc4a569` power: supply: bq27xxx-i2c: Do not free non existing IRQ \| * `537e3f49db` efi/capsule-loader: fix incorrect allocation size \| * `882a51a10e` rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back \| * `80fabcd5d1` netfilter: nf_tables: allow NFPROTO_INET in nft_(match/target)_validate() \| * `e24acaefdd` Bluetooth: Enforce validation on max value of connection interval \| * `df193568d6` Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST \| * `0309b68aea` Bluetooth: hci_event: Fix wrongly recorded wakeup BD_ADDR \| * `6dd0a9dfa9` Bluetooth: Avoid potential use-after-free in hci_error_reset \| * `6782a54e1a` net: usb: dm9601: fix wrong return value in dm9601_mdio_read \| * `c1c7396b57` lan78xx: enable auto speed configuration for LAN7850 if no EEPROM is detected \| * `810fa7d5e5` ipv6: fix potential "struct net" leak in inet6_rtm_getaddr() \| * `906986fed8` tun: Fix xdp_rxq_info's queue_index when detaching \| * `2e95350fe9` net: ip_tunnel: prevent perpetual headroom growth \| * `f19d1f98e6` netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter \| * `acd9f6d481` mtd: spinand: gigadevice: Fix the get ecc status issue \| * `8e3a867593` mtd: spinand: gigadevice: Support GD5F1GQ5UExxG \| * `37077ed16c` crypto: virtio/akcipher - Fix stack overflow on memcpy \| * `bf85def4b6` platform/x86: touchscreen_dmi: Allow partial (prefix) matches for ACPI names * \| `67b086c845` Revert "mptcp: fix lockless access in subflow ULP diag" * \| `92a0d7e20f` Revert "net: dev: Convert sa_data to flexible array in struct sockaddr" * \| `bb807b14f3` Revert "arp: Prevent overflow in arp_req_get()." * \| `888e5e5b56` Revert "usb: roles: fix NULL pointer issue when put module's reference" * \| `72f354f396` Revert "usb: roles: don't get/set_role() when usb_role_switch is unregistered" * \| `e92b643b4b` Merge 5.10.211 into android12-5.10-lts \|/ * `9985c44f23` Linux 5.10.211 * `94ebf71bdd` ext4: regenerate buddy after block freeing failed if under fc replay * `dbc9b22d0e` arp: Prevent overflow in arp_req_get(). * `ea1cd64d59` fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio * `bff0a0658e` block: ataflop: more blk-mq refactoring fixes * `b49b022f7d` drm/amd/display: Fix memory leak in dm_sw_fini() * `c6551ff227` drm/syncobj: call drm_syncobj_fence_add_wait when WAIT_AVAILABLE flag is set * `144ec5e1ce` drm/syncobj: make lockdep complain on WAIT_FOR_SUBMIT v3 * `31ea574aec` netfilter: nf_tables: set dormant flag on hook register failure * `31e10d6cb0` tls: stop recv() if initial process_rx_list gave us non-DATA * `7c54eaa3b0` tls: rx: drop pointless else after goto * `4820e84e28` tls: rx: jump to a more appropriate label * `5d4e4eff79` s390: use the correct count for __iowrite64_copy() * `f6ce90567e` net: dev: Convert sa_data to flexible array in struct sockaddr * `c1b447a21a` packet: move from strlcpy with unused retval to strscpy * `65c38f23d1` ipv6: sr: fix possible use-after-free and null-ptr-deref * `d9b5e2b7a8` afs: Increase buffer size in afs_update_volume_status() * `2f56d71262` ipv6: properly combine dev_base_seq and ipv6.dev_addr_genid * `dcc1375d41` ipv4: properly combine dev_base_seq and ipv4.dev_addr_genid * `fc30793e06` nouveau: fix function cast warnings * `49ef33a90e` scsi: jazz_esp: Only build if SCSI core is builtin * `b42b801aba` bpf, scripts: Correct GPL license name * `a2d1e1f8f0` RDMA/srpt: fix function pointer cast warnings * `905de68fcd` arm64: dts: rockchip: set num-cs property for spi on px30 * `5639414a52` RDMA/qedr: Fix qedr_create_user_qp error flow * `5a5c039dac` RDMA/srpt: Support specifying the srpt_service_guid parameter * `179bb08834` RDMA/bnxt_re: Return error for SRQ resize * `3fa240bb6b` IB/hfi1: Fix a memleak in init_credit_return * `8affdbb3e2` mptcp: fix lockless access in subflow ULP diag * `eb3693454b` usb: roles: don't get/set_role() when usb_role_switch is unregistered * `e279bf8e51` usb: roles: fix NULL pointer issue when put module's reference * `57ca0e16f3` usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs * `1e204a8e9e` usb: cdns3: fix memory double free when handle zero packet * `b40328eea9` usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable() * `1dfe6393d1` x86/alternative: Make custom return thunk unconditional * `dd1a169b44` Revert "x86/alternative: Make custom return thunk unconditional" * `e8e9d1f6cf` x86/returnthunk: Allow different return thunks * `4eb421fa71` x86/ftrace: Use alternative RET encoding * `b253061d4b` x86/ibt,paravirt: Use text_gen_insn() for paravirt_patch() * `e752912ce1` x86/text-patching: Make text_gen_insn() play nice with ANNOTATE_NOENDBR * `c13d426040` Revert "x86/ftrace: Use alternative RET encoding" * `70d92abbe2` ARM: ep93xx: Add terminator to gpiod_lookup_table * `dcb4d14268` l2tp: pass correct message length to ip6_append_data * `03366ad111` PCI/MSI: Prevent MSI hardware interrupt number truncation * `2e534fd15e` gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp() * `6e5069b40f` KVM: arm64: vgic-its: Test for valid IRQ in its_sync_lpi_pending_table() * `615af9cb3e` KVM: arm64: vgic-its: Test for valid IRQ in MOVALL handler * `3c652f6fa1` dm-crypt: don't modify the data when using authenticated encryption * `f6a765a61e` s390/cio: fix invalid -EBUSY on ccw_device_start * `3f38d22e64` IB/hfi1: Fix sdma.h tx->num_descs off-by-one error * `a0180e940c` erofs: fix lz4 inplace decompression * `841b9f6f68` x86: drop bogus "cc" clobber from __try_cmpxchg_user_asm() * `6360869cc4` jbd2: Fix wrongly judgement for buffer head removing while doing checkpoint * `69389d82ab` jbd2: recheck chechpointing non-dirty buffer * `cb1609ef8a` jbd2: remove redundant buffer io error checks * `52b9609b89` iwlwifi: mvm: write queue_sync_state only for sync * `f5e6da2ca1` iwlwifi: mvm: do more useful queue sync accounting * `87b7d049ce` platform/x86: intel-vbtn: Support for tablet mode on HP Pavilion 13 x360 PC * `6c367739cd` lan743x: fix for potential NULL pointer dereference with bare card * `a1ccc4f441` btrfs: do not pin logs too early during renames * `16b70511bd` btrfs: unify lookup return value when dir entry is missing * `fccb8a6109` btrfs: introduce btrfs_lookup_match_dir * `aaf2d6b7ec` btrfs: tree-checker: check for overlapping extent items * `b8034ca2fd` task_stack, x86/cea: Force-inline stack helpers * `68ffe3ec19` ASoC: Intel: bytcr_rt5651: Drop reference count of ACPI device after use * `edeef1b4fb` ASoC: Intel: boards: get codec device with ACPI instead of bus search * `151b360f47` ASoC: Intel: boards: harden codec property handling * `877037eff7` mtd: spinand: macronix: Add support for MX35LFxGE4AD * `b6c4a44e89` cifs: add a warning when the in-flight count goes negative * `e410dfaaac` powerpc/watchpoints: Annotate atomic context in more places * `2641aa3f56` powerpc/watchpoint: Workaround P10 DD1 issue with VSX-32 byte instructions * `d021ba1142` block: ataflop: fix breakage introduced at blk-mq refactoring * `1dd3dc3892` seccomp: Invalidate seccomp mode to catch death failures * `7ab8a3bac5` x86/uaccess: Implement macros for CMPXCHG on user addresses * `13f6937f53` hsr: Avoid double remove of a node. * `b2e72d88c3` hvc/xen: prevent concurrent accesses to the shared ring * `86ba65e535` media: av7110: prevent underflow in write_ts_to_decoder() * `d6e60c53d2` ASoC: fsl_micfil: register platform component before registering cpu dai * `de899edac7` ARM: dts: imx: Set default tuning step for imx6sx usdhc * `51582123dd` irqchip/mips-gic: Don't touch vl_map if a local interrupt is not routable * `ef6128a1ba` ARM: dts: BCM53573: Drop nonexistent "default-off" LED trigger * `a4c0234b16` pmdomain: renesas: r8a77980-sysc: CR7 must be always on * `5fe446b245` virtio-blk: Ensure no requests in virtqueues before deleting vqs. * `92a1090b47` firewire: core: send bus reset promptly on gap count error * `6a375022b0` scsi: lpfc: Use unsigned type for num_sge * `7fb1979274` hwmon: (coretemp) Enlarge per package core count limit * `988ae00e69` efi: Don't add memblocks for soft-reserved memory * `4fff3d735b` efi: runtime: Fix potential overflow of soft-reserved region size * `865f99f641` Input: i8042 - add Fujitsu Lifebook U728 to i8042 quirk table * `30a8784572` ext4: correct the hole length returned by ext4_map_blocks() * `a72037da4a` nvmet-fc: abort command when there is no binding * `a0fa157bd4` nvmet-fc: release reference on target port * `5da866be3d` nvmet-fcloop: swap the list_add_tail arguments * `4f2c95015e` nvme-fc: do not wait in vain when unloading module * `f82ed69f6a` netfilter: conntrack: check SCTP_CID_SHUTDOWN_ACK for vtag setting in sctp_new * `da47fc8d30` spi: sh-msiof: avoid integer overflow in constants * `0a840d7984` ASoC: sunxi: sun4i-spdif: Add support for Allwinner H616 * `5b33bbeefb` nvmet-tcp: fix nvme tcp ida memory leak * `d21c122de3` regulator: pwm-regulator: Add validity checks in continuous .get_voltage * `c432094aa7` dmaengine: ti: edma: Add some null pointer checks to the edma_probe * `ffeb72a80a` ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() * `927794a021` ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() * `2b39c1a0a8` ahci: add 43-bit DMA address quirk for ASMedia ASM1061 controllers * `15bb22da0f` ahci: asm1166: correct count of reported ports * `e94da8aca2` spi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected * `cd36da760b` fbdev: sis: Error out if pixclock equals zero * `512ee6d604` fbdev: savage: Error out if pixclock equals zero * `5ffab99e07` wifi: mac80211: fix race condition on enabling fast-xmit * `7e71fbc68d` wifi: cfg80211: fix missing interfaces when dumping * `17c976fe2c` dmaengine: fsl-qdma: increase size of 'irq_name' * `d94a80da90` dmaengine: shdma: increase size of 'dev_id' * `168ed59170` scsi: target: core: Add TMF to tmr_list handling * `e4bc311745` sched/rt: Disallow writing invalid values to sched_rt_period_us * `13c6bce76d` sched/rt: Fix sysctl_sched_rr_timeslice intial value * `b1ba065137` zonefs: Improve error handling * `19087d70e9` userfaultfd: fix mmap_changing checking in mfill_atomic_hugetlb * `18d88bf9c2` sched/rt: sysctl_sched_rr_timeslice show default timeslice after reset * `94b064984a` smb: client: fix parsing of SMB3.1.1 POSIX create context * `13fb0fc491` smb: client: fix potential OOBs in smb2_parse_contexts() * `b03c8099a7` smb: client: fix OOB in receive_encrypted_standard() * `3fa31e7a9d` net/sched: Retire dsmark qdisc * `71925d6863` net/sched: Retire ATM qdisc * `56a6720d9b` net/sched: Retire CBQ qdisc Change-Id: Ifcdb2a0a24ed57b62d73c24ab1e6d8918b9c4068 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-06-28 16:12:51 +00:00
Greg Kroah-Hartman	dde5ece421	Merge 5.10.217 into android12-5.10-lts Changes in 5.10.217 dmaengine: pl330: issue_pending waits until WFP state dmaengine: Revert "dmaengine: pl330: issue_pending waits until WFP state" wifi: nl80211: don't free NULL coalescing rule eeprom: at24: Use dev_err_probe for nvmem register failure eeprom: at24: Probe for DDR3 thermal sensor in the SPD case eeprom: at24: fix memory corruption race condition pinctrl: pinctrl-aspeed-g6: Fix register offset for pinconf of GPIOR-T pinctrl/meson: fix typo in PDM's pin name pinctrl: core: delete incorrect free in pinctrl_enable() pinctrl: mediatek: paris: Rework mtk_pinconf_{get,set} switch/case logic pinctrl: mediatek: paris: Fix PIN_CONFIG_INPUT_SCHMITT_ENABLE readback pinctrl: mediatek: paris: Rework support for PIN_CONFIG_{INPUT,OUTPUT}_ENABLE sunrpc: add a struct rpc_stats arg to rpc_create_args nfs: expose /proc/net/sunrpc/nfs in net namespaces nfs: make the rpc_stat per net namespace nfs: Handle error of rpc_proc_register() in nfs_net_init(). power: rt9455: hide unused rt9455_boost_voltage_values pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map() regulator: mt6360: De-capitalize devicetree regulator subnodes s390/mm: Fix storage key clearing for guest huge pages s390/mm: Fix clearing storage keys for huge pages bna: ensure the copied buf is NUL terminated octeontx2-af: avoid off-by-one read from userspace nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). net l2tp: drop flow hash on forward s390/vdso: Add CFI for RA register to asm macro vdso_func net: qede: sanitize 'rc' in qede_add_tc_flower_fltr() net: qede: use return from qede_parse_flow_attr() for flower net: qede: use return from qede_parse_flow_attr() for flow_spec net: qede: use return from qede_parse_actions() ASoC: Fix 7/8 spaces indentation in Kconfig ASoC: meson: cards: select SND_DYNAMIC_MINORS cxgb4: Properly lock TX queue for the selftest. net: dsa: mv88e6xxx: Fix number of databases for 88E6141 / 88E6341 net: bridge: fix multicast-to-unicast with fraglist GSO net: core: reject skb_copy(_expand) for fraglist GSO skbs tipc: fix a possible memleak in tipc_buf_append net: gro: add flush check in udp_gro_receive_segment clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() scsi: lpfc: Update lpfc_ramp_down_queue_handler() logic gfs2: Fix invalid metadata access in punch_hole wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc wifi: cfg80211: fix rdev_dump_mpp() arguments order net: mark racy access on sk->sk_rcvbuf scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload btrfs: return accurate error code on open failure in open_fs_devices() ALSA: line6: Zero-initialize message buffers net: bcmgenet: Reset RBUF on first open ata: sata_gemini: Check clk_enable() result firewire: ohci: mask bus reset interrupts between ISR and bottom half tools/power turbostat: Fix added raw MSR output tools/power turbostat: Fix Bzy_MHz documentation typo btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve btrfs: always clear PERTRANS metadata during commit scsi: target: Fix SELinux error when systemd-modules loads the target module blk-iocost: avoid out of bounds shift gpu: host1x: Do not setup DMA for virtual devices MIPS: scall: Save thread_info.syscall unconditionally on entry selftests: timers: Fix valid-adjtimex signed left-shift undefined behavior fs/9p: only translate RWX permissions for plain 9P2000 fs/9p: translate O_TRUNC into OTRUNC 9p: explicitly deny setlease attempts gpio: wcove: Use -ENOTSUPP consistently gpio: crystalcove: Use -ENOTSUPP consistently clk: Don't hold prepare_lock when calling kref_put() fs/9p: drop inodes immediately on non-.L too drm/nouveau/dp: Don't probe eDP ports twice harder net:usb:qmi_wwan: support Rolling modules xfrm: Preserve vlan tags for transport mode software GRO tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation hwmon: (corsair-cpro) Use a separate buffer for sending commands hwmon: (corsair-cpro) Use complete_all() instead of complete() in ccp_raw_event() hwmon: (corsair-cpro) Protect ccp->wait_input_report with a spinlock phonet: fix rtm_phonet_notify() skb allocation kcov: Remove kcov include from sched.h and move it to its users. net: bridge: fix corrupted ethernet header on multicast-to-unicast ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() net: hns3: use appropriate barrier function after setting a bit value btrfs: fix kvcalloc() arguments order in btrfs_ioctl_send() firewire: nosy: ensure user_length is taken into account when fetching packet contents arm64: dts: qcom: Fix 'interrupt-map' parent address cells usb: typec: ucsi: Check for notifications after init usb: typec: ucsi: Fix connector check on init usb: Fix regression caused by invalid ep0 maxpacket in virtual SuperSpeed device usb: ohci: Prevent missed ohci interrupts usb: gadget: composite: fix OS descriptors w_value logic usb: gadget: f_fs: Fix a race condition when processing setup packets. usb: xhci-plat: Don't include xhci.h usb: dwc3: core: Prevent phy suspend during init ALSA: hda/realtek: Fix mute led of HP Laptop 15-da3001TU iio:imu: adis16475: Fix sync mode setting iio: accel: mxc4005: Interrupt handling fixes tipc: fix UAF in error path net: bcmgenet: synchronize use of bcmgenet_set_rx_mode() ASoC: tegra: Fix DSPK 16-bit playback dyndbg: fix old BUG_ON in >control parser mei: me: add lunar lake point M DID drm/vmwgfx: Fix invalid reads in fence signaled events net: fix out-of-bounds access in ops_init hwmon: (pmbus/ucd9000) Increase delay from 250 to 500us regulator: core: fix debugfs creation regression keys: Fix overwrite of key expiration on instantiation md: fix kmemleak of rdev->serial Linux 5.10.217 Change-Id: I63eef00187948953d29febc26cc4c2c30166f7aa Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-06-14 13:21:33 +00:00
Greg Kroah-Hartman	c15c1199d6	Merge 5.10.216 into android12-5.10-lts Changes in 5.10.216 batman-adv: Avoid infinite loop trying to resize local TT Bluetooth: Fix memory leak in hci_req_sync_complete() media: cec: core: remove length check of Timer Status nouveau: fix function cast warning net: openvswitch: fix unwanted error log on timeout policy probing u64_stats: fix u64_stats_init() for lockdep when used repeatedly in one file xsk: validate user input for XDP_{UMEM\|COMPLETION}_FILL_RING geneve: fix header validation in geneve[6]_xmit_skb octeontx2-af: Fix NIX SQ mode and BP config ipv6: fib: hide unused 'pn' variable ipv4/route: avoid unused-but-set-variable warning ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr Bluetooth: SCO: Fix not validating setsockopt user input netfilter: complete validation of user input net/mlx5: Properly link new fs rules into the tree af_unix: Do not use atomic ops for unix_sk(sk)->inflight. af_unix: Fix garbage collector racing against connect() net: ena: Fix potential sign extension issue net: ena: Wrong missing IO completions check order net: ena: Fix incorrect descriptor free behavior iommu/vt-d: Allocate local memory for page request queue mailbox: imx: fix suspend failue btrfs: qgroup: correctly model root qgroup rsv in convert drm/client: Fully protect modes[] with dev->mode_config.mutex vhost: Add smp_rmb() in vhost_vq_avail_empty() x86/cpu: Actually turn off mitigations by default for SPECULATION_MITIGATIONS=n selftests: timers: Fix abs() warning in posix_timers test x86/apic: Force native_apic_mem_read() to use the MOV instruction irqflags: Explicitly ignore lockdep_hrtimer_exit() argument btrfs: record delayed inode root in transaction riscv: Enable per-task stack canaries riscv: process: Fix kernel gp leakage selftests/ftrace: Limit length in subsystem-enable tests kprobes: Fix possible use-after-free issue on kprobe registration Revert "tracing/trigger: Fix to return error if failed to alloc snapshot" netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() netfilter: nft_set_pipapo: do not free live element tun: limit printing rate when illegal packet received by tun dev RDMA/rxe: Fix the problem "mutex_destroy missing" RDMA/cm: Print the old state when cm_destroy_id gets timeout RDMA/mlx5: Fix port number for counter query in multi-port configuration drm: nv04: Fix out of bounds access drm/panel: visionox-rm69299: don't unregister DSI device clk: Remove prepare_lock hold assertion in __clk_release() clk: Mark 'all_lists' as const clk: remove extra empty line clk: Print an info line before disabling unused clocks clk: Initialize struct clk_core kref earlier clk: Get runtime PM before walking tree during disable_unused x86/cpufeatures: Fix dependencies for GFNI, VAES, and VPCLMULQDQ binder: check offset alignment in binder_get_object() thunderbolt: Avoid notify PM core about runtime PM resume thunderbolt: Fix wake configurations after device unplug comedi: vmk80xx: fix incomplete endpoint checking serial/pmac_zilog: Remove flawed mitigation for rx irq flood USB: serial: option: add Fibocom FM135-GL variants USB: serial: option: add support for Fibocom FM650/FG650 USB: serial: option: add Lonsung U8300/U9300 product USB: serial: option: support Quectel EM060K sub-models USB: serial: option: add Rolling RW101-GL and RW135-GL support USB: serial: option: add Telit FN920C04 rmnet compositions Revert "usb: cdc-wdm: close race between read and workqueue" usb: dwc2: host: Fix dereference issue in DDMA completion flow. usb: Disable USB3 LPM at shutdown mei: me: disable RPL-S on SPS and IGN firmwares speakup: Avoid crash on very long word fs: sysfs: Fix reference leak in sysfs_break_active_protection() init/main.c: Fix potential static_command_line memory overflow drm/amdgpu: validate the parameters of bo mapping operations more clearly nouveau: fix instmem race condition around ptr stores nilfs2: fix OOB in nilfs_set_de_type arm64: dts: rockchip: fix alphabetical ordering RK3399 puma arm64: dts: rockchip: enable internal pull-up on PCIE_WAKE# for RK3399 Puma arm64: dts: rockchip: Remove unsupported node from the Pinebook Pro dts arm64: dts: mediatek: mt7622: add support for coherent DMA arm64: dts: mediatek: mt7622: introduce nodes for Wireless Ethernet Dispatch arm64: dts: mediatek: mt7622: fix clock controllers arm64: dts: mediatek: mt7622: fix IR nodename arm64: dts: mediatek: mt7622: fix ethernet controller "compatible" arm64: dts: mediatek: mt7622: drop "reset-names" from thermal block arm64: dts: mediatek: mt2712: fix validation errors ARC: [plat-hsdk]: Remove misplaced interrupt-cells property wifi: iwlwifi: mvm: remove old PASN station when adding a new one vxlan: drop packets from invalid src-address mlxsw: core: Unregister EMAD trap using FORWARD action NFC: trf7970a: disable all regulators on removal ipv4: check for NULL idev in ip_route_use_hint() net: usb: ax88179_178a: stop lying about skb->truesize net: gtp: Fix Use-After-Free in gtp_dellink ipvs: Fix checksumming on GSO of SCTP packets net: openvswitch: Fix Use-After-Free in ovs_ct_exit mlxsw: spectrum_acl_tcam: Fix race during rehash delayed work mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash mlxsw: spectrum_acl_tcam: Rate limit error message mlxsw: spectrum_acl_tcam: Fix memory leak during rehash mlxsw: spectrum_acl_tcam: Fix warning during rehash mlxsw: spectrum_acl_tcam: Fix incorrect list API usage mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work netfilter: nf_tables: honor table dormant flag from netdev release event path i40e: Do not use WQ_MEM_RECLAIM flag for workqueue i40e: Report MFS in decimal base instead of hex iavf: Fix TC config comparison with existing adapter TC config net: ethernet: ti: am65-cpts: Fix PTPv1 message type on TX packets af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc(). serial: core: Provide port lock wrappers serial: mxs-auart: add spinlock around changing cts state Revert "crypto: api - Disallow identical driver names" net/mlx5e: Fix a race in command alloc flow tracing: Show size of requested perf buffer tracing: Increase PERF_MAX_TRACE_SIZE to handle Sentinel1 and docker together PM / devfreq: Fix buffer overflow in trans_stat_show Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old() Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0bda:0x4853 btrfs: fix information leak in btrfs_ioctl_logical_to_ino() cpu: Re-enable CPU mitigations by default for !X86 architectures arm64: dts: rockchip: enable internal pull-up for Q7_THRM# on RK3399 Puma drm/amdgpu/sdma5.2: use legacy HDP flush for SDMA2/3 drm/amdgpu: Fix leak when GPU memory allocation fails irqchip/gic-v3-its: Prevent double free on error ethernet: Add helper for assigning packet type when dest address does not match device address net: b44: set pause params only when interface is up stackdepot: respect __GFP_NOLOCKDEP allocation flag mtd: diskonchip: work around ubsan link failure tcp: Clean up kernel listener's reqsk in inet_twsk_purge() tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge() dmaengine: owl: fix register access functions idma64: Don't try to serve interrupts when device is powered off dma: xilinx_dpdma: Fix locking riscv: fix VMALLOC_START definition riscv: Fix TASK_SIZE on 64-bit NOMMU i2c: smbus: fix NULL function pointer dereference HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up bounds: Use the right number of bits for power-of-two CONFIG_NR_CPUS udp: preserve the connected status if only UDP cmsg serial: core: fix kernel-doc for uart_port_unlock_irqrestore() riscv: Disable STACKPROTECTOR_PER_TASK if GCC_PLUGIN_RANDSTRUCT is enabled Linux 5.10.216 Change-Id: Ia2bf3ba6ed3f36a56f71543442427eb770a2400b Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-06-13 16:02:17 +00:00
Kuniyuki Iwashima	f91f368b2e	UPSTREAM: af_unix: Do not use atomic ops for unix_sk(sk)->inflight. [ Upstream commit 97af84a6bba2ab2b9c704c08e67de3b5ea551bb2 ] When touching unix_sk(sk)->inflight, we are always under spin_lock(&unix_gc_lock). Let's convert unix_sk(sk)->inflight to the normal unsigned long. Bug: 336226035 Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://lore.kernel.org/r/20240123170856.41348-3-kuniyu@amazon.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Stable-dep-of: 47d8ac011fe1 ("af_unix: Fix garbage collector racing against connect()") Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 301fdbaa0bba4653570f07789909939f977a7620) Signed-off-by: Lee Jones <joneslee@google.com> Change-Id: I0d965d5f2a863d798c06de9f21d0467f256b538e	2024-06-11 11:07:37 +01:00
Greg Kroah-Hartman	9d06d47cd2	ANDROID: ABI fixup for abi break in struct dst_ops In commit 92f1655aa2b2 ("net: fix __dst_negative_advice() race") the struct dst_ops callback negative_advice is callback changes function parameters. But as this pointer is part of a structure that is tracked in the ABI checker, the tool triggers when this is changed. However, the callback pointer is internal to the networking stack, so changing the function type is safe, so needing to preserve this is not required. To do so, switch the function pointer type back to the old one so that the checking tools pass, AND then do a hard cast of the function pointer to the new type when assigning and calling the function. Bug: 343727534 Fixes: 92f1655aa2b2 ("net: fix __dst_negative_advice() race") Change-Id: I48d4ab4bbd29f8edc8fbd7923828b7f78a23e12e Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-06-01 13:50:40 +00:00
Eric Dumazet	bff4c6bace	BACKPORT: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF. RCU rules are that we must first clear sk->sk_dst_cache, then call dst_release(old_dst). Note that sk_dst_reset(sk) is implementing this protocol correctly, while __dst_negative_advice() uses the wrong order. Given that ip6_negative_advice() has special logic against RTF_CACHE, this means each of the three ->negative_advice() existing methods must perform the sk_dst_reset() themselves. Note the check against NULL dst is centralized in __dst_negative_advice(), there is no need to duplicate it in various callbacks. Many thanks to Clement Lecigne for tracking this issue. This old bug became visible after the blamed commit, using UDP sockets. Bug: 343727534 Fixes: `a87cb3e48e` ("net: Facility to report route quality of connected sockets") Reported-by: Clement Lecigne <clecigne@google.com> Diagnosed-by: Clement Lecigne <clecigne@google.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Tom Herbert <tom@herbertland.com> Reviewed-by: David Ahern <dsahern@kernel.org> Link: https://lore.kernel.org/r/20240528114353.1794151-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> (cherry picked from commit 92f1655aa2b2294d0b49925f3b875a634bd3b59e) [Lee: Trivial/unrelated conflict - no change to the patch] Signed-off-by: Lee Jones <joneslee@google.com> Change-Id: I293734dca1b81fcb712e1de294f51e96a405f7e4 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-06-01 13:48:25 +00:00
Greg Kroah-Hartman	9100d24dfd	This is the 5.10.215 stable release -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmYaZdgACgkQONu9yGCS aT4oMxAA0pATFAq8RN5f9CmYlMg5HqHgzZ8lJv8P0/reOINhUa+F5sJb1n+x+Ch4 WQbmiFeZRzfsKZ2qKhIdNR0Lg+9JOr/DtYXdSBZ6InfSWrTAIrQ9fjl5Warkmcgg O4WbgF5BVgU3vGFATgxLvnUZwhR1D7WK93oMDunzrT7+OqyncU3f1Uj53ZAu9030 z18UNqnTxDLYH/CMGwAeRkaZqBev9gZ1HdgQWA27SVLqWQwZq0al81Cmlo+ECVmk 5dF6V2pid4qfKGJjDDfx1NS0PVnoP68iK4By1SXyoFV9VBiSwp77nUUyDr7YsHsT u8GpZHr9jZvSO5/xtKv20NPLejTPCRKc06CbkwpikDRtGOocBL8em0GuVqlf8hMs KwDb6ZEzYhXZGPJHbJM+aRD1tq/KHw9X7TrldOszMQPr6lubBtscPbg1FCg3OlcC HUrtub0i275x7TH0dJeRTD8TRE9jRmF+tl7KQytEJM3JRrquFjLyhDj+/VJnZkiB lzj3FRf4zshzgz4+CAeqXO/8Lu8b3fGYmcW1acCmk7emjDcXUKojPj/Aig6T4l7P oCWDY3+w1E6eiyE8BazxY1KUa/41ld0VJnlW5JWGRaDFTJwrk0h6/rvf9qImSckw IGx24UezRyp6NS1op3Qm2iwHLr41pFRfKxNm9ppgH9iBPzOhe38= =pkLL -----END PGP SIGNATURE----- Merge 5.10.215 into android12-5.10-lts Changes in 5.10.215 amdkfd: use calloc instead of kzalloc to avoid integer overflow Documentation/hw-vuln: Update spectre doc x86/cpu: Support AMD Automatic IBRS x86/bugs: Use sysfs_emit() timers: Update kernel-doc for various functions timers: Use del_timer_sync() even on UP timers: Rename del_timer_sync() to timer_delete_sync() wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach media: staging: ipu3-imgu: Set fields before media_entity_pads_init() clk: qcom: gcc-sdm845: Add soft dependency on rpmhpd smack: Set SMACK64TRANSMUTE only for dirs in smack_inode_setxattr() smack: Handle SMACK64TRANSMUTE in smack_inode_setsecurity() arm: dts: marvell: Fix maxium->maxim typo in brownstone dts drm/vmwgfx: stop using ttm_bo_create v2 drm/vmwgfx: switch over to the new pin interface v2 drm/vmwgfx/vmwgfx_cmdbuf_res: Remove unused variable 'ret' drm/vmwgfx: Fix some static checker warnings drm/vmwgfx: Fix possible null pointer derefence with invalid contexts serial: max310x: fix NULL pointer dereference in I2C instantiation media: xc4000: Fix atomicity violation in xc4000_get_frequency KVM: Always flush async #PF workqueue when vCPU is being destroyed sparc64: NMI watchdog: fix return value of __setup handler sparc: vDSO: fix return value of __setup handler crypto: qat - fix double free during reset crypto: qat - resolve race condition during AER recovery selftests/mqueue: Set timeout to 180 seconds ext4: correct best extent lstart adjustment logic block: introduce zone_write_granularity limit block: Clear zone limits for a non-zoned stacked queue bounds: support non-power-of-two CONFIG_NR_CPUS fat: fix uninitialized field in nostale filehandles ubifs: Set page uptodate in the correct place ubi: Check for too small LEB size in VTBL code ubi: correct the calculation of fastmap size mtd: rawnand: meson: fix scrambling mode value in command macro parisc: Avoid clobbering the C/B bits in the PSW with tophys and tovirt macros parisc: Fix ip_fast_csum parisc: Fix csum_ipv6_magic on 32-bit systems parisc: Fix csum_ipv6_magic on 64-bit systems parisc: Strip upper 32 bit of sum in csum_ipv6_magic for 64-bit builds PM: suspend: Set mem_sleep_current during kernel command line setup clk: qcom: gcc-ipq6018: fix terminating of frequency table arrays clk: qcom: gcc-ipq8074: fix terminating of frequency table arrays clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays powerpc/fsl: Fix mfpmr build errors with newer binutils USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB USB: serial: add device ID for VeriFone adapter USB: serial: cp210x: add ID for MGP Instruments PDS100 USB: serial: option: add MeiG Smart SLM320 product USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M PM: sleep: wakeirq: fix wake irq warning in system suspend mmc: tmio: avoid concurrent runs of mmc_request_done() fuse: fix root lookup with nonzero generation fuse: don't unhash root usb: typec: ucsi: Clean up UCSI_CABLE_PROP macros printk/console: Split out code that enables default console serial: Lock console when calling into driver before registration btrfs: fix off-by-one chunk length calculation at contains_pending_extent() PCI: Drop pci_device_remove() test of pci_dev->driver PCI/PM: Drain runtime-idle callbacks before driver removal PCI/ERR: Cache RCEC EA Capability offset in pci_init_capabilities() PCI: Cache PCIe Device Capabilities register PCI: Work around Intel I210 ROM BAR overlap defect PCI/ASPM: Make Intel DG2 L1 acceptable latency unlimited PCI/DPC: Quirk PIO log size for certain Intel Root Ports PCI/DPC: Quirk PIO log size for Intel Raptor Lake Root Ports Revert "Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"" dm-raid: fix lockdep waring in "pers->hot_add_disk" mac802154: fix llsec key resources release in mac802154_llsec_key_del mm: swap: fix race between free_swap_and_cache() and swapoff() mmc: core: Fix switch on gp3 partition drm/etnaviv: Restore some id values hwmon: (amc6821) add of_match table ext4: fix corruption during on-line resize nvmem: meson-efuse: fix function pointer type mismatch slimbus: core: Remove usage of the deprecated ida_simple_xx() API phy: tegra: xusb: Add API to retrieve the port number of phy usb: gadget: tegra-xudc: Use dev_err_probe() usb: gadget: tegra-xudc: Fix USB3 PHY retrieval logic speakup: Fix 8bit characters from direct synth PCI/ERR: Clear AER status only when we control AER PCI/AER: Block runtime suspend when handling errors nfs: fix UAF in direct writes kbuild: Move -Wenum-{compare-conditional,enum-conversion} into W=1 PCI: dwc: endpoint: Fix advertised resizable BAR size vfio/platform: Disable virqfds on cleanup ring-buffer: Fix waking up ring buffer readers ring-buffer: Do not set shortest_full when full target is hit ring-buffer: Fix resetting of shortest_full ring-buffer: Fix full_waiters_pending in poll soc: fsl: qbman: Always disable interrupts when taking cgr_lock soc: fsl: qbman: Add helper for sanity checking cgr ops soc: fsl: qbman: Add CGR update function soc: fsl: qbman: Use raw spinlock for cgr_lock s390/zcrypt: fix reference counting on zcrypt card objects drm/panel: do not return negative error codes from drm_panel_get_modes() drm/exynos: do not return negative values from .get_modes() drm/imx/ipuv3: do not return negative values from .get_modes() drm/vc4: hdmi: do not return negative values from .get_modes() memtest: use {READ,WRITE}_ONCE in memory scanning nilfs2: fix failure to detect DAT corruption in btree and direct mappings nilfs2: prevent kernel bug at submit_bh_wbc() cpufreq: dt: always allocate zeroed cpumask x86/CPU/AMD: Update the Zenbleed microcode revisions net: hns3: tracing: fix hclgevf trace event strings wireguard: netlink: check for dangling peer via is_dead instead of empty list wireguard: netlink: access device through ctx instead of peer ahci: asm1064: correct count of reported ports ahci: asm1064: asm1166: don't limit reported ports drm/amd/display: Return the correct HDCP error code drm/amd/display: Fix noise issue on HDMI AV mute dm snapshot: fix lockup in dm_exception_table_exit vxge: remove unnecessary cast in kfree() x86/stackprotector/32: Make the canary into a regular percpu variable x86/pm: Work around false positive kmemleak report in msr_build_context() scripts: kernel-doc: Fix syntax error due to undeclared args variable comedi: comedi_test: Prevent timers rescheduling during deletion cpufreq: brcmstb-avs-cpufreq: fix up "add check for cpufreq_cpu_get's return value" netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout netfilter: nf_tables: disallow anonymous set with timeout flag netfilter: nf_tables: reject constant set with timeout Drivers: hv: vmbus: Calculate ring buffer size for more efficient use of memory xfrm: Avoid clang fortify warning in copy_to_user_tmpl() KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() ALSA: hda/realtek - Fix headset Mic no show at resume back for Lenovo ALC897 platform USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command usb: gadget: ncm: Fix handling of zero block length packets usb: port: Don't try to peer unused USB ports based on location tty: serial: fsl_lpuart: avoid idle preamble pending if CTS is enabled mei: me: add arrow lake point S DID mei: me: add arrow lake point H DID vt: fix unicode buffer corruption when deleting characters fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion tee: optee: Fix kernel panic caused by incorrect error handling xen/events: close evtchn after mapping cleanup printk: Update @console_may_schedule in console_trylock_spinning() btrfs: allocate btrfs_ioctl_defrag_range_args on stack x86/asm: Add _ASM_RIP() macro for x86-64 (%rip) suffix x86/bugs: Add asm helpers for executing VERW x86/entry_64: Add VERW just before userspace transition x86/entry_32: Add VERW just before userspace transition x86/bugs: Use ALTERNATIVE() instead of mds_user_clear static key KVM/VMX: Use BT+JNC, i.e. EFLAGS.CF to select VMRESUME vs. VMLAUNCH KVM/VMX: Move VERW closer to VMentry for MDS mitigation x86/mmio: Disable KVM mitigation when X86_FEATURE_CLEAR_CPU_BUF is set Documentation/hw-vuln: Add documentation for RFDS x86/rfds: Mitigate Register File Data Sampling (RFDS) KVM/x86: Export RFDS_NO and RFDS_CLEAR to guests perf/core: Fix reentry problem in perf_output_read_group() efivarfs: Request at most 512 bytes for variable names powerpc: xor_vmx: Add '-mhard-float' to CFLAGS serial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO mm/memory-failure: fix an incorrect use of tail pages mm/migrate: set swap entry values of THP tail pages properly. init: open /initrd.image with O_LARGEFILE wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes exec: Fix NOMMU linux_binprm::exec in transfer_args_to_stack() hexagon: vmlinux.lds.S: handle attributes section mmc: core: Initialize mmc_blk_ioc_data mmc: core: Avoid negative index with array access net: ll_temac: platform_get_resource replaced by wrong function usb: cdc-wdm: close race between read and workqueue ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs scsi: core: Fix unremoved procfs host directory regression staging: vc04_services: changen strncpy() to strscpy_pad() staging: vc04_services: fix information leak in create_component() USB: core: Add hub_get() and hub_put() routines usb: dwc2: host: Fix remote wakeup from hibernation usb: dwc2: host: Fix hibernation flow usb: dwc2: host: Fix ISOC flow in DDMA mode usb: dwc2: gadget: LPM flow fix usb: udc: remove warning when queue disabled ep usb: typec: ucsi: Ack unsupported commands usb: typec: ucsi: Clear UCSI_CCI_RESET_COMPLETE before reset scsi: qla2xxx: Split FCE\|EFT trace control scsi: qla2xxx: Fix command flush on cable pull scsi: qla2xxx: Delay I/O Abort on PCI error x86/cpu: Enable STIBP on AMD if Automatic IBRS is enabled PCI/DPC: Quirk PIO log size for Intel Ice Lake Root Ports scsi: lpfc: Correct size for wqe for memset() USB: core: Fix deadlock in usb_deauthorize_interface() nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet ixgbe: avoid sleeping allocation in ixgbe_ipsec_vf_add_sa() tcp: properly terminate timers for kernel sockets ACPICA: debugger: check status of acpi_evaluate_object() in acpi_db_walk_for_fields() bpf: Protect against int overflow for stack access size Octeontx2-af: fix pause frame configuration in GMP mode dm integrity: fix out-of-range warning r8169: fix issue caused by buggy BIOS on certain boards with RTL8168d x86/cpufeatures: Add new word for scattered features Bluetooth: hci_event: set the conn encrypted before conn establishes Bluetooth: Fix TOCTOU in HCI debugfs implementation netfilter: nf_tables: disallow timeout for anonymous sets net/rds: fix possible cp null dereference vfio/pci: Disable auto-enable of exclusive INTx IRQ vfio/pci: Lock external INTx masking ops vfio: Introduce interface to flush virqfd inject workqueue vfio/pci: Create persistent INTx handler vfio/platform: Create persistent IRQ handlers vfio/fsl-mc: Block calling interrupt handler without trigger io_uring: ensure '0' is returned on file registration success Revert "x86/mm/ident_map: Use gbpages only where full GB page should be mapped." mm, vmscan: prevent infinite loop for costly GFP_NOIO \| __GFP_RETRY_MAYFAIL allocations x86/srso: Add SRSO mitigation for Hygon processors block: add check that partition length needs to be aligned with block size netfilter: nf_tables: reject new basechain after table flag update netfilter: nf_tables: flush pending destroy work before exit_net release netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() netfilter: validate user input for expected length vboxsf: Avoid an spurious warning if load_nls_xxx() fails bpf, sockmap: Prevent lock inversion deadlock in map delete elem net/sched: act_skbmod: prevent kernel-infoleak net: stmmac: fix rx queue priority assignment erspan: make sure erspan_base_hdr is present in skb->head selftests: reuseaddr_conflict: add missing new line at the end of the output ipv6: Fix infinite recursion in fib6_dump_done(). udp: do not transition UDP GRO fraglist partial checksums to unnecessary octeontx2-pf: check negative error code in otx2_open() i40e: fix i40e_count_filters() to count only active/new filters i40e: fix vf may be used uninitialized in this function warning scsi: qla2xxx: Update manufacturer details scsi: qla2xxx: Update manufacturer detail Revert "usb: phy: generic: Get the vbus supply" udp: do not accept non-tunnel GSO skbs landing in a tunnel net: ravb: Always process TX descriptor ring arm64: dts: qcom: sc7180: Remove clock for bluetooth on Trogdor arm64: dts: qcom: sc7180-trogdor: mark bluetooth address as broken ASoC: ops: Fix wraparound for mask in snd_soc_get_volsw ata: sata_sx4: fix pdc20621_get_from_dimm() on 64-bit scsi: mylex: Fix sysfs buffer lengths ata: sata_mv: Fix PCI device ID table declaration compilation warning ALSA: hda/realtek: Update Panasonic CF-SZ6 quirk to support headset with microphone driver core: Introduce device_link_wait_removal() of: dynamic: Synchronize of_changeset_destroy() with the devlink removals x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() s390/entry: align system call table on 8 bytes riscv: Fix spurious errors from __get/put_kernel_nofault x86/bugs: Fix the SRSO mitigation on Zen3/4 x86/retpoline: Do the necessary fixup to the Zen3/4 srso return thunk for !SRSO mptcp: don't account accept() of non-MPC client as fallback to TCP x86/cpufeatures: Add CPUID_LNX_5 to track recently added Linux-defined word objtool: Add asm version of STACK_FRAME_NON_STANDARD wifi: ath9k: fix LNA selection in ath_ant_try_scan() VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() panic: Flush kernel log buffer at the end arm64: dts: rockchip: fix rk3328 hdmi ports node arm64: dts: rockchip: fix rk3399 hdmi ports node ionic: set adminq irq affinity pstore/zone: Add a null pointer check to the psz_kmsg_read tools/power x86_energy_perf_policy: Fix file leak in get_pkg_num() btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() btrfs: export: handle invalid inode or root reference in btrfs_get_parent() btrfs: send: handle path ref underflow in header iterate_inode_ref() net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() Bluetooth: btintel: Fix null ptr deref in btintel_read_version Input: synaptics-rmi4 - fail probing if memory allocation for "phys" fails pinctrl: renesas: checker: Limit cfg reg enum checks to provided IDs sysv: don't call sb_bread() with pointers_lock held scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc() isofs: handle CDs with bad root inode but good Joliet root directory media: sta2x11: fix irq handler cast ext4: add a hint for block bitmap corrupt state in mb_groups ext4: forbid commit inconsistent quota data when errors=remount-ro drm/amd/display: Fix nanosec stat overflow SUNRPC: increase size of rpc_wait_queue.qlen from unsigned short to unsigned int Revert "ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default" libperf evlist: Avoid out-of-bounds access block: prevent division by zero in blk_rq_stat_sum() RDMA/cm: add timeout to cm_destroy_id wait Input: allocate keycode for Display refresh rate toggle platform/x86: touchscreen_dmi: Add an extra entry for a variant of the Chuwi Vi8 tablet ktest: force $buildonly = 1 for 'make_warnings_file' test type ring-buffer: use READ_ONCE() to read cpu_buffer->commit_page in concurrent environment tools: iio: replace seekdir() in iio_generic_buffer usb: typec: tcpci: add generic tcpci fallback compatible usb: sl811-hcd: only defined function checkdone if QUIRK2 is defined fbdev: viafb: fix typo in hw_bitblt_1 and hw_bitblt_2 drivers/nvme: Add quirks for device 126f:2262 fbmon: prevent division by zero in fb_videomode_from_videomode() netfilter: nf_tables: release batch on table validation from abort path netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path netfilter: nf_tables: discard table flag update with pending basechain deletion tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc virtio: reenable config if freezing device failed x86/mm/pat: fix VM_PAT handling in COW mappings drm/i915/gt: Reset queue_priority_hint on parking Bluetooth: btintel: Fixe build regression VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() kbuild: dummy-tools: adjust to stricter stackprotector check scsi: sd: Fix wrong zone_write_granularity value during revalidate x86/retpoline: Add NOENDBR annotation to the SRSO dummy return thunk x86/head/64: Re-enable stack protection Linux 5.10.215 Change-Id: I45a0a9c4a0683ff5ef97315690f1f884f666e1b5 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-06-01 11:03:55 +00:00
Paul Davey	a4b7606732	xfrm: Preserve vlan tags for transport mode software GRO [ Upstream commit 58fbfecab965014b6e3cc956a76b4a96265a1add ] The software GRO path for esp transport mode uses skb_mac_header_rebuild prior to re-injecting the packet via the xfrm_napi_dev. This only copies skb->mac_len bytes of header which may not be sufficient if the packet contains 802.1Q tags or other VLAN tags. Worse copying only the initial header will leave a packet marked as being VLAN tagged but without the corresponding tag leading to mangling when it is later untagged. The VLAN tags are important when receiving the decrypted esp transport mode packet after GRO processing to ensure it is received on the correct interface. Therefore record the full mac header length in xfrm_transport_input for later use in corresponding xfrm_transport_finish to copy the entire mac header when rebuilding the mac header for GRO. The skb->data pointer is left pointing skb->mac_header bytes after the start of the mac header as is expected by the network stack and network and transport header offsets reset to this location. Fixes: `7785bba299` ("esp: Add a software GRO codepath") Signed-off-by: Paul Davey <paul.davey@alliedtelesis.co.nz> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2024-05-17 11:48:06 +02:00
Greg Kroah-Hartman	dd27b89022	Merge 5.10.214 into android12-5.10-lts Changes in 5.10.214 io_uring/unix: drop usage of io_uring socket io_uring: drop any code related to SCM_RIGHTS rcu-tasks: Provide rcu_trace_implies_rcu_gp() bpf: Defer the free of inner map when necessary selftests: tls: use exact comparison in recv_partial ASoC: rt5645: Make LattePanda board DMI match more precise x86/xen: Add some null pointer checking to smp.c MIPS: Clear Cause.BD in instruction_pointer_set HID: multitouch: Add required quirk for Synaptics 0xcddc device gen_compile_commands: fix invalid escape sequence warning RDMA/mlx5: Fix fortify source warning while accessing Eth segment RDMA/mlx5: Relax DEVX access upon modify commands x86/mm: Move is_vsyscall_vaddr() into asm/vsyscall.h x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() net/iucv: fix the allocation size of iucv_path_table array parisc/ftrace: add missing CONFIG_DYNAMIC_FTRACE check block: sed-opal: handle empty atoms when parsing response dm-verity, dm-crypt: align "struct bvec_iter" correctly scsi: mpt3sas: Prevent sending diag_reset when the controller is ready Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security firewire: core: use long bus reset on gap count error ASoC: Intel: bytcr_rt5640: Add an extra entry for the Chuwi Vi8 tablet Input: gpio_keys_polled - suppress deferred probe error for gpio ASoC: wm8962: Enable oscillator if selecting WM8962_FLL_OSC ASoC: wm8962: Enable both SPKOUTR_ENA and SPKOUTL_ENA in mono mode ASoC: wm8962: Fix up incorrect error message in wm8962_set_fll x86/paravirt: Fix build due to __text_gen_insn() backport do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak nbd: null check for nla_nest_start fs/select: rework stack allocation hack for clang block: add a new set_read_only method md: implement ->set_read_only to hook into BLKROSET processing md: Don't clear MD_CLOSING when the raid is about to stop aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts timekeeping: Fix cross-timestamp interpolation on counter wrap timekeeping: Fix cross-timestamp interpolation corner case decision timekeeping: Fix cross-timestamp interpolation for non-x86 wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled wifi: b43: Stop/wake correct queue in PIO Tx path when QoS is disabled wifi: b43: Stop correct queue in DMA worker when QoS is disabled wifi: b43: Disable QoS for bcm4331 wifi: wilc1000: fix declarations ordering wifi: wilc1000: fix RCU usage in connect path wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work wifi: wilc1000: fix multi-vif management when deleting a vif wifi: mwifiex: debugfs: Drop unnecessary error check for debugfs_create_dir() cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value sock_diag: annotate data-races around sock_diag_handlers[family] inet_diag: annotate data-races around inet_diag_table[] bpftool: Silence build warning about calloc() af_unix: Annotate data-race of gc_in_progress in wait_for_unix_gc(). wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete wifi: iwlwifi: dbg-tlv: ensure NUL termination wifi: iwlwifi: fix EWRD table validity check net: blackhole_dev: fix build warning for ethh set but not used wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer() arm64: dts: mediatek: mt7622: add missing "device_type" to memory nodes bpf: Factor out bpf_spin_lock into helpers. bpf: Mark bpf_spin_{lock,unlock}() helpers with notrace correctly wireless: Remove redundant 'flush_workqueue()' calls wifi: wilc1000: prevent use-after-free on vif when cleaning up all interfaces ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() bus: tegra-aconnect: Update dependency to ARCH_TEGRA iommu/amd: Mark interrupt as managed wifi: brcmsmac: avoid function pointer casts net: ena: Remove ena_select_queue ARM: dts: arm: realview: Fix development chip ROM compatible value ARM: dts: imx6dl-yapp4: Move phy reset into switch node ARM: dts: imx6dl-yapp4: Fix typo in the QCA switch register address ARM: dts: imx6dl-yapp4: Move the internal switch PHYs under the switch node arm64: dts: marvell: reorder crypto interrupts on Armada SoCs ACPI: scan: Fix device check notification handling x86, relocs: Ignore relocations in .notes section SUNRPC: fix some memleaks in gssx_dec_option_array mmc: wmt-sdmmc: remove an incorrect release_mem_region() call in the .remove function wifi: rtw88: 8821c: Fix false alarm count PCI: Make pci_dev_is_disconnected() helper public for other drivers iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected igb: move PEROUT and EXTTS isr logic to separate functions igb: Fix missing time sync events Bluetooth: Remove superfluous call to hci_conn_check_pending() Bluetooth: hci_core: Fix possible buffer overflow sr9800: Add check for usbnet_get_endpoints bpf: Eliminate rlimit-based memory accounting for devmap maps bpf: Fix DEVMAP_HASH overflow check on 32-bit arches bpf: Fix hashtab overflow check on 32-bit arches bpf: Fix stackmap overflow check on 32-bit arches ipv6: fib6_rules: flush route cache when rule is changed net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv() net: phy: fix phy_get_internal_delay accessing an empty array net: hns3: fix port duplex configure error in IMP reset net: phy: DP83822: enable rgmii mode if phy_interface_is_rgmii net: phy: dp83822: Fix RGMII TX delay configuration OPP: debugfs: Fix warning around icc_get_name() tcp: fix incorrect parameter validation in the do_tcp_getsockopt() function net/ipv4: Replace one-element array with flexible-array member net/ipv4: Revert use of struct_size() helper net/ipv4/ipv6: Replace one-element arraya with flexible-array members bpf: net: Change do_ip_getsockopt() to take the sockptr_t argument ipmr: fix incorrect parameter validation in the ip_mroute_getsockopt() function l2tp: fix incorrect parameter validation in the pppol2tp_getsockopt() function udp: fix incorrect parameter validation in the udp_lib_getsockopt() function net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function net/x25: fix incorrect parameter validation in the x25_getsockopt() function nfp: flower: handle acti_netdevs allocation failure dm raid: fix false positive for requeue needed during reshape dm: call the resume method on internal suspend drm/tegra: dsi: Add missing check for of_find_device_by_node drm/tegra: dsi: Make use of the helper function dev_err_probe() drm/tegra: dsi: Fix some error handling paths in tegra_dsi_probe() drm/tegra: dsi: Fix missing pm_runtime_disable() in the error handling path of tegra_dsi_probe() drm/tegra: output: Fix missing i2c_put_adapter() in the error handling paths of tegra_output_probe() drm/rockchip: inno_hdmi: Fix video timing drm: Don't treat 0 as -1 in drm_fixp2int_ceil drm/rockchip: lvds: do not overwrite error code drm/rockchip: lvds: do not print scary message when probing defer drm/lima: fix a memleak in lima_heap_alloc dmaengine: tegra210-adma: Update dependency to ARCH_TEGRA media: tc358743: register v4l2 async device only after successful setup PCI/DPC: Print all TLP Prefixes, not just the first perf record: Fix possible incorrect free in record__switch_output() HID: lenovo: Add middleclick_workaround sysfs knob for cptkbd drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()' drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()' perf evsel: Fix duplicate initialization of data->id in evsel__parse_sample() media: em28xx: annotate unchecked call to media_device_register() media: v4l2-tpg: fix some memleaks in tpg_alloc media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity media: edia: dvbdev: fix a use-after-free pinctrl: mediatek: Drop bogus slew rate register range for MT8192 clk: qcom: reset: Commonize the de/assert functions clk: qcom: reset: Ensure write completion on reset de/assertion quota: simplify drop_dquot_ref() quota: Fix potential NULL pointer dereference quota: Fix rcu annotations of inode dquot pointers PCI: switchtec: Fix an error handling path in switchtec_pci_probe() crypto: xilinx - call finalize with bh disabled perf thread_map: Free strlist on normal path in thread_map__new_by_tid_str() drm/radeon/ni: Fix wrong firmware size logging in ni_init_microcode() ALSA: seq: fix function cast warnings perf stat: Avoid metric-only segv ASoC: meson: Use dev_err_probe() helper ASoC: meson: aiu: fix function pointer type mismatch ASoC: meson: t9015: fix function pointer type mismatch media: sun8i-di: Fix coefficient writes media: sun8i-di: Fix power on/off sequences media: sun8i-di: Fix chroma difference threshold media: imx: csc/scaler: fix v4l2_ctrl_handler memory leak media: go7007: add check of return value of go7007_read_addr() media: pvrusb2: remove redundant NULL check media: pvrusb2: fix pvr2_stream_callback casts clk: qcom: dispcc-sdm845: Adjust internal GDSC wait times drm/mediatek: dsi: Fix DSI RGB666 formats and definitions PCI: Mark 3ware-9650SE Root Port Extended Tags as broken clk: hisilicon: hi3519: Release the correct number of gates in hi3519_clk_unregister() drm/tegra: put drm_gem_object ref on error in tegra_fb_create mfd: syscon: Call of_node_put() only when of_parse_phandle() takes a ref mfd: altera-sysmgr: Call of_node_put() only when of_parse_phandle() takes a ref crypto: arm/sha - fix function cast warnings drm/tidss: Fix initial plane zpos values mtd: maps: physmap-core: fix flash size larger than 32-bit mtd: rawnand: lpc32xx_mlc: fix irq handler prototype ASoC: meson: axg-tdm-interface: fix mclk setup without mclk-fs ASoC: meson: axg-tdm-interface: add frame rate constraint drm/amdgpu: Fix missing break in ATOM_ARG_IMM Case of atom_get_src_int() media: pvrusb2: fix uaf in pvr2_context_set_notify media: dvb-frontends: avoid stack overflow warnings with clang media: go7007: fix a memleak in go7007_load_encoder media: ttpci: fix two memleaks in budget_av_attach media: mediatek: vcodec: avoid -Wcast-function-type-strict warning drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip powerpc/hv-gpci: Fix the H_GET_PERF_COUNTER_INFO hcall return value checks drm/msm/dpu: add division of drm_display_mode's hskew parameter powerpc/embedded6xx: Fix no previous prototype for avr_uart_send() etc. leds: aw2013: Unlock mutex before destroying it leds: sgm3140: Add missing timer cleanup and flash gpio control backlight: lm3630a: Initialize backlight_properties on init backlight: lm3630a: Don't set bl->props.brightness in get_brightness backlight: da9052: Fully initialize backlight_properties during probe backlight: lm3639: Fully initialize backlight_properties during probe backlight: lp8788: Fully initialize backlight_properties during probe sparc32: Fix section mismatch in leon_pci_grpci clk: Fix clk_core_get NULL dereference ALSA: hda/realtek: fix ALC285 issues on HP Envy x360 laptops ALSA: usb-audio: Stop parsing channels bits when all channels are found. RDMA/srpt: Do not register event handler until srpt device is fully setup f2fs: compress: fix to check unreleased compressed cluster scsi: csiostor: Avoid function pointer casts RDMA/device: Fix a race between mad_client and cm_client init scsi: bfa: Fix function pointer type mismatch for hcb_qe->cbfn net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr() NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 NFSv4.2: fix listxattr maximum XDR buffer size watchdog: stm32_iwdg: initialize default timeout NFS: Fix an off by one in root_nfs_cat() afs: Revert "afs: Hide silly-rename files from userspace" remoteproc: stm32: Constify st_rproc_ops remoteproc: Add new get_loaded_rsc_table() to rproc_ops remoteproc: stm32: Move resource table setup to rproc_ops remoteproc: stm32: use correct format strings on 64-bit remoteproc: stm32: Fix incorrect type in assignment for va remoteproc: stm32: Fix incorrect type assignment returned by stm32_rproc_get_loaded_rsc_tablef tty: vt: fix 20 vs 0x20 typo in EScsiignore serial: max310x: fix syntax error in IRQ error message tty: serial: samsung: fix tx_empty() to return TIOCSER_TEMT kconfig: fix infinite loop when expanding a macro at the end of file rtc: mt6397: select IRQ_DOMAIN instead of depending on it serial: 8250_exar: Don't remove GPIO device on suspend staging: greybus: fix get_channel_from_mode() failure path usb: gadget: net2272: Use irqflags in the call to net2272_probe_fin io_uring: don't save/restore iowait state octeontx2-af: Use matching wake_up API variant in CGX command interface s390/vtime: fix average steal time calculation soc: fsl: dpio: fix kcalloc() argument order hsr: Fix uninit-value access in hsr_get_node() packet: annotate data-races around ignore_outgoing net: dsa: mt7530: prevent possible incorrect XTAL frequency selection wireguard: receive: annotate data-race around receiving_counter.counter rds: introduce acquire/release ordering in acquire/release_in_xmit() hsr: Handle failures in module init net/bnx2x: Prevent access to a freed page in page_pool octeontx2-af: Use separate handlers for interrupts netfilter: nft_set_pipapo: release elements in clone only from destroy path scsi: fc: Update formal FPIN descriptor definitions ARM: dts: sun8i-h2-plus-bananapi-m2-zero: add regulator nodes vcc-dram and vcc1v2 netfilter: nf_tables: do not compare internal table flags on updates rcu: add a helper to report consolidated flavor QS bpf: report RCU QS in cpumap kthread spi: spi-mt65xx: Fix NULL pointer access in interrupt handler regmap: Add missing map->bus check remoteproc: stm32: fix phys_addr_t format string Linux 5.10.214 Change-Id: Iad0cc6acbf53bac96c0409ce61dc6836d83ed7bc Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-05-15 16:03:24 +00:00
Kuniyuki Iwashima	ae7c8f52aa	af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc(). [ Upstream commit 1971d13ffa84a551d29a81fdf5b5ec5be166ac83 ] syzbot reported a lockdep splat regarding unix_gc_lock and unix_state_lock(). One is called from recvmsg() for a connected socket, and another is called from GC for TCP_LISTEN socket. So, the splat is false-positive. Let's add a dedicated lock class for the latter to suppress the splat. Note that this change is not necessary for net-next.git as the issue is only applied to the old GC impl. [0]: WARNING: possible circular locking dependency detected 6.9.0-rc5-syzkaller-00007-g4d2008430ce8 #0 Not tainted ----------------------------------------------------- kworker/u8:1/11 is trying to acquire lock: ffff88807cea4e70 (&u->lock){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] ffff88807cea4e70 (&u->lock){+.+.}-{2:2}, at: __unix_gc+0x40e/0xf70 net/unix/garbage.c:302 but task is already holding lock: ffffffff8f6ab638 (unix_gc_lock){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] ffffffff8f6ab638 (unix_gc_lock){+.+.}-{2:2}, at: __unix_gc+0x117/0xf70 net/unix/garbage.c:261 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (unix_gc_lock){+.+.}-{2:2}: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] unix_notinflight+0x13d/0x390 net/unix/garbage.c:140 unix_detach_fds net/unix/af_unix.c:1819 [inline] unix_destruct_scm+0x221/0x350 net/unix/af_unix.c:1876 skb_release_head_state+0x100/0x250 net/core/skbuff.c:1188 skb_release_all net/core/skbuff.c:1200 [inline] __kfree_skb net/core/skbuff.c:1216 [inline] kfree_skb_reason+0x16d/0x3b0 net/core/skbuff.c:1252 kfree_skb include/linux/skbuff.h:1262 [inline] manage_oob net/unix/af_unix.c:2672 [inline] unix_stream_read_generic+0x1125/0x2700 net/unix/af_unix.c:2749 unix_stream_splice_read+0x239/0x320 net/unix/af_unix.c:2981 do_splice_read fs/splice.c:985 [inline] splice_file_to_pipe+0x299/0x500 fs/splice.c:1295 do_splice+0xf2d/0x1880 fs/splice.c:1379 __do_splice fs/splice.c:1436 [inline] __do_sys_splice fs/splice.c:1652 [inline] __se_sys_splice+0x331/0x4a0 fs/splice.c:1634 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #0 (&u->lock){+.+.}-{2:2}: check_prev_add kernel/locking/lockdep.c:3134 [inline] check_prevs_add kernel/locking/lockdep.c:3253 [inline] validate_chain+0x18cb/0x58e0 kernel/locking/lockdep.c:3869 __lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] __unix_gc+0x40e/0xf70 net/unix/garbage.c:302 process_one_work kernel/workqueue.c:3254 [inline] process_scheduled_works+0xa10/0x17c0 kernel/workqueue.c:3335 worker_thread+0x86d/0xd70 kernel/workqueue.c:3416 kthread+0x2f0/0x390 kernel/kthread.c:388 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(unix_gc_lock); lock(&u->lock); lock(unix_gc_lock); lock(&u->lock); * DEADLOCK * 3 locks held by kworker/u8:1/11: #0: ffff888015089148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3229 [inline] #0: ffff888015089148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x8e0/0x17c0 kernel/workqueue.c:3335 #1: ffffc90000107d00 (unix_gc_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3230 [inline] #1: ffffc90000107d00 (unix_gc_work){+.+.}-{0:0}, at: process_scheduled_works+0x91b/0x17c0 kernel/workqueue.c:3335 #2: ffffffff8f6ab638 (unix_gc_lock){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] #2: ffffffff8f6ab638 (unix_gc_lock){+.+.}-{2:2}, at: __unix_gc+0x117/0xf70 net/unix/garbage.c:261 stack backtrace: CPU: 0 PID: 11 Comm: kworker/u8:1 Not tainted 6.9.0-rc5-syzkaller-00007-g4d2008430ce8 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Workqueue: events_unbound __unix_gc Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2187 check_prev_add kernel/locking/lockdep.c:3134 [inline] check_prevs_add kernel/locking/lockdep.c:3253 [inline] validate_chain+0x18cb/0x58e0 kernel/locking/lockdep.c:3869 __lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] __unix_gc+0x40e/0xf70 net/unix/garbage.c:302 process_one_work kernel/workqueue.c:3254 [inline] process_scheduled_works+0xa10/0x17c0 kernel/workqueue.c:3335 worker_thread+0x86d/0xd70 kernel/workqueue.c:3416 kthread+0x2f0/0x390 kernel/kthread.c:388 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Fixes: 47d8ac011fe1 ("af_unix: Fix garbage collector racing against connect()") Reported-and-tested-by: syzbot+fa379358c28cc87cc307@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=fa379358c28cc87cc307 Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Link: https://lore.kernel.org/r/20240424170443.9832-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2024-05-02 16:23:43 +02:00
Kuniyuki Iwashima	14bea27d1c	af_unix: Do not use atomic ops for unix_sk(sk)->inflight. [ Upstream commit 97af84a6bba2ab2b9c704c08e67de3b5ea551bb2 ] When touching unix_sk(sk)->inflight, we are always under spin_lock(&unix_gc_lock). Let's convert unix_sk(sk)->inflight to the normal unsigned long. Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://lore.kernel.org/r/20240123170856.41348-3-kuniyu@amazon.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Stable-dep-of: 47d8ac011fe1 ("af_unix: Fix garbage collector racing against connect()") Signed-off-by: Sasha Levin <sashal@kernel.org>	2024-05-02 16:23:34 +02:00
Luiz Augusto von Dentz	b0e30c3769	Bluetooth: SCO: Fix not validating setsockopt user input [ Upstream commit 51eda36d33e43201e7a4fd35232e069b2c850b01 ] syzbot reported sco_sock_setsockopt() is copying data without checking user input length. BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline] BUG: KASAN: slab-out-of-bounds in sco_sock_setsockopt+0xc0b/0xf90 net/bluetooth/sco.c:893 Read of size 4 at addr ffff88805f7b15a3 by task syz-executor.5/12578 Fixes: `ad10b1a487` ("Bluetooth: Add Bluetooth socket voice option") Fixes: `b96e9c671b` ("Bluetooth: Add BT_DEFER_SETUP option to sco socket") Fixes: `00398e1d51` ("Bluetooth: Add support for BT_PKT_STATUS CMSG data for SCO connections") Fixes: f6873401a608 ("Bluetooth: Allow setting of codec for HFP offload use case") Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2024-05-02 16:23:34 +02:00
Jiri Benc	3fb02ec57e	ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr [ Upstream commit 7633c4da919ad51164acbf1aa322cc1a3ead6129 ] Although ipv6_get_ifaddr walks inet6_addr_lst under the RCU lock, it still means hlist_for_each_entry_rcu can return an item that got removed from the list. The memory itself of such item is not freed thanks to RCU but nothing guarantees the actual content of the memory is sane. In particular, the reference count can be zero. This can happen if ipv6_del_addr is called in parallel. ipv6_del_addr removes the entry from inet6_addr_lst (hlist_del_init_rcu(&ifp->addr_lst)) and drops all references (__in6_ifa_put(ifp) + in6_ifa_put(ifp)). With bad enough timing, this can happen: 1. In ipv6_get_ifaddr, hlist_for_each_entry_rcu returns an entry. 2. Then, the whole ipv6_del_addr is executed for the given entry. The reference count drops to zero and kfree_rcu is scheduled. 3. ipv6_get_ifaddr continues and tries to increments the reference count (in6_ifa_hold). 4. The rcu is unlocked and the entry is freed. 5. The freed entry is returned. Prevent increasing of the reference count in such case. The name in6_ifa_hold_safe is chosen to mimic the existing fib6_info_hold_safe. [ 41.506330] refcount_t: addition on 0; use-after-free. [ 41.506760] WARNING: CPU: 0 PID: 595 at lib/refcount.c:25 refcount_warn_saturate+0xa5/0x130 [ 41.507413] Modules linked in: veth bridge stp llc [ 41.507821] CPU: 0 PID: 595 Comm: python3 Not tainted 6.9.0-rc2.main-00208-g49563be82afa #14 [ 41.508479] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) [ 41.509163] RIP: 0010:refcount_warn_saturate+0xa5/0x130 [ 41.509586] Code: ad ff 90 0f 0b 90 90 c3 cc cc cc cc 80 3d c0 30 ad 01 00 75 a0 c6 05 b7 30 ad 01 01 90 48 c7 c7 38 cc 7a 8c e8 cc 18 ad ff 90 <0f> 0b 90 90 c3 cc cc cc cc 80 3d 98 30 ad 01 00 0f 85 75 ff ff ff [ 41.510956] RSP: 0018:ffffbda3c026baf0 EFLAGS: 00010282 [ 41.511368] RAX: 0000000000000000 RBX: ffff9e9c46914800 RCX: 0000000000000000 [ 41.511910] RDX: ffff9e9c7ec29c00 RSI: ffff9e9c7ec1c900 RDI: ffff9e9c7ec1c900 [ 41.512445] RBP: ffff9e9c43660c9c R08: 0000000000009ffb R09: 00000000ffffdfff [ 41.512998] R10: 00000000ffffdfff R11: ffffffff8ca58a40 R12: ffff9e9c4339a000 [ 41.513534] R13: 0000000000000001 R14: ffff9e9c438a0000 R15: ffffbda3c026bb48 [ 41.514086] FS: 00007fbc4cda1740(0000) GS:ffff9e9c7ec00000(0000) knlGS:0000000000000000 [ 41.514726] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 41.515176] CR2: 000056233b337d88 CR3: 000000000376e006 CR4: 0000000000370ef0 [ 41.515713] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 41.516252] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 41.516799] Call Trace: [ 41.517037] <TASK> [ 41.517249] ? __warn+0x7b/0x120 [ 41.517535] ? refcount_warn_saturate+0xa5/0x130 [ 41.517923] ? report_bug+0x164/0x190 [ 41.518240] ? handle_bug+0x3d/0x70 [ 41.518541] ? exc_invalid_op+0x17/0x70 [ 41.520972] ? asm_exc_invalid_op+0x1a/0x20 [ 41.521325] ? refcount_warn_saturate+0xa5/0x130 [ 41.521708] ipv6_get_ifaddr+0xda/0xe0 [ 41.522035] inet6_rtm_getaddr+0x342/0x3f0 [ 41.522376] ? __pfx_inet6_rtm_getaddr+0x10/0x10 [ 41.522758] rtnetlink_rcv_msg+0x334/0x3d0 [ 41.523102] ? netlink_unicast+0x30f/0x390 [ 41.523445] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 41.523832] netlink_rcv_skb+0x53/0x100 [ 41.524157] netlink_unicast+0x23b/0x390 [ 41.524484] netlink_sendmsg+0x1f2/0x440 [ 41.524826] __sys_sendto+0x1d8/0x1f0 [ 41.525145] __x64_sys_sendto+0x1f/0x30 [ 41.525467] do_syscall_64+0xa5/0x1b0 [ 41.525794] entry_SYSCALL_64_after_hwframe+0x72/0x7a [ 41.526213] RIP: 0033:0x7fbc4cfcea9a [ 41.526528] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89 [ 41.527942] RSP: 002b:00007ffcf54012a8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 41.528593] RAX: ffffffffffffffda RBX: 00007ffcf5401368 RCX: 00007fbc4cfcea9a [ 41.529173] RDX: 000000000000002c RSI: 00007fbc4b9d9bd0 RDI: 0000000000000005 [ 41.529786] RBP: 00007fbc4bafb040 R08: 00007ffcf54013e0 R09: 000000000000000c [ 41.530375] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 41.530977] R13: ffffffffc4653600 R14: 0000000000000001 R15: 00007fbc4ca85d1b [ 41.531573] </TASK> Fixes: `5c578aedcb` ("IPv6: convert addrconf hash list to RCU") Reviewed-by: Eric Dumazet <edumazet@google.com> Reviewed-by: David Ahern <dsahern@kernel.org> Signed-off-by: Jiri Benc <jbenc@redhat.com> Link: https://lore.kernel.org/r/8ab821e36073a4a406c50ec83c9e8dc586c539e4.1712585809.git.jbenc@redhat.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2024-05-02 16:23:34 +02:00
Eric Dumazet	10204df9be	geneve: fix header validation in geneve[6]_xmit_skb [ Upstream commit d8a6213d70accb403b82924a1c229e733433a5ef ] syzbot is able to trigger an uninit-value in geneve_xmit() [1] Problem : While most ip tunnel helpers (like ip_tunnel_get_dsfield()) uses skb_protocol(skb, true), pskb_inet_may_pull() is only using skb->protocol. If anything else than ETH_P_IPV6 or ETH_P_IP is found in skb->protocol, pskb_inet_may_pull() does nothing at all. If a vlan tag was provided by the caller (af_packet in the syzbot case), the network header might not point to the correct location, and skb linear part could be smaller than expected. Add skb_vlan_inet_prepare() to perform a complete mac validation. Use this in geneve for the moment, I suspect we need to adopt this more broadly. v4 - Jakub reported v3 broke l2_tos_ttl_inherit.sh selftest - Only call __vlan_get_protocol() for vlan types. Link: https://lore.kernel.org/netdev/20240404100035.3270a7d5@kernel.org/ v2,v3 - Addressed Sabrina comments on v1 and v2 Link: https://lore.kernel.org/netdev/Zg1l9L2BNoZWZDZG@hog/ [1] BUG: KMSAN: uninit-value in geneve_xmit_skb drivers/net/geneve.c:910 [inline] BUG: KMSAN: uninit-value in geneve_xmit+0x302d/0x5420 drivers/net/geneve.c:1030 geneve_xmit_skb drivers/net/geneve.c:910 [inline] geneve_xmit+0x302d/0x5420 drivers/net/geneve.c:1030 __netdev_start_xmit include/linux/netdevice.h:4903 [inline] netdev_start_xmit include/linux/netdevice.h:4917 [inline] xmit_one net/core/dev.c:3531 [inline] dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3547 __dev_queue_xmit+0x348d/0x52c0 net/core/dev.c:4335 dev_queue_xmit include/linux/netdevice.h:3091 [inline] packet_xmit+0x9c/0x6c0 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3081 [inline] packet_sendmsg+0x8bb0/0x9ef0 net/packet/af_packet.c:3113 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 __sys_sendto+0x685/0x830 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x125/0x1d0 net/socket.c:2199 do_syscall_64+0xd5/0x1f0 entry_SYSCALL_64_after_hwframe+0x6d/0x75 Uninit was created at: slab_post_alloc_hook mm/slub.c:3804 [inline] slab_alloc_node mm/slub.c:3845 [inline] kmem_cache_alloc_node+0x613/0xc50 mm/slub.c:3888 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:577 __alloc_skb+0x35b/0x7a0 net/core/skbuff.c:668 alloc_skb include/linux/skbuff.h:1318 [inline] alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6504 sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2795 packet_alloc_skb net/packet/af_packet.c:2930 [inline] packet_snd net/packet/af_packet.c:3024 [inline] packet_sendmsg+0x722d/0x9ef0 net/packet/af_packet.c:3113 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 __sys_sendto+0x685/0x830 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x125/0x1d0 net/socket.c:2199 do_syscall_64+0xd5/0x1f0 entry_SYSCALL_64_after_hwframe+0x6d/0x75 CPU: 0 PID: 5033 Comm: syz-executor346 Not tainted 6.9.0-rc1-syzkaller-00005-g928a87efa423 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 Fixes: d13f048dd40e ("net: geneve: modify IP header check in geneve6_xmit_skb and geneve_xmit_skb") Reported-by: syzbot+9ee20ec1de7b3168db09@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/000000000000d19c3a06152f9ee4@google.com/ Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Phillip Potter <phil@philpotter.co.uk> Cc: Sabrina Dubroca <sd@queasysnail.net> Reviewed-by: Sabrina Dubroca <sd@queasysnail.net> Reviewed-by: Phillip Potter <phil@philpotter.co.uk> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>	2024-05-02 16:23:34 +02:00
Greg Kroah-Hartman	67b086c845	Revert "mptcp: fix lockless access in subflow ULP diag" This reverts commit `8affdbb3e2` which is commit b8adb69a7d29c2d33eb327bca66476fb6066516b upstream. It breaks the Android kernel abi and can be brought back in the future in an abi-safe way if it is really needed. Bug: 161946584 Change-Id: Ib22d4d7d600994c79e87c929870ba31cc5a4aad3 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-04-30 14:27:29 +00:00
Greg Kroah-Hartman	e92b643b4b	Merge 5.10.211 into android12-5.10-lts Changes in 5.10.211 net/sched: Retire CBQ qdisc net/sched: Retire ATM qdisc net/sched: Retire dsmark qdisc smb: client: fix OOB in receive_encrypted_standard() smb: client: fix potential OOBs in smb2_parse_contexts() smb: client: fix parsing of SMB3.1.1 POSIX create context sched/rt: sysctl_sched_rr_timeslice show default timeslice after reset userfaultfd: fix mmap_changing checking in mfill_atomic_hugetlb zonefs: Improve error handling sched/rt: Fix sysctl_sched_rr_timeslice intial value sched/rt: Disallow writing invalid values to sched_rt_period_us scsi: target: core: Add TMF to tmr_list handling dmaengine: shdma: increase size of 'dev_id' dmaengine: fsl-qdma: increase size of 'irq_name' wifi: cfg80211: fix missing interfaces when dumping wifi: mac80211: fix race condition on enabling fast-xmit fbdev: savage: Error out if pixclock equals zero fbdev: sis: Error out if pixclock equals zero spi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected ahci: asm1166: correct count of reported ports ahci: add 43-bit DMA address quirk for ASMedia ASM1061 controllers ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() dmaengine: ti: edma: Add some null pointer checks to the edma_probe regulator: pwm-regulator: Add validity checks in continuous .get_voltage nvmet-tcp: fix nvme tcp ida memory leak ASoC: sunxi: sun4i-spdif: Add support for Allwinner H616 spi: sh-msiof: avoid integer overflow in constants netfilter: conntrack: check SCTP_CID_SHUTDOWN_ACK for vtag setting in sctp_new nvme-fc: do not wait in vain when unloading module nvmet-fcloop: swap the list_add_tail arguments nvmet-fc: release reference on target port nvmet-fc: abort command when there is no binding ext4: correct the hole length returned by ext4_map_blocks() Input: i8042 - add Fujitsu Lifebook U728 to i8042 quirk table efi: runtime: Fix potential overflow of soft-reserved region size efi: Don't add memblocks for soft-reserved memory hwmon: (coretemp) Enlarge per package core count limit scsi: lpfc: Use unsigned type for num_sge firewire: core: send bus reset promptly on gap count error virtio-blk: Ensure no requests in virtqueues before deleting vqs. pmdomain: renesas: r8a77980-sysc: CR7 must be always on ARM: dts: BCM53573: Drop nonexistent "default-off" LED trigger irqchip/mips-gic: Don't touch vl_map if a local interrupt is not routable ARM: dts: imx: Set default tuning step for imx6sx usdhc ASoC: fsl_micfil: register platform component before registering cpu dai media: av7110: prevent underflow in write_ts_to_decoder() hvc/xen: prevent concurrent accesses to the shared ring hsr: Avoid double remove of a node. x86/uaccess: Implement macros for CMPXCHG on user addresses seccomp: Invalidate seccomp mode to catch death failures block: ataflop: fix breakage introduced at blk-mq refactoring powerpc/watchpoint: Workaround P10 DD1 issue with VSX-32 byte instructions powerpc/watchpoints: Annotate atomic context in more places cifs: add a warning when the in-flight count goes negative mtd: spinand: macronix: Add support for MX35LFxGE4AD ASoC: Intel: boards: harden codec property handling ASoC: Intel: boards: get codec device with ACPI instead of bus search ASoC: Intel: bytcr_rt5651: Drop reference count of ACPI device after use task_stack, x86/cea: Force-inline stack helpers btrfs: tree-checker: check for overlapping extent items btrfs: introduce btrfs_lookup_match_dir btrfs: unify lookup return value when dir entry is missing btrfs: do not pin logs too early during renames lan743x: fix for potential NULL pointer dereference with bare card platform/x86: intel-vbtn: Support for tablet mode on HP Pavilion 13 x360 PC iwlwifi: mvm: do more useful queue sync accounting iwlwifi: mvm: write queue_sync_state only for sync jbd2: remove redundant buffer io error checks jbd2: recheck chechpointing non-dirty buffer jbd2: Fix wrongly judgement for buffer head removing while doing checkpoint x86: drop bogus "cc" clobber from __try_cmpxchg_user_asm() erofs: fix lz4 inplace decompression IB/hfi1: Fix sdma.h tx->num_descs off-by-one error s390/cio: fix invalid -EBUSY on ccw_device_start dm-crypt: don't modify the data when using authenticated encryption KVM: arm64: vgic-its: Test for valid IRQ in MOVALL handler KVM: arm64: vgic-its: Test for valid IRQ in its_sync_lpi_pending_table() gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp() PCI/MSI: Prevent MSI hardware interrupt number truncation l2tp: pass correct message length to ip6_append_data ARM: ep93xx: Add terminator to gpiod_lookup_table Revert "x86/ftrace: Use alternative RET encoding" x86/text-patching: Make text_gen_insn() play nice with ANNOTATE_NOENDBR x86/ibt,paravirt: Use text_gen_insn() for paravirt_patch() x86/ftrace: Use alternative RET encoding x86/returnthunk: Allow different return thunks Revert "x86/alternative: Make custom return thunk unconditional" x86/alternative: Make custom return thunk unconditional usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable() usb: cdns3: fix memory double free when handle zero packet usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs usb: roles: fix NULL pointer issue when put module's reference usb: roles: don't get/set_role() when usb_role_switch is unregistered mptcp: fix lockless access in subflow ULP diag IB/hfi1: Fix a memleak in init_credit_return RDMA/bnxt_re: Return error for SRQ resize RDMA/srpt: Support specifying the srpt_service_guid parameter RDMA/qedr: Fix qedr_create_user_qp error flow arm64: dts: rockchip: set num-cs property for spi on px30 RDMA/srpt: fix function pointer cast warnings bpf, scripts: Correct GPL license name scsi: jazz_esp: Only build if SCSI core is builtin nouveau: fix function cast warnings ipv4: properly combine dev_base_seq and ipv4.dev_addr_genid ipv6: properly combine dev_base_seq and ipv6.dev_addr_genid afs: Increase buffer size in afs_update_volume_status() ipv6: sr: fix possible use-after-free and null-ptr-deref packet: move from strlcpy with unused retval to strscpy net: dev: Convert sa_data to flexible array in struct sockaddr s390: use the correct count for __iowrite64_copy() tls: rx: jump to a more appropriate label tls: rx: drop pointless else after goto tls: stop recv() if initial process_rx_list gave us non-DATA netfilter: nf_tables: set dormant flag on hook register failure drm/syncobj: make lockdep complain on WAIT_FOR_SUBMIT v3 drm/syncobj: call drm_syncobj_fence_add_wait when WAIT_AVAILABLE flag is set drm/amd/display: Fix memory leak in dm_sw_fini() block: ataflop: more blk-mq refactoring fixes fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio arp: Prevent overflow in arp_req_get(). ext4: regenerate buddy after block freeing failed if under fc replay Linux 5.10.211 Note, this merges away the following commit: `a0180e940c` ("erofs: fix lz4 inplace decompression") as it conflicted too badly with the existing erofs changes in this branch that are not upstream. If it is needed, it can be brought back in the future in a safe way. Change-Id: I432a4a0964e0708d2cd337872ad75d57cbf92cce Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-04-16 15:38:10 +00:00
Eric Dumazet	e3e27d2b44	tcp: properly terminate timers for kernel sockets [ Upstream commit 151c9c724d05d5b0dd8acd3e11cb69ef1f2dbada ] We had various syzbot reports about tcp timers firing after the corresponding netns has been dismantled. Fortunately Josef Bacik could trigger the issue more often, and could test a patch I wrote two years ago. When TCP sockets are closed, we call inet_csk_clear_xmit_timers() to 'stop' the timers. inet_csk_clear_xmit_timers() can be called from any context, including when socket lock is held. This is the reason it uses sk_stop_timer(), aka del_timer(). This means that ongoing timers might finish much later. For user sockets, this is fine because each running timer holds a reference on the socket, and the user socket holds a reference on the netns. For kernel sockets, we risk that the netns is freed before timer can complete, because kernel sockets do not hold reference on the netns. This patch adds inet_csk_clear_xmit_timers_sync() function that using sk_stop_timer_sync() to make sure all timers are terminated before the kernel socket is released. Modules using kernel sockets close them in their netns exit() handler. Also add sock_not_owned_by_me() helper to get LOCKDEP support : inet_csk_clear_xmit_timers_sync() must not be called while socket lock is held. It is very possible we can revert in the future commit 3a58f13a881e ("net: rds: acquire refcount on TCP sockets") which attempted to solve the issue in rds only. (net/smc/af_smc.c and net/mptcp/subflow.c have similar code) We probably can remove the check_net() tests from tcp_out_of_resources() and __tcp_close() in the future. Reported-by: Josef Bacik <josef@toxicpanda.com> Closes: https://lore.kernel.org/netdev/20240314210740.GA2823176@perftesting/ Fixes: `26abe14379` ("net: Modify sk_alloc to not reference count the netns of kernel sockets.") Fixes: `8a68173691` ("net: sk_clone_lock() should only do get_net() if the parent is not a kernel socket") Link: https://lore.kernel.org/bpf/CANn89i+484ffqb93aQm1N-tjxxvb3WDKX0EbD7318RwRgsatjw@mail.gmail.com/ Signed-off-by: Eric Dumazet <edumazet@google.com> Tested-by: Josef Bacik <josef@toxicpanda.com> Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Link: https://lore.kernel.org/r/20240322135732.1535772-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2024-04-13 12:59:15 +02:00
Fedor Pchelkin	068ab2759b	mac802154: fix llsec key resources release in mac802154_llsec_key_del [ Upstream commit e8a1e58345cf40b7b272e08ac7b32328b2543e40 ] mac802154_llsec_key_del() can free resources of a key directly without following the RCU rules for waiting before the end of a grace period. This may lead to use-after-free in case llsec_lookup_key() is traversing the list of keys in parallel with a key deletion: refcount_t: addition on 0; use-after-free. WARNING: CPU: 4 PID: 16000 at lib/refcount.c:25 refcount_warn_saturate+0x162/0x2a0 Modules linked in: CPU: 4 PID: 16000 Comm: wpan-ping Not tainted 6.7.0 #19 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 RIP: 0010:refcount_warn_saturate+0x162/0x2a0 Call Trace: <TASK> llsec_lookup_key.isra.0+0x890/0x9e0 mac802154_llsec_encrypt+0x30c/0x9c0 ieee802154_subif_start_xmit+0x24/0x1e0 dev_hard_start_xmit+0x13e/0x690 sch_direct_xmit+0x2ae/0xbc0 __dev_queue_xmit+0x11dd/0x3c20 dgram_sendmsg+0x90b/0xd60 __sys_sendto+0x466/0x4c0 __x64_sys_sendto+0xe0/0x1c0 do_syscall_64+0x45/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 Also, ieee802154_llsec_key_entry structures are not freed by mac802154_llsec_key_del(): unreferenced object 0xffff8880613b6980 (size 64): comm "iwpan", pid 2176, jiffies 4294761134 (age 60.475s) hex dump (first 32 bytes): 78 0d 8f 18 80 88 ff ff 22 01 00 00 00 00 ad de x......."....... 00 00 00 00 00 00 00 00 03 00 cd ab 00 00 00 00 ................ backtrace: [<ffffffff81dcfa62>] __kmem_cache_alloc_node+0x1e2/0x2d0 [<ffffffff81c43865>] kmalloc_trace+0x25/0xc0 [<ffffffff88968b09>] mac802154_llsec_key_add+0xac9/0xcf0 [<ffffffff8896e41a>] ieee802154_add_llsec_key+0x5a/0x80 [<ffffffff8892adc6>] nl802154_add_llsec_key+0x426/0x5b0 [<ffffffff86ff293e>] genl_family_rcv_msg_doit+0x1fe/0x2f0 [<ffffffff86ff46d1>] genl_rcv_msg+0x531/0x7d0 [<ffffffff86fee7a9>] netlink_rcv_skb+0x169/0x440 [<ffffffff86ff1d88>] genl_rcv+0x28/0x40 [<ffffffff86fec15c>] netlink_unicast+0x53c/0x820 [<ffffffff86fecd8b>] netlink_sendmsg+0x93b/0xe60 [<ffffffff86b91b35>] ____sys_sendmsg+0xac5/0xca0 [<ffffffff86b9c3dd>] ___sys_sendmsg+0x11d/0x1c0 [<ffffffff86b9c65a>] __sys_sendmsg+0xfa/0x1d0 [<ffffffff88eadbf5>] do_syscall_64+0x45/0xf0 [<ffffffff890000ea>] entry_SYSCALL_64_after_hwframe+0x6e/0x76 Handle the proper resource release in the RCU callback function mac802154_llsec_key_del_rcu(). Note that if llsec_lookup_key() finds a key, it gets a refcount via llsec_key_get() and locally copies key id from key_entry (which is a list element). So it's safe to call llsec_key_put() and free the list entry after the RCU grace period elapses. Found by Linux Verification Center (linuxtesting.org). Fixes: `5d637d5aab` ("mac802154: add llsec structures and mutators") Cc: stable@vger.kernel.org Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru> Acked-by: Alexander Aring <aahringo@redhat.com> Message-ID: <20240228163840.6667-1-pchelkin@ispras.ru> Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2024-04-13 12:58:25 +02:00
Greg Kroah-Hartman	66e91da883	This is the 5.10.210 stable release -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmXYTLkACgkQONu9yGCS aT4+fhAAqqR/Cvx53ZKMQ8GZTCudAZnr/Dz6kWYwxhhhIbQjDpCaf9mgsrEDaQS2 ancSZjzYaOUIXq/IsthXxQIUhiZbuM3iuSEi7+odWgSYdkFyzuUt8MWLBGSaB5Er ojn+APtq7vPXTSnp7uMwqMC3/BHCKkeYIjRVevhhHBKG5d3lzkV1xU8NcvMkLaly CIRxpWXD3w2b7K0GEbb/zN1GQEHDCQcxjuaJoe/5FKGJkqd3T31eyiJTRumCCMcz j8vkGkYmcMJpWf04iLgVA1p13I5/HGrXdEBI/GutN8IABIC3Cp42jW8phHYKW5ZM a4R25LZG5buND1Ubpq+EDrYn3EaPek5XRki0w8ZAXfNa3rYc+N6mQjkzNSOzhJ/5 VNsn3EAE1Dwtar5Z3ASe9ugDbh+0bgx85PbfaADK88V+qWb3DVr1TBWmDNu2vfVP rv4I0EKu9r3vOE8aNMEBuhAVkIK3mEQUxwab6RKNrMby/5Uwa+ugrrUtQd8V+T1S j6r6v7u7aZ8mhYO7d6WSvAKL85lCWGbs3WRIKCJZmDRyqWrWW9tVWRN9wrZ2QnRr iaCQKk8P474P7/j1zwnmih8l4wS1oszveNziWwd0fi1Nn/WQYM+JKYQvpuQijmQ+ J9jLyWo7a59zffIE6mzJdNwFy9hlw9X+VnJmExk/Q88Z7Bt5wPQ= =laYd -----END PGP SIGNATURE----- Merge 5.10.210 into android12-5.10-lts Changes in 5.10.210 usb: cdns3: Fixes for sparse warnings usb: cdns3: fix uvc failure work since sg support enabled usb: cdns3: fix incorrect calculation of ep_buf_size when more than one config usb: cdns3: fix iso transfer error when mult is not zero usb: cdns3: Fix uvc fail when DMA cross 4k boundery since sg enabled PCI: mediatek: Clear interrupt status before dispatching handler units: change from 'L' to 'UL' units: add the HZ macros serial: sc16is7xx: set safe default SPI clock frequency spi: introduce SPI_MODE_X_MASK macro serial: sc16is7xx: add check for unsupported SPI modes during probe iio: adc: ad7091r: Set alert bit in config register iio: adc: ad7091r: Allow users to configure device events iio: adc: ad7091r: Enable internal vref if external vref is not supplied dmaengine: fix NULL pointer in channel unregistration function iio:adc:ad7091r: Move exports into IIO_AD7091R namespace. ext4: allow for the last group to be marked as trimmed crypto: api - Disallow identical driver names PM: hibernate: Enforce ordering during image compression/decompression hwrng: core - Fix page fault dead lock on mmap-ed hwrng crypto: s390/aes - Fix buffer overread in CTR mode rpmsg: virtio: Free driver_override when rpmsg_remove() bus: mhi: host: Drop chan lock before queuing buffers parisc/firmware: Fix F-extend for PDC addresses async: Split async_schedule_node_domain() async: Introduce async_schedule_dev_nocall() arm64: dts: qcom: sdm845: fix USB wakeup interrupt types arm64: dts: qcom: sdm845: fix USB DP/DM HS PHY interrupts lsm: new security_file_ioctl_compat() hook scripts/get_abi: fix source path leak mmc: core: Use mrq.sbc in close-ended ffu mmc: mmc_spi: remove custom DMA mapped buffers rtc: Adjust failure return code for cmos_set_alarm() nouveau/vmm: don't set addr on the fail path to avoid warning ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path rename(): fix the locking of subdirectories block: Remove special-casing of compound pages stddef: Introduce DECLARE_FLEX_ARRAY() helper smb3: Replace smb2pdu 1-element arrays with flex-arrays mm: vmalloc: introduce array allocation functions KVM: use __vcalloc for very large allocations net/smc: fix illegal rmb_desc access in SMC-D connection dump tcp: make sure init the accept_queue's spinlocks once bnxt_en: Wait for FLR to complete during probe vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING llc: make llc_ui_sendmsg() more robust against bonding changes llc: Drop support for ETH_P_TR_802_2. net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv tracing: Ensure visibility when inserting an element into tracing_map afs: Hide silly-rename files from userspace tcp: Add memory barrier to tcp_push() netlink: fix potential sleeping issue in mqueue_flush_file ipv6: init the accept_queue's spinlocks in inet6_create net/mlx5: DR, Use the right GVMI number for drop action net/mlx5e: fix a double-free in arfs_create_groups netfilter: nf_tables: restrict anonymous set and map names to 16 bytes netfilter: nf_tables: validate NFPROTO_* family net: mvpp2: clear BM pool before initialization selftests: netdevsim: fix the udp_tunnel_nic test fjes: fix memleaks in fjes_hw_setup net: fec: fix the unhandled context fault from smmu btrfs: ref-verify: free ref cache before clearing mount opt btrfs: tree-checker: fix inline ref size in error messages btrfs: don't warn if discard range is not aligned to sector btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args btrfs: don't abort filesystem when attempting to snapshot deleted subvolume rbd: don't move requests to the running list on errors exec: Fix error handling in begin_new_exec() wifi: iwlwifi: fix a memory corruption netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain netfilter: nf_tables: reject QUEUE/DROP verdict parameters gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-04 drm: Don't unref the same fb many times by mistake due to deadlock handling drm/bridge: nxp-ptn3460: fix i2c_master_send() error checking drm/tidss: Fix atomic_flush check drm/bridge: nxp-ptn3460: simplify some error checking PM: sleep: Use dev_printk() when possible PM: sleep: Avoid calling put_device() under dpm_list_mtx PM: core: Remove unnecessary (void ) conversions PM: sleep: Fix possible deadlocks in core system-wide PM code fs/pipe: move check to pipe_has_watch_queue() pipe: wakeup wr_wait after setting max_usage ARM: dts: samsung: exynos4210-i9100: Unconditionally enable LDO12 arm64: dts: qcom: sc7180: Use pdc interrupts for USB instead of GIC interrupts arm64: dts: qcom: sc7180: fix USB wakeup interrupt types media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run mm: use __pfn_to_section() instead of open coding it mm/sparsemem: fix race in accessing memory_section->usage btrfs: remove err variable from btrfs_delete_subvolume btrfs: avoid copying BTRFS_ROOT_SUBVOL_DEAD flag to snapshot of subvolume being deleted drm: panel-simple: add missing bus flags for Tianma tm070jvhg[30/33] drm/exynos: fix accidental on-stack copy of exynos_drm_plane drm/exynos: gsc: minor fix for loop iteration in gsc_runtime_resume gpio: eic-sprd: Clear interrupt after set the interrupt type spi: bcm-qspi: fix SFDP BFPT read by usig mspi read mips: Call lose_fpu(0) before initializing fcr31 in mips_set_personality_nan tick/sched: Preserve number of idle sleeps across CPU hotplug events x86/entry/ia32: Ensure s32 is sign extended to s64 powerpc/mm: Fix null-pointer dereference in pgtable_cache_add drivers/perf: pmuv3: don't expose SW_INCR event in sysfs powerpc: Fix build error due to is_valid_bugaddr() powerpc/mm: Fix build failures due to arch_reserved_kernel_pages() x86/boot: Ignore NMIs during very early boot powerpc: pmd_move_must_withdraw() is only needed for CONFIG_TRANSPARENT_HUGEPAGE powerpc/lib: Validate size for vector operations x86/mce: Mark fatal MCE's page as poison to avoid panic in the kdump kernel perf/core: Fix narrow startup race when creating the perf nr_addr_filters sysfs file debugobjects: Stop accessing objects after releasing hash bucket lock regulator: core: Only increment use_count when enable_count changes audit: Send netlink ACK before setting connection in auditd_set ACPI: video: Add quirk for the Colorful X15 AT 23 Laptop PNP: ACPI: fix fortify warning ACPI: extlog: fix NULL pointer dereference check PM / devfreq: Synchronize devfreq_monitor_[start/stop] ACPI: APEI: set memory failure flags as MF_ACTION_REQUIRED on synchronous events FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree UBSAN: array-index-out-of-bounds in dtSplitRoot jfs: fix slab-out-of-bounds Read in dtSearch jfs: fix array-index-out-of-bounds in dbAdjTree jfs: fix uaf in jfs_evict_inode pstore/ram: Fix crash when setting number of cpus to an odd number crypto: stm32/crc32 - fix parsing list of devices afs: fix the usage of read_seqbegin_or_lock() in afs_lookup_volume_rcu() afs: fix the usage of read_seqbegin_or_lock() in afs_find_server() rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock() jfs: fix array-index-out-of-bounds in diNewExt s390/ptrace: handle setting of fpc register correctly KVM: s390: fix setting of fpc register SUNRPC: Fix a suspicious RCU usage warning ecryptfs: Reject casefold directory inodes ext4: fix inconsistent between segment fstrim and full fstrim ext4: unify the type of flexbg_size to unsigned int ext4: remove unnecessary check from alloc_flex_gd() ext4: avoid online resizing failures due to oversized flex bg wifi: rt2x00: restart beacon queue when hardware reset selftests/bpf: satisfy compiler by having explicit return in btf test selftests/bpf: Fix pyperf180 compilation failure with clang18 scsi: lpfc: Fix possible file string name overflow when updating firmware PCI: Add no PM reset quirk for NVIDIA Spectrum devices bonding: return -ENOMEM instead of BUG in alb_upper_dev_walk scsi: arcmsr: Support new PCI device IDs 1883 and 1886 ARM: dts: imx7d: Fix coresight funnel ports ARM: dts: imx7s: Fix lcdif compatible ARM: dts: imx7s: Fix nand-controller #size-cells wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() bpf: Add map and need_defer parameters to .map_fd_put_ptr() scsi: libfc: Don't schedule abort twice scsi: libfc: Fix up timeout error in fc_fcp_rec_error() bpf: Set uattr->batch.count as zero before batched update or deletion ARM: dts: rockchip: fix rk3036 hdmi ports node ARM: dts: imx25/27-eukrea: Fix RTC node name ARM: dts: imx: Use flash@0,0 pattern ARM: dts: imx27: Fix sram node ARM: dts: imx1: Fix sram node ionic: pass opcode to devcmd_wait block/rnbd-srv: Check for unlikely string overflow ARM: dts: imx25: Fix the iim compatible string ARM: dts: imx25/27: Pass timing0 ARM: dts: imx27-apf27dev: Fix LED name ARM: dts: imx23-sansa: Use preferred i2c-gpios properties ARM: dts: imx23/28: Fix the DMA controller node name net: dsa: mv88e6xxx: Fix mv88e6352_serdes_get_stats error path block: prevent an integer overflow in bvec_try_merge_hw_page md: Whenassemble the array, consult the superblock of the freshest device arm64: dts: qcom: msm8996: Fix 'in-ports' is a required property arm64: dts: qcom: msm8998: Fix 'out-ports' is a required property wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift() wifi: cfg80211: free beacon_ies when overridden from hidden BSS Bluetooth: qca: Set both WIDEBAND_SPEECH and LE_STATES quirks for QCA2066 Bluetooth: L2CAP: Fix possible multiple reject send i40e: Fix VF disable behavior to block all traffic f2fs: fix to check return value of f2fs_reserve_new_block() ALSA: hda: Refer to correct stream index at loops ASoC: doc: Fix undefined SND_SOC_DAPM_NOPM argument fast_dput(): handle underflows gracefully RDMA/IPoIB: Fix error code return in ipoib_mcast_join drm/amd/display: Fix tiled display misalignment f2fs: fix write pointers on zoned device after roll forward drm/drm_file: fix use of uninitialized variable drm/framebuffer: Fix use of uninitialized variable drm/mipi-dsi: Fix detach call without attach media: stk1160: Fixed high volume of stk1160_dbg messages media: rockchip: rga: fix swizzling for RGB formats PCI: add INTEL_HDA_ARL to pci_ids.h ALSA: hda: Intel: add HDA_ARL PCI ID support ALSA: hda: intel-dspcfg: add filters for ARL-S and ARL drm/exynos: Call drm_atomic_helper_shutdown() at shutdown/unbind time IB/ipoib: Fix mcast list locking media: ddbridge: fix an error code problem in ddb_probe drm/msm/dpu: Ratelimit framedone timeout msgs clk: hi3620: Fix memory leak in hi3620_mmc_clk_init() clk: mmp: pxa168: Fix memory leak in pxa168_clk_init() watchdog: it87_wdt: Keep WDTCTRL bit 3 unmodified for IT8784/IT8786 drm/amdgpu: Let KFD sync with VM fences drm/amdgpu: Drop 'fence' check in 'to_amdgpu_amdkfd_fence()' leds: trigger: panic: Don't register panic notifier if creating the trigger failed um: Fix naming clash between UML and scheduler um: Don't use vfprintf() for os_info() um: net: Fix return type of uml_net_start_xmit() i3c: master: cdns: Update maximum prescaler value for i2c clock xen/gntdev: Fix the abuse of underlying struct page in DMA-buf import mfd: ti_am335x_tscadc: Fix TI SoC dependencies PCI: Only override AMD USB controller if required PCI: switchtec: Fix stdev_release() crash after surprise hot remove usb: hub: Replace hardcoded quirk value with BIT() macro tty: allow TIOCSLCKTRMIOS with CAP_CHECKPOINT_RESTORE fs/kernfs/dir: obey S_ISGID PCI/AER: Decode Requester ID when no error info found libsubcmd: Fix memory leak in uniq() virtio_net: Fix "‘%d’ directive writing between 1 and 11 bytes into a region of size 10" warnings blk-mq: fix IO hang from sbitmap wakeup race ceph: fix deadlock or deadcode of misusing dget() drm/amd/powerplay: Fix kzalloc parameter 'ATOM_Tonga_PPM_Table' in 'get_platform_power_management_table()' drm/amdgpu: Release 'adev->pm.fw' before return in 'amdgpu_device_need_post()' perf: Fix the nr_addr_filters fix wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update drm: using mul_u32_u32() requires linux/math64.h scsi: isci: Fix an error code problem in isci_io_request_build() scsi: core: Introduce enum scsi_disposition scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler ip6_tunnel: use dev_sw_netstats_rx_add() ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv() net-zerocopy: Refactor frag-is-remappable test. tcp: add sanity checks to rx zerocopy ixgbe: Remove non-inclusive language ixgbe: Refactor returning internal error codes ixgbe: Refactor overtemp event handling ixgbe: Fix an error handling path in ixgbe_read_iosf_sb_reg_x550() ipv6: Ensure natural alignment of const ipv6 loopback and router addresses llc: call sock_orphan() at release time netfilter: nf_log: replace BUG_ON by WARN_ON_ONCE when putting logger netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations net: ipv4: fix a memleak in ip_setup_cork af_unix: fix lockdep positive in sk_diag_dump_icons() net: sysfs: Fix /sys/class/net/<iface> path HID: apple: Add support for the 2021 Magic Keyboard HID: apple: Add 2021 magic keyboard FN key mapping bonding: remove print in bond_verify_device_path uapi: stddef.h: Fix __DECLARE_FLEX_ARRAY for C++ PM: sleep: Fix error handling in dpm_prepare() dmaengine: fsl-dpaa2-qdma: Fix the size of dma pools dmaengine: ti: k3-udma: Report short packet errors dmaengine: fsl-qdma: Fix a memory leak related to the status queue DMA dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA phy: renesas: rcar-gen3-usb2: Fix returning wrong error code dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP drm/msm/dp: return correct Colorimetry for DP_TEST_DYNAMIC_RANGE_CEA case net: stmmac: xgmac: fix handling of DPP safety error for DMA channels selftests: net: avoid just another constant wait tunnels: fix out of bounds access when building IPv6 PMTU error atm: idt77252: fix a memleak in open_card_ubr0 hwmon: (aspeed-pwm-tacho) mutex for tach reading hwmon: (coretemp) Fix out-of-bounds memory access hwmon: (coretemp) Fix bogus core_id to attr name mapping inet: read sk->sk_family once in inet_recv_error() rxrpc: Fix response to PING RESPONSE ACKs to a dead call tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() ppp_async: limit MRU to 64K netfilter: nft_compat: reject unused compat flag netfilter: nft_compat: restrict match/target protocol to u16 netfilter: nft_ct: reject direction for ct id netfilter: nft_set_pipapo: store index in scratch maps netfilter: nft_set_pipapo: add helper to release pcpu scratch area netfilter: nft_set_pipapo: remove scratch_aligned pointer scsi: core: Move scsi_host_busy() out of host lock if it is for per-command blk-iocost: Fix an UBSAN shift-out-of-bounds warning net/af_iucv: clean up a try_then_request_module() USB: serial: qcserial: add new usb-id for Dell Wireless DW5826e USB: serial: option: add Fibocom FM101-GL variant USB: serial: cp210x: add ID for IMST iM871A-USB usb: host: xhci-plat: Add support for XHCI_SG_TRB_CACHE_SIZE_QUIRK hrtimer: Report offline hrtimer enqueue Input: i8042 - fix strange behavior of touchpad on Clevo NS70PU Input: atkbd - skip ATKBD_CMD_SETLEDS when skipping ATKBD_CMD_GETID vhost: use kzalloc() instead of kmalloc() followed by memset() clocksource: Skip watchdog check for large watchdog intervals net: stmmac: xgmac: use #define for string constants net: stmmac: xgmac: fix a typo of register name in DPP safety handling netfilter: nft_set_rbtree: skip end interval element from gc btrfs: forbid creating subvol qgroups btrfs: do not ASSERT() if the newly created subvolume already got read btrfs: forbid deleting live subvol qgroup btrfs: send: return EOPNOTSUPP on unknown flags of: unittest: Fix compile in the non-dynamic case net: openvswitch: limit the number of recursions from action sets spi: ppc4xx: Drop write-only variable ASoC: rt5645: Fix deadlock in rt5645_jack_detect_work() net: sysfs: Fix /sys/class/net/<iface> path for statistics MIPS: Add 'memory' clobber to csum_ipv6_magic() inline assembler i40e: Fix waiting for queues of all VSIs to be disabled tracing/trigger: Fix to return error if failed to alloc snapshot mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again ALSA: hda/realtek: Fix the external mic not being recognised for Acer Swift 1 SF114-32 ALSA: hda/realtek: Enable Mute LED on HP Laptop 14-fq0xxx HID: wacom: generic: Avoid reporting a serial of '0' to userspace HID: wacom: Do not register input devices until after hid_hw_start usb: ucsi_acpi: Fix command completion handling USB: hub: check for alternate port before enabling A_ALT_HNP_SUPPORT usb: f_mass_storage: forbid async queue when shutdown happen media: ir_toy: fix a memleak in irtoy_tx powerpc/kasan: Fix addr error caused by page alignment i2c: i801: Remove i801_set_block_buffer_mode i2c: i801: Fix block process call transactions modpost: trim leading spaces when processing source files list scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock" lsm: fix the logic in security_inode_getsecctx() firewire: core: correct documentation of fw_csr_string() kernel API kbuild: Fix changing ELF file type for output of gen_btf for big endian nfc: nci: free rx_data_reassembly skb on NCI device cleanup net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame() xen-netback: properly sync TX responses ALSA: hda/realtek: Enable headset mic on Vaio VJFE-ADL binder: signal epoll threads of self-work misc: fastrpc: Mark all sessions as invalid in cb_remove ext4: fix double-free of blocks due to wrong extents moved_len tracing: Fix wasted memory in saved_cmdlines logic staging: iio: ad5933: fix type mismatch regression iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC iio: accel: bma400: Fix a compilation problem media: rc: bpf attach/detach requires write permission hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove ring-buffer: Clean ring_buffer_poll_wait() error return serial: max310x: set default value when reading clock ready bit serial: max310x: improve crystal stable clock detection x86/Kconfig: Transmeta Crusoe is CPU family 5, not 6 x86/mm/ident_map: Use gbpages only where full GB page should be mapped. mmc: slot-gpio: Allow non-sleeping GPIO ro ALSA: hda/conexant: Add quirk for SWS JS201D nilfs2: fix data corruption in dsync block recovery for small block sizes nilfs2: fix hang in nilfs_lookup_dirty_data_buffers() crypto: ccp - Fix null pointer dereference in __sev_platform_shutdown_locked nfp: use correct macro for LengthSelect in BAR config nfp: flower: prevent re-adding mac index for bonded port wifi: mac80211: reload info pointer in ieee80211_tx_dequeue() irqchip/irq-brcmstb-l2: Add write memory barrier before exit irqchip/gic-v3-its: Fix GICv4.1 VPE affinity update s390/qeth: Fix potential loss of L3-IP@ in case of network issues ceph: prevent use-after-free in encode_cap_msg() of: property: fix typo in io-channels can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER) pmdomain: core: Move the unused cleanup to a _sync initcall tracing: Inform kmemleak of saved_cmdlines allocation Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d" bus: moxtet: Add spi device table PCI: dwc: endpoint: Fix dw_pcie_ep_raise_msix_irq() alignment support mips: Fix max_mapnr being uninitialized on early stages crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init serial: Add rs485_supported to uart_port serial: 8250_exar: Fill in rs485_supported serial: 8250_exar: Set missing rs485_supported flag scripts/decode_stacktrace.sh: silence stderr messages from addr2line/nm scripts/decode_stacktrace.sh: support old bash version scripts: decode_stacktrace: demangle Rust symbols scripts/decode_stacktrace.sh: optionally use LLVM utilities netfilter: ipset: fix performance regression in swap operation netfilter: ipset: Missing gc cancellations fixed hrtimer: Ignore slack time for RT tasks in schedule_hrtimeout_range() Revert "arm64: Stash shadow stack pointer in the task struct on interrupt" net: prevent mss overflow in skb_segment() sched/membarrier: reduce the ability to hammer on sys_membarrier nilfs2: fix potential bug in end_buffer_async_write nilfs2: replace WARN_ONs for invalid DAT metadata block requests dm: limit the number of targets and parameter size area PM: runtime: add devm_pm_runtime_enable helper PM: runtime: Have devm_pm_runtime_enable() handle pm_runtime_dont_use_autosuspend() drm/msm/dsi: Enable runtime PM netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval() net: bcmgenet: Fix EEE implementation PCI: dwc: Fix a 64bit bug in dw_pcie_ep_raise_msix_irq() Linux 5.10.210 Change-Id: I5e7327f58dd6abd26ac2b1e328a81c1010d1147c Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-04-10 07:10:03 +00:00
Gustavo A. R. Silva	415edd2d66	net/ipv4/ipv6: Replace one-element arraya with flexible-array members [ Upstream commit db243b796439c0caba47865564d8acd18a301d18 ] There is a regular need in the kernel to provide a way to declare having a dynamically sized set of trailing elements in a structure. Kernel code should always use “flexible array members”[1] for these cases. The older style of one-element or zero-length arrays should no longer be used[2]. Use an anonymous union with a couple of anonymous structs in order to keep userspace unchanged and refactor the related code accordingly: $ pahole -C group_filter net/ipv4/ip_sockglue.o struct group_filter { union { struct { __u32 gf_interface_aux; /* 0 4 / / XXX 4 bytes hole, try to pack / struct __kernel_sockaddr_storage gf_group_aux; / 8 128 / / --- cacheline 2 boundary (128 bytes) was 8 bytes ago --- / __u32 gf_fmode_aux; / 136 4 / __u32 gf_numsrc_aux; / 140 4 / struct __kernel_sockaddr_storage gf_slist[1]; / 144 128 / }; / 0 272 / struct { __u32 gf_interface; / 0 4 / / XXX 4 bytes hole, try to pack / struct __kernel_sockaddr_storage gf_group; / 8 128 / / --- cacheline 2 boundary (128 bytes) was 8 bytes ago --- / __u32 gf_fmode; / 136 4 / __u32 gf_numsrc; / 140 4 / struct __kernel_sockaddr_storage gf_slist_flex[0]; / 144 0 / }; / 0 144 / }; / 0 272 / / size: 272, cachelines: 5, members: 1 / / last cacheline: 16 bytes / }; $ pahole -C compat_group_filter net/ipv4/ip_sockglue.o struct compat_group_filter { union { struct { __u32 gf_interface_aux; / 0 4 / struct __kernel_sockaddr_storage gf_group_aux __attribute__((__aligned__(4))); / 4 128 / / --- cacheline 2 boundary (128 bytes) was 4 bytes ago --- / __u32 gf_fmode_aux; / 132 4 / __u32 gf_numsrc_aux; / 136 4 / struct __kernel_sockaddr_storage gf_slist[1] __attribute__((__aligned__(4))); / 140 128 / } __attribute__((__packed__)) __attribute__((__aligned__(4))); / 0 268 / struct { __u32 gf_interface; / 0 4 / struct __kernel_sockaddr_storage gf_group __attribute__((__aligned__(4))); / 4 128 / / --- cacheline 2 boundary (128 bytes) was 4 bytes ago --- / __u32 gf_fmode; / 132 4 / __u32 gf_numsrc; / 136 4 / struct __kernel_sockaddr_storage gf_slist_flex[0] __attribute__((__aligned__(4))); / 140 0 / } __attribute__((__packed__)) __attribute__((__aligned__(4))); / 0 140 / } __attribute__((__aligned__(1))); / 0 268 / / size: 268, cachelines: 5, members: 1 / / forced alignments: 1 / / last cacheline: 12 bytes */ } __attribute__((__packed__)); This helps with the ongoing efforts to globally enable -Warray-bounds and get us closer to being able to tighten the FORTIFY_SOURCE routines on memcpy(). [1] https://en.wikipedia.org/wiki/Flexible_array_member [2] https://www.kernel.org/doc/html/v5.10/process/deprecated.html#zero-length-and-one-element-arrays Link: https://github.com/KSPP/linux/issues/79 Link: https://github.com/KSPP/linux/issues/109 Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net> Stable-dep-of: 5c3be3e0eb44 ("ipmr: fix incorrect parameter validation in the ip_mroute_getsockopt() function") Signed-off-by: Sasha Levin <sashal@kernel.org>	2024-03-26 18:21:53 -04:00
Paolo Abeni	8affdbb3e2	mptcp: fix lockless access in subflow ULP diag commit b8adb69a7d29c2d33eb327bca66476fb6066516b upstream. Since the introduction of the subflow ULP diag interface, the dump callback accessed all the subflow data with lockless. We need either to annotate all the read and write operation accordingly, or acquire the subflow socket lock. Let's do latter, even if slower, to avoid a diffstat havoc. Fixes: `5147dfb508` ("mptcp: allow dumping subflow context to userspace") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com> Reviewed-by: Mat Martineau <martineau@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2024-03-01 13:16:49 +01:00
Dan Carpenter	9a865a11d6	netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval() commit c301f0981fdd3fd1ffac6836b423c4d7a8e0eb63 upstream. The problem is in nft_byteorder_eval() where we are iterating through a loop and writing to dst[0], dst[1], dst[2] and so on... On each iteration we are writing 8 bytes. But dst[] is an array of u32 so each element only has space for 4 bytes. That means that every iteration overwrites part of the previous element. I spotted this bug while reviewing commit caf3ef7468f7 ("netfilter: nf_tables: prevent OOB access in nft_byteorder_eval") which is a related issue. I think that the reason we have not detected this bug in testing is that most of time we only write one element. Fixes: `ce1e7989d9` ("netfilter: nft_byteorder: provide 64bit le/be conversion") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> [Ajay: Modified to apply on v5.10.y] Signed-off-by: Ajay Kaher <ajay.kaher@broadcom.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2024-02-23 08:42:32 +01:00
Eric Dumazet	f199018dc7	af_unix: fix lockdep positive in sk_diag_dump_icons() [ Upstream commit 4d322dce82a1d44f8c83f0f54f95dd1b8dcf46c9 ] syzbot reported a lockdep splat [1]. Blamed commit hinted about the possible lockdep violation, and code used unix_state_lock_nested() in an attempt to silence lockdep. It is not sufficient, because unix_state_lock_nested() is already used from unix_state_double_lock(). We need to use a separate subclass. This patch adds a distinct enumeration to make things more explicit. Also use swap() in unix_state_double_lock() as a clean up. v2: add a missing inline keyword to unix_state_lock_nested() [1] WARNING: possible circular locking dependency detected 6.8.0-rc1-syzkaller-00356-g8a696a29c690 #0 Not tainted syz-executor.1/2542 is trying to acquire lock: ffff88808b5df9e8 (rlock-AF_UNIX){+.+.}-{2:2}, at: skb_queue_tail+0x36/0x120 net/core/skbuff.c:3863 but task is already holding lock: ffff88808b5dfe70 (&u->lock/1){+.+.}-{2:2}, at: unix_dgram_sendmsg+0xfc7/0x2200 net/unix/af_unix.c:2089 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&u->lock/1){+.+.}-{2:2}: lock_acquire+0x1e3/0x530 kernel/locking/lockdep.c:5754 _raw_spin_lock_nested+0x31/0x40 kernel/locking/spinlock.c:378 sk_diag_dump_icons net/unix/diag.c:87 [inline] sk_diag_fill+0x6ea/0xfe0 net/unix/diag.c:157 sk_diag_dump net/unix/diag.c:196 [inline] unix_diag_dump+0x3e9/0x630 net/unix/diag.c:220 netlink_dump+0x5c1/0xcd0 net/netlink/af_netlink.c:2264 __netlink_dump_start+0x5d7/0x780 net/netlink/af_netlink.c:2370 netlink_dump_start include/linux/netlink.h:338 [inline] unix_diag_handler_dump+0x1c3/0x8f0 net/unix/diag.c:319 sock_diag_rcv_msg+0xe3/0x400 netlink_rcv_skb+0x1df/0x430 net/netlink/af_netlink.c:2543 sock_diag_rcv+0x2a/0x40 net/core/sock_diag.c:280 netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] netlink_unicast+0x7e6/0x980 net/netlink/af_netlink.c:1367 netlink_sendmsg+0xa37/0xd70 net/netlink/af_netlink.c:1908 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] sock_write_iter+0x39a/0x520 net/socket.c:1160 call_write_iter include/linux/fs.h:2085 [inline] new_sync_write fs/read_write.c:497 [inline] vfs_write+0xa74/0xca0 fs/read_write.c:590 ksys_write+0x1a0/0x2c0 fs/read_write.c:643 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf5/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b -> #0 (rlock-AF_UNIX){+.+.}-{2:2}: check_prev_add kernel/locking/lockdep.c:3134 [inline] check_prevs_add kernel/locking/lockdep.c:3253 [inline] validate_chain+0x1909/0x5ab0 kernel/locking/lockdep.c:3869 __lock_acquire+0x1345/0x1fd0 kernel/locking/lockdep.c:5137 lock_acquire+0x1e3/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 skb_queue_tail+0x36/0x120 net/core/skbuff.c:3863 unix_dgram_sendmsg+0x15d9/0x2200 net/unix/af_unix.c:2112 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0x592/0x890 net/socket.c:2584 ___sys_sendmsg net/socket.c:2638 [inline] __sys_sendmmsg+0x3b2/0x730 net/socket.c:2724 __do_sys_sendmmsg net/socket.c:2753 [inline] __se_sys_sendmmsg net/socket.c:2750 [inline] __x64_sys_sendmmsg+0xa0/0xb0 net/socket.c:2750 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf5/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&u->lock/1); lock(rlock-AF_UNIX); lock(&u->lock/1); lock(rlock-AF_UNIX); * DEADLOCK * 1 lock held by syz-executor.1/2542: #0: ffff88808b5dfe70 (&u->lock/1){+.+.}-{2:2}, at: unix_dgram_sendmsg+0xfc7/0x2200 net/unix/af_unix.c:2089 stack backtrace: CPU: 1 PID: 2542 Comm: syz-executor.1 Not tainted 6.8.0-rc1-syzkaller-00356-g8a696a29c690 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 check_noncircular+0x366/0x490 kernel/locking/lockdep.c:2187 check_prev_add kernel/locking/lockdep.c:3134 [inline] check_prevs_add kernel/locking/lockdep.c:3253 [inline] validate_chain+0x1909/0x5ab0 kernel/locking/lockdep.c:3869 __lock_acquire+0x1345/0x1fd0 kernel/locking/lockdep.c:5137 lock_acquire+0x1e3/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 skb_queue_tail+0x36/0x120 net/core/skbuff.c:3863 unix_dgram_sendmsg+0x15d9/0x2200 net/unix/af_unix.c:2112 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0x592/0x890 net/socket.c:2584 ___sys_sendmsg net/socket.c:2638 [inline] __sys_sendmmsg+0x3b2/0x730 net/socket.c:2724 __do_sys_sendmmsg net/socket.c:2753 [inline] __se_sys_sendmmsg net/socket.c:2750 [inline] __x64_sys_sendmmsg+0xa0/0xb0 net/socket.c:2750 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf5/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b RIP: 0033:0x7f26d887cda9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f26d95a60c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: ffffffffffffffda RBX: 00007f26d89abf80 RCX: 00007f26d887cda9 RDX: 000000000000003e RSI: 00000000200bd000 RDI: 0000000000000004 RBP: 00007f26d88c947a R08: 0000000000000000 R09: 0000000000000000 R10: 00000000000008c0 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007f26d89abf80 R15: 00007ffcfe081a68 Fixes: `2aac7a2cb0` ("unix_diag: Pending connections IDs NLA") Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com> Link: https://lore.kernel.org/r/20240130184235.1620738-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2024-02-23 08:42:17 +01:00
Kuniyuki Iwashima	9ccdef19cf	llc: Drop support for ETH_P_TR_802_2. [ Upstream commit e3f9bed9bee261e3347131764e42aeedf1ffea61 ] syzbot reported an uninit-value bug below. [0] llc supports ETH_P_802_2 (0x0004) and used to support ETH_P_TR_802_2 (0x0011), and syzbot abused the latter to trigger the bug. write$tun(r0, &(0x7f0000000040)={@val={0x0, 0x11}, @val, @mpls={[], @llc={@snap={0xaa, 0x1, ')', "90e5dd"}}}}, 0x16) llc_conn_handler() initialises local variables {saddr,daddr}.mac based on skb in llc_pdu_decode_sa()/llc_pdu_decode_da() and passes them to __llc_lookup(). However, the initialisation is done only when skb->protocol is htons(ETH_P_802_2), otherwise, __llc_lookup_established() and __llc_lookup_listener() will read garbage. The missing initialisation existed prior to commit `211ed86510` ("net: delete all instances of special processing for token ring"). It removed the part to kick out the token ring stuff but forgot to close the door allowing ETH_P_TR_802_2 packets to sneak into llc_rcv(). Let's remove llc_tr_packet_type and complete the deprecation. [0]: BUG: KMSAN: uninit-value in __llc_lookup_established+0xe9d/0xf90 __llc_lookup_established+0xe9d/0xf90 __llc_lookup net/llc/llc_conn.c:611 [inline] llc_conn_handler+0x4bd/0x1360 net/llc/llc_conn.c:791 llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206 __netif_receive_skb_one_core net/core/dev.c:5527 [inline] __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5641 netif_receive_skb_internal net/core/dev.c:5727 [inline] netif_receive_skb+0x58/0x660 net/core/dev.c:5786 tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555 tun_get_user+0x53af/0x66d0 drivers/net/tun.c:2002 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:2020 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x8ef/0x1490 fs/read_write.c:584 ksys_write+0x20f/0x4c0 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:646 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b Local variable daddr created at: llc_conn_handler+0x53/0x1360 net/llc/llc_conn.c:783 llc_rcv+0xfbb/0x14a0 net/llc/llc_input.c:206 CPU: 1 PID: 5004 Comm: syz-executor994 Not tainted 6.6.0-syzkaller-14500-g1c41041124bd #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 Fixes: `211ed86510` ("net: delete all instances of special processing for token ring") Reported-by: syzbot+b5ad66046b913bc04c6f@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b5ad66046b913bc04c6f Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://lore.kernel.org/r/20240119015515.61898-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2024-02-23 08:41:56 +01:00
Zhengchao Shao	bc99dcedd2	tcp: make sure init the accept_queue's spinlocks once [ Upstream commit 198bc90e0e734e5f98c3d2833e8390cac3df61b2 ] When I run syz's reproduction C program locally, it causes the following issue: pvqspinlock: lock 0xffff9d181cd5c660 has corrupted value 0x0! WARNING: CPU: 19 PID: 21160 at __pv_queued_spin_unlock_slowpath (kernel/locking/qspinlock_paravirt.h:508) Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 RIP: 0010:__pv_queued_spin_unlock_slowpath (kernel/locking/qspinlock_paravirt.h:508) Code: 73 56 3a ff 90 c3 cc cc cc cc 8b 05 bb 1f 48 01 85 c0 74 05 c3 cc cc cc cc 8b 17 48 89 fe 48 c7 c7 30 20 ce 8f e8 ad 56 42 ff <0f> 0b c3 cc cc cc cc 0f 0b 0f 1f 40 00 90 90 90 90 90 90 90 90 90 RSP: 0018:ffffa8d200604cb8 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff9d1ef60e0908 RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffff9d1ef60e0900 RBP: ffff9d181cd5c280 R08: 0000000000000000 R09: 00000000ffff7fff R10: ffffa8d200604b68 R11: ffffffff907dcdc8 R12: 0000000000000000 R13: ffff9d181cd5c660 R14: ffff9d1813a3f330 R15: 0000000000001000 FS: 00007fa110184640(0000) GS:ffff9d1ef60c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000000 CR3: 000000011f65e000 CR4: 00000000000006f0 Call Trace: <IRQ> _raw_spin_unlock (kernel/locking/spinlock.c:186) inet_csk_reqsk_queue_add (net/ipv4/inet_connection_sock.c:1321) inet_csk_complete_hashdance (net/ipv4/inet_connection_sock.c:1358) tcp_check_req (net/ipv4/tcp_minisocks.c:868) tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2260) ip_protocol_deliver_rcu (net/ipv4/ip_input.c:205) ip_local_deliver_finish (net/ipv4/ip_input.c:234) __netif_receive_skb_one_core (net/core/dev.c:5529) process_backlog (./include/linux/rcupdate.h:779) __napi_poll (net/core/dev.c:6533) net_rx_action (net/core/dev.c:6604) __do_softirq (./arch/x86/include/asm/jump_label.h:27) do_softirq (kernel/softirq.c:454 kernel/softirq.c:441) </IRQ> <TASK> __local_bh_enable_ip (kernel/softirq.c:381) __dev_queue_xmit (net/core/dev.c:4374) ip_finish_output2 (./include/net/neighbour.h:540 net/ipv4/ip_output.c:235) __ip_queue_xmit (net/ipv4/ip_output.c:535) __tcp_transmit_skb (net/ipv4/tcp_output.c:1462) tcp_rcv_synsent_state_process (net/ipv4/tcp_input.c:6469) tcp_rcv_state_process (net/ipv4/tcp_input.c:6657) tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1929) __release_sock (./include/net/sock.h:1121 net/core/sock.c:2968) release_sock (net/core/sock.c:3536) inet_wait_for_connect (net/ipv4/af_inet.c:609) __inet_stream_connect (net/ipv4/af_inet.c:702) inet_stream_connect (net/ipv4/af_inet.c:748) __sys_connect (./include/linux/file.h:45 net/socket.c:2064) __x64_sys_connect (net/socket.c:2073 net/socket.c:2070 net/socket.c:2070) do_syscall_64 (arch/x86/entry/common.c:51 arch/x86/entry/common.c:82) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:129) RIP: 0033:0x7fa10ff05a3d Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ab a3 0e 00 f7 d8 64 89 01 48 RSP: 002b:00007fa110183de8 EFLAGS: 00000202 ORIG_RAX: 000000000000002a RAX: ffffffffffffffda RBX: 0000000020000054 RCX: 00007fa10ff05a3d RDX: 000000000000001c RSI: 0000000020000040 RDI: 0000000000000003 RBP: 00007fa110183e20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 00007fa110184640 R13: 0000000000000000 R14: 00007fa10fe8b060 R15: 00007fff73e23b20 </TASK> The issue triggering process is analyzed as follows: Thread A Thread B tcp_v4_rcv //receive ack TCP packet inet_shutdown tcp_check_req tcp_disconnect //disconnect sock ... tcp_set_state(sk, TCP_CLOSE) inet_csk_complete_hashdance ... inet_csk_reqsk_queue_add inet_listen //start listen spin_lock(&queue->rskq_lock) inet_csk_listen_start ... reqsk_queue_alloc ... spin_lock_init spin_unlock(&queue->rskq_lock) //warning When the socket receives the ACK packet during the three-way handshake, it will hold spinlock. And then the user actively shutdowns the socket and listens to the socket immediately, the spinlock will be initialized. When the socket is going to release the spinlock, a warning is generated. Also the same issue to fastopenq.lock. Move init spinlock to inet_create and inet_accept to make sure init the accept_queue's spinlocks once. Fixes: `fff1f3001c` ("tcp: add a spinlock to protect struct request_sock_queue") Fixes: `168a8f5805` ("tcp: TCP Fast Open Server - main code path") Reported-by: Ming Shu <sming56@aliyun.com> Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://lore.kernel.org/r/20240118012019.1751966-1-shaozhengchao@huawei.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2024-02-23 08:41:55 +01:00
Greg Kroah-Hartman	7e6944b050	This is the 5.10.209 stable release -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmWy4soACgkQONu9yGCS aT5VxA/8DwcU5ST4AJ4EOaaWHUU/HHMV2/bSOLDhVTEl4gEnaj3LeOz2bIrfzNgb 9bHBYCtl3PFl+hZxY3wvC55o80SeIjskpU9rHvzQ36y8dd+uIfXjhLHPBHV7AO4m Yu6+dEoaJqFpVgyBKn+YFg6x0w8m1sWX5tcrQRkcMt/REak91bqdf8l0JDz1Jd2d uiCh3ssy9yNl7UTdPovzgK9IZ4zv0Kk13F9lXcsMEmjmB3awyaQlglBlCG0NEUKj wRWzT4uKHHcW4sHg/UyEfVUnKQGZvf7/eOAXK2kEsBFSzcl+QLwZxWSmRDL81dzl 1jjivPCQKtEPZqIZnDQuNvtijw5NNT/yJ5yRlJ7qmuCuBA/2VYqecEAVERhd6dYj le6oMu3340G5Dyq43XhOtPf+Fm1HkuMtQ49oyK8k/nEZSFGDWlrJ//cuOWYjUbpo d/fgCaLCxAm60KPiCnGdC7GQcIDJBbgjC3XDvxYGLA0ee+31XqhHDTlOkeHv+7oP 3PwSssT/M4Ppwzb0Imna/qaCO7lKUbS4oQSLahbfGg+fyAKfM7N3No7raF+L4VIE RACbvKrSfv2WuTncQBdd/kQ2kvhuGMD4L1WjXNFi2VQzI2JbEcYZcJWYXF5tvCNj aotDJumjF0WtGWcEdKg8Cr2AArMm6dHmRS5VVIG+taWpiWIl5lc= =iU8L -----END PGP SIGNATURE----- Merge 5.10.209 into android12-5.10-lts Changes in 5.10.209 f2fs: explicitly null-terminate the xattr list pinctrl: lochnagar: Don't build on MIPS ALSA: hda - Fix speaker and headset mic pin config for CHUWI CoreBook XPro mptcp: fix uninit-value in mptcp_incoming_options debugfs: fix automount d_fsdata usage drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer nvme-core: check for too small lba shift ASoC: wm8974: Correct boost mixer inputs ASoC: Intel: Skylake: Fix mem leak in few functions ASoC: nau8822: Fix incorrect type in assignment and cast to restricted __be16 ASoC: Intel: Skylake: mem leak in skl register function ASoC: cs43130: Fix the position of const qualifier ASoC: cs43130: Fix incorrect frame delay configuration ASoC: rt5650: add mutex to avoid the jack detection failure nouveau/tu102: flush all pdbs on vmm flush net/tg3: fix race condition in tg3_reset_task() ASoC: da7219: Support low DC impedance headset nvme: introduce helper function to get ctrl state drm/exynos: fix a potential error pointer dereference drm/exynos: fix a wrong error checking clk: rockchip: rk3128: Fix HCLK_OTG gate register jbd2: correct the printing of write_flags in jbd2_write_superblock() drm/crtc: Fix uninit-value bug in drm_mode_setcrtc neighbour: Don't let neigh_forced_gc() disable preemption for long jbd2: fix soft lockup in journal_finish_inode_data_buffers() tracing: Have large events show up as '[LINE TOO BIG]' instead of nothing tracing: Add size check when printing trace_marker output ring-buffer: Do not record in NMI if the arch does not support cmpxchg in NMI reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning Input: atkbd - skip ATKBD_CMD_GETID in translated mode Input: i8042 - add nomux quirk for Acer P459-G2-M s390/scm: fix virtual vs physical address confusion ARC: fix spare error Input: xpad - add Razer Wolverine V2 support i2c: rk3x: fix potential spinlock recursion on poll ida: Fix crash in ida_free when the bitmap is empty net: qrtr: ns: Return 0 if server port is not present ARM: sun9i: smp: fix return code check of of_property_match_string drm/crtc: fix uninitialized variable use ACPI: resource: Add another DMI match for the TongFang GMxXGxx binder: use EPOLLERR from eventpoll.h binder: fix trivial typo of binder_free_buf_locked() binder: fix comment on binder_alloc_new_buf() return value uio: Fix use-after-free in uio_open parport: parport_serial: Add Brainboxes BAR details parport: parport_serial: Add Brainboxes device IDs and geometry PCI: Add ACS quirk for more Zhaoxin Root Ports coresight: etm4x: Fix width of CCITMIN field x86/lib: Fix overflow when counting digits EDAC/thunderx: Fix possible out-of-bounds string access powerpc: add crtsavres.o to always-y instead of extra-y powerpc: Remove in_kernel_text() powerpc/44x: select I2C for CURRITUCK powerpc/pseries/memhotplug: Quieten some DLPAR operations powerpc/pseries/memhp: Fix access beyond end of drmem array selftests/powerpc: Fix error handling in FPU/VMX preemption tests powerpc/powernv: Add a null pointer check to scom_debug_init_one() powerpc/powernv: Add a null pointer check in opal_event_init() powerpc/powernv: Add a null pointer check in opal_powercap_init() powerpc/imc-pmu: Add a null pointer check in update_events_in_group() spi: spi-zynqmp-gqspi: fix driver kconfig dependencies mtd: rawnand: Increment IFC_TIMEOUT_MSECS for nand controller response ACPI: video: check for error while searching for backlight device parent ACPI: LPIT: Avoid u32 multiplication overflow of: property: define of_property_read_u{8,16,32,64}_array() unconditionally of: Add of_property_present() helper cpufreq: Use of_property_present() for testing DT property presence cpufreq: scmi: process the result of devm_of_clk_add_hw_provider() net: netlabel: Fix kerneldoc warnings netlabel: remove unused parameter in netlbl_netlink_auditinfo() calipso: fix memory leak in netlbl_calipso_add_pass() efivarfs: force RO when remounting if SetVariable is not supported spi: sh-msiof: Enforce fixed DTDL for R-Car H3 ACPI: extlog: Clear Extended Error Log status when RAS_CEC handled the error mtd: Fix gluebi NULL pointer dereference caused by ftl notifier selinux: Fix error priority for bind with AF_UNSPEC on PF_INET6 socket virtio_crypto: Introduce VIRTIO_CRYPTO_NOSPC virtio-crypto: introduce akcipher service virtio-crypto: implement RSA algorithm virtio-crypto: change code style virtio-crypto: use private buffer for control request virtio-crypto: wait ctrl queue instead of busy polling crypto: virtio - Handle dataq logic with tasklet crypto: sa2ul - Return crypto_aead_setkey to transfer the error crypto: ccp - fix memleak in ccp_init_dm_workarea crypto: af_alg - Disallow multiple in-flight AIO requests crypto: sahara - remove FLAGS_NEW_KEY logic crypto: sahara - fix cbc selftest failure crypto: sahara - fix ahash selftest failure crypto: sahara - fix processing requests with cryptlen < sg->length crypto: sahara - fix error handling in sahara_hw_descriptor_create() pstore: ram_core: fix possible overflow in persistent_ram_init_ecc() fs: indicate request originates from old mount API Revert "gfs2: Don't reject a supposedly full bitmap if we have blocks reserved" gfs2: Also reflect single-block allocations in rgd->rd_extfail_pt gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump crypto: virtio - Wait for tasklet to complete on device remove crypto: sahara - avoid skcipher fallback code duplication crypto: sahara - handle zero-length aes requests crypto: sahara - fix ahash reqsize crypto: sahara - fix wait_for_completion_timeout() error handling crypto: sahara - improve error handling in sahara_sha_process() crypto: sahara - fix processing hash requests with req->nbytes < sg->length crypto: sahara - do not resize req->src when doing hash operations crypto: scomp - fix req->dst buffer overflow blocklayoutdriver: Fix reference leak of pnfs_device_node NFSv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT wifi: rtw88: fix RX filter in FIF_ALLMULTI flag bpf, lpm: Fix check prefixlen before walking trie bpf: Add crosstask check to __bpf_get_stack wifi: ath11k: Defer on rproc_get failure wifi: libertas: stop selecting wext ARM: dts: qcom: apq8064: correct XOADC register address ncsi: internal.h: Fix a spello net/ncsi: Fix netlink major/minor version numbers firmware: ti_sci: Fix an off-by-one in ti_sci_debugfs_create() firmware: meson_sm: populate platform devices from sm device tree data wifi: rtlwifi: rtl8821ae: phy: fix an undefined bitwise shift behavior arm64: dts: ti: k3-am65-main: Fix DSS irq trigger type bpf: fix check for attempt to corrupt spilled pointer scsi: fnic: Return error if vmalloc() failed arm64: dts: qcom: qrb5165-rb5: correct LED panic indicator arm64: dts: qcom: sdm845-db845c: correct LED panic indicator bpf: Fix verification of indirect var-off stack access scsi: hisi_sas: Replace with standard error code return value selftests/net: fix grep checking for fib_nexthop_multiprefix virtio/vsock: fix logic which reduces credit update messages dma-mapping: Add dma_release_coherent_memory to DMA API dma-mapping: clear dev->dma_mem to NULL after freeing it wifi: rtlwifi: add calculate_bit_shift() wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift() wifi: rtlwifi: rtl8192c: using calculate_bit_shift() wifi: rtlwifi: rtl8192cu: using calculate_bit_shift() wifi: rtlwifi: rtl8192ce: using calculate_bit_shift() rtlwifi: rtl8192de: make arrays static const, makes object smaller wifi: rtlwifi: rtl8192de: using calculate_bit_shift() wifi: rtlwifi: rtl8192ee: using calculate_bit_shift() wifi: rtlwifi: rtl8192se: using calculate_bit_shift() netfilter: nf_tables: mark newset as dead on transaction abort Bluetooth: Fix bogus check for re-auth no supported with non-ssp Bluetooth: btmtkuart: fix recv_buf() return value ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() ARM: davinci: always select CONFIG_CPU_ARM926T RDMA/usnic: Silence uninitialized symbol smatch warnings drm/panel-elida-kd35t133: hold panel in reset for unprepare rcu: Create an unrcu_pointer() to remove __rcu from a pointer drm/nouveau/fence:: fix warning directly dereferencing a rcu pointer drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function media: pvrusb2: fix use after free on context disconnection drm/bridge: Fix typo in post_disable() description f2fs: fix to avoid dirent corruption drm/radeon/r600_cs: Fix possible int overflows in r600_cs_check_reg() drm/radeon/r100: Fix integer overflow issues in r100_cs_track_check() drm/radeon: check return value of radeon_ring_lock() ASoC: cs35l33: Fix GPIO name and drop legacy include ASoC: cs35l34: Fix GPIO name and drop legacy include drm/msm/mdp4: flush vblank event on disable drm/msm/dsi: Use pm_runtime_resume_and_get to prevent refcnt leaks drm/drv: propagate errors from drm_modeset_register_all() drm/radeon: check the alloc_workqueue return value in radeon_crtc_init() drm/radeon/dpm: fix a memleak in sumo_parse_power_table drm/radeon/trinity_dpm: fix a memleak in trinity_parse_power_table drm/bridge: tc358767: Fix return value on error case media: cx231xx: fix a memleak in cx231xx_init_isoc clk: qcom: gpucc-sm8150: Update the gpu_cc_pll1 config media: rkisp1: Disable runtime PM in probe error path f2fs: fix to check compress file in f2fs_move_file_range() f2fs: fix to update iostat correctly in f2fs_filemap_fault() media: dvbdev: drop refcount on error path in dvb_device_open() media: dvb-frontends: m88ds3103: Fix a memory leak in an error handling path of m88ds3103_probe() drm/amdgpu/debugfs: fix error code when smc register accessors are NULL drm/amd/pm: fix a double-free in si_dpm_init drivers/amd/pm: fix a use-after-free in kv_parse_power_table gpu/drm/radeon: fix two memleaks in radeon_vm_init dt-bindings: clock: Update the videocc resets for sm8150 clk: qcom: videocc-sm8150: Update the videocc resets clk: qcom: videocc-sm8150: Add missing PLL config property drivers: clk: zynqmp: calculate closest mux rate clk: zynqmp: make bestdiv unsigned clk: zynqmp: Add a check for NULL pointer drivers: clk: zynqmp: update divider round rate logic watchdog: set cdev owner before adding watchdog/hpwdt: Only claim UNKNOWN NMI if from iLO watchdog: bcm2835_wdt: Fix WDIOC_SETTIMEOUT handling watchdog: rti_wdt: Drop runtime pm reference count when watchdog is unused clk: si5341: fix an error code problem in si5341_output_clk_set_rate clk: fixed-rate: add devm_clk_hw_register_fixed_rate clk: fixed-rate: fix clk_hw_register_fixed_rate_with_accuracy_parent_hw pwm: stm32: Use regmap_clear_bits and regmap_set_bits where applicable pwm: stm32: Use hweight32 in stm32_pwm_detect_channels pwm: stm32: Fix enable count for clk in .probe() mmc: sdhci_am654: Fix TI SoC dependencies mmc: sdhci_omap: Fix TI SoC dependencies IB/iser: Prevent invalidating wrong MR of: Fix double free in of_parse_phandle_with_args_map of: unittest: Fix of_count_phandle_with_args() expected value message keys, dns: Fix size check of V1 server-list header binder: fix async space check for 0-sized buffers binder: fix unused alloc->free_async_space binder: fix use-after-free in shinker's callback Input: atkbd - use ab83 as id when skipping the getid command dma-mapping: Fix build error unused-value virtio-crypto: fix memory-leak virtio-crypto: fix memory leak in virtio_crypto_alg_skcipher_close_session() Revert "ASoC: atmel: Remove system clock tree configuration for at91sam9g20ek" kprobes: Fix to handle forcibly unoptimized kprobes on freeing_list net: ethernet: mtk_eth_soc: remove duplicate if statements xen-netback: don't produce zero-size SKB frags binder: fix race between mmput() and do_exit() tick-sched: Fix idle and iowait sleeptime accounting vs CPU hotplug usb: phy: mxs: remove CONFIG_USB_OTG condition for mxs_phy_is_otg_host() usb: dwc: ep0: Update request status in dwc3_ep0_stall_restart Revert "usb: dwc3: Soft reset phy on probe for host" Revert "usb: dwc3: don't reset device side if dwc3 was configured as host-only" usb: chipidea: wait controller resume finished for wakeup irq Revert "usb: typec: class: fix typec_altmode_put_partner to put plugs" usb: typec: class: fix typec_altmode_put_partner to put plugs usb: mon: Fix atomicity violation in mon_bin_vma_fault serial: imx: Ensure that imx_uart_rs485_config() is called with enabled clock ALSA: oxygen: Fix right channel of capture volume mixer ALSA: hda/relatek: Enable Mute LED on HP Laptop 15s-fq2xxx fbdev: flush deferred work in fb_deferred_io_fsync() pwm: jz4740: Don't use dev_err_probe() in .request() io_uring/rw: ensure io->bytes_done is always initialized rootfs: Fix support for rootfstype= when root= is given Bluetooth: Fix atomicity violation in {min,max}_key_size_set iommu/arm-smmu-qcom: Add missing GMU entry to match table wifi: rtlwifi: Remove bogus and dangerous ASPM disable/enable code wifi: rtlwifi: Convert LNKCTL change to PCIe cap RMW accessors wifi: mwifiex: configure BSSID consistently when starting AP x86/kvm: Do not try to disable kvmclock if it was not enabled KVM: arm64: vgic-v4: Restore pending state on host userspace write KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache iio: adc: ad7091r: Pass iio_dev to event handler HID: wacom: Correct behavior when processing some confidence == false touches mfd: syscon: Fix null pointer dereference in of_syscon_register() leds: aw2013: Select missing dependency REGMAP_I2C mips: dmi: Fix early remap on MIPS32 mips: Fix incorrect max_low_pfn adjustment MIPS: Alchemy: Fix an out-of-bound access in db1200_dev_setup() MIPS: Alchemy: Fix an out-of-bound access in db1550_dev_setup() power: supply: cw2015: correct time_to_empty units in sysfs serial: 8250: omap: Don't skip resource freeing if pm_runtime_resume_and_get() failed libapi: Add missing linux/types.h header to get the __u64 type on io.h acpi: property: Let args be NULL in __acpi_node_get_property_reference software node: Let args be NULL in software_node_get_reference_args serial: imx: fix tx statemachine deadlock iio: adc: ad9467: Benefit from devm_clk_get_enabled() to simplify iio: adc: ad9467: fix reset gpio handling iio: adc: ad9467: don't ignore error codes iio: adc: ad9467: fix scale setting perf genelf: Set ELF program header addresses properly tty: change tty_write_lock()'s ndelay parameter to bool tty: early return from send_break() on TTY_DRIVER_HARDWARE_BREAK tty: don't check for signal_pending() in send_break() tty: use 'if' in send_break() instead of 'goto' usb: cdc-acm: return correct error code on unsupported break nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length nvmet-tcp: fix a crash in nvmet_req_complete() perf env: Avoid recursively taking env->bpf_progs.lock apparmor: avoid crash when parsed profile name is empty serial: imx: Correct clock error message in function probe() nvmet-tcp: Fix the H2C expected PDU len calculation PCI: keystone: Fix race condition when initializing PHYs s390/pci: fix max size calculation in zpci_memcpy_toio() net: qualcomm: rmnet: fix global oob in rmnet_policy net: ethernet: ti: am65-cpsw: Fix max mtu to fit ethernet frames net: phy: micrel: populate .soft_reset for KSZ9131 net: ravb: Fix dma_addr_t truncation in error case net: dsa: vsc73xx: Add null pointer check to vsc73xx_gpio_probe netfilter: nf_tables: do not allow mismatch field size and set key length netfilter: nf_tables: skip dead set elements in netlink dump netfilter: nf_tables: reject NFT_SET_CONCAT with not field length description ipvs: avoid stat macros calls from preemptible context kdb: Fix a potential buffer overflow in kdb_local() ethtool: netlink: Add missing ethnl_ops_begin/complete mlxsw: spectrum_acl_erp: Fix error flow of pool allocation failure mlxsw: spectrum: Use 'bitmap_zalloc()' when applicable mlxsw: spectrum_acl_tcam: Add missing mutex_destroy() mlxsw: spectrum_acl_tcam: Make fini symmetric to init mlxsw: spectrum_acl_tcam: Reorder functions to avoid forward declarations mlxsw: spectrum_acl_tcam: Fix stack corruption selftests: mlxsw: qos_pfc: Convert to iproute2 dcb selftests: mlxsw: qos_pfc: Adjust the test to support 8 lanes i2c: s3c24xx: fix read transfers in polling mode i2c: s3c24xx: fix transferring more than one message in polling mode arm64: dts: armada-3720-turris-mox: set irq type for RTC Linux 5.10.209 Change-Id: I86438e299a811ccb08c5a27b2259c33cd482ff00 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-01-27 03:00:58 +00:00
Luiz Augusto von Dentz	fd54d16613	Bluetooth: Fix bogus check for re-auth no supported with non-ssp [ Upstream commit d03376c185926098cb4d668d6458801eb785c0a5 ] This reverts `19f8def031` "Bluetooth: Fix auth_complete_evt for legacy units" which seems to be working around a bug on a broken controller rather then any limitation imposed by the Bluetooth spec, in fact if there ws not possible to re-auth the command shall fail not succeed. Fixes: `19f8def031` ("Bluetooth: Fix auth_complete_evt for legacy units") Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2024-01-25 14:37:46 -08:00
Greg Kroah-Hartman	62f62d810d	Revert "ipv6: remove max_size check inline with ipv4" This reverts commit `dd56c5790d` which is commit af6d10345ca76670c1b7c37799f0d5576ccef277 upstream. It breaks the Android kernel abi and can be brought back in the future in an abi-safe way if it is really needed. Bug: 161946584 Change-Id: I7e768b45f1b301807a89234d2af0fd025a13396e Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-01-17 08:04:30 +00:00
Greg Kroah-Hartman	680475ab46	This is the 5.10.208 stable release -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmWlb9wACgkQONu9yGCS aT7xVBAAxWKfeQYqCxJbBVpyriOLnbzrNeM4fi0TCyX4J/UsMrpnMP101eFZmyJN L2W4rzWcRHoogWSdK1SvjRZuBi2bUUj0NVbfsoLZPJvJ5yj8gg4Io/ejhXStvXcH o0aKVR9pBfLu4NWWNZ0gOJQ5xK+ndHp+naylV6kA6WYyUBr+q8BSTQJcEDM4gAkl eRdshQIbQK1JUPmgA6Grv/FsaoPsfU+BxriWfRMEiYrFjLDCHkr9YJ3RlIwYVJDU +7CG6AzLXk3qNczk/4/9Vx67agDpeXT0kCiAPB0Y8GPH+4bNtE6FIzRTNNfHbPOV Q8U18dToawIvOXUZaenX84Dg8XKS9vUVD/KxBqUTvLwlaUDVZr9XNtOkdCQcnwro qTMxFE7HttpMJSSHtZp7xLyOwn8i74vgcfYXngZlawZJzAHVqgCDk4105PylSetZ BTBxn990H9TxDO0weaiDLKMPbXVusxxbFY4hBVxVQdmfwWrJ7yYVb2IAF4kNy7dF dRVoPDOC5Qf840REJgwzKJysZ4l2Ejcdicxi6zG+7SJH2jKYrcCW4AloALODRVHz uf8BOgvD2W9lOTXkJy+LziNvDvVqe5B1l2E/WAIXI6jmo/abkmSKJpPWtTcF7xYs CU7+3dny8BMu7zAIXjgnJmVRiGGMudi/steXyE0KV5X9hOdLQJo= =F/LV -----END PGP SIGNATURE----- Merge 5.10.208 into android12-5.10-lts Changes in 5.10.208 keys, dns: Fix missing size check of V1 server-list header block: Don't invalidate pagecache for invalid falloc modes ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP ProBook 440 G6 nfc: llcp_core: Hold a ref to llcp_local->dev when holding a ref to llcp_local octeontx2-af: Fix marking couple of structure as __packed drm/i915/dp: Fix passing the correct DPCD_REV for drm_dp_set_phy_test_pattern i40e: Fix filter input checks to prevent config with invalid values net: sched: em_text: fix possible memory leak in em_text_destroy() ARM: sun9i: smp: Fix array-index-out-of-bounds read in sunxi_mc_smp_init sfc: fix a double-free bug in efx_probe_filters net: bcmgenet: Fix FCS generation for fragmented skbuffs netfilter: nftables: add loop check helper function netfilter: nft_immediate: drop chain reference counter on error net: Save and restore msg_namelen in sock_sendmsg i40e: fix use-after-free in i40e_aqc_add_filters() ASoC: meson: g12a-toacodec: Validate written enum values ASoC: meson: g12a-tohdmitx: Validate written enum values ASoC: meson: g12a-toacodec: Fix event generation ASoC: meson: g12a-tohdmitx: Fix event generation for S/PDIF mux i40e: Restore VF MSI-X state during PCI reset net/qla3xxx: switch from 'pci_' to 'dma_' API net/qla3xxx: fix potential memleak in ql_alloc_buffer_queues asix: Add check for usbnet_get_endpoints bnxt_en: Remove mis-applied code from bnxt_cfg_ntp_filters() net: Implement missing SO_TIMESTAMPING_NEW cmsg support mm/memory-failure: check the mapcount of the precise page firewire: ohci: suppress unexpected system reboot in AMD Ryzen machines and ASM108x/VT630x PCIe cards x86/kprobes: fix incorrect return address calculation in kprobe_emulate_call_indirect i2c: core: Fix atomic xfer check for non-preempt config mm: fix unmap_mapping_range high bits shift bug mmc: meson-mx-sdhc: Fix initialization frozen issue mmc: rpmb: fixes pause retune on all RPMB partitions. mmc: core: Cancel delayed work before releasing host mmc: sdhci-sprd: Fix eMMC init failure after hw reset powerpc: update ppc_save_regs to save current r1 in pt_regs net: tls, update curr on splice as well ipv6: remove max_size check inline with ipv4 drm/qxl: fix UAF on handle creation netfilter: nf_tables: Reject tables of unsupported family PCI: Extract ATS disabling to a helper function PCI: Disable ATS for specific Intel IPU E2000 devices Revert "nvme: use command_id instead of req->tag in trace_nvme_complete_rq()" Linux 5.10.208 Change-Id: I85f7791b6a3e06127bfd2e52a23ce90abb80ed8f Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-01-16 13:12:39 +00:00
Jon Maxwell	dd56c5790d	ipv6: remove max_size check inline with ipv4 commit af6d10345ca76670c1b7c37799f0d5576ccef277 upstream. In ip6_dst_gc() replace: if (entries > gc_thresh) With: if (entries > ops->gc_thresh) Sending Ipv6 packets in a loop via a raw socket triggers an issue where a route is cloned by ip6_rt_cache_alloc() for each packet sent. This quickly consumes the Ipv6 max_size threshold which defaults to 4096 resulting in these warnings: [1] 99.187805] dst_alloc: 7728 callbacks suppressed [2] Route cache is full: consider increasing sysctl net.ipv6.route.max_size. . . [300] Route cache is full: consider increasing sysctl net.ipv6.route.max_size. When this happens the packet is dropped and sendto() gets a network is unreachable error: remaining pkt 200557 errno 101 remaining pkt 196462 errno 101 . . remaining pkt 126821 errno 101 Implement David Aherns suggestion to remove max_size check seeing that Ipv6 has a GC to manage memory usage. Ipv4 already does not check max_size. Here are some memory comparisons for Ipv4 vs Ipv6 with the patch: Test by running 5 instances of a program that sends UDP packets to a raw socket 5000000 times. Compare Ipv4 and Ipv6 performance with a similar program. Ipv4: Before test: MemFree: 29427108 kB Slab: 237612 kB ip6_dst_cache 1912 2528 256 32 2 : tunables 0 0 0 xfrm_dst_cache 0 0 320 25 2 : tunables 0 0 0 ip_dst_cache 2881 3990 192 42 2 : tunables 0 0 0 During test: MemFree: 29417608 kB Slab: 247712 kB ip6_dst_cache 1912 2528 256 32 2 : tunables 0 0 0 xfrm_dst_cache 0 0 320 25 2 : tunables 0 0 0 ip_dst_cache 44394 44394 192 42 2 : tunables 0 0 0 After test: MemFree: 29422308 kB Slab: 238104 kB ip6_dst_cache 1912 2528 256 32 2 : tunables 0 0 0 xfrm_dst_cache 0 0 320 25 2 : tunables 0 0 0 ip_dst_cache 3048 4116 192 42 2 : tunables 0 0 0 Ipv6 with patch: Errno 101 errors are not observed anymore with the patch. Before test: MemFree: 29422308 kB Slab: 238104 kB ip6_dst_cache 1912 2528 256 32 2 : tunables 0 0 0 xfrm_dst_cache 0 0 320 25 2 : tunables 0 0 0 ip_dst_cache 3048 4116 192 42 2 : tunables 0 0 0 During Test: MemFree: 29431516 kB Slab: 240940 kB ip6_dst_cache 11980 12064 256 32 2 : tunables 0 0 0 xfrm_dst_cache 0 0 320 25 2 : tunables 0 0 0 ip_dst_cache 3048 4116 192 42 2 : tunables 0 0 0 After Test: MemFree: 29441816 kB Slab: 238132 kB ip6_dst_cache 1902 2432 256 32 2 : tunables 0 0 0 xfrm_dst_cache 0 0 320 25 2 : tunables 0 0 0 ip_dst_cache 3048 4116 192 42 2 : tunables 0 0 0 Tested-by: Andrea Mayer <andrea.mayer@uniroma2.it> Signed-off-by: Jon Maxwell <jmaxwell37@gmail.com> Reviewed-by: David Ahern <dsahern@kernel.org> Link: https://lore.kernel.org/r/20230112012532.311021-1-jmaxwell37@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Cc: "Jitindar Singh, Suraj" <surajjs@amazon.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2024-01-15 18:48:07 +01:00
Greg Kroah-Hartman	8a9d593fd6	This is the 5.10.206 stable release -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmWYDlYACgkQONu9yGCS aT5i8A//V/cQxM4ABg2SGkOLg9TFEmUC/TsrvbmSjwTTpOgi1XuncuxBxoLz6eb4 G8nCmFjuh2E8YL2WMXn5Gs891J6enlc+Pg8Iz54NVXKff4RJZy2zP2KEVmHwYS5R Bm2uUsfqQFXZ4V6tRUBiUTtk/aLyNKbiJEV/eg/1NL27xoNTfWFICnq8Jr7liCxt kedPiN6MAVzHCJ00IPRSFFuVHgofI1lPhCg6qbU0KEmfU/3sXZ3hP4ewBI/QbAIF MO3XLXTpWU8QnKqr50cnW30pxhm+Lc/n/TokgRC0Ng1YtDms6zFyLxCX5CDH1FHf Y3QhS5HVZmR2x7Ga5wd8gLwoXun/HU7y+GCVD1ToiWch/zF/vUgYK80Hkxsc/0Wf UUs8erxkGKpidpOrqNOgHxeTtpLbTVYGi/F8XMoohUW7qmlLvyiezU/wHapJ6EZA T93QS/WhY993b2Hz7apu3o7Jm9ZpiVIpoRiniWRkcoLltZM7RdZTqnIHr/0PAZbD qtOzQrCDCT5EMZz9rjI45K9K5pOA8cVhjehnQaG93DSiVp0wu+uP/Ib15oZiVA/q k+uW5YgT03HZQ8QTcW4d87mLqkl5PqzpWRRBQZw9aN22YQ9wyUEPpjliZgDpjjXE lKtr4S2Sudfpt5kiH72MYZbMqsgn8TT56lumL6ZplEvlPH/J76Y= =Xj2r -----END PGP SIGNATURE----- Merge 5.10.206 into android12-5.10-lts Changes in 5.10.206 ksmbd: fix wrong name of SMB2_CREATE_ALLOCATION_SIZE smb: client: fix OOB in smb2_query_reparse_point() ARM: OMAP2+: Fix null pointer dereference and memory leak in omap_soc_device_init reset: Fix crash when freeing non-existent optional resets s390/vx: fix save/restore of fpu kernel context wifi: mac80211: mesh_plink: fix matches_local logic Revert "net/mlx5e: fix double free of encap_header" net/mlx5e: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list() net/mlx5: Fix fw tracer first block check net/mlx5e: Correct snprintf truncation handling for fw_version buffer used by representors net: sched: ife: fix potential use-after-free ethernet: atheros: fix a memleak in atl1e_setup_ring_resources net/rose: fix races in rose_kill_by_device() net: check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev() afs: Fix the dynamic root's d_delete to always delete unused dentries afs: Fix dynamic root lookup DNS check net: warn if gso_type isn't set for a GSO SKB net: check dev->gso_max_size in gso_features_check() keys, dns: Allow key types (eg. DNS) to be reclaimed immediately on expiry afs: Fix overwriting of result of DNS query i2c: aspeed: Handle the coalesced stop conditions with the start conditions. pinctrl: at91-pio4: use dedicated lock class for IRQ ALSA: hda/hdmi: Add quirk to force pin connectivity on NUC10 ALSA: hda/hdmi: add force-connect quirk for NUC5CPYB smb: client: fix NULL deref in asn1_ber_decoder() btrfs: do not allow non subvolume root targets for snapshot interconnect: Treat xlate() returning NULL node as an error iio: imu: inv_mpu6050: fix an error code problem in inv_mpu6050_read_raw Input: ipaq-micro-keys - add error handling for devm_kmemdup scsi: bnx2fc: Fix skb double free in bnx2fc_rcv() iio: common: ms_sensors: ms_sensors_i2c: fix humidity conversion time table iio: adc: ti_am335x_adc: Fix return value check of tiadc_request_dma() wifi: cfg80211: Add my certificate wifi: cfg80211: fix certs build to not depend on file order USB: serial: ftdi_sio: update Actisense PIDs constant names USB: serial: option: add Quectel EG912Y module support USB: serial: option: add Foxconn T99W265 with new baseline USB: serial: option: add Quectel RM500Q R13 firmware support Bluetooth: hci_event: Fix not checking if HCI_OP_INQUIRY has been sent Bluetooth: L2CAP: Send reject on command corrupted request Input: soc_button_array - add mapping for airplane mode button net: 9p: avoid freeing uninit memory in p9pdu_vreadf net: rfkill: gpio: set GPIO direction net: ks8851: Fix TX stall caused by TX buffer overrun dt-bindings: nvmem: mxs-ocotp: Document fsl,ocotp tracing / synthetic: Disable events after testing in synth_event_gen_test_init() bus: ti-sysc: Flush posted write only after srst_udelay lib/vsprintf: Fix %pfwf when current node refcount == 0 x86/alternatives: Sync core before enabling interrupts 9p/net: fix possible memory leak in p9_check_errors() ARM: dts: Fix occasional boot hang for am3 usb Bluetooth: SMP: Convert BT_ERR/BT_DBG to bt_dev_err/bt_dev_dbg Bluetooth: use inclusive language in SMP Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE usb: fotg210-hcd: delete an incorrect bounds test smb: client: fix OOB in SMB2_query_info_init() smb: client: fix OOB in smbCalcSize() Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg spi: atmel: Switch to transfer_one transfer method spi: atmel: Fix CS and initialization bug scsi: core: Add scsi_prot_ref_tag() helper scsi: core: Introduce scsi_get_sector() scsi: core: Make scsi_get_lba() return the LBA scsi: core: Use scsi_cmd_to_rq() instead of scsi_cmnd.request scsi: core: Use a structure member to track the SCSI command submitter scsi: core: Always send batch on reset or error handling command ring-buffer: Fix wake ups when buffer_percent is set to 100 tracing: Fix blocked reader of snapshot buffer netfilter: nf_tables: skip set commit for deleted/destroyed sets dm-integrity: don't modify bio's immutable bio_vec in integrity_metadata() Revert "MIPS: Loongson64: Enable DMA noncoherent support" Bluetooth: SMP: Fix crash when receiving new connection when debug is enabled spi: atmel: Fix PDC transfer setup bug Linux 5.10.206 Change-Id: Ifc248e166849f9102cb1d3e32c33080236de2332 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-01-08 18:41:26 +00:00
Xiao Yao	da448f145f	Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE [ Upstream commit 59b047bc98084f8af2c41483e4d68a5adf2fa7f7 ] If two Bluetooth devices both support BR/EDR and BLE, and also support Secure Connections, then they only need to pair once. The LTK generated during the LE pairing process may be converted into a BR/EDR link key for BR/EDR transport, and conversely, a link key generated during the BR/EDR SSP pairing process can be converted into an LTK for LE transport. Hence, the link type of the link key and LTK is not fixed, they can be either an LE LINK or an ACL LINK. Currently, in the mgmt_new_irk/ltk/crsk/link_key functions, the link type is fixed, which could lead to incorrect address types being reported to the application layer. Therefore, it is necessary to add link_type/addr_type to the smp_irk/ltk/crsk and link_key, to ensure the generation of the correct address type. SMP over BREDR: Before Fix: > ACL Data RX: Handle 11 flags 0x02 dlen 12 BR/EDR SMP: Identity Address Information (0x09) len 7 Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76) @ MGMT Event: New Identity Resolving Key (0x0018) plen 30 Random address: 00:00:00:00:00:00 (Non-Resolvable) LE Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76) @ MGMT Event: New Long Term Key (0x000a) plen 37 LE Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76) Key type: Authenticated key from P-256 (0x03) After Fix: > ACL Data RX: Handle 11 flags 0x02 dlen 12 BR/EDR SMP: Identity Address Information (0x09) len 7 Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76) @ MGMT Event: New Identity Resolving Key (0x0018) plen 30 Random address: 00:00:00:00:00:00 (Non-Resolvable) BR/EDR Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76) @ MGMT Event: New Long Term Key (0x000a) plen 37 BR/EDR Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76) Key type: Authenticated key from P-256 (0x03) SMP over LE: Before Fix: @ MGMT Event: New Identity Resolving Key (0x0018) plen 30 Random address: 5F:5C:07:37:47:D5 (Resolvable) LE Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76) @ MGMT Event: New Long Term Key (0x000a) plen 37 LE Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76) Key type: Authenticated key from P-256 (0x03) @ MGMT Event: New Link Key (0x0009) plen 26 BR/EDR Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76) Key type: Authenticated Combination key from P-256 (0x08) After Fix: @ MGMT Event: New Identity Resolving Key (0x0018) plen 30 Random address: 5E:03:1C:00:38:21 (Resolvable) LE Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76) @ MGMT Event: New Long Term Key (0x000a) plen 37 LE Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76) Key type: Authenticated key from P-256 (0x03) @ MGMT Event: New Link Key (0x0009) plen 26 Store hint: Yes (0x01) LE Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76) Key type: Authenticated Combination key from P-256 (0x08) Cc: stable@vger.kernel.org Signed-off-by: Xiao Yao <xiaoyao@rock-chips.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2024-01-05 15:12:29 +01:00
Archie Pusaka	4bc912140b	Bluetooth: use inclusive language in SMP [ Upstream commit fad646e16d3cafd67d3cfff8e66f77401190957e ] This patch replaces some non-inclusive terms based on the appropriate language mapping table compiled by the Bluetooth SIG: https://specificationrefs.bluetooth.com/language-mapping/Appropriate_Language_Mapping_Table.pdf Specifically, these terms are replaced: master -> initiator slave -> responder Signed-off-by: Archie Pusaka <apusaka@chromium.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Stable-dep-of: 59b047bc9808 ("Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE") Signed-off-by: Sasha Levin <sashal@kernel.org>	2024-01-05 15:12:29 +01:00
Greg Kroah-Hartman	068af29e24	ANDROID: GKI: fix crc issue in include/net/addrconf.h In commit `97275e470c` ("net: ipv6: support reporting otherwise unknown prefix flags in RTM_NEWPREFIX") a union is added to fix some issues, but that messes with the crc of a number of networking symbols for obvious reasons. As this does not actually change the abi at all, use some GENKSYMS magic #define logic to preserve the crc so that all is well. Bug: 161946584 Fixes: `97275e470c` ("net: ipv6: support reporting otherwise unknown prefix flags in RTM_NEWPREFIX") Cc: Maciej Żenczykowski <maze@google.com> Cc: Lorenzo Colitti <lorenzo@google.com> Change-Id: I9d2df74e8f3ae60425534f1b33d50b2bc444f7f5 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-01-05 11:35:04 +00:00
Greg Kroah-Hartman	b7733bafef	This is the 5.10.205 stable release -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmWC/gkACgkQONu9yGCS aT5O2hAA1RcHox8KatosKeBihzJnxqdMyfDIGpWQXQb4U3vjvVe8hboapJJHYidd yJgN29rgQUJNxa0hX/kE86QiH6UuellRrz9kkQawDcCt9wKS/8frusjwJPCvK+EC 2rp08JAl3ZNr7vczO5t/H/uHBsCiP84m8USP7/e/7JX8I3OmSfgRfrMHc/ay0Brk JGpMITCGHuy5xFI8Tl8snG5aQ1KY06YcuSC4vutYzpEgCjCWJPhQAMb/t1vpQKRD Qt1F6zRTslZjlcabztjrQ71S7iBTW9Lx0wLSCN0VrkgishDl567ttHVO/knT6OLU VYsnr2z7i2nwvrooQ+pH7uJTyInEkf9CGNw69me0KrjZtcIWLliEOpCQlBN+fOl5 zig4VzLQHlSo5mLo2WmLpnDQUXk1/nEb1DjSjYnKalV0tKpDm1HxgzNIAGCmEidD 81+Q92eMot3rlWxgqL+ytapF1dfgGpt92H31fhQJP6uI/a7SRAUhUJqmP51r9mOJ F1LM2kd9lPCTYiJWpRj+6SKvNX5mmZAxV5hZ4JzmH4uIDWsV8DQEJve7TnI5KOm9 KUuGhRGjQ7mNvtlNZUeS00uqijKBXg61xPKyXJb3Ph1GheLHPyXiVRlgGdItrbme TJUBa2b6zGAMqTPA2UMebTtnNtnejkH9CU7ojGoIG8AFvnPyhd0= =mybH -----END PGP SIGNATURE----- Merge 5.10.205 into android12-5.10-lts Changes in 5.10.205 netfilter: nf_tables: fix 'exist' matching on bigendian arches afs: Fix refcount underflow from error handling race HID: lenovo: Restrict detection of patched firmware only to USB cptkbd net: ipv6: support reporting otherwise unknown prefix flags in RTM_NEWPREFIX qca_debug: Prevent crash on TX ring changes qca_debug: Fix ethtool -G iface tx behavior qca_spi: Fix reset behavior atm: solos-pci: Fix potential deadlock on &cli_queue_lock atm: solos-pci: Fix potential deadlock on &tx_queue_lock net: vlan: introduce skb_vlan_eth_hdr() net: fec: correct queue selection atm: Fix Use-After-Free in do_vcc_ioctl net/rose: Fix Use-After-Free in rose_ioctl qed: Fix a potential use-after-free in qed_cxt_tables_alloc net: Remove acked SYN flag from packet in the transmit queue correctly net: ena: Destroy correct number of xdp queues upon failure net: ena: Fix XDP redirection error sign-file: Fix incorrect return values check vsock/virtio: Fix unsigned integer wrap around in virtio_transport_has_space() net: stmmac: use dev_err_probe() for reporting mdio bus registration failure net: stmmac: Handle disabled MDIO busses from devicetree appletalk: Fix Use-After-Free in atalk_ioctl net: atlantic: fix double free in ring reinit logic cred: switch to using atomic_long_t fuse: dax: set fc->dax to NULL in fuse_dax_conn_free() ALSA: hda/hdmi: add force-connect quirks for ASUSTeK Z170 variants ALSA: hda/realtek: Apply mute LED quirk for HP15-db Revert "PCI: acpiphp: Reassign resources on bridge if necessary" PCI: loongson: Limit MRRS to 256 drm/mediatek: Add spinlock for setting vblank event in atomic_begin usb: aqc111: check packet for fixup for true limit blk-throttle: fix lockdep warning of "cgroup_mutex or RCU read lock required!" bcache: avoid oversize memory allocation by small stripe_size bcache: remove redundant assignment to variable cur_idx bcache: add code comments for bch_btree_node_get() and __bch_btree_node_alloc() bcache: avoid NULL checking to c->root in run_cache_set() platform/x86: intel_telemetry: Fix kernel doc descriptions HID: glorious: fix Glorious Model I HID report HID: add ALWAYS_POLL quirk for Apple kb HID: hid-asus: reset the backlight brightness level on resume HID: multitouch: Add quirk for HONOR GLO-GXXX touchpad asm-generic: qspinlock: fix queued_spin_value_unlocked() implementation net: usb: qmi_wwan: claim interface 4 for ZTE MF290 HID: hid-asus: add const to read-only outgoing usb buffer perf: Fix perf_event_validate_size() lockdep splat soundwire: stream: fix NULL pointer dereference for multi_link ext4: prevent the normalized size from exceeding EXT_MAX_BLOCKS arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify team: Fix use-after-free when an option instance allocation fails ring-buffer: Fix memory leak of free page tracing: Update snapshot buffer on resize if it is allocated ring-buffer: Have saved event hold the entire event ring-buffer: Fix writing to the buffer with max_data_size ring-buffer: Fix a race in rb_time_cmpxchg() for 32 bit archs USB: gadget: core: adjust uevent timing on gadget unbind tty: n_gsm: fix tty registration before control channel open tty: n_gsm, remove duplicates of parameters tty: n_gsm: add sanity check for gsm->receive in gsm_receive_buf() powerpc/ftrace: Create a dummy stackframe to fix stack unwind powerpc/ftrace: Fix stack teardown in ftrace_no_trace Linux 5.10.205 Change-Id: I2471e112e6ed8bd85f0bf2812cb0a5bff2ac1bdd Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-12-21 12:24:50 +00:00
Maciej Żenczykowski	97275e470c	net: ipv6: support reporting otherwise unknown prefix flags in RTM_NEWPREFIX [ Upstream commit bd4a816752bab609dd6d65ae021387beb9e2ddbd ] Lorenzo points out that we effectively clear all unknown flags from PIO when copying them to userspace in the netlink RTM_NEWPREFIX notification. We could fix this one at a time as new flags are defined, or in one fell swoop - I choose the latter. We could either define 6 new reserved flags (reserved1..6) and handle them individually (and rename them as new flags are defined), or we could simply copy the entire unmodified byte over - I choose the latter. This unfortunately requires some anonymous union/struct magic, so we add a static assert on the struct size for a little extra safety. Cc: David Ahern <dsahern@kernel.org> Cc: Lorenzo Colitti <lorenzo@google.com> Fixes: `1da177e4c3` ("Linux-2.6.12-rc2") Signed-off-by: Maciej Żenczykowski <maze@google.com> Reviewed-by: David Ahern <dsahern@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-12-20 15:44:27 +01:00
Greg Kroah-Hartman	36f0b85aff	Revert "genetlink: add CAP_NET_ADMIN test for multicast bind" This reverts commit `015870c10c` which does not have a direct relation to an upstream commit. It breaks the Android kernel abi and can be brought back in the future in an abi-safe way if it is really needed. Bug: 161946584 Change-Id: I8ddc8a86b47a9560115ccb83fc50d522436d0b3b Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-12-18 19:18:41 +00:00
Greg Kroah-Hartman	ae04f2701b	Revert "drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group" This reverts commit `e844a9309f` which is commit e03781879a0d524ce3126678d50a80484a513c4b upstream. It breaks the Android kernel abi and can be brought back in the future in an abi-safe way if it is really needed. Bug: 161946584 Change-Id: Iecbd6b6537bd4cd2d178d0afbdc7557e521429c5 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-12-18 19:18:24 +00:00
Greg Kroah-Hartman	001d2105f6	This is the 5.10.204 stable release -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmV56W4ACgkQONu9yGCS aT7epxAAz6RM0Id+xXS3pb8CcyYncjrWlVRwLJn2zdJit1oWBHePonCQURaOiwMA 2IvUUjqeTL/lr1h8L2gRled7EVDMrSv0z4IBDOl4BdF2Z0TfwLhRKiT04RmyHQrG k08SnS51IFsKmsUYUMf/SYBu1uvK5rXggjLjXvLsObRQJUOZbQwMdKIXge4+N1js zvoU5DNF+FhWoCQO7uExG7rFv9Hv5ftdCQz5u3Aon0+B7wJMFzDie38TCkPMzptU ydKILRFAlf3096OcHtS6JBEsPetViOoytyv2pgFzaWMfHJnbnI4d8kRoI9r1GZwA 6S9Yfli0ZKPur/1FVsMsYs8PHABiBwKw2tRmT15oOtE3+xg08F408jcUccL+vi/v qXOqhX6wpesw6+MTgOXTjJhSxRHBzKMey1iSBWB5E8g7wuB6DRm0KDl5FaUHbdTf GLXFtgpHZdbCPKyolcTTESjxnNBzc+wUY8YTekEdmppy4uWS7B9Vml44nP1ej0+Z P1Q2iNMkABYjoRW3hVXgSdfoHX/dJSu/+tmeNba1Ay8Tj0PWVqRZ99cagG+F53Sg iCNJhrfwK+uznwo9/4bcKXZXTKhUROtzoxcPNdRONyCiqlFSq1WtkjADzVBV75od 9EbLTJqh5GtfBoA4W6rzyt9tjNevZHHChOsT4e8uEnnCFZJeK7Q= =qOMN -----END PGP SIGNATURE----- Merge 5.10.204 into android12-5.10-lts Changes in 5.10.204 hrtimers: Push pending hrtimers away from outgoing CPU earlier i2c: designware: Fix corrupted memory seen in the ISR netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test tg3: Move the [rt]x_dropped counters to tg3_napi tg3: Increment tx_dropped in tg3_tso_bug() kconfig: fix memory leak from range properties drm/amdgpu: correct chunk_ptr to a pointer to chunk. platform/x86: asus-wmi: Add support for SW_TABLET_MODE on UX360 platform/x86: asus-nb-wmi: Allow configuring SW_TABLET_MODE method with a module option platform/x86: asus-nb-wmi: Add tablet_mode_sw=lid-flip quirk for the TP200s asus-wmi: Add dgpu disable method platform/x86: asus-wmi: Adjust tablet/lidflip handling to use enum platform/x86: asus-wmi: Add support for ROG X13 tablet mode platform/x86: asus-wmi: Simplify tablet-mode-switch probing platform/x86: asus-wmi: Simplify tablet-mode-switch handling platform/x86: asus-wmi: Move i8042 filter install to shared asus-wmi code of: base: Fix some formatting issues and provide missing descriptions of: Fix kerneldoc output formatting of: Add missing 'Return' section in kerneldoc comments of: dynamic: Fix of_reconfig_get_state_change() return value documentation ipv6: fix potential NULL deref in fib6_add() octeontx2-pf: Add missing mutex lock in otx2_get_pauseparam hv_netvsc: rndis_filter needs to select NLS mlxbf-bootctl: correctly identify secure boot with development keys net: arcnet: com20020 fix error handling arcnet: restoring support for multiple Sohard Arcnet cards i40e: Fix unexpected MFS warning message net: bnxt: fix a potential use-after-free in bnxt_init_tc ionic: fix snprintf format length warning ionic: Fix dim work handling in split interrupt mode ipv4: ip_gre: Avoid skb_pull() failure in ipgre_xmit() net: hns: fix fake link up on xge port netfilter: xt_owner: Fix for unsafe access of sk->sk_socket tcp: do not accept ACK of bytes we never sent bpf: sockmap, updating the sg structure should also update curr tee: optee: Fix supplicant based device enumeration arm64: dts: rockchip: Expand reg size of vdec node for RK3399 RDMA/rtrs-clt: Remove the warnings for req in_use check RDMA/bnxt_re: Correct module description string hwmon: (acpi_power_meter) Fix 4.29 MW bug ASoC: wm_adsp: fix memleak in wm_adsp_buffer_populate tracing: Fix a warning when allocating buffered events fails scsi: be2iscsi: Fix a memleak in beiscsi_init_wrb_handle() ARM: imx: Check return value of devm_kasprintf in imx_mmdc_perf_init ARM: dts: imx7: Declare timers compatible with fsl,imx6dl-gpt riscv: fix misaligned access handling of C.SWSP and C.SDSP ALSA: pcm: fix out-of-bounds in snd_pcm_state_names ALSA: hda/realtek: Enable headset on Lenovo M90 Gen5 nilfs2: fix missing error check for sb_set_blocksize call nilfs2: prevent WARNING in nilfs_sufile_set_segment_usage() checkstack: fix printed address tracing: Always update snapshot buffer size tracing: Disable snapshot buffer when stopping instance tracers tracing: Fix incomplete locking when disabling buffered events tracing: Fix a possible race when disabling buffered events packet: Move reference count in packet_sock to atomic_long_t arm64: dts: mediatek: mt7622: fix memory node warning check arm64: dts: mediatek: mt8173-evb: Fix regulator-fixed node names arm64: dts: mediatek: mt8183: Fix unit address for scp reserved memory misc: mei: client.c: return negative error code in mei_cl_write misc: mei: client.c: fix problem of return '-EOVERFLOW' in mei_cl_write ring-buffer: Force absolute timestamp on discard of event tracing: Set actual size after ring buffer resize tracing: Stop current tracer when resizing buffer perf/core: Add a new read format to get a number of lost samples perf: Fix perf_event_validate_size() gpiolib: sysfs: Fix error handling on failed export drm/amdgpu: correct the amdgpu runtime dereference usage count usb: gadget: f_hid: fix report descriptor allocation parport: Add support for Brainboxes IX/UC/PX parallel cards Revert "xhci: Loosen RPM as default policy to cover for AMD xHC 1.1" usb: typec: class: fix typec_altmode_put_partner to put plugs ARM: PL011: Fix DMA support serial: sc16is7xx: address RX timeout interrupt errata serial: 8250: 8250_omap: Clear UART_HAS_RHR_IT_DIS bit serial: 8250: 8250_omap: Do not start RX DMA on THRI interrupt serial: 8250_omap: Add earlycon support for the AM654 UART controller x86/CPU/AMD: Check vendor in the AMD microcode callback KVM: s390/mm: Properly reset no-dat MIPS: Loongson64: Reserve vgabios memory on boot MIPS: Loongson64: Enable DMA noncoherent support io_uring/af_unix: disable sending io_uring over sockets netlink: don't call ->netlink_bind with table lock held genetlink: add CAP_NET_ADMIN test for multicast bind psample: Require 'CAP_NET_ADMIN' when joining "packets" group drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group netfilter: nft_set_pipapo: skip inactive elements during set walk platform/x86: asus-wmi: Fix kbd_dock_devid tablet-switch reporting tools headers UAPI: Sync linux/perf_event.h with the kernel sources platform/x86: asus-wmi: Document the dgpu_disable sysfs attribute mmc: block: Be sure to wait while busy in CQE error recovery Revert "btrfs: add dmesg output for first mount and last unmount of a filesystem" cifs: Fix non-availability of dedup breaking generic/304 smb: client: fix potential NULL deref in parse_dfs_referrals() devcoredump : Serialize devcd_del work devcoredump: Send uevent once devcd is ready r8169: fix rtl8125b PAUSE frames blasting when suspended Linux 5.10.204 Change-Id: Ic65cbf2bdbf57c9cea815a17fcec35c0b72168a2 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-12-14 15:59:58 +00:00
Ido Schimmel	e844a9309f	drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group commit e03781879a0d524ce3126678d50a80484a513c4b upstream. The "NET_DM" generic netlink family notifies drop locations over the "events" multicast group. This is problematic since by default generic netlink allows non-root users to listen to these notifications. Fix by adding a new field to the generic netlink multicast group structure that when set prevents non-root users or root without the 'CAP_SYS_ADMIN' capability (in the user namespace owning the network namespace) from joining the group. Set this field for the "events" group. Use 'CAP_SYS_ADMIN' rather than 'CAP_NET_ADMIN' because of the nature of the information that is shared over this group. Note that the capability check in this case will always be performed against the initial user namespace since the family is not netns aware and only operates in the initial network namespace. A new field is added to the structure rather than using the "flags" field because the existing field uses uAPI flags and it is inappropriate to add a new uAPI flag for an internal kernel check. In net-next we can rework the "flags" field to use internal flags and fold the new field into it. But for now, in order to reduce the amount of changes, add a new field. Since the information can only be consumed by root, mark the control plane operations that start and stop the tracing as root-only using the 'GENL_ADMIN_PERM' flag. Tested using [1]. Before: # capsh -- -c ./dm_repo # capsh --drop=cap_sys_admin -- -c ./dm_repo After: # capsh -- -c ./dm_repo # capsh --drop=cap_sys_admin -- -c ./dm_repo Failed to join "events" multicast group [1] $ cat dm.c #include <stdio.h> #include <netlink/genl/ctrl.h> #include <netlink/genl/genl.h> #include <netlink/socket.h> int main(int argc, char *argv) { struct nl_sock sk; int grp, err; sk = nl_socket_alloc(); if (!sk) { fprintf(stderr, "Failed to allocate socket\n"); return -1; } err = genl_connect(sk); if (err) { fprintf(stderr, "Failed to connect socket\n"); return err; } grp = genl_ctrl_resolve_grp(sk, "NET_DM", "events"); if (grp < 0) { fprintf(stderr, "Failed to resolve \"events\" multicast group\n"); return grp; } err = nl_socket_add_memberships(sk, grp, NFNLGRP_NONE); if (err) { fprintf(stderr, "Failed to join \"events\" multicast group\n"); return err; } return 0; } $ gcc -I/usr/include/libnl3 -lnl-3 -lnl-genl-3 -o dm_repo dm.c Fixes: `9a8afc8d39` ("Network Drop Monitor: Adding drop monitor implementation & Netlink protocol") Reported-by: "The UK's National Cyber Security Centre (NCSC)" <security@ncsc.gov.uk> Signed-off-by: Ido Schimmel <idosch@nvidia.com> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Jiri Pirko <jiri@nvidia.com> Link: https://lore.kernel.org/r/20231206213102.1824398-3-idosch@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-12-13 18:27:06 +01:00
Ido Schimmel	015870c10c	genetlink: add CAP_NET_ADMIN test for multicast bind This is a partial backport of upstream commit 4d54cc32112d ("mptcp: avoid lock_fast usage in accept path"). It is only a partial backport because the patch in the link below was erroneously squash-merged into upstream commit 4d54cc32112d ("mptcp: avoid lock_fast usage in accept path"). Below is the original patch description from Florian Westphal: " genetlink sets NL_CFG_F_NONROOT_RECV for its netlink socket so anyone can subscribe to multicast messages. rtnetlink doesn't allow this unconditionally, rtnetlink_bind() restricts bind requests to CAP_NET_ADMIN for a few groups. This allows to set GENL_UNS_ADMIN_PERM flag on genl mcast groups to mandate CAP_NET_ADMIN. This will be used by the upcoming mptcp netlink event facility which exposes the token (mptcp connection identifier) to userspace. " Link: https://lore.kernel.org/mptcp/20210213000001.379332-8-mathew.j.martineau@linux.intel.com/ Signed-off-by: Ido Schimmel <idosch@nvidia.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-12-13 18:27:06 +01:00
Greg Kroah-Hartman	7999a9a70d	This is the 5.10.202 stable release -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmVmG20ACgkQONu9yGCS aT6dzg/7BnCP2SpVmgEaD7FdPvGO/A6O5VrC9zu3sQE6g2gAwirZhdgE8NRn+ggm WSQ1kIA+HEcY23FKpq46pBED4P1irudiW7DkLw8nyOGp+XLb4wGkF5lBBP5z+B2P ga2RgwqKvYWeDaUW4n1Uy7m2Cz+wqCg/EvnITo40glSWPh20gM532/CSnA5akoje 9mjZYZ0rKHKTZGu65aNScNR7XnXHIivJU6C1jF6L9N1+Xn679nUHKQP4KM/RcjpX g1WQMWFC3mGIn5IX28W1wvKS320D5HLmTLnLqJvFpJN9+13DUnUoXcX469zvQoxJ GL3S94goWN/0BPOgr5KcKvTj00b4O+EWhQuQt+x8NLdydzRQuyFu2UpLNhIKKSou sT+BcxzeuqJhEh1tZItcZkZBptpLEkb0ezT11u5McnU5FjPzzzP8CtEetKKmEaBU AUoEP/lQQlVyk1I6xAeuzu53smncNQt6CqnXJxYXOBGgJ2txAM5kroMKXPin5C8k BCpUIqghhKmBd1hwuKyaOBKF99eLKKZsuvXppoPD0Yz7/Nq5TgdBw0qbNt2iLr05 XSM7WIIeCBROaV+ZiVxgtcXDR51FpMr7CLTbkBQ6IgLwircHeHSK7rQn7kFO3fCg OezhWAuh72qDZ2PCJ84fj21IhZ49a5oCLbUdBew+KzZervVpSo0= =eW67 -----END PGP SIGNATURE----- Merge 5.10.202 into android12-5.10-lts Changes in 5.10.202 locking/ww_mutex/test: Fix potential workqueue corruption perf/core: Bail out early if the request AUX area is out of bound clocksource/drivers/timer-imx-gpt: Fix potential memory leak clocksource/drivers/timer-atmel-tcb: Fix initialization on SAM9 hardware x86/mm: Drop the 4 MB restriction on minimal NUMA node memory size wifi: mac80211_hwsim: fix clang-specific fortify warning wifi: mac80211: don't return unset power in ieee80211_get_tx_power() bpf: Detect IP == ksym.end as part of BPF program wifi: ath9k: fix clang-specific fortify warnings wifi: ath10k: fix clang-specific fortify warning net: annotate data-races around sk->sk_tx_queue_mapping net: annotate data-races around sk->sk_dst_pending_confirm wifi: ath10k: Don't touch the CE interrupt registers after power up Bluetooth: btusb: Add date->evt_skb is NULL check Bluetooth: Fix double free in hci_conn_cleanup platform/x86: thinkpad_acpi: Add battery quirk for Thinkpad X120e drm/komeda: drop all currently held locks if deadlock happens drm/msm/dp: skip validity check for DP CTS EDID checksum drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7 drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga drm/amdgpu: Fix potential null pointer derefernce drm/panel: fix a possible null pointer dereference drm/panel/panel-tpo-tpg110: fix a possible null pointer dereference drm/panel: st7703: Pick different reset sequence drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL selftests/efivarfs: create-read: fix a resource leak ASoC: soc-card: Add storage for PCI SSID crypto: pcrypt - Fix hungtask for PADATA_RESET RDMA/hfi1: Use FIELD_GET() to extract Link Width fs/jfs: Add check for negative db_l2nbperpage fs/jfs: Add validity check for db_maxag and db_agpref jfs: fix array-index-out-of-bounds in dbFindLeaf jfs: fix array-index-out-of-bounds in diAlloc HID: lenovo: Detect quirk-free fw on cptkbd and stop applying workaround ARM: 9320/1: fix stack depot IRQ stack filter ALSA: hda: Fix possible null-ptr-deref when assigning a stream PCI: tegra194: Use FIELD_GET()/FIELD_PREP() with Link Width fields atm: iphase: Do PCI error checks on own line scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() misc: pci_endpoint_test: Add Device ID for R-Car S4-8 PCIe controller HID: Add quirk for Dell Pro Wireless Keyboard and Mouse KM5221W exfat: support handle zero-size directory tty: vcc: Add check for kstrdup() in vcc_probe() usb: gadget: f_ncm: Always set current gadget in ncm_bind() 9p/trans_fd: Annotate data-racy writes to file::f_flags i2c: sun6i-p2wi: Prevent potential division by zero media: gspca: cpia1: shift-out-of-bounds in set_flicker media: vivid: avoid integer overflow gfs2: ignore negated quota changes gfs2: fix an oops in gfs2_permission media: cobalt: Use FIELD_GET() to extract Link Width media: imon: fix access to invalid resource for the second interface drm/amd/display: Avoid NULL dereference of timing generator kgdb: Flush console before entering kgdb on panic ASoC: ti: omap-mcbsp: Fix runtime PM underflow warnings drm/amdgpu: fix software pci_unplug on some chips pwm: Fix double shift bug wifi: iwlwifi: Use FW rate for non-data frames xhci: turn cancelled td cleanup to its own function SUNRPC: ECONNRESET might require a rebind SUNRPC: Add an IS_ERR() check back to where it was NFSv4.1: fix SP4_MACH_CRED protection for pnfs IO SUNRPC: Fix RPC client cleaned up the freed pipefs dentries gfs2: Silence "suspicious RCU usage in gfs2_permission" warning ipvlan: add ipvlan_route_v6_outbound() helper tty: Fix uninit-value access in ppp_sync_receive() net: hns3: fix variable may not initialized problem in hns3_init_mac_addr() net: hns3: fix VF reset fail issue tipc: Fix kernel-infoleak due to uninitialized TLV value ppp: limit MRU to 64K xen/events: fix delayed eoi list handling ptp: annotate data-race around q->head and q->tail bonding: stop the device in bond_setup_by_slave() net: ethernet: cortina: Fix max RX frame define net: ethernet: cortina: Handle large frames net: ethernet: cortina: Fix MTU max setting netfilter: nf_conntrack_bridge: initialize err to 0 net: stmmac: fix rx budget limit check net/mlx5e: fix double free of encap_header net/mlx5_core: Clean driver version and name net/mlx5e: Check return value of snprintf writing to fw_version buffer for representors macvlan: Don't propagate promisc change to lower dev in passthru tools/power/turbostat: Fix a knl bug cifs: spnego: add ';' in HOST_KEY_LEN cifs: fix check of rc in function generate_smb3signingkey media: venus: hfi: add checks to perform sanity on queue pointers powerpc/perf: Fix disabling BHRB and instruction sampling randstruct: Fix gcc-plugin performance mode to stay in group bpf: Fix check_stack_write_fixed_off() to correctly spill imm bpf: Fix precision tracking for BPF_ALU \| BPF_TO_BE \| BPF_END scsi: mpt3sas: Fix loop logic scsi: megaraid_sas: Increase register read retry rount from 3 to 30 for selected registers x86/cpu/hygon: Fix the CPU topology evaluation for real KVM: x86: hyper-v: Don't auto-enable stimer on write from user-space KVM: x86: Ignore MSR_AMD64_TW_CFG access audit: don't take task_lock() in audit_exe_compare() code path audit: don't WARN_ON_ONCE(!current->mm) in audit_exe_compare() tty/sysrq: replace smp_processor_id() with get_cpu() hvc/xen: fix console unplug hvc/xen: fix error path in xen_hvc_init() to always register frontend driver PCI/sysfs: Protect driver's D3cold preference from user space watchdog: move softlockup_panic back to early_param ACPI: resource: Do IRQ override on TongFang GMxXGxx arm64: Restrict CPU_BIG_ENDIAN to GNU as or LLVM IAS 15.x or newer parisc/pdc: Add width field to struct pdc_model clk: qcom: ipq8074: drop the CLK_SET_RATE_PARENT flag from PLL clocks clk: qcom: ipq6018: drop the CLK_SET_RATE_PARENT flag from PLL clocks mmc: vub300: fix an error code mmc: sdhci_am654: fix start loop index for TAP value parsing PCI/ASPM: Fix L1 substate handling in aspm_attr_store_common() arm64: dts: qcom: ipq6018: Fix hwlock index for SMEM PM: hibernate: Use __get_safe_page() rather than touching the list PM: hibernate: Clean up sync_read handling in snapshot_write_next() rcu: kmemleak: Ignore kmemleak false positives when RCU-freeing objects btrfs: don't arbitrarily slow down delalloc if we're committing firmware: qcom_scm: use 64-bit calling convention only when client is 64-bit ima: detect changes to the backing overlay file wifi: ath11k: fix temperature event locking wifi: ath11k: fix dfs radar event locking wifi: ath11k: fix htt pktlog locking mmc: meson-gx: Remove setting of CMD_CFG_ERROR genirq/generic_chip: Make irq_remove_generic_chip() irqdomain aware PCI: keystone: Don't discard .remove() callback PCI: keystone: Don't discard .probe() callback jbd2: fix potential data lost in recovering journal raced with synchronizing fs bdev quota: explicitly forbid quota files from being encrypted kernel/reboot: emergency_restart: Set correct system_state i2c: core: Run atomic i2c xfer when !preemptible mcb: fix error handling for different scenarios when parsing dmaengine: stm32-mdma: correct desc prep when channel running mm/cma: use nth_page() in place of direct struct page manipulation mm/memory_hotplug: use pfn math in place of direct struct page manipulation mtd: cfi_cmdset_0001: Byte swap OTP info i3c: master: cdns: Fix reading status register parisc: Prevent booting 64-bit kernels on PA1.x machines parisc/pgtable: Do not drop upper 5 address bits of physical address xhci: Enable RPM on controllers that support low-power states ALSA: info: Fix potential deadlock at disconnection ALSA: hda/realtek - Add Dell ALC295 to pin fall back table ALSA: hda/realtek - Enable internal speaker of ASUS K6500ZC serial: meson: remove redundant initialization of variable id tty: serial: meson: retrieve port FIFO size from DT serial: meson: Use platform_get_irq() to get the interrupt tty: serial: meson: fix hard LOCKUP on crtscts mode cpufreq: stats: Fix buffer overflow detection in trans_stats() Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0cb8:0xc559 bluetooth: Add device 0bda:887b to device tables bluetooth: Add device 13d3:3571 to device tables Bluetooth: btusb: Add RTW8852BE device 13d3:3570 to device tables Bluetooth: btusb: Add 0bda:b85b for Fn-Link RTL8852BE PCI: exynos: Don't discard .remove() callback arm64: dts: qcom: ipq6018: switch TCSR mutex to MMIO arm64: dts: qcom: ipq6018: Fix tcsr_mutex register size Revert ncsi: Propagate carrier gain/loss events to the NCSI controller lsm: fix default return value for vm_enough_memory lsm: fix default return value for inode_getsecctx i2c: designware: Disable TX_EMPTY irq while waiting for block length byte net: dsa: lan9303: consequently nested-lock physical MDIO net: phylink: initialize carrier state at creation i2c: i801: fix potential race in i801_block_transaction_byte_by_byte f2fs: avoid format-overflow warning media: lirc: drop trailing space from scancode transmit media: sharp: fix sharp encoding media: venus: hfi_parser: Add check to keep the number of codecs within range media: venus: hfi: fix the check to handle session buffer requirement media: venus: hfi: add checks to handle capabilities from firmware nfsd: fix file memleak on client_opens_release mm: kmem: drop __GFP_NOFAIL when allocating objcg vectors media: qcom: camss: Fix vfe_get() error jump Revert "net: r8169: Disable multicast filter for RTL8168H and RTL8107E" ext4: apply umask if ACL support is disabled ext4: correct offset of gdb backup in non meta_bg group to update_backups ext4: correct return value of ext4_convert_meta_bg ext4: correct the start block of counting reserved clusters ext4: remove gdb backup copy for meta bg in setup_new_flex_group_blocks drm/amd/pm: Handle non-terminated overdrive commands. drm/amdgpu: fix error handling in amdgpu_bo_list_get() drm/amd/display: Change the DMCUB mailbox memory location from FB to inbox io_uring/fdinfo: lock SQ thread while retrieving thread cpu/pid tracing: Have trace_event_file have ref counters netfilter: nftables: update table flags from the commit phase netfilter: nf_tables: fix table flag updates netfilter: nf_tables: disable toggling dormant table state more than once interconnect: qcom: Add support for mask-based BCMs Linux 5.10.202 Change-Id: I762bcd4848d9b87cbb4efe4104fe1685999dc0f7 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-12-08 16:26:36 +00:00
Greg Kroah-Hartman	ddeac706a1	Revert "inet: shrink struct flowi_common" This reverts commit `f830d4f698` which is commit 1726483b79a72e0150734d5367e4a0238bf8fcff upstream. It only moves things around a structure, AND it saves lots of memory, but in doing so breaks the stable Android ABI, so it must be reverted (Android devices have plenty of kernel memory...) If this is to come back in the future, it can do so in an abi-safe way. Bug: 161946584 Change-Id: I5a5a40c6f6982122d766f3fe5cfde3f3514bc9ae Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-12-08 14:54:59 +00:00
Greg Kroah-Hartman	cf3a19d56e	Merge 5.10.201 into android12-5.10-lts Changes in 5.10.201 iov_iter, x86: Be consistent about the __user tag on copy_mc_to_user() sched/uclamp: Ignore (util == 0) optimization in feec() when p_util_max = 0 vfs: fix readahead(2) on block devices x86/srso: Fix SBPB enablement for (possible) future fixed HW futex: Don't include process MM in futex key on no-MMU x86/boot: Fix incorrect startup_gdt_descr.size pstore/platform: Add check for kstrdup genirq/matrix: Exclude managed interrupts in irq_matrix_allocated() i40e: fix potential memory leaks in i40e_remove() udp: add missing WRITE_ONCE() around up->encap_rcv tcp: call tcp_try_undo_recovery when an RTOd TFO SYNACK is ACKed overflow: Implement size_t saturating arithmetic helpers gve: Use size_add() in call to struct_size() mlxsw: Use size_mul() in call to struct_size() tipc: Use size_add() in calls to struct_size() net: spider_net: Use size_add() in call to struct_size() wifi: rtw88: debug: Fix the NULL vs IS_ERR() bug for debugfs_create_file() wifi: mt76: mt7603: rework/fix rx pse hang check tcp_metrics: add missing barriers on delete tcp_metrics: properly set tp->snd_ssthresh in tcp_init_metrics() tcp_metrics: do not create an entry from tcp_init_metrics() wifi: rtlwifi: fix EDCA limit set by BT coexistence can: dev: can_restart(): don't crash kernel if carrier is OK can: dev: can_restart(): fix race condition between controller restart and netif_carrier_on() PM / devfreq: rockchip-dfi: Make pmu regmap mandatory thermal: core: prevent potential string overflow r8169: use tp_to_dev instead of open code r8169: fix rare issue with broken rx after link-down on RTL8125 chtls: fix tp->rcv_tstamp initialization tcp: fix cookie_init_timestamp() overflows ACPI: sysfs: Fix create_pnp_modalias() and create_of_modalias() ipv6: avoid atomic fragment on GSO packets net: add DEV_STATS_READ() helper ipvlan: properly track tx_errors regmap: debugfs: Fix a erroneous check after snprintf() clk: qcom: clk-rcg2: Fix clock rate overflow for high parent frequencies clk: qcom: mmcc-msm8998: Add hardware clockgating registers to some clks clk: qcom: mmcc-msm8998: Don't check halt bit on some branch clks clk: qcom: mmcc-msm8998: Set bimc_smmu_gdsc always on clk: qcom: mmcc-msm8998: Fix the SMMU GDSC clk: qcom: gcc-sm8150: use ARRAY_SIZE instead of specifying num_parents clk: qcom: gcc-sm8150: Fix gcc_sdcc2_apps_clk_src clk: imx: Select MXC_CLK for CLK_IMX8QXP clk: imx: imx8mq: correct error handling path clk: asm9260: use parent index to link the reference clock clk: linux/clk-provider.h: fix kernel-doc warnings and typos spi: nxp-fspi: use the correct ioremap function clk: keystone: pll: fix a couple NULL vs IS_ERR() checks clk: ti: Add ti_dt_clk_name() helper to use clock-output-names clk: ti: Update pll and clockdomain clocks to use ti_dt_clk_name() clk: ti: Update component clocks to use ti_dt_clk_name() clk: ti: change ti_clk_register[_omap_hw]() API clk: ti: fix double free in of_ti_divider_clk_setup() clk: npcm7xx: Fix incorrect kfree clk: mediatek: clk-mt6765: Add check for mtk_alloc_clk_data clk: mediatek: clk-mt6779: Add check for mtk_alloc_clk_data clk: mediatek: clk-mt6797: Add check for mtk_alloc_clk_data clk: mediatek: clk-mt7629-eth: Add check for mtk_alloc_clk_data clk: mediatek: clk-mt7629: Add check for mtk_alloc_clk_data clk: mediatek: clk-mt2701: Add check for mtk_alloc_clk_data clk: qcom: config IPQ_APSS_6018 should depend on QCOM_SMEM platform/x86: wmi: Fix probe failure when failing to register WMI devices platform/x86: wmi: remove unnecessary initializations platform/x86: wmi: Fix opening of char device hwmon: (axi-fan-control) Support temperature vs pwm points hwmon: (axi-fan-control) Fix possible NULL pointer dereference hwmon: (coretemp) Fix potentially truncated sysfs attribute name drm/rockchip: vop: Fix reset of state in duplicate state crtc funcs drm/rockchip: vop: Fix call to crtc reset helper drm/radeon: possible buffer overflow drm/bridge: tc358768: Fix use of uninitialized variable drm/bridge: tc358768: Disable non-continuous clock mode drm/bridge: tc358768: Fix bit updates drm/mediatek: Fix iommu fault during crtc enabling drm/rockchip: cdn-dp: Fix some error handling paths in cdn_dp_probe() arm64/arm: xen: enlighten: Fix KPTI checks drm/rockchip: Fix type promotion bug in rockchip_gem_iommu_map() xen-pciback: Consider INTx disabled when MSI/MSI-X is enabled arm64: dts: qcom: msm8916: Fix iommu local address range arm64: dts: qcom: sdm845-mtp: fix WiFi configuration ARM: dts: qcom: mdm9615: populate vsdcc fixed regulator soc: qcom: llcc: Handle a second device without data corruption firmware: ti_sci: Mark driver as non removable clk: scmi: Free scmi_clk allocated when the clocks with invalid info are skipped selftests/pidfd: Fix ksft print formats selftests/resctrl: Ensure the benchmark commands fits to its array crypto: hisilicon/hpre - Fix a erroneous check after snprintf() hwrng: geode - fix accessing registers libnvdimm/of_pmem: Use devm_kstrdup instead of kstrdup and check its return value nd_btt: Make BTT lanes preemptible crypto: caam/qi2 - fix Chacha20 + Poly1305 self test failure crypto: caam/jr - fix Chacha20 + Poly1305 self test failure crypto: qat - mask device capabilities with soft straps crypto: qat - increase size of buffers hid: cp2112: Fix duplicate workqueue initialization ARM: 9321/1: memset: cast the constant byte to unsigned char ext4: move 'ix' sanity check to corrent position ASoC: fsl: mpc5200_dma.c: Fix warning of Function parameter or member not described IB/mlx5: Fix rdma counter binding for RAW QP RDMA/hns: Fix uninitialized ucmd in hns_roce_create_qp_common() RDMA/hns: Fix signed-unsigned mixed comparisons ASoC: fsl: Fix PM disable depth imbalance in fsl_easrc_probe scsi: ufs: core: Leave space for '\0' in utf8 desc string RDMA/hfi1: Workaround truncation compilation error hid: cp2112: Fix IRQ shutdown stopping polling for all IRQs on chip sh: bios: Revive earlyprintk support Revert "HID: logitech-hidpp: add a module parameter to keep firmware gestures" HID: logitech-hidpp: Remove HIDPP_QUIRK_NO_HIDINPUT quirk HID: logitech-hidpp: Don't restart IO, instead defer hid_connect() only HID: logitech-hidpp: Revert "Don't restart communication if not necessary" HID: logitech-hidpp: Move get_wireless_feature_index() check to hidpp_connect_event() ASoC: Intel: Skylake: Fix mem leak when parsing UUIDs fails padata: Convert from atomic_t to refcount_t on parallel_data->refcnt padata: Fix refcnt handling in padata_free_shell() ASoC: ams-delta.c: use component after check mfd: core: Un-constify mfd_cell.of_reg mfd: core: Ensure disabled devices are skipped without aborting mfd: dln2: Fix double put in dln2_probe leds: pwm: Don't disable the PWM when the LED should be off leds: trigger: ledtrig-cpu:: Fix 'output may be truncated' issue for 'cpu' tty: tty_jobctrl: fix pid memleak in disassociate_ctty() livepatch: Fix missing newline character in klp_resolve_symbols() usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency dmaengine: ti: edma: handle irq_of_parse_and_map() errors misc: st_core: Do not call kfree_skb() under spin_lock_irqsave() tools: iio: privatize globals and functions in iio_generic_buffer.c file tools: iio: iio_generic_buffer: Fix some integer type and calculation tools: iio: iio_generic_buffer ensure alignment USB: usbip: fix stub_dev hub disconnect dmaengine: pxa_dma: Remove an erroneous BUG_ON() in pxad_free_desc() f2fs: fix to initialize map.m_pblk in f2fs_precache_extents() interconnect: qcom: sc7180: Retire DEFINE_QBCM interconnect: qcom: sc7180: Set ACV enable_mask modpost: fix tee MODULE_DEVICE_TABLE built on big-endian host powerpc/40x: Remove stale PTE_ATOMIC_UPDATES macro powerpc/xive: Fix endian conversion size powerpc/imc-pmu: Use the correct spinlock initializer. powerpc/pseries: fix potential memory leak in init_cpu_associativity() xhci: Loosen RPM as default policy to cover for AMD xHC 1.1 usb: host: xhci-plat: fix possible kernel oops while resuming perf machine: Avoid out of bounds LBR memory read perf hist: Add missing puts to hist__account_cycles i3c: Fix potential refcount leak in i3c_master_register_new_i3c_devs rtc: pcf85363: fix wrong mask/val parameters in regmap_update_bits call pcmcia: cs: fix possible hung task and memory leak pccardd() pcmcia: ds: fix refcount leak in pcmcia_device_add() pcmcia: ds: fix possible name leak in error path in pcmcia_device_add() media: i2c: max9286: Fix some redundant of_node_put() calls media: bttv: fix use after free error due to btv->timeout timer media: s3c-camif: Avoid inappropriate kfree() media: vidtv: psi: Add check for kstrdup media: vidtv: mux: Add check and kfree for kstrdup media: cedrus: Fix clock/reset sequence media: dvb-usb-v2: af9035: fix missing unlock regmap: prevent noinc writes from clobbering cache pwm: sti: Avoid conditional gotos pwm: sti: Reduce number of allocations and drop usage of chip_data pwm: brcmstb: Utilize appropriate clock APIs in suspend/resume Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() llc: verify mac len before reading mac header hsr: Prevent use after free in prp_create_tagged_frame() tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING inet: shrink struct flowi_common dccp: Call security_inet_conn_request() after setting IPv4 addresses. dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses. net: r8169: Disable multicast filter for RTL8168H and RTL8107E Fix termination state for idr_for_each_entry_ul() net: stmmac: xgmac: Enable support for multiple Flexible PPS outputs net/smc: fix dangling sock under state SMC_APPFINCLOSEWAIT net/smc: allow cdc msg send rather than drop it with NULL sndbuf_desc net/smc: put sk reference if close work was canceled tg3: power down device only on SYSTEM_POWER_OFF r8169: respect userspace disabling IFF_MULTICAST netfilter: xt_recent: fix (increase) ipv6 literal buffer length netfilter: nft_redir: use `struct nf_nat_range2` throughout and deduplicate eval call-backs netfilter: nat: fix ipv6 nat redirect with mapped and scoped addresses x86: Share definition of __is_canonical_address() x86/sev-es: Allow copy_from_kernel_nofault() in earlier boot drm/syncobj: fix DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE spi: spi-zynq-qspi: add spi-mem to driver kconfig dependencies fbdev: imsttfb: Fix error path of imsttfb_probe() fbdev: imsttfb: fix a resource leak in probe fbdev: fsl-diu-fb: mark wr_reg_wa() static tracing/kprobes: Fix the order of argument descriptions Revert "mmc: core: Capture correct oemid-bits for eMMC cards" btrfs: use u64 for buffer sizes in the tree search ioctls Linux 5.10.201 Change-Id: I0ce874e25eb6aeebf5826d6ef843fdbbf55d7c7d Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-11-29 14:46:51 +00:00
Pablo Neira Ayuso	d9c4da8cb7	netfilter: nf_tables: fix table flag updates commit 179d9ba5559a756f4322583388b3213fe4e391b0 upstream. The dormant flag need to be updated from the preparation phase, otherwise, two consecutive requests to dorm a table in the same batch might try to remove the same hooks twice, resulting in the following warning: hook not found, pf 3 num 0 WARNING: CPU: 0 PID: 334 at net/netfilter/core.c:480 __nf_unregister_net_hook+0x1eb/0x610 net/netfilter/core.c:480 Modules linked in: CPU: 0 PID: 334 Comm: kworker/u4:5 Not tainted 5.12.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: netns cleanup_net RIP: 0010:__nf_unregister_net_hook+0x1eb/0x610 net/netfilter/core.c:480 This patch is a partial revert of 0ce7cf4127f1 ("netfilter: nftables: update table flags from the commit phase") to restore the previous behaviour. However, there is still another problem: A batch containing a series of dorm-wakeup-dorm table and vice-versa also trigger the warning above since hook unregistration happens from the preparation phase, while hook registration occurs from the commit phase. To fix this problem, this patch adds two internal flags to annotate the original dormant flag status which are __NFT_TABLE_F_WAS_DORMANT and __NFT_TABLE_F_WAS_AWAKEN, to restore it from the abort path. The __NFT_TABLE_F_UPDATE bitmask allows to handle the dormant flag update with one single transaction. Reported-by: syzbot+7ad5cd1615f2d89c6e7e@syzkaller.appspotmail.com Fixes: 0ce7cf4127f1 ("netfilter: nftables: update table flags from the commit phase") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-11-28 16:55:02 +00:00
Pablo Neira Ayuso	7d1d3f1134	netfilter: nftables: update table flags from the commit phase commit 0ce7cf4127f14078ca598ba9700d813178a59409 upstream. Do not update table flags from the preparation phase. Store the flags update into the transaction, then update the flags from the commit phase. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-11-28 16:55:02 +00:00
Eric Dumazet	22fa35ded3	net: annotate data-races around sk->sk_dst_pending_confirm [ Upstream commit eb44ad4e635132754bfbcb18103f1dcb7058aedd ] This field can be read or written without socket lock being held. Add annotations to avoid load-store tearing. Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-11-28 16:54:50 +00:00
Eric Dumazet	67b7de95d1	net: annotate data-races around sk->sk_tx_queue_mapping [ Upstream commit 0bb4d124d34044179b42a769a0c76f389ae973b6 ] This field can be read or written without socket lock being held. Add annotations to avoid load-store tearing. Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-11-28 16:54:49 +00:00
Jeremy Sowden	b65d851b2e	netfilter: nft_redir: use `struct nf_nat_range2` throughout and deduplicate eval call-backs [ Upstream commit 6f56ad1b92328997e1b1792047099df6f8d7acb5 ] `nf_nat_redirect_ipv4` takes a `struct nf_nat_ipv4_multi_range_compat`, but converts it internally to a `struct nf_nat_range2`. Change the function to take the latter, factor out the code now shared with `nf_nat_redirect_ipv6`, move the conversion to the xt_REDIRECT module, and update the ipv4 range initialization in the nft_redir module. Replace a bare hex constant for 127.0.0.1 with a macro. Remove `WARN_ON`. `nf_nat_setup_info` calls `nf_ct_is_confirmed`: /* Can't setup nat info for confirmed ct. */ if (nf_ct_is_confirmed(ct)) return NF_ACCEPT; This means that `ct` cannot be null or the kernel will crash, and implies that `ctinfo` is `IP_CT_NEW` or `IP_CT_RELATED`. nft_redir has separate ipv4 and ipv6 call-backs which share much of their code, and an inet one switch containing a switch that calls one of the others based on the family of the packet. Merge the ipv4 and ipv6 ones into the inet one in order to get rid of the duplicate code. Const-qualify the `priv` pointer since we don't need to write through it. Assign `priv->flags` to the range instead of OR-ing it in. Set the `NF_NAT_RANGE_PROTO_SPECIFIED` flag once during init, rather than on every eval. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Florian Westphal <fw@strlen.de> Stable-dep-of: 80abbe8a8263 ("netfilter: nat: fix ipv6 nat redirect with mapped and scoped addresses") Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-11-20 11:06:56 +01:00

1 2 3 4 5 ...

14841 Commits