Commit Graph

13224 Commits

Author SHA1 Message Date
Greg Kroah-Hartman
e0b884a0f5 ANDROID: GKI: sock.h: add Android ABI padding to some structures
Try to mitigate potential future driver core api changes by adding a
padding to struct sock.

Based on a patch from Michal Marek <mmarek@suse.cz> from the SLES kernel

Leaf changes summary: 1 artifact changed
Changed leaf types summary: 1 leaf type changed
Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 0 Added function
Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variable

'struct sock at sock.h:324:1' changed:
  type size changed from 6016 to 6528 (in bits)
  8 data member insertions:
    'u64 sock::android_kabi_reserved1', at offset 6016 (in bits) at sock.h:516:1
    'u64 sock::android_kabi_reserved2', at offset 6080 (in bits) at sock.h:517:1
    'u64 sock::android_kabi_reserved3', at offset 6144 (in bits) at sock.h:518:1
    'u64 sock::android_kabi_reserved4', at offset 6208 (in bits) at sock.h:519:1
    'u64 sock::android_kabi_reserved5', at offset 6272 (in bits) at sock.h:520:1
    'u64 sock::android_kabi_reserved6', at offset 6336 (in bits) at sock.h:521:1
    'u64 sock::android_kabi_reserved7', at offset 6400 (in bits) at sock.h:522:1
    'u64 sock::android_kabi_reserved8', at offset 6464 (in bits) at sock.h:523:1

Bug: 151154716
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I61c3d6cf12c087345db71fc6d93ee6bd58969003
2020-03-19 11:56:25 +01:00
Greg Kroah-Hartman
0d3cca0c7d Merge 5.4.26 into android-5.4
Changes in 5.4.26
	virtio_balloon: Adjust label in virtballoon_probe
	ALSA: hda/realtek - More constifications
	ALSA: hda/realtek - Add Headset Mic supported for HP cPC
	ALSA: hda/realtek - Fixed one of HP ALC671 platform Headset Mic supported
	cgroup, netclassid: periodically release file_lock on classid updating
	gre: fix uninit-value in __iptunnel_pull_header
	inet_diag: return classid for all socket types
	ipv6/addrconf: call ipv6_mc_up() for non-Ethernet interface
	ipvlan: add cond_resched_rcu() while processing muticast backlog
	ipvlan: do not add hardware address of master to its unicast filter list
	ipvlan: do not use cond_resched_rcu() in ipvlan_process_multicast()
	ipvlan: don't deref eth hdr before checking it's set
	macvlan: add cond_resched() during multicast processing
	net: dsa: fix phylink_start()/phylink_stop() calls
	net: dsa: mv88e6xxx: fix lockup on warm boot
	net: fec: validate the new settings in fec_enet_set_coalesce()
	net: hns3: fix a not link up issue when fibre port supports autoneg
	net/ipv6: use configured metric when add peer route
	netlink: Use netlink header as base to calculate bad attribute offset
	net: macsec: update SCI upon MAC address change.
	net: nfc: fix bounds checking bugs on "pipe"
	net/packet: tpacket_rcv: do not increment ring index on drop
	net: phy: bcm63xx: fix OOPS due to missing driver name
	net: stmmac: dwmac1000: Disable ACS if enhanced descs are not used
	net: systemport: fix index check to avoid an array out of bounds access
	r8152: check disconnect status after long sleep
	sfc: detach from cb_page in efx_copy_channel()
	slip: make slhc_compress() more robust against malicious packets
	taprio: Fix sending packets without dequeueing them
	bonding/alb: make sure arp header is pulled before accessing it
	bnxt_en: reinitialize IRQs when MTU is modified
	bnxt_en: fix error handling when flashing from file
	cgroup: memcg: net: do not associate sock with unrelated cgroup
	net: memcg: late association of sock to memcg
	net: memcg: fix lockdep splat in inet_csk_accept()
	devlink: validate length of param values
	devlink: validate length of region addr/len
	fib: add missing attribute validation for tun_id
	nl802154: add missing attribute validation
	nl802154: add missing attribute validation for dev_type
	can: add missing attribute validation for termination
	macsec: add missing attribute validation for port
	net: fq: add missing attribute validation for orphan mask
	net: taprio: add missing attribute validation for txtime delay
	team: add missing attribute validation for port ifindex
	team: add missing attribute validation for array index
	tipc: add missing attribute validation for MTU property
	nfc: add missing attribute validation for SE API
	nfc: add missing attribute validation for deactivate target
	nfc: add missing attribute validation for vendor subcommand
	net: phy: avoid clearing PHY interrupts twice in irq handler
	net: phy: fix MDIO bus PM PHY resuming
	net/ipv6: need update peer route when modify metric
	net/ipv6: remove the old peer route if change it to a new one
	selftests/net/fib_tests: update addr_metric_test for peer route testing
	net: dsa: Don't instantiate phylink for CPU/DSA ports unless needed
	net: phy: Avoid multiple suspends
	cgroup: cgroup_procs_next should increase position index
	cgroup: Iterate tasks that did not finish do_exit()
	netfilter: nf_tables: fix infinite loop when expr is not available
	iwlwifi: mvm: Do not require PHY_SKU NVM section for 3168 devices
	virtio-blk: fix hw_queue stopped on arbitrary error
	iommu/vt-d: quirk_ioat_snb_local_iommu: replace WARN_TAINT with pr_warn + add_taint
	netfilter: nf_conntrack: ct_cpu_seq_next should increase position index
	netfilter: synproxy: synproxy_cpu_seq_next should increase position index
	netfilter: xt_recent: recent_seq_next should increase position index
	netfilter: x_tables: xt_mttg_seq_next should increase position index
	workqueue: don't use wq_select_unbound_cpu() for bound works
	drm/amd/display: remove duplicated assignment to grph_obj_type
	drm/i915: be more solid in checking the alignment
	drm/i915: Defer semaphore priority bumping to a workqueue
	mmc: sdhci-pci-gli: Enable MSI interrupt for GL975x
	pinctrl: falcon: fix syntax error
	ktest: Add timeout for ssh sync testing
	cifs_atomic_open(): fix double-put on late allocation failure
	gfs2_atomic_open(): fix O_EXCL|O_CREAT handling on cold dcache
	KVM: x86: clear stale x86_emulate_ctxt->intercept value
	KVM: nVMX: avoid NULL pointer dereference with incorrect EVMCS GPAs
	ARC: define __ALIGN_STR and __ALIGN symbols for ARC
	fuse: fix stack use after return
	s390/dasd: fix data corruption for thin provisioned devices
	ipmi_si: Avoid spurious errors for optional IRQs
	blk-iocost: fix incorrect vtime comparison in iocg_is_idle()
	fscrypt: don't evict dirty inodes after removing key
	macintosh: windfarm: fix MODINFO regression
	x86/ioremap: Map EFI runtime services data as encrypted for SEV
	efi: Fix a race and a buffer overflow while reading efivars via sysfs
	efi: Add a sanity check to efivar_store_raw()
	i2c: designware-pci: Fix BUG_ON during device removal
	mt76: fix array overflow on receiving too many fragments for a packet
	perf/amd/uncore: Replace manual sampling check with CAP_NO_INTERRUPT flag
	x86/mce: Fix logic and comments around MSR_PPIN_CTL
	iommu/dma: Fix MSI reservation allocation
	iommu/vt-d: dmar: replace WARN_TAINT with pr_warn + add_taint
	iommu/vt-d: Fix RCU list debugging warnings
	iommu/vt-d: Fix a bug in intel_iommu_iova_to_phys() for huge page
	batman-adv: Don't schedule OGM for disabled interface
	clk: imx8mn: Fix incorrect clock defines
	pinctrl: meson-gxl: fix GPIOX sdio pins
	pinctrl: imx: scu: Align imx sc msg structs to 4
	virtio_ring: Fix mem leak with vring_new_virtqueue()
	drm/i915/gvt: Fix dma-buf display blur issue on CFL
	pinctrl: core: Remove extra kref_get which blocks hogs being freed
	drm/i915/gvt: Fix unnecessary schedule timer when no vGPU exits
	driver code: clarify and fix platform device DMA mask allocation
	iommu/vt-d: Fix RCU-list bugs in intel_iommu_init()
	i2c: gpio: suppress error on probe defer
	nl80211: add missing attribute validation for critical protocol indication
	nl80211: add missing attribute validation for beacon report scanning
	nl80211: add missing attribute validation for channel switch
	perf bench futex-wake: Restore thread count default to online CPU count
	netfilter: cthelper: add missing attribute validation for cthelper
	netfilter: nft_payload: add missing attribute validation for payload csum flags
	netfilter: nft_tunnel: add missing attribute validation for tunnels
	netfilter: nf_tables: dump NFTA_CHAIN_FLAGS attribute
	netfilter: nft_chain_nat: inet family is missing module ownership
	iommu/vt-d: Fix the wrong printing in RHSA parsing
	iommu/vt-d: Ignore devices with out-of-spec domain number
	i2c: acpi: put device when verifying client fails
	iommu/amd: Fix IOMMU AVIC not properly update the is_run bit in IRTE
	ipv6: restrict IPV6_ADDRFORM operation
	net/smc: check for valid ib_client_data
	net/smc: cancel event worker during device removal
	Linux 5.4.26

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ifacde9164f8ded01031a9e6a9c313d4fbcead25b
2020-03-18 08:19:15 +01:00
Jakub Kicinski
e80e3f7252 fib: add missing attribute validation for tun_id
[ Upstream commit 4c16d64ea0 ]

Add missing netlink policy entry for FRA_TUN_ID.

Fixes: e7030878fc ("fib: Add fib rule match on tunnel id")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-03-18 07:17:44 +01:00
Greg Kroah-Hartman
ce5de62e20 Merge 5.4.24 into android-5.4
Changes in 5.4.24
	io_uring: grab ->fs as part of async offload
	EDAC: skx_common: downgrade message importance on missing PCI device
	net: dsa: b53: Ensure the default VID is untagged
	net: fib_rules: Correctly set table field when table number exceeds 8 bits
	net: macb: ensure interface is not suspended on at91rm9200
	net: mscc: fix in frame extraction
	net: phy: restore mdio regs in the iproc mdio driver
	net: sched: correct flower port blocking
	net/tls: Fix to avoid gettig invalid tls record
	nfc: pn544: Fix occasional HW initialization failure
	qede: Fix race between rdma destroy workqueue and link change event
	Revert "net: dev: introduce support for sch BYPASS for lockless qdisc"
	udp: rehash on disconnect
	sctp: move the format error check out of __sctp_sf_do_9_1_abort
	bnxt_en: Improve device shutdown method.
	bnxt_en: Issue PCIe FLR in kdump kernel to cleanup pending DMAs.
	bonding: add missing netdev_update_lockdep_key()
	net: export netdev_next_lower_dev_rcu()
	bonding: fix lockdep warning in bond_get_stats()
	ipv6: Fix route replacement with dev-only route
	ipv6: Fix nlmsg_flags when splitting a multipath route
	ipmi:ssif: Handle a possible NULL pointer reference
	drm/msm: Set dma maximum segment size for mdss
	sched/core: Don't skip remote tick for idle CPUs
	timers/nohz: Update NOHZ load in remote tick
	sched/fair: Prevent unlimited runtime on throttled group
	dax: pass NOWAIT flag to iomap_apply
	mac80211: consider more elements in parsing CRC
	cfg80211: check wiphy driver existence for drvinfo report
	s390/zcrypt: fix card and queue total counter wrap
	qmi_wwan: re-add DW5821e pre-production variant
	qmi_wwan: unconditionally reject 2 ep interfaces
	NFSv4: Fix races between open and dentry revalidation
	perf/smmuv3: Use platform_get_irq_optional() for wired interrupt
	perf/x86/intel: Add Elkhart Lake support
	perf/x86/cstate: Add Tremont support
	perf/x86/msr: Add Tremont support
	ceph: do not execute direct write in parallel if O_APPEND is specified
	ARM: dts: sti: fixup sound frame-inversion for stihxxx-b2120.dtsi
	drm/amd/display: Do not set optimized_require to false after plane disable
	RDMA/siw: Remove unwanted WARN_ON in siw_cm_llp_data_ready()
	drm/amd/display: Check engine is not NULL before acquiring
	drm/amd/display: Limit minimum DPPCLK to 100MHz.
	drm/amd/display: Add initialitions for PLL2 clock source
	amdgpu: Prevent build errors regarding soft/hard-float FP ABI tags
	soc/tegra: fuse: Fix build with Tegra194 configuration
	i40e: Fix the conditional for i40e_vc_validate_vqs_bitmaps
	net: ena: fix potential crash when rxfh key is NULL
	net: ena: fix uses of round_jiffies()
	net: ena: add missing ethtool TX timestamping indication
	net: ena: fix incorrect default RSS key
	net: ena: rss: do not allocate key when not supported
	net: ena: rss: fix failure to get indirection table
	net: ena: rss: store hash function as values and not bits
	net: ena: fix incorrectly saving queue numbers when setting RSS indirection table
	net: ena: fix corruption of dev_idx_to_host_tbl
	net: ena: ethtool: use correct value for crc32 hash
	net: ena: ena-com.c: prevent NULL pointer dereference
	ice: update Unit Load Status bitmask to check after reset
	cifs: Fix mode output in debugging statements
	cfg80211: add missing policy for NL80211_ATTR_STATUS_CODE
	mac80211: fix wrong 160/80+80 MHz setting
	net: hns3: add management table after IMP reset
	net: hns3: fix a copying IPv6 address error in hclge_fd_get_flow_tuples()
	nvme/tcp: fix bug on double requeue when send fails
	nvme: prevent warning triggered by nvme_stop_keep_alive
	nvme/pci: move cqe check after device shutdown
	ext4: potential crash on allocation error in ext4_alloc_flex_bg_array()
	audit: fix error handling in audit_data_to_entry()
	audit: always check the netlink payload length in audit_receive_msg()
	ACPICA: Introduce ACPI_ACCESS_BYTE_WIDTH() macro
	ACPI: watchdog: Fix gas->access_width usage
	KVM: VMX: check descriptor table exits on instruction emulation
	HID: ite: Only bind to keyboard USB interface on Acer SW5-012 keyboard dock
	HID: core: fix off-by-one memset in hid_report_raw_event()
	HID: core: increase HID report buffer size to 8KiB
	drm/amdgpu: Drop DRIVER_USE_AGP
	drm/radeon: Inline drm_get_pci_dev
	macintosh: therm_windtunnel: fix regression when instantiating devices
	tracing: Disable trace_printk() on post poned tests
	Revert "PM / devfreq: Modify the device name as devfreq(X) for sysfs"
	amdgpu/gmc_v9: save/restore sdpif regs during S3
	cpufreq: Fix policy initialization for internal governor drivers
	io_uring: fix 32-bit compatability with sendmsg/recvmsg
	netfilter: ipset: Fix "INFO: rcu detected stall in hash_xxx" reports
	net/smc: transfer fasync_list in case of fallback
	vhost: Check docket sk_family instead of call getname
	netfilter: ipset: Fix forceadd evaluation path
	netfilter: xt_hashlimit: reduce hashlimit_mutex scope for htable_put()
	HID: alps: Fix an error handling path in 'alps_input_configured()'
	HID: hiddev: Fix race in in hiddev_disconnect()
	MIPS: VPE: Fix a double free and a memory leak in 'release_vpe()'
	i2c: altera: Fix potential integer overflow
	i2c: jz4780: silence log flood on txabrt
	drm/i915/gvt: Fix orphan vgpu dmabuf_objs' lifetime
	drm/i915/gvt: Separate display reset from ALL_ENGINES reset
	nl80211: fix potential leak in AP start
	mac80211: Remove a redundant mutex unlock
	kbuild: fix DT binding schema rule to detect command line changes
	hv_netvsc: Fix unwanted wakeup in netvsc_attach()
	usb: charger: assign specific number for enum value
	nvme-pci: Hold cq_poll_lock while completing CQEs
	s390/qeth: vnicc Fix EOPNOTSUPP precedence
	net: netlink: cap max groups which will be considered in netlink_bind()
	net: atlantic: fix use after free kasan warn
	net: atlantic: fix potential error handling
	net: atlantic: fix out of range usage of active_vlans array
	net/smc: no peer ID in CLC decline for SMCD
	net: ena: make ena rxfh support ETH_RSS_HASH_NO_CHANGE
	selftests: Install settings files to fix TIMEOUT failures
	kbuild: remove header compile test
	kbuild: move headers_check rule to usr/include/Makefile
	kbuild: remove unneeded variable, single-all
	kbuild: make single target builds even faster
	namei: only return -ECHILD from follow_dotdot_rcu()
	mwifiex: drop most magic numbers from mwifiex_process_tdls_action_frame()
	mwifiex: delete unused mwifiex_get_intf_num()
	KVM: SVM: Override default MMIO mask if memory encryption is enabled
	KVM: Check for a bad hva before dropping into the ghc slow path
	sched/fair: Optimize select_idle_cpu
	f2fs: fix to add swap extent correctly
	RDMA/hns: Simplify the calculation and usage of wqe idx for post verbs
	RDMA/hns: Bugfix for posting a wqe with sge
	drivers: net: xgene: Fix the order of the arguments of 'alloc_etherdev_mqs()'
	ima: ima/lsm policy rule loading logic bug fixes
	kprobes: Set unoptimized flag after unoptimizing code
	lib/vdso: Make __arch_update_vdso_data() logic understandable
	lib/vdso: Update coarse timekeeper unconditionally
	pwm: omap-dmtimer: put_device() after of_find_device_by_node()
	perf hists browser: Restore ESC as "Zoom out" of DSO/thread/etc
	perf ui gtk: Add missing zalloc object
	x86/resctrl: Check monitoring static key in the MBM overflow handler
	KVM: x86: Remove spurious kvm_mmu_unload() from vcpu destruction path
	KVM: x86: Remove spurious clearing of async #PF MSR
	rcu: Allow only one expedited GP to run concurrently with wakeups
	ubifs: Fix ino_t format warnings in orphan_delete()
	thermal: db8500: Depromote debug print
	thermal: brcmstb_thermal: Do not use DT coefficients
	netfilter: nft_tunnel: no need to call htons() when dumping ports
	netfilter: nf_flowtable: fix documentation
	bus: tegra-aconnect: Remove PM_CLK dependency
	xfs: clear kernel only flags in XFS_IOC_ATTRMULTI_BY_HANDLE
	locking/lockdep: Fix lockdep_stats indentation problem
	mm/debug.c: always print flags in dump_page()
	mm/gup: allow FOLL_FORCE for get_user_pages_fast()
	mm/huge_memory.c: use head to check huge zero page
	mm, thp: fix defrag setting if newline is not used
	kvm: nVMX: VMWRITE checks VMCS-link pointer before VMCS field
	kvm: nVMX: VMWRITE checks unsupported field before read-only field
	blktrace: Protect q->blk_trace with RCU
	Linux 5.4.24

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I0b31557e16c72bd30d1e6938ed199918ff326d88
2020-03-05 17:42:40 +01:00
Jason Baron
50acd32ea7 net: sched: correct flower port blocking
[ Upstream commit 8a9093c798 ]

tc flower rules that are based on src or dst port blocking are sometimes
ineffective due to uninitialized stack data. __skb_flow_dissect() extracts
ports from the skb for tc flower to match against. However, the port
dissection is not done when when the FLOW_DIS_IS_FRAGMENT bit is set in
key_control->flags. All callers of __skb_flow_dissect(), zero-out the
key_control field except for fl_classify() as used by the flower
classifier. Thus, the FLOW_DIS_IS_FRAGMENT may be set on entry to
__skb_flow_dissect(), since key_control is allocated on the stack
and may not be initialized.

Since key_basic and key_control are present for all flow keys, let's
make sure they are initialized.

Fixes: 62230715fd ("flow_dissector: do not dissect l4 ports for fragments")
Co-developed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: Jason Baron <jbaron@akamai.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-03-05 16:43:32 +01:00
Greg Kroah-Hartman
87acfa0267 Merge 5.4.19 into android-5.4
Changes in 5.4.19
	sparc32: fix struct ipc64_perm type definition
	bnxt_en: Move devlink_register before registering netdev
	cls_rsvp: fix rsvp_policy
	gtp: use __GFP_NOWARN to avoid memalloc warning
	l2tp: Allow duplicate session creation with UDP
	net: hsr: fix possible NULL deref in hsr_handle_frame()
	net_sched: fix an OOB access in cls_tcindex
	net: stmmac: Delete txtimer in suspend()
	bnxt_en: Fix TC queue mapping.
	rxrpc: Fix use-after-free in rxrpc_put_local()
	rxrpc: Fix insufficient receive notification generation
	rxrpc: Fix missing active use pinning of rxrpc_local object
	rxrpc: Fix NULL pointer deref due to call->conn being cleared on disconnect
	tcp: clear tp->total_retrans in tcp_disconnect()
	tcp: clear tp->delivered in tcp_disconnect()
	tcp: clear tp->data_segs{in|out} in tcp_disconnect()
	tcp: clear tp->segs_{in|out} in tcp_disconnect()
	ionic: fix rxq comp packet type mask
	MAINTAINERS: correct entries for ISDN/mISDN section
	netdevsim: fix stack-out-of-bounds in nsim_dev_debugfs_init()
	bnxt_en: Fix logic that disables Bus Master during firmware reset.
	media: uvcvideo: Avoid cyclic entity chains due to malformed USB descriptors
	mfd: dln2: More sanity checking for endpoints
	netfilter: ipset: fix suspicious RCU usage in find_set_and_id
	ipc/msg.c: consolidate all xxxctl_down() functions
	tracing/kprobes: Have uname use __get_str() in print_fmt
	tracing: Fix sched switch start/stop refcount racy updates
	rcu: Use *_ONCE() to protect lockless ->expmask accesses
	rcu: Avoid data-race in rcu_gp_fqs_check_wake()
	srcu: Apply *_ONCE() to ->srcu_last_gp_end
	rcu: Use READ_ONCE() for ->expmask in rcu_read_unlock_special()
	nvmet: Fix error print message at nvmet_install_queue function
	nvmet: Fix controller use after free
	Bluetooth: btusb: fix memory leak on fw
	Bluetooth: btusb: Disable runtime suspend on Realtek devices
	brcmfmac: Fix memory leak in brcmf_usbdev_qinit
	usb: dwc3: gadget: Check END_TRANSFER completion
	usb: dwc3: gadget: Delay starting transfer
	usb: typec: tcpci: mask event interrupts when remove driver
	objtool: Silence build output
	usb: gadget: f_fs: set req->num_sgs as 0 for non-sg transfer
	usb: gadget: legacy: set max_speed to super-speed
	usb: gadget: f_ncm: Use atomic_t to track in-flight request
	usb: gadget: f_ecm: Use atomic_t to track in-flight request
	ALSA: usb-audio: Fix endianess in descriptor validation
	ALSA: usb-audio: Annotate endianess in Scarlett gen2 quirk
	ALSA: dummy: Fix PCM format loop in proc output
	memcg: fix a crash in wb_workfn when a device disappears
	mm/sparse.c: reset section's mem_map when fully deactivated
	mmc: sdhci-pci: Make function amd_sdhci_reset static
	utimes: Clamp the timestamps in notify_change()
	mm/memory_hotplug: fix remove_memory() lockdep splat
	mm: thp: don't need care deferred split queue in memcg charge move path
	mm: move_pages: report the number of non-attempted pages
	media/v4l2-core: set pages dirty upon releasing DMA buffers
	media: v4l2-core: compat: ignore native command codes
	media: v4l2-rect.h: fix v4l2_rect_map_inside() top/left adjustments
	lib/test_kasan.c: fix memory leak in kmalloc_oob_krealloc_more()
	irqdomain: Fix a memory leak in irq_domain_push_irq()
	x86/cpu: Update cached HLE state on write to TSX_CTRL_CPUID_CLEAR
	platform/x86: intel_scu_ipc: Fix interrupt support
	ALSA: hda: Apply aligned MMIO access only conditionally
	ALSA: hda: Add Clevo W65_67SB the power_save blacklist
	ALSA: hda: Add JasperLake PCI ID and codec vid
	arm64: acpi: fix DAIF manipulation with pNMI
	KVM: arm64: Correct PSTATE on exception entry
	KVM: arm/arm64: Correct CPSR on exception entry
	KVM: arm/arm64: Correct AArch32 SPSR on exception entry
	KVM: arm64: Only sign-extend MMIO up to register width
	MIPS: syscalls: fix indentation of the 'SYSNR' message
	MIPS: fix indentation of the 'RELOCS' message
	MIPS: boot: fix typo in 'vmlinux.lzma.its' target
	s390/mm: fix dynamic pagetable upgrade for hugetlbfs
	powerpc/mmu_gather: enable RCU_TABLE_FREE even for !SMP case
	powerpc/ptdump: Fix W+X verification
	powerpc/xmon: don't access ASDR in VMs
	powerpc/pseries: Advance pfn if section is not present in lmb_is_removable()
	powerpc/32s: Fix bad_kuap_fault()
	powerpc/32s: Fix CPU wake-up from sleep mode
	tracing: Fix now invalid var_ref_vals assumption in trace action
	PCI: tegra: Fix return value check of pm_runtime_get_sync()
	PCI: keystone: Fix outbound region mapping
	PCI: keystone: Fix link training retries initiation
	PCI: keystone: Fix error handling when "num-viewport" DT property is not populated
	mmc: spi: Toggle SPI polarity, do not hardcode it
	ACPI: video: Do not export a non working backlight interface on MSI MS-7721 boards
	ACPI / battery: Deal with design or full capacity being reported as -1
	ACPI / battery: Use design-cap for capacity calculations if full-cap is not available
	ACPI / battery: Deal better with neither design nor full capacity not being reported
	alarmtimer: Unregister wakeup source when module get fails
	fscrypt: don't print name of busy file when removing key
	ubifs: don't trigger assertion on invalid no-key filename
	ubifs: Fix wrong memory allocation
	ubifs: Fix FS_IOC_SETFLAGS unexpectedly clearing encrypt flag
	ubifs: Fix deadlock in concurrent bulk-read and writepage
	mmc: sdhci-of-at91: fix memleak on clk_get failure
	ASoC: SOF: core: free trace on errors
	hv_balloon: Balloon up according to request page number
	mfd: axp20x: Mark AXP20X_VBUS_IPSOUT_MGMT as volatile
	nvmem: core: fix memory abort in cleanup path
	crypto: api - Check spawn->alg under lock in crypto_drop_spawn
	crypto: ccree - fix backlog memory leak
	crypto: ccree - fix AEAD decrypt auth fail
	crypto: ccree - fix pm wrongful error reporting
	crypto: ccree - fix FDE descriptor sequence
	crypto: ccree - fix PM race condition
	padata: Remove broken queue flushing
	fs: allow deduplication of eof block into the end of the destination file
	scripts/find-unused-docs: Fix massive false positives
	erofs: fix out-of-bound read for shifted uncompressed block
	scsi: megaraid_sas: Do not initiate OCR if controller is not in ready state
	scsi: qla2xxx: Fix mtcp dump collection failure
	cpupower: Revert library ABI changes from commit ae2917093f
	power: supply: axp20x_ac_power: Fix reporting online status
	power: supply: ltc2941-battery-gauge: fix use-after-free
	ovl: fix wrong WARN_ON() in ovl_cache_update_ino()
	ovl: fix lseek overflow on 32bit
	f2fs: choose hardlimit when softlimit is larger than hardlimit in f2fs_statfs_project()
	f2fs: fix miscounted block limit in f2fs_statfs_project()
	f2fs: code cleanup for f2fs_statfs_project()
	f2fs: fix dcache lookup of !casefolded directories
	f2fs: fix race conditions in ->d_compare() and ->d_hash()
	PM: core: Fix handling of devices deleted during system-wide resume
	cpufreq: Avoid creating excessively large stack frames
	of: Add OF_DMA_DEFAULT_COHERENT & select it on powerpc
	ARM: dma-api: fix max_pfn off-by-one error in __dma_supported()
	dm zoned: support zone sizes smaller than 128MiB
	dm space map common: fix to ensure new block isn't already in use
	dm writecache: fix incorrect flush sequence when doing SSD mode commit
	dm crypt: fix GFP flags passed to skcipher_request_alloc()
	dm crypt: fix benbi IV constructor crash if used in authenticated mode
	dm thin metadata: use pool locking at end of dm_pool_metadata_close
	dm: fix potential for q->make_request_fn NULL pointer
	scsi: qla2xxx: Fix stuck login session using prli_pend_timer
	ASoC: SOF: Introduce state machine for FW boot
	ASoC: SOF: core: release resources on errors in probe_continue
	tracing: Annotate ftrace_graph_hash pointer with __rcu
	tracing: Annotate ftrace_graph_notrace_hash pointer with __rcu
	ftrace: Add comment to why rcu_dereference_sched() is open coded
	ftrace: Protect ftrace_graph_hash with ftrace_sync
	crypto: pcrypt - Avoid deadlock by using per-instance padata queues
	btrfs: fix improper setting of scanned for range cyclic write cache pages
	btrfs: Handle another split brain scenario with metadata uuid feature
	riscv, bpf: Fix broken BPF tail calls
	selftests/bpf: Fix perf_buffer test on systems w/ offline CPUs
	bpf, devmap: Pass lockdep expression to RCU lists
	libbpf: Fix realloc usage in bpf_core_find_cands
	tc-testing: fix eBPF tests failure on linux fresh clones
	samples/bpf: Don't try to remove user's homedir on clean
	samples/bpf: Xdp_redirect_cpu fix missing tracepoint attach
	selftests/bpf: Fix test_attach_probe
	selftests/bpf: Skip perf hw events test if the setup disabled it
	selftests: bpf: Use a temporary file in test_sockmap
	selftests: bpf: Ignore FIN packets for reuseport tests
	crypto: api - fix unexpectedly getting generic implementation
	crypto: hisilicon - Use the offset fields in sqe to avoid need to split scatterlists
	crypto: ccp - set max RSA modulus size for v3 platform devices as well
	crypto: arm64/ghash-neon - bump priority to 150
	crypto: pcrypt - Do not clear MAY_SLEEP flag in original request
	crypto: atmel-aes - Fix counter overflow in CTR mode
	crypto: api - Fix race condition in crypto_spawn_alg
	crypto: picoxcell - adjust the position of tasklet_init and fix missed tasklet_kill
	powerpc/futex: Fix incorrect user access blocking
	scsi: qla2xxx: Fix unbound NVME response length
	NFS: Fix memory leaks and corruption in readdir
	NFS: Directory page cache pages need to be locked when read
	nfsd: fix filecache lookup
	jbd2_seq_info_next should increase position index
	ext4: fix deadlock allocating crypto bounce page from mempool
	ext4: fix race conditions in ->d_compare() and ->d_hash()
	Btrfs: fix missing hole after hole punching and fsync when using NO_HOLES
	Btrfs: make deduplication with range including the last block work
	Btrfs: fix infinite loop during fsync after rename operations
	btrfs: set trans->drity in btrfs_commit_transaction
	btrfs: drop log root for dropped roots
	Btrfs: fix race between adding and putting tree mod seq elements and nodes
	btrfs: flush write bio if we loop in extent_write_cache_pages
	btrfs: Correctly handle empty trees in find_first_clear_extent_bit
	ARM: tegra: Enable PLLP bypass during Tegra124 LP1
	iwlwifi: don't throw error when trying to remove IGTK
	mwifiex: fix unbalanced locking in mwifiex_process_country_ie()
	sunrpc: expiry_time should be seconds not timeval
	gfs2: fix gfs2_find_jhead that returns uninitialized jhead with seq 0
	gfs2: move setting current->backing_dev_info
	gfs2: fix O_SYNC write handling
	drm: atmel-hlcdc: use double rate for pixel clock only if supported
	drm: atmel-hlcdc: enable clock before configuring timing engine
	drm: atmel-hlcdc: prefer a lower pixel-clock than requested
	drm/rect: Avoid division by zero
	media: iguanair: fix endpoint sanity check
	media: rc: ensure lirc is initialized before registering input device
	tools/kvm_stat: Fix kvm_exit filter name
	xen/balloon: Support xend-based toolstack take two
	watchdog: fix UAF in reboot notifier handling in watchdog core code
	bcache: add readahead cache policy options via sysfs interface
	eventfd: track eventfd_signal() recursion depth
	aio: prevent potential eventfd recursion on poll
	KVM: x86: Refactor picdev_write() to prevent Spectre-v1/L1TF attacks
	KVM: x86: Refactor prefix decoding to prevent Spectre-v1/L1TF attacks
	KVM: x86: Protect pmu_intel.c from Spectre-v1/L1TF attacks
	KVM: x86: Protect DR-based index computations from Spectre-v1/L1TF attacks
	KVM: x86: Protect kvm_lapic_reg_write() from Spectre-v1/L1TF attacks
	KVM: x86: Protect kvm_hv_msr_[get|set]_crash_data() from Spectre-v1/L1TF attacks
	KVM: x86: Protect ioapic_write_indirect() from Spectre-v1/L1TF attacks
	KVM: x86: Protect MSR-based index computations in pmu.h from Spectre-v1/L1TF attacks
	KVM: x86: Protect ioapic_read_indirect() from Spectre-v1/L1TF attacks
	KVM: x86: Protect MSR-based index computations from Spectre-v1/L1TF attacks in x86.c
	KVM: x86: Protect x86_decode_insn from Spectre-v1/L1TF attacks
	KVM: x86: Protect MSR-based index computations in fixed_msr_to_seg_unit() from Spectre-v1/L1TF attacks
	KVM: x86: Fix potential put_fpu() w/o load_fpu() on MPX platform
	KVM: PPC: Book3S HV: Uninit vCPU if vcore creation fails
	KVM: PPC: Book3S PR: Free shared page if mmu initialization fails
	kvm/svm: PKU not currently supported
	x86/kvm: Be careful not to clear KVM_VCPU_FLUSH_TLB bit
	x86/kvm: Introduce kvm_(un)map_gfn()
	x86/KVM: Make sure KVM_VCPU_FLUSH_TLB flag is not missed
	x86/kvm: Cache gfn to pfn translation
	x86/KVM: Clean up host's steal time structure
	KVM: VMX: Add non-canonical check on writes to RTIT address MSRs
	KVM: x86: Don't let userspace set host-reserved cr4 bits
	KVM: x86: Free wbinvd_dirty_mask if vCPU creation fails
	KVM: x86: Handle TIF_NEED_FPU_LOAD in kvm_{load,put}_guest_fpu()
	KVM: x86: Ensure guest's FPU state is loaded when accessing for emulation
	KVM: x86: Revert "KVM: X86: Fix fpu state crash in kvm guest"
	KVM: s390: do not clobber registers during guest reset/store status
	ocfs2: fix oops when writing cloned file
	mm/page_alloc.c: fix uninitialized memmaps on a partially populated last section
	arm64: dts: qcom: qcs404-evb: Set vdd_apc regulator in high power mode
	mm/mmu_gather: invalidate TLB correctly on batch allocation failure and flush
	clk: tegra: Mark fuse clock as critical
	drm/amd/dm/mst: Ignore payload update failures
	virtio-balloon: initialize all vq callbacks
	virtio-pci: check name when counting MSI-X vectors
	fix up iter on short count in fuse_direct_io()
	broken ping to ipv6 linklocal addresses on debian buster
	percpu: Separate decrypted varaibles anytime encryption can be enabled
	ASoC: meson: axg-fifo: fix fifo threshold setup
	scsi: qla2xxx: Fix the endianness of the qla82xx_get_fw_size() return type
	scsi: csiostor: Adjust indentation in csio_device_reset
	scsi: qla4xxx: Adjust indentation in qla4xxx_mem_free
	scsi: ufs: Recheck bkops level if bkops is disabled
	mtd: spi-nor: Split mt25qu512a (n25q512a) entry into two
	phy: qualcomm: Adjust indentation in read_poll_timeout
	ext2: Adjust indentation in ext2_fill_super
	powerpc/44x: Adjust indentation in ibm4xx_denali_fixup_memsize
	drm: msm: mdp4: Adjust indentation in mdp4_dsi_encoder_enable
	NFC: pn544: Adjust indentation in pn544_hci_check_presence
	ppp: Adjust indentation into ppp_async_input
	net: smc911x: Adjust indentation in smc911x_phy_configure
	net: tulip: Adjust indentation in {dmfe, uli526x}_init_module
	IB/mlx5: Fix outstanding_pi index for GSI qps
	IB/core: Fix ODP get user pages flow
	nfsd: fix delay timer on 32-bit architectures
	nfsd: fix jiffies/time_t mixup in LRU list
	nfsd: Return the correct number of bytes written to the file
	virtio-balloon: Fix memory leak when unloading while hinting is in progress
	virtio_balloon: Fix memory leaks on errors in virtballoon_probe()
	ubi: fastmap: Fix inverted logic in seen selfcheck
	ubi: Fix an error pointer dereference in error handling code
	ubifs: Fix memory leak from c->sup_node
	regulator: core: Add regulator_is_equal() helper
	ASoC: sgtl5000: Fix VDDA and VDDIO comparison
	bonding/alb: properly access headers in bond_alb_xmit()
	devlink: report 0 after hitting end in region read
	dpaa_eth: support all modes with rate adapting PHYs
	net: dsa: b53: Always use dev->vlan_enabled in b53_configure_vlan()
	net: dsa: bcm_sf2: Only 7278 supports 2Gb/sec IMP port
	net: dsa: microchip: enable module autoprobe
	net: mvneta: move rx_dropped and rx_errors in per-cpu stats
	net_sched: fix a resource leak in tcindex_set_parms()
	net: stmmac: fix a possible endless loop
	net: systemport: Avoid RBUF stuck in Wake-on-LAN mode
	net/mlx5: IPsec, Fix esp modify function attribute
	net/mlx5: IPsec, fix memory leak at mlx5_fpga_ipsec_delete_sa_ctx
	net: macb: Remove unnecessary alignment check for TSO
	net: macb: Limit maximum GEM TX length in TSO
	taprio: Fix enabling offload with wrong number of traffic classes
	taprio: Fix still allowing changing the flags during runtime
	taprio: Add missing policy validation for flags
	taprio: Use taprio_reset_tc() to reset Traffic Classes configuration
	taprio: Fix dropping packets when using taprio + ETF offloading
	ipv6/addrconf: fix potential NULL deref in inet6_set_link_af()
	qed: Fix timestamping issue for L2 unicast ptp packets.
	drop_monitor: Do not cancel uninitialized work item
	net/mlx5: Fix deadlock in fs_core
	net/mlx5: Deprecate usage of generic TLS HW capability bit
	ASoC: Intel: skl_hda_dsp_common: Fix global-out-of-bounds bug
	mfd: da9062: Fix watchdog compatible string
	mfd: rn5t618: Mark ADC control register volatile
	mfd: bd70528: Fix hour register mask
	x86/timer: Don't skip PIT setup when APIC is disabled or in legacy mode
	btrfs: use bool argument in free_root_pointers()
	btrfs: free block groups after free'ing fs trees
	drm/dp_mst: Remove VCPI while disabling topology mgr
	KVM: x86/mmu: Apply max PA check for MMIO sptes to 32-bit KVM
	KVM: x86: use CPUID to locate host page table reserved bits
	KVM: x86: Use gpa_t for cr2/gpa to fix TDP support on 32-bit KVM
	KVM: x86: fix overlap between SPTE_MMIO_MASK and generation
	KVM: nVMX: vmread should not set rflags to specify success in case of #PF
	KVM: Use vcpu-specific gva->hva translation when querying host page size
	KVM: Play nice with read-only memslots when querying host page size
	cifs: fail i/o on soft mounts if sessionsetup errors out
	x86/apic/msi: Plug non-maskable MSI affinity race
	clocksource: Prevent double add_timer_on() for watchdog_timer
	perf/core: Fix mlock accounting in perf_mmap()
	rxrpc: Fix service call disconnection
	regulator fix for "regulator: core: Add regulator_is_equal() helper"
	powerpc/kuap: Fix set direction in allow/prevent_user_access()
	Linux 5.4.19

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ief6bae336b8e6931810e5b357c0d5e16fbf1c13e
2020-02-11 14:09:41 -08:00
Eric Dumazet
6978e2935c bonding/alb: properly access headers in bond_alb_xmit()
[ Upstream commit 38f88c4540 ]

syzbot managed to send an IPX packet through bond_alb_xmit()
and af_packet and triggered a use-after-free.

First, bond_alb_xmit() was using ipx_hdr() helper to reach
the IPX header, but ipx_hdr() was using the transport offset
instead of the network offset. In the particular syzbot
report transport offset was 0xFFFF

This patch removes ipx_hdr() since it was only (mis)used from bonding.

Then we need to make sure IPv4/IPv6/IPX headers are pulled
in skb->head before dereferencing anything.

BUG: KASAN: use-after-free in bond_alb_xmit+0x153a/0x1590 drivers/net/bonding/bond_alb.c:1452
Read of size 2 at addr ffff8801ce56dfff by task syz-executor.2/18108
 (if (ipx_hdr(skb)->ipx_checksum != IPX_NO_CHECKSUM) ...)

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 [<ffffffff8441fc42>] __dump_stack lib/dump_stack.c:17 [inline]
 [<ffffffff8441fc42>] dump_stack+0x14d/0x20b lib/dump_stack.c:53
 [<ffffffff81a7dec4>] print_address_description+0x6f/0x20b mm/kasan/report.c:282
 [<ffffffff81a7e0ec>] kasan_report_error mm/kasan/report.c:380 [inline]
 [<ffffffff81a7e0ec>] kasan_report mm/kasan/report.c:438 [inline]
 [<ffffffff81a7e0ec>] kasan_report.cold+0x8c/0x2a0 mm/kasan/report.c:422
 [<ffffffff81a7dc4f>] __asan_report_load_n_noabort+0xf/0x20 mm/kasan/report.c:469
 [<ffffffff82c8c00a>] bond_alb_xmit+0x153a/0x1590 drivers/net/bonding/bond_alb.c:1452
 [<ffffffff82c60c74>] __bond_start_xmit drivers/net/bonding/bond_main.c:4199 [inline]
 [<ffffffff82c60c74>] bond_start_xmit+0x4f4/0x1570 drivers/net/bonding/bond_main.c:4224
 [<ffffffff83baa558>] __netdev_start_xmit include/linux/netdevice.h:4525 [inline]
 [<ffffffff83baa558>] netdev_start_xmit include/linux/netdevice.h:4539 [inline]
 [<ffffffff83baa558>] xmit_one net/core/dev.c:3611 [inline]
 [<ffffffff83baa558>] dev_hard_start_xmit+0x168/0x910 net/core/dev.c:3627
 [<ffffffff83bacf35>] __dev_queue_xmit+0x1f55/0x33b0 net/core/dev.c:4238
 [<ffffffff83bae3a8>] dev_queue_xmit+0x18/0x20 net/core/dev.c:4278
 [<ffffffff84339189>] packet_snd net/packet/af_packet.c:3226 [inline]
 [<ffffffff84339189>] packet_sendmsg+0x4919/0x70b0 net/packet/af_packet.c:3252
 [<ffffffff83b1ac0c>] sock_sendmsg_nosec net/socket.c:673 [inline]
 [<ffffffff83b1ac0c>] sock_sendmsg+0x12c/0x160 net/socket.c:684
 [<ffffffff83b1f5a2>] __sys_sendto+0x262/0x380 net/socket.c:1996
 [<ffffffff83b1f700>] SYSC_sendto net/socket.c:2008 [inline]
 [<ffffffff83b1f700>] SyS_sendto+0x40/0x60 net/socket.c:2004

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: Jay Vosburgh <j.vosburgh@gmail.com>
Cc: Veaceslav Falico <vfalico@gmail.com>
Cc: Andy Gospodarek <andy@greyhouse.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-02-11 04:35:48 -08:00
Greg Kroah-Hartman
1bb7ab6685 Merge 5.4.18 into android-5.4
Changes in 5.4.18
	vfs: fix do_last() regression
	cifs: fix soft mounts hanging in the reconnect code
	x86/resctrl: Fix a deadlock due to inaccurate reference
	x86/resctrl: Fix use-after-free when deleting resource groups
	x86/resctrl: Fix use-after-free due to inaccurate refcount of rdtgroup
	e1000e: Drop unnecessary __E1000_DOWN bit twiddling
	e1000e: Revert "e1000e: Make watchdog use delayed work"
	gfs2: Another gfs2_find_jhead fix
	perf c2c: Fix return type for histogram sorting comparision functions
	PM / devfreq: Add new name attribute for sysfs
	tools lib: Fix builds when glibc contains strlcpy()
	arm64: kbuild: remove compressed images on 'make ARCH=arm64 (dist)clean'
	mm/mempolicy.c: fix out of bounds write in mpol_parse_str()
	reiserfs: Fix memory leak of journal device string
	media: digitv: don't continue if remote control state can't be read
	media: af9005: uninitialized variable printked
	media: vp7045: do not read uninitialized values if usb transfer fails
	media: gspca: zero usb_buf
	media: dvb-usb/dvb-usb-urb.c: initialize actlen to 0
	tomoyo: Use atomic_t for statistics counter
	ttyprintk: fix a potential deadlock in interrupt context issue
	Bluetooth: Fix race condition in hci_release_sock()
	cgroup: Prevent double killing of css when enabling threaded cgroup
	clk: sunxi-ng: v3s: Fix incorrect number of hw_clks.
	arm64: dts: meson-sm1-sei610: add gpio bluetooth interrupt
	ARM: dts: sun8i: a83t: Correct USB3503 GPIOs polarity
	ARM: dts: am57xx-beagle-x15/am57xx-idk: Remove "gpios" for endpoint dt nodes
	ARM: dts: beagle-x15-common: Model 5V0 regulator
	soc: ti: wkup_m3_ipc: Fix race condition with rproc_boot
	tools lib traceevent: Fix memory leakage in filter_event
	rseq: Unregister rseq for clone CLONE_VM
	clk: sunxi-ng: sun8i-r: Fix divider on APB0 clock
	clk: sunxi-ng: h6-r: Fix AR100/R_APB2 parent order
	mac80211: mesh: restrict airtime metric to peered established plinks
	clk: mmp2: Fix the order of timer mux parents
	ASoC: rt5640: Fix NULL dereference on module unload
	s390/zcrypt: move ap device reset from bus to driver code
	i40e: Fix virtchnl_queue_select bitmap validation
	ixgbevf: Remove limit of 10 entries for unicast filter list
	ixgbe: Fix calculation of queue with VFs and flow director on interface flap
	igb: Fix SGMII SFP module discovery for 100FX/LX.
	iavf: remove current MAC address filter on VF reset
	platform/x86: GPD pocket fan: Allow somewhat lower/higher temperature limits
	platform/x86: intel_pmc_core: update Comet Lake platform driver
	ASoC: SOF: Intel: fix HDA codec driver probe with multiple controllers
	ASoC: hdac_hda: Fix error in driver removal after failed probe
	ASoC: sti: fix possible sleep-in-atomic
	qmi_wwan: Add support for Quectel RM500Q
	parisc: Use proper printk format for resource_size_t
	lkdtm/bugs: fix build error in lkdtm_UNSET_SMEP
	wireless: fix enabling channel 12 for custom regulatory domain
	cfg80211: Fix radar event during another phy CAC
	mac80211: Fix TKIP replay protection immediately after key setup
	wireless: wext: avoid gcc -O3 warning
	perf/x86/intel/uncore: Add PCI ID of IMC for Xeon E3 V5 Family
	perf/x86/intel/uncore: Remove PCIe3 unit for SNR
	riscv: delete temporary files
	XArray: Fix xas_pause at ULONG_MAX
	iwlwifi: pcie: allocate smaller dev_cmd for TX headers
	iwlwifi: Don't ignore the cap field upon mcc update
	iwlwifi: dbg: force stop the debug monitor HW
	Input: evdev - convert kzalloc()/vzalloc() to kvzalloc()
	ARM: dts: am335x-boneblack-common: fix memory size
	vti[6]: fix packet tx through bpf_redirect()
	xfrm interface: fix packet tx through bpf_redirect()
	xfrm: interface: do not confirm neighbor when do pmtu update
	Input: max77650-onkey - add of_match table
	scsi: fnic: do not queue commands during fwreset
	ARM: 8955/1: virt: Relax arch timer version check during early boot
	led: max77650: add of_match table
	tee: optee: Fix compilation issue with nommu
	r8152: get default setting of WOL before initializing
	r8152: disable U2P3 for RTL8153B
	r8152: Disable PLA MCU clock speed down
	r8152: disable test IO for RTL8153B
	r8152: avoid the MCU to clear the lanwake
	r8152: disable DelayPhyPwrChg
	ARM: dts: am43x-epos-evm: set data pin directions for spi0 and spi1
	qlcnic: Fix CPU soft lockup while collecting firmware dump
	powerpc/fsl/dts: add fsl,erratum-a011043
	net/fsl: treat fsl,erratum-a011043
	net: fsl/fman: rename IF_MODE_XGMII to IF_MODE_10G
	seq_tab_next() should increase position index
	l2t_seq_next should increase position index
	netfilter: conntrack: sctp: use distinct states for new SCTP connections
	netfilter: nf_tables_offload: fix check the chain offload flag
	net: Fix skb->csum update in inet_proto_csum_replace16().
	btrfs: do not zero f_bavail if we have available space
	cpuidle: teo: Avoid using "early hits" incorrectly
	flow_dissector: Fix to use new variables for port ranges in bpf hook
	dm thin: fix use-after-free in metadata_pre_commit_callback
	perf report: Fix no libunwind compiled warning break s390 issue
	mm/migrate.c: also overwrite error when it is bigger than zero
	ASoC: topology: fix soc_tplg_fe_link_create() - link->dobj initialization order
	Revert "rsi: fix potential null dereference in rsi_probe()"
	tracing/uprobe: Fix to make trace_uprobe_filter alignment safe
	Linux 5.4.18

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I2dcf0611b3c562c6e934f952844a90be6ace99ed
2020-02-05 22:19:48 +00:00
Orr Mazor
e233cbaf8e cfg80211: Fix radar event during another phy CAC
[ Upstream commit 26ec17a1dc ]

In case a radar event of CAC_FINISHED or RADAR_DETECTED
happens during another phy is during CAC we might need
to cancel that CAC.

If we got a radar in a channel that another phy is now
doing CAC on then the CAC should be canceled there.

If, for example, 2 phys doing CAC on the same channels,
or on comptable channels, once on of them will finish his
CAC the other might need to cancel his CAC, since it is no
longer relevant.

To fix that the commit adds an callback and implement it in
mac80211 to end CAC.
This commit also adds a call to said callback if after a radar
event we see the CAC is no longer relevant

Signed-off-by: Orr Mazor <Orr.Mazor@tandemg.com>
Reviewed-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
Link: https://lore.kernel.org/r/20191222145449.15792-1-Orr.Mazor@tandemg.com
[slightly reformat/reword commit message]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-02-05 21:22:46 +00:00
Greg Kroah-Hartman
83003512ab Merge 5.4.17 into android-5.4
Changes in 5.4.17
	Bluetooth: btusb: fix non-atomic allocation in completion handler
	orinoco_usb: fix interface sanity check
	rsi_91x_usb: fix interface sanity check
	usb: dwc3: pci: add ID for the Intel Comet Lake -V variant
	usb: host: xhci-tegra: set MODULE_FIRMWARE for tegra186
	USB: serial: ir-usb: add missing endpoint sanity check
	USB: serial: ir-usb: fix link-speed handling
	USB: serial: ir-usb: fix IrLAP framing
	usb: dwc3: turn off VBUS when leaving host mode
	usb: typec: wcove: fix "op-sink-microwatt" default that was in mW
	usb: typec: fusb302: fix "op-sink-microwatt" default that was in mW
	staging: most: net: fix buffer overflow
	staging: wlan-ng: ensure error return is actually returned
	staging: vt6656: correct packet types for CTS protect, mode.
	staging: vt6656: use NULLFUCTION stack on mac80211
	staging: vt6656: Fix false Tx excessive retries reporting.
	serial: 8250_bcm2835aux: Fix line mismatch on driver unbind
	serial: imx: fix a race condition in receive path
	debugfs: Return -EPERM when locked down
	component: do not dereference opaque pointer in debugfs
	binder: fix log spam for existing debugfs file creation.
	mei: hdcp: bind only with i915 on the same PCH
	mei: me: add comet point (lake) H device ids
	iio: adc: stm32-dfsdm: fix single conversion
	iio: st_gyro: Correct data for LSM9DS0 gyro
	driver core: Fix test_async_driver_probe if NUMA is disabled
	crypto: chelsio - fix writing tfm flags to wrong place
	CIFS: Fix task struct use-after-free on reconnect
	cifs: set correct max-buffer-size for smb2_ioctl_init()
	cifs: Fix memory allocation in __smb2_handle_cancelled_cmd()
	ath9k: fix storage endpoint lookup
	brcmfmac: fix interface sanity check
	rtl8xxxu: fix interface sanity check
	zd1211rw: fix storage endpoint lookup
	net_sched: ematch: reject invalid TCF_EM_SIMPLE
	net_sched: fix ops->bind_class() implementations
	net_sched: walk through all child classes in tc_bind_tclass()
	net: socionext: fix possible user-after-free in netsec_process_rx
	net: socionext: fix xdp_result initialization in netsec_process_rx
	udp: segment looped gso packets correctly
	mlxsw: minimal: Fix an error handling path in 'mlxsw_m_port_create()'
	net: include struct nhmsg size in nh nlmsg size
	rxrpc: Fix use-after-free in rxrpc_receive_data()
	HID: multitouch: Add LG MELF0410 I2C touchscreen support
	arc: eznps: fix allmodconfig kconfig warning
	HID: Add quirk for Xin-Mo Dual Controller
	HID: ite: Add USB id match for Acer SW5-012 keyboard dock
	HID: asus: Ignore Asus vendor-page usage-code 0xff events
	HID: Add quirk for incorrect input length on Lenovo Y720
	HID: intel-ish-hid: ipc: add CMP device id
	HID: wacom: Recognize new MobileStudio Pro PID
	ASoC: SOF: fix fault at driver unload after failed probe
	ASoC: SOF: Intel: hda: hda-dai: fix oops on hda_link .hw_free
	drivers/hid/hid-multitouch.c: fix a possible null pointer access.
	phy: qcom-qmp: Increase PHY ready timeout
	ASoC: fsl_audmix: add missed pm_runtime_disable
	ASoC: topology: Prevent use-after-free in snd_soc_get_pcm_runtime()
	phy: cpcap-usb: Prevent USB line glitches from waking up modem
	HID: intel-ish-hid: ipc: Add Tiger Lake PCI device ID
	watchdog: max77620_wdt: fix potential build errors
	watchdog: rn5t618_wdt: fix module aliases
	watchdog: orion: fix platform_get_irq() complaints
	usb: musb: jz4740: Silence error if code is -EPROBE_DEFER
	can: tcan4x5x: tcan4x5x_parse_config(): reset device before register access
	spi: spi-dw: Add lock protect dw_spi rx/tx to prevent concurrent calls
	net: Google gve: Remove dma_wmb() before ringing doorbell
	drivers/net/b44: Change to non-atomic bit operations on pwol_mask
	net: wan: sdla: Fix cast from pointer to integer of different size
	gpio: max77620: Add missing dependency on GPIOLIB_IRQCHIP
	iommu/dma: fix variable 'cookie' set but not used
	drm/amd/display: Reduce HDMI pixel encoding if max clock is exceeded
	stmmac: debugfs entry name is not be changed when udev rename device name.
	atm: eni: fix uninitialized variable warning
	HID: steam: Fix input device disappearing
	extcon-intel-cht-wc: Don't reset USB data connection at probe
	ASoC: Intel: cht_bsw_rt5645: Add quirk for boards using pmc_plt_clk_0
	drm/amdgpu/SRIOV: add navi12 pci id for SRIOV (v2)
	libbpf: Fix BTF-defined map's __type macro handling of arrays
	staging: mt7621-pci: add quirks for 'E2' revision using 'soc_device_attribute'
	platform/x86: dell-laptop: disable kbd backlight on Inspiron 10xx
	PCI: Add DMA alias quirk for Intel VCA NTB
	media: dvbsky: add support for eyeTV Geniatech T2 lite
	bus: ti-sysc: Handle mstandby quirk and use it for musb
	bus: ti-sysc: Use swsup quirks also for am335x musb
	spi: pxa2xx: Add support for Intel Comet Lake-H
	iommu/amd: Support multiple PCI DMA aliases in device table
	iommu/amd: Support multiple PCI DMA aliases in IRQ Remapping
	perf/imx_ddr: Add enhanced AXI ID filter support
	mfd: intel-lpss: Add Intel Comet Lake PCH-H PCI IDs
	ARM: config: aspeed-g5: Enable 8250_DW quirks
	ARM: OMAP2+: SmartReflex: add omap_sr_pdata definition
	mmc: sdhci-pci: Quirk for AMD SDHC Device 0x7906
	mmc: sdhci-pci: Add support for Intel JSL
	bus: ti-sysc: Add module enable quirk for audio AESS
	usb-storage: Disable UAS on JMicron SATA enclosure
	ALSA: hda/realtek - Move some alc236 pintbls to fallback table
	Bluetooth: Allow combination of BDADDR_PROPERTY and INVALID_BDADDR quirks
	Bluetooth: btbcm: Use the BDADDR_PROPERTY quirk
	bus: ti-sysc: Fix missing force mstandby quirk handling
	rsi: fix use-after-free on failed probe and unbind
	rsi: fix use-after-free on probe errors
	rsi: fix memory leak on failed URB submission
	rsi: fix non-atomic allocation in completion handler
	crypto: af_alg - Use bh_lock_sock in sk_destruct
	crypto: vmx - reject xts inputs that are too short
	crypto: caam - do not reset pointer size from MCFGR register
	crypto: pcrypt - Fix user-after-free on module unload
	KVM: arm64: Write arch.mdcr_el2 changes since last vcpu_load on VHE
	Revert "um: Enable CONFIG_CONSTRUCTORS"
	power/supply: ingenic-battery: Don't change scale if there's only one
	Linux 5.4.17

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I03dc4a2a426ff7700c26560c294bcbfc66f26e38
2020-02-02 20:24:42 +00:00
Willem de Bruijn
3c8c966cc7 udp: segment looped gso packets correctly
[ Upstream commit 6cd021a58c ]

Multicast and broadcast packets can be looped from egress to ingress
pre segmentation with dev_loopback_xmit. That function unconditionally
sets ip_summed to CHECKSUM_UNNECESSARY.

udp_rcv_segment segments gso packets in the udp rx path. Segmentation
usually executes on egress, and does not expect packets of this type.
__udp_gso_segment interprets !CHECKSUM_PARTIAL as CHECKSUM_NONE. But
the offsets are not correct for gso_make_checksum.

UDP GSO packets are of type CHECKSUM_PARTIAL, with their uh->check set
to the correct pseudo header checksum. Reset ip_summed to this type.
(CHECKSUM_PARTIAL is allowed on ingress, see comments in skbuff.h)

Reported-by: syzbot <syzkaller@googlegroups.com>
Fixes: cf329aa42b ("udp: cope with UDP GRO packet misdirection")
Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-02-01 09:34:39 +00:00
Cong Wang
55ec468d30 net_sched: fix ops->bind_class() implementations
[ Upstream commit 2e24cd7555 ]

The current implementations of ops->bind_class() are merely
searching for classid and updating class in the struct tcf_result,
without invoking either of cl_ops->bind_tcf() or
cl_ops->unbind_tcf(). This breaks the design of them as qdisc's
like cbq use them to count filters too. This is why syzbot triggered
the warning in cbq_destroy_class().

In order to fix this, we have to call cl_ops->bind_tcf() and
cl_ops->unbind_tcf() like the filter binding path. This patch does
so by refactoring out two helper functions __tcf_bind_filter()
and __tcf_unbind_filter(), which are lockless and accept a Qdisc
pointer, then teaching each implementation to call them correctly.

Note, we merely pass the Qdisc pointer as an opaque pointer to
each filter, they only need to pass it down to the helper
functions without understanding it at all.

Fixes: 07d79fc7d9 ("net_sched: add reverse binding for tc class")
Reported-and-tested-by: syzbot+0a0596220218fcb603a8@syzkaller.appspotmail.com
Reported-and-tested-by: syzbot+63bdb6006961d8c917c6@syzkaller.appspotmail.com
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Cc: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-02-01 09:34:38 +00:00
Greg Kroah-Hartman
cac5f79018 Merge 5.4.16 into android-5.4
Changes in 5.4.16
	can, slip: Protect tty->disc_data in write_wakeup and close with RCU
	firestream: fix memory leaks
	gtp: make sure only SOCK_DGRAM UDP sockets are accepted
	ipv6: sr: remove SKB_GSO_IPXIP6 on End.D* actions
	net: bcmgenet: Use netif_tx_napi_add() for TX NAPI
	net: cxgb3_main: Add CAP_NET_ADMIN check to CHELSIO_GET_MEM
	net: ip6_gre: fix moving ip6gre between namespaces
	net, ip6_tunnel: fix namespaces move
	net, ip_tunnel: fix namespaces move
	net: rtnetlink: validate IFLA_MTU attribute in rtnl_create_link()
	net_sched: fix datalen for ematch
	net_sched: use validated TCA_KIND attribute in tc_new_tfilter()
	net-sysfs: Fix reference count leak
	net: usb: lan78xx: Add .ndo_features_check
	Revert "udp: do rmem bulk free even if the rx sk queue is empty"
	tcp_bbr: improve arithmetic division in bbr_update_bw()
	tcp: do not leave dangling pointers in tp->highest_sack
	tun: add mutex_unlock() call and napi.skb clearing in tun_get_user()
	airo: Fix possible info leak in AIROOLDIOCTL/SIOCDEVPRIVATE
	airo: Add missing CAP_NET_ADMIN check in AIROOLDIOCTL/SIOCDEVPRIVATE
	mlxsw: spectrum_acl: Fix use-after-free during reload
	fou: Fix IPv6 netlink policy
	net: Fix packet reordering caused by GRO and listified RX cooperation
	net/mlx5: Fix lowest FDB pool size
	net/mlx5: Update the list of the PCI supported devices
	net/mlx5: DR, Enable counter on non-fwd-dest objects
	net/mlx5: E-Switch, Prevent ingress rate configuration of uplink rep
	net/mlx5: DR, use non preemptible call to get the current cpu number
	net/mlx5e: kTLS, Fix corner-case checks in TX resync flow
	net/mlx5e: kTLS, Remove redundant posts in TX resync flow
	net/mlx5e: kTLS, Do not send decrypted-marked SKBs via non-accel path
	ipv4: Detect rollover in specific fib table dump
	Revert "io_uring: only allow submit from owning task"
	afs: Fix characters allowed into cell names
	hwmon: (adt7475) Make volt2reg return same reg as reg2volt input
	hwmon: (core) Do not use device managed functions for memory allocations
	ceph: hold extra reference to r_parent over life of request
	PCI: Mark AMD Navi14 GPU rev 0xc5 ATS as broken
	drm/panfrost: Add the panfrost_gem_mapping concept
	drm/i915: Align engine->uabi_class/instance with i915_drm.h
	PM: hibernate: fix crashes with init_on_free=1
	tracing: trigger: Replace unneeded RCU-list traversals
	tracing/uprobe: Fix double perf_event linking on multiprobe uprobe
	tracing: Do not set trace clock if tracefs lockdown is in effect
	tracing: Fix histogram code when expression has same var as value
	powerpc/mm/hash: Fix sharing context ids between kernel & userspace
	powerpc/xive: Discard ESB load value when interrupt is invalid
	Revert "iwlwifi: mvm: fix scan config command size"
	iwlwifi: mvm: don't send the IWL_MVM_RXQ_NSSN_SYNC notif to Rx queues
	XArray: Fix infinite loop with entry at ULONG_MAX
	XArray: Fix xa_find_after with multi-index entries
	XArray: Fix xas_find returning too many entries
	pinctrl: sunrisepoint: Add missing Interrupt Status register offset
	iommu/vt-d: Call __dmar_remove_one_dev_info with valid pointer
	Input: keyspan-remote - fix control-message timeouts
	Revert "Input: synaptics-rmi4 - don't increment rmiaddr for SMBus transfers"
	ARM: 8950/1: ftrace/recordmcount: filter relocation types
	mmc: tegra: fix SDR50 tuning override
	mmc: sdhci: fix minimum clock rate for v3 controller
	mmc: sdhci_am654: Remove Inverted Write Protect flag
	mmc: sdhci_am654: Reset Command and Data line after tuning
	mlxsw: switchx2: Do not modify cloned SKBs during xmit
	net/tls: fix async operation
	Input: pm8xxx-vib - fix handling of separate enable register
	Input: sur40 - fix interface sanity checks
	Input: gtco - fix endpoint sanity check
	Input: aiptek - fix endpoint sanity check
	Input: pegasus_notetaker - fix endpoint sanity check
	Input: sun4i-ts - add a check for devm_thermal_zone_of_sensor_register
	netfilter: nft_osf: add missing check for DREG attribute
	lib: Reduce user_access_begin() boundaries in strncpy_from_user() and strnlen_user()
	iommu/amd: Fix IOMMU perf counter clobbering during init
	readdir: make user_access_begin() use the real access range
	leds: gpio: Fix uninitialized gpio label for fwnode based probe
	hsr: Fix a compilation error
	hwmon: (nct7802) Fix voltage limits to wrong registers
	hwmon: (nct7802) Fix non-working alarm on voltages
	scsi: RDMA/isert: Fix a recently introduced regression related to logout
	tracing: xen: Ordered comparison of function pointers
	iwlwifi: mvm: fix SKB leak on invalid queue
	iwlwifi: mvm: fix potential SKB leak on TXQ TX
	drm/i915/userptr: fix size calculation
	xfrm: support output_mark for offload ESP packets
	net, sk_msg: Don't check if sock is locked when tearing down psock
	do_last(): fetch directory ->i_mode and ->i_uid before it's too late
	readdir: be more conservative with directory entry names
	net/sonic: Add mutual exclusion for accessing shared state
	net/sonic: Clear interrupt flags immediately
	net/sonic: Use MMIO accessors
	net/sonic: Fix interface error stats collection
	net/sonic: Fix receive buffer handling
	net/sonic: Avoid needless receive descriptor EOL flag updates
	net/sonic: Improve receive descriptor status flag check
	net/sonic: Fix receive buffer replenishment
	net/sonic: Quiesce SONIC before re-initializing descriptor memory
	net/sonic: Fix command register usage
	net/sonic: Fix CAM initialization
	net/sonic: Prevent tx watchdog timeout
	libertas: Fix two buffer overflows at parsing bss descriptor
	media: v4l2-ioctl.c: zero reserved fields for S/TRY_FMT
	netfilter: ipset: use bitmap infrastructure completely
	netfilter: nf_tables: add __nft_chain_type_get()
	netfilter: nf_tables: autoload modules from the abort path
	net/x25: fix nonblocking connect
	Linux 5.4.16

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I9e45fa24244d45c31254748eb2ce698084ca06ac
2020-01-29 20:44:29 +01:00
Pablo Neira Ayuso
ce75dd3abb netfilter: nf_tables: autoload modules from the abort path
commit eb014de4fd upstream.

This patch introduces a list of pending module requests. This new module
list is composed of nft_module_request objects that contain the module
name and one status field that tells if the module has been already
loaded (the 'done' field).

In the first pass, from the preparation phase, the netlink command finds
that a module is missing on this list. Then, a module request is
allocated and added to this list and nft_request_module() returns
-EAGAIN. This triggers the abort path with the autoload parameter set on
from nfnetlink, request_module() is called and the module request enters
the 'done' state. Since the mutex is released when loading modules from
the abort phase, the module list is zapped so this is iteration occurs
over a local list. Therefore, the request_module() calls happen when
object lists are in consistent state (after fulling aborting the
transaction) and the commit list is empty.

On the second pass, the netlink command will find that it already tried
to load the module, so it does not request it again and
nft_request_module() returns 0. Then, there is a look up to find the
object that the command was missing. If the module was successfully
loaded, the command proceeds normally since it finds the missing object
in place, otherwise -ENOENT is reported to userspace.

This patch also updates nfnetlink to include the reason to enter the
abort phase, which is required for this new autoload module rationale.

Fixes: ec7470b834 ("netfilter: nf_tables: store transaction list locally while requesting module")
Reported-by: syzbot+29125d208b3dae9a7019@syzkaller.appspotmail.com
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-01-29 16:45:33 +01:00
Greg Kroah-Hartman
ea962facf5 Merge 5.4.14 into android-5.4
Changes in 5.4.14
	ARM: dts: meson8: fix the size of the PMU registers
	clk: qcom: gcc-sdm845: Add missing flag to votable GDSCs
	soc: amlogic: meson-ee-pwrc: propagate PD provider registration errors
	soc: amlogic: meson-ee-pwrc: propagate errors from pm_genpd_init()
	dt-bindings: reset: meson8b: fix duplicate reset IDs
	ARM: dts: imx6q-dhcom: fix rtc compatible
	arm64: dts: ls1028a: fix endian setting for dcfg
	arm64: dts: imx8mm: Change SDMA1 ahb clock for imx8mm
	bus: ti-sysc: Fix iterating over clocks
	clk: Don't try to enable critical clocks if prepare failed
	Revert "gpio: thunderx: Switch to GPIOLIB_IRQCHIP"
	arm64: dts: imx8mq-librem5-devkit: use correct interrupt for the magnetometer
	ASoC: msm8916-wcd-digital: Reset RX interpolation path after use
	ASoC: stm32: sai: fix possible circular locking
	ASoC: stm32: dfsdm: fix 16 bits record
	ASoC: msm8916-wcd-analog: Fix selected events for MIC BIAS External1
	ASoC: msm8916-wcd-analog: Fix MIC BIAS Internal1
	ARM: OMAP2+: Fix ti_sysc_find_one_clockdomain to check for to_clk_hw_omap
	ARM: dts: imx7ulp: fix reg of cpu node
	ARM: dts: imx6q-dhcom: Fix SGTL5000 VDDIO regulator connection
	ASoC: Intel: bytcht_es8316: Fix Irbis NB41 netbook quirk
	ALSA: dice: fix fallback from protocol extension into limited functionality
	ALSA: seq: Fix racy access for queue timer in proc read
	ALSA: firewire-tascam: fix corruption due to spin lock without restoration in SoftIRQ context
	ALSA: usb-audio: fix sync-ep altsetting sanity check
	arm64: dts: allwinner: a64: olinuxino: Fix SDIO supply regulator
	arm64: dts: allwinner: a64: olinuxino: Fix eMMC supply regulator
	arm64: dts: agilex/stratix10: fix pmu interrupt numbers
	Fix built-in early-load Intel microcode alignment
	clk: sunxi-ng: r40: Allow setting parent rate for external clock outputs
	block: fix an integer overflow in logical block size
	fuse: fix fuse_send_readpages() in the syncronous read case
	io_uring: only allow submit from owning task
	cpuidle: teo: Fix intervals[] array indexing bug
	ARM: dts: am571x-idk: Fix gpios property to have the correct gpio number
	ARM: davinci: select CONFIG_RESET_CONTROLLER
	perf: Correctly handle failed perf_get_aux_event()
	iio: adc: ad7124: Fix DT channel configuration
	iio: imu: st_lsm6dsx: Fix selection of ST_LSM6DS3_ID
	iio: light: vcnl4000: Fix scale for vcnl4040
	iio: chemical: pms7003: fix unmet triggered buffer dependency
	iio: buffer: align the size of scan bytes to size of the largest element
	USB: serial: simple: Add Motorola Solutions TETRA MTP3xxx and MTP85xx
	USB: serial: option: Add support for Quectel RM500Q
	USB: serial: opticon: fix control-message timeouts
	USB: serial: option: add support for Quectel RM500Q in QDL mode
	USB: serial: suppress driver bind attributes
	USB: serial: ch341: handle unbound port at reset_resume
	USB: serial: io_edgeport: handle unbound ports on URB completion
	USB: serial: io_edgeport: add missing active-port sanity check
	USB: serial: keyspan: handle unbound ports
	USB: serial: quatech2: handle unbound ports
	staging: comedi: ni_routes: fix null dereference in ni_find_route_source()
	staging: comedi: ni_routes: allow partial routing information
	scsi: fnic: fix invalid stack access
	scsi: mptfusion: Fix double fetch bug in ioctl
	ptrace: reintroduce usage of subjective credentials in ptrace_has_cap()
	mtd: rawnand: gpmi: Fix suspend/resume problem
	mtd: rawnand: gpmi: Restore nfc timing setup after suspend/resume
	usb: core: hub: Improved device recognition on remote wakeup
	cpu/SMT: Fix x86 link error without CONFIG_SYSFS
	x86/resctrl: Fix an imbalance in domain_remove_cpu()
	x86/CPU/AMD: Ensure clearing of SME/SEV features is maintained
	locking/rwsem: Fix kernel crash when spinning on RWSEM_OWNER_UNKNOWN
	perf/x86/intel/uncore: Fix missing marker for snr_uncore_imc_freerunning_events
	x86/efistub: Disable paging at mixed mode entry
	s390/zcrypt: Fix CCA cipher key gen with clear key value function
	scsi: storvsc: Correctly set number of hardware queues for IDE disk
	mtd: spi-nor: Fix selection of 4-byte addressing opcodes on Spansion
	drm/i915: Add missing include file <linux/math64.h>
	x86/resctrl: Fix potential memory leak
	efi/earlycon: Fix write-combine mapping on x86
	s390/setup: Fix secure ipl message
	clk: samsung: exynos5420: Keep top G3D clocks enabled
	perf hists: Fix variable name's inconsistency in hists__for_each() macro
	locking/lockdep: Fix buffer overrun problem in stack_trace[]
	perf report: Fix incorrectly added dimensions as switch perf data file
	mm/shmem.c: thp, shmem: fix conflict of above-47bit hint address and PMD alignment
	mm/huge_memory.c: thp: fix conflict of above-47bit hint address and PMD alignment
	mm: memcg/slab: fix percpu slab vmstats flushing
	mm: memcg/slab: call flush_memcg_workqueue() only if memcg workqueue is valid
	mm, debug_pagealloc: don't rely on static keys too early
	btrfs: rework arguments of btrfs_unlink_subvol
	btrfs: fix invalid removal of root ref
	btrfs: do not delete mismatched root refs
	btrfs: relocation: fix reloc_root lifespan and access
	btrfs: fix memory leak in qgroup accounting
	btrfs: check rw_devices, not num_devices for balance
	Btrfs: always copy scrub arguments back to user space
	mm/memory_hotplug: don't free usage map when removing a re-added early section
	mm/page-writeback.c: avoid potential division by zero in wb_min_max_ratio()
	mm: khugepaged: add trace status description for SCAN_PAGE_HAS_PRIVATE
	ARM: dts: imx6qdl-sabresd: Remove incorrect power supply assignment
	ARM: dts: imx6sx-sdb: Remove incorrect power supply assignment
	ARM: dts: imx6sl-evk: Remove incorrect power supply assignment
	ARM: dts: imx6sll-evk: Remove incorrect power supply assignment
	ARM: dts: imx6q-icore-mipi: Use 1.5 version of i.Core MX6DL
	ARM: dts: imx7: Fix Toradex Colibri iMX7S 256MB NAND flash support
	net: stmmac: 16KB buffer must be 16 byte aligned
	net: stmmac: Enable 16KB buffer size
	reset: Fix {of,devm}_reset_control_array_get kerneldoc return types
	tipc: fix potential hanging after b/rcast changing
	tipc: fix retrans failure due to wrong destination
	net: fix kernel-doc warning in <linux/netdevice.h>
	block: Fix the type of 'sts' in bsg_queue_rq()
	drm/amd/display: Reorder detect_edp_sink_caps before link settings read.
	bpf: Fix incorrect verifier simulation of ARSH under ALU32
	bpf: Sockmap/tls, during free we may call tcp_bpf_unhash() in loop
	bpf: Sockmap, ensure sock lock held during tear down
	bpf: Sockmap/tls, push write_space updates through ulp updates
	bpf: Sockmap, skmsg helper overestimates push, pull, and pop bounds
	bpf: Sockmap/tls, msg_push_data may leave end mark in place
	bpf: Sockmap/tls, tls_sw can create a plaintext buf > encrypt buf
	bpf: Sockmap/tls, skmsg can have wrapped skmsg that needs extra chaining
	bpf: Sockmap/tls, fix pop data with SK_DROP return code
	i2c: tegra: Fix suspending in active runtime PM state
	i2c: tegra: Properly disable runtime PM on driver's probe error
	cfg80211: fix deadlocks in autodisconnect work
	cfg80211: fix memory leak in nl80211_probe_mesh_link
	cfg80211: fix memory leak in cfg80211_cqm_rssi_update
	cfg80211: fix page refcount issue in A-MSDU decap
	bpf/sockmap: Read psock ingress_msg before sk_receive_queue
	i2c: iop3xx: Fix memory leak in probe error path
	netfilter: fix a use-after-free in mtype_destroy()
	netfilter: arp_tables: init netns pointer in xt_tgdtor_param struct
	netfilter: nat: fix ICMP header corruption on ICMP errors
	netfilter: nft_tunnel: fix null-attribute check
	netfilter: nft_tunnel: ERSPAN_VERSION must not be null
	netfilter: nf_tables: remove WARN and add NLA_STRING upper limits
	netfilter: nf_tables: store transaction list locally while requesting module
	netfilter: nf_tables: fix flowtable list del corruption
	NFC: pn533: fix bulk-message timeout
	net: bpf: Don't leak time wait and request sockets
	bpftool: Fix printing incorrect pointer in btf_dump_ptr
	batman-adv: Fix DAT candidate selection on little endian systems
	macvlan: use skb_reset_mac_header() in macvlan_queue_xmit()
	hv_netvsc: Fix memory leak when removing rndis device
	net: avoid updating qdisc_xmit_lock_key in netdev_update_lockdep_key()
	net: dsa: tag_qca: fix doubled Tx statistics
	net: hns3: pad the short frame before sending to the hardware
	net: hns: fix soft lockup when there is not enough memory
	net: phy: dp83867: Set FORCE_LINK_GOOD to default after reset
	net/sched: act_ife: initalize ife->metalist earlier
	net: usb: lan78xx: limit size of local TSO packets
	net/wan/fsl_ucc_hdlc: fix out of bounds write on array utdm_info
	ptp: free ptp device pin descriptors properly
	r8152: add missing endpoint sanity check
	tcp: fix marked lost packets not being retransmitted
	bnxt_en: Fix NTUPLE firmware command failures.
	bnxt_en: Fix ipv6 RFS filter matching logic.
	bnxt_en: Do not treat DSN (Digital Serial Number) read failure as fatal.
	net: ethernet: ave: Avoid lockdep warning
	net: systemport: Fixed queue mapping in internal ring map
	net: dsa: sja1105: Don't error out on disabled ports with no phy-mode
	net: dsa: tag_gswip: fix typo in tagger name
	net: sched: act_ctinfo: fix memory leak
	net: dsa: bcm_sf2: Configure IMP port for 2Gb/sec
	i40e: prevent memory leak in i40e_setup_macvlans
	drm/amdgpu: allow direct upload save restore list for raven2
	sh_eth: check sh_eth_cpu_data::dual_port when dumping registers
	mlxsw: spectrum: Do not modify cloned SKBs during xmit
	mlxsw: spectrum: Wipe xstats.backlog of down ports
	mlxsw: spectrum_qdisc: Include MC TCs in Qdisc counters
	net: stmmac: selftests: Make it work in Synopsys AXS101 boards
	net: stmmac: selftests: Mark as fail when received VLAN ID != expected
	selftests: mlxsw: qos_mc_aware: Fix mausezahn invocation
	net: stmmac: selftests: Update status when disabling RSS
	net: stmmac: tc: Do not setup flower filtering if RSS is enabled
	devlink: Wait longer before warning about unset port type
	xen/blkfront: Adjust indentation in xlvbd_alloc_gendisk
	dt-bindings: Add missing 'properties' keyword enclosing 'snps,tso'
	tcp: refine rule to allow EPOLLOUT generation under mem pressure
	irqchip: Place CONFIG_SIFIVE_PLIC into the menu
	arm64: dts: qcom: msm8998: Disable coresight by default
	cw1200: Fix a signedness bug in cw1200_load_firmware()
	arm64: dts: meson: axg: fix audio fifo reg size
	arm64: dts: meson: g12: fix audio fifo reg size
	arm64: dts: meson-gxl-s905x-khadas-vim: fix gpio-keys-polled node
	arm64: dts: renesas: r8a77970: Fix PWM3
	arm64: dts: marvell: Add AP806-dual missing CPU clocks
	cfg80211: check for set_wiphy_params
	tick/sched: Annotate lockless access to last_jiffies_update
	arm64: dts: marvell: Fix CP110 NAND controller node multi-line comment alignment
	arm64: dts: renesas: r8a774a1: Remove audio port node
	arm64: dts: imx8mm-evk: Assigned clocks for audio plls
	arm64: dts: qcom: sdm845-cheza: delete zap-shader
	ARM: dts: imx6ul-kontron-n6310-s: Disable the snvs-poweroff driver
	arm64: dts: allwinner: a64: Re-add PMU node
	ARM: dts: dra7: fix cpsw mdio fck clock
	arm64: dts: juno: Fix UART frequency
	ARM: dts: Fix sgx sysconfig register for omap4
	Revert "arm64: dts: juno: add dma-ranges property"
	mtd: devices: fix mchp23k256 read and write
	mtd: cfi_cmdset_0002: only check errors when ready in cfi_check_err_status()
	mtd: cfi_cmdset_0002: fix delayed error detection on HyperFlash
	um: Don't trace irqflags during shutdown
	um: virtio_uml: Disallow modular build
	reiserfs: fix handling of -EOPNOTSUPP in reiserfs_for_each_xattr
	scsi: esas2r: unlock on error in esas2r_nvram_read_direct()
	scsi: hisi_sas: Don't create debugfs dump folder twice
	scsi: hisi_sas: Set the BIST init value before enabling BIST
	scsi: qla4xxx: fix double free bug
	scsi: bnx2i: fix potential use after free
	scsi: target: core: Fix a pr_debug() argument
	scsi: lpfc: fix: Coverity: lpfc_get_scsi_buf_s3(): Null pointer dereferences
	scsi: hisi_sas: Return directly if init hardware failed
	scsi: scsi_transport_sas: Fix memory leak when removing devices
	scsi: qla2xxx: Fix qla2x00_request_irqs() for MSI
	scsi: qla2xxx: fix rports not being mark as lost in sync fabric scan
	scsi: core: scsi_trace: Use get_unaligned_be*()
	scsi: lpfc: Fix list corruption detected in lpfc_put_sgl_per_hdwq
	scsi: lpfc: Fix hdwq sgl locks and irq handling
	scsi: lpfc: Fix a kernel warning triggered by lpfc_get_sgl_per_hdwq()
	rtw88: fix potential read outside array boundary
	perf probe: Fix wrong address verification
	perf script: Allow --time with --reltime
	clk: sprd: Use IS_ERR() to validate the return value of syscon_regmap_lookup_by_phandle()
	clk: imx7ulp: Correct system clock source option #7
	clk: imx7ulp: Correct DDR clock mux options
	regulator: ab8500: Remove SYSCLKREQ from enum ab8505_regulator_id
	hwmon: (pmbus/ibm-cffps) Switch LEDs to blocking brightness call
	hwmon: (pmbus/ibm-cffps) Fix LED blink behavior
	perf script: Fix --reltime with --time
	scsi: lpfc: use hdwq assigned cpu for allocation
	Linux 5.4.14

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I400bdf3be682df698c2477fbf869d5ad8ce300b5
2020-01-23 08:37:43 +01:00
John Fastabend
2aa7a1ed37 bpf: Sockmap/tls, push write_space updates through ulp updates
commit 33bfe20dd7 upstream.

When sockmap sock with TLS enabled is removed we cleanup bpf/psock state
and call tcp_update_ulp() to push updates to TLS ULP on top. However, we
don't push the write_space callback up and instead simply overwrite the
op with the psock stored previous op. This may or may not be correct so
to ensure we don't overwrite the TLS write space hook pass this field to
the ULP and have it fixup the ctx.

This completes a previous fix that pushed the ops through to the ULP
but at the time missed doing this for write_space, presumably because
write_space TLS hook was added around the same time.

Fixes: 95fa145479 ("bpf: sockmap/tls, close can race with map free")
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
Acked-by: Jonathan Lemon <jonathan.lemon@gmail.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/bpf/20200111061206.8028-4-john.fastabend@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-01-23 08:22:45 +01:00
Greg Kroah-Hartman
813bf83282 Merge 5.4.9 into android-5.4
Changes in 5.4.9
	drm/mcde: dsi: Fix invalid pointer dereference if panel cannot be found
	nvme_fc: add module to ops template to allow module references
	nvme-fc: fix double-free scenarios on hw queues
	drm/amdgpu: add check before enabling/disabling broadcast mode
	drm/amdgpu: add header line for power profile on Arcturus
	drm/amdgpu: add cache flush workaround to gfx8 emit_fence
	drm/amd/display: Map DSC resources 1-to-1 if numbers of OPPs and DSCs are equal
	drm/amd/display: Fixed kernel panic when booting with DP-to-HDMI dongle
	drm/amd/display: Change the delay time before enabling FEC
	drm/amd/display: Reset steer fifo before unblanking the stream
	drm/amd/display: update dispclk and dppclk vco frequency
	nvme/pci: Fix write and poll queue types
	nvme/pci: Fix read queue count
	iio: st_accel: Fix unused variable warning
	iio: adc: max9611: Fix too short conversion time delay
	PM / devfreq: Fix devfreq_notifier_call returning errno
	PM / devfreq: Set scaling_max_freq to max on OPP notifier error
	PM / devfreq: Don't fail devfreq_dev_release if not in list
	afs: Fix afs_find_server lookups for ipv4 peers
	afs: Fix SELinux setting security label on /afs
	RDMA/cma: add missed unregister_pernet_subsys in init failure
	rxe: correctly calculate iCRC for unaligned payloads
	scsi: lpfc: Fix memory leak on lpfc_bsg_write_ebuf_set func
	scsi: qla2xxx: Use explicit LOGO in target mode
	scsi: qla2xxx: Drop superfluous INIT_WORK of del_work
	scsi: qla2xxx: Don't call qlt_async_event twice
	scsi: qla2xxx: Fix PLOGI payload and ELS IOCB dump length
	scsi: qla2xxx: Configure local loop for N2N target
	scsi: qla2xxx: Send Notify ACK after N2N PLOGI
	scsi: qla2xxx: Don't defer relogin unconditonally
	scsi: qla2xxx: Ignore PORT UPDATE after N2N PLOGI
	scsi: iscsi: qla4xxx: fix double free in probe
	scsi: libsas: stop discovering if oob mode is disconnected
	scsi: iscsi: Avoid potential deadlock in iscsi_if_rx func
	staging/wlan-ng: add CRC32 dependency in Kconfig
	drm/nouveau: Move the declaration of struct nouveau_conn_atom up a bit
	drm/nouveau: Fix drm-core using atomic code-paths on pre-nv50 hardware
	drm/nouveau/kms/nv50-: fix panel scaling
	usb: gadget: fix wrong endpoint desc
	net: make socket read/write_iter() honor IOCB_NOWAIT
	afs: Fix mountpoint parsing
	afs: Fix creation calls in the dynamic root to fail with EOPNOTSUPP
	raid5: need to set STRIPE_HANDLE for batch head
	md: raid1: check rdev before reference in raid1_sync_request func
	s390/cpum_sf: Adjust sampling interval to avoid hitting sample limits
	s390/cpum_sf: Avoid SBD overflow condition in irq handler
	RDMA/counter: Prevent auto-binding a QP which are not tracked with res
	IB/mlx4: Follow mirror sequence of device add during device removal
	IB/mlx5: Fix steering rule of drop and count
	xen-blkback: prevent premature module unload
	xen/balloon: fix ballooned page accounting without hotplug enabled
	PM / hibernate: memory_bm_find_bit(): Tighten node optimisation
	ALSA: hda/realtek - Add Bass Speaker and fixed dac for bass speaker
	ALSA: hda/realtek - Enable the bass speaker of ASUS UX431FLC
	PCI: Add a helper to check Power Resource Requirements _PR3 existence
	ALSA: hda: Allow HDA to be runtime suspended when dGPU is not bound to a driver
	PCI: Fix missing inline for pci_pr3_present()
	ALSA: hda - fixup for the bass speaker on Lenovo Carbon X1 7th gen
	tcp: fix data-race in tcp_recvmsg()
	shmem: pin the file in shmem_fault() if mmap_sem is dropped
	taskstats: fix data-race
	ALSA: hda - Downgrade error message for single-cmd fallback
	netfilter: nft_tproxy: Fix port selector on Big Endian
	block: add bio_truncate to fix guard_bio_eod
	mm: drop mmap_sem before calling balance_dirty_pages() in write fault
	ALSA: ice1724: Fix sleep-in-atomic in Infrasonic Quartet support code
	ALSA: usb-audio: fix set_format altsetting sanity check
	ALSA: usb-audio: set the interface format after resume on Dell WD19
	ALSA: hda - Apply sync-write workaround to old Intel platforms, too
	ALSA: hda/realtek - Add headset Mic no shutup for ALC283
	drm/sun4i: hdmi: Remove duplicate cleanup calls
	drm/amdgpu/smu: add metrics table lock
	drm/amdgpu/smu: add metrics table lock for arcturus (v2)
	drm/amdgpu/smu: add metrics table lock for navi (v2)
	drm/amdgpu/smu: add metrics table lock for vega20 (v2)
	MIPS: BPF: Disable MIPS32 eBPF JIT
	MIPS: BPF: eBPF JIT: check for MIPS ISA compliance in Kconfig
	MIPS: Avoid VDSO ABI breakage due to global register variable
	media: pulse8-cec: fix lost cec_transmit_attempt_done() call
	media: cec: CEC 2.0-only bcast messages were ignored
	media: cec: avoid decrementing transmit_queue_sz if it is 0
	media: cec: check 'transmit_in_progress', not 'transmitting'
	mm/memory_hotplug: shrink zones when offlining memory
	mm/zsmalloc.c: fix the migrated zspage statistics.
	memcg: account security cred as well to kmemcg
	mm: move_pages: return valid node id in status if the page is already on the target node
	mm/oom: fix pgtables units mismatch in Killed process message
	ocfs2: fix the crash due to call ocfs2_get_dlm_debug once less
	pstore/ram: Write new dumps to start of recycled zones
	pstore/ram: Fix error-path memory leak in persistent_ram_new() callers
	gcc-plugins: make it possible to disable CONFIG_GCC_PLUGINS again
	locks: print unsigned ino in /proc/locks
	selftests/seccomp: Zero out seccomp_notif
	seccomp: Check that seccomp_notif is zeroed out by the user
	samples/seccomp: Zero out members based on seccomp_notif_sizes
	selftests/seccomp: Catch garbage on SECCOMP_IOCTL_NOTIF_RECV
	dmaengine: Fix access to uninitialized dma_slave_caps
	dmaengine: dma-jz4780: Also break descriptor chains on JZ4725B
	Btrfs: fix infinite loop during nocow writeback due to race
	compat_ioctl: block: handle Persistent Reservations
	compat_ioctl: block: handle BLKREPORTZONE/BLKRESETZONE
	compat_ioctl: block: handle BLKGETZONESZ/BLKGETNRZONES
	bpf: Fix precision tracking for unbounded scalars
	ata: libahci_platform: Export again ahci_platform_<en/dis>able_phys()
	ata: ahci_brcm: Fix AHCI resources management
	ata: ahci_brcm: Add missing clock management during recovery
	ata: ahci_brcm: BCM7425 AHCI requires AHCI_HFLAG_DELAY_ENGINE
	libata: Fix retrieving of active qcs
	gpio: xtensa: fix driver build
	gpiolib: fix up emulated open drain outputs
	clocksource: riscv: add notrace to riscv_sched_clock
	riscv: ftrace: correct the condition logic in function graph tracer
	rseq/selftests: Fix: Namespace gettid() for compatibility with glibc 2.30
	tracing: Fix lock inversion in trace_event_enable_tgid_record()
	tracing: Avoid memory leak in process_system_preds()
	tracing: Have the histogram compare functions convert to u64 first
	tracing: Fix endianness bug in histogram trigger
	samples/trace_printk: Wait for IRQ work to finish
	io_uring: use current task creds instead of allocating a new one
	mm/gup: fix memory leak in __gup_benchmark_ioctl
	apparmor: fix aa_xattrs_match() may sleep while holding a RCU lock
	dmaengine: virt-dma: Fix access after free in vchan_complete()
	gen_initramfs_list.sh: fix 'bad variable name' error
	ALSA: cs4236: fix error return comparison of an unsigned integer
	ALSA: pcm: Yet another missing check of non-cached buffer type
	ALSA: firewire-motu: Correct a typo in the clock proc string
	scsi: lpfc: Fix rpi release when deleting vport
	exit: panic before exit_mm() on global init exit
	arm64: Revert support for execute-only user mappings
	ftrace: Avoid potential division by zero in function profiler
	spi: spi-fsl-dspi: Fix 16-bit word order in 32-bit XSPI mode
	drm/msm: include linux/sched/task.h
	PM / devfreq: Check NULL governor in available_governors_show
	sunrpc: fix crash when cache_head become valid before update
	arm64: dts: qcom: msm8998-clamshell: Remove retention idle state
	nfsd4: fix up replay_matches_cache()
	powerpc: Chunk calls to flush_dcache_range in arch_*_memory
	HID: i2c-hid: Reset ALPS touchpads on resume
	net/sched: annotate lockless accesses to qdisc->empty
	kernel/module.c: wakeup processes in module_wq on module unload
	ACPI: sysfs: Change ACPI_MASKABLE_GPE_MAX to 0x100
	perf callchain: Fix segfault in thread__resolve_callchain_sample()
	iommu/vt-d: Remove incorrect PSI capability check
	of: overlay: add_changeset_property() memory leak
	cifs: Fix potential softlockups while refreshing DFS cache
	firmware: arm_scmi: Avoid double free in error flow
	xfs: don't check for AG deadlock for realtime files in bunmapi
	platform/x86: pmc_atom: Add Siemens CONNECT X300 to critclk_systems DMI table
	netfilter: nf_queue: enqueue skbs with NULL dst
	net, sysctl: Fix compiler warning when only cBPF is present
	watchdog: tqmx86_wdt: Fix build error
	regulator: axp20x: Fix axp20x_set_ramp_delay
	regulator: bd70528: Remove .set_ramp_delay for bd70528_ldo_ops
	spi: uniphier: Fix FIFO threshold
	regulator: axp20x: Fix AXP22x ELDO2 regulator enable bitmask
	powerpc/mm: Mark get_slice_psize() & slice_addr_is_low() as notrace
	Bluetooth: btusb: fix PM leak in error case of setup
	Bluetooth: delete a stray unlock
	Bluetooth: Fix memory leak in hci_connect_le_scan
	arm64: dts: meson-gxl-s905x-khadas-vim: fix uart_A bluetooth node
	arm64: dts: meson-gxm-khadas-vim2: fix uart_A bluetooth node
	media: flexcop-usb: ensure -EIO is returned on error condition
	regulator: ab8500: Remove AB8505 USB regulator
	media: usb: fix memory leak in af9005_identify_state
	dt-bindings: clock: renesas: rcar-usb2-clock-sel: Fix typo in example
	arm64: dts: meson: odroid-c2: Disable usb_otg bus to avoid power failed warning
	phy: renesas: rcar-gen3-usb2: Use platform_get_irq_optional() for optional irq
	tty: serial: msm_serial: Fix lockup for sysrq and oops
	cifs: Fix lookup of root ses in DFS referral cache
	fs: cifs: Fix atime update check vs mtime
	fix compat handling of FICLONERANGE, FIDEDUPERANGE and FS_IOC_FIEMAP
	ath9k_htc: Modify byte order for an error message
	ath9k_htc: Discard undersized packets
	drm/i915/execlists: Fix annotation for decoupling virtual request
	xfs: periodically yield scrub threads to the scheduler
	net: add annotations on hh->hh_len lockless accesses
	ubifs: ubifs_tnc_start_commit: Fix OOB in layout_in_gaps
	btrfs: get rid of unique workqueue helper functions
	Btrfs: only associate the locked page with one async_chunk struct
	s390/smp: fix physical to logical CPU map for SMT
	mm/sparse.c: mark populate_section_memmap as __meminit
	xen/blkback: Avoid unmapping unmapped grant pages
	lib/ubsan: don't serialize UBSAN report
	efi: Don't attempt to map RCI2 config table if it doesn't exist
	perf/x86/intel/bts: Fix the use of page_private()
	net: annotate lockless accesses to sk->sk_pacing_shift
	hsr: avoid debugfs warning message when module is remove
	hsr: fix error handling routine in hsr_dev_finalize()
	hsr: fix a race condition in node list insertion and deletion
	mm/hugetlb: defer freeing of huge pages if in non-task context
	Linux 5.4.9

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I8eebcdac421faf74f70af8e8666abfdcdc45c86b
2020-01-09 16:00:18 +01:00
Eric Dumazet
8f8e806c51 net: annotate lockless accesses to sk->sk_pacing_shift
[ Upstream commit 7c68fa2bdd ]

sk->sk_pacing_shift can be read and written without lock
synchronization. This patch adds annotations to
document this fact and avoid future syzbot complains.

This might also avoid unexpected false sharing
in sk_pacing_shift_update(), as the compiler
could remove the conditional check and always
write over sk->sk_pacing_shift :

if (sk->sk_pacing_shift != val)
	sk->sk_pacing_shift = val;

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-01-09 10:20:07 +01:00
Eric Dumazet
3900f9268a net: add annotations on hh->hh_len lockless accesses
[ Upstream commit c305c6ae79 ]

KCSAN reported a data-race [1]

While we can use READ_ONCE() on the read sides,
we need to make sure hh->hh_len is written last.

[1]

BUG: KCSAN: data-race in eth_header_cache / neigh_resolve_output

write to 0xffff8880b9dedcb8 of 4 bytes by task 29760 on cpu 0:
 eth_header_cache+0xa9/0xd0 net/ethernet/eth.c:247
 neigh_hh_init net/core/neighbour.c:1463 [inline]
 neigh_resolve_output net/core/neighbour.c:1480 [inline]
 neigh_resolve_output+0x415/0x470 net/core/neighbour.c:1470
 neigh_output include/net/neighbour.h:511 [inline]
 ip6_finish_output2+0x7a2/0xec0 net/ipv6/ip6_output.c:116
 __ip6_finish_output net/ipv6/ip6_output.c:142 [inline]
 __ip6_finish_output+0x2d7/0x330 net/ipv6/ip6_output.c:127
 ip6_finish_output+0x41/0x160 net/ipv6/ip6_output.c:152
 NF_HOOK_COND include/linux/netfilter.h:294 [inline]
 ip6_output+0xf2/0x280 net/ipv6/ip6_output.c:175
 dst_output include/net/dst.h:436 [inline]
 NF_HOOK include/linux/netfilter.h:305 [inline]
 ndisc_send_skb+0x459/0x5f0 net/ipv6/ndisc.c:505
 ndisc_send_ns+0x207/0x430 net/ipv6/ndisc.c:647
 rt6_probe_deferred+0x98/0xf0 net/ipv6/route.c:615
 process_one_work+0x3d4/0x890 kernel/workqueue.c:2269
 worker_thread+0xa0/0x800 kernel/workqueue.c:2415
 kthread+0x1d4/0x200 drivers/block/aoe/aoecmd.c:1253
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352

read to 0xffff8880b9dedcb8 of 4 bytes by task 29572 on cpu 1:
 neigh_resolve_output net/core/neighbour.c:1479 [inline]
 neigh_resolve_output+0x113/0x470 net/core/neighbour.c:1470
 neigh_output include/net/neighbour.h:511 [inline]
 ip6_finish_output2+0x7a2/0xec0 net/ipv6/ip6_output.c:116
 __ip6_finish_output net/ipv6/ip6_output.c:142 [inline]
 __ip6_finish_output+0x2d7/0x330 net/ipv6/ip6_output.c:127
 ip6_finish_output+0x41/0x160 net/ipv6/ip6_output.c:152
 NF_HOOK_COND include/linux/netfilter.h:294 [inline]
 ip6_output+0xf2/0x280 net/ipv6/ip6_output.c:175
 dst_output include/net/dst.h:436 [inline]
 NF_HOOK include/linux/netfilter.h:305 [inline]
 ndisc_send_skb+0x459/0x5f0 net/ipv6/ndisc.c:505
 ndisc_send_ns+0x207/0x430 net/ipv6/ndisc.c:647
 rt6_probe_deferred+0x98/0xf0 net/ipv6/route.c:615
 process_one_work+0x3d4/0x890 kernel/workqueue.c:2269
 worker_thread+0xa0/0x800 kernel/workqueue.c:2415
 kthread+0x1d4/0x200 drivers/block/aoe/aoecmd.c:1253
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 29572 Comm: kworker/1:4 Not tainted 5.4.0-rc6+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events rt6_probe_deferred

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-01-09 10:20:06 +01:00
Eric Dumazet
3b91237c52 net/sched: annotate lockless accesses to qdisc->empty
commit 90b2be27bb upstream.

KCSAN reported the following race [1]

BUG: KCSAN: data-race in __dev_queue_xmit / net_tx_action

read to 0xffff8880ba403508 of 1 bytes by task 21814 on cpu 1:
 __dev_xmit_skb net/core/dev.c:3389 [inline]
 __dev_queue_xmit+0x9db/0x1b40 net/core/dev.c:3761
 dev_queue_xmit+0x21/0x30 net/core/dev.c:3825
 neigh_hh_output include/net/neighbour.h:500 [inline]
 neigh_output include/net/neighbour.h:509 [inline]
 ip6_finish_output2+0x873/0xec0 net/ipv6/ip6_output.c:116
 __ip6_finish_output net/ipv6/ip6_output.c:142 [inline]
 __ip6_finish_output+0x2d7/0x330 net/ipv6/ip6_output.c:127
 ip6_finish_output+0x41/0x160 net/ipv6/ip6_output.c:152
 NF_HOOK_COND include/linux/netfilter.h:294 [inline]
 ip6_output+0xf2/0x280 net/ipv6/ip6_output.c:175
 dst_output include/net/dst.h:436 [inline]
 ip6_local_out+0x74/0x90 net/ipv6/output_core.c:179
 ip6_send_skb+0x53/0x110 net/ipv6/ip6_output.c:1795
 udp_v6_send_skb.isra.0+0x3ec/0xa70 net/ipv6/udp.c:1173
 udpv6_sendmsg+0x1906/0x1c20 net/ipv6/udp.c:1471
 inet6_sendmsg+0x6d/0x90 net/ipv6/af_inet6.c:576
 sock_sendmsg_nosec net/socket.c:637 [inline]
 sock_sendmsg+0x9f/0xc0 net/socket.c:657
 ___sys_sendmsg+0x2b7/0x5d0 net/socket.c:2311
 __sys_sendmmsg+0x123/0x350 net/socket.c:2413
 __do_sys_sendmmsg net/socket.c:2442 [inline]
 __se_sys_sendmmsg net/socket.c:2439 [inline]
 __x64_sys_sendmmsg+0x64/0x80 net/socket.c:2439
 do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

write to 0xffff8880ba403508 of 1 bytes by interrupt on cpu 0:
 qdisc_run_begin include/net/sch_generic.h:160 [inline]
 qdisc_run include/net/pkt_sched.h:120 [inline]
 net_tx_action+0x2b1/0x6c0 net/core/dev.c:4551
 __do_softirq+0x115/0x33f kernel/softirq.c:292
 do_softirq_own_stack+0x2a/0x40 arch/x86/entry/entry_64.S:1082
 do_softirq.part.0+0x6b/0x80 kernel/softirq.c:337
 do_softirq kernel/softirq.c:329 [inline]
 __local_bh_enable_ip+0x76/0x80 kernel/softirq.c:189
 local_bh_enable include/linux/bottom_half.h:32 [inline]
 rcu_read_unlock_bh include/linux/rcupdate.h:688 [inline]
 ip6_finish_output2+0x7bb/0xec0 net/ipv6/ip6_output.c:117
 __ip6_finish_output net/ipv6/ip6_output.c:142 [inline]
 __ip6_finish_output+0x2d7/0x330 net/ipv6/ip6_output.c:127
 ip6_finish_output+0x41/0x160 net/ipv6/ip6_output.c:152
 NF_HOOK_COND include/linux/netfilter.h:294 [inline]
 ip6_output+0xf2/0x280 net/ipv6/ip6_output.c:175
 dst_output include/net/dst.h:436 [inline]
 ip6_local_out+0x74/0x90 net/ipv6/output_core.c:179
 ip6_send_skb+0x53/0x110 net/ipv6/ip6_output.c:1795
 udp_v6_send_skb.isra.0+0x3ec/0xa70 net/ipv6/udp.c:1173
 udpv6_sendmsg+0x1906/0x1c20 net/ipv6/udp.c:1471
 inet6_sendmsg+0x6d/0x90 net/ipv6/af_inet6.c:576
 sock_sendmsg_nosec net/socket.c:637 [inline]
 sock_sendmsg+0x9f/0xc0 net/socket.c:657
 ___sys_sendmsg+0x2b7/0x5d0 net/socket.c:2311
 __sys_sendmmsg+0x123/0x350 net/socket.c:2413
 __do_sys_sendmmsg net/socket.c:2442 [inline]
 __se_sys_sendmmsg net/socket.c:2439 [inline]
 __x64_sys_sendmmsg+0x64/0x80 net/socket.c:2439
 do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 21817 Comm: syz-executor.2 Not tainted 5.4.0-rc6+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

Fixes: d518d2ed86 ("net/sched: fix race between deactivation and dequeue for NOLOCK qdisc")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: Davide Caratti <dcaratti@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-01-09 10:20:02 +01:00
Greg Kroah-Hartman
de197c5a4f Merge 5.4.8 into android-5.4
Changes in 5.4.8
	Revert "MIPS: futex: Restore \n after sync instructions"
	Revert "MIPS: futex: Emit Loongson3 sync workarounds within asm"
	scsi: lpfc: Fix spinlock_irq issues in lpfc_els_flush_cmd()
	scsi: lpfc: Fix discovery failures when target device connectivity bounces
	scsi: mpt3sas: Fix clear pending bit in ioctl status
	scsi: lpfc: Fix locking on mailbox command completion
	scsi: mpt3sas: Reject NVMe Encap cmnds to unsupported HBA
	gpio: mxc: Only get the second IRQ when there is more than one IRQ
	scsi: lpfc: Fix list corruption in lpfc_sli_get_iocbq
	Input: atmel_mxt_ts - disable IRQ across suspend
	f2fs: fix to update time in lazytime mode
	powerpc/papr_scm: Fix an off-by-one check in papr_scm_meta_{get, set}
	tools/power/x86/intel-speed-select: Remove warning for unused result
	platform/x86: peaq-wmi: switch to using polled mode of input devices
	iommu: rockchip: Free domain on .domain_free
	iommu/tegra-smmu: Fix page tables in > 4 GiB memory
	dmaengine: xilinx_dma: Clear desc_pendingcount in xilinx_dma_reset
	scsi: target: compare full CHAP_A Algorithm strings
	scsi: lpfc: Fix hardlockup in lpfc_abort_handler
	scsi: lpfc: Fix SLI3 hba in loop mode not discovering devices
	scsi: csiostor: Don't enable IRQs too early
	scsi: hisi_sas: Replace in_softirq() check in hisi_sas_task_exec()
	scsi: hisi_sas: Delete the debugfs folder of hisi_sas when the probe fails
	powerpc/pseries: Mark accumulate_stolen_time() as notrace
	powerpc/pseries: Don't fail hash page table insert for bolted mapping
	Input: st1232 - do not reset the chip too early
	selftests/powerpc: Fixup clobbers for TM tests
	powerpc/tools: Don't quote $objdump in scripts
	dma-debug: add a schedule point in debug_dma_dump_mappings()
	dma-mapping: Add vmap checks to dma_map_single()
	dma-mapping: fix handling of dma-ranges for reserved memory (again)
	dmaengine: fsl-qdma: Handle invalid qdma-queue0 IRQ
	leds: lm3692x: Handle failure to probe the regulator
	leds: an30259a: add a check for devm_regmap_init_i2c
	leds: trigger: netdev: fix handling on interface rename
	clocksource/drivers/asm9260: Add a check for of_clk_get
	clocksource/drivers/timer-of: Use unique device name instead of timer
	dtc: Use pkg-config to locate libyaml
	selftests/powerpc: Skip tm-signal-sigreturn-nt if TM not available
	powerpc/security/book3s64: Report L1TF status in sysfs
	powerpc/book3s64/hash: Add cond_resched to avoid soft lockup warning
	ext4: update direct I/O read lock pattern for IOCB_NOWAIT
	ext4: iomap that extends beyond EOF should be marked dirty
	jbd2: Fix statistics for the number of logged blocks
	scsi: tracing: Fix handling of TRANSFER LENGTH == 0 for READ(6) and WRITE(6)
	scsi: lpfc: Fix unexpected error messages during RSCN handling
	scsi: lpfc: Fix duplicate unreg_rpi error in port offline flow
	f2fs: fix to update dir's i_pino during cross_rename
	clk: qcom: smd: Add missing pnoc clock
	clk: qcom: Allow constant ratio freq tables for rcg
	clk: clk-gpio: propagate rate change to parent
	irqchip/irq-bcm7038-l1: Enable parent IRQ if necessary
	irqchip: ingenic: Error out if IRQ domain creation failed
	dma-direct: check for overflows on 32 bit DMA addresses
	fs/quota: handle overflows of sysctl fs.quota.* and report as unsigned long
	iommu/arm-smmu-v3: Don't display an error when IRQ lines are missing
	i2c: stm32f7: fix & reorder remove & probe error handling
	iomap: fix return value of iomap_dio_bio_actor on 32bit systems
	Input: ili210x - handle errors from input_mt_init_slots()
	scsi: lpfc: fix: Coverity: lpfc_cmpl_els_rsp(): Null pointer dereferences
	scsi: zorro_esp: Limit DMA transfers to 65536 bytes (except on Fastlane)
	PCI: rpaphp: Fix up pointer to first drc-info entry
	scsi: ufs: fix potential bug which ends in system hang
	powerpc/pseries/cmm: Implement release() function for sysfs device
	PCI: rpaphp: Don't rely on firmware feature to imply drc-info support
	PCI: rpaphp: Annotate and correctly byte swap DRC properties
	PCI: rpaphp: Correctly match ibm, my-drc-index to drc-name when using drc-info
	powerpc/security: Fix wrong message when RFI Flush is disable
	powerpc/eeh: differentiate duplicate detection message
	powerpc/book3s/mm: Update Oops message to print the correct translation in use
	scsi: atari_scsi: sun3_scsi: Set sg_tablesize to 1 instead of SG_NONE
	clk: pxa: fix one of the pxa RTC clocks
	bcache: at least try to shrink 1 node in bch_mca_scan()
	HID: quirks: Add quirk for HP MSU1465 PIXART OEM mouse
	dt-bindings: Improve validation build error handling
	HID: logitech-hidpp: Silence intermittent get_battery_capacity errors
	HID: i2c-hid: fix no irq after reset on raydium 3118
	ARM: 8937/1: spectre-v2: remove Brahma-B53 from hardening
	libnvdimm/btt: fix variable 'rc' set but not used
	HID: Improve Windows Precision Touchpad detection.
	HID: rmi: Check that the RMI_STARTED bit is set before unregistering the RMI transport device
	watchdog: imx7ulp: Fix reboot hang
	watchdog: prevent deferral of watchdogd wakeup on RT
	watchdog: Fix the race between the release of watchdog_core_data and cdev
	powerpc/fixmap: Use __fix_to_virt() instead of fix_to_virt()
	scsi: pm80xx: Fix for SATA device discovery
	scsi: ufs: Fix error handing during hibern8 enter
	scsi: scsi_debug: num_tgts must be >= 0
	scsi: NCR5380: Add disconnect_mask module parameter
	scsi: target: core: Release SPC-2 reservations when closing a session
	scsi: ufs: Fix up auto hibern8 enablement
	scsi: iscsi: Don't send data to unbound connection
	scsi: target: iscsi: Wait for all commands to finish before freeing a session
	f2fs: Fix deadlock in f2fs_gc() context during atomic files handling
	habanalabs: skip VA block list update in reset flow
	gpio/mpc8xxx: fix qoriq GPIO reading
	platform/x86: intel_pmc_core: Fix the SoC naming inconsistency
	platform/x86: intel_pmc_core: Add Comet Lake (CML) platform support to intel_pmc_core driver
	gpio: mpc8xxx: Don't overwrite default irq_set_type callback
	gpio: lynxpoint: Setup correct IRQ handlers
	tools/power/x86/intel-speed-select: Ignore missing config level
	Drivers: hv: vmbus: Fix crash handler reset of Hyper-V synic
	apparmor: fix unsigned len comparison with less than zero
	drm/amdgpu: Call find_vma under mmap_sem
	scripts/kallsyms: fix definitely-lost memory leak
	powerpc: Don't add -mabi= flags when building with Clang
	cifs: Fix use-after-free bug in cifs_reconnect()
	um: virtio: Keep reading on -EAGAIN
	io_uring: io_allocate_scq_urings() should return a sane state
	of: unittest: fix memory leak in attach_node_and_children
	cdrom: respect device capabilities during opening action
	cifs: move cifsFileInfo_put logic into a work-queue
	perf diff: Use llabs() with 64-bit values
	perf script: Fix brstackinsn for AUXTRACE
	perf regs: Make perf_reg_name() return "unknown" instead of NULL
	s390/zcrypt: handle new reply code FILTERED_BY_HYPERVISOR
	mailbox: imx: Clear the right interrupts at shutdown
	libfdt: define INT32_MAX and UINT32_MAX in libfdt_env.h
	s390/unwind: filter out unreliable bogus %r14
	s390/cpum_sf: Check for SDBT and SDB consistency
	ocfs2: fix passing zero to 'PTR_ERR' warning
	mailbox: imx: Fix Tx doorbell shutdown path
	s390: disable preemption when switching to nodat stack with CALL_ON_STACK
	selftests: vm: add fragment CONFIG_TEST_VMALLOC
	mm/hugetlbfs: fix error handling when setting up mounts
	kernel: sysctl: make drop_caches write-only
	userfaultfd: require CAP_SYS_PTRACE for UFFD_FEATURE_EVENT_FORK
	Revert "powerpc/vcpu: Assume dedicated processors as non-preempt"
	sctp: fix err handling of stream initialization
	md: make sure desc_nr less than MD_SB_DISKS
	Revert "iwlwifi: assign directly to iwl_trans->cfg in QuZ detection"
	netfilter: ebtables: compat: reject all padding in matches/watchers
	6pack,mkiss: fix possible deadlock
	powerpc: Fix __clear_user() with KUAP enabled
	net/smc: add fallback check to connect()
	netfilter: bridge: make sure to pull arp header in br_nf_forward_arp()
	inetpeer: fix data-race in inet_putpeer / inet_putpeer
	net: add a READ_ONCE() in skb_peek_tail()
	net: icmp: fix data-race in cmp_global_allow()
	hrtimer: Annotate lockless access to timer->state
	tomoyo: Don't use nifty names on sockets.
	uaccess: disallow > INT_MAX copy sizes
	drm: limit to INT_MAX in create_blob ioctl
	xfs: fix mount failure crash on invalid iclog memory access
	cxgb4/cxgb4vf: fix flow control display for auto negotiation
	net: dsa: bcm_sf2: Fix IP fragment location and behavior
	net/mlxfw: Fix out-of-memory error in mfa2 flash burning
	net: phy: aquantia: add suspend / resume ops for AQR105
	net/sched: act_mirred: Pull mac prior redir to non mac_header_xmit device
	net/sched: add delete_empty() to filters and use it in cls_flower
	net_sched: sch_fq: properly set sk->sk_pacing_status
	net: stmmac: dwmac-meson8b: Fix the RGMII TX delay on Meson8b/8m2 SoCs
	ptp: fix the race between the release of ptp_clock and cdev
	tcp: Fix highest_sack and highest_sack_seq
	udp: fix integer overflow while computing available space in sk_rcvbuf
	bnxt_en: Fix MSIX request logic for RDMA driver.
	bnxt_en: Free context memory in the open path if firmware has been reset.
	bnxt_en: Return error if FW returns more data than dump length
	bnxt_en: Fix bp->fw_health allocation and free logic.
	bnxt_en: Remove unnecessary NULL checks for fw_health
	bnxt_en: Fix the logic that creates the health reporters.
	bnxt_en: Add missing devlink health reporters for VFs.
	mlxsw: spectrum_router: Skip loopback RIFs during MAC validation
	mlxsw: spectrum: Use dedicated policer for VRRP packets
	net: add bool confirm_neigh parameter for dst_ops.update_pmtu
	ip6_gre: do not confirm neighbor when do pmtu update
	gtp: do not confirm neighbor when do pmtu update
	net/dst: add new function skb_dst_update_pmtu_no_confirm
	tunnel: do not confirm neighbor when do pmtu update
	vti: do not confirm neighbor when do pmtu update
	sit: do not confirm neighbor when do pmtu update
	net/dst: do not confirm neighbor for vxlan and geneve pmtu update
	net: dsa: sja1105: Reconcile the meaning of TPID and TPID2 for E/T and P/Q/R/S
	net: marvell: mvpp2: phylink requires the link interrupt
	gtp: fix wrong condition in gtp_genl_dump_pdp()
	gtp: avoid zero size hashtable
	bonding: fix active-backup transition after link failure
	tcp: do not send empty skb from tcp_write_xmit()
	tcp/dccp: fix possible race __inet_lookup_established()
	hv_netvsc: Fix tx_table init in rndis_set_subchannel()
	gtp: fix an use-after-free in ipv4_pdp_find()
	gtp: do not allow adding duplicate tid and ms_addr pdp context
	bnxt: apply computed clamp value for coalece parameter
	ipv6/addrconf: only check invalid header values when NETLINK_F_STRICT_CHK is set
	net: phylink: fix interface passed to mac_link_up
	net: ena: fix napi handler misbehavior when the napi budget is zero
	vhost/vsock: accept only packets with the right dst_cid
	mmc: sdhci-of-esdhc: fix up erratum A-008171 workaround
	mmc: sdhci-of-esdhc: re-implement erratum A-009204 workaround
	mm/hugetlbfs: fix for_each_hstate() loop in init_hugetlbfs_fs()
	Linux 5.4.8

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I9962505e7207f0004499de4666df6862105e990d
2020-01-04 19:40:03 +01:00
Eric Dumazet
0a0ee9f2d5 tcp/dccp: fix possible race __inet_lookup_established()
[ Upstream commit 8dbd76e79a ]

Michal Kubecek and Firo Yang did a very nice analysis of crashes
happening in __inet_lookup_established().

Since a TCP socket can go from TCP_ESTABLISH to TCP_LISTEN
(via a close()/socket()/listen() cycle) without a RCU grace period,
I should not have changed listeners linkage in their hash table.

They must use the nulls protocol (Documentation/RCU/rculist_nulls.txt),
so that a lookup can detect a socket in a hash list was moved in
another one.

Since we added code in commit d296ba60d8 ("soreuseport: Resolve
merge conflict for v4/v6 ordering fix"), we have to add
hlist_nulls_add_tail_rcu() helper.

Fixes: 3b24d854cb ("tcp/dccp: do not touch listener sk_refcnt under synflood")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Michal Kubecek <mkubecek@suse.cz>
Reported-by: Firo Yang <firo.yang@suse.com>
Reviewed-by: Michal Kubecek <mkubecek@suse.cz>
Link: https://lore.kernel.org/netdev/20191120083919.GH27852@unicorn.suse.cz/
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-01-04 19:19:13 +01:00
Hangbin Liu
82cb396aee net/dst: do not confirm neighbor for vxlan and geneve pmtu update
[ Upstream commit f081042d12 ]

When do IPv6 tunnel PMTU update and calls __ip6_rt_update_pmtu() in the end,
we should not call dst_confirm_neigh() as there is no two-way communication.

So disable the neigh confirm for vxlan and geneve pmtu update.

v5: No change.
v4: No change.
v3: Do not remove dst_confirm_neigh, but add a new bool parameter in
    dst_ops.update_pmtu to control whether we should do neighbor confirm.
    Also split the big patch to small ones for each area.
v2: Remove dst_confirm_neigh in __ip6_rt_update_pmtu.

Fixes: a93bf0ff44 ("vxlan: update skb dst pmtu on tx path")
Fixes: 52a589d51f ("geneve: update skb dst pmtu on tx path")
Reviewed-by: Guillaume Nault <gnault@redhat.com>
Tested-by: Guillaume Nault <gnault@redhat.com>
Acked-by: David Ahern <dsahern@gmail.com>
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-01-04 19:19:05 +01:00
Hangbin Liu
70f10ed21e net/dst: add new function skb_dst_update_pmtu_no_confirm
[ Upstream commit 07dc35c6e3 ]

Add a new function skb_dst_update_pmtu_no_confirm() for callers who need
update pmtu but should not do neighbor confirm.

v5: No change.
v4: No change.
v3: Do not remove dst_confirm_neigh, but add a new bool parameter in
    dst_ops.update_pmtu to control whether we should do neighbor confirm.
    Also split the big patch to small ones for each area.
v2: Remove dst_confirm_neigh in __ip6_rt_update_pmtu.

Reviewed-by: Guillaume Nault <gnault@redhat.com>
Acked-by: David Ahern <dsahern@gmail.com>
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-01-04 19:19:01 +01:00
Hangbin Liu
d49ce85cad net: add bool confirm_neigh parameter for dst_ops.update_pmtu
[ Upstream commit bd085ef678 ]

The MTU update code is supposed to be invoked in response to real
networking events that update the PMTU. In IPv6 PMTU update function
__ip6_rt_update_pmtu() we called dst_confirm_neigh() to update neighbor
confirmed time.

But for tunnel code, it will call pmtu before xmit, like:
  - tnl_update_pmtu()
    - skb_dst_update_pmtu()
      - ip6_rt_update_pmtu()
        - __ip6_rt_update_pmtu()
          - dst_confirm_neigh()

If the tunnel remote dst mac address changed and we still do the neigh
confirm, we will not be able to update neigh cache and ping6 remote
will failed.

So for this ip_tunnel_xmit() case, _EVEN_ if the MTU is changed, we
should not be invoking dst_confirm_neigh() as we have no evidence
of successful two-way communication at this point.

On the other hand it is also important to keep the neigh reachability fresh
for TCP flows, so we cannot remove this dst_confirm_neigh() call.

To fix the issue, we have to add a new bool parameter for dst_ops.update_pmtu
to choose whether we should do neigh update or not. I will add the parameter
in this patch and set all the callers to true to comply with the previous
way, and fix the tunnel code one by one on later patches.

v5: No change.
v4: No change.
v3: Do not remove dst_confirm_neigh, but add a new bool parameter in
    dst_ops.update_pmtu to control whether we should do neighbor confirm.
    Also split the big patch to small ones for each area.
v2: Remove dst_confirm_neigh in __ip6_rt_update_pmtu.

Suggested-by: David Miller <davem@davemloft.net>
Reviewed-by: Guillaume Nault <gnault@redhat.com>
Acked-by: David Ahern <dsahern@gmail.com>
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-01-04 19:18:58 +01:00
Davide Caratti
c40e059513 net/sched: add delete_empty() to filters and use it in cls_flower
[ Upstream commit a5b72a083d ]

Revert "net/sched: cls_u32: fix refcount leak in the error path of
u32_change()", and fix the u32 refcount leak in a more generic way that
preserves the semantic of rule dumping.
On tc filters that don't support lockless insertion/removal, there is no
need to guard against concurrent insertion when a removal is in progress.
Therefore, for most of them we can avoid a full walk() when deleting, and
just decrease the refcount, like it was done on older Linux kernels.
This fixes situations where walk() was wrongly detecting a non-empty
filter, like it happened with cls_u32 in the error path of change(), thus
leading to failures in the following tdc selftests:

 6aa7: (filter, u32) Add/Replace u32 with source match and invalid indev
 6658: (filter, u32) Add/Replace u32 with custom hash table and invalid handle
 74c2: (filter, u32) Add/Replace u32 filter with invalid hash table id

On cls_flower, and on (future) lockless filters, this check is necessary:
move all the check_empty() logic in a callback so that each filter
can have its own implementation. For cls_flower, it's sufficient to check
if no IDRs have been allocated.

This reverts commit 275c44aa19.

Changes since v1:
 - document the need for delete_empty() when TCF_PROTO_OPS_DOIT_UNLOCKED
   is used, thanks to Vlad Buslov
 - implement delete_empty() without doing fl_walk(), thanks to Vlad Buslov
 - squash revert and new fix in a single patch, to be nice with bisect
   tests that run tdc on u32 filter, thanks to Dave Miller

Fixes: 275c44aa19 ("net/sched: cls_u32: fix refcount leak in the error path of u32_change()")
Fixes: 6676d5e416 ("net: sched: set dedicated tcf_walker flag when tp is empty")
Suggested-by: Jamal Hadi Salim <jhs@mojatatu.com>
Suggested-by: Vlad Buslov <vladbu@mellanox.com>
Signed-off-by: Davide Caratti <dcaratti@redhat.com>
Reviewed-by: Vlad Buslov <vladbu@mellanox.com>
Tested-by: Jamal Hadi Salim <jhs@mojatatu.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-01-04 19:18:46 +01:00
Greg Kroah-Hartman
861433ef01 Merge 5.4.7 into android-5.4
Changes in 5.4.7
	af_packet: set defaule value for tmo
	fjes: fix missed check in fjes_acpi_add
	mod_devicetable: fix PHY module format
	net: dst: Force 4-byte alignment of dst_metrics
	net: gemini: Fix memory leak in gmac_setup_txqs
	net: hisilicon: Fix a BUG trigered by wrong bytes_compl
	net: nfc: nci: fix a possible sleep-in-atomic-context bug in nci_uart_tty_receive()
	net: phy: ensure that phy IDs are correctly typed
	net: qlogic: Fix error paths in ql_alloc_large_buffers()
	net-sysfs: Call dev_hold always in rx_queue_add_kobject
	net: usb: lan78xx: Fix suspend/resume PHY register access error
	nfp: flower: fix stats id allocation
	qede: Disable hardware gro when xdp prog is installed
	qede: Fix multicast mac configuration
	sctp: fix memleak on err handling of stream initialization
	sctp: fully initialize v4 addr in some functions
	selftests: forwarding: Delete IPv6 address at the end
	neighbour: remove neigh_cleanup() method
	bonding: fix bond_neigh_init()
	net: ena: fix default tx interrupt moderation interval
	net: ena: fix issues in setting interrupt moderation params in ethtool
	dpaa2-ptp: fix double free of the ptp_qoriq IRQ
	mlxsw: spectrum_router: Remove unlikely user-triggerable warning
	net: ethernet: ti: davinci_cpdma: fix warning "device driver frees DMA memory with different size"
	net: stmmac: platform: Fix MDIO init for platforms without PHY
	net: dsa: b53: Fix egress flooding settings
	NFC: nxp-nci: Fix probing without ACPI
	btrfs: don't double lock the subvol_sem for rename exchange
	btrfs: do not call synchronize_srcu() in inode_tree_del
	Btrfs: make tree checker detect checksum items with overlapping ranges
	btrfs: return error pointer from alloc_test_extent_buffer
	Btrfs: fix missing data checksums after replaying a log tree
	btrfs: send: remove WARN_ON for readonly mount
	btrfs: abort transaction after failed inode updates in create_subvol
	btrfs: skip log replay on orphaned roots
	btrfs: do not leak reloc root if we fail to read the fs root
	btrfs: handle ENOENT in btrfs_uuid_tree_iterate
	Btrfs: fix removal logic of the tree mod log that leads to use-after-free issues
	ALSA: pcm: Avoid possible info leaks from PCM stream buffers
	ALSA: hda/ca0132 - Keep power on during processing DSP response
	ALSA: hda/ca0132 - Avoid endless loop
	ALSA: hda/ca0132 - Fix work handling in delayed HP detection
	drm/vc4/vc4_hdmi: fill in connector info
	drm/virtio: switch virtio_gpu_wait_ioctl() to gem helper.
	drm: mst: Fix query_payload ack reply struct
	drm/mipi-dbi: fix a loop in debugfs code
	drm/panel: Add missing drm_panel_init() in panel drivers
	drm: exynos: exynos_hdmi: use cec_notifier_conn_(un)register
	drm: Use EOPNOTSUPP, not ENOTSUPP
	drm/amd/display: verify stream link before link test
	drm/bridge: analogix-anx78xx: silence -EPROBE_DEFER warnings
	drm/amd/display: OTC underflow fix
	iio: max31856: add missing of_node and parent references to iio_dev
	iio: light: bh1750: Resolve compiler warning and make code more readable
	drm/amdgpu/sriov: add ring_stop before ring_create in psp v11 code
	drm/amdgpu: grab the id mgr lock while accessing passid_mapping
	drm/ttm: return -EBUSY on pipelining with no_gpu_wait (v2)
	drm/amd/display: Rebuild mapped resources after pipe split
	ath10k: add cleanup in ath10k_sta_state()
	drm/amd/display: Handle virtual signal type in disable_link()
	ath10k: Check if station exists before forwarding tx airtime report
	spi: Add call to spi_slave_abort() function when spidev driver is released
	drm/meson: vclk: use the correct G12A frac max value
	staging: rtl8192u: fix multiple memory leaks on error path
	staging: rtl8188eu: fix possible null dereference
	rtlwifi: prevent memory leak in rtl_usb_probe
	libertas: fix a potential NULL pointer dereference
	Revert "pinctrl: sh-pfc: r8a77990: Fix MOD_SEL1 bit30 when using SSI_SCK2 and SSI_WS2"
	Revert "pinctrl: sh-pfc: r8a77990: Fix MOD_SEL1 bit31 when using SIM0_D"
	ath10k: fix backtrace on coredump
	IB/iser: bound protection_sg size by data_sg size
	drm/komeda: Workaround for broken FLIP_COMPLETE timestamps
	spi: gpio: prevent memory leak in spi_gpio_probe
	media: am437x-vpfe: Setting STD to current value is not an error
	media: cedrus: fill in bus_info for media device
	media: seco-cec: Add a missing 'release_region()' in an error handling path
	media: vim2m: Fix abort issue
	media: vim2m: Fix BUG_ON in vim2m_device_release()
	media: max2175: Fix build error without CONFIG_REGMAP_I2C
	media: ov6650: Fix control handler not freed on init error
	media: i2c: ov2659: fix s_stream return value
	media: ov6650: Fix crop rectangle alignment not passed back
	media: i2c: ov2659: Fix missing 720p register config
	media: ov6650: Fix stored frame format not in sync with hardware
	media: ov6650: Fix stored crop rectangle not in sync with hardware
	tools/power/cpupower: Fix initializer override in hsw_ext_cstates
	media: venus: core: Fix msm8996 frequency table
	ath10k: fix offchannel tx failure when no ath10k_mac_tx_frm_has_freq
	media: vimc: Fix gpf in rmmod path when stream is active
	drm/amd/display: Set number of pipes to 1 if the second pipe was disabled
	pinctrl: devicetree: Avoid taking direct reference to device name string
	drm/sun4i: dsi: Fix TCON DRQ set bits
	drm/amdkfd: fix a potential NULL pointer dereference (v2)
	x86/math-emu: Check __copy_from_user() result
	drm/amd/powerplay: A workaround to GPU RESET on APU
	selftests/bpf: Correct path to include msg + path
	drm/amd/display: set minimum abm backlight level
	media: venus: Fix occasionally failures to suspend
	rtw88: fix NSS of hw_cap
	drm/amd/display: fix struct init in update_bounding_box
	usb: renesas_usbhs: add suspend event support in gadget mode
	crypto: aegis128-neon - use Clang compatible cflags for ARM
	hwrng: omap3-rom - Call clk_disable_unprepare() on exit only if not idled
	regulator: max8907: Fix the usage of uninitialized variable in max8907_regulator_probe()
	tools/memory-model: Fix data race detection for unordered store and load
	media: flexcop-usb: fix NULL-ptr deref in flexcop_usb_transfer_init()
	media: cec-funcs.h: add status_req checks
	media: meson/ao-cec: move cec_notifier_cec_adap_register after hw setup
	drm/bridge: dw-hdmi: Refuse DDC/CI transfers on the internal I2C controller
	samples: pktgen: fix proc_cmd command result check logic
	block: Fix writeback throttling W=1 compiler warnings
	drm/amdkfd: Fix MQD size calculation
	MIPS: futex: Emit Loongson3 sync workarounds within asm
	mwifiex: pcie: Fix memory leak in mwifiex_pcie_init_evt_ring
	drm/drm_vblank: Change EINVAL by the correct errno
	selftests/bpf: Fix btf_dump padding test case
	libbpf: Fix struct end padding in btf_dump
	libbpf: Fix passing uninitialized bytes to setsockopt
	net/smc: increase device refcount for added link group
	team: call RCU read lock when walking the port_list
	media: cx88: Fix some error handling path in 'cx8800_initdev()'
	crypto: inside-secure - Fix a maybe-uninitialized warning
	crypto: aegis128/simd - build 32-bit ARM for v8 architecture explicitly
	misc: fastrpc: fix memory leak from miscdev->name
	ASoC: SOF: enable sync_write in hdac_bus
	media: ti-vpe: vpe: Fix Motion Vector vpdma stride
	media: ti-vpe: vpe: fix a v4l2-compliance warning about invalid pixel format
	media: ti-vpe: vpe: fix a v4l2-compliance failure about frame sequence number
	media: ti-vpe: vpe: Make sure YUYV is set as default format
	media: ti-vpe: vpe: fix a v4l2-compliance failure causing a kernel panic
	media: ti-vpe: vpe: ensure buffers are cleaned up properly in abort cases
	drm/amd/display: Properly round nominal frequency for SPD
	drm/amd/display: wait for set pipe mcp command completion
	media: ti-vpe: vpe: fix a v4l2-compliance failure about invalid sizeimage
	drm/amd/display: add new active dongle to existent w/a
	syscalls/x86: Use the correct function type in SYSCALL_DEFINE0
	drm/amd/display: Fix dongle_caps containing stale information.
	extcon: sm5502: Reset registers during initialization
	drm/amd/display: Program DWB watermarks from correct state
	x86/mm: Use the correct function type for native_set_fixmap()
	ath10k: Correct error handling of dma_map_single()
	rtw88: coex: Set 4 slot mode for A2DP
	drm/bridge: dw-hdmi: Restore audio when setting a mode
	perf test: Report failure for mmap events
	perf report: Add warning when libunwind not compiled in
	perf test: Avoid infinite loop for task exit case
	perf vendor events arm64: Fix Hisi hip08 DDRC PMU eventname
	usb: usbfs: Suppress problematic bind and unbind uevents.
	drm/amd/powerplay: avoid disabling ECC if RAS is enabled for VEGA20
	iio: adc: max1027: Reset the device at probe time
	Bluetooth: btusb: avoid unused function warning
	Bluetooth: missed cpu_to_le16 conversion in hci_init4_req
	Bluetooth: Workaround directed advertising bug in Broadcom controllers
	Bluetooth: hci_core: fix init for HCI_USER_CHANNEL
	bpf/stackmap: Fix deadlock with rq_lock in bpf_get_stack()
	x86/mce: Lower throttling MCE messages' priority to warning
	drm/amd/display: enable hostvm based on roimmu active for dcn2.1
	drm/amd/display: fix header for RN clk mgr
	drm/amdgpu: fix amdgpu trace event print string format error
	staging: iio: ad9834: add a check for devm_clk_get
	power: supply: cpcap-battery: Check voltage before orderly_poweroff
	perf tests: Disable bp_signal testing for arm64
	selftests/bpf: Make a copy of subtest name
	net: hns3: log and clear hardware error after reset complete
	RDMA/hns: Fix wrong parameters when initial mtt of srq->idx_que
	drm/gma500: fix memory disclosures due to uninitialized bytes
	ASoC: soc-pcm: fixup dpcm_prune_paths() loop continue
	rtl8xxxu: fix RTL8723BU connection failure issue after warm reboot
	RDMA/siw: Fix SQ/RQ drain logic
	ipmi: Don't allow device module unload when in use
	x86/ioapic: Prevent inconsistent state when moving an interrupt
	media: cedrus: Fix undefined shift with a SHIFT_AND_MASK_BITS macro
	media: aspeed: set hsync and vsync polarities to normal before starting mode detection
	drm/nouveau: Don't grab runtime PM refs for HPD IRQs
	media: ov6650: Fix stored frame interval not in sync with hardware
	media: ad5820: Define entity function
	media: ov5640: Make 2592x1944 mode only available at 15 fps
	media: st-mipid02: add a check for devm_gpiod_get_optional
	media: imx7-mipi-csis: Add a check for devm_regulator_get
	media: aspeed: clear garbage interrupts
	media: smiapp: Register sensor after enabling runtime PM on the device
	md: no longer compare spare disk superblock events in super_load
	staging: wilc1000: potential corruption in wilc_parse_join_bss_param()
	md/bitmap: avoid race window between md_bitmap_resize and bitmap_file_clear_bit
	drm: Don't free jobs in wait_event_interruptible()
	EDAC/amd64: Set grain per DIMM
	arm64: psci: Reduce the waiting time for cpu_psci_cpu_kill()
	drm/amd/display: setting the DIG_MODE to the correct value.
	i40e: initialize ITRN registers with correct values
	drm/amd/display: correctly populate dpp refclk in fpga
	i40e: Wrong 'Advertised FEC modes' after set FEC to AUTO
	net: phy: dp83867: enable robust auto-mdix
	drm/tegra: sor: Use correct SOR index on Tegra210
	regulator: core: Release coupled_rdevs on regulator_init_coupling() error
	ubsan, x86: Annotate and allow __ubsan_handle_shift_out_of_bounds() in uaccess regions
	spi: sprd: adi: Add missing lock protection when rebooting
	ACPI: button: Add DMI quirk for Medion Akoya E2215T
	RDMA/qedr: Fix memory leak in user qp and mr
	RDMA/hns: Fix memory leak on 'context' on error return path
	RDMA/qedr: Fix srqs xarray initialization
	RDMA/core: Set DMA parameters correctly
	staging: wilc1000: check if device is initialzied before changing vif
	gpu: host1x: Allocate gather copy for host1x
	net: dsa: LAN9303: select REGMAP when LAN9303 enable
	phy: renesas: phy-rcar-gen2: Fix the array off by one warning
	phy: qcom-usb-hs: Fix extcon double register after power cycle
	s390/time: ensure get_clock_monotonic() returns monotonic values
	s390: add error handling to perf_callchain_kernel
	s390/mm: add mm_pxd_folded() checks to pxd_free()
	net: hns3: add struct netdev_queue debug info for TX timeout
	libata: Ensure ata_port probe has completed before detach
	loop: fix no-unmap write-zeroes request behavior
	net/mlx5e: Verify that rule has at least one fwd/drop action
	pinctrl: sh-pfc: sh7734: Fix duplicate TCLK1_B
	ALSA: bebob: expand sleep just after breaking connections for protocol version 1
	iio: dln2-adc: fix iio_triggered_buffer_postenable() position
	libbpf: Fix error handling in bpf_map__reuse_fd()
	Bluetooth: Fix advertising duplicated flags
	ALSA: pcm: Fix missing check of the new non-cached buffer type
	spi: sifive: disable clk when probe fails and remove
	ASoC: SOF: imx: fix reverse CONFIG_SND_SOC_SOF_OF dependency
	pinctrl: qcom: sc7180: Add missing tile info in SDC_QDSD_PINGROUP/UFS_RESET
	pinctrl: amd: fix __iomem annotation in amd_gpio_irq_handler()
	ixgbe: protect TX timestamping from API misuse
	cpufreq: sun50i: Fix CPU speed bin detection
	media: rcar_drif: fix a memory disclosure
	media: v4l2-core: fix touch support in v4l_g_fmt
	nvme: introduce "Command Aborted By host" status code
	media: staging/imx: Use a shorter name for driver
	nvmem: imx-ocotp: reset error status on probe
	nvmem: core: fix nvmem_cell_write inline function
	ASoC: SOF: topology: set trigger order for FE DAI link
	media: vivid: media_device_cleanup was called too early
	spi: dw: Fix Designware SPI loopback
	bnx2x: Fix PF-VF communication over multi-cos queues.
	spi: img-spfi: fix potential double release
	ALSA: timer: Limit max amount of slave instances
	RDMA/core: Fix return code when modify_port isn't supported
	drm: msm: a6xx: fix debug bus register configuration
	rtlwifi: fix memory leak in rtl92c_set_fw_rsvdpagepkt()
	perf probe: Fix to find range-only function instance
	perf cs-etm: Fix definition of macro TO_CS_QUEUE_NR
	perf probe: Fix to list probe event with correct line number
	perf jevents: Fix resource leak in process_mapfile() and main()
	perf probe: Walk function lines in lexical blocks
	perf probe: Fix to probe an inline function which has no entry pc
	perf probe: Fix to show ranges of variables in functions without entry_pc
	perf probe: Fix to show inlined function callsite without entry_pc
	libsubcmd: Use -O0 with DEBUG=1
	perf probe: Fix to probe a function which has no entry pc
	perf tools: Fix cross compile for ARM64
	perf tools: Splice events onto evlist even on error
	drm/amdgpu: disallow direct upload save restore list from gfx driver
	drm/amd/powerplay: fix struct init in renoir_print_clk_levels
	drm/amdgpu: fix potential double drop fence reference
	ice: Check for null pointer dereference when setting rings
	xen/gntdev: Use select for DMA_SHARED_BUFFER
	perf parse: If pmu configuration fails free terms
	perf probe: Skip overlapped location on searching variables
	net: avoid potential false sharing in neighbor related code
	perf probe: Return a better scope DIE if there is no best scope
	perf probe: Fix to show calling lines of inlined functions
	perf probe: Skip end-of-sequence and non statement lines
	perf probe: Filter out instances except for inlined subroutine and subprogram
	libbpf: Fix negative FD close() in xsk_setup_xdp_prog()
	s390/bpf: Use kvcalloc for addrs array
	cgroup: freezer: don't change task and cgroups status unnecessarily
	selftests: proc: Make va_max 1MB
	drm/amdgpu: Avoid accidental thread reactivation.
	media: exynos4-is: fix wrong mdev and v4l2 dev order in error path
	ath10k: fix get invalid tx rate for Mesh metric
	fsi: core: Fix small accesses and unaligned offsets via sysfs
	selftests: net: Fix printf format warnings on arm
	media: pvrusb2: Fix oops on tear-down when radio support is not present
	soundwire: intel: fix PDI/stream mapping for Bulk
	crypto: atmel - Fix authenc support when it is set to m
	ice: delay less
	media: si470x-i2c: add missed operations in remove
	media: cedrus: Use helpers to access capture queue
	media: v4l2-ctrl: Lock main_hdl on operations of requests_queued.
	iio: cros_ec_baro: set info_mask_shared_by_all_available field
	EDAC/ghes: Fix grain calculation
	media: vicodec: media_device_cleanup was called too early
	media: vim2m: media_device_cleanup was called too early
	spi: pxa2xx: Add missed security checks
	ASoC: rt5677: Mark reg RT5677_PWR_ANLG2 as volatile
	iio: dac: ad5446: Add support for new AD5600 DAC
	bpf, testing: Workaround a verifier failure for test_progs
	ASoC: Intel: kbl_rt5663_rt5514_max98927: Add dmic format constraint
	net: dsa: sja1105: Disallow management xmit during switch reset
	r8169: respect EEE user setting when restarting network
	s390/disassembler: don't hide instruction addresses
	net: ethernet: ti: Add dependency for TI_DAVINCI_EMAC
	nvme: Discard workaround for non-conformant devices
	parport: load lowlevel driver if ports not found
	bcache: fix static checker warning in bcache_device_free()
	cpufreq: Register drivers only after CPU devices have been registered
	qtnfmac: fix debugfs support for multiple cards
	qtnfmac: fix invalid channel information output
	x86/crash: Add a forward declaration of struct kimage
	qtnfmac: fix using skb after free
	RDMA/efa: Clear the admin command buffer prior to its submission
	tracing: use kvcalloc for tgid_map array allocation
	MIPS: ralink: enable PCI support only if driver for mt7621 SoC is selected
	tracing/kprobe: Check whether the non-suffixed symbol is notrace
	bcache: fix deadlock in bcache_allocator
	iwlwifi: mvm: fix unaligned read of rx_pkt_status
	ASoC: wm8904: fix regcache handling
	regulator: core: Let boot-on regulators be powered off
	spi: tegra20-slink: add missed clk_unprepare
	tun: fix data-race in gro_normal_list()
	xhci-pci: Allow host runtime PM as default also for Intel Ice Lake xHCI
	crypto: virtio - deal with unsupported input sizes
	mmc: tmio: Add MMC_CAP_ERASE to allow erase/discard/trim requests
	btrfs: don't prematurely free work in end_workqueue_fn()
	btrfs: don't prematurely free work in run_ordered_work()
	sched/uclamp: Fix overzealous type replacement
	ASoC: wm2200: add missed operations in remove and probe failure
	spi: st-ssc4: add missed pm_runtime_disable
	ASoC: wm5100: add missed pm_runtime_disable
	perf/core: Fix the mlock accounting, again
	selftests, bpf: Fix test_tc_tunnel hanging
	selftests, bpf: Workaround an alu32 sub-register spilling issue
	bnxt_en: Return proper error code for non-existent NVM variable
	net: phy: avoid matching all-ones clause 45 PHY IDs
	firmware_loader: Fix labels with comma for builtin firmware
	ASoC: Intel: bytcr_rt5640: Update quirk for Acer Switch 10 SW5-012 2-in-1
	x86/insn: Add some Intel instructions to the opcode map
	net-af_xdp: Use correct number of channels from ethtool
	brcmfmac: remove monitor interface when detaching
	perf session: Fix decompression of PERF_RECORD_COMPRESSED records
	perf probe: Fix to show function entry line as probe-able
	s390/crypto: Fix unsigned variable compared with zero
	s390/kasan: support memcpy_real with TRACE_IRQFLAGS
	bnxt_en: Improve RX buffer error handling.
	iwlwifi: check kasprintf() return value
	fbtft: Make sure string is NULL terminated
	ASoC: soc-pcm: check symmetry before hw_params
	net: ethernet: ti: ale: clean ale tbl on init and intf restart
	mt76: fix possible out-of-bound access in mt7615_fill_txs/mt7603_fill_txs
	s390/cpumf: Adjust registration of s390 PMU device drivers
	crypto: sun4i-ss - Fix 64-bit size_t warnings
	crypto: sun4i-ss - Fix 64-bit size_t warnings on sun4i-ss-hash.c
	mac80211: consider QoS Null frames for STA_NULLFUNC_ACKED
	crypto: vmx - Avoid weird build failures
	libtraceevent: Fix memory leakage in copy_filter_type
	mips: fix build when "48 bits virtual memory" is enabled
	drm/amdgpu: fix bad DMA from INTERRUPT_CNTL2
	ice: Only disable VF state when freeing each VF resources
	ice: Fix setting coalesce to handle DCB configuration
	net: phy: initialise phydev speed and duplex sanely
	tools, bpf: Fix build for 'make -s tools/bpf O=<dir>'
	RDMA/bnxt_re: Fix missing le16_to_cpu
	RDMA/bnxt_re: Fix stat push into dma buffer on gen p5 devices
	bpf: Provide better register bounds after jmp32 instructions
	RDMA/bnxt_re: Fix chip number validation Broadcom's Gen P5 series
	ibmvnic: Fix completion structure initialization
	net: wireless: intel: iwlwifi: fix GRO_NORMAL packet stalling
	MIPS: futex: Restore \n after sync instructions
	btrfs: don't prematurely free work in reada_start_machine_worker()
	btrfs: don't prematurely free work in scrub_missing_raid56_worker()
	Revert "mmc: sdhci: Fix incorrect switch to HS mode"
	mmc: mediatek: fix CMD_TA to 2 for MT8173 HS200/HS400 mode
	tpm_tis: reserve chip for duration of tpm_tis_core_init
	tpm: fix invalid locking in NONBLOCKING mode
	iommu: fix KASAN use-after-free in iommu_insert_resv_region
	iommu: set group default domain before creating direct mappings
	iommu/vt-d: Fix dmar pte read access not set error
	iommu/vt-d: Set ISA bridge reserved region as relaxable
	iommu/vt-d: Allocate reserved region for ISA with correct permission
	can: xilinx_can: Fix missing Rx can packets on CANFD2.0
	can: m_can: tcan4x5x: add required delay after reset
	can: j1939: j1939_sk_bind(): take priv after lock is held
	can: flexcan: fix possible deadlock and out-of-order reception after wakeup
	can: flexcan: poll MCR_LPM_ACK instead of GPR ACK for stop mode acknowledgment
	can: kvaser_usb: kvaser_usb_leaf: Fix some info-leaks to USB devices
	selftests: net: tls: remove recv_rcvbuf test
	spi: dw: Correct handling of native chipselect
	spi: cadence: Correct handling of native chipselect
	usb: xhci: Fix build warning seen with CONFIG_PM=n
	drm/amdgpu: fix uninitialized variable pasid_mapping_needed
	ath10k: Revert "ath10k: add cleanup in ath10k_sta_state()"
	RDMA/siw: Fix post_recv QP state locking
	md: avoid invalid memory access for array sb->dev_roles
	s390/ftrace: fix endless recursion in function_graph tracer
	ARM: dts: Fix vcsi regulator to be always-on for droid4 to prevent hangs
	can: flexcan: add low power enter/exit acknowledgment helper
	usbip: Fix receive error in vhci-hcd when using scatter-gather
	usbip: Fix error path of vhci_recv_ret_submit()
	spi: fsl: don't map irq during probe
	spi: fsl: use platform_get_irq() instead of of_irq_to_resource()
	efi/memreserve: Register reservations as 'reserved' in /proc/iomem
	cpufreq: Avoid leaving stale IRQ work items during CPU offline
	KEYS: asymmetric: return ENOMEM if akcipher_request_alloc() fails
	mm: vmscan: protect shrinker idr replace with CONFIG_MEMCG
	USB: EHCI: Do not return -EPIPE when hub is disconnected
	intel_th: pci: Add Comet Lake PCH-V support
	intel_th: pci: Add Elkhart Lake SOC support
	intel_th: Fix freeing IRQs
	intel_th: msu: Fix window switching without windows
	platform/x86: hp-wmi: Make buffer for HPWMI_FEATURE2_QUERY 128 bytes
	staging: comedi: gsc_hpdi: check dma_alloc_coherent() return value
	tty/serial: atmel: fix out of range clock divider handling
	serial: sprd: Add clearing break interrupt operation
	pinctrl: baytrail: Really serialize all register accesses
	clk: imx: clk-imx7ulp: Add missing sentinel of ulp_div_table
	clk: imx: clk-composite-8m: add lock to gate/mux
	clk: imx: pll14xx: fix clk_pll14xx_wait_lock
	ext4: fix ext4_empty_dir() for directories with holes
	ext4: check for directory entries too close to block end
	ext4: unlock on error in ext4_expand_extra_isize()
	ext4: validate the debug_want_extra_isize mount option at parse time
	iocost: over-budget forced IOs should schedule async delay
	KVM: PPC: Book3S HV: Fix regression on big endian hosts
	kvm: x86: Host feature SSBD doesn't imply guest feature SPEC_CTRL_SSBD
	kvm: x86: Host feature SSBD doesn't imply guest feature AMD_SSBD
	KVM: arm/arm64: Properly handle faulting of device mappings
	KVM: arm64: Ensure 'params' is initialised when looking up sys register
	x86/intel: Disable HPET on Intel Coffee Lake H platforms
	x86/MCE/AMD: Do not use rdmsr_safe_on_cpu() in smca_configure()
	x86/MCE/AMD: Allow Reserved types to be overwritten in smca_banks[]
	x86/mce: Fix possibly incorrect severity calculation on AMD
	powerpc/vcpu: Assume dedicated processors as non-preempt
	powerpc/irq: fix stack overflow verification
	ocxl: Fix concurrent AFU open and device removal
	mmc: sdhci-msm: Correct the offset and value for DDR_CONFIG register
	mmc: sdhci-of-esdhc: Revert "mmc: sdhci-of-esdhc: add erratum A-009204 support"
	mmc: sdhci: Update the tuning failed messages to pr_debug level
	mmc: sdhci-of-esdhc: fix P2020 errata handling
	mmc: sdhci: Workaround broken command queuing on Intel GLK
	mmc: sdhci: Add a quirk for broken command queuing
	nbd: fix shutdown and recv work deadlock v2
	iwlwifi: pcie: move power gating workaround earlier in the flow
	Linux 5.4.7

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I3585238149235bf73bb453e25861d9a6b9193dfa
2019-12-31 17:56:13 +01:00
Eric Dumazet
074b5c1221 net: avoid potential false sharing in neighbor related code
[ Upstream commit 25c7a6d1f9 ]

There are common instances of the following construct :

	if (n->confirmed != now)
		n->confirmed = now;

A C compiler could legally remove the conditional.

Use READ_ONCE()/WRITE_ONCE() to avoid this problem.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-12-31 16:45:03 +01:00
Eric Dumazet
a073350c5f neighbour: remove neigh_cleanup() method
[ Upstream commit f394722fb0 ]

neigh_cleanup() has not been used for seven years, and was a wrong design.

Messing with shared pointer in bond_neigh_init() without proper
memory barriers would at least trigger syzbot complains eventually.

It is time to remove this stuff.

Fixes: b63b70d877 ("IPoIB: Use a private hash table for path lookup in xmit path")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-12-31 16:41:37 +01:00
Geert Uytterhoeven
f0465803fa net: dst: Force 4-byte alignment of dst_metrics
[ Upstream commit 258a980d1e ]

When storing a pointer to a dst_metrics structure in dst_entry._metrics,
two flags are added in the least significant bits of the pointer value.
Hence this assumes all pointers to dst_metrics structures have at least
4-byte alignment.

However, on m68k, the minimum alignment of 32-bit values is 2 bytes, not
4 bytes.  Hence in some kernel builds, dst_default_metrics may be only
2-byte aligned, leading to obscure boot warnings like:

    WARNING: CPU: 0 PID: 7 at lib/refcount.c:28 refcount_warn_saturate+0x44/0x9a
    refcount_t: underflow; use-after-free.
    Modules linked in:
    CPU: 0 PID: 7 Comm: ksoftirqd/0 Tainted: G        W         5.5.0-rc2-atari-01448-g114a1a1038af891d-dirty #261
    Stack from 10835e6c:
	    10835e6c 0038134f 00023fa6 00394b0f 0000001c 00000009 00321560 00023fea
	    00394b0f 0000001c 001a70f8 00000009 00000000 10835eb4 00000001 00000000
	    04208040 0000000a 00394b4a 10835ed4 00043aa8 001a70f8 00394b0f 0000001c
	    00000009 00394b4a 0026aba8 003215a4 00000003 00000000 0026d5a8 00000001
	    003215a4 003a4361 003238d6 000001f0 00000000 003215a4 10aa3b00 00025e84
	    003ddb00 10834000 002416a8 10aa3b00 00000000 00000080 000aa038 0004854a
    Call Trace: [<00023fa6>] __warn+0xb2/0xb4
     [<00023fea>] warn_slowpath_fmt+0x42/0x64
     [<001a70f8>] refcount_warn_saturate+0x44/0x9a
     [<00043aa8>] printk+0x0/0x18
     [<001a70f8>] refcount_warn_saturate+0x44/0x9a
     [<0026aba8>] refcount_sub_and_test.constprop.73+0x38/0x3e
     [<0026d5a8>] ipv4_dst_destroy+0x5e/0x7e
     [<00025e84>] __local_bh_enable_ip+0x0/0x8e
     [<002416a8>] dst_destroy+0x40/0xae

Fix this by forcing 4-byte alignment of all dst_metrics structures.

Fixes: e5fd387ad5 ("ipv6: do not overwrite inetpeer metrics prematurely")
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-12-31 16:41:17 +01:00
Greg Kroah-Hartman
09cdc723de Merge 5.4.5 into android-5.4
Changes in 5.4.5
	inet: protect against too small mtu values.
	mqprio: Fix out-of-bounds access in mqprio_dump
	net: bridge: deny dev_set_mac_address() when unregistering
	net: dsa: fix flow dissection on Tx path
	net: ethernet: ti: cpsw: fix extra rx interrupt
	net: sched: fix dump qlen for sch_mq/sch_mqprio with NOLOCK subqueues
	net_sched: validate TCA_KIND attribute in tc_chain_tmplt_add()
	net: thunderx: start phy before starting autonegotiation
	net/tls: Fix return values to avoid ENOTSUPP
	openvswitch: support asymmetric conntrack
	tcp: md5: fix potential overestimation of TCP option space
	tipc: fix ordering of tipc module init and exit routine
	net/mlx5e: Query global pause state before setting prio2buffer
	net: ipv6: add net argument to ip6_dst_lookup_flow
	net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup
	tcp: fix rejected syncookies due to stale timestamps
	tcp: tighten acceptance of ACKs not matching a child socket
	tcp: Protect accesses to .ts_recent_stamp with {READ,WRITE}_ONCE()
	net: core: rename indirect block ingress cb function
	net: sched: allow indirect blocks to bind to clsact in TC
	cls_flower: Fix the behavior using port ranges with hw-offload
	gre: refetch erspan header from skb->data after pskb_may_pull()
	Fixed updating of ethertype in function skb_mpls_pop
	hsr: fix a NULL pointer dereference in hsr_dev_xmit()
	net: Fixed updating of ethertype in skb_mpls_push()
	net/mlx5e: Fix TXQ indices to be sequential
	act_ct: support asymmetric conntrack
	net/mlx5e: Fix SFF 8472 eeprom length
	net/mlx5e: Fix freeing flow with kfree() and not kvfree()
	net/mlx5e: Fix translation of link mode into speed
	net/mlx5e: ethtool, Fix analysis of speed setting
	page_pool: do not release pool until inflight == 0.
	xdp: obtain the mem_id mutex before trying to remove an entry.
	ionic: keep users rss hash across lif reset
	net: mscc: ocelot: unregister the PTP clock on deinit
	r8169: add missing RX enabling for WoL on RTL8125
	Linux 5.4.5

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I65207949c27553e0bdc8d10740c9f11d97ff8ebf
2019-12-18 16:54:08 +01:00
Jonathan Lemon
05f646cb21 page_pool: do not release pool until inflight == 0.
[ Upstream commit c3f812cea0 ]

The page pool keeps track of the number of pages in flight, and
it isn't safe to remove the pool until all pages are returned.

Disallow removing the pool until all pages are back, so the pool
is always available for page producers.

Make the page pool responsible for its own delayed destruction
instead of relying on XDP, so the page pool can be used without
the xdp memory model.

When all pages are returned, free the pool and notify xdp if the
pool is registered with the xdp memory system.  Have the callback
perform a table walk since some drivers (cpsw) may share the pool
among multiple xdp_rxq_info.

Note that the increment of pages_state_release_cnt may result in
inflight == 0, resulting in the pool being released.

Fixes: d956a048cd ("xdp: force mem allocator removal and periodic warning")
Signed-off-by: Jonathan Lemon <jonathan.lemon@gmail.com>
Acked-by: Jesper Dangaard Brouer <brouer@redhat.com>
Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-12-18 16:09:07 +01:00
Yoshiki Komachi
71bc12b1fb cls_flower: Fix the behavior using port ranges with hw-offload
[ Upstream commit 8ffb055bea ]

The recent commit 5c72299fba ("net: sched: cls_flower: Classify
packets using port ranges") had added filtering based on port ranges
to tc flower. However the commit missed necessary changes in hw-offload
code, so the feature gave rise to generating incorrect offloaded flow
keys in NIC.

One more detailed example is below:

$ tc qdisc add dev eth0 ingress
$ tc filter add dev eth0 ingress protocol ip flower ip_proto tcp \
  dst_port 100-200 action drop

With the setup above, an exact match filter with dst_port == 0 will be
installed in NIC by hw-offload. IOW, the NIC will have a rule which is
equivalent to the following one.

$ tc qdisc add dev eth0 ingress
$ tc filter add dev eth0 ingress protocol ip flower ip_proto tcp \
  dst_port 0 action drop

The behavior was caused by the flow dissector which extracts packet
data into the flow key in the tc flower. More specifically, regardless
of exact match or specified port ranges, fl_init_dissector() set the
FLOW_DISSECTOR_KEY_PORTS flag in struct flow_dissector to extract port
numbers from skb in skb_flow_dissect() called by fl_classify(). Note
that device drivers received the same struct flow_dissector object as
used in skb_flow_dissect(). Thus, offloaded drivers could not identify
which of these is used because the FLOW_DISSECTOR_KEY_PORTS flag was
set to struct flow_dissector in either case.

This patch adds the new FLOW_DISSECTOR_KEY_PORTS_RANGE flag and the new
tp_range field in struct fl_flow_key to recognize which filters are applied
to offloaded drivers. At this point, when filters based on port ranges
passed to drivers, drivers return the EOPNOTSUPP error because they do
not support the feature (the newly created FLOW_DISSECTOR_KEY_PORTS_RANGE
flag).

Fixes: 5c72299fba ("net: sched: cls_flower: Classify packets using port ranges")
Signed-off-by: Yoshiki Komachi <komachi.yoshiki@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-12-18 16:08:49 +01:00
John Hurley
1b511a9d2c net: core: rename indirect block ingress cb function
[ Upstream commit dbad340889 ]

With indirect blocks, a driver can register for callbacks from a device
that is does not 'own', for example, a tunnel device. When registering to
or unregistering from a new device, a callback is triggered to generate
a bind/unbind event. This, in turn, allows the driver to receive any
existing rules or to properly clean up installed rules.

When first added, it was assumed that all indirect block registrations
would be for ingress offloads. However, the NFP driver can, in some
instances, support clsact qdisc binds for egress offload.

Change the name of the indirect block callback command in flow_offload to
remove the 'ingress' identifier from it. While this does not change
functionality, a follow up patch will implement a more more generic
callback than just those currently just supporting ingress offload.

Fixes: 4d12ba4278 ("nfp: flower: allow offloading of matches on 'internal' ports")
Signed-off-by: John Hurley <john.hurley@netronome.com>
Acked-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-12-18 16:08:47 +01:00
Guillaume Nault
ee0dc0c3f3 tcp: Protect accesses to .ts_recent_stamp with {READ,WRITE}_ONCE()
[ Upstream commit 721c8dafad ]

Syncookies borrow the ->rx_opt.ts_recent_stamp field to store the
timestamp of the last synflood. Protect them with READ_ONCE() and
WRITE_ONCE() since reads and writes aren't serialised.

Use of .rx_opt.ts_recent_stamp for storing the synflood timestamp was
introduced by a0f82f64e2 ("syncookies: remove last_synq_overflow from
struct tcp_sock"). But unprotected accesses were already there when
timestamp was stored in .last_synq_overflow.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Guillaume Nault <gnault@redhat.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-12-18 16:08:45 +01:00
Guillaume Nault
e70ee16481 tcp: tighten acceptance of ACKs not matching a child socket
[ Upstream commit cb44a08f86 ]

When no synflood occurs, the synflood timestamp isn't updated.
Therefore it can be so old that time_after32() can consider it to be
in the future.

That's a problem for tcp_synq_no_recent_overflow() as it may report
that a recent overflow occurred while, in fact, it's just that jiffies
has grown past 'last_overflow' + TCP_SYNCOOKIE_VALID + 2^31.

Spurious detection of recent overflows lead to extra syncookie
verification in cookie_v[46]_check(). At that point, the verification
should fail and the packet dropped. But we should have dropped the
packet earlier as we didn't even send a syncookie.

Let's refine tcp_synq_no_recent_overflow() to report a recent overflow
only if jiffies is within the
[last_overflow, last_overflow + TCP_SYNCOOKIE_VALID] interval. This
way, no spurious recent overflow is reported when jiffies wraps and
'last_overflow' becomes in the future from the point of view of
time_after32().

However, if jiffies wraps and enters the
[last_overflow, last_overflow + TCP_SYNCOOKIE_VALID] interval (with
'last_overflow' being a stale synflood timestamp), then
tcp_synq_no_recent_overflow() still erroneously reports an
overflow. In such cases, we have to rely on syncookie verification
to drop the packet. We unfortunately have no way to differentiate
between a fresh and a stale syncookie timestamp.

In practice, using last_overflow as lower bound is problematic.
If the synflood timestamp is concurrently updated between the time
we read jiffies and the moment we store the timestamp in
'last_overflow', then 'now' becomes smaller than 'last_overflow' and
tcp_synq_no_recent_overflow() returns true, potentially dropping a
valid syncookie.

Reading jiffies after loading the timestamp could fix the problem,
but that'd require a memory barrier. Let's just accommodate for
potential timestamp growth instead and extend the interval using
'last_overflow - HZ' as lower bound.

Signed-off-by: Guillaume Nault <gnault@redhat.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-12-18 16:08:43 +01:00
Guillaume Nault
9afe690185 tcp: fix rejected syncookies due to stale timestamps
[ Upstream commit 04d26e7b15 ]

If no synflood happens for a long enough period of time, then the
synflood timestamp isn't refreshed and jiffies can advance so much
that time_after32() can't accurately compare them any more.

Therefore, we can end up in a situation where time_after32(now,
last_overflow + HZ) returns false, just because these two values are
too far apart. In that case, the synflood timestamp isn't updated as
it should be, which can trick tcp_synq_no_recent_overflow() into
rejecting valid syncookies.

For example, let's consider the following scenario on a system
with HZ=1000:

  * The synflood timestamp is 0, either because that's the timestamp
    of the last synflood or, more commonly, because we're working with
    a freshly created socket.

  * We receive a new SYN, which triggers synflood protection. Let's say
    that this happens when jiffies == 2147484649 (that is,
    'synflood timestamp' + HZ + 2^31 + 1).

  * Then tcp_synq_overflow() doesn't update the synflood timestamp,
    because time_after32(2147484649, 1000) returns false.
    With:
      - 2147484649: the value of jiffies, aka. 'now'.
      - 1000: the value of 'last_overflow' + HZ.

  * A bit later, we receive the ACK completing the 3WHS. But
    cookie_v[46]_check() rejects it because tcp_synq_no_recent_overflow()
    says that we're not under synflood. That's because
    time_after32(2147484649, 120000) returns false.
    With:
      - 2147484649: the value of jiffies, aka. 'now'.
      - 120000: the value of 'last_overflow' + TCP_SYNCOOKIE_VALID.

    Of course, in reality jiffies would have increased a bit, but this
    condition will last for the next 119 seconds, which is far enough
    to accommodate for jiffie's growth.

Fix this by updating the overflow timestamp whenever jiffies isn't
within the [last_overflow, last_overflow + HZ] range. That shouldn't
have any performance impact since the update still happens at most once
per second.

Now we're guaranteed to have fresh timestamps while under synflood, so
tcp_synq_no_recent_overflow() can safely use it with time_after32() in
such situations.

Stale timestamps can still make tcp_synq_no_recent_overflow() return
the wrong verdict when not under synflood. This will be handled in the
next patch.

For 64 bits architectures, the problem was introduced with the
conversion of ->tw_ts_recent_stamp to 32 bits integer by commit
cca9bab1b7 ("tcp: use monotonic timestamps for PAWS").
The problem has always been there on 32 bits architectures.

Fixes: cca9bab1b7 ("tcp: use monotonic timestamps for PAWS")
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Guillaume Nault <gnault@redhat.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-12-18 16:08:43 +01:00
Sabrina Dubroca
48d58ae9e8 net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup
[ Upstream commit 6c8991f415 ]

ipv6_stub uses the ip6_dst_lookup function to allow other modules to
perform IPv6 lookups. However, this function skips the XFRM layer
entirely.

All users of ipv6_stub->ip6_dst_lookup use ip_route_output_flow (via the
ip_route_output_key and ip_route_output helpers) for their IPv4 lookups,
which calls xfrm_lookup_route(). This patch fixes this inconsistent
behavior by switching the stub to ip6_dst_lookup_flow, which also calls
xfrm_lookup_route().

This requires some changes in all the callers, as these two functions
take different arguments and have different return types.

Fixes: 5f81bd2e5d ("ipv6: export a stub for IPv6 symbols used by vxlan")
Reported-by: Xiumei Mu <xmu@redhat.com>
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-12-18 16:08:42 +01:00
Sabrina Dubroca
8cadbd146a net: ipv6: add net argument to ip6_dst_lookup_flow
[ Upstream commit c4e85f73af ]

This will be used in the conversion of ipv6_stub to ip6_dst_lookup_flow,
as some modules currently pass a net argument without a socket to
ip6_dst_lookup. This is equivalent to commit 343d60aada ("ipv6: change
ipv6_stub_impl.ipv6_dst_lookup to take net argument").

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-12-18 16:08:40 +01:00
Eric Dumazet
20f72aae9b inet: protect against too small mtu values.
[ Upstream commit 501a90c945 ]

syzbot was once again able to crash a host by setting a very small mtu
on loopback device.

Let's make inetdev_valid_mtu() available in include/net/ip.h,
and use it in ip_setup_cork(), so that we protect both ip_append_page()
and __ip_append_data()

Also add a READ_ONCE() when the device mtu is read.

Pairs this lockless read with one WRITE_ONCE() in __dev_set_mtu(),
even if other code paths might write over this field.

Add a big comment in include/linux/netdevice.h about dev->mtu
needing READ_ONCE()/WRITE_ONCE() annotations.

Hopefully we will add the missing ones in followup patches.

[1]

refcount_t: saturated; leaking memory.
WARNING: CPU: 0 PID: 9464 at lib/refcount.c:22 refcount_warn_saturate+0x138/0x1f0 lib/refcount.c:22
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 9464 Comm: syz-executor850 Not tainted 5.4.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x197/0x210 lib/dump_stack.c:118
 panic+0x2e3/0x75c kernel/panic.c:221
 __warn.cold+0x2f/0x3e kernel/panic.c:582
 report_bug+0x289/0x300 lib/bug.c:195
 fixup_bug arch/x86/kernel/traps.c:174 [inline]
 fixup_bug arch/x86/kernel/traps.c:169 [inline]
 do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:267
 do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:286
 invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1027
RIP: 0010:refcount_warn_saturate+0x138/0x1f0 lib/refcount.c:22
Code: 06 31 ff 89 de e8 c8 f5 e6 fd 84 db 0f 85 6f ff ff ff e8 7b f4 e6 fd 48 c7 c7 e0 71 4f 88 c6 05 56 a6 a4 06 01 e8 c7 a8 b7 fd <0f> 0b e9 50 ff ff ff e8 5c f4 e6 fd 0f b6 1d 3d a6 a4 06 31 ff 89
RSP: 0018:ffff88809689f550 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff815e4336 RDI: ffffed1012d13e9c
RBP: ffff88809689f560 R08: ffff88809c50a3c0 R09: fffffbfff15d31b1
R10: fffffbfff15d31b0 R11: ffffffff8ae98d87 R12: 0000000000000001
R13: 0000000000040100 R14: ffff888099041104 R15: ffff888218d96e40
 refcount_add include/linux/refcount.h:193 [inline]
 skb_set_owner_w+0x2b6/0x410 net/core/sock.c:1999
 sock_wmalloc+0xf1/0x120 net/core/sock.c:2096
 ip_append_page+0x7ef/0x1190 net/ipv4/ip_output.c:1383
 udp_sendpage+0x1c7/0x480 net/ipv4/udp.c:1276
 inet_sendpage+0xdb/0x150 net/ipv4/af_inet.c:821
 kernel_sendpage+0x92/0xf0 net/socket.c:3794
 sock_sendpage+0x8b/0xc0 net/socket.c:936
 pipe_to_sendpage+0x2da/0x3c0 fs/splice.c:458
 splice_from_pipe_feed fs/splice.c:512 [inline]
 __splice_from_pipe+0x3ee/0x7c0 fs/splice.c:636
 splice_from_pipe+0x108/0x170 fs/splice.c:671
 generic_splice_sendpage+0x3c/0x50 fs/splice.c:842
 do_splice_from fs/splice.c:861 [inline]
 direct_splice_actor+0x123/0x190 fs/splice.c:1035
 splice_direct_to_actor+0x3b4/0xa30 fs/splice.c:990
 do_splice_direct+0x1da/0x2a0 fs/splice.c:1078
 do_sendfile+0x597/0xd00 fs/read_write.c:1464
 __do_sys_sendfile64 fs/read_write.c:1525 [inline]
 __se_sys_sendfile64 fs/read_write.c:1511 [inline]
 __x64_sys_sendfile64+0x1dd/0x220 fs/read_write.c:1511
 do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x441409
Code: e8 ac e8 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb 08 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fffb64c4f78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441409
RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000005
RBP: 0000000000073b8a R08: 0000000000000010 R09: 0000000000000010
R10: 0000000000010001 R11: 0000000000000246 R12: 0000000000402180
R13: 0000000000402210 R14: 0000000000000000 R15: 0000000000000000
Kernel Offset: disabled
Rebooting in 86400 seconds..

Fixes: 1470ddf7f8 ("inet: Remove explicit write references to sk/inet in ip_append_data")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-12-18 16:08:17 +01:00
Maciej Żenczykowski
05665fed98 BACKPORT: FROMLIST: net: introduce ip_local_unbindable_ports sysctl
and associated inet_is_local_unbindable_port() helper function:
use it to make explicitly binding to an unbindable port return
-EPERM 'Operation not permitted'.

Autobind doesn't honour this new sysctl since:
  (a) you can simply set both if that's the behaviour you desire
  (b) there could be a use for preventing explicit while allowing auto
  (c) it's faster in the relatively critical path of doing port selection
      during connect() to only check one bitmap instead of both

Various ports may have special use cases which are not suitable for
use by general userspace applications. Currently, ports specified in
ip_local_reserved_ports sysctl will not be returned only in case of
automatic port assignment, but nothing prevents you from explicitly
binding to them - even from an entirely unprivileged process.

In certain cases it is desirable to prevent the host from assigning the
ports even in case of explicit binds, even from superuser processes.

Example use cases might be:
 - a port being stolen by the nic for remote serial console, remote
   power management or some other sort of debugging functionality
   (crash collection, gdb, direct access to some other microcontroller
   on the nic or motherboard, remote management of the nic itself).
 - a transparent proxy where packets are being redirected: in case
   a socket matches this connection, packets from this application
   would be incorrectly sent to one of the endpoints.

Initially I wanted to solve this problem via the simple one line:

static inline bool inet_port_requires_bind_service(struct net *net, unsigned short port) {
-       return port < net->ipv4.sysctl_ip_prot_sock;
+       return port < net->ipv4.sysctl_ip_prot_sock || inet_is_local_reserved_port(net, port);
}

However, this doesn't work for two reasons:
  (a) it changes userspace visible behaviour of the existing local
      reserved ports sysctl, and there appears to be enough documentation
      on the internet talking about setting it to make this a bad idea
  (b) it doesn't prevent privileged apps from using these ports,
      CAP_BIND_SERVICE is relatively likely to be available to, for example,
      a recursive DNS server so it can listed on port 53, which also needs
      to do src port randomization for outgoing queries due to security
      reasons (and it thus does manual port binding).

If we *know* that certain ports are simply unusable, then it's better
nothing even gets the opportunity to try to use them.  This way we at
least get a quick failure, instead of some sort of timeout (or possibly
even corruption of the data stream of the non-kernel based use case).

Test:
  vm:~# cat /proc/sys/net/ipv4/ip_local_unbindable_ports

  vm:~# python -c 'import socket; s = socket.socket(socket.AF_INET6, socket.SOCK_STREAM, 0); s.bind(("::", 3967))'
  vm:~# python -c 'import socket; s = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM, 0); s.bind(("::", 3967))'
  vm:~# echo 3967 > /proc/sys/net/ipv4/ip_local_unbindable_ports
  vm:~# cat /proc/sys/net/ipv4/ip_local_unbindable_ports
  3967
  vm:~# python -c 'import socket; s = socket.socket(socket.AF_INET6, socket.SOCK_STREAM, 0); s.bind(("::", 3967))'
  socket.error: (1, 'Operation not permitted')
  vm:~# python -c 'import socket; s = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM, 0); s.bind(("::", 3967))'
  socket.error: (1, 'Operation not permitted')

Cc: Sean Tranchetti <stranche@codeaurora.org>
Cc: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Linux SCTP <linux-sctp@vger.kernel.org>
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Bug: 140404597
Link: https://patchwork.ozlabs.org/patch/1206704/
Change-Id: Ie96207bea90ae1345adf7b45724d0caf4d6e52c2
Signed-off-by: Todd Kjos <tkjos@google.com>
2019-12-13 09:50:32 -08:00
Greg Kroah-Hartman
164bf1a6c4 Merge 5.4.2 into android-5.4
Changes in 5.4.2
	io_uring: async workers should inherit the user creds
	net: separate out the msghdr copy from ___sys_{send,recv}msg()
	net: disallow ancillary data for __sys_{send,recv}msg_file()
	crypto: inside-secure - Fix stability issue with Macchiatobin
	driver core: platform: use the correct callback type for bus_find_device
	usb: dwc2: use a longer core rest timeout in dwc2_core_reset()
	staging: wilc1000: fix illegal memory access in wilc_parse_join_bss_param()
	staging: rtl8192e: fix potential use after free
	staging: rtl8723bs: Drop ACPI device ids
	staging: rtl8723bs: Add 024c:0525 to the list of SDIO device-ids
	USB: serial: ftdi_sio: add device IDs for U-Blox C099-F9P
	mei: bus: prefix device names on bus with the bus name
	mei: me: add comet point V device id
	thunderbolt: Power cycle the router if NVM authentication fails
	x86/fpu: Don't cache access to fpu_fpregs_owner_ctx
	gve: Fix the queue page list allocated pages count
	macvlan: schedule bc_work even if error
	mdio_bus: don't use managed reset-controller
	net: dsa: sja1105: fix sja1105_parse_rgmii_delays()
	net: macb: add missed tasklet_kill
	net: psample: fix skb_over_panic
	net: sched: fix `tc -s class show` no bstats on class with nolock subqueues
	openvswitch: fix flow command message size
	sctp: Fix memory leak in sctp_sf_do_5_2_4_dupcook
	slip: Fix use-after-free Read in slip_open
	sctp: cache netns in sctp_ep_common
	openvswitch: drop unneeded BUG_ON() in ovs_flow_cmd_build_info()
	openvswitch: remove another BUG_ON()
	net/tls: take into account that bpf_exec_tx_verdict() may free the record
	net/tls: free the record on encryption error
	net: skmsg: fix TLS 1.3 crash with full sk_msg
	selftests/tls: add a test for fragmented messages
	net/tls: remove the dead inplace_crypto code
	net/tls: use sg_next() to walk sg entries
	selftests: bpf: test_sockmap: handle file creation failures gracefully
	selftests: bpf: correct perror strings
	tipc: fix link name length check
	selftests: pmtu: use -oneline for ip route list cache
	r8169: fix jumbo configuration for RTL8168evl
	r8169: fix resume on cable plug-in
	ext4: add more paranoia checking in ext4_expand_extra_isize handling
	Revert "jffs2: Fix possible null-pointer dereferences in jffs2_add_frag_to_fragtree()"
	crypto: talitos - Fix build error by selecting LIB_DES
	HID: core: check whether Usage Page item is after Usage ID items
	platform/x86: hp-wmi: Fix ACPI errors caused by too small buffer
	platform/x86: hp-wmi: Fix ACPI errors caused by passing 0 as input size
	Linux 5.4.2

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I8d695c1db60112decd0939927ccb472eb6c5286c
2019-12-04 23:46:13 +01:00
Jakub Kicinski
569cac5a50 net/tls: use sg_next() to walk sg entries
[ Upstream commit c5daa6cccd ]

Partially sent record cleanup path increments an SG entry
directly instead of using sg_next(). This should not be a
problem today, as encrypted messages should be always
allocated as arrays. But given this is a cleanup path it's
easy to miss was this ever to change. Use sg_next(), and
simplify the code.

Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Simon Horman <simon.horman@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-12-04 22:31:02 +01:00
Jakub Kicinski
a58365a79a net/tls: remove the dead inplace_crypto code
[ Upstream commit 9e5ffed37d ]

Looks like when BPF support was added by commit d3b18ad31f
("tls: add bpf support to sk_msg handling") and
commit d829e9c411 ("tls: convert to generic sk_msg interface")
it broke/removed the support for in-place crypto as added by
commit 4e6d47206c ("tls: Add support for inplace records
encryption").

The inplace_crypto member of struct tls_rec is dead, inited
to zero, and sometimes set to zero again. It used to be
set to 1 when record was allocated, but the skmsg code doesn't
seem to have been written with the idea of in-place crypto
in mind.

Since non trivial effort is required to bring the feature back
and we don't really have the HW to measure the benefit just
remove the left over support for now to avoid confusing readers.

Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Simon Horman <simon.horman@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-12-04 22:31:02 +01:00
Xin Long
0111438d7c sctp: cache netns in sctp_ep_common
[ Upstream commit 312434617c ]

This patch is to fix a data-race reported by syzbot:

  BUG: KCSAN: data-race in sctp_assoc_migrate / sctp_hash_obj

  write to 0xffff8880b67c0020 of 8 bytes by task 18908 on cpu 1:
    sctp_assoc_migrate+0x1a6/0x290 net/sctp/associola.c:1091
    sctp_sock_migrate+0x8aa/0x9b0 net/sctp/socket.c:9465
    sctp_accept+0x3c8/0x470 net/sctp/socket.c:4916
    inet_accept+0x7f/0x360 net/ipv4/af_inet.c:734
    __sys_accept4+0x224/0x430 net/socket.c:1754
    __do_sys_accept net/socket.c:1795 [inline]
    __se_sys_accept net/socket.c:1792 [inline]
    __x64_sys_accept+0x4e/0x60 net/socket.c:1792
    do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
    entry_SYSCALL_64_after_hwframe+0x44/0xa9

  read to 0xffff8880b67c0020 of 8 bytes by task 12003 on cpu 0:
    sctp_hash_obj+0x4f/0x2d0 net/sctp/input.c:894
    rht_key_get_hash include/linux/rhashtable.h:133 [inline]
    rht_key_hashfn include/linux/rhashtable.h:159 [inline]
    rht_head_hashfn include/linux/rhashtable.h:174 [inline]
    head_hashfn lib/rhashtable.c:41 [inline]
    rhashtable_rehash_one lib/rhashtable.c:245 [inline]
    rhashtable_rehash_chain lib/rhashtable.c:276 [inline]
    rhashtable_rehash_table lib/rhashtable.c:316 [inline]
    rht_deferred_worker+0x468/0xab0 lib/rhashtable.c:420
    process_one_work+0x3d4/0x890 kernel/workqueue.c:2269
    worker_thread+0xa0/0x800 kernel/workqueue.c:2415
    kthread+0x1d4/0x200 drivers/block/aoe/aoecmd.c:1253
    ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352

It was caused by rhashtable access asoc->base.sk when sctp_assoc_migrate
is changing its value. However, what rhashtable wants is netns from asoc
base.sk, and for an asoc, its netns won't change once set. So we can
simply fix it by caching netns since created.

Fixes: d6c0256a60 ("sctp: add the rhashtable apis for sctp global transport hashtable")
Reported-by: syzbot+e3b35fe7918ff0ee474e@syzkaller.appspotmail.com
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-12-04 22:30:57 +01:00
Greg Kroah-Hartman
54e301676a Merge 5.4 into android-mainline
Linux 5.4

Here we go!

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Iee409f3bbf65b93fa419e5b09818efb8e56569fd
2019-11-25 09:57:21 +01:00
Willem de Bruijn
d4ffb02dee net/tls: enable sk_msg redirect to tls socket egress
Bring back tls_sw_sendpage_locked. sk_msg redirection into a socket
with TLS_TX takes the following path:

  tcp_bpf_sendmsg_redir
    tcp_bpf_push_locked
      tcp_bpf_push
        kernel_sendpage_locked
          sock->ops->sendpage_locked

Also update the flags test in tls_sw_sendpage_locked to allow flag
MSG_NO_SHARED_FRAGS. bpf_tcp_sendmsg sets this.

Link: https://lore.kernel.org/netdev/CA+FuTSdaAawmZ2N8nfDDKu3XLpXBbMtcCT0q4FntDD2gn8ASUw@mail.gmail.com/T/#t
Link: https://github.com/wdebruij/kerneltools/commits/icept.2
Fixes: 0608c69c9a ("bpf: sk_msg, sock{map|hash} redirect through ULP")
Fixes: f3de19af0f ("Revert \"net/tls: remove unused function tls_sw_sendpage_locked\"")
Signed-off-by: Willem de Bruijn <willemb@google.com>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-11-19 15:03:02 -08:00
Greg Kroah-Hartman
ad5859c6ae Merge 5.4-rc8 into android-mainline
Linux 5.4-rc8

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I1f55e5d34dc78ddb064910ce1e1b7a7b5b39aaba
2019-11-18 08:31:11 +01:00
Greg Kroah-Hartman
682d8bf784 Merge tag 'v5.4-rc7' into android-mainline
Linux 5.4-rc7

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I505207a0a6f68ccc3519d7f190d8faf25d9d479a
2019-11-11 06:10:55 +01:00
Jiri Pirko
5a508a254b devlink: disallow reload operation during device cleanup
There is a race between driver code that does setup/cleanup of device
and devlink reload operation that in some drivers works with the same
code. Use after free could we easily obtained by running:

while true; do
        echo "0000:00:10.0" >/sys/bus/pci/drivers/mlxsw_spectrum2/bind
        devlink dev reload pci/0000:00:10.0 &
        echo "0000:00:10.0" >/sys/bus/pci/drivers/mlxsw_spectrum2/unbind
done

Fix this by enabling reload only after setup of device is complete and
disabling it at the beginning of the cleanup process.

Reported-by: Ido Schimmel <idosch@mellanox.com>
Fixes: 2d8dc5bbf4 ("devlink: Add support for reload")
Signed-off-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-11-09 19:38:36 -08:00