Commit Graph

1160973 Commits

Author SHA1 Message Date
Will McVicker
0cf5cecba6 Revert "crypto: api - Disallow identical driver names"
This reverts commit 680eb0a993 which is
commit 27016f75f5ed47e2d8e0ca75a8ff1f40bc1a5e27 upstream.

This breaks for devices that use the downstream fips140 module.

Bug: 335718233
Bug: 335830134
Change-Id: Ie465403c40fe75fee5934ea160b86a4c77ef8f17
Signed-off-by: Will McVicker <willmcvicker@google.com>
2024-05-30 13:02:35 -07:00
Greg Kroah-Hartman
1dca1fead9 Merge branch 'android14-6.1' into branch 'android14-6.1-lts'
This catches the android14-6.1-lts branch up to date with recent changes
in the android14-6.1 branch, including symbol additions which are
required for us to track in the LTS branch.

Included in here are the following commits:

* 0a5aada71c ANDROID: GKI: Update symbol list for mtk
* 34a15d3507 UPSTREAM: usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs
* bd552fcbbd ANDROID: GKI: Update rockchip symbols to add iova APIs
* 4ed706c20a FROMLIST: sched/pi: Reweight fair_policy() tasks when inheriting prio
* b1e11ffd90 ANDROID: Update the ABI symbol list
* 29a00abe43 ANDROID: mm: Add restricted vendor hook in do_read_fault()
* 51c421385e ANDROID: abi_gki_aarch64_qcom: Update symbol list
* a9dca663a7 ANDROID: Update the ABI symbol list
* 6316af1012 ANDROID: add vendor hooks and expoert reclaim_pages to reclaim memory
* 1d241d978d FROMGIT: usb: dwc3: Wait unconditionally after issuing EndXfer command
* f9ca61c8d8 ANDROID: ABI: Update honor symbol list
* c7fcb9bf9a ANDROID: add vendor hook in do_read_fault to tune fault_around_bytes
* 23f2a9f5f1 ANDROID: usb: Optimize the problem of slow transfer rate in USB accessory mode
* 6a3d68af9c ANDROID: Zap kernel/sched/android.h stubs
* 274e3e9696 ANDROID: export one function for mm metrics
* 117a941226 ANDROID: Update the ABI symbol list
* 0d080e01a2 ANDROID: Export sysctl_sched_wakeup_granularity to enable modifying it
* 039d2a958c UPSTREAM: ALSA: virtio: use ack callback
* 47dfe41d57 UPSTREAM: usb: typec: tcpm: clear pd_event queue in PORT_RESET
* 93188d7732 BACKPORT: usb: typec: tcpm: enforce ready state when queueing alt mode vdm
* 4d55129aea UPSTREAM: crypto: x86/curve25519 - disable gcov
* cf685d2b02 ANDROID: GKI: Update QCOM symbol list and ABI STG
* fae94bc4e7 ANDROID: GKI: update symbol list file for xiaomi
* d5e04556d4 UPSTREAM: netfilter: nft_set_pipapo: do not free live element
* dc6facfe02 UPSTREAM: net: tls: handle backlogging of crypto requests
* 1794308d46 ANDROID: 16K: Fix show maps CFI failure
* 72a9c0a205 ANDROID: 16K: Handle pad VMA splits and merges
* b86b5cb22d ANDROID: 16K: madvise_vma_pad_pages: Remove filemap_fault check
* 1657717c12 ANDROID: 16K: Only madvise padding from dynamic linker context
* 2ca5e076c9 ANDROID: 16K: Separate padding from ELF LOAD segment mappings
* 1537dbe21b ANDROID: 16K: Exclude ELF padding for fault around range
* 6815ef3195 ANDROID: 16K: Use MADV_DONTNEED to save VMA padding pages.
* 6b9e404675 ANDROID: 16K: Introduce ELF padding representation for VMAs
* e79c1d4590 ANDROID: 16K: Introduce /sys/kernel/mm/pgsize_miration/enabled
* ea3c70fb95 FROMGIT: usb: typec: tcpm: Check for port partner validity before consuming it
* 13f322e958 Revert "FROMGIT: usb: typec: tcpm: Check for port partner validity before consuming it"
* 6657c436ed FROMGIT: usb: typec: tcpm: Check for port partner validity before consuming it
* 1d37bc9913 ANDROID: vendor_hooks: add symbols for lazy preemption
* 14f07c1db0 ANDROID: vendor_hooks: add two hooks for lazy preemption
* 6364d59412 ANDROID: KVM: arm64: wait_for_initramfs for pKVM module loading procfs
* 4744b3a4ed ANDROID: GKI: Expose device async to userspace
* 08cc4037cf FROMGIT: coresight: etm4x: Fix access to resource selector registers
* 7ff054397a FROMGIT: coresight: etm4x: Safe access for TRCQCLTR
* f401cce7d9 FROMGIT: coresight: etm4x: Do not save/restore Data trace control registers
* d9604db041 FROMGIT: coresight: etm4x: Do not hardcode IOMEM access for register restore
* fa87a072a7 ANDROID: GKI: Update honda symbol list for led-trigger
* c61278bb70 ANDROID: GKI: Update symbols to symbol list
* 260bfad693 ANDROID: vendor_hook: Add hooks to support reader optimistic spin in rwsem
* d0c6724b0f UPSTREAM: af_unix: Fix garbage collector racing against connect()
* 94c88f80ff UPSTREAM: af_unix: Do not use atomic ops for unix_sk(sk)->inflight.
* 3dfddcb9c2 ANDROID: GKI: fix ABI breakage in struct userfaultfd_ctx
* 8dd482be44 UPSTREAM: userfaultfd: fix deadlock warning when locking src and dst VMAs
* ce2896c0c6 BACKPORT: userfaultfd: use per-vma locks in userfaultfd operations
* daf0b0fc4a BACKPORT: mm: add vma_assert_locked() for !CONFIG_PER_VMA_LOCK
* a5b6040d5c BACKPORT: userfaultfd: protect mmap_changing with rw_sem in userfaulfd_ctx
* 6b5ee039a1 BACKPORT: userfaultfd: move userfaultfd_ctx struct to header file
* ac96edb501 BACKPORT: userfaultfd: fix mmap_changing checking in mfill_atomic_hugetlb
* 51eab7ecc4 BACKPORT: selftests/mm: add separate UFFDIO_MOVE test for PMD splitting
* f152691515 BACKPORT: selftests/mm: add UFFDIO_MOVE ioctl test
* a5d504c067 BACKPORT: selftests/mm: add uffd_test_case_ops to allow test case-specific operations
* ee72d5a7d9 BACKPORT: selftests/mm: call uffd_test_ctx_clear at the end of the test
* abd6748ba6 UPSTREAM: userfaultfd: fix return error if mmap_changing is non-zero in MOVE ioctl
* 4f658d7723 BACKPORT: userfaultfd: change src_folio after ensuring it's unpinned in UFFDIO_MOVE
* bfb4b24b64 BACKPORT: mm: userfaultfd: fix unexpected change to src_folio when UFFDIO_MOVE fails
* 6ecd08eaf4 BACKPORT: userfaultfd: handle zeropage moves by UFFDIO_MOVE
* e275c2b743 UPSTREAM: userfaultfd: avoid huge_zero_page in UFFDIO_MOVE
* 60c5a0e023 UPSTREAM: userfaultfd: fix move_pages_pte() splitting folio under RCU read lock
* 5025ad140e BACKPORT: userfaultfd: UFFDIO_MOVE uABI
* 25db7c13d8 UPSTREAM: mm/rmap: support move to different root anon_vma in folio_move_anon_rmap()
* 503add1843 ANDROID: PM: hibernate: Encryption support with compression
* 3e99ae28ea ANDROID: abi_gki_aarch64_qcom: Update symbol list
* 8f08ea0d59 ANDROID: vendor_hooks: Add hooks to support hibernation
* e7e8932600 ANDROID: gki_defconfig: Sync gki_defconfig
* 54c2418b76 UPSTREAM: PM: hibernate: Support to select compression algorithm
* 76c7e9747b UPSTREAM: PM: hibernate: Add support for LZ4 compression for hibernation
* 990d3701d0 BACKPORT: PM: hibernate: Move to crypto APIs for LZO compression
* d224d17a14 BACKPORT: PM: hibernate: Rename lzo* to make it generic
* dcb09569bb ANDROID: ABI: Update symbol list for Exynos SoC
* 692e3553d2 ANDROID: abi_gki_aarch64_qcom: Update symbol list
* 8943be7d1b BACKPORT: mtk-mmsys: Change mtk-mmsys & mtk-mutex to modules
* 34e8dc4ed0 BACKPORT: clk: mediatek: Split configuration options for MT8186 clock drivers
* a5ce14670a BACKPORT: clk: mediatek: Add MODULE_LICENSE() where missing
* 4bfe25d0b6 ANDROID: Update the ABI symbol list
* 24edb63b85 Reapply "ANDROID: block: Add support for filesystem requests and small segments"
* 141ebdcb28 UPSTREAM: usb:typec:tcpm:support double Rp to Vbus cable as sink
* 8672a5ee4d ANDROID: Update the ABI symbol list

Change-Id: I594743790b6a498847862039bd47c65c51876b73
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-05-22 10:50:52 +00:00
Seiya Wang
0a5aada71c ANDROID: GKI: Update symbol list for mtk
3 function symbol(s) added
  'int dev_pm_opp_register_notifier(struct device*, struct notifier_block*)'
  'int dev_pm_opp_unregister_notifier(struct device*, struct notifier_block*)'
  'int snd_soc_suspend(struct device*)'

Bug: 341821144
Change-Id: Iafcfaede99a35e10d9162e0298a7e3feb43cec73
Signed-off-by: Seiya Wang <seiya.wang@mediatek.com>
2024-05-21 09:55:20 +00:00
Greg Kroah-Hartman
b98ce0fe28 ANDROID: GKI: update the abi for tracing changes in 6.1.84
In 6.1.84, a number of internal tracing structures changed.  Those
structures are not used outside of the core kernel, but due to opaque
pointers being carried into some abi signatures, they are tracked by the
.stg file.

Update the .stg file to handle these changes, as they are safe to modify
at this point in time.

The changes are:

INFO: ABI DIFFERENCES HAVE BEEN DETECTED!
INFO: type 'struct trace_buffer' changed
  byte size changed from 224 to 216
  2 members ('bool time_stamp_abs' .. 'struct ring_buffer_ext_cb* ext_cb') changed
    offset changed by -64

type 'struct ring_buffer_per_cpu' changed
  byte size changed from 496 to 488

type 'struct rb_irq_work' changed
  byte size changed from 96 to 88
  member 'long wait_index' was removed
  3 members ('bool waiters_pending' .. 'bool wakeup_full') changed
    offset changed by -64

Fixes: 347385861c ("Linux 6.1.84")
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Id0c90b04188335ffa9a40db0397ed5a12080ca95
2024-05-20 16:04:32 +00:00
Greg Kroah-Hartman
5f29666f69 Revert "timers: Rename del_timer_sync() to timer_delete_sync()"
This reverts commit 113d5341ee which is
commit 9b13df3fb6 upstream.

It breaks the Android kernel abi by turning del_timer_sync() into an
inline function, which breaks the abi.  Fix this by putting it back as
needed AND fix up the only use of this new function in
drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c which is
what caused this commit to be backported to 5.4.274 in the first place.

Bug: 161946584
Change-Id: Icd26c7c81e6172f36eeeb69827989bfab1d32afe
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-05-20 11:02:50 +00:00
Greg Kroah-Hartman
501c229a8a Revert "media: mc: Add num_links flag to media_pad"
This reverts commit cff51913c5 which is
commit baeddf94aa61879b118f2faa37ed126d772670cc upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I5b874c8b01bdd8cdeed6dec216fdad500593f5a7
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-05-20 10:34:50 +00:00
Greg Kroah-Hartman
2b84f5edda Revert "media: mc: Expand MUST_CONNECT flag to always require an enabled link"
This reverts commit e2c545b841 which is
commit b3decc5ce7d778224d266423b542326ad469cb5f upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I94f10b3fe86210799b5697259e32114f00f080f0
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-05-20 10:34:50 +00:00
Krishna Kurapati
34a15d3507 UPSTREAM: usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs
It is observed sometimes when tethering is used over NCM with Windows 11
as host, at some instances, the gadget_giveback has one byte appended at
the end of a proper NTB. When the NTB is parsed, unwrap call looks for
any leftover bytes in SKB provided by u_ether and if there are any pending
bytes, it treats them as a separate NTB and parses it. But in case the
second NTB (as per unwrap call) is faulty/corrupt, all the datagrams that
were parsed properly in the first NTB and saved in rx_list are dropped.

Adding a few custom traces showed the following:
[002] d..1  7828.532866: dwc3_gadget_giveback: ep1out:
req 000000003868811a length 1025/16384 zsI ==> 0
[002] d..1  7828.532867: ncm_unwrap_ntb: K: ncm_unwrap_ntb toprocess: 1025
[002] d..1  7828.532867: ncm_unwrap_ntb: K: ncm_unwrap_ntb nth: 1751999342
[002] d..1  7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb seq: 0xce67
[002] d..1  7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb blk_len: 0x400
[002] d..1  7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb ndp_len: 0x10
[002] d..1  7828.532869: ncm_unwrap_ntb: K: Parsed NTB with 1 frames

In this case, the giveback is of 1025 bytes and block length is 1024.
The rest 1 byte (which is 0x00) won't be parsed resulting in drop of
all datagrams in rx_list.

Same is case with packets of size 2048:
[002] d..1  7828.557948: dwc3_gadget_giveback: ep1out:
req 0000000011dfd96e length 2049/16384 zsI ==> 0
[002] d..1  7828.557949: ncm_unwrap_ntb: K: ncm_unwrap_ntb nth: 1751999342
[002] d..1  7828.557950: ncm_unwrap_ntb: K: ncm_unwrap_ntb blk_len: 0x800

Lecroy shows one byte coming in extra confirming that the byte is coming
in from PC:

 Transfer 2959 - Bytes Transferred(1025)  Timestamp((18.524 843 590)
 - Transaction 8391 - Data(1025 bytes) Timestamp(18.524 843 590)
 --- Packet 4063861
       Data(1024 bytes)
       Duration(2.117us) Idle(14.700ns) Timestamp(18.524 843 590)
 --- Packet 4063863
       Data(1 byte)
       Duration(66.160ns) Time(282.000ns) Timestamp(18.524 845 722)

According to Windows driver, no ZLP is needed if wBlockLength is non-zero,
because the non-zero wBlockLength has already told the function side the
size of transfer to be expected. However, there are in-market NCM devices
that rely on ZLP as long as the wBlockLength is multiple of wMaxPacketSize.
To deal with such devices, it pads an extra 0 at end so the transfer is no
longer multiple of wMaxPacketSize.

Cc: <stable@vger.kernel.org>
Fixes: 9f6ce4240a ("usb: gadget: f_ncm.c added")
Signed-off-by: Krishna Kurapati <quic_kriskura@quicinc.com>
Reviewed-by: Maciej Żenczykowski <maze@google.com>
Link: https://lore.kernel.org/r/20240205074650.200304-1-quic_kriskura@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

(cherry picked from commit 76c51146820c5dac629f21deafab0a7039bc3ccd
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master)

Bug: 320608613
Change-Id: Iee598bcbede12582235fca38a0c9f50f3b7375c5
Signed-off-by: Krishna Kurapati <quic_kriskura@quicinc.com>
(cherry picked from commit c344c3ebe3fead1ed0c12bd686be083748011342)
2024-05-20 05:51:47 +00:00
Kever Yang
bd552fcbbd ANDROID: GKI: Update rockchip symbols to add iova APIs
INFO: 2 function symbol(s) added
  'struct iova* alloc_iova(struct iova_domain*, unsigned long, unsigned long, bool)'
  'void free_iova(struct iova_domain*, unsigned long)'

Bug: 300024866
Change-Id: Iccdadf2b516343411871f1df0f46299af9b51c97
Signed-off-by: Kever Yang <kever.yang@rock-chips.com>
2024-05-18 20:21:31 +00:00
Qais Yousef
4ed706c20a FROMLIST: sched/pi: Reweight fair_policy() tasks when inheriting prio
For fair tasks inheriting the priority (nice) without reweighting is
a NOP as the task's share won't change.

This is visible when running with PTHREAD_PRIO_INHERIT where fair tasks
with low priority values are susceptible to starvation leading to PI
like impact on lock contention.

The logic in rt_mutex will reset these low priority fair tasks into nice
0, but without the additional reweight operation to actually update the
weights, it doesn't have the desired impact of boosting them to allow
them to run sooner/longer to release the lock.

Apply the reweight for fair_policy() tasks to achieve the desired boost
for those low nice values tasks. Note that boost here means resetting
their nice to 0; as this is what the current logic does for fair tasks.

We need to re-instate ordering fair tasks by their priority order on the
waiter tree to ensure we inherit the top_waiter properly.

Handling of idle_policy() requires more code refactoring and is not
handled yet. idle_policy() are treated specially and only run when the
CPU is idle and get a hardcoded low weight value. Changing weights won't
be enough without a promotion first to SCHED_OTHER.

Tested with a test program that creates three threads.

	1. main thread that spawns high prio and low prio task and busy
	   loops

	2. low priority thread that holds a pthread_mutex() with
	   PTHREAD_PRIO_INHERIT protocol. Runs at nice +10. Busy loops
	   after holding the lock.

	3. high priority thread that holds a pthread_mutex() with
	   PTHREADPTHREAD_PRIO_INHERIT, but made to start after the low
	   priority thread. Runs at nice 0. Should remain blocked by the
	   low priority thread.

All tasks are pinned to CPU0.

Without the patch I can see the low priority thread running only for
~10% of the time which is what expected without it being boosted.

With the patch the low priority thread runs for ~50% which is what
expected if it gets boosted to nice 0.

I modified the test program logic afterwards to ensure that after
releasing the lock the low priority thread goes back to running for 10%
of the time, and it does.

Bug: 263876335
Link: https://lore.kernel.org/lkml/20240514160711.hpdg64grdwc43ux7@airbuntu/
Reported-by: Yabin Cui <yabinc@google.com>
Signed-off-by: Qais Yousef <qyousef@layalina.io>
[Fix trivial conflict with vendor hook]
Signed-off-by: Qais Yousef <qyousef@google.com>
Change-Id: Ia954ee528495b5cf5c3a2157c68b4a757cef1f83
(cherry picked from commit 23ac35ed8fc6220e4e498a21d22a9dbe67e7da9b)
Signed-off-by: Qais Yousef <qyousef@google.com>
2024-05-18 19:08:51 +00:00
liangjlee
b1e11ffd90 ANDROID: Update the ABI symbol list
Adding the following symbols:
  - __traceiter_android_rvh_do_read_fault
  - __tracepoint_android_rvh_do_read_fault

Bug: 336873696
Change-Id: I7ff2b064942826dcadc949595c9d7df917123986
Signed-off-by: liangjlee <liangjlee@google.com>
2024-05-18 19:08:12 +00:00
liangjlee
29a00abe43 ANDROID: mm: Add restricted vendor hook in do_read_fault()
This patch add a restricted vendor hook in do_read_fault() for tracking
which file and offsets are faulted.

Bug: 336736235
Change-Id: I425690e58550c4ac44912daa10b5eac0728bfb4e
Signed-off-by: liangjlee <liangjlee@google.com>
2024-05-18 19:08:12 +00:00
Srinivasarao Pathipati
51c421385e ANDROID: abi_gki_aarch64_qcom: Update symbol list
The commit 893597cbab ("r8152: add USB device driver for
config selection"), uses usb register/degister symbols.
Add them to the symbol list.

  usb_deregister_device_driver
  usb_register_device_driver

Bug: 341211984
Change-Id: Ifcf37d5630891c5963123af09843b00395f9eff6
Signed-off-by: Srinivasarao Pathipati <quic_c_spathi@quicinc.com>
2024-05-17 09:12:05 +00:00
Minchan Kim
a9dca663a7 ANDROID: Update the ABI symbol list
3 function symbol(s) added
  'int __traceiter_android_rvh_madvise_pageout_end(void*, void*, struct list_head*)'
  'int __traceiter_android_rvh_madvise_pageout_begin(void*, void**)'
  'int __traceiter_android_rvh_reclaim_folio_list(void*, struct list_head*, void*)'

3 variable symbol(s) added
  'struct tracepoint __tracepoint_android_rvh_madvise_pageout_end'
  'struct tracepoint __tracepoint_android_rvh_madvise_pageout_begin'
  'struct tracepoint __tracepoint_android_rvh_reclaim_folio_list'

Bug: 326662423
Change-Id: Ie5805e48060f9e91b87c739ad8a01977b38c2f08
Signed-off-by: Minchan Kim <minchan@google.com>
2024-05-16 23:20:01 +00:00
Minchan Kim
6316af1012 ANDROID: add vendor hooks and expoert reclaim_pages to reclaim memory
Add vendor hooks to reclaim MADV_PAGEOUT memory for asynchrnous
device. It also exports reclaim_pages to reclaim memory.

Bug: 326662423
Change-Id: Ic2516c64a9dbd53173a3bfb19b6cd21636916c27
Signed-off-by: Minchan Kim <minchan@google.com>
2024-05-16 23:20:01 +00:00
Greg Kroah-Hartman
2b530e8f5d Merge 6.1.84 into android14-6.1-lts
Changes in 6.1.84
	x86/cpu: Support AMD Automatic IBRS
	x86/bugs: Use sysfs_emit()
	KVM: x86: Update KVM-only leaf handling to allow for 100% KVM-only leafs
	KVM: x86: Advertise CPUID.(EAX=7,ECX=2):EDX[5:0] to userspace
	KVM: x86: Use a switch statement and macros in __feature_translate()
	timers: Update kernel-doc for various functions
	timers: Use del_timer_sync() even on UP
	timers: Rename del_timer_sync() to timer_delete_sync()
	wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
	media: staging: ipu3-imgu: Set fields before media_entity_pads_init()
	arm64: dts: qcom: sc7280: Add additional MSI interrupts
	remoteproc: virtio: Fix wdg cannot recovery remote processor
	clk: qcom: gcc-sdm845: Add soft dependency on rpmhpd
	smack: Set SMACK64TRANSMUTE only for dirs in smack_inode_setxattr()
	smack: Handle SMACK64TRANSMUTE in smack_inode_setsecurity()
	arm: dts: marvell: Fix maxium->maxim typo in brownstone dts
	drm/vmwgfx: Fix possible null pointer derefence with invalid contexts
	serial: max310x: fix NULL pointer dereference in I2C instantiation
	pci_iounmap(): Fix MMIO mapping leak
	media: xc4000: Fix atomicity violation in xc4000_get_frequency
	media: mc: Add local pad to pipeline regardless of the link state
	media: mc: Fix flags handling when creating pad links
	media: mc: Add num_links flag to media_pad
	media: mc: Rename pad variable to clarify intent
	media: mc: Expand MUST_CONNECT flag to always require an enabled link
	KVM: Always flush async #PF workqueue when vCPU is being destroyed
	cpufreq: amd-pstate: Fix min_perf assignment in amd_pstate_adjust_perf()
	powerpc/smp: Adjust nr_cpu_ids to cover all threads of a core
	powerpc/smp: Increase nr_cpu_ids to include the boot CPU
	sparc64: NMI watchdog: fix return value of __setup handler
	sparc: vDSO: fix return value of __setup handler
	crypto: qat - fix double free during reset
	crypto: qat - resolve race condition during AER recovery
	selftests/mqueue: Set timeout to 180 seconds
	ext4: correct best extent lstart adjustment logic
	block: Clear zone limits for a non-zoned stacked queue
	kasan/test: avoid gcc warning for intentional overflow
	bounds: support non-power-of-two CONFIG_NR_CPUS
	fat: fix uninitialized field in nostale filehandles
	ubifs: Set page uptodate in the correct place
	ubi: Check for too small LEB size in VTBL code
	ubi: correct the calculation of fastmap size
	mtd: rawnand: meson: fix scrambling mode value in command macro
	parisc/unaligned: Rewrite 64-bit inline assembly of emulate_ldd()
	parisc: Avoid clobbering the C/B bits in the PSW with tophys and tovirt macros
	parisc: Fix ip_fast_csum
	parisc: Fix csum_ipv6_magic on 32-bit systems
	parisc: Fix csum_ipv6_magic on 64-bit systems
	parisc: Strip upper 32 bit of sum in csum_ipv6_magic for 64-bit builds
	md/raid5: fix atomicity violation in raid5_cache_count
	cpufreq: Limit resolving a frequency to policy min/max
	PM: suspend: Set mem_sleep_current during kernel command line setup
	clk: qcom: gcc-ipq6018: fix terminating of frequency table arrays
	clk: qcom: gcc-ipq8074: fix terminating of frequency table arrays
	clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays
	clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays
	usb: xhci: Add error handling in xhci_map_urb_for_dma
	powerpc/fsl: Fix mfpmr build errors with newer binutils
	USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB
	USB: serial: add device ID for VeriFone adapter
	USB: serial: cp210x: add ID for MGP Instruments PDS100
	USB: serial: option: add MeiG Smart SLM320 product
	KVM: x86/xen: inject vCPU upcall vector when local APIC is enabled
	USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M
	PM: sleep: wakeirq: fix wake irq warning in system suspend
	mmc: tmio: avoid concurrent runs of mmc_request_done()
	fuse: fix root lookup with nonzero generation
	fuse: don't unhash root
	usb: typec: ucsi: Clean up UCSI_CABLE_PROP macros
	serial: Lock console when calling into driver before registration
	btrfs: qgroup: always free reserved space for extent records
	btrfs: fix off-by-one chunk length calculation at contains_pending_extent()
	PCI/PM: Drain runtime-idle callbacks before driver removal
	PCI/DPC: Quirk PIO log size for Intel Raptor Lake Root Ports
	dm-raid: fix lockdep waring in "pers->hot_add_disk"
	powerpc: xor_vmx: Add '-mhard-float' to CFLAGS
	mac802154: fix llsec key resources release in mac802154_llsec_key_del
	swap: comments get_swap_device() with usage rule
	mm: swap: fix race between free_swap_and_cache() and swapoff()
	mmc: core: Fix switch on gp3 partition
	drm/etnaviv: Restore some id values
	landlock: Warn once if a Landlock action is requested while disabled
	hwmon: (amc6821) add of_match table
	ext4: fix corruption during on-line resize
	nvmem: meson-efuse: fix function pointer type mismatch
	slimbus: core: Remove usage of the deprecated ida_simple_xx() API
	phy: tegra: xusb: Add API to retrieve the port number of phy
	usb: gadget: tegra-xudc: Fix USB3 PHY retrieval logic
	speakup: Fix 8bit characters from direct synth
	PCI/AER: Block runtime suspend when handling errors
	io_uring/net: correctly handle multishot recvmsg retry setup
	sparc: Explicitly include correct DT includes
	sparc32: Fix parport build with sparc32
	nfs: fix UAF in direct writes
	kbuild: Move -Wenum-{compare-conditional,enum-conversion} into W=1
	PCI: qcom: Rename qcom_pcie_config_sid_sm8250() to reflect IP version
	PCI: qcom: Enable BDF to SID translation properly
	PCI: dwc: endpoint: Fix advertised resizable BAR size
	PCI: hv: Fix ring buffer size calculation
	vfio: Use GFP_KERNEL_ACCOUNT for userspace persistent allocations
	vfio/pci: Consolidate irq cleanup on MSI/MSI-X disable
	vfio/pci: Remove negative check on unsigned vector
	vfio/pci: Lock external INTx masking ops
	vfio/platform: Disable virqfds on cleanup
	ksmbd: retrieve number of blocks using vfs_getattr in set_file_allocation_info
	ring-buffer: Fix waking up ring buffer readers
	ring-buffer: Do not set shortest_full when full target is hit
	ring-buffer: Fix resetting of shortest_full
	ring-buffer: Fix full_waiters_pending in poll
	ring-buffer: Use wait_event_interruptible() in ring_buffer_wait()
	soc: fsl: qbman: Always disable interrupts when taking cgr_lock
	soc: fsl: qbman: Use raw spinlock for cgr_lock
	s390/zcrypt: fix reference counting on zcrypt card objects
	drm/probe-helper: warn about negative .get_modes()
	drm/panel: do not return negative error codes from drm_panel_get_modes()
	drm/exynos: do not return negative values from .get_modes()
	drm/imx/ipuv3: do not return negative values from .get_modes()
	drm/vc4: hdmi: do not return negative values from .get_modes()
	memtest: use {READ,WRITE}_ONCE in memory scanning
	Revert "block/mq-deadline: use correct way to throttling write requests"
	f2fs: mark inode dirty for FI_ATOMIC_COMMITTED flag
	f2fs: truncate page cache before clearing flags when aborting atomic write
	nilfs2: fix failure to detect DAT corruption in btree and direct mappings
	nilfs2: prevent kernel bug at submit_bh_wbc()
	cifs: open_cached_dir(): add FILE_READ_EA to desired access
	cpufreq: dt: always allocate zeroed cpumask
	x86/CPU/AMD: Update the Zenbleed microcode revisions
	NFSD: Fix nfsd_clid_class use of __string_len() macro
	net: hns3: tracing: fix hclgevf trace event strings
	LoongArch: Change __my_cpu_offset definition to avoid mis-optimization
	LoongArch: Define the __io_aw() hook as mmiowb()
	wireguard: netlink: check for dangling peer via is_dead instead of empty list
	wireguard: netlink: access device through ctx instead of peer
	ahci: asm1064: correct count of reported ports
	ahci: asm1064: asm1166: don't limit reported ports
	drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag
	drm/amd/display: Return the correct HDCP error code
	drm/amd/display: Fix noise issue on HDMI AV mute
	dm snapshot: fix lockup in dm_exception_table_exit
	x86/pm: Work around false positive kmemleak report in msr_build_context()
	cpufreq: brcmstb-avs-cpufreq: fix up "add check for cpufreq_cpu_get's return value"
	platform/x86: p2sb: On Goldmont only cache P2SB and SPI devfn BAR
	tls: fix race between tx work scheduling and socket close
	netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout
	netfilter: nf_tables: disallow anonymous set with timeout flag
	netfilter: nf_tables: reject constant set with timeout
	Drivers: hv: vmbus: Calculate ring buffer size for more efficient use of memory
	xfrm: Avoid clang fortify warning in copy_to_user_tmpl()
	init/Kconfig: lower GCC version check for -Warray-bounds
	KVM: x86: Mark target gfn of emulated atomic instruction as dirty
	KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region()
	tracing: Use .flush() call to wake up readers
	drm/amdgpu/pm: Fix the error of pwm1_enable setting
	drm/i915: Check before removing mm notifier
	ALSA: hda/realtek - Fix headset Mic no show at resume back for Lenovo ALC897 platform
	USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
	usb: gadget: ncm: Fix handling of zero block length packets
	usb: port: Don't try to peer unused USB ports based on location
	tty: serial: fsl_lpuart: avoid idle preamble pending if CTS is enabled
	misc: lis3lv02d_i2c: Fix regulators getting en-/dis-abled twice on suspend/resume
	mei: me: add arrow lake point S DID
	mei: me: add arrow lake point H DID
	vt: fix unicode buffer corruption when deleting characters
	fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion
	ALSA: hda/realtek - Add Headset Mic supported Acer NB platform
	ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook
	tee: optee: Fix kernel panic caused by incorrect error handling
	mm, vmscan: prevent infinite loop for costly GFP_NOIO | __GFP_RETRY_MAYFAIL allocations
	iio: accel: adxl367: fix DEVID read after reset
	iio: accel: adxl367: fix I2C FIFO data register
	i2c: i801: Avoid potential double call to gpiod_remove_lookup_table
	drm/amd/display: handle range offsets in VRR ranges
	x86/efistub: Call mixed mode boot services on the firmware's stack
	net: tls: handle backlogging of crypto requests
	ASoC: amd: yc: Revert "Fix non-functional mic on Lenovo 21J2"
	iommu: Avoid races around default domain allocations
	clocksource/drivers/arm_global_timer: Fix maximum prescaler value
	entry: Respect changes to system call number by trace_sys_enter()
	minmax: add umin(a, b) and umax(a, b)
	swiotlb: Fix alignment checks when both allocation and DMA masks are present
	iommu/dma: Force swiotlb_max_mapping_size on an untrusted device
	printk: Update @console_may_schedule in console_trylock_spinning()
	irqchip/renesas-rzg2l: Implement restriction when writing ISCR register
	irqchip/renesas-rzg2l: Flush posted write in irq_eoi()
	irqchip/renesas-rzg2l: Add macro to retrieve TITSR register offset based on register's index
	irqchip/renesas-rzg2l: Rename rzg2l_tint_eoi()
	irqchip/renesas-rzg2l: Rename rzg2l_irq_eoi()
	irqchip/renesas-rzg2l: Prevent spurious interrupts when setting trigger type
	kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address
	efi/libstub: fix efi_random_alloc() to allocate memory at alloc_min or higher address
	x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD
	efi: fix panic in kdump kernel
	pwm: img: fix pwm clock lookup
	tty: serial: imx: Fix broken RS485
	block: Fix page refcounts for unaligned buffers in __bio_release_pages()
	blk-mq: release scheduler resource when request completes
	selftests: mptcp: diag: return KSFT_FAIL not test_cnt
	vfio/pci: Disable auto-enable of exclusive INTx IRQ
	vfio: Introduce interface to flush virqfd inject workqueue
	vfio/pci: Create persistent INTx handler
	vfio/platform: Create persistent IRQ handlers
	vfio/fsl-mc: Block calling interrupt handler without trigger
	x86/coco: Export cc_vendor
	x86/coco: Get rid of accessor functions
	x86/Kconfig: Remove CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT
	x86/sev: Fix position dependent variable references in startup code
	mm/migrate: set swap entry values of THP tail pages properly.
	init: open /initrd.image with O_LARGEFILE
	x86/efistub: Add missing boot_params for mixed mode compat entry
	efi/libstub: Cast away type warning in use of max()
	btrfs: zoned: don't skip block groups with 100% zone unusable
	btrfs: zoned: use zone aware sb location for scrub
	wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes
	wifi: iwlwifi: fw: don't always use FW dump trig
	exec: Fix NOMMU linux_binprm::exec in transfer_args_to_stack()
	hexagon: vmlinux.lds.S: handle attributes section
	mmc: sdhci-omap: re-tuning is needed after a pm transition to support emmc HS200 mode
	mmc: core: Initialize mmc_blk_ioc_data
	mmc: core: Avoid negative index with array access
	block: Do not force full zone append completion in req_bio_endio()
	thermal: devfreq_cooling: Fix perf state when calculate dfc res_util
	nouveau/dmem: handle kcalloc() allocation failure
	net: ll_temac: platform_get_resource replaced by wrong function
	drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed
	drm/amdkfd: fix TLB flush after unmap for GFX9.4.2
	drm/i915/bios: Tolerate devdata==NULL in intel_bios_encoder_supports_dp_dual_mode()
	drm/i915/gt: Reset queue_priority_hint on parking
	Bluetooth: hci_sync: Fix not checking error on hci_cmd_sync_cancel_sync
	Revert "usb: phy: generic: Get the vbus supply"
	usb: cdc-wdm: close race between read and workqueue
	USB: UAS: return ENODEV when submit urbs fail with device not attached
	usb: dwc3-am62: Rename private data
	usb: dwc3-am62: fix module unload/reload behavior
	ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs
	scsi: core: Fix unremoved procfs host directory regression
	staging: vc04_services: changen strncpy() to strscpy_pad()
	staging: vc04_services: fix information leak in create_component()
	USB: core: Add hub_get() and hub_put() routines
	USB: core: Fix deadlock in port "disable" sysfs attribute
	scsi: sd: Fix TCG OPAL unlock on system resume
	usb: dwc2: host: Fix remote wakeup from hibernation
	usb: dwc2: host: Fix hibernation flow
	usb: dwc2: host: Fix ISOC flow in DDMA mode
	usb: dwc2: gadget: Fix exiting from clock gating
	usb: dwc2: gadget: LPM flow fix
	usb: udc: remove warning when queue disabled ep
	usb: typec: Return size of buffer if pd_set operation succeeds
	usb: typec: ucsi: Clear EVENT_PENDING under PPM lock
	usb: typec: ucsi: Ack unsupported commands
	usb: typec: ucsi_acpi: Refactor and fix DELL quirk
	usb: typec: ucsi: Clear UCSI_CCI_RESET_COMPLETE before reset
	scsi: qla2xxx: Prevent command send on chip reset
	scsi: qla2xxx: Fix N2N stuck connection
	scsi: qla2xxx: Split FCE|EFT trace control
	scsi: qla2xxx: Update manufacturer detail
	scsi: qla2xxx: NVME|FCP prefer flag not being honored
	scsi: qla2xxx: Fix command flush on cable pull
	scsi: qla2xxx: Fix double free of fcport
	scsi: qla2xxx: Change debug message during driver unload
	scsi: qla2xxx: Delay I/O Abort on PCI error
	x86/cpu: Enable STIBP on AMD if Automatic IBRS is enabled
	tls: fix use-after-free on failed backlog decryption
	scsi: lpfc: Correct size for cmdwqe/rspwqe for memset()
	scsi: lpfc: Correct size for wqe for memset()
	scsi: libsas: Add a helper sas_get_sas_addr_and_dev_type()
	scsi: libsas: Fix disk not being scanned in after being removed
	x86/sev: Skip ROM range scans and validation for SEV-SNP guests
	USB: core: Fix deadlock in usb_deauthorize_interface()
	tools/resolve_btfids: fix build with musl libc
	Linux 6.1.84

Change-Id: I2aa458588d512ce908a9b087cdc66b345cef83a9
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-05-16 17:29:02 +00:00
Prashanth K
1d241d978d FROMGIT: usb: dwc3: Wait unconditionally after issuing EndXfer command
Currently all controller IP/revisions except DWC3_usb3 >= 310a
wait 1ms unconditionally for ENDXFER completion when IOC is not
set. This is because DWC_usb3 controller revisions >= 3.10a
supports GUCTL2[14: Rst_actbitlater] bit which allows polling
CMDACT bit to know whether ENDXFER command is completed.

Consider a case where an IN request was queued, and parallelly
soft_disconnect was called (due to ffs_epfile_release). This
eventually calls stop_active_transfer with IOC cleared, hence
send_gadget_ep_cmd() skips waiting for CMDACT cleared during
EndXfer. For DWC3 controllers with revisions >= 310a, we don't
forcefully wait for 1ms either, and we proceed by unmapping the
requests. If ENDXFER didn't complete by this time, it leads to
SMMU faults since the controller would still be accessing those
requests.

Fix this by ensuring ENDXFER completion by adding 1ms delay in
__dwc3_stop_active_transfer() unconditionally.

Cc: stable@vger.kernel.org
Fixes: b353eb6dc2 ("usb: dwc3: gadget: Skip waiting for CMDACT cleared during endxfer")
Signed-off-by: Prashanth K <quic_prashk@quicinc.com>
Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://lore.kernel.org/r/20240502044103.1066350-1-quic_prashk@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 340415457
(cherry picked from commit 1d26ba0944d398f88aaf997bda3544646cf21945
https: //git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git/ usb-next)
Signed-off-by: Prashanth K <quic_prashk@quicinc.com>
Change-Id: I0d3792d620ecd380f2a0a80ae5137c25d1adac4d
2024-05-16 16:04:36 +00:00
Dezhi Huang
f9ca61c8d8 ANDROID: ABI: Update honor symbol list
1 function symbol(s) added
  'int __traceiter_android_vh_tune_fault_around_bytes(unsigned long *)'

1 variable symbol(s) added
  'struct tracepoint __tracepoint_android_vh_tune_fault_around_bytes'

with this vendor_hook, oem can dynamically adjust fault_around_bytes to
balance memory usage and performance

Bug: 340749845
Change-Id: I0ec6c5cc0b021dd7e7854dbe13f13c3f6b488b64
Signed-off-by: Dezhi Huang <huangdezhi@hihonor.com>
2024-05-16 15:41:17 +00:00
Dezhi Huang
c7fcb9bf9a ANDROID: add vendor hook in do_read_fault to tune fault_around_bytes
with this vendor_hook, oem can dynamically adjust fault_around_bytes to
balance memory usage and performance

Bug: 340749845
Change-Id: I429f4302caf44a769696ccec84e9cc13ea8892ea
Signed-off-by: Dezhi Huang <huangdezhi@hihonor.com>
2024-05-16 15:41:17 +00:00
hulianqin
23f2a9f5f1 ANDROID: usb: Optimize the problem of slow transfer rate in USB accessory mode
The data transfer rate using Google Restore in USB3.2 mode is slower,
only about 140MB/s at 5Gbps.

The bMaxBurst is not set, and num_fifos in
dwc3_gadget_resize_tx_fifosis 1, which results
in only 131btye of dwc3 ram space being allocated to ep.

Modify bMaxBurst to 6.
The 5Gbps rate increases from 140MB/s to 350MB/s.
The 10Gbps rate is increased from 220MB/s to 500MB/s.

Bug: 340049583

Change-Id: I5710af32c72d0b57afaecc00c4f0909af4b9a299
Signed-off-by: Lianqin Hu <hulianqin@vivo.corp-partner.google.com>
Signed-off-by: Lianqin Hu <hulianqin@vivo.com>
2024-05-16 15:40:36 +00:00
Greg Kroah-Hartman
81cc178d7c Revert "io_uring: drop any code related to SCM_RIGHTS"
This reverts commit a3812a47a3 which is
commit 6e5e6d274956305f1fc0340522b38f5f5be74bdb upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I84857293b288c8a160b2567d4018568c36893eff
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-05-16 14:12:37 +00:00
Greg Kroah-Hartman
229c1b5f61 Revert "Bluetooth: hci_conn: Consolidate code for aborting connections"
This reverts commit 6083089ab0 which is
commit a13f316e90 upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: Ic482b9be644466e06baa4bc0f01a7cbf63b905fb
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-05-16 14:12:36 +00:00
Greg Kroah-Hartman
50619421ea Revert "Bluetooth: hci_core: Cancel request on command timeout"
This reverts commit 1b6cfa4c76 which is
commit 63298d6e752fc0ec7f5093860af8bc9f047b30c8 upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I63e22487a918e73d667b231128efcfceb48f528b
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-05-16 14:12:33 +00:00
John Stultz
6a3d68af9c ANDROID: Zap kernel/sched/android.h stubs
Long ago with android-mainline, kernel/sched/android.h was added
to include stub functions for out-of-tree logic that we wanted
to remove from android-mainline without breaking vendor drivers
that relied on these stubs.

Unfortunately, when the android release branches (android14-6.1
and android15-6.6) forked from android-mainline, the stubs were
kept.

In some cases, the functionality dropped was re-added to the
release branches, but using new function names. Drivers that
continued to use the old names, would then end up using the stub
impelementations, likely without noticing.

Lets try to clean this up by removing the stub header.

This should not affect the GKI KABI, and pre-existing modules
should continue to work, but when modules are re-build, they
may run into build issues and will need tweaks to remove the
old stub functions.

Bug: 332588830
Change-Id: I516913f2e4c36e6edbffb3c12b633a158ba04287
Signed-off-by: John Stultz <jstultz@google.com>
2024-05-16 14:00:33 +00:00
Greg Kroah-Hartman
6147e04a86 Revert "Bluetooth: hci_sync: Fix overwriting request callback"
This reverts commit da77c1d39b which is
commit 2615fd9a7c2507eb3be3fbe49dcec88a2f56454a upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I4250b5552873f25a1a0dec32159511eeb96aac9a
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-05-16 13:44:35 +00:00
Greg Kroah-Hartman
c0dded0f8b Revert "Bluetooth: fix use-after-free in accessing skb after sending it"
This reverts commit 715264ad09 which is
commit 947ec0d002dce8577b655793dcc6fc78d67b7cb6 upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: Icc979230a67566ee6a64cee43c91ec710c53c019
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-05-16 13:44:02 +00:00
Greg Kroah-Hartman
7386876ffd Revert "Bluetooth: hci_core: Fix missing instances using HCI_MAX_AD_LENGTH"
This reverts commit 99f30e12e5 which is
commit db08722fc7 upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I8de43981e4a64a6484e85d0e2f3ad77f0dd11f23
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-05-16 13:41:48 +00:00
Greg Kroah-Hartman
0ba60e394b Revert "Bluetooth: Fix eir name length"
This reverts commit 262a77d85e which is
commit 2ab3e8d67fc1d4a7638b769cf83023ec209fc0a9 upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: Iaeeb3fa9c2f11e4e24d212a7c703cda24c01fa65
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-05-16 13:41:21 +00:00
Natanael Copa
ff903561b7 UPSTREAM: tools/resolve_btfids: fix build with musl libc
commit 62248b22d01e96a4d669cde0d7005bd51ebf9e76 upstream.

Include the header that defines u32.
This fixes build of 6.6.23 and 6.1.83 kernels for Alpine Linux, which
uses musl libc. I assume that GNU libc indirecly pulls in linux/types.h.

Fixes: 9707ac4fe2f5 ("tools/resolve_btfids: Refactor set sorting with types from btf_ids.h")
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218647
Cc: stable@vger.kernel.org
Change-Id: I34cd9d80bc1623c0caa1c2f894710e6640b4c0bc
Signed-off-by: Natanael Copa <ncopa@alpinelinux.org>
Tested-by: Greg Thelen <gthelen@google.com>
Link: https://lore.kernel.org/r/20240328110103.28734-1-ncopa@alpinelinux.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 7b970a145c)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-05-16 09:35:28 +00:00
Greg Kroah-Hartman
0328f7d241 Merge 6.1.83 into android14-6.1-lts
Changes in 6.1.83
	md: fix data corruption for raid456 when reshape restart while grow up
	md/raid10: prevent soft lockup while flush writes
	io_uring/unix: drop usage of io_uring socket
	io_uring: drop any code related to SCM_RIGHTS
	nfsd: allow nfsd_file_get to sanely handle a NULL pointer
	nfsd: don't open-code clear_and_wake_up_bit
	nfsd: NFSD_FILE_KEY_INODE only needs to find GC'ed entries
	nfsd: simplify test_bit return in NFSD_FILE_KEY_FULL comparator
	nfsd: don't kill nfsd_files because of lease break error
	nfsd: add some comments to nfsd_file_do_acquire
	nfsd: don't take/put an extra reference when putting a file
	nfsd: update comment over __nfsd_file_cache_purge
	nfsd: allow reaping files still under writeback
	NFSD: Convert filecache to rhltable
	nfsd: simplify the delayed disposal list code
	NFSD: Fix problem of COMMIT and NFS4ERR_DELAY in infinite loop
	NFSD: Add an nfsd4_encode_nfstime4() helper
	nfsd: Fix creation time serialization order
	media: rkisp1: Fix IRQ handling due to shared interrupts
	perf/arm-cmn: Workaround AmpereOneX errata AC04_MESH_1 (incorrect child count)
	selftests: tls: use exact comparison in recv_partial
	ASoC: rt5645: Make LattePanda board DMI match more precise
	ASoC: amd: yc: Fix non-functional mic on Lenovo 82UU
	x86/xen: Add some null pointer checking to smp.c
	MIPS: Clear Cause.BD in instruction_pointer_set
	HID: multitouch: Add required quirk for Synaptics 0xcddc device
	gen_compile_commands: fix invalid escape sequence warning
	arm64/sve: Lower the maximum allocation for the SVE ptrace regset
	soc: microchip: Fix POLARFIRE_SOC_SYS_CTRL input prompt
	RDMA/mlx5: Fix fortify source warning while accessing Eth segment
	RDMA/mlx5: Relax DEVX access upon modify commands
	riscv: dts: sifive: add missing #interrupt-cells to pmic
	x86/mm: Move is_vsyscall_vaddr() into asm/vsyscall.h
	x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault()
	net/iucv: fix the allocation size of iucv_path_table array
	parisc/ftrace: add missing CONFIG_DYNAMIC_FTRACE check
	block: sed-opal: handle empty atoms when parsing response
	dm-verity, dm-crypt: align "struct bvec_iter" correctly
	arm64: dts: Fix dtc interrupt_provider warnings
	btrfs: fix data races when accessing the reserved amount of block reserves
	btrfs: fix data race at btrfs_use_block_rsv() when accessing block reserve
	net: smsc95xx: add support for SYS TEC USB-SPEmodule1
	wifi: mac80211: only call drv_sta_rc_update for uploaded stations
	ASoC: amd: yc: Add Lenovo ThinkBook 21J0 into DMI quirk table
	scsi: mpt3sas: Prevent sending diag_reset when the controller is ready
	ALSA: hda/realtek - ALC285 reduce pop noise from Headphone port
	drm/amdgpu: Enable gpu reset for S3 abort cases on Raven series
	ASoC: amd: yc: Fix non-functional mic on Lenovo 21J2
	Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security
	Bluetooth: mgmt: Fix limited discoverable off timeout
	firewire: core: use long bus reset on gap count error
	arm64: tegra: Set the correct PHY mode for MGBE
	ASoC: Intel: bytcr_rt5640: Add an extra entry for the Chuwi Vi8 tablet
	Input: gpio_keys_polled - suppress deferred probe error for gpio
	ASoC: wm8962: Enable oscillator if selecting WM8962_FLL_OSC
	ASoC: wm8962: Enable both SPKOUTR_ENA and SPKOUTL_ENA in mono mode
	ASoC: wm8962: Fix up incorrect error message in wm8962_set_fll
	do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
	fs: Fix rw_hint validation
	s390/dasd: add autoquiesce feature
	s390/dasd: Use dev_*() for device log messages
	s390/dasd: fix double module refcount decrement
	rcu/exp: Fix RCU expedited parallel grace period kworker allocation failure recovery
	rcu/exp: Handle RCU expedited grace period kworker allocation failure
	nbd: null check for nla_nest_start
	fs/select: rework stack allocation hack for clang
	md: Don't clear MD_CLOSING when the raid is about to stop
	lib/cmdline: Fix an invalid format specifier in an assertion msg
	lib: memcpy_kunit: Fix an invalid format specifier in an assertion msg
	time: test: Fix incorrect format specifier
	rtc: test: Fix invalid format specifier.
	io_uring/net: unify how recvmsg and sendmsg copy in the msghdr
	io_uring/net: move receive multishot out of the generic msghdr path
	io_uring/net: fix overflow check in io_recvmsg_mshot_prep()
	aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
	x86/resctrl: Implement new mba_MBps throttling heuristic
	x86/sme: Fix memory encryption setting if enabled by default and not overridden
	timekeeping: Fix cross-timestamp interpolation on counter wrap
	timekeeping: Fix cross-timestamp interpolation corner case decision
	timekeeping: Fix cross-timestamp interpolation for non-x86
	sched/fair: Take the scheduling domain into account in select_idle_smt()
	sched/fair: Take the scheduling domain into account in select_idle_core()
	wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()
	wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled
	wifi: b43: Stop/wake correct queue in PIO Tx path when QoS is disabled
	wifi: b43: Stop correct queue in DMA worker when QoS is disabled
	wifi: b43: Disable QoS for bcm4331
	wifi: wilc1000: fix declarations ordering
	wifi: wilc1000: fix RCU usage in connect path
	wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work
	wifi: wilc1000: do not realloc workqueue everytime an interface is added
	wifi: wilc1000: fix multi-vif management when deleting a vif
	wifi: mwifiex: debugfs: Drop unnecessary error check for debugfs_create_dir()
	ARM: dts: renesas: r8a73a4: Fix external clocks and clock rate
	cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value
	cpufreq: Explicitly include correct DT includes
	cpufreq: mediatek-hw: Wait for CPU supplies before probing
	sock_diag: annotate data-races around sock_diag_handlers[family]
	inet_diag: annotate data-races around inet_diag_table[]
	bpftool: Silence build warning about calloc()
	libbpf: Apply map_set_def_max_entries() for inner_maps on creation
	selftest/bpf: Add map_in_maps with BPF_MAP_TYPE_PERF_EVENT_ARRAY values
	af_unix: Annotate data-race of gc_in_progress in wait_for_unix_gc().
	cpufreq: mediatek-hw: Don't error out if supply is not found
	libbpf: Fix faccessat() usage on Android
	pmdomain: qcom: rpmhpd: Drop SA8540P gfx.lvl
	arm64: dts: imx8mm-kontron: Disable pullups for I2C signals on OSM-S i.MX8MM
	arm64: dts: imx8mm-kontron: Disable pullups for I2C signals on SL/BL i.MX8MM
	arm64: dts: imx8mm-kontron: Disable pullups for onboard UART signals on BL OSM-S board
	arm64: dts: imx8mm-kontron: Disable pullups for onboard UART signals on BL board
	arm64: dts: imx8mm-kontron: Disable pull resistors for SD card signals on BL OSM-S board
	arm64: dts: imx8mm-kontron: Disable pull resistors for SD card signals on BL board
	arm64: dts: imx8mm-kontron: Fix interrupt for RTC on OSM-S i.MX8MM module
	libbpf: Add missing LIBBPF_API annotation to libbpf_set_memlock_rlim API
	wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete
	wifi: iwlwifi: mvm: report beacon protection failures
	wifi: iwlwifi: dbg-tlv: ensure NUL termination
	wifi: iwlwifi: fix EWRD table validity check
	gpio: vf610: allow disabling the vf610 driver
	arm64: dts: imx8mm-venice-gw71xx: fix USB OTG VBUS
	pwm: atmel-hlcdc: Convert to platform remove callback returning void
	pwm: atmel-hlcdc: Use consistent variable naming
	pwm: atmel-hlcdc: Fix clock imbalance related to suspend support
	net: blackhole_dev: fix build warning for ethh set but not used
	wifi: ath11k: initialize rx_mcs_80 and rx_mcs_160 before use
	wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
	wifi: wfx: fix memory leak when starting AP
	printk: Disable passing console lock owner completely during panic()
	pwm: sti: Fix capture for st,pwm-num-chan < st,capture-num-chan
	tools/resolve_btfids: Refactor set sorting with types from btf_ids.h
	tools/resolve_btfids: Fix cross-compilation to non-host endianness
	wifi: iwlwifi: mvm: don't set replay counters to 0xff
	s390/pai: fix attr_event_free upper limit for pai device drivers
	s390/vdso: drop '-fPIC' from LDFLAGS
	selftests: forwarding: Add missing config entries
	selftests: forwarding: Add missing multicast routing config entries
	ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down()
	arm64: dts: mt8183: kukui: Split out keyboard node and describe detachables
	arm64: dts: mt8183: Move CrosEC base detection node to kukui-based DTs
	arm64: dts: mediatek: mt7986: add "#reset-cells" to infracfg
	arm64: dts: mediatek: mt8192-asurada: Remove CrosEC base detection node
	arm64: dts: mediatek: mt8192: fix vencoder clock name
	arm64: dts: mediatek: mt7622: add missing "device_type" to memory nodes
	bpf: Mark bpf_spin_{lock,unlock}() helpers with notrace correctly
	ARM: dts: qcom: msm8974: correct qfprom node size
	wifi: wilc1000: prevent use-after-free on vif when cleaning up all interfaces
	ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()
	bus: tegra-aconnect: Update dependency to ARCH_TEGRA
	iommu/amd: Mark interrupt as managed
	wifi: brcmsmac: avoid function pointer casts
	arm64: dts: qcom: sdm845-db845c: correct PCIe wake-gpios
	arm64: dts: qcom: sm8150: use 'gpios' suffix for PCI GPIOs
	arm64: dts: qcom: sm8150: correct PCIe wake-gpios
	powercap: dtpm_cpu: Fix error check against freq_qos_add_request()
	net: ena: Remove ena_select_queue
	arm64: dts: mt8195-cherry-tomato: change watchdog reset boot flow
	firmware: arm_scmi: Fix double free in SMC transport cleanup path
	wifi: wilc1000: revert reset line logic flip
	ARM: dts: arm: realview: Fix development chip ROM compatible value
	arm64: dts: renesas: r9a07g043: Split out RZ/G2UL SoC specific parts
	arm64: dts: renesas: r9a07g043u: Add IRQC node
	arm64: dts: renesas: rzg2l: Add missing interrupts to IRQC nodes
	arm64: dts: renesas: r8a779a0: Update to R-Car Gen4 compatible values
	arm64: dts: renesas: r8a779a0: Correct avb[01] reg sizes
	arm64: dts: renesas: r8a779g0: Correct avb[01] reg sizes
	net: mctp: copy skb ext data when fragmenting
	pstore: inode: Convert mutex usage to guard(mutex)
	pstore: inode: Only d_invalidate() is needed
	arm64: dts: allwinner: h6: Add RX DMA channel for SPDIF
	ARM: dts: imx6dl-yapp4: Move phy reset into switch node
	ARM: dts: imx6dl-yapp4: Fix typo in the QCA switch register address
	ARM: dts: imx6dl-yapp4: Move the internal switch PHYs under the switch node
	arm64: dts: marvell: reorder crypto interrupts on Armada SoCs
	ACPI: resource: Add Infinity laptops to irq1_edge_low_force_override
	ACPI: resource: Do IRQ override on Lunnen Ground laptops
	ACPI: resource: Add MAIBENBEN X577 to irq1_edge_low_force_override
	ACPI: scan: Fix device check notification handling
	arm64: dts: rockchip: add missing interrupt-names for rk356x vdpu
	x86, relocs: Ignore relocations in .notes section
	SUNRPC: fix some memleaks in gssx_dec_option_array
	mmc: wmt-sdmmc: remove an incorrect release_mem_region() call in the .remove function
	ACPI: CPPC: enable AMD CPPC V2 support for family 17h processors
	wifi: rtw88: 8821c: Fix beacon loss and disconnect
	wifi: rtw88: 8821c: Fix false alarm count
	PCI: Make pci_dev_is_disconnected() helper public for other drivers
	iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected
	igb: Fix missing time sync events
	Bluetooth: Remove HCI_POWER_OFF_TIMEOUT
	Bluetooth: mgmt: Remove leftover queuing of power_off work
	Bluetooth: Remove superfluous call to hci_conn_check_pending()
	Bluetooth: hci_qca: don't use IS_ERR_OR_NULL() with gpiod_get_optional()
	Bluetooth: Cancel sync command before suspend and power off
	Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running
	Bluetooth: hci_conn: Consolidate code for aborting connections
	Bluetooth: hci_core: Cancel request on command timeout
	Bluetooth: hci_sync: Fix overwriting request callback
	Bluetooth: hci_core: Fix possible buffer overflow
	Bluetooth: af_bluetooth: Fix deadlock
	Bluetooth: fix use-after-free in accessing skb after sending it
	sr9800: Add check for usbnet_get_endpoints
	s390/cache: prevent rebuild of shared_cpu_list
	bpf: Fix DEVMAP_HASH overflow check on 32-bit arches
	bpf: Fix hashtab overflow check on 32-bit arches
	bpf: Fix stackmap overflow check on 32-bit arches
	iommu/vt-d: Retrieve IOMMU perfmon capability information
	iommu: Fix compilation without CONFIG_IOMMU_INTEL
	ipv6: fib6_rules: flush route cache when rule is changed
	net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()
	net: phy: fix phy_get_internal_delay accessing an empty array
	net: hns3: fix wrong judgment condition issue
	net: hns3: fix kernel crash when 1588 is received on HIP08 devices
	net: hns3: fix port duplex configure error in IMP reset
	Bluetooth: MGMT: Fix always using HCI_MAX_AD_LENGTH
	Bluetooth: hci_core: Fix missing instances using HCI_MAX_AD_LENGTH
	Bluetooth: Fix eir name length
	net: phy: dp83822: Fix RGMII TX delay configuration
	OPP: debugfs: Fix warning around icc_get_name()
	tcp: fix incorrect parameter validation in the do_tcp_getsockopt() function
	ipmr: fix incorrect parameter validation in the ip_mroute_getsockopt() function
	l2tp: fix incorrect parameter validation in the pppol2tp_getsockopt() function
	udp: fix incorrect parameter validation in the udp_lib_getsockopt() function
	net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function
	net/x25: fix incorrect parameter validation in the x25_getsockopt() function
	nfp: flower: handle acti_netdevs allocation failure
	bpf: hardcode BPF_PROG_PACK_SIZE to 2MB * num_possible_nodes()
	dm raid: fix false positive for requeue needed during reshape
	dm: call the resume method on internal suspend
	drm/tegra: dsi: Add missing check for of_find_device_by_node
	drm/tegra: dpaux: Fix PM disable depth imbalance in tegra_dpaux_probe
	drm/tegra: dsi: Make use of the helper function dev_err_probe()
	drm/tegra: dsi: Fix some error handling paths in tegra_dsi_probe()
	drm/tegra: dsi: Fix missing pm_runtime_disable() in the error handling path of tegra_dsi_probe()
	drm/tegra: hdmi: Convert to devm_platform_ioremap_resource()
	drm/tegra: hdmi: Fix some error handling paths in tegra_hdmi_probe()
	drm/tegra: rgb: Fix some error handling paths in tegra_dc_rgb_probe()
	drm/tegra: rgb: Fix missing clk_put() in the error handling paths of tegra_dc_rgb_probe()
	drm/tegra: output: Fix missing i2c_put_adapter() in the error handling paths of tegra_output_probe()
	drm/rockchip: inno_hdmi: Fix video timing
	drm: Don't treat 0 as -1 in drm_fixp2int_ceil
	drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node
	drm/rockchip: lvds: do not overwrite error code
	drm/rockchip: lvds: do not print scary message when probing defer
	drm/panel-edp: use put_sync in unprepare
	drm/lima: fix a memleak in lima_heap_alloc
	ASoC: amd: acp: Add missing error handling in sof-mach
	dmaengine: tegra210-adma: Update dependency to ARCH_TEGRA
	media: tc358743: register v4l2 async device only after successful setup
	PCI/DPC: Print all TLP Prefixes, not just the first
	perf record: Fix possible incorrect free in record__switch_output()
	HID: lenovo: Add middleclick_workaround sysfs knob for cptkbd
	drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()'
	drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()'
	pinctrl: renesas: r8a779g0: Add Audio SSI pins, groups, and functions
	pinctrl: renesas: r8a779g0: Add missing SCIF_CLK2 pin group/function
	clk: samsung: exynos850: Propagate SPI IPCLK rate change
	perf evsel: Fix duplicate initialization of data->id in evsel__parse_sample()
	clk: meson: Add missing clocks to axg_clk_regmaps
	media: em28xx: annotate unchecked call to media_device_register()
	media: v4l2-tpg: fix some memleaks in tpg_alloc
	media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity
	media: edia: dvbdev: fix a use-after-free
	pinctrl: mediatek: Drop bogus slew rate register range for MT8186
	pinctrl: mediatek: Drop bogus slew rate register range for MT8192
	clk: qcom: reset: Commonize the de/assert functions
	clk: qcom: reset: Ensure write completion on reset de/assertion
	quota: simplify drop_dquot_ref()
	quota: Fix potential NULL pointer dereference
	quota: Fix rcu annotations of inode dquot pointers
	PCI: switchtec: Fix an error handling path in switchtec_pci_probe()
	crypto: xilinx - call finalize with bh disabled
	perf thread_map: Free strlist on normal path in thread_map__new_by_tid_str()
	drm/msm/dpu: fix the programming of INTF_CFG2_DATA_HCTL_EN
	drm/msm/dpu: Only enable DSC_MODE_MULTIPLEX if dsc_merge is enabled
	drm/radeon/ni: Fix wrong firmware size logging in ni_init_microcode()
	clk: renesas: r8a779g0: Add CMT clocks
	clk: renesas: r8a779g0: Add Audio clocks
	clk: renesas: r8a779g0: Add thermal clock
	clk: renesas: r8a779g0: Correct PFC/GPIO parent clocks
	clk: renesas: r8a779f0: Correct PFC/GPIO parent clock
	ALSA: seq: fix function cast warnings
	perf stat: Avoid metric-only segv
	ASoC: meson: aiu: fix function pointer type mismatch
	ASoC: meson: t9015: fix function pointer type mismatch
	powerpc: Force inlining of arch_vmap_p{u/m}d_supported()
	ASoC: SOF: Introduce container struct for SOF firmware
	ASoC: SOF: Add some bounds checking to firmware data
	NTB: EPF: fix possible memory leak in pci_vntb_probe()
	NTB: fix possible name leak in ntb_register_device()
	media: cedrus: h265: Associate mv col buffers with buffer
	media: cedrus: h265: Fix configuring bitstream size
	media: sun8i-di: Fix coefficient writes
	media: sun8i-di: Fix power on/off sequences
	media: sun8i-di: Fix chroma difference threshold
	media: imx: csc/scaler: fix v4l2_ctrl_handler memory leak
	media: go7007: add check of return value of go7007_read_addr()
	media: pvrusb2: remove redundant NULL check
	media: pvrusb2: fix pvr2_stream_callback casts
	clk: qcom: dispcc-sdm845: Adjust internal GDSC wait times
	drm/mediatek: dsi: Fix DSI RGB666 formats and definitions
	PCI: Mark 3ware-9650SE Root Port Extended Tags as broken
	clk: hisilicon: hi3519: Release the correct number of gates in hi3519_clk_unregister()
	clk: hisilicon: hi3559a: Fix an erroneous devm_kfree()
	drm/tegra: put drm_gem_object ref on error in tegra_fb_create
	mfd: syscon: Call of_node_put() only when of_parse_phandle() takes a ref
	mfd: altera-sysmgr: Call of_node_put() only when of_parse_phandle() takes a ref
	crypto: arm/sha - fix function cast warnings
	crypto: jitter - fix CRYPTO_JITTERENTROPY help text
	drm/tidss: Fix initial plane zpos values
	drm/tidss: Fix sync-lost issue with two displays
	mtd: maps: physmap-core: fix flash size larger than 32-bit
	mtd: rawnand: lpc32xx_mlc: fix irq handler prototype
	ASoC: meson: axg-tdm-interface: fix mclk setup without mclk-fs
	ASoC: meson: axg-tdm-interface: add frame rate constraint
	HID: amd_sfh: Update HPD sensor structure elements
	HID: amd_sfh: Avoid disabling the interrupt
	drm/amdgpu: Fix missing break in ATOM_ARG_IMM Case of atom_get_src_int()
	media: pvrusb2: fix uaf in pvr2_context_set_notify
	media: dvb-frontends: avoid stack overflow warnings with clang
	media: go7007: fix a memleak in go7007_load_encoder
	media: ttpci: fix two memleaks in budget_av_attach
	media: mediatek: vcodec: avoid -Wcast-function-type-strict warning
	gpio: nomadik: fix offset bug in nmk_pmx_set()
	drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip
	powerpc/pseries: Fix potential memleak in papr_get_attr()
	powerpc/hv-gpci: Fix the H_GET_PERF_COUNTER_INFO hcall return value checks
	drm/msm/dpu: add division of drm_display_mode's hskew parameter
	modules: wait do_free_init correctly
	powerpc/embedded6xx: Fix no previous prototype for avr_uart_send() etc.
	leds: aw2013: Unlock mutex before destroying it
	leds: sgm3140: Add missing timer cleanup and flash gpio control
	backlight: lm3630a: Initialize backlight_properties on init
	backlight: lm3630a: Don't set bl->props.brightness in get_brightness
	backlight: da9052: Fully initialize backlight_properties during probe
	backlight: lm3639: Fully initialize backlight_properties during probe
	backlight: lp8788: Fully initialize backlight_properties during probe
	sparc32: Fix section mismatch in leon_pci_grpci
	clk: Fix clk_core_get NULL dereference
	clk: zynq: Prevent null pointer dereference caused by kmalloc failure
	ALSA: hda/realtek: fix ALC285 issues on HP Envy x360 laptops
	ALSA: usb-audio: Stop parsing channels bits when all channels are found.
	RDMA/irdma: Allow accurate reporting on QP max send/recv WR
	RDMA/irdma: Remove duplicate assignment
	RDMA/srpt: Do not register event handler until srpt device is fully setup
	f2fs: reduce stack memory cost by using bitfield in struct f2fs_io_info
	f2fs: compress: fix to guarantee persisting compressed blocks by CP
	f2fs: compress: fix to cover normal cluster write with cp_rwsem
	f2fs: compress: fix to check unreleased compressed cluster
	f2fs: simplify __allocate_data_block
	f2fs: delete obsolete FI_FIRST_BLOCK_WRITTEN
	f2fs: delete obsolete FI_DROP_CACHE
	f2fs: introduce get_dnode_addr() to clean up codes
	f2fs: update blkaddr in __set_data_blkaddr() for cleanup
	f2fs: compress: fix to avoid inconsistence bewteen i_blocks and dnode
	f2fs: compress: fix to cover f2fs_disable_compressed_file() w/ i_sem
	f2fs: fix to avoid potential panic during recovery
	scsi: csiostor: Avoid function pointer casts
	RDMA/hns: Fix mis-modifying default congestion control algorithm
	RDMA/device: Fix a race between mad_client and cm_client init
	RDMA/rtrs-clt: Check strnlen return len in sysfs mpath_policy_store()
	scsi: bfa: Fix function pointer type mismatch for hcb_qe->cbfn
	f2fs: compress: fix to check zstd compress level correctly in mount option
	net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr()
	NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102
	NFSv4.2: fix listxattr maximum XDR buffer size
	f2fs: compress: fix to check compress flag w/ .i_sem lock
	f2fs: check number of blocks in a current section
	watchdog: stm32_iwdg: initialize default timeout
	f2fs: ro: compress: fix to avoid caching unaligned extent
	NFS: Fix an off by one in root_nfs_cat()
	f2fs: convert to use sbi directly
	f2fs: compress: relocate some judgments in f2fs_reserve_compress_blocks
	f2fs: compress: fix reserve_cblocks counting error when out of space
	perf/x86/amd/core: Avoid register reset when CPU is dead
	afs: Revert "afs: Hide silly-rename files from userspace"
	nfs: fix panic when nfs4_ff_layout_prepare_ds() fails
	io_uring/net: correct the type of variable
	comedi: comedi_test: Prevent timers rescheduling during deletion
	remoteproc: stm32: use correct format strings on 64-bit
	remoteproc: stm32: Fix incorrect type in assignment for va
	remoteproc: stm32: Fix incorrect type assignment returned by stm32_rproc_get_loaded_rsc_tablef
	usb: phy: generic: Get the vbus supply
	tty: vt: fix 20 vs 0x20 typo in EScsiignore
	serial: max310x: fix syntax error in IRQ error message
	tty: serial: samsung: fix tx_empty() to return TIOCSER_TEMT
	arm64: dts: broadcom: bcmbca: bcm4908: drop invalid switch cells
	kconfig: fix infinite loop when expanding a macro at the end of file
	hwtracing: hisi_ptt: Move type check to the beginning of hisi_ptt_pmu_event_init()
	rtc: mt6397: select IRQ_DOMAIN instead of depending on it
	serial: 8250_exar: Don't remove GPIO device on suspend
	staging: greybus: fix get_channel_from_mode() failure path
	usb: gadget: net2272: Use irqflags in the call to net2272_probe_fin
	ASoC: rockchip: i2s-tdm: Fix inaccurate sampling rates
	nouveau: reset the bo resource bus info after an eviction
	tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge()
	rds: tcp: Fix use-after-free of net in reqsk_timer_handler().
	octeontx2-af: Use matching wake_up API variant in CGX command interface
	s390/vtime: fix average steal time calculation
	net/sched: taprio: proper TCA_TAPRIO_TC_ENTRY_INDEX check
	soc: fsl: dpio: fix kcalloc() argument order
	tcp: Fix refcnt handling in __inet_hash_connect().
	hsr: Fix uninit-value access in hsr_get_node()
	nvme: only set reserved_tags in nvme_alloc_io_tag_set for fabrics controllers
	nvme: add the Apple shared tag workaround to nvme_alloc_io_tag_set
	nvme: fix reconnection fail due to reserved tag allocation
	net: mediatek: mtk_eth_soc: clear MAC_MCR_FORCE_LINK only when MAC is up
	net: ethernet: mtk_eth_soc: fix PPE hanging issue
	packet: annotate data-races around ignore_outgoing
	net: veth: do not manipulate GRO when using XDP
	net: dsa: mt7530: prevent possible incorrect XTAL frequency selection
	drm: Fix drm_fixp2int_round() making it add 0.5
	vdpa_sim: reset must not run
	vdpa/mlx5: Allow CVQ size changes
	wireguard: receive: annotate data-race around receiving_counter.counter
	rds: introduce acquire/release ordering in acquire/release_in_xmit()
	hsr: Handle failures in module init
	ipv4: raw: Fix sending packets from raw sockets via IPsec tunnels
	net: phy: fix phy_read_poll_timeout argument type in genphy_loopback
	dm-integrity: fix a memory leak when rechecking the data
	net/bnx2x: Prevent access to a freed page in page_pool
	octeontx2-af: recover CPT engine when it gets fault
	octeontx2-af: add mbox for CPT LF reset
	octeontx2-af: optimize cpt pf identification
	octeontx2-af: add mbox to return CPT_AF_FLT_INT info
	octeontx2: Detect the mbox up or down message via register
	net: octeontx2: Use alloc_ordered_workqueue() to create ordered workqueues
	octeontx2-pf: Use default max_active works instead of one
	octeontx2-pf: Send UP messages to VF only when VF is up.
	octeontx2-af: Use separate handlers for interrupts
	netfilter: nft_set_pipapo: release elements in clone only from destroy path
	netfilter: nf_tables: do not compare internal table flags on updates
	rcu: add a helper to report consolidated flavor QS
	net: report RCU QS on threaded NAPI repolling
	bpf: report RCU QS in cpumap kthread
	net: dsa: mt7530: fix link-local frames that ingress vlan filtering ports
	net: dsa: mt7530: fix handling of all link-local frames
	spi: spi-mt65xx: Fix NULL pointer access in interrupt handler
	selftests: forwarding: Fix ping failure due to short timeout
	dm: address indent/space issues
	dm io: Support IO priority
	dm-integrity: align the outgoing bio in integrity_recheck
	x86/efistub: Clear decompressor BSS in native EFI entrypoint
	x86/efistub: Don't clear BSS twice in mixed mode
	remoteproc: stm32: fix incorrect optional pointers
	Linux 6.1.83

Change-Id: I621b271ff4a4603b0a348b64edc9c942bf050047
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-05-15 12:13:59 +00:00
Greg Kroah-Hartman
96cbfc5879 Merge 6.1.82 into android14-6.1-lts
Changes in 6.1.82
	ceph: switch to corrected encoding of max_xattr_size in mdsmap
	net: lan78xx: fix runtime PM count underflow on link stop
	ixgbe: {dis, en}able irqs in ixgbe_txrx_ring_{dis, en}able
	i40e: disable NAPI right after disabling irqs when handling xsk_pool
	ice: reorder disabling IRQ and NAPI in ice_qp_dis
	tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string
	geneve: make sure to pull inner header in geneve_rx()
	net: sparx5: Fix use after free inside sparx5_del_mact_entry
	ice: virtchnl: stop pretending to support RSS over AQ or registers
	net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink()
	igc: avoid returning frame twice in XDP_REDIRECT
	net/ipv6: avoid possible UAF in ip6_route_mpath_notify()
	cpumap: Zero-initialise xdp_rxq_info struct before running XDP program
	net: dsa: microchip: fix register write order in ksz8_ind_write8()
	net/rds: fix WARNING in rds_conn_connect_if_down
	netfilter: nft_ct: fix l3num expectations with inet pseudo family
	netfilter: nf_conntrack_h323: Add protection for bmp length out of range
	erofs: apply proper VMA alignment for memory mapped files on THP
	netrom: Fix a data-race around sysctl_netrom_default_path_quality
	netrom: Fix a data-race around sysctl_netrom_obsolescence_count_initialiser
	netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser
	netrom: Fix a data-race around sysctl_netrom_transport_timeout
	netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries
	netrom: Fix a data-race around sysctl_netrom_transport_acknowledge_delay
	netrom: Fix a data-race around sysctl_netrom_transport_busy_delay
	netrom: Fix a data-race around sysctl_netrom_transport_requested_window_size
	netrom: Fix a data-race around sysctl_netrom_transport_no_activity_timeout
	netrom: Fix a data-race around sysctl_netrom_routing_control
	netrom: Fix a data-race around sysctl_netrom_link_fails_count
	netrom: Fix data-races around sysctl_net_busy_read
	KVM: s390: add stat counter for shadow gmap events
	KVM: s390: vsie: fix race during shadow creation
	ASoC: codecs: wcd938x: fix headphones volume controls
	drm/amd/display: Fix uninitialized variable usage in core_link_ 'read_dpcd() & write_dpcd()' functions
	nfp: flower: add goto_chain_index for ct entry
	nfp: flower: add hardware offload check for post ct entry
	readahead: avoid multiple marked readahead pages
	selftests/mm: switch to bash from sh
	selftests: mm: fix map_hugetlb failure on 64K page size systems
	xhci: process isoc TD properly when there was a transaction error mid TD.
	xhci: handle isoc Babble and Buffer Overrun events properly
	drm/amdgpu: Reset IH OVERFLOW_CLEAR bit
	x86/mmio: Disable KVM mitigation when X86_FEATURE_CLEAR_CPU_BUF is set
	Documentation/hw-vuln: Add documentation for RFDS
	x86/rfds: Mitigate Register File Data Sampling (RFDS)
	KVM/x86: Export RFDS_NO and RFDS_CLEAR to guests
	selftests: mptcp: decrease BW in simult flows
	drm/amd/display: Wrong colorimetry workaround
	drm/amd/display: Fix MST Null Ptr for RV
	getrusage: add the "signal_struct *sig" local variable
	getrusage: move thread_group_cputime_adjusted() outside of lock_task_sighand()
	getrusage: use __for_each_thread()
	getrusage: use sig->stats_lock rather than lock_task_sighand()
	fs/proc: do_task_stat: use __for_each_thread()
	fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats
	Linux 6.1.82

Change-Id: I8d895a098144f39d40badf314fbb4a632c5ace49
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-05-15 11:51:24 +00:00
Robin Hsu
274e3e9696 ANDROID: export one function for mm metrics
export function for sysfs node formating

Bug: 299190787
Change-Id: I71e6a0815efa8df99d036bf457b8a0081999f3de
Signed-off-by: Robin Hsu <robinhsu@google.com>
2024-05-15 02:15:23 +00:00
Qais Yousef
117a941226 ANDROID: Update the ABI symbol list
Adding the following symbols:
  - drm_hdmi_avi_infoframe_from_display_mode
  - hdmi_avi_infoframe_pack
  - sysctl_sched_wakeup_granularity

Bug: 337139487
Change-Id: I08ff1f4406e14fd42fee255d3eb49ccbd9c9b338
Signed-off-by: Qais Yousef <qyousef@google.com>
2024-05-14 23:31:22 +00:00
Qais Yousef
0d080e01a2 ANDROID: Export sysctl_sched_wakeup_granularity to enable modifying it
The value is only available in debugfs. Export it to allow out of tree
modules to modify it.

Bug: 337139487
Signed-off-by: Qais Yousef <qyousef@google.com>
Change-Id: I4b3a5aeeee0539b88756aacc97df6181f68d9d0d
2024-05-14 23:31:22 +00:00
Matias Ezequiel Vara Larsen
039d2a958c UPSTREAM: ALSA: virtio: use ack callback
This commit uses the ack() callback to determine when a buffer has been
updated, then exposes it to guest.

The current mechanism splits a dma buffer into descriptors that are
exposed to the device. This dma buffer is shared with the user
application. When the device consumes a buffer, the driver moves the
request from the used ring to available ring.

The driver exposes the buffer to the device without knowing if the
content has been updated from the user. The section 2.8.21.1 of the
virtio spec states that: "The device MAY access the descriptor chains
the driver created and the memory they refer to immediately". If the
device picks up buffers from the available ring just after it is
notified, it happens that the content may be old.

When the ack() callback is invoked, the driver exposes only the buffers
that have already been updated, i.e., enqueued in the available ring.
Thus, the device always picks up a buffer that is updated.

For capturing, the driver starts by exposing all the available buffers
to device. After device updates the content of a buffer, it enqueues it
in the used ring. It is only after the ack() for capturing is issued
that the driver re-enqueues the buffer in the available ring.

Co-developed-by: Anton Yakovlev <anton.yakovlev@opensynergy.com>
Signed-off-by: Anton Yakovlev <anton.yakovlev@opensynergy.com>
Signed-off-by: Matias Ezequiel Vara Larsen <mvaralar@redhat.com>
Link: https://lore.kernel.org/r/ZTjkn1YAFz67yfqx@fedora
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Bug: 331600622
Change-Id: If1269f1777432256eea0e0275b678d0d649753bb
(cherry picked from commit fe981e67568c41de6caae25d70b5f203b94452cc)
Signed-off-by: Brian Daniels <briandaniels@google.com>
2024-05-14 21:47:20 +00:00
Greg Kroah-Hartman
045f29a0bd Revert "usb: gadget: Properly configure the device for remote wakeup"
This reverts commit ed9fdc82ca which is
commit b93c2a68f3 upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: Ib55f9062147895c79170426d3455dcef12d0f25f
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-05-14 12:49:37 +00:00
Greg Kroah-Hartman
2e193db1b4 Revert "scsi: sd: usb_storage: uas: Access media prior to querying device properties"
This reverts commit b73dd5f999 which is
commit 321da3dc1f3c92a12e3c5da934090d2992a8814c upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I54aee6b89e0350b57183b081535ccc4f6d0a8638
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-05-14 12:48:35 +00:00
Greg Kroah-Hartman
3011e898b2 Revert "Bluetooth: hci_qca: mark OF related data as maybe unused"
This reverts commit eb7b5777d3 which is
commit 44fac8a2fd upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I02cc1a461bc2e554cd4aa435a6b3bf25dfcfcfd8
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-05-14 12:47:10 +00:00
Greg Kroah-Hartman
a3778f3e13 Revert "Bluetooth: hci_qca: Add support for QTI Bluetooth chip wcn6855"
This reverts commit e5383662fd which is
commit 095327fede upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I705d791c9553d22c3c1d286c6c77ead07e0b1428
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-05-14 12:47:09 +00:00
Greg Kroah-Hartman
d9340ec8dd Revert "Bluetooth: btqca: use le32_to_cpu for ver.soc_id"
This reverts commit 29059d0f3b which is
commit 8153b738bc upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I8399038f8d89a402d22d1071e4a503eab05d6174
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-05-14 12:47:08 +00:00
Greg Kroah-Hartman
b904eebfd4 Revert "Bluetooth: btqca: Add WCN3988 support"
This reverts commit 9409636132 which is
commit f904feefe6 upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I1ca051a8ba0f510b7c48a13856ed54859d09f67c
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-05-14 12:47:06 +00:00
Greg Kroah-Hartman
55a316da31 Revert "Bluetooth: qca: use switch case for soc type behavior"
This reverts commit fc47ed389a which is
commit 691d54d0f7 upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I0b3cbead808d92dc25ae36021fd853ed197f15ef
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-05-14 12:47:05 +00:00
Greg Kroah-Hartman
360b41bc65 Revert "Bluetooth: qca: add support for WCN7850"
This reverts commit 67ffc334b9 which is
commit 67ffc334b9 upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I62f7e652e6cd20291b5897431865e8a3ebbacb4d
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-05-14 12:47:04 +00:00
Greg Kroah-Hartman
e075d7f47a Revert "Bluetooth: hci_qca: Set BDA quirk bit if fwnode exists in DT"
This reverts commit 92b8a3273f which is
commit 7dcd3e014aa7faeeaf4047190b22d8a19a0db696 upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I652f40ab304425a2c5418431515df4e1afa3193e
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-05-14 12:47:03 +00:00
RD Babiera
47dfe41d57 UPSTREAM: usb: typec: tcpm: clear pd_event queue in PORT_RESET
When a Fast Role Swap control message attempt results in a transition
to ERROR_RECOVERY, the TCPC can still queue a TCPM_SOURCING_VBUS event.

If the event is queued but processed after the tcpm_reset_port() call
in the PORT_RESET state, then the following occurs:
1. tcpm_reset_port() calls tcpm_init_vbus() to reset the vbus sourcing and
sinking state
2. tcpm_pd_event_handler() turns VBUS on before the port is in the default
state.
3. The port resolves as a sink. In the SNK_DISCOVERY state,
tcpm_set_charge() cannot set vbus to charge.

Clear pd events within PORT_RESET to get rid of non-applicable events.

Fixes: b17dd57118 ("staging: typec: tcpm: Improve role swap with non PD capable partners")
Cc: stable@vger.kernel.org
Signed-off-by: RD Babiera <rdbabiera@google.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/20240423202715.3375827-2-rdbabiera@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 311127232
(cherry picked from commit bf20c69cf3cf9c6445c4925dd9a8a6ca1b78bfdf)
Change-Id: I9b27d040d0acdeb2af74fd3fe90d246b864b5141
Signed-off-by: RD Babiera <rdbabiera@google.com>
2024-05-14 09:29:14 +00:00
RD Babiera
93188d7732 BACKPORT: usb: typec: tcpm: enforce ready state when queueing alt mode vdm
Before sending Enter Mode for an Alt Mode, there is a gap between Discover
Modes and the Alt Mode driver queueing the Enter Mode VDM for the port
partner to send a message to the port.

If this message results in unregistering Alt Modes such as in a DR_SWAP,
then the following deadlock can occur with respect to the DisplayPort Alt
Mode driver:
1. The DR_SWAP state holds port->lock. Unregistering the Alt Mode driver
results in a cancel_work_sync() that waits for the current dp_altmode_work
to finish.
2. dp_altmode_work makes a call to tcpm_altmode_enter. The deadlock occurs
because tcpm_queue_vdm_unlock attempts to hold port->lock.

Before attempting to grab the lock, ensure that the port is in a state
vdm_run_state_machine can run in. Alt Mode unregistration will not occur
in these states.

Fixes: 03eafcfb60 ("usb: typec: tcpm: Add tcpm_queue_vdm_unlocked() helper")
Cc: stable@vger.kernel.org
Signed-off-by: RD Babiera <rdbabiera@google.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/20240423202356.3372314-2-rdbabiera@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 333787869
(cherry picked from commit cdc9946ea6377e8e214b135ccc308c5e514ba25f)
[rd: removed SRC_VDM_IDENTITY_REQUEST check, state not defined in branch]
Change-Id: I8018d1fdc294885ae609b6e45e9bf6ab190897b9
Signed-off-by: RD Babiera <rdbabiera@google.com>
2024-05-14 09:28:19 +00:00
Joe Fradley
4d55129aea UPSTREAM: crypto: x86/curve25519 - disable gcov
curve25519-x86_64.c fails to build when CONFIG_GCOV_KERNEL is enabled.
The error is "inline assembly requires more registers than available"
thrown from the `fsqr()` function. Therefore, excluding this file from
GCOV profiling until this issue is resolved. Thereby allowing
CONFIG_GCOV_PROFILE_ALL to be enabled for x86.

Change-Id: Icbb1ed0e1b99f1cb0a21ea7a2920b3edce70c38d
Signed-off-by: Joe Fradley <joefradley@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
(cherry picked from commit c390c452eb)
2024-05-10 12:38:46 +00:00
Priyansh Jain
cf685d2b02 ANDROID: GKI: Update QCOM symbol list and ABI STG
Update QCOM symbol list in android/abi_gki_aarch64_qcom with following
symbols.

4 function symbol(s) added
  'struct powercap_control_type* powercap_register_control_type(struct powercap_control_type*,
       const char*, const struct powercap_control_type_ops*)'
  'struct powercap_zone* powercap_register_zone(struct powercap_zone*,
       struct powercap_control_type*, const char*, struct powercap_zone*,
       const struct powercap_zone_ops*, int, const struct powercap_zone_constraint_ops*)'
  'int powercap_unregister_control_type(struct powercap_control_type*)'
  'int powercap_unregister_zone(struct powercap_control_type*, struct powercap_zone*)'

Bug: 338523446
Change-Id: Ie1305e6231532c824bd11bcc1e0abecdb55109aa
Signed-off-by: Priyansh Jain <quic_priyjain@quicinc.com>
Signed-off-by: Will McVicker <willmcvicker@google.com>
2024-05-08 18:38:43 +00:00
fengqi
fae94bc4e7 ANDROID: GKI: update symbol list file for xiaomi
INFO: 68 function symbol(s) added
  'int __break_lease(struct inode*, unsigned int, unsigned int)'
  'void __d_lookup_unhash_wake(struct dentry*)'
  'int __folio_lock_killable(struct folio*)'
  'int add_swap_extent(struct swap_info_struct*, unsigned long, unsigned long, sector_t)'
  'int asn1_ber_decoder(const struct asn1_decoder*, void*, const unsigned char*, size_t)'
  'size_t copy_page_from_iter(struct page*, size_t, size_t, struct iov_iter*)'
  'size_t copy_page_to_iter(struct page*, size_t, size_t, struct iov_iter*)'
  'struct dentry* d_alloc_parallel(struct dentry*, const struct qstr*, wait_queue_head_t*)'
  'void d_drop(struct dentry*)'
  'struct dentry* d_hash_and_lookup(struct dentry*, struct qstr*)'
  'void d_invalidate(struct dentry*)'
  'void d_move(struct dentry*, struct dentry*)'
  'void deactivate_super(struct super_block*)'
  'int errseq_check(errseq_t*, errseq_t)'
  'int file_modified(struct file*)'
  'vm_fault_t filemap_map_pages(struct vm_fault*, unsigned long, unsigned long)'
  'int finish_no_open(struct file*, struct dentry*)'
  'int finish_open(struct file*, struct dentry*, int(*)(struct inode*, struct file*))'
  'bool folio_clear_dirty_for_io(struct folio*)'
  'void folio_wait_private_2(struct folio*)'
  'int fs_param_is_bool(struct p_log*, const struct fs_parameter_spec*, struct fs_parameter*, struct fs_parse_result*)'
  'int fs_param_is_u64(struct p_log*, const struct fs_parameter_spec*, struct fs_parameter*, struct fs_parse_result*)'
  'void generate_random_uuid(unsigned char*)'
  'ssize_t generic_copy_file_range(struct file*, loff_t, struct file*, loff_t, size_t, unsigned int)'
  'ssize_t generic_file_write_iter(struct kiocb*, struct iov_iter*)'
  'int generic_key_instantiate(struct key*, struct key_preparsed_payload*)'
  'int generic_setlease(struct file*, long, struct file_lock**, void**)'
  'int invalidate_inode_pages2(struct address_space*)'
  'void iov_iter_bvec(struct iov_iter*, unsigned int, const struct bio_vec*, unsigned long, size_t)'
  'void iov_iter_discard(struct iov_iter*, unsigned int, size_t)'
  'ssize_t iov_iter_get_pages_alloc2(struct iov_iter*, struct page***, size_t, size_t*)'
  'int iov_iter_npages(const struct iov_iter*, int)'
  'void key_invalidate(struct key*)'
  'void key_revoke(struct key*)'
  'int key_validate(const struct key*)'
  'void lock_two_nondirectories(struct inode*, struct inode*)'
  'int locks_lock_inode_wait(struct inode*, struct file_lock*)'
  'enum OID look_up_OID(const void*, size_t)'
  'struct dentry* lookup_positive_unlocked(const char*, struct dentry*, int)'
  'int out_of_line_wait_on_bit_lock(void*, int, wait_bit_action_f*, unsigned int)'
  'const struct cred* override_creds(const struct cred*)'
  'int posix_lock_file(struct file*, struct file_lock*, struct file_lock*)'
  'void posix_test_lock(struct file*, struct file_lock*)'
  'struct cred* prepare_kernel_cred(struct task_struct*)'
  'int register_key_type(struct key_type*)'
  'struct key* request_key_tag(struct key_type*, const char*, struct key_tag*, const char*)'
  'void revert_creds(const struct cred*)'
  'int security_sb_eat_lsm_opts(char*, void**)'
  'void seq_escape_mem(struct seq_file*, const char*, size_t, unsigned int, const char*)'
  'int set_anon_super(struct super_block*, void*)'
  'struct super_block* sget(struct file_system_type*, int(*)(struct super_block*, void*), int(*)(struct super_block*, void*), int, void*)'
  'int sock_sendmsg(struct socket*, struct msghdr*)'
  'int sprint_oid(const void*, size_t, char*, size_t)'
  'int super_setup_bdi(struct super_block*)'
  'void tcp_sock_set_cork(struct sock*, bool)'
  'void tcp_sock_set_nodelay(struct sock*)'
  'void truncate_inode_pages_range(struct address_space*, loff_t, loff_t)'
  'void truncate_pagecache_range(struct inode*, loff_t, loff_t)'
  'void unlock_two_nondirectories(struct inode*, struct inode*)'
  'void unregister_key_type(struct key_type*)'
  'void user_describe(const struct key*, struct seq_file*)'
  'void user_destroy(struct key*)'
  'long user_read(const struct key*, char*, size_t)'
  'void user_revoke(struct key*)'
  'int utf8s_to_utf16s(const u8*, int, enum utf16_endian, wchar_t*, int)'
  'int vfs_parse_fs_string(struct fs_context*, const char*, const char*, size_t)'
  'loff_t vfs_setpos(struct file*, loff_t, loff_t)'
  'void wait_on_page_writeback(struct page*)'

1 variable symbol(s) added
  'struct key_type key_type_logon'

Bug: 334801999

Change-Id: I89f2029bb73155ffd0dd4236de32a7c74d1a8f48
Signed-off-by: fengqi <fengqi@xiaomi.corp-partner.google.com>
2024-05-08 17:05:40 +00:00
Florian Westphal
d5e04556d4 UPSTREAM: netfilter: nft_set_pipapo: do not free live element
[ Upstream commit 3cfc9ec039af60dbd8965ae085b2c2ccdcfbe1cc ]

Pablo reports a crash with large batches of elements with a
back-to-back add/remove pattern.  Quoting Pablo:

  add_elem("00000000") timeout 100 ms
  ...
  add_elem("0000000X") timeout 100 ms
  del_elem("0000000X") <---------------- delete one that was just added
  ...
  add_elem("00005000") timeout 100 ms

  1) nft_pipapo_remove() removes element 0000000X
  Then, KASAN shows a splat.

Looking at the remove function there is a chance that we will drop a
rule that maps to a non-deactivated element.

Removal happens in two steps, first we do a lookup for key k and return the
to-be-removed element and mark it as inactive in the next generation.
Then, in a second step, the element gets removed from the set/map.

The _remove function does not work correctly if we have more than one
element that share the same key.

This can happen if we insert an element into a set when the set already
holds an element with same key, but the element mapping to the existing
key has timed out or is not active in the next generation.

In such case its possible that removal will unmap the wrong element.
If this happens, we will leak the non-deactivated element, it becomes
unreachable.

The element that got deactivated (and will be freed later) will
remain reachable in the set data structure, this can result in
a crash when such an element is retrieved during lookup (stale
pointer).

Add a check that the fully matching key does in fact map to the element
that we have marked as inactive in the deactivation step.
If not, we need to continue searching.

Add a bug/warn trap at the end of the function as well, the remove
function must not ever be called with an invisible/unreachable/non-existent
element.

v2: avoid uneeded temporary variable (Stefano)

Bug: 336735501
Fixes: 3c4287f620 ("nf_tables: Add set type for arbitrary concatenation of ranges")
Reported-by: Pablo Neira Ayuso <pablo@netfilter.org>
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit ebf7c9746f)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ic9a48ac9ac0f9960fea9e066d9a0a9fb93f7b633
2024-05-07 13:49:00 +00:00