Commit Graph

1074263 Commits

Author SHA1 Message Date
Greg Kroah-Hartman
30f4052325 Merge "Merge branch 'android14-5.15' into branch 'android14-5.15-lts'" into android14-5.15-lts 2024-02-15 13:25:56 +00:00
Greg Kroah-Hartman
2e2880028c Merge branch 'android14-5.15' into branch 'android14-5.15-lts'
Catch up on a number of changes merged on the normal branch to the LTS
branch.  This includes the following commits:

* eb7a469127 ANDROID: introduce a vendor hook to allow speculative swap pagefaults
* 8014b372fb ANDROID: mm: allow limited speculative page faulting in do_swap_page()
* d87717c9e0 ANDROID: GKI: fix ABI breakage in struct ipv6_devconf
* e9eafb11e1 Reapply "net: release reference to inet6_dev pointer"
* bdf29bd281 Reapply "net: change accept_ra_min_rtr_lft to affect all RA lifetimes"
* aa0920715e Reapply "net: add sysctl accept_ra_min_rtr_lft"
* cfef864314 ANDROID: GKI: explicit include of stringify.h
* 1bbef27576 ANDROID: GKI: Preserve CRC value for wireless_send_event()
* 6fba8c7e34 BACKPORT: wifi: nl80211: Allow authentication frames and set keys on NAN interface
* a2c880b765 UPSTREAM: wifi: cfg80211: Allow action frames to be transmitted with link BSS in MLD
* a2a5f22724 BACKPORT: wifi: cfg80211: include puncturing bitmap in channel switch events
* 2fe5888b30 BACKPORT: wifi: nl80211: validate and configure puncturing bitmap
* 1ef87d0cd0 BACKPORT: wifi: cfg80211: move puncturing bitmap validation from mac80211
* c7c4d0de0f UPSTREAM: wifi: nl80211: add MLO_LINK_ID to CMD_STOP_AP event
* e17b1173b0 ANDROID: GKI: add symbol list for pixel watch
* cea40c5b94 ANDROID: GKI: Do not export non-existent unsafe DDK header
* 7aa924029c UPSTREAM: net: tls, update curr on splice as well
* cf3a0a202e BACKPORT: f2fs: Restrict max filesize for 16K f2fs
* 27bd7b3da9 BACKPORT: f2fs: Support Block Size == Page Size
* e548514692 UPSTREAM: arm64: scs: Disable LTO for SCS patching code
* 46ed54bf00 UPSTREAM: netfilter: nf_tables: check if catch-all set element is active in next generation
* c523387084 ANDROID: Update the ABI symbol list
* 8d40c367ee Reapply "perf: Fix perf_event_validate_size()"
* 671218461d ANDROID: binder: fix integer as NULL assignment
* d632b78a61 UPSTREAM: ida: Fix crash in ida_free when the bitmap is empty
* f7b4a1559d UPSTREAM: netfilter: nf_tables: Reject tables of unsupported family
* 0a649455af ANDROID: ABI break fix caused by kernfs_root and kernfs_elem_dir size increase
* 1de2411a19 UPSTREAM: kernfs: fix NULL dereferencing in kernfs_remove
* 05de9bcede UPSTREAM: kernfs: prevent early freeing of root node
* d8dbc91f9a UPSTREAM: kernfs: switch global kernfs_rwsem lock to per-fs lock
* 73ba66a3c5 Reapply "perf: Disallow mis-matched inherited group reads"
* 076f9f28f5 FROMGIT: mm: memcg: don't periodically flush stats when memcg is disabled
* a330adce53 UPSTREAM: Revert "drm/bridge: lt9611uxc: Switch to devm MIPI-DSI helpers"
* ac7b9d215a UPSTREAM: Revert "drm/bridge: lt9611uxc: Register and attach our DSI device at probe"
* a9030727b0 UPSTREAM: Revert "drm/bridge: lt9611uxc: fix the race in the error path"
* d9ce9afcf1 ANDROID: mm: Fix VMA ref count after fast-mremap

Change-Id: Ie898504ffae8e2eeba23c320e565b4b55c98d344
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-02-14 14:41:57 +00:00
Konrad Dybcio
abe9e11e84 UPSTREAM: drm/msm/dsi: Enable runtime PM
[ Upstream commit 6ab502bc1cf3147ea1d8540d04b83a7a4cb6d1f1 ]

Some devices power the DSI PHY/PLL through a power rail that we model
as a GENPD. Enable runtime PM to make it suspendable.

Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Patchwork: https://patchwork.freedesktop.org/patch/543352/
Link: https://lore.kernel.org/r/20230620-topic-dsiphy_rpm-v2-2-a11a751f34f0@linaro.org
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Stable-dep-of: 3d07a411b4fa ("drm/msm/dsi: Use pm_runtime_resume_and_get to prevent refcnt leaks")
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Change-Id: I9f1a28e7c47c394fe7200826627a5373455f3826
2024-02-14 13:14:59 +05:30
Douglas Anderson
6205c3735f UPSTREAM: PM: runtime: Have devm_pm_runtime_enable() handle pm_runtime_dont_use_autosuspend()
[ Upstream commit b4060db925 ]

The PM Runtime docs say:

  Drivers in ->remove() callback should undo the runtime PM changes done
  in ->probe(). Usually this means calling pm_runtime_disable(),
  pm_runtime_dont_use_autosuspend() etc.

From grepping code, it's clear that many people aren't aware of the
need to call pm_runtime_dont_use_autosuspend().

When brainstorming solutions, one idea that came up was to leverage
the new-ish devm_pm_runtime_enable() function. The idea here is that:

 * When the devm action is called we know that the driver is being
   removed. It's the perfect time to undo the use_autosuspend.

 * The code of pm_runtime_dont_use_autosuspend() already handles the
   case of being called when autosuspend wasn't enabled.

Suggested-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: 3d07a411b4fa ("drm/msm/dsi: Use pm_runtime_resume_and_get to prevent refcnt leaks")
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Change-Id: I3433f1936cdc52ed4c26263de7c5c6fcd058e30c
2024-02-14 13:13:52 +05:30
Suren Baghdasaryan
eb7a469127 ANDROID: introduce a vendor hook to allow speculative swap pagefaults
Since SPF is an out-of-tree feature, the risks of changing its behavior
are higher. Add a vendor hook to enable speculative swap pagefaults. By
default it's disabled and should not cause troubles for current users.

Bug: 322762567
Change-Id: I3df7c545aa27d2707ee51ea42368f785c5faa735
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
2024-02-13 21:32:42 +00:00
Suren Baghdasaryan
8014b372fb ANDROID: mm: allow limited speculative page faulting in do_swap_page()
Speculative page handling was disabled in do_swap_page() because it was
unsafe to call migration_entry_wait(). Another calls which are not safe
without taking mmap_lock are ksm_might_need_to_copy() because it relies
on the VMA being stable and readahead. However if we avoid these cases,
the rest seems to be safe. Relax the check to avoid only these unsafe
cases and allow speculation otherwise.

Bug: 322762567
Change-Id: Ic1fda0a5549088d5f37004dbacf3193116a5f868
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
2024-02-13 21:32:42 +00:00
Carlos Llamas
d87717c9e0 ANDROID: GKI: fix ABI breakage in struct ipv6_devconf
The following list of commits, which are in the 5.15.136 release, add a
new field in struct ipv6_devconf and this breaks the abi. Fix this by
using one of the reserved slots for upstream changes and update the stg
file to preserve the build.

  5e13e69ddf ("net: release reference to inet6_dev pointer")
  aade10d51d ("net: change accept_ra_min_rtr_lft to affect all RA lifetimes")
  8f12d2d66c ("net: add sysctl accept_ra_min_rtr_lft")

type 'struct ipv6_devconf' changed
  member 'union { struct { __s32 accept_ra_min_lft; u32 padding; }; struct { u64 android_kabi_reserved1; }; union { }; }' was added
  member 'u64 android_kabi_reserved1' was removed

Bug: 320243175
Change-Id: Icddcad574f3c29f6d3e63b10f8c7e51bdf46fe7f
Signed-off-by: Carlos Llamas <cmllamas@google.com>
2024-02-13 01:29:02 +00:00
Carlos Llamas
e9eafb11e1 Reapply "net: release reference to inet6_dev pointer"
This reverts commit 7b3ee41b62.

Bug: 320243175
Change-Id: I4627e1097dddbb697597cbb51e4ba9f4f1af61da
Signed-off-by: Carlos Llamas <cmllamas@google.com>
2024-02-13 00:33:47 +00:00
Carlos Llamas
bdf29bd281 Reapply "net: change accept_ra_min_rtr_lft to affect all RA lifetimes"
This reverts commit 9144a81de4.

Bug: 320243175
Change-Id: If51722d74fe9b326d69c96c0cdfca43db6e33b93
Signed-off-by: Carlos Llamas <cmllamas@google.com>
2024-02-13 00:33:33 +00:00
Carlos Llamas
aa0920715e Reapply "net: add sysctl accept_ra_min_rtr_lft"
This reverts commit 0a427f1810.

Bug: 320243175
Change-Id: Ia31692230f2f5cbd2ac349edcb2be320497c52f3
Signed-off-by: Carlos Llamas <cmllamas@google.com>
2024-02-13 00:33:06 +00:00
Carlos Llamas
cfef864314 ANDROID: GKI: explicit include of stringify.h
The android_kabi.h header file uses the __stringify() macro without
explicitly including its definition via linux/stringify.h. This can
result in build breaking when using the ANDROID_KABI_USE macro:

  common/include/linux/ipv6.h:83:2: error: expected ')'
  ANDROID_KABI_USE(1, struct { __s32 accept_ra_min_lft; u32 padding; });
  ^
  [...]
  common/include/linux/android_kabi.h:44:24: note: expanded from macro '__ANDROID_KABI_CHECK_SIZE_ALIGN'
      __FILE__ ":" __stringify(__LINE__) ": "          \
                   ^

To fix this let android_kabi.h include stringify.h explicitly instead of
relying on includes of previous unrelated header files.

Bug: 324437514
Change-Id: I16cced44e723871b2e1a92b312e60f38e41fea70
Signed-off-by: Carlos Llamas <cmllamas@google.com>
2024-02-13 00:29:52 +00:00
Isaac J. Manjarres
1bbef27576 ANDROID: GKI: Preserve CRC value for wireless_send_event()
Commit d7c1a9a0ed ("wifi: nl80211: validate and configure puncturing
bitmap") and commit 9b89495e47 ("wifi: nl80211: Allow authentication
frames and set keys on NAN interface") added two entries to the
nl80211_ext_feature_index enum, which caused the CRC value for the
wireless_send_event() symbol to change.

Fix this by hiding the new enum entries during the CRC generation phase.
While the values of NUM_NL80211_EXT_FEATURES and
MAX_NL80211_EXT_FEATURES have changed, it shouldn't be a problem in this
case, since MAX_NL80211_EXT_FEATURES is not used in the kernel source,
and the one usage of NUM_NL80211_EXT_FEATURES remains unchanged.

Bug: 272227555
Bug: 324871355
Change-Id: I8b5be4c39b1ab72f0f2b3c9ff10f15a981a431db
Signed-off-by: Isaac J. Manjarres <isaacmanjarres@google.com>
2024-02-12 06:29:23 -08:00
Vinay Gannevaram
6fba8c7e34 BACKPORT: wifi: nl80211: Allow authentication frames and set keys on NAN interface
Wi-Fi Aware R4 specification defines NAN Pairing which uses PASN handshake
to authenticate the peer and generate keys. Hence allow to register and transmit
the PASN authentication frames on NAN interface and set the keys to driver or
underlying modules on NAN interface.

The driver needs to configure the feature flag NL80211_EXT_FEATURE_SECURE_NAN,
which also helps userspace modules to know if the driver supports secure NAN.

Signed-off-by: Vinay Gannevaram <quic_vganneva@quicinc.com>
Link: https://lore.kernel.org/r/1675519179-24174-1-git-send-email-quic_vganneva@quicinc.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Bug: 272227555
Change-Id: Ib8e15683772cf9696b51fb5360642813ca0a078b
(cherry picked from commit 9b89495e47)
[shivbara: replace reserved UAPI attribute with corresponding upstream
attribute]
Signed-off-by: Shivani Baranwal <quic_shivbara@quicinc.com>
Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
(cherry picked from commit 092199e995efc58b29d568614581b3f63a05ca8c)
Signed-off-by: Lee Jones <joneslee@google.com>
2024-02-12 06:09:33 -08:00
Rameshkumar Sundaram
a2c880b765 UPSTREAM: wifi: cfg80211: Allow action frames to be transmitted with link BSS in MLD
Currently action frames TX only with ML address as A3(BSSID) are
allowed in an ML AP, but TX for a non-ML Station can happen in any
link of an ML BSS with link BSS address as A3.
In case of an MLD, if User-space has provided a valid link_id in
action frame TX request, allow transmission of the frame in that link.

Signed-off-by: Rameshkumar Sundaram <quic_ramess@quicinc.com>
Link: https://lore.kernel.org/r/20230201061602.3918-1-quic_ramess@quicinc.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Bug: 272227555
Change-Id: Iceb00b0713d9123f040e10e06cbfc412ee6a0375
(cherry picked from commit 19085ef39f)
Signed-off-by: Shivani Baranwal <quic_shivbara@quicinc.com>
Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
(cherry picked from commit 05164a8564bacb11ed74b2826b27f8bded606a12)
Signed-off-by: Lee Jones <joneslee@google.com>
2024-02-12 06:09:33 -08:00
Aloka Dixit
a2a5f22724 BACKPORT: wifi: cfg80211: include puncturing bitmap in channel switch events
Add puncturing bitmap in channel switch notifications
and corresponding trace functions.

Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
Link: https://lore.kernel.org/r/20230131001227.25014-4-quic_alokad@quicinc.com
[fix qtnfmac]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Bug: 272227555
Change-Id: I6e5c3ba2be2f1667533918d467fb3713f1d29362
(cherry picked from commit b345f0637c)
[vjakkam: resolve conflicts in mac80211 files]
Signed-off-by: Shivani Baranwal <quic_shivbara@quicinc.com>
Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
(cherry picked from commit 6bab8a400278f71a89eb17d567eab5d5b688b771)
Signed-off-by: Lee Jones <joneslee@google.com>
2024-02-12 06:09:33 -08:00
Aloka Dixit
2fe5888b30 BACKPORT: wifi: nl80211: validate and configure puncturing bitmap
- New feature flag, NL80211_EXT_FEATURE_PUNCT, to advertise
  driver support for preamble puncturing in AP mode.
- New attribute, NL80211_ATTR_PUNCT_BITMAP, to receive a puncturing
  bitmap from the userspace during AP bring up (NL80211_CMD_START_AP)
  and channel switch (NL80211_CMD_CHANNEL_SWITCH) operations. Each bit
  corresponds to a 20 MHz channel in the operating bandwidth, lowest
  bit for the lowest channel. Bit set to 1 indicates that the channel
  is punctured. Higher 16 bits are reserved.
- New members added to structures cfg80211_ap_settings and
  cfg80211_csa_settings to propagate the bitmap to the driver after
  validation.

Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
Signed-off-by: Muna Sinada <quic_msinada@quicinc.com>
Link: https://lore.kernel.org/r/20230131001227.25014-3-quic_alokad@quicinc.com
[move validation against 0xffff into policy]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Bug: 272227555
Change-Id: I2d9a90cba8812bfe81d0168133ef2239dcc536ac
(cherry picked from commit d7c1a9a0ed)
[shivbara: replace reserved UAPI attributes with corresponding
upstream attributes]
Signed-off-by: Shivani Baranwal <quic_shivbara@quicinc.com>
(cherry picked from commit e8a4772f4d125216fe5ea362d48e7f1a7051111a)
Signed-off-by: Lee Jones <joneslee@google.com>
2024-02-12 06:09:33 -08:00
Aloka Dixit
1ef87d0cd0 BACKPORT: wifi: cfg80211: move puncturing bitmap validation from mac80211
- Move ieee80211_valid_disable_subchannel_bitmap() from mlme.c to
  chan.c, rename it as cfg80211_valid_disable_subchannel_bitmap()
  and export it.
- Modify the prototype to include struct cfg80211_chan_def instead
  of only bandwidth to support a check which returns false if the
  primary channel is punctured.

Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
Link: https://lore.kernel.org/r/20230131001227.25014-2-quic_alokad@quicinc.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Bug: 272227555
Change-Id: I0b5d7829982afc0ae18b105ddd3ad9df7d3dd7ed
(cherry picked from commit b25413fed3)
[shivbara: Skipped changes in net/mac80211 due to missing
dependency changes]
Signed-off-by: Shivani Baranwal <quic_shivbara@quicinc.com>
(cherry picked from commit 5761541a4eb5b73572602cddeca2f732052b96e2)
Signed-off-by: Lee Jones <joneslee@google.com>
2024-02-12 06:09:32 -08:00
Alvin Šipraga
c7c4d0de0f UPSTREAM: wifi: nl80211: add MLO_LINK_ID to CMD_STOP_AP event
nl80211_send_ap_stopped() can be called multiple times on the same
netdev for each link when using Multi-Link Operation. Add the
MLO_LINK_ID attribute to the event to allow userspace to distinguish
which link the event is for.

Signed-off-by: Alvin Šipraga <alsi@bang-olufsen.dk>
Link: https://lore.kernel.org/r/20230128125844.2407135-2-alvin@pqrs.dk
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Bug: 272227555
Change-Id: I02104259eda61893f5f40bcd18a5e89bf6871ae6
(cherry picked from commit cba7217a92)
Signed-off-by: Shivani Baranwal <quic_shivbara@quicinc.com>
(cherry picked from commit 267de69e07c3246ec07eec621689d17bef1bb377)
Signed-off-by: Lee Jones <joneslee@google.com>
2024-02-12 06:09:32 -08:00
Ben Fennema
e17b1173b0 ANDROID: GKI: add symbol list for pixel watch
1 function symbol(s) added
  'void add_taint(unsigned int, enum lockdep_ok)'

1 variable symbol(s) added
  'struct bus_type spi_bus_type'

Bug: 321098228
Change-Id: I13c8e6da30dcb512706fcf6a951f30649449ba48
Signed-off-by: Ben Fennema <fennema@google.com>
2024-02-08 20:59:04 +00:00
Isaac J. Manjarres
cea40c5b94 ANDROID: GKI: Do not export non-existent unsafe DDK header
Merge commit c51de219f5 ("Merge tag 'android14-5.15.131_r00' into
android-14-5.15") brought in upstream commit 7963d4d710 ("usb: typec:
tcpci: move tcpci.h to include/linux/usb/"). However, the reference
to the drivers/usb/typec/tcpm/tcpci.h headers was not removed from
the all_headers_unsafe ddk_headers target.

This causes build failures when building with --allow_ddk_unsafe_headers
as the file cannot be found, so remove it.

Bug: 324422915
Fixes: c51de219f5 ("Merge tag 'android14-5.15.131_r00' into android-14-5.15")
Change-Id: Id65881dd87df6edb3fe9f935e8bb45faa6af2374
Signed-off-by: Isaac J. Manjarres <isaacmanjarres@google.com>
2024-02-08 09:17:02 -08:00
John Fastabend
7aa924029c UPSTREAM: net: tls, update curr on splice as well
commit c5a595000e2677e865a39f249c056bc05d6e55fd upstream.

The curr pointer must also be updated on the splice similar to how
we do this for other copy types.

Bug: 322282717
Fixes: d829e9c411 ("tls: convert to generic sk_msg interface")
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Reported-by: Jann Horn <jannh@google.com>
Link: https://lore.kernel.org/r/20231206232706.374377-2-john.fastabend@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit ba5efd8544)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: If942207e6338993096c9fbc8ce4c23a6bbecaf2e
2024-02-06 15:56:46 +00:00
Daniel Rosenberg
cf3a0a202e BACKPORT: f2fs: Restrict max filesize for 16K f2fs
Blocks are tracked by u32, so the max permitted filesize is
(U32_MAX + 1) * BLOCK_SIZE. Additionally, in order to support crypto
data unit sizes of 4K with a 16K block with IV_INO_LBLK_{32,64}, we must
further restrict max filesize to (U32_MAX + 1) * 4096. This does not
affect 4K blocksize f2fs as the natural limit for files are well below
that.

Fixes: ac5dd4e5de6a ("BACKPORT: Support Block Size == Page Size")
Signed-off-by: Daniel Rosenberg <drosen@google.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit a6a010f5def544af3efcfe21683905a712b60536)
Change-Id: I8697e37841e1882a3f613e9aab1857ad7e4c3f2f
Bug: 248132568
2024-02-05 22:59:31 +00:00
Daniel Rosenberg
27bd7b3da9 BACKPORT: f2fs: Support Block Size == Page Size
This allows f2fs to support cases where the block size = page size for
both 4K and 16K block sizes. Other sizes should work as well, should the
need arise. This does not currently support 4K Block size filesystems if
the page size is 16K.

Change-Id: Ifab03cddeec1389a6a3fb64174063ffccbb93072
Signed-off-by: Daniel Rosenberg <drosen@google.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Bug: 248132568
(cherry picked from commit 8b8e202be3264fc33464f8dc319e0c1563ac89d8)
(fixed minor conflict in fs/f2fs/inode.c)
2024-02-05 22:59:31 +00:00
Ard Biesheuvel
e548514692 UPSTREAM: arm64: scs: Disable LTO for SCS patching code
Full LTO takes the '-mbranch-protection=none' passed to the compiler
when generating the dynamic shadow call stack patching code as a hint to
stop emitting PAC instructions altogether. (Thin LTO appears unaffected
by this)

Work around this by disabling LTO for the compilation unit, which
appears to convince the linker that it should still use PAC in the rest
of the kernel..

Fixes: 3b619e22c4 ("arm64: implement dynamic shadow call stack for Clang")
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Sami Tolvanen <samitolvanen@google.com>
Tested-by: Sami Tolvanen <samitolvanen@google.com>
Link: https://lore.kernel.org/r/20240123133052.1417449-6-ardb+git@google.com
Signed-off-by: Will Deacon <will@kernel.org>
(cherry picked from commit d104a6fef3fec137d8d44961224ab76edbd6cbc7)
Bug: 317883735
Change-Id: Ic4bdb0a6e527f8cb2745282b81945aa7b7231502
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
2024-02-05 10:13:53 -08:00
Pablo Neira Ayuso
46ed54bf00 UPSTREAM: netfilter: nf_tables: check if catch-all set element is active in next generation
commit b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7 upstream.

When deactivating the catch-all set element, check the state in the next
generation that represents this transaction.

This bug uncovered after the recent removal of the element busy mark
a2dd0233cb ("netfilter: nf_tables: remove busy mark and gc batch API").

Bug: 323034444
Fixes: aaa31047a6 ("netfilter: nftables: add catch-all set element support")
Cc: stable@vger.kernel.org
Reported-by: lonial con <kongln9170@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit a372f1d01b)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I40ac92a33db48a2709079d27d7d529946ba297c7
2024-02-05 15:51:10 +00:00
Pindar Yang
c523387084 ANDROID: Update the ABI symbol list
1 function symbol(s) added
  'bool iio_buffer_enabled(struct iio_dev*)'

Bug: 300854197
Change-Id: I12f80e536138be95afbfd5ad9b5c7233c549c0fd
Signed-off-by: Pindar Yang <pindaryang@google.com>
2024-02-05 08:50:54 +00:00
Greg Kroah-Hartman
8d40c367ee Reapply "perf: Fix perf_event_validate_size()"
This reverts commit 63d0d92b34 which is
commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b upstream.

Bug: 316932704
Change-Id: I69bfbf5180f57592ce285ea14f6f7b7c1b2b0f8f
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-02-02 10:04:47 +00:00
Carlos Llamas
671218461d ANDROID: binder: fix integer as NULL assignment
Fixes the following sparse warning:

  drivers/android/binder_alloc.c:883:25: warning: Using plain integer as NULL pointer

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202401190625.6EvaSCpr-lkp@intel.com/
Fixes: 63f7ddea2e ("ANDROID: binder: fix KMI-break due to address type change")
Change-Id: I1ac36c879c3396c1c4945602c1dfdc6e3b192b47
Signed-off-by: Carlos Llamas <cmllamas@google.com>
2024-02-01 23:17:16 +00:00
Matthew Wilcox (Oracle)
d632b78a61 UPSTREAM: ida: Fix crash in ida_free when the bitmap is empty
[ Upstream commit af73483f4e8b6f5c68c9aa63257bdd929a9c194a ]

The IDA usually detects double-frees, but that detection failed to
consider the case when there are no nearby IDs allocated and so we have a
NULL bitmap rather than simply having a clear bit.  Add some tests to the
test-suite to be sure we don't inadvertently reintroduce this problem.
Unfortunately they're quite noisy so include a message to disregard
the warnings.

Bug: 321878978
Reported-by: Zhenghan Wang <wzhmmmmm@gmail.com>
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 5dbcdaf4db)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I4919e5c64af12f86fe1a91e1e9224a58eedbf345
2024-02-01 10:27:53 +00:00
Phil Sutter
f7b4a1559d UPSTREAM: netfilter: nf_tables: Reject tables of unsupported family
commit f1082dd31f upstream.

An nftables family is merely a hollow container, its family just a
number and such not reliant on compile-time options other than nftables
support itself. Add an artificial check so attempts at using a family
the kernel can't support fail as early as possible. This helps user
space detect kernels which lack e.g. NFPROTO_INET.

Bug: 321815738
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit ab3a3aadb3)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I7123795885791a62089d5f7d1e5ff5a3f90e4abd
2024-02-01 10:27:12 +00:00
Minchan Kim
0a649455af ANDROID: ABI break fix caused by kernfs_root and kernfs_elem_dir size increase
Adding kernfs_rwsem in kernfs_root breaks the ABI unfortunately
since it changes the size of kernfs_root structure.
To fix the issue, this patch introduces new data structure
kernfs_root_ext which includes kernfs_root with kernfs_rwsem to
avoid increasing kernfs_root'size. It also introduces kernfs_rwsem
wrapper function to reach kernfs_rwsem from kernfs_root to minimize
change.

Bug: 320903885
Bug: 219424218
Bug: 206126556
Signed-off-by: Minchan Kim <minchan@google.com>
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Change-Id: Iabaad9623e9a101210073db3106c93f06847a8b3
2024-01-31 12:33:55 -08:00
Minchan Kim
1de2411a19 UPSTREAM: kernfs: fix NULL dereferencing in kernfs_remove
kernfs_remove supported NULL kernfs_node param to bail out but revent
per-fs lock change introduced regression that dereferencing the
param without NULL check so kernel goes crash.

This patch checks the NULL kernfs_node in kernfs_remove and if so,
just return.

Quote from bug report by Jirka

```
The bug is triggered by running NAS Parallel benchmark suite on
SuperMicro servers with 2x Xeon(R) Gold 6126 CPU. Here is the error
log:

[  247.035564] BUG: kernel NULL pointer dereference, address: 0000000000000008
[  247.036009] #PF: supervisor read access in kernel mode
[  247.036009] #PF: error_code(0x0000) - not-present page
[  247.036009] PGD 0 P4D 0
[  247.036009] Oops: 0000 [#1] PREEMPT SMP PTI
[  247.058060] CPU: 1 PID: 6546 Comm: umount Not tainted
5.16.0393c3714081a53795bbff0e985d24146def6f57f+ #16
[  247.058060] Hardware name: Supermicro Super Server/X11DDW-L, BIOS
2.0b 03/07/2018
[  247.058060] RIP: 0010:kernfs_remove+0x8/0x50
[  247.058060] Code: 4c 89 e0 5b 5d 41 5c 41 5d 41 5e c3 49 c7 c4 f4
ff ff ff eb b2 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 0f 1f 44 00 00
41 54 55 <48> 8b 47 08 48 89 fd 48 85 c0 48 0f 44 c7 4c 8b 60 50 49 83
c4 60
[  247.058060] RSP: 0018:ffffbbfa48a27e48 EFLAGS: 00010246
[  247.058060] RAX: 0000000000000001 RBX: ffffffff89e31f98 RCX: 0000000080200018
[  247.058060] RDX: 0000000080200019 RSI: fffff6760786c900 RDI: 0000000000000000
[  247.058060] RBP: ffffffff89e31f98 R08: ffff926b61b24d00 R09: 0000000080200018
[  247.122048] R10: ffff926b61b24d00 R11: ffff926a8040c000 R12: ffff927bd09a2000
[  247.122048] R13: ffffffff89e31fa0 R14: dead000000000122 R15: dead000000000100
[  247.122048] FS:  00007f01be0a8c40(0000) GS:ffff926fa8e40000(0000)
knlGS:0000000000000000
[  247.122048] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  247.122048] CR2: 0000000000000008 CR3: 00000001145c6003 CR4: 00000000007706e0
[  247.122048] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  247.122048] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  247.122048] PKRU: 55555554
[  247.122048] Call Trace:
[  247.122048]  <TASK>
[  247.122048]  rdt_kill_sb+0x29d/0x350
[  247.122048]  deactivate_locked_super+0x36/0xa0
[  247.122048]  cleanup_mnt+0x131/0x190
[  247.122048]  task_work_run+0x5c/0x90
[  247.122048]  exit_to_user_mode_prepare+0x229/0x230
[  247.122048]  syscall_exit_to_user_mode+0x18/0x40
[  247.122048]  do_syscall_64+0x48/0x90
[  247.122048]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[  247.122048] RIP: 0033:0x7f01be2d735b
```

Link: https://bugzilla.kernel.org/show_bug.cgi?id=215696
Link: https://lore.kernel.org/lkml/CAE4VaGDZr_4wzRn2___eDYRtmdPaGGJdzu_LCSkJYuY9BEO3cw@mail.gmail.com/
Fixes: 393c371408 (kernfs: switch global kernfs_rwsem lock to per-fs lock)
Cc: stable@vger.kernel.org
Reported-by: Jirka Hladky <jhladky@redhat.com>
Tested-by: Jirka Hladky <jhladky@redhat.com>
Acked-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Minchan Kim <minchan@kernel.org>
Link: https://lore.kernel.org/r/20220427172152.3505364-1-minchan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

(cherry picked from commit ad8d869343)

Bug: 320903885
Bug: 219424218
Bug: 206126556
Change-Id: I5b0a491231ee8913b7f522f22349c22ba0e07d88
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
2024-01-31 12:33:55 -08:00
Minchan Kim
05de9bcede UPSTREAM: kernfs: prevent early freeing of root node
Marek reported the warning below.

  =========================
  WARNING: held lock freed!
  5.16.0-rc2+ #10984 Not tainted
  -------------------------
  kworker/1:0/18 is freeing memory ffff00004034e200-ffff00004034e3ff,
with a lock still held there!
  ffff00004034e348 (&root->kernfs_rwsem){++++}-{3:3}, at:
__kernfs_remove+0x310/0x37c
  3 locks held by kworker/1:0/18:
   #0: ffff000040107938 ((wq_completion)cgroup_destroy){+.+.}-{0:0}, at:
process_one_work+0x1f0/0x6f0
   #1: ffff80000b55bdc0
((work_completion)(&(&css->destroy_rwork)->work)){+.+.}-{0:0}, at:
process_one_work+0x1f0/0x6f0
   #2: ffff00004034e348 (&root->kernfs_rwsem){++++}-{3:3}, at:
__kernfs_remove+0x310/0x37c

  stack backtrace:
  CPU: 1 PID: 18 Comm: kworker/1:0 Not tainted 5.16.0-rc2+ #10984
  Hardware name: Raspberry Pi 4 Model B (DT)
  Workqueue: cgroup_destroy css_free_rwork_fn
  Call trace:
   dump_backtrace+0x0/0x1ac
   show_stack+0x18/0x24
   dump_stack_lvl+0x8c/0xb8
   dump_stack+0x18/0x34
   debug_check_no_locks_freed+0x124/0x140
   kfree+0xf0/0x3a4
   kernfs_put+0x1f8/0x224
   __kernfs_remove+0x1b8/0x37c
   kernfs_destroy_root+0x38/0x50
   css_free_rwork_fn+0x288/0x3d4
   process_one_work+0x288/0x6f0
   worker_thread+0x74/0x470
   kthread+0x188/0x194
   ret_from_fork+0x10/0x20

Since kernfs moves the kernfs_rwsem lock into root, it couldn't hold
the lock when the root node is tearing down. Thus, get the refcount
of root node.

Fixes: 393c371408 ("kernfs: switch global kernfs_rwsem lock to per-fs lock")
Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
Acked-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Minchan Kim <minchan@kernel.org>
Link: https://lore.kernel.org/r/20211201231648.1027165-1-minchan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

(cherry picked from commit 555a0ce455)

Bug: 320903885
Change-Id: If96f85b88b662e88430c9c8d1efb436e9a80ddcf
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
2024-01-31 12:33:54 -08:00
Minchan Kim
d8dbc91f9a UPSTREAM: kernfs: switch global kernfs_rwsem lock to per-fs lock
The kernfs implementation has big lock granularity(kernfs_rwsem) so
every kernfs-based(e.g., sysfs, cgroup) fs are able to compete the
lock. It makes trouble for some cases to wait the global lock
for a long time even though they are totally independent contexts
each other.

A general example is process A goes under direct reclaim with holding
the lock when it accessed the file in sysfs and process B is waiting
the lock with exclusive mode and then process C is waiting the lock
until process B could finish the job after it gets the lock from
process A.

This patch switches the global kernfs_rwsem to per-fs lock, which
put the rwsem into kernfs_root.

Suggested-by: Tejun Heo <tj@kernel.org>
Acked-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Minchan Kim <minchan@kernel.org>
Link: https://lore.kernel.org/r/20211118230008.2679780-1-minchan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

(cherry picked from commit 393c371408)

Bug: 320903885
Bug: 219424218
Bug: 206126556
Change-Id: I5f942f7a4a18b3c2198496fea789b381ba955d19
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
2024-01-31 12:33:54 -08:00
Greg Kroah-Hartman
73ba66a3c5 Reapply "perf: Disallow mis-matched inherited group reads"
This reverts commit 96e78d17ff3251e17ba5894ad194227c0a44adbb.

Keeps the ABI stable by taking advantage of a hole in the structure!

Bug: 307236803
Change-Id: Ic5f7ebeb3a9b13afdb3bfff7e54c4a93b863dab6
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-01-31 02:02:04 +00:00
T.J. Mercier
076f9f28f5 FROMGIT: mm: memcg: don't periodically flush stats when memcg is disabled
The root memcg is onlined even when memcg is disabled.  When it's onlined
a 2 second periodic stat flush is started, but no stat flushing is
required when memcg is disabled because there can be no child memcgs.
Most calls to flush memcg stats are avoided when memcg is disabled as a
result of the mem_cgroup_disabled check added in 7d7ef0a4686a ("mm: memcg:
restore subtree stats flushing"), but the periodic flushing started in
mem_cgroup_css_online is not.  Skip it.

Link: https://lkml.kernel.org/r/20240126211927.1171338-1-tjmercier@google.com
Fixes: aa48e47e39 ("memcg: infrastructure to flush memcg stats")
Change-Id: Iae6aeb3091d349898ea4987a784a971d9b3c97f7
Signed-off-by: T.J. Mercier <tjmercier@google.com>
Acked-by: Shakeel Butt <shakeelb@google.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Acked-by: Chris Li <chrisl@kernel.org>
Reported-by: Minchan Kim <minchan@google.com>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
(cherry picked from commit 7e9bccbe57812f888f51d46d7cdbc6327eee24f3
 https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git/
 mm-unstable)
Signed-off-by: T.J. Mercier <tjmercier@google.com>
2024-01-30 20:40:26 +00:00
Amit Pundir
a330adce53 UPSTREAM: Revert "drm/bridge: lt9611uxc: Switch to devm MIPI-DSI helpers"
This reverts commit f53a045793.

This and the dependent fixes broke display on RB5.

Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 146449535
Change-Id: I4fdd0480c2df048a97dff263fc7da4016110c8f8
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
(cherry picked from commit 7aa33c99b5)
2024-01-30 21:43:26 +05:30
Amit Pundir
ac7b9d215a UPSTREAM: Revert "drm/bridge: lt9611uxc: Register and attach our DSI device at probe"
This reverts commit 29aba28ea1.

This and the dependent fixes broke display on RB5.

Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 146449535
Change-Id: I30de5ccc3baca99c876a213ca7884b2dbfed6926
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
(cherry picked from commit 4a8350a0ea)
2024-01-30 21:43:16 +05:30
Amit Pundir
a9030727b0 UPSTREAM: Revert "drm/bridge: lt9611uxc: fix the race in the error path"
This reverts commit d0d01bb4a5.

This and the dependent fixes broke display on RB5.

Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 146449535
Change-Id: I2b14dacf44678ce65024092f5050ee735d39ea87
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
(cherry picked from commit e21817ce16)
2024-01-30 21:42:53 +05:30
Greg Kroah-Hartman
c169b3e6e4 Merge 5.15.148 into android14-5.15-lts
Changes in 5.15.148
	f2fs: explicitly null-terminate the xattr list
	pinctrl: lochnagar: Don't build on MIPS
	ALSA: hda - Fix speaker and headset mic pin config for CHUWI CoreBook XPro
	mptcp: fix uninit-value in mptcp_incoming_options
	wifi: cfg80211: lock wiphy mutex for rfkill poll
	debugfs: fix automount d_fsdata usage
	drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer
	nvme-core: check for too small lba shift
	ASoC: wm8974: Correct boost mixer inputs
	ASoC: Intel: Skylake: Fix mem leak in few functions
	ASoC: nau8822: Fix incorrect type in assignment and cast to restricted __be16
	ASoC: Intel: Skylake: mem leak in skl register function
	ASoC: cs43130: Fix the position of const qualifier
	ASoC: cs43130: Fix incorrect frame delay configuration
	ASoC: rt5650: add mutex to avoid the jack detection failure
	nouveau/tu102: flush all pdbs on vmm flush
	net/tg3: fix race condition in tg3_reset_task()
	ASoC: da7219: Support low DC impedance headset
	ASoC: ops: add correct range check for limiting volume
	nvme: introduce helper function to get ctrl state
	drm/amdgpu: Add NULL checks for function pointers
	drm/exynos: fix a potential error pointer dereference
	drm/exynos: fix a wrong error checking
	hwmon: (corsair-psu) Fix probe when built-in
	clk: rockchip: rk3128: Fix HCLK_OTG gate register
	jbd2: correct the printing of write_flags in jbd2_write_superblock()
	drm/crtc: Fix uninit-value bug in drm_mode_setcrtc
	neighbour: Don't let neigh_forced_gc() disable preemption for long
	platform/x86: intel-vbtn: Fix missing tablet-mode-switch events
	jbd2: fix soft lockup in journal_finish_inode_data_buffers()
	tracing: Have large events show up as '[LINE TOO BIG]' instead of nothing
	tracing: Add size check when printing trace_marker output
	stmmac: dwmac-loongson: drop useless check for compatible fallback
	MIPS: dts: loongson: drop incorrect dwmac fallback compatible
	tracing: Fix uaf issue when open the hist or hist_debug file
	ring-buffer: Do not record in NMI if the arch does not support cmpxchg in NMI
	reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning
	Input: atkbd - skip ATKBD_CMD_GETID in translated mode
	Input: i8042 - add nomux quirk for Acer P459-G2-M
	s390/scm: fix virtual vs physical address confusion
	ARC: fix spare error
	wifi: iwlwifi: pcie: avoid a NULL pointer dereference
	Input: xpad - add Razer Wolverine V2 support
	ASoC: Intel: bytcr_rt5640: Add quirk for the Medion Lifetab S10346
	i2c: rk3x: fix potential spinlock recursion on poll
	ida: Fix crash in ida_free when the bitmap is empty
	net: qrtr: ns: Return 0 if server port is not present
	ARM: sun9i: smp: fix return code check of of_property_match_string
	drm/crtc: fix uninitialized variable use
	ACPI: resource: Add another DMI match for the TongFang GMxXGxx
	Revert "ASoC: atmel: Remove system clock tree configuration for at91sam9g20ek"
	bpf: Add --skip_encoding_btf_inconsistent_proto, --btf_gen_optimized to pahole flags for v1.25
	kprobes: Fix to handle forcibly unoptimized kprobes on freeing_list
	Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"
	binder: use EPOLLERR from eventpoll.h
	binder: fix use-after-free in shinker's callback
	binder: fix trivial typo of binder_free_buf_locked()
	binder: fix comment on binder_alloc_new_buf() return value
	uio: Fix use-after-free in uio_open
	parport: parport_serial: Add Brainboxes BAR details
	parport: parport_serial: Add Brainboxes device IDs and geometry
	leds: ledtrig-tty: Free allocated ttyname buffer on deactivate
	PCI: Add ACS quirk for more Zhaoxin Root Ports
	coresight: etm4x: Fix width of CCITMIN field
	x86/lib: Fix overflow when counting digits
	EDAC/thunderx: Fix possible out-of-bounds string access
	powerpc: Mark .opd section read-only
	powerpc/toc: Future proof kernel toc
	powerpc: remove checks for binutils older than 2.25
	powerpc: add crtsavres.o to always-y instead of extra-y
	powerpc/44x: select I2C for CURRITUCK
	powerpc/pseries/memhp: Fix access beyond end of drmem array
	selftests/powerpc: Fix error handling in FPU/VMX preemption tests
	powerpc/powernv: Add a null pointer check to scom_debug_init_one()
	powerpc/powernv: Add a null pointer check in opal_event_init()
	powerpc/powernv: Add a null pointer check in opal_powercap_init()
	powerpc/imc-pmu: Add a null pointer check in update_events_in_group()
	spi: spi-zynqmp-gqspi: fix driver kconfig dependencies
	mtd: rawnand: Increment IFC_TIMEOUT_MSECS for nand controller response
	ACPI: video: check for error while searching for backlight device parent
	ACPI: LPIT: Avoid u32 multiplication overflow
	of: property: define of_property_read_u{8,16,32,64}_array() unconditionally
	of: Add of_property_present() helper
	cpufreq: Use of_property_present() for testing DT property presence
	cpufreq: scmi: process the result of devm_of_clk_add_hw_provider()
	calipso: fix memory leak in netlbl_calipso_add_pass()
	efivarfs: force RO when remounting if SetVariable is not supported
	spi: sh-msiof: Enforce fixed DTDL for R-Car H3
	ACPI: LPSS: Fix the fractional clock divider flags
	ACPI: extlog: Clear Extended Error Log status when RAS_CEC handled the error
	kunit: debugfs: Fix unchecked dereference in debugfs_print_results()
	mtd: Fix gluebi NULL pointer dereference caused by ftl notifier
	selinux: Fix error priority for bind with AF_UNSPEC on PF_INET6 socket
	crypto: virtio - Handle dataq logic with tasklet
	crypto: sa2ul - Return crypto_aead_setkey to transfer the error
	crypto: ccp - fix memleak in ccp_init_dm_workarea
	crypto: af_alg - Disallow multiple in-flight AIO requests
	crypto: sahara - remove FLAGS_NEW_KEY logic
	crypto: sahara - fix cbc selftest failure
	crypto: sahara - fix ahash selftest failure
	crypto: sahara - fix processing requests with cryptlen < sg->length
	crypto: sahara - fix error handling in sahara_hw_descriptor_create()
	pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()
	fs: indicate request originates from old mount API
	gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
	crypto: virtio - Wait for tasklet to complete on device remove
	crypto: sahara - avoid skcipher fallback code duplication
	crypto: sahara - handle zero-length aes requests
	crypto: sahara - fix ahash reqsize
	crypto: sahara - fix wait_for_completion_timeout() error handling
	crypto: sahara - improve error handling in sahara_sha_process()
	crypto: sahara - fix processing hash requests with req->nbytes < sg->length
	crypto: sahara - do not resize req->src when doing hash operations
	crypto: scomp - fix req->dst buffer overflow
	blocklayoutdriver: Fix reference leak of pnfs_device_node
	NFSv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT
	wifi: rtw88: fix RX filter in FIF_ALLMULTI flag
	bpf, lpm: Fix check prefixlen before walking trie
	bpf: Add crosstask check to __bpf_get_stack
	wifi: ath11k: Defer on rproc_get failure
	wifi: libertas: stop selecting wext
	ARM: dts: qcom: apq8064: correct XOADC register address
	net/ncsi: Fix netlink major/minor version numbers
	firmware: ti_sci: Fix an off-by-one in ti_sci_debugfs_create()
	firmware: meson_sm: populate platform devices from sm device tree data
	wifi: rtlwifi: rtl8821ae: phy: fix an undefined bitwise shift behavior
	arm64: dts: ti: k3-am65-main: Fix DSS irq trigger type
	bpf: enforce precision of R0 on callback return
	ARM: dts: qcom: sdx65: correct SPMI node name
	arm64: dts: qcom: sc7180: Make watchdog bark interrupt edge triggered
	arm64: dts: qcom: sc7280: Make watchdog bark interrupt edge triggered
	arm64: dts: qcom: sdm845: Make watchdog bark interrupt edge triggered
	arm64: dts: qcom: sm8150: Make watchdog bark interrupt edge triggered
	arm64: dts: qcom: sm8250: Make watchdog bark interrupt edge triggered
	bpf: fix check for attempt to corrupt spilled pointer
	scsi: fnic: Return error if vmalloc() failed
	arm64: dts: qcom: qrb5165-rb5: correct LED panic indicator
	arm64: dts: qcom: sdm845-db845c: correct LED panic indicator
	arm64: dts: qcom: sc7280: fix usb_2 wakeup interrupt types
	bpf: Fix verification of indirect var-off stack access
	block: Set memalloc_noio to false on device_add_disk() error path
	scsi: hisi_sas: Rename HISI_SAS_{RESET -> RESETTING}_BIT
	scsi: hisi_sas: Prevent parallel FLR and controller reset
	scsi: hisi_sas: Replace with standard error code return value
	scsi: hisi_sas: Rollback some operations if FLR failed
	scsi: hisi_sas: Correct the number of global debugfs registers
	selftests/net: fix grep checking for fib_nexthop_multiprefix
	virtio/vsock: fix logic which reduces credit update messages
	dma-mapping: Add dma_release_coherent_memory to DMA API
	dma-mapping: clear dev->dma_mem to NULL after freeing it
	soc: qcom: llcc: Fix dis_cap_alloc and retain_on_pc configuration
	arm64: dts: qcom: sm8150-hdk: fix SS USB regulators
	block: add check of 'minors' and 'first_minor' in device_add_disk()
	arm64: dts: qcom: sc7280: Mark SDHCI hosts as cache-coherent
	wifi: rtlwifi: add calculate_bit_shift()
	wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift()
	wifi: rtlwifi: rtl8192c: using calculate_bit_shift()
	wifi: rtlwifi: rtl8192cu: using calculate_bit_shift()
	wifi: rtlwifi: rtl8192ce: using calculate_bit_shift()
	wifi: rtlwifi: rtl8192de: using calculate_bit_shift()
	wifi: rtlwifi: rtl8192ee: using calculate_bit_shift()
	wifi: rtlwifi: rtl8192se: using calculate_bit_shift()
	wifi: iwlwifi: mvm: set siso/mimo chains to 1 in FW SMPS request
	wifi: iwlwifi: mvm: send TX path flush in rfkill
	netfilter: nf_tables: mark newset as dead on transaction abort
	Bluetooth: Fix bogus check for re-auth no supported with non-ssp
	Bluetooth: btmtkuart: fix recv_buf() return value
	block: make BLK_DEF_MAX_SECTORS unsigned
	null_blk: don't cap max_hw_sectors to BLK_DEF_MAX_SECTORS
	net/sched: act_ct: fix skb leak and crash on ooo frags
	mlxbf_gige: Fix intermittent no ip issue
	net: mellanox: mlxbf_gige: Replace non-standard interrupt handling
	mlxbf_gige: Enable the GigE port in mlxbf_gige_open
	ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()
	ARM: davinci: always select CONFIG_CPU_ARM926T
	Revert "drm/tidss: Annotate dma-fence critical section in commit path"
	Revert "drm/omapdrm: Annotate dma-fence critical section in commit path"
	RDMA/usnic: Silence uninitialized symbol smatch warnings
	RDMA/hns: Fix inappropriate err code for unsupported operations
	drm/panel-elida-kd35t133: hold panel in reset for unprepare
	drm/nouveau/fence:: fix warning directly dereferencing a rcu pointer
	drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function
	drm/tilcdc: Fix irq free on unload
	media: pvrusb2: fix use after free on context disconnection
	drm/bridge: Fix typo in post_disable() description
	f2fs: fix to avoid dirent corruption
	drm/radeon/r600_cs: Fix possible int overflows in r600_cs_check_reg()
	drm/radeon/r100: Fix integer overflow issues in r100_cs_track_check()
	drm/radeon: check return value of radeon_ring_lock()
	ASoC: cs35l33: Fix GPIO name and drop legacy include
	ASoC: cs35l34: Fix GPIO name and drop legacy include
	drm/msm/mdp4: flush vblank event on disable
	drm/msm/dsi: Use pm_runtime_resume_and_get to prevent refcnt leaks
	drm/drv: propagate errors from drm_modeset_register_all()
	drm/radeon: check the alloc_workqueue return value in radeon_crtc_init()
	drm/radeon/dpm: fix a memleak in sumo_parse_power_table
	drm/radeon/trinity_dpm: fix a memleak in trinity_parse_power_table
	drm/bridge: cdns-mhdp8546: Fix use of uninitialized variable
	drm/bridge: tc358767: Fix return value on error case
	media: cx231xx: fix a memleak in cx231xx_init_isoc
	clk: qcom: gpucc-sm8150: Update the gpu_cc_pll1 config
	media: rkisp1: Disable runtime PM in probe error path
	f2fs: fix to check compress file in f2fs_move_file_range()
	f2fs: fix to update iostat correctly in f2fs_filemap_fault()
	f2fs: fix the f2fs_file_write_iter tracepoint
	media: dvbdev: drop refcount on error path in dvb_device_open()
	media: dvb-frontends: m88ds3103: Fix a memory leak in an error handling path of m88ds3103_probe()
	drm/amdgpu/debugfs: fix error code when smc register accessors are NULL
	drm/amd/pm: fix a double-free in si_dpm_init
	drivers/amd/pm: fix a use-after-free in kv_parse_power_table
	gpu/drm/radeon: fix two memleaks in radeon_vm_init
	dt-bindings: clock: Update the videocc resets for sm8150
	clk: qcom: videocc-sm8150: Update the videocc resets
	clk: qcom: videocc-sm8150: Add missing PLL config property
	drivers: clk: zynqmp: calculate closest mux rate
	clk: zynqmp: make bestdiv unsigned
	clk: zynqmp: Add a check for NULL pointer
	drivers: clk: zynqmp: update divider round rate logic
	watchdog: set cdev owner before adding
	watchdog/hpwdt: Only claim UNKNOWN NMI if from iLO
	watchdog: bcm2835_wdt: Fix WDIOC_SETTIMEOUT handling
	watchdog: rti_wdt: Drop runtime pm reference count when watchdog is unused
	clk: si5341: fix an error code problem in si5341_output_clk_set_rate
	clk: asm9260: use parent index to link the reference clock
	clk: fixed-rate: add devm_clk_hw_register_fixed_rate
	clk: fixed-rate: fix clk_hw_register_fixed_rate_with_accuracy_parent_hw
	pwm: stm32: Use regmap_clear_bits and regmap_set_bits where applicable
	pwm: stm32: Use hweight32 in stm32_pwm_detect_channels
	pwm: stm32: Fix enable count for clk in .probe()
	ASoC: rt5645: Drop double EF20 entry from dmi_platform_data[]
	ALSA: scarlett2: Add missing error check to scarlett2_config_save()
	ALSA: scarlett2: Add missing error check to scarlett2_usb_set_config()
	ALSA: scarlett2: Allow passing any output to line_out_remap()
	ALSA: scarlett2: Add missing error checks to *_ctl_get()
	ALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put()
	mmc: sdhci_am654: Fix TI SoC dependencies
	mmc: sdhci_omap: Fix TI SoC dependencies
	IB/iser: Prevent invalidating wrong MR
	drm/amd/pm/smu7: fix a memleak in smu7_hwmgr_backend_init
	ksmbd: validate the zero field of packet header
	of: Fix double free in of_parse_phandle_with_args_map
	of: unittest: Fix of_count_phandle_with_args() expected value message
	selftests/bpf: Add assert for user stacks in test_task_stack
	keys, dns: Fix size check of V1 server-list header
	binder: fix async space check for 0-sized buffers
	binder: fix unused alloc->free_async_space
	Input: atkbd - use ab83 as id when skipping the getid command
	dma-mapping: Fix build error unused-value
	virtio-crypto: fix memory leak in virtio_crypto_alg_skcipher_close_session()
	xen-netback: don't produce zero-size SKB frags
	binder: fix race between mmput() and do_exit()
	tick-sched: Fix idle and iowait sleeptime accounting vs CPU hotplug
	usb: phy: mxs: remove CONFIG_USB_OTG condition for mxs_phy_is_otg_host()
	usb: dwc: ep0: Update request status in dwc3_ep0_stall_restart
	Revert "usb: dwc3: Soft reset phy on probe for host"
	Revert "usb: dwc3: don't reset device side if dwc3 was configured as host-only"
	usb: chipidea: wait controller resume finished for wakeup irq
	usb: cdns3: fix uvc failure work since sg support enabled
	usb: cdns3: fix iso transfer error when mult is not zero
	usb: cdns3: Fix uvc fail when DMA cross 4k boundery since sg enabled
	Revert "usb: typec: class: fix typec_altmode_put_partner to put plugs"
	usb: typec: class: fix typec_altmode_put_partner to put plugs
	usb: mon: Fix atomicity violation in mon_bin_vma_fault
	serial: imx: Ensure that imx_uart_rs485_config() is called with enabled clock
	ALSA: oxygen: Fix right channel of capture volume mixer
	ALSA: hda/relatek: Enable Mute LED on HP Laptop 15s-fq2xxx
	fbdev: flush deferred work in fb_deferred_io_fsync()
	scsi: mpi3mr: Refresh sdev queue depth after controller reset
	block: add check that partition length needs to be aligned with block size
	netfilter: nf_tables: check if catch-all set element is active in next generation
	pwm: jz4740: Don't use dev_err_probe() in .request()
	io_uring/rw: ensure io->bytes_done is always initialized
	rootfs: Fix support for rootfstype= when root= is given
	Bluetooth: Fix atomicity violation in {min,max}_key_size_set
	bpf: Fix re-attachment branch in bpf_tracing_prog_attach
	iommu/arm-smmu-qcom: Add missing GMU entry to match table
	wifi: mt76: fix broken precal loading from MTD for mt7915
	wifi: rtlwifi: Remove bogus and dangerous ASPM disable/enable code
	wifi: rtlwifi: Convert LNKCTL change to PCIe cap RMW accessors
	wifi: mwifiex: configure BSSID consistently when starting AP
	PCI: dwc: endpoint: Fix dw_pcie_ep_raise_msix_irq() alignment support
	PCI: mediatek: Clear interrupt status before dispatching handler
	x86/kvm: Do not try to disable kvmclock if it was not enabled
	KVM: arm64: vgic-v4: Restore pending state on host userspace write
	KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache
	iio: adc: ad7091r: Pass iio_dev to event handler
	HID: wacom: Correct behavior when processing some confidence == false touches
	serial: sc16is7xx: add check for unsupported SPI modes during probe
	serial: sc16is7xx: set safe default SPI clock frequency
	iommu/dma: Trace bounce buffer usage when mapping buffers
	ARM: 9330/1: davinci: also select PINCTRL
	mfd: syscon: Fix null pointer dereference in of_syscon_register()
	leds: aw2013: Select missing dependency REGMAP_I2C
	mfd: intel-lpss: Fix the fractional clock divider flags
	mips: dmi: Fix early remap on MIPS32
	mips: Fix incorrect max_low_pfn adjustment
	riscv: Check if the code to patch lies in the exit section
	riscv: Fix module_alloc() that did not reset the linear mapping permissions
	MIPS: Alchemy: Fix an out-of-bound access in db1200_dev_setup()
	MIPS: Alchemy: Fix an out-of-bound access in db1550_dev_setup()
	power: supply: cw2015: correct time_to_empty units in sysfs
	power: supply: bq256xx: fix some problem in bq256xx_hw_init
	serial: 8250: omap: Don't skip resource freeing if pm_runtime_resume_and_get() failed
	libapi: Add missing linux/types.h header to get the __u64 type on io.h
	software node: Let args be NULL in software_node_get_reference_args
	serial: imx: fix tx statemachine deadlock
	selftests/sgx: Fix uninitialized pointer dereference in error path
	selftests/sgx: Skip non X86_64 platform
	iio: adc: ad9467: Benefit from devm_clk_get_enabled() to simplify
	iio: adc: ad9467: fix reset gpio handling
	iio: adc: ad9467: don't ignore error codes
	iio: adc: ad9467: fix scale setting
	perf genelf: Set ELF program header addresses properly
	tty: change tty_write_lock()'s ndelay parameter to bool
	tty: early return from send_break() on TTY_DRIVER_HARDWARE_BREAK
	tty: don't check for signal_pending() in send_break()
	tty: use 'if' in send_break() instead of 'goto'
	usb: cdc-acm: return correct error code on unsupported break
	nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length
	nvmet-tcp: fix a crash in nvmet_req_complete()
	perf env: Avoid recursively taking env->bpf_progs.lock
	apparmor: avoid crash when parsed profile name is empty
	usb: xhci-mtk: fix a short packet issue of gen1 isoc-in transfer
	serial: imx: Correct clock error message in function probe()
	nvmet: re-fix tracing strncpy() warning
	nvmet-tcp: Fix the H2C expected PDU len calculation
	PCI: keystone: Fix race condition when initializing PHYs
	s390/pci: fix max size calculation in zpci_memcpy_toio()
	net: qualcomm: rmnet: fix global oob in rmnet_policy
	net: ethernet: ti: am65-cpsw: Fix max mtu to fit ethernet frames
	net: phy: micrel: populate .soft_reset for KSZ9131
	mptcp: mptcp_parse_option() fix for MPTCPOPT_MP_JOIN
	mptcp: drop unused sk in mptcp_get_options
	mptcp: strict validation before using mp_opt->hmac
	mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect()
	mptcp: use OPTION_MPTCP_MPJ_SYN in subflow_check_req()
	net: ravb: Fix dma_addr_t truncation in error case
	net: stmmac: ethtool: Fixed calltrace caused by unbalanced disable_irq_wake calls
	bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS
	net: dsa: vsc73xx: Add null pointer check to vsc73xx_gpio_probe
	netfilter: nf_tables: reject invalid set policy
	netfilter: nft_connlimit: move stateful fields out of expression data
	netfilter: nft_last: move stateful fields out of expression data
	netfilter: nft_quota: move stateful fields out of expression data
	netfilter: nft_limit: rename stateful structure
	netfilter: nft_limit: move stateful fields out of expression data
	netfilter: nf_tables: memcg accounting for dynamically allocated objects
	netfilter: nft_limit: do not ignore unsupported flags
	netfilter: nf_tables: do not allow mismatch field size and set key length
	netfilter: nf_tables: skip dead set elements in netlink dump
	netfilter: nf_tables: reject NFT_SET_CONCAT with not field length description
	ipvs: avoid stat macros calls from preemptible context
	kdb: Fix a potential buffer overflow in kdb_local()
	ethtool: netlink: Add missing ethnl_ops_begin/complete
	mlxsw: spectrum_acl_erp: Fix error flow of pool allocation failure
	mlxsw: spectrum: Use 'bitmap_zalloc()' when applicable
	mlxsw: spectrum_acl_tcam: Add missing mutex_destroy()
	mlxsw: spectrum_acl_tcam: Make fini symmetric to init
	mlxsw: spectrum_acl_tcam: Reorder functions to avoid forward declarations
	mlxsw: spectrum_acl_tcam: Fix stack corruption
	selftests: mlxsw: qos_pfc: Adjust the test to support 8 lanes
	ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work
	i2c: s3c24xx: fix read transfers in polling mode
	i2c: s3c24xx: fix transferring more than one message in polling mode
	block: Remove special-casing of compound pages
	netfilter: nf_tables: typo NULL check in _clone() function
	netfilter: nft_connlimit: memleak if nf_ct_netns_get() fails
	netfilter: nft_limit: fix stateful object memory leak
	netfilter: nft_limit: Clone packet limits' cost value
	netfilter: nft_last: copy content when cloning expression
	netfilter: nft_quota: copy content when cloning expression
	arm64: dts: armada-3720-turris-mox: set irq type for RTC
	Revert "Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d""
	Linux 5.15.148

Change-Id: Ib12b7afb7a00d83d1868f9a0afd6d1c316560494
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-01-26 18:04:48 +00:00
Kalesh Singh
d9ce9afcf1 ANDROID: mm: Fix VMA ref count after fast-mremap
Since the cmpxchg() to unlock the VMA (reset ref count from -1), is
enclosed in VM_BUG_ON_VMA() it gets compiled out in non-debug builds
(CONFIG_DEBUG_VM=n). This means that any VMA that underwent a fast-remap
will have it's refcount stuck at -1, making it not be eligible for
future speculative faults, and preventing freeing of the VMA.

Bug: 322411509
Change-Id: If5bf61c7d94268700f2c4f096d946201b68abdb8
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
2024-01-26 04:58:45 +00:00
Greg Kroah-Hartman
0e69322670 Merge branch 'android14-5.15' into branch 'android14-5.15-lts'
A back-merge to catch the latest changes that are in the android14-5.15
branch.  This contains the following commits:

* 1982cd32ae ANDROID: GKI: Remove CONFIG_MEDIA_CEC_RC
*   270ce44fdb Merge "Merge tag 'android14-5.15.144_r00' into branch 'android14-5.15'" into android14-5.15
|\
| * f26b6b0390 Merge tag 'android14-5.15.144_r00' into branch 'android14-5.15'
* | 9a196e8051 ANDROID: uid_sys_stats: Drop CONFIG_UID_SYS_STATS_DEBUG logic
* | debd0f470b ANDROID: uid_sys_stats: Fully initialize uid_entry_tmp value
* | cf1268f696 UPSTREAM: usb: gadget: uvc: Remove nested locking
* | c9395ddbaa UPSTREAM: usb: gadget: uvc: Fix use are free during STREAMOFF
* | 7a71ed71fc ANDROID: fuse-bpf: Fix the issue of abnormal lseek system calls
* | da99db444b ANDROID: Update the ABI symbol list
* | 4f66f3be95 ANDROID: Export sysctl_sched_min_granularity
* | e32aeb03b9 UPSTREAM: sched/fair: Limit sched slice duration
* | b9e9a2c009 FROMGIT: mm: update mark_victim tracepoints fields
* | 61d5f76a90 UPSTREAM: mmc: core: Do not force a retune before RPMB switch
* | d85e6cb679 ANDROID: GKI: add symbol list for etm driver
* | eb31cad2df UPSTREAM: coresight: tmc: Don't enable TMC when it's not ready.
* | 57ddb1ecd7 UPSTREAM: netfilter: nf_tables: bail out on mismatching dynset and set expressions
|/
* a4da62d21c FROMGIT: usb: dwc3: gadget: Handle EP0 request dequeuing properly
* 0d3c49180f UPSTREAM: usb: dwc3: gadget: Refactor EP0 forced stall/restart into a separate API
* 154a4394d0 UPSTREAM: usb: dwc3: gadget: Execute gadget stop after halting the controller
* 0b1767af48 BACKPORT: usb: dwc3: gadget: Stall and restart EP0 if host is unresponsive
* b68fafef56 UPSTREAM: usb: dwc3: gadget: Submit endxfer command if delayed during disconnect
* 02524b7519 UPSTREAM: usb: dwc3: ep0: Don't prepare beyond Setup stage
* 149320568d ANDROID: arm64: mm: perform clean & invalidation in __dma_map_area
* d0cdb904f9 ANDROID: GKI: Update symbol list for Amlogic
* a95b355479 UPSTREAM: bcache: move uapi header bcache.h to bcache code directory
* 6246b8f3ef UPSTREAM: netfilter: nf_tables: skip set commit for deleted/destroyed sets
* 6048991845 ANDROID: KVM: arm64: Avoid BUG-ing from the host abort path
* 38cb0b1181 ANDROID: GKI: Update symbol list for lenovo
* 3cd672870a ANDROID: binder: fix KMI-break due to alloc->lock
* 63f7ddea2e ANDROID: binder: fix KMI-break due to address type change
* 74ecd99c15 BACKPORT: FROMGIT: binder: switch alloc->mutex to spinlock_t
* 5a8658eac3 BACKPORT: FROMGIT: binder: reverse locking order in shrinker callback
* f0667c870c FROMGIT: binder: avoid user addresses in debug logs
* b93c9f8565 FROMGIT: binder: refactor binder_delete_free_buffer()
* f6b1c043ae FROMGIT: binder: collapse print_binder_buffer() into caller
* 683f84a35f FROMGIT: binder: document the final page calculation
* 4c82cbad43 BACKPORT: FROMGIT: binder: rename lru shrinker utilities
* eba1fb9603 UPSTREAM: drivers/android: remove redundant ret variable
* 356047fe2a FROMGIT: binder: make oversized buffer code more readable
* f7476dca31 FROMGIT: binder: remove redundant debug log
* 477e8e8453 BACKPORT: FROMGIT: binder: perform page installation outside of locks
* af71193412 FROMGIT: binder: initialize lru pages in mmap callback
* ef524f4dd4 FROMGIT: binder: malloc new_buffer outside of locks
* b23dbdbf19 BACKPORT: FROMGIT: binder: refactor page range allocation
* 59e0d62fc8 BACKPORT: FROMGIT: binder: relocate binder_alloc_clear_buf()
* 081ddad216 FROMGIT: binder: relocate low space calculation
* e1d195e94d FROMGIT: binder: separate the no-space debugging logic
* 26d06d9349 FROMGIT: binder: remove pid param in binder_alloc_new_buf()
* d5c44f9065 FROMGIT: binder: do unlocked work in binder_alloc_new_buf()
* 0b24368fff FROMGIT: binder: split up binder_update_page_range()
* c38a89805f FROMGIT: binder: keep vma addresses type as unsigned long
* ca5c7be9e0 FROMGIT: binder: remove extern from function prototypes
* 2a250a1528 FROMGIT: binder: fix comment on binder_alloc_new_buf() return value
* 26f0c01348 FROMGIT: binder: fix trivial typo of binder_free_buf_locked()
* 11ca07657c FROMGIT: binder: fix unused alloc->free_async_space
* 65cf1585ea FROMGIT: binder: fix async space check for 0-sized buffers
* 1787dddd97 FROMGIT: binder: fix race between mmput() and do_exit()
* 8dce2880bc FROMGIT: binder: fix use-after-free in shinker's callback
* 3c4732563e FROMGIT: binder: use EPOLLERR from eventpoll.h
* 486b17a096 ANDROID: GKI: Update symbol list for Amlogic
* bfefe25dfa UPSTREAM: bpf: Fix prog_array_map_poke_run map poke update
* 274748592e ANDROID: gki_defconfig: Set CONFIG_IDLE_INJECT and CONFIG_CPU_IDLE_THERMAL into y
* 597362d44f ANDROID: KVM: arm64: Don't prepopulate MMIO regions for host stage-2
* 45d542adb4 ANDROID: KVM: arm64: Fix host_smc print typo
* 38bb85f2fb ANDROID: KVM: arm64: Fix hyp event alignment
* c09c7c05d0 ANDROID: KVM: arm64: Document module_change_host_prot_range
* 80d91f64ba BACKPORT: USB: gadget: core: adjust uevent timing on gadget unbind
* 19a4494b2b ANDROID: GKI: Update RTK STB KMI symbol list
* 55f6a96975 UPSTREAM: dm verity: don't perform FEC for failed readahead IO
* 781393c0a2 UPSTREAM: ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
* 97c69470fe UPSTREAM: netfilter: nft_set_pipapo: skip inactive elements during set walk
* 16ea59408c ANDROID: fuse-bpf: Follow mounts in lookups
* abea1cb16e ANDROID: Snapshot Mainline's version of checkpatch.pl
* 9f6f0c1de5 ANDROID: GKI: Update symbol list for Amlogic
* a5123cff8d ANDROID: KVM: arm64: Skip prefaulting ptes which will be modified later
* 97bbbf4497 ANDROID: KVM: arm64: Introduce module_change_host_prot_range
* 1dc2dbbb57 ANDROID: KVM: arm64: Relax checks in module_change_host_page_prot
* b43baa770b ANDROID: KVM: arm64: Optimise module_change_host_page_prot
* dc87f3522e ANDROID: KVM: arm64: Prefault entries when splitting a block mapping
* ab6f88aebe ANDROID: GKI: Update symbol list for transsion
* 896cff8734 ANDROID: Add vendor_hooks to workaround CONFIG_TASK_DELAY_ACCT
* 3d3f9377b2 ANDROID:  Add missing symbol for QCOM
* 5feaf92b24 UPSTREAM: binder: fix memory leaks of spam and pending work
* 92bef7c6af UPSTREAM: mm,kfence: decouple kfence from page granularity mapping judgement
* e6ffb329ee UPSTREAM: arm64/mm: fold check for KFENCE into can_set_direct_map()
* b39c28c44c ANDROID: GKI: db845c: Update symbols list and ABI on rpmsg_register_device_override
* d0b481d97e ANDROID: fix up rpmsg_device ABI break
* 6bfb30205b ANDROID: fix up platform_device ABI break
* 649e9135df UPSTREAM: rpmsg: Fix possible refcount leak in rpmsg_register_device_override()
* b1e39deac4 UPSTREAM: rpmsg: glink: Release driver_override
* 9697a16480 BACKPORT: rpmsg: Fix calling device_lock() on non-initialized device
* 01b4519a41 BACKPORT: rpmsg: Fix kfree() of static memory on setting driver_override
* d82ae69002 UPSTREAM: rpmsg: Constify local variable in field store macro
* 341acb7bac UPSTREAM: driver: platform: Add helper for safer setting of driver_override
* 81051a615f Revert "ANDROID: Enable CONFIG_KUNIT=y."
* 1d5461bec0 Revert "ANDROID: Add kunit targets."
* 12ab8f1569 UPSTREAM: io_uring/fdinfo: lock SQ thread while retrieving thread cpu/pid
* 3a7b8e544b ANDROID: arm64: Remove a bunch of duplicate errata hunks
* 4ba6c3197c ANDROID: arm64: Disable workaround for CPU errata 2441007 and 2441009
* 0bea71c862 ANDROID: abi_gki_aarch64_qcom: Add GIC and hibernation APIs
* 3923e9952d ANDROID: irqchip/irq-gic-v3: Add vendor hook for gic suspend
* bd58836882 ANDROID: Update the ABI representation
* 16a47663f5 BACKPORT: fscrypt: support crypto data unit size less than filesystem block size
* a934b92361 ANDROID: mm: do not allow file-backed pages from CMA
* 35482d0d38 UPSTREAM: netfilter: nf_tables: remove catchall element in GC sync path
* e19a3cd1ce ANDROID: fuse-bpf: Ignore readaheads unless they go to the daemon
* 5421e17c17 ANDROID: Update the ABI symbol list
* 46f8b2ca58 ANDROID: GKI: add a vendor hook in ptep_clear_flush_young()
* 0add0e52ef UPSTREAM: fs: drop_caches: draining pages before dropping caches
*   0d1f309e44 Merge "Merge tag 'android14-5.15.137_r00' into branch 'android14-5.15'" into android14-5.15
|\
| * 6dfd4d406c Merge tag 'android14-5.15.137_r00' into branch 'android14-5.15'
* | 73c2c0d53d ANDROID: Update the ABI symbol list
* | 87344b2ab7 ANDROID: sched: Add trace_android_rvh_set_user_nice_locked
|/
* bd1e76c09b ANDROID: GKI: update symbol list
* fdaddcab76 ANDROID: GKI: vendor code needs __balance_callbacks access
* e2fbc5cc3a ANDROID: KVM: arm64: pkvm_module_ops documentation
* bf291bdd70 UPSTREAM: usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm()
* 52ecdc264d UPSTREAM: USB: core: Fix race by not overwriting udev->descriptor in hub_port_init()
* a7f103722b UPSTREAM: USB: core: Change usb_get_device_descriptor() API
* 28e703ec05 UPSTREAM: USB: core: Unite old scheme and new scheme descriptor reads
* e5f9357102 ANDROID: GKI: Update symbol list for lenovo
* dcf95aa0af FROMGIT: usb:gadget:uvc Do not use worker thread to pump isoc usb requests
* 8078e50f5e FROMGIT: usb: gadget: uvc: Fix use-after-free for inflight usb_requests
* 0041748215 FROMGIT: usb: gadget: uvc: move video disable logic to its own function
* 563283055b FROMGIT: usb: gadget: uvc: Allocate uvc_requests one at a time
* 848fa308a9 FROMGIT: usb: gadget: uvc: prevent use of disabled endpoint
* 24e0a18cb4 ANDROID: abi_gki_aarch64_qcom: Update symbol list
* 8ab43e8a3e ANDROID: arch_topology: Add android_rvh_update_thermal_stats
* 6ac8b4fbb4 ANDROID: fuse-bpf: Add NULL pointer check in fuse_release_in
* 4030b1eeed ANDROID: GKI: update symbol list for lenovo
* 71647086d7 ANDROID: GKI: add a vendor hook in cpufreq_online
* 2cecfa7378 FROMGIT: Input: uinput - allow injecting event times
* e9a7a2060a ANDROID: Update the ABI symbol list
* 984523c368 ANDROID: sched: Add vendor hook for update_load_sum
* f88c9605bd ANDROID: GKI: update mtktv symbol
* b6fd46aaf1 ANDROID: GKI: Add symbol list for Transsion
* 17d202d85b ANDROID: KVM: arm64: mount procfs for pKVM module loading
* be8f9c8bf9 ANDROID: GKI: Update symbol list for Amlogic
* 76fcf197f2 UPSTREAM: ASoC: soc-compress: Fix deadlock in soc_compr_open_fe
* 7f194d670f BACKPORT: ASoC: add snd_soc_card_mutex_lock/unlock()
* 8cdc41d9b8 BACKPORT: ASoC: expand snd_soc_dpcm_mutex_lock/unlock()
* 2721efad0a BACKPORT: ASoC: expand snd_soc_dapm_mutex_lock/unlock()
* b7bcf839e1 ANDROID: KVM: arm64: Fix error path in pkvm_mem_abort()
* 27aaaa9af5 ANDROID: GKI: Update symbol list for Amlogic
* 0681d570ba ANDROID: mm: add vendor hook in isolate_freepages()
* f206a8c31c ANDROID: GKI: Update symbol list for Amlogic
* 88b56693e9 ANDROID: GKI: Update symbol list for rtktv
* dbeed23196 ANDROID: fs/passthrough: Fix compatibility with R/O file system
* bde02310d4 ANDROID: Update the ABI symbol list
* 71320d0c1e Revert "ANDROID: KVM: arm64: Don't allocate from handle_host_mem_abort"
* 7b356cb300 UPSTREAM: netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c
* 7d75f8038b UPSTREAM: vringh: don't use vringh_kiov_advance() in vringh_iov_xfer()
* 484868e95c BACKPORT: usb: gadget: uvc: Add missing initialization of ssp config descriptor
* ae71397d90 BACKPORT: usb: gadget: unconditionally allocate hs/ss descriptor in bind operation
* f5beeb23ed UPSTREAM: usb: gadget: f_uvc: change endpoint allocation in uvc_function_bind()
* 65aa3dd94a UPSTREAM: usb: gadget: function: Remove unused declarations
* 81bffd1c1a UPSTREAM: usb: gadget: uvc: clean up comments and styling in video_pump
* 0772c040ae UPSTREAM: ravb: Fix use-after-free issue in ravb_tx_timeout_work()
* 069cc1491e UPSTREAM: ravb: Fix up dma_free_coherent() call in ravb_remove()
* 501954e892 BACKPORT: usb: typec: altmodes/displayport: Signal hpd low when exiting mode
* b39c40b693 ANDROID: Update the ABI symbol list
* 858e65da9c ANDROID: f2fs: Fix the calculation of the number of zones
* 2eb175772d ANDROID: GKI: Update symbol list for lenovo
* 0a25bb8f1c ANDROID: KVM: arm64: Fix KVM_HOST_S2_DEFAULT_MMIO_PTE encoding

Change-Id: I7d833acbf81f15f2b96f130d293febe6a8b3fca2
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2024-01-26 03:06:45 +00:00
Greg Kroah-Hartman
6139f2a02f Linux 5.15.148
Link: https://lore.kernel.org/r/20240122235744.598274724@linuxfoundation.org
Tested-by: SeongJae Park <sj@kernel.org>
Tested-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Link: https://lore.kernel.org/r/20240123174500.819179356@linuxfoundation.org
Tested-by: SeongJae Park <sj@kernel.org>
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
Tested-by: Kelsey Steele <kelseysteele@linux.microsoft.com>
Tested-by: Ron Economos <re@w6rz.net>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Allen Pais <apais@linux.microsoft.com>
Tested-by: kernelci.org bot <bot@kernelci.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-01-25 14:52:56 -08:00
Song Liu
84c39986fe Revert "Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d""
This reverts commit bed9e27baf52a09b7ba2a3714f1e24e17ced386d.

The original set [1][2] was expected to undo a suboptimal fix in [2], and
replace it with a better fix [1]. However, as reported by Dan Moulding [2]
causes an issue with raid5 with journal device.

Revert [2] for now to close the issue. We will follow up on another issue
reported by Juxiao Bi, as [2] is expected to fix it. We believe this is a
good trade-off, because the latter issue happens less freqently.

In the meanwhile, we will NOT revert [1], as it contains the right logic.

[1] commit d6e035aad6c0 ("md: bypass block throttle for superblock update")
[2] commit bed9e27baf52 ("Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"")

Reported-by: Dan Moulding <dan@danm.net>
Closes: https://lore.kernel.org/linux-raid/20240123005700.9302-1-dan@danm.net/
Fixes: bed9e27baf52 ("Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"")
Cc: stable@vger.kernel.org # v5.19+
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Song Liu <song@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-01-25 14:52:56 -08:00
Sjoerd Simons
c8483a4845 arm64: dts: armada-3720-turris-mox: set irq type for RTC
commit fca8a117c1c9a0f8b8feed117db34cf58134dc2c upstream.

The rtc on the mox shares its interrupt line with the moxtet bus. Set
the interrupt type to be consistent between both devices. This ensures
correct setup of the interrupt line regardless of probing order.

Signed-off-by: Sjoerd Simons <sjoerd@collabora.com>
Cc: <stable@vger.kernel.org> # v6.2+
Fixes: 21aad8ba61 ("arm64: dts: armada-3720-turris-mox: Add missing interrupt for RTC")
Reviewed-by: Marek Behún <kabel@kernel.org>
Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-01-25 14:52:56 -08:00
Pablo Neira Ayuso
98052220f1 netfilter: nft_quota: copy content when cloning expression
commit aabef97a35 upstream.

If the ruleset contains consumed quota, restore them accordingly.
Otherwise, listing after restoration shows never used items.

Restore the user-defined quota and flags too.

Fixes: ed0a0c60f0 ("netfilter: nft_quota: move stateful fields out of expression data")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-01-25 14:52:56 -08:00
Pablo Neira Ayuso
3be3c61232 netfilter: nft_last: copy content when cloning expression
commit 860e874290 upstream.

If the ruleset contains last timestamps, restore them accordingly.
Otherwise, listing after restoration shows never used items.

Fixes: 33a24de37e ("netfilter: nft_last: move stateful fields out of expression data")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-01-25 14:52:56 -08:00
Phil Sutter
42d4617848 netfilter: nft_limit: Clone packet limits' cost value
commit 558254b0b6 upstream.

When cloning a packet-based limit expression, copy the cost value as
well. Otherwise the new limit is not functional anymore.

Fixes: 3b9e2ea6c1 ("netfilter: nft_limit: move stateful fields out of expression data")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-01-25 14:52:56 -08:00
Florian Westphal
d808805851 netfilter: nft_limit: fix stateful object memory leak
commit 1a58f84ea5 upstream.

We need to provide a destroy callback to release the extra fields.

Fixes: 3b9e2ea6c1 ("netfilter: nft_limit: move stateful fields out of expression data")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-01-25 14:52:55 -08:00
Pablo Neira Ayuso
e562d84225 netfilter: nft_connlimit: memleak if nf_ct_netns_get() fails
commit 7d70984a1a upstream.

Check if nf_ct_netns_get() fails then release the limit object
previously allocated via kmalloc().

Fixes: 37f319f37d ("netfilter: nft_connlimit: move stateful fields out of expression data")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-01-25 14:52:55 -08:00