Commit Graph

1051878 Commits

Author SHA1 Message Date
Veerendranath Jakkam
6ebaf9ca4c UPSTREAM: nl80211: Add support to set AP settings flags with single attribute
In previous method each AP settings flag is represented by a top-level
flag attribute and conversion to enum cfg80211_ap_settings_flags had to
be done before sending them to driver. This commit is to make it easier
to define new AP settings flags and sending them to driver.

This commit also deprecate sending of
%NL80211_ATTR_EXTERNAL_AUTH_SUPPORT in %NL80211_CMD_START_AP. But to
maintain backwards compatibility checks for
%NL80211_ATTR_EXTERNAL_AUTH_SUPPORT in %NL80211_CMD_START_AP when
%NL80211_ATTR_AP_SETTINGS_FLAGS not present in %NL80211_CMD_START_AP.

Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
Link: https://lore.kernel.org/r/1637911519-21306-1-git-send-email-vjakkam@codeaurora.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Bug: 215824523
(cherry picked from commit 47301a74bb)
Change-Id: I84d7c859fabcda0c90cb05b0f4d3714b268ba232
Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-02-03 10:54:54 -08:00
Lorenzo Bianconi
edd3b03740 UPSTREAM: cfg80211: rename offchannel_chain structs to background_chain to avoid confusion with ETSI standard
ETSI standard defines "Offchannel CAC" as:
"Off-Channel CAC is performed by a number of non-continuous checks
spread over a period in time. This period, which is required to
determine the presence of radar signals, is defined as the Off-Channel
CAC Time..
Minimum Off-Channel CAC Time 6 minutes and Maximum Off-Channel CAC Time
4 hours..".
mac80211 implementation refers to a dedicated hw chain used for continuous
radar monitoring. Rename offchannel_* references to background_* in
order to avoid confusion with ETSI standard.

Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://lore.kernel.org/r/4204cc1d648d76b44557981713231e030a3bd991.1638190762.git.lorenzo@kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Bug: 215824523
(cherry picked from commit a95bfb876f)
Change-Id: I0dbbbd3d3276959cec772ee65d9f57879712e74c
Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-02-03 10:54:54 -08:00
Lorenzo Bianconi
aef95dea79 UPSTREAM: mac80211: introduce set_radar_offchan callback
Similar to cfg80211, introduce set_radar_offchan callback in mac80211_ops
in order to configure a dedicated offchannel chain available on some hw
(e.g. mt7915) to perform offchannel CAC detection and avoid tx/rx downtime.

Tested-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://lore.kernel.org/r/201110606d4f3a7dfdf31440e351f2e2c375d4f0.1634979655.git.lorenzo@kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Bug: 215824523
(cherry picked from commit 237337c230)
Change-Id: I80c8f060111e05a1e02b1e8926d4da53c6aa636e
Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-02-03 10:54:54 -08:00
Ilan Peer
2706cc9064 UPSTREAM: cfg80211: Add support for notifying association comeback
Thought the underline driver MLME can handle association temporal
rejection with comeback, it is still useful to notify this to
user space, as user space might want to handle the temporal
rejection differently. For example, in case the comeback time
is too long, user space can deauthenticate immediately and try
to associate with a different AP.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20211129152938.2467809e8cb3.I45574185b582666bc78eef0c29a4c36b478e5382@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Bug: 215824523
(cherry picked from commit a083ee8a4e)
Change-Id: I47f7aa2b409f267b82431fd79c205e20e4df4981
Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-02-03 10:54:54 -08:00
Johannes Berg
d3578b139d UPSTREAM: cfg80211: simplify cfg80211_chandef_valid()
There are a lot of duplicate checks in this function to
check the delta between the control channel and CF1.
With the addition of 320 MHz, this will become even more.
Simplify the code so that the common checks are done
only once for multiple bandwidths.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20211129152938.2d0240b07f11.I759e8e990f5386ba2b56ffb2488a8d4e16e22c1b@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Bug: 215824523
(cherry picked from commit 3bb1ccc4ed)
Change-Id: I404920dc3e613455d933ab84947099d1c696c3fd
Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-02-03 10:54:54 -08:00
Finn Behrens
92d558f329 UPSTREAM: nl80211: remove reload flag from regulatory_request
This removes the previously unused reload flag, which was introduced in
1eda919126.
The request is handled as NL80211_REGDOM_SET_BY_CORE, which is parsed
unconditionally.

Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Nathan Chancellor <nathan@kernel.org>
Fixes: 1eda919126 ("nl80211: reset regdom when reloading regdb")
Link: https://lore.kernel.org/all/YaZuKYM5bfWe2Urn@archlinux-ax161/
Signed-off-by: Finn Behrens <me@kloenk.de>
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
Link: https://lore.kernel.org/r/YadvTolO8rQcNCd/@gimli.kloenk.dev
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Bug: 215824523
(cherry picked from commit 37d3311424)
Change-Id: I26ea2e65f8e853dc8133e56296710aeb4a1c8c01
Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-02-03 10:54:53 -08:00
Finn Behrens
f3a39c4218 UPSTREAM: nl80211: reset regdom when reloading regdb
Reload the regdom when the regulatory db is reloaded.
Otherwise, the user had to change the regulatoy domain
to a different one and then reset it to the correct
one to have a new regulatory db take effect after a
reload.

Signed-off-by: Finn Behrens <fin@nyantec.com>
Link: https://lore.kernel.org/r/YaIIZfxHgqc/UTA7@gimli.kloenk.dev
[edit commit message]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Bug: 215824523
(cherry picked from commit 1eda919126)
Change-Id: I2e51ae0fa2b44d850ebe3d30c90e69a1a2c92221
Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-02-03 10:54:53 -08:00
Johannes Berg
ccb91dbf24 UPSTREAM: cfg80211: use ieee80211_bss_get_elem() instead of _get_ie()
Use the structured helper for finding an element instead of
the unstructured ieee80211_bss_get_ie().

Link: https://lore.kernel.org/r/20210930131130.e94709f341c3.I4ddb7fcb40efca27987deda7f9a144a5702ebfae@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Bug: 215824523
(cherry picked from commit fb8b53acf6)
Change-Id: I2ce0b62e038bedee306bb29a34d2c6ed262e5d83
Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-02-03 10:54:53 -08:00
Lorenzo Bianconi
72059fa373 UPSTREAM: cfg80211: allow continuous radar monitoring on offchannel chain
Allow continuous radar detection on the offchannel chain in order
to switch to the monitored channel whenever the underlying driver
reports a radar pattern on the main channel.

Tested-by: Owen Peng <owen.peng@mediatek.com>
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://lore.kernel.org/r/d46217310a49b14ff0e9c002f0a6e0547d70fd2c.1637071350.git.lorenzo@kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Bug: 215824523
(cherry picked from commit 8415816493)
Change-Id: Icd087afa0cd4305fab507f6cef5e4025bdfad70e
Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-02-03 10:54:53 -08:00
Lorenzo Bianconi
0493ff880f UPSTREAM: cfg80211: schedule offchan_cac_abort_wk in cfg80211_radar_event
If necessary schedule offchan_cac_abort_wk work in cfg80211_radar_event
routine adding offchan parameter to cfg80211_radar_event signature.
Rename cfg80211_radar_event in __cfg80211_radar_event and introduce
the two following inline helpers:
- cfg80211_radar_event
- cfg80211_offchan_radar_event
Doing so the drv will not need to run cfg80211_offchan_cac_abort() after
radar detection on the offchannel chain.

Tested-by: Owen Peng <owen.peng@mediatek.com>
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://lore.kernel.org/r/3ff583e021e3343a3ced54a7b09b5e184d1880dc.1637062727.git.lorenzo@kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Bug: 215824523
(cherry picked from commit c47240cb46)
Change-Id: I10bc3bc1630f25064562fd6e8a9f4ebdc3d7481e
Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-02-03 10:54:53 -08:00
liuguoqiang
58ea06f6b2 UPSTREAM: cfg80211: delete redundant free code
When kzalloc failed and rdev->sacn_req or rdev->scan_msg is null, pass a
null pointer to kfree is redundant, delete it and return directly.

Signed-off-by: liuguoqiang <liuguoqiang@uniontech.com>
Link: https://lore.kernel.org/r/20211115092139.24407-1-liuguoqiang@uniontech.com
[remove now unused creq = NULL assigment]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Bug: 215824523
(cherry picked from commit 3536672bbd)
Change-Id: I650e011e4bb5def81f0af15cff74fbe4fe0424f7
Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-02-03 10:54:53 -08:00
Lorenzo Bianconi
b03386aee2 UPSTREAM: cfg80211: fix possible NULL pointer dereference in cfg80211_stop_offchan_radar_detection
Fix the following NULL pointer dereference in
cfg80211_stop_offchan_radar_detection routine that occurs when hostapd
is stopped during the CAC on offchannel chain:

Sat Jan  1 0[  779.567851]   ESR = 0x96000005
0:12:50 2000 dae[  779.572346]   EC = 0x25: DABT (current EL), IL = 32 bits
mon.debug hostap[  779.578984]   SET = 0, FnV = 0
d: hostapd_inter[  779.583445]   EA = 0, S1PTW = 0
face_deinit_free[  779.587936] Data abort info:
: num_bss=1 conf[  779.592224]   ISV = 0, ISS = 0x00000005
->num_bss=1
Sat[  779.597403]   CM = 0, WnR = 0
 Jan  1 00:12:50[  779.601749] user pgtable: 4k pages, 39-bit VAs, pgdp=00000000418b2000
 2000 daemon.deb[  779.609601] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000
ug hostapd: host[  779.619657] Internal error: Oops: 96000005 [#1] SMP
[  779.770810] CPU: 0 PID: 2202 Comm: hostapd Not tainted 5.10.75 #0
[  779.776892] Hardware name: MediaTek MT7622 RFB1 board (DT)
[  779.782370] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO BTYPE=--)
[  779.788384] pc : cfg80211_chandef_valid+0x10/0x490 [cfg80211]
[  779.794128] lr : cfg80211_check_station_change+0x3190/0x3950 [cfg80211]
[  779.800731] sp : ffffffc01204b7e0
[  779.804036] x29: ffffffc01204b7e0 x28: ffffff80039bdc00
[  779.809340] x27: 0000000000000000 x26: ffffffc008cb3050
[  779.814644] x25: 0000000000000000 x24: 0000000000000002
[  779.819948] x23: ffffff8002630000 x22: ffffff8003e748d0
[  779.825252] x21: 0000000000000cc0 x20: ffffff8003da4a00
[  779.830556] x19: 0000000000000000 x18: ffffff8001bf7ce0
[  779.835860] x17: 00000000ffffffff x16: 0000000000000000
[  779.841164] x15: 0000000040d59200 x14: 00000000000019c0
[  779.846467] x13: 00000000000001c8 x12: 000636b9e9dab1c6
[  779.851771] x11: 0000000000000141 x10: 0000000000000820
[  779.857076] x9 : 0000000000000000 x8 : ffffff8003d7d038
[  779.862380] x7 : 0000000000000000 x6 : ffffff8003d7d038
[  779.867683] x5 : 0000000000000e90 x4 : 0000000000000038
[  779.872987] x3 : 0000000000000002 x2 : 0000000000000004
[  779.878291] x1 : 0000000000000000 x0 : 0000000000000000
[  779.883594] Call trace:
[  779.886039]  cfg80211_chandef_valid+0x10/0x490 [cfg80211]
[  779.891434]  cfg80211_check_station_change+0x3190/0x3950 [cfg80211]
[  779.897697]  nl80211_radar_notify+0x138/0x19c [cfg80211]
[  779.903005]  cfg80211_stop_offchan_radar_detection+0x7c/0x8c [cfg80211]
[  779.909616]  __cfg80211_leave+0x2c/0x190 [cfg80211]
[  779.914490]  cfg80211_register_netdevice+0x1c0/0x6d0 [cfg80211]
[  779.920404]  raw_notifier_call_chain+0x50/0x70
[  779.924841]  call_netdevice_notifiers_info+0x54/0xa0
[  779.929796]  __dev_close_many+0x40/0x100
[  779.933712]  __dev_change_flags+0x98/0x190
[  779.937800]  dev_change_flags+0x20/0x60
[  779.941628]  devinet_ioctl+0x534/0x6d0
[  779.945370]  inet_ioctl+0x1bc/0x230
[  779.948849]  sock_do_ioctl+0x44/0x200
[  779.952502]  sock_ioctl+0x268/0x4c0
[  779.955985]  __arm64_sys_ioctl+0xac/0xd0
[  779.959900]  el0_svc_common.constprop.0+0x60/0x110
[  779.964682]  do_el0_svc+0x1c/0x24
[  779.967990]  el0_svc+0x10/0x1c
[  779.971036]  el0_sync_handler+0x9c/0x120
[  779.974950]  el0_sync+0x148/0x180
[  779.978259] Code: a9bc7bfd 910003fd a90153f3 aa0003f3 (f9400000)
[  779.984344] ---[ end trace 0e67b4f5d6cdeec7 ]---
[  779.996400] Kernel panic - not syncing: Oops: Fatal exception
[  780.002139] SMP: stopping secondary CPUs
[  780.006057] Kernel Offset: disabled
[  780.009537] CPU features: 0x0000002,04002004
[  780.013796] Memory Limit: none

Fixes: b8f5facf286b ("cfg80211: implement APIs for dedicated radar detection HW")
Reported-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
Tested-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://lore.kernel.org/r/c2e34c065bf8839c5ffa45498ae154021a72a520.1635958796.git.lorenzo@kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Bug: 215824523
(cherry picked from commit 91e89c7732)
Change-Id: Ic305d4860e92b67dd1dc74dec9ac5deb7a42cf74
Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-02-03 10:54:53 -08:00
Lorenzo Bianconi
c6e3db4b3c UPSTREAM: cfg80211: move offchan_cac_event to a dedicated work
In order to make cfg80211_offchan_cac_abort() (renamed from
cfg80211_offchan_cac_event) callable in other contexts and
without so much locking restrictions, make it trigger a new
work instead of operating directly.

Do some other renames while at it to clarify.

Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://lore.kernel.org/r/6145c3d0f30400a568023f67981981d24c7c6133.1635325205.git.lorenzo@kernel.org
[rewrite commit log]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Bug: 215824523
(cherry picked from commit 1507b15319)
Change-Id: I41235223e0211d55760e83b2b2a8b1f3229c5c3c
Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-02-03 10:54:52 -08:00
Ilan Peer
9ba3336fdc UPSTREAM: cfg80211: Fix order of enum nl80211_band_iftype_attr documentation
And fix the comment.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20211129152938.4ef43aff0c5d.I96dcb743bcd4f387ba4cfaa61987aeb642ad762b@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Bug: 215824523
(cherry picked from commit 28f350a67d)
Change-Id: I8e5cb61c85e448dbf537c3d098090f2e98549239
Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-02-03 10:54:52 -08:00
Lorenzo Bianconi
5d0725f5d6 UPSTREAM: cfg80211: implement APIs for dedicated radar detection HW
If a dedicated (off-channel) radar detection hardware (chain)
is available in the hardware/driver, allow this to be used by
calling the NL80211_CMD_RADAR_DETECT command with a new flag
attribute requesting off-channel radar detection is used.

Offchannel CAC (channel availability check) avoids the CAC
downtime when switching to a radar channel or when turning on
the AP.

Drivers advertise support for this using the new feature flag
NL80211_EXT_FEATURE_RADAR_OFFCHAN.

Tested-by: Evelyn Tsai <evelyn.tsai@mediatek.com>
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://lore.kernel.org/r/7468e291ef5d05d692c1738d25b8f778d8ea5c3f.1634979655.git.lorenzo@kernel.org
Link: https://lore.kernel.org/r/1e60e60fef00e14401adae81c3d49f3e5f307537.1634979655.git.lorenzo@kernel.org
Link: https://lore.kernel.org/r/85fa50f57fc3adb2934c8d9ca0be30394de6b7e8.1634979655.git.lorenzo@kernel.org
Link: https://lore.kernel.org/r/4b6c08671ad59aae0ac46fc94c02f31b1610eb72.1634979655.git.lorenzo@kernel.org
Link: https://lore.kernel.org/r/241849ccaf2c228873c6f8495bf87b19159ba458.1634979655.git.lorenzo@kernel.org
[remove offchan_mutex, fix cfg80211_stop_offchan_radar_detection(),
 remove gfp_t argument, fix documentation, fix tracing]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Bug: 215824523
(cherry picked from commit bc2dfc0283)
Change-Id: Ib1b423534d2383c7b1d186ed7ec085c89151d5ff
Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-02-03 10:54:52 -08:00
Johannes Berg
38631d440d UPSTREAM: cfg80211: fix kernel-doc for MBSSID EMA
The struct member ema_max_profile_periodicity was listed
with the wrong name in the kernel-doc, fix that.

Link: https://lore.kernel.org/r/20211021173038.18ec2030c66b.Iac731bb299525940948adad2c41f514b7dd81c47@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Bug: 215824523
(cherry picked from commit f9d366d420)
Change-Id: I69bba5ae01593ea76a08c155c5141849ec945f8b
Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-02-03 10:54:52 -08:00
Srinivasan Raju
290bc8e2f8 UPSTREAM: nl80211: Add LC placeholder band definition to nl80211_band
Define LC band which is a draft under IEEE 802.11bb.
Current NL80211_BAND_LC is a placeholder band and
will be more defined IEEE 802.11bb progresses.

Signed-off-by: Srinivasan Raju <srini.raju@purelifi.com>
Link: https://lore.kernel.org/r/20211018100143.7565-2-srini.raju@purelifi.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Bug: 215824523
(cherry picked from commit 63fa042666)
Change-Id: I61a62aad3449a7f5efad8e18454980d53b7bd010
Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-02-03 10:54:52 -08:00
John Crispin
ede2a43301 UPSTREAM: nl80211: MBSSID and EMA support in AP mode
Add new attributes to configure support for multiple BSSID
and advanced multi-BSSID advertisements (EMA) in AP mode.

- NL80211_ATTR_MBSSID_CONFIG used for per interface configuration.
- NL80211_ATTR_MBSSID_ELEMS used to MBSSID elements for beacons.

Memory for the elements is allocated dynamically. This change frees
the memory in existing functions which call nl80211_parse_beacon(),
a comment is added to indicate the new references to do the same.

Signed-off-by: John Crispin <john@phrozen.org>
Co-developed-by: Aloka Dixit <alokad@codeaurora.org>
Signed-off-by: Aloka Dixit <alokad@codeaurora.org>
Link: https://lore.kernel.org/r/20210916025437.29138-2-alokad@codeaurora.org
[don't leave ERR_PTR hanging around]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Bug: 215824523
(cherry picked from commit dc1e3cb8da)
Change-Id: I446257c295df9eb840b4e113b646559120c71f31
Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-02-03 10:54:52 -08:00
Johannes Berg
42c6a8abb7 UPSTREAM: nl80211: don't put struct cfg80211_ap_settings on stack
This struct has grown quite a bit, so dynamically allocate
it instead of putting it on the stack.

Link: https://lore.kernel.org/r/20210923161836.5813d881eae3.I0fc0f83905b0bfa332c4f1505e00c13abfca3545@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Bug: 215824523
(cherry picked from commit 9e263e193a)
Change-Id: I7f3a24c9cbe28bcde3e15b7e92f3e7a7c1f02987
Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-02-03 10:54:51 -08:00
Subrat Mishra
e021381788 UPSTREAM: cfg80211: AP mode driver offload for FILS association crypto
Add a driver FILS crypto offload extended capability flag to indicate
that the driver running in AP mode is capable of handling encryption
and decryption of (Re)Association request and response frames.
Add a command to set FILS AAD data to driver.

This feature is supported on drivers running in AP mode only.
This extended capability is exchanged with hostapd during cfg80211
init. If the driver indicates this capability, then before sending the
Authentication response frame, hostapd sets FILS AAD data to the
driver. This allows the driver to decrypt (Re)Association Request
frame and encrypt (Re)Association Response frame. FILS Key derivation
will still be done in hostapd.

Signed-off-by: Subrat Mishra <subratm@codeaurora.org>
Link: https://lore.kernel.org/r/1631685143-13530-1-git-send-email-subratm@codeaurora.org
[fix whitespace]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Bug: 215824523
(cherry picked from commit e306784a8d)
Change-Id: I3ab2a3c5a31deef0ae44da3eca4b82c91c46e453
Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-02-03 10:54:51 -08:00
Tim Murray
206689258c FROMGIT: f2fs: move f2fs to use reader-unfair rwsems
f2fs rw_semaphores work better if writers can starve readers,
especially for the checkpoint thread, because writers are strictly
more important than reader threads. This prevents significant priority
inversion between low-priority readers that blocked while trying to
acquire the read lock and a second acquisition of the write lock that
might be blocking high priority work.

Bug: 214413989
Signed-off-by: Tim Murray <timmurray@google.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
(cherry picked from commit e4544b63a7
  git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs.git dev)
Change-Id: Ia0eb86447488c5ba9845a6b2eb98652200e08281
2022-02-02 16:21:26 -08:00
Yifan Hong
db0c2ceba7 ANDROID: build/build-tools -> build/kernel/build-tools.
This is part of the build -> build/kernel transition.

Test: TH
Bug: 204425264
Change-Id: I5bcf6ac00b6388af198e486f191e13f0b60050c9
Signed-off-by: Yifan Hong <elsk@google.com>
2022-02-02 22:32:37 +00:00
Tadeusz Struk
10412e10c6 ANDROID: incremental-fs: populate userns before calling vfs_rename
The old and new mount user name spaces need to be populated
before calling vfs_rename().

Bug: 211066171

Signed-off-by: Tadeusz Struk <tadeusz.struk@linaro.org>
Change-Id: Ieac6975abb4131c8f5bdefe25b5f241c80023e38
2022-02-02 14:50:39 +00:00
Tadeusz Struk
7ad88c9349 ANDROID: incremental-fs: remove index and incomplete dir on umount
Cleanup incremental-fs left overs on umount, otherwise incr-fs will
complain as below:

BUG: Dentry {i=47a,n=.incomplete} still in use [unmount of incremental-fs]

This requires vfs_rmdir() of the special index and incomplete dirs.
Also free options.sysfs_name in incfs_mount_fs() instead of in
incfs_free_mount_info() to make it consistent with incfs_remount_fs().

Since set_anon_super() was used in incfs_mount_fs() the incfs_kill_sb()
should use kill_anon_super() instead of generic_shutdown_super()
otherwise it will leak the pseudo dev_t that set_anon_super() allocates.

Bug: 211066171

Signed-off-by: Tadeusz Struk <tadeusz.struk@linaro.org>
Change-Id: I7ea54db63513fc130e1997cbf79121015ee12405
2022-02-02 14:50:22 +00:00
Greg Kroah-Hartman
8222792e8e Merge 5.15.19 into android13-5.15
Changes in 5.15.19
	can: m_can: m_can_fifo_{read,write}: don't read or write from/to FIFO if length is 0
	net: sfp: ignore disabled SFP node
	net: stmmac: configure PTP clock source prior to PTP initialization
	net: stmmac: skip only stmmac_ptp_register when resume from suspend
	ARM: 9179/1: uaccess: avoid alignment faults in copy_[from|to]_kernel_nofault
	ARM: 9180/1: Thumb2: align ALT_UP() sections in modules sufficiently
	KVM: arm64: Use shadow SPSR_EL1 when injecting exceptions on !VHE
	s390/module: fix loading modules with a lot of relocations
	s390/hypfs: include z/VM guests with access control group set
	s390/nmi: handle guarded storage validity failures for KVM guests
	s390/nmi: handle vector validity failures for KVM guests
	bpf: Guard against accessing NULL pt_regs in bpf_get_task_stack()
	powerpc32/bpf: Fix codegen for bpf-to-bpf calls
	powerpc/bpf: Update ldimm64 instructions during extra pass
	ucount: Make get_ucount a safe get_user replacement
	scsi: zfcp: Fix failed recovery on gone remote port with non-NPIV FCP devices
	udf: Restore i_lenAlloc when inode expansion fails
	udf: Fix NULL ptr deref when converting from inline format
	efi: runtime: avoid EFIv2 runtime services on Apple x86 machines
	PM: wakeup: simplify the output logic of pm_show_wakelocks()
	tracing/histogram: Fix a potential memory leak for kstrdup()
	tracing: Don't inc err_log entry count if entry allocation fails
	ceph: properly put ceph_string reference after async create attempt
	ceph: set pool_ns in new inode layout for async creates
	fsnotify: fix fsnotify hooks in pseudo filesystems
	Revert "KVM: SVM: avoid infinite loop on NPF from bad address"
	psi: Fix uaf issue when psi trigger is destroyed while being polled
	powerpc/audit: Fix syscall_get_arch()
	perf/x86/intel/uncore: Fix CAS_COUNT_WRITE issue for ICX
	perf/x86/intel: Add a quirk for the calculation of the number of counters on Alder Lake
	drm/etnaviv: relax submit size limits
	drm/atomic: Add the crtc to affected crtc only if uapi.enable = true
	drm/amd/display: Fix FP start/end for dcn30_internal_validate_bw.
	KVM: LAPIC: Also cancel preemption timer during SET_LAPIC
	KVM: SVM: Never reject emulation due to SMAP errata for !SEV guests
	KVM: SVM: Don't intercept #GP for SEV guests
	KVM: x86: nSVM: skip eax alignment check for non-SVM instructions
	KVM: x86: Forcibly leave nested virt when SMM state is toggled
	KVM: x86: Keep MSR_IA32_XSS unchanged for INIT
	KVM: x86: Update vCPU's runtime CPUID on write to MSR_IA32_XSS
	KVM: x86: Sync the states size with the XCR0/IA32_XSS at, any time
	KVM: PPC: Book3S HV Nested: Fix nested HFSCR being clobbered with multiple vCPUs
	dm: revert partial fix for redundant bio-based IO accounting
	block: add bio_start_io_acct_time() to control start_time
	dm: properly fix redundant bio-based IO accounting
	serial: pl011: Fix incorrect rs485 RTS polarity on set_mctrl
	serial: 8250: of: Fix mapped region size when using reg-offset property
	serial: stm32: fix software flow control transfer
	tty: n_gsm: fix SW flow control encoding/handling
	tty: Partially revert the removal of the Cyclades public API
	tty: Add support for Brainboxes UC cards.
	kbuild: remove include/linux/cyclades.h from header file check
	usb-storage: Add unusual-devs entry for VL817 USB-SATA bridge
	usb: xhci-plat: fix crash when suspend if remote wake enable
	usb: common: ulpi: Fix crash in ulpi_match()
	usb: gadget: f_sourcesink: Fix isoc transfer for USB_SPEED_SUPER_PLUS
	usb: cdnsp: Fix segmentation fault in cdns_lost_power function
	usb: dwc3: xilinx: Skip resets and USB3 register settings for USB2.0 mode
	usb: dwc3: xilinx: Fix error handling when getting USB3 PHY
	USB: core: Fix hang in usb_kill_urb by adding memory barriers
	usb: typec: tcpci: don't touch CC line if it's Vconn source
	usb: typec: tcpm: Do not disconnect while receiving VBUS off
	usb: typec: tcpm: Do not disconnect when receiving VSAFE0V
	ucsi_ccg: Check DEV_INT bit only when starting CCG4
	mm, kasan: use compare-exchange operation to set KASAN page tag
	jbd2: export jbd2_journal_[grab|put]_journal_head
	ocfs2: fix a deadlock when commit trans
	sched/membarrier: Fix membarrier-rseq fence command missing from query bitmask
	PCI/sysfs: Find shadow ROM before static attribute initialization
	x86/MCE/AMD: Allow thresholding interface updates after init
	x86/cpu: Add Xeon Icelake-D to list of CPUs that support PPIN
	powerpc/32s: Allocate one 256k IBAT instead of two consecutives 128k IBATs
	powerpc/32s: Fix kasan_init_region() for KASAN
	powerpc/32: Fix boot failure with GCC latent entropy plugin
	i40e: Increase delay to 1 s after global EMP reset
	i40e: Fix issue when maximum queues is exceeded
	i40e: Fix queues reservation for XDP
	i40e: Fix for failed to init adminq while VF reset
	i40e: fix unsigned stat widths
	usb: roles: fix include/linux/usb/role.h compile issue
	rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev
	rpmsg: char: Fix race between the release of rpmsg_eptdev and cdev
	scsi: elx: efct: Don't use GFP_KERNEL under spin lock
	scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put()
	ipv6_tunnel: Rate limit warning messages
	ARM: 9170/1: fix panic when kasan and kprobe are enabled
	net: fix information leakage in /proc/net/ptype
	hwmon: (lm90) Mark alert as broken for MAX6646/6647/6649
	hwmon: (lm90) Mark alert as broken for MAX6680
	ping: fix the sk_bound_dev_if match in ping_lookup
	ipv4: avoid using shared IP generator for connected sockets
	hwmon: (lm90) Reduce maximum conversion rate for G781
	NFSv4: Handle case where the lookup of a directory fails
	NFSv4: nfs_atomic_open() can race when looking up a non-regular file
	net-procfs: show net devices bound packet types
	drm/msm: Fix wrong size calculation
	drm/msm/dsi: Fix missing put_device() call in dsi_get_phy
	drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable
	ipv6: annotate accesses to fn->fn_sernum
	NFS: Ensure the server has an up to date ctime before hardlinking
	NFS: Ensure the server has an up to date ctime before renaming
	KVM: arm64: pkvm: Use the mm_ops indirection for cache maintenance
	SUNRPC: Use BIT() macro in rpc_show_xprt_state()
	SUNRPC: Don't dereference xprt->snd_task if it's a cookie
	powerpc64/bpf: Limit 'ldbrx' to processors compliant with ISA v2.06
	netfilter: conntrack: don't increment invalid counter on NF_REPEAT
	powerpc/64s: Mask SRR0 before checking against the masked NIP
	perf: Fix perf_event_read_local() time
	sched/pelt: Relax the sync of util_sum with util_avg
	net: phy: broadcom: hook up soft_reset for BCM54616S
	net: stmmac: dwmac-visconti: Fix bit definitions for ETHER_CLK_SEL
	net: stmmac: dwmac-visconti: Fix clock configuration for RMII mode
	phylib: fix potential use-after-free
	octeontx2-af: Do not fixup all VF action entries
	octeontx2-af: Fix LBK backpressure id count
	octeontx2-af: Retry until RVU block reset complete
	octeontx2-pf: cn10k: Ensure valid pointers are freed to aura
	octeontx2-af: verify CQ context updates
	octeontx2-af: Increase link credit restore polling timeout
	octeontx2-af: cn10k: Do not enable RPM loopback for LPC interfaces
	octeontx2-pf: Forward error codes to VF
	rxrpc: Adjust retransmission backoff
	efi/libstub: arm64: Fix image check alignment at entry
	io_uring: fix bug in slow unregistering of nodes
	Drivers: hv: balloon: account for vmbus packet header in max_pkt_size
	hwmon: (lm90) Re-enable interrupts after alert clears
	hwmon: (lm90) Mark alert as broken for MAX6654
	hwmon: (lm90) Fix sysfs and udev notifications
	hwmon: (adt7470) Prevent divide by zero in adt7470_fan_write()
	powerpc/perf: Fix power_pmu_disable to call clear_pmi_irq_pending only if PMI is pending
	ipv4: fix ip option filtering for locally generated fragments
	ibmvnic: Allow extra failures before disabling
	ibmvnic: init ->running_cap_crqs early
	ibmvnic: don't spin in tasklet
	net/smc: Transitional solution for clcsock race issue
	video: hyperv_fb: Fix validation of screen resolution
	can: tcan4x5x: regmap: fix max register value
	drm/msm/hdmi: Fix missing put_device() call in msm_hdmi_get_phy
	drm/msm/dpu: invalid parameter check in dpu_setup_dspp_pcc
	drm/msm/a6xx: Add missing suspend_count increment
	yam: fix a memory leak in yam_siocdevprivate()
	net: cpsw: Properly initialise struct page_pool_params
	net: hns3: handle empty unknown interrupt for VF
	sch_htb: Fail on unsupported parameters when offload is requested
	Revert "drm/ast: Support 1600x900 with 108MHz PCLK"
	KVM: selftests: Don't skip L2's VMCALL in SMM test for SVM guest
	ceph: put the requests/sessions when it fails to alloc memory
	gve: Fix GFP flags when allocing pages
	Revert "ipv6: Honor all IPv6 PIO Valid Lifetime values"
	net: bridge: vlan: fix single net device option dumping
	ipv4: raw: lock the socket in raw_bind()
	ipv4: tcp: send zero IPID in SYNACK messages
	ipv4: remove sparse error in ip_neigh_gw4()
	net: bridge: vlan: fix memory leak in __allowed_ingress
	Bluetooth: refactor malicious adv data check
	irqchip/realtek-rtl: Map control data to virq
	irqchip/realtek-rtl: Fix off-by-one in routing
	dt-bindings: can: tcan4x5x: fix mram-cfg RX FIFO config
	perf/core: Fix cgroup event list management
	psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n
	psi: fix "defined but not used" warnings when CONFIG_PROC_FS=n
	usb: dwc3: xilinx: fix uninitialized return value
	usr/include/Makefile: add linux/nfc.h to the compile-test coverage
	fsnotify: invalidate dcache before IN_DELETE event
	block: Fix wrong offset in bio_truncate()
	mtd: rawnand: mpc5121: Remove unused variable in ads5121_select_chip()
	Linux 5.15.19

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I66399d45af362fa8e1672ba38c0d672e21afc716
2022-02-02 09:32:24 +01:00
Paul Lawrence
68d2a58b28 ANDROID: Incremental fs: Mark merkle tree pages uptodate
The merkle tree pages at the end of the incremental files were being
zero'd and marked uptodate on 5.15. Mark uptodate on creation to prevent
this.

Bug: 197663427
Test: The test in that bug now passes on 5.15 kernel
Signed-off-by: Paul Lawrence <paullawrence@google.com>
Change-Id: I5c0781c51bfbc64929e7a465db1ae975ce5928f9
2022-02-01 23:52:52 +00:00
Patrick Daly
8920ba7401 ANDROID: iommu/io-pgtable-arm: Add IOMMU_CACHE_ICACHE_OCACHE_NWA
Allow io-coherent devices to use a inner writeback read/write allocate,
outer writeback read allocate, no-write allocate cache policy. The outer
cache policy affects the behavior of a system cache, at least on qcom
boards which have one.

The rational follows that of IOMMU_SYS_CACHE_ONLY_NWA. Certain gpu
usecases perform better when using a no-write allocate policy.

Rename the IOMMU_SYS_CACHE_* flags to better reflect that they are not
exclusive with IOMMU_CACHE.

Bug: 189339242
Change-Id: Ic91616a148f39fead008a5b87a54ffd781fee734
Signed-off-by: Patrick Daly <pdaly@codeaurora.org>
Signed-off-by: Georgi Djakov <quic_c_gdjako@quicinc.com>
2022-02-01 22:15:48 +00:00
Isaac J. Manjarres
ec1e52f1ca ANDROID: iommu/dma: Add support for DMA_ATTR_SYS_CACHE_ONLY_NWA
IOMMU_SYS_CACHE_ONLY_NWA allows buffers for non-coherent devices
to be mapped with the correct memory attributes so that the buffers
can be cached in the system cache, with a no write allocate cache policy.
However, this property is only usable by drivers that invoke the
IOMMU API directly; it is not usable by drivers that use the DMA API.

Thus, introduce DMA_ATTR_SYS_CACHE_ONLY_NWA, so that drivers for
non-coherent devices that use the DMA API can use it to specify if
they want a buffer to be cached in the system cache.

Bug: 189339242
Change-Id: Ic812a1fb144a58deb4279c2bf121fc6cc4c3b208
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
Signed-off-by: Georgi Djakov <quic_c_gdjako@quicinc.com>
2022-02-01 22:15:37 +00:00
Isaac J. Manjarres
69c6228a2c ANDROID: iommu/dma: Add support fo DMA_ATTR_SYS_CACHE_ONLY
IOMMU_SYS_CACHE_ONLY allows buffers for non-coherent devices
to be mapped with the correct memory attributes so that the buffers
can be cached in the system cache. However, this property
is only usable by drivers that invoke the IOMMU API directly;
it is not usable by drivers that use the DMA API.

Thus, introduce DMA_ATTR_SYS_CACHE_ONLY, so that drivers for
non-coherent devices that use the DMA API can use it to specify if
they want a buffer to be cached in the system cache.

Bug: 189339242
Change-Id: I849d7a3f36b689afd2f6ee400507223fd6395158
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
Signed-off-by: Georgi Djakov <quic_c_gdjako@quicinc.com>
2022-02-01 22:15:20 +00:00
Isaac J. Manjarres
2c39fe8223 ANDROID: arm64: Add support for system cache memory type
Non-coherent devices on systems that support a system or
last level cache may want to request that allocations be
cached in the system cache. For memory that is allocated
by the kernel, and used for DMA with devices, the memory
attributes used for CPU access should match the memory
attributes that will be used for device access.

The memory attributes that need to be programmed into
the MAIR for system cache usage are:

0xf4 - Normal memory, outer write back read/write allocate,
inner non-cacheable.

There is currently no support for this memory attribute for
CPU mappings, so add it.

Bug: 189339242
Change-Id: I3abc7becd408f20ac5499cbbe3c6c6f53f784107
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
Signed-off-by: Georgi Djakov <quic_c_gdjako@quicinc.com>
2022-02-01 22:15:11 +00:00
Neeraj Upadhyay
5cf67f02b3 ANDROID: Update QCOM symbol list
Update QCOM symbol list to include vhost symbols.

Bug: 217278607
Change-Id: I4ae6aa941f3a2adc0f7594fbffb3da464a5b4602
Signed-off-by: Neeraj Upadhyay <quic_neeraju@quicinc.com>
2022-02-01 21:05:08 +00:00
Steve Muckle
388a1734b3 Revert "ANDROID: GKI: enable test_stackinit kernel module"
Reason for revert: need alternative deployment path for test modules

Change-Id: I2b27bb5451a3338e5d5cdb1e67440290cd42df44
Bug: 181024194
Signed-off-by: Steve Muckle <smuckle@google.com>
2022-02-01 20:33:18 +00:00
John Hubbard
2b3eb6227c FROMLIST: Revert mm/gup: small refactoring: simplify try_grab_page()
This reverts commit 54d516b1d6

That commit did a refactoring that effectively combined fast and slow
gup paths (again). And that was again incorrect, for two reasons:

a) Fast gup and slow gup get reference counts on pages in different ways
and with different goals: see Linus' writeup in commit cd1adf1b63
("Revert "mm/gup: remove try_get_page(), call try_get_compound_head()
directly""), and

b) try_grab_compound_head() also has a specific check for "FOLL_LONGTERM
&& !is_pinned(page)", that assumes that the caller can fall back to slow
gup. This resulted in new failures, as recently report by Will McVicker
[1].

But (a) has problems too, even though they may not have been reported
yet. So just revert this.

[1] https://lore.kernel.org/r/20220131203504.3458775-1-willmcvicker@google.com

Bug: 215285107
Link: https://lore.kernel.org/lkml/20220201092927.242254-1-jhubbard@nvidia.com/
Fixes: 54d516b1d6 ("mm/gup: small refactoring: simplify try_grab_page()")
Cc: Christoph Hellwig <hch@lst.de>
Cc: Will McVicker <willmcvicker@google.com>
Cc: Minchan Kim <minchan@google.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Christian Borntraeger <borntraeger@de.ibm.com>
Cc: Heiko Carstens <hca@linux.ibm.com>
Cc: Vasily Gorbik <gor@linux.ibm.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: John Hubbard <jhubbard@nvidia.com>
Signed-off-by: Will McVicker <willmcvicker@google.com>
Change-Id: I1effe60ed2a737a8f25f9256eff3de01d8bd0add
2022-02-01 10:04:41 -08:00
Georgi Djakov
2ab4227174 ANDROID: qcom: iommu: Use restricted vendor hook for dma ops
Use rvh instead of vh for the iommu_setup_dma_ops to prevent
sleeping while atomic bugs as mutexes are used to serialize
access to iova regions.

Bug: 216657571
Change-Id: If90d0714576ed6ca4b014b1447a1518f05a7ed0b
Signed-off-by: Georgi Djakov <quic_c_gdjako@quicinc.com>
2022-02-01 17:44:12 +00:00
Greg Kroah-Hartman
47cccb1eb2 Linux 5.15.19
Link: https://lore.kernel.org/r/20220131105229.959216821@linuxfoundation.org
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Ron Economos <re@w6rz.net>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Florian Fainelli <f.fainelli@gmail.com>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Bagas Sanjaya <bagasdotme@gmail.com>
Tested-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-02-01 17:27:16 +01:00
Geert Uytterhoeven
a9739362c7 mtd: rawnand: mpc5121: Remove unused variable in ads5121_select_chip()
commit 33a0da68fb upstream.

drivers/mtd/nand/raw/mpc5121_nfc.c: In function ‘ads5121_select_chip’:
drivers/mtd/nand/raw/mpc5121_nfc.c:294:19: warning: unused variable ‘mtd’ [-Wunused-variable]
  294 |  struct mtd_info *mtd = nand_to_mtd(nand);
      |                   ^~~

Fixes: 758b56f58b ("mtd: rawnand: Pass a nand_chip object to chip->select_chip()")
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20211122132138.3899138-1-geert@linux-m68k.org
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-02-01 17:27:16 +01:00
OGAWA Hirofumi
4633a79ff8 block: Fix wrong offset in bio_truncate()
commit 3ee859e384 upstream.

bio_truncate() clears the buffer outside of last block of bdev, however
current bio_truncate() is using the wrong offset of page. So it can
return the uninitialized data.

This happened when both of truncated/corrupted FS and userspace (via
bdev) are trying to read the last of bdev.

Reported-by: syzbot+ac94ae5f68b84197f41c@syzkaller.appspotmail.com
Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Link: https://lore.kernel.org/r/875yqt1c9g.fsf@mail.parknet.co.jp
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-02-01 17:27:16 +01:00
Amir Goldstein
3d7b7272ce fsnotify: invalidate dcache before IN_DELETE event
commit a37d9a17f0 upstream.

Apparently, there are some applications that use IN_DELETE event as an
invalidation mechanism and expect that if they try to open a file with
the name reported with the delete event, that it should not contain the
content of the deleted file.

Commit 49246466a9 ("fsnotify: move fsnotify_nameremove() hook out of
d_delete()") moved the fsnotify delete hook before d_delete() so fsnotify
will have access to a positive dentry.

This allowed a race where opening the deleted file via cached dentry
is now possible after receiving the IN_DELETE event.

To fix the regression, create a new hook fsnotify_delete() that takes
the unlinked inode as an argument and use a helper d_delete_notify() to
pin the inode, so we can pass it to fsnotify_delete() after d_delete().

Backporting hint: this regression is from v5.3. Although patch will
apply with only trivial conflicts to v5.4 and v5.10, it won't build,
because fsnotify_delete() implementation is different in each of those
versions (see fsnotify_link()).

A follow up patch will fix the fsnotify_unlink/rmdir() calls in pseudo
filesystem that do not need to call d_delete().

Link: https://lore.kernel.org/r/20220120215305.282577-1-amir73il@gmail.com
Reported-by: Ivan Delalande <colona@arista.com>
Link: https://lore.kernel.org/linux-fsdevel/YeNyzoDM5hP5LtGW@visor/
Fixes: 49246466a9 ("fsnotify: move fsnotify_nameremove() hook out of d_delete()")
Cc: stable@vger.kernel.org # v5.3+
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-02-01 17:27:15 +01:00
Dmitry V. Levin
e8421a9d7b usr/include/Makefile: add linux/nfc.h to the compile-test coverage
commit 10756dc5b0 upstream.

As linux/nfc.h userspace compilation was finally fixed by commits
79b69a8370 ("nfc: uapi: use kernel size_t to fix user-space builds")
and 7175f02c4e ("uapi: fix linux/nfc.h userspace compilation errors"),
there is no need to keep the compile-test exception for it in
usr/include/Makefile.

Signed-off-by: Dmitry V. Levin <ldv@altlinux.org>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-02-01 17:27:15 +01:00
Robert Hancock
c571505aa0 usb: dwc3: xilinx: fix uninitialized return value
commit b470947c36 upstream.

A previous patch to skip part of the initialization when a USB3 PHY was
not present could result in the return value being uninitialized in that
case, causing spurious probe failures. Initialize ret to 0 to avoid this.

Fixes: 9678f3361a ("usb: dwc3: xilinx: Skip resets and USB3 register settings for USB2.0 mode")
Cc: <stable@vger.kernel.org>
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Robert Hancock <robert.hancock@calian.com>
Link: https://lore.kernel.org/r/20220127221500.177021-1-robert.hancock@calian.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-02-01 17:27:15 +01:00
Suren Baghdasaryan
442414e8c4 psi: fix "defined but not used" warnings when CONFIG_PROC_FS=n
commit 44585f7bc0 upstream.

When CONFIG_PROC_FS is disabled psi code generates the following
warnings:

  kernel/sched/psi.c:1364:30: warning: 'psi_cpu_proc_ops' defined but not used [-Wunused-const-variable=]
      1364 | static const struct proc_ops psi_cpu_proc_ops = {
           |                              ^~~~~~~~~~~~~~~~
  kernel/sched/psi.c:1355:30: warning: 'psi_memory_proc_ops' defined but not used [-Wunused-const-variable=]
      1355 | static const struct proc_ops psi_memory_proc_ops = {
           |                              ^~~~~~~~~~~~~~~~~~~
  kernel/sched/psi.c:1346:30: warning: 'psi_io_proc_ops' defined but not used [-Wunused-const-variable=]
      1346 | static const struct proc_ops psi_io_proc_ops = {
           |                              ^~~~~~~~~~~~~~~

Make definitions of these structures and related functions conditional
on CONFIG_PROC_FS config.

Link: https://lkml.kernel.org/r/20220119223940.787748-3-surenb@google.com
Fixes: 0e94682b73 ("psi: introduce psi monitor")
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Reported-by: kernel test robot <lkp@intel.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-02-01 17:27:15 +01:00
Suren Baghdasaryan
949c4c1889 psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n
commit 51e50fbd3e upstream.

When CONFIG_CGROUPS is disabled psi code generates the following
warnings:

  kernel/sched/psi.c:1112:21: warning: no previous prototype for 'psi_trigger_create' [-Wmissing-prototypes]
      1112 | struct psi_trigger *psi_trigger_create(struct psi_group *group,
           |                     ^~~~~~~~~~~~~~~~~~
  kernel/sched/psi.c:1182:6: warning: no previous prototype for 'psi_trigger_destroy' [-Wmissing-prototypes]
      1182 | void psi_trigger_destroy(struct psi_trigger *t)
           |      ^~~~~~~~~~~~~~~~~~~
  kernel/sched/psi.c:1249:10: warning: no previous prototype for 'psi_trigger_poll' [-Wmissing-prototypes]
      1249 | __poll_t psi_trigger_poll(void **trigger_ptr,
           |          ^~~~~~~~~~~~~~~~

Change the declarations of these functions in the header to provide the
prototypes even when they are unused.

Link: https://lkml.kernel.org/r/20220119223940.787748-2-surenb@google.com
Fixes: 0e94682b73 ("psi: introduce psi monitor")
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Reported-by: kernel test robot <lkp@intel.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-02-01 17:27:15 +01:00
Namhyung Kim
fd26531855 perf/core: Fix cgroup event list management
commit c5de60cd62 upstream.

The active cgroup events are managed in the per-cpu cgrp_cpuctx_list.
This list is only accessed from current cpu and not protected by any
locks.  But from the commit ef54c1a476 ("perf: Rework
perf_event_exit_event()"), it's possible to access (actually modify)
the list from another cpu.

In the perf_remove_from_context(), it can remove an event from the
context without an IPI when the context is not active.  This is not
safe with cgroup events which can have some active events in the
context even if ctx->is_active is 0 at the moment.  The target cpu
might be in the middle of list iteration at the same time.

If the event is enabled when it's about to be closed, it might call
perf_cgroup_event_disable() and list_del() with the cgrp_cpuctx_list
on a different cpu.

This resulted in a crash due to an invalid list pointer access during
the cgroup list traversal on the cpu which the event belongs to.

Let's fallback to IPI to access the cgrp_cpuctx_list from that cpu.
Similarly, perf_install_in_context() should use IPI for the cgroup
events too.

Fixes: ef54c1a476 ("perf: Rework perf_event_exit_event()")
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20220124195808.2252071-1-namhyung@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-02-01 17:27:15 +01:00
Marc Kleine-Budde
cba7bdc047 dt-bindings: can: tcan4x5x: fix mram-cfg RX FIFO config
commit 17a3042262 upstream.

This tcan4x5x only comes with 2K of MRAM, a RX FIFO with a dept of 32
doesn't fit into the MRAM. Use a depth of 16 instead.

Fixes: 4edd396a19 ("dt-bindings: can: tcan4x5x: Add DT bindings for TCAN4x5X driver")
Link: https://lore.kernel.org/all/20220119062951.2939851-1-mkl@pengutronix.de
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-02-01 17:27:15 +01:00
Sander Vanheule
e905e1b65c irqchip/realtek-rtl: Fix off-by-one in routing
commit 91351b5dd0 upstream.

There is an offset between routing values (1..6) and the connected MIPS
CPU interrupts (2..7), but no distinction was made between these two
values.

This issue was previously hidden during testing, because an interrupt
mapping was used where for each required interrupt another (unused)
routing was configured, with an offset of +1.

Offset the CPU IRQ numbers by -1 to retrieve the correct routing value.

Fixes: 9f3a0f34b8 ("irqchip: Add support for Realtek RTL838x/RTL839x interrupt controller")
Signed-off-by: Sander Vanheule <sander@svanheule.net>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/177b920aa8d8610615692d0e657e509f363c85ca.1641739718.git.sander@svanheule.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-02-01 17:27:15 +01:00
Sander Vanheule
f67594cbf3 irqchip/realtek-rtl: Map control data to virq
commit 291e79c7e2 upstream.

The driver assigned the irqchip and irq handler to the hardware irq,
instead of the virq. This is incorrect, and only worked because these
irq numbers happened to be the same on the devices used for testing the
original driver.

Fixes: 9f3a0f34b8 ("irqchip: Add support for Realtek RTL838x/RTL839x interrupt controller")
Signed-off-by: Sander Vanheule <sander@svanheule.net>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/4b4936606480265db47df152f00bc2ed46340599.1641739718.git.sander@svanheule.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-02-01 17:27:15 +01:00
Brian Gix
bcea886771 Bluetooth: refactor malicious adv data check
commit 899663be5e upstream.

Check for out-of-bound read was being performed at the end of while
num_reports loop, and would fill journal with false positives. Added
check to beginning of loop processing so that it doesn't get checked
after ptr has been advanced.

Signed-off-by: Brian Gix <brian.gix@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: syphyr <syphyr@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-02-01 17:27:14 +01:00
Tim Yi
c5e216e880 net: bridge: vlan: fix memory leak in __allowed_ingress
[ Upstream commit fd20d97383 ]

When using per-vlan state, if vlan snooping and stats are disabled,
untagged or priority-tagged ingress frame will go to check pvid state.
If the port state is forwarding and the pvid state is not
learning/forwarding, untagged or priority-tagged frame will be dropped
but skb memory is not freed.
Should free skb when __allowed_ingress returns false.

Fixes: a580c76d53 ("net: bridge: vlan: add per-vlan state")
Signed-off-by: Tim Yi <tim.yi@pica8.com>
Acked-by: Nikolay Aleksandrov <nikolay@nvidia.com>
Link: https://lore.kernel.org/r/20220127074953.12632-1-tim.yi@pica8.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-02-01 17:27:14 +01:00
Eric Dumazet
8861857ccc ipv4: remove sparse error in ip_neigh_gw4()
[ Upstream commit 3c42b20198 ]

./include/net/route.h:373:48: warning: incorrect type in argument 2 (different base types)
./include/net/route.h:373:48:    expected unsigned int [usertype] key
./include/net/route.h:373:48:    got restricted __be32 [usertype] daddr

Fixes: 5c9f7c1dfc ("ipv4: Add helpers for neigh lookup for nexthop")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://lore.kernel.org/r/20220127013404.1279313-1-eric.dumazet@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-02-01 17:27:14 +01:00
Eric Dumazet
d887a33724 ipv4: tcp: send zero IPID in SYNACK messages
[ Upstream commit 970a5a3ea8 ]

In commit 431280eebe ("ipv4: tcp: send zero IPID for RST and
ACK sent in SYN-RECV and TIME-WAIT state") we took care of some
ctl packets sent by TCP.

It turns out we need to use a similar strategy for SYNACK packets.

By default, they carry IP_DF and IPID==0, but there are ways
to ask them to use the hashed IP ident generator and thus
be used to build off-path attacks.
(Ref: Off-Path TCP Exploits of the Mixed IPID Assignment)

One of this way is to force (before listener is started)
echo 1 >/proc/sys/net/ipv4/ip_no_pmtu_disc

Another way is using forged ICMP ICMP_FRAG_NEEDED
with a very small MTU (like 68) to force a false return from
ip_dont_fragment()

In this patch, ip_build_and_send_pkt() uses the following
heuristics.

1) Most SYNACK packets are smaller than IPV4_MIN_MTU and therefore
can use IP_DF regardless of the listener or route pmtu setting.

2) In case the SYNACK packet is bigger than IPV4_MIN_MTU,
we use prandom_u32() generator instead of the IPv4 hashed ident one.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Ray Che <xijiache@gmail.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Cc: Geoff Alexander <alexandg@cs.unm.edu>
Cc: Willy Tarreau <w@1wt.eu>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-02-01 17:27:14 +01:00