Catch up with some commits applied to the android12-5.10 branch that adds
new symbols to ensure that the ABI remains stable with LTS merges.
This merge contains the following commits:
* 383607d234 Merge "Merge tag 'android12-5.10.185_r00' into android12-5.10" into android12-5.10
|\
| * e424229872 Merge tag 'android12-5.10.185_r00' into android12-5.10
* | b4b7d22830 ANDROID: wakeupbypass: Add vendor hook for batteryswap
* | 1dc5772322 ANDROID: GKI: Update symbols to symbol list
* | 28f1c8e015 ANDROID: vendor_hook: Add hook to abort reclaim and compaction
* | adad2dab31 UPSTREAM: Revert "Fix XFRM-I support for nested ESP tunnels"
* | f48a4c3b29 ANDROID: Incremental fs: Allocate data buffer based on input request size
* | 4def2dd180 ANDROID: ABI: update symbol list for Xclipse GPU
* | bff06d6020 ANDROID: vendor_hooks: Supplement the missing hook call point.
* | de4dc1c15c ANDROID: GKI: Add symbol list for Nothing
|/
* b52f2d4395 UPSTREAM: usb: dwc3: gadget: Propagate core init errors to UDC during pullup
* 505b4a1929 UPSTREAM: usb: gadget: udc: renesas_usb3: Fix use after free bug in renesas_usb3_remove due to race condition
* 158d8bfffc UPSTREAM: media: rkvdec: fix use after free bug in rkvdec_remove
* 739f5722f4 UPSTREAM: x86/mm: Avoid using set_pgd() outside of real PGD pages
* 5db82d830f UPSTREAM: relayfs: fix out-of-bounds access in relay_file_read
* be9bc79296 UPSTREAM: io_uring: hold uring mutex around poll removal
* 6a975c2771 UPSTREAM: net/sched: flower: fix possible OOB write in fl_set_geneve_opt()
* c811ac11f7 UPSTREAM: ipvlan:Fix out-of-bounds caused by unclear skb->cb
* 540586cf5b ANDROID: GKI: Update symbols to symbol list
* 4782c8cb16 ANDROID: vendor_hook: Add hook to tune readaround size
* 69a794a283 ANDROID: vendor_hooks: Add hooks to avoid key threads stalled in memory allocations
* 69dc2c1a79 UPSTREAM: f2fs: fix to avoid use-after-free for cached IPU bio
* 39c3d16903 UPSTREAM: net/sched: cls_u32: Fix reference counter leak leading to overflow
* 4991def0fa UPSTREAM: xfs: verify buffer contents when we skip log replay
* 1c98645c8e UPSTREAM: memstick: r592: Fix UAF bug in r592_remove due to race condition
* e6d71f847b BACKPORT: btrfs: unset reloc control if transaction commit fails in prepare_to_relocate()
* b3af11bf90 ANDROID: ABI: Update oplus symbol list
* 5f17bf82b4 ANDROID: Export memcg functions to allow module to add new files
* 40aea038ea ANDROID: HID: Only utilise UHID provided exports if UHID is enabled
* 5bffeca4fb UPSTREAM: bluetooth: Perform careful capability checks in hci_sock_ioctl()
* c93516a2d0 ANDROID: HID; Over-ride default maximum buffer size when using UHID
* ab25d94e88 UPSTREAM: usb: gadget: f_fs: Add unbind event before functionfs_unbind
* 552009b284 UPSTREAM: net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize
* c6ae8be4e6 ANDROID: GKI: update symbol list for exynos
* 0a52039fcb UPSTREAM: mailbox: mailbox-test: fix a locking issue in mbox_test_message_write()
* 17bbc533f8 UPSTREAM: mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write()
* 708d51e22a UPSTREAM: 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition
* b82903573e FROMGIT: pstore: Revert pmsg_lock back to a normal mutex
* 403d5d1318 ANDROID: vendor_hook: Avoid clearing protect-flag before waking waiters
* 2246168a72 ANDROID: fix a race between speculative page walk and unmap operations
* 7cc458acf4 BACKPORT: usb: gadget: udc: Handle gadget_connect failure during bind operation
* fffb0ae9aa BACKPORT: usb: dwc3: gadget: Bail out in pullup if soft reset timeout happens
* a4420dc21f BACKPORT: f2fs: skip GC if possible when checkpoint disabling
Change-Id: I74d4bd3e7f094e845598f8c29348bea10738d57a
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Changes in 5.10.187
x86/microcode/AMD: Load late on both threads too
x86/cpu/amd: Move the errata checking functionality up
x86/cpu/amd: Add a Zenbleed fix
Linux 5.10.187
Change-Id: Icaf3650dfd034290d1f80e7ec911581d32dd8568
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Upstream commit: 522b1d6921
Add a fix for the Zen2 VZEROUPPER data corruption bug where under
certain circumstances executing VZEROUPPER can cause register
corruption or leak data.
The optimal fix is through microcode but in the case the proper
microcode revision has not been applied, enable a fallback fix using
a chicken bit.
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Implemented a hook to check if battery swap is enabled in
alarm timer suspend routine. During a battery swap, it is
crucial to ensure that the device remains in a suspended
state, relying on a limited backup power source. It is
essential to prevent any unintended awakenings in this
state, as they could potentially lead to sudden surges
in the power consumption, ultimately resulting in a
device shutdown. Hence, we disable alarmtimer IRQs when
in batteryswap mode.
Bug: 290881352
Change-Id: I31dc30d9a3168bb1356cccba49f0a70fd6b73782
Signed-off-by: Vatsal Parasrampuria <vp9924@zebra.com>
We need to abort the reclaim/compaction by sending
signal(such as SIGUSR2) to the reclaim thread, or
just abort when cpu-usage is too-high or free-mem is enough.
Bug: 289987875
Change-Id: I4b637cbd2b37235eec27a985a9b5b95598247c59
Signed-off-by: shenjiangjiang <shenjiangjiang@oppo.com>
(cherry picked from commit 024628cc9203cbd4f8471d98435b3a3d6f85764d)
[ Upstream commit 5fc46f9421 ]
This reverts commit b0355dbbf1.
The reverted commit clears the secpath on packets received via xfrm interfaces
to support nested IPsec tunnels. This breaks Netfilter policy matching using
xt_policy in the FORWARD chain, as the secpath is missing during forwarding.
Additionally, Benedict Wong reports that it breaks Transport-in-Tunnel mode.
Fix this regression by reverting the commit until we have a better approach
for nested IPsec tunnels.
Fixes: b0355dbbf1 ("Fix XFRM-I support for nested ESP tunnels")
Link: https://lore.kernel.org/netdev/20230412085615.124791-1-martin@strongswan.org/
Signed-off-by: Martin Willi <martin@strongswan.org>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Bug: 288489934
(cherry picked from commit c5449195f8)
Change-Id: Iefaed6d21a641fefb02e0fd0067086a9ae3a802a
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Presently the data buffer used to return the per-UID timeout description
is created based on information provided by the user. It is expected
that the user populates a variable called 'timeouts_array_size' which is
heavily scrutinised to ensure the value provided is appropriate i.e.
smaller than the largest possible value but large enough to contain all
of the data we wish to pass back.
The issue is that the aforementioned scrutiny is imposed on a different
variable to the one expected. Contrary to expectation, the data buffer
is actually being allocated to the size specified in a variable named
'timeouts_array_size_out'. A variable originally designed to only
contain the output information i.e. the size of the data actually copied
to the user for consumption. This value is also user provided and is
not given the same level of scrutiny as the former.
The fix in this case is simple. Ignore 'timeouts_array_size_out' until
it is time to populate (over-write) it ourselves and use
'timeouts_array_size' to shape the buffer as intended.
Bug: 281547360
Change-Id: I95e12879a33a2355f9e4bc0ce2bfc3f229141aa8
Signed-off-by: Lee Jones <joneslee@google.com>
(cherry picked from commit 5a4d20a3eb4e651f88ed2f1f08cee066639ca801)
Leaf changes summary: 1 artifact changed
Changed leaf types summary: 0 leaf type changed
Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 1 Added function
Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variable
1 Added function:
[A] 'function void ttm_tt_unpopulate(ttm_bo_device*, ttm_tt*)'
Xclipse GPU driver depends on TTM for graphics buffer allocation and management. It is required by customers to add graphics memory swap to improve overall memory efficiency. However TTM's swap feature can't be used since it selects victim buffer by LRU and we can't choose a specific buffer to swap.
Xclipse GPU driver implements its own swap feature by means of APIs of TTM. But the problem is TTM's buffer allocations statistics in ttm_tt.c which are local to that file. Whenever a graphic buffer is swapped out, the size of total page allocation should be decreased but it is not possible from the outside of ttm_tt.c. If the statistics is not maintained well, TTM ends up swapping out TTM buffers globally which is unexpected.
Bug: 291100620
Change-Id: I0edc4b5e8ae6d9e41e99750eb5f0e62fa78ec1fb
Signed-off-by: Kyongho Cho <pullip.cho@samsung.com>
As a supplement to commit eed2741ae6
("ANDROID: vendor_hook: add hooks to protect locking-tsk in cpu scheduler").
In rwsem read, we missed a lock-holding scenario, add it now.
Bug: 290868674
Change-Id: I718dd942b24b330a79283fc241dcbf47cc34c0c5
Signed-off-by: Liujie Xie <xieliujie@oppo.com>
Add symbol list for Nothing at the first time
2 function symbol(s) added
'struct file_system_type* get_fs_type(const char*)'
'void iterate_supers_type(struct file_system_type*, void(*)(struct super_block*, void*), void*)'
Bug: 290756100
Change-Id: I3cdf16cf21bf04df2c0ab10358e7e7dd4e82c2d1
Signed-off-by: Dylan Chang <dylan.chang@nothing.tech>
Signed-off-by: Giuliano Procida <gprocida@google.com>
In commit 1ac6e9ee84 ("sysctl: move some boundary constants from
sysctl.c to sysctl_vals"), the sysctl_vals variable got changed, but
unfortunatly many Android vendors liked using that array. To preserve
the ABI, put the array back the way it was and rename the new change to
be `android_gki_sysctl_vals` instead, and move the #defines to use it.
This way if any external code is rebuilt, it will use the new symbols,
but if not, the old ones will still work just as before, not requiring a
rebuild at all.
Bug: 161946584
Fixes: 1ac6e9ee84 ("sysctl: move some boundary constants from sysctl.c to sysctl_vals")
Change-Id: Ib094ae03682e11fee4f0b06af362541bbcba24d5
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
In scenarios where pullup relies on resume (get sync) to initialize
the controller and set the run stop bit, then core_init is followed by
gadget_resume which will eventually set run stop bit.
But in cases where the core_init fails, the return value is not sent
back to udc appropriately. So according to UDC the controller has
started but in reality we never set the run stop bit.
On systems like Android, there are uevents sent to HAL depending on
whether the configfs_bind / configfs_disconnect were invoked. In the
above mentioned scnenario, if the core init fails, the run stop won't
be set and the cable plug-out won't result in generation of any
disconnect event and userspace would never get any uevent regarding
cable plug out and we never call pullup(0) again. Furthermore none of
the next Plug-In/Plug-Out's would be known to configfs.
Return back the appropriate result to UDC to let the userspace/
configfs know that the pullup failed so they can take appropriate
action.
Fixes: 77adb8bdf4 ("usb: dwc3: gadget: Allow runtime suspend if UDC unbinded")
Cc: stable <stable@kernel.org>
Change-Id: Ieb281722cdc4fa2ff15545d9edaabdc8c2d70223
Signed-off-by: Krishna Kurapati <quic_kriskura@quicinc.com>
Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Message-ID: <20230618120949.14868-1-quic_kriskura@quicinc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit c0aabed9cahttps://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master)
Bug: 289984280
Change-Id: I633b2c325dd954a3e4cdd636052158a90fd976a3
Signed-off-by: Krishna Kurapati <quic_kriskura@quicinc.com>
This reverts commit 304802e5b0 which is
commit cfe6807d82 upstream.
It breaks the Android api, so revert it for now. If it needs to come
back, it can do so in an abi-safe way.
Bug: 161946584
Change-Id: I0f1f7b4de721ff23d252eef9b55678c3b6053cb7
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This reverts commit 75aa3f255c which is
commit 8c00914e54 upstream.
It breaks the Android api, so revert it for now. If it needs to come
back, it can do so in an abi-safe way.
Bug: 161946584
Change-Id: Ic6c0f3eda15a05d292fa047430a900682505fa64
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[ Upstream commit 2b947f8769 ]
In renesas_usb3_probe, role_work is bound with renesas_usb3_role_work.
renesas_usb3_start will be called to start the work.
If we remove the driver which will call usbhs_remove, there may be
an unfinished work. The possible sequence is as follows:
CPU0 CPU1
renesas_usb3_role_work
renesas_usb3_remove
usb_role_switch_unregister
device_unregister
kfree(sw)
//free usb3->role_sw
usb_role_switch_set_role
//use usb3->role_sw
The usb3->role_sw could be freed under such circumstance and then
used in usb_role_switch_set_role.
This bug was found by static analysis. And note that removing a
driver is a root-only operation, and should never happen in normal
case. But the root user may directly remove the device which
will also trigger the remove function.
Fix it by canceling the work before cleanup in the renesas_usb3_remove.
Bug: 289003615
Fixes: 39facfa01c ("usb: gadget: udc: renesas_usb3: Add register of usb role switch")
Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Link: https://lore.kernel.org/r/20230320062931.505170-1-zyytlz.wz@163.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit df23805209)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I79a1dbeba9a90ee5daf94648ef6a32207b283561
[ Upstream commit 3228cec23b ]
In rkvdec_probe, rkvdec->watchdog_work is bound with
rkvdec_watchdog_func. Then rkvdec_vp9_run may
be called to start the work.
If we remove the module which will call rkvdec_remove
to make cleanup, there may be a unfinished work.
The possible sequence is as follows, which will
cause a typical UAF bug.
Fix it by canceling the work before cleanup in rkvdec_remove.
CPU0 CPU1
|rkvdec_watchdog_func
rkvdec_remove |
rkvdec_v4l2_cleanup|
v4l2_m2m_release |
kfree(m2m_dev); |
|
| v4l2_m2m_get_curr_priv
| m2m_dev->curr_ctx //use
Bug: 289003637
Fixes: cd33c83044 ("media: rkvdec: Add the rkvdec driver")
Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 6a17add9c6)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ibdf4667315d98ac1cd42545f61e271c291893edd
commit d082d48737 upstream.
KPTI keeps around two PGDs: one for userspace and another for the
kernel. Among other things, set_pgd() contains infrastructure to
ensure that updates to the kernel PGD are reflected in the user PGD
as well.
One side-effect of this is that set_pgd() expects to be passed whole
pages. Unfortunately, init_trampoline_kaslr() passes in a single entry:
'trampoline_pgd_entry'.
When KPTI is on, set_pgd() will update 'trampoline_pgd_entry' (an
8-Byte globally stored [.bss] variable) and will then proceed to
replicate that value into the non-existent neighboring user page
(located +4k away), leading to the corruption of other global [.bss]
stored variables.
Fix it by directly assigning 'trampoline_pgd_entry' and avoiding
set_pgd().
[ dhansen: tweak subject and changelog ]
Bug: 274115504
Fixes: 0925dda596 ("x86/mm/KASLR: Use only one PUD entry for real mode trampoline")
Suggested-by: Dave Hansen <dave.hansen@linux.intel.com>
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/all/20230614163859.924309-1-lee@kernel.org/g
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 364fdcbb03)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Idc1fc494d7ccb4a8a3765e1f46482583b528a584
commit 43ec16f145 upstream.
There is a crash in relay_file_read, as the var from
point to the end of last subbuf.
The oops looks something like:
pc : __arch_copy_to_user+0x180/0x310
lr : relay_file_read+0x20c/0x2c8
Call trace:
__arch_copy_to_user+0x180/0x310
full_proxy_read+0x68/0x98
vfs_read+0xb0/0x1d0
ksys_read+0x6c/0xf0
__arm64_sys_read+0x20/0x28
el0_svc_common.constprop.3+0x84/0x108
do_el0_svc+0x74/0x90
el0_svc+0x1c/0x28
el0_sync_handler+0x88/0xb0
el0_sync+0x148/0x180
We get the condition by analyzing the vmcore:
1). The last produced byte and last consumed byte
both at the end of the last subbuf
2). A softirq calls function(e.g __blk_add_trace)
to write relay buffer occurs when an program is calling
relay_file_read_avail().
relay_file_read
relay_file_read_avail
relay_file_read_consume(buf, 0, 0);
//interrupted by softirq who will write subbuf
....
return 1;
//read_start point to the end of the last subbuf
read_start = relay_file_read_start_pos
//avail is equal to subsize
avail = relay_file_read_subbuf_avail
//from points to an invalid memory address
from = buf->start + read_start
//system is crashed
copy_to_user(buffer, from, avail)
Bug: 288957094
Link: https://lkml.kernel.org/r/20230419040203.37676-1-zhang.zhengming@h3c.com
Fixes: 8d62fdebda ("relay file read: start-pos fix")
Signed-off-by: Zhang Zhengming <zhang.zhengming@h3c.com>
Reviewed-by: Zhao Lei <zhao_lei1@hoperun.com>
Reviewed-by: Zhou Kete <zhou.kete@h3c.com>
Reviewed-by: Pengcheng Yang <yangpc@wangsu.com>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit f6ee841ff2)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ibbdf65d8bf2268c3e8c09520f595167a2ed41e8b
Snipped from commit 9ca9fb24d5 upstream.
While reworking the poll hashing in the v6.0 kernel, we ended up
grabbing the ctx->uring_lock in poll update/removal. This also fixed
a bug with linked timeouts racing with timeout expiry and poll
removal.
Bring back just the locking fix for that.
Bug: 289229683
Reported-and-tested-by: Querijn Voet <querijnqyn@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 0e388fce7a)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ife3683f26b19af1887ae1c59d3bd8b4e1700c79a
[ Upstream commit 4d56304e58 ]
If we send two TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets and their total
size is 252 bytes(key->enc_opts.len = 252) then
key->enc_opts.len = opt->length = data_len / 4 = 0 when the third
TCA_FLOWER_KEY_ENC_OPTS_GENEVE packet enters fl_set_geneve_opt. This
bypasses the next bounds check and results in an out-of-bounds.
Bug: 288660424
Fixes: 0a6e77784f ("net/sched: allow flower to match tunnel options")
Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Reviewed-by: Pieter Jansen van Vuuren <pieter.jansen-van-vuuren@amd.com>
Link: https://lore.kernel.org/r/20230531102805.27090-1-hbh25y@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 45f47d2cf1)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I53c534b7d43f4c7da5a9f63556c79d35797aa598
Changes in 5.10.186
drm/amd/display: fix the system hang while disable PSR
net/sched: Refactor qdisc_graft() for ingress and clsact Qdiscs
tracing: Add tracing_reset_all_online_cpus_unlocked() function
tick/common: Align tick period during sched_timer setup
selftests: mptcp: lib: skip if missing symbol
selftests: mptcp: lib: skip if not below kernel version
selftests: mptcp: pm nl: remove hardcoded default limits
selftests: mptcp: join: skip check if MIB counter not supported
nilfs2: fix buffer corruption due to concurrent device reads
Drivers: hv: vmbus: Fix vmbus_wait_for_unload() to scan present CPUs
PCI: hv: Fix a race condition bug in hv_pci_query_relations()
Revert "PCI: hv: Fix a timing issue which causes kdump to fail occasionally"
PCI: hv: Remove the useless hv_pcichild_state from struct hv_pci_dev
PCI: hv: Fix a race condition in hv_irq_unmask() that can cause panic
cgroup: Do not corrupt task iteration when rebinding subsystem
mmc: sdhci-msm: Disable broken 64-bit DMA on MSM8916
mmc: meson-gx: remove redundant mmc_request_done() call from irq context
mmc: mmci: stm32: fix max busy timeout calculation
ip_tunnels: allow VXLAN/GENEVE to inherit TOS/TTL from VLAN
regulator: pca9450: Fix LDO3OUT and LDO4OUT MASK
regmap: spi-avmm: Fix regmap_bus max_raw_write
writeback: fix dereferencing NULL mapping->host on writeback_page_template
io_uring/net: save msghdr->msg_control for retries
io_uring/net: clear msg_controllen on partial sendmsg retry
io_uring/net: disable partial retries for recvmsg with cmsg
nilfs2: prevent general protection fault in nilfs_clear_dirty_page()
x86/mm: Avoid using set_pgd() outside of real PGD pages
mm/pagealloc: sysctl: change watermark_scale_factor max limit to 30%
sysctl: move some boundary constants from sysctl.c to sysctl_vals
memfd: check for non-NULL file_seals in memfd_create() syscall
ieee802154: hwsim: Fix possible memory leaks
xfrm: Treat already-verified secpath entries as optional
xfrm: interface: rename xfrm_interface.c to xfrm_interface_core.c
xfrm: Ensure policies always checked on XFRM-I input path
bpf: track immediate values written to stack by BPF_ST instruction
bpf: Fix verifier id tracking of scalars on spill
xfrm: fix inbound ipv4/udp/esp packets to UDPv6 dualstack sockets
selftests: net: vrf-xfrm-tests: change authentication and encryption algos
selftests: net: fcnal-test: check if FIPS mode is enabled
xfrm: Linearize the skb after offloading if needed.
net: qca_spi: Avoid high load if QCA7000 is not available
mmc: mtk-sd: fix deferred probing
mmc: mvsdio: fix deferred probing
mmc: omap: fix deferred probing
mmc: omap_hsmmc: fix deferred probing
mmc: owl: fix deferred probing
mmc: sdhci-acpi: fix deferred probing
mmc: sh_mmcif: fix deferred probing
mmc: usdhi60rol0: fix deferred probing
ipvs: align inner_mac_header for encapsulation
net: dsa: mt7530: fix trapping frames on non-MT7621 SoC MT7530 switch
be2net: Extend xmit workaround to BE3 chip
netfilter: nft_set_pipapo: .walk does not deal with generations
netfilter: nf_tables: disallow element updates of bound anonymous sets
netfilter: nfnetlink_osf: fix module autoload
Revert "net: phy: dp83867: perform soft reset and retain established link"
sch_netem: acquire qdisc lock in netem_change()
gpio: Allow per-parent interrupt data
gpiolib: Fix GPIO chip IRQ initialization restriction
scsi: target: iscsi: Prevent login threads from racing between each other
HID: wacom: Add error check to wacom_parse_and_register()
arm64: Add missing Set/Way CMO encodings
media: cec: core: don't set last_initiator if tx in progress
nfcsim.c: Fix error checking for debugfs_create_dir
usb: gadget: udc: fix NULL dereference in remove()
Input: soc_button_array - add invalid acpi_index DMI quirk handling
s390/cio: unregister device when the only path is gone
spi: lpspi: disable lpspi module irq in DMA mode
ASoC: simple-card: Add missing of_node_put() in case of error
ASoC: nau8824: Add quirk to active-high jack-detect
s390/purgatory: disable branch profiling
ARM: dts: Fix erroneous ADS touchscreen polarities
drm/exynos: vidi: fix a wrong error return
drm/exynos: fix race condition UAF in exynos_g2d_exec_ioctl
drm/radeon: fix race condition UAF in radeon_gem_set_domain_ioctl
x86/apic: Fix kernel panic when booting with intremap=off and x2apic_phys
i2c: imx-lpi2c: fix type char overflow issue when calculating the clock cycle
netfilter: nftables: statify nft_parse_register()
netfilter: nf_tables: validate registers coming from userspace.
netfilter: nf_tables: hold mutex on netns pre_exit path
bpf/btf: Accept function names that contain dots
Linux 5.10.186
Change-Id: I2c45f6bd0cb20e43ac316ed751d2708315db80f0
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This reverts commit bf82668eb9 which is
commit 9bc61c04ff upstream.
It is removing unused code, but that changes a structure size so revert
it for now to preserve the ABI.
Bug: 161946584
Change-Id: I237cda2e5c07440d25613a1a1e30fa499751c7ac
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
In some situations, we want to decrease readaround size for better
performance. So we add this hook.
Bug: 288216516
Change-Id: If2f5f75976c99ff1f82ce29d370f9216926055ab
Signed-off-by: Oven <liyangouwen1@oppo.com>
memory allocations
We add these hooks to avoid key threads blocked in memory allocation
path.
-android_vh_free_unref_page_bypass ----We create a memory pool for the key threads. This hook determines whether a page should be free to the pool or to buddy freelist. It works with a existing hook `android_vh_alloc_pages_reclaim_bypass`, which takes pages out of the pool.
-android_vh_kvmalloc_node_use_vmalloc ----For key threads, we perfer not to run into direct reclaim. So we clear __GFP_DIRECT_RECLAIM flag. For threads which are not that important, we perfer use vmalloc.
-android_vh_should_alloc_pages_retry ----Before key threads run into direct reclaim, we want to retry with a lower watermark.
-android_vh_unreserve_highatomic_bypass ----We want to keep more highatomic pages when unreserve them to avoid highatomic allocation failures.
-android_vh_pageset_update ----We found the default per-cpu pageset is quite few in smartphones with large ram size. This hook is used to increase it to reduce zone->lock contentions.
-android_vh_rmqueue_bulk_bypass ----We found sometimes when key threads run into rmqueue_bulk, it took several milliseconds spinning at zone->lock or filling per-cpu pages. We use this hook to take pages from the mempool mentioned above, rather than grab zone->lock and fill a batch of pages to per-cpu.
Bug: 288216516
Change-Id: I1656032d6819ca627723341987b6094775bc345f
Signed-off-by: Oven <liyangouwen1@oppo.com>
[ Upstream commit 5cdb422c83 ]
xfstest generic/019 reports a bug:
kernel BUG at mm/filemap.c:1619!
RIP: 0010:folio_end_writeback+0x8a/0x90
Call Trace:
end_page_writeback+0x1c/0x60
f2fs_write_end_io+0x199/0x420
bio_endio+0x104/0x180
submit_bio_noacct+0xa5/0x510
submit_bio+0x48/0x80
f2fs_submit_write_bio+0x35/0x300
f2fs_submit_merged_ipu_write+0x2a0/0x2b0
f2fs_write_single_data_page+0x838/0x8b0
f2fs_write_cache_pages+0x379/0xa30
f2fs_write_data_pages+0x30c/0x340
do_writepages+0xd8/0x1b0
__writeback_single_inode+0x44/0x370
writeback_sb_inodes+0x233/0x4d0
__writeback_inodes_wb+0x56/0xf0
wb_writeback+0x1dd/0x2d0
wb_workfn+0x367/0x4a0
process_one_work+0x21d/0x430
worker_thread+0x4e/0x3c0
kthread+0x103/0x130
ret_from_fork+0x2c/0x50
The root cause is: after cp_error is set, f2fs_submit_merged_ipu_write()
in f2fs_write_single_data_page() tries to flush IPU bio in cache, however
f2fs_submit_merged_ipu_write() missed to check validity of @bio parameter,
result in submitting random cached bio which belong to other IO context,
then it will cause use-after-free issue, fix it by adding additional
validity check.
Fixes: 0b20fcec86 ("f2fs: cache global IPU bio")
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Bug: 268109575
Change-Id: Ifbdad0f8e8b51592ed63d025cf13965e623a7956
Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>
Changes in 5.10.185
lib: cleanup kstrto*() usage
kernel.h: split out kstrtox() and simple_strtox() to a separate header
test_firmware: Use kstrtobool() instead of strtobool()
test_firmware: prevent race conditions by a correct implementation of locking
test_firmware: fix a memory leak with reqs buffer
power: supply: ab8500: Fix external_power_changed race
power: supply: sc27xx: Fix external_power_changed race
power: supply: bq27xxx: Use mod_delayed_work() instead of cancel() + schedule()
ARM: dts: vexpress: add missing cache properties
tools: gpio: fix debounce_period_us output of lsgpio
power: supply: Ratelimit no data debug output
platform/x86: asus-wmi: Ignore WMI events with codes 0x7B, 0xC0
regulator: Fix error checking for debugfs_create_dir
irqchip/gic-v3: Disable pseudo NMIs on Mediatek devices w/ firmware issues
power: supply: Fix logic checking if system is running from battery
btrfs: scrub: try harder to mark RAID56 block groups read-only
btrfs: handle memory allocation failure in btrfs_csum_one_bio
ASoC: soc-pcm: test if a BE can be prepared
parisc: Improve cache flushing for PCXL in arch_sync_dma_for_cpu()
parisc: Flush gatt writes and adjust gatt mask in parisc_agp_mask_memory()
MIPS: Alchemy: fix dbdma2
mips: Move initrd_start check after initrd address sanitisation.
ASoC: dwc: move DMA init to snd_soc_dai_driver probe()
xen/blkfront: Only check REQ_FUA for writes
drm:amd:amdgpu: Fix missing buffer object unlock in failure path
irqchip/gic: Correctly validate OF quirk descriptors
io_uring: hold uring mutex around poll removal
epoll: ep_autoremove_wake_function should use list_del_init_careful
ocfs2: fix use-after-free when unmounting read-only filesystem
ocfs2: check new file size on fallocate call
nios2: dts: Fix tse_mac "max-frame-size" property
nilfs2: fix incomplete buffer cleanup in nilfs_btnode_abort_change_key()
nilfs2: fix possible out-of-bounds segment allocation in resize ioctl
kexec: support purgatories with .text.hot sections
x86/purgatory: remove PGO flags
powerpc/purgatory: remove PGO flags
nouveau: fix client work fence deletion race
RDMA/uverbs: Restrict usage of privileged QKEYs
net: usb: qmi_wwan: add support for Compal RXM-G1
ALSA: hda/realtek: Add a quirk for Compaq N14JP6
Remove DECnet support from kernel
USB: serial: option: add Quectel EM061KGL series
serial: lantiq: add missing interrupt ack
usb: dwc3: gadget: Reset num TRBs before giving back the request
RDMA/rtrs: Fix the last iu->buf leak in err path
spi: fsl-dspi: avoid SCK glitches with continuous transfers
netfilter: nfnetlink: skip error delivery on batch in case of ENOMEM
net: enetc: correct the indexes of highest and 2nd highest TCs
ping6: Fix send to link-local addresses with VRF.
net/sched: cls_u32: Fix reference counter leak leading to overflow
RDMA/rxe: Remove the unused variable obj
RDMA/rxe: Removed unused name from rxe_task struct
RDMA/rxe: Fix the use-before-initialization error of resp_pkts
iavf: remove mask from iavf_irq_enable_queues()
octeontx2-af: fixed resource availability check
RDMA/mlx5: Initiate dropless RQ for RAW Ethernet functions
RDMA/cma: Always set static rate to 0 for RoCE
IB/uverbs: Fix to consider event queue closing also upon non-blocking mode
IB/isert: Fix dead lock in ib_isert
IB/isert: Fix possible list corruption in CMA handler
IB/isert: Fix incorrect release of isert connection
ipvlan: fix bound dev checking for IPv6 l3s mode
sctp: fix an error code in sctp_sf_eat_auth()
igb: fix nvm.ops.read() error handling
drm/nouveau: don't detect DSM for non-NVIDIA device
drm/nouveau/dp: check for NULL nv_connector->native_mode
drm/nouveau: add nv_encoder pointer check for NULL
ext4: drop the call to ext4_error() from ext4_get_group_info()
net/sched: cls_api: Fix lockup on flushing explicitly created chain
net: lapbether: only support ethernet devices
net: tipc: resize nlattr array to correct size
selftests/ptp: Fix timestamp printf format for PTP_SYS_OFFSET
afs: Fix vlserver probe RTT handling
cgroup: always put cset in cgroup_css_set_put_fork
rcu/kvfree: Avoid freeing new kfree_rcu() memory after old grace period
neighbour: Remove unused inline function neigh_key_eq16()
net: Remove unused inline function dst_hold_and_use()
net: Remove DECnet leftovers from flow.h.
neighbour: delete neigh_lookup_nodev as not used
batman-adv: Switch to kstrtox.h for kstrtou64
mmc: block: ensure error propagation for non-blk
mm/memory_hotplug: extend offline_and_remove_memory() to handle more than one memory block
nilfs2: reject devices with insufficient block count
media: dvbdev: Fix memleak in dvb_register_device
media: dvbdev: fix error logic at dvb_register_device()
media: dvb-core: Fix use-after-free due to race at dvb_register_device()
drm/i915/dg1: Wait for pcode/uncore handshake at startup
drm/i915/gen11+: Only load DRAM information from pcode
um: Fix build w/o CONFIG_PM_SLEEP
Linux 5.10.185
Change-Id: I05ba9c2e38c013c553c9f89e2a6b71ec9bdb0bd3
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This reverts commit 9fcc3c3d26 which is
commit ed779fe4c9 upstream.
It breaks the Android kernel abi and is not needed for Android systems,
so it is safe to revert.
Bug: 161946584
Change-Id: I0aa37ddcb0939b55d0d1b74ab3e0432b02cc5285
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[ Upstream commit 9724160b39 ]
When building a kernel with LLVM=1, LLVM_IAS=0 and CONFIG_KASAN=y, LLVM
leaves DWARF tags for the "asan.module_ctor" & co symbols. In turn,
pahole creates BTF_KIND_FUNC entries for these and this makes the BTF
metadata validation fail because they contain a dot.
In a dramatic turn of event, this BTF verification failure can cause
the netfilter_bpf initialization to fail, causing netfilter_core to
free the netfilter_helper hashmap and netfilter_ftp to trigger a
use-after-free. The risk of u-a-f in netfilter will be addressed
separately but the existence of "asan.module_ctor" debug info under some
build conditions sounds like a good enough reason to accept functions
that contain dots in BTF.
Although using only LLVM=1 is the recommended way to compile clang-based
kernels, users can certainly do LLVM=1, LLVM_IAS=0 as well and we still
try to support that combination according to Nick. To clarify:
- > v5.10 kernel, LLVM=1 (LLVM_IAS=0 is not the default) is recommended,
but user can still have LLVM=1, LLVM_IAS=0 to trigger the issue
- <= 5.10 kernel, LLVM=1 (LLVM_IAS=0 is the default) is recommended in
which case GNU as will be used
Fixes: 1dc9285184 ("bpf: kernel side support for BTF Var and DataSec")
Signed-off-by: Florent Revest <revest@chromium.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Cc: Yonghong Song <yhs@meta.com>
Cc: Nick Desaulniers <ndesaulniers@google.com>
Link: https://lore.kernel.org/bpf/20230615145607.3469985-1-revest@chromium.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
commit 3923b1e440 upstream.
clean_net() runs in workqueue while walking over the lists, grab mutex.
Fixes: 767d1216bf ("netfilter: nftables: fix possible UAF over chains from packet path in netns")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 6e1acfa387 upstream.
Bail out in case userspace uses unsupported registers.
Fixes: 49499c3e6e ("netfilter: nf_tables: switch registers to 32 bit addressing")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit 85d38d5810 ]
When booting with "intremap=off" and "x2apic_phys" on the kernel command
line, the physical x2APIC driver ends up being used even when x2APIC
mode is disabled ("intremap=off" disables x2APIC mode). This happens
because the first compound condition check in x2apic_phys_probe() is
false due to x2apic_mode == 0 and so the following one returns true
after default_acpi_madt_oem_check() having already selected the physical
x2APIC driver.
This results in the following panic:
kernel BUG at arch/x86/kernel/apic/io_apic.c:2409!
invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.4.0-rc2-ver4.1rc2 #2
Hardware name: Dell Inc. PowerEdge R6515/07PXPY, BIOS 2.3.6 07/06/2021
RIP: 0010:setup_IO_APIC+0x9c/0xaf0
Call Trace:
<TASK>
? native_read_msr
apic_intr_mode_init
x86_late_time_init
start_kernel
x86_64_start_reservations
x86_64_start_kernel
secondary_startup_64_no_verify
</TASK>
which is:
setup_IO_APIC:
apic_printk(APIC_VERBOSE, "ENABLING IO-APIC IRQs\n");
for_each_ioapic(ioapic)
BUG_ON(mp_irqdomain_create(ioapic));
Return 0 to denote that x2APIC has not been enabled when probing the
physical x2APIC driver.
[ bp: Massage commit message heavily. ]
Fixes: 9ebd680bd0 ("x86, apic: Use probe routines to simplify apic selection")
Signed-off-by: Dheeraj Kumar Srivastava <dheerajkumar.srivastava@amd.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Kishon Vijay Abraham I <kvijayab@amd.com>
Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
Reviewed-by: Cyrill Gorcunov <gorcunov@gmail.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20230616212236.1389-1-dheerajkumar.srivastava@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 982b173a6c ]
Userspace can race to free the gobj(robj converted from), robj should not
be accessed again after drm_gem_object_put, otherwith it will result in
use-after-free.
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Min Li <lm0963hack@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 48bfd02569 ]
If it is async, runqueue_node is freed in g2d_runqueue_worker on another
worker thread. So in extreme cases, if g2d_runqueue_worker runs first, and
then executes the following if statement, there will be use-after-free.
Signed-off-by: Min Li <lm0963hack@gmail.com>
Reviewed-by: Andi Shyti <andi.shyti@kernel.org>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 4a05955980 ]
Fix a wrong error return by dropping an error return.
When vidi driver is remvoed, if ctx->raw_edid isn't same as fake_edid_info
then only what we have to is to free ctx->raw_edid so that driver removing
can work correctly - it's not an error case.
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Reviewed-by: Andi Shyti <andi.shyti@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit 03c5c83b70 ]
Avoid linker error for randomly generated config file that
has CONFIG_BRANCH_PROFILE_NONE enabled and make it similar
to riscv, x86 and also to commit 4bf3ec384e ("s390: disable
branch profiling for vdso").
Reviewed-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Greg Kroah-Hartman