Commit Graph

1070562 Commits

Author SHA1 Message Date
Greg Kroah-Hartman
e02ff715d5 Revert "locking/rtmutex: Fix task->pi_waiters integrity"
This reverts commit 4ed1549129 which is
commit f7853c3424 upstream.

It breaks the Android api due to a structure, struct rt_mutex_waiter,
escaping out of the core kernel code, into an Android hook, making it
something that can not be modified without potentially major problems.

If this needs to come back, it must do so in an ABI-safe way in the
future, for now, it can just be reverted.

Bug: 161946584
Change-Id: Idd251aa4e905cc284523b0b81b3e8993c6a58866
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-08-29 16:50:18 +00:00
Greg Kroah-Hartman
5f5a985931 Merge 5.15.124 into android14-5.15-lts
Changes in 5.15.124
	jbd2: Fix wrongly judgement for buffer head removing while doing checkpoint
	KVM: s390: pv: fix index value of replaced ASCE
	io_uring: don't audit the capability check in io_uring_create()
	gpio: tps68470: Make tps68470_gpio_output() always set the initial value
	pwm: Add a stub for devm_pwmchip_add()
	gpio: mvebu: Make use of devm_pwmchip_add
	gpio: mvebu: fix irq domain leak
	btrfs: fix race between quota disable and relocation
	i2c: Delete error messages for failed memory allocations
	i2c: Improve size determinations
	i2c: nomadik: Remove unnecessary goto label
	i2c: nomadik: Use devm_clk_get_enabled()
	i2c: nomadik: Remove a useless call in the remove function
	PCI/ASPM: Return 0 or -ETIMEDOUT from pcie_retrain_link()
	PCI/ASPM: Factor out pcie_wait_for_retrain()
	PCI/ASPM: Avoid link retraining race
	PCI: rockchip: Remove writes to unused registers
	PCI: rockchip: Fix window mapping and address translation for endpoint
	PCI: rockchip: Don't advertise MSI-X in PCIe capabilities
	dlm: cleanup plock_op vs plock_xop
	dlm: rearrange async condition return
	fs: dlm: interrupt posix locks only when process is killed
	drm/ttm: Don't print error message if eviction was interrupted
	drm/ttm: Don't leak a resource on eviction error
	n_tty: Rename tail to old_tail in n_tty_read()
	tty: fix hang on tty device with no_room set
	drm/ttm: never consider pinned BOs for eviction&swap
	cifs: missing directory in MAINTAINERS file
	cifs: use fs_context for automounts
	ksmbd: remove internal.h include
	cifs: if deferred close is disabled then close files immediately
	pwm: meson: Simplify duplicated per-channel tracking
	pwm: meson: fix handling of period/duty if greater than UINT_MAX
	tracing/probes: Add symstr type for dynamic events
	tracing/probes: Fix to avoid double count of the string length on the array
	tracing: Allow synthetic events to pass around stacktraces
	Revert "tracing: Add "(fault)" name injection to kernel probes"
	tracing/probes: Fix to record 0-length data_loc in fetch_store_string*() if fails
	scsi: qla2xxx: Remove unused declarations for qla2xxx
	scsi: qla2xxx: Multi-que support for TMF
	scsi: qla2xxx: Fix task management cmd failure
	scsi: qla2xxx: Fix task management cmd fail due to unavailable resource
	scsi: qla2xxx: Add debug prints in the device remove path
	scsi: qla2xxx: Fix hang in task management
	drm/amdgpu: fix vkms crtc settings
	drm/amdgpu/vkms: relax timer deactivation by hrtimer_try_to_cancel
	phy: qcom-snps: Use dev_err_probe() to simplify code
	phy: qcom-snps: correct struct qcom_snps_hsphy kerneldoc
	phy: qcom-snps-femto-v2: keep cfg_ahb_clk enabled during runtime suspend
	phy: qcom-snps-femto-v2: properly enable ref clock
	soundwire: qcom: update status correctly with mask
	media: staging: atomisp: select V4L2_FWNODE
	i40e: Fix an NULL vs IS_ERR() bug for debugfs_create_dir()
	iavf: fix potential deadlock on allocation failure
	iavf: check for removal state before IAVF_FLAG_PF_COMMS_FAILED
	net: phy: marvell10g: fix 88x3310 power up
	net: hns3: fix wrong tc bandwidth weight data issue
	net: hns3: fix wrong bw weight of disabled tc issue
	vxlan: move to its own directory
	vxlan: calculate correct header length for GPE
	phy: hisilicon: Fix an out of bounds check in hisi_inno_phy_probe()
	ethernet: atheros: fix return value check in atl1e_tso_csum()
	ipv6 addrconf: fix bug where deleting a mngtmpaddr can create a new temporary address
	tcp: Reduce chance of collisions in inet6_hashfn().
	ice: Fix memory management in ice_ethtool_fdir.c
	bonding: reset bond's flags when down link is P2P device
	team: reset team's flags when down link is P2P device
	net: stmmac: Apply redundant write work around on 4.xx too
	platform/x86: msi-laptop: Fix rfkill out-of-sync on MSI Wind U100
	igc: Fix Kernel Panic during ndo_tx_timeout callback
	netfilter: nft_set_rbtree: fix overlap expiration walk
	netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR
	netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID
	net/sched: mqprio: refactor nlattr parsing to a separate function
	net/sched: mqprio: add extack to mqprio_parse_nlattr()
	net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64
	benet: fix return value check in be_lancer_xmit_workarounds()
	tipc: check return value of pskb_trim()
	tipc: stop tipc crypto on failure in tipc_node_create
	RDMA/mlx4: Make check for invalid flags stricter
	drm/msm/dpu: drop enum dpu_core_perf_data_bus_id
	drm/msm/adreno: Fix snapshot BINDLESS_DATA size
	RDMA/irdma: Add missing read barriers
	RDMA/irdma: Fix data race on CQP completion stats
	RDMA/irdma: Fix data race on CQP request done
	RDMA/mthca: Fix crash when polling CQ for shared QPs
	RDMA/bnxt_re: Prevent handling any completions after qp destroy
	drm/msm: Fix IS_ERR_OR_NULL() vs NULL check in a5xx_submit_in_rb()
	ASoC: fsl_spdif: Silence output on stop
	block: Fix a source code comment in include/uapi/linux/blkzoned.h
	dm raid: fix missing reconfig_mutex unlock in raid_ctr() error paths
	dm raid: clean up four equivalent goto tags in raid_ctr()
	dm raid: protect md_stop() with 'reconfig_mutex'
	drm/amd: Fix an error handling mistake in psp_sw_init()
	RDMA/irdma: Report correct WC error
	ata: pata_ns87415: mark ns87560_tf_read static
	ring-buffer: Fix wrong stat of cpu_buffer->read
	tracing: Fix warning in trace_buffered_event_disable()
	Revert "usb: gadget: tegra-xudc: Fix error check in tegra_xudc_powerdomain_init()"
	usb: gadget: call usb_gadget_check_config() to verify UDC capability
	USB: gadget: Fix the memory leak in raw_gadget driver
	KVM: Grab a reference to KVM for VM and vCPU stats file descriptors
	KVM: VMX: Don't fudge CR0 and CR4 for restricted L2 guest
	serial: qcom-geni: drop bogus runtime pm state update
	serial: 8250_dw: Preserve original value of DLF register
	serial: sifive: Fix sifive_serial_console_setup() section
	USB: serial: option: support Quectel EM060K_128
	USB: serial: option: add Quectel EC200A module support
	USB: serial: simple: add Kaufmann RKS+CAN VCP
	USB: serial: simple: sort driver entries
	can: gs_usb: gs_can_close(): add missing set of CAN state to CAN_STATE_STOPPED
	Revert "usb: dwc3: core: Enable AutoRetry feature in the controller"
	usb: dwc3: pci: skip BYT GPIO lookup table for hardwired phy
	usb: dwc3: don't reset device side if dwc3 was configured as host-only
	usb: ohci-at91: Fix the unhandle interrupt when resume
	USB: quirks: add quirk for Focusrite Scarlett
	usb: cdns3: fix incorrect calculation of ep_buf_size when more than one config
	usb: xhci-mtk: set the dma max_seg_size
	Revert "usb: xhci: tegra: Fix error check"
	Documentation: security-bugs.rst: update preferences when dealing with the linux-distros group
	Documentation: security-bugs.rst: clarify CVE handling
	staging: r8712: Fix memory leak in _r8712_init_xmit_priv()
	staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext()
	tty: n_gsm: fix UAF in gsm_cleanup_mux
	Revert "xhci: add quirk for host controllers that don't update endpoint DCS"
	ALSA: hda/relatek: Enable Mute LED on HP 250 G8
	hwmon: (k10temp) Enable AMD3255 Proc to show negative temperature
	hwmon: (nct7802) Fix for temp6 (PECI1) processed even if PECI1 disabled
	btrfs: check if the transaction was aborted at btrfs_wait_for_commit()
	btrfs: check for commit error at btrfs_attach_transaction_barrier()
	file: always lock position for FMODE_ATOMIC_POS
	nfsd: Remove incorrect check in nfsd4_validate_stateid
	tpm_tis: Explicitly check for error code
	irq-bcm6345-l1: Do not assume a fixed block to cpu mapping
	irqchip/gic-v4.1: Properly lock VPEs when doing a directLPI invalidation
	locking/rtmutex: Fix task->pi_waiters integrity
	KVM: x86: Disallow KVM_SET_SREGS{2} if incoming CR0 is invalid
	virtio-net: fix race between set queues and probe
	s390/dasd: fix hanging device after quiesce/resume
	ASoC: wm8904: Fill the cache for WM8904_ADC_TEST_0 register
	ceph: never send metrics if disable_send_metrics is set
	dm cache policy smq: ensure IO doesn't prevent cleaner policy progress
	rbd: make get_lock_owner_info() return a single locker or NULL
	rbd: harden get_lock_owner_info() a bit
	rbd: retrieve and check lock owner twice before blocklisting
	tracing: Fix trace_event_raw_event_synth() if else statement
	ACPI: processor: perflib: Use the "no limit" frequency QoS
	ACPI: processor: perflib: Avoid updating frequency QoS unnecessarily
	cpufreq: intel_pstate: Drop ACPI _PSS states table patching
	selftests: mptcp: sockopt: use 'iptables-legacy' if available
	io_uring: treat -EAGAIN for REQ_F_NOWAIT as final for io-wq
	ASoC: cs42l51: fix driver to properly autoload with automatic module loading
	selftests: mptcp: join: only check for ip6tables if needed
	Linux 5.15.124

Change-Id: Ifeb2357cc7522671aff42c1408cc917a0f1aa905
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-08-25 16:54:16 +00:00
Greg Kroah-Hartman
d737715c00 Merge 5.15.123 into android14-5.15-lts
Changes in 5.15.123
	ALSA: hda/realtek - remove 3k pull low procedure
	ALSA: hda/realtek: Add quirk for Clevo NS70AU
	ALSA: hda/realtek: Enable Mute LED on HP Laptop 15s-eq2xxx
	keys: Fix linking a duplicate key to a keyring's assoc_array
	perf probe: Add test for regression introduced by switch to die_get_decl_file()
	btrfs: fix warning when putting transaction with qgroups enabled after abort
	fuse: revalidate: don't invalidate if interrupted
	btrfs: zoned: fix memory leak after finding block group with super blocks
	fuse: ioctl: translate ENOSYS in outarg
	selftests: tc: set timeout to 15 minutes
	selftests: tc: add 'ct' action kconfig dep
	regmap: Drop initial version of maximum transfer length fixes
	regmap: Account for register length in SMBus I/O limits
	can: bcm: Fix UAF in bcm_proc_show()
	selftests: tc: add ConnTrack procfs kconfig
	drm/client: Fix memory leak in drm_client_target_cloned
	drm/client: Fix memory leak in drm_client_modeset_probe
	drm/amd/display: Disable MPC split by default on special asic
	drm/amd/display: Keep PHY active for DP displays on DCN31
	ASoC: fsl_sai: Disable bit clock with transmitter
	ASoC: codecs: wcd938x: fix missing clsh ctrl error handling
	ASoC: codecs: wcd-mbhc-v2: fix resource leaks on component remove
	ASoC: codecs: wcd938x: fix resource leaks on component remove
	ASoC: codecs: wcd938x: fix missing mbhc init error handling
	ASoC: codecs: wcd934x: fix resource leaks on component remove
	ASoC: codecs: wcd938x: fix codec initialisation race
	ASoC: codecs: wcd938x: fix soundwire initialisation race
	ext4: correct inline offset when handling xattrs in inode body
	drm/radeon: Fix integer overflow in radeon_cs_parser_init
	ALSA: emu10k1: roll up loops in DSP setup code for Audigy
	quota: Properly disable quotas when add_dquot_ref() fails
	quota: fix warning in dqgrab()
	udf: Fix uninitialized array access for some pathnames
	fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev
	MIPS: dec: prom: Address -Warray-bounds warning
	FS: JFS: Fix null-ptr-deref Read in txBegin
	FS: JFS: Check for read-only mounted filesystem in txBegin
	spi: bcm63xx: fix max prepend length
	fbdev: imxfb: warn about invalid left/right margin
	perf build: Fix library not found error when using CSLIBS
	pinctrl: amd: Use amd_pinconf_set() for all config options
	net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()/cpsw_ale_set_field()
	bridge: Add extack warning when enabling STP in netns.
	ethernet: use eth_hw_addr_set() instead of ether_addr_copy()
	of: net: add a helper for loading netdev->dev_addr
	ethernet: use of_get_ethdev_address()
	net: ethernet: mtk_eth_soc: handle probe deferral
	net: sched: cls_bpf: Undo tcf_bind_filter in case of an error
	iavf: Fix use-after-free in free_netdev
	iavf: Fix out-of-bounds when setting channels on remove
	security: keys: Modify mismatched function name
	octeontx2-pf: Dont allocate BPIDs for LBK interfaces
	bpf: Fix subprog idx logic in check_max_stack_depth
	igc: Prevent garbled TX queue with XDP ZEROCOPY
	tcp: annotate data-races around tcp_rsk(req)->ts_recent
	net: ipv4: Use kfree_sensitive instead of kfree
	net:ipv6: check return value of pskb_trim()
	Revert "tcp: avoid the lookup process failing to get sk in ehash table"
	fbdev: au1200fb: Fix missing IRQ check in au1200fb_drv_probe
	llc: Don't drop packet from non-root netns.
	netfilter: nf_tables: fix spurious set element insertion failure
	netfilter: nft_set_pipapo: fix improper element removal
	netfilter: nf_tables: skip bound chain in netns release path
	netfilter: nf_tables: skip bound chain on rule flush
	tcp: annotate data-races around tp->tcp_tx_delay
	tcp: annotate data-races around tp->keepalive_time
	tcp: annotate data-races around tp->keepalive_intvl
	tcp: annotate data-races around tp->keepalive_probes
	tcp: annotate data-races around icsk->icsk_syn_retries
	tcp: annotate data-races around tp->linger2
	tcp: annotate data-races around rskq_defer_accept
	tcp: annotate data-races around tp->notsent_lowat
	tcp: annotate data-races around icsk->icsk_user_timeout
	tcp: annotate data-races around fastopenq.max_qlen
	net: phy: prevent stale pointer dereference in phy_init()
	jbd2: recheck chechpointing non-dirty buffer
	tracing/histograms: Return an error if we fail to add histogram to hist_vars list
	nixge: fix mac address error handling again
	Revert "drm/amd/display: edp do not add non-edid timings"
	Linux 5.15.123

Change-Id: I3162dc1d106295097e8075b29bab3646b7167e7b
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-08-25 11:10:37 +00:00
Greg Kroah-Hartman
19f4d8d2d0 Merge android14-5.15 into android14-5.15-lts
This catches up the android14-5.15-lts branch up with a lot of bugfixes
and ABI additions that were in the android14-5.15 branch.

This consists of the following commits:

* 95e0307577 BACKPORT: blk-crypto: dynamically allocate fallback profile
* c7860b4dbd UPSTREAM: media: usb: siano: Fix warning due to null work_func_t function pointer
* cb69585f72 UPSTREAM: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb
* 064fe2809f ANDROID: Delete build.config.gki.aarch64.16k.
* 5acbeb3895 FROMGIT: usb: typec: tcpm: Refactor the PPS APDO selection
* 90ad33eb0e ANDROID: GKI: Update symbol list for lenovo
* 844dfdef1c UPSTREAM: net: tap_open(): set sk_uid from current_fsuid()
* 7e0b682baf UPSTREAM: net: tun_chr_open(): set sk_uid from current_fsuid()
* 09eac0d3a8 UPSTREAM: usb: typec: tcpm: Fix response to vsafe0V event
* 8f1d7c6850 ANDROID: Update the ABI symbol list
* 54afed884d UPSTREAM: net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free
* d6c1899f33 UPSTREAM: net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free
* cb45423bcc UPSTREAM: net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free
* 880189fdd2 UPSTREAM: netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID
* 4c73cba07b ANDROID: usb: gadget: f_accessory: Mitgate handling of non-existent USB request
* eebccae505 ANDROID: Update the ABI symbol list
* a845525d3e FROMGIT: Multi-gen LRU: skip CMA pages when they are not eligible
* 4502265e16 BACKPORT: mm: skip CMA pages when they are not available
* 53c38ebc4e ANDROID: dm-bow: Protect Ranges fetched and erased from the RB tree
* b88b3d3664 UPSTREAM: netfilter: nf_tables: skip bound chain on rule flush
* 6bcc6ff841 UPSTREAM: tty: n_gsm: fix UAF in gsm_cleanup_mux
* b4a6c6f4a1 UPSTREAM: net/sched: sch_qfq: account for stab overhead in qfq_enqueue
* 1b2e6ebdc6 UPSTREAM: net/sched: sch_qfq: refactor parsing of netlink parameters
* 4128e28878 UPSTREAM: netfilter: nft_set_pipapo: fix improper element removal
* 1122dd3711 ANDROID: Add checkpatch target.
* 056a17677d BACKPORT: FROMGIT: usb: typec: altmodes/displayport: Signal hpd when configuring pin assignment
* ee1147625d BACKPORT: USB: Gadget: core: Help prevent panic during UVC unconfigure
* 7ba2131ad4 FROMLIST: scsi: ufs: Disable zone write locking
* 4224108a41 FROMLIST: scsi: ufs: Split an if-condition
* 1c33b80bf7 FROMLIST: scsi: scsi_debug: Support injecting unaligned write errors
* 6c0276ef82 FROMLIST: scsi: scsi_debug: Support disabling zone write locking
* 3347f7daae FROMLIST: scsi: core: Retry unaligned zoned writes
* 4e1d1b839d FROMLIST: block/mq-deadline: Only use zone locking if necessary
* 5414ea3f50 BACKPORT: FROMLIST: block: Introduce the flag QUEUE_FLAG_NO_ZONE_WRITE_LOCK
* d01888a968 Revert "ANDROID: block: Introduce a request queue flag for pipelining zoned writes"
* 6a1ceeede7 Revert "ANDROID: block/mq-deadline: Only use zone locking if necessary"
* dc77af3d38 Revert "ANDROID: scsi: Retry unaligned zoned writes"
* 2e83e40f6a Revert "ANDROID: scsi: ufs: Enable zoned write pipelining"
* e08f97fe80 Revert "ANDROID: scsi: ufs: Disable zoned write pipelining"
* a0565250b3 Revert "ANDROID: scsi: core: Delay unaligned write error retries"
* 053f022ed4 Revert "ANDROID: scsi: core: Limit zoned write retries"
* 8c7e6396da ANDROID: GKI: update mtktv symbol
* 7d47dd77f1 ANDROID: GKI: Add mtktv ABI symbol list, media, trace and remaining subsys
* 655a288103 ANDROID: GKI: Add mtktv ABI symbol list, cpufreq and misc
* 663ca511e8 ANDROID: GKI: Add mtktv ABI symbol list, net, eth, regulator and pinmux
* 99c011c37d ANDROID: GKI: Add mtktv ABI symbol list, pwm, serial and snd
* b85af8a6dd ANDROID: GKI: Add mtktv ABI symbol list, usb and v4l2
* 0f986fae12 FROMGIT: BACKPORT: Multi-gen LRU: Fix can_swap in lru_gen_look_around()
* 12fb1c3ef5 FROMGIT: BACKPORT: Multi-gen LRU: Avoid race in inc_min_seq()
* bf03a7c90a FROMGIT: BACKPORT: Multi-gen LRU: Fix per-zone reclaim
* 0c5273e138 BACKPORT: FROMGIT: block: Improve performance for BLK_MQ_F_BLOCKING drivers
* d12306bb95 FROMGIT: scsi: Remove a blk_mq_run_hw_queues() call
* 8bb4682c76 BACKPORT: FROMGIT: scsi: Inline scsi_kick_queue()
* 4bbc8e45b2 ANDROID: ABI: Update STG ABI to format version 2
* a9bc04930f ANDROID: GKI: usb: phy: use ANDROID_KABI_USE for api notify_port_status
* 7aa67c1a12 FROMGIT: dt-bindings: phy: realtek: Add Realtek DHC RTD SoC USB 3.0 PHY
* d58cdad855 FROMGIT: dt-bindings: phy: realtek: Add Realtek DHC RTD SoC USB 2.0 PHY
* 6e97af079d FROMGIT: phy: realtek: usb: Add driver for the Realtek SoC USB 3.0 PHY
* 3dadac8ba6 FROMGIT: phy: realtek: usb: Add driver for the Realtek SoC USB 2.0 PHY
* a600af2c26 FROMGIT: usb: phy: add usb phy notify port status API
* 46ee6c3cdd ANDROID: GKI: Create symbol files in include/config
* 9c0a91f91a ANDROID: fuse-bpf: Use stored bpf for create_open
* 77092bb630 ANDROID: fuse-bpf: Add bpf to negative fuse_dentry
* fe475ca0b5 ANDROID: fuse-bpf: Check inode not null
* feb5ea6684 ANDROID: fuse-bpf: Fix flock test compile error
* 3c49a49167 ANDROID: fuse-bpf: Add partial flock support
* 95e1c94a22 UPSTREAM: dm init: add dm-mod.waitfor to wait for asynchronously probed block devices
* 098173a46b ANDROID: Update the ABI symbol list
* 619a5f635c ANDROID: cpuidle: teo: Export a function that allows modifying util_threshold
* d92dd7312f Revert "ANDROID: GKI: Remove temp build file abi_gki_protected_exports"
* 924b7017dd ANDROID: Update the ABI symbol list
* c82392dabd BACKPORT: blk-crypto: use dynamic lock class for blk_crypto_profile::lock
* 44cf75cc35 ANDROID: KVM: arm64: Fix memory ordering for pKVM module callbacks
* fddd85ce63 ANDROID: GKI: Update symbol list for Amlogic
* f686a35a77 UPSTREAM: net/sched: cls_fw: Fix improper refcount update leads to use-after-free
* 625e1470a9 UPSTREAM: netfilter: nf_tables: fix chain binding transaction logic
* de818a4efb UPSTREAM: fs/ntfs3: Check fields while reading
* 48fffa48b0 ANDROID: GKI: Move GKI module headers to generated includes
* c51761363c ANDROID: set kmi_symbol_list_add_only for Kleaf builds.
* 1281598c53 ANDROID: GKI: Remove temp build file abi_gki_protected_exports
* 48916f9971 ANDROID: GKI: Update symbol list for Amlogic
* c2591e463d UPSTREAM: ASoC: soc-pcm: Move debugfs removal out of spinlock
* 4dc2398a95 UPSTREAM: ASoC: soc-pcm: Fix DPCM lockdep warning due to nested stream locks
* 1dd1248e12 FROMLIST: fuse: revalidate: don't invalidate if interrupted
* ef049b5a71 ANDROID: GKI: Update symbol list for Amlogic
* 88829ece33 UPSTREAM: squashfs: always build "file direct" version of page actor
* 044746150d UPSTREAM: squashfs: fix cache race with migration
* f15bd09d1e BACKPORT: squashfs: cache partial compressed blocks
* 9d4be29185 UPSTREAM: squashfs: fix buffer release race condition in readahead code
* 813c3dec23 UPSTREAM: squashfs: fix extending readahead beyond end of file
* dec4ef3ce4 UPSTREAM: squashfs: fix read regression introduced in readahead code
* 80e656926e UPSTREAM: squashfs: don't call kmalloc in decompressors
* 401371c174 UPSTREAM: squashfs: don't use intermediate buffer if pages missing
* c7f85bb4c4 UPSTREAM: squashfs: extend "page actor" to handle missing pages
* af51b9dded UPSTREAM: squashfs: support reading fragments in readahead call
* 3ba07deef7 UPSTREAM: squashfs: implement readahead
* feb80c37c6 UPSTREAM: gfs2: Don't deref jdesc in evict
* 578ffd6434 UPSTREAM: media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()
* 9b30cd89af ANDROID: Incremental fs: Allocate data buffer based on input request size
* a6ab807946 ANDROID: GKI: Update symbol list for Amlogic
* b4a6ab6566 ANDROID: KVM: arm64: Fix MMU context save/restore over TLB invalidation
* 770ba0ef6a ANDROID: Update the ABI symbol list
* 48d77946ef UPSTREAM: kasan: suppress recursive reports for HW_TAGS
* 47c669cde1 UPSTREAM: kasan, arm64: add arch_suppress_tag_checks_start/stop
* 03471b2b03 BACKPORT: arm64: mte: rename TCO routines
* 867621cdc5 BACKPORT: kasan, arm64: rename tagging-related routines
* 4c8e131d55 UPSTREAM: kasan: drop empty tagging-related defines
* c624358178 ANDROID: GKI: Update symbol list for Amlogic
* 0c09eb760b ANDROID: Update the ABI symbol list
* ca0cd37761 UPSTREAM: usb: gadget: u_serial: Add null pointer check in gs_start_io
* b0992aa672 ANDROID: Update the ABI symbol list
* fb6593baff ANDROID: ABI: Update lenovo symbol list
* 28c0341559 ANDROID: Update the ABI symbol list
* 40a4ec538f UPSTREAM: fsverity: reject FS_IOC_ENABLE_VERITY on mode 3 fds
* 28d90f10d5 UPSTREAM: fsverity: explicitly check for buffer overflow in build_merkle_tree()
* d53de05681 ANDROID: GKI: Update RTK STB KMI symbol list
* 0765cda329 UPSTREAM: f2fs: fix deadlock in i_xattr_sem and inode page lock
* 38fff8f312 Revert "FROMLIST: f2fs: remove i_xattr_sem to avoid deadlock and fix the original issue"
* 60a2ccabe2 UPSTREAM: usb: gadget: udc: renesas_usb3: Fix use after free bug in renesas_usb3_remove due to race condition
* ebe7bbdffd UPSTREAM: media: rkvdec: fix use after free bug in rkvdec_remove
* 4d634bb7be UPSTREAM: relayfs: fix out-of-bounds access in relay_file_read
* b8cb7eb0b4 BACKPORT: revert "net: align SO_RCVMARK required privileges with SO_MARK"
* 9b46997240 UPSTREAM: wifi: cfg80211: fix link del callback to call correct handler
* dc11ed25f7 UPSTREAM: wifi: cfg80211: reject bad AP MLD address
* 2e6bf292f3 UPSTREAM: KVM: arm64: Populate fault info for watchpoint
* c8a3a08497 UPSTREAM: KVM: Fix vcpu_array[0] races
* d18fa8c525 UPSTREAM: media: pvrusb2: fix DVB_CORE dependency
* f4aace942a UPSTREAM: kasan: hw_tags: avoid invalid virt_to_page()
* 8f4b51c499 UPSTREAM: scsi: ufs: core: mcq: Fix &hwq->cq_lock deadlock issue
* 94fb13dc4f UPSTREAM: x86/mm: Avoid using set_pgd() outside of real PGD pages
* 759c5c3fc2 UPSTREAM: netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE
* be89d165e3 UPSTREAM: net/sched: flower: fix possible OOB write in fl_set_geneve_opt()
* 4ae6b40b7c UPSTREAM: PCI/PM: Extend D3hot delay for NVIDIA HDA controllers
* 738dfcc029 UPSTREAM: wifi: cfg80211: fix MLO connection ownership
* d0e0e85d34 UPSTREAM: wifi: nl80211: fix NULL-ptr deref in offchan check
* 9e7678cc60 UPSTREAM: scsi: ufs: mcq: Use active_reqs to check busy in clock scaling
* 9d0d5eacda UPSTREAM: scsi: ufs: mcq: qcom: Clean the return path of ufs_qcom_mcq_config_resource()
* fa5c4a2186 UPSTREAM: scsi: ufs: mcq: qcom: Fix passing zero to PTR_ERR
* 63ab8dfd17 UPSTREAM: scsi: ufs: mcq: Fix incorrectly set queue depth
* 6423bd5a46 UPSTREAM: net: use a bounce buffer for copying skb->mark
* 656563759a UPSTREAM: io_uring: hold uring mutex around poll removal
* 1f5a89e0cc ANDROID: Set arch attribute for allmodconfig builds
* ceb26af319 ANDROID: KVM: arm64: Remove 'struct kvm_vcpu' from the KMI
* aad223db39 UPSTREAM: KVM: arm64: Restore GICv2-on-GICv3 functionality
* 2c17fbc0d9 UPSTREAM: KVM: arm64: vgic: Wrap vgic_its_create() with config_lock
* ec0944c324 UPSTREAM: KVM: arm64: vgic: Fix a circular locking issue
* e4b31e748a UPSTREAM: KVM: arm64: vgic: Don't acquire its_lock before config_lock
* b7e1f97ef7 BACKPORT: KVM: arm64: Avoid lock inversion when setting the VM register width
* 0c5ec70ec3 UPSTREAM: KVM: arm64: Avoid vcpu->mutex v. kvm->lock inversion in CPU_ON
* 60266126b3 BACKPORT: KVM: arm64: Use config_lock to protect data ordered against KVM_RUN
* 1536afa216 UPSTREAM: KVM: arm64: Use config_lock to protect vgic state
* 1d194af64a BACKPORT: KVM: arm64: Add helper vgic_write_guest_lock()
* 54b1b225ed UPSTREAM: ipvlan:Fix out-of-bounds caused by unclear skb->cb
* b31675307e UPSTREAM: net/sched: cls_u32: Fix reference counter leak leading to overflow
* eda34db29b ANDROID: GKI: Update symbol list for Amlogic
* d8eb5e7ca9 ANDROID: db845c: Fix build when using --kgdb
* d40f3254b6 FROMLIST: kheaders: dereferences the source tree
* 2ebd113814 FROMLIST: f2fs: remove i_xattr_sem to avoid deadlock and fix the original issue
* 258f11319b ANDROID: db845c: Local define for db845c targets
* 2af5c43333 ANDROID: Update the ABI symbol list
* 5af00d8531 ANDROID: Export cpu_push_stop
* 3c328a636a ANDROID: Update the ABI symbol list
* bdd2312e95 ANDROID: rockpi4: Fix build when using --kgdb
* d1601b50e6 ANDROID: kleaf: android/gki_system_dlkm_modules is generated.
* a7068670a7 ANDROID: fuse-bpf: Move FUSE_RELEASE to correct place
* ad20125502 ANDROID: fuse-bpf: Ensure bpf field can never be nulled
* bd30e9ff41 ANDROID: Update the ABI symbol list
* 7a26ac9e26 ANDROID: Delete MODULES_LIST from build configs.
* 270b27a648 ANDROID: ABI: Update lenovo symbol list
* 0a9d005c81 UPSTREAM: memstick: r592: Fix UAF bug in r592_remove due to race condition
* d465a446d2 UPSTREAM: xfs: verify buffer contents when we skip log replay

Change-Id: I56fc52175fbae29d6dea862b66a619b249e93e7c
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-08-25 11:06:54 +00:00
Sweet Tea Dorminy
95e0307577 BACKPORT: blk-crypto: dynamically allocate fallback profile
blk_crypto_profile_init() calls lockdep_register_key(), which warns and
does not register if the provided memory is a static object.
blk-crypto-fallback currently has a static blk_crypto_profile and calls
blk_crypto_profile_init() thereupon, resulting in the warning and
failure to register.

Fortunately it is simple enough to use a dynamically allocated profile
and make lockdep function correctly.

Fixes: 2fb48d88e7 ("blk-crypto: use dynamic lock class for blk_crypto_profile::lock")
Cc: stable@vger.kernel.org
Signed-off-by: Sweet Tea Dorminy <sweettea-kernel@dorminy.me>
Reviewed-by: Eric Biggers <ebiggers@google.com>
Link: https://lore.kernel.org/r/20230817141615.15387-1-sweettea-kernel@dorminy.me
Signed-off-by: Jens Axboe <axboe@kernel.dk>

(cherry picked from commit c984ff1423)
(resolved conflict due to HW-wrapped key support)
Change-Id: I8c889550f97dc3d326930bd5745da6ea64061309
Signed-off-by: Eric Biggers <ebiggers@google.com>
2023-08-24 14:19:34 +00:00
Duoming Zhou
c7860b4dbd UPSTREAM: media: usb: siano: Fix warning due to null work_func_t function pointer
[ Upstream commit 6f489a966f ]

The previous commit ebad8e731c ("media: usb: siano: Fix use after
free bugs caused by do_submit_urb") adds cancel_work_sync() in
smsusb_stop_streaming(). But smsusb_stop_streaming() may be called,
even if the work_struct surb->wq has not been initialized. As a result,
the warning will occur. One of the processes that could lead to warning
is shown below:

smsusb_probe()
  smsusb_init_device()
    if (!dev->in_ep || !dev->out_ep || align < 0) {
         smsusb_term_device(intf);
           smsusb_stop_streaming()
             cancel_work_sync(&dev->surbs[i].wq);
               __cancel_work_timer()
                 __flush_work()
                   if (WARN_ON(!work->func)) // work->func is null

The log reported by syzbot is shown below:

WARNING: CPU: 0 PID: 897 at kernel/workqueue.c:3066 __flush_work+0x798/0xa80 kernel/workqueue.c:3063
Modules linked in:
CPU: 0 PID: 897 Comm: kworker/0:2 Not tainted 6.2.0-rc1-syzkaller #0
RIP: 0010:__flush_work+0x798/0xa80 kernel/workqueue.c:3066
...
RSP: 0018:ffffc9000464ebf8 EFLAGS: 00010246
RAX: 1ffff11002dbb420 RBX: 0000000000000021 RCX: 1ffffffff204fa4e
RDX: dffffc0000000000 RSI: 0000000000000001 RDI: ffff888016dda0e8
RBP: ffffc9000464ed98 R08: 0000000000000001 R09: ffffffff90253b2f
R10: 0000000000000001 R11: 0000000000000000 R12: ffff888016dda0e8
R13: ffff888016dda0e8 R14: ffff888016dda100 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffd4331efe8 CR3: 000000000b48e000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __cancel_work_timer+0x315/0x460 kernel/workqueue.c:3160
 smsusb_stop_streaming drivers/media/usb/siano/smsusb.c:182 [inline]
 smsusb_term_device+0xda/0x2d0 drivers/media/usb/siano/smsusb.c:344
 smsusb_init_device+0x400/0x9ce drivers/media/usb/siano/smsusb.c:419
 smsusb_probe+0xbbd/0xc55 drivers/media/usb/siano/smsusb.c:567
...

This patch adds check before cancel_work_sync(). If surb->wq has not
been initialized, the cancel_work_sync() will not be executed.

Bug: 295075980
Reported-by: syzbot+27b0b464864741b18b99@syzkaller.appspotmail.com
Fixes: ebad8e731c ("media: usb: siano: Fix use after free bugs caused by do_submit_urb")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 8abb53c516)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ie2946408cfde466d0138c23093ec6738b7e51161
2023-08-23 16:18:45 +00:00
Sungwoo Kim
cb69585f72 UPSTREAM: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb
commit 1728137b33 upstream.

l2cap_sock_release(sk) frees sk. However, sk's children are still alive
and point to the already free'd sk's address.
To fix this, l2cap_sock_release(sk) also cleans sk's children.

==================================================================
BUG: KASAN: use-after-free in l2cap_sock_ready_cb+0xb7/0x100 net/bluetooth/l2cap_sock.c:1650
Read of size 8 at addr ffff888104617aa8 by task kworker/u3:0/276

CPU: 0 PID: 276 Comm: kworker/u3:0 Not tainted 6.2.0-00001-gef397bd4d5fb-dirty #59
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Workqueue: hci2 hci_rx_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x72/0x95 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:306 [inline]
 print_report+0x175/0x478 mm/kasan/report.c:417
 kasan_report+0xb1/0x130 mm/kasan/report.c:517
 l2cap_sock_ready_cb+0xb7/0x100 net/bluetooth/l2cap_sock.c:1650
 l2cap_chan_ready+0x10e/0x1e0 net/bluetooth/l2cap_core.c:1386
 l2cap_config_req+0x753/0x9f0 net/bluetooth/l2cap_core.c:4480
 l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:5739 [inline]
 l2cap_sig_channel net/bluetooth/l2cap_core.c:6509 [inline]
 l2cap_recv_frame+0xe2e/0x43c0 net/bluetooth/l2cap_core.c:7788
 l2cap_recv_acldata+0x6ed/0x7e0 net/bluetooth/l2cap_core.c:8506
 hci_acldata_packet net/bluetooth/hci_core.c:3813 [inline]
 hci_rx_work+0x66e/0xbc0 net/bluetooth/hci_core.c:4048
 process_one_work+0x4ea/0x8e0 kernel/workqueue.c:2289
 worker_thread+0x364/0x8e0 kernel/workqueue.c:2436
 kthread+0x1b9/0x200 kernel/kthread.c:376
 ret_from_fork+0x2c/0x50 arch/x86/entry/entry_64.S:308
 </TASK>

Allocated by task 288:
 kasan_save_stack+0x22/0x50 mm/kasan/common.c:45
 kasan_set_track+0x25/0x30 mm/kasan/common.c:52
 ____kasan_kmalloc mm/kasan/common.c:374 [inline]
 __kasan_kmalloc+0x82/0x90 mm/kasan/common.c:383
 kasan_kmalloc include/linux/kasan.h:211 [inline]
 __do_kmalloc_node mm/slab_common.c:968 [inline]
 __kmalloc+0x5a/0x140 mm/slab_common.c:981
 kmalloc include/linux/slab.h:584 [inline]
 sk_prot_alloc+0x113/0x1f0 net/core/sock.c:2040
 sk_alloc+0x36/0x3c0 net/core/sock.c:2093
 l2cap_sock_alloc.constprop.0+0x39/0x1c0 net/bluetooth/l2cap_sock.c:1852
 l2cap_sock_create+0x10d/0x220 net/bluetooth/l2cap_sock.c:1898
 bt_sock_create+0x183/0x290 net/bluetooth/af_bluetooth.c:132
 __sock_create+0x226/0x380 net/socket.c:1518
 sock_create net/socket.c:1569 [inline]
 __sys_socket_create net/socket.c:1606 [inline]
 __sys_socket_create net/socket.c:1591 [inline]
 __sys_socket+0x112/0x200 net/socket.c:1639
 __do_sys_socket net/socket.c:1652 [inline]
 __se_sys_socket net/socket.c:1650 [inline]
 __x64_sys_socket+0x40/0x50 net/socket.c:1650
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x72/0xdc

Freed by task 288:
 kasan_save_stack+0x22/0x50 mm/kasan/common.c:45
 kasan_set_track+0x25/0x30 mm/kasan/common.c:52
 kasan_save_free_info+0x2e/0x50 mm/kasan/generic.c:523
 ____kasan_slab_free mm/kasan/common.c:236 [inline]
 ____kasan_slab_free mm/kasan/common.c:200 [inline]
 __kasan_slab_free+0x10a/0x190 mm/kasan/common.c:244
 kasan_slab_free include/linux/kasan.h:177 [inline]
 slab_free_hook mm/slub.c:1781 [inline]
 slab_free_freelist_hook mm/slub.c:1807 [inline]
 slab_free mm/slub.c:3787 [inline]
 __kmem_cache_free+0x88/0x1f0 mm/slub.c:3800
 sk_prot_free net/core/sock.c:2076 [inline]
 __sk_destruct+0x347/0x430 net/core/sock.c:2168
 sk_destruct+0x9c/0xb0 net/core/sock.c:2183
 __sk_free+0x82/0x220 net/core/sock.c:2194
 sk_free+0x7c/0xa0 net/core/sock.c:2205
 sock_put include/net/sock.h:1991 [inline]
 l2cap_sock_kill+0x256/0x2b0 net/bluetooth/l2cap_sock.c:1257
 l2cap_sock_release+0x1a7/0x220 net/bluetooth/l2cap_sock.c:1428
 __sock_release+0x80/0x150 net/socket.c:650
 sock_close+0x19/0x30 net/socket.c:1368
 __fput+0x17a/0x5c0 fs/file_table.c:320
 task_work_run+0x132/0x1c0 kernel/task_work.c:179
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
 exit_to_user_mode_prepare+0x113/0x120 kernel/entry/common.c:203
 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline]
 syscall_exit_to_user_mode+0x21/0x50 kernel/entry/common.c:296
 do_syscall_64+0x4c/0x90 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x72/0xdc

The buggy address belongs to the object at ffff888104617800
 which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 680 bytes inside of
 1024-byte region [ffff888104617800, ffff888104617c00)

The buggy address belongs to the physical page:
page:00000000dbca6a80 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888104614000 pfn:0x104614
head:00000000dbca6a80 order:2 compound_mapcount:0 subpages_mapcount:0 compound_pincount:0
flags: 0x200000000010200(slab|head|node=0|zone=2)
raw: 0200000000010200 ffff888100041dc0 ffffea0004212c10 ffffea0004234b10
raw: ffff888104614000 0000000000080002 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff888104617980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888104617a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888104617a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                  ^
 ffff888104617b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888104617b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Bug: 297025149
Ack: This bug is found by FuzzBT with a modified Syzkaller. Other
contributors are Ruoyu Wu and Hui Peng.
Signed-off-by: Sungwoo Kim <iam@sung-woo.kim>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 29fac18499)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I1f4cf5a928b4825c63488bde0d5589517cc84ef8
2023-08-23 14:37:06 +01:00
Yifan Hong
064fe2809f ANDROID: Delete build.config.gki.aarch64.16k.
This is now implemented with defconfig fragments.
define_common_kernels use the regular
build.config.gki.aarch64 and apply
16k_defconfig on it.

Bug: 286589887
Test: TH
Signed-off-by: Yifan Hong <elsk@google.com>
(cherry picked from https://android-review.googlesource.com/q/commit:03d155e488ab9e5192cb344419e219203b82ea54)
Merged-In: I71d9abd8faa19a2e517b1c9cb82f9b1a0c9b9197
Change-Id: I71d9abd8faa19a2e517b1c9cb82f9b1a0c9b9197
2023-08-22 19:05:16 +00:00
Kyle Tso
5acbeb3895 FROMGIT: usb: typec: tcpm: Refactor the PPS APDO selection
In current design of the PPS APDO selection, TCPM power supply only
accepts the requested voltage which is inside the range of the selected
PPS profile. To extend the flexibility and usability, remove the checks
about the voltage range in current profile. And try to search all PPS
APDOs of the Source that fit the requested voltage.

Also remove some redundant checks in tcpm_pd_build_pps_request.

Signed-off-by: Kyle Tso <kyletso@google.com>
Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20230731162159.19483-1-kyletso@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 273608315
(cherry picked from commit 40f362ffa5
 git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-next)
Change-Id: If7969af6acbda6769f6a3581fcf1d2325a2b3355
Signed-off-by: Kyle Tso <kyletso@google.com>
2023-08-22 17:09:03 +00:00
erinwang
90ad33eb0e ANDROID: GKI: Update symbol list for lenovo
1 function symbol(s) added
  'int migrate_swap(struct task_struct*, struct task_struct*, int, int)'

Bug: 296962442
Change-Id: Id45b36c807d83abe0224e3e8c8b398bbae1235e0
Signed-off-by: erinwang <erinwang2@lenovo.com>
2023-08-22 17:05:03 +00:00
Laszlo Ersek
844dfdef1c UPSTREAM: net: tap_open(): set sk_uid from current_fsuid()
commit 5c9241f3ce upstream.

Commit 66b2c338ad initializes the "sk_uid" field in the protocol socket
(struct sock) from the "/dev/tapX" device node's owner UID. Per original
commit 86741ec254 ("net: core: Add a UID field to struct sock.",
2016-11-04), that's wrong: the idea is to cache the UID of the userspace
process that creates the socket. Commit 86741ec254 mentions socket() and
accept(); with "tap", the action that creates the socket is
open("/dev/tapX").

Therefore the device node's owner UID is irrelevant. In most cases,
"/dev/tapX" will be owned by root, so in practice, commit 66b2c338ad has
no observable effect:

- before, "sk_uid" would be zero, due to undefined behavior
  (CVE-2023-1076),

- after, "sk_uid" would be zero, due to "/dev/tapX" being owned by root.

What matters is the (fs)UID of the process performing the open(), so cache
that in "sk_uid".

Bug: 295995961
Cc: Eric Dumazet <edumazet@google.com>
Cc: Lorenzo Colitti <lorenzo@google.com>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: Pietro Borrello <borrello@diag.uniroma1.it>
Cc: netdev@vger.kernel.org
Cc: stable@vger.kernel.org
Fixes: 66b2c338ad ("tap: tap_open(): correctly initialize socket uid")
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2173435
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 767800fc40)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Ib5f80015e5c0280acf9f35124d3ff267ff0420f0
2023-08-22 15:15:51 +01:00
Laszlo Ersek
7e0b682baf UPSTREAM: net: tun_chr_open(): set sk_uid from current_fsuid()
commit 9bc3047374 upstream.

Commit a096ccca6e initializes the "sk_uid" field in the protocol socket
(struct sock) from the "/dev/net/tun" device node's owner UID. Per
original commit 86741ec254 ("net: core: Add a UID field to struct
sock.", 2016-11-04), that's wrong: the idea is to cache the UID of the
userspace process that creates the socket. Commit 86741ec254 mentions
socket() and accept(); with "tun", the action that creates the socket is
open("/dev/net/tun").

Therefore the device node's owner UID is irrelevant. In most cases,
"/dev/net/tun" will be owned by root, so in practice, commit a096ccca6e
has no observable effect:

- before, "sk_uid" would be zero, due to undefined behavior
  (CVE-2023-1076),

- after, "sk_uid" would be zero, due to "/dev/net/tun" being owned by root.

What matters is the (fs)UID of the process performing the open(), so cache
that in "sk_uid".

Bug: 295995961
Cc: Eric Dumazet <edumazet@google.com>
Cc: Lorenzo Colitti <lorenzo@google.com>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: Pietro Borrello <borrello@diag.uniroma1.it>
Cc: netdev@vger.kernel.org
Cc: stable@vger.kernel.org
Fixes: a096ccca6e ("tun: tun_chr_open(): correctly initialize socket uid")
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2173435
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit b6846d7c40)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I2540ac5876ca7dad39e1b867a5e09a5c9c69bb86
2023-08-22 15:15:37 +01:00
Badhri Jagan Sridharan
09eac0d3a8 UPSTREAM: usb: typec: tcpm: Fix response to vsafe0V event
commit 4270d2b484 upstream.

Do not transition to SNK_UNATTACHED state when receiving vsafe0v event
while in SNK_HARD_RESET_WAIT_VBUS. Ignore VBUS off events as well as
in some platforms VBUS off can be signalled more than once.

[143515.364753] Requesting mux state 1, usb-role 2, orientation 2
[143515.365520] pending state change SNK_HARD_RESET_SINK_OFF -> SNK_HARD_RESET_SINK_ON @ 650 ms [rev3 HARD_RESET]
[143515.632281] CC1: 0 -> 0, CC2: 3 -> 0 [state SNK_HARD_RESET_SINK_OFF, polarity 1, disconnected]
[143515.637214] VBUS on
[143515.664985] VBUS off
[143515.664992] state change SNK_HARD_RESET_SINK_OFF -> SNK_HARD_RESET_WAIT_VBUS [rev3 HARD_RESET]
[143515.665564] VBUS VSAFE0V
[143515.665566] state change SNK_HARD_RESET_WAIT_VBUS -> SNK_UNATTACHED [rev3 HARD_RESET]

Fixes: 28b43d3d74 ("usb: typec: tcpm: Introduce vsafe0v for vbus")
Cc: <stable@vger.kernel.org>
Change-Id: I0279d8abde2ceb42aefea29b4ca21972dbe4065c
Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/20230712085722.1414743-1-badhri@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 290878685
(cherry picked from commit c2372b1559)
Change-Id: I9cfd4f5533edf7b3a0893a7bef2845448d21b650
Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
2023-08-21 23:34:45 +00:00
Will McVicker
8f1d7c6850 ANDROID: Update the ABI symbol list
Adding the following symbols:
  - d_path
  - __traceiter_android_vh_sched_setaffinity_early
  - __tracepoint_android_vh_sched_setaffinity_early

Bug: 293815374
Change-Id: I2fd3b47217fa7a9806d81ba1964c94b3c4b05554
Signed-off-by: David Kimmel <davidkimmel@google.com>
Signed-off-by: Will McVicker <willmcvicker@google.com>
2023-08-21 19:09:33 +00:00
valis
54afed884d UPSTREAM: net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free
[ Upstream commit b80b829e9e ]

When route4_change() is called on an existing filter, the whole
tcf_result struct is always copied into the new instance of the filter.

This causes a problem when updating a filter bound to a class,
as tcf_unbind_filter() is always called on the old instance in the
success path, decreasing filter_cnt of the still referenced class
and allowing it to be deleted, leading to a use-after-free.

Fix this by no longer copying the tcf_result struct from the old filter.

Bug: 296347075
Fixes: 1109c00547 ("net: sched: RCU cls_route")
Reported-by: valis <sec@valis.email>
Reported-by: Bing-Jhong Billy Jheng <billy@starlabs.sg>
Signed-off-by: valis <sec@valis.email>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Victor Nogueira <victor@mojatatu.com>
Reviewed-by: Pedro Tammela <pctammela@mojatatu.com>
Reviewed-by: M A Ramdhan <ramdhan@starlabs.sg>
Link: https://lore.kernel.org/r/20230729123202.72406-4-jhs@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit d4d3b53a4c)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Iefbd201b92847ec1349f92c107d7ef5aec3fb359
2023-08-21 14:54:06 +00:00
valis
d6c1899f33 UPSTREAM: net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free
[ Upstream commit 76e42ae831 ]

When fw_change() is called on an existing filter, the whole
tcf_result struct is always copied into the new instance of the filter.

This causes a problem when updating a filter bound to a class,
as tcf_unbind_filter() is always called on the old instance in the
success path, decreasing filter_cnt of the still referenced class
and allowing it to be deleted, leading to a use-after-free.

Fix this by no longer copying the tcf_result struct from the old filter.

Bug: 296347075
Fixes: e35a8ee599 ("net: sched: fw use RCU")
Reported-by: valis <sec@valis.email>
Reported-by: Bing-Jhong Billy Jheng <billy@starlabs.sg>
Signed-off-by: valis <sec@valis.email>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Victor Nogueira <victor@mojatatu.com>
Reviewed-by: Pedro Tammela <pctammela@mojatatu.com>
Reviewed-by: M A Ramdhan <ramdhan@starlabs.sg>
Link: https://lore.kernel.org/r/20230729123202.72406-3-jhs@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 7f691439b2)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I33c91c83d1cd8e889a7261adfa3779ca6c141088
2023-08-21 14:54:04 +00:00
valis
cb45423bcc UPSTREAM: net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free
[ Upstream commit 3044b16e7c ]

When u32_change() is called on an existing filter, the whole
tcf_result struct is always copied into the new instance of the filter.

This causes a problem when updating a filter bound to a class,
as tcf_unbind_filter() is always called on the old instance in the
success path, decreasing filter_cnt of the still referenced class
and allowing it to be deleted, leading to a use-after-free.

Fix this by no longer copying the tcf_result struct from the old filter.

Bug: 296347075
Fixes: de5df63228 ("net: sched: cls_u32 changes to knode must appear atomic to readers")
Reported-by: valis <sec@valis.email>
Reported-by: M A Ramdhan <ramdhan@starlabs.sg>
Signed-off-by: valis <sec@valis.email>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Victor Nogueira <victor@mojatatu.com>
Reviewed-by: Pedro Tammela <pctammela@mojatatu.com>
Reviewed-by: M A Ramdhan <ramdhan@starlabs.sg>
Link: https://lore.kernel.org/r/20230729123202.72406-2-jhs@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit aab2d095ce)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I1a8381c308cc97cf61d6f95a02992d2c553455c5
2023-08-21 14:54:01 +00:00
Pablo Neira Ayuso
880189fdd2 UPSTREAM: netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID
[ Upstream commit 0ebc1064e4 ]

Bail out with EOPNOTSUPP when adding rule to bound chain via
NFTA_RULE_CHAIN_ID. The following warning splat is shown when
adding a rule to a deleted bound chain:

 WARNING: CPU: 2 PID: 13692 at net/netfilter/nf_tables_api.c:2013 nf_tables_chain_destroy+0x1f7/0x210 [nf_tables]
 CPU: 2 PID: 13692 Comm: chain-bound-rul Not tainted 6.1.39 #1
 RIP: 0010:nf_tables_chain_destroy+0x1f7/0x210 [nf_tables]

Bug: 296128351
Fixes: d0e2c7de92 ("netfilter: nf_tables: add NFT_CHAIN_BINDING")
Reported-by: Kevin Rich <kevinrich1337@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 268cb07ef3)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Icf97f57d18bb2b30ed28a3de6cdd18661d7f1c3d
2023-08-21 13:57:51 +01:00
Lee Jones
4c73cba07b ANDROID: usb: gadget: f_accessory: Mitgate handling of non-existent USB request
Prevents mishandling USB requests that are no longer present.

Bug: 161010552
Fixes: 483cb5629e ("ANDROID: usb: gadget: f_accessory: Add Android Accessory function")
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Change-Id: I8ff24d6d49214c3bd10a1b5d5e72814ec2a91c61
(cherry picked from commit 5228cb193d)
Signed-off-by: Lee Jones <joneslee@google.com>
2023-08-16 09:47:31 +00:00
Petri Gynther
eebccae505 ANDROID: Update the ABI symbol list
Adding the following symbols:
  - drm_connector_attach_max_bpc_property

Bug: 295934766
Change-Id: I7e32466caae2ae200b9549c62a3bcb2652612181
Signed-off-by: Petri Gynther <pgynther@google.com>
2023-08-15 21:19:03 +00:00
Charan Teja Kalla
a845525d3e FROMGIT: Multi-gen LRU: skip CMA pages when they are not eligible
This patch is based on the commit 5da226dbfce3("mm: skip CMA pages when
they are not available") which skips cma pages reclaim when they are not
eligible for the current allocation context.  In mglru, such pages are
added to the tail of the immediate generation to maintain better LRU
order, which is unlike the case of conventional LRU where such pages are
directly added to the head of the LRU list(akin to adding to head of the
youngest generation in mglru).

No observable issue without this patch on MGLRU, but logically it make
sense to skip the CMA page reclaim when those pages can't be satisfied for
the current allocation context.

Link: https://lkml.kernel.org/r/1691568344-13475-1-git-send-email-quic_charante@quicinc.com
Change-Id: I586415b3e3a92da23f3e79b9d63802a2ced03432
Signed-off-by: Charan Teja Kalla <quic_charante@quicinc.com>
Reviewed-by: Kalesh Singh <kaleshsingh@google.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Yu Zhao <yuzhao@google.com>
Cc: Zhaoyang Huang <zhaoyang.huang@unisoc.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
(cherry picked from commit 75d52d9304ef5b268eb798b0c679815290a0fc83 https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git mm-unstable)
Bug: 288383787
Bug: 291719697
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
2023-08-15 19:57:14 +00:00
Zhaoyang Huang
4502265e16 BACKPORT: mm: skip CMA pages when they are not available
This patch fixes unproductive reclaiming of CMA pages by skipping them
when they are not available for current context.  It arises from the below
OOM issue, which was caused by a large proportion of MIGRATE_CMA pages
among free pages.

[   36.172486] [03-19 10:05:52.172] ActivityManager: page allocation failure: order:0, mode:0xc00(GFP_NOIO), nodemask=(null),cpuset=foreground,mems_allowed=0
[   36.189447] [03-19 10:05:52.189] DMA32: 0*4kB 447*8kB (C) 217*16kB (C) 124*32kB (C) 136*64kB (C) 70*128kB (C) 22*256kB (C) 3*512kB (C) 0*1024kB 0*2048kB 0*4096kB = 35848kB
[   36.193125] [03-19 10:05:52.193] Normal: 231*4kB (UMEH) 49*8kB (MEH) 14*16kB (H) 13*32kB (H) 8*64kB (H) 2*128kB (H) 0*256kB 1*512kB (H) 0*1024kB 0*2048kB 0*4096kB = 3236kB
...
[   36.234447] [03-19 10:05:52.234] SLUB: Unable to allocate memory on node -1, gfp=0xa20(GFP_ATOMIC)
[   36.234455] [03-19 10:05:52.234] cache: ext4_io_end, object size: 64, buffer size: 64, default order: 0, min order: 0
[   36.234459] [03-19 10:05:52.234] node 0: slabs: 53,objs: 3392, free: 0

This change further decreases the chance for wrong OOMs in the presence
of a lot of CMA memory.

[david@redhat.com: changelog addition]
Link: https://lkml.kernel.org/r/1685501461-19290-1-git-send-email-zhaoyang.huang@unisoc.com
Change-Id: I84f1145c38b5ff7b825f2122b33bc55997931bd7
Signed-off-by: Zhaoyang Huang <zhaoyang.huang@unisoc.com>
Acked-by: David Hildenbrand <david@redhat.com>
Cc: ke.wang <ke.wang@unisoc.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
(cherry picked from commit 5da226dbfc)
Bug: 288383787
Bug: 291719697
[ Rename folio to page - Kalesh Singh ]
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
2023-08-15 19:57:14 +00:00
Lee Jones
53c38ebc4e ANDROID: dm-bow: Protect Ranges fetched and erased from the RB tree
Bug: 195565510
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Change-Id: Ic8134eb902aa7d929e3121b2f69b1d258f570652
(cherry picked from commit 98c15b2bad)
Signed-off-by: Lee Jones <joneslee@google.com>
2023-08-15 16:21:25 +00:00
Pablo Neira Ayuso
b88b3d3664 UPSTREAM: netfilter: nf_tables: skip bound chain on rule flush
[ Upstream commit 6eaf41e87a ]

Skip bound chain when flushing table rules, the rule that owns this
chain releases these objects.

Otherwise, the following warning is triggered:

  WARNING: CPU: 2 PID: 1217 at net/netfilter/nf_tables_api.c:2013 nf_tables_chain_destroy+0x1f7/0x210 [nf_tables]
  CPU: 2 PID: 1217 Comm: chain-flush Not tainted 6.1.39 #1
  RIP: 0010:nf_tables_chain_destroy+0x1f7/0x210 [nf_tables]

Bug: 294357305
Fixes: d0e2c7de92 ("netfilter: nf_tables: add NFT_CHAIN_BINDING")
Reported-by: Kevin Rich <kevinrich1337@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit e18922ce3e)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I48f43d0ce3410efec2513479a1f4c7708a097b01
2023-08-15 16:18:31 +00:00
Chaoyuan Peng
6bcc6ff841 UPSTREAM: tty: n_gsm: fix UAF in gsm_cleanup_mux
commit 9b9c8195f3 upstream.

In gsm_cleanup_mux() the 'gsm->dlci' pointer was not cleaned properly,
leaving it a dangling pointer after gsm_dlci_release.
This leads to use-after-free where 'gsm->dlci[0]' are freed and accessed
by the subsequent gsm_cleanup_mux().

Such is the case in the following call trace:

 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
 print_address_description+0x63/0x3b0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:434 [inline]
 kasan_report+0x16b/0x1c0 mm/kasan/report.c:451
 gsm_cleanup_mux+0x76a/0x850 drivers/tty/n_gsm.c:2397
 gsm_config drivers/tty/n_gsm.c:2653 [inline]
 gsmld_ioctl+0xaae/0x15b0 drivers/tty/n_gsm.c:2986
 tty_ioctl+0x8ff/0xc50 drivers/tty/tty_io.c:2816
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:874 [inline]
 __se_sys_ioctl+0xf1/0x160 fs/ioctl.c:860
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
 </TASK>

Allocated by task 3501:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:46 [inline]
 set_alloc_info mm/kasan/common.c:434 [inline]
 ____kasan_kmalloc+0xba/0xf0 mm/kasan/common.c:513
 kasan_kmalloc include/linux/kasan.h:264 [inline]
 kmem_cache_alloc_trace+0x143/0x290 mm/slub.c:3247
 kmalloc include/linux/slab.h:591 [inline]
 kzalloc include/linux/slab.h:721 [inline]
 gsm_dlci_alloc+0x53/0x3a0 drivers/tty/n_gsm.c:1932
 gsm_activate_mux+0x1c/0x330 drivers/tty/n_gsm.c:2438
 gsm_config drivers/tty/n_gsm.c:2677 [inline]
 gsmld_ioctl+0xd46/0x15b0 drivers/tty/n_gsm.c:2986
 tty_ioctl+0x8ff/0xc50 drivers/tty/tty_io.c:2816
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:874 [inline]
 __se_sys_ioctl+0xf1/0x160 fs/ioctl.c:860
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x61/0xcb

Freed by task 3501:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track+0x4b/0x80 mm/kasan/common.c:46
 kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:360
 ____kasan_slab_free+0xd8/0x120 mm/kasan/common.c:366
 kasan_slab_free include/linux/kasan.h:230 [inline]
 slab_free_hook mm/slub.c:1705 [inline]
 slab_free_freelist_hook+0xdd/0x160 mm/slub.c:1731
 slab_free mm/slub.c:3499 [inline]
 kfree+0xf1/0x270 mm/slub.c:4559
 dlci_put drivers/tty/n_gsm.c:1988 [inline]
 gsm_dlci_release drivers/tty/n_gsm.c:2021 [inline]
 gsm_cleanup_mux+0x574/0x850 drivers/tty/n_gsm.c:2415
 gsm_config drivers/tty/n_gsm.c:2653 [inline]
 gsmld_ioctl+0xaae/0x15b0 drivers/tty/n_gsm.c:2986
 tty_ioctl+0x8ff/0xc50 drivers/tty/tty_io.c:2816
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:874 [inline]
 __se_sys_ioctl+0xf1/0x160 fs/ioctl.c:860
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x61/0xcb

Bug: 291178675
Fixes: aa371e96f0 ("tty: n_gsm: fix restart handling via CLD command")
Signed-off-by: Chaoyuan Peng <hedonistsmith@gmail.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 9615ca54bc)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I947cad0e8080378b40d4098add48992ade5fe638
2023-08-15 16:17:27 +00:00
Pedro Tammela
b4a6c6f4a1 UPSTREAM: net/sched: sch_qfq: account for stab overhead in qfq_enqueue
[ Upstream commit 3e337087c3 ]

Lion says:
-------
In the QFQ scheduler a similar issue to CVE-2023-31436
persists.

Consider the following code in net/sched/sch_qfq.c:

static int qfq_enqueue(struct sk_buff *skb, struct Qdisc *sch,
                struct sk_buff **to_free)
{
     unsigned int len = qdisc_pkt_len(skb), gso_segs;

    // ...

     if (unlikely(cl->agg->lmax < len)) {
         pr_debug("qfq: increasing maxpkt from %u to %u for class %u",
              cl->agg->lmax, len, cl->common.classid);
         err = qfq_change_agg(sch, cl, cl->agg->class_weight, len);
         if (err) {
             cl->qstats.drops++;
             return qdisc_drop(skb, sch, to_free);
         }

    // ...

     }

Similarly to CVE-2023-31436, "lmax" is increased without any bounds
checks according to the packet length "len". Usually this would not
impose a problem because packet sizes are naturally limited.

This is however not the actual packet length, rather the
"qdisc_pkt_len(skb)" which might apply size transformations according to
"struct qdisc_size_table" as created by "qdisc_get_stab()" in
net/sched/sch_api.c if the TCA_STAB option was set when modifying the qdisc.

A user may choose virtually any size using such a table.

As a result the same issue as in CVE-2023-31436 can occur, allowing heap
out-of-bounds read / writes in the kmalloc-8192 cache.
-------

We can create the issue with the following commands:

tc qdisc add dev $DEV root handle 1: stab mtu 2048 tsize 512 mpu 0 \
overhead 999999999 linklayer ethernet qfq
tc class add dev $DEV parent 1: classid 1:1 htb rate 6mbit burst 15k
tc filter add dev $DEV parent 1: matchall classid 1:1
ping -I $DEV 1.1.1.2

This is caused by incorrectly assuming that qdisc_pkt_len() returns a
length within the QFQ_MIN_LMAX < len < QFQ_MAX_LMAX.

Bug: 292249631
Fixes: 462dbc9101 ("pkt_sched: QFQ Plus: fair-queueing service at DRR cost")
Reported-by: Lion <nnamrec@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Pedro Tammela <pctammela@mojatatu.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 70feebdbfa)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I69bec7b092e980fe8e0946c26ed9b5ac7c57bf3d
2023-08-15 16:15:07 +00:00
Pedro Tammela
1b2e6ebdc6 UPSTREAM: net/sched: sch_qfq: refactor parsing of netlink parameters
[ Upstream commit 25369891fc ]

Two parameters can be transformed into netlink policies and
validated while parsing the netlink message.

Bug: 292249631
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Pedro Tammela <pctammela@mojatatu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: 3e337087c3 ("net/sched: sch_qfq: account for stab overhead in qfq_enqueue")
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 8e0326cbc4)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Idb17a2f9a50b060bcadca6cf7a8c6b7ecaf7d0f1
2023-08-15 16:15:07 +00:00
Florian Westphal
4128e28878 UPSTREAM: netfilter: nft_set_pipapo: fix improper element removal
[ Upstream commit 87b5a5c209 ]

end key should be equal to start unless NFT_SET_EXT_KEY_END is present.

Its possible to add elements that only have a start key
("{ 1.0.0.0 . 2.0.0.0 }") without an internval end.

Insertion treats this via:

if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY_END))
   end = (const u8 *)nft_set_ext_key_end(ext)->data;
else
   end = start;

but removal side always uses nft_set_ext_key_end().
This is wrong and leads to garbage remaining in the set after removal
next lookup/insert attempt will give:

BUG: KASAN: slab-use-after-free in pipapo_get+0x8eb/0xb90
Read of size 1 at addr ffff888100d50586 by task nft-pipapo_uaf_/1399
Call Trace:
 kasan_report+0x105/0x140
 pipapo_get+0x8eb/0xb90
 nft_pipapo_insert+0x1dc/0x1710
 nf_tables_newsetelem+0x31f5/0x4e00
 ..

Bug: 293587745
Fixes: 3c4287f620 ("nf_tables: Add set type for arbitrary concatenation of ranges")
Reported-by: lonial con <kongln9170@gmail.com>
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 90c3955beb)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I51a423aaa2c31c4df89776505b602aa2c1523b82
2023-08-15 11:55:10 +01:00
Yifan Hong
1122dd3711 ANDROID: Add checkpatch target.
Running the following will run scripts/checkpatch.pl on a
patch of HEAD

  tools/bazel run //common:checkpatch

or a given Git SHA1:

  tools/bazel run //common:checkpatch -- --git_sha1 ...

For additional flags, see

  tools/bazel run //common:checkpatch -- --help

For details, see
  build/kernel/kleaf/docs/checkpatch.md
in your source tree.

Test: TH
Bug: 259995152
Change-Id: Iaad8fd69508cf9be11340166aafbb84930d4805c
Signed-off-by: Yifan Hong <elsk@google.com>
(cherry picked from commit 7dbf26568fcccde88470e7a25c07f0c7229e85f1)
2023-08-14 23:01:40 +00:00
RD Babiera
056a17677d BACKPORT: FROMGIT: usb: typec: altmodes/displayport: Signal hpd when configuring pin assignment
When connecting to some DisplayPort partners, the initial status update
after entering DisplayPort Alt Mode notifies that the DFP_D/UFP_D is not in
the connected state. This leads to sending a configure message that keeps
the device in USB mode. The port partner then sets DFP_D/UFP_D to the
connected state and HPD to high in the same Attention message. Currently,
the HPD signal is dropped in order to handle configuration.

This patch saves changes to the HPD signal when the device chooses to
configure during dp_altmode_status_update, and invokes sysfs_notify if
necessary for HPD after configuring.

Fixes: 0e3bb7d689 ("usb: typec: Add driver for DisplayPort alternate mode")
Cc: stable@vger.kernel.org
Signed-off-by: RD Babiera <rdbabiera@google.com>
Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/all/20230726020903.1409072-1-rdbabiera@google.com/
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 288137625
(cherry picked from commit 5a5ccd61cf
 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
 usb-linus)
[rd: resolved minor conflict in displayport.c]
Change-Id: I26ef49949aa0681ea6b88d8c95f5ddd54fe84664
Signed-off-by: RD Babiera <rdbabiera@google.com>
2023-08-14 22:52:26 +00:00
Alan Stern
ee1147625d BACKPORT: USB: Gadget: core: Help prevent panic during UVC unconfigure
Avichal Rakesh reported a kernel panic that occurred when the UVC
gadget driver was removed from a gadget's configuration.  The panic
involves a somewhat complicated interaction between the kernel driver
and a userspace component (as described in the Link tag below), but
the analysis did make one thing clear: The Gadget core should
accomodate gadget drivers calling usb_gadget_deactivate() as part of
their unbind procedure.

Currently this doesn't work.  gadget_unbind_driver() calls
driver->unbind() while holding the udc->connect_lock mutex, and
usb_gadget_deactivate() attempts to acquire that mutex, which will
result in a deadlock.

The simple fix is for gadget_unbind_driver() to release the mutex when
invoking the ->unbind() callback.  There is no particular reason for
it to be holding the mutex at that time, and the mutex isn't held
while the ->bind() callback is invoked.  So we'll drop the mutex
before performing the unbind callback and reacquire it afterward.

We'll also add a couple of comments to usb_gadget_activate() and
usb_gadget_deactivate().  Because they run in process context they
must not be called from a gadget driver's ->disconnect() callback,
which (according to the kerneldoc for struct usb_gadget_driver in
include/linux/usb/gadget.h) may run in interrupt context.  This may
help prevent similar bugs from arising in the future.

Reported-and-tested-by: Avichal Rakesh <arakesh@google.com>
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Fixes: 286d9975a8 ("usb: gadget: udc: core: Prevent soft_connect_store() race")
Link: https://lore.kernel.org/linux-usb/4d7aa3f4-22d9-9f5a-3d70-1bd7148ff4ba@google.com/
Cc: Badhri Jagan Sridharan <badhri@google.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/48b2f1f1-0639-46bf-bbfc-98cb05a24914@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 291976100
Change-Id: Icff01d8e88f041af4bda8726242de9cd518a247a
(cherry picked from commit 65dadb2bee)
[arakesh: Current branch has diverged from upstream, but the
          semantics of the bug remains the same. Manually cp'ed over
          the diff from upstream patch]
Signed-off-by: Avichal Rakesh <arakesh@google.com>
2023-08-11 17:30:31 +00:00
Bart Van Assche
7ba2131ad4 FROMLIST: scsi: ufs: Disable zone write locking
From the UFSHCI 4.0 specification, about the legacy (single queue) mode:
"The host controller always process transfer requests in-order according
to the order submitted to the list. In case of multiple commands with
single doorbell register ringing (batch mode), The dispatch order for
these transfer requests by host controller will base on their index in
the List. A transfer request with lower index value will be executed
before a transfer request with higher index value."

From the UFSHCI 4.0 specification, about the MCQ mode:
"Command Submission
1. Host SW writes an Entry to SQ
2. Host SW updates SQ doorbell tail pointer

Command Processing
3. After fetching the Entry, Host Controller updates SQ doorbell head
   pointer
4. Host controller sends COMMAND UPIU to UFS device"

In other words, for both legacy and MCQ mode, UFS controllers are
required to forward commands to the UFS device in the order these
commands have been received from the host.

Notes:
- For legacy mode this is only correct if the host submits one
  command at a time. The UFS driver does this.
- Also in legacy mode, the command order is not preserved if
  auto-hibernation is enabled in the UFS controller. Hence, enable
  zone write locking if auto-hibernation is enabled.

This patch improves performance as follows on my test setup:
- With the mq-deadline scheduler: 2.5x more IOPS for small writes.
- When not using an I/O scheduler compared to using mq-deadline with
  zone locking: 4x more IOPS for small writes.

Cc: Martin K. Petersen <martin.petersen@oracle.com>
Cc: Avri Altman <avri.altman@wdc.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Damien Le Moal <dlemoal@kernel.org>
Cc: Ming Lei <ming.lei@redhat.com>
Change-Id: Ie569b09ed78ecb91af0a13f56992f075f8d1f07a
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Bug: 234829282
Link: https://lore.kernel.org/linux-block/20230804154821.3232094-1-bvanassche@acm.org/T/#mbfe0e160cc8a47c16af598f1c0b3aeeb125d66de
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-08-10 21:03:40 +00:00
Bart Van Assche
4224108a41 FROMLIST: scsi: ufs: Split an if-condition
Make the next patch in this series easier to read. No functionality is
changed.

Cc: Martin K. Petersen <martin.petersen@oracle.com>
Cc: Avri Altman <avri.altman@wdc.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Damien Le Moal <dlemoal@kernel.org>
Cc: Ming Lei <ming.lei@redhat.com>
Change-Id: Id28955a0fb550c0e65eca2979efd3c796ac97dfa
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Bug: 234829282
Link: https://lore.kernel.org/linux-block/20230804154821.3232094-1-bvanassche@acm.org/T/#m49d28556332d4b959b8d8f4f7beeaec14add573d
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-08-10 21:03:40 +00:00
Bart Van Assche
1c33b80bf7 FROMLIST: scsi: scsi_debug: Support injecting unaligned write errors
Allow user space software, e.g. a blktests test, to inject unaligned
write errors.

Cc: Martin K. Petersen <martin.petersen@oracle.com>
Cc: Douglas Gilbert <dgilbert@interlog.com>
Change-Id: I05beba49f97d897b46bb1dc030037d4ae461f02b
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Bug: 234829282
Link: https://lore.kernel.org/linux-block/20230804154821.3232094-1-bvanassche@acm.org/T/#m90e1577803b1b226a8d85c9ac6195b4c0a4d2e3f
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-08-10 21:03:40 +00:00
Bart Van Assche
6c0276ef82 FROMLIST: scsi: scsi_debug: Support disabling zone write locking
Make it easier to test handling of QUEUE_FLAG_NO_ZONE_WRITE_LOCK by
adding support for setting this flag for scsi_debug request queues.

Cc: Martin K. Petersen <martin.petersen@oracle.com>
Cc: Douglas Gilbert <dgilbert@interlog.com>
Change-Id: I6c8f338dea26c8bfbbca18c70e306f904eccf0cb
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Bug: 234829282
Link: https://lore.kernel.org/linux-block/20230804154821.3232094-1-bvanassche@acm.org/T/#m42e4fdc8dce111f4cdd4dee21f438cd6bf0c9c70
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-08-10 21:03:40 +00:00
Bart Van Assche
3347f7daae FROMLIST: scsi: core: Retry unaligned zoned writes
If zoned writes (REQ_OP_WRITE) for a sequential write required zone have
a starting LBA that differs from the write pointer, e.g. because zoned
writes have been reordered, then the storage device will respond with an
UNALIGNED WRITE COMMAND error. Send commands that failed with an
unaligned write error to the SCSI error handler if zone write locking is
disabled. Let the SCSI error handler sort SCSI commands per LBA before
resubmitting these.

If zone write locking is disabled, increase the number of retries for
write commands sent to a sequential zone to the maximum number of
outstanding commands because in the worst case the number of times
reordered zoned writes have to be retried is (number of outstanding
writes per sequential zone) - 1.

Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Cc: Martin K. Petersen <martin.petersen@oracle.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Ming Lei <ming.lei@redhat.com>
Change-Id: I519cb3aedea7e0635be8af554edee76e8d162498
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Bug: 234829282
Link: https://lore.kernel.org/linux-block/20230804154821.3232094-1-bvanassche@acm.org/T/#ma6573df4361baa921c258e3b39685a5c4c509faa
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-08-10 21:03:40 +00:00
Bart Van Assche
4e1d1b839d FROMLIST: block/mq-deadline: Only use zone locking if necessary
Measurements have shown that limiting the queue depth to one per zone for
zoned writes has a significant negative performance impact on zoned UFS
devices. Hence this patch that disables zone locking by the mq-deadline
scheduler if the storage controller preserves the command order. This
patch is based on the following assumptions:
- It happens infrequently that zoned write requests are reordered by the
  block layer.
- The I/O priority of all write requests is the same per zone.
- Either no I/O scheduler is used or an I/O scheduler is used that
  serializes write requests per zone.

Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Ming Lei <ming.lei@redhat.com>
Change-Id: I2000beaa430f29ea1096149a7d3b8a5423b679ec
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Bug: 234829282
Link: https://lore.kernel.org/linux-block/20230804154821.3232094-1-bvanassche@acm.org/T/#made79fdd0e1d8d466f734250f3868b4d6f8105db
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-08-10 21:03:40 +00:00
Bart Van Assche
5414ea3f50 BACKPORT: FROMLIST: block: Introduce the flag QUEUE_FLAG_NO_ZONE_WRITE_LOCK
Writes in sequential write required zones must happen at the write
pointer. Even if the submitter of the write commands (e.g. a filesystem)
submits writes for sequential write required zones in order, the block
layer or the storage controller may reorder these write commands.

The zone locking mechanism in the mq-deadline I/O scheduler serializes
write commands for sequential zones. Some but not all storage controllers
require this serialization. Introduce a new request queue flag to allow
block drivers to indicate that they preserve the order of write commands
and thus do not require serialization of writes per zone.

Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Ming Lei <ming.lei@redhat.com>
Change-Id: Ibf578f0ec92074ccc2c11d2c24c8d6309294bc8c
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Bug: 234829282
Link: https://lore.kernel.org/linux-block/20230804154821.3232094-1-bvanassche@acm.org/T/#m539c093dff4322599af97bccea975f73f3f67013
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-08-10 21:03:40 +00:00
Bart Van Assche
d01888a968 Revert "ANDROID: block: Introduce a request queue flag for pipelining zoned writes"
Prepare for applying the FROMLIST version of this patch.

This reverts commit 54678c4c75.

Bug: 234829282
Change-Id: I37215b4527d993e56b1e9a85c390c9ce843850e7
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-08-10 21:03:40 +00:00
Bart Van Assche
6a1ceeede7 Revert "ANDROID: block/mq-deadline: Only use zone locking if necessary"
Prepare for applying the FROMLIST version of this patch.

This reverts commit f57c245b52.

Bug: 234829282
Change-Id: I34cc27653fc8d22f8e068f2776be285c5e2806f3
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-08-10 21:03:40 +00:00
Bart Van Assche
dc77af3d38 Revert "ANDROID: scsi: Retry unaligned zoned writes"
Prepare for applying the FROMLIST version of this patch.

This reverts commit 33aea9741e.

Bug: 234829282
Change-Id: I4928e41be2dfcf25dd21ce5feb4e3dcdd8b9df35
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-08-10 21:03:40 +00:00
Bart Van Assche
2e83e40f6a Revert "ANDROID: scsi: ufs: Enable zoned write pipelining"
Prepare for applying the FROMLIST version of this patch.

This reverts commit d701aaaeb4.

Bug: 234829282
Change-Id: I7f267cf661807c7c8c96ea05966d77b338d62de2
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-08-10 21:03:40 +00:00
Bart Van Assche
e08f97fe80 Revert "ANDROID: scsi: ufs: Disable zoned write pipelining"
Prepare for applying the FROMLIST version of this patch.

This reverts commit ca743f9d51.

Bug: 234829282
Change-Id: Id95600f80be575da720b098a86aa46b84d33a733
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-08-10 21:03:40 +00:00
Bart Van Assche
a0565250b3 Revert "ANDROID: scsi: core: Delay unaligned write error retries"
Prepare for applying the FROMLIST version of this patch.

This reverts commit 2dffc600ca.

Bug: 234829282
Change-Id: I58fad37a8586350676b6d9be93aa01b1ce170a00
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-08-10 21:03:40 +00:00
Bart Van Assche
053f022ed4 Revert "ANDROID: scsi: core: Limit zoned write retries"
Prepare for applying the FROMLIST version of this patch.

This reverts commit 3bfdcf06e4.

Bug: 234829282
Change-Id: I5b2492d9b1475f69a0650a7621a2ea1606d7fb92
Signed-off-by: Bart Van Assche <bvanassche@google.com>
2023-08-10 21:03:40 +00:00
Lecopzer Chen
8c7e6396da ANDROID: GKI: update mtktv symbol
update for gki modules protected symbols

11 function symbol(s) added
  'void baswap(bdaddr_t*, const bdaddr_t*)'
  'void bt_procfs_cleanup(struct net*, const char*)'
  'int bt_procfs_init(struct net*, const char*, struct bt_sock_list*, int(*)(struct seq_file*, void*))'
  'void bt_sock_link(struct bt_sock_list*, struct sock*)'
  'int bt_sock_register(int, const struct net_proto_family*)'
  'void bt_sock_unlink(struct bt_sock_list*, struct sock*)'
  'void bt_sock_unregister(int)'
  'int generic_mii_ioctl(struct mii_if_info*, struct mii_ioctl_data*, int, unsigned int*)'
  'bool l2cap_is_socket(struct socket*)'
  'int mii_ethtool_set_link_ksettings(struct mii_if_info*, const struct ethtool_link_ksettings*)'
  'int mii_nway_restart(struct mii_if_info*)'

Bug: 295293717
Change-Id: I14162165fc644243d4d73aa32a0cd8cb5c10846e
Signed-off-by: Lecopzer Chen <lecopzer.chen@mediatek.com>
2023-08-10 13:46:18 +00:00
Lecopzer Chen
7d47dd77f1 ANDROID: GKI: Add mtktv ABI symbol list, media, trace and remaining subsys
43 function symbol(s) added
  'int __devm_mdiobus_register(struct device*, struct mii_bus*, struct module*)'
  'void __insert_inode_hash(struct inode*, unsigned long)'
  'int __mdiobus_register(struct mii_bus*, struct module*)'
  'void __sock_recv_cmsgs(struct msghdr*, struct sock*, struct sk_buff*)'
  'int __trace_bputs(unsigned long, const char*)'
  'int __traceiter_android_vh_oom_check_panic(void*, struct oom_control*, int*)'
  'void _trace_android_vh_record_pcpu_rwsem_starttime(struct task_struct*, unsigned long)'
  'int block_is_partially_uptodate(struct page*, unsigned long, unsigned long)'
  'int buffer_migrate_page(struct address_space*, struct page*, struct page*, enum migrate_mode)'
  'struct inode* igrab(struct inode*)'
  'int iio_read_channel_scale(struct iio_channel*, int*, int*)'
  'void invalidate_bh_lrus()'
  'void io_schedule()'
  'u64 jiffies64_to_nsecs(u64)'
  'int kern_path(const char*, unsigned int, struct path*)'
  'int kmsg_dump_register(struct kmsg_dumper*)'
  'int kmsg_dump_unregister(struct kmsg_dumper*)'
  'int kstrtoul_from_user(const char*, size_t, unsigned int, unsigned long*)'
  'enum led_default_state led_init_default_state_get(struct fwnode_handle*)'
  'int lzo1x_1_compress(const unsigned char*, size_t, unsigned char*, size_t*, void*)'
  'int lzo1x_decompress_safe(const unsigned char*, size_t, unsigned char*, size_t*)'
  'struct media_link* media_create_intf_link(struct media_entity*, struct media_interface*, u32)'
  'int media_create_pad_links(const struct media_device*, u32, struct media_entity*, u16, u32, struct media_entity*, u16, u32, bool)'
  'int media_device_register_entity(struct media_device*, struct media_entity*)'
  'int media_device_register_entity_notify(struct media_device*, struct media_entity_notify*)'
  'void media_device_unregister_entity(struct media_entity*)'
  'struct media_intf_devnode* media_devnode_create(struct media_device*, u32, u32, u32, u32)'
  'void media_devnode_remove(struct media_intf_devnode*)'
  'struct media_link* media_entity_find_link(struct media_pad*, struct media_pad*)'
  'int media_get_pad_index(struct media_entity*, bool, enum media_pad_signal_type)'
  'struct dentry* mount_bdev(struct file_system_type*, int, const char*, void*, int(*)(struct super_block*, void*, int))'
  'struct list_head* seq_list_next(void*, struct list_head*, loff_t*)'
  'struct list_head* seq_list_start(struct list_head*, loff_t)'
  'int seq_open_private(struct file*, const struct seq_operations*, int)'
  'int sprint_symbol_no_offset(char*, unsigned long)'
  'unsigned int stack_trace_save_regs(struct pt_regs*, unsigned long*, unsigned int, unsigned int)'
  'ssize_t store_sampling_rate(struct gov_attr_set*, const char*, size_t)'
  'int sysfs_merge_group(struct kobject*, const struct attribute_group*)'
  'void sysfs_unmerge_group(struct kobject*, const struct attribute_group*)'
  'int trace_array_destroy(struct trace_array*)'
  'struct trace_array* trace_array_get_by_name(const char*)'
  'int trace_array_init_printk(struct trace_array*)'
  'int trace_array_printk(struct trace_array*, unsigned long, const char*, ...)'

4 variable symbol(s) added
  'struct tracepoint __tracepoint_android_vh_oom_check_panic'
  'const struct fwnode_operations irqchip_fwnode_ops'
  'struct workqueue_struct* system_freezable_power_efficient_wq'
  'struct srcu_struct tracepoint_srcu'

Bug: 293831482
Change-Id: If762f88971a9d8c2013c407838e46669a78719ff
Signed-off-by: Lecopzer Chen <lecopzer.chen@mediatek.com>
2023-08-09 17:02:02 +00:00
Lecopzer Chen
655a288103 ANDROID: GKI: Add mtktv ABI symbol list, cpufreq and misc
32 function symbol(s) added
  'void clk_bulk_put_all(int, struct clk_bulk_data*)'
  'struct clk* clk_register_divider_table(struct device*, const char*, const char*, unsigned long, void*, u8, u8, u8, const struct clk_div_table*, spinlock_t*)'
  'void console_verbose()'
  'void cpufreq_dbs_governor_exit(struct cpufreq_policy*)'
  'int cpufreq_dbs_governor_init(struct cpufreq_policy*)'
  'void cpufreq_dbs_governor_limits(struct cpufreq_policy*)'
  'int cpufreq_dbs_governor_start(struct cpufreq_policy*)'
  'void cpufreq_dbs_governor_stop(struct cpufreq_policy*)'
  'void cpufreq_update_policy(unsigned int)'
  'struct dentry* d_add_ci(struct dentry*, struct inode*, struct qstr*)'
  'unsigned int dbs_update(struct cpufreq_policy*)'
  'void dev_get_tstats64(struct net_device*, struct rtnl_link_stats64*)'
  'int device_match_of_node(struct device*, const void*)'
  'struct regmap* device_node_to_regmap(struct device_node*)'
  'void devm_devfreq_remove_device(struct device*, struct devfreq*)'
  'int devm_extcon_register_notifier(struct device*, struct extcon_dev*, unsigned int, struct notifier_block*)'
  'struct gpio_desc* devm_gpiod_get_index_optional(struct device*, const char*, unsigned int, enum gpiod_flags)'
  'int devm_hwspin_lock_unregister(struct device*, struct hwspinlock_device*)'
  'struct mii_bus* devm_mdiobus_alloc_size(struct device*, int)'
  'void drm_atomic_state_default_clear(struct drm_atomic_state*)'
  'void drm_display_mode_from_videomode(const struct videomode*, struct drm_display_mode*)'
  'void end_page_writeback(struct page*)'
  'int eth_platform_get_mac_address(struct device*, u8*)'
  'void ftrace_dump(enum ftrace_dump_mode)'
  'void* gen_pool_dma_alloc(struct gen_pool*, size_t, dma_addr_t*)'
  'struct gen_pool* gen_pool_get(struct device*, const char*)'
  'int generic_error_remove_page(struct address_space*, struct page*)'
  'void gov_update_cpu_data(struct dbs_data*)'
  'struct gpio_chip* gpiochip_find(void*, int(*)(struct gpio_chip*, void*))'
  'int gpiod_is_active_low(const struct gpio_desc*)'
  'int idr_alloc_u32(struct idr*, void*, u32*, unsigned long, gfp_t)'
  'void* idr_get_next_ul(struct idr*, unsigned long*)'

Bug: 293831482
Change-Id: Icc54949b24588b4d3e2ef59783b494bf3cd682c0
Signed-off-by: Lecopzer Chen <lecopzer.chen@mediatek.com>
2023-08-09 17:02:02 +00:00
Lecopzer Chen
663ca511e8 ANDROID: GKI: Add mtktv ABI symbol list, net, eth, regulator and pinmux
36 function symbol(s) added
  'void net_selftest(struct net_device*, struct ethtool_test*, u64*)'
  'int net_selftest_get_count()'
  'void net_selftest_get_strings(u8*)'
  'struct thermal_cooling_device* of_cpufreq_cooling_register(struct cpufreq_policy*)'
  'void path_put(const struct path*)'
  'ssize_t perf_event_sysfs_show(struct device*, struct device_attribute*, char*)'
  'struct phy_device* phy_connect(struct net_device*, const char*, void(*)(struct net_device*), phy_interface_t)'
  'void phy_disconnect(struct phy_device*)'
  'int phy_do_ioctl_running(struct net_device*, struct ifreq*, int)'
  'int phy_ethtool_get_link_ksettings(struct net_device*, struct ethtool_link_ksettings*)'
  'int phy_ethtool_nway_reset(struct net_device*)'
  'int phy_ethtool_set_link_ksettings(struct net_device*, const struct ethtool_link_ksettings*)'
  'void phy_start(struct phy_device*)'
  'void phy_stop(struct phy_device*)'
  'int phy_suspend(struct phy_device*)'
  'pid_t pid_vnr(struct pid*)'
  'void pinconf_generic_dump_config(struct pinctrl_dev*, struct seq_file*, unsigned long)'
  'int pinctrl_count_index_with_args(const struct device_node*, const char*)'
  'int pinctrl_generic_add_group(struct pinctrl_dev*, const char*, int*, int, void*)'
  'int pinctrl_generic_get_group_count(struct pinctrl_dev*)'
  'const char* pinctrl_generic_get_group_name(struct pinctrl_dev*, unsigned int)'
  'int pinctrl_generic_get_group_pins(struct pinctrl_dev*, unsigned int, const unsigned int**, unsigned int*)'
  'int pinctrl_generic_remove_group(struct pinctrl_dev*, unsigned int)'
  'int pinctrl_parse_index_with_args(const struct device_node*, const char*, int, struct of_phandle_args*)'
  'int pinctrl_register_and_init(struct pinctrl_desc*, struct device*, void*, struct pinctrl_dev**)'
  'int pinmux_generic_add_function(struct pinctrl_dev*, const char*, const char**, unsigned int, void*)'
  'struct function_desc* pinmux_generic_get_function(struct pinctrl_dev*, unsigned int)'
  'int pinmux_generic_get_function_count(struct pinctrl_dev*)'
  'int pinmux_generic_get_function_groups(struct pinctrl_dev*, unsigned int, const char* const**, unsigned int*)'
  'const char* pinmux_generic_get_function_name(struct pinctrl_dev*, unsigned int)'
  'int pinmux_generic_remove_function(struct pinctrl_dev*, unsigned int)'
  'void proc_set_user(struct proc_dir_entry*, kuid_t, kgid_t)'
  'int regulator_set_mode(struct regulator*, unsigned int)'
  'int regulator_set_voltage_time(struct regulator*, int, int)'
  'int sb_min_blocksize(struct super_block*, int)'
  'int schedule_hrtimeout(ktime_t*, enum hrtimer_mode)'

Bug: 293831482
Change-Id: I83226962af59b23418594dbc4ca816f9a0456b45
Signed-off-by: Lecopzer Chen <lecopzer.chen@mediatek.com>
2023-08-09 17:02:02 +00:00
Lecopzer Chen
99c011c37d ANDROID: GKI: Add mtktv ABI symbol list, pwm, serial and snd
22 function symbol(s) added
  'void pwm_free(struct pwm_device*)'
  'struct pwm_device* pwm_request(int, const char*)'
  'void serial8250_do_pm(struct uart_port*, unsigned int, unsigned int)'
  'void serial8250_do_set_termios(struct uart_port*, struct ktermios*, struct ktermios*)'
  'void serial8250_do_shutdown(struct uart_port*)'
  'int serial8250_do_startup(struct uart_port*)'
  'struct uart_8250_port* serial8250_get_port(int)'
  'unsigned int serial8250_modem_status(struct uart_8250_port*)'
  'int serial8250_register_8250_port(const struct uart_8250_port*)'
  'void serial8250_resume_port(int)'
  'void serial8250_rpm_get(struct uart_8250_port*)'
  'void serial8250_rpm_put(struct uart_8250_port*)'
  'void serial8250_rpm_put_tx(struct uart_8250_port*)'
  'unsigned char serial8250_rx_chars(struct uart_8250_port*, unsigned char)'
  'void serial8250_suspend_port(int)'
  'void serial8250_tx_chars(struct uart_8250_port*)'
  'void serial8250_unregister_port(int)'
  'bool sk_capable(const struct sock*, int)'
  'int snd_compress_new(struct snd_card*, int, int, const char*, struct snd_compr*)'
  'struct snd_kcontrol* snd_ctl_find_id(struct snd_card*, struct snd_ctl_elem_id*)'
  'int snd_pcm_format_big_endian(snd_pcm_format_t)'
  'const char* snd_pcm_format_name(snd_pcm_format_t)'

Bug: 293831482
Change-Id: I4b664a3b232f0a038ed59ec523f09eab3e3506cc
Signed-off-by: Lecopzer Chen <lecopzer.chen@mediatek.com>
2023-08-09 17:02:02 +00:00