Commit Graph

988235 Commits

Author SHA1 Message Date
Greg Kroah-Hartman
ee8877df71 Revert "tcp: ensure to use the most recently sent skb when filling the rate sample"
This reverts commit 3c464db03c which is
commit b253a0680c upstream.

It breaks the abi and is not needed for Android systems, so revert it.

Bug: 161946584
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I6c40e8900bcc80b03e3d5fb2c99c9e95615b81ff
2022-05-13 11:16:23 +02:00
Greg Kroah-Hartman
6273d79c86 Merge 5.10.114 into android12-5.10-lts
Changes in 5.10.114
	floppy: disable FDRAWCMD by default
	lightnvm: disable the subsystem
	usb: mtu3: fix USB 3.0 dual-role-switch from device to host
	USB: quirks: add a Realtek card reader
	USB: quirks: add STRING quirk for VCOM device
	USB: serial: whiteheat: fix heap overflow in WHITEHEAT_GET_DTR_RTS
	USB: serial: cp210x: add PIDs for Kamstrup USB Meter Reader
	USB: serial: option: add support for Cinterion MV32-WA/MV32-WB
	USB: serial: option: add Telit 0x1057, 0x1058, 0x1075 compositions
	xhci: Enable runtime PM on second Alderlake controller
	xhci: stop polling roothubs after shutdown
	xhci: increase usb U3 -> U0 link resume timeout from 100ms to 500ms
	iio: dac: ad5592r: Fix the missing return value.
	iio: dac: ad5446: Fix read_raw not returning set value
	iio: magnetometer: ak8975: Fix the error handling in ak8975_power_on()
	iio: imu: inv_icm42600: Fix I2C init possible nack
	usb: misc: fix improper handling of refcount in uss720_probe()
	usb: typec: ucsi: Fix reuse of completion structure
	usb: typec: ucsi: Fix role swapping
	usb: gadget: uvc: Fix crash when encoding data for usb request
	usb: gadget: configfs: clear deactivation flag in configfs_composite_unbind()
	usb: dwc3: Try usb-role-switch first in dwc3_drd_init
	usb: dwc3: core: Fix tx/rx threshold settings
	usb: dwc3: core: Only handle soft-reset in DCTL
	usb: dwc3: gadget: Return proper request status
	usb: cdns3: Fix issue for clear halt endpoint
	usb: phy: generic: Get the vbus supply
	serial: imx: fix overrun interrupts in DMA mode
	serial: 8250: Also set sticky MCR bits in console restoration
	serial: 8250: Correct the clock for EndRun PTP/1588 PCIe device
	arch_topology: Do not set llc_sibling if llc_id is invalid
	pinctrl: samsung: fix missing GPIOLIB on ARM64 Exynos config
	hex2bin: make the function hex_to_bin constant-time
	hex2bin: fix access beyond string end
	riscv: patch_text: Fixup last cpu should be master
	x86/pci/xen: Disable PCI/MSI[-X] masking for XEN_HVM guests
	iocost: don't reset the inuse weight of under-weighted debtors
	video: fbdev: udlfb: properly check endpoint type
	arm64: dts: meson: remove CPU opps below 1GHz for G12B boards
	arm64: dts: meson: remove CPU opps below 1GHz for SM1 boards
	iio:imu:bmi160: disable regulator in error path
	mtd: rawnand: fix ecc parameters for mt7622
	USB: Fix xhci event ring dequeue pointer ERDP update issue
	ARM: dts: imx6qdl-apalis: Fix sgtl5000 detection issue
	phy: samsung: Fix missing of_node_put() in exynos_sata_phy_probe
	phy: samsung: exynos5250-sata: fix missing device put in probe error paths
	ARM: OMAP2+: Fix refcount leak in omap_gic_of_init
	bus: ti-sysc: Make omap3 gpt12 quirk handling SoC specific
	phy: ti: omap-usb2: Fix error handling in omap_usb2_enable_clocks
	ARM: dts: at91: Map MCLK for wm8731 on at91sam9g20ek
	ARM: dts: at91: sama5d4_xplained: fix pinctrl phandle name
	phy: mapphone-mdm6600: Fix PM error handling in phy_mdm6600_probe
	phy: ti: Add missing pm_runtime_disable() in serdes_am654_probe
	ARM: dts: Fix mmc order for omap3-gta04
	ARM: dts: am3517-evm: Fix misc pinmuxing
	ARM: dts: logicpd-som-lv: Fix wrong pinmuxing on OMAP35
	ipvs: correctly print the memory size of ip_vs_conn_tab
	pinctrl: mediatek: moore: Fix build error
	mtd: rawnand: Fix return value check of wait_for_completion_timeout
	mtd: fix 'part' field data corruption in mtd_info
	pinctrl: stm32: Do not call stm32_gpio_get() for edge triggered IRQs in EOI
	memory: renesas-rpc-if: Fix HF/OSPI data transfer in Manual Mode
	net: dsa: Add missing of_node_put() in dsa_port_link_register_of
	netfilter: nft_set_rbtree: overlap detection with element re-addition after deletion
	bpf, lwt: Fix crash when using bpf_skb_set_tunnel_key() from bpf_xmit lwt hook
	pinctrl: rockchip: fix RK3308 pinmux bits
	tcp: md5: incorrect tcp_header_len for incoming connections
	pinctrl: stm32: Keep pinctrl block clock enabled when LEVEL IRQ requested
	tcp: ensure to use the most recently sent skb when filling the rate sample
	wireguard: device: check for metadata_dst with skb_valid_dst()
	sctp: check asoc strreset_chunk in sctp_generate_reconf_event
	ARM: dts: imx6ull-colibri: fix vqmmc regulator
	arm64: dts: imx8mn-ddr4-evk: Describe the 32.768 kHz PMIC clock
	pinctrl: pistachio: fix use of irq_of_parse_and_map()
	cpufreq: fix memory leak in sun50i_cpufreq_nvmem_probe
	net: hns3: modify the return code of hclge_get_ring_chain_from_mbx
	net: hns3: add validity check for message data length
	net: hns3: add return value for mailbox handling in PF
	net/smc: sync err code when tcp connection was refused
	ip_gre: Make o_seqno start from 0 in native mode
	ip6_gre: Make o_seqno start from 0 in native mode
	ip_gre, ip6_gre: Fix race condition on o_seqno in collect_md mode
	tcp: fix potential xmit stalls caused by TCP_NOTSENT_LOWAT
	tcp: make sure treq->af_specific is initialized
	bus: sunxi-rsb: Fix the return value of sunxi_rsb_device_create()
	clk: sunxi: sun9i-mmc: check return value after calling platform_get_resource()
	net: bcmgenet: hide status block before TX timestamping
	net: phy: marvell10g: fix return value on error
	net: dsa: lantiq_gswip: Don't set GSWIP_MII_CFG_RMII_CLK
	drm/amdkfd: Fix GWS queue count
	drm/amd/display: Fix memory leak in dcn21_clock_source_create
	tls: Skip tls_append_frag on zero copy size
	bnx2x: fix napi API usage sequence
	net: fec: add missing of_node_put() in fec_enet_init_stop_mode()
	ixgbe: ensure IPsec VF<->PF compatibility
	ibmvnic: fix miscellaneous checks
	Revert "ibmvnic: Add ethtool private flag for driver-defined queue limits"
	tcp: fix F-RTO may not work correctly when receiving DSACK
	ASoC: Intel: soc-acpi: correct device endpoints for max98373
	ASoC: wm8731: Disable the regulator when probing fails
	ext4: fix bug_on in start_this_handle during umount filesystem
	x86: __memcpy_flushcache: fix wrong alignment if size > 2^32
	cifs: destage any unwritten data to the server before calling copychunk_write
	drivers: net: hippi: Fix deadlock in rr_close()
	powerpc/perf: Fix 32bit compile
	zonefs: Fix management of open zones
	zonefs: Clear inode information flags on inode creation
	kasan: prevent cpu_quarantine corruption when CPU offline and cache shrink occur at same time
	drm/i915: Fix SEL_FETCH_PLANE_*(PIPE_B+) register addresses
	net: ethernet: stmmac: fix write to sgmii_adapter_base
	thermal: int340x: Fix attr.show callback prototype
	x86/cpu: Load microcode during restore_processor_state()
	perf symbol: Pass is_kallsyms to symbols__fixup_end()
	perf symbol: Update symbols__fixup_end()
	tty: n_gsm: fix restart handling via CLD command
	tty: n_gsm: fix decoupled mux resource
	tty: n_gsm: fix mux cleanup after unregister tty device
	tty: n_gsm: fix wrong signal octet encoding in convergence layer type 2
	tty: n_gsm: fix malformed counter for out of frame data
	netfilter: nft_socket: only do sk lookups when indev is available
	tty: n_gsm: fix insufficient txframe size
	tty: n_gsm: fix wrong DLCI release order
	tty: n_gsm: fix missing explicit ldisc flush
	tty: n_gsm: fix wrong command retry handling
	tty: n_gsm: fix wrong command frame length field encoding
	tty: n_gsm: fix reset fifo race condition
	tty: n_gsm: fix incorrect UA handling
	tty: n_gsm: fix software flow control handling
	perf symbol: Remove arch__symbols__fixup_end()
	Linux 5.10.114

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I5bae5ef7c58046213b62c82599707f569a955337
2022-05-12 17:48:27 +02:00
Greg Kroah-Hartman
681997eca1 Revert "ipv6: make ip6_rt_gc_expire an atomic_t"
This reverts commit 49516e6ed9 which is
commit 9cb7c01342 upstream.

It breaks the Android KABI and is not needed in Android devices, so just
revert it.

Bug: 161946584
Fixes: 49516e6ed9 ("ipv6: make ip6_rt_gc_expire an atomic_t")
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ibab89760234525cc5622cd60e61599784fd0f80a
2022-05-12 12:04:12 +02:00
Greg Kroah-Hartman
141fbd343b Revert "oom_kill.c: futex: delay the OOM reaper to allow time for proper futex cleanup"
This reverts commit ed5d4efb4d which is
commit e4a38402c3 upstream.

It breaks the kernel ABI and should not be an issue for Android at this
point in time.  If it is, it can come back in a different, abi-stable
form.

Bug: 161946584
Fixes: ed5d4efb4d ("oom_kill.c: futex: delay the OOM reaper to allow time for proper futex cleanup")
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I729614c373a7b28546376913e719bbaf6dd306a9
2022-05-12 12:03:58 +02:00
Greg Kroah-Hartman
ca9b002a16 Merge 5.10.113 into android12-5.10-lts
Changes in 5.10.113
	etherdevice: Adjust ether_addr* prototypes to silence -Wstringop-overead
	mm: page_alloc: fix building error on -Werror=array-compare
	tracing: Dump stacktrace trigger to the corresponding instance
	perf tools: Fix segfault accessing sample_id xyarray
	gfs2: assign rgrp glock before compute_bitstructs
	net/sched: cls_u32: fix netns refcount changes in u32_change()
	ALSA: usb-audio: Clear MIDI port active flag after draining
	ALSA: hda/realtek: Add quirk for Clevo NP70PNP
	dm: fix mempool NULL pointer race when completing IO
	ASoC: atmel: Remove system clock tree configuration for at91sam9g20ek
	ASoC: msm8916-wcd-digital: Check failure for devm_snd_soc_register_component
	ASoC: codecs: wcd934x: do not switch off SIDO Buck when codec is in use
	dmaengine: imx-sdma: Fix error checking in sdma_event_remap
	dmaengine: mediatek:Fix PM usage reference leak of mtk_uart_apdma_alloc_chan_resources
	spi: spi-mtk-nor: initialize spi controller after resume
	esp: limit skb_page_frag_refill use to a single page
	igc: Fix infinite loop in release_swfw_sync
	igc: Fix BUG: scheduling while atomic
	rxrpc: Restore removed timer deletion
	net/smc: Fix sock leak when release after smc_shutdown()
	net/packet: fix packet_sock xmit return value checking
	ip6_gre: Avoid updating tunnel->tun_hlen in __gre6_xmit()
	ip6_gre: Fix skb_under_panic in __gre6_xmit()
	net/sched: cls_u32: fix possible leak in u32_init_knode()
	l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upper_dev_get_rcu
	ipv6: make ip6_rt_gc_expire an atomic_t
	netlink: reset network and mac headers in netlink_dump()
	net: stmmac: Use readl_poll_timeout_atomic() in atomic state
	dmaengine: idxd: add RO check for wq max_batch_size write
	dmaengine: idxd: add RO check for wq max_transfer_size write
	selftests: mlxsw: vxlan_flooding: Prevent flooding of unwanted packets
	arm64/mm: Remove [PUD|PMD]_TABLE_BIT from [pud|pmd]_bad()
	arm64: mm: fix p?d_leaf()
	ARM: vexpress/spc: Avoid negative array index when !SMP
	reset: tegra-bpmp: Restore Handle errors in BPMP response
	platform/x86: samsung-laptop: Fix an unsigned comparison which can never be negative
	ALSA: usb-audio: Fix undefined behavior due to shift overflowing the constant
	arm64: dts: imx: Fix imx8*-var-som touchscreen property sizes
	vxlan: fix error return code in vxlan_fdb_append
	cifs: Check the IOCB_DIRECT flag, not O_DIRECT
	net: atlantic: Avoid out-of-bounds indexing
	mt76: Fix undefined behavior due to shift overflowing the constant
	brcmfmac: sdio: Fix undefined behavior due to shift overflowing the constant
	dpaa_eth: Fix missing of_node_put in dpaa_get_ts_info()
	drm/msm/mdp5: check the return of kzalloc()
	net: macb: Restart tx only if queue pointer is lagging
	scsi: qedi: Fix failed disconnect handling
	stat: fix inconsistency between struct stat and struct compat_stat
	nvme: add a quirk to disable namespace identifiers
	nvme-pci: disable namespace identifiers for Qemu controllers
	EDAC/synopsys: Read the error count from the correct register
	mm, hugetlb: allow for "high" userspace addresses
	oom_kill.c: futex: delay the OOM reaper to allow time for proper futex cleanup
	mm/mmu_notifier.c: fix race in mmu_interval_notifier_remove()
	ata: pata_marvell: Check the 'bmdma_addr' beforing reading
	dma: at_xdmac: fix a missing check on list iterator
	net: atlantic: invert deep par in pm functions, preventing null derefs
	xtensa: patch_text: Fixup last cpu should be master
	xtensa: fix a7 clobbering in coprocessor context load/store
	openvswitch: fix OOB access in reserve_sfa_size()
	gpio: Request interrupts after IRQ is initialized
	ASoC: soc-dapm: fix two incorrect uses of list iterator
	e1000e: Fix possible overflow in LTR decoding
	ARC: entry: fix syscall_trace_exit argument
	arm_pmu: Validate single/group leader events
	sched/pelt: Fix attach_entity_load_avg() corner case
	perf/core: Fix perf_mmap fail when CONFIG_PERF_USE_VMALLOC enabled
	drm/panel/raspberrypi-touchscreen: Avoid NULL deref if not initialised
	drm/panel/raspberrypi-touchscreen: Initialise the bridge in prepare
	KVM: PPC: Fix TCE handling for VFIO
	drm/vc4: Use pm_runtime_resume_and_get to fix pm_runtime_get_sync() usage
	powerpc/perf: Fix power9 event alternatives
	perf report: Set PERF_SAMPLE_DATA_SRC bit for Arm SPE event
	ext4: fix fallocate to use file_modified to update permissions consistently
	ext4: fix symlink file size not match to file content
	ext4: fix use-after-free in ext4_search_dir
	ext4: limit length to bitmap_maxbytes - blocksize in punch_hole
	ext4, doc: fix incorrect h_reserved size
	ext4: fix overhead calculation to account for the reserved gdt blocks
	ext4: force overhead calculation if the s_overhead_cluster makes no sense
	can: isotp: stop timeout monitoring when no first frame was sent
	jbd2: fix a potential race while discarding reserved buffers after an abort
	spi: atmel-quadspi: Fix the buswidth adjustment between spi-mem and controller
	staging: ion: Prevent incorrect reference counting behavour
	block/compat_ioctl: fix range check in BLKGETSIZE
	Revert "net: micrel: fix KS8851_MLL Kconfig"
	Linux 5.10.113

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I4ed10699cbb32b89caf79b8b4a2a35b3d8824115
2022-05-12 11:23:35 +02:00
Greg Kroah-Hartman
f64cd19a00 Merge branch 'android12-5.10' into android12-5.10-lts
Sync up with android12-5.10 for the following commits:

503435dc8c FROMGIT: usb: gadget: uvc: allow for application to cleanly shutdown
3736ae703b FROMGIT: usb: dwc3: gadget: increase tx fifo size for ss isoc endpoints
300cec3502 UPSTREAM: usb: gadget: configfs: clear deactivation flag in configfs_composite_unbind()
a35bc53848 FROMGIT: usb: gadget: uvc: remove pause flag use
36aa07174b FROMGIT: usb: gadget: uvc: allow changing interface name via configfs
74b55107d0 UPSTREAM: usb: gadget: uvc: Fix crash when encoding data for usb request
53129aceec UPSTREAM: usb: gadget: uvc: test if ep->desc is valid on ep_queue
23cca7ad30 UPSTREAM: usb: gadget: uvc: only pump video data if necessary
6692312df6 UPSTREAM: usb: gadget: uvc: only schedule stream in streaming state
1c14550b60 UPSTREAM: usb: dwc3: gadget: Give some time to schedule isoc
5d084e9710 UPSTREAM: usb: gadget: uvc: make uvc_num_requests depend on gadget speed
15a663ebbe UPSTREAM: usb: gadget: composite: Show warning if function driver's descriptors are incomplete.
3172c95582 FROMLIST: kbuild: Add environment variables for userprogs flags
a07b60e85c ANDROID: dm-bow: Protect Ranges fetched and erased from the RB tree
0d752f78b2 BACKPORT: staging: ion: Prevent incorrect reference counting behavour
1e037dd790 FROMGIT: net: fix wrong network header length
a37eec78a6 UPSTREAM: mm: fix unexpected zeroed page mapping with zram swap
2f55d5cbe2 ANDROID: vendor_hooks: Add hooks for mutex
0780756946 UPSTREAM: usb: dwc3: gadget: Replace list_for_each_entry_safe() if using giveback
1a73ed4b2e UPSTREAM: usb: dwc3: Issue core soft reset before enabling run/stop
fe513e1c26 UPSTREAM: usb: dwc3: gadget: Wait for ep0 xfers to complete during dequeue
75059d208e ANDROID: Update QCOM symbol list for trace_map/unmap
7c9d15f68b ANDROID: fix KCFLAGS override by __ANDROID_COMMON_KERNEL__
e5b4949bfc ANDROID: vendor_hooks: tune reclaim scan type for specified mem_cgroup
eb80a7e84f ANDROID: vendor_hooks: Add hooks for rwsem
5558db2674 ANDROID: Add flag to indicate compiling against ACK
bb18f818ee ANDROID: GKI: build damon reclaim
0453acd7fb FROMLIST: mm/damon/reclaim: Fix the timer always stays active
2522f6c4da BACKPORT: treewide: Add missing includes masked by cgroup -> bpf dependency
70ff0aeea7 UPSTREAM: mm/damon: modify damon_rand() macro to static inline function
3ecd29b57b UPSTREAM: mm/damon: add 'age' of region tracepoint support
94006b8a3a UPSTREAM: mm/damon: hide kernel pointer from tracepoint event
4c350065aa UPSTREAM: mm/damon/vaddr: hide kernel pointer from damon_va_three_regions() failure log
c44028a162 UPSTREAM: mm/damon/vaddr: use pr_debug() for damon_va_three_regions() failure logging
98dcd2427c UPSTREAM: mm/damon/dbgfs: remove an unnecessary variable
21dc18f9a0 UPSTREAM: mm/damon: move the implementation of damon_insert_region to damon.h
73faa856e9 UPSTREAM: mm/damon: add access checking for hugetlb pages
b0cf3ac6d3 UPSTREAM: mm/damon/dbgfs: support all DAMOS stats
1c400b8796 UPSTREAM: mm/damon/reclaim: provide reclamation statistics
f755f1a2bc UPSTREAM: mm/damon/schemes: account how many times quota limit has exceeded
7cecfab158 UPSTREAM: mm/damon/schemes: account scheme actions that successfully applied
943c0cd13f UPSTREAM: mm/damon: convert macro functions to static inline functions
947d088b1f UPSTREAM: mm/damon: move damon_rand() definition into damon.h
b45423116e UPSTREAM: mm/damon/schemes: add the validity judgment of thresholds
b198e86d5a UPSTREAM: mm/damon/vaddr: remove swap_ranges() and replace it with swap()
9a8de9c702 UPSTREAM: mm/damon: remove some unneeded function definitions in damon.h
07045a0e5a UPSTREAM: mm/damon/core: use abs() instead of diff_of()
8b02bed759 UPSTREAM: mm/damon: unified access_check function naming rules
d4d20c7ef5 UPSTREAM: mm/damon/dbgfs: fix 'struct pid' leaks in 'dbgfs_target_ids_write()'
c3939031fb UPSTREAM: mm/damon/dbgfs: protect targets destructions with kdamond_lock
82bb332bf0 UPSTREAM: mm/damon/vaddr-test: remove unnecessary variables
4f0e48e5e9 UPSTREAM: mm/damon/vaddr-test: split a test function having >1024 bytes frame size
90af7e344b UPSTREAM: mm/damon/vaddr: remove an unnecessary warning message
4e19846848 UPSTREAM: mm/damon/core: remove unnecessary error messages
a7969dac5a UPSTREAM: mm/damon/dbgfs: remove an unnecessary error message
f37ab7f595 UPSTREAM: mm/damon/core: use better timer mechanisms selection threshold
63e8bc85e6 UPSTREAM: mm/damon/core: fix fake load reports due to uninterruptible sleeps
a9ec7ed936 BACKPORT: timers: implement usleep_idle_range()
2581464867 UPSTREAM: mm/damon/dbgfs: fix missed use of damon_dbgfs_lock
dbbff9155c UPSTREAM: mm/damon/dbgfs: use '__GFP_NOWARN' for user-specified size buffer allocation
55a2d2f5a7 UPSTREAM: mm/damon: remove return value from before_terminate callback
b48f28f49c UPSTREAM: mm/damon: fix a few spelling mistakes in comments and a pr_debug message
bb15a07842 UPSTREAM: mm/damon: simplify stop mechanism
f1456aa48d UPSTREAM: mm/damon/dbgfs: add adaptive_targets list check before enable monitor_on
8c2db14f3f UPSTREAM: mm/damon: remove unnecessary variable initialization
4d321b786f UPSTREAM: mm/damon: introduce DAMON-based Reclamation (DAMON_RECLAIM)
57b0fb6229 UPSTREAM: selftests/damon: support watermarks
88d44101df UPSTREAM: mm/damon/dbgfs: support watermarks
fb7d5f3b1a UPSTREAM: mm/damon/schemes: activate schemes based on a watermarks mechanism
d4ba5298be UPSTREAM: tools/selftests/damon: update for regions prioritization of schemes
eb9cf87aa8 UPSTREAM: mm/damon/dbgfs: support prioritization weights
798e889699 UPSTREAM: mm/damon/vaddr,paddr: support pageout prioritization
dd1947047e UPSTREAM: mm/damon/schemes: prioritize regions within the quotas
1990bcb746 UPSTREAM: mm/damon/selftests: support schemes quotas
8c491daa0f UPSTREAM: mm/damon/dbgfs: support quotas of schemes
2c090a6bc6 UPSTREAM: mm/damon/schemes: implement time quota
8c0c30e2f0 UPSTREAM: mm/damon/schemes: skip already charged targets and regions
a9af0008be UPSTREAM: mm/damon/schemes: implement size quota for schemes application speed control
780cd6f930 UPSTREAM: mm/damon/paddr: support the pageout scheme
71a23818ca UPSTREAM: mm/damon/dbgfs: remove unnecessary variables
1d68b96800 UPSTREAM: mm/damon/vaddr: constify static mm_walk_ops
932c8c61e1 UPSTREAM: mm/damon/dbgfs: support physical memory monitoring
f348ba2256 UPSTREAM: mm/damon: implement primitives for physical address space monitoring
3c4a2c1428 UPSTREAM: mm/damon/vaddr: separate commonly usable functions
c7f64c7f78 UPSTREAM: mm/damon/dbgfs-test: add a unit test case for 'init_regions'
27b2b8d255 UPSTREAM: mm/damon/dbgfs: allow users to set initial monitoring target regions
cc2e33ff7c UPSTREAM: selftests/damon: add 'schemes' debugfs tests
ef678357b3 UPSTREAM: mm/damon/schemes: implement statistics feature
5203491dbb UPSTREAM: mm/damon/dbgfs: support DAMON-based Operation Schemes
cad23cd779 UPSTREAM: mm/damon/vaddr: support DAMON-based Operation Schemes
2a437378a5 UPSTREAM: mm/damon/core: implement DAMON-based Operation Schemes (DAMOS)
3d9ce6d28b UPSTREAM: mm/damon/core: account age of target regions
b1209ff347 UPSTREAM: mm/damon/core: nullify pointer ctx->kdamond with a NULL
e0fad2fbbe UPSTREAM: mm/damon: needn't hold kdamond_lock to print pid of kdamond
bcf5bbcaf4 UPSTREAM: mm/damon: remove unnecessary do_exit() from kdamond
526b5029ad UPSTREAM: mm/damon/core: print kdamond start log in debug mode only
6239bbbcea UPSTREAM: include/linux/damon.h: fix kernel-doc comments for 'damon_callback'
8c5ef4d641 UPSTREAM: mm/damon: grammar s/works/work/
e31da16e69 UPSTREAM: mm/damon/core-test: fix wrong expectations for 'damon_split_regions_of()'
b25e76d9c3 UPSTREAM: mm/damon: don't use strnlen() with known-bogus source length
c1a4fca349 UPSTREAM: mm/damon: add kunit tests
b5131d9c10 UPSTREAM: mm/damon: add user space selftests
fe62a24792 UPSTREAM: mm/damon/dbgfs: support multiple contexts
562b676ce9 UPSTREAM: mm/damon/dbgfs: export kdamond pid to the user space
c10dc7808e UPSTREAM: mm/damon: implement a debugfs-based user space interface
3ea808dca1 UPSTREAM: mm/damon: add a tracepoint
2afdd88030 UPSTREAM: mm/damon: implement primitives for the virtual memory address spaces
75e13bad97 UPSTREAM: mm/idle_page_tracking: make PG_idle reusable
0f1bc2a61d UPSTREAM: mm/damon: adaptively adjust regions
488e19fc91 UPSTREAM: mm/damon/core: implement region-based sampling
bc19dd9a51 UPSTREAM: mm: introduce Data Access MONitor (DAMON)
35a697cab4 BACKPORT: net/packet: fix slab-out-of-bounds access in packet_recvmsg()
24d464d38b BACKPORT: fuse: fix pipe buffer lifetime for direct_io
2e3c211e7e BACKPORT: dm: fix NULL pointer issue when free bio
aed2e27d51 UPSTREAM: kfence, x86: fix preemptible warning on KPTI-enabled systems
e0513ed978 ANDROID: ABI: Update allowed list for galaxy
6ed058a9bf ANDROID: abi_gki_aarch64.xml: update based on proper LTO=full setting
46f414b1c2 BACKPORT: virtio-blk: Use blk_validate_block_size() to validate block size
f06daa5a0b ANDROID: add for tuning readahead size
6def3a5ed8 BACKPORT: media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across ioctls
31beefbf14 BACKPORT: nl80211: correctly check NL80211_ATTR_REG_ALPHA2 size
b07625698e BACKPORT: ext4: don't BUG if someone dirty pages without asking ext4 first
3628acf6b8 ANDROID: GKI: Update symbols to abi_gki_aarch64_oplus
b8bb3b43a4 BACKPORT: iommu: Extend mutex lock scope in iommu_probe_device()
00f2b55cc4 BACKPORT: iommu: Fix race condition during default domain allocation
0dcfc2c036 ANDROID: GKI: Update symbols to symbol list
9608dc38a0 FROMLIST: remoteproc: Use unbounded workqueue for recovery work
b5bcf0d667 UPSTREAM: xfrm: fix tunnel model fragmentation behavior
20e11d7969 ANDROID: GKI: Enable CRYPTO_DES
eff1ffbf0c ANDROID: GKI: set more vfs-only exports into their own namespace
3c06a5ce5e ANDROID: Split ANDROID_STRUCT_PADDING into separate configs
5b1bb43708 ANDROID: selftests: incfs: skip large_file_test test is not enough free space
3b25a439ce ANDROID: selftests: incfs: Add -fno-omit-frame-pointer
3e45af8a72 ANDROID: incremental-fs: limit mount stack depth
d8fade2b40 ANDROID: GKI: Update symbols to abi_gki_aarch64_oplus
ceb6918d1d ANDROID: vendor_hooks: Reduce pointless modversions CRC churn
002528dfb5 UPSTREAM: locking/lockdep: Avoid potential access of invalid memory in lock_class
404df4751a ANDROID: mm: Fix implicit declaration of function 'isolate_lru_page'
e2c0e8502e ANDROID: GKI: Update symbols to symbol list
51513a1775 ANDROID: GKI: Update symbols to symbol list
7b7125914c ANDROID: GKI: Add hook symbol to symbol list
7a7eadac58 Revert "ANDROID: dm-bow: Protect Ranges fetched and erased from the RB tree"
cb7c1a4c78 ANDROID: vendor_hooks: Add hooks to for free_unref_page_commit
a2485b8abd ANDROID: vendor_hooks: Add hooks to for alloc_contig_range
bc159fee3d ANDROID: GKI: Update symbols to symbol list
95380146ce ANDROID: vendor_hooks: Add hook in shrink_node_memcgs
a3f112353c ANDROID: GKI: Add symbols to symbol list
ec48b1892e FROMGIT: iommu/iova: Improve 32-bit free space estimate
d9845e9e5c ANDROID: export walk_page_range and swp_swap_info
71d560e017 ANDROID: vendor_hooks: export shrink_slab
74720dae8b ANDROID: usb: gadget: f_accessory: add compat_ioctl support
e7f39d0aa2 UPSTREAM: sr9700: sanity check for packet length
6282531a84 UPSTREAM: io_uring: return back safer resurrect
87c1f135bf UPSTREAM: Revert "xfrm: state and policy should fail if XFRMA_IF_ID 0"
ff0000fe82 UPSTREAM: usb: gadget: don't release an existing dev->buf
590a98d5d1 UPSTREAM: usb: gadget: clear related members when goto fail

Update the abi.xml file with the following addtions that are now being
tracked:

Leaf changes summary: 184 artifacts changed
Changed leaf types summary: 0 leaf type changed
Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 178 Added functions
Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 6 Added variables

178 Added functions:

  [A] 'function int __cleancache_get_page(page*)'
  [A] 'function int __dquot_alloc_space(inode*, qsize_t, int)'
  [A] 'function void __dquot_free_space(inode*, qsize_t, int)'
  [A] 'function int __dquot_transfer(inode*, dquot**)'
  [A] 'function int __fscrypt_encrypt_symlink(inode*, const char*, unsigned int, fscrypt_str*)'
  [A] 'function bool __fscrypt_inode_uses_inline_crypto(const inode*)'
  [A] 'function int __fscrypt_prepare_link(inode*, inode*, dentry*)'
  [A] 'function int __fscrypt_prepare_lookup(inode*, dentry*, fscrypt_name*)'
  [A] 'function int __fscrypt_prepare_readdir(inode*)'
  [A] 'function int __fscrypt_prepare_rename(inode*, dentry*, inode*, dentry*, unsigned int)'
  [A] 'function int __fscrypt_prepare_setattr(dentry*, iattr*)'
  [A] 'function ssize_t __generic_file_write_iter(kiocb*, iov_iter*)'
  [A] 'function sock* __inet6_lookup_established(net*, inet_hashinfo*, const in6_addr*, const __be16, const in6_addr*, const u16, const int, const int)'
  [A] 'function sock* __inet_lookup_established(net*, inet_hashinfo*, const __be32, const __be16, const __be32, const u16, const int, const int)'
  [A] 'function unsigned long int __page_file_index(page*)'
  [A] 'function address_space* __page_file_mapping(page*)'
  [A] 'function int __percpu_counter_init(percpu_counter*, s64, gfp_t, lock_class_key*)'
  [A] 'function s64 __percpu_counter_sum(percpu_counter*)'
  [A] 'function int __traceiter_android_vh_cma_drain_all_pages_bypass(void*, unsigned int, bool*)'
  [A] 'function int __traceiter_android_vh_pcplist_add_cma_pages_bypass(void*, int, bool*)'
  [A] 'function int __traceiter_android_vh_shrink_node_memcgs(void*, mem_cgroup*, bool*)'
  [A] 'function int __traceiter_map(void*, unsigned long int, phys_addr_t, size_t)'
  [A] 'function int __traceiter_unmap(void*, unsigned long int, size_t, size_t)'
  [A] 'function void __xa_clear_mark(xarray*, unsigned long int, xa_mark_t)'
  [A] 'function int add_swap_extent(swap_info_struct*, unsigned long int, unsigned long int, sector_t)'
  [A] 'function int add_to_page_cache_lru(page*, address_space*, unsigned long int, gfp_t)'
  [A] 'function void bio_associate_blkg_from_css(bio*, cgroup_subsys_state*)'
  [A] 'function const char* blk_op_str(unsigned int)'
  [A] 'function int blkdev_issue_zeroout(block_device*, sector_t, sector_t, gfp_t, unsigned int)'
  [A] 'function void clear_nlink(inode*)'
  [A] 'function long int congestion_wait(int, long int)'
  [A] 'function dentry* d_find_alias(inode*)'
  [A] 'function void d_instantiate_new(dentry*, inode*)'
  [A] 'function void d_invalidate(dentry*)'
  [A] 'function void d_tmpfile(dentry*, inode*)'
  [A] 'function char* dentry_path_raw(dentry*, char*, int)'
  [A] 'function dquot* dqget(super_block*, kqid)'
  [A] 'function void dqput(dquot*)'
  [A] 'function int dquot_acquire(dquot*)'
  [A] 'function dquot* dquot_alloc(super_block*, int)'
  [A] 'function int dquot_alloc_inode(inode*)'
  [A] 'function int dquot_claim_space_nodirty(inode*, qsize_t)'
  [A] 'function int dquot_commit(dquot*)'
  [A] 'function int dquot_commit_info(super_block*, int)'
  [A] 'function void dquot_destroy(dquot*)'
  [A] 'function int dquot_disable(super_block*, int, unsigned int)'
  [A] 'function void dquot_drop(inode*)'
  [A] 'function int dquot_file_open(inode*, file*)'
  [A] 'function void dquot_free_inode(inode*)'
  [A] 'function int dquot_get_dqblk(super_block*, kqid, qc_dqblk*)'
  [A] 'function int dquot_get_next_dqblk(super_block*, kqid*, qc_dqblk*)'
  [A] 'function int dquot_get_next_id(super_block*, kqid*)'
  [A] 'function int dquot_get_state(super_block*, qc_state*)'
  [A] 'function int dquot_initialize(inode*)'
  [A] 'function bool dquot_initialize_needed(inode*)'
  [A] 'function int dquot_load_quota_inode(inode*, int, int, unsigned int)'
  [A] 'function int dquot_mark_dquot_dirty(dquot*)'
  [A] 'function int dquot_quota_off(super_block*, int)'
  [A] 'function int dquot_quota_on(super_block*, int, int, const path*)'
  [A] 'function int dquot_quota_on_mount(super_block*, char*, int, int)'
  [A] 'function int dquot_release(dquot*)'
  [A] 'function int dquot_resume(super_block*, int)'
  [A] 'function int dquot_set_dqblk(super_block*, kqid, qc_dqblk*)'
  [A] 'function int dquot_set_dqinfo(super_block*, int, qc_info*)'
  [A] 'function int dquot_transfer(inode*, iattr*)'
  [A] 'function int dquot_writeback_dquots(super_block*, int)'
  [A] 'function void evict_inodes(super_block*)'
  [A] 'function bool filemap_allow_speculation()'
  [A] 'function int filemap_check_errors(address_space*)'
  [A] 'function vm_fault_t filemap_map_pages(vm_fault*, unsigned long int, unsigned long int)'
  [A] 'function inode* find_inode_nowait(super_block*, unsigned long int, int (inode*, unsigned long int, void*)*, void*)'
  [A] 'function int freeze_bdev(block_device*)'
  [A] 'function int freeze_super(super_block*)'
  [A] 'function void fscrypt_decrypt_bio(bio*)'
  [A] 'function bool fscrypt_dio_supported(kiocb*, iov_iter*)'
  [A] 'function int fscrypt_drop_inode(inode*)'
  [A] 'function page* fscrypt_encrypt_pagecache_blocks(page*, unsigned int, unsigned int, gfp_t)'
  [A] 'function int fscrypt_file_open(inode*, file*)'
  [A] 'function int fscrypt_fname_alloc_buffer(u32, fscrypt_str*)'
  [A] 'function int fscrypt_fname_disk_to_usr(const inode*, u32, u32, const fscrypt_str*, fscrypt_str*)'
  [A] 'function void fscrypt_fname_free_buffer(fscrypt_str*)'
  [A] 'function u64 fscrypt_fname_siphash(const inode*, const qstr*)'
  [A] 'function void fscrypt_free_bounce_page(page*)'
  [A] 'function void fscrypt_free_inode(inode*)'
  [A] 'function const char* fscrypt_get_symlink(inode*, void*, unsigned int, delayed_call*)'
  [A] 'function int fscrypt_has_permitted_context(inode*, inode*)'
  [A] 'function int fscrypt_ioctl_add_key(file*, void*)'
  [A] 'function int fscrypt_ioctl_get_key_status(file*, void*)'
  [A] 'function int fscrypt_ioctl_get_nonce(file*, void*)'
  [A] 'function int fscrypt_ioctl_get_policy(file*, void*)'
  [A] 'function int fscrypt_ioctl_get_policy_ex(file*, void*)'
  [A] 'function int fscrypt_ioctl_remove_key(file*, void*)'
  [A] 'function int fscrypt_ioctl_remove_key_all_users(file*, void*)'
  [A] 'function int fscrypt_ioctl_set_policy(file*, void*)'
  [A] 'function bool fscrypt_match_name(const fscrypt_name*, const u8*, u32)'
  [A] 'function bool fscrypt_mergeable_bio(bio*, const inode*, u64)'
  [A] 'function int fscrypt_prepare_new_inode(inode*, inode*, bool*)'
  [A] 'function int fscrypt_prepare_symlink(inode*, const char*, unsigned int, unsigned int, fscrypt_str*)'
  [A] 'function void fscrypt_put_encryption_info(inode*)'
  [A] 'function void fscrypt_set_bio_crypt_ctx(bio*, const inode*, u64, gfp_t)'
  [A] 'function int fscrypt_set_context(inode*, void*)'
  [A] 'function int fscrypt_set_test_dummy_encryption(super_block*, const char*, fscrypt_dummy_policy*)'
  [A] 'function int fscrypt_setup_filename(inode*, const qstr*, int, fscrypt_name*)'
  [A] 'function void fscrypt_show_test_dummy_encryption(seq_file*, char, super_block*)'
  [A] 'function int fscrypt_symlink_getattr(const path*, kstat*)'
  [A] 'function int fscrypt_zeroout_range(const inode*, unsigned long int, sector_t, unsigned int)'
  [A] 'function void fsverity_cleanup_inode(inode*)'
  [A] 'function void fsverity_enqueue_verify_work(work_struct*)'
  [A] 'function int fsverity_file_open(inode*, file*)'
  [A] 'function int fsverity_ioctl_enable(file*, void*)'
  [A] 'function int fsverity_ioctl_measure(file*, void*)'
  [A] 'function int fsverity_ioctl_read_metadata(file*, void*)'
  [A] 'function int fsverity_prepare_setattr(dentry*, iattr*)'
  [A] 'function void fsverity_verify_bio(bio*)'
  [A] 'function bool fsverity_verify_page(page*)'
  [A] 'function void generate_random_uuid(unsigned char*)'
  [A] 'function dentry* generic_fh_to_dentry(super_block*, fid*, int, int, inode* (super_block*, typedef u64, typedef u32)*)'
  [A] 'function dentry* generic_fh_to_parent(super_block*, fid*, int, int, inode* (super_block*, typedef u64, typedef u32)*)'
  [A] 'function loff_t generic_file_llseek_size(file*, loff_t, int, loff_t, loff_t)'
  [A] 'function void generic_set_encrypted_ci_d_ops(dentry*)'
  [A] 'function int gpiochip_irqchip_add_key(gpio_chip*, irq_chip*, unsigned int, irq_flow_handler_t, unsigned int, bool, lock_class_key*, lock_class_key*)'
  [A] 'function void gpiochip_set_nested_irqchip(gpio_chip*, irq_chip*, unsigned int)'
  [A] 'function usb_request* gs_alloc_req(usb_ep*, unsigned int, gfp_t)'
  [A] 'function void gs_free_req(usb_ep*, usb_request*)'
  [A] 'function void gserial_free_line(unsigned char)'
  [A] 'function void gserial_resume(gserial*)'
  [A] 'function void gserial_suspend(gserial*)'
  [A] 'function void iget_failed(inode*)'
  [A] 'function inode* iget_locked(super_block*, unsigned long int)'
  [A] 'function inode* ilookup(super_block*, unsigned long int)'
  [A] 'function void inode_nohighmem(inode*)'
  [A] 'function int insert_inode_locked(inode*)'
  [A] 'function int kset_register(kset*)'
  [A] 'function char* match_strdup(const substring_t*)'
  [A] 'function void migrate_page_copy(page*, page*)'
  [A] 'function int migrate_page_move_mapping(address_space*, page*, page*, int)'
  [A] 'function void migrate_page_states(page*, page*)'
  [A] 'function void page_cache_ra_unbounded(readahead_control*, unsigned long int, unsigned long int)'
  [A] 'function void page_cache_sync_ra(readahead_control*, file_ra_state*, unsigned long int)'
  [A] 'function const char* page_get_link(dentry*, inode*, delayed_call*)'
  [A] 'function int page_symlink(inode*, const char*, int)'
  [A] 'function int pagecache_write_begin(file*, address_space*, loff_t, unsigned int, unsigned int, page**, void**)'
  [A] 'function int pagecache_write_end(file*, address_space*, loff_t, unsigned int, unsigned int, page*, void*)'
  [A] 'function void percpu_counter_add_batch(percpu_counter*, s64, s32)'
  [A] 'function void percpu_counter_destroy(percpu_counter*)'
  [A] 'function void percpu_counter_set(percpu_counter*, s64)'
  [A] 'function posix_acl* posix_acl_alloc(int, gfp_t)'
  [A] 'function int posix_acl_chmod(inode*, umode_t)'
  [A] 'function int posix_acl_equiv_mode(const posix_acl*, umode_t*)'
  [A] 'function unsigned int radix_tree_gang_lookup(const xarray*, void**, unsigned long int, unsigned int)'
  [A] 'function int radix_tree_preload(gfp_t)'
  [A] 'function page* read_cache_page_gfp(address_space*, unsigned long int, gfp_t)'
  [A] 'function void seq_escape(seq_file*, const char*, const char*)'
  [A] 'function void set_cached_acl(inode*, int, posix_acl*)'
  [A] 'function int set_task_ioprio(task_struct*, int)'
  [A] 'function void shrink_dcache_sb(super_block*)'
  [A] 'function unsigned long int shrink_slab(gfp_t, int, mem_cgroup*, int)'
  [A] 'function swap_info_struct* swp_swap_info(swp_entry_t)'
  [A] 'function void sync_inodes_sb(super_block*)'
  [A] 'function int thaw_bdev(block_device*)'
  [A] 'function int thaw_super(super_block*)'
  [A] 'function void truncate_inode_pages_range(address_space*, loff_t, loff_t)'
  [A] 'function void truncate_pagecache_range(inode*, loff_t, loff_t)'
  [A] 'function int utf8_casefold(const unicode_map*, const qstr*, unsigned char*, size_t)'
  [A] 'function unicode_map* utf8_load(const char*)'
  [A] 'function int utf8_strncasecmp_folded(const unicode_map*, const qstr*, const qstr*)'
  [A] 'function void utf8_unload(unicode_map*)'
  [A] 'function int utf8s_to_utf16s(const u8*, int, utf16_endian, wchar_t*, int)'
  [A] 'function int vfs_ioc_fssetxattr_check(inode*, const fsxattr*, fsxattr*)'
  [A] 'function int vfs_ioc_setflags_prepare(inode*, unsigned int, unsigned int)'
  [A] 'function loff_t vfs_setpos(file*, loff_t, loff_t)'
  [A] 'function void vm_unmap_aliases()'
  [A] 'function void wait_for_completion_io(completion*)'
  [A] 'function void wait_for_stable_page(page*)'
  [A] 'function void wait_on_page_writeback(page*)'
  [A] 'function int walk_page_range(mm_struct*, unsigned long int, unsigned long int, const mm_walk_ops*, void*)'
  [A] 'function void wbc_account_cgroup_owner(writeback_control*, page*, size_t)'
  [A] 'function bool xa_get_mark(xarray*, unsigned long int, xa_mark_t)'

6 Added variables:

  [A] 'tracepoint __tracepoint_android_vh_cma_drain_all_pages_bypass'
  [A] 'tracepoint __tracepoint_android_vh_pcplist_add_cma_pages_bypass'
  [A] 'tracepoint __tracepoint_android_vh_shrink_node_memcgs'
  [A] 'tracepoint __tracepoint_map'
  [A] 'tracepoint __tracepoint_unmap'
  [A] 'inet_hashinfo tcp_hashinfo'

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Id62d82c18aeac7b909440af67860c93969108553
2022-05-11 19:17:15 +02:00
Dan Vacura
503435dc8c FROMGIT: usb: gadget: uvc: allow for application to cleanly shutdown
Several types of kernel panics can occur due to timing during the uvc
gadget removal. This appears to be a problem with gadget resources being
managed by both the client application's v4l2 open/close and the UDC
gadget bind/unbind. Since the concept of USB_GADGET_DELAYED_STATUS
doesn't exist for unbind, add a wait to allow for the application to
close out.

Some examples of the panics that can occur are:

<1>[ 1147.652313] Unable to handle kernel NULL pointer dereference at
virtual address 0000000000000028
<4>[ 1147.652510] Call trace:
<4>[ 1147.652514]  usb_gadget_disconnect+0x74/0x1f0
<4>[ 1147.652516]  usb_gadget_deactivate+0x38/0x168
<4>[ 1147.652520]  usb_function_deactivate+0x54/0x90
<4>[ 1147.652524]  uvc_function_disconnect+0x14/0x38
<4>[ 1147.652527]  uvc_v4l2_release+0x34/0xa0
<4>[ 1147.652537]  __fput+0xdc/0x2c0
<4>[ 1147.652540]  ____fput+0x10/0x1c
<4>[ 1147.652545]  task_work_run+0xe4/0x12c
<4>[ 1147.652549]  do_notify_resume+0x108/0x168

<1>[  282.950561][ T1472] Unable to handle kernel NULL pointer
dereference at virtual address 00000000000005b8
<6>[  282.953111][ T1472] Call trace:
<6>[  282.953121][ T1472]  usb_function_deactivate+0x54/0xd4
<6>[  282.953134][ T1472]  uvc_v4l2_release+0xac/0x1e4
<6>[  282.953145][ T1472]  v4l2_release+0x134/0x1f0
<6>[  282.953167][ T1472]  __fput+0xf4/0x428
<6>[  282.953178][ T1472]  ____fput+0x14/0x24
<6>[  282.953193][ T1472]  task_work_run+0xac/0x130

<3>[  213.410077][   T29] configfs-gadget gadget: uvc: Failed to queue
request (-108).
<1>[  213.410116][   T29] Unable to handle kernel NULL pointer
dereference at virtual address 0000000000000003
<6>[  213.413460][   T29] Call trace:
<6>[  213.413474][   T29]  uvcg_video_pump+0x1f0/0x384
<6>[  213.413489][   T29]  process_one_work+0x2a4/0x544
<6>[  213.413502][   T29]  worker_thread+0x350/0x784
<6>[  213.413515][   T29]  kthread+0x2ac/0x320
<6>[  213.413528][   T29]  ret_from_fork+0x10/0x30

Signed-off-by: Dan Vacura <w36195@motorola.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20220503201039.71720-1-w36195@motorola.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 229140375
(cherry picked from commit b81ac4395b
 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-linus)
Signed-off-by: Dan Vacura <w36195@motorola.com>
Change-Id: I451813637a02429041aa34ce9cb4cbd63c557415
2022-05-10 12:06:19 -05:00
Dan Vacura
3736ae703b FROMGIT: usb: dwc3: gadget: increase tx fifo size for ss isoc endpoints
Improve performance of isoc transfers in superspeed by increasing the
number of possible endpoints available, matching that of what was
configured for bulk transfers.

Signed-off-by: Dan Vacura <w36195@motorola.com>
Link: https://lore.kernel.org/r/20220420183338.445622-1-w36195@motorola.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 229140375
(cherry picked from commit 6a7c7df993
 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-next)
Change-Id: Iaa105cd98b0f4de3450bb5f6b10df67ed20a8336
Signed-off-by: Dan Vacura <w36195@motorola.com>
2022-05-10 12:06:19 -05:00
Vijayavardhan Vennapusa
300cec3502 UPSTREAM: usb: gadget: configfs: clear deactivation flag in configfs_composite_unbind()
If any function like UVC is deactivating gadget as part of composition
switch which results in not calling pullup enablement, it is not getting
enabled after switch to new composition due to this deactivation flag
not cleared. This results in USB enumeration not happening after switch
to new USB composition. Hence clear deactivation flag inside gadget
structure in configfs_composite_unbind() before switch to new USB
composition.

Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
Signed-off-by: Dan Vacura <w36195@motorola.com>
Cc: stable <stable@kernel.org>
Link: https://lore.kernel.org/r/20220413211038.72797-1-w36195@motorola.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 229140375
(cherry picked from commit bf95c4d463)
Change-Id: I0013ab8443e47788291951516baec3e7c8e445aa
Signed-off-by: Dan Vacura <w36195@motorola.com>
2022-05-10 12:06:19 -05:00
Dan Vacura
a35bc53848 FROMGIT: usb: gadget: uvc: remove pause flag use
The pause flag doesn't appear to serve a purpose as it is possible for
the pump worker thread to not be running when new buffers are queued.
Before the following change was introduced: "43cd0023872e usb: gadget:
uvc_video: add worker to handle the frame pumping", the pause flag
status was discarded and never returned. This masked a current issues of
the userspace receiving non-zero values (considered unsuccessful) and
prevents trace_v4l2_qbuf() from being called.

Signed-off-by: Dan Vacura <w36195@motorola.com>
Link: https://lore.kernel.org/r/20220413192402.26063-1-w36195@motorola.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 229140375
(cherry picked from commit be30e35027
 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-next)
Change-Id: Id841e7f0dc6c79f74ca41bb93f2504effc2fefd8
Signed-off-by: Dan Vacura <w36195@motorola.com>
2022-05-10 12:06:19 -05:00
Dan Vacura
36aa07174b FROMGIT: usb: gadget: uvc: allow changing interface name via configfs
Add a configfs entry, "function_name", to change the iInterface field
for VideoControl. This name is used on host devices for user selection,
useful when multiple cameras are present. The default will remain "UVC
Camera".

Signed-off-by: Dan Vacura <w36195@motorola.com>
Link: https://lore.kernel.org/r/20220401160447.5919-1-w36195@motorola.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 229140375
(cherry picked from commit 324e4f8507
 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-next)
Change-Id: I6943d40dbc0dec125464b66684ae31252e807d9b
Signed-off-by: Dan Vacura <w36195@motorola.com>
2022-05-10 12:06:18 -05:00
Dan Vacura
74b55107d0 UPSTREAM: usb: gadget: uvc: Fix crash when encoding data for usb request
During the uvcg_video_pump() process, if an error occurs and
uvcg_queue_cancel() is called, the buffer queue will be cleared out, but
the current marker (queue->buf_used) of the active buffer (no longer
active) is not reset. On the next iteration of uvcg_video_pump() the
stale buf_used count will be used and the logic of min((unsigned
int)len, buf->bytesused - queue->buf_used) may incorrectly calculate a
nbytes size, causing an invalid memory access.

[80802.185460][  T315] configfs-gadget gadget: uvc: VS request completed
with status -18.
[80802.185519][  T315] configfs-gadget gadget: uvc: VS request completed
with status -18.
...
uvcg_queue_cancel() is called and the queue is cleared out, but the
marker queue->buf_used is not reset.
...
[80802.262328][ T8682] Unable to handle kernel paging request at virtual
address ffffffc03af9f000
...
...
[80802.263138][ T8682] Call trace:
[80802.263146][ T8682]  __memcpy+0x12c/0x180
[80802.263155][ T8682]  uvcg_video_pump+0xcc/0x1e0
[80802.263165][ T8682]  process_one_work+0x2cc/0x568
[80802.263173][ T8682]  worker_thread+0x28c/0x518
[80802.263181][ T8682]  kthread+0x160/0x170
[80802.263188][ T8682]  ret_from_fork+0x10/0x18
[80802.263198][ T8682] Code: a8c12829 a88130cb a8c130

Fixes: d692522577 ("usb: gadget/uvc: Port UVC webcam gadget to use videobuf2 framework")
Cc: <stable@vger.kernel.org>
Signed-off-by: Dan Vacura <w36195@motorola.com>
Link: https://lore.kernel.org/r/20220331184024.23918-1-w36195@motorola.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 229140375
(cherry picked from commit 71d471e3fa)
Change-Id: I0e801793e56537177b0ff08dd8a5460d98c9614a
Signed-off-by: Dan Vacura <w36195@motorola.com>
2022-05-10 12:06:18 -05:00
Michael Grzeschik
53129aceec UPSTREAM: usb: gadget: uvc: test if ep->desc is valid on ep_queue
The reason that the ep_queue has failed could be a disabled endpoint.
In that case it is not guaranteed that the ep->desc is still valid.
This patch adds a check for NULL.

Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Paul Elder <paul.elder@ideasonboard.com>
Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
Link: https://lore.kernel.org/r/20211017215017.18392-4-m.grzeschik@pengutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 229140375
(cherry picked from commit 38db3716a5)
Signed-off-by: Dan Vacura <w36195@motorola.com>
Change-Id: I8a17f64088832947e3a4481140d884881bf603ff
2022-05-10 12:06:18 -05:00
Michael Grzeschik
23cca7ad30 UPSTREAM: usb: gadget: uvc: only pump video data if necessary
If the streaming endpoint is not enabled, the worker has nothing to do.
In the case buffers are still queued, this patch ensures that it will bail
out without handling any data.

Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Paul Elder <paul.elder@ideasonboard.com>
Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
Link: https://lore.kernel.org/r/20211017215017.18392-6-m.grzeschik@pengutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 229140375
(cherry picked from commit f9897ec0f6)
Signed-off-by: Dan Vacura <w36195@motorola.com>
Change-Id: Ice201abf1f4e4f38ea2b80a990896597e365e74b
2022-05-10 12:06:18 -05:00
Michael Grzeschik
6692312df6 UPSTREAM: usb: gadget: uvc: only schedule stream in streaming state
This patch ensures that the video pump thread will only be scheduled if
the uvc is really in streaming state. This way the worker will not have
to run on an empty queue.

Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Paul Elder <paul.elder@ideasonboard.com>
Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
Link: https://lore.kernel.org/r/20211017215017.18392-5-m.grzeschik@pengutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 229140375
(cherry picked from commit 5fc49d8bee)
Signed-off-by: Dan Vacura <w36195@motorola.com>
Change-Id: I5724e6c41a4b298f42d4009bdfe2f0232ae16517
2022-05-10 12:06:18 -05:00
Thinh Nguyen
1c14550b60 UPSTREAM: usb: dwc3: gadget: Give some time to schedule isoc
Currently the driver will schedule isoc transfers immediately on the
next interval, which is quite aggressive when the interval is 125us.
There's report that some platforms may need more time to process the
transfer, otherwise the controller may miss the first interval. Let's
keep it simple and give the controller at least 500us to schedule the
isoc transfer.

Link: https://lore.kernel.org/linux-usb/20220302143539.GI11577@pengutronix.de/
Tested-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://lore.kernel.org/r/deb8146b8e1f7f8495ef2d5647017270934cb2d8.1646708142.git.Thinh.Nguyen@synopsys.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 229140375
(cherry picked from commit aa6812be1f)
Signed-off-by: Dan Vacura <w36195@motorola.com>
Change-Id: I3bbf5abfdb249fb9a10c664f11d4f3b682ceafd1
2022-05-10 12:06:18 -05:00
Michael Grzeschik
5d084e9710 UPSTREAM: usb: gadget: uvc: make uvc_num_requests depend on gadget speed
While sending bigger images is possible with USB_SPEED_SUPER it is
better to use more isochronous requests in flight. This patch makes the
number uvc_num_requests dynamic by changing it depending on the gadget
speed.

Reviewed-by: Paul Elder <paul.elder@ideasonboard.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
Link: https://lore.kernel.org/r/20210628155311.16762-3-m.grzeschik@pengutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 229140375
(cherry picked from commit 9973772dbb)
Signed-off-by: Dan Vacura <w36195@motorola.com>
Change-Id: I1385bf8f973f3e5ee6c76193bffe0046eca22439
2022-05-10 12:06:18 -05:00
Qihang Hu
15a663ebbe UPSTREAM: usb: gadget: composite: Show warning if function driver's descriptors are incomplete.
In the config_ep_by_speed_and_alt function, select the corresponding
descriptor through g->speed. But some legacy or not well designed
function drivers may not support the corresponding speed. So, we can
directly display warnings instead of causing kernel panic. At the
same time, it indicates the reasons in warning message.

Reviewed-by: Peter Chen <peter.chen@kernel.org>
Signed-off-by: Qihang Hu <huqihang@oppo.com>
Link: https://lore.kernel.org/r/20211110101129.462357-1-huqihang@oppo.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 229140375
(cherry picked from commit 16d4275920)
Signed-off-by: Dan Vacura <w36195@motorola.com>
Change-Id: Iaef2ecfc080dc4a97fe9911af4da78316af8e063
2022-05-10 12:06:18 -05:00
Elliot Berman
3172c95582 FROMLIST: kbuild: Add environment variables for userprogs flags
Allow additional arguments be passed to userprogs compilation.
Reproducible clang builds need to provide a sysroot and gcc path to
ensure the same toolchain is used across hosts. KCFLAGS is not currently
used for any user programs compilation, so add new USERCFLAGS and
USERLDFLAGS which serves similar purpose as HOSTCFLAGS/HOSTLDFLAGS.

Clang 13+ might detect GCC installation on hosts which have it installed
to a default location in /. With addition of these environment
variables, you can specify flags such as:

$ make USERCFLAGS=--sysroot=/path/to/sysroot

This can also be used to specify different sysroots such as musl or
bionic which may be installed on the host in paths that the compiler
may not search by default.

Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Bug: 214127735
Link: https://lore.kernel.org/linux-kbuild/20220201213542.2808035-1-quic_eberman@quicinc.com/
Change-Id: I035309a569130774a1212f294973eee2830a6588
(cherry picked from commit df70410432)
2022-05-10 16:09:36 +00:00
Lee Jones
a07b60e85c ANDROID: dm-bow: Protect Ranges fetched and erased from the RB tree
Bug: 195565510
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Change-Id: Ic8134eb902aa7d929e3121b2f69b1d258f570652
(cherry picked from commit 98c15b2bad)
2022-05-10 13:25:21 +00:00
Lee Jones
0d752f78b2 BACKPORT: staging: ion: Prevent incorrect reference counting behavour
Supply additional check in order to prevent unexpected results.

Bug: 205573273
Fixes: b892bf75b2 ("ion: Switch ion to use dma-buf")
Suggested-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[Lee: Patch now applies to ion_buffer.c instead of ion.c]
Change-Id: Ia6afdd9ca502caa9cad6619d438fc6c8e8457679
(cherry picked from commit fea24b07ed)
2022-05-10 10:33:09 +00:00
Lina Wang
1e037dd790 FROMGIT: net: fix wrong network header length
When clatd starts with ebpf offloaing, and NETIF_F_GRO_FRAGLIST is enable,
several skbs are gathered in skb_shinfo(skb)->frag_list. The first skb's
ipv6 header will be changed to ipv4 after bpf_skb_proto_6_to_4,
network_header\transport_header\mac_header have been updated as ipv4 acts,
but other skbs in frag_list didnot update anything, just ipv6 packets.

udp_queue_rcv_skb will call skb_segment_list to traverse other skbs in
frag_list and make sure right udp payload is delivered to user space.
Unfortunately, other skbs in frag_list who are still ipv6 packets are
updated like the first skb and will have wrong transport header length.

e.g.before bpf_skb_proto_6_to_4,the first skb and other skbs in frag_list
has the same network_header(24)& transport_header(64), after
bpf_skb_proto_6_to_4, ipv6 protocol has been changed to ipv4, the first
skb's network_header is 44,transport_header is 64, other skbs in frag_list
didnot change.After skb_segment_list, the other skbs in frag_list has
different network_header(24) and transport_header(44), so there will be 20
bytes different from original,that is difference between ipv6 header and
ipv4 header. Just change transport_header to be the same with original.

Actually, there are two solutions to fix it, one is traversing all skbs
and changing every skb header in bpf_skb_proto_6_to_4, the other is
modifying frag_list skb's header in skb_segment_list. Considering
efficiency, adopt the second one--- when the first skb and other skbs in
frag_list has different network_header length, restore them to make sure
right udp payload is delivered to user space.

Signed-off-by: Lina Wang <lina.wang@mediatek.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit cf3ab8d4a7 https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git master)
Bug: 218157620
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I36f2f329ec1a56bb0742141a7fa482cafa183ad3
2022-05-09 15:41:38 +00:00
Greg Kroah-Hartman
f40e35e79c Linux 5.10.114
Link: https://lore.kernel.org/r/20220504153021.299025455@linuxfoundation.org
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Hulk Robot <hulkrobot@huawei.com>
Tested-by: Florian Fainelli <f.fainelli@gmail.com>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-09 09:05:09 +02:00
Namhyung Kim
2d74f61787 perf symbol: Remove arch__symbols__fixup_end()
commit a5d20d42a2 upstream.

Now the generic code can handle kallsyms fixup properly so no need to
keep the arch-functions anymore.

Fixes: 3cf6a32f3f ("perf symbols: Fix symbol size calculation condition")
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Acked-by: Ian Rogers <irogers@google.com>
Cc: Heiko Carstens <hca@linux.ibm.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: John Garry <john.garry@huawei.com>
Cc: Leo Yan <leo.yan@linaro.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Michael Petlan <mpetlan@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Song Liu <songliubraving@fb.com>
Cc: Will Deacon <will@kernel.org>
Cc: linux-s390@vger.kernel.org
Cc: linuxppc-dev@lists.ozlabs.org
Link: https://lore.kernel.org/r/20220416004048.1514900-4-namhyung@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-09 09:05:09 +02:00
Daniel Starke
bf98302e68 tty: n_gsm: fix software flow control handling
commit f4f7d63287 upstream.

n_gsm is based on the 3GPP 07.010 and its newer version is the 3GPP 27.010.
See https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDetails.aspx?specificationId=1516
The changes from 07.010 to 27.010 are non-functional. Therefore, I refer to
the newer 27.010 here. Chapter 5.4.8.1 states that XON/XOFF characters
shall be used instead of Fcon/Fcoff command in advanced option mode to
handle flow control. Chapter 5.4.8.2 describes how XON/XOFF characters
shall be handled. Basic option mode only used Fcon/Fcoff commands and no
XON/XOFF characters. These are treated as data bytes here.
The current implementation uses the gsm_mux field 'constipated' to handle
flow control from the remote peer and the gsm_dlci field 'constipated' to
handle flow control from each DLCI. The later is unrelated to this patch.
The gsm_mux field is correctly set for Fcon/Fcoff commands in
gsm_control_message(). However, the same is not true for XON/XOFF
characters in gsm1_receive().
Disable software flow control handling in the tty to allow explicit
handling by n_gsm.
Add the missing handling in advanced option mode for gsm_mux in
gsm1_receive() to comply with the standard.

This patch depends on the following commit:
Commit 8838b2af23 ("tty: n_gsm: fix SW flow control encoding/handling")

Fixes: e1eaea46bb ("tty: n_gsm line discipline")
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Starke <daniel.starke@siemens.com>
Link: https://lore.kernel.org/r/20220422071025.5490-3-daniel.starke@siemens.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-09 09:05:08 +02:00
Daniel Starke
95b267271a tty: n_gsm: fix incorrect UA handling
commit ff9166c623 upstream.

n_gsm is based on the 3GPP 07.010 and its newer version is the 3GPP 27.010.
See https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDetails.aspx?specificationId=1516
The changes from 07.010 to 27.010 are non-functional. Therefore, I refer to
the newer 27.010 here. Chapter 5.4.4.2 states that any received unnumbered
acknowledgment (UA) with its poll/final (PF) bit set to 0 shall be
discarded. Currently, all UA frame are handled in the same way regardless
of the PF bit. This does not comply with the standard.
Remove the UA case in gsm_queue() to process only UA frames with PF bit set
to 1 to abide the standard.

Fixes: e1eaea46bb ("tty: n_gsm line discipline")
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Starke <daniel.starke@siemens.com>
Link: https://lore.kernel.org/r/20220414094225.4527-20-daniel.starke@siemens.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-09 09:05:08 +02:00
Daniel Starke
70b045d9ae tty: n_gsm: fix reset fifo race condition
commit 73029a4d71 upstream.

gsmtty_write() and gsm_dlci_data_output() properly guard the fifo access.
However, gsm_dlci_close() and gsmtty_flush_buffer() modifies the fifo but
do not guard this.
Add a guard here to prevent race conditions on parallel writes to the fifo.

Fixes: e1eaea46bb ("tty: n_gsm line discipline")
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Starke <daniel.starke@siemens.com>
Link: https://lore.kernel.org/r/20220414094225.4527-17-daniel.starke@siemens.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-09 09:05:08 +02:00
Daniel Starke
320a24c4ef tty: n_gsm: fix wrong command frame length field encoding
commit 398867f59f upstream.

n_gsm is based on the 3GPP 07.010 and its newer version is the 3GPP 27.010.
See https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDetails.aspx?specificationId=1516
The changes from 07.010 to 27.010 are non-functional. Therefore, I refer to
the newer 27.010 here. Chapter 5.4.6.1 states that each command frame shall
be made up from type, length and value. Looking for example in chapter
5.4.6.3.5 at the description for the encoding of a flow control on command
it becomes obvious, that the type and length field is always present
whereas the value may be zero bytes long. The current implementation omits
the length field if the value is not present. This is wrong.
Correct this by always sending the length in gsm_control_transmit().
So far only the modem status command (MSC) has included a value and encoded
its length directly. Therefore, also change gsmtty_modem_update().

Fixes: e1eaea46bb ("tty: n_gsm line discipline")
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Starke <daniel.starke@siemens.com>
Link: https://lore.kernel.org/r/20220414094225.4527-12-daniel.starke@siemens.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-09 09:05:08 +02:00
Daniel Starke
935f314b6f tty: n_gsm: fix wrong command retry handling
commit d0bcdffcad upstream.

n_gsm is based on the 3GPP 07.010 and its newer version is the 3GPP 27.010.
See https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDetails.aspx?specificationId=1516
The changes from 07.010 to 27.010 are non-functional. Therefore, I refer to
the newer 27.010 here. Chapter 5.7.3 states that the valid range for the
maximum number of retransmissions (N2) is from 0 to 255 (both including).
gsm_config() fails to limit this range correctly. Furthermore,
gsm_control_retransmit() handles this number incorrectly by performing
N2 - 1 retransmission attempts. Setting N2 to zero results in more than 255
retransmission attempts.
Fix the range check in gsm_config() and the value handling in
gsm_control_send() and gsm_control_retransmit() to comply with 3GPP 27.010.

Fixes: e1eaea46bb ("tty: n_gsm line discipline")
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Starke <daniel.starke@siemens.com>
Link: https://lore.kernel.org/r/20220414094225.4527-11-daniel.starke@siemens.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-09 09:05:08 +02:00
Daniel Starke
17b86db43c tty: n_gsm: fix missing explicit ldisc flush
commit 17eac65202 upstream.

In gsm_cleanup_mux() the muxer is closed down and all queues are removed.
However, removing the queues is done without explicit control of the
underlying buffers. Flush those before freeing up our queues to ensure
that all outgoing queues are cleared consistently. Otherwise, a new mux
connection establishment attempt may time out while the underlying tty is
still busy sending out the remaining data from the previous connection.

Fixes: e1eaea46bb ("tty: n_gsm line discipline")
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Starke <daniel.starke@siemens.com>
Link: https://lore.kernel.org/r/20220414094225.4527-10-daniel.starke@siemens.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-09 09:05:08 +02:00
Daniel Starke
a2baa907c2 tty: n_gsm: fix wrong DLCI release order
commit deefc58baf upstream.

The current DLCI release order starts with the control channel followed by
the user channels. Reverse this order to keep the control channel open
until all user channels have been released.

Fixes: e1eaea46bb ("tty: n_gsm line discipline")
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Starke <daniel.starke@siemens.com>
Link: https://lore.kernel.org/r/20220414094225.4527-9-daniel.starke@siemens.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-09 09:05:08 +02:00
Daniel Starke
705925e693 tty: n_gsm: fix insufficient txframe size
commit 535bf600de upstream.

n_gsm is based on the 3GPP 07.010 and its newer version is the 3GPP 27.010.
See https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDetails.aspx?specificationId=1516
The changes from 07.010 to 27.010 are non-functional. Therefore, I refer to
the newer 27.010 here. Chapter 5.7.2 states that the maximum frame size
(N1) refers to the length of the information field (i.e. user payload).
However, 'txframe' stores the whole frame including frame header, checksum
and start/end flags. We also need to consider the byte stuffing overhead.
Define constant for the protocol overhead and adjust the 'txframe' size
calculation accordingly to reserve enough space for a complete mux frame
including byte stuffing for advanced option mode. Note that no byte
stuffing is applied to the start and end flag.
Also use MAX_MTU instead of MAX_MRU as this buffer is used for data
transmission.

Fixes: e1eaea46bb ("tty: n_gsm line discipline")
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Starke <daniel.starke@siemens.com>
Link: https://lore.kernel.org/r/20220414094225.4527-8-daniel.starke@siemens.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-09 09:05:08 +02:00
Florian Westphal
842a9bbbef netfilter: nft_socket: only do sk lookups when indev is available
commit 743b83f15d upstream.

Check if the incoming interface is available and NFT_BREAK
in case neither skb->sk nor input device are set.

Because nf_sk_lookup_slow*() assume packet headers are in the
'in' direction, use in postrouting is not going to yield a meaningful
result.  Same is true for the forward chain, so restrict the use
to prerouting, input and output.

Use in output work if a socket is already attached to the skb.

Fixes: 554ced0a6e ("netfilter: nf_tables: add support for native socket matching")
Reported-and-tested-by: Topi Miettinen <toiwoton@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-09 09:05:08 +02:00
Daniel Starke
7346e54dbf tty: n_gsm: fix malformed counter for out of frame data
commit a24b4b2f66 upstream.

The gsm_mux field 'malformed' represents the number of malformed frames
received. However, gsm1_receive() also increases this counter for any out
of frame byte.
Fix this by ignoring out of frame data for the malformed counter.

Fixes: e1eaea46bb ("tty: n_gsm line discipline")
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Starke <daniel.starke@siemens.com>
Link: https://lore.kernel.org/r/20220414094225.4527-7-daniel.starke@siemens.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-09 09:05:08 +02:00
Daniel Starke
d19613895e tty: n_gsm: fix wrong signal octet encoding in convergence layer type 2
commit 06d5afd4d6 upstream.

n_gsm is based on the 3GPP 07.010 and its newer version is the 3GPP 27.010.
See https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDetails.aspx?specificationId=1516
The changes from 07.010 to 27.010 are non-functional. Therefore, I refer to
the newer 27.010 here. Chapter 5.5.2 describes that the signal octet in
convergence layer type 2 can be either one or two bytes. The length is
encoded in the EA bit. This is set 1 for the last byte in the sequence.
gsmtty_modem_update() handles this correctly but gsm_dlci_data_output()
fails to set EA to 1. There is no case in which we encode two signal octets
as there is no case in which we send out a break signal.
Therefore, always set the EA bit to 1 for the signal octet to fix this.

Fixes: e1eaea46bb ("tty: n_gsm line discipline")
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Starke <daniel.starke@siemens.com>
Link: https://lore.kernel.org/r/20220414094225.4527-5-daniel.starke@siemens.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-09 09:05:08 +02:00
Daniel Starke
26f127f6d9 tty: n_gsm: fix mux cleanup after unregister tty device
commit 284260f278 upstream.

Internally, we manage the alive state of the mux channels and mux itself
with the field member 'dead'. This makes it possible to notify the user
if the accessed underlying link is already gone. On the other hand,
however, removing the virtual ttys before terminating the channels may
result in peer messages being received without any internal target. Move
the mux cleanup procedure from gsmld_detach_gsm() to gsmld_close() to fix
this by keeping the virtual ttys open until the mux has been cleaned up.

Fixes: e1eaea46bb ("tty: n_gsm line discipline")
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Starke <daniel.starke@siemens.com>
Link: https://lore.kernel.org/r/20220414094225.4527-4-daniel.starke@siemens.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-09 09:05:07 +02:00
Daniel Starke
f26c271492 tty: n_gsm: fix decoupled mux resource
commit 1ec92e9742 upstream.

The active mux instances are managed in the gsm_mux array and via mux_get()
and mux_put() functions separately. This gives a very loose coupling
between the actual instance and the gsm_mux array which manages it. It also
results in unnecessary lockings which makes it prone to failures. And it
creates a race condition if more than the maximum number of mux instances
are requested while the user changes the parameters of an active instance.
The user may loose ownership of the current mux instance in this case.
Fix this by moving the gsm_mux array handling to the mux allocation and
deallocation functions.

Fixes: e1eaea46bb ("tty: n_gsm line discipline")
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Starke <daniel.starke@siemens.com>
Link: https://lore.kernel.org/r/20220414094225.4527-3-daniel.starke@siemens.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-09 09:05:07 +02:00
Daniel Starke
47132f9f7f tty: n_gsm: fix restart handling via CLD command
commit aa371e96f0 upstream.

n_gsm is based on the 3GPP 07.010 and its newer version is the 3GPP 27.010.
See https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDetails.aspx?specificationId=1516
The changes from 07.010 to 27.010 are non-functional. Therefore, I refer to
the newer 27.010 here. Chapter 5.8.2 states that both sides will revert to
the non-multiplexed mode via a close-down message (CLD). The usual program
flow is as following:
- start multiplex mode by sending AT+CMUX to the mobile
- establish the control channel (DLCI 0)
- establish user channels (DLCI >0)
- terminate user channels
- send close-down message (CLD)
- revert to AT protocol (i.e. leave multiplexed mode)

The AT protocol is out of scope of the n_gsm driver. However,
gsm_disconnect() sends CLD if gsm_config() detects that the requested
parameters require the mux protocol to restart. The next immediate action
is to start the mux protocol by opening DLCI 0 again. Any responder side
which handles CLD commands correctly forces us to fail at this point
because AT+CMUX needs to be sent to the mobile to start the mux again.
Therefore, remove the CLD command in this phase and keep both sides in
multiplexed mode.
Remove the gsm_disconnect() function as it become unnecessary and merge the
remaining parts into gsm_cleanup_mux() to handle the termination order and
locking correctly.

Fixes: 71e0779153 ("tty: n_gsm: do not send/receive in ldisc close path")
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Starke <daniel.starke@siemens.com>
Link: https://lore.kernel.org/r/20220414094225.4527-2-daniel.starke@siemens.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-09 09:05:07 +02:00
Namhyung Kim
b3c88d46db perf symbol: Update symbols__fixup_end()
commit 8799ebce84 upstream.

Now arch-specific functions all do the same thing.  When it fixes the
symbol address it needs to check the boundary between the kernel image
and modules.  For the last symbol in the previous region, it cannot
know the exact size as it's discarded already.  Thus it just uses a
small page size (4096) and rounds it up like the last symbol.

Fixes: 3cf6a32f3f ("perf symbols: Fix symbol size calculation condition")
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Acked-by: Ian Rogers <irogers@google.com>
Cc: Heiko Carstens <hca@linux.ibm.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: John Garry <john.garry@huawei.com>
Cc: Leo Yan <leo.yan@linaro.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Michael Petlan <mpetlan@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Song Liu <songliubraving@fb.com>
Cc: Will Deacon <will@kernel.org>
Cc: linux-s390@vger.kernel.org
Cc: linuxppc-dev@lists.ozlabs.org
Link: https://lore.kernel.org/r/20220416004048.1514900-3-namhyung@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-09 09:05:07 +02:00
Namhyung Kim
3d0a3168a3 perf symbol: Pass is_kallsyms to symbols__fixup_end()
commit 838425f2de upstream.

The symbol fixup is necessary for symbols in kallsyms since they don't
have size info.  So we use the next symbol's address to calculate the
size.  Now it's also used for user binaries because sometimes they miss
size for hand-written asm functions.

There's a arch-specific function to handle kallsyms differently but
currently it cannot distinguish kallsyms from others.  Pass this
information explicitly to handle it properly.  Note that those arch
functions will be moved to the generic function so I didn't added it to
the arch-functions.

Fixes: 3cf6a32f3f ("perf symbols: Fix symbol size calculation condition")
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Acked-by: Ian Rogers <irogers@google.com>
Cc: Heiko Carstens <hca@linux.ibm.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: John Garry <john.garry@huawei.com>
Cc: Leo Yan <leo.yan@linaro.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Michael Petlan <mpetlan@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Song Liu <songliubraving@fb.com>
Cc: Will Deacon <will@kernel.org>
Cc: linux-s390@vger.kernel.org
Cc: linuxppc-dev@lists.ozlabs.org
Link: https://lore.kernel.org/r/20220416004048.1514900-2-namhyung@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-09 09:05:07 +02:00
Borislav Petkov
2ab14625b8 x86/cpu: Load microcode during restore_processor_state()
commit f9e14dbbd4 upstream.

When resuming from system sleep state, restore_processor_state()
restores the boot CPU MSRs. These MSRs could be emulated by microcode.
If microcode is not loaded yet, writing to emulated MSRs leads to
unchecked MSR access error:

  ...
  PM: Calling lapic_suspend+0x0/0x210
  unchecked MSR access error: WRMSR to 0x10f (tried to write 0x0...0) at rIP: ... (native_write_msr)
  Call Trace:
    <TASK>
    ? restore_processor_state
    x86_acpi_suspend_lowlevel
    acpi_suspend_enter
    suspend_devices_and_enter
    pm_suspend.cold
    state_store
    kobj_attr_store
    sysfs_kf_write
    kernfs_fop_write_iter
    new_sync_write
    vfs_write
    ksys_write
    __x64_sys_write
    do_syscall_64
    entry_SYSCALL_64_after_hwframe
   RIP: 0033:0x7fda13c260a7

To ensure microcode emulated MSRs are available for restoration, load
the microcode on the boot CPU before restoring these MSRs.

  [ Pawan: write commit message and productize it. ]

Fixes: e2a1256b17 ("x86/speculation: Restore speculation related MSRs during S3 resume")
Reported-by: Kyle D. Pelton <kyle.d.pelton@intel.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Tested-by: Kyle D. Pelton <kyle.d.pelton@intel.com>
Cc: stable@vger.kernel.org
Link: https://bugzilla.kernel.org/show_bug.cgi?id=215841
Link: https://lore.kernel.org/r/4350dfbf785cd482d3fafa72b2b49c83102df3ce.1650386317.git.pawan.kumar.gupta@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-09 09:05:07 +02:00
Kees Cook
795afbe8b4 thermal: int340x: Fix attr.show callback prototype
commit d0f6cfb2bd upstream.

Control Flow Integrity (CFI) instrumentation of the kernel noticed that
the caller, dev_attr_show(), and the callback, odvp_show(), did not have
matching function prototypes, which would cause a CFI exception to be
raised. Correct the prototype by using struct device_attribute instead
of struct kobj_attribute.

Reported-and-tested-by: Joao Moreira <joao@overdrivepizza.com>
Link: https://lore.kernel.org/lkml/067ce8bd4c3968054509831fa2347f4f@overdrivepizza.com/
Fixes: 006f006f1e ("thermal/int340x_thermal: Export OEM vendor variables")
Cc: 5.8+ <stable@vger.kernel.org> # 5.8+
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-09 09:05:07 +02:00
Dinh Nguyen
11d16498d7 net: ethernet: stmmac: fix write to sgmii_adapter_base
commit 5fd1fe4807 upstream.

I made a mistake with the commit a6aaa00324 ("net: ethernet: stmmac:
fix altr_tse_pcs function when using a fixed-link"). I should have
tested against both scenario of having a SGMII interface and one
without.

Without the SGMII PCS TSE adpater, the sgmii_adapter_base address is
NULL, thus a write to this address will fail.

Cc: stable@vger.kernel.org
Fixes: a6aaa00324 ("net: ethernet: stmmac: fix altr_tse_pcs function when using a fixed-link")
Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
Link: https://lore.kernel.org/r/20220420152345.27415-1-dinguyen@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-09 09:05:07 +02:00
Imre Deak
236dd62230 drm/i915: Fix SEL_FETCH_PLANE_*(PIPE_B+) register addresses
commit 4ae4dd2e26 upstream.

Fix typo in the _SEL_FETCH_PLANE_BASE_1_B register base address.

Fixes: a5523e2ff0 ("drm/i915: Add PSR2 selective fetch registers")
References: https://gitlab.freedesktop.org/drm/intel/-/issues/5400
Cc: José Roberto de Souza <jose.souza@intel.com>
Cc: <stable@vger.kernel.org> # v5.9+
Signed-off-by: Imre Deak <imre.deak@intel.com>
Reviewed-by: José Roberto de Souza <jose.souza@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20220421162221.2261895-1-imre.deak@intel.com
(cherry picked from commit af2cbc6ef9)
Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-09 09:05:07 +02:00
Zqiang
78d4dccf16 kasan: prevent cpu_quarantine corruption when CPU offline and cache shrink occur at same time
commit 31fa985b41 upstream.

kasan_quarantine_remove_cache() is called in kmem_cache_shrink()/
destroy().  The kasan_quarantine_remove_cache() call is protected by
cpuslock in kmem_cache_destroy() to ensure serialization with
kasan_cpu_offline().

However the kasan_quarantine_remove_cache() call is not protected by
cpuslock in kmem_cache_shrink().  When a CPU is going offline and cache
shrink occurs at same time, the cpu_quarantine may be corrupted by
interrupt (per_cpu_remove_cache operation).

So add a cpu_quarantine offline flags check in per_cpu_remove_cache().

[akpm@linux-foundation.org: add comment, per Zqiang]

Link: https://lkml.kernel.org/r/20220414025925.2423818-1-qiang1.zhang@intel.com
Signed-off-by: Zqiang <qiang1.zhang@intel.com>
Reviewed-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrey Konovalov <andreyknvl@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-09 09:05:07 +02:00
Damien Le Moal
5fef6df273 zonefs: Clear inode information flags on inode creation
commit 694852ead2 upstream.

Ensure that the i_flags field of struct zonefs_inode_info is cleared to
0 when initializing a zone file inode, avoiding seeing the flag
ZONEFS_ZONE_OPEN being incorrectly set.

Fixes: b5c00e9757 ("zonefs: open/close zone on file open/close")
Cc: <stable@vger.kernel.org>
Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Reviewed-by: Hans Holmberg <hans.holmberg@wdc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-09 09:05:06 +02:00
Damien Le Moal
92ed64a920 zonefs: Fix management of open zones
commit 1da18a296f upstream.

The mount option "explicit_open" manages the device open zone
resources to ensure that if an application opens a sequential file for
writing, the file zone can always be written by explicitly opening
the zone and accounting for that state with the s_open_zones counter.

However, if some zones are already open when mounting, the device open
zone resource usage status will be larger than the initial s_open_zones
value of 0. Ensure that this inconsistency does not happen by closing
any sequential zone that is open when mounting.

Furthermore, with ZNS drives, closing an explicitly open zone that has
not been written will change the zone state to "closed", that is, the
zone will remain in an active state. Since this can then cause failures
of explicit open operations on other zones if the drive active zone
resources are exceeded, we need to make sure that the zone is not
active anymore by resetting it instead of closing it. To address this,
zonefs_zone_mgmt() is modified to change a REQ_OP_ZONE_CLOSE request
into a REQ_OP_ZONE_RESET for sequential zones that have not been
written.

Fixes: b5c00e9757 ("zonefs: open/close zone on file open/close")
Cc: <stable@vger.kernel.org>
Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Reviewed-by: Hans Holmberg <hans.holmberg@wdc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-09 09:05:06 +02:00
Alexey Kardashevskiy
42e8ec3b4b powerpc/perf: Fix 32bit compile
[ Upstream commit bb82c57469 ]

The "read_bhrb" global symbol is only called under CONFIG_PPC64 of
arch/powerpc/perf/core-book3s.c but it is compiled for both 32 and 64 bit
anyway (and LLVM fails to link this on 32bit).

This fixes it by moving bhrb.o to obj64 targets.

Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20220421025756.571995-1-aik@ozlabs.ru
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-05-09 09:05:06 +02:00
Duoming Zhou
ac3d077043 drivers: net: hippi: Fix deadlock in rr_close()
[ Upstream commit bc6de28784 ]

There is a deadlock in rr_close(), which is shown below:

   (Thread 1)                |      (Thread 2)
                             | rr_open()
rr_close()                   |  add_timer()
 spin_lock_irqsave() //(1)   |  (wait a time)
 ...                         | rr_timer()
 del_timer_sync()            |  spin_lock_irqsave() //(2)
 (wait timer to stop)        |  ...

We hold rrpriv->lock in position (1) of thread 1 and
use del_timer_sync() to wait timer to stop, but timer handler
also need rrpriv->lock in position (2) of thread 2.
As a result, rr_close() will block forever.

This patch extracts del_timer_sync() from the protection of
spin_lock_irqsave(), which could let timer handler to obtain
the needed lock.

Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Link: https://lore.kernel.org/r/20220417125519.82618-1-duoming@zju.edu.cn
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-05-09 09:05:06 +02:00
Ronnie Sahlberg
5399e7b80c cifs: destage any unwritten data to the server before calling copychunk_write
[ Upstream commit f5d0f921ea ]

because the copychunk_write might cover a region of the file that has not yet
been sent to the server and thus fail.

A simple way to reproduce this is:
truncate -s 0 /mnt/testfile; strace -f -o x -ttT xfs_io -i -f -c 'pwrite 0k 128k' -c 'fcollapse 16k 24k' /mnt/testfile

the issue is that the 'pwrite 0k 128k' becomes rearranged on the wire with
the 'fcollapse 16k 24k' due to write-back caching.

fcollapse is implemented in cifs.ko as a SMB2 IOCTL(COPYCHUNK_WRITE) call
and it will fail serverside since the file is still 0b in size serverside
until the writes have been destaged.
To avoid this we must ensure that we destage any unwritten data to the
server before calling COPYCHUNK_WRITE.

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1997373
Reported-by: Xiaoli Feng <xifeng@redhat.com>
Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-05-09 09:05:06 +02:00