Merge 5.10.62 into android12-5.10-lts
Changes in 5.10.62 net: qrtr: fix another OOB Read in qrtr_endpoint_post bpf: Fix ringbuf helper function compatibility bpf: Fix NULL pointer dereference in bpf_get_local_storage() helper ASoC: rt5682: Adjust headset volume button threshold ASoC: component: Remove misplaced prefix handling in pin control functions ARC: Fix CONFIG_STACKDEPOT netfilter: conntrack: collect all entries in one cycle once: Fix panic when module unload blk-iocost: fix lockdep warning on blkcg->lock ovl: fix uninitialized pointer read in ovl_lookup_real_one() net: mscc: Fix non-GPL export of regmap APIs can: usb: esd_usb2: esd_usb2_rx_event(): fix the interchange of the CAN RX and TX error counters ceph: correctly handle releasing an embedded cap flush riscv: Ensure the value of FP registers in the core dump file is up to date Revert "btrfs: compression: don't try to compress if we don't have enough pages" drm/amdgpu: Cancel delayed work when GFXOFF is disabled Revert "USB: serial: ch341: fix character loss at high transfer rates" USB: serial: option: add new VID/PID to support Fibocom FG150 usb: renesas-xhci: Prefer firmware loading on unknown ROM state usb: dwc3: gadget: Fix dwc3_calc_trbs_left() usb: dwc3: gadget: Stop EP0 transfers during pullup disable scsi: core: Fix hang of freezing queue between blocking and running device RDMA/bnxt_re: Add missing spin lock initialization IB/hfi1: Fix possible null-pointer dereference in _extend_sdma_tx_descs() RDMA/bnxt_re: Remove unpaired rtnl unlock in bnxt_re_dev_init() ice: do not abort devlink info if board identifier can't be found net: usb: pegasus: fixes of set_register(s) return value evaluation; igc: fix page fault when thunderbolt is unplugged igc: Use num_tx_queues when iterating over tx_ring queue e1000e: Fix the max snoop/no-snoop latency for 10M e1000e: Do not take care about recovery NVM checksum RDMA/efa: Free IRQ vectors on error flow ip_gre: add validation for csum_start xgene-v2: Fix a resource leak in the error handling path of 'xge_probe()' net: marvell: fix MVNETA_TX_IN_PRGRS bit number ucounts: Increase ucounts reference counter before the security hook net/sched: ets: fix crash when flipping from 'strict' to 'quantum' ipv6: use siphash in rt6_exception_hash() ipv4: use siphash instead of Jenkins in fnhe_hashfun() cxgb4: dont touch blocked freelist bitmap after free rtnetlink: Return correct error on changing device netns net: hns3: clear hardware resource when loading driver net: hns3: add waiting time before cmdq memory is released net: hns3: fix duplicate node in VLAN list net: hns3: fix get wrong pfc_en when query PFC configuration Revert "mmc: sdhci-iproc: Set SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN on BCM2711" net: stmmac: add mutex lock to protect est parameters net: stmmac: fix kernel panic due to NULL pointer dereference of plat->est drm/i915: Fix syncmap memory leak usb: gadget: u_audio: fix race condition on endpoint stop dt-bindings: sifive-l2-cache: Fix 'select' matching perf/x86/intel/uncore: Fix integer overflow on 23 bit left shift of a u32 clk: renesas: rcar-usb2-clock-sel: Fix kernel NULL pointer dereference iwlwifi: pnvm: accept multiple HW-type TLVs opp: remove WARN when no valid OPPs remain cpufreq: blocklist Qualcomm sm8150 in cpufreq-dt-platdev virtio: Improve vq->broken access to avoid any compiler optimization virtio_pci: Support surprise removal of virtio pci device virtio_vdpa: reject invalid vq indices vringh: Use wiov->used to check for read/write desc order tools/virtio: fix build qed: qed ll2 race condition fixes qed: Fix null-pointer dereference in qed_rdma_create_qp() Revert "drm/amd/pm: fix workload mismatch on vega10" drm/amd/pm: change the workload type for some cards blk-mq: don't grab rq's refcount in blk_mq_check_expired() drm: Copy drm_wait_vblank to user before returning drm/nouveau/disp: power down unused DP links during init drm/nouveau/kms/nv50: workaround EFI GOP window channel format differences net/rds: dma_map_sg is entitled to merge entries btrfs: fix race between marking inode needs to be logged and log syncing pipe: avoid unnecessary EPOLLET wakeups under normal loads pipe: do FASYNC notifications for every pipe IO, not just state changes mtd: spinand: Fix incorrect parameters for on-die ECC tipc: call tipc_wait_for_connect only when dlen is not 0 vt_kdsetmode: extend console locking Bluetooth: btusb: check conditions before enabling USB ALT 3 for WBS riscv: Fixup wrong ftrace remove cflag riscv: Fixup patch_text panic in ftrace perf env: Fix memory leak of bpf_prog_info_linear member perf symbol-elf: Fix memory leak by freeing sdt_note.args perf record: Fix memory leak in vDSO found using ASAN perf tools: Fix arm64 build error with gcc-11 perf annotate: Fix jump parsing for C++ code. powerpc/perf: Invoke per-CPU variable access with disabled interrupts srcu: Provide internal interface to start a Tree SRCU grace period srcu: Provide polling interfaces for Tree SRCU grace periods srcu: Provide internal interface to start a Tiny SRCU grace period srcu: Make Tiny SRCU use multi-bit grace-period counter srcu: Provide polling interfaces for Tiny SRCU grace periods tracepoint: Use rcu get state and cond sync for static call updates usb: typec: ucsi: acpi: Always decode connector change information usb: typec: ucsi: Work around PPM losing change information usb: typec: ucsi: Clear pending after acking connector change net: dsa: mt7530: fix VLAN traffic leaks again lkdtm: Enable DOUBLE_FAULT on all architectures arm64: dts: qcom: msm8994-angler: Fix gpio-reserved-ranges 85-88 btrfs: fix NULL pointer dereference when deleting device by invalid id kthread: Fix PF_KTHREAD vs to_kthread() race Revert "floppy: reintroduce O_NDELAY fix" Revert "parisc: Add assembly implementations for memset, strlen, strcpy, strncpy and strcat" net: don't unconditionally copy_from_user a struct ifreq for socket ioctls audit: move put_tree() to avoid trim_trees refcount underflow and UAF bpf: Fix potentially incorrect results with bpf_get_local_storage() Linux 5.10.62 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I5a9bf4b2c254ae21a10f838494cae1c3fa016be3
This commit is contained in:
Greg Kroah-Hartman
@@ -372,8 +372,8 @@ const struct bpf_func_proto bpf_get_current_ancestor_cgroup_id_proto = {
|
||||
};
|
||||
|
||||
#ifdef CONFIG_CGROUP_BPF
|
||||
DECLARE_PER_CPU(struct bpf_cgroup_storage*,
|
||||
bpf_cgroup_storage[MAX_BPF_CGROUP_STORAGE_TYPE]);
|
||||
DECLARE_PER_CPU(struct bpf_cgroup_storage_info,
|
||||
bpf_cgroup_storage_info[BPF_CGROUP_STORAGE_NEST_MAX]);
|
||||
|
||||
BPF_CALL_2(bpf_get_local_storage, struct bpf_map *, map, u64, flags)
|
||||
{
|
||||
@@ -382,10 +382,17 @@ BPF_CALL_2(bpf_get_local_storage, struct bpf_map *, map, u64, flags)
|
||||
* verifier checks that its value is correct.
|
||||
*/
|
||||
enum bpf_cgroup_storage_type stype = cgroup_storage_type(map);
|
||||
struct bpf_cgroup_storage *storage;
|
||||
struct bpf_cgroup_storage *storage = NULL;
|
||||
void *ptr;
|
||||
int i;
|
||||
|
||||
storage = this_cpu_read(bpf_cgroup_storage[stype]);
|
||||
for (i = BPF_CGROUP_STORAGE_NEST_MAX - 1; i >= 0; i--) {
|
||||
if (likely(this_cpu_read(bpf_cgroup_storage_info[i].task) != current))
|
||||
continue;
|
||||
|
||||
storage = this_cpu_read(bpf_cgroup_storage_info[i].storage[stype]);
|
||||
break;
|
||||
}
|
||||
|
||||
if (stype == BPF_CGROUP_STORAGE_SHARED)
|
||||
ptr = &READ_ONCE(storage->buf)->data[0];
|
||||
|
||||
@@ -9,10 +9,11 @@
|
||||
#include <linux/slab.h>
|
||||
#include <uapi/linux/btf.h>
|
||||
|
||||
DEFINE_PER_CPU(struct bpf_cgroup_storage*, bpf_cgroup_storage[MAX_BPF_CGROUP_STORAGE_TYPE]);
|
||||
|
||||
#ifdef CONFIG_CGROUP_BPF
|
||||
|
||||
DEFINE_PER_CPU(struct bpf_cgroup_storage_info,
|
||||
bpf_cgroup_storage_info[BPF_CGROUP_STORAGE_NEST_MAX]);
|
||||
|
||||
#include "../cgroup/cgroup-internal.h"
|
||||
|
||||
#define LOCAL_STORAGE_CREATE_FLAG_MASK \
|
||||
|
||||
@@ -4693,8 +4693,6 @@ static int check_map_func_compatibility(struct bpf_verifier_env *env,
|
||||
case BPF_MAP_TYPE_RINGBUF:
|
||||
if (func_id != BPF_FUNC_ringbuf_output &&
|
||||
func_id != BPF_FUNC_ringbuf_reserve &&
|
||||
func_id != BPF_FUNC_ringbuf_submit &&
|
||||
func_id != BPF_FUNC_ringbuf_discard &&
|
||||
func_id != BPF_FUNC_ringbuf_query)
|
||||
goto error;
|
||||
break;
|
||||
@@ -4798,6 +4796,12 @@ static int check_map_func_compatibility(struct bpf_verifier_env *env,
|
||||
if (map->map_type != BPF_MAP_TYPE_PERF_EVENT_ARRAY)
|
||||
goto error;
|
||||
break;
|
||||
case BPF_FUNC_ringbuf_output:
|
||||
case BPF_FUNC_ringbuf_reserve:
|
||||
case BPF_FUNC_ringbuf_query:
|
||||
if (map->map_type != BPF_MAP_TYPE_RINGBUF)
|
||||
goto error;
|
||||
break;
|
||||
case BPF_FUNC_get_stackid:
|
||||
if (map->map_type != BPF_MAP_TYPE_STACK_TRACE)
|
||||
goto error;
|
||||
|
||||
Reference in New Issue
Block a user