340 Commits

Author	SHA1	Message	Date
Greg Kroah-Hartman	88eb084d18	Revert "Merge 5.10.220 into android12-5.10-lts" ... This reverts commit 87a7f35a24, reversing changes made to 640645c85b. 5.10.220 is a bunch of vfs and nfs changes that are not needed in Android systems, so revert the whole lot all at once, except for the version number bump. Change-Id: If28dc2231f27d326d3730716f23545dd0a2cdc75 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-07-16 16:33:14 +00:00
Greg Kroah-Hartman	87a7f35a24	Merge 5.10.220 into android12-5.10-lts ... Changes in 5.10.220 SUNRPC: Rename svc_encode_read_payload() NFSD: Invoke svc_encode_result_payload() in "read" NFSD encoders NFSD: A semicolon is not needed after a switch statement. nfsd/nfs3: remove unused macro nfsd3_fhandleres NFSD: Clean up the show_nf_may macro NFSD: Remove extra "0x" in tracepoint format specifier NFSD: Add SPDX header for fs/nfsd/trace.c nfsd: Fix error return code in nfsd_file_cache_init() SUNRPC: Add xdr_set_scratch_page() and xdr_reset_scratch_buffer() SUNRPC: Prepare for xdr_stream-style decoding on the server-side NFSD: Add common helpers to decode void args and encode void results NFSD: Add tracepoints in nfsd_dispatch() NFSD: Add tracepoints in nfsd4_decode/encode_compound() NFSD: Replace the internals of the READ_BUF() macro NFSD: Replace READ* macros in nfsd4_decode_access() NFSD: Replace READ* macros in nfsd4_decode_close() NFSD: Replace READ* macros in nfsd4_decode_commit() NFSD: Change the way the expected length of a fattr4 is checked NFSD: Replace READ* macros that decode the fattr4 size attribute NFSD: Replace READ* macros that decode the fattr4 acl attribute NFSD: Replace READ* macros that decode the fattr4 mode attribute NFSD: Replace READ* macros that decode the fattr4 owner attribute NFSD: Replace READ* macros that decode the fattr4 owner_group attribute NFSD: Replace READ* macros that decode the fattr4 time_set attributes NFSD: Replace READ* macros that decode the fattr4 security label attribute NFSD: Replace READ* macros that decode the fattr4 umask attribute NFSD: Replace READ* macros in nfsd4_decode_fattr() NFSD: Replace READ* macros in nfsd4_decode_create() NFSD: Replace READ* macros in nfsd4_decode_delegreturn() NFSD: Replace READ* macros in nfsd4_decode_getattr() NFSD: Replace READ* macros in nfsd4_decode_link() NFSD: Relocate nfsd4_decode_opaque() NFSD: Add helpers to decode a clientid4 and an NFSv4 state owner NFSD: Add helper for decoding locker4 NFSD: Replace READ* macros in nfsd4_decode_lock() NFSD: Replace READ* macros in nfsd4_decode_lockt() NFSD: Replace READ* macros in nfsd4_decode_locku() NFSD: Replace READ* macros in nfsd4_decode_lookup() NFSD: Add helper to decode NFSv4 verifiers NFSD: Add helper to decode OPEN's createhow4 argument NFSD: Add helper to decode OPEN's openflag4 argument NFSD: Replace READ* macros in nfsd4_decode_share_access() NFSD: Replace READ* macros in nfsd4_decode_share_deny() NFSD: Add helper to decode OPEN's open_claim4 argument NFSD: Replace READ* macros in nfsd4_decode_open() NFSD: Replace READ* macros in nfsd4_decode_open_confirm() NFSD: Replace READ* macros in nfsd4_decode_open_downgrade() NFSD: Replace READ* macros in nfsd4_decode_putfh() NFSD: Replace READ* macros in nfsd4_decode_read() NFSD: Replace READ* macros in nfsd4_decode_readdir() NFSD: Replace READ* macros in nfsd4_decode_remove() NFSD: Replace READ* macros in nfsd4_decode_rename() NFSD: Replace READ* macros in nfsd4_decode_renew() NFSD: Replace READ* macros in nfsd4_decode_secinfo() NFSD: Replace READ* macros in nfsd4_decode_setattr() NFSD: Replace READ* macros in nfsd4_decode_setclientid() NFSD: Replace READ* macros in nfsd4_decode_setclientid_confirm() NFSD: Replace READ* macros in nfsd4_decode_verify() NFSD: Replace READ* macros in nfsd4_decode_write() NFSD: Replace READ* macros in nfsd4_decode_release_lockowner() NFSD: Replace READ* macros in nfsd4_decode_cb_sec() NFSD: Replace READ* macros in nfsd4_decode_backchannel_ctl() NFSD: Replace READ* macros in nfsd4_decode_bind_conn_to_session() NFSD: Add a separate decoder to handle state_protect_ops NFSD: Add a separate decoder for ssv_sp_parms NFSD: Add a helper to decode state_protect4_a NFSD: Add a helper to decode nfs_impl_id4 NFSD: Add a helper to decode channel_attrs4 NFSD: Replace READ* macros in nfsd4_decode_create_session() NFSD: Replace READ* macros in nfsd4_decode_destroy_session() NFSD: Replace READ* macros in nfsd4_decode_free_stateid() NFSD: Replace READ* macros in nfsd4_decode_getdeviceinfo() NFSD: Replace READ* macros in nfsd4_decode_layoutcommit() NFSD: Replace READ* macros in nfsd4_decode_layoutget() NFSD: Replace READ* macros in nfsd4_decode_layoutreturn() NFSD: Replace READ* macros in nfsd4_decode_secinfo_no_name() NFSD: Replace READ* macros in nfsd4_decode_sequence() NFSD: Replace READ* macros in nfsd4_decode_test_stateid() NFSD: Replace READ* macros in nfsd4_decode_destroy_clientid() NFSD: Replace READ* macros in nfsd4_decode_reclaim_complete() NFSD: Replace READ* macros in nfsd4_decode_fallocate() NFSD: Replace READ* macros in nfsd4_decode_nl4_server() NFSD: Replace READ* macros in nfsd4_decode_copy() NFSD: Replace READ* macros in nfsd4_decode_copy_notify() NFSD: Replace READ* macros in nfsd4_decode_offload_status() NFSD: Replace READ* macros in nfsd4_decode_seek() NFSD: Replace READ* macros in nfsd4_decode_clone() NFSD: Replace READ* macros in nfsd4_decode_xattr_name() NFSD: Replace READ* macros in nfsd4_decode_setxattr() NFSD: Replace READ* macros in nfsd4_decode_listxattrs() NFSD: Make nfsd4_ops::opnum a u32 NFSD: Replace READ* macros in nfsd4_decode_compound() NFSD: Remove macros that are no longer used nfsd: only call inode_query_iversion in the I_VERSION case nfsd: simplify nfsd4_change_info nfsd: minor nfsd4_change_attribute cleanup nfsd4: don't query change attribute in v2/v3 case Revert "nfsd4: support change_attr_type attribute" nfsd: add a new EXPORT_OP_NOWCC flag to struct export_operations nfsd: allow filesystems to opt out of subtree checking nfsd: close cached files prior to a REMOVE or RENAME that would replace target exportfs: Add a function to return the raw output from fh_to_dentry() nfsd: Fix up nfsd to ensure that timeout errors don't result in ESTALE nfsd: Set PF_LOCAL_THROTTLE on local filesystems only nfsd: Record NFSv4 pre/post-op attributes as non-atomic exec: Don't open code get_close_on_exec exec: Move unshare_files to fix posix file locking during exec exec: Simplify unshare_files exec: Remove reset_files_struct kcmp: In kcmp_epoll_target use fget_task bpf: In bpf_task_fd_query use fget_task proc/fd: In proc_fd_link use fget_task Revert "fget: clarify and improve __fget_files() implementation" file: Rename __fcheck_files to files_lookup_fd_raw file: Factor files_lookup_fd_locked out of fcheck_files file: Replace fcheck_files with files_lookup_fd_rcu file: Rename fcheck lookup_fd_rcu file: Implement task_lookup_fd_rcu proc/fd: In tid_fd_mode use task_lookup_fd_rcu kcmp: In get_file_raw_ptr use task_lookup_fd_rcu file: Implement task_lookup_next_fd_rcu proc/fd: In proc_readfd_common use task_lookup_next_fd_rcu proc/fd: In fdinfo seq_show don't use get_files_struct file: Merge __fd_install into fd_install file: In f_dupfd read RLIMIT_NOFILE once. file: Merge __alloc_fd into alloc_fd file: Rename __close_fd to close_fd and remove the files parameter file: Replace ksys_close with close_fd inotify: Increase default inotify.max_user_watches limit to 1048576 fs/lockd: convert comma to semicolon NFSD: Fix sparse warning in nfssvc.c NFSD: Restore NFSv4 decoding's SAVEMEM functionality SUNRPC: Make trace_svc_process() display the RPC procedure symbolically SUNRPC: Display RPC procedure names instead of proc numbers SUNRPC: Move definition of XDR_UNIT NFSD: Update GETATTR3args decoder to use struct xdr_stream NFSD: Update ACCESS3arg decoder to use struct xdr_stream NFSD: Update READ3arg decoder to use struct xdr_stream NFSD: Update WRITE3arg decoder to use struct xdr_stream NFSD: Update READLINK3arg decoder to use struct xdr_stream NFSD: Fix returned READDIR offset cookie NFSD: Add helper to set up the pages where the dirlist is encoded NFSD: Update READDIR3args decoders to use struct xdr_stream NFSD: Update COMMIT3arg decoder to use struct xdr_stream NFSD: Update the NFSv3 DIROPargs decoder to use struct xdr_stream NFSD: Update the RENAME3args decoder to use struct xdr_stream NFSD: Update the LINK3args decoder to use struct xdr_stream NFSD: Update the SETATTR3args decoder to use struct xdr_stream NFSD: Update the CREATE3args decoder to use struct xdr_stream NFSD: Update the MKDIR3args decoder to use struct xdr_stream NFSD: Update the SYMLINK3args decoder to use struct xdr_stream NFSD: Update the MKNOD3args decoder to use struct xdr_stream NFSD: Update the NFSv2 GETATTR argument decoder to use struct xdr_stream NFSD: Update the NFSv2 READ argument decoder to use struct xdr_stream NFSD: Update the NFSv2 WRITE argument decoder to use struct xdr_stream NFSD: Update the NFSv2 READLINK argument decoder to use struct xdr_stream NFSD: Add helper to set up the pages where the dirlist is encoded NFSD: Update the NFSv2 READDIR argument decoder to use struct xdr_stream NFSD: Update NFSv2 diropargs decoding to use struct xdr_stream NFSD: Update the NFSv2 RENAME argument decoder to use struct xdr_stream NFSD: Update the NFSv2 LINK argument decoder to use struct xdr_stream NFSD: Update the NFSv2 SETATTR argument decoder to use struct xdr_stream NFSD: Update the NFSv2 CREATE argument decoder to use struct xdr_stream NFSD: Update the NFSv2 SYMLINK argument decoder to use struct xdr_stream NFSD: Remove argument length checking in nfsd_dispatch() NFSD: Update the NFSv2 GETACL argument decoder to use struct xdr_stream NFSD: Add an xdr_stream-based decoder for NFSv2/3 ACLs NFSD: Update the NFSv2 SETACL argument decoder to use struct xdr_stream NFSD: Update the NFSv2 ACL GETATTR argument decoder to use struct xdr_stream NFSD: Update the NFSv2 ACL ACCESS argument decoder to use struct xdr_stream NFSD: Clean up after updating NFSv2 ACL decoders NFSD: Update the NFSv3 GETACL argument decoder to use struct xdr_stream NFSD: Update the NFSv2 SETACL argument decoder to use struct xdr_stream NFSD: Clean up after updating NFSv3 ACL decoders nfsd: remove unused stats counters nfsd: protect concurrent access to nfsd stats counters nfsd: report per-export stats nfsd4: simplify process_lookup1 nfsd: simplify process_lock nfsd: simplify nfsd_renew nfsd: rename lookup_clientid->set_client nfsd: refactor set_client nfsd: find_cpntf_state cleanup nfsd: remove unused set_client argument nfsd: simplify nfsd4_check_open_reclaim nfsd: cstate->session->se_client -> cstate->clp NFSv4_2: SSC helper should use its own config. nfs: use change attribute for NFS re-exports nfsd: skip some unnecessary stats in the v4 case inotify, memcg: account inotify instances to kmemcg module: unexport find_module and module_mutex module: use RCU to synchronize find_module kallsyms: refactor {,module_}kallsyms_on_each_symbol kallsyms: only build {,module_}kallsyms_on_each_symbol when required fs: add file and path permissions helpers namei: introduce struct renamedata NFSD: Extract the svcxdr_init_encode() helper NFSD: Update the GETATTR3res encoder to use struct xdr_stream NFSD: Update the NFSv3 ACCESS3res encoder to use struct xdr_stream NFSD: Update the NFSv3 LOOKUP3res encoder to use struct xdr_stream NFSD: Update the NFSv3 wccstat result encoder to use struct xdr_stream NFSD: Update the NFSv3 READLINK3res encoder to use struct xdr_stream NFSD: Update the NFSv3 READ3res encode to use struct xdr_stream NFSD: Update the NFSv3 WRITE3res encoder to use struct xdr_stream NFSD: Update the NFSv3 CREATE family of encoders to use struct xdr_stream NFSD: Update the NFSv3 RENAMEv3res encoder to use struct xdr_stream NFSD: Update the NFSv3 LINK3res encoder to use struct xdr_stream NFSD: Update the NFSv3 FSSTAT3res encoder to use struct xdr_stream NFSD: Update the NFSv3 FSINFO3res encoder to use struct xdr_stream NFSD: Update the NFSv3 PATHCONF3res encoder to use struct xdr_stream NFSD: Update the NFSv3 COMMIT3res encoder to use struct xdr_stream NFSD: Add a helper that encodes NFSv3 directory offset cookies NFSD: Count bytes instead of pages in the NFSv3 READDIR encoder NFSD: Update the NFSv3 READDIR3res encoder to use struct xdr_stream NFSD: Update NFSv3 READDIR entry encoders to use struct xdr_stream NFSD: Remove unused NFSv3 directory entry encoders NFSD: Reduce svc_rqst::rq_pages churn during READDIR operations NFSD: Update the NFSv2 stat encoder to use struct xdr_stream NFSD: Update the NFSv2 attrstat encoder to use struct xdr_stream NFSD: Update the NFSv2 diropres encoder to use struct xdr_stream NFSD: Update the NFSv2 READLINK result encoder to use struct xdr_stream NFSD: Update the NFSv2 READ result encoder to use struct xdr_stream NFSD: Update the NFSv2 STATFS result encoder to use struct xdr_stream NFSD: Add a helper that encodes NFSv3 directory offset cookies NFSD: Count bytes instead of pages in the NFSv2 READDIR encoder NFSD: Update the NFSv2 READDIR result encoder to use struct xdr_stream NFSD: Update the NFSv2 READDIR entry encoder to use struct xdr_stream NFSD: Remove unused NFSv2 directory entry encoders NFSD: Add an xdr_stream-based encoder for NFSv2/3 ACLs NFSD: Update the NFSv2 GETACL result encoder to use struct xdr_stream NFSD: Update the NFSv2 SETACL result encoder to use struct xdr_stream NFSD: Update the NFSv2 ACL GETATTR result encoder to use struct xdr_stream NFSD: Update the NFSv2 ACL ACCESS result encoder to use struct xdr_stream NFSD: Clean up after updating NFSv2 ACL encoders NFSD: Update the NFSv3 GETACL result encoder to use struct xdr_stream NFSD: Update the NFSv3 SETACL result encoder to use struct xdr_stream NFSD: Clean up after updating NFSv3 ACL encoders NFSD: Add a tracepoint to record directory entry encoding NFSD: Clean up NFSDDBG_FACILITY macro nfsd: helper for laundromat expiry calculations nfsd: Log client tracking type log message as info instead of warning nfsd: Fix typo "accesible" nfsd: COPY with length 0 should copy to end of file nfsd: don't ignore high bits of copy count nfsd: report client confirmation status in "info" file SUNRPC: Export svc_xprt_received() UAPI: nfsfh.h: Replace one-element array with flexible-array member NFSD: Use DEFINE_SPINLOCK() for spinlock fsnotify: allow fsnotify_{peek,remove}_first_event with empty queue Revert "fanotify: limit number of event merge attempts" fanotify: reduce event objectid to 29-bit hash fanotify: mix event info and pid into merge key hash fsnotify: use hash table for faster events merge fanotify: limit number of event merge attempts fanotify: configurable limits via sysfs fanotify: support limited functionality for unprivileged users fanotify_user: use upper_32_bits() to verify mask nfsd: remove unused function nfsd: removed unused argument in nfsd_startup_generic() nfsd: hash nfs4_files by inode number nfsd: track filehandle aliasing in nfs4_files nfsd: reshuffle some code nfsd: grant read delegations to clients holding writes nfsd: Fix fall-through warnings for Clang NFSv4.2: Remove ifdef CONFIG_NFSD from NFSv4.2 client SSC code. NFS: fix nfs_fetch_iversion() fanotify: fix permission model of unprivileged group NFSD: Add an RPC authflavor tracepoint display helper NFSD: Add nfsd_clid_cred_mismatch tracepoint NFSD: Add nfsd_clid_verf_mismatch tracepoint NFSD: Remove trace_nfsd_clid_inuse_err NFSD: Add nfsd_clid_confirmed tracepoint NFSD: Add nfsd_clid_reclaim_complete tracepoint NFSD: Add nfsd_clid_destroyed tracepoint NFSD: Add a couple more nfsd_clid_expired call sites NFSD: Add tracepoints for SETCLIENTID edge cases NFSD: Add tracepoints for EXCHANGEID edge cases NFSD: Constify @fh argument of knfsd_fh_hash() NFSD: Capture every CB state transition NFSD: Drop TRACE_DEFINE_ENUM for NFSD4_CB_<state> macros NFSD: Add cb_lost tracepoint NFSD: Adjust cb_shutdown tracepoint NFSD: Enhance the nfsd_cb_setup tracepoint NFSD: Add an nfsd_cb_lm_notify tracepoint NFSD: Add an nfsd_cb_offload tracepoint NFSD: Replace the nfsd_deleg_break tracepoint NFSD: Add an nfsd_cb_probe tracepoint NFSD: Remove the nfsd_cb_work and nfsd_cb_done tracepoints NFSD: Update nfsd_cb_args tracepoint nfsd: Prevent truncation of an unlinked inode from blocking access to its directory nfsd: move some commit_metadata()s outside the inode lock NFSD add vfs_fsync after async copy is done NFSD: delay unmount source's export after inter-server copy completed. nfsd: move fsnotify on client creation outside spinlock nfsd4: Expose the callback address and state of each NFS4 client nfsd: fix kernel test robot warning in SSC code NFSD: Fix error return code in nfsd4_interssc_connect() nfsd: rpc_peeraddr2str needs rcu lock lockd: Remove stale comments lockd: Create a simplified .vs_dispatch method for NLM requests lockd: Common NLM XDR helpers lockd: Update the NLMv1 void argument decoder to use struct xdr_stream lockd: Update the NLMv1 TEST arguments decoder to use struct xdr_stream lockd: Update the NLMv1 LOCK arguments decoder to use struct xdr_stream lockd: Update the NLMv1 CANCEL arguments decoder to use struct xdr_stream lockd: Update the NLMv1 UNLOCK arguments decoder to use struct xdr_stream lockd: Update the NLMv1 nlm_res arguments decoder to use struct xdr_stream lockd: Update the NLMv1 SM_NOTIFY arguments decoder to use struct xdr_stream lockd: Update the NLMv1 SHARE arguments decoder to use struct xdr_stream lockd: Update the NLMv1 FREE_ALL arguments decoder to use struct xdr_stream lockd: Update the NLMv1 void results encoder to use struct xdr_stream lockd: Update the NLMv1 TEST results encoder to use struct xdr_stream lockd: Update the NLMv1 nlm_res results encoder to use struct xdr_stream lockd: Update the NLMv1 SHARE results encoder to use struct xdr_stream lockd: Update the NLMv4 void arguments decoder to use struct xdr_stream lockd: Update the NLMv4 TEST arguments decoder to use struct xdr_stream lockd: Update the NLMv4 LOCK arguments decoder to use struct xdr_stream lockd: Update the NLMv4 CANCEL arguments decoder to use struct xdr_stream lockd: Update the NLMv4 UNLOCK arguments decoder to use struct xdr_stream lockd: Update the NLMv4 nlm_res arguments decoder to use struct xdr_stream lockd: Update the NLMv4 SM_NOTIFY arguments decoder to use struct xdr_stream lockd: Update the NLMv4 SHARE arguments decoder to use struct xdr_stream lockd: Update the NLMv4 FREE_ALL arguments decoder to use struct xdr_stream lockd: Update the NLMv4 void results encoder to use struct xdr_stream lockd: Update the NLMv4 TEST results encoder to use struct xdr_stream lockd: Update the NLMv4 nlm_res results encoder to use struct xdr_stream lockd: Update the NLMv4 SHARE results encoder to use struct xdr_stream nfsd: remove redundant assignment to pointer 'this' NFSD: Prevent a possible oops in the nfs_dirent() tracepoint nfsd: fix NULL dereference in nfs3svc_encode_getaclres kernel/pid.c: remove static qualifier from pidfd_create() kernel/pid.c: implement additional checks upon pidfd_create() parameters fanotify: minor cosmetic adjustments to fid labels fanotify: introduce a generic info record copying helper fanotify: add pidfd support to the fanotify API fsnotify: replace igrab() with ihold() on attach connector fsnotify: count s_fsnotify_inode_refs for attached connectors fsnotify: count all objects with attached connectors fsnotify: optimize the case of no marks of any type NFSD: Clean up splice actor SUNRPC: Add svc_rqst_replace_page() API NFSD: Batch release pages during splice read NFSD: remove vanity comments sysctl: introduce new proc handler proc_dobool lockd: change the proc_handler for nsm_use_hostnames nlm: minor nlm_lookup_file argument change nlm: minor refactoring lockd: update nlm_lookup_file reexport comment Keep read and write fds with each nlm_file nfs: don't atempt blocking locks on nfs reexports lockd: don't attempt blocking locks on nfs reexports nfs: don't allow reexport reclaims SUNRPC: Add svc_rqst::rq_auth_stat SUNRPC: Set rq_auth_stat in the pg_authenticate() callout SUNRPC: Eliminate the RQ_AUTHERR flag NFS: Add a private local dispatcher for NFSv4 callback operations NFS: Remove unused callback void decoder fsnotify: fix sb_connectors leak NLM: Fix svcxdr_encode_owner() nfsd: Fix a warning for nfsd_file_close_inode fsnotify: pass data_type to fsnotify_name() fsnotify: pass dentry instead of inode data fsnotify: clarify contract for create event hooks fsnotify: Don't insert unmergeable events in hashtable fanotify: Fold event size calculation to its own function fanotify: Split fsid check from other fid mode checks inotify: Don't force FS_IN_IGNORED fsnotify: Add helper to detect overflow_event fsnotify: Add wrapper around fsnotify_add_event fsnotify: Retrieve super block from the data field fsnotify: Protect fsnotify_handle_inode_event from no-inode events fsnotify: Pass group argument to free_event fanotify: Support null inode event in fanotify_dfid_inode fanotify: Allow file handle encoding for unhashed events fanotify: Encode empty file handle when no inode is provided fanotify: Require fid_mode for any non-fd event fsnotify: Support FS_ERROR event type fanotify: Reserve UAPI bits for FAN_FS_ERROR fanotify: Pre-allocate pool of error events fanotify: Support enqueueing of error events fanotify: Support merging of error events fanotify: Wrap object_fh inline space in a creator macro fanotify: Add helpers to decide whether to report FID/DFID fanotify: WARN_ON against too large file handles fanotify: Report fid info for file related file system errors fanotify: Emit generic error info for error event fanotify: Allow users to request FAN_FS_ERROR events SUNRPC: Trace calls to .rpc_call_done NFSD: Optimize DRC bucket pruning NFSD: move filehandle format declarations out of "uapi". NFSD: drop support for ancient filehandles NFSD: simplify struct nfsfh NFSD: Initialize pointer ni with NULL and not plain integer 0 NFSD: Have legacy NFSD WRITE decoders use xdr_stream_subsegment() SUNRPC: Replace the "__be32 *p" parameter to .pc_decode SUNRPC: Change return value type of .pc_decode NFSD: Save location of NFSv4 COMPOUND status SUNRPC: Replace the "__be32 *p" parameter to .pc_encode SUNRPC: Change return value type of .pc_encode nfsd: update create verifier comment NFSD:fix boolreturn.cocci warning nfsd4: remove obselete comment NFSD: Fix exposure in nfsd4_decode_bitmap() NFSD: Fix READDIR buffer overflow fsnotify: clarify object type argument fsnotify: separate mark iterator type from object type enum fanotify: introduce group flag FAN_REPORT_TARGET_FID fsnotify: generate FS_RENAME event with rich information fanotify: use macros to get the offset to fanotify_info buffer fanotify: use helpers to parcel fanotify_info buffer fanotify: support secondary dir fh and name in fanotify_info fanotify: record old and new parent and name in FAN_RENAME event fanotify: record either old name new name or both for FAN_RENAME fanotify: report old and/or new parent+name in FAN_RENAME event fanotify: wire up FAN_RENAME event exit: Implement kthread_exit exit: Rename module_put_and_exit to module_put_and_kthread_exit NFSD: Fix sparse warning NFSD: handle errors better in write_ports_addfd() SUNRPC: change svc_get() to return the svc. SUNRPC/NFSD: clean up get/put functions. SUNRPC: stop using ->sv_nrthreads as a refcount nfsd: make nfsd_stats.th_cnt atomic_t SUNRPC: use sv_lock to protect updates to sv_nrthreads. NFSD: narrow nfsd_mutex protection in nfsd thread NFSD: Make it possible to use svc_set_num_threads_sync SUNRPC: discard svo_setup and rename svc_set_num_threads_sync() NFSD: simplify locking for network notifier. lockd: introduce nlmsvc_serv lockd: simplify management of network status notifiers lockd: move lockd_start_svc() call into lockd_create_svc() lockd: move svc_exit_thread() into the thread lockd: introduce lockd_put() lockd: rename lockd_create_svc() to lockd_get() SUNRPC: move the pool_map definitions (back) into svc.c SUNRPC: always treat sv_nrpools==1 as "not pooled" lockd: use svc_set_num_threads() for thread start and stop NFS: switch the callback service back to non-pooled. NFSD: Remove be32_to_cpu() from DRC hash function NFSD: Fix inconsistent indenting NFSD: simplify per-net file cache management NFSD: Combine XDR error tracepoints nfsd: improve stateid access bitmask documentation NFSD: De-duplicate nfsd4_decode_bitmap4() nfs: block notification on fs with its own ->lock nfsd4: add refcount for nfsd4_blocked_lock NFSD: Fix zero-length NFSv3 WRITEs nfsd: map EBADF nfsd: Add errno mapping for EREMOTEIO nfsd: Retry once in nfsd_open on an -EOPENSTALE return NFSD: Clean up nfsd_vfs_write() NFSD: De-duplicate net_generic(SVC_NET(rqstp), nfsd_net_id) NFSD: De-duplicate net_generic(nf->nf_net, nfsd_net_id) nfsd: Add a tracepoint for errors in nfsd4_clone_file_range() NFSD: Write verifier might go backwards NFSD: Clean up the nfsd_net::nfssvc_boot field NFSD: Rename boot verifier functions NFSD: Trace boot verifier resets Revert "nfsd: skip some unnecessary stats in the v4 case" NFSD: Move fill_pre_wcc() and fill_post_wcc() nfsd: fix crash on COPY_NOTIFY with special stateid fanotify: remove variable set but not used lockd: fix server crash on reboot of client holding lock lockd: fix failure to cleanup client locks NFSD: Fix the behavior of READ near OFFSET_MAX NFSD: Fix ia_size underflow NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes NFSD: COMMIT operations must not return NFS?ERR_INVAL NFSD: Deprecate NFS_OFFSET_MAX nfsd: Add support for the birth time attribute NFSD: De-duplicate hash bucket indexing NFSD: Skip extra computation for RC_NOCACHE case NFSD: Streamline the rare "found" case SUNRPC: Remove the .svo_enqueue_xprt method SUNRPC: Merge svc_do_enqueue_xprt() into svc_enqueue_xprt() SUNRPC: Remove svo_shutdown method SUNRPC: Rename svc_create_xprt() SUNRPC: Rename svc_close_xprt() SUNRPC: Remove svc_shutdown_net() NFSD: Remove svc_serv_ops::svo_module NFSD: Move svc_serv_ops::svo_function into struct svc_serv NFSD: Remove CONFIG_NFSD_V3 NFSD: Clean up _lm_ operation names nfsd: fix using the correct variable for sizeof() fsnotify: fix merge with parent's ignored mask fsnotify: optimize FS_MODIFY events with no ignored masks fsnotify: remove redundant parameter judgment SUNRPC: Return true/false (not 1/0) from bool functions nfsd: Fix a write performance regression nfsd: Clean up nfsd_file_put() fanotify: do not allow setting dirent events in mask of non-dir fs/lock: documentation cleanup. Replace inode->i_lock with flc_lock. inotify: move control flags from mask to mark flags fsnotify: pass flags argument to fsnotify_alloc_group() fsnotify: make allow_dups a property of the group fsnotify: create helpers for group mark_mutex lock inotify: use fsnotify group lock helpers nfsd: use fsnotify group lock helpers dnotify: use fsnotify group lock helpers fsnotify: allow adding an inode mark without pinning inode fanotify: create helper fanotify_mark_user_flags() fanotify: factor out helper fanotify_mark_update_flags() fanotify: implement "evictable" inode marks fanotify: use fsnotify group lock helpers fanotify: enable "evictable" inode marks fsnotify: introduce mark type iterator fsnotify: consistent behavior for parent not watching children fanotify: fix incorrect fmode_t casts NFSD: Clean up nfsd_splice_actor() NFSD: add courteous server support for thread with only delegation NFSD: add support for share reservation conflict to courteous server NFSD: move create/destroy of laundry_wq to init_nfsd and exit_nfsd fs/lock: add helper locks_owner_has_blockers to check for blockers fs/lock: add 2 callbacks to lock_manager_operations to resolve conflict NFSD: add support for lock conflict to courteous server NFSD: Show state of courtesy client in client info NFSD: Clean up nfsd3_proc_create() NFSD: Avoid calling fh_drop_write() twice in do_nfsd_create() NFSD: Refactor nfsd_create_setattr() NFSD: Refactor NFSv3 CREATE NFSD: Refactor NFSv4 OPEN(CREATE) NFSD: Remove do_nfsd_create() NFSD: Clean up nfsd_open_verified() NFSD: Instantiate a struct file when creating a regular NFSv4 file NFSD: Remove dprintk call sites from tail of nfsd4_open() NFSD: Fix whitespace NFSD: Move documenting comment for nfsd4_process_open2() NFSD: Trace filecache opens NFSD: Clean up the show_nf_flags() macro SUNRPC: Use RMW bitops in single-threaded hot paths nfsd: Unregister the cld notifier when laundry_wq create failed nfsd: Fix null-ptr-deref in nfsd_fill_super() nfsd: destroy percpu stats counters after reply cache shutdown NFSD: Modernize nfsd4_release_lockowner() NFSD: Add documenting comment for nfsd4_release_lockowner() NFSD: nfsd_file_put() can sleep NFSD: Fix potential use-after-free in nfsd_file_put() SUNRPC: Optimize xdr_reserve_space() fanotify: refine the validation checks on non-dir inode mask NFS: restore module put when manager exits. NFSD: Decode NFSv4 birth time attribute lockd: set fl_owner when unlocking files lockd: fix nlm_close_files fs: inotify: Fix typo in inotify comment fanotify: prepare for setting event flags in ignore mask fanotify: cleanups for fanotify_mark() input validations fanotify: introduce FAN_MARK_IGNORE fsnotify: Fix comment typo nfsd: eliminate the NFSD_FILE_BREAK_* flags SUNRPC: Fix xdr_encode_bool() NLM: Defend against file_lock changes after vfs_test_lock() NFSD: Fix space and spelling mistake nfsd: remove redundant assignment to variable len NFSD: Demote a WARN to a pr_warn() NFSD: Report filecache LRU size NFSD: Report count of calls to nfsd_file_acquire() NFSD: Report count of freed filecache items NFSD: Report average age of filecache items NFSD: Add nfsd_file_lru_dispose_list() helper NFSD: Refactor nfsd_file_gc() NFSD: Refactor nfsd_file_lru_scan() NFSD: Report the number of items evicted by the LRU walk NFSD: Record number of flush calls NFSD: Zero counters when the filecache is re-initialized NFSD: Hook up the filecache stat file NFSD: WARN when freeing an item still linked via nf_lru NFSD: Trace filecache LRU activity NFSD: Leave open files out of the filecache LRU NFSD: Fix the filecache LRU shrinker NFSD: Never call nfsd_file_gc() in foreground paths NFSD: No longer record nf_hashval in the trace log NFSD: Remove lockdep assertion from unhash_and_release_locked() NFSD: nfsd_file_unhash can compute hashval from nf->nf_inode NFSD: Refactor __nfsd_file_close_inode() NFSD: nfsd_file_hash_remove can compute hashval NFSD: Remove nfsd_file::nf_hashval NFSD: Replace the "init once" mechanism NFSD: Set up an rhashtable for the filecache NFSD: Convert the filecache to use rhashtable NFSD: Clean up unused code after rhashtable conversion NFSD: Separate tracepoints for acquire and create NFSD: Move nfsd_file_trace_alloc() tracepoint NFSD: NFSv4 CLOSE should release an nfsd_file immediately NFSD: Ensure nf_inode is never dereferenced NFSD: refactoring v4 specific code to a helper in nfs4state.c NFSD: keep track of the number of v4 clients in the system NFSD: limit the number of v4 clients to 1024 per 1GB of system memory nfsd: silence extraneous printk on nfsd.ko insertion NFSD: Optimize nfsd4_encode_operation() NFSD: Optimize nfsd4_encode_fattr() NFSD: Clean up SPLICE_OK in nfsd4_encode_read() NFSD: Add an nfsd4_read::rd_eof field NFSD: Optimize nfsd4_encode_readv() NFSD: Simplify starting_len NFSD: Use xdr_pad_size() NFSD: Clean up nfsd4_encode_readlink() NFSD: Fix strncpy() fortify warning NFSD: nfserrno(-ENOMEM) is nfserr_jukebox NFSD: Shrink size of struct nfsd4_copy_notify NFSD: Shrink size of struct nfsd4_copy NFSD: Reorder the fields in struct nfsd4_op NFSD: Make nfs4_put_copy() static NFSD: Replace boolean fields in struct nfsd4_copy NFSD: Refactor nfsd4_cleanup_inter_ssc() (1/2) NFSD: Refactor nfsd4_cleanup_inter_ssc() (2/2) NFSD: Refactor nfsd4_do_copy() NFSD: Remove kmalloc from nfsd4_do_async_copy() NFSD: Add nfsd4_send_cb_offload() NFSD: Move copy offload callback arguments into a separate structure NFSD: drop fh argument from alloc_init_deleg NFSD: verify the opened dentry after setting a delegation NFSD: introduce struct nfsd_attrs NFSD: set attributes when creating symlinks NFSD: add security label to struct nfsd_attrs NFSD: add posix ACLs to struct nfsd_attrs NFSD: change nfsd_create()/nfsd_symlink() to unlock directory before returning. NFSD: always drop directory lock in nfsd_unlink() NFSD: only call fh_unlock() once in nfsd_link() NFSD: reduce locking in nfsd_lookup() NFSD: use explicit lock/unlock for directory ops NFSD: use (un)lock_inode instead of fh_(un)lock for file operations NFSD: discard fh_locked flag and fh_lock/fh_unlock lockd: detect and reject lock arguments that overflow NFSD: fix regression with setting ACLs. nfsd_splice_actor(): handle compound pages NFSD: move from strlcpy with unused retval to strscpy lockd: move from strlcpy with unused retval to strscpy NFSD enforce filehandle check for source file in COPY NFSD: remove redundant variable status nfsd: Avoid some useless tests nfsd: Propagate some error code returned by memdup_user() NFSD: Increase NFSD_MAX_OPS_PER_COMPOUND NFSD: Protect against send buffer overflow in NFSv2 READDIR NFSD: Protect against send buffer overflow in NFSv3 READDIR NFSD: Protect against send buffer overflow in NFSv2 READ NFSD: Protect against send buffer overflow in NFSv3 READ NFSD: drop fname and flen args from nfsd_create_locked() NFSD: Fix handling of oversized NFSv4 COMPOUND requests nfsd: clean up mounted_on_fileid handling nfsd: remove nfsd4_prepare_cb_recall() declaration NFSD: Add tracepoints to report NFSv4 callback completions NFSD: Add a mechanism to wait for a DELEGRETURN NFSD: Refactor nfsd_setattr() NFSD: Make nfsd4_setattr() wait before returning NFS4ERR_DELAY NFSD: Make nfsd4_rename() wait before returning NFS4ERR_DELAY NFSD: Make nfsd4_remove() wait before returning NFS4ERR_DELAY NFSD: keep track of the number of courtesy clients in the system NFSD: add shrinker to reap courtesy clients on low memory condition SUNRPC: Parametrize how much of argsize should be zeroed NFSD: Reduce amount of struct nfsd4_compoundargs that needs clearing NFSD: Refactor common code out of dirlist helpers NFSD: Use xdr_inline_decode() to decode NFSv3 symlinks NFSD: Clean up WRITE arg decoders NFSD: Clean up nfs4svc_encode_compoundres() NFSD: Remove "inline" directives on op_rsize_bop helpers NFSD: Remove unused nfsd4_compoundargs::cachetype field NFSD: Pack struct nfsd4_compoundres nfsd: use DEFINE_PROC_SHOW_ATTRIBUTE to define nfsd_proc_ops nfsd: use DEFINE_SHOW_ATTRIBUTE to define export_features_fops and supported_enctypes_fops nfsd: use DEFINE_SHOW_ATTRIBUTE to define client_info_fops nfsd: use DEFINE_SHOW_ATTRIBUTE to define nfsd_reply_cache_stats_fops nfsd: use DEFINE_SHOW_ATTRIBUTE to define nfsd_file_cache_stats_fops NFSD: Rename the fields in copy_stateid_t NFSD: Cap rsize_bop result based on send buffer size nfsd: only fill out return pointer on success in nfsd4_lookup_stateid nfsd: fix comments about spinlock handling with delegations nfsd: make nfsd4_run_cb a bool return function nfsd: extra checks when freeing delegation stateids fs/notify: constify path fsnotify: remove unused declaration fanotify: Remove obsoleted fanotify_event_has_path() nfsd: fix nfsd_file_unhash_and_dispose nfsd: rework hashtable handling in nfsd_do_file_acquire NFSD: unregister shrinker when nfsd_init_net() fails nfsd: fix net-namespace logic in __nfsd_file_cache_purge nfsd: fix use-after-free in nfsd_file_do_acquire tracepoint nfsd: put the export reference in nfsd4_verify_deleg_dentry NFSD: Fix reads with a non-zero offset that don't end on a page boundary filelock: add a new locks_inode_context accessor function lockd: use locks_inode_context helper nfsd: use locks_inode_context helper NFSD: Simplify READ_PLUS NFSD: Remove redundant assignment to variable host_err NFSD: Finish converting the NFSv2 GETACL result encoder NFSD: Finish converting the NFSv3 GETACL result encoder nfsd: ignore requests to disable unsupported versions nfsd: move nfserrno() to vfs.c nfsd: allow disabling NFSv2 at compile time exportfs: use pr_debug for unreachable debug statements NFSD: Pass the target nfsd_file to nfsd_commit() NFSD: Revert "NFSD: NFSv4 CLOSE should release an nfsd_file immediately" NFSD: Add an NFSD_FILE_GC flag to enable nfsd_file garbage collection NFSD: Flesh out a documenting comment for filecache.c NFSD: Clean up nfs4_preprocess_stateid_op() call sites NFSD: Trace stateids returned via DELEGRETURN NFSD: Trace delegation revocations NFSD: Use const pointers as parameters to fh_ helpers NFSD: Update file_hashtbl() helpers NFSD: Clean up nfsd4_init_file() NFSD: Add a nfsd4_file_hash_remove() helper NFSD: Clean up find_or_add_file() NFSD: Refactor find_file() NFSD: Use rhashtable for managing nfs4_file objects NFSD: Fix licensing header in filecache.c nfsd: remove the pages_flushed statistic from filecache nfsd: reorganize filecache.c nfsd: fix up the filecache laundrette scheduling NFSD: Add an nfsd_file_fsync tracepoint lockd: set other missing fields when unlocking files nfsd: return error if nfs4_setacl fails NFSD: Use struct_size() helper in alloc_session() lockd: set missing fl_flags field when retrieving args lockd: ensure we use the correct file descriptor when unlocking lockd: fix file selection in nlmsvc_cancel_blocked NFSD: pass range end to vfs_fsync_range() instead of count NFSD: refactoring courtesy_client_reaper to a generic low memory shrinker NFSD: add support for sending CB_RECALL_ANY NFSD: add delegation reaper to react to low memory condition NFSD: Use only RQ_DROPME to signal the need to drop a reply NFSD: Avoid clashing function prototypes nfsd: rework refcounting in filecache nfsd: fix handling of cached open files in nfsd4_open codepath Revert "SUNRPC: Use RMW bitops in single-threaded hot paths" NFSD: Use set_bit(RQ_DROPME) NFSD: fix use-after-free in nfsd4_ssc_setup_dul() NFSD: register/unregister of nfsd-client shrinker at nfsd startup/shutdown time NFSD: replace delayed_work with work_struct for nfsd_client_shrinker nfsd: don't free files unconditionally in __nfsd_file_cache_purge nfsd: don't destroy global nfs4_file table in per-net shutdown NFSD: enhance inter-server copy cleanup nfsd: allow nfsd_file_get to sanely handle a NULL pointer nfsd: clean up potential nfsd_file refcount leaks in COPY codepath NFSD: fix leaked reference count of nfsd4_ssc_umount_item nfsd: don't hand out delegation on setuid files being opened for write NFSD: fix problems with cleanup on errors in nfsd4_copy nfsd: fix courtesy client with deny mode handling in nfs4_upgrade_open nfsd: don't fsync nfsd_files on last close NFSD: copy the whole verifier in nfsd_copy_write_verifier NFSD: Protect against filesystem freezing lockd: set file_lock start and end when decoding nlm4 testargs nfsd: don't replace page in rq_pages if it's a continuation of last page NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL nfsd: call op_release, even when op_func returns an error nfsd: don't open-code clear_and_wake_up_bit nfsd: NFSD_FILE_KEY_INODE only needs to find GC'ed entries nfsd: simplify test_bit return in NFSD_FILE_KEY_FULL comparator nfsd: don't kill nfsd_files because of lease break error nfsd: add some comments to nfsd_file_do_acquire nfsd: don't take/put an extra reference when putting a file nfsd: update comment over __nfsd_file_cache_purge nfsd: allow reaping files still under writeback NFSD: Convert filecache to rhltable nfsd: simplify the delayed disposal list code NFSD: Fix problem of COMMIT and NFS4ERR_DELAY in infinite loop nfsd: make a copy of struct iattr before calling notify_change nfsd: fix double fget() bug in __write_ports_addfd() lockd: drop inappropriate svc_get() from locked_get() NFSD: Add an nfsd4_encode_nfstime4() helper nfsd: Fix creation time serialization order nfsd: don't allow nfsd threads to be signalled. nfsd: Simplify code around svc_exit_thread() call in nfsd() nfsd: separate nfsd_last_thread() from nfsd_put() Documentation: Add missing documentation for EXPORT_OP flags NFSD: fix possible oops when nfsd/pool_stats is closed. nfsd: call nfsd_last_thread() before final nfsd_put() nfsd: drop the nfsd_put helper nfsd: fix RELEASE_LOCKOWNER nfsd: don't take fi_lock in nfsd_break_deleg_cb() nfsd: don't call locks_release_private() twice concurrently nfsd: Fix a regression in nfsd_setattr() Linux 5.10.220 Change-Id: I589ec5e63d1f985ab69f9755b9a87330627d44c5 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-07-16 15:58:54 +00:00
Greg Kroah-Hartman	fedef46c69	Merge 5.10.219 into android12-5.10-lts ... Changes in 5.10.219 x86/tsc: Trust initial offset in architectural TSC-adjust MSRs tty: n_gsm: fix possible out-of-bounds in gsm0_receive() speakup: Fix sizeof() vs ARRAY_SIZE() bug ring-buffer: Fix a race between readers and resize checks net: smc91x: Fix m68k kernel compilation for ColdFire CPU nilfs2: fix unexpected freezing of nilfs_segctor_sync() nilfs2: fix potential hang in nilfs_detach_log_writer() ALSA: core: Fix NULL module pointer assignment at card init wifi: cfg80211: fix the order of arguments for trace events of the tx_rx_evt class net: usb: qmi_wwan: add Telit FN920C04 compositions drm/amd/display: Set color_mgmt_changed to true on unsuspend ASoC: rt5645: Fix the electric noise due to the CBJ contacts floating ASoC: dt-bindings: rt5645: add cbj sleeve gpio property regulator: vqmmc-ipq4019: fix module autoloading ASoC: rt715: add vendor clear control register ASoC: da7219-aad: fix usage of device_get_named_child_node() drm/amdkfd: Flush the process wq before creating a kfd_process nvme: find numa distance only if controller has valid numa id openpromfs: finish conversion to the new mount API crypto: bcm - Fix pointer arithmetic firmware: raspberrypi: Use correct device for DMA mappings ecryptfs: Fix buffer size for tag 66 packet nilfs2: fix out-of-range warning parisc: add missing export of __cmpxchg_u8() crypto: ccp - drop platform ifdef checks crypto: x86/nh-avx2 - add missing vzeroupper crypto: x86/sha256-avx2 - add missing vzeroupper s390/cio: fix tracepoint subchannel type field jffs2: prevent xattr node from overflowing the eraseblock soc: mediatek: cmdq: Fix typo of CMDQ_JUMP_RELATIVE null_blk: Fix missing mutex_destroy() at module removal md: fix resync softlockup when bitmap size is less than array size wifi: ath10k: poll service ready message before failing x86/boot: Ignore relocations in .notes sections in walk_relocs() too qed: avoid truncating work queue length scsi: ufs: qcom: Perform read back after writing reset bit scsi: ufs-qcom: Fix ufs RST_n spec violation scsi: ufs: qcom: Perform read back after writing REG_UFS_SYS1CLK_1US scsi: ufs: ufs-qcom: Fix the Qcom register name for offset 0xD0 scsi: ufs: ufs-qcom: Clear qunipro_g4_sel for HW version major 5 scsi: ufs: qcom: Perform read back after writing unipro mode scsi: ufs: qcom: Perform read back after writing CGC enable scsi: ufs: cdns-pltfrm: Perform read back after writing HCLKDIV scsi: ufs: core: Perform read back after disabling interrupts scsi: ufs: core: Perform read back after disabling UIC_COMMAND_COMPL irqchip/alpine-msi: Fix off-by-one in allocation error path irqchip/loongson-pch-msi: Fix off-by-one on allocation error path ACPI: disable -Wstringop-truncation gfs2: Fix "ignore unlock failures after withdraw" selftests/bpf: Fix umount cgroup2 error in test_sockmap cpufreq: Reorganize checks in cpufreq_offline() cpufreq: Split cpufreq_offline() cpufreq: Rearrange locking in cpufreq_remove_dev() cpufreq: exit() callback is optional net: export inet_lookup_reuseport and inet6_lookup_reuseport net: remove duplicate reuseport_lookup functions udp: Avoid call to compute_score on multiple sites scsi: libsas: Fix the failure of adding phy with zero-address to port scsi: hpsa: Fix allocation size for Scsi_Host private data x86/purgatory: Switch to the position-independent small code model wifi: ath10k: Fix an error code problem in ath10k_dbg_sta_write_peer_debug_trigger() wifi: ath10k: populate board data for WCN3990 tcp: avoid premature drops in tcp_add_backlog() net: give more chances to rcu in netdev_wait_allrefs_any() macintosh/via-macii: Fix "BUG: sleeping function called from invalid context" wifi: carl9170: add a proper sanity check for endpoints wifi: ar5523: enable proper endpoint verification sh: kprobes: Merge arch_copy_kprobe() into arch_prepare_kprobe() Revert "sh: Handle calling csum_partial with misaligned data" selftests/binderfs: use the Makefile's rules, not Make's implicit rules HID: intel-ish-hid: ipc: Add check for pci_alloc_irq_vectors scsi: bfa: Ensure the copied buf is NUL terminated scsi: qedf: Ensure the copied buf is NUL terminated wifi: mwl8k: initialize cmd->addr[] properly usb: aqc111: stop lying about skb->truesize net: usb: sr9700: stop lying about skb->truesize m68k: Fix spinlock race in kernel thread creation m68k: mac: Fix reboot hang on Mac IIci net: ipv6: fix wrong start position when receive hop-by-hop fragment eth: sungem: remove .ndo_poll_controller to avoid deadlocks net: ethernet: cortina: Locking fixes af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg net: usb: smsc95xx: stop lying about skb->truesize net: openvswitch: fix overwriting ct original tuple for ICMPv6 ipv6: sr: add missing seg6_local_exit ipv6: sr: fix incorrect unregister order ipv6: sr: fix invalid unregister error path net/mlx5: Discard command completions in internal error drm/amd/display: Fix potential index out of bounds in color transformation function ASoC: soc-acpi: add helper to identify parent driver. ASoC: Intel: Disable route checks for Skylake boards mtd: rawnand: hynix: fixed typo fbdev: shmobile: fix snprintf truncation drm/meson: vclk: fix calculation of 59.94 fractional rates drm/mediatek: Add 0 size check to mtk_drm_gem_obj powerpc/fsl-soc: hide unused const variable fbdev: sisfb: hide unused variables media: ngene: Add dvb_ca_en50221_init return value check media: radio-shark2: Avoid led_names truncations drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference fbdev: sh7760fb: allow modular build media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries drm/arm/malidp: fix a possible null pointer dereference drm: vc4: Fix possible null pointer dereference ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value drm/bridge: lt9611: Don't log an error when DSI host can't be found drm/bridge: tc358775: Don't log an error when DSI host can't be found drm/panel: simple: Add missing Innolux G121X1-L03 format, flags, connector drm/mipi-dsi: use correct return type for the DSC functions RDMA/hns: Refactor the hns_roce_buf allocation flow RDMA/hns: Create QP with selected QPN for bank load balance RDMA/hns: Fix incorrect symbol types RDMA/hns: Fix return value in hns_roce_map_mr_sg RDMA/hns: Use complete parentheses in macros RDMA/hns: Modify the print level of CQE error clk: qcom: mmcc-msm8998: fix venus clock issue x86/insn: Fix PUSH instruction in x86 instruction decoder opcode map ext4: avoid excessive credit estimate in ext4_tmpfile() sunrpc: removed redundant procp check ext4: simplify calculation of blkoff in ext4_mb_new_blocks_simple ext4: fix unit mismatch in ext4_mb_new_blocks_simple ext4: try all groups in ext4_mb_new_blocks_simple ext4: remove unused parameter from ext4_mb_new_blocks_simple() ext4: fix potential unnitialized variable SUNRPC: Fix gss_free_in_token_pages() selftests/kcmp: Make the test output consistent and clear selftests/kcmp: remove unused open mode RDMA/IPoIB: Fix format truncation compilation errors net: qrtr: fix null-ptr-deref in qrtr_ns_remove net: qrtr: ns: Fix module refcnt netrom: fix possible dead-lock in nr_rt_ioctl() af_packet: do not call packet_read_pending() from tpacket_destruct_skb() sched/fair: Allow disabling sched_balance_newidle with sched_relax_domain_level greybus: lights: check return of get_channel_from_mode f2fs: fix to wait on page writeback in __clone_blkaddrs() soundwire: cadence: fix invalid PDI offset dmaengine: idma64: Add check for dma_set_max_seg_size firmware: dmi-id: add a release callback function serial: max3100: Lock port->lock when calling uart_handle_cts_change() serial: max3100: Update uart_driver_registered on driver removal serial: max3100: Fix bitwise types greybus: arche-ctrl: move device table to its right location serial: sc16is7xx: add proper sched.h include for sched_set_fifo() f2fs: compress: support chksum f2fs: add compress_mode mount option f2fs: compress: clean up parameter of __f2fs_cluster_blocks() f2fs: compress: remove unneeded preallocation f2fs: introduce FI_COMPRESS_RELEASED instead of using IMMUTABLE bit f2fs: compress: fix to relocate check condition in f2fs_{release,reserve}_compress_blocks() f2fs: add cp_error check in f2fs_write_compressed_pages f2fs: fix to force keeping write barrier for strict fsync mode f2fs: do not allow partial truncation on pinned file f2fs: fix typos in comments f2fs: fix to relocate check condition in f2fs_fallocate() f2fs: fix to check pinfile flag in f2fs_move_file_range() iio: pressure: dps310: support negative temperature values fpga: region: change FPGA indirect article to an fpga: region: Rename dev to parent for parent device docs: driver-api: fpga: avoid using UTF-8 chars fpga: region: Use standard dev_release for class driver fpga: region: add owner module and take its refcount microblaze: Remove gcc flag for non existing early_printk.c file microblaze: Remove early printk call from cpuinfo-static.c usb: gadget: u_audio: Clear uac pointer when freed. stm class: Fix a double free in stm_register_device() ppdev: Remove usage of the deprecated ida_simple_xx() API ppdev: Add an error check in register_device extcon: max8997: select IRQ_DOMAIN instead of depending on it PCI/EDR: Align EDR_PORT_DPC_ENABLE_DSM with PCI Firmware r3.3 PCI/EDR: Align EDR_PORT_LOCATE_DSM with PCI Firmware r3.3 f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock f2fs: fix to release node block count in error path of f2fs_new_node_page() f2fs: compress: don't allow unaligned truncation on released compress inode serial: sh-sci: protect invalidating RXDMA on shutdown libsubcmd: Fix parse-options memory leak s390/ipl: Fix incorrect initialization of len fields in nvme reipl block s390/ipl: Fix incorrect initialization of nvme dump block Input: ims-pcu - fix printf string overflow Input: ioc3kbd - convert to platform remove callback returning void Input: ioc3kbd - add device table mmc: sdhci_am654: Add tuning algorithm for delay chain mmc: sdhci_am654: Write ITAPDLY for DDR52 timing mmc: sdhci_am654: Drop lookup for deprecated ti,otap-del-sel mmc: sdhci_am654: Add OTAP/ITAP delay enable mmc: sdhci_am654: Add ITAPDLYSEL in sdhci_j721e_4bit_set_clock mmc: sdhci_am654: Fix ITAPDLY for HS400 timing Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation drm/msm/dpu: Always flush the slave INTF on the CTL um: Fix return value in ubd_init() um: Add winch to winch_handlers before registering winch IRQ um: vector: fix bpfflash parameter evaluation drm/bridge: tc358775: fix support for jeida-18 and jeida-24 media: stk1160: fix bounds checking in stk1160_copy_video() scsi: qla2xxx: Replace all non-returning strlcpy() with strscpy() media: flexcop-usb: clean up endpoint sanity checks media: flexcop-usb: fix sanity check of bNumEndpoints powerpc/pseries: Add failure related checks for h_get_mpp and h_get_ppp um: Fix the -Wmissing-prototypes warning for __switch_mm media: cec: cec-adap: always cancel work in cec_transmit_msg_fh media: cec: cec-api: add locking in cec_release() media: core headers: fix kernel-doc warnings media: cec: fix a deadlock situation media: cec: call enable_adap on s_log_addrs media: cec: abort if the current transmit was canceled media: cec: correctly pass on reply results media: cec: use call_op and check for !unregistered media: cec-adap.c: drop activate_cnt, use state info instead media: cec: core: avoid recursive cec_claim_log_addrs media: cec: core: avoid confusing "transmit timed out" message null_blk: Fix the WARNING: modpost: missing MODULE_DESCRIPTION() regulator: bd71828: Don't overwrite runtime voltages x86/kconfig: Select ARCH_WANT_FRAME_POINTERS again when UNWINDER_FRAME_POINTER=y nfc: nci: Fix uninit-value in nci_rx_work ASoC: tas2552: Add TX path for capturing AUDIO-OUT data sunrpc: fix NFSACL RPC retry on soft mount rpcrdma: fix handling for RDMA_CM_EVENT_DEVICE_REMOVAL ipv6: sr: fix memleak in seg6_hmac_init_algo params: lift param_set_uint_minmax to common code tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). openvswitch: Set the skbuff pkt_type for proper pmtud support. arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY virtio: delete vq in vp_find_vqs_msix() when request_irq() fails net: fec: avoid lock evasion when reading pps_enable tls: fix missing memory barrier in tls_init nfc: nci: Fix kcov check in nci_rx_work() nfc: nci: Fix handling of zero-length payload packets in nci_rx_work() netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() netfilter: nft_payload: restore vlan q-in-q match support spi: Don't mark message DMA mapped when no transfer in it is nvmet: fix ns enable/disable possible hang net/mlx5e: Use rx_missed_errors instead of rx_dropped for reporting buffer exhaustion dma-buf/sw-sync: don't enable IRQ from sync_print_obj() bpf: Fix potential integer overflow in resolve_btfids enic: Validate length of nl attributes in enic_set_vf_port net: usb: smsc95xx: fix changing LED_SEL bit value updated from EEPROM bpf: Allow delete from sockmap/sockhash only if update is allowed net:fec: Add fec_enet_deinit() netfilter: tproxy: bail out if IP has been disabled on the device kconfig: fix comparison to constant symbols, 'm', 'n' spi: stm32: Don't warn about spurious interrupts ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound hwmon: (shtc1) Fix property misspelling ALSA: timer: Set lower bound of start tick time genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline media: cec: core: add adap_nb_transmit_canceled() callback SUNRPC: Fix loop termination condition in gss_free_in_token_pages() binder: fix max_thread type inconsistency mmc: core: Do not force a retune before RPMB switch io_uring: fail NOP if non-zero op flags is passed in afs: Don't cross .backup mountpoint from backup volume nilfs2: fix use-after-free of timer for log writer thread vxlan: Fix regression when dropping packets due to invalid src addresses x86/mm: Remove broken vsyscall emulation code from the page fault code netfilter: nf_tables: restrict tunnel object to NFPROTO_NETDEV netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode() media: lgdt3306a: Add a check against null-pointer-def drm/amdgpu: add error handle to avoid out-of-bounds ata: pata_legacy: make legacy_exit() work again ACPI: resource: Do IRQ override on TongFang GXxHRXx and GMxHGxx arm64: tegra: Correct Tegra132 I2C alias arm64: dts: qcom: qcs404: fix bluetooth device address md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING wifi: rtl8xxxu: Fix the TX power of RTL8192CU, RTL8723AU wifi: rtlwifi: rtl8192de: Fix low speed with WPA3-SAE wifi: rtlwifi: rtl8192de: Fix endianness issue in RX path arm64: dts: hi3798cv200: fix the size of GICR media: mc: mark the media devnode as registered from the, start media: mxl5xx: Move xpt structures off stack media: v4l2-core: hold videodev_lock until dev reg, finishes mmc: core: Add mmc_gpiod_set_cd_config() function mmc: sdhci-acpi: Sort DMI quirks alphabetically mmc: sdhci-acpi: Fix Lenovo Yoga Tablet 2 Pro 1380 sdcard slot not working mmc: sdhci-acpi: Disable write protect detection on Toshiba WT10-A fbdev: savage: Handle err return when savagefb_check_var failed KVM: arm64: Allow AArch32 PSTATE.M to be restored as System mode crypto: ecrdsa - Fix module auto-load on add_key crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak net/ipv6: Fix route deleting failure when metric equals 0 net/9p: fix uninit-value in p9_client_rpc() intel_th: pci: Add Meteor Lake-S CPU support sparc64: Fix number of online CPUs watchdog: rti_wdt: Set min_hw_heartbeat_ms to accommodate a safety margin kdb: Fix buffer overflow during tab-complete kdb: Use format-strings rather than '\0' injection in kdb_read() kdb: Fix console handling when editing and tab-completing commands kdb: Merge identical case statements in kdb_read() kdb: Use format-specifiers rather than memset() for padding in kdb_read() net: fix __dst_negative_advice() race sparc: move struct termio to asm/termios.h ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() s390/ap: Fix crash in AP internal function modify_bitmap() nfs: fix undefined behavior in nfs_block_bits() NFS: Fix READ_PLUS when server doesn't support OP_READ_PLUS scsi: ufs: ufs-qcom: Clear qunipro_g4_sel for HW major version > 5 f2fs: compress: fix compression chksum RDMA/hns: Use mutex instead of spinlock for ida allocation RDMA/hns: Fix CQ and QP cache affinity Linux 5.10.219 Change-Id: I0e21ff44d28df2a2802a9fb35f0959bb5ab528fc Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-07-10 14:41:23 +00:00
Christian Brauner	b0fa673c8c	fs: add file and path permissions helpers ... [ Upstream commit 02f92b3868a1b34ab98464e76b0e4e060474ba10 ] Add two simple helpers to check permissions on a file and path respectively and convert over some callers. It simplifies quite a few codepaths and also reduces the churn in later patches quite a bit. Christoph also correctly points out that this makes codepaths (e.g. ioctls) way easier to follow that would otherwise have to do more complex argument passing than necessary. Link: https://lore.kernel.org/r/20210121131959.646623-4-christian.brauner@ubuntu.com Cc: David Howells <dhowells@redhat.com> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: linux-fsdevel@vger.kernel.org Suggested-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: James Morris <jamorris@linux.microsoft.com> Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2024-06-21 14:52:58 +02:00
Breno Leitao	4d51845d73	af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg ... [ Upstream commit 540bf24fba16b88c1b3b9353927204b4f1074e25 ] A data-race condition has been identified in af_unix. In one data path, the write function unix_release_sock() atomically writes to sk->sk_shutdown using WRITE_ONCE. However, on the reader side, unix_stream_sendmsg() does not read it atomically. Consequently, this issue is causing the following KCSAN splat to occur: BUG: KCSAN: data-race in unix_release_sock / unix_stream_sendmsg write (marked) to 0xffff88867256ddbb of 1 bytes by task 7270 on cpu 28: unix_release_sock (net/unix/af_unix.c:640) unix_release (net/unix/af_unix.c:1050) sock_close (net/socket.c:659 net/socket.c:1421) __fput (fs/file_table.c:422) __fput_sync (fs/file_table.c:508) __se_sys_close (fs/open.c:1559 fs/open.c:1541) __x64_sys_close (fs/open.c:1541) x64_sys_call (arch/x86/entry/syscall_64.c:33) do_syscall_64 (arch/x86/entry/common.c:?) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) read to 0xffff88867256ddbb of 1 bytes by task 989 on cpu 14: unix_stream_sendmsg (net/unix/af_unix.c:2273) __sock_sendmsg (net/socket.c:730 net/socket.c:745) ____sys_sendmsg (net/socket.c:2584) __sys_sendmmsg (net/socket.c:2638 net/socket.c:2724) __x64_sys_sendmmsg (net/socket.c:2753 net/socket.c:2750 net/socket.c:2750) x64_sys_call (arch/x86/entry/syscall_64.c:33) do_syscall_64 (arch/x86/entry/common.c:?) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) value changed: 0x01 -> 0x03 The line numbers are related to commit dd5a440a31fa ("Linux 6.9-rc7"). Commit e1d09c2c2f57 ("af_unix: Fix data races around sk->sk_shutdown.") addressed a comparable issue in the past regarding sk->sk_shutdown. However, it overlooked resolving this particular data path. This patch only offending unix_stream_sendmsg() function, since the other reads seem to be protected by unix_state_lock() as discussed in Link: https://lore.kernel.org/all/20240508173324.53565-1-kuniyu@amazon.com/ Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Signed-off-by: Breno Leitao <leitao@debian.org> Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com> Link: https://lore.kernel.org/r/20240509081459.2807828-1-leitao@debian.org Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2024-06-16 13:32:09 +02:00
Greg Kroah-Hartman	c15c1199d6	Merge 5.10.216 into android12-5.10-lts ... Changes in 5.10.216 batman-adv: Avoid infinite loop trying to resize local TT Bluetooth: Fix memory leak in hci_req_sync_complete() media: cec: core: remove length check of Timer Status nouveau: fix function cast warning net: openvswitch: fix unwanted error log on timeout policy probing u64_stats: fix u64_stats_init() for lockdep when used repeatedly in one file xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING geneve: fix header validation in geneve[6]_xmit_skb octeontx2-af: Fix NIX SQ mode and BP config ipv6: fib: hide unused 'pn' variable ipv4/route: avoid unused-but-set-variable warning ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr Bluetooth: SCO: Fix not validating setsockopt user input netfilter: complete validation of user input net/mlx5: Properly link new fs rules into the tree af_unix: Do not use atomic ops for unix_sk(sk)->inflight. af_unix: Fix garbage collector racing against connect() net: ena: Fix potential sign extension issue net: ena: Wrong missing IO completions check order net: ena: Fix incorrect descriptor free behavior iommu/vt-d: Allocate local memory for page request queue mailbox: imx: fix suspend failue btrfs: qgroup: correctly model root qgroup rsv in convert drm/client: Fully protect modes[] with dev->mode_config.mutex vhost: Add smp_rmb() in vhost_vq_avail_empty() x86/cpu: Actually turn off mitigations by default for SPECULATION_MITIGATIONS=n selftests: timers: Fix abs() warning in posix_timers test x86/apic: Force native_apic_mem_read() to use the MOV instruction irqflags: Explicitly ignore lockdep_hrtimer_exit() argument btrfs: record delayed inode root in transaction riscv: Enable per-task stack canaries riscv: process: Fix kernel gp leakage selftests/ftrace: Limit length in subsystem-enable tests kprobes: Fix possible use-after-free issue on kprobe registration Revert "tracing/trigger: Fix to return error if failed to alloc snapshot" netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() netfilter: nft_set_pipapo: do not free live element tun: limit printing rate when illegal packet received by tun dev RDMA/rxe: Fix the problem "mutex_destroy missing" RDMA/cm: Print the old state when cm_destroy_id gets timeout RDMA/mlx5: Fix port number for counter query in multi-port configuration drm: nv04: Fix out of bounds access drm/panel: visionox-rm69299: don't unregister DSI device clk: Remove prepare_lock hold assertion in __clk_release() clk: Mark 'all_lists' as const clk: remove extra empty line clk: Print an info line before disabling unused clocks clk: Initialize struct clk_core kref earlier clk: Get runtime PM before walking tree during disable_unused x86/cpufeatures: Fix dependencies for GFNI, VAES, and VPCLMULQDQ binder: check offset alignment in binder_get_object() thunderbolt: Avoid notify PM core about runtime PM resume thunderbolt: Fix wake configurations after device unplug comedi: vmk80xx: fix incomplete endpoint checking serial/pmac_zilog: Remove flawed mitigation for rx irq flood USB: serial: option: add Fibocom FM135-GL variants USB: serial: option: add support for Fibocom FM650/FG650 USB: serial: option: add Lonsung U8300/U9300 product USB: serial: option: support Quectel EM060K sub-models USB: serial: option: add Rolling RW101-GL and RW135-GL support USB: serial: option: add Telit FN920C04 rmnet compositions Revert "usb: cdc-wdm: close race between read and workqueue" usb: dwc2: host: Fix dereference issue in DDMA completion flow. usb: Disable USB3 LPM at shutdown mei: me: disable RPL-S on SPS and IGN firmwares speakup: Avoid crash on very long word fs: sysfs: Fix reference leak in sysfs_break_active_protection() init/main.c: Fix potential static_command_line memory overflow drm/amdgpu: validate the parameters of bo mapping operations more clearly nouveau: fix instmem race condition around ptr stores nilfs2: fix OOB in nilfs_set_de_type arm64: dts: rockchip: fix alphabetical ordering RK3399 puma arm64: dts: rockchip: enable internal pull-up on PCIE_WAKE# for RK3399 Puma arm64: dts: rockchip: Remove unsupported node from the Pinebook Pro dts arm64: dts: mediatek: mt7622: add support for coherent DMA arm64: dts: mediatek: mt7622: introduce nodes for Wireless Ethernet Dispatch arm64: dts: mediatek: mt7622: fix clock controllers arm64: dts: mediatek: mt7622: fix IR nodename arm64: dts: mediatek: mt7622: fix ethernet controller "compatible" arm64: dts: mediatek: mt7622: drop "reset-names" from thermal block arm64: dts: mediatek: mt2712: fix validation errors ARC: [plat-hsdk]: Remove misplaced interrupt-cells property wifi: iwlwifi: mvm: remove old PASN station when adding a new one vxlan: drop packets from invalid src-address mlxsw: core: Unregister EMAD trap using FORWARD action NFC: trf7970a: disable all regulators on removal ipv4: check for NULL idev in ip_route_use_hint() net: usb: ax88179_178a: stop lying about skb->truesize net: gtp: Fix Use-After-Free in gtp_dellink ipvs: Fix checksumming on GSO of SCTP packets net: openvswitch: Fix Use-After-Free in ovs_ct_exit mlxsw: spectrum_acl_tcam: Fix race during rehash delayed work mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash mlxsw: spectrum_acl_tcam: Rate limit error message mlxsw: spectrum_acl_tcam: Fix memory leak during rehash mlxsw: spectrum_acl_tcam: Fix warning during rehash mlxsw: spectrum_acl_tcam: Fix incorrect list API usage mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work netfilter: nf_tables: honor table dormant flag from netdev release event path i40e: Do not use WQ_MEM_RECLAIM flag for workqueue i40e: Report MFS in decimal base instead of hex iavf: Fix TC config comparison with existing adapter TC config net: ethernet: ti: am65-cpts: Fix PTPv1 message type on TX packets af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc(). serial: core: Provide port lock wrappers serial: mxs-auart: add spinlock around changing cts state Revert "crypto: api - Disallow identical driver names" net/mlx5e: Fix a race in command alloc flow tracing: Show size of requested perf buffer tracing: Increase PERF_MAX_TRACE_SIZE to handle Sentinel1 and docker together PM / devfreq: Fix buffer overflow in trans_stat_show Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old() Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0bda:0x4853 btrfs: fix information leak in btrfs_ioctl_logical_to_ino() cpu: Re-enable CPU mitigations by default for !X86 architectures arm64: dts: rockchip: enable internal pull-up for Q7_THRM# on RK3399 Puma drm/amdgpu/sdma5.2: use legacy HDP flush for SDMA2/3 drm/amdgpu: Fix leak when GPU memory allocation fails irqchip/gic-v3-its: Prevent double free on error ethernet: Add helper for assigning packet type when dest address does not match device address net: b44: set pause params only when interface is up stackdepot: respect __GFP_NOLOCKDEP allocation flag mtd: diskonchip: work around ubsan link failure tcp: Clean up kernel listener's reqsk in inet_twsk_purge() tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge() dmaengine: owl: fix register access functions idma64: Don't try to serve interrupts when device is powered off dma: xilinx_dpdma: Fix locking riscv: fix VMALLOC_START definition riscv: Fix TASK_SIZE on 64-bit NOMMU i2c: smbus: fix NULL function pointer dereference HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up bounds: Use the right number of bits for power-of-two CONFIG_NR_CPUS udp: preserve the connected status if only UDP cmsg serial: core: fix kernel-doc for uart_port_unlock_irqrestore() riscv: Disable STACKPROTECTOR_PER_TASK if GCC_PLUGIN_RANDSTRUCT is enabled Linux 5.10.216 Change-Id: Ia2bf3ba6ed3f36a56f71543442427eb770a2400b Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-06-13 16:02:17 +00:00
Kuniyuki Iwashima	14bea27d1c	af_unix: Do not use atomic ops for unix_sk(sk)->inflight. ... [ Upstream commit 97af84a6bba2ab2b9c704c08e67de3b5ea551bb2 ] When touching unix_sk(sk)->inflight, we are always under spin_lock(&unix_gc_lock). Let's convert unix_sk(sk)->inflight to the normal unsigned long. Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://lore.kernel.org/r/20240123170856.41348-3-kuniyu@amazon.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Stable-dep-of: 47d8ac011fe1 ("af_unix: Fix garbage collector racing against connect()") Signed-off-by: Sasha Levin <sashal@kernel.org>	2024-05-02 16:23:34 +02:00
Greg Kroah-Hartman	66e91da883	Merge 5.10.210 into android12-5.10-lts ... Changes in 5.10.210 usb: cdns3: Fixes for sparse warnings usb: cdns3: fix uvc failure work since sg support enabled usb: cdns3: fix incorrect calculation of ep_buf_size when more than one config usb: cdns3: fix iso transfer error when mult is not zero usb: cdns3: Fix uvc fail when DMA cross 4k boundery since sg enabled PCI: mediatek: Clear interrupt status before dispatching handler units: change from 'L' to 'UL' units: add the HZ macros serial: sc16is7xx: set safe default SPI clock frequency spi: introduce SPI_MODE_X_MASK macro serial: sc16is7xx: add check for unsupported SPI modes during probe iio: adc: ad7091r: Set alert bit in config register iio: adc: ad7091r: Allow users to configure device events iio: adc: ad7091r: Enable internal vref if external vref is not supplied dmaengine: fix NULL pointer in channel unregistration function iio:adc:ad7091r: Move exports into IIO_AD7091R namespace. ext4: allow for the last group to be marked as trimmed crypto: api - Disallow identical driver names PM: hibernate: Enforce ordering during image compression/decompression hwrng: core - Fix page fault dead lock on mmap-ed hwrng crypto: s390/aes - Fix buffer overread in CTR mode rpmsg: virtio: Free driver_override when rpmsg_remove() bus: mhi: host: Drop chan lock before queuing buffers parisc/firmware: Fix F-extend for PDC addresses async: Split async_schedule_node_domain() async: Introduce async_schedule_dev_nocall() arm64: dts: qcom: sdm845: fix USB wakeup interrupt types arm64: dts: qcom: sdm845: fix USB DP/DM HS PHY interrupts lsm: new security_file_ioctl_compat() hook scripts/get_abi: fix source path leak mmc: core: Use mrq.sbc in close-ended ffu mmc: mmc_spi: remove custom DMA mapped buffers rtc: Adjust failure return code for cmos_set_alarm() nouveau/vmm: don't set addr on the fail path to avoid warning ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path rename(): fix the locking of subdirectories block: Remove special-casing of compound pages stddef: Introduce DECLARE_FLEX_ARRAY() helper smb3: Replace smb2pdu 1-element arrays with flex-arrays mm: vmalloc: introduce array allocation functions KVM: use __vcalloc for very large allocations net/smc: fix illegal rmb_desc access in SMC-D connection dump tcp: make sure init the accept_queue's spinlocks once bnxt_en: Wait for FLR to complete during probe vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING llc: make llc_ui_sendmsg() more robust against bonding changes llc: Drop support for ETH_P_TR_802_2. net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv tracing: Ensure visibility when inserting an element into tracing_map afs: Hide silly-rename files from userspace tcp: Add memory barrier to tcp_push() netlink: fix potential sleeping issue in mqueue_flush_file ipv6: init the accept_queue's spinlocks in inet6_create net/mlx5: DR, Use the right GVMI number for drop action net/mlx5e: fix a double-free in arfs_create_groups netfilter: nf_tables: restrict anonymous set and map names to 16 bytes netfilter: nf_tables: validate NFPROTO_* family net: mvpp2: clear BM pool before initialization selftests: netdevsim: fix the udp_tunnel_nic test fjes: fix memleaks in fjes_hw_setup net: fec: fix the unhandled context fault from smmu btrfs: ref-verify: free ref cache before clearing mount opt btrfs: tree-checker: fix inline ref size in error messages btrfs: don't warn if discard range is not aligned to sector btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args btrfs: don't abort filesystem when attempting to snapshot deleted subvolume rbd: don't move requests to the running list on errors exec: Fix error handling in begin_new_exec() wifi: iwlwifi: fix a memory corruption netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain netfilter: nf_tables: reject QUEUE/DROP verdict parameters gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-04 drm: Don't unref the same fb many times by mistake due to deadlock handling drm/bridge: nxp-ptn3460: fix i2c_master_send() error checking drm/tidss: Fix atomic_flush check drm/bridge: nxp-ptn3460: simplify some error checking PM: sleep: Use dev_printk() when possible PM: sleep: Avoid calling put_device() under dpm_list_mtx PM: core: Remove unnecessary (void *) conversions PM: sleep: Fix possible deadlocks in core system-wide PM code fs/pipe: move check to pipe_has_watch_queue() pipe: wakeup wr_wait after setting max_usage ARM: dts: samsung: exynos4210-i9100: Unconditionally enable LDO12 arm64: dts: qcom: sc7180: Use pdc interrupts for USB instead of GIC interrupts arm64: dts: qcom: sc7180: fix USB wakeup interrupt types media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run mm: use __pfn_to_section() instead of open coding it mm/sparsemem: fix race in accessing memory_section->usage btrfs: remove err variable from btrfs_delete_subvolume btrfs: avoid copying BTRFS_ROOT_SUBVOL_DEAD flag to snapshot of subvolume being deleted drm: panel-simple: add missing bus flags for Tianma tm070jvhg[30/33] drm/exynos: fix accidental on-stack copy of exynos_drm_plane drm/exynos: gsc: minor fix for loop iteration in gsc_runtime_resume gpio: eic-sprd: Clear interrupt after set the interrupt type spi: bcm-qspi: fix SFDP BFPT read by usig mspi read mips: Call lose_fpu(0) before initializing fcr31 in mips_set_personality_nan tick/sched: Preserve number of idle sleeps across CPU hotplug events x86/entry/ia32: Ensure s32 is sign extended to s64 powerpc/mm: Fix null-pointer dereference in pgtable_cache_add drivers/perf: pmuv3: don't expose SW_INCR event in sysfs powerpc: Fix build error due to is_valid_bugaddr() powerpc/mm: Fix build failures due to arch_reserved_kernel_pages() x86/boot: Ignore NMIs during very early boot powerpc: pmd_move_must_withdraw() is only needed for CONFIG_TRANSPARENT_HUGEPAGE powerpc/lib: Validate size for vector operations x86/mce: Mark fatal MCE's page as poison to avoid panic in the kdump kernel perf/core: Fix narrow startup race when creating the perf nr_addr_filters sysfs file debugobjects: Stop accessing objects after releasing hash bucket lock regulator: core: Only increment use_count when enable_count changes audit: Send netlink ACK before setting connection in auditd_set ACPI: video: Add quirk for the Colorful X15 AT 23 Laptop PNP: ACPI: fix fortify warning ACPI: extlog: fix NULL pointer dereference check PM / devfreq: Synchronize devfreq_monitor_[start/stop] ACPI: APEI: set memory failure flags as MF_ACTION_REQUIRED on synchronous events FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree UBSAN: array-index-out-of-bounds in dtSplitRoot jfs: fix slab-out-of-bounds Read in dtSearch jfs: fix array-index-out-of-bounds in dbAdjTree jfs: fix uaf in jfs_evict_inode pstore/ram: Fix crash when setting number of cpus to an odd number crypto: stm32/crc32 - fix parsing list of devices afs: fix the usage of read_seqbegin_or_lock() in afs_lookup_volume_rcu() afs: fix the usage of read_seqbegin_or_lock() in afs_find_server*() rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock() jfs: fix array-index-out-of-bounds in diNewExt s390/ptrace: handle setting of fpc register correctly KVM: s390: fix setting of fpc register SUNRPC: Fix a suspicious RCU usage warning ecryptfs: Reject casefold directory inodes ext4: fix inconsistent between segment fstrim and full fstrim ext4: unify the type of flexbg_size to unsigned int ext4: remove unnecessary check from alloc_flex_gd() ext4: avoid online resizing failures due to oversized flex bg wifi: rt2x00: restart beacon queue when hardware reset selftests/bpf: satisfy compiler by having explicit return in btf test selftests/bpf: Fix pyperf180 compilation failure with clang18 scsi: lpfc: Fix possible file string name overflow when updating firmware PCI: Add no PM reset quirk for NVIDIA Spectrum devices bonding: return -ENOMEM instead of BUG in alb_upper_dev_walk scsi: arcmsr: Support new PCI device IDs 1883 and 1886 ARM: dts: imx7d: Fix coresight funnel ports ARM: dts: imx7s: Fix lcdif compatible ARM: dts: imx7s: Fix nand-controller #size-cells wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() bpf: Add map and need_defer parameters to .map_fd_put_ptr() scsi: libfc: Don't schedule abort twice scsi: libfc: Fix up timeout error in fc_fcp_rec_error() bpf: Set uattr->batch.count as zero before batched update or deletion ARM: dts: rockchip: fix rk3036 hdmi ports node ARM: dts: imx25/27-eukrea: Fix RTC node name ARM: dts: imx: Use flash@0,0 pattern ARM: dts: imx27: Fix sram node ARM: dts: imx1: Fix sram node ionic: pass opcode to devcmd_wait block/rnbd-srv: Check for unlikely string overflow ARM: dts: imx25: Fix the iim compatible string ARM: dts: imx25/27: Pass timing0 ARM: dts: imx27-apf27dev: Fix LED name ARM: dts: imx23-sansa: Use preferred i2c-gpios properties ARM: dts: imx23/28: Fix the DMA controller node name net: dsa: mv88e6xxx: Fix mv88e6352_serdes_get_stats error path block: prevent an integer overflow in bvec_try_merge_hw_page md: Whenassemble the array, consult the superblock of the freshest device arm64: dts: qcom: msm8996: Fix 'in-ports' is a required property arm64: dts: qcom: msm8998: Fix 'out-ports' is a required property wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift() wifi: cfg80211: free beacon_ies when overridden from hidden BSS Bluetooth: qca: Set both WIDEBAND_SPEECH and LE_STATES quirks for QCA2066 Bluetooth: L2CAP: Fix possible multiple reject send i40e: Fix VF disable behavior to block all traffic f2fs: fix to check return value of f2fs_reserve_new_block() ALSA: hda: Refer to correct stream index at loops ASoC: doc: Fix undefined SND_SOC_DAPM_NOPM argument fast_dput(): handle underflows gracefully RDMA/IPoIB: Fix error code return in ipoib_mcast_join drm/amd/display: Fix tiled display misalignment f2fs: fix write pointers on zoned device after roll forward drm/drm_file: fix use of uninitialized variable drm/framebuffer: Fix use of uninitialized variable drm/mipi-dsi: Fix detach call without attach media: stk1160: Fixed high volume of stk1160_dbg messages media: rockchip: rga: fix swizzling for RGB formats PCI: add INTEL_HDA_ARL to pci_ids.h ALSA: hda: Intel: add HDA_ARL PCI ID support ALSA: hda: intel-dspcfg: add filters for ARL-S and ARL drm/exynos: Call drm_atomic_helper_shutdown() at shutdown/unbind time IB/ipoib: Fix mcast list locking media: ddbridge: fix an error code problem in ddb_probe drm/msm/dpu: Ratelimit framedone timeout msgs clk: hi3620: Fix memory leak in hi3620_mmc_clk_init() clk: mmp: pxa168: Fix memory leak in pxa168_clk_init() watchdog: it87_wdt: Keep WDTCTRL bit 3 unmodified for IT8784/IT8786 drm/amdgpu: Let KFD sync with VM fences drm/amdgpu: Drop 'fence' check in 'to_amdgpu_amdkfd_fence()' leds: trigger: panic: Don't register panic notifier if creating the trigger failed um: Fix naming clash between UML and scheduler um: Don't use vfprintf() for os_info() um: net: Fix return type of uml_net_start_xmit() i3c: master: cdns: Update maximum prescaler value for i2c clock xen/gntdev: Fix the abuse of underlying struct page in DMA-buf import mfd: ti_am335x_tscadc: Fix TI SoC dependencies PCI: Only override AMD USB controller if required PCI: switchtec: Fix stdev_release() crash after surprise hot remove usb: hub: Replace hardcoded quirk value with BIT() macro tty: allow TIOCSLCKTRMIOS with CAP_CHECKPOINT_RESTORE fs/kernfs/dir: obey S_ISGID PCI/AER: Decode Requester ID when no error info found libsubcmd: Fix memory leak in uniq() virtio_net: Fix "‘%d’ directive writing between 1 and 11 bytes into a region of size 10" warnings blk-mq: fix IO hang from sbitmap wakeup race ceph: fix deadlock or deadcode of misusing dget() drm/amd/powerplay: Fix kzalloc parameter 'ATOM_Tonga_PPM_Table' in 'get_platform_power_management_table()' drm/amdgpu: Release 'adev->pm.fw' before return in 'amdgpu_device_need_post()' perf: Fix the nr_addr_filters fix wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update drm: using mul_u32_u32() requires linux/math64.h scsi: isci: Fix an error code problem in isci_io_request_build() scsi: core: Introduce enum scsi_disposition scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler ip6_tunnel: use dev_sw_netstats_rx_add() ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv() net-zerocopy: Refactor frag-is-remappable test. tcp: add sanity checks to rx zerocopy ixgbe: Remove non-inclusive language ixgbe: Refactor returning internal error codes ixgbe: Refactor overtemp event handling ixgbe: Fix an error handling path in ixgbe_read_iosf_sb_reg_x550() ipv6: Ensure natural alignment of const ipv6 loopback and router addresses llc: call sock_orphan() at release time netfilter: nf_log: replace BUG_ON by WARN_ON_ONCE when putting logger netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations net: ipv4: fix a memleak in ip_setup_cork af_unix: fix lockdep positive in sk_diag_dump_icons() net: sysfs: Fix /sys/class/net/<iface> path HID: apple: Add support for the 2021 Magic Keyboard HID: apple: Add 2021 magic keyboard FN key mapping bonding: remove print in bond_verify_device_path uapi: stddef.h: Fix __DECLARE_FLEX_ARRAY for C++ PM: sleep: Fix error handling in dpm_prepare() dmaengine: fsl-dpaa2-qdma: Fix the size of dma pools dmaengine: ti: k3-udma: Report short packet errors dmaengine: fsl-qdma: Fix a memory leak related to the status queue DMA dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA phy: renesas: rcar-gen3-usb2: Fix returning wrong error code dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP drm/msm/dp: return correct Colorimetry for DP_TEST_DYNAMIC_RANGE_CEA case net: stmmac: xgmac: fix handling of DPP safety error for DMA channels selftests: net: avoid just another constant wait tunnels: fix out of bounds access when building IPv6 PMTU error atm: idt77252: fix a memleak in open_card_ubr0 hwmon: (aspeed-pwm-tacho) mutex for tach reading hwmon: (coretemp) Fix out-of-bounds memory access hwmon: (coretemp) Fix bogus core_id to attr name mapping inet: read sk->sk_family once in inet_recv_error() rxrpc: Fix response to PING RESPONSE ACKs to a dead call tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() ppp_async: limit MRU to 64K netfilter: nft_compat: reject unused compat flag netfilter: nft_compat: restrict match/target protocol to u16 netfilter: nft_ct: reject direction for ct id netfilter: nft_set_pipapo: store index in scratch maps netfilter: nft_set_pipapo: add helper to release pcpu scratch area netfilter: nft_set_pipapo: remove scratch_aligned pointer scsi: core: Move scsi_host_busy() out of host lock if it is for per-command blk-iocost: Fix an UBSAN shift-out-of-bounds warning net/af_iucv: clean up a try_then_request_module() USB: serial: qcserial: add new usb-id for Dell Wireless DW5826e USB: serial: option: add Fibocom FM101-GL variant USB: serial: cp210x: add ID for IMST iM871A-USB usb: host: xhci-plat: Add support for XHCI_SG_TRB_CACHE_SIZE_QUIRK hrtimer: Report offline hrtimer enqueue Input: i8042 - fix strange behavior of touchpad on Clevo NS70PU Input: atkbd - skip ATKBD_CMD_SETLEDS when skipping ATKBD_CMD_GETID vhost: use kzalloc() instead of kmalloc() followed by memset() clocksource: Skip watchdog check for large watchdog intervals net: stmmac: xgmac: use #define for string constants net: stmmac: xgmac: fix a typo of register name in DPP safety handling netfilter: nft_set_rbtree: skip end interval element from gc btrfs: forbid creating subvol qgroups btrfs: do not ASSERT() if the newly created subvolume already got read btrfs: forbid deleting live subvol qgroup btrfs: send: return EOPNOTSUPP on unknown flags of: unittest: Fix compile in the non-dynamic case net: openvswitch: limit the number of recursions from action sets spi: ppc4xx: Drop write-only variable ASoC: rt5645: Fix deadlock in rt5645_jack_detect_work() net: sysfs: Fix /sys/class/net/<iface> path for statistics MIPS: Add 'memory' clobber to csum_ipv6_magic() inline assembler i40e: Fix waiting for queues of all VSIs to be disabled tracing/trigger: Fix to return error if failed to alloc snapshot mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again ALSA: hda/realtek: Fix the external mic not being recognised for Acer Swift 1 SF114-32 ALSA: hda/realtek: Enable Mute LED on HP Laptop 14-fq0xxx HID: wacom: generic: Avoid reporting a serial of '0' to userspace HID: wacom: Do not register input devices until after hid_hw_start usb: ucsi_acpi: Fix command completion handling USB: hub: check for alternate port before enabling A_ALT_HNP_SUPPORT usb: f_mass_storage: forbid async queue when shutdown happen media: ir_toy: fix a memleak in irtoy_tx powerpc/kasan: Fix addr error caused by page alignment i2c: i801: Remove i801_set_block_buffer_mode i2c: i801: Fix block process call transactions modpost: trim leading spaces when processing source files list scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock" lsm: fix the logic in security_inode_getsecctx() firewire: core: correct documentation of fw_csr_string() kernel API kbuild: Fix changing ELF file type for output of gen_btf for big endian nfc: nci: free rx_data_reassembly skb on NCI device cleanup net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame() xen-netback: properly sync TX responses ALSA: hda/realtek: Enable headset mic on Vaio VJFE-ADL binder: signal epoll threads of self-work misc: fastrpc: Mark all sessions as invalid in cb_remove ext4: fix double-free of blocks due to wrong extents moved_len tracing: Fix wasted memory in saved_cmdlines logic staging: iio: ad5933: fix type mismatch regression iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC iio: accel: bma400: Fix a compilation problem media: rc: bpf attach/detach requires write permission hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove ring-buffer: Clean ring_buffer_poll_wait() error return serial: max310x: set default value when reading clock ready bit serial: max310x: improve crystal stable clock detection x86/Kconfig: Transmeta Crusoe is CPU family 5, not 6 x86/mm/ident_map: Use gbpages only where full GB page should be mapped. mmc: slot-gpio: Allow non-sleeping GPIO ro ALSA: hda/conexant: Add quirk for SWS JS201D nilfs2: fix data corruption in dsync block recovery for small block sizes nilfs2: fix hang in nilfs_lookup_dirty_data_buffers() crypto: ccp - Fix null pointer dereference in __sev_platform_shutdown_locked nfp: use correct macro for LengthSelect in BAR config nfp: flower: prevent re-adding mac index for bonded port wifi: mac80211: reload info pointer in ieee80211_tx_dequeue() irqchip/irq-brcmstb-l2: Add write memory barrier before exit irqchip/gic-v3-its: Fix GICv4.1 VPE affinity update s390/qeth: Fix potential loss of L3-IP@ in case of network issues ceph: prevent use-after-free in encode_cap_msg() of: property: fix typo in io-channels can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER) pmdomain: core: Move the unused cleanup to a _sync initcall tracing: Inform kmemleak of saved_cmdlines allocation Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d" bus: moxtet: Add spi device table PCI: dwc: endpoint: Fix dw_pcie_ep_raise_msix_irq() alignment support mips: Fix max_mapnr being uninitialized on early stages crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init serial: Add rs485_supported to uart_port serial: 8250_exar: Fill in rs485_supported serial: 8250_exar: Set missing rs485_supported flag scripts/decode_stacktrace.sh: silence stderr messages from addr2line/nm scripts/decode_stacktrace.sh: support old bash version scripts: decode_stacktrace: demangle Rust symbols scripts/decode_stacktrace.sh: optionally use LLVM utilities netfilter: ipset: fix performance regression in swap operation netfilter: ipset: Missing gc cancellations fixed hrtimer: Ignore slack time for RT tasks in schedule_hrtimeout_range() Revert "arm64: Stash shadow stack pointer in the task struct on interrupt" net: prevent mss overflow in skb_segment() sched/membarrier: reduce the ability to hammer on sys_membarrier nilfs2: fix potential bug in end_buffer_async_write nilfs2: replace WARN_ONs for invalid DAT metadata block requests dm: limit the number of targets and parameter size area PM: runtime: add devm_pm_runtime_enable helper PM: runtime: Have devm_pm_runtime_enable() handle pm_runtime_dont_use_autosuspend() drm/msm/dsi: Enable runtime PM netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval() net: bcmgenet: Fix EEE implementation PCI: dwc: Fix a 64bit bug in dw_pcie_ep_raise_msix_irq() Linux 5.10.210 Change-Id: I5e7327f58dd6abd26ac2b1e328a81c1010d1147c Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2024-04-10 07:10:03 +00:00
Eric Dumazet	f199018dc7	af_unix: fix lockdep positive in sk_diag_dump_icons() ... [ Upstream commit 4d322dce82a1d44f8c83f0f54f95dd1b8dcf46c9 ] syzbot reported a lockdep splat [1]. Blamed commit hinted about the possible lockdep violation, and code used unix_state_lock_nested() in an attempt to silence lockdep. It is not sufficient, because unix_state_lock_nested() is already used from unix_state_double_lock(). We need to use a separate subclass. This patch adds a distinct enumeration to make things more explicit. Also use swap() in unix_state_double_lock() as a clean up. v2: add a missing inline keyword to unix_state_lock_nested() [1] WARNING: possible circular locking dependency detected 6.8.0-rc1-syzkaller-00356-g8a696a29c690 #0 Not tainted syz-executor.1/2542 is trying to acquire lock: ffff88808b5df9e8 (rlock-AF_UNIX){+.+.}-{2:2}, at: skb_queue_tail+0x36/0x120 net/core/skbuff.c:3863 but task is already holding lock: ffff88808b5dfe70 (&u->lock/1){+.+.}-{2:2}, at: unix_dgram_sendmsg+0xfc7/0x2200 net/unix/af_unix.c:2089 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&u->lock/1){+.+.}-{2:2}: lock_acquire+0x1e3/0x530 kernel/locking/lockdep.c:5754 _raw_spin_lock_nested+0x31/0x40 kernel/locking/spinlock.c:378 sk_diag_dump_icons net/unix/diag.c:87 [inline] sk_diag_fill+0x6ea/0xfe0 net/unix/diag.c:157 sk_diag_dump net/unix/diag.c:196 [inline] unix_diag_dump+0x3e9/0x630 net/unix/diag.c:220 netlink_dump+0x5c1/0xcd0 net/netlink/af_netlink.c:2264 __netlink_dump_start+0x5d7/0x780 net/netlink/af_netlink.c:2370 netlink_dump_start include/linux/netlink.h:338 [inline] unix_diag_handler_dump+0x1c3/0x8f0 net/unix/diag.c:319 sock_diag_rcv_msg+0xe3/0x400 netlink_rcv_skb+0x1df/0x430 net/netlink/af_netlink.c:2543 sock_diag_rcv+0x2a/0x40 net/core/sock_diag.c:280 netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] netlink_unicast+0x7e6/0x980 net/netlink/af_netlink.c:1367 netlink_sendmsg+0xa37/0xd70 net/netlink/af_netlink.c:1908 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] sock_write_iter+0x39a/0x520 net/socket.c:1160 call_write_iter include/linux/fs.h:2085 [inline] new_sync_write fs/read_write.c:497 [inline] vfs_write+0xa74/0xca0 fs/read_write.c:590 ksys_write+0x1a0/0x2c0 fs/read_write.c:643 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf5/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b -> #0 (rlock-AF_UNIX){+.+.}-{2:2}: check_prev_add kernel/locking/lockdep.c:3134 [inline] check_prevs_add kernel/locking/lockdep.c:3253 [inline] validate_chain+0x1909/0x5ab0 kernel/locking/lockdep.c:3869 __lock_acquire+0x1345/0x1fd0 kernel/locking/lockdep.c:5137 lock_acquire+0x1e3/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 skb_queue_tail+0x36/0x120 net/core/skbuff.c:3863 unix_dgram_sendmsg+0x15d9/0x2200 net/unix/af_unix.c:2112 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0x592/0x890 net/socket.c:2584 ___sys_sendmsg net/socket.c:2638 [inline] __sys_sendmmsg+0x3b2/0x730 net/socket.c:2724 __do_sys_sendmmsg net/socket.c:2753 [inline] __se_sys_sendmmsg net/socket.c:2750 [inline] __x64_sys_sendmmsg+0xa0/0xb0 net/socket.c:2750 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf5/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&u->lock/1); lock(rlock-AF_UNIX); lock(&u->lock/1); lock(rlock-AF_UNIX); *** DEADLOCK *** 1 lock held by syz-executor.1/2542: #0: ffff88808b5dfe70 (&u->lock/1){+.+.}-{2:2}, at: unix_dgram_sendmsg+0xfc7/0x2200 net/unix/af_unix.c:2089 stack backtrace: CPU: 1 PID: 2542 Comm: syz-executor.1 Not tainted 6.8.0-rc1-syzkaller-00356-g8a696a29c690 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 check_noncircular+0x366/0x490 kernel/locking/lockdep.c:2187 check_prev_add kernel/locking/lockdep.c:3134 [inline] check_prevs_add kernel/locking/lockdep.c:3253 [inline] validate_chain+0x1909/0x5ab0 kernel/locking/lockdep.c:3869 __lock_acquire+0x1345/0x1fd0 kernel/locking/lockdep.c:5137 lock_acquire+0x1e3/0x530 kernel/locking/lockdep.c:5754 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 skb_queue_tail+0x36/0x120 net/core/skbuff.c:3863 unix_dgram_sendmsg+0x15d9/0x2200 net/unix/af_unix.c:2112 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0x592/0x890 net/socket.c:2584 ___sys_sendmsg net/socket.c:2638 [inline] __sys_sendmmsg+0x3b2/0x730 net/socket.c:2724 __do_sys_sendmmsg net/socket.c:2753 [inline] __se_sys_sendmmsg net/socket.c:2750 [inline] __x64_sys_sendmmsg+0xa0/0xb0 net/socket.c:2750 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf5/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b RIP: 0033:0x7f26d887cda9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f26d95a60c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: ffffffffffffffda RBX: 00007f26d89abf80 RCX: 00007f26d887cda9 RDX: 000000000000003e RSI: 00000000200bd000 RDI: 0000000000000004 RBP: 00007f26d88c947a R08: 0000000000000000 R09: 0000000000000000 R10: 00000000000008c0 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007f26d89abf80 R15: 00007ffcfe081a68 Fixes: 2aac7a2cb0 ("unix_diag: Pending connections IDs NLA") Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com> Link: https://lore.kernel.org/r/20240130184235.1620738-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2024-02-23 08:42:17 +01:00
Greg Kroah-Hartman	8026d5839b	Merge 5.10.195 into android12-5.10-lts ... Changes in 5.10.195 erofs: ensure that the post-EOF tails are all zeroed ARM: pxa: remove use of symbol_get() mmc: au1xmmc: force non-modular build and remove symbol_get usage net: enetc: use EXPORT_SYMBOL_GPL for enetc_phc_index rtc: ds1685: use EXPORT_SYMBOL_GPL for ds1685_rtc_poweroff modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules USB: serial: option: add Quectel EM05G variant (0x030e) USB: serial: option: add FOXCONN T99W368/T99W373 product usb: dwc3: meson-g12a: do post init to fix broken usb after resumption usb: chipidea: imx: improve logic if samsung,picophy-* parameter is 0 HID: wacom: remove the battery when the EKR is off staging: rtl8712: fix race condition Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition configfs: fix a race in configfs_lookup() serial: qcom-geni: fix opp vote on shutdown serial: sc16is7xx: fix broken port 0 uart init serial: sc16is7xx: fix bug when first setting GPIO direction firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe fsi: master-ast-cf: Add MODULE_FIRMWARE macro nilfs2: fix general protection fault in nilfs_lookup_dirty_data_buffers() nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse pinctrl: amd: Don't show `Invalid config param` errors ASoC: rt5682: Fix a problem with error handling in the io init function of the soundwire ARM: dts: imx: update sdma node name format ARM: dts: imx7s: Drop dma-apb interrupt-names ARM: dts: imx: Adjust dma-apbh node name ARM: dts: imx: Set default tuning step for imx7d usdhc phy: qcom-snps-femto-v2: use qcom_snps_hsphy_suspend/resume error code media: pulse8-cec: handle possible ping error media: pci: cx23885: fix error handling for cx23885 ATSC boards 9p: virtio: make sure 'offs' is initialized in zc_request ASoC: da7219: Flush pending AAD IRQ when suspending ASoC: da7219: Check for failure reading AAD IRQ events ethernet: atheros: fix return value check in atl1c_tso_csum() vxlan: generalize vxlan_parse_gpe_hdr and remove unused args m68k: Fix invalid .section syntax s390/dasd: use correct number of retries for ERP requests s390/dasd: fix hanging device after request requeue fs/nls: make load_nls() take a const parameter ASoc: codecs: ES8316: Fix DMIC config ASoC: atmel: Fix the 8K sample parameter in I2SC master platform/x86: intel: hid: Always call BTNL ACPI method platform/x86: huawei-wmi: Silence ambient light sensor drm/amd/display: Exit idle optimizations before attempt to access PHY ovl: Always reevaluate the file signature for IMA ata: pata_arasan_cf: Use dev_err_probe() instead dev_err() in data_xfer() security: keys: perform capable check only on privileged operations kprobes: Prohibit probing on CFI preamble symbol clk: fixed-mmio: make COMMON_CLK_FIXED_MMIO depend on HAS_IOMEM vmbus_testing: fix wrong python syntax for integer value comparison net: usb: qmi_wwan: add Quectel EM05GV2 idmaengine: make FSL_EDMA and INTEL_IDMA64 depends on HAS_IOMEM scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock netlabel: fix shift wrapping bug in netlbl_catmap_setlong() bnx2x: fix page fault following EEH recovery sctp: handle invalid error codes without calling BUG() scsi: storvsc: Always set no_report_opcodes ALSA: seq: oss: Fix racy open/close of MIDI devices tracing: Introduce pipe_cpumask to avoid race on trace_pipes platform/mellanox: Fix mlxbf-tmfifo not handling all virtio CONSOLE notifications net: Avoid address overwrite in kernel_connect udf: Check consistency of Space Bitmap Descriptor udf: Handle error when adding extent to a file Revert "net: macsec: preserve ingress frame ordering" reiserfs: Check the return value from __getblk() eventfd: Export eventfd_ctx_do_read() eventfd: prevent underflow for eventfd semaphores fs: Fix error checking for d_hash_and_lookup() tmpfs: verify {g,u}id mount options correctly selftests/harness: Actually report SKIP for signal tests refscale: Fix uninitalized use of wait_queue_head_t OPP: Fix passing 0 to PTR_ERR in _opp_attach_genpd() selftests/resctrl: Don't leak buffer in fill_cache() selftests/resctrl: Unmount resctrl FS if child fails to run benchmark selftests/resctrl: Close perf value read fd on errors x86/decompressor: Don't rely on upper 32 bits of GPRs being preserved perf/imx_ddr: don't enable counter0 if none of 4 counters are used s390/pkey: fix/harmonize internal keyblob headers s390/paes: fix PKEY_TYPE_EP11_AES handling for secure keyblobs x86/efistub: Fix PCI ROM preservation in mixed mode cpufreq: powernow-k8: Use related_cpus instead of cpus in driver.exit() bpftool: Use a local bpf_perf_event_value to fix accessing its fields bpf: Clear the probe_addr for uprobe tcp: tcp_enter_quickack_mode() should be static hwrng: nomadik - keep clock enabled while hwrng is registered regmap: rbtree: Use alloc_flags for memory allocations udp: re-score reuseport groups when connected sockets are present bpf: reject unhashed sockets in bpf_sk_assign wifi: mt76: testmode: add nla_policy for MT76_TM_ATTR_TX_LENGTH spi: tegra20-sflash: fix to check return value of platform_get_irq() in tegra_sflash_probe() can: gs_usb: gs_usb_receive_bulk_callback(): count RX overflow errors also in case of OOM wifi: mwifiex: Fix OOB and integer underflow when rx packets wifi: mwifiex: fix error recovery in PCIE buffer descriptor management selftests/bpf: fix static assert compilation issue for test_cls_*.c crypto: stm32 - Properly handle pm_runtime_get failing crypto: api - Use work queue in crypto_destroy_instance Bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe() Bluetooth: Fix potential use-after-free when clear keys net: tcp: fix unexcepted socket die when snd_wnd is 0 selftests/bpf: Clean up fmod_ret in bench_rename test script ice: ice_aq_check_events: fix off-by-one check when filling buffer crypto: caam - fix unchecked return value error hwrng: iproc-rng200 - Implement suspend and resume calls lwt: Fix return values of BPF xmit ops lwt: Check LWTUNNEL_XMIT_CONTINUE strictly fs: ocfs2: namei: check return value of ocfs2_add_entry() wifi: mwifiex: fix memory leak in mwifiex_histogram_read() wifi: mwifiex: Fix missed return in oob checks failed path samples/bpf: fix broken map lookup probe wifi: ath9k: fix races between ath9k_wmi_cmd and ath9k_wmi_ctrl_rx wifi: ath9k: protect WMI command response buffer replacement with a lock wifi: mwifiex: avoid possible NULL skb pointer dereference Bluetooth: btusb: Do not call kfree_skb() under spin_lock_irqsave() wifi: ath9k: use IS_ERR() with debugfs_create_dir() net: arcnet: Do not call kfree_skb() under local_irq_disable() mlxsw: i2c: Fix chunk size setting in output mailbox buffer mlxsw: i2c: Limit single transaction buffer size hwmon: (tmp513) Fix the channel number in tmp51x_is_visible() net/sched: sch_hfsc: Ensure inner classes have fsc curve netrom: Deny concurrent connect(). drm/bridge: tc358764: Fix debug print parameter order quota: factor out dquot_write_dquot() quota: rename dquot_active() to inode_quota_active() quota: add new helper dquot_active() quota: fix dqput() to follow the guarantees dquot_srcu should provide ASoC: stac9766: fix build errors with REGMAP_AC97 soc: qcom: ocmem: Add OCMEM hardware version print soc: qcom: ocmem: Fix NUM_PORTS & NUM_MACROS macros arm64: dts: qcom: msm8996: Add missing interrupt to the USB2 controller drm/amdgpu: avoid integer overflow warning in amdgpu_device_resize_fb_bar() ARM: dts: BCM5301X: Harmonize EHCI/OHCI DT nodes name ARM: dts: BCM53573: Describe on-SoC BCM53125 rev 4 switch ARM: dts: BCM53573: Drop nonexistent #usb-cells ARM: dts: BCM53573: Add cells sizes to PCIe node ARM: dts: BCM53573: Use updated "spi-gpio" binding properties drm/etnaviv: fix dumping of active MMU context x86/mm: Fix PAT bit missing from page protection modify mask ARM: dts: s3c64xx: align pinctrl with dtschema ARM: dts: samsung: s3c6410-mini6410: correct ethernet reg addresses (split) ARM: dts: s5pv210: adjust node names to DT spec ARM: dts: s5pv210: add dummy 5V regulator for backlight on SMDKv210 ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split) drm: adv7511: Fix low refresh rate register for ADV7533/5 ARM: dts: BCM53573: Fix Ethernet info for Luxul devices arm64: dts: qcom: sdm845: Add missing RPMh power domain to GCC arm64: dts: qcom: sdm845: Fix the min frequency of "ice_core_clk" drm/amdgpu: Update min() to min_t() in 'amdgpu_info_ioctl' md/bitmap: don't set max_write_behind if there is no write mostly device md/md-bitmap: hold 'reconfig_mutex' in backlog_store() drm/tegra: Remove superfluous error messages around platform_get_irq() drm/tegra: dpaux: Fix incorrect return value of platform_get_irq of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name() drm/armada: Fix off-by-one error in armada_overlay_get_property() drm/panel: simple: Add missing connector type and pixel format for AUO T215HVN01 ima: Remove deprecated IMA_TRUSTED_KEYRING Kconfig drm: xlnx: zynqmp_dpsub: Add missing check for dma_set_mask drm/msm/mdp5: Don't leak some plane state firmware: meson_sm: fix to avoid potential NULL pointer dereference smackfs: Prevent underflow in smk_set_cipso() drm/amd/pm: fix variable dereferenced issue in amdgpu_device_attr_create() drm/msm/a2xx: Call adreno_gpu_init() earlier audit: fix possible soft lockup in __audit_inode_child() bus: ti-sysc: Fix build warning for 64-bit build drm/mediatek: Fix potential memory leak if vmap() fail bus: ti-sysc: Fix cast to enum warning of: unittest: Fix overlay type in apply/revert check ALSA: ac97: Fix possible error value of *rac97 ipmi:ssif: Add check for kstrdup ipmi:ssif: Fix a memory leak when scanning for an adapter drivers: clk: keystone: Fix parameter judgment in _of_pll_clk_init() clk: sunxi-ng: Modify mismatched function name clk: qcom: gcc-sc7180: use ARRAY_SIZE instead of specifying num_parents clk: qcom: gcc-sc7180: Fix up gcc_sdcc2_apps_clk_src ext4: correct grp validation in ext4_mb_good_group clk: qcom: gcc-sm8250: use ARRAY_SIZE instead of specifying num_parents clk: qcom: gcc-sm8250: Fix gcc_sdcc2_apps_clk_src clk: qcom: reset: Use the correct type of sleep/delay based on length PCI: Mark NVIDIA T4 GPUs to avoid bus reset pinctrl: mcp23s08: check return value of devm_kasprintf() PCI: pciehp: Use RMW accessors for changing LNKCTL PCI/ASPM: Use RMW accessors for changing LNKCTL clk: imx8mp: fix sai4 clock clk: imx: composite-8m: fix clock pauses when set_rate would be a no-op vfio/type1: fix cap_migration information leak powerpc/fadump: reset dump area size if fadump memory reserve fails powerpc/perf: Convert fsl_emb notifier to state machine callbacks drm/amdgpu: Use RMW accessors for changing LNKCTL drm/radeon: Use RMW accessors for changing LNKCTL net/mlx5: Use RMW accessors for changing LNKCTL wifi: ath10k: Use RMW accessors for changing LNKCTL powerpc: Don't include lppaca.h in paca.h powerpc/pseries: Rework lppaca_shared_proc() to avoid DEBUG_PREEMPT nfs/blocklayout: Use the passed in gfp flags powerpc/iommu: Fix notifiers being shared by PCI and VIO buses jfs: validate max amount of blocks before allocation. fs: lockd: avoid possible wrong NULL parameter NFSD: da_addr_body field missing in some GETDEVICEINFO replies NFS: Guard against READDIR loop when entry names exceed MAXNAMELEN NFSv4.2: fix handling of COPY ERR_OFFLOAD_NO_REQ media: ad5820: Drop unsupported ad5823 from i2c_ and of_device_id tables media: i2c: tvp5150: check return value of devm_kasprintf() media: v4l2-core: Fix a potential resource leak in v4l2_fwnode_parse_link() drivers: usb: smsusb: fix error handling code in smsusb_init_device media: dib7000p: Fix potential division by zero media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer() media: cx24120: Add retval check for cx24120_message_send() scsi: hisi_sas: Print SAS address for v3 hw erroneous completion print scsi: libsas: Introduce more SAM status code aliases in enum exec_status scsi: hisi_sas: Modify v3 HW SSP underflow error processing scsi: hisi_sas: Modify v3 HW SATA completion error processing scsi: hisi_sas: Fix warnings detected by sparse scsi: hisi_sas: Fix normally completed I/O analysed as failed media: rkvdec: increase max supported height for H.264 media: mediatek: vcodec: Return NULL if no vdec_fb is found usb: phy: mxs: fix getting wrong state with mxs_phy_is_otg_host() scsi: RDMA/srp: Fix residual handling scsi: iscsi: Rename iscsi_set_param() to iscsi_if_set_param() scsi: iscsi: Add length check for nlattr payload scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param() scsi: be2iscsi: Add length check when parsing nlattrs scsi: qla4xxx: Add length check when parsing nlattrs serial: sprd: Assign sprd_port after initialized to avoid wrong access serial: sprd: Fix DMA buffer leak issue x86/APM: drop the duplicate APM_MINOR_DEV macro scsi: qedf: Do not touch __user pointer in qedf_dbg_stop_io_on_error_cmd_read() directly scsi: qedf: Do not touch __user pointer in qedf_dbg_debug_cmd_read() directly scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read() directly coresight: tmc: Explicit type conversions to prevent integer overflow dma-buf/sync_file: Fix docs syntax driver core: test_async: fix an error code IB/uverbs: Fix an potential error pointer dereference fsi: aspeed: Reset master errors after CFAM reset iommu/qcom: Disable and reset context bank before programming iommu/vt-d: Fix to flush cache of PASID directory table media: go7007: Remove redundant if statement USB: gadget: f_mass_storage: Fix unused variable warning media: ov5640: Enable MIPI interface in ov5640_set_power_mipi() media: i2c: ov2680: Set V4L2_CTRL_FLAG_MODIFY_LAYOUT on flips media: ov2680: Remove auto-gain and auto-exposure controls media: ov2680: Fix ov2680_bayer_order() media: ov2680: Fix vflip / hflip set functions media: ov2680: Fix regulators being left enabled on ov2680_power_on() errors cgroup:namespace: Remove unused cgroup_namespaces_init() scsi: core: Use 32-bit hostnum in scsi_host_lookup() scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock serial: tegra: handle clk prepare error in tegra_uart_hw_init() amba: bus: fix refcount leak Revert "IB/isert: Fix incorrect release of isert connection" RDMA/siw: Balance the reference of cep->kref in the error path RDMA/siw: Correct wrong debug message HID: logitech-dj: Fix error handling in logi_dj_recv_switch_to_dj_mode() HID: multitouch: Correct devm device reference for hidinput input_dev name x86/speculation: Mark all Skylake CPUs as vulnerable to GDS tracing: Fix race issue between cpu buffer write and swap mtd: rawnand: brcmnand: Fix mtd oobsize phy/rockchip: inno-hdmi: use correct vco_div_5 macro on rk3328 phy/rockchip: inno-hdmi: round fractal pixclock in rk3328 recalc_rate phy/rockchip: inno-hdmi: do not power on rk3328 post pll on reg write rpmsg: glink: Add check for kstrdup mtd: spi-nor: Check bus width while setting QE bit mtd: rawnand: fsmc: handle clk prepare error in fsmc_nand_resume() um: Fix hostaudio build errors dmaengine: ste_dma40: Add missing IRQ check in d40_probe cpufreq: Fix the race condition while updating the transition_task of policy virtio_ring: fix avail_wrap_counter in virtqueue_add_packed igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c netfilter: xt_u32: validate user space input netfilter: xt_sctp: validate the flag_info count skbuff: skb_segment, Call zero copy functions before using skbuff frags igb: set max size RX buffer when store bad packet is enabled PM / devfreq: Fix leak in devfreq_dev_release() ALSA: pcm: Fix missing fixup call in compat hw_refine ioctl printk: ringbuffer: Fix truncating buffer size min_t cast scsi: core: Fix the scsi_set_resid() documentation ipmi_si: fix a memleak in try_smi_init() ARM: OMAP2+: Fix -Warray-bounds warning in _pwrdm_state_switch() backlight/gpio_backlight: Compare against struct fb_info.device backlight/bd6107: Compare against struct fb_info.device backlight/lv5207lp: Compare against struct fb_info.device xtensa: PMU: fix base address for the newer hardware arm64: csum: Fix OoB access in IP checksum code for negative lengths media: dvb: symbol fixup for dvb_attach() Revert "scsi: qla2xxx: Fix buffer overrun" scsi: mpt3sas: Perform additional retries if doorbell read returns 0 ntb: Drop packets when qp link is down ntb: Clean up tx tail index on link down ntb: Fix calculation ntb_transport_tx_free_entry() Revert "PCI: Mark NVIDIA T4 GPUs to avoid bus reset" procfs: block chmod on /proc/thread-self/comm parisc: Fix /proc/cpuinfo output for lscpu dlm: fix plock lookup when using multiple lockspaces dccp: Fix out of bounds access in DCCP error handler X.509: if signature is unsupported skip validation net: handle ARPHRD_PPP in dev_is_mac_header_xmit() fsverity: skip PKCS#7 parser when keyring is empty pstore/ram: Check start of empty przs during init s390/ipl: add missing secure/has_secure file to ipl type 'unknown' crypto: stm32 - fix loop iterating through scatterlist for DMA cpufreq: brcmstb-avs-cpufreq: Fix -Warray-bounds bug usb: typec: bus: verify partner exists in typec_altmode_attention USB: core: Unite old scheme and new scheme descriptor reads USB: core: Change usb_get_device_descriptor() API USB: core: Fix race by not overwriting udev->descriptor in hub_port_init() USB: core: Fix oversight in SuperSpeed initialization usb: typec: tcpci: clear the fault status bit tracing: Zero the pipe cpumask on alloc to avoid spurious -EBUSY md/md-bitmap: remove unnecessary local variable in backlog_store() udf: initialize newblock to 0 net/ipv6: SKB symmetric hash should incorporate transport ports io_uring: always lock in io_apoll_task_func io_uring: break out of iowq iopoll on teardown io_uring: break iopolling on signal scsi: qla2xxx: Fix deletion race condition scsi: qla2xxx: fix inconsistent TMF timeout scsi: qla2xxx: Fix erroneous link up failure scsi: qla2xxx: Turn off noisy message log scsi: qla2xxx: Remove unsupported ql2xenabledif option fbdev/ep93xx-fb: Do not assign to struct fb_info.dev drm/ast: Fix DRAM init on AST2200 lib/test_meminit: allocate pages up to order MAX_ORDER parisc: led: Fix LAN receive and transmit LEDs parisc: led: Reduce CPU overhead for disk & lan LED computation pinctrl: cherryview: fix address_space_handler() argument dt-bindings: clock: xlnx,versal-clk: drop select:false clk: imx: pll14xx: dynamically configure PLL for 393216000/361267200Hz clk: qcom: gcc-mdm9615: use proper parent for pll0_vote clock soc: qcom: qmi_encdec: Restrict string length in decode NFS: Fix a potential data corruption NFSv4/pnfs: minor fix for cleanup path in nfs4_get_device_info kconfig: fix possible buffer overflow backlight: gpio_backlight: Drop output GPIO direction check for initial power state perf annotate bpf: Don't enclose non-debug code with an assert() x86/virt: Drop unnecessary check on extended CPUID level in cpu_has_svm() perf top: Don't pass an ERR_PTR() directly to perf_session__delete() watchdog: intel-mid_wdt: add MODULE_ALIAS() to allow auto-load pwm: lpc32xx: Remove handling of PWM channels net/sched: fq_pie: avoid stalls in fq_pie_timer() sctp: annotate data-races around sk->sk_wmem_queued ipv4: annotate data-races around fi->fib_dead net: read sk->sk_family once in sk_mc_loop() drm/i915/gvt: Save/restore HW status to support GVT suspend/resume drm/i915/gvt: Drop unused helper intel_vgpu_reset_gtt() ipv4: ignore dst hint for multipath routes igb: disable virtualization features on 82580 veth: Fixing transmit return status for dropped packets net: ipv6/addrconf: avoid integer underflow in ipv6_create_tempaddr af_unix: Fix data-races around user->unix_inflight. af_unix: Fix data-race around unix_tot_inflight. af_unix: Fix data-races around sk->sk_shutdown. af_unix: Fix data race around sk->sk_err. net: sched: sch_qfq: Fix UAF in qfq_dequeue() kcm: Destroy mutex in kcm_exit_net() igc: Change IGC_MIN to allow set rx/tx value between 64 and 80 igbvf: Change IGBVF_MIN to allow set rx/tx value between 64 and 80 igb: Change IGB_MIN to allow set rx/tx value between 64 and 80 s390/zcrypt: don't leak memory if dev_set_name() fails idr: fix param name in idr_alloc_cyclic() doc ip_tunnels: use DEV_STATS_INC() net: dsa: sja1105: fix bandwidth discrepancy between tc-cbs software and offload net: dsa: sja1105: fix -ENOSPC when replacing the same tc-cbs too many times netfilter: nfnetlink_osf: avoid OOB read net: hns3: fix the port information display when sfp is absent sh: boards: Fix CEU buffer size passed to dma_declare_coherent_memory() ext4: add correct group descriptors and reserved GDT blocks to system zone ata: sata_gemini: Add missing MODULE_DESCRIPTION ata: pata_ftide010: Add missing MODULE_DESCRIPTION fuse: nlookup missing decrement in fuse_direntplus_link btrfs: don't start transaction when joining with TRANS_JOIN_NOSTART btrfs: use the correct superblock to compare fsid in btrfs_validate_super mtd: rawnand: brcmnand: Fix crash during the panic_write mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write mtd: rawnand: brcmnand: Fix potential false time out warning drm/amd/display: prevent potential division by zero errors perf hists browser: Fix hierarchy mode header perf tools: Handle old data in PERF_RECORD_ATTR perf hists browser: Fix the number of entries for 'e' key ACPI: APEI: explicit init of HEST and GHES in apci_init() arm64: sdei: abort running SDEI handlers during crash scsi: qla2xxx: If fcport is undergoing deletion complete I/O with retry scsi: qla2xxx: Consolidate zio threshold setting for both FCP & NVMe scsi: qla2xxx: Fix crash in PCIe error handling scsi: qla2xxx: Flush mailbox commands on chip reset ARM: dts: samsung: exynos4210-i9100: Fix LCD screen's physical size ARM: dts: BCM5301X: Extend RAM to full 256MB for Linksys EA6500 V2 bus: mhi: host: Skip MHI reset if device is in RDDM net: ipv4: fix one memleak in __inet_del_ifa() selftests/kselftest/runner/run_one(): allow running non-executable files kselftest/runner.sh: Propagate SIGTERM to runner child net/smc: use smc_lgr_list.lock to protect smc_lgr_list.list iterate in smcr_port_add net: ethernet: mvpp2_main: fix possible OOB write in mvpp2_ethtool_get_rxnfc() net: ethernet: mtk_eth_soc: fix possible NULL pointer dereference in mtk_hwlro_get_fdir_all() hsr: Fix uninit-value access in fill_frame_info() r8152: check budget for r8152_poll() kcm: Fix memory leak in error path of kcm_sendmsg() platform/mellanox: mlxbf-tmfifo: Drop the Rx packet if no more descriptors platform/mellanox: mlxbf-tmfifo: Drop jumbo frames net/tls: do not free tls_rec on async operation in bpf_exec_tx_verdict() ipv6: fix ip6_sock_set_addr_preferences() typo ixgbe: fix timestamp configuration code kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg(). drm/amd/display: Fix a bug when searching for insert_above_mpcc parisc: Drop loops_per_jiffy from per_cpu struct Linux 5.10.195 Change-Id: I4eef618f573b6d4201e05c9cf56088d77d712d97 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-09-19 11:32:32 +00:00
Kuniyuki Iwashima	cf29b42766	af_unix: Fix data-race around unix_tot_inflight. ... [ Upstream commit ade32bd8a738d7497ffe9743c46728db26740f78 ] unix_tot_inflight is changed under spin_lock(unix_gc_lock), but unix_release_sock() reads it locklessly. Let's use READ_ONCE() for unix_tot_inflight. Note that the writer side was marked by commit 9d6d7f1cb67c ("af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress") BUG: KCSAN: data-race in unix_inflight / unix_release_sock write (marked) to 0xffffffff871852b8 of 4 bytes by task 123 on cpu 1: unix_inflight+0x130/0x180 net/unix/scm.c:64 unix_attach_fds+0x137/0x1b0 net/unix/scm.c:123 unix_scm_to_skb net/unix/af_unix.c:1832 [inline] unix_dgram_sendmsg+0x46a/0x14f0 net/unix/af_unix.c:1955 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg+0x148/0x160 net/socket.c:747 ____sys_sendmsg+0x4e4/0x610 net/socket.c:2493 ___sys_sendmsg+0xc6/0x140 net/socket.c:2547 __sys_sendmsg+0x94/0x140 net/socket.c:2576 __do_sys_sendmsg net/socket.c:2585 [inline] __se_sys_sendmsg net/socket.c:2583 [inline] __x64_sys_sendmsg+0x45/0x50 net/socket.c:2583 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc read to 0xffffffff871852b8 of 4 bytes by task 4891 on cpu 0: unix_release_sock+0x608/0x910 net/unix/af_unix.c:671 unix_release+0x59/0x80 net/unix/af_unix.c:1058 __sock_release+0x7d/0x170 net/socket.c:653 sock_close+0x19/0x30 net/socket.c:1385 __fput+0x179/0x5e0 fs/file_table.c:321 ____fput+0x15/0x20 fs/file_table.c:349 task_work_run+0x116/0x1a0 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop kernel/entry/common.c:171 [inline] exit_to_user_mode_prepare+0x174/0x180 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline] syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:297 do_syscall_64+0x4b/0x90 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x72/0xdc value changed: 0x00000000 -> 0x00000001 Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 4891 Comm: systemd-coredum Not tainted 6.4.0-rc5-01219-gfa0e21fa4443 #5 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Fixes: 9305cfa444 ("[AF_UNIX]: Make unix_tot_inflight counter non-atomic") Reported-by: syzkaller <syzkaller@googlegroups.com> Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-09-19 12:20:26 +02:00
Greg Kroah-Hartman	b23fd871be	Merge 5.10.192 into android12-5.10-lts ... Changes in 5.10.192 mmc: sdhci-f-sdh30: Replace with sdhci_pltfm macsec: Fix traffic counters/statistics macsec: use DEV_STATS_INC() net/mlx5: Refactor init clock function net/mlx5: Move all internal timer metadata into a dedicated struct net/mlx5: Skip clock update work when device is in error state drm/radeon: Fix integer overflow in radeon_cs_parser_init ALSA: emu10k1: roll up loops in DSP setup code for Audigy ASoC: Intel: sof_sdw: add quirk for MTL RVP ASoC: Intel: sof_sdw: add quirk for LNL RVP PCI: tegra194: Fix possible array out of bounds access ARM: dts: imx6dl: prtrvt, prtvt7, prti6q, prtwd2: fix USB related warnings ASoC: Intel: sof_sdw: Add support for Rex soundwire iopoll: Call cpu_relax() in busy loops quota: Properly disable quotas when add_dquot_ref() fails quota: fix warning in dqgrab() dma-remap: use kvmalloc_array/kvfree for larger dma memory remap drm/amdgpu: install stub fence into potential unused fence pointers HID: add quirk for 03f0:464a HP Elite Presenter Mouse RDMA/mlx5: Return the firmware result upon destroying QP/RQ ovl: check type and offset of struct vfsmount in ovl_entry udf: Fix uninitialized array access for some pathnames fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev MIPS: dec: prom: Address -Warray-bounds warning FS: JFS: Fix null-ptr-deref Read in txBegin FS: JFS: Check for read-only mounted filesystem in txBegin media: v4l2-mem2mem: add lock to protect parameter num_rdy usb: gadget: u_serial: Avoid spinlock recursion in __gs_console_push media: platform: mediatek: vpu: fix NULL ptr dereference usb: chipidea: imx: don't request QoS for imx8ulp usb: chipidea: imx: add missing USB PHY DPDM wakeup setting gfs2: Fix possible data races in gfs2_show_options() pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db() Bluetooth: L2CAP: Fix use-after-free Bluetooth: btusb: Add MT7922 bluetooth ID for the Asus Ally drm/amdgpu: Fix potential fence use-after-free v2 ALSA: hda/realtek: Add quirks for Unis H3C Desktop B760 & Q760 ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync() powerpc/kasan: Disable KCOV in KASAN code ring-buffer: Do not swap cpu_buffer during resize process IMA: allow/fix UML builds iio: add addac subdirectory dt-bindings: iio: add AD74413R iio: adc: stx104: Utilize iomap interface iio: adc: stx104: Implement and utilize register structures iio: addac: stx104: Fix race condition for stx104_write_raw() iio: addac: stx104: Fix race condition when converting analog-to-digital bus: mhi: Add MHI PCI support for WWAN modems bus: mhi: Add MMIO region length to controller structure bus: mhi: Move host MHI code to "host" directory bus: mhi: host: Range check CHDBOFF and ERDBOFF irqchip/mips-gic: Get rid of the reliance on irq_cpu_online() irqchip/mips-gic: Use raw spinlock for gic_lock usb: gadget: udc: core: Introduce check_config to verify USB configuration usb: cdns3: allocate TX FIFO size according to composite EP number usb: cdns3: fix NCM gadget RX speed 20x slow than expection at iMX8QM USB: dwc3: qcom: fix NULL-deref on suspend mmc: bcm2835: fix deferred probing mmc: sunxi: fix deferred probing mmc: core: add devm_mmc_alloc_host mmc: meson-gx: use devm_mmc_alloc_host mmc: meson-gx: fix deferred probing tracing/probes: Have process_fetch_insn() take a void * instead of pt_regs tracing/probes: Fix to update dynamic data counter if fetcharg uses it virtio-mmio: Use to_virtio_mmio_device() to simply code virtio-mmio: don't break lifecycle of vm_dev i2c: bcm-iproc: Fix bcm_iproc_i2c_isr deadlock issue fbdev: mmp: fix value check in mmphw_probe() powerpc/rtas_flash: allow user copy to flash block cache objects tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux tty: serial: fsl_lpuart: Clear the error flags by writing 1 for lpuart32 platforms btrfs: fix BUG_ON condition in btrfs_cancel_balance i2c: designware: Handle invalid SMBus block data response length value net: xfrm: Fix xfrm_address_filter OOB read net: af_key: fix sadb_x_filter validation net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure xfrm: fix slab-use-after-free in decode_session6 ip6_vti: fix slab-use-after-free in decode_session6 ip_vti: fix potential slab-use-after-free in decode_session6 xfrm: add NULL check in xfrm_update_ae_params xfrm: add forgotten nla_policy for XFRMA_MTIMER_THRESH selftests: mirror_gre_changes: Tighten up the TTL test match drm/panel: simple: Fix AUO G121EAN01 panel timings according to the docs ipvs: fix racy memcpy in proc_do_sync_threshold netfilter: nft_dynset: disallow object maps net: phy: broadcom: stub c45 read/write for 54810 team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves i40e: fix misleading debug logs net: dsa: mv88e6xxx: Wait for EEPROM done before HW reset sock: Fix misuse of sk_under_memory_pressure() net: do not allow gso_size to be set to GSO_BY_FRAGS bus: ti-sysc: Flush posted write on enable before reset arm64: dts: rockchip: fix supplies on rk3399-rock-pi-4 arm64: dts: rockchip: use USB host by default on rk3399-rock-pi-4 arm64: dts: rockchip: add ES8316 codec for ROCK Pi 4 arm64: dts: rockchip: add SPDIF node for ROCK Pi 4 arm64: dts: rockchip: fix regulator name on rk3399-rock-4 arm64: dts: rockchip: sort nodes/properties on rk3399-rock-4 arm64: dts: rockchip: Disable HS400 for eMMC on ROCK Pi 4 ASoC: rt5665: add missed regulator_bulk_disable ASoC: meson: axg-tdm-formatter: fix channel slot allocation ALSA: hda/realtek - Remodified 3k pull low procedure serial: 8250: Fix oops for port->pm on uart_change_pm() ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces. cifs: Release folio lock on fscache read hit. mmc: wbsd: fix double mmc_free_host() in wbsd_init() mmc: block: Fix in_flight[issue_type] value error netfilter: set default timeout to 3 secs for sctp shutdown send and recv state af_unix: Fix null-ptr-deref in unix_stream_sendpage(). virtio-net: set queues after driver_ok net: fix the RTO timer retransmitting skb every 1ms if linear option is enabled mmc: f-sdh30: fix order of function calls in sdhci_f_sdh30_remove x86/cpu: Fix __x86_return_thunk symbol type x86/cpu: Fix up srso_safe_ret() and __x86_return_thunk() x86/alternative: Make custom return thunk unconditional objtool: Add frame-pointer-specific function ignore x86/ibt: Add ANNOTATE_NOENDBR x86/cpu: Clean up SRSO return thunk mess x86/cpu: Rename original retbleed methods x86/cpu: Rename srso_(.*)_alias to srso_alias_\1 x86/cpu: Cleanup the untrain mess x86/srso: Explain the untraining sequences a bit more x86/static_call: Fix __static_call_fixup() x86/retpoline: Don't clobber RFLAGS during srso_safe_ret() x86/CPU/AMD: Fix the DIV(0) initial fix attempt x86/srso: Disable the mitigation on unaffected configurations x86/retpoline,kprobes: Fix position of thunk sections with CONFIG_LTO_CLANG objtool/x86: Fixup frame-pointer vs rethunk x86/srso: Correct the mitigation status when SMT is disabled Linux 5.10.192 Change-Id: Id6dcc6748bce39baa640b8f0c3764d1d95643016 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-08-28 17:10:38 +00:00
Kuniyuki Iwashima	c080cee930	af_unix: Fix null-ptr-deref in unix_stream_sendpage(). ... Bing-Jhong Billy Jheng reported null-ptr-deref in unix_stream_sendpage() with detailed analysis and a nice repro. unix_stream_sendpage() tries to add data to the last skb in the peer's recv queue without locking the queue. If the peer's FD is passed to another socket and the socket's FD is passed to the peer, there is a loop between them. If we close both sockets without receiving FD, the sockets will be cleaned up by garbage collection. The garbage collection iterates such sockets and unlinks skb with FD from the socket's receive queue under the queue's lock. So, there is a race where unix_stream_sendpage() could access an skb locklessly that is being released by garbage collection, resulting in use-after-free. To avoid the issue, unix_stream_sendpage() must lock the peer's recv queue. Note the issue does not exist in 6.5+ thanks to the recent sendpage() refactoring. This patch is originally written by Linus Torvalds. BUG: unable to handle page fault for address: ffff988004dd6870 PF: supervisor read access in kernel mode PF: error_code(0x0000) - not-present page PGD 0 P4D 0 PREEMPT SMP PTI CPU: 4 PID: 297 Comm: garbage_uaf Not tainted 6.1.46 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:kmem_cache_alloc_node+0xa2/0x1e0 Code: c0 0f 84 32 01 00 00 41 83 fd ff 74 10 48 8b 00 48 c1 e8 3a 41 39 c5 0f 85 1c 01 00 00 41 8b 44 24 28 49 8b 3c 24 48 8d 4a 40 <49> 8b 1c 06 4c 89 f0 65 48 0f c7 0f 0f 94 c0 84 c0 74 a1 41 8b 44 RSP: 0018:ffffc9000079fac0 EFLAGS: 00000246 RAX: 0000000000000070 RBX: 0000000000000005 RCX: 000000000001a284 RDX: 000000000001a244 RSI: 0000000000400cc0 RDI: 000000000002eee0 RBP: 0000000000400cc0 R08: 0000000000400cc0 R09: 0000000000000003 R10: 0000000000000001 R11: 0000000000000000 R12: ffff888003970f00 R13: 00000000ffffffff R14: ffff988004dd6800 R15: 00000000000000e8 FS: 00007f174d6f3600(0000) GS:ffff88807db00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff988004dd6870 CR3: 00000000092be000 CR4: 00000000007506e0 PKRU: 55555554 Call Trace: <TASK> ? __die_body.cold+0x1a/0x1f ? page_fault_oops+0xa9/0x1e0 ? fixup_exception+0x1d/0x310 ? exc_page_fault+0xa8/0x150 ? asm_exc_page_fault+0x22/0x30 ? kmem_cache_alloc_node+0xa2/0x1e0 ? __alloc_skb+0x16c/0x1e0 __alloc_skb+0x16c/0x1e0 alloc_skb_with_frags+0x48/0x1e0 sock_alloc_send_pskb+0x234/0x270 unix_stream_sendmsg+0x1f5/0x690 sock_sendmsg+0x5d/0x60 ____sys_sendmsg+0x210/0x260 ___sys_sendmsg+0x83/0xd0 ? kmem_cache_alloc+0xc6/0x1c0 ? avc_disable+0x20/0x20 ? percpu_counter_add_batch+0x53/0xc0 ? alloc_empty_file+0x5d/0xb0 ? alloc_file+0x91/0x170 ? alloc_file_pseudo+0x94/0x100 ? __fget_light+0x9f/0x120 __sys_sendmsg+0x54/0xa0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x69/0xd3 RIP: 0033:0x7f174d639a7d Code: 28 89 54 24 1c 48 89 74 24 10 89 7c 24 08 e8 8a c1 f4 ff 8b 54 24 1c 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 33 44 89 c7 48 89 44 24 08 e8 de c1 f4 ff 48 RSP: 002b:00007ffcb563ea50 EFLAGS: 00000293 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f174d639a7d RDX: 0000000000000000 RSI: 00007ffcb563eab0 RDI: 0000000000000007 RBP: 00007ffcb563eb10 R08: 0000000000000000 R09: 00000000ffffffff R10: 00000000004040a0 R11: 0000000000000293 R12: 00007ffcb563ec28 R13: 0000000000401398 R14: 0000000000403e00 R15: 00007f174d72c000 </TASK> Fixes: 869e7c6248 ("net: af_unix: implement stream sendpage support") Reported-by: Bing-Jhong Billy Jheng <billy@starlabs.sg> Reviewed-by: Bing-Jhong Billy Jheng <billy@starlabs.sg> Co-developed-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2023-08-26 15:26:56 +02:00
Greg Kroah-Hartman	df0f5bd7a8	Merge 5.10.190 into android12-5.10-lts ... Changes in 5.10.190 KVM: s390: pv: fix index value of replaced ASCE io_uring: don't audit the capability check in io_uring_create() gpio: tps68470: Make tps68470_gpio_output() always set the initial value btrfs: fix race between quota disable and relocation btrfs: fix extent buffer leak after tree mod log failure at split_node() i2c: Delete error messages for failed memory allocations i2c: Improve size determinations i2c: nomadik: Remove unnecessary goto label i2c: nomadik: Use devm_clk_get_enabled() i2c: nomadik: Remove a useless call in the remove function PCI/ASPM: Return 0 or -ETIMEDOUT from pcie_retrain_link() PCI/ASPM: Factor out pcie_wait_for_retrain() PCI/ASPM: Avoid link retraining race dlm: cleanup plock_op vs plock_xop dlm: rearrange async condition return fs: dlm: interrupt posix locks only when process is killed drm/ttm: add ttm_bo_pin()/ttm_bo_unpin() v2 drm/ttm: never consider pinned BOs for eviction&swap tracing: Show real address for trace event arguments pwm: meson: Simplify duplicated per-channel tracking pwm: meson: fix handling of period/duty if greater than UINT_MAX ext4: fix to check return value of freeze_bdev() in ext4_shutdown() phy: qcom-snps: Use dev_err_probe() to simplify code phy: qcom-snps: correct struct qcom_snps_hsphy kerneldoc phy: qcom-snps-femto-v2: keep cfg_ahb_clk enabled during runtime suspend phy: qcom-snps-femto-v2: properly enable ref clock media: staging: atomisp: select V4L2_FWNODE i40e: Fix an NULL vs IS_ERR() bug for debugfs_create_dir() net: phy: marvell10g: fix 88x3310 power up net: hns3: reconstruct function hclge_ets_validate() net: hns3: fix wrong bw weight of disabled tc issue vxlan: move to its own directory vxlan: calculate correct header length for GPE phy: hisilicon: Fix an out of bounds check in hisi_inno_phy_probe() ethernet: atheros: fix return value check in atl1e_tso_csum() ipv6 addrconf: fix bug where deleting a mngtmpaddr can create a new temporary address tcp: Reduce chance of collisions in inet6_hashfn(). ice: Fix memory management in ice_ethtool_fdir.c bonding: reset bond's flags when down link is P2P device team: reset team's flags when down link is P2P device platform/x86: msi-laptop: Fix rfkill out-of-sync on MSI Wind U100 netfilter: nft_set_rbtree: fix overlap expiration walk netfilter: nftables: add helper function to validate set element data netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID net/sched: mqprio: refactor nlattr parsing to a separate function net/sched: mqprio: add extack to mqprio_parse_nlattr() net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64 benet: fix return value check in be_lancer_xmit_workarounds() tipc: check return value of pskb_trim() tipc: stop tipc crypto on failure in tipc_node_create RDMA/mlx4: Make check for invalid flags stricter drm/msm/dpu: drop enum dpu_core_perf_data_bus_id drm/msm/adreno: Fix snapshot BINDLESS_DATA size RDMA/mthca: Fix crash when polling CQ for shared QPs drm/msm: Fix IS_ERR_OR_NULL() vs NULL check in a5xx_submit_in_rb() ASoC: fsl_spdif: Silence output on stop block: Fix a source code comment in include/uapi/linux/blkzoned.h dm raid: fix missing reconfig_mutex unlock in raid_ctr() error paths dm raid: clean up four equivalent goto tags in raid_ctr() dm raid: protect md_stop() with 'reconfig_mutex' ata: pata_ns87415: mark ns87560_tf_read static ring-buffer: Fix wrong stat of cpu_buffer->read tracing: Fix warning in trace_buffered_event_disable() Revert "usb: gadget: tegra-xudc: Fix error check in tegra_xudc_powerdomain_init()" USB: gadget: Fix the memory leak in raw_gadget driver serial: qcom-geni: drop bogus runtime pm state update serial: 8250_dw: Preserve original value of DLF register serial: sifive: Fix sifive_serial_console_setup() section USB: serial: option: support Quectel EM060K_128 USB: serial: option: add Quectel EC200A module support USB: serial: simple: add Kaufmann RKS+CAN VCP USB: serial: simple: sort driver entries can: gs_usb: gs_can_close(): add missing set of CAN state to CAN_STATE_STOPPED Revert "usb: dwc3: core: Enable AutoRetry feature in the controller" usb: dwc3: pci: skip BYT GPIO lookup table for hardwired phy usb: dwc3: don't reset device side if dwc3 was configured as host-only usb: ohci-at91: Fix the unhandle interrupt when resume USB: quirks: add quirk for Focusrite Scarlett usb: xhci-mtk: set the dma max_seg_size Revert "usb: xhci: tegra: Fix error check" Documentation: security-bugs.rst: update preferences when dealing with the linux-distros group Documentation: security-bugs.rst: clarify CVE handling staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext() tty: n_gsm: fix UAF in gsm_cleanup_mux ALSA: hda/relatek: Enable Mute LED on HP 250 G8 hwmon: (nct7802) Fix for temp6 (PECI1) processed even if PECI1 disabled btrfs: check for commit error at btrfs_attach_transaction_barrier() file: always lock position for FMODE_ATOMIC_POS nfsd: Remove incorrect check in nfsd4_validate_stateid tpm_tis: Explicitly check for error code irq-bcm6345-l1: Do not assume a fixed block to cpu mapping irqchip/gic-v4.1: Properly lock VPEs when doing a directLPI invalidation KVM: VMX: Invert handling of CR0.WP for EPT without unrestricted guest KVM: VMX: Fold ept_update_paging_mode_cr0() back into vmx_set_cr0() KVM: nVMX: Do not clear CR3 load/store exiting bits if L1 wants 'em KVM: VMX: Don't fudge CR0 and CR4 for restricted L2 guest staging: rtl8712: Use constants from <linux/ieee80211.h> staging: r8712: Fix memory leak in _r8712_init_xmit_priv() btrfs: check if the transaction was aborted at btrfs_wait_for_commit() virtio-net: fix race between set queues and probe s390/dasd: fix hanging device after quiesce/resume ASoC: wm8904: Fill the cache for WM8904_ADC_TEST_0 register ceph: never send metrics if disable_send_metrics is set dm cache policy smq: ensure IO doesn't prevent cleaner policy progress drm/ttm: make ttm_bo_unpin more defensive ACPI: processor: perflib: Use the "no limit" frequency QoS ACPI: processor: perflib: Avoid updating frequency QoS unnecessarily cpufreq: intel_pstate: Drop ACPI _PSS states table patching selftests: mptcp: depend on SYN_COOKIES io_uring: treat -EAGAIN for REQ_F_NOWAIT as final for io-wq ASoC: cs42l51: fix driver to properly autoload with automatic module loading kprobes/x86: Fix fall-through warnings for Clang x86/kprobes: Do not decode opcode in resume_execution() x86/kprobes: Retrieve correct opcode for group instruction x86/kprobes: Identify far indirect JMP correctly x86/kprobes: Use int3 instead of debug trap for single-step x86/kprobes: Fix to identify indirect jmp and others using range case x86/kprobes: Move 'inline' to the beginning of the kprobe_is_ss() declaration x86/kprobes: Update kcb status flag after singlestepping x86/kprobes: Fix JNG/JNLE emulation io_uring: gate iowait schedule on having pending requests perf: Fix function pointer case loop: Select I/O scheduler 'none' from inside add_disk() arm64: dts: imx8mn-var-som: add missing pull-up for onboard PHY reset pinmux word-at-a-time: use the same return type for has_zero regardless of endianness KVM: s390: fix sthyi error handling wifi: cfg80211: Fix return value in scan logic net/mlx5: DR, fix memory leak in mlx5dr_cmd_create_reformat_ctx net/mlx5e: fix return value check in mlx5e_ipsec_remove_trailer() bpf: Add length check for SK_DIAG_BPF_STORAGE_REQ_MAP_FD parsing rtnetlink: let rtnl_bridge_setlink checks IFLA_BRIDGE_MODE length net: dsa: fix value check in bcm_sf2_sw_probe() perf test uprobe_from_different_cu: Skip if there is no gcc net: sched: cls_u32: Fix match key mis-addressing mISDN: hfcpci: Fix potential deadlock on &hc->lock net: annotate data-races around sk->sk_max_pacing_rate net: add missing READ_ONCE(sk->sk_rcvlowat) annotation net: add missing READ_ONCE(sk->sk_sndbuf) annotation net: add missing READ_ONCE(sk->sk_rcvbuf) annotation net: add missing data-race annotations around sk->sk_peek_off net: add missing data-race annotation for sk_ll_usec net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free bpf: sockmap: Remove preempt_disable in sock_map_sk_acquire net: ll_temac: Switch to use dev_err_probe() helper net: ll_temac: fix error checking of irq_of_parse_and_map() net: netsec: Ignore 'phy-mode' on SynQuacer in DT mode net: dcb: choose correct policy to parse DCB_ATTR_BCN s390/qeth: Don't call dev_close/dev_open (DOWN/UP) ip6mr: Fix skb_under_panic in ip6mr_cache_report() vxlan: Fix nexthop hash size net/mlx5: fs_core: Make find_closest_ft more generic net/mlx5: fs_core: Skip the FTs in the same FS_TYPE_PRIO_CHAINS fs_prio tcp_metrics: fix addr_same() helper tcp_metrics: annotate data-races around tm->tcpm_stamp tcp_metrics: annotate data-races around tm->tcpm_lock tcp_metrics: annotate data-races around tm->tcpm_vals[] tcp_metrics: annotate data-races around tm->tcpm_net tcp_metrics: fix data-race in tcpm_suck_dst() vs fastopen scsi: zfcp: Defer fc_rport blocking until after ADISC response libceph: fix potential hang in ceph_osdc_notify() USB: zaurus: Add ID for A-300/B-500/C-700 ceph: defer stopping mdsc delayed_work exfat: use kvmalloc_array/kvfree instead of kmalloc_array/kfree exfat: release s_lock before calling dir_emit() mtd: spinand: toshiba: Fix ecc_get_status mtd: rawnand: meson: fix OOB available bytes for ECC arm64: dts: stratix10: fix incorrect I2C property for SCL signal net: tun_chr_open(): set sk_uid from current_fsuid() net: tap_open(): set sk_uid from current_fsuid() bpf: Disable preemption in bpf_event_output open: make RESOLVE_CACHED correctly test for O_TMPFILE drm/ttm: check null pointer before accessing when swapping file: reinstate f_pos locking optimization for regular files tracing: Fix sleeping while atomic in kdb ftdump fs/sysv: Null check to prevent null-ptr-deref bug Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb fs: Protect reconfiguration of sb read-write from racing writes ext2: Drop fragment support mtd: rawnand: omap_elm: Fix incorrect type in assignment mtd: rawnand: fsl_upm: Fix an off-by one test in fun_exec_op() powerpc/mm/altmap: Fix altmap boundary check selftests/rseq: check if libc rseq support is registered selftests/rseq: Play nice with binaries statically linked against glibc 2.35+ soundwire: bus: add better dev_dbg to track complete() calls soundwire: bus: pm_runtime_request_resume on peripheral attachment soundwire: fix enumeration completion PM / wakeirq: support enabling wake-up irq after runtime_suspend called PM: sleep: wakeirq: fix wake irq arming exfat: speed up iterate/lookup by fixing start point of traversing cluster chain exfat: support dynamic allocate bh for exfat_entry_set_cache exfat: check if filename entries exceeds max filename length mt76: move band capabilities in mt76_phy mt76: mt7615: Fix fall-through warnings for Clang wifi: mt76: mt7615: do not advertise 5 GHz on first phy of MT7615D (DBDC) ARM: dts: imx: add usb alias ARM: dts: imx6sll: fixup of operating points ARM: dts: nxp/imx6sll: fix wrong property name in usbphy node x86/CPU/AMD: Do not leak quotient data after a division by 0 Linux 5.10.190 Fix up build problem in ext4 due to merge of ed3d841f2f ("ext4: fix to check return value of freeze_bdev() in ext4_shutdown()") conflicting with a previous block layer core change coming in through the f2fs tree in the past, that is not upstream, but ANDROID specific. Change-Id: Ib95e59ce8ba653bcc791802735afafcd26bd996f Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-08-25 12:26:58 +00:00
Eric Dumazet	ad417bab9d	net: add missing data-race annotations around sk->sk_peek_off ... [ Upstream commit 11695c6e966b0ec7ed1d16777d294cef865a5c91 ] sk_getsockopt() runs locklessly, thus we need to annotate the read of sk->sk_peek_off. While we are at it, add corresponding annotations to sk_set_peek_off() and unix_set_peek_off(). Fixes: b9bb53f383 ("sock: convert sk_peek_offset functions to WRITE_ONCE") Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Willem de Bruijn <willemb@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-08-11 11:57:49 +02:00
Greg Kroah-Hartman	6d62ca19a7	Merge 5.10.181 into android12-5.10-lts ... Changes in 5.10.181 driver core: add a helper to setup both the of_node and fwnode of a device drm/mipi-dsi: Set the fwnode for mipi_dsi_device ARM: 9296/1: HP Jornada 7XX: fix kernel-doc warnings net: mdio: mvusb: Fix an error handling path in mvusb_mdio_probe() linux/dim: Do nothing if no time delta between samples net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs(). netfilter: conntrack: fix possible bug_on with enable_hooks=1 netlink: annotate accesses to nlk->cb_running net: annotate sk->sk_err write from do_recvmmsg() net: deal with most data-races in sk_wait_event() net: tap: check vlan with eth_type_vlan() method net: add vlan_get_protocol_and_depth() helper tcp: factor out __tcp_close() helper tcp: add annotations around sk->sk_shutdown accesses ipvlan:Fix out-of-bounds caused by unclear skb->cb net: datagram: fix data-races in datagram_poll() af_unix: Fix a data race of sk->sk_receive_queue->qlen. af_unix: Fix data races around sk->sk_shutdown. drm/i915/dp: prevent potential div-by-zero fbdev: arcfb: Fix error handling in arcfb_probe() ext4: remove an unused variable warning with CONFIG_QUOTA=n ext4: reflect error codes from ext4_multi_mount_protect() to its callers ext4: don't clear SB_RDONLY when remounting r/w until quota is re-enabled ext4: fix lockdep warning when enabling MMP ext4: remove redundant mb_regenerate_buddy() ext4: drop s_mb_bal_lock and convert protected fields to atomic ext4: add mballoc stats proc file ext4: allow to find by goal if EXT4_MB_HINT_GOAL_ONLY is set ext4: allow ext4_get_group_info() to fail refscale: Move shutdown from wait_event() to wait_event_idle() rcu: Protect rcu_print_task_exp_stall() ->exp_tasks access fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode() drm/amd/display: Use DC_LOG_DC in the trasform pixel function regmap: cache: Return error in cache sync operations for REGCACHE_NONE arm64: dts: qcom: msm8996: Add missing DWC3 quirks memstick: r592: Fix UAF bug in r592_remove due to race condition firmware: arm_sdei: Fix sleep from invalid context BUG ACPI: EC: Fix oops when removing custom query handlers remoteproc: stm32_rproc: Add mutex protection for workqueue drm/tegra: Avoid potential 32-bit integer overflow ACPICA: Avoid undefined behavior: applying zero offset to null pointer ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects drm/amd: Fix an out of bounds error in BIOS parser wifi: ath: Silence memcpy run-time false positive warning bpf: Annotate data races in bpf_local_storage wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex ext2: Check block size validity during mount scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow net: pasemi: Fix return type of pasemi_mac_start_tx() net: Catch invalid index in XPS mapping scsi: target: iscsit: Free cmds before session free lib: cpu_rmap: Avoid use after free on rmap->obj array entries scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race condition gfs2: Fix inode height consistency check ext4: set goal start correctly in ext4_mb_normalize_request ext4: Fix best extent lstart adjustment logic in ext4_mb_new_inode_pa() f2fs: fix to drop all dirty pages during umount() if cp_error is set samples/bpf: Fix fout leak in hbm's run_bpf_prog wifi: iwlwifi: pcie: fix possible NULL pointer dereference wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf null_blk: Always check queue mode setting from configfs wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace wifi: ath11k: Fix SKB corruption in REO destination ring ipvs: Update width of source for ip_vs_sync_conn_options Bluetooth: hci_bcm: Fall back to getting bdaddr from EFI if not set Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE HID: logitech-hidpp: Don't use the USB serial for USB devices HID: logitech-hidpp: Reconcile USB and Unifying serials spi: spi-imx: fix MX51_ECSPI_* macros when cs > 3 HID: wacom: generic: Set battery quirk only when we see battery data usb: typec: tcpm: fix multiple times discover svids error serial: 8250: Reinit port->pm on port specific driver unbind mcb-pci: Reallocate memory region to avoid memory overlapping sched: Fix KCSAN noinstr violation recordmcount: Fix memory leaks in the uwrite function RDMA/core: Fix multiple -Warray-bounds warnings iommu/arm-smmu-qcom: Limit the SMR groups to 128 clk: tegra20: fix gcc-7 constant overflow warning iommu/arm-smmu-v3: Acknowledge pri/event queue overflow if any Input: xpad - add constants for GIP interface numbers phy: st: miphy28lp: use _poll_timeout functions for waits mfd: dln2: Fix memory leak in dln2_probe() btrfs: move btrfs_find_highest_objectid/btrfs_find_free_objectid to disk-io.c btrfs: replace calls to btrfs_find_free_ino with btrfs_find_free_objectid btrfs: fix space cache inconsistency after error loading it from disk xfrm: don't check the default policy if the policy allows the packet Revert "Fix XFRM-I support for nested ESP tunnels" drm/msm/dp: unregister audio driver during unbind drm/msm/dpu: Remove duplicate register defines from INTF cpupower: Make TSC read per CPU for Mperf monitor af_key: Reject optional tunnel/BEET mode templates in outbound policies net: fec: Better handle pm_runtime_get() failing in .remove() net: phy: dp83867: add w/a for packet errors seen with short cables ALSA: firewire-digi00x: prevent potential use after free ALSA: hda/realtek: Apply HP B&O top speaker profile to Pavilion 15 vsock: avoid to close connected socket after the timeout ipv4/tcp: do not use per netns ctl sockets net: Find dst with sk's xfrm policy not ctl_sk tcp: fix possible sk_priority leak in tcp_v4_send_reset() serial: arc_uart: fix of_iomap leak in `arc_serial_probe` erspan: get the proto with the md version for collect_md net: hns3: fix sending pfc frames after reset issue net: hns3: fix reset delay time to avoid configuration timeout media: netup_unidvb: fix use-after-free at del_timer() SUNRPC: Fix trace_svc_register() call site drm/exynos: fix g2d_open/close helper function definitions net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() net/tipc: fix tipc header files for kernel-doc tipc: add tipc_bearer_min_mtu to calculate min mtu tipc: do not update mtu if msg_max is too small in mtu negotiation tipc: check the bearer min mtu properly when setting it by netlink net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop() net: bcmgenet: Restore phy_stop() depending upon suspend/close wifi: mac80211: fix min center freq offset tracing wifi: iwlwifi: mvm: don't trust firmware n_channels scsi: storvsc: Don't pass unused PFNs to Hyper-V host cassini: Fix a memory leak in the error handling path of cas_init_one() igb: fix bit_shift to be in [1..8] range vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit() netfilter: nft_set_rbtree: fix null deref on element insertion bridge: always declare tunnel functions ALSA: usb-audio: Add a sample rate workaround for Line6 Pod Go USB: usbtmc: Fix direction for 0-length ioctl control messages usb-storage: fix deadlock when a scsi command timeouts more than once USB: UHCI: adjust zhaoxin UHCI controllers OverCurrent bit value usb: dwc3: debugfs: Resume dwc3 before accessing registers usb: gadget: u_ether: Fix host MAC address case usb: typec: altmodes/displayport: fix pin_assignment_show ALSA: hda: Fix Oops by 9.1 surround channel names ALSA: hda: Add NVIDIA codec IDs a3 through a7 to patch table ALSA: hda/realtek: Add quirk for Clevo L140AU ALSA: hda/realtek: Add a quirk for HP EliteDesk 805 ALSA: hda/realtek: Add quirk for 2nd ASUS GU603 can: j1939: recvmsg(): allow MSG_CMSG_COMPAT flag can: isotp: recvmsg(): allow MSG_CMSG_COMPAT flag can: kvaser_pciefd: Set CAN_STATE_STOPPED in kvaser_pciefd_stop() can: kvaser_pciefd: Call request_irq() before enabling interrupts can: kvaser_pciefd: Empty SRB buffer in probe can: kvaser_pciefd: Clear listen-only bit if not explicitly requested can: kvaser_pciefd: Do not send EFLUSH command on TFD interrupt can: kvaser_pciefd: Disable interrupts in probe error path statfs: enforce statfs[64] structure initialization serial: Add support for Advantech PCI-1611U card vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF ceph: force updating the msg pointer in non-split case tpm/tpm_tis: Disable interrupts for more Lenovo devices powerpc/64s/radix: Fix soft dirty tracking nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode() HID: wacom: Force pen out of prox if no events have been received in a while HID: wacom: Add new Intuos Pro Small (PTH-460) device IDs HID: wacom: add three styli to wacom_intuos_get_tool_type KVM: arm64: Link position-independent string routines into .hyp.text serial: 8250_exar: derive nr_ports from PCI ID for Acces I/O cards serial: exar: Add support for Sealevel 7xxxC serial cards serial: 8250_exar: Add support for USR298x PCI Modems s390/qdio: get rid of register asm s390/qdio: fix do_sqbs() inline assembly constraint watchdog: sp5100_tco: Immediately trigger upon starting. ARM: dts: stm32: fix AV96 board SAI2 pin muxing on stm32mp15 writeback, cgroup: remove extra percpu_ref_exit() net/sched: act_mirred: refactor the handle of xmit net/sched: act_mirred: better wording on protection against excessive stack growth act_mirred: use the backlog for nested calls to mirred ingress spi: fsl-spi: Re-organise transfer bits_per_word adaptation spi: fsl-cpm: Use 16 bit mode for large transfers with even size ocfs2: Switch to security_inode_init_security() ALSA: hda/ca0132: add quirk for EVGA X299 DARK ALSA: hda: Fix unhandled register update during auto-suspend period ALSA: hda/realtek: Enable headset onLenovo M70/M90 net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize m68k: Move signal frame following exception on 68020/030 parisc: Handle kgdb breakpoints only in kernel context parisc: Allow to reboot machine after system halt gpio: mockup: Fix mode of debugfs files btrfs: use nofs when cleaning up aborted transactions dt-binding: cdns,usb3: Fix cdns,on-chip-buff-size type x86/mm: Avoid incomplete Global INVLPG flushes selftests/memfd: Fix unknown type name build failure parisc: Fix flush_dcache_page() for usage from irq context x86/topology: Fix erroneous smp_num_siblings on Intel Hybrid platforms debugobjects: Don't wake up kswapd from fill_pool() fbdev: udlfb: Fix endpoint check net: fix stack overflow when LRO is disabled for virtual interfaces udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated(). USB: core: Add routines for endpoint checks in old drivers USB: sisusbvga: Add endpoint checks media: radio-shark: Add endpoint checks net: fix skb leak in __skb_tstamp_tx() selftests: fib_tests: mute cleanup error message octeontx2-pf: Fix TSOv6 offload bpf: Fix mask generation for 32-bit narrow loads of 64-bit fields ipv6: Fix out-of-bounds access in ipv6_find_tlv() power: supply: leds: Fix blink to LED on transition power: supply: bq27xxx: Fix bq27xxx_battery_update() race condition power: supply: bq27xxx: Fix I2C IRQ race on remove power: supply: bq27xxx: Fix poll_interval handling and races on remove power: supply: sbs-charger: Fix INHIBITED bit for Status reg fs: fix undefined behavior in bit shift for SB_NOUSER coresight: Fix signedness bug in tmc_etr_buf_insert_barrier_packet() xen/pvcalls-back: fix double frees with pvcalls_new_active_socket() x86/show_trace_log_lvl: Ensure stack pointer is aligned, again ASoC: Intel: Skylake: Fix declaration of enum skl_ch_cfg forcedeth: Fix an error handling path in nv_probe() net/mlx5e: do as little as possible in napi poll when budget is 0 net/mlx5: DR, Fix crc32 calculation to work on big-endian (BE) CPUs net/mlx5: Fix error message when failing to allocate device memory net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device arm64: dts: imx8mn-var-som: fix PHY detection bug by adding deassert delay 3c589_cs: Fix an error handling path in tc589_probe() net: phy: mscc: add VSC8502 to MODULE_DEVICE_TABLE Linux 5.10.181 Change-Id: Iaad0b0bb7c1ad061b28ad4ee16e03db935241177 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-06-27 08:23:11 +00:00
Kuniyuki Iwashima	8307e372e7	af_unix: Fix data races around sk->sk_shutdown. ... [ Upstream commit e1d09c2c2f5793474556b60f83900e088d0d366d ] KCSAN found a data race around sk->sk_shutdown where unix_release_sock() and unix_shutdown() update it under unix_state_lock(), OTOH unix_poll() and unix_dgram_poll() read it locklessly. We need to annotate the writes and reads with WRITE_ONCE() and READ_ONCE(). BUG: KCSAN: data-race in unix_poll / unix_release_sock write to 0xffff88800d0f8aec of 1 bytes by task 264 on cpu 0: unix_release_sock+0x75c/0x910 net/unix/af_unix.c:631 unix_release+0x59/0x80 net/unix/af_unix.c:1042 __sock_release+0x7d/0x170 net/socket.c:653 sock_close+0x19/0x30 net/socket.c:1397 __fput+0x179/0x5e0 fs/file_table.c:321 ____fput+0x15/0x20 fs/file_table.c:349 task_work_run+0x116/0x1a0 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop kernel/entry/common.c:171 [inline] exit_to_user_mode_prepare+0x174/0x180 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline] syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:297 do_syscall_64+0x4b/0x90 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x72/0xdc read to 0xffff88800d0f8aec of 1 bytes by task 222 on cpu 1: unix_poll+0xa3/0x2a0 net/unix/af_unix.c:3170 sock_poll+0xcf/0x2b0 net/socket.c:1385 vfs_poll include/linux/poll.h:88 [inline] ep_item_poll.isra.0+0x78/0xc0 fs/eventpoll.c:855 ep_send_events fs/eventpoll.c:1694 [inline] ep_poll fs/eventpoll.c:1823 [inline] do_epoll_wait+0x6c4/0xea0 fs/eventpoll.c:2258 __do_sys_epoll_wait fs/eventpoll.c:2270 [inline] __se_sys_epoll_wait fs/eventpoll.c:2265 [inline] __x64_sys_epoll_wait+0xcc/0x190 fs/eventpoll.c:2265 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc value changed: 0x00 -> 0x03 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 222 Comm: dbus-broker Not tainted 6.3.0-rc7-02330-gca6270c12e20 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Fixes: 3c73419c09 ("af_unix: fix 'poll for write'/ connected DGRAM sockets") Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Michal Kubiak <michal.kubiak@intel.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-05-30 12:57:46 +01:00
Kuniyuki Iwashima	9b977b0cbb	af_unix: Fix a data race of sk->sk_receive_queue->qlen. ... [ Upstream commit 679ed006d416ea0cecfe24a99d365d1dea69c683 ] KCSAN found a data race of sk->sk_receive_queue->qlen where recvmsg() updates qlen under the queue lock and sendmsg() checks qlen under unix_state_sock(), not the queue lock, so the reader side needs READ_ONCE(). BUG: KCSAN: data-race in __skb_try_recv_from_queue / unix_wait_for_peer write (marked) to 0xffff888019fe7c68 of 4 bytes by task 49792 on cpu 0: __skb_unlink include/linux/skbuff.h:2347 [inline] __skb_try_recv_from_queue+0x3de/0x470 net/core/datagram.c:197 __skb_try_recv_datagram+0xf7/0x390 net/core/datagram.c:263 __unix_dgram_recvmsg+0x109/0x8a0 net/unix/af_unix.c:2452 unix_dgram_recvmsg+0x94/0xa0 net/unix/af_unix.c:2549 sock_recvmsg_nosec net/socket.c:1019 [inline] ____sys_recvmsg+0x3a3/0x3b0 net/socket.c:2720 ___sys_recvmsg+0xc8/0x150 net/socket.c:2764 do_recvmmsg+0x182/0x560 net/socket.c:2858 __sys_recvmmsg net/socket.c:2937 [inline] __do_sys_recvmmsg net/socket.c:2960 [inline] __se_sys_recvmmsg net/socket.c:2953 [inline] __x64_sys_recvmmsg+0x153/0x170 net/socket.c:2953 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc read to 0xffff888019fe7c68 of 4 bytes by task 49793 on cpu 1: skb_queue_len include/linux/skbuff.h:2127 [inline] unix_recvq_full net/unix/af_unix.c:229 [inline] unix_wait_for_peer+0x154/0x1a0 net/unix/af_unix.c:1445 unix_dgram_sendmsg+0x13bc/0x14b0 net/unix/af_unix.c:2048 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg+0x148/0x160 net/socket.c:747 ____sys_sendmsg+0x20e/0x620 net/socket.c:2503 ___sys_sendmsg+0xc6/0x140 net/socket.c:2557 __sys_sendmmsg+0x11d/0x370 net/socket.c:2643 __do_sys_sendmmsg net/socket.c:2672 [inline] __se_sys_sendmmsg net/socket.c:2669 [inline] __x64_sys_sendmmsg+0x58/0x70 net/socket.c:2669 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc value changed: 0x0000000b -> 0x00000001 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 49793 Comm: syz-executor.0 Not tainted 6.3.0-rc7-02330-gca6270c12e20 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Michal Kubiak <michal.kubiak@intel.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-05-30 12:57:46 +01:00
Greg Kroah-Hartman	8a8eb074ed	Merge 5.10.122 into android12-5.10-lts ... Changes in 5.10.122 pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards staging: greybus: codecs: fix type confusion of list iterator variable iio: adc: ad7124: Remove shift from scan_type lkdtm/bugs: Check for the NULL pointer after calling kmalloc tty: goldfish: Use tty_port_destroy() to destroy port tty: serial: owl: Fix missing clk_disable_unprepare() in owl_uart_probe tty: n_tty: Restore EOF push handling behavior tty: serial: fsl_lpuart: fix potential bug when using both of_alias_get_id and ida_simple_get usb: usbip: fix a refcount leak in stub_probe() usb: usbip: add missing device lock on tweak configuration cmd USB: storage: karma: fix rio_karma_init return usb: musb: Fix missing of_node_put() in omap2430_probe staging: fieldbus: Fix the error handling path in anybuss_host_common_probe() pwm: lp3943: Fix duty calculation in case period was clamped rpmsg: qcom_smd: Fix irq_of_parse_and_map() return value usb: dwc3: pci: Fix pm_runtime_get_sync() error checking misc: fastrpc: fix an incorrect NULL check on list iterator firmware: stratix10-svc: fix a missing check on list iterator usb: typec: mux: Check dev_set_name() return value iio: adc: stmpe-adc: Fix wait_for_completion_timeout return value check iio: proximity: vl53l0x: Fix return value check of wait_for_completion_timeout iio: adc: sc27xx: fix read big scale voltage not right iio: adc: sc27xx: Fine tune the scale calibration values rpmsg: qcom_smd: Fix returning 0 if irq_of_parse_and_map() fails phy: qcom-qmp: fix pipe-clock imbalance on power-on failure serial: sifive: Report actual baud base rather than fixed 115200 coresight: cpu-debug: Replace mutex with mutex_trylock on panic notifier extcon: ptn5150: Add queue work sync before driver release soc: rockchip: Fix refcount leak in rockchip_grf_init clocksource/drivers/riscv: Events are stopped during CPU suspend rtc: mt6397: check return value after calling platform_get_resource() serial: meson: acquire port->lock in startup() serial: 8250_fintek: Check SER_RS485_RTS_* only with RS485 serial: digicolor-usart: Don't allow CS5-6 serial: rda-uart: Don't allow CS5-6 serial: txx9: Don't allow CS5-6 serial: sh-sci: Don't allow CS5-6 serial: sifive: Sanitize CSIZE and c_iflag serial: st-asc: Sanitize CSIZE and correct PARENB for CS7 serial: stm32-usart: Correct CSIZE, bits, and parity firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle bus: ti-sysc: Fix warnings for unbind for serial driver: base: fix UAF when driver_attach failed driver core: fix deadlock in __device_attach watchdog: rti-wdt: Fix pm_runtime_get_sync() error checking watchdog: ts4800_wdt: Fix refcount leak in ts4800_wdt_probe ASoC: fsl_sai: Fix FSL_SAI_xDR/xFR definition clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map() return value s390/crypto: fix scatterwalk_unmap() callers in AES-GCM net: sched: fixed barrier to prevent skbuff sticking in qdisc backlog net: ethernet: mtk_eth_soc: out of bounds read in mtk_hwlro_get_fdir_entry() net: ethernet: ti: am65-cpsw-nuss: Fix some refcount leaks net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register modpost: fix removing numeric suffixes jffs2: fix memory leak in jffs2_do_fill_super ubi: fastmap: Fix high cpu usage of ubi_bgt by making sure wl_pool not empty ubi: ubi_create_volume: Fix use-after-free when volume creation failed bpf: Fix probe read error in ___bpf_prog_run() riscv: read-only pages should not be writable net/smc: fixes for converting from "struct smc_cdc_tx_pend **" to "struct smc_wr_tx_pend_priv *" nfp: only report pause frame configuration for physical device sfc: fix considering that all channels have TX queues sfc: fix wrong tx channel offset with efx_separate_tx_channels net/mlx5: Don't use already freed action pointer net/mlx5: correct ECE offset in query qp output net/mlx5e: Update netdev features after changing XDP state net: sched: add barrier to fix packet stuck problem for lockless qdisc tcp: tcp_rtx_synack() can be called from process context gpio: pca953x: use the correct register address to do regcache sync afs: Fix infinite loop found by xfstest generic/676 scsi: sd: Fix potential NULL pointer dereference tipc: check attribute length for bearer name driver core: Fix wait_for_device_probe() & deferred_probe_timeout interaction perf c2c: Fix sorting in percent_rmt_hitm_cmp() dmaengine: idxd: set DMA_INTERRUPT cap bit mips: cpc: Fix refcount leak in mips_cpc_default_phys_base bootconfig: Make the bootconfig.o as a normal object file tracing: Fix sleeping function called from invalid context on RT kernel tracing: Avoid adding tracer option before update_tracer_options iommu/arm-smmu: fix possible null-ptr-deref in arm_smmu_device_probe() iommu/arm-smmu-v3: check return value after calling platform_get_resource() f2fs: remove WARN_ON in f2fs_is_valid_blkaddr i2c: cadence: Increase timeout per message if necessary m68knommu: set ZERO_PAGE() to the allocated zeroed page m68knommu: fix undefined reference to `_init_sp' dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type NFSv4: Don't hold the layoutget locks across multiple RPC calls video: fbdev: hyperv_fb: Allow resolutions with size > 64 MB for Gen1 video: fbdev: pxa3xx-gcu: release the resources correctly in pxa3xx_gcu_probe/remove() xprtrdma: treat all calls not a bcall when bc_serv is NULL netfilter: nat: really support inet nat without l3 address netfilter: nf_tables: delete flowtable hooks via transaction list powerpc/kasan: Force thread size increase with KASAN netfilter: nf_tables: always initialize flowtable hook list in transaction ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe netfilter: nf_tables: release new hooks on unsupported flowtable flags netfilter: nf_tables: memleak flow rule from commit path netfilter: nf_tables: bail out early if hardware offload is not supported xen: unexport __init-annotated xen_xlate_map_ballooned_pages() af_unix: Fix a data-race in unix_dgram_peer_wake_me(). bpf, arm64: Clear prog->jited_len along prog->jited net: dsa: lantiq_gswip: Fix refcount leak in gswip_gphy_fw_list net/mlx4_en: Fix wrong return value on ioctl EEPROM query failure SUNRPC: Fix the calculation of xdr->end in xdr_get_next_encode_buffer() net: mdio: unexport __init-annotated mdio_bus_init() net: xfrm: unexport __init-annotated xfrm4_protocol_init() net: ipv6: unexport __init-annotated seg6_hmac_init() net/mlx5: Rearm the FW tracer after each tracer event net/mlx5: fs, fail conflicting actions ip_gre: test csum_start instead of transport header net: altera: Fix refcount leak in altera_tse_mdio_create drm: imx: fix compiler warning with gcc-12 iio: dummy: iio_simple_dummy: check the return value of kstrdup() staging: rtl8712: fix a potential memory leak in r871xu_drv_init() iio: st_sensors: Add a local lock for protecting odr lkdtm/usercopy: Expand size of "out of frame" object tty: synclink_gt: Fix null-pointer-dereference in slgt_clean() tty: Fix a possible resource leak in icom_probe drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop() drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop() USB: host: isp116x: check return value after calling platform_get_resource() drivers: tty: serial: Fix deadlock in sa1100_set_termios() drivers: usb: host: Fix deadlock in oxu_bus_suspend() USB: hcd-pci: Fully suspend across freeze/thaw cycle sysrq: do not omit current cpu when showing backtrace of all active CPUs usb: dwc2: gadget: don't reset gadget's driver->bus misc: rtsx: set NULL intfdata when probe fails extcon: Modify extcon device to be created after driver data is set clocksource/drivers/sp804: Avoid error on multiple instances staging: rtl8712: fix uninit-value in usb_read8() and friends staging: rtl8712: fix uninit-value in r871xu_drv_init() serial: msm_serial: disable interrupts in __msm_console_write() kernfs: Separate kernfs_pr_cont_buf and rename_lock. watchdog: wdat_wdt: Stop watchdog when rebooting the system md: protect md_unregister_thread from reentrancy scsi: myrb: Fix up null pointer access on myrb_cleanup() Revert "net: af_key: add check for pfkey_broadcast in function pfkey_process" ceph: allow ceph.dir.rctime xattr to be updatable drm/radeon: fix a possible null pointer dereference modpost: fix undefined behavior of is_arm_mapping_symbol() x86/cpu: Elide KCSAN for cpu_has() and friends jump_label,noinstr: Avoid instrumentation for JUMP_LABEL=n builds nbd: call genl_unregister_family() first in nbd_cleanup() nbd: fix race between nbd_alloc_config() and module removal nbd: fix io hung while disconnecting device s390/gmap: voluntarily schedule during key setting cifs: version operations for smb20 unneeded when legacy support disabled nodemask: Fix return values to be unsigned vringh: Fix loop descriptors check in the indirect cases scripts/gdb: change kernel config dumping method ALSA: hda/conexant - Fix loopback issue with CX20632 ALSA: hda/realtek: Fix for quirk to enable speaker output on the Lenovo Yoga DuetITL 2021 cifs: return errors during session setup during reconnects cifs: fix reconnect on smb3 mount types ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files mmc: block: Fix CQE recovery reset success net: phy: dp83867: retrigger SGMII AN when link change nfc: st21nfca: fix incorrect validating logic in EVT_TRANSACTION nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling nfc: st21nfca: fix incorrect sizing calculations in EVT_TRANSACTION ixgbe: fix bcast packets Rx on VF after promisc removal ixgbe: fix unexpected VLAN Rx in promisc mode on VF Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag drm/bridge: analogix_dp: Support PSR-exit to disable transition drm/atomic: Force bridge self-refresh-exit on CRTC switch powerpc/32: Fix overread/overwrite of thread_struct via ptrace powerpc/mm: Switch obsolete dssall to .long interconnect: qcom: sc7180: Drop IP0 interconnects interconnect: Restore sync state by ignoring ipa-virt in provider count md/raid0: Ignore RAID0 layout if the second zone has only one device PCI: qcom: Fix pipe clock imbalance zonefs: fix handling of explicit_open option on mount dmaengine: idxd: add missing callback function to support DMA_INTERRUPT tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd Linux 5.10.122 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I8b96565fbcb635b2faaf2adcf287c963180c0b92	2022-07-28 15:05:26 +02:00
Kuniyuki Iwashima	c61848500a	af_unix: Fix a data-race in unix_dgram_peer_wake_me(). ... [ Upstream commit 662a80946ce13633ae90a55379f1346c10f0c432 ] unix_dgram_poll() calls unix_dgram_peer_wake_me() without `other`'s lock held and check if its receive queue is full. Here we need to use unix_recvq_full_lockless() instead of unix_recvq_full(), otherwise KCSAN will report a data-race. Fixes: 7d267278a9 ("unix: avoid use-after-free in ep_remove_wait_queue") Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Link: https://lore.kernel.org/r/20220605232325.11804-1-kuniyu@amazon.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-06-14 18:32:40 +02:00
Greg Kroah-Hartman	f45f895af5	Merge branch 'android12-5.10' into android12-5.10-lts ... Sync up with android12-5.10 for the following commits: 2c152aa329 UPSTREAM: f2fs: reduce the scope of setting fsck tag when de->name_len is zero c29dd368ef ANDROID: GKI: Update symbols to abi_gki_aarch64_oplus 428d0bb762 ANDROID: Add initial ASUS symbol list 87a74496ed ANDROID: configfs: add proper module namespace marking b7a6c15a6f ANDROID: Configure out the macros in android_kabi and android_vendor bdc772adbd ANDROID: kernel: fix debug_kinfo set twice crash issue d483eed85f ANDROID: GKI: set vfs-only exports into their own namespace 27fc5a7c69 UPSTREAM: net/packet: rx_owner_map depends on pg_vec f70ea63f3b ANDROID: GKI: Update symbols to symbol list a593acdae8 FROMLIST: module.h: allow #define strings to work with MODULE_IMPORT_NS eb171b4cbe FROMLIST: export: fix string handling of namespace in EXPORT_SYMBOL_NS 05c23b7a50 ANDROID: vendor_hooks: Add hooks for binder e99926fdfa ANDROID: mm/oom_kill: allow process_mrelease reclaim memory in parallel with exit_mmap f4f2c619d5 FROMLIST: mm/oom_kill: allow process_mrelease to run under mmap_lock protection 2452622293 FROMLIST: mm: protect free_pgtables with mmap_lock write lock in exit_mmap fd7af95538 UPSTREAM: mm/oom_kill.c: prevent a race between process_mrelease and exit_mmap fe50dcab7a UPSTREAM: mm: wire up syscall process_mrelease 7fc3ac4968 UPSTREAM: mm: introduce process_mrelease system call ac44888155 Revert "FROMGIT: mm: improve mprotect(R|W) efficiency on pages referenced once" 3a624c9ccd ANDROID: fips140: add show_invalid_inputs command to fips140_lab_util a481d43521 ANDROID: fips140: refactor and rename fips140_lab_test d4b5ca56b5 ANDROID: GKI: add lenovo symbol list 47874cc690 ANDROID: abi_gki_aarch64_qcom: Add rproc_set_firmware c41767a8ec UPSTREAM: remoteproc: Add a rproc_set_firmware() API 28d62c68d1 FROMGIT: iommu/io-pgtable-arm-v7s: Add error handle for page table allocation failure 99ad261273 UPSTREAM: sctp: add param size validation for SCTP_PARAM_SET_PRIMARY 282a4de8f0 UPSTREAM: sctp: validate chunk size in __rcv_asconf_lookup fef7dba3a7 UPSTREAM: bpf: Fix integer overflow in prealloc_elems_and_freelist() 893425f545 ANDROID: GKI: Update symbol list cef0df2218 ANDROID: ABI: update allowed list for galaxy a7ab784f60 ANDROID: vendor_hooks: Add hooks for futex 84fc3abca0 ANDROID: dma-contiguous: Add tracehook to allow subpage allocations in dma_alloc_contiguous d94655c43e ANDROID: Update the ABI xml and symbol list 414c32d38e UPSTREAM: ALSA: memalloc: Align buffer allocations in page size 75617df5b3 ANDROID: Fix mmu_notifier_trylock definition for !CONFIG_MMU_NOTIFIER config 7531e63661 FROMGIT: USB: gadget: bRequestType is a bitfield, not a enum 70c9301d9c ANDROID: qcom: Add flush_delayed_fput to ABI 5d8520b557 ANDROID: fix ABI breakage caused by mm_struct->mmu_notifier_lock addition a4d26b9a4b ANDROID: fix ABI breakage caused by percpu_rw_semaphore changes 6971350406 ANDROID: fix mmu_notifier race caused by not taking mmap_lock during SPF 2fc2c66b9c ANDROID: percpu-rwsem: enable percpu_sem destruction in atomic context f3f87608d8 FROMLIST: virtio_mmio: pm: Add notification handlers for restore and freeze 9180348b91 FROMLIST: virtio: do not reset stateful devices on resume 392cb940f6 FROMGIT: f2fs: avoid EINVAL by SBI_NEED_FSCK when pinning a file ddd9e01504 UPSTREAM: mm, slub: fix incorrect memcg slab count for bulk free 82ac5b0b1d UPSTREAM: mm, slub: fix potential use-after-free in slab_debugfs_fops e07a663f5d UPSTREAM: mm, slub: fix potential memoryleak in kmem_cache_open() cd02f347ab UPSTREAM: mm, slub: fix mismatch between reconstructed freelist depth and cnt 6b6725f77d UPSTREAM: mm, slub: fix two bugs in slab_debug_trace_open() 791f85d16d UPSTREAM: mm, slub: allocate private object map for debugfs listings 1260b47d4f FROMGIT: dma-buf: remove restriction of IOCTL:DMA_BUF_SET_NAME e80be54e4b UPSTREAM: usb: dwc3: core: balance phy init and exit 89137e0047 UPSTREAM: xhci: Fix failure to give back some cached cancelled URBs. f37b6d79f8 ANDROID: mm/memory_hotplug: Don't special case memory_block_size_bytes 8b7ffd60a5 UPSTREAM: usb: gadget: uvc: fix multiple opens ae22ebebbb UPSTREAM: aio: fix use-after-free due to missing POLLFREE handling b9c8788830 UPSTREAM: aio: keep poll requests on waitqueue until completed f965176884 UPSTREAM: signalfd: use wake_up_pollfree() 49744a390d UPSTREAM: binder: use wake_up_pollfree() e50fe1de2f UPSTREAM: wait: add wake_up_pollfree() 53afb231f5 UPSTREAM: USB: gadget: zero allocate endpoint 0 buffers 593309a377 BACKPORT: scsi: ufs: Improve SCSI abort handling further 21949c429a FROMGIT: scsi: ufs: Introduce ufshcd_release_scsi_cmd() d600bdedac FROMGIT: scsi: ufs: Remove the 'update_scaling' local variable 5f9614157c UPSTREAM: scsi: ufs: core: Fix another task management completion race 76760a995c BACKPORT: scsi: ufs: core: Fix task management completion timeout race dab2a8a288 ANDROID: qcom: Add android_rvh_do_ptrauth_fault to ABI b4604acd52 UPSTREAM: USB: gadget: detect too-big endpoint 0 requests 2d6a43c036 ANDROID: ABI: Add symbols used by frame buffer driver 183905923f UPSTREAM: xhci: Add bus number to some debug messages 5b15c955a6 UPSTREAM: xhci: Add additional dynamic debug to follow URBs in cancel and error cases. f4cbe34956 UPSTREAM: Revert "USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk set" c23b0e7c47 UPSTREAM: xhci: Fix failure to give back some cached cancelled URBs. 7320fb1abd UPSTREAM: HID: check for valid USB device for many HID drivers e98c96b8b8 UPSTREAM: HID: wacom: fix problems when device is not a valid USB device 5a72ef56c8 UPSTREAM: HID: bigbenff: prevent null pointer dereference 7b8a19b917 UPSTREAM: HID: add USB_HID dependancy on some USB HID drivers 8219b106a3 UPSTREAM: HID: add USB_HID dependancy to hid-chicony a4909c90b7 UPSTREAM: HID: add USB_HID dependancy to hid-prodikeys ddea17081f UPSTREAM: HID: add hid_is_usb() function to make it simpler for USB detection 81b6ea435e FROMGIT: clk: Don't parent clks until the parent is fully registered 78ea29e570 UPSTREAM: mm/gup: remove the vma allocation from gup_longterm_locked() 709fde7c61 BACKPORT: usb: typec: tcpm: Wait in SNK_DEBOUNCED until disconnect ea4a92c6af ANDROID: ABI: Add iio_write_channel_raw symbol f803f248dd ANDROID: GKI: Update symbols to symbol list 672d51b2a7 UPSTREAM: ASoC: dapm: use component prefix when checking widget names 686cd3b2d8 ANDROID: ABI: Add symbols used by clocksource driver 80c1cef2d1 ANDROID: GKI: Export clocksource_mmio_init 84881c68b1 ANDROID: GKI: Export sched_clock_register 9e5446d7de FROMGIT: f2fs: show number of pending discard commands 28de741861 ANDROID: workqueue: export symbol of the function wq_worker_comm() 71f00d64c1 ANDROID: GKI: Update symbols to symbol list 05aa93d251 ANDROID: vendor_hooks: Add hooks for binder proc transaction Also update the .xml file for the following new symbols that are now being tracked: Leaf changes summary: 165 artifacts changed Changed leaf types summary: 0 leaf type changed Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 154 Added functions Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 11 Added variables 154 Added functions: [A] 'function void __bforget(buffer_head*)' [A] 'function ssize_t __blockdev_direct_IO(kiocb*, inode*, block_device*, iov_iter*, get_block_t*, dio_iodone_t*, dio_submit_t*, int)' [A] 'function buffer_head* __bread_gfp(block_device*, sector_t, unsigned int, gfp_t)' [A] 'function void __breadahead(block_device*, sector_t, unsigned int)' [A] 'function void __brelse(buffer_head*)' [A] 'function void __cancel_dirty_page(page*)' [A] 'function void __cleancache_invalidate_inode(address_space*)' [A] 'function void __filemap_set_wb_err(address_space*, int)' [A] 'function void __insert_inode_hash(inode*, unsigned long int)' [A] 'function void __mark_inode_dirty(inode*, int)' [A] 'function void __pagevec_release(pagevec*)' [A] 'function void __remove_inode_hash(inode*)' [A] 'function int __set_page_dirty_buffers(page*)' [A] 'function int __set_page_dirty_nobuffers(page*)' [A] 'function int __test_set_page_writeback(page*, bool)' [A] 'function int __traceiter_android_vh_binder_free_proc(void*, binder_proc*)' [A] 'function int __traceiter_android_vh_binder_has_work_ilocked(void*, binder_thread*, bool, int*)' [A] 'function int __traceiter_android_vh_binder_looper_state_registered(void*, binder_thread*, binder_proc*)' [A] 'function int __traceiter_android_vh_binder_proc_transaction_end(void*, task_struct*, task_struct*, task_struct*, unsigned int, bool, bool)' [A] 'function int __traceiter_android_vh_binder_read_done(void*, binder_proc*, binder_thread*)' [A] 'function int __traceiter_android_vh_binder_thread_read(void*, list_head**, binder_proc*, binder_thread*)' [A] 'function int __traceiter_android_vh_binder_thread_release(void*, binder_proc*, binder_thread*)' [A] 'function int __traceiter_android_vh_futex_sleep_start(void*, task_struct*)' [A] 'function int __traceiter_block_bio_remap(void*, request_queue*, bio*, dev_t, sector_t)' [A] 'function int add_to_page_cache_locked(page*, address_space*, unsigned long int, gfp_t)' [A] 'function bio* bio_split(bio*, int, gfp_t, bio_set*)' [A] 'function wait_queue_head* bit_waitqueue(void*, int)' [A] 'function blk_plug_cb* blk_check_plugged(blk_plug_cb_fn, void*, int)' [A] 'function void blk_queue_max_write_same_sectors(request_queue*, unsigned int)' [A] 'function int blkdev_issue_discard(block_device*, sector_t, sector_t, gfp_t, unsigned long int)' [A] 'function void block_invalidatepage(page*, unsigned int, unsigned int)' [A] 'function int block_is_partially_uptodate(page*, unsigned long int, unsigned long int)' [A] 'function int buffer_migrate_page(address_space*, page*, page*, migrate_mode)' [A] 'function bool capable_wrt_inode_uidgid(const inode*, int)' [A] 'function void clean_bdev_aliases(block_device*, sector_t, sector_t)' [A] 'function void clear_inode(inode*)' [A] 'function int clear_page_dirty_for_io(page*)' [A] 'function int clk_set_duty_cycle(clk*, unsigned int, unsigned int)' [A] 'function int clocksource_mmio_init(void*, const char*, unsigned long int, int, unsigned int, typedef u64 (clocksource*)*)' [A] 'function u64 clocksource_mmio_readl_up(clocksource*)' [A] 'function void create_empty_buffers(page*, unsigned long int, unsigned long int)' [A] 'function int current_umask()' [A] 'function dentry* d_add_ci(dentry*, inode*, qstr*)' [A] 'function void d_instantiate(dentry*, inode*)' [A] 'function dentry* d_obtain_alias(inode*)' [A] 'function dentry* d_splice_alias(inode*, dentry*)' [A] 'function void delete_from_page_cache(page*)' [A] 'function void disk_stack_limits(gendisk*, block_device*, sector_t)' [A] 'function void drop_nlink(inode*)' [A] 'function void end_buffer_write_sync(buffer_head*, int)' [A] 'function void end_page_writeback(page*)' [A] 'function errseq_t errseq_set(errseq_t*, int)' [A] 'function int fb_get_options(const char*, char**)' [A] 'function int fiemap_fill_next_extent(fiemap_extent_info*, u64, u64, u64, u32)' [A] 'function int fiemap_prep(inode*, fiemap_extent_info*, u64, u64*, u32)' [A] 'function int file_remove_privs(file*)' [A] 'function int file_update_time(file*)' [A] 'function int file_write_and_wait_range(file*, loff_t, loff_t)' [A] 'function vm_fault_t filemap_fault(vm_fault*)' [A] 'function int filemap_fdatawait_range(address_space*, loff_t, loff_t)' [A] 'function int filemap_fdatawrite(address_space*)' [A] 'function int filemap_flush(address_space*)' [A] 'function int filemap_write_and_wait_range(address_space*, loff_t, loff_t)' [A] 'function file* filp_open(const char*, int, umode_t)' [A] 'function void flush_delayed_fput()' [A] 'function int freq_qos_remove_notifier(freq_constraints*, freq_qos_req_type, notifier_block*)' [A] 'function int generic_error_remove_page(address_space*, page*)' [A] 'function ssize_t generic_file_direct_write(kiocb*, iov_iter*)' [A] 'function int generic_file_mmap(file*, vm_area_struct*)' [A] 'function int generic_file_open(inode*, file*)' [A] 'function ssize_t generic_file_splice_read(file*, loff_t*, pipe_inode_info*, size_t, unsigned int)' [A] 'function void generic_fillattr(inode*, kstat*)' [A] 'function ssize_t generic_read_dir(file*, char*, size_t, loff_t*)' [A] 'function page* grab_cache_page_write_begin(address_space*, unsigned long int, unsigned int)' [A] 'function inode* iget5_locked(super_block*, unsigned long int, int (inode*, void*)*, int (inode*, void*)*, void*)' [A] 'function inode* igrab(inode*)' [A] 'function void ihold(inode*)' [A] 'function int iio_write_channel_raw(iio_channel*, int)' [A] 'function inode* ilookup5(super_block*, unsigned long int, int (inode*, void*)*, void*)' [A] 'function int in_group_p(kgid_t)' [A] 'function void inc_nlink(inode*)' [A] 'function void init_special_inode(inode*, umode_t, dev_t)' [A] 'function void inode_dio_wait(inode*)' [A] 'function void inode_init_once(inode*)' [A] 'function void inode_init_owner(inode*, const inode*, umode_t)' [A] 'function int inode_newsize_ok(const inode*, loff_t)' [A] 'function void inode_set_flags(inode*, unsigned int, unsigned int)' [A] 'function void io_schedule()' [A] 'function void iov_iter_advance(iov_iter*, size_t)' [A] 'function unsigned long int iov_iter_alignment(const iov_iter*)' [A] 'function size_t iov_iter_copy_from_user_atomic(page*, iov_iter*, unsigned long int, size_t)' [A] 'function int iov_iter_fault_in_readable(iov_iter*, size_t)' [A] 'function ssize_t iov_iter_get_pages(iov_iter*, page**, size_t, unsigned int, size_t*)' [A] 'function size_t iov_iter_single_seg_count(const iov_iter*)' [A] 'function bool is_bad_inode(inode*)' [A] 'function ssize_t iter_file_splice_write(pipe_inode_info*, file*, loff_t*, size_t, unsigned int)' [A] 'function ino_t iunique(super_block*, ino_t)' [A] 'function void kill_block_super(super_block*)' [A] 'function void ll_rw_block(int, int, int, buffer_head**)' [A] 'function nls_table* load_nls(char*)' [A] 'function nls_table* load_nls_default()' [A] 'function void lru_cache_add(page*)' [A] 'function void make_bad_inode(inode*)' [A] 'function void mark_buffer_async_write(buffer_head*)' [A] 'function void mark_buffer_dirty(buffer_head*)' [A] 'function void mark_buffer_write_io_error(buffer_head*)' [A] 'function void mark_page_accessed(page*)' [A] 'function void mnt_drop_write_file(file*)' [A] 'function int mnt_want_write_file(file*)' [A] 'function dentry* mount_bdev(file_system_type*, int, const char*, void*, int (super_block*, void*, int)*)' [A] 'function void mpage_readahead(readahead_control*, get_block_t*)' [A] 'function int mpage_readpage(page*, get_block_t*)' [A] 'function int notify_change(dentry*, iattr*, inode**)' [A] 'function unsigned long int page_cache_next_miss(address_space*, unsigned long int, unsigned long int)' [A] 'function unsigned long int page_cache_prev_miss(address_space*, unsigned long int, unsigned long int)' [A] 'function bool page_mapped(page*)' [A] 'function int page_mkclean(page*)' [A] 'function void page_zero_new_buffers(page*, unsigned int, unsigned int)' [A] 'function page* pagecache_get_page(address_space*, unsigned long int, int, gfp_t)' [A] 'function unsigned int pagevec_lookup_range(pagevec*, address_space*, unsigned long int*, unsigned long int)' [A] 'function unsigned int pagevec_lookup_range_tag(pagevec*, address_space*, unsigned long int*, unsigned long int, xa_mark_t)' [A] 'function void put_pages_list(list_head*)' [A] 'function gfp_t readahead_gfp_mask(address_space*)' [A] 'function int redirty_page_for_writepage(writeback_control*, page*)' [A] 'function int rproc_set_firmware(rproc*, const char*)' [A] 'function int sb_min_blocksize(super_block*, int)' [A] 'function int sb_set_blocksize(super_block*, int)' [A] 'function void sched_clock_register(typedef u64 ()*, int, unsigned long int)' [A] 'function int security_inode_init_security(inode*, inode*, const qstr*, const initxattrs, void*)' [A] 'function void set_nlink(inode*, unsigned int)' [A] 'function int setattr_prepare(dentry*, iattr*)' [A] 'function blk_qc_t submit_bio_noacct(bio*)' [A] 'function int sync_dirty_buffer(buffer_head*)' [A] 'function int sync_filesystem(super_block*)' [A] 'function int sync_inode_metadata(inode*, int)' [A] 'function void tag_pages_for_writeback(address_space*, unsigned long int, unsigned long int)' [A] 'function timespec64 timestamp_truncate(timespec64, inode*)' [A] 'function void touch_atime(const path*)' [A] 'function void truncate_inode_pages(address_space*, loff_t)' [A] 'function void truncate_inode_pages_final(address_space*)' [A] 'function void truncate_pagecache(inode*, loff_t)' [A] 'function void truncate_setsize(inode*, loff_t)' [A] 'function int try_to_release_page(page*, gfp_t)' [A] 'function void try_to_writeback_inodes_sb(super_block*, wb_reason)' [A] 'function void unload_nls(nls_table*)' [A] 'function void unlock_buffer(buffer_head*)' [A] 'function void unlock_new_inode(inode*)' [A] 'function void usbnet_cdc_unbind(usbnet*, usb_interface*)' [A] 'function int usbnet_generic_cdc_bind(usbnet*, usb_interface*)' [A] 'function void wait_on_page_bit(page*, int)' [A] 'function int wake_bit_function(wait_queue_entry*, unsigned int, int, void*)' [A] 'function void wq_worker_comm(char*, size_t, task_struct*)' [A] 'function int write_inode_now(inode*, int)' [A] 'function int write_one_page(page*)' 11 Added variables: [A] 'tracepoint __tracepoint_android_rvh_do_ptrauth_fault' [A] 'tracepoint __tracepoint_android_vh_binder_free_proc' [A] 'tracepoint __tracepoint_android_vh_binder_has_work_ilocked' [A] 'tracepoint __tracepoint_android_vh_binder_looper_state_registered' [A] 'tracepoint __tracepoint_android_vh_binder_proc_transaction_end' [A] 'tracepoint __tracepoint_android_vh_binder_read_done' [A] 'tracepoint __tracepoint_android_vh_binder_thread_read' [A] 'tracepoint __tracepoint_android_vh_binder_thread_release' [A] 'tracepoint __tracepoint_android_vh_futex_sleep_start' [A] 'tracepoint __tracepoint_android_vh_subpage_dma_contig_alloc' [A] 'tracepoint __tracepoint_block_bio_remap' Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I064b6ff0420cee2d64e17814f43fbff8e2d9b019 Change-Id: Ia880c70c912f2b801a770feb1fdc4f4eb390d34d	2022-01-17 18:47:02 +01:00
Greg Kroah-Hartman	d483eed85f	ANDROID: GKI: set vfs-only exports into their own namespace ... We have namespaces, so use them for all vfs-exported namespaces so that filesystems can use them, but not anything else. Some in-kernel drivers that do direct filesystem accesses (because they serve up files) are also allowed access to these symbols to keep 'make allmodconfig' builds working properly, but it is not needed for Android kernel images. Bug: 157965270 Bug: 210074446 Cc: Matthias Maennich <maennich@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Iaf6140baf3a18a516ab2d5c3966235c42f3f70de	2022-01-11 09:30:47 +01:00
Eric Dumazet	3db53827a0	af_unix: fix races in sk_peer_pid and sk_peer_cred accesses ... [ Upstream commit 35306eb23814444bd4021f8a1c3047d3cb0c8b2b ] Jann Horn reported that SO_PEERCRED and SO_PEERGROUPS implementations are racy, as af_unix can concurrently change sk_peer_pid and sk_peer_cred. In order to fix this issue, this patch adds a new spinlock that needs to be used whenever these fields are read or written. Jann also pointed out that l2cap_sock_get_peer_pid_cb() is currently reading sk->sk_peer_pid which makes no sense, as this field is only possibly set by AF_UNIX sockets. We will have to clean this in a separate patch. This could be done by reverting b48596d1dc "Bluetooth: L2CAP: Add get_peer_pid callback" or implementing what was truly expected. Fixes: 109f6e39fa ("af_unix: Allow SO_PEERCRED to work across namespaces.") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: Jann Horn <jannh@google.com> Cc: Eric W. Biederman <ebiederm@xmission.com> Cc: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Cc: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-10-06 15:55:58 +02:00
Eric Dumazet	df38f941a7	net/af_unix: fix a data-race in unix_dgram_poll ... commit 04f08eb44b5011493d77b602fdec29ff0f5c6cd5 upstream. syzbot reported another data-race in af_unix [1] Lets change __skb_insert() to use WRITE_ONCE() when changing skb head qlen. Also, change unix_dgram_poll() to use lockless version of unix_recvq_full() It is verry possible we can switch all/most unix_recvq_full() to the lockless version, this will be done in a future kernel version. [1] HEAD commit: 8596e589b787732c8346f0482919e83cc9362db1 BUG: KCSAN: data-race in skb_queue_tail / unix_dgram_poll write to 0xffff88814eeb24e0 of 4 bytes by task 25815 on cpu 0: __skb_insert include/linux/skbuff.h:1938 [inline] __skb_queue_before include/linux/skbuff.h:2043 [inline] __skb_queue_tail include/linux/skbuff.h:2076 [inline] skb_queue_tail+0x80/0xa0 net/core/skbuff.c:3264 unix_dgram_sendmsg+0xff2/0x1600 net/unix/af_unix.c:1850 sock_sendmsg_nosec net/socket.c:703 [inline] sock_sendmsg net/socket.c:723 [inline] ____sys_sendmsg+0x360/0x4d0 net/socket.c:2392 ___sys_sendmsg net/socket.c:2446 [inline] __sys_sendmmsg+0x315/0x4b0 net/socket.c:2532 __do_sys_sendmmsg net/socket.c:2561 [inline] __se_sys_sendmmsg net/socket.c:2558 [inline] __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2558 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae read to 0xffff88814eeb24e0 of 4 bytes by task 25834 on cpu 1: skb_queue_len include/linux/skbuff.h:1869 [inline] unix_recvq_full net/unix/af_unix.c:194 [inline] unix_dgram_poll+0x2bc/0x3e0 net/unix/af_unix.c:2777 sock_poll+0x23e/0x260 net/socket.c:1288 vfs_poll include/linux/poll.h:90 [inline] ep_item_poll fs/eventpoll.c:846 [inline] ep_send_events fs/eventpoll.c:1683 [inline] ep_poll fs/eventpoll.c:1798 [inline] do_epoll_wait+0x6ad/0xf00 fs/eventpoll.c:2226 __do_sys_epoll_wait fs/eventpoll.c:2238 [inline] __se_sys_epoll_wait fs/eventpoll.c:2233 [inline] __x64_sys_epoll_wait+0xf6/0x120 fs/eventpoll.c:2233 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae value changed: 0x0000001b -> 0x00000001 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 25834 Comm: syz-executor.1 Tainted: G W 5.14.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Fixes: 86b18aaa2b ("skbuff: fix a data race in skb_queue_len()") Cc: Qian Cai <cai@lca.pw> Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-09-22 12:27:58 +02:00
Miklos Szeredi	93c5951e0c	af_unix: fix garbage collect vs MSG_PEEK ... commit cbcf01128d0a92e131bd09f1688fe032480b65ca upstream. unix_gc() assumes that candidate sockets can never gain an external reference (i.e. be installed into an fd) while the unix_gc_lock is held. Except for MSG_PEEK this is guaranteed by modifying inflight count under the unix_gc_lock. MSG_PEEK does not touch any variable protected by unix_gc_lock (file count is not), yet it needs to be serialized with garbage collection. Do this by locking/unlocking unix_gc_lock: 1) increment file count 2) lock/unlock barrier to make sure incremented file count is visible to garbage collection 3) install file into fd This is a lock barrier (unlike smp_mb()) that ensures that garbage collection is run completely before or completely after the barrier. Cc: <stable@vger.kernel.org> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-07-31 08:16:11 +02:00
Eric Dumazet	5f2ccc58a3	net/af_unix: fix a data-race in unix_dgram_sendmsg / unix_release_sock ... [ Upstream commit a494bd642d9120648b06bb7d28ce6d05f55a7819 ] While unix_may_send(sk, osk) is called while osk is locked, it appears unix_release_sock() can overwrite unix_peer() after this lock has been released, making KCSAN unhappy. Changing unix_release_sock() to access/change unix_peer() before lock is released should fix this issue. BUG: KCSAN: data-race in unix_dgram_sendmsg / unix_release_sock write to 0xffff88810465a338 of 8 bytes by task 20852 on cpu 1: unix_release_sock+0x4ed/0x6e0 net/unix/af_unix.c:558 unix_release+0x2f/0x50 net/unix/af_unix.c:859 __sock_release net/socket.c:599 [inline] sock_close+0x6c/0x150 net/socket.c:1258 __fput+0x25b/0x4e0 fs/file_table.c:280 ____fput+0x11/0x20 fs/file_table.c:313 task_work_run+0xae/0x130 kernel/task_work.c:164 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop kernel/entry/common.c:175 [inline] exit_to_user_mode_prepare+0x156/0x190 kernel/entry/common.c:209 __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline] syscall_exit_to_user_mode+0x20/0x40 kernel/entry/common.c:302 do_syscall_64+0x56/0x90 arch/x86/entry/common.c:57 entry_SYSCALL_64_after_hwframe+0x44/0xae read to 0xffff88810465a338 of 8 bytes by task 20888 on cpu 0: unix_may_send net/unix/af_unix.c:189 [inline] unix_dgram_sendmsg+0x923/0x1610 net/unix/af_unix.c:1712 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg net/socket.c:674 [inline] ____sys_sendmsg+0x360/0x4d0 net/socket.c:2350 ___sys_sendmsg net/socket.c:2404 [inline] __sys_sendmmsg+0x315/0x4b0 net/socket.c:2490 __do_sys_sendmmsg net/socket.c:2519 [inline] __se_sys_sendmmsg net/socket.c:2516 [inline] __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2516 do_syscall_64+0x4a/0x90 arch/x86/entry/common.c:47 entry_SYSCALL_64_after_hwframe+0x44/0xae value changed: 0xffff888167905400 -> 0x0000000000000000 Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 20888 Comm: syz-executor.0 Not tainted 5.13.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-06-23 14:42:46 +02:00
Or Cohen	c9bf52a173	net/af_unix: Remove unused old_pid variable ... Commit 109f6e39fa ("af_unix: Allow SO_PEERCRED to work across namespaces.") introduced the old_pid variable in unix_listen, but it's never used. Remove the declaration and the call to put_pid. Signed-off-by: Or Cohen <orcohen@paloaltonetworks.com> Link: https://lore.kernel.org/r/20201011153527.18628-1-orcohen@paloaltonetworks.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>	2020-10-13 17:21:46 -07:00
Jing Xiangfeng	c8c33b80f4	net: unix: remove redundant assignment to variable 'err' ... After commit 37ab4fa784 ("net: unix: allow bind to fail on mutex lock"), the assignment to err is redundant. So remove it. Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2020-09-21 14:51:37 -07:00
Gustavo A. R. Silva	df561f6688	treewide: Use fallthrough pseudo-keyword ... Replace the existing /* fall through */ comments and its variants with the new pseudo-keyword macro fallthrough[1]. Also, remove unnecessary fall-through markings when it is the case. [1] https://www.kernel.org/doc/html/v5.7/process/deprecated.html?highlight=fallthrough#implicit-switch-case-fall-through Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>	2020-08-23 17:36:59 -05:00
Christoph Hellwig	a44d9e7210	net: make ->{get,set}sockopt in proto_ops optional ... Just check for a NULL method instead of wiring up sock_no_{get,set}sockopt. Signed-off-by: Christoph Hellwig <hch@lst.de> Acked-by: Marc Kleine-Budde <mkl@pengutronix.de> Signed-off-by: David S. Miller <davem@davemloft.net>	2020-07-19 18:16:41 -07:00
Paolo Abeni	e427cad6ee	net: datagram: drop 'destructor' argument from several helpers ... The only users for such argument are the UDP protocol and the UNIX socket family. We can safely reclaim the accounted memory directly from the UDP code and, after the previous patch, we can do scm stats accounting outside the datagram helpers. Overall this cleans up a bit some datagram-related helpers, and avoids an indirect call per packet in the UDP receive path. v1 -> v2: - call scm_stat_del() only when not peeking - Kirill - fix build issue with CONFIG_INET_ESPINTCP Signed-off-by: Paolo Abeni <pabeni@redhat.com> Reviewed-by: Kirill Tkhai <ktkhai@virtuozzo.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2020-02-28 12:12:53 -08:00
Paolo Abeni	7782040b95	unix: uses an atomic type for scm files accounting ... So the scm_stat_{add,del} helper can be invoked with no additional lock held. This clean-up the code a bit and will make the next patch easier. Signed-off-by: Paolo Abeni <pabeni@redhat.com> Reviewed-by: Kirill Tkhai <ktkhai@virtuozzo.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2020-02-28 12:12:53 -08:00
David S. Miller	9f6e055907	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net ... The mptcp conflict was overlapping additions. The SMC conflict was an additional and removal happening at the same time. Signed-off-by: David S. Miller <davem@davemloft.net>	2020-02-27 18:31:39 -08:00
David S. Miller	5c05a164d4	unix: It's CONFIG_PROC_FS not CONFIG_PROCFS ... Fixes: 3a12500ed5 ("unix: define and set show_fdinfo only if procfs is enabled") Signed-off-by: David S. Miller <davem@davemloft.net>	2020-02-27 11:52:35 -08:00
Tobias Klauser	3a12500ed5	unix: define and set show_fdinfo only if procfs is enabled ... Follow the pattern used with other *_show_fdinfo functions and only define unix_show_fdinfo and set it in proto_ops if CONFIG_PROCFS is set. Fixes: 3c32da19a8 ("unix: Show number of pending scm files of receive queue in fdinfo") Signed-off-by: Tobias Klauser <tklauser@distanz.ch> Reviewed-by: Kirill Tkhai <ktkhai@virtuozzo.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2020-02-27 11:11:57 -08:00
Jules Irenge	48851e9e80	af_unix: Add missing annotation for unix_wait_for_peer() ... Sparse reports a warning unix_wait_for_peer() warning: context imbalance in unix_wait_for_peer() - unexpected unlock The root cause is the missing annotation at unix_wait_for_peer() Add the missing annotation __releases(&unix_sk(other)->lock) Signed-off-by: Jules Irenge <jbi.octave@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2020-02-24 13:26:49 -08:00
Qian Cai	86b18aaa2b	skbuff: fix a data race in skb_queue_len() ... sk_buff.qlen can be accessed concurrently as noticed by KCSAN, BUG: KCSAN: data-race in __skb_try_recv_from_queue / unix_dgram_sendmsg read to 0xffff8a1b1d8a81c0 of 4 bytes by task 5371 on cpu 96: unix_dgram_sendmsg+0x9a9/0xb70 include/linux/skbuff.h:1821 net/unix/af_unix.c:1761 ____sys_sendmsg+0x33e/0x370 ___sys_sendmsg+0xa6/0xf0 __sys_sendmsg+0x69/0xf0 __x64_sys_sendmsg+0x51/0x70 do_syscall_64+0x91/0xb47 entry_SYSCALL_64_after_hwframe+0x49/0xbe write to 0xffff8a1b1d8a81c0 of 4 bytes by task 1 on cpu 99: __skb_try_recv_from_queue+0x327/0x410 include/linux/skbuff.h:2029 __skb_try_recv_datagram+0xbe/0x220 unix_dgram_recvmsg+0xee/0x850 ____sys_recvmsg+0x1fb/0x210 ___sys_recvmsg+0xa2/0xf0 __sys_recvmsg+0x66/0xf0 __x64_sys_recvmsg+0x51/0x70 do_syscall_64+0x91/0xb47 entry_SYSCALL_64_after_hwframe+0x49/0xbe Since only the read is operating as lockless, it could introduce a logic bug in unix_recvq_full() due to the load tearing. Fix it by adding a lockless variant of skb_queue_len() and unix_recvq_full() where READ_ONCE() is on the read while WRITE_ONCE() is on the write similar to the commit d7d16a8935 ("net: add skb_queue_empty_lockless()"). Signed-off-by: Qian Cai <cai@lca.pw> Signed-off-by: David S. Miller <davem@davemloft.net>	2020-02-06 13:59:10 +01:00
David S. Miller	4f2c17e0f3	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next ... Steffen Klassert says: ==================== pull request (net-next): ipsec-next 2020-01-21 1) Add support for TCP encapsulation of IKE and ESP messages, as defined by RFC 8229. Patchset from Sabrina Dubroca. Please note that there is a merge conflict in: net/unix/af_unix.c between commit: 3c32da19a8 ("unix: Show number of pending scm files of receive queue in fdinfo") from the net-next tree and commit: b50b0580d2 ("net: add queue argument to __skb_wait_for_more_packets and __skb_{,try_}recv_datagram") from the ipsec-next tree. The conflict can be solved as done in linux-next. Please pull or let me know if there are problems. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>	2020-01-21 12:18:20 +01:00
David S. Miller	ac80010fc9	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net ... Mere overlapping changes in the conflicts here. Signed-off-by: David S. Miller <davem@davemloft.net>	2019-12-22 15:15:05 -08:00
Kirill Tkhai	3c32da19a8	unix: Show number of pending scm files of receive queue in fdinfo ... Unix sockets like a block box. You never know what is stored there: there may be a file descriptor holding a mount or a block device, or there may be whole universes with namespaces, sockets with receive queues full of sockets etc. The patch adds a little debug and accounts number of files (not recursive), which is in receive queue of a unix socket. Sometimes this is useful to determine, that socket should be investigated or which task should be killed to put reference counter on a resourse. v2: Pass correct argument to lockdep Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2019-12-12 17:04:55 -08:00
Pankaj Bharadiya	c593642c8b	treewide: Use sizeof_field() macro ... Replace all the occurrences of FIELD_SIZEOF() with sizeof_field() except at places where these are defined. Later patches will remove the unused definition of FIELD_SIZEOF(). This patch is generated using following script: EXCLUDE_FILES="include/linux/stddef.h|include/linux/kernel.h" git grep -l -e "\bFIELD_SIZEOF\b" | while read file; do if [[ "$file" =~ $EXCLUDE_FILES ]]; then continue fi sed -i -e 's/\bFIELD_SIZEOF\b/sizeof_field/g' $file; done Signed-off-by: Pankaj Bharadiya <pankaj.laxminarayan.bharadiya@intel.com> Link: https://lore.kernel.org/r/20190924105839.110713-3-pankaj.laxminarayan.bharadiya@intel.com Co-developed-by: Kees Cook <keescook@chromium.org> Signed-off-by: Kees Cook <keescook@chromium.org> Acked-by: David Miller <davem@davemloft.net> # for net	2019-12-09 10:36:44 -08:00
Sabrina Dubroca	b50b0580d2	net: add queue argument to __skb_wait_for_more_packets and __skb_{,try_}recv_datagram ... This will be used by ESP over TCP to handle the queue of IKE messages. Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Acked-by: David S. Miller <davem@davemloft.net> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>	2019-12-09 09:59:07 +01:00
Linus Torvalds	0da522107e	Merge tag 'compat-ioctl-5.5' of git://git.kernel.org:/pub/scm/linux/kernel/git/arnd/playground ... Pull removal of most of fs/compat_ioctl.c from Arnd Bergmann: "As part of the cleanup of some remaining y2038 issues, I came to fs/compat_ioctl.c, which still has a couple of commands that need support for time64_t. In completely unrelated work, I spent time on cleaning up parts of this file in the past, moving things out into drivers instead. After Al Viro reviewed an earlier version of this series and did a lot more of that cleanup, I decided to try to completely eliminate the rest of it and move it all into drivers. This series incorporates some of Al's work and many patches of my own, but in the end stops short of actually removing the last part, which is the scsi ioctl handlers. I have patches for those as well, but they need more testing or possibly a rewrite" * tag 'compat-ioctl-5.5' of git://git.kernel.org:/pub/scm/linux/kernel/git/arnd/playground: (42 commits) scsi: sd: enable compat ioctls for sed-opal pktcdvd: add compat_ioctl handler compat_ioctl: move SG_GET_REQUEST_TABLE handling compat_ioctl: ppp: move simple commands into ppp_generic.c compat_ioctl: handle PPPIOCGIDLE for 64-bit time_t compat_ioctl: move PPPIOCSCOMPRESS to ppp_generic compat_ioctl: unify copy-in of ppp filters tty: handle compat PPP ioctls compat_ioctl: move SIOCOUTQ out of compat_ioctl.c compat_ioctl: handle SIOCOUTQNSD af_unix: add compat_ioctl support compat_ioctl: reimplement SG_IO handling compat_ioctl: move WDIOC handling into wdt drivers fs: compat_ioctl: move FITRIM emulation into file systems gfs2: add compat_ioctl support compat_ioctl: remove unused convert_in_user macro compat_ioctl: remove last RAID handling code compat_ioctl: remove /dev/raw ioctl translation compat_ioctl: remove PCI ioctl translation compat_ioctl: remove joystick ioctl translation ...	2019-12-01 13:46:15 -08:00
David S. Miller	d31e95585c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net ... The only slightly tricky merge conflict was the netdevsim because the mutex locking fix overlapped a lot of driver reload reorganization. The rest were (relatively) trivial in nature. Signed-off-by: David S. Miller <davem@davemloft.net>	2019-11-02 13:54:56 -07:00
Eric Dumazet	3ef7cf57c7	net: use skb_queue_empty_lockless() in poll() handlers ... Many poll() handlers are lockless. Using skb_queue_empty_lockless() instead of skb_queue_empty() is more appropriate. Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2019-10-28 13:33:41 -07:00
Arnd Bergmann	5f6beb9e0f	af_unix: add compat_ioctl support ... The af_unix protocol family has a custom ioctl command (inexplicibly based on SIOCPROTOPRIVATE), but never had a compat_ioctl handler for 32-bit applications. Since all commands are compatible here, add a trivial wrapper that performs the compat_ptr() conversion for SIOCOUTQ/SIOCINQ. SIOCUNIXFILE does not use the argument, but it doesn't hurt to also use compat_ptr() here. Fixes: ba94f3088b ("unix: add ioctl to open a unix socket file with O_PATH") Cc: netdev@vger.kernel.org Cc: "David S. Miller" <davem@davemloft.net> Cc: Eric Dumazet <edumazet@google.com> Signed-off-by: Arnd Bergmann <arnd@arndb.de>	2019-10-23 17:23:46 +02:00
Vito Caputo	262ce0af81	af_unix: __unix_find_socket_byname() cleanup ... Remove pointless return variable dance. Appears vestigial from when the function did locking as seen in unix_find_socket_byinode(), but locking is handled in unix_find_socket_byname() for __unix_find_socket_byname(). Signed-off-by: Vito Caputo <vcaputo@pengaru.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2019-10-11 20:40:18 -07:00
Thomas Gleixner	2874c5fd28	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 ... Based on 1 normalized pattern(s): this program is free software you can redistribute it and or modify it under the terms of the gnu general public license as published by the free software foundation either version 2 of the license or at your option any later version extracted by the scancode license scanner the SPDX license identifier GPL-2.0-or-later has been chosen to replace the boilerplate/reference in 3029 file(s). Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Allison Randal <allison@lohutok.net> Cc: linux-spdx@vger.kernel.org Link: https://lkml.kernel.org/r/20190527070032.746973796@linutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2019-05-30 11:26:32 -07:00
Paolo Abeni	fd69c399c7	datagram: remove rendundant 'peeked' argument ... After commit a297569fe0 ("net/udp: do not touch skb->peeked unless really needed") the 'peeked' argument of __skb_try_recv_datagram() and friends is always equal to !!'flags & MSG_PEEK'. Since such argument is really a boolean info, and the callers have already 'flags & MSG_PEEK' handy, we can remove it and clean-up the code a bit. Signed-off-by: Paolo Abeni <pabeni@redhat.com> Acked-by: Willem de Bruijn <willemb@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>	2019-04-08 09:51:54 -07:00
Linus Torvalds	38e7571c07	Merge tag 'io_uring-2019-03-06' of git://git.kernel.dk/linux-block ... Pull io_uring IO interface from Jens Axboe: "Second attempt at adding the io_uring interface. Since the first one, we've added basic unit testing of the three system calls, that resides in liburing like the other unit tests that we have so far. It'll take a while to get full coverage of it, but we're working towards it. I've also added two basic test programs to tools/io_uring. One uses the raw interface and has support for all the various features that io_uring supports outside of standard IO, like fixed files, fixed IO buffers, and polled IO. The other uses the liburing API, and is a simplified version of cp(1). This adds support for a new IO interface, io_uring. io_uring allows an application to communicate with the kernel through two rings, the submission queue (SQ) and completion queue (CQ) ring. This allows for very efficient handling of IOs, see the v5 posting for some basic numbers: https://lore.kernel.org/linux-block/20190116175003.17880-1-axboe@kernel.dk/ Outside of just efficiency, the interface is also flexible and extendable, and allows for future use cases like the upcoming NVMe key-value store API, networked IO, and so on. It also supports async buffered IO, something that we've always failed to support in the kernel. Outside of basic IO features, it supports async polled IO as well. This particular feature has already been tested at Facebook months ago for flash storage boxes, with 25-33% improvements. It makes polled IO actually useful for real world use cases, where even basic flash sees a nice win in terms of efficiency, latency, and performance. These boxes were IOPS bound before, now they are not. This series adds three new system calls. One for setting up an io_uring instance (io_uring_setup(2)), one for submitting/completing IO (io_uring_enter(2)), and one for aux functions like registrating file sets, buffers, etc (io_uring_register(2)). Through the help of Arnd, I've coordinated the syscall numbers so merge on that front should be painless. Jon did a writeup of the interface a while back, which (except for minor details that have been tweaked) is still accurate. Find that here: https://lwn.net/Articles/776703/ Huge thanks to Al Viro for helping getting the reference cycle code correct, and to Jann Horn for his extensive reviews focused on both security and bugs in general. There's a userspace library that provides basic functionality for applications that don't need or want to care about how to fiddle with the rings directly. It has helpers to allow applications to easily set up an io_uring instance, and submit/complete IO through it without knowing about the intricacies of the rings. It also includes man pages (thanks to Jeff Moyer), and will continue to grow support helper functions and features as time progresses. Find it here: git://git.kernel.dk/liburing Fio has full support for the raw interface, both in the form of an IO engine (io_uring), but also with a small test application (t/io_uring) that can exercise and benchmark the interface" * tag 'io_uring-2019-03-06' of git://git.kernel.dk/linux-block: io_uring: add a few test tools io_uring: allow workqueue item to handle multiple buffered requests io_uring: add support for IORING_OP_POLL io_uring: add io_kiocb ref count io_uring: add submission polling io_uring: add file set registration net: split out functions related to registering inflight socket files io_uring: add support for pre-mapped user IO buffers block: implement bio helper to add iter bvec pages to bio io_uring: batch io_kiocb allocation io_uring: use fget/fput_many() for file references fs: add fget_many() and fput_many() io_uring: support for IO polling io_uring: add fsync support Add io_uring IO interface	2019-03-08 14:48:40 -08:00