commit 983695fa676568fc0fe5ddd995c7267aabc24632 upstream.
Intention of cgroup bind/connect/sendmsg BPF hooks is to act transparently
to applications as also stated in original motivation in 7828f20e3779 ("Merge
branch 'bpf-cgroup-bind-connect'"). When recently integrating the latter
two hooks into Cilium to enable host based load-balancing with Kubernetes,
I ran into the issue that pods couldn't start up as DNS got broken. Kubernetes
typically sets up DNS as a service and is thus subject to load-balancing.
Upon further debugging, it turns out that the cgroupv2 sendmsg BPF hooks API
is currently insufficient and thus not usable as-is for standard applications
shipped with most distros. To break down the issue we ran into with a simple
example:
# cat /etc/resolv.conf
nameserver 147.75.207.207
nameserver 147.75.207.208
For the purpose of a simple test, we set up above IPs as service IPs and
transparently redirect traffic to a different DNS backend server for that
node:
# cilium service list
ID Frontend Backend
1 147.75.207.207:53 1 => 8.8.8.8:53
2 147.75.207.208:53 1 => 8.8.8.8:53
The attached BPF program is basically selecting one of the backends if the
service IP/port matches on the cgroup hook. DNS breaks here, because the
hooks are not transparent enough to applications which have built-in msg_name
address checks:
# nslookup 1.1.1.1
;; reply from unexpected source: 8.8.8.8#53, expected 147.75.207.207#53
;; reply from unexpected source: 8.8.8.8#53, expected 147.75.207.208#53
;; reply from unexpected source: 8.8.8.8#53, expected 147.75.207.207#53
[...]
;; connection timed out; no servers could be reached
# dig 1.1.1.1
;; reply from unexpected source: 8.8.8.8#53, expected 147.75.207.207#53
;; reply from unexpected source: 8.8.8.8#53, expected 147.75.207.208#53
;; reply from unexpected source: 8.8.8.8#53, expected 147.75.207.207#53
[...]
; <<>> DiG 9.11.3-1ubuntu1.7-Ubuntu <<>> 1.1.1.1
;; global options: +cmd
;; connection timed out; no servers could be reached
For comparison, if none of the service IPs is used, and we tell nslookup
to use 8.8.8.8 directly it works just fine, of course:
# nslookup 1.1.1.1 8.8.8.8
1.1.1.1.in-addr.arpa name = one.one.one.one.
In order to fix this and thus act more transparent to the application,
this needs reverse translation on recvmsg() side. A minimal fix for this
API is to add similar recvmsg() hooks behind the BPF cgroups static key
such that the program can track state and replace the current sockaddr_in{,6}
with the original service IP. From BPF side, this basically tracks the
service tuple plus socket cookie in an LRU map where the reverse NAT can
then be retrieved via map value as one example. Side-note: the BPF cgroups
static key should be converted to a per-hook static key in future.
Same example after this fix:
# cilium service list
ID Frontend Backend
1 147.75.207.207:53 1 => 8.8.8.8:53
2 147.75.207.208:53 1 => 8.8.8.8:53
Lookups work fine now:
# nslookup 1.1.1.1
1.1.1.1.in-addr.arpa name = one.one.one.one.
Authoritative answers can be found from:
# dig 1.1.1.1
; <<>> DiG 9.11.3-1ubuntu1.7-Ubuntu <<>> 1.1.1.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 51550
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;1.1.1.1. IN A
;; AUTHORITY SECTION:
. 23426 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2019052001 1800 900 604800 86400
;; Query time: 17 msec
;; SERVER: 147.75.207.207#53(147.75.207.207)
;; WHEN: Tue May 21 12:59:38 UTC 2019
;; MSG SIZE rcvd: 111
And from an actual packet level it shows that we're using the back end
server when talking via 147.75.207.20{7,8} front end:
# tcpdump -i any udp
[...]
12:59:52.698732 IP foo.42011 > google-public-dns-a.google.com.domain: 18803+ PTR? 1.1.1.1.in-addr.arpa. (38)
12:59:52.698735 IP foo.42011 > google-public-dns-a.google.com.domain: 18803+ PTR? 1.1.1.1.in-addr.arpa. (38)
12:59:52.701208 IP google-public-dns-a.google.com.domain > foo.42011: 18803 1/0/0 PTR one.one.one.one. (67)
12:59:52.701208 IP google-public-dns-a.google.com.domain > foo.42011: 18803 1/0/0 PTR one.one.one.one. (67)
[...]
In order to be flexible and to have same semantics as in sendmsg BPF
programs, we only allow return codes in [1,1] range. In the sendmsg case
the program is called if msg->msg_name is present which can be the case
in both, connected and unconnected UDP.
The former only relies on the sockaddr_in{,6} passed via connect(2) if
passed msg->msg_name was NULL. Therefore, on recvmsg side, we act in similar
way to call into the BPF program whenever a non-NULL msg->msg_name was
passed independent of sk->sk_state being TCP_ESTABLISHED or not. Note
that for TCP case, the msg->msg_name is ignored in the regular recvmsg
path and therefore not relevant.
For the case of ip{,v6}_recv_error() paths, picked up via MSG_ERRQUEUE,
the hook is not called. This is intentional as it aligns with the same
semantics as in case of TCP cgroup BPF hooks right now. This might be
better addressed in future through a different bpf_attach_type such
that this case can be distinguished from the regular recvmsg paths,
for example.
Fixes: 1cedee13d25a ("bpf: Hooks for sys_sendmsg")
Change-Id: I41a8551c5ab8a336796ef85b8bb1cfaf48cb8843
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Andrey Ignatov <rdna@fb.com>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Acked-by: Martynas Pumputis <m@lambda.lt>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Daniel Borkmannauthored and Sorayukiicommited 2026-05-15 17:56:57 +07:00
This patch allows a BPF_PROG_TYPE_SK_REUSEPORT bpf prog to select a
SO_REUSEPORT sk from a BPF_MAP_TYPE_REUSEPORT_ARRAY introduced in
the earlier patch. "bpf_run_sk_reuseport()" will return -ECONNREFUSED
when the BPF_PROG_TYPE_SK_REUSEPORT prog returns SK_DROP.
The callers, in inet[6]_hashtable.c and ipv[46]/udp.c, are modified to
handle this case and return NULL immediately instead of continuing the
sk search from its hashtable.
It re-uses the existing SO_ATTACH_REUSEPORT_EBPF setsockopt to attach
BPF_PROG_TYPE_SK_REUSEPORT. The "sk_reuseport_attach_bpf()" will check
if the attaching bpf prog is in the new SK_REUSEPORT or the existing
SOCKET_FILTER type and then check different things accordingly.
One level of "__reuseport_attach_prog()" call is removed. The
"sk_unhashed() && ..." and "sk->sk_reuseport_cb" tests are pushed
back to "reuseport_attach_prog()" in sock_reuseport.c. sock_reuseport.c
seems to have more knowledge on those test requirements than filter.c.
In "reuseport_attach_prog()", after new_prog is attached to reuse->prog,
the old_prog (if any) is also directly freed instead of returning the
old_prog to the caller and asking the caller to free.
The sysctl_optmem_max check is moved back to the
"sk_reuseport_attach_filter()" and "sk_reuseport_attach_bpf()".
As of other bpf prog types, the new BPF_PROG_TYPE_SK_REUSEPORT is only
bounded by the usual "bpf_prog_charge_memlock()" during load time
instead of bounded by both bpf_prog_charge_memlock and sysctl_optmem_max.
Change-Id: Iefb87c0f2ce87110e63f0feded73c087cc65c52e
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Martin KaFai Lauauthored and Sorayukiicommited 2026-05-15 17:56:49 +07:00
This patch moves the udp[46]_portaddr_hash()
to net/ip[v6].h. The function name is renamed to
ipv[46]_portaddr_hash().
It will be used by a later patch which adds a second listener
hashtable hashed by the address and port.
Change-Id: Ie185f651128d2a2f1643f893a6eebe71d46020fa
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Martin KaFai Lauauthored and Sorayukiicommited 2026-05-15 17:56:48 +07:00
Since commit e32ea7e747 ("soreuseport: fast reuseport UDP socket
selection") and commit c125e80b88 ("soreuseport: fast reuseport
TCP socket selection") the relevant reuseport socket matching the current
packet is selected by the reuseport_select_sock() call. The only
exceptions are invalid BPF filters/filters returning out-of-range
indices.
In the latter case the code implicitly falls back to using the hash
demultiplexing, but instead of selecting the socket inside the
reuseport_select_sock() function, it relies on the hash selection
logic introduced with the early soreuseport implementation.
With this patch, in case of a BPF filter returning a bad socket
index value, we fall back to hash-based selection inside the
reuseport_select_sock() body, so that we can drop some duplicate
code in the ipv4 and ipv6 stack.
This also allows faster lookup in the above scenario and will allow
us to avoid computing the hash value for successful, BPF based
demultiplexing - in a later patch.
Change-Id: Ib55f4a673bbf9453454a663bc6c06954bea94065
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Acked-by: Craig Gallek <kraig@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Paolo Abeniauthored and Sorayukiicommited 2026-05-15 17:56:48 +07:00
In addition to already existing BPF hooks for sys_bind and sys_connect,
the patch provides new hooks for sys_sendmsg.
It leverages existing BPF program type `BPF_PROG_TYPE_CGROUP_SOCK_ADDR`
that provides access to socket itlself (properties like family, type,
protocol) and user-passed `struct sockaddr *` so that BPF program can
override destination IP and port for system calls such as sendto(2) or
sendmsg(2) and/or assign source IP to the socket.
The hooks are implemented as two new attach types:
`BPF_CGROUP_UDP4_SENDMSG` and `BPF_CGROUP_UDP6_SENDMSG` for UDPv4 and
UDPv6 correspondingly.
UDPv4 and UDPv6 separate attach types for same reason as sys_bind and
sys_connect hooks, i.e. to prevent reading from / writing to e.g.
user_ip6 fields when user passes sockaddr_in since it'd be out-of-bound.
The difference with already existing hooks is sys_sendmsg are
implemented only for unconnected UDP.
For TCP it doesn't make sense to change user-provided `struct sockaddr *`
at sendto(2)/sendmsg(2) time since socket either was already connected
and has source/destination set or wasn't connected and call to
sendto(2)/sendmsg(2) would lead to ENOTCONN anyway.
Connected UDP is already handled by sys_connect hooks that can override
source/destination at connect time and use fast-path later, i.e. these
hooks don't affect UDP fast-path.
Rewriting source IP is implemented differently than that in sys_connect
hooks. When sys_sendmsg is used with unconnected UDP it doesn't work to
just bind socket to desired local IP address since source IP can be set
on per-packet basis by using ancillary data (cmsg(3)). So no matter if
socket is bound or not, source IP has to be rewritten on every call to
sys_sendmsg.
To do so two new fields are added to UAPI `struct bpf_sock_addr`;
* `msg_src_ip4` to set source IPv4 for UDPv4;
* `msg_src_ip6` to set source IPv6 for UDPv6.
Change-Id: If2579364b20e5184f9340fe6f2036fe40478b591
Signed-off-by: Andrey Ignatov <rdna@fb.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Andrey Ignatovauthored and Sorayukiicommited 2026-05-15 17:56:34 +07:00
== The problem ==
See description of the problem in the initial patch of this patch set.
== The solution ==
The patch provides much more reliable in-kernel solution for the 2nd
part of the problem: making outgoing connecttion from desired IP.
It adds new attach types `BPF_CGROUP_INET4_CONNECT` and
`BPF_CGROUP_INET6_CONNECT` for program type
`BPF_PROG_TYPE_CGROUP_SOCK_ADDR` that can be used to override both
source and destination of a connection at connect(2) time.
Local end of connection can be bound to desired IP using newly
introduced BPF-helper `bpf_bind()`. It allows to bind to only IP though,
and doesn't support binding to port, i.e. leverages
`IP_BIND_ADDRESS_NO_PORT` socket option. There are two reasons for this:
* looking for a free port is expensive and can affect performance
significantly;
* there is no use-case for port.
As for remote end (`struct sockaddr *` passed by user), both parts of it
can be overridden, remote IP and remote port. It's useful if an
application inside cgroup wants to connect to another application inside
same cgroup or to itself, but knows nothing about IP assigned to the
cgroup.
Support is added for IPv4 and IPv6, for TCP and UDP.
IPv4 and IPv6 have separate attach types for same reason as sys_bind
hooks, i.e. to prevent reading from / writing to e.g. user_ip6 fields
when user passes sockaddr_in since it'd be out-of-bound.
== Implementation notes ==
The patch introduces new field in `struct proto`: `pre_connect` that is
a pointer to a function with same signature as `connect` but is called
before it. The reason is in some cases BPF hooks should be called way
before control is passed to `sk->sk_prot->connect`. Specifically
`inet_dgram_connect` autobinds socket before calling
`sk->sk_prot->connect` and there is no way to call `bpf_bind()` from
hooks from e.g. `ip4_datagram_connect` or `ip6_datagram_connect` since
it'd cause double-bind. On the other hand `proto.pre_connect` provides a
flexible way to add BPF hooks for connect only for necessary `proto` and
call them at desired time before `connect`. Since `bpf_bind()` is
allowed to bind only to IP and autobind in `inet_dgram_connect` binds
only port there is no chance of double-bind.
bpf_bind() sets `force_bind_address_no_port` to bind to only IP despite
of value of `bind_address_no_port` socket field.
bpf_bind() sets `with_lock` to `false` when calling to __inet_bind()
and __inet6_bind() since all call-sites, where bpf_bind() is called,
already hold socket lock.
Change-Id: Ief71932407d9e96d6264ebf2089be8ea38a67ea4
Signed-off-by: Andrey Ignatov <rdna@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Andrey Ignatovauthored and Sorayukiicommited 2026-05-15 17:56:15 +07:00
Damir reported a breakage of SO_BINDTODEVICE for UDP sockets.
In absence of VRF devices, after commit fb74c27735f0 ("net:
ipv4: add second dif to udp socket lookups") the dif mismatch
isn't fatal anymore for UDP socket lookup with non null
sk_bound_dev_if, breaking SO_BINDTODEVICE semantics.
This changeset addresses the issue making the dif match mandatory
again in the above scenario.
Reported-by: Damir Mansurov <dnman@oktetlabs.ru>
Fixes: fb74c27735f0 ("net: ipv4: add second dif to udp socket lookups")
Fixes: 1801b570dd2a ("net: ipv6: add second dif to udp socket lookups")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Acked-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Paolo Abeniauthored and Sorayukiicommited 2026-05-15 17:55:20 +07:00
Add a second device index, sdif, to inet6 socket lookups. sdif is the
index for ingress devices enslaved to an l3mdev. It allows the lookups
to consider the enslaved device as well as the L3 domain when searching
for a socket.
TCP moves the data in the cb. Prior to tcp_v4_rcv (e.g., early demux) the
ingress index is obtained from IPCB using inet_sdif and after tcp_v4_rcv
tcp_v4_sdif is used.
Signed-off-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
David Ahernauthored and Sorayukiicommited 2026-05-15 17:55:19 +07:00
Add a second device index, sdif, to udp socket lookups. sdif is the
index for ingress devices enslaved to an l3mdev. It allows the lookups
to consider the enslaved device as well as the L3 domain when searching
for a socket.
Early demux lookups are handled in the next patch as part of INET_MATCH
changes.
Signed-off-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
David Ahernauthored and Sorayukiicommited 2026-05-15 17:55:19 +07:00
Packets arriving in a VRF currently are delivered to UDP sockets that
aren't bound to any interface. TCP defaults to not delivering packets
arriving in a VRF to unbound sockets. IP route lookup and socket
transmit both assume that unbound means using the default table and
UDP applications that haven't been changed to be aware of VRFs may not
function correctly in this case since they may not be able to handle
overlapping IP address ranges, or be able to send packets back to the
original sender if required.
So add a sysctl, udp_l3mdev_accept, to control this behaviour with it
being analgous to the existing tcp_l3mdev_accept, namely to allow a
process to have a VRF-global listen socket. Have this default to off
as this is the behaviour that users will expect, given that there is
no explicit mechanism to set unmodified VRF-unaware application into a
default VRF.
Signed-off-by: Robert Shearman <rshearma@brocade.com>
Acked-by: David Ahern <dsa@cumulusnetworks.com>
Tested-by: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Robert Shearmanauthored and Sorayukiicommited 2026-05-15 17:55:18 +07:00
The inet6_protocol structure is only passed as the first argument to
inet6_add_protocol or inet6_del_protocol, both of which are declared as
const. Thus the inet6_protocol structure itself can be const.
Also drop __read_mostly where present on the newly const structures.
Done with the help of Coccinelle.
Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
Julia Lawallauthored and Sorayukiicommited 2026-05-15 17:54:58 +07:00
Certain system process significant unconnected UDP workload.
It would be preferrable to disable UDP early demux for those systems
and enable it for TCP only.
By disabling UDP demux, we see these slight gains on an ARM64 system-
782 -> 788Mbps unconnected single stream UDPv4
633 -> 654Mbps unconnected UDPv4 different sources
The performance impact can change based on CPU architecure and cache
sizes. There will not much difference seen if entire UDP hash table
is in cache.
Both sysctls are enabled by default to preserve existing behavior.
v1->v2: Change function pointer instead of adding conditional as
suggested by Stephen.
v2->v3: Read once in callers to avoid issues due to compiler
optimizations. Also update commit message with the tests.
v3->v4: Store and use read once result instead of querying pointer
again incorrectly.
v4->v5: Refactor to avoid errors due to compilation with IPV6={m,n}
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Suggested-by: Eric Dumazet <edumazet@google.com>
Cc: Stephen Hemminger <stephen@networkplumber.org>
Cc: Tom Herbert <tom@herbertland.com>
Cc: David Miller <davem@davemloft.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
subashab@codeaurora.orgauthored and Sorayukiicommited 2026-05-15 17:54:49 +07:00
# By Eric Dumazet (9) and others
# Via Greg Kroah-Hartman
* common/android-4.9-q:
Linux 4.9.287
perf/x86: Reset destroy callback on event init failure
scsi: virtio_scsi: Fix spelling mistake "Unsupport" -> "Unsupported"
scsi: ses: Fix unsigned comparison with less than zero
mac80211: Drop frames from invalid MAC address in ad-hoc mode
netfilter: ip6_tables: zero-initialize fragment offset
HID: apple: Fix logical maximum and usage maximum of Magic Keyboard JIS
gup: document and work around "COW can break either way" issue
i40e: fix endless loop under rtnl
rtnetlink: fix if_nlmsg_stats_size() under estimation
drm/nouveau/debugfs: fix file release memory leak
netlink: annotate data races around nlk->bound
net: bridge: use nla_total_size_64bit() in br_get_linkxstats_size()
ARM: imx6: disable the GIC CPU interface before calling stby-poweroff sequence
ptp_pch: Load module automatically if ID matches
powerpc/fsl/dts: Fix phy-connection-type for fm1mac3
net_sched: fix NULL deref in fifo_set_limit()
phy: mdio: fix memory leak
bpf: Fix integer overflow in prealloc_elems_and_freelist()
xtensa: call irqchip_init only when CONFIG_USE_OF is selected
ARM: dts: omap3430-sdp: Fix NAND device node
nfsd4: Handle the NFSv4 READDIR 'dircount' hint being zero
ovl: fix missing negative dentry check in ovl_rename()
USB: cdc-acm: fix break reporting
USB: cdc-acm: fix racy tty buffer accesses
Partially revert "usb: Kconfig: using select for USB_COMMON dependency"
Linux 4.9.286
libata: Add ATA_HORKAGE_NO_NCQ_ON_ATI for Samsung 860 and 870 SSD.
usb: testusb: Fix for showing the connection speed
scsi: sd: Free scsi_disk device via put_device()
ext2: fix sleeping in atomic bugs on error
sparc64: fix pci_iounmap() when CONFIG_PCI is not set
xen-netback: correct success/error reporting for the SKB-with-fraglist case
net: mdio: introduce a shutdown method to mdio device drivers
af_unix: fix races in sk_peer_pid and sk_peer_cred accesses
Linux 4.9.285
cred: allow get_cred() and put_cred() to be given NULL.
HID: usbhid: free raw_report buffers in usbhid_stop
netfilter: ipset: Fix oversized kvmalloc() calls
HID: betop: fix slab-out-of-bounds Write in betop_probe
arm64: Extend workaround for erratum 1024718 to all versions of Cortex-A55
ARM: 9098/1: ftrace: MODULE_PLT: Fix build problem without DYNAMIC_FTRACE
ARM: 9079/1: ftrace: Add MODULE_PLTS support
ARM: 9078/1: Add warn suppress parameter to arm_gen_branch_link()
ARM: 9077/1: PLT: Move struct plt_entries definition to header
EDAC/synopsys: Fix wrong value type assignment for edac_mode
net: udp: annotate data race around udp_sk(sk)->corkflag
ext4: fix potential infinite loop in ext4_dx_readdir()
ipack: ipoctal: fix module reference leak
ipack: ipoctal: fix missing allocation-failure check
ipack: ipoctal: fix tty-registration error handling
ipack: ipoctal: fix tty registration race
ipack: ipoctal: fix stack information leak
e100: fix buffer overrun in e100_get_regs
e100: fix length calculation in e100_get_regs_len
hwmon: (tmp421) fix rounding for negative values
mac80211: limit injected vht mcs/nss in ieee80211_parse_tx_radiotap
ipvs: check that ip_vs_conn_tab_bits is between 8 and 20
mac80211: fix use-after-free in CCMP/GCMP RX
cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory
cpufreq: schedutil: Use kobject release() method to free sugov_tunables
tty: Fix out-of-bound vmalloc access in imageblit
qnx4: work around gcc false positive warning bug
arm64: dts: marvell: armada-37xx: Extend PCIe MEM space
spi: Fix tegra20 build with CONFIG_PM=n
net: 6pack: Fix tx timeout and slot time
alpha: Declare virt_to_phys and virt_to_bus parameter as pointer to volatile
arm64: Mark __stack_chk_guard as __ro_after_init
parisc: Use absolute_pointer() to define PAGE0
qnx4: avoid stringop-overread errors
sparc: avoid stringop-overread errors
net: i825xx: Use absolute_pointer for memcpy from fixed memory location
compiler.h: Introduce absolute_pointer macro
m68k: Double cast io functions to unsigned long
net: stmmac: allow CSR clock of 300MHz
blktrace: Fix uaf in blk_trace access after removing by sysfs
scsi: iscsi: Adjust iface sysfs attr detection
net/mlx4_en: Don't allow aRFS for encapsulated packets
net: hso: fix muxed tty registration
serial: mvebu-uart: fix driver's tx_empty callback
mcb: fix error handling in mcb_alloc_bus()
USB: serial: option: add device id for Foxconn T99W265
USB: serial: option: remove duplicate USB device ID
USB: serial: option: add Telit LN920 compositions
USB: serial: mos7840: remove duplicated 0xac24 device ID
staging: greybus: uart: fix tty use after free
USB: serial: cp210x: add ID for GW Instek GDM-834x Digital Multimeter
usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
xen/x86: fix PV trap handling on secondary processors
cifs: fix incorrect check for null pointer in header_assemble
usb: musb: tusb6010: uninitialized data in tusb_fifo_write_unaligned()
usb: gadget: r8a66597: fix a loop in set_feature()
ocfs2: drop acl cache for directories too
BACKPORT: loop: Set correct device size when using LOOP_CONFIGURE
Linux 4.9.284
sctp: validate from_addr_param return
drm/nouveau/nvkm: Replace -ENOSYS with -ENODEV
blk-throttle: fix UAF by deleteing timer in blk_throtl_exit()
nilfs2: fix memory leak in nilfs_sysfs_delete_snapshot_group
nilfs2: fix memory leak in nilfs_sysfs_create_snapshot_group
nilfs2: fix memory leak in nilfs_sysfs_delete_##name##_group
nilfs2: fix memory leak in nilfs_sysfs_create_##name##_group
nilfs2: fix NULL pointer in nilfs_##name##_attr_release
nilfs2: fix memory leak in nilfs_sysfs_create_device_group
ceph: lockdep annotations for try_nonblocking_invalidate
dmaengine: xilinx_dma: Set DMA mask for coherent APIs
dmaengine: ioat: depends on !UML
parisc: Move pci_dev_is_behind_card_dino to where it is used
pwm: lpc32xx: Don't modify HW state in .probe() after the PWM chip was registered
profiling: fix shift-out-of-bounds bugs
prctl: allow to setup brk for et_dyn executables
9p/trans_virtio: Remove sysfs file on probe failure
thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
sctp: add param size validation for SCTP_PARAM_SET_PRIMARY
sctp: validate chunk size in __rcv_asconf_lookup
staging: android: ion: fix page is NULL
crypto: talitos - fix max key size for sha384 and sha512
PM / wakeirq: Fix unbalanced IRQ enable for wakeirq
s390/bpf: Fix optimizing out zero-extensions
Linux 4.9.283
s390/bpf: Fix 64-bit subtraction of the -0x80000000 constant
net: renesas: sh_eth: Fix freeing wrong tx descriptor
qlcnic: Remove redundant unlock in qlcnic_pinit_from_rom
net: dsa: b53: Fix calculating number of switch ports
ARC: export clear_user_page() for modules
mtd: rawnand: cafe: Fix a resource leak in the error handling path of 'cafe_nand_probe()'
PCI: Sync __pci_register_driver() stub for CONFIG_PCI=n
ethtool: Fix an error code in cxgb2.c
net: usb: cdc_mbim: avoid altsetting toggling for Telit LN920
mfd: Don't use irq_create_mapping() to resolve a mapping
dt-bindings: mtd: gpmc: Fix the ECC bytes vs. OOB bytes equation
x86/mm: Fix kern_addr_valid() to cope with existing but not present entries
tcp: fix tp->undo_retrans accounting in tcp_sacktag_one()
net/af_unix: fix a data-race in unix_dgram_poll
events: Reuse value read using READ_ONCE instead of re-reading it
tipc: increase timeout in tipc_sk_enqueue()
r6040: Restore MDIO clock frequency after MAC reset
net/l2tp: Fix reference count leak in l2tp_udp_recv_core
dccp: don't duplicate ccid when cloning dccp sock
ptp: dp83640: don't define PAGE0
net-caif: avoid user-triggerable WARN_ON(1)
bnx2x: Fix enabling network interfaces without VFs
xen: reset legacy rtc flag for PV domU
platform/chrome: cros_ec_proto: Send command again when timeout occurs
memcg: enable accounting for pids in nested pid namespaces
mm/hugetlb: initialize hugetlb_usage in mm_init
scsi: BusLogic: Fix missing pr_cont() use
parisc: fix crash with signals and alloca
net: w5100: check return value after calling platform_get_resource()
net: fix NULL pointer reference in cipso_v4_doi_free
ath9k: fix sleeping in atomic context
ath9k: fix OOB read ar9300_eeprom_restore_internal
parport: remove non-zero check on count
usbip: give back URBs for unsent unlink requests during cleanup
Revert "USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk set"
cifs: fix wrong release in sess_alloc_buffer() failed path
mmc: rtsx_pci: Fix long reads when clock is prescaled
gfs2: Don't call dlm after protocol is unmounted
rpc: fix gss_svc_init cleanup on failure
ARM: tegra: tamonten: Fix UART pad setting
gpu: drm: amd: amdgpu: amdgpu_i2c: fix possible uninitialized-variable access in amdgpu_i2c_router_select_ddc_port()
Bluetooth: avoid circular locks in sco_sock_connect
net: ethernet: stmmac: Do not use unreachable() in ipq806x_gmac_probe()
ASoC: Intel: bytcr_rt5640: Move "Platform Clock" routes to the maps for the matching in-/output
Bluetooth: skip invalid hci_sync_conn_complete_evt
ata: sata_dwc_460ex: No need to call phy_exit() befre phy_init()
staging: ks7010: Fix the initialization of the 'sleep_status' structure
serial: 8250_pci: make setup_port() parameters explicitly unsigned
hvsi: don't panic on tty_register_driver failure
xtensa: ISS: don't panic in rs_init
serial: 8250: Define RX trigger levels for OxSemi 950 devices
s390/jump_label: print real address in a case of a jump label bug
flow_dissector: Fix out-of-bounds warnings
ipv4: ip_output.c: Fix out-of-bounds warning in ip_copy_addrs()
video: fbdev: riva: Error out if 'pixclock' equals zero
video: fbdev: kyro: Error out if 'pixclock' equals zero
video: fbdev: asiliantfb: Error out if 'pixclock' equals zero
bpf/tests: Do not PASS tests without actually testing the result
bpf/tests: Fix copy-and-paste error in double word test
tty: serial: jsm: hold port lock when reporting modem line changes
staging: board: Fix uninitialized spinlock when attaching genpd
usb: gadget: composite: Allow bMaxPower=0 if self-powered
usb: gadget: u_ether: fix a potential null pointer dereference
usb: host: fotg210: fix the actual_length of an iso packet
usb: host: fotg210: fix the endpoint's transactional opportunities calculation
Smack: Fix wrong semantics in smk_access_entry()
netlink: Deal with ESRCH error in nlmsg_notify()
video: fbdev: kyro: fix a DoS bug by restricting user input
iio: dac: ad5624r: Fix incorrect handling of an optional regulator.
PCI: Use pci_update_current_state() in pci_enable_device_flags()
crypto: mxs-dcp - Use sg_mapping_iter to copy data
MIPS: Malta: fix alignment of the devicetree buffer
pinctrl: single: Fix error return code in pcs_parse_bits_in_pinctrl_entry()
openrisc: don't printk() unconditionally
vfio: Use config not menuconfig for VFIO_NOIOMMU
PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
PCI: Restrict ASMedia ASM1062 SATA Max Payload Size Supported
ARM: 9105/1: atags_to_fdt: don't warn about stack size
libata: add ATA_HORKAGE_NO_NCQ_TRIM for Samsung 860 and 870 SSDs
media: rc-loopback: return number of emitters rather than error
media: uvc: don't do DMA on stack
VMCI: fix NULL pointer dereference when unmapping queue pair
power: supply: max17042: handle fails of reading status register
crypto: public_key: fix overflow during implicit conversion
xen: fix setting of max_pfn in shared_info
powerpc/perf/hv-gpci: Fix counter value parsing
PCI/MSI: Skip masking MSI-X on Xen PV
rtc: tps65910: Correct driver module alias
fbmem: don't allow too huge resolutions
clk: kirkwood: Fix a clocking boot regression
IMA: remove -Wmissing-prototypes warning
KVM: x86: Update vCPU's hv_clock before back to guest when tsc_offset is adjusted
tty: Fix data race between tiocsti() and flush_to_ldisc()
ipv4: make exception cache less predictible
bcma: Fix memory leak for internally-handled cores
ath6kl: wmi: fix an error code in ath6kl_wmi_sync_point()
usb: ehci-orion: Handle errors of clk_prepare_enable() in probe
i2c: mt65xx: fix IRQ check
CIFS: Fix a potencially linear read overflow
mmc: moxart: Fix issue with uninitialized dma_slave_config
mmc: dw_mmc: Fix issue with uninitialized dma_slave_config
i2c: s3c2410: fix IRQ check
i2c: iop3xx: fix deferred probing
Bluetooth: add timeout sanity check to hci_inquiry
usb: gadget: mv_u3d: request_irq() after initializing UDC
usb: phy: tahvo: add IRQ check
usb: host: ohci-tmio: add IRQ check
Bluetooth: Move shutdown callback before flushing tx and rx queue
usb: phy: twl6030: add IRQ checks
usb: phy: fsl-usb: add IRQ check
usb: gadget: udc: at91: add IRQ check
drm/msm/dsi: Fix some reference counted resource leaks
Bluetooth: fix repeated calls to sco_sock_kill
arm64: dts: exynos: correct GIC CPU interfaces address range on Exynos7
Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow
soc: qcom: smsm: Fix missed interrupts if state changes while masked
PCI: PM: Enable PME if it can be signaled from D3cold
i2c: highlander: add IRQ check
net: cipso: fix warnings in netlbl_cipsov4_add_std
tcp: seq_file: Avoid skipping sk during tcp_seek_last_pos
Bluetooth: sco: prevent information leak in sco_conn_defer_accept()
media: go7007: remove redundant initialization
media: dvb-usb: fix uninit-value in vp702x_read_mac_addr
media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init
certs: Trigger creation of RSA module signing key if it's not an RSA key
crypto: qat - use proper type for vf_mask
spi: spi-pic32: Fix issue with uninitialized dma_slave_config
m68k: emu: Fix invalid free in nfeth_cleanup()
udf_get_extendedattr() had no boundary checks.
crypto: qat - do not export adf_iov_putmsg()
crypto: qat - fix naming for init/shutdown VF to PF notifications
crypto: qat - fix reuse of completion variable
crypto: qat - handle both source of interrupt in VF ISR
crypto: qat - do not ignore errors from enable_vf2pf_comms()
libata: fix ata_host_start()
power: supply: max17042_battery: fix typo in MAx17042_TOFF
udf: Check LVID earlier
crypto: omap-sham - clear dma flags only after omap_sham_update_dma_stop()
power: supply: axp288_fuel_gauge: Report register-address on readb / writeb errors
crypto: mxs-dcp - Check for DMA mapping errors
regmap: fix the offset of register error log
PCI: Call Max Payload Size-related fixup quirks early
x86/reboot: Limit Dell Optiplex 990 quirk to early BIOS versions
Revert "btrfs: compression: don't try to compress if we don't have enough pages"
mm/page_alloc: speed up the iteration of max_order
net: ll_temac: Remove left-over debug message
powerpc/boot: Delete unneeded .globl _zimage_start
powerpc/module64: Fix comment in R_PPC64_ENTRY handling
crypto: talitos - reduce max key size for SEC1
mm/kmemleak.c: make cond_resched() rate-limiting more efficient
s390/disassembler: correct disassembly lines alignment
ipv4/icmp: l3mdev: Perform icmp error route lookup on source device routing table (v2)
gfs2: Don't clear SGID when inheriting ACLs
nvme-pci: Fix an error handling path in 'nvme_probe()'
tc358743: fix register i2c_rd/wr function fix
PM / wakeirq: Enable dedicated wakeirq for suspend
net/sched: cls_flower: Use mask for addr_type
USB: serial: mos7720: improve OOM-handling in read_mos_reg()
usb: phy: isp1301: Fix build warning when CONFIG_OF is disabled
igmp: Add ip_mc_list lock in ip_check_mc_rcu
media: stkwebcam: fix memory leak in stk_camera_probe
ath9k: Postpone key cache entry deletion for TXQ frames reference it
ath: Modify ath_key_delete() to not need full key entry
ath: Export ath_hw_keysetmac()
ath9k: Clear key cache explicitly on disabling hardware
ath: Use safer key clearing with key cache entries
ALSA: pcm: fix divide error in snd_pcm_lib_ioctl
ARM: 8918/2: only build return_address() if needed
cryptoloop: add a deprecation warning
perf/x86/amd/ibs: Work around erratum #1197
qede: Fix memset corruption
qed: Fix the VF msix vectors flow
xtensa: fix kconfig unmet dependency warning for HAVE_FUTEX_CMPXCHG
mtd: nand: atmel_nand: remove build warning in atmel_nand_remove()
ext4: fix race writing to an inline_data file while its xattrs are changing
Conflicts:
arch/arm64/mm/proc.S
drivers/staging/android/ion/ion_system_heap.c
fs/gfs2/acl.c
kernel/sched/cpufreq_schedutil.c
Change-Id: I4f527f0ca32f1649fdb0fba22be08a0dfaeabfa2
commit a9f5970767d11eadc805d5283f202612c7ba1f59 upstream.
up->corkflag field can be read or written without any lock.
Annotate accesses to avoid possible syzbot/KCSAN reports.
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Eric Dumazetauthored and Greg Kroah-Hartmancommited 2021-10-06 10:23:42 +02:00
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE4n5dijQDou9mhzu83qZv95d3LNwFAmDccEYACgkQ3qZv95d3
LNwiGw//SxIpTG9pJTyRsPqaJHXC0gPtuqKVtkH9LQZSmNUIuhoL0AVb/xaeAhZS
OZxDKdwTXqBqwtG5hIIITJL1ZXuuhFV1TAsP2Q16cVkXqpTU8v8uX1B85b8VPY8a
a1CZF/o9Lr8nAfvcuw8QN4Dmqu++KdqcNmqSAGX7p9Tn2WR82p9HF+4Y4cWrNwoB
PDXU7McIzU5eNyCC5qrX85vqDqexqg/Y641O5FiT6VUIniMdOISFXniTO8qlcMXi
pHwV2A3yE4q1qCQ9MOYM/Q/KHxV2yb+IMsmDW9XbMJ+W3jE7S8GTRX+pR+54o5Cj
jU50IsAiY7X5FltxcS4y3wA7Sn+TegHFzGGk1kVlatav2XULNyzoOsMjytM+8CGJ
WC+SSVmB+lWFYkVKUw2dlihyDa5TZUt67jK5vNyZxwR+foXzEh64oqUwLwEMOtAZ
Df4ftgcjbs2jLumjHUi0zp1Agxen9W2yoPErgMrCXFWbYkfEigXE4fip++2+WyQv
Fu72OIZNfqNJy0vbaV/VDdEKEePg9FAT4rCn0VTdao7nVsyuoWVGcwC/qIIRQTcn
XWE1x6Sm+5mEv92gSNvdtJK+xkhQ6ibQz0LjD8SPkAf4oLjMarU3aLIViczSjr2r
h/VONNFPo3y3RKBvOQ9SRBVBnRsjbEtUeft/rWS80XZ9W5bK/iI=
=yEni
-----END PGP SIGNATURE-----
Merge 4.9.274 into android-4.9-q
Changes in 4.9.274
net: ieee802154: fix null deref in parse dev addr
HID: hid-sensor-hub: Return error for hid_set_field() failure
HID: Add BUS_VIRTUAL to hid_connect logging
HID: usbhid: fix info leak in hid_submit_ctrl
ARM: OMAP2+: Fix build warning when mmc_omap is not built
HID: gt683r: add missing MODULE_DEVICE_TABLE
gfs2: Fix use-after-free in gfs2_glock_shrink_scan
scsi: target: core: Fix warning on realtime kernels
ethernet: myri10ge: Fix missing error code in myri10ge_probe()
net: ipconfig: Don't override command-line hostnames or domains
rtnetlink: Fix missing error code in rtnl_bridge_notify()
net/x25: Return the correct errno code
net: Return the correct errno code
fib: Return the correct errno code
dmaengine: QCOM_HIDMA_MGMT depends on HAS_IOMEM
dmaengine: stedma40: add missing iounmap() on error in d40_probe()
mm: hwpoison: change PageHWPoison behavior on hugetlb pages
batman-adv: Avoid WARN_ON timing related checks
net: ipv4: fix memory leak in netlbl_cipsov4_add_std
net: rds: fix memory leak in rds_recvmsg
udp: fix race between close() and udp_abort()
rtnetlink: Fix regression in bridge VLAN configuration
netfilter: synproxy: Fix out of bounds when parsing TCP options
alx: Fix an error handling path in 'alx_probe()'
net: stmmac: dwmac1000: Fix extended MAC address registers definition
qlcnic: Fix an error handling path in 'qlcnic_probe()'
netxen_nic: Fix an error handling path in 'netxen_nic_probe()'
net: cdc_ncm: switch to eth%d interface naming
net: usb: fix possible use-after-free in smsc75xx_bind
net: ipv4: fix memory leak in ip_mc_add1_src
net/af_unix: fix a data-race in unix_dgram_sendmsg / unix_release_sock
be2net: Fix an error handling path in 'be_probe()'
net: hamradio: fix memory leak in mkiss_close
net: cdc_eem: fix tx fixup skb leak
net: ethernet: fix potential use-after-free in ec_bhf_remove
scsi: core: Put .shost_dev in failure path if host state changes to RUNNING
radeon: use memcpy_to/fromio for UVD fw upload
can: bcm: fix infoleak in struct bcm_msg_head
tracing: Do no increment trace_clock_global() by one
PCI: Mark TI C667X to avoid bus reset
PCI: Mark some NVIDIA GPUs to avoid bus reset
dmaengine: pl330: fix wrong usage of spinlock flags in dma_cyclc
net: fec_ptp: add clock rate zero check
can: bcm/raw/isotp: use per module netdevice notifier
usb: dwc3: core: fix kernel panic when do reboot
tracing: Do not stop recording cmdlines when tracing is off
tracing: Do not stop recording comms if the trace file is being read
x86/fpu: Reset state for all signal restore failures
inet: use bigger hash table for IP ID generation
i40e: Be much more verbose about what we can and cannot offload
ARM: 9081/1: fix gcc-10 thumb2-kernel regression
Makefile: Move -Wno-unused-but-set-variable out of GCC only block
arm64: perf: Disable PMU while processing counter overflows
Revert "PCI: PM: Do not read power state in pci_enable_device_flags()"
mac80211: remove warning in ieee80211_get_sband()
cfg80211: call cfg80211_leave_ocb when switching away from OCB
mac80211: drop multicast fragments
ping: Check return value of function 'ping_queue_rcv_skb'
inet: annotate date races around sk->sk_txhash
net: caif: fix memory leak in ldisc_open
net/packet: annotate accesses to po->bind
net/packet: annotate accesses to po->ifindex
r8152: Avoid memcpy() over-reading of ETH_SS_STATS
sh_eth: Avoid memcpy() over-reading of ETH_SS_STATS
r8169: Avoid memcpy() over-reading of ETH_SS_STATS
net: qed: Fix memcpy() overflow of qed_dcbx_params()
net: ll_temac: Avoid ndo_start_xmit returning NETDEV_TX_BUSY
nilfs2: fix memory leak in nilfs_sysfs_delete_device_group
i2c: robotfuzz-osif: fix control-request directions
Linux 4.9.274
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I31d1bfc426326657ecc9db939474f25961471552
[ Upstream commit a8b897c7bcd47f4147d066e22cc01d1026d7640e ]
Kaustubh reported and diagnosed a panic in udp_lib_lookup().
The root cause is udp_abort() racing with close(). Both
racing functions acquire the socket lock, but udp{v6}_destroy_sock()
release it before performing destructive actions.
We can't easily extend the socket lock scope to avoid the race,
instead use the SOCK_DEAD flag to prevent udp_abort from doing
any action when the critical race happens.
Diagnosed-and-tested-by: Kaustubh Pandey <kapandey@codeaurora.org>
Fixes: 5d77dca828 ("net: diag: support SOCK_DESTROY for UDP sockets")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Paolo Abeniauthored and Sasha Levincommited 2021-06-30 08:49:13 -04:00
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl8kLjwACgkQONu9yGCS
aT7RXg/+I1gwJspo3+4rep0OkqCTJPpmpMuULYjQAmU+riRgmX3cr4bSUjsTSHqU
gONQWvTUs6BF8mHciCx2F6w+X1KF+d2CYnigqHj6a2uK4d2r2pQuV9kl9+mpvEFD
Ah12Z5OndNX72oSx3t7XULlxZSrpfNTA274jdlHZcavSxXnf9qREKpTHBKzPmwAz
Jeln+56WT90Aa9+VVnFbFfVZpmA9D/itW8u53McsXVAmmHUu8AEsiCJNeZCWF9cI
fqtlIsgLkEixNluIqxx8p1mJEQmX1SziphHflBhhnUBKOKCoyk86TKrDYQI5/4DM
SIkU3m5JUQiU/j1ua+o/wt/oLDRlCfRzF5UzQ2IYTDkYAfhW4ye4eBl5gmvEw/wC
2usYk61CROd8mgyhXi7mZ85gG1cDlsuAe/9RKiMaGzaMBZ8NPX0uKCqf3jQsI0xE
FjfI9b2FMsKuiEENMuMjkV+jAQ3MI1bz/Lx2Xbt4HRB/1gmNNWHOuRrEOrfNAPNN
FfTqqYCqhZYmgAfna6uvExqNOdLnhOi+R5O/7X/+puRz9AXCZYPFN7J1+3xAh/CB
OUcG5k927SmAWysnVupTgtDS5TwGAy21Yi93gbgdox/aZ20ivqClhT2WwMkXbNHB
kcOcTiQTkOofcgEOGhMRhgHjGryu/cg6hwBE5qNx7yRhfMPcAyc=
=cXt2
-----END PGP SIGNATURE-----
Merge 4.9.232 into android-4.9-q
Changes in 4.9.232
pinctrl: amd: fix npins for uart0 in kerncz_groups
mac80211: allow rx of mesh eapol frames with default rx key
scsi: scsi_transport_spi: Fix function pointer check
xtensa: fix __sync_fetch_and_{and,or}_4 declarations
xtensa: update *pos in cpuinfo_op.next
drivers/net/wan/lapbether: Fixed the value of hard_header_len
net: sky2: initialize return of gm_phy_read
drm/nouveau/i2c/g94-: increase NV_PMGR_DP_AUXCTL_TRANSACTREQ timeout
SUNRPC reverting d03727b248d0 ("NFSv4 fix CLOSE not waiting for direct IO compeletion")
uprobes: Change handle_swbp() to send SIGTRAP with si_code=SI_KERNEL, to fix GDB regression
ALSA: info: Drop WARN_ON() from buffer NULL sanity check
ASoC: rt5670: Correct RT5670_LDO_SEL_MASK
btrfs: fix double free on ulist after backref resolution failure
btrfs: fix mount failure caused by race with umount
bnxt_en: Fix race when modifying pause settings.
hippi: Fix a size used in a 'pci_free_consistent()' in an error handling path
ax88172a: fix ax88172a_unbind() failures
net: dp83640: fix SIOCSHWTSTAMP to update the struct with actual configuration
net: smc91x: Fix possible memory leak in smc_drv_probe()
scripts/decode_stacktrace: strip basepath from all paths
HID: i2c-hid: add Mediacom FlexBook edge13 to descriptor override
HID: apple: Disable Fn-key key-re-mapping on clone keyboards
dmaengine: tegra210-adma: Fix runtime PM imbalance on error
regmap: dev_get_regmap_match(): fix string comparison
dmaengine: ioat setting ioat timeout as module parameter
usb: gadget: udc: gr_udc: fix memleak on error handling path in gr_ep_init()
arm64: Use test_tsk_thread_flag() for checking TIF_SINGLESTEP
x86: math-emu: Fix up 'cmp' insn for clang ias
usb: xhci-mtk: fix the failure of bandwidth allocation
usb: xhci: Fix ASM2142/ASM3142 DMA addressing
Revert "cifs: Fix the target file was deleted when rename failed."
staging: wlan-ng: properly check endpoint types
staging: comedi: addi_apci_1032: check INSN_CONFIG_DIGITAL_TRIG shift
staging: comedi: ni_6527: fix INSN_CONFIG_DIGITAL_TRIG support
staging: comedi: addi_apci_1500: check INSN_CONFIG_DIGITAL_TRIG shift
staging: comedi: addi_apci_1564: check INSN_CONFIG_DIGITAL_TRIG shift
serial: 8250: fix null-ptr-deref in serial8250_start_tx()
serial: 8250_mtk: Fix high-speed baud rates clamping
vt: Reject zero-sized screen buffer size.
Makefile: Fix GCC_TOOLCHAIN_DIR prefix for Clang cross compilation
mm/memcg: fix refcount error while moving and swapping
io-mapping: indicate mapping failure
parisc: Add atomic64_set_release() define to avoid CPU soft lockups
ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb
ath9k: Fix regression with Atheros 9271
AX.25: Fix out-of-bounds read in ax25_connect()
AX.25: Prevent out-of-bounds read in ax25_sendmsg()
dev: Defer free of skbs in flush_backlog
net-sysfs: add a newline when printing 'tx_timeout' by sysfs
net: udp: Fix wrong clean up for IS_UDPLITE macro
rxrpc: Fix sendmsg() returning EPIPE due to recvmsg() returning ENODATA
AX.25: Prevent integer overflows in connect and sendmsg
tcp: allow at most one TLP probe per flight
ip6_gre: fix null-ptr-deref in ip6gre_init_net()
drivers/net/wan/x25_asy: Fix to make it work
regmap: debugfs: check count when read regmap file
xfs: set format back to extents if xfs_bmap_extents_to_btree
perf probe: Fix to check blacklist address correctly
perf annotate: Use asprintf when formatting objdump command line
perf tools: Fix snprint warnings for gcc 8
perf: Make perf able to build with latest libbfd
Linux 4.9.232
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Iae57e72dbaebe67399c6756146f30762e5f25b2e
[ Upstream commit b0a422772fec29811e293c7c0e6f991c0fd9241d ]
We can't use IS_UDPLITE to replace udp_sk->pcflag when UDPLITE_RECV_CC is
checked.
Fixes: b2bf1e2659 ("[UDP]: Clean up for IS_UDPLITE macro")
Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Miaohe Linauthored and Greg Kroah-Hartmancommited 2020-07-31 16:44:06 +02:00
* refs/heads/tmp-70d52cb:
Linux 4.9.185
arm64: kaslr: keep modules inside module region when KASAN is enabled
dmaengine: imx-sdma: remove BD_INTR for channel0
MIPS: Add missing EHB in mtc0 -> mfc0 sequence.
IB/hfi1: Close PSM sdma_progress sleep window
KVM: LAPIC: Fix pending interrupt in IRR blocked by software disable LAPIC
arm64, vdso: Define vdso_{start,end} as array
tty: rocket: fix incorrect forward declaration of 'rp_init()'
btrfs: Ensure replaced device doesn't have pending chunk allocation
drm/imx: only send event on crtc disable if kept disabled
drm/imx: notify drm core before sending event during crtc disable
lib/mpi: Fix karactx leak in mpi_powm
ALSA: usb-audio: fix sign unintended sign extension on left shifts
ALSA: line6: Fix write on zero-sized buffer
ALSA: firewire-lib/fireworks: fix miss detection of received MIDI messages
ALSA: seq: fix incorrect order of dest_client/dest_ports arguments
crypto: user - prevent operating on larval algorithms
ptrace: Fix ->ptracer_cred handling for PTRACE_TRACEME
MIPS: Workaround GCC __builtin_unreachable reordering bug
drm/i915/dmc: protect against reading random memory
KVM: x86: degrade WARN to pr_warn_ratelimited
clk: sunxi: fix uninitialized access
ARC: handle gcc generated __builtin_trap for older compiler
bug.h: work around GCC PR82365 in BUG()
ARC: fix allnoconfig build warning
mfd: omap-usb-tll: Fix register offsets
MIPS: netlogic: xlr: Remove erroneous check in nlm_fmn_send()
MIPS: math-emu: do not use bools for arithmetic
mm/mlock.c: change count_mm_mlocked_page_nr return type
scripts/decode_stacktrace.sh: prefix addr2line with $CROSS_COMPILE
scsi: hpsa: correct ioaccel2 chaining
usb: gadget: udc: lpc32xx: allocate descriptor with GFP_ATOMIC
usb: gadget: fusb300_udc: Fix memory leak of fusb300->ep[i]
ASoC: max98090: remove 24-bit format support if RJ is 0
drm/mediatek: fix unbind functions
spi: bitbang: Fix NULL pointer dereference in spi_unregister_master
ASoC: soc-pcm: BE dai needs prepare when pause release after resume
ASoC : cs4265 : readable register too low
Bluetooth: Fix faulty expression for minimum encryption key size check
tipc: pass tunnel dev as NULL to udp_tunnel(6)_xmit_skb
bpf: udp: ipv6: Avoid running reuseport's bpf_prog from __udp6_lib_err
bpf: udp: Avoid calling reuseport's bpf_prog from udp_gro
net: check before dereferencing netdev_ops during busy poll
ipv4: Use return value of inet_iif() for __raw_v4_lookup in the while loop
bonding: Always enable vlan tx offload
team: Always enable vlan tx offload
tun: wake up waitqueues after IFF_UP is set
tipc: check msg->req data len in tipc_nl_compat_bearer_disable
tipc: change to use register_pernet_device
sctp: change to hold sk after auth shkey is created successfully
net: stmmac: fixed new system time seconds value calculation
af_packet: Block execution of tasks waiting for transmit to complete in AF_PACKET
cpu/speculation: Warn on unsupported mitigations= parameter
NFS/flexfiles: Use the correct TCP timeout for flexfiles I/O
x86/speculation: Allow guests to use SSBD even if host does not
scsi: vmw_pscsi: Fix use-after-free in pvscsi_queue_lck()
mm/page_idle.c: fix oops because end_pfn is larger than max_pfn
fs/binfmt_flat.c: make load_flat_shared_library() work
fs/proc/array.c: allow reporting eip/esp for all coredumping threads
net/9p: include trans_common.h to fix missing prototype warning.
9p: p9dirent_read: check network-provided name length
9p/rdma: remove useless check in cm_event_handler
9p: acl: fix uninitialized iattr access
9p/rdma: do not disconnect on down_interruptible EAGAIN
perf header: Fix unchecked usage of strncpy()
perf help: Remove needless use of strncpy()
perf ui helpline: Use strlcpy() as a shorter form of strncpy() + explicit set nul
IB/hfi1: Avoid hardlockup with flushlist_lock
mac80211: Do not use stack memory with scatterlist for GMAC
mac80211: drop robust management frames from unknown TA
cfg80211: fix memory leak of wiphy device name
Bluetooth: Fix regression with minimum encryption key size alignment
Bluetooth: Align minimum encryption key size for LE and BR/EDR connections
ARM: imx: cpuidle-imx6sx: Restrict the SW2ISO increase to i.MX6SX
powerpc/bpf: use unsigned division instruction for 64-bit operations
can: purge socket error queue on sock destruct
can: flexcan: fix timeout when set small bitrate
btrfs: start readahead also in seed devices
nvme: Fix u32 overflow in the number of namespace list calculation
hwmon: (pmbus/core) Treat parameters as paged if on multiple pages
s390/qeth: fix VLAN attribute in bridge_hostnotify udev event
scsi: ufs: Check that space was properly alloced in copy_query_response
scripts/checkstack.pl: Fix arm64 wrong or unknown architecture
drm/arm/hdlcd: Allow a bit of clock tolerance
net: ethernet: mediatek: Use NET_IP_ALIGN to judge if HW RX_2BYTE_OFFSET is enabled
net: ethernet: mediatek: Use hw_feature to judge if HWLRO is supported
sparc: perf: fix updated event period in response to PERF_EVENT_IOC_PERIOD
net: hns: Fix loopback test failed at copper ports
net: dsa: mv88e6xxx: avoid error message on remove from VLAN 0
MIPS: uprobes: remove set but not used variable 'epc'
IB/{qib, hfi1, rdmavt}: Correct ibv_devinfo max_mr value
IB/hfi1: Insure freeze_work work_struct is canceled on shutdown
IB/rdmavt: Fix alloc_qpn() WARN_ON()
parisc: Fix compiler warnings in float emulation code
parport: Fix mem leak in parport_register_dev_model
ARC: fix build warnings with !CONFIG_KPROBES
apparmor: enforce nullbyte at end of tag string
Input: uinput - add compat ioctl number translation for UI_*_FF_UPLOAD
IB/hfi1: Silence txreq allocation warnings
usb: chipidea: udc: workaround for endpoint conflict issue
scsi: ufs: Avoid runtime suspend possibly being blocked forever
gcc-9: silence 'address-of-packed-member' warning
tracing: Silence GCC 9 array bounds warning
BACKPORT: kheaders: Do not regenerate archive if config is not changed
BACKPORT: kheaders: Move from proc to sysfs
BACKPORT: Provide in-kernel headers to make extending kernel easier
Change-Id: I2fc2e9b2019708f0febb754efbf2a63e47ad5b81
Signed-off-by: jianzhou <jianzhou@codeaurora.org>
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl0lmgMACgkQONu9yGCS
aT6xqhAAtn87S6SThYc2y6eQP/svHHCy7PGabWQm4RjnWnO2JAZkfJ3iIj+mgnqF
umL7zINXVtkZ3G4BiQzOdMcuKE9cBDpHIJTicOEa/lHKLuDw5FscDeW8SGsR7T4/
1OR1/55JA0R90Lew+Bzs8A9O1b525/35RQtxyOzFxZvl4xAgxUMrTJtSctMCJhSU
MhzpxuIkvRCfWnlqbxLGKimv8UEcs9JwZlZKmAt+oTkbBeit2JWNJy5+w7Ln4g2N
SVASZDg1/oad+jGzIHrT5fJs6ZC8EtH111xIUaS8Got/E5GCxG4qOMKOWFxf6Mag
jy+YvzsAw06yIY7IxZbKpS1LJNTkNekH+8hKpTgf4wuWaUkakIJchnw+att4QpVz
P8g/BG85DvrTzCIiKmYBEvsw9l9+Utb7iTpKeGvlw1+KmJnF1fu8ZEQQ9tOOr5VB
w5HaqeMDRBz3twg/tf/SpEzI6PJgSQxLS4fwEYLkGEWrEBY9VqZ+sRtjIbWay2rG
JeFFwiIDcF3pXrE7MtpTvYTYUGcxvtbAj49KViSs0BtWkhszcMgTEwLFSYL0LoYF
La1NhfL7GnkZtyTEworvr7NXU7x/yMfvvSSdoVTpimkGUuGyD3VMILe11b6QDGzu
CBfr09uJAtEGtAn59ZSXJvmqwAYwKrmcfvTqQ3S3lZsxXWV2CLw=
=WDg7
-----END PGP SIGNATURE-----
Merge 4.9.185 into android-4.9-q
Changes in 4.9.185
tracing: Silence GCC 9 array bounds warning
gcc-9: silence 'address-of-packed-member' warning
scsi: ufs: Avoid runtime suspend possibly being blocked forever
usb: chipidea: udc: workaround for endpoint conflict issue
IB/hfi1: Silence txreq allocation warnings
Input: uinput - add compat ioctl number translation for UI_*_FF_UPLOAD
apparmor: enforce nullbyte at end of tag string
ARC: fix build warnings with !CONFIG_KPROBES
parport: Fix mem leak in parport_register_dev_model
parisc: Fix compiler warnings in float emulation code
IB/rdmavt: Fix alloc_qpn() WARN_ON()
IB/hfi1: Insure freeze_work work_struct is canceled on shutdown
IB/{qib, hfi1, rdmavt}: Correct ibv_devinfo max_mr value
MIPS: uprobes: remove set but not used variable 'epc'
net: dsa: mv88e6xxx: avoid error message on remove from VLAN 0
net: hns: Fix loopback test failed at copper ports
sparc: perf: fix updated event period in response to PERF_EVENT_IOC_PERIOD
net: ethernet: mediatek: Use hw_feature to judge if HWLRO is supported
net: ethernet: mediatek: Use NET_IP_ALIGN to judge if HW RX_2BYTE_OFFSET is enabled
drm/arm/hdlcd: Allow a bit of clock tolerance
scripts/checkstack.pl: Fix arm64 wrong or unknown architecture
scsi: ufs: Check that space was properly alloced in copy_query_response
s390/qeth: fix VLAN attribute in bridge_hostnotify udev event
hwmon: (pmbus/core) Treat parameters as paged if on multiple pages
nvme: Fix u32 overflow in the number of namespace list calculation
btrfs: start readahead also in seed devices
can: flexcan: fix timeout when set small bitrate
can: purge socket error queue on sock destruct
powerpc/bpf: use unsigned division instruction for 64-bit operations
ARM: imx: cpuidle-imx6sx: Restrict the SW2ISO increase to i.MX6SX
Bluetooth: Align minimum encryption key size for LE and BR/EDR connections
Bluetooth: Fix regression with minimum encryption key size alignment
cfg80211: fix memory leak of wiphy device name
mac80211: drop robust management frames from unknown TA
mac80211: Do not use stack memory with scatterlist for GMAC
IB/hfi1: Avoid hardlockup with flushlist_lock
perf ui helpline: Use strlcpy() as a shorter form of strncpy() + explicit set nul
perf help: Remove needless use of strncpy()
perf header: Fix unchecked usage of strncpy()
9p/rdma: do not disconnect on down_interruptible EAGAIN
9p: acl: fix uninitialized iattr access
9p/rdma: remove useless check in cm_event_handler
9p: p9dirent_read: check network-provided name length
net/9p: include trans_common.h to fix missing prototype warning.
fs/proc/array.c: allow reporting eip/esp for all coredumping threads
fs/binfmt_flat.c: make load_flat_shared_library() work
mm/page_idle.c: fix oops because end_pfn is larger than max_pfn
scsi: vmw_pscsi: Fix use-after-free in pvscsi_queue_lck()
x86/speculation: Allow guests to use SSBD even if host does not
NFS/flexfiles: Use the correct TCP timeout for flexfiles I/O
cpu/speculation: Warn on unsupported mitigations= parameter
af_packet: Block execution of tasks waiting for transmit to complete in AF_PACKET
net: stmmac: fixed new system time seconds value calculation
sctp: change to hold sk after auth shkey is created successfully
tipc: change to use register_pernet_device
tipc: check msg->req data len in tipc_nl_compat_bearer_disable
tun: wake up waitqueues after IFF_UP is set
team: Always enable vlan tx offload
bonding: Always enable vlan tx offload
ipv4: Use return value of inet_iif() for __raw_v4_lookup in the while loop
net: check before dereferencing netdev_ops during busy poll
bpf: udp: Avoid calling reuseport's bpf_prog from udp_gro
bpf: udp: ipv6: Avoid running reuseport's bpf_prog from __udp6_lib_err
tipc: pass tunnel dev as NULL to udp_tunnel(6)_xmit_skb
Bluetooth: Fix faulty expression for minimum encryption key size check
ASoC : cs4265 : readable register too low
ASoC: soc-pcm: BE dai needs prepare when pause release after resume
spi: bitbang: Fix NULL pointer dereference in spi_unregister_master
drm/mediatek: fix unbind functions
ASoC: max98090: remove 24-bit format support if RJ is 0
usb: gadget: fusb300_udc: Fix memory leak of fusb300->ep[i]
usb: gadget: udc: lpc32xx: allocate descriptor with GFP_ATOMIC
scsi: hpsa: correct ioaccel2 chaining
scripts/decode_stacktrace.sh: prefix addr2line with $CROSS_COMPILE
mm/mlock.c: change count_mm_mlocked_page_nr return type
MIPS: math-emu: do not use bools for arithmetic
MIPS: netlogic: xlr: Remove erroneous check in nlm_fmn_send()
mfd: omap-usb-tll: Fix register offsets
ARC: fix allnoconfig build warning
bug.h: work around GCC PR82365 in BUG()
ARC: handle gcc generated __builtin_trap for older compiler
clk: sunxi: fix uninitialized access
KVM: x86: degrade WARN to pr_warn_ratelimited
drm/i915/dmc: protect against reading random memory
MIPS: Workaround GCC __builtin_unreachable reordering bug
ptrace: Fix ->ptracer_cred handling for PTRACE_TRACEME
crypto: user - prevent operating on larval algorithms
ALSA: seq: fix incorrect order of dest_client/dest_ports arguments
ALSA: firewire-lib/fireworks: fix miss detection of received MIDI messages
ALSA: line6: Fix write on zero-sized buffer
ALSA: usb-audio: fix sign unintended sign extension on left shifts
lib/mpi: Fix karactx leak in mpi_powm
drm/imx: notify drm core before sending event during crtc disable
drm/imx: only send event on crtc disable if kept disabled
btrfs: Ensure replaced device doesn't have pending chunk allocation
tty: rocket: fix incorrect forward declaration of 'rp_init()'
arm64, vdso: Define vdso_{start,end} as array
KVM: LAPIC: Fix pending interrupt in IRR blocked by software disable LAPIC
IB/hfi1: Close PSM sdma_progress sleep window
MIPS: Add missing EHB in mtc0 -> mfc0 sequence.
dmaengine: imx-sdma: remove BD_INTR for channel0
arm64: kaslr: keep modules inside module region when KASAN is enabled
Linux 4.9.185
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl0lmgMACgkQONu9yGCS
aT6xqhAAtn87S6SThYc2y6eQP/svHHCy7PGabWQm4RjnWnO2JAZkfJ3iIj+mgnqF
umL7zINXVtkZ3G4BiQzOdMcuKE9cBDpHIJTicOEa/lHKLuDw5FscDeW8SGsR7T4/
1OR1/55JA0R90Lew+Bzs8A9O1b525/35RQtxyOzFxZvl4xAgxUMrTJtSctMCJhSU
MhzpxuIkvRCfWnlqbxLGKimv8UEcs9JwZlZKmAt+oTkbBeit2JWNJy5+w7Ln4g2N
SVASZDg1/oad+jGzIHrT5fJs6ZC8EtH111xIUaS8Got/E5GCxG4qOMKOWFxf6Mag
jy+YvzsAw06yIY7IxZbKpS1LJNTkNekH+8hKpTgf4wuWaUkakIJchnw+att4QpVz
P8g/BG85DvrTzCIiKmYBEvsw9l9+Utb7iTpKeGvlw1+KmJnF1fu8ZEQQ9tOOr5VB
w5HaqeMDRBz3twg/tf/SpEzI6PJgSQxLS4fwEYLkGEWrEBY9VqZ+sRtjIbWay2rG
JeFFwiIDcF3pXrE7MtpTvYTYUGcxvtbAj49KViSs0BtWkhszcMgTEwLFSYL0LoYF
La1NhfL7GnkZtyTEworvr7NXU7x/yMfvvSSdoVTpimkGUuGyD3VMILe11b6QDGzu
CBfr09uJAtEGtAn59ZSXJvmqwAYwKrmcfvTqQ3S3lZsxXWV2CLw=
=WDg7
-----END PGP SIGNATURE-----
Merge 4.9.185 into android-4.9
Changes in 4.9.185
tracing: Silence GCC 9 array bounds warning
gcc-9: silence 'address-of-packed-member' warning
scsi: ufs: Avoid runtime suspend possibly being blocked forever
usb: chipidea: udc: workaround for endpoint conflict issue
IB/hfi1: Silence txreq allocation warnings
Input: uinput - add compat ioctl number translation for UI_*_FF_UPLOAD
apparmor: enforce nullbyte at end of tag string
ARC: fix build warnings with !CONFIG_KPROBES
parport: Fix mem leak in parport_register_dev_model
parisc: Fix compiler warnings in float emulation code
IB/rdmavt: Fix alloc_qpn() WARN_ON()
IB/hfi1: Insure freeze_work work_struct is canceled on shutdown
IB/{qib, hfi1, rdmavt}: Correct ibv_devinfo max_mr value
MIPS: uprobes: remove set but not used variable 'epc'
net: dsa: mv88e6xxx: avoid error message on remove from VLAN 0
net: hns: Fix loopback test failed at copper ports
sparc: perf: fix updated event period in response to PERF_EVENT_IOC_PERIOD
net: ethernet: mediatek: Use hw_feature to judge if HWLRO is supported
net: ethernet: mediatek: Use NET_IP_ALIGN to judge if HW RX_2BYTE_OFFSET is enabled
drm/arm/hdlcd: Allow a bit of clock tolerance
scripts/checkstack.pl: Fix arm64 wrong or unknown architecture
scsi: ufs: Check that space was properly alloced in copy_query_response
s390/qeth: fix VLAN attribute in bridge_hostnotify udev event
hwmon: (pmbus/core) Treat parameters as paged if on multiple pages
nvme: Fix u32 overflow in the number of namespace list calculation
btrfs: start readahead also in seed devices
can: flexcan: fix timeout when set small bitrate
can: purge socket error queue on sock destruct
powerpc/bpf: use unsigned division instruction for 64-bit operations
ARM: imx: cpuidle-imx6sx: Restrict the SW2ISO increase to i.MX6SX
Bluetooth: Align minimum encryption key size for LE and BR/EDR connections
Bluetooth: Fix regression with minimum encryption key size alignment
cfg80211: fix memory leak of wiphy device name
mac80211: drop robust management frames from unknown TA
mac80211: Do not use stack memory with scatterlist for GMAC
IB/hfi1: Avoid hardlockup with flushlist_lock
perf ui helpline: Use strlcpy() as a shorter form of strncpy() + explicit set nul
perf help: Remove needless use of strncpy()
perf header: Fix unchecked usage of strncpy()
9p/rdma: do not disconnect on down_interruptible EAGAIN
9p: acl: fix uninitialized iattr access
9p/rdma: remove useless check in cm_event_handler
9p: p9dirent_read: check network-provided name length
net/9p: include trans_common.h to fix missing prototype warning.
fs/proc/array.c: allow reporting eip/esp for all coredumping threads
fs/binfmt_flat.c: make load_flat_shared_library() work
mm/page_idle.c: fix oops because end_pfn is larger than max_pfn
scsi: vmw_pscsi: Fix use-after-free in pvscsi_queue_lck()
x86/speculation: Allow guests to use SSBD even if host does not
NFS/flexfiles: Use the correct TCP timeout for flexfiles I/O
cpu/speculation: Warn on unsupported mitigations= parameter
af_packet: Block execution of tasks waiting for transmit to complete in AF_PACKET
net: stmmac: fixed new system time seconds value calculation
sctp: change to hold sk after auth shkey is created successfully
tipc: change to use register_pernet_device
tipc: check msg->req data len in tipc_nl_compat_bearer_disable
tun: wake up waitqueues after IFF_UP is set
team: Always enable vlan tx offload
bonding: Always enable vlan tx offload
ipv4: Use return value of inet_iif() for __raw_v4_lookup in the while loop
net: check before dereferencing netdev_ops during busy poll
bpf: udp: Avoid calling reuseport's bpf_prog from udp_gro
bpf: udp: ipv6: Avoid running reuseport's bpf_prog from __udp6_lib_err
tipc: pass tunnel dev as NULL to udp_tunnel(6)_xmit_skb
Bluetooth: Fix faulty expression for minimum encryption key size check
ASoC : cs4265 : readable register too low
ASoC: soc-pcm: BE dai needs prepare when pause release after resume
spi: bitbang: Fix NULL pointer dereference in spi_unregister_master
drm/mediatek: fix unbind functions
ASoC: max98090: remove 24-bit format support if RJ is 0
usb: gadget: fusb300_udc: Fix memory leak of fusb300->ep[i]
usb: gadget: udc: lpc32xx: allocate descriptor with GFP_ATOMIC
scsi: hpsa: correct ioaccel2 chaining
scripts/decode_stacktrace.sh: prefix addr2line with $CROSS_COMPILE
mm/mlock.c: change count_mm_mlocked_page_nr return type
MIPS: math-emu: do not use bools for arithmetic
MIPS: netlogic: xlr: Remove erroneous check in nlm_fmn_send()
mfd: omap-usb-tll: Fix register offsets
ARC: fix allnoconfig build warning
bug.h: work around GCC PR82365 in BUG()
ARC: handle gcc generated __builtin_trap for older compiler
clk: sunxi: fix uninitialized access
KVM: x86: degrade WARN to pr_warn_ratelimited
drm/i915/dmc: protect against reading random memory
MIPS: Workaround GCC __builtin_unreachable reordering bug
ptrace: Fix ->ptracer_cred handling for PTRACE_TRACEME
crypto: user - prevent operating on larval algorithms
ALSA: seq: fix incorrect order of dest_client/dest_ports arguments
ALSA: firewire-lib/fireworks: fix miss detection of received MIDI messages
ALSA: line6: Fix write on zero-sized buffer
ALSA: usb-audio: fix sign unintended sign extension on left shifts
lib/mpi: Fix karactx leak in mpi_powm
drm/imx: notify drm core before sending event during crtc disable
drm/imx: only send event on crtc disable if kept disabled
btrfs: Ensure replaced device doesn't have pending chunk allocation
tty: rocket: fix incorrect forward declaration of 'rp_init()'
arm64, vdso: Define vdso_{start,end} as array
KVM: LAPIC: Fix pending interrupt in IRR blocked by software disable LAPIC
IB/hfi1: Close PSM sdma_progress sleep window
MIPS: Add missing EHB in mtc0 -> mfc0 sequence.
dmaengine: imx-sdma: remove BD_INTR for channel0
arm64: kaslr: keep modules inside module region when KASAN is enabled
Linux 4.9.185
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
commit 4ac30c4b3659efac031818c418beb51e630d512d upstream.
__udp6_lib_err() may be called when handling icmpv6 message. For example,
the icmpv6 toobig(type=2). __udp6_lib_lookup() is then called
which may call reuseport_select_sock(). reuseport_select_sock() will
call into a bpf_prog (if there is one).
reuseport_select_sock() is expecting the skb->data pointing to the
transport header (udphdr in this case). For example, run_bpf_filter()
is pulling the transport header.
However, in the __udp6_lib_err() path, the skb->data is pointing to the
ipv6hdr instead of the udphdr.
One option is to pull and push the ipv6hdr in __udp6_lib_err().
Instead of doing this, this patch follows how the original
commit 538950a1b7 ("soreuseport: setsockopt SO_ATTACH_REUSEPORT_[CE]BPF")
was done in IPv4, which has passed a NULL skb pointer to
reuseport_select_sock().
Fixes: 538950a1b7 ("soreuseport: setsockopt SO_ATTACH_REUSEPORT_[CE]BPF")
Cc: Craig Gallek <kraig@google.com>
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Acked-by: Song Liu <songliubraving@fb.com>
Acked-by: Craig Gallek <kraig@google.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Martin KaFai Lauauthored and Greg Kroah-Hartmancommited 2019-07-10 09:55:42 +02:00
commit 257a525fe2e49584842c504a92c27097407f778f upstream.
When the commit a6024562ff ("udp: Add GRO functions to UDP socket")
added udp[46]_lib_lookup_skb to the udp_gro code path, it broke
the reuseport_select_sock() assumption that skb->data is pointing
to the transport header.
This patch follows an earlier __udp6_lib_err() fix by
passing a NULL skb to avoid calling the reuseport's bpf_prog.
Fixes: a6024562ff ("udp: Add GRO functions to UDP socket")
Cc: Tom Herbert <tom@herbertland.com>
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Acked-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Martin KaFai Lauauthored and Greg Kroah-Hartmancommited 2019-07-10 09:55:42 +02:00
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlnfOyYACgkQONu9yGCS
aT4WIhAAp2/bzmMGPUIQNwxCoeHWQUA8SIPPtjFSO3XKfFeKB8CFcxo4LUTlfEah
OJmTcg2ajSwWmHcE9LUq42cW6AqA77I3NFkUrB2QMPzL6AirTVF1qrCbqHfvslb4
0ur/jIW8ElAoaT6hzV7BCszlAfpMS+WLjafdAYRdZjRX9GfJp77pxg79aYyPz2P7
RC4MNdQ7nhK7eeEqmUHV5CDs+aywU/H40ylZwmkk3detijVxZqEYPItrXUxFs7Ms
fMJv1u/lfwmHC9ljUdZzHsKBGkNMN+lZeeNW7dOCsDRjuo/XZpuqLE8TDX7n5qcu
E9+p28xXWq7o0fTsX+wEkkm70CPWCHg/7dMPeHBGtwBJWBWk01gvQhk2f2N20U+o
eqSTQeuo+UT3J8/T5jDR0DmyYO1YZ4euGA6uczpEDMFK5y+qeeL/zLC/5OmETa7W
0GgtyQDkEAFLoHZhgAFYtKIgs30XuY3vkc9DNu6U+G4GbbpLhqmWb6C+t71osE96
2y5t+gJxi8nA91y33gWeIWF1pVit2jqFYA9/P5Ful48CAYykQ2sp1H8R2IwNewKP
s+beYNQfVS6grz1tkKA282Fqxnd+OUNnrf1k1f7vsUIYq2wbjbqduEbEQ6nhpg0Z
xa57uZO72RUH0Psd2iT4ylGKLklQUMuRRB6V50by8HgFemsjf74=
=rBh3
-----END PGP SIGNATURE-----
Merge 4.9.55 into android-4.9
Changes in 4.9.55
USB: gadgetfs: Fix crash caused by inadequate synchronization
USB: gadgetfs: fix copy_to_user while holding spinlock
usb: gadget: udc: atmel: set vbus irqflags explicitly
usb: gadget: udc: renesas_usb3: fix for no-data control transfer
usb: gadget: udc: renesas_usb3: fix Pn_RAMMAP.Pn_MPKT value
usb: gadget: udc: renesas_usb3: Fix return value of usb3_write_pipe()
usb-storage: unusual_devs entry to fix write-access regression for Seagate external drives
usb-storage: fix bogus hardware error messages for ATA pass-thru devices
usb: renesas_usbhs: fix the BCLR setting condition for non-DCP pipe
usb: renesas_usbhs: fix usbhsf_fifo_clear() for RX direction
ALSA: usb-audio: Check out-of-bounds access by corrupted buffer descriptor
usb: pci-quirks.c: Corrected timeout values used in handshake
USB: cdc-wdm: ignore -EPIPE from GetEncapsulatedResponse
USB: dummy-hcd: fix connection failures (wrong speed)
USB: dummy-hcd: fix infinite-loop resubmission bug
USB: dummy-hcd: Fix erroneous synchronization change
USB: devio: Don't corrupt user memory
usb: gadget: mass_storage: set msg_registered after msg registered
USB: g_mass_storage: Fix deadlock when driver is unbound
USB: uas: fix bug in handling of alternate settings
USB: core: harden cdc_parse_cdc_header
usb: Increase quirk delay for USB devices
USB: fix out-of-bounds in usb_set_configuration
xhci: fix finding correct bus_state structure for USB 3.1 hosts
xhci: Fix sleeping with spin_lock_irq() held in ASmedia 1042A workaround
xhci: set missing SuperSpeedPlus Link Protocol bit in roothub descriptor
Revert "xhci: Limit USB2 port wake support for AMD Promontory hosts"
iio: adc: twl4030: Fix an error handling path in 'twl4030_madc_probe()'
iio: adc: twl4030: Disable the vusb3v1 rugulator in the error handling path of 'twl4030_madc_probe()'
iio: ad_sigma_delta: Implement a dedicated reset function
staging: iio: ad7192: Fix - use the dedicated reset function avoiding dma from stack.
iio: core: Return error for failed read_reg
IIO: BME280: Updates to Humidity readings need ctrl_reg write!
iio: ad7793: Fix the serial interface reset
iio: adc: mcp320x: Fix readout of negative voltages
iio: adc: mcp320x: Fix oops on module unload
uwb: properly check kthread_run return value
uwb: ensure that endpoint is interrupt
staging: vchiq_2835_arm: Fix NULL ptr dereference in free_pagelist
mm, oom_reaper: skip mm structs with mmu notifiers
lib/ratelimit.c: use deferred printk() version
lsm: fix smack_inode_removexattr and xattr_getsecurity memleak
ALSA: compress: Remove unused variable
Revert "ALSA: echoaudio: purge contradictions between dimension matrix members and total number of members"
ALSA: usx2y: Suppress kernel warning at page allocation failures
mlxsw: spectrum: Prevent mirred-related crash on removal
net: sched: fix use-after-free in tcf_action_destroy and tcf_del_walker
sctp: potential read out of bounds in sctp_ulpevent_type_enabled()
tcp: update skb->skb_mstamp more carefully
bpf/verifier: reject BPF_ALU64|BPF_END
tcp: fix data delivery rate
udpv6: Fix the checksum computation when HW checksum does not apply
ip6_gre: skb_push ipv6hdr before packing the header in ip6gre_header
net: phy: Fix mask value write on gmii2rgmii converter speed register
ip6_tunnel: do not allow loading ip6_tunnel if ipv6 is disabled in cmdline
net/sched: cls_matchall: fix crash when used with classful qdisc
tcp: fastopen: fix on syn-data transmit failure
net: emac: Fix napi poll list corruption
packet: hold bind lock when rebinding to fanout hook
bpf: one perf event close won't free bpf program attached by another perf event
isdn/i4l: fetch the ppp_write buffer in one shot
net_sched: always reset qdisc backlog in qdisc_reset()
net: qcom/emac: specify the correct size when mapping a DMA buffer
vti: fix use after free in vti_tunnel_xmit/vti6_tnl_xmit
l2tp: Avoid schedule while atomic in exit_net
l2tp: fix race condition in l2tp_tunnel_delete
tun: bail out from tun_get_user() if the skb is empty
net: dsa: Fix network device registration order
packet: in packet_do_bind, test fanout with bind_lock held
packet: only test po->has_vnet_hdr once in packet_snd
net: Set sk_prot_creator when cloning sockets to the right proto
netlink: do not proceed if dump's start() errs
ip6_gre: ip6gre_tap device should keep dst
ip6_tunnel: update mtu properly for ARPHRD_ETHER tunnel device in tx path
tipc: use only positive error codes in messages
net: rtnetlink: fix info leak in RTM_GETSTATS call
socket, bpf: fix possible use after free
powerpc/64s: Use emergency stack for kernel TM Bad Thing program checks
powerpc/tm: Fix illegal TM state in signal handler
percpu: make this_cpu_generic_read() atomic w.r.t. interrupts
driver core: platform: Don't read past the end of "driver_override" buffer
Drivers: hv: fcopy: restore correct transfer length
stm class: Fix a use-after-free
ftrace: Fix kmemleak in unregister_ftrace_graph
HID: i2c-hid: allocate hid buffers for real worst case
HID: wacom: leds: Don't try to control the EKR's read-only LEDs
HID: wacom: Always increment hdev refcount within wacom_get_hdev_data
HID: wacom: bits shifted too much for 9th and 10th buttons
rocker: fix rocker_tlv_put_* functions for KASAN
netlink: fix nla_put_{u8,u16,u32} for KASAN
iwlwifi: mvm: use IWL_HCMD_NOCOPY for MCAST_FILTER_CMD
iwlwifi: add workaround to disable wide channels in 5GHz
scsi: sd: Do not override max_sectors_kb sysfs setting
brcmfmac: add length check in brcmf_cfg80211_escan_handler()
brcmfmac: setup passive scan if requested by user-space
drm/i915/bios: ignore HDMI on port A
nvme-pci: Use PCI bus address for data/queues in CMB
mmc: core: add driver strength selection when selecting hs400es
sched/cpuset/pm: Fix cpuset vs. suspend-resume bugs
vfs: deny copy_file_range() for non regular files
ext4: fix data corruption for mmap writes
ext4: Don't clear SGID when inheriting ACLs
ext4: don't allow encrypted operations without keys
f2fs: don't allow encrypted operations without keys
KVM: x86: fix singlestepping over syscall
Linux 4.9.55
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[ Upstream commit 63ecc3d9436f8012e49dc846d6cb0a85a3433517 ]
While trying an ESP transport mode encryption for UDPv6 packets of
datagram size 1436 with MTU 1500, checksum error was observed in
the secondary fragment.
This error occurs due to the UDP payload checksum being missed out
when computing the full checksum for these packets in
udp6_hwcsum_outgoing().
Fixes: d39d938c82 ("ipv6: Introduce udpv6_send_skb()")
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Subash Abhinov Kasiviswanathanauthored and Greg Kroah-Hartmancommited 2017-10-12 11:51:20 +02:00
Currently, in the udp6 code, the dst cookie is not initialized/updated
concurrently with the RX dst used by early demux.
As a result, the dst_check() in the early_demux path always fails,
the rx dst cache is always invalidated, and we can't really
leverage significant gain from the demux lookup.
Fix it adding udp6 specific variant of sk_rx_dst_set() and use it
to set the dst cookie when the dst entry is really changed.
The issue is there since the introduction of early demux for ipv6.
CRs-Fixed: 2122802
Change-Id: I607ee86f4b53dd422dda81d88fdfb03a73647676
Fixes: 5425077d73e0 ("net: ipv6: Add early demux handler for UDP unicast")
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Git-commit: 64f0f5d18a47c703c85576375cc010e83dac6a48
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Paolo Abeniauthored and Subash Abhinov Kasiviswanathancommited 2017-10-09 16:01:04 -06:00
In udp_v4/6_early_demux() code, we try to hold dst->__refcnt for
dst with DST_NOCACHE flag. This is because later in udp_sk_rx_dst_set()
function, we will try to cache this dst in sk for connected case.
However, a better way to achieve this is to not try to hold dst in
early_demux(), but in udp_sk_rx_dst_set(), call dst_hold_safe(). This
approach is also more consistant with how tcp is handling it. And it
will make later changes simpler.
CRs-Fixed: 2122802
Change-Id: Idb147edb9de364f76bd02df9069954f9c9e29b67
Signed-off-by: Wei Wang <weiwan@google.com>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Git-commit: d24406c85d123df773bc4df88ad5da2233896919
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Wei Wangauthored and Subash Abhinov Kasiviswanathancommited 2017-10-09 16:01:01 -06:00
When an early demuxed packet reaches __udp6_lib_lookup_skb(), the
sk reference is retrieved and used, but the relevant reference
count is leaked and the socket destructor is never called.
Beyond leaking the sk memory, if there are pending UDP packets
in the receive queue, even the related accounted memory is leaked.
In the long run, this will cause persistent forward allocation errors
and no UDP skbs (both ipv4 and ipv6) will be able to reach the
user-space.
Fix this by explicitly accessing the early demux reference before
the lookup, and properly decreasing the socket reference count
after usage.
Also drop the skb_steal_sock() in __udp6_lib_lookup_skb(), and
the now obsoleted comment about "socket cache".
The newly added code is derived from the current ipv4 code for the
similar path.
v1 -> v2:
fixed the __udp6_lib_rcv() return code for resubmission,
as suggested by Eric
CRs-Fixed: 2122802
Change-Id: I2ede4e7661a35bd2234258c7514fd99ea9bbeea5
Reported-by: Sam Edwards <CFSworks@gmail.com>
Reported-by: Marc Haber <mh+netdev@zugschlus.de>
Fixes: 5425077d73e0 ("net: ipv6: Add early demux handler for UDP unicast")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Git-commit: c9f2c1ae123a751d4e4f949144500219354d5ee1
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Paolo Abeniauthored and Subash Abhinov Kasiviswanathancommited 2017-10-09 16:00:57 -06:00
In __ip6_datagram_connect(), reset sk->sk_v6_daddr and inet->dport if
error occurs.
In udp_v6_early_demux(), check for sk_state to make sure it is in
TCP_ESTABLISHED state.
Together, it makes sure unconnected UDP socket won't be considered as a
valid candidate for early demux.
v3: add TCP_ESTABLISHED state check in udp_v6_early_demux()
v2: fix compilation error
CRs-Fixed: 2122802
Change-Id: Ifa9c2ddfaa5b51d4082b7b1dd8a5d03b3c290705
Fixes: 5425077d73e0 ("net: ipv6: Add early demux handler for UDP unicast")
Signed-off-by: Wei Wang <weiwan@google.com>
Acked-by: Maciej Żenczykowski <maze@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Git-commit: 85cb73ff9b74785a7fc752875d7f0fe17ca3ea7c
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Wei Wangauthored and Subash Abhinov Kasiviswanathancommited 2017-10-09 16:00:54 -06:00
David Ahern reported that commit 5425077d73e0c ("net: ipv6: Add early demux
handler for UDP unicast") breaks udp_l3mdev_accept=0 since early
demux for IPv6 UDP was doing a generic socket lookup which does not
require an exact match. Fix this by making UDPv6 early demux match
connected sockets only.
v1->v2: Take reference to socket after match as suggested by Eric
v2->v3: Add comment before break
CRs-Fixed: 2122802
Change-Id: Ief9fd4a51561b7a49efa3780ebe8dc3632bdfa1c
Fixes: 5425077d73e0c ("net: ipv6: Add early demux handler for UDP unicast")
Reported-by: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Cc: Eric Dumazet <edumazet@google.com>
Acked-by: David Ahern <dsa@cumulusnetworks.com>
Tested-by: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Git-commit: 0bd84065b19bca12f07f288c8ea470e2c1b2de7a
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
[subashab@codeaurora.org: refactor to pass checkpatch]
subashab@codeaurora.orgauthored and Subash Abhinov Kasiviswanathancommited 2017-10-09 16:00:33 -06:00
While running a single stream UDPv6 test, we observed that amount
of CPU spent in NET_RX softirq was much greater than UDPv4 for an
equivalent receive rate. The test here was run on an ARM64 based
Android system. On further analysis with perf, we found that UDPv6
was spending significant time in the statistics netfilter targets
which did socket lookup per packet. These statistics rules perform
a lookup when there is no socket associated with the skb. Since
there are multiple instances of these rules based on UID, there
will be equal number of lookups per skb.
By introducing early demux for UDPv6, we avoid the redundant lookups.
This also helped to improve the performance (800Mbps -> 870Mbps) on a
CPU limited system in a single stream UDPv6 receive test with 1450
byte sized datagrams using iperf.
v1->v2: Use IPv6 cookie to validate dst instead of 0 as suggested
by Eric
CRs-Fixed: 2122802
Change-Id: I2a59058656863c2e20629fe30fbbe3847319f439
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Git-commit: 5425077d73e0c8e7e9267ca8397cc0e2293c1fb9
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
[subashab@codeaurora.org: refactor to pass checkpatch]
subashab@codeaurora.orgauthored and Subash Abhinov Kasiviswanathancommited 2017-10-09 15:49:53 -06:00
While trying an ESP transport mode encryption for UDPv6 packets of
datagram size 1436 with MTU 1500, checksum error was observed in
the secondary fragment.
This error occurs due to the UDP payload checksum being missed out
when computing the full checksum for these packets in
udp6_hwcsum_outgoing().
CRs-Fixed: 2087660
Change-Id: I8f9066a5fa731a7c81b6713dc93b1cf4824646f0
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAllEs4kACgkQONu9yGCS
aT4f0Q/9GqF8IGzm04f/KHJtuWleRAztioQbeHL1PRZdkxUBZGulXjjYIWwxuD8M
I4JWMNkI3KObU4xKPRa6kwjgMOTACBOFMKcosr3GByOIOkxxFuT57vWEtoB8sKJl
DUmQIi+uaeoCXvKIalp8pTZTrLSbKgJ7TsKEXTTJiN5HJ+d2BqsG27wjZshZjr9a
4Wr9qS76gxzFUo7ZtIoRSBPbXxYsbqgJwFc9x/QmGZua3BQepwwsbtlexhFRKB0E
QSrwyYSpDly2Y1V2flnO6BWBuTMfNw0Jwd42FOW1WvEulcrxhCPvv7+So/e40zWT
GoujyJaGqdcSxpa43QA3qUut1WiecxAX5iyiLFDcowhgnj0KRfjFrxWH5I3fGbxb
WWq78vrhq5h7zVm32XOTDzZ9R3M74GXUW9hL0uRYwsnG2pcBnHq1oe1SV3S2xv3G
v0c+T8DBxlxH5ostBzjnSs0cUDyT3i7jvKG7EJQoVebHj/2w87k3SkoUZ/x7saCM
4CdnT/ahuXAM/cmQBh/PXdVlj0f228n+GfNFqrd6YOxnDO9A6mmySAtMJS2Ovk4i
9fD2BQy3FzD8ygeCRyP8Px0BzZjuYBwhDbHlN8zJESqBR+7343u9z2xYV5MqYAO/
eWMLtIYAtzwZM0H4BNbLMd+QB2KBGm9tmd2UocufyAGmUj8Vx5A=
=1Dcl
-----END PGP SIGNATURE-----
Merge 4.9.33 into android-4.9
Changes in 4.9.33
PCI/PM: Add needs_resume flag to avoid suspend complete optimization
drm/i915: Prevent the system suspend complete optimization
partitions/msdos: FreeBSD UFS2 file systems are not recognized
netfilter: nf_conntrack_sip: fix wrong memory initialisation
ibmvnic: Fix endian errors in error reporting output
ibmvnic: Fix endian error when requesting device capabilities
net: xilinx_emaclite: fix freezes due to unordered I/O
net: xilinx_emaclite: fix receive buffer overflow
tcp: tcp_probe: use spin_lock_bh()
ipv6: Handle IPv4-mapped src to in6addr_any dst.
ipv6: Inhibit IPv4-mapped src address on the wire.
tipc: Fix tipc_sk_reinit race conditions
gfs2: Use rhashtable walk interface in glock_hash_walk
NET: Fix /proc/net/arp for AX.25
ibmvnic: Call napi_disable instead of napi_enable in failure path
ibmvnic: Initialize completion variables before starting work
NET: mkiss: Fix panic
net: hns: Fix the device being used for dma mapping during TX
sierra_net: Skip validating irrelevant fields for IDLE LSIs
sierra_net: Add support for IPv6 and Dual-Stack Link Sense Indications
i2c: piix4: Request the SMBUS semaphore inside the mutex
i2c: piix4: Fix request_region size
powerpc/powernv: Properly set "host-ipi" on IPIs
kernel/ucount.c: mark user_header with kmemleak_ignore()
net: thunderx: Fix PHY autoneg for SGMII QLM mode
ipv6: addrconf: fix generation of new temporary addresses
vfio/spapr_tce: Set window when adding additional groups to container
ipv6: Fix IPv6 packet loss in scenarios involving roaming + snooping switches
ARM: defconfigs: make NF_CT_PROTO_SCTP and NF_CT_PROTO_UDPLITE built-in
PM / runtime: Avoid false-positive warnings from might_sleep_if()
jump label: pass kbuild_cflags when checking for asm goto support
shmem: fix sleeping from atomic context
kasan: respect /proc/sys/kernel/traceoff_on_warning
log2: make order_base_2() behave correctly on const input value zero
ethtool: do not vzalloc(0) on registers dump
net: phy: Fix lack of reference count on PHY driver
net: phy: Fix PHY module checks and NULL deref in phy_attach_direct()
net: fix ndo_features_check/ndo_fix_features comment ordering
fscache: Fix dead object requeue
fscache: Clear outstanding writes when disabling a cookie
FS-Cache: Initialise stores_lock in netfs cookie
ipv6: fix flow labels when the traffic class is non-0
drm/nouveau: prevent userspace from deleting client object
drm/nouveau/fence/g84-: protect against concurrent access to semaphore buffers
net/mlx4_core: Avoid command timeouts during VF driver device shutdown
gianfar: synchronize DMA API usage by free_skb_rx_queue w/ gfar_new_page
pinctrl: baytrail: Rectify debounce support (part 2)
cec: fix wrong last_la determination
drm: prevent double-(un)registration for connectors
drm: Don't race connector registration
pinctrl: berlin-bg4ct: fix the value for "sd1a" of pin SCRD0_CRD_PRES
net: adaptec: starfire: add checks for dma mapping errors
drm/i915: Check for NULL i915_vma in intel_unpin_fb_obj()
net/mlx5: E-Switch, Err when retrieving steering name-space fails
net/mlx5: Return EOPNOTSUPP when failing to get steering name-space
parisc, parport_gsc: Fixes for printk continuation lines
net: phy: micrel: add support for KSZ8795
gtp: add genl family modules alias
drm/nouveau: Intercept ACPI_VIDEO_NOTIFY_PROBE
drm/nouveau: Rename acpi_work to hpd_work
drm/nouveau: Handle fbcon suspend/resume in seperate worker
drm/nouveau: Don't enabling polling twice on runtime resume
drm/nouveau: Fix drm poll_helper handling
drm/ast: Fixed system hanged if disable P2A
ravb: unmap descriptors when freeing rings
nfs: Fix "Don't increment lock sequence ID after NFS4ERR_MOVED"
nvmet-rdma: Fix missing dma sync to nvme data structures
r8152: avoid start_xmit to call napi_schedule during autosuspend
r8152: check rx after napi is enabled
r8152: re-schedule napi for tx
r8152: fix rtl8152_post_reset function
r8152: avoid start_xmit to schedule napi when napi is disabled
net-next: ethernet: mediatek: change the compatible string
bnxt_en: Fix bnxt_reset() in the slow path task.
bnxt_en: Enhance autoneg support.
bnxt_en: Fix RTNL lock usage on bnxt_update_link().
bnxt_en: Fix RTNL lock usage on bnxt_get_port_module_status().
sctp: sctp gso should set feature with NETIF_F_SG when calling skb_segment
sctp: sctp_addr_id2transport should verify the addr before looking up assoc
usb: musb: Fix external abort on non-linefetch for musb_irq_work()
mn10300: fix build error of missing fpu_save()
romfs: use different way to generate fsid for BLOCK or MTD
frv: add atomic64_add_unless()
frv: add missing atomic64 operations
proc: add a schedule point in proc_pid_readdir()
userfaultfd: fix SIGBUS resulting from false rwsem wakeups
kernel/watchdog.c: move hardlockup detector to separate file
kernel/watchdog.c: move shared definitions to nmi.h
kernel/watchdog: prevent false hardlockup on overloaded system
vhost/vsock: handle vhost_vq_init_access() error
ARC: smp-boot: Decouple Non masters waiting API from jump to entry point
ARCv2: smp-boot: wake_flag polling by non-Masters needs to be uncached
tipc: ignore requests when the connection state is not CONNECTED
tipc: fix connection refcount error
tipc: add subscription refcount to avoid invalid delete
tipc: fix nametbl_lock soft lockup at node/link events
netfilter: nf_tables: fix set->nelems counting with no NLM_F_EXCL
netfilter: nft_log: restrict the log prefix length to 127
RDMA/qedr: Dispatch port active event from qedr_add
RDMA/qedr: Fix and simplify memory leak in PD alloc
RDMA/qedr: Don't reset QP when queues aren't flushed
RDMA/qedr: Don't spam dmesg if QP is in error state
RDMA/qedr: Return max inline data in QP query result
xtensa: don't use linux IRQ #0
s390/kvm: do not rely on the ILC on kvm host protection fauls
drm/i915: Workaround VLV/CHV DSI scanline counter hardware fail
drm/i915: Always recompute watermarks when distrust_bios_wm is set, v2.
sparc64: make string buffers large enough
Linux 4.9.33
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[ Upstream commit 052d2369d1b479cdbbe020fdd6d057d3c342db74 ]
This patch adds a check on the type of the source address for the case
where the destination address is in6addr_any. If the source is an
IPv4-mapped IPv6 source address, the destination is changed to
::ffff:127.0.0.1, and otherwise the destination is changed to ::1. This
is done in three locations to handle UDP calls to either connect() or
sendmsg() and TCP calls to connect(). Note that udpv6_sendmsg() delays
handling an in6addr_any destination until very late, so the patch only
needs to handle the case where the source is an IPv4-mapped IPv6
address.
Signed-off-by: Jonathan T. Leighton <jtleight@udel.edu>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Jonathan T. Leightonauthored and Greg Kroah-Hartmancommited 2017-06-17 06:41:49 +02:00
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAljcttMACgkQONu9yGCS
aT6QpBAAiikkI2QliPhA8MrLU6COLKnSC+a84mGlBC7pVbTyWDQuS2BVbhAVxV6r
pOqardeN8UJuDXVb6jXTilojxku7urcRSrsdOHoGHS4mjB3/EZZWB2mEyPipDPh7
OeyiL5ZbTj/6XncR74Z+8TKbEdFU9mM7mY+vxdiGUrHdKlI15M+N4inrIWXoQYBm
4cNRM0kIaZza/IOgPdIPH8C01sgMmSrOn6CCLT9rFHSWEWQEqYk/6H9Zc+lyo94U
OWyfIjf220Axf0DszBU2mEAldWcR/QFTUW6qfi11buOUxF3sZP6i71VNAlqX6zbX
CfhPGe4PHZars5CzLnENHc88t61dcxtH7VivWSLllErUg8y8n5It3zKpSMTEYfjd
dXko6k7jAJlPIOIi1ZHD71q6T145B5srAfGDV/SAq584imZnBM3xesijFpr5vonV
0tEOZ3nMnhxL55XKIDJI86IyPVHAySG8WqtaYWy8GieV7EEZTs+8/Sy1AvT8Skr/
4GSfpVEZDLjixQyDM/roUtp/2fTg/s9iNCTDw/zrCCCSE7Q4AEMyd4iyc4dWU2XT
NuRdy5vDeIjqculLqM0LTB/5hlTVKLRlpkHyaxl7LNxMpV9JHKDqgzGYkbvWZNWH
7k1IJ9VbXxd06IQEZhUqv7FccGwRFtyzblaDgCBgnksWmbxHvtg=
=rkSm
-----END PGP SIGNATURE-----
Merge 4.9.19 into android-4.9
Changes in 4.9.19:
net/openvswitch: Set the ipv6 source tunnel key address attribute correctly
net: bcmgenet: Do not suspend PHY if Wake-on-LAN is enabled
net: properly release sk_frag.page
amd-xgbe: Fix jumbo MTU processing on newer hardware
openvswitch: Add missing case OVS_TUNNEL_KEY_ATTR_PAD
net: unix: properly re-increment inflight counter of GC discarded candidates
qmi_wwan: add Dell DW5811e
net: vrf: Reset rt6i_idev in local dst after put
net/mlx5: Add missing entries for set/query rate limit commands
net/mlx5e: Use the proper UAPI values when offloading TC vlan actions
net/mlx5: Increase number of max QPs in default profile
net/mlx5e: Count GSO packets correctly
net/mlx5e: Count LRO packets correctly
ipv6: make sure to initialize sockc.tsflags before first use
net: bcmgenet: remove bcmgenet_internal_phy_setup()
ipv4: provide stronger user input validation in nl_fib_input()
socket, bpf: fix sk_filter use after free in sk_clone_lock
tcp: initialize icsk_ack.lrcvtime at session start time
Input: ALPS - fix V8+ protocol handling (73 03 28)
Input: ALPS - fix trackstick button handling on V8 devices
Input: elan_i2c - add ASUS EeeBook X205TA special touchpad fw
Input: i8042 - add noloop quirk for Dell Embedded Box PC 3000
Input: iforce - validate number of endpoints before using them
Input: ims-pcu - validate number of endpoints before using them
Input: hanwang - validate number of endpoints before using them
Input: yealink - validate number of endpoints before using them
Input: cm109 - validate number of endpoints before using them
Input: kbtab - validate number of endpoints before using them
Input: sur40 - validate number of endpoints before using them
ALSA: seq: Fix racy cell insertions during snd_seq_pool_done()
ALSA: ctxfi: Fix the incorrect check of dma_set_mask() call
ALSA: hda - Adding a group of pin definition to fix headset problem
USB: serial: option: add Quectel UC15, UC20, EC21, and EC25 modems
USB: serial: qcserial: add Dell DW5811e
ACM gadget: fix endianness in notifications
usb: gadget: f_uvc: Fix SuperSpeed companion descriptor's wBytesPerInterval
usb-core: Add LINEAR_FRAME_INTR_BINTERVAL USB quirk
USB: uss720: fix NULL-deref at probe
USB: lvtest: fix NULL-deref at probe
USB: idmouse: fix NULL-deref at probe
USB: wusbcore: fix NULL-deref at probe
usb: musb: cppi41: don't check early-TX-interrupt for Isoch transfer
usb: hub: Fix crash after failure to read BOS descriptor
USB: usbtmc: add missing endpoint sanity check
USB: usbtmc: fix probe error path
uwb: i1480-dfu: fix NULL-deref at probe
uwb: hwa-rc: fix NULL-deref at probe
mmc: ushc: fix NULL-deref at probe
iio: adc: ti_am335x_adc: fix fifo overrun recovery
iio: sw-device: Fix config group initialization
iio: hid-sensor-trigger: Change get poll value function order to avoid sensor properties losing after resume from S3
iio: magnetometer: ak8974: remove incorrect __exit markups
parport: fix attempt to write duplicate procfiles
ext4: mark inode dirty after converting inline directory
ext4: lock the xattr block before checksuming it
powerpc/64s: Fix idle wakeup potential to clobber registers
mmc: sdhci-of-at91: Support external regulators
mmc: sdhci-of-arasan: fix incorrect timeout clock
mmc: sdhci: Do not disable interrupts while waiting for clock
mmc: sdhci-pci: Do not disable interrupts in sdhci_intel_set_power
hwrng: amd - Revert managed API changes
hwrng: geode - Revert managed API changes
clk: sunxi-ng: sun6i: Fix enable bit offset for hdmi-ddc module clock
clk: sunxi-ng: mp: Adjust parent rate for pre-dividers
mwifiex: pcie: don't leak DMA buffers when removing
crypto: ccp - Assign DMA commands to the channel's CCP
xen/acpi: upload PM state from init-domain to Xen
iommu/vt-d: Fix NULL pointer dereference in device_to_iommu
Revert "ARM: at91/dt: sama5d2: Use new compatible for ohci node"
ARM: at91: pm: cpu_idle: switch DDR to power-down mode
arm64: kaslr: Fix up the kernel image alignment
cpufreq: Restore policy min/max limits on CPU online
cgroup, net_cls: iterate the fds of only the tasks which are being migrated
blk-mq: don't complete un-started request in timeout handler
drm/amdgpu: reinstate oland workaround for sclk
auxdisplay: img-ascii-lcd: add missing sentinel entry in img_ascii_lcd_matches
jbd2: don't leak memory if setting up journal fails
intel_th: Don't leak module refcount on failure to activate
Drivers: hv: vmbus: Don't leak channel ids
Drivers: hv: vmbus: Don't leak memory when a channel is rescinded
libceph: don't set weight to IN when OSD is destroyed
device-dax: fix pmd/pte fault fallback handling
drm/bridge: analogix dp: Fix runtime PM state on driver bind
nl80211: fix dumpit error path RTNL deadlocks
drm: reference count event->completion
fbcon: Fix vc attr at deinit
crypto: algif_hash - avoid zero-sized array
Linux 4.9.19
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[ Upstream commit d515684d78148884d5fc425ba904c50f03844020 ]
In the case udp_sk(sk)->pending is AF_INET6, udpv6_sendmsg() would
jump to do_append_data, skipping the initialization of sockc.tsflags.
Fix the problem by moving sockc.tsflags initialization earlier.
The bug was detected with KMSAN.
Fixes: c14ac9451c ("sock: enable timestamping using control messages")
Signed-off-by: Alexander Potapenko <glider@google.com>
Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Alexander Potapenkoauthored and Greg Kroah-Hartmancommited 2017-03-30 09:41:22 +02:00
- Use the UID in routing lookups made by protocol connect() and
sendmsg() functions.
- Make sure that routing lookups triggered by incoming packets
(e.g., Path MTU discovery) take the UID of the socket into
account.
- For packets not associated with a userspace socket, (e.g., ping
replies) use UID 0 inside the user namespace corresponding to
the network namespace the socket belongs to. This allows
all namespaces to apply routing and iptables rules to
kernel-originated traffic in that namespaces by matching UID 0.
This is better than using the UID of the kernel socket that is
sending the traffic, because the UID of kernel sockets created
at namespace creation time (e.g., the per-processor ICMP and
TCP sockets) is the UID of the user that created the socket,
which might not be mapped in the namespace.
Change-Id: Ie35761630d9a77746399d6808ff0efb143efabb8
Tested: compiles allnoconfig, allyesconfig, allmodconfig
Tested: https://android-review.googlesource.com/253302
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Lorenzo Colittiauthored and Dmitry Shmidtcommited 2017-01-27 13:55:59 -08:00
In commits 93821778de ("udp: Fix rcv socket locking") and
f7ad74fef3 ("net/ipv6/udp: UDP encapsulation: break backlog_rcv into
__udpv6_queue_rcv_skb") UDP backlog handlers were renamed, but UDPlite
was forgotten.
This leads to crashes if UDPlite header is pulled twice, which happens
starting from commit e6afc8ace6 ("udp: remove headers from UDP packets
before queueing")
Bug found by syzkaller team, thanks a lot guys !
Note that backlog use in UDP/UDPlite is scheduled to be removed starting
from linux-4.10, so this patch is only needed up to linux-4.9
Fixes: 93821778de ("udp: Fix rcv socket locking")
Fixes: f7ad74fef3 ("net/ipv6/udp: UDP encapsulation: break backlog_rcv into __udpv6_queue_rcv_skb")
Fixes: e6afc8ace6 ("udp: remove headers from UDP packets before queueing")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Cc: Benjamin LaHaise <bcrl@kvack.org>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Eric Dumazetauthored and David S. Millercommited 2016-11-24 15:32:14 -05:00
Honor udptable parameter that is passed to __udp*_lib_mcast_deliver(),
otherwise udplite broadcast/multicast use the wrong table and it breaks.
Fixes: 2dc41cff75 ("udp: Use hash2 for long hash1 chains in __udp*_lib_mcast_deliver.")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Pablo Neiraauthored and David S. Millercommited 2016-11-15 22:14:27 -05:00
First bug was added in commit ad6f939ab1 ("ip: Add offset parameter to
ip_cmsg_recv") : Tom missed that ipv4 udp messages could be received on
AF_INET6 socket. ip_cmsg_recv(msg, skb) should have been replaced by
ip_cmsg_recv_offset(msg, skb, sizeof(struct udphdr));
Then commit e6afc8ace6 ("udp: remove headers from UDP packets before
queueing") forgot to adjust the offsets now UDP headers are pulled
before skb are put in receive queue.
Fixes: ad6f939ab1 ("ip: Add offset parameter to ip_cmsg_recv")
Fixes: e6afc8ace6 ("udp: remove headers from UDP packets before queueing")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Sam Kumar <samanthakumar@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Tested-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Eric Dumazetauthored and David S. Millercommited 2016-10-26 17:33:22 -04:00
Now RCU lookups of ipv6 udp sockets no longer dereference
pinet6 field, we can get rid of udp_v6_clear_sk() helper.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Eric Dumazetauthored and David S. Millercommited 2016-08-23 23:23:50 -07:00
This implements SOCK_DESTROY for UDP sockets similar to what was done
for TCP with commit c1e64e298b ("net: diag: Support destroying TCP
sockets.") A process with a UDP socket targeted for destroy is awakened
and recvmsg fails with ECONNABORTED.
Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
David Ahernauthored and David S. Millercommited 2016-08-23 23:12:27 -07:00
After commit ca065d0cf8 ("udp: no longer use SLAB_DESTROY_BY_RCU")
we do not need this special allocation mode anymore, even if it is
harmless.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Eric Dumazetauthored and David S. Millercommited 2016-08-23 17:46:17 -07:00
After a612769774 ("udp: prevent bugcheck if filter truncates packet
too much"), there followed various other fixes for similar cases such
as f4979fcea7 ("rose: limit sk_filter trim to payload").
Latter introduced a new helper sk_filter_trim_cap(), where we can pass
the trim limit directly to the socket filter handling. Make use of it
here as well with sizeof(struct udphdr) as lower cap limit and drop the
extra skb->len test in UDP's input path.
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Cc: Willem de Bruijn <willemb@google.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Daniel Borkmannauthored and David S. Millercommited 2016-07-25 21:40:33 -07:00
If socket filter truncates an udp packet below the length of UDP header
in udpv6_queue_rcv_skb() or udp_queue_rcv_skb(), it will trigger a
BUG_ON in skb_pull_rcsum(). This BUG_ON (and therefore a system crash if
kernel is configured that way) can be easily enforced by an unprivileged
user which was reported as CVE-2016-6162. For a reproducer, see
http://seclists.org/oss-sec/2016/q3/8
Fixes: e6afc8ace6 ("udp: remove headers from UDP packets before queueing")
Reported-by: Marco Grassi <marco.gra@gmail.com>
Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
Acked-by: Eric Dumazet <edumazet@google.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Michal Kubečekauthored and David S. Millercommited 2016-07-11 12:43:15 -07:00
Daniel Borkmann
authored and
Sorayukii
commited 
Martin KaFai Lau
authored and
Paolo Abeni
authored and
Andrey Ignatov
authored and
David Ahern
authored and
Robert Shearman
authored and
Julia Lawall
authored and
subashab@codeaurora.org
authored and
Michael Bestas
commited 
Greg Kroah-Hartman
commited 
Eric Dumazet
authored and
Greg Kroah-Hartman
commited 
Sasha Levin
commited 
Miaohe Lin
authored and
jianzhou
commited 
Wei Wang
authored and
Jonathan T. Leighton
authored and
Alexander Potapenko
authored and
Lorenzo Colitti
authored and
Dmitry Shmidt
commited 
David S. Miller
commited 
Pablo Neira
authored and
David Ahern
authored and
Michal Kubeček
authored and