5183d3514ae6e8257386cc2d1384438d3da170b5
881 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
lucaswei
|
56acc710a6 |
Merge LA.UM.9.12.R2.10.00.00.685.011 via branch 'qcom-msm-4.19-7250' into android-msm-pixel-4.19
Conflicts: Documentation/ABI/testing/sysfs-fs-f2fs Documentation/filesystems/f2fs.txt Documentation/filesystems/fscrypt.rst Documentation/sysctl/vm.txt Makefile arch/arm64/boot/Makefile arch/arm64/configs/vendor/kona_defconfig arch/arm64/configs/vendor/lito_defconfig arch/arm64/kernel/vdso.c arch/arm64/mm/init.c arch/arm64/mm/mmu.c arch/ia64/mm/init.c arch/powerpc/mm/mem.c arch/s390/mm/init.c arch/sh/mm/init.c arch/x86/mm/init_32.c arch/x86/mm/init_64.c block/bio.c block/blk-crypto-fallback.c block/blk-crypto-internal.h block/blk-crypto.c block/blk-merge.c block/keyslot-manager.c build.config.common drivers/base/core.c drivers/base/power/wakeup.c drivers/char/adsprpc.c drivers/char/diag/diagchar_core.c drivers/crypto/Makefile drivers/crypto/msm/qcedev.c drivers/crypto/msm/qcrypto.c drivers/dma-buf/dma-buf.c drivers/input/input.c drivers/input/keycombo.c drivers/input/misc/gpio_input.c drivers/input/misc/gpio_matrix.c drivers/input/touchscreen/st/fts.c drivers/md/Kconfig drivers/md/dm-default-key.c drivers/md/dm.c drivers/mmc/host/Makefile drivers/mmc/host/sdhci-msm-ice.h drivers/net/phy/phy_device.c drivers/of/property.c drivers/pci/controller/pci-msm.c drivers/platform/msm/gsi/Makefile drivers/platform/msm/ipa/ipa_rm_inactivity_timer.c drivers/platform/msm/ipa/ipa_v3/ipa.c drivers/platform/msm/ipa/ipa_v3/ipa_pm.c drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c drivers/platform/msm/sps/spsi.h drivers/power/supply/qcom/qpnp-smb5.c drivers/power/supply/qcom/smb5-lib.h drivers/power/supply/qcom/step-chg-jeita.c drivers/scsi/ufs/Kconfig drivers/scsi/ufs/Makefile drivers/scsi/ufs/ufs-qcom-ice.c drivers/scsi/ufs/ufs-qcom.c drivers/scsi/ufs/ufs-qcom.h drivers/scsi/ufs/ufshcd-crypto.c drivers/scsi/ufs/ufshcd-crypto.h drivers/scsi/ufs/ufshcd.c drivers/scsi/ufs/ufshcd.h drivers/soc/qcom/Makefile drivers/soc/qcom/msm_bus/msm_bus_dbg.c drivers/soc/qcom/msm_bus/msm_bus_dbg_rpmh.c drivers/soc/qcom/msm_minidump.c drivers/soc/qcom/peripheral-loader.c drivers/soc/qcom/smp2p.c drivers/soc/qcom/smp2p_sleepstate.c drivers/soc/qcom/subsystem_restart.c drivers/spi/spi-geni-qcom.c drivers/thermal/tsens.h drivers/tty/serial/Kconfig drivers/tty/serial/msm_geni_serial.c drivers/usb/typec/tcpm/fusb302.c drivers/usb/typec/tcpm/tcpm.c fs/crypto/bio.c fs/crypto/crypto.c fs/crypto/fname.c fs/crypto/fscrypt_private.h fs/crypto/inline_crypt.c fs/crypto/keyring.c fs/crypto/keysetup.c fs/crypto/keysetup_v1.c fs/crypto/policy.c fs/eventpoll.c fs/ext4/inode.c fs/ext4/ioctl.c fs/ext4/page-io.c fs/ext4/super.c fs/f2fs/Kconfig fs/f2fs/compress.c fs/f2fs/data.c fs/f2fs/dir.c fs/f2fs/f2fs.h fs/f2fs/file.c fs/f2fs/gc.c fs/f2fs/hash.c fs/f2fs/inline.c fs/f2fs/inode.c fs/f2fs/namei.c fs/f2fs/super.c fs/f2fs/sysfs.c fs/ubifs/ioctl.c include/linux/bio-crypt-ctx.h include/linux/bio.h include/linux/blk-crypto.h include/linux/blk_types.h include/linux/fscrypt.h include/linux/gfp.h include/linux/keyslot-manager.h include/linux/memory_hotplug.h include/linux/usb/tcpm.h include/linux/usb/typec.h include/soc/qcom/socinfo.h include/trace/events/f2fs.h include/uapi/linux/fscrypt.h include/uapi/linux/sched/types.h kernel/memremap.c kernel/sched/core.c kernel/sched/cpufreq_schedutil.c kernel/sched/fair.c kernel/sched/psi.c kernel/sched/sched.h kernel/sysctl.c lib/Makefile lib/test_stackinit.c mm/filemap.c mm/hmm.c mm/memory_hotplug.c mm/page_alloc.c scripts/gen_autoksyms.sh Bug: 157994070 Bug: 157858241 Bug: 157879992 Signed-off-by: lucaswei <lucaswei@google.com> Change-Id: Ib43efc6464e484b85107587c2f770246b48ddee6 |
||
|
Greg Kroah-Hartman
|
05951af8e6 |
UPSTREAM: bpf: Explicitly memset some bpf info structures declared on the stack
Trying to initialize a structure with "= {};" will not always clean out
all padding locations in a structure. So be explicit and call memset to
initialize everything for a number of bpf information structures that
are then copied from userspace, sometimes from smaller memory locations
than the size of the structure.
Bug: 153418162
Test: run vts VtsKernelNetTest pass (b/153418162#comment5)
Reported-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20200320162258.GA794295@kroah.com
(cherry picked from commit 269efb7fc478563a7e7b22590d8076823f4ac82a)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I52a2cab20aa310085ec104bd811ac4f2b83657b6
Signed-off-by: Mars Lin <marslin@google.com>
|
||
|
Greg Kroah-Hartman
|
cb05993e6a |
UPSTREAM: bpf: Explicitly memset the bpf_attr structure
For the bpf syscall, we are relying on the compiler to properly zero out the bpf_attr union that we copy userspace data into. Unfortunately that doesn't always work properly, padding and other oddities might not be correctly zeroed, and in some tests odd things have been found when the stack is pre-initialized to other values. Fix this by explicitly memsetting the structure to 0 before using it. Bug: 153418162 Test: run vts VtsKernelNetTest pass (b/153418162#comment5) Reported-by: Maciej Żenczykowski <maze@google.com> Reported-by: John Stultz <john.stultz@linaro.org> Reported-by: Alexander Potapenko <glider@google.com> Reported-by: Alistair Delva <adelva@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Yonghong Song <yhs@fb.com> Link: https://android-review.googlesource.com/c/kernel/common/+/1235490 Link: https://lore.kernel.org/bpf/20200320094813.GA421650@kroah.com (cherry picked from commit 8096f229421f7b22433775e928d506f0342e5907) Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I2dc28cd45024da5cc6861ff4a9b25fae389cc6d8 Signed-off-by: Mars Lin <marslin@google.com> |
||
|
Ivaylo Georgiev
|
cb4e55266e |
Merge android-4.19.110:wq(1984fff) into msm-4.19
* refs/heads/tmp-1984fff:
Revert "ANDROID: staging: android: ion: enable modularizing the ion driver"
Revert "BACKPORT: sched/rt: Make RT capacity-aware"
Revert "ANDROID: GKI: Add devm_thermal_of_virtual_sensor_register API."
Linux 4.19.110
KVM: SVM: fix up incorrect backport
ANDROID: gki_defconfig: Enable USB_CONFIGFS_MASS_STORAGE
UPSTREAM: arm64: memory: Add missing brackets to untagged_addr() macro
UPSTREAM: mm: Avoid creating virtual address aliases in brk()/mmap()/mremap()
ANDROID: Add TPM support and the vTPM proxy to Cuttlefish.
Revert "ANDROID: tty: serdev: Fix broken serial console input"
ANDROID: serdev: restrict claim of platform devices
ANDROID: update the ABI xml representation
ANDROID: GKI: add a USB TypeC vendor field for ABI compat
UPSTREAM: usb: typec: mux: Switch to use fwnode_property_count_uXX()
UPSTREAM: usb: typec: Make sure an alt mode exist before getting its partner
UPSTREAM: usb: typec: Registering real device entries for the muxes
UPSTREAM: usb: typec: mux: remove redundant check on variable match
UPSTREAM: usb: typec: mux: Fix unsigned comparison with less than zero
UPSTREAM: usb: typec: mux: Find the muxes by also matching against the device node
UPSTREAM: usb: typec: Find the ports by also matching against the device node
UPSTREAM: usb: typec: Rationalize the API for the muxes
UPSTREAM: device property: Add helpers to count items in an array
UPSTREAM: platform/x86: intel_cht_int33fe: Remove old style mux connections
UPSTREAM: platform/x86: intel_cht_int33fe: Prepare for better mux naming scheme
UPSTREAM: usb: typec: Prepare alt mode enter/exit reporting for UCSI alt mode support
ANDROID: GKI: Update ABI
ANDROID: GKI: drivers: of: Add API to find ddr device type
UPSTREAM: Input: reset device timestamp on sync
UPSTREAM: Input: allow drivers specify timestamp for input events
ANDROID: GKI: usb: dwc3: Add USB_DR_MODE_DRD as dual role mode
ANDROID: GKI: Add devm_thermal_of_virtual_sensor_register API.
UPSTREAM: crypto: skcipher - Introduce crypto_sync_skcipher
ANDROID: GKI: cfg80211: Add AP stopped interface
UPSTREAM: device connection: Add fwnode member to struct device_connection
FROMGIT: kallsyms: unexport kallsyms_lookup_name() and kallsyms_on_each_symbol()
FROMGIT: samples/hw_breakpoint: drop use of kallsyms_lookup_name()
FROMGIT: samples/hw_breakpoint: drop HW_BREAKPOINT_R when reporting writes
UPSTREAM: fscrypt: don't evict dirty inodes after removing key
ANDROID: gki_defconfig: Enable CONFIG_VM_EVENT_COUNTERS
ANDROID: gki_defconfig: Enable CONFIG_CLEANCACHE
ANDROID: Update ABI representation
ANDROID: gki_defconfig: disable CONFIG_DEBUG_DEVRES
Linux 4.19.109
scsi: pm80xx: Fixed kernel panic during error recovery for SATA drive
dm integrity: fix a deadlock due to offloading to an incorrect workqueue
efi/x86: Handle by-ref arguments covering multiple pages in mixed mode
efi/x86: Align GUIDs to their size in the mixed mode runtime wrapper
powerpc: fix hardware PMU exception bug on PowerVM compatibility mode systems
dmaengine: coh901318: Fix a double lock bug in dma_tc_handle()
hwmon: (adt7462) Fix an error return in ADT7462_REG_VOLT()
ARM: dts: imx7-colibri: Fix frequency for sd/mmc
ARM: dts: am437x-idk-evm: Fix incorrect OPP node names
ARM: imx: build v7_cpu_resume() unconditionally
IB/hfi1, qib: Ensure RCU is locked when accessing list
RMDA/cm: Fix missing ib_cm_destroy_id() in ib_cm_insert_listen()
RDMA/iwcm: Fix iwcm work deallocation
ARM: dts: imx6: phycore-som: fix emmc supply
phy: mapphone-mdm6600: Fix write timeouts with shorter GPIO toggle interval
phy: mapphone-mdm6600: Fix timeouts by adding wake-up handling
drm/sun4i: de2/de3: Remove unsupported VI layer formats
drm/sun4i: Fix DE2 VI layer format support
ASoC: dapm: Correct DAPM handling of active widgets during shutdown
ASoC: pcm512x: Fix unbalanced regulator enable call in probe error path
ASoC: pcm: Fix possible buffer overflow in dpcm state sysfs output
dmaengine: imx-sdma: remove dma_slave_config direction usage and leave sdma_event_enable()
ASoC: intel: skl: Fix possible buffer overflow in debug outputs
ASoC: intel: skl: Fix pin debug prints
ASoC: topology: Fix memleak in soc_tplg_manifest_load()
ASoC: topology: Fix memleak in soc_tplg_link_elems_load()
spi: bcm63xx-hsspi: Really keep pll clk enabled
ARM: dts: ls1021a: Restore MDIO compatible to gianfar
dm writecache: verify watermark during resume
dm: report suspended device during destroy
dm cache: fix a crash due to incorrect work item cancelling
dmaengine: tegra-apb: Prevent race conditions of tasklet vs free list
dmaengine: tegra-apb: Fix use-after-free
x86/pkeys: Manually set X86_FEATURE_OSPKE to preserve existing changes
media: v4l2-mem2mem.c: fix broken links
vt: selection, push sel_lock up
vt: selection, push console lock down
vt: selection, close sel_buffer race
serial: 8250_exar: add support for ACCES cards
tty:serial:mvebu-uart:fix a wrong return
arm: dts: dra76x: Fix mmc3 max-frequency
fat: fix uninit-memory access for partial initialized inode
mm: fix possible PMD dirty bit lost in set_pmd_migration_entry()
mm, numa: fix bad pmd by atomically check for pmd_trans_huge when marking page tables prot_numa
vgacon: Fix a UAF in vgacon_invert_region
usb: core: port: do error out if usb_autopm_get_interface() fails
usb: core: hub: do error out if usb_autopm_get_interface() fails
usb: core: hub: fix unhandled return by employing a void function
usb: dwc3: gadget: Update chain bit correctly when using sg list
usb: quirks: add NO_LPM quirk for Logitech Screen Share
usb: storage: Add quirk for Samsung Fit flash
cifs: don't leak -EAGAIN for stat() during reconnect
ALSA: hda/realtek - Fix silent output on Gigabyte X570 Aorus Master
ALSA: hda/realtek - Add Headset Mic supported
net: thunderx: workaround BGX TX Underflow issue
x86/xen: Distribute switch variables for initialization
ice: Don't tell the OS that link is going down
nvme: Fix uninitialized-variable warning
s390/qdio: fill SL with absolute addresses
x86/boot/compressed: Don't declare __force_order in kaslr_64.c
s390: make 'install' not depend on vmlinux
s390/cio: cio_ignore_proc_seq_next should increase position index
watchdog: da9062: do not ping the hw during stop()
net: ks8851-ml: Fix 16-bit IO operation
net: ks8851-ml: Fix 16-bit data access
net: ks8851-ml: Remove 8-bit bus accessors
net: dsa: b53: Ensure the default VID is untagged
selftests: forwarding: use proto icmp for {gretap, ip6gretap}_mac testing
drm/msm/dsi/pll: call vco set rate explicitly
drm/msm/dsi: save pll state before dsi host is powered off
scsi: megaraid_sas: silence a warning
drm: msm: Fix return type of dsi_mgr_connector_mode_valid for kCFI
drm/msm/mdp5: rate limit pp done timeout warnings
usb: gadget: serial: fix Tx stall after buffer overflow
usb: gadget: ffs: ffs_aio_cancel(): Save/restore IRQ flags
usb: gadget: composite: Support more than 500mA MaxPower
selftests: fix too long argument
serial: ar933x_uart: set UART_CS_{RX,TX}_READY_ORIDE
ALSA: hda: do not override bus codec_mask in link_get()
kprobes: Fix optimize_kprobe()/unoptimize_kprobe() cancellation logic
RDMA/core: Fix use of logical OR in get_new_pps
RDMA/core: Fix pkey and port assignment in get_new_pps
net: dsa: bcm_sf2: Forcibly configure IMP port for 1Gb/sec
ALSA: hda/realtek - Fix a regression for mute led on Lenovo Carbon X1
EDAC/amd64: Set grain per DIMM
ANDROID: Fix kernelci build-break for arm32
ANDROID: enable CONFIG_WATCHDOG_CORE=y
ANDROID: kbuild: align UNUSED_KSYMS_WHITELIST with upstream
FROMLIST: f2fs: fix wrong check on F2FS_IOC_FSSETXATTR
FROMGIT: driver core: Reevaluate dev->links.need_for_probe as suppliers are added
FROMGIT: driver core: Call sync_state() even if supplier has no consumers
FROMGIT: of: property: Add device link support for power-domains and hwlocks
UPSTREAM: binder: prevent UAF for binderfs devices II
UPSTREAM: binder: prevent UAF for binderfs devices
ANDROID: GKI: enable PM_GENERIC_DOMAINS by default
ANDROID: GKI: pci: framework: disable auto suspend link
ANDROID: GKI: gpio: Add support for hierarchical IRQ domains
ANDROID: GKI: of: property: Add device links support for pinctrl-[0-3]
ANDROID: GKI: of: property: Ignore properties that start with "qcom,"
ANDROID: GKI: of: property: Add support for parsing qcom,msm-bus,name property
ANDROID: GKI: genirq: Export symbols to compile irqchip drivers as modules
ANDROID: GKI: of: irq: add helper to remap interrupts to another irqdomain
ANDROID: GKI: genirq/irqdomain: add export symbols for modularizing
ANDROID: GKI: genirq: Introduce irq_chip_get/set_parent_state calls
ANDROID: Update ABI representation
ANDROID: arm64: gki_defconfig: disable CONFIG_ZONE_DMA32
ANDROID: GKI: drivers: thermal: Fix ABI diff for struct thermal_cooling_device
ANDROID: GKI: drivers: thermal: Indicate in DT the trips are for temperature falling
ANDROID: Update ABI representation
ANDROID: Update ABI whitelist for qcom SoCs
ANDROID: gki_defconfig: enable CONFIG_TYPEC
ANDROID: Fix kernelci build-break on !CONFIG_CMA builds
ANDROID: GKI: mm: fix cma accounting in zone_watermark_ok
ANDROID: CC_FLAGS_CFI add -fno-sanitize-blacklist
FROMLIST: lib: test_stackinit.c: XFAIL switch variable init tests
Linux 4.19.108
audit: always check the netlink payload length in audit_receive_msg()
mm, thp: fix defrag setting if newline is not used
mm/huge_memory.c: use head to check huge zero page
netfilter: nf_flowtable: fix documentation
netfilter: nft_tunnel: no need to call htons() when dumping ports
thermal: brcmstb_thermal: Do not use DT coefficients
KVM: x86: Remove spurious clearing of async #PF MSR
KVM: x86: Remove spurious kvm_mmu_unload() from vcpu destruction path
perf hists browser: Restore ESC as "Zoom out" of DSO/thread/etc
pwm: omap-dmtimer: put_device() after of_find_device_by_node()
kprobes: Set unoptimized flag after unoptimizing code
drivers: net: xgene: Fix the order of the arguments of 'alloc_etherdev_mqs()'
perf stat: Fix shadow stats for clock events
perf stat: Use perf_evsel__is_clocki() for clock events
sched/fair: Fix O(nr_cgroups) in the load balancing path
sched/fair: Optimize update_blocked_averages()
KVM: Check for a bad hva before dropping into the ghc slow path
KVM: SVM: Override default MMIO mask if memory encryption is enabled
mwifiex: delete unused mwifiex_get_intf_num()
mwifiex: drop most magic numbers from mwifiex_process_tdls_action_frame()
namei: only return -ECHILD from follow_dotdot_rcu()
net: ena: make ena rxfh support ETH_RSS_HASH_NO_CHANGE
net/smc: no peer ID in CLC decline for SMCD
net: atlantic: fix potential error handling
net: atlantic: fix use after free kasan warn
net: netlink: cap max groups which will be considered in netlink_bind()
s390/qeth: vnicc Fix EOPNOTSUPP precedence
usb: charger: assign specific number for enum value
hv_netvsc: Fix unwanted wakeup in netvsc_attach()
drm/i915/gvt: Separate display reset from ALL_ENGINES reset
drm/i915/gvt: Fix orphan vgpu dmabuf_objs' lifetime
i2c: jz4780: silence log flood on txabrt
i2c: altera: Fix potential integer overflow
MIPS: VPE: Fix a double free and a memory leak in 'release_vpe()'
HID: hiddev: Fix race in in hiddev_disconnect()
HID: alps: Fix an error handling path in 'alps_input_configured()'
vhost: Check docket sk_family instead of call getname
amdgpu/gmc_v9: save/restore sdpif regs during S3
Revert "PM / devfreq: Modify the device name as devfreq(X) for sysfs"
tracing: Disable trace_printk() on post poned tests
macintosh: therm_windtunnel: fix regression when instantiating devices
HID: core: increase HID report buffer size to 8KiB
HID: core: fix off-by-one memset in hid_report_raw_event()
HID: ite: Only bind to keyboard USB interface on Acer SW5-012 keyboard dock
KVM: VMX: check descriptor table exits on instruction emulation
ACPI: watchdog: Fix gas->access_width usage
ACPICA: Introduce ACPI_ACCESS_BYTE_WIDTH() macro
audit: fix error handling in audit_data_to_entry()
ext4: potential crash on allocation error in ext4_alloc_flex_bg_array()
net/tls: Fix to avoid gettig invalid tls record
qede: Fix race between rdma destroy workqueue and link change event
ipv6: Fix nlmsg_flags when splitting a multipath route
ipv6: Fix route replacement with dev-only route
sctp: move the format error check out of __sctp_sf_do_9_1_abort
nfc: pn544: Fix occasional HW initialization failure
net: sched: correct flower port blocking
net: phy: restore mdio regs in the iproc mdio driver
net: mscc: fix in frame extraction
net: fib_rules: Correctly set table field when table number exceeds 8 bits
sysrq: Remove duplicated sysrq message
sysrq: Restore original console_loglevel when sysrq disabled
cfg80211: add missing policy for NL80211_ATTR_STATUS_CODE
cifs: Fix mode output in debugging statements
net: ena: ena-com.c: prevent NULL pointer dereference
net: ena: ethtool: use correct value for crc32 hash
net: ena: fix incorrectly saving queue numbers when setting RSS indirection table
net: ena: rss: store hash function as values and not bits
net: ena: rss: fix failure to get indirection table
net: ena: fix incorrect default RSS key
net: ena: add missing ethtool TX timestamping indication
net: ena: fix uses of round_jiffies()
net: ena: fix potential crash when rxfh key is NULL
soc/tegra: fuse: Fix build with Tegra194 configuration
ARM: dts: sti: fixup sound frame-inversion for stihxxx-b2120.dtsi
qmi_wwan: unconditionally reject 2 ep interfaces
qmi_wwan: re-add DW5821e pre-production variant
s390/zcrypt: fix card and queue total counter wrap
cfg80211: check wiphy driver existence for drvinfo report
mac80211: consider more elements in parsing CRC
dax: pass NOWAIT flag to iomap_apply
drm/msm: Set dma maximum segment size for mdss
ipmi:ssif: Handle a possible NULL pointer reference
iwlwifi: pcie: fix rb_allocator workqueue allocation
irqchip/gic-v3-its: Fix misuse of GENMASK macro
ANDROID: Update ABI representation
ANDROID: abi_gki_aarch64_whitelist: add module_layout and task_struct
ANDROID: gki_defconfig: disable KPROBES, update ABI
ANDROID: GKI: mm: add cma pcp list
ANDROID: GKI: cma: redirect page allocation to CMA
BACKPORT: mm, compaction: be selective about what pageblocks to clear skip hints
BACKPORT: mm: reclaim small amounts of memory when an external fragmentation event occurs
BACKPORT: mm: move zone watermark accesses behind an accessor
UPSTREAM: mm: use alloc_flags to record if kswapd can wake
UPSTREAM: mm, page_alloc: spread allocations across zones before introducing fragmentation
ANDROID: GKI: update abi for ufshcd changes
ANDROID: Unconditionally create bridge tracepoints
ANDROID: gki_defconfig: Enable MFD_SYSCON on x86
ANDROID: scsi: ufs: allow ufs variants to override sg entry size
ANDROID: Re-add default y for VIRTIO_PCI_LEGACY
ANDROID: GKI: build in HVC_DRIVER
ANDROID: Removed default m for virtual sw crypto device
ANDROID: Remove default y on BRIDGE_IGMP_SNOOPING
ANDROID: GKI: Added missing SND configs
FROMLIST: ufs: fix a bug on printing PRDT
UPSTREAM: sched/uclamp: Reject negative values in cpu_uclamp_write()
ANDROID: gki_defconfig: Disable CONFIG_RT_GROUP_SCHED
ANDROID: GKI: Remove CONFIG_BRIDGE from arm64 config
ANDROID: Add ABI Whitelist for qcom
ANDROID: Enable HID_NINTENDO as y
FROMLIST: HID: nintendo: add nintendo switch controller driver
UPSTREAM: regulator/of_get_regulator: add child path to find the regulator supplier
ANDROID: gki_defconfig: Remove 'BRIDGE_NETFILTER is not set'
BACKPORT: net: disable BRIDGE_NETFILTER by default
ANDROID: kbuild: fix UNUSED_KSYMS_WHITELIST backport
Linux 4.19.107
Revert "char/random: silence a lockdep splat with printk()"
s390/mm: Explicitly compare PAGE_DEFAULT_KEY against zero in storage_key_init_range
xen: Enable interrupts when calling _cond_resched()
ata: ahci: Add shutdown to freeze hardware resources of ahci
rxrpc: Fix call RCU cleanup using non-bh-safe locks
netfilter: xt_hashlimit: limit the max size of hashtable
ALSA: seq: Fix concurrent access to queue current tick/time
ALSA: seq: Avoid concurrent access to queue flags
ALSA: rawmidi: Avoid bit fields for state flags
bpf, offload: Replace bitwise AND by logical AND in bpf_prog_offload_info_fill
genirq/proc: Reject invalid affinity masks (again)
iommu/vt-d: Fix compile warning from intel-svm.h
ecryptfs: replace BUG_ON with error handling code
staging: greybus: use after free in gb_audio_manager_remove_all()
staging: rtl8723bs: fix copy of overlapping memory
usb: dwc2: Fix in ISOC request length checking
usb: gadget: composite: Fix bMaxPower for SuperSpeedPlus
scsi: Revert "target: iscsi: Wait for all commands to finish before freeing a session"
scsi: Revert "RDMA/isert: Fix a recently introduced regression related to logout"
Revert "dmaengine: imx-sdma: Fix memory leak"
Btrfs: fix btrfs_wait_ordered_range() so that it waits for all ordered extents
btrfs: do not check delayed items are empty for single transaction cleanup
btrfs: reset fs_root to NULL on error in open_ctree
btrfs: fix bytes_may_use underflow in prealloc error condtition
KVM: apic: avoid calculating pending eoi from an uninitialized val
KVM: nVMX: handle nested posted interrupts when apicv is disabled for L1
KVM: nVMX: Check IO instruction VM-exit conditions
KVM: nVMX: Refactor IO bitmap checks into helper function
ext4: fix race between writepages and enabling EXT4_EXTENTS_FL
ext4: rename s_journal_flag_rwsem to s_writepages_rwsem
ext4: fix mount failure with quota configured as module
ext4: fix potential race between s_flex_groups online resizing and access
ext4: fix potential race between s_group_info online resizing and access
ext4: fix potential race between online resizing and write operations
ext4: add cond_resched() to __ext4_find_entry()
ext4: fix a data race in EXT4_I(inode)->i_disksize
drm/nouveau/kms/gv100-: Re-set LUT after clearing for modesets
lib/stackdepot.c: fix global out-of-bounds in stack_slabs
tty: serial: qcom_geni_serial: Fix RX cancel command failure
tty: serial: qcom_geni_serial: Remove xfer_mode variable
tty: serial: qcom_geni_serial: Remove set_rfr_wm() and related variables
tty: serial: qcom_geni_serial: Remove use of *_relaxed() and mb()
tty: serial: qcom_geni_serial: Remove interrupt storm
tty: serial: qcom_geni_serial: Fix UART hang
KVM: x86: don't notify userspace IOAPIC on edge-triggered interrupt EOI
KVM: nVMX: Don't emulate instructions in guest mode
xhci: apply XHCI_PME_STUCK_QUIRK to Intel Comet Lake platforms
drm/amdgpu/soc15: fix xclk for raven
mm/vmscan.c: don't round up scan size for online memory cgroup
genirq/irqdomain: Make sure all irq domain flags are distinct
nvme-multipath: Fix memory leak with ana_log_buf
mm/memcontrol.c: lost css_put in memcg_expand_shrinker_maps()
Revert "ipc,sem: remove uneeded sem_undo_list lock usage in exit_sem()"
MAINTAINERS: Update drm/i915 bug filing URL
serdev: ttyport: restore client ops on deregistration
tty: serial: imx: setup the correct sg entry for tx dma
tty/serial: atmel: manage shutdown in case of RS485 or ISO7816 mode
serial: 8250: Check UPF_IRQ_SHARED in advance
x86/cpu/amd: Enable the fixed Instructions Retired counter IRPERF
x86/mce/amd: Fix kobject lifetime
x86/mce/amd: Publish the bank pointer only after setup has succeeded
jbd2: fix ocfs2 corrupt when clearing block group bits
powerpc/tm: Fix clearing MSR[TS] in current when reclaiming on signal delivery
staging: rtl8723bs: Fix potential overuse of kernel memory
staging: rtl8723bs: Fix potential security hole
staging: rtl8188eu: Fix potential overuse of kernel memory
staging: rtl8188eu: Fix potential security hole
usb: dwc3: gadget: Check for IOC/LST bit in TRB->ctrl fields
usb: dwc2: Fix SET/CLEAR_FEATURE and GET_STATUS flows
USB: hub: Fix the broken detection of USB3 device in SMSC hub
USB: hub: Don't record a connect-change event during reset-resume
USB: Fix novation SourceControl XL after suspend
usb: uas: fix a plug & unplug racing
USB: quirks: blacklist duplicate ep on Sound Devices USBPre2
USB: core: add endpoint-blacklist quirk
usb: host: xhci: update event ring dequeue pointer on purpose
xhci: Fix memory leak when caching protocol extended capability PSI tables - take 2
xhci: fix runtime pm enabling for quirky Intel hosts
xhci: Force Maximum Packet size for Full-speed bulk devices to valid range.
staging: vt6656: fix sign of rx_dbm to bb_pre_ed_rssi.
staging: android: ashmem: Disallow ashmem memory from being remapped
vt: vt_ioctl: fix race in VT_RESIZEX
vt: selection, handle pending signals in paste_selection
vt: fix scrollback flushing on background consoles
floppy: check FDC index for errors before assigning it
USB: misc: iowarrior: add support for the 100 device
USB: misc: iowarrior: add support for the 28 and 28L devices
USB: misc: iowarrior: add support for 2 OEMed devices
thunderbolt: Prevent crash if non-active NVMem file is read
ecryptfs: fix a memory leak bug in ecryptfs_init_messaging()
ecryptfs: fix a memory leak bug in parse_tag_1_packet()
ASoC: sun8i-codec: Fix setting DAI data format
ALSA: hda/realtek - Apply quirk for yet another MSI laptop
ALSA: hda/realtek - Apply quirk for MSI GP63, too
ALSA: hda: Use scnprintf() for printing texts for sysfs/procfs
iommu/qcom: Fix bogus detach logic
UPSTREAM: sched/psi: Fix OOB write when writing 0 bytes to PSI files
UPSTREAM: psi: Fix a division error in psi poll()
UPSTREAM: sched/psi: Fix sampling error and rare div0 crashes with cgroups and high uptime
UPSTREAM: sched/psi: Correct overly pessimistic size calculation
ANDROID: build.config.gki.aarch64: enable symbol trimming
FROMLIST: f2fs: Handle casefolding with Encryption
FROMLIST: fscrypt: Have filesystems handle their d_ops
FROMLIST: ext4: Use generic casefolding support
FROMLIST: f2fs: Use generic casefolding support
FROMLIST: Add standard casefolding support
FROMLIST: unicode: Add utf8_casefold_hash
ANDROID: sdcardfs: fix -ENOENT lookup race issue
ANDROID: gki_defconfig: Enable CONFIG_RD_LZ4
ANDROID: gki: Enable BINFMT_MISC as part of GKI
ANDROID: gki_defconfig: disable CONFIG_CRYPTO_MD4
ANDROID: dm: Add wrapped key support in dm-default-key
ANDROID: dm: add support for passing through derive_raw_secret
ANDROID: block: Prevent crypto fallback for wrapped keys
BACKPORT: FROMLIST: kbuild: generate autoksyms.h early
BACKPORT: FROMLIST: kbuild: split adjust_autoksyms.sh in two parts
BACKPORT: FROMLIST: kbuild: allow symbol whitelisting with TRIM_UNUSED_KSYMS
ANDROID: kbuild: use modules.order in adjust_autoksyms.sh
UPSTREAM: kbuild: source include/config/auto.conf instead of ${KCONFIG_CONFIG}
ANDROID: Disable wq fp check in CFI builds
ANDROID: increase limit on sched-tune boost groups
BACKPORT: nvmem: core: fix regression in of_nvmem_cell_get()
BACKPORT: nvmem: hide unused nvmem_find_cell_by_index function
BACKPORT: nvmem: resolve cells from DT at registration time
Linux 4.19.106
drm/amdgpu/display: handle multiple numbers of fclks in dcn_calcs.c (v2)
mlxsw: spectrum_dpipe: Add missing error path
virtio_balloon: prevent pfn array overflow
cifs: log warning message (once) if out of disk space
help_next should increase position index
NFS: Fix memory leaks
drm/amdgpu/smu10: fix smu10_get_clock_by_type_with_voltage
drm/amdgpu/smu10: fix smu10_get_clock_by_type_with_latency
brd: check and limit max_part par
microblaze: Prevent the overflow of the start
iwlwifi: mvm: Fix thermal zone registration
irqchip/gic-v3-its: Reference to its_invall_cmd descriptor when building INVALL
bcache: explicity type cast in bset_bkey_last()
reiserfs: prevent NULL pointer dereference in reiserfs_insert_item()
lib/scatterlist.c: adjust indentation in __sg_alloc_table
ocfs2: fix a NULL pointer dereference when call ocfs2_update_inode_fsync_trans()
radeon: insert 10ms sleep in dce5_crtc_load_lut
trigger_next should increase position index
ftrace: fpid_next() should increase position index
drm/nouveau/disp/nv50-: prevent oops when no channel method map provided
irqchip/gic-v3: Only provision redistributors that are enabled in ACPI
rbd: work around -Wuninitialized warning
ceph: check availability of mds cluster on mount after wait timeout
bpf: map_seq_next should always increase position index
cifs: fix NULL dereference in match_prepath
iwlegacy: ensure loop counter addr does not wrap and cause an infinite loop
hostap: Adjust indentation in prism2_hostapd_add_sta
ARM: 8951/1: Fix Kexec compilation issue.
jbd2: make sure ESHUTDOWN to be recorded in the journal superblock
jbd2: switch to use jbd2_journal_abort() when failed to submit the commit record
selftests: bpf: Reset global state between reuseport test runs
iommu/vt-d: Remove unnecessary WARN_ON_ONCE()
bcache: cached_dev_free needs to put the sb page
powerpc/sriov: Remove VF eeh_dev state when disabling SR-IOV
drm/nouveau/mmu: fix comptag memory leak
ALSA: hda - Add docking station support for Lenovo Thinkpad T420s
driver core: platform: fix u32 greater or equal to zero comparison
s390/ftrace: generate traced function stack frame
s390: adjust -mpacked-stack support check for clang 10
x86/decoder: Add TEST opcode to Group3-2
kbuild: use -S instead of -E for precise cc-option test in Kconfig
ALSA: hda/hdmi - add retry logic to parse_intel_hdmi()
irqchip/mbigen: Set driver .suppress_bind_attrs to avoid remove problems
remoteproc: Initialize rproc_class before use
module: avoid setting info->name early in case we can fall back to info->mod->name
btrfs: device stats, log when stats are zeroed
btrfs: safely advance counter when looking up bio csums
btrfs: fix possible NULL-pointer dereference in integrity checks
pwm: Remove set but not set variable 'pwm'
ide: serverworks: potential overflow in svwks_set_pio_mode()
cmd64x: potential buffer overflow in cmd64x_program_timings()
pwm: omap-dmtimer: Remove PWM chip in .remove before making it unfunctional
x86/mm: Fix NX bit clearing issue in kernel_map_pages_in_pgd
f2fs: fix memleak of kobject
watchdog/softlockup: Enforce that timestamp is valid on boot
drm/amd/display: fixup DML dependencies
arm64: fix alternatives with LLVM's integrated assembler
scsi: iscsi: Don't destroy session if there are outstanding connections
f2fs: free sysfs kobject
f2fs: set I_LINKABLE early to avoid wrong access by vfs
iommu/arm-smmu-v3: Use WRITE_ONCE() when changing validity of an STE
usb: musb: omap2430: Get rid of musb .set_vbus for omap2430 glue
drm/vmwgfx: prevent memory leak in vmw_cmdbuf_res_add
drm/nouveau/fault/gv100-: fix memory leak on module unload
drm/nouveau/drm/ttm: Remove set but not used variable 'mem'
drm/nouveau: Fix copy-paste error in nouveau_fence_wait_uevent_handler
drm/nouveau/gr/gk20a,gm200-: add terminators to method lists read from fw
drm/nouveau/secboot/gm20b: initialize pointer in gm20b_secboot_new()
vme: bridges: reduce stack usage
bpf: Return -EBADRQC for invalid map type in __bpf_tx_xdp_map
driver core: Print device when resources present in really_probe()
driver core: platform: Prevent resouce overflow from causing infinite loops
visorbus: fix uninitialized variable access
tty: synclink_gt: Adjust indentation in several functions
tty: synclinkmp: Adjust indentation in several functions
ASoC: atmel: fix build error with CONFIG_SND_ATMEL_SOC_DMA=m
wan: ixp4xx_hss: fix compile-testing on 64-bit
x86/nmi: Remove irq_work from the long duration NMI handler
Input: edt-ft5x06 - work around first register access error
rcu: Use WRITE_ONCE() for assignments to ->pprev for hlist_nulls
efi/x86: Don't panic or BUG() on non-critical error conditions
soc/tegra: fuse: Correct straps' address for older Tegra124 device trees
IB/hfi1: Add software counter for ctxt0 seq drop
staging: rtl8188: avoid excessive stack usage
udf: Fix free space reporting for metadata and virtual partitions
usbip: Fix unsafe unaligned pointer usage
ARM: dts: stm32: Add power-supply for DSI panel on stm32f469-disco
drm: remove the newline for CRC source name.
mlx5: work around high stack usage with gcc
ACPI: button: Add DMI quirk for Razer Blade Stealth 13 late 2019 lid switch
tools lib api fs: Fix gcc9 stringop-truncation compilation error
ALSA: sh: Fix compile warning wrt const
clk: uniphier: Add SCSSI clock gate for each channel
ALSA: sh: Fix unused variable warnings
clk: sunxi-ng: add mux and pll notifiers for A64 CPU clock
RDMA/rxe: Fix error type of mmap_offset
reset: uniphier: Add SCSSI reset control for each channel
pinctrl: sh-pfc: sh7269: Fix CAN function GPIOs
PM / devfreq: rk3399_dmc: Add COMPILE_TEST and HAVE_ARM_SMCCC dependency
x86/vdso: Provide missing include file
crypto: chtls - Fixed memory leak
dmaengine: imx-sdma: Fix memory leak
dmaengine: Store module owner in dma_device struct
selinux: ensure we cleanup the internal AVC counters on error in avc_update()
ARM: dts: r8a7779: Add device node for ARM global timer
drm/mediatek: handle events when enabling/disabling crtc
scsi: aic7xxx: Adjust indentation in ahc_find_syncrate
scsi: ufs: Complete pending requests in host reset and restore path
ACPICA: Disassembler: create buffer fields in ACPI_PARSE_LOAD_PASS1
orinoco: avoid assertion in case of NULL pointer
rtlwifi: rtl_pci: Fix -Wcast-function-type
iwlegacy: Fix -Wcast-function-type
ipw2x00: Fix -Wcast-function-type
b43legacy: Fix -Wcast-function-type
ALSA: usx2y: Adjust indentation in snd_usX2Y_hwdep_dsp_status
netfilter: nft_tunnel: add the missing ERSPAN_VERSION nla_policy
fore200e: Fix incorrect checks of NULL pointer dereference
r8169: check that Realtek PHY driver module is loaded
reiserfs: Fix spurious unlock in reiserfs_fill_super() error handling
media: v4l2-device.h: Explicitly compare grp{id,mask} to zero in v4l2_device macros
PCI: Increase D3 delay for AMD Ryzen5/7 XHCI controllers
PCI: Add generic quirk for increasing D3hot delay
media: cx23885: Add support for AVerMedia CE310B
PCI: iproc: Apply quirk_paxc_bridge() for module as well as built-in
ARM: dts: imx6: rdu2: Limit USBH1 to Full Speed
ARM: dts: imx6: rdu2: Disable WP for USDHC2 and USDHC3
arm64: dts: qcom: msm8996: Disable USB2 PHY suspend by core
selinux: ensure we cleanup the internal AVC counters on error in avc_insert()
arm: dts: allwinner: H3: Add PMU node
arm64: dts: allwinner: H6: Add PMU mode
selinux: fall back to ref-walk if audit is required
NFC: port100: Convert cpu_to_le16(le16_to_cpu(E1) + E2) to use le16_add_cpu().
net/wan/fsl_ucc_hdlc: reject muram offsets above 64K
regulator: rk808: Lower log level on optional GPIOs being not available
drm/amdgpu: Ensure ret is always initialized when using SOC15_WAIT_ON_RREG
drm/amdgpu: remove 4 set but not used variable in amdgpu_atombios_get_connector_info_from_object_table
clk: qcom: rcg2: Don't crash if our parent can't be found; return an error
kconfig: fix broken dependency in randconfig-generated .config
KVM: s390: ENOTSUPP -> EOPNOTSUPP fixups
nbd: add a flush_workqueue in nbd_start_device
drm/amd/display: Retrain dongles when SINK_COUNT becomes non-zero
ath10k: Correct the DMA direction for management tx buffers
ext4, jbd2: ensure panic when aborting with zero errno
ARM: 8952/1: Disable kmemleak on XIP kernels
tracing: Fix very unlikely race of registering two stat tracers
tracing: Fix tracing_stat return values in error handling paths
powerpc/iov: Move VF pdev fixup into pcibios_fixup_iov()
s390/pci: Fix possible deadlock in recover_store()
pwm: omap-dmtimer: Simplify error handling
x86/sysfb: Fix check for bad VRAM size
jbd2: clear JBD2_ABORT flag before journal_reset to update log tail info when load journal
kselftest: Minimise dependency of get_size on C library interfaces
clocksource/drivers/bcm2835_timer: Fix memory leak of timer
usb: dwc2: Fix IN FIFO allocation
usb: gadget: udc: fix possible sleep-in-atomic-context bugs in gr_probe()
uio: fix a sleep-in-atomic-context bug in uio_dmem_genirq_irqcontrol()
sparc: Add .exit.data section.
MIPS: Loongson: Fix potential NULL dereference in loongson3_platform_init()
efi/x86: Map the entire EFI vendor string before copying it
pinctrl: baytrail: Do not clear IRQ flags on direct-irq enabled pins
media: sti: bdisp: fix a possible sleep-in-atomic-context bug in bdisp_device_run()
char/random: silence a lockdep splat with printk()
iommu/vt-d: Fix off-by-one in PASID allocation
gpio: gpio-grgpio: fix possible sleep-in-atomic-context bugs in grgpio_irq_map/unmap()
powerpc/powernv/iov: Ensure the pdn for VFs always contains a valid PE number
media: i2c: mt9v032: fix enum mbus codes and frame sizes
pxa168fb: Fix the function used to release some memory in an error handling path
pinctrl: sh-pfc: sh7264: Fix CAN function GPIOs
gianfar: Fix TX timestamping with a stacked DSA driver
ALSA: ctl: allow TLV read operation for callback type of element in locked case
ext4: fix ext4_dax_read/write inode locking sequence for IOCB_NOWAIT
leds: pca963x: Fix open-drain initialization
brcmfmac: Fix use after free in brcmf_sdio_readframes()
cpu/hotplug, stop_machine: Fix stop_machine vs hotplug order
drm/gma500: Fixup fbdev stolen size usage evaluation
KVM: nVMX: Use correct root level for nested EPT shadow page tables
Revert "KVM: VMX: Add non-canonical check on writes to RTIT address MSRs"
Revert "KVM: nVMX: Use correct root level for nested EPT shadow page tables"
net/sched: flower: add missing validation of TCA_FLOWER_FLAGS
net/sched: matchall: add missing validation of TCA_MATCHALL_FLAGS
net: dsa: tag_qca: Make sure there is headroom for tag
net/smc: fix leak of kernel memory to user space
enic: prevent waking up stopped tx queues over watchdog reset
core: Don't skip generic XDP program execution for cloned SKBs
ANDROID: arm64: update the abi with the new gki_defconfig
ANDROID: arm64: gki_defconfig: disable CONFIG_DEBUG_PREEMPT
ANDROID: GKI: arm64: gki_defconfig: follow-up to removing DRM_MSM driver
ANDROID: drm/msm: Remove Kconfig default
ANDROID: GKI: arm64: gki_defconfig: remove qcom,cmd-db driver
ANDROID: GKI: drivers: qcom: cmd-db: Allow compiling qcom,cmd-db driver as module
ANDROID: GKI: arm64: gki_defconfig: remove qcom,rpmh-rsc driver
ANDROID: GKI: drivers: qcom: rpmh-rsc: Add tristate support for qcom,rpmh-rsc driver
ANDROID: ufs, block: fix crypto power management and move into block layer
ANDROID: rtc: class: support hctosys from modular RTC drivers
ANDROID: Incremental fs: Support xattrs
ANDROID: abi update for 4.19.105
UPSTREAM: random: ignore GRND_RANDOM in getentropy(2)
UPSTREAM: random: add GRND_INSECURE to return best-effort non-cryptographic bytes
UPSTREAM: linux/random.h: Mark CONFIG_ARCH_RANDOM functions __must_check
UPSTREAM: linux/random.h: Use false with bool
UPSTREAM: linux/random.h: Remove arch_has_random, arch_has_random_seed
UPSTREAM: random: remove some dead code of poolinfo
UPSTREAM: random: fix typo in add_timer_randomness()
UPSTREAM: random: Add and use pr_fmt()
UPSTREAM: random: convert to ENTROPY_BITS for better code readability
UPSTREAM: random: remove unnecessary unlikely()
UPSTREAM: random: remove kernel.random.read_wakeup_threshold
UPSTREAM: random: delete code to pull data into pools
UPSTREAM: random: remove the blocking pool
UPSTREAM: random: make /dev/random be almost like /dev/urandom
UPSTREAM: random: Add a urandom_read_nowait() for random APIs that don't warn
UPSTREAM: random: Don't wake crng_init_wait when crng_init == 1
UPSTREAM: char/random: silence a lockdep splat with printk()
BACKPORT: fdt: add support for rng-seed
BACKPORT: arm64: map FDT as RW for early_init_dt_scan()
UPSTREAM: random: fix soft lockup when trying to read from an uninitialized blocking pool
UPSTREAM: random: document get_random_int() family
UPSTREAM: random: move rand_initialize() earlier
UPSTREAM: random: only read from /dev/random after its pool has received 128 bits
UPSTREAM: drivers/char/random.c: make primary_crng static
UPSTREAM: drivers/char/random.c: remove unused stuct poolinfo::poolbits
UPSTREAM: drivers/char/random.c: constify poolinfo_table
ANDROID: clang: update to 10.0.4
Linux 4.19.105
KVM: x86/mmu: Fix struct guest_walker arrays for 5-level paging
jbd2: do not clear the BH_Mapped flag when forgetting a metadata buffer
jbd2: move the clearing of b_modified flag to the journal_unmap_buffer()
NFSv4.1 make cachethis=no for writes
hwmon: (pmbus/ltc2978) Fix PMBus polling of MFR_COMMON definitions.
perf/x86/intel: Fix inaccurate period in context switch for auto-reload
s390/time: Fix clk type in get_tod_clock
RDMA/core: Fix protection fault in get_pkey_idx_qp_list
RDMA/rxe: Fix soft lockup problem due to using tasklets in softirq
RDMA/hfi1: Fix memory leak in _dev_comp_vect_mappings_create
RDMA/core: Fix invalid memory access in spec_filter_size
IB/rdmavt: Reset all QPs when the device is shut down
IB/hfi1: Close window for pq and request coliding
IB/hfi1: Acquire lock to release TID entries when user file is closed
nvme: fix the parameter order for nvme_get_log in nvme_get_fw_slot_info
perf/x86/amd: Add missing L2 misses event spec to AMD Family 17h's event map
KVM: nVMX: Use correct root level for nested EPT shadow page tables
arm64: ssbs: Fix context-switch when SSBS is present on all CPUs
ARM: npcm: Bring back GPIOLIB support
btrfs: log message when rw remount is attempted with unclean tree-log
btrfs: print message when tree-log replay starts
btrfs: ref-verify: fix memory leaks
Btrfs: fix race between using extent maps and merging them
ext4: improve explanation of a mount failure caused by a misconfigured kernel
ext4: add cond_resched() to ext4_protect_reserved_inode
ext4: fix checksum errors with indexed dirs
ext4: fix support for inode sizes > 1024 bytes
ext4: don't assume that mmp_nodename/bdevname have NUL
ALSA: usb-audio: Add clock validity quirk for Denon MC7000/MCX8000
ALSA: usb-audio: sound: usb: usb true/false for bool return type
arm64: nofpsmid: Handle TIF_FOREIGN_FPSTATE flag cleanly
arm64: cpufeature: Set the FP/SIMD compat HWCAP bits properly
ALSA: usb-audio: Apply sample rate quirk for Audioengine D1
ALSA: hda/realtek - Fix silent output on MSI-GL73
ALSA: usb-audio: Fix UAC2/3 effect unit parsing
Input: synaptics - remove the LEN0049 dmi id from topbuttonpad list
Input: synaptics - enable SMBus on ThinkPad L470
Input: synaptics - switch T470s to RMI4 by default
ANDROID: Fix ABI representation after enabling CONFIG_NET_NS
ANDROID: gki_defconfig: Enable CONFIG_NET_NS
ANDROID: gki_defconfig: Enable XDP_SOCKETS
UPSTREAM: sched/topology: Introduce a sysctl for Energy Aware Scheduling
ANDROID: gki_defconfig: Enable MAC80211_RC_MINSTREL
ANDROID: f2fs: remove unused function
ANDROID: virtio: virtio_input: pass _DIRECT only if the device advertises _DIRECT
ANDROID: cf build: Use merge_configs
ANDROID: net: bpf: Allow TC programs to call BPF_FUNC_skb_change_head
ANDROID: gki_defconfig: Disable SDCARD_FS
Linux 4.19.104
padata: fix null pointer deref of pd->pinst
serial: uartps: Move the spinlock after the read of the tx empty
x86/stackframe, x86/ftrace: Add pt_regs frame annotations
x86/stackframe: Move ENCODE_FRAME_POINTER to asm/frame.h
scsi: megaraid_sas: Do not initiate OCR if controller is not in ready state
libertas: make lbs_ibss_join_existing() return error code on rates overflow
libertas: don't exit from lbs_ibss_join_existing() with RCU read lock held
mwifiex: Fix possible buffer overflows in mwifiex_cmd_append_vsie_tlv()
mwifiex: Fix possible buffer overflows in mwifiex_ret_wmm_get_status()
pinctrl: sh-pfc: r8a7778: Fix duplicate SDSELF_B and SD1_CLK_B
media: i2c: adv748x: Fix unsafe macros
crypto: atmel-sha - fix error handling when setting hmac key
crypto: artpec6 - return correct error code for failed setkey()
mtd: sharpslpart: Fix unsigned comparison to zero
mtd: onenand_base: Adjust indentation in onenand_read_ops_nolock
KVM: arm64: pmu: Don't increment SW_INCR if PMCR.E is unset
KVM: arm: Make inject_abt32() inject an external abort instead
KVM: arm: Fix DFSR setting for non-LPAE aarch32 guests
KVM: arm/arm64: Fix young bit from mmu notifier
arm64: ptrace: nofpsimd: Fail FP/SIMD regset operations
arm64: cpufeature: Fix the type of no FP/SIMD capability
ARM: 8949/1: mm: mark free_memmap as __init
KVM: arm/arm64: vgic-its: Fix restoration of unmapped collections
iommu/arm-smmu-v3: Populate VMID field for CMDQ_OP_TLBI_NH_VA
powerpc/pseries: Allow not having ibm, hypertas-functions::hcall-multi-tce for DDW
powerpc/pseries/vio: Fix iommu_table use-after-free refcount warning
tools/power/acpi: fix compilation error
ARM: dts: at91: sama5d3: define clock rate range for tcb1
ARM: dts: at91: sama5d3: fix maximum peripheral clock rates
ARM: dts: am43xx: add support for clkout1 clock
ARM: dts: at91: Reenable UART TX pull-ups
platform/x86: intel_mid_powerbtn: Take a copy of ddata
ARC: [plat-axs10x]: Add missing multicast filter number to GMAC node
rtc: cmos: Stop using shared IRQ
rtc: hym8563: Return -EINVAL if the time is known to be invalid
spi: spi-mem: Fix inverted logic in op sanity check
spi: spi-mem: Add extra sanity checks on the op param
gpio: zynq: Report gpio direction at boot
serial: uartps: Add a timeout to the tx empty wait
NFSv4: try lease recovery on NFS4ERR_EXPIRED
NFS/pnfs: Fix pnfs_generic_prepare_to_resend_writes()
NFS: Revalidate the file size on a fatal write error
nfs: NFS_SWAP should depend on SWAP
PCI: Don't disable bridge BARs when assigning bus resources
PCI/switchtec: Fix vep_vector_number ioread width
ath10k: pci: Only dump ATH10K_MEM_REGION_TYPE_IOREG when safe
PCI/IOV: Fix memory leak in pci_iov_add_virtfn()
scsi: ufs: Fix ufshcd_probe_hba() reture value in case ufshcd_scsi_add_wlus() fails
RDMA/uverbs: Verify MR access flags
RDMA/core: Fix locking in ib_uverbs_event_read
RDMA/netlink: Do not always generate an ACK for some netlink operations
IB/mlx4: Fix memory leak in add_gid error flow
hv_sock: Remove the accept port restriction
ASoC: pcm: update FE/BE trigger order based on the command
ANDROID: gki_defconfig: Add CONFIG_UNICODE
ANDROID: added memory initialization tests to cuttlefish config
ANDROID: gki_defconfig: enable CONFIG_RUNTIME_TESTING_MENU
fs-verity: use u64_to_user_ptr()
fs-verity: use mempool for hash requests
fs-verity: implement readahead of Merkle tree pages
fs-verity: implement readahead for FS_IOC_ENABLE_VERITY
fscrypt: improve format of no-key names
ubifs: allow both hash and disk name to be provided in no-key names
ubifs: don't trigger assertion on invalid no-key filename
fscrypt: clarify what is meant by a per-file key
fscrypt: derive dirhash key for casefolded directories
fscrypt: don't allow v1 policies with casefolding
fscrypt: add "fscrypt_" prefix to fname_encrypt()
fscrypt: don't print name of busy file when removing key
fscrypt: document gfp_flags for bounce page allocation
fscrypt: optimize fscrypt_zeroout_range()
fscrypt: remove redundant bi_status check
fscrypt: Allow modular crypto algorithms
FROMLIST: rename missed uaccess .fixup section
ANDROID: f2fs: fix missing blk-crypto changes
ANDROID: gki_defconfig: enable heap and stack initialization.
UPSTREAM: lib/test_stackinit: Handle Clang auto-initialization pattern
UPSTREAM: lib: Introduce test_stackinit module
fscrypt: include <linux/ioctl.h> in UAPI header
fscrypt: don't check for ENOKEY from fscrypt_get_encryption_info()
fscrypt: remove fscrypt_is_direct_key_policy()
fscrypt: move fscrypt_valid_enc_modes() to policy.c
fscrypt: check for appropriate use of DIRECT_KEY flag earlier
fscrypt: split up fscrypt_supported_policy() by policy version
fscrypt: introduce fscrypt_needs_contents_encryption()
fscrypt: move fscrypt_d_revalidate() to fname.c
fscrypt: constify inode parameter to filename encryption functions
fscrypt: constify struct fscrypt_hkdf parameter to fscrypt_hkdf_expand()
fscrypt: verify that the crypto_skcipher has the correct ivsize
fscrypt: use crypto_skcipher_driver_name()
fscrypt: support passing a keyring key to FS_IOC_ADD_ENCRYPTION_KEY
keys: Export lookup_user_key to external users
UPSTREAM: dynamic_debug: allow to work if debugfs is disabled
UPSTREAM: lib: dynamic_debug: no need to check return value of debugfs_create functions
ANDROID: ABI/Whitelist: update for Cuttlefish
ANDROID: update ABI representation and GKI whitelist
ANDROID: gki_defconfig: Set CONFIG_ANDROID_BINDERFS=y
Linux 4.19.103
rxrpc: Fix service call disconnection
perf/core: Fix mlock accounting in perf_mmap()
clocksource: Prevent double add_timer_on() for watchdog_timer
x86/apic/msi: Plug non-maskable MSI affinity race
cifs: fail i/o on soft mounts if sessionsetup errors out
mm/page_alloc.c: fix uninitialized memmaps on a partially populated last section
mm: return zero_resv_unavail optimization
mm: zero remaining unavailable struct pages
KVM: Play nice with read-only memslots when querying host page size
KVM: Use vcpu-specific gva->hva translation when querying host page size
KVM: nVMX: vmread should not set rflags to specify success in case of #PF
KVM: VMX: Add non-canonical check on writes to RTIT address MSRs
KVM: x86: Use gpa_t for cr2/gpa to fix TDP support on 32-bit KVM
KVM: x86/mmu: Apply max PA check for MMIO sptes to 32-bit KVM
btrfs: flush write bio if we loop in extent_write_cache_pages
drm/dp_mst: Remove VCPI while disabling topology mgr
drm: atmel-hlcdc: enable clock before configuring timing engine
btrfs: free block groups after free'ing fs trees
btrfs: use bool argument in free_root_pointers()
ext4: fix deadlock allocating crypto bounce page from mempool
net: dsa: b53: Always use dev->vlan_enabled in b53_configure_vlan()
net: macb: Limit maximum GEM TX length in TSO
net: macb: Remove unnecessary alignment check for TSO
net/mlx5: IPsec, fix memory leak at mlx5_fpga_ipsec_delete_sa_ctx
net/mlx5: IPsec, Fix esp modify function attribute
net: systemport: Avoid RBUF stuck in Wake-on-LAN mode
net_sched: fix a resource leak in tcindex_set_parms()
net: mvneta: move rx_dropped and rx_errors in per-cpu stats
net: dsa: bcm_sf2: Only 7278 supports 2Gb/sec IMP port
bonding/alb: properly access headers in bond_alb_xmit()
mfd: rn5t618: Mark ADC control register volatile
mfd: da9062: Fix watchdog compatible string
ubi: Fix an error pointer dereference in error handling code
ubi: fastmap: Fix inverted logic in seen selfcheck
nfsd: Return the correct number of bytes written to the file
nfsd: fix jiffies/time_t mixup in LRU list
nfsd: fix delay timer on 32-bit architectures
IB/core: Fix ODP get user pages flow
IB/mlx5: Fix outstanding_pi index for GSI qps
net: tulip: Adjust indentation in {dmfe, uli526x}_init_module
net: smc911x: Adjust indentation in smc911x_phy_configure
ppp: Adjust indentation into ppp_async_input
NFC: pn544: Adjust indentation in pn544_hci_check_presence
drm: msm: mdp4: Adjust indentation in mdp4_dsi_encoder_enable
powerpc/44x: Adjust indentation in ibm4xx_denali_fixup_memsize
ext2: Adjust indentation in ext2_fill_super
phy: qualcomm: Adjust indentation in read_poll_timeout
scsi: ufs: Recheck bkops level if bkops is disabled
scsi: qla4xxx: Adjust indentation in qla4xxx_mem_free
scsi: csiostor: Adjust indentation in csio_device_reset
scsi: qla2xxx: Fix the endianness of the qla82xx_get_fw_size() return type
percpu: Separate decrypted varaibles anytime encryption can be enabled
drm/amd/dm/mst: Ignore payload update failures
clk: tegra: Mark fuse clock as critical
KVM: s390: do not clobber registers during guest reset/store status
KVM: x86: Free wbinvd_dirty_mask if vCPU creation fails
KVM: x86: Don't let userspace set host-reserved cr4 bits
x86/kvm: Be careful not to clear KVM_VCPU_FLUSH_TLB bit
KVM: PPC: Book3S PR: Free shared page if mmu initialization fails
KVM: PPC: Book3S HV: Uninit vCPU if vcore creation fails
KVM: x86: Fix potential put_fpu() w/o load_fpu() on MPX platform
KVM: x86: Protect MSR-based index computations in fixed_msr_to_seg_unit() from Spectre-v1/L1TF attacks
KVM: x86: Protect x86_decode_insn from Spectre-v1/L1TF attacks
KVM: x86: Protect MSR-based index computations from Spectre-v1/L1TF attacks in x86.c
KVM: x86: Protect ioapic_read_indirect() from Spectre-v1/L1TF attacks
KVM: x86: Protect MSR-based index computations in pmu.h from Spectre-v1/L1TF attacks
KVM: x86: Protect ioapic_write_indirect() from Spectre-v1/L1TF attacks
KVM: x86: Protect kvm_hv_msr_[get|set]_crash_data() from Spectre-v1/L1TF attacks
KVM: x86: Protect kvm_lapic_reg_write() from Spectre-v1/L1TF attacks
KVM: x86: Protect DR-based index computations from Spectre-v1/L1TF attacks
KVM: x86: Protect pmu_intel.c from Spectre-v1/L1TF attacks
KVM: x86: Refactor prefix decoding to prevent Spectre-v1/L1TF attacks
KVM: x86: Refactor picdev_write() to prevent Spectre-v1/L1TF attacks
aio: prevent potential eventfd recursion on poll
eventfd: track eventfd_signal() recursion depth
bcache: add readahead cache policy options via sysfs interface
watchdog: fix UAF in reboot notifier handling in watchdog core code
xen/balloon: Support xend-based toolstack take two
tools/kvm_stat: Fix kvm_exit filter name
media: rc: ensure lirc is initialized before registering input device
drm/rect: Avoid division by zero
gfs2: fix O_SYNC write handling
gfs2: move setting current->backing_dev_info
sunrpc: expiry_time should be seconds not timeval
mwifiex: fix unbalanced locking in mwifiex_process_country_ie()
iwlwifi: don't throw error when trying to remove IGTK
ARM: tegra: Enable PLLP bypass during Tegra124 LP1
Btrfs: fix race between adding and putting tree mod seq elements and nodes
btrfs: set trans->drity in btrfs_commit_transaction
Btrfs: fix missing hole after hole punching and fsync when using NO_HOLES
jbd2_seq_info_next should increase position index
NFS: Directory page cache pages need to be locked when read
NFS: Fix memory leaks and corruption in readdir
scsi: qla2xxx: Fix unbound NVME response length
crypto: picoxcell - adjust the position of tasklet_init and fix missed tasklet_kill
crypto: api - Fix race condition in crypto_spawn_alg
crypto: atmel-aes - Fix counter overflow in CTR mode
crypto: pcrypt - Do not clear MAY_SLEEP flag in original request
crypto: ccp - set max RSA modulus size for v3 platform devices as well
samples/bpf: Don't try to remove user's homedir on clean
ftrace: Protect ftrace_graph_hash with ftrace_sync
ftrace: Add comment to why rcu_dereference_sched() is open coded
tracing: Annotate ftrace_graph_notrace_hash pointer with __rcu
tracing: Annotate ftrace_graph_hash pointer with __rcu
padata: Remove broken queue flushing
dm writecache: fix incorrect flush sequence when doing SSD mode commit
dm: fix potential for q->make_request_fn NULL pointer
dm crypt: fix benbi IV constructor crash if used in authenticated mode
dm space map common: fix to ensure new block isn't already in use
dm zoned: support zone sizes smaller than 128MiB
of: Add OF_DMA_DEFAULT_COHERENT & select it on powerpc
PM: core: Fix handling of devices deleted during system-wide resume
f2fs: code cleanup for f2fs_statfs_project()
f2fs: fix miscounted block limit in f2fs_statfs_project()
f2fs: choose hardlimit when softlimit is larger than hardlimit in f2fs_statfs_project()
ovl: fix wrong WARN_ON() in ovl_cache_update_ino()
power: supply: ltc2941-battery-gauge: fix use-after-free
scsi: qla2xxx: Fix mtcp dump collection failure
scripts/find-unused-docs: Fix massive false positives
crypto: ccree - fix PM race condition
crypto: ccree - fix pm wrongful error reporting
crypto: ccree - fix backlog memory leak
crypto: api - Check spawn->alg under lock in crypto_drop_spawn
mfd: axp20x: Mark AXP20X_VBUS_IPSOUT_MGMT as volatile
hv_balloon: Balloon up according to request page number
mmc: sdhci-of-at91: fix memleak on clk_get failure
PCI: keystone: Fix link training retries initiation
crypto: geode-aes - convert to skcipher API and make thread-safe
ubifs: Fix deadlock in concurrent bulk-read and writepage
ubifs: Fix FS_IOC_SETFLAGS unexpectedly clearing encrypt flag
ubifs: don't trigger assertion on invalid no-key filename
ubifs: Reject unsupported ioctl flags explicitly
alarmtimer: Unregister wakeup source when module get fails
ACPI / battery: Deal better with neither design nor full capacity not being reported
ACPI / battery: Use design-cap for capacity calculations if full-cap is not available
ACPI / battery: Deal with design or full capacity being reported as -1
ACPI: video: Do not export a non working backlight interface on MSI MS-7721 boards
mmc: spi: Toggle SPI polarity, do not hardcode it
PCI: tegra: Fix return value check of pm_runtime_get_sync()
smb3: fix signing verification of large reads
powerpc/pseries: Advance pfn if section is not present in lmb_is_removable()
powerpc/xmon: don't access ASDR in VMs
s390/mm: fix dynamic pagetable upgrade for hugetlbfs
MIPS: boot: fix typo in 'vmlinux.lzma.its' target
MIPS: fix indentation of the 'RELOCS' message
KVM: arm64: Only sign-extend MMIO up to register width
KVM: arm/arm64: Correct AArch32 SPSR on exception entry
KVM: arm/arm64: Correct CPSR on exception entry
KVM: arm64: Correct PSTATE on exception entry
ALSA: hda: Add Clevo W65_67SB the power_save blacklist
platform/x86: intel_scu_ipc: Fix interrupt support
irqdomain: Fix a memory leak in irq_domain_push_irq()
lib/test_kasan.c: fix memory leak in kmalloc_oob_krealloc_more()
media: v4l2-rect.h: fix v4l2_rect_map_inside() top/left adjustments
media: v4l2-core: compat: ignore native command codes
media/v4l2-core: set pages dirty upon releasing DMA buffers
mm: move_pages: report the number of non-attempted pages
mm/memory_hotplug: fix remove_memory() lockdep splat
ALSA: dummy: Fix PCM format loop in proc output
ALSA: usb-audio: Fix endianess in descriptor validation
usb: gadget: f_ecm: Use atomic_t to track in-flight request
usb: gadget: f_ncm: Use atomic_t to track in-flight request
usb: gadget: legacy: set max_speed to super-speed
usb: typec: tcpci: mask event interrupts when remove driver
brcmfmac: Fix memory leak in brcmf_usbdev_qinit
rcu: Avoid data-race in rcu_gp_fqs_check_wake()
tracing: Fix sched switch start/stop refcount racy updates
ipc/msg.c: consolidate all xxxctl_down() functions
mfd: dln2: More sanity checking for endpoints
media: uvcvideo: Avoid cyclic entity chains due to malformed USB descriptors
rxrpc: Fix NULL pointer deref due to call->conn being cleared on disconnect
rxrpc: Fix missing active use pinning of rxrpc_local object
rxrpc: Fix insufficient receive notification generation
rxrpc: Fix use-after-free in rxrpc_put_local()
tcp: clear tp->segs_{in|out} in tcp_disconnect()
tcp: clear tp->data_segs{in|out} in tcp_disconnect()
tcp: clear tp->delivered in tcp_disconnect()
tcp: clear tp->total_retrans in tcp_disconnect()
bnxt_en: Fix TC queue mapping.
net: stmmac: Delete txtimer in suspend()
net_sched: fix an OOB access in cls_tcindex
net: hsr: fix possible NULL deref in hsr_handle_frame()
l2tp: Allow duplicate session creation with UDP
gtp: use __GFP_NOWARN to avoid memalloc warning
cls_rsvp: fix rsvp_policy
sparc32: fix struct ipc64_perm type definition
iwlwifi: mvm: fix NVM check for 3168 devices
printk: fix exclusive_console replaying
udf: Allow writing to 'Rewritable' partitions
x86/cpu: Update cached HLE state on write to TSX_CTRL_CPUID_CLEAR
ocfs2: fix oops when writing cloned file
media: iguanair: fix endpoint sanity check
kernel/module: Fix memleak in module_add_modinfo_attrs()
ovl: fix lseek overflow on 32bit
Revert "drm/sun4i: dsi: Change the start delay calculation"
ANDROID: Revert "ANDROID: gki_defconfig: removed CONFIG_PM_WAKELOCKS"
ANDROID: dm: prevent default-key from being enabled without needed hooks
ANDROID: gki: x86: Enable PCI_MSI, WATCHDOG, HPET
ANDROID: Incremental fs: Fix crash on failed lookup
ANDROID: Incremental fs: Make files writeable
ANDROID: update abi for 4.19.102
ANDROID: Incremental fs: Remove C++-style comments
Linux 4.19.102
mm/migrate.c: also overwrite error when it is bigger than zero
perf report: Fix no libunwind compiled warning break s390 issue
btrfs: do not zero f_bavail if we have available space
net: Fix skb->csum update in inet_proto_csum_replace16().
l2t_seq_next should increase position index
seq_tab_next() should increase position index
net: fsl/fman: rename IF_MODE_XGMII to IF_MODE_10G
net/fsl: treat fsl,erratum-a011043
powerpc/fsl/dts: add fsl,erratum-a011043
qlcnic: Fix CPU soft lockup while collecting firmware dump
ARM: dts: am43x-epos-evm: set data pin directions for spi0 and spi1
r8152: get default setting of WOL before initializing
airo: Add missing CAP_NET_ADMIN check in AIROOLDIOCTL/SIOCDEVPRIVATE
airo: Fix possible info leak in AIROOLDIOCTL/SIOCDEVPRIVATE
tee: optee: Fix compilation issue with nommu
ARM: 8955/1: virt: Relax arch timer version check during early boot
scsi: fnic: do not queue commands during fwreset
xfrm: interface: do not confirm neighbor when do pmtu update
xfrm interface: fix packet tx through bpf_redirect()
vti[6]: fix packet tx through bpf_redirect()
ARM: dts: am335x-boneblack-common: fix memory size
iwlwifi: Don't ignore the cap field upon mcc update
riscv: delete temporary files
bnxt_en: Fix ipv6 RFS filter matching logic.
net: dsa: bcm_sf2: Configure IMP port for 2Gb/sec
netfilter: nft_tunnel: ERSPAN_VERSION must not be null
wireless: wext: avoid gcc -O3 warning
mac80211: Fix TKIP replay protection immediately after key setup
cfg80211: Fix radar event during another phy CAC
wireless: fix enabling channel 12 for custom regulatory domain
parisc: Use proper printk format for resource_size_t
qmi_wwan: Add support for Quectel RM500Q
ASoC: sti: fix possible sleep-in-atomic
platform/x86: GPD pocket fan: Allow somewhat lower/higher temperature limits
igb: Fix SGMII SFP module discovery for 100FX/LX.
ixgbe: Fix calculation of queue with VFs and flow director on interface flap
ixgbevf: Remove limit of 10 entries for unicast filter list
ASoC: rt5640: Fix NULL dereference on module unload
clk: mmp2: Fix the order of timer mux parents
mac80211: mesh: restrict airtime metric to peered established plinks
clk: sunxi-ng: h6-r: Fix AR100/R_APB2 parent order
rseq: Unregister rseq for clone CLONE_VM
tools lib traceevent: Fix memory leakage in filter_event
soc: ti: wkup_m3_ipc: Fix race condition with rproc_boot
ARM: dts: beagle-x15-common: Model 5V0 regulator
ARM: dts: am57xx-beagle-x15/am57xx-idk: Remove "gpios" for endpoint dt nodes
ARM: dts: sun8i: a83t: Correct USB3503 GPIOs polarity
media: si470x-i2c: Move free() past last use of 'radio'
cgroup: Prevent double killing of css when enabling threaded cgroup
Bluetooth: Fix race condition in hci_release_sock()
ttyprintk: fix a potential deadlock in interrupt context issue
tomoyo: Use atomic_t for statistics counter
media: dvb-usb/dvb-usb-urb.c: initialize actlen to 0
media: gspca: zero usb_buf
media: vp7045: do not read uninitialized values if usb transfer fails
media: af9005: uninitialized variable printked
media: digitv: don't continue if remote control state can't be read
reiserfs: Fix memory leak of journal device string
mm/mempolicy.c: fix out of bounds write in mpol_parse_str()
ext4: validate the debug_want_extra_isize mount option at parse time
arm64: kbuild: remove compressed images on 'make ARCH=arm64 (dist)clean'
tools lib: Fix builds when glibc contains strlcpy()
PM / devfreq: Add new name attribute for sysfs
perf c2c: Fix return type for histogram sorting comparision functions
rsi: fix use-after-free on failed probe and unbind
rsi: add hci detach for hibernation and poweroff
crypto: pcrypt - Fix user-after-free on module unload
x86/resctrl: Fix a deadlock due to inaccurate reference
x86/resctrl: Fix use-after-free due to inaccurate refcount of rdtgroup
x86/resctrl: Fix use-after-free when deleting resource groups
vfs: fix do_last() regression
ANDROID: update abi definitions
BACKPORT: clk: core: clarify the check for runtime PM
UPSTREAM: sched/fair/util_est: Implement faster ramp-up EWMA on utilization increases
ANDROID: Re-use SUGOV_RT_MAX_FREQ to control uclamp rt behavior
BACKPORT: sched/fair: Make EAS wakeup placement consider uclamp restrictions
BACKPORT: sched/fair: Make task_fits_capacity() consider uclamp restrictions
ANDROID: sched/core: Move SchedTune task API into UtilClamp wrappers
ANDROID: sched/core: Add a latency-sensitive flag to uclamp
ANDROID: sched/tune: Move SchedTune cpu API into UtilClamp wrappers
ANDROID: init: kconfig: Only allow sched tune if !uclamp
FROMGIT: sched/core: Fix size of rq::uclamp initialization
FROMGIT: sched/uclamp: Fix a bug in propagating uclamp value in new cgroups
FROMGIT: sched/uclamp: Rename uclamp_util_with() into uclamp_rq_util_with()
FROMGIT: sched/uclamp: Make uclamp util helpers use and return UL values
FROMGIT: sched/uclamp: Remove uclamp_util()
BACKPORT: sched/rt: Make RT capacity-aware
UPSTREAM: tools headers UAPI: Sync sched.h with the kernel
UPSTREAM: sched/uclamp: Fix overzealous type replacement
UPSTREAM: sched/uclamp: Fix incorrect condition
UPSTREAM: sched/core: Fix compilation error when cgroup not selected
UPSTREAM: sched/core: Fix uclamp ABI bug, clean up and robustify sched_read_attr() ABI logic and code
UPSTREAM: sched/uclamp: Always use 'enum uclamp_id' for clamp_id values
UPSTREAM: sched/uclamp: Update CPU's refcount on TG's clamp changes
UPSTREAM: sched/uclamp: Use TG's clamps to restrict TASK's clamps
UPSTREAM: sched/uclamp: Propagate system defaults to the root group
UPSTREAM: sched/uclamp: Propagate parent clamps
UPSTREAM: sched/uclamp: Extend CPU's cgroup controller
BACKPORT: sched/uclamp: Add uclamp support to energy_compute()
UPSTREAM: sched/uclamp: Add uclamp_util_with()
BACKPORT: sched/cpufreq, sched/uclamp: Add clamps for FAIR and RT tasks
UPSTREAM: sched/uclamp: Set default clamps for RT tasks
UPSTREAM: sched/uclamp: Reset uclamp values on RESET_ON_FORK
UPSTREAM: sched/uclamp: Extend sched_setattr() to support utilization clamping
UPSTREAM: sched/core: Allow sched_setattr() to use the current policy
UPSTREAM: sched/uclamp: Add system default clamps
UPSTREAM: sched/uclamp: Enforce last task's UCLAMP_MAX
UPSTREAM: sched/uclamp: Add bucket local max tracking
UPSTREAM: sched/uclamp: Add CPU's clamp buckets refcounting
UPSTREAM: cgroup: add cgroup_parse_float()
Linux 4.19.101
KVM: arm64: Write arch.mdcr_el2 changes since last vcpu_load on VHE
block: fix 32 bit overflow in __blkdev_issue_discard()
block: cleanup __blkdev_issue_discard()
random: try to actively add entropy rather than passively wait for it
crypto: af_alg - Use bh_lock_sock in sk_destruct
rsi: fix non-atomic allocation in completion handler
rsi: fix memory leak on failed URB submission
rsi: fix use-after-free on probe errors
sched/fair: Fix insertion in rq->leaf_cfs_rq_list
sched/fair: Add tmp_alone_branch assertion
usb-storage: Disable UAS on JMicron SATA enclosure
ARM: OMAP2+: SmartReflex: add omap_sr_pdata definition
iommu/amd: Support multiple PCI DMA aliases in IRQ Remapping
PCI: Add DMA alias quirk for Intel VCA NTB
platform/x86: dell-laptop: disable kbd backlight on Inspiron 10xx
HID: steam: Fix input device disappearing
atm: eni: fix uninitialized variable warning
gpio: max77620: Add missing dependency on GPIOLIB_IRQCHIP
net: wan: sdla: Fix cast from pointer to integer of different size
drivers/net/b44: Change to non-atomic bit operations on pwol_mask
spi: spi-dw: Add lock protect dw_spi rx/tx to prevent concurrent calls
watchdog: rn5t618_wdt: fix module aliases
watchdog: max77620_wdt: fix potential build errors
phy: cpcap-usb: Prevent USB line glitches from waking up modem
phy: qcom-qmp: Increase PHY ready timeout
drivers/hid/hid-multitouch.c: fix a possible null pointer access.
HID: Add quirk for incorrect input length on Lenovo Y720
HID: ite: Add USB id match for Acer SW5-012 keyboard dock
HID: Add quirk for Xin-Mo Dual Controller
arc: eznps: fix allmodconfig kconfig warning
HID: multitouch: Add LG MELF0410 I2C touchscreen support
net_sched: fix ops->bind_class() implementations
net_sched: ematch: reject invalid TCF_EM_SIMPLE
zd1211rw: fix storage endpoint lookup
rtl8xxxu: fix interface sanity check
brcmfmac: fix interface sanity check
ath9k: fix storage endpoint lookup
cifs: Fix memory allocation in __smb2_handle_cancelled_cmd()
crypto: chelsio - fix writing tfm flags to wrong place
iio: st_gyro: Correct data for LSM9DS0 gyro
mei: me: add comet point (lake) H device ids
component: do not dereference opaque pointer in debugfs
serial: 8250_bcm2835aux: Fix line mismatch on driver unbind
staging: vt6656: Fix false Tx excessive retries reporting.
staging: vt6656: use NULLFUCTION stack on mac80211
staging: vt6656: correct packet types for CTS protect, mode.
staging: wlan-ng: ensure error return is actually returned
staging: most: net: fix buffer overflow
usb: dwc3: turn off VBUS when leaving host mode
USB: serial: ir-usb: fix IrLAP framing
USB: serial: ir-usb: fix link-speed handling
USB: serial: ir-usb: add missing endpoint sanity check
usb: dwc3: pci: add ID for the Intel Comet Lake -V variant
rsi_91x_usb: fix interface sanity check
orinoco_usb: fix interface sanity check
ANDROID: gki: Removed cf modules from gki_defconfig
ANDROID: Remove default y for VIRTIO_PCI_LEGACY
ANDROID: gki_defconfig: Remove SND_8X0
ANDROID: gki: Fixed some typos in Kconfig.gki
ANDROID: modularize BLK_MQ_VIRTIO
ANDROID: kallsyms: strip hashes from function names with ThinLTO
ANDROID: Incremental fs: Remove unneeded compatibility typedef
ANDROID: Incremental fs: Enable incrementalfs in GKI
ANDROID: Incremental fs: Fix sparse errors
ANDROID: Fixing incremental fs style issues
ANDROID: Make incfs selftests pass
ANDROID: Initial commit of Incremental FS
ANDROID: gki_defconfig: Enable req modules in GKI
ANDROID: gki_defconfig: Set IKHEADERS back to =y
UPSTREAM: UAPI: ndctl: Remove use of PAGE_SIZE
Linux 4.19.100
mm/memory_hotplug: shrink zones when offlining memory
mm/memory_hotplug: fix try_offline_node()
mm/memunmap: don't access uninitialized memmap in memunmap_pages()
drivers/base/node.c: simplify unregister_memory_block_under_nodes()
mm/hotplug: kill is_dev_zone() usage in __remove_pages()
mm/memory_hotplug: remove "zone" parameter from sparse_remove_one_section
mm/memory_hotplug: make unregister_memory_block_under_nodes() never fail
mm/memory_hotplug: remove memory block devices before arch_remove_memory()
mm/memory_hotplug: create memory block devices after arch_add_memory()
drivers/base/memory: pass a block_id to init_memory_block()
mm/memory_hotplug: allow arch_remove_memory() without CONFIG_MEMORY_HOTREMOVE
s390x/mm: implement arch_remove_memory()
mm/memory_hotplug: make __remove_pages() and arch_remove_memory() never fail
powerpc/mm: Fix section mismatch warning
mm/memory_hotplug: make __remove_section() never fail
mm/memory_hotplug: make unregister_memory_section() never fail
mm, memory_hotplug: update a comment in unregister_memory()
drivers/base/memory.c: clean up relics in function parameters
mm/memory_hotplug: release memory resource after arch_remove_memory()
mm, memory_hotplug: add nid parameter to arch_remove_memory
drivers/base/memory.c: remove an unnecessary check on NR_MEM_SECTIONS
mm, sparse: pass nid instead of pgdat to sparse_add_one_section()
mm, sparse: drop pgdat_resize_lock in sparse_add/remove_one_section()
mm/memory_hotplug: make remove_memory() take the device_hotplug_lock
net/x25: fix nonblocking connect
netfilter: nf_tables: add __nft_chain_type_get()
netfilter: ipset: use bitmap infrastructure completely
scsi: iscsi: Avoid potential deadlock in iscsi_if_rx func
media: v4l2-ioctl.c: zero reserved fields for S/TRY_FMT
libertas: Fix two buffer overflows at parsing bss descriptor
coresight: tmc-etf: Do not call smp_processor_id from preemptible
coresight: etb10: Do not call smp_processor_id from preemptible
crypto: geode-aes - switch to skcipher for cbc(aes) fallback
sd: Fix REQ_OP_ZONE_REPORT completion handling
tracing: Fix histogram code when expression has same var as value
tracing: Remove open-coding of hist trigger var_ref management
tracing: Use hist trigger's var_ref array to destroy var_refs
net/sonic: Prevent tx watchdog timeout
net/sonic: Fix CAM initialization
net/sonic: Fix command register usage
net/sonic: Quiesce SONIC before re-initializing descriptor memory
net/sonic: Fix receive buffer replenishment
net/sonic: Improve receive descriptor status flag check
net/sonic: Avoid needless receive descriptor EOL flag updates
net/sonic: Fix receive buffer handling
net/sonic: Fix interface error stats collection
net/sonic: Use MMIO accessors
net/sonic: Clear interrupt flags immediately
net/sonic: Add mutual exclusion for accessing shared state
do_last(): fetch directory ->i_mode and ->i_uid before it's too late
tracing: xen: Ordered comparison of function pointers
scsi: RDMA/isert: Fix a recently introduced regression related to logout
hwmon: (nct7802) Fix voltage limits to wrong registers
netfilter: nft_osf: add missing check for DREG attribute
Input: sun4i-ts - add a check for devm_thermal_zone_of_sensor_register
Input: pegasus_notetaker - fix endpoint sanity check
Input: aiptek - fix endpoint sanity check
Input: gtco - fix endpoint sanity check
Input: sur40 - fix interface sanity checks
Input: pm8xxx-vib - fix handling of separate enable register
Documentation: Document arm64 kpti control
mmc: sdhci: fix minimum clock rate for v3 controller
mmc: tegra: fix SDR50 tuning override
ARM: 8950/1: ftrace/recordmcount: filter relocation types
Revert "Input: synaptics-rmi4 - don't increment rmiaddr for SMBus transfers"
Input: keyspan-remote - fix control-message timeouts
tracing: trigger: Replace unneeded RCU-list traversals
PCI: Mark AMD Navi14 GPU rev 0xc5 ATS as broken
hwmon: (core) Do not use device managed functions for memory allocations
hwmon: (adt7475) Make volt2reg return same reg as reg2volt input
afs: Fix characters allowed into cell names
tun: add mutex_unlock() call and napi.skb clearing in tun_get_user()
tcp: do not leave dangling pointers in tp->highest_sack
tcp_bbr: improve arithmetic division in bbr_update_bw()
Revert "udp: do rmem bulk free even if the rx sk queue is empty"
net: usb: lan78xx: Add .ndo_features_check
net-sysfs: Fix reference count leak
net-sysfs: Call dev_hold always in rx_queue_add_kobject
net-sysfs: Call dev_hold always in netdev_queue_add_kobject
net-sysfs: fix netdev_queue_add_kobject() breakage
net-sysfs: Fix reference count leak in rx|netdev_queue_add_kobject
net_sched: fix datalen for ematch
net: rtnetlink: validate IFLA_MTU attribute in rtnl_create_link()
net, ip_tunnel: fix namespaces move
net, ip6_tunnel: fix namespaces move
net: ip6_gre: fix moving ip6gre between namespaces
net: cxgb3_main: Add CAP_NET_ADMIN check to CHELSIO_GET_MEM
net: bcmgenet: Use netif_tx_napi_add() for TX NAPI
ipv6: sr: remove SKB_GSO_IPXIP6 on End.D* actions
gtp: make sure only SOCK_DGRAM UDP sockets are accepted
firestream: fix memory leaks
can, slip: Protect tty->disc_data in write_wakeup and close with RCU
ANDROID: update abi definitions
UPSTREAM: staging: most: net: fix buffer overflow
ANDROID: gki_defconfig: Enable CONFIG_BTT
ANDROID: gki_defconfig: Temporarily disable CFI
f2fs: fix race conditions in ->d_compare() and ->d_hash()
f2fs: fix dcache lookup of !casefolded directories
f2fs: Add f2fs stats to sysfs
f2fs: delete duplicate information on sysfs nodes
f2fs: change to use rwsem for gc_mutex
f2fs: update f2fs document regarding to fsync_mode
f2fs: add a way to turn off ipu bio cache
f2fs: code cleanup for f2fs_statfs_project()
f2fs: fix miscounted block limit in f2fs_statfs_project()
f2fs: show the CP_PAUSE reason in checkpoint traces
f2fs: fix deadlock allocating bio_post_read_ctx from mempool
f2fs: remove unneeded check for error allocating bio_post_read_ctx
f2fs: convert inline_dir early before starting rename
f2fs: fix memleak of kobject
f2fs: fix to add swap extent correctly
mm: export add_swap_extent()
f2fs: run fsck when getting bad inode during GC
f2fs: support data compression
f2fs: free sysfs kobject
f2fs: declare nested quota_sem and remove unnecessary sems
f2fs: don't put new_page twice in f2fs_rename
f2fs: set I_LINKABLE early to avoid wrong access by vfs
f2fs: don't keep META_MAPPING pages used for moving verity file blocks
f2fs: introduce private bioset
f2fs: cleanup duplicate stats for atomic files
f2fs: set GFP_NOFS when moving inline dentries
f2fs: should avoid recursive filesystem ops
f2fs: keep quota data on write_begin failure
f2fs: call f2fs_balance_fs outside of locked page
f2fs: preallocate DIO blocks when forcing buffered_io
Linux 4.19.99
m68k: Call timer_interrupt() with interrupts disabled
arm64: dts: meson-gxm-khadas-vim2: fix uart_A bluetooth node
serial: stm32: fix clearing interrupt error flags
IB/iser: Fix dma_nents type definition
usb: dwc3: Allow building USB_DWC3_QCOM without EXTCON
samples/bpf: Fix broken xdp_rxq_info due to map order assumptions
arm64: dts: juno: Fix UART frequency
drm/radeon: fix bad DMA from INTERRUPT_CNTL2
dmaengine: ti: edma: fix missed failure handling
afs: Remove set but not used variables 'before', 'after'
affs: fix a memory leak in affs_remount
mmc: core: fix wl1251 sdio quirks
mmc: sdio: fix wl1251 vendor id
i2c: stm32f7: report dma error during probe
packet: fix data-race in fanout_flow_is_huge()
net: neigh: use long type to store jiffies delta
hv_netvsc: flag software created hash value
MIPS: Loongson: Fix return value of loongson_hwmon_init
dpaa_eth: avoid timestamp read on error paths
dpaa_eth: perform DMA unmapping before read
hwrng: omap3-rom - Fix missing clock by probing with device tree
drm: panel-lvds: Potential Oops in probe error handling
afs: Fix large file support
hv_netvsc: Fix send_table offset in case of a host bug
hv_netvsc: Fix offset usage in netvsc_send_table()
net: qca_spi: Move reset_count to struct qcaspi
afs: Fix missing timeout reset
bpf, offload: Unlock on error in bpf_offload_dev_create()
xsk: Fix registration of Rx-only sockets
net: netem: correct the parent's backlog when corrupted packet was dropped
net: netem: fix error path for corrupted GSO frames
arm64: hibernate: check pgd table allocation
firmware: dmi: Fix unlikely out-of-bounds read in save_mem_devices
dmaengine: imx-sdma: fix size check for sdma script_number
vhost/test: stop device before reset
drm/msm/dsi: Implement reset correctly
net/smc: receive pending data after RCV_SHUTDOWN
net/smc: receive returns without data
tcp: annotate lockless access to tcp_memory_pressure
net: add {READ|WRITE}_ONCE() annotations on ->rskq_accept_head
net: avoid possible false sharing in sk_leave_memory_pressure()
act_mirred: Fix mirred_init_module error handling
s390/qeth: Fix initialization of vnicc cmd masks during set online
s390/qeth: Fix error handling during VNICC initialization
sctp: add chunks to sk_backlog when the newsk sk_socket is not set
net: stmmac: fix disabling flexible PPS output
net: stmmac: fix length of PTP clock's name string
ip6erspan: remove the incorrect mtu limit for ip6erspan
llc: fix sk_buff refcounting in llc_conn_state_process()
llc: fix another potential sk_buff leak in llc_ui_sendmsg()
mac80211: accept deauth frames in IBSS mode
rxrpc: Fix trace-after-put looking at the put connection record
net: stmmac: gmac4+: Not all Unicast addresses may be available
nvme: retain split access workaround for capability reads
net: sched: cbs: Avoid division by zero when calculating the port rate
net: ethernet: stmmac: Fix signedness bug in ipq806x_gmac_of_parse()
net: nixge: Fix a signedness bug in nixge_probe()
of: mdio: Fix a signedness bug in of_phy_get_and_connect()
net: axienet: fix a signedness bug in probe
net: stmmac: dwmac-meson8b: Fix signedness bug in probe
net: socionext: Fix a signedness bug in ave_probe()
net: netsec: Fix signedness bug in netsec_probe()
net: broadcom/bcmsysport: Fix signedness in bcm_sysport_probe()
net: hisilicon: Fix signedness bug in hix5hd2_dev_probe()
cxgb4: Signedness bug in init_one()
net: aquantia: Fix aq_vec_isr_legacy() return value
iommu/amd: Wait for completion of IOTLB flush in attach_device
crypto: hisilicon - Matching the dma address for dma_pool_free()
bpf: fix BTF limits
powerpc/mm/mce: Keep irqs disabled during lockless page table walk
clk: actions: Fix factor clk struct member access
mailbox: qcom-apcs: fix max_register value
f2fs: fix to avoid accessing uninitialized field of inode page in is_alive()
bnxt_en: Increase timeout for HWRM_DBG_COREDUMP_XX commands
um: Fix off by one error in IRQ enumeration
net/rds: Fix 'ib_evt_handler_call' element in 'rds_ib_stat_names'
RDMA/cma: Fix false error message
ath10k: adjust skb length in ath10k_sdio_mbox_rx_packet
gpio/aspeed: Fix incorrect number of banks
pinctrl: iproc-gpio: Fix incorrect pinconf configurations
net: sonic: replace dev_kfree_skb in sonic_send_packet
hwmon: (shtc1) fix shtc1 and shtw1 id mask
ixgbe: sync the first fragment unconditionally
btrfs: use correct count in btrfs_file_write_iter()
Btrfs: fix inode cache waiters hanging on path allocation failure
Btrfs: fix inode cache waiters hanging on failure to start caching thread
Btrfs: fix hang when loading existing inode cache off disk
scsi: fnic: fix msix interrupt allocation
f2fs: fix error path of f2fs_convert_inline_page()
f2fs: fix wrong error injection path in inc_valid_block_count()
ARM: dts: logicpd-som-lv: Fix i2c2 and i2c3 Pin mux
rtlwifi: Fix file release memory leak
net: hns3: fix error VF index when setting VLAN offload
net: sonic: return NETDEV_TX_OK if failed to map buffer
led: triggers: Fix dereferencing of null pointer
xsk: avoid store-tearing when assigning umem
xsk: avoid store-tearing when assigning queues
ARM: dts: aspeed-g5: Fixe gpio-ranges upper limit
tty: serial: fsl_lpuart: Use appropriate lpuart32_* I/O funcs
wcn36xx: use dynamic allocation for large variables
ath9k: dynack: fix possible deadlock in ath_dynack_node_{de}init
netfilter: ctnetlink: honor IPS_OFFLOAD flag
iio: dac: ad5380: fix incorrect assignment to val
bcache: Fix an error code in bch_dump_read()
usb: typec: tps6598x: Fix build error without CONFIG_REGMAP_I2C
bcma: fix incorrect update of BCMA_CORE_PCI_MDIO_DATA
irqdomain: Add the missing assignment of domain->fwnode for named fwnode
staging: greybus: light: fix a couple double frees
x86, perf: Fix the dependency of the x86 insn decoder selftest
power: supply: Init device wakeup after device_add()
net/sched: cbs: Set default link speed to 10 Mbps in cbs_set_port_rate
hwmon: (lm75) Fix write operations for negative temperatures
Partially revert "kfifo: fix kfifo_alloc() and kfifo_init()"
rxrpc: Fix lack of conn cleanup when local endpoint is cleaned up [ver #2]
ahci: Do not export local variable ahci_em_messages
iommu/mediatek: Fix iova_to_phys PA start for 4GB mode
media: em28xx: Fix exception handling in em28xx_alloc_urbs()
mips: avoid explicit UB in assignment of mips_io_port_base
rtc: pcf2127: bugfix: read rtc disables watchdog
ARM: 8896/1: VDSO: Don't leak kernel addresses
media: atmel: atmel-isi: fix timeout value for stop streaming
i40e: reduce stack usage in i40e_set_fc
mac80211: minstrel_ht: fix per-group max throughput rate initialization
rtc: rv3029: revert error handling patch to rv3029_eeprom_write()
dmaengine: dw: platform: Switch to acpi_dma_controller_register()
ASoC: sun4i-i2s: RX and TX counter registers are swapped
powerpc/64s/radix: Fix memory hot-unplug page table split
signal: Allow cifs and drbd to receive their terminating signals
bnxt_en: Fix handling FRAG_ERR when NVM_INSTALL_UPDATE cmd fails
drm: rcar-du: lvds: Fix bridge_to_rcar_lvds
tools: bpftool: fix format strings and arguments for jsonw_printf()
tools: bpftool: fix arguments for p_err() in do_event_pipe()
net/rds: Add a few missing rds_stat_names entries
ASoC: wm8737: Fix copy-paste error in wm8737_snd_controls
ASoC: cs4349: Use PM ops 'cs4349_runtime_pm'
ASoC: es8328: Fix copy-paste error in es8328_right_line_controls
RDMA/hns: bugfix for slab-out-of-bounds when loading hip08 driver
RDMA/hns: Bugfix for slab-out-of-bounds when unloading hip08 driver
ext4: set error return correctly when ext4_htree_store_dirent fails
crypto: caam - free resources in case caam_rng registration failed
cxgb4: smt: Add lock for atomic_dec_and_test
spi: bcm-qspi: Fix BSPI QUAD and DUAL mode support when using flex mode
net: fix bpf_xdp_adjust_head regression for generic-XDP
iio: tsl2772: Use devm_add_action_or_reset for tsl2772_chip_off
cifs: fix rmmod regression in cifs.ko caused by force_sig changes
net/mlx5: Fix mlx5_ifc_query_lag_out_bits
ARM: dts: stm32: add missing vdda-supply to adc on stm32h743i-eval
tipc: reduce risk of wakeup queue starvation
arm64: dts: renesas: r8a77995: Fix register range of display node
ALSA: aoa: onyx: always initialize register read value
crypto: ccp - Reduce maximum stack usage
x86/kgbd: Use NMI_VECTOR not APIC_DM_NMI
mic: avoid statically declaring a 'struct device'.
media: rcar-vin: Clean up correct notifier in error path
usb: host: xhci-hub: fix extra endianness conversion
qed: reduce maximum stack frame size
libertas_tf: Use correct channel range in lbtf_geo_init
PM: sleep: Fix possible overflow in pm_system_cancel_wakeup()
clk: sunxi-ng: v3s: add the missing PLL_DDR1
drm/panel: make drm_panel.h self-contained
xfrm interface: ifname may be wrong in logs
scsi: libfc: fix null pointer dereference on a null lport
ARM: stm32: use "depends on" instead of "if" after prompt
xdp: fix possible cq entry leak
x86/pgtable/32: Fix LOWMEM_PAGES constant
net/tls: fix socket wmem accounting on fallback with netem
net: pasemi: fix an use-after-free in pasemi_mac_phy_init()
ceph: fix "ceph.dir.rctime" vxattr value
PCI: mobiveil: Fix the valid check for inbound and outbound windows
PCI: mobiveil: Fix devfn check in mobiveil_pcie_valid_device()
PCI: mobiveil: Remove the flag MSI_FLAG_MULTI_PCI_MSI
RDMA/hns: Fixs hw access invalid dma memory error
fsi: sbefifo: Don't fail operations when in SBE IPL state
devres: allow const resource arguments
fsi/core: Fix error paths on CFAM init
ACPI: PM: Introduce "poweroff" callbacks for ACPI PM domain and LPSS
ACPI: PM: Simplify and fix PM domain hibernation callbacks
PM: ACPI/PCI: Resume all devices during hibernation
um: Fix IRQ controller regression on console read
xprtrdma: Fix use-after-free in rpcrdma_post_recvs
rxrpc: Fix uninitialized error code in rxrpc_send_data_packet()
mfd: intel-lpss: Release IDA resources
iommu/amd: Make iommu_disable safer
bnxt_en: Suppress error messages when querying DSCP DCB capabilities.
bnxt_en: Fix ethtool selftest crash under error conditions.
fork,memcg: alloc_thread_stack_node needs to set tsk->stack
backlight: pwm_bl: Fix heuristic to determine number of brightness levels
tools: bpftool: use correct argument in cgroup errors
nvmem: imx-ocotp: Change TIMING calculation to u-boot algorithm
nvmem: imx-ocotp: Ensure WAIT bits are preserved when setting timing
clk: qcom: Fix -Wunused-const-variable
dmaengine: hsu: Revert "set HSU_CH_MTSR to memory width"
perf/ioctl: Add check for the sample_period value
ip6_fib: Don't discard nodes with valid routing information in fib6_locate_1()
drm/msm/a3xx: remove TPL1 regs from snapshot
arm64: dts: allwinner: h6: Pine H64: Add interrupt line for RTC
net/sched: cbs: Fix error path of cbs_module_init
ARM: dts: iwg20d-q7-common: Fix SDHI1 VccQ regularor
rtc: pcf8563: Clear event flags and disable interrupts before requesting irq
rtc: pcf8563: Fix interrupt trigger method
ASoC: ti: davinci-mcasp: Fix slot mask settings when using multiple AXRs
net/af_iucv: always register net_device notifier
net/af_iucv: build proper skbs for HiperTransport
net/udp_gso: Allow TX timestamp with UDP GSO
net: netem: fix backlog accounting for corrupted GSO frames
drm/msm/mdp5: Fix mdp5_cfg_init error return
IB/hfi1: Handle port down properly in pio
bpf: fix the check that forwarding is enabled in bpf_ipv6_fib_lookup
powerpc/pseries/mobility: rebuild cacheinfo hierarchy post-migration
powerpc/cacheinfo: add cacheinfo_teardown, cacheinfo_rebuild
qed: iWARP - fix uninitialized callback
qed: iWARP - Use READ_ONCE and smp_store_release to access ep->state
ASoC: meson: axg-tdmout: right_j is not supported
ASoC: meson: axg-tdmin: right_j is not supported
ntb_hw_switchtec: potential shift wrapping bug in switchtec_ntb_init_sndev()
firmware: arm_scmi: update rate_discrete in clock_describe_rates_get
firmware: arm_scmi: fix bitfield definitions for SENSOR_DESC attributes
phy: usb: phy-brcm-usb: Remove sysfs attributes upon driver removal
iommu/vt-d: Duplicate iommu_resv_region objects per device list
arm64: dts: meson-gxm-khadas-vim2: fix Bluetooth support
arm64: dts: meson-gxm-khadas-vim2: fix gpio-keys-polled node
serial: stm32: fix a recursive locking in stm32_config_rs485
mpls: fix warning with multi-label encap
arm64: dts: renesas: ebisu: Remove renesas, no-ether-link property
crypto: inside-secure - fix queued len computation
crypto: inside-secure - fix zeroing of the request in ahash_exit_inv
media: vivid: fix incorrect assignment operation when setting video mode
clk: sunxi-ng: sun50i-h6-r: Fix incorrect W1 clock gate register
cpufreq: brcmstb-avs-cpufreq: Fix types for voltage/frequency
cpufreq: brcmstb-avs-cpufreq: Fix initial command check
phy: qcom-qusb2: fix missing assignment of ret when calling clk_prepare_enable
net: don't clear sock->sk early to avoid trouble in strparser
RDMA/uverbs: check for allocation failure in uapi_add_elm()
net: core: support XDP generic on stacked devices.
netvsc: unshare skb in VF rx handler
crypto: talitos - fix AEAD processing.
net: hns3: fix a memory leak issue for hclge_map_unmap_ring_to_vf_vector
inet: frags: call inet_frags_fini() after unregister_pernet_subsys()
signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of force_sig
signal/bpfilter: Fix bpfilter_kernl to use send_sig not force_sig
iommu: Use right function to get group for device
iommu: Add missing new line for dma type
misc: sgi-xp: Properly initialize buf in xpc_get_rsvd_page_pa
serial: stm32: fix wakeup source initialization
serial: stm32: Add support of TC bit status check
serial: stm32: fix transmit_chars when tx is stopped
serial: stm32: fix rx data length when parity enabled
serial: stm32: fix rx error handling
serial: stm32: fix word length configuration
crypto: ccp - Fix 3DES complaint from ccp-crypto module
crypto: ccp - fix AES CFB error exposed by new test vectors
spi: spi-fsl-spi: call spi_finalize_current_message() at the end
RDMA/qedr: Fix incorrect device rate.
arm64: dts: meson: libretech-cc: set eMMC as removable
dmaengine: tegra210-adma: Fix crash during probe
clk: meson: axg: spread spectrum is on mpll2
clk: meson: gxbb: no spread spectrum on mpll0
ARM: dts: sun8i-h3: Fix wifi in Beelink X2 DT
afs: Fix double inc of vnode->cb_break
afs: Fix lock-wait/callback-break double locking
afs: Don't invalidate callback if AFS_VNODE_DIR_VALID not set
afs: Fix key leak in afs_release() and afs_evict_inode()
EDAC/mc: Fix edac_mc_find() in case no device is found
thermal: cpu_cooling: Actually trace CPU load in thermal_power_cpu_get_power
thermal: rcar_gen3_thermal: fix interrupt type
backlight: lm3630a: Return 0 on success in update_status functions
netfilter: nf_tables: correct NFT_LOGLEVEL_MAX value
kdb: do a sanity check on the cpu in kdb_per_cpu()
nfp: bpf: fix static check error through tightening shift amount adjustment
ARM: riscpc: fix lack of keyboard interrupts after irq conversion
pwm: meson: Don't disable PWM when setting duty repeatedly
pwm: meson: Consider 128 a valid pre-divider
netfilter: ebtables: CONFIG_COMPAT: reject trailing data after last rule
crypto: caam - fix caam_dump_sg that iterates through scatterlist
platform/x86: alienware-wmi: printing the wrong error code
media: davinci/vpbe: array underflow in vpbe_enum_outputs()
media: omap_vout: potential buffer overflow in vidioc_dqbuf()
ALSA: aica: Fix a long-time build breakage
l2tp: Fix possible NULL pointer dereference
vfio/mdev: Fix aborting mdev child device removal if one fails
vfio/mdev: Follow correct remove sequence
vfio/mdev: Avoid release parent reference during error path
afs: Fix the afs.cell and afs.volume xattr handlers
ath10k: Fix encoding for protected management frames
lightnvm: pblk: fix lock order in pblk_rb_tear_down_check
mmc: core: fix possible use after free of host
watchdog: rtd119x_wdt: Fix remove function
dmaengine: tegra210-adma: restore channel status
net: ena: fix ena_com_fill_hash_function() implementation
net: ena: fix incorrect test of supported hash function
net: ena: fix: Free napi resources when ena_up() fails
net: ena: fix swapped parameters when calling ena_com_indirect_table_fill_entry
iommu/vt-d: Make kernel parameter igfx_off work with vIOMMU
RDMA/rxe: Consider skb reserve space based on netdev of GID
IB/mlx5: Add missing XRC options to QP optional params mask
dwc2: gadget: Fix completed transfer size calculation in DDMA
usb: gadget: fsl: fix link error against usb-gadget module
ASoC: fix valid stream condition
packet: in recvmsg msg_name return at least sizeof sockaddr_ll
ARM: dts: logicpd-som-lv: Fix MMC1 card detect
PCI: iproc: Enable iProc config read for PAXBv2
netfilter: nft_flow_offload: add entry to flowtable after confirmation
KVM: PPC: Book3S HV: Fix lockdep warning when entering the guest
scsi: qla2xxx: Avoid that qlt_send_resp_ctio() corrupts memory
scsi: qla2xxx: Fix error handling in qlt_alloc_qfull_cmd()
scsi: qla2xxx: Fix a format specifier
irqchip/gic-v3-its: fix some definitions of inner cacheability attributes
s390/kexec_file: Fix potential segment overlap in ELF loader
coresight: catu: fix clang build warning
NFS: Don't interrupt file writeout due to fatal errors
afs: Further fix file locking
afs: Fix AFS file locking to allow fine grained locks
ALSA: usb-audio: Handle the error from snd_usb_mixer_apply_create_quirk()
dmaengine: axi-dmac: Don't check the number of frames for alignment
6lowpan: Off by one handling ->nexthdr
media: ov2659: fix unbalanced mutex_lock/unlock
ARM: dts: ls1021: Fix SGMII PCS link remaining down after PHY disconnect
powerpc: vdso: Make vdso32 installation conditional in vdso_install
net: hns3: fix loop condition of hns3_get_tx_timeo_queue_info()
selftests/ipc: Fix msgque compiler warnings
usb: typec: tcpm: Notify the tcpc to start connection-detection for SRPs
tipc: set sysctl_tipc_rmem and named_timeout right range
platform/x86: alienware-wmi: fix kfree on potentially uninitialized pointer
soc: amlogic: meson-gx-pwrc-vpu: Fix power on/off register bitmask
PCI: dwc: Fix dw_pcie_ep_find_capability() to return correct capability offset
staging: android: vsoc: fix copy_from_user overrun
perf/core: Fix the address filtering fix
hwmon: (w83627hf) Use request_muxed_region for Super-IO accesses
net: hns3: fix for vport->bw_limit overflow problem
PCI: rockchip: Fix rockchip_pcie_ep_assert_intx() bitwise operations
ARM: pxa: ssp: Fix "WARNING: invalid free of devm_ allocated data"
brcmfmac: fix leak of mypkt on error return path
scsi: target/core: Fix a race condition in the LUN lookup code
rxrpc: Fix detection of out of order acks
firmware: arm_scmi: fix of_node leak in scmi_mailbox_check
ACPI: button: reinitialize button state upon resume
clk: qcom: Skip halt checks on gcc_pcie_0_pipe_clk for 8998
net/sched: cbs: fix port_rate miscalculation
of: use correct function prototype for of_overlay_fdt_apply()
scsi: qla2xxx: Unregister chrdev if module initialization fails
drm/vmwgfx: Remove set but not used variable 'restart'
bpf: Add missed newline in verifier verbose log
ehea: Fix a copy-paste err in ehea_init_port_res
rtc: mt6397: Don't call irq_dispose_mapping.
rtc: Fix timestamp value for RTC_TIMESTAMP_BEGIN_1900
arm64/vdso: don't leak kernel addresses
drm/fb-helper: generic: Call drm_client_add() after setup is done
spi: bcm2835aux: fix driver to not allow 65535 (=-1) cs-gpios
soc/fsl/qe: Fix an error code in qe_pin_request()
bus: ti-sysc: Fix sysc_unprepare() when no clocks have been allocated
spi: tegra114: configure dma burst size to fifo trig level
spi: tegra114: flush fifos
spi: tegra114: terminate dma and reset on transfer timeout
spi: tegra114: fix for unpacked mode transfers
spi: tegra114: clear packed bit for unpacked mode
media: tw5864: Fix possible NULL pointer dereference in tw5864_handle_frame
media: davinci-isif: avoid uninitialized variable use
soc: qcom: cmd-db: Fix an error code in cmd_db_dev_probe()
net: dsa: Avoid null pointer when failing to connect to PHY
ARM: OMAP2+: Fix potentially uninitialized return value for _setup_reset()
net: phy: don't clear BMCR in genphy_soft_reset
ARM: dts: sun9i: optimus: Fix fixed-regulators
arm64: dts: allwinner: a64: Add missing PIO clocks
ARM: dts: sun8i: a33: Reintroduce default pinctrl muxing
m68k: mac: Fix VIA timer counter accesses
tipc: tipc clang warning
jfs: fix bogus variable self-initialization
crypto: ccree - reduce kernel stack usage with clang
regulator: tps65086: Fix tps65086_ldoa1_ranges for selector 0xB
media: cx23885: check allocation return
media: wl128x: Fix an error code in fm_download_firmware()
media: cx18: update *pos correctly in cx18_read_pos()
media: ivtv: update *pos correctly in ivtv_read_pos()
soc: amlogic: gx-socinfo: Add mask for each SoC packages
regulator: lp87565: Fix missing register for LP87565_BUCK_0
net: sh_eth: fix a missing check of of_get_phy_mode
net/mlx5e: IPoIB, Fix RX checksum statistics update
net/mlx5: Fix multiple updates of steering rules in parallel
xen, cpu_hotplug: Prevent an out of bounds access
drivers/rapidio/rio_cm.c: fix potential oops in riocm_ch_listen()
nfp: fix simple vNIC mailbox length
scsi: megaraid_sas: reduce module load time
x86/mm: Remove unused variable 'cpu'
nios2: ksyms: Add missing symbol exports
PCI: Fix "try" semantics of bus and slot reset
rbd: clear ->xferred on error from rbd_obj_issue_copyup()
media: dvb/earth-pt1: fix wrong initialization for demod blocks
powerpc/mm: Check secondary hash page table
net: aquantia: fixed instack structure overflow
NFSv4/flexfiles: Fix invalid deref in FF_LAYOUT_DEVID_NODE()
NFS: Add missing encode / decode sequence_maxsz to v4.2 operations
iommu/vt-d: Fix NULL pointer reference in intel_svm_bind_mm()
hwrng: bcm2835 - fix probe as platform device
net: sched: act_csum: Fix csum calc for tagged packets
netfilter: nft_set_hash: bogus element self comparison from deactivation path
netfilter: nft_set_hash: fix lookups with fixed size hash on big endian
ath10k: Fix length of wmi tlv command for protected mgmt frames
regulator: wm831x-dcdc: Fix list of wm831x_dcdc_ilim from mA to uA
ARM: 8849/1: NOMMU: Fix encodings for PMSAv8's PRBAR4/PRLAR4
ARM: 8848/1: virt: Align GIC version check with arm64 counterpart
ARM: 8847/1: pm: fix HYP/SVC mode mismatch when MCPM is used
iommu: Fix IOMMU debugfs fallout
mmc: sdhci-brcmstb: handle mmc_of_parse() errors during probe
NFS/pnfs: Bulk destroy of layouts needs to be safe w.r.t. umount
platform/x86: wmi: fix potential null pointer dereference
clocksource/drivers/exynos_mct: Fix error path in timer resources initialization
clocksource/drivers/sun5i: Fail gracefully when clock rate is unavailable
perf, pt, coresight: Fix address filters for vmas with non-zero offset
perf: Copy parent's address filter offsets on clone
NFS: Fix a soft lockup in the delegation recovery code
powerpc/64s: Fix logic when handling unknown CPU features
staging: rtlwifi: Use proper enum for return in halmac_parse_psd_data_88xx
fs/nfs: Fix nfs_parse_devname to not modify it's argument
net: dsa: fix unintended change of bridge interface STP state
ASoC: qcom: Fix of-node refcount unbalance in apq8016_sbc_parse_of()
driver core: Fix PM-runtime for links added during consumer probe
drm/nouveau: fix missing break in switch statement
drm/nouveau/pmu: don't print reply values if exec is false
drm/nouveau/bios/ramcfg: fix missing parentheses when calculating RON
net/mlx5: Delete unused FPGA QPN variable
net: dsa: qca8k: Enable delay for RGMII_ID mode
regulator: pv88090: Fix array out-of-bounds access
regulator: pv88080: Fix array out-of-bounds access
regulator: pv88060: Fix array out-of-bounds access
brcmfmac: create debugfs files for bus-specific layer
cdc-wdm: pass return value of recover_from_urb_loss
dmaengine: mv_xor: Use correct device for DMA API
staging: r8822be: check kzalloc return or bail
KVM: PPC: Release all hardware TCE tables attached to a group
mdio_bus: Fix PTR_ERR() usage after initialization to constant
hwmon: (pmbus/tps53679) Fix driver info initialization in probe routine
vfio_pci: Enable memory accesses before calling pci_map_rom
media: sh: migor: Include missing dma-mapping header
mt76: usb: fix possible memory leak in mt76u_buf_free
net: dsa: b53: Do not program CPU port's PVID
net: dsa: b53: Properly account for VLAN filtering
net: dsa: b53: Fix default VLAN ID
keys: Timestamp new keys
block: don't use bio->bi_vcnt to figure out segment number
usb: phy: twl6030-usb: fix possible use-after-free on remove
PCI: endpoint: functions: Use memcpy_fromio()/memcpy_toio()
driver core: Fix possible supplier PM-usage counter imbalance
RDMA/mlx5: Fix memory leak in case we fail to add an IB device
pinctrl: sh-pfc: sh73a0: Fix fsic_spdif pin groups
pinctrl: sh-pfc: r8a7792: Fix vin1_data18_b pin group
pinctrl: sh-pfc: r8a7791: Fix scifb2_data_c pin group
pinctrl: sh-pfc: emev2: Add missing pinmux functions
ntb_hw_switchtec: NT req id mapping table register entry number should be 512
ntb_hw_switchtec: debug print 64bit aligned crosslink BAR Numbers
drm/etnaviv: potential NULL dereference
xsk: add missing smp_rmb() in xsk_mmap
ipmi: kcs_bmc: handle devm_kasprintf() failure case
iw_cxgb4: use tos when finding ipv6 routes
iw_cxgb4: use tos when importing the endpoint
fbdev: chipsfb: remove set but not used variable 'size'
rtc: pm8xxx: fix unintended sign extension
rtc: 88pm80x: fix unintended sign extension
rtc: 88pm860x: fix unintended sign extension
net/smc: original socket family in inet_sock_diag
rtc: ds1307: rx8130: Fix alarm handling
net: phy: fixed_phy: Fix fixed_phy not checking GPIO
ath10k: fix dma unmap direction for management frames
arm64: dts: msm8916: remove bogus argument to the cpu clock
thermal: mediatek: fix register index error
rtc: ds1672: fix unintended sign extension
clk: ingenic: jz4740: Fix gating of UDC clock
staging: most: cdev: add missing check for cdev_add failure
iwlwifi: mvm: fix RSS config command
drm/xen-front: Fix mmap attributes for display buffers
ARM: dts: lpc32xx: phy3250: fix SD card regulator voltage
ARM: dts: lpc32xx: fix ARM PrimeCell LCD controller clocks property
ARM: dts: lpc32xx: fix ARM PrimeCell LCD controller variant
ARM: dts: lpc32xx: reparent keypad controller to SIC1
ARM: dts: lpc32xx: add required clocks property to keypad device node
driver core: Do not call rpm_put_suppliers() in pm_runtime_drop_link()
driver core: Fix handling of runtime PM flags in device_link_add()
driver core: Do not resume suppliers under device_links_write_lock()
driver core: Avoid careless re-use of existing device links
driver core: Fix DL_FLAG_AUTOREMOVE_SUPPLIER device link flag handling
crypto: crypto4xx - Fix wrong ppc4xx_trng_probe()/ppc4xx_trng_remove() arguments
driver: uio: fix possible use-after-free in __uio_register_device
driver: uio: fix possible memory leak in __uio_register_device
tty: ipwireless: Fix potential NULL pointer dereference
bus: ti-sysc: Fix timer handling with drop pm_runtime_irq_safe()
iwlwifi: mvm: fix A-MPDU reference assignment
arm64: dts: allwinner: h6: Move GIC device node fix base address ordering
ip_tunnel: Fix route fl4 init in ip_md_tunnel_xmit
net/mlx5: Take lock with IRQs disabled to avoid deadlock
iwlwifi: mvm: avoid possible access out of array.
clk: sunxi-ng: sun8i-a23: Enable PLL-MIPI LDOs when ungating it
ARM: dts: sun8i-a23-a33: Move NAND controller device node to sort by address
net: hns3: fix bug of ethtool_ops.get_channels for VF
spi/topcliff_pch: Fix potential NULL dereference on allocation error
rtc: cmos: ignore bogus century byte
IB/mlx5: Don't override existing ip_protocol
media: tw9910: Unregister subdevice with v4l2-async
net: hns3: fix wrong combined count returned by ethtool -l
IB/iser: Pass the correct number of entries for dma mapped SGL
ASoC: imx-sgtl5000: put of nodes if finding codec fails
crypto: tgr192 - fix unaligned memory access
crypto: brcm - Fix some set-but-not-used warning
kbuild: mark prepare0 as PHONY to fix external module build
media: s5p-jpeg: Correct step and max values for V4L2_CID_JPEG_RESTART_INTERVAL
drm/etnaviv: NULL vs IS_ERR() buf in etnaviv_core_dump()
memory: tegra: Don't invoke Tegra30+ specific memory timing setup on Tegra20
net: phy: micrel: set soft_reset callback to genphy_soft_reset for KSZ9031
RDMA/iw_cxgb4: Fix the unchecked ep dereference
spi: cadence: Correct initialisation of runtime PM
arm64: dts: apq8016-sbc: Increase load on l11 for SDCARD
drm/shmob: Fix return value check in shmob_drm_probe
RDMA/qedr: Fix out of bounds index check in query pkey
RDMA/ocrdma: Fix out of bounds index check in query pkey
IB/usnic: Fix out of bounds index check in query pkey
fork, memcg: fix cached_stacks case
drm/fb-helper: generic: Fix setup error path
drm/etnaviv: fix some off by one bugs
ARM: dts: r8a7743: Remove generic compatible string from iic3
drm: Fix error handling in drm_legacy_addctx
remoteproc: qcom: q6v5-mss: Add missing regulator for MSM8996
remoteproc: qcom: q6v5-mss: Add missing clocks for MSM8996
arm64: defconfig: Re-enable bcm2835-thermal driver
MIPS: BCM63XX: drop unused and broken DSP platform device
clk: dove: fix refcount leak in dove_clk_init()
clk: mv98dx3236: fix refcount leak in mv98dx3236_clk_init()
clk: armada-xp: fix refcount leak in axp_clk_init()
clk: kirkwood: fix refcount leak in kirkwood_clk_init()
clk: armada-370: fix refcount leak in a370_clk_init()
clk: vf610: fix refcount leak in vf610_clocks_init()
clk: imx7d: fix refcount leak in imx7d_clocks_init()
clk: imx6sx: fix refcount leak in imx6sx_clocks_init()
clk: imx6q: fix refcount leak in imx6q_clocks_init()
clk: samsung: exynos4: fix refcount leak in exynos4_get_xom()
clk: socfpga: fix refcount leak
clk: ti: fix refcount leak in ti_dt_clocks_register()
clk: qoriq: fix refcount leak in clockgen_init()
clk: highbank: fix refcount leak in hb_clk_init()
fork,memcg: fix crash in free_thread_stack on memcg charge fail
Input: nomadik-ske-keypad - fix a loop timeout test
vxlan: changelink: Fix handling of default remotes
net: hns3: fix error handling int the hns3_get_vector_ring_chain
pinctrl: sh-pfc: sh7734: Remove bogus IPSR10 value
pinctrl: sh-pfc: sh7269: Add missing PCIOR0 field
pinctrl: sh-pfc: r8a77995: Remove bogus SEL_PWM[0-3]_3 configurations
pinctrl: sh-pfc: sh7734: Add missing IPSR11 field
pinctrl: sh-pfc: r8a77980: Add missing MOD_SEL0 field
pinctrl: sh-pfc: r8a77970: Add missing MOD_SEL0 field
pinctrl: sh-pfc: r8a7794: Remove bogus IPSR9 field
pinctrl: sh-pfc: sh73a0: Add missing TO pin to tpu4_to3 group
pinctrl: sh-pfc: r8a7791: Remove bogus marks from vin1_b_data18 group
pinctrl: sh-pfc: r8a7791: Remove bogus ctrl marks from qspi_data4_b group
pinctrl: sh-pfc: r8a7740: Add missing LCD0 marks to lcd0_data24_1 group
pinctrl: sh-pfc: r8a7740: Add missing REF125CK pin to gether_gmii group
ipv6: add missing tx timestamping on IPPROTO_RAW
switchtec: Remove immediate status check after submitting MRPC command
staging: bcm2835-camera: fix module autoloading
staging: bcm2835-camera: Abort probe if there is no camera
mailbox: ti-msgmgr: Off by one in ti_msgmgr_of_xlate()
IB/rxe: Fix incorrect cache cleanup in error flow
OPP: Fix missing debugfs supply directory for OPPs
IB/hfi1: Correctly process FECN and BECN in packets
net: phy: Fix not to call phy_resume() if PHY is not attached
arm64: dts: renesas: r8a7795-es1: Add missing power domains to IPMMU nodes
arm64: dts: meson-gx: Add hdmi_5v regulator as hdmi tx supply
drm/dp_mst: Skip validating ports during destruction, just ref
net: always initialize pagedlen
drm: rcar-du: Fix vblank initialization
drm: rcar-du: Fix the return value in case of error in 'rcar_du_crtc_set_crc_source()'
exportfs: fix 'passing zero to ERR_PTR()' warning
bus: ti-sysc: Add mcasp optional clocks flag
pinctrl: meson-gxl: remove invalid GPIOX tsin_a pins
ASoC: sun8i-codec: add missing route for ADC
pcrypt: use format specifier in kobject_add
ARM: dts: bcm283x: Correct mailbox register sizes
ASoC: wm97xx: fix uninitialized regmap pointer problem
NTB: ntb_hw_idt: replace IS_ERR_OR_NULL with regular NULL checks
mlxsw: spectrum: Set minimum shaper on MC TCs
mlxsw: reg: QEEC: Add minimum shaper fields
net: hns3: add error handler for hns3_nic_init_vector_data()
drm/sun4i: hdmi: Fix double flag assignation
net: socionext: Add dummy PHY register read in phy_write()
tipc: eliminate message disordering during binding table update
powerpc/kgdb: add kgdb_arch_set/remove_breakpoint()
netfilter: nf_flow_table: do not remove offload when other netns's interface is down
RDMA/bnxt_re: Add missing spin lock initialization
rtlwifi: rtl8821ae: replace _rtl8821ae_mrate_idx_to_arfr_id with generic version
powerpc/pseries/memory-hotplug: Fix return value type of find_aa_index
pwm: lpss: Release runtime-pm reference from the driver's remove callback
netfilter: nft_osf: usage from output path is not valid
staging: comedi: ni_mio_common: protect register write overflow
iwlwifi: nvm: get num of hw addresses from firmware
ALSA: usb-audio: update quirk for B&W PX to remove microphone
of: Fix property name in of_node_get_device_type
drm/msm: fix unsigned comparison with less than zero
mei: replace POLL* with EPOLL* for write queues.
cfg80211: regulatory: make initialization more robust
usb: gadget: fsl_udc_core: check allocation return value and cleanup on failure
usb: dwc3: add EXTCON dependency for qcom
genirq/debugfs: Reinstate full OF path for domain name
IB/hfi1: Add mtu check for operational data VLs
IB/rxe: replace kvfree with vfree
mailbox: mediatek: Add check for possible failure of kzalloc
ASoC: wm9712: fix unused variable warning
signal/ia64: Use the force_sig(SIGSEGV,...) in ia64_rt_sigreturn
signal/ia64: Use the generic force_sigsegv in setup_frame
drm/hisilicon: hibmc: Don't overwrite fb helper surface depth
bridge: br_arp_nd_proxy: set icmp6_router if neigh has NTF_ROUTER
PCI: iproc: Remove PAXC slot check to allow VF support
firmware: coreboot: Let OF core populate platform device
ARM: qcom_defconfig: Enable MAILBOX
apparmor: don't try to replace stale label in ptrace access check
ALSA: hda: fix unused variable warning
apparmor: Fix network performance issue in aa_label_sk_perm
iio: fix position relative kernel version
drm/virtio: fix bounds check in virtio_gpu_cmd_get_capset()
ixgbe: don't clear IPsec sa counters on HW clearing
ARM: dts: at91: nattis: make the SD-card slot work
ARM: dts: at91: nattis: set the PRLUD and HIPOW signals low
drm/sti: do not remove the drm_bridge that was never added
ipmi: Fix memory leak in __ipmi_bmc_register
watchdog: sprd: Fix the incorrect pointer getting from driver data
soc: aspeed: Fix snoop_file_poll()'s return type
perf map: No need to adjust the long name of modules
crypto: sun4i-ss - fix big endian issues
mt7601u: fix bbp version check in mt7601u_wait_bbp_ready
tipc: fix wrong timeout input for tipc_wait_for_cond()
tipc: update mon's self addr when node addr generated
powerpc/archrandom: fix arch_get_random_seed_int()
powerpc/pseries: Enable support for ibm,drc-info property
SUNRPC: Fix svcauth_gss_proxy_init()
mfd: intel-lpss: Add default I2C device properties for Gemini Lake
i2c: i2c-stm32f7: fix 10-bits check in slave free id search loop
i2c: stm32f7: rework slave_id allocation
xfs: Sanity check flags of Q_XQUOTARM call
Revert "efi: Fix debugobjects warning on 'efi_rts_work'"
FROMGIT: ext4: Add EXT4_IOC_FSGETXATTR/EXT4_IOC_FSSETXATTR to compat_ioctl.
ANDROID: gki_defconfig: Set IKHEADERS back to =m
ANDROID: gki_defconfig: enable NVDIMM/PMEM options
UPSTREAM: virtio-pmem: Add virtio pmem driver
UPSTREAM: libnvdimm: nd_region flush callback support
UPSTREAM: libnvdimm/of_pmem: Provide a unique name for bus provider
UPSTREAM: libnvdimm/of_pmem: Fix platform_no_drv_owner.cocci warnings
ANDROID: x86: gki_defconfig: enable LTO and CFI
ANDROID: x86: map CFI jump tables in pti_clone_entry_text
ANDROID: BACKPORT: x86, module: Ignore __typeid__ relocations
ANDROID: BACKPORT: x86, relocs: Ignore __typeid__ relocations
ANDROID: BACKPORT: x86/extable: Do not mark exception callback as CFI
FROMLIST: crypto, x86/sha: Eliminate casts on asm implementations
UPSTREAM: crypto: x86 - Rename functions to avoid conflict with crypto/sha256.h
UPSTREAM: x86/vmlinux: Actually use _etext for the end of the text segment
ANDROID: update ABI following inline crypto changes
ANDROID: gki_defconfig: enable dm-default-key
ANDROID: dm: add dm-default-key target for metadata encryption
ANDROID: dm: enable may_passthrough_inline_crypto on some targets
ANDROID: dm: add support for passing through inline crypto support
ANDROID: block: Introduce passthrough keyslot manager
ANDROID: ext4, f2fs: enable direct I/O with inline encryption
FROMLIST: scsi: ufs: add program_key() variant op
ANDROID: block: export symbols needed for modules to use inline crypto
ANDROID: block: fix some inline crypto bugs
UPSTREAM: mm/page_io.c: annotate refault stalls from swap_readpage
UPSTREAM: lib/test_meminit.c: add bulk alloc/free tests
UPSTREAM: lib/test_meminit: add a kmem_cache_alloc_bulk() test
UPSTREAM: mm/slub.c: init_on_free=1 should wipe freelist ptr for bulk allocations
ANDROID: mm/cma.c: Export symbols
ANDROID: gki_defconfig: Set CONFIG_ION=m
ANDROID: lib/plist: Export symbol plist_add
ANDROID: staging: android: ion: enable modularizing the ion driver
Revert "ANDROID: security,perf: Allow further restriction of perf_event_open"
ANDROID: selinux: modify RTM_GETLINK permission
FROMLIST: security: selinux: allow per-file labelling for binderfs
BACKPORT: tracing: Remove unnecessary DEBUG_FS dependency
BACKPORT: debugfs: Fix !DEBUG_FS debugfs_create_automount
ANDROID: update abi for 4.19.98
Linux 4.19.98
hwmon: (pmbus/ibm-cffps) Switch LEDs to blocking brightness call
regulator: ab8500: Remove SYSCLKREQ from enum ab8505_regulator_id
clk: sprd: Use IS_ERR() to validate the return value of syscon_regmap_lookup_by_phandle()
perf probe: Fix wrong address verification
scsi: core: scsi_trace: Use get_unaligned_be*()
scsi: qla2xxx: fix rports not being mark as lost in sync fabric scan
scsi: qla2xxx: Fix qla2x00_request_irqs() for MSI
scsi: target: core: Fix a pr_debug() argument
scsi: bnx2i: fix potential use after free
scsi: qla4xxx: fix double free bug
scsi: esas2r: unlock on error in esas2r_nvram_read_direct()
reiserfs: fix handling of -EOPNOTSUPP in reiserfs_for_each_xattr
drm/nouveau/mmu: qualify vmm during dtor
drm/nouveau/bar/gf100: ensure BAR is mapped
drm/nouveau/bar/nv50: check bar1 vmm return value
mtd: devices: fix mchp23k256 read and write
Revert "arm64: dts: juno: add dma-ranges property"
arm64: dts: marvell: Fix CP110 NAND controller node multi-line comment alignment
tick/sched: Annotate lockless access to last_jiffies_update
cfg80211: check for set_wiphy_params
arm64: dts: meson-gxl-s905x-khadas-vim: fix gpio-keys-polled node
cw1200: Fix a signedness bug in cw1200_load_firmware()
irqchip: Place CONFIG_SIFIVE_PLIC into the menu
tcp: refine rule to allow EPOLLOUT generation under mem pressure
xen/blkfront: Adjust indentation in xlvbd_alloc_gendisk
mlxsw: spectrum_qdisc: Include MC TCs in Qdisc counters
mlxsw: spectrum: Wipe xstats.backlog of down ports
sh_eth: check sh_eth_cpu_data::dual_port when dumping registers
tcp: fix marked lost packets not being retransmitted
r8152: add missing endpoint sanity check
ptp: free ptp device pin descriptors properly
net/wan/fsl_ucc_hdlc: fix out of bounds write on array utdm_info
net: usb: lan78xx: limit size of local TSO packets
net: hns: fix soft lockup when there is not enough memory
net: dsa: tag_qca: fix doubled Tx statistics
hv_netvsc: Fix memory leak when removing rndis device
macvlan: use skb_reset_mac_header() in macvlan_queue_xmit()
batman-adv: Fix DAT candidate selection on little endian systems
NFC: pn533: fix bulk-message timeout
netfilter: nf_tables: fix flowtable list del corruption
netfilter: nf_tables: store transaction list locally while requesting module
netfilter: nf_tables: remove WARN and add NLA_STRING upper limits
netfilter: nft_tunnel: fix null-attribute check
netfilter: arp_tables: init netns pointer in xt_tgdtor_param struct
netfilter: fix a use-after-free in mtype_destroy()
cfg80211: fix page refcount issue in A-MSDU decap
cfg80211: fix memory leak in cfg80211_cqm_rssi_update
cfg80211: fix deadlocks in autodisconnect work
bpf: Fix incorrect verifier simulation of ARSH under ALU32
arm64: dts: agilex/stratix10: fix pmu interrupt numbers
mm/huge_memory.c: thp: fix conflict of above-47bit hint address and PMD alignment
mm/huge_memory.c: make __thp_get_unmapped_area static
net: stmmac: Enable 16KB buffer size
net: stmmac: 16KB buffer must be 16 byte aligned
ARM: dts: imx7: Fix Toradex Colibri iMX7S 256MB NAND flash support
ARM: dts: imx6q-icore-mipi: Use 1.5 version of i.Core MX6DL
ARM: dts: imx6qdl: Add Engicam i.Core 1.5 MX6
mm/page-writeback.c: avoid potential division by zero in wb_min_max_ratio()
btrfs: fix memory leak in qgroup accounting
btrfs: do not delete mismatched root refs
btrfs: fix invalid removal of root ref
btrfs: rework arguments of btrfs_unlink_subvol
mm: memcg/slab: call flush_memcg_workqueue() only if memcg workqueue is valid
mm/shmem.c: thp, shmem: fix conflict of above-47bit hint address and PMD alignment
perf report: Fix incorrectly added dimensions as switch perf data file
perf hists: Fix variable name's inconsistency in hists__for_each() macro
x86/resctrl: Fix potential memory leak
drm/i915: Add missing include file <linux/math64.h>
x86/efistub: Disable paging at mixed mode entry
x86/CPU/AMD: Ensure clearing of SME/SEV features is maintained
x86/resctrl: Fix an imbalance in domain_remove_cpu()
usb: core: hub: Improved device recognition on remote wakeup
ptrace: reintroduce usage of subjective credentials in ptrace_has_cap()
LSM: generalize flag passing to security_capable
ARM: dts: am571x-idk: Fix gpios property to have the correct gpio number
block: fix an integer overflow in logical block size
Fix built-in early-load Intel microcode alignment
arm64: dts: allwinner: a64: olinuxino: Fix SDIO supply regulator
ALSA: usb-audio: fix sync-ep altsetting sanity check
ALSA: seq: Fix racy access for queue timer in proc read
ALSA: dice: fix fallback from protocol extension into limited functionality
ARM: dts: imx6q-dhcom: Fix SGTL5000 VDDIO regulator connection
ASoC: msm8916-wcd-analog: Fix MIC BIAS Internal1
ASoC: msm8916-wcd-analog: Fix selected events for MIC BIAS External1
scsi: mptfusion: Fix double fetch bug in ioctl
scsi: fnic: fix invalid stack access
USB: serial: quatech2: handle unbound ports
USB: serial: keyspan: handle unbound ports
USB: serial: io_edgeport: add missing active-port sanity check
USB: serial: io_edgeport: handle unbound ports on URB completion
USB: serial: ch341: handle unbound port at reset_resume
USB: serial: suppress driver bind attributes
USB: serial: option: add support for Quectel RM500Q in QDL mode
USB: serial: opticon: fix control-message timeouts
USB: serial: option: Add support for Quectel RM500Q
USB: serial: simple: Add Motorola Solutions TETRA MTP3xxx and MTP85xx
iio: buffer: align the size of scan bytes to size of the largest element
ASoC: msm8916-wcd-digital: Reset RX interpolation path after use
clk: Don't try to enable critical clocks if prepare failed
ARM: dts: imx6q-dhcom: fix rtc compatible
dt-bindings: reset: meson8b: fix duplicate reset IDs
clk: qcom: gcc-sdm845: Add missing flag to votable GDSCs
ARM: dts: meson8: fix the size of the PMU registers
ANDROID: gki: Make GKI specific modules builtins
ANDROID: fscrypt: add support for hardware-wrapped keys
ANDROID: block: add KSM op to derive software secret from wrapped key
ANDROID: block: provide key size as input to inline crypto APIs
ANDROID: ufshcd-crypto: export cap find API
ANDROID: build config for cuttlefish ramdisk
ANDROID: Update ABI representation and whitelist
Linux 4.19.97
ocfs2: call journal flush to mark journal as empty after journal recovery when mount
hexagon: work around compiler crash
hexagon: parenthesize registers in asm predicates
ioat: ioat_alloc_ring() failure handling.
dmaengine: k3dma: Avoid null pointer traversal
drm/arm/mali: make malidp_mw_connector_helper_funcs static
MIPS: Prevent link failure with kcov instrumentation
mips: cacheinfo: report shared CPU map
rseq/selftests: Turn off timeout setting
selftests: firmware: Fix it to do root uid check and skip
scsi: libcxgbi: fix NULL pointer dereference in cxgbi_device_destroy()
gpio: mpc8xxx: Add platform device to gpiochip->parent
rtc: brcmstb-waketimer: add missed clk_disable_unprepare
rtc: msm6242: Fix reading of 10-hour digit
f2fs: fix potential overflow
rtlwifi: Remove unnecessary NULL check in rtl_regd_init
spi: atmel: fix handling of cs_change set on non-last xfer
mtd: spi-nor: fix silent truncation in spi_nor_read_raw()
mtd: spi-nor: fix silent truncation in spi_nor_read()
iommu/mediatek: Correct the flush_iotlb_all callback
media: exynos4-is: Fix recursive locking in isp_video_release()
media: v4l: cadence: Fix how unsued lanes are handled in 'csi2rx_start()'
media: rcar-vin: Fix incorrect return statement in rvin_try_format()
media: ov6650: Fix .get_fmt() V4L2_SUBDEV_FORMAT_TRY support
media: ov6650: Fix some format attributes not under control
media: ov6650: Fix incorrect use of JPEG colorspace
tty: serial: pch_uart: correct usage of dma_unmap_sg
tty: serial: imx: use the sg count from dma_map_sg
powerpc/powernv: Disable native PCIe port management
PCI/PTM: Remove spurious "d" from granularity message
PCI: dwc: Fix find_next_bit() usage
compat_ioctl: handle SIOCOUTQNSD
af_unix: add compat_ioctl support
arm64: dts: apq8096-db820c: Increase load on l21 for SDCARD
scsi: sd: enable compat ioctls for sed-opal
pinctrl: lewisburg: Update pin list according to v1.1v6
pinctl: ti: iodelay: fix error checking on pinctrl_count_index_with_args call
clk: samsung: exynos5420: Preserve CPU clocks configuration during suspend/resume
mei: fix modalias documentation
iio: imu: adis16480: assign bias value only if operation succeeded
NFSv4.x: Drop the slot if nfs4_delegreturn_prepare waits for layoutreturn
NFSv2: Fix a typo in encode_sattr()
crypto: virtio - implement missing support for output IVs
xprtrdma: Fix completion wait during device removal
platform/x86: GPD pocket fan: Use default values when wrong modparams are given
platform/x86: asus-wmi: Fix keyboard brightness cannot be set to 0
scsi: sd: Clear sdkp->protection_type if disk is reformatted without PI
scsi: enclosure: Fix stale device oops with hot replug
RDMA/srpt: Report the SCSI residual to the initiator
RDMA/mlx5: Return proper error value
btrfs: simplify inode locking for RWF_NOWAIT
drm/ttm: fix incrementing the page pointer for huge pages
drm/ttm: fix start page for huge page check in ttm_put_pages()
afs: Fix missing cell comparison in afs_test_super()
cifs: Adjust indentation in smb2_open_file
s390/qeth: Fix vnicc_is_in_use if rx_bcast not set
s390/qeth: fix false reporting of VNIC CHAR config failure
hsr: reset network header when supervision frame is created
gpio: Fix error message on out-of-range GPIO in lookup table
iommu: Remove device link to group on failure
gpio: zynq: Fix for bug in zynq_gpio_restore_context API
mtd: onenand: omap2: Pass correct flags for prep_dma_memcpy
ASoC: stm32: spdifrx: fix race condition in irq handler
ASoC: stm32: spdifrx: fix inconsistent lock state
ASoC: soc-core: Set dpcm_playback / dpcm_capture
RDMA/bnxt_re: Fix Send Work Entry state check while polling completions
RDMA/bnxt_re: Avoid freeing MR resources if dereg fails
rtc: mt6397: fix alarm register overwrite
drm/i915: Fix use-after-free when destroying GEM context
dccp: Fix memleak in __feat_register_sp
RDMA: Fix goto target to release the allocated memory
iwlwifi: pcie: fix memory leaks in iwl_pcie_ctxt_info_gen3_init
iwlwifi: dbg_ini: fix memory leak in alloc_sgtable
media: usb:zr364xx:Fix KASAN:null-ptr-deref Read in zr364xx_vidioc_querycap
f2fs: check if file namelen exceeds max value
f2fs: check memory boundary by insane namelen
f2fs: Move err variable to function scope in f2fs_fill_dentries()
mac80211: Do not send Layer 2 Update frame before authorization
cfg80211/mac80211: make ieee80211_send_layer2_update a public function
fs/select: avoid clang stack usage warning
ethtool: reduce stack usage with clang
HID: hidraw, uhid: Always report EPOLLOUT
HID: hidraw: Fix returning EPOLLOUT from hidraw_poll
hidraw: Return EPOLLOUT from hidraw_poll
ANDROID: update ABI whitelist
ANDROID: update kernel ABI for CONFIG_DUMMY
GKI: enable CONFIG_DUMMY=y
UPSTREAM: kcov: fix struct layout for kcov_remote_arg
UPSTREAM: vhost, kcov: collect coverage from vhost_worker
UPSTREAM: usb, kcov: collect coverage from hub_event
ANDROID: update kernel ABI for kcov changes
UPSTREAM: kcov: remote coverage support
UPSTREAM: kcov: improve CONFIG_ARCH_HAS_KCOV help text
UPSTREAM: kcov: convert kcov.refcount to refcount_t
UPSTREAM: kcov: no need to check return value of debugfs_create functions
GKI: enable CONFIG_NETFILTER_XT_MATCH_QUOTA2_LOG=y
Linux 4.19.96
drm/i915/gen9: Clear residual context state on context switch
netfilter: ipset: avoid null deref when IPSET_ATTR_LINENO is present
netfilter: conntrack: dccp, sctp: handle null timeout argument
netfilter: arp_tables: init netns pointer in xt_tgchk_param struct
phy: cpcap-usb: Fix flakey host idling and enumerating of devices
phy: cpcap-usb: Fix error path when no host driver is loaded
USB: Fix: Don't skip endpoint descriptors with maxpacket=0
HID: hiddev: fix mess in hiddev_open()
ath10k: fix memory leak
rtl8xxxu: prevent leaking urb
scsi: bfa: release allocated memory in case of error
mwifiex: pcie: Fix memory leak in mwifiex_pcie_alloc_cmdrsp_buf
mwifiex: fix possible heap overflow in mwifiex_process_country_ie()
tty: always relink the port
tty: link tty and port before configuring it as console
serdev: Don't claim unsupported ACPI serial devices
staging: rtl8188eu: Add device code for TP-Link TL-WN727N v5.21
staging: comedi: adv_pci1710: fix AI channels 16-31 for PCI-1713
usb: musb: dma: Correct parameter passed to IRQ handler
usb: musb: Disable pullup at init
usb: musb: fix idling for suspend after disconnect interrupt
USB: serial: option: add ZLP support for 0x1bc7/0x9010
staging: vt6656: set usb_set_intfdata on driver fail.
gpiolib: acpi: Add honor_wakeup module-option + quirk mechanism
gpiolib: acpi: Turn dmi_system_id table into a generic quirk table
can: can_dropped_invalid_skb(): ensure an initialized headroom in outgoing CAN sk_buffs
can: mscan: mscan_rx_poll(): fix rx path lockup when returning from polling to irq mode
can: gs_usb: gs_usb_probe(): use descriptors of current altsetting
can: kvaser_usb: fix interface sanity check
drm/dp_mst: correct the shifting in DP_REMOTE_I2C_READ
drm/fb-helper: Round up bits_per_pixel if possible
drm/sun4i: tcon: Set RGB DCLK min. divider based on hardware model
Input: input_event - fix struct padding on sparc64
Input: add safety guards to input_set_keycode()
HID: hid-input: clear unmapped usages
HID: uhid: Fix returning EPOLLOUT from uhid_char_poll
HID: Fix slab-out-of-bounds read in hid_field_extract
tracing: Change offset type to s32 in preempt/irq tracepoints
tracing: Have stack tracer compile when MCOUNT_INSN_SIZE is not defined
kernel/trace: Fix do not unregister tracepoints when register sched_migrate_task fail
ALSA: hda/realtek - Add quirk for the bass speaker on Lenovo Yoga X1 7th gen
ALSA: hda/realtek - Set EAPD control to default for ALC222
ALSA: hda/realtek - Add new codec supported for ALCS1200A
ALSA: usb-audio: Apply the sample rate quirk for Bose Companion 5
usb: chipidea: host: Disable port power only if previously enabled
i2c: fix bus recovery stop mode timing
chardev: Avoid potential use-after-free in 'chrdev_open()'
ANDROID: Enable HID_STEAM, HID_SONY, JOYSTICK_XPAD as y
ANDROID: gki_defconfig: Enable blk-crypto fallback
BACKPORT: FROMLIST: Update Inline Encryption from v5 to v6 of patch series
docs: fs-verity: mention statx() support
f2fs: support STATX_ATTR_VERITY
ext4: support STATX_ATTR_VERITY
statx: define STATX_ATTR_VERITY
docs: fs-verity: document first supported kernel version
f2fs: add support for IV_INO_LBLK_64 encryption policies
ext4: add support for IV_INO_LBLK_64 encryption policies
fscrypt: add support for IV_INO_LBLK_64 policies
fscrypt: avoid data race on fscrypt_mode::logged_impl_name
fscrypt: zeroize fscrypt_info before freeing
fscrypt: remove struct fscrypt_ctx
fscrypt: invoke crypto API for ESSIV handling
Conflicts:
Documentation/devicetree/bindings
Documentation/devicetree/bindings/bus/ti-sysc.txt
Documentation/devicetree/bindings/thermal/thermal.txt
Documentation/sysctl/vm.txt
arch/arm64/mm/mmu.c
block/blk-crypto-fallback.c
block/blk-merge.c
block/keyslot-manager.c
drivers/char/Kconfig
drivers/clk/qcom/clk-rcg2.c
drivers/gpio/gpiolib.c
drivers/hid/hid-quirks.c
drivers/irqchip/Kconfig
drivers/md/Kconfig
drivers/md/dm-default-key.c
drivers/md/dm.c
drivers/nvmem/core.c
drivers/of/Kconfig
drivers/of/fdt.c
drivers/of/irq.c
drivers/scsi/ufs/ufshcd-crypto.c
drivers/scsi/ufs/ufshcd.c
drivers/scsi/ufs/ufshcd.h
drivers/scsi/ufs/ufshci.h
drivers/usb/dwc3/gadget.c
drivers/usb/gadget/composite.c
drivers/usb/gadget/function/f_fs.c
fs/crypto/bio.c
fs/crypto/fname.c
fs/crypto/fscrypt_private.h
fs/crypto/keyring.c
fs/crypto/keysetup.c
fs/f2fs/data.c
fs/f2fs/file.c
include/crypto/skcipher.h
include/linux/gfp.h
include/linux/keyslot-manager.h
include/linux/of_fdt.h
include/sound/soc.h
kernel/sched/cpufreq_schedutil.c
kernel/sched/fair.c
kernel/sched/psi.c
kernel/sched/rt.c
kernel/sched/sched.h
kernel/sched/topology.c
kernel/sched/tune.h
kernel/sysctl.c
mm/compaction.c
mm/page_alloc.c
mm/vmscan.c
security/commoncap.c
security/selinux/avc.c
Change-Id: I9a08175c4892e533ecde8da847f75dc4874b303a
Signed-off-by: Ivaylo Georgiev <irgeorgiev@codeaurora.org>
|
||
|
Greg Kroah-Hartman
|
138a4a65f9 |
Merge 4.19.95 into android-4.19-q
Changes in 4.19.95 USB: dummy-hcd: use usb_urb_dir_in instead of usb_pipein USB: dummy-hcd: increase max number of devices to 32 bpf: Fix passing modified ctx to ld/abs/ind instruction regulator: fix use after free issue ASoC: max98090: fix possible race conditions locking/spinlock/debug: Fix various data races netfilter: ctnetlink: netns exit must wait for callbacks mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame() libtraceevent: Fix lib installation with O= x86/efi: Update e820 with reserved EFI boot services data to fix kexec breakage ASoC: Intel: bytcr_rt5640: Update quirk for Teclast X89 efi/gop: Return EFI_NOT_FOUND if there are no usable GOPs efi/gop: Return EFI_SUCCESS if a usable GOP was found efi/gop: Fix memory leak in __gop_query32/64() ARM: dts: imx6ul: imx6ul-14x14-evk.dtsi: Fix SPI NOR probing ARM: vexpress: Set-up shared OPP table instead of individual for each CPU netfilter: uapi: Avoid undefined left-shift in xt_sctp.h netfilter: nft_set_rbtree: bogus lookup/get on consecutive elements in named sets netfilter: nf_tables: validate NFT_SET_ELEM_INTERVAL_END netfilter: nf_tables: validate NFT_DATA_VALUE after nft_data_init() ARM: dts: BCM5301X: Fix MDIO node address/size cells selftests/ftrace: Fix multiple kprobe testcase ARM: dts: Cygnus: Fix MDIO node address/size cells spi: spi-cavium-thunderx: Add missing pci_release_regions() ASoC: topology: Check return value for soc_tplg_pcm_create() ARM: dts: bcm283x: Fix critical trip point bnxt_en: Return error if FW returns more data than dump length bpf, mips: Limit to 33 tail calls spi: spi-ti-qspi: Fix a bug when accessing non default CS ARM: dts: am437x-gp/epos-evm: fix panel compatible samples: bpf: Replace symbol compare of trace_event samples: bpf: fix syscall_tp due to unused syscall powerpc: Ensure that swiotlb buffer is allocated from low memory btrfs: Fix error messages in qgroup_rescan_init bpf: Clear skb->tstamp in bpf_redirect when necessary bnx2x: Do not handle requests from VFs after parity bnx2x: Fix logic to get total no. of PFs per engine cxgb4: Fix kernel panic while accessing sge_info net: usb: lan78xx: Fix error message format specifier parisc: add missing __init annotation rfkill: Fix incorrect check to avoid NULL pointer dereference ASoC: wm8962: fix lambda value regulator: rn5t618: fix module aliases iommu/iova: Init the struct iova to fix the possible memleak kconfig: don't crash on NULL expressions in expr_eq() perf/x86/intel: Fix PT PMI handling fs: avoid softlockups in s_inodes iterators net: stmmac: Do not accept invalid MTU values net: stmmac: xgmac: Clear previous RX buffer size net: stmmac: RX buffer size must be 16 byte aligned net: stmmac: Always arm TX Timer at end of transmission start s390/purgatory: do not build purgatory with kcov, kasan and friends drm/exynos: gsc: add missed component_del s390/dasd/cio: Interpret ccw_device_get_mdc return value correctly s390/dasd: fix memleak in path handling error case block: fix memleak when __blk_rq_map_user_iov() is failed parisc: Fix compiler warnings in debug_core.c llc2: Fix return statement of llc_stat_ev_rx_null_dsap_xid_c (and _test_c) hv_netvsc: Fix unwanted rx_table reset powerpc/vcpu: Assume dedicated processors as non-preempt powerpc/spinlocks: Include correct header for static key cpufreq: imx6q: read OCOTP through nvmem for imx6ul/imx6ull ARM: dts: imx6ul: use nvmem-cells for cpu speed grading PCI/switchtec: Read all 64 bits of part_event_bitmap gtp: fix bad unlock balance in gtp_encap_enable_socket macvlan: do not assume mac_header is set in macvlan_broadcast() net: dsa: mv88e6xxx: Preserve priority when setting CPU port. net: stmmac: dwmac-sun8i: Allow all RGMII modes net: stmmac: dwmac-sunxi: Allow all RGMII modes net: usb: lan78xx: fix possible skb leak pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM sch_cake: avoid possible divide by zero in cake_enqueue() sctp: free cmd->obj.chunk for the unprocessed SCTP_CMD_REPLY tcp: fix "old stuff" D-SACK causing SACK to be treated as D-SACK vxlan: fix tos value before xmit vlan: fix memory leak in vlan_dev_set_egress_priority vlan: vlan_changelink() should propagate errors mlxsw: spectrum_qdisc: Ignore grafting of invisible FIFO net: sch_prio: When ungrafting, replace with FIFO usb: dwc3: gadget: Fix request complete check USB: core: fix check for duplicate endpoints USB: serial: option: add Telit ME910G1 0x110a composition usb: missing parentheses in USE_NEW_SCHEME Linux 4.19.95 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I53325b428de3591fdf7287a1ff67ca1e913d77ab |
||
|
Daniel Borkmann
|
f70280ee89 |
bpf: Fix passing modified ctx to ld/abs/ind instruction
commit 6d4f151acf9a4f6fab09b615f246c717ddedcf0c upstream. Anatoly has been fuzzing with kBdysch harness and reported a KASAN slab oob in one of the outcomes: [...] [ 77.359642] BUG: KASAN: slab-out-of-bounds in bpf_skb_load_helper_8_no_cache+0x71/0x130 [ 77.360463] Read of size 4 at addr ffff8880679bac68 by task bpf/406 [ 77.361119] [ 77.361289] CPU: 2 PID: 406 Comm: bpf Not tainted 5.5.0-rc2-xfstests-00157-g2187f215eba #1 [ 77.362134] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 77.362984] Call Trace: [ 77.363249] dump_stack+0x97/0xe0 [ 77.363603] print_address_description.constprop.0+0x1d/0x220 [ 77.364251] ? bpf_skb_load_helper_8_no_cache+0x71/0x130 [ 77.365030] ? bpf_skb_load_helper_8_no_cache+0x71/0x130 [ 77.365860] __kasan_report.cold+0x37/0x7b [ 77.366365] ? bpf_skb_load_helper_8_no_cache+0x71/0x130 [ 77.366940] kasan_report+0xe/0x20 [ 77.367295] bpf_skb_load_helper_8_no_cache+0x71/0x130 [ 77.367821] ? bpf_skb_load_helper_8+0xf0/0xf0 [ 77.368278] ? mark_lock+0xa3/0x9b0 [ 77.368641] ? kvm_sched_clock_read+0x14/0x30 [ 77.369096] ? sched_clock+0x5/0x10 [ 77.369460] ? sched_clock_cpu+0x18/0x110 [ 77.369876] ? bpf_skb_load_helper_8+0xf0/0xf0 [ 77.370330] ___bpf_prog_run+0x16c0/0x28f0 [ 77.370755] __bpf_prog_run32+0x83/0xc0 [ 77.371153] ? __bpf_prog_run64+0xc0/0xc0 [ 77.371568] ? match_held_lock+0x1b/0x230 [ 77.371984] ? rcu_read_lock_held+0xa1/0xb0 [ 77.372416] ? rcu_is_watching+0x34/0x50 [ 77.372826] sk_filter_trim_cap+0x17c/0x4d0 [ 77.373259] ? sock_kzfree_s+0x40/0x40 [ 77.373648] ? __get_filter+0x150/0x150 [ 77.374059] ? skb_copy_datagram_from_iter+0x80/0x280 [ 77.374581] ? do_raw_spin_unlock+0xa5/0x140 [ 77.375025] unix_dgram_sendmsg+0x33a/0xa70 [ 77.375459] ? do_raw_spin_lock+0x1d0/0x1d0 [ 77.375893] ? unix_peer_get+0xa0/0xa0 [ 77.376287] ? __fget_light+0xa4/0xf0 [ 77.376670] __sys_sendto+0x265/0x280 [ 77.377056] ? __ia32_sys_getpeername+0x50/0x50 [ 77.377523] ? lock_downgrade+0x350/0x350 [ 77.377940] ? __sys_setsockopt+0x2a6/0x2c0 [ 77.378374] ? sock_read_iter+0x240/0x240 [ 77.378789] ? __sys_socketpair+0x22a/0x300 [ 77.379221] ? __ia32_sys_socket+0x50/0x50 [ 77.379649] ? mark_held_locks+0x1d/0x90 [ 77.380059] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 77.380536] __x64_sys_sendto+0x74/0x90 [ 77.380938] do_syscall_64+0x68/0x2a0 [ 77.381324] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 77.381878] RIP: 0033:0x44c070 [...] After further debugging, turns out while in case of other helper functions we disallow passing modified ctx, the special case of ld/abs/ind instruction which has similar semantics (except r6 being the ctx argument) is missing such check. Modified ctx is impossible here as bpf_skb_load_helper_8_no_cache() and others are expecting skb fields in original position, hence, add check_ctx_reg() to reject any modified ctx. Issue was first introduced back in |
||
|
Greg Kroah-Hartman
|
3e66813e88 |
Merge 4.19.92 into android-4.19-q
Changes in 4.19.92 af_packet: set defaule value for tmo fjes: fix missed check in fjes_acpi_add mod_devicetable: fix PHY module format net: dst: Force 4-byte alignment of dst_metrics net: gemini: Fix memory leak in gmac_setup_txqs net: hisilicon: Fix a BUG trigered by wrong bytes_compl net: nfc: nci: fix a possible sleep-in-atomic-context bug in nci_uart_tty_receive() net: qlogic: Fix error paths in ql_alloc_large_buffers() net: usb: lan78xx: Fix suspend/resume PHY register access error qede: Disable hardware gro when xdp prog is installed qede: Fix multicast mac configuration sctp: fully initialize v4 addr in some functions selftests: forwarding: Delete IPv6 address at the end btrfs: don't double lock the subvol_sem for rename exchange btrfs: do not call synchronize_srcu() in inode_tree_del Btrfs: fix missing data checksums after replaying a log tree btrfs: send: remove WARN_ON for readonly mount btrfs: abort transaction after failed inode updates in create_subvol btrfs: skip log replay on orphaned roots btrfs: do not leak reloc root if we fail to read the fs root btrfs: handle ENOENT in btrfs_uuid_tree_iterate Btrfs: fix removal logic of the tree mod log that leads to use-after-free issues ALSA: pcm: Avoid possible info leaks from PCM stream buffers ALSA: hda/ca0132 - Keep power on during processing DSP response ALSA: hda/ca0132 - Avoid endless loop ALSA: hda/ca0132 - Fix work handling in delayed HP detection drm: mst: Fix query_payload ack reply struct drm/panel: Add missing drm_panel_init() in panel drivers drm/bridge: analogix-anx78xx: silence -EPROBE_DEFER warnings iio: light: bh1750: Resolve compiler warning and make code more readable drm/amdgpu: grab the id mgr lock while accessing passid_mapping spi: Add call to spi_slave_abort() function when spidev driver is released staging: rtl8192u: fix multiple memory leaks on error path staging: rtl8188eu: fix possible null dereference rtlwifi: prevent memory leak in rtl_usb_probe libertas: fix a potential NULL pointer dereference ath10k: fix backtrace on coredump IB/iser: bound protection_sg size by data_sg size media: am437x-vpfe: Setting STD to current value is not an error media: i2c: ov2659: fix s_stream return value media: ov6650: Fix crop rectangle alignment not passed back media: i2c: ov2659: Fix missing 720p register config media: ov6650: Fix stored frame format not in sync with hardware media: ov6650: Fix stored crop rectangle not in sync with hardware tools/power/cpupower: Fix initializer override in hsw_ext_cstates media: venus: core: Fix msm8996 frequency table ath10k: fix offchannel tx failure when no ath10k_mac_tx_frm_has_freq pinctrl: devicetree: Avoid taking direct reference to device name string drm/amdkfd: fix a potential NULL pointer dereference (v2) selftests/bpf: Correct path to include msg + path media: venus: Fix occasionally failures to suspend usb: renesas_usbhs: add suspend event support in gadget mode hwrng: omap3-rom - Call clk_disable_unprepare() on exit only if not idled regulator: max8907: Fix the usage of uninitialized variable in max8907_regulator_probe() media: flexcop-usb: fix NULL-ptr deref in flexcop_usb_transfer_init() media: cec-funcs.h: add status_req checks drm/bridge: dw-hdmi: Refuse DDC/CI transfers on the internal I2C controller samples: pktgen: fix proc_cmd command result check logic block: Fix writeback throttling W=1 compiler warnings mwifiex: pcie: Fix memory leak in mwifiex_pcie_init_evt_ring drm/drm_vblank: Change EINVAL by the correct errno media: cx88: Fix some error handling path in 'cx8800_initdev()' media: ti-vpe: vpe: Fix Motion Vector vpdma stride media: ti-vpe: vpe: fix a v4l2-compliance warning about invalid pixel format media: ti-vpe: vpe: fix a v4l2-compliance failure about frame sequence number media: ti-vpe: vpe: Make sure YUYV is set as default format media: ti-vpe: vpe: fix a v4l2-compliance failure causing a kernel panic media: ti-vpe: vpe: ensure buffers are cleaned up properly in abort cases media: ti-vpe: vpe: fix a v4l2-compliance failure about invalid sizeimage syscalls/x86: Use the correct function type in SYSCALL_DEFINE0 drm/amd/display: Fix dongle_caps containing stale information. extcon: sm5502: Reset registers during initialization x86/mm: Use the correct function type for native_set_fixmap() ath10k: Correct error handling of dma_map_single() drm/bridge: dw-hdmi: Restore audio when setting a mode perf test: Report failure for mmap events perf report: Add warning when libunwind not compiled in usb: usbfs: Suppress problematic bind and unbind uevents. iio: adc: max1027: Reset the device at probe time Bluetooth: missed cpu_to_le16 conversion in hci_init4_req Bluetooth: Workaround directed advertising bug in Broadcom controllers Bluetooth: hci_core: fix init for HCI_USER_CHANNEL bpf/stackmap: Fix deadlock with rq_lock in bpf_get_stack() x86/mce: Lower throttling MCE messages' priority to warning perf tests: Disable bp_signal testing for arm64 drm/gma500: fix memory disclosures due to uninitialized bytes rtl8xxxu: fix RTL8723BU connection failure issue after warm reboot ipmi: Don't allow device module unload when in use x86/ioapic: Prevent inconsistent state when moving an interrupt media: smiapp: Register sensor after enabling runtime PM on the device md/bitmap: avoid race window between md_bitmap_resize and bitmap_file_clear_bit arm64: psci: Reduce the waiting time for cpu_psci_cpu_kill() i40e: initialize ITRN registers with correct values net: phy: dp83867: enable robust auto-mdix drm/tegra: sor: Use correct SOR index on Tegra210 spi: sprd: adi: Add missing lock protection when rebooting ACPI: button: Add DMI quirk for Medion Akoya E2215T RDMA/qedr: Fix memory leak in user qp and mr gpu: host1x: Allocate gather copy for host1x net: dsa: LAN9303: select REGMAP when LAN9303 enable phy: qcom-usb-hs: Fix extcon double register after power cycle s390/time: ensure get_clock_monotonic() returns monotonic values s390/mm: add mm_pxd_folded() checks to pxd_free() net: hns3: add struct netdev_queue debug info for TX timeout libata: Ensure ata_port probe has completed before detach loop: fix no-unmap write-zeroes request behavior pinctrl: sh-pfc: sh7734: Fix duplicate TCLK1_B iio: dln2-adc: fix iio_triggered_buffer_postenable() position libbpf: Fix error handling in bpf_map__reuse_fd() Bluetooth: Fix advertising duplicated flags pinctrl: amd: fix __iomem annotation in amd_gpio_irq_handler() ixgbe: protect TX timestamping from API misuse media: rcar_drif: fix a memory disclosure media: v4l2-core: fix touch support in v4l_g_fmt nvmem: imx-ocotp: reset error status on probe rfkill: allocate static minor bnx2x: Fix PF-VF communication over multi-cos queues. spi: img-spfi: fix potential double release ALSA: timer: Limit max amount of slave instances rtlwifi: fix memory leak in rtl92c_set_fw_rsvdpagepkt() perf probe: Fix to find range-only function instance perf probe: Fix to list probe event with correct line number perf jevents: Fix resource leak in process_mapfile() and main() perf probe: Walk function lines in lexical blocks perf probe: Fix to probe an inline function which has no entry pc perf probe: Fix to show ranges of variables in functions without entry_pc perf probe: Fix to show inlined function callsite without entry_pc libsubcmd: Use -O0 with DEBUG=1 perf probe: Fix to probe a function which has no entry pc perf tools: Splice events onto evlist even on error drm/amdgpu: disallow direct upload save restore list from gfx driver drm/amdgpu: fix potential double drop fence reference xen/gntdev: Use select for DMA_SHARED_BUFFER perf parse: If pmu configuration fails free terms perf probe: Skip overlapped location on searching variables perf probe: Return a better scope DIE if there is no best scope perf probe: Fix to show calling lines of inlined functions perf probe: Skip end-of-sequence and non statement lines perf probe: Filter out instances except for inlined subroutine and subprogram ath10k: fix get invalid tx rate for Mesh metric fsi: core: Fix small accesses and unaligned offsets via sysfs media: pvrusb2: Fix oops on tear-down when radio support is not present soundwire: intel: fix PDI/stream mapping for Bulk crypto: atmel - Fix authenc support when it is set to m ice: delay less media: si470x-i2c: add missed operations in remove EDAC/ghes: Fix grain calculation spi: pxa2xx: Add missed security checks ASoC: rt5677: Mark reg RT5677_PWR_ANLG2 as volatile iio: dac: ad5446: Add support for new AD5600 DAC ASoC: Intel: kbl_rt5663_rt5514_max98927: Add dmic format constraint s390/disassembler: don't hide instruction addresses nvme: Discard workaround for non-conformant devices parport: load lowlevel driver if ports not found bcache: fix static checker warning in bcache_device_free() cpufreq: Register drivers only after CPU devices have been registered x86/crash: Add a forward declaration of struct kimage tracing: use kvcalloc for tgid_map array allocation tracing/kprobe: Check whether the non-suffixed symbol is notrace bcache: fix deadlock in bcache_allocator iwlwifi: mvm: fix unaligned read of rx_pkt_status ASoC: wm8904: fix regcache handling spi: tegra20-slink: add missed clk_unprepare tun: fix data-race in gro_normal_list() crypto: virtio - deal with unsupported input sizes mmc: tmio: Add MMC_CAP_ERASE to allow erase/discard/trim requests btrfs: don't prematurely free work in end_workqueue_fn() btrfs: don't prematurely free work in run_ordered_work() ASoC: wm2200: add missed operations in remove and probe failure spi: st-ssc4: add missed pm_runtime_disable ASoC: wm5100: add missed pm_runtime_disable ASoC: Intel: bytcr_rt5640: Update quirk for Acer Switch 10 SW5-012 2-in-1 x86/insn: Add some Intel instructions to the opcode map brcmfmac: remove monitor interface when detaching iwlwifi: check kasprintf() return value fbtft: Make sure string is NULL terminated net: ethernet: ti: ale: clean ale tbl on init and intf restart crypto: sun4i-ss - Fix 64-bit size_t warnings crypto: sun4i-ss - Fix 64-bit size_t warnings on sun4i-ss-hash.c mac80211: consider QoS Null frames for STA_NULLFUNC_ACKED crypto: vmx - Avoid weird build failures libtraceevent: Fix memory leakage in copy_filter_type mips: fix build when "48 bits virtual memory" is enabled drm/amdgpu: fix bad DMA from INTERRUPT_CNTL2 net: phy: initialise phydev speed and duplex sanely btrfs: don't prematurely free work in reada_start_machine_worker() btrfs: don't prematurely free work in scrub_missing_raid56_worker() Revert "mmc: sdhci: Fix incorrect switch to HS mode" mmc: mediatek: fix CMD_TA to 2 for MT8173 HS200/HS400 mode can: kvaser_usb: kvaser_usb_leaf: Fix some info-leaks to USB devices usb: xhci: Fix build warning seen with CONFIG_PM=n drm/amdgpu: fix uninitialized variable pasid_mapping_needed s390/ftrace: fix endless recursion in function_graph tracer btrfs: return error pointer from alloc_test_extent_buffer usbip: Fix receive error in vhci-hcd when using scatter-gather usbip: Fix error path of vhci_recv_ret_submit() cpufreq: Avoid leaving stale IRQ work items during CPU offline USB: EHCI: Do not return -EPIPE when hub is disconnected intel_th: pci: Add Comet Lake PCH-V support intel_th: pci: Add Elkhart Lake SOC support platform/x86: hp-wmi: Make buffer for HPWMI_FEATURE2_QUERY 128 bytes staging: comedi: gsc_hpdi: check dma_alloc_coherent() return value ext4: fix ext4_empty_dir() for directories with holes ext4: check for directory entries too close to block end ext4: unlock on error in ext4_expand_extra_isize() KVM: arm64: Ensure 'params' is initialised when looking up sys register x86/MCE/AMD: Do not use rdmsr_safe_on_cpu() in smca_configure() x86/MCE/AMD: Allow Reserved types to be overwritten in smca_banks[] powerpc/vcpu: Assume dedicated processors as non-preempt powerpc/irq: fix stack overflow verification mmc: sdhci-msm: Correct the offset and value for DDR_CONFIG register mmc: sdhci-of-esdhc: Revert "mmc: sdhci-of-esdhc: add erratum A-009204 support" mmc: sdhci: Update the tuning failed messages to pr_debug level mmc: sdhci-of-esdhc: fix P2020 errata handling mmc: sdhci: Workaround broken command queuing on Intel GLK mmc: sdhci: Add a quirk for broken command queuing nbd: fix shutdown and recv work deadlock v2 perf probe: Fix to show function entry line as probe-able Linux 4.19.92 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: If5b3537932bcabaffceef591cf1a4c1b71d7874e |
||
|
Song Liu
|
a7f4da875c |
bpf/stackmap: Fix deadlock with rq_lock in bpf_get_stack()
[ Upstream commit eac9153f2b584c702cea02c1f1a57d85aa9aea42 ]
bpf stackmap with build-id lookup (BPF_F_STACK_BUILD_ID) can trigger A-A
deadlock on rq_lock():
rcu: INFO: rcu_sched detected stalls on CPUs/tasks:
[...]
Call Trace:
try_to_wake_up+0x1ad/0x590
wake_up_q+0x54/0x80
rwsem_wake+0x8a/0xb0
bpf_get_stack+0x13c/0x150
bpf_prog_fbdaf42eded9fe46_on_event+0x5e3/0x1000
bpf_overflow_handler+0x60/0x100
__perf_event_overflow+0x4f/0xf0
perf_swevent_overflow+0x99/0xc0
___perf_sw_event+0xe7/0x120
__schedule+0x47d/0x620
schedule+0x29/0x90
futex_wait_queue_me+0xb9/0x110
futex_wait+0x139/0x230
do_futex+0x2ac/0xa50
__x64_sys_futex+0x13c/0x180
do_syscall_64+0x42/0x100
entry_SYSCALL_64_after_hwframe+0x44/0xa9
This can be reproduced by:
1. Start a multi-thread program that does parallel mmap() and malloc();
2. taskset the program to 2 CPUs;
3. Attach bpf program to trace_sched_switch and gather stackmap with
build-id, e.g. with trace.py from bcc tools:
trace.py -U -p <pid> -s <some-bin,some-lib> t:sched:sched_switch
A sample reproducer is attached at the end.
This could also trigger deadlock with other locks that are nested with
rq_lock.
Fix this by checking whether irqs are disabled. Since rq_lock and all
other nested locks are irq safe, it is safe to do up_read() when irqs are
not disable. If the irqs are disabled, postpone up_read() in irq_work.
Fixes:
|
||
|
Greg Kroah-Hartman
|
c79e0f865d |
Merge 4.19.89 into android-4.19-q
Changes in 4.19.89
rsi: release skb if rsi_prepare_beacon fails
arm64: tegra: Fix 'active-low' warning for Jetson TX1 regulator
sparc64: implement ioremap_uc
lp: fix sparc64 LPSETTIMEOUT ioctl
usb: gadget: u_serial: add missing port entry locking
tty: serial: fsl_lpuart: use the sg count from dma_map_sg
tty: serial: msm_serial: Fix flow control
serial: pl011: Fix DMA ->flush_buffer()
serial: serial_core: Perform NULL checks for break_ctl ops
serial: ifx6x60: add missed pm_runtime_disable
autofs: fix a leak in autofs_expire_indirect()
RDMA/hns: Correct the value of HNS_ROCE_HEM_CHUNK_LEN
iwlwifi: pcie: don't consider IV len in A-MSDU
exportfs_decode_fh(): negative pinned may become positive without the parent locked
audit_get_nd(): don't unlock parent too early
NFC: nxp-nci: Fix NULL pointer dereference after I2C communication error
xfrm: release device reference for invalid state
Input: cyttsp4_core - fix use after free bug
sched/core: Avoid spurious lock dependencies
perf/core: Consistently fail fork on allocation failures
ALSA: pcm: Fix stream lock usage in snd_pcm_period_elapsed()
drm/sun4i: tcon: Set min division of TCON0_DCLK to 1.
selftests: kvm: fix build with glibc >= 2.30
rsxx: add missed destroy_workqueue calls in remove
net: ep93xx_eth: fix mismatch of request_mem_region in remove
i2c: core: fix use after free in of_i2c_notify
serial: core: Allow processing sysrq at port unlock time
cxgb4vf: fix memleak in mac_hlist initialization
iwlwifi: mvm: synchronize TID queue removal
iwlwifi: trans: Clear persistence bit when starting the FW
iwlwifi: mvm: Send non offchannel traffic via AP sta
ARM: 8813/1: Make aligned 2-byte getuser()/putuser() atomic on ARMv6+
audit: Embed key into chunk
netfilter: nf_tables: don't use position attribute on rule replacement
ARC: IOC: panic if kernel was started with previously enabled IOC
net/mlx5: Release resource on error flow
clk: sunxi-ng: a64: Fix gate bit of DSI DPHY
ice: Fix NVM mask defines
dlm: fix possible call to kfree() for non-initialized pointer
ARM: dts: exynos: Fix LDO13 min values on Odroid XU3/XU4/HC1
extcon: max8997: Fix lack of path setting in USB device mode
net: ethernet: ti: cpts: correct debug for expired txq skb
rtc: s3c-rtc: Avoid using broken ALMYEAR register
rtc: max77686: Fix the returned value in case of error in 'max77686_rtc_read_time()'
i40e: don't restart nway if autoneg not supported
virtchnl: Fix off by one error
clk: rockchip: fix rk3188 sclk_smc gate data
clk: rockchip: fix rk3188 sclk_mac_lbtest parameter ordering
ARM: dts: rockchip: Fix rk3288-rock2 vcc_flash name
dlm: fix missing idr_destroy for recover_idr
MIPS: SiByte: Enable ZONE_DMA32 for LittleSur
net: dsa: mv88e6xxx: Work around mv886e6161 SERDES missing MII_PHYSID2
scsi: zfcp: update kernel message for invalid FCP_CMND length, it's not the CDB
scsi: zfcp: drop default switch case which might paper over missing case
drivers: soc: Allow building the amlogic drivers without ARCH_MESON
bus: ti-sysc: Fix getting optional clocks in clock_roles
ARM: dts: imx6: RDU2: fix eGalax touchscreen node
crypto: ecc - check for invalid values in the key verification test
crypto: bcm - fix normal/non key hash algorithm failure
arm64: dts: zynqmp: Fix node names which contain "_"
pinctrl: qcom: ssbi-gpio: fix gpio-hog related boot issues
Staging: iio: adt7316: Fix i2c data reading, set the data field
firmware: raspberrypi: Fix firmware calls with large buffers
mm/vmstat.c: fix NUMA statistics updates
clk: rockchip: fix I2S1 clock gate register for rk3328
clk: rockchip: fix ID of 8ch clock of I2S1 for rk3328
sctp: count sk_wmem_alloc by skb truesize in sctp_packet_transmit
regulator: Fix return value of _set_load() stub
USB: serial: f81534: fix reading old/new IC config
xfs: extent shifting doesn't fully invalidate page cache
net-next/hinic:fix a bug in set mac address
net-next/hinic: fix a bug in rx data flow
ice: Fix return value from NAPI poll
ice: Fix possible NULL pointer de-reference
iomap: FUA is wrong for DIO O_DSYNC writes into unwritten extents
iomap: sub-block dio needs to zeroout beyond EOF
iomap: dio data corruption and spurious errors when pipes fill
iomap: readpages doesn't zero page tail beyond EOF
iw_cxgb4: only reconnect with MPAv1 if the peer aborts
MIPS: OCTEON: octeon-platform: fix typing
net/smc: use after free fix in smc_wr_tx_put_slot()
math-emu/soft-fp.h: (_FP_ROUND_ZERO) cast 0 to void to fix warning
nds32: Fix the items of hwcap_str ordering issue.
rtc: max8997: Fix the returned value in case of error in 'max8997_rtc_read_alarm()'
rtc: dt-binding: abx80x: fix resistance scale
ARM: dts: exynos: Use Samsung SoC specific compatible for DWC2 module
media: coda: fix memory corruption in case more than 32 instances are opened
media: pulse8-cec: return 0 when invalidating the logical address
media: cec: report Vendor ID after initialization
iwlwifi: fix cfg structs for 22000 with different RF modules
ravb: Clean up duplex handling
net/ipv6: re-do dad when interface has IFF_NOARP flag change
dmaengine: coh901318: Fix a double-lock bug
dmaengine: coh901318: Remove unused variable
dmaengine: dw-dmac: implement dma protection control setting
net: qualcomm: rmnet: move null check on dev before dereferecing it
selftests/powerpc: Allocate base registers
selftests/powerpc: Skip test instead of failing
usb: dwc3: debugfs: Properly print/set link state for HS
usb: dwc3: don't log probe deferrals; but do log other error codes
ACPI: fix acpi_find_child_device() invocation in acpi_preset_companion()
f2fs: fix to account preflush command for noflush_merge mode
f2fs: fix count of seg_freed to make sec_freed correct
f2fs: change segment to section in f2fs_ioc_gc_range
ARM: dts: rockchip: Fix the PMU interrupt number for rv1108
ARM: dts: rockchip: Assign the proper GPIO clocks for rv1108
f2fs: fix to allow node segment for GC by ioctl path
sparc: Fix JIT fused branch convergance.
sparc: Correct ctx->saw_frame_pointer logic.
nvme: Free ctrl device name on init failure
dma-mapping: fix return type of dma_set_max_seg_size()
slimbus: ngd: Fix build error on x86
altera-stapl: check for a null key before strcasecmp'ing it
serial: imx: fix error handling in console_setup
i2c: imx: don't print error message on probe defer
clk: meson: Fix GXL HDMI PLL fractional bits width
gpu: host1x: Fix syncpoint ID field size on Tegra186
lockd: fix decoding of TEST results
sctp: increase sk_wmem_alloc when head->truesize is increased
iommu/amd: Fix line-break in error log reporting
ASoC: rsnd: tidyup registering method for rsnd_kctrl_new()
ARM: dts: sun4i: Fix gpio-keys warning
ARM: dts: sun4i: Fix HDMI output DTC warning
ARM: dts: sun5i: a10s: Fix HDMI output DTC warning
ARM: dts: r8a779[01]: Disable unconnected LVDS encoders
ARM: dts: sun7i: Fix HDMI output DTC warning
ARM: dts: sun8i: a23/a33: Fix OPP DTC warnings
ARM: dts: sun8i: v3s: Change pinctrl nodes to avoid warning
dlm: NULL check before kmem_cache_destroy is not needed
ARM: debug: enable UART1 for socfpga Cyclone5
can: xilinx: fix return type of ndo_start_xmit function
nfsd: fix a warning in __cld_pipe_upcall()
bpf: btf: implement btf_name_valid_identifier()
bpf: btf: check name validity for various types
tools: bpftool: fix a bitfield pretty print issue
ASoC: au8540: use 64-bit arithmetic instead of 32-bit
ARM: OMAP1/2: fix SoC name printing
arm64: dts: meson-gxl-libretech-cc: fix GPIO lines names
arm64: dts: meson-gxbb-nanopi-k2: fix GPIO lines names
arm64: dts: meson-gxbb-odroidc2: fix GPIO lines names
arm64: dts: meson-gxl-khadas-vim: fix GPIO lines names
net/x25: fix called/calling length calculation in x25_parse_address_block
net/x25: fix null_x25_address handling
tools/bpf: make libbpf _GNU_SOURCE friendly
clk: mediatek: Drop __init from mtk_clk_register_cpumuxes()
clk: mediatek: Drop more __init markings for driver probe
soc: renesas: r8a77970-sysc: Correct names of A2DP/A2CN power domains
soc: renesas: r8a77980-sysc: Correct names of A2DP[01] power domains
soc: renesas: r8a77980-sysc: Correct A3VIP[012] power domain hierarchy
kbuild: disable dtc simple_bus_reg warnings by default
tcp: make tcp_space() aware of socket backlog
ARM: dts: mmp2: fix the gpio interrupt cell number
ARM: dts: realview-pbx: Fix duplicate regulator nodes
tcp: fix off-by-one bug on aborting window-probing socket
tcp: fix SNMP under-estimation on failed retransmission
tcp: fix SNMP TCP timeout under-estimation
modpost: skip ELF local symbols during section mismatch check
kbuild: fix single target build for external module
mtd: fix mtd_oobavail() incoherent returned value
ARM: dts: pxa: clean up USB controller nodes
clk: meson: meson8b: fix the offset of vid_pll_dco's N value
clk: sunxi-ng: h3/h5: Fix CSI_MCLK parent
clk: qcom: Fix MSM8998 resets
media: cxd2880-spi: fix probe when dvb_attach fails
ARM: dts: realview: Fix some more duplicate regulator nodes
dlm: fix invalid cluster name warning
net/mlx4_core: Fix return codes of unsupported operations
pstore/ram: Avoid NULL deref in ftrace merging failure path
powerpc/math-emu: Update macros from GCC
clk: renesas: r8a77990: Correct parent clock of DU
clk: renesas: r8a77995: Correct parent clock of DU
MIPS: OCTEON: cvmx_pko_mem_debug8: use oldest forward compatible definition
nfsd: Return EPERM, not EACCES, in some SETATTR cases
media: uvcvideo: Abstract streaming object lifetime
tty: serial: qcom_geni_serial: Fix softlock
ARM: dts: sun8i: h3: Fix the system-control register range
tty: Don't block on IO when ldisc change is pending
media: stkwebcam: Bugfix for wrong return values
firmware: qcom: scm: fix compilation error when disabled
clk: qcom: gcc-msm8998: Disable halt check of UFS clocks
sctp: frag_point sanity check
soc: renesas: r8a77990-sysc: Fix initialization order of 3DG-{A,B}
mlxsw: spectrum_router: Relax GRE decap matching check
IB/hfi1: Ignore LNI errors before DC8051 transitions to Polling state
IB/hfi1: Close VNIC sdma_progress sleep window
mlx4: Use snprintf instead of complicated strcpy
usb: mtu3: fix dbginfo in qmu_tx_zlp_error_handler
clk: renesas: rcar-gen3: Set state when registering SD clocks
ASoC: max9867: Fix power management
ARM: dts: sunxi: Fix PMU compatible strings
ARM: dts: am335x-pdu001: Fix polarity of card detection input
media: vimc: fix start stream when link is disabled
net: aquantia: fix RSS table and key sizes
sched/fair: Scale bandwidth quota and period without losing quota/period ratio precision
fuse: verify nlink
fuse: verify attributes
ALSA: hda/realtek - Enable internal speaker of ASUS UX431FLC
ALSA: hda/realtek - Enable the headset-mic on a Xiaomi's laptop
ALSA: hda/realtek - Dell headphone has noise on unmute for ALC236
ALSA: pcm: oss: Avoid potential buffer overflows
ALSA: hda - Add mute led support for HP ProBook 645 G4
Input: synaptics - switch another X1 Carbon 6 to RMI/SMbus
Input: synaptics-rmi4 - re-enable IRQs in f34v7_do_reflash
Input: synaptics-rmi4 - don't increment rmiaddr for SMBus transfers
Input: goodix - add upside-down quirk for Teclast X89 tablet
coresight: etm4x: Fix input validation for sysfs.
Input: Fix memory leak in psxpad_spi_probe
x86/mm/32: Sync only to VMALLOC_END in vmalloc_sync_all()
x86/PCI: Avoid AMD FCH XHCI USB PME# from D0 defect
xfrm interface: fix memory leak on creation
xfrm interface: avoid corruption on changelink
xfrm interface: fix list corruption for x-netns
xfrm interface: fix management of phydev
CIFS: Fix NULL-pointer dereference in smb2_push_mandatory_locks
CIFS: Fix SMB2 oplock break processing
tty: vt: keyboard: reject invalid keycodes
can: slcan: Fix use-after-free Read in slcan_open
kernfs: fix ino wrap-around detection
jbd2: Fix possible overflow in jbd2_log_space_left()
drm/msm: fix memleak on release
drm/i810: Prevent underflow in ioctl
arm64: dts: exynos: Revert "Remove unneeded address space mapping for soc node"
KVM: arm/arm64: vgic: Don't rely on the wrong pending table
KVM: x86: do not modify masked bits of shared MSRs
KVM: x86: fix presentation of TSX feature in ARCH_CAPABILITIES
KVM: x86: Grab KVM's srcu lock when setting nested state
crypto: crypto4xx - fix double-free in crypto4xx_destroy_sdr
crypto: atmel-aes - Fix IV handling when req->nbytes < ivsize
crypto: af_alg - cast ki_complete ternary op to int
crypto: ccp - fix uninitialized list head
crypto: ecdh - fix big endian bug in ECC library
crypto: user - fix memory leak in crypto_report
spi: atmel: Fix CS high support
mwifiex: update set_mac_address logic
can: ucan: fix non-atomic allocation in completion handler
RDMA/qib: Validate ->show()/store() callbacks before calling them
iomap: Fix pipe page leakage during splicing
thermal: Fix deadlock in thermal thermal_zone_device_check
vcs: prevent write access to vcsu devices
binder: Fix race between mmap() and binder_alloc_print_pages()
binder: Handle start==NULL in binder_update_page_range()
ALSA: hda - Fix pending unsol events at shutdown
md/raid0: Fix an error message in raid0_make_request()
watchdog: aspeed: Fix clock behaviour for ast2600
perf script: Fix invalid LBR/binary mismatch error
splice: don't read more than available pipe space
iomap: partially revert 4721a601099 (simulated directio short read on EFAULT)
xfs: add missing error check in xfs_prepare_shift()
ASoC: rsnd: fixup MIX kctrl registration
KVM: x86: fix out-of-bounds write in KVM_GET_EMULATED_CPUID (CVE-2019-19332)
net: qrtr: fix memort leak in qrtr_tun_write_iter
appletalk: Fix potential NULL pointer dereference in unregister_snap_client
appletalk: Set error code if register_snap_client failed
Linux 4.19.89
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ib03743db658afb561f36bf513e38754eed704fef
|
||
|
Yonghong Song
|
12c49ac4cf |
bpf: btf: check name validity for various types
[ Upstream commit eb04bbb608e683f8fd3ef7f716e2fa32dd90861f ]
This patch added name checking for the following types:
. BTF_KIND_PTR, BTF_KIND_ARRAY, BTF_KIND_VOLATILE,
BTF_KIND_CONST, BTF_KIND_RESTRICT:
the name must be null
. BTF_KIND_STRUCT, BTF_KIND_UNION: the struct/member name
is either null or a valid identifier
. BTF_KIND_ENUM: the enum type name is either null or a valid
identifier; the enumerator name must be a valid identifier.
. BTF_KIND_FWD: the name must be a valid identifier
. BTF_KIND_TYPEDEF: the name must be a valid identifier
For those places a valid name is required, the name must be
a valid C identifier. This can be relaxed later if we found
use cases for a different (non-C) frontend.
Fixes:
|
||
|
Yonghong Song
|
2f3e380d49 |
bpf: btf: implement btf_name_valid_identifier()
[ Upstream commit cdbb096adddb3f42584cecb5ec2e07c26815b71f ]
Function btf_name_valid_identifier() have been implemented in
bpf-next commit 2667a2626f4d ("bpf: btf: Add BTF_KIND_FUNC and
BTF_KIND_FUNC_PROTO"). Backport this function so later patch
can use it.
Fixes:
|
||
|
Greg Kroah-Hartman
|
47d86d5c55 |
Merge 4.19.88 into android-4.19-q
Changes in 4.19.88 clk: meson: gxbb: let sar_adc_clk_div set the parent clock rate clocksource/drivers/mediatek: Fix error handling ASoC: msm8916-wcd-analog: Fix RX1 selection in RDAC2 MUX ASoC: compress: fix unsigned integer overflow check reset: Fix memory leak in reset_control_array_put() clk: samsung: exynos5433: Fix error paths ASoC: kirkwood: fix external clock probe defer ASoC: kirkwood: fix device remove ordering clk: samsung: exynos5420: Preserve PLL configuration during suspend/resume pinctrl: cherryview: Allocate IRQ chip dynamic ARM: dts: imx6qdl-sabreauto: Fix storm of accelerometer interrupts reset: fix reset_control_ops kerneldoc comment clk: at91: avoid sleeping early clk: sunxi: Fix operator precedence in sunxi_divs_clk_setup clk: sunxi-ng: a80: fix the zero'ing of bits 16 and 18 ARM: dts: sun8i-a83t-tbs-a711: Fix WiFi resume from suspend samples/bpf: fix build by setting HAVE_ATTR_TEST to zero powerpc/bpf: Fix tail call implementation idr: Fix integer overflow in idr_for_each_entry idr: Fix idr_alloc_u32 on 32-bit systems x86/resctrl: Prevent NULL pointer dereference when reading mondata clk: ti: dra7-atl-clock: Remove ti_clk_add_alias call clk: ti: clkctrl: Fix failed to enable error with double udelay timeout net: fec: add missed clk_disable_unprepare in remove bridge: ebtables: don't crash when using dnat target in output chains can: peak_usb: report bus recovery as well can: c_can: D_CAN: c_can_chip_config(): perform a sofware reset on open can: rx-offload: can_rx_offload_queue_tail(): fix error handling, avoid skb mem leak can: rx-offload: can_rx_offload_offload_one(): do not increase the skb_queue beyond skb_queue_len_max can: rx-offload: can_rx_offload_offload_one(): increment rx_fifo_errors on queue overflow or OOM can: rx-offload: can_rx_offload_offload_one(): use ERR_PTR() to propagate error value in case of errors can: rx-offload: can_rx_offload_irq_offload_timestamp(): continue on error can: rx-offload: can_rx_offload_irq_offload_fifo(): continue on error can: flexcan: increase error counters if skb enqueueing via can_rx_offload_queue_sorted() fails can: mcp251x: mcp251x_restart_work_handler(): Fix potential force_quit race condition watchdog: meson: Fix the wrong value of left time ASoC: stm32: sai: add restriction on mmap support scripts/gdb: fix debugging modules compiled with hot/cold partitioning net: bcmgenet: use RGMII loopback for MAC reset net: bcmgenet: reapply manual settings to the PHY net: mscc: ocelot: fix __ocelot_rmw_ix prototype ceph: return -EINVAL if given fsc mount option on kernel w/o support net/fq_impl: Switch to kvmalloc() for memory allocation mac80211: fix station inactive_time shortly after boot block: drbd: remove a stray unlock in __drbd_send_protocol() pwm: bcm-iproc: Prevent unloading the driver module while in use scsi: target/tcmu: Fix queue_cmd_ring() declaration scsi: lpfc: Fix kernel Oops due to null pring pointers scsi: lpfc: Fix dif and first burst use in write commands ARM: dts: Fix up SQ201 flash access tracing: Lock event_mutex before synth_event_mutex ARM: debug-imx: only define DEBUG_IMX_UART_PORT if needed ARM: dts: imx51: Fix memory node duplication ARM: dts: imx53: Fix memory node duplication ARM: dts: imx31: Fix memory node duplication ARM: dts: imx35: Fix memory node duplication ARM: dts: imx7: Fix memory node duplication ARM: dts: imx6ul: Fix memory node duplication ARM: dts: imx6sx: Fix memory node duplication ARM: dts: imx6sl: Fix memory node duplication ARM: dts: imx50: Fix memory node duplication ARM: dts: imx23: Fix memory node duplication ARM: dts: imx1: Fix memory node duplication ARM: dts: imx27: Fix memory node duplication ARM: dts: imx25: Fix memory node duplication ARM: dts: imx53-voipac-dmm-668: Fix memory node duplication parisc: Fix serio address output parisc: Fix HP SDC hpa address output ARM: dts: Fix hsi gdd range for omap4 arm64: mm: Prevent mismatched 52-bit VA support arm64: smp: Handle errors reported by the firmware bus: ti-sysc: Check for no-reset and no-idle flags at the child level platform/x86: mlx-platform: Fix LED configuration ARM: OMAP1: fix USB configuration for device-only setups RDMA/hns: Fix the bug while use multi-hop of pbl arm64: preempt: Fix big-endian when checking preempt count in assembly RDMA/vmw_pvrdma: Use atomic memory allocation in create AH PM / AVS: SmartReflex: NULL check before some freeing functions is not needed xfs: zero length symlinks are not valid ARM: ks8695: fix section mismatch warning ACPI / LPSS: Ignore acpi_device_fix_up_power() return value scsi: lpfc: Enable Management features for IF_TYPE=6 scsi: qla2xxx: Fix NPIV handling for FC-NVMe scsi: qla2xxx: Fix for FC-NVMe discovery for NPIV port nvme: provide fallback for discard alloc failure s390/zcrypt: make sysfs reset attribute trigger queue reset crypto: user - support incremental algorithm dumps arm64: dts: renesas: draak: Fix CVBS input mwifiex: fix potential NULL dereference and use after free mwifiex: debugfs: correct histogram spacing, formatting brcmfmac: set F2 watermark to 256 for 4373 brcmfmac: set SDIO F1 MesBusyCtrl for CYW4373 rtl818x: fix potential use after free bcache: do not check if debug dentry is ERR or NULL explicitly on remove bcache: do not mark writeback_running too early xfs: require both realtime inodes to mount nvme: fix kernel paging oops ubifs: Fix default compression selection in ubifs ubi: Put MTD device after it is not used ubi: Do not drop UBI device reference before using microblaze: adjust the help to the real behavior microblaze: move "... is ready" messages to arch/microblaze/Makefile microblaze: fix multiple bugs in arch/microblaze/boot/Makefile iwlwifi: move iwl_nvm_check_version() into dvm iwlwifi: mvm: force TCM re-evaluation on TCM resume iwlwifi: pcie: fix erroneous print iwlwifi: pcie: set cmd_len in the correct place gpio: pca953x: Fix AI overflow on PCAL6524 gpiolib: Fix return value of gpio_to_desc() stub if !GPIOLIB kvm: vmx: Set IA32_TSC_AUX for legacy mode guests Revert "KVM: nVMX: reset cache/shadows when switching loaded VMCS" Revert "KVM: nVMX: move check_vmentry_postreqs() call to nested_vmx_enter_non_root_mode()" crypto/chelsio/chtls: listen fails with multiadapt VSOCK: bind to random port for VMADDR_PORT_ANY mmc: meson-gx: make sure the descriptor is stopped on errors mtd: rawnand: sunxi: Write pageprog related opcodes to WCMD_SET usb: ehci-omap: Fix deferred probe for phy handling btrfs: Check for missing device before bio submission in btrfs_map_bio btrfs: fix ncopies raid_attr for RAID56 btrfs: dev-replace: set result code of cancel by status of scrub Btrfs: allow clear_extent_dirty() to receive a cached extent state record btrfs: only track ref_heads in delayed_ref_updates serial: sh-sci: Fix crash in rx_timer_fn() on PIO fallback HID: intel-ish-hid: fixes incorrect error handling gpio: raspberrypi-exp: decrease refcount on firmware dt node serial: 8250: Rate limit serial port rx interrupts during input overruns kprobes/x86/xen: blacklist non-attachable xen interrupt functions xen/pciback: Check dev_data before using it kprobes: Blacklist symbols in arch-defined prohibited area kprobes/x86: Show x86-64 specific blacklisted symbols correctly vfio-mdev/samples: Use u8 instead of char for handle functions memory: omap-gpmc: Get the header of the enum pinctrl: xway: fix gpio-hog related boot issues net/mlx5: Continue driver initialization despite debugfs failure netfilter: nf_nat_sip: fix RTP/RTCP source port translations exofs_mount(): fix leaks on failure exits bnxt_en: Return linux standard errors in bnxt_ethtool.c bnxt_en: Save ring statistics before reset. bnxt_en: query force speeds before disabling autoneg mode. KVM: s390: unregister debug feature on failing arch init pinctrl: sh-pfc: r8a77990: Fix MOD_SEL0 SEL_I2C1 field width pinctrl: sh-pfc: sh7264: Fix PFCR3 and PFCR0 register configuration pinctrl: sh-pfc: sh7734: Fix shifted values in IPSR10 HID: doc: fix wrong data structure reference for UHID_OUTPUT dm flakey: Properly corrupt multi-page bios. gfs2: take jdata unstuff into account in do_grow dm raid: fix false -EBUSY when handling check/repair message xfs: Align compat attrlist_by_handle with native implementation. xfs: Fix bulkstat compat ioctls on x32 userspace. IB/qib: Fix an error code in qib_sdma_verbs_send() clocksource/drivers/fttmr010: Fix invalid interrupt register access vxlan: Fix error path in __vxlan_dev_create() powerpc/book3s/32: fix number of bats in p/v_block_mapped() powerpc/xmon: fix dump_segments() drivers/regulator: fix a missing check of return value Bluetooth: hci_bcm: Handle specific unknown packets after firmware loading serial: max310x: Fix tx_empty() callback openrisc: Fix broken paths to arch/or32 RDMA/srp: Propagate ib_post_send() failures to the SCSI mid-layer scsi: qla2xxx: deadlock by configfs_depend_item scsi: csiostor: fix incorrect dma device in case of vport brcmfmac: Fix access point mode ath6kl: Only use match sets when firmware supports it ath6kl: Fix off by one error in scan completion powerpc/perf: Fix unit_sel/cache_sel checks powerpc/32: Avoid unsupported flags with clang powerpc/prom: fix early DEBUG messages powerpc/mm: Make NULL pointer deferences explicit on bad page faults. powerpc/44x/bamboo: Fix PCI range vfio/spapr_tce: Get rid of possible infinite loop powerpc/powernv/eeh/npu: Fix uninitialized variables in opal_pci_eeh_freeze_status drbd: ignore "all zero" peer volume sizes in handshake drbd: reject attach of unsuitable uuids even if connected drbd: do not block when adjusting "disk-options" while IO is frozen drbd: fix print_st_err()'s prototype to match the definition IB/rxe: Make counters thread safe bpf/cpumap: make sure frame_size for build_skb is aligned if headroom isn't regulator: tps65910: fix a missing check of return value powerpc/83xx: handle machine check caused by watchdog timer powerpc/pseries: Fix node leak in update_lmb_associativity_index() powerpc: Fix HMIs on big-endian with CONFIG_RELOCATABLE=y crypto: mxc-scc - fix build warnings on ARM64 pwm: clps711x: Fix period calculation net/netlink_compat: Fix a missing check of nla_parse_nested net/net_namespace: Check the return value of register_pernet_subsys() f2fs: fix block address for __check_sit_bitmap f2fs: fix to dirty inode synchronously um: Include sys/uio.h to have writev() um: Make GCOV depend on !KCOV net: (cpts) fix a missing check of clk_prepare net: stmicro: fix a missing check of clk_prepare net: dsa: bcm_sf2: Propagate error value from mdio_write atl1e: checking the status of atl1e_write_phy_reg tipc: fix a missing check of genlmsg_put net: marvell: fix a missing check of acpi_match_device net/wan/fsl_ucc_hdlc: Avoid double free in ucc_hdlc_probe() ocfs2: clear journal dirty flag after shutdown journal vmscan: return NODE_RECLAIM_NOSCAN in node_reclaim() when CONFIG_NUMA is n mm/page_alloc.c: free order-0 pages through PCP in page_frag_free() mm/page_alloc.c: use a single function to free page mm/page_alloc.c: deduplicate __memblock_free_early() and memblock_free() tools/vm/page-types.c: fix "kpagecount returned fewer pages than expected" failures netfilter: nf_tables: fix a missing check of nla_put_failure xprtrdma: Prevent leak of rpcrdma_rep objects infiniband: bnxt_re: qplib: Check the return value of send_message infiniband/qedr: Potential null ptr dereference of qp firmware: arm_sdei: fix wrong of_node_put() in init function firmware: arm_sdei: Fix DT platform device creation lib/genalloc.c: fix allocation of aligned buffer from non-aligned chunk lib/genalloc.c: use vzalloc_node() to allocate the bitmap fork: fix some -Wmissing-prototypes warnings drivers/base/platform.c: kmemleak ignore a known leak lib/genalloc.c: include vmalloc.h mtd: Check add_mtd_device() ret code tipc: fix memory leak in tipc_nl_compat_publ_dump net/core/neighbour: tell kmemleak about hash tables ata: ahci: mvebu: do Armada 38x configuration only on relevant SoCs PCI/MSI: Return -ENOSPC from pci_alloc_irq_vectors_affinity() net/core/neighbour: fix kmemleak minimal reference count for hash tables serial: 8250: Fix serial8250 initialization crash gpu: ipu-v3: pre: don't trigger update if buffer address doesn't change sfc: suppress duplicate nvmem partition types in efx_ef10_mtd_probe ip_tunnel: Make none-tunnel-dst tunnel port work with lwtunnel decnet: fix DN_IFREQ_SIZE net/smc: prevent races between smc_lgr_terminate() and smc_conn_free() net/smc: don't wait for send buffer space when data was already sent mm/hotplug: invalid PFNs from pfn_to_online_page() xfs: end sync buffer I/O properly on shutdown error net/smc: fix sender_free computation blktrace: Show requests without sector net/smc: fix byte_order for rx_curs_confirmed tipc: fix skb may be leaky in tipc_link_input ASoC: samsung: i2s: Fix prescaler setting for the secondary DAI sfc: initialise found bitmap in efx_ef10_mtd_probe geneve: change NET_UDP_TUNNEL dependency to select net: fix possible overflow in __sk_mem_raise_allocated() net: ip_gre: do not report erspan_ver for gre or gretap net: ip6_gre: do not report erspan_ver for ip6gre or ip6gretap sctp: don't compare hb_timer expire date before starting it bpf: decrease usercnt if bpf_map_new_fd() fails in bpf_map_get_fd_by_id() mmc: core: align max segment size with logical block size net: dev: Use unsigned integer as an argument to left-shift kvm: properly check debugfs dentry before using it bpf: drop refcount if bpf_map_new_fd() fails in map_create() net: hns3: Change fw error code NOT_EXEC to NOT_SUPPORTED net: hns3: fix PFC not setting problem for DCB module net: hns3: fix an issue for hclgevf_ae_get_hdev net: hns3: fix an issue for hns3_update_new_int_gl iommu/amd: Fix NULL dereference bug in match_hid_uid apparmor: delete the dentry in aafs_remove() to avoid a leak scsi: libsas: Support SATA PHY connection rate unmatch fixing during discovery ACPI / APEI: Don't wait to serialise with oops messages when panic()ing ACPI / APEI: Switch estatus pool to use vmalloc memory scsi: hisi_sas: shutdown axi bus to avoid exception CQ returned scsi: libsas: Check SMP PHY control function result RDMA/hns: Fix the bug with updating rq head pointer when flush cqe RDMA/hns: Bugfix for the scene without receiver queue RDMA/hns: Fix the state of rereg mr RDMA/hns: Use GFP_ATOMIC in hns_roce_v2_modify_qp ASoC: rt5645: Headphone Jack sense inverts on the LattePanda board powerpc/pseries/dlpar: Fix a missing check in dlpar_parse_cc_property() xdp: fix cpumap redirect SKB creation bug mtd: Remove a debug trace in mtdpart.c mm, gup: add missing refcount overflow checks on s390 clk: at91: fix update bit maps on CFG_MOR write clk: at91: generated: set audio_pll_allowed in at91_clk_register_generated() usb: dwc2: use a longer core rest timeout in dwc2_core_reset() staging: rtl8192e: fix potential use after free staging: rtl8723bs: Drop ACPI device ids staging: rtl8723bs: Add 024c:0525 to the list of SDIO device-ids USB: serial: ftdi_sio: add device IDs for U-Blox C099-F9P mei: bus: prefix device names on bus with the bus name mei: me: add comet point V device id thunderbolt: Power cycle the router if NVM authentication fails xfrm: Fix memleak on xfrm state destroy media: v4l2-ctrl: fix flags for DO_WHITE_BALANCE net: macb: fix error format in dev_err() pwm: Clear chip_data in pwm_put() media: atmel: atmel-isc: fix asd memory allocation media: atmel: atmel-isc: fix INIT_WORK misplacement macvlan: schedule bc_work even if error net: psample: fix skb_over_panic openvswitch: fix flow command message size sctp: Fix memory leak in sctp_sf_do_5_2_4_dupcook slip: Fix use-after-free Read in slip_open openvswitch: drop unneeded BUG_ON() in ovs_flow_cmd_build_info() openvswitch: remove another BUG_ON() selftests: bpf: test_sockmap: handle file creation failures gracefully tipc: fix link name length check sctp: cache netns in sctp_ep_common net: sched: fix `tc -s class show` no bstats on class with nolock subqueues net: macb: add missed tasklet_kill ext4: add more paranoia checking in ext4_expand_extra_isize handling watchdog: sama5d4: fix WDD value to be always set to max net: macb: Fix SUBNS increment and increase resolution net: macb driver, check for SKBTX_HW_TSTAMP mtd: rawnand: atmel: Fix spelling mistake in error message mtd: rawnand: atmel: fix possible object reference leak mtd: spi-nor: cast to u64 to avoid uint overflows drm/atmel-hlcdc: revert shift by 8 mailbox: stm32_ipcc: add spinlock to fix channels concurrent access tcp: exit if nothing to retransmit on RTO timeout HID: core: check whether Usage Page item is after Usage ID items crypto: stm32/hash - Fix hmac issue more than 256 bytes media: stm32-dcmi: fix DMA corruption when stopping streaming media: stm32-dcmi: fix check of pm_runtime_get_sync return value hwrng: stm32 - fix unbalanced pm_runtime_enable clk: stm32mp1: fix HSI divider flag clk: stm32mp1: fix mcu divider table clk: stm32mp1: add CLK_SET_RATE_NO_REPARENT to Kernel clocks clk: stm32mp1: parent clocks update mailbox: mailbox-test: fix null pointer if no mmio pinctrl: stm32: fix memory leak issue ASoC: stm32: i2s: fix dma configuration ASoC: stm32: i2s: fix 16 bit format support ASoC: stm32: i2s: fix IRQ clearing ASoC: stm32: sai: add missing put_device() dmaengine: stm32-dma: check whether length is aligned on FIFO threshold platform/x86: hp-wmi: Fix ACPI errors caused by too small buffer platform/x86: hp-wmi: Fix ACPI errors caused by passing 0 as input size net: fec: fix clock count mis-match Linux 4.19.88 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ib17de804b245aa3da465ddc97270b8c7bd9fba66 |
||
|
Jesper Dangaard Brouer
|
7d8677ff10 |
xdp: fix cpumap redirect SKB creation bug
[ Upstream commit 676e4a6fe703f2dae699ee9d56f14516f9ada4ea ] We want to avoid leaking pointer info from xdp_frame (that is placed in top of frame) like commit |
||
|
Peng Sun
|
1a5df073d0 |
bpf: drop refcount if bpf_map_new_fd() fails in map_create()
[ Upstream commit 352d20d611414715353ee65fc206ee57ab1a6984 ]
In bpf/syscall.c, map_create() first set map->usercnt to 1, a file
descriptor is supposed to return to userspace. When bpf_map_new_fd()
fails, drop the refcount.
Fixes:
|
||
|
Peng Sun
|
944df7b4b9 |
bpf: decrease usercnt if bpf_map_new_fd() fails in bpf_map_get_fd_by_id()
[ Upstream commit 781e62823cb81b972dc8652c1827205cda2ac9ac ]
In bpf/syscall.c, bpf_map_get_fd_by_id() use bpf_map_inc_not_zero()
to increase the refcount, both map->refcnt and map->usercnt. Then, if
bpf_map_new_fd() fails, should handle map->usercnt too.
Fixes:
|
||
|
Jesper Dangaard Brouer
|
f0910af753 |
bpf/cpumap: make sure frame_size for build_skb is aligned if headroom isn't
[ Upstream commit 77ea5f4cbe2084db9ab021ba73fb7eadf1610884 ]
The frame_size passed to build_skb must be aligned, else it is
possible that the embedded struct skb_shared_info gets unaligned.
For correctness make sure that xdpf->headroom in included in the
alignment. No upstream drivers can hit this, as all XDP drivers provide
an aligned headroom. This was discovered when playing with implementing
XDP support for mvneta, which have a 2 bytes DSA header, and this
Marvell ARM64 platform didn't like doing atomic operations on an
unaligned skb_shinfo(skb)->dataref addresses.
Fixes:
|
||
|
Greg Kroah-Hartman
|
ead6fb7317 |
Merge 4.19.87 into android-4.19-q
Changes in 4.19.87 mlxsw: spectrum_router: Fix determining underlay for a GRE tunnel net/mlx4_en: fix mlx4 ethtool -N insertion net/mlx4_en: Fix wrong limitation for number of TX rings net: rtnetlink: prevent underflows in do_setvfinfo() net/sched: act_pedit: fix WARN() in the traffic path net: sched: ensure opts_len <= IP_TUNNEL_OPTS_MAX in act_tunnel_key sfc: Only cancel the PPS workqueue if it exists net/mlx5e: Fix set vf link state error flow net/mlxfw: Verify FSM error code translation doesn't exceed array size net/mlx5: Fix auto group size calculation vhost/vsock: split packets to send using multiple buffers gpio: max77620: Fixup debounce delays tools: gpio: Correctly add make dependencies for gpio_utils nbd:fix memory leak in nbd_get_socket() virtio_console: allocate inbufs in add_port() only if it is needed Revert "fs: ocfs2: fix possible null-pointer dereferences in ocfs2_xa_prepare_entry()" mm/ksm.c: don't WARN if page is still mapped in remove_stable_node() drm/amd/powerplay: issue no PPSMC_MSG_GetCurrPkgPwr on unsupported ASICs drm/i915/pmu: "Frequency" is reported as accumulated cycles drm/i915/userptr: Try to acquire the page lock around set_page_dirty() mwifiex: Fix NL80211_TX_POWER_LIMITED ALSA: isight: fix leak of reference to firewire unit in error path of .probe callback crypto: testmgr - fix sizeof() on COMP_BUF_SIZE printk: lock/unlock console only for new logbuf entries printk: fix integer overflow in setup_log_buf() pinctrl: madera: Fix uninitialized variable bug in madera_mux_set_mux PCI: cadence: Write MSI data with 32bits gfs2: Fix marking bitmaps non-full pty: fix compat ioctls synclink_gt(): fix compat_ioctl() powerpc: Fix signedness bug in update_flash_db() powerpc/boot: Fix opal console in boot wrapper powerpc/boot: Disable vector instructions powerpc/eeh: Fix null deref for devices removed during EEH powerpc/eeh: Fix use of EEH_PE_KEEP on wrong field EDAC, thunderx: Fix memory leak in thunderx_l2c_threaded_isr() mt76: do not store aggregation sequence number for null-data frames mt76x0: phy: fix restore phase in mt76x0_phy_recalibrate_after_assoc brcmsmac: AP mode: update beacon when TIM changes ath10k: set probe request oui during driver start ath10k: allocate small size dma memory in ath10k_pci_diag_write_mem skd: fixup usage of legacy IO API cdrom: don't attempt to fiddle with cdo->capability spi: sh-msiof: fix deferred probing mmc: mediatek: fill the actual clock for mmc debugfs mmc: mediatek: fix cannot receive new request when msdc_cmd_is_ready fail PCI: mediatek: Fix class type for MT7622 to PCI_CLASS_BRIDGE_PCI btrfs: defrag: use btrfs_mod_outstanding_extents in cluster_pages_for_defrag btrfs: handle error of get_old_root gsmi: Fix bug in append_to_eventlog sysfs handler misc: mic: fix a DMA pool free failure w1: IAD Register is yet readable trough iad sys file. Fix snprintf (%u for unsigned, count for max size). m68k: fix command-line parsing when passed from u-boot scsi: hisi_sas: Feed back linkrate(max/min) when re-attached scsi: hisi_sas: Fix the race between IO completion and timeout for SMP/internal IO scsi: hisi_sas: Free slot later in slot_complete_vx_hw() RDMA/bnxt_re: Avoid NULL check after accessing the pointer RDMA/bnxt_re: Fix qp async event reporting RDMA/bnxt_re: Avoid resource leak in case the NQ registration fails pinctrl: sunxi: Fix a memory leak in 'sunxi_pinctrl_build_state()' pwm: lpss: Only set update bit if we are actually changing the settings amiflop: clean up on errors during setup qed: Align local and global PTT to propagate through the APIs. scsi: ips: fix missing break in switch nfp: bpf: protect against mis-initializing atomic counters KVM: nVMX: reset cache/shadows when switching loaded VMCS KVM: nVMX: move check_vmentry_postreqs() call to nested_vmx_enter_non_root_mode() KVM/x86: Fix invvpid and invept register operand size in 64-bit mode clk: tegra: Fixes for MBIST work around scsi: isci: Use proper enumerated type in atapi_d2h_reg_frame_handler scsi: isci: Change sci_controller_start_task's return type to sci_status scsi: bfa: Avoid implicit enum conversion in bfad_im_post_vendor_event scsi: iscsi_tcp: Explicitly cast param in iscsi_sw_tcp_host_get_param crypto: ccree - avoid implicit enum conversion nvmet: avoid integer overflow in the discard code nvmet-fcloop: suppress a compiler warning nvme-pci: fix hot removal during error handling PCI: mediatek: Fixup MSI enablement logic by enabling MSI before clocks clk: mmp2: fix the clock id for sdh2_clk and sdh3_clk clk: at91: audio-pll: fix audio pmc type ASoC: tegra_sgtl5000: fix device_node refcounting scsi: dc395x: fix dma API usage in srb_done scsi: dc395x: fix DMA API usage in sg_update_list scsi: zorro_esp: Limit DMA transfers to 65535 bytes net: dsa: mv88e6xxx: Fix 88E6141/6341 2500mbps SERDES speed net: fix warning in af_unix net: ena: Fix Kconfig dependency on X86 xfs: fix use-after-free race in xfs_buf_rele xfs: clear ail delwri queued bufs on unmount of shutdown fs kprobes, x86/ptrace.h: Make regs_get_kernel_stack_nth() not fault on bad stack ACPI / scan: Create platform device for INT33FE ACPI nodes PM / Domains: Deal with multiple states but no governor in genpd ALSA: i2c/cs8427: Fix int to char conversion macintosh/windfarm_smu_sat: Fix debug output PCI: vmd: Detach resources after stopping root bus USB: misc: appledisplay: fix backlight update_status return code usbip: tools: fix atoi() on non-null terminated string sctp: use sk_wmem_queued to check for writable space dm raid: avoid bitmap with raid4/5/6 journal device selftests/bpf: fix file resource leak in load_kallsyms SUNRPC: Fix a compile warning for cmpxchg64() sunrpc: safely reallow resvport min/max inversion atm: zatm: Fix empty body Clang warnings s390/perf: Return error when debug_register fails swiotlb: do not panic on mapping failures spi: omap2-mcspi: Set FIFO DMA trigger level to word length x86/intel_rdt: Prevent pseudo-locking from using stale pointers sparc: Fix parport build warnings. scsi: hisi_sas: Fix NULL pointer dereference powerpc/pseries: Export raw per-CPU VPA data via debugfs powerpc/mm/radix: Fix off-by-one in split mapping logic powerpc/mm/radix: Fix overuse of small pages in splitting logic powerpc/mm/radix: Fix small page at boundary when splitting powerpc/64s/radix: Fix radix__flush_tlb_collapsed_pmd double flushing pmd selftests/bpf: fix return value comparison for tests in test_libbpf.sh tools: bpftool: fix completion for "bpftool map update" ceph: fix dentry leak in ceph_readdir_prepopulate ceph: only allow punch hole mode in fallocate rtc: s35390a: Change buf's type to u8 in s35390a_init RISC-V: Avoid corrupting the upper 32-bit of phys_addr_t in ioremap thermal: armada: fix a test in probe() f2fs: fix to spread clear_cold_data() f2fs: spread f2fs_set_inode_flags() mISDN: Fix type of switch control variable in ctrl_teimanager qlcnic: fix a return in qlcnic_dcb_get_capability() net: ethernet: ti: cpsw: unsync mcast entries while switch promisc mode mfd: arizona: Correct calling of runtime_put_sync mfd: mc13xxx-core: Fix PMIC shutdown when reading ADC values mfd: intel_soc_pmic_bxtwc: Chain power button IRQs as well mfd: max8997: Enale irq-wakeup unconditionally net: socionext: Stop PHY before resetting netsec fs/cifs: fix uninitialised variable warnings spi: uniphier: fix incorrect property items selftests/ftrace: Fix to test kprobe $comm arg only if available selftests: watchdog: fix message when /dev/watchdog open fails selftests: watchdog: Fix error message. selftests: kvm: Fix -Wformat warnings selftests: fix warning: "_GNU_SOURCE" redefined thermal: rcar_thermal: fix duplicate IRQ request thermal: rcar_thermal: Prevent hardware access during system suspend net: ethernet: cadence: fix socket buffer corruption problem bpf: devmap: fix wrong interface selection in notifier_call bpf, btf: fix a missing check bug in btf_parse powerpc/process: Fix flush_all_to_thread for SPE sparc64: Rework xchg() definition to avoid warnings. arm64: lib: use C string functions with KASAN enabled fs/ocfs2/dlm/dlmdebug.c: fix a sleep-in-atomic-context bug in dlm_print_one_mle() mm/page-writeback.c: fix range_cyclic writeback vs writepages deadlock tools/testing/selftests/vm/gup_benchmark.c: fix 'write' flag usage mm: thp: fix MADV_DONTNEED vs migrate_misplaced_transhuge_page race condition macsec: update operstate when lower device changes macsec: let the administrator set UP state even if lowerdev is down block: fix the DISCARD request merge i2c: uniphier-f: make driver robust against concurrency i2c: uniphier-f: fix occasional timeout error i2c: uniphier-f: fix race condition when IRQ is cleared um: Make line/tty semantics use true write IRQ vfs: avoid problematic remapping requests into partial EOF block ipv4/igmp: fix v1/v2 switchback timeout based on rfc3376, 8.12 powerpc/xmon: Relax frame size for clang selftests/powerpc/ptrace: Fix out-of-tree build selftests/powerpc/signal: Fix out-of-tree build selftests/powerpc/switch_endian: Fix out-of-tree build selftests/powerpc/cache_shape: Fix out-of-tree build block: call rq_qos_exit() after queue is frozen mm/gup_benchmark.c: prevent integer overflow in ioctl linux/bitmap.h: handle constant zero-size bitmaps correctly linux/bitmap.h: fix type of nbits in bitmap_shift_right() lib/bitmap.c: fix remaining space computation in bitmap_print_to_pagebuf hfsplus: fix BUG on bnode parent update hfs: fix BUG on bnode parent update hfsplus: prevent btree data loss on ENOSPC hfs: prevent btree data loss on ENOSPC hfsplus: fix return value of hfsplus_get_block() hfs: fix return value of hfs_get_block() hfsplus: update timestamps on truncate() hfs: update timestamp on truncate() fs/hfs/extent.c: fix array out of bounds read of array extent kernel/panic.c: do not append newline to the stack protector panic string mm/memory_hotplug: make add_memory() take the device_hotplug_lock mm/memory_hotplug: fix online/offline_pages called w.o. mem_hotplug_lock powerpc/powernv: hold device_hotplug_lock when calling device_online() igb: shorten maximum PHC timecounter update interval fm10k: ensure completer aborts are marked as non-fatal after a resume net: hns3: bugfix for buffer not free problem during resetting net: hns3: bugfix for reporting unknown vector0 interrupt repeatly problem net: hns3: bugfix for is_valid_csq_clean_head() net: hns3: bugfix for hclge_mdio_write and hclge_mdio_read ntb_netdev: fix sleep time mismatch ntb: intel: fix return value for ndev_vec_mask() irq/matrix: Fix memory overallocation nvme-pci: fix conflicting p2p resource adds arm64: makefile fix build of .i file in external module case tools/power turbosat: fix AMD APIC-id output mm: handle no memcg case in memcg_kmem_charge() properly ocfs2: without quota support, avoid calling quota recovery ocfs2: don't use iocb when EIOCBQUEUED returns ocfs2: don't put and assigning null to bh allocated outside ocfs2: fix clusters leak in ocfs2_defrag_extent() net: do not abort bulk send on BQL status sched/topology: Fix off by one bug sched/fair: Don't increase sd->balance_interval on newidle balance openvswitch: fix linking without CONFIG_NF_CONNTRACK_LABELS ARM: dts: imx6sx-sdb: Fix enet phy regulator clk: sunxi-ng: enable so-said LDOs for A64 SoC's pll-mipi clock soc: bcm: brcmstb: Fix re-entry point with a THUMB2_KERNEL audit: print empty EXECVE args sock_diag: fix autoloading of the raw_diag module net: bpfilter: fix iptables failure if bpfilter_umh is disabled nds32: Fix bug in bitfield.h media: ov13858: Check for possible null pointer btrfs: avoid link error with CONFIG_NO_AUTO_INLINE wil6210: fix debugfs memory access alignment wil6210: fix L2 RX status handling wil6210: fix RGF_CAF_ICR address for Talyn-MB wil6210: fix locking in wmi_call ath10k: snoc: fix unbalanced clock error handling wlcore: Fix the return value in case of error in 'wlcore_vendor_cmd_smart_config_start()' rtl8xxxu: Fix missing break in switch brcmsmac: never log "tid x is not agg'able" by default wireless: airo: potential buffer overflow in sprintf() rtlwifi: rtl8192de: Fix misleading REG_MCUFWDL information net: dsa: bcm_sf2: Turn on PHY to allow successful registration scsi: mpt3sas: Fix Sync cache command failure during driver unload scsi: mpt3sas: Don't modify EEDPTagMode field setting on SAS3.5 HBA devices scsi: mpt3sas: Fix driver modifying persistent data in Manufacturing page11 scsi: megaraid_sas: Fix msleep granularity scsi: megaraid_sas: Fix goto labels in error handling scsi: lpfc: fcoe: Fix link down issue after 1000+ link bounces scsi: lpfc: Fix odd recovery in duplicate FLOGIs in point-to-point scsi: lpfc: Correct loss of fc4 type on remote port address change usb: typec: tcpm: charge current handling for sink during hard reset dlm: fix invalid free dlm: don't leak kernel pointer to userspace vrf: mark skb for multicast or link-local as enslaved to VRF clk: tegra20: Turn EMC clock gate into divider ACPICA: Use %d for signed int print formatting instead of %u net: bcmgenet: return correct value 'ret' from bcmgenet_power_down of: unittest: allow base devicetree to have symbol metadata of: unittest: initialize args before calling of_*parse_*() tools: bpftool: pass an argument to silence open_obj_pinned() cfg80211: Prevent regulatory restore during STA disconnect in concurrent interfaces pinctrl: qcom: spmi-gpio: fix gpio-hog related boot issues pinctrl: bcm2835: Use define directive for BCM2835_PINCONF_PARAM_PULL pinctrl: lpc18xx: Use define directive for PIN_CONFIG_GPIO_PIN_INT pinctrl: zynq: Use define directive for PIN_CONFIG_IO_STANDARD PCI: keystone: Use quirk to limit MRRS for K2G nvme-pci: fix surprise removal spi: omap2-mcspi: Fix DMA and FIFO event trigger size mismatch i2c: uniphier-f: fix timeout error after reading 8 bytes mm/memory_hotplug: Do not unlock when fails to take the device_hotplug_lock ipv6: Fix handling of LLA with VRF and sockets bound to VRF cfg80211: call disconnect_wk when AP stops mm/page_io.c: do not free shared swap slots Bluetooth: Fix invalid-free in bcsp_close() KVM: MMU: Do not treat ZONE_DEVICE pages as being reserved ath10k: Fix a NULL-ptr-deref bug in ath10k_usb_alloc_urb_from_pipe ath9k_hw: fix uninitialized variable data md/raid10: prevent access of uninitialized resync_pages offset mm/memory_hotplug: don't access uninitialized memmaps in shrink_zone_span() net: phy: dp83867: fix speed 10 in sgmii mode net: phy: dp83867: increase SGMII autoneg timer duration ocfs2: remove ocfs2_is_o2cb_active() ARM: 8904/1: skip nomap memblocks while finding the lowmem/highmem boundary ARC: perf: Accommodate big-endian CPU x86/insn: Fix awk regexp warnings x86/speculation: Fix incorrect MDS/TAA mitigation status x86/speculation: Fix redundant MDS mitigation message nbd: prevent memory leak y2038: futex: Move compat implementation into futex.c futex: Prevent robust futex exit race ALSA: usb-audio: Fix NULL dereference at parsing BADD nfc: port100: handle command failure cleanly media: vivid: Set vid_cap_streaming and vid_out_streaming to true media: vivid: Fix wrong locking that causes race conditions on streaming stop media: usbvision: Fix races among open, close, and disconnect cpufreq: Add NULL checks to show() and store() methods of cpufreq media: uvcvideo: Fix error path in control parsing failure media: b2c2-flexcop-usb: add sanity checking media: cxusb: detect cxusb_ctrl_msg error in query media: imon: invalid dereference in imon_touch_event virtio_ring: fix return code on DMA mapping fails USBIP: add config dependency for SGL_ALLOC usbip: tools: fix fd leakage in the function of read_attr_usbip_status usbip: Fix uninitialized symbol 'nents' in stub_recv_cmd_submit() usb-serial: cp201x: support Mark-10 digital force gauge USB: chaoskey: fix error case of a timeout appledisplay: fix error handling in the scheduled work USB: serial: mos7840: add USB ID to support Moxa UPort 2210 USB: serial: mos7720: fix remote wakeup USB: serial: mos7840: fix remote wakeup USB: serial: option: add support for DW5821e with eSIM support USB: serial: option: add support for Foxconn T77W968 LTE modules staging: comedi: usbduxfast: usbduxfast_ai_cmdtest rounding error powerpc/64s: support nospectre_v2 cmdline option powerpc/book3s64: Fix link stack flush on context switch KVM: PPC: Book3S HV: Flush link stack on guest exit to host kernel PM / devfreq: Fix kernel oops on governor module load Linux 4.19.87 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I68dbcb014ebe255a216af042b6f8b8fb35d97e59 |
||
|
Martin Lau
|
54299e1cf3 |
bpf, btf: fix a missing check bug in btf_parse
[ Upstream commit 4a6998aff82a20a1aece86a186d8e5263f8b2315 ]
Wenwen Wang reported:
In btf_parse(), the header of the user-space btf data 'btf_data'
is firstly parsed and verified through btf_parse_hdr().
In btf_parse_hdr(), the header is copied from user-space 'btf_data'
to kernel-space 'btf->hdr' and then verified. If no error happens
during the verification process, the whole data of 'btf_data',
including the header, is then copied to 'data' in btf_parse(). It
is obvious that the header is copied twice here. More importantly,
no check is enforced after the second copy to make sure the headers
obtained in these two copies are same. Given that 'btf_data' resides
in the user space, a malicious user can race to modify the header
between these two copies. By doing so, the user can inject
inconsistent data, which can cause undefined behavior of the
kernel and introduce potential security risk.
This issue is similar to the one fixed in commit 8af03d1ae2e1 ("bpf:
btf: Fix a missing check bug"). To fix it, this patch copies the user
'btf_data' *before* parsing / verifying the BTF header.
Fixes:
|
||
|
Taehee Yoo
|
8044e741ee |
bpf: devmap: fix wrong interface selection in notifier_call
[ Upstream commit f592f804831f1cf9d1f9966f58c80f150e6829b5 ]
The dev_map_notification() removes interface in devmap if
unregistering interface's ifindex is same.
But only checking ifindex is not enough because other netns can have
same ifindex. so that wrong interface selection could occurred.
Hence netdev pointer comparison code is added.
v2: compare netdev pointer instead of using net_eq() (Daniel Borkmann)
v1: Initial patch
Fixes:
|
||
|
Greg Kroah-Hartman
|
10f1d14718 |
Merge 4.19.86 into android-4.19-q
Changes in 4.19.86
spi: mediatek: use correct mata->xfer_len when in fifo transfer
i2c: mediatek: modify threshold passed to i2c_get_dma_safe_msg_buf()
tee: optee: add missing of_node_put after of_device_is_available
Revert "OPP: Protect dev_list with opp_table lock"
net: cdc_ncm: Signedness bug in cdc_ncm_set_dgram_size()
idr: Fix idr_get_next race with idr_remove
mm/memory_hotplug: don't access uninitialized memmaps in shrink_pgdat_span()
mm/memory_hotplug: fix updating the node span
arm64: uaccess: Ensure PAN is re-enabled after unhandled uaccess fault
fbdev: Ditch fb_edid_add_monspecs
bpf, x32: Fix bug for BPF_ALU64 | BPF_NEG
bpf, x32: Fix bug with ALU64 {LSH, RSH, ARSH} BPF_X shift by 0
bpf, x32: Fix bug with ALU64 {LSH, RSH, ARSH} BPF_K shift by 0
bpf, x32: Fix bug for BPF_JMP | {BPF_JSGT, BPF_JSLE, BPF_JSLT, BPF_JSGE}
net: ovs: fix return type of ndo_start_xmit function
net: xen-netback: fix return type of ndo_start_xmit function
ARM: dts: dra7: Enable workaround for errata i870 in PCIe host mode
ARM: dts: omap5: enable OTG role for DWC3 controller
net: hns3: Fix for netdev not up problem when setting mtu
net: hns3: Fix loss of coal configuration while doing reset
f2fs: return correct errno in f2fs_gc
ARM: dts: sun8i: h3-h5: ir register size should be the whole memory block
ARM: dts: sun8i: h3: bpi-m2-plus: Fix address for external RGMII Ethernet PHY
tcp: up initial rmem to 128KB and SYN rwin to around 64KB
SUNRPC: Fix priority queue fairness
ACPI / LPSS: Make acpi_lpss_find_device() also find PCI devices
ACPI / LPSS: Resume BYT/CHT I2C controllers from resume_noirq
f2fs: keep lazytime on remount
IB/hfi1: Error path MAD response size is incorrect
IB/hfi1: Ensure ucast_dlid access doesnt exceed bounds
mt76x2: fix tx power configuration for VHT mcs 9
mt76x2: disable WLAN core before probe
mt76: fix handling ps-poll frames
iommu/io-pgtable-arm: Fix race handling in split_blk_unmap()
iommu/arm-smmu-v3: Fix unexpected CMD_SYNC timeout
kvm: arm/arm64: Fix stage2_flush_memslot for 4 level page table
arm64/numa: Report correct memblock range for the dummy node
ath10k: fix vdev-start timeout on error
rtlwifi: btcoex: Use proper enumerated types for Wi-Fi only interface
ata: ahci_brcm: Allow using driver or DSL SoCs
PM / devfreq: Fix devfreq_add_device() when drivers are built as modules.
PM / devfreq: Fix handling of min/max_freq == 0
PM / devfreq: stopping the governor before device_unregister()
ath9k: fix reporting calculated new FFT upper max
selftests/tls: Fix recv(MSG_PEEK) & splice() test cases
usb: gadget: udc: fotg210-udc: Fix a sleep-in-atomic-context bug in fotg210_get_status()
usb: dwc3: gadget: Check ENBLSLPM before sending ep command
nl80211: Fix a GET_KEY reply attribute
irqchip/irq-mvebu-icu: Fix wrong private data retrieval
watchdog: core: fix null pointer dereference when releasing cdev
watchdog: renesas_wdt: stop when unregistering
watchdog: sama5d4: fix timeout-sec usage
watchdog: w83627hf_wdt: Support NCT6796D, NCT6797D, NCT6798D
KVM: PPC: Inform the userspace about TCE update failures
printk: Do not miss new messages when replaying the log
printk: CON_PRINTBUFFER console registration is a bit racy
dmaengine: ep93xx: Return proper enum in ep93xx_dma_chan_direction
dmaengine: timb_dma: Use proper enum in td_prep_slave_sg
ALSA: hda: Fix mismatch for register mask and value in ext controller.
ext4: fix build error when DX_DEBUG is defined
clk: keystone: Enable TISCI clocks if K3_ARCH
sunrpc: Fix connect metrics
x86/PCI: Apply VMD's AERSID fixup generically
mei: samples: fix a signedness bug in amt_host_if_call()
cxgb4: Use proper enum in cxgb4_dcb_handle_fw_update
cxgb4: Use proper enum in IEEE_FAUX_SYNC
powerpc/pseries: Fix DTL buffer registration
powerpc/pseries: Fix how we iterate over the DTL entries
powerpc/xive: Move a dereference below a NULL test
ARM: dts: at91: sama5d4_xplained: fix addressable nand flash size
ARM: dts: at91: at91sam9x5cm: fix addressable nand flash size
ARM: dts: at91: sama5d2_ptc_ek: fix bootloader env offsets
mtd: rawnand: sh_flctl: Use proper enum for flctl_dma_fifo0_transfer
PM / hibernate: Check the success of generating md5 digest before hibernation
tools: PCI: Fix compilation warnings
clocksource/drivers/sh_cmt: Fixup for 64-bit machines
clocksource/drivers/sh_cmt: Fix clocksource width for 32-bit machines
ice: Fix forward to queue group logic
md: allow metadata updates while suspending an array - fix
ixgbe: Fix ixgbe TX hangs with XDP_TX beyond queue limit
i40e: Use proper enum in i40e_ndo_set_vf_link_state
ixgbe: Fix crash with VFs and flow director on interface flap
IB/mthca: Fix error return code in __mthca_init_one()
IB/rxe: avoid srq memory leak
RDMA/hns: Bugfix for reserved qp number
RDMA/hns: Submit bad wr when post send wr exception
RDMA/hns: Bugfix for CM test
RDMA/hns: Limit the size of extend sge of sq
IB/mlx4: Avoid implicit enumerated type conversion
rpmsg: glink: smem: Support rx peak for size less than 4 bytes
msm/gpu/a6xx: Force of_dma_configure to setup DMA for GMU
OPP: Return error on error from dev_pm_opp_get_opp_count()
ACPICA: Never run _REG on system_memory and system_IO
cpuidle: menu: Fix wakeup statistics updates for polling state
ASoC: qdsp6: q6asm-dai: checking NULL vs IS_ERR()
powerpc/time: Use clockevents_register_device(), fixing an issue with large decrementer
powerpc/64s/radix: Explicitly flush ERAT with local LPID invalidation
ata: ep93xx: Use proper enums for directions
qed: Avoid implicit enum conversion in qed_ooo_submit_tx_buffers
media: rc: ir-rc6-decoder: enable toggle bit for Kathrein RCU-676 remote
media: pxa_camera: Fix check for pdev->dev.of_node
media: rcar-vin: fix redeclaration of symbol
media: i2c: adv748x: Support probing a single output
ALSA: hda/sigmatel - Disable automute for Elo VuPoint
bnxt_en: return proper error when FW returns HWRM_ERR_CODE_RESOURCE_ACCESS_DENIED
KVM: PPC: Book3S PR: Exiting split hack mode needs to fixup both PC and LR
USB: serial: cypress_m8: fix interrupt-out transfer length
usb: dwc2: disable power_down on rockchip devices
mtd: physmap_of: Release resources on error
cpu/SMT: State SMT is disabled even with nosmt and without "=force"
brcmfmac: reduce timeout for action frame scan
brcmfmac: fix full timeout waiting for action frame on-channel tx
qtnfmac: request userspace to do OBSS scanning if FW can not
qtnfmac: pass sgi rate info flag to wireless core
qtnfmac: inform wireless core about supported extended capabilities
qtnfmac: drop error reports for out-of-bounds key indexes
clk: samsung: Use NOIRQ stage for Exynos5433 clocks suspend/resume
clk: samsung: exynos5420: Define CLK_SECKEY gate clock only or Exynos5420
clk: samsung: Use clk_hw API for calling clk framework from clk notifiers
i2c: brcmstb: Allow enabling the driver on DSL SoCs
printk: Correct wrong casting
NFSv4.x: fix lock recovery during delegation recall
dmaengine: ioat: fix prototype of ioat_enumerate_channels
media: ov5640: fix framerate update
media: cec-gpio: select correct Signal Free Time
gfs2: slow the deluge of io error messages
i2c: omap: use core to detect 'no zero length' quirk
i2c: qup: use core to detect 'no zero length' quirk
i2c: tegra: use core to detect 'no zero length' quirk
i2c: zx2967: use core to detect 'no zero length' quirk
Input: st1232 - set INPUT_PROP_DIRECT property
Input: silead - try firmware reload after unsuccessful resume
soc: fsl: bman_portals: defer probe after bman's probe
net: hns3: Fix for rx vlan id handle to support Rev 0x21 hardware
tc-testing: fix build of eBPF programs
remoteproc: Check for NULL firmwares in sysfs interface
remoteproc: qcom: q6v5: Fix a race condition on fatal crash
kexec: Allocate decrypted control pages for kdump if SME is enabled
x86/olpc: Fix build error with CONFIG_MFD_CS5535=m
dmaengine: rcar-dmac: set scatter/gather max segment size
crypto: mxs-dcp - Fix SHA null hashes and output length
crypto: mxs-dcp - Fix AES issues
xfrm: use correct size to initialise sp->ovec
ACPI / SBS: Fix rare oops when removing modules
iwlwifi: mvm: don't send keys when entering D3
xsk: proper AF_XDP socket teardown ordering
x86/fsgsbase/64: Fix ptrace() to read the FS/GS base accurately
mmc: renesas_sdhi_internal_dmac: Whitelist r8a774a1
mmc: tmio: Fix SCC error detection
mmc: renesas_sdhi_internal_dmac: set scatter/gather max segment size
atmel_lcdfb: support native-mode display-timings
fbdev: sbuslib: use checked version of put_user()
fbdev: sbuslib: integer overflow in sbusfb_ioctl_helper()
fbdev: fix broken menu dependencies
reset: Fix potential use-after-free in __of_reset_control_get()
bcache: account size of buckets used in uuid write to ca->meta_sectors_written
bcache: recal cached_dev_sectors on detach
platform/x86: mlx-platform: Properly use mlxplat_mlxcpld_msn201x_items
media: dw9714: Fix error handling in probe function
media: dw9807-vcm: Fix probe error handling
media: cx18: Don't check for address of video_dev
mtd: spi-nor: cadence-quadspi: Use proper enum for dma_[un]map_single
mtd: devices: m25p80: Make sure WRITE_EN is issued before each write
x86/intel_rdt: Introduce utility to obtain CDP peer
x86/intel_rdt: CBM overlap should also check for overlap with CDP peer
mmc: mmci: expand startbiterr to irqmask and error check
s390/kasan: avoid vdso instrumentation
s390/kasan: avoid instrumentation of early C code
s390/kasan: avoid user access code instrumentation
proc/vmcore: Fix i386 build error of missing copy_oldmem_page_encrypted()
backlight: lm3639: Unconditionally call led_classdev_unregister
mfd: ti_am335x_tscadc: Keep ADC interface on if child is wakeup capable
printk: Give error on attempt to set log buffer length to over 2G
media: isif: fix a NULL pointer dereference bug
GFS2: Flush the GFS2 delete workqueue before stopping the kernel threads
media: cx231xx: fix potential sign-extension overflow on large shift
media: venus: vdec: fix decoded data size
ALSA: hda/ca0132 - Fix input effect controls for desktop cards
lightnvm: pblk: fix rqd.error return value in pblk_blk_erase_sync
lightnvm: pblk: fix incorrect min_write_pgs
lightnvm: pblk: guarantee emeta on line close
lightnvm: pblk: fix write amplificiation calculation
lightnvm: pblk: guarantee mw_cunits on read buffer
lightnvm: do no update csecs and sos on 1.2
lightnvm: pblk: fix error handling of pblk_lines_init()
lightnvm: pblk: consider max hw sectors supported for max_write_pgs
x86/kexec: Correct KEXEC_BACKUP_SRC_END off-by-one error
bpf: btf: Fix a missing check bug
net: fix generic XDP to handle if eth header was mangled
gpio: syscon: Fix possible NULL ptr usage
spi: fsl-lpspi: Prevent FIFO under/overrun by default
pinctrl: gemini: Mask and set properly
spi: spidev: Fix OF tree warning logic
ARM: 8802/1: Call syscall_trace_exit even when system call skipped
x86/mm: Do not warn about PCI BIOS W+X mappings
orangefs: rate limit the client not running info message
pinctrl: gemini: Fix up TVC clock group
scsi: arcmsr: clean up clang warning on extraneous parentheses
hwmon: (k10temp) Support all Family 15h Model 6xh and Model 7xh processors
hwmon: (nct6775) Fix names of DIMM temperature sources
hwmon: (pwm-fan) Silence error on probe deferral
hwmon: (ina3221) Fix INA3221_CONFIG_MODE macros
hwmon: (npcm-750-pwm-fan) Change initial pwm target to 255
selftests: forwarding: Have lldpad_app_wait_set() wait for unknown, too
net: sched: avoid writing on noop_qdisc
netfilter: nft_compat: do not dump private area
misc: cxl: Fix possible null pointer dereference
mac80211: minstrel: fix using short preamble CCK rates on HT clients
mac80211: minstrel: fix CCK rate group streams value
mac80211: minstrel: fix sampling/reporting of CCK rates in HT mode
spi: rockchip: initialize dma_slave_config properly
mlxsw: spectrum_switchdev: Check notification relevance based on upper device
ARM: dts: omap5: Fix dual-role mode on Super-Speed port
tcp: start receiver buffer autotuning sooner
ACPI / LPSS: Use acpi_lpss_* instead of acpi_subsys_* functions for hibernate
PM / devfreq: Fix static checker warning in try_then_request_governor
tools: PCI: Fix broken pcitest compilation
powerpc/time: Fix clockevent_decrementer initalisation for PR KVM
mmc: tmio: fix SCC error handling to avoid false positive CRC error
x86/resctrl: Fix rdt_find_domain() return value and checks
Linux 4.19.86
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I40e00f0b53336aba2edc8ed6a696fdf5206fdba7
|
||
|
Wenwen Wang
|
014045888a |
bpf: btf: Fix a missing check bug
[ Upstream commit 8af03d1ae2e154a8be3631e8694b87007e1bdbc2 ] In btf_parse_hdr(), the length of the btf data header is firstly copied from the user space to 'hdr_len' and checked to see whether it is larger than 'btf_data_size'. If yes, an error code EINVAL is returned. Otherwise, the whole header is copied again from the user space to 'btf->hdr'. However, after the second copy, there is no check between 'btf->hdr->hdr_len' and 'hdr_len' to confirm that the two copies get the same value. Given that the btf data is in the user space, a malicious user can race to change the data between the two copies. By doing so, the user can provide malicious data to the kernel and cause undefined behavior. This patch adds a necessary check after the second copy, to make sure 'btf->hdr->hdr_len' has the same value as 'hdr_len'. Otherwise, an error code EINVAL will be returned. Signed-off-by: Wenwen Wang <wang6495@umn.edu> Acked-by: Song Liu <songliubraving@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
|
Sami Tolvanen
|
89aed473c5 |
ANDROID: bpf: validate bpf_func when BPF_JIT is enabled with CFI
With CONFIG_BPF_JIT, the kernel makes indirect calls to dynamically
generated code, which the compile-time Control-Flow Integrity (CFI)
checking cannot validate. This change adds basic sanity checking to
ensure we are jumping to a valid location, which narrows down the
attack surface on the stored pointer.
In addition, this change adds a weak arch_bpf_jit_check_func function,
which architectures that implement BPF JIT can override to perform
additional validation, such as verifying that the pointer points to
the correct memory region.
Bug: 140377409
Change-Id: I8ebac6637ab6bd9db44716b1c742add267298669
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
(cherry picked from commit
|
||
|
Daniel Borkmann
|
ed568ca736 |
bpf: fix use after free in prog symbol exposure
commit c751798aa224fadc5124b49eeb38fb468c0fa039 upstream.
syzkaller managed to trigger the warning in bpf_jit_free() which checks via
bpf_prog_kallsyms_verify_off() for potentially unlinked JITed BPF progs
in kallsyms, and subsequently trips over GPF when walking kallsyms entries:
[...]
8021q: adding VLAN 0 to HW filter on device batadv0
8021q: adding VLAN 0 to HW filter on device batadv0
WARNING: CPU: 0 PID: 9869 at kernel/bpf/core.c:810 bpf_jit_free+0x1e8/0x2a0
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 9869 Comm: kworker/0:7 Not tainted 5.0.0-rc8+ #1
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events bpf_prog_free_deferred
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x113/0x167 lib/dump_stack.c:113
panic+0x212/0x40b kernel/panic.c:214
__warn.cold.8+0x1b/0x38 kernel/panic.c:571
report_bug+0x1a4/0x200 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:178 [inline]
do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:271
do_invalid_op+0x36/0x40 arch/x86/kernel/traps.c:290
invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:973
RIP: 0010:bpf_jit_free+0x1e8/0x2a0
Code: 02 4c 89 e2 83 e2 07 38 d0 7f 08 84 c0 0f 85 86 00 00 00 48 ba 00 02 00 00 00 00 ad de 0f b6 43 02 49 39 d6 0f 84 5f fe ff ff <0f> 0b e9 58 fe ff ff 48 b8 00 00 00 00 00 fc ff df 4c 89 e2 48 c1
RSP: 0018:ffff888092f67cd8 EFLAGS: 00010202
RAX: 0000000000000007 RBX: ffffc90001947000 RCX: ffffffff816e9d88
RDX: dead000000000200 RSI: 0000000000000008 RDI: ffff88808769f7f0
RBP: ffff888092f67d00 R08: fffffbfff1394059 R09: fffffbfff1394058
R10: fffffbfff1394058 R11: ffffffff89ca02c7 R12: ffffc90001947002
R13: ffffc90001947020 R14: ffffffff881eca80 R15: ffff88808769f7e8
BUG: unable to handle kernel paging request at fffffbfff400d000
#PF error: [normal kernel read fault]
PGD 21ffee067 P4D 21ffee067 PUD 21ffed067 PMD 9f942067 PTE 0
Oops: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 9869 Comm: kworker/0:7 Not tainted 5.0.0-rc8+ #1
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events bpf_prog_free_deferred
RIP: 0010:bpf_get_prog_addr_region kernel/bpf/core.c:495 [inline]
RIP: 0010:bpf_tree_comp kernel/bpf/core.c:558 [inline]
RIP: 0010:__lt_find include/linux/rbtree_latch.h:115 [inline]
RIP: 0010:latch_tree_find include/linux/rbtree_latch.h:208 [inline]
RIP: 0010:bpf_prog_kallsyms_find+0x107/0x2e0 kernel/bpf/core.c:632
Code: 00 f0 ff ff 44 38 c8 7f 08 84 c0 0f 85 fa 00 00 00 41 f6 45 02 01 75 02 0f 0b 48 39 da 0f 82 92 00 00 00 48 89 d8 48 c1 e8 03 <42> 0f b6 04 30 84 c0 74 08 3c 03 0f 8e 45 01 00 00 8b 03 48 c1 e0
[...]
Upon further debugging, it turns out that whenever we trigger this
issue, the kallsyms removal in bpf_prog_ksym_node_del() was /skipped/
but yet bpf_jit_free() reported that the entry is /in use/.
Problem is that symbol exposure via bpf_prog_kallsyms_add() but also
perf_event_bpf_event() were done /after/ bpf_prog_new_fd(). Once the
fd is exposed to the public, a parallel close request came in right
before we attempted to do the bpf_prog_kallsyms_add().
Given at this time the prog reference count is one, we start to rip
everything underneath us via bpf_prog_release() -> bpf_prog_put().
The memory is eventually released via deferred free, so we're seeing
that bpf_jit_free() has a kallsym entry because we added it from
bpf_prog_load() but /after/ bpf_prog_put() from the remote CPU.
Therefore, move both notifications /before/ we install the fd. The
issue was never seen between bpf_prog_alloc_id() and bpf_prog_new_fd()
because upon bpf_prog_get_fd_by_id() we'll take another reference to
the BPF prog, so we're still holding the original reference from the
bpf_prog_load().
Fixes: 6ee52e2a3fe4 ("perf, bpf: Introduce PERF_RECORD_BPF_EVENT")
Fixes:
|
||
|
Valdis Klētnieks
|
7c10f8941b |
bpf: silence warning messages in core
[ Upstream commit aee450cbe482a8c2f6fa5b05b178ef8b8ff107ca ]
Compiling kernel/bpf/core.c with W=1 causes a flood of warnings:
kernel/bpf/core.c:1198:65: warning: initialized field overwritten [-Woverride-init]
1198 | #define BPF_INSN_3_TBL(x, y, z) [BPF_##x | BPF_##y | BPF_##z] = true
| ^~~~
kernel/bpf/core.c:1087:2: note: in expansion of macro 'BPF_INSN_3_TBL'
1087 | INSN_3(ALU, ADD, X), \
| ^~~~~~
kernel/bpf/core.c:1202:3: note: in expansion of macro 'BPF_INSN_MAP'
1202 | BPF_INSN_MAP(BPF_INSN_2_TBL, BPF_INSN_3_TBL),
| ^~~~~~~~~~~~
kernel/bpf/core.c:1198:65: note: (near initialization for 'public_insntable[12]')
1198 | #define BPF_INSN_3_TBL(x, y, z) [BPF_##x | BPF_##y | BPF_##z] = true
| ^~~~
kernel/bpf/core.c:1087:2: note: in expansion of macro 'BPF_INSN_3_TBL'
1087 | INSN_3(ALU, ADD, X), \
| ^~~~~~
kernel/bpf/core.c:1202:3: note: in expansion of macro 'BPF_INSN_MAP'
1202 | BPF_INSN_MAP(BPF_INSN_2_TBL, BPF_INSN_3_TBL),
| ^~~~~~~~~~~~
98 copies of the above.
The attached patch silences the warnings, because we *know* we're overwriting
the default initializer. That leaves bpf/core.c with only 6 other warnings,
which become more visible in comparison.
Signed-off-by: Valdis Kletnieks <valdis.kletnieks@vt.edu>
Acked-by: Andrii Nakryiko <andriin@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
||
|
Toshiaki Makita
|
4c2ce7addd |
bpf, devmap: Add missing RCU read lock on flush
[ Upstream commit 86723c8640633bee4b4588d3c7784ee7a0032f65 ]
.ndo_xdp_xmit() assumes it is called under RCU. For example virtio_net
uses RCU to detect it has setup the resources for tx. The assumption
accidentally broke when introducing bulk queue in devmap.
Fixes:
|
||
|
Toshiaki Makita
|
ab44f8bcf2 |
bpf, devmap: Add missing bulk queue free
[ Upstream commit edabf4d9dd905acd60048ea1579943801e3a4876 ]
dev_map_free() forgot to free bulk queue when freeing its entries.
Fixes:
|
||
|
Toshiaki Makita
|
8d09e86210 |
bpf, devmap: Fix premature entry free on destroying map
[ Upstream commit d4dd153d551634683fccf8881f606fa9f3dfa1ef ] dev_map_free() waits for flush_needed bitmap to be empty in order to ensure all flush operations have completed before freeing its entries. However the corresponding clear_bit() was called before using the entries, so the entries could be used after free. All access to the entries needs to be done before clearing the bit. It seems commit |
||
|
Daniel Borkmann
|
54e8cf41b2 |
bpf: fix bpf_jit_limit knob for PAGE_SIZE >= 64K
[ Upstream commit fdadd04931c2d7cd294dc5b2b342863f94be53a3 ]
Michael and Sandipan report:
Commit ede95a63b5 introduced a bpf_jit_limit tuneable to limit BPF
JIT allocations. At compile time it defaults to PAGE_SIZE * 40000,
and is adjusted again at init time if MODULES_VADDR is defined.
For ppc64 kernels, MODULES_VADDR isn't defined, so we're stuck with
the compile-time default at boot-time, which is 0x9c400000 when
using 64K page size. This overflows the signed 32-bit bpf_jit_limit
value:
root@ubuntu:/tmp# cat /proc/sys/net/core/bpf_jit_limit
-1673527296
and can cause various unexpected failures throughout the network
stack. In one case `strace dhclient eth0` reported:
setsockopt(5, SOL_SOCKET, SO_ATTACH_FILTER, {len=11, filter=0x105dd27f8},
16) = -1 ENOTSUPP (Unknown error 524)
and similar failures can be seen with tools like tcpdump. This doesn't
always reproduce however, and I'm not sure why. The more consistent
failure I've seen is an Ubuntu 18.04 KVM guest booted on a POWER9
host would time out on systemd/netplan configuring a virtio-net NIC
with no noticeable errors in the logs.
Given this and also given that in near future some architectures like
arm64 will have a custom area for BPF JIT image allocations we should
get rid of the BPF_JIT_LIMIT_DEFAULT fallback / default entirely. For
4.21, we have an overridable bpf_jit_alloc_exec(), bpf_jit_free_exec()
so therefore add another overridable bpf_jit_alloc_exec_limit() helper
function which returns the possible size of the memory area for deriving
the default heuristic in bpf_jit_charge_init().
Like bpf_jit_alloc_exec() and bpf_jit_free_exec(), the new
bpf_jit_alloc_exec_limit() assumes that module_alloc() is the default
JIT memory provider, and therefore in case archs implement their custom
module_alloc() we use MODULES_{END,_VADDR} for limits and otherwise for
vmalloc_exec() cases like on ppc64 we use VMALLOC_{END,_START}.
Additionally, for archs supporting large page sizes, we should change
the sysctl to be handled as long to not run into sysctl restrictions
in future.
Fixes: ede95a63b5e8 ("bpf: add bpf_jit_limit knob to restrict unpriv allocations")
Reported-by: Sandipan Das <sandipan@linux.ibm.com>
Reported-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Tested-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
||
|
Daniel Borkmann
|
613bc37f74 |
bpf: fix unconnected udp hooks
commit 983695fa676568fc0fe5ddd995c7267aabc24632 upstream. Intention of cgroup bind/connect/sendmsg BPF hooks is to act transparently to applications as also stated in original motivation in |
||
|
Jonathan Lemon
|
4992d4af58 |
bpf: lpm_trie: check left child of last leftmost node for NULL
commit da2577fdd0932ea4eefe73903f1130ee366767d2 upstream.
If the leftmost parent node of the tree has does not have a child
on the left side, then trie_get_next_key (and bpftool map dump) will
not look at the child on the right. This leads to the traversal
missing elements.
Lookup is not affected.
Update selftest to handle this case.
Reproducer:
bpftool map create /sys/fs/bpf/lpm type lpm_trie key 6 \
value 1 entries 256 name test_lpm flags 1
bpftool map update pinned /sys/fs/bpf/lpm key 8 0 0 0 0 0 value 1
bpftool map update pinned /sys/fs/bpf/lpm key 16 0 0 0 0 128 value 2
bpftool map dump pinned /sys/fs/bpf/lpm
Returns only 1 element. (2 expected)
Fixes:
|
||
|
Krzesimir Nowak
|
f9ee13ce21 |
bpf: fix undefined behavior in narrow load handling
[ Upstream commit e2f7fc0ac6957cabff4cecf6c721979b571af208 ] Commit |
||
|
Eric Dumazet
|
003e2d74c5 |
bpf: devmap: fix use-after-free Read in __dev_map_entry_free
commit 2baae3545327632167c0180e9ca1d467416f1919 upstream.
synchronize_rcu() is fine when the rcu callbacks only need
to free memory (kfree_rcu() or direct kfree() call rcu call backs)
__dev_map_entry_free() is a bit more complex, so we need to make
sure that call queued __dev_map_entry_free() callbacks have completed.
sysbot report:
BUG: KASAN: use-after-free in dev_map_flush_old kernel/bpf/devmap.c:365
[inline]
BUG: KASAN: use-after-free in __dev_map_entry_free+0x2a8/0x300
kernel/bpf/devmap.c:379
Read of size 8 at addr ffff8801b8da38c8 by task ksoftirqd/1/18
CPU: 1 PID: 18 Comm: ksoftirqd/1 Not tainted 4.17.0+ #39
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1b9/0x294 lib/dump_stack.c:113
print_address_description+0x6c/0x20b mm/kasan/report.c:256
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412
__asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
dev_map_flush_old kernel/bpf/devmap.c:365 [inline]
__dev_map_entry_free+0x2a8/0x300 kernel/bpf/devmap.c:379
__rcu_reclaim kernel/rcu/rcu.h:178 [inline]
rcu_do_batch kernel/rcu/tree.c:2558 [inline]
invoke_rcu_callbacks kernel/rcu/tree.c:2818 [inline]
__rcu_process_callbacks kernel/rcu/tree.c:2785 [inline]
rcu_process_callbacks+0xe9d/0x1760 kernel/rcu/tree.c:2802
__do_softirq+0x2e0/0xaf5 kernel/softirq.c:284
run_ksoftirqd+0x86/0x100 kernel/softirq.c:645
smpboot_thread_fn+0x417/0x870 kernel/smpboot.c:164
kthread+0x345/0x410 kernel/kthread.c:240
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:412
Allocated by task 6675:
save_stack+0x43/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc+0xc4/0xe0 mm/kasan/kasan.c:553
kmem_cache_alloc_trace+0x152/0x780 mm/slab.c:3620
kmalloc include/linux/slab.h:513 [inline]
kzalloc include/linux/slab.h:706 [inline]
dev_map_alloc+0x208/0x7f0 kernel/bpf/devmap.c:102
find_and_alloc_map kernel/bpf/syscall.c:129 [inline]
map_create+0x393/0x1010 kernel/bpf/syscall.c:453
__do_sys_bpf kernel/bpf/syscall.c:2351 [inline]
__se_sys_bpf kernel/bpf/syscall.c:2328 [inline]
__x64_sys_bpf+0x303/0x510 kernel/bpf/syscall.c:2328
do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 26:
save_stack+0x43/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
__kasan_slab_free+0x11a/0x170 mm/kasan/kasan.c:521
kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
__cache_free mm/slab.c:3498 [inline]
kfree+0xd9/0x260 mm/slab.c:3813
dev_map_free+0x4fa/0x670 kernel/bpf/devmap.c:191
bpf_map_free_deferred+0xba/0xf0 kernel/bpf/syscall.c:262
process_one_work+0xc64/0x1b70 kernel/workqueue.c:2153
worker_thread+0x181/0x13a0 kernel/workqueue.c:2296
kthread+0x345/0x410 kernel/kthread.c:240
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:412
The buggy address belongs to the object at ffff8801b8da37c0
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 264 bytes inside of
512-byte region [ffff8801b8da37c0, ffff8801b8da39c0)
The buggy address belongs to the page:
page:ffffea0006e368c0 count:1 mapcount:0 mapping:ffff8801da800940
index:0xffff8801b8da3540
flags: 0x2fffc0000000100(slab)
raw: 02fffc0000000100 ffffea0007217b88 ffffea0006e30cc8 ffff8801da800940
raw: ffff8801b8da3540 ffff8801b8da3040 0000000100000004 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8801b8da3780: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
ffff8801b8da3800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff8801b8da3880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8801b8da3900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8801b8da3980: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
Fixes:
|
||
|
Daniel Borkmann
|
43caa29c99 |
bpf: add bpf_jit_limit knob to restrict unpriv allocations
commit ede95a63b5e84ddeea6b0c473b36ab8bfd8c6ce3 upstream. Rick reported that the BPF JIT could potentially fill the entire module space with BPF programs from unprivileged users which would prevent later attempts to load normal kernel modules or privileged BPF programs, for example. If JIT was enabled but unsuccessful to generate the image, then before commit |
||
|
Daniel Borkmann
|
107e215c29 |
bpf, lru: avoid messing with eviction heuristics upon syscall lookup
commit 50b045a8c0ccf44f76640ac3eea8d80ca53979a3 upstream. One of the biggest issues we face right now with picking LRU map over regular hash table is that a map walk out of user space, for example, to just dump the existing entries or to remove certain ones, will completely mess up LRU eviction heuristics and wrong entries such as just created ones will get evicted instead. The reason for this is that we mark an entry as "in use" via bpf_lru_node_set_ref() from system call lookup side as well. Thus upon walk, all entries are being marked, so information of actual least recently used ones are "lost". In case of Cilium where it can be used (besides others) as a BPF based connection tracker, this current behavior causes disruption upon control plane changes that need to walk the map from user space to evict certain entries. Discussion result from bpfconf [0] was that we should simply just remove marking from system call side as no good use case could be found where it's actually needed there. Therefore this patch removes marking for regular LRU and per-CPU flavor. If there ever should be a need in future, the behavior could be selected via map creation flag, but due to mentioned reason we avoid this here. [0] http://vger.kernel.org/bpfconf.html Fixes: |
||
|
Daniel Borkmann
|
2bb3c5470a |
bpf: add map_lookup_elem_sys_only for lookups from syscall side
commit c6110222c6f49ea68169f353565eb865488a8619 upstream. Add a callback map_lookup_elem_sys_only() that map implementations could use over map_lookup_elem() from system call side in case the map implementation needs to handle the latter differently than from the BPF data path. If map_lookup_elem_sys_only() is set, this will be preferred pick for map lookups out of user space. This hook is used in a follow-up fix for LRU map, but once development window opens, we can convert other map types from map_lookup_elem() (here, the one called upon BPF_MAP_LOOKUP_ELEM cmd is meant) over to use the callback to simplify and clean up the latter. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Martin KaFai Lau <kafai@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Chenbo Feng
|
3ded3aaa4a |
bpf: relax inode permission check for retrieving bpf program
commit e547ff3f803e779a3898f1f48447b29f43c54085 upstream. For iptable module to load a bpf program from a pinned location, it only retrieve a loaded program and cannot change the program content so requiring a write permission for it might not be necessary. Also when adding or removing an unrelated iptable rule, it might need to flush and reload the xt_bpf related rules as well and triggers the inode permission check. It might be better to remove the write premission check for the inode so we won't need to grant write access to all the processes that flush and restore iptables rules. Signed-off-by: Chenbo Feng <fengc@google.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Daniel Borkmann
|
e8eef7ad98 |
bpf: fix use after free in bpf_evict_inode
[ Upstream commit 1da6c4d9140cb7c13e87667dc4e1488d6c8fc10f ]
syzkaller was able to generate the following UAF in bpf:
BUG: KASAN: use-after-free in lookup_last fs/namei.c:2269 [inline]
BUG: KASAN: use-after-free in path_lookupat.isra.43+0x9f8/0xc00 fs/namei.c:2318
Read of size 1 at addr ffff8801c4865c47 by task syz-executor2/9423
CPU: 0 PID: 9423 Comm: syz-executor2 Not tainted 4.20.0-rc1-next-20181109+
#110
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x244/0x39d lib/dump_stack.c:113
print_address_description.cold.7+0x9/0x1ff mm/kasan/report.c:256
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report.cold.8+0x242/0x309 mm/kasan/report.c:412
__asan_report_load1_noabort+0x14/0x20 mm/kasan/report.c:430
lookup_last fs/namei.c:2269 [inline]
path_lookupat.isra.43+0x9f8/0xc00 fs/namei.c:2318
filename_lookup+0x26a/0x520 fs/namei.c:2348
user_path_at_empty+0x40/0x50 fs/namei.c:2608
user_path include/linux/namei.h:62 [inline]
do_mount+0x180/0x1ff0 fs/namespace.c:2980
ksys_mount+0x12d/0x140 fs/namespace.c:3258
__do_sys_mount fs/namespace.c:3272 [inline]
__se_sys_mount fs/namespace.c:3269 [inline]
__x64_sys_mount+0xbe/0x150 fs/namespace.c:3269
do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457569
Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fde6ed96c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000457569
RDX: 0000000020000040 RSI: 0000000020000000 RDI: 0000000000000000
RBP: 000000000072bf00 R08: 0000000020000340 R09: 0000000000000000
R10: 0000000000200000 R11: 0000000000000246 R12: 00007fde6ed976d4
R13: 00000000004c2c24 R14: 00000000004d4990 R15: 00000000ffffffff
Allocated by task 9424:
save_stack+0x43/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:553
__do_kmalloc mm/slab.c:3722 [inline]
__kmalloc_track_caller+0x157/0x760 mm/slab.c:3737
kstrdup+0x39/0x70 mm/util.c:49
bpf_symlink+0x26/0x140 kernel/bpf/inode.c:356
vfs_symlink+0x37a/0x5d0 fs/namei.c:4127
do_symlinkat+0x242/0x2d0 fs/namei.c:4154
__do_sys_symlink fs/namei.c:4173 [inline]
__se_sys_symlink fs/namei.c:4171 [inline]
__x64_sys_symlink+0x59/0x80 fs/namei.c:4171
do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 9425:
save_stack+0x43/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
__kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
__cache_free mm/slab.c:3498 [inline]
kfree+0xcf/0x230 mm/slab.c:3817
bpf_evict_inode+0x11f/0x150 kernel/bpf/inode.c:565
evict+0x4b9/0x980 fs/inode.c:558
iput_final fs/inode.c:1550 [inline]
iput+0x674/0xa90 fs/inode.c:1576
do_unlinkat+0x733/0xa30 fs/namei.c:4069
__do_sys_unlink fs/namei.c:4110 [inline]
__se_sys_unlink fs/namei.c:4108 [inline]
__x64_sys_unlink+0x42/0x50 fs/namei.c:4108
do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
In this scenario path lookup under RCU is racing with the final
unlink in case of symlinks. As Linus puts it in his analysis:
[...] We actually RCU-delay the inode freeing itself, but
when we do the final iput(), the "evict()" function is called
synchronously. Now, the simple fix would seem to just RCU-delay
the kfree() of the symlink data in bpf_evict_inode(). Maybe
that's the right thing to do. [...]
Al suggested to piggy-back on the ->destroy_inode() callback in
order to implement RCU deferral there which can then kfree() the
inode->i_link eventually right before putting inode back into
inode cache. By reusing free_inode_nonrcu() from there we can
avoid the need for our own inode cache and just reuse generic
one as we currently do.
And in-fact on top of all this we should just get rid of the
bpf_evict_inode() entirely. This means truncate_inode_pages_final()
and clear_inode() will then simply be called by the fs core via
evict(). Dropping the reference should really only be done when
inode is unhashed and nothing reachable anymore, so it's better
also moved into the final ->destroy_inode() callback.
Fixes:
|
||
|
Xu Yu
|
f5959dec08 |
bpf: do not restore dst_reg when cur_state is freed
commit 0803278b0b4d8eeb2b461fb698785df65a725d9e upstream.
Syzkaller hit 'KASAN: use-after-free Write in sanitize_ptr_alu' bug.
Call trace:
dump_stack+0xbf/0x12e
print_address_description+0x6a/0x280
kasan_report+0x237/0x360
sanitize_ptr_alu+0x85a/0x8d0
adjust_ptr_min_max_vals+0x8f2/0x1ca0
adjust_reg_min_max_vals+0x8ed/0x22e0
do_check+0x1ca6/0x5d00
bpf_check+0x9ca/0x2570
bpf_prog_load+0xc91/0x1030
__se_sys_bpf+0x61e/0x1f00
do_syscall_64+0xc8/0x550
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Fault injection trace:
kfree+0xea/0x290
free_func_state+0x4a/0x60
free_verifier_state+0x61/0xe0
push_stack+0x216/0x2f0 <- inject failslab
sanitize_ptr_alu+0x2b1/0x8d0
adjust_ptr_min_max_vals+0x8f2/0x1ca0
adjust_reg_min_max_vals+0x8ed/0x22e0
do_check+0x1ca6/0x5d00
bpf_check+0x9ca/0x2570
bpf_prog_load+0xc91/0x1030
__se_sys_bpf+0x61e/0x1f00
do_syscall_64+0xc8/0x550
entry_SYSCALL_64_after_hwframe+0x49/0xbe
When kzalloc() fails in push_stack(), free_verifier_state() will free
current verifier state. As push_stack() returns, dst_reg was restored
if ptr_is_dst_reg is false. However, as member of the cur_state,
dst_reg is also freed, and error occurs when dereferencing dst_reg.
Simply fix it by testing ret of push_stack() before restoring dst_reg.
Fixes: 979d63d50c0c ("bpf: prevent out of bounds speculation on pointer arithmetic")
Signed-off-by: Xu Yu <xuyu@linux.alibaba.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
|
Alban Crequy
|
02f8211b75 |
bpf, lpm: fix lookup bug in map_delete_elem
[ Upstream commit 7c0cdf0b3940f63d9777c3fcf250a2f83859ca54 ]
trie_delete_elem() was deleting an entry even though it was not matching
if the prefixlen was correct. This patch adds a check on matchlen.
Reproducer:
$ sudo bpftool map create /sys/fs/bpf/mylpm type lpm_trie key 8 value 1 entries 128 name mylpm flags 1
$ sudo bpftool map update pinned /sys/fs/bpf/mylpm key hex 10 00 00 00 aa bb cc dd value hex 01
$ sudo bpftool map dump pinned /sys/fs/bpf/mylpm
key: 10 00 00 00 aa bb cc dd value: 01
Found 1 element
$ sudo bpftool map delete pinned /sys/fs/bpf/mylpm key hex 10 00 00 00 ff ff ff ff
$ echo $?
0
$ sudo bpftool map dump pinned /sys/fs/bpf/mylpm
Found 0 elements
A similar reproducer is added in the selftests.
Without the patch:
$ sudo ./tools/testing/selftests/bpf/test_lpm_map
test_lpm_map: test_lpm_map.c:485: test_lpm_delete: Assertion `bpf_map_delete_elem(map_fd, key) == -1 && errno == ENOENT' failed.
Aborted
With the patch: test_lpm_map runs without errors.
Fixes:
|
||
|
Alexei Starovoitov
|
c7c68a1b9a |
bpf: fix lockdep false positive in stackmap
[ Upstream commit 3defaf2f15b2bfd86c6664181ac009e91985f8ac ]
Lockdep warns about false positive:
[ 11.211460] ------------[ cut here ]------------
[ 11.211936] DEBUG_LOCKS_WARN_ON(depth <= 0)
[ 11.211985] WARNING: CPU: 0 PID: 141 at ../kernel/locking/lockdep.c:3592 lock_release+0x1ad/0x280
[ 11.213134] Modules linked in:
[ 11.214954] RIP: 0010:lock_release+0x1ad/0x280
[ 11.223508] Call Trace:
[ 11.223705] <IRQ>
[ 11.223874] ? __local_bh_enable+0x7a/0x80
[ 11.224199] up_read+0x1c/0xa0
[ 11.224446] do_up_read+0x12/0x20
[ 11.224713] irq_work_run_list+0x43/0x70
[ 11.225030] irq_work_run+0x26/0x50
[ 11.225310] smp_irq_work_interrupt+0x57/0x1f0
[ 11.225662] irq_work_interrupt+0xf/0x20
since rw_semaphore is released in a different task vs task that locked the sema.
It is expected behavior.
Fix the warning with up_read_non_owner() and rwsem_release() annotation.
Fixes:
|
||
|
Martin KaFai Lau
|
ae26a7109c |
bpf: Fix syscall's stackmap lookup potential deadlock
[ Upstream commit 7c4cd051add3d00bbff008a133c936c515eaa8fe ] The map_lookup_elem used to not acquiring spinlock in order to optimize the reader. It was true until commit |
||
|
Alexei Starovoitov
|
e3bc64c9aa |
bpf: fix lockdep false positive in percpu_freelist
[ Upstream commit a89fac57b5d080771efd4d71feaae19877cf68f0 ]
Lockdep warns about false positive:
[ 12.492084] 00000000e6b28347 (&head->lock){+...}, at: pcpu_freelist_push+0x2a/0x40
[ 12.492696] but this lock was taken by another, HARDIRQ-safe lock in the past:
[ 12.493275] (&rq->lock){-.-.}
[ 12.493276]
[ 12.493276]
[ 12.493276] and interrupts could create inverse lock ordering between them.
[ 12.493276]
[ 12.494435]
[ 12.494435] other info that might help us debug this:
[ 12.494979] Possible interrupt unsafe locking scenario:
[ 12.494979]
[ 12.495518] CPU0 CPU1
[ 12.495879] ---- ----
[ 12.496243] lock(&head->lock);
[ 12.496502] local_irq_disable();
[ 12.496969] lock(&rq->lock);
[ 12.497431] lock(&head->lock);
[ 12.497890] <Interrupt>
[ 12.498104] lock(&rq->lock);
[ 12.498368]
[ 12.498368] *** DEADLOCK ***
[ 12.498368]
[ 12.498837] 1 lock held by dd/276:
[ 12.499110] #0: 00000000c58cb2ee (rcu_read_lock){....}, at: trace_call_bpf+0x5e/0x240
[ 12.499747]
[ 12.499747] the shortest dependencies between 2nd lock and 1st lock:
[ 12.500389] -> (&rq->lock){-.-.} {
[ 12.500669] IN-HARDIRQ-W at:
[ 12.500934] _raw_spin_lock+0x2f/0x40
[ 12.501373] scheduler_tick+0x4c/0xf0
[ 12.501812] update_process_times+0x40/0x50
[ 12.502294] tick_periodic+0x27/0xb0
[ 12.502723] tick_handle_periodic+0x1f/0x60
[ 12.503203] timer_interrupt+0x11/0x20
[ 12.503651] __handle_irq_event_percpu+0x43/0x2c0
[ 12.504167] handle_irq_event_percpu+0x20/0x50
[ 12.504674] handle_irq_event+0x37/0x60
[ 12.505139] handle_level_irq+0xa7/0x120
[ 12.505601] handle_irq+0xa1/0x150
[ 12.506018] do_IRQ+0x77/0x140
[ 12.506411] ret_from_intr+0x0/0x1d
[ 12.506834] _raw_spin_unlock_irqrestore+0x53/0x60
[ 12.507362] __setup_irq+0x481/0x730
[ 12.507789] setup_irq+0x49/0x80
[ 12.508195] hpet_time_init+0x21/0x32
[ 12.508644] x86_late_time_init+0xb/0x16
[ 12.509106] start_kernel+0x390/0x42a
[ 12.509554] secondary_startup_64+0xa4/0xb0
[ 12.510034] IN-SOFTIRQ-W at:
[ 12.510305] _raw_spin_lock+0x2f/0x40
[ 12.510772] try_to_wake_up+0x1c7/0x4e0
[ 12.511220] swake_up_locked+0x20/0x40
[ 12.511657] swake_up_one+0x1a/0x30
[ 12.512070] rcu_process_callbacks+0xc5/0x650
[ 12.512553] __do_softirq+0xe6/0x47b
[ 12.512978] irq_exit+0xc3/0xd0
[ 12.513372] smp_apic_timer_interrupt+0xa9/0x250
[ 12.513876] apic_timer_interrupt+0xf/0x20
[ 12.514343] default_idle+0x1c/0x170
[ 12.514765] do_idle+0x199/0x240
[ 12.515159] cpu_startup_entry+0x19/0x20
[ 12.515614] start_kernel+0x422/0x42a
[ 12.516045] secondary_startup_64+0xa4/0xb0
[ 12.516521] INITIAL USE at:
[ 12.516774] _raw_spin_lock_irqsave+0x38/0x50
[ 12.517258] rq_attach_root+0x16/0xd0
[ 12.517685] sched_init+0x2f2/0x3eb
[ 12.518096] start_kernel+0x1fb/0x42a
[ 12.518525] secondary_startup_64+0xa4/0xb0
[ 12.518986] }
[ 12.519132] ... key at: [<ffffffff82b7bc28>] __key.71384+0x0/0x8
[ 12.519649] ... acquired at:
[ 12.519892] pcpu_freelist_pop+0x7b/0xd0
[ 12.520221] bpf_get_stackid+0x1d2/0x4d0
[ 12.520563] ___bpf_prog_run+0x8b4/0x11a0
[ 12.520887]
[ 12.521008] -> (&head->lock){+...} {
[ 12.521292] HARDIRQ-ON-W at:
[ 12.521539] _raw_spin_lock+0x2f/0x40
[ 12.521950] pcpu_freelist_push+0x2a/0x40
[ 12.522396] bpf_get_stackid+0x494/0x4d0
[ 12.522828] ___bpf_prog_run+0x8b4/0x11a0
[ 12.523296] INITIAL USE at:
[ 12.523537] _raw_spin_lock+0x2f/0x40
[ 12.523944] pcpu_freelist_populate+0xc0/0x120
[ 12.524417] htab_map_alloc+0x405/0x500
[ 12.524835] __do_sys_bpf+0x1a3/0x1a90
[ 12.525253] do_syscall_64+0x4a/0x180
[ 12.525659] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 12.526167] }
[ 12.526311] ... key at: [<ffffffff838f7668>] __key.13130+0x0/0x8
[ 12.526812] ... acquired at:
[ 12.527047] __lock_acquire+0x521/0x1350
[ 12.527371] lock_acquire+0x98/0x190
[ 12.527680] _raw_spin_lock+0x2f/0x40
[ 12.527994] pcpu_freelist_push+0x2a/0x40
[ 12.528325] bpf_get_stackid+0x494/0x4d0
[ 12.528645] ___bpf_prog_run+0x8b4/0x11a0
[ 12.528970]
[ 12.529092]
[ 12.529092] stack backtrace:
[ 12.529444] CPU: 0 PID: 276 Comm: dd Not tainted 5.0.0-rc3-00018-g2fa53f892422 #475
[ 12.530043] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014
[ 12.530750] Call Trace:
[ 12.530948] dump_stack+0x5f/0x8b
[ 12.531248] check_usage_backwards+0x10c/0x120
[ 12.531598] ? ___bpf_prog_run+0x8b4/0x11a0
[ 12.531935] ? mark_lock+0x382/0x560
[ 12.532229] mark_lock+0x382/0x560
[ 12.532496] ? print_shortest_lock_dependencies+0x180/0x180
[ 12.532928] __lock_acquire+0x521/0x1350
[ 12.533271] ? find_get_entry+0x17f/0x2e0
[ 12.533586] ? find_get_entry+0x19c/0x2e0
[ 12.533902] ? lock_acquire+0x98/0x190
[ 12.534196] lock_acquire+0x98/0x190
[ 12.534482] ? pcpu_freelist_push+0x2a/0x40
[ 12.534810] _raw_spin_lock+0x2f/0x40
[ 12.535099] ? pcpu_freelist_push+0x2a/0x40
[ 12.535432] pcpu_freelist_push+0x2a/0x40
[ 12.535750] bpf_get_stackid+0x494/0x4d0
[ 12.536062] ___bpf_prog_run+0x8b4/0x11a0
It has been explained that is a false positive here:
https://lkml.org/lkml/2018/7/25/756
Recap:
- stackmap uses pcpu_freelist
- The lock in pcpu_freelist is a percpu lock
- stackmap is only used by tracing bpf_prog
- A tracing bpf_prog cannot be run if another bpf_prog
has already been running (ensured by the percpu bpf_prog_active counter).
Eric pointed out that this lockdep splats stops other
legit lockdep splats in selftests/bpf/test_progs.c.
Fix this by calling local_irq_save/restore for stackmap.
Another false positive had also been worked around by calling
local_irq_save in commit
|
||
|
Daniel Borkmann
|
ca490a9873 |
bpf: fix sanitation rewrite in case of non-pointers
commit 3612af783cf52c74a031a2f11b82247b2599d3cd upstream.
Marek reported that he saw an issue with the below snippet in that
timing measurements where off when loaded as unpriv while results
were reasonable when loaded as privileged:
[...]
uint64_t a = bpf_ktime_get_ns();
uint64_t b = bpf_ktime_get_ns();
uint64_t delta = b - a;
if ((int64_t)delta > 0) {
[...]
Turns out there is a bug where a corner case is missing in the fix
d3bd7413e0ca ("bpf: fix sanitation of alu op with pointer / scalar
type from different paths"), namely fixup_bpf_calls() only checks
whether aux has a non-zero alu_state, but it also needs to test for
the case of BPF_ALU_NON_POINTER since in both occasions we need to
skip the masking rewrite (as there is nothing to mask).
Fixes: d3bd7413e0ca ("bpf: fix sanitation of alu op with pointer / scalar type from different paths")
Reported-by: Marek Majkowski <marek@cloudflare.com>
Reported-by: Arthur Fabre <afabre@cloudflare.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/netdev/CAJPywTJqP34cK20iLM5YmUMz9KXQOdu1-+BZrGMAGgLuBWz7fg@mail.gmail.com/T/
Acked-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
|
Stanislav Fomichev
|
5c6fdd877e |
bpf: zero out build_id for BPF_STACK_BUILD_ID_IP
[ Upstream commit 4af396ae4836c4ecab61e975b8e61270c551894d ]
When returning BPF_STACK_BUILD_ID_IP from stack_map_get_build_id_offset,
make sure that build_id field is empty. Since we are using percpu
free list, there is a possibility that we might reuse some previous
bpf_stack_build_id with non-zero build_id.
Fixes:
|
||
|
Stanislav Fomichev
|
c4555b9f28 |
bpf: don't assume build-id length is always 20 bytes
[ Upstream commit 0b698005a9d11c0e91141ec11a2c4918a129f703 ]
Build-id length is not fixed to 20, it can be (`man ld` /--build-id):
* 128-bit (uuid)
* 160-bit (sha1)
* any length specified in ld --build-id=0xhexstring
To fix the issue of missing BPF_STACK_BUILD_ID_VALID for shorter build-ids,
assume that build-id is somewhere in the range of 1 .. 20.
Set the remaining bytes to zero.
v2:
* don't introduce new "len = min(BPF_BUILD_ID_SIZE, nhdr->n_descsz)",
we already know that nhdr->n_descsz <= BPF_BUILD_ID_SIZE if we enter
this 'if' condition
Fixes:
|
||
|
Song Liu
|
2f3480e340 |
bpf: fix panic in stack_map_get_build_id() on i386 and arm32
[ Upstream commit beaf3d1901f4ea46fbd5c9d857227d99751de469 ]
As Naresh reported, test_stacktrace_build_id() causes panic on i386 and
arm32 systems. This is caused by page_address() returns NULL in certain
cases.
This patch fixes this error by using kmap_atomic/kunmap_atomic instead
of page_address.
Fixes:
|
||
|
Daniel Borkmann
|
37c9e3ee42 |
bpf: fix inner map masking to prevent oob under speculation
[ commit 9d5564ddcf2a0f5ba3fa1c3a1f8a1b59ad309553 upstream ]
During review I noticed that inner meta map setup for map in
map is buggy in that it does not propagate all needed data
from the reference map which the verifier is later accessing.
In particular one such case is index masking to prevent out of
bounds access under speculative execution due to missing the
map's unpriv_array/index_mask field propagation. Fix this such
that the verifier is generating the correct code for inlined
lookups in case of unpriviledged use.
Before patch (test_verifier's 'map in map access' dump):
# bpftool prog dump xla id 3
0: (62) *(u32 *)(r10 -4) = 0
1: (bf) r2 = r10
2: (07) r2 += -4
3: (18) r1 = map[id:4]
5: (07) r1 += 272 |
6: (61) r0 = *(u32 *)(r2 +0) |
7: (35) if r0 >= 0x1 goto pc+6 | Inlined map in map lookup
8: (54) (u32) r0 &= (u32) 0 | with index masking for
9: (67) r0 <<= 3 | map->unpriv_array.
10: (0f) r0 += r1 |
11: (79) r0 = *(u64 *)(r0 +0) |
12: (15) if r0 == 0x0 goto pc+1 |
13: (05) goto pc+1 |
14: (b7) r0 = 0 |
15: (15) if r0 == 0x0 goto pc+11
16: (62) *(u32 *)(r10 -4) = 0
17: (bf) r2 = r10
18: (07) r2 += -4
19: (bf) r1 = r0
20: (07) r1 += 272 |
21: (61) r0 = *(u32 *)(r2 +0) | Index masking missing (!)
22: (35) if r0 >= 0x1 goto pc+3 | for inner map despite
23: (67) r0 <<= 3 | map->unpriv_array set.
24: (0f) r0 += r1 |
25: (05) goto pc+1 |
26: (b7) r0 = 0 |
27: (b7) r0 = 0
28: (95) exit
After patch:
# bpftool prog dump xla id 1
0: (62) *(u32 *)(r10 -4) = 0
1: (bf) r2 = r10
2: (07) r2 += -4
3: (18) r1 = map[id:2]
5: (07) r1 += 272 |
6: (61) r0 = *(u32 *)(r2 +0) |
7: (35) if r0 >= 0x1 goto pc+6 | Same inlined map in map lookup
8: (54) (u32) r0 &= (u32) 0 | with index masking due to
9: (67) r0 <<= 3 | map->unpriv_array.
10: (0f) r0 += r1 |
11: (79) r0 = *(u64 *)(r0 +0) |
12: (15) if r0 == 0x0 goto pc+1 |
13: (05) goto pc+1 |
14: (b7) r0 = 0 |
15: (15) if r0 == 0x0 goto pc+12
16: (62) *(u32 *)(r10 -4) = 0
17: (bf) r2 = r10
18: (07) r2 += -4
19: (bf) r1 = r0
20: (07) r1 += 272 |
21: (61) r0 = *(u32 *)(r2 +0) |
22: (35) if r0 >= 0x1 goto pc+4 | Now fixed inlined inner map
23: (54) (u32) r0 &= (u32) 0 | lookup with proper index masking
24: (67) r0 <<= 3 | for map->unpriv_array.
25: (0f) r0 += r1 |
26: (05) goto pc+1 |
27: (b7) r0 = 0 |
28: (b7) r0 = 0
29: (95) exit
Fixes:
|
||
|
Daniel Borkmann
|
eed84f94ff |
bpf: fix sanitation of alu op with pointer / scalar type from different paths
[ commit d3bd7413e0ca40b60cf60d4003246d067cafdeda upstream ]
While 979d63d50c0c ("bpf: prevent out of bounds speculation on pointer
arithmetic") took care of rejecting alu op on pointer when e.g. pointer
came from two different map values with different map properties such as
value size, Jann reported that a case was not covered yet when a given
alu op is used in both "ptr_reg += reg" and "numeric_reg += reg" from
different branches where we would incorrectly try to sanitize based
on the pointer's limit. Catch this corner case and reject the program
instead.
Fixes: 979d63d50c0c ("bpf: prevent out of bounds speculation on pointer arithmetic")
Reported-by: Jann Horn <jannh@google.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
||
|
Daniel Borkmann
|
f92a819b4c |
bpf: prevent out of bounds speculation on pointer arithmetic
[ commit 979d63d50c0c0f7bc537bf821e056cc9fe5abd38 upstream ] Jann reported that the original commit back in |
||
|
Daniel Borkmann
|
4f7f708d0e |
bpf: fix check_map_access smin_value test when pointer contains offset
[ commit b7137c4eab85c1cf3d46acdde90ce1163b28c873 upstream ] In check_map_access() we probe actual bounds through __check_map_access() with offset of reg->smin_value + off for lower bound and offset of reg->umax_value + off for the upper bound. However, even though the reg->smin_value could have a negative value, the final result of the sum with off could be positive when pointer arithmetic with known and unknown scalars is combined. In this case we reject the program with an error such as "R<x> min value is negative, either use unsigned index or do a if (index >=0) check." even though the access itself would be fine. Therefore extend the check to probe whether the actual resulting reg->smin_value + off is less than zero. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: Sasha Levin <sashal@kernel.org> |