1162 Commits

Author	SHA1	Message	Date
Pablo Neira Ayuso	f993c1a2b0	UPSTREAM: netfilter: nf_tables: deactivate anonymous set from preparation phase ... commit c1592a89942e9678f7d9c8030efa777c0d57edab upstream. Toggle deleted anonymous sets as inactive in the next generation, so users cannot perform any update on it. Clear the generation bitmask in case the transaction is aborted. The following KASAN splat shows a set element deletion for a bound anonymous set that has been already removed in the same transaction. [ 64.921510] ================================================================== [ 64.923123] BUG: KASAN: wild-memory-access in nf_tables_commit+0xa24/0x1490 [nf_tables] [ 64.924745] Write of size 8 at addr dead000000000122 by task test/890 [ 64.927903] CPU: 3 PID: 890 Comm: test Not tainted 6.3.0+ #253 [ 64.931120] Call Trace: [ 64.932699] <TASK> [ 64.934292] dump_stack_lvl+0x33/0x50 [ 64.935908] ? nf_tables_commit+0xa24/0x1490 [nf_tables] [ 64.937551] kasan_report+0xda/0x120 [ 64.939186] ? nf_tables_commit+0xa24/0x1490 [nf_tables] [ 64.940814] nf_tables_commit+0xa24/0x1490 [nf_tables] [ 64.942452] ? __kasan_slab_alloc+0x2d/0x60 [ 64.944070] ? nf_tables_setelem_notify+0x190/0x190 [nf_tables] [ 64.945710] ? kasan_set_track+0x21/0x30 [ 64.947323] nfnetlink_rcv_batch+0x709/0xd90 [nfnetlink] [ 64.948898] ? nfnetlink_rcv_msg+0x480/0x480 [nfnetlink] Bug: 282877000 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Lee Jones <joneslee@google.com> Change-Id: I536b7fbec55a5b37a57546023891a3dcfeb2c24b	2023-05-16 08:38:49 +01:00
Greg Kroah-Hartman	fc4de343bd	Merge 5.15.87 into android13-5.15-lts ... Changes in 5.15.87 usb: dwc3: qcom: Fix memory leak in dwc3_qcom_interconnect_init cifs: fix oops during encryption Revert "selftests/bpf: Add test for unstable CT lookup API" nvme-pci: fix doorbell buffer value endianness nvme-pci: fix mempool alloc size nvme-pci: fix page size checks ACPI: resource: Skip IRQ override on Asus Vivobook K3402ZA/K3502ZA ACPI: resource: do IRQ override on LENOVO IdeaPad ACPI: resource: do IRQ override on XMG Core 15 ACPI: resource: do IRQ override on Lenovo 14ALC7 block, bfq: fix uaf for bfqq in bfq_exit_icq_bfqq ata: ahci: Fix PCS quirk application for suspend nvme: fix the NVME_CMD_EFFECTS_CSE_MASK definition nvmet: don't defer passthrough commands with trivial effects to the workqueue fs/ntfs3: Validate BOOT record_size fs/ntfs3: Add overflow check for attribute size fs/ntfs3: Validate data run offset fs/ntfs3: Add null pointer check to attr_load_runs_vcn fs/ntfs3: Fix memory leak on ntfs_fill_super() error path fs/ntfs3: Add null pointer check for inode operations fs/ntfs3: Validate attribute name offset fs/ntfs3: Validate buffer length while parsing index fs/ntfs3: Validate resident attribute name fs/ntfs3: Fix slab-out-of-bounds read in run_unpack soundwire: dmi-quirks: add quirk variant for LAPBC710 NUC15 fs/ntfs3: Validate index root when initialize NTFS security fs/ntfs3: Use __GFP_NOWARN allocation at wnd_init() fs/ntfs3: Use __GFP_NOWARN allocation at ntfs_fill_super() fs/ntfs3: Delete duplicate condition in ntfs_read_mft() fs/ntfs3: Fix slab-out-of-bounds in r_page objtool: Fix SEGFAULT powerpc/rtas: avoid device tree lookups in rtas_os_term() powerpc/rtas: avoid scheduling in rtas_os_term() HID: multitouch: fix Asus ExpertBook P2 P2451FA trackpoint HID: plantronics: Additional PIDs for double volume key presses quirk pstore: Properly assign mem_type property pstore/zone: Use GFP_ATOMIC to allocate zone buffer hfsplus: fix bug causing custom uid and gid being unable to be assigned with mount binfmt: Fix error return code in load_elf_fdpic_binary() ovl: Use ovl mounter's fsuid and fsgid in ovl_link() ALSA: line6: correct midi status byte when receiving data from podxt ALSA: line6: fix stack overflow in line6_midi_transmit pnode: terminate at peers of source mfd: mt6360: Add bounds checking in Regmap read/write call-backs md: fix a crash in mempool_free mm, compaction: fix fast_isolate_around() to stay within boundaries f2fs: should put a page when checking the summary info f2fs: allow to read node block after shutdown mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING tpm: acpi: Call acpi_put_table() to fix memory leak tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails kcsan: Instrument memcpy/memset/memmove with newer Clang ASoC: Intel/SOF: use set_stream() instead of set_tdm_slots() for HDAudio ASoC/SoundWire: dai: expand 'stream' concept beyond SoundWire rcu-tasks: Simplify trc_read_check_handler() atomic operations net/af_packet: add VLAN support for AF_PACKET SOCK_RAW GSO net/af_packet: make sure to pull mac header media: stv0288: use explicitly signed char soc: qcom: Select REMAP_MMIO for LLCC driver kest.pl: Fix grub2 menu handling for rebooting ktest.pl minconfig: Unset configs instead of just removing them jbd2: use the correct print format perf/x86/intel/uncore: Disable I/O stacks to PMU mapping on ICX-D perf/x86/intel/uncore: Clear attr_update properly arm64: dts: qcom: sdm845-db845c: correct SPI2 pins drive strength mmc: sdhci-sprd: Disable CLK_AUTO when the clock is less than 400K btrfs: fix resolving backrefs for inline extent followed by prealloc ARM: ux500: do not directly dereference __iomem arm64: dts: qcom: sdm850-lenovo-yoga-c630: correct I2C12 pins drive strength selftests: Use optional USERCFLAGS and USERLDFLAGS PM/devfreq: governor: Add a private governor_data for governor cpufreq: Init completion before kobject_init_and_add() ALSA: patch_realtek: Fix Dell Inspiron Plus 16 ALSA: hda/realtek: Apply dual codec fixup for Dell Latitude laptops fs: dlm: fix sock release if listen fails fs: dlm: retry accept() until -EAGAIN or error returns mptcp: mark ops structures as ro_after_init mptcp: remove MPTCP 'ifdef' in TCP SYN cookies dm cache: Fix ABBA deadlock between shrink_slab and dm_cache_metadata_abort dm thin: Fix ABBA deadlock between shrink_slab and dm_pool_abort_metadata dm thin: Use last transaction's pmd->root when commit failed dm thin: resume even if in FAIL mode dm thin: Fix UAF in run_timer_softirq() dm integrity: Fix UAF in dm_integrity_dtr() dm clone: Fix UAF in clone_dtr() dm cache: Fix UAF in destroy() dm cache: set needs_check flag after aborting metadata tracing/hist: Fix out-of-bound write on 'action_data.var_ref_idx' perf/core: Call LSM hook after copying perf_event_attr of/kexec: Fix reading 32-bit "linux,initrd-{start,end}" values KVM: VMX: Resume guest immediately when injecting #GP on ECREATE KVM: nVMX: Inject #GP, not #UD, if "generic" VMXON CR0/CR4 check fails KVM: nVMX: Properly expose ENABLE_USR_WAIT_PAUSE control to L1 x86/microcode/intel: Do not retry microcode reloading on the APs ftrace/x86: Add back ftrace_expected for ftrace bug reports x86/kprobes: Fix kprobes instruction boudary check with CONFIG_RETHUNK x86/kprobes: Fix optprobe optimization check with CONFIG_RETHUNK tracing: Fix race where eprobes can be called before the event tracing: Fix complicated dependency of CONFIG_TRACER_MAX_TRACE tracing/hist: Fix wrong return value in parse_action_params() tracing/probes: Handle system names with hyphens tracing: Fix infinite loop in tracing_read_pipe on overflowed print_trace_line staging: media: tegra-video: fix chan->mipi value on error staging: media: tegra-video: fix device_node use after free ARM: 9256/1: NWFPE: avoid compiler-generated __aeabi_uldivmod media: dvb-core: Fix double free in dvb_register_device() media: dvb-core: Fix UAF due to refcount races at releasing cifs: fix confusing debug message cifs: fix missing display of three mount options rtc: ds1347: fix value written to century register block: mq-deadline: Do not break sequential write streams to zoned HDDs md/bitmap: Fix bitmap chunk size overflow issues efi: Add iMac Pro 2017 to uefi skip cert quirk wifi: wilc1000: sdio: fix module autoloading ASoC: jz4740-i2s: Handle independent FIFO flush bits ipu3-imgu: Fix NULL pointer dereference in imgu_subdev_set_selection() ipmi: fix long wait in unload when IPMI disconnect mtd: spi-nor: Check for zero erase size in spi_nor_find_best_erase_type() ima: Fix a potential NULL pointer access in ima_restore_measurement_list ipmi: fix use after free in _ipmi_destroy_user() PCI: Fix pci_device_is_present() for VFs by checking PF PCI/sysfs: Fix double free in error path riscv: stacktrace: Fixup ftrace_graph_ret_addr retp argument riscv: mm: notify remote harts about mmu cache updates crypto: n2 - add missing hash statesize crypto: ccp - Add support for TEE for PCI ID 0x14CA driver core: Fix bus_type.match() error handling in __driver_attach() phy: qcom-qmp-combo: fix sc8180x reset iommu/amd: Fix ivrs_acpihid cmdline parsing code remoteproc: core: Do pm_relax when in RPROC_OFFLINE state parisc: led: Fix potential null-ptr-deref in start_task() device_cgroup: Roll back to original exceptions after copy failure drm/connector: send hotplug uevent on connector cleanup drm/vmwgfx: Validate the box size for the snooped cursor drm/i915/dsi: fix VBT send packet port selection for dual link DSI drm/ingenic: Fix missing platform_driver_unregister() call in ingenic_drm_init() ext4: silence the warning when evicting inode with dioread_nolock ext4: add inode table check in __ext4_get_inode_loc to aovid possible infinite loop ext4: remove trailing newline from ext4_msg() message fs: ext4: initialize fsdata in pagecache_write() ext4: fix use-after-free in ext4_orphan_cleanup ext4: fix undefined behavior in bit shift for ext4_check_flag_values ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode ext4: add helper to check quota inums ext4: fix bug_on in __es_tree_search caused by bad quota inode ext4: fix reserved cluster accounting in __es_remove_extent() ext4: check and assert if marking an no_delete evicting inode dirty ext4: fix bug_on in __es_tree_search caused by bad boot loader inode ext4: fix leaking uninitialized memory in fast-commit journal ext4: fix uninititialized value in 'ext4_evict_inode' ext4: init quota for 'old.inode' in 'ext4_rename' ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline ext4: fix corruption when online resizing a 1K bigalloc fs ext4: fix error code return to user-space in ext4_get_branch() ext4: avoid BUG_ON when creating xattrs ext4: fix kernel BUG in 'ext4_write_inline_data_end()' ext4: fix inode leak in ext4_xattr_inode_create() on an error path ext4: initialize quota before expanding inode in setproject ioctl ext4: avoid unaccounted block allocation when expanding inode ext4: allocate extended attribute value in vmalloc area drm/amdgpu: handle polaris10/11 overlap asics (v2) drm/amdgpu: make display pinning more flexible (v2) block: mq-deadline: Fix dd_finish_request() for zoned devices tracing: Fix issue of missing one synthetic field ext4: remove unused enum EXT4_FC_COMMIT_FAILED ext4: use ext4_debug() instead of jbd_debug() ext4: introduce EXT4_FC_TAG_BASE_LEN helper ext4: factor out ext4_fc_get_tl() ext4: fix potential out of bound read in ext4_fc_replay_scan() ext4: disable fast-commit of encrypted dir operations ext4: don't set up encryption key during jbd2 transaction ext4: add missing validation of fast-commit record lengths ext4: fix unaligned memory access in ext4_fc_reserve_space() ext4: fix off-by-one errors in fast-commit block filling ARM: renumber bits related to _TIF_WORK_MASK phy: qcom-qmp-combo: fix out-of-bounds clock access btrfs: replace strncpy() with strscpy() btrfs: move missing device handling in a dedicate function btrfs: fix extent map use-after-free when handling missing device in read_one_chunk x86/mce: Get rid of msr_ops x86/MCE/AMD: Clear DFR errors found in THR handler media: s5p-mfc: Fix to handle reference queue during finishing media: s5p-mfc: Clear workbit to handle error condition media: s5p-mfc: Fix in register read and write for H264 perf probe: Use dwarf_attr_integrate as generic DWARF attr accessor perf probe: Fix to get the DW_AT_decl_file and DW_AT_call_file as unsinged data ravb: Fix "failed to switch device to config mode" message during unbind ext4: goto right label 'failed_mount3a' ext4: correct inconsistent error msg in nojournal mode mbcache: automatically delete entries from cache on freeing ext4: fix deadlock due to mbcache entry corruption drm/i915/migrate: don't check the scratch page drm/i915/migrate: fix offset calculation drm/i915/migrate: fix length calculation SUNRPC: ensure the matching upcall is in-flight upon downcall btrfs: fix an error handling path in btrfs_defrag_leaves() bpf: pull before calling skb_postpull_rcsum() drm/panfrost: Fix GEM handle creation ref-counting netfilter: nf_tables: consolidate set description netfilter: nf_tables: add function to create set stateful expressions netfilter: nf_tables: perform type checking for existing sets vmxnet3: correctly report csum_level for encapsulated packet netfilter: nf_tables: honor set timeout and garbage collection updates veth: Fix race with AF_XDP exposing old or uninitialized descriptors nfsd: shut down the NFSv4 state objects before the filecache net: hns3: add interrupts re-initialization while doing VF FLR net: hns3: refactor hns3_nic_reuse_page() net: hns3: extract macro to simplify ring stats update code net: hns3: fix miss L3E checking for rx packet net: hns3: fix VF promisc mode not update when mac table full net: sched: fix memory leak in tcindex_set_parms qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure net: dsa: mv88e6xxx: depend on PTP conditionally nfc: Fix potential resource leaks vdpa_sim: fix possible memory leak in vdpasim_net_init() and vdpasim_blk_init() vhost/vsock: Fix error handling in vhost_vsock_init() vringh: fix range used in iotlb_translate() vhost: fix range used in translate_desc() vdpa_sim: fix vringh initialization in vdpasim_queue_ready() net/mlx5: E-Switch, properly handle ingress tagged packets on VST net/mlx5: Add forgotten cleanup calls into mlx5_init_once() error path net/mlx5: Avoid recovery in probe flows net/mlx5e: IPoIB, Don't allow CQE compression to be turned on by default net/mlx5e: TC, Refactor mlx5e_tc_add_flow_mod_hdr() to get flow attr net/mlx5e: Always clear dest encap in neigh-update-del net/mlx5e: Fix hw mtu initializing at XDP SQ allocation net: amd-xgbe: add missed tasklet_kill net: ena: Fix toeplitz initial hash value net: ena: Don't register memory info on XDP exchange net: ena: Account for the number of processed bytes in XDP net: ena: Use bitmask to indicate packet redirection net: ena: Fix rx_copybreak value update net: ena: Set default value for RX interrupt moderation net: ena: Update NUMA TPH hint register upon NUMA node update net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device RDMA/mlx5: Fix validation of max_rd_atomic caps for DC drm/meson: Reduce the FIFO lines held when AFBC is not used filelock: new helper: vfs_inode_has_locks ceph: switch to vfs_inode_has_locks() to fix file lock bug gpio: sifive: Fix refcount leak in sifive_gpio_probe net: sched: atm: dont intepret cls results when asked to drop net: sched: cbq: dont intepret cls results when asked to drop net: sparx5: Fix reading of the MAC address netfilter: ipset: fix hash:net,port,net hang with /0 subnet netfilter: ipset: Rework long task execution when adding/deleting entries perf tools: Fix resources leak in perf_data__open_dir() drm/imx: ipuv3-plane: Fix overlay plane width fs/ntfs3: don't hold ni_lock when calling truncate_setsize() drivers/net/bonding/bond_3ad: return when there's no aggregator octeontx2-pf: Fix lmtst ID used in aura free usb: rndis_host: Secure rndis_query check against int overflow perf stat: Fix handling of --for-each-cgroup with --bpf-counters to match non BPF mode drm/i915: unpin on error in intel_vgpu_shadow_mm_pin() caif: fix memory leak in cfctrl_linkup_request() udf: Fix extension of the last extent in the file ASoC: Intel: bytcr_rt5640: Add quirk for the Advantech MICA-071 tablet nvme: fix multipath crash caused by flush request when blktrace is enabled io_uring: check for valid register opcode earlier nvmet: use NVME_CMD_EFFECTS_CSUPP instead of open coding it nvme: also return I/O command effects from nvme_command_effects btrfs: check superblock to ensure the fs was not modified at thaw time x86/kexec: Fix double-free of elf header buffer x86/bugs: Flush IBP in ib_prctl_set() nfsd: fix handling of readdir in v4root vs. mount upcall timeout fbdev: matroxfb: G200eW: Increase max memory from 1 MB to 16 MB block: don't allow splitting of a REQ_NOWAIT bio io_uring: fix CQ waiting timeout handling thermal: int340x: Add missing attribute for data rate base riscv: uaccess: fix type of 0 variable on error in get_user() riscv, kprobes: Stricter c.jr/c.jalr decoding drm/i915/gvt: fix gvt debugfs destroy drm/i915/gvt: fix vgpu debugfs clean in remove hfs/hfsplus: use WARN_ON for sanity check hfs/hfsplus: avoid WARN_ON() for sanity check, use proper error handling ksmbd: fix infinite loop in ksmbd_conn_handler_loop() ksmbd: check nt_len to be at least CIFS_ENCPWD_SIZE in ksmbd_decode_ntlmssp_auth_blob Revert "ACPI: PM: Add support for upcoming AMD uPEP HID AMDI007" mptcp: dedicated request sock for subflow in v6 mptcp: use proper req destructor for IPv6 ext4: don't allow journal inode to have encrypt flag selftests: set the BUILD variable to absolute path btrfs: make thaw time super block check to also verify checksum net: hns3: fix return value check bug of rx copybreak mbcache: Avoid nesting of cache->c_list_lock under bit locks efi: random: combine bootloader provided RNG seed with RNG protocol output io_uring: Fix unsigned 'res' comparison with zero in io_fixup_rw_res() drm/mgag200: Fix PLL setup for G200_SE_A rev >=4 Linux 5.15.87 Change-Id: I1df39ccb245b1e224417ee8deb8c7a5f9be2650a Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2023-01-31 12:22:42 +00:00
Pablo Neira Ayuso	ac95cdafac	netfilter: nf_tables: honor set timeout and garbage collection updates ... [ Upstream commit 123b99619cca94bdca0bf7bde9abe28f0a0dfe06 ] Set timeout and garbage collection interval updates are ignored on updates. Add transaction to update global set element timeout and garbage collection interval. Fixes: 96518518cc ("netfilter: add nftables") Suggested-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-01-12 11:59:09 +01:00
Pablo Neira Ayuso	996cd779c2	netfilter: nf_tables: consolidate set description ... [ Upstream commit bed4a63ea4ae77cfe5aae004ef87379f0655260a ] Add the following fields to the set description: - key type - data type - object type - policy - gc_int: garbage collection interval) - timeout: element timeout This prepares for stricter set type checks on updates in a follow up patch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Stable-dep-of: f6594c372afd ("netfilter: nf_tables: perform type checking for existing sets") Signed-off-by: Sasha Levin <sashal@kernel.org>	2023-01-12 11:59:08 +01:00
Greg Kroah-Hartman	889a0c39fe	Merge 5.15.64 into android13-5.15-lts ... Changes in 5.15.64 wifi: rtlwifi: remove always-true condition pointed out by GCC 12 eth: sun: cassini: remove dead code audit: fix potential double free on error path from fsnotify_add_inode_mark cgroup: Fix race condition at rebind_subsystems() parisc: Make CONFIG_64BIT available for ARCH=parisc64 only parisc: Fix exception handler for fldw and fstw instructions kernel/sys_ni: add compat entry for fadvise64_64 x86/entry: Move CLD to the start of the idtentry macro block: add a bdev_max_zone_append_sectors helper block: add bdev_max_segments() helper btrfs: zoned: revive max_zone_append_bytes btrfs: replace BTRFS_MAX_EXTENT_SIZE with fs_info->max_extent_size btrfs: convert count_max_extents() to use fs_info->max_extent_size Input: i8042 - move __initconst to fix code styling warning Input: i8042 - merge quirk tables Input: i8042 - add TUXEDO devices to i8042 quirk tables Input: i8042 - add additional TUXEDO devices to i8042 quirk tables drivers/base: fix userspace break from using bin_attributes for cpumap and cpulist scsi: qla2xxx: Fix response queue handler reading stale packets scsi: qla2xxx: edif: Fix dropped IKE message btrfs: put initial index value of a directory in a constant btrfs: pass the dentry to btrfs_log_new_name() instead of the inode btrfs: remove unnecessary parameter delalloc_start for writepage_delalloc() riscv: lib: uaccess: fold fixups into body riscv: lib: uaccess: fix CSR_STATUS SR_SUM bit xfrm: fix refcount leak in __xfrm_policy_check() xfrm: clone missing x->lastused in xfrm_do_migrate af_key: Do not call xfrm_probe_algs in parallel xfrm: policy: fix metadata dst->dev xmit null pointer dereference fs: require CAP_SYS_ADMIN in target namespace for idmapped mounts net: use eth_hw_addr_set() instead of ether_addr_copy() Revert "net: macsec: update SCI upon MAC address change." NFS: Don't allocate nfs_fattr on the stack in __nfs42_ssc_open() NFSv4.2 fix problems with __nfs42_ssc_open SUNRPC: RPC level errors should set task->tk_rpc_status mm/smaps: don't access young/dirty bit if pte unpresent ntfs: fix acl handling rose: check NULL rose_loopback_neigh->loopback r8152: fix the units of some registers for RTL8156A r8152: fix the RX FIFO settings when suspending nfc: pn533: Fix use-after-free bugs caused by pn532_cmd_timeout ice: xsk: Force rings to be sized to power of 2 ice: xsk: prohibit usage of non-balanced queue id net/mlx5e: Properly disable vlan strip on non-UL reps net/mlx5: Avoid false positive lockdep warning by adding lock_class_key net/mlx5e: Fix wrong application of the LRO state net/mlx5e: Fix wrong tc flag used when set hw-tc-offload off net: ipa: don't assume SMEM is page-aligned net: phy: Don't WARN for PHY_READY state in mdio_bus_phy_resume() net: moxa: get rid of asymmetry in DMA mapping/unmapping bonding: 802.3ad: fix no transmission of LACPDUs net: ipvtap - add __init/__exit annotations to module init/exit funcs netfilter: ebtables: reject blobs that don't provide all entry points bnxt_en: fix NQ resource accounting during vf creation on 57500 chips netfilter: nf_tables: disallow updates of implicit chain netfilter: nf_tables: make table handle allocation per-netns friendly netfilter: nft_payload: report ERANGE for too long offset and length netfilter: nft_payload: do not truncate csum_offset and csum_type netfilter: nf_tables: do not leave chain stats enabled on error netfilter: nft_osf: restrict osf to ipv4, ipv6 and inet families netfilter: nft_tunnel: restrict it to netdev family netfilter: nf_tables: consolidate rule verdict trace call netfilter: nft_cmp: optimize comparison for 16-bytes netfilter: bitwise: improve error goto labels netfilter: nf_tables: upfront validation of data via nft_data_init() netfilter: nf_tables: disallow jump to implicit chain from set element netfilter: nf_tables: disallow binding to already bound chain netfilter: flowtable: add function to invoke garbage collection immediately netfilter: flowtable: fix stuck flows on cleanup due to pending work net: Fix data-races around sysctl_[rw]mem_(max|default). net: Fix data-races around weight_p and dev_weight_[rt]x_bias. net: Fix data-races around netdev_max_backlog. net: Fix data-races around netdev_tstamp_prequeue. ratelimit: Fix data-races in ___ratelimit(). net: Fix data-races around sysctl_optmem_max. net: Fix a data-race around sysctl_tstamp_allow_data. net: Fix a data-race around sysctl_net_busy_poll. net: Fix a data-race around sysctl_net_busy_read. net: Fix a data-race around netdev_budget. tcp: expose the tcp_mark_push() and tcp_skb_entail() helpers mptcp: stop relying on tcp_tx_skb_cache net: Fix data-races around sysctl_max_skb_frags. net: Fix a data-race around netdev_budget_usecs. net: Fix data-races around sysctl_fb_tunnels_only_for_init_net. net: Fix data-races around sysctl_devconf_inherit_init_net. net: Fix a data-race around sysctl_somaxconn. ixgbe: stop resetting SYSTIME in ixgbe_ptp_start_cyclecounter i40e: Fix incorrect address type for IPv6 flow rules rxrpc: Fix locking in rxrpc's sendmsg ionic: widen queue_lock use around lif init and deinit ionic: clear broken state on generation change ionic: fix up issues with handling EAGAIN on FW cmds ionic: VF initial random MAC address if no assigned mac net: stmmac: work around sporadic tx issue on link-up btrfs: fix silent failure when deleting root reference btrfs: replace: drop assert for suspended replace btrfs: add info when mount fails due to stale replace target btrfs: check if root is readonly while setting security xattr btrfs: fix possible memory leak in btrfs_get_dev_args_from_path() perf/x86/lbr: Enable the branch type for the Arch LBR by default x86/unwind/orc: Unwind ftrace trampolines with correct ORC entry x86/bugs: Add "unknown" reporting for MMIO Stale Data x86/nospec: Unwreck the RSB stuffing loop: Check for overflow while configuring loop writeback: avoid use-after-free after removing device asm-generic: sections: refactor memory_intersects mm/damon/dbgfs: avoid duplicate context directory creation s390/mm: do not trigger write fault when vma does not allow VM_WRITE bootmem: remove the vmemmap pages from kmemleak in put_page_bootmem s390: fix double free of GS and RI CBs on fork() failure fbdev: fbcon: Properly revert changes when vc_resize() failed Revert "memcg: cleanup racy sum avoidance code" ACPI: processor: Remove freq Qos request for all CPUs nouveau: explicitly wait on the fence in nouveau_bo_move_m2mf smb3: missing inode locks in punch hole xen/privcmd: fix error exit of privcmd_ioctl_dm_op() riscv: traps: add missing prototype io_uring: fix issue with io_write() not always undoing sb_start_write() Revert "usbnet: smsc95xx: Fix deadlock on runtime resume" Revert "usbnet: smsc95xx: Forward PHY interrupts to PHY driver to avoid polling" mm/hugetlb: fix hugetlb not supporting softdirty tracking Revert "md-raid: destroy the bitmap after destroying the thread" md: call __md_stop_writes in md_stop mptcp: Fix crash due to tcp_tsorted_anchor was initialized before release skb arm64: Fix match_list for erratum 1286807 on Arm Cortex-A76 binder_alloc: add missing mmap_lock calls when using the VMA x86/nospec: Fix i386 RSB stuffing Documentation/ABI: Mention retbleed vulnerability info file for sysfs blk-mq: fix io hung due to missing commit_rqs perf python: Fix build when PYTHON_CONFIG is user supplied perf/x86/intel/uncore: Fix broken read_counter() for SNB IMC PMU perf/x86/intel/ds: Fix precise store latency handling perf stat: Clear evsel->reset_group for each stat run scsi: ufs: core: Enable link lost interrupt scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq bpf: Don't use tnum_range on array range checking for poke descriptors Linux 5.15.64 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Iaba96c173ad668df1c20b3bee08ce0e34f1068e1	2022-08-31 17:29:10 +02:00
Pablo Neira Ayuso	8fbdec08db	netfilter: flowtable: fix stuck flows on cleanup due to pending work ... [ Upstream commit 9afb4b27349a499483ae0134282cefd0c90f480f ] To clear the flow table on flow table free, the following sequence normally happens in order: 1) gc_step work is stopped to disable any further stats/del requests. 2) All flow table entries are set to teardown state. 3) Run gc_step which will queue HW del work for each flow table entry. 4) Waiting for the above del work to finish (flush). 5) Run gc_step again, deleting all entries from the flow table. 6) Flow table is freed. But if a flow table entry already has pending HW stats or HW add work step 3 will not queue HW del work (it will be skipped), step 4 will wait for the pending add/stats to finish, and step 5 will queue HW del work which might execute after freeing of the flow table. To fix the above, this patch flushes the pending work, then it sets the teardown flag to all flows in the flowtable and it forces a garbage collector run to queue work to remove the flows from hardware, then it flushes this new pending work and (finally) it forces another garbage collector run to remove the entry from the software flowtable. Stack trace: [47773.882335] BUG: KASAN: use-after-free in down_read+0x99/0x460 [47773.883634] Write of size 8 at addr ffff888103b45aa8 by task kworker/u20:6/543704 [47773.885634] CPU: 3 PID: 543704 Comm: kworker/u20:6 Not tainted 5.12.0-rc7+ #2 [47773.886745] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009) [47773.888438] Workqueue: nf_ft_offload_del flow_offload_work_handler [nf_flow_table] [47773.889727] Call Trace: [47773.890214] dump_stack+0xbb/0x107 [47773.890818] print_address_description.constprop.0+0x18/0x140 [47773.892990] kasan_report.cold+0x7c/0xd8 [47773.894459] kasan_check_range+0x145/0x1a0 [47773.895174] down_read+0x99/0x460 [47773.899706] nf_flow_offload_tuple+0x24f/0x3c0 [nf_flow_table] [47773.907137] flow_offload_work_handler+0x72d/0xbe0 [nf_flow_table] [47773.913372] process_one_work+0x8ac/0x14e0 [47773.921325] [47773.921325] Allocated by task 592159: [47773.922031] kasan_save_stack+0x1b/0x40 [47773.922730] __kasan_kmalloc+0x7a/0x90 [47773.923411] tcf_ct_flow_table_get+0x3cb/0x1230 [act_ct] [47773.924363] tcf_ct_init+0x71c/0x1156 [act_ct] [47773.925207] tcf_action_init_1+0x45b/0x700 [47773.925987] tcf_action_init+0x453/0x6b0 [47773.926692] tcf_exts_validate+0x3d0/0x600 [47773.927419] fl_change+0x757/0x4a51 [cls_flower] [47773.928227] tc_new_tfilter+0x89a/0x2070 [47773.936652] [47773.936652] Freed by task 543704: [47773.937303] kasan_save_stack+0x1b/0x40 [47773.938039] kasan_set_track+0x1c/0x30 [47773.938731] kasan_set_free_info+0x20/0x30 [47773.939467] __kasan_slab_free+0xe7/0x120 [47773.940194] slab_free_freelist_hook+0x86/0x190 [47773.941038] kfree+0xce/0x3a0 [47773.941644] tcf_ct_flow_table_cleanup_work Original patch description and stack trace by Paul Blakey. Fixes: c29f74e0df ("netfilter: nf_flow_table: hardware offload support") Reported-by: Paul Blakey <paulb@nvidia.com> Tested-by: Paul Blakey <paulb@nvidia.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-08-31 17:16:42 +02:00
Pablo Neira Ayuso	eb6645a0f2	netfilter: flowtable: add function to invoke garbage collection immediately ... [ Upstream commit 759eebbcfafcefa23b59e912396306543764bd3c ] Expose nf_flow_table_gc_run() to force a garbage collector run from the offload infrastructure. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-08-31 17:16:42 +02:00
Pablo Neira Ayuso	7196f4577f	netfilter: nf_tables: disallow jump to implicit chain from set element ... [ Upstream commit f323ef3a0d49e147365284bc1f02212e617b7f09 ] Extend struct nft_data_desc to add a flag field that specifies nft_data_init() is being called for set element data. Use it to disallow jump to implicit chain from set element, only jump to chain via immediate expression is allowed. Fixes: d0e2c7de92 ("netfilter: nf_tables: add NFT_CHAIN_BINDING") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-08-31 17:16:42 +02:00
Pablo Neira Ayuso	4097749aec	netfilter: nf_tables: upfront validation of data via nft_data_init() ... [ Upstream commit 341b6941608762d8235f3fd1e45e4d7114ed8c2c ] Instead of parsing the data and then validate that type and length are correct, pass a description of the expected data so it can be validated upfront before parsing it to bail out earlier. This patch adds a new .size field to specify the maximum size of the data area. The .len field is optional and it is used as an input/output field, it provides the specific length of the expected data in the input path. If then .len field is not specified, then obtained length from the netlink attribute is stored. This is required by cmp, bitwise, range and immediate, which provide no netlink attribute that describes the data length. The immediate expression uses the destination register type to infer the expected data type. Relying on opencoded validation of the expected data might lead to subtle bugs as described in 7e6bc1f6cabc ("netfilter: nf_tables: stricter validation of element data"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-08-31 17:16:41 +02:00
Pablo Neira Ayuso	9bf98120a9	netfilter: nft_cmp: optimize comparison for 16-bytes ... [ Upstream commit 23f68d462984bfda47c7bf663dca347e8e3df549 ] Allow up to 16-byte comparisons with a new cmp fast version. Use two 64-bit words and calculate the mask representing the bits to be compared. Make sure the comparison is 64-bit aligned and avoid out-of-bound memory access on registers. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-08-31 17:16:41 +02:00
Pablo Neira Ayuso	fbaeb8046e	netfilter: nf_tables: make table handle allocation per-netns friendly ... [ Upstream commit ab482c6b66a4a8c0a8c0b0f577a785cf9ff1c2e2 ] mutex is per-netns, move table_netns to the pernet area. *read-write* to 0xffffffff883a01e8 of 8 bytes by task 6542 on cpu 0: nf_tables_newtable+0x6dc/0xc00 net/netfilter/nf_tables_api.c:1221 nfnetlink_rcv_batch net/netfilter/nfnetlink.c:513 [inline] nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline] nfnetlink_rcv+0xa6a/0x13a0 net/netfilter/nfnetlink.c:652 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x652/0x730 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x643/0x740 net/netlink/af_netlink.c:1921 Fixes: f102d66b33 ("netfilter: nf_tables: use dedicated mutex to guard transactions") Reported-by: Abhishek Shah <abhishek.shah@columbia.edu> Reviewed-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-08-31 17:16:40 +02:00
Greg Kroah-Hartman	817780c598	Merge 5.15.56 into android13-5.15-lts ... Changes in 5.15.56 ALSA: hda - Add fixup for Dell Latitidue E5430 ALSA: hda/conexant: Apply quirk for another HP ProDesk 600 G3 model ALSA: hda/realtek: Fix headset mic for Acer SF313-51 ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 ALSA: hda/realtek: fix mute/micmute LEDs for HP machines ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc221 ALSA: hda/realtek - Enable the headset-mic on a Xiaomi's laptop xen/netback: avoid entering xenvif_rx_next_skb() with an empty rx queue fix race between exit_itimers() and /proc/pid/timers mm: userfaultfd: fix UFFDIO_CONTINUE on fallocated shmem pages mm: split huge PUD on wp_huge_pud fallback tracing/histograms: Fix memory leak problem net: sock: tracing: Fix sock_exceed_buf_limit not to dereference stale pointer ip: fix dflt addr selection for connected nexthop ARM: 9213/1: Print message about disabled Spectre workarounds only once ARM: 9214/1: alignment: advance IT state after emulating Thumb instruction wifi: mac80211: fix queue selection for mesh/OCB interfaces cgroup: Use separate src/dst nodes when preloading css_sets for migration btrfs: return -EAGAIN for NOWAIT dio reads/writes on compressed and inline extents drm/panfrost: Put mapping instead of shmem obj on panfrost_mmu_map_fault_addr() error drm/panfrost: Fix shrinker list corruption by madvise IOCTL fs/remap: constrain dedupe of EOF blocks nilfs2: fix incorrect masking of permission flags for symlinks sh: convert nommu io{re,un}map() to static inline functions Revert "evm: Fix memleak in init_desc" xfs: only run COW extent recovery when there are no live extents xfs: don't include bnobt blocks when reserving free block pool xfs: run callbacks before waking waiters in xlog_state_shutdown_callbacks xfs: drop async cache flushes from CIL commits. reset: Fix devm bulk optional exclusive control getter ARM: dts: imx6qdl-ts7970: Fix ngpio typo and count spi: amd: Limit max transfer and message size ARM: 9209/1: Spectre-BHB: avoid pr_info() every time a CPU comes out of idle ARM: 9210/1: Mark the FDT_FIXED sections as shareable net/mlx5e: kTLS, Fix build time constant test in TX net/mlx5e: kTLS, Fix build time constant test in RX net/mlx5e: Fix enabling sriov while tc nic rules are offloaded net/mlx5e: Fix capability check for updating vnic env counters net/mlx5e: Ring the TX doorbell on DMA errors drm/i915: fix a possible refcount leak in intel_dp_add_mst_connector() ima: Fix a potential integer overflow in ima_appraise_measurement ASoC: sgtl5000: Fix noise on shutdown/remove ASoC: tas2764: Add post reset delays ASoC: tas2764: Fix and extend FSYNC polarity handling ASoC: tas2764: Correct playback volume range ASoC: tas2764: Fix amp gain register offset & default ASoC: Intel: Skylake: Correct the ssp rate discovery in skl_get_ssp_clks() ASoC: Intel: Skylake: Correct the handling of fmt_config flexible array net: stmmac: dwc-qos: Disable split header for Tegra194 net: ethernet: ti: am65-cpsw: Fix devlink port register sequence sysctl: Fix data races in proc_dointvec(). sysctl: Fix data races in proc_douintvec(). sysctl: Fix data races in proc_dointvec_minmax(). sysctl: Fix data races in proc_douintvec_minmax(). sysctl: Fix data races in proc_doulongvec_minmax(). sysctl: Fix data races in proc_dointvec_jiffies(). tcp: Fix a data-race around sysctl_tcp_max_orphans. inetpeer: Fix data-races around sysctl. net: Fix data-races around sysctl_mem. cipso: Fix data-races around sysctl. icmp: Fix data-races around sysctl. ipv4: Fix a data-race around sysctl_fib_sync_mem. ARM: dts: at91: sama5d2: Fix typo in i2s1 node ARM: dts: sunxi: Fix SPI NOR campatible on Orange Pi Zero arm64: dts: broadcom: bcm4908: Fix timer node for BCM4906 SoC arm64: dts: broadcom: bcm4908: Fix cpu node for smp boot netfilter: nf_log: incorrect offset to network header netfilter: nf_tables: replace BUG_ON by element length check drm/i915/gvt: IS_ERR() vs NULL bug in intel_gvt_update_reg_whitelist() xen/gntdev: Ignore failure to unmap INVALID_GRANT_HANDLE lockd: set fl_owner when unlocking files lockd: fix nlm_close_files tracing: Fix sleeping while atomic in kdb ftdump drm/i915/selftests: fix a couple IS_ERR() vs NULL tests drm/i915/dg2: Add Wa_22011100796 drm/i915/gt: Serialize GRDOM access between multiple engine resets drm/i915/gt: Serialize TLB invalidates with GT resets drm/i915/uc: correctly track uc_fw init failure drm/i915: Require the vm mutex for i915_vma_bind() bnxt_en: Fix bnxt_reinit_after_abort() code path bnxt_en: Fix bnxt_refclk_read() sysctl: Fix data-races in proc_dou8vec_minmax(). sysctl: Fix data-races in proc_dointvec_ms_jiffies(). icmp: Fix data-races around sysctl_icmp_echo_enable_probe. icmp: Fix a data-race around sysctl_icmp_ignore_bogus_error_responses. icmp: Fix a data-race around sysctl_icmp_errors_use_inbound_ifaddr. icmp: Fix a data-race around sysctl_icmp_ratelimit. icmp: Fix a data-race around sysctl_icmp_ratemask. raw: Fix a data-race around sysctl_raw_l3mdev_accept. tcp: Fix a data-race around sysctl_tcp_ecn_fallback. ipv4: Fix data-races around sysctl_ip_dynaddr. nexthop: Fix data-races around nexthop_compat_mode. net: ftgmac100: Hold reference returned by of_get_child_by_name() net: stmmac: fix leaks in probe ima: force signature verification when CONFIG_KEXEC_SIG is configured ima: Fix potential memory leak in ima_init_crypto() drm/amd/display: Only use depth 36 bpp linebuffers on DCN display engines. drm/amd/pm: Prevent divide by zero sfc: fix use after free when disabling sriov ceph: switch netfs read ops to use rreq->inode instead of rreq->mapping->host seg6: fix skb checksum evaluation in SRH encapsulation/insertion seg6: fix skb checksum in SRv6 End.B6 and End.B6.Encaps behaviors seg6: bpf: fix skb checksum in bpf_push_seg6_encap() sfc: fix kernel panic when creating VF net: atlantic: remove deep parameter on suspend/resume functions net: atlantic: remove aq_nic_deinit() when resume KVM: x86: Fully initialize 'struct kvm_lapic_irq' in kvm_pv_kick_cpu_op() net/tls: Check for errors in tls_device_init ACPI: video: Fix acpi_video_handles_brightness_key_presses() mm: sysctl: fix missing numa_stat when !CONFIG_HUGETLB_PAGE btrfs: rename btrfs_bio to btrfs_io_context btrfs: zoned: fix a leaked bioc in read_zone_info ksmbd: use SOCK_NONBLOCK type for kernel_accept() powerpc/xive/spapr: correct bitmap allocation size vdpa/mlx5: Initialize CVQ vringh only once vduse: Tie vduse mgmtdev and its device virtio_mmio: Add missing PM calls to freeze/restore virtio_mmio: Restore guest page size on resume netfilter: br_netfilter: do not skip all hooks with 0 priority scsi: hisi_sas: Limit max hw sectors for v3 HW cpufreq: pmac32-cpufreq: Fix refcount leak bug platform/x86: hp-wmi: Ignore Sanitization Mode event firmware: sysfb: Make sysfb_create_simplefb() return a pdev pointer firmware: sysfb: Add sysfb_disable() helper function fbdev: Disable sysfb device registration when removing conflicting FBs net: tipc: fix possible refcount leak in tipc_sk_create() NFC: nxp-nci: don't print header length mismatch on i2c error nvme-tcp: always fail a request when sending it failed nvme: fix regression when disconnect a recovering ctrl net: sfp: fix memory leak in sfp_probe() ASoC: ops: Fix off by one in range control validation pinctrl: aspeed: Fix potential NULL dereference in aspeed_pinmux_set_mux() ASoC: Realtek/Maxim SoundWire codecs: disable pm_runtime on remove ASoC: rt711-sdca-sdw: fix calibrate mutex initialization ASoC: Intel: sof_sdw: handle errors on card registration ASoC: rt711: fix calibrate mutex initialization ASoC: rt7*-sdw: harden jack_detect_handler ASoC: codecs: rt700/rt711/rt711-sdca: initialize workqueues in probe ASoC: SOF: Intel: hda-loader: Clarify the cl_dsp_init() flow ASoC: wcd938x: Fix event generation for some controls ASoC: Intel: bytcr_wm5102: Fix GPIO related probe-ordering problem ASoC: wm5110: Fix DRE control ASoC: rt711-sdca: fix kernel NULL pointer dereference when IO error ASoC: dapm: Initialise kcontrol data for mux/demux controls ASoC: cs47l15: Fix event generation for low power mux control ASoC: madera: Fix event generation for OUT1 demux ASoC: madera: Fix event generation for rate controls irqchip: or1k-pic: Undefine mask_ack for level triggered hardware x86: Clear .brk area at early boot soc: ixp4xx/npe: Fix unused match warning ARM: dts: stm32: use the correct clock source for CEC on stm32mp151 Revert "can: xilinx_can: Limit CANFD brp to 2" ALSA: usb-audio: Add quirks for MacroSilicon MS2100/MS2106 devices ALSA: usb-audio: Add quirk for Fiero SC-01 ALSA: usb-audio: Add quirk for Fiero SC-01 (fw v1.0.0) nvme-pci: phison e16 has bogus namespace ids signal handling: don't use BUG_ON() for debugging USB: serial: ftdi_sio: add Belimo device ids usb: typec: add missing uevent when partner support PD usb: dwc3: gadget: Fix event pending check tty: serial: samsung_tty: set dma burst_size to 1 vt: fix memory overlapping when deleting chars in the buffer serial: 8250: fix return error code in serial8250_request_std_resource() serial: stm32: Clear prev values before setting RTS delays serial: pl011: UPSTAT_AUTORTS requires .throttle/unthrottle serial: 8250: Fix PM usage_count for console handover x86/pat: Fix x86_has_pat_wp() drm/aperture: Run fbdev removal before internal helpers Linux 5.15.56 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ib44efbedc8fea205005bd3ec2806ebb8cb19710d	2022-08-10 16:54:10 +02:00
Greg Kroah-Hartman	85e3c21eb8	Merge 5.15.54 into android13-5.15-lts ... Changes in 5.15.54 mm/slub: add missing TID updates on slab deactivation mm/filemap: fix UAF in find_lock_entries Revert "selftests/bpf: Add test for bpf_timer overwriting crash" ALSA: usb-audio: Workarounds for Behringer UMC 204/404 HD ALSA: hda/realtek: Add quirk for Clevo L140PU ALSA: cs46xx: Fix missing snd_card_free() call at probe error can: bcm: use call_rcu() instead of costly synchronize_rcu() can: grcan: grcan_probe(): remove extra of_node_get() can: gs_usb: gs_usb_open/close(): fix memory leak can: m_can: m_can_chip_config(): actually enable internal timestamping can: m_can: m_can_{read_fifo,echo_tx_event}(): shift timestamp to full 32 bits can: mcp251xfd: mcp251xfd_regmap_crc_read(): improve workaround handling for mcp2517fd can: mcp251xfd: mcp251xfd_regmap_crc_read(): update workaround broken CRC on TBC register bpf: Fix incorrect verifier simulation around jmp32's jeq/jne bpf: Fix insufficient bounds propagation from adjust_scalar_min_max_vals usbnet: fix memory leak in error case net: rose: fix UAF bug caused by rose_t0timer_expiry netfilter: nft_set_pipapo: release elements in clone from abort path netfilter: nf_tables: stricter validation of element data btrfs: rename btrfs_alloc_chunk to btrfs_create_chunk btrfs: add additional parameters to btrfs_init_tree_ref/btrfs_init_data_ref btrfs: fix invalid delayed ref after subvolume creation failure btrfs: fix warning when freeing leaf after subvolume creation failure Input: cpcap-pwrbutton - handle errors from platform_get_irq() Input: goodix - change goodix_i2c_write() len parameter type to int Input: goodix - add a goodix.h header file Input: goodix - refactor reset handling Input: goodix - try not to touch the reset-pin on x86/ACPI devices dma-buf/poll: Get a file reference for outstanding fence callbacks btrfs: fix deadlock between chunk allocation and chunk btree modifications drm/i915: Disable bonding on gen12+ platforms drm/i915/gt: Register the migrate contexts with their engines drm/i915: Replace the unconditional clflush with drm_clflush_virt_range() PCI/portdrv: Rename pm_iter() to pcie_port_device_iter() PCI: pciehp: Ignore Link Down/Up caused by error-induced Hot Reset media: ir_toy: prevent device from hanging during transmit memory: renesas-rpc-if: Avoid unaligned bus access for HyperFlash ath11k: add hw_param for wakeup_mhi qed: Improve the stack space of filter_config() platform/x86: wmi: introduce helper to convert driver to WMI driver platform/x86: wmi: Replace read_takes_no_args with a flags field platform/x86: wmi: Fix driver->notify() vs ->probe() race mt76: mt7921: get rid of mt7921_mac_set_beacon_filter mt76: mt7921: introduce mt7921_mcu_set_beacon_filter utility routine mt76: mt7921: fix a possible race enabling/disabling runtime-pm bpf: Stop caching subprog index in the bpf_pseudo_func insn bpf, arm64: Use emit_addr_mov_i64() for BPF_PSEUDO_FUNC riscv: defconfig: enable DRM_NOUVEAU RISC-V: defconfigs: Set CONFIG_FB=y, for FB console net/mlx5e: Check action fwd/drop flag exists also for nic flows net/mlx5e: Split actions_match_supported() into a sub function net/mlx5e: TC, Reject rules with drop and modify hdr action net/mlx5e: TC, Reject rules with forward and drop actions ASoC: rt5682: Avoid the unexpected IRQ event during going to suspend ASoC: rt5682: Re-detect the combo jack after resuming ASoC: rt5682: Fix deadlock on resume netfilter: nf_tables: convert pktinfo->tprot_set to flags field netfilter: nft_payload: support for inner header matching / mangling netfilter: nft_payload: don't allow th access for fragments s390/boot: allocate amode31 section in decompressor s390/setup: use physical pointers for memblock_reserve() s390/setup: preserve memory at OLDMEM_BASE and OLDMEM_SIZE ibmvnic: init init_done_rc earlier ibmvnic: clear fop when retrying probe ibmvnic: Allow queueing resets during probe virtio-blk: avoid preallocating big SGL for data io_uring: ensure that fsnotify is always called block: use bdev_get_queue() in bio.c block: only mark bio as tracked if it really is tracked block: fix rq-qos breakage from skipping rq_qos_done_bio() stddef: Introduce struct_group() helper macro media: omap3isp: Use struct_group() for memcpy() region media: davinci: vpif: fix use-after-free on driver unbind mt76: mt76_connac: fix MCU_CE_CMD_SET_ROC definition error mt76: mt7921: do not always disable fw runtime-pm cxl/port: Hold port reference until decoder release clk: renesas: r9a07g044: Update multiplier and divider values for PLL2/3 KVM: x86/mmu: Use yield-safe TDP MMU root iter in MMU notifier unmapping KVM: x86/mmu: Use common TDP MMU zap helper for MMU notifier unmap hook scsi: qla2xxx: Move heartbeat handling from DPC thread to workqueue scsi: qla2xxx: Fix laggy FC remote port session recovery scsi: qla2xxx: edif: Replace list_for_each_safe with list_for_each_entry_safe scsi: qla2xxx: Fix crash during module load unload test gfs2: Fix gfs2_file_buffered_write endless loop workaround vdpa/mlx5: Avoid processing works if workqueue was destroyed btrfs: handle device lookup with btrfs_dev_lookup_args btrfs: add a btrfs_get_dev_args_from_path helper btrfs: use btrfs_get_dev_args_from_path in dev removal ioctls btrfs: remove device item and update super block in the same transaction drbd: add error handling support for add_disk() drbd: Fix double free problem in drbd_create_device drbd: fix an invalid memory access caused by incorrect use of list iterator drm/amd/display: Set min dcfclk if pipe count is 0 drm/amd/display: Fix by adding FPU protection for dcn30_internal_validate_bw NFSD: De-duplicate net_generic(nf->nf_net, nfsd_net_id) NFSD: COMMIT operations must not return NFS?ERR_INVAL riscv/mm: Add XIP_FIXUP for riscv_pfn_base iio: accel: mma8452: use the correct logic to get mma8452_data batman-adv: Use netif_rx(). mtd: spi-nor: Skip erase logic when SPI_NOR_NO_ERASE is set Compiler Attributes: add __alloc_size() for better bounds checking mm: vmalloc: introduce array allocation functions KVM: use __vcalloc for very large allocations btrfs: don't access possibly stale fs_info data in device_list_add KVM: s390x: fix SCK locking scsi: qla2xxx: Fix loss of NVMe namespaces after driver reload test powerpc/32: Don't use lmw/stmw for saving/restoring non volatile regs powerpc: flexible GPR range save/restore macros powerpc/tm: Fix more userspace r13 corruption serial: sc16is7xx: Clear RS485 bits in the shutdown bus: mhi: core: Use correctly sized arguments for bit field bus: mhi: Fix pm_state conversion to string stddef: Introduce DECLARE_FLEX_ARRAY() helper uapi/linux/stddef.h: Add include guards ASoC: rt5682: move clk related code to rt5682_i2c_probe ASoC: rt5682: fix an incorrect NULL check on list iterator drm/amd/vcn: fix an error msg on vcn 3.0 KVM: Don't create VM debugfs files outside of the VM directory tty: n_gsm: Modify CR,PF bit when config requester tty: n_gsm: Save dlci address open status when config requester tty: n_gsm: fix frame reception handling ALSA: usb-audio: add mapping for MSI MPG X570S Carbon Max Wifi. ALSA: usb-audio: add mapping for MSI MAG X570S Torpedo MAX. tty: n_gsm: fix missing update of modem controls after DLCI open btrfs: zoned: encapsulate inode locking for zoned relocation btrfs: zoned: use dedicated lock for data relocation KVM: Initialize debugfs_dentry when a VM is created to avoid NULL deref mm/hwpoison: mf_mutex for soft offline and unpoison mm/hwpoison: avoid the impact of hwpoison_filter() return value on mce handler mm/memory-failure.c: fix race with changing page compound again mm/hwpoison: fix race between hugetlb free/demotion and memory_failure_hugetlb() tty: n_gsm: fix invalid use of MSC in advanced option tty: n_gsm: fix sometimes uninitialized warning in gsm_dlci_modem_output() serial: 8250_mtk: Make sure to select the right FEATURE_SEL tty: n_gsm: fix invalid gsmtty_write_room() result drm/amd: Refactor `amdgpu_aspm` to be evaluated per device drm/amdgpu: vi: disable ASPM on Intel Alder Lake based systems drm/i915: Fix a race between vma / object destruction and unbinding drm/mediatek: Use mailbox rx_callback instead of cmdq_task_cb drm/mediatek: Remove the pointer of struct cmdq_client drm/mediatek: Detect CMDQ execution timeout drm/mediatek: Add cmdq_handle in mtk_crtc drm/mediatek: Add vblank register/unregister callback functions Bluetooth: protect le accept and resolv lists with hdev->lock Bluetooth: btmtksdio: fix use-after-free at btmtksdio_recv_event io_uring: avoid io-wq -EAGAIN looping for !IOPOLL irqchip/gic-v3: Ensure pseudo-NMIs have an ISB between ack and handling irqchip/gic-v3: Refactor ISB + EOIR at ack time rxrpc: Fix locking issue dt-bindings: soc: qcom: smd-rpm: Add compatible for MSM8953 SoC dt-bindings: soc: qcom: smd-rpm: Fix missing MSM8936 compatible module: change to print useful messages from elf_validity_check() module: fix [e_shstrndx].sh_size=0 OOB access iommu/vt-d: Fix PCI bus rescan device hot add fbdev: fbmem: Fix logo center image dx issue fbmem: Check virtual screen sizes in fb_set_var() fbcon: Disallow setting font bigger than screen size fbcon: Prevent that screen size is smaller than font size PM: runtime: Redefine pm_runtime_release_supplier() memregion: Fix memregion_free() fallback definition video: of_display_timing.h: include errno.h powerpc/powernv: delay rng platform device creation until later in boot net: dsa: qca8k: reset cpu port on MTU change can: kvaser_usb: replace run-time checks with struct kvaser_usb_driver_info can: kvaser_usb: kvaser_usb_leaf: fix CAN clock frequency regression can: kvaser_usb: kvaser_usb_leaf: fix bittiming limits xfs: remove incorrect ASSERT in xfs_rename Revert "serial: sc16is7xx: Clear RS485 bits in the shutdown" btrfs: fix error pointer dereference in btrfs_ioctl_rm_dev_v2() virtio-blk: modify the value type of num in virtio_queue_rq() btrfs: fix use of uninitialized variable at rm device ioctl tty: n_gsm: fix encoding of command/response bit ARM: meson: Fix refcount leak in meson_smp_prepare_cpus pinctrl: sunxi: a83t: Fix NAND function name for some pins ASoC: rt711: Add endianness flag in snd_soc_component_driver ASoC: rt711-sdca: Add endianness flag in snd_soc_component_driver ASoC: codecs: rt700/rt711/rt711-sdca: resume bus/codec in .set_jack_detect arm64: dts: qcom: msm8994: Fix CPU6/7 reg values arm64: dts: qcom: sdm845: use dispcc AHB clock for mdss node ARM: mxs_defconfig: Enable the framebuffer arm64: dts: imx8mp-evk: correct mmc pad settings arm64: dts: imx8mp-evk: correct the uart2 pinctl value arm64: dts: imx8mp-evk: correct gpio-led pad settings arm64: dts: imx8mp-evk: correct vbus pad settings arm64: dts: imx8mp-evk: correct eqos pad settings arm64: dts: imx8mp-evk: correct I2C1 pad settings arm64: dts: imx8mp-evk: correct I2C3 pad settings arm64: dts: imx8mp-phyboard-pollux-rdk: correct uart pad settings arm64: dts: imx8mp-phyboard-pollux-rdk: correct eqos pad settings arm64: dts: imx8mp-phyboard-pollux-rdk: correct i2c2 & mmc settings pinctrl: sunxi: sunxi_pconf_set: use correct offset arm64: dts: qcom: msm8992-*: Fix vdd_lvs1_2-supply typo ARM: at91: pm: use proper compatible for sama5d2's rtc ARM: at91: pm: use proper compatibles for sam9x60's rtc and rtt ARM: at91: pm: use proper compatibles for sama7g5's rtc and rtt ARM: dts: at91: sam9x60ek: fix eeprom compatible and size ARM: dts: at91: sama5d2_icp: fix eeprom compatibles ARM: at91: fix soc detection for SAM9X60 SiPs xsk: Clear page contiguity bit when unmapping pool i2c: piix4: Fix a memory leak in the EFCH MMIO support i40e: Fix dropped jumbo frames statistics i40e: Fix VF's MAC Address change on VM ARM: dts: stm32: use usbphyc ck_usbo_48m as USBH OHCI clock on stm32mp151 ARM: dts: stm32: add missing usbh clock and fix clk order on stm32mp15 ibmvnic: Properly dispose of all skbs during a failover. selftests: forwarding: fix flood_unicast_test when h2 supports IFF_UNICAST_FLT selftests: forwarding: fix learning_test when h1 supports IFF_UNICAST_FLT selftests: forwarding: fix error message in learning_test r8169: fix accessing unset transport header i2c: cadence: Unregister the clk notifier in error path dmaengine: imx-sdma: Allow imx8m for imx7 FW revs misc: rtsx_usb: fix use of dma mapped buffer for usb bulk transfer misc: rtsx_usb: use separate command and response buffers misc: rtsx_usb: set return value in rsp_buf alloc err path Revert "mm/memory-failure.c: fix race with changing page compound again" Revert "serial: 8250_mtk: Make sure to select the right FEATURE_SEL" dt-bindings: dma: allwinner,sun50i-a64-dma: Fix min/max typo ida: don't use BUG_ON() for debugging dmaengine: pl330: Fix lockdep warning about non-static key dmaengine: lgm: Fix an error handling path in intel_ldma_probe() dmaengine: at_xdma: handle errors of at_xdmac_alloc_desc() correctly dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate dmaengine: qcom: bam_dma: fix runtime PM underflow dmaengine: ti: Add missing put_device in ti_dra7_xbar_route_allocate dmaengine: idxd: force wq context cleanup on device disable path selftests/net: fix section name when using xdp_dummy.o Linux 5.15.54 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I5434cb4ec4ac9e6d1f619f47a5139a11352b98e1	2022-08-10 13:23:20 +02:00
Greg Kroah-Hartman	f3a0b5d245	Merge 5.15.47 into android13-5.15-lts ... Changes in 5.15.47 pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards staging: greybus: codecs: fix type confusion of list iterator variable iio: adc: ad7124: Remove shift from scan_type lkdtm/bugs: Check for the NULL pointer after calling kmalloc lkdtm/bugs: Don't expect thread termination without CONFIG_UBSAN_TRAP tty: goldfish: Use tty_port_destroy() to destroy port tty: serial: owl: Fix missing clk_disable_unprepare() in owl_uart_probe tty: n_tty: Restore EOF push handling behavior serial: 8250_aspeed_vuart: Fix potential NULL dereference in aspeed_vuart_probe tty: serial: fsl_lpuart: fix potential bug when using both of_alias_get_id and ida_simple_get remoteproc: imx_rproc: Ignore create mem entry for resource table usb: usbip: fix a refcount leak in stub_probe() usb: usbip: add missing device lock on tweak configuration cmd USB: storage: karma: fix rio_karma_init return usb: musb: Fix missing of_node_put() in omap2430_probe staging: fieldbus: Fix the error handling path in anybuss_host_common_probe() pwm: lp3943: Fix duty calculation in case period was clamped pwm: raspberrypi-poe: Fix endianness in firmware struct rpmsg: qcom_smd: Fix irq_of_parse_and_map() return value usb: dwc3: gadget: Replace list_for_each_entry_safe() if using giveback usb: dwc3: pci: Fix pm_runtime_get_sync() error checking misc: fastrpc: fix an incorrect NULL check on list iterator firmware: stratix10-svc: fix a missing check on list iterator usb: typec: mux: Check dev_set_name() return value rpmsg: virtio: Fix possible double free in rpmsg_probe() rpmsg: virtio: Fix possible double free in rpmsg_virtio_add_ctrl_dev() rpmsg: virtio: Fix the unregistration of the device rpmsg_ctrl iio: adc: stmpe-adc: Fix wait_for_completion_timeout return value check iio: proximity: vl53l0x: Fix return value check of wait_for_completion_timeout iio: adc: sc27xx: fix read big scale voltage not right iio: adc: sc27xx: Fine tune the scale calibration values rpmsg: qcom_smd: Fix returning 0 if irq_of_parse_and_map() fails pvpanic: Fix typos in the comments misc/pvpanic: Convert regular spinlock into trylock on panic path phy: qcom-qmp: fix pipe-clock imbalance on power-on failure power: supply: axp288_fuel_gauge: Drop BIOS version check from "T3 MRD" DMI quirk serial: sifive: Report actual baud base rather than fixed 115200 export: fix string handling of namespace in EXPORT_SYMBOL_NS soundwire: intel: prevent pm_runtime resume prior to system suspend coresight: cpu-debug: Replace mutex with mutex_trylock on panic notifier ksmbd: fix reference count leak in smb_check_perm_dacl() extcon: ptn5150: Add queue work sync before driver release soc: rockchip: Fix refcount leak in rockchip_grf_init clocksource/drivers/riscv: Events are stopped during CPU suspend ARM: dts: aspeed: ast2600-evb: Enable RX delay for MAC0/MAC1 rtc: mt6397: check return value after calling platform_get_resource() rtc: ftrtc010: Use platform_get_irq() to get the interrupt rtc: ftrtc010: Fix error handling in ftrtc010_rtc_probe staging: r8188eu: add check for kzalloc tty: n_gsm: Don't ignore write return value in gsmld_output() tty: n_gsm: Fix packet data hex dump output serial: meson: acquire port->lock in startup() serial: 8250_fintek: Check SER_RS485_RTS_* only with RS485 serial: cpm_uart: Fix build error without CONFIG_SERIAL_CPM_CONSOLE serial: digicolor-usart: Don't allow CS5-6 serial: rda-uart: Don't allow CS5-6 serial: txx9: Don't allow CS5-6 serial: sh-sci: Don't allow CS5-6 serial: sifive: Sanitize CSIZE and c_iflag serial: st-asc: Sanitize CSIZE and correct PARENB for CS7 serial: stm32-usart: Correct CSIZE, bits, and parity firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle bus: ti-sysc: Fix warnings for unbind for serial driver: base: fix UAF when driver_attach failed driver core: fix deadlock in __device_attach watchdog: rti-wdt: Fix pm_runtime_get_sync() error checking watchdog: ts4800_wdt: Fix refcount leak in ts4800_wdt_probe blk-mq: don't touch ->tagset in blk_mq_get_sq_hctx ASoC: fsl_sai: Fix FSL_SAI_xDR/xFR definition clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map() return value s390/crypto: fix scatterwalk_unmap() callers in AES-GCM net: sched: fixed barrier to prevent skbuff sticking in qdisc backlog net: ethernet: mtk_eth_soc: out of bounds read in mtk_hwlro_get_fdir_entry() net: ethernet: ti: am65-cpsw-nuss: Fix some refcount leaks net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register modpost: fix removing numeric suffixes jffs2: fix memory leak in jffs2_do_fill_super ubi: fastmap: Fix high cpu usage of ubi_bgt by making sure wl_pool not empty ubi: ubi_create_volume: Fix use-after-free when volume creation failed selftests/bpf: fix selftest after random: Urandom_read tracepoint removal selftests/bpf: fix stacktrace_build_id with missing kprobe/urandom_read bpf: Fix probe read error in ___bpf_prog_run() block: take destination bvec offsets into account in bio_copy_data_iter riscv: read-only pages should not be writable net/smc: fixes for converting from "struct smc_cdc_tx_pend **" to "struct smc_wr_tx_pend_priv *" tcp: add accessors to read/set tp->snd_cwnd nfp: only report pause frame configuration for physical device sfc: fix considering that all channels have TX queues sfc: fix wrong tx channel offset with efx_separate_tx_channels block: make bioset_exit() fully resilient against being called twice vdpa: Fix error logic in vdpa_nl_cmd_dev_get_doit virtio: pci: Fix an error handling path in vp_modern_probe() net/mlx5: Don't use already freed action pointer net/mlx5e: TC NIC mode, fix tc chains miss table net/mlx5: CT: Fix header-rewrite re-use for tupels net/mlx5: correct ECE offset in query qp output net/mlx5e: Update netdev features after changing XDP state net: sched: add barrier to fix packet stuck problem for lockless qdisc tcp: tcp_rtx_synack() can be called from process context vdpa: ifcvf: set pci driver data in probe octeontx2-af: fix error code in is_valid_offset() s390/mcck: isolate SIE instruction when setting CIF_MCCK_GUEST flag regulator: mt6315-regulator: fix invalid allowed mode gpio: pca953x: use the correct register address to do regcache sync afs: Fix infinite loop found by xfstest generic/676 scsi: sd: Fix potential NULL pointer dereference tipc: check attribute length for bearer name driver core: Fix wait_for_device_probe() & deferred_probe_timeout interaction perf c2c: Fix sorting in percent_rmt_hitm_cmp() dmaengine: idxd: set DMA_INTERRUPT cap bit mips: cpc: Fix refcount leak in mips_cpc_default_phys_base bootconfig: Make the bootconfig.o as a normal object file tracing: Make tp_printk work on syscall tracepoints tracing: Fix sleeping function called from invalid context on RT kernel tracing: Avoid adding tracer option before update_tracer_options iommu/arm-smmu: fix possible null-ptr-deref in arm_smmu_device_probe() iommu/arm-smmu-v3: check return value after calling platform_get_resource() f2fs: remove WARN_ON in f2fs_is_valid_blkaddr i2c: cadence: Increase timeout per message if necessary m68knommu: set ZERO_PAGE() to the allocated zeroed page m68knommu: fix undefined reference to `_init_sp' dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type NFSv4: Don't hold the layoutget locks across multiple RPC calls video: fbdev: hyperv_fb: Allow resolutions with size > 64 MB for Gen1 video: fbdev: pxa3xx-gcu: release the resources correctly in pxa3xx_gcu_probe/remove() RISC-V: use memcpy for kexec_file mode m68knommu: fix undefined reference to `mach_get_rtc_pll' f2fs: fix to tag gcing flag on page during file defragment xprtrdma: treat all calls not a bcall when bc_serv is NULL drm/bridge: sn65dsi83: Fix an error handling path in sn65dsi83_probe() drm/bridge: ti-sn65dsi83: Handle dsi_lanes == 0 as invalid netfilter: nat: really support inet nat without l3 address netfilter: nf_tables: use kfree_rcu(ptr, rcu) to release hooks in clean_net path netfilter: nf_tables: delete flowtable hooks via transaction list powerpc/kasan: Force thread size increase with KASAN SUNRPC: Trap RDMA segment overflows netfilter: nf_tables: always initialize flowtable hook list in transaction ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe netfilter: nf_tables: release new hooks on unsupported flowtable flags netfilter: nf_tables: memleak flow rule from commit path netfilter: nf_tables: bail out early if hardware offload is not supported xen: unexport __init-annotated xen_xlate_map_ballooned_pages() stmmac: intel: Fix an error handling path in intel_eth_pci_probe() af_unix: Fix a data-race in unix_dgram_peer_wake_me(). bpf, arm64: Clear prog->jited_len along prog->jited net: dsa: lantiq_gswip: Fix refcount leak in gswip_gphy_fw_list net/mlx4_en: Fix wrong return value on ioctl EEPROM query failure i40e: xsk: Move tmp desc array from driver to pool xsk: Fix handling of invalid descriptors in XSK TX batching API SUNRPC: Fix the calculation of xdr->end in xdr_get_next_encode_buffer() net: mdio: unexport __init-annotated mdio_bus_init() net: xfrm: unexport __init-annotated xfrm4_protocol_init() net: ipv6: unexport __init-annotated seg6_hmac_init() net/mlx5: Lag, filter non compatible devices net/mlx5: Fix mlx5_get_next_dev() peer device matching net/mlx5: Rearm the FW tracer after each tracer event net/mlx5: fs, fail conflicting actions ip_gre: test csum_start instead of transport header net: altera: Fix refcount leak in altera_tse_mdio_create net: dsa: mv88e6xxx: use BMSR_ANEGCOMPLETE bit for filling an_complete tcp: use alloc_large_system_hash() to allocate table_perturb drm: imx: fix compiler warning with gcc-12 nfp: flower: restructure flow-key for gre+vlan combination iov_iter: Fix iter_xarray_get_pages{,_alloc}() iio: dummy: iio_simple_dummy: check the return value of kstrdup() staging: rtl8712: fix a potential memory leak in r871xu_drv_init() iio: st_sensors: Add a local lock for protecting odr lkdtm/usercopy: Expand size of "out of frame" object drivers: staging: rtl8723bs: Fix deadlock in rtw_surveydone_event_callback() drivers: staging: rtl8192bs: Fix deadlock in rtw_joinbss_event_prehandle() tty: synclink_gt: Fix null-pointer-dereference in slgt_clean() tty: Fix a possible resource leak in icom_probe thunderbolt: Use different lane for second DisplayPort tunnel drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop() drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop() USB: host: isp116x: check return value after calling platform_get_resource() drivers: tty: serial: Fix deadlock in sa1100_set_termios() drivers: usb: host: Fix deadlock in oxu_bus_suspend() USB: hcd-pci: Fully suspend across freeze/thaw cycle char: xillybus: fix a refcount leak in cleanup_dev() sysrq: do not omit current cpu when showing backtrace of all active CPUs usb: dwc2: gadget: don't reset gadget's driver->bus soundwire: qcom: adjust autoenumeration timeout misc: rtsx: set NULL intfdata when probe fails extcon: Fix extcon_get_extcon_dev() error handling extcon: Modify extcon device to be created after driver data is set clocksource/drivers/sp804: Avoid error on multiple instances staging: rtl8712: fix uninit-value in usb_read8() and friends staging: rtl8712: fix uninit-value in r871xu_drv_init() serial: msm_serial: disable interrupts in __msm_console_write() kernfs: Separate kernfs_pr_cont_buf and rename_lock. watchdog: wdat_wdt: Stop watchdog when rebooting the system md: protect md_unregister_thread from reentrancy scsi: myrb: Fix up null pointer access on myrb_cleanup() Revert "net: af_key: add check for pfkey_broadcast in function pfkey_process" ceph: allow ceph.dir.rctime xattr to be updatable ceph: flush the mdlog for filesystem sync drm/amd/display: Check if modulo is 0 before dividing. drm/radeon: fix a possible null pointer dereference drm/amd/pm: Fix missing thermal throttler status um: line: Use separate IRQs per line modpost: fix undefined behavior of is_arm_mapping_symbol() x86/cpu: Elide KCSAN for cpu_has() and friends jump_label,noinstr: Avoid instrumentation for JUMP_LABEL=n builds nbd: call genl_unregister_family() first in nbd_cleanup() nbd: fix race between nbd_alloc_config() and module removal nbd: fix io hung while disconnecting device s390/gmap: voluntarily schedule during key setting cifs: version operations for smb20 unneeded when legacy support disabled drm/amd/pm: use bitmap_{from,to}_arr32 where appropriate nodemask: Fix return values to be unsigned vringh: Fix loop descriptors check in the indirect cases scripts/gdb: change kernel config dumping method ALSA: usb-audio: Skip generic sync EP parse for secondary EP ALSA: usb-audio: Set up (implicit) sync for Saffire 6 ALSA: hda/conexant - Fix loopback issue with CX20632 ALSA: hda/realtek: Fix for quirk to enable speaker output on the Lenovo Yoga DuetITL 2021 ALSA: hda/realtek: Add quirk for HP Dev One cifs: return errors during session setup during reconnects cifs: fix reconnect on smb3 mount types KEYS: trusted: tpm2: Fix migratable logic ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files mmc: block: Fix CQE recovery reset success net: phy: dp83867: retrigger SGMII AN when link change net: openvswitch: fix misuse of the cached connection on tuple changes writeback: Fix inode->i_io_list not be protected by inode->i_lock error nfc: st21nfca: fix incorrect validating logic in EVT_TRANSACTION nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling nfc: st21nfca: fix incorrect sizing calculations in EVT_TRANSACTION ixgbe: fix bcast packets Rx on VF after promisc removal ixgbe: fix unexpected VLAN Rx in promisc mode on VF Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag vduse: Fix NULL pointer dereference on sysfs access powerpc: Don't select HAVE_IRQ_EXIT_ON_IRQ_STACK drm/bridge: analogix_dp: Support PSR-exit to disable transition drm/atomic: Force bridge self-refresh-exit on CRTC switch drm/amdgpu: update VCN codec support for Yellow Carp powerpc/32: Fix overread/overwrite of thread_struct via ptrace powerpc/mm: Switch obsolete dssall to .long drm/ast: Create threshold values for AST2600 random: avoid checking crng_ready() twice in random_init() random: mark bootloader randomness code as __init random: account for arch randomness in bits md/raid0: Ignore RAID0 layout if the second zone has only one device net/sched: act_police: more accurate MTU policing PCI: qcom: Fix pipe clock imbalance zonefs: fix handling of explicit_open option on mount iov_iter: fix build issue due to possible type mis-match dmaengine: idxd: add missing callback function to support DMA_INTERRUPT tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd xsk: Fix possible crash when multiple sockets are created Linux 5.15.47 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I4f53567cd8a0a13927a16f41a2be8bc0db21ce5b	2022-08-08 12:12:20 +02:00
Greg Kroah-Hartman	89405fc691	Merge 5.15.45 into android13-5.15-lts ... Changes in 5.15.45 ALSA: usb-audio: Don't get sample rate for MCT Trigger 5 USB-to-HDMI pinctrl: sunxi: fix f1c100s uart2 function KVM: arm64: Don't hypercall before EL2 init percpu_ref_init(): clean ->percpu_count_ref on failure net: af_key: check encryption module availability consistency nfc: pn533: Fix buggy cleanup order net: ftgmac100: Disable hardware checksum on AST2600 i2c: ismt: Provide a DMA buffer for Interrupt Cause Logging drivers: i2c: thunderx: Allow driver to work with ACPI defined TWSI controllers netfilter: nf_tables: disallow non-stateful expression in sets earlier i2c: ismt: prevent memory corruption in ismt_access() assoc_array: Fix BUG_ON during garbage collect pipe: make poll_usage boolean and annotate its access pipe: Fix missing lock in pipe_resize_ring() net: ipa: compute proper aggregation limit drm/i915: Fix -Wstringop-overflow warning in call to intel_read_wm_latency() exfat: check if cluster num is valid lib/crypto: add prompts back to crypto libraries crypto: drbg - prepare for more fine-grained tracking of seeding state crypto: drbg - track whether DRBG was seeded with !rng_is_initialized() crypto: drbg - move dynamic ->reseed_threshold adjustments to __drbg_seed() crypto: drbg - make reseeding from get_random_bytes() synchronous netfilter: nf_tables: sanitize nft_set_desc_concat_parse() netfilter: nf_tables: hold mutex on netns pre_exit path netfilter: nf_tables: double hook unregistration in netns path netfilter: conntrack: re-fetch conntrack after insertion KVM: PPC: Book3S HV: fix incorrect NULL check on list iterator x86/kvm: Alloc dummy async #PF token outside of raw spinlock x86, kvm: use correct GFP flags for preemption disabled KVM: x86: avoid calling x86 emulator without a decoded instruction KVM: x86: Drop WARNs that assert a triple fault never "escapes" from L2 KVM: SVM: Use kzalloc for sev ioctl interfaces to prevent kernel data leak crypto: caam - fix i.MX6SX entropy delay value crypto: ecrdsa - Fix incorrect use of vli_cmp zsmalloc: fix races between asynchronous zspage free and page migration ALSA: usb-audio: Workaround for clock setup on TEAC devices ALSA: usb-audio: Add missing ep_idx in fixed EP quirks ALSA: usb-audio: Configure sync endpoints before data Bluetooth: hci_qca: Use del_timer_sync() before freeing ARM: dts: s5pv210: Correct interrupt name for bluetooth in Aries dm integrity: fix error code in dm_integrity_ctr() dm crypt: make printing of the key constant-time dm stats: add cond_resched when looping over entries dm verity: set DM_TARGET_IMMUTABLE feature flag raid5: introduce MD_BROKEN fs/ntfs3: validate BOOT sectors_per_clusters HID: multitouch: Add support for Google Whiskers Touchpad HID: multitouch: add quirks to enable Lenovo X12 trackpoint x86/sgx: Disconnect backing page references from dirty status x86/sgx: Mark PCMD page as dirty when modifying contents x86/sgx: Obtain backing storage page with enclave mutex held x86/sgx: Fix race between reclaimer and page fault handler x86/sgx: Ensure no data in PCMD page after truncate media: i2c: imx412: Fix reset GPIO polarity media: i2c: imx412: Fix power_off ordering tpm: Fix buffer access in tpm2_get_tpm_pt() tpm: ibmvtpm: Correct the return value in tpm_ibmvtpm_probe() docs: submitting-patches: Fix crossref to 'The canonical patch format' NFS: Memory allocation failures are not server fatal errors NFSD: Fix possible sleep during nfsd4_release_lockowner() bpf: Fix potential array overflow in bpf_trampoline_get_progs() bpf: Enlarge offset check value to INT_MAX in bpf_skb_{load,store}_bytes bpf: Fix excessive memory allocation in stack_map_alloc() bpf: Reject writes for PTR_TO_MAP_KEY in check_helper_mem_access bpf: Check PTR_TO_MEM | MEM_RDONLY in check_helper_mem_access ALSA: usb-audio: Optimize TEAC clock quirk Linux 5.15.45 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I80c8d092a237b8314e834ff13a9ef86c9a86fa23	2022-08-04 11:09:29 +02:00
Pablo Neira Ayuso	5a4bb158f4	netfilter: nf_tables: replace BUG_ON by element length check ... [ Upstream commit c39ba4de6b0a843bec5d46c2b6f2064428dada5e ] BUG_ON can be triggered from userspace with an element with a large userdata area. Replace it by length check and return EINVAL instead. Over time extensions have been growing in size. Pick a sufficiently old Fixes: tag to propagate this fix. Fixes: 7d7402642e ("netfilter: nf_tables: variable sized set element keys / data") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-07-21 21:24:23 +02:00
Pablo Neira Ayuso	5445819e76	netfilter: nft_payload: support for inner header matching / mangling ... [ Upstream commit c46b38dc8743535e686b911d253a844f0bd50ead ] Allow to match and mangle on inner headers / payload data after the transport header. There is a new field in the pktinfo structure that stores the inner header offset which is calculated only when requested. Only TCP and UDP supported at this stage. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-07-12 16:34:55 +02:00
Pablo Neira Ayuso	0d9bd7e6ac	netfilter: nf_tables: convert pktinfo->tprot_set to flags field ... [ Upstream commit b5bdc6f9c24db9a0adf8bd00c0e935b184654f00 ] Generalize boolean field to store more flags on the pktinfo structure. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-07-12 16:34:55 +02:00
Greg Kroah-Hartman	4e079c929f	ANDROID: GKI: add Android ABI padding to struct nf_conn ... Try to mitigate potential future driver core api changes by adding padding to struct nf_conn; Bug: 151154716 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ib18a9a929d351c66556f1f27b217cbf22b733a10	2022-06-18 18:44:13 +00:00
Vignesh Saravanaperumal	889670d815	ANDROID: GKI: add vendor padding variable in struct nf_conn ... Some vendors want to add things to 'struct nf_conn', so give them a u64 where they can then have a pointer off to their private data and they can do whatever they want to do without breaking or changing any abi for anyone else. Note, usually an android trace hook is also needed to use this properly, so be aware that this will be required as well. Bug: 171013716 Signed-off-by: Vignesh Saravanaperumal <vignesh1.s@samsung.com> Change-Id: I245c162ee3fb083e3f39cf7bec3bd78cb624e005	2022-06-18 18:28:48 +00:00
Pablo Neira Ayuso	23cb1fef93	netfilter: nf_tables: bail out early if hardware offload is not supported ... [ Upstream commit 3a41c64d9c1185a2f3a184015e2a9b78bfc99c71 ] If user requests for NFT_CHAIN_HW_OFFLOAD, then check if either device provides the .ndo_setup_tc interface or there is an indirect flow block that has been registered. Otherwise, bail out early from the preparation phase. Moreover, validate that family == NFPROTO_NETDEV and hook is NF_NETDEV_INGRESS. Fixes: c9626a2cbd ("netfilter: nf_tables: add hardware offload support") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-06-14 18:36:17 +02:00
Pablo Neira Ayuso	f275989ad0	netfilter: nf_tables: delete flowtable hooks via transaction list ... [ Upstream commit b6d9014a3335194590abdd2a2471ef5147a67645 ] Remove inactive bool field in nft_hook object that was introduced in abadb2f865 ("netfilter: nf_tables: delete devices from flowtable"). Move stale flowtable hooks to transaction list instead. Deleting twice the same device does not result in ENOENT. Fixes: abadb2f865 ("netfilter: nf_tables: delete devices from flowtable") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-06-14 18:36:16 +02:00
Florian Westphal	01989d7eeb	netfilter: conntrack: re-fetch conntrack after insertion ... commit 56b14ecec97f39118bf85c9ac2438c5a949509ed upstream. In case the conntrack is clashing, insertion can free skb->_nfct and set skb->_nfct to the already-confirmed entry. This wasn't found before because the conntrack entry and the extension space used to free'd after an rcu grace period, plus the race needs events enabled to trigger. Reported-by: <syzbot+793a590957d9c1b96620@syzkaller.appspotmail.com> Fixes: 71d8c47fc6 ("netfilter: conntrack: introduce clash resolution on insertion race") Fixes: 2ad9d7747c ("netfilter: conntrack: free extension area immediately") Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-06-06 08:43:38 +02:00
Greg Kroah-Hartman	4b85648b91	Revert "Revert "netfilter: conntrack: avoid useless indirection during conntrack destruction"" ... This reverts commit 8b226103c9. It was originally reverted as it broke the abi but can now be safely brought back. Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: If91a2ea72060e1cadc14cdb18e5e8a6bfe54a594	2022-06-01 09:32:33 -07:00
Greg Kroah-Hartman	8b226103c9	Revert "netfilter: conntrack: avoid useless indirection during conntrack destruction" ... This reverts commit 67e4860eee. It breaks the abi and is not really needed for Android systems, so revert it for now. Bug: 161946584 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ia8363274cf64b68fdbf0653a4e520a5a5a35117f	2022-05-18 08:57:12 +02:00
Florian Westphal	67e4860eee	netfilter: conntrack: avoid useless indirection during conntrack destruction ... commit 6ae7989c9af0d98ab64196f4f4c6f6499454bd23 upstream. nf_ct_put() results in a usesless indirection: nf_ct_put -> nf_conntrack_put -> nf_conntrack_destroy -> rcu readlock + indirect call of ct_hooks->destroy(). There are two _put helpers: nf_ct_put and nf_conntrack_put. The latter is what should be used in code that MUST NOT cause a linker dependency on the conntrack module (e.g. calls from core network stack). Everyone else should call nf_ct_put() instead. A followup patch will convert a few nf_conntrack_put() calls to nf_ct_put(), in particular from modules that already have a conntrack dependency such as act_ct or even nf_conntrack itself. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-04-27 14:39:01 +02:00
Phil Sutter	0ee072f913	netfilter: conntrack: Add and use nf_ct_set_auto_assign_helper_warned() ... [ Upstream commit 31d0bb9763efad30377505f3467f958d1ebe1e3d ] The function sets the pernet boolean to avoid the spurious warning from nf_ct_lookup_helper() when assigning conntrack helpers via nftables. Fixes: 1a64edf54f ("netfilter: nft_ct: add helper set support") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-04-08 14:23:42 +02:00
Pablo Neira Ayuso	2a85c4cb3b	netfilter: flowtable: Fix QinQ and pppoe support for inet table ... [ Upstream commit 0492d857636e1c52cd71594a723c4b26a7b31978 ] nf_flow_offload_inet_hook() does not check for 802.1q and PPPoE. Fetch inner ethertype from these encapsulation protocols. Fixes: 72efd585f7 ("netfilter: flowtable: add pppoe support") Fixes: 4cd91f7c29 ("netfilter: flowtable: add vlan support") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-04-08 14:23:40 +02:00
Florian Westphal	dd648bd1b3	netfilter: nf_queue: fix possible use-after-free ... commit c3873070247d9e3c7a6b0cf9bf9b45e8018427b1 upstream. Eric Dumazet says: The sock_hold() side seems suspect, because there is no guarantee that sk_refcnt is not already 0. On failure, we cannot queue the packet and need to indicate an error. The packet will be dropped by the caller. v2: split skb prefetch hunk into separate change Fixes: 271b72c7fa ("udp: RCU handling for Unicast packets.") Reported-by: Eric Dumazet <eric.dumazet@gmail.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-03-08 19:12:45 +01:00
Pablo Neira Ayuso	6c5d780469	netfilter: nf_tables_offload: incorrect flow offload action array size ... commit b1a5983f56e371046dcf164f90bfaf704d2b89f6 upstream. immediate verdict expression needs to allocate one slot in the flow offload action array, however, immediate data expression does not need to do so. fwd and dup expression need to allocate one slot, this is missing. Add a new offload_action interface to report if this expression needs to allocate one slot in the flow offload action array. Fixes: be2861dc36 ("netfilter: nft_{fwd,dup}_netdev: add offload support") Reported-and-tested-by: Nick Gregory <Nick.Gregory@Sophos.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2022-03-02 11:47:51 +01:00
Eric Dumazet	be2b5a78a0	netfilter: conntrack: annotate data-races around ct->timeout ... commit 802a7dc5cf1bef06f7b290ce76d478138408d6b1 upstream. (struct nf_conn)->timeout can be read/written locklessly, add READ_ONCE()/WRITE_ONCE() to prevent load/store tearing. BUG: KCSAN: data-race in __nf_conntrack_alloc / __nf_conntrack_find_get write to 0xffff888132e78c08 of 4 bytes by task 6029 on cpu 0: __nf_conntrack_alloc+0x158/0x280 net/netfilter/nf_conntrack_core.c:1563 init_conntrack+0x1da/0xb30 net/netfilter/nf_conntrack_core.c:1635 resolve_normal_ct+0x502/0x610 net/netfilter/nf_conntrack_core.c:1746 nf_conntrack_in+0x1c5/0x88f net/netfilter/nf_conntrack_core.c:1901 ipv6_conntrack_local+0x19/0x20 net/netfilter/nf_conntrack_proto.c:414 nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline] nf_hook_slow+0x72/0x170 net/netfilter/core.c:619 nf_hook include/linux/netfilter.h:262 [inline] NF_HOOK include/linux/netfilter.h:305 [inline] ip6_xmit+0xa3a/0xa60 net/ipv6/ip6_output.c:324 inet6_csk_xmit+0x1a2/0x1e0 net/ipv6/inet6_connection_sock.c:135 __tcp_transmit_skb+0x132a/0x1840 net/ipv4/tcp_output.c:1402 tcp_transmit_skb net/ipv4/tcp_output.c:1420 [inline] tcp_write_xmit+0x1450/0x4460 net/ipv4/tcp_output.c:2680 __tcp_push_pending_frames+0x68/0x1c0 net/ipv4/tcp_output.c:2864 tcp_push_pending_frames include/net/tcp.h:1897 [inline] tcp_data_snd_check+0x62/0x2e0 net/ipv4/tcp_input.c:5452 tcp_rcv_established+0x880/0x10e0 net/ipv4/tcp_input.c:5947 tcp_v6_do_rcv+0x36e/0xa50 net/ipv6/tcp_ipv6.c:1521 sk_backlog_rcv include/net/sock.h:1030 [inline] __release_sock+0xf2/0x270 net/core/sock.c:2768 release_sock+0x40/0x110 net/core/sock.c:3300 sk_stream_wait_memory+0x435/0x700 net/core/stream.c:145 tcp_sendmsg_locked+0xb85/0x25a0 net/ipv4/tcp.c:1402 tcp_sendmsg+0x2c/0x40 net/ipv4/tcp.c:1440 inet6_sendmsg+0x5f/0x80 net/ipv6/af_inet6.c:644 sock_sendmsg_nosec net/socket.c:704 [inline] sock_sendmsg net/socket.c:724 [inline] __sys_sendto+0x21e/0x2c0 net/socket.c:2036 __do_sys_sendto net/socket.c:2048 [inline] __se_sys_sendto net/socket.c:2044 [inline] __x64_sys_sendto+0x74/0x90 net/socket.c:2044 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae read to 0xffff888132e78c08 of 4 bytes by task 17446 on cpu 1: nf_ct_is_expired include/net/netfilter/nf_conntrack.h:286 [inline] ____nf_conntrack_find net/netfilter/nf_conntrack_core.c:776 [inline] __nf_conntrack_find_get+0x1c7/0xac0 net/netfilter/nf_conntrack_core.c:807 resolve_normal_ct+0x273/0x610 net/netfilter/nf_conntrack_core.c:1734 nf_conntrack_in+0x1c5/0x88f net/netfilter/nf_conntrack_core.c:1901 ipv6_conntrack_local+0x19/0x20 net/netfilter/nf_conntrack_proto.c:414 nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline] nf_hook_slow+0x72/0x170 net/netfilter/core.c:619 nf_hook include/linux/netfilter.h:262 [inline] NF_HOOK include/linux/netfilter.h:305 [inline] ip6_xmit+0xa3a/0xa60 net/ipv6/ip6_output.c:324 inet6_csk_xmit+0x1a2/0x1e0 net/ipv6/inet6_connection_sock.c:135 __tcp_transmit_skb+0x132a/0x1840 net/ipv4/tcp_output.c:1402 __tcp_send_ack+0x1fd/0x300 net/ipv4/tcp_output.c:3956 tcp_send_ack+0x23/0x30 net/ipv4/tcp_output.c:3962 __tcp_ack_snd_check+0x2d8/0x510 net/ipv4/tcp_input.c:5478 tcp_ack_snd_check net/ipv4/tcp_input.c:5523 [inline] tcp_rcv_established+0x8c2/0x10e0 net/ipv4/tcp_input.c:5948 tcp_v6_do_rcv+0x36e/0xa50 net/ipv6/tcp_ipv6.c:1521 sk_backlog_rcv include/net/sock.h:1030 [inline] __release_sock+0xf2/0x270 net/core/sock.c:2768 release_sock+0x40/0x110 net/core/sock.c:3300 tcp_sendpage+0x94/0xb0 net/ipv4/tcp.c:1114 inet_sendpage+0x7f/0xc0 net/ipv4/af_inet.c:833 rds_tcp_xmit+0x376/0x5f0 net/rds/tcp_send.c:118 rds_send_xmit+0xbed/0x1500 net/rds/send.c:367 rds_send_worker+0x43/0x200 net/rds/threads.c:200 process_one_work+0x3fc/0x980 kernel/workqueue.c:2298 worker_thread+0x616/0xa70 kernel/workqueue.c:2445 kthread+0x2c7/0x2e0 kernel/kthread.c:327 ret_from_fork+0x1f/0x30 value changed: 0x00027cc2 -> 0x00000000 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 17446 Comm: kworker/u4:5 Tainted: G W 5.16.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: krdsd rds_send_worker Note: I chose an arbitrary commit for the Fixes: tag, because I do not think we need to backport this fix to very old kernels. Fixes: e37542ba11 ("netfilter: conntrack: avoid possible false sharing") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-12-14 10:57:10 +01:00
Pablo Neira Ayuso	6fb721cf78	netfilter: nf_tables: honor NLM_F_CREATE and NLM_F_EXCL in event notification ... Include the NLM_F_CREATE and NLM_F_EXCL flags in netlink event notifications, otherwise userspace cannot distiguish between create and add commands. Fixes: 96518518cc ("netfilter: add nftables") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>	2021-10-02 12:00:17 +02:00
Florian Westphal	339031bafe	netfilter: conntrack: fix boot failure with nf_conntrack.enable_hooks=1 ... This is a revert of 7b1957b049 ("netfilter: nf_defrag_ipv4: use net_generic infra") and a partial revert of 8b0adbe3e3 ("netfilter: nf_defrag_ipv6: use net_generic infra"). If conntrack is builtin and kernel is booted with: nf_conntrack.enable_hooks=1 .... kernel will fail to boot due to a NULL deref in nf_defrag_ipv4_enable(): Its called before the ipv4 defrag initcall is made, so net_generic() returns NULL. To resolve this, move the user refcount back to struct net so calls to those functions are possible even before their initcalls have run. Fixes: 7b1957b049 ("netfilter: nf_defrag_ipv4: use net_generic infra") Fixes: 8b0adbe3e3 ("netfilter: nf_defrag_ipv6: use net_generic infra"). Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>	2021-09-28 13:04:55 +02:00
Ryoga Saito	7a3f5b0de3	netfilter: add netfilter hooks to SRv6 data plane ... This patch introduces netfilter hooks for solving the problem that conntrack couldn't record both inner flows and outer flows. This patch also introduces a new sysctl toggle for enabling lightweight tunnel netfilter hooks. Signed-off-by: Ryoga Saito <contact@proelbtn.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>	2021-08-30 01:51:36 +02:00
Florian Westphal	bd1431db0b	netfilter: ecache: remove nf_exp_event_notifier structure ... Reuse the conntrack event notofier struct, this allows to remove the extra register/unregister functions and avoids a pointer in struct net. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>	2021-08-25 12:50:38 +02:00
Florian Westphal	b86c0e6429	netfilter: ecache: prepare for event notifier merge ... This prepares for merge for ct and exp notifier structs. The 'fcn' member is renamed to something unique. Second, the register/unregister api is simplified. There is only one implementation so there is no need to do any error checking. Replace the EBUSY logic with WARN_ON_ONCE. This allows to remove error unwinding. The exp notifier register/unregister function is removed in a followup patch. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>	2021-08-25 12:50:38 +02:00
Florian Westphal	478374a3c1	netfilter: ecache: remove one indent level ... nf_conntrack_eventmask_report and nf_ct_deliver_cached_events shared most of their code. This unifies the layout by changing if (nf_ct_is_confirmed(ct)) { foo } to if (!nf_ct_is_confirmed(ct))) return foo This removes one level of indentation. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>	2021-08-25 12:50:38 +02:00
Florian Westphal	8702997074	netfilter: nf_queue: move hookfn registration out of struct net ... This was done to detect when the pernet->init() function was not called yet, by checking if net->nf.queue_handler is NULL. Once the nfnetlink_queue module is active, all struct net pointers contain the same address. So place this back in nf_queue.c. Handle the 'netns error unwind' test by checking nfnl_queue_net for a NULL pointer and add a comment for this. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>	2021-08-10 17:32:00 +02:00
Vasily Averin	a23f89a999	netfilter: conntrack: nf_ct_gre_keymap_flush() removal ... nf_ct_gre_keymap_flush() is useless. It is called from nf_conntrack_cleanup_net_list() only and tries to remove nf_ct_gre_keymap entries from pernet gre keymap list. Though: a) at this point the list should already be empty, all its entries were deleted during the conntracks cleanup, because nf_conntrack_cleanup_net_list() executes nf_ct_iterate_cleanup(kill_all) before nf_conntrack_proto_pernet_fini(): nf_conntrack_cleanup_net_list +- nf_ct_iterate_cleanup | nf_ct_put | nf_conntrack_put | nf_conntrack_destroy | destroy_conntrack | destroy_gre_conntrack | nf_ct_gre_keymap_destroy `- nf_conntrack_proto_pernet_fini nf_ct_gre_keymap_flush b) Let's say we find that the keymap list is not empty. This means netns still has a conntrack associated with gre, in which case we should not free its memory, because this will lead to a double free and related crashes. However I doubt it could have gone unnoticed for years, obviously this does not happen in real life. So I think we can remove both nf_ct_gre_keymap_flush() and nf_conntrack_proto_pernet_fini(). Signed-off-by: Vasily Averin <vvs@virtuozzo.com> Acked-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>	2021-07-02 02:07:01 +02:00
Florian Westphal	62eec0d733	netfilter: conntrack: pass hook state to log functions ... The packet logger backend is unable to provide the incoming (or outgoing) interface name because that information isn't available. Pass the hook state, it contains the network namespace, the protocol family, the network interfaces and other things. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>	2021-06-18 14:47:43 +02:00
Pablo Neira Ayuso	836382dc24	netfilter: nf_tables: add last expression ... Add a new optional expression that tells you when last matching on a given rule / set element element has happened. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>	2021-06-17 03:23:00 +02:00
David S. Miller	7f3579e189	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next ... Pablo Neira Ayuso says: ==================== Netfilter updates for net-next The following patchset contains Netfilter updates for net-next: 1) Add nfgenmsg field to nfnetlink's struct nfnl_info and use it. 2) Remove nft_ctx_init_from_elemattr() and nft_ctx_init_from_setattr() helper functions. 3) Add the nf_ct_pernet() helper function to fetch the conntrack pernetns data area. 4) Expose TCP and UDP flowtable offload timeouts through sysctl, from Oz Shlomo. 5) Add nfnetlink_hook subsystem to fetch the netfilter hook pipeline configuration, from Florian Westphal. This also includes a new field to annotate the hook type as metadata. 6) Fix unsafe memory access to non-linear skbuff in the new SCTP chunk support for nft_exthdr, from Phil Sutter. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>	2021-06-09 14:50:35 -07:00
David S. Miller	126285651b	Merge ra.kernel.org:/pub/scm/linux/kernel/git/netdev/net ... Bug fixes overlapping feature additions and refactoring, mostly. Signed-off-by: David S. Miller <davem@davemloft.net>	2021-06-07 13:01:52 -07:00
Oz Shlomo	1d91d2e1a7	netfilter: flowtable: Set offload timeouts according to proto values ... Currently the aging period for tcp/udp connections is hard coded to 30 seconds. Aged tcp/udp connections configure a hard coded 120/30 seconds pickup timeout for conntrack. This configuration may be too aggressive or permissive for some users. Dynamically configure the nf flow table GC timeout intervals according to the user defined values. Signed-off-by: Oz Shlomo <ozsh@nvidia.com> Reviewed-by: Paul Blakey <paulb@nvidia.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>	2021-06-07 12:23:38 +02:00
Pablo Neira Ayuso	0418b989a4	netfilter: nftables: add nf_ct_pernet() helper function ... Consolidate call to net_generic(net, nf_conntrack_net_id) in this wrapper function. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>	2021-06-07 12:23:37 +02:00
Florian Westphal	897389de48	netfilter: nf_tables: remove xt_action_param from nft_pktinfo ... Init it on demand in the nft_compat expression. This reduces size of nft_pktinfo from 48 to 24 bytes on x86_64. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>	2021-05-29 22:15:59 +02:00
Florian Westphal	f06ad944b6	netfilter: nf_tables: remove unused arg in nft_set_pktinfo_unspec() ... The functions pass extra skb arg, but either its not used or the helpers can already access it via pkt->skb. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>	2021-05-29 01:04:54 +02:00
Florian Westphal	2d7b4ace07	netfilter: nf_tables: add and use nft_thoff helper ... This allows to change storage placement later on without changing readers. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>	2021-05-29 01:04:54 +02:00
Florian Westphal	85554eb981	netfilter: nf_tables: add and use nft_sk helper ... This allows to change storage placement later on without changing readers. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>	2021-05-29 01:04:53 +02:00
Florian Westphal	f227925e53	netfilter: nf_tables: prefer direct calls for set lookups ... Extend nft_set_do_lookup() to use direct calls when retpoline feature is enabled. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>	2021-05-29 01:04:27 +02:00