malhuda/msm-4.14
1
0
Fork 0
mirror of https://github.com/rd-stuffs/msm-4.14.git synced 2025-02-20 11:45:48 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity
805,622 Commits 5 Branches 0 Tags
Commit Graph

1716 Commits

Author SHA1 Message Date
Alexander Winkowski
63d74b187f
Merge branch 'deprecated/android-4.14-stable' of https://android.googlesource.com/kernel/common into lineage-21 
Conflicts:
	Documentation/arm64/silicon-errata.txt
	arch/arm/Makefile
	arch/arm/configs/ranchu_defconfig
	arch/arm64/Kconfig
	arch/arm64/configs/ranchu64_defconfig
	arch/arm64/include/asm/cpucaps.h
	arch/arm64/include/asm/cputype.h
	arch/arm64/kernel/cpu_errata.c
	arch/arm64/kernel/setup.c
	arch/arm64/kvm/hyp/switch.c
	arch/arm64/mm/mmu.c
	arch/arm64/mm/proc.S
	arch/x86/Makefile
	arch/x86/configs/i386_ranchu_defconfig
	arch/x86/configs/x86_64_ranchu_defconfig
	drivers/char/Kconfig
	drivers/clk/clk.c
	drivers/clk/qcom/clk-rcg2.c
	drivers/devfreq/devfreq.c
	drivers/gpu/drm/msm/msm_drv.c
	drivers/mailbox/mailbox.c
	drivers/md/dm-verity-target.c
	drivers/media/dvb-core/dmxdev.c
	drivers/mmc/core/block.c
	drivers/mmc/core/core.c
	drivers/mmc/core/host.c
	drivers/mmc/core/mmc.c
	drivers/mmc/core/mmc_ops.c
	drivers/mmc/core/queue.c
	drivers/mmc/host/sdhci-msm.c
	drivers/mmc/host/sdhci.c
	drivers/mtd/ubi/wl.c
	drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
	drivers/rpmsg/qcom_glink_native.c
	drivers/scsi/ufs/ufs-qcom.c
	drivers/scsi/ufs/ufshcd.c
	drivers/soc/qcom/smp2p.c
	drivers/staging/android/ion/ion.c
	drivers/thermal/thermal_core.c
	drivers/tty/tty_jobctrl.c
	drivers/usb/core/hub.c
	drivers/usb/core/quirks.c
	drivers/usb/dwc3/core.c
	drivers/usb/dwc3/gadget.c
	drivers/usb/gadget/composite.c
	drivers/usb/gadget/function/f_accessory.c
	drivers/usb/gadget/function/f_fs.c
	drivers/usb/gadget/function/f_uac1.c
	drivers/usb/gadget/function/f_uac2.c
	drivers/usb/gadget/legacy/dbgp.c
	drivers/usb/gadget/legacy/inode.c
	drivers/usb/host/xhci.c
	drivers/usb/host/xhci.h
	fs/fat/fatent.c
	fs/incfs/main.c
	include/linux/usb/usbnet.h
	include/net/pkt_sched.h
	include/net/sock.h
	include/uapi/linux/virtio_ids.h
	kernel/cpu.c
	kernel/panic.c
	kernel/sched/cpufreq_schedutil.c
	kernel/sched/fair.c
	lib/ubsan.h
	net/core/skbuff.c
	net/ipv4/inet_connection_sock.c
	net/qrtr/qrtr.c
	net/sctp/input.c
	scripts/checkpatch.pl
	security/selinux/avc.c

Change-Id: I3df6e75af6716bc6df4831d41ffd60680832ef66
Signed-off-by: Alexander Winkowski <dereference23@outlook.com>
 2024-04-13 08:31:14 +00:00
Vladimir Oltean
9c6d380d2d net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode 
[ Upstream commit 6ca3c005d0604e8d2b439366e3923ea58db99641 ]

According to the synchronization rules for .ndo_get_stats() as seen in
Documentation/networking/netdevices.rst, acquiring a plain spin_lock()
should not be illegal, but the bridge driver implementation makes it so.

After running these commands, I am being faced with the following
lockdep splat:

$ ip link add link swp0 name macsec0 type macsec encrypt on && ip link set swp0 up
$ ip link add dev br0 type bridge vlan_filtering 1 && ip link set br0 up
$ ip link set macsec0 master br0 && ip link set macsec0 up

  ========================================================
  WARNING: possible irq lock inversion dependency detected
  6.4.0-04295-g31b577b4bd4a #603 Not tainted
  --------------------------------------------------------
  swapper/1/0 just changed the state of lock:
  ffff6bd348724cd8 (&br->lock){+.-.}-{3:3}, at: br_forward_delay_timer_expired+0x34/0x198
  but this lock took another, SOFTIRQ-unsafe lock in the past:
   (&ocelot->stats_lock){+.+.}-{3:3}

  and interrupts could create inverse lock ordering between them.

  other info that might help us debug this:
  Chain exists of:
    &br->lock --> &br->hash_lock --> &ocelot->stats_lock

   Possible interrupt unsafe locking scenario:

         CPU0                    CPU1
         ----                    ----
    lock(&ocelot->stats_lock);
                                 local_irq_disable();
                                 lock(&br->lock);
                                 lock(&br->hash_lock);
    <Interrupt>
      lock(&br->lock);

   *** DEADLOCK ***

(details about the 3 locks skipped)

swp0 is instantiated by drivers/net/dsa/ocelot/felix.c, and this
only matters to the extent that its .ndo_get_stats64() method calls
spin_lock(&ocelot->stats_lock).

Documentation/locking/lockdep-design.rst says:

| A lock is irq-safe means it was ever used in an irq context, while a lock
| is irq-unsafe means it was ever acquired with irq enabled.

(...)

| Furthermore, the following usage based lock dependencies are not allowed
| between any two lock-classes::
|
|    <hardirq-safe>   ->  <hardirq-unsafe>
|    <softirq-safe>   ->  <softirq-unsafe>

Lockdep marks br->hash_lock as softirq-safe, because it is sometimes
taken in softirq context (for example br_fdb_update() which runs in
NET_RX softirq), and when it's not in softirq context it blocks softirqs
by using spin_lock_bh().

Lockdep marks ocelot->stats_lock as softirq-unsafe, because it never
blocks softirqs from running, and it is never taken from softirq
context. So it can always be interrupted by softirqs.

There is a call path through which a function that holds br->hash_lock:
fdb_add_hw_addr() will call a function that acquires ocelot->stats_lock:
ocelot_port_get_stats64(). This can be seen below:

ocelot_port_get_stats64+0x3c/0x1e0
felix_get_stats64+0x20/0x38
dsa_slave_get_stats64+0x3c/0x60
dev_get_stats+0x74/0x2c8
rtnl_fill_stats+0x4c/0x150
rtnl_fill_ifinfo+0x5cc/0x7b8
rtmsg_ifinfo_build_skb+0xe4/0x150
rtmsg_ifinfo+0x5c/0xb0
__dev_notify_flags+0x58/0x200
__dev_set_promiscuity+0xa0/0x1f8
dev_set_promiscuity+0x30/0x70
macsec_dev_change_rx_flags+0x68/0x88
__dev_set_promiscuity+0x1a8/0x1f8
__dev_set_rx_mode+0x74/0xa8
dev_uc_add+0x74/0xa0
fdb_add_hw_addr+0x68/0xd8
fdb_add_local+0xc4/0x110
br_fdb_add_local+0x54/0x88
br_add_if+0x338/0x4a0
br_add_slave+0x20/0x38
do_setlink+0x3a4/0xcb8
rtnl_newlink+0x758/0x9d0
rtnetlink_rcv_msg+0x2f0/0x550
netlink_rcv_skb+0x128/0x148
rtnetlink_rcv+0x24/0x38

the plain English explanation for it is:

The macsec0 bridge port is created without p->flags & BR_PROMISC,
because it is what br_manage_promisc() decides for a VLAN filtering
bridge with a single auto port.

As part of the br_add_if() procedure, br_fdb_add_local() is called for
the MAC address of the device, and this results in a call to
dev_uc_add() for macsec0 while the softirq-safe br->hash_lock is taken.

Because macsec0 does not have IFF_UNICAST_FLT, dev_uc_add() ends up
calling __dev_set_promiscuity() for macsec0, which is propagated by its
implementation, macsec_dev_change_rx_flags(), to the lower device: swp0.
This triggers the call path:

dev_set_promiscuity(swp0)
-> rtmsg_ifinfo()
   -> dev_get_stats()
      -> ocelot_port_get_stats64()

with a calling context that lockdep doesn't like (br->hash_lock held).

Normally we don't see this, because even though many drivers that can be
bridge ports don't support IFF_UNICAST_FLT, we need a driver that

(a) doesn't support IFF_UNICAST_FLT, *and*
(b) it forwards the IFF_PROMISC flag to another driver, and
(c) *that* driver implements ndo_get_stats64() using a softirq-unsafe
    spinlock.

Condition (b) is necessary because the first __dev_set_rx_mode() calls
__dev_set_promiscuity() with "bool notify=false", and thus, the
rtmsg_ifinfo() code path won't be entered.

The same criteria also hold true for DSA switches which don't report
IFF_UNICAST_FLT. When the DSA master uses a spin_lock() in its
ndo_get_stats64() method, the same lockdep splat can be seen.

I think the deadlock possibility is real, even though I didn't reproduce
it, and I'm thinking of the following situation to support that claim:

fdb_add_hw_addr() runs on a CPU A, in a context with softirqs locally
disabled and br->hash_lock held, and may end up attempting to acquire
ocelot->stats_lock.

In parallel, ocelot->stats_lock is currently held by a thread B (say,
ocelot_check_stats_work()), which is interrupted while holding it by a
softirq which attempts to lock br->hash_lock.

Thread B cannot make progress because br->hash_lock is held by A. Whereas
thread A cannot make progress because ocelot->stats_lock is held by B.

When taking the issue at face value, the bridge can avoid that problem
by simply making the ports promiscuous from a code path with a saner
calling context (br->hash_lock not held). A bridge port without
IFF_UNICAST_FLT is going to become promiscuous as soon as we call
dev_uc_add() on it (which we do unconditionally), so why not be
preemptive and make it promiscuous right from the beginning, so as to
not be taken by surprise.

With this, we've broken the links between code that holds br->hash_lock
or br->lock and code that calls into the ndo_change_rx_flags() or
ndo_get_stats64() ops of the bridge port.

Fixes: 2796d0c648c9 ("bridge: Automatically manage port promiscuous mode.")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2023-08-11 11:33:40 +02:00
Pablo Neira Ayuso
4916fe2825 netfilter: nftables: add nft_parse_register_store() and use it 
[ 345023b0db315648ccc3c1a36aee88304a8b4d91 ]

This new function combines the netlink register attribute parser
and the store validation function.

This update requires to replace:

        enum nft_registers      dreg:8;

in many of the expression private areas otherwise compiler complains
with:

        error: cannot take address of bit-field ‘dreg’

when passing the register field as reference.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2023-05-30 12:38:37 +01:00
Florian Westphal
754e8b7428 netfilter: ebtables: fix memory leak when blob is malformed 
[ Upstream commit 62ce44c4fff947eebdf10bb582267e686e6835c9 ]

The bug fix was incomplete, it "replaced" crash with a memory leak.
The old code had an assignment to "ret" embedded into the conditional,
restore this.

Fixes: 7997eff82828 ("netfilter: ebtables: reject blobs that don't provide all entry points")
Reported-and-tested-by: syzbot+a24c5252f3e3ab733464@syzkaller.appspotmail.com
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2022-09-28 10:56:51 +02:00
Harsh Modi
6da3735f1f netfilter: br_netfilter: Drop dst references before setting. 
[ Upstream commit d047283a7034140ea5da759a494fd2274affdd46 ]

The IPv6 path already drops dst in the daddr changed case, but the IPv4
path does not. This change makes the two code paths consistent.

Further, it is possible that there is already a metadata_dst allocated from
ingress that might already be attached to skbuff->dst while following
the bridge path. If it is not released before setting a new
metadata_dst, it will be leaked. This is similar to what is done in
bpf_set_tunnel_key() or ip6_route_input().

It is important to note that the memory being leaked is not the dst
being set in the bridge code, but rather memory allocated from some
other code path that is not being freed correctly before the skb dst is
overwritten.

An example of the leakage fixed by this commit found using kmemleak:

unreferenced object 0xffff888010112b00 (size 256):
  comm "softirq", pid 0, jiffies 4294762496 (age 32.012s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 80 16 f1 83 ff ff ff ff  ................
    e1 4e f6 82 ff ff ff ff 00 00 00 00 00 00 00 00  .N..............
  backtrace:
    [<00000000d79567ea>] metadata_dst_alloc+0x1b/0xe0
    [<00000000be113e13>] udp_tun_rx_dst+0x174/0x1f0
    [<00000000a36848f4>] geneve_udp_encap_recv+0x350/0x7b0
    [<00000000d4afb476>] udp_queue_rcv_one_skb+0x380/0x560
    [<00000000ac064aea>] udp_unicast_rcv_skb+0x75/0x90
    [<000000009a8ee8c5>] ip_protocol_deliver_rcu+0xd8/0x230
    [<00000000ef4980bb>] ip_local_deliver_finish+0x7a/0xa0
    [<00000000d7533c8c>] __netif_receive_skb_one_core+0x89/0xa0
    [<00000000a879497d>] process_backlog+0x93/0x190
    [<00000000e41ade9f>] __napi_poll+0x28/0x170
    [<00000000b4c0906b>] net_rx_action+0x14f/0x2a0
    [<00000000b20dd5d4>] __do_softirq+0xf4/0x305
    [<000000003a7d7e15>] __irq_exit_rcu+0xc3/0x140
    [<00000000968d39a2>] sysvec_apic_timer_interrupt+0x9e/0xc0
    [<000000009e920794>] asm_sysvec_apic_timer_interrupt+0x16/0x20
    [<000000008942add0>] native_safe_halt+0x13/0x20

Florian Westphal says: "Original code was likely fine because nothing
ever did set a skb->dst entry earlier than bridge in those days."

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Harsh Modi <harshmodi@google.com>
Acked-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2022-09-15 12:23:52 +02:00
Florian Westphal
afd0138259 netfilter: ebtables: reject blobs that don't provide all entry points 
[ Upstream commit 7997eff82828304b780dc0a39707e1946d6f1ebf ]

Harshit Mogalapalli says:
 In ebt_do_table() function dereferencing 'private->hook_entry[hook]'
 can lead to NULL pointer dereference. [..] Kernel panic:

general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
[..]
RIP: 0010:ebt_do_table+0x1dc/0x1ce0
Code: 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 5c 16 00 00 48 b8 00 00 00 00 00 fc ff df 49 8b 6c df 08 48 8d 7d 2c 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 88
[..]
Call Trace:
 nf_hook_slow+0xb1/0x170
 __br_forward+0x289/0x730
 maybe_deliver+0x24b/0x380
 br_flood+0xc6/0x390
 br_dev_xmit+0xa2e/0x12c0

For some reason ebtables rejects blobs that provide entry points that are
not supported by the table, but what it should instead reject is the
opposite: blobs that DO NOT provide an entry point supported by the table.

t->valid_hooks is the bitmask of hooks (input, forward ...) that will see
packets.  Providing an entry point that is not support is harmless
(never called/used), but the inverse isn't: it results in a crash
because the ebtables traverser doesn't expect a NULL blob for a location
its receiving packets for.

Instead of fixing all the individual checks, do what iptables is doing and
reject all blobs that differ from the expected hooks.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Reported-by: syzkaller <syzkaller@googlegroups.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2022-09-05 10:25:03 +02:00
Florian Westphal
85b9029d0d netfilter: br_netfilter: do not skip all hooks with 0 priority 
[ Upstream commit c2577862eeb0be94f151f2f1fff662b028061b00 ]

When br_netfilter module is loaded, skbs may be diverted to the
ipv4/ipv6 hooks, just like as if we were routing.

Unfortunately, bridge filter hooks with priority 0 may be skipped
in this case.

Example:
1. an nftables bridge ruleset is loaded, with a prerouting
   hook that has priority 0.
2. interface is added to the bridge.
3. no tcp packet is ever seen by the bridge prerouting hook.
4. flush the ruleset
5. load the bridge ruleset again.
6. tcp packets are processed as expected.

After 1) the only registered hook is the bridge prerouting hook, but its
not called yet because the bridge hasn't been brought up yet.

After 2), hook order is:
   0 br_nf_pre_routing // br_netfilter internal hook
   0 chain bridge f prerouting // nftables bridge ruleset

The packet is diverted to br_nf_pre_routing.
If call-iptables is off, the nftables bridge ruleset is called as expected.

But if its enabled, br_nf_hook_thresh() will skip it because it assumes
that all 0-priority hooks had been called previously in bridge context.

To avoid this, check for the br_nf_pre_routing hook itself, we need to
resume directly after it, even if this hook has a priority of 0.

Unfortunately, this still results in different packet flow.
With this fix, the eval order after in 3) is:
1. br_nf_pre_routing
2. ip(6)tables (if enabled)
3. nftables bridge

but after 5 its the much saner:
1. nftables bridge
2. br_nf_pre_routing
3. ip(6)tables (if enabled)

Unfortunately I don't see a solution here:
It would be possible to move br_nf_pre_routing to a higher priority
so that it will be called later in the pipeline, but this also impacts
ebtables evaluation order, and would still result in this very ordering
problem for all nftables-bridge hooks with the same priority as the
br_nf_pre_routing one.

Searching back through the git history I don't think this has
ever behaved in any other way, hence, no fixes-tag.

Reported-by: Radim Hrazdil <rhrazdil@redhat.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2022-07-21 20:42:46 +02:00
Andrew Lunn
3f67219813 net: bridge: Clear offload_fwd_mark when passing frame up bridge interface. 
[ Upstream commit fbb3abdf2223cd0dfc07de85fe5a43ba7f435bdf ]

It is possible to stack bridges on top of each other. Consider the
following which makes use of an Ethernet switch:

       br1
     /    \
    /      \
   /        \
 br0.11    wlan0
   |
   br0
 /  |  \
p1  p2  p3

br0 is offloaded to the switch. Above br0 is a vlan interface, for
vlan 11. This vlan interface is then a slave of br1. br1 also has a
wireless interface as a slave. This setup trunks wireless lan traffic
over the copper network inside a VLAN.

A frame received on p1 which is passed up to the bridge has the
skb->offload_fwd_mark flag set to true, indicating that the switch has
dealt with forwarding the frame out ports p2 and p3 as needed. This
flag instructs the software bridge it does not need to pass the frame
back down again. However, the flag is not getting reset when the frame
is passed upwards. As a result br1 sees the flag, wrongly interprets
it, and fails to forward the frame to wlan0.

When passing a frame upwards, clear the flag. This is the Rx
equivalent of br_switchdev_frame_unmark() in br_dev_xmit().

Fixes: f1c2eddf4cb6 ("bridge: switchdev: Use an helper to clear forward mark")
Signed-off-by: Andrew Lunn <andrew@lunn.ch>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Tested-by: Ido Schimmel <idosch@nvidia.com>
Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
Link: https://lore.kernel.org/r/20220518005840.771575-1-andrew@lunn.ch
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2022-05-25 08:41:20 +02:00
Florian Westphal
271bf4601e netfilter: bridge: add support for pppoe filtering 
[ Upstream commit 28b78ecffea8078d81466b2e01bb5a154509f1ba ]

This makes 'bridge-nf-filter-pppoe-tagged' sysctl work for
bridged traffic.

Looking at the original commit it doesn't appear this ever worked:

 static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff **pskb,
[..]
        if (skb->protocol == htons(ETH_P_8021Q)) {
                skb_pull(skb, VLAN_HLEN);
                skb->network_header += VLAN_HLEN;
+       } else if (skb->protocol == htons(ETH_P_PPP_SES)) {
+               skb_pull(skb, PPPOE_SES_HLEN);
+               skb->network_header += PPPOE_SES_HLEN;
        }
 [..]
	NF_HOOK(... POST_ROUTING, ...)

... but the adjusted offsets are never restored.

The alternative would be to rip this code out for good,
but otoh we'd have to keep this anyway for the vlan handling
(which works because vlan tag info is in the skb, not the packet
 payload).

Reported-and-tested-by: Amish Chana <amish@3g.co.za>
Fixes: 516299d2f5b6f97 ("[NETFILTER]: bridge-nf: filter bridged IPv4/IPv6 encapsulated in pppoe traffic")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2022-01-27 09:00:49 +01:00
Eric Dumazet
a84d989a7f net: bridge: use nla_total_size_64bit() in br_get_linkxstats_size() 
[ Upstream commit dbe0b88064494b7bb6a9b2aa7e085b14a3112d44 ]

bridge_fill_linkxstats() is using nla_reserve_64bit().

We must use nla_total_size_64bit() instead of nla_total_size()
for corresponding data structure.

Fixes: 1080ab95e3c7 ("net: bridge: add support for IGMP/MLD stats and export them via netlink")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Nikolay Aleksandrov <nikolay@nvidia.com>
Cc: Vivien Didelot <vivien.didelot@gmail.com>
Acked-by: Nikolay Aleksandrov <nikolay@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2021-10-17 10:08:33 +02:00
Yang Yingliang
b123e6b288 net: bridge: fix memleak in br_add_if() 
[ Upstream commit 519133debcc19f5c834e7e28480b60bdc234fe02 ]

I got a memleak report:

BUG: memory leak
unreferenced object 0x607ee521a658 (size 240):
comm "syz-executor.0", pid 955, jiffies 4294780569 (age 16.449s)
hex dump (first 32 bytes, cpu 1):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000d830ea5a>] br_multicast_add_port+0x1c2/0x300 net/bridge/br_multicast.c:1693
[<00000000274d9a71>] new_nbp net/bridge/br_if.c:435 [inline]
[<00000000274d9a71>] br_add_if+0x670/0x1740 net/bridge/br_if.c:611
[<0000000012ce888e>] do_set_master net/core/rtnetlink.c:2513 [inline]
[<0000000012ce888e>] do_set_master+0x1aa/0x210 net/core/rtnetlink.c:2487
[<0000000099d1cafc>] __rtnl_newlink+0x1095/0x13e0 net/core/rtnetlink.c:3457
[<00000000a01facc0>] rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3488
[<00000000acc9186c>] rtnetlink_rcv_msg+0x369/0xa10 net/core/rtnetlink.c:5550
[<00000000d4aabb9c>] netlink_rcv_skb+0x134/0x3d0 net/netlink/af_netlink.c:2504
[<00000000bc2e12a3>] netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
[<00000000bc2e12a3>] netlink_unicast+0x4a0/0x6a0 net/netlink/af_netlink.c:1340
[<00000000e4dc2d0e>] netlink_sendmsg+0x789/0xc70 net/netlink/af_netlink.c:1929
[<000000000d22c8b3>] sock_sendmsg_nosec net/socket.c:654 [inline]
[<000000000d22c8b3>] sock_sendmsg+0x139/0x170 net/socket.c:674
[<00000000e281417a>] ____sys_sendmsg+0x658/0x7d0 net/socket.c:2350
[<00000000237aa2ab>] ___sys_sendmsg+0xf8/0x170 net/socket.c:2404
[<000000004f2dc381>] __sys_sendmsg+0xd3/0x190 net/socket.c:2433
[<0000000005feca6c>] do_syscall_64+0x37/0x90 arch/x86/entry/common.c:47
[<000000007304477d>] entry_SYSCALL_64_after_hwframe+0x44/0xae

On error path of br_add_if(), p->mcast_stats allocated in
new_nbp() need be freed, or it will be leaked.

Fixes: 1080ab95e3c7 ("net: bridge: add support for IGMP/MLD stats and export them via netlink")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Acked-by: Nikolay Aleksandrov <nikolay@nvidia.com>
Link: https://lore.kernel.org/r/20210809132023.978546-1-yangyingliang@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2021-08-26 08:37:02 -04:00
Wolfgang Bumiller
8ebf539132 net: bridge: sync fdb to new unicast-filtering ports 
commit a019abd8022061b917da767cd1a66ed823724eab upstream.

Since commit 2796d0c648c9 ("bridge: Automatically manage
port promiscuous mode.")
bridges with `vlan_filtering 1` and only 1 auto-port don't
set IFF_PROMISC for unicast-filtering-capable ports.

Normally on port changes `br_manage_promisc` is called to
update the promisc flags and unicast filters if necessary,
but it cannot distinguish between *new* ports and ones
losing their promisc flag, and new ports end up not
receiving the MAC address list.

Fix this by calling `br_fdb_sync_static` in `br_add_if`
after the port promisc flags are updated and the unicast
filter was supposed to have been filled.

Fixes: 2796d0c648c9 ("bridge: Automatically manage port promiscuous mode.")
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Acked-by: Nikolay Aleksandrov <nikolay@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2021-07-28 11:12:15 +02:00
Nikolay Aleksandrov
2ab1c6d329 net: bridge: multicast: fix PIM hello router port marking race 
commit 04bef83a3358946bfc98a5ecebd1b0003d83d882 upstream.

When a PIM hello packet is received on a bridge port with multicast
snooping enabled, we mark it as a router port automatically, that
includes adding that port the router port list. The multicast lock
protects that list, but it is not acquired in the PIM message case
leading to a race condition, we need to take it to fix the race.

Cc: stable@vger.kernel.org
Fixes: 91b02d3d133b ("bridge: mcast: add router port on PIM hello message")
Signed-off-by: Nikolay Aleksandrov <nikolay@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2021-07-20 16:17:55 +02:00
Nikolay Aleksandrov
42020f7f37 net: bridge: fix vlan tunnel dst refcnt when egressing 
commit cfc579f9d89af4ada58c69b03bcaa4887840f3b3 upstream.

The egress tunnel code uses dst_clone() and directly sets the result
which is wrong because the entry might have 0 refcnt or be already deleted,
causing number of problems. It also triggers the WARN_ON() in dst_hold()[1]
when a refcnt couldn't be taken. Fix it by using dst_hold_safe() and
checking if a reference was actually taken before setting the dst.

[1] dmesg WARN_ON log and following refcnt errors
 WARNING: CPU: 5 PID: 38 at include/net/dst.h:230 br_handle_egress_vlan_tunnel+0x10b/0x134 [bridge]
 Modules linked in: 8021q garp mrp bridge stp llc bonding ipv6 virtio_net
 CPU: 5 PID: 38 Comm: ksoftirqd/5 Kdump: loaded Tainted: G        W         5.13.0-rc3+ #360
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014
 RIP: 0010:br_handle_egress_vlan_tunnel+0x10b/0x134 [bridge]
 Code: e8 85 bc 01 e1 45 84 f6 74 90 45 31 f6 85 db 48 c7 c7 a0 02 19 a0 41 0f 94 c6 31 c9 31 d2 44 89 f6 e8 64 bc 01 e1 85 db 75 02 <0f> 0b 31 c9 31 d2 44 89 f6 48 c7 c7 70 02 19 a0 e8 4b bc 01 e1 49
 RSP: 0018:ffff8881003d39e8 EFLAGS: 00010246
 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
 RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffffa01902a0
 RBP: ffff8881040c6700 R08: 0000000000000000 R09: 0000000000000001
 R10: 2ce93d0054fe0d00 R11: 54fe0d00000e0000 R12: ffff888109515000
 R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000401
 FS:  0000000000000000(0000) GS:ffff88822bf40000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 00007f42ba70f030 CR3: 0000000109926000 CR4: 00000000000006e0
 Call Trace:
  br_handle_vlan+0xbc/0xca [bridge]
  __br_forward+0x23/0x164 [bridge]
  deliver_clone+0x41/0x48 [bridge]
  br_handle_frame_finish+0x36f/0x3aa [bridge]
  ? skb_dst+0x2e/0x38 [bridge]
  ? br_handle_ingress_vlan_tunnel+0x3e/0x1c8 [bridge]
  ? br_handle_frame_finish+0x3aa/0x3aa [bridge]
  br_handle_frame+0x2c3/0x377 [bridge]
  ? __skb_pull+0x33/0x51
  ? vlan_do_receive+0x4f/0x36a
  ? br_handle_frame_finish+0x3aa/0x3aa [bridge]
  __netif_receive_skb_core+0x539/0x7c6
  ? __list_del_entry_valid+0x16e/0x1c2
  __netif_receive_skb_list_core+0x6d/0xd6
  netif_receive_skb_list_internal+0x1d9/0x1fa
  gro_normal_list+0x22/0x3e
  dev_gro_receive+0x55b/0x600
  ? detach_buf_split+0x58/0x140
  napi_gro_receive+0x94/0x12e
  virtnet_poll+0x15d/0x315 [virtio_net]
  __napi_poll+0x2c/0x1c9
  net_rx_action+0xe6/0x1fb
  __do_softirq+0x115/0x2d8
  run_ksoftirqd+0x18/0x20
  smpboot_thread_fn+0x183/0x19c
  ? smpboot_unregister_percpu_thread+0x66/0x66
  kthread+0x10a/0x10f
  ? kthread_mod_delayed_work+0xb6/0xb6
  ret_from_fork+0x22/0x30
 ---[ end trace 49f61b07f775fd2b ]---
 dst_release: dst:00000000c02d677a refcnt:-1
 dst_release underflow

Cc: stable@vger.kernel.org
Fixes: 11538d039ac6 ("bridge: vlan dst_metadata hooks in ingress and egress paths")
Signed-off-by: Nikolay Aleksandrov <nikolay@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2021-06-30 08:48:54 -04:00
Nikolay Aleksandrov
ad7feefe71 net: bridge: fix vlan tunnel dst null pointer dereference 
commit 58e2071742e38f29f051b709a5cca014ba51166f upstream.

This patch fixes a tunnel_dst null pointer dereference due to lockless
access in the tunnel egress path. When deleting a vlan tunnel the
tunnel_dst pointer is set to NULL without waiting a grace period (i.e.
while it's still usable) and packets egressing are dereferencing it
without checking. Use READ/WRITE_ONCE to annotate the lockless use of
tunnel_id, use RCU for accessing tunnel_dst and make sure it is read
only once and checked in the egress path. The dst is already properly RCU
protected so we don't need to do anything fancy than to make sure
tunnel_id and tunnel_dst are read only once and checked in the egress path.

Cc: stable@vger.kernel.org
Fixes: 11538d039ac6 ("bridge: vlan dst_metadata hooks in ingress and egress paths")
Signed-off-by: Nikolay Aleksandrov <nikolay@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2021-06-30 08:48:54 -04:00
Vladimir Oltean
d3edbf396d net: bridge: use switchdev for port flags set through sysfs too 
commit 8043c845b63a2dd88daf2d2d268a33e1872800f0 upstream.

Looking through patchwork I don't see that there was any consensus to
use switchdev notifiers only in case of netlink provided port flags but
not sysfs (as a sort of deprecation, punishment or anything like that),
so we should probably keep the user interface consistent in terms of
functionality.

http://patchwork.ozlabs.org/project/netdev/patch/20170605092043.3523-3-jiri@resnulli.us/
http://patchwork.ozlabs.org/project/netdev/patch/20170608064428.4785-3-jiri@resnulli.us/

Fixes: 3922285d96e7 ("net: bridge: Add support for offloading port attributes")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Acked-by: Nikolay Aleksandrov <nikolay@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2021-03-07 11:27:43 +01:00
Zhang Changzhong
97b4606290 net: bridge: vlan: fix error return code in __vlan_add() 
[ Upstream commit ee4f52a8de2c6f78b01f10b4c330867d88c1653a ]

Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.

Fixes: f8ed289fab84 ("bridge: vlan: use br_vlan_(get|put)_master to deal with refcounts")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Acked-by: Nikolay Aleksandrov <nikolay@nvidia.com>
Link: https://lore.kernel.org/r/1607071737-33875-1-git-send-email-zhangchangzhong@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2020-12-29 13:46:45 +01:00
Antoine Tenart
5e2cca19f1 netfilter: bridge: reset skb->pkt_type after NF_INET_POST_ROUTING traversal 
[ Upstream commit 44f64f23bae2f0fad25503bc7ab86cd08d04cd47 ]

Netfilter changes PACKET_OTHERHOST to PACKET_HOST before invoking the
hooks as, while it's an expected value for a bridge, routing expects
PACKET_HOST. The change is undone later on after hook traversal. This
can be seen with pairs of functions updating skb>pkt_type and then
reverting it to its original value:

For hook NF_INET_PRE_ROUTING:
  setup_pre_routing / br_nf_pre_routing_finish

For hook NF_INET_FORWARD:
  br_nf_forward_ip / br_nf_forward_finish

But the third case where netfilter does this, for hook
NF_INET_POST_ROUTING, the packet type is changed in br_nf_post_routing
but never reverted. A comment says:

  /* We assume any code from br_dev_queue_push_xmit onwards doesn't care
   * about the value of skb->pkt_type. */

But when having a tunnel (say vxlan) attached to a bridge we have the
following call trace:

  br_nf_pre_routing
  br_nf_pre_routing_ipv6
     br_nf_pre_routing_finish
  br_nf_forward_ip
     br_nf_forward_finish
  br_nf_post_routing           <- pkt_type is updated to PACKET_HOST
     br_nf_dev_queue_xmit      <- but not reverted to its original value
  vxlan_xmit
     vxlan_xmit_one
        skb_tunnel_check_pmtu  <- a check on pkt_type is performed

In this specific case, this creates issues such as when an ICMPv6 PTB
should be sent back. When CONFIG_BRIDGE_NETFILTER is enabled, the PTB
isn't sent (as skb_tunnel_check_pmtu checks if pkt_type is PACKET_HOST
and returns early).

If the comment is right and no one cares about the value of
skb->pkt_type after br_dev_queue_push_xmit (which isn't true), resetting
it to its original value should be safe.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Antoine Tenart <atenart@kernel.org>
Reviewed-by: Florian Westphal <fw@strlen.de>
Link: https://lore.kernel.org/r/20201123174902.622102-1-atenart@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2020-12-08 10:17:33 +01:00
Heiner Kallweit
f0cfc3abc9 net: bridge: add missing counters to ndo_get_stats64 callback 
[ Upstream commit 7a30ecc9237681bb125cbd30eee92bef7e86293d ]

In br_forward.c and br_input.c fields dev->stats.tx_dropped and
dev->stats.multicast are populated, but they are ignored in
ndo_get_stats64.

Fixes: 28172739f0a2 ("net: fix 64 bit counters on 32 bit arches")
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Link: https://lore.kernel.org/r/58ea9963-77ad-a7cf-8dfd-fc95ab95f606@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2020-11-24 13:05:38 +01:00
Srinivasarao P
0190a01fb1 Merge android-4.14-stable.190 (d2d05bc) into msm-4.14 
* refs/heads/tmp-d2d05bc:
  Linux 4.14.190
  ath9k: Fix regression with Atheros 9271
  ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb
  parisc: Add atomic64_set_release() define to avoid CPU soft lockups
  io-mapping: indicate mapping failure
  mm/memcg: fix refcount error while moving and swapping
  Makefile: Fix GCC_TOOLCHAIN_DIR prefix for Clang cross compilation
  vt: Reject zero-sized screen buffer size.
  fbdev: Detect integer underflow at "struct fbcon_ops"->clear_margins.
  serial: 8250_mtk: Fix high-speed baud rates clamping
  serial: 8250: fix null-ptr-deref in serial8250_start_tx()
  staging: comedi: addi_apci_1564: check INSN_CONFIG_DIGITAL_TRIG shift
  staging: comedi: addi_apci_1500: check INSN_CONFIG_DIGITAL_TRIG shift
  staging: comedi: ni_6527: fix INSN_CONFIG_DIGITAL_TRIG support
  staging: comedi: addi_apci_1032: check INSN_CONFIG_DIGITAL_TRIG shift
  staging: wlan-ng: properly check endpoint types
  Revert "cifs: Fix the target file was deleted when rename failed."
  usb: xhci: Fix ASM2142/ASM3142 DMA addressing
  usb: xhci-mtk: fix the failure of bandwidth allocation
  binder: Don't use mmput() from shrinker function.
  x86: math-emu: Fix up 'cmp' insn for clang ias
  arm64: Use test_tsk_thread_flag() for checking TIF_SINGLESTEP
  usb: gadget: udc: gr_udc: fix memleak on error handling path in gr_ep_init()
  Input: synaptics - enable InterTouch for ThinkPad X1E 1st gen
  dmaengine: ioat setting ioat timeout as module parameter
  hwmon: (aspeed-pwm-tacho) Avoid possible buffer overflow
  regmap: dev_get_regmap_match(): fix string comparison
  spi: mediatek: use correct SPI_CFG2_REG MACRO
  Input: add `SW_MACHINE_COVER`
  dmaengine: tegra210-adma: Fix runtime PM imbalance on error
  HID: apple: Disable Fn-key key-re-mapping on clone keyboards
  HID: i2c-hid: add Mediacom FlexBook edge13 to descriptor override
  scripts/decode_stacktrace: strip basepath from all paths
  serial: exar: Fix GPIO configuration for Sealevel cards based on XR17V35X
  bonding: check return value of register_netdevice() in bond_newlink()
  i2c: rcar: always clear ICSAR to avoid side effects
  ipvs: fix the connection sync failed in some cases
  mlxsw: destroy workqueue when trap_register in mlxsw_emad_init
  bonding: check error value of register_netdevice() immediately
  net: smc91x: Fix possible memory leak in smc_drv_probe()
  drm: sun4i: hdmi: Fix inverted HPD result
  net: dp83640: fix SIOCSHWTSTAMP to update the struct with actual configuration
  ax88172a: fix ax88172a_unbind() failures
  hippi: Fix a size used in a 'pci_free_consistent()' in an error handling path
  bnxt_en: Fix race when modifying pause settings.
  btrfs: fix page leaks after failure to lock page for delalloc
  btrfs: fix mount failure caused by race with umount
  btrfs: fix double free on ulist after backref resolution failure
  ASoC: rt5670: Correct RT5670_LDO_SEL_MASK
  ALSA: info: Drop WARN_ON() from buffer NULL sanity check
  uprobes: Change handle_swbp() to send SIGTRAP with si_code=SI_KERNEL, to fix GDB regression
  IB/umem: fix reference count leak in ib_umem_odp_get()
  spi: spi-fsl-dspi: Exit the ISR with IRQ_NONE when it's not ours
  SUNRPC reverting d03727b248d0 ("NFSv4 fix CLOSE not waiting for direct IO compeletion")
  irqdomain/treewide: Keep firmware node unconditionally allocated
  drm/nouveau/i2c/g94-: increase NV_PMGR_DP_AUXCTL_TRANSACTREQ timeout
  net: sky2: initialize return of gm_phy_read
  drivers/net/wan/lapbether: Fixed the value of hard_header_len
  xtensa: update *pos in cpuinfo_op.next
  xtensa: fix __sync_fetch_and_{and,or}_4 declarations
  scsi: scsi_transport_spi: Fix function pointer check
  mac80211: allow rx of mesh eapol frames with default rx key
  pinctrl: amd: fix npins for uart0 in kerncz_groups
  gpio: arizona: put pm_runtime in case of failure
  gpio: arizona: handle pm_runtime_get_sync failure case
  ANDROID: Incremental fs: magic number compatible 32-bit
  ANDROID: kbuild: don't merge .*..compoundliteral in modules
  Revert "arm64/alternatives: use subsections for replacement sequences"
  Linux 4.14.189
  rxrpc: Fix trace string
  libceph: don't omit recovery_deletes in target_copy()
  x86/cpu: Move x86_cache_bits settings
  sched/fair: handle case of task_h_load() returning 0
  arm64: ptrace: Override SPSR.SS when single-stepping is enabled
  thermal/drivers/cpufreq_cooling: Fix wrong frequency converted from power
  misc: atmel-ssc: lock with mutex instead of spinlock
  dmaengine: fsl-edma: Fix NULL pointer exception in fsl_edma_tx_handler
  intel_th: pci: Add Emmitsburg PCH support
  intel_th: pci: Add Tiger Lake PCH-H support
  intel_th: pci: Add Jasper Lake CPU support
  hwmon: (emc2103) fix unable to change fan pwm1_enable attribute
  MIPS: Fix build for LTS kernel caused by backporting lpj adjustment
  timer: Fix wheel index calculation on last level
  uio_pdrv_genirq: fix use without device tree and no interrupt
  Input: i8042 - add Lenovo XiaoXin Air 12 to i8042 nomux list
  mei: bus: don't clean driver pointer
  Revert "zram: convert remaining CLASS_ATTR() to CLASS_ATTR_RO()"
  fuse: Fix parameter for FS_IOC_{GET,SET}FLAGS
  virtio: virtio_console: add missing MODULE_DEVICE_TABLE() for rproc serial
  USB: serial: option: add Quectel EG95 LTE modem
  USB: serial: option: add GosunCn GM500 series
  USB: serial: ch341: add new Product ID for CH340
  USB: serial: cypress_m8: enable Simply Automated UPB PIM
  USB: serial: iuu_phoenix: fix memory corruption
  usb: gadget: function: fix missing spinlock in f_uac1_legacy
  usb: chipidea: core: add wakeup support for extcon
  usb: dwc2: Fix shutdown callback in platform
  USB: c67x00: fix use after free in c67x00_giveback_urb
  ALSA: usb-audio: Fix race against the error recovery URB submission
  ALSA: line6: Perform sanity check for each URB creation
  HID: magicmouse: do not set up autorepeat
  mtd: rawnand: oxnas: Release all devices in the _remove() path
  mtd: rawnand: oxnas: Unregister all devices on error
  mtd: rawnand: oxnas: Keep track of registered devices
  mtd: rawnand: brcmnand: fix CS0 layout
  perf stat: Zero all the 'ena' and 'run' array slot stats for interval mode
  copy_xstate_to_kernel: Fix typo which caused GDB regression
  ARM: dts: socfpga: Align L2 cache-controller nodename with dtschema
  Revert "thermal: mediatek: fix register index error"
  staging: comedi: verify array index is correct before using it
  usb: gadget: udc: atmel: fix uninitialized read in debug printk
  spi: spi-sun6i: sun6i_spi_transfer_one(): fix setting of clock rate
  arm64: dts: meson: add missing gxl rng clock
  phy: sun4i-usb: fix dereference of pointer phy0 before it is null checked
  iio:health:afe4404 Fix timestamp alignment and prevent data leak.
  ACPI: video: Use native backlight on Acer TravelMate 5735Z
  ACPI: video: Use native backlight on Acer Aspire 5783z
  mmc: sdhci: do not enable card detect interrupt for gpio cd type
  doc: dt: bindings: usb: dwc3: Update entries for disabling SS instances in park mode
  Revert "usb/xhci-plat: Set PM runtime as active on resume"
  Revert "usb/ehci-platform: Set PM runtime as active on resume"
  Revert "usb/ohci-platform: Fix a warning when hibernating"
  of: of_mdio: Correct loop scanning logic
  net: dsa: bcm_sf2: Fix node reference count
  spi: fix initial SPI_SR value in spi-fsl-dspi
  spi: spi-fsl-dspi: Fix lockup if device is shutdown during SPI transfer
  iio:health:afe4403 Fix timestamp alignment and prevent data leak.
  iio:pressure:ms5611 Fix buffer element alignment
  iio: pressure: zpa2326: handle pm_runtime_get_sync failure
  iio: mma8452: Add missed iio_device_unregister() call in mma8452_probe()
  iio: magnetometer: ak8974: Fix runtime PM imbalance on error
  iio:humidity:hdc100x Fix alignment and data leak issues
  iio:magnetometer:ak8974: Fix alignment and data leak issues
  arm64/alternatives: don't patch up internal branches
  arm64: alternative: Use true and false for boolean values
  i2c: eg20t: Load module automatically if ID matches
  gfs2: read-only mounts should grab the sd_freeze_gl glock
  tpm_tis: extra chip->ops check on error path in tpm_tis_core_init
  arm64/alternatives: use subsections for replacement sequences
  drm/exynos: fix ref count leak in mic_pre_enable
  cgroup: Fix sock_cgroup_data on big-endian.
  cgroup: fix cgroup_sk_alloc() for sk_clone_lock()
  tcp: md5: do not send silly options in SYNCOOKIES
  tcp: make sure listeners don't initialize congestion-control state
  net_sched: fix a memory leak in atm_tc_init()
  tcp: md5: allow changing MD5 keys in all socket states
  tcp: md5: refine tcp_md5_do_add()/tcp_md5_hash_key() barriers
  tcp: md5: add missing memory barriers in tcp_md5_do_add()/tcp_md5_hash_key()
  net: usb: qmi_wwan: add support for Quectel EG95 LTE modem
  net: Added pointer check for dst->ops->neigh_lookup in dst_neigh_lookup_skb
  llc: make sure applications use ARPHRD_ETHER
  l2tp: remove skb_dst_set() from l2tp_xmit_skb()
  ipv4: fill fl4_icmp_{type,code} in ping_v4_sendmsg
  genetlink: remove genl_bind
  s390/mm: fix huge pte soft dirty copying
  ARC: elf: use right ELF_ARCH
  ARC: entry: fix potential EFA clobber when TIF_SYSCALL_TRACE
  dm: use noio when sending kobject event
  drm/radeon: fix double free
  btrfs: fix fatal extent_buffer readahead vs releasepage race
  Revert "ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb"
  KVM: x86: Mark CR4.TSD as being possibly owned by the guest
  KVM: x86: Inject #GP if guest attempts to toggle CR4.LA57 in 64-bit mode
  KVM: x86: bit 8 of non-leaf PDPEs is not reserved
  KVM: arm64: Stop clobbering x0 for HVC_SOFT_RESTART
  KVM: arm64: Fix definition of PAGE_HYP_DEVICE
  ALSA: usb-audio: add quirk for MacroSilicon MS2109
  ALSA: hda - let hs_mic be picked ahead of hp_mic
  ALSA: opl3: fix infoleak in opl3
  mlxsw: spectrum_router: Remove inappropriate usage of WARN_ON()
  net: macb: mark device wake capable when "magic-packet" property present
  bnxt_en: fix NULL dereference in case SR-IOV configuration fails
  nbd: Fix memory leak in nbd_add_socket
  arm64: kgdb: Fix single-step exception handling oops
  ALSA: compress: fix partial_drain completion state
  smsc95xx: avoid memory leak in smsc95xx_bind
  smsc95xx: check return value of smsc95xx_reset
  net: cxgb4: fix return error value in t4_prep_fw
  x86/entry: Increase entry_stack size to a full page
  nvme-rdma: assign completion vector correctly
  scsi: mptscsih: Fix read sense data size
  ARM: imx6: add missing put_device() call in imx6q_suspend_init()
  cifs: update ctime and mtime during truncate
  s390/kasan: fix early pgm check handler execution
  ixgbe: protect ring accesses with READ- and WRITE_ONCE
  spi: spidev: fix a potential use-after-free in spidev_release()
  spi: spidev: fix a race between spidev_release and spidev_remove
  gpu: host1x: Detach driver on unregister
  ARM: dts: omap4-droid4: Fix spi configuration and increase rate
  spi: spi-fsl-dspi: Fix external abort on interrupt in resume or exit paths
  spi: spi-fsl-dspi: use IRQF_SHARED mode to request IRQ
  spi: spi-fsl-dspi: Fix lockup if device is removed during SPI transfer
  spi: spi-fsl-dspi: Adding shutdown hook
  KVM: s390: reduce number of IO pins to 1
  UPSTREAM: perf/core: Fix crash when using HW tracing kernel filters
  ANDROID: fscrypt: fix DUN contiguity with inline encryption + IV_INO_LBLK_32 policies
  ANDROID: f2fs: add back compress inode check
  Linux 4.14.188
  efi: Make it possible to disable efivar_ssdt entirely
  dm zoned: assign max_io_len correctly
  irqchip/gic: Atomically update affinity
  MIPS: Add missing EHB in mtc0 -> mfc0 sequence for DSPen
  cifs: Fix the target file was deleted when rename failed.
  SMB3: Honor persistent/resilient handle flags for multiuser mounts
  SMB3: Honor 'seal' flag for multiuser mounts
  Revert "ALSA: usb-audio: Improve frames size computation"
  nfsd: apply umask on fs without ACL support
  i2c: algo-pca: Add 0x78 as SCL stuck low status for PCA9665
  virtio-blk: free vblk-vqs in error path of virtblk_probe()
  drm: sun4i: hdmi: Remove extra HPD polling
  hwmon: (acpi_power_meter) Fix potential memory leak in acpi_power_meter_add()
  hwmon: (max6697) Make sure the OVERT mask is set correctly
  cxgb4: parse TC-U32 key values and masks natively
  cxgb4: use unaligned conversion for fetching timestamp
  crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock()
  kgdb: Avoid suspicious RCU usage warning
  usb: usbtest: fix missing kfree(dev->buf) in usbtest_disconnect
  mm/slub: fix stack overruns with SLUB_STATS
  mm/slub.c: fix corrupted freechain in deactivate_slab()
  usbnet: smsc95xx: Fix use-after-free after removal
  EDAC/amd64: Read back the scrub rate PCI register on F15h
  mm: fix swap cache node allocation mask
  btrfs: fix data block group relocation failure due to concurrent scrub
  btrfs: cow_file_range() num_bytes and disk_num_bytes are same
  btrfs: fix a block group ref counter leak after failure to remove block group
  UPSTREAM: binder: fix null deref of proc->context
  ANDROID: GKI: scripts: Makefile: update the lz4 command (#2)
  Linux 4.14.187
  Revert "tty: hvc: Fix data abort due to race in hvc_open"
  xfs: add agf freeblocks verify in xfs_agf_verify
  NFSv4 fix CLOSE not waiting for direct IO compeletion
  pNFS/flexfiles: Fix list corruption if the mirror count changes
  SUNRPC: Properly set the @subbuf parameter of xdr_buf_subsegment()
  sunrpc: fixed rollback in rpc_gssd_dummy_populate()
  Staging: rtl8723bs: prevent buffer overflow in update_sta_support_rate()
  drm/radeon: fix fb_div check in ni_init_smc_spll_table()
  tracing: Fix event trigger to accept redundant spaces
  arm64: perf: Report the PC value in REGS_ABI_32 mode
  ocfs2: fix panic on nfs server over ocfs2
  ocfs2: fix value of OCFS2_INVALID_SLOT
  ocfs2: load global_inode_alloc
  mm/slab: use memzero_explicit() in kzfree()
  btrfs: fix failure of RWF_NOWAIT write into prealloc extent beyond eof
  KVM: nVMX: Plumb L2 GPA through to PML emulation
  KVM: X86: Fix MSR range of APIC registers in X2APIC mode
  ACPI: sysfs: Fix pm_profile_attr type
  ALSA: hda: Add NVIDIA codec IDs 9a & 9d through a0 to patch table
  blktrace: break out of blktrace setup on concurrent calls
  kbuild: improve cc-option to clean up all temporary files
  s390/ptrace: fix setting syscall number
  net: alx: fix race condition in alx_remove
  ata/libata: Fix usage of page address by page_address in ata_scsi_mode_select_xlat function
  sched/core: Fix PI boosting between RT and DEADLINE tasks
  net: bcmgenet: use hardware padding of runt frames
  netfilter: ipset: fix unaligned atomic access
  usb: gadget: udc: Potential Oops in error handling code
  ARM: imx5: add missing put_device() call in imx_suspend_alloc_ocram()
  net: qed: fix excessive QM ILT lines consumption
  net: qed: fix NVMe login fails over VFs
  net: qed: fix left elements count calculation
  RDMA/mad: Fix possible memory leak in ib_mad_post_receive_mads()
  ASoC: rockchip: Fix a reference count leak.
  RDMA/cma: Protect bind_list and listen_list while finding matching cm id
  rxrpc: Fix handling of rwind from an ACK packet
  ARM: dts: NSP: Correct FA2 mailbox node
  efi/esrt: Fix reference count leak in esre_create_sysfs_entry.
  cifs/smb3: Fix data inconsistent when zero file range
  cifs/smb3: Fix data inconsistent when punch hole
  xhci: Poll for U0 after disabling USB2 LPM
  ALSA: usb-audio: Fix OOB access of mixer element list
  ALSA: usb-audio: Clean up mixer element list traverse
  ALSA: usb-audio: uac1: Invalidate ctl on interrupt
  loop: replace kill_bdev with invalidate_bdev
  cdc-acm: Add DISABLE_ECHO quirk for Microchip/SMSC chip
  xhci: Fix enumeration issue when setting max packet size for FS devices.
  xhci: Fix incorrect EP_STATE_MASK
  ALSA: usb-audio: add quirk for Denon DCD-1500RE
  usb: host: ehci-exynos: Fix error check in exynos_ehci_probe()
  usb: host: xhci-mtk: avoid runtime suspend when removing hcd
  USB: ehci: reopen solution for Synopsys HC bug
  usb: add USB_QUIRK_DELAY_INIT for Logitech C922
  usb: dwc2: Postponed gadget registration to the udc class driver
  USB: ohci-sm501: Add missed iounmap() in remove
  net: core: reduce recursion limit value
  net: Do not clear the sock TX queue in sk_set_socket()
  net: Fix the arp error in some cases
  ip6_gre: fix use-after-free in ip6gre_tunnel_lookup()
  tcp_cubic: fix spurious HYSTART_DELAY exit upon drop in min RTT
  ip_tunnel: fix use-after-free in ip_tunnel_lookup()
  tg3: driver sleeps indefinitely when EEH errors exceed eeh_max_freezes
  tcp: grow window for OOO packets only for SACK flows
  sctp: Don't advertise IPv4 addresses if ipv6only is set on the socket
  rxrpc: Fix notification call on completion of discarded calls
  rocker: fix incorrect error handling in dma_rings_init
  net: usb: ax88179_178a: fix packet alignment padding
  net: fix memleak in register_netdevice()
  net: bridge: enfore alignment for ethernet address
  mld: fix memory leak in ipv6_mc_destroy_dev()
  ibmveth: Fix max MTU limit
  apparmor: don't try to replace stale label in ptraceme check
  fix a braino in "sparc32: fix register window handling in genregs32_[gs]et()"
  net: sched: export __netdev_watchdog_up()
  block/bio-integrity: don't free 'buf' if bio_integrity_add_page() failed
  net: be more gentle about silly gso requests coming from user
  scsi: scsi_devinfo: handle non-terminated strings
  ANDROID: Makefile: append BUILD_NUMBER to version string when defined
  Linux 4.14.186
  KVM: x86/mmu: Set mmio_value to '0' if reserved #PF can't be generated
  kvm: x86: Fix reserved bits related calculation errors caused by MKTME
  kvm: x86: Move kvm_set_mmio_spte_mask() from x86.c to mmu.c
  md: add feature flag MD_FEATURE_RAID0_LAYOUT
  net: core: device_rename: Use rwsem instead of a seqcount
  sched/rt, net: Use CONFIG_PREEMPTION.patch
  kretprobe: Prevent triggering kretprobe from within kprobe_flush_task
  e1000e: Do not wake up the system via WOL if device wakeup is disabled
  kprobes: Fix to protect kick_kprobe_optimizer() by kprobe_mutex
  crypto: algboss - don't wait during notifier callback
  crypto: algif_skcipher - Cap recv SG list at ctx->used
  mtd: rawnand: tmio: Fix the probe error path
  mtd: rawnand: mtk: Fix the probe error path
  mtd: rawnand: plat_nand: Fix the probe error path
  mtd: rawnand: socrates: Fix the probe error path
  mtd: rawnand: oxnas: Fix the probe error path
  mtd: rawnand: oxnas: Add of_node_put()
  mtd: rawnand: orion: Fix the probe error path
  mtd: rawnand: xway: Fix the probe error path
  mtd: rawnand: sharpsl: Fix the probe error path
  mtd: rawnand: diskonchip: Fix the probe error path
  mtd: rawnand: Pass a nand_chip object to nand_release()
  block: nr_sects_write(): Disable preemption on seqcount write
  x86/boot/compressed: Relax sed symbol type regex for LLVM ld.lld
  drm/dp_mst: Increase ACT retry timeout to 3s
  ext4: fix partial cluster initialization when splitting extent
  selinux: fix double free
  drm/qxl: Use correct notify port address when creating cursor ring
  drm/dp_mst: Reformat drm_dp_check_act_status() a bit
  drm: encoder_slave: fix refcouting error for modules
  libata: Use per port sync for detach
  arm64: hw_breakpoint: Don't invoke overflow handler on uaccess watchpoints
  block: Fix use-after-free in blkdev_get()
  bcache: fix potential deadlock problem in btree_gc_coalesce
  perf report: Fix NULL pointer dereference in hists__fprintf_nr_sample_events()
  usb/ehci-platform: Set PM runtime as active on resume
  usb/xhci-plat: Set PM runtime as active on resume
  scsi: acornscsi: Fix an error handling path in acornscsi_probe()
  drm/sun4i: hdmi ddc clk: Fix size of m divider
  selftests/net: in timestamping, strncpy needs to preserve null byte
  gfs2: fix use-after-free on transaction ail lists
  blktrace: fix endianness for blk_log_remap()
  blktrace: fix endianness in get_pdu_int()
  blktrace: use errno instead of bi_status
  selftests/vm/pkeys: fix alloc_random_pkey() to make it really random
  elfnote: mark all .note sections SHF_ALLOC
  include/linux/bitops.h: avoid clang shift-count-overflow warnings
  lib/zlib: remove outdated and incorrect pre-increment optimization
  geneve: change from tx_error to tx_dropped on missing metadata
  crypto: omap-sham - add proper load balancing support for multicore
  pinctrl: freescale: imx: Fix an error handling path in 'imx_pinctrl_probe()'
  pinctrl: imxl: Fix an error handling path in 'imx1_pinctrl_core_probe()'
  scsi: ufs: Don't update urgent bkops level when toggling auto bkops
  scsi: iscsi: Fix reference count leak in iscsi_boot_create_kobj
  gfs2: Allow lock_nolock mount to specify jid=X
  openrisc: Fix issue with argument clobbering for clone/fork
  vfio/mdev: Fix reference count leak in add_mdev_supported_type
  ASoC: fsl_asrc_dma: Fix dma_chan leak when config DMA channel failed
  extcon: adc-jack: Fix an error handling path in 'adc_jack_probe()'
  powerpc/4xx: Don't unmap NULL mbase
  NFSv4.1 fix rpc_call_done assignment for BIND_CONN_TO_SESSION
  net: sunrpc: Fix off-by-one issues in 'rpc_ntop6'
  scsi: ufs-qcom: Fix scheduling while atomic issue
  clk: bcm2835: Fix return type of bcm2835_register_gate
  x86/apic: Make TSC deadline timer detection message visible
  usb: gadget: Fix issue with config_ep_by_speed function
  usb: gadget: fix potential double-free in m66592_probe.
  usb: gadget: lpc32xx_udc: don't dereference ep pointer before null check
  USB: gadget: udc: s3c2410_udc: Remove pointless NULL check in s3c2410_udc_nuke
  usb: dwc2: gadget: move gadget resume after the core is in L0 state
  watchdog: da9062: No need to ping manually before setting timeout
  IB/cma: Fix ports memory leak in cma_configfs
  PCI/PTM: Inherit Switch Downstream Port PTM settings from Upstream Port
  dm zoned: return NULL if dmz_get_zone_for_reclaim() fails to find a zone
  powerpc/64s/pgtable: fix an undefined behaviour
  clk: samsung: exynos5433: Add IGNORE_UNUSED flag to sclk_i2s1
  tty: n_gsm: Fix bogus i++ in gsm_data_kick
  USB: host: ehci-mxc: Add error handling in ehci_mxc_drv_probe()
  drm/msm/mdp5: Fix mdp5_init error path for failed mdp5_kms allocation
  usb/ohci-platform: Fix a warning when hibernating
  vfio-pci: Mask cap zero
  powerpc/ps3: Fix kexec shutdown hang
  powerpc/pseries/ras: Fix FWNMI_VALID off by one
  tty: n_gsm: Fix waking up upper tty layer when room available
  tty: n_gsm: Fix SOF skipping
  PCI: Fix pci_register_host_bridge() device_register() error handling
  clk: ti: composite: fix memory leak
  dlm: remove BUG() before panic()
  scsi: mpt3sas: Fix double free warnings
  power: supply: smb347-charger: IRQSTAT_D is volatile
  power: supply: lp8788: Fix an error handling path in 'lp8788_charger_probe()'
  scsi: qla2xxx: Fix warning after FC target reset
  PCI/ASPM: Allow ASPM on links to PCIe-to-PCI/PCI-X Bridges
  PCI: rcar: Fix incorrect programming of OB windows
  drivers: base: Fix NULL pointer exception in __platform_driver_probe() if a driver developer is foolish
  serial: amba-pl011: Make sure we initialize the port.lock spinlock
  i2c: pxa: fix i2c_pxa_scream_blue_murder() debug output
  staging: sm750fb: add missing case while setting FB_VISUAL
  thermal/drivers/ti-soc-thermal: Avoid dereferencing ERR_PTR
  tty: hvc: Fix data abort due to race in hvc_open
  s390/qdio: put thinint indicator after early error
  ALSA: usb-audio: Improve frames size computation
  scsi: qedi: Do not flush offload work if ARP not resolved
  staging: greybus: fix a missing-check bug in gb_lights_light_config()
  scsi: ibmvscsi: Don't send host info in adapter info MAD after LPM
  scsi: sr: Fix sr_probe() missing deallocate of device minor
  apparmor: fix introspection of of task mode for unconfined tasks
  mksysmap: Fix the mismatch of '.L' symbols in System.map
  NTB: Fix the default port and peer numbers for legacy drivers
  yam: fix possible memory leak in yam_init_driver
  powerpc/crashkernel: Take "mem=" option into account
  nfsd: Fix svc_xprt refcnt leak when setup callback client failed
  powerpc/perf/hv-24x7: Fix inconsistent output values incase multiple hv-24x7 events run
  clk: clk-flexgen: fix clock-critical handling
  scsi: lpfc: Fix lpfc_nodelist leak when processing unsolicited event
  mfd: wm8994: Fix driver operation if loaded as modules
  m68k/PCI: Fix a memory leak in an error handling path
  vfio/pci: fix memory leaks in alloc_perm_bits()
  ps3disk: use the default segment boundary
  PCI: aardvark: Don't blindly enable ASPM L0s and don't write to read-only register
  dm mpath: switch paths in dm_blk_ioctl() code path
  usblp: poison URBs upon disconnect
  i2c: pxa: clear all master action bits in i2c_pxa_stop_message()
  f2fs: report delalloc reserve as non-free in statfs for project quota
  iio: bmp280: fix compensation of humidity
  scsi: qla2xxx: Fix issue with adapter's stopping state
  ALSA: isa/wavefront: prevent out of bounds write in ioctl
  scsi: qedi: Check for buffer overflow in qedi_set_path()
  ARM: integrator: Add some Kconfig selections
  ASoC: davinci-mcasp: Fix dma_chan refcnt leak when getting dma type
  backlight: lp855x: Ensure regulators are disabled on probe failure
  clk: qcom: msm8916: Fix the address location of pll->config_reg
  remoteproc: Fix IDR initialisation in rproc_alloc()
  iio: pressure: bmp280: Tolerate IRQ before registering
  i2c: piix4: Detect secondary SMBus controller on AMD AM4 chipsets
  clk: sunxi: Fix incorrect usage of round_down()
  power: supply: bq24257_charger: Replace depends on REGMAP_I2C with select
  drm/i915: Whitelist context-local timestamp in the gen9 cmdparser
  s390: fix syscall_get_error for compat processes
  ANDROID: ext4: Optimize match for casefolded encrypted dirs
  ANDROID: ext4: Handle casefolding with encryption
  ANDROID: cuttlefish_defconfig: x86: Enable KERNEL_LZ4
  ANDROID: GKI: scripts: Makefile: update the lz4 command
  FROMLIST: f2fs: fix use-after-free when accessing bio->bi_crypt_context
  Linux 4.14.185
  perf symbols: Fix debuginfo search for Ubuntu
  perf probe: Fix to check blacklist address correctly
  perf probe: Do not show the skipped events
  w1: omap-hdq: cleanup to add missing newline for some dev_dbg
  mtd: rawnand: pasemi: Fix the probe error path
  mtd: rawnand: brcmnand: fix hamming oob layout
  sunrpc: clean up properly in gss_mech_unregister()
  sunrpc: svcauth_gss_register_pseudoflavor must reject duplicate registrations.
  kbuild: force to build vmlinux if CONFIG_MODVERSION=y
  powerpc/64s: Save FSCR to init_task.thread.fscr after feature init
  powerpc/64s: Don't let DT CPU features set FSCR_DSCR
  drivers/macintosh: Fix memleak in windfarm_pm112 driver
  ARM: tegra: Correct PL310 Auxiliary Control Register initialization
  kernel/cpu_pm: Fix uninitted local in cpu_pm
  dm crypt: avoid truncating the logical block size
  sparc64: fix misuses of access_process_vm() in genregs32_[sg]et()
  sparc32: fix register window handling in genregs32_[gs]et()
  pinctrl: samsung: Save/restore eint_mask over suspend for EINT_TYPE GPIOs
  power: vexpress: add suppress_bind_attrs to true
  igb: Report speed and duplex as unknown when device is runtime suspended
  media: ov5640: fix use of destroyed mutex
  b43_legacy: Fix connection problem with WPA3
  b43: Fix connection problem with WPA3
  b43legacy: Fix case where channel status is corrupted
  media: go7007: fix a miss of snd_card_free
  carl9170: remove P2P_GO support
  e1000e: Relax condition to trigger reset for ME workaround
  e1000e: Disable TSO for buffer overrun workaround
  PCI: Program MPS for RCiEP devices
  blk-mq: move _blk_mq_update_nr_hw_queues synchronize_rcu call
  btrfs: fix wrong file range cleanup after an error filling dealloc range
  btrfs: fix error handling when submitting direct I/O bio
  PCI: Unify ACS quirk desired vs provided checking
  PCI: Add ACS quirk for Intel Root Complex Integrated Endpoints
  PCI: Generalize multi-function power dependency device links
  vga_switcheroo: Use device link for HDA controller
  vga_switcheroo: Deduplicate power state tracking
  PCI: Make ACS quirk implementations more uniform
  PCI: Add ACS quirk for Ampere root ports
  PCI: Add ACS quirk for iProc PAXB
  PCI: Avoid FLR for AMD Starship USB 3.0
  PCI: Avoid FLR for AMD Matisse HD Audio & USB 3.0
  PCI: Disable MSI for Freescale Layerscape PCIe RC mode
  ext4: fix race between ext4_sync_parent() and rename()
  ext4: fix error pointer dereference
  ext4: fix EXT_MAX_EXTENT/INDEX to check for zeroed eh_max
  evm: Fix possible memory leak in evm_calc_hmac_or_hash()
  ima: Directly assign the ima_default_policy pointer to ima_rules
  ima: Fix ima digest hash table key calculation
  mm: thp: make the THP mapcount atomic against __split_huge_pmd_locked()
  btrfs: send: emit file capabilities after chown
  string.h: fix incompatibility between FORTIFY_SOURCE and KASAN
  platform/x86: hp-wmi: Convert simple_strtoul() to kstrtou32()
  cpuidle: Fix three reference count leaks
  spi: dw: Return any value retrieved from the dma_transfer callback
  mmc: sdhci-esdhc-imx: fix the mask for tuning start point
  ixgbe: fix signed-integer-overflow warning
  mmc: via-sdmmc: Respect the cmd->busy_timeout from the mmc core
  staging: greybus: sdio: Respect the cmd->busy_timeout from the mmc core
  mmc: sdhci-msm: Set SDHCI_QUIRK_MULTIBLOCK_READ_ACMD12 quirk
  MIPS: Fix IRQ tracing when call handle_fpe() and handle_msa_fpe()
  PCI: Don't disable decoding when mmio_always_on is set
  macvlan: Skip loopback packets in RX handler
  m68k: mac: Don't call via_flush_cache() on Mac IIfx
  x86/mm: Stop printing BRK addresses
  mips: Add udelay lpj numbers adjustment
  mips: MAAR: Use more precise address mask
  x86/boot: Correct relocation destination on old linkers
  mwifiex: Fix memory corruption in dump_station
  rtlwifi: Fix a double free in _rtl_usb_tx_urb_setup()
  md: don't flush workqueue unconditionally in md_open
  net: qed*: Reduce RX and TX default ring count when running inside kdump kernel
  wcn36xx: Fix error handling path in 'wcn36xx_probe()'
  nvme: refine the Qemu Identify CNS quirk
  kgdb: Fix spurious true from in_dbg_master()
  mips: cm: Fix an invalid error code of INTVN_*_ERR
  MIPS: Truncate link address into 32bit for 32bit kernel
  Crypto/chcr: fix for ccm(aes) failed test
  powerpc/spufs: fix copy_to_user while atomic
  net: allwinner: Fix use correct return type for ndo_start_xmit()
  media: cec: silence shift wrapping warning in __cec_s_log_addrs()
  net: lpc-enet: fix error return code in lpc_mii_init()
  exit: Move preemption fixup up, move blocking operations down
  lib/mpi: Fix 64-bit MIPS build with Clang
  net: bcmgenet: set Rx mode before starting netif
  netfilter: nft_nat: return EOPNOTSUPP if type or flags are not supported
  audit: fix a net reference leak in audit_list_rules_send()
  MIPS: Make sparse_init() using top-down allocation
  media: platform: fcp: Set appropriate DMA parameters
  media: dvb: return -EREMOTEIO on i2c transfer failure.
  audit: fix a net reference leak in audit_send_reply()
  dt-bindings: display: mediatek: control dpi pins mode to avoid leakage
  e1000: Distribute switch variables for initialization
  tools api fs: Make xxx__mountpoint() more scalable
  brcmfmac: fix wrong location to get firmware feature
  staging: android: ion: use vmap instead of vm_map_ram
  net: vmxnet3: fix possible buffer overflow caused by bad DMA value in vmxnet3_get_rss()
  x86/kvm/hyper-v: Explicitly align hcall param for kvm_hyperv_exit
  spi: dw: Fix Rx-only DMA transfers
  ARM: 8978/1: mm: make act_mm() respect THREAD_SIZE
  btrfs: do not ignore error from btrfs_next_leaf() when inserting checksums
  clocksource: dw_apb_timer_of: Fix missing clockevent timers
  clocksource: dw_apb_timer: Make CPU-affiliation being optional
  spi: dw: Enable interrupts in accordance with DMA xfer mode
  kgdb: Prevent infinite recursive entries to the debugger
  Bluetooth: Add SCO fallback for invalid LMP parameters error
  MIPS: Loongson: Build ATI Radeon GPU driver as module
  ixgbe: Fix XDP redirect on archs with PAGE_SIZE above 4K
  spi: dw: Zero DMA Tx and Rx configurations on stack
  net: ena: fix error returning in ena_com_get_hash_function()
  spi: pxa2xx: Apply CS clk quirk to BXT
  objtool: Ignore empty alternatives
  media: si2157: Better check for running tuner in init
  crypto: ccp -- don't "select" CONFIG_DMADEVICES
  drm: bridge: adv7511: Extend list of audio sample rates
  ACPI: GED: use correct trigger type field in _Exx / _Lxx handling
  xen/pvcalls-back: test for errors when calling backend_connect()
  can: kvaser_usb: kvaser_usb_leaf: Fix some info-leaks to USB devices
  mmc: sdio: Fix potential NULL pointer error in mmc_sdio_init_card()
  mmc: sdhci-msm: Clear tuning done flag while hs400 tuning
  agp/intel: Reinforce the barrier after GTT updates
  perf: Add cond_resched() to task_function_call()
  fat: don't allow to mount if the FAT length == 0
  mm/slub: fix a memory leak in sysfs_slab_add()
  Smack: slab-out-of-bounds in vsscanf
  ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb
  ath9x: Fix stack-out-of-bounds Write in ath9k_hif_usb_rx_cb
  ath9k: Fix use-after-free Write in ath9k_htc_rx_msg
  ath9k: Fix use-after-free Read in ath9k_wmi_ctrl_rx
  KVM: arm64: Make vcpu_cp1x() work on Big Endian hosts
  KVM: MIPS: Fix VPN2_MASK definition for variable cpu_vmbits
  KVM: MIPS: Define KVM_ENTRYHI_ASID to cpu_asid_mask(&boot_cpu_data)
  KVM: nVMX: Consult only the "basic" exit reason when routing nested exit
  KVM: nSVM: leave ASID aside in copy_vmcb_control_area
  KVM: nSVM: fix condition for filtering async PF
  video: fbdev: w100fb: Fix a potential double free.
  proc: Use new_inode not new_inode_pseudo
  ovl: initialize error in ovl_copy_xattr
  selftests/net: in rxtimestamp getopt_long needs terminating null entry
  crypto: virtio: Fix dest length calculation in __virtio_crypto_skcipher_do_req()
  crypto: virtio: Fix src/dst scatterlist calculation in __virtio_crypto_skcipher_do_req()
  crypto: virtio: Fix use-after-free in virtio_crypto_skcipher_finalize_req()
  spi: bcm2835: Fix controller unregister order
  spi: pxa2xx: Fix controller unregister order
  spi: Fix controller unregister order
  spi: No need to assign dummy value in spi_unregister_controller()
  spi: dw: Fix controller unregister order
  spi: dw: fix possible race condition
  x86/speculation: PR_SPEC_FORCE_DISABLE enforcement for indirect branches.
  x86/speculation: Avoid force-disabling IBPB based on STIBP and enhanced IBRS.
  x86/speculation: Add support for STIBP always-on preferred mode
  x86/speculation: Change misspelled STIPB to STIBP
  KVM: x86: only do L1TF workaround on affected processors
  KVM: x86/mmu: Consolidate "is MMIO SPTE" code
  kvm: x86: Fix L1TF mitigation for shadow MMU
  ALSA: pcm: disallow linking stream to itself
  crypto: cavium/nitrox - Fix 'nitrox_get_first_device()' when ndevlist is fully iterated
  spi: bcm-qspi: when tx/rx buffer is NULL set to 0
  spi: bcm2835aux: Fix controller unregister order
  nilfs2: fix null pointer dereference at nilfs_segctor_do_construct()
  cgroup, blkcg: Prepare some symbols for module and !CONFIG_CGROUP usages
  ACPI: PM: Avoid using power resources if there are none for D0
  ACPI: GED: add support for _Exx / _Lxx handler methods
  ACPI: CPPC: Fix reference count leak in acpi_cppc_processor_probe()
  ACPI: sysfs: Fix reference count leak in acpi_sysfs_add_hotplug_profile()
  ALSA: usb-audio: Fix inconsistent card PM state after resume
  ALSA: hda/realtek - add a pintbl quirk for several Lenovo machines
  ALSA: es1688: Add the missed snd_card_free()
  efi/efivars: Add missing kobject_put() in sysfs entry creation error path
  x86/reboot/quirks: Add MacBook6,1 reboot quirk
  x86/speculation: Prevent rogue cross-process SSBD shutdown
  x86/PCI: Mark Intel C620 MROMs as having non-compliant BARs
  x86_64: Fix jiffies ODR violation
  mm: add kvfree_sensitive() for freeing sensitive data objects
  perf probe: Accept the instance number of kretprobe event
  ath9k_htc: Silence undersized packet warnings
  powerpc/xive: Clear the page tables for the ESB IO mapping
  drivers/net/ibmvnic: Update VNIC protocol version reporting
  Input: synaptics - add a second working PNP_ID for Lenovo T470s
  sched/fair: Don't NUMA balance for kthreads
  ARM: 8977/1: ptrace: Fix mask for thumb breakpoint hook
  crypto: talitos - fix ECB and CBC algs ivsize
  serial: imx: Fix handling of TC irq in combination with DMA
  lib: Reduce user_access_begin() boundaries in strncpy_from_user() and strnlen_user()
  x86: uaccess: Inhibit speculation past access_ok() in user_access_begin()
  arch/openrisc: Fix issues with access_ok()
  Fix 'acccess_ok()' on alpha and SH
  make 'user_access_begin()' do 'access_ok()'
  vxlan: Avoid infinite loop when suppressing NS messages with invalid options
  ipv6: fix IPV6_ADDRFORM operation logic
  writeback: Drop I_DIRTY_TIME_EXPIRE
  writeback: Fix sync livelock due to b_dirty_time processing
  writeback: Avoid skipping inode writeback
  writeback: Protect inode->i_io_list with inode->i_lock
  Revert "writeback: Avoid skipping inode writeback"
  ANDROID: Enable LZ4_RAMDISK
  fscrypt: remove stale definition
  fs-verity: remove unnecessary extern keywords
  fs-verity: fix all kerneldoc warnings
  fscrypt: add support for IV_INO_LBLK_32 policies
  fscrypt: make test_dummy_encryption use v2 by default
  fscrypt: support test_dummy_encryption=v2
  fscrypt: add fscrypt_add_test_dummy_key()
  linux/parser.h: add include guards
  fscrypt: remove unnecessary extern keywords
  fscrypt: name all function parameters
  fscrypt: fix all kerneldoc warnings
  ANDROID: kbuild: merge more sections with LTO
  Linux 4.14.184
  uprobes: ensure that uprobe->offset and ->ref_ctr_offset are properly aligned
  iio: vcnl4000: Fix i2c swapped word reading.
  x86/speculation: Add Ivy Bridge to affected list
  x86/speculation: Add SRBDS vulnerability and mitigation documentation
  x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) mitigation
  x86/cpu: Add 'table' argument to cpu_matches()
  x86/cpu: Add a steppings field to struct x86_cpu_id
  nvmem: qfprom: remove incorrect write support
  CDC-ACM: heed quirk also in error handling
  staging: rtl8712: Fix IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK
  tty: hvc_console, fix crashes on parallel open/close
  vt: keyboard: avoid signed integer overflow in k_ascii
  usb: musb: Fix runtime PM imbalance on error
  usb: musb: start session in resume for host port
  USB: serial: option: add Telit LE910C1-EUX compositions
  USB: serial: usb_wwan: do not resubmit rx urb on fatal errors
  USB: serial: qcserial: add DW5816e QDL support
  l2tp: add sk_family checks to l2tp_validate_socket
  net: check untrusted gso_size at kernel entry
  vsock: fix timeout in vsock_accept()
  NFC: st21nfca: add missed kfree_skb() in an error path
  net: usb: qmi_wwan: add Telit LE910C1-EUX composition
  l2tp: do not use inet_hash()/inet_unhash()
  devinet: fix memleak in inetdev_init()
  airo: Fix read overflows sending packets
  scsi: ufs: Release clock if DMA map fails
  mmc: fix compilation of user API
  kernel/relay.c: handle alloc_percpu returning NULL in relay_open
  p54usb: add AirVasT USB stick device-id
  HID: i2c-hid: add Schneider SCL142ALM to descriptor override
  HID: sony: Fix for broken buttons on DS3 USB dongles
  mm: Fix mremap not considering huge pmd devmap
  net: smsc911x: Fix runtime PM imbalance on error
  net: ethernet: stmmac: Enable interface clocks on probe for IPQ806x
  net/ethernet/freescale: rework quiesce/activate for ucc_geth
  net: bmac: Fix read of MAC address from ROM
  x86/mmiotrace: Use cpumask_available() for cpumask_var_t variables
  i2c: altera: Fix race between xfer_msg and isr thread
  ARC: [plat-eznps]: Restrict to CONFIG_ISA_ARCOMPACT
  ARC: Fix ICCM & DCCM runtime size checks
  pppoe: only process PADT targeted at local interfaces
  s390/ftrace: save traced function caller
  spi: dw: use "smp_mb()" to avoid sending spi data error
  scsi: hisi_sas: Check sas_port before using it
  libnvdimm: Fix endian conversion issues 
  scsi: scsi_devinfo: fixup string compare
  ANDROID: Incremental fs: Remove dependency on PKCS7_MESSAGE_PARSER
  f2fs: attach IO flags to the missing cases
  f2fs: add node_io_flag for bio flags likewise data_io_flag
  f2fs: remove unused parameter of f2fs_put_rpages_mapping()
  f2fs: handle readonly filesystem in f2fs_ioc_shutdown()
  f2fs: avoid utf8_strncasecmp() with unstable name
  f2fs: don't return vmalloc() memory from f2fs_kmalloc()
  ANDROID: dm-bow: Add block_size option
  ANDROID: Incremental fs: Cache successful hash calculations
  ANDROID: Incremental fs: Fix four error-path bugs
  ANDROID: cuttlefish_defconfig: Disable CMOS RTC driver
  f2fs: fix retry logic in f2fs_write_cache_pages()
  ANDROID: modules: fix lockprove warning
  BACKPORT: arm64: vdso: Explicitly add build-id option
  BACKPORT: arm64: vdso: use $(LD) instead of $(CC) to link VDSO
  Linux 4.14.183
  scsi: zfcp: fix request object use-after-free in send path causing wrong traces
  genirq/generic_pending: Do not lose pending affinity update
  net: hns: Fixes the missing put_device in positive leg for roce reset
  net: hns: fix unsigned comparison to less than zero
  KVM: VMX: check for existence of secondary exec controls before accessing
  rxrpc: Fix transport sockopts to get IPv4 errors on an IPv6 socket
  sc16is7xx: move label 'err_spi' to correct section
  mm/vmalloc.c: don't dereference possible NULL pointer in __vunmap()
  netfilter: nf_conntrack_pptp: fix compilation warning with W=1 build
  bonding: Fix reference count leak in bond_sysfs_slave_add.
  qlcnic: fix missing release in qlcnic_83xx_interrupt_test.
  esp6: get the right proto for transport mode in esp6_gso_encap
  netfilter: nf_conntrack_pptp: prevent buffer overflows in debug code
  netfilter: nfnetlink_cthelper: unbreak userspace helper support
  netfilter: ipset: Fix subcounter update skip
  netfilter: nft_reject_bridge: enable reject with bridge vlan
  ip_vti: receive ipip packet by calling ip_tunnel_rcv
  vti4: eliminated some duplicate code.
  xfrm: fix error in comment
  xfrm: fix a NULL-ptr deref in xfrm_local_error
  xfrm: fix a warning in xfrm_policy_insert_list
  xfrm: call xfrm_output_gso when inner_protocol is set in xfrm_output
  xfrm: allow to accept packets with ipv6 NEXTHDR_HOP in xfrm_input
  copy_xstate_to_kernel(): don't leave parts of destination uninitialized
  x86/dma: Fix max PFN arithmetic overflow on 32 bit systems
  mac80211: mesh: fix discovery timer re-arming issue / crash
  parisc: Fix kernel panic in mem_init()
  iommu: Fix reference count leak in iommu_group_alloc.
  include/asm-generic/topology.h: guard cpumask_of_node() macro argument
  fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info()
  mm: remove VM_BUG_ON(PageSlab()) from page_mapcount()
  libceph: ignore pool overlay and cache logic on redirects
  ALSA: hda/realtek - Add new codec supported for ALC287
  exec: Always set cap_ambient in cap_bprm_set_creds
  ALSA: usb-audio: mixer: volume quirk for ESS Technology Asus USB DAC
  ALSA: hwdep: fix a left shifting 1 by 31 UB bug
  RDMA/pvrdma: Fix missing pci disable in pvrdma_pci_probe()
  mmc: block: Fix use-after-free issue for rpmb
  ARM: dts: bcm2835-rpi-zero-w: Fix led polarity
  ARM: dts/imx6q-bx50v3: Set display interface clock parents
  ARM: dts: imx6q-bx50v3: Add internal switch
  IB/qib: Call kobject_put() when kobject_init_and_add() fails
  gpio: exar: Fix bad handling for ida_simple_get error path
  ARM: uaccess: fix DACR mismatch with nested exceptions
  ARM: uaccess: integrate uaccess_save and uaccess_restore
  ARM: uaccess: consolidate uaccess asm to asm/uaccess-asm.h
  ARM: 8843/1: use unified assembler in headers
  Input: synaptics-rmi4 - fix error return code in rmi_driver_probe()
  Input: synaptics-rmi4 - really fix attn_data use-after-free
  Input: i8042 - add ThinkPad S230u to i8042 reset list
  Input: dlink-dir685-touchkeys - fix a typo in driver name
  Input: xpad - add custom init packet for Xbox One S controllers
  Input: evdev - call input_flush_device() on release(), not flush()
  Input: usbtouchscreen - add support for BonXeon TP
  samples: bpf: Fix build error
  cifs: Fix null pointer check in cifs_read
  net: freescale: select CONFIG_FIXED_PHY where needed
  usb: gadget: legacy: fix redundant initialization warnings
  cachefiles: Fix race between read_waiter and read_copier involving op->to_do
  gfs2: move privileged user check to gfs2_quota_lock_check
  net: microchip: encx24j600: add missed kthread_stop
  gpio: tegra: mask GPIO IRQs during IRQ shutdown
  ARM: dts: rockchip: fix pinctrl sub nodename for spi in rk322x.dtsi
  arm64: dts: rockchip: swap interrupts interrupt-names rk3399 gpu node
  ARM: dts: rockchip: fix phy nodename for rk3228-evb
  net/mlx4_core: fix a memory leak bug.
  net: sun: fix missing release regions in cas_init_one().
  net: qrtr: Fix passing invalid reference to qrtr_local_enqueue()
  net/mlx5e: Update netdev txq on completions during closure
  sctp: Start shutdown on association restart if in SHUTDOWN-SENT state and socket is closed
  r8152: support additional Microsoft Surface Ethernet Adapter variant
  net sched: fix reporting the first-time use timestamp
  net: revert "net: get rid of an signed integer overflow in ip_idents_reserve()"
  net/mlx5: Add command entry handling completion
  net: ipip: fix wrong address family in init error path
  ax25: fix setsockopt(SO_BINDTODEVICE)
  ANDROID: scs: fix recursive spinlock in scs_check_usage
  ANDROID: timer: fix timer_setup with CFI
  FROMGIT: USB: dummy-hcd: use configurable endpoint naming scheme
  UPSTREAM: USB: dummy-hcd: remove unsupported isochronous endpoints
  UPSTREAM: usb: raw-gadget: fix null-ptr-deref when reenabling endpoints
  UPSTREAM: usb: raw-gadget: documentation updates
  UPSTREAM: usb: raw-gadget: support stalling/halting/wedging endpoints
  UPSTREAM: usb: raw-gadget: fix gadget endpoint selection
  UPSTREAM: usb: raw-gadget: improve uapi headers comments
  UPSTREAM: usb: raw-gadget: fix return value of ep read ioctls
  UPSTREAM: usb: raw-gadget: fix raw_event_queue_fetch locking
  UPSTREAM: usb: raw-gadget: Fix copy_to/from_user() checks
  f2fs: fix wrong discard space
  f2fs: compress: don't compress any datas after cp stop
  f2fs: remove unneeded return value of __insert_discard_tree()
  f2fs: fix wrong value of tracepoint parameter
  f2fs: protect new segment allocation in expand_inode_data
  f2fs: code cleanup by removing ifdef macro surrounding
  writeback: Avoid skipping inode writeback
  ANDROID: net: bpf: permit redirect from ingress L3 to egress L2 devices at near max mtu
  Revert "ANDROID: Incremental fs: Avoid continually recalculating hashes"
  Linux 4.14.182
  iio: adc: stm32-adc: fix device used to request dma
  iio: adc: stm32-adc: Use dma_request_chan() instead dma_request_slave_channel()
  x86/unwind/orc: Fix unwind_get_return_address_ptr() for inactive tasks
  rxrpc: Fix a memory leak in rxkad_verify_response()
  rapidio: fix an error in get_user_pages_fast() error handling
  mei: release me_cl object reference
  iio: dac: vf610: Fix an error handling path in 'vf610_dac_probe()'
  iio: sca3000: Remove an erroneous 'get_device()'
  staging: greybus: Fix uninitialized scalar variable
  staging: iio: ad2s1210: Fix SPI reading
  Revert "gfs2: Don't demote a glock until its revokes are written"
  cxgb4/cxgb4vf: Fix mac_hlist initialization and free
  cxgb4: free mac_hlist properly
  media: fdp1: Fix R-Car M3-N naming in debug message
  libnvdimm/btt: Fix LBA masking during 'free list' population
  libnvdimm/btt: Remove unnecessary code in btt_freelist_init
  ubsan: build ubsan.c more conservatively
  x86/uaccess, ubsan: Fix UBSAN vs. SMAP
  powerpc/64s: Disable STRICT_KERNEL_RWX
  powerpc: Remove STRICT_KERNEL_RWX incompatibility with RELOCATABLE
  powerpc: restore alphabetic order in Kconfig
  dmaengine: tegra210-adma: Fix an error handling path in 'tegra_adma_probe()'
  apparmor: Fix aa_label refcnt leak in policy_update
  ALSA: pcm: fix incorrect hw_base increase
  ALSA: iec1712: Initialize STDSP24 properly when using the model=staudio option
  l2tp: initialise PPP sessions before registering them
  l2tp: protect sock pointer of struct pppol2tp_session with RCU
  l2tp: initialise l2tp_eth sessions before registering them
  l2tp: don't register sessions in l2tp_session_create()
  arm64: fix the flush_icache_range arguments in machine_kexec
  padata: purge get_cpu and reorder_via_wq from padata_do_serial
  padata: initialize pd->cpu with effective cpumask
  padata: Replace delayed timer with immediate workqueue in padata_reorder
  padata: set cpu_index of unused CPUs to -1
  ARM: futex: Address build warning
  platform/x86: asus-nb-wmi: Do not load on Asus T100TA and T200TA
  USB: core: Fix misleading driver bug report
  ceph: fix double unlock in handle_cap_export()
  gtp: set NLM_F_MULTI flag in gtp_genl_dump_pdp()
  x86/apic: Move TSC deadline timer debug printk
  scsi: ibmvscsi: Fix WARN_ON during event pool release
  component: Silence bind error on -EPROBE_DEFER
  vhost/vsock: fix packet delivery order to monitoring devices
  configfs: fix config_item refcnt leak in configfs_rmdir()
  scsi: qla2xxx: Fix hang when issuing nvme disconnect-all in NPIV
  HID: multitouch: add eGalaxTouch P80H84 support
  gcc-common.h: Update for GCC 10
  ubi: Fix seq_file usage in detailed_erase_block_info debugfs file
  i2c: mux: demux-pinctrl: Fix an error handling path in 'i2c_demux_pinctrl_probe()'
  iommu/amd: Fix over-read of ACPI UID from IVRS table
  fix multiplication overflow in copy_fdtable()
  ima: Fix return value of ima_write_policy()
  evm: Check also if *tfm is an error pointer in init_desc()
  ima: Set file->f_mode instead of file->f_flags in ima_calc_file_hash()
  padata: ensure padata_do_serial() runs on the correct CPU
  padata: ensure the reorder timer callback runs on the correct CPU
  i2c: dev: Fix the race between the release of i2c_dev and cdev
  watchdog: Fix the race between the release of watchdog_core_data and cdev
  ext4: add cond_resched() to ext4_protect_reserved_inode
  ANDROID: scsi: ufs: Handle clocks when lrbp fails
  ANDROID: fscrypt: handle direct I/O with IV_INO_LBLK_32
  BACKPORT: FROMLIST: fscrypt: add support for IV_INO_LBLK_32 policies
  f2fs: avoid inifinite loop to wait for flushing node pages at cp_error
  ANDROID: namespace'ify tcp_default_init_rwnd implementation
  Linux 4.14.181
  Makefile: disallow data races on gcc-10 as well
  KVM: x86: Fix off-by-one error in kvm_vcpu_ioctl_x86_setup_mce
  ARM: dts: r8a7740: Add missing extal2 to CPG node
  ARM: dts: r8a73a4: Add missing CMT1 interrupts
  arm64: dts: rockchip: Rename dwc3 device nodes on rk3399 to make dtc happy
  arm64: dts: rockchip: Replace RK805 PMIC node name with "pmic" on rk3328 boards
  Revert "ALSA: hda/realtek: Fix pop noise on ALC225"
  usb: gadget: legacy: fix error return code in cdc_bind()
  usb: gadget: legacy: fix error return code in gncm_bind()
  usb: gadget: audio: Fix a missing error return value in audio_bind()
  usb: gadget: net2272: Fix a memory leak in an error handling path in 'net2272_plat_probe()'
  clk: rockchip: fix incorrect configuration of rk3228 aclk_gpu* clocks
  exec: Move would_dump into flush_old_exec
  x86/unwind/orc: Fix error handling in __unwind_start()
  usb: xhci: Fix NULL pointer dereference when enqueuing trbs from urb sg list
  USB: gadget: fix illegal array access in binding with UDC
  usb: host: xhci-plat: keep runtime active when removing host
  usb: core: hub: limit HUB_QUIRK_DISABLE_AUTOSUSPEND to USB5534B
  ALSA: usb-audio: Add control message quirk delay for Kingston HyperX headset
  x86: Fix early boot crash on gcc-10, third try
  ARM: dts: imx27-phytec-phycard-s-rdk: Fix the I2C1 pinctrl entries
  ARM: dts: dra7: Fix bus_dma_limit for PCIe
  ALSA: rawmidi: Fix racy buffer resize under concurrent accesses
  ALSA: rawmidi: Initialize allocated buffers
  ALSA: hda/realtek - Limit int mic boost for Thinkpad T530
  net: tcp: fix rx timestamp behavior for tcp_recvmsg
  netprio_cgroup: Fix unlimited memory leak of v2 cgroups
  net: ipv4: really enforce backoff for redirects
  net: dsa: loop: Add module soft dependency
  hinic: fix a bug of ndo_stop
  Revert "ipv6: add mtu lock check in __ip6_rt_update_pmtu"
  net: phy: fix aneg restart in phy_ethtool_set_eee
  netlabel: cope with NULL catmap
  net: fix a potential recursive NETDEV_FEAT_CHANGE
  net: phy: micrel: Use strlcpy() for ethtool::get_strings
  x86/asm: Add instruction suffixes to bitops
  gcc-10: avoid shadowing standard library 'free()' in crypto
  gcc-10: disable 'restrict' warning for now
  gcc-10: disable 'stringop-overflow' warning for now
  gcc-10: disable 'array-bounds' warning for now
  gcc-10: disable 'zero-length-bounds' warning for now
  Stop the ad-hoc games with -Wno-maybe-initialized
  kbuild: compute false-positive -Wmaybe-uninitialized cases in Kconfig
  gcc-10 warnings: fix low-hanging fruit
  pnp: Use list_for_each_entry() instead of open coding
  hwmon: (da9052) Synchronize access with mfd
  IB/mlx4: Test return value of calls to ib_get_cached_pkey
  netfilter: conntrack: avoid gcc-10 zero-length-bounds warning
  i40iw: Fix error handling in i40iw_manage_arp_cache()
  pinctrl: cherryview: Add missing spinlock usage in chv_gpio_irq_handler
  pinctrl: baytrail: Enable pin configuration setting for GPIO chip
  ipmi: Fix NULL pointer dereference in ssif_probe
  x86/entry/64: Fix unwind hints in register clearing code
  ALSA: hda/realtek - Fix S3 pop noise on Dell Wyse
  ipc/util.c: sysvipc_find_ipc() incorrectly updates position index
  drm/qxl: lost qxl_bo_kunmap_atomic_page in qxl_image_init_helper()
  ALSA: hda/hdmi: fix race in monitor detection during probe
  cpufreq: intel_pstate: Only mention the BIOS disabling turbo mode once
  dmaengine: mmp_tdma: Reset channel error on release
  dmaengine: pch_dma.c: Avoid data race between probe and irq handler
  scsi: sg: add sg_remove_request in sg_write
  virtio-blk: handle block_device_operations callbacks after hot unplug
  drop_monitor: work around gcc-10 stringop-overflow warning
  net: moxa: Fix a potential double 'free_irq()'
  net/sonic: Fix a resource leak in an error handling path in 'jazz_sonic_probe()'
  shmem: fix possible deadlocks on shmlock_user_lock
  net: stmmac: Use mutex instead of spinlock
  f2fs: fix to avoid memory leakage in f2fs_listxattr
  f2fs: fix to avoid accessing xattr across the boundary
  f2fs: sanity check of xattr entry size
  f2fs: introduce read_xattr_block
  f2fs: introduce read_inline_xattr
  blktrace: fix dereference after null check
  blktrace: Protect q->blk_trace with RCU
  blktrace: fix trace mutex deadlock
  blktrace: fix unlocked access to init/start-stop/teardown
  net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup
  net: ipv6: add net argument to ip6_dst_lookup_flow
  scripts/decodecode: fix trapping instruction formatting
  objtool: Fix stack offset tracking for indirect CFAs
  netfilter: nat: never update the UDP checksum when it's 0
  x86/unwind/orc: Fix error path for bad ORC entry type
  x86/unwind/orc: Prevent unwinding before ORC initialization
  x86/unwind/orc: Don't skip the first frame for inactive tasks
  x86/entry/64: Fix unwind hints in rewind_stack_do_exit()
  x86/entry/64: Fix unwind hints in kernel exit path
  batman-adv: Fix refcnt leak in batadv_v_ogm_process
  batman-adv: Fix refcnt leak in batadv_store_throughput_override
  batman-adv: Fix refcnt leak in batadv_show_throughput_override
  batman-adv: fix batadv_nc_random_weight_tq
  coredump: fix crash when umh is disabled
  mm/page_alloc: fix watchdog soft lockups during set_zone_contiguous()
  KVM: arm: vgic: Fix limit condition when writing to GICD_I[CS]ACTIVER
  tracing: Add a vmalloc_sync_mappings() for safe measure
  USB: serial: garmin_gps: add sanity checking for data length
  USB: uas: add quirk for LaCie 2Big Quadra
  HID: usbhid: Fix race between usbhid_close() and usbhid_stop()
  geneve: only configure or fill UDP_ZERO_CSUM6_RX/TX info when CONFIG_IPV6
  HID: wacom: Read HID_DG_CONTACTMAX directly for non-generic devices
  ipv6: fix cleanup ordering for ip6_mr failure
  net: stricter validation of untrusted gso packets
  bnxt_en: Fix VF anti-spoof filter setup.
  bnxt_en: Improve AER slot reset.
  net/mlx5: Fix command entry leak in Internal Error State
  net/mlx5: Fix forced completion access non initialized command entry
  bnxt_en: Fix VLAN acceleration handling in bnxt_fix_features().
  sch_sfq: validate silly quantum values
  sch_choke: avoid potential panic in choke_reset()
  net: usb: qmi_wwan: add support for DW5816e
  net/mlx4_core: Fix use of ENOSPC around mlx4_counter_alloc()
  net: macsec: preserve ingress frame ordering
  fq_codel: fix TCA_FQ_CODEL_DROP_BATCH_SIZE sanity checks
  dp83640: reverse arguments to list_add_tail
  USB: serial: qcserial: Add DW5816e support
  f2fs: compress: fix zstd data corruption
  f2fs: add compressed/gc data read IO stat
  f2fs: fix potential use-after-free issue
  f2fs: compress: don't handle non-compressed data in workqueue
  f2fs: remove redundant assignment to variable err
  f2fs: refactor resize_fs to avoid meta updates in progress
  f2fs: use round_up to enhance calculation
  f2fs: introduce F2FS_IOC_RESERVE_COMPRESS_BLOCKS
  f2fs: Avoid double lock for cp_rwsem during checkpoint
  f2fs: report delalloc reserve as non-free in statfs for project quota
  f2fs: Fix wrong stub helper update_sit_info
  f2fs: compress: let lz4 compressor handle output buffer budget properly
  f2fs: remove blk_plugging in block_operations
  f2fs: introduce F2FS_IOC_RELEASE_COMPRESS_BLOCKS
  f2fs: shrink spinlock coverage
  f2fs: correctly fix the parent inode number during fsync()
  f2fs: introduce mempool for {,de}compress intermediate page allocation
  f2fs: introduce f2fs_bmap_compress()
  f2fs: support fiemap on compressed inode
  f2fs: support partial truncation on compressed inode
  f2fs: remove redundant compress inode check
  f2fs: flush dirty meta pages when flushing them
  f2fs: use strcmp() in parse_options()
  f2fs: fix checkpoint=disable:%u%%
  f2fs: Use the correct style for SPDX License Identifier
  f2fs: rework filename handling
  f2fs: split f2fs_d_compare() from f2fs_match_name()
  f2fs: don't leak filename in f2fs_try_convert_inline_dir()
  ANDROID: clang: update to 11.0.1
  FROMLIST: x86_64: fix jiffies ODR violation
  ANDROID: cuttlefish_defconfig: Enable net testing options
  ANDROID: Incremental fs: wake up log pollers less often
  ANDROID: Incremental fs: Fix scheduling while atomic error
  ANDROID: Incremental fs: Avoid continually recalculating hashes
  Revert "f2fs: refactor resize_fs to avoid meta updates in progress"
  UPSTREAM: HID: steam: Fix input device disappearing
  ANDROID: fscrypt: set dun_bytes more precisely
  ANDROID: dm-default-key: set dun_bytes more precisely
  ANDROID: block: backport the ability to specify max_dun_bytes
  ANDROID: hid: steam: remove BT controller matching
  ANDROID: dm-default-key: Update key size for wrapped keys
  ANDROID: cuttlefish_defconfig: Enable CONFIG_STATIC_USERMODEHELPER
  ANDROID: cuttlefish_defconfig: enable CONFIG_MMC_CRYPTO
  ANDROID: Add padding for crypto related structs in UFS and MMC
  ANDROID: mmc: MMC crypto API
  f2fs: fix missing check for f2fs_unlock_op
  f2fs: refactor resize_fs to avoid meta updates in progress

 Conflicts:
	Documentation/devicetree/bindings/usb/dwc3.txt
	drivers/block/virtio_blk.c
	drivers/mmc/core/Kconfig
	drivers/mmc/core/block.c
	drivers/mmc/host/sdhci-msm.c
	drivers/net/ethernet/stmicro/stmmac/stmmac.h
	drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
	drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
	drivers/scsi/ufs/ufs-qcom.c
	drivers/usb/gadget/composite.c
	drivers/usb/gadget/function/f_uac1_legacy.c
	fs/crypto/crypto.c
	fs/crypto/inline_crypt.c
	fs/crypto/keyring.c
	fs/f2fs/checkpoint.c
	include/linux/fs.h
	include/linux/mmc/host.h
	include/linux/mod_devicetable.h
	include/uapi/linux/input-event-codes.h
	net/qrtr/qrtr.c
	sound/core/compress_offload.c
	sound/core/rawmidi.c

Fixed build errors:
	drivers/scsi/ufs/ufshcd.c

Change-Id: I2add911b58d3c87b666ffa0fe46cbceb6cc56430
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
 2020-09-06 01:12:33 +05:30
Thomas Martitz
bc0feec2bc net: bridge: enfore alignment for ethernet address 
[ Upstream commit db7202dec92e6caa2706c21d6fc359af318bde2e ]

The eth_addr member is passed to ether_addr functions that require
2-byte alignment, therefore the member must be properly aligned
to avoid unaligned accesses.

The problem is in place since the initial merge of multicast to unicast:
commit 6db6f0eae6052b70885562e1733896647ec1d807 bridge: multicast to unicast

Fixes: 6db6f0eae605 ("bridge: multicast to unicast")
Cc: Roopa Prabhu <roopa@cumulusnetworks.com>
Cc: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Felix Fietkau <nbd@nbd.name>
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Martitz <t.martitz@avm.de>
Acked-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2020-06-30 15:37:58 -04:00
Srinivasarao P
8e1e29842d Merge android-4.14.168 (509b380) into msm-4.14 
* refs/heads/tmp-509b380:
  Revert "Revert "ANDROID: security,perf: Allow further restriction of perf_event_open""
  Linux 4.14.168
  m68k: Call timer_interrupt() with interrupts disabled
  serial: stm32: fix clearing interrupt error flags
  IB/iser: Fix dma_nents type definition
  arm64: dts: juno: Fix UART frequency
  drm/radeon: fix bad DMA from INTERRUPT_CNTL2
  dmaengine: ti: edma: fix missed failure handling
  affs: fix a memory leak in affs_remount
  mmc: core: fix wl1251 sdio quirks
  mmc: sdio: fix wl1251 vendor id
  packet: fix data-race in fanout_flow_is_huge()
  net: neigh: use long type to store jiffies delta
  hv_netvsc: flag software created hash value
  MIPS: Loongson: Fix return value of loongson_hwmon_init
  afs: Fix large file support
  net: qca_spi: Move reset_count to struct qcaspi
  net: netem: correct the parent's backlog when corrupted packet was dropped
  net: netem: fix error path for corrupted GSO frames
  dmaengine: imx-sdma: fix size check for sdma script_number
  drm/msm/dsi: Implement reset correctly
  tcp: annotate lockless access to tcp_memory_pressure
  net: add {READ|WRITE}_ONCE() annotations on ->rskq_accept_head
  net: avoid possible false sharing in sk_leave_memory_pressure()
  act_mirred: Fix mirred_init_module error handling
  net: stmmac: fix length of PTP clock's name string
  llc: fix sk_buff refcounting in llc_conn_state_process()
  llc: fix another potential sk_buff leak in llc_ui_sendmsg()
  mac80211: accept deauth frames in IBSS mode
  net: stmmac: gmac4+: Not all Unicast addresses may be available
  nvme: retain split access workaround for capability reads
  net: ethernet: stmmac: Fix signedness bug in ipq806x_gmac_of_parse()
  of: mdio: Fix a signedness bug in of_phy_get_and_connect()
  net: axienet: fix a signedness bug in probe
  net: stmmac: dwmac-meson8b: Fix signedness bug in probe
  net: broadcom/bcmsysport: Fix signedness in bcm_sysport_probe()
  net: hisilicon: Fix signedness bug in hix5hd2_dev_probe()
  net: aquantia: Fix aq_vec_isr_legacy() return value
  iommu/amd: Wait for completion of IOTLB flush in attach_device
  net/rds: Fix 'ib_evt_handler_call' element in 'rds_ib_stat_names'
  RDMA/cma: Fix false error message
  ath10k: adjust skb length in ath10k_sdio_mbox_rx_packet
  pinctrl: iproc-gpio: Fix incorrect pinconf configurations
  net: sonic: replace dev_kfree_skb in sonic_send_packet
  hwmon: (shtc1) fix shtc1 and shtw1 id mask
  ixgbe: sync the first fragment unconditionally
  btrfs: use correct count in btrfs_file_write_iter()
  Btrfs: fix inode cache waiters hanging on path allocation failure
  Btrfs: fix inode cache waiters hanging on failure to start caching thread
  Btrfs: fix hang when loading existing inode cache off disk
  scsi: fnic: fix msix interrupt allocation
  net: sonic: return NETDEV_TX_OK if failed to map buffer
  tty: serial: fsl_lpuart: Use appropriate lpuart32_* I/O funcs
  ath9k: dynack: fix possible deadlock in ath_dynack_node_{de}init
  iio: dac: ad5380: fix incorrect assignment to val
  bcma: fix incorrect update of BCMA_CORE_PCI_MDIO_DATA
  irqdomain: Add the missing assignment of domain->fwnode for named fwnode
  staging: greybus: light: fix a couple double frees
  x86, perf: Fix the dependency of the x86 insn decoder selftest
  power: supply: Init device wakeup after device_add()
  hwmon: (lm75) Fix write operations for negative temperatures
  Partially revert "kfifo: fix kfifo_alloc() and kfifo_init()"
  ahci: Do not export local variable ahci_em_messages
  iommu/mediatek: Fix iova_to_phys PA start for 4GB mode
  mips: avoid explicit UB in assignment of mips_io_port_base
  rtc: pcf2127: bugfix: read rtc disables watchdog
  media: atmel: atmel-isi: fix timeout value for stop streaming
  mac80211: minstrel_ht: fix per-group max throughput rate initialization
  dmaengine: dw: platform: Switch to acpi_dma_controller_register()
  ASoC: sun4i-i2s: RX and TX counter registers are swapped
  signal: Allow cifs and drbd to receive their terminating signals
  bnxt_en: Fix handling FRAG_ERR when NVM_INSTALL_UPDATE cmd fails
  net/rds: Add a few missing rds_stat_names entries
  ASoC: wm8737: Fix copy-paste error in wm8737_snd_controls
  ASoC: cs4349: Use PM ops 'cs4349_runtime_pm'
  ASoC: es8328: Fix copy-paste error in es8328_right_line_controls
  ext4: set error return correctly when ext4_htree_store_dirent fails
  crypto: caam - free resources in case caam_rng registration failed
  cifs: fix rmmod regression in cifs.ko caused by force_sig changes
  net/mlx5: Fix mlx5_ifc_query_lag_out_bits
  ARM: dts: stm32: add missing vdda-supply to adc on stm32h743i-eval
  tipc: reduce risk of wakeup queue starvation
  ALSA: aoa: onyx: always initialize register read value
  crypto: ccp - Reduce maximum stack usage
  x86/kgbd: Use NMI_VECTOR not APIC_DM_NMI
  mic: avoid statically declaring a 'struct device'.
  usb: host: xhci-hub: fix extra endianness conversion
  qed: reduce maximum stack frame size
  libertas_tf: Use correct channel range in lbtf_geo_init
  PM: sleep: Fix possible overflow in pm_system_cancel_wakeup()
  clk: sunxi-ng: v3s: add the missing PLL_DDR1
  scsi: libfc: fix null pointer dereference on a null lport
  net: pasemi: fix an use-after-free in pasemi_mac_phy_init()
  RDMA/hns: Fixs hw access invalid dma memory error
  devres: allow const resource arguments
  rxrpc: Fix uninitialized error code in rxrpc_send_data_packet()
  mfd: intel-lpss: Release IDA resources
  iommu/amd: Make iommu_disable safer
  bnxt_en: Fix ethtool selftest crash under error conditions.
  nvmem: imx-ocotp: Ensure WAIT bits are preserved when setting timing
  clk: qcom: Fix -Wunused-const-variable
  dmaengine: hsu: Revert "set HSU_CH_MTSR to memory width"
  perf/ioctl: Add check for the sample_period value
  drm/msm/a3xx: remove TPL1 regs from snapshot
  rtc: pcf8563: Clear event flags and disable interrupts before requesting irq
  rtc: pcf8563: Fix interrupt trigger method
  ASoC: ti: davinci-mcasp: Fix slot mask settings when using multiple AXRs
  net/af_iucv: always register net_device notifier
  net: netem: fix backlog accounting for corrupted GSO frames
  drm/msm/mdp5: Fix mdp5_cfg_init error return
  powerpc/pseries/mobility: rebuild cacheinfo hierarchy post-migration
  powerpc/cacheinfo: add cacheinfo_teardown, cacheinfo_rebuild
  qed: iWARP - Use READ_ONCE and smp_store_release to access ep->state
  iommu/vt-d: Duplicate iommu_resv_region objects per device list
  mpls: fix warning with multi-label encap
  media: vivid: fix incorrect assignment operation when setting video mode
  cpufreq: brcmstb-avs-cpufreq: Fix types for voltage/frequency
  cpufreq: brcmstb-avs-cpufreq: Fix initial command check
  netvsc: unshare skb in VF rx handler
  inet: frags: call inet_frags_fini() after unregister_pernet_subsys()
  signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of force_sig
  iommu: Use right function to get group for device
  misc: sgi-xp: Properly initialize buf in xpc_get_rsvd_page_pa
  serial: stm32: fix wakeup source initialization
  serial: stm32: Add support of TC bit status check
  serial: stm32: fix transmit_chars when tx is stopped
  serial: stm32: fix rx error handling
  crypto: ccp - Fix 3DES complaint from ccp-crypto module
  crypto: ccp - fix AES CFB error exposed by new test vectors
  spi: spi-fsl-spi: call spi_finalize_current_message() at the end
  RDMA/qedr: Fix incorrect device rate.
  arm64: dts: meson: libretech-cc: set eMMC as removable
  dmaengine: tegra210-adma: Fix crash during probe
  ARM: dts: sun8i-h3: Fix wifi in Beelink X2 DT
  EDAC/mc: Fix edac_mc_find() in case no device is found
  thermal: cpu_cooling: Actually trace CPU load in thermal_power_cpu_get_power
  backlight: lm3630a: Return 0 on success in update_status functions
  kdb: do a sanity check on the cpu in kdb_per_cpu()
  ARM: riscpc: fix lack of keyboard interrupts after irq conversion
  pwm: meson: Don't disable PWM when setting duty repeatedly
  pwm: meson: Consider 128 a valid pre-divider
  netfilter: ebtables: CONFIG_COMPAT: reject trailing data after last rule
  crypto: caam - fix caam_dump_sg that iterates through scatterlist
  platform/x86: alienware-wmi: printing the wrong error code
  media: davinci/vpbe: array underflow in vpbe_enum_outputs()
  media: omap_vout: potential buffer overflow in vidioc_dqbuf()
  l2tp: Fix possible NULL pointer dereference
  vfio/mdev: Fix aborting mdev child device removal if one fails
  vfio/mdev: Avoid release parent reference during error path
  afs: Fix the afs.cell and afs.volume xattr handlers
  lightnvm: pblk: fix lock order in pblk_rb_tear_down_check
  mmc: core: fix possible use after free of host
  dmaengine: tegra210-adma: restore channel status
  net: ena: fix ena_com_fill_hash_function() implementation
  net: ena: fix incorrect test of supported hash function
  net: ena: fix: Free napi resources when ena_up() fails
  net: ena: fix swapped parameters when calling ena_com_indirect_table_fill_entry
  iommu/vt-d: Make kernel parameter igfx_off work with vIOMMU
  IB/mlx5: Add missing XRC options to QP optional params mask
  dwc2: gadget: Fix completed transfer size calculation in DDMA
  usb: gadget: fsl: fix link error against usb-gadget module
  ASoC: fix valid stream condition
  packet: in recvmsg msg_name return at least sizeof sockaddr_ll
  scsi: qla2xxx: Avoid that qlt_send_resp_ctio() corrupts memory
  scsi: qla2xxx: Fix a format specifier
  irqchip/gic-v3-its: fix some definitions of inner cacheability attributes
  NFS: Don't interrupt file writeout due to fatal errors
  ALSA: usb-audio: Handle the error from snd_usb_mixer_apply_create_quirk()
  dmaengine: axi-dmac: Don't check the number of frames for alignment
  6lowpan: Off by one handling ->nexthdr
  media: ov2659: fix unbalanced mutex_lock/unlock
  ARM: dts: ls1021: Fix SGMII PCS link remaining down after PHY disconnect
  powerpc: vdso: Make vdso32 installation conditional in vdso_install
  selftests/ipc: Fix msgque compiler warnings
  tipc: set sysctl_tipc_rmem and named_timeout right range
  platform/x86: alienware-wmi: fix kfree on potentially uninitialized pointer
  hwmon: (w83627hf) Use request_muxed_region for Super-IO accesses
  net: hns3: fix for vport->bw_limit overflow problem
  ARM: pxa: ssp: Fix "WARNING: invalid free of devm_ allocated data"
  scsi: target/core: Fix a race condition in the LUN lookup code
  scsi: qla2xxx: Unregister chrdev if module initialization fails
  ehea: Fix a copy-paste err in ehea_init_port_res
  spi: bcm2835aux: fix driver to not allow 65535 (=-1) cs-gpios
  soc/fsl/qe: Fix an error code in qe_pin_request()
  spi: tegra114: configure dma burst size to fifo trig level
  spi: tegra114: flush fifos
  spi: tegra114: terminate dma and reset on transfer timeout
  spi: tegra114: fix for unpacked mode transfers
  spi: tegra114: clear packed bit for unpacked mode
  media: tw5864: Fix possible NULL pointer dereference in tw5864_handle_frame
  media: davinci-isif: avoid uninitialized variable use
  ARM: OMAP2+: Fix potentially uninitialized return value for _setup_reset()
  arm64: dts: allwinner: a64: Add missing PIO clocks
  m68k: mac: Fix VIA timer counter accesses
  tipc: tipc clang warning
  jfs: fix bogus variable self-initialization
  regulator: tps65086: Fix tps65086_ldoa1_ranges for selector 0xB
  media: cx23885: check allocation return
  media: wl128x: Fix an error code in fm_download_firmware()
  media: cx18: update *pos correctly in cx18_read_pos()
  media: ivtv: update *pos correctly in ivtv_read_pos()
  regulator: lp87565: Fix missing register for LP87565_BUCK_0
  net: sh_eth: fix a missing check of of_get_phy_mode
  xen, cpu_hotplug: Prevent an out of bounds access
  drivers/rapidio/rio_cm.c: fix potential oops in riocm_ch_listen()
  scsi: megaraid_sas: reduce module load time
  x86/mm: Remove unused variable 'cpu'
  nios2: ksyms: Add missing symbol exports
  powerpc/mm: Check secondary hash page table
  net: aquantia: fixed instack structure overflow
  NFSv4/flexfiles: Fix invalid deref in FF_LAYOUT_DEVID_NODE()
  netfilter: nft_set_hash: fix lookups with fixed size hash on big endian
  regulator: wm831x-dcdc: Fix list of wm831x_dcdc_ilim from mA to uA
  ARM: 8848/1: virt: Align GIC version check with arm64 counterpart
  ARM: 8847/1: pm: fix HYP/SVC mode mismatch when MCPM is used
  mmc: sdhci-brcmstb: handle mmc_of_parse() errors during probe
  NFS/pnfs: Bulk destroy of layouts needs to be safe w.r.t. umount
  platform/x86: wmi: fix potential null pointer dereference
  clocksource/drivers/exynos_mct: Fix error path in timer resources initialization
  clocksource/drivers/sun5i: Fail gracefully when clock rate is unavailable
  NFS: Fix a soft lockup in the delegation recovery code
  powerpc/64s: Fix logic when handling unknown CPU features
  staging: rtlwifi: Use proper enum for return in halmac_parse_psd_data_88xx
  fs/nfs: Fix nfs_parse_devname to not modify it's argument
  ASoC: qcom: Fix of-node refcount unbalance in apq8016_sbc_parse_of()
  drm/nouveau/pmu: don't print reply values if exec is false
  drm/nouveau/bios/ramcfg: fix missing parentheses when calculating RON
  net: dsa: qca8k: Enable delay for RGMII_ID mode
  regulator: pv88090: Fix array out-of-bounds access
  regulator: pv88080: Fix array out-of-bounds access
  regulator: pv88060: Fix array out-of-bounds access
  cdc-wdm: pass return value of recover_from_urb_loss
  dmaengine: mv_xor: Use correct device for DMA API
  staging: r8822be: check kzalloc return or bail
  KVM: PPC: Release all hardware TCE tables attached to a group
  hwmon: (pmbus/tps53679) Fix driver info initialization in probe routine
  vfio_pci: Enable memory accesses before calling pci_map_rom
  keys: Timestamp new keys
  block: don't use bio->bi_vcnt to figure out segment number
  usb: phy: twl6030-usb: fix possible use-after-free on remove
  PCI: endpoint: functions: Use memcpy_fromio()/memcpy_toio()
  pinctrl: sh-pfc: sh73a0: Fix fsic_spdif pin groups
  pinctrl: sh-pfc: r8a7792: Fix vin1_data18_b pin group
  pinctrl: sh-pfc: r8a7791: Fix scifb2_data_c pin group
  pinctrl: sh-pfc: emev2: Add missing pinmux functions
  drm/etnaviv: potential NULL dereference
  iw_cxgb4: use tos when finding ipv6 routes
  iw_cxgb4: use tos when importing the endpoint
  fbdev: chipsfb: remove set but not used variable 'size'
  rtc: pm8xxx: fix unintended sign extension
  rtc: 88pm80x: fix unintended sign extension
  rtc: 88pm860x: fix unintended sign extension
  rtc: ds1307: rx8130: Fix alarm handling
  net: phy: fixed_phy: Fix fixed_phy not checking GPIO
  thermal: mediatek: fix register index error
  rtc: ds1672: fix unintended sign extension
  staging: most: cdev: add missing check for cdev_add failure
  iwlwifi: mvm: fix RSS config command
  ARM: dts: lpc32xx: phy3250: fix SD card regulator voltage
  ARM: dts: lpc32xx: fix ARM PrimeCell LCD controller clocks property
  ARM: dts: lpc32xx: fix ARM PrimeCell LCD controller variant
  ARM: dts: lpc32xx: reparent keypad controller to SIC1
  ARM: dts: lpc32xx: add required clocks property to keypad device node
  driver core: Do not resume suppliers under device_links_write_lock()
  crypto: crypto4xx - Fix wrong ppc4xx_trng_probe()/ppc4xx_trng_remove() arguments
  driver: uio: fix possible use-after-free in __uio_register_device
  driver: uio: fix possible memory leak in __uio_register_device
  tty: ipwireless: Fix potential NULL pointer dereference
  iwlwifi: mvm: fix A-MPDU reference assignment
  net/mlx5: Take lock with IRQs disabled to avoid deadlock
  iwlwifi: mvm: avoid possible access out of array.
  clk: sunxi-ng: sun8i-a23: Enable PLL-MIPI LDOs when ungating it
  spi/topcliff_pch: Fix potential NULL dereference on allocation error
  rtc: cmos: ignore bogus century byte
  IB/iser: Pass the correct number of entries for dma mapped SGL
  ASoC: imx-sgtl5000: put of nodes if finding codec fails
  crypto: tgr192 - fix unaligned memory access
  crypto: brcm - Fix some set-but-not-used warning
  kbuild: mark prepare0 as PHONY to fix external module build
  media: s5p-jpeg: Correct step and max values for V4L2_CID_JPEG_RESTART_INTERVAL
  drm/etnaviv: NULL vs IS_ERR() buf in etnaviv_core_dump()
  RDMA/iw_cxgb4: Fix the unchecked ep dereference
  spi: cadence: Correct initialisation of runtime PM
  arm64: dts: apq8016-sbc: Increase load on l11 for SDCARD
  drm/shmob: Fix return value check in shmob_drm_probe
  RDMA/qedr: Fix out of bounds index check in query pkey
  RDMA/ocrdma: Fix out of bounds index check in query pkey
  IB/usnic: Fix out of bounds index check in query pkey
  MIPS: BCM63XX: drop unused and broken DSP platform device
  clk: dove: fix refcount leak in dove_clk_init()
  clk: mv98dx3236: fix refcount leak in mv98dx3236_clk_init()
  clk: armada-xp: fix refcount leak in axp_clk_init()
  clk: kirkwood: fix refcount leak in kirkwood_clk_init()
  clk: armada-370: fix refcount leak in a370_clk_init()
  clk: vf610: fix refcount leak in vf610_clocks_init()
  clk: imx7d: fix refcount leak in imx7d_clocks_init()
  clk: imx6sx: fix refcount leak in imx6sx_clocks_init()
  clk: imx6q: fix refcount leak in imx6q_clocks_init()
  clk: samsung: exynos4: fix refcount leak in exynos4_get_xom()
  clk: socfpga: fix refcount leak
  clk: qoriq: fix refcount leak in clockgen_init()
  clk: highbank: fix refcount leak in hb_clk_init()
  Input: nomadik-ske-keypad - fix a loop timeout test
  vxlan: changelink: Fix handling of default remotes
  pinctrl: sh-pfc: sh7734: Remove bogus IPSR10 value
  pinctrl: sh-pfc: sh7269: Add missing PCIOR0 field
  pinctrl: sh-pfc: r8a77995: Remove bogus SEL_PWM[0-3]_3 configurations
  pinctrl: sh-pfc: sh7734: Add missing IPSR11 field
  pinctrl: sh-pfc: r8a7794: Remove bogus IPSR9 field
  pinctrl: sh-pfc: sh73a0: Add missing TO pin to tpu4_to3 group
  pinctrl: sh-pfc: r8a7791: Remove bogus marks from vin1_b_data18 group
  pinctrl: sh-pfc: r8a7791: Remove bogus ctrl marks from qspi_data4_b group
  pinctrl: sh-pfc: r8a7740: Add missing LCD0 marks to lcd0_data24_1 group
  pinctrl: sh-pfc: r8a7740: Add missing REF125CK pin to gether_gmii group
  switchtec: Remove immediate status check after submitting MRPC command
  staging: bcm2835-camera: Abort probe if there is no camera
  IB/rxe: Fix incorrect cache cleanup in error flow
  net: phy: Fix not to call phy_resume() if PHY is not attached
  drm/dp_mst: Skip validating ports during destruction, just ref
  exportfs: fix 'passing zero to ERR_PTR()' warning
  pcrypt: use format specifier in kobject_add
  NTB: ntb_hw_idt: replace IS_ERR_OR_NULL with regular NULL checks
  mlxsw: reg: QEEC: Add minimum shaper fields
  drm/sun4i: hdmi: Fix double flag assignation
  pwm: lpss: Release runtime-pm reference from the driver's remove callback
  staging: comedi: ni_mio_common: protect register write overflow
  ALSA: usb-audio: update quirk for B&W PX to remove microphone
  IB/hfi1: Add mtu check for operational data VLs
  IB/rxe: replace kvfree with vfree
  drm/hisilicon: hibmc: Don't overwrite fb helper surface depth
  PCI: iproc: Remove PAXC slot check to allow VF support
  apparmor: don't try to replace stale label in ptrace access check
  ALSA: hda: fix unused variable warning
  drm/virtio: fix bounds check in virtio_gpu_cmd_get_capset()
  drm/sti: do not remove the drm_bridge that was never added
  crypto: sun4i-ss - fix big endian issues
  mt7601u: fix bbp version check in mt7601u_wait_bbp_ready
  tipc: fix wrong timeout input for tipc_wait_for_cond()
  powerpc/archrandom: fix arch_get_random_seed_int()
  mfd: intel-lpss: Add default I2C device properties for Gemini Lake
  xfs: Sanity check flags of Q_XQUOTARM call
  FROMGIT: ext4: Add EXT4_IOC_FSGETXATTR/EXT4_IOC_FSSETXATTR to compat_ioctl.
  ANDROID: cuttlefish_defconfig: enable CONFIG_IKHEADERS as m
  ANDROID: cuttlefish_defconfig: enable NVDIMM/PMEM options
  UPSTREAM: virtio-pmem: Add virtio pmem driver
  BACKPORT: libnvdimm: nd_region flush callback support
  UPSTREAM: libnvdimm/of_pmem: Provide a unique name for bus provider
  UPSTREAM: libnvdimm/of_pmem: Fix platform_no_drv_owner.cocci warnings
  UPSTREAM: libnvdimm, of_pmem: use dev_to_node() instead of of_node_to_nid()
  UPSTREAM: libnvdimm: Add device-tree based driver
  UPSTREAM: libnvdimm: Add of_node to region and bus descriptors
  FROMLIST: security: selinux: allow per-file labelling for binderfs
  UPSTREAM: mm/page_io.c: annotate refault stalls from swap_readpage
  Revert "ANDROID: security,perf: Allow further restriction of perf_event_open"
  ANDROID: selinux: modify RTM_GETLINK permission
  UPSTREAM: lib/test_meminit.c: add bulk alloc/free tests
  UPSTREAM: lib/test_meminit: add a kmem_cache_alloc_bulk() test
  UPSTREAM: mm: slub: really fix slab walking for init_on_free
  UPSTREAM: mm/slub.c: init_on_free=1 should wipe freelist ptr for bulk allocations

 Conflicts:
	drivers/mmc/core/quirks.h
	include/uapi/linux/virtio_ids.h

 New header file entries are added to .bp files.

Change-Id: I515cb78684f524e239850625b163ba023b517e10
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
 2020-06-30 21:32:05 +05:30
Michael Braun
c6745328de netfilter: nft_reject_bridge: enable reject with bridge vlan 
commit e9c284ec4b41c827f4369973d2792992849e4fa5 upstream.

Currently, using the bridge reject target with tagged packets
results in untagged packets being sent back.

Fix this by mirroring the vlan id as well.

Fixes: 85f5b3086a04 ("netfilter: bridge: add reject support")
Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2020-06-03 08:18:08 +02:00
qctecmdr
d97a391800 Merge "Merge android-4.14.162 (c2bd4f8) into msm-4.14" 2020-04-27 07:31:58 -07:00
qctecmdr
62baf6ce22 Merge "net: bridge: Add changes to send icmp error" 2020-04-26 18:13:22 -07:00
Chaitanya Pratapa
71ff05e1dc net: bridge: Add changes to send icmp error 
When packet length to be forwarded is greater than MTU
instead of silently discarding the packet, make sure to send
ICMP error with frag needed so that client can adjust the
packet length for subsequent packets.

Change-Id: Ia86d7a2ad7fa7f235dd18742b33fd457173c4d28
Signed-off-by: Chaitanya Pratapa <cpratapa@codeaurora.org>
 2020-04-22 10:24:28 -07:00
Srinivasarao P
89c9d6d8aa Merge android-4.14.162 (c2bd4f8) into msm-4.14 
* refs/heads/tmp-c2bd4f8:
  Linux 4.14.162
  spi: fsl: use platform_get_irq() instead of of_irq_to_resource()
  gtp: avoid zero size hashtable
  gtp: fix an use-after-free in ipv4_pdp_find()
  gtp: fix wrong condition in gtp_genl_dump_pdp()
  tcp: do not send empty skb from tcp_write_xmit()
  tcp/dccp: fix possible race __inet_lookup_established()
  gtp: do not allow adding duplicate tid and ms_addr pdp context
  sit: do not confirm neighbor when do pmtu update
  vti: do not confirm neighbor when do pmtu update
  tunnel: do not confirm neighbor when do pmtu update
  net/dst: add new function skb_dst_update_pmtu_no_confirm
  gtp: do not confirm neighbor when do pmtu update
  ip6_gre: do not confirm neighbor when do pmtu update
  net: add bool confirm_neigh parameter for dst_ops.update_pmtu
  vhost/vsock: accept only packets with the right dst_cid
  udp: fix integer overflow while computing available space in sk_rcvbuf
  ptp: fix the race between the release of ptp_clock and cdev
  net/mlxfw: Fix out-of-memory error in mfa2 flash burning
  net: ena: fix napi handler misbehavior when the napi budget is zero
  pinctrl: baytrail: Really serialize all register accesses
  tty/serial: atmel: fix out of range clock divider handling
  spi: fsl: don't map irq during probe
  hrtimer: Annotate lockless access to timer->state
  net: icmp: fix data-race in cmp_global_allow()
  net: add a READ_ONCE() in skb_peek_tail()
  inetpeer: fix data-race in inet_putpeer / inet_putpeer
  netfilter: bridge: make sure to pull arp header in br_nf_forward_arp()
  6pack,mkiss: fix possible deadlock
  netfilter: ebtables: compat: reject all padding in matches/watchers
  filldir[64]: remove WARN_ON_ONCE() for bad directory entries
  Make filldir[64]() verify the directory entry filename is valid
  perf strbuf: Remove redundant va_end() in strbuf_addv()
  bonding: fix active-backup transition after link failure
  ALSA: hda - Downgrade error message for single-cmd fallback
  netfilter: nf_queue: enqueue skbs with NULL dst
  net, sysctl: Fix compiler warning when only cBPF is present
  x86/mce: Fix possibly incorrect severity calculation on AMD
  userfaultfd: require CAP_SYS_PTRACE for UFFD_FEATURE_EVENT_FORK
  kernel: sysctl: make drop_caches write-only
  ocfs2: fix passing zero to 'PTR_ERR' warning
  s390/cpum_sf: Check for SDBT and SDB consistency
  libfdt: define INT32_MAX and UINT32_MAX in libfdt_env.h
  s390/zcrypt: handle new reply code FILTERED_BY_HYPERVISOR
  perf regs: Make perf_reg_name() return "unknown" instead of NULL
  perf script: Fix brstackinsn for AUXTRACE
  cdrom: respect device capabilities during opening action
  scripts/kallsyms: fix definitely-lost memory leak
  apparmor: fix unsigned len comparison with less than zero
  gpio: mpc8xxx: Don't overwrite default irq_set_type callback
  scsi: target: iscsi: Wait for all commands to finish before freeing a session
  scsi: iscsi: Don't send data to unbound connection
  scsi: NCR5380: Add disconnect_mask module parameter
  scsi: scsi_debug: num_tgts must be >= 0
  scsi: ufs: Fix error handing during hibern8 enter
  scsi: pm80xx: Fix for SATA device discovery
  HID: Improve Windows Precision Touchpad detection.
  libnvdimm/btt: fix variable 'rc' set but not used
  HID: logitech-hidpp: Silence intermittent get_battery_capacity errors
  bcache: at least try to shrink 1 node in bch_mca_scan()
  clk: pxa: fix one of the pxa RTC clocks
  scsi: atari_scsi: sun3_scsi: Set sg_tablesize to 1 instead of SG_NONE
  powerpc/security: Fix wrong message when RFI Flush is disable
  powerpc/pseries/cmm: Implement release() function for sysfs device
  scsi: ufs: fix potential bug which ends in system hang
  scsi: lpfc: fix: Coverity: lpfc_cmpl_els_rsp(): Null pointer dereferences
  fs/quota: handle overflows of sysctl fs.quota.* and report as unsigned long
  irqchip: ingenic: Error out if IRQ domain creation failed
  irqchip/irq-bcm7038-l1: Enable parent IRQ if necessary
  clk: qcom: Allow constant ratio freq tables for rcg
  f2fs: fix to update dir's i_pino during cross_rename
  scsi: lpfc: Fix duplicate unreg_rpi error in port offline flow
  scsi: tracing: Fix handling of TRANSFER LENGTH == 0 for READ(6) and WRITE(6)
  jbd2: Fix statistics for the number of logged blocks
  ext4: update direct I/O read lock pattern for IOCB_NOWAIT
  powerpc/book3s64/hash: Add cond_resched to avoid soft lockup warning
  powerpc/security/book3s64: Report L1TF status in sysfs
  clocksource/drivers/asm9260: Add a check for of_clk_get
  dma-debug: add a schedule point in debug_dma_dump_mappings()
  powerpc/tools: Don't quote $objdump in scripts
  powerpc/pseries: Don't fail hash page table insert for bolted mapping
  powerpc/pseries: Mark accumulate_stolen_time() as notrace
  scsi: csiostor: Don't enable IRQs too early
  scsi: lpfc: Fix SLI3 hba in loop mode not discovering devices
  scsi: target: compare full CHAP_A Algorithm strings
  iommu/tegra-smmu: Fix page tables in > 4 GiB memory
  Input: atmel_mxt_ts - disable IRQ across suspend
  scsi: lpfc: Fix locking on mailbox command completion
  scsi: mpt3sas: Fix clear pending bit in ioctl status
  scsi: lpfc: Fix discovery failures when target device connectivity bounces
  ANDROID: serdev: Fix platform device support

Conflicts:
	drivers/scsi/ufs/ufshcd.c
	kernel/time/hrtimer.c

Discarded commit 'kernel: sysctl: make drop_caches write-only'
due to vts regression.

Change-Id: Ieabdc1178e170d30672e233f43139bb97af9bf80
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
 2020-04-18 17:49:12 +05:30
Srinivasarao P
c84760496e Merge android-4.14.160 (0f543a0) into msm-4.14 
* refs/heads/tmp-0f543a0:
  Linux 4.14.160
  net: stmmac: don't stop NAPI processing when dropping a packet
  net: stmmac: use correct DMA buffer size in the RX descriptor
  xhci: fix USB3 device initiated resume race with roothub autosuspend
  drm/radeon: fix r1xx/r2xx register checker for POT textures
  scsi: iscsi: Fix a potential deadlock in the timeout handler
  dm btree: increase rebalance threshold in __rebalance2()
  dma-buf: Fix memory leak in sync_file_merge()
  vfio/pci: call irq_bypass_unregister_producer() before freeing irq
  ARM: tegra: Fix FLOW_CTLR_HALT register clobbering by tegra_resume()
  ARM: dts: s3c64xx: Fix init order of clock providers
  CIFS: Respect O_SYNC and O_DIRECT flags during reconnect
  rpmsg: glink: Free pending deferred work on remove
  rpmsg: glink: Don't send pending rx_done during remove
  rpmsg: glink: Fix rpmsg_register_device err handling
  rpmsg: glink: Put an extra reference during cleanup
  rpmsg: glink: Fix use after free in open_ack TIMEOUT case
  rpmsg: glink: Fix reuse intents memory leak issue
  rpmsg: glink: Set tail pointer to 0 at end of FIFO
  xtensa: fix TLB sanity checker
  PCI: Apply Cavium ACS quirk to ThunderX2 and ThunderX3
  PCI/MSI: Fix incorrect MSI-X masking on resume
  PCI: Fix Intel ACS quirk UPDCR register address
  PCI/PM: Always return devices to D0 when thawing
  Revert "regulator: Defer init completion for a while after late_initcall"
  nvme: host: core: fix precedence of ternary operator
  inet: protect against too small mtu values.
  tcp: Protect accesses to .ts_recent_stamp with {READ,WRITE}_ONCE()
  tcp: tighten acceptance of ACKs not matching a child socket
  tcp: fix rejected syncookies due to stale timestamps
  tipc: fix ordering of tipc module init and exit routine
  tcp: md5: fix potential overestimation of TCP option space
  openvswitch: support asymmetric conntrack
  net: thunderx: start phy before starting autonegotiation
  net: ethernet: ti: cpsw: fix extra rx interrupt
  net: dsa: fix flow dissection on Tx path
  net: bridge: deny dev_set_mac_address() when unregistering
  ANDROID: cuttlefish_defconfig: Enable CONFIG_GNSS_CMDLINE_SERIAL
  ANDROID: gnss: Add command line test driver
  ANDROID: serdev: add platform device support
  ANDROID: cuttlefish_defconfig: set BINFMT_MISC
  UPSTREAM: binder: fix incorrect calculation for num_valid
  ANDROID: kbuild: disable clang-specific configs with other compilers

Conflicts:
	drivers/rpmsg/qcom_glink_native.c
	drivers/rpmsg/qcom_glink_smem.c
	net/ipv4/ip_output.c

Change-Id: I5a153d5632311789c3d2a24522a8fa3696b06850
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
 2020-04-17 17:59:15 +05:30
Srinivasarao P
f3f0576c22 Merge android-4.14.158 (84afceb) into msm-4.14 
* refs/heads/tmp-84afceb:
  Linux 4.14.158
  net: fec: fix clock count mis-match
  platform/x86: hp-wmi: Fix ACPI errors caused by passing 0 as input size
  platform/x86: hp-wmi: Fix ACPI errors caused by too small buffer
  ASoC: stm32: i2s: fix IRQ clearing
  ASoC: stm32: i2s: fix 16 bit format support
  ASoC: stm32: i2s: fix dma configuration
  pinctrl: stm32: fix memory leak issue
  mailbox: mailbox-test: fix null pointer if no mmio
  hwrng: stm32 - fix unbalanced pm_runtime_enable
  media: stm32-dcmi: fix DMA corruption when stopping streaming
  crypto: stm32/hash - Fix hmac issue more than 256 bytes
  HID: core: check whether Usage Page item is after Usage ID items
  futex: Prevent exit livelock
  futex: Provide distinct return value when owner is exiting
  futex: Add mutex around futex exit
  futex: Provide state handling for exec() as well
  futex: Sanitize exit state handling
  futex: Mark the begin of futex exit explicitly
  futex: Set task::futex_state to DEAD right after handling futex exit
  futex: Split futex_mm_release() for exit/exec
  exit/exec: Seperate mm_release()
  futex: Replace PF_EXITPIDONE with a state
  futex: Move futex exit handling into futex code
  futex: Prevent robust futex exit race
  y2038: futex: Move compat implementation into futex.c
  mtd: spi-nor: cast to u64 to avoid uint overflows
  mtd: rawnand: atmel: fix possible object reference leak
  mtd: rawnand: atmel: Fix spelling mistake in error message
  net: macb driver, check for SKBTX_HW_TSTAMP
  net: macb: Fix SUBNS increment and increase resolution
  watchdog: sama5d4: fix WDD value to be always set to max
  ext4: add more paranoia checking in ext4_expand_extra_isize handling
  net: sched: fix `tc -s class show` no bstats on class with nolock subqueues
  sctp: cache netns in sctp_ep_common
  tipc: fix link name length check
  openvswitch: remove another BUG_ON()
  openvswitch: drop unneeded BUG_ON() in ovs_flow_cmd_build_info()
  slip: Fix use-after-free Read in slip_open
  openvswitch: fix flow command message size
  net: psample: fix skb_over_panic
  macvlan: schedule bc_work even if error
  media: atmel: atmel-isc: fix INIT_WORK misplacement
  media: atmel: atmel-isc: fix asd memory allocation
  pwm: Clear chip_data in pwm_put()
  net: macb: fix error format in dev_err()
  media: v4l2-ctrl: fix flags for DO_WHITE_BALANCE
  xfrm: Fix memleak on xfrm state destroy
  mei: bus: prefix device names on bus with the bus name
  USB: serial: ftdi_sio: add device IDs for U-Blox C099-F9P
  staging: rtl8723bs: Add 024c:0525 to the list of SDIO device-ids
  staging: rtl8723bs: Drop ACPI device ids
  staging: rtl8192e: fix potential use after free
  clk: at91: generated: set audio_pll_allowed in at91_clk_register_generated()
  clk: at91: fix update bit maps on CFG_MOR write
  mm, gup: add missing refcount overflow checks on s390
  mtd: Remove a debug trace in mtdpart.c
  powerpc/pseries/dlpar: Fix a missing check in dlpar_parse_cc_property()
  scsi: libsas: Check SMP PHY control function result
  ACPI / APEI: Switch estatus pool to use vmalloc memory
  ACPI / APEI: Don't wait to serialise with oops messages when panic()ing
  scsi: libsas: Support SATA PHY connection rate unmatch fixing during discovery
  apparmor: delete the dentry in aafs_remove() to avoid a leak
  iommu/amd: Fix NULL dereference bug in match_hid_uid
  net: hns3: Change fw error code NOT_EXEC to NOT_SUPPORTED
  bpf: drop refcount if bpf_map_new_fd() fails in map_create()
  kvm: properly check debugfs dentry before using it
  net: dev: Use unsigned integer as an argument to left-shift
  bpf: decrease usercnt if bpf_map_new_fd() fails in bpf_map_get_fd_by_id()
  sctp: don't compare hb_timer expire date before starting it
  net: fix possible overflow in __sk_mem_raise_allocated()
  sfc: initialise found bitmap in efx_ef10_mtd_probe
  tipc: fix skb may be leaky in tipc_link_input
  blktrace: Show requests without sector
  net/smc: prevent races between smc_lgr_terminate() and smc_conn_free()
  decnet: fix DN_IFREQ_SIZE
  ip_tunnel: Make none-tunnel-dst tunnel port work with lwtunnel
  sfc: suppress duplicate nvmem partition types in efx_ef10_mtd_probe
  gpu: ipu-v3: pre: don't trigger update if buffer address doesn't change
  serial: 8250: Fix serial8250 initialization crash
  net/core/neighbour: fix kmemleak minimal reference count for hash tables
  PCI/MSI: Return -ENOSPC from pci_alloc_irq_vectors_affinity()
  net/core/neighbour: tell kmemleak about hash tables
  tipc: fix memory leak in tipc_nl_compat_publ_dump
  mtd: Check add_mtd_device() ret code
  lib/genalloc.c: include vmalloc.h
  drivers/base/platform.c: kmemleak ignore a known leak
  fork: fix some -Wmissing-prototypes warnings
  lib/genalloc.c: use vzalloc_node() to allocate the bitmap
  lib/genalloc.c: fix allocation of aligned buffer from non-aligned chunk
  vmscan: return NODE_RECLAIM_NOSCAN in node_reclaim() when CONFIG_NUMA is n
  ocfs2: clear journal dirty flag after shutdown journal
  net/wan/fsl_ucc_hdlc: Avoid double free in ucc_hdlc_probe()
  tipc: fix a missing check of genlmsg_put
  atl1e: checking the status of atl1e_write_phy_reg
  net: dsa: bcm_sf2: Propagate error value from mdio_write
  net: stmicro: fix a missing check of clk_prepare
  net: (cpts) fix a missing check of clk_prepare
  um: Make GCOV depend on !KCOV
  f2fs: fix to dirty inode synchronously
  net/net_namespace: Check the return value of register_pernet_subsys()
  net/netlink_compat: Fix a missing check of nla_parse_nested
  pwm: clps711x: Fix period calculation
  crypto: mxc-scc - fix build warnings on ARM64
  powerpc/pseries: Fix node leak in update_lmb_associativity_index()
  powerpc/83xx: handle machine check caused by watchdog timer
  regulator: tps65910: fix a missing check of return value
  IB/rxe: Make counters thread safe
  drbd: fix print_st_err()'s prototype to match the definition
  drbd: do not block when adjusting "disk-options" while IO is frozen
  drbd: reject attach of unsuitable uuids even if connected
  drbd: ignore "all zero" peer volume sizes in handshake
  powerpc/powernv/eeh/npu: Fix uninitialized variables in opal_pci_eeh_freeze_status
  vfio/spapr_tce: Get rid of possible infinite loop
  powerpc/44x/bamboo: Fix PCI range
  powerpc/mm: Make NULL pointer deferences explicit on bad page faults.
  powerpc/prom: fix early DEBUG messages
  powerpc/perf: Fix unit_sel/cache_sel checks
  ath6kl: Fix off by one error in scan completion
  ath6kl: Only use match sets when firmware supports it
  scsi: csiostor: fix incorrect dma device in case of vport
  scsi: qla2xxx: deadlock by configfs_depend_item
  RDMA/srp: Propagate ib_post_send() failures to the SCSI mid-layer
  openrisc: Fix broken paths to arch/or32
  serial: max310x: Fix tx_empty() callback
  Bluetooth: hci_bcm: Handle specific unknown packets after firmware loading
  drivers/regulator: fix a missing check of return value
  powerpc/xmon: fix dump_segments()
  powerpc/book3s/32: fix number of bats in p/v_block_mapped()
  vxlan: Fix error path in __vxlan_dev_create()
  clocksource/drivers/fttmr010: Fix invalid interrupt register access
  IB/qib: Fix an error code in qib_sdma_verbs_send()
  xfs: Fix bulkstat compat ioctls on x32 userspace.
  xfs: Align compat attrlist_by_handle with native implementation.
  gfs2: take jdata unstuff into account in do_grow
  dm flakey: Properly corrupt multi-page bios.
  HID: doc: fix wrong data structure reference for UHID_OUTPUT
  pinctrl: sh-pfc: sh7734: Fix shifted values in IPSR10
  pinctrl: sh-pfc: sh7264: Fix PFCR3 and PFCR0 register configuration
  KVM: s390: unregister debug feature on failing arch init
  bnxt_en: query force speeds before disabling autoneg mode.
  bnxt_en: Return linux standard errors in bnxt_ethtool.c
  exofs_mount(): fix leaks on failure exits
  net/mlx5: Continue driver initialization despite debugfs failure
  pinctrl: xway: fix gpio-hog related boot issues
  vfio-mdev/samples: Use u8 instead of char for handle functions
  xen/pciback: Check dev_data before using it
  kprobes/x86/xen: blacklist non-attachable xen interrupt functions
  serial: 8250: Rate limit serial port rx interrupts during input overruns
  HID: intel-ish-hid: fixes incorrect error handling
  btrfs: only track ref_heads in delayed_ref_updates
  mtd: rawnand: sunxi: Write pageprog related opcodes to WCMD_SET
  mmc: meson-gx: make sure the descriptor is stopped on errors
  VSOCK: bind to random port for VMADDR_PORT_ANY
  kvm: vmx: Set IA32_TSC_AUX for legacy mode guests
  gpiolib: Fix return value of gpio_to_desc() stub if !GPIOLIB
  iwlwifi: move iwl_nvm_check_version() into dvm
  microblaze: move "... is ready" messages to arch/microblaze/Makefile
  microblaze: adjust the help to the real behavior
  ubi: Do not drop UBI device reference before using
  ubi: Put MTD device after it is not used
  xfs: require both realtime inodes to mount
  rtl818x: fix potential use after free
  mwifiex: debugfs: correct histogram spacing, formatting
  mwifiex: fix potential NULL dereference and use after free
  crypto: user - support incremental algorithm dumps
  scsi: lpfc: Enable Management features for IF_TYPE=6
  ACPI / LPSS: Ignore acpi_device_fix_up_power() return value
  ARM: ks8695: fix section mismatch warning
  PM / AVS: SmartReflex: NULL check before some freeing functions is not needed
  RDMA/vmw_pvrdma: Use atomic memory allocation in create AH
  ARM: OMAP1: fix USB configuration for device-only setups
  arm64: smp: Handle errors reported by the firmware
  arm64: mm: Prevent mismatched 52-bit VA support
  parisc: Fix HP SDC hpa address output
  parisc: Fix serio address output
  ARM: dts: imx53-voipac-dmm-668: Fix memory node duplication
  ARM: debug-imx: only define DEBUG_IMX_UART_PORT if needed
  ARM: dts: Fix up SQ201 flash access
  scsi: lpfc: Fix dif and first burst use in write commands
  scsi: lpfc: Fix kernel Oops due to null pring pointers
  pwm: bcm-iproc: Prevent unloading the driver module while in use
  block: drbd: remove a stray unlock in __drbd_send_protocol()
  mac80211: fix station inactive_time shortly after boot
  ceph: return -EINVAL if given fsc mount option on kernel w/o support
  net: bcmgenet: reapply manual settings to the PHY
  scripts/gdb: fix debugging modules compiled with hot/cold partitioning
  watchdog: meson: Fix the wrong value of left time
  can: rx-offload: can_rx_offload_irq_offload_fifo(): continue on error
  can: rx-offload: can_rx_offload_irq_offload_timestamp(): continue on error
  can: rx-offload: can_rx_offload_offload_one(): use ERR_PTR() to propagate error value in case of errors
  can: rx-offload: can_rx_offload_offload_one(): increment rx_fifo_errors on queue overflow or OOM
  can: rx-offload: can_rx_offload_offload_one(): do not increase the skb_queue beyond skb_queue_len_max
  can: rx-offload: can_rx_offload_queue_tail(): fix error handling, avoid skb mem leak
  can: c_can: D_CAN: c_can_chip_config(): perform a sofware reset on open
  can: peak_usb: report bus recovery as well
  bridge: ebtables: don't crash when using dnat target in output chains
  net: fec: add missed clk_disable_unprepare in remove
  clk: ti: dra7-atl-clock: Remove ti_clk_add_alias call
  x86/resctrl: Prevent NULL pointer dereference when reading mondata
  idr: Fix idr_alloc_u32 on 32-bit systems
  clk: sunxi-ng: a80: fix the zero'ing of bits 16 and 18
  clk: at91: avoid sleeping early
  reset: fix reset_control_ops kerneldoc comment
  clk: samsung: exynos5420: Preserve PLL configuration during suspend/resume
  ASoC: kirkwood: fix external clock probe defer
  reset: Fix memory leak in reset_control_array_put()
  ASoC: compress: fix unsigned integer overflow check
  ASoC: msm8916-wcd-analog: Fix RX1 selection in RDAC2 MUX
  clk: meson: gxbb: let sar_adc_clk_div set the parent clock rate
  Revert "KVM: nVMX: reset cache/shadows when switching loaded VMCS"
  UPSTREAM: dt-bindings: arm: coresight: Add support for coresight-loses-context-with-cpu
  BACKPORT: coresight: etm4x: Save/restore state across CPU low power states
  BACKPORT: ARM: 8900/1: UNWINDER_FRAME_POINTER implementation for Clang

Conflicts:
	Documentation/devicetree/bindings/arm/coresight.txt
	arch/arm/Makefile
	drivers/hid/hid-core.c
	kernel/exit.c

Reverted the downstream patch "HID: core: add usage_page_preceding flag for hid_concatenate_usage_page()"
as original issue got fixed with upstream changes.

Change-Id: I3b833825b3d1104fa07378caef144639074d0a0d
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
 2020-04-16 16:59:09 +05:30
Florian Westphal
eba68981c6 netfilter: ebtables: CONFIG_COMPAT: reject trailing data after last rule 
[ Upstream commit 680f6af5337c98d116e4f127cea7845339dba8da ]

If userspace provides a rule blob with trailing data after last target,
we trigger a splat, then convert ruleset to 64bit format (with trailing
data), then pass that to do_replace_finish() which then returns -EINVAL.

Erroring out right away avoids the splat plus unneeded translation and
error unwind.

Fixes: 81e675c227ec ("netfilter: ebtables: add CONFIG_COMPAT support")
Reported-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2020-01-27 14:46:34 +01:00
Hangbin Liu
7ae78f9bbb net: add bool confirm_neigh parameter for dst_ops.update_pmtu 
[ Upstream commit bd085ef678b2cc8c38c105673dfe8ff8f5ec0c57 ]

The MTU update code is supposed to be invoked in response to real
networking events that update the PMTU. In IPv6 PMTU update function
__ip6_rt_update_pmtu() we called dst_confirm_neigh() to update neighbor
confirmed time.

But for tunnel code, it will call pmtu before xmit, like:
  - tnl_update_pmtu()
    - skb_dst_update_pmtu()
      - ip6_rt_update_pmtu()
        - __ip6_rt_update_pmtu()
          - dst_confirm_neigh()

If the tunnel remote dst mac address changed and we still do the neigh
confirm, we will not be able to update neigh cache and ping6 remote
will failed.

So for this ip_tunnel_xmit() case, _EVEN_ if the MTU is changed, we
should not be invoking dst_confirm_neigh() as we have no evidence
of successful two-way communication at this point.

On the other hand it is also important to keep the neigh reachability fresh
for TCP flows, so we cannot remove this dst_confirm_neigh() call.

To fix the issue, we have to add a new bool parameter for dst_ops.update_pmtu
to choose whether we should do neigh update or not. I will add the parameter
in this patch and set all the callers to true to comply with the previous
way, and fix the tunnel code one by one on later patches.

v5: No change.
v4: No change.
v3: Do not remove dst_confirm_neigh, but add a new bool parameter in
    dst_ops.update_pmtu to control whether we should do neighbor confirm.
    Also split the big patch to small ones for each area.
v2: Remove dst_confirm_neigh in __ip6_rt_update_pmtu.

Suggested-by: David Miller <davem@davemloft.net>
Reviewed-by: Guillaume Nault <gnault@redhat.com>
Acked-by: David Ahern <dsahern@gmail.com>
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2020-01-04 14:00:14 +01:00
Eric Dumazet
ff194a9099 netfilter: bridge: make sure to pull arp header in br_nf_forward_arp() 
commit 5604285839aaedfb23ebe297799c6e558939334d upstream.

syzbot is kind enough to remind us we need to call skb_may_pull()

BUG: KMSAN: uninit-value in br_nf_forward_arp+0xe61/0x1230 net/bridge/br_netfilter_hooks.c:665
CPU: 1 PID: 11631 Comm: syz-executor.1 Not tainted 5.4.0-rc8-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1c9/0x220 lib/dump_stack.c:118
 kmsan_report+0x128/0x220 mm/kmsan/kmsan_report.c:108
 __msan_warning+0x64/0xc0 mm/kmsan/kmsan_instr.c:245
 br_nf_forward_arp+0xe61/0x1230 net/bridge/br_netfilter_hooks.c:665
 nf_hook_entry_hookfn include/linux/netfilter.h:135 [inline]
 nf_hook_slow+0x18b/0x3f0 net/netfilter/core.c:512
 nf_hook include/linux/netfilter.h:260 [inline]
 NF_HOOK include/linux/netfilter.h:303 [inline]
 __br_forward+0x78f/0xe30 net/bridge/br_forward.c:109
 br_flood+0xef0/0xfe0 net/bridge/br_forward.c:234
 br_handle_frame_finish+0x1a77/0x1c20 net/bridge/br_input.c:162
 nf_hook_bridge_pre net/bridge/br_input.c:245 [inline]
 br_handle_frame+0xfb6/0x1eb0 net/bridge/br_input.c:348
 __netif_receive_skb_core+0x20b9/0x51a0 net/core/dev.c:4830
 __netif_receive_skb_one_core net/core/dev.c:4927 [inline]
 __netif_receive_skb net/core/dev.c:5043 [inline]
 process_backlog+0x610/0x13c0 net/core/dev.c:5874
 napi_poll net/core/dev.c:6311 [inline]
 net_rx_action+0x7a6/0x1aa0 net/core/dev.c:6379
 __do_softirq+0x4a1/0x83a kernel/softirq.c:293
 do_softirq_own_stack+0x49/0x80 arch/x86/entry/entry_64.S:1091
 </IRQ>
 do_softirq kernel/softirq.c:338 [inline]
 __local_bh_enable_ip+0x184/0x1d0 kernel/softirq.c:190
 local_bh_enable+0x36/0x40 include/linux/bottom_half.h:32
 rcu_read_unlock_bh include/linux/rcupdate.h:688 [inline]
 __dev_queue_xmit+0x38e8/0x4200 net/core/dev.c:3819
 dev_queue_xmit+0x4b/0x60 net/core/dev.c:3825
 packet_snd net/packet/af_packet.c:2959 [inline]
 packet_sendmsg+0x8234/0x9100 net/packet/af_packet.c:2984
 sock_sendmsg_nosec net/socket.c:637 [inline]
 sock_sendmsg net/socket.c:657 [inline]
 __sys_sendto+0xc44/0xc70 net/socket.c:1952
 __do_sys_sendto net/socket.c:1964 [inline]
 __se_sys_sendto+0x107/0x130 net/socket.c:1960
 __x64_sys_sendto+0x6e/0x90 net/socket.c:1960
 do_syscall_64+0xb6/0x160 arch/x86/entry/common.c:291
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45a679
Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f0a3c9e5c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 000000000045a679
RDX: 000000000000000e RSI: 0000000020000200 RDI: 0000000000000003
RBP: 000000000075bf20 R08: 00000000200000c0 R09: 0000000000000014
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f0a3c9e66d4
R13: 00000000004c8ec1 R14: 00000000004dfe28 R15: 00000000ffffffff

Uninit was created at:
 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:149 [inline]
 kmsan_internal_poison_shadow+0x5c/0x110 mm/kmsan/kmsan.c:132
 kmsan_slab_alloc+0x97/0x100 mm/kmsan/kmsan_hooks.c:86
 slab_alloc_node mm/slub.c:2773 [inline]
 __kmalloc_node_track_caller+0xe27/0x11a0 mm/slub.c:4381
 __kmalloc_reserve net/core/skbuff.c:141 [inline]
 __alloc_skb+0x306/0xa10 net/core/skbuff.c:209
 alloc_skb include/linux/skbuff.h:1049 [inline]
 alloc_skb_with_frags+0x18c/0xa80 net/core/skbuff.c:5662
 sock_alloc_send_pskb+0xafd/0x10a0 net/core/sock.c:2244
 packet_alloc_skb net/packet/af_packet.c:2807 [inline]
 packet_snd net/packet/af_packet.c:2902 [inline]
 packet_sendmsg+0x63a6/0x9100 net/packet/af_packet.c:2984
 sock_sendmsg_nosec net/socket.c:637 [inline]
 sock_sendmsg net/socket.c:657 [inline]
 __sys_sendto+0xc44/0xc70 net/socket.c:1952
 __do_sys_sendto net/socket.c:1964 [inline]
 __se_sys_sendto+0x107/0x130 net/socket.c:1960
 __x64_sys_sendto+0x6e/0x90 net/socket.c:1960
 do_syscall_64+0xb6/0x160 arch/x86/entry/common.c:291
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fixes: c4e70a87d975 ("netfilter: bridge: rename br_netfilter.c to br_netfilter_hooks.c")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2020-01-04 14:00:06 +01:00
Florian Westphal
69bb991336 netfilter: ebtables: compat: reject all padding in matches/watchers 
commit e608f631f0ba5f1fc5ee2e260a3a35d13107cbfe upstream.

syzbot reported following splat:

BUG: KASAN: vmalloc-out-of-bounds in size_entry_mwt net/bridge/netfilter/ebtables.c:2063 [inline]
BUG: KASAN: vmalloc-out-of-bounds in compat_copy_entries+0x128b/0x1380 net/bridge/netfilter/ebtables.c:2155
Read of size 4 at addr ffffc900004461f4 by task syz-executor267/7937

CPU: 1 PID: 7937 Comm: syz-executor267 Not tainted 5.5.0-rc1-syzkaller #0
 size_entry_mwt net/bridge/netfilter/ebtables.c:2063 [inline]
 compat_copy_entries+0x128b/0x1380 net/bridge/netfilter/ebtables.c:2155
 compat_do_replace+0x344/0x720 net/bridge/netfilter/ebtables.c:2249
 compat_do_ebt_set_ctl+0x22f/0x27e net/bridge/netfilter/ebtables.c:2333
 [..]

Because padding isn't considered during computation of ->buf_user_offset,
"total" is decremented by fewer bytes than it should.

Therefore, the first part of

if (*total < sizeof(*entry) || entry->next_offset < sizeof(*entry))

will pass, -- it should not have.  This causes oob access:
entry->next_offset is past the vmalloced size.

Reject padding and check that computed user offset (sum of ebt_entry
structure plus all individual matches/watchers/targets) is same
value that userspace gave us as the offset of the next entry.

Reported-by: syzbot+f68108fed972453a0ad4@syzkaller.appspotmail.com
Fixes: 81e675c227ec ("netfilter: ebtables: add CONFIG_COMPAT support")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2020-01-04 14:00:04 +01:00
Nikolay Aleksandrov
8edc9ddadb net: bridge: deny dev_set_mac_address() when unregistering 
[ Upstream commit c4b4c421857dc7b1cf0dccbd738472360ff2cd70 ]

We have an interesting memory leak in the bridge when it is being
unregistered and is a slave to a master device which would change the
mac of its slaves on unregister (e.g. bond, team). This is a very
unusual setup but we do end up leaking 1 fdb entry because
dev_set_mac_address() would cause the bridge to insert the new mac address
into its table after all fdbs are flushed, i.e. after dellink() on the
bridge has finished and we call NETDEV_UNREGISTER the bond/team would
release it and will call dev_set_mac_address() to restore its original
address and that in turn will add an fdb in the bridge.
One fix is to check for the bridge dev's reg_state in its
ndo_set_mac_address callback and return an error if the bridge is not in
NETREG_REGISTERED.

Easy steps to reproduce:
 1. add bond in mode != A/B
 2. add any slave to the bond
 3. add bridge dev as a slave to the bond
 4. destroy the bridge device

Trace:
 unreferenced object 0xffff888035c4d080 (size 128):
   comm "ip", pid 4068, jiffies 4296209429 (age 1413.753s)
   hex dump (first 32 bytes):
     41 1d c9 36 80 88 ff ff 00 00 00 00 00 00 00 00  A..6............
     d2 19 c9 5e 3f d7 00 00 00 00 00 00 00 00 00 00  ...^?...........
   backtrace:
     [<00000000ddb525dc>] kmem_cache_alloc+0x155/0x26f
     [<00000000633ff1e0>] fdb_create+0x21/0x486 [bridge]
     [<0000000092b17e9c>] fdb_insert+0x91/0xdc [bridge]
     [<00000000f2a0f0ff>] br_fdb_change_mac_address+0xb3/0x175 [bridge]
     [<000000001de02dbd>] br_stp_change_bridge_id+0xf/0xff [bridge]
     [<00000000ac0e32b1>] br_set_mac_address+0x76/0x99 [bridge]
     [<000000006846a77f>] dev_set_mac_address+0x63/0x9b
     [<00000000d30738fc>] __bond_release_one+0x3f6/0x455 [bonding]
     [<00000000fc7ec01d>] bond_netdev_event+0x2f2/0x400 [bonding]
     [<00000000305d7795>] notifier_call_chain+0x38/0x56
     [<0000000028885d4a>] call_netdevice_notifiers+0x1e/0x23
     [<000000008279477b>] rollback_registered_many+0x353/0x6a4
     [<0000000018ef753a>] unregister_netdevice_many+0x17/0x6f
     [<00000000ba854b7a>] rtnl_delete_link+0x3c/0x43
     [<00000000adf8618d>] rtnl_dellink+0x1dc/0x20a
     [<000000009b6395fd>] rtnetlink_rcv_msg+0x23d/0x268

Fixes: 43598813386f ("bridge: add local MAC address to forwarding table (v2)")
Reported-by: syzbot+2add91c08eb181fea1bf@syzkaller.appspotmail.com
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2019-12-21 10:47:30 +01:00
Florian Westphal
6fc27a2497 bridge: ebtables: don't crash when using dnat target in output chains 
[ Upstream commit b23c0742c2ce7e33ed79d10e451f70fdb5ca85d1 ]

xt_in() returns NULL in the output hook, skip the pkt_type change for
that case, redirection only makes sense in broute/prerouting hooks.

Reported-by: Tom Yan <tom.ty89@gmail.com>
Cc: Linus Lüssing <linus.luessing@c0d3.blue>
Fixes: cf3cb246e277d ("bridge: ebtables: fix reception of frames DNAT-ed to bridge device/port")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2019-12-05 15:36:56 +01:00
Blagovest Kolenichev
3b572c9bfa Merge android-4.14-q.146 (a3d6259) into msm-4.14 
* refs/heads/tmp-a3d6259:
  Linux 4.14.146
  media: technisat-usb2: break out of loop at end of buffer
  tcp: Don't dequeue SYN/FIN-segments from write-queue
  tcp: Reset send_head when removing skb from write-queue
  binfmt_elf: move brk out of mmap when doing direct loader exec
  floppy: fix usercopy direction
  PCI: kirin: Fix section mismatch warning
  iommu/amd: Fix race in increase_address_space()
  iommu/amd: Flush old domains in kdump kernel
  keys: Fix missing null pointer check in request_key_auth_describe()
  x86/hyper-v: Fix overflow bug in fill_gva_list()
  x86/uaccess: Don't leak the AC flags into __get_user() argument evaluation
  dmaengine: ti: omap-dma: Add cleanup in omap_dma_probe()
  dmaengine: ti: dma-crossbar: Fix a memory leak bug
  net: seeq: Fix the function used to release some memory in an error handling path
  tools/power turbostat: fix buffer overrun
  tools/power x86_energy_perf_policy: Fix argument parsing
  tools/power x86_energy_perf_policy: Fix "uninitialized variable" warnings at -O2
  amd-xgbe: Fix error path in xgbe_mod_init()
  perf/x86/amd/ibs: Fix sample bias for dispatched micro-ops
  perf/x86/intel: Restrict period on Nehalem
  i2c: designware: Synchronize IRQs when unregistering slave client
  sky2: Disable MSI on yet another ASUS boards (P6Xxxx)
  ARM: 8901/1: add a criteria for pfn_valid of arm
  cifs: Use kzfree() to zero out the password
  cifs: set domainName when a domain-key is used in multiuser
  kallsyms: Don't let kallsyms_lookup_size_offset() fail on retrieving the first symbol
  NFSv2: Fix write regression
  NFSv2: Fix eof handling
  netfilter: nf_conntrack_ftp: Fix debug output
  x86/apic: Fix arch_dynirq_lower_bound() bug for DT enabled machines
  r8152: Set memory to all 0xFFs on failed reg reads
  batman-adv: Only read OGM2 tvlv_len after buffer len check
  ARM: 8874/1: mm: only adjust sections of valid mm structures
  qed: Add cleanup in qed_slowpath_start()
  Kconfig: Fix the reference to the IDT77105 Phy driver in the description of ATM_NICSTAR_USE_IDT77105
  NFS: Fix initialisation of I/O result struct in nfs_pgio_rpcsetup
  NFSv4: Fix return value in nfs_finish_open()
  NFSv4: Fix return values for nfs4_file_open()
  netfilter: xt_nfacct: Fix alignment mismatch in xt_nfacct_match_info
  fpga: altera-ps-spi: Fix getting of optional confd gpio
  s390/bpf: use 32-bit index for tail calls
  ARM: dts: dra74x: Fix iodelay configuration for mmc3
  ARM: OMAP2+: Fix omap4 errata warning on other SoCs
  s390/bpf: fix lcgr instruction encoding
  ARM: OMAP2+: Fix missing SYSC_HAS_RESET_STATUS for dra7 epwmss
  nl80211: Fix possible Spectre-v1 for CQM RSSI thresholds
  mwifiex: Fix three heap overflow at parsing element in cfg80211_ap_settings
  tty/serial: atmel: reschedule TX after RX was started
  serial: sprd: correct the wrong sequence of arguments
  firmware: google: check if size is valid when decoding VPD data
  KVM: coalesced_mmio: add bounds checking
  net_sched: let qdisc_put() accept NULL pointer
  xen-netfront: do not assume sk_buff_head list is empty in error handling
  media: tm6000: double free if usb disconnect while streaming
  phy: renesas: rcar-gen3-usb2: Disable clearing VBUS in over-current
  USB: usbcore: Fix slab-out-of-bounds bug during device reset
  powerpc/mm/radix: Use the right page size for vmemmap mapping
  Input: elan_i2c - remove Lenovo Legion Y7000 PnpID
  HID: wacom: generic: read HID_DG_CONTACTMAX from any feature report
  ANDROID: regression introduced override_creds=off
  Linux 4.14.145
  x86/build: Add -Wnoaddress-of-packed-member to REALMODE_CFLAGS, to silence GCC9 build warning
  nvmem: Use the same permissions for eeprom as for nvmem
  platform/x86: pmc_atom: Add CB4063 Beckhoff Automation board to critclk_systems DMI table
  Revert "Bluetooth: btusb: driver to enable the usb-wakeup feature"
  drm/mediatek: mtk_drm_drv.c: Add of_node_put() before goto
  firmware: ti_sci: Always request response from firmware
  crypto: talitos - HMAC SNOOP NO AFEU mode requires SW icv checking.
  crypto: talitos - Do not modify req->cryptlen on decryption.
  crypto: talitos - fix ECB algs ivsize
  crypto: talitos - check data blocksize in ablkcipher.
  crypto: talitos - fix CTR alg blocksize
  crypto: talitos - check AES key size
  driver core: Fix use-after-free and double free on glue directory
  ubifs: Correctly use tnc_next() in search_dh_cookie()
  PCI: Always allow probing with driver_override
  mtd: rawnand: mtk: Fix wrongly assigned OOB buffer pointer issue
  clk: rockchip: Don't yell about bad mmc phases when getting
  drm/meson: Add support for XBGR8888 & ABGR8888 formats
  powerpc: Add barrier_nospec to raw_copy_in_user()
  MIPS: VDSO: Use same -m%-float cflag as the kernel proper
  MIPS: VDSO: Prevent use of smp_processor_id()
  KVM: nVMX: handle page fault in vmread
  KVM: x86: work around leak of uninitialized stack contents
  KVM: s390: Do not leak kernel stack data in the KVM_S390_INTERRUPT ioctl
  genirq: Prevent NULL pointer dereference in resend_irqs()
  Btrfs: fix assertion failure during fsync and use of stale transaction
  gpio: fix line flag validation in lineevent_create
  gpio: fix line flag validation in linehandle_create
  gpiolib: acpi: Add gpiolib_acpi_run_edge_events_on_boot option and blacklist
  Revert "MIPS: SiByte: Enable swiotlb for SWARM, LittleSur and BigSur"
  btrfs: correctly validate compression type
  btrfs: compression: add helper for type to string conversion
  tun: fix use-after-free when register netdev failed
  tipc: add NULL pointer check before calling kfree_rcu
  tcp: fix tcp_ecn_withdraw_cwr() to clear TCP_ECN_QUEUE_CWR
  sctp: use transport pf_retrans in sctp_do_8_2_transport_strike
  sctp: Fix the link time qualifier of 'sctp_ctrlsock_exit()'
  sch_hhf: ensure quantum and hhf_non_hh_weight are non-zero
  net: phylink: Fix flow control resolution
  net: gso: Fix skb_segment splat when splitting gso_size mangled skb having linear-headed frag_list
  net: Fix null de-reference of device refcount
  isdn/capi: check message length in capi_write()
  ipv6: Fix the link time qualifier of 'ping_v6_proc_exit_net()'
  cdc_ether: fix rndis support for Mediatek based smartphones
  bridge/mdb: remove wrong use of NLM_F_MULTI
  Linux 4.14.144
  vhost: make sure log_num < in_num
  kernel/module: Fix mem leak in module_add_modinfo_attrs
  clk: s2mps11: Add used attribute to s2mps11_dt_match
  scripts/decode_stacktrace: match basepath using shell prefix operator, not regex
  arm64: dts: rockchip: enable usb-host regulators at boot on rk3328-rock64
  powerpc/64: mark start_here_multiplatform as __ref
  hv_sock: Fix hang when a connection is closed
  batman-adv: Only read OGM tvlv_len after buffer len check
  batman-adv: fix uninit-value in batadv_netlink_get_ifindex()
  vhost/test: fix build for vhost test
  PCI: dra7xx: Fix legacy INTD IRQ handling
  PCI: designware-ep: Fix find_first_zero_bit() usage
  ip6: fix skb leak in ip6frag_expire_frag_queue()
  xfrm: clean up xfrm protocol checks
  powerpc/tm: Fix FP/VMX unavailable exceptions inside a transaction
  drm/vmwgfx: Fix double free in vmw_recv_msg()
  sched/fair: Don't assign runtime for throttled cfs_rq
  ALSA: hda/realtek - Fix the problem of two front mics on a ThinkCentre
  ALSA: hda/realtek - Fix overridden device-specific initialization
  ALSA: hda - Fix potential endless loop at applying quirks
  Linux 4.14.143
  x86/boot: Preserve boot_params.secure_boot from sanitizing
  mld: fix memory leak in mld_del_delrec()
  net: sched: act_sample: fix psample group handling on overwrite
  tcp: remove empty skb from write queue in error cases
  tcp: inherit timestamp on mtu probe
  net: stmmac: dwmac-rk: Don't fail if phy regulator is absent
  net_sched: fix a NULL pointer deref in ipt action
  net: fix skb use after free in netpoll
  Revert "x86/apic: Include the LDR when clearing out APIC registers"
  spi: bcm2835aux: fix corruptions for longer spi transfers
  spi: bcm2835aux: remove dangerous uncontrolled read of fifo
  spi: bcm2835aux: unifying code between polling and interrupt driven code
  libceph: allow ceph_buffer_put() to receive a NULL ceph_buffer
  KVM: arm/arm64: Only skip MMIO insn once
  ceph: fix buffer free while holding i_ceph_lock in fill_inode()
  ceph: fix buffer free while holding i_ceph_lock in __ceph_build_xattrs_blob()
  ceph: fix buffer free while holding i_ceph_lock in __ceph_setxattr()
  IB/mlx4: Fix memory leaks
  Tools: hv: kvp: eliminate 'may be used uninitialized' warning
  Input: hyperv-keyboard: Use in-place iterator API in the channel callback
  HID: cp2112: prevent sleeping function called from invalid context
  kprobes: Fix potential deadlock in kprobe_optimizer()
  ravb: Fix use-after-free ravb_tstamp_skb
  wimax/i2400m: fix a memory leak bug
  net: kalmia: fix memory leaks
  cx82310_eth: fix a memory leak bug
  vfs: fix page locking deadlocks when deduping files
  lan78xx: Fix memory leaks
  net: myri10ge: fix memory leaks
  liquidio: add cleanup in octeon_setup_iq()
  cxgb4: fix a memory leak bug
  drm/mediatek: set DMA max segment size
  drm/mediatek: use correct device to import PRIME buffers
  gpio: Fix build error of function redefinition
  ibmveth: Convert multicast list size for little-endian system
  Bluetooth: btqca: Add a short delay before downloading the NVM
  net: tc35815: Explicitly check NET_IP_ALIGN is not zero in tc35815_rx
  hv_netvsc: Fix a warning of suspicious RCU usage
  net: tundra: tsi108: use spin_lock_irqsave instead of spin_lock_irq in IRQ context
  Linux 4.14.142
  Revert "ASoC: Fail card instantiation if DAI format setup fails"
  x86/ptrace: fix up botched merge of spectrev1 fix
  i2c: piix4: Fix port selection for AMD Family 16h Model 30h
  NFS: Ensure O_DIRECT reports an error if the bytes read/written is 0
  NFS: Pass error information to the pgio error cleanup routine
  NFSv4/pnfs: Fix a page lock leak in nfs_pageio_resend()
  NFS: Clean up list moves of struct nfs_page
  KVM: arm/arm64: vgic-v2: Handle SGI bits in GICD_I{S,C}PENDR0 as WI
  KVM: arm/arm64: vgic: Fix potential deadlock when ap_list is long
  KVM: PPC: Book3S: Fix incorrect guest-to-user-translation error handling
  mac80211: fix possible sta leak
  Revert "cfg80211: fix processing world regdomain when non modular"
  crypto: ccp - Ignore unconfigured CCP device on suspend/resume
  VMCI: Release resource if the work is already queued
  drm/i915: Don't deballoon unused ggtt drm_mm_node in linux guest
  intel_th: pci: Add Tiger Lake support
  intel_th: pci: Add support for another Lewisburg PCH
  stm class: Fix a double free of stm_source_device
  mmc: core: Fix init of SD cards reporting an invalid VDD range
  mmc: sdhci-of-at91: add quirk for broken HS200
  uprobes/x86: Fix detection of 32-bit user mode
  USB: storage: ums-realtek: Whitelist auto-delink support
  USB: storage: ums-realtek: Update module parameter description for auto_delink_en
  usb: host: xhci: rcar: Fix typo in compatible string matching
  usb: host: ohci: fix a race condition between shutdown and irq
  usb: chipidea: udc: don't do hardware access if gadget has stopped
  USB: cdc-wdm: fix race between write and disconnect due to flag abuse
  usb-storage: Add new JMS567 revision to unusual_devs
  ftrace: Check for empty hash and comment the race with registering probes
  ftrace: Check for successful allocation of hash
  ftrace: Fix NULL pointer dereference in t_probe_next()
  x86/apic: Include the LDR when clearing out APIC registers
  x86/apic: Do not initialize LDR and DFR for bigsmp
  KVM: x86: Don't update RIP or do single-step on faulting emulation
  kvm: x86: skip populating logical dest map if apic is not sw enabled
  ALSA: seq: Fix potential concurrent access to the deleted pool
  ALSA: line6: Fix memory leak at line6_init_pcm() error path
  mm/zsmalloc.c: fix build when CONFIG_COMPACTION=n
  tcp: make sure EPOLLOUT wont be missed
  net/smc: make sure EPOLLOUT is raised
  ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit
  ALSA: usb-audio: Fix a stack buffer overflow bug in check_input_term
  tcp: fix tcp_rtx_queue_tail in case of empty retransmit queue
  drm/tilcdc: Register cpufreq notifier after we have initialized crtc
  scsi: ufs: Fix RX_TERMINATION_FORCE_ENABLE define value
  drm/bridge: tfp410: fix memleak in get_modes()
  watchdog: bcm2835_wdt: Fix module autoload
  tools: hv: fix KVP and VSS daemons exit code
  usb: host: fotg2: restart hcd after port reset
  drm/ast: Fixed reboot test may cause system hanged
  i2c: emev2: avoid race when unregistering slave client
  i2c: rcar: avoid race when unregistering slave client
  xen/blkback: fix memory leaks
  usb: gadget: mass_storage: Fix races between fsg_disable and fsg_set_alt
  usb: gadget: composite: Clear "suspended" on reset/disconnect
  iommu/dma: Handle SG length overflow better
  auxdisplay: panel: need to delete scan_timer when misc_register fails in panel_attach
  dmaengine: ste_dma40: fix unneeded variable warning
  ANDROID: sched: Disallow WALT with CFS bandwidth control
  ANDROID: fiq_debugger: remove

Conflicts:
	drivers/base/core.c
	drivers/staging/android/fiq_debugger/fiq_debugger.c
	drivers/usb/gadget/function/f_mass_storage.c
	sound/usb/mixer.c

Change-Id: Ifae45fc2fc7e7a777d77faacc1b3b88e371097df
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
 2019-09-30 03:33:08 -07:00
Nicolas Dichtel
0344ead5d2 bridge/mdb: remove wrong use of NLM_F_MULTI 
[ Upstream commit 94a72b3f024fc7e9ab640897a1e38583a470659d ]

NLM_F_MULTI must be used only when a NLMSG_DONE message is sent at the end.
In fact, NLMSG_DONE is sent only at the end of a dump.

Libraries like libnl will wait forever for NLMSG_DONE.

Fixes: 949f1e39a617 ("bridge: mdb: notify on router port add and del")
CC: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Acked-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2019-09-19 09:07:59 +02:00
Blagovest Kolenichev
459ee51360 Merge android-4.14-q.141 (633520acd) into msm-4.14 
* refs/heads/tmp-633520acd:
  Linux 4.14.141
  Revert "perf test 6: Fix missing kvm module load for s390"
  powerpc: Allow flush_(inval_)dcache_range to work across ranges >4GB
  dm zoned: fix potential NULL dereference in dmz_do_reclaim()
  xfs: fix missing ILOCK unlock when xfs_setattr_nonsize fails due to EDQUOT
  mm/zsmalloc.c: fix race condition in zs_destroy_pool
  mm/zsmalloc.c: migration can leave pages in ZS_EMPTY indefinitely
  mm, page_owner: handle THP splits correctly
  genirq: Properly pair kobject_del() with kobject_add()
  dm zoned: properly handle backing device failure
  dm zoned: improve error handling in i/o map code
  dm zoned: improve error handling in reclaim
  dm table: fix invalid memory accesses with too high sector number
  dm space map metadata: fix missing store of apply_bops() return value
  dm btree: fix order of block initialization in btree_split_beneath
  dm kcopyd: always complete failed jobs
  x86/boot: Fix boot regression caused by bootparam sanitizing
  x86/boot: Save fields explicitly, zero out everything else
  x86/CPU/AMD: Clear RDRAND CPUID bit on AMD family 15h/16h
  x86/apic: Handle missing global clockevent gracefully
  x86/retpoline: Don't clobber RFLAGS during CALL_NOSPEC on i386
  userfaultfd_release: always remove uffd flags and clear vm_userfaultfd_ctx
  gpiolib: never report open-drain/source lines as 'input' to user-space
  drm/nouveau: Don't retry infinitely when receiving no data on i2c over AUX
  libceph: fix PG split vs OSD (re)connect race
  ceph: don't try fill file_lock on unsuccessful GETFILELOCK reply
  Revert "dm bufio: fix deadlock with loop device"
  HID: wacom: Correct distance scale for 2nd-gen Intuos devices
  HID: wacom: correct misreported EKR ring values
  selftests: kvm: Adding config fragments
  perf pmu-events: Fix missing "cpu_clk_unhalted.core" event
  perf cpumap: Fix writing to illegal memory in handling cpumap mask
  perf ftrace: Fix failure to set cpumask when only one cpu is present
  drm/vmwgfx: fix memory leak when too many retries have occurred
  x86/lib/cpu: Address missing prototypes warning
  libata: add SG safety checks in SFF pio transfers
  libata: have ata_scsi_rw_xlat() fail invalid passthrough requests
  net: hisilicon: Fix dma_map_single failed on arm64
  net: hisilicon: fix hip04-xmit never return TX_BUSY
  net: hisilicon: make hip04_tx_reclaim non-reentrant
  net: cxgb3_main: Fix a resource leak in a error path in 'init_one()'
  SMB3: Kernel oops mounting a encryptData share with CONFIG_DEBUG_VIRTUAL
  HID: input: fix a4tech horizontal wheel custom usage
  NFSv4: Fix a potential sleep while atomic in nfs4_do_reclaim()
  net/ethernet/qlogic/qed: force the string buffer NULL-terminated
  can: peak_usb: force the string buffer NULL-terminated
  can: sja1000: force the string buffer NULL-terminated
  perf bench numa: Fix cpu0 binding
  isdn: hfcsusb: Fix mISDN driver crash caused by transfer buffer on the stack
  netfilter: ipset: Fix rename concurrency with listing
  isdn: mISDN: hfcsusb: Fix possible null-pointer dereferences in start_isoc_chain()
  qed: RDMA - Fix the hw_ver returned in device attributes
  net: usb: qmi_wwan: Add the BroadMobi BM818 card
  ASoC: ti: davinci-mcasp: Correct slot_width posed constraint
  st_nci_hci_connectivity_event_received: null check the allocation
  st21nfca_connectivity_event_received: null check the allocation
  ASoC: Fail card instantiation if DAI format setup fails
  can: dev: call netif_carrier_off() in register_candev()
  bonding: Force slave speed check after link state recovery for 802.3ad
  ASoC: dapm: Fix handling of custom_stop_condition on DAPM graph walks
  netfilter: ebtables: fix a memory leak bug in compat
  mips: fix cacheinfo
  MIPS: kernel: only use i8253 clocksource with periodic clockevent
  HID: Add 044f:b320 ThrustMaster, Inc. 2 in 1 DT

Conflicts:
	fs/userfaultfd.c

Change-Id: I2cc194e1b6d638378c9727a2bd52d76fc6142804
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
 2019-08-29 09:34:18 -07:00
Blagovest Kolenichev
8b902c6d60 Merge android-4.14-q.140 (2f8eadd) into msm-4.14 
* refs/heads/tmp-2f8eadd:
  Linux 4.14.140
  xfrm: policy: remove pcpu policy cache
  mmc: sdhci-of-arasan: Do now show error message in case of deffered probe
  bonding: Add vlan tx offload to hw_enc_features
  team: Add vlan tx offload to hw_enc_features
  net/mlx5e: Use flow keys dissector to parse packets for ARFS
  net/mlx5e: Only support tx/rx pause setting for port owner
  xen/netback: Reset nr_frags before freeing skb
  sctp: fix the transport error_count check
  net/packet: fix race in tpacket_snd()
  net/mlx4_en: fix a memory leak bug
  bnx2x: Fix VF's VLAN reconfiguration in reload.
  iommu/amd: Move iommu_init_pci() to .init section
  Input: psmouse - fix build error of multiple definition
  netfilter: conntrack: Use consistent ct id hash calculation
  arm64: ftrace: Ensure module ftrace trampoline is coherent with I-side
  arm64: compat: Allow single-byte watchpoints on all addresses
  Revert "tcp: Clear sk_send_head after purging the write queue"
  bpf: fix bpf_jit_limit knob for PAGE_SIZE >= 64K
  USB: serial: option: Add Motorola modem UARTs
  USB: serial: option: add the BroadMobi BM818 card
  USB: serial: option: Add support for ZTE MF871A
  USB: serial: option: add D-Link DWM-222 device ID
  USB: CDC: fix sanity checks in CDC union parser
  usb: cdc-acm: make sure a refcount is taken early enough
  usb: gadget: udc: renesas_usb3: Fix sysfs interface of "role"
  USB: core: Fix races in character device registration and deregistraion
  iio: adc: max9611: Fix temperature reading in probe
  staging: comedi: dt3000: Fix rounding up of timer divisor
  staging: comedi: dt3000: Fix signed integer overflow 'divider * base'
  KVM: arm/arm64: Sync ICH_VMCR_EL2 back when about to block
  asm-generic: fix -Wtype-limits compiler warnings
  ocfs2: remove set but not used variable 'last_hash'
  drm: msm: Fix add_gpu_components
  IB/mad: Fix use-after-free in ib mad completion handling
  IB/core: Add mitigation for Spectre V1
  arm64/mm: fix variable 'pud' set but not used
  arm64: unwind: Prohibit probing on return_address()
  arm64/efi: fix variable 'si' set but not used
  kbuild: modpost: handle KBUILD_EXTRA_SYMBOLS only for external modules
  ata: libahci: do not complain in case of deferred probe
  scsi: qla2xxx: Fix possible fcport null-pointer dereferences
  scsi: hpsa: correct scsi command status issue after reset
  drm/bridge: lvds-encoder: Fix build error while CONFIG_DRM_KMS_HELPER=m
  libata: zpodd: Fix small read overflow in zpodd_get_mech_type()
  perf header: Fix use of unitialized value warning
  perf header: Fix divide by zero error if f_header.attr_size==0
  irqchip/irq-imx-gpcv2: Forward irq type to parent
  irqchip/gic-v3-its: Free unused vpt_page when alloc vpe table fail
  xen/pciback: remove set but not used variable 'old_state'
  clk: renesas: cpg-mssr: Fix reset control race condition
  clk: at91: generated: Truncate divisor to GENERATED_MAX_DIV + 1
  netfilter: ebtables: also count base chain policies
  net: usb: pegasus: fix improper read if get_registers() fail
  Input: iforce - add sanity checks
  Input: kbtab - sanity check for endpoint type
  HID: hiddev: do cleanup in failure of opening a device
  HID: hiddev: avoid opening a disconnected device
  HID: holtek: test for sanity of intfdata
  ALSA: hda - Let all conexant codec enter D3 when rebooting
  ALSA: hda - Add a generic reboot_notify
  ALSA: hda - Fix a memory leak bug
  ALSA: hda - Apply workaround for another AMD chip 1022:1487
  xtensa: add missing isync to the cpu_reset TLB code
  x86/mm: Use WRITE_ONCE() when setting PTEs
  bpf: add bpf_jit_limit knob to restrict unpriv allocations
  bpf: restrict access to core bpf sysctls
  bpf: get rid of pure_initcall dependency to enable jits
  mm/memcontrol.c: fix use after free in mem_cgroup_iter()
  mm/usercopy: use memory range to be accessed for wraparound check
  sh: kernel: hw_breakpoint: Fix missing break in switch statement
  scsi: mpt3sas: Use 63-bit DMA addressing on SAS35 HBA

Change-Id: I6365fb1dd47655e268bbd361acf0ad5e7ff9d433
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
 2019-08-29 08:22:52 -07:00
Wenwen Wang
bdfb3b3527 netfilter: ebtables: fix a memory leak bug in compat 
[ Upstream commit 15a78ba1844a8e052c1226f930133de4cef4e7ad ]

In compat_do_replace(), a temporary buffer is allocated through vmalloc()
to hold entries copied from the user space. The buffer address is firstly
saved to 'newinfo->entries', and later on assigned to 'entries_tmp'. Then
the entries in this temporary buffer is copied to the internal kernel
structure through compat_copy_entries(). If this copy process fails,
compat_do_replace() should be terminated. However, the allocated temporary
buffer is not freed on this path, leading to a memory leak.

To fix the bug, free the buffer before returning from compat_do_replace().

Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 2019-08-29 08:26:37 +02:00
Florian Westphal
9f896cbc0a netfilter: ebtables: also count base chain policies 
commit 3b48300d5cc7c7bed63fddb006c4046549ed4aec upstream.

ebtables doesn't include the base chain policies in the rule count,
so we need to add them manually when we call into the x_tables core
to allocate space for the comapt offset table.

This lead syzbot to trigger:
WARNING: CPU: 1 PID: 9012 at net/netfilter/x_tables.c:649
xt_compat_add_offset.cold+0x11/0x36 net/netfilter/x_tables.c:649

Reported-by: syzbot+276ddebab3382bbf72db@syzkaller.appspotmail.com
Fixes: 2035f3ff8eaa ("netfilter: ebtables: compat: un-break 32bit setsockopt when no rules are present")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2019-08-25 10:50:09 +02:00
Blagovest Kolenichev
07a1b124a0 Merge android-4.14-q.138 (4a80569) into msm-4.14 
* refs/heads/tmp-4a80569:
  Linux 4.14.138
  spi: bcm2835: Fix 3-wire mode if DMA is enabled
  cgroup: Fix css_task_iter_advance_css_set() cset skip condition
  cgroup: css_task_iter_skip()'d iterators must be advanced before accessed
  cgroup: Include dying leaders with live threads in PROCS iterations
  cgroup: Implement css_task_iter_skip()
  cgroup: Call cgroup_release() before __exit_signal()
  bnx2x: Disable multi-cos feature.
  mvpp2: refactor MTU change code
  tun: mark small packets as owned by the tap sock
  net/mlx5e: Prevent encap flow counter update async to user query
  compat_ioctl: pppoe: fix PPPOEIOCSFWD handling
  tipc: compat: allow tipc commands without arguments
  NFC: nfcmrvl: fix gpio-handling regression
  net: sched: Fix a possible null-pointer dereference in dequeue_func()
  net: phylink: Fix flow control for fixed-link
  net/mlx5: Use reversed order when unregister devices
  net: fix ifindex collision during namespace removal
  net: bridge: mcast: don't delete permanent entries when fast leave is enabled
  net: bridge: delete local fdb on device init failure
  ip6_tunnel: fix possible use-after-free on xmit
  ife: error out when nla attributes are empty
  atm: iphase: Fix Spectre v1 vulnerability
  objtool: Add rewind_stack_do_exit() to the noreturn list
  objtool: Add machine_real_restart() to the noreturn list
  IB: directly cast the sockaddr union to aockaddr
  RDMA: Directly cast the sockaddr union to sockaddr
  HID: Add quirk for HP X1200 PIXART OEM mouse
  HID: wacom: fix bit shift for Cintiq Companion 2
  arm64: cpufeature: Fix feature comparison for CTR_EL0.{CWG,ERG}
  tcp: be more careful in tcp_fragment()
  ARM: dts: Add pinmuxing for i2c2 and i2c3 for LogicPD torpedo
  ARM: dts: Add pinmuxing for i2c2 and i2c3 for LogicPD SOM-LV
  scsi: fcoe: Embed fc_rport_priv in fcoe_rport structure

Change-Id: I494f952048fa433fdb24b70781dba18cc6f10b0c
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
 2019-08-20 04:52:51 -07:00
Nikolay Aleksandrov
b674f7dede net: bridge: mcast: don't delete permanent entries when fast leave is enabled 
[ Upstream commit 5c725b6b65067909548ac9ca9bc777098ec9883d ]

When permanent entries were introduced by the commit below, they were
exempt from timing out and thus igmp leave wouldn't affect them unless
fast leave was enabled on the port which was added before permanent
entries existed. It shouldn't matter if fast leave is enabled or not
if the user added a permanent entry it shouldn't be deleted on igmp
leave.

Before:
$ echo 1 > /sys/class/net/eth4/brport/multicast_fast_leave
$ bridge mdb add dev br0 port eth4 grp 229.1.1.1 permanent
$ bridge mdb show
dev br0 port eth4 grp 229.1.1.1 permanent

< join and leave 229.1.1.1 on eth4 >

$ bridge mdb show
$

After:
$ echo 1 > /sys/class/net/eth4/brport/multicast_fast_leave
$ bridge mdb add dev br0 port eth4 grp 229.1.1.1 permanent
$ bridge mdb show
dev br0 port eth4 grp 229.1.1.1 permanent

< join and leave 229.1.1.1 on eth4 >

$ bridge mdb show
dev br0 port eth4 grp 229.1.1.1 permanent

Fixes: ccb1c31a7a87 ("bridge: add flags to distinguish permanent mdb entires")
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2019-08-09 17:53:34 +02:00
Nikolay Aleksandrov
fbe5e82df0 net: bridge: delete local fdb on device init failure 
[ Upstream commit d7bae09fa008c6c9a489580db0a5a12063b97f97 ]

On initialization failure we have to delete the local fdb which was
inserted due to the default pvid creation. This problem has been present
since the inception of default_pvid. Note that currently there are 2 cases:
1) in br_dev_init() when br_multicast_init() fails
2) if register_netdevice() fails after calling ndo_init()

This patch takes care of both since br_vlan_flush() is called on both
occasions. Also the new fdb delete would be a no-op on normal bridge
device destruction since the local fdb would've been already flushed by
br_dev_delete(). This is not an issue for ports since nbp_vlan_init() is
called last when adding a port thus nothing can fail after it.

Reported-by: syzbot+88533dc8b582309bf3ee@syzkaller.appspotmail.com
Fixes: 5be5a2df40f0 ("bridge: Add filtering support for default_pvid")
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2019-08-09 17:53:34 +02:00
Blagovest Kolenichev
41d4f1d82f Merge android-4.14-q.135 (1391d3b) into msm-4.14 
* refs/heads/tmp-1391d3b:
  Linux 4.14.135
  access: avoid the RCU grace period for the temporary subjective credentials
  powerpc/tm: Fix oops on sigreturn on systems without TM
  powerpc/xive: Fix loop exit-condition in xive_find_target_in_mask()
  ALSA: hda - Add a conexant codec entry to let mute led work
  ALSA: line6: Fix wrong altsetting for LINE6_PODHD500_1
  hpet: Fix division by zero in hpet_time_div()
  fpga-manager: altera-ps-spi: Fix build error
  binder: prevent transactions to context manager from its own process.
  x86/speculation/mds: Apply more accurate check on hypervisor platform
  x86/sysfb_efi: Add quirks for some devices with swapped width and height
  btrfs: inode: Don't compress if NODATASUM or NODATACOW set
  KVM: nVMX: do not use dangling shadow VMCS after guest reset
  usb: pci-quirks: Correct AMD PLL quirk detection
  usb: wusbcore: fix unbalanced get/put cluster_id
  drm/crc-debugfs: Also sprinkle irqrestore over early exits
  drm/crc: Only report a single overflow when a CRC fd is opened
  locking/lockdep: Hide unused 'class' variable
  locking/lockdep: Fix lock used or unused stats error
  mm/mmu_notifier: use hlist_add_head_rcu()
  mm/gup.c: remove some BUG_ONs from get_gate_page()
  mm/gup.c: mark undo_dev_pagemap as __maybe_unused
  9p: pass the correct prototype to read_cache_page
  mm/kmemleak.c: fix check for softirq context
  sh: prevent warnings when using iounmap
  block/bio-integrity: fix a memory leak bug
  powerpc/eeh: Handle hugepages in ioremap space
  mailbox: handle failed named mailbox channel request
  f2fs: avoid out-of-range memory access
  powerpc/boot: add {get, put}_unaligned_be32 to xz_config.h
  PCI: dwc: pci-dra7xx: Fix compilation when !CONFIG_GPIOLIB
  RDMA/rxe: Fill in wc byte_len with IB_WC_RECV_RDMA_WITH_IMM
  perf annotate: Fix dereferencing freed memory found by the smatch tool
  perf session: Fix potential NULL pointer dereference found by the smatch tool
  perf test mmap-thread-lookup: Initialize variable to suppress memory sanitizer warning
  kallsyms: exclude kasan local symbols on s390
  serial: sh-sci: Fix TX DMA buffer flushing and workqueue races
  serial: sh-sci: Terminate TX DMA during buffer flushing
  RDMA/i40iw: Set queue pair state when being queried
  powerpc/4xx/uic: clear pending interrupt after irq type/pol change
  um: Silence lockdep complaint about mmap_sem
  mfd: hi655x-pmic: Fix missing return value check for devm_regmap_init_mmio_clk
  mfd: arizona: Fix undefined behavior
  mfd: core: Set fwnode for created devices
  recordmcount: Fix spurious mcount entries on powerpc
  powerpc/xmon: Fix disabling tracing while in xmon
  iio: iio-utils: Fix possible incorrect mask calculation
  PCI: xilinx-nwl: Fix Multi MSI data programming
  kbuild: Add -Werror=unknown-warning-option to CLANG_FLAGS
  PCI: sysfs: Ignore lockdep for remove attribute
  serial: mctrl_gpio: Check if GPIO property exisits before requesting it
  drm/msm: Depopulate platform on probe failure
  powerpc/pci/of: Fix OF flags parsing for 64bit BARs
  usb: gadget: Zero ffs_io_data
  tty: serial_core: Set port active bit in uart_port_activate
  drm/rockchip: Properly adjust to a true clock in adjusted_mode
  powerpc/pseries/mobility: prevent cpu hotplug during DT update
  phy: renesas: rcar-gen2: Fix memory leak at error paths
  drm/virtio: Add memory barriers for capset cache.
  serial: 8250: Fix TX interrupt handling condition
  tty: serial: msm_serial: avoid system lockup condition
  tty/serial: digicolor: Fix digicolor-usart already registered warning
  memstick: Fix error cleanup path of memstick_init
  drm/crc-debugfs: User irqsafe spinlock in drm_crtc_add_crc_entry
  drm/bridge: sii902x: pixel clock unit is 10kHz instead of 1kHz
  drm/bridge: tc358767: read display_props in get_modes()
  PCI: Return error if cannot probe VF
  drm/edid: Fix a missing-check bug in drm_load_edid_firmware()
  tty: serial: cpm_uart - fix init when SMC is relocated
  pinctrl: rockchip: fix leaked of_node references
  tty: max310x: Fix invalid baudrate divisors calculator
  usb: core: hub: Disable hub-initiated U1/U2
  drm/panel: simple: Fix panel_simple_dsi_probe
  hvsock: fix epollout hang from race condition
  nfsd: Fix overflow causing non-working mounts on 1 TB machines
  nfsd: fix performance-limiting session calculation
  nfsd: give out fewer session slots as limit approaches
  nfsd: increase DRC cache limit
  NFSv4: Fix open create exclusive when the server reboots
  perf/events/amd/uncore: Fix amd_uncore_llc ID to use pre-defined cpu_llc_id
  mm: vmscan: scan anonymous pages on file refaults
  ext4: allow directory holes
  ext4: use jbd2_inode dirty range scoping
  jbd2: introduce jbd2_inode dirty range scoping
  mm: add filemap_fdatawait_range_keep_errors()
  ext4: enforce the immutable flag on open files
  ext4: don't allow any modifications to an immutable file
  MIPS: lb60: Fix pin mappings
  dma-buf: Discard old fence_excl on retrying get_fences_rcu for realloc
  dma-buf: balance refcount inbalance
  net: bridge: stp: don't cache eth dest pointer before skb pull
  net: bridge: mcast: fix stale ipv6 hdr pointer when handling v6 query
  net: bridge: mcast: fix stale nsrcs pointer in igmp3/mld2 report handling
  tcp: Reset bytes_acked and bytes_received when disconnecting
  tcp: fix tcp_set_congestion_control() use from bpf hook
  net: make skb_dst_force return true when dst is refcounted
  bonding: validate ip header before check IPPROTO_IGMP
  netrom: hold sock when setting skb->destructor
  netrom: fix a memory leak in nr_rx_frame()
  macsec: fix checksumming after decryption
  macsec: fix use-after-free of skb during RX
  vrf: make sure skb->data contains ip header to make routing
  sky2: Disable MSI on ASUS P6T
  rxrpc: Fix send on a connected, but unbound socket
  nfc: fix potential illegal memory access
  net: openvswitch: fix csum updates for MPLS actions
  net: neigh: fix multiple neigh timer scheduling
  net: dsa: mv88e6xxx: wait after reset deactivation
  net: bcmgenet: use promisc for unsupported filters
  ipv4: don't set IPv6 only flags to IPv4 addresses
  igmp: fix memory leak in igmpv3_del_delrec()
  caif-hsi: fix possible deadlock in cfhsi_exit_module()
  bnx2x: Prevent ptp_task to be rescheduled indefinitely
  bnx2x: Prevent load reordering in tx completion processing
  lib/strscpy: Shut up KASAN false-positives in strscpy()
  compiler.h: Add read_word_at_a_time() function.
  compiler.h, kasan: Avoid duplicating __read_once_size_nocheck()
  dm bufio: fix deadlock with loop device
  dt-bindings: allow up to four clocks for orion-mdio
  net: mvmdio: allow up to four clocks to be specified for orion-mdio
  usb: Handle USB3 remote wakeup for LPM enabled devices correctly
  Bluetooth: Add SMP workaround Microsoft Surface Precision Mouse bug
  intel_th: msu: Fix single mode with disabled IOMMU
  eCryptfs: fix a couple type promotion bugs
  powerpc/watchpoint: Restore NV GPRs while returning from exception
  powerpc/32s: fix suspend/resume when IBATs 4-7 are used
  parisc: Fix kernel panic due invalid values in IAOQ0 or IAOQ1
  parisc: Ensure userspace privilege for ptraced processes in regset functions
  crypto: caam - limit output IV to CBC to work around CTR mode DMA issue
  PCI: hv: Fix a use-after-free bug in hv_eject_device_work()
  gpu: ipu-v3: ipu-ic: Fix saturation bit offset in TPMEM
  coda: pass the host file in vma->vm_file on mmap
  libnvdimm/pfn: fix fsdax-mode namespace info-block zero-fields
  HID: wacom: correct touch resolution x/y typo
  HID: wacom: generic: only switch the mode on devices with LEDs
  Btrfs: add missing inode version, ctime and mtime updates when punching hole
  Btrfs: fix fsync not persisting dentry deletions due to inode evictions
  Btrfs: fix data loss after inode eviction, renaming it, and fsync it
  PCI: Do not poll for PME if the device is in D3cold
  intel_th: pci: Add Ice Lake NNPI support
  perf/x86/amd/uncore: Set the thread mask for F17h L3 PMCs
  perf/x86/amd/uncore: Do not set 'ThreadMask' and 'SliceMask' for non-L3 PMCs
  x86/boot: Fix memory leak in default_get_smp_config()
  9p/virtio: Add cleanup path in p9_virtio_init
  9p/xen: Add cleanup path in p9_trans_xen_init
  xen/events: fix binding user event channels to cpus
  dm zoned: fix zone state management race
  padata: use smp_mb in padata_reorder to avoid orphaned padata jobs
  drm/nouveau/i2c: Enable i2c pads & busses during preinit
  fs/proc/proc_sysctl.c: fix the default values of i_uid/i_gid on /proc/sys inodes.
  arm64: tegra: Fix AGIC register range
  KVM: x86/vPMU: refine kvm_pmu err msg when event creation failed
  media: coda: Remove unbalanced and unneeded mutex unlock
  media: v4l2: Test type instead of cfg->type in v4l2_ctrl_new_custom()
  ALSA: hda/realtek: apply ALC891 headset fixup to one Dell machine
  ALSA: seq: Break too long mutex context in the write loop
  ASoC: dapm: Adapt for debugfs API change
  lib/scatterlist: Fix mapping iterator when sg->offset is greater than PAGE_SIZE
  pnfs/flexfiles: Fix PTR_ERR() dereferences in ff_layout_track_ds_error
  NFSv4: Handle the special Linux file open access mode
  iwlwifi: pcie: fix ALIVE interrupt handling for gen2 devices w/o MSI-X
  iwlwifi: pcie: don't service an interrupt that was masked
  arm64: tegra: Update Jetson TX1 GPU regulator timings
  regulator: s2mps11: Fix buck7 and buck8 wrong voltages
  Input: alps - fix a mismatch between a condition check and its comment
  Input: synaptics - whitelist Lenovo T580 SMBus intertouch
  Input: alps - don't handle ALPS cs19 trackpoint-only device
  Input: gtco - bounds check collection indent level
  crypto: crypto4xx - fix a potential double free in ppc4xx_trng_probe
  crypto: ccp/gcm - use const time tag comparison.
  crypto: ccp - memset structure fields to zero before reuse
  crypto: chacha20poly1305 - fix atomic sleep when using async algorithm
  crypto: arm64/sha2-ce - correct digest for empty data in finup
  crypto: arm64/sha1-ce - correct digest for empty data in finup
  crypto: ccp - Validate the the error value used to index error messages
  crypto: ghash - fix unaligned memory access in ghash_setkey()
  scsi: mac_scsi: Fix pseudo DMA implementation, take 2
  scsi: mac_scsi: Increase PIO/PDMA transfer length threshold
  scsi: megaraid_sas: Fix calculation of target ID
  scsi: core: Fix race on creating sense cache
  Revert "scsi: ncr5380: Increase register polling limit"
  scsi: NCR5380: Always re-enable reselection interrupt
  scsi: NCR5380: Reduce goto statements in NCR5380_select()
  xen: let alloc_xenballooned_pages() fail if not enough memory free
  floppy: fix out-of-bounds read in copy_buffer
  floppy: fix invalid pointer dereference in drive_name
  floppy: fix out-of-bounds read in next_valid_format
  floppy: fix div-by-zero in setup_format_params
  iavf: fix dereference of null rx_buffer pointer
  net: mvmdio: defer probe of orion-mdio if a clock is not ready
  gtp: fix use-after-free in gtp_newlink()
  gtp: fix use-after-free in gtp_encap_destroy()
  gtp: fix Illegal context switch in RCU read-side critical section.
  gtp: fix suspicious RCU usage
  Bluetooth: validate BLE connection interval updates
  gtp: add missing gtp_encap_disable_sock() in gtp_encap_enable()
  Bluetooth: Check state in l2cap_disconnect_rsp
  Bluetooth: 6lowpan: search for destination address in all peers
  Bluetooth: hci_bcsp: Fix memory leak in rx_skb
  gpiolib: Fix references to gpiod_[gs]et_*value_cansleep() variants
  net: usb: asix: init MAC address buffers
  perf stat: Make metric event lookup more robust
  iwlwifi: mvm: Drop large non sta frames
  ath10k: destroy sdio workqueue while remove sdio module
  net: hns3: add some error checking in hclge_tm module
  net: hns3: fix a -Wformat-nonliteral compile warning
  bcache: check c->gc_thread by IS_ERR_OR_NULL in cache_set_flush()
  EDAC: Fix global-out-of-bounds write when setting edac_mc_poll_msec
  crypto: asymmetric_keys - select CRYPTO_HASH where needed
  crypto: serpent - mark __serpent_setkey_sbox noinline
  ixgbe: Check DDM existence in transceiver before access
  rslib: Fix handling of of caller provided syndrome
  rslib: Fix decoding of shortened codes
  clocksource/drivers/exynos_mct: Increase priority over ARM arch timer
  libata: don't request sense data on !ZAC ATA devices
  perf tools: Increase MAX_NR_CPUS and MAX_CACHES
  ath10k: fix PCIE device wake up failed
  ath10k: add missing error handling
  ipvs: fix tinfo memory leak in start_sync_thread
  mt7601u: fix possible memory leak when the device is disconnected
  x86/build: Add 'set -e' to mkcapflags.sh to delete broken capflags.c
  mt7601u: do not schedule rx_tasklet when the device has been disconnected
  rtlwifi: rtl8192cu: fix error handle when usb probe failed
  media: hdpvr: fix locking and a missing msleep
  media: vimc: cap: check v4l2_fill_pixfmt return value
  media: coda: increment sequence offset for the last returned frame
  media: coda: fix last buffer handling in V4L2_ENC_CMD_STOP
  media: coda: fix mpeg2 sequence number handling
  acpi/arm64: ignore 5.1 FADTs that are reported as 5.0
  timer_list: Guard procfs specific code
  ntp: Limit TAI-UTC offset
  media: i2c: fix warning same module names
  media: s5p-mfc: Make additional clocks optional
  ipvs: defer hook registration to avoid leaks
  ipsec: select crypto ciphers for xfrm_algo
  EDAC/sysfs: Fix memory leak when creating a csrow object
  ipoib: correcly show a VF hardware address
  vhost_net: disable zerocopy by default
  perf evsel: Make perf_evsel__name() accept a NULL argument
  x86/atomic: Fix smp_mb__{before,after}_atomic()
  sched/core: Add __sched tag for io_schedule()
  xfrm: fix sa selector validation
  blkcg, writeback: dead memcgs shouldn't contribute to writeback ownership arbitration
  x86/cpufeatures: Add FDP_EXCPTN_ONLY and ZERO_FCS_FDS
  rcu: Force inlining of rcu_read_lock()
  bpf: silence warning messages in core
  regmap: fix bulk writes on paged registers
  gpio: omap: ensure irq is enabled before wakeup
  gpio: omap: fix lack of irqstatus_raw0 for OMAP4
  iommu: Fix a leak in iommu_insert_resv_region
  media: fdp1: Support M3N and E3 platforms
  perf test 6: Fix missing kvm module load for s390
  perf cs-etm: Properly set the value of 'old' and 'head' in snapshot mode
  ipset: Fix memory accounting for hash types on resize
  net: sfp: add mutex to prevent concurrent state checks
  RAS/CEC: Fix pfn insertion
  s390/qdio: handle PENDING state for QEBSM devices
  net: axienet: Fix race condition causing TX hang
  net: fec: Do not use netdev messages too early
  net: stmmac: dwmac4: fix flow control issue
  cpupower : frequency-set -r option misses the last cpu in related cpu list
  media: wl128x: Fix some error handling in fm_v4l2_init_video_device()
  locking/lockdep: Fix merging of hlocks with non-zero references
  tua6100: Avoid build warnings.
  crypto: talitos - Align SEC1 accesses to 32 bits boundaries.
  crypto: talitos - properly handle split ICV.
  net: phy: Check against net_device being NULL
  media: staging: media: davinci_vpfe: - Fix for memory leak if decoder initialization fails.
  media: mc-device.c: don't memset __user pointer contents
  fscrypt: clean up some BUG_ON()s in block encryption/decryption
  xfrm: Fix xfrm sel prefix length validation
  af_key: fix leaks in key_pol_get_resp and dump_sp.
  signal/pid_namespace: Fix reboot_pid_ns to use send_sig not force_sig
  qed: Set the doorbell address correctly
  net: stmmac: dwmac4/5: Clear unused address entries
  net: stmmac: dwmac1000: Clear unused address entries
  media: media_device_enum_links32: clean a reserved field
  media: vpss: fix a potential NULL pointer dereference
  media: marvell-ccic: fix DMA s/g desc number calculation
  crypto: talitos - fix skcipher failure due to wrong output IV
  media: spi: IR LED: add missing of table registration
  media: dvb: usb: fix use after free in dvb_usb_device_exit
  batman-adv: fix for leaked TVLV handler.
  ath: DFS JP domain W56 fixed pulse type 3 RADAR detection
  ath6kl: add some bounds checking
  ath9k: Check for errors when reading SREV register
  ath10k: Do not send probe response template for mesh
  wil6210: fix potential out-of-bounds read
  dmaengine: imx-sdma: fix use-after-free on probe error path
  scsi: iscsi: set auth_protocol back to NULL if CHAP_A value is not supported
  arm64/efi: Mark __efistub_stext_offset as an absolute symbol explicitly
  MIPS: fix build on non-linux hosts
  MIPS: ath79: fix ar933x uart parity mode
  ANDROID: enable CONFIG_RTC_DRV_TEST on cuttlefish
  ANDROID: cuttlefish_defconfig: enable CONFIG_CPU_FREQ_TIMES
  ANDROID: xfrm: remove in_compat_syscall() checks
  UPSTREAM: binder: Set end of SG buffer area properly.

Conflicts:
	drivers/gpu/drm/msm/msm_drv.c

Change-Id: I3f568e1d41c853c51a6ed293de6420fb447fe8e0
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
 2019-07-31 06:09:15 -07:00
Nikolay Aleksandrov
eaee127e4a net: bridge: stp: don't cache eth dest pointer before skb pull 
[ Upstream commit 2446a68ae6a8cee6d480e2f5b52f5007c7c41312 ]

Don't cache eth dest pointer before calling pskb_may_pull.

Fixes: cf0f02d04a83 ("[BRIDGE]: use llc for receiving STP packets")
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2019-07-31 07:28:46 +02:00
Nikolay Aleksandrov
c060a35bbe net: bridge: mcast: fix stale ipv6 hdr pointer when handling v6 query 
[ Upstream commit 3b26a5d03d35d8f732d75951218983c0f7f68dff ]

We get a pointer to the ipv6 hdr in br_ip6_multicast_query but we may
call pskb_may_pull afterwards and end up using a stale pointer.
So use the header directly, it's just 1 place where it's needed.

Fixes: 08b202b67264 ("bridge br_multicast: IPv6 MLD support.")
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Tested-by: Martin Weinelt <martin@linuxlounge.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2019-07-31 07:28:46 +02:00
Nikolay Aleksandrov
e95de01edc net: bridge: mcast: fix stale nsrcs pointer in igmp3/mld2 report handling 
[ Upstream commit e57f61858b7cf478ed6fa23ed4b3876b1c9625c4 ]

We take a pointer to grec prior to calling pskb_may_pull and use it
afterwards to get nsrcs so record nsrcs before the pull when handling
igmp3 and we get a pointer to nsrcs and call pskb_may_pull when handling
mld2 which again could lead to reading 2 bytes out-of-bounds.

 ==================================================================
 BUG: KASAN: use-after-free in br_multicast_rcv+0x480c/0x4ad0 [bridge]
 Read of size 2 at addr ffff8880421302b4 by task ksoftirqd/1/16

 CPU: 1 PID: 16 Comm: ksoftirqd/1 Tainted: G           OE     5.2.0-rc6+ #1
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
 Call Trace:
  dump_stack+0x71/0xab
  print_address_description+0x6a/0x280
  ? br_multicast_rcv+0x480c/0x4ad0 [bridge]
  __kasan_report+0x152/0x1aa
  ? br_multicast_rcv+0x480c/0x4ad0 [bridge]
  ? br_multicast_rcv+0x480c/0x4ad0 [bridge]
  kasan_report+0xe/0x20
  br_multicast_rcv+0x480c/0x4ad0 [bridge]
  ? br_multicast_disable_port+0x150/0x150 [bridge]
  ? ktime_get_with_offset+0xb4/0x150
  ? __kasan_kmalloc.constprop.6+0xa6/0xf0
  ? __netif_receive_skb+0x1b0/0x1b0
  ? br_fdb_update+0x10e/0x6e0 [bridge]
  ? br_handle_frame_finish+0x3c6/0x11d0 [bridge]
  br_handle_frame_finish+0x3c6/0x11d0 [bridge]
  ? br_pass_frame_up+0x3a0/0x3a0 [bridge]
  ? virtnet_probe+0x1c80/0x1c80 [virtio_net]
  br_handle_frame+0x731/0xd90 [bridge]
  ? select_idle_sibling+0x25/0x7d0
  ? br_handle_frame_finish+0x11d0/0x11d0 [bridge]
  __netif_receive_skb_core+0xced/0x2d70
  ? virtqueue_get_buf_ctx+0x230/0x1130 [virtio_ring]
  ? do_xdp_generic+0x20/0x20
  ? virtqueue_napi_complete+0x39/0x70 [virtio_net]
  ? virtnet_poll+0x94d/0xc78 [virtio_net]
  ? receive_buf+0x5120/0x5120 [virtio_net]
  ? __netif_receive_skb_one_core+0x97/0x1d0
  __netif_receive_skb_one_core+0x97/0x1d0
  ? __netif_receive_skb_core+0x2d70/0x2d70
  ? _raw_write_trylock+0x100/0x100
  ? __queue_work+0x41e/0xbe0
  process_backlog+0x19c/0x650
  ? _raw_read_lock_irq+0x40/0x40
  net_rx_action+0x71e/0xbc0
  ? __switch_to_asm+0x40/0x70
  ? napi_complete_done+0x360/0x360
  ? __switch_to_asm+0x34/0x70
  ? __switch_to_asm+0x40/0x70
  ? __schedule+0x85e/0x14d0
  __do_softirq+0x1db/0x5f9
  ? takeover_tasklets+0x5f0/0x5f0
  run_ksoftirqd+0x26/0x40
  smpboot_thread_fn+0x443/0x680
  ? sort_range+0x20/0x20
  ? schedule+0x94/0x210
  ? __kthread_parkme+0x78/0xf0
  ? sort_range+0x20/0x20
  kthread+0x2ae/0x3a0
  ? kthread_create_worker_on_cpu+0xc0/0xc0
  ret_from_fork+0x35/0x40

 The buggy address belongs to the page:
 page:ffffea0001084c00 refcount:0 mapcount:-128 mapping:0000000000000000 index:0x0
 flags: 0xffffc000000000()
 raw: 00ffffc000000000 ffffea0000cfca08 ffffea0001098608 0000000000000000
 raw: 0000000000000000 0000000000000003 00000000ffffff7f 0000000000000000
 page dumped because: kasan: bad access detected

 Memory state around the buggy address:
 ffff888042130180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888042130200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 > ffff888042130280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                     ^
 ffff888042130300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888042130380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ==================================================================
 Disabling lock debugging due to kernel taint

Fixes: bc8c20acaea1 ("bridge: multicast: treat igmpv3 report with INCLUDE and no sources as a leave")
Reported-by: Martin Weinelt <martin@linuxlounge.net>
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Tested-by: Martin Weinelt <martin@linuxlounge.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2019-07-31 07:28:46 +02:00
Blagovest Kolenichev
05efa6b764 Merge android-4.14.120 (eeb46d8) into msm-4.14 
* refs/heads/tmp-eeb46d8:
  Linux 4.14.120
  s390/speculation: Fix build error caused by bad backport
  powerpc/booke64: set RI in default MSR
  powerpc/powernv/idle: Restore IAMR after idle
  drivers/virt/fsl_hypervisor.c: prevent integer overflow in ioctl
  drivers/virt/fsl_hypervisor.c: dereferencing error pointers in ioctl
  tipc: fix hanging clients using poll with EPOLLOUT flag
  vrf: sit mtu should not be updated when vrf netdev is the link
  vlan: disable SIOCSHWTSTAMP in container
  packet: Fix error path in packet_init
  net: ucc_geth - fix Oops when changing number of buffers in the ring
  net: seeq: fix crash caused by not set dev.parent
  net: ethernet: stmmac: dwmac-sun8i: enable support of unicast filtering
  net: dsa: Fix error cleanup path in dsa_init_module
  ipv4: Fix raw socket lookup for local traffic
  fib_rules: return 0 directly if an exactly same rule exists when NLM_F_EXCL not supplied
  dpaa_eth: fix SG frame cleanup
  bridge: Fix error path for kobject_init_and_add()
  bonding: fix arp_validate toggling in active-backup mode
  powerpc/64s: Include cpu header
  Don't jump to compute_result state from check_result state
  rtlwifi: rtl8723ae: Fix missing break in switch statement
  mwl8k: Fix rate_idx underflow
  cw1200: fix missing unlock on error in cw1200_hw_scan()
  x86/kprobes: Avoid kretprobe recursion bug
  nfc: nci: Potential off by one in ->pipes[] array
  NFC: nci: Add some bounds checking in nci_hci_cmd_received()
  mlxsw: core: Do not use WQ_MEM_RECLAIM for mlxsw workqueue
  mlxsw: core: Do not use WQ_MEM_RECLAIM for mlxsw ordered workqueue
  mlxsw: core: Do not use WQ_MEM_RECLAIM for EMAD workqueue
  mlxsw: spectrum_switchdev: Add MDB entries in prepare phase
  net: fec: manage ahb clock in runtime pm
  mm/memory.c: fix modifying of page protection by insert_pfn()
  net: hns: Fix WARNING when hns modules installed
  x86/fpu: Don't export __kernel_fpu_{begin,end}()
  cifs: fix memory leak in SMB2_read
  drm/rockchip: fix for mailbox read validation.
  netfilter: nf_tables: warn when expr implements only one of activate/deactivate
  Input: elan_i2c - add hardware ID for multiple Lenovo laptops
  ACPICA: Namespace: remove address node from global list after method termination
  gtp: change NET_UDP_TUNNEL dependency to select
  net_sched: fix two more memory leaks in cls_tcindex
  xtensa: xtfpga.dtsi: fix dtc warnings about SPI
  devres: Align data[] to ARCH_KMALLOC_MINALIGN
  vt: always call notifier with the console lock held
  arm64: dts: marvell: armada-ap806: reserve PSCI area
  RDMA/vmw_pvrdma: Return the correct opcode when creating WR
  drm/rockchip: psr: do not dereference encoder before it is null checked.
  leds: pwm: silently error out on EPROBE_DEFER
  powerpc: remove old GCC version checks
  arm64: KVM: Make VHE Stage-2 TLB invalidation operations non-interruptible
  mm: introduce mm_[p4d|pud|pmd]_folded
  x86/vdso: Pass --eh-frame-hdr to the linker
  Btrfs: fix missing delayed iputs on unmount
  net: stmmac: Move debugfs init/exit to ->probe()/->remove()
  staging: olpc_dcon: add a missing dependency
  scsi: raid_attrs: fix unused variable warning
  drm/i915: Downgrade Gen9 Plane WM latency error
  tracing/fgraph: Fix set_graph_function from showing interrupts
  net: don't keep lonely packets forever in the gro hash
  media: ov5640: fix auto controls values when switching to manual mode
  media: ov5640: fix wrong binning value in exposure calculation
  drm/i915: Disable LP3 watermarks on all SNB machines
  fuse: fix possibly missed wake-up after abort
  media: adv7842: when the EDID is cleared, unconfigure CEC as well
  media: adv7604: when the EDID is cleared, unconfigure CEC as well
  media: cec: integrate cec_validate_phys_addr() in cec-api.c
  media: cec: make cec_get_edid_spa_location() an inline function
  KVM: arm/arm64: Ensure only THP is candidate for adjustment
  ima: open a new file instance if no read permissions
  IB/rxe: Revise the ib_wr_opcode enum
  ACPICA: AML interpreter: add region addresses in global list during initialization
  bcache: correct dirty data statistics
  MIPS: VDSO: Reduce VDSO_RANDOMIZE_SIZE to 64MB for 64bit
  sparc64: Make corrupted user stacks more debuggable.
  sparc64: Export __node_distance.
  Input: synaptics-rmi4 - fix possible double free
  spi: ST ST95HF NFC: declare missing of table
  spi: Micrel eth switch: declare missing of table
  drm/imx: don't skip DP channel disable for background plane
  gpu: ipu-v3: dp: fix CSC handling
  selftests/net: correct the return value for run_netsocktests
  drm/sun4i: Set device driver data at bind time for use in unbind
  s390: ctcm: fix ctcm_new_device error return code
  MIPS: perf: ath79: Fix perfcount IRQ assignment
  netfilter: ctnetlink: don't use conntrack/expect object addresses as id
  ipvs: do not schedule icmp errors from tunnels
  selftests: netfilter: check icmp pkttoobig errors are set as related
  init: initialize jump labels before command line option parsing
  mm: fix inactive list balancing between NUMA nodes and cgroups
  tools lib traceevent: Fix missing equality check for strcmp
  KVM: x86: avoid misreporting level-triggered irqs as edge-triggered in tracing
  KVM: fix spectrev1 gadgets
  x86/reboot, efi: Use EFI reboot for Acer TravelMate X514-51T
  s390/pkey: add one more argument space for debug feature entry
  mISDN: Check address length before reading address family
  clocksource/drivers/oxnas: Fix OX820 compatible
  s390/3270: fix lockdep false positive on view->lock
  nl80211: Add NL80211_FLAG_CLEAR_SKB flag for other NL commands
  mac80211: fix memory accounting with A-MSDU aggregation
  mac80211: Increase MAX_MSG_LEN
  mac80211: fix unaligned access in mesh table hash function
  s390/dasd: Fix capacity calculation for large volumes
  libnvdimm/btt: Fix a kmemdup failure check
  HID: input: add mapping for "Toggle Display" key
  HID: input: add mapping for keyboard Brightness Up/Down/Toggle keys
  HID: input: add mapping for Expose/Overview key
  libnvdimm/namespace: Fix a potential NULL pointer dereference
  iio: adc: xilinx: fix potential use-after-free on remove
  USB: serial: fix unthrottle races
  kernfs: fix barrier usage in __kernfs_new_node()
  hwmon: (pwm-fan) Disable PWM if fetching cooling data fails
  platform/x86: thinkpad_acpi: Disable Bluetooth for some machines
  platform/x86: sony-laptop: Fix unintentional fall-through
  netfilter: compat: initialize all fields in xt_init
  ANDROID: cuttlefish_defconfig: Disable DEVTMPFS
  ANDROID: Move from clang r349610 to r353983c.
  f2fs: fix to avoid accessing xattr across the boundary
  f2fs: fix to avoid potential race on sbi->unusable_block_count access/update
  f2fs: add tracepoint for f2fs_filemap_fault()
  f2fs: introduce DATA_GENERIC_ENHANCE
  f2fs: fix to handle error in f2fs_disable_checkpoint()
  f2fs: remove redundant check in f2fs_file_write_iter()
  f2fs: fix to be aware of readonly device in write_checkpoint()
  f2fs: fix to skip recovery on readonly device
  f2fs: fix to consider multiple device for readonly check
  f2fs: relocate chksum_offset for large_nat_bitmap feature
  f2fs: allow unfixed f2fs_checkpoint.checksum_offset
  f2fs: Replace spaces with tab
  f2fs: insert space before the open parenthesis '('
  f2fs: allow address pointer number of dnode aligning to specified size
  f2fs: introduce f2fs_read_single_page() for cleanup
  f2fs: mark is_extension_exist() inline
  f2fs: fix to set FI_UPDATE_WRITE correctly
  f2fs: fix to avoid panic in f2fs_inplace_write_data()
  f2fs: fix to do sanity check on valid block count of segment
  f2fs: fix to do sanity check on valid node/block count
  f2fs: fix to avoid panic in do_recover_data()
  f2fs: fix to do sanity check on free nid
  f2fs: fix to do checksum even if inode page is uptodate
  f2fs: fix to avoid panic in f2fs_remove_inode_page()
  f2fs: fix to clear dirty inode in error path of f2fs_iget()
  f2fs: remove new blank line of f2fs kernel message
  f2fs: fix wrong __is_meta_io() macro
  f2fs: fix to avoid panic in dec_valid_node_count()
  f2fs: fix to avoid panic in dec_valid_block_count()
  f2fs: fix to use inline space only if inline_xattr is enable
  f2fs: fix to retrieve inline xattr space
  f2fs: fix error path of recovery
  f2fs: fix to avoid deadloop in foreground GC
  f2fs: data: fix warning Using plain integer as NULL pointer
  f2fs: add tracepoint for f2fs_file_write_iter()
  f2fs: add comment for conditional compilation statement
  f2fs: fix potential recursive call when enabling data_flush
  f2fs: improve discard handling with multi-device volumes
  f2fs: Reduce zoned block device memory usage
  f2fs: Fix use of number of devices

Conflicts:
	fs/f2fs/data.c
	mm/vmscan.c

Change-Id: If6ce28cd56119ea6094c556ff4bc1aedfb24378c
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
 2019-07-23 10:59:55 -07:00
Blagovest Kolenichev
d4dcd34c67 Merge android-4.14.116 (85dc1a5) into msm-4.14 
* refs/heads/tmp-85dc1a5:
  Linux 4.14.116
  leds: pca9532: fix a potential NULL pointer dereference
  ptrace: take into account saved_sigmask in PTRACE{GET,SET}SIGMASK
  iommu/amd: Reserve exclusion range in iova-domain
  kconfig/[mn]conf: handle backspace (^H) key
  gpio: of: Fix of_gpiochip_add() error path
  libata: fix using DMA buffers on stack
  scsi: zfcp: reduce flood of fcrscn1 trace records on multi-element RSCN
  ceph: fix use-after-free on symlink traversal
  usb: u132-hcd: fix resource leak
  usb: usb251xb: fix to avoid potential NULL pointer dereference
  scsi: qla4xxx: fix a potential NULL pointer dereference
  drm/meson: Uninstall IRQ handler
  drm/meson: Fix invalid pointer in meson_drv_unbind()
  gpio: aspeed: fix a potential NULL pointer dereference
  net: ethernet: ti: fix possible object reference leak
  net: ibm: fix possible object reference leak
  net: xilinx: fix possible object reference leak
  NFS: Fix a typo in nfs_init_timeout_values()
  ARM: dts: imx6qdl: Fix typo in imx6qdl-icore-rqs.dtsi
  net/sched: don't dereference a->goto_chain to read the chain index
  net: macb: Add null check for PCLK and HCLK
  staging: rtlwifi: Fix potential NULL pointer dereference of kzalloc
  staging: rtl8712: uninitialized memory in read_bbreg_hdl()
  staging: rtlwifi: rtl8822b: fix to avoid potential NULL pointer dereference
  staging: rtl8188eu: Fix potential NULL pointer dereference of kcalloc
  net: ks8851: Set initial carrier state to down
  net: ks8851: Delay requesting IRQ until opened
  net: ks8851: Reassert reset pin if chip ID check fails
  net: ks8851: Dequeue RX packets explicitly
  ARM: dts: pfla02: increase phy reset duration
  usb: gadget: net2272: Fix net2272_dequeue()
  usb: gadget: net2280: Fix net2280_dequeue()
  usb: gadget: net2280: Fix overrun of OUT messages
  KVM: arm/arm64: vgic-its: Take the srcu lock when parsing the memslots
  serial: ar933x_uart: Fix build failure with disabled console
  sc16is7xx: missing unregister/delete driver on error in sc16is7xx_init()
  s390/qeth: fix race when initializing the IP address table
  netfilter: bridge: set skb transport_header before entering NF_INET_PRE_ROUTING
  netfilter: nft_set_rbtree: check for inactive element after flag mismatch
  qlcnic: Avoid potential NULL pointer dereference
  s390: limit brk randomization to 32MB
  ARM: dts: bcm283x: Fix hdmi hpd gpio pull
  fs: prevent page refcount overflow in pipe_buf_get
  mm: prevent get_user_pages() from overflowing page refcount
  mm: add 'try_get_page()' helper function
  mm: make page ref count overflow check tighter and more explicit
  usbnet: ipheth: fix potential null pointer dereference in ipheth_carrier_set
  usbnet: ipheth: prevent TX queue timeouts when device not ready
  selinux: use kernel linux/socket.h for genheaders and mdp

Change-Id: I4c096d869f0c685cf3a107748bba0ffe3b20c029
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
 2019-06-25 03:08:08 -07:00