summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2022-11-21UPSTREAM: wifi: mac80211_hwsim: use 32-bit skb cookieandroid-goldfish-4.14-devJohannes Berg
commit cc5250cdb43d444061412df7fae72d2b4acbdf97 upstream. We won't really have enough skbs to need a 64-bit cookie, and on 32-bit platforms storing the 64-bit cookie into the void *rate_driver_data doesn't work anyway. Switch back to using just a 32-bit cookie and uintptr_t for the type to avoid compiler warnings about all this. Fixes: 4ee186fa7e40 ("wifi: mac80211_hwsim: fix race condition in pending packet") Signed-off-by: Johannes Berg <johannes.berg@intel.com> Cc: Jeongik Cha <jeongik@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 6dece5ad6e1e7d8c2bacfae606dc6f18a18c51e0) Signed-off-by: Carlos Llamas <cmllamas@google.com> Bug: 236994625 Change-Id: I81b075297ec2248f706aebc914cd5e2783665bbc
2022-11-21UPSTREAM: wifi: mac80211_hwsim: add back erroneously removed castJohannes Berg
commit 58b6259d820d63c2adf1c7541b54cce5a2ae6073 upstream. The robots report that we're now casting to a differently sized integer, which is correct, and the previous patch had erroneously removed it. Reported-by: kernel test robot <lkp@intel.com> Fixes: 4ee186fa7e40 ("wifi: mac80211_hwsim: fix race condition in pending packet") Signed-off-by: Johannes Berg <johannes.berg@intel.com> Cc: Jeongik Cha <jeongik@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit d400222f49599423862010f0c7f6fee142be72d7) Signed-off-by: Carlos Llamas <cmllamas@google.com> Bug: 236994625 Change-Id: I4b5cfa77c47d4d03b46600f0b543e27340c228c0
2022-11-21UPSTREAM: wifi: mac80211_hwsim: fix race condition in pending packetJeongik Cha
commit 4ee186fa7e40ae06ebbfbad77e249e3746e14114 upstream. A pending packet uses a cookie as an unique key, but it can be duplicated because it didn't use atomic operators. And also, a pending packet can be null in hwsim_tx_info_frame_received_nl due to race condition with mac80211_hwsim_stop. For this, * Use an atomic type and operator for a cookie * Add a lock around the loop for pending packets Signed-off-by: Jeongik Cha <jeongik@google.com> Link: https://lore.kernel.org/r/20220704084354.3556326-1-jeongik@google.com Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit eb8fc4277b628ac81db806c130a500dd48a9e524) Signed-off-by: Carlos Llamas <cmllamas@google.com> Bug: 236994625 Change-Id: Ic6613c8869a51b5de303e40406f023af689b9d64
2022-11-21BACKPORT: mac80211_hwsim: fill boottime_ns in netlink RX pathWeilun Du
Give a proper boottime_ns value for netlink RX to avoid scan issues here. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Link: https://lore.kernel.org/r/20190729160605.1074-1-johannes@sipsolutions.net BUG: 259101715 Change-Id: Ief0bc91b1d6ad4d22266c36e0691f617705ddb8b Signed-off-by: Weilun Du <wdu@google.com>
2022-11-21BACKPORT: mac80211_hwsim: add concurrent channels scanning support over virtioWeilun Du
This fixed the crash when setting channels to 2 or more when communicating over virtio. Signed-off-by: Weilun Du <wdu@google.com> Link: https://lore.kernel.org/r/20210506180530.3418576-1-wdu@google.com Signed-off-by: Johannes Berg <johannes.berg@intel.com> (cherry picked from commit 626c30f9e77354301ff9162c3bdddaf92d9b5cf3 https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/commit/?id=626c30f9e77354301ff9162c3bdddaf92d9b5cf3) Bug: 182576217 Signed-off-by: Weilun Du <wdu@google.com> Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: Ia9be6c1d962b941a92f4e1be41e874dbe08024e5
2022-11-21Revert "BACKPORT: mac80211_hwsim: add concurrent channels scanning support ↵Weilun Du
over virtio" This reverts commit 2ed290642538fc7394c3c835b1fdc2870e38da26. Reason for revert: The unclean cherry-pick has a few problems. BUG: 182576217 Change-Id: Ib9bb550334bd3504d39e1720b62c5957b3aea205 Signed-off-by: Weilun Du <wdu@google.com>
2022-11-18BACKPORT: mac80211_hwsim: add concurrent channels scanning support over virtioWeilun Du
This fixed the crash when setting channels to 2 or more when communicating over virtio. Bug: 182576217 Signed-off-by: Weilun Du <wdu@google.com> Link: https://lore.kernel.org/r/20210506180530.3418576-1-wdu@google.com Signed-off-by: Johannes Berg <johannes.berg@intel.com> Change-Id: Id319bd63b757237fa8601b823001024bf067c36c Signed-off-by: Weilun Du <wdu@google.com>
2022-11-18BACKPORT: mac80211_hwsim: add frame transmission support over virtioWeilun Du
This allows communication with external entities. It also required fixing up the netlink policy, since NLA_UNSPEC attributes are no longer accepted. Signed-off-by: Erel Geron <erelx.geron@intel.com> [port to backports, inline the ID, use 29 as the ID as requested, drop != NULL checks, reduce ifdefs] Link: https://lore.kernel.org/r/20200305143212.c6e4c87d225b.I7ce60bf143e863dcdf0fb8040aab7168ba549b99@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com> Bug: 173808904 Signed-off-by: Weilun Du <wdu@google.com> Change-Id: I6097464f47460c2383e941594c88637446a77dd5
2022-11-18BACKPORT: mac80211_hwsim: add permanent mac address option for new radiosBenjamin Beichler
If simulation needs predictable permanent mac addresses of hwsim wireless phy, this patch add the ability to create a new radio with a user defined permanent mac address. Allowed mac addresses needs to be locally administrated mac addresses (as also the former fixed 42:* and 02:* were). To do not break the operation with legacy software using hwsim, the new address is set twice. The problem here is, the netlink call backs use wiphy->addresses[1] as identification of a radio and not the proposed permanent address (wiphy->addresses[0]). This design decision is not documented in the kernel repo, therefore this patch simply reproduces this, but with the same address. Signed-off-by: Benjamin Beichler <benjamin.beichler@uni-rostock.de> [make pointer const] Signed-off-by: Johannes Berg <johannes.berg@intel.com> Change-Id: Idff4d3269746470c076e6998351044711cf29a0f
2022-11-18BACKPORT: mac80211_hwsim: add hwsim_tx_rate_flags to netlink attributesBenjamin Beichler
For correct interpretation of a tx rate, the corresponding rate flags are needed (e.g. whether a HT-MCS rate or a legacy rate) and moreover for more correct simulation the other infos of the flags are important (like short-GI). Keeping compatibility, the flags are not integrated into the existing hwsim_tx_rate, but transmitted as an additional netlink attribute. Signed-off-by: Benjamin Beichler <benjamin.beichler@uni-rostock.de> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Change-Id: I99e3aa0a131ea80fd5f7d156cd7e68a593b5cb17
2022-05-03Replace HDA_CODEC_REALTEK with HDA_GENERICRoman Kiryanov
Bug: 230502385 Test: boot emulator, check if audio works Signed-off-by: Roman Kiryanov <rkir@google.com> Change-Id: Id812cb38cf1126c4579dddcef51be451966de22c
2022-05-02Improve handling of the command buffer in goldfish_syncRoman Kiryanov
32 command is not enough and just changing the buffer size will consume too much stack. Bug: 229140548 Test: presubmit Change-Id: I6396f7523c0a84ecdc2382da164872fb4091d0e6 Signed-off-by: Roman Kiryanov <rkir@google.com>
2022-05-02Fix a buffer overrun in `goldfish_sync_cmd_queue`Roman Kiryanov
`goldfish_sync_cmd_queue` used to write a warning that the cmd queue is full but still wrote into the buffer causing an overrun and missing the command. Bug: 229140548 Test: presubmit Signed-off-by: Roman Kiryanov <rkir@google.com> Change-Id: I56c1fc3cf3756a82bb6e4e2bb7c0eee3e13941fc
2022-05-02Fix resource cleanup for `goldfish_sync_fence_create`Roman Kiryanov
The `ioctl` call incorrectly cleaned up a newly created fence if `copy_to_user` fails. Bug: 200322608 Test: build Signed-off-by: Roman Kiryanov <rkir@google.com> Change-Id: Id93d1cf570cb32d37cb6e7f1f7e9345cfbb16d3d
2021-07-26update arm64 configs for emulator to run on M1Bo Hu
Signed-off-by: Bo Hu <bohu@google.com> Change-Id: I286d375fd15406705e38f6a006779dd181ea25c9
2020-04-07defconfig: Update defconfigs for x86_64 and arm64Roman Kiryanov
Bug: 153210465 Test: CtsKernelConfigTestCases Test: CtsOsTestCases Test: CtsHardwareTestCases Test: CtsNativeHardwareTestCases Test: CtsPermissionTestCases Test: CtsNetTestCases Signed-off-by: Roman Kiryanov <rkir@google.com> Change-Id: I925cd22dc5590f116a22f2e85ce59636c411180f
2020-04-07build: Update build configs for x86_64 and arm64Roman Kiryanov
Bug: 153210465 Signed-off-by: Roman Kiryanov <rkir@google.com> Change-Id: I05b61c9a323b3ce0dd5ac67d3621e7e167384f6d
2020-04-07build: Retire old build related filesRoman Kiryanov
Bug: 153210465 Signed-off-by: Roman Kiryanov <rkir@google.com> Change-Id: I4c088d22bc3ba5f6e639d242249f40f147806a2c
2020-04-07goldfish_address_space: add a driverRoman Kiryanov
On the host side (QEMU) we have a PCI device with two bars: * the control bar - it provides registers to talk to the device; * the address area bar - it is just some address space that is populated by guest requests (via ioctls). Once a memory block is allocated, the guest can mmap it into its userspace. On the host side we also have access to this memory block. Bug: 116046430 Bug: 140112486 Bug: 153210465 Signed-off-by: Lingfeng Yang <lfy@google.com> Signed-off-by: Roman Kiryanov <rkir@google.com> Change-Id: Ia0260cb1ea675064bf4c5b03b9715b335a79b68c
2020-04-07goldfish_rotary: add a driverRoman Kiryanov
Some Android Wear images have the rotary input, this driver adds support to this input. Bug: 153210465 Signed-off-by: Roman Kiryanov <rkir@google.com> Change-Id: Ide222838f8a571c089030c64b89b78ad50897386
2020-04-07goldfish_sync: cleanupRoman Kiryanov
* merged all files in to one; * moved out from staging; * moved userpace api to the UAPI file; * removed mutable global variables; * removed redundant locking; * removed redundant memory allocations; * minor fixes to error handling. Bug: 153210465 Signed-off-by: Roman Kiryanov <rkir@google.com> Change-Id: I2e4a1dcfd354a4ace1c4ba8797cf2cf84e5280eb
2020-04-07goldfish_pipe: add v1 and DNA to v2Roman Kiryanov
This change adds v1 and DMA support to v2. Bug: 153210465 Signed-off-by: Roman Kiryanov <rkir@google.com> Change-Id: Ice5434b6f532464bf72c452e0a59fe572ba2805b
2020-04-07goldfish_cpufreq: Add goldfish cpufreq stats driver. It can only provide ↵Weilun Du
fake static value. Test: run cts -m CtsStatsdHostTestCases -t android.cts.statsd.atom.UidAtomTests#testDeviceCalculatedPowerBlameUid Bug: 120856552 Bug: 79493321 Bug: 153210465 Signed-off-by: Weilun Du <wdu@google.com> Signed-off-by: Roman Kiryanov <rkir@google.com> Change-Id: I1a3f111f4445950b2b0b8d9f3c763f9d55fc7198
2020-04-07goldfish_battery: Adding more properties for readWeilun Du
Add voltage, temperature, charge counter, voltage max and current max properties to goldfish battery for read. Added POWER_SUPPLY_PROP_CURRENT_NOW,POWER_SUPPLY_PROP_CURRENT_AVG, POWER_SUPPLY_PROP_CHARGE_FULL, POWER_SUPPLY_PROP_CYCLE_COUNT. Use hard-coded values in goldfish-battery driver to avoid error logs in host emulator. Bug: 78225751 Bug: 37465083 Bug: 153210465 Signed-off-by: Weilun Du <wdu@google.com> Signed-off-by: Roman Kiryanov <rkir@google.com> Change-Id: I171d681920db9e6c15284c2c9cf2cd9c09410e33 Signed-off-by: Roman Kiryanov <rkir@google.com>
2020-04-07goldfish: Indicate goldfish drivers depend on HAS_IOMEMBjoern Johansson
Goldfish drivers make use of iomem to communicate with the host. Indicate this dependency in the Kconfig files so that drivers are not built on platforms that do not support this. This is useful for usermode Linux which is used to run test cases on the kernel. These drivers do not compile in usermode without this fix because iomem is not available. Bug: 153210465 Signed-off-by: Bjoern Johansson <bjoernj@google.com> Signed-off-by: Roman Kiryanov <rkir@google.com> Change-Id: I6cf2d89d72c98c88e1e923a9259c4fd1fc58c5dd
2020-04-07Retire KEYBOARD_GOLDFISH_EVENTSRoman Kiryanov
We use virtio input isntead. Bug: 153210465 Signed-off-by: Roman Kiryanov <rkir@google.com> Change-Id: Ic86435f37b2ccafe1c9227aeaf0d1d469fe6ba81
2020-04-07Retire GOLDFISH_NANDRoman Kiryanov
Not used by goldfish. Bug: 153210465 Signed-off-by: Roman Kiryanov <rkir@google.com> Change-Id: Ic324610b670189be13276c11beb8abe5ca8f25e4
2020-04-07Retire GOLDFISH_PDEV_BUSRoman Kiryanov
Not used by goldfish. Bug: 153210465 Signed-off-by: Roman Kiryanov <rkir@google.com> Change-Id: I2d446b90c81698fe4f76a486c5569b5fe83afbe6
2020-04-07mac80211_hwsim: set timestamps relative to bootBjoern Johansson
The Linux API specifies that the timestamp in probes and beacons should be in microseconds since epoch. Android expects microseconds since boot. This changes the behavior in mac80211_hwsim to match the expected Android behavior. This is a short term solution to work around this problem. Newer kernels have been fixed to provide information about time since boot (in 6e19bc4b7091ffd26586100eee78232b44427ec7) and will not need this workaround. (cherry picked from commit 061be437c30b ("mac80211_hwsim: set timestamps relative to boot")) Bug: 153210465 Signed-off-by: Bjoern Johansson <bjoernj@google.com> Signed-off-by: Roman Kiryanov <rkir@google.com> Change-Id: I8fd43841c7f335dfbee9b294058423dbc98fa7e9
2020-04-07mac80211_hwsim: add option to set unique MAC addrBjoern Johansson
Create a module parameter to set the second and third octet in the MAC address to something unique. This allows each radio to have a globally unique MAC address if multiple virtual wireless networks are bridged or in the presence of other interfaces that use the same range of MAC addresses. (cherry picked from commit 76649abdcceb6e8b697a5b1fb8d3f021e752ec60) Bug: 134897139 Bug: 153210465 Signed-off-by: Bjoern Johansson <bjoernj@google.com> Signed-off-by: Roman Kiryanov <rkir@google.com> Change-Id: I9ea86fa5e55f3b349609b447a63543bd7205641f
2020-04-07kernel: Init Multi-Touch to Prevent Kernel from Filtering Out ABS_MT_SLOT ↵Weilun Du
Events. Bug: 129491066 Bug: 153210465 Signed-off-by: Weilun Du <wdu@google.com> Signed-off-by: Roman Kiryanov <rkir@google.com> Change-Id: Id368038b4e80b4579a3ed938313b466005a4f0f8
2020-04-07kernel: Send SUBSYSTEM=power_supply NETLINK events to an addtional groupRoman Kiryanov
Our Android Emulator runs on x86 and the defconfig includes CONFIG_X86_CPUID. This driver calls device_destroy in the teardown callback (from cpuhp_setup_state). During suspending, the kernel destroys cpus and broadcasts NETLINK events about it to nl_groups=1 (as all other events). healthd listens for all NETLINK messages (to filter only SUBSYSTEM=power_supply ones) with EPOLLWAKEUP to react urgently for battery issues. Since the suspending process produces cpu shutdown events, healthd always prevents our system from suspending. This change should be matched with a healthd change to stop listening for nl_groups=1. Bug: 139203596 Bug: 153210465 Test: CtsVerifier, SENSORS/Device Suspend Test Signed-off-by: Roman Kiryanov <rkir@google.com> Change-Id: I6136a62af7ca07106f8e878c5ff5bbb10bfe4445
2020-04-04UPSTREAM: loop: Only freeze block queue when needed.Martijn Coenen
__loop_update_dio() can be called as a part of loop_set_fd(), when the block queue is not yet up and running; avoid freezing the block queue in that case, since that is an expensive operation. Bug: 148607611 Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com> Signed-off-by: Martijn Coenen <maco@android.com> Signed-off-by: Jens Axboe <axboe@kernel.dk> (cherry picked from commit 0fbcf57982346763ec636f176d5afaa367b5f71b) Change-Id: I17d8de6b6b54a667703d60ea1c62449bb14331da
2020-04-04UPSTREAM: loop: Only change blocksize when needed.Martijn Coenen
Return early in loop_set_block_size() if the requested block size is identical to the one we already have; this avoids expensive calls to freeze the block queue. Bug: 148607611 Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Martijn Coenen <maco@android.com> Signed-off-by: Jens Axboe <axboe@kernel.dk> (cherry picked from commit 7e81f99afd91c937f0e66dc135e26c1c4f78b003) Change-Id: I61778680579dbfeeb193133527a3926d376e0bac
2020-04-02Merge 4.14.175 into android-4.14-qGreg Kroah-Hartman
Changes in 4.14.175 spi: qup: call spi_qup_pm_resume_runtime before suspending powerpc: Include .BTF section ARM: dts: dra7: Add "dma-ranges" property to PCIe RC DT nodes spi: pxa2xx: Add CS control clock quirk spi/zynqmp: remove entry that causes a cs glitch drm/exynos: dsi: propagate error value and silence meaningless warning drm/exynos: dsi: fix workaround for the legacy clock name drivers/perf: arm_pmu_acpi: Fix incorrect checking of gicc pointer altera-stapl: altera_get_note: prevent write beyond end of 'key' dm bio record: save/restore bi_end_io and bi_integrity xenbus: req->body should be updated before req->state xenbus: req->err should be updated before req->state block, bfq: fix overwrite of bfq_group pointer in bfq_find_set_group() parse-maintainers: Mark as executable USB: Disable LPM on WD19's Realtek Hub usb: quirks: add NO_LPM quirk for RTL8153 based ethernet adapters USB: serial: option: add ME910G1 ECM composition 0x110b usb: host: xhci-plat: add a shutdown USB: serial: pl2303: add device-id for HP LD381 usb: xhci: apply XHCI_SUSPEND_DELAY to AMD XHCI controller 1022:145c ALSA: line6: Fix endless MIDI read loop ALSA: seq: virmidi: Fix running status after receiving sysex ALSA: seq: oss: Fix running status after receiving sysex ALSA: pcm: oss: Avoid plugin buffer overflow ALSA: pcm: oss: Remove WARNING from snd_pcm_plug_alloc() checks iio: trigger: stm32-timer: disable master mode when stopping iio: magnetometer: ak8974: Fix negative raw values in sysfs mmc: sdhci-of-at91: fix cd-gpios for SAMA5D2 staging: rtl8188eu: Add device id for MERCUSYS MW150US v2 staging/speakup: fix get_word non-space look-ahead intel_th: Fix user-visible error codes intel_th: pci: Add Elkhart Lake CPU support rtc: max8907: add missing select REGMAP_IRQ xhci: Do not open code __print_symbolic() in xhci trace events memcg: fix NULL pointer dereference in __mem_cgroup_usage_unregister_event mm: slub: be more careful about the double cmpxchg of freelist mm, slub: prevent kmalloc_node crashes and memory leaks page-flags: fix a crash at SetPageError(THP_SWAP) x86/mm: split vmalloc_sync_all() USB: cdc-acm: fix close_delay and closing_wait units in TIOCSSERIAL USB: cdc-acm: fix rounding error in TIOCSSERIAL iio: adc: at91-sama5d2_adc: fix channel configuration for differential channels iio: adc: at91-sama5d2_adc: fix differential channels in triggered mode kbuild: Disable -Wpointer-to-enum-cast futex: Fix inode life-time issue futex: Unbreak futex hashing Revert "vrf: mark skb for multicast or link-local as enslaved to VRF" Revert "ipv6: Fix handling of LLA with VRF and sockets bound to VRF" ALSA: hda/realtek: Fix pop noise on ALC225 arm64: smp: fix smp_send_stop() behaviour arm64: smp: fix crash_smp_send_stop() behaviour drm/bridge: dw-hdmi: fix AVI frame colorimetry staging: greybus: loopback_test: fix potential path truncation staging: greybus: loopback_test: fix potential path truncations Revert "drm/dp_mst: Skip validating ports during destruction, just ref" hsr: fix general protection fault in hsr_addr_is_self() macsec: restrict to ethernet devices net: dsa: Fix duplicate frames flooded by learning net: mvneta: Fix the case where the last poll did not process all rx net/packet: tpacket_rcv: avoid a producer race condition net: qmi_wwan: add support for ASKEY WWHC050 net_sched: cls_route: remove the right filter from hashtable net_sched: keep alloc_hash updated after hash allocation net: stmmac: dwmac-rk: fix error path in rk_gmac_probe NFC: fdp: Fix a signedness bug in fdp_nci_send_patch() slcan: not call free_netdev before rtnl_unlock in slcan_open bnxt_en: fix memory leaks in bnxt_dcbnl_ieee_getets() net: dsa: mt7530: Change the LINK bit to reflect the link status vxlan: check return value of gro_cells_init() hsr: use rcu_read_lock() in hsr_get_node_{list/status}() hsr: add restart routine into hsr_get_node_list() hsr: set .netnsok flag net: ipv4: don't let PMTU updates increase route MTU cgroup-v1: cgroup_pidlist_next should update position index cpupower: avoid multiple definition with gcc -fno-common drivers/of/of_mdio.c:fix of_mdiobus_register() cgroup1: don't call release_agent when it is "" dt-bindings: net: FMan erratum A050385 arm64: dts: ls1043a: FMan erratum A050385 fsl/fman: detect FMan erratum A050385 scsi: ipr: Fix softlockup when rescanning devices in petitboot mac80211: Do not send mesh HWMP PREQ if HWMP is disabled dpaa_eth: Remove unnecessary boolean expression in dpaa_get_headroom sxgbe: Fix off by one in samsung driver strncpy size arg arm64: ptrace: map SPSR_ELx<->PSR for compat tasks arm64: compat: map SPSR_ELx<->PSR for signals ftrace/x86: Anotate text_mutex split between ftrace_arch_code_modify_post_process() and ftrace_arch_code_modify_prepare() i2c: hix5hd2: add missed clk_disable_unprepare in remove Input: synaptics - enable RMI on HP Envy 13-ad105ng Input: avoid BIT() macro usage in the serio.h UAPI header ARM: dts: dra7: Add bus_dma_limit for L3 bus ARM: dts: omap5: Add bus_dma_limit for L3 bus perf probe: Do not depend on dwfl_module_addrsym() tools: Let O= makes handle a relative path with -C option scripts/dtc: Remove redundant YYLOC global declaration scsi: sd: Fix optimal I/O size for devices that change reported values mac80211: mark station unauthorized before key removal gpiolib: acpi: Correct comment for HP x2 10 honor_wakeup quirk gpiolib: acpi: Rework honor_wakeup option into an ignore_wake option gpiolib: acpi: Add quirk to ignore EC wakeups on HP x2 10 BYT + AXP288 model RDMA/core: Ensure security pkey modify is not lost genirq: Fix reference leaks on irq affinity notifiers xfrm: handle NETDEV_UNREGISTER for xfrm device vti[6]: fix packet tx through bpf_redirect() in XinY cases RDMA/mlx5: Block delay drop to unprivileged users xfrm: fix uctx len check in verify_sec_ctx_len xfrm: add the missing verify_sec_ctx_len check in xfrm_add_acquire xfrm: policy: Fix doulbe free in xfrm_policy_timer netfilter: nft_fwd_netdev: validate family and chain type vti6: Fix memory leak of skb if input policy check fails Input: raydium_i2c_ts - use true and false for boolean values Input: raydium_i2c_ts - fix error codes in raydium_i2c_boot_trigger() afs: Fix some tracing details USB: serial: option: add support for ASKEY WWHC050 USB: serial: option: add BroadMobi BM806U USB: serial: option: add Wistron Neweb D19Q1 USB: cdc-acm: restore capability check order USB: serial: io_edgeport: fix slab-out-of-bounds read in edge_interrupt_callback usb: musb: fix crash with highmen PIO and usbmon media: flexcop-usb: fix endpoint sanity check media: usbtv: fix control-message timeouts staging: rtl8188eu: Add ASUS USB-N10 Nano B1 to device table staging: wlan-ng: fix ODEBUG bug in prism2sta_disconnect_usb staging: wlan-ng: fix use-after-free Read in hfa384x_usbin_callback libfs: fix infoleak in simple_attr_read() media: ov519: add missing endpoint sanity checks media: dib0700: fix rc endpoint lookup media: stv06xx: add missing descriptor sanity checks media: xirlink_cit: add missing descriptor sanity checks mac80211: Check port authorization in the ieee80211_tx_dequeue() case mac80211: fix authentication with iwlwifi/mvm vt: selection, introduce vc_is_sel vt: ioctl, switch VT_IS_IN_USE and VT_BUSY to inlines vt: switch vt_dont_switch to bool vt: vt_ioctl: remove unnecessary console allocation checks vt: vt_ioctl: fix VT_DISALLOCATE freeing in-use virtual console vt: vt_ioctl: fix use-after-free in vt_in_use() platform/x86: pmc_atom: Add Lex 2I385SW to critclk_systems DMI table bpf: Explicitly memset the bpf_attr structure bpf: Explicitly memset some bpf info structures declared on the stack gpiolib: acpi: Add quirk to ignore EC wakeups on HP x2 10 CHT + AXP288 model net: ks8851-ml: Fix IO operations, again arm64: alternative: fix build with clang integrated assembler perf map: Fix off by one in strncpy() size argument ARM: dts: oxnas: Fix clear-mask property ARM: bcm2835-rpi-zero-w: Add missing pinctrl name arm64: dts: ls1043a-rdb: correct RGMII delay mode to rgmii-id arm64: dts: ls1046ardb: set RGMII interfaces to RGMII_ID mode Linux 4.14.175 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I222580f96c61d9abb3e81f147270de2bcd1cd53a
2020-04-02Linux 4.14.175Greg Kroah-Hartman
2020-04-02arm64: dts: ls1046ardb: set RGMII interfaces to RGMII_ID modeMadalin Bucur
commit d79e9d7c1e4ba5f95f2ff3541880c40ea9722212 upstream. The correct setting for the RGMII ports on LS1046ARDB is to enable delay on both Rx and Tx so the interface mode used must be PHY_INTERFACE_MODE_RGMII_ID. Since commit 1b3047b5208a80 ("net: phy: realtek: add support for configuring the RX delay on RTL8211F") the Realtek 8211F PHY driver has control over the RGMII RX delay and it is disabling it for RGMII_TXID. The LS1046ARDB uses two such PHYs in RGMII_ID mode but in the device tree the mode was described as "rgmii". Changing the phy-connection-type to "rgmii-id" to address the issue. Fixes: 3fa395d2c48a ("arm64: dts: add LS1046A DPAA FMan nodes") Signed-off-by: Madalin Bucur <madalin.bucur@oss.nxp.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02arm64: dts: ls1043a-rdb: correct RGMII delay mode to rgmii-idMadalin Bucur
commit 4022d808c45277693ea86478fab1f081ebf997e8 upstream. The correct setting for the RGMII ports on LS1043ARDB is to enable delay on both Rx and Tx so the interface mode used must be PHY_INTERFACE_MODE_RGMII_ID. Since commit 1b3047b5208a80 ("net: phy: realtek: add support for configuring the RX delay on RTL8211F") the Realtek 8211F PHY driver has control over the RGMII RX delay and it is disabling it for RGMII_TXID. The LS1043ARDB uses two such PHYs in RGMII_ID mode but in the device tree the mode was described as "rgmii_txid". This issue was not apparent at the time as the PHY driver took the same action for RGMII_TXID and RGMII_ID back then but it became visible (RX no longer working) after the above patch. Changing the phy-connection-type to "rgmii-id" to address the issue. Fixes: bf02f2ffe59c ("arm64: dts: add LS1043A DPAA FMan support") Signed-off-by: Madalin Bucur <madalin.bucur@oss.nxp.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02ARM: bcm2835-rpi-zero-w: Add missing pinctrl nameNick Hudson
commit 6687c201fdc3139315c2ea7ef96c157672805cdc upstream. Define the sdhci pinctrl state as "default" so it gets applied correctly and to match all other RPis. Fixes: 2c7c040c73e9 ("ARM: dts: bcm2835: Add Raspberry Pi Zero W") Signed-off-by: Nick Hudson <skrll@netbsd.org> Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02ARM: dts: oxnas: Fix clear-mask propertySungbo Eo
commit deeabb4c1341a12bf8b599e6a2f4cfa4fd74738c upstream. Disable all rps-irq interrupts during driver initialization to prevent an accidental interrupt on GIC. Fixes: 84316f4ef141 ("ARM: boot: dts: Add Oxford Semiconductor OX810SE dtsi") Fixes: 38d4a53733f5 ("ARM: dts: Add support for OX820 and Pogoplug V3") Signed-off-by: Sungbo Eo <mans0n@gorani.run> Acked-by: Neil Armstrong <narmstrong@baylibre.com> Signed-off-by: Neil Armstrong <narmstrong@baylibre.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02perf map: Fix off by one in strncpy() size argumentdisconnect3d
commit db2c549407d4a76563c579e4768f7d6d32afefba upstream. This patch fixes an off-by-one error in strncpy size argument in tools/perf/util/map.c. The issue is that in: strncmp(filename, "/system/lib/", 11) the passed string literal: "/system/lib/" has 12 bytes (without the NULL byte) and the passed size argument is 11. As a result, the logic won't match the ending "/" byte and will pass filepaths that are stored in other directories e.g. "/system/libmalicious/bin" or just "/system/libmalicious". This functionality seems to be present only on Android. I assume the /system/ directory is only writable by the root user, so I don't think this bug has much (or any) security impact. Fixes: eca818369996 ("perf tools: Add automatic remapping of Android libraries") Signed-off-by: disconnect3d <dominik.b.czarnota@gmail.com> Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> Cc: Changbin Du <changbin.du@intel.com> Cc: Jiri Olsa <jolsa@redhat.com> Cc: John Keeping <john@metanate.com> Cc: Mark Rutland <mark.rutland@arm.com> Cc: Michael Lentine <mlentine@google.com> Cc: Namhyung Kim <namhyung@kernel.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Song Liu <songliubraving@fb.com> Cc: Stephane Eranian <eranian@google.com> Link: http://lore.kernel.org/lkml/20200309104855.3775-1-dominik.b.czarnota@gmail.com Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02arm64: alternative: fix build with clang integrated assemblerIlie Halip
commit 6f5459da2b8736720afdbd67c4bd2d1edba7d0e3 upstream. Building an arm64 defconfig with clang's integrated assembler, this error occurs: <instantiation>:2:2: error: unrecognized instruction mnemonic _ASM_EXTABLE 9999b, 9f ^ arch/arm64/mm/cache.S:50:1: note: while in macro instantiation user_alt 9f, "dc cvau, x4", "dc civac, x4", 0 ^ While GNU as seems fine with case-sensitive macro instantiations, clang doesn't, so use the actual macro name (_asm_extable) as in the rest of the file. Also checked that the generated assembly matches the GCC output. Reviewed-by: Nick Desaulniers <ndesaulniers@google.com> Tested-by: Nick Desaulniers <ndesaulniers@google.com> Fixes: 290622efc76e ("arm64: fix "dc cvau" cache operation on errata-affected core") Link: https://github.com/ClangBuiltLinux/linux/issues/924 Signed-off-by: Ilie Halip <ilie.halip@gmail.com> Signed-off-by: Will Deacon <will@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02net: ks8851-ml: Fix IO operations, againMarek Vasut
commit 8262e6f9b1034ede34548a04dec4c302d92c9497 upstream. This patch reverts 58292104832f ("net: ks8851-ml: Fix 16-bit IO operation") and edacb098ea9c ("net: ks8851-ml: Fix 16-bit data access"), because it turns out these were only necessary due to buggy hardware. This patch adds a check for such a buggy hardware to prevent any such mistakes again. While working further on the KS8851 driver, it came to light that the KS8851-16MLL is capable of switching bus endianness by a hardware strap, EESK pin. If this strap is incorrect, the IO accesses require such endian swapping as is being reverted by this patch. Such swapping also impacts the performance significantly. Hence, in addition to removing it, detect that the hardware is broken, report to user, and fail to bind with such hardware. Fixes: 58292104832f ("net: ks8851-ml: Fix 16-bit IO operation") Fixes: edacb098ea9c ("net: ks8851-ml: Fix 16-bit data access") Signed-off-by: Marek Vasut <marex@denx.de> Cc: David S. Miller <davem@davemloft.net> Cc: Lukas Wunner <lukas@wunner.de> Cc: Petr Stetiar <ynezz@true.cz> Cc: YueHaibing <yuehaibing@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02gpiolib: acpi: Add quirk to ignore EC wakeups on HP x2 10 CHT + AXP288 modelHans de Goede
commit 0c625ccfe6f754d0896b8881f5c85bcb81699f1f upstream. There are at least 3 models of the HP x2 10 models: Bay Trail SoC + AXP288 PMIC Cherry Trail SoC + AXP288 PMIC Cherry Trail SoC + TI PMIC Like on the other HP x2 10 models we need to ignore wakeup for ACPI GPIO events on the external embedded-controller pin to avoid spurious wakeups on the HP x2 10 CHT + AXP288 model too. This commit adds an extra DMI based quirk for the HP x2 10 CHT + AXP288 model, ignoring wakeups for ACPI GPIO events on the EC interrupt pin on this model. This fixes spurious wakeups from suspend on this model. Fixes: aa23ca3d98f7 ("gpiolib: acpi: Add honor_wakeup module-option + quirk mechanism") Reported-and-tested-by: Marc Lehmann <schmorp@schmorp.de> Signed-off-by: Hans de Goede <hdegoede@redhat.com> Link: https://lore.kernel.org/r/20200302111225.6641-4-hdegoede@redhat.com Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02bpf: Explicitly memset some bpf info structures declared on the stackGreg Kroah-Hartman
commit 5c6f25887963f15492b604dd25cb149c501bbabf upstream. Trying to initialize a structure with "= {};" will not always clean out all padding locations in a structure. So be explicit and call memset to initialize everything for a number of bpf information structures that are then copied from userspace, sometimes from smaller memory locations than the size of the structure. Reported-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Yonghong Song <yhs@fb.com> Link: https://lore.kernel.org/bpf/20200320162258.GA794295@kroah.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02bpf: Explicitly memset the bpf_attr structureGreg Kroah-Hartman
commit 8096f229421f7b22433775e928d506f0342e5907 upstream. For the bpf syscall, we are relying on the compiler to properly zero out the bpf_attr union that we copy userspace data into. Unfortunately that doesn't always work properly, padding and other oddities might not be correctly zeroed, and in some tests odd things have been found when the stack is pre-initialized to other values. Fix this by explicitly memsetting the structure to 0 before using it. Reported-by: Maciej Żenczykowski <maze@google.com> Reported-by: John Stultz <john.stultz@linaro.org> Reported-by: Alexander Potapenko <glider@google.com> Reported-by: Alistair Delva <adelva@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Yonghong Song <yhs@fb.com> Link: https://android-review.googlesource.com/c/kernel/common/+/1235490 Link: https://lore.kernel.org/bpf/20200320094813.GA421650@kroah.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02platform/x86: pmc_atom: Add Lex 2I385SW to critclk_systems DMI tableGeorg Müller
commit 95b31e35239e5e1689e3d965d692a313c71bd8ab upstream. The Lex 2I385SW board has two Intel I211 ethernet controllers. Without this patch, only the first port is usable. The second port fails to start with the following message: igb: probe of 0000:02:00.0 failed with error -2 Fixes: 648e921888ad ("clk: x86: Stop marking clocks as CLK_IS_CRITICAL") Tested-by: Georg Müller <georgmueller@gmx.net> Signed-off-by: Georg Müller <georgmueller@gmx.net> Reviewed-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02vt: vt_ioctl: fix use-after-free in vt_in_use()Eric Biggers
commit 7cf64b18b0b96e751178b8d0505d8466ff5a448f upstream. vt_in_use() dereferences console_driver->ttys[i] without proper locking. This is broken because the tty can be closed and freed concurrently. We could fix this by using 'READ_ONCE(console_driver->ttys[i]) != NULL' and skipping the check of tty_struct::count. But, looking at console_driver->ttys[i] isn't really appropriate anyway because even if it is NULL the tty can still be in the process of being closed. Instead, fix it by making vt_in_use() require console_lock() and check whether the vt is allocated and has port refcount > 1. This works since following the patch "vt: vt_ioctl: fix VT_DISALLOCATE freeing in-use virtual console" the port refcount is incremented while the vt is open. Reproducer (very unreliable, but it worked for me after a few minutes): #include <fcntl.h> #include <linux/vt.h> int main() { int fd, nproc; struct vt_stat state; char ttyname[16]; fd = open("/dev/tty10", O_RDONLY); for (nproc = 1; nproc < 8; nproc *= 2) fork(); for (;;) { sprintf(ttyname, "/dev/tty%d", rand() % 8); close(open(ttyname, O_RDONLY)); ioctl(fd, VT_GETSTATE, &state); } } KASAN report: BUG: KASAN: use-after-free in vt_in_use drivers/tty/vt/vt_ioctl.c:48 [inline] BUG: KASAN: use-after-free in vt_ioctl+0x1ad3/0x1d70 drivers/tty/vt/vt_ioctl.c:657 Read of size 4 at addr ffff888065722468 by task syz-vt2/132 CPU: 0 PID: 132 Comm: syz-vt2 Not tainted 5.6.0-rc5-00130-g089b6d3654916 #13 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20191223_100556-anatol 04/01/2014 Call Trace: [...] vt_in_use drivers/tty/vt/vt_ioctl.c:48 [inline] vt_ioctl+0x1ad3/0x1d70 drivers/tty/vt/vt_ioctl.c:657 tty_ioctl+0x9db/0x11b0 drivers/tty/tty_io.c:2660 [...] Allocated by task 136: [...] kzalloc include/linux/slab.h:669 [inline] alloc_tty_struct+0x96/0x8a0 drivers/tty/tty_io.c:2982 tty_init_dev+0x23/0x350 drivers/tty/tty_io.c:1334 tty_open_by_driver drivers/tty/tty_io.c:1987 [inline] tty_open+0x3ca/0xb30 drivers/tty/tty_io.c:2035 [...] Freed by task 41: [...] kfree+0xbf/0x200 mm/slab.c:3757 free_tty_struct+0x8d/0xb0 drivers/tty/tty_io.c:177 release_one_tty+0x22d/0x2f0 drivers/tty/tty_io.c:1468 process_one_work+0x7f1/0x14b0 kernel/workqueue.c:2264 worker_thread+0x8b/0xc80 kernel/workqueue.c:2410 [...] Fixes: 4001d7b7fc27 ("vt: push down the tty lock so we can see what is left to tackle") Cc: <stable@vger.kernel.org> # v3.4+ Acked-by: Jiri Slaby <jslaby@suse.cz> Signed-off-by: Eric Biggers <ebiggers@google.com> Link: https://lore.kernel.org/r/20200322034305.210082-3-ebiggers@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02vt: vt_ioctl: fix VT_DISALLOCATE freeing in-use virtual consoleEric Biggers
commit ca4463bf8438b403596edd0ec961ca0d4fbe0220 upstream. The VT_DISALLOCATE ioctl can free a virtual console while tty_release() is still running, causing a use-after-free in con_shutdown(). This occurs because VT_DISALLOCATE considers a virtual console's 'struct vc_data' to be unused as soon as the corresponding tty's refcount hits 0. But actually it may be still being closed. Fix this by making vc_data be reference-counted via the embedded 'struct tty_port'. A newly allocated virtual console has refcount 1. Opening it for the first time increments the refcount to 2. Closing it for the last time decrements the refcount (in tty_operations::cleanup() so that it happens late enough), as does VT_DISALLOCATE. Reproducer: #include <fcntl.h> #include <linux/vt.h> #include <sys/ioctl.h> #include <unistd.h> int main() { if (fork()) { for (;;) close(open("/dev/tty5", O_RDWR)); } else { int fd = open("/dev/tty10", O_RDWR); for (;;) ioctl(fd, VT_DISALLOCATE, 5); } } KASAN report: BUG: KASAN: use-after-free in con_shutdown+0x76/0x80 drivers/tty/vt/vt.c:3278 Write of size 8 at addr ffff88806a4ec108 by task syz_vt/129 CPU: 0 PID: 129 Comm: syz_vt Not tainted 5.6.0-rc2 #11 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20191223_100556-anatol 04/01/2014 Call Trace: [...] con_shutdown+0x76/0x80 drivers/tty/vt/vt.c:3278 release_tty+0xa8/0x410 drivers/tty/tty_io.c:1514 tty_release_struct+0x34/0x50 drivers/tty/tty_io.c:1629 tty_release+0x984/0xed0 drivers/tty/tty_io.c:1789 [...] Allocated by task 129: [...] kzalloc include/linux/slab.h:669 [inline] vc_allocate drivers/tty/vt/vt.c:1085 [inline] vc_allocate+0x1ac/0x680 drivers/tty/vt/vt.c:1066 con_install+0x4d/0x3f0 drivers/tty/vt/vt.c:3229 tty_driver_install_tty drivers/tty/tty_io.c:1228 [inline] tty_init_dev+0x94/0x350 drivers/tty/tty_io.c:1341 tty_open_by_driver drivers/tty/tty_io.c:1987 [inline] tty_open+0x3ca/0xb30 drivers/tty/tty_io.c:2035 [...] Freed by task 130: [...] kfree+0xbf/0x1e0 mm/slab.c:3757 vt_disallocate drivers/tty/vt/vt_ioctl.c:300 [inline] vt_ioctl+0x16dc/0x1e30 drivers/tty/vt/vt_ioctl.c:818 tty_ioctl+0x9db/0x11b0 drivers/tty/tty_io.c:2660 [...] Fixes: 4001d7b7fc27 ("vt: push down the tty lock so we can see what is left to tackle") Cc: <stable@vger.kernel.org> # v3.4+ Reported-by: syzbot+522643ab5729b0421998@syzkaller.appspotmail.com Acked-by: Jiri Slaby <jslaby@suse.cz> Signed-off-by: Eric Biggers <ebiggers@google.com> Link: https://lore.kernel.org/r/20200322034305.210082-2-ebiggers@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02vt: vt_ioctl: remove unnecessary console allocation checksEric Biggers
commit 1aa6e058dd6cd04471b1f21298270014daf48ac9 upstream. The vc_cons_allocated() checks in vt_ioctl() and vt_compat_ioctl() are unnecessary because they can only be reached by calling ioctl() on an open tty, which implies the corresponding virtual console is allocated. And even if the virtual console *could* be freed concurrently, then these checks would be broken since they aren't done under console_lock, and the vc_data is dereferenced before them anyway. So, remove these unneeded checks to avoid confusion. Signed-off-by: Eric Biggers <ebiggers@google.com> Link: https://lore.kernel.org/r/20200224080326.295046-1-ebiggers@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-11 04:42:34 +0000