[PATCH 5.9 02/46] devlink: Make sure devlink instance and port are in same net namespace

From: Parav Pandit [ Upstream commit a7b43649507dae4e55ff0087cad4e4dd1c6d5b99 ] When devlink reload operation is not used, netdev of an Ethernet port may be present in different net namespace than the net namespace of the devlink instance. Ensure that both the devlink instance and devlink port

[PATCH 5.4 09/39] tun: honor IOCB_NOWAIT flag

From: Jens Axboe [ Upstream commit 5aac0390a63b8718237a61dd0d24a29201d1c94a ] tun only checks the file O_NONBLOCK flag, but it should also be checking the iocb IOCB_NOWAIT flag. Any fops using ->read/write_iter() should check both, otherwise it breaks users that correctly expect O_NONBLOCK

[PATCH 5.4 27/39] vxlan: fix error return code in __vxlan_dev_create()

From: Zhang Changzhong [ Upstream commit 832e09798c261cf58de3a68cfcc6556408c16a5a ] Fix to return a negative error code from the error handling case instead of 0, as done elsewhere in this function. Fixes: 0ce1822c2a08 ("vxlan: add adjacent link to limit depth level") Reported-by: Hulk Robot

[PATCH 5.9 23/46] inet_ecn: Fix endianness of checksum update when setting ECT(1)

From: "Toke H�iland-J�rgensen" [ Upstream commit 2867e1eac61016f59b3d730e3f7aa488e186e917 ] When adding support for propagating ECT(1) marking in IP headers it seems I suffered from endianness-confusion in the checksum update calculation: In fact the ECN field is in the *lower* bits of the

[PATCH 5.4 29/39] net: mvpp2: Fix error return code in mvpp2_open()

From: Wang Hai [ Upstream commit 82a10dc7f0960735f40e8d7d3bee56934291600f ] Fix to return negative error code -ENOENT from invalid configuration error handling case instead of 0, as done elsewhere in this function. Fixes: 4bb043262878 ("net: mvpp2: phylink support") Reported-by: Hulk Robot

[PATCH 5.9 22/46] tipc: fix incompatible mtu of transmission

From: Hoang Le [ Upstream commit 0643334902fcdc770e2d9555811200213339a3f6 ] In commit 682cd3cf946b6 ("tipc: confgiure and apply UDP bearer MTU on running links"), we introduced a function to change UDP bearer MTU and applied this new value across existing per-link. However, we did not apply

[PATCH 5.9 33/46] net: skbuff: ensure LSE is pullable before decrementing the MPLS ttl

From: Davide Caratti [ Upstream commit 13de4ed9e3a9ccbe54d05f7d5c773f69ecaf6c64 ] skb_mpls_dec_ttl() reads the LSE without ensuring that it is contained in the skb "linear" area. Fix this calling pskb_may_pull() before reading the current ttl. Found by code inspection. Fixes: 2a2ea50870ba

[PATCH 5.9 26/46] dpaa_eth: copy timestamp fields to new skb in A-050385 workaround

From: Yangbo Lu [ Upstream commit 07500a6085806d97039ebcba8d9b8b29129f0106 ] The timestamp fields should be copied to new skb too in A-050385 workaround for later TX timestamping handling. Fixes: 3c68b8fffb48 ("dpaa_eth: FMan erratum A050385 workaround") Signed-off-by: Yangbo Lu Acked-by:

[PATCH 5.9 36/46] net/mlx5: DR, Proper handling of unsupported Connect-X6DX SW steering

From: Yevgeny Kliteynik [ Upstream commit d421e466c2373095f165ddd25cbabd6c5b077928 ] STEs format for Connect-X5 and Connect-X6DX different. Currently, on Connext-X6DX the SW steering would break at some point when building STEs w/o giving a proper error message. Fix this by checking the STE

[PATCH 5.9 11/46] tun: honor IOCB_NOWAIT flag

From: Jens Axboe [ Upstream commit 5aac0390a63b8718237a61dd0d24a29201d1c94a ] tun only checks the file O_NONBLOCK flag, but it should also be checking the iocb IOCB_NOWAIT flag. Any fops using ->read/write_iter() should check both, otherwise it breaks users that correctly expect O_NONBLOCK

[PATCH 5.9 30/46] vxlan: fix error return code in __vxlan_dev_create()

From: Zhang Changzhong [ Upstream commit 832e09798c261cf58de3a68cfcc6556408c16a5a ] Fix to return a negative error code from the error handling case instead of 0, as done elsewhere in this function. Fixes: 0ce1822c2a08 ("vxlan: add adjacent link to limit depth level") Reported-by: Hulk Robot

[PATCH 5.9 37/46] net/mlx5: Fix wrong address reclaim when command interface is down

From: Eran Ben Elisha [ Upstream commit 1d2bb5ad89f47d8ce8aedc70ef85059ab3870292 ] When command interface is down, driver to reclaim all 4K page chucks that were hold by the Firmeware. Fix a bug for 64K page size systems, where driver repeatedly released only the first chunk of the page.

[PATCH 5.9 45/46] uapi: fix statx attribute value overlap for DAX & MOUNT_ROOT

From: Eric Sandeen commit 72d1249e2ffdbc344e465031ec5335fa3489d62e upstream. STATX_ATTR_MOUNT_ROOT and STATX_ATTR_DAX got merged with the same value, so one of them needs fixing. Move STATX_ATTR_DAX. While we're in here, clarify the value-matching scheme for some of the attributes, and

[PATCH 5.9 40/46] Input: xpad - support Ardwiino Controllers

From: Sanjay Govind commit 2aab1561439032be2e98811dd0ddbeb5b2ae4c61 upstream. This commit adds support for Ardwiino Controllers Signed-off-by: Sanjay Govind Link: https://lore.kernel.org/r/20201201071922.131666-1-sanjay.govi...@gmail.com Cc: sta...@vger.kernel.org Signed-off-by: Dmitry

[PATCH 5.9 13/46] vsock/virtio: discard packets only when socket is really closed

From: Stefano Garzarella [ Upstream commit 3fe356d58efae54dade9ec94ea7c919ed20cf4db ] Starting from commit 8692cefc433f ("virtio_vsock: Fix race condition in virtio_transport_recv_pkt"), we discard packets in virtio_transport_recv_pkt() if the socket has been released. When the socket is

[PATCH 5.9 42/46] Input: atmel_mxt_ts - fix lost interrupts

From: Linus Walleij commit 8c3b55a299c325830a987de21dab6a89ecb71164 upstream. After commit 74d905d2d38a devices requiring the workaround for edge triggered interrupts stopped working. The hardware needs the quirk to be used before even proceeding to check if the quirk is needed because

[PATCH 5.9 43/46] tracing: Fix alignment of static buffer

From: Minchan Kim commit 8fa655a3a0013a0c2a2aada6f39a93ee6fc25549 upstream. With 5.9 kernel on ARM64, I found ftrace_dump output was broken but it had no problem with normal output "cat /sys/kernel/debug/tracing/trace". With investigation, it seems coping the data into temporal buffer seems to

[PATCH 5.9 07/46] net/tls: Protect from calling tls_dev_del for TLS RX twice

From: Maxim Mikityanskiy [ Upstream commit 025cc2fb6a4e84e9a0552c0017dcd1c24b7ac7da ] tls_device_offload_cleanup_rx doesn't clear tls_ctx->netdev after calling tls_dev_del if TLX TX offload is also enabled. Clearing tls_ctx->netdev gets postponed until tls_device_gc_task. It leaves a time frame

[PATCH 5.9 44/46] tracing: Remove WARN_ON in start_thread()

From: Vasily Averin commit 310e3a4b5a4fc718a72201c1e4cf5c64ac6f5442 upstream. This patch reverts commit 978defee11a5 ("tracing: Do a WARN_ON() if start_thread() in hwlat is called when thread exists") .start hook can be legally called several times if according tracer is stopped screen

[PATCH 5.9 14/46] mptcp: fix NULL ptr dereference on bad MPJ

From: Paolo Abeni [ Upstream commit d3ab78858f1451351221061a1c365495df196500 ] If an msk listener receives an MPJ carrying an invalid token, it will zero the request socket msk entry. That should later cause fallback and subflow reset - as per RFC - at subflow_syn_recv_sock() time due to

[PATCH 5.9 46/46] drm/i915/gt: Fixup tgl mocs for PTE tracking

From: Chris Wilson commit be33805c65297611971003d72e7f9235e23ec84d upstream. Forcing mocs:1 [used for our winsys follows-pte mode] to be cached caused display glitches. Though it is documented as deprecated (and so likely behaves as uncached) use the follow-pte bit and force it out of L3 cache.

[PATCH 5.9 15/46] net/packet: fix packet receive on L3 devices without visible hard header

From: Eyal Birger [ Upstream commit d549699048b4b5c22dd710455bcdb76966e55aa3 ] In the patchset merged by commit b9fcf0a0d826 ("Merge branch 'support-AF_PACKET-for-layer-3-devices'") L3 devices which did not have header_ops were given one for the purpose of protocol parsing on af_packet transmit

[PATCH 5.9 38/46] net: mlx5e: fix fs_tcp.c build when IPV6 is not enabled

From: Randy Dunlap [ Upstream commit 8a78a440108e55ddd845b0ef46df575248667520 ] Fix build when CONFIG_IPV6 is not enabled by making a function be built conditionally. Fixes these build errors and warnings: ../drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c: In function

[PATCH 5.9 41/46] Input: i8042 - add ByteSpeed touchpad to noloop table

From: Po-Hsu Lin commit a48491c65b513e5cdc3e7a886a4db915f848a5f5 upstream. It looks like the C15B laptop got another vendor: ByteSpeed LLC. Avoid AUX loopback on this touchpad as well, thus input subsystem will be able to recognize a Synaptics touchpad in the AUX port. BugLink:

[PATCH 5.9 39/46] ALSA: usb-audio: US16x08: fix value count for level meters

From: Hector Martin commit 402d5840b0d40a2a26c8651165d29b534abb6d36 upstream. The level meter control returns 34 integers of info. This fixes: snd-usb-audio 3-1:1.0: control 2:0:0:Level Meter:0: access overflow Fixes: d2bb390a2081 ("ALSA: usb-audio: Tascam US-16x08 DSP mixer quirk") Cc:

[PATCH 5.9 16/46] netfilter: bridge: reset skb->pkt_type after NF_INET_POST_ROUTING traversal

From: Antoine Tenart [ Upstream commit 44f64f23bae2f0fad25503bc7ab86cd08d04cd47 ] Netfilter changes PACKET_OTHERHOST to PACKET_HOST before invoking the hooks as, while it's an expected value for a bridge, routing expects PACKET_HOST. The change is undone later on after hook traversal. This can

[PATCH 5.9 10/46] tcp: Set INET_ECN_xmit configuration in tcp_reinit_congestion_control

From: Alexander Duyck [ Upstream commit 55472017a4219ca965a957584affdb17549ae4a4 ] When setting congestion control via a BPF program it is seen that the SYN/ACK for packets within a given flow will not include the ECT0 flag. A bit of simple printk debugging shows that when this is configured

[PATCH 5.9 34/46] net: openvswitch: ensure LSE is pullable before reading it

From: Davide Caratti [ Upstream commit 43c13605bad44b8abbc9776d6e63f62ccb7a47d6 ] when openvswitch is configured to mangle the LSE, the current value is read from the packet dereferencing 4 bytes at mpls_hdr(): ensure that the label is contained in the skb "linear" area. Found by code

[PATCH 5.9 12/46] usbnet: ipheth: fix connectivity with iOS 14

From: Yves-Alexis Perez [ Upstream commit f33d9e2b48a34e1558b67a473a1fc1d6e793f93c ] Starting with iOS 14 released in September 2020, connectivity using the personal hotspot USB tethering function of iOS devices is broken. Communication between the host and the device (for example ICMP traffic

[PATCH 5.9 32/46] net: mvpp2: Fix error return code in mvpp2_open()

From: Wang Hai [ Upstream commit 82a10dc7f0960735f40e8d7d3bee56934291600f ] Fix to return negative error code -ENOENT from invalid configuration error handling case instead of 0, as done elsewhere in this function. Fixes: 4bb043262878 ("net: mvpp2: phylink support") Reported-by: Hulk Robot

[PATCH 5.9 29/46] net: pasemi: fix error return code in pasemi_mac_open()

From: Zhang Changzhong [ Upstream commit aba84871bd4f52c4dfcf3ad5d4501a6c9d2de90e ] Fix to return a negative error code from the error handling case instead of 0, as done elsewhere in this function. Fixes: 72b05b9940f0 ("pasemi_mac: RX/TX ring management cleanup") Fixes: 8d636d8bc5ff

[PATCH 5.9 27/46] net/x25: prevent a couple of overflows

From: Dan Carpenter [ Upstream commit 6ee50c8e262a0f0693dad264c3c99e30e6442a56 ] The .x25_addr[] address comes from the user and is not necessarily NUL terminated. This leads to a couple problems. The first problem is that the strlen() in x25_bind() can read beyond the end of the buffer. The

[PATCH 5.9 35/46] net/sched: act_mpls: ensure LSE is pullable before reading it

From: Davide Caratti [ Upstream commit 9608fa653059c3f72faab0c148ac8773c46e7314 ] when 'act_mpls' is used to mangle the LSE, the current value is read from the packet dereferencing 4 bytes at mpls_hdr(): ensure that the label is contained in the skb "linear" area. Found by code inspection.

[PATCH 5.9 09/46] sock: set sk_err to ee_errno on dequeue from errq

From: Willem de Bruijn [ Upstream commit 985f7337421a811cb354ca93882f943c8335a6f5 ] When setting sk_err, set it to ee_errno, not ee_origin. Commit f5f99309fa74 ("sock: do not set sk_err in sock_dequeue_err_skb") disabled updating sk_err on errq dequeue, which is correct for most error types

[PATCH 5.9 25/46] net: ip6_gre: set dev->hard_header_len when using header_ops

From: Antoine Tenart [ Upstream commit 832ba596494b2c9eac7760259eff2d8b7dcad0ee ] syzkaller managed to crash the kernel using an NBMA ip6gre interface. I could reproduce it creating an NBMA ip6gre interface and forwarding traffic to it: skbuff: skb_under_panic: text:8250e927 len:148

[PATCH 5.9 31/46] chelsio/chtls: fix a double free in chtls_setkey()

From: Dan Carpenter [ Upstream commit 391119fb5c5c4bdb4d57c7ffeb5e8d18560783d1 ] The "skb" is freed by the transmit code in cxgb4_ofld_send() and we shouldn't use it again. But in the current code, if we hit an error later on in the function then the clean up code will call kfree_skb(skb) and

[PATCH 5.9 20/46] ibmvnic: Ensure that SCRQ entry reads are correctly ordered

From: Thomas Falcon [ Upstream commit b71ec952234610b4f90ef17a2fdcb124d5320070 ] Ensure that received Subordinate Command-Response Queue (SCRQ) entries are properly read in order by the driver. These queues are used in the ibmvnic device to process RX buffer and TX completion descriptors.

[PATCH 5.9 21/46] ibmvnic: Fix TX completion error handling

From: Thomas Falcon [ Upstream commit ba246c175116e2e8fa4fdfa5f8e958e086a9a818 ] TX completions received with an error return code are not being processed properly. When an error code is seen, do not proceed to the next completion before cleaning up the existing entry's data structures. Fixes:

[PATCH 5.9 28/46] cxgb3: fix error return code in t3_sge_alloc_qset()

From: Zhang Changzhong [ Upstream commit ff9924897f8bfed82e61894b373ab9d2dfea5b10 ] Fix to return a negative error code from the error handling case instead of 0, as done elsewhere in this function. Fixes: b1fb1f280d09 ("cxgb3 - Fix dma mapping error path") Reported-by: Hulk Robot

[PATCH 5.9 19/46] chelsio/chtls: fix panic during unload reload chtls

From: Vinay Kumar Yadav [ Upstream commit e3d5e971d2f83d8ddd4b91a50cea4517fb488383 ] there is kernel panic in inet_twsk_free() while chtls module unload when socket is in TIME_WAIT state because sk_prot_creator was not preserved on connection socket. Fixes: cc35c88ae4db ("crypto : chtls - CPL

[PATCH 5.9 17/46] ipv4: Fix tos mask in inet_rtm_getroute()

From: Guillaume Nault [ Upstream commit 1ebf179037cb46c19da3a9c1e2ca16e7a754b75e ] When inet_rtm_getroute() was converted to use the RCU variants of ip_route_input() and ip_route_output_key(), the TOS parameters stopped being masked with IPTOS_RT_MASK before doing the route lookup. As a

[PATCH 5.9 05/46] net: openvswitch: fix TTL decrement action netlink message format

From: Eelco Chaudron [ Upstream commit 69929d4c49e182f8526d42c43b37b460d562d3a0 ] Currently, the openvswitch module is not accepting the correctly formated netlink message for the TTL decrement action. For both setting and getting the dec_ttl action, the actions should be nested in the

[PATCH 5.9 00/46] 5.9.13-rc1 review

This is the start of the stable review cycle for the 5.9.13 release. There are 46 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Tue, 08 Dec 2020 11:15:42 +. Anything

[PATCH 5.9 18/46] dt-bindings: net: correct interrupt flags in examples

From: Krzysztof Kozlowski [ Upstream commit 4d521943f76bd0d1e68ea5e02df7aadd30b2838a ] GPIO_ACTIVE_x flags are not correct in the context of interrupt flags. These are simple defines so they could be used in DTS but they will not have the same meaning: 1. GPIO_ACTIVE_HIGH = 0 = IRQ_TYPE_NONE 2.

[PATCH 5.9 24/46] geneve: pull IP header before ECN decapsulation

From: Eric Dumazet [ Upstream commit 4179b00c04d18ea7013f68d578d80f3c9d13150a ] IP_ECN_decapsulate() and IP6_ECN_decapsulate() assume IP header is already pulled. geneve does not ensure this yet. Fixing this generically in IP_ECN_decapsulate() and IP6_ECN_decapsulate() is not possible, since

[PATCH 5.9 03/46] ipv6: addrlabel: fix possible memory leak in ip6addrlbl_net_init

From: Wang Hai [ Upstream commit e255e11e66da8281e337e4e352956e8a4999fca4 ] kmemleak report a memory leak as follows: unreferenced object 0x8880059c6a00 (size 64): comm "ip", pid 23696, jiffies 4296590183 (age 1755.384s) hex dump (first 32 bytes): 20 01 00 10 00 00 00 00 00 00 00

[PATCH 5.9 01/46] devlink: Hold rtnl lock while reading netdev attributes

From: Parav Pandit [ Upstream commit b187c9b4178b87954dbc94e78a7094715794714f ] A netdevice of a devlink port can be moved to different net namespace than its parent devlink instance. This scenario occurs when devlink reload is not used. When netdevice is undergoing migration to net namespace,

[PATCH 5.4 37/39] Input: i8042 - add ByteSpeed touchpad to noloop table

From: Po-Hsu Lin commit a48491c65b513e5cdc3e7a886a4db915f848a5f5 upstream. It looks like the C15B laptop got another vendor: ByteSpeed LLC. Avoid AUX loopback on this touchpad as well, thus input subsystem will be able to recognize a Synaptics touchpad in the AUX port. BugLink:

[PATCH 5.4 38/39] tracing: Remove WARN_ON in start_thread()

From: Vasily Averin commit 310e3a4b5a4fc718a72201c1e4cf5c64ac6f5442 upstream. This patch reverts commit 978defee11a5 ("tracing: Do a WARN_ON() if start_thread() in hwlat is called when thread exists") .start hook can be legally called several times if according tracer is stopped screen

[PATCH 5.9 08/46] rose: Fix Null pointer dereference in rose_send_frame()

From: Anmol Karn [ Upstream commit 3b3fd068c56e3fbea30090859216a368398e39bf ] rose_send_frame() dereferences `neigh->dev` when called from rose_transmit_clear_request(), and the first occurrence of the `neigh` is in rose_loopback_timer() as `rose_loopback_neigh`, and it is initialized in

[PATCH 5.4 36/39] Input: xpad - support Ardwiino Controllers

From: Sanjay Govind commit 2aab1561439032be2e98811dd0ddbeb5b2ae4c61 upstream. This commit adds support for Ardwiino Controllers Signed-off-by: Sanjay Govind Link: https://lore.kernel.org/r/20201201071922.131666-1-sanjay.govi...@gmail.com Cc: sta...@vger.kernel.org Signed-off-by: Dmitry

[PATCH 5.9 06/46] net/tls: missing received data after fast remote close

From: Vadim Fedorenko [ Upstream commit 20ffc7adf53a5fd3d19751fbff7895bcca66686e ] In case when tcp socket received FIN after some data and the parser haven't started before reading data caller will receive an empty buffer. This behavior differs from plain TCP socket and leads to special

[PATCH 5.9 04/46] net/af_iucv: set correct sk_protocol for child sockets

From: Julian Wiedmann [ Upstream commit c5dab0941fcdc9664eb0ec0d4d51433216d91336 ] Child sockets erroneously inherit their parent's sk_type (ie. SOCK_*), instead of the PF_IUCV protocol that the parent was created with in iucv_sock_create(). We're currently not using sk->sk_protocol ourselves,

[PATCH 5.4 32/39] net/sched: act_mpls: ensure LSE is pullable before reading it

From: Davide Caratti [ Upstream commit 9608fa653059c3f72faab0c148ac8773c46e7314 ] when 'act_mpls' is used to mangle the LSE, the current value is read from the packet dereferencing 4 bytes at mpls_hdr(): ensure that the label is contained in the skb "linear" area. Found by code inspection.

[PATCH 5.4 33/39] net/mlx5: DR, Proper handling of unsupported Connect-X6DX SW steering

From: Yevgeny Kliteynik [ Upstream commit d421e466c2373095f165ddd25cbabd6c5b077928 ] STEs format for Connect-X5 and Connect-X6DX different. Currently, on Connext-X6DX the SW steering would break at some point when building STEs w/o giving a proper error message. Fix this by checking the STE

[PATCH 5.4 39/39] RDMA/i40iw: Address an mmap handler exploit in i40iw

From: Shiraz Saleem commit 2ed381439e89fa6d1a0839ef45ccd45d99d8e915 upstream. i40iw_mmap manipulates the vma->vm_pgoff to differentiate a push page mmap vs a doorbell mmap, and uses it to compute the pfn in remap_pfn_range without any validation. This is vulnerable to an mmap exploit as

[PATCH 5.4 00/39] 5.4.82-rc1 review

This is the start of the stable review cycle for the 5.4.82 release. There are 39 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Tue, 08 Dec 2020 11:15:42 +. Anything

[PATCH 5.4 07/39] sock: set sk_err to ee_errno on dequeue from errq

From: Willem de Bruijn [ Upstream commit 985f7337421a811cb354ca93882f943c8335a6f5 ] When setting sk_err, set it to ee_errno, not ee_origin. Commit f5f99309fa74 ("sock: do not set sk_err in sock_dequeue_err_skb") disabled updating sk_err on errq dequeue, which is correct for most error types

[PATCH 5.4 08/39] tcp: Set INET_ECN_xmit configuration in tcp_reinit_congestion_control

From: Alexander Duyck [ Upstream commit 55472017a4219ca965a957584affdb17549ae4a4 ] When setting congestion control via a BPF program it is seen that the SYN/ACK for packets within a given flow will not include the ECT0 flag. A bit of simple printk debugging shows that when this is configured

[PATCH 5.4 31/39] net: openvswitch: ensure LSE is pullable before reading it

From: Davide Caratti [ Upstream commit 43c13605bad44b8abbc9776d6e63f62ccb7a47d6 ] when openvswitch is configured to mangle the LSE, the current value is read from the packet dereferencing 4 bytes at mpls_hdr(): ensure that the label is contained in the skb "linear" area. Found by code

[PATCH 5.4 35/39] ALSA: usb-audio: US16x08: fix value count for level meters

From: Hector Martin commit 402d5840b0d40a2a26c8651165d29b534abb6d36 upstream. The level meter control returns 34 integers of info. This fixes: snd-usb-audio 3-1:1.0: control 2:0:0:Level Meter:0: access overflow Fixes: d2bb390a2081 ("ALSA: usb-audio: Tascam US-16x08 DSP mixer quirk") Cc:

[PATCH 5.4 30/39] net: skbuff: ensure LSE is pullable before decrementing the MPLS ttl

From: Davide Caratti [ Upstream commit 13de4ed9e3a9ccbe54d05f7d5c773f69ecaf6c64 ] skb_mpls_dec_ttl() reads the LSE without ensuring that it is contained in the skb "linear" area. Fix this calling pskb_may_pull() before reading the current ttl. Found by code inspection. Fixes: 2a2ea50870ba

[PATCH 5.4 05/39] net/tls: Protect from calling tls_dev_del for TLS RX twice

From: Maxim Mikityanskiy [ Upstream commit 025cc2fb6a4e84e9a0552c0017dcd1c24b7ac7da ] tls_device_offload_cleanup_rx doesn't clear tls_ctx->netdev after calling tls_dev_del if TLX TX offload is also enabled. Clearing tls_ctx->netdev gets postponed until tls_device_gc_task. It leaves a time frame

[PATCH 5.4 26/39] net: pasemi: fix error return code in pasemi_mac_open()

From: Zhang Changzhong [ Upstream commit aba84871bd4f52c4dfcf3ad5d4501a6c9d2de90e ] Fix to return a negative error code from the error handling case instead of 0, as done elsewhere in this function. Fixes: 72b05b9940f0 ("pasemi_mac: RX/TX ring management cleanup") Fixes: 8d636d8bc5ff

[PATCH 5.4 21/39] inet_ecn: Fix endianness of checksum update when setting ECT(1)

From: "Toke H�iland-J�rgensen" [ Upstream commit 2867e1eac61016f59b3d730e3f7aa488e186e917 ] When adding support for propagating ECT(1) marking in IP headers it seems I suffered from endianness-confusion in the checksum update calculation: In fact the ECN field is in the *lower* bits of the

[PATCH 5.4 24/39] net/x25: prevent a couple of overflows

From: Dan Carpenter [ Upstream commit 6ee50c8e262a0f0693dad264c3c99e30e6442a56 ] The .x25_addr[] address comes from the user and is not necessarily NUL terminated. This leads to a couple problems. The first problem is that the strlen() in x25_bind() can read beyond the end of the buffer. The

[PATCH 5.4 23/39] net: ip6_gre: set dev->hard_header_len when using header_ops

From: Antoine Tenart [ Upstream commit 832ba596494b2c9eac7760259eff2d8b7dcad0ee ] syzkaller managed to crash the kernel using an NBMA ip6gre interface. I could reproduce it creating an NBMA ip6gre interface and forwarding traffic to it: skbuff: skb_under_panic: text:8250e927 len:148

Re: [PATCH v2 0/9] Add support for Microsoft Surface System Aggregator Module

On Sun, Dec 06, 2020 at 11:41:46AM +0100, Hans de Goede wrote: > Hi, > > On 12/6/20 11:33 AM, Leon Romanovsky wrote: > > On Sun, Dec 06, 2020 at 11:04:06AM +0100, Hans de Goede wrote: > > > > >> But there is a difference between being careful and just nacking > >> it because no new UAPI may be

[PATCH 5.4 20/39] ibmvnic: Fix TX completion error handling

From: Thomas Falcon [ Upstream commit ba246c175116e2e8fa4fdfa5f8e958e086a9a818 ] TX completions received with an error return code are not being processed properly. When an error code is seen, do not proceed to the next completion before cleaning up the existing entry's data structures. Fixes:

[PATCH 5.4 22/39] geneve: pull IP header before ECN decapsulation

From: Eric Dumazet [ Upstream commit 4179b00c04d18ea7013f68d578d80f3c9d13150a ] IP_ECN_decapsulate() and IP6_ECN_decapsulate() assume IP header is already pulled. geneve does not ensure this yet. Fixing this generically in IP_ECN_decapsulate() and IP6_ECN_decapsulate() is not possible, since

[PATCH 5.4 19/39] ibmvnic: Ensure that SCRQ entry reads are correctly ordered

From: Thomas Falcon [ Upstream commit b71ec952234610b4f90ef17a2fdcb124d5320070 ] Ensure that received Subordinate Command-Response Queue (SCRQ) entries are properly read in order by the driver. These queues are used in the ibmvnic device to process RX buffer and TX completion descriptors.

[PATCH 5.4 17/39] dt-bindings: net: correct interrupt flags in examples

From: Krzysztof Kozlowski [ Upstream commit 4d521943f76bd0d1e68ea5e02df7aadd30b2838a ] GPIO_ACTIVE_x flags are not correct in the context of interrupt flags. These are simple defines so they could be used in DTS but they will not have the same meaning: 1. GPIO_ACTIVE_HIGH = 0 = IRQ_TYPE_NONE 2.

[PATCH 5.4 02/39] ipv6: addrlabel: fix possible memory leak in ip6addrlbl_net_init

From: Wang Hai [ Upstream commit e255e11e66da8281e337e4e352956e8a4999fca4 ] kmemleak report a memory leak as follows: unreferenced object 0x8880059c6a00 (size 64): comm "ip", pid 23696, jiffies 4296590183 (age 1755.384s) hex dump (first 32 bytes): 20 01 00 10 00 00 00 00 00 00 00

[PATCH 5.4 16/39] ipv4: Fix tos mask in inet_rtm_getroute()

From: Guillaume Nault [ Upstream commit 1ebf179037cb46c19da3a9c1e2ca16e7a754b75e ] When inet_rtm_getroute() was converted to use the RCU variants of ip_route_input() and ip_route_output_key(), the TOS parameters stopped being masked with IPTOS_RT_MASK before doing the route lookup. As a

[PATCH 5.4 15/39] netfilter: bridge: reset skb->pkt_type after NF_INET_POST_ROUTING traversal

From: Antoine Tenart [ Upstream commit 44f64f23bae2f0fad25503bc7ab86cd08d04cd47 ] Netfilter changes PACKET_OTHERHOST to PACKET_HOST before invoking the hooks as, while it's an expected value for a bridge, routing expects PACKET_HOST. The change is undone later on after hook traversal. This can

[PATCH 5.4 14/39] sched/fair: Fix unthrottle_cfs_rq() for leaf_cfs_rq list

From: Vincent Guittot [ Upstream commit 39f23ce07b9355d05a64ae303ce20d1c4b92b957 ] Although not exactly identical, unthrottle_cfs_rq() and enqueue_task_fair() are quite close and follow the same sequence for enqueuing an entity in the cfs hierarchy. Modify unthrottle_cfs_rq() to use the same

[PATCH 5.4 12/39] staging/octeon: fix up merge error

From: Randy Dunlap commit 673b41e04a035d760bc0aff83fa9ee24fd9c2779 upstream. There's a semantic conflict in the Octeon staging network driver, which used the skb_reset_tc() function to reset skb state when re-using an skb. But that inline helper function was removed in mainline by commit

[PATCH 5.4 13/39] ima: extend boot_aggregate with kernel measurements

From: Maurizio Drocco [ Upstream commit 20c59ce010f84300f6c655d32db2610d3433f85c ] Registers 8-9 are used to store measurements of the kernel and its command line (e.g., grub2 bootloader with tpm module enabled). IMA should include them in the boot aggregate. Registers 8-9 should be only

[PATCH 5.4 11/39] bonding: wait for sysfs kobject destruction before freeing struct slave

From: Jamie Iles [ Upstream commit b9ad3e9f5a7a760ab068e33e1f18d240ba32ce92 ] syzkaller found that with CONFIG_DEBUG_KOBJECT_RELEASE=y, releasing a struct slave device could result in the following splat: kobject: 'bonding_slave' (cecdd4fe): kobject_release, parent 74ceb2b2

[PATCH 5.4 01/39] devlink: Hold rtnl lock while reading netdev attributes

From: Parav Pandit [ Upstream commit b187c9b4178b87954dbc94e78a7094715794714f ] A netdevice of a devlink port can be moved to different net namespace than its parent devlink instance. This scenario occurs when devlink reload is not used. When netdevice is undergoing migration to net namespace,

[PATCH 5.4 10/39] usbnet: ipheth: fix connectivity with iOS 14

From: Yves-Alexis Perez [ Upstream commit f33d9e2b48a34e1558b67a473a1fc1d6e793f93c ] Starting with iOS 14 released in September 2020, connectivity using the personal hotspot USB tethering function of iOS devices is broken. Communication between the host and the device (for example ICMP traffic

[PATCH 4.19 18/32] geneve: pull IP header before ECN decapsulation

From: Eric Dumazet [ Upstream commit 4179b00c04d18ea7013f68d578d80f3c9d13150a ] IP_ECN_decapsulate() and IP6_ECN_decapsulate() assume IP header is already pulled. geneve does not ensure this yet. Fixing this generically in IP_ECN_decapsulate() and IP6_ECN_decapsulate() is not possible, since

[PATCH 4.19 26/32] chelsio/chtls: fix panic during unload reload chtls

From: Vinay Kumar Yadav [ Upstream commit e3d5e971d2f83d8ddd4b91a50cea4517fb488383 ] there is kernel panic in inet_twsk_free() while chtls module unload when socket is in TIME_WAIT state because sk_prot_creator was not preserved on connection socket. Fixes: cc35c88ae4db ("crypto : chtls - CPL

[PATCH 4.19 25/32] net/mlx5: Fix wrong address reclaim when command interface is down

From: Eran Ben Elisha [ Upstream commit 1d2bb5ad89f47d8ce8aedc70ef85059ab3870292 ] When command interface is down, driver to reclaim all 4K page chucks that were hold by the Firmeware. Fix a bug for 64K page size systems, where driver repeatedly released only the first chunk of the page.

[PATCH 4.19 27/32] dt-bindings: net: correct interrupt flags in examples

From: Krzysztof Kozlowski [ Upstream commit 4d521943f76bd0d1e68ea5e02df7aadd30b2838a ] GPIO_ACTIVE_x flags are not correct in the context of interrupt flags. These are simple defines so they could be used in DTS but they will not have the same meaning: 1. GPIO_ACTIVE_HIGH = 0 = IRQ_TYPE_NONE 2.

[PATCH 4.19 24/32] net: mvpp2: Fix error return code in mvpp2_open()

From: Wang Hai [ Upstream commit 82a10dc7f0960735f40e8d7d3bee56934291600f ] Fix to return negative error code -ENOENT from invalid configuration error handling case instead of 0, as done elsewhere in this function. Fixes: 4bb043262878 ("net: mvpp2: phylink support") Reported-by: Hulk Robot

[PATCH 4.14 11/20] ibmvnic: Fix TX completion error handling

From: Thomas Falcon [ Upstream commit ba246c175116e2e8fa4fdfa5f8e958e086a9a818 ] TX completions received with an error return code are not being processed properly. When an error code is seen, do not proceed to the next completion before cleaning up the existing entry's data structures. Fixes:

[PATCH 4.19 03/32] net/tls: missing received data after fast remote close

From: Vadim Fedorenko [ Upstream commit 20ffc7adf53a5fd3d19751fbff7895bcca66686e ] In case when tcp socket received FIN after some data and the parser haven't started before reading data caller will receive an empty buffer. This behavior differs from plain TCP socket and leads to special

[PATCH 4.19 12/32] i40e: Fix removing driver while bare-metal VFs pass traffic

From: Sylwester Dziedziuch [ Upstream commit 2980cbd4dce7b1e9bf57df3ced43a7b184986f50 ] Prevent VFs from resetting when PF driver is being unloaded: - introduce new pf state: __I40E_VF_RESETS_DISABLED; - check if pf state has __I40E_VF_RESETS_DISABLED state set, if so, disable any further

[PATCH 4.14 12/20] net/x25: prevent a couple of overflows

From: Dan Carpenter [ Upstream commit 6ee50c8e262a0f0693dad264c3c99e30e6442a56 ] The .x25_addr[] address comes from the user and is not necessarily NUL terminated. This leads to a couple problems. The first problem is that the strlen() in x25_bind() can read beyond the end of the buffer. The

[PATCH 4.14 05/20] tun: honor IOCB_NOWAIT flag

From: Jens Axboe [ Upstream commit 5aac0390a63b8718237a61dd0d24a29201d1c94a ] tun only checks the file O_NONBLOCK flag, but it should also be checking the iocb IOCB_NOWAIT flag. Any fops using ->read/write_iter() should check both, otherwise it breaks users that correctly expect O_NONBLOCK

[PATCH 4.19 32/32] RDMA/i40iw: Address an mmap handler exploit in i40iw

From: Shiraz Saleem commit 2ed381439e89fa6d1a0839ef45ccd45d99d8e915 upstream. i40iw_mmap manipulates the vma->vm_pgoff to differentiate a push page mmap vs a doorbell mmap, and uses it to compute the pfn in remap_pfn_range without any validation. This is vulnerable to an mmap exploit as

[PATCH 4.19 22/32] net: pasemi: fix error return code in pasemi_mac_open()

From: Zhang Changzhong [ Upstream commit aba84871bd4f52c4dfcf3ad5d4501a6c9d2de90e ] Fix to return a negative error code from the error handling case instead of 0, as done elsewhere in this function. Fixes: 72b05b9940f0 ("pasemi_mac: RX/TX ring management cleanup") Fixes: 8d636d8bc5ff

[PATCH 4.19 23/32] chelsio/chtls: fix a double free in chtls_setkey()

From: Dan Carpenter [ Upstream commit 391119fb5c5c4bdb4d57c7ffeb5e8d18560783d1 ] The "skb" is freed by the transmit code in cxgb4_ofld_send() and we shouldn't use it again. But in the current code, if we hit an error later on in the function then the clean up code will call kfree_skb(skb) and

[PATCH 4.19 20/32] net/x25: prevent a couple of overflows

From: Dan Carpenter [ Upstream commit 6ee50c8e262a0f0693dad264c3c99e30e6442a56 ] The .x25_addr[] address comes from the user and is not necessarily NUL terminated. This leads to a couple problems. The first problem is that the strlen() in x25_bind() can read beyond the end of the buffer. The

[PATCH 4.19 30/32] Input: i8042 - add ByteSpeed touchpad to noloop table

From: Po-Hsu Lin commit a48491c65b513e5cdc3e7a886a4db915f848a5f5 upstream. It looks like the C15B laptop got another vendor: ByteSpeed LLC. Avoid AUX loopback on this touchpad as well, thus input subsystem will be able to recognize a Synaptics touchpad in the AUX port. BugLink:

[PATCH 4.19 31/32] tracing: Remove WARN_ON in start_thread()

From: Vasily Averin commit 310e3a4b5a4fc718a72201c1e4cf5c64ac6f5442 upstream. This patch reverts commit 978defee11a5 ("tracing: Do a WARN_ON() if start_thread() in hwlat is called when thread exists") .start hook can be legally called several times if according tracer is stopped screen

[PATCH 4.19 29/32] Input: xpad - support Ardwiino Controllers

From: Sanjay Govind commit 2aab1561439032be2e98811dd0ddbeb5b2ae4c61 upstream. This commit adds support for Ardwiino Controllers Signed-off-by: Sanjay Govind Link: https://lore.kernel.org/r/20201201071922.131666-1-sanjay.govi...@gmail.com Cc: sta...@vger.kernel.org Signed-off-by: Dmitry

[PATCH 4.19 08/32] usbnet: ipheth: fix connectivity with iOS 14

From: Yves-Alexis Perez [ Upstream commit f33d9e2b48a34e1558b67a473a1fc1d6e793f93c ] Starting with iOS 14 released in September 2020, connectivity using the personal hotspot USB tethering function of iOS devices is broken. Communication between the host and the device (for example ICMP traffic

[PATCH 4.19 28/32] ALSA: usb-audio: US16x08: fix value count for level meters

From: Hector Martin commit 402d5840b0d40a2a26c8651165d29b534abb6d36 upstream. The level meter control returns 34 integers of info. This fixes: snd-usb-audio 3-1:1.0: control 2:0:0:Level Meter:0: access overflow Fixes: d2bb390a2081 ("ALSA: usb-audio: Tascam US-16x08 DSP mixer quirk") Cc:

<    1   2   3   4   5   6   7   >