This is the 4.4.176 stable release

-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlxw/rsACgkQONu9yGCS
 aT4+axAAoCAo7YeLWpNklC5FQyNpvRTjFrYQB8pkOX1u3dv/7HNyvw7zO54G/eeD
 h2qDY1pUPk7TieQ6hgt+wuIScTgk7rKaP7tPE6avOYh24BKiArN7o7wbBlQkGTDs
 HE+dnm2v6j5iQN5m7qjUSVpr9TsGVlfIBcgwXOjwB/d/UaNK5lnUlAxjyWe6Ciee
 GTz8mXaPwtEmC8rTeetlH/IM1Ts5B0/rH03Ag8AzWbNZ52Wpq1RKFytzrSFxCeBr
 QWtADU3jtuUE58sKrWntlyzpHzo8KtVi2R99/YriUq3lJJs3Dnq5jKuT3uAngWh0
 N0suo6ix9k3xLI0ABdhrtyuwL8r61vggCxk+lI5n8Tj3E51FiTJ/KlZ9vR4lmDng
 08IWrAzcATsssKIWHoymOKYGUMwoqtHjtzqr22Y6pK0i0vKMS+D/R0V4iWTu3h+7
 ZpiZltJtTLexUM+8OC1sCmkzodJUY2Zlm0xC0rJGwIDf3OEvHarBuckLyBZK5zM/
 w83wGPv61YXlIqphorcBVZ1Wx4b/maGZrRUu2ENSNm8WWa32IqMHP9DTwB+jG0pL
 7s1Jx3+6eW/B1b/rws5m8zlpakEGo3GqV/NexgiQPRxILF6rEqGrKflpK/H0VTxa
 K0X8TQfuSKgFtZBL2w75Ib2Pnojsl1YDhv8fPnt5nX6MnbGRqkA=
 =/u0O
 -----END PGP SIGNATURE-----

Merge 4.4.176 into android-4.4

Changes in 4.4.176
	net: fix IPv6 prefix route residue
	vsock: cope with memory allocation failure at socket creation time
	hwmon: (lm80) Fix missing unlock on error in set_fan_div()
	net: Fix for_each_netdev_feature on Big endian
	sky2: Increase D3 delay again
	net: Add header for usage of fls64()
	tcp: tcp_v4_err() should be more careful
	net: Do not allocate page fragments that are not skb aligned
	tcp: clear icsk_backoff in tcp_write_queue_purge()
	vxlan: test dev->flags & IFF_UP before calling netif_rx()
	net: stmmac: Fix a race in EEE enable callback
	net: ipv4: use a dedicated counter for icmp_v4 redirect packets
	x86: livepatch: Treat R_X86_64_PLT32 as R_X86_64_PC32
	kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974)
	mfd: as3722: Handle interrupts on suspend
	mfd: as3722: Mark PM functions as __maybe_unused
	net/x25: do not hold the cpu too long in x25_new_lci()
	mISDN: fix a race in dev_expire_timer()
	ax25: fix possible use-after-free
	KVM: VMX: Fix x2apic check in vmx_msr_bitmap_mode()
	Linux 4.4.176

Change-Id: I04f3fbccfda85580720628f6415548d3e34781cc
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This commit is contained in:
Greg Kroah-Hartman 2019-02-23 10:11:24 +01:00
commit cf84cdc1d2
25 changed files with 135 additions and 46 deletions

View file

@ -1,6 +1,6 @@
VERSION = 4
PATCHLEVEL = 4
SUBLEVEL = 175
SUBLEVEL = 176
EXTRAVERSION =
NAME = Blurry Fish Butt

View file

@ -58,6 +58,7 @@ int klp_write_module_reloc(struct module *mod, unsigned long type,
val = (s32)value;
break;
case R_X86_64_PC32:
case R_X86_64_PLT32:
val = (u32)(value - loc);
break;
default:

View file

@ -4628,7 +4628,9 @@ static u8 vmx_msr_bitmap_mode(struct kvm_vcpu *vcpu)
{
u8 mode = 0;
if (irqchip_in_kernel(vcpu->kvm) && apic_x2apic_mode(vcpu->arch.apic)) {
if (cpu_has_secondary_exec_ctrls() &&
(vmcs_read32(SECONDARY_VM_EXEC_CONTROL) &
SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE)) {
mode |= MSR_BITMAP_MODE_X2APIC;
if (enable_apicv)
mode |= MSR_BITMAP_MODE_X2APIC_APICV;

View file

@ -393,8 +393,10 @@ static ssize_t set_fan_div(struct device *dev, struct device_attribute *attr,
}
rv = lm80_read_value(client, LM80_REG_FANDIV);
if (rv < 0)
if (rv < 0) {
mutex_unlock(&data->update_lock);
return rv;
}
reg = (rv & ~(3 << (2 * (nr + 1))))
| (data->fan_div[nr] << (2 * (nr + 1)));
lm80_write_value(client, LM80_REG_FANDIV, reg);

View file

@ -168,8 +168,8 @@ dev_expire_timer(unsigned long data)
spin_lock_irqsave(&timer->dev->lock, flags);
if (timer->id >= 0)
list_move_tail(&timer->list, &timer->dev->expired);
spin_unlock_irqrestore(&timer->dev->lock, flags);
wake_up_interruptible(&timer->dev->wait);
spin_unlock_irqrestore(&timer->dev->lock, flags);
}
static int

View file

@ -405,6 +405,8 @@ static int as3722_i2c_probe(struct i2c_client *i2c,
goto scrub;
}
device_init_wakeup(as3722->dev, true);
dev_dbg(as3722->dev, "AS3722 core driver initialized successfully\n");
return 0;
@ -422,6 +424,29 @@ static int as3722_i2c_remove(struct i2c_client *i2c)
return 0;
}
static int __maybe_unused as3722_i2c_suspend(struct device *dev)
{
struct as3722 *as3722 = dev_get_drvdata(dev);
if (device_may_wakeup(dev))
enable_irq_wake(as3722->chip_irq);
disable_irq(as3722->chip_irq);
return 0;
}
static int __maybe_unused as3722_i2c_resume(struct device *dev)
{
struct as3722 *as3722 = dev_get_drvdata(dev);
enable_irq(as3722->chip_irq);
if (device_may_wakeup(dev))
disable_irq_wake(as3722->chip_irq);
return 0;
}
static const struct of_device_id as3722_of_match[] = {
{ .compatible = "ams,as3722", },
{},
@ -434,10 +459,15 @@ static const struct i2c_device_id as3722_i2c_id[] = {
};
MODULE_DEVICE_TABLE(i2c, as3722_i2c_id);
static const struct dev_pm_ops as3722_pm_ops = {
SET_SYSTEM_SLEEP_PM_OPS(as3722_i2c_suspend, as3722_i2c_resume)
};
static struct i2c_driver as3722_i2c_driver = {
.driver = {
.name = "as3722",
.of_match_table = as3722_of_match,
.pm = &as3722_pm_ops,
},
.probe = as3722_i2c_probe,
.remove = as3722_i2c_remove,

View file

@ -5079,7 +5079,7 @@ static int sky2_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
INIT_WORK(&hw->restart_work, sky2_restart);
pci_set_drvdata(pdev, hw);
pdev->d3_delay = 200;
pdev->d3_delay = 300;
return 0;

View file

@ -614,25 +614,27 @@ static int stmmac_ethtool_op_set_eee(struct net_device *dev,
struct ethtool_eee *edata)
{
struct stmmac_priv *priv = netdev_priv(dev);
int ret;
priv->eee_enabled = edata->eee_enabled;
if (!priv->eee_enabled)
if (!edata->eee_enabled) {
stmmac_disable_eee_mode(priv);
else {
} else {
/* We are asking for enabling the EEE but it is safe
* to verify all by invoking the eee_init function.
* In case of failure it will return an error.
*/
priv->eee_enabled = stmmac_eee_init(priv);
if (!priv->eee_enabled)
edata->eee_enabled = stmmac_eee_init(priv);
if (!edata->eee_enabled)
return -EOPNOTSUPP;
/* Do not change tx_lpi_timer in case of failure */
priv->tx_lpi_timer = edata->tx_lpi_timer;
}
return phy_ethtool_set_eee(priv->phydev, edata);
ret = phy_ethtool_set_eee(dev->phydev, edata);
if (ret)
return ret;
priv->eee_enabled = edata->eee_enabled;
priv->tx_lpi_timer = edata->tx_lpi_timer;
return 0;
}
static u32 stmmac_usec2riwt(u32 usec, struct stmmac_priv *priv)

View file

@ -1881,7 +1881,7 @@ static void vxlan_encap_bypass(struct sk_buff *skb, struct vxlan_dev *src_vxlan,
struct pcpu_sw_netstats *tx_stats, *rx_stats;
union vxlan_addr loopback;
union vxlan_addr *remote_ip = &dst_vxlan->default_dst.remote_ip;
struct net_device *dev = skb->dev;
struct net_device *dev;
int len = skb->len;
tx_stats = this_cpu_ptr(src_vxlan->dev->tstats);
@ -1901,8 +1901,15 @@ static void vxlan_encap_bypass(struct sk_buff *skb, struct vxlan_dev *src_vxlan,
#endif
}
rcu_read_lock();
dev = skb->dev;
if (unlikely(!(dev->flags & IFF_UP))) {
kfree_skb(skb);
goto drop;
}
if (dst_vxlan->flags & VXLAN_F_LEARN)
vxlan_snoop(skb->dev, &loopback, eth_hdr(skb)->h_source);
vxlan_snoop(dev, &loopback, eth_hdr(skb)->h_source);
u64_stats_update_begin(&tx_stats->syncp);
tx_stats->tx_packets++;
@ -1915,8 +1922,10 @@ static void vxlan_encap_bypass(struct sk_buff *skb, struct vxlan_dev *src_vxlan,
rx_stats->rx_bytes += len;
u64_stats_update_end(&rx_stats->syncp);
} else {
drop:
dev->stats.rx_dropped++;
}
rcu_read_unlock();
}
static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,

View file

@ -11,6 +11,8 @@
#define _LINUX_NETDEV_FEATURES_H
#include <linux/types.h>
#include <linux/bitops.h>
#include <asm/byteorder.h>
typedef u64 netdev_features_t;
@ -125,8 +127,26 @@ enum {
#define NETIF_F_HW_L2FW_DOFFLOAD __NETIF_F(HW_L2FW_DOFFLOAD)
#define NETIF_F_BUSY_POLL __NETIF_F(BUSY_POLL)
#define for_each_netdev_feature(mask_addr, bit) \
for_each_set_bit(bit, (unsigned long *)mask_addr, NETDEV_FEATURE_COUNT)
/* Finds the next feature with the highest number of the range of start till 0.
*/
static inline int find_next_netdev_feature(u64 feature, unsigned long start)
{
/* like BITMAP_LAST_WORD_MASK() for u64
* this sets the most significant 64 - start to 0.
*/
feature &= ~0ULL >> (-start & ((sizeof(feature) * 8) - 1));
return fls64(feature) - 1;
}
/* This goes for the MSB to the LSB through the set feature bits,
* mask_addr should be a u64 and bit an int
*/
#define for_each_netdev_feature(mask_addr, bit) \
for ((bit) = find_next_netdev_feature((mask_addr), \
NETDEV_FEATURE_COUNT); \
(bit) >= 0; \
(bit) = find_next_netdev_feature((mask_addr), (bit) - 1))
/* Features valid for ethtool to change */
/* = all defined minus driver/device-class-related */

View file

@ -199,6 +199,18 @@ static inline void ax25_hold_route(ax25_route *ax25_rt)
void __ax25_put_route(ax25_route *ax25_rt);
extern rwlock_t ax25_route_lock;
static inline void ax25_route_lock_use(void)
{
read_lock(&ax25_route_lock);
}
static inline void ax25_route_lock_unuse(void)
{
read_unlock(&ax25_route_lock);
}
static inline void ax25_put_route(ax25_route *ax25_rt)
{
if (atomic_dec_and_test(&ax25_rt->refcount))

View file

@ -40,6 +40,7 @@ struct inet_peer {
u32 metrics[RTAX_MAX];
u32 rate_tokens; /* rate limiting for ICMP */
u32 n_redirects;
unsigned long rate_last;
union {
struct list_head gc_list;

View file

@ -1460,6 +1460,7 @@ static inline void tcp_write_queue_purge(struct sock *sk)
sk_wmem_free_skb(sk, skb);
sk_mem_reclaim(sk);
tcp_clear_all_retrans_hints(tcp_sk(sk));
inet_csk(sk)->icsk_backoff = 0;
}
static inline struct sk_buff *tcp_write_queue_head(const struct sock *sk)

View file

@ -114,6 +114,7 @@ netdev_tx_t ax25_ip_xmit(struct sk_buff *skb)
dst = (ax25_address *)(bp + 1);
src = (ax25_address *)(bp + 8);
ax25_route_lock_use();
route = ax25_get_route(dst, NULL);
if (route) {
digipeat = route->digipeat;
@ -206,9 +207,8 @@ netdev_tx_t ax25_ip_xmit(struct sk_buff *skb)
ax25_queue_xmit(skb, dev);
put:
if (route)
ax25_put_route(route);
ax25_route_lock_unuse();
return NETDEV_TX_OK;
}

View file

@ -40,7 +40,7 @@
#include <linux/export.h>
static ax25_route *ax25_route_list;
static DEFINE_RWLOCK(ax25_route_lock);
DEFINE_RWLOCK(ax25_route_lock);
void ax25_rt_device_down(struct net_device *dev)
{
@ -349,6 +349,7 @@ const struct file_operations ax25_route_fops = {
* Find AX.25 route
*
* Only routes with a reference count of zero can be destroyed.
* Must be called with ax25_route_lock read locked.
*/
ax25_route *ax25_get_route(ax25_address *addr, struct net_device *dev)
{
@ -356,7 +357,6 @@ ax25_route *ax25_get_route(ax25_address *addr, struct net_device *dev)
ax25_route *ax25_def_rt = NULL;
ax25_route *ax25_rt;
read_lock(&ax25_route_lock);
/*
* Bind to the physical interface we heard them on, or the default
* route if none is found;
@ -379,11 +379,6 @@ ax25_route *ax25_get_route(ax25_address *addr, struct net_device *dev)
if (ax25_spe_rt != NULL)
ax25_rt = ax25_spe_rt;
if (ax25_rt != NULL)
ax25_hold_route(ax25_rt);
read_unlock(&ax25_route_lock);
return ax25_rt;
}
@ -414,9 +409,12 @@ int ax25_rt_autobind(ax25_cb *ax25, ax25_address *addr)
ax25_route *ax25_rt;
int err = 0;
if ((ax25_rt = ax25_get_route(addr, NULL)) == NULL)
ax25_route_lock_use();
ax25_rt = ax25_get_route(addr, NULL);
if (!ax25_rt) {
ax25_route_lock_unuse();
return -EHOSTUNREACH;
}
if ((ax25->ax25_dev = ax25_dev_ax25dev(ax25_rt->dev)) == NULL) {
err = -EHOSTUNREACH;
goto put;
@ -451,8 +449,7 @@ int ax25_rt_autobind(ax25_cb *ax25, ax25_address *addr)
}
put:
ax25_put_route(ax25_rt);
ax25_route_lock_unuse();
return err;
}

View file

@ -6421,7 +6421,7 @@ static netdev_features_t netdev_sync_upper_features(struct net_device *lower,
netdev_features_t feature;
int feature_bit;
for_each_netdev_feature(&upper_disables, feature_bit) {
for_each_netdev_feature(upper_disables, feature_bit) {
feature = __NETIF_F_BIT(feature_bit);
if (!(upper->wanted_features & feature)
&& (features & feature)) {
@ -6441,7 +6441,7 @@ static void netdev_sync_lower_features(struct net_device *upper,
netdev_features_t feature;
int feature_bit;
for_each_netdev_feature(&upper_disables, feature_bit) {
for_each_netdev_feature(upper_disables, feature_bit) {
feature = __NETIF_F_BIT(feature_bit);
if (!(features & feature) && (lower->features & feature)) {
netdev_dbg(upper, "Disabling feature %pNF on lower dev %s.\n",

View file

@ -374,6 +374,8 @@ static void *__netdev_alloc_frag(unsigned int fragsz, gfp_t gfp_mask)
*/
void *netdev_alloc_frag(unsigned int fragsz)
{
fragsz = SKB_DATA_ALIGN(fragsz);
return __netdev_alloc_frag(fragsz, GFP_ATOMIC | __GFP_COLD);
}
EXPORT_SYMBOL(netdev_alloc_frag);
@ -387,6 +389,8 @@ static void *__napi_alloc_frag(unsigned int fragsz, gfp_t gfp_mask)
void *napi_alloc_frag(unsigned int fragsz)
{
fragsz = SKB_DATA_ALIGN(fragsz);
return __napi_alloc_frag(fragsz, GFP_ATOMIC | __GFP_COLD);
}
EXPORT_SYMBOL(napi_alloc_frag);

View file

@ -448,6 +448,7 @@ relookup:
atomic_set(&p->rid, 0);
p->metrics[RTAX_LOCK-1] = INETPEER_METRICS_NEW;
p->rate_tokens = 0;
p->n_redirects = 0;
/* 60*HZ is arbitrary, but chosen enough high so that the first
* calculation of tokens is at its maximum.
*/

View file

@ -880,13 +880,15 @@ void ip_rt_send_redirect(struct sk_buff *skb)
/* No redirected packets during ip_rt_redirect_silence;
* reset the algorithm.
*/
if (time_after(jiffies, peer->rate_last + ip_rt_redirect_silence))
if (time_after(jiffies, peer->rate_last + ip_rt_redirect_silence)) {
peer->rate_tokens = 0;
peer->n_redirects = 0;
}
/* Too many ignored redirects; do not send anything
* set dst.rate_last to the last seen redirected packet.
*/
if (peer->rate_tokens >= ip_rt_redirect_number) {
if (peer->n_redirects >= ip_rt_redirect_number) {
peer->rate_last = jiffies;
goto out_put_peer;
}
@ -903,6 +905,7 @@ void ip_rt_send_redirect(struct sk_buff *skb)
icmp_send(skb, ICMP_REDIRECT, ICMP_REDIR_HOST, gw);
peer->rate_last = jiffies;
++peer->rate_tokens;
++peer->n_redirects;
#ifdef CONFIG_IP_ROUTE_VERBOSE
if (log_martians &&
peer->rate_tokens == ip_rt_redirect_number)

View file

@ -2253,7 +2253,6 @@ int tcp_disconnect(struct sock *sk, int flags)
tp->write_seq += tp->max_window + 2;
if (tp->write_seq == 0)
tp->write_seq = 1;
icsk->icsk_backoff = 0;
tp->snd_cwnd = 2;
icsk->icsk_probes_out = 0;
tp->packets_out = 0;

View file

@ -466,14 +466,15 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
if (sock_owned_by_user(sk))
break;
skb = tcp_write_queue_head(sk);
if (WARN_ON_ONCE(!skb))
break;
icsk->icsk_backoff--;
icsk->icsk_rto = tp->srtt_us ? __tcp_set_rto(tp) :
TCP_TIMEOUT_INIT;
icsk->icsk_rto = inet_csk_rto_backoff(icsk, TCP_RTO_MAX);
skb = tcp_write_queue_head(sk);
BUG_ON(!skb);
remaining = icsk->icsk_rto -
min(icsk->icsk_rto,
tcp_time_stamp - tcp_skb_timestamp(skb));

View file

@ -1070,7 +1070,8 @@ check_cleanup_prefix_route(struct inet6_ifaddr *ifp, unsigned long *expires)
list_for_each_entry(ifa, &idev->addr_list, if_list) {
if (ifa == ifp)
continue;
if (!ipv6_prefix_equal(&ifa->addr, &ifp->addr,
if (ifa->prefix_len != ifp->prefix_len ||
!ipv6_prefix_equal(&ifa->addr, &ifp->addr,
ifp->prefix_len))
continue;
if (ifa->flags & (IFA_F_PERMANENT | IFA_F_NOPREFIXROUTE))

View file

@ -1656,6 +1656,10 @@ static void vmci_transport_cleanup(struct work_struct *work)
static void vmci_transport_destruct(struct vsock_sock *vsk)
{
/* transport can be NULL if we hit a failure at init() time */
if (!vmci_trans(vsk))
return;
/* Ensure that the detach callback doesn't use the sk/vsk
* we are about to destruct.
*/

View file

@ -352,17 +352,15 @@ static unsigned int x25_new_lci(struct x25_neigh *nb)
unsigned int lci = 1;
struct sock *sk;
read_lock_bh(&x25_list_lock);
while ((sk = __x25_find_socket(lci, nb)) != NULL) {
while ((sk = x25_find_socket(lci, nb)) != NULL) {
sock_put(sk);
if (++lci == 4096) {
lci = 0;
break;
}
cond_resched();
}
read_unlock_bh(&x25_list_lock);
return lci;
}

View file

@ -2711,14 +2711,15 @@ static int kvm_ioctl_create_device(struct kvm *kvm,
return ret;
}
kvm_get_kvm(kvm);
ret = anon_inode_getfd(ops->name, &kvm_device_fops, dev, O_RDWR | O_CLOEXEC);
if (ret < 0) {
kvm_put_kvm(kvm);
ops->destroy(dev);
return ret;
}
list_add(&dev->vm_node, &kvm->devices);
kvm_get_kvm(kvm);
cd->fd = ret;
return 0;
}