Add the reference count for Smart Wireless Interface Manager to
know whether there are any process who still has the socket in
question in use or not.
Enable INET DIAG.
Redefine the TCP_FLAG as it gives compiling error when an enum is defined
by a function return.
Change-Id: I1aa9c810fec2e332048c9ef4199ec3f996bc3a75
Signed-off-by: Chinh Tran <chinht@codeaurora.org>
[chiaweic@codeaurora.org: resolve conflicts encountered with port to 4.4]
Signed-off-by: Skylar Chang <chiaweic@codeaurora.org>
While compiling for usermode linux for x86 architecture, observed
compilation issues with probable usage of uninitialized variables.
This change initializes the variables.
Signed-off-by: Jeevan Shriram <jshriram@codeaurora.org>
This reverts commit f8aac738feb06363f4db715754f1e91d39ace021 ("net: unix:
Fix uninitialized warnings when building for ARCH=um").
Signed-off-by: David Keitel <dkeitel@codeaurora.org>
Add config support to disable the network skb fragment cache.
Enabling this option ensures that when allocating skbs the network
skb fragment cache will not be used.
Disabling use of the fragment cache can be useful on some low end
targets because it reduces memory pressure.
Change-Id: If3be82741a51d9275e41ca2eca99db3d1a4b2fcb
Signed-off-by: Liam Mark <lmark@codeaurora.org>
[satyap: trivial merge conflict resolution]
Signed-off-by: Satya Durga Srinivasu Prabhala <satyap@codeaurora.org>
IPC Router binds any port as a control port and moves it from the client
port list to control port list. Misbehaving clients can exploit this
incorrect behavior.
IPC Router to check if the port is a client port before binding it as a
control port.
CRs-Fixed: 974577
Change-Id: I9f189b76967d5f85750218a7cb6537d187a69663
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
Currently DPM is listening for all netlink events
and there is battery drain because of that. Since,
DPM is interested only in BIND and LISTEN events,
changes are to process only BIND and LSTEN events
and skip the rest for the sockev client.
CRs-Fixed: 945890
Change-Id: Iae11027945b981538f9c16ae9d5cd1ecf88a3743
Signed-off-by: Susheel Yadagiri <syadagir@codeaurora.org>
Signed-off-by: Ravinder Konka <rkonka@codeaurora.org>
The service info structure is allocated with uninitialized memory for the
max number of services and returns the complete structure to the usersapce
resulting in the information leak if lookup operation finds less number of
services than the requested number.
Check the minimum of requested and available services and copy the minimum
information to the user-space.
CRs-Fixed: 965934
Change-Id: Ic97f875855fdc6440c1db1d8d0338ee8b03a9d0a
Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org>
During hotplug if an RPS CPU goes offline,
then there is a possibility that the IPI
delivery to the RPS core might fail, this
happens in the cases when unruly drivers
use netif_rx API in the wrong context.
This happens due to two reasons
a) Firstly using netif_rx API in non preemptive
context leads to enough latencies that the IPI
delivery might fail to an RPS core. This is because
the softIRQ trigger will become unpredictable.
b) by using netif_rx it becomes an architectural
issue where we are trying to do two things in two
different contexts. We set the NAPI bit in context
and sent the IPI in other context. Now since the
context switch is allowed, the remote CPU is allowed
to go finish its hotplug.
If there was no context switch in the first place,
which typically happens by either using the correct
version of netif_rx or switching to NAPI framework,
then the remote CPU is not allowed to go to CPU DOWN
state. This is by design since hotplug framework causes
the remote dying CPU to wait until atleast one context
switch happens on all other CPUS. If preemption is
disabled then the dying CPU has to wait until preemption
is enabled and a context switch happens.
This patch catches these unruly drivers and handles
IPI misses by clearing NAPI sate on remote RPS CPUs
Please refere here for more documentation on hotplug
and preemption cases https://lwn.net/Articles/569686/
CRs-Fixed: 966095
Change-Id: I072f91bdb4d7e444e3624e8e010ef1b66a67b1ed
Acked-by: Abhishek Chauhan <abchauha@qti.qualcomm.com>
Signed-off-by: Ravinder Konka <rkonka@codeaurora.org>
When SIP ALG is disabled, SIP packet should not be parsed by
SIP ALG module. Make change to Check nf_ct_disable_sip_alg flag
before parsing the SIP packet to bypass SIP ALG processing
when SIP ALG is disabled.
Change-Id: I863c93f418b694bc0e9101c31d2da12e761091a6
Signed-off-by: Ravinder Konka <rkonka@codeaurora.org>
Liping Zhang spotted a race between tcp_nuke_addr and tcp_close
that can cause a crash. If a userspace process calls tcp_close
on a socket at the same time that tcp_nuke_addr is closing it,
and tcp_close wins the race to call lock_sock, it will call
sock_orphan before releasing the lock. sock_orphan sets the
SOCK_DEAD flag on the socket and proceeds to close it, eventually
calling inet_csk_destroy_sock. When tcp_nuke_addr gets the socket
lock, it calls tcp_done. But if tcp_done sees the SOCK_DEAD flag,
it calls inet_csk_destroy_sock as well, resulting in a double
free.
Fix this by checking for SOCK_DEAD again after lock_sock
succeeds. Eric had already pointed out that this could be a
problem in b/23663111, so there was already a TODO in the code
for this.
Change-Id: I0c87c3fd0598384d957b69734366bd4e2fd7e8d7
Git-commit: 61469ddc534f255c709349a1a611216ecd07e13d
Git-repo: https://android.googlesource.com/kernel/common/
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
tcp_nuke addr only grabs the bottom half socket lock, but not the
userspace socket lock. This allows a userspace program to call
close() while the socket is running, which causes a NULL pointer
dereference in inet_put_port.
Bug: 23663111
Bug: 24072792
Change-Id: Iecb63af68c2db4764c74785153d1c9054f76b94f
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Git-commit: 74d66ee756afcc3269e4c1341f793c52be629af9
Git-repo: https://android.googlesource.com/kernel/common/
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Changes to store forced port only in the original direction.
This resolves the MT call issue where destination port is
incorrectly translated to forced_port.
Change-Id: I1b1c407c4beb8185ada0b005b1cd1034cb975141
Signed-off-by: Ravinder Konka <rkonka@codeaurora.org>
Currently, IPC Router statically associates the version of the
protocol to be used with each link. Thus, dynamic version negotiation
is not possible.
Add support for version negotiation that sets IPC Router version
after a successful negotiation.
Change-Id: Iea04742ef30443c1e36760561e7f20175c4fbaa6
Signed-off-by: Atish Kumar Patra <apatra@codeaurora.org>
It is possible that the 'tail' variable is used without initialization.
This change fixes uninitialized variable usage.
Change-Id: Idbd7d52797af2eeffcece19249055d5099a7fdb1
Signed-off-by: Jeevan Shriram <jshriram@codeaurora.org>
It is possible that the 'in' variable is used without
initialization. This change fixes uninitialized variable usage.
Change-Id: If26733110b29ec1c1150f1da50efa0c1ac6c2796
Signed-off-by: Jeevan Shriram <jshriram@codeaurora.org>
* lsk-44/linux-linaro-lsk-v4.4:
Linux 4.4.3
modules: fix modparam async_probe request
module: wrapper for symbol name.
itimers: Handle relative timers with CONFIG_TIME_LOW_RES proper
posix-timers: Handle relative timers with CONFIG_TIME_LOW_RES proper
timerfd: Handle relative timers with CONFIG_TIME_LOW_RES proper
prctl: take mmap sem for writing to protect against others
xfs: log mount failures don't wait for buffers to be released
Revert "xfs: clear PF_NOFREEZE for xfsaild kthread"
xfs: inode recovery readahead can race with inode buffer creation
libxfs: pack the agfl header structure so XFS_AGFL_SIZE is correct
ovl: setattr: check permissions before copy-up
ovl: root: copy attr
ovl: check dentry positiveness in ovl_cleanup_whiteouts()
ovl: use a minimal buffer in ovl_copy_xattr
ovl: allow zero size xattr
futex: Drop refcount if requeue_pi() acquired the rtmutex
devm_memremap_release(): fix memremap'd addr handling
ipc/shm: handle removed segments gracefully in shm_mmap()
intel_scu_ipcutil: underflow in scu_reg_access()
mm,thp: khugepaged: call pte flush at the time of collapse
dump_stack: avoid potential deadlocks
radix-tree: fix oops after radix_tree_iter_retry
drivers/hwspinlock: fix race between radix tree insertion and lookup
radix-tree: fix race in gang lookup
MAINTAINERS: return arch/sh to maintained state, with new maintainers
memcg: only free spare array when readers are done
numa: fix /proc/<pid>/numa_maps for hugetlbfs on s390
fs/hugetlbfs/inode.c: fix bugs in hugetlb_vmtruncate_list()
scripts/bloat-o-meter: fix python3 syntax error
dma-debug: switch check from _text to _stext
m32r: fix m32104ut_defconfig build fail
xhci: Fix list corruption in urb dequeue at host removal
Revert "xhci: don't finish a TD if we get a short-transfer event mid TD"
iommu/vt-d: Clear PPR bit to ensure we get more page request interrupts
iommu/vt-d: Fix 64-bit accesses to 32-bit DMAR_GSTS_REG
iommu/vt-d: Fix mm refcounting to hold mm_count not mm_users
iommu/amd: Correct the wrong setting of alias DTE in do_attach
iommu/vt-d: Don't skip PCI devices when disabling IOTLB
Input: vmmouse - fix absolute device registration
string_helpers: fix precision loss for some inputs
Input: i8042 - add Fujitsu Lifebook U745 to the nomux list
Input: elantech - mark protocols v2 and v3 as semi-mt
mm: fix regression in remap_file_pages() emulation
mm: replace vma_lock_anon_vma with anon_vma_lock_read/write
mm: fix mlock accouting
libnvdimm: fix namespace object confusion in is_uuid_busy()
mm: soft-offline: check return value in second __get_any_page() call
perf kvm record/report: 'unprocessable sample' error while recording/reporting guest data
KVM: PPC: Fix ONE_REG AltiVec support
KVM: PPC: Fix emulation of H_SET_DABR/X on POWER8
KVM: arm/arm64: Fix reference to uninitialised VGIC
arm64: dma-mapping: fix handling of devices registered before arch_initcall
ARM: OMAP2+: Fix ppa_zero_params and ppa_por_params for rodata
ARM: OMAP2+: Fix save_secure_ram_context for rodata
ARM: OMAP2+: Fix l2dis_3630 for rodata
ARM: OMAP2+: Fix l2_inv_api_params for rodata
ARM: OMAP2+: Fix wait_dll_lock_timed for rodata
ARM: dts: at91: sama5d4ek: add phy address and IRQ for macb0
ARM: dts: at91: sama5d4 xplained: fix phy0 IRQ type
ARM: dts: at91: sama5d4: fix instance id of DBGU
ARM: dts: at91: sama5d4 xplained: properly mux phy interrupt
ARM: dts: omap5-board-common: enable rtc and charging of backup battery
ARM: dts: Fix omap5 PMIC control lines for RTC writes
ARM: dts: Fix wl12xx missing clocks that cause hangs
ARM: nomadik: fix up SD/MMC DT settings
ARM: 8517/1: ICST: avoid arithmetic overflow in icst_hz()
ARM: 8519/1: ICST: try other dividends than 1
arm64: mm: avoid calling apply_to_page_range on empty range
ARM: mvebu: remove duplicated regulator definition in Armada 388 GP
powerpc/ioda: Set "read" permission when "write" is set
powerpc/powernv: Fix stale PE primary bus
powerpc/eeh: Fix stale cached primary bus
powerpc/eeh: Fix PE location code
SUNRPC: Fixup socket wait for memory
udf: Check output buffer length when converting name to CS0
udf: Prevent buffer overrun with multi-byte characters
udf: limit the maximum number of indirect extents in a row
pNFS/flexfiles: Fix an XDR encoding bug in layoutreturn
nfs: Fix race in __update_open_stateid()
pNFS/flexfiles: Fix an Oopsable typo in ff_mirror_match_fh()
NFS: Fix attribute cache revalidation
cifs: fix erroneous return value
cifs_dbg() outputs an uninitialized buffer in cifs_readdir()
cifs: fix race between call_async() and reconnect()
cifs: Ratelimit kernel log messages
iio: inkern: fix a NULL dereference on error
iio: pressure: mpl115: fix temperature offset sign
iio: light: acpi-als: Report data as processed
iio: dac: mcp4725: set iio name property in sysfs
iio: add IIO_TRIGGER dependency to STK8BA50
iio: add HAS_IOMEM dependency to VF610_ADC
iio-light: Use a signed return type for ltr501_match_samp_freq()
iio:adc:ti_am335x_adc Fix buffered mode by identifying as software buffer.
iio: adis_buffer: Fix out-of-bounds memory access
scsi: fix soft lockup in scsi_remove_target() on module removal
SCSI: Add Marvell Console to VPD blacklist
scsi_dh_rdac: always retry MODE SELECT on command lock violation
drivers/scsi/sg.c: mark VMA as VM_IO to prevent migration
SCSI: fix crashes in sd and sr runtime PM
iscsi-target: Fix potential dead-lock during node acl delete
scsi: add Synology to 1024 sector blacklist
klist: fix starting point removed bug in klist iterators
tracepoints: Do not trace when cpu is offline
tracing: Fix freak link error caused by branch tracer
perf tools: tracepoint_error() can receive e=NULL, robustify it
tools lib traceevent: Fix output of %llu for 64 bit values read on 32 bit machines
ptrace: use fsuid, fsgid, effective creds for fs access checks
Btrfs: fix direct IO requests not reporting IO error to user space
Btrfs: fix hang on extent buffer lock caused by the inode_paths ioctl
Btrfs: fix page reading in extent_same ioctl leading to csum errors
Btrfs: fix invalid page accesses in extent_same (dedup) ioctl
btrfs: properly set the termination value of ctx->pos in readdir
Revert "btrfs: clear PF_NOFREEZE in cleaner_kthread()"
Btrfs: fix fitrim discarding device area reserved for boot loader's use
btrfs: handle invalid num_stripes in sys_array
ext4: don't read blocks from disk after extents being swapped
ext4: fix potential integer overflow
ext4: fix scheduling in atomic on group checksum failure
serial: omap: Prevent DoS using unprivileged ioctl(TIOCSRS485)
serial: 8250_pci: Add Intel Broadwell ports
tty: Add support for PCIe WCH382 2S multi-IO card
pty: make sure super_block is still valid in final /dev/tty close
pty: fix possible use after free of tty->driver_data
staging/speakup: Use tty_ldisc_ref() for paste kworker
phy: twl4030-usb: Fix unbalanced pm_runtime_enable on module reload
phy: twl4030-usb: Relase usb phy on unload
ALSA: seq: Fix double port list deletion
ALSA: seq: Fix leak of pool buffer at concurrent writes
ALSA: pcm: Fix rwsem deadlock for non-atomic PCM stream
ALSA: hda - Cancel probe work instead of flush at remove
x86/mm: Fix vmalloc_fault() to handle large pages properly
x86/uaccess/64: Handle the caching of 4-byte nocache copies properly in __copy_user_nocache()
x86/uaccess/64: Make the __copy_user_nocache() assembly code more readable
x86/mm/pat: Avoid truncation when converting cpa->numpages to address
x86/mm: Fix types used in pgprot cacheability flags translations
Linux 4.4.2
HID: multitouch: fix input mode switching on some Elan panels
mm, vmstat: fix wrong WQ sleep when memory reclaim doesn't make any progress
zsmalloc: fix migrate_zspage-zs_free race condition
zram: don't call idr_remove() from zram_remove()
zram: try vmalloc() after kmalloc()
zram/zcomp: use GFP_NOIO to allocate streams
rtlwifi: rtl8821ae: Fix 5G failure when EEPROM is incorrectly encoded
rtlwifi: rtl8821ae: Fix errors in parameter initialization
crypto: marvell/cesa - fix test in mv_cesa_dev_dma_init()
crypto: atmel-sha - remove calls of clk_prepare() from atomic contexts
crypto: atmel-sha - fix atmel_sha_remove()
crypto: algif_skcipher - Do not set MAY_BACKLOG on the async path
crypto: algif_skcipher - Do not dereference ctx without socket lock
crypto: algif_skcipher - Do not assume that req is unchanged
crypto: user - lock crypto_alg_list on alg dump
EVM: Use crypto_memneq() for digest comparisons
crypto: algif_hash - wait for crypto_ahash_init() to complete
crypto: shash - Fix has_key setting
crypto: chacha20-ssse3 - Align stack pointer to 64 bytes
crypto: caam - make write transactions bufferable on PPC platforms
crypto: algif_skcipher - sendmsg SG marking is off by one
crypto: algif_skcipher - Load TX SG list after waiting
crypto: crc32c - Fix crc32c soft dependency
crypto: algif_skcipher - Fix race condition in skcipher_check_key
crypto: algif_hash - Fix race condition in hash_check_key
crypto: af_alg - Forbid bind(2) when nokey child sockets are present
crypto: algif_skcipher - Remove custom release parent function
crypto: algif_hash - Remove custom release parent function
crypto: af_alg - Allow af_af_alg_release_parent to be called on nokey path
ahci: Intel DNV device IDs SATA
libata: disable forced PORTS_IMPL for >= AHCI 1.3
crypto: algif_skcipher - Add key check exception for cipher_null
crypto: skcipher - Add crypto_skcipher_has_setkey
crypto: algif_hash - Require setkey before accept(2)
crypto: hash - Add crypto_ahash_has_setkey
crypto: algif_skcipher - Add nokey compatibility path
crypto: af_alg - Add nokey compatibility path
crypto: af_alg - Fix socket double-free when accept fails
crypto: af_alg - Disallow bind/setkey/... after accept(2)
crypto: algif_skcipher - Require setkey before accept(2)
sched: Fix crash in sched_init_numa()
ext4 crypto: add missing locking for keyring_key access
iommu/io-pgtable-arm: Ensure we free the final level on teardown
tty: Fix unsafe ldisc reference via ioctl(TIOCGETD)
tty: Retry failed reopen if tty teardown in-progress
tty: Wait interruptibly for tty lock on reopen
n_tty: Fix unsafe reference to "other" ldisc
usb: xhci: apply XHCI_PME_STUCK_QUIRK to Intel Broxton-M platforms
usb: xhci: handle both SSIC ports in PME stuck quirk
usb: phy: msm: fix error handling in probe.
usb: cdc-acm: send zero packet for intel 7260 modem
usb: cdc-acm: handle unlinked urb in acm read callback
USB: option: fix Cinterion AHxx enumeration
USB: serial: option: Adding support for Telit LE922
USB: cp210x: add ID for IAI USB to RS485 adaptor
USB: serial: ftdi_sio: add support for Yaesu SCU-18 cable
usb: hub: do not clear BOS field during reset device
USB: visor: fix null-deref at probe
USB: serial: visor: fix crash on detecting device without write_urbs
ASoC: rt5645: fix the shift bit of IN1 boost
saa7134-alsa: Only frees registered sound cards
ALSA: dummy: Implement timer backend switching more safely
ALSA: hda - Fix bad dereference of jack object
ALSA: hda - Fix speaker output from VAIO AiO machines
Revert "ALSA: hda - Fix noise on Gigabyte Z170X mobo"
ALSA: hda - Fix static checker warning in patch_hdmi.c
ALSA: hda - Add fixup for Mac Mini 7,1 model
ALSA: timer: Fix race between stop and interrupt
ALSA: timer: Fix wrong instance passed to slave callbacks
ALSA: timer: Fix race at concurrent reads
ALSA: timer: Fix link corruption due to double start or stop
ALSA: timer: Fix leftover link at closing
ALSA: timer: Code cleanup
ALSA: seq: Fix lockdep warnings due to double mutex locks
ALSA: seq: Fix race at closing in virmidi driver
ALSA: seq: Fix yet another races among ALSA timer accesses
ASoC: dpcm: fix the BE state on hw_free
ALSA: pcm: Fix potential deadlock in OSS emulation
ALSA: hda/realtek - Support Dell headset mode for ALC225
ALSA: hda/realtek - Support headset mode for ALC225
ALSA: hda/realtek - New codec support of ALC225
ALSA: rawmidi: Fix race at copying & updating the position
ALSA: rawmidi: Remove kernel WARNING for NULL user-space buffer check
ALSA: rawmidi: Make snd_rawmidi_transmit() race-free
ALSA: seq: Degrade the error message for too many opens
ALSA: seq: Fix incorrect sanity check at snd_seq_oss_synth_cleanup()
ALSA: dummy: Disable switching timer backend via sysfs
ALSA: compress: Disable GET_CODEC_CAPS ioctl for some architectures
ALSA: hda - disable dynamic clock gating on Broxton before reset
ALSA: Add missing dependency on CONFIG_SND_TIMER
ALSA: bebob: Use a signed return type for get_formation_index
ALSA: usb-audio: avoid freeing umidi object twice
ALSA: usb-audio: Add native DSD support for PS Audio NuWave DAC
ALSA: usb-audio: Fix OPPO HA-1 vendor ID
ALSA: usb-audio: Add quirk for Microsoft LifeCam HD-6000
ALSA: usb-audio: Fix TEAC UD-501/UD-503/NT-503 usb delay
hrtimer: Handle remaining time proper for TIME_LOW_RES
md/raid: only permit hot-add of compatible integrity profiles
media: i2c: Don't export ir-kbd-i2c module alias
parisc: Fix __ARCH_SI_PREAMBLE_SIZE
parisc: Protect huge page pte changes with spinlocks
printk: do cond_resched() between lines while outputting to consoles
tracing/stacktrace: Show entire trace if passed in function not found
tracing: Fix stacktrace skip depth in trace_buffer_unlock_commit_regs()
PCI: Fix minimum allocation address overwrite
PCI: host: Mark PCIe/PCI (MSI) IRQ cascade handlers as IRQF_NO_THREAD
mtd: nand: assign reasonable default name for NAND drivers
wlcore/wl12xx: spi: fix NULL pointer dereference (Oops)
wlcore/wl12xx: spi: fix oops on firmware load
ocfs2/dlm: clear refmap bit of recovery lock while doing local recovery cleanup
ocfs2/dlm: ignore cleaning the migration mle that is inuse
ALSA: hda - Implement loopback control switch for Realtek and other codecs
block: fix bio splitting on max sectors
base/platform: Fix platform drivers with no probe callback
HID: usbhid: fix recursive deadlock
ocfs2: NFS hangs in __ocfs2_cluster_lock due to race with ocfs2_unblock_lock
block: split bios to max possible length
NFSv4.1/pnfs: Fixup an lo->plh_block_lgets imbalance in layoutreturn
crypto: sun4i-ss - add missing statesize
Linux 4.4.1
arm64: kernel: fix architected PMU registers unconditional access
arm64: kernel: enforce pmuserenr_el0 initialization and restore
arm64: mm: ensure that the zero page is visible to the page table walker
arm64: Clear out any singlestep state on a ptrace detach operation
powerpc/module: Handle R_PPC64_ENTRY relocations
scripts/recordmcount.pl: support data in text section on powerpc
powerpc: Make {cmp}xchg* and their atomic_ versions fully ordered
powerpc: Make value-returning atomics fully ordered
powerpc/tm: Check for already reclaimed tasks
batman-adv: Drop immediate orig_node free function
batman-adv: Drop immediate batadv_hard_iface free function
batman-adv: Drop immediate neigh_ifinfo free function
batman-adv: Drop immediate batadv_neigh_node free function
batman-adv: Drop immediate batadv_orig_ifinfo free function
batman-adv: Avoid recursive call_rcu for batadv_nc_node
batman-adv: Avoid recursive call_rcu for batadv_bla_claim
team: Replace rcu_read_lock with a mutex in team_vlan_rx_kill_vid
net/mlx5_core: Fix trimming down IRQ number
bridge: fix lockdep addr_list_lock false positive splat
ipv6: update skb->csum when CE mark is propagated
net: bpf: reject invalid shifts
phonet: properly unshare skbs in phonet_rcv()
dwc_eth_qos: Fix dma address for multi-fragment skbs
bonding: Prevent IPv6 link local address on enslaved devices
net: preserve IP control block during GSO segmentation
udp: disallow UFO for sockets with SO_NO_CHECK option
net: pktgen: fix null ptr deref in skb allocation
sched,cls_flower: set key address type when present
tcp_yeah: don't set ssthresh below 2
ipv6: tcp: add rcu locking in tcp_v6_send_synack()
net: sctp: prevent writes to cookie_hmac_alg from accessing invalid memory
vxlan: fix test which detect duplicate vxlan iface
unix: properly account for FDs passed over unix sockets
xhci: refuse loading if nousb is used
usb: core: lpm: fix usb3_hardware_lpm sysfs node
USB: cp210x: add ID for ELV Marble Sound Board 1
rtlwifi: fix memory leak for USB device
ASoC: compress: Fix compress device direction check
ASoC: wm5110: Fix PGA clear when disabling DRE
ALSA: timer: Handle disconnection more safely
ALSA: hda - Flush the pending probe work at remove
ALSA: hda - Fix missing module loading with model=generic option
ALSA: hda - Fix bass pin fixup for ASUS N550JX
ALSA: control: Avoid kernel warnings from tlv ioctl with numid 0
ALSA: hrtimer: Fix stall by hrtimer_cancel()
ALSA: pcm: Fix snd_pcm_hw_params struct copy in compat mode
ALSA: seq: Fix snd_seq_call_port_info_ioctl in compat mode
ALSA: hda - Add fixup for Dell Latitidue E6540
ALSA: timer: Fix double unlink of active_list
ALSA: timer: Fix race among timer ioctls
ALSA: hda - fix the headset mic detection problem for a Dell laptop
ALSA: timer: Harden slave timer list handling
ALSA: usb-audio: Fix mixer ctl regression of Native Instrument devices
ALSA: hda - Fix white noise on Dell Latitude E5550
ALSA: seq: Fix race at timer setup and close
ALSA: usb-audio: Avoid calling usb_autopm_put_interface() at disconnect
ALSA: seq: Fix missing NULL check at remove_events ioctl
ALSA: hda - Fixup inverted internal mic for Lenovo E50-80
ALSA: usb: Add native DSD support for Oppo HA-1
x86/mm: Improve switch_mm() barrier comments
x86/mm: Add barriers and document switch_mm()-vs-flush synchronization
x86/boot: Double BOOT_HEAP_SIZE to 64KB
x86/reboot/quirks: Add iMac10,1 to pci_reboot_dmi_table[]
kvm: x86: Fix vmwrite to SECONDARY_VM_EXEC_CONTROL
KVM: x86: correctly print #AC in traces
KVM: x86: expose MSR_TSC_AUX to userspace
x86/xen: don't reset vcpu_info on a cancelled suspend
KEYS: Fix keyring ref leak in join_session_keyring()
Conflicts:
arch/arm64/kernel/perf_event.c
drivers/scsi/sd.c
sound/core/compress_offload.c
Change-Id: I9f77fe42aaae249c24cd6e170202110ab1426878
Signed-off-by: Trilok Soni <tsoni@codeaurora.org>
This patch adds trace events to help with debug for gso feature
by identifying the packets(and their lenghts) that are using
the segmentation offload feature.
Change-Id: Ibfe1194cc63e74c75047040b0c540713d539992e
Acked-by: Ashwanth Goli <ashwanth@qti.qualcomm.com>
Signed-off-by: Ravinder Konka <rkonka@codeaurora.org>
Specifications state that the MAP packet length in the MAP header do
not account for the number of bytes of packet trailer from DL checksum
offload. Current implementation takes this into account for data
packets but not for command packets. As a result, the additional
8 bytes were sent to hardware as part of the MAP ACK's and were
subsequently dropped.
Fix this by truncating the extra bytes of the DL checksum trailer from
the MAP ACK.
CRs-Fixed: 961336
Change-Id: I175dde695e7ee09d16c99fb71898d635c7a812ab
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Set the protocol as ETH_P_MAP when sending a MAP ACK as a response
to a MAP command packet. Physical device drivers may drop these
packets if the ETH_P_MAP protocol is not present on the skb.
CRs-Fixed: 961336
Change-Id: I05ca1350fb16747b0300106654a74d3318389a30
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
A rcu stall with the following backtrace was seen on a system with
forwarding, optimistic_dad and use_optimistic set. To reproduce,
set these flags and allow ipv6 autoconf.
This occurs because the device write_lock is acquired while already
holding the read_lock. Back trace below -
INFO: rcu_preempt self-detected stall on CPU { 1} (t=2100 jiffies
g=3992 c=3991 q=4471)
<6> Task dump for CPU 1:
<2> kworker/1:0 R running task 12168 15 2 0x00000002
<2> Workqueue: ipv6_addrconf addrconf_dad_work
<6> Call trace:
<2> [<ffffffc000084da8>] el1_irq+0x68/0xdc
<2> [<ffffffc000cc4e0c>] _raw_write_lock_bh+0x20/0x30
<2> [<ffffffc000bc5dd8>] __ipv6_dev_ac_inc+0x64/0x1b4
<2> [<ffffffc000bcbd2c>] addrconf_join_anycast+0x9c/0xc4
<2> [<ffffffc000bcf9f0>] __ipv6_ifa_notify+0x160/0x29c
<2> [<ffffffc000bcfb7c>] ipv6_ifa_notify+0x50/0x70
<2> [<ffffffc000bd035c>] addrconf_dad_work+0x314/0x334
<2> [<ffffffc0000b64c8>] process_one_work+0x244/0x3fc
<2> [<ffffffc0000b7324>] worker_thread+0x2f8/0x418
<2> [<ffffffc0000bb40c>] kthread+0xe0/0xec
v2: do addrconf_dad_kick inside read lock and then acquire write
lock for ipv6_ifa_notify as suggested by Eric
Fixes: 7fd2561e4e ("net: ipv6: Add a sysctl to make optimistic
addresses useful candidates")
CRs-Fixed: 970640
Change-Id: I2d8ef58108e2ab29594bd0179af8523eaea6fff9
Cc: Eric Dumazet <edumazet@google.com>
Cc: Erik Kline <ek@google.com>
Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Git-commit: 16186a82de1fdd868255448274e64ae2616e2640
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
update seemp_api header file
update seemp_parm_id header file
update seemp_core to log data with blk header set to 64B
remove logging from fs proc base and net socket modules
Change-Id: I583e3129d62651b155b0372e173564d5a17e3153
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
Improves the ability of a malware protection program
to detect anomalies in various activities. It records
task activities in a log and rates the actions
according to how a typical user would use the tools.
Change-Id: I976bc97f57215f173b046326b5f905522d785288
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
Signed-off-by: William Clark <wclark@codeaurora.org>
This reverts commit 8125696991.
The commit"cfg80211/mac80211: disconnect on suspend" forces disconnection
on wlan interfaces if wake on wireless is not enabled from the user space.
Wake on Wireless is enabled by default in wlan driver (CLD) and cfg80211
layer never aware of wake on wirless enabled status done in wlan driver.
To avoid the disconnection while going to suspend and keep wlan driver
in WOW mode by default, the commit "cfg80211/mac80211: disconnect on
suspend" should be reverted.
CRs-Fixed: 540571
Change-Id: I483fe0530f9f00c338680416449215af326e3df1
Signed-off-by: Ganesh Kondabattini <ganeshk@codeaurora.org>
This reverts commit f04c22033c.
The commit "cfg80211: export interface stopping function" exports a new
cfg80211_stop_iface() function, intended for driver internal interface
combination management and channel switching. The new function is used
by commit "cfg80211/mac80211: disconnect on suspend" which is reverted
in order to avoid the disconnection while going to suspend. Hence the
commit "cfg80211: export interface stopping function" should be reverted.
CRs-Fixed: 540571
Signed-off-by: Ahmad Kholaif <akholaif@codeaurora.org>
AP stopped interface can be used to indicate that the AP mode has
stopped functioning, WLAN driver may have encountered errors that has
forced the driver to stop the AP mode.
When the driver is in P2P-Go mode, and when it goes thru automatic
recovery from firmware crashes, it uses this interface to notify the
userspace that the group has been deleted.
CRs-Fixed: 453060
Change-Id: Ifcd8d4f0c0b26f56a56fb8560aa474297b7521d4
Signed-off-by: Sameer Thalappil <sameert@codeaurora.org>
When flag WIPHY_FLAG_DFS_OFFLOAD is defined, the driver would handle
all the DFS related operations. Therefore the kernel needs to ignore
the DFS state that it uses to block the userspace calls to the driver
through cfg80211 APIs. Also it should treat the userspace calls to
start radar detection as a no-op.
Change-Id: I9dd2076945581ca67e54dfc96dd3dbc526c6f0a2
CRs-Fixed: 630797
Signed-off-by: Amar Singhal <asinghal@codeaurora.org>
[neelanshm@codeaurora.org: Do not include the unrequired
change in util.c]
Signed-off-by: Neelansh Mittal <neelanshm@codeaurora.org>
This commit merges the following commits into one snapshot up to
msm-3.18 commit e70ad0cd5efdd9dc91a77dcdac31d6132e1315c1.
8e465d5 msm: wlan: Update tx power limits of country UA
296bec0 msm: wlan: Update regulatory database for some countries
c0fc361 msm: wlan: Fix the DFS region for Japan
6f1cca3 msm: wlan: Update the wifi regulatory database for TW
2c5867a msm: wlan: Modify JAPAN regulatory rules
e430543 regdb: Update database with 60GHz for Japan
ccce8fb msm: wlan: Correct the parsing of db.txt
acf74a2 cfg80211: add space after the b/w in db.txt
b2b5b4e msm: wlan: update the dfs_region to db.txt
36c64bd msm: wlan: Add country KP
da5d9cb msm: wlan: Update db.txt for regulatory support.
Signed-off-by: Ryan Hsu <ryanhsu@codeaurora.org>
Taking the gratuitous ARP/unsolicited NA detection code from
mwifiex (but fixing it up to not have read-after-skb-end bugs),
implement the ability for userspace to request the behaviour
required by HS2.0 to drop gratuitous ARP and unsolicited NA
frames when proxy ARP service is enabled on the AP. Since this
behaviour is only mandatory for HS2.0 and may not always be
desired, make it optional - modify cfg80211/nl80211 for that.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Git-commit: be9efdecf8ecdcc6d2221845482e7359b33a603b
Git-repo : git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next.git
Change-Id: I1e4083a2327c121073226aa6b75bb6b5b97cec00
CRs-fixed: 621827
[akholaif@codeaurora.org: only picked up the declaration
and definition of cfg80211_is_gratuitous_arp_unsolicited_na()]
Signed-off-by: Ahmad Kholaif <akholaif@codeaurora.org>
This is to help the hardware configured in world
roaming mode to save power when not connected to
any AP.
CRs-Fixed: 542802
Change-Id: Ia643d0e9848dcd486832973bd6dd186edd7bd4ea
Signed-off-by: Mihir Shete <smihir@codeaurora.org>
Added new procfs flag to toggle the automatic addition of prefix
routes on a per device basis. The new flag is accept_ra_prefix_route.
Defaults to 1 as to not break existing behavior.
CRs-Fixed: 435320
Change-Id: If25493890c7531c27f5b2c4855afebbbbf5d072a
Acked-by: Harout S. Hedeshian <harouth@qti.qualcomm.com>
Signed-off-by: Tianyi Gou <tgou@codeaurora.org>
[subashab@codeaurora.org: resolve trivial merge conflicts]
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
added a null check to prevent a null pointer derefence of hard idle
timer
Change-Id: Id1e49d5b109d8c71947723b252f4d2b6f3ebc35f
CRs-Fixed: 880124
Signed-off-by: Susheel Yadav Yadagiri <syadagir@codeaurora.org>
idletimer_resume() assumes that the PM_SUSPEND_PREPARE notifier is sent
before PM_POST_SUSPEND so that timer->last_suspend_time is initialized.
However, it is possible for PM_POST_SUSPEND to be sent first if there is an
error returned from another driver's PM_SUSPEND_PREPARE notifier.
Add a flag indicating whether the current value of timer->last_suspend is
valid.
Detected with CONFIG_SLUB_DEBUG & CONFIG_DEBUG_SPINLOCK in arm64. The
timestamp lock is held for more than a minute while
set_normalized_timespec() proceses the poisoned timer->last_suspend_time
argument.
Change-Id: I95328b0ac85dba819ff9cef751c3d07300c232f1
Signed-off-by: Patrick Daly <pdaly@codeaurora.org>
Force any pending hardidletimer_tg_work() to complete before freeing
the associated work struct.
CRs-Fixed: 814707
Change-Id: I57b2f0dcd24f05ddb472d6007525d1722f9fe0b0
Signed-off-by: Patrick Daly <pdaly@codeaurora.org>
This patch implements a hardidletimer Xtables target that can be used to
identify when interfaces have been idle for a certain period of time.
Timers are identified by labels and are created when a rule is set with a
new label. The rules also take a timeout value (in seconds) as an option.
If more than one rule uses the same timer label, the timer will be
restarted whenever any of the rules get a hit.
One entry for each timer is created in sysfs. This attribute contains the
timer remaining for the timer to expire. The attributes are located under
the xt_idletimer class:
/sys/class/xt_hardidletimer/timers/<label>
When the timer expires, the target module sends a sysfs notification to the
userspace, which can then decide what to do (eg. disconnect to save power)
Compared to xt_IDLETIMER, xt_HARDIDLETIMER can send notifications when CPU
is in suspend too, to notify the timer expiry
Change-Id: I1723d44e02df864d63da7550766ea7d763076de2
Signed-off-by: Bhavya Sokke Mallikarjunappa <bsokke@codeaurora.org>
tc_qdisc_flow_control() incorrectly assumes that all queue disciplines
implement the change() callback in Qdisc_ops. If the flow control function
is called a queue that does not implement change(), we try to jump to a
null function pointer resulting in a panic. The flow control function
does require that the queue discipline support change() in order to
enable/disable the queue. Now we will check if the queue to do flow
control on supports the required funcionality and will WARN_ONCE and
return if the requirements are not met.
[<ffffffc000c5c028>] panic+0x28c
[<ffffffc0000889f4>] die+0x238
[<ffffffc000088a6c>] arm64_notify_die+0x4c
[<ffffffc000088d00>] bad_mode+0xa8
[<ffffffc000ab9ab8>] tc_qdisc_flow_control+0x98
[<ffffffc000c506e8>] rmnet_vnd_ioctl+0x230
[<ffffffc000aac6fc>] dev_ifsioc+0x2a0
[<ffffffc000aacde8>] dev_ioctl+0x644
[<ffffffc000a7db4c>] sock_ioctl+0x4c
[<ffffffc0001af548>] do_vfs_ioctl+0x4b4
[<ffffffc0001af684>] SyS_ioctl+0x60
[<ffffffc0000854b0>] el0_svc_naked+0x24
Change-Id: I85ca324e57814b6c0eac48d2e076e861ab32c260
Signed-off-by: Harout Hedeshian <harouth@codeaurora.org>
A low cost method of determining GRO statistics is required. This
change introduces a new counter which tracks whenever GRO coalesces
ingress packets. The counter is per-CPU and exposed in
/proc/net/softnet_stat as the last column of data. No user space
impact is expected as a result of this change. However, this change
should be reverted if legacy tools have problems with the new column
in softnet_stat.
Change-Id: I05965c0cb150947935d5977884cc4d583b37131d
Signed-off-by: Harout Hedeshian <harouth@codeaurora.org>
[subashab@codeaurora.org: resolve trivial merge conflicts]
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Reserved ports may have some special use cases which are not suitable
for use by general userspace applications. Currently, ports specified
in ip_local_reserved_ports will not be returned only in case of
automatic port assignment.
Add a boolean sysctl flag 'reserved_port_bind'. Default value is 1
which preserves the existing behavior. Setting the value to 0 will
prevent userspace applications from binding to these ports even when
they are explicitly requested.
BUG=20663075
Change-Id: Ib1071ca5bd437cd3c4f71b56147e4858f3b9ebec
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Modify the printout functions for IPv4-TCP, IPv4-UDP, IPv6-TCP, IPv6-UDP,
such that the state for the socket is printed as state = state | 0x80.
The actual socket state is unmodified. This change is required for the
user space to determine whether a socket is a transparent socket, and
to determine if the socket holder intends to consume packets locally
or to forward them to an external processor.
Change-Id: I2ca403b4c2c74e7ddcdbda53e4ba43613bae9c42
Signed-off-by: Harout Hedeshian <harouth@codeaurora.org>
[subashab@codeaurora.org: resolve trivial merge conflicts]
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Cloned packets arriving in ingress path can cause issues with GRO
since the skb shared info is garbled.
Warn once if a cloned packet is queued up to the network stack.
CRs-Fixed: 823275
Change-Id: I049f04f39b3d1338838560e08c93a973de427fc0
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
[subashab@codeaurora.org: resolve trivial merge conflicts]
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
UDP IPv4 encapsulation sockets will have their state printed as 0xF0
binary ORed with the actual state such that they can be distinguished
from regular UDP sockets in /proc/net/udp.
CRs-Fixed: 821341
Change-Id: I240ab1526a4280e5e996d9577a904581684fc84a
Signed-off-by: Harout Hedeshian <harouth@codeaurora.org>
[subashab@codeaurora.org: resolve trivial merge conflicts]
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Too many socket events are generated by netlink socket. Filtering out
unwanted socket events.
Change-Id: I3a4d7e14843cf72d6af2d948113b27928ed01adb
Acked-by: Krishnan Ramachandran <kramacha@qti.qualcomm.com>
Signed-off-by: Harout Hedeshian <harouth@codeaurora.org>
Ensure that BIND and LISTEN syscalls do fput_light AFTER sockev notifier
callback has returned. Also, increase refcount on sock->sk (if available)
before invoking the notifier callback. Prevent crash due to use-after-free.
[<c0891d5c>] (sockev_client_cb+0xfc/0x1e4) from [<c0a273a4>] (notifier_cal
[<c0a273a4>] (notifier_call_chain+0x44/0x84) from [<c01422cc>] (__blocking
[<c01422cc>] (__blocking_notifier_call_chain+0x48/0x60) from [<c01422fc>]
[<c01422fc>] (blocking_notifier_call_chain+0x18/0x20) from [<c0865968>] (S
[<c0865968>] (SyS_bind+0xb0/0xe8) from [<c0105ba0>] (ret_fast_syscall+0x0/
CRs-Fixed: 787283
Change-Id: I2de65929b22c58637692cf582b6b46b11713494e
Signed-off-by: Harout Hedeshian <harouth@codeaurora.org>
Added module which subscribes to socket notifier events. Notifier events
are then converted to a multicast netlink message for user space
applications to consume.
CRs-Fixed: 626021
Change-Id: Id5c6808d972b69f5f065d7fba9094e75c6ad0b2c
Signed-off-by: Harout Hedeshian <harouth@codeaurora.org>
[subashab@codeaurora.org: resolve trivial merge conflicts]
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Allows other areas in the kernel to register notifier callbacks which
get invoked whenever something performs an administrative action on a
socket. This patch adds hooks in socket(), bind(), listen(), accept(),
shutdown().
CRs-Fixed: 626021
Change-Id: I4ae99cb2206d7c4eddba69757335c18d10143045
Signed-off-by: Harout Hedeshian <harouth@codeaurora.org>
[subashab@codeaurora.org: resolve trivial merge conflicts]
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
The networking module uses iov_iter library to manage the vector buffers
from user-space. Use iov_iter accessor functions to copy the data from/to
the user-space vector buffers.
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
Update the function signature of sendmsg and recvmsg operations.
Pass the kernel socket flag to the updated socket object allocation
function.
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
