1 |
commit: ea80b3ffdf0cbc13e3d65a4f84ff8af127c33061 |
2 |
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> |
3 |
AuthorDate: Fri Mar 3 12:30:10 2023 +0000 |
4 |
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> |
5 |
CommitDate: Fri Mar 3 12:30:10 2023 +0000 |
6 |
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=ea80b3ff |
7 |
|
8 |
Linux patch 5.10.171 |
9 |
|
10 |
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> |
11 |
|
12 |
0000_README | 4 + |
13 |
1170_linux-5.10.171.patch | 597 ++++++++++++++++++++++++++++++++++++++++++++++ |
14 |
2 files changed, 601 insertions(+) |
15 |
|
16 |
diff --git a/0000_README b/0000_README |
17 |
index 4e3efaf2..1a198b29 100644 |
18 |
--- a/0000_README |
19 |
+++ b/0000_README |
20 |
@@ -723,6 +723,10 @@ Patch: 1169_linux-5.10.170.patch |
21 |
From: https://www.kernel.org |
22 |
Desc: Linux 5.10.170 |
23 |
|
24 |
+Patch: 1170_linux-5.10.171.patch |
25 |
+From: https://www.kernel.org |
26 |
+Desc: Linux 5.10.171 |
27 |
+ |
28 |
Patch: 1500_XATTR_USER_PREFIX.patch |
29 |
From: https://bugs.gentoo.org/show_bug.cgi?id=470644 |
30 |
Desc: Support for namespace user.pax.* on tmpfs. |
31 |
|
32 |
diff --git a/1170_linux-5.10.171.patch b/1170_linux-5.10.171.patch |
33 |
new file mode 100644 |
34 |
index 00000000..689d118e |
35 |
--- /dev/null |
36 |
+++ b/1170_linux-5.10.171.patch |
37 |
@@ -0,0 +1,597 @@ |
38 |
+diff --git a/Makefile b/Makefile |
39 |
+index 028fca7ec5cf3..9dde2c2307893 100644 |
40 |
+--- a/Makefile |
41 |
++++ b/Makefile |
42 |
+@@ -1,7 +1,7 @@ |
43 |
+ # SPDX-License-Identifier: GPL-2.0 |
44 |
+ VERSION = 5 |
45 |
+ PATCHLEVEL = 10 |
46 |
+-SUBLEVEL = 170 |
47 |
++SUBLEVEL = 171 |
48 |
+ EXTRAVERSION = |
49 |
+ NAME = Dare mighty things |
50 |
+ |
51 |
+diff --git a/arch/arm/boot/dts/rk3288.dtsi b/arch/arm/boot/dts/rk3288.dtsi |
52 |
+index 9051fb4a267d4..aab28161b9ae9 100644 |
53 |
+--- a/arch/arm/boot/dts/rk3288.dtsi |
54 |
++++ b/arch/arm/boot/dts/rk3288.dtsi |
55 |
+@@ -1203,6 +1203,7 @@ |
56 |
+ clock-names = "dp", "pclk"; |
57 |
+ phys = <&edp_phy>; |
58 |
+ phy-names = "dp"; |
59 |
++ power-domains = <&power RK3288_PD_VIO>; |
60 |
+ resets = <&cru SRST_EDP>; |
61 |
+ reset-names = "dp"; |
62 |
+ rockchip,grf = <&grf>; |
63 |
+diff --git a/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts b/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts |
64 |
+index daa9a0c601a9f..22ab5e1d7319d 100644 |
65 |
+--- a/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts |
66 |
++++ b/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts |
67 |
+@@ -91,7 +91,6 @@ |
68 |
+ linux,default-trigger = "heartbeat"; |
69 |
+ gpios = <&rk805 1 GPIO_ACTIVE_LOW>; |
70 |
+ default-state = "on"; |
71 |
+- mode = <0x23>; |
72 |
+ }; |
73 |
+ |
74 |
+ user_led: led-1 { |
75 |
+@@ -99,7 +98,6 @@ |
76 |
+ linux,default-trigger = "mmc1"; |
77 |
+ gpios = <&rk805 0 GPIO_ACTIVE_LOW>; |
78 |
+ default-state = "off"; |
79 |
+- mode = <0x05>; |
80 |
+ }; |
81 |
+ }; |
82 |
+ }; |
83 |
+diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c |
84 |
+index 99e23a5df0267..2306abb09f7f5 100644 |
85 |
+--- a/drivers/acpi/nfit/core.c |
86 |
++++ b/drivers/acpi/nfit/core.c |
87 |
+@@ -3687,8 +3687,8 @@ void acpi_nfit_shutdown(void *data) |
88 |
+ |
89 |
+ mutex_lock(&acpi_desc->init_mutex); |
90 |
+ set_bit(ARS_CANCEL, &acpi_desc->scrub_flags); |
91 |
+- cancel_delayed_work_sync(&acpi_desc->dwork); |
92 |
+ mutex_unlock(&acpi_desc->init_mutex); |
93 |
++ cancel_delayed_work_sync(&acpi_desc->dwork); |
94 |
+ |
95 |
+ /* |
96 |
+ * Bounce the nvdimm bus lock to make sure any in-flight |
97 |
+diff --git a/drivers/gpu/drm/virtio/virtgpu_object.c b/drivers/gpu/drm/virtio/virtgpu_object.c |
98 |
+index 0c98978e2e55c..1681486860019 100644 |
99 |
+--- a/drivers/gpu/drm/virtio/virtgpu_object.c |
100 |
++++ b/drivers/gpu/drm/virtio/virtgpu_object.c |
101 |
+@@ -157,9 +157,10 @@ static int virtio_gpu_object_shmem_init(struct virtio_gpu_device *vgdev, |
102 |
+ * since virtio_gpu doesn't support dma-buf import from other devices. |
103 |
+ */ |
104 |
+ shmem->pages = drm_gem_shmem_get_sg_table(&bo->base.base); |
105 |
+- if (!shmem->pages) { |
106 |
++ if (IS_ERR(shmem->pages)) { |
107 |
+ drm_gem_shmem_unpin(&bo->base.base); |
108 |
+- return -EINVAL; |
109 |
++ shmem->pages = NULL; |
110 |
++ return PTR_ERR(shmem->pages); |
111 |
+ } |
112 |
+ |
113 |
+ if (use_dma_api) { |
114 |
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c |
115 |
+index baadead947c8b..5f9ec1d1464a2 100644 |
116 |
+--- a/drivers/hid/hid-core.c |
117 |
++++ b/drivers/hid/hid-core.c |
118 |
+@@ -1197,6 +1197,7 @@ int hid_open_report(struct hid_device *device) |
119 |
+ __u8 *end; |
120 |
+ __u8 *next; |
121 |
+ int ret; |
122 |
++ int i; |
123 |
+ static int (*dispatch_type[])(struct hid_parser *parser, |
124 |
+ struct hid_item *item) = { |
125 |
+ hid_parser_main, |
126 |
+@@ -1247,6 +1248,8 @@ int hid_open_report(struct hid_device *device) |
127 |
+ goto err; |
128 |
+ } |
129 |
+ device->collection_size = HID_DEFAULT_NUM_COLLECTIONS; |
130 |
++ for (i = 0; i < HID_DEFAULT_NUM_COLLECTIONS; i++) |
131 |
++ device->collection[i].parent_idx = -1; |
132 |
+ |
133 |
+ ret = -EINVAL; |
134 |
+ while ((next = fetch_item(start, end, &item)) != NULL) { |
135 |
+diff --git a/drivers/infiniband/hw/hfi1/user_exp_rcv.c b/drivers/infiniband/hw/hfi1/user_exp_rcv.c |
136 |
+index 897923981855d..0e0be6c62e3d1 100644 |
137 |
+--- a/drivers/infiniband/hw/hfi1/user_exp_rcv.c |
138 |
++++ b/drivers/infiniband/hw/hfi1/user_exp_rcv.c |
139 |
+@@ -202,16 +202,11 @@ static void unpin_rcv_pages(struct hfi1_filedata *fd, |
140 |
+ static int pin_rcv_pages(struct hfi1_filedata *fd, struct tid_user_buf *tidbuf) |
141 |
+ { |
142 |
+ int pinned; |
143 |
+- unsigned int npages; |
144 |
++ unsigned int npages = tidbuf->npages; |
145 |
+ unsigned long vaddr = tidbuf->vaddr; |
146 |
+ struct page **pages = NULL; |
147 |
+ struct hfi1_devdata *dd = fd->uctxt->dd; |
148 |
+ |
149 |
+- /* Get the number of pages the user buffer spans */ |
150 |
+- npages = num_user_pages(vaddr, tidbuf->length); |
151 |
+- if (!npages) |
152 |
+- return -EINVAL; |
153 |
+- |
154 |
+ if (npages > fd->uctxt->expected_count) { |
155 |
+ dd_dev_err(dd, "Expected buffer too big\n"); |
156 |
+ return -EINVAL; |
157 |
+@@ -238,7 +233,6 @@ static int pin_rcv_pages(struct hfi1_filedata *fd, struct tid_user_buf *tidbuf) |
158 |
+ return pinned; |
159 |
+ } |
160 |
+ tidbuf->pages = pages; |
161 |
+- tidbuf->npages = npages; |
162 |
+ fd->tid_n_pinned += pinned; |
163 |
+ return pinned; |
164 |
+ } |
165 |
+@@ -316,6 +310,7 @@ int hfi1_user_exp_rcv_setup(struct hfi1_filedata *fd, |
166 |
+ mutex_init(&tidbuf->cover_mutex); |
167 |
+ tidbuf->vaddr = tinfo->vaddr; |
168 |
+ tidbuf->length = tinfo->length; |
169 |
++ tidbuf->npages = num_user_pages(tidbuf->vaddr, tidbuf->length); |
170 |
+ tidbuf->psets = kcalloc(uctxt->expected_count, sizeof(*tidbuf->psets), |
171 |
+ GFP_KERNEL); |
172 |
+ if (!tidbuf->psets) { |
173 |
+diff --git a/drivers/md/md.c b/drivers/md/md.c |
174 |
+index 3038e7ecb7e16..c0b34637bd667 100644 |
175 |
+--- a/drivers/md/md.c |
176 |
++++ b/drivers/md/md.c |
177 |
+@@ -5683,6 +5683,7 @@ static int md_alloc(dev_t dev, char *name) |
178 |
+ * completely removed (mddev_delayed_delete). |
179 |
+ */ |
180 |
+ flush_workqueue(md_misc_wq); |
181 |
++ flush_workqueue(md_rdev_misc_wq); |
182 |
+ |
183 |
+ mutex_lock(&disks_mutex); |
184 |
+ error = -EEXIST; |
185 |
+diff --git a/drivers/tty/vt/vc_screen.c b/drivers/tty/vt/vc_screen.c |
186 |
+index f566eb1839dc5..71e091f879f0e 100644 |
187 |
+--- a/drivers/tty/vt/vc_screen.c |
188 |
++++ b/drivers/tty/vt/vc_screen.c |
189 |
+@@ -403,10 +403,11 @@ vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos) |
190 |
+ unsigned int this_round, skip = 0; |
191 |
+ int size; |
192 |
+ |
193 |
+- ret = -ENXIO; |
194 |
+ vc = vcs_vc(inode, &viewed); |
195 |
+- if (!vc) |
196 |
+- goto unlock_out; |
197 |
++ if (!vc) { |
198 |
++ ret = -ENXIO; |
199 |
++ break; |
200 |
++ } |
201 |
+ |
202 |
+ /* Check whether we are above size each round, |
203 |
+ * as copy_to_user at the end of this loop |
204 |
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c |
205 |
+index 5925b8eb9ee38..7af2def631a24 100644 |
206 |
+--- a/drivers/usb/core/hub.c |
207 |
++++ b/drivers/usb/core/hub.c |
208 |
+@@ -2380,9 +2380,8 @@ static int usb_enumerate_device_otg(struct usb_device *udev) |
209 |
+ * usb_enumerate_device - Read device configs/intfs/otg (usbcore-internal) |
210 |
+ * @udev: newly addressed device (in ADDRESS state) |
211 |
+ * |
212 |
+- * This is only called by usb_new_device() and usb_authorize_device() |
213 |
+- * and FIXME -- all comments that apply to them apply here wrt to |
214 |
+- * environment. |
215 |
++ * This is only called by usb_new_device() -- all comments that apply there |
216 |
++ * apply here wrt to environment. |
217 |
+ * |
218 |
+ * If the device is WUSB and not authorized, we don't attempt to read |
219 |
+ * the string descriptors, as they will be errored out by the device |
220 |
+diff --git a/drivers/usb/core/sysfs.c b/drivers/usb/core/sysfs.c |
221 |
+index 8d134193fa0cf..a2ca38e25e0c3 100644 |
222 |
+--- a/drivers/usb/core/sysfs.c |
223 |
++++ b/drivers/usb/core/sysfs.c |
224 |
+@@ -889,11 +889,7 @@ read_descriptors(struct file *filp, struct kobject *kobj, |
225 |
+ size_t srclen, n; |
226 |
+ int cfgno; |
227 |
+ void *src; |
228 |
+- int retval; |
229 |
+ |
230 |
+- retval = usb_lock_device_interruptible(udev); |
231 |
+- if (retval < 0) |
232 |
+- return -EINTR; |
233 |
+ /* The binary attribute begins with the device descriptor. |
234 |
+ * Following that are the raw descriptor entries for all the |
235 |
+ * configurations (config plus subsidiary descriptors). |
236 |
+@@ -918,7 +914,6 @@ read_descriptors(struct file *filp, struct kobject *kobj, |
237 |
+ off -= srclen; |
238 |
+ } |
239 |
+ } |
240 |
+- usb_unlock_device(udev); |
241 |
+ return count - nleft; |
242 |
+ } |
243 |
+ |
244 |
+diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c |
245 |
+index 2caccbb6e0140..7b54e814aefb1 100644 |
246 |
+--- a/drivers/usb/gadget/function/u_serial.c |
247 |
++++ b/drivers/usb/gadget/function/u_serial.c |
248 |
+@@ -81,6 +81,9 @@ |
249 |
+ #define WRITE_BUF_SIZE 8192 /* TX only */ |
250 |
+ #define GS_CONSOLE_BUF_SIZE 8192 |
251 |
+ |
252 |
++/* Prevents race conditions while accessing gser->ioport */ |
253 |
++static DEFINE_SPINLOCK(serial_port_lock); |
254 |
++ |
255 |
+ /* console info */ |
256 |
+ struct gs_console { |
257 |
+ struct console console; |
258 |
+@@ -1376,8 +1379,10 @@ void gserial_disconnect(struct gserial *gser) |
259 |
+ if (!port) |
260 |
+ return; |
261 |
+ |
262 |
++ spin_lock_irqsave(&serial_port_lock, flags); |
263 |
++ |
264 |
+ /* tell the TTY glue not to do I/O here any more */ |
265 |
+- spin_lock_irqsave(&port->port_lock, flags); |
266 |
++ spin_lock(&port->port_lock); |
267 |
+ |
268 |
+ gs_console_disconnect(port); |
269 |
+ |
270 |
+@@ -1392,7 +1397,8 @@ void gserial_disconnect(struct gserial *gser) |
271 |
+ tty_hangup(port->port.tty); |
272 |
+ } |
273 |
+ port->suspended = false; |
274 |
+- spin_unlock_irqrestore(&port->port_lock, flags); |
275 |
++ spin_unlock(&port->port_lock); |
276 |
++ spin_unlock_irqrestore(&serial_port_lock, flags); |
277 |
+ |
278 |
+ /* disable endpoints, aborting down any active I/O */ |
279 |
+ usb_ep_disable(gser->out); |
280 |
+@@ -1426,10 +1432,19 @@ EXPORT_SYMBOL_GPL(gserial_suspend); |
281 |
+ |
282 |
+ void gserial_resume(struct gserial *gser) |
283 |
+ { |
284 |
+- struct gs_port *port = gser->ioport; |
285 |
++ struct gs_port *port; |
286 |
+ unsigned long flags; |
287 |
+ |
288 |
+- spin_lock_irqsave(&port->port_lock, flags); |
289 |
++ spin_lock_irqsave(&serial_port_lock, flags); |
290 |
++ port = gser->ioport; |
291 |
++ |
292 |
++ if (!port) { |
293 |
++ spin_unlock_irqrestore(&serial_port_lock, flags); |
294 |
++ return; |
295 |
++ } |
296 |
++ |
297 |
++ spin_lock(&port->port_lock); |
298 |
++ spin_unlock(&serial_port_lock); |
299 |
+ port->suspended = false; |
300 |
+ if (!port->start_delayed) { |
301 |
+ spin_unlock_irqrestore(&port->port_lock, flags); |
302 |
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c |
303 |
+index 2fc65cbbfea95..14a7af7f3bcd7 100644 |
304 |
+--- a/drivers/usb/serial/option.c |
305 |
++++ b/drivers/usb/serial/option.c |
306 |
+@@ -402,6 +402,8 @@ static void option_instat_callback(struct urb *urb); |
307 |
+ #define LONGCHEER_VENDOR_ID 0x1c9e |
308 |
+ |
309 |
+ /* 4G Systems products */ |
310 |
++/* This one was sold as the VW and Skoda "Carstick LTE" */ |
311 |
++#define FOUR_G_SYSTEMS_PRODUCT_CARSTICK_LTE 0x7605 |
312 |
+ /* This is the 4G XS Stick W14 a.k.a. Mobilcom Debitel Surf-Stick * |
313 |
+ * It seems to contain a Qualcomm QSC6240/6290 chipset */ |
314 |
+ #define FOUR_G_SYSTEMS_PRODUCT_W14 0x9603 |
315 |
+@@ -1976,6 +1978,8 @@ static const struct usb_device_id option_ids[] = { |
316 |
+ .driver_info = RSVD(2) }, |
317 |
+ { USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) }, |
318 |
+ { USB_DEVICE(TLAYTECH_VENDOR_ID, TLAYTECH_PRODUCT_TEU800) }, |
319 |
++ { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_CARSTICK_LTE), |
320 |
++ .driver_info = RSVD(0) }, |
321 |
+ { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14), |
322 |
+ .driver_info = NCTRL(0) | NCTRL(1) }, |
323 |
+ { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W100), |
324 |
+diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c |
325 |
+index 4a6ba0997e399..b081b61e97c8d 100644 |
326 |
+--- a/fs/btrfs/send.c |
327 |
++++ b/fs/btrfs/send.c |
328 |
+@@ -7276,10 +7276,10 @@ long btrfs_ioctl_send(struct file *mnt_file, struct btrfs_ioctl_send_args *arg) |
329 |
+ /* |
330 |
+ * Check that we don't overflow at later allocations, we request |
331 |
+ * clone_sources_count + 1 items, and compare to unsigned long inside |
332 |
+- * access_ok. |
333 |
++ * access_ok. Also set an upper limit for allocation size so this can't |
334 |
++ * easily exhaust memory. Max number of clone sources is about 200K. |
335 |
+ */ |
336 |
+- if (arg->clone_sources_count > |
337 |
+- ULONG_MAX / sizeof(struct clone_root) - 1) { |
338 |
++ if (arg->clone_sources_count > SZ_8M / sizeof(struct clone_root)) { |
339 |
+ ret = -EINVAL; |
340 |
+ goto out; |
341 |
+ } |
342 |
+diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c |
343 |
+index 642e1a0560c6d..0c27b81ee1eb7 100644 |
344 |
+--- a/io_uring/io_uring.c |
345 |
++++ b/io_uring/io_uring.c |
346 |
+@@ -1092,7 +1092,8 @@ static int __io_register_rsrc_update(struct io_ring_ctx *ctx, unsigned type, |
347 |
+ unsigned nr_args); |
348 |
+ static void io_clean_op(struct io_kiocb *req); |
349 |
+ static struct file *io_file_get(struct io_ring_ctx *ctx, |
350 |
+- struct io_kiocb *req, int fd, bool fixed); |
351 |
++ struct io_kiocb *req, int fd, bool fixed, |
352 |
++ unsigned int issue_flags); |
353 |
+ static void __io_queue_sqe(struct io_kiocb *req); |
354 |
+ static void io_rsrc_put_work(struct work_struct *work); |
355 |
+ |
356 |
+@@ -3975,7 +3976,7 @@ static int io_tee(struct io_kiocb *req, unsigned int issue_flags) |
357 |
+ return -EAGAIN; |
358 |
+ |
359 |
+ in = io_file_get(req->ctx, req, sp->splice_fd_in, |
360 |
+- (sp->flags & SPLICE_F_FD_IN_FIXED)); |
361 |
++ (sp->flags & SPLICE_F_FD_IN_FIXED), issue_flags); |
362 |
+ if (!in) { |
363 |
+ ret = -EBADF; |
364 |
+ goto done; |
365 |
+@@ -4015,7 +4016,7 @@ static int io_splice(struct io_kiocb *req, unsigned int issue_flags) |
366 |
+ return -EAGAIN; |
367 |
+ |
368 |
+ in = io_file_get(req->ctx, req, sp->splice_fd_in, |
369 |
+- (sp->flags & SPLICE_F_FD_IN_FIXED)); |
370 |
++ (sp->flags & SPLICE_F_FD_IN_FIXED), issue_flags); |
371 |
+ if (!in) { |
372 |
+ ret = -EBADF; |
373 |
+ goto done; |
374 |
+@@ -6876,13 +6877,16 @@ static void io_fixed_file_set(struct io_fixed_file *file_slot, struct file *file |
375 |
+ } |
376 |
+ |
377 |
+ static inline struct file *io_file_get_fixed(struct io_ring_ctx *ctx, |
378 |
+- struct io_kiocb *req, int fd) |
379 |
++ struct io_kiocb *req, int fd, |
380 |
++ unsigned int issue_flags) |
381 |
+ { |
382 |
+- struct file *file; |
383 |
++ struct file *file = NULL; |
384 |
+ unsigned long file_ptr; |
385 |
+ |
386 |
++ io_ring_submit_lock(ctx, !(issue_flags & IO_URING_F_NONBLOCK)); |
387 |
++ |
388 |
+ if (unlikely((unsigned int)fd >= ctx->nr_user_files)) |
389 |
+- return NULL; |
390 |
++ goto out; |
391 |
+ fd = array_index_nospec(fd, ctx->nr_user_files); |
392 |
+ file_ptr = io_fixed_file_slot(&ctx->file_table, fd)->file_ptr; |
393 |
+ file = (struct file *) (file_ptr & FFS_MASK); |
394 |
+@@ -6890,6 +6894,8 @@ static inline struct file *io_file_get_fixed(struct io_ring_ctx *ctx, |
395 |
+ /* mask in overlapping REQ_F and FFS bits */ |
396 |
+ req->flags |= (file_ptr << REQ_F_NOWAIT_READ_BIT); |
397 |
+ io_req_set_rsrc_node(req); |
398 |
++out: |
399 |
++ io_ring_submit_unlock(ctx, !(issue_flags & IO_URING_F_NONBLOCK)); |
400 |
+ return file; |
401 |
+ } |
402 |
+ |
403 |
+@@ -6907,10 +6913,11 @@ static struct file *io_file_get_normal(struct io_ring_ctx *ctx, |
404 |
+ } |
405 |
+ |
406 |
+ static inline struct file *io_file_get(struct io_ring_ctx *ctx, |
407 |
+- struct io_kiocb *req, int fd, bool fixed) |
408 |
++ struct io_kiocb *req, int fd, bool fixed, |
409 |
++ unsigned int issue_flags) |
410 |
+ { |
411 |
+ if (fixed) |
412 |
+- return io_file_get_fixed(ctx, req, fd); |
413 |
++ return io_file_get_fixed(ctx, req, fd, issue_flags); |
414 |
+ else |
415 |
+ return io_file_get_normal(ctx, req, fd); |
416 |
+ } |
417 |
+@@ -7132,7 +7139,7 @@ static int io_init_req(struct io_ring_ctx *ctx, struct io_kiocb *req, |
418 |
+ |
419 |
+ if (io_op_defs[req->opcode].needs_file) { |
420 |
+ req->file = io_file_get(ctx, req, READ_ONCE(sqe->fd), |
421 |
+- (sqe_flags & IOSQE_FIXED_FILE)); |
422 |
++ (sqe_flags & IOSQE_FIXED_FILE), 0); |
423 |
+ if (unlikely(!req->file)) |
424 |
+ ret = -EBADF; |
425 |
+ } |
426 |
+diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c |
427 |
+index 9d26c5e9da058..d35ea927ca8af 100644 |
428 |
+--- a/net/caif/caif_socket.c |
429 |
++++ b/net/caif/caif_socket.c |
430 |
+@@ -1020,6 +1020,7 @@ static void caif_sock_destructor(struct sock *sk) |
431 |
+ return; |
432 |
+ } |
433 |
+ sk_stream_kill_queues(&cf_sk->sk); |
434 |
++ WARN_ON(sk->sk_forward_alloc); |
435 |
+ caif_free_client(&cf_sk->layer); |
436 |
+ } |
437 |
+ |
438 |
+diff --git a/net/core/filter.c b/net/core/filter.c |
439 |
+index a5df0cf46bbf8..b9c954182b375 100644 |
440 |
+--- a/net/core/filter.c |
441 |
++++ b/net/core/filter.c |
442 |
+@@ -5401,7 +5401,7 @@ static int bpf_ipv4_fib_lookup(struct net *net, struct bpf_fib_lookup *params, |
443 |
+ neigh = __ipv6_neigh_lookup_noref_stub(dev, dst); |
444 |
+ } |
445 |
+ |
446 |
+- if (!neigh) |
447 |
++ if (!neigh || !(neigh->nud_state & NUD_VALID)) |
448 |
+ return BPF_FIB_LKUP_RET_NO_NEIGH; |
449 |
+ |
450 |
+ return bpf_fib_set_fwd_params(params, neigh, dev); |
451 |
+@@ -5514,7 +5514,7 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params, |
452 |
+ * not needed here. |
453 |
+ */ |
454 |
+ neigh = __ipv6_neigh_lookup_noref_stub(dev, dst); |
455 |
+- if (!neigh) |
456 |
++ if (!neigh || !(neigh->nud_state & NUD_VALID)) |
457 |
+ return BPF_FIB_LKUP_RET_NO_NEIGH; |
458 |
+ |
459 |
+ return bpf_fib_set_fwd_params(params, neigh, dev); |
460 |
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c |
461 |
+index f6f580e9d2820..82ccc3eebe71d 100644 |
462 |
+--- a/net/core/neighbour.c |
463 |
++++ b/net/core/neighbour.c |
464 |
+@@ -242,7 +242,7 @@ static int neigh_forced_gc(struct neigh_table *tbl) |
465 |
+ (n->nud_state == NUD_NOARP) || |
466 |
+ (tbl->is_multicast && |
467 |
+ tbl->is_multicast(n->primary_key)) || |
468 |
+- time_after(tref, n->updated)) |
469 |
++ !time_in_range(n->updated, tref, jiffies)) |
470 |
+ remove = true; |
471 |
+ write_unlock(&n->lock); |
472 |
+ |
473 |
+@@ -262,7 +262,17 @@ static int neigh_forced_gc(struct neigh_table *tbl) |
474 |
+ |
475 |
+ static void neigh_add_timer(struct neighbour *n, unsigned long when) |
476 |
+ { |
477 |
++ /* Use safe distance from the jiffies - LONG_MAX point while timer |
478 |
++ * is running in DELAY/PROBE state but still show to user space |
479 |
++ * large times in the past. |
480 |
++ */ |
481 |
++ unsigned long mint = jiffies - (LONG_MAX - 86400 * HZ); |
482 |
++ |
483 |
+ neigh_hold(n); |
484 |
++ if (!time_in_range(n->confirmed, mint, jiffies)) |
485 |
++ n->confirmed = mint; |
486 |
++ if (time_before(n->used, n->confirmed)) |
487 |
++ n->used = n->confirmed; |
488 |
+ if (unlikely(mod_timer(&n->timer, when))) { |
489 |
+ printk("NEIGH: BUG, double timer add, state is %x\n", |
490 |
+ n->nud_state); |
491 |
+@@ -948,12 +958,14 @@ static void neigh_periodic_work(struct work_struct *work) |
492 |
+ goto next_elt; |
493 |
+ } |
494 |
+ |
495 |
+- if (time_before(n->used, n->confirmed)) |
496 |
++ if (time_before(n->used, n->confirmed) && |
497 |
++ time_is_before_eq_jiffies(n->confirmed)) |
498 |
+ n->used = n->confirmed; |
499 |
+ |
500 |
+ if (refcount_read(&n->refcnt) == 1 && |
501 |
+ (state == NUD_FAILED || |
502 |
+- time_after(jiffies, n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) { |
503 |
++ !time_in_range_open(jiffies, n->used, |
504 |
++ n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) { |
505 |
+ *np = n->next; |
506 |
+ neigh_mark_dead(n); |
507 |
+ write_unlock(&n->lock); |
508 |
+diff --git a/net/core/stream.c b/net/core/stream.c |
509 |
+index d7c5413d16d57..cd60746877b1e 100644 |
510 |
+--- a/net/core/stream.c |
511 |
++++ b/net/core/stream.c |
512 |
+@@ -209,7 +209,6 @@ void sk_stream_kill_queues(struct sock *sk) |
513 |
+ sk_mem_reclaim(sk); |
514 |
+ |
515 |
+ WARN_ON(sk->sk_wmem_queued); |
516 |
+- WARN_ON(sk->sk_forward_alloc); |
517 |
+ |
518 |
+ /* It is _impossible_ for the backlog to contain anything |
519 |
+ * when we get here. All user references to this socket |
520 |
+diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c |
521 |
+index da518b4ca84c6..e4f21a6924153 100644 |
522 |
+--- a/net/xfrm/xfrm_interface.c |
523 |
++++ b/net/xfrm/xfrm_interface.c |
524 |
+@@ -207,6 +207,52 @@ static void xfrmi_scrub_packet(struct sk_buff *skb, bool xnet) |
525 |
+ skb->mark = 0; |
526 |
+ } |
527 |
+ |
528 |
++static int xfrmi_input(struct sk_buff *skb, int nexthdr, __be32 spi, |
529 |
++ int encap_type, unsigned short family) |
530 |
++{ |
531 |
++ struct sec_path *sp; |
532 |
++ |
533 |
++ sp = skb_sec_path(skb); |
534 |
++ if (sp && (sp->len || sp->olen) && |
535 |
++ !xfrm_policy_check(NULL, XFRM_POLICY_IN, skb, family)) |
536 |
++ goto discard; |
537 |
++ |
538 |
++ XFRM_SPI_SKB_CB(skb)->family = family; |
539 |
++ if (family == AF_INET) { |
540 |
++ XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr); |
541 |
++ XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL; |
542 |
++ } else { |
543 |
++ XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct ipv6hdr, daddr); |
544 |
++ XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 = NULL; |
545 |
++ } |
546 |
++ |
547 |
++ return xfrm_input(skb, nexthdr, spi, encap_type); |
548 |
++discard: |
549 |
++ kfree_skb(skb); |
550 |
++ return 0; |
551 |
++} |
552 |
++ |
553 |
++static int xfrmi4_rcv(struct sk_buff *skb) |
554 |
++{ |
555 |
++ return xfrmi_input(skb, ip_hdr(skb)->protocol, 0, 0, AF_INET); |
556 |
++} |
557 |
++ |
558 |
++static int xfrmi6_rcv(struct sk_buff *skb) |
559 |
++{ |
560 |
++ return xfrmi_input(skb, skb_network_header(skb)[IP6CB(skb)->nhoff], |
561 |
++ 0, 0, AF_INET6); |
562 |
++} |
563 |
++ |
564 |
++static int xfrmi4_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) |
565 |
++{ |
566 |
++ return xfrmi_input(skb, nexthdr, spi, encap_type, AF_INET); |
567 |
++} |
568 |
++ |
569 |
++static int xfrmi6_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) |
570 |
++{ |
571 |
++ return xfrmi_input(skb, nexthdr, spi, encap_type, AF_INET6); |
572 |
++} |
573 |
++ |
574 |
+ static int xfrmi_rcv_cb(struct sk_buff *skb, int err) |
575 |
+ { |
576 |
+ const struct xfrm_mode *inner_mode; |
577 |
+@@ -780,8 +826,8 @@ static struct pernet_operations xfrmi_net_ops = { |
578 |
+ }; |
579 |
+ |
580 |
+ static struct xfrm6_protocol xfrmi_esp6_protocol __read_mostly = { |
581 |
+- .handler = xfrm6_rcv, |
582 |
+- .input_handler = xfrm_input, |
583 |
++ .handler = xfrmi6_rcv, |
584 |
++ .input_handler = xfrmi6_input, |
585 |
+ .cb_handler = xfrmi_rcv_cb, |
586 |
+ .err_handler = xfrmi6_err, |
587 |
+ .priority = 10, |
588 |
+@@ -831,8 +877,8 @@ static struct xfrm6_tunnel xfrmi_ip6ip_handler __read_mostly = { |
589 |
+ #endif |
590 |
+ |
591 |
+ static struct xfrm4_protocol xfrmi_esp4_protocol __read_mostly = { |
592 |
+- .handler = xfrm4_rcv, |
593 |
+- .input_handler = xfrm_input, |
594 |
++ .handler = xfrmi4_rcv, |
595 |
++ .input_handler = xfrmi4_input, |
596 |
+ .cb_handler = xfrmi_rcv_cb, |
597 |
+ .err_handler = xfrmi4_err, |
598 |
+ .priority = 10, |
599 |
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c |
600 |
+index 0d12bdf59d4cc..d15aa62887de0 100644 |
601 |
+--- a/net/xfrm/xfrm_policy.c |
602 |
++++ b/net/xfrm/xfrm_policy.c |
603 |
+@@ -3710,6 +3710,9 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, |
604 |
+ goto reject; |
605 |
+ } |
606 |
+ |
607 |
++ if (if_id) |
608 |
++ secpath_reset(skb); |
609 |
++ |
610 |
+ xfrm_pols_put(pols, npols); |
611 |
+ return 1; |
612 |
+ } |
613 |
+diff --git a/scripts/tags.sh b/scripts/tags.sh |
614 |
+index fd96734deff13..b82aebb0c995e 100755 |
615 |
+--- a/scripts/tags.sh |
616 |
++++ b/scripts/tags.sh |
617 |
+@@ -95,10 +95,13 @@ all_sources() |
618 |
+ |
619 |
+ all_compiled_sources() |
620 |
+ { |
621 |
+- realpath -es $([ -z "$KBUILD_ABS_SRCTREE" ] && echo --relative-to=.) \ |
622 |
+- include/generated/autoconf.h $(find $ignore -name "*.cmd" -exec \ |
623 |
+- grep -Poh '(?(?=^source_.* \K).*|(?=^ \K\S).*(?= \\))' {} \+ | |
624 |
+- awk '!a[$0]++') | sort -u |
625 |
++ { |
626 |
++ echo include/generated/autoconf.h |
627 |
++ find $ignore -name "*.cmd" -exec \ |
628 |
++ sed -n -E 's/^source_.* (.*)/\1/p; s/^ (\S.*) \\/\1/p' {} \+ | |
629 |
++ awk '!a[$0]++' |
630 |
++ } | xargs realpath -es $([ -z "$KBUILD_ABS_SRCTREE" ] && echo --relative-to=.) | |
631 |
++ sort -u |
632 |
+ } |
633 |
+ |
634 |
+ all_target_sources() |