Commit 8aca45f6 authored Mar 21, 2022 by Greg Kroah-Hartman

Merge branch 'android11-5.4' into 'android11-5.4-lts'

Sync up with android11-5.4 for the following commits:

d8789c9d Merge tag 'android11-5.4.180_r00' into android11-5.4
e12150c5 UPSTREAM: usb: gadget: Fix use-after-free bug by not setting udc->dev.driver
9f938618 UPSTREAM: usb: gadget: rndis: prevent integer overflow in rndis_set_response()
09809e2b UPSTREAM: fixup for "arm64 entry: Add macro for reading symbol address from the trampoline"
194240fa UPSTREAM: arm64: Use the clearbhb instruction in mitigations
4900c325 UPSTREAM: KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and migrated
18ee5021 UPSTREAM: arm64: Mitigate spectre style branch history side channels
f734ff58 UPSTREAM: KVM: arm64: Add templates for BHB mitigation sequences
66ef49ca UPSTREAM: arm64: proton-pack: Report Spectre-BHB vulnerabilities as part of Spectre-v2
36b454a8 UPSTREAM: arm64: Add percpu vectors for EL1
df875dc8 UPSTREAM: arm64: entry: Add macro for reading symbol addresses from the trampoline
a04f5e26 UPSTREAM: arm64: entry: Add vectors that have the bhb mitigation sequences
e545c719 UPSTREAM: arm64: entry: Add non-kpti __bp_harden_el1_vectors for mitigations
ef5fb0f9 UPSTREAM: arm64: entry: Allow the trampoline text to occupy multiple pages
363341f5 UPSTREAM: arm64: entry: Make the kpti trampoline's kpti sequence optional
25cd0ee5 UPSTREAM: arm64: entry: Move trampoline macros out of ifdef'd section
41285e5a UPSTREAM: arm64: entry: Don't assume tramp_vectors is the start of the vectors
f1529317 UPSTREAM: arm64: entry: Allow tramp_alias to access symbols after the 4K boundary
52e174ea UPSTREAM: arm64: entry: Move the trampoline data page before the text page
491224d4 UPSTREAM: arm64: entry: Free up another register on kpti's tramp_exit path
0955db3b UPSTREAM: arm64: entry: Make the trampoline cleanup optional
289accc5 UPSTREAM: arm64: entry.S: Add ventry overflow sanity checks
990f43d4 UPSTREAM: arm64: Add Cortex-X2 CPU part definition
a0847063 UPSTREAM: arm64: add ID_AA64ISAR2_EL1 sys register
473d0801 UPSTREAM: arm64: Add Neoverse-N2, Cortex-A710 CPU part definition
b1c011e7 UPSTREAM: arm64: Add part number for Arm Cortex-A77
7d1d2de3 UPSTREAM: sctp: fix the processing for INIT chunk
b94d6fe4 ANDROID: dm-bow: Protect Ranges fetched and erased from the RB tree
6cfc86a0 UPSTREAM: ARM: fix Thumb2 regression with Spectre BHB
e491469b UPSTREAM: ARM: Spectre-BHB: provide empty stub for non-config
383c8eb2 UPSTREAM: ARM: fix build warning in proc-v7-bugs.c
244fecd0 UPSTREAM: ARM: Do not use NOCROSSREFS directive with ld.lld
33ecfe78 UPSTREAM: ARM: fix co-processor register typo
a2572303 UPSTREAM: ARM: fix build error when BPF_SYSCALL is disabled
dc044591 UPSTREAM: ARM: include unprivileged BPF status in Spectre V2 reporting
9ff274f5 UPSTREAM: ARM: Spectre-BHB workaround
21e0a096 UPSTREAM: ARM: use LOADADDR() to get load address of sections
0013389a UPSTREAM: ARM: early traps initialisation
3aa8448c UPSTREAM: ARM: report Spectre v2 status through sysfs
57927cab UPSTREAM: arm/arm64: smccc/psci: add arm_smccc_1_1_get_conduit()
123e80fe UPSTREAM: arm/arm64: Provide a wrapper for SMCCC 1.1 calls
398beb56 UPSTREAM: x86/speculation: Warn about eIBRS + LFENCE + Unprivileged eBPF + SMT
c8803feb UPSTREAM: x86/speculation: Warn about Spectre v2 LFENCE mitigation
69aa4eee UPSTREAM: x86/speculation: Update link to AMD speculation whitepaper
9ad2b9b2 UPSTREAM: x86/speculation: Use generic retpoline by default on AMD
4e9fffdc UPSTREAM: x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting
4318c0c6 UPSTREAM: Documentation/hw-vuln: Update spectre doc
b9eb6a3c UPSTREAM: x86/speculation: Add eIBRS + Retpoline options
f86fd590 UPSTREAM: x86/speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE
0b8fa4c6 UPSTREAM: x86,bugs: Unconditionally allow spectre_v2=retpoline,amd
951cd7f6 UPSTREAM: x86/speculation: Merge one test in spectre_v2_user_select_mitigation()
508711cf UPSTREAM: bpf: Add kconfig knob for disabling unpriv bpf by default
2aea7dc1 UPSTREAM: mmc: block: fix read single on recovery logic
5d7a491a UPSTREAM: lib/iov_iter: initialize "flags" in new pipe_buffer
88e13027 Revert "ANDROID: incremental-fs: remove index and incomplete dir on umount"
2b144ea9 Revert "ANDROID: incremental-fs: fix mount_fs issue"
46778c88 FROMGIT: f2fs: avoid EINVAL by SBI_NEED_FSCK when pinning a file
9a4b39bd UPSTREAM: usb: gadget: rndis: check size of RNDIS_MSG_SET command
0d1f1d43 UPSTREAM: USB: gadget: validate interface OS descriptor requests
f5fe4610 Revert "tracefs: Have tracefs directories not set OTH permission bits by default"
717add4e UPSTREAM: tipc: improve size validations for received domain records

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I8f950d67b05ff95523e4a59f59ed6a376f2ad674

parents f54aeabb d8789c9d

drivers/md/dm-bow.c

+13 −4

Original line number	Diff line number	Diff line
		@@ -236,6 +236,7 @@ static void set_type(struct bow_context bc, struct bow_range *br, int type)

		(*br)->type = type;

		mutex_lock(&bc->ranges_lock);
		if (next->type == type) {
		if (type == TRIMMED)
		list_del(&next->trimmed_list);
		@@ -249,6 +250,7 @@ static void set_type(struct bow_context bc, struct bow_range *br, int type)
		rb_erase(&(*br)->node, &bc->ranges);
		kfree(*br);
		}
		mutex_unlock(&bc->ranges_lock);

		*br = NULL;
		}
		@@ -599,6 +601,7 @@ static void dm_bow_dtr(struct dm_target *ti)
		struct bow_context bc = (struct bow_context ) ti->private;
		struct kobject *kobj;

		mutex_lock(&bc->ranges_lock);
		while (rb_first(&bc->ranges)) {
		struct bow_range *br = container_of(rb_first(&bc->ranges),
		struct bow_range, node);
		@@ -606,6 +609,8 @@ static void dm_bow_dtr(struct dm_target *ti)
		rb_erase(&br->node, &bc->ranges);
		kfree(br);
		}
		mutex_unlock(&bc->ranges_lock);

		if (bc->workqueue)
		destroy_workqueue(bc->workqueue);
		if (bc->bufio)
		@@ -1182,6 +1187,7 @@ static void dm_bow_tablestatus(struct dm_target ti, char result,
		return;
		}

		mutex_lock(&bc->ranges_lock);
		for (i = rb_first(&bc->ranges); i; i = rb_next(i)) {
		struct bow_range *br = container_of(i, struct bow_range, node);

		@@ -1189,11 +1195,11 @@ static void dm_bow_tablestatus(struct dm_target ti, char result,
		readable_type[br->type],
		(unsigned long long)br->sector);
		if (result >= end)
		return;
		goto unlock;

		result += scnprintf(result, end - result, "\n");
		if (result >= end)
		return;
		goto unlock;

		if (br->type == TRIMMED)
		++trimmed_range_count;
		@@ -1215,19 +1221,22 @@ static void dm_bow_tablestatus(struct dm_target ti, char result,
		if (!rb_next(i)) {
		scnprintf(result, end - result,
		"\nERROR: Last range not of type TOP");
		return;
		goto unlock;
		}

		if (br->sector > range_top(br)) {
		scnprintf(result, end - result,
		"\nERROR: sectors out of order");
		return;
		goto unlock;
		}
		}

		if (trimmed_range_count != trimmed_list_length)
		scnprintf(result, end - result,
		"\nERROR: not all trimmed ranges in trimmed list");

		unlock:
		mutex_unlock(&bc->ranges_lock);
		}

		static void dm_bow_status(struct dm_target *ti, status_type_t type,

drivers/usb/gadget/function/rndis.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -642,6 +642,7 @@ static int rndis_set_response(struct rndis_params *params,
		BufLength = le32_to_cpu(buf->InformationBufferLength);
		BufOffset = le32_to_cpu(buf->InformationBufferOffset);
		if ((BufLength > RNDIS_MAX_TOTAL_SIZE) \|\|
		(BufOffset > RNDIS_MAX_TOTAL_SIZE) \|\|
		(BufOffset + 8 >= RNDIS_MAX_TOTAL_SIZE))
		return -EINVAL;

drivers/usb/gadget/udc/core.c

+0 −3

Original line number	Diff line number	Diff line
		@@ -1303,7 +1303,6 @@ static void usb_gadget_remove_driver(struct usb_udc *udc)
		usb_gadget_udc_stop(udc);

		udc->driver = NULL;
		udc->dev.driver = NULL;
		udc->gadget->dev.driver = NULL;
		}

		@@ -1352,7 +1351,6 @@ static int udc_bind_to_driver(struct usb_udc udc, struct usb_gadget_driver dri
		driver->function);

		udc->driver = driver;
		udc->dev.driver = &driver->driver;
		udc->gadget->dev.driver = &driver->driver;

		usb_gadget_udc_set_speed(udc, driver->max_speed);
		@@ -1374,7 +1372,6 @@ static int udc_bind_to_driver(struct usb_udc udc, struct usb_gadget_driver dri
		dev_err(&udc->dev, "failed to start %s: %d\n",
		udc->driver->function, ret);
		udc->driver = NULL;
		udc->dev.driver = NULL;
		udc->gadget->dev.driver = NULL;
		return ret;
		}

fs/f2fs/data.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -2577,6 +2577,11 @@ bool f2fs_should_update_outplace(struct inode inode, struct f2fs_io_info fio)
		{
		struct f2fs_sb_info *sbi = F2FS_I_SB(inode);

		/* The below cases were checked when setting it. */
		if (f2fs_is_pinned_file(inode))
		return false;
		if (fio && is_sbi_flag_set(sbi, SBI_NEED_FSCK))
		return true;
		if (f2fs_lfs_mode(sbi))
		return true;
		if (S_ISDIR(inode->i_mode))

fs/f2fs/file.c

+5 −5

Original line number	Diff line number	Diff line
		@@ -3235,17 +3235,17 @@ static int f2fs_ioc_set_pin_file(struct file *filp, unsigned long arg)

		inode_lock(inode);

		if (f2fs_should_update_outplace(inode, NULL)) {
		ret = -EINVAL;
		goto out;
		}

		if (!pin) {
		clear_inode_flag(inode, FI_PIN_FILE);
		f2fs_i_gc_failures_write(inode, 0);
		goto done;
		}

		if (f2fs_should_update_outplace(inode, NULL)) {
		ret = -EINVAL;
		goto out;
		}

		if (f2fs_pin_file_control(inode, false)) {
		ret = -EAGAIN;
		goto out;