Merge 5.12-rc7 into usb-next

We need the USB fixes in here as well.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Conflicts:

MAINTAINERS
- keep Chandrasekar
drivers/net/ethernet/mellanox/mlx5/core/en_main.c
- simple fix + trust the code re-added

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Conflicts:

MAINTAINERS
- keep Chandrasekar
drivers/net/ethernet/mellanox/mlx5/core/en_main.c
- simple fix + trust the code re-added to param.c in -next is fine
include/linux/bpf.h
- trivial
include/linux/ethtool.h
- trivial, fix kdoc while at it
include/linux/skmsg.h
- move to relevant place in tcp.c, comment re-wrapped
net/core/skmsg.c
- add the sk = sk // sk = NULL around calls
net/tipc/crypto.c
- trivial

Signed-off-by: Jakub Kicinski <kuba@kernel.org>

show more ...

Merge tag 'net-5.12-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Jakub Kicinski:
"Networking fixes for 5.12-rc7, including fixes from can, ipsec,
ma

Merge tag 'net-5.12-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Jakub Kicinski:
"Networking fixes for 5.12-rc7, including fixes from can, ipsec,
mac80211, wireless, and bpf trees.

No scary regressions here or in the works, but small fixes for 5.12
changes keep coming.

Current release - regressions:

- virtio: do not pull payload in skb->head

- virtio: ensure mac header is set in virtio_net_hdr_to_skb()

- Revert "net: correct sk_acceptq_is_full()"

- mptcp: revert "mptcp: provide subflow aware release function"

- ethernet: lan743x: fix ethernet frame cutoff issue

- dsa: fix type was not set for devlink port

- ethtool: remove link_mode param and derive link params from driver

- sched: htb: fix null pointer dereference on a null new_q

- wireless: iwlwifi: Fix softirq/hardirq disabling in
iwl_pcie_enqueue_hcmd()

- wireless: iwlwifi: fw: fix notification wait locking

- wireless: brcmfmac: p2p: Fix deadlock introduced by avoiding the
rtnl dependency

Current release - new code bugs:

- napi: fix hangup on napi_disable for threaded napi

- bpf: take module reference for trampoline in module

- wireless: mt76: mt7921: fix airtime reporting and related tx hangs

- wireless: iwlwifi: mvm: rfi: don't lock mvm->mutex when sending
config command

Previous releases - regressions:

- rfkill: revert back to old userspace API by default

- nfc: fix infinite loop, refcount & memory leaks in LLCP sockets

- let skb_orphan_partial wake-up waiters

- xfrm/compat: Cleanup WARN()s that can be user-triggered

- vxlan, geneve: do not modify the shared tunnel info when PMTU
triggers an ICMP reply

- can: fix msg_namelen values depending on CAN_REQUIRED_SIZE

- can: uapi: mark union inside struct can_frame packed

- sched: cls: fix action overwrite reference counting

- sched: cls: fix err handler in tcf_action_init()

- ethernet: mlxsw: fix ECN marking in tunnel decapsulation

- ethernet: nfp: Fix a use after free in nfp_bpf_ctrl_msg_rx

- ethernet: i40e: fix receiving of single packets in xsk zero-copy
mode

- ethernet: cxgb4: avoid collecting SGE_QBASE regs during traffic

Previous releases - always broken:

- bpf: Refuse non-O_RDWR flags in BPF_OBJ_GET

- bpf: Refcount task stack in bpf_get_task_stack

- bpf, x86: Validate computation of branch displacements

- ieee802154: fix many similar syzbot-found bugs
- fix NULL dereferences in netlink attribute handling
- reject unsupported operations on monitor interfaces
- fix error handling in llsec_key_alloc()

- xfrm: make ipv4 pmtu check honor ip header df

- xfrm: make hash generation lock per network namespace

- xfrm: esp: delete NETIF_F_SCTP_CRC bit from features for esp
offload

- ethtool: fix incorrect datatype in set_eee ops

- xdp: fix xdp_return_frame() kernel BUG throw for page_pool memory
model

- openvswitch: fix send of uninitialized stack memory in ct limit
reply

Misc:

- udp: add get handling for UDP_GRO sockopt"

* tag 'net-5.12-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (182 commits)
net: fix hangup on napi_disable for threaded napi
net: hns3: Trivial spell fix in hns3 driver
lan743x: fix ethernet frame cutoff issue
net: ipv6: check for validity before dereferencing cfg->fc_nlinfo.nlh
net: dsa: lantiq_gswip: Configure all remaining GSWIP_MII_CFG bits
net: dsa: lantiq_gswip: Don't use PHY auto polling
net: sched: sch_teql: fix null-pointer dereference
ipv6: report errors for iftoken via netlink extack
net: sched: fix err handler in tcf_action_init()
net: sched: fix action overwrite reference counting
Revert "net: sched: bump refcount for new action in ACT replace mode"
ice: fix memory leak of aRFS after resuming from suspend
i40e: Fix sparse warning: missing error code 'err'
i40e: Fix sparse error: 'vsi->netdev' could be null
i40e: Fix sparse error: uninitialized symbol 'ring'
i40e: Fix sparse errors in i40e_txrx.c
i40e: Fix parameters in aq_get_phy_register()
nl80211: fix beacon head validation
bpf, x86: Validate computation of branch displacements for x86-32
bpf, x86: Validate computation of branch displacements for x86-64
...

show more ...

net/rds: Avoid potential use after free in rds_send_remove_from_sock

In case of rs failure in rds_send_remove_from_sock(), the 'rm' resource
is freed and later under spinlock, causing potential use-

net/rds: Avoid potential use after free in rds_send_remove_from_sock

In case of rs failure in rds_send_remove_from_sock(), the 'rm' resource
is freed and later under spinlock, causing potential use-after-free.
Set the free pointer to NULL to avoid undefined behavior.

Signed-off-by: Aditya Pakki <pakki001@umn.edu>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

show more ...

net/rds: Fix a use after free in rds_message_map_pages

In rds_message_map_pages, the rm is freed by rds_message_put(rm).
But rm is still used by rm->data.op_sg in return value.

My patch assigns ERR

net/rds: Fix a use after free in rds_message_map_pages

In rds_message_map_pages, the rm is freed by rds_message_put(rm).
But rm is still used by rm->data.op_sg in return value.

My patch assigns ERR_CAST(rm->data.op_sg) to err before the rm is
freed to avoid the uaf.

Fixes: 7dba92037baf3 ("net/rds: Use ERR_PTR for rds_message_alloc_sgs()")
Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Reviewed-by: Håkon Bugge <haakon.bugge@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

show more ...

Merge branch 'master' into for-next

Sync with Linus' branch in order to be able to apply fixups
of more recent patches.

Merge branch 'next' into for-linus

Prepare input updates for 5.9 merge window.

Merge branch 'elan-i2c' into next

Bring in update to Elan touchpad driver to support newer touchpads with
higher resolution.

Backmerge remote-tracking branch 'drm/drm-next' into drm-misc-next

Some conflicts with ttm_bo->offset removal, but drm-misc-next needs updating to v5.8.

Signed-off-by: Maarten Lankhorst <maarten.la

Backmerge remote-tracking branch 'drm/drm-next' into drm-misc-next

Some conflicts with ttm_bo->offset removal, but drm-misc-next needs updating to v5.8.

Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>

show more ...

Merge drm/drm-next into drm-intel-next-queued

Catch up with upstream, in particular to get c1e8d7c6a7a6 ("mmap locking
API: convert mmap_sem comments").

Signed-off-by: Jani Nikula <jani.nikula@inte

Merge drm/drm-next into drm-intel-next-queued

Catch up with upstream, in particular to get c1e8d7c6a7a6 ("mmap locking
API: convert mmap_sem comments").

Signed-off-by: Jani Nikula <jani.nikula@intel.com>

show more ...

Merge v5.8-rc1 into drm-misc-fixes

Beginning a new release cycles for what will become v5.8. Updating
drm-misc-fixes accordingly.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>

Merge branch 'dt/schema-cleanups' into dt/linus

Merge branch 'x86/entry' into ras/core

to fixup conflicts in arch/x86/kernel/cpu/mce/core.c so MCE specific follow
up patches can be applied without creating a horrible merge conflict
afterwards.

Merge branch 'fixes-v5.7' into fixes

Merge branches 'for-5.7/upstream-fixes', 'for-5.8/apple', 'for-5.8/asus', 'for-5.8/core', 'for-5.8/intel-ish', 'for-5.8/logitech', 'for-5.8/mcp2221' and 'for-5.8/multitouch' into for-linus

Merge tag 'v5.7-rc7' into devel

Linux 5.7-rc7

Merge tag 'v5.7-rc6' into rdma.git for-next

Linux 5.7-rc6

Conflict in drivers/net/ethernet/mellanox/mlx5/core/steering/dr_send.c
resolved by deleting dr_cq_event, matching how netdev resolved it.

Merge tag 'v5.7-rc6' into rdma.git for-next

Linux 5.7-rc6

Conflict in drivers/net/ethernet/mellanox/mlx5/core/steering/dr_send.c
resolved by deleting dr_cq_event, matching how netdev resolved it.

Required for dependencies in the following patches.

Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>

show more ...

Merge branch 'i2c/for-current-fixed' into i2c/for-5.8

Merge branch 'kvm-amd-fixes' into HEAD

Merge branch 'for-mingo' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu into core/rcu

Pull RCU updates from Paul McKenney:

1. Miscellaneous fixes.
2. kfree_rcu() updates.

Merge branch 'for-mingo' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu into core/rcu

Pull RCU updates from Paul McKenney:

1. Miscellaneous fixes.
2. kfree_rcu() updates.
3. Remove scheduler locking restriction
4. RCU-tasks update, including addition of RCU Tasks Trace for
BPF use and RCU Tasks Rude. (This branch is on top of #3 due
to overlap of changed code.)
5. RCU CPU stall warning updates.
6. Torture-test updates.

show more ...

Merge tag 'tags/linear-ranges-lib' into psy-next

lib: Add linear ranges helper library and start using it

Series extracts a "linear ranges" helper out of the regulator
framework. Linear ranges help

Merge tag 'tags/linear-ranges-lib' into psy-next

lib: Add linear ranges helper library and start using it

Series extracts a "linear ranges" helper out of the regulator
framework. Linear ranges helper is intended to help converting
real-world values to register values when conversion is linear. I
suspect this is useful also for power subsystem and possibly for clk.

Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>

show more ...

Merge tag 'linear-ranges-lib' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator into regulator-5.8

lib: Add linear ranges helper library and start using it

Series extracts a "lin

Merge tag 'linear-ranges-lib' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator into regulator-5.8

lib: Add linear ranges helper library and start using it

Series extracts a "linear ranges" helper out of the regulator
framework. Linear ranges helper is intended to help converting
real-world values to register values when conversion is linear. I
suspect this is useful also for power subsystem and possibly for clk.

show more ...

Merge tag 'v5.7-rc3' into spi-5.8

Linux 5.7-rc3

Merge 5.7-rc3 into staging-next

We need the staging fixes in here too, and this resolves a merge issue
with the vt6656 driver.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Merge 5.7-rc3 into driver-core-next

We need the driver core fixes in here as well.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>