linux-stable.git, branch v4.9.239

Linux 4.9.239

2020-10-14T07:48:17+00:00

Tested-by: Jon Hunter 
Tested-by: Linux Kernel Functional Testing 
Tested-by: Guenter Roeck 
Tested-by: Shuah Khan 
Link: https://lore.kernel.org/r/20201012132629.585664421@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman

net: usb: rtl8150: set random MAC address when set_ethernet_addr() fails

2020-10-14T07:48:17+00:00

commit f45a4248ea4cc13ed50618ff066849f9587226b2 upstream.

When get_registers() fails in set_ethernet_addr(),the uninitialized
value of node_id gets copied over as the address.
So, check the return value of get_registers().

If get_registers() executed successfully (i.e., it returns
sizeof(node_id)), copy over the MAC address using ether_addr_copy()
(instead of using memcpy()).

Else, if get_registers() failed instead, a randomly generated MAC
address is set as the MAC address instead.

Reported-by: syzbot+abbc768b560c84d92fd3@syzkaller.appspotmail.com
Tested-by: syzbot+abbc768b560c84d92fd3@syzkaller.appspotmail.com
Acked-by: Petko Manolov 
Signed-off-by: Anant Thazhemadam 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

mm: khugepaged: recalculate min_free_kbytes after memory hotplug as expected by khugepaged

2020-10-14T07:48:17+00:00

commit 4aab2be0983031a05cb4a19696c9da5749523426 upstream.

When memory is hotplug added or removed the min_free_kbytes should be
recalculated based on what is expected by khugepaged.  Currently after
hotplug, min_free_kbytes will be set to a lower default and higher
default set when THP enabled is lost.

This change restores min_free_kbytes as expected for THP consumers.

[vijayb@linux.microsoft.com: v5]
  Link: https://lkml.kernel.org/r/1601398153-5517-1-git-send-email-vijayb@linux.microsoft.com

Fixes: f000565adb77 ("thp: set recommended min free kbytes")
Signed-off-by: Vijay Balakrishna 
Signed-off-by: Andrew Morton 
Reviewed-by: Pavel Tatashin 
Acked-by: Michal Hocko 
Cc: Allen Pais 
Cc: Andrea Arcangeli 
Cc: "Kirill A. Shutemov" 
Cc: Oleg Nesterov 
Cc: Song Liu 
Cc: 
Link: https://lkml.kernel.org/r/1600305709-2319-2-git-send-email-vijayb@linux.microsoft.com
Link: https://lkml.kernel.org/r/1600204258-13683-1-git-send-email-vijayb@linux.microsoft.com
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

perf: Fix task_function_call() error handling

2020-10-14T07:48:17+00:00

[ Upstream commit 6d6b8b9f4fceab7266ca03d194f60ec72bd4b654 ]

The error handling introduced by commit:

  2ed6edd33a21 ("perf: Add cond_resched() to task_function_call()")

looses any return value from smp_call_function_single() that is not
{0, -EINVAL}. This is a problem because it will return -EXNIO when the
target CPU is offline. Worse, in that case it'll turn into an infinite
loop.

Fixes: 2ed6edd33a21 ("perf: Add cond_resched() to task_function_call()")
Reported-by: Srikar Dronamraju 
Signed-off-by: Kajol Jain 
Signed-off-by: Peter Zijlstra (Intel) 
Signed-off-by: Ingo Molnar 
Reviewed-by: Barret Rhoden 
Tested-by: Srikar Dronamraju 
Link: https://lkml.kernel.org/r/20200827064732.20860-1-kjain@linux.ibm.com
Signed-off-by: Sasha Levin

rxrpc: Fix server keyring leak

2020-10-14T07:48:17+00:00

[ Upstream commit 38b1dc47a35ba14c3f4472138ea56d014c2d609b ]

If someone calls setsockopt() twice to set a server key keyring, the first
keyring is leaked.

Fix it to return an error instead if the server key keyring is already set.

Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both")
Signed-off-by: David Howells 
Signed-off-by: Sasha Levin

rxrpc: Fix some missing _bh annotations on locking conn->state_lock

2020-10-14T07:48:17+00:00

[ Upstream commit fa1d113a0f96f9ab7e4fe4f8825753ba1e34a9d3 ]

conn->state_lock may be taken in softirq mode, but a previous patch
replaced an outer lock in the response-packet event handling code, and lost
the _bh from that when doing so.

Fix this by applying the _bh annotation to the state_lock locking.

Fixes: a1399f8bb033 ("rxrpc: Call channels should have separate call number spaces")
Signed-off-by: David Howells 
Signed-off-by: Sasha Levin

rxrpc: Downgrade the BUG() for unsupported token type in rxrpc_read()

2020-10-14T07:48:17+00:00

[ Upstream commit 9a059cd5ca7d9c5c4ca5a6e755cf72f230176b6a ]

If rxrpc_read() (which allows KEYCTL_READ to read a key), sees a token of a
type it doesn't recognise, it can BUG in a couple of places, which is
unnecessary as it can easily get back to userspace.

Fix this to print an error message instead.

Fixes: 99455153d067 ("RxRPC: Parse security index 5 keys (Kerberos 5)")
Signed-off-by: David Howells 
Signed-off-by: Sasha Levin

rxrpc: Fix rxkad token xdr encoding

2020-10-14T07:48:16+00:00

[ Upstream commit 56305118e05b2db8d0395bba640ac9a3aee92624 ]

The session key should be encoded with just the 8 data bytes and
no length; ENCODE_DATA precedes it with a 4 byte length, which
confuses some existing tools that try to parse this format.

Add an ENCODE_BYTES macro that does not include a length, and use
it for the key.  Also adjust the expected length.

Note that commit 774521f353e1d ("rxrpc: Fix an assertion in
rxrpc_read()") had fixed a BUG by changing the length rather than
fixing the encoding.  The original length was correct.

Fixes: 99455153d067 ("RxRPC: Parse security index 5 keys (Kerberos 5)")
Signed-off-by: Marc Dionne 
Signed-off-by: David Howells 
Signed-off-by: Sasha Levin

mdio: fix mdio-thunder.c dependency & build error

2020-10-14T07:48:16+00:00

[ Upstream commit 7dbbcf496f2a4b6d82cfc7810a0746e160b79762 ]

Fix build error by selecting MDIO_DEVRES for MDIO_THUNDER.
Fixes this build error:

ld: drivers/net/phy/mdio-thunder.o: in function `thunder_mdiobus_pci_probe':
drivers/net/phy/mdio-thunder.c:78: undefined reference to `devm_mdiobus_alloc_size'

Fixes: 379d7ac7ca31 ("phy: mdio-thunder: Add driver for Cavium Thunder SoC MDIO buses.")
Reported-by: kernel test robot 
Signed-off-by: Randy Dunlap 
Cc: Bartosz Golaszewski 
Cc: Andrew Lunn 
Cc: Heiner Kallweit 
Cc: netdev@vger.kernel.org
Cc: David Daney 
Reviewed-by: Andrew Lunn 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

bonding: set dev->needed_headroom in bond_setup_by_slave()

2020-10-14T07:48:16+00:00

[ Upstream commit f32f19339596b214c208c0dba716f4b6cc4f6958 ]

syzbot managed to crash a host by creating a bond
with a GRE device.

For non Ethernet device, bonding calls bond_setup_by_slave()
instead of ether_setup(), and unfortunately dev->needed_headroom
was not copied from the new added member.

[  171.243095] skbuff: skb_under_panic: text:ffffffffa184b9ea len:116 put:20 head:ffff883f84012dc0 data:ffff883f84012dbc tail:0x70 end:0xd00 dev:bond0
[  171.243111] ------------[ cut here ]------------
[  171.243112] kernel BUG at net/core/skbuff.c:112!
[  171.243117] invalid opcode: 0000 [#1] SMP KASAN PTI
[  171.243469] gsmi: Log Shutdown Reason 0x03
[  171.243505] Call Trace:
[  171.243506]  
[  171.243512]  [] skb_push+0x49/0x50
[  171.243516]  [] ipgre_header+0x2a/0xf0
[  171.243520]  [] neigh_connected_output+0xb7/0x100
[  171.243524]  [] ip6_finish_output2+0x383/0x490
[  171.243528]  [] __ip6_finish_output+0xa2/0x110
[  171.243531]  [] ip6_finish_output+0x2c/0xa0
[  171.243534]  [] ip6_output+0x69/0x110
[  171.243537]  [] ? ip6_output+0x110/0x110
[  171.243541]  [] mld_sendpack+0x1b2/0x2d0
[  171.243544]  [] ? mld_send_report+0xf0/0xf0
[  171.243548]  [] mld_ifc_timer_expire+0x2d7/0x3b0
[  171.243551]  [] ? mld_gq_timer_expire+0x50/0x50
[  171.243556]  [] call_timer_fn+0x30/0x130
[  171.243559]  [] expire_timers+0x4c/0x110
[  171.243563]  [] __run_timers+0x213/0x260
[  171.243566]  [] ? ktime_get+0x3d/0xa0
[  171.243570]  [] ? clockevents_program_event+0x7e/0xe0
[  171.243574]  [] ? sched_clock_cpu+0x15/0x190
[  171.243577]  [] run_timer_softirq+0x1d/0x40
[  171.243581]  [] __do_softirq+0x152/0x2f0
[  171.243585]  [] irq_exit+0x9f/0xb0
[  171.243588]  [] smp_apic_timer_interrupt+0xfd/0x1a0
[  171.243591]  [] apic_timer_interrupt+0x86/0x90

Fixes: f5184d267c1a ("net: Allow netdevices to specify needed head/tailroom")
Signed-off-by: Eric Dumazet 
Reported-by: syzbot 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin