Linux patch 5.10.1495.10-158

Signed-off-by: Mike Pagano <mpagano@gentoo.org>

2 files changed, 206 insertions, 0 deletions

diff --git a/0000_README b/0000_README
index cfc507bc..73ccd6af 100644
--- a/0000_README
+++ b/0000_README
@@ -635,6 +635,10 @@ Patch:  1147_linux-5.10.148.patch
 From:   http://www.kernel.org
 Desc:   Linux 5.10.148
 
+Patch:  1148_linux-5.10.149.patch
+From:   http://www.kernel.org
+Desc:   Linux 5.10.149
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.
diff --git a/1148_linux-5.10.149.patch b/1148_linux-5.10.149.patch
new file mode 100644
index 00000000..6dda5b25
--- /dev/null
+++ b/1148_linux-5.10.149.patch
@@ -0,0 +1,202 @@
+diff --git a/Makefile b/Makefile
+index c40acf09ce29d..b824bdb0457c5 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 5
+ PATCHLEVEL = 10
+-SUBLEVEL = 148
++SUBLEVEL = 149
+ EXTRAVERSION =
+ NAME = Dare mighty things
+ 
+diff --git a/fs/splice.c b/fs/splice.c
+index 6610e55c0e2ab..866d5c2367b23 100644
+--- a/fs/splice.c
++++ b/fs/splice.c
+@@ -806,15 +806,17 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
+ {
+ 	struct pipe_inode_info *pipe;
+ 	long ret, bytes;
++	umode_t i_mode;
+ 	size_t len;
+ 	int i, flags, more;
+ 
+ 	/*
+-	 * We require the input to be seekable, as we don't want to randomly
+-	 * drop data for eg socket -> socket splicing. Use the piped splicing
+-	 * for that!
++	 * We require the input being a regular file, as we don't want to
++	 * randomly drop data for eg socket -> socket splicing. Use the
++	 * piped splicing for that!
+ 	 */
+-	if (unlikely(!(in->f_mode & FMODE_LSEEK)))
++	i_mode = file_inode(in)->i_mode;
++	if (unlikely(!S_ISREG(i_mode) && !S_ISBLK(i_mode)))
+ 		return -EINVAL;
+ 
+ 	/*
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index bcc94cc1b6201..63499db5c63d9 100644
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1485,7 +1485,6 @@ struct ieee802_11_elems {
+ 	const u8 *supp_rates;
+ 	const u8 *ds_params;
+ 	const struct ieee80211_tim_ie *tim;
+-	const u8 *challenge;
+ 	const u8 *rsn;
+ 	const u8 *rsnx;
+ 	const u8 *erp_info;
+@@ -1538,7 +1537,6 @@ struct ieee802_11_elems {
+ 	u8 ssid_len;
+ 	u8 supp_rates_len;
+ 	u8 tim_len;
+-	u8 challenge_len;
+ 	u8 rsn_len;
+ 	u8 rsnx_len;
+ 	u8 ext_supp_rates_len;
+@@ -1553,6 +1551,8 @@ struct ieee802_11_elems {
+ 	u8 country_elem_len;
+ 	u8 bssid_index_len;
+ 
++	void *nontx_profile;
++
+ 	/* whether a parse error occurred while retrieving these elements */
+ 	bool parse_error;
+ };
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index 3988403064ab6..c52b8eb7fb8a2 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -2899,14 +2899,14 @@ static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
+ {
+ 	struct ieee80211_local *local = sdata->local;
+ 	struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
++	const struct element *challenge;
+ 	u8 *pos;
+-	struct ieee802_11_elems elems;
+ 	u32 tx_flags = 0;
+ 
+ 	pos = mgmt->u.auth.variable;
+-	ieee802_11_parse_elems(pos, len - (pos - (u8 *)mgmt), false, &elems,
+-			       mgmt->bssid, auth_data->bss->bssid);
+-	if (!elems.challenge)
++	challenge = cfg80211_find_elem(WLAN_EID_CHALLENGE, pos,
++				       len - (pos - (u8 *)mgmt));
++	if (!challenge)
+ 		return;
+ 	auth_data->expected_transaction = 4;
+ 	drv_mgd_prepare_tx(sdata->local, sdata, 0);
+@@ -2914,7 +2914,8 @@ static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
+ 		tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
+ 			   IEEE80211_TX_INTFL_MLME_CONN_TX;
+ 	ieee80211_send_auth(sdata, 3, auth_data->algorithm, 0,
+-			    elems.challenge - 2, elems.challenge_len + 2,
++			    (void *)challenge,
++			    challenge->datalen + sizeof(*challenge),
+ 			    auth_data->bss->bssid, auth_data->bss->bssid,
+ 			    auth_data->key, auth_data->key_len,
+ 			    auth_data->key_idx, tx_flags);
+@@ -3299,7 +3300,7 @@ static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
+ 	}
+ 	capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
+ 	ieee802_11_parse_elems(pos, len - (pos - (u8 *)mgmt), false, elems,
+-			       mgmt->bssid, assoc_data->bss->bssid);
++			       mgmt->bssid, NULL);
+ 
+ 	if (elems->aid_resp)
+ 		aid = le16_to_cpu(elems->aid_resp->aid);
+@@ -3393,6 +3394,7 @@ static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
+ 			sdata_info(sdata,
+ 				   "AP bug: VHT operation missing from AssocResp\n");
+ 		}
++		kfree(bss_elems.nontx_profile);
+ 	}
+ 
+ 	/*
+@@ -3707,7 +3709,7 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
+ 		return;
+ 
+ 	ieee802_11_parse_elems(pos, len - (pos - (u8 *)mgmt), false, &elems,
+-			       mgmt->bssid, assoc_data->bss->bssid);
++			       mgmt->bssid, NULL);
+ 
+ 	if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
+ 	    elems.timeout_int &&
+@@ -4044,6 +4046,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
+ 		ifmgd->assoc_data->timeout = jiffies;
+ 		ifmgd->assoc_data->timeout_started = true;
+ 		run_again(sdata, ifmgd->assoc_data->timeout);
++		kfree(elems.nontx_profile);
+ 		return;
+ 	}
+ 
+@@ -4221,7 +4224,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
+ 		ieee80211_report_disconnect(sdata, deauth_buf,
+ 					    sizeof(deauth_buf), true,
+ 					    WLAN_REASON_DEAUTH_LEAVING);
+-		return;
++		goto free;
+ 	}
+ 
+ 	if (sta && elems.opmode_notif)
+@@ -4236,6 +4239,8 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
+ 					       elems.cisco_dtpc_elem);
+ 
+ 	ieee80211_bss_info_change_notify(sdata, changed);
++free:
++	kfree(elems.nontx_profile);
+ }
+ 
+ void ieee80211_sta_rx_queued_ext(struct ieee80211_sub_if_data *sdata,
+diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
+index d6afaacaf7ef8..b241ff8c015a9 100644
+--- a/net/mac80211/scan.c
++++ b/net/mac80211/scan.c
+@@ -227,6 +227,8 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
+ 						rx_status, beacon);
+ 	}
+ 
++	kfree(elems.nontx_profile);
++
+ 	return bss;
+ }
+ 
+diff --git a/net/mac80211/util.c b/net/mac80211/util.c
+index 11d5686893c6a..7fa6efa8b83c1 100644
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -1124,10 +1124,6 @@ _ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
+ 			} else
+ 				elem_parse_failed = true;
+ 			break;
+-		case WLAN_EID_CHALLENGE:
+-			elems->challenge = pos;
+-			elems->challenge_len = elen;
+-			break;
+ 		case WLAN_EID_VENDOR_SPECIFIC:
+ 			if (elen >= 4 && pos[0] == 0x00 && pos[1] == 0x50 &&
+ 			    pos[2] == 0xf2) {
+@@ -1487,6 +1483,11 @@ u32 ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
+ 			cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
+ 					       nontransmitted_profile,
+ 					       nontransmitted_profile_len);
++		if (!nontransmitted_profile_len) {
++			nontransmitted_profile_len = 0;
++			kfree(nontransmitted_profile);
++			nontransmitted_profile = NULL;
++		}
+ 	}
+ 
+ 	crc = _ieee802_11_parse_elems_crc(start, len, action, elems, filter,
+@@ -1516,7 +1517,7 @@ u32 ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
+ 	    offsetofend(struct ieee80211_bssid_index, dtim_count))
+ 		elems->dtim_count = elems->bssid_index->dtim_count;
+ 
+-	kfree(nontransmitted_profile);
++	elems->nontx_profile = nontransmitted_profile;
+ 
+ 	return crc;
+ }