kernel-alx/patches-5.4/0318-5.4.219-all-fixes.patch

diff --git a/Makefile b/Makefile
index c26d5ce1d6768..58325c33ef0cf 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 4
-SUBLEVEL = 218
+SUBLEVEL = 219
 EXTRAVERSION =
 NAME = Kleptomaniac Octopus
 
diff --git a/fs/splice.c b/fs/splice.c
index ae5623244d5e3..e509239d7e06a 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -895,15 +895,17 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
 {
 	struct pipe_inode_info *pipe;
 	long ret, bytes;
+	umode_t i_mode;
 	size_t len;
 	int i, flags, more;
 
 	/*
-	 * We require the input to be seekable, as we don't want to randomly
-	 * drop data for eg socket -> socket splicing. Use the piped splicing
-	 * for that!
+	 * We require the input being a regular file, as we don't want to
+	 * randomly drop data for eg socket -> socket splicing. Use the
+	 * piped splicing for that!
 	 */
-	if (unlikely(!(in->f_mode & FMODE_LSEEK)))
+	i_mode = file_inode(in)->i_mode;
+	if (unlikely(!S_ISREG(i_mode) && !S_ISBLK(i_mode)))
 		return -EINVAL;
 
 	/*
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 7747a6f46d299..f30a205323de5 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1460,7 +1460,6 @@ struct ieee802_11_elems {
 	const u8 *supp_rates;
 	const u8 *ds_params;
 	const struct ieee80211_tim_ie *tim;
-	const u8 *challenge;
 	const u8 *rsn;
 	const u8 *erp_info;
 	const u8 *ext_supp_rates;
@@ -1507,7 +1506,6 @@ struct ieee802_11_elems {
 	u8 ssid_len;
 	u8 supp_rates_len;
 	u8 tim_len;
-	u8 challenge_len;
 	u8 rsn_len;
 	u8 ext_supp_rates_len;
 	u8 wmm_info_len;
@@ -1521,6 +1519,8 @@ struct ieee802_11_elems {
 	u8 country_elem_len;
 	u8 bssid_index_len;
 
+	void *nontx_profile;
+
 	/* whether a parse error occurred while retrieving these elements */
 	bool parse_error;
 };
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 5415e566e09d8..b48a09043663a 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -2829,14 +2829,14 @@ static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
 {
 	struct ieee80211_local *local = sdata->local;
 	struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
+	const struct element *challenge;
 	u8 *pos;
-	struct ieee802_11_elems elems;
 	u32 tx_flags = 0;
 
 	pos = mgmt->u.auth.variable;
-	ieee802_11_parse_elems(pos, len - (pos - (u8 *)mgmt), false, &elems,
-			       mgmt->bssid, auth_data->bss->bssid);
-	if (!elems.challenge)
+	challenge = cfg80211_find_elem(WLAN_EID_CHALLENGE, pos,
+				       len - (pos - (u8 *)mgmt));
+	if (!challenge)
 		return;
 	auth_data->expected_transaction = 4;
 	drv_mgd_prepare_tx(sdata->local, sdata, 0);
@@ -2844,7 +2844,8 @@ static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
 		tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
 			   IEEE80211_TX_INTFL_MLME_CONN_TX;
 	ieee80211_send_auth(sdata, 3, auth_data->algorithm, 0,
-			    elems.challenge - 2, elems.challenge_len + 2,
+			    (void *)challenge,
+			    challenge->datalen + sizeof(*challenge),
 			    auth_data->bss->bssid, auth_data->bss->bssid,
 			    auth_data->key, auth_data->key_len,
 			    auth_data->key_idx, tx_flags);
@@ -3223,7 +3224,7 @@ static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
 
 	pos = mgmt->u.assoc_resp.variable;
 	ieee802_11_parse_elems(pos, len - (pos - (u8 *)mgmt), false, &elems,
-			       mgmt->bssid, assoc_data->bss->bssid);
+			       mgmt->bssid, NULL);
 
 	if (!elems.supp_rates) {
 		sdata_info(sdata, "no SuppRates element in AssocResp\n");
@@ -3298,6 +3299,7 @@ static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
 			sdata_info(sdata,
 				   "AP bug: VHT operation missing from AssocResp\n");
 		}
+		kfree(bss_elems.nontx_profile);
 	}
 
 	/*
@@ -3575,7 +3577,7 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
 
 	pos = mgmt->u.assoc_resp.variable;
 	ieee802_11_parse_elems(pos, len - (pos - (u8 *)mgmt), false, &elems,
-			       mgmt->bssid, assoc_data->bss->bssid);
+			       mgmt->bssid, NULL);
 
 	if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
 	    elems.timeout_int &&
@@ -3882,6 +3884,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
 		ifmgd->assoc_data->timeout = jiffies;
 		ifmgd->assoc_data->timeout_started = true;
 		run_again(sdata, ifmgd->assoc_data->timeout);
+		kfree(elems.nontx_profile);
 		return;
 	}
 
@@ -4049,7 +4052,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
 		ieee80211_report_disconnect(sdata, deauth_buf,
 					    sizeof(deauth_buf), true,
 					    WLAN_REASON_DEAUTH_LEAVING);
-		return;
+		goto free;
 	}
 
 	if (sta && elems.opmode_notif)
@@ -4064,6 +4067,8 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
 					       elems.cisco_dtpc_elem);
 
 	ieee80211_bss_info_change_notify(sdata, changed);
+free:
+	kfree(elems.nontx_profile);
 }
 
 void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index c353162e81aea..ee65f1f50a0ab 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -216,6 +216,8 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
 						rx_status, beacon);
 	}
 
+	kfree(elems.nontx_profile);
+
 	return bss;
 }
 
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index a529861256e62..6223af1c3457a 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1006,10 +1006,6 @@ _ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
 			} else
 				elem_parse_failed = true;
 			break;
-		case WLAN_EID_CHALLENGE:
-			elems->challenge = pos;
-			elems->challenge_len = elen;
-			break;
 		case WLAN_EID_VENDOR_SPECIFIC:
 			if (elen >= 4 && pos[0] == 0x00 && pos[1] == 0x50 &&
 			    pos[2] == 0xf2) {
@@ -1367,6 +1363,11 @@ u32 ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
 			cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
 					       nontransmitted_profile,
 					       nontransmitted_profile_len);
+		if (!nontransmitted_profile_len) {
+			nontransmitted_profile_len = 0;
+			kfree(nontransmitted_profile);
+			nontransmitted_profile = NULL;
+		}
 	}
 
 	crc = _ieee802_11_parse_elems_crc(start, len, action, elems, filter,
@@ -1396,7 +1397,7 @@ u32 ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
 	    offsetofend(struct ieee80211_bssid_index, dtim_count))
 		elems->dtim_count = elems->bssid_index->dtim_count;
 
-	kfree(nontransmitted_profile);
+	elems->nontx_profile = nontransmitted_profile;
 
 	return crc;
 }
1	diff --git a/Makefile b/Makefile
2	index c26d5ce1d6768..58325c33ef0cf 100644
3	--- a/Makefile
4	+++ b/Makefile
5	@@ -1,7 +1,7 @@
6	# SPDX-License-Identifier: GPL-2.0
7	VERSION = 5
8	PATCHLEVEL = 4
9	-SUBLEVEL = 218
10	+SUBLEVEL = 219
11	EXTRAVERSION =
12	NAME = Kleptomaniac Octopus
13
14	diff --git a/fs/splice.c b/fs/splice.c
15	index ae5623244d5e3..e509239d7e06a 100644
16	--- a/fs/splice.c
17	+++ b/fs/splice.c
18	@@ -895,15 +895,17 @@ ssize_t splice_direct_to_actor(struct file in, struct splice_desc sd,
19	{
20	struct pipe_inode_info *pipe;
21	long ret, bytes;
22	+ umode_t i_mode;
23	size_t len;
24	int i, flags, more;
25
26	/*
27	- * We require the input to be seekable, as we don't want to randomly
28	- * drop data for eg socket -> socket splicing. Use the piped splicing
29	- * for that!
30	+ * We require the input being a regular file, as we don't want to
31	+ * randomly drop data for eg socket -> socket splicing. Use the
32	+ * piped splicing for that!
33	*/
34	- if (unlikely(!(in->f_mode & FMODE_LSEEK)))
35	+ i_mode = file_inode(in)->i_mode;
36	+ if (unlikely(!S_ISREG(i_mode) && !S_ISBLK(i_mode)))
37	return -EINVAL;
38
39	/*
40	diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
41	index 7747a6f46d299..f30a205323de5 100644
42	--- a/net/mac80211/ieee80211_i.h
43	+++ b/net/mac80211/ieee80211_i.h
44	@@ -1460,7 +1460,6 @@ struct ieee802_11_elems {
45	const u8 *supp_rates;
46	const u8 *ds_params;
47	const struct ieee80211_tim_ie *tim;
48	- const u8 *challenge;
49	const u8 *rsn;
50	const u8 *erp_info;
51	const u8 *ext_supp_rates;
52	@@ -1507,7 +1506,6 @@ struct ieee802_11_elems {
53	u8 ssid_len;
54	u8 supp_rates_len;
55	u8 tim_len;
56	- u8 challenge_len;
57	u8 rsn_len;
58	u8 ext_supp_rates_len;
59	u8 wmm_info_len;
60	@@ -1521,6 +1519,8 @@ struct ieee802_11_elems {
61	u8 country_elem_len;
62	u8 bssid_index_len;
63
64	+ void *nontx_profile;
65	+
66	/* whether a parse error occurred while retrieving these elements */
67	bool parse_error;
68	};
69	diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
70	index 5415e566e09d8..b48a09043663a 100644
71	--- a/net/mac80211/mlme.c
72	+++ b/net/mac80211/mlme.c
73	@@ -2829,14 +2829,14 @@ static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
74	{
75	struct ieee80211_local *local = sdata->local;
76	struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
77	+ const struct element *challenge;
78	u8 *pos;
79	- struct ieee802_11_elems elems;
80	u32 tx_flags = 0;
81
82	pos = mgmt->u.auth.variable;
83	- ieee802_11_parse_elems(pos, len - (pos - (u8 *)mgmt), false, &elems,
84	- mgmt->bssid, auth_data->bss->bssid);
85	- if (!elems.challenge)
86	+ challenge = cfg80211_find_elem(WLAN_EID_CHALLENGE, pos,
87	+ len - (pos - (u8 *)mgmt));
88	+ if (!challenge)
89	return;
90	auth_data->expected_transaction = 4;
91	drv_mgd_prepare_tx(sdata->local, sdata, 0);
92	@@ -2844,7 +2844,8 @@ static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
93	tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS \|
94	IEEE80211_TX_INTFL_MLME_CONN_TX;
95	ieee80211_send_auth(sdata, 3, auth_data->algorithm, 0,
96	- elems.challenge - 2, elems.challenge_len + 2,
97	+ (void *)challenge,
98	+ challenge->datalen + sizeof(*challenge),
99	auth_data->bss->bssid, auth_data->bss->bssid,
100	auth_data->key, auth_data->key_len,
101	auth_data->key_idx, tx_flags);
102	@@ -3223,7 +3224,7 @@ static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
103
104	pos = mgmt->u.assoc_resp.variable;
105	ieee802_11_parse_elems(pos, len - (pos - (u8 *)mgmt), false, &elems,
106	- mgmt->bssid, assoc_data->bss->bssid);
107	+ mgmt->bssid, NULL);
108
109	if (!elems.supp_rates) {
110	sdata_info(sdata, "no SuppRates element in AssocResp\n");
111	@@ -3298,6 +3299,7 @@ static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
112	sdata_info(sdata,
113	"AP bug: VHT operation missing from AssocResp\n");
114	}
115	+ kfree(bss_elems.nontx_profile);
116	}
117
118	/*
119	@@ -3575,7 +3577,7 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
120
121	pos = mgmt->u.assoc_resp.variable;
122	ieee802_11_parse_elems(pos, len - (pos - (u8 *)mgmt), false, &elems,
123	- mgmt->bssid, assoc_data->bss->bssid);
124	+ mgmt->bssid, NULL);
125
126	if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
127	elems.timeout_int &&
128	@@ -3882,6 +3884,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
129	ifmgd->assoc_data->timeout = jiffies;
130	ifmgd->assoc_data->timeout_started = true;
131	run_again(sdata, ifmgd->assoc_data->timeout);
132	+ kfree(elems.nontx_profile);
133	return;
134	}
135
136	@@ -4049,7 +4052,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
137	ieee80211_report_disconnect(sdata, deauth_buf,
138	sizeof(deauth_buf), true,
139	WLAN_REASON_DEAUTH_LEAVING);
140	- return;
141	+ goto free;
142	}
143
144	if (sta && elems.opmode_notif)
145	@@ -4064,6 +4067,8 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
146	elems.cisco_dtpc_elem);
147
148	ieee80211_bss_info_change_notify(sdata, changed);
149	+free:
150	+ kfree(elems.nontx_profile);
151	}
152
153	void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
154	diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
155	index c353162e81aea..ee65f1f50a0ab 100644
156	--- a/net/mac80211/scan.c
157	+++ b/net/mac80211/scan.c
158	@@ -216,6 +216,8 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
159	rx_status, beacon);
160	}
161
162	+ kfree(elems.nontx_profile);
163	+
164	return bss;
165	}
166
167	diff --git a/net/mac80211/util.c b/net/mac80211/util.c
168	index a529861256e62..6223af1c3457a 100644
169	--- a/net/mac80211/util.c
170	+++ b/net/mac80211/util.c
171	@@ -1006,10 +1006,6 @@ _ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
172	} else
173	elem_parse_failed = true;
174	break;
175	- case WLAN_EID_CHALLENGE:
176	- elems->challenge = pos;
177	- elems->challenge_len = elen;
178	- break;
179	case WLAN_EID_VENDOR_SPECIFIC:
180	if (elen >= 4 && pos[0] == 0x00 && pos[1] == 0x50 &&
181	pos[2] == 0xf2) {
182	@@ -1367,6 +1363,11 @@ u32 ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
183	cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
184	nontransmitted_profile,
185	nontransmitted_profile_len);
186	+ if (!nontransmitted_profile_len) {
187	+ nontransmitted_profile_len = 0;
188	+ kfree(nontransmitted_profile);
189	+ nontransmitted_profile = NULL;
190	+ }
191	}
192
193	crc = _ieee802_11_parse_elems_crc(start, len, action, elems, filter,
194	@@ -1396,7 +1397,7 @@ u32 ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
195	offsetofend(struct ieee80211_bssid_index, dtim_count))
196	elems->dtim_count = elems->bssid_index->dtim_count;
197
198	- kfree(nontransmitted_profile);
199	+ elems->nontx_profile = nontransmitted_profile;
200
201	return crc;
202	}