evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

This is the 4.4.192 stable release

Browse source 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl13bQ8ACgkQONu9yGCS
 aT7MNA/8CJJOI1UwUD2bmGsPg5OMOkAhucsIS1U2NH0OiPRbYbHRKiau8ML5FHAk
 9MMEjndZoDxokndbBFAao/oq+8uXrzokxfoLAvzSm6ICIv8x5tI81v2yjVh8EPk3
 6/2fJ68ugovSgAyMZlIK9Z/UeoJAoLPVqSlp7h0ecP00DOvEe5Vs347MfabNiNHP
 OrKCd0myMieBdAy2idEOs/s97q0WbwPhrEELQFCDOEhTTdDMGMP14/X7TdFHELVf
 G927erT6ztErLQHe8BUYmeQvxrLVoL9IV0vOMh98rbWxHD32/jqxO5yVY77oHH0b
 lDT8nH2s+6pa3b3bZkVnEYKN9omE/O8QJVBHMuRGbWFjwyXJfAE7rMxVul6tUn/d
 I96wBHD4kskGeXXcgb4zc/TSVo2WFJDvnnIgRs7hvUjPTAJ+iwJHXg9yjgu4BP7Z
 uP14eTTv0CILtcKpkcRtjdmr64crJ/YdedZxlJut8nM5s7ui0waytpxzoaKIKg7i
 j/QiRIYRikTTOqeABRw6/EZeYnieSdh1xrozI1fnKdikzU0nSx5Qxk7dsR4pTxrd
 0699ba+TZHaJ+4eSYPxm+CejAXom9MBBgyLevT9ZkGu2wk3nPJ5GZU0olMcV1WXo
 yN6/Xid8aXQBFOXw3Ex9pUI/qrV0fGEhZwFuOyCNFy1/lqMv2TY=
 =s9Vs
 -----END PGP SIGNATURE-----

Merge 4.4.192 into android-4.4

Changes in 4.4.192
	net: tundra: tsi108: use spin_lock_irqsave instead of spin_lock_irq in IRQ context
	net: tc35815: Explicitly check NET_IP_ALIGN is not zero in tc35815_rx
	Bluetooth: btqca: Add a short delay before downloading the NVM
	ibmveth: Convert multicast list size for little-endian system
	gpio: Fix build error of function redefinition
	cxgb4: fix a memory leak bug
	net: myri10ge: fix memory leaks
	cx82310_eth: fix a memory leak bug
	net: kalmia: fix memory leaks
	wimax/i2400m: fix a memory leak bug
	ravb: Fix use-after-free ravb_tstamp_skb
	Tools: hv: kvp: eliminate 'may be used uninitialized' warning
	IB/mlx4: Fix memory leaks
	ceph: fix buffer free while holding i_ceph_lock in __ceph_setxattr()
	KVM: arm/arm64: Only skip MMIO insn once
	libceph: allow ceph_buffer_put() to receive a NULL ceph_buffer
	spi: bcm2835aux: ensure interrupts are enabled for shared handler
	spi: bcm2835aux: unifying code between polling and interrupt driven code
	spi: bcm2835aux: remove dangerous uncontrolled read of fifo
	spi: bcm2835aux: fix corruptions for longer spi transfers
	Revert "x86/apic: Include the LDR when clearing out APIC registers"
	net: fix skb use after free in netpoll
	net: stmmac: dwmac-rk: Don't fail if phy regulator is absent
	Linux 4.4.192

Change-Id: I5e02cd84379aa9da7da5ed9545e939e0ca13197f
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This commit is contained in:
Greg Kroah-Hartman 2019-09-10 10:50:50 +01:00
commit da6d147f98
21 changed files with 74 additions and 95 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
Makefile
View file

@ -1,6 +1,6 @@
VERSION = 4
PATCHLEVEL = 4
SUBLEVEL = 191
SUBLEVEL = 192
EXTRAVERSION =
NAME = Blurry Fish Butt

7
arch/arm/kvm/mmio.c
View file

@ -98,6 +98,12 @@ int kvm_handle_mmio_return(struct kvm_vcpu *vcpu, struct kvm_run *run)
unsigned int len;
int mask;
/* Detect an already handled MMIO return */
if (unlikely(!vcpu->mmio_needed))
return 0;
vcpu->mmio_needed = 0;
if (!run->mmio.is_write) {
len = run->mmio.len;
if (len > sizeof(unsigned long))
@ -206,6 +212,7 @@ int io_mem_abort(struct kvm_vcpu *vcpu, struct kvm_run *run,
run->mmio.is_write = is_write;
run->mmio.phys_addr = fault_ipa;
run->mmio.len = len;
vcpu->mmio_needed = 1;
if (!ret) {
/* We handled the access successfully in the kernel. */

4
arch/x86/kernel/apic/apic.c
View file

@ -1031,10 +1031,6 @@ void clear_local_APIC(void)
apic_write(APIC_LVT0, v | APIC_LVT_MASKED);
v = apic_read(APIC_LVT1);
apic_write(APIC_LVT1, v | APIC_LVT_MASKED);
if (!x2apic_enabled()) {
v = apic_read(APIC_LDR) & ~APIC_LDR_MASK;
apic_write(APIC_LDR, v);
}
if (maxlvt >= 4) {
v = apic_read(APIC_LVTPC);
apic_write(APIC_LVTPC, v | APIC_LVT_MASKED);

3
drivers/bluetooth/btqca.c
View file

@ -363,6 +363,9 @@ int qca_uart_setup_rome(struct hci_dev *hdev, uint8_t baudrate)
return err;
}
/* Give the controller some time to get ready to receive the NVM */
msleep(10);
/* Download NVM configuration */
config.type = TLV_TYPE_NVM;
snprintf(config.fwname, sizeof(config.fwname), "qca/nvm_%08x.bin",

4
drivers/infiniband/hw/mlx4/mad.c
View file

@ -1526,8 +1526,6 @@ tx_err:
tx_buf_size, DMA_TO_DEVICE);
kfree(tun_qp->tx_ring[i].buf.addr);
}
kfree(tun_qp->tx_ring);
tun_qp->tx_ring = NULL;
i = MLX4_NUM_TUNNEL_BUFS;
err:
while (i > 0) {
@ -1536,6 +1534,8 @@ err:
rx_buf_size, DMA_FROM_DEVICE);
kfree(tun_qp->ring[i].addr);
}
kfree(tun_qp->tx_ring);
tun_qp->tx_ring = NULL;
kfree(tun_qp->ring);
tun_qp->ring = NULL;
return -ENOMEM;

4
drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
View file

@ -2673,8 +2673,10 @@ static ssize_t blocked_fl_write(struct file *filp, const char __user *ubuf,
return -ENOMEM;
err = bitmap_parse_user(ubuf, count, t, adap->sge.egr_sz);
if (err)
if (err) {
kvfree(t);
return err;
}
bitmap_copy(adap->sge.blocked_fl, t, adap->sge.egr_sz);
t4_free_mem(t);

9
drivers/net/ethernet/ibm/ibmveth.c
View file

@ -1555,7 +1555,7 @@ static int ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id)
struct net_device *netdev;
struct ibmveth_adapter *adapter;
unsigned char *mac_addr_p;
unsigned int *mcastFilterSize_p;
__be32 *mcastFilterSize_p;
long ret;
unsigned long ret_attr;
@ -1577,8 +1577,9 @@ static int ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id)
return -EINVAL;
}
mcastFilterSize_p = (unsigned int *)vio_get_attribute(dev,
VETH_MCAST_FILTER_SIZE, NULL);
mcastFilterSize_p = (__be32 *)vio_get_attribute(dev,
VETH_MCAST_FILTER_SIZE,
NULL);
if (!mcastFilterSize_p) {
dev_err(&dev->dev, "Can't find VETH_MCAST_FILTER_SIZE "
"attribute\n");
@ -1595,7 +1596,7 @@ static int ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id)
adapter->vdev = dev;
adapter->netdev = netdev;
adapter->mcastFilterSize = *mcastFilterSize_p;
adapter->mcastFilterSize = be32_to_cpu(*mcastFilterSize_p);
adapter->pool_config = 0;
netif_napi_add(netdev, &adapter->napi, ibmveth_poll, 16);

2
drivers/net/ethernet/myricom/myri10ge/myri10ge.c
View file

@ -4114,7 +4114,7 @@ static int myri10ge_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
* setup (if available). */
status = myri10ge_request_irq(mgp);
if (status != 0)
goto abort_with_firmware;
goto abort_with_slices;
myri10ge_free_irq(mgp);
/* Save configuration space to be restored if the

8
drivers/net/ethernet/renesas/ravb_main.c
View file

@ -1,6 +1,6 @@
/* Renesas Ethernet AVB device driver
*
* Copyright (C) 2014-2015 Renesas Electronics Corporation
* Copyright (C) 2014-2019 Renesas Electronics Corporation
* Copyright (C) 2015 Renesas Solutions Corp.
* Copyright (C) 2015 Cogent Embedded, Inc. <source@cogentembedded.com>
*
@ -501,7 +501,10 @@ static void ravb_get_tx_tstamp(struct net_device *ndev)
kfree(ts_skb);
if (tag == tfa_tag) {
skb_tstamp_tx(skb, &shhwtstamps);
dev_consume_skb_any(skb);
break;
} else {
dev_kfree_skb_any(skb);
}
}
ravb_write(ndev, ravb_read(ndev, TCCR) | TCCR_TFR, TCCR);
@ -1382,7 +1385,7 @@ static netdev_tx_t ravb_start_xmit(struct sk_buff *skb, struct net_device *ndev)
DMA_TO_DEVICE);
goto unmap;
}
ts_skb->skb = skb;
ts_skb->skb = skb_get(skb);
ts_skb->tag = priv->ts_skb_tag++;
priv->ts_skb_tag &= 0x3ff;
list_add_tail(&ts_skb->list, &priv->ts_skb_list);
@ -1514,6 +1517,7 @@ static int ravb_close(struct net_device *ndev)
/* Clear the timestamp list */
list_for_each_entry_safe(ts_skb, ts_skb2, &priv->ts_skb_list, list) {
list_del(&ts_skb->list);
kfree_skb(ts_skb->skb);
kfree(ts_skb);
}

6
drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
View file

@ -429,10 +429,8 @@ static int phy_power_on(struct rk_priv_data *bsp_priv, bool enable)
int ret;
struct device *dev = &bsp_priv->pdev->dev;
if (!ldo) {
dev_err(dev, "no regulator found\n");
return -1;
}
if (!ldo)
return 0;
if (enable) {
ret = regulator_enable(ldo);

2
drivers/net/ethernet/toshiba/tc35815.c
View file

@ -1528,7 +1528,7 @@ tc35815_rx(struct net_device *dev, int limit)
pci_unmap_single(lp->pci_dev,
lp->rx_skbs[cur_bd].skb_dma,
RX_BUF_SIZE, PCI_DMA_FROMDEVICE);
if (!HAVE_DMA_RXALIGN(lp) && NET_IP_ALIGN)
if (!HAVE_DMA_RXALIGN(lp) && NET_IP_ALIGN != 0)
memmove(skb->data, skb->data - NET_IP_ALIGN,
pkt_len);
data = skb_put(skb, pkt_len);

5
drivers/net/ethernet/tundra/tsi108_eth.c
View file

@ -379,9 +379,10 @@ tsi108_stat_carry_one(int carry, int carry_bit, int carry_shift,
static void tsi108_stat_carry(struct net_device *dev)
{
struct tsi108_prv_data *data = netdev_priv(dev);
unsigned long flags;
u32 carry1, carry2;
spin_lock_irq(&data->misclock);
spin_lock_irqsave(&data->misclock, flags);
carry1 = TSI_READ(TSI108_STAT_CARRY1);
carry2 = TSI_READ(TSI108_STAT_CARRY2);
@ -449,7 +450,7 @@ static void tsi108_stat_carry(struct net_device *dev)
TSI108_STAT_TXPAUSEDROP_CARRY,
&data->tx_pause_drop);
spin_unlock_irq(&data->misclock);
spin_unlock_irqrestore(&data->misclock, flags);
}
/* Read a stat counter atomically with respect to carries.

3
drivers/net/usb/cx82310_eth.c
View file

@ -175,7 +175,8 @@ static int cx82310_bind(struct usbnet *dev, struct usb_interface *intf)
}
if (!timeout) {
dev_err(&udev->dev, "firmware not ready in time\n");
return -ETIMEDOUT;
ret = -ETIMEDOUT;
goto err;
}
/* enable ethernet mode (?) */

6
drivers/net/usb/kalmia.c
View file

@ -117,16 +117,16 @@ kalmia_init_and_get_ethernet_addr(struct usbnet *dev, u8 *ethernet_addr)
status = kalmia_send_init_packet(dev, usb_buf, sizeof(init_msg_1)
/ sizeof(init_msg_1[0]), usb_buf, 24);
if (status != 0)
return status;
goto out;
memcpy(usb_buf, init_msg_2, 12);
status = kalmia_send_init_packet(dev, usb_buf, sizeof(init_msg_2)
/ sizeof(init_msg_2[0]), usb_buf, 28);
if (status != 0)
return status;
goto out;
memcpy(ethernet_addr, usb_buf + 10, ETH_ALEN);
out:
kfree(usb_buf);
return status;
}

4
drivers/net/wimax/i2400m/fw.c
View file

@ -351,13 +351,15 @@ int i2400m_barker_db_init(const char *_options)
}
result = i2400m_barker_db_add(barker);
if (result < 0)
goto error_add;
goto error_parse_add;
}
kfree(options_orig);
}
return 0;
error_parse_add:
error_parse:
kfree(options_orig);
error_add:
kfree(i2400m_barker_db);
return result;

57
drivers/spi/spi-bcm2835aux.c
View file

@ -181,19 +181,14 @@ static void bcm2835aux_spi_reset_hw(struct bcm2835aux_spi *bs)
BCM2835_AUX_SPI_CNTL0_CLEARFIFO);
}
static irqreturn_t bcm2835aux_spi_interrupt(int irq, void *dev_id)
static void bcm2835aux_spi_transfer_helper(struct bcm2835aux_spi *bs)
{
struct spi_master *master = dev_id;
struct bcm2835aux_spi *bs = spi_master_get_devdata(master);
irqreturn_t ret = IRQ_NONE;
u32 stat = bcm2835aux_rd(bs, BCM2835_AUX_SPI_STAT);
/* check if we have data to read */
while (bs->rx_len &&
(!(bcm2835aux_rd(bs, BCM2835_AUX_SPI_STAT) &
BCM2835_AUX_SPI_STAT_RX_EMPTY))) {
for (; bs->rx_len && (stat & BCM2835_AUX_SPI_STAT_RX_LVL);
stat = bcm2835aux_rd(bs, BCM2835_AUX_SPI_STAT))
bcm2835aux_rd_fifo(bs);
ret = IRQ_HANDLED;
}
/* check if we have data to write */
while (bs->tx_len &&
@ -201,16 +196,21 @@ static irqreturn_t bcm2835aux_spi_interrupt(int irq, void *dev_id)
(!(bcm2835aux_rd(bs, BCM2835_AUX_SPI_STAT) &
BCM2835_AUX_SPI_STAT_TX_FULL))) {
bcm2835aux_wr_fifo(bs);
ret = IRQ_HANDLED;
}
}
/* and check if we have reached "done" */
while (bs->rx_len &&
(!(bcm2835aux_rd(bs, BCM2835_AUX_SPI_STAT) &
BCM2835_AUX_SPI_STAT_BUSY))) {
bcm2835aux_rd_fifo(bs);
ret = IRQ_HANDLED;
}
static irqreturn_t bcm2835aux_spi_interrupt(int irq, void *dev_id)
{
struct spi_master *master = dev_id;
struct bcm2835aux_spi *bs = spi_master_get_devdata(master);
/* IRQ may be shared, so return if our interrupts are disabled */
if (!(bcm2835aux_rd(bs, BCM2835_AUX_SPI_CNTL1) &
(BCM2835_AUX_SPI_CNTL1_TXEMPTY | BCM2835_AUX_SPI_CNTL1_IDLE)))
return IRQ_NONE;
/* do common fifo handling */
bcm2835aux_spi_transfer_helper(bs);
/* and if rx_len is 0 then wake up completion and disable spi */
if (!bs->rx_len) {
@ -218,8 +218,7 @@ static irqreturn_t bcm2835aux_spi_interrupt(int irq, void *dev_id)
complete(&master->xfer_completion);
}
/* and return */
return ret;
return IRQ_HANDLED;
}
static int __bcm2835aux_spi_transfer_one_irq(struct spi_master *master,
@ -265,7 +264,6 @@ static int bcm2835aux_spi_transfer_one_poll(struct spi_master *master,
{
struct bcm2835aux_spi *bs = spi_master_get_devdata(master);
unsigned long timeout;
u32 stat;
/* configure spi */
bcm2835aux_wr(bs, BCM2835_AUX_SPI_CNTL1, bs->cntl[1]);
@ -276,24 +274,9 @@ static int bcm2835aux_spi_transfer_one_poll(struct spi_master *master,
/* loop until finished the transfer */
while (bs->rx_len) {
/* read status */
stat = bcm2835aux_rd(bs, BCM2835_AUX_SPI_STAT);
/* fill in tx fifo with remaining data */
if ((bs->tx_len) && (!(stat & BCM2835_AUX_SPI_STAT_TX_FULL))) {
bcm2835aux_wr_fifo(bs);
continue;
}
/* read data from fifo for both cases */
if (!(stat & BCM2835_AUX_SPI_STAT_RX_EMPTY)) {
bcm2835aux_rd_fifo(bs);
continue;
}
if (!(stat & BCM2835_AUX_SPI_STAT_BUSY)) {
bcm2835aux_rd_fifo(bs);
continue;
}
/* do common fifo handling */
bcm2835aux_spi_transfer_helper(bs);
/* there is still data pending to read check the timeout */
if (bs->rx_len && time_after(jiffies, timeout)) {

8
fs/ceph/xattr.c
View file

@ -916,6 +916,7 @@ int __ceph_setxattr(struct dentry *dentry, const char *name,
struct ceph_inode_info *ci = ceph_inode(inode);
struct ceph_mds_client *mdsc = ceph_sb_to_client(dentry->d_sb)->mdsc;
struct ceph_cap_flush *prealloc_cf = NULL;
struct ceph_buffer *old_blob = NULL;
int issued;
int err;
int dirty = 0;
@ -984,13 +985,15 @@ retry:
struct ceph_buffer *blob;
spin_unlock(&ci->i_ceph_lock);
dout(" preaallocating new blob size=%d\n", required_blob_size);
ceph_buffer_put(old_blob); /* Shouldn't be required */
dout(" pre-allocating new blob size=%d\n", required_blob_size);
blob = ceph_buffer_new(required_blob_size, GFP_NOFS);
if (!blob)
goto do_sync_unlocked;
spin_lock(&ci->i_ceph_lock);
/* prealloc_blob can't be released while holding i_ceph_lock */
if (ci->i_xattrs.prealloc_blob)
ceph_buffer_put(ci->i_xattrs.prealloc_blob);
old_blob = ci->i_xattrs.prealloc_blob;
ci->i_xattrs.prealloc_blob = blob;
goto retry;
}
@ -1006,6 +1009,7 @@ retry:
}
spin_unlock(&ci->i_ceph_lock);
ceph_buffer_put(old_blob);
if (lock_snap_rwsem)
up_read(&mdsc->snap_rwsem);
if (dirty)

3
include/linux/ceph/buffer.h
View file

@ -29,7 +29,8 @@ static inline struct ceph_buffer *ceph_buffer_get(struct ceph_buffer *b)
static inline void ceph_buffer_put(struct ceph_buffer *b)
{
kref_put(&b->kref, ceph_buffer_release);
if (b)
kref_put(&b->kref, ceph_buffer_release);
}
extern int ceph_decode_buffer(struct ceph_buffer **b, void **p, void *end);

24
include/linux/gpio.h
View file

@ -229,30 +229,6 @@ static inline int irq_to_gpio(unsigned irq)
return -EINVAL;
}
static inline int
gpiochip_add_pin_range(struct gpio_chip *chip, const char *pinctl_name,
unsigned int gpio_offset, unsigned int pin_offset,
unsigned int npins)
{
WARN_ON(1);
return -EINVAL;
}
static inline int
gpiochip_add_pingroup_range(struct gpio_chip *chip,
struct pinctrl_dev *pctldev,
unsigned int gpio_offset, const char *pin_group)
{
WARN_ON(1);
return -EINVAL;
}
static inline void
gpiochip_remove_pin_ranges(struct gpio_chip *chip)
{
WARN_ON(1);
}
static inline int devm_gpio_request(struct device *dev, unsigned gpio,
const char *label)
{

6
net/core/netpoll.c
View file

@ -122,7 +122,7 @@ static void queue_process(struct work_struct *work)
txq = netdev_get_tx_queue(dev, q_index);
HARD_TX_LOCK(dev, txq, smp_processor_id());
if (netif_xmit_frozen_or_stopped(txq) ||
netpoll_start_xmit(skb, dev, txq) != NETDEV_TX_OK) {
!dev_xmit_complete(netpoll_start_xmit(skb, dev, txq))) {
skb_queue_head(&npinfo->txq, skb);
HARD_TX_UNLOCK(dev, txq);
local_irq_restore(flags);
@ -357,7 +357,7 @@ void netpoll_send_skb_on_dev(struct netpoll *np, struct sk_buff *skb,
HARD_TX_UNLOCK(dev, txq);
if (status == NETDEV_TX_OK)
if (dev_xmit_complete(status))
break;
}
@ -374,7 +374,7 @@ void netpoll_send_skb_on_dev(struct netpoll *np, struct sk_buff *skb,
}
if (status != NETDEV_TX_OK) {
if (!dev_xmit_complete(status)) {
skb_queue_tail(&npinfo->txq, skb);
schedule_delayed_work(&npinfo->tx_work,0);
}

2
tools/hv/hv_kvp_daemon.c
View file

@ -878,7 +878,7 @@ kvp_get_ip_info(int family, char *if_name, int op,
int sn_offset = 0;
int error = 0;
char *buffer;
struct hv_kvp_ipaddr_value *ip_buffer;
struct hv_kvp_ipaddr_value *ip_buffer = NULL;
char cidr_mask[5]; /* /xyz */
int weight;
int i;