Commit graph

599415 commits

Author SHA1 Message Date
Linux Build Service Account
5d75820235 Merge "defconfig: msm: Enable SMD packet driver for msm8996-auto" 2018-04-19 02:49:33 -07:00
Ke Huang
2d60fe4d7c cnss: cnss_pci: adapt cnss to msm virtual platform
the virtual platform changes to use gerenic pci but not use
msm pci so adapt the cnss_pci to the msm virtual platform.

Change-Id: I8afb5afb9c447e984f2c6f44a722945c48be18dd
Signed-off-by: Ke Huang <keh@codeaurora.org>
2018-04-19 16:17:00 +08:00
Pradeep P V K
7b76e6a40f mmc: core: Donot fall back to lower speed modes for tuning errors
CRC errors are expected during tuning. MMC driver tries to fallback
to lower speed mode if it encounters consecutive CRC errors.
It should ignore CRC errors observed during tuning and shouldn't
try to fallback.

There is a check present for ignoring CRC errors for SD card
tuning commands. A new check has been added to ignore CRC errors
for eMMC tuning command as well.

Change-Id: Ic2bfa4f6a883fe30fdee85cf2e26779f3e906824
Signed-off-by: Pradeep P V K <ppvk@codeaurora.org>
2018-04-18 22:53:08 -07:00
Archana Sathyakumar
a64e201b9b soc: qcom: rpm_stats: Fix snprintf string format
Undefined string lengths could lead to buffer overflows. Format the
string correctly to ensure proper usage of snprintf.

Change-Id: Ia85754327d342aefce2a67eb7f5aeca857d8fbcf
Signed-off-by: Archana Sathyakumar <asathyak@codeaurora.org>
2018-04-18 22:26:12 -07:00
Paresh Purabhiya
d6696e3622 ARM: dts: msm: clean up display device tree for MSM8996
Display device setting for MSM8996 scattered in different files.
Need to clean up and consolidate display entries into platform
specific files.

Signed-off-by: Paresh Purabhiya <ppurab@codeaurora.org>
Change-Id: I49d45e77b9353c7f84f0f6058e15ed4b89e305d9
2018-04-19 00:21:06 -04:00
Linux Build Service Account
6d0d8f7af3 Merge "clk: qcom: Update DSI PLL settings as per latest recommendation" 2018-04-18 15:10:16 -07:00
Linux Build Service Account
ff4eea9d8b Merge "usb: phy-msm-susb-qmp: power down phy upon disconnect notification" 2018-04-18 15:10:14 -07:00
Balachandra C S
8a3001d05e ARM: dts: msm: Add ldo29 and ldo31 to neutrino device node
Add ldo29 and ldo31 to neutrino device node to disable/enable
vote during suspend/resume.

Change-Id: Ia7fb99aad315e6e74a61bda563a29f01a0faaa22
Signed-off-by: Balachandra C S <balacs@codeaurora.org>
2018-04-18 18:00:58 +05:30
Linux Build Service Account
04eb780a68 Merge "ARM: dts: msm: enable secure smmu domain on msm8996" 2018-04-18 04:50:58 -07:00
Linux Build Service Account
f838d89392 Merge "mmc: card: Service RPMB requests with priority over other requests" 2018-04-18 04:50:57 -07:00
Linux Build Service Account
315e769672 Merge "voice_svc: Avoid double free in voice_svc driver" 2018-04-18 04:50:55 -07:00
Linux Build Service Account
1b5da171e8 Merge "init/main: Put kernel end place_marker" 2018-04-18 04:50:54 -07:00
Linux Build Service Account
12fee561b0 Merge "mmc: card: Call blk_requeue_request() with queue-lock held" 2018-04-18 04:50:53 -07:00
Linux Build Service Account
4285c64373 Merge "v4l2-core: Remove unhelpful warnings" 2018-04-18 04:50:52 -07:00
Ke Huang
734a7cbbd1 ARM: dts: msm: Add WiFi SSR support on msm8996 vplatform
Add WiFi SSR support on msm8996 vplatform based on the
subsys notification virtualization.

Change-Id: I4fab07cda3596033f19c120d91b938a92cfee0d9
Signed-off-by: Ke Huang <keh@codeaurora.org>
2018-04-18 14:07:20 +08:00
Vijay kumar Tumati
169e423524 msm: camera: sensor: Receive sensor output data rate information
Program data rate specific camera hardware registers using this
information.

Change-Id: I0a64fd6f5b0e9ae0a5edee836998d8fea0e7478d
Signed-off-by: Vijay kumar Tumati <vtumati@codeaurora.org>
2018-04-18 10:18:27 +05:30
Gustavo Solaira
093a4dcddf esoc: Use standard reset time for mdm9x55 atomic reset
The atomic reset command uses mdelay so it should use
the standard reset time of 203ms otherwise the system
can get locked for many seconds.

Change-Id: I476efac0a2244101f0f5e4d046582c5746dbead6
Signed-off-by: Gustavo Solaira <gustavos@codeaurora.org>
2018-04-17 21:47:45 -07:00
Gustavo Solaira
ee837fb633 esoc: Only force power off if the graceful shutdown fails
Force power off should only be used in case the graceful
shutdown fails otherwise the esoc will be resetted even
when not needed.

Change-Id: I2180e36a10bb325e55a8782554c71165fa7a6bee
Signed-off-by: Gustavo Solaira <gustavos@codeaurora.org>
2018-04-17 21:47:44 -07:00
Yue Ma
6fa70646d9 cnss2: Support unified QMI sequence
Unified QMI sequence creates a common sequence that can be used by
firmware and host driver among various devices. It will help reduce
maintenance effort and enhance scalability. Add the support for it
to CNSS2 driver.

Change-Id: Ia8b20f185bd9ecc4b7866aa2df62318b981e93f5
Signed-off-by: Yue Ma <yuem@codeaurora.org>
2018-04-17 12:14:54 -07:00
Sarada Prasanna Garnayak
61e87507a5 ARM: dts: msm: update icnss device node for sdm660 and sdm630
Invalid min and max voltage configuration for the vdd-0.8-cx-mx
voltage regulator is causing smmu error after WLAN hardware reset.
To fix the above issue update the icnss wlan module vdd-0.8-cx-mx
regulator min and max voltage configuration value.

CRs-Fixed: 2175145
Change-Id: I293d1d3802c5a0bd3ba7244422ed46d16ef940b0
Signed-off-by: Sarada Prasanna Garnayak <sgarna@codeaurora.org>
2018-04-17 05:44:43 -07:00
Arun Kumar Neelakantam
612c98edc7 defconfig: msm: Enable SMD packet driver for msm8996-auto
SMD packet driver provide access to SMD resources from the
user space through device nodes.

CRs-Fixed: 2223967
Change-Id: I3d458493994f877bfc0bf252ad9e1d5f5e180138
Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org>
2018-04-17 14:44:50 +05:30
Linux Build Service Account
db005c458c Merge "mm-camera2:isp2: Release buffer lock after use" 2018-04-16 22:39:43 -07:00
Linux Build Service Account
289dfc65ae Merge "ARM: dts: msm: Update client-id for sde_kms_hyp" 2018-04-16 22:39:41 -07:00
Linux Build Service Account
f9b6081933 Merge "soc: qcom: scm: Support single HAB id for QCPE" 2018-04-16 22:39:40 -07:00
Vivek Kumar
a639d14d31 init/main: Put kernel end place_marker
Put kernel end place_marker for all targets.
This saves the kernel end time for targets which
enable MSM_BOOT_TIME_MARKER.

Change-Id: Iad635e971bdd341328d40681b7acf8a6f43f288d
Signed-off-by: Vivek Kumar <vivekuma@codeaurora.org>
2018-04-16 11:06:39 -07:00
Veerabhadrarao Badiganti
b8e9f7e011 mmc: card: Call blk_requeue_request() with queue-lock held
blk_requeue_request() must be called with queue lock held.

If it is called without this lock then there is a chance that block-
queue would be accessed simultaneously by more than one entity (say,
request completion & re-queue) and both can mess-up the queue
pointers which can result in unexpected results.

Change-Id: If81711ecf65a185f4c8dc19b8568621460c93db8
Signed-off-by: Veerabhadrarao Badiganti <vbadigan@codeaurora.org>
2018-04-16 08:07:45 -07:00
Veerabhadrarao Badiganti
d3643ee7ff mmc: card: Service RPMB requests with priority over other requests
RPMB requests are initiated from TZ and TZ gets blocked from servicing
other tasks/requests till it completes RPMB request. Delays in
servicing RPMB request may result in system-level stability/performance
issues.

Below is the issue observed:
1. TZ rpmb API is called to update TA rollback information. TZ forwards
   the request to HLOS mmc driver via rpmb-service.
2. mmc driver services the rpmb requests only after finishing the
   outstanding IO requests.
3. As part of handling an IO requests, mmc driver makes ICE call
   for getting encryption keys, which in-turn makes call to TZ.
4. Since ICE driver finds TZ is busy/blocked it returns ice request
   with -EBUSY error.
5. The failed requests with -EBUSY error would re-queued back.
6. The IO requests keep getting failed and keep getting re-queued
   and mmc driver never gets a chance to service rpmb requests.
7. This results in a deadlock senario.

So RPMB requests need to be serviced immediately.
If there is any outstanding RPMB request, then mmc driver should stop
pulling any more new requests. The moment its done with serving
ongoing requests, It should start processing RPMB request.

Change-Id: I2d0f98a11716ef946551cc1a967e70a38e91d6ac
Signed-off-by: Veerabhadrarao Badiganti <vbadigan@codeaurora.org>
2018-04-16 20:28:51 +05:30
Meera Gande
bf3dafc5ed mm-camera2:isp2: Release buffer lock after use
At start axi stream, we are acquiring the
buffer lock and releasing after completing
the stream configuration operations. In case
of live snapshot,this is causing the buffer
operations to halt and leading to sof freeze.

Change-Id: I7f57c8befc85c105a5690ac71e0276f42b9f1929
Signed-off-by: Meera Gande <mgande@codeaurora.org>
2018-04-16 11:42:44 +05:30
Linux Build Service Account
49df0ab20d Merge "soc: qcom: boot_stats: Fix place_marker API" 2018-04-15 22:22:34 -07:00
Linux Build Service Account
b813c182eb Merge "ath10k: deinit wow config in driver unload" 2018-04-15 22:22:33 -07:00
Rahul Sharma
ed3f93ba0b ARM: dts: msm: enable secure smmu domain on msm8996
Enable secure context bank of smmu domain to facilitate the
secure display usecases.

Change-Id: I2dea0b7d7a57558070a3f9b726d8e2d3d541521b
Signed-off-by: Rahul Sharma <rahsha@codeaurora.org>
2018-04-15 21:31:22 -07:00
Vivek Kumar
c5a90e7f3a ARM: dts: msm: Update client-id for sde_kms_hyp
Update Client-id for sde_kms_hyp node in LA-GVM.
This is required for MTMD feature.

Change-Id: I97c4c55b94173f4cc08d739974a11b9dd3a80ea3
Signed-off-by: Vivek Kumar <vivekuma@codeaurora.org>
2018-04-16 07:15:51 +05:30
Amit Blay
e51ceb3c2e soc: qcom: scm: Support single HAB id for QCPE
All guest VMs use the same HAB id for communication
with QCPE.

Change-Id: I01ed16376730276f13a734b82d387b1d30d14434
Signed-off-by: Amit Blay <ablay@codeaurora.org>
2018-04-15 07:14:14 -07:00
Linux Build Service Account
1920040bec Merge "defconfig: sdm660: Enable cnss_genl driver compilation" 2018-04-15 01:27:54 -07:00
Linux Build Service Account
18b279d0c7 Merge "defconfig: msmcortex_mediabox : Enable docker" 2018-04-15 01:27:41 -07:00
Linux Build Service Account
b85aa29d18 Merge "defconfig: Add USB pass-through related defconfig" 2018-04-15 01:27:39 -07:00
Linux Build Service Account
fb048ed53e Merge "ARM: dts: msm: Enable PMIC-GPIO clients for msm8996 GVM" 2018-04-14 13:44:49 -07:00
Linux Build Service Account
03da9df1d7 Merge "ARM: dts: msm: Add USB devices for msm8996 GVM" 2018-04-14 13:44:47 -07:00
Greg Kroah-Hartman
89904ccfe2 This is the 4.4.128 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlrQ7ekACgkQONu9yGCS
 aT6Znw//VtAP82BGP/+H6X6gt0rBRIYseEJkHOpKRu5PK+Vpx7mMQFIfBId95P6R
 buq1QyzY9yz8ixbByg/w60WA2jK/I9i0tDGBnSlZzNmUvbk01oBN+cc/weZDynF7
 rFbSvD3aTmPB4nm9VE+n7V/tgGeuu/bwi04zulAm/B0/zA+w9GZv/aAto3WlLdjF
 ogZPSo5y6ifm6Qryq9sTR42LyDBXOy1klRSIK5EXY1OnIvPL1HSYR3ea2yj3AMXB
 RPvpCCY8j7zC9yVifX1c+Gfv2tXVHb9kjgheJixP2J4M3fFlR5tjLQXtTP2S2I8G
 cuMcdT6MiQw31rMoLcpej66dMtkL3k6sEpzcnSPPNenTuDIolz7BLEyaO/hhgi9J
 6vIXAd4Xm9D8HkH3iG/L3GtD3JXpVPtHyli/X1M3hz/VNUSOUPENIjMmGoxfBOtQ
 d7c8VGxDjnqmafri3fBAm4c603qW7O1wqJ7vLs9z7vgOIxlOLoJ/uiazoJKgW6O0
 z0S/BABWqpAUAI9jgm2GvRDR2keM2mhQIgIrY0+ZpnaLSGe3MugB+GbK6xdBCuYA
 anOv9VTEAPlTc8gb+GlusbUVjQyacEDwXoT6f9mELCW8cqpMgh+3TiKFihbYkUTN
 ly/DxZH3jpva0dq94Mgjv1u/nlg9ac3zqGeo9buQQFC7MSoZKEM=
 =LiZa
 -----END PGP SIGNATURE-----

Merge 4.4.128 into android-4.4

Changes in 4.4.128
	cfg80211: make RATE_INFO_BW_20 the default
	md/raid5: make use of spin_lock_irq over local_irq_disable + spin_lock
	rtc: snvs: fix an incorrect check of return value
	x86/asm: Don't use RBP as a temporary register in csum_partial_copy_generic()
	NFSv4.1: RECLAIM_COMPLETE must handle NFS4ERR_CONN_NOT_BOUND_TO_SESSION
	IB/srpt: Fix abort handling
	af_key: Fix slab-out-of-bounds in pfkey_compile_policy.
	mac80211: bail out from prep_connection() if a reconfig is ongoing
	bna: Avoid reading past end of buffer
	qlge: Avoid reading past end of buffer
	ipmi_ssif: unlock on allocation failure
	net: cdc_ncm: Fix TX zero padding
	net: ethernet: ti: cpsw: adjust cpsw fifos depth for fullduplex flow control
	lockd: fix lockd shutdown race
	drivers/misc/vmw_vmci/vmci_queue_pair.c: fix a couple integer overflow tests
	pidns: disable pid allocation if pid_ns_prepare_proc() is failed in alloc_pid()
	s390: move _text symbol to address higher than zero
	net/mlx4_en: Avoid adding steering rules with invalid ring
	NFSv4.1: Work around a Linux server bug...
	CIFS: silence lockdep splat in cifs_relock_file()
	blk-mq: NVMe 512B/4K+T10 DIF/DIX format returns I/O error on dd with split op
	net: qca_spi: Fix alignment issues in rx path
	netxen_nic: set rcode to the return status from the call to netxen_issue_cmd
	Input: elan_i2c - check if device is there before really probing
	Input: elantech - force relative mode on a certain module
	KVM: PPC: Book3S PR: Check copy_to/from_user return values
	vmxnet3: ensure that adapter is in proper state during force_close
	SMB2: Fix share type handling
	bus: brcmstb_gisb: Use register offsets with writes too
	bus: brcmstb_gisb: correct support for 64-bit address output
	PowerCap: Fix an error code in powercap_register_zone()
	ARM: dts: imx53-qsrb: Pulldown PMIC IRQ pin
	staging: wlan-ng: prism2mgmt.c: fixed a double endian conversion before calling hfa384x_drvr_setconfig16, also fixes relative sparse warning
	x86/tsc: Provide 'tsc=unstable' boot parameter
	ARM: dts: imx6qdl-wandboard: Fix audio channel swap
	ipv6: avoid dad-failures for addresses with NODAD
	async_tx: Fix DMA_PREP_FENCE usage in do_async_gen_syndrome()
	usb: dwc3: keystone: check return value
	btrfs: fix incorrect error return ret being passed to mapping_set_error
	ata: libahci: properly propagate return value of platform_get_irq()
	neighbour: update neigh timestamps iff update is effective
	arp: honour gratuitous ARP _replies_
	usb: chipidea: properly handle host or gadget initialization failure
	USB: ene_usb6250: fix first command execution
	net: x25: fix one potential use-after-free issue
	USB: ene_usb6250: fix SCSI residue overwriting
	serial: 8250: omap: Disable DMA for console UART
	serial: sh-sci: Fix race condition causing garbage during shutdown
	sh_eth: Use platform device for printing before register_netdev()
	scsi: csiostor: fix use after free in csio_hw_use_fwconfig()
	powerpc/mm: Fix virt_addr_valid() etc. on 64-bit hash
	ath5k: fix memory leak on buf on failed eeprom read
	selftests/powerpc: Fix TM resched DSCR test with some compilers
	xfrm: fix state migration copy replay sequence numbers
	iio: hi8435: avoid garbage event at first enable
	iio: hi8435: cleanup reset gpio
	ext4: handle the rest of ext4_mb_load_buddy() ENOMEM errors
	md-cluster: fix potential lock issue in add_new_disk
	ARM: davinci: da8xx: Create DSP device only when assigned memory
	ray_cs: Avoid reading past end of buffer
	leds: pca955x: Correct I2C Functionality
	sched/numa: Use down_read_trylock() for the mmap_sem
	net/mlx5: Tolerate irq_set_affinity_hint() failures
	selinux: do not check open permission on sockets
	block: fix an error code in add_partition()
	mlx5: fix bug reading rss_hash_type from CQE
	net: ieee802154: fix net_device reference release too early
	libceph: NULL deref on crush_decode() error path
	netfilter: ctnetlink: fix incorrect nf_ct_put during hash resize
	pNFS/flexfiles: missing error code in ff_layout_alloc_lseg()
	ASoC: rsnd: SSI PIO adjust to 24bit mode
	scsi: bnx2fc: fix race condition in bnx2fc_get_host_stats()
	fix race in drivers/char/random.c:get_reg()
	ext4: fix off-by-one on max nr_pages in ext4_find_unwritten_pgoff()
	tcp: better validation of received ack sequences
	net: move somaxconn init from sysctl code
	Input: elan_i2c - clear INT before resetting controller
	bonding: Don't update slave->link until ready to commit
	KVM: nVMX: Fix handling of lmsw instruction
	net: llc: add lock_sock in llc_ui_bind to avoid a race condition
	ARM: dts: ls1021a: add "fsl,ls1021a-esdhc" compatible string to esdhc node
	thermal: power_allocator: fix one race condition issue for thermal_instances list
	perf probe: Add warning message if there is unexpected event name
	l2tp: fix missing print session offset info
	rds; Reset rs->rs_bound_addr in rds_add_bound() failure path
	hwmon: (ina2xx) Make calibration register value fixed
	media: videobuf2-core: don't go out of the buffer range
	ASoC: Intel: cht_bsw_rt5645: Analog Mic support
	scsi: libiscsi: Allow sd_shutdown on bad transport
	scsi: mpt3sas: Proper handling of set/clear of "ATA command pending" flag.
	vfb: fix video mode and line_length being set when loaded
	gpio: label descriptors using the device name
	ASoC: Intel: sst: Fix the return value of 'sst_send_byte_stream_mrfld()'
	wl1251: check return from call to wl1251_acx_arp_ip_filter
	hdlcdrv: Fix divide by zero in hdlcdrv_ioctl
	ovl: filter trusted xattr for non-admin
	powerpc/[booke|4xx]: Don't clobber TCR[WP] when setting TCR[DIE]
	dmaengine: imx-sdma: Handle return value of clk_prepare_enable
	arm64: futex: Fix undefined behaviour with FUTEX_OP_OPARG_SHIFT usage
	net/mlx5: avoid build warning for uniprocessor
	cxgb4: FW upgrade fixes
	rtc: opal: Handle disabled TPO in opal_get_tpo_time()
	rtc: interface: Validate alarm-time before handling rollover
	SUNRPC: ensure correct error is reported by xs_tcp_setup_socket()
	net: freescale: fix potential null pointer dereference
	KVM: SVM: do not zero out segment attributes if segment is unusable or not present
	clk: scpi: fix return type of __scpi_dvfs_round_rate
	clk: Fix __set_clk_rates error print-string
	powerpc/spufs: Fix coredump of SPU contexts
	perf trace: Add mmap alias for s390
	qlcnic: Fix a sleep-in-atomic bug in qlcnic_82xx_hw_write_wx_2M and qlcnic_82xx_hw_read_wx_2M
	mISDN: Fix a sleep-in-atomic bug
	drm/omap: fix tiled buffer stride calculations
	cxgb4: fix incorrect cim_la output for T6
	Fix serial console on SNI RM400 machines
	bio-integrity: Do not allocate integrity context for bio w/o data
	skbuff: return -EMSGSIZE in skb_to_sgvec to prevent overflow
	sit: reload iphdr in ipip6_rcv
	net/mlx4: Fix the check in attaching steering rules
	net/mlx4: Check if Granular QoS per VF has been enabled before updating QP qos_vport
	perf header: Set proper module name when build-id event found
	perf report: Ensure the perf DSO mapping matches what libdw sees
	tags: honor COMPILED_SOURCE with apart output directory
	e1000e: fix race condition around skb_tstamp_tx()
	cx25840: fix unchecked return values
	mceusb: sporadic RX truncation corruption fix
	net: phy: avoid genphy_aneg_done() for PHYs without clause 22 support
	ARM: imx: Add MXC_CPU_IMX6ULL and cpu_is_imx6ull
	e1000e: Undo e1000e_pm_freeze if __e1000_shutdown fails
	perf/core: Correct event creation with PERF_FORMAT_GROUP
	MIPS: mm: fixed mappings: correct initialisation
	MIPS: mm: adjust PKMAP location
	MIPS: kprobes: flush_insn_slot should flush only if probe initialised
	Fix loop device flush before configure v3
	net: emac: fix reset timeout with AR8035 phy
	perf tests: Decompress kernel module before objdump
	skbuff: only inherit relevant tx_flags
	xen: avoid type warning in xchg_xen_ulong
	bnx2x: Allow vfs to disable txvlan offload
	sctp: fix recursive locking warning in sctp_do_peeloff
	sparc64: ldc abort during vds iso boot
	iio: magnetometer: st_magn_spi: fix spi_device_id table
	Bluetooth: Send HCI Set Event Mask Page 2 command only when needed
	cpuidle: dt: Add missing 'of_node_put()'
	ACPICA: Events: Add runtime stub support for event APIs
	ACPICA: Disassembler: Abort on an invalid/unknown AML opcode
	s390/dasd: fix hanging safe offline
	vxlan: dont migrate permanent fdb entries during learn
	bcache: stop writeback thread after detaching
	bcache: segregate flash only volume write streams
	scsi: libsas: fix memory leak in sas_smp_get_phy_events()
	scsi: libsas: fix error when getting phy events
	scsi: libsas: initialize sas_phy status according to response of DISCOVER
	blk-mq: fix kernel oops in blk_mq_tag_idle()
	tty: n_gsm: Allow ADM response in addition to UA for control dlci
	EDAC, mv64x60: Fix an error handling path
	cxgb4vf: Fix SGE FL buffer initialization logic for 64K pages
	perf tools: Fix copyfile_offset update of output offset
	ipsec: check return value of skb_to_sgvec always
	rxrpc: check return value of skb_to_sgvec always
	virtio_net: check return value of skb_to_sgvec always
	virtio_net: check return value of skb_to_sgvec in one more location
	random: use lockless method of accessing and updating f->reg_idx
	futex: Remove requirement for lock_page() in get_futex_key()
	Kbuild: provide a __UNIQUE_ID for clang
	arp: fix arp_filter on l3slave devices
	net: fix possible out-of-bound read in skb_network_protocol()
	net/ipv6: Fix route leaking between VRFs
	netlink: make sure nladdr has correct size in netlink_connect()
	net/sched: fix NULL dereference in the error path of tcf_bpf_init()
	pptp: remove a buggy dst release in pptp_connect()
	sctp: do not leak kernel memory to user space
	sctp: sctp_sockaddr_af must check minimal addr length for AF_INET6
	sky2: Increase D3 delay to sky2 stops working after suspend
	vhost: correctly remove wait queue during poll failure
	vlan: also check phy_driver ts_info for vlan's real device
	bonding: fix the err path for dev hwaddr sync in bond_enslave
	bonding: move dev_mc_sync after master_upper_dev_link in bond_enslave
	bonding: process the err returned by dev_set_allmulti properly in bond_enslave
	net: fool proof dev_valid_name()
	ip_tunnel: better validate user provided tunnel names
	ipv6: sit: better validate user provided tunnel names
	ip6_gre: better validate user provided tunnel names
	ip6_tunnel: better validate user provided tunnel names
	vti6: better validate user provided tunnel names
	r8169: fix setting driver_data after register_netdev
	net sched actions: fix dumping which requires several messages to user space
	net/ipv6: Increment OUTxxx counters after netfilter hook
	ipv6: the entire IPv6 header chain must fit the first fragment
	vrf: Fix use after free and double free in vrf_finish_output
	Revert "xhci: plat: Register shutdown for xhci_plat"
	Linux 4.4.128

Change-Id: I9c1e58f634cc18f15a840c9d192c892dfcc5ff73
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2018-04-14 15:35:32 +02:00
Alistair Strachan
25d6aefb7c ANDROID: Add build server config for cuttlefish.
The build server config can be used with gcc or clang.
Specify CC=clang to build with clang.

Change-Id: Id346ab1489ecaaef8e9e66b084cc416dd0581f69
Signed-off-by: Alistair Strachan <astrachan@google.com>
2018-04-13 16:20:01 -07:00
Alistair Strachan
12f9b37fcd ANDROID: Add defconfig for cuttlefish.
This file is based on x86_64_defconfig, merged with the base and
recommended configs from configs.git, with the virtio drivers enabled
and some spurious kernel features turned off.

(This version differs from the 4.9 and 4.14 versions because it uses the
 deprecated ANDROID_LOW_MEMORY_KILLER feature instead of MEMCG.)

Change-Id: I61bde941e8cfef2dd83cb4ff040f7380922cc44e
Signed-off-by: Alistair Strachan <astrachan@google.com>
2018-04-13 16:20:01 -07:00
Greg Hartman
6a38f9839e FROMLIST: staging: Android: Add 'vsoc' driver for cuttlefish.
The cuttlefish system is a virtual SoC architecture based on QEMU. It
uses the QEMU ivshmem feature to share memory regions between guest and
host with a custom protocol.

Signed-off-by: Greg Hartman <ghartman@google.com>
[sent upstream via staging https://patchwork.kernel.org/patch/10339507/]
Change-Id: Iaf5d7536898329a66d00764d8892d1395164519e
Signed-off-by: Alistair Strachan <astrachan@google.com>
2018-04-13 16:15:45 -07:00
Greg Hackmann
4f175e7cd9 Revert "proc: make oom adjustment files user read-only"
CTS no longer expects oom_{adj,score_adj} to be read-only.  See
https://android-review.googlesource.com/530687/ for additional context.

This reverts commit 55541f1ac3.

Bug: 63142211
Change-Id: I8011b4389b17d9577a6aff08943d0021e990171b
Signed-off-by: Greg Hackmann <ghackmann@google.com>
2018-04-13 15:23:32 -07:00
Greg Hackmann
e588258301 Revert "fixup! proc: make oom adjustment files user read-only"
CTS no longer expects oom_{adj,score_adj} to be read-only.  See
https://android-review.googlesource.com/530687/ for additional context.

This reverts commit 87a7a2cfbe.

Bug: 63142211
Change-Id: I1d1b33c93ca6b6c16a9c1d5430dcb5cbe3ec894c
Signed-off-by: Greg Hackmann <ghackmann@google.com>
2018-04-13 15:23:32 -07:00
Greg Kroah-Hartman
dbb7876236 Linux 4.4.128 2018-04-13 19:50:28 +02:00
Greg Hackmann
f02dc09866 Revert "xhci: plat: Register shutdown for xhci_plat"
Pixel 2 field testers reported that when they tried to reboot their
phones with some USB devices plugged in, the reboot would get wedged and
eventually trigger watchdog reset.  Once the Pixel kernel team found a
reliable repro case, they narrowed it down to this commit's 4.4.y
backport.  Reverting the change made the issue go away.

This reverts commit b07c12517f2aed0add8ce18146bb426b14099392.

Signed-off-by: Greg Hackmann <ghackmann@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-13 19:50:27 +02:00
David Ahern
56f8ae4e07 vrf: Fix use after free and double free in vrf_finish_output
commit 82dd0d2a9a76fc8fa2b18d80b987d455728bf83a upstream.

Miguel reported an skb use after free / double free in vrf_finish_output
when neigh_output returns an error. The vrf driver should return after
the call to neigh_output as it takes over the skb on error path as well.

Patch is a simplified version of Miguel's patch which was written for 4.9,
and updated to top of tree.

Fixes: 8f58336d3f ("net: Add ethernet header for pass through VRF device")
Signed-off-by: Miguel Fadon Perlines <mfadon@teldat.com>
Signed-off-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[ backport to 4.4 and 4.9 dropped the sock_confirm_neigh and
  changed neigh_output to dst_neigh_output ]
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-13 19:50:27 +02:00
Paolo Abeni
d7d9a32687 ipv6: the entire IPv6 header chain must fit the first fragment
[ Upstream commit 10b8a3de603df7b96004179b1b33b1708c76d144 ]

While building ipv6 datagram we currently allow arbitrary large
extheaders, even beyond pmtu size. The syzbot has found a way
to exploit the above to trigger the following splat:

kernel BUG at ./include/linux/skbuff.h:2073!
invalid opcode: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
    (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 4230 Comm: syzkaller672661 Not tainted 4.16.0-rc2+ #326
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:__skb_pull include/linux/skbuff.h:2073 [inline]
RIP: 0010:__ip6_make_skb+0x1ac8/0x2190 net/ipv6/ip6_output.c:1636
RSP: 0018:ffff8801bc18f0f0 EFLAGS: 00010293
RAX: ffff8801b17400c0 RBX: 0000000000000738 RCX: ffffffff84f01828
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8801b415ac18
RBP: ffff8801bc18f360 R08: ffff8801b4576844 R09: 0000000000000000
R10: ffff8801bc18f380 R11: ffffed00367aee4e R12: 00000000000000d6
R13: ffff8801b415a740 R14: dffffc0000000000 R15: ffff8801b45767c0
FS:  0000000001535880(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000002000b000 CR3: 00000001b4123001 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
  ip6_finish_skb include/net/ipv6.h:969 [inline]
  udp_v6_push_pending_frames+0x269/0x3b0 net/ipv6/udp.c:1073
  udpv6_sendmsg+0x2a96/0x3400 net/ipv6/udp.c:1343
  inet_sendmsg+0x11f/0x5e0 net/ipv4/af_inet.c:764
  sock_sendmsg_nosec net/socket.c:630 [inline]
  sock_sendmsg+0xca/0x110 net/socket.c:640
  ___sys_sendmsg+0x320/0x8b0 net/socket.c:2046
  __sys_sendmmsg+0x1ee/0x620 net/socket.c:2136
  SYSC_sendmmsg net/socket.c:2167 [inline]
  SyS_sendmmsg+0x35/0x60 net/socket.c:2162
  do_syscall_64+0x280/0x940 arch/x86/entry/common.c:287
  entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x4404c9
RSP: 002b:00007ffdce35f948 EFLAGS: 00000217 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004404c9
RDX: 0000000000000003 RSI: 0000000020001f00 RDI: 0000000000000003
RBP: 00000000006cb018 R08: 00000000004002c8 R09: 00000000004002c8
R10: 0000000020000080 R11: 0000000000000217 R12: 0000000000401df0
R13: 0000000000401e80 R14: 0000000000000000 R15: 0000000000000000
Code: ff e8 1d 5e b9 fc e9 15 e9 ff ff e8 13 5e b9 fc e9 44 e8 ff ff e8 29
5e b9 fc e9 c0 e6 ff ff e8 3f f3 80 fc 0f 0b e8 38 f3 80 fc <0f> 0b 49 8d
87 80 00 00 00 4d 8d 87 84 00 00 00 48 89 85 20 fe
RIP: __skb_pull include/linux/skbuff.h:2073 [inline] RSP: ffff8801bc18f0f0
RIP: __ip6_make_skb+0x1ac8/0x2190 net/ipv6/ip6_output.c:1636 RSP:
ffff8801bc18f0f0

As stated by RFC 7112 section 5:

   When a host fragments an IPv6 datagram, it MUST include the entire
   IPv6 Header Chain in the First Fragment.

So this patch addresses the issue dropping datagrams with excessive
extheader length. It also updates the error path to report to the
calling socket nonnegative pmtu values.

The issue apparently predates git history.

v1 -> v2: cleanup error path, as per Eric's suggestion

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: syzbot+91e6f9932ff122fa4410@syzkaller.appspotmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-13 19:50:27 +02:00
Jeff Barnhill
fdef35f27d net/ipv6: Increment OUTxxx counters after netfilter hook
[ Upstream commit 71a1c915238c970cd9bdd5bf158b1279d6b6d55b ]

At the end of ip6_forward(), IPSTATS_MIB_OUTFORWDATAGRAMS and
IPSTATS_MIB_OUTOCTETS are incremented immediately before the NF_HOOK call
for NFPROTO_IPV6 / NF_INET_FORWARD.  As a result, these counters get
incremented regardless of whether or not the netfilter hook allows the
packet to continue being processed.  This change increments the counters
in ip6_forward_finish() so that it will not happen if the netfilter hook
chooses to terminate the packet, which is similar to how IPv4 works.

Signed-off-by: Jeff Barnhill <0xeffeff@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-13 19:50:27 +02:00
Craig Dillabaugh
bdcffff5fd net sched actions: fix dumping which requires several messages to user space
[ Upstream commit 734549eb550c0c720bc89e50501f1b1e98cdd841 ]

Fixes a bug in the tcf_dump_walker function that can cause some actions
to not be reported when dumping a large number of actions. This issue
became more aggrevated when cookies feature was added. In particular
this issue is manifest when large cookie values are assigned to the
actions and when enough actions are created that the resulting table
must be dumped in multiple batches.

The number of actions returned in each batch is limited by the total
number of actions and the memory buffer size.  With small cookies
the numeric limit is reached before the buffer size limit, which avoids
the code path triggering this bug. When large cookies are used buffer
fills before the numeric limit, and the erroneous code path is hit.

For example after creating 32 csum actions with the cookie
aaaabbbbccccdddd

$ tc actions ls action csum
total acts 26

    action order 0: csum (tcp) action continue
    index 1 ref 1 bind 0
    cookie aaaabbbbccccdddd

    .....

    action order 25: csum (tcp) action continue
    index 26 ref 1 bind 0
    cookie aaaabbbbccccdddd
total acts 6

    action order 0: csum (tcp) action continue
    index 28 ref 1 bind 0
    cookie aaaabbbbccccdddd

    ......

    action order 5: csum (tcp) action continue
    index 32 ref 1 bind 0
    cookie aaaabbbbccccdddd

Note that the action with index 27 is omitted from the report.

Fixes: 4b3550ef53 ("[NET_SCHED]: Use nla_nest_start/nla_nest_end")"
Signed-off-by: Craig Dillabaugh <cdillaba@mojatatu.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-13 19:50:27 +02:00