Commit graph

599063 commits

Author SHA1 Message Date
Jaegeuk Kim
e69d0248ef f2fs: check cap_resource only for data blocks
Cherry-pick from origin/upstream-f2fs-stable-linux-4.4.y:
commit f819874f58 ("f2fs: check cap_resource only for data blocks")

This patch changes the rule to check cap_resource for data blocks, not inode
or node blocks in order to avoid selinux denial.

Change-Id: I875d7ccf7cce7b833a1c11cb0eef0b504b823c4a
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2018-04-23 23:10:14 -07:00
Jaegeuk Kim
35346d5c24 Revert "f2fs: introduce f2fs_set_page_dirty_nobuffer"
Cherry-pick from origin/upstream-f2fs-stable-linux-4.4.y:
commit 3e7a141175 ("Revert "f2fs: introduce f2fs_set_page_dirty_nobuffer"")

This patch reverts copied f2fs_set_page_dirty_nobuffer to use generic function
for stability.

This reverts commit fe76b796fc5194cc3d57265002e3a748566d073f.

Change-Id: I3d4728d894d1af41a2f1e30ebc375907abd5ffc8
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2018-04-23 23:09:36 -07:00
Jaegeuk Kim
b5390be7d0 f2fs: clear PageError on writepage
Cherry-pick from origin/upstream-f2fs-stable-linux-4.4.y:
commit 070da80085 ("f2fs: clear PageError on writepage")

This patch clears PageError in some pages tagged by read path, but when we
write the pages with valid contents, writepage should clear the bit likewise
ext4.

Change-Id: I7272074f2bb9c81fc43e37074b44e9d761756263
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2018-04-23 23:09:00 -07:00
Guenter Roeck
bd23e3af17 UPSTREAM: timer: Export destroy_hrtimer_on_stack()
hrtimer_init_on_stack() needs a matching call to
destroy_hrtimer_on_stack(), so both need to be exported.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit c08376ac97cb202ec65320f3d90d5c4c5e2adb0b)
[astrachan: Fixes i386-allmodconfig build failure in vsoc.ko noticed
 by 01.org kbuild-all project building kernel/msm]
Bug: 78036828
Change-Id: If4d5c466255019322ea21ef38ee5b1b382cce969
Signed-off-by: Alistair Strachan <astrachan@google.com>
2018-04-23 21:04:07 +00:00
Patrik Torstensson
ed3b23f4d9 BACKPORT: dm verity: add 'check_at_most_once' option to only validate hashes once
This allows platforms that are CPU/memory contrained to verify data
blocks only the first time they are read from the data device, rather
than every time.  As such, it provides a reduced level of security
because only offline tampering of the data device's content will be
detected, not online tampering.

Hash blocks are still verified each time they are read from the hash
device, since verification of hash blocks is less performance critical
than data blocks, and a hash block will not be verified any more after
all the data blocks it covers have been verified anyway.

This option introduces a bitset that is used to check if a block has
been validated before or not.  A block can be validated more than once
as there is no thread protection for the bitset.

These changes were developed and tested on entry-level Android Go
devices.

(change to use vzalloc/vfree)
(change per_bio_data_size variable)

Bug: 72664474
Change-Id: I2db2db26c7897c78407789de2cc4cff3587c84bb
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
(cherry picked from commit 843f38d382b1ca2f6f4ae2ef7c35933e6319ffbb)
Signed-off-by: Patrik Torstensson <totte@google.com>
2018-04-23 14:30:08 +00:00
Eric Biggers
a9c753efb3 f2fs: call unlock_new_inode() before d_instantiate()
Cherry-pick from origin/upstream-f2fs-stable-linux-4.4.y:
  dafecc032e ("f2fs: call unlock_new_inode() before d_instantiate()")

xfstest generic/429 sometimes hangs on f2fs, caused by a thread being
unable to take a directory's i_rwsem for write in vfs_rmdir().  In the
test, one thread repeatedly creates and removes a directory, and other
threads repeatedly look up a file in the directory.  The bug is that
f2fs_mkdir() calls d_instantiate() before unlock_new_inode(), resulting
in the directory inode being exposed to lookups before it has been fully
initialized.  And with CONFIG_DEBUG_LOCK_ALLOC, unlock_new_inode()
reinitializes ->i_rwsem, corrupting its state when it is already held.

Fix it by calling unlock_new_inode() before d_instantiate().  This
matches what other filesystems do.

Fixes: 57397d86c6 ("f2fs: add inode operations for special inodes")
Change-Id: I1c50a45449b89ce590ae2caccb7d499f4b717665
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2018-04-20 22:30:46 -07:00
Eric Biggers
0f4e0fa71f f2fs: refactor read path to allow multiple postprocessing steps
Cherry-pick from origin/upstream-f2fs-stable-linux-4.4.y:
  c18b4f60c8 ("f2fs: refactor read path to allow multiple postprocessing steps")

Currently f2fs's ->readpage() and ->readpages() assume that either the
data undergoes no postprocessing, or decryption only.  But with
fs-verity, there will be an additional authenticity verification step,
and it may be needed either by itself, or combined with decryption.

To support this, store a 'struct bio_post_read_ctx' in ->bi_private
which contains a work struct, a bitmask of postprocessing steps that are
enabled, and an indicator of the current step.  The bio completion
routine, if there was no I/O error, enqueues the first postprocessing
step.  When that completes, it continues to the next step.  Pages that
fail any postprocessing step have PageError set.  Once all steps have
completed, pages without PageError set are set Uptodate, and all pages
are unlocked.

Also replace f2fs_encrypted_file() with a new function
f2fs_post_read_required() in places like direct I/O and garbage
collection that really should be testing whether the file needs special
I/O processing, not whether it is encrypted specifically.

This may also be useful for other future f2fs features such as
compression.

Change-Id: I742be348b9dfc2113200bcc5366a84e978371a54
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2018-04-20 22:30:46 -07:00
Eric Biggers
f478c9bfbb fscrypt: allow synchronous bio decryption
Cherry-pick from origin/upstream-f2fs-stable-linux-4.4.y:
  13890bed20 ("fscrypt: allow synchronous bio decryption")

Currently, fscrypt provides fscrypt_decrypt_bio_pages() which decrypts a
bio's pages asynchronously, then unlocks them afterwards.  But, this
assumes that decryption is the last "postprocessing step" for the bio,
so it's incompatible with additional postprocessing steps such as
authenticity verification after decryption.

Therefore, rename the existing fscrypt_decrypt_bio_pages() to
fscrypt_enqueue_decrypt_bio().  Then, add fscrypt_decrypt_bio() which
decrypts the pages in the bio synchronously without unlocking the pages,
nor setting them Uptodate; and add fscrypt_enqueue_decrypt_work(), which
enqueues work on the fscrypt_read_workqueue.  The new functions will be
used by filesystems that support both fscrypt and fs-verity.

Change-Id: I99f1c7bfb79381f6e4abf2b1f418776b19bd8e08
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
2018-04-20 22:30:46 -07:00
Srinivasarao P
0382cccfee Merge android-4.4.128 (89904cc) into msm-4.4
* refs/heads/tmp-89904cc
  ANDROID: Add build server config for cuttlefish.
  ANDROID: Add defconfig for cuttlefish.
  FROMLIST: staging: Android: Add 'vsoc' driver for cuttlefish.
  Revert "proc: make oom adjustment files user read-only"
  Revert "fixup! proc: make oom adjustment files user read-only"
  Linux 4.4.128
  Revert "xhci: plat: Register shutdown for xhci_plat"
  vrf: Fix use after free and double free in vrf_finish_output
  ipv6: the entire IPv6 header chain must fit the first fragment
  net/ipv6: Increment OUTxxx counters after netfilter hook
  net sched actions: fix dumping which requires several messages to user space
  r8169: fix setting driver_data after register_netdev
  vti6: better validate user provided tunnel names
  ip6_tunnel: better validate user provided tunnel names
  ip6_gre: better validate user provided tunnel names
  ipv6: sit: better validate user provided tunnel names
  ip_tunnel: better validate user provided tunnel names
  net: fool proof dev_valid_name()
  bonding: process the err returned by dev_set_allmulti properly in bond_enslave
  bonding: move dev_mc_sync after master_upper_dev_link in bond_enslave
  bonding: fix the err path for dev hwaddr sync in bond_enslave
  vlan: also check phy_driver ts_info for vlan's real device
  vhost: correctly remove wait queue during poll failure
  sky2: Increase D3 delay to sky2 stops working after suspend
  sctp: sctp_sockaddr_af must check minimal addr length for AF_INET6
  sctp: do not leak kernel memory to user space
  pptp: remove a buggy dst release in pptp_connect()
  net/sched: fix NULL dereference in the error path of tcf_bpf_init()
  netlink: make sure nladdr has correct size in netlink_connect()
  net/ipv6: Fix route leaking between VRFs
  net: fix possible out-of-bound read in skb_network_protocol()
  arp: fix arp_filter on l3slave devices
  Kbuild: provide a __UNIQUE_ID for clang
  futex: Remove requirement for lock_page() in get_futex_key()
  random: use lockless method of accessing and updating f->reg_idx
  virtio_net: check return value of skb_to_sgvec in one more location
  virtio_net: check return value of skb_to_sgvec always
  rxrpc: check return value of skb_to_sgvec always
  ipsec: check return value of skb_to_sgvec always
  perf tools: Fix copyfile_offset update of output offset
  cxgb4vf: Fix SGE FL buffer initialization logic for 64K pages
  EDAC, mv64x60: Fix an error handling path
  tty: n_gsm: Allow ADM response in addition to UA for control dlci
  blk-mq: fix kernel oops in blk_mq_tag_idle()
  scsi: libsas: initialize sas_phy status according to response of DISCOVER
  scsi: libsas: fix error when getting phy events
  scsi: libsas: fix memory leak in sas_smp_get_phy_events()
  bcache: segregate flash only volume write streams
  bcache: stop writeback thread after detaching
  vxlan: dont migrate permanent fdb entries during learn
  s390/dasd: fix hanging safe offline
  ACPICA: Disassembler: Abort on an invalid/unknown AML opcode
  ACPICA: Events: Add runtime stub support for event APIs
  cpuidle: dt: Add missing 'of_node_put()'
  Bluetooth: Send HCI Set Event Mask Page 2 command only when needed
  iio: magnetometer: st_magn_spi: fix spi_device_id table
  sparc64: ldc abort during vds iso boot
  sctp: fix recursive locking warning in sctp_do_peeloff
  bnx2x: Allow vfs to disable txvlan offload
  xen: avoid type warning in xchg_xen_ulong
  skbuff: only inherit relevant tx_flags
  perf tests: Decompress kernel module before objdump
  net: emac: fix reset timeout with AR8035 phy
  Fix loop device flush before configure v3
  MIPS: kprobes: flush_insn_slot should flush only if probe initialised
  MIPS: mm: adjust PKMAP location
  MIPS: mm: fixed mappings: correct initialisation
  perf/core: Correct event creation with PERF_FORMAT_GROUP
  e1000e: Undo e1000e_pm_freeze if __e1000_shutdown fails
  ARM: imx: Add MXC_CPU_IMX6ULL and cpu_is_imx6ull
  net: phy: avoid genphy_aneg_done() for PHYs without clause 22 support
  mceusb: sporadic RX truncation corruption fix
  cx25840: fix unchecked return values
  e1000e: fix race condition around skb_tstamp_tx()
  tags: honor COMPILED_SOURCE with apart output directory
  perf report: Ensure the perf DSO mapping matches what libdw sees
  perf header: Set proper module name when build-id event found
  net/mlx4: Check if Granular QoS per VF has been enabled before updating QP qos_vport
  net/mlx4: Fix the check in attaching steering rules
  sit: reload iphdr in ipip6_rcv
  skbuff: return -EMSGSIZE in skb_to_sgvec to prevent overflow
  bio-integrity: Do not allocate integrity context for bio w/o data
  Fix serial console on SNI RM400 machines
  cxgb4: fix incorrect cim_la output for T6
  drm/omap: fix tiled buffer stride calculations
  mISDN: Fix a sleep-in-atomic bug
  qlcnic: Fix a sleep-in-atomic bug in qlcnic_82xx_hw_write_wx_2M and qlcnic_82xx_hw_read_wx_2M
  perf trace: Add mmap alias for s390
  powerpc/spufs: Fix coredump of SPU contexts
  clk: Fix __set_clk_rates error print-string
  clk: scpi: fix return type of __scpi_dvfs_round_rate
  KVM: SVM: do not zero out segment attributes if segment is unusable or not present
  net: freescale: fix potential null pointer dereference
  SUNRPC: ensure correct error is reported by xs_tcp_setup_socket()
  rtc: interface: Validate alarm-time before handling rollover
  rtc: opal: Handle disabled TPO in opal_get_tpo_time()
  cxgb4: FW upgrade fixes
  net/mlx5: avoid build warning for uniprocessor
  arm64: futex: Fix undefined behaviour with FUTEX_OP_OPARG_SHIFT usage
  dmaengine: imx-sdma: Handle return value of clk_prepare_enable
  powerpc/[booke|4xx]: Don't clobber TCR[WP] when setting TCR[DIE]
  ovl: filter trusted xattr for non-admin
  hdlcdrv: Fix divide by zero in hdlcdrv_ioctl
  wl1251: check return from call to wl1251_acx_arp_ip_filter
  ASoC: Intel: sst: Fix the return value of 'sst_send_byte_stream_mrfld()'
  gpio: label descriptors using the device name
  vfb: fix video mode and line_length being set when loaded
  scsi: mpt3sas: Proper handling of set/clear of "ATA command pending" flag.
  scsi: libiscsi: Allow sd_shutdown on bad transport
  ASoC: Intel: cht_bsw_rt5645: Analog Mic support
  media: videobuf2-core: don't go out of the buffer range
  hwmon: (ina2xx) Make calibration register value fixed
  rds; Reset rs->rs_bound_addr in rds_add_bound() failure path
  l2tp: fix missing print session offset info
  perf probe: Add warning message if there is unexpected event name
  thermal: power_allocator: fix one race condition issue for thermal_instances list
  ARM: dts: ls1021a: add "fsl,ls1021a-esdhc" compatible string to esdhc node
  net: llc: add lock_sock in llc_ui_bind to avoid a race condition
  KVM: nVMX: Fix handling of lmsw instruction
  bonding: Don't update slave->link until ready to commit
  Input: elan_i2c - clear INT before resetting controller
  net: move somaxconn init from sysctl code
  tcp: better validation of received ack sequences
  ext4: fix off-by-one on max nr_pages in ext4_find_unwritten_pgoff()
  fix race in drivers/char/random.c:get_reg()
  scsi: bnx2fc: fix race condition in bnx2fc_get_host_stats()
  ASoC: rsnd: SSI PIO adjust to 24bit mode
  pNFS/flexfiles: missing error code in ff_layout_alloc_lseg()
  netfilter: ctnetlink: fix incorrect nf_ct_put during hash resize
  libceph: NULL deref on crush_decode() error path
  net: ieee802154: fix net_device reference release too early
  mlx5: fix bug reading rss_hash_type from CQE
  block: fix an error code in add_partition()
  selinux: do not check open permission on sockets
  net/mlx5: Tolerate irq_set_affinity_hint() failures
  sched/numa: Use down_read_trylock() for the mmap_sem
  leds: pca955x: Correct I2C Functionality
  ray_cs: Avoid reading past end of buffer
  ARM: davinci: da8xx: Create DSP device only when assigned memory
  md-cluster: fix potential lock issue in add_new_disk
  ext4: handle the rest of ext4_mb_load_buddy() ENOMEM errors
  iio: hi8435: cleanup reset gpio
  iio: hi8435: avoid garbage event at first enable
  xfrm: fix state migration copy replay sequence numbers
  selftests/powerpc: Fix TM resched DSCR test with some compilers
  ath5k: fix memory leak on buf on failed eeprom read
  powerpc/mm: Fix virt_addr_valid() etc. on 64-bit hash
  scsi: csiostor: fix use after free in csio_hw_use_fwconfig()
  sh_eth: Use platform device for printing before register_netdev()
  serial: sh-sci: Fix race condition causing garbage during shutdown
  serial: 8250: omap: Disable DMA for console UART
  USB: ene_usb6250: fix SCSI residue overwriting
  net: x25: fix one potential use-after-free issue
  USB: ene_usb6250: fix first command execution
  usb: chipidea: properly handle host or gadget initialization failure
  arp: honour gratuitous ARP _replies_
  neighbour: update neigh timestamps iff update is effective
  ata: libahci: properly propagate return value of platform_get_irq()
  btrfs: fix incorrect error return ret being passed to mapping_set_error
  usb: dwc3: keystone: check return value
  async_tx: Fix DMA_PREP_FENCE usage in do_async_gen_syndrome()
  ipv6: avoid dad-failures for addresses with NODAD
  ARM: dts: imx6qdl-wandboard: Fix audio channel swap
  x86/tsc: Provide 'tsc=unstable' boot parameter
  staging: wlan-ng: prism2mgmt.c: fixed a double endian conversion before calling hfa384x_drvr_setconfig16, also fixes relative sparse warning
  ARM: dts: imx53-qsrb: Pulldown PMIC IRQ pin
  PowerCap: Fix an error code in powercap_register_zone()
  bus: brcmstb_gisb: correct support for 64-bit address output
  bus: brcmstb_gisb: Use register offsets with writes too
  SMB2: Fix share type handling
  vmxnet3: ensure that adapter is in proper state during force_close
  KVM: PPC: Book3S PR: Check copy_to/from_user return values
  Input: elantech - force relative mode on a certain module
  Input: elan_i2c - check if device is there before really probing
  netxen_nic: set rcode to the return status from the call to netxen_issue_cmd
  net: qca_spi: Fix alignment issues in rx path
  blk-mq: NVMe 512B/4K+T10 DIF/DIX format returns I/O error on dd with split op
  CIFS: silence lockdep splat in cifs_relock_file()
  NFSv4.1: Work around a Linux server bug...
  net/mlx4_en: Avoid adding steering rules with invalid ring
  s390: move _text symbol to address higher than zero
  pidns: disable pid allocation if pid_ns_prepare_proc() is failed in alloc_pid()
  drivers/misc/vmw_vmci/vmci_queue_pair.c: fix a couple integer overflow tests
  lockd: fix lockd shutdown race
  net: ethernet: ti: cpsw: adjust cpsw fifos depth for fullduplex flow control
  net: cdc_ncm: Fix TX zero padding
  ipmi_ssif: unlock on allocation failure
  qlge: Avoid reading past end of buffer
  bna: Avoid reading past end of buffer
  mac80211: bail out from prep_connection() if a reconfig is ongoing
  af_key: Fix slab-out-of-bounds in pfkey_compile_policy.
  IB/srpt: Fix abort handling
  NFSv4.1: RECLAIM_COMPLETE must handle NFS4ERR_CONN_NOT_BOUND_TO_SESSION
  x86/asm: Don't use RBP as a temporary register in csum_partial_copy_generic()
  rtc: snvs: fix an incorrect check of return value
  md/raid5: make use of spin_lock_irq over local_irq_disable + spin_lock
  cfg80211: make RATE_INFO_BW_20 the default
  ANDROID: proc: add null check in proc_uid_init
  f2fs/fscrypt: updates to v4.17-rc1
  Reduce amount of casting in drivers/tty/goldfish.c.

Conflicts:
	drivers/staging/android/Kconfig
	drivers/staging/android/Makefile

Change-Id: Ic7aa3df76a0312b8d6d84f8a8e11e793311a239a
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
2018-04-20 13:05:36 +05:30
Srinivasarao P
81a6413ed7 Merge android-4.4.127 (d6bbe8b) into msm-4.4
* refs/heads/tmp-d6bbe8b
  Linux 4.4.127
  Revert "ip6_vti: adjust vti mtu according to mtu of lower device"
  net: cavium: liquidio: fix up "Avoid dma_unmap_single on uninitialized ndata"
  spi: davinci: fix up dma_mapping_error() incorrect patch
  Revert "mtip32xx: use runtime tag to initialize command header"
  Revert "cpufreq: Fix governor module removal race"
  Revert "ARM: dts: omap3-n900: Fix the audio CODEC's reset pin"
  Revert "ARM: dts: am335x-pepper: Fix the audio CODEC's reset pin"
  Revert "PCI/MSI: Stop disabling MSI/MSI-X in pci_device_shutdown()"
  nospec: Kill array_index_nospec_mask_check()
  nospec: Move array_index_nospec() parameter checking into separate macro
  net: hns: Fix ethtool private flags
  md/raid10: reset the 'first' at the end of loop
  ARM: dts: am57xx-beagle-x15-common: Add overide powerhold property
  ARM: dts: dra7: Add power hold and power controller properties to palmas
  Documentation: pinctrl: palmas: Add ti,palmas-powerhold-override property definition
  vt: change SGR 21 to follow the standards
  Input: i8042 - enable MUX on Sony VAIO VGN-CS series to fix touchpad
  Input: i8042 - add Lenovo ThinkPad L460 to i8042 reset list
  staging: comedi: ni_mio_common: ack ai fifo error interrupts.
  fs/proc: Stop trying to report thread stacks
  crypto: x86/cast5-avx - fix ECB encryption when long sg follows short one
  crypto: ahash - Fix early termination in hash walk
  parport_pc: Add support for WCH CH382L PCI-E single parallel port card.
  media: usbtv: prevent double free in error case
  mei: remove dev_err message on an unsupported ioctl
  USB: serial: cp210x: add ELDAT Easywave RX09 id
  USB: serial: ftdi_sio: add support for Harman FirmwareHubEmulator
  USB: serial: ftdi_sio: add RT Systems VX-8 cable
  usb: dwc2: Improve gadget state disconnection handling
  scsi: virtio_scsi: always read VPD pages for multiqueue too
  llist: clang: introduce member_address_is_nonnull()
  Bluetooth: Fix missing encryption refresh on Security Request
  netfilter: x_tables: add and use xt_check_proc_name
  netfilter: bridge: ebt_among: add more missing match size checks
  xfrm: Refuse to insert 32 bit userspace socket policies on 64 bit systems
  net: xfrm: use preempt-safe this_cpu_read() in ipcomp_alloc_tfms()
  RDMA/ucma: Introduce safer rdma_addr_size() variants
  RDMA/ucma: Don't allow join attempts for unsupported AF family
  RDMA/ucma: Check that device exists prior to accessing it
  RDMA/ucma: Check that device is connected prior to access it
  RDMA/ucma: Ensure that CM_ID exists prior to access it
  RDMA/ucma: Fix use-after-free access in ucma_close
  RDMA/ucma: Check AF family prior resolving address
  xfrm_user: uncoditionally validate esn replay attribute struct
  arm64: avoid overflow in VA_START and PAGE_OFFSET
  selinux: Remove redundant check for unknown labeling behavior
  netfilter: ctnetlink: Make some parameters integer to avoid enum mismatch
  tty: provide tty_name() even without CONFIG_TTY
  audit: add tty field to LOGIN event
  frv: declare jiffies to be located in the .data section
  jiffies.h: declare jiffies and jiffies_64 with ____cacheline_aligned_in_smp
  fs: compat: Remove warning from COMPATIBLE_IOCTL
  selinux: Remove unnecessary check of array base in selinux_set_mapping()
  cpumask: Add helper cpumask_available()
  genirq: Use cpumask_available() for check of cpumask variable
  netfilter: nf_nat_h323: fix logical-not-parentheses warning
  Input: mousedev - fix implicit conversion warning
  dm ioctl: remove double parentheses
  PCI: Make PCI_ROM_ADDRESS_MASK a 32-bit constant
  writeback: fix the wrong congested state variable definition
  ACPI, PCI, irq: remove redundant check for null string pointer
  kprobes/x86: Fix to set RWX bits correctly before releasing trampoline
  usb: gadget: f_hid: fix: Prevent accessing released memory
  usb: gadget: align buffer size when allocating for OUT endpoint
  usb: gadget: fix usb_ep_align_maybe endianness and new usb_ep_align
  usb: gadget: change len to size_t on alloc_ep_req()
  usb: gadget: define free_ep_req as universal function
  partitions/msdos: Unable to mount UFS 44bsd partitions
  perf/hwbp: Simplify the perf-hwbp code, fix documentation
  ALSA: pcm: potential uninitialized return values
  ALSA: pcm: Use dma_bytes as size parameter in dma_mmap_coherent()
  mtd: jedec_probe: Fix crash in jedec_read_mfr()
  Replace #define with enum for better compilation errors.
  Add missing include to drivers/tty/goldfish.c
  Fix whitespace in drivers/tty/goldfish.c
  ANDROID: fuse: Add null terminator to path in canonical path to avoid issue
  ANDROID: sdcardfs: Fix sdcardfs to stop creating cases-sensitive duplicate entries.
  ANDROID: add missing include to pdev_bus
  ANDROID: pdev_bus: replace writel with gf_write_ptr
  ANDROID: Cleanup type casting in goldfish.h
  ANDROID: Include missing headers in goldfish.h
  ANDROID: cpufreq: times: skip printing invalid frequencies
  ANDROID: xt_qtaguid: Remove unnecessary null checks to device's name
  ANDROID: xt_qtaguid: Remove unnecessary null checks to ifa_label
  ANDROID: cpufreq: times: allocate enough space for a uid_entry
  Linux 4.4.126
  net: systemport: Rewrite __bcm_sysport_tx_reclaim()
  net: fec: Fix unbalanced PM runtime calls
  ieee802154: 6lowpan: fix possible NULL deref in lowpan_device_event()
  s390/qeth: on channel error, reject further cmd requests
  s390/qeth: lock read device while queueing next buffer
  s390/qeth: when thread completes, wake up all waiters
  s390/qeth: free netdevice when removing a card
  team: Fix double free in error path
  skbuff: Fix not waking applications when errors are enqueued
  net: Only honor ifindex in IP_PKTINFO if non-0
  netlink: avoid a double skb free in genlmsg_mcast()
  net/iucv: Free memory obtained by kzalloc
  net: ethernet: ti: cpsw: add check for in-band mode setting with RGMII PHY interface
  net: ethernet: arc: Fix a potential memory leak if an optional regulator is deferred
  l2tp: do not accept arbitrary sockets
  ipv6: fix access to non-linear packet in ndisc_fill_redirect_hdr_option()
  dccp: check sk for closed state in dccp_sendmsg()
  net: Fix hlist corruptions in inet_evict_bucket()
  Revert "genirq: Use irqd_get_trigger_type to compare the trigger type for shared IRQs"
  scsi: sg: don't return bogus Sg_requests
  Revert "genirq: Use irqd_get_trigger_type to compare the trigger type for shared IRQs"
  UPSTREAM: drm: virtio-gpu: set atomic flag
  UPSTREAM: drm: virtio-gpu: transfer dumb buffers to host on plane update
  UPSTREAM: drm: virtio-gpu: ensure plane is flushed to host on atomic update
  UPSTREAM: drm: virtio-gpu: get the fb from the plane state for atomic updates
  Linux 4.4.125
  bpf, x64: increase number of passes
  bpf: skip unnecessary capability check
  kbuild: disable clang's default use of -fmerge-all-constants
  staging: lustre: ptlrpc: kfree used instead of kvfree
  perf/x86/intel: Don't accidentally clear high bits in bdw_limit_period()
  x86/entry/64: Don't use IST entry for #BP stack
  x86/boot/64: Verify alignment of the LOAD segment
  x86/build/64: Force the linker to use 2MB page size
  kvm/x86: fix icebp instruction handling
  tty: vt: fix up tabstops properly
  can: cc770: Fix use after free in cc770_tx_interrupt()
  can: cc770: Fix queue stall & dropped RTR reply
  can: cc770: Fix stalls on rt-linux, remove redundant IRQ ack
  staging: ncpfs: memory corruption in ncp_read_kernel()
  mtd: nand: fsl_ifc: Fix nand waitfunc return value
  tracing: probeevent: Fix to support minus offset from symbol
  rtlwifi: rtl8723be: Fix loss of signal
  brcmfmac: fix P2P_DEVICE ethernet address generation
  acpi, numa: fix pxm to online numa node associations
  drm: udl: Properly check framebuffer mmap offsets
  drm/radeon: Don't turn off DP sink when disconnected
  drm/vmwgfx: Fix a destoy-while-held mutex problem.
  x86/mm: implement free pmd/pte page interfaces
  mm/vmalloc: add interfaces to free unmapped page table
  libata: Modify quirks for MX100 to limit NCQ_TRIM quirk to MU01 version
  libata: Make Crucial BX100 500GB LPM quirk apply to all firmware versions
  libata: Apply NOLPM quirk to Crucial M500 480 and 960GB SSDs
  libata: Enable queued TRIM for Samsung SSD 860
  libata: disable LPM for Crucial BX100 SSD 500GB drive
  libata: Apply NOLPM quirk to Crucial MX100 512GB SSDs
  libata: remove WARN() for DMA or PIO command without data
  libata: fix length validation of ATAPI-relayed SCSI commands
  Bluetooth: btusb: Fix quirk for Atheros 1525/QCA6174
  clk: bcm2835: Protect sections updating shared registers
  ahci: Add PCI-id for the Highpoint Rocketraid 644L card
  PCI: Add function 1 DMA alias quirk for Highpoint RocketRAID 644L
  mmc: dw_mmc: fix falling from idmac to PIO mode when dw_mci_reset occurs
  ALSA: hda/realtek - Always immediately update mute LED with pin VREF
  ALSA: aloop: Fix access to not-yet-ready substream via cable
  ALSA: aloop: Sync stale timer before release
  ALSA: usb-audio: Fix parsing descriptor of UAC2 processing unit
  iio: st_pressure: st_accel: pass correct platform data to init
  MIPS: ralink: Remove ralink_halt()
  ANDROID: cpufreq: times: fix proc_time_in_state_show
  dtc: turn off dtc unit address warnings by default
  Linux 4.4.124
  RDMA/ucma: Fix access to non-initialized CM_ID object
  dmaengine: ti-dma-crossbar: Fix event mapping for TPCC_EVT_MUX_60_63
  clk: si5351: Rename internal plls to avoid name collisions
  nfsd4: permit layoutget of executable-only files
  RDMA/ocrdma: Fix permissions for OCRDMA_RESET_STATS
  ip6_vti: adjust vti mtu according to mtu of lower device
  iommu/vt-d: clean up pr_irq if request_threaded_irq fails
  pinctrl: Really force states during suspend/resume
  coresight: Fix disabling of CoreSight TPIU
  pty: cancel pty slave port buf's work in tty_release
  drm/omap: DMM: Check for DMM readiness after successful transaction commit
  vgacon: Set VGA struct resource types
  IB/umem: Fix use of npages/nmap fields
  RDMA/cma: Use correct size when writing netlink stats
  IB/ipoib: Avoid memory leak if the SA returns a different DGID
  mmc: avoid removing non-removable hosts during suspend
  platform/chrome: Use proper protocol transfer function
  cros_ec: fix nul-termination for firmware build info
  media: [RESEND] media: dvb-frontends: Add delay to Si2168 restart
  media: bt8xx: Fix err 'bt878_probe()'
  rtlwifi: rtl_pci: Fix the bug when inactiveps is enabled.
  RDMA/iwpm: Fix uninitialized error code in iwpm_send_mapinfo()
  drm/msm: fix leak in failed get_pages
  media: c8sectpfe: fix potential NULL pointer dereference in c8sectpfe_timer_interrupt
  Bluetooth: hci_qca: Avoid setup failure on missing rampatch
  perf tests kmod-path: Don't fail if compressed modules aren't supported
  rtc: ds1374: wdt: Fix stop/start ioctl always returning -EINVAL
  rtc: ds1374: wdt: Fix issue with timeout scaling from secs to wdt ticks
  cifs: small underflow in cnvrtDosUnixTm()
  net: hns: fix ethtool_get_strings overflow in hns driver
  sm501fb: don't return zero on failure path in sm501fb_start()
  video: fbdev: udlfb: Fix buffer on stack
  tcm_fileio: Prevent information leak for short reads
  ia64: fix module loading for gcc-5.4
  md/raid10: skip spare disk as 'first' disk
  Input: twl4030-pwrbutton - use correct device for irq request
  power: supply: pda_power: move from timer to delayed_work
  bnx2x: Align RX buffers
  drm/nouveau/kms: Increase max retries in scanout position queries.
  ACPI / PMIC: xpower: Fix power_table addresses
  ipmi/watchdog: fix wdog hang on panic waiting for ipmi response
  ARM: DRA7: clockdomain: Change the CLKTRCTRL of CM_PCIE_CLKSTCTRL to SW_WKUP
  mmc: sdhci-of-esdhc: limit SD clock for ls1012a/ls1046a
  staging: wilc1000: fix unchecked return value
  staging: unisys: visorhba: fix s-Par to boot with option CONFIG_VMAP_STACK set to y
  mtip32xx: use runtime tag to initialize command header
  mfd: palmas: Reset the POWERHOLD mux during power off
  mac80211: don't parse encrypted management frames in ieee80211_frame_acked
  Btrfs: send, fix file hole not being preserved due to inline extent
  rndis_wlan: add return value validation
  mt7601u: check return value of alloc_skb
  iio: st_pressure: st_accel: Initialise sensor platform data properly
  NFS: don't try to cross a mountpount when there isn't one there.
  infiniband/uverbs: Fix integer overflows
  scsi: mac_esp: Replace bogus memory barrier with spinlock
  qlcnic: fix unchecked return value
  wan: pc300too: abort path on failure
  mmc: host: omap_hsmmc: checking for NULL instead of IS_ERR()
  openvswitch: Delete conntrack entry clashing with an expectation.
  netfilter: xt_CT: fix refcnt leak on error path
  Fix driver usage of 128B WQEs when WQ_CREATE is V1.
  ASoC: Intel: Skylake: Uninitialized variable in probe_codec()
  IB/mlx4: Change vma from shared to private
  IB/mlx4: Take write semaphore when changing the vma struct
  HSI: ssi_protocol: double free in ssip_pn_xmit()
  IB/ipoib: Update broadcast object if PKey value was changed in index 0
  IB/ipoib: Fix deadlock between ipoib_stop and mcast join flow
  ALSA: hda - Fix headset microphone detection for ASUS N551 and N751
  e1000e: fix timing for 82579 Gigabit Ethernet controller
  tcp: remove poll() flakes with FastOpen
  NFS: Fix missing pg_cleanup after nfs_pageio_cond_complete()
  md/raid10: wait up frozen array in handle_write_completed
  iommu/omap: Register driver before setting IOMMU ops
  ARM: 8668/1: ftrace: Fix dynamic ftrace with DEBUG_RODATA and !FRAME_POINTER
  KVM: PPC: Book3S PR: Exit KVM on failed mapping
  scsi: virtio_scsi: Always try to read VPD pages
  clk: ns2: Correct SDIO bits
  ath: Fix updating radar flags for coutry code India
  spi: dw: Disable clock after unregistering the host
  media/dvb-core: Race condition when writing to CAM
  net: ipv6: send unsolicited NA on admin up
  i2c: i2c-scmi: add a MS HID
  genirq: Use irqd_get_trigger_type to compare the trigger type for shared IRQs
  cpufreq/sh: Replace racy task affinity logic
  ACPI/processor: Replace racy task affinity logic
  ACPI/processor: Fix error handling in __acpi_processor_start()
  time: Change posix clocks ops interfaces to use timespec64
  Input: ar1021_i2c - fix too long name in driver's device table
  rtc: cmos: Do not assume irq 8 for rtc when there are no legacy irqs
  x86: i8259: export legacy_pic symbol
  regulator: anatop: set default voltage selector for pcie
  platform/x86: asus-nb-wmi: Add wapf4 quirk for the X302UA
  staging: android: ashmem: Fix possible deadlock in ashmem_ioctl
  CIFS: Enable encryption during session setup phase
  SMB3: Validate negotiate request must always be signed
  tpm_tis: fix potential buffer overruns caused by bit glitches on the bus
  tpm: fix potential buffer overruns caused by bit glitches on the bus
  BACKPORT, FROMLIST: crypto: arm64/speck - add NEON-accelerated implementation of Speck-XTS
  Linux 4.4.123
  bpf: fix incorrect sign extension in check_alu_op()
  usb: gadget: bdc: 64-bit pointer capability check
  USB: gadget: udc: Add missing platform_device_put() on error in bdc_pci_probe()
  btrfs: Fix use-after-free when cleaning up fs_devs with a single stale device
  btrfs: alloc_chunk: fix DUP stripe size handling
  ARM: dts: LogicPD Torpedo: Fix I2C1 pinmux
  scsi: sg: only check for dxfer_len greater than 256M
  scsi: sg: fix static checker warning in sg_is_valid_dxfer
  scsi: sg: fix SG_DXFER_FROM_DEV transfers
  irqchip/gic-v3-its: Ensure nr_ites >= nr_lpis
  fs/aio: Use RCU accessors for kioctx_table->table[]
  fs/aio: Add explicit RCU grace period when freeing kioctx
  lock_parent() needs to recheck if dentry got __dentry_kill'ed under it
  fs: Teach path_connected to handle nfs filesystems with multiple roots.
  drm/amdgpu/dce: Don't turn off DP sink when disconnected
  ALSA: seq: Clear client entry before deleting else at closing
  ALSA: seq: Fix possible UAF in snd_seq_check_queue()
  ALSA: hda - Revert power_save option default value
  ALSA: pcm: Fix UAF in snd_pcm_oss_get_formats()
  x86/mm: Fix vmalloc_fault to use pXd_large
  x86/vm86/32: Fix POPF emulation
  selftests/x86/entry_from_vm86: Add test cases for POPF
  selftests/x86: Add tests for the STR and SLDT instructions
  selftests/x86: Add tests for User-Mode Instruction Prevention
  selftests/x86/entry_from_vm86: Exit with 1 if we fail
  ima: relax requiring a file signature for new files with zero length
  rcutorture/configinit: Fix build directory error message
  ipvlan: add L2 check for packets arriving via virtual devices
  ASoC: nuc900: Fix a loop timeout test
  mac80211: remove BUG() when interface type is invalid
  mac80211_hwsim: enforce PS_MANUAL_POLL to be set after PS_ENABLED
  agp/intel: Flush all chipset writes after updating the GGTT
  drm/amdkfd: Fix memory leaks in kfd topology
  veth: set peer GSO values
  media: cpia2: Fix a couple off by one bugs
  scsi: dh: add new rdac devices
  scsi: devinfo: apply to HP XP the same flags as Hitachi VSP
  scsi: core: scsi_get_device_flags_keyed(): Always return device flags
  spi: sun6i: disable/unprepare clocks on remove
  tools/usbip: fixes build with musl libc toolchain
  ath10k: fix invalid STS_CAP_OFFSET_MASK
  clk: qcom: msm8916: fix mnd_width for codec_digcodec
  cpufreq: Fix governor module removal race
  ath10k: update tdls teardown state to target
  ARM: dts: omap3-n900: Fix the audio CODEC's reset pin
  ARM: dts: am335x-pepper: Fix the audio CODEC's reset pin
  mtd: nand: fix interpretation of NAND_CMD_NONE in nand_command[_lp]()
  net: xfrm: allow clearing socket xfrm policies.
  test_firmware: fix setting old custom fw path back on exit
  sched: Stop resched_cpu() from sending IPIs to offline CPUs
  sched: Stop switched_to_rt() from sending IPIs to offline CPUs
  ARM: dts: exynos: Correct Trats2 panel reset line
  HID: elo: clear BTN_LEFT mapping
  video/hdmi: Allow "empty" HDMI infoframes
  drm/edid: set ELD connector type in drm_edid_to_eld()
  wil6210: fix memory access violation in wil_memcpy_from/toio_32
  pwm: tegra: Increase precision in PWM rate calculation
  kprobes/x86: Set kprobes pages read-only
  kprobes/x86: Fix kprobe-booster not to boost far call instructions
  scsi: sg: close race condition in sg_remove_sfp_usercontext()
  scsi: sg: check for valid direction before starting the request
  perf session: Don't rely on evlist in pipe mode
  perf inject: Copy events when reordering events in pipe mode
  drivers/perf: arm_pmu: handle no platform_device
  usb: gadget: dummy_hcd: Fix wrong power status bit clear/reset in dummy_hub_control()
  usb: dwc2: Make sure we disconnect the gadget state
  md/raid6: Fix anomily when recovering a single device in RAID6.
  regulator: isl9305: fix array size
  MIPS: r2-on-r6-emu: Clear BLTZALL and BGEZALL debugfs counters
  MIPS: r2-on-r6-emu: Fix BLEZL and BGTZL identification
  MIPS: BPF: Fix multiple problems in JIT skb access helpers.
  MIPS: BPF: Quit clobbering callee saved registers in JIT code.
  coresight: Fixes coresight DT parse to get correct output port ID.
  drm/amdgpu: Fail fb creation from imported dma-bufs. (v2)
  drm/radeon: Fail fb creation from imported dma-bufs.
  video: ARM CLCD: fix dma allocation size
  iommu/iova: Fix underflow bug in __alloc_and_insert_iova_range
  apparmor: Make path_max parameter readonly
  scsi: ses: don't get power status of SES device slot on probe
  fm10k: correctly check if interface is removed
  ALSA: firewire-digi00x: handle all MIDI messages on streaming packets
  reiserfs: Make cancel_old_flush() reliable
  ARM: dts: koelsch: Correct clock frequency of X2 DU clock input
  net/faraday: Add missing include of of.h
  powerpc: Avoid taking a data miss on every userspace instruction miss
  ARM: dts: r8a7791: Correct parent of SSI[0-9] clocks
  ARM: dts: r8a7790: Correct parent of SSI[0-9] clocks
  NFC: nfcmrvl: double free on error path
  NFC: nfcmrvl: Include unaligned.h instead of access_ok.h
  vxlan: vxlan dev should inherit lowerdev's gso_max_size
  drm/vmwgfx: Fixes to vmwgfx_fb
  braille-console: Fix value returned by _braille_console_setup
  bonding: refine bond_fold_stats() wrap detection
  f2fs: relax node version check for victim data in gc
  blk-throttle: make sure expire time isn't too big
  mm: Fix false-positive VM_BUG_ON() in page_cache_{get,add}_speculative()
  driver: (adm1275) set the m,b and R coefficients correctly for power
  dmaengine: imx-sdma: add 1ms delay to ensure SDMA channel is stopped
  tcp: sysctl: Fix a race to avoid unexpected 0 window from space
  spi: omap2-mcspi: poll OMAP2_MCSPI_CHSTAT_RXS for PIO transfer
  ASoC: rcar: ssi: don't set SSICR.CKDV = 000 with SSIWSR.CONT
  sched: act_csum: don't mangle TCP and UDP GSO packets
  Input: qt1070 - add OF device ID table
  sysrq: Reset the watchdog timers while displaying high-resolution timers
  timers, sched_clock: Update timeout for clock wrap
  media: i2c/soc_camera: fix ov6650 sensor getting wrong clock
  scsi: ipr: Fix missed EH wakeup
  solo6x10: release vb2 buffers in solo_stop_streaming()
  of: fix of_device_get_modalias returned length when truncating buffers
  batman-adv: handle race condition for claims between gateways
  ARM: dts: Adjust moxart IRQ controller and flags
  net/8021q: create device with all possible features in wanted_features
  HID: clamp input to logical range if no null state
  perf probe: Return errno when not hitting any event
  ath10k: disallow DFS simulation if DFS channel is not enabled
  drm: Defer disabling the vblank IRQ until the next interrupt (for instant-off)
  drivers: net: xgene: Fix hardware checksum setting
  perf tools: Make perf_event__synthesize_mmap_events() scale
  i40e: fix ethtool to get EEPROM data from X722 interface
  i40e: Acquire NVM lock before reads on all devices
  perf sort: Fix segfault with basic block 'cycles' sort dimension
  selinux: check for address length in selinux_socket_bind()
  PCI/MSI: Stop disabling MSI/MSI-X in pci_device_shutdown()
  ath10k: fix a warning during channel switch with multiple vaps
  drm: qxl: Don't alloc fbdev if emulation is not supported
  HID: reject input outside logical range only if null state is set
  staging: wilc1000: add check for kmalloc allocation failure.
  staging: speakup: Replace BUG_ON() with WARN_ON().
  Input: tsc2007 - check for presence and power down tsc2007 during probe
  blkcg: fix double free of new_blkg in blkcg_init_queue
  ANDROID: cpufreq: times: avoid prematurely freeing uid_entry
  ANDROID: Use standard logging functions in goldfish_pipe
  ANDROID: Fix whitespace in goldfish
  staging: android: ashmem: Fix possible deadlock in ashmem_ioctl
  llist: clang: introduce member_address_is_nonnull()
  Linux 4.4.122
  fixup: sctp: verify size of a new chunk in _sctp_make_chunk()
  serial: 8250_pci: Add Brainboxes UC-260 4 port serial device
  usb: gadget: f_fs: Fix use-after-free in ffs_fs_kill_sb()
  usb: usbmon: Read text within supplied buffer size
  USB: usbmon: remove assignment from IS_ERR argument
  usb: quirks: add control message delay for 1b1c:1b20
  USB: storage: Add JMicron bridge 152d:2567 to unusual_devs.h
  staging: android: ashmem: Fix lockdep issue during llseek
  staging: comedi: fix comedi_nsamples_left.
  uas: fix comparison for error code
  tty/serial: atmel: add new version check for usart
  serial: sh-sci: prevent lockup on full TTY buffers
  x86: Treat R_X86_64_PLT32 as R_X86_64_PC32
  x86/module: Detect and skip invalid relocations
  Revert "ARM: dts: LogicPD Torpedo: Fix I2C1 pinmux"
  NFS: Fix an incorrect type in struct nfs_direct_req
  scsi: qla2xxx: Replace fcport alloc with qla2x00_alloc_fcport
  ubi: Fix race condition between ubi volume creation and udev
  ext4: inplace xattr block update fails to deduplicate blocks
  netfilter: x_tables: pack percpu counter allocations
  netfilter: x_tables: pass xt_counters struct to counter allocator
  netfilter: x_tables: pass xt_counters struct instead of packet counter
  netfilter: use skb_to_full_sk in ip_route_me_harder
  netfilter: ipv6: fix use-after-free Write in nf_nat_ipv6_manip_pkt
  netfilter: bridge: ebt_among: add missing match size checks
  netfilter: ebtables: CONFIG_COMPAT: don't trust userland offsets
  netfilter: IDLETIMER: be syzkaller friendly
  netfilter: nat: cope with negative port range
  netfilter: x_tables: fix missing timer initialization in xt_LED
  netfilter: add back stackpointer size checks
  tc358743: fix register i2c_rd/wr function fix
  Input: tca8418_keypad - remove double read of key event register
  ARM: omap2: hide omap3_save_secure_ram on non-OMAP3 builds
  netfilter: nfnetlink_queue: fix timestamp attribute
  watchdog: hpwdt: fix unused variable warning
  watchdog: hpwdt: Check source of NMI
  watchdog: hpwdt: SMBIOS check
  nospec: Include <asm/barrier.h> dependency
  ALSA: hda: add dock and led support for HP ProBook 640 G2
  ALSA: hda: add dock and led support for HP EliteBook 820 G3
  ALSA: seq: More protection for concurrent write and ioctl races
  ALSA: seq: Don't allow resizing pool in use
  ALSA: hda/realtek - Fix dock line-out volume on Dell Precision 7520
  x86/MCE: Serialize sysfs changes
  bcache: don't attach backing with duplicate UUID
  kbuild: Handle builtin dtb file names containing hyphens
  loop: Fix lost writes caused by missing flag
  Input: matrix_keypad - fix race when disabling interrupts
  MIPS: OCTEON: irq: Check for null return on kzalloc allocation
  MIPS: ath25: Check for kzalloc allocation failure
  MIPS: BMIPS: Do not mask IPIs during suspend
  drm/amdgpu: fix KV harvesting
  drm/radeon: fix KV harvesting
  drm/amdgpu: Notify sbios device ready before send request
  drm/amdgpu: Fix deadlock on runtime suspend
  drm/radeon: Fix deadlock on runtime suspend
  drm/nouveau: Fix deadlock on runtime suspend
  drm: Allow determining if current task is output poll worker
  workqueue: Allow retrieval of current task's work struct
  scsi: qla2xxx: Fix NULL pointer crash due to active timer for ABTS
  RDMA/mlx5: Fix integer overflow while resizing CQ
  RDMA/ucma: Check that user doesn't overflow QP state
  RDMA/ucma: Limit possible option size
  ANDROID: ranchu: 32 bit framebuffer support
  ANDROID: Address checkpatch warnings in goldfishfb
  ANDROID: Address checkpatch.pl warnings in goldfish_pipe
  ANDROID: sdcardfs: fix lock issue on 32 bit/SMP architectures
  ANDROID: goldfish: Fix typo in goldfish_cmd_locked() call
  ANDROID: Address checkpatch.pl warnings in goldfish_pipe_v2
  FROMLIST: f2fs: don't put dentry page in pagecache into highmem
  Linux 4.4.121
  btrfs: preserve i_mode if __btrfs_set_acl() fails
  bpf, x64: implement retpoline for tail call
  dm io: fix duplicate bio completion due to missing ref count
  mpls, nospec: Sanitize array index in mpls_label_ok()
  net: mpls: Pull common label check into helper
  sctp: verify size of a new chunk in _sctp_make_chunk()
  s390/qeth: fix IPA command submission race
  s390/qeth: fix SETIP command handling
  sctp: fix dst refcnt leak in sctp_v6_get_dst()
  sctp: fix dst refcnt leak in sctp_v4_get_dst
  udplite: fix partial checksum initialization
  ppp: prevent unregistered channels from connecting to PPP units
  netlink: ensure to loop over all netns in genlmsg_multicast_allns()
  net: ipv4: don't allow setting net.ipv4.route.min_pmtu below 68
  net: fix race on decreasing number of TX queues
  ipv6 sit: work around bogus gcc-8 -Wrestrict warning
  hdlc_ppp: carrier detect ok, don't turn off negotiation
  fib_semantics: Don't match route with mismatching tclassid
  bridge: check brport attr show in brport_show
  Revert "led: core: Fix brightness setting when setting delay_off=0"
  x86/spectre: Fix an error message
  leds: do not overflow sysfs buffer in led_trigger_show
  x86/apic/vector: Handle legacy irq data correctly
  ARM: dts: LogicPD Torpedo: Fix I2C1 pinmux
  btrfs: Don't clear SGID when inheriting ACLs
  x86/syscall: Sanitize syscall table de-references under speculation fix
  KVM: mmu: Fix overlap between public and private memslots
  ARM: mvebu: Fix broken PL310_ERRATA_753970 selects
  nospec: Allow index argument to have const-qualified type
  media: m88ds3103: don't call a non-initalized function
  cpufreq: s3c24xx: Fix broken s3c_cpufreq_init()
  ALSA: hda: Add a power_save blacklist
  ALSA: usb-audio: Add a quirck for B&W PX headphones
  tpm_i2c_nuvoton: fix potential buffer overruns caused by bit glitches on the bus
  tpm_i2c_infineon: fix potential buffer overruns caused by bit glitches on the bus
  tpm: st33zp24: fix potential buffer overruns caused by bit glitches on the bus
  ANDROID: Delete the goldfish_nand driver.
  ANDROID: Add input support for Android Wear.
  ANDROID: proc: fix config & includes for /proc/uid
  FROMLIST: ARM: amba: Don't read past the end of sysfs "driver_override" buffer
  UPSTREAM: ANDROID: binder: remove WARN() for redundant txn error
  ANDROID: cpufreq: times: Add missing includes
  ANDROID: cpufreq: Add time_in_state to /proc/uid directories
  ANDROID: proc: Add /proc/uid directory
  ANDROID: cpufreq: times: track per-uid time in state
  ANDROID: cpufreq: track per-task time in state

Conflicts:
	drivers/gpu/drm/msm/msm_gem.c
	drivers/net/wireless/ath/regd.c
	kernel/sched/core.c

Change-Id: I9bb7b5a062415da6925a5a56a34e6eb066a53320
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
2018-04-20 12:27:57 +05:30
Linux Build Service Account
ace014f81d Merge "drm: msm: fix potential NULL pointer dereference" 2018-04-19 14:17:11 -07:00
Linux Build Service Account
9be90e52bc Merge "ARM: dts: msm: update icnss device node for sdm660 and sdm630" 2018-04-19 02:49:34 -07:00
Linux Build Service Account
5d75820235 Merge "defconfig: msm: Enable SMD packet driver for msm8996-auto" 2018-04-19 02:49:33 -07:00
Linux Build Service Account
6d0d8f7af3 Merge "clk: qcom: Update DSI PLL settings as per latest recommendation" 2018-04-18 15:10:16 -07:00
Linux Build Service Account
ff4eea9d8b Merge "usb: phy-msm-susb-qmp: power down phy upon disconnect notification" 2018-04-18 15:10:14 -07:00
Linux Build Service Account
04eb780a68 Merge "ARM: dts: msm: enable secure smmu domain on msm8996" 2018-04-18 04:50:58 -07:00
Linux Build Service Account
f838d89392 Merge "mmc: card: Service RPMB requests with priority over other requests" 2018-04-18 04:50:57 -07:00
Linux Build Service Account
315e769672 Merge "voice_svc: Avoid double free in voice_svc driver" 2018-04-18 04:50:55 -07:00
Linux Build Service Account
1b5da171e8 Merge "init/main: Put kernel end place_marker" 2018-04-18 04:50:54 -07:00
Linux Build Service Account
12fee561b0 Merge "mmc: card: Call blk_requeue_request() with queue-lock held" 2018-04-18 04:50:53 -07:00
Linux Build Service Account
4285c64373 Merge "v4l2-core: Remove unhelpful warnings" 2018-04-18 04:50:52 -07:00
Sarada Prasanna Garnayak
61e87507a5 ARM: dts: msm: update icnss device node for sdm660 and sdm630
Invalid min and max voltage configuration for the vdd-0.8-cx-mx
voltage regulator is causing smmu error after WLAN hardware reset.
To fix the above issue update the icnss wlan module vdd-0.8-cx-mx
regulator min and max voltage configuration value.

CRs-Fixed: 2175145
Change-Id: I293d1d3802c5a0bd3ba7244422ed46d16ef940b0
Signed-off-by: Sarada Prasanna Garnayak <sgarna@codeaurora.org>
2018-04-17 05:44:43 -07:00
Arun Kumar Neelakantam
612c98edc7 defconfig: msm: Enable SMD packet driver for msm8996-auto
SMD packet driver provide access to SMD resources from the
user space through device nodes.

CRs-Fixed: 2223967
Change-Id: I3d458493994f877bfc0bf252ad9e1d5f5e180138
Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org>
2018-04-17 14:44:50 +05:30
Linux Build Service Account
db005c458c Merge "mm-camera2:isp2: Release buffer lock after use" 2018-04-16 22:39:43 -07:00
Linux Build Service Account
289dfc65ae Merge "ARM: dts: msm: Update client-id for sde_kms_hyp" 2018-04-16 22:39:41 -07:00
Linux Build Service Account
f9b6081933 Merge "soc: qcom: scm: Support single HAB id for QCPE" 2018-04-16 22:39:40 -07:00
Vivek Kumar
a639d14d31 init/main: Put kernel end place_marker
Put kernel end place_marker for all targets.
This saves the kernel end time for targets which
enable MSM_BOOT_TIME_MARKER.

Change-Id: Iad635e971bdd341328d40681b7acf8a6f43f288d
Signed-off-by: Vivek Kumar <vivekuma@codeaurora.org>
2018-04-16 11:06:39 -07:00
Veerabhadrarao Badiganti
b8e9f7e011 mmc: card: Call blk_requeue_request() with queue-lock held
blk_requeue_request() must be called with queue lock held.

If it is called without this lock then there is a chance that block-
queue would be accessed simultaneously by more than one entity (say,
request completion & re-queue) and both can mess-up the queue
pointers which can result in unexpected results.

Change-Id: If81711ecf65a185f4c8dc19b8568621460c93db8
Signed-off-by: Veerabhadrarao Badiganti <vbadigan@codeaurora.org>
2018-04-16 08:07:45 -07:00
Veerabhadrarao Badiganti
d3643ee7ff mmc: card: Service RPMB requests with priority over other requests
RPMB requests are initiated from TZ and TZ gets blocked from servicing
other tasks/requests till it completes RPMB request. Delays in
servicing RPMB request may result in system-level stability/performance
issues.

Below is the issue observed:
1. TZ rpmb API is called to update TA rollback information. TZ forwards
   the request to HLOS mmc driver via rpmb-service.
2. mmc driver services the rpmb requests only after finishing the
   outstanding IO requests.
3. As part of handling an IO requests, mmc driver makes ICE call
   for getting encryption keys, which in-turn makes call to TZ.
4. Since ICE driver finds TZ is busy/blocked it returns ice request
   with -EBUSY error.
5. The failed requests with -EBUSY error would re-queued back.
6. The IO requests keep getting failed and keep getting re-queued
   and mmc driver never gets a chance to service rpmb requests.
7. This results in a deadlock senario.

So RPMB requests need to be serviced immediately.
If there is any outstanding RPMB request, then mmc driver should stop
pulling any more new requests. The moment its done with serving
ongoing requests, It should start processing RPMB request.

Change-Id: I2d0f98a11716ef946551cc1a967e70a38e91d6ac
Signed-off-by: Veerabhadrarao Badiganti <vbadigan@codeaurora.org>
2018-04-16 20:28:51 +05:30
Meera Gande
bf3dafc5ed mm-camera2:isp2: Release buffer lock after use
At start axi stream, we are acquiring the
buffer lock and releasing after completing
the stream configuration operations. In case
of live snapshot,this is causing the buffer
operations to halt and leading to sof freeze.

Change-Id: I7f57c8befc85c105a5690ac71e0276f42b9f1929
Signed-off-by: Meera Gande <mgande@codeaurora.org>
2018-04-16 11:42:44 +05:30
Linux Build Service Account
49df0ab20d Merge "soc: qcom: boot_stats: Fix place_marker API" 2018-04-15 22:22:34 -07:00
Linux Build Service Account
b813c182eb Merge "ath10k: deinit wow config in driver unload" 2018-04-15 22:22:33 -07:00
Rahul Sharma
ed3f93ba0b ARM: dts: msm: enable secure smmu domain on msm8996
Enable secure context bank of smmu domain to facilitate the
secure display usecases.

Change-Id: I2dea0b7d7a57558070a3f9b726d8e2d3d541521b
Signed-off-by: Rahul Sharma <rahsha@codeaurora.org>
2018-04-15 21:31:22 -07:00
Vivek Kumar
c5a90e7f3a ARM: dts: msm: Update client-id for sde_kms_hyp
Update Client-id for sde_kms_hyp node in LA-GVM.
This is required for MTMD feature.

Change-Id: I97c4c55b94173f4cc08d739974a11b9dd3a80ea3
Signed-off-by: Vivek Kumar <vivekuma@codeaurora.org>
2018-04-16 07:15:51 +05:30
Amit Blay
e51ceb3c2e soc: qcom: scm: Support single HAB id for QCPE
All guest VMs use the same HAB id for communication
with QCPE.

Change-Id: I01ed16376730276f13a734b82d387b1d30d14434
Signed-off-by: Amit Blay <ablay@codeaurora.org>
2018-04-15 07:14:14 -07:00
Linux Build Service Account
1920040bec Merge "defconfig: sdm660: Enable cnss_genl driver compilation" 2018-04-15 01:27:54 -07:00
Linux Build Service Account
18b279d0c7 Merge "defconfig: msmcortex_mediabox : Enable docker" 2018-04-15 01:27:41 -07:00
Linux Build Service Account
b85aa29d18 Merge "defconfig: Add USB pass-through related defconfig" 2018-04-15 01:27:39 -07:00
Linux Build Service Account
fb048ed53e Merge "ARM: dts: msm: Enable PMIC-GPIO clients for msm8996 GVM" 2018-04-14 13:44:49 -07:00
Linux Build Service Account
03da9df1d7 Merge "ARM: dts: msm: Add USB devices for msm8996 GVM" 2018-04-14 13:44:47 -07:00
Greg Kroah-Hartman
89904ccfe2 This is the 4.4.128 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlrQ7ekACgkQONu9yGCS
 aT6Znw//VtAP82BGP/+H6X6gt0rBRIYseEJkHOpKRu5PK+Vpx7mMQFIfBId95P6R
 buq1QyzY9yz8ixbByg/w60WA2jK/I9i0tDGBnSlZzNmUvbk01oBN+cc/weZDynF7
 rFbSvD3aTmPB4nm9VE+n7V/tgGeuu/bwi04zulAm/B0/zA+w9GZv/aAto3WlLdjF
 ogZPSo5y6ifm6Qryq9sTR42LyDBXOy1klRSIK5EXY1OnIvPL1HSYR3ea2yj3AMXB
 RPvpCCY8j7zC9yVifX1c+Gfv2tXVHb9kjgheJixP2J4M3fFlR5tjLQXtTP2S2I8G
 cuMcdT6MiQw31rMoLcpej66dMtkL3k6sEpzcnSPPNenTuDIolz7BLEyaO/hhgi9J
 6vIXAd4Xm9D8HkH3iG/L3GtD3JXpVPtHyli/X1M3hz/VNUSOUPENIjMmGoxfBOtQ
 d7c8VGxDjnqmafri3fBAm4c603qW7O1wqJ7vLs9z7vgOIxlOLoJ/uiazoJKgW6O0
 z0S/BABWqpAUAI9jgm2GvRDR2keM2mhQIgIrY0+ZpnaLSGe3MugB+GbK6xdBCuYA
 anOv9VTEAPlTc8gb+GlusbUVjQyacEDwXoT6f9mELCW8cqpMgh+3TiKFihbYkUTN
 ly/DxZH3jpva0dq94Mgjv1u/nlg9ac3zqGeo9buQQFC7MSoZKEM=
 =LiZa
 -----END PGP SIGNATURE-----

Merge 4.4.128 into android-4.4

Changes in 4.4.128
	cfg80211: make RATE_INFO_BW_20 the default
	md/raid5: make use of spin_lock_irq over local_irq_disable + spin_lock
	rtc: snvs: fix an incorrect check of return value
	x86/asm: Don't use RBP as a temporary register in csum_partial_copy_generic()
	NFSv4.1: RECLAIM_COMPLETE must handle NFS4ERR_CONN_NOT_BOUND_TO_SESSION
	IB/srpt: Fix abort handling
	af_key: Fix slab-out-of-bounds in pfkey_compile_policy.
	mac80211: bail out from prep_connection() if a reconfig is ongoing
	bna: Avoid reading past end of buffer
	qlge: Avoid reading past end of buffer
	ipmi_ssif: unlock on allocation failure
	net: cdc_ncm: Fix TX zero padding
	net: ethernet: ti: cpsw: adjust cpsw fifos depth for fullduplex flow control
	lockd: fix lockd shutdown race
	drivers/misc/vmw_vmci/vmci_queue_pair.c: fix a couple integer overflow tests
	pidns: disable pid allocation if pid_ns_prepare_proc() is failed in alloc_pid()
	s390: move _text symbol to address higher than zero
	net/mlx4_en: Avoid adding steering rules with invalid ring
	NFSv4.1: Work around a Linux server bug...
	CIFS: silence lockdep splat in cifs_relock_file()
	blk-mq: NVMe 512B/4K+T10 DIF/DIX format returns I/O error on dd with split op
	net: qca_spi: Fix alignment issues in rx path
	netxen_nic: set rcode to the return status from the call to netxen_issue_cmd
	Input: elan_i2c - check if device is there before really probing
	Input: elantech - force relative mode on a certain module
	KVM: PPC: Book3S PR: Check copy_to/from_user return values
	vmxnet3: ensure that adapter is in proper state during force_close
	SMB2: Fix share type handling
	bus: brcmstb_gisb: Use register offsets with writes too
	bus: brcmstb_gisb: correct support for 64-bit address output
	PowerCap: Fix an error code in powercap_register_zone()
	ARM: dts: imx53-qsrb: Pulldown PMIC IRQ pin
	staging: wlan-ng: prism2mgmt.c: fixed a double endian conversion before calling hfa384x_drvr_setconfig16, also fixes relative sparse warning
	x86/tsc: Provide 'tsc=unstable' boot parameter
	ARM: dts: imx6qdl-wandboard: Fix audio channel swap
	ipv6: avoid dad-failures for addresses with NODAD
	async_tx: Fix DMA_PREP_FENCE usage in do_async_gen_syndrome()
	usb: dwc3: keystone: check return value
	btrfs: fix incorrect error return ret being passed to mapping_set_error
	ata: libahci: properly propagate return value of platform_get_irq()
	neighbour: update neigh timestamps iff update is effective
	arp: honour gratuitous ARP _replies_
	usb: chipidea: properly handle host or gadget initialization failure
	USB: ene_usb6250: fix first command execution
	net: x25: fix one potential use-after-free issue
	USB: ene_usb6250: fix SCSI residue overwriting
	serial: 8250: omap: Disable DMA for console UART
	serial: sh-sci: Fix race condition causing garbage during shutdown
	sh_eth: Use platform device for printing before register_netdev()
	scsi: csiostor: fix use after free in csio_hw_use_fwconfig()
	powerpc/mm: Fix virt_addr_valid() etc. on 64-bit hash
	ath5k: fix memory leak on buf on failed eeprom read
	selftests/powerpc: Fix TM resched DSCR test with some compilers
	xfrm: fix state migration copy replay sequence numbers
	iio: hi8435: avoid garbage event at first enable
	iio: hi8435: cleanup reset gpio
	ext4: handle the rest of ext4_mb_load_buddy() ENOMEM errors
	md-cluster: fix potential lock issue in add_new_disk
	ARM: davinci: da8xx: Create DSP device only when assigned memory
	ray_cs: Avoid reading past end of buffer
	leds: pca955x: Correct I2C Functionality
	sched/numa: Use down_read_trylock() for the mmap_sem
	net/mlx5: Tolerate irq_set_affinity_hint() failures
	selinux: do not check open permission on sockets
	block: fix an error code in add_partition()
	mlx5: fix bug reading rss_hash_type from CQE
	net: ieee802154: fix net_device reference release too early
	libceph: NULL deref on crush_decode() error path
	netfilter: ctnetlink: fix incorrect nf_ct_put during hash resize
	pNFS/flexfiles: missing error code in ff_layout_alloc_lseg()
	ASoC: rsnd: SSI PIO adjust to 24bit mode
	scsi: bnx2fc: fix race condition in bnx2fc_get_host_stats()
	fix race in drivers/char/random.c:get_reg()
	ext4: fix off-by-one on max nr_pages in ext4_find_unwritten_pgoff()
	tcp: better validation of received ack sequences
	net: move somaxconn init from sysctl code
	Input: elan_i2c - clear INT before resetting controller
	bonding: Don't update slave->link until ready to commit
	KVM: nVMX: Fix handling of lmsw instruction
	net: llc: add lock_sock in llc_ui_bind to avoid a race condition
	ARM: dts: ls1021a: add "fsl,ls1021a-esdhc" compatible string to esdhc node
	thermal: power_allocator: fix one race condition issue for thermal_instances list
	perf probe: Add warning message if there is unexpected event name
	l2tp: fix missing print session offset info
	rds; Reset rs->rs_bound_addr in rds_add_bound() failure path
	hwmon: (ina2xx) Make calibration register value fixed
	media: videobuf2-core: don't go out of the buffer range
	ASoC: Intel: cht_bsw_rt5645: Analog Mic support
	scsi: libiscsi: Allow sd_shutdown on bad transport
	scsi: mpt3sas: Proper handling of set/clear of "ATA command pending" flag.
	vfb: fix video mode and line_length being set when loaded
	gpio: label descriptors using the device name
	ASoC: Intel: sst: Fix the return value of 'sst_send_byte_stream_mrfld()'
	wl1251: check return from call to wl1251_acx_arp_ip_filter
	hdlcdrv: Fix divide by zero in hdlcdrv_ioctl
	ovl: filter trusted xattr for non-admin
	powerpc/[booke|4xx]: Don't clobber TCR[WP] when setting TCR[DIE]
	dmaengine: imx-sdma: Handle return value of clk_prepare_enable
	arm64: futex: Fix undefined behaviour with FUTEX_OP_OPARG_SHIFT usage
	net/mlx5: avoid build warning for uniprocessor
	cxgb4: FW upgrade fixes
	rtc: opal: Handle disabled TPO in opal_get_tpo_time()
	rtc: interface: Validate alarm-time before handling rollover
	SUNRPC: ensure correct error is reported by xs_tcp_setup_socket()
	net: freescale: fix potential null pointer dereference
	KVM: SVM: do not zero out segment attributes if segment is unusable or not present
	clk: scpi: fix return type of __scpi_dvfs_round_rate
	clk: Fix __set_clk_rates error print-string
	powerpc/spufs: Fix coredump of SPU contexts
	perf trace: Add mmap alias for s390
	qlcnic: Fix a sleep-in-atomic bug in qlcnic_82xx_hw_write_wx_2M and qlcnic_82xx_hw_read_wx_2M
	mISDN: Fix a sleep-in-atomic bug
	drm/omap: fix tiled buffer stride calculations
	cxgb4: fix incorrect cim_la output for T6
	Fix serial console on SNI RM400 machines
	bio-integrity: Do not allocate integrity context for bio w/o data
	skbuff: return -EMSGSIZE in skb_to_sgvec to prevent overflow
	sit: reload iphdr in ipip6_rcv
	net/mlx4: Fix the check in attaching steering rules
	net/mlx4: Check if Granular QoS per VF has been enabled before updating QP qos_vport
	perf header: Set proper module name when build-id event found
	perf report: Ensure the perf DSO mapping matches what libdw sees
	tags: honor COMPILED_SOURCE with apart output directory
	e1000e: fix race condition around skb_tstamp_tx()
	cx25840: fix unchecked return values
	mceusb: sporadic RX truncation corruption fix
	net: phy: avoid genphy_aneg_done() for PHYs without clause 22 support
	ARM: imx: Add MXC_CPU_IMX6ULL and cpu_is_imx6ull
	e1000e: Undo e1000e_pm_freeze if __e1000_shutdown fails
	perf/core: Correct event creation with PERF_FORMAT_GROUP
	MIPS: mm: fixed mappings: correct initialisation
	MIPS: mm: adjust PKMAP location
	MIPS: kprobes: flush_insn_slot should flush only if probe initialised
	Fix loop device flush before configure v3
	net: emac: fix reset timeout with AR8035 phy
	perf tests: Decompress kernel module before objdump
	skbuff: only inherit relevant tx_flags
	xen: avoid type warning in xchg_xen_ulong
	bnx2x: Allow vfs to disable txvlan offload
	sctp: fix recursive locking warning in sctp_do_peeloff
	sparc64: ldc abort during vds iso boot
	iio: magnetometer: st_magn_spi: fix spi_device_id table
	Bluetooth: Send HCI Set Event Mask Page 2 command only when needed
	cpuidle: dt: Add missing 'of_node_put()'
	ACPICA: Events: Add runtime stub support for event APIs
	ACPICA: Disassembler: Abort on an invalid/unknown AML opcode
	s390/dasd: fix hanging safe offline
	vxlan: dont migrate permanent fdb entries during learn
	bcache: stop writeback thread after detaching
	bcache: segregate flash only volume write streams
	scsi: libsas: fix memory leak in sas_smp_get_phy_events()
	scsi: libsas: fix error when getting phy events
	scsi: libsas: initialize sas_phy status according to response of DISCOVER
	blk-mq: fix kernel oops in blk_mq_tag_idle()
	tty: n_gsm: Allow ADM response in addition to UA for control dlci
	EDAC, mv64x60: Fix an error handling path
	cxgb4vf: Fix SGE FL buffer initialization logic for 64K pages
	perf tools: Fix copyfile_offset update of output offset
	ipsec: check return value of skb_to_sgvec always
	rxrpc: check return value of skb_to_sgvec always
	virtio_net: check return value of skb_to_sgvec always
	virtio_net: check return value of skb_to_sgvec in one more location
	random: use lockless method of accessing and updating f->reg_idx
	futex: Remove requirement for lock_page() in get_futex_key()
	Kbuild: provide a __UNIQUE_ID for clang
	arp: fix arp_filter on l3slave devices
	net: fix possible out-of-bound read in skb_network_protocol()
	net/ipv6: Fix route leaking between VRFs
	netlink: make sure nladdr has correct size in netlink_connect()
	net/sched: fix NULL dereference in the error path of tcf_bpf_init()
	pptp: remove a buggy dst release in pptp_connect()
	sctp: do not leak kernel memory to user space
	sctp: sctp_sockaddr_af must check minimal addr length for AF_INET6
	sky2: Increase D3 delay to sky2 stops working after suspend
	vhost: correctly remove wait queue during poll failure
	vlan: also check phy_driver ts_info for vlan's real device
	bonding: fix the err path for dev hwaddr sync in bond_enslave
	bonding: move dev_mc_sync after master_upper_dev_link in bond_enslave
	bonding: process the err returned by dev_set_allmulti properly in bond_enslave
	net: fool proof dev_valid_name()
	ip_tunnel: better validate user provided tunnel names
	ipv6: sit: better validate user provided tunnel names
	ip6_gre: better validate user provided tunnel names
	ip6_tunnel: better validate user provided tunnel names
	vti6: better validate user provided tunnel names
	r8169: fix setting driver_data after register_netdev
	net sched actions: fix dumping which requires several messages to user space
	net/ipv6: Increment OUTxxx counters after netfilter hook
	ipv6: the entire IPv6 header chain must fit the first fragment
	vrf: Fix use after free and double free in vrf_finish_output
	Revert "xhci: plat: Register shutdown for xhci_plat"
	Linux 4.4.128

Change-Id: I9c1e58f634cc18f15a840c9d192c892dfcc5ff73
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2018-04-14 15:35:32 +02:00
Alistair Strachan
25d6aefb7c ANDROID: Add build server config for cuttlefish.
The build server config can be used with gcc or clang.
Specify CC=clang to build with clang.

Change-Id: Id346ab1489ecaaef8e9e66b084cc416dd0581f69
Signed-off-by: Alistair Strachan <astrachan@google.com>
2018-04-13 16:20:01 -07:00
Alistair Strachan
12f9b37fcd ANDROID: Add defconfig for cuttlefish.
This file is based on x86_64_defconfig, merged with the base and
recommended configs from configs.git, with the virtio drivers enabled
and some spurious kernel features turned off.

(This version differs from the 4.9 and 4.14 versions because it uses the
 deprecated ANDROID_LOW_MEMORY_KILLER feature instead of MEMCG.)

Change-Id: I61bde941e8cfef2dd83cb4ff040f7380922cc44e
Signed-off-by: Alistair Strachan <astrachan@google.com>
2018-04-13 16:20:01 -07:00
Greg Hartman
6a38f9839e FROMLIST: staging: Android: Add 'vsoc' driver for cuttlefish.
The cuttlefish system is a virtual SoC architecture based on QEMU. It
uses the QEMU ivshmem feature to share memory regions between guest and
host with a custom protocol.

Signed-off-by: Greg Hartman <ghartman@google.com>
[sent upstream via staging https://patchwork.kernel.org/patch/10339507/]
Change-Id: Iaf5d7536898329a66d00764d8892d1395164519e
Signed-off-by: Alistair Strachan <astrachan@google.com>
2018-04-13 16:15:45 -07:00
Greg Hackmann
4f175e7cd9 Revert "proc: make oom adjustment files user read-only"
CTS no longer expects oom_{adj,score_adj} to be read-only.  See
https://android-review.googlesource.com/530687/ for additional context.

This reverts commit 55541f1ac3.

Bug: 63142211
Change-Id: I8011b4389b17d9577a6aff08943d0021e990171b
Signed-off-by: Greg Hackmann <ghackmann@google.com>
2018-04-13 15:23:32 -07:00
Greg Hackmann
e588258301 Revert "fixup! proc: make oom adjustment files user read-only"
CTS no longer expects oom_{adj,score_adj} to be read-only.  See
https://android-review.googlesource.com/530687/ for additional context.

This reverts commit 87a7a2cfbe.

Bug: 63142211
Change-Id: I1d1b33c93ca6b6c16a9c1d5430dcb5cbe3ec894c
Signed-off-by: Greg Hackmann <ghackmann@google.com>
2018-04-13 15:23:32 -07:00
Greg Kroah-Hartman
dbb7876236 Linux 4.4.128 2018-04-13 19:50:28 +02:00
Greg Hackmann
f02dc09866 Revert "xhci: plat: Register shutdown for xhci_plat"
Pixel 2 field testers reported that when they tried to reboot their
phones with some USB devices plugged in, the reboot would get wedged and
eventually trigger watchdog reset.  Once the Pixel kernel team found a
reliable repro case, they narrowed it down to this commit's 4.4.y
backport.  Reverting the change made the issue go away.

This reverts commit b07c12517f2aed0add8ce18146bb426b14099392.

Signed-off-by: Greg Hackmann <ghackmann@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-13 19:50:27 +02:00
David Ahern
56f8ae4e07 vrf: Fix use after free and double free in vrf_finish_output
commit 82dd0d2a9a76fc8fa2b18d80b987d455728bf83a upstream.

Miguel reported an skb use after free / double free in vrf_finish_output
when neigh_output returns an error. The vrf driver should return after
the call to neigh_output as it takes over the skb on error path as well.

Patch is a simplified version of Miguel's patch which was written for 4.9,
and updated to top of tree.

Fixes: 8f58336d3f ("net: Add ethernet header for pass through VRF device")
Signed-off-by: Miguel Fadon Perlines <mfadon@teldat.com>
Signed-off-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[ backport to 4.4 and 4.9 dropped the sock_confirm_neigh and
  changed neigh_output to dst_neigh_output ]
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-13 19:50:27 +02:00
Paolo Abeni
d7d9a32687 ipv6: the entire IPv6 header chain must fit the first fragment
[ Upstream commit 10b8a3de603df7b96004179b1b33b1708c76d144 ]

While building ipv6 datagram we currently allow arbitrary large
extheaders, even beyond pmtu size. The syzbot has found a way
to exploit the above to trigger the following splat:

kernel BUG at ./include/linux/skbuff.h:2073!
invalid opcode: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
    (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 4230 Comm: syzkaller672661 Not tainted 4.16.0-rc2+ #326
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:__skb_pull include/linux/skbuff.h:2073 [inline]
RIP: 0010:__ip6_make_skb+0x1ac8/0x2190 net/ipv6/ip6_output.c:1636
RSP: 0018:ffff8801bc18f0f0 EFLAGS: 00010293
RAX: ffff8801b17400c0 RBX: 0000000000000738 RCX: ffffffff84f01828
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8801b415ac18
RBP: ffff8801bc18f360 R08: ffff8801b4576844 R09: 0000000000000000
R10: ffff8801bc18f380 R11: ffffed00367aee4e R12: 00000000000000d6
R13: ffff8801b415a740 R14: dffffc0000000000 R15: ffff8801b45767c0
FS:  0000000001535880(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000002000b000 CR3: 00000001b4123001 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
  ip6_finish_skb include/net/ipv6.h:969 [inline]
  udp_v6_push_pending_frames+0x269/0x3b0 net/ipv6/udp.c:1073
  udpv6_sendmsg+0x2a96/0x3400 net/ipv6/udp.c:1343
  inet_sendmsg+0x11f/0x5e0 net/ipv4/af_inet.c:764
  sock_sendmsg_nosec net/socket.c:630 [inline]
  sock_sendmsg+0xca/0x110 net/socket.c:640
  ___sys_sendmsg+0x320/0x8b0 net/socket.c:2046
  __sys_sendmmsg+0x1ee/0x620 net/socket.c:2136
  SYSC_sendmmsg net/socket.c:2167 [inline]
  SyS_sendmmsg+0x35/0x60 net/socket.c:2162
  do_syscall_64+0x280/0x940 arch/x86/entry/common.c:287
  entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x4404c9
RSP: 002b:00007ffdce35f948 EFLAGS: 00000217 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004404c9
RDX: 0000000000000003 RSI: 0000000020001f00 RDI: 0000000000000003
RBP: 00000000006cb018 R08: 00000000004002c8 R09: 00000000004002c8
R10: 0000000020000080 R11: 0000000000000217 R12: 0000000000401df0
R13: 0000000000401e80 R14: 0000000000000000 R15: 0000000000000000
Code: ff e8 1d 5e b9 fc e9 15 e9 ff ff e8 13 5e b9 fc e9 44 e8 ff ff e8 29
5e b9 fc e9 c0 e6 ff ff e8 3f f3 80 fc 0f 0b e8 38 f3 80 fc <0f> 0b 49 8d
87 80 00 00 00 4d 8d 87 84 00 00 00 48 89 85 20 fe
RIP: __skb_pull include/linux/skbuff.h:2073 [inline] RSP: ffff8801bc18f0f0
RIP: __ip6_make_skb+0x1ac8/0x2190 net/ipv6/ip6_output.c:1636 RSP:
ffff8801bc18f0f0

As stated by RFC 7112 section 5:

   When a host fragments an IPv6 datagram, it MUST include the entire
   IPv6 Header Chain in the First Fragment.

So this patch addresses the issue dropping datagrams with excessive
extheader length. It also updates the error path to report to the
calling socket nonnegative pmtu values.

The issue apparently predates git history.

v1 -> v2: cleanup error path, as per Eric's suggestion

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: syzbot+91e6f9932ff122fa4410@syzkaller.appspotmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-13 19:50:27 +02:00