Commit graph

575 commits

Author SHA1 Message Date
Srinivasarao P
b2c952f9a8 Merge android-4.4.146 (13962260) into msm-4.4
* refs/heads/tmp-13962260
  Linux 4.4.146
  scsi: sg: fix minor memory leak in error path
  crypto: padlock-aes - Fix Nano workaround data corruption
  kvm: x86: vmx: fix vpid leak
  virtio_balloon: fix another race between migration and ballooning
  net: socket: fix potential spectre v1 gadget in socketcall
  can: ems_usb: Fix memory leak on ems_usb_disconnect()
  squashfs: more metadata hardenings
  squashfs: more metadata hardening
  netlink: Fix spectre v1 gadget in netlink_create()
  net: dsa: Do not suspend/resume closed slave_dev
  inet: frag: enforce memory limits earlier
  tcp: add one more quick ack after after ECN events
  tcp: refactor tcp_ecn_check_ce to remove sk type cast
  tcp: do not aggressively quick ack after ECN events
  tcp: add max_quickacks param to tcp_incr_quickack and tcp_enter_quickack_mode
  tcp: do not force quickack when receiving out-of-order packets
  NET: stmmac: align DMA stuff to largest cache line length
  xen-netfront: wait xenbus state change when load module manually
  net: lan78xx: fix rx handling before first packet is send
  net: fix amd-xgbe flow-control issue
  ipv4: remove BUG_ON() from fib_compute_spec_dst
  ASoC: pxa: Fix module autoload for platform drivers
  dmaengine: pxa_dma: remove duplicate const qualifier
  ext4: check for allocation block validity with block group locked
  ext4: fix inline data updates with checksums enabled
  squashfs: be more careful about metadata corruption
  random: mix rdrand with entropy sent in from userspace
  drm: Add DP PSR2 sink enable bit
  media: si470x: fix __be16 annotations
  scsi: megaraid_sas: Increase timeout by 1 sec for non-RAID fastpath IOs
  scsi: scsi_dh: replace too broad "TP9" string with the exact models
  media: omap3isp: fix unbalanced dma_iommu_mapping
  crypto: authenc - don't leak pointers to authenc keys
  crypto: authencesn - don't leak pointers to authenc keys
  usb: hub: Don't wait for connect state at resume for powered-off ports
  microblaze: Fix simpleImage format generation
  audit: allow not equal op for audit by executable
  rsi: Fix 'invalid vdd' warning in mmc
  ipconfig: Correctly initialise ic_nameservers
  drm/gma500: fix psb_intel_lvds_mode_valid()'s return type
  memory: tegra: Apply interrupts mask per SoC
  memory: tegra: Do not handle spurious interrupts
  ALSA: hda/ca0132: fix build failure when a local macro is defined
  drm/atomic: Handling the case when setting old crtc for plane
  media: siano: get rid of __le32/__le16 cast warnings
  bpf: fix references to free_bpf_prog_info() in comments
  thermal: exynos: fix setting rising_threshold for Exynos5433
  scsi: megaraid: silence a static checker bug
  scsi: 3w-xxxx: fix a missing-check bug
  scsi: 3w-9xxx: fix a missing-check bug
  perf: fix invalid bit in diagnostic entry
  s390/cpum_sf: Add data entry sizes to sampling trailer entry
  brcmfmac: Add support for bcm43364 wireless chipset
  mtd: rawnand: fsl_ifc: fix FSL NAND driver to read all ONFI parameter pages
  media: saa7164: Fix driver name in debug output
  libata: Fix command retry decision
  media: rcar_jpu: Add missing clk_disable_unprepare() on error in jpu_open()
  dma-iommu: Fix compilation when !CONFIG_IOMMU_DMA
  tty: Fix data race in tty_insert_flip_string_fixed_flag
  HID: i2c-hid: check if device is there before really probing
  powerpc/embedded6xx/hlwd-pic: Prevent interrupts from being handled by Starlet
  drm/radeon: fix mode_valid's return type
  HID: hid-plantronics: Re-resend Update to map button for PTT products
  ALSA: usb-audio: Apply rate limit to warning messages in URB complete callback
  media: smiapp: fix timeout checking in smiapp_read_nvm
  md: fix NULL dereference of mddev->pers in remove_and_add_spares()
  regulator: pfuze100: add .is_enable() for pfuze100_swb_regulator_ops
  ALSA: emu10k1: Rate-limit error messages about page errors
  scsi: ufs: fix exception event handling
  mwifiex: correct histogram data with appropriate index
  PCI: pciehp: Request control of native hotplug only if supported
  pinctrl: at91-pio4: add missing of_node_put
  powerpc/8xx: fix invalid register expression in head_8xx.S
  powerpc/powermac: Mark variable x as unused
  powerpc/powermac: Add missing prototype for note_bootable_part()
  powerpc/chrp/time: Make some functions static, add missing header include
  powerpc/32: Add a missing include header
  ath: Add regulatory mapping for Bahamas
  ath: Add regulatory mapping for Bermuda
  ath: Add regulatory mapping for Serbia
  ath: Add regulatory mapping for Tanzania
  ath: Add regulatory mapping for Uganda
  ath: Add regulatory mapping for APL2_FCCA
  ath: Add regulatory mapping for APL13_WORLD
  ath: Add regulatory mapping for ETSI8_WORLD
  ath: Add regulatory mapping for FCC3_ETSIC
  PCI: Prevent sysfs disable of device while driver is attached
  btrfs: qgroup: Finish rescan when hit the last leaf of extent tree
  btrfs: add barriers to btrfs_sync_log before log_commit_wait wakeups
  media: videobuf2-core: don't call memop 'finish' when queueing
  wlcore: sdio: check for valid platform device data before suspend
  mwifiex: handle race during mwifiex_usb_disconnect
  mfd: cros_ec: Fail early if we cannot identify the EC
  ASoC: dpcm: fix BE dai not hw_free and shutdown
  Bluetooth: btusb: Add a new Realtek 8723DE ID 2ff8:b011
  Bluetooth: hci_qca: Fix "Sleep inside atomic section" warning
  iwlwifi: pcie: fix race in Rx buffer allocator
  perf/x86/intel/uncore: Correct fixed counter index check for NHM
  perf/x86/intel/uncore: Correct fixed counter index check in generic code
  usbip: usbip_detach: Fix memory, udev context and udev leak
  f2fs: fix to don't trigger writeback during recovery
  disable loading f2fs module on PAGE_SIZE > 4KB
  RDMA/mad: Convert BUG_ONs to error flows
  powerpc/64s: Fix compiler store ordering to SLB shadow area
  hvc_opal: don't set tb_ticks_per_usec in udbg_init_opal_common()
  infiniband: fix a possible use-after-free bug
  netfilter: ipset: List timing out entries with "timeout 1" instead of zero
  rtc: ensure rtc_set_alarm fails when alarms are not supported
  mm/slub.c: add __printf verification to slab_err()
  mm: vmalloc: avoid racy handling of debugobjects in vunmap
  nfsd: fix potential use-after-free in nfsd4_decode_getdeviceinfo
  ALSA: fm801: add error handling for snd_ctl_add
  ALSA: emu10k1: add error handling for snd_ctl_add
  xen/netfront: raise max number of slots in xennet_get_responses()
  tracing: Quiet gcc warning about maybe unused link variable
  tracing/kprobes: Fix trace_probe flags on enable_trace_kprobe() failure
  tracing: Fix possible double free in event_enable_trigger_func()
  tracing: Fix double free of event_trigger_data
  Input: elan_i2c - add another ACPI ID for Lenovo Ideapad 330-15AST
  Input: i8042 - add Lenovo LaVie Z to the i8042 reset list
  Input: elan_i2c - add ACPI ID for lenovo ideapad 330
  MIPS: Fix off-by-one in pci_resource_to_user()
  kernel/sys.c: fix merge error with 4.4.144

Conflicts:
	drivers/scsi/ufs/ufshcd.c
	include/net/tcp.h
	net/socket.c

Change-Id: Ie84fdcf54b0a45508f76ef56330291f54e35ed30
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
2018-08-07 15:36:56 +05:30
Hans Verkuil
46431d9c28 media: videobuf2-core: don't call memop 'finish' when queueing
[ Upstream commit 90b2da89a083e1395cb322521a42397c49ae4500 ]

When a buffer is queued or requeued in vb2_buffer_done, then don't
call the finish memop. In this case the buffer is only returned to vb2,
not to userspace.

Calling 'finish' here will cause an unbalance when the queue is
canceled, since the core will call the same memop again.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-08-06 16:24:32 +02:00
Blagovest Kolenichev
e1496b7442 Merge android-4.4.139 (7ba5557) into msm-4.4
* refs/heads/tmp-7ba5557
  Linux 4.4.139
  Bluetooth: Fix connection if directed advertising and privacy is used
  cdc_ncm: avoid padding beyond end of skb
  dm thin: handle running out of data space vs concurrent discard
  block: Fix transfer when chunk sectors exceeds max
  spi: Fix scatterlist elements size in spi_map_buf
  Btrfs: fix unexpected cow in run_delalloc_nocow
  ALSA: hda/realtek - Add a quirk for FSC ESPRIMO U9210
  Input: elantech - fix V4 report decoding for module with middle key
  Input: elantech - enable middle button of touchpads on ThinkPad P52
  Input: elan_i2c_smbus - fix more potential stack buffer overflows
  udf: Detect incorrect directory size
  xen: Remove unnecessary BUG_ON from __unbind_from_irq()
  Input: elan_i2c - add ELAN0618 (Lenovo v330 15IKB) ACPI ID
  video: uvesafb: Fix integer overflow in allocation
  NFSv4: Fix possible 1-byte stack overflow in nfs_idmap_read_and_verify_message
  nfsd: restrict rd_maxcount to svc_max_payload in nfsd_encode_readdir
  media: dvb_frontend: fix locking issues at dvb_frontend_get_event()
  media: cx231xx: Add support for AverMedia DVD EZMaker 7
  media: v4l2-compat-ioctl32: prevent go past max size
  perf intel-pt: Fix packet decoding of CYC packets
  perf intel-pt: Fix "Unexpected indirect branch" error
  perf intel-pt: Fix MTC timing after overflow
  perf intel-pt: Fix decoding to accept CBR between FUP and corresponding TIP
  perf intel-pt: Fix sync_switch INTEL_PT_SS_NOT_TRACING
  perf tools: Fix symbol and object code resolution for vdso32 and vdsox32
  mfd: intel-lpss: Program REMAP register in PIO mode
  backlight: tps65217_bl: Fix Device Tree node lookup
  backlight: max8925_bl: Fix Device Tree node lookup
  backlight: as3711_bl: Fix Device Tree node lookup
  xfrm: skip policies marked as dead while rehashing
  xfrm: Ignore socket policies when rebuilding hash tables
  UBIFS: Fix potential integer overflow in allocation
  ubi: fastmap: Cancel work upon detach
  md: fix two problems with setting the "re-add" device state.
  linvdimm, pmem: Preserve read-only setting for pmem devices
  scsi: zfcp: fix missing REC trigger trace on enqueue without ERP thread
  scsi: zfcp: fix missing REC trigger trace for all objects in ERP_FAILED
  scsi: zfcp: fix missing REC trigger trace on terminate_rport_io for ERP_FAILED
  scsi: zfcp: fix missing REC trigger trace on terminate_rport_io early return
  scsi: zfcp: fix misleading REC trigger trace where erp_action setup failed
  scsi: zfcp: fix missing SCSI trace for retry of abort / scsi_eh TMF
  scsi: zfcp: fix missing SCSI trace for result of eh_host_reset_handler
  scsi: qla2xxx: Fix setting lower transfer speed if GPSC fails
  iio:buffer: make length types match kfifo types
  Btrfs: fix clone vs chattr NODATASUM race
  time: Make sure jiffies_to_msecs() preserves non-zero time periods
  MIPS: io: Add barrier after register read in inX()
  PCI: pciehp: Clear Presence Detect and Data Link Layer Status Changed on resume
  MIPS: BCM47XX: Enable 74K Core ExternalSync for PCIe erratum
  mtd: cfi_cmdset_0002: Avoid walking all chips when unlocking.
  mtd: cfi_cmdset_0002: Fix unlocking requests crossing a chip boudary
  mtd: cfi_cmdset_0002: fix SEGV unlocking multiple chips
  mtd: cfi_cmdset_0002: Use right chip in do_ppb_xxlock()
  mtd: cfi_cmdset_0002: Change write buffer to check correct value
  RDMA/mlx4: Discard unknown SQP work requests
  IB/qib: Fix DMA api warning with debug kernel
  of: unittest: for strings, account for trailing \0 in property length field
  ARM: 8764/1: kgdb: fix NUMREGBYTES so that gdb_regs[] is the correct size
  powerpc/fadump: Unregister fadump on kexec down path.
  cpuidle: powernv: Fix promotion from snooze if next state disabled
  powerpc/ptrace: Fix enforcement of DAWR constraints
  powerpc/ptrace: Fix setting 512B aligned breakpoints with PTRACE_SET_DEBUGREG
  powerpc/mm/hash: Add missing isync prior to kernel stack SLB switch
  fuse: fix control dir setup and teardown
  fuse: don't keep dead fuse_conn at fuse_fill_super().
  fuse: atomic_o_trunc should truncate pagecache
  Bluetooth: hci_qca: Avoid missing rampatch failure with userspace fw loader
  ipmi:bt: Set the timeout before doing a capabilities check
  branch-check: fix long->int truncation when profiling branches
  mips: ftrace: fix static function graph tracing
  lib/vsprintf: Remove atomic-unsafe support for %pCr
  ASoC: cirrus: i2s: Fix {TX|RX}LinCtrlData setup
  ASoC: cirrus: i2s: Fix LRCLK configuration
  ASoC: dapm: delete dapm_kcontrol_data paths list before freeing it
  1wire: family module autoload fails because of upper/lower case mismatch.
  usb: do not reset if a low-speed or full-speed device timed out
  signal/xtensa: Consistenly use SIGBUS in do_unaligned_user
  serial: sh-sci: Use spin_{try}lock_irqsave instead of open coding version
  m68k/mm: Adjust VM area to be unmapped by gap size for __iounmap()
  x86/spectre_v1: Disable compiler optimizations over array_index_mask_nospec()
  fs/binfmt_misc.c: do not allow offset overflow
  w1: mxc_w1: Enable clock before calling clk_get_rate() on it
  libata: Drop SanDisk SD7UB3Q*G1001 NOLPM quirk
  libata: zpodd: small read overflow in eject_tray()
  libata: zpodd: make arrays cdb static, reduces object code size
  cpufreq: Fix new policy initialization during limits updates via sysfs
  ALSA: hda: add dock and led support for HP ProBook 640 G4
  ALSA: hda: add dock and led support for HP EliteBook 830 G5
  ALSA: hda - Handle kzalloc() failure in snd_hda_attach_pcm_stream()
  btrfs: scrub: Don't use inode pages for device replace
  driver core: Don't ignore class_dir_create_and_add() failure.
  ext4: fix fencepost error in check for inode count overflow during resize
  ext4: update mtime in ext4_punch_hole even if no blocks are released
  tcp: verify the checksum of the first data segment in a new connection
  bonding: re-evaluate force_primary when the primary slave name changes
  usb: musb: fix remote wakeup racing with suspend
  Btrfs: make raid6 rebuild retry more
  tcp: do not overshoot window_clamp in tcp_rcv_space_adjust()
  Revert "Btrfs: fix scrub to repair raid6 corruption"
  net/sonic: Use dma_mapping_error()
  net: qmi_wwan: Add Netgear Aircard 779S
  atm: zatm: fix memcmp casting
  ipvs: fix buffer overflow with sync daemon and service
  netfilter: ebtables: handle string from userspace with care
  xfrm6: avoid potential infinite loop in _decode_session6()
  ANDROID: Add kconfig to make dm-verity check_at_most_once default enabled
  ANDROID: sdcardfs: fix potential crash when reserved_mb is not zero

Change-Id: Ibcd2b6614843e4e8fd5a57acf350a9e83e1c0dbc
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
2018-07-03 12:24:56 -07:00
Mauro Carvalho Chehab
ce7d1aac3c media: v4l2-compat-ioctl32: prevent go past max size
commit ea72fbf588ac9c017224dcdaa2019ff52ca56fee upstream.

As warned by smatch:
	drivers/media/v4l2-core/v4l2-compat-ioctl32.c:879 put_v4l2_ext_controls32() warn: check for integer overflow 'count'

The access_ok() logic should check for too big arrays too.

Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-07-03 11:21:33 +02:00
Srinivasarao P
ee76c85f71 Merge android-4.4.129 (b1c4836) into msm-4.4
* refs/heads/tmp-b1c4836
  Linux 4.4.129
  writeback: safer lock nesting
  fanotify: fix logic of events on child
  ext4: bugfix for mmaped pages in mpage_release_unused_pages()
  mm/filemap.c: fix NULL pointer in page_cache_tree_insert()
  mm: allow GFP_{FS,IO} for page_cache_read page cache allocation
  autofs: mount point create should honour passed in mode
  Don't leak MNT_INTERNAL away from internal mounts
  rpc_pipefs: fix double-dput()
  hypfs_kill_super(): deal with failed allocations
  jffs2_kill_sb(): deal with failed allocations
  powerpc/lib: Fix off-by-one in alternate feature patching
  powerpc/eeh: Fix enabling bridge MMIO windows
  MIPS: memset.S: Fix clobber of v1 in last_fixup
  MIPS: memset.S: Fix return of __clear_user from Lpartial_fixup
  MIPS: memset.S: EVA & fault support for small_memset
  MIPS: uaccess: Add micromips clobbers to bzero invocation
  HID: hidraw: Fix crash on HIDIOCGFEATURE with a destroyed device
  ALSA: hda - New VIA controller suppor no-snoop path
  ALSA: rawmidi: Fix missing input substream checks in compat ioctls
  ALSA: line6: Use correct endpoint type for midi output
  ext4: fix deadlock between inline_data and ext4_expand_extra_isize_ea()
  ext4: fix crashes in dioread_nolock mode
  drm/radeon: Fix PCIe lane width calculation
  ext4: don't allow r/w mounts if metadata blocks overlap the superblock
  vfio/pci: Virtualize Maximum Read Request Size
  vfio/pci: Virtualize Maximum Payload Size
  vfio-pci: Virtualize PCIe & AF FLR
  ALSA: pcm: Fix endless loop for XRUN recovery in OSS emulation
  ALSA: pcm: Fix mutex unbalance in OSS emulation ioctls
  ALSA: pcm: Return -EBUSY for OSS ioctls changing busy streams
  ALSA: pcm: Avoid potential races between OSS ioctls and read/write
  ALSA: pcm: Use ERESTARTSYS instead of EINTR in OSS emulation
  ALSA: oss: consolidate kmalloc/memset 0 call to kzalloc
  watchdog: f71808e_wdt: Fix WD_EN register read
  thermal: imx: Fix race condition in imx_thermal_probe()
  clk: bcm2835: De-assert/assert PLL reset signal when appropriate
  clk: mvebu: armada-38x: add support for missing clocks
  clk: mvebu: armada-38x: add support for 1866MHz variants
  mmc: jz4740: Fix race condition in IRQ mask update
  iommu/vt-d: Fix a potential memory leak
  um: Use POSIX ucontext_t instead of struct ucontext
  dmaengine: at_xdmac: fix rare residue corruption
  IB/srp: Fix completion vector assignment algorithm
  IB/srp: Fix srp_abort()
  ALSA: pcm: Fix UAF at PCM release via PCM timer access
  RDMA/ucma: Don't allow setting RDMA_OPTION_IB_PATH without an RDMA device
  ext4: fail ext4_iget for root directory if unallocated
  ext4: don't update checksum of new initialized bitmaps
  jbd2: if the journal is aborted then don't allow update of the log tail
  random: use a tighter cap in credit_entropy_bits_safe()
  thunderbolt: Resume control channel after hibernation image is created
  ASoC: ssm2602: Replace reg_default_raw with reg_default
  HID: core: Fix size as type u32
  HID: Fix hid_report_len usage
  powerpc/powernv: Fix OPAL NVRAM driver OPAL_BUSY loops
  powerpc/powernv: define a standard delay for OPAL_BUSY type retry loops
  powerpc/64: Fix smp_wmb barrier definition use use lwsync consistently
  powerpc/powernv: Handle unknown OPAL errors in opal_nvram_write()
  HID: i2c-hid: fix size check and type usage
  usb: dwc3: pci: Properly cleanup resource
  USB:fix USB3 devices behind USB3 hubs not resuming at hibernate thaw
  ACPI / hotplug / PCI: Check presence of slot itself in get_slot_status()
  ACPI / video: Add quirk to force acpi-video backlight on Samsung 670Z5E
  regmap: Fix reversed bounds check in regmap_raw_write()
  xen-netfront: Fix hang on device removal
  ARM: dts: at91: sama5d4: fix pinctrl compatible string
  ARM: dts: at91: at91sam9g25: fix mux-mask pinctrl property
  usb: musb: gadget: misplaced out of bounds check
  mm, slab: reschedule cache_reap() on the same CPU
  ipc/shm: fix use-after-free of shm file via remap_file_pages()
  resource: fix integer overflow at reallocation
  fs/reiserfs/journal.c: add missing resierfs_warning() arg
  ubi: Reject MLC NAND
  ubi: Fix error for write access
  ubi: fastmap: Don't flush fastmap work on detach
  ubifs: Check ubifs_wbuf_sync() return code
  tty: make n_tty_read() always abort if hangup is in progress
  x86/hweight: Don't clobber %rdi
  x86/hweight: Get rid of the special calling convention
  lan78xx: Correctly indicate invalid OTP
  slip: Check if rstate is initialized before uncompressing
  cdc_ether: flag the Cinterion AHS8 modem by gemalto as WWAN
  hwmon: (ina2xx) Fix access to uninitialized mutex
  rtl8187: Fix NULL pointer dereference in priv->conf_mutex
  getname_kernel() needs to make sure that ->name != ->iname in long case
  s390/ipl: ensure loadparm valid flag is set
  s390/qdio: don't merge ERROR output buffers
  s390/qdio: don't retry EQBS after CCQ 96
  block/loop: fix deadlock after loop_set_status
  Revert "perf tests: Decompress kernel module before objdump"
  radeon: hide pointless #warning when compile testing
  perf intel-pt: Fix timestamp following overflow
  perf intel-pt: Fix error recovery from missing TIP packet
  perf intel-pt: Fix sync_switch
  perf intel-pt: Fix overlap detection to identify consecutive buffers correctly
  parisc: Fix out of array access in match_pci_device()
  media: v4l2-compat-ioctl32: don't oops on overlay
  f2fs: check cap_resource only for data blocks
  Revert "f2fs: introduce f2fs_set_page_dirty_nobuffer"
  f2fs: clear PageError on writepage
  UPSTREAM: timer: Export destroy_hrtimer_on_stack()
  BACKPORT: dm verity: add 'check_at_most_once' option to only validate hashes once
  f2fs: call unlock_new_inode() before d_instantiate()
  f2fs: refactor read path to allow multiple postprocessing steps
  fscrypt: allow synchronous bio decryption

Change-Id: I45f4ac10734d92023b53118d83dcd6c83974a283
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
2018-04-24 19:07:57 +05:30
Mauro Carvalho Chehab
96adc5c82b media: v4l2-compat-ioctl32: don't oops on overlay
commit 85ea29f19eab56ec16ec6b92bc67305998706afa upstream.

At put_v4l2_window32(), it tries to access kp->clips. However,
kp points to an userspace pointer. So, it should be obtained
via get_user(), otherwise it can OOPS:

 vivid-000: ==================  END STATUS  ==================
 BUG: unable to handle kernel paging request at 00000000fffb18e0
 IP: [<ffffffffc05468d9>] __put_v4l2_format32+0x169/0x220 [videodev]
 PGD 3f5776067 PUD 3f576f067 PMD 3f5769067 PTE 800000042548f067
 Oops: 0001 [#1] SMP
 Modules linked in: vivid videobuf2_vmalloc videobuf2_memops v4l2_dv_timings videobuf2_core v4l2_common videodev media xt_CHECKSUM iptable_mangle ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack tun bridge stp llc ebtable_filter ebtables ip6table_filter ip6_tables bluetooth rfkill binfmt_misc snd_hda_codec_hdmi i915 snd_hda_intel snd_hda_controller snd_hda_codec intel_rapl x86_pkg_temp_thermal snd_hwdep intel_powerclamp snd_pcm coretemp snd_seq_midi kvm_intel kvm snd_seq_midi_event snd_rawmidi i2c_algo_bit drm_kms_helper snd_seq drm crct10dif_pclmul e1000e snd_seq_device crc32_pclmul snd_timer ghash_clmulni_intel snd mei_me mei ptp pps_core soundcore lpc_ich video crc32c_intel [last unloaded: media]
 CPU: 2 PID: 28332 Comm: v4l2-compliance Not tainted 3.18.102+ #107
 Hardware name:                  /NUC5i7RYB, BIOS RYBDWi35.86A.0364.2017.0511.0949 05/11/2017
 task: ffff8804293f8000 ti: ffff8803f5640000 task.ti: ffff8803f5640000
 RIP: 0010:[<ffffffffc05468d9>]  [<ffffffffc05468d9>] __put_v4l2_format32+0x169/0x220 [videodev]
 RSP: 0018:ffff8803f5643e28  EFLAGS: 00010246
 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00000000fffb1ab4
 RDX: 00000000fffb1a68 RSI: 00000000fffb18d8 RDI: 00000000fffb1aa8
 RBP: ffff8803f5643e48 R08: 0000000000000001 R09: ffff8803f54b0378
 R10: 0000000000000000 R11: 0000000000000168 R12: 00000000fffb18c0
 R13: 00000000fffb1a94 R14: 00000000fffb18c8 R15: 0000000000000000
 FS:  0000000000000000(0000) GS:ffff880456d00000(0063) knlGS:00000000f7100980
 CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
 CR2: 00000000fffb18e0 CR3: 00000003f552b000 CR4: 00000000003407e0
 Stack:
  00000000fffb1a94 00000000c0cc5640 0000000000000056 ffff8804274f3600
  ffff8803f5643ed0 ffffffffc0547e16 0000000000000003 ffff8803f5643eb0
  ffffffff81301460 ffff88009db44b01 ffff880441942520 ffff8800c0d05640
 Call Trace:
  [<ffffffffc0547e16>] v4l2_compat_ioctl32+0x12d6/0x1b1d [videodev]
  [<ffffffff81301460>] ? file_has_perm+0x70/0xc0
  [<ffffffff81252a2c>] compat_SyS_ioctl+0xec/0x1200
  [<ffffffff8173241a>] sysenter_dispatch+0x7/0x21
 Code: 00 00 48 8b 80 48 c0 ff ff 48 83 e8 38 49 39 c6 0f 87 2b ff ff ff 49 8d 45 1c e8 a3 ce e3 c0 85 c0 0f 85 1a ff ff ff 41 8d 40 ff <4d> 8b 64 24 20 41 89 d5 48 8d 44 40 03 4d 8d 34 c4 eb 15 0f 1f
 RIP  [<ffffffffc05468d9>] __put_v4l2_format32+0x169/0x220 [videodev]
 RSP <ffff8803f5643e28>
 CR2: 00000000fffb18e0

Tested with vivid driver on Kernel v3.18.102.

Same bug happens upstream too:

 BUG: KASAN: user-memory-access in __put_v4l2_format32+0x98/0x4d0 [videodev]
 Read of size 8 at addr 00000000ffe48400 by task v4l2-compliance/8713

 CPU: 0 PID: 8713 Comm: v4l2-compliance Not tainted 4.16.0-rc4+ #108
 Hardware name:  /NUC5i7RYB, BIOS RYBDWi35.86A.0364.2017.0511.0949 05/11/2017
 Call Trace:
  dump_stack+0x5c/0x7c
  kasan_report+0x164/0x380
  ? __put_v4l2_format32+0x98/0x4d0 [videodev]
  __put_v4l2_format32+0x98/0x4d0 [videodev]
  v4l2_compat_ioctl32+0x1aec/0x27a0 [videodev]
  ? __fsnotify_inode_delete+0x20/0x20
  ? __put_v4l2_format32+0x4d0/0x4d0 [videodev]
  compat_SyS_ioctl+0x646/0x14d0
  ? do_ioctl+0x30/0x30
  do_fast_syscall_32+0x191/0x3f4
  entry_SYSENTER_compat+0x6b/0x7a
 ==================================================================
 Disabling lock debugging due to kernel taint
 BUG: unable to handle kernel paging request at 00000000ffe48400
 IP: __put_v4l2_format32+0x98/0x4d0 [videodev]
 PGD 3a22fb067 P4D 3a22fb067 PUD 39b6f0067 PMD 39b6f1067 PTE 80000003256af067
 Oops: 0001 [#1] SMP KASAN
 Modules linked in: vivid videobuf2_vmalloc videobuf2_dma_contig videobuf2_memops v4l2_tpg v4l2_dv_timings videobuf2_v4l2 videobuf2_common v4l2_common videodev xt_CHECKSUM iptable_mangle ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack libcrc32c tun bridge stp llc ebtable_filter ebtables ip6table_filter ip6_tables bluetooth rfkill ecdh_generic binfmt_misc snd_hda_codec_hdmi intel_rapl x86_pkg_temp_thermal intel_powerclamp i915 coretemp snd_hda_intel snd_hda_codec kvm_intel snd_hwdep snd_hda_core kvm snd_pcm irqbypass crct10dif_pclmul crc32_pclmul snd_seq_midi ghash_clmulni_intel snd_seq_midi_event i2c_algo_bit intel_cstate snd_rawmidi intel_uncore snd_seq drm_kms_helper e1000e snd_seq_device snd_timer intel_rapl_perf
  drm ptp snd mei_me mei lpc_ich pps_core soundcore video crc32c_intel
 CPU: 0 PID: 8713 Comm: v4l2-compliance Tainted: G    B            4.16.0-rc4+ #108
 Hardware name:  /NUC5i7RYB, BIOS RYBDWi35.86A.0364.2017.0511.0949 05/11/2017
 RIP: 0010:__put_v4l2_format32+0x98/0x4d0 [videodev]
 RSP: 0018:ffff8803b9be7d30 EFLAGS: 00010282
 RAX: 0000000000000000 RBX: ffff8803ac983e80 RCX: ffffffff8cd929f2
 RDX: 1ffffffff1d0a149 RSI: 0000000000000297 RDI: 0000000000000297
 RBP: 00000000ffe485c0 R08: fffffbfff1cf5123 R09: ffffffff8e7a8948
 R10: 0000000000000001 R11: fffffbfff1cf5122 R12: 00000000ffe483e0
 R13: 00000000ffe485c4 R14: ffff8803ac985918 R15: 00000000ffe483e8
 FS:  0000000000000000(0000) GS:ffff880407400000(0063) knlGS:00000000f7a46980
 CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
 CR2: 00000000ffe48400 CR3: 00000003a83f2003 CR4: 00000000003606f0
 Call Trace:
  v4l2_compat_ioctl32+0x1aec/0x27a0 [videodev]
  ? __fsnotify_inode_delete+0x20/0x20
  ? __put_v4l2_format32+0x4d0/0x4d0 [videodev]
  compat_SyS_ioctl+0x646/0x14d0
  ? do_ioctl+0x30/0x30
  do_fast_syscall_32+0x191/0x3f4
  entry_SYSENTER_compat+0x6b/0x7a
 Code: 4c 89 f7 4d 8d 7c 24 08 e8 e6 a4 69 cb 48 8b 83 98 1a 00 00 48 83 e8 10 49 39 c7 0f 87 9d 01 00 00 49 8d 7c 24 20 e8 c8 a4 69 cb <4d> 8b 74 24 20 4c 89 ef 4c 89 fe ba 10 00 00 00 e8 23 d9 08 cc
 RIP: __put_v4l2_format32+0x98/0x4d0 [videodev] RSP: ffff8803b9be7d30
 CR2: 00000000ffe48400

cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-24 09:32:03 +02:00
Srinivasarao P
0382cccfee Merge android-4.4.128 (89904cc) into msm-4.4
* refs/heads/tmp-89904cc
  ANDROID: Add build server config for cuttlefish.
  ANDROID: Add defconfig for cuttlefish.
  FROMLIST: staging: Android: Add 'vsoc' driver for cuttlefish.
  Revert "proc: make oom adjustment files user read-only"
  Revert "fixup! proc: make oom adjustment files user read-only"
  Linux 4.4.128
  Revert "xhci: plat: Register shutdown for xhci_plat"
  vrf: Fix use after free and double free in vrf_finish_output
  ipv6: the entire IPv6 header chain must fit the first fragment
  net/ipv6: Increment OUTxxx counters after netfilter hook
  net sched actions: fix dumping which requires several messages to user space
  r8169: fix setting driver_data after register_netdev
  vti6: better validate user provided tunnel names
  ip6_tunnel: better validate user provided tunnel names
  ip6_gre: better validate user provided tunnel names
  ipv6: sit: better validate user provided tunnel names
  ip_tunnel: better validate user provided tunnel names
  net: fool proof dev_valid_name()
  bonding: process the err returned by dev_set_allmulti properly in bond_enslave
  bonding: move dev_mc_sync after master_upper_dev_link in bond_enslave
  bonding: fix the err path for dev hwaddr sync in bond_enslave
  vlan: also check phy_driver ts_info for vlan's real device
  vhost: correctly remove wait queue during poll failure
  sky2: Increase D3 delay to sky2 stops working after suspend
  sctp: sctp_sockaddr_af must check minimal addr length for AF_INET6
  sctp: do not leak kernel memory to user space
  pptp: remove a buggy dst release in pptp_connect()
  net/sched: fix NULL dereference in the error path of tcf_bpf_init()
  netlink: make sure nladdr has correct size in netlink_connect()
  net/ipv6: Fix route leaking between VRFs
  net: fix possible out-of-bound read in skb_network_protocol()
  arp: fix arp_filter on l3slave devices
  Kbuild: provide a __UNIQUE_ID for clang
  futex: Remove requirement for lock_page() in get_futex_key()
  random: use lockless method of accessing and updating f->reg_idx
  virtio_net: check return value of skb_to_sgvec in one more location
  virtio_net: check return value of skb_to_sgvec always
  rxrpc: check return value of skb_to_sgvec always
  ipsec: check return value of skb_to_sgvec always
  perf tools: Fix copyfile_offset update of output offset
  cxgb4vf: Fix SGE FL buffer initialization logic for 64K pages
  EDAC, mv64x60: Fix an error handling path
  tty: n_gsm: Allow ADM response in addition to UA for control dlci
  blk-mq: fix kernel oops in blk_mq_tag_idle()
  scsi: libsas: initialize sas_phy status according to response of DISCOVER
  scsi: libsas: fix error when getting phy events
  scsi: libsas: fix memory leak in sas_smp_get_phy_events()
  bcache: segregate flash only volume write streams
  bcache: stop writeback thread after detaching
  vxlan: dont migrate permanent fdb entries during learn
  s390/dasd: fix hanging safe offline
  ACPICA: Disassembler: Abort on an invalid/unknown AML opcode
  ACPICA: Events: Add runtime stub support for event APIs
  cpuidle: dt: Add missing 'of_node_put()'
  Bluetooth: Send HCI Set Event Mask Page 2 command only when needed
  iio: magnetometer: st_magn_spi: fix spi_device_id table
  sparc64: ldc abort during vds iso boot
  sctp: fix recursive locking warning in sctp_do_peeloff
  bnx2x: Allow vfs to disable txvlan offload
  xen: avoid type warning in xchg_xen_ulong
  skbuff: only inherit relevant tx_flags
  perf tests: Decompress kernel module before objdump
  net: emac: fix reset timeout with AR8035 phy
  Fix loop device flush before configure v3
  MIPS: kprobes: flush_insn_slot should flush only if probe initialised
  MIPS: mm: adjust PKMAP location
  MIPS: mm: fixed mappings: correct initialisation
  perf/core: Correct event creation with PERF_FORMAT_GROUP
  e1000e: Undo e1000e_pm_freeze if __e1000_shutdown fails
  ARM: imx: Add MXC_CPU_IMX6ULL and cpu_is_imx6ull
  net: phy: avoid genphy_aneg_done() for PHYs without clause 22 support
  mceusb: sporadic RX truncation corruption fix
  cx25840: fix unchecked return values
  e1000e: fix race condition around skb_tstamp_tx()
  tags: honor COMPILED_SOURCE with apart output directory
  perf report: Ensure the perf DSO mapping matches what libdw sees
  perf header: Set proper module name when build-id event found
  net/mlx4: Check if Granular QoS per VF has been enabled before updating QP qos_vport
  net/mlx4: Fix the check in attaching steering rules
  sit: reload iphdr in ipip6_rcv
  skbuff: return -EMSGSIZE in skb_to_sgvec to prevent overflow
  bio-integrity: Do not allocate integrity context for bio w/o data
  Fix serial console on SNI RM400 machines
  cxgb4: fix incorrect cim_la output for T6
  drm/omap: fix tiled buffer stride calculations
  mISDN: Fix a sleep-in-atomic bug
  qlcnic: Fix a sleep-in-atomic bug in qlcnic_82xx_hw_write_wx_2M and qlcnic_82xx_hw_read_wx_2M
  perf trace: Add mmap alias for s390
  powerpc/spufs: Fix coredump of SPU contexts
  clk: Fix __set_clk_rates error print-string
  clk: scpi: fix return type of __scpi_dvfs_round_rate
  KVM: SVM: do not zero out segment attributes if segment is unusable or not present
  net: freescale: fix potential null pointer dereference
  SUNRPC: ensure correct error is reported by xs_tcp_setup_socket()
  rtc: interface: Validate alarm-time before handling rollover
  rtc: opal: Handle disabled TPO in opal_get_tpo_time()
  cxgb4: FW upgrade fixes
  net/mlx5: avoid build warning for uniprocessor
  arm64: futex: Fix undefined behaviour with FUTEX_OP_OPARG_SHIFT usage
  dmaengine: imx-sdma: Handle return value of clk_prepare_enable
  powerpc/[booke|4xx]: Don't clobber TCR[WP] when setting TCR[DIE]
  ovl: filter trusted xattr for non-admin
  hdlcdrv: Fix divide by zero in hdlcdrv_ioctl
  wl1251: check return from call to wl1251_acx_arp_ip_filter
  ASoC: Intel: sst: Fix the return value of 'sst_send_byte_stream_mrfld()'
  gpio: label descriptors using the device name
  vfb: fix video mode and line_length being set when loaded
  scsi: mpt3sas: Proper handling of set/clear of "ATA command pending" flag.
  scsi: libiscsi: Allow sd_shutdown on bad transport
  ASoC: Intel: cht_bsw_rt5645: Analog Mic support
  media: videobuf2-core: don't go out of the buffer range
  hwmon: (ina2xx) Make calibration register value fixed
  rds; Reset rs->rs_bound_addr in rds_add_bound() failure path
  l2tp: fix missing print session offset info
  perf probe: Add warning message if there is unexpected event name
  thermal: power_allocator: fix one race condition issue for thermal_instances list
  ARM: dts: ls1021a: add "fsl,ls1021a-esdhc" compatible string to esdhc node
  net: llc: add lock_sock in llc_ui_bind to avoid a race condition
  KVM: nVMX: Fix handling of lmsw instruction
  bonding: Don't update slave->link until ready to commit
  Input: elan_i2c - clear INT before resetting controller
  net: move somaxconn init from sysctl code
  tcp: better validation of received ack sequences
  ext4: fix off-by-one on max nr_pages in ext4_find_unwritten_pgoff()
  fix race in drivers/char/random.c:get_reg()
  scsi: bnx2fc: fix race condition in bnx2fc_get_host_stats()
  ASoC: rsnd: SSI PIO adjust to 24bit mode
  pNFS/flexfiles: missing error code in ff_layout_alloc_lseg()
  netfilter: ctnetlink: fix incorrect nf_ct_put during hash resize
  libceph: NULL deref on crush_decode() error path
  net: ieee802154: fix net_device reference release too early
  mlx5: fix bug reading rss_hash_type from CQE
  block: fix an error code in add_partition()
  selinux: do not check open permission on sockets
  net/mlx5: Tolerate irq_set_affinity_hint() failures
  sched/numa: Use down_read_trylock() for the mmap_sem
  leds: pca955x: Correct I2C Functionality
  ray_cs: Avoid reading past end of buffer
  ARM: davinci: da8xx: Create DSP device only when assigned memory
  md-cluster: fix potential lock issue in add_new_disk
  ext4: handle the rest of ext4_mb_load_buddy() ENOMEM errors
  iio: hi8435: cleanup reset gpio
  iio: hi8435: avoid garbage event at first enable
  xfrm: fix state migration copy replay sequence numbers
  selftests/powerpc: Fix TM resched DSCR test with some compilers
  ath5k: fix memory leak on buf on failed eeprom read
  powerpc/mm: Fix virt_addr_valid() etc. on 64-bit hash
  scsi: csiostor: fix use after free in csio_hw_use_fwconfig()
  sh_eth: Use platform device for printing before register_netdev()
  serial: sh-sci: Fix race condition causing garbage during shutdown
  serial: 8250: omap: Disable DMA for console UART
  USB: ene_usb6250: fix SCSI residue overwriting
  net: x25: fix one potential use-after-free issue
  USB: ene_usb6250: fix first command execution
  usb: chipidea: properly handle host or gadget initialization failure
  arp: honour gratuitous ARP _replies_
  neighbour: update neigh timestamps iff update is effective
  ata: libahci: properly propagate return value of platform_get_irq()
  btrfs: fix incorrect error return ret being passed to mapping_set_error
  usb: dwc3: keystone: check return value
  async_tx: Fix DMA_PREP_FENCE usage in do_async_gen_syndrome()
  ipv6: avoid dad-failures for addresses with NODAD
  ARM: dts: imx6qdl-wandboard: Fix audio channel swap
  x86/tsc: Provide 'tsc=unstable' boot parameter
  staging: wlan-ng: prism2mgmt.c: fixed a double endian conversion before calling hfa384x_drvr_setconfig16, also fixes relative sparse warning
  ARM: dts: imx53-qsrb: Pulldown PMIC IRQ pin
  PowerCap: Fix an error code in powercap_register_zone()
  bus: brcmstb_gisb: correct support for 64-bit address output
  bus: brcmstb_gisb: Use register offsets with writes too
  SMB2: Fix share type handling
  vmxnet3: ensure that adapter is in proper state during force_close
  KVM: PPC: Book3S PR: Check copy_to/from_user return values
  Input: elantech - force relative mode on a certain module
  Input: elan_i2c - check if device is there before really probing
  netxen_nic: set rcode to the return status from the call to netxen_issue_cmd
  net: qca_spi: Fix alignment issues in rx path
  blk-mq: NVMe 512B/4K+T10 DIF/DIX format returns I/O error on dd with split op
  CIFS: silence lockdep splat in cifs_relock_file()
  NFSv4.1: Work around a Linux server bug...
  net/mlx4_en: Avoid adding steering rules with invalid ring
  s390: move _text symbol to address higher than zero
  pidns: disable pid allocation if pid_ns_prepare_proc() is failed in alloc_pid()
  drivers/misc/vmw_vmci/vmci_queue_pair.c: fix a couple integer overflow tests
  lockd: fix lockd shutdown race
  net: ethernet: ti: cpsw: adjust cpsw fifos depth for fullduplex flow control
  net: cdc_ncm: Fix TX zero padding
  ipmi_ssif: unlock on allocation failure
  qlge: Avoid reading past end of buffer
  bna: Avoid reading past end of buffer
  mac80211: bail out from prep_connection() if a reconfig is ongoing
  af_key: Fix slab-out-of-bounds in pfkey_compile_policy.
  IB/srpt: Fix abort handling
  NFSv4.1: RECLAIM_COMPLETE must handle NFS4ERR_CONN_NOT_BOUND_TO_SESSION
  x86/asm: Don't use RBP as a temporary register in csum_partial_copy_generic()
  rtc: snvs: fix an incorrect check of return value
  md/raid5: make use of spin_lock_irq over local_irq_disable + spin_lock
  cfg80211: make RATE_INFO_BW_20 the default
  ANDROID: proc: add null check in proc_uid_init
  f2fs/fscrypt: updates to v4.17-rc1
  Reduce amount of casting in drivers/tty/goldfish.c.

Conflicts:
	drivers/staging/android/Kconfig
	drivers/staging/android/Makefile

Change-Id: Ic7aa3df76a0312b8d6d84f8a8e11e793311a239a
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
2018-04-20 13:05:36 +05:30
Mauro Carvalho Chehab
7fba5c7a0a media: videobuf2-core: don't go out of the buffer range
[ Upstream commit df93dc61b0d8b19a5c9db545cf3fcc24f88dfde4 ]

Currently, there's no check if an invalid buffer range
is passed. However, while testing DVB memory mapped apps,
I got this:

   videobuf2_core: VB: num_buffers -2143943680, buffer 33, index -2143943647
   unable to handle kernel paging request at ffff888b773c0890
   IP: __vb2_queue_alloc+0x134/0x4e0 [videobuf2_core]
   PGD 4142c7067 P4D 4142c7067 PUD 0
   Oops: 0002 [#1] SMP
   Modules linked in: xt_CHECKSUM iptable_mangle ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack tun bridge stp llc ebtable_filter ebtables ip6table_filter ip6_tables bluetooth rfkill ecdh_generic binfmt_misc rc_dvbsky sp2 ts2020 intel_rapl x86_pkg_temp_thermal dvb_usb_dvbsky intel_powerclamp dvb_usb_v2 coretemp m88ds3103 kvm_intel i2c_mux dvb_core snd_hda_codec_hdmi crct10dif_pclmul crc32_pclmul videobuf2_vmalloc videobuf2_memops snd_hda_intel ghash_clmulni_intel videobuf2_core snd_hda_codec rc_core mei_me intel_cstate snd_hwdep snd_hda_core videodev intel_uncore snd_pcm mei media tpm_tis tpm_tis_core intel_rapl_perf tpm snd_timer lpc_ich snd soundcore kvm irqbypass libcrc32c i915 i2c_algo_bit drm_kms_helper
   e1000e ptp drm crc32c_intel video pps_core
   CPU: 3 PID: 1776 Comm: dvbv5-zap Not tainted 4.14.0+ #78
   Hardware name:                  /NUC5i7RYB, BIOS RYBDWi35.86A.0364.2017.0511.0949 05/11/2017
   task: ffff88877c73bc80 task.stack: ffffb7c402418000
   RIP: 0010:__vb2_queue_alloc+0x134/0x4e0 [videobuf2_core]
   RSP: 0018:ffffb7c40241bc60 EFLAGS: 00010246
   RAX: 0000000080360421 RBX: 0000000000000021 RCX: 000000000000000a
   RDX: ffffb7c40241bcf4 RSI: ffff888780362c60 RDI: ffff888796d8e130
   RBP: ffffb7c40241bcc8 R08: 0000000000000316 R09: 0000000000000004
   R10: ffff888780362c00 R11: 0000000000000001 R12: 000000000002f000
   R13: ffff8887758be700 R14: 0000000000021000 R15: 0000000000000001
   FS:  00007f2849024740(0000) GS:ffff888796d80000(0000) knlGS:0000000000000000
   CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
   CR2: ffff888b773c0890 CR3: 000000043beb2005 CR4: 00000000003606e0
   Call Trace:
    vb2_core_reqbufs+0x226/0x420 [videobuf2_core]
    dvb_vb2_reqbufs+0x2d/0xc0 [dvb_core]
    dvb_dvr_do_ioctl+0x98/0x1d0 [dvb_core]
    dvb_usercopy+0x53/0x1b0 [dvb_core]
    ? dvb_demux_ioctl+0x20/0x20 [dvb_core]
    ? tty_ldisc_deref+0x16/0x20
    ? tty_write+0x1f9/0x310
    ? process_echoes+0x70/0x70
    dvb_dvr_ioctl+0x15/0x20 [dvb_core]
    do_vfs_ioctl+0xa5/0x600
    SyS_ioctl+0x79/0x90
    entry_SYSCALL_64_fastpath+0x1a/0xa5
   RIP: 0033:0x7f28486f7ea7
   RSP: 002b:00007ffc13b2db18 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
   RAX: ffffffffffffffda RBX: 000055b10fc06130 RCX: 00007f28486f7ea7
   RDX: 00007ffc13b2db48 RSI: 00000000c0086f3c RDI: 0000000000000007
   RBP: 0000000000000203 R08: 000055b10df1e02c R09: 000000000000002e
   R10: 0036b42415108357 R11: 0000000000000246 R12: 0000000000000000
   R13: 00007f2849062f60 R14: 00000000000001f1 R15: 00007ffc13b2da54
   Code: 74 0a 60 8b 0a 48 83 c0 30 48 83 c2 04 89 48 d0 89 48 d4 48 39 f0 75 eb 41 8b 42 08 83 7d d4 01 41 c7 82 ec 01 00 00 ff ff ff ff <4d> 89 94 c5 88 00 00 00 74 14 83 c3 01 41 39 dc 0f 85 f1 fe ff
   RIP: __vb2_queue_alloc+0x134/0x4e0 [videobuf2_core] RSP: ffffb7c40241bc60
   CR2: ffff888b773c0890

So, add a sanity check in order to prevent going past array.

Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-13 19:50:13 +02:00
Shiju Mathew
fba9268511 v4l2-core: Remove unhelpful warnings
This warning is causing unnecessary triage for any test reports.

Change-Id: Iec47d217264e1b98b1fbe62c0ba9ef47aa41af9c
Signed-off-by: Shiju Mathew <shijum@codeaurora.org>
2018-04-11 11:41:36 -07:00
Srinivasarao P
8720164c1a Merge android-4.4.118 (5f7f76a) into msm-4.4
* refs/heads/tmp-5f7f76a
  Linux 4.4.118
  net: dst_cache_per_cpu_dst_set() can be static
  crypto: s5p-sss - Fix kernel Oops in AES-ECB mode
  KVM: nVMX: invvpid handling improvements
  KVM: VMX: clean up declaration of VPID/EPT invalidation types
  kvm: nVMX: Fix kernel panics induced by illegal INVEPT/INVVPID types
  KVM: nVMX: vmx_complete_nested_posted_interrupt() can't fail
  KVM: nVMX: kmap() can't fail
  x86/speculation: Fix typo IBRS_ATT, which should be IBRS_ALL
  x86/spectre: Simplify spectre_v2 command line parsing
  x86/retpoline: Avoid retpolines for built-in __init functions
  x86/kvm: Update spectre-v1 mitigation
  x86/paravirt: Remove 'noreplace-paravirt' cmdline option
  x86/spectre: Fix spelling mistake: "vunerable"-> "vulnerable"
  x86/spectre: Report get_user mitigation for spectre_v1
  nl80211: Sanitize array index in parse_txq_params
  vfs, fdtable: Prevent bounds-check bypass via speculative execution
  x86/syscall: Sanitize syscall table de-references under speculation
  x86/get_user: Use pointer masking to limit speculation
  x86: Introduce barrier_nospec
  x86: Implement array_index_mask_nospec
  array_index_nospec: Sanitize speculative array de-references
  Documentation: Document array_index_nospec
  x86/spectre: Check CONFIG_RETPOLINE in command line parser
  x86/cpu/bugs: Make retpoline module warning conditional
  x86/bugs: Drop one "mitigation" from dmesg
  x86/nospec: Fix header guards names
  module/retpoline: Warn about missing retpoline in module
  KVM: VMX: Make indirect call speculation safe
  KVM: x86: Make indirect calls in emulator speculation safe
  x86/retpoline: Remove the esp/rsp thunk
  KVM: async_pf: Fix #DF due to inject "Page not Present" and "Page Ready" exceptions simultaneously
  kasan: rework Kconfig settings
  drm/gma500: remove helper function
  x86/microcode/AMD: Change load_microcode_amd()'s param to bool to fix preemptibility bug
  genksyms: Fix segfault with invalid declarations
  dell-wmi, dell-laptop: depends DMI
  netlink: fix nla_put_{u8,u16,u32} for KASAN
  ASoC: Intel: Kconfig: fix build when ACPI is not enabled
  ARM: tegra: select USB_ULPI from EHCI rather than platform
  ncr5380: shut up gcc indentation warning
  usb: phy: msm add regulator dependency
  idle: i7300: add PCI dependency
  binfmt_elf: compat: avoid unused function warning
  isdn: sc: work around type mismatch warning
  power: bq27xxx_battery: mark some symbols __maybe_unused
  Revert "power: bq27xxx_battery: Remove unneeded dependency in Kconfig"
  ncpfs: fix unused variable warning
  gpio: xgene: mark PM functions as __maybe_unused
  net: hp100: remove unnecessary #ifdefs
  dmaengine: zx: fix build warning
  perf/x86: Shut up false-positive -Wmaybe-uninitialized warning
  wireless: cw1200: use __maybe_unused to hide pm functions_
  cw1200: fix bogus maybe-uninitialized warning
  v4l: remove MEDIA_TUNER dependency for VIDEO_TUNER
  hdpvr: hide unused variable
  drm/gma500: Sanity-check pipe index
  serial: 8250_mid: fix broken DMA dependency
  ASoC: rockchip: use __maybe_unused to hide st_irq_syscfg_resume
  ISDN: eicon: reduce stack size of sig_ind function
  em28xx: only use mt9v011 if camera support is enabled
  go7007: add MEDIA_CAMERA_SUPPORT dependency
  KVM: add X86_LOCAL_APIC dependency
  Input: tca8418_keypad - hide gcc-4.9 -Wmaybe-uninitialized warning
  drm/nouveau: hide gcc-4.9 -Wmaybe-uninitialized
  tc358743: fix register i2c_rd/wr functions
  staging: unisys: visorinput depends on INPUT
  i2c: remove __init from i2c_register_board_info()
  b2c2: flexcop: avoid unused function warnings
  infiniband: cxgb4: use %pR format string for printing resources
  iio: adc: axp288: remove redundant duplicate const on axp288_adc_channels
  ASoC: mediatek: add i2c dependency
  genirq/msi: Add stubs for get_cached_msi_msg/pci_write_msi_msg
  tty: cyclades: cyz_interrupt is only used for PCI
  drm/vmwgfx: use *_32_bits() macros
  tlan: avoid unused label with PCI=n
  tc1100-wmi: fix build warning when CONFIG_PM not enabled
  ipv4: ipconfig: avoid unused ic_proto_used symbol
  netfilter: ipvs: avoid unused variable warnings
  x86/platform/olpc: Fix resume handler build warning
  staging: wilc1000: fix kbuild test robot error
  rtlwifi: fix gcc-6 indentation warning
  USB: cdc_subset: only build when one driver is enabled
  hwrng: exynos - use __maybe_unused to hide pm functions
  fbdev: sm712fb: avoid unused function warnings
  Drivers: hv: vmbus: fix build warning
  modsign: hide openssl output in silent builds
  fbdev: s6e8ax0: avoid unused function warnings
  mtd: cfi: enforce valid geometry configuration
  mtd: sh_flctl: pass FIFO as physical address
  amd-xgbe: Fix unused suspend handlers build warning
  fbdev: auo_k190x: avoid unused function warnings
  driver-core: use 'dev' argument in dev_dbg_ratelimited stub
  target/user: Fix cast from pointer to phys_addr_t
  tty: hvc_xen: hide xen_console_remove when unused
  usb: musb/ux500: remove duplicate check for dma_is_compatible
  pwc: hide unused label
  SCSI: initio: remove duplicate module device table
  scsi: mvumi: use __maybe_unused to hide pm functions
  video: Use bool instead int pointer for get_opt_bool() argument
  fbdev: sis: enforce selection of at least one backend
  staging: ste_rmi4: avoid unused function warnings
  video: fbdev: sis: remove unused variable
  scsi: fdomain: drop fdomain_pci_tbl when built-in
  mptfusion: hide unused seq_mpt_print_ioc_summary function
  mtd: maps: add __init attribute
  mtd: ichxrom: maybe-uninitialized with gcc-4.9
  md: avoid warning for 32-bit sector_t
  profile: hide unused functions when !CONFIG_PROC_FS
  dpt_i2o: fix build warning
  drivers/net: fix eisa_driver probe section mismatch
  scsi: sim710: fix build warning
  x86/boot: Avoid warning for zero-filling .bss
  thermal: spear: use __maybe_unused for PM functions
  ssb: mark ssb_bus_register as __maybe_unused
  reiserfs: avoid a -Wmaybe-uninitialized warning
  ALSA: hda/ca0132 - fix possible NULL pointer use
  arm64: Kconfig: select COMPAT_BINFMT_ELF only when BINFMT_ELF is set
  scsi: advansys: fix uninitialized data access
  x86/platform: Add PCI dependency for PUNIT_ATOM_DEBUG
  x86: add MULTIUSER dependency for KVM
  thermal: fix INTEL_SOC_DTS_IOSF_CORE dependencies
  x86/build: Silence the build with "make -s"
  tools build: Add tools tree support for 'make -s'
  x86/fpu/math-emu: Fix possible uninitialized variable use
  arm64: define BUG() instruction without CONFIG_BUG
  x86/ras/inject: Make it depend on X86_LOCAL_APIC=y
  scsi: advansys: fix build warning for PCI=n
  video: fbdev: via: remove possibly unused variables
  platform/x86: intel_mid_thermal: Fix suspend handlers unused warning
  gpio: intel-mid: Fix build warning when !CONFIG_PM
  vmxnet3: prevent building with 64K pages
  isdn: icn: remove a #warning
  virtio_balloon: prevent uninitialized variable use
  hippi: Fix a Fix a possible sleep-in-atomic bug in rr_close
  xen: XEN_ACPI_PROCESSOR is Dom0-only
  x86/mm/kmmio: Fix mmiotrace for page unaligned addresses
  mm/early_ioremap: Fix boot hang with earlyprintk=efi,keep
  dmaengine: jz4740: disable/unprepare clk if probe fails
  drm/armada: fix leak of crtc structure
  xfrm: Fix stack-out-of-bounds with misconfigured transport mode policies.
  spi: sun4i: disable clocks in the remove function
  ASoC: rockchip: disable clock on error
  clk: fix a panic error caused by accessing NULL pointer
  dmaengine: at_hdmac: fix potential NULL pointer dereference in atc_prep_dma_interleaved
  dmaengine: ioat: Fix error handling path
  509: fix printing uninitialized stack memory when OID is empty
  btrfs: Fix possible off-by-one in btrfs_search_path_in_tree
  net_sched: red: Avoid illegal values
  net_sched: red: Avoid devision by zero
  gianfar: fix a flooded alignment reports because of padding issue.
  s390/dasd: prevent prefix I/O error
  powerpc/perf: Fix oops when grouping different pmu events
  ipvlan: Add the skb->mark as flow4's member to lookup route
  scripts/kernel-doc: Don't fail with status != 0 if error encountered with -none
  RDMA/cma: Make sure that PSN is not over max allowed
  pinctrl: sunxi: Fix A80 interrupt pin bank
  media: s5k6aa: describe some function parameters
  perf bench numa: Fixup discontiguous/sparse numa nodes
  perf top: Fix window dimensions change handling
  ARM: dts: am4372: Correct the interrupts_properties of McASP
  ARM: dts: Fix omap4 hang with GPS connected to USB by using wakeupgen
  ARM: AM33xx: PRM: Remove am33xx_pwrdm_read_prev_pwrst function
  ARM: OMAP2+: Fix SRAM virt to phys translation for save_secure_ram_context
  usb: build drivers/usb/common/ when USB_SUPPORT is set
  usbip: keep usbip_device sockfd state in sync with tcp_socket
  staging: iio: adc: ad7192: fix external frequency setting
  binder: check for binder_thread allocation failure in binder_poll()
  staging: android: ashmem: Fix a race condition in pin ioctls
  dn_getsockoptdecnet: move nf_{get/set}sockopt outside sock lock
  Make DST_CACHE a silent config option
  arm64: dts: add #cooling-cells to CPU nodes
  video: fbdev/mmp: add MODULE_LICENSE
  ASoC: ux500: add MODULE_LICENSE tag
  net: avoid skb_warn_bad_offload on IS_ERR
  netfilter: xt_RATEEST: acquire xt_rateest_mutex for hash insert
  netfilter: on sockopt() acquire sock lock only in the required scope
  netfilter: ipt_CLUSTERIP: fix out-of-bounds accesses in clusterip_tg_check()
  netfilter: x_tables: avoid out-of-bounds reads in xt_request_find_{match|target}
  netfilter: x_tables: fix int overflow in xt_alloc_table_info()
  KVM: x86: fix escape of guest dr6 to the host
  crypto: x86/twofish-3way - Fix %rbp usage
  selinux: skip bounded transition processing if the policy isn't loaded
  selinux: ensure the context is NUL terminated in security_context_to_sid_core()
  Provide a function to create a NUL-terminated string from unterminated data
  drm: Require __GFP_NOFAIL for the legacy drm_modeset_lock_all
  blktrace: fix unlocked registration of tracepoints
  xfrm: check id proto in validate_tmpl()
  xfrm: Fix stack-out-of-bounds read on socket policy lookup.
  mm,vmscan: Make unregister_shrinker() no-op if register_shrinker() failed.
  cfg80211: check dev_set_name() return value
  net: replace dst_cache ip6_tunnel implementation with the generic one
  net: add dst_cache support
  ANDROID: sdcardfs: Hold i_mutex for i_size_write
  BACKPORT, FROMGIT: crypto: speck - add test vectors for Speck64-XTS
  BACKPORT, FROMGIT: crypto: speck - add test vectors for Speck128-XTS
  BACKPORT, FROMGIT: crypto: arm/speck - add NEON-accelerated implementation of Speck-XTS
  FROMGIT: crypto: speck - export common helpers
  BACKPORT, FROMGIT: crypto: speck - add support for the Speck block cipher
  UPSTREAM: ANDROID: binder: synchronize_rcu() when using POLLFREE.
  f2fs: updates on v4.16-rc1

Conflicts:
	net/Kconfig
	net/core/Makefile

Change-Id: I659b0444812b04252f1f1fba8bc62410ce42b061
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
2018-03-01 17:20:34 +05:30
Srinivasarao P
863577dd59 Merge android-4.4.116 (20ddb25) into msm-4.4
* refs/heads/tmp-20ddb25
  Linux 4.4.116
  ftrace: Remove incorrect setting of glob search field
  mn10300/misalignment: Use SIGSEGV SEGV_MAPERR to report a failed user copy
  ovl: fix failure to fsync lower dir
  ACPI: sbshc: remove raw pointer from printk() message
  nvme: Fix managing degraded controllers
  btrfs: Handle btrfs_set_extent_delalloc failure in fixup worker
  pktcdvd: Fix pkt_setup_dev() error path
  EDAC, octeon: Fix an uninitialized variable warning
  xtensa: fix futex_atomic_cmpxchg_inatomic
  alpha: fix reboot on Avanti platform
  alpha: fix crash if pthread_create races with signal delivery
  signal/sh: Ensure si_signo is initialized in do_divide_error
  signal/openrisc: Fix do_unaligned_access to send the proper signal
  Bluetooth: btusb: Restore QCA Rome suspend/resume fix with a "rewritten" version
  Revert "Bluetooth: btusb: fix QCA Rome suspend/resume"
  Bluetooth: btsdio: Do not bind to non-removable BCM43341
  HID: quirks: Fix keyboard + touchpad on Toshiba Click Mini not working
  kernel/async.c: revert "async: simplify lowest_in_progress()"
  media: cxusb, dib0700: ignore XC2028_I2C_FLUSH
  media: ts2020: avoid integer overflows on 32 bit machines
  watchdog: imx2_wdt: restore previous timeout after suspend+resume
  KVM: nVMX: Fix races when sending nested PI while dest enters/leaves L2
  arm: KVM: Fix SMCCC handling of unimplemented SMC/HVC calls
  crypto: caam - fix endless loop when DECO acquire fails
  media: v4l2-compat-ioctl32.c: refactor compat ioctl32 logic
  media: v4l2-compat-ioctl32.c: don't copy back the result for certain errors
  media: v4l2-compat-ioctl32.c: drop pr_info for unknown buffer type
  media: v4l2-compat-ioctl32.c: copy clip list in put_v4l2_window32
  media: v4l2-compat-ioctl32: Copy v4l2_window->global_alpha
  media: v4l2-compat-ioctl32.c: make ctrl_is_pointer work for subdevs
  media: v4l2-compat-ioctl32.c: fix ctrl_is_pointer
  media: v4l2-compat-ioctl32.c: copy m.userptr in put_v4l2_plane32
  media: v4l2-compat-ioctl32.c: avoid sizeof(type)
  media: v4l2-compat-ioctl32.c: move 'helper' functions to __get/put_v4l2_format32
  media: v4l2-compat-ioctl32.c: fix the indentation
  media: v4l2-compat-ioctl32.c: add missing VIDIOC_PREPARE_BUF
  vb2: V4L2_BUF_FLAG_DONE is set after DQBUF
  media: v4l2-ioctl.c: don't copy back the result for -ENOTTY
  nsfs: mark dentry with DCACHE_RCUACCESS
  crypto: poly1305 - remove ->setkey() method
  crypto: cryptd - pass through absence of ->setkey()
  crypto: hash - introduce crypto_hash_alg_has_setkey()
  ahci: Add Intel Cannon Lake PCH-H PCI ID
  ahci: Add PCI ids for Intel Bay Trail, Cherry Trail and Apollo Lake AHCI
  ahci: Annotate PCI ids for mobile Intel chipsets as such
  kernfs: fix regression in kernfs_fop_write caused by wrong type
  NFS: reject request for id_legacy key without auxdata
  NFS: commit direct writes even if they fail partially
  NFS: Add a cond_resched() to nfs_commit_release_pages()
  nfs/pnfs: fix nfs_direct_req ref leak when i/o falls back to the mds
  ubi: block: Fix locking for idr_alloc/idr_remove
  mtd: nand: sunxi: Fix ECC strength choice
  mtd: nand: Fix nand_do_read_oob() return value
  mtd: nand: brcmnand: Disable prefetch by default
  mtd: cfi: convert inline functions to macros
  media: dvb-usb-v2: lmedm04: move ts2020 attach to dm04_lme2510_tuner
  media: dvb-usb-v2: lmedm04: Improve logic checking of warm start
  dccp: CVE-2017-8824: use-after-free in DCCP code
  sched/rt: Up the root domain ref count when passing it around via IPIs
  sched/rt: Use container_of() to get root domain in rto_push_irq_work_func()
  usb: gadget: uvc: Missing files for configfs interface
  posix-timer: Properly check sigevent->sigev_notify
  netfilter: nf_queue: Make the queue_handler pernet
  kaiser: fix compile error without vsyscall
  x86/kaiser: fix build error with KASAN && !FUNCTION_GRAPH_TRACER
  dmaengine: dmatest: fix container_of member in dmatest_callback
  CIFS: zero sensitive data when freeing
  cifs: Fix autonegotiate security settings mismatch
  cifs: Fix missing put_xid in cifs_file_strict_mmap
  powerpc/pseries: include linux/types.h in asm/hvcall.h
  x86/microcode: Do the family check first
  x86/microcode/AMD: Do not load when running on a hypervisor
  crypto: tcrypt - fix S/G table for test_aead_speed()
  don't put symlink bodies in pagecache into highmem
  KEYS: encrypted: fix buffer overread in valid_master_desc()
  media: soc_camera: soc_scale_crop: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE
  vhost_net: stop device during reset owner
  tcp: release sk_frag.page in tcp_disconnect
  r8169: fix RTL8168EP take too long to complete driver initialization.
  qlcnic: fix deadlock bug
  net: igmp: add a missing rcu locking section
  ip6mr: fix stale iterator
  x86/asm: Fix inline asm call constraints for GCC 4.4
  drm: rcar-du: Fix race condition when disabling planes at CRTC stop
  drm: rcar-du: Use the VBK interrupt for vblank events
  ASoC: rsnd: avoid duplicate free_irq()
  ASoC: rsnd: don't call free_irq() on Parent SSI
  ASoC: simple-card: Fix misleading error message
  net: cdc_ncm: initialize drvflags before usage
  usbip: fix 3eee23c3ec14 tcp_socket address still in the status file
  usbip: vhci_hcd: clear just the USB_PORT_STAT_POWER bit
  ASoC: pcm512x: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE
  powerpc/64s: Allow control of RFI flush via debugfs
  powerpc/64s: Wire up cpu_show_meltdown()
  powerpc/powernv: Check device-tree for RFI flush settings
  powerpc/pseries: Query hypervisor for RFI flush settings
  powerpc/64s: Support disabling RFI flush with no_rfi_flush and nopti
  powerpc/64s: Add support for RFI flush of L1-D cache
  powerpc/64s: Convert slb_miss_common to use RFI_TO_USER/KERNEL
  powerpc/64: Convert the syscall exit path to use RFI_TO_USER/KERNEL
  powerpc/64: Convert fast_exception_return to use RFI_TO_USER/KERNEL
  powerpc/64s: Simple RFI macro conversions
  powerpc/64: Add macros for annotating the destination of rfid/hrfid
  powerpc/pseries: Add H_GET_CPU_CHARACTERISTICS flags & wrapper
  powerpc: Simplify module TOC handling
  powerpc: Fix VSX enabling/flushing to also test MSR_FP and MSR_VEC
  powerpc/64: Fix flush_(d|i)cache_range() called from modules
  powerpc/bpf/jit: Disable classic BPF JIT on ppc64le
  BACKPORT: xfrm: Fix return value check of copy_sec_ctx.
  time: Fix ktime_get_raw() incorrect base accumulation
  sched/fair: prevent possible infinite loop in sched_group_energy
  UPSTREAM: MIPS: Fix build of compressed image
  ANDROID: qtaguid: Fix the UAF probelm with tag_ref_tree
  UPSTREAM: ANDROID: binder: remove waitqueue when thread exits.
  UPSTREAM: arm64/efi: Make strnlen() available to the EFI namespace
  UPSTREAM: ARM: boot: Add an implementation of strnlen for libfdt
  ANDROID: MIPS: Add ranchu[32r5|32r6|64]_defconfig
  FROMLIST: tty: goldfish: Enable 'earlycon' only if built-in
  FROMLIST: MIPS: ranchu: Add Ranchu as a new generic-based board
  FROMLIST: MIPS: Add noexec=on|off kernel parameter
  FROMLIST: MIPS: CPC: Map registers using DT in mips_cpc_default_phys_base()
  FROMLIST: dt-bindings: Document mti,mips-cpc binding
  FROMLIST: MIPS: math-emu: Mark fall throughs in switch statements with a comment
  FROMLIST: MIPS: math-emu: Avoid multiple assignment
  FROMLIST: MIPS: math-emu: Avoid an assignment within if statement condition
  FROMLIST: MIPS: math-emu: Declare function srl128() as static
  FROMLIST: MIPS: math-emu: Avoid definition duplication for macro DPXMULT()
  FROMLIST: MIPS: math-emu: Remove an unnecessary header inclusion
  UPSTREAM: scripts/dtc: Update to upstream version 0931cea3ba20
  UPSTREAM: scripts/dtc: dt_to_config - kernel config options for a devicetree
  UPSTREAM: scripts/dtc: Update to upstream version 53bf130b1cdd
  UPSTREAM: scripts/dtc: Update to upstream commit b06e55c88b9b
  UPSTREAM: scripts/dtc: dtx_diff - add info to error message
  UPSTREAM: dtc: create tool to diff device trees
  UPSTREAM: config: android-base: disable CONFIG_NFSD and CONFIG_NFS_FS
  UPSTREAM: config: android-base: add CGROUP_BPF
  UPSTREAM: config: android-base: add CONFIG_MODULES option
  UPSTREAM: config: android-base: add CONFIG_IKCONFIG option
  UPSTREAM: config: android-base: disable CONFIG_USELIB and CONFIG_FHANDLE
  UPSTREAM: config: android-base: enable hardened usercopy and kernel ASLR
  UPSTREAM: config: android: enable CONFIG_SECCOMP
  UPSTREAM: config: android: set SELinux as default security mode
  UPSTREAM: config: android: move device mapper options to recommended
  UPSTREAM: config/android: Remove CONFIG_IPV6_PRIVACY
  UPSTREAM: config: add android config fragments
  BACKPORT: MIPS: generic: Add a MAINTAINERS entry
  BACKPORT: irqchip/irq-goldfish-pic: Add Goldfish PIC driver
  UPSTREAM: dt-bindings/goldfish-pic: Add device tree binding for Goldfish PIC driver
  UPSTREAM: MIPS: Allow storing pgd in C0_CONTEXT for MIPSr6
  UPSTREAM: MIPS: CPS: Handle spurious VP starts more gracefully
  UPSTREAM: MIPS: CPS: Handle cores not powering down more gracefully
  UPSTREAM: MIPS: CPS: Prevent multi-core with dcache aliasing
  UPSTREAM: MIPS: CPS: Select CONFIG_SYS_SUPPORTS_SCHED_SMT for MIPSr6
  UPSTREAM: MIPS: CM: WARN on attempt to lock invalid VP, not BUG
  UPSTREAM: MIPS: CM: Avoid per-core locking with CM3 & higher
  UPSTREAM: MIPS: smp-cps: Avoid BUG() when offlining pre-r6 CPUs
  UPSTREAM: MIPS: smp-cps: Add support for CPU hotplug of MIPSr6 processors
  UPSTREAM: MIPS: generic: Bump default NR_CPUS to 16
  UPSTREAM: MIPS: pm-cps: Change FSB workaround to CPU blacklist
  UPSTREAM: MIPS: Fix early CM probing
  UPSTREAM: MIPS: smp-cps: Stop printing EJTAG exceptions to UART
  UPSTREAM: MIPS: smp-cps: Add nothreads kernel parameter
  UPSTREAM: MIPS: smp-cps: Support MIPSr6 Virtual Processors
  UPSTREAM: MIPS: smp-cps: Skip core setup if coherent
  UPSTREAM: MIPS: smp-cps: Pull boot config retrieval out of mips_cps_boot_vpes
  UPSTREAM: MIPS: smp-cps: Pull cache init into a function
  UPSTREAM: MIPS: smp-cps: Ensure our VP ident calculation is correct
  UPSTREAM: irqchip: mips-gic: Provide VP ID accessor
  UPSTREAM: irqchip: mips-gic: Use HW IDs for VPE_OTHER_ADDR
  UPSTREAM: MIPS: CM: Fix mips_cm_max_vp_width for UP kernels
  UPSTREAM: MIPS: CM: Add CM GCR_BEV_BASE accessors
  UPSTREAM: MIPS: CPC: Add start, stop and running CM3 CPC registers
  UPSTREAM: MIPS: pm-cps: Avoid offset overflow on MIPSr6
  UPSTREAM: MIPS: traps: Make sure secondary cores have a sane ebase register
  UPSTREAM: MIPS: Detect MIPSr6 Virtual Processor support
  UPSTREAM: Documentation: Add device tree binding for Goldfish FB driver
  UPSTREAM: MIPS: math-emu: Use preferred flavor of unsigned integer declarations
  UPSTREAM: MIPS: math-emu: <MADDF|MSUBF>.D: Fix accuracy (64-bit case)
  UPSTREAM: MIPS: math-emu: <MADDF|MSUBF>.S: Fix accuracy (32-bit case)
  UPSTREAM: MIPS: Update Goldfish RTC driver maintainer email address
  UPSTREAM: MIPS: Update RINT emulation maintainer email address
  UPSTREAM: MIPS: math-emu: do not use bools for arithmetic
  UPSTREAM: rtc: goldfish: Add RTC driver for Android emulator
  BACKPORT: dt-bindings: Add device tree binding for Goldfish RTC driver
  UPSTREAM: tty: goldfish: Implement support for kernel 'earlycon' parameter
  UPSTREAM: tty: goldfish: Use streaming DMA for r/w operations on Ranchu platforms
  UPSTREAM: tty: goldfish: Refactor constants to better reflect their nature
  UPSTREAM: MIPS: math-emu: Add FP emu debugfs stats for individual instructions
  UPSTREAM: MIPS: math-emu: Add FP emu debugfs clear functionality
  UPSTREAM: MIPS: math-emu: Add FP emu debugfs statistics for branches
  BACKPORT: MIPS: math-emu: CLASS.D: Zero bits 32-63 of the result
  BACKPORT: MIPS: math-emu: RINT.<D|S>: Fix several problems by reimplementation
  UPSTREAM: MIPS: math-emu: CMP.Sxxx.<D|S>: Prevent occurrences of SIGILL crashes
  UPSTREAM: MIPS: math-emu: <MADDF|MSUBF>.<D|S>: Clean up "maddf_flags" enumeration
  UPSTREAM: MIPS: math-emu: <MADDF|MSUBF>.<D|S>: Fix some cases of zero inputs
  UPSTREAM: MIPS: math-emu: <MADDF|MSUBF>.<D|S>: Fix some cases of infinite inputs
  UPSTREAM: MIPS: math-emu: <MADDF|MSUBF>.<D|S>: Fix NaN propagation
  UPSTREAM: tty: goldfish: Fix a parameter of a call to free_irq
  UPSTREAM: MIPS: VDSO: Fix clobber lists in fallback code paths
  UPSTREAM: MIPS: VDSO: Fix a mismatch between comment and preprocessor constant
  UPSTREAM: MIPS: VDSO: Add implementation of gettimeofday() fallback
  UPSTREAM: MIPS: VDSO: Add implementation of clock_gettime() fallback
  UPSTREAM: MIPS: VDSO: Fix conversions in do_monotonic()/do_monotonic_coarse()
  UPSTREAM: MIPS: unaligned: Add DSP lwx & lhx missaligned access support
  UPSTREAM: MIPS: build: Fix "-modd-spreg" switch usage when compiling for mips32r6
  UPSTREAM: MIPS: cmdline: Add support for 'memmap' parameter
  UPSTREAM: MIPS: math-emu: Handle zero accumulator case in MADDF and MSUBF separately
  UPSTREAM: MIPS: Support per-device DMA coherence
  UPSTREAM: MIPS: dma-default: Don't check hw_coherentio if device is non-coherent
  UPSTREAM: MIPS: Sanitise coherentio semantics
  UPSTREAM: MIPS: CPC: Provide default mips_cpc_default_phys_base to ignore CPC
  UPSTREAM: MIPS: generic: Introduce generic DT-based board support
  UPSTREAM: MIPS: Support generating Flattened Image Trees (.itb)
  UPSTREAM: MIPS: Allow emulation for unaligned [LS]DXC1 instructions
  UPSTREAM: MIPS: math-emu: Fix BC1EQZ and BC1NEZ condition handling
  UPSTREAM: MIPS: r2-on-r6-emu: Clear BLTZALL and BGEZALL debugfs counters
  UPSTREAM: MIPS: r2-on-r6-emu: Fix BLEZL and BGTZL identification
  UPSTREAM: MIPS: remove aliasing alignment if HW has antialising support
  BACKPORT: MIPS: store the appended dtb address in a variable
  UPSTREAM: MIPS: Fix FCSR Cause bit handling for correct SIGFPE issue
  UPSTREAM: MIPS: kernel: Audit and remove any unnecessary uses of module.h
  UPSTREAM: MIPS: c-r4k: Fix sigtramp SMP call to use kmap
  UPSTREAM: MIPS: c-r4k: Fix protected_writeback_scache_line for EVA
  UPSTREAM: MIPS: Spelling fix lets -> let's
  UPSTREAM: MIPS: R6: Fix typo
  UPSTREAM: MIPS: traps: Correct the SIGTRAP debug ABI in `do_watch' and `do_trap_or_bp'
  UPSTREAM: MIPS: inst.h: Rename cbcond{0,1}_op to pop{1,3}0_op
  UPSTREAM: MIPS: inst.h: Rename b{eq,ne}zcji[al]c_op to pop{6,7}6_op
  UPSTREAM: MIPS: math-emu: Fix m{add,sub}.s shifts
  UPSTREAM: MIPS: inst: Declare fsel_op for sel.fmt instruction
  UPSTREAM: MIPS: math-emu: Fix code indentation
  UPSTREAM: MIPS: math-emu: Fix bit-width in ieee754dp_{mul, maddf, msubf} comments
  UPSTREAM: MIPS: math-emu: Add z argument macros
  UPSTREAM: MIPS: math-emu: Unify ieee754dp_m{add,sub}f
  UPSTREAM: MIPS: math-emu: Unify ieee754sp_m{add,sub}f
  UPSTREAM: MIPS: math-emu: Emulate MIPSr6 sel.fmt instruction
  UPSTREAM: MIPS: math-emu: Fix BC1{EQ,NE}Z emulation
  UPSTREAM: MIPS: math-emu: Always propagate sNaN payload in quieting
  UPSTREAM: MIPS: Fix misspellings in comments.
  UPSTREAM: MIPS: math-emu: Add IEEE Std 754-2008 NaN encoding emulation
  UPSTREAM: MIPS: math-emu: Add IEEE Std 754-2008 ABS.fmt and NEG.fmt emulation
  UPSTREAM: MIPS: non-exec stack & heap when non-exec PT_GNU_STACK is present
  UPSTREAM: MIPS: Add IEEE Std 754 conformance mode selection
  UPSTREAM: MIPS: Determine the presence of IEEE Std 754-2008 features
  UPSTREAM: MIPS: Define the legacy-NaN and 2008-NaN features
  UPSTREAM: MIPS: ELF: Interpret the NAN2008 file header flag
  UPSTREAM: ELF: Also pass any interpreter's file header to `arch_check_elf'
  UPSTREAM: MIPS: Use a union to access the ELF file header
  UPSTREAM: MIPS: Fix delay slot emulation count in debugfs
  BACKPORT: exit_thread: accept a task parameter to be exited
  UPSTREAM: mn10300: let exit_fpu accept a task
  UPSTREAM: MIPS: Use per-mm page to execute branch delay slot instructions
  BACKPORT: s390: get rid of exit_thread()
  BACKPORT: exit_thread: remove empty bodies
  UPSTREAM: MIPS: Make flush_thread
  UPSTREAM: MIPS: Properly disable FPU in start_thread()
  UPSTREAM: MIPS: Select CONFIG_HANDLE_DOMAIN_IRQ and make it work.
  UPSTREAM: MIPS: math-emu: Fix typo
  UPSTREAM: MIPS: math-emu: dsemul: Remove an unused bit in ADDIUPC emulation
  UPSTREAM: MIPS: math-emu: dsemul: Reduce `get_isa16_mode' clutter
  UPSTREAM: MIPS: math-emu: dsemul: Correct description of the emulation frame
  UPSTREAM: MIPS: math-emu: Correct the emulation of microMIPS ADDIUPC instruction
  UPSTREAM: MIPS: math-emu: Make microMIPS branch delay slot emulation work
  UPSTREAM: MIPS: math-emu: dsemul: Fix ill formatting of microMIPS part
  UPSTREAM: MIPS: math-emu: Correctly handle NOP emulation

Conflicts:
	drivers/irqchip/Kconfig
	drivers/irqchip/Makefile
	drivers/media/v4l2-core/v4l2-compat-ioctl32.c

Change-Id: I98374358ab24ce80dba3afa2f4562c71f45b7aab
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
2018-03-01 17:18:47 +05:30
Arnd Bergmann
30ddc36cb7 v4l: remove MEDIA_TUNER dependency for VIDEO_TUNER
commit 7c8fe516bd81d991feb73ccd969ec29850af3013 upstream.

em28xx selects VIDEO_TUNER, which has a dependency on MEDIA_TUNER,
so we get a Kconfig warning if that is disabled:

warning: (VIDEO_PVRUSB2 && VIDEO_USBVISION && VIDEO_GO7007 && VIDEO_AU0828_V4L2 && VIDEO_CX231XX && VIDEO_TM6000 && VIDEO_EM28XX && VIDEO_IVTV && VIDEO_MXB && VIDEO_CX18 && VIDEO_CX23885 && VIDEO_CX88 && VIDEO_BT848 && VIDEO_SAA7134 && VIDEO_SAA7164) selects VIDEO_TUNER which has unmet direct dependencies (MEDIA_SUPPORT && MEDIA_TUNER)

VIDEO_TUNER does not actually depend on MEDIA_TUNER, and the
dependency does nothing except cause the above warning, so let's
remove it.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-25 11:03:50 +01:00
Daniel Mentz
e87f959666 media: v4l2-compat-ioctl32.c: refactor compat ioctl32 logic
commit a1dfb4c48cc1e64eeb7800a27c66a6f7e88d075a upstream.

The 32-bit compat v4l2 ioctl handling is implemented based on its 64-bit
equivalent. It converts 32-bit data structures into its 64-bit
equivalents and needs to provide the data to the 64-bit ioctl in user
space memory which is commonly allocated using
compat_alloc_user_space().

However, due to how that function is implemented, it can only be called
a single time for every syscall invocation.

Supposedly to avoid this limitation, the existing code uses a mix of
memory from the kernel stack and memory allocated through
compat_alloc_user_space().

Under normal circumstances, this would not work, because the 64-bit
ioctl expects all pointers to point to user space memory. As a
workaround, set_fs(KERNEL_DS) is called to temporarily disable this
extra safety check and allow kernel pointers. However, this might
introduce a security vulnerability: The result of the 32-bit to 64-bit
conversion is writeable by user space because the output buffer has been
allocated via compat_alloc_user_space(). A malicious user space process
could then manipulate pointers inside this output buffer, and due to the
previous set_fs(KERNEL_DS) call, functions like get_user() or put_user()
no longer prevent kernel memory access.

The new approach is to pre-calculate the total amount of user space
memory that is needed, allocate it using compat_alloc_user_space() and
then divide up the allocated memory to accommodate all data structures
that need to be converted.

An alternative approach would have been to retain the union type karg
that they allocated on the kernel stack in do_video_ioctl(), copy all
data from user space into karg and then back to user space. However, we
decided against this approach because it does not align with other
compat syscall implementations. Instead, we tried to replicate the
get_user/put_user pairs as found in other places in the kernel:

    if (get_user(clipcount, &up->clipcount) ||
        put_user(clipcount, &kp->clipcount)) return -EFAULT;

Notes from hans.verkuil@cisco.com:

This patch was taken from:
    97b733953c

Clearly nobody could be bothered to upstream this patch or at minimum
tell us :-( We only heard about this a week ago.

This patch was rebased and cleaned up. Compared to the original I
also swapped the order of the convert_in_user arguments so that they
matched copy_in_user. It was hard to review otherwise. I also replaced
the ALLOC_USER_SPACE/ALLOC_AND_GET by a normal function.

Fixes: 6b5a9492ca ("v4l: introduce string control support.")

Signed-off-by: Daniel Mentz <danielmentz@google.com>
Co-developed-by: Hans Verkuil <hans.verkuil@cisco.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-16 20:09:45 +01:00
Hans Verkuil
af41ce9e13 media: v4l2-compat-ioctl32.c: don't copy back the result for certain errors
commit d83a8243aaefe62ace433e4384a4f077bed86acb upstream.

Some ioctls need to copy back the result even if the ioctl returned
an error. However, don't do this for the error code -ENOTTY.
It makes no sense in that cases.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-16 20:09:44 +01:00
Hans Verkuil
edbc67ef65 media: v4l2-compat-ioctl32.c: drop pr_info for unknown buffer type
commit 169f24ca68bf0f247d111aef07af00dd3a02ae88 upstream.

There is nothing wrong with using an unknown buffer type. So
stop spamming the kernel log whenever this happens. The kernel
will just return -EINVAL to signal this.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-16 20:09:44 +01:00
Hans Verkuil
4c8ba4d5ad media: v4l2-compat-ioctl32.c: copy clip list in put_v4l2_window32
commit a751be5b142ef6bcbbb96d9899516f4d9c8d0ef4 upstream.

put_v4l2_window32() didn't copy back the clip list to userspace.
Drivers can update the clip rectangles, so this should be done.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-16 20:09:44 +01:00
Daniel Mentz
8b775336cc media: v4l2-compat-ioctl32: Copy v4l2_window->global_alpha
commit 025a26fa14f8fd55d50ab284a30c016a5be953d0 upstream.

Commit b2787845fb ("V4L/DVB (5289): Add support for video output
overlays.") added the field global_alpha to struct v4l2_window but did
not update the compat layer accordingly. This change adds global_alpha
to struct v4l2_window32 and copies the value for global_alpha back and
forth.

Signed-off-by: Daniel Mentz <danielmentz@google.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-16 20:09:44 +01:00
Hans Verkuil
8fbc22b343 media: v4l2-compat-ioctl32.c: make ctrl_is_pointer work for subdevs
commit 273caa260035c03d89ad63d72d8cd3d9e5c5e3f1 upstream.

If the device is of type VFL_TYPE_SUBDEV then vdev->ioctl_ops
is NULL so the 'if (!ops->vidioc_query_ext_ctrl)' check would crash.
Add a test for !ops to the condition.

All sub-devices that have controls will use the control framework,
so they do not have an equivalent to ops->vidioc_query_ext_ctrl.
Returning false if ops is NULL is the correct thing to do here.

Fixes: b8c601e8af ("v4l2-compat-ioctl32.c: fix ctrl_is_pointer")

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reported-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-16 20:09:44 +01:00
Hans Verkuil
d64d203f20 media: v4l2-compat-ioctl32.c: fix ctrl_is_pointer
commit b8c601e8af2d08f733d74defa8465303391bb930 upstream.

ctrl_is_pointer just hardcoded two known string controls, but that
caused problems when using e.g. custom controls that use a pointer
for the payload.

Reimplement this function: it now finds the v4l2_ctrl (if the driver
uses the control framework) or it calls vidioc_query_ext_ctrl (if the
driver implements that directly).

In both cases it can now check if the control is a pointer control
or not.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-16 20:09:44 +01:00
Hans Verkuil
c6cbc2c353 media: v4l2-compat-ioctl32.c: copy m.userptr in put_v4l2_plane32
commit 8ed5a59dcb47a6f76034ee760b36e089f3e82529 upstream.

The struct v4l2_plane32 should set m.userptr as well. The same
happens in v4l2_buffer32 and v4l2-compliance tests for this.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-16 20:09:44 +01:00
Hans Verkuil
57f0817a6d media: v4l2-compat-ioctl32.c: avoid sizeof(type)
commit 333b1e9f96ce05f7498b581509bb30cde03018bf upstream.

Instead of doing sizeof(struct foo) use sizeof(*up). There even were
cases where 4 * sizeof(__u32) was used instead of sizeof(kp->reserved),
which is very dangerous when the size of the reserved array changes.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-16 20:09:44 +01:00
Hans Verkuil
56a4fbdf50 media: v4l2-compat-ioctl32.c: move 'helper' functions to __get/put_v4l2_format32
commit 486c521510c44a04cd756a9267e7d1e271c8a4ba upstream.

These helper functions do not really help. Move the code to the
__get/put_v4l2_format32 functions.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-16 20:09:43 +01:00
Hans Verkuil
04d632236a media: v4l2-compat-ioctl32.c: fix the indentation
commit b7b957d429f601d6d1942122b339474f31191d75 upstream.

The indentation of this source is all over the place. Fix this.
This patch only changes whitespace.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-16 20:09:43 +01:00
Hans Verkuil
4a85bbbcb5 media: v4l2-compat-ioctl32.c: add missing VIDIOC_PREPARE_BUF
commit 3ee6d040719ae09110e5cdf24d5386abe5d1b776 upstream.

The result of the VIDIOC_PREPARE_BUF ioctl was never copied back
to userspace since it was missing in the switch.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-16 20:09:43 +01:00
Ricardo Ribalda
587a6b8324 vb2: V4L2_BUF_FLAG_DONE is set after DQBUF
commit 3171cc2b4eb9831ab4df1d80d0410a945b8bc84e upstream.

According to the doc, V4L2_BUF_FLAG_DONE is cleared after DQBUF:

V4L2_BUF_FLAG_DONE 0x00000004  ... After calling the VIDIOC_QBUF or
VIDIOC_DQBUF it is always cleared ...

Unfortunately, it seems that videobuf2 keeps it set after DQBUF. This
can be tested with vivid and dev_debug:

[257604.338082] video1: VIDIOC_DQBUF: 71:33:25.00260479 index=3,
type=vid-cap, flags=0x00002004, field=none, sequence=163,
memory=userptr, bytesused=460800, offset/userptr=0x344b000,
length=460800

This patch forces FLAG_DONE to 0 after calling DQBUF.

Reported-by: Dimitrios Katsaros <patcherwork@gmail.com>
Signed-off-by: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-16 20:09:43 +01:00
Hans Verkuil
15e3780a8a media: v4l2-ioctl.c: don't copy back the result for -ENOTTY
commit 181a4a2d5a0a7b43cab08a70710d727e7764ccdd upstream.

If the ioctl returned -ENOTTY, then don't bother copying
back the result as there is no point.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-16 20:09:43 +01:00
Srinivasarao P
b0e2559a3e Merge android-4.4.103 (9fbf3d7) into msm-4.4
* refs/heads/tmp-9fbf3d7
  Linux 4.4.103
  Revert "sctp: do not peel off an assoc from one netns to another one"
  xen: xenbus driver must not accept invalid transaction ids
  s390/kbuild: enable modversions for symbols exported from asm
  ASoC: wm_adsp: Don't overrun firmware file buffer when reading region data
  btrfs: return the actual error value from from btrfs_uuid_tree_iterate
  ASoC: rsnd: don't double free kctrl
  netfilter: nf_tables: fix oob access
  netfilter: nft_queue: use raw_smp_processor_id()
  spi: SPI_FSL_DSPI should depend on HAS_DMA
  staging: iio: cdc: fix improper return value
  iio: light: fix improper return value
  mac80211: Suppress NEW_PEER_CANDIDATE event if no room
  mac80211: Remove invalid flag operations in mesh TSF synchronization
  drm: Apply range restriction after color adjustment when allocation
  ALSA: hda - Apply ALC269_FIXUP_NO_SHUTUP on HDA_FIXUP_ACT_PROBE
  ath10k: set CTS protection VDEV param only if VDEV is up
  ath10k: fix potential memory leak in ath10k_wmi_tlv_op_pull_fw_stats()
  ath10k: ignore configuring the incorrect board_id
  ath10k: fix incorrect txpower set by P2P_DEVICE interface
  drm/armada: Fix compile fail
  net: 3com: typhoon: typhoon_init_one: fix incorrect return values
  net: 3com: typhoon: typhoon_init_one: make return values more specific
  net: Allow IP_MULTICAST_IF to set index to L3 slave
  dmaengine: zx: set DMA_CYCLIC cap_mask bit
  PCI: Apply _HPX settings only to relevant devices
  RDS: RDMA: return appropriate error on rdma map failures
  e1000e: Separate signaling for link check/link up
  e1000e: Fix return value test
  e1000e: Fix error path in link detection
  PM / OPP: Add missing of_node_put(np)
  net/9p: Switch to wait_event_killable()
  fscrypt: lock mutex before checking for bounce page pool
  sched/rt: Simplify the IPI based RT balancing logic
  media: v4l2-ctrl: Fix flags field on Control events
  cx231xx-cards: fix NULL-deref on missing association descriptor
  media: rc: check for integer overflow
  media: Don't do DMA on stack for firmware upload in the AS102 driver
  powerpc/signal: Properly handle return value from uprobe_deny_signal()
  parisc: Fix validity check of pointer size argument in new CAS implementation
  ixgbe: Fix skb list corruption on Power systems
  fm10k: Use smp_rmb rather than read_barrier_depends
  i40evf: Use smp_rmb rather than read_barrier_depends
  ixgbevf: Use smp_rmb rather than read_barrier_depends
  igbvf: Use smp_rmb rather than read_barrier_depends
  igb: Use smp_rmb rather than read_barrier_depends
  i40e: Use smp_rmb rather than read_barrier_depends
  NFC: fix device-allocation error return
  IB/srp: Avoid that a cable pull can trigger a kernel crash
  IB/srpt: Do not accept invalid initiator port names
  libnvdimm, namespace: make 'resource' attribute only readable by root
  libnvdimm, namespace: fix label initialization to use valid seq numbers
  clk: ti: dra7-atl-clock: fix child-node lookups
  clk: ti: dra7-atl-clock: Fix of_node reference counting
  SUNRPC: Fix tracepoint storage issues with svc_recv and svc_rqst_status
  KVM: SVM: obey guest PAT
  KVM: nVMX: set IDTR and GDTR limits when loading L1 host state
  target: Fix QUEUE_FULL + SCSI task attribute handling
  iscsi-target: Fix non-immediate TMR reference leak
  fs/9p: Compare qid.path in v9fs_test_inode
  fix a page leak in vhost_scsi_iov_to_sgl() error recovery
  ALSA: hda/realtek - Fix ALC700 family no sound issue
  ALSA: timer: Remove kernel warning at compat ioctl error paths
  ALSA: usb-audio: Add sanity checks in v2 clock parsers
  ALSA: usb-audio: Fix potential out-of-bound access at parsing SU
  ALSA: usb-audio: Add sanity checks to FE parser
  ALSA: pcm: update tstamp only if audio_tstamp changed
  ext4: fix interaction between i_size, fallocate, and delalloc after a crash
  ata: fixes kernel crash while tracing ata_eh_link_autopsy event
  rtlwifi: fix uninitialized rtlhal->last_suspend_sec time
  rtlwifi: rtl8192ee: Fix memory leak when loading firmware
  nfsd: deal with revoked delegations appropriately
  nfs: Fix ugly referral attributes
  NFS: Fix typo in nomigration mount option
  isofs: fix timestamps beyond 2027
  bcache: check ca->alloc_thread initialized before wake up it
  eCryptfs: use after free in ecryptfs_release_messaging()
  nilfs2: fix race condition that causes file system corruption
  autofs: don't fail mount for transient error
  MIPS: BCM47XX: Fix LED inversion for WRT54GSv1
  MIPS: Fix an n32 core file generation regset support regression
  dm: fix race between dm_get_from_kobject() and __dm_destroy()
  dm bufio: fix integer overflow when limiting maximum cache size
  ALSA: hda: Add Raven PCI ID
  MIPS: ralink: Fix typo in mt7628 pinmux function
  MIPS: ralink: Fix MT7628 pinmux
  ARM: 8721/1: mm: dump: check hardware RO bit for LPAE
  ARM: 8722/1: mm: make STRICT_KERNEL_RWX effective for LPAE
  x86/decoder: Add new TEST instruction pattern
  lib/mpi: call cond_resched() from mpi_powm() loop
  sched: Make resched_cpu() unconditional
  vsock: use new wait API for vsock_stream_sendmsg()
  AF_VSOCK: Shrink the area influenced by prepare_to_wait
  ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER
  s390/disassembler: increase show_code buffer size
  s390/disassembler: add missing end marker for e7 table
  s390/runtime instrumention: fix possible memory corruption
  s390: fix transactional execution control register handling
  BACKPORT: time: Clean up CLOCK_MONOTONIC_RAW time handling
  BACKPORT: time: Fix CLOCK_MONOTONIC_RAW sub-nanosecond accounting
  UPSTREAM: arm64: vdso: fix clock_getres for 4GiB-aligned res
  f2fs: updates on 4.15-rc1
  UPSTREAM: android: binder: fix type mismatch warning
  Linux 4.4.102
  mm, hwpoison: fixup "mm: check the return value of lookup_page_ext for all call sites"

Conflicts:
	fs/ext4/crypto_key.c
	mm/debug-pagealloc.c

Change-Id: Ibe35d78bd0397f3ff2049e0a1dda20fcb06f2f75
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
2018-01-02 18:15:22 +05:30
Ricardo Ribalda Delgado
5a11b8458b media: v4l2-ctrl: Fix flags field on Control events
commit 9cac9d2fb2fe0e0cadacdb94415b3fe49e3f724f upstream.

VIDIOC_DQEVENT and VIDIOC_QUERY_EXT_CTRL should give the same output for
the control flags field.

This patch creates a new function user_flags(), that calculates the user
exported flags value (which is different than the kernel internal flags
structure). This function is then used by all the code that exports the
internal flags to userspace.

Reported-by: Dimitrios Katsaros <patcherwork@gmail.com>
Signed-off-by: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-11-30 08:37:25 +00:00
Linux Build Service Account
f2b5c20a20 Merge "Merge android-4.4@d68ba9f (v4.4.89) into msm-4.4" 2017-10-17 05:38:14 -07:00
Blagovest Kolenichev
fda1654df8 Merge android-4.4@d68ba9f (v4.4.89) into msm-4.4
* refs/heads/tmp-d68ba9f
  Linux 4.4.89
  ftrace: Fix memleak when unregistering dynamic ops when tracing disabled
  bcache: fix bch_hprint crash and improve output
  bcache: fix for gc and write-back race
  bcache: Correct return value for sysfs attach errors
  bcache: correct cache_dirty_target in __update_writeback_rate()
  bcache: do not subtract sectors_to_gc for bypassed IO
  bcache: Fix leak of bdev reference
  bcache: initialize dirty stripes in flash_dev_run()
  media: uvcvideo: Prevent heap overflow when accessing mapped controls
  media: v4l2-compat-ioctl32: Fix timespec conversion
  PCI: shpchp: Enable bridge bus mastering if MSI is enabled
  ARC: Re-enable MMU upon Machine Check exception
  tracing: Apply trace_clock changes to instance max buffer
  ftrace: Fix selftest goto location on error
  scsi: qla2xxx: Fix an integer overflow in sysfs code
  scsi: sg: fixup infoleak when using SG_GET_REQUEST_TABLE
  scsi: sg: factor out sg_fill_request_table()
  scsi: sg: off by one in sg_ioctl()
  scsi: sg: use standard lists for sg_requests
  scsi: sg: remove 'save_scat_len'
  scsi: storvsc: fix memory leak on ring buffer busy
  scsi: megaraid_sas: Return pended IOCTLs with cmd_status MFI_STAT_WRONG_STATE in case adapter is dead
  scsi: megaraid_sas: Check valid aen class range to avoid kernel panic
  scsi: zfcp: trace high part of "new" 64 bit SCSI LUN
  scsi: zfcp: trace HBA FSF response by default on dismiss or timedout late response
  scsi: zfcp: fix payload with full FCP_RSP IU in SCSI trace records
  scsi: zfcp: fix missing trace records for early returns in TMF eh handlers
  scsi: zfcp: fix passing fsf_req to SCSI trace on TMF to correlate with HBA
  scsi: zfcp: fix capping of unsuccessful GPN_FT SAN response trace records
  scsi: zfcp: add handling for FCP_RESID_OVER to the fcp ingress path
  scsi: zfcp: fix queuecommand for scsi_eh commands when DIX enabled
  skd: Submit requests to firmware before triggering the doorbell
  skd: Avoid that module unloading triggers a use-after-free
  md/bitmap: disable bitmap_resize for file-backed bitmaps.
  block: Relax a check in blk_start_queue()
  powerpc: Fix DAR reporting when alignment handler faults
  ext4: fix quota inconsistency during orphan cleanup for read-only mounts
  ext4: fix incorrect quotaoff if the quota feature is enabled
  crypto: AF_ALG - remove SGL terminator indicator when chaining
  MIPS: math-emu: MINA.<D|S>: Fix some cases of infinity and zero inputs
  MIPS: math-emu: <MAXA|MINA>.<D|S>: Fix cases of both infinite inputs
  MIPS: math-emu: <MAXA|MINA>.<D|S>: Fix cases of input values with opposite signs
  MIPS: math-emu: <MAX|MIN>.<D|S>: Fix cases of both inputs negative
  MIPS: math-emu: <MAX|MAXA|MIN|MINA>.<D|S>: Fix cases of both inputs zero
  MIPS: math-emu: <MAX|MAXA|MIN|MINA>.<D|S>: Fix quiet NaN propagation
  Input: i8042 - add Gigabyte P57 to the keyboard reset table
  tty: fix __tty_insert_flip_char regression
  tty: improve tty_insert_flip_char() slow path
  tty: improve tty_insert_flip_char() fast path
  mm: prevent double decrease of nr_reserved_highatomic
  nfsd: Fix general protection fault in release_lock_stateid()
  md/raid5: release/flush io in raid5_do_work()
  x86/fsgsbase/64: Report FSBASE and GSBASE correctly in core dumps
  f2fs: check hot_data for roll-forward recovery
  ipv6: fix typo in fib6_net_exit()
  ipv6: fix memory leak with multiple tables during netns destruction
  gianfar: Fix Tx flow control deactivation
  Revert "net: fix percpu memory leaks"
  Revert "net: use lib/percpu_counter API for fragmentation mem accounting"
  tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0
  Revert "net: phy: Correctly process PHY_HALTED in phy_stop_machine()"
  qlge: avoid memcpy buffer overflow
  ipv6: fix sparse warning on rt6i_node
  ipv6: add rcu grace period before freeing fib6_node
  ipv6: accept 64k - 1 packet length in ip6_find_1stfragopt()
  f2fs: fix a missing size change in f2fs_setattr
  f2fs: fix to access nullified flush_cmd_control pointer
  f2fs: free meta pages if sanity check for ckpt is failed
  f2fs: detect wrong layout
  f2fs: call sync_fs when f2fs is idle
  Revert "f2fs: use percpu_counter for # of dirty pages in inode"
  f2fs: return AOP_WRITEPAGE_ACTIVATE for writepage
  f2fs: do not activate auto_recovery for fallocated i_size
  f2fs: fix 32-bit build
  f2fs: fix incorrect free inode count in ->statfs
  f2fs: drop duplicate header timer.h
  f2fs: fix wrong AUTO_RECOVER condition
  f2fs: do not recover i_size if it's valid
  f2fs: fix fdatasync
  f2fs: fix to account total free nid correctly
  f2fs: fix an infinite loop when flush nodes in cp
  f2fs: don't wait writeback for datas during checkpoint
  f2fs: fix wrong written_valid_blocks counting
  f2fs: avoid BG_GC in f2fs_balance_fs
  f2fs: fix redundant block allocation
  f2fs: use err for f2fs_preallocate_blocks
  f2fs: support multiple devices
  f2fs: allow dio read for LFS mode
  f2fs: revert segment allocation for direct IO
  f2fs: return directly if block has been removed from the victim
  Revert "f2fs: do not recover from previous remained wrong dnodes"
  f2fs: remove checkpoint in f2fs_freeze
  f2fs: assign segments correctly for direct_io
  f2fs: fix wrong i_atime recovery
  f2fs: record inode updating status correctly
  f2fs: Trace reset zone events
  f2fs: Reset sequential zones on zoned block devices
  f2fs: Cache zoned block devices zone type
  f2fs: Do not allow adaptive mode for host-managed zoned block devices
  f2fs: Always enable discard for zoned blocks devices
  f2fs: Suppress discard warning message for zoned block devices
  f2fs: Check zoned block feature for host-managed zoned block devices
  f2fs: Use generic zoned block device terminology
  f2fs: Add missing break in switch-case
  f2fs: avoid infinite loop in the EIO case on recover_orphan_inodes
  f2fs: report error of f2fs_fill_dentries
  fs/crypto: catch up 4.9-rc6
  f2fs: hide a maybe-uninitialized warning
  f2fs: remove percpu_count due to performance regression
  f2fs: make clean inodes when flushing inode page
  f2fs: keep dirty inodes selectively for checkpoint
  f2fs: Replace CURRENT_TIME_SEC with current_time() for inode timestamps
  f2fs: use BIO_MAX_PAGES for bio allocation
  f2fs: declare static function for __build_free_nids
  f2fs: call f2fs_balance_fs for setattr
  f2fs: count dirty inodes to flush node pages during checkpoint
  f2fs: avoid casted negative value as shrink count
  f2fs: don't interrupt free nids building during nid allocation
  f2fs: clean up free nid list operations
  f2fs: split free nid list
  f2fs: clear nlink if fail to add_link
  f2fs: fix sparse warnings
  f2fs: fix error handling in fsync_node_pages
  f2fs: fix to update largest extent under lock
  f2fs: be aware of extent beyond EOF in fiemap
  f2fs: don't miss any f2fs_balance_fs cases
  f2fs: add missing f2fs_balance_fs in f2fs_zero_range
  f2fs: give a chance to detach from dirty list
  f2fs: fix to release discard entries during checkpoint
  f2fs: exclude free nids building and allocation
  f2fs: fix to determine start_cp_addr by sbi->cur_cp_pack
  f2fs: fix overflow due to condition check order
  posix_acl: Clear SGID bit when setting file permissions
  f2fs: fix wrong sum_page pointer in f2fs_gc
  f2fs: backport from (4c1fad64 - Merge tag 'for-f2fs-4.9' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs)
  Revert "ANDROID: sched/tune: Initialize raw_spin_lock in boosted_groups"
  BACKPORT: partial: mm, oom_reaper: do not mmput synchronously from the oom reaper context
  FROMLIST: android: binder: Don't get mm from task
  FROMLIST: android: binder: Remove unused vma argument
  FROMLIST: android: binder: Drop lru lock in isolate callback
  ANDROID: configs: remove config fragments
  drivers: cpufreq_interactive: handle error for module load fail
  UPSTREAM: Fix build break in fork.c when THREAD_SIZE < PAGE_SIZE

Conflicts:
	android/configs/android-base.cfg
	android/configs/android-recommended.cfg
	fs/f2fs/data.c
	fs/f2fs/f2fs.h
	fs/f2fs/super.c
	include/linux/mm_types.h
	include/linux/sched.h
	kernel/fork.c

Change-Id: I21a427f17e8a1892a212df7c8707f74fb37ce400
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
2017-09-29 14:49:19 -07:00
Daniel Mentz
04affe4e11 media: v4l2-compat-ioctl32: Fix timespec conversion
commit 9c7ba1d7634cef490b85bc64c4091ff004821bfd upstream.

Certain syscalls like recvmmsg support 64 bit timespec values for the
X32 ABI. The helper function compat_put_timespec converts a timespec
value to a 32 bit or 64 bit value depending on what ABI is used. The
v4l2 compat layer, however, is not designed to support 64 bit timespec
values and always uses 32 bit values. Hence, compat_put_timespec must
not be used.

Without this patch, user space will be provided with bad timestamp
values from the VIDIOC_DQEVENT ioctl. Also, fields of the struct
v4l2_event32 that come immediately after timestamp get overwritten,
namely the field named id.

Fixes: 81993e81a9 ("compat: Get rid of (get|put)_compat_time(val|spec)")
Cc: H. Peter Anvin <hpa@linux.intel.com>
Cc: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Cc: Tiffany Lin <tiffany.lin@mediatek.com>
Cc: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com>
Cc: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Daniel Mentz <danielmentz@google.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-09-27 11:00:16 +02:00
Surajit Podder
a0a1d6f10f media: v4l2-compat-ioctl32: memset stack union in compat ioctl
memset karg in do_video_ioctl to ensure that stack memory is
not copied to user memory.

Change-Id: Ib892f8cabff1e0076c670496ee6353d00afdf85e
Signed-off-by: Surajit Podder <spodder@codeaurora.org>
2017-09-18 04:12:56 -07:00
Blagovest Kolenichev
0fc26d9423 Merge branch 'android-4.4@77ddb50' (v4.4.74) into 'msm-4.4'
* refs/heads/tmp-77ddb50:
  UPSTREAM: usb: gadget: f_fs: avoid out of bounds access on comp_desc
  Linux 4.4.74
  mm: fix new crash in unmapped_area_topdown()
  Allow stack to grow up to address space limit
  mm: larger stack guard gap, between vmas
  alarmtimer: Rate limit periodic intervals
  MIPS: Fix bnezc/jialc return address calculation
  usb: dwc3: exynos fix axius clock error path to do cleanup
  alarmtimer: Prevent overflow of relative timers
  genirq: Release resources in __setup_irq() error path
  swap: cond_resched in swap_cgroup_prepare()
  mm/memory-failure.c: use compound_head() flags for huge pages
  USB: gadgetfs, dummy-hcd, net2280: fix locking for callbacks
  usb: xhci: ASMedia ASM1042A chipset need shorts TX quirk
  drivers/misc/c2port/c2port-duramar2150.c: checking for NULL instead of IS_ERR()
  usb: r8a66597-hcd: decrease timeout
  usb: r8a66597-hcd: select a different endpoint on timeout
  USB: gadget: dummy_hcd: fix hub-descriptor removable fields
  pvrusb2: reduce stack usage pvr2_eeprom_analyze()
  usb: core: fix potential memory leak in error path during hcd creation
  USB: hub: fix SS max number of ports
  iio: proximity: as3935: recalibrate RCO after resume
  staging: rtl8188eu: prevent an underflow in rtw_check_beacon_data()
  mfd: omap-usb-tll: Fix inverted bit use for USB TLL mode
  x86/mm/32: Set the '__vmalloc_start_set' flag in initmem_init()
  serial: efm32: Fix parity management in 'efm32_uart_console_get_options()'
  mac80211: fix IBSS presp allocation size
  mac80211: fix CSA in IBSS mode
  mac80211/wpa: use constant time memory comparison for MACs
  mac80211: don't look at the PM bit of BAR frames
  vb2: Fix an off by one error in 'vb2_plane_vaddr'
  cpufreq: conservative: Allow down_threshold to take values from 1 to 10
  can: gs_usb: fix memory leak in gs_cmd_reset()
  configfs: Fix race between create_link and configfs_rmdir
  UPSTREAM: bpf: don't let ldimm64 leak map addresses on unprivileged
  BACKPORT: ext4: fix data exposure after a crash
  ANDROID: sdcardfs: remove dead function open_flags_to_access_mode()
  ANDROID: android-base.cfg: split out arm64-specific configs
  Linux 4.4.73
  sparc64: make string buffers large enough
  s390/kvm: do not rely on the ILC on kvm host protection fauls
  xtensa: don't use linux IRQ #0
  tipc: ignore requests when the connection state is not CONNECTED
  proc: add a schedule point in proc_pid_readdir()
  romfs: use different way to generate fsid for BLOCK or MTD
  sctp: sctp_addr_id2transport should verify the addr before looking up assoc
  r8152: avoid start_xmit to schedule napi when napi is disabled
  r8152: fix rtl8152_post_reset function
  r8152: re-schedule napi for tx
  nfs: Fix "Don't increment lock sequence ID after NFS4ERR_MOVED"
  ravb: unmap descriptors when freeing rings
  drm/ast: Fixed system hanged if disable P2A
  drm/nouveau: Don't enabling polling twice on runtime resume
  parisc, parport_gsc: Fixes for printk continuation lines
  net: adaptec: starfire: add checks for dma mapping errors
  pinctrl: berlin-bg4ct: fix the value for "sd1a" of pin SCRD0_CRD_PRES
  gianfar: synchronize DMA API usage by free_skb_rx_queue w/ gfar_new_page
  net/mlx4_core: Avoid command timeouts during VF driver device shutdown
  drm/nouveau/fence/g84-: protect against concurrent access to semaphore buffers
  drm/nouveau: prevent userspace from deleting client object
  ipv6: fix flow labels when the traffic class is non-0
  FS-Cache: Initialise stores_lock in netfs cookie
  fscache: Clear outstanding writes when disabling a cookie
  fscache: Fix dead object requeue
  ethtool: do not vzalloc(0) on registers dump
  log2: make order_base_2() behave correctly on const input value zero
  kasan: respect /proc/sys/kernel/traceoff_on_warning
  jump label: pass kbuild_cflags when checking for asm goto support
  PM / runtime: Avoid false-positive warnings from might_sleep_if()
  ipv6: Fix IPv6 packet loss in scenarios involving roaming + snooping switches
  i2c: piix4: Fix request_region size
  sierra_net: Add support for IPv6 and Dual-Stack Link Sense Indications
  sierra_net: Skip validating irrelevant fields for IDLE LSIs
  net: hns: Fix the device being used for dma mapping during TX
  NET: mkiss: Fix panic
  NET: Fix /proc/net/arp for AX.25
  ipv6: Inhibit IPv4-mapped src address on the wire.
  ipv6: Handle IPv4-mapped src to in6addr_any dst.
  net: xilinx_emaclite: fix receive buffer overflow
  net: xilinx_emaclite: fix freezes due to unordered I/O
  Call echo service immediately after socket reconnect
  staging: rtl8192e: rtl92e_fill_tx_desc fix write to mapped out memory.
  ARM: dts: imx6dl: Fix the VDD_ARM_CAP voltage for 396MHz operation
  partitions/msdos: FreeBSD UFS2 file systems are not recognized
  s390/vmem: fix identity mapping
  usb: gadget: f_fs: Fix possibe deadlock

Conflicts:
	drivers/usb/gadget/function/f_fs.c

Change-Id: I23106e9fc2c4f2d0b06acce59b781f6c36487fcc
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
2017-06-28 10:03:23 -07:00
Christophe JAILLET
a8686c968f vb2: Fix an off by one error in 'vb2_plane_vaddr'
commit 5ebb6dd36c9f5fb37b1077b393c254d70a14cb46 upstream.

We should ensure that 'plane_no' is '< vb->num_planes' as done in
'vb2_plane_cookie' just a few lines below.

Fixes: e23ccc0ad9 ("[media] v4l: add videobuf2 Video for Linux 2 driver framework")

Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-06-26 07:13:08 +02:00
Runmin Wang
efbe378b81 Merge branch 'v4.4-16.09-android-tmp' into lsk-v4.4-16.09-android
* v4.4-16.09-android-tmp:
  unsafe_[get|put]_user: change interface to use a error target label
  usercopy: remove page-spanning test for now
  usercopy: fix overlap check for kernel text
  mm/slub: support left redzone
  Linux 4.4.21
  lib/mpi: mpi_write_sgl(): fix skipping of leading zero limbs
  regulator: anatop: allow regulator to be in bypass mode
  hwrng: exynos - Disable runtime PM on probe failure
  cpufreq: Fix GOV_LIMITS handling for the userspace governor
  metag: Fix atomic_*_return inline asm constraints
  scsi: fix upper bounds check of sense key in scsi_sense_key_string()
  ALSA: timer: fix NULL pointer dereference on memory allocation failure
  ALSA: timer: fix division by zero after SNDRV_TIMER_IOCTL_CONTINUE
  ALSA: timer: fix NULL pointer dereference in read()/ioctl() race
  ALSA: hda - Enable subwoofer on Dell Inspiron 7559
  ALSA: hda - Add headset mic quirk for Dell Inspiron 5468
  ALSA: rawmidi: Fix possible deadlock with virmidi registration
  ALSA: fireworks: accessing to user space outside spinlock
  ALSA: firewire-tascam: accessing to user space outside spinlock
  ALSA: usb-audio: Add sample rate inquiry quirk for B850V3 CP2114
  crypto: caam - fix IV loading for authenc (giv)decryption
  uprobes: Fix the memcg accounting
  x86/apic: Do not init irq remapping if ioapic is disabled
  vhost/scsi: fix reuse of &vq->iov[out] in response
  bcache: RESERVE_PRIO is too small by one when prio_buckets() is a power of two.
  ubifs: Fix assertion in layout_in_gaps()
  ovl: fix workdir creation
  ovl: listxattr: use strnlen()
  ovl: remove posix_acl_default from workdir
  ovl: don't copy up opaqueness
  wrappers for ->i_mutex access
  lustre: remove unused declaration
  timekeeping: Avoid taking lock in NMI path with CONFIG_DEBUG_TIMEKEEPING
  timekeeping: Cap array access in timekeeping_debug
  xfs: fix superblock inprogress check
  ASoC: atmel_ssc_dai: Don't unconditionally reset SSC on stream startup
  drm/msm: fix use of copy_from_user() while holding spinlock
  drm: Reject page_flip for !DRIVER_MODESET
  drm/radeon: fix radeon_move_blit on 32bit systems
  s390/sclp_ctl: fix potential information leak with /dev/sclp
  rds: fix an infoleak in rds_inc_info_copy
  powerpc/tm: Avoid SLB faults in treclaim/trecheckpoint when RI=0
  nvme: Call pci_disable_device on the error path.
  cgroup: reduce read locked section of cgroup_threadgroup_rwsem during fork
  block: make sure a big bio is split into at most 256 bvecs
  block: Fix race triggered by blk_set_queue_dying()
  ext4: avoid modifying checksum fields directly during checksum verification
  ext4: avoid deadlock when expanding inode size
  ext4: properly align shifted xattrs when expanding inodes
  ext4: fix xattr shifting when expanding inodes part 2
  ext4: fix xattr shifting when expanding inodes
  ext4: validate that metadata blocks do not overlap superblock
  net: Use ns_capable_noaudit() when determining net sysctl permissions
  kernel: Add noaudit variant of ns_capable()
  KEYS: Fix ASN.1 indefinite length object parsing
  drivers:hv: Lock access to hyperv_mmio resource tree
  cxlflash: Move to exponential back-off when cmd_room is not available
  netfilter: x_tables: check for size overflow
  drm/amdgpu/cz: enable/disable vce dpm even if vce pg is disabled
  cred: Reject inodes with invalid ids in set_create_file_as()
  fs: Check for invalid i_uid in may_follow_link()
  IB/IPoIB: Do not set skb truesize since using one linearskb
  udp: properly support MSG_PEEK with truncated buffers
  crypto: nx-842 - Mask XERS0 bit in return value
  cxlflash: Fix to avoid virtual LUN failover failure
  cxlflash: Fix to escalate LINK_RESET also on port 1
  tipc: fix nl compat regression for link statistics
  tipc: fix an infoleak in tipc_nl_compat_link_dump
  netfilter: x_tables: check for size overflow
  Bluetooth: Add support for Intel Bluetooth device 8265 [8087:0a2b]
  drm/i915: Check VBT for port presence in addition to the strap on VLV/CHV
  drm/i915: Only ignore eDP ports that are connected
  Input: xpad - move pending clear to the correct location
  net: thunderx: Fix link status reporting
  x86/hyperv: Avoid reporting bogus NMI status for Gen2 instances
  crypto: vmx - IV size failing on skcipher API
  tda10071: Fix dependency to REGMAP_I2C
  crypto: vmx - Fix ABI detection
  crypto: vmx - comply with ABIs that specify vrsave as reserved.
  HID: core: prevent out-of-bound readings
  lpfc: Fix DMA faults observed upon plugging loopback connector
  block: fix blk_rq_get_max_sectors for driver private requests
  irqchip/gicv3-its: numa: Enable workaround for Cavium thunderx erratum 23144
  clocksource: Allow unregistering the watchdog
  btrfs: Continue write in case of can_not_nocow
  blk-mq: End unstarted requests on dying queue
  cxlflash: Fix to resolve dead-lock during EEH recovery
  drm/radeon/mst: fix regression in lane/link handling.
  ecryptfs: fix handling of directory opening
  ALSA: hda: add AMD Polaris-10/11 AZ PCI IDs with proper driver caps
  drm: Balance error path for GEM handle allocation
  ntp: Fix ADJ_SETOFFSET being used w/ ADJ_NANO
  time: Verify time values in adjtimex ADJ_SETOFFSET to avoid overflow
  Input: xpad - correctly handle concurrent LED and FF requests
  net: thunderx: Fix receive packet stats
  net: thunderx: Fix for multiqset not configured upon interface toggle
  perf/x86/cqm: Fix CQM memory leak and notifier leak
  perf/x86/cqm: Fix CQM handling of grouping events into a cache_group
  s390/crypto: provide correct file mode at device register.
  proc: revert /proc/<pid>/maps [stack:TID] annotation
  intel_idle: Support for Intel Xeon Phi Processor x200 Product Family
  cxlflash: Fix to avoid unnecessary scan with internal LUNs
  Drivers: hv: vmbus: don't manipulate with clocksources on crash
  Drivers: hv: vmbus: avoid scheduling in interrupt context in vmbus_initiate_unload()
  Drivers: hv: vmbus: avoid infinite loop in init_vp_index()
  arcmsr: fixes not release allocated resource
  arcmsr: fixed getting wrong configuration data
  s390/pci_dma: fix DMA table corruption with > 4 TB main memory
  net/mlx5e: Don't modify CQ before it was created
  net/mlx5e: Don't try to modify CQ moderation if it is not supported
  mmc: sdhci: Do not BUG on invalid vdd
  UVC: Add support for R200 depth camera
  sched/numa: Fix use-after-free bug in the task_numa_compare
  ALSA: hda - add codec support for Kabylake display audio codec
  drm/i915: Fix hpd live status bits for g4x
  tipc: fix nullptr crash during subscription cancel
  arm64: Add workaround for Cavium erratum 27456
  net: thunderx: Fix for Qset error due to CQ full
  drm/radeon: fix dp link rate selection (v2)
  drm/amdgpu: fix dp link rate selection (v2)
  qla2xxx: Use ATIO type to send correct tmr response
  mmc: sdhci: 64-bit DMA actually has 4-byte alignment
  drm/atomic: Do not unset crtc when an encoder is stolen
  drm/i915/skl: Add missing SKL ids
  drm/i915/bxt: update list of PCIIDs
  hrtimer: Catch illegal clockids
  i40e/i40evf: Fix RSS rx-flow-hash configuration through ethtool
  mpt3sas: Fix for Asynchronous completion of timedout IO and task abort of timedout IO.
  mpt3sas: A correction in unmap_resources
  net: cavium: liquidio: fix check for in progress flag
  arm64: KVM: Configure TCR_EL2.PS at runtime
  irqchip/gic-v3: Make sure read from ICC_IAR1_EL1 is visible on redestributor
  pwm: lpc32xx: fix and simplify duty cycle and period calculations
  pwm: lpc32xx: correct number of PWM channels from 2 to 1
  pwm: fsl-ftm: Fix clock enable/disable when using PM
  megaraid_sas: Add an i/o barrier
  megaraid_sas: Fix SMAP issue
  megaraid_sas: Do not allow PCI access during OCR
  s390/cio: update measurement characteristics
  s390/cio: ensure consistent measurement state
  s390/cio: fix measurement characteristics memleak
  qeth: initialize net_device with carrier off
  lpfc: Fix external loopback failure.
  lpfc: Fix mbox reuse in PLOGI completion
  lpfc: Fix RDP Speed reporting.
  lpfc: Fix crash in fcp command completion path.
  lpfc: Fix driver crash when module parameter lpfc_fcp_io_channel set to 16
  lpfc: Fix RegLogin failed error seen on Lancer FC during port bounce
  lpfc: Fix the FLOGI discovery logic to comply with T11 standards
  lpfc: Fix FCF Infinite loop in lpfc_sli4_fcf_rr_next_index_get.
  cxl: Enable PCI device ID for future IBM CXL adapter
  cxl: fix build for GCC 4.6.x
  cxlflash: Enable device id for future IBM CXL adapter
  cxlflash: Resolve oops in wait_port_offline
  cxlflash: Fix to resolve cmd leak after host reset
  cxl: Fix DSI misses when the context owning task exits
  cxl: Fix possible idr warning when contexts are released
  Drivers: hv: vmbus: fix rescind-offer handling for device without a driver
  Drivers: hv: vmbus: serialize process_chn_event() and vmbus_close_internal()
  Drivers: hv: vss: run only on supported host versions
  drivers/hv: cleanup synic msrs if vmbus connect failed
  Drivers: hv: util: catch allocation errors
  tools: hv: report ENOSPC errors in hv_fcopy_daemon
  Drivers: hv: utils: run polling callback always in interrupt context
  Drivers: hv: util: Increase the timeout for util services
  lightnvm: fix missing grown bad block type
  lightnvm: fix locking and mempool in rrpc_lun_gc
  lightnvm: unlock rq and free ppa_list on submission fail
  lightnvm: add check after mempool allocation
  lightnvm: fix incorrect nr_free_blocks stat
  lightnvm: fix bio submission issue
  cxlflash: a couple off by one bugs
  fm10k: Cleanup exception handling for mailbox interrupt
  fm10k: Cleanup MSI-X interrupts in case of failure
  fm10k: reinitialize queuing scheme after calling init_hw
  fm10k: always check init_hw for errors
  fm10k: reset max_queues on init_hw_vf failure
  fm10k: Fix handling of NAPI budget when multiple queues are enabled per vector
  fm10k: Correct MTU for jumbo frames
  fm10k: do not assume VF always has 1 queue
  clk: xgene: Fix divider with non-zero shift value
  e1000e: fix division by zero on jumbo MTUs
  e1000: fix data race between tx_ring->next_to_clean
  ixgbe: Fix handling of NAPI budget when multiple queues are enabled per vector
  igb: fix NULL derefs due to skipped SR-IOV enabling
  igb: use the correct i210 register for EEMNGCTL
  igb: don't unmap NULL hw_addr
  i40e: Fix Rx hash reported to the stack by our driver
  i40e: clean whole mac filter list
  i40evf: check rings before freeing resources
  i40e: don't add zero MAC filter
  i40e: properly delete VF MAC filters
  i40e: Fix memory leaks, sideband filter programming
  i40e: fix: do not sleep in netdev_ops
  i40e/i40evf: Fix RS bit update in Tx path and disable force WB workaround
  i40evf: handle many MAC filters correctly
  i40e: Workaround fix for mss < 256 issue
  UPSTREAM: audit: fix a double fetch in audit_log_single_execve_arg()
  UPSTREAM: ARM: 8494/1: mm: Enable PXN when running non-LPAE kernel on LPAE processor
  FIXUP: sched/tune: update accouting before CPU capacity
  FIXUP: sched/tune: add fixes missing from a previous patch
  arm: Fix #if/#ifdef typo in topology.c
  arm: Fix build error "conflicting types for 'scale_cpu_capacity'"
  sched/walt: use do_div instead of division operator
  DEBUG: cpufreq: fix cpu_capacity tracing build for non-smp systems
  sched/walt: include missing header for arm_timer_read_counter()
  cpufreq: Kconfig: Fixup incorrect selection by CPU_FREQ_DEFAULT_GOV_SCHED
  sched/fair: Avoid redundant idle_cpu() call in update_sg_lb_stats()
  FIXUP: sched: scheduler-driven cpu frequency selection
  sched/rt: Add Kconfig option to enable panicking for RT throttling
  sched/rt: print RT tasks when RT throttling is activated
  UPSTREAM: sched: Fix a race between __kthread_bind() and sched_setaffinity()
  sched/fair: Favor higher cpus only for boosted tasks
  vmstat: make vmstat_updater deferrable again and shut down on idle
  sched/fair: call OPP update when going idle after migration
  sched/cpufreq_sched: fix thermal capping events
  sched/fair: Picking cpus with low OPPs for tasks that prefer idle CPUs
  FIXUP: sched/tune: do initialization as a postcore_initicall
  DEBUG: sched: add tracepoint for RD overutilized
  sched/tune: Introducing a new schedtune attribute prefer_idle
  sched: use util instead of capacity to select busy cpu
  arch_timer: add error handling when the MPM global timer is cleared
  FIXUP: sched: Fix double-release of spinlock in move_queued_task
  FIXUP: sched/fair: Fix hang during suspend in sched_group_energy
  FIXUP: sched: fix SchedFreq integration for both PELT and WALT
  sched: EAS: Avoid causing spikes to max-freq unnecessarily
  FIXUP: sched: fix set_cfs_cpu_capacity when WALT is in use
  sched/walt: Accounting for number of irqs pending on each core
  sched: Introduce Window Assisted Load Tracking (WALT)
  sched/tune: fix PB and PC cuts indexes definition
  sched/fair: optimize idle cpu selection for boosted tasks
  FIXUP: sched/tune: fix accounting for runnable tasks
  sched/tune: use a single initialisation function
  sched/{fair,tune}: simplify fair.c code
  FIXUP: sched/tune: fix payoff calculation for boost region
  sched/tune: Add support for negative boost values
  FIX: sched/tune: move schedtune_nornalize_energy into fair.c
  FIX: sched/tune: update usage of boosted task utilisation on CPU selection
  sched/fair: add tunable to set initial task load
  sched/fair: add tunable to force selection at cpu granularity
  sched: EAS: take cstate into account when selecting idle core
  sched/cpufreq_sched: Consolidated update
  FIXUP: sched: fix build for non-SMP target
  DEBUG: sched/tune: add tracepoint on P-E space filtering
  DEBUG: sched/tune: add tracepoint for energy_diff() values
  DEBUG: sched/tune: add tracepoint for task boost signal
  arm: topology: Define TC2 energy and provide it to the scheduler
  CHROMIUM: sched: update the average of nr_running
  DEBUG: schedtune: add tracepoint for schedtune_tasks_update() values
  DEBUG: schedtune: add tracepoint for CPU boost signal
  DEBUG: schedtune: add tracepoint for SchedTune configuration update
  DEBUG: sched: add energy procfs interface
  DEBUG: sched,cpufreq: add cpu_capacity change tracepoint
  DEBUG: sched: add tracepoint for CPU load/util signals
  DEBUG: sched: add tracepoint for task load/util signals
  DEBUG: sched: add tracepoint for cpu/freq scale invariance
  sched/fair: filter energy_diff() based on energy_payoff value
  sched/tune: add support to compute normalized energy
  sched/fair: keep track of energy/capacity variations
  sched/fair: add boosted task utilization
  sched/{fair,tune}: track RUNNABLE tasks impact on per CPU boost value
  sched/tune: compute and keep track of per CPU boost value
  sched/tune: add initial support for CGroups based boosting
  sched/fair: add boosted CPU usage
  sched/fair: add function to convert boost value into "margin"
  sched/tune: add sysctl interface to define a boost value
  sched/tune: add detailed documentation
  fixup! sched/fair: jump to max OPP when crossing UP threshold
  fixup! sched: scheduler-driven cpu frequency selection
  sched: rt scheduler sets capacity requirement
  sched: deadline: use deadline bandwidth in scale_rt_capacity
  sched: remove call of sched_avg_update from sched_rt_avg_update
  sched/cpufreq_sched: add trace events
  sched/fair: jump to max OPP when crossing UP threshold
  sched/fair: cpufreq_sched triggers for load balancing
  sched/{core,fair}: trigger OPP change request on fork()
  sched/fair: add triggers for OPP change requests
  sched: scheduler-driven cpu frequency selection
  cpufreq: introduce cpufreq_driver_is_slow
  sched: Consider misfit tasks when load-balancing
  sched: Add group_misfit_task load-balance type
  sched: Add per-cpu max capacity to sched_group_capacity
  sched: Do eas idle balance regardless of the rq avg idle value
  arm64: Enable max freq invariant scheduler load-tracking and capacity support
  arm: Enable max freq invariant scheduler load-tracking and capacity support
  sched: Update max cpu capacity in case of max frequency constraints
  cpufreq: Max freq invariant scheduler load-tracking and cpu capacity support
  arm64, topology: Updates to use DT bindings for EAS costing data
  sched: Support for extracting EAS energy costs from DT
  Documentation: DT bindings for energy model cost data required by EAS
  sched: Disable energy-unfriendly nohz kicks
  sched: Consider a not over-utilized energy-aware system as balanced
  sched: Energy-aware wake-up task placement
  sched: Determine the current sched_group idle-state
  sched, cpuidle: Track cpuidle state index in the scheduler
  sched: Add over-utilization/tipping point indicator
  sched: Estimate energy impact of scheduling decisions
  sched: Extend sched_group_energy to test load-balancing decisions
  sched: Calculate energy consumption of sched_group
  sched: Highest energy aware balancing sched_domain level pointer
  sched: Relocated cpu_util() and change return type
  sched: Compute cpu capacity available at current frequency
  arm64: Cpu invariant scheduler load-tracking and capacity support
  arm: Cpu invariant scheduler load-tracking and capacity support
  sched: Introduce SD_SHARE_CAP_STATES sched_domain flag
  sched: Initialize energy data structures
  sched: Introduce energy data structures
  sched: Make energy awareness a sched feature
  sched: Documentation for scheduler energy cost model
  sched: Prevent unnecessary active balance of single task in sched group
  sched: Enable idle balance to pull single task towards cpu with higher capacity
  sched: Consider spare cpu capacity at task wake-up
  sched: Add cpu capacity awareness to wakeup balancing
  sched: Store system-wide maximum cpu capacity in root domain
  arm: Update arch_scale_cpu_capacity() to reflect change to define
  arm64: Enable frequency invariant scheduler load-tracking support
  arm: Enable frequency invariant scheduler load-tracking support
  cpufreq: Frequency invariant scheduler load-tracking support
  sched/fair: Fix new task's load avg removed from source CPU in wake_up_new_task()
  FROMLIST: pstore: drop pmsg bounce buffer
  UPSTREAM: usercopy: remove page-spanning test for now
  UPSTREAM: usercopy: force check_object_size() inline
  BACKPORT: usercopy: fold builtin_const check into inline function
  UPSTREAM: x86/uaccess: force copy_*_user() to be inlined
  UPSTREAM: HID: core: prevent out-of-bound readings
  Android: Fix build breakages.
  UPSTREAM: tty: Prevent ldisc drivers from re-using stale tty fields
  UPSTREAM: netfilter: nfnetlink: correctly validate length of batch messages
  cpuset: Make cpusets restore on hotplug
  UPSTREAM: mm/slub: support left redzone
  UPSTREAM: Make the hardened user-copy code depend on having a hardened allocator
  Android: MMC/UFS IO Latency Histograms.
  UPSTREAM: usercopy: fix overlap check for kernel text
  UPSTREAM: usercopy: avoid potentially undefined behavior in pointer math
  UPSTREAM: unsafe_[get|put]_user: change interface to use a error target label
  BACKPORT: arm64: mm: fix location of _etext
  BACKPORT: ARM: 8583/1: mm: fix location of _etext
  BACKPORT: Don't show empty tag stats for unprivileged uids
  UPSTREAM: tcp: fix use after free in tcp_xmit_retransmit_queue()
  ANDROID: base-cfg: drop SECCOMP_FILTER config
  UPSTREAM: [media] xc2028: unlock on error in xc2028_set_config()
  UPSTREAM: [media] xc2028: avoid use after free
  ANDROID: base-cfg: enable SECCOMP config
  ANDROID: rcu_sync: Export rcu_sync_lockdep_assert
  RFC: FROMLIST: cgroup: reduce read locked section of cgroup_threadgroup_rwsem during fork
  RFC: FROMLIST: cgroup: avoid synchronize_sched() in __cgroup_procs_write()
  RFC: FROMLIST: locking/percpu-rwsem: Optimize readers and reduce global impact
  net: ipv6: Fix ping to link-local addresses.
  ipv6: fix endianness error in icmpv6_err
  ANDROID: dm: android-verity: Allow android-verity to be compiled as an independent module
  backporting: a brief introduce of backported feautures on 4.4
  Linux 4.4.20
  sysfs: correctly handle read offset on PREALLOC attrs
  hwmon: (iio_hwmon) fix memory leak in name attribute
  ALSA: line6: Fix POD sysfs attributes segfault
  ALSA: line6: Give up on the lock while URBs are released.
  ALSA: line6: Remove double line6_pcm_release() after failed acquire.
  ACPI / SRAT: fix SRAT parsing order with both LAPIC and X2APIC present
  ACPI / sysfs: fix error code in get_status()
  ACPI / drivers: replace acpi_probe_lock spinlock with mutex
  ACPI / drivers: fix typo in ACPI_DECLARE_PROBE_ENTRY macro
  staging: comedi: ni_mio_common: fix wrong insn_write handler
  staging: comedi: ni_mio_common: fix AO inttrig backwards compatibility
  staging: comedi: comedi_test: fix timer race conditions
  staging: comedi: daqboard2000: bug fix board type matching code
  USB: serial: option: add WeTelecom 0x6802 and 0x6803 products
  USB: serial: option: add WeTelecom WM-D200
  USB: serial: mos7840: fix non-atomic allocation in write path
  USB: serial: mos7720: fix non-atomic allocation in write path
  USB: fix typo in wMaxPacketSize validation
  usb: chipidea: udc: don't touch DP when controller is in host mode
  USB: avoid left shift by -1
  dmaengine: usb-dmac: check CHCR.DE bit in usb_dmac_isr_channel()
  crypto: qat - fix aes-xts key sizes
  crypto: nx - off by one bug in nx_of_update_msc()
  Input: i8042 - set up shared ps2_cmd_mutex for AUX ports
  Input: i8042 - break load dependency between atkbd/psmouse and i8042
  Input: tegra-kbc - fix inverted reset logic
  btrfs: properly track when rescan worker is running
  btrfs: waiting on qgroup rescan should not always be interruptible
  fs/seq_file: fix out-of-bounds read
  gpio: Fix OF build problem on UM
  usb: renesas_usbhs: gadget: fix return value check in usbhs_mod_gadget_probe()
  megaraid_sas: Fix probing cards without io port
  mpt3sas: Fix resume on WarpDrive flash cards
  cdc-acm: fix wrong pipe type on rx interrupt xfers
  i2c: cros-ec-tunnel: Fix usage of cros_ec_cmd_xfer()
  mfd: cros_ec: Add cros_ec_cmd_xfer_status() helper
  aacraid: Check size values after double-fetch from user
  ARC: Elide redundant setup of DMA callbacks
  ARC: Call trace_hardirqs_on() before enabling irqs
  ARC: use correct offset in pt_regs for saving/restoring user mode r25
  ARC: build: Better way to detect ISA compatible toolchain
  drm/i915: fix aliasing_ppgtt leak
  drm/amdgpu: record error code when ring test failed
  drm/amd/amdgpu: sdma resume fail during S4 on CI
  drm/amdgpu: skip TV/CV in display parsing
  drm/amdgpu: avoid a possible array overflow
  drm/amdgpu: fix amdgpu_move_blit on 32bit systems
  drm/amdgpu: Change GART offset to 64-bit
  iio: fix sched WARNING "do not call blocking ops when !TASK_RUNNING"
  sched/nohz: Fix affine unpinned timers mess
  sched/cputime: Fix NO_HZ_FULL getrusage() monotonicity regression
  of: fix reference counting in of_graph_get_endpoint_by_regs
  arm64: dts: rockchip: add reset saradc node for rk3368 SoCs
  mac80211: fix purging multicast PS buffer queue
  s390/dasd: fix hanging device after clear subchannel
  EDAC: Increment correct counter in edac_inc_ue_error()
  pinctrl/amd: Remove the default de-bounce time
  iommu/arm-smmu: Don't BUG() if we find aborting STEs with disable_bypass
  iommu/arm-smmu: Fix CMDQ error handling
  iommu/dma: Don't put uninitialised IOVA domains
  xhci: Make sure xhci handles USB_SPEED_SUPER_PLUS devices.
  USB: serial: ftdi_sio: add PIDs for Ivium Technologies devices
  USB: serial: ftdi_sio: add device ID for WICED USB UART dev board
  USB: serial: option: add support for Telit LE920A4
  USB: serial: option: add D-Link DWM-156/A3
  USB: serial: fix memleak in driver-registration error path
  xhci: don't dereference a xhci member after removing xhci
  usb: xhci: Fix panic if disconnect
  xhci: always handle "Command Ring Stopped" events
  usb/gadget: fix gadgetfs aio support.
  usb: gadget: fsl_qe_udc: off by one in setup_received_handle()
  USB: validate wMaxPacketValue entries in endpoint descriptors
  usb: renesas_usbhs: Use dmac only if the pipe type is bulk
  usb: renesas_usbhs: clear the BRDYSTS in usbhsg_ep_enable()
  USB: hub: change the locking in hub_activate
  USB: hub: fix up early-exit pathway in hub_activate
  usb: hub: Fix unbalanced reference count/memory leak/deadlocks
  usb: define USB_SPEED_SUPER_PLUS speed for SuperSpeedPlus USB3.1 devices
  usb: dwc3: gadget: increment request->actual once
  usb: dwc3: pci: add Intel Kabylake PCI ID
  usb: misc: usbtest: add fix for driver hang
  usb: ehci: change order of register cleanup during shutdown
  crypto: caam - defer aead_set_sh_desc in case of zero authsize
  crypto: caam - fix echainiv(authenc) encrypt shared descriptor
  crypto: caam - fix non-hmac hashes
  genirq/msi: Make sure PCI MSIs are activated early
  genirq/msi: Remove unused MSI_FLAG_IDENTITY_MAP
  um: Don't discard .text.exit section
  ACPI / CPPC: Prevent cpc_desc_ptr points to the invalid data
  ACPI: CPPC: Return error if _CPC is invalid on a CPU
  mmc: sdhci-acpi: Reduce Baytrail eMMC/SD/SDIO hangs
  PCI: Limit config space size for Netronome NFP4000
  PCI: Add Netronome NFP4000 PF device ID
  PCI: Limit config space size for Netronome NFP6000 family
  PCI: Add Netronome vendor and device IDs
  PCI: Support PCIe devices with short cfg_size
  NVMe: Don't unmap controller registers on reset
  ALSA: hda - Manage power well properly for resume
  libnvdimm, nd_blk: mask off reserved status bits
  perf intel-pt: Fix occasional decoding errors when tracing system-wide
  vfio/pci: Fix NULL pointer oops in error interrupt setup handling
  virtio: fix memory leak in virtqueue_add()
  parisc: Fix order of EREFUSED define in errno.h
  arm64: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO
  ALSA: usb-audio: Add quirk for ELP HD USB Camera
  ALSA: usb-audio: Add a sample rate quirk for Creative Live! Cam Socialize HD (VF0610)
  powerpc/eeh: eeh_pci_enable(): fix checking of post-request state
  SUNRPC: allow for upcalls for same uid but different gss service
  SUNRPC: Handle EADDRNOTAVAIL on connection failures
  tools/testing/nvdimm: fix SIGTERM vs hotplug crash
  uprobes/x86: Fix RIP-relative handling of EVEX-encoded instructions
  x86/mm: Disable preemption during CR3 read+write
  hugetlb: fix nr_pmds accounting with shared page tables
  mm: SLUB hardened usercopy support
  mm: SLAB hardened usercopy support
  s390/uaccess: Enable hardened usercopy
  sparc/uaccess: Enable hardened usercopy
  powerpc/uaccess: Enable hardened usercopy
  ia64/uaccess: Enable hardened usercopy
  arm64/uaccess: Enable hardened usercopy
  ARM: uaccess: Enable hardened usercopy
  x86/uaccess: Enable hardened usercopy
  x86: remove more uaccess_32.h complexity
  x86: remove pointless uaccess_32.h complexity
  x86: fix SMAP in 32-bit environments
  Use the new batched user accesses in generic user string handling
  Add 'unsafe' user access functions for batched accesses
  x86: reorganize SMAP handling in user space accesses
  mm: Hardened usercopy
  mm: Implement stack frame object validation
  mm: Add is_migrate_cma_page
  Linux 4.4.19
  Documentation/module-signing.txt: Note need for version info if reusing a key
  module: Invalidate signatures on force-loaded modules
  dm flakey: error READ bios during the down_interval
  rtc: s3c: Add s3c_rtc_{enable/disable}_clk in s3c_rtc_setfreq()
  lpfc: fix oops in lpfc_sli4_scmd_to_wqidx_distr() from lpfc_send_taskmgmt()
  ACPI / EC: Work around method reentrancy limit in ACPICA for _Qxx
  x86/platform/intel_mid_pci: Rework IRQ0 workaround
  PCI: Mark Atheros AR9485 and QCA9882 to avoid bus reset
  MIPS: hpet: Increase HPET_MIN_PROG_DELTA and decrease HPET_MIN_CYCLES
  MIPS: Don't register r4k sched clock when CPUFREQ enabled
  MIPS: mm: Fix definition of R6 cache instruction
  SUNRPC: Don't allocate a full sockaddr_storage for tracing
  Input: elan_i2c - properly wake up touchpad on ASUS laptops
  target: Fix ordered task CHECK_CONDITION early exception handling
  target: Fix max_unmap_lba_count calc overflow
  target: Fix race between iscsi-target connection shutdown + ABORT_TASK
  target: Fix missing complete during ABORT_TASK + CMD_T_FABRIC_STOP
  target: Fix ordered task target_setup_cmd_from_cdb exception hang
  iscsi-target: Fix panic when adding second TCP connection to iSCSI session
  ubi: Fix race condition between ubi device creation and udev
  ubi: Fix early logging
  ubi: Make volume resize power cut aware
  of: fix memory leak related to safe_name()
  IB/mlx4: Fix memory leak if QP creation failed
  IB/mlx4: Fix error flow when sending mads under SRIOV
  IB/mlx4: Fix the SQ size of an RC QP
  IB/IWPM: Fix a potential skb leak
  IB/IPoIB: Don't update neigh validity for unresolved entries
  IB/SA: Use correct free function
  IB/mlx5: Return PORT_ERR in Active to Initializing tranisition
  IB/mlx5: Fix post send fence logic
  IB/mlx5: Fix entries check in mlx5_ib_resize_cq
  IB/mlx5: Fix returned values of query QP
  IB/mlx5: Fix entries checks in mlx5_ib_create_cq
  IB/mlx5: Fix MODIFY_QP command input structure
  ALSA: hda - Fix headset mic detection problem for two dell machines
  ALSA: hda: add AMD Bonaire AZ PCI ID with proper driver caps
  ALSA: hda/realtek - Can't adjust speaker's volume on a Dell AIO
  ALSA: hda: Fix krealloc() with __GFP_ZERO usage
  mm/hugetlb: avoid soft lockup in set_max_huge_pages()
  mtd: nand: fix bug writing 1 byte less than page size
  block: fix bdi vs gendisk lifetime mismatch
  block: add missing group association in bio-cloning functions
  metag: Fix __cmpxchg_u32 asm constraint for CMP
  ftrace/recordmcount: Work around for addition of metag magic but not relocations
  balloon: check the number of available pages in leak balloon
  drm/i915/dp: Revert "drm/i915/dp: fall back to 18 bpp when sink capability is unknown"
  drm/i915: Never fully mask the the EI up rps interrupt on SNB/IVB
  drm/edid: Add 6 bpc quirk for display AEO model 0.
  drm: Restore double clflush on the last partial cacheline
  drm/nouveau/fbcon: fix font width not divisible by 8
  drm/nouveau/gr/nv3x: fix instobj write offsets in gr setup
  drm/nouveau: check for supported chipset before booting fbdev off the hw
  drm/radeon: support backlight control for UNIPHY3
  drm/radeon: fix firmware info version checks
  drm/radeon: Poll for both connect/disconnect on analog connectors
  drm/radeon: add a delay after ATPX dGPU power off
  drm/amdgpu/gmc7: add missing mullins case
  drm/amdgpu: fix firmware info version checks
  drm/amdgpu: Disable RPM helpers while reprobing connectors on resume
  drm/amdgpu: support backlight control for UNIPHY3
  drm/amdgpu: Poll for both connect/disconnect on analog connectors
  drm/amdgpu: add a delay after ATPX dGPU power off
  w1:omap_hdq: fix regression
  netlabel: add address family checks to netlbl_{sock,req}_delattr()
  ARM: dts: sunxi: Add a startup delay for fixed regulator enabled phys
  audit: fix a double fetch in audit_log_single_execve_arg()
  iommu/amd: Update Alias-DTE in update_device_table()
  iommu/amd: Init unity mappings only for dma_ops domains
  iommu/amd: Handle IOMMU_DOMAIN_DMA in ops->domain_free call-back
  iommu/vt-d: Return error code in domain_context_mapping_one()
  iommu/exynos: Suppress unbinding to prevent system failure
  drm/i915: Don't complain about lack of ACPI video bios
  nfsd: don't return an unhashed lock stateid after taking mutex
  nfsd: Fix race between FREE_STATEID and LOCK
  nfs: don't create zero-length requests
  MIPS: KVM: Propagate kseg0/mapped tlb fault errors
  MIPS: KVM: Fix gfn range check in kseg0 tlb faults
  MIPS: KVM: Add missing gfn range check
  MIPS: KVM: Fix mapped fault broken commpage handling
  random: add interrupt callback to VMBus IRQ handler
  random: print a warning for the first ten uninitialized random users
  random: initialize the non-blocking pool via add_hwgenerator_randomness()
  CIFS: Fix a possible invalid memory access in smb2_query_symlink()
  cifs: fix crash due to race in hmac(md5) handling
  cifs: Check for existing directory when opening file with O_CREAT
  fs/cifs: make share unaccessible at root level mountable
  jbd2: make journal y2038 safe
  ARC: mm: don't loose PTE_SPECIAL in pte_modify()
  remoteproc: Fix potential race condition in rproc_add
  ovl: disallow overlayfs as upperdir
  HID: uhid: fix timeout when probe races with IO
  EDAC: Correct channel count limit
  Bluetooth: Fix l2cap_sock_setsockopt() with optname BT_RCVMTU
  spi: pxa2xx: Clear all RFT bits in reset_sccr1() on Intel Quark
  i2c: efm32: fix a failure path in efm32_i2c_probe()
  s5p-mfc: Add release callback for memory region devs
  s5p-mfc: Set device name for reserved memory region devs
  hp-wmi: Fix wifi cannot be hard-unblocked
  dm: set DMF_SUSPENDED* _before_ clearing DMF_NOFLUSH_SUSPENDING
  sur40: fix occasional oopses on device close
  sur40: lower poll interval to fix occasional FPS drops to ~56 FPS
  Fix RC5 decoding with Fintek CIR chipset
  vb2: core: Skip planes array verification if pb is NULL
  videobuf2-v4l2: Verify planes array in buffer dequeueing
  media: dvb_ringbuffer: Add memory barriers
  media: usbtv: prevent access to free'd resources
  mfd: qcom_rpm: Parametrize also ack selector size
  mfd: qcom_rpm: Fix offset error for msm8660
  intel_pstate: Fix MSR_CONFIG_TDP_x addressing in core_get_max_pstate()
  s390/cio: allow to reset channel measurement block
  KVM: nVMX: Fix memory corruption when using VMCS shadowing
  KVM: VMX: handle PML full VMEXIT that occurs during event delivery
  KVM: MTRR: fix kvm_mtrr_check_gfn_range_consistency page fault
  KVM: PPC: Book3S HV: Save/restore TM state in H_CEDE
  KVM: PPC: Book3S HV: Pull out TM state save/restore into separate procedures
  arm64: mm: avoid fdt_check_header() before the FDT is fully mapped
  arm64: dts: rockchip: fixes the gic400 2nd region size for rk3368
  pinctrl: cherryview: prevent concurrent access to GPIO controllers
  Bluetooth: hci_intel: Fix null gpio desc pointer dereference
  gpio: intel-mid: Remove potentially harmful code
  gpio: pca953x: Fix NBANK calculation for PCA9536
  tty/serial: atmel: fix RS485 half duplex with DMA
  serial: samsung: Fix ERR pointer dereference on deferred probe
  tty: serial: msm: Don't read off end of tx fifo
  arm64: Fix incorrect per-cpu usage for boot CPU
  arm64: debug: unmask PSTATE.D earlier
  arm64: kernel: Save and restore UAO and addr_limit on exception entry
  USB: usbfs: fix potential infoleak in devio
  usb: renesas_usbhs: fix NULL pointer dereference in xfer_work()
  USB: serial: option: add support for Telit LE910 PID 0x1206
  usb: dwc3: fix for the isoc transfer EP_BUSY flag
  usb: quirks: Add no-lpm quirk for Elan
  usb: renesas_usbhs: protect the CFIFOSEL setting in usbhsg_ep_enable()
  usb: f_fs: off by one bug in _ffs_func_bind()
  usb: gadget: avoid exposing kernel stack
  UPSTREAM: usb: gadget: configfs: add mutex lock before unregister gadget
  ANDROID: dm-verity: adopt changes made to dm callbacks
  UPSTREAM: ecryptfs: fix handling of directory opening
  ANDROID: net: core: fix UID-based routing
  ANDROID: net: fib: remove duplicate assignment
  FROMLIST: proc: Fix timerslack_ns CAP_SYS_NICE check when adjusting self
  ANDROID: dm verity fec: pack the fec_header structure
  ANDROID: dm: android-verity: Verify header before fetching table
  ANDROID: dm: allow adb disable-verity only in userdebug
  ANDROID: dm: mount as linear target if eng build
  ANDROID: dm: use default verity public key
  ANDROID: dm: fix signature verification flag
  ANDROID: dm: use name_to_dev_t
  ANDROID: dm: rename dm-linear methods for dm-android-verity
  ANDROID: dm: Minor cleanup
  ANDROID: dm: Mounting root as linear device when verity disabled
  ANDROID: dm-android-verity: Rebase on top of 4.1
  ANDROID: dm: Add android verity target
  ANDROID: dm: fix dm_substitute_devices()
  ANDROID: dm: Rebase on top of 4.1
  CHROMIUM: dm: boot time specification of dm=
  Implement memory_state_time, used by qcom,cpubw
  Revert "panic: Add board ID to panic output"
  usb: gadget: f_accessory: remove duplicate endpoint alloc
  BACKPORT: brcmfmac: defer DPC processing during probe
  FROMLIST: proc: Add LSM hook checks to /proc/<tid>/timerslack_ns
  FROMLIST: proc: Relax /proc/<tid>/timerslack_ns capability requirements
  UPSTREAM: ppp: defer netns reference release for ppp channel
  cpuset: Add allow_attach hook for cpusets on android.
  UPSTREAM: KEYS: Fix ASN.1 indefinite length object parsing
  ANDROID: sdcardfs: fix itnull.cocci warnings
  android-recommended.cfg: enable fstack-protector-strong
  Linux 4.4.18
  mm: memcontrol: fix memcg id ref counter on swap charge move
  mm: memcontrol: fix swap counter leak on swapout from offline cgroup
  mm: memcontrol: fix cgroup creation failure after many small jobs
  ext4: fix reference counting bug on block allocation error
  ext4: short-cut orphan cleanup on error
  ext4: validate s_reserved_gdt_blocks on mount
  ext4: don't call ext4_should_journal_data() on the journal inode
  ext4: fix deadlock during page writeback
  ext4: check for extents that wrap around
  crypto: scatterwalk - Fix test in scatterwalk_done
  crypto: gcm - Filter out async ghash if necessary
  fs/dcache.c: avoid soft-lockup in dput()
  fuse: fix wrong assignment of ->flags in fuse_send_init()
  fuse: fuse_flush must check mapping->flags for errors
  fuse: fsync() did not return IO errors
  sysv, ipc: fix security-layer leaking
  block: fix use-after-free in seq file
  x86/syscalls/64: Add compat_sys_keyctl for 32-bit userspace
  drm/i915: Pretend cursor is always on for ILK-style WM calculations (v2)
  x86/mm/pat: Fix BUG_ON() in mmap_mem() on QEMU/i386
  x86/pat: Document the PAT initialization sequence
  x86/xen, pat: Remove PAT table init code from Xen
  x86/mtrr: Fix PAT init handling when MTRR is disabled
  x86/mtrr: Fix Xorg crashes in Qemu sessions
  x86/mm/pat: Replace cpu_has_pat with boot_cpu_has()
  x86/mm/pat: Add pat_disable() interface
  x86/mm/pat: Add support of non-default PAT MSR setting
  devpts: clean up interface to pty drivers
  random: strengthen input validation for RNDADDTOENTCNT
  apparmor: fix ref count leak when profile sha1 hash is read
  Revert "s390/kdump: Clear subchannel ID to signal non-CCW/SCSI IPL"
  KEYS: 64-bit MIPS needs to use compat_sys_keyctl for 32-bit userspace
  arm: oabi compat: add missing access checks
  cdc_ncm: do not call usbnet_link_change from cdc_ncm_bind
  i2c: i801: Allow ACPI SystemIO OpRegion to conflict with PCI BAR
  x86/mm/32: Enable full randomization on i386 and X86_32
  HID: sony: do not bail out when the sixaxis refuses the output report
  PNP: Add Broadwell to Intel MCH size workaround
  PNP: Add Haswell-ULT to Intel MCH size workaround
  scsi: ignore errors from scsi_dh_add_device()
  ipath: Restrict use of the write() interface
  tcp: consider recv buf for the initial window scale
  qed: Fix setting/clearing bit in completion bitmap
  net/irda: fix NULL pointer dereference on memory allocation failure
  net: bgmac: Fix infinite loop in bgmac_dma_tx_add()
  bonding: set carrier off for devices created through netlink
  ipv4: reject RTNH_F_DEAD and RTNH_F_LINKDOWN from user space
  tcp: enable per-socket rate limiting of all 'challenge acks'
  tcp: make challenge acks less predictable
  arm64: relocatable: suppress R_AARCH64_ABS64 relocations in vmlinux
  arm64: vmlinux.lds: make __rela_offset and __dynsym_offset ABSOLUTE
  Linux 4.4.17
  vfs: fix deadlock in file_remove_privs() on overlayfs
  intel_th: Fix a deadlock in modprobing
  intel_th: pci: Add Kaby Lake PCH-H support
  net: mvneta: set real interrupt per packet for tx_done
  libceph: apply new_state before new_up_client on incrementals
  libata: LITE-ON CX1-JB256-HP needs lower max_sectors
  i2c: mux: reg: wrong condition checked for of_address_to_resource return value
  posix_cpu_timer: Exit early when process has been reaped
  media: fix airspy usb probe error path
  ipr: Clear interrupt on croc/crocodile when running with LSI
  SCSI: fix new bug in scsi_dev_info_list string matching
  RDS: fix rds_tcp_init() error path
  can: fix oops caused by wrong rtnl dellink usage
  can: fix handling of unmodifiable configuration options fix
  can: c_can: Update D_CAN TX and RX functions to 32 bit - fix Altera Cyclone access
  can: at91_can: RX queue could get stuck at high bus load
  perf/x86: fix PEBS issues on Intel Atom/Core2
  ovl: handle ATTR_KILL*
  sched/fair: Fix effective_load() to consistently use smoothed load
  mmc: block: fix packed command header endianness
  block: fix use-after-free in sys_ioprio_get()
  qeth: delete napi struct when removing a qeth device
  platform/chrome: cros_ec_dev - double fetch bug in ioctl
  clk: rockchip: initialize flags of clk_init_data in mmc-phase clock
  spi: sun4i: fix FIFO limit
  spi: sunxi: fix transfer timeout
  namespace: update event counter when umounting a deleted dentry
  9p: use file_dentry()
  ext4: verify extent header depth
  ecryptfs: don't allow mmap when the lower fs doesn't support it
  Revert "ecryptfs: forbid opening files without mmap handler"
  locks: use file_inode()
  power_supply: power_supply_read_temp only if use_cnt > 0
  cgroup: set css->id to -1 during init
  pinctrl: imx: Do not treat a PIN without MUX register as an error
  pinctrl: single: Fix missing flush of posted write for a wakeirq
  pvclock: Add CPU barriers to get correct version value
  Input: tsc200x - report proper input_dev name
  Input: xpad - validate USB endpoint count during probe
  Input: wacom_w8001 - w8001_MAX_LENGTH should be 13
  Input: xpad - fix oops when attaching an unknown Xbox One gamepad
  Input: elantech - add more IC body types to the list
  Input: vmmouse - remove port reservation
  ALSA: timer: Fix leak in events via snd_timer_user_tinterrupt
  ALSA: timer: Fix leak in events via snd_timer_user_ccallback
  ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS
  xenbus: don't bail early from xenbus_dev_request_and_reply()
  xenbus: don't BUG() on user mode induced condition
  xen/pciback: Fix conf_space read/write overlap check.
  ARC: unwind: ensure that .debug_frame is generated (vs. .eh_frame)
  arc: unwind: warn only once if DW2_UNWIND is disabled
  kernel/sysrq, watchdog, sched/core: Reset watchdog on all CPUs while processing sysrq-w
  pps: do not crash when failed to register
  vmlinux.lds: account for destructor sections
  mm, meminit: ensure node is online before checking whether pages are uninitialised
  mm, meminit: always return a valid node from early_pfn_to_nid
  mm, compaction: prevent VM_BUG_ON when terminating freeing scanner
  fs/nilfs2: fix potential underflow in call to crc32_le
  mm, compaction: abort free scanner if split fails
  mm, sl[au]b: add __GFP_ATOMIC to the GFP reclaim mask
  dmaengine: at_xdmac: double FIFO flush needed to compute residue
  dmaengine: at_xdmac: fix residue corruption
  dmaengine: at_xdmac: align descriptors on 64 bits
  x86/quirks: Add early quirk to reset Apple AirPort card
  x86/quirks: Reintroduce scanning of secondary buses
  x86/quirks: Apply nvidia_bugs quirk only on root bus
  USB: OHCI: Don't mark EDs as ED_OPER if scheduling fails

Conflicts:
	arch/arm/kernel/topology.c
	arch/arm64/include/asm/arch_gicv3.h
	arch/arm64/kernel/topology.c
	block/bio.c
	drivers/cpufreq/Kconfig
	drivers/md/Makefile
	drivers/media/dvb-core/dvb_ringbuffer.c
	drivers/media/tuners/tuner-xc2028.c
	drivers/misc/Kconfig
	drivers/misc/Makefile
	drivers/mmc/core/host.c
	drivers/scsi/ufs/ufshcd.c
	drivers/scsi/ufs/ufshcd.h
	drivers/usb/dwc3/gadget.c
	drivers/usb/gadget/configfs.c
	fs/ecryptfs/file.c
	include/linux/mmc/core.h
	include/linux/mmc/host.h
	include/linux/mmzone.h
	include/linux/sched.h
	include/linux/sched/sysctl.h
	include/trace/events/power.h
	include/trace/events/sched.h
	init/Kconfig
	kernel/cpuset.c
	kernel/exit.c
	kernel/sched/Makefile
	kernel/sched/core.c
	kernel/sched/cputime.c
	kernel/sched/fair.c
	kernel/sched/features.h
	kernel/sched/rt.c
	kernel/sched/sched.h
	kernel/sched/stop_task.c
	kernel/sched/tune.c
	lib/Kconfig.debug
	mm/Makefile
	mm/vmstat.c

Change-Id: I243a43231ca56a6362076fa6301827e1b0493be5
Signed-off-by: Runmin Wang <runminw@codeaurora.org>
2016-12-16 13:52:17 -08:00
Runmin Wang
9cc5c789d9 Merge remote-tracking branch 'msm4.4/tmp-da9a92f' into msm-4.4
* origin/tmp-da9a92f:
  arm64: kaslr: increase randomization granularity
  arm64: relocatable: deal with physically misaligned kernel images
  arm64: don't map TEXT_OFFSET bytes below the kernel if we can avoid it
  arm64: kernel: replace early 64-bit literal loads with move-immediates
  arm64: introduce mov_q macro to move a constant into a 64-bit register
  arm64: kernel: perform relocation processing from ID map
  arm64: kernel: use literal for relocated address of __secondary_switched
  arm64: kernel: don't export local symbols from head.S
  arm64: simplify kernel segment mapping granularity
  arm64: cover the .head.text section in the .text segment mapping
  arm64: move early boot code to the .init segment
  arm64: use 'segment' rather than 'chunk' to describe mapped kernel regions
  arm64: mm: Mark .rodata as RO
  Linux 4.4.16
  ovl: verify upper dentry before unlink and rename
  drm/i915: Revert DisplayPort fast link training feature
  tmpfs: fix regression hang in fallocate undo
  tmpfs: don't undo fallocate past its last page
  crypto: qat - make qat_asym_algs.o depend on asn1 headers
  xen/acpi: allow xen-acpi-processor driver to load on Xen 4.7
  File names with trailing period or space need special case conversion
  cifs: dynamic allocation of ntlmssp blob
  Fix reconnect to not defer smb3 session reconnect long after socket reconnect
  53c700: fix BUG on untagged commands
  s390: fix test_fp_ctl inline assembly contraints
  scsi: fix race between simultaneous decrements of ->host_failed
  ovl: verify upper dentry in ovl_remove_and_whiteout()
  ovl: Copy up underlying inode's ->i_mode to overlay inode
  ARM: mvebu: fix HW I/O coherency related deadlocks
  ARM: dts: armada-38x: fix MBUS_ID for crypto SRAM on Armada 385 Linksys
  ARM: sunxi/dt: make the CHIP inherit from allwinner,sun5i-a13
  ALSA: hda: add AMD Stoney PCI ID with proper driver caps
  ALSA: hda - fix use-after-free after module unload
  ALSA: ctl: Stop notification after disconnection
  ALSA: pcm: Free chmap at PCM free callback, too
  ALSA: hda/realtek - add new pin definition in alc225 pin quirk table
  ALSA: hda - fix read before array start
  ALSA: hda - Add PCI ID for Kabylake-H
  ALSA: hda/realtek: Add Lenovo L460 to docking unit fixup
  ALSA: timer: Fix negative queue usage by racy accesses
  ALSA: echoaudio: Fix memory allocation
  ALSA: au88x0: Fix calculation in vortex_wtdma_bufshift()
  ALSA: hda / realtek - add two more Thinkpad IDs (5050,5053) for tpt460 fixup
  ALSA: hda - Fix the headset mic jack detection on Dell machine
  ALSA: dummy: Fix a use-after-free at closing
  hwmon: (dell-smm) Cache fan_type() calls and change fan detection
  hwmon: (dell-smm) Disallow fan_type() calls on broken machines
  hwmon: (dell-smm) Restrict fan control and serial number to CAP_SYS_ADMIN by default
  tty/vt/keyboard: fix OOB access in do_compute_shiftstate()
  tty: vt: Fix soft lockup in fbcon cursor blink timer.
  iio:ad7266: Fix probe deferral for vref
  iio:ad7266: Fix support for optional regulators
  iio:ad7266: Fix broken regulator error handling
  iio: accel: kxsd9: fix the usage of spi_w8r8()
  staging: iio: accel: fix error check
  iio: hudmidity: hdc100x: fix incorrect shifting and scaling
  iio: humidity: hdc100x: fix IIO_TEMP channel reporting
  iio: humidity: hdc100x: correct humidity integration time mask
  iio: proximity: as3935: fix buffer stack trashing
  iio: proximity: as3935: remove triggered buffer processing
  iio: proximity: as3935: correct IIO_CHAN_INFO_RAW output
  iio: light apds9960: Add the missing dev.parent
  iio:st_pressure: fix sampling gains (bring inline with ABI)
  iio: Fix error handling in iio_trigger_attach_poll_func
  xen/balloon: Fix declared-but-not-defined warning
  perf/x86: Fix undefined shift on 32-bit kernels
  memory: omap-gpmc: Fix omap gpmc EXTRADELAY timing
  drm/vmwgfx: Fix error paths when mapping framebuffer
  drm/vmwgfx: Delay pinning fbdev framebuffer until after mode set
  drm/vmwgfx: Check pin count before attempting to move a buffer
  drm/vmwgfx: Work around mode set failure in 2D VMs
  drm/vmwgfx: Add an option to change assumed FB bpp
  drm/ttm: Make ttm_bo_mem_compat available
  drm: atmel-hlcdc: actually disable scaling when no scaling is required
  drm: make drm_atomic_set_mode_prop_for_crtc() more reliable
  drm: add missing drm_mode_set_crtcinfo call
  drm/i915: Update CDCLK_FREQ register on BDW after changing cdclk frequency
  drm/i915: Update ifdeffery for mutex->owner
  drm/i915: Refresh cached DP port register value on resume
  drm/i915/ilk: Don't disable SSC source if it's in use
  drm/nouveau/disp/sor/gf119: select correct sor when poking training pattern
  drm/nouveau: fix for disabled fbdev emulation
  drm/nouveau/fbcon: fix out-of-bounds memory accesses
  drm/nouveau/gr/gf100-: update sm error decoding from gk20a nvgpu headers
  drm/nouveau/disp/sor/gf119: both links use the same training register
  virtio_balloon: fix PFN format for virtio-1
  drm/dp/mst: Always clear proposed vcpi table for port.
  drm/amdkfd: destroy dbgmgr in notifier release
  drm/amdkfd: unbind only existing processes
  ubi: Make recover_peb power cut aware
  drm/amdgpu/gfx7: fix broken condition check
  drm/radeon: fix asic initialization for virtualized environments
  btrfs: account for non-CoW'd blocks in btrfs_abort_transaction
  percpu: fix synchronization between synchronous map extension and chunk destruction
  percpu: fix synchronization between chunk->map_extend_work and chunk destruction
  af_unix: fix hard linked sockets on overlay
  vfs: add d_real_inode() helper
  arm64: Rework valid_user_regs
  ipmi: Remove smi_msg from waiting_rcv_msgs list before handle_one_recv_msg()
  drm/mgag200: Black screen fix for G200e rev 4
  iommu/amd: Fix unity mapping initialization race
  iommu/vt-d: Enable QI on all IOMMUs before setting root entry
  iommu/arm-smmu: Wire up map_sg for arm-smmu-v3
  base: make module_create_drivers_dir race-free
  tracing: Handle NULL formats in hold_module_trace_bprintk_format()
  HID: multitouch: enable palm rejection for Windows Precision Touchpad
  HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands
  HID: elo: kill not flush the work
  KVM: nVMX: VMX instructions: fix segment checks when L1 is in long mode.
  kvm: Fix irq route entries exceeding KVM_MAX_IRQ_ROUTES
  KEYS: potential uninitialized variable
  ARCv2: LLSC: software backoff is NOT needed starting HS2.1c
  ARCv2: Check for LL-SC livelock only if LLSC is enabled
  ipv6: Fix mem leak in rt6i_pcpu
  cdc_ncm: workaround for EM7455 "silent" data interface
  net_sched: fix mirrored packets checksum
  packet: Use symmetric hash for PACKET_FANOUT_HASH.
  sched/fair: Fix cfs_rq avg tracking underflow
  UBIFS: Implement ->migratepage()
  mm: Export migrate_page_move_mapping and migrate_page_copy
  MIPS: KVM: Fix modular KVM under QEMU
  ARM: 8579/1: mm: Fix definition of pmd_mknotpresent
  ARM: 8578/1: mm: ensure pmd_present only checks the valid bit
  ARM: imx6ul: Fix Micrel PHY mask
  NFS: Fix another OPEN_DOWNGRADE bug
  make nfs_atomic_open() call d_drop() on all ->open_context() errors.
  nfsd: check permissions when setting ACLs
  posix_acl: Add set_posix_acl
  nfsd: Extend the mutex holding region around in nfsd4_process_open2()
  nfsd: Always lock state exclusively.
  nfsd4/rpc: move backchannel create logic into rpc code
  writeback: use higher precision calculation in domain_dirty_limits()
  thermal: cpu_cooling: fix improper order during initialization
  uvc: Forward compat ioctls to their handlers directly
  Revert "gpiolib: Split GPIO flags parsing and GPIO configuration"
  x86/amd_nb: Fix boot crash on non-AMD systems
  kprobes/x86: Clear TF bit in fault on single-stepping
  x86, build: copy ldlinux.c32 to image.iso
  locking/static_key: Fix concurrent static_key_slow_inc()
  locking/qspinlock: Fix spin_unlock_wait() some more
  locking/ww_mutex: Report recursive ww_mutex locking early
  of: irq: fix of_irq_get[_byname]() kernel-doc
  of: fix autoloading due to broken modalias with no 'compatible'
  mnt: If fs_fully_visible fails call put_filesystem.
  mnt: Account for MS_RDONLY in fs_fully_visible
  mnt: fs_fully_visible test the proper mount for MNT_LOCKED
  usb: common: otg-fsm: add license to usb-otg-fsm
  USB: EHCI: declare hostpc register as zero-length array
  usb: dwc2: fix regression on big-endian PowerPC/ARM systems
  powerpc/tm: Always reclaim in start_thread() for exec() class syscalls
  powerpc/pseries: Fix IBM_ARCH_VEC_NRCORES_OFFSET since POWER8NVL was added
  powerpc/pseries: Fix PCI config address for DDW
  powerpc/iommu: Remove the dependency on EEH struct in DDW mechanism
  IB/mlx4: Properly initialize GRH TClass and FlowLabel in AHs
  IB/cm: Fix a recently introduced locking bug
  EDAC, sb_edac: Fix rank lookup on Broadwell
  mac80211: Fix mesh estab_plinks counting in STA removal case
  mac80211_hwsim: Add missing check for HWSIM_ATTR_SIGNAL
  mac80211: mesh: flush mesh paths unconditionally
  mac80211: fix fast_tx header alignment
  Linux 4.4.15
  usb: dwc3: exynos: Fix deferred probing storm.
  usb: host: ehci-tegra: Grab the correct UTMI pads reset
  usb: gadget: fix spinlock dead lock in gadgetfs
  USB: mos7720: delete parport
  xhci: Fix handling timeouted commands on hosts in weird states.
  USB: xhci: Add broken streams quirk for Frescologic device id 1009
  usb: xhci-plat: properly handle probe deferral for devm_clk_get()
  xhci: Cleanup only when releasing primary hcd
  usb: musb: host: correct cppi dma channel for isoch transfer
  usb: musb: Ensure rx reinit occurs for shared_fifo endpoints
  usb: musb: Stop bulk endpoint while queue is rotated
  usb: musb: only restore devctl when session was set in backup
  usb: quirks: Add no-lpm quirk for Acer C120 LED Projector
  usb: quirks: Fix sorting
  USB: uas: Fix slave queue_depth not being set
  crypto: user - re-add size check for CRYPTO_MSG_GETALG
  crypto: ux500 - memmove the right size
  crypto: vmx - Increase priority of aes-cbc cipher
  AX.25: Close socket connection on session completion
  bpf: try harder on clones when writing into skb
  net: alx: Work around the DMA RX overflow issue
  net: macb: fix default configuration for GMAC on AT91
  neigh: Explicitly declare RCU-bh read side critical section in neigh_xmit()
  bpf, perf: delay release of BPF prog after grace period
  sock_diag: do not broadcast raw socket destruction
  Bridge: Fix ipv6 mc snooping if bridge has no ipv6 address
  ipmr/ip6mr: Initialize the last assert time of mfc entries.
  netem: fix a use after free
  esp: Fix ESN generation under UDP encapsulation
  sit: correct IP protocol used in ipip6_err
  net: Don't forget pr_fmt on net_dbg_ratelimited for CONFIG_DYNAMIC_DEBUG
  net_sched: fix pfifo_head_drop behavior vs backlog
  sdcardfs: Truncate packages_gid.list on overflow
  UPSTREAM: cdc_ncm: do not call usbnet_link_change from cdc_ncm_bind
  BACKPORT: proc: add /proc/<pid>/timerslack_ns interface
  BACKPORT: timer: convert timer_slack_ns from unsigned long to u64
  netfilter: xt_quota2: make quota2_log work well
  Revert "usb: gadget: prevent change of Host MAC address of 'usb0' interface"
  BACKPORT: PM / sleep: Go direct_complete if driver has no callbacks
  ANDROID: base-cfg: enable UID_CPUTIME
  UPSTREAM: USB: usbfs: fix potential infoleak in devio
  UPSTREAM: ALSA: timer: Fix leak in events via snd_timer_user_ccallback
  UPSTREAM: ALSA: timer: Fix leak in events via snd_timer_user_tinterrupt
  UPSTREAM: ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS
  ANDROID: configs: remove unused configs
  ANDROID: cpu: send KOBJ_ONLINE event when enabling cpus
  ANDROID: dm verity fec: initialize recursion level
  ANDROID: dm verity fec: fix RS block calculation
  Linux 4.4.14
  netfilter: x_tables: introduce and use xt_copy_counters_from_user
  netfilter: x_tables: do compat validation via translate_table
  netfilter: x_tables: xt_compat_match_from_user doesn't need a retval
  netfilter: ip6_tables: simplify translate_compat_table args
  netfilter: ip_tables: simplify translate_compat_table args
  netfilter: arp_tables: simplify translate_compat_table args
  netfilter: x_tables: don't reject valid target size on some architectures
  netfilter: x_tables: validate all offsets and sizes in a rule
  netfilter: x_tables: check for bogus target offset
  netfilter: x_tables: check standard target size too
  netfilter: x_tables: add compat version of xt_check_entry_offsets
  netfilter: x_tables: assert minimum target size
  netfilter: x_tables: kill check_entry helper
  netfilter: x_tables: add and use xt_check_entry_offsets
  netfilter: x_tables: validate targets of jumps
  netfilter: x_tables: don't move to non-existent next rule
  drm/core: Do not preserve framebuffer on rmfb, v4.
  crypto: qat - fix adf_ctl_drv.c:undefined reference to adf_init_pf_wq
  netfilter: x_tables: fix unconditional helper
  netfilter: x_tables: make sure e->next_offset covers remaining blob size
  netfilter: x_tables: validate e->target_offset early
  MIPS: Fix 64k page support for 32 bit kernels.
  sparc64: Fix return from trap window fill crashes.
  sparc: Harden signal return frame checks.
  sparc64: Take ctx_alloc_lock properly in hugetlb_setup().
  sparc64: Reduce TLB flushes during hugepte changes
  sparc/PCI: Fix for panic while enabling SR-IOV
  sparc64: Fix sparc64_set_context stack handling.
  sparc64: Fix numa node distance initialization
  sparc64: Fix bootup regressions on some Kconfig combinations.
  sparc: Fix system call tracing register handling.
  fix d_walk()/non-delayed __d_free() race
  sched: panic on corrupted stack end
  proc: prevent stacking filesystems on top
  x86/entry/traps: Don't force in_interrupt() to return true in IST handlers
  wext: Fix 32 bit iwpriv compatibility issue with 64 bit Kernel
  ecryptfs: forbid opening files without mmap handler
  memcg: add RCU locking around css_for_each_descendant_pre() in memcg_offline_kmem()
  parisc: Fix pagefault crash in unaligned __get_user() call
  pinctrl: mediatek: fix dual-edge code defect
  powerpc/pseries: Add POWER8NVL support to ibm,client-architecture-support call
  powerpc: Use privileged SPR number for MMCR2
  powerpc: Fix definition of SIAR and SDAR registers
  powerpc/pseries/eeh: Handle RTAS delay requests in configure_bridge
  arm64: mm: always take dirty state from new pte in ptep_set_access_flags
  arm64: Provide "model name" in /proc/cpuinfo for PER_LINUX32 tasks
  crypto: ccp - Fix AES XTS error for request sizes above 4096
  crypto: public_key: select CRYPTO_AKCIPHER
  irqchip/gic-v3: Fix ICC_SGI1R_EL1.INTID decoding mask
  s390/bpf: reduce maximum program size to 64 KB
  s390/bpf: fix recache skb->data/hlen for skb_vlan_push/pop
  gpio: bcm-kona: fix bcm_kona_gpio_reset() warnings
  ARM: fix PTRACE_SETVFPREGS on SMP systems
  ALSA: hda/realtek: Add T560 docking unit fixup
  ALSA: hda/realtek - Add support for new codecs ALC700/ALC701/ALC703
  ALSA: hda/realtek - ALC256 speaker noise issue
  ALSA: hda - Fix headset mic detection problem for Dell machine
  ALSA: hda - Add PCI ID for Kabylake
  KVM: irqfd: fix NULL pointer dereference in kvm_irq_map_gsi
  KVM: x86: fix OOPS after invalid KVM_SET_DEBUGREGS
  vxlan, gre, geneve: Set a large MTU on ovs-created tunnel devices
  geneve: Relax MTU constraints
  vxlan: Relax MTU constraints
  ipv6: Skip XFRM lookup if dst_entry in socket cache is valid
  l2tp: fix configuration passed to setup_udp_tunnel_sock()
  bridge: Don't insert unnecessary local fdb entry on changing mac address
  tcp: record TLP and ER timer stats in v6 stats
  vxlan: Accept user specified MTU value when create new vxlan link
  team: don't call netdev_change_features under team->lock
  sfc: on MC reset, clear PIO buffer linkage in TXQs
  bpf, inode: disallow userns mounts
  uapi glibc compat: fix compilation when !__USE_MISC in glibc
  udp: prevent skbs lingering in tunnel socket queues
  bpf: Use mount_nodev not mount_ns to mount the bpf filesystem
  tuntap: correctly wake up process during uninit
  switchdev: pass pointer to fib_info instead of copy
  tipc: fix nametable publication field in nl compat
  netlink: Fix dump skb leak/double free
  tipc: check nl sock before parsing nested attributes
  scsi: Add QEMU CD-ROM to VPD Inquiry Blacklist
  scsi_lib: correctly retry failed zero length REQ_TYPE_FS commands
  cs-etm: associating output packet with CPU they executed on
  cs-etm: removing unecessary structure field
  cs-etm: account for each trace buffer in the queue
  cs-etm: avoid casting variable
  perf tools: fixing Makefile problems
  perf tools: new naming convention for openCSD
  perf scripts: Add python scripts for CoreSight traces
  perf tools: decoding capailitity for CoreSight traces
  perf symbols: Check before overwriting build_id
  perf tools: pushing driver configuration down to the kernel
  perf tools: add infrastructure for PMU specific configuration
  coresight: etm-perf: incorporating sink definition from the cmd line
  coresight: adding sink parameter to function coresight_build_path()
  perf: passing struct perf_event to function setup_aux()
  perf/core: adding PMU driver specific configuration
  perf tools: adding coresight etm PMU record capabilities
  perf tools: making coresight PMU listable
  coresight: tmc: implementing TMC-ETR AUX space API
  coresight: Add support for Juno platform
  coresight: Handle build path error
  coresight: Fix erroneous memset in tmc_read_unprepare_etr
  coresight: Fix tmc_read_unprepare_etr
  coresight: Fix NULL pointer dereference in _coresight_build_path
  ANDROID: dm verity fec: add missing release from fec_ktype
  ANDROID: dm verity fec: limit error correction recursion
  ANDROID: restrict access to perf events
  FROMLIST: security,perf: Allow further restriction of perf_event_open
  BACKPORT: perf tools: Document the perf sysctls
  Revert "armv6 dcc tty driver"
  Revert "arm: dcc_tty: fix armv6 dcc tty build failure"
  ARM64: Ignore Image-dtb from git point of view
  arm64: add option to build Image-dtb
  ANDROID: usb: gadget: f_midi: set fi->f to NULL when free f_midi function
  Linux 4.4.13
  xfs: handle dquot buffer readahead in log recovery correctly
  xfs: print name of verifier if it fails
  xfs: skip stale inodes in xfs_iflush_cluster
  xfs: fix inode validity check in xfs_iflush_cluster
  xfs: xfs_iflush_cluster fails to abort on error
  xfs: Don't wrap growfs AGFL indexes
  xfs: disallow rw remount on fs with unknown ro-compat features
  gcov: disable tree-loop-im to reduce stack usage
  scripts/package/Makefile: rpmbuild add support of RPMOPTS
  dma-debug: avoid spinlock recursion when disabling dma-debug
  PM / sleep: Handle failures in device_suspend_late() consistently
  ext4: silence UBSAN in ext4_mb_init()
  ext4: address UBSAN warning in mb_find_order_for_block()
  ext4: fix oops on corrupted filesystem
  ext4: clean up error handling when orphan list is corrupted
  ext4: fix hang when processing corrupted orphaned inode list
  drm/imx: Match imx-ipuv3-crtc components using device node in platform data
  drm/i915: Don't leave old junk in ilk active watermarks on readout
  drm/atomic: Verify connector->funcs != NULL when clearing states
  drm/fb_helper: Fix references to dev->mode_config.num_connector
  drm/i915/fbdev: Fix num_connector references in intel_fb_initial_config()
  drm/amdgpu: Fix hdmi deep color support.
  drm/amdgpu: use drm_mode_vrefresh() rather than mode->vrefresh
  drm/vmwgfx: Fix order of operation
  drm/vmwgfx: use vmw_cmd_dx_cid_check for query commands.
  drm/vmwgfx: Enable SVGA_3D_CMD_DX_SET_PREDICATION
  drm/gma500: Fix possible out of bounds read
  sunrpc: fix stripping of padded MIC tokens
  xen: use same main loop for counting and remapping pages
  xen/events: Don't move disabled irqs
  powerpc/eeh: Restore initial state in eeh_pe_reset_and_recover()
  Revert "powerpc/eeh: Fix crash in eeh_add_device_early() on Cell"
  powerpc/eeh: Don't report error in eeh_pe_reset_and_recover()
  powerpc/book3s64: Fix branching to OOL handlers in relocatable kernel
  pipe: limit the per-user amount of pages allocated in pipes
  QE-UART: add "fsl,t1040-ucc-uart" to of_device_id
  wait/ptrace: assume __WALL if the child is traced
  mm: use phys_addr_t for reserve_bootmem_region() arguments
  media: v4l2-compat-ioctl32: fix missing reserved field copy in put_v4l2_create32
  PCI: Disable all BAR sizing for devices with non-compliant BARs
  pinctrl: exynos5440: Use off-stack memory for pinctrl_gpio_range
  clk: bcm2835: divider value has to be 1 or more
  clk: bcm2835: pll_off should only update CM_PLL_ANARST
  clk: at91: fix check of clk_register() returned value
  clk: bcm2835: Fix PLL poweron
  cpuidle: Fix cpuidle_state_is_coupled() argument in cpuidle_enter()
  cpuidle: Indicate when a device has been unregistered
  PM / Runtime: Fix error path in pm_runtime_force_resume()
  mfd: intel_soc_pmic_core: Terminate panel control GPIO lookup table correctly
  mfd: intel-lpss: Save register context on suspend
  hwmon: (ads7828) Enable internal reference
  aacraid: Fix for KDUMP driver hang
  aacraid: Fix for aac_command_thread hang
  aacraid: Relinquish CPU during timeout wait
  rtlwifi: pci: use dev_kfree_skb_irq instead of kfree_skb in rtl_pci_reset_trx_ring
  rtlwifi: Fix logic error in enter/exit power-save mode
  rtlwifi: btcoexist: Implement antenna selection
  rtlwifi: rtl8723be: Add antenna select module parameter
  hwrng: exynos - Fix unbalanced PM runtime put on timeout error path
  ath5k: Change led pin configuration for compaq c700 laptop
  ath10k: fix kernel panic, move arvifs list head init before htt init
  ath10k: fix rx_channel during hw reconfigure
  ath10k: fix firmware assert in monitor mode
  ath10k: fix debugfs pktlog_filter write
  ath9k: Fix LED polarity for some Mini PCI AR9220 MB92 cards.
  ath9k: Add a module parameter to invert LED polarity.
  ARM: dts: imx35: restore existing used clock enumeration
  ARM: dts: exynos: Add interrupt line to MAX8997 PMIC on exynos4210-trats
  ARM: dts: at91: fix typo in sama5d2 PIN_PD24 description
  ARM: mvebu: fix GPIO config on the Linksys boards
  Input: uinput - handle compat ioctl for UI_SET_PHYS
  ASoC: ak4642: Enable cache usage to fix crashes on resume
  affs: fix remount failure when there are no options changed
  MIPS: VDSO: Build with `-fno-strict-aliasing'
  MIPS: lib: Mark intrinsics notrace
  MIPS: Build microMIPS VDSO for microMIPS kernels
  MIPS: Fix sigreturn via VDSO on microMIPS kernel
  MIPS: ptrace: Prevent writes to read-only FCSR bits
  MIPS: ptrace: Fix FP context restoration FCSR regression
  MIPS: Disable preemption during prctl(PR_SET_FP_MODE, ...)
  MIPS: Prevent "restoration" of MSA context in non-MSA kernels
  MIPS: Fix MSA ld_*/st_* asm macros to use PTR_ADDU
  MIPS: Use copy_s.fmt rather than copy_u.fmt
  MIPS: Loongson-3: Reserve 32MB for RS780E integrated GPU
  MIPS: Reserve nosave data for hibernation
  MIPS: ath79: make bootconsole wait for both THRE and TEMT
  MIPS: Sync icache & dcache in set_pte_at
  MIPS: Handle highmem pages in __update_cache
  MIPS: Flush highmem pages in __flush_dcache_page
  MIPS: Fix watchpoint restoration
  MIPS: Fix uapi include in exported asm/siginfo.h
  MIPS: Fix siginfo.h to use strict posix types
  MIPS: Avoid using unwind_stack() with usermode
  MIPS: Don't unwind to user mode with EVA
  MIPS: MSA: Fix a link error on `_init_msa_upper' with older GCC
  MIPS: math-emu: Fix jalr emulation when rd == $0
  MIPS64: R6: R2 emulation bugfix
  coresight: etb10: adjust read pointer only when needed
  coresight: configuring ETF in FIFO mode when acting as link
  coresight: tmc: implementing TMC-ETF AUX space API
  coresight: moving struct cs_buffers to header file
  coresight: tmc: keep track of memory width
  coresight: tmc: make sysFS and Perf mode mutually exclusive
  coresight: tmc: dump system memory content only when needed
  coresight: tmc: adding mode of operation for link/sinks
  coresight: tmc: getting rid of multiple read access
  coresight: tmc: allocating memory when needed
  coresight: tmc: making prepare/unprepare functions generic
  coresight: tmc: splitting driver in ETB/ETF and ETR components
  coresight: tmc: cleaning up header file
  coresight: tmc: introducing new header file
  coresight: tmc: clearly define number of transfers per burst
  coresight: tmc: re-implementing tmc_read_prepare/unprepare() functions
  coresight: tmc: waiting for TMCReady bit before programming
  coresight: tmc: modifying naming convention
  coresight: tmc: adding sysFS management entries
  coresight: etm4x: add tracer ID for A72 Maia processor.
  coresight: etb10: fixing the right amount of words to read
  coresight: stm: adding driver for CoreSight STM component
  coresight: adding path for STM device
  coresight: etm4x: modify q_support type
  coresight: no need to do the forced type conversion
  coresight: removing gratuitous boot time log messages
  coresight: etb10: splitting sysFS "status" entry
  coresight: moving coresight_simple_func() to header file
  coresight: etm4x: implementing the perf PMU API
  coresight: etm4x: implementing user/kernel mode tracing
  coresight: etm4x: moving etm_drvdata::enable to atomic field
  coresight: etm4x: unlocking tracers in default arch init
  coresight: etm4x: splitting etmv4 default configuration
  coresight: etm4x: splitting struct etmv4_drvdata
  coresight: etm4x: adding config and traceid registers
  coresight: etm4x: moving sysFS entries to a dedicated file
  stm class: Support devices that override software assigned masters
  stm class: Remove unnecessary pointer increment
  stm class: Fix stm device initialization order
  stm class: Do not leak the chrdev in error path
  stm class: Remove a pointless line
  stm class: stm_heartbeat: Make nr_devs parameter read-only
  stm class: dummy_stm: Make nr_dummies parameter read-only
  MAINTAINERS: Add a git tree for the stm class
  perf/ring_buffer: Document AUX API usage
  perf/core: Free AUX pages in unmap path
  perf/ring_buffer: Refuse to begin AUX transaction after rb->aux_mmap_count drops
  perf auxtrace: Add perf_evlist pointer to *info_priv_size()
  perf session: Simplify tool stubs
  perf inject: Hit all DSOs for AUX data in JIT and other cases
  perf tools: tracepoint_error() can receive e=NULL, robustify it
  perf evlist: Make perf_evlist__open() open evsels with their cpus and threads (like perf record does)
  perf evsel: Introduce disable() method
  perf cpumap: Auto initialize cpu__max_{node,cpu}
  drivers/hwtracing: make coresight-etm-perf.c explicitly non-modular
  drivers/hwtracing: make coresight-* explicitly non-modular
  coresight: introducing a global trace ID function
  coresight: etm-perf: new PMU driver for ETM tracers
  coresight: etb10: implementing AUX API
  coresight: etb10: adding operation mode for sink->enable()
  coresight: etb10: moving to local atomic operations
  coresight: etm3x: implementing perf_enable/disable() API
  coresight: etm3x: implementing user/kernel mode tracing
  coresight: etm3x: consolidating initial config
  coresight: etm3x: changing default trace configuration
  coresight: etm3x: set progbit to stop trace collection
  coresight: etm3x: adding operation mode for etm_enable()
  coresight: etm3x: splitting struct etm_drvdata
  coresight: etm3x: unlocking tracers in default arch init
  coresight: etm3x: moving sysFS entries to dedicated file
  coresight: etm3x: moving etm_readl/writel to header file
  coresight: moving PM runtime operations to core framework
  coresight: add API to get sink from path
  coresight: associating path with session rather than tracer
  coresight: etm4x: Check every parameter used by dma_xx_coherent.
  coresight: "DEVICE_ATTR_RO" should defined as static.
  coresight: implementing 'cpu_id()' API
  coresight: removing bind/unbind options from sysfs
  coresight: remove csdev's link from topology
  coresight: release reference taken by 'bus_find_device()'
  coresight: coresight_unregister() function cleanup
  coresight: fixing lockdep error
  coresight: fixing indentation problem
  coresight: Fix a typo in Kconfig
  coresight: checking for NULL string in coresight_name_match()
  perf/core: Disable the event on a truncated AUX record
  perf/core: Don't leak event in the syscall error path
  perf/core: Fix perf_sched_count derailment
  stm class: dummy_stm: Add link callback for fault injection
  stm class: Plug stm device's unlink callback
  stm class: Fix a race in unlinking
  stm class: Fix unbalanced module/device refcounting
  stm class: Guard output assignment against concurrency
  stm class: Fix unlocking braino in the error path
  stm class: Add heartbeat stm source device
  stm class: dummy_stm: Create multiple devices
  stm class: Support devices with multiple instances
  stm class: Use driver's packet callback return value
  stm class: Prevent user-controllable allocations
  stm class: Fix link list locking
  stm class: Fix locking in unbinding policy path
  stm class: Select CONFIG_SRCU
  stm class: Hide STM-specific options if STM is disabled
  perf: Synchronously free aux pages in case of allocation failure
  Linux 4.4.12
  kbuild: move -Wunused-const-variable to W=1 warning level
  Revert "scsi: fix soft lockup in scsi_remove_target() on module removal"
  scsi: Add intermediate STARGET_REMOVE state to scsi_target_state
  hpfs: implement the show_options method
  hpfs: fix remount failure when there are no options changed
  UBI: Fix static volume checks when Fastmap is used
  SIGNAL: Move generic copy_siginfo() to signal.h
  thunderbolt: Fix double free of drom buffer
  IB/srp: Fix a debug kernel crash
  ALSA: hda - Fix headset mic detection problem for one Dell machine
  ALSA: hda/realtek - Add support for ALC295/ALC3254
  ALSA: hda - Fix headphone noise on Dell XPS 13 9360
  ALSA: hda/realtek - New codecs support for ALC234/ALC274/ALC294
  mcb: Fixed bar number assignment for the gdd
  clk: bcm2835: add locking to pll*_on/off methods
  locking,qspinlock: Fix spin_is_locked() and spin_unlock_wait()
  serial: samsung: Reorder the sequence of clock control when call s3c24xx_serial_set_termios()
  serial: 8250_mid: recognize interrupt source in handler
  serial: 8250_mid: use proper bar for DNV platform
  serial: 8250_pci: fix divide error bug if baud rate is 0
  Fix OpenSSH pty regression on close
  tty/serial: atmel: fix hardware handshake selection
  TTY: n_gsm, fix false positive WARN_ON
  tty: vt, return error when con_startup fails
  xen/x86: actually allocate legacy interrupts on PV guests
  KVM: x86: mask CPUID(0xD,0x1).EAX against host value
  MIPS: KVM: Fix timer IRQ race when writing CP0_Compare
  MIPS: KVM: Fix timer IRQ race when freezing timer
  KVM: x86: fix ordering of cr0 initialization code in vmx_cpu_reset
  KVM: MTRR: remove MSR 0x2f8
  staging: comedi: das1800: fix possible NULL dereference
  usb: gadget: udc: core: Fix argument of dev_err() in usb_gadget_map_request()
  USB: leave LPM alone if possible when binding/unbinding interface drivers
  usb: misc: usbtest: fix pattern tests for scatterlists.
  usb: f_mass_storage: test whether thread is running before starting another
  usb: gadget: f_fs: Fix EFAULT generation for async read operations
  USB: serial: option: add even more ZTE device ids
  USB: serial: option: add more ZTE device ids
  USB: serial: option: add support for Cinterion PH8 and AHxx
  USB: serial: io_edgeport: fix memory leaks in probe error path
  USB: serial: io_edgeport: fix memory leaks in attach error path
  USB: serial: quatech2: fix use-after-free in probe error path
  USB: serial: keyspan: fix use-after-free in probe error path
  USB: serial: mxuport: fix use-after-free in probe error path
  mei: bus: call mei_cl_read_start under device lock
  mei: amthif: discard not read messages
  mei: fix NULL dereferencing during FW initiated disconnection
  Bluetooth: vhci: Fix race at creating hci device
  Bluetooth: vhci: purge unhandled skbs
  Bluetooth: vhci: fix open_timeout vs. hdev race
  mmc: sdhci-pci: Remove MMC_CAP_BUS_WIDTH_TEST for Intel controllers
  mmc: longer timeout for long read time quirk
  dell-rbtn: Ignore ACPI notifications if device is suspended
  ACPI / osi: Fix an issue that acpi_osi=!* cannot disable ACPICA internal strings
  mmc: sdhci-acpi: Remove MMC_CAP_BUS_WIDTH_TEST for Intel controllers
  mmc: mmc: Fix partition switch timeout for some eMMCs
  can: fix handling of unmodifiable configuration options
  irqchip/gic-v3: Configure all interrupts as non-secure Group-1
  irqchip/gic: Ensure ordering between read of INTACK and shared data
  Input: pwm-beeper - fix - scheduling while atomic
  mfd: omap-usb-tll: Fix scheduling while atomic BUG
  sched/loadavg: Fix loadavg artifacts on fully idle and on fully loaded systems
  clk: qcom: msm8916: Fix crypto clock flags
  crypto: sun4i-ss - Replace spinlock_bh by spin_lock_irq{save|restore}
  crypto: talitos - fix ahash algorithms registration
  crypto: caam - fix caam_jr_alloc() ret code
  ring-buffer: Prevent overflow of size in ring_buffer_resize()
  ring-buffer: Use long for nr_pages to avoid overflow failures
  asix: Fix offset calculation in asix_rx_fixup() causing slow transmissions
  fs/cifs: correctly to anonymous authentication for the NTLM(v2) authentication
  fs/cifs: correctly to anonymous authentication for the NTLM(v1) authentication
  fs/cifs: correctly to anonymous authentication for the LANMAN authentication
  fs/cifs: correctly to anonymous authentication via NTLMSSP
  remove directory incorrectly tries to set delete on close on non-empty directories
  kvm: arm64: Fix EC field in inject_abt64
  arm/arm64: KVM: Enforce Break-Before-Make on Stage-2 page tables
  arm64: cpuinfo: Missing NULL terminator in compat_hwcap_str
  arm64: Implement pmdp_set_access_flags() for hardware AF/DBM
  arm64: Implement ptep_set_access_flags() for hardware AF/DBM
  arm64: Ensure pmd_present() returns false after pmd_mknotpresent()
  arm64: Fix typo in the pmdp_huge_get_and_clear() definition
  ext4: iterate over buffer heads correctly in move_extent_per_page()
  perf test: Fix build of BPF and LLVM on older glibc libraries
  perf/core: Fix perf_event_open() vs. execve() race
  perf/x86/intel/pt: Generate PMI in the STOP region as well
  Btrfs: don't use src fd for printk
  UPSTREAM: mac80211: fix "warning: ‘target_metric’ may be used uninitialized"
  Revert "drivers: power: use 'current' instead of 'get_current()'"
  cpufreq: interactive: drop cpufreq_{get,put}_global_kobject func calls
  Revert "cpufreq: interactive: build fixes for 4.4"
  xt_qtaguid: Fix panic caused by processing non-full socket.
  fiq_debugger: Add fiq_debugger.disable option
  UPSTREAM: procfs: fixes pthread cross-thread naming if !PR_DUMPABLE
  FROMLIST: wlcore: Disable filtering in AP role
  Revert "drivers: power: Add watchdog timer to catch drivers which lockup during suspend."
  fiq_debugger: Add option to apply uart overlay by FIQ_DEBUGGER_UART_OVERLAY
  Revert "Recreate asm/mach/mmc.h include file"
  Revert "ARM: Add 'card_present' state to mmc_platfrom_data"
  usb: dual-role: make stub functions inline
  Revert "mmc: Add status IRQ and status callback function to mmc platform data"
  quick selinux support for tracefs
  Revert "hid-multitouch: Filter collections by application usage."
  Revert "HID: steelseries: validate output report details"
  xt_qtaguid: Fix panic caused by synack processing
  Revert "mm: vmscan: Add a debug file for shrinkers"
  Revert "SELinux: Enable setting security contexts on rootfs inodes."
  Revert "SELinux: build fix for 4.1"
  fuse: Add support for d_canonical_path
  vfs: change d_canonical_path to take two paths
  android: recommended.cfg: remove CONFIG_UID_STAT
  netfilter: xt_qtaguid: seq_printf fixes
  Revert "misc: uidstat: Adding uid stat driver to collect network statistics."
  Revert "net: activity_stats: Add statistics for network transmission activity"
  Revert "net: activity_stats: Stop using obsolete create_proc_read_entry api"
  Revert "misc: uidstat: avoid create_stat() race and blockage."
  Revert "misc: uidstat: Remove use of obsolete create_proc_read_entry api"
  Revert "misc seq_printf fixes for 4.4"
  Revert "misc: uid_stat: Include linux/atomic.h instead of asm/atomic.h"
  Revert "net: socket ioctl to reset connections matching local address"
  Revert "net: fix iterating over hashtable in tcp_nuke_addr()"
  Revert "net: fix crash in tcp_nuke_addr()"
  Revert "Don't kill IPv4 sockets when killing IPv6 sockets was requested."
  Revert "tcp: Fix IPV6 module build errors"
  android: base-cfg: remove CONFIG_SWITCH
  Revert "switch: switch class and GPIO drivers."
  Revert "drivers: switch: remove S_IWUSR from dev_attr"
  ANDROID: base-cfg: enable CONFIG_IP_NF_NAT
  BACKPORT: selinux: restrict kernel module loading
  android: base-cfg: enable CONFIG_QUOTA

Conflicts:
	Documentation/sysctl/kernel.txt
	drivers/cpufreq/cpufreq_interactive.c
	drivers/hwtracing/coresight/Kconfig
	drivers/hwtracing/coresight/Makefile
	drivers/hwtracing/coresight/coresight-etm4x.c
	drivers/hwtracing/coresight/coresight-etm4x.h
	drivers/hwtracing/coresight/coresight-priv.h
	drivers/hwtracing/coresight/coresight-stm.c
	drivers/hwtracing/coresight/coresight-tmc.c
	drivers/mmc/core/core.c
	include/linux/coresight-stm.h
	include/linux/coresight.h
	include/linux/msm_mdp.h
	include/uapi/linux/coresight-stm.h
	kernel/events/core.c
	kernel/sched/fair.c
	net/Makefile
	net/ipv4/netfilter/arp_tables.c
	net/ipv4/netfilter/ip_tables.c
	net/ipv4/tcp.c
	net/ipv6/netfilter/ip6_tables.c
	net/netfilter/xt_quota2.c
	sound/core/pcm.c

Change-Id: I17aa0002815014e9bddc47e67769a53c15768a99
Signed-off-by: Runmin Wang <runminw@codeaurora.org>
2016-10-28 10:48:35 -07:00
Runmin Wang
617229a3e9 Merge remote-tracking branch 'msm-4.4/tmp-510d0a3f' into msm-4.4
* msm-4.4/tmp-510d0a3f:
  Linux 4.4.11
  nf_conntrack: avoid kernel pointer value leak in slab name
  drm/radeon: fix DP link training issue with second 4K monitor
  drm/i915/bdw: Add missing delay during L3 SQC credit programming
  drm/i915: Bail out of pipe config compute loop on LPT
  drm/radeon: fix PLL sharing on DCE6.1 (v2)
  Revert "[media] videobuf2-v4l2: Verify planes array in buffer dequeueing"
  Input: max8997-haptic - fix NULL pointer dereference
  get_rock_ridge_filename(): handle malformed NM entries
  tools lib traceevent: Do not reassign parg after collapse_tree()
  qla1280: Don't allocate 512kb of host tags
  atomic_open(): fix the handling of create_error
  regulator: axp20x: Fix axp22x ldo_io voltage ranges
  regulator: s2mps11: Fix invalid selector mask and voltages for buck9
  workqueue: fix rebind bound workers warning
  ARM: dts: at91: sam9x5: Fix the memory range assigned to the PMC
  vfs: rename: check backing inode being equal
  vfs: add vfs_select_inode() helper
  perf/core: Disable the event on a truncated AUX record
  regmap: spmi: Fix regmap_spmi_ext_read in multi-byte case
  pinctrl: at91-pio4: fix pull-up/down logic
  spi: spi-ti-qspi: Handle truncated frames properly
  spi: spi-ti-qspi: Fix FLEN and WLEN settings if bits_per_word is overridden
  spi: pxa2xx: Do not detect number of enabled chip selects on Intel SPT
  ALSA: hda - Fix broken reconfig
  ALSA: hda - Fix white noise on Asus UX501VW headset
  ALSA: hda - Fix subwoofer pin on ASUS N751 and N551
  ALSA: usb-audio: Yet another Phoneix Audio device quirk
  ALSA: usb-audio: Quirk for yet another Phoenix Audio devices (v2)
  crypto: testmgr - Use kmalloc memory for RSA input
  crypto: hash - Fix page length clamping in hash walk
  crypto: qat - fix invalid pf2vf_resp_wq logic
  s390/mm: fix asce_bits handling with dynamic pagetable levels
  zsmalloc: fix zs_can_compact() integer overflow
  ocfs2: fix posix_acl_create deadlock
  ocfs2: revert using ocfs2_acl_chmod to avoid inode cluster lock hang
  net/route: enforce hoplimit max value
  tcp: refresh skb timestamp at retransmit time
  net: thunderx: avoid exposing kernel stack
  net: fix a kernel infoleak in x25 module
  uapi glibc compat: fix compile errors when glibc net/if.h included before linux/if.h MIME-Version: 1.0
  bridge: fix igmp / mld query parsing
  net: bridge: fix old ioctl unlocked net device walk
  VSOCK: do not disconnect socket when peer has shutdown SEND only
  net/mlx4_en: Fix endianness bug in IPV6 csum calculation
  net: fix infoleak in rtnetlink
  net: fix infoleak in llc
  net: fec: only clear a queue's work bit if the queue was emptied
  netem: Segment GSO packets on enqueue
  sch_dsmark: update backlog as well
  sch_htb: update backlog as well
  net_sched: update hierarchical backlog too
  net_sched: introduce qdisc_replace() helper
  gre: do not pull header in ICMP error processing
  net: Implement net_dbg_ratelimited() for CONFIG_DYNAMIC_DEBUG case
  samples/bpf: fix trace_output example
  bpf: fix check_map_func_compatibility logic
  bpf: fix refcnt overflow
  bpf: fix double-fdput in replace_map_fd_with_map_ptr()
  net/mlx4_en: fix spurious timestamping callbacks
  ipv4/fib: don't warn when primary address is missing if in_dev is dead
  net/mlx5e: Fix minimum MTU
  net/mlx5e: Device's mtu field is u16 and not int
  openvswitch: use flow protocol when recalculating ipv6 checksums
  atl2: Disable unimplemented scatter/gather feature
  vlan: pull on __vlan_insert_tag error path and fix csum correction
  net: use skb_postpush_rcsum instead of own implementations
  cdc_mbim: apply "NDP to end" quirk to all Huawei devices
  bpf/verifier: reject invalid LD_ABS | BPF_DW instruction
  net: sched: do not requeue a NULL skb
  packet: fix heap info leak in PACKET_DIAG_MCLIST sock_diag interface
  route: do not cache fib route info on local routes with oif
  decnet: Do not build routes to devices without decnet private data.
  parisc: Use generic extable search and sort routines
  arm64: kasan: Use actual memory node when populating the kernel image shadow
  arm64: mm: treat memstart_addr as a signed quantity
  arm64: lse: deal with clobbered IP registers after branch via PLT
  arm64: mm: check at build time that PAGE_OFFSET divides the VA space evenly
  arm64: kasan: Fix zero shadow mapping overriding kernel image shadow
  arm64: consistently use p?d_set_huge
  arm64: fix KASLR boot-time I-cache maintenance
  arm64: hugetlb: partial revert of 66b3923a1a0f
  arm64: make irq_stack_ptr more robust
  arm64: efi: invoke EFI_RNG_PROTOCOL to supply KASLR randomness
  efi: stub: use high allocation for converted command line
  efi: stub: add implementation of efi_random_alloc()
  efi: stub: implement efi_get_random_bytes() based on EFI_RNG_PROTOCOL
  arm64: kaslr: randomize the linear region
  arm64: add support for kernel ASLR
  arm64: add support for building vmlinux as a relocatable PIE binary
  arm64: switch to relative exception tables
  extable: add support for relative extables to search and sort routines
  scripts/sortextable: add support for ET_DYN binaries
  arm64: futex.h: Add missing PAN toggling
  arm64: make asm/elf.h available to asm files
  arm64: avoid dynamic relocations in early boot code
  arm64: avoid R_AARCH64_ABS64 relocations for Image header fields
  arm64: add support for module PLTs
  arm64: move brk immediate argument definitions to separate header
  arm64: mm: use bit ops rather than arithmetic in pa/va translations
  arm64: mm: only perform memstart_addr sanity check if DEBUG_VM
  arm64: User die() instead of panic() in do_page_fault()
  arm64: allow kernel Image to be loaded anywhere in physical memory
  arm64: defer __va translation of initrd_start and initrd_end
  arm64: move kernel image to base of vmalloc area
  arm64: kvm: deal with kernel symbols outside of linear mapping
  arm64: decouple early fixmap init from linear mapping
  arm64: pgtable: implement static [pte|pmd|pud]_offset variants
  arm64: introduce KIMAGE_VADDR as the virtual base of the kernel region
  arm64: add support for ioremap() block mappings
  arm64: prevent potential circular header dependencies in asm/bug.h
  of/fdt: factor out assignment of initrd_start/initrd_end
  of/fdt: make memblock minimum physical address arch configurable
  arm64: Remove the get_thread_info() function
  arm64: kernel: Don't toggle PAN on systems with UAO
  arm64: cpufeature: Test 'matches' pointer to find the end of the list
  arm64: kernel: Add support for User Access Override
  arm64: add ARMv8.2 id_aa64mmfr2 boiler plate
  arm64: cpufeature: Change read_cpuid() to use sysreg's mrs_s macro
  arm64: use local label prefixes for __reg_num symbols
  arm64: vdso: Mark vDSO code as read-only
  arm64: ubsan: select ARCH_HAS_UBSAN_SANITIZE_ALL
  arm64: ptdump: Indicate whether memory should be faulting
  arm64: Add support for ARCH_SUPPORTS_DEBUG_PAGEALLOC
  arm64: Drop alloc function from create_mapping
  arm64: prefetch: add missing #include for spin_lock_prefetch
  arm64: lib: patch in prfm for copy_page if requested
  arm64: lib: improve copy_page to deal with 128 bytes at a time
  arm64: prefetch: add alternative pattern for CPUs without a prefetcher
  arm64: prefetch: don't provide spin_lock_prefetch with LSE
  arm64: allow vmalloc regions to be set with set_memory_*
  arm64: kernel: implement ACPI parking protocol
  arm64: mm: create new fine-grained mappings at boot
  arm64: ensure _stext and _etext are page-aligned
  arm64: mm: allow passing a pgdir to alloc_init_*
  arm64: mm: allocate pagetables anywhere
  arm64: mm: use fixmap when creating page tables
  arm64: mm: add functions to walk tables in fixmap
  arm64: mm: add __{pud,pgd}_populate
  arm64: mm: avoid redundant __pa(__va(x))
  arm64: mm: add functions to walk page tables by PA
  arm64: mm: move pte_* macros
  arm64: kasan: avoid TLB conflicts
  arm64: mm: add code to safely replace TTBR1_EL1
  arm64: add function to install the idmap
  arm64: unmap idmap earlier
  arm64: unify idmap removal
  arm64: mm: place empty_zero_page in bss
  arm64: mm: specialise pagetable allocators
  asm-generic: Fix local variable shadow in __set_fixmap_offset
  Eliminate the .eh_frame sections from the aarch64 vmlinux and kernel modules
  arm64: Fix an enum typo in mm/dump.c
  arm64: kasan: ensure that the KASAN zero page is mapped read-only
  arch/arm64/include/asm/pgtable.h: add pmd_mkclean for THP
  arm64: hide __efistub_ aliases from kallsyms
  Linux 4.4.10
  drm/i915/skl: Fix DMC load on Skylake J0 and K0
  lib/test-string_helpers.c: fix and improve string_get_size() tests
  ACPI / processor: Request native thermal interrupt handling via _OSC
  drm/i915: Fake HDMI live status
  drm/i915: Make RPS EI/thresholds multiple of 25 on SNB-BDW
  drm/i915: Fix eDP low vswing for Broadwell
  drm/i915/ddi: Fix eDP VDD handling during booting and suspend/resume
  drm/radeon: make sure vertical front porch is at least 1
  iio: ak8975: fix maybe-uninitialized warning
  iio: ak8975: Fix NULL pointer exception on early interrupt
  drm/amdgpu: set metadata pointer to NULL after freeing.
  drm/amdgpu: make sure vertical front porch is at least 1
  gpu: ipu-v3: Fix imx-ipuv3-crtc module autoloading
  nvmem: mxs-ocotp: fix buffer overflow in read
  USB: serial: cp210x: add Straizona Focusers device ids
  USB: serial: cp210x: add ID for Link ECU
  ata: ahci-platform: Add ports-implemented DT bindings.
  libahci: save port map for forced port map
  powerpc: Fix bad inline asm constraint in create_zero_mask()
  ACPICA: Dispatcher: Update thread ID for recursive method calls
  x86/sysfb_efi: Fix valid BAR address range check
  ARC: Add missing io barriers to io{read,write}{16,32}be()
  ARM: cpuidle: Pass on arm_cpuidle_suspend()'s return value
  propogate_mnt: Handle the first propogated copy being a slave
  fs/pnode.c: treat zero mnt_group_id-s as unequal
  x86/tsc: Read all ratio bits from MSR_PLATFORM_INFO
  MAINTAINERS: Remove asterisk from EFI directory names
  writeback: Fix performance regression in wb_over_bg_thresh()
  batman-adv: Reduce refcnt of removed router when updating route
  batman-adv: Fix broadcast/ogm queue limit on a removed interface
  batman-adv: Check skb size before using encapsulated ETH+VLAN header
  batman-adv: fix DAT candidate selection (must use vid)
  mm: update min_free_kbytes from khugepaged after core initialization
  proc: prevent accessing /proc/<PID>/environ until it's ready
  Input: zforce_ts - fix dual touch recognition
  HID: Fix boot delay for Creative SB Omni Surround 5.1 with quirk
  HID: wacom: Add support for DTK-1651
  xen/evtchn: fix ring resize when binding new events
  xen/balloon: Fix crash when ballooning on x86 32 bit PAE
  xen: Fix page <-> pfn conversion on 32 bit systems
  ARM: SoCFPGA: Fix secondary CPU startup in thumb2 kernel
  ARM: EXYNOS: Properly skip unitialized parent clock in power domain on
  mm/zswap: provide unique zpool name
  mm, cma: prevent nr_isolated_* counters from going negative
  Minimal fix-up of bad hashing behavior of hash_64()
  MD: make bio mergeable
  tracing: Don't display trigger file for events that can't be enabled
  mac80211: fix statistics leak if dev_alloc_name() fails
  ath9k: ar5008_hw_cmn_spur_mitigate: add missing mask_m & mask_p initialisation
  lpfc: fix misleading indentation
  clk: qcom: msm8960: Fix ce3_src register offset
  clk: versatile: sp810: support reentrance
  clk: qcom: msm8960: fix ce3_core clk enable register
  clk: meson: Fix meson_clk_register_clks() signature type mismatch
  clk: rockchip: free memory in error cases when registering clock branches
  soc: rockchip: power-domain: fix err handle while probing
  clk-divider: make sure read-only dividers do not write to their register
  CNS3xxx: Fix PCI cns3xxx_write_config()
  mwifiex: fix corner case association failure
  ata: ahci_xgene: dereferencing uninitialized pointer in probe
  nbd: ratelimit error msgs after socket close
  mfd: intel-lpss: Remove clock tree on error path
  ipvs: drop first packet to redirect conntrack
  ipvs: correct initial offset of Call-ID header search in SIP persistence engine
  ipvs: handle ip_vs_fill_iph_skb_off failure
  RDMA/iw_cxgb4: Fix bar2 virt addr calculation for T4 chips
  Revert: "powerpc/tm: Check for already reclaimed tasks"
  arm64: head.S: use memset to clear BSS
  efi: stub: define DISABLE_BRANCH_PROFILING for all architectures
  arm64: entry: remove pointless SPSR mode check
  arm64: mm: move pgd_cache initialisation to pgtable_cache_init
  arm64: module: avoid undefined shift behavior in reloc_data()
  arm64: module: fix relocation of movz instruction with negative immediate
  arm64: traps: address fallout from printk -> pr_* conversion
  arm64: ftrace: fix a stack tracer's output under function graph tracer
  arm64: pass a task parameter to unwind_frame()
  arm64: ftrace: modify a stack frame in a safe way
  arm64: remove irq_count and do_softirq_own_stack()
  arm64: hugetlb: add support for PTE contiguous bit
  arm64: Use PoU cache instr for I/D coherency
  arm64: Defer dcache flush in __cpu_copy_user_page
  arm64: reduce stack use in irq_handler
  arm64: Documentation: add list of software workarounds for errata
  arm64: mm: place __cpu_setup in .text
  arm64: cmpxchg: Don't incldue linux/mmdebug.h
  arm64: mm: fold alternatives into .init
  arm64: Remove redundant padding from linker script
  arm64: mm: remove pointless PAGE_MASKing
  arm64: don't call C code with el0's fp register
  arm64: when walking onto the task stack, check sp & fp are in current->stack
  arm64: Add this_cpu_ptr() assembler macro for use in entry.S
  arm64: irq: fix walking from irq stack to task stack
  arm64: Add do_softirq_own_stack() and enable irq_stacks
  arm64: Modify stack trace and dump for use with irq_stack
  arm64: Store struct thread_info in sp_el0
  arm64: Add trace_hardirqs_off annotation in ret_to_user
  arm64: ftrace: fix the comments for ftrace_modify_code
  arm64: ftrace: stop using kstop_machine to enable/disable tracing
  arm64: spinlock: serialise spin_unlock_wait against concurrent lockers
  arm64: enable HAVE_IRQ_TIME_ACCOUNTING
  arm64: fix COMPAT_SHMLBA definition for large pages
  arm64: add __init/__initdata section marker to some functions/variables
  arm64: pgtable: implement pte_accessible()
  arm64: mm: allow sections for unaligned bases
  arm64: mm: detect bad __create_mapping uses
  Linux 4.4.9
  extcon: max77843: Use correct size for reading the interrupt register
  stm class: Select CONFIG_SRCU
  megaraid_sas: add missing curly braces in ioctl handler
  sunrpc/cache: drop reference when sunrpc_cache_pipe_upcall() detects a race
  thermal: rockchip: fix a impossible condition caused by the warning
  unbreak allmodconfig KCONFIG_ALLCONFIG=...
  jme: Fix device PM wakeup API usage
  jme: Do not enable NIC WoL functions on S0
  bus: imx-weim: Take the 'status' property value into account
  ARM: dts: pxa: fix dma engine node to pxa3xx-nand
  ARM: dts: armada-375: use armada-370-sata for SATA
  ARM: EXYNOS: select THERMAL_OF
  ARM: prima2: always enable reset controller
  ARM: OMAP3: Add cpuidle parameters table for omap3430
  ext4: fix races of writeback with punch hole and zero range
  ext4: fix races between buffered IO and collapse / insert range
  ext4: move unlocked dio protection from ext4_alloc_file_blocks()
  ext4: fix races between page faults and hole punching
  perf stat: Document --detailed option
  perf tools: handle spaces in file names obtained from /proc/pid/maps
  perf hists browser: Only offer symbol scripting when a symbol is under the cursor
  mtd: nand: Drop mtd.owner requirement in nand_scan
  mtd: brcmnand: Fix v7.1 register offsets
  mtd: spi-nor: remove micron_quad_enable()
  serial: sh-sci: Remove cpufreq notifier to fix crash/deadlock
  ext4: fix NULL pointer dereference in ext4_mark_inode_dirty()
  x86/mm/kmmio: Fix mmiotrace for hugepages
  perf evlist: Reference count the cpu and thread maps at set_maps()
  drivers/misc/ad525x_dpot: AD5274 fix RDAC read back errors
  rtc: max77686: Properly handle regmap_irq_get_virq() error code
  rtc: rx8025: remove rv8803 id
  rtc: ds1685: passing bogus values to irq_restore
  rtc: vr41xx: Wire up alarm_irq_enable
  rtc: hym8563: fix invalid year calculation
  PM / Domains: Fix removal of a subdomain
  PM / OPP: Initialize u_volt_min/max to a valid value
  misc: mic/scif: fix wrap around tests
  misc/bmp085: Enable building as a module
  lib/mpi: Endianness fix
  fbdev: da8xx-fb: fix videomodes of lcd panels
  scsi_dh: force modular build if SCSI is a module
  paride: make 'verbose' parameter an 'int' again
  regulator: s5m8767: fix get_register() error handling
  irqchip/mxs: Fix error check of of_io_request_and_map()
  irqchip/sunxi-nmi: Fix error check of of_io_request_and_map()
  spi/rockchip: Make sure spi clk is on in rockchip_spi_set_cs
  locking/mcs: Fix mcs_spin_lock() ordering
  regulator: core: Fix nested locking of supplies
  regulator: core: Ensure we lock all regulators
  regulator: core: fix regulator_lock_supply regression
  Revert "regulator: core: Fix nested locking of supplies"
  videobuf2-v4l2: Verify planes array in buffer dequeueing
  videobuf2-core: Check user space planes array in dqbuf
  USB: usbip: fix potential out-of-bounds write
  cgroup: make sure a parent css isn't freed before its children
  mm/hwpoison: fix wrong num_poisoned_pages accounting
  mm: vmscan: reclaim highmem zone if buffer_heads is over limit
  numa: fix /proc/<pid>/numa_maps for THP
  mm/huge_memory: replace VM_NO_THP VM_BUG_ON with actual VMA check
  memcg: relocate charge moving from ->attach to ->post_attach
  cgroup, cpuset: replace cpuset_post_attach_flush() with cgroup_subsys->post_attach callback
  slub: clean up code for kmem cgroup support to kmem_cache_free_bulk
  workqueue: fix ghost PENDING flag while doing MQ IO
  x86/apic: Handle zero vector gracefully in clear_vector_irq()
  efi: Expose non-blocking set_variable() wrapper to efivars
  efi: Fix out-of-bounds read in variable_matches()
  IB/security: Restrict use of the write() interface
  IB/mlx5: Expose correct max_sge_rd limit
  cxl: Keep IRQ mappings on context teardown
  v4l2-dv-timings.h: fix polarity for 4k formats
  vb2-memops: Fix over allocation of frame vectors
  ASoC: rt5640: Correct the digital interface data select
  ASoC: dapm: Make sure we have a card when displaying component widgets
  ASoC: ssm4567: Reset device before regcache_sync()
  ASoC: s3c24xx: use const snd_soc_component_driver pointer
  EDAC: i7core, sb_edac: Don't return NOTIFY_BAD from mce_decoder callback
  toshiba_acpi: Fix regression caused by hotkey enabling value
  i2c: exynos5: Fix possible ABBA deadlock by keeping I2C clock prepared
  i2c: cpm: Fix build break due to incompatible pointer types
  perf intel-pt: Fix segfault tracing transactions
  drm/i915: Use fw_domains_put_with_fifo() on HSW
  drm/i915: Fixup the free space logic in ring_prepare
  drm/amdkfd: uninitialized variable in dbgdev_wave_control_set_registers()
  drm/i915: skl_update_scaler() wants a rotation bitmask instead of bit number
  drm/i915: Cleanup phys status page too
  pwm: brcmstb: Fix check of devm_ioremap_resource() return code
  drm/dp/mst: Get validated port ref in drm_dp_update_payload_part1()
  drm/dp/mst: Restore primary hub guid on resume
  drm/dp/mst: Validate port in drm_dp_payload_send_msg()
  drm/nouveau/gr/gf100: select a stream master to fixup tfb offset queries
  drm: Loongson-3 doesn't fully support wc memory
  drm/radeon: fix vertical bars appear on monitor (v2)
  drm/radeon: forbid mapping of userptr bo through radeon device file
  drm/radeon: fix initial connector audio value
  drm/radeon: add a quirk for a XFX R9 270X
  drm/amdgpu: fix regression on CIK (v2)
  amdgpu/uvd: add uvd fw version for amdgpu
  drm/amdgpu: bump the afmt limit for CZ, ST, Polaris
  drm/amdgpu: use defines for CRTCs and AMFT blocks
  drm/amdgpu: when suspending, if uvd/vce was running. need to cancel delay work.
  iommu/dma: Restore scatterlist offsets correctly
  iommu/amd: Fix checking of pci dma aliases
  pinctrl: single: Fix pcs_parse_bits_in_pinctrl_entry to use __ffs than ffs
  pinctrl: mediatek: correct debounce time unit in mtk_gpio_set_debounce
  xen kconfig: don't "select INPUT_XEN_KBDDEV_FRONTEND"
  Input: pmic8xxx-pwrkey - fix algorithm for converting trigger delay
  Input: gtco - fix crash on detecting device without endpoints
  netlink: don't send NETLINK_URELEASE for unbound sockets
  nl80211: check netlink protocol in socket release notification
  powerpc: Update TM user feature bits in scan_features()
  powerpc: Update cpu_user_features2 in scan_features()
  powerpc: scan_features() updates incorrect bits for REAL_LE
  crypto: talitos - fix AEAD tcrypt tests
  crypto: talitos - fix crash in talitos_cra_init()
  crypto: sha1-mb - use corrcet pointer while completing jobs
  crypto: ccp - Prevent information leakage on export
  iwlwifi: mvm: fix memory leak in paging
  iwlwifi: pcie: lower the debug level for RSA semaphore access
  s390/pci: add extra padding to function measurement block
  cpufreq: intel_pstate: Fix processing for turbo activation ratio
  Revert "drm/amdgpu: disable runtime pm on PX laptops without dGPU power control"
  Revert "drm/radeon: disable runtime pm on PX laptops without dGPU power control"
  drm/i915: Fix race condition in intel_dp_destroy_mst_connector()
  drm/qxl: fix cursor position with non-zero hotspot
  drm/nouveau/core: use vzalloc for allocating ramht
  futex: Acknowledge a new waiter in counter before plist
  futex: Handle unlock_pi race gracefully
  asm-generic/futex: Re-enable preemption in futex_atomic_cmpxchg_inatomic()
  ALSA: hda - Add dock support for ThinkPad X260
  ALSA: pcxhr: Fix missing mutex unlock
  ALSA: hda - add PCI ID for Intel Broxton-T
  ALSA: hda - Keep powering up ADCs on Cirrus codecs
  ALSA: hda/realtek - Add ALC3234 headset mode for Optiplex 9020m
  ALSA: hda - Don't trust the reported actual power state
  x86 EDAC, sb_edac.c: Repair damage introduced when "fixing" channel address
  x86/mm/xen: Suppress hugetlbfs in PV guests
  arm64: Update PTE_RDONLY in set_pte_at() for PROT_NONE permission
  arm64: Honour !PTE_WRITE in set_pte_at() for kernel mappings
  sched/cgroup: Fix/cleanup cgroup teardown/init
  dmaengine: pxa_dma: fix the maximum requestor line
  dmaengine: hsu: correct use of channel status register
  dmaengine: dw: fix master selection
  debugfs: Make automount point inodes permanently empty
  lib: lz4: fixed zram with lz4 on big endian machines
  dm cache metadata: fix cmd_read_lock() acquiring write lock
  dm cache metadata: fix READ_LOCK macros and cleanup WRITE_LOCK macros
  usb: gadget: f_fs: Fix use-after-free
  usb: hcd: out of bounds access in for_each_companion
  xhci: fix 10 second timeout on removal of PCI hotpluggable xhci controllers
  usb: xhci: fix wild pointers in xhci_mem_cleanup
  xhci: resume USB 3 roothub first
  usb: xhci: applying XHCI_PME_STUCK_QUIRK to Intel BXT B0 host
  assoc_array: don't call compare_object() on a node
  ARM: OMAP2+: hwmod: Fix updating of sysconfig register
  ARM: OMAP2: Fix up interconnect barrier initialization for DRA7
  ARM: mvebu: Correct unit address for linksys
  ARM: dts: AM43x-epos: Fix clk parent for synctimer
  KVM: arm/arm64: Handle forward time correction gracefully
  kvm: x86: do not leak guest xcr0 into host interrupt handlers
  x86/mce: Avoid using object after free in genpool
  block: loop: fix filesystem corruption in case of aio/dio
  block: partition: initialize percpuref before sending out KOBJ_ADD

Conflicts:
	arch/arm64/Kconfig
	arch/arm64/include/asm/cputype.h
	arch/arm64/include/asm/hardirq.h
	arch/arm64/include/asm/irq.h
	arch/arm64/include/asm/mmu_context.h
	arch/arm64/kernel/cpu_errata.c
	arch/arm64/kernel/cpuinfo.c
	arch/arm64/kernel/setup.c
	arch/arm64/kernel/smp.c
	arch/arm64/kernel/stacktrace.c
	arch/arm64/mm/init.c
	arch/arm64/mm/mmu.c
	arch/arm64/mm/pageattr.c
	mm/memcontrol.c

CRs-Fixed: 1069136
Signed-off-by: Bryan Huntsman <bryanh@codeaurora.org>
Signed-off-by: Runmin Wang <runminw@codeaurora.org>
Change-Id: Ie9a16debd0578331a66947376f3b787a7bb54d65
2016-10-21 18:00:55 -07:00
Trilok Soni
5ab1e18aa3 Revert "Merge remote-tracking branch 'msm-4.4/tmp-510d0a3f' into msm-4.4"
This reverts commit 9d6fd2c3e9 ("Merge remote-tracking branch
'msm-4.4/tmp-510d0a3f' into msm-4.4"), because it breaks the
dump parsing tools due to kernel can be loaded anywhere in the memory
now and not fixed at linear mapping.

Change-Id: Id416f0a249d803442847d09ac47781147b0d0ee6
Signed-off-by: Trilok Soni <tsoni@codeaurora.org>
2016-08-26 14:34:05 -07:00
Sakari Ailus
33201bcbc3 vb2: core: Skip planes array verification if pb is NULL
commit 126f40298446a82116e1f92a1aaf72b8c8228fae upstream.

An earlier patch fixing an input validation issue introduced another
issue: vb2_core_dqbuf() is called with pb argument value NULL in some
cases, causing a NULL pointer dereference. Fix this by skipping the
verification as there's nothing to verify.

Fixes: e7e0c3e26587 ("[media] videobuf2-core: Check user space planes array in dqbuf")

Signed-off-by: David R <david@unsolicited.net>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-08-20 18:09:18 +02:00
Sakari Ailus
175845952e videobuf2-v4l2: Verify planes array in buffer dequeueing
commit 83934b75c368f529d084815c463a7ef781dc9751 upstream.

When a buffer is being dequeued using VIDIOC_DQBUF IOCTL, the exact buffer
which will be dequeued is not known until the buffer has been removed from
the queue. The number of planes is specific to a buffer, not to the queue.

This does lead to the situation where multi-plane buffers may be requested
and queued with n planes, but VIDIOC_DQBUF IOCTL may be passed an argument
struct with fewer planes.

__fill_v4l2_buffer() however uses the number of planes from the dequeued
videobuf2 buffer, overwriting kernel memory (the m.planes array allocated
in video_usercopy() in v4l2-ioctl.c)  if the user provided fewer
planes than the dequeued buffer had. Oops!

Fixes: b0e0e1f83d ("[media] media: videobuf2: Prepare to divide videobuf2")

Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-08-20 18:09:18 +02:00
Linux Build Service Account
2f9bd7c38d Merge "msm: sde: add rotator pixel format to v4l2 enum ioctl" 2016-08-19 17:51:10 -07:00
Trilok Soni
9d6fd2c3e9 Merge remote-tracking branch 'msm-4.4/tmp-510d0a3f' into msm-4.4
* msm-4.4/tmp-510d0a3f:
  Linux 4.4.11
  nf_conntrack: avoid kernel pointer value leak in slab name
  drm/radeon: fix DP link training issue with second 4K monitor
  drm/i915/bdw: Add missing delay during L3 SQC credit programming
  drm/i915: Bail out of pipe config compute loop on LPT
  drm/radeon: fix PLL sharing on DCE6.1 (v2)
  Revert "[media] videobuf2-v4l2: Verify planes array in buffer dequeueing"
  Input: max8997-haptic - fix NULL pointer dereference
  get_rock_ridge_filename(): handle malformed NM entries
  tools lib traceevent: Do not reassign parg after collapse_tree()
  qla1280: Don't allocate 512kb of host tags
  atomic_open(): fix the handling of create_error
  regulator: axp20x: Fix axp22x ldo_io voltage ranges
  regulator: s2mps11: Fix invalid selector mask and voltages for buck9
  workqueue: fix rebind bound workers warning
  ARM: dts: at91: sam9x5: Fix the memory range assigned to the PMC
  vfs: rename: check backing inode being equal
  vfs: add vfs_select_inode() helper
  perf/core: Disable the event on a truncated AUX record
  regmap: spmi: Fix regmap_spmi_ext_read in multi-byte case
  pinctrl: at91-pio4: fix pull-up/down logic
  spi: spi-ti-qspi: Handle truncated frames properly
  spi: spi-ti-qspi: Fix FLEN and WLEN settings if bits_per_word is overridden
  spi: pxa2xx: Do not detect number of enabled chip selects on Intel SPT
  ALSA: hda - Fix broken reconfig
  ALSA: hda - Fix white noise on Asus UX501VW headset
  ALSA: hda - Fix subwoofer pin on ASUS N751 and N551
  ALSA: usb-audio: Yet another Phoneix Audio device quirk
  ALSA: usb-audio: Quirk for yet another Phoenix Audio devices (v2)
  crypto: testmgr - Use kmalloc memory for RSA input
  crypto: hash - Fix page length clamping in hash walk
  crypto: qat - fix invalid pf2vf_resp_wq logic
  s390/mm: fix asce_bits handling with dynamic pagetable levels
  zsmalloc: fix zs_can_compact() integer overflow
  ocfs2: fix posix_acl_create deadlock
  ocfs2: revert using ocfs2_acl_chmod to avoid inode cluster lock hang
  net/route: enforce hoplimit max value
  tcp: refresh skb timestamp at retransmit time
  net: thunderx: avoid exposing kernel stack
  net: fix a kernel infoleak in x25 module
  uapi glibc compat: fix compile errors when glibc net/if.h included before linux/if.h MIME-Version: 1.0
  bridge: fix igmp / mld query parsing
  net: bridge: fix old ioctl unlocked net device walk
  VSOCK: do not disconnect socket when peer has shutdown SEND only
  net/mlx4_en: Fix endianness bug in IPV6 csum calculation
  net: fix infoleak in rtnetlink
  net: fix infoleak in llc
  net: fec: only clear a queue's work bit if the queue was emptied
  netem: Segment GSO packets on enqueue
  sch_dsmark: update backlog as well
  sch_htb: update backlog as well
  net_sched: update hierarchical backlog too
  net_sched: introduce qdisc_replace() helper
  gre: do not pull header in ICMP error processing
  net: Implement net_dbg_ratelimited() for CONFIG_DYNAMIC_DEBUG case
  samples/bpf: fix trace_output example
  bpf: fix check_map_func_compatibility logic
  bpf: fix refcnt overflow
  bpf: fix double-fdput in replace_map_fd_with_map_ptr()
  net/mlx4_en: fix spurious timestamping callbacks
  ipv4/fib: don't warn when primary address is missing if in_dev is dead
  net/mlx5e: Fix minimum MTU
  net/mlx5e: Device's mtu field is u16 and not int
  openvswitch: use flow protocol when recalculating ipv6 checksums
  atl2: Disable unimplemented scatter/gather feature
  vlan: pull on __vlan_insert_tag error path and fix csum correction
  net: use skb_postpush_rcsum instead of own implementations
  cdc_mbim: apply "NDP to end" quirk to all Huawei devices
  bpf/verifier: reject invalid LD_ABS | BPF_DW instruction
  net: sched: do not requeue a NULL skb
  packet: fix heap info leak in PACKET_DIAG_MCLIST sock_diag interface
  route: do not cache fib route info on local routes with oif
  decnet: Do not build routes to devices without decnet private data.
  parisc: Use generic extable search and sort routines
  arm64: kasan: Use actual memory node when populating the kernel image shadow
  arm64: mm: treat memstart_addr as a signed quantity
  arm64: lse: deal with clobbered IP registers after branch via PLT
  arm64: mm: check at build time that PAGE_OFFSET divides the VA space evenly
  arm64: kasan: Fix zero shadow mapping overriding kernel image shadow
  arm64: consistently use p?d_set_huge
  arm64: fix KASLR boot-time I-cache maintenance
  arm64: hugetlb: partial revert of 66b3923a1a0f
  arm64: make irq_stack_ptr more robust
  arm64: efi: invoke EFI_RNG_PROTOCOL to supply KASLR randomness
  efi: stub: use high allocation for converted command line
  efi: stub: add implementation of efi_random_alloc()
  efi: stub: implement efi_get_random_bytes() based on EFI_RNG_PROTOCOL
  arm64: kaslr: randomize the linear region
  arm64: add support for kernel ASLR
  arm64: add support for building vmlinux as a relocatable PIE binary
  arm64: switch to relative exception tables
  extable: add support for relative extables to search and sort routines
  scripts/sortextable: add support for ET_DYN binaries
  arm64: futex.h: Add missing PAN toggling
  arm64: make asm/elf.h available to asm files
  arm64: avoid dynamic relocations in early boot code
  arm64: avoid R_AARCH64_ABS64 relocations for Image header fields
  arm64: add support for module PLTs
  arm64: move brk immediate argument definitions to separate header
  arm64: mm: use bit ops rather than arithmetic in pa/va translations
  arm64: mm: only perform memstart_addr sanity check if DEBUG_VM
  arm64: User die() instead of panic() in do_page_fault()
  arm64: allow kernel Image to be loaded anywhere in physical memory
  arm64: defer __va translation of initrd_start and initrd_end
  arm64: move kernel image to base of vmalloc area
  arm64: kvm: deal with kernel symbols outside of linear mapping
  arm64: decouple early fixmap init from linear mapping
  arm64: pgtable: implement static [pte|pmd|pud]_offset variants
  arm64: introduce KIMAGE_VADDR as the virtual base of the kernel region
  arm64: add support for ioremap() block mappings
  arm64: prevent potential circular header dependencies in asm/bug.h
  of/fdt: factor out assignment of initrd_start/initrd_end
  of/fdt: make memblock minimum physical address arch configurable
  arm64: Remove the get_thread_info() function
  arm64: kernel: Don't toggle PAN on systems with UAO
  arm64: cpufeature: Test 'matches' pointer to find the end of the list
  arm64: kernel: Add support for User Access Override
  arm64: add ARMv8.2 id_aa64mmfr2 boiler plate
  arm64: cpufeature: Change read_cpuid() to use sysreg's mrs_s macro
  arm64: use local label prefixes for __reg_num symbols
  arm64: vdso: Mark vDSO code as read-only
  arm64: ubsan: select ARCH_HAS_UBSAN_SANITIZE_ALL
  arm64: ptdump: Indicate whether memory should be faulting
  arm64: Add support for ARCH_SUPPORTS_DEBUG_PAGEALLOC
  arm64: Drop alloc function from create_mapping
  arm64: prefetch: add missing #include for spin_lock_prefetch
  arm64: lib: patch in prfm for copy_page if requested
  arm64: lib: improve copy_page to deal with 128 bytes at a time
  arm64: prefetch: add alternative pattern for CPUs without a prefetcher
  arm64: prefetch: don't provide spin_lock_prefetch with LSE
  arm64: allow vmalloc regions to be set with set_memory_*
  arm64: kernel: implement ACPI parking protocol
  arm64: mm: create new fine-grained mappings at boot
  arm64: ensure _stext and _etext are page-aligned
  arm64: mm: allow passing a pgdir to alloc_init_*
  arm64: mm: allocate pagetables anywhere
  arm64: mm: use fixmap when creating page tables
  arm64: mm: add functions to walk tables in fixmap
  arm64: mm: add __{pud,pgd}_populate
  arm64: mm: avoid redundant __pa(__va(x))
  arm64: mm: add functions to walk page tables by PA
  arm64: mm: move pte_* macros
  arm64: kasan: avoid TLB conflicts
  arm64: mm: add code to safely replace TTBR1_EL1
  arm64: add function to install the idmap
  arm64: unmap idmap earlier
  arm64: unify idmap removal
  arm64: mm: place empty_zero_page in bss
  arm64: mm: specialise pagetable allocators
  asm-generic: Fix local variable shadow in __set_fixmap_offset
  Eliminate the .eh_frame sections from the aarch64 vmlinux and kernel modules
  arm64: Fix an enum typo in mm/dump.c
  arm64: kasan: ensure that the KASAN zero page is mapped read-only
  arch/arm64/include/asm/pgtable.h: add pmd_mkclean for THP
  arm64: hide __efistub_ aliases from kallsyms
  Linux 4.4.10
  drm/i915/skl: Fix DMC load on Skylake J0 and K0
  lib/test-string_helpers.c: fix and improve string_get_size() tests
  ACPI / processor: Request native thermal interrupt handling via _OSC
  drm/i915: Fake HDMI live status
  drm/i915: Make RPS EI/thresholds multiple of 25 on SNB-BDW
  drm/i915: Fix eDP low vswing for Broadwell
  drm/i915/ddi: Fix eDP VDD handling during booting and suspend/resume
  drm/radeon: make sure vertical front porch is at least 1
  iio: ak8975: fix maybe-uninitialized warning
  iio: ak8975: Fix NULL pointer exception on early interrupt
  drm/amdgpu: set metadata pointer to NULL after freeing.
  drm/amdgpu: make sure vertical front porch is at least 1
  gpu: ipu-v3: Fix imx-ipuv3-crtc module autoloading
  nvmem: mxs-ocotp: fix buffer overflow in read
  USB: serial: cp210x: add Straizona Focusers device ids
  USB: serial: cp210x: add ID for Link ECU
  ata: ahci-platform: Add ports-implemented DT bindings.
  libahci: save port map for forced port map
  powerpc: Fix bad inline asm constraint in create_zero_mask()
  ACPICA: Dispatcher: Update thread ID for recursive method calls
  x86/sysfb_efi: Fix valid BAR address range check
  ARC: Add missing io barriers to io{read,write}{16,32}be()
  ARM: cpuidle: Pass on arm_cpuidle_suspend()'s return value
  propogate_mnt: Handle the first propogated copy being a slave
  fs/pnode.c: treat zero mnt_group_id-s as unequal
  x86/tsc: Read all ratio bits from MSR_PLATFORM_INFO
  MAINTAINERS: Remove asterisk from EFI directory names
  writeback: Fix performance regression in wb_over_bg_thresh()
  batman-adv: Reduce refcnt of removed router when updating route
  batman-adv: Fix broadcast/ogm queue limit on a removed interface
  batman-adv: Check skb size before using encapsulated ETH+VLAN header
  batman-adv: fix DAT candidate selection (must use vid)
  mm: update min_free_kbytes from khugepaged after core initialization
  proc: prevent accessing /proc/<PID>/environ until it's ready
  Input: zforce_ts - fix dual touch recognition
  HID: Fix boot delay for Creative SB Omni Surround 5.1 with quirk
  HID: wacom: Add support for DTK-1651
  xen/evtchn: fix ring resize when binding new events
  xen/balloon: Fix crash when ballooning on x86 32 bit PAE
  xen: Fix page <-> pfn conversion on 32 bit systems
  ARM: SoCFPGA: Fix secondary CPU startup in thumb2 kernel
  ARM: EXYNOS: Properly skip unitialized parent clock in power domain on
  mm/zswap: provide unique zpool name
  mm, cma: prevent nr_isolated_* counters from going negative
  Minimal fix-up of bad hashing behavior of hash_64()
  MD: make bio mergeable
  tracing: Don't display trigger file for events that can't be enabled
  mac80211: fix statistics leak if dev_alloc_name() fails
  ath9k: ar5008_hw_cmn_spur_mitigate: add missing mask_m & mask_p initialisation
  lpfc: fix misleading indentation
  clk: qcom: msm8960: Fix ce3_src register offset
  clk: versatile: sp810: support reentrance
  clk: qcom: msm8960: fix ce3_core clk enable register
  clk: meson: Fix meson_clk_register_clks() signature type mismatch
  clk: rockchip: free memory in error cases when registering clock branches
  soc: rockchip: power-domain: fix err handle while probing
  clk-divider: make sure read-only dividers do not write to their register
  CNS3xxx: Fix PCI cns3xxx_write_config()
  mwifiex: fix corner case association failure
  ata: ahci_xgene: dereferencing uninitialized pointer in probe
  nbd: ratelimit error msgs after socket close
  mfd: intel-lpss: Remove clock tree on error path
  ipvs: drop first packet to redirect conntrack
  ipvs: correct initial offset of Call-ID header search in SIP persistence engine
  ipvs: handle ip_vs_fill_iph_skb_off failure
  RDMA/iw_cxgb4: Fix bar2 virt addr calculation for T4 chips
  Revert: "powerpc/tm: Check for already reclaimed tasks"
  arm64: head.S: use memset to clear BSS
  efi: stub: define DISABLE_BRANCH_PROFILING for all architectures
  arm64: entry: remove pointless SPSR mode check
  arm64: mm: move pgd_cache initialisation to pgtable_cache_init
  arm64: module: avoid undefined shift behavior in reloc_data()
  arm64: module: fix relocation of movz instruction with negative immediate
  arm64: traps: address fallout from printk -> pr_* conversion
  arm64: ftrace: fix a stack tracer's output under function graph tracer
  arm64: pass a task parameter to unwind_frame()
  arm64: ftrace: modify a stack frame in a safe way
  arm64: remove irq_count and do_softirq_own_stack()
  arm64: hugetlb: add support for PTE contiguous bit
  arm64: Use PoU cache instr for I/D coherency
  arm64: Defer dcache flush in __cpu_copy_user_page
  arm64: reduce stack use in irq_handler
  arm64: Documentation: add list of software workarounds for errata
  arm64: mm: place __cpu_setup in .text
  arm64: cmpxchg: Don't incldue linux/mmdebug.h
  arm64: mm: fold alternatives into .init
  arm64: Remove redundant padding from linker script
  arm64: mm: remove pointless PAGE_MASKing
  arm64: don't call C code with el0's fp register
  arm64: when walking onto the task stack, check sp & fp are in current->stack
  arm64: Add this_cpu_ptr() assembler macro for use in entry.S
  arm64: irq: fix walking from irq stack to task stack
  arm64: Add do_softirq_own_stack() and enable irq_stacks
  arm64: Modify stack trace and dump for use with irq_stack
  arm64: Store struct thread_info in sp_el0
  arm64: Add trace_hardirqs_off annotation in ret_to_user
  arm64: ftrace: fix the comments for ftrace_modify_code
  arm64: ftrace: stop using kstop_machine to enable/disable tracing
  arm64: spinlock: serialise spin_unlock_wait against concurrent lockers
  arm64: enable HAVE_IRQ_TIME_ACCOUNTING
  arm64: fix COMPAT_SHMLBA definition for large pages
  arm64: add __init/__initdata section marker to some functions/variables
  arm64: pgtable: implement pte_accessible()
  arm64: mm: allow sections for unaligned bases
  arm64: mm: detect bad __create_mapping uses
  Linux 4.4.9
  extcon: max77843: Use correct size for reading the interrupt register
  stm class: Select CONFIG_SRCU
  megaraid_sas: add missing curly braces in ioctl handler
  sunrpc/cache: drop reference when sunrpc_cache_pipe_upcall() detects a race
  thermal: rockchip: fix a impossible condition caused by the warning
  unbreak allmodconfig KCONFIG_ALLCONFIG=...
  jme: Fix device PM wakeup API usage
  jme: Do not enable NIC WoL functions on S0
  bus: imx-weim: Take the 'status' property value into account
  ARM: dts: pxa: fix dma engine node to pxa3xx-nand
  ARM: dts: armada-375: use armada-370-sata for SATA
  ARM: EXYNOS: select THERMAL_OF
  ARM: prima2: always enable reset controller
  ARM: OMAP3: Add cpuidle parameters table for omap3430
  ext4: fix races of writeback with punch hole and zero range
  ext4: fix races between buffered IO and collapse / insert range
  ext4: move unlocked dio protection from ext4_alloc_file_blocks()
  ext4: fix races between page faults and hole punching
  perf stat: Document --detailed option
  perf tools: handle spaces in file names obtained from /proc/pid/maps
  perf hists browser: Only offer symbol scripting when a symbol is under the cursor
  mtd: nand: Drop mtd.owner requirement in nand_scan
  mtd: brcmnand: Fix v7.1 register offsets
  mtd: spi-nor: remove micron_quad_enable()
  serial: sh-sci: Remove cpufreq notifier to fix crash/deadlock
  ext4: fix NULL pointer dereference in ext4_mark_inode_dirty()
  x86/mm/kmmio: Fix mmiotrace for hugepages
  perf evlist: Reference count the cpu and thread maps at set_maps()
  drivers/misc/ad525x_dpot: AD5274 fix RDAC read back errors
  rtc: max77686: Properly handle regmap_irq_get_virq() error code
  rtc: rx8025: remove rv8803 id
  rtc: ds1685: passing bogus values to irq_restore
  rtc: vr41xx: Wire up alarm_irq_enable
  rtc: hym8563: fix invalid year calculation
  PM / Domains: Fix removal of a subdomain
  PM / OPP: Initialize u_volt_min/max to a valid value
  misc: mic/scif: fix wrap around tests
  misc/bmp085: Enable building as a module
  lib/mpi: Endianness fix
  fbdev: da8xx-fb: fix videomodes of lcd panels
  scsi_dh: force modular build if SCSI is a module
  paride: make 'verbose' parameter an 'int' again
  regulator: s5m8767: fix get_register() error handling
  irqchip/mxs: Fix error check of of_io_request_and_map()
  irqchip/sunxi-nmi: Fix error check of of_io_request_and_map()
  spi/rockchip: Make sure spi clk is on in rockchip_spi_set_cs
  locking/mcs: Fix mcs_spin_lock() ordering
  regulator: core: Fix nested locking of supplies
  regulator: core: Ensure we lock all regulators
  regulator: core: fix regulator_lock_supply regression
  Revert "regulator: core: Fix nested locking of supplies"
  videobuf2-v4l2: Verify planes array in buffer dequeueing
  videobuf2-core: Check user space planes array in dqbuf
  USB: usbip: fix potential out-of-bounds write
  cgroup: make sure a parent css isn't freed before its children
  mm/hwpoison: fix wrong num_poisoned_pages accounting
  mm: vmscan: reclaim highmem zone if buffer_heads is over limit
  numa: fix /proc/<pid>/numa_maps for THP
  mm/huge_memory: replace VM_NO_THP VM_BUG_ON with actual VMA check
  memcg: relocate charge moving from ->attach to ->post_attach
  cgroup, cpuset: replace cpuset_post_attach_flush() with cgroup_subsys->post_attach callback
  slub: clean up code for kmem cgroup support to kmem_cache_free_bulk
  workqueue: fix ghost PENDING flag while doing MQ IO
  x86/apic: Handle zero vector gracefully in clear_vector_irq()
  efi: Expose non-blocking set_variable() wrapper to efivars
  efi: Fix out-of-bounds read in variable_matches()
  IB/security: Restrict use of the write() interface
  IB/mlx5: Expose correct max_sge_rd limit
  cxl: Keep IRQ mappings on context teardown
  v4l2-dv-timings.h: fix polarity for 4k formats
  vb2-memops: Fix over allocation of frame vectors
  ASoC: rt5640: Correct the digital interface data select
  ASoC: dapm: Make sure we have a card when displaying component widgets
  ASoC: ssm4567: Reset device before regcache_sync()
  ASoC: s3c24xx: use const snd_soc_component_driver pointer
  EDAC: i7core, sb_edac: Don't return NOTIFY_BAD from mce_decoder callback
  toshiba_acpi: Fix regression caused by hotkey enabling value
  i2c: exynos5: Fix possible ABBA deadlock by keeping I2C clock prepared
  i2c: cpm: Fix build break due to incompatible pointer types
  perf intel-pt: Fix segfault tracing transactions
  drm/i915: Use fw_domains_put_with_fifo() on HSW
  drm/i915: Fixup the free space logic in ring_prepare
  drm/amdkfd: uninitialized variable in dbgdev_wave_control_set_registers()
  drm/i915: skl_update_scaler() wants a rotation bitmask instead of bit number
  drm/i915: Cleanup phys status page too
  pwm: brcmstb: Fix check of devm_ioremap_resource() return code
  drm/dp/mst: Get validated port ref in drm_dp_update_payload_part1()
  drm/dp/mst: Restore primary hub guid on resume
  drm/dp/mst: Validate port in drm_dp_payload_send_msg()
  drm/nouveau/gr/gf100: select a stream master to fixup tfb offset queries
  drm: Loongson-3 doesn't fully support wc memory
  drm/radeon: fix vertical bars appear on monitor (v2)
  drm/radeon: forbid mapping of userptr bo through radeon device file
  drm/radeon: fix initial connector audio value
  drm/radeon: add a quirk for a XFX R9 270X
  drm/amdgpu: fix regression on CIK (v2)
  amdgpu/uvd: add uvd fw version for amdgpu
  drm/amdgpu: bump the afmt limit for CZ, ST, Polaris
  drm/amdgpu: use defines for CRTCs and AMFT blocks
  drm/amdgpu: when suspending, if uvd/vce was running. need to cancel delay work.
  iommu/dma: Restore scatterlist offsets correctly
  iommu/amd: Fix checking of pci dma aliases
  pinctrl: single: Fix pcs_parse_bits_in_pinctrl_entry to use __ffs than ffs
  pinctrl: mediatek: correct debounce time unit in mtk_gpio_set_debounce
  xen kconfig: don't "select INPUT_XEN_KBDDEV_FRONTEND"
  Input: pmic8xxx-pwrkey - fix algorithm for converting trigger delay
  Input: gtco - fix crash on detecting device without endpoints
  netlink: don't send NETLINK_URELEASE for unbound sockets
  nl80211: check netlink protocol in socket release notification
  powerpc: Update TM user feature bits in scan_features()
  powerpc: Update cpu_user_features2 in scan_features()
  powerpc: scan_features() updates incorrect bits for REAL_LE
  crypto: talitos - fix AEAD tcrypt tests
  crypto: talitos - fix crash in talitos_cra_init()
  crypto: sha1-mb - use corrcet pointer while completing jobs
  crypto: ccp - Prevent information leakage on export
  iwlwifi: mvm: fix memory leak in paging
  iwlwifi: pcie: lower the debug level for RSA semaphore access
  s390/pci: add extra padding to function measurement block
  cpufreq: intel_pstate: Fix processing for turbo activation ratio
  Revert "drm/amdgpu: disable runtime pm on PX laptops without dGPU power control"
  Revert "drm/radeon: disable runtime pm on PX laptops without dGPU power control"
  drm/i915: Fix race condition in intel_dp_destroy_mst_connector()
  drm/qxl: fix cursor position with non-zero hotspot
  drm/nouveau/core: use vzalloc for allocating ramht
  futex: Acknowledge a new waiter in counter before plist
  futex: Handle unlock_pi race gracefully
  asm-generic/futex: Re-enable preemption in futex_atomic_cmpxchg_inatomic()
  ALSA: hda - Add dock support for ThinkPad X260
  ALSA: pcxhr: Fix missing mutex unlock
  ALSA: hda - add PCI ID for Intel Broxton-T
  ALSA: hda - Keep powering up ADCs on Cirrus codecs
  ALSA: hda/realtek - Add ALC3234 headset mode for Optiplex 9020m
  ALSA: hda - Don't trust the reported actual power state
  x86 EDAC, sb_edac.c: Repair damage introduced when "fixing" channel address
  x86/mm/xen: Suppress hugetlbfs in PV guests
  arm64: Update PTE_RDONLY in set_pte_at() for PROT_NONE permission
  arm64: Honour !PTE_WRITE in set_pte_at() for kernel mappings
  sched/cgroup: Fix/cleanup cgroup teardown/init
  dmaengine: pxa_dma: fix the maximum requestor line
  dmaengine: hsu: correct use of channel status register
  dmaengine: dw: fix master selection
  debugfs: Make automount point inodes permanently empty
  lib: lz4: fixed zram with lz4 on big endian machines
  dm cache metadata: fix cmd_read_lock() acquiring write lock
  dm cache metadata: fix READ_LOCK macros and cleanup WRITE_LOCK macros
  usb: gadget: f_fs: Fix use-after-free
  usb: hcd: out of bounds access in for_each_companion
  xhci: fix 10 second timeout on removal of PCI hotpluggable xhci controllers
  usb: xhci: fix wild pointers in xhci_mem_cleanup
  xhci: resume USB 3 roothub first
  usb: xhci: applying XHCI_PME_STUCK_QUIRK to Intel BXT B0 host
  assoc_array: don't call compare_object() on a node
  ARM: OMAP2+: hwmod: Fix updating of sysconfig register
  ARM: OMAP2: Fix up interconnect barrier initialization for DRA7
  ARM: mvebu: Correct unit address for linksys
  ARM: dts: AM43x-epos: Fix clk parent for synctimer
  KVM: arm/arm64: Handle forward time correction gracefully
  kvm: x86: do not leak guest xcr0 into host interrupt handlers
  x86/mce: Avoid using object after free in genpool
  block: loop: fix filesystem corruption in case of aio/dio
  block: partition: initialize percpuref before sending out KOBJ_ADD

Conflicts:
	arch/arm64/Kconfig
	arch/arm64/include/asm/cputype.h
	arch/arm64/include/asm/hardirq.h
	arch/arm64/include/asm/irq.h
	arch/arm64/kernel/cpu_errata.c
	arch/arm64/kernel/cpuinfo.c
	arch/arm64/kernel/setup.c
	arch/arm64/kernel/smp.c
	arch/arm64/kernel/stacktrace.c
	arch/arm64/mm/init.c
	arch/arm64/mm/mmu.c
	arch/arm64/mm/pageattr.c
	mm/memcontrol.c

CRs-Fixed: 1054234
Signed-off-by: Trilok Soni <tsoni@codeaurora.org>
Change-Id: I2a7a34631ffee36ce18b9171f16d023be777392f
2016-08-18 14:50:45 -07:00
Alan Kwong
7bd24747f6 msm: sde: add rotator pixel format to v4l2 enum ioctl
Import rotator pixel formats into v4l2 enum ioctl so rotator pixel
formats will not generate kernel warning during format enumeration.

CRs-Fixed: 1054825
Change-Id: Ie739fffa2d1faed64c2bf03eac92f38fa2ab6e55
Signed-off-by: Alan Kwong <akwong@codeaurora.org>
2016-08-18 16:12:20 -04:00
Trilok Soni
f145f41478 Merge remote-tracking branch 'msm-4.4/tmp-2bf7955' into msm-4.4
* msm-4.4/tmp-2bf7955:
  Linux 4.4.8
  Revert "usb: hub: do not clear BOS field during reset device"
  usbvision: fix crash on detecting device with invalid configuration
  staging: android: ion: Set the length of the DMA sg entries in buffer
  Revert "PCI, x86: Implement pcibios_alloc_irq() and pcibios_free_irq()"
  Revert "PCI: Add helpers to manage pci_dev->irq and pci_dev->irq_managed"
  Revert "x86/PCI: Don't alloc pcibios-irq when MSI is enabled"
  HID: usbhid: fix inconsistent reset/resume/reset-resume behavior
  HID: wacom: fix Bamboo ONE oops
  ALSA: usb-audio: Skip volume controls triggers hangup on Dell USB Dock
  ALSA: usb-audio: Add a quirk for Plantronics BT300
  ALSA: usb-audio: Add a sample rate quirk for Phoenix Audio TMX320
  ALSA: hda/realtek - Enable the ALC292 dock fixup on the Thinkpad T460s
  ALSA: hda - fix front mic problem for a HP desktop
  ALSA: hda - Fix headset support and noise on HP EliteBook 755 G2
  ALSA: hda - Fixup speaker pass-through control for nid 0x14 on ALC225
  mmc: sdhci-pci: Add support and PCI IDs for more Broxton host controllers
  perf: Cure event->pending_disable race
  perf: Do not double free
  arm64: replace read_lock to rcu lock in call_step_hook
  Btrfs: fix file/data loss caused by fsync after rename and new inode
  iommu: Don't overwrite domain pointer when there is no default_domain
  ext4: ignore quota mount options if the quota feature is enabled
  ext4: add lockdep annotations for i_data_sem
  btrfs: fix crash/invalid memory access on fsync when using overlayfs
  nfs: use file_dentry()
  fs: add file_dentry()
  sd: Fix excessive capacity printing on devices with blocks bigger than 512 bytes
  iio: gyro: bmg160: fix endianness when reading axes
  iio: gyro: bmg160: fix buffer read values
  iio: accel: bmc150: fix endianness when reading axes
  iio: st_magn: always define ST_MAGN_TRIGGER_SET_STATE
  usb: renesas_usbhs: fix to avoid using a disabled ep in usbhsg_queue_done()
  usb: renesas_usbhs: disable TX IRQ before starting TX DMAC transfer
  usb: renesas_usbhs: avoid NULL pointer derefernce in usbhsf_pkt_handler()
  mac80211: fix txq queue related crashes
  mac80211: fix unnecessary frame drops in mesh fwding
  mac80211: fix ibss scan parameters
  mac80211: avoid excessive stack usage in sta_info
  mac80211: properly deal with station hashtable insert errors
  virtio: virtio 1.0 cs04 spec compliance for reset
  rbd: use GFP_NOIO consistently for request allocations
  pcmcia: db1xxx_ss: fix last irq_to_gpio user
  v4l: vsp1: Set the SRU CTRL0 register when starting the stream
  coda: fix error path in case of missing pdata on non-DT platform
  au0828: Fix dev_state handling
  au0828: fix au0828_v4l2_close() dev_state race condition
  pinctrl: freescale: imx: fix bogus check of of_iomap() return value
  pinctrl: nomadik: fix pull debug print inversion
  pinctrl: sunxi: Fix A33 external interrupts not working
  pinctrl: sh-pfc: only use dummy states for non-DT platforms
  pinctrl: pistachio: fix mfio84-89 function description and pinmux.
  MIPS: Fix MSA ld unaligned failure cases
  KVM: x86: reduce default value of halt_poll_ns parameter
  KVM: x86: Inject pending interrupt even if pending nmi exist
  cdc-acm: fix NULL pointer reference
  USB: uas: Add a new NO_REPORT_LUNS quirk
  USB: uas: Limit qdepth at the scsi-host level
  mpls: find_outdev: check for err ptr in addition to NULL check
  ipv6: Count in extension headers in skb->network_header
  ip6_tunnel: set rtnl_link_ops before calling register_netdevice
  ipv6: l2tp: fix a potential issue in l2tp_ip6_recv
  ipv4: l2tp: fix a potential issue in l2tp_ip_recv
  tuntap: restore default qdisc
  tun, bpf: fix suspicious RCU usage in tun_{attach, detach}_filter
  rtnl: fix msg size calculation in if_nlmsg_size()
  bridge: Allow set bridge ageing time when switchdev disabled
  ipv6: udp: fix UDP_MIB_IGNOREDMULTI updates
  qmi_wwan: add "D-Link DWM-221 B1" device id
  xfrm: Fix crash observed during device unregistration and decryption
  ppp: take reference on channels netns
  ipv4: initialize flowi4_flags before calling fib_lookup()
  ipv4: fix broadcast packets reception
  bonding: fix bond_get_stats()
  net: bcmgenet: fix dma api length mismatch
  qlge: Fix receive packets drop.
  tcp/dccp: remove obsolete WARN_ON() in icmp handlers
  ppp: ensure file->private_data can't be overridden
  ath9k: fix buffer overrun for ar9287
  farsync: fix off-by-one bug in fst_add_one
  mlx4: add missing braces in verify_qp_parameters
  net: Fix use after free in the recvmmsg exit path
  ipv4: Don't do expensive useless work during inetdev destroy.
  bridge: allow zero ageing time
  rocker: set FDB cleanup timer according to lowest ageing time
  mlxsw: spectrum: Check requested ageing time is valid
  macvtap: always pass ethernet header in linear
  qlcnic: Fix mailbox completion handling during spurious interrupt
  qlcnic: Remove unnecessary usage of atomic_t
  sh_eth: advance 'rxdesc' later in sh_eth_ring_format()
  sh_eth: fix NULL pointer dereference in sh_eth_ring_format()
  bpf: avoid copying junk bytes in bpf_get_current_comm()
  packet: validate variable length ll headers
  ax25: add link layer header validation function
  net: validate variable length ll headers
  ppp: release rtnl mutex when interface creation fails
  tcp: fix tcpi_segs_in after connection establishment
  udp6: fix UDP/IPv6 encap resubmit path
  usbnet: cleanup after bind() in probe()
  cdc_ncm: toggle altsetting to force reset before setup
  vxlan: fix missing options_len update on RX with collect metadata
  ipv6: re-enable fragment header matching in ipv6_find_hdr
  qmi_wwan: add Sierra Wireless EM74xx device ID
  tipc: Revert "tipc: use existing sk_write_queue for outgoing packet chain"
  mld, igmp: Fix reserved tailroom calculation
  sctp: lack the check for ports in sctp_v6_cmp_addr
  net: fix bridge multicast packet checksum validation
  net: qca_spi: clear IFF_TX_SKB_SHARING
  net: qca_spi: Don't clear IFF_BROADCAST
  net: vrf: Remove direct access to skb->data
  net: jme: fix suspend/resume on JMC260
  ipv4: only create late gso-skb if skb is already set up with CHECKSUM_PARTIAL
  tunnel: Clear IPCB(skb)->opt before dst_link_failure called
  tcp: convert cached rtt from usec to jiffies when feeding initial rto
  xen/events: Mask a moving irq
  drm/amdgpu/gmc: use proper register for vram type on Fiji
  drm/amdgpu/gmc: move vram type fetching into sw_init
  drm/radeon: add a dpm quirk for all R7 370 parts
  drm/radeon: add another R7 370 quirk
  drm/radeon: add a dpm quirk for sapphire Dual-X R7 370 2G D5
  drm/udl: Use unlocked gem unreferencing
  drm/dp: move hw_mutex up the call stack
  arm64: opcodes.h: Add arm big-endian config options before including arm header
  compiler-gcc: disable -ftracer for __noclone functions
  libnvdimm, pfn: fix uuid validation
  libnvdimm: fix smart data retrieval
  powerpc/mm: Fixup preempt underflow with huge pages
  mm: fix invalid node in alloc_migrate_target()
  ALSA: hda - Apply fix for white noise on Asus N550JV, too
  ALSA: hda - Fix white noise on Asus N750JV headphone
  ALSA: hda - Asus N750JV external subwoofer fixup
  ALSA: timer: Use mod_timer() for rearming the system timer
  parisc: Unbreak handling exceptions from kernel modules
  parisc: Fix kernel crash with reversed copy_from_user()
  parisc: Avoid function pointers for kernel exception routines
  PKCS#7: pkcs7_validate_trust(): initialize the _trusted output argument
  hwmon: (max1111) Return -ENODEV from max1111_read_channel if not instantiated
  Linux 4.4.7
  perf/x86/intel: Fix PEBS data source interpretation on Nehalem/Westmere
  perf/x86/intel: Use PAGE_SIZE for PEBS buffer size on Core2
  perf/x86/intel: Fix PEBS warning by only restoring active PMU in pmi
  perf/x86/pebs: Add workaround for broken OVFL status on HSW+
  sched/cputime: Fix steal time accounting vs. CPU hotplug
  scsi_common: do not clobber fixed sense information
  PM / sleep: Clear pm_suspend_global_flags upon hibernate
  intel_idle: prevent SKL-H boot failure when C8+C9+C10 enabled
  mtd: onenand: fix deadlock in onenand_block_markbad
  mm/page_alloc: prevent merging between isolated and other pageblocks
  ocfs2/dlm: fix BUG in dlm_move_lockres_to_recovery_list
  ocfs2/dlm: fix race between convert and recovery
  Input: ati_remote2 - fix crashes on detecting device with invalid descriptor
  Input: ims-pcu - sanity check against missing interfaces
  Input: synaptics - handle spurious release of trackstick buttons, again
  writeback, cgroup: fix use of the wrong bdi_writeback which mismatches the inode
  writeback, cgroup: fix premature wb_put() in locked_inode_to_wb_and_lock_list()
  ACPI / PM: Runtime resume devices when waking from hibernate
  ARM: dts: at91: sama5d4 Xplained: don't disable hsmci regulator
  ARM: dts: at91: sama5d3 Xplained: don't disable hsmci regulator
  nfsd: fix deadlock secinfo+readdir compound
  nfsd4: fix bad bounds checking
  iser-target: Rework connection termination
  iser-target: Separate flows for np listeners and connections cma events
  iser-target: Add new state ISER_CONN_BOUND to isert_conn
  iser-target: Fix identification of login rx descriptor type
  target: Fix target_release_cmd_kref shutdown comp leak
  clk: bcm2835: Fix setting of PLL divider clock rates
  clk: rockchip: add hclk_cpubus to the list of rk3188 critical clocks
  clk: rockchip: rk3368: fix hdmi_cec gate-register
  clk: rockchip: rk3368: fix parents of video encoder/decoder
  clk: rockchip: rk3368: fix cpuclk core dividers
  clk: rockchip: rk3368: fix cpuclk mux bit of big cpu-cluster
  mmc: sdhci: Fix override of timeout clk wrt max_busy_timeout
  mmc: sdhci: fix data timeout (part 2)
  mmc: sdhci: fix data timeout (part 1)
  mmc: mmc_spi: Add Card Detect comments and fix CD GPIO case
  mmc: block: fix ABI regression of mmc_blk_ioctl
  ideapad-laptop: Add ideapad Y700 (15) to the no_hw_rfkill DMI list
  MAINTAINERS: Update mailing list and web page for hwmon subsystem
  kbuild/mkspec: fix grub2 installkernel issue
  scripts/kconfig: allow building with make 3.80 again
  scripts/coccinelle: modernize &
  bitops: Do not default to __clear_bit() for __clear_bit_unlock()
  tracing: Fix trace_printk() to print when not using bprintk()
  tracing: Fix crash from reading trace_pipe with sendfile
  tracing: Have preempt(irqs)off trace preempt disabled functions
  IB/ipoib: fix for rare multicast join race condition
  drm/amdgpu: include the right version of gmc header files for iceland
  drm/amdgpu: disable runtime pm on PX laptops without dGPU power control
  drm/radeon: Don't drop DP 2.7 Ghz link setup on some cards.
  drm/radeon: disable runtime pm on PX laptops without dGPU power control
  iwlwifi: mvm: Fix paging memory leak
  ipr: Fix regression when loading firmware
  ipr: Fix out-of-bounds null overwrite
  rapidio/rionet: fix deadlock on SMP
  fs/coredump: prevent fsuid=0 dumps into user-controlled directories
  fuse: Add reference counting for fuse_io_priv
  fuse: do not use iocb after it may have been freed
  md: multipath: don't hardcopy bio in .make_request path
  md/raid5: preserve STRIPE_PREREAD_ACTIVE in break_stripe_batch_list
  raid10: include bio_end_io_list in nr_queued to prevent freeze_array hang
  RAID5: revert e9e4c377e2 to fix a livelock
  RAID5: check_reshape() shouldn't call mddev_suspend
  md/raid5: Compare apples to apples (or sectors to sectors)
  raid1: include bio_end_io_list in nr_queued to prevent freeze_array hang
  xfs: fix two memory leaks in xfs_attr_list.c error paths
  quota: Fix possible GPF due to uninitialised pointers
  ARC: bitops: Remove non relevant comments
  ARC: [BE] readl()/writel() to work in Big Endian CPU configuration
  xtensa: clear all DBREAKC registers on start
  xtensa: fix preemption in {clear,copy}_user_highpage
  xtensa: ISS: don't hang if stdin EOF is reached
  splice: handle zero nr_pages in splice_to_pipe()
  vfs: show_vfsstat: do not ignore errors from show_devname method
  of: alloc anywhere from memblock if range not specified
  net: mvneta: enable change MAC address when interface is up
  cgroup: ignore css_sets associated with dead cgroups during migration
  Bluetooth: Fix potential buffer overflow with Add Advertising
  Bluetooth: Add new AR3012 ID 0489:e095
  watchdog: rc32434_wdt: fix ioctl error handling
  watchdog: don't run proc_watchdog_update if new value is same as old
  ia64: define ioremap_uc()
  mm: memcontrol: reclaim and OOM kill when shrinking memory.max below usage
  mm: memcontrol: reclaim when shrinking memory.high below usage
  bcache: fix cache_set_flush() NULL pointer dereference on OOM
  bcache: fix race of writeback thread starting before complete initialization
  bcache: cleaned up error handling around register_cache()
  IB/srpt: Simplify srpt_handle_tsk_mgmt()
  brd: Fix discard request processing
  jbd2: fix FS corruption possibility in jbd2_journal_destroy() on umount path
  tools/hv: Use include/uapi with __EXPORTED_HEADERS__
  ALSA: hda - Fix unconditional GPIO toggle via automute
  ALSA: hda - fix the mic mute button and led problem for a Lenovo AIO
  ALSA: hda - Don't handle ELD notify from invalid port
  ALSA: intel8x0: Add clock quirk entry for AD1981B on IBM ThinkPad X41.
  ALSA: pcm: Avoid "BUG:" string for warnings again
  ALSA: hda - Apply reboot D3 fix for CX20724 codec, too
  mtip32xx: Cleanup queued requests after surprise removal
  mtip32xx: Implement timeout handler
  mtip32xx: Handle FTL rebuild failure state during device initialization
  mtip32xx: Handle safe removal during IO
  mtip32xx: Fix for rmmod crash when drive is in FTL rebuild
  mtip32xx: Print exact time when an internal command is interrupted
  mtip32xx: Remove unwanted code from taskfile error handler
  mtip32xx: Fix broken service thread handling
  mtip32xx: Avoid issuing standby immediate cmd during FTL rebuild
  media: v4l2-compat-ioctl32: fix missing length copy in put_v4l2_buffer32
  coda: fix first encoded frame payload
  bttv: Width must be a multiple of 16 when capturing planar formats
  adv7511: TX_EDID_PRESENT is still 1 after a disconnect
  saa7134: Fix bytesperline not being set correctly for planar formats
  8250: use callbacks to access UART_DLL/UART_DLM
  net: irda: Fix use-after-free in irtty_open()
  tty: Fix GPF in flush_to_ldisc(), part 2
  staging: comedi: ni_mio_common: fix the ni_write[blw]() functions
  staging: android: ion_test: fix check of platform_device_register_simple() error code
  staging: comedi: ni_tiocmd: change mistaken use of start_src for start_arg
  HID: fix hid_ignore_special_drivers module parameter
  HID: multitouch: force retrieving of Win8 signature blob
  HID: i2c-hid: fix OOB write in i2c_hid_set_or_send_report()
  HID: logitech: fix Dual Action gamepad support
  tpm: fix the cleanup of struct tpm_chip
  tpm_eventlog.c: fix binary_bios_measurements
  tpm_crb: tpm2_shutdown() must be called before tpm_chip_unregister()
  tpm: fix the rollback in tpm_chip_register()
  mei: bus: check if the device is enabled before data transfer
  X.509: Fix leap year handling again
  crypto: marvell/cesa - forward devm_ioremap_resource() error code
  crypto: ux500 - fix checks of error code returned by devm_ioremap_resource()
  crypto: atmel - fix checks of error code returned by devm_ioremap_resource()
  crypto: keywrap - memzero the correct memory
  crypto: ccp - memset request context to zero during import
  crypto: ccp - Don't assume export/import areas are aligned
  crypto: ccp - Limit the amount of information exported
  crypto: ccp - Add hash state import and export support
  Bluetooth: btusb: Add a new AR3012 ID 13d3:3472
  Bluetooth: btusb: Add a new AR3012 ID 04ca:3014
  Bluetooth: btusb: Add new AR3012 ID 13d3:3395
  ALSA: usb-audio: Fix double-free in error paths after snd_usb_add_audio_stream() call
  ALSA: usb-audio: Minor code cleanup in create_fixed_stream_quirk()
  ALSA: usb-audio: add Microsoft HD-5001 to quirks
  ALSA: usb-audio: Add sanity checks for endpoint accesses
  ALSA: usb-audio: Fix NULL dereference in create_fixed_stream_quirk()
  Input: powermate - fix oops with malicious USB descriptors
  pwc: Add USB id for Philips Spc880nc webcam
  USB: option: add "D-Link DWM-221 B1" device id
  USB: serial: ftdi_sio: Add support for ICP DAS I-756xU devices
  USB: serial: cp210x: Adding GE Healthcare Device ID
  USB: cypress_m8: add endpoint sanity check
  USB: digi_acceleport: do sanity checking for the number of ports
  USB: mct_u232: add sanity checking in probe
  USB: usb_driver_claim_interface: add sanity checking
  USB: iowarrior: fix oops with malicious USB descriptors
  USB: cdc-acm: more sanity checking
  USB: uas: Reduce can_queue to MAX_CMNDS
  usb: hub: fix a typo in hub_port_init() leading to wrong logic
  usb: retry reset if a device times out
  dm: fix rq_end_stats() NULL pointer in dm_requeue_original_request()
  dm cache: make sure every metadata function checks fail_io
  dm thin metadata: don't issue prefetches if a transaction abort has failed
  dm: fix excessive dm-mq context switching
  dm snapshot: disallow the COW and origin devices from being identical
  libnvdimm: Fix security issue with DSM IOCTL.
  aic7xxx: Fix queue depth handling
  be2iscsi: set the boot_kset pointer to NULL in case of failure
  scsi: storvsc: fix SRB_STATUS_ABORTED handling
  sd: Fix discard granularity when LBPRZ=1
  aacraid: Set correct msix count for EEH recovery
  aacraid: Fix memory leak in aac_fib_map_free
  aacraid: Fix RRQ overload
  sg: fix dxferp in from_to case
  x86/mm: TLB_REMOTE_SEND_IPI should count pages
  x86/iopl: Fix iopl capability check on Xen PV
  x86/iopl/64: Properly context-switch IOPL on Xen PV
  x86/apic: Fix suspicious RCU usage in smp_trace_call_function_interrupt()
  x86/irq: Cure live lock in fixup_irqs()
  PCI: ACPI: IA64: fix IO port generic range check
  PCI: Disable IO/MEM decoding for devices with non-compliant BARs
  pinctrl-bcm2835: Fix cut-and-paste error in "pull" parsing
  s390/pci: enforce fmb page boundary rule
  s390/cpumf: add missing lpp magic initialization
  s390: fix floating pointer register corruption (again)
  EDAC, amd64_edac: Shift wrapping issue in f1x_get_norm_dct_addr()
  EDAC/sb_edac: Fix computation of channel address
  sched/preempt, sh: kmap_coherent relies on disabled preemption
  sched/cputime: Fix steal_account_process_tick() to always return jiffies
  Thermal: Ignore invalid trip points
  perf tools: Fix python extension build
  perf tools: Fix checking asprintf return value
  perf tools: Dont stop PMU parsing on alias parse error
  perf/core: Fix perf_sched_count derailment
  KVM: VMX: fix nested vpid for old KVM guests
  KVM: VMX: avoid guest hang on invalid invvpid instruction
  KVM: VMX: avoid guest hang on invalid invept instruction
  KVM: fix spin_lock_init order on x86
  KVM: i8254: change PIT discard tick policy
  KVM: x86: fix missed hardware breakpoints
  x86/PCI: Mark Broadwell-EP Home Agent & PCU as having non-compliant BARs
  perf/x86/intel: Add definition for PT PMI bit
  x86/entry/compat: Keep TS_COMPAT set during signal delivery
  x86/microcode: Untangle from BLK_DEV_INITRD
  x86/microcode/intel: Make early loader look for builtin microcode too
  mmc: sh_mmcif: Correct TX DMA channel allocation
  mmc: sh_mmcif: rework dma channel handling
  ASoC: samsung: pass DMA channels as pointers
  regulator: core: Fix nested locking of supplies
  regulator: core: avoid unused variable warning
  s390/cpumf: Fix lpp detection
  cpufreq: dt: No need to allocate resources anymore
  cpufreq: dt: No need to fetch voltage-tolerance
  cpufreq: dt: Use dev_pm_opp_set_rate() to switch frequency
  cpufreq: dt: Reuse dev_pm_opp_get_max_transition_latency()
  cpufreq: dt: Unsupported OPPs are already disabled
  cpufreq: dt: Pass regulator name to the OPP core
  cpufreq: dt: OPP layers handles clock-latency for V1 bindings as well
  cpufreq: dt: Rename 'need_update' to 'opp_v1'
  cpufreq: dt: Convert few pr_debug/err() calls to dev_dbg/err()
  cpufreq-dt: fix handling regulator_get_voltage() result
  cpufreq-dt: Supply power coefficient when registering cooling devices
  PM / OPP: Rename structures for clarity
  PM / OPP: Fix incorrect comments
  PM / OPP: Initialize regulator pointer to an error value
  PM / OPP: Initialize u_volt_min/max to a valid value
  PM / OPP: Fix NULL pointer dereference crash when disabling OPPs
  PM / OPP: Add dev_pm_opp_set_rate()
  PM / OPP: Manage device clk
  PM / OPP: Parse clock-latency and voltage-tolerance for v1 bindings
  PM / OPP: Introduce dev_pm_opp_get_max_transition_latency()
  PM / OPP: Introduce dev_pm_opp_get_max_volt_latency()
  PM / OPP: Disable OPPs that aren't supported by the regulator
  PM / OPP: get/put regulators from OPP core
  cpufreq: cpufreq-dt: avoid uninitialized variable warnings:
  PM / OPP: Use snprintf() instead of sprintf()
  PM / OPP: Set cpu_dev->id in cpumask first
  PM / OPP: Fix parsing of opp-microvolt and opp-microamp properties
  PM / OPP: Parse 'opp-<prop>-<name>' bindings
  PM / OPP: Parse 'opp-supported-hw' binding
  PM / OPP: Add missing doc comments
  PM / OPP: Rename OPP nodes as opp@<opp-hz>
  PM / OPP: Remove 'operating-points-names' binding
  PM / OPP: Add {opp-microvolt|opp-microamp}-<name> binding
  PM / OPP: Add "opp-supported-hw" binding
  PM / OPP: Add debugfs support
  arm64: vdso: Mark vDSO code as read-only

Conflicts:
	drivers/staging/android/ion/ion.c
	mm/page_alloc.c

CRs-Fixed: 1010239
Change-Id: Id59539cad642885e1e41340cebae4159ba1f7eaf
Signed-off-by: Trilok Soni <tsoni@codeaurora.org>
2016-07-22 16:45:32 -07:00
Runmin Wang
750075feff Merge remote-tracking branch 'origin/tmp-917a9a9133a6' into lsk
* tmp-917a9:
  ARM/vdso: Mark the vDSO code read-only after init
  x86/vdso: Mark the vDSO code read-only after init
  lkdtm: Verify that '__ro_after_init' works correctly
  arch: Introduce post-init read-only memory
  x86/mm: Always enable CONFIG_DEBUG_RODATA and remove the Kconfig option
  mm/init: Add 'rodata=off' boot cmdline parameter to disable read-only kernel mappings
  asm-generic: Consolidate mark_rodata_ro()
  Linux 4.4.6
  ld-version: Fix awk regex compile failure
  target: Drop incorrect ABORT_TASK put for completed commands
  block: don't optimize for non-cloned bio in bio_get_last_bvec()
  MIPS: smp.c: Fix uninitialised temp_foreign_map
  MIPS: Fix build error when SMP is used without GIC
  ovl: fix getcwd() failure after unsuccessful rmdir
  ovl: copy new uid/gid into overlayfs runtime inode
  userfaultfd: don't block on the last VM updates at exit time
  powerpc/powernv: Fix OPAL_CONSOLE_FLUSH prototype and usages
  powerpc/powernv: Add a kmsg_dumper that flushes console output on panic
  powerpc: Fix dedotify for binutils >= 2.26
  Revert "drm/radeon/pm: adjust display configuration after powerstate"
  drm/radeon: Fix error handling in radeon_flip_work_func.
  drm/amdgpu: Fix error handling in amdgpu_flip_work_func.
  Revert "drm/radeon: call hpd_irq_event on resume"
  x86/mm: Fix slow_virt_to_phys() for X86_PAE again
  gpu: ipu-v3: Do not bail out on missing optional port nodes
  mac80211: Fix Public Action frame RX in AP mode
  mac80211: check PN correctly for GCMP-encrypted fragmented MPDUs
  mac80211: minstrel_ht: fix a logic error in RTS/CTS handling
  mac80211: minstrel_ht: set default tx aggregation timeout to 0
  mac80211: fix use of uninitialised values in RX aggregation
  mac80211: minstrel: Change expected throughput unit back to Kbps
  iwlwifi: mvm: inc pending frames counter also when txing non-sta
  can: gs_usb: fixed disconnect bug by removing erroneous use of kfree()
  cfg80211/wext: fix message ordering
  wext: fix message delay/ordering
  ovl: fix working on distributed fs as lower layer
  ovl: ignore lower entries when checking purity of non-directory entries
  ASoC: wm8958: Fix enum ctl accesses in a wrong type
  ASoC: wm8994: Fix enum ctl accesses in a wrong type
  ASoC: samsung: Use IRQ safe spin lock calls
  ASoC: dapm: Fix ctl value accesses in a wrong type
  ncpfs: fix a braino in OOM handling in ncp_fill_cache()
  jffs2: reduce the breakage on recovery from halfway failed rename()
  dmaengine: at_xdmac: fix residue computation
  tracing: Fix check for cpu online when event is disabled
  s390/dasd: fix diag 0x250 inline assembly
  s390/mm: four page table levels vs. fork
  KVM: MMU: fix reserved bit check for ept=0/CR0.WP=0/CR4.SMEP=1/EFER.NX=0
  KVM: MMU: fix ept=0/pte.u=1/pte.w=0/CR0.WP=0/CR4.SMEP=1/EFER.NX=0 combo
  KVM: PPC: Book3S HV: Sanitize special-purpose register values on guest exit
  KVM: s390: correct fprs on SIGP (STOP AND) STORE STATUS
  KVM: VMX: disable PEBS before a guest entry
  kvm: cap halt polling at exactly halt_poll_ns
  PCI: Allow a NULL "parent" pointer in pci_bus_assign_domain_nr()
  ARM: OMAP2+: hwmod: Introduce ti,no-idle dt property
  ARM: dts: dra7: do not gate cpsw clock due to errata i877
  ARM: mvebu: fix overlap of Crypto SRAM with PCIe memory window
  arm64: account for sparsemem section alignment when choosing vmemmap offset
  Linux 4.4.5
  drm/amdgpu: fix topaz/tonga gmc assignment in 4.4 stable
  modules: fix longstanding /proc/kallsyms vs module insertion race.
  drm/i915: refine qemu south bridge detection
  drm/i915: more virtual south bridge detection
  block: get the 1st and last bvec via helpers
  block: check virt boundary in bio_will_gap()
  drm/amdgpu: Use drm_calloc_large for VM page_tables array
  thermal: cpu_cooling: fix out of bounds access in time_in_idle
  i2c: brcmstb: allocate correct amount of memory for regmap
  ubi: Fix out of bounds write in volume update code
  cxl: Fix PSL timebase synchronization detection
  MIPS: traps: Fix SIGFPE information leak from `do_ov' and `do_trap_or_bp'
  MIPS: scache: Fix scache init with invalid line size.
  USB: serial: option: add support for Quectel UC20
  USB: serial: option: add support for Telit LE922 PID 0x1045
  USB: qcserial: add Sierra Wireless EM74xx device ID
  USB: qcserial: add Dell Wireless 5809e Gobi 4G HSPA+ (rev3)
  USB: cp210x: Add ID for Parrot NMEA GPS Flight Recorder
  usb: chipidea: otg: change workqueue ci_otg as freezable
  ALSA: timer: Fix broken compat timer user status ioctl
  ALSA: hdspm: Fix zero-division
  ALSA: hdsp: Fix wrong boolean ctl value accesses
  ALSA: hdspm: Fix wrong boolean ctl value accesses
  ALSA: seq: oss: Don't drain at closing a client
  ALSA: pcm: Fix ioctls for X32 ABI
  ALSA: timer: Fix ioctls for X32 ABI
  ALSA: rawmidi: Fix ioctls X32 ABI
  ALSA: hda - Fix mic issues on Acer Aspire E1-472
  ALSA: ctl: Fix ioctls for X32 ABI
  ALSA: usb-audio: Add a quirk for Plantronics DA45
  adv7604: fix tx 5v detect regression
  dmaengine: pxa_dma: fix cyclic transfers
  Fix directory hardlinks from deleted directories
  jffs2: Fix page lock / f->sem deadlock
  Revert "jffs2: Fix lock acquisition order bug in jffs2_write_begin"
  Btrfs: fix loading of orphan roots leading to BUG_ON
  pata-rb532-cf: get rid of the irq_to_gpio() call
  tracing: Do not have 'comm' filter override event 'comm' field
  ata: ahci: don't mark HotPlugCapable Ports as external/removable
  PM / sleep / x86: Fix crash on graph trace through x86 suspend
  arm64: vmemmap: use virtual projection of linear region
  Adding Intel Lewisburg device IDs for SATA
  writeback: flush inode cgroup wb switches instead of pinning super_block
  block: bio: introduce helpers to get the 1st and last bvec
  libata: Align ata_device's id on a cacheline
  libata: fix HDIO_GET_32BIT ioctl
  drm/amdgpu: return from atombios_dp_get_dpcd only when error
  drm/amdgpu/gfx8: specify which engine to wait before vm flush
  drm/amdgpu: apply gfx_v8 fixes to gfx_v7 as well
  drm/amdgpu/pm: update current crtc info after setting the powerstate
  drm/radeon/pm: update current crtc info after setting the powerstate
  drm/ast: Fix incorrect register check for DRAM width
  target: Fix WRITE_SAME/DISCARD conversion to linux 512b sectors
  iommu/vt-d: Use BUS_NOTIFY_REMOVED_DEVICE in hotplug path
  iommu/amd: Fix boot warning when device 00:00.0 is not iommu covered
  iommu/amd: Apply workaround for ATS write permission check
  arm/arm64: KVM: Fix ioctl error handling
  KVM: x86: fix root cause for missed hardware breakpoints
  vfio: fix ioctl error handling
  Fix cifs_uniqueid_to_ino_t() function for s390x
  CIFS: Fix SMB2+ interim response processing for read requests
  cifs: fix out-of-bounds access in lease parsing
  fbcon: set a default value to blink interval
  kvm: x86: Update tsc multiplier on change.
  mips/kvm: fix ioctl error handling
  parisc: Fix ptrace syscall number and return value modification
  PCI: keystone: Fix MSI code that retrieves struct pcie_port pointer
  block: Initialize max_dev_sectors to 0
  drm/amdgpu: mask out WC from BO on unsupported arches
  btrfs: async-thread: Fix a use-after-free error for trace
  btrfs: Fix no_space in write and rm loop
  Btrfs: fix deadlock running delayed iputs at transaction commit time
  drivers: sh: Restore legacy clock domain on SuperH platforms
  use ->d_seq to get coherency between ->d_inode and ->d_flags
  Linux 4.4.4
  iwlwifi: mvm: don't allow sched scans without matches to be started
  iwlwifi: update and fix 7265 series PCI IDs
  iwlwifi: pcie: properly configure the debug buffer size for 8000
  iwlwifi: dvm: fix WoWLAN
  security: let security modules use PTRACE_MODE_* with bitmasks
  IB/cma: Fix RDMA port validation for iWarp
  x86/irq: Plug vector cleanup race
  x86/irq: Call irq_force_move_complete with irq descriptor
  x86/irq: Remove outgoing CPU from vector cleanup mask
  x86/irq: Remove the cpumask allocation from send_cleanup_vector()
  x86/irq: Clear move_in_progress before sending cleanup IPI
  x86/irq: Remove offline cpus from vector cleanup
  x86/irq: Get rid of code duplication
  x86/irq: Copy vectormask instead of an AND operation
  x86/irq: Check vector allocation early
  x86/irq: Reorganize the search in assign_irq_vector
  x86/irq: Reorganize the return path in assign_irq_vector
  x86/irq: Do not use apic_chip_data.old_domain as temporary buffer
  x86/irq: Validate that irq descriptor is still active
  x86/irq: Fix a race in x86_vector_free_irqs()
  x86/irq: Call chip->irq_set_affinity in proper context
  x86/entry/compat: Add missing CLAC to entry_INT80_32
  x86/mpx: Fix off-by-one comparison with nr_registers
  hpfs: don't truncate the file when delete fails
  do_last(): ELOOP failure exit should be done after leaving RCU mode
  should_follow_link(): validate ->d_seq after having decided to follow
  xen/pcifront: Fix mysterious crashes when NUMA locality information was extracted.
  xen/pciback: Save the number of MSI-X entries to be copied later.
  xen/pciback: Check PF instead of VF for PCI_COMMAND_MEMORY
  xen/scsiback: correct frontend counting
  xen/arm: correctly handle DMA mapping of compound pages
  ARM: at91/dt: fix typo in sama5d2 pinmux descriptions
  ARM: OMAP2+: Fix onenand initialization to avoid filesystem corruption
  do_last(): don't let a bogus return value from ->open() et.al. to confuse us
  kernel/resource.c: fix muxed resource handling in __request_region()
  sunrpc/cache: fix off-by-one in qword_get()
  tracing: Fix showing function event in available_events
  powerpc/eeh: Fix partial hotplug criterion
  KVM: x86: MMU: fix ubsan index-out-of-range warning
  KVM: x86: fix conversion of addresses to linear in 32-bit protected mode
  KVM: x86: fix missed hardware breakpoints
  KVM: arm/arm64: vgic: Ensure bitmaps are long enough
  KVM: async_pf: do not warn on page allocation failures
  of/irq: Fix msi-map calculation for nonzero rid-base
  NFSv4: Fix a dentry leak on alias use
  nfs: fix nfs_size_to_loff_t
  block: fix use-after-free in dio_bio_complete
  bio: return EINTR if copying to user space got interrupted
  i2c: i801: Adding Intel Lewisburg support for iTCO
  phy: core: fix wrong err handle for phy_power_on
  writeback: keep superblock pinned during cgroup writeback association switches
  cgroup: make sure a parent css isn't offlined before its children
  cpuset: make mm migration asynchronous
  PCI/AER: Flush workqueue on device remove to avoid use-after-free
  ARCv2: SMP: Emulate IPI to self using software triggered interrupt
  ARCv2: STAR 9000950267: Handle return from intr to Delay Slot #2
  libata: fix sff host state machine locking while polling
  qla2xxx: Fix stale pointer access.
  spi: atmel: fix gpio chip-select in case of non-DT platform
  target: Fix race with SCF_SEND_DELAYED_TAS handling
  target: Fix remote-port TMR ABORT + se_cmd fabric stop
  target: Fix TAS handling for multi-session se_node_acls
  target: Fix LUN_RESET active TMR descriptor handling
  target: Fix LUN_RESET active I/O handling for ACK_KREF
  ALSA: hda - Fixing background noise on Dell Inspiron 3162
  ALSA: hda - Apply clock gate workaround to Skylake, too
  Revert "workqueue: make sure delayed work run in local cpu"
  workqueue: handle NUMA_NO_NODE for unbound pool_workqueue lookup
  mac80211: Requeue work after scan complete for all VIF types.
  rfkill: fix rfkill_fop_read wait_event usage
  tick/nohz: Set the correct expiry when switching to nohz/lowres mode
  perf stat: Do not clean event's private stats
  cdc-acm:exclude Samsung phone 04e8:685d
  Revert "Staging: panel: usleep_range is preferred over udelay"
  Staging: speakup: Fix getting port information
  sd: Optimal I/O size is in bytes, not sectors
  libceph: don't spam dmesg with stray reply warnings
  libceph: use the right footer size when skipping a message
  libceph: don't bail early from try_read() when skipping a message
  libceph: fix ceph_msg_revoke()
  seccomp: always propagate NO_NEW_PRIVS on tsync
  cpufreq: Fix NULL reference crash while accessing policy->governor_data
  cpufreq: pxa2xx: fix pxa_cpufreq_change_voltage prototype
  hwmon: (ads1015) Handle negative conversion values correctly
  hwmon: (gpio-fan) Remove un-necessary speed_index lookup for thermal hook
  hwmon: (dell-smm) Blacklist Dell Studio XPS 8000
  Thermal: do thermal zone update after a cooling device registered
  Thermal: handle thermal zone device properly during system sleep
  Thermal: initialize thermal zone device correctly
  IB/mlx5: Expose correct maximum number of CQE capacity
  IB/qib: Support creating qps with GFP_NOIO flag
  IB/qib: fix mcast detach when qp not attached
  IB/cm: Fix a recently introduced deadlock
  dmaengine: dw: disable BLOCK IRQs for non-cyclic xfer
  dmaengine: at_xdmac: fix resume for cyclic transfers
  dmaengine: dw: fix cyclic transfer callbacks
  dmaengine: dw: fix cyclic transfer setup
  nfit: fix multi-interface dimm handling, acpi6.1 compatibility
  ACPI / PCI / hotplug: unlock in error path in acpiphp_enable_slot()
  ACPI: Revert "ACPI / video: Add Dell Inspiron 5737 to the blacklist"
  ACPI / video: Add disable_backlight_sysfs_if quirk for the Toshiba Satellite R830
  ACPI / video: Add disable_backlight_sysfs_if quirk for the Toshiba Portege R700
  lib: sw842: select crc32
  uapi: update install list after nvme.h rename
  ideapad-laptop: Add Lenovo Yoga 700 to no_hw_rfkill dmi list
  ideapad-laptop: Add Lenovo ideapad Y700-17ISK to no_hw_rfkill dmi list
  toshiba_acpi: Fix blank screen at boot if transflective backlight is supported
  make sure that freeing shmem fast symlinks is RCU-delayed
  drm/radeon/pm: adjust display configuration after powerstate
  drm/radeon: Don't hang in radeon_flip_work_func on disabled crtc. (v2)
  drm: Fix treatment of drm_vblank_offdelay in drm_vblank_on() (v2)
  drm: Fix drm_vblank_pre/post_modeset regression from Linux 4.4
  drm: Prevent vblank counter bumps > 1 with active vblank clients. (v2)
  drm: No-Op redundant calls to drm_vblank_off() (v2)
  drm/radeon: use post-decrement in error handling
  drm/qxl: use kmalloc_array to alloc reloc_info in qxl_process_single_command
  drm/i915: fix error path in intel_setup_gmbus()
  drm/i915/dsi: don't pass arbitrary data to sideband
  drm/i915/dsi: defend gpio table against out of bounds access
  drm/i915/skl: Don't skip mst encoders in skl_ddi_pll_select()
  drm/i915: Don't reject primary plane windowing with color keying enabled on SKL+
  drm/i915/dp: fall back to 18 bpp when sink capability is unknown
  drm/i915: Make sure DC writes are coherent on flush.
  drm/i915: Init power domains early in driver load
  drm/i915: intel_hpd_init(): Fix suspend/resume reprobing
  drm/i915: Restore inhibiting the load of the default context
  drm: fix missing reference counting decrease
  drm/radeon: hold reference to fences in radeon_sa_bo_new
  drm/radeon: mask out WC from BO on unsupported arches
  drm: add helper to check for wc memory support
  drm/radeon: fix DP audio support for APU with DCE4.1 display engine
  drm/radeon: Add a common function for DFS handling
  drm/radeon: cleaned up VCO output settings for DP audio
  drm/radeon: properly byte swap vce firmware setup
  drm/radeon: clean up fujitsu quirks
  drm/radeon: Fix "slow" audio over DP on DCE8+
  drm/radeon: call hpd_irq_event on resume
  drm/radeon: Fix off-by-one errors in radeon_vm_bo_set_addr
  drm/dp/mst: deallocate payload on port destruction
  drm/dp/mst: Reverse order of MST enable and clearing VC payload table.
  drm/dp/mst: move GUID storage from mgr, port to only mst branch
  drm/dp/mst: Calculate MST PBN with 31.32 fixed point
  drm: Add drm_fixp_from_fraction and drm_fixp2int_ceil
  drm/dp/mst: fix in RAD element access
  drm/dp/mst: fix in MSTB RAD initialization
  drm/dp/mst: always send reply for UP request
  drm/dp/mst: process broadcast messages correctly
  drm/nouveau: platform: Fix deferred probe
  drm/nouveau/disp/dp: ensure sink is powered up before attempting link training
  drm/nouveau/display: Enable vblank irqs after display engine is on again.
  drm/nouveau/kms: take mode_config mutex in connector hotplug path
  drm/amdgpu/pm: adjust display configuration after powerstate
  drm/amdgpu: Don't hang in amdgpu_flip_work_func on disabled crtc.
  drm/amdgpu: use post-decrement in error handling
  drm/amdgpu: fix issue with overlapping userptrs
  drm/amdgpu: hold reference to fences in amdgpu_sa_bo_new (v2)
  drm/amdgpu: remove unnecessary forward declaration
  drm/amdgpu: fix s4 resume
  drm/amdgpu: remove exp hardware support from iceland
  drm/amdgpu: don't load MEC2 on topaz
  drm/amdgpu: drop topaz support from gmc8 module
  drm/amdgpu: pull topaz gmc bits into gmc_v7
  drm/amdgpu: The VI specific EXE bit should only apply to GMC v8.0 above
  drm/amdgpu: iceland use CI based MC IP
  drm/amdgpu: move gmc7 support out of CIK dependency
  drm/amdgpu: no need to load MC firmware on fiji
  drm/amdgpu: fix amdgpu_bo_pin_restricted VRAM placing v2
  drm/amdgpu: fix tonga smu resume
  drm/amdgpu: fix lost sync_to if scheduler is enabled.
  drm/amdgpu: call hpd_irq_event on resume
  drm/amdgpu: Fix off-by-one errors in amdgpu_vm_bo_map
  drm/vmwgfx: respect 'nomodeset'
  drm/vmwgfx: Fix a width / pitch mismatch on framebuffer updates
  drm/vmwgfx: Fix an incorrect lock check
  virtio_pci: fix use after free on release
  virtio_balloon: fix race between migration and ballooning
  virtio_balloon: fix race by fill and leak
  regulator: mt6311: MT6311_REGULATOR needs to select REGMAP_I2C
  regulator: axp20x: Fix GPIO LDO enable value for AXP22x
  clk: exynos: use irqsave version of spin_lock to avoid deadlock with irqs
  cxl: use correct operator when writing pcie config space values
  sparc64: fix incorrect sign extension in sys_sparc64_personality
  EDAC, mc_sysfs: Fix freeing bus' name
  EDAC: Robustify workqueues destruction
  MIPS: Fix buffer overflow in syscall_get_arguments()
  MIPS: Fix some missing CONFIG_CPU_MIPSR6 #ifdefs
  MIPS: hpet: Choose a safe value for the ETIME check
  MIPS: Loongson-3: Fix SMP_ASK_C0COUNT IPI handler
  Revert "MIPS: Fix PAGE_MASK definition"
  cputime: Prevent 32bit overflow in time[val|spec]_to_cputime()
  time: Avoid signed overflow in timekeeping_get_ns()
  Bluetooth: 6lowpan: Fix handling of uncompressed IPv6 packets
  Bluetooth: 6lowpan: Fix kernel NULL pointer dereferences
  Bluetooth: Fix incorrect removing of IRKs
  Bluetooth: Add support of Toshiba Broadcom based devices
  Bluetooth: Use continuous scanning when creating LE connections
  Drivers: hv: vmbus: Fix a Host signaling bug
  tools: hv: vss: fix the write()'s argument: error -> vss_msg
  mmc: sdhci: Allow override of get_cd() called from sdhci_request()
  mmc: sdhci: Allow override of mmc host operations
  mmc: sdhci-pci: Fix card detect race for Intel BXT/APL
  mmc: pxamci: fix again read-only gpio detection polarity
  mmc: sdhci-acpi: Fix card detect race for Intel BXT/APL
  mmc: mmci: fix an ages old detection error
  mmc: core: Enable tuning according to the actual timing
  mmc: sdhci: Fix sdhci_runtime_pm_bus_on/off()
  mmc: mmc: Fix incorrect use of driver strength switching HS200 and HS400
  mmc: sdio: Fix invalid vdd in voltage switch power cycle
  mmc: sdhci: Fix DMA descriptor with zero data length
  mmc: sdhci-pci: Do not default to 33 Ohm driver strength for Intel SPT
  mmc: usdhi6rol0: handle NULL data in timeout
  clockevents/tcb_clksrc: Prevent disabling an already disabled clock
  posix-clock: Fix return code on the poll method's error path
  irqchip/gic-v3-its: Fix double ICC_EOIR write for LPI in EOImode==1
  irqchip/atmel-aic: Fix wrong bit operation for IRQ priority
  irqchip/mxs: Add missing set_handle_irq()
  irqchip/omap-intc: Add support for spurious irq handling
  coresight: checking for NULL string in coresight_name_match()
  dm: fix dm_rq_target_io leak on faults with .request_fn DM w/ blk-mq paths
  dm snapshot: fix hung bios when copy error occurs
  dm space map metadata: remove unused variable in brb_pop()
  tda1004x: only update the frontend properties if locked
  vb2: fix a regression in poll() behavior for output,streams
  gspca: ov534/topro: prevent a division by 0
  si2157: return -EINVAL if firmware blob is too big
  media: dvb-core: Don't force CAN_INVERSION_AUTO in oneshot mode
  rc: sunxi-cir: Initialize the spinlock properly
  namei: ->d_inode of a pinned dentry is stable only for positives
  mei: validate request value in client notify request ioctl
  mei: fix fasync return value on error
  rtlwifi: rtl8723be: Fix module parameter initialization
  rtlwifi: rtl8188ee: Fix module parameter initialization
  rtlwifi: rtl8192se: Fix module parameter initialization
  rtlwifi: rtl8723ae: Fix initialization of module parameters
  rtlwifi: rtl8192de: Fix incorrect module parameter descriptions
  rtlwifi: rtl8192ce: Fix handling of module parameters
  rtlwifi: rtl8192cu: Add missing parameter setup
  rtlwifi: rtl_pci: Fix kernel panic
  locks: fix unlock when fcntl_setlk races with a close
  um: link with -lpthread
  uml: fix hostfs mknod()
  uml: flush stdout before forking
  s390/fpu: signals vs. floating point control register
  s390/compat: correct restore of high gprs on signal return
  s390/dasd: fix performance drop
  s390/dasd: fix refcount for PAV reassignment
  s390/dasd: prevent incorrect length error under z/VM after PAV changes
  s390: fix normalization bug in exception table sorting
  btrfs: initialize the seq counter in struct btrfs_device
  Btrfs: Initialize btrfs_root->highest_objectid when loading tree root and subvolume roots
  Btrfs: fix transaction handle leak on failure to create hard link
  Btrfs: fix number of transaction units required to create symlink
  Btrfs: send, don't BUG_ON() when an empty symlink is found
  btrfs: statfs: report zero available if metadata are exhausted
  Btrfs: igrab inode in writepage
  Btrfs: add missing brelse when superblock checksum fails
  KVM: s390: fix memory overwrites when vx is disabled
  s390/kvm: remove dependency on struct save_area definition
  clocksource/drivers/vt8500: Increase the minimum delta
  genirq: Validate action before dereferencing it in handle_irq_event_percpu()
  mm: numa: quickly fail allocations for NUMA balancing on full nodes
  mm: thp: fix SMP race condition between THP page fault and MADV_DONTNEED
  ocfs2: unlock inode if deleting inode from orphan fails
  drm/i915: shut up gen8+ SDE irq dmesg noise
  iw_cxgb3: Fix incorrectly returning error on success
  spi: omap2-mcspi: Prevent duplicate gpio_request
  drivers: android: correct the size of struct binder_uintptr_t for BC_DEAD_BINDER_DONE
  USB: option: add "4G LTE usb-modem U901"
  USB: option: add support for SIM7100E
  USB: cp210x: add IDs for GE B650V3 and B850V3 boards
  usb: dwc3: Fix assignment of EP transfer resources
  can: ems_usb: Fix possible tx overflow
  dm thin: fix race condition when destroying thin pool workqueue
  bcache: Change refill_dirty() to always scan entire disk if necessary
  bcache: prevent crash on changing writeback_running
  bcache: allows use of register in udev to avoid "device_busy" error.
  bcache: unregister reboot notifier if bcache fails to unregister device
  bcache: fix a leak in bch_cached_dev_run()
  bcache: clear BCACHE_DEV_UNLINK_DONE flag when attaching a backing device
  bcache: Add a cond_resched() call to gc
  bcache: fix a livelock when we cause a huge number of cache misses
  lib/ucs2_string: Correct ucs2 -> utf8 conversion
  efi: Add pstore variables to the deletion whitelist
  efi: Make efivarfs entries immutable by default
  efi: Make our variable validation list include the guid
  efi: Do variable name validation tests in utf8
  efi: Use ucs2_as_utf8 in efivarfs instead of open coding a bad version
  lib/ucs2_string: Add ucs2 -> utf8 helper functions
  ARM: 8457/1: psci-smp is built only for SMP
  drm/gma500: Use correct unref in the gem bo create function
  devm_memremap: Fix error value when memremap failed
  KVM: s390: fix guest fprs memory leak
  arm64: errata: Add -mpc-relative-literal-loads to build flags
  ARM: debug-ll: fix BCM63xx entry for multiplatform
  ext4: fix bh->b_state corruption
  sctp: Fix port hash table size computation
  unix_diag: fix incorrect sign extension in unix_lookup_by_ino
  tipc: unlock in error path
  rtnl: RTM_GETNETCONF: fix wrong return value
  IFF_NO_QUEUE: Fix for drivers not calling ether_setup()
  tcp/dccp: fix another race at listener dismantle
  route: check and remove route cache when we get route
  net_sched fix: reclassification needs to consider ether protocol changes
  pppoe: fix reference counting in PPPoE proxy
  l2tp: Fix error creating L2TP tunnels
  net/mlx4_en: Avoid changing dev->features directly in run-time
  net/mlx4_en: Choose time-stamping shift value according to HW frequency
  net/mlx4_en: Count HW buffer overrun only once
  qmi_wwan: add "4G LTE usb-modem U901"
  tcp: md5: release request socket instead of listener
  tipc: fix premature addition of node to lookup table
  af_unix: Guard against other == sk in unix_dgram_sendmsg
  af_unix: Don't set err in unix_stream_read_generic unless there was an error
  ipv4: fix memory leaks in ip_cmsg_send() callers
  bonding: Fix ARP monitor validation
  bpf: fix branch offset adjustment on backjumps after patching ctx expansion
  flow_dissector: Fix unaligned access in __skb_flow_dissector when used by eth_get_headlen
  net: Copy inner L3 and L4 headers as unaligned on GRE TEB
  sctp: translate network order to host order when users get a hmacid
  enic: increment devcmd2 result ring in case of timeout
  tg3: Fix for tg3 transmit queue 0 timed out when too many gso_segs
  net:Add sysctl_max_skb_frags
  tcp: do not drop syn_recv on all icmp reports
  unix: correctly track in-flight fds in sending process user_struct
  ipv6: fix a lockdep splat
  ipv6: addrconf: Fix recursive spin lock call
  ipv6/udp: use sticky pktinfo egress ifindex on connect()
  ipv6: enforce flowi6_oif usage in ip6_dst_lookup_tail()
  tcp: beware of alignments in tcp_get_info()
  switchdev: Require RTNL mutex to be held when sending FDB notifications
  inet: frag: Always orphan skbs inside ip_defrag()
  tipc: fix connection abort during subscription cancel
  net: dsa: fix mv88e6xxx switches
  sctp: allow setting SCTP_SACK_IMMEDIATELY by the application
  pptp: fix illegal memory access caused by multiple bind()s
  af_unix: fix struct pid memory leak
  tcp: fix NULL deref in tcp_v4_send_ack()
  lwt: fix rx checksum setting for lwt devices tunneling over ipv6
  tunnels: Allow IPv6 UDP checksums to be correctly controlled.
  net: dp83640: Fix tx timestamp overflow handling.
  gro: Make GRO aware of lightweight tunnels.
  af_iucv: Validate socket address length in iucv_sock_bind()

Conflicts:
	arch/arm64/Makefile
	arch/arm64/include/asm/cacheflush.h
	drivers/mmc/host/sdhci.c
	drivers/usb/dwc3/ep0.c
	drivers/usb/dwc3/gadget.c
	kernel/module.c
	sound/core/pcm_compat.c

CRs-Fixed: 1010239
Signed-off-by: Runmin Wang <runminw@codeaurora.org>
Change-Id: I41a28636fc9ad91f9d979b191784609476294cdf
2016-07-12 11:40:49 -07:00
Arun Menon
0f44a0706b msm: vidc: Add missing qmenu entries for MPEG ctrls
V4l2 control framework mandates a qmenu entry for each control item.
Validate_new() function accesses the qmenu entry for control item,
and any missing qmenu entries causes a crash within this function.
This patch fixes those crashes.

CRs-Fixed: 1031156
Change-Id: Ie507b1de9ce08221678a730146164d6e970aac8a
Signed-off-by: Arun Menon <avmenon@codeaurora.org>
Signed-off-by: Amit Shekhar <ashekhar@codeaurora.org>
2016-06-27 19:53:07 -07:00
Tiffany Lin
08c6a55e79 media: v4l2-compat-ioctl32: fix missing reserved field copy in put_v4l2_create32
commit baf43c6eace43868e490f18560287fa3481b2159 upstream.

In v4l2-compliance utility, test VIDIOC_CREATE_BUFS will check whether reserved
filed of v4l2_create_buffers filled with zero
Reserved field is filled with zero in v4l_create_bufs.
This patch copy reserved field of v4l2_create_buffer from kernel space to user
space

Signed-off-by: Tiffany Lin <tiffany.lin@mediatek.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-06-07 18:14:35 -07:00
Arun Menon
71d4d751e1 [media] v4l: Add qcom video color formats
Update v4l_fill_fmtdesc() with qcom specific video
color formats to prevent it from throwing up
a warning stacktrace and flooding the logs.

CRs-Fixed: 1018787
Change-Id: Ia140bfb2fcd699937cd845c4489458e5fefb5150
Signed-off-by: Arun Menon <avmenon@codeaurora.org>
2016-05-20 19:23:48 -07:00
Mauro Carvalho Chehab
9df2dc6cf4 Revert "[media] videobuf2-v4l2: Verify planes array in buffer dequeueing"
commit 93f0750dcdaed083d6209b01e952e98ca730db66 upstream.

This patch causes a Kernel panic when called on a DVB driver.

This was also reported by David R <david@unsolicited.net>:

May  7 14:47:35 server kernel: [  501.247123] BUG: unable to handle kernel NULL pointer dereference at 0000000000000004
May  7 14:47:35 server kernel: [  501.247239] IP: [<ffffffffa0222c71>] __verify_planes_array.isra.3+0x1/0x80 [videobuf2_v4l2]
May  7 14:47:35 server kernel: [  501.247354] PGD cae6f067 PUD ca99c067 PMD 0
May  7 14:47:35 server kernel: [  501.247426] Oops: 0000 [#1] SMP
May  7 14:47:35 server kernel: [  501.247482] Modules linked in: xfs tun xt_connmark xt_TCPMSS xt_tcpmss xt_owner xt_REDIRECT nf_nat_redirect xt_nat ipt_MASQUERADE nf_nat_masquerade_ipv4 ts_kmp ts_bm xt_string ipt_REJECT nf_reject_ipv4 xt_recent xt_conntrack xt_multiport xt_pkttype xt_tcpudp xt_mark nf_log_ipv4 nf_log_common xt_LOG xt_limit iptable_mangle iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_filter ip_tables ip6table_filter ip6_tables x_tables pppoe pppox dm_crypt ts2020 regmap_i2c ds3000 cx88_dvb dvb_pll cx88_vp3054_i2c mt352 videobuf2_dvb cx8800 cx8802 cx88xx pl2303 tveeprom videobuf2_dma_sg ppdev videobuf2_memops videobuf2_v4l2 videobuf2_core dvb_usb_digitv snd_hda_codec_via snd_hda_codec_hdmi snd_hda_codec_generic radeon dvb_usb snd_hda_intel amd64_edac_mod serio_raw snd_hda_codec edac_core fbcon k10temp bitblit softcursor snd_hda_core font snd_pcm_oss i2c_piix4 snd_mixer_oss tileblit drm_kms_helper syscopyarea snd_pcm snd_seq_dummy sysfillrect snd_seq_oss sysimgblt fb_sys_fops ttm snd_seq_midi r8169 snd_rawmidi drm snd_seq_midi_event e1000e snd_seq snd_seq_device snd_timer snd ptp pps_core i2c_algo_bit soundcore parport_pc ohci_pci shpchp tpm_tis tpm nfsd auth_rpcgss oid_registry hwmon_vid exportfs nfs_acl mii nfs bonding lockd grace lp sunrpc parport
May  7 14:47:35 server kernel: [  501.249564] CPU: 1 PID: 6889 Comm: vb2-cx88[0] Not tainted 4.5.3 #3
May  7 14:47:35 server kernel: [  501.249644] Hardware name: System manufacturer System Product Name/M4A785TD-V EVO, BIOS 0211    07/08/2009
May  7 14:47:35 server kernel: [  501.249767] task: ffff8800aebf3600 ti: ffff8801e07a0000 task.ti: ffff8801e07a0000
May  7 14:47:35 server kernel: [  501.249861] RIP: 0010:[<ffffffffa0222c71>]  [<ffffffffa0222c71>] __verify_planes_array.isra.3+0x1/0x80 [videobuf2_v4l2]
May  7 14:47:35 server kernel: [  501.250002] RSP: 0018:ffff8801e07a3de8  EFLAGS: 00010086
May  7 14:47:35 server kernel: [  501.250071] RAX: 0000000000000283 RBX: ffff880210dc5000 RCX: 0000000000000283
May  7 14:47:35 server kernel: [  501.250161] RDX: ffffffffa0222cf0 RSI: 0000000000000000 RDI: ffff880210dc5014
May  7 14:47:35 server kernel: [  501.250251] RBP: ffff8801e07a3df8 R08: ffff8801e07a0000 R09: 0000000000000000
May  7 14:47:35 server kernel: [  501.250348] R10: 0000000000000000 R11: 0000000000000001 R12: ffff8800cda2a9d8
May  7 14:47:35 server kernel: [  501.250438] R13: ffff880210dc51b8 R14: 0000000000000000 R15: ffff8800cda2a828
May  7 14:47:35 server kernel: [  501.250528] FS:  00007f5b77fff700(0000) GS:ffff88021fc40000(0000) knlGS:00000000adaffb40
May  7 14:47:35 server kernel: [  501.250631] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
May  7 14:47:35 server kernel: [  501.250704] CR2: 0000000000000004 CR3: 00000000ca19d000 CR4: 00000000000006e0
May  7 14:47:35 server kernel: [  501.250794] Stack:
May  7 14:47:35 server kernel: [  501.250822]  ffff8801e07a3df8 ffffffffa0222cfd ffff8801e07a3e70 ffffffffa0236beb
May  7 14:47:35 server kernel: [  501.250937]  0000000000000283 ffff8801e07a3e94 0000000000000000 0000000000000000
May  7 14:47:35 server kernel: [  501.251051]  ffff8800aebf3600 ffffffff8108d8e0 ffff8801e07a3e38 ffff8801e07a3e38
May  7 14:47:35 server kernel: [  501.251165] Call Trace:
May  7 14:47:35 server kernel: [  501.251200]  [<ffffffffa0222cfd>] ? __verify_planes_array_core+0xd/0x10 [videobuf2_v4l2]
May  7 14:47:35 server kernel: [  501.251306]  [<ffffffffa0236beb>] vb2_core_dqbuf+0x2eb/0x4c0 [videobuf2_core]
May  7 14:47:35 server kernel: [  501.251398]  [<ffffffff8108d8e0>] ? prepare_to_wait_event+0x100/0x100
May  7 14:47:35 server kernel: [  501.251482]  [<ffffffffa023855b>] vb2_thread+0x1cb/0x220 [videobuf2_core]
May  7 14:47:35 server kernel: [  501.251569]  [<ffffffffa0238390>] ? vb2_core_qbuf+0x230/0x230 [videobuf2_core]
May  7 14:47:35 server kernel: [  501.251662]  [<ffffffffa0238390>] ? vb2_core_qbuf+0x230/0x230 [videobuf2_core]
May  7 14:47:35 server kernel: [  501.255982]  [<ffffffff8106f984>] kthread+0xc4/0xe0
May  7 14:47:35 server kernel: [  501.260292]  [<ffffffff8106f8c0>] ? kthread_park+0x50/0x50
May  7 14:47:35 server kernel: [  501.264615]  [<ffffffff81697a5f>] ret_from_fork+0x3f/0x70
May  7 14:47:35 server kernel: [  501.268962]  [<ffffffff8106f8c0>] ? kthread_park+0x50/0x50
May  7 14:47:35 server kernel: [  501.273216] Code: 0d 01 74 16 48 8b 46 28 48 8b 56 30 48 89 87 d0 01 00 00 48 89 97 d8 01 00 00 5d c3 66 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 55 <8b> 46 04 48 89 e5 8d 50 f7 31 c0 83 fa 01 76 02 5d c3 48 83 7e
May  7 14:47:35 server kernel: [  501.282146] RIP  [<ffffffffa0222c71>] __verify_planes_array.isra.3+0x1/0x80 [videobuf2_v4l2]
May  7 14:47:35 server kernel: [  501.286391]  RSP <ffff8801e07a3de8>
May  7 14:47:35 server kernel: [  501.290619] CR2: 0000000000000004
May  7 14:47:35 server kernel: [  501.294786] ---[ end trace b2b354153ccad110 ]---

This reverts commit 2c1f6951a8a82e6de0d82b1158b5e493fc6c54ab.

Cc: Sakari Ailus <sakari.ailus@linux.intel.com>
Cc: Hans Verkuil <hans.verkuil@cisco.com>
Fixes: 2c1f6951a8a8 ("[media] videobuf2-v4l2: Verify planes array in buffer dequeueing")
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-05-18 17:06:55 -07:00
Arun Menon
be489cec86 [media] v4l: Update v4l2 32bit structures
Update v4l2_event32 structure with updated elements
from v4l2_event structure. Also copy and update
reserved and other fields during 32 bit ioctl handling.

CRs-Fixed: 1013345
Change-Id: I3038a2c0c7f2b7f13c412dc04890744d8dbe37ee
Signed-off-by: Arun Menon <avmenon@codeaurora.org>
2016-05-11 17:44:10 -07:00