Evolution-X-Devices/kernel_google_b1c1
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
705,034 Commits 4 Branches 0 Tags
vic-testing
Commit Graph

75 Commits

Author SHA1 Message Date
Lucas Wei
a7836adcc8 Merge android-4.9-q (4.9.264) into android-msm-pixel-4.9-lts 
Merge 4.9.264 into android-4.9-q
Linux 4.9.264
    xen-blkback: don't leak persistent grants from xen_blkbk_map()
    mac80211: fix double free in ibss_leave
    net: qrtr: fix a kernel-infoleak in qrtr_recvmsg()
    net: sched: validate stab values
  * can: dev: Move device back to init netns on owning netns delete
      include/net/rtnetlink.h
      net/core/dev.c
  * futex: Handle transient "ownerless" rtmutex state correctly
      kernel/futex.c
  * futex: Fix incorrect should_fail_futex() handling
      kernel/futex.c
  * futex: Prevent robust futex exit race
      kernel/futex.c
  * arm64: futex: Bound number of LDXR/STXR loops in FUTEX_WAKE_OP
      arch/arm64/include/asm/futex.h
  * locking/futex: Allow low-level atomic operations to return -EAGAIN
      kernel/futex.c
  * futex: Fix (possible) missed wakeup
      kernel/futex.c
  * futex: Handle early deadlock return correctly
      kernel/futex.c
      kernel/locking/rtmutex.c
  * futex,rt_mutex: Fix rt_mutex_cleanup_proxy_lock()
      kernel/locking/rtmutex.c
  * futex: Avoid freeing an active timer
      kernel/futex.c
  * futex: Drop hb->lock before enqueueing on the rtmutex
      kernel/futex.c
      kernel/locking/rtmutex.c
      kernel/locking/rtmutex_common.h
  * futex: Rework futex_lock_pi() to use rt_mutex_*_proxy_lock()
      kernel/futex.c
      kernel/locking/rtmutex.c
      kernel/locking/rtmutex_common.h
  * futex,rt_mutex: Introduce rt_mutex_init_waiter()
      kernel/futex.c
      kernel/locking/rtmutex.c
      kernel/locking/rtmutex_common.h
  * futex: Use smp_store_release() in mark_wake_futex()
      kernel/futex.c
  * idr: add ida_is_empty
      drivers/usb/gadget/function/f_hid.c
      include/linux/idr.h
    perf auxtrace: Fix auxtrace queue conflict
    ACPI: scan: Use unique number for instance_no
    ACPI: scan: Rearrange memory allocation in acpi_device_add()
    RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server
    net: cdc-phonet: fix data-interface release on probe failure
    mac80211: fix rate mask reset
    can: m_can: m_can_do_rx_poll(): fix extraneous msg loss warning
    can: c_can: move runtime PM enable/disable to c_can_platform
    can: c_can_pci: c_can_pci_remove(): fix use-after-free
    net/qlcnic: Fix a use after free in qlcnic_83xx_get_minidump_template
    e1000e: Fix error handling in e1000_set_d0_lplu_state_82571
    e1000e: add rtnl_lock() to e1000_reset_task
    net: dsa: bcm_sf2: Qualify phydev->dev_flags based on port
  * macvlan: macvlan_count_rx() needs to be aware of preemption
      include/linux/if_macvlan.h
    bus: omap_l3_noc: mark l3 irqs as IRQF_NO_THREAD
    arm64: dts: ls1043a: mark crypto engine dma coherent
    squashfs: fix xattr id and id lookup sanity checks
  * squashfs: fix inode lookup sanity checks
      fs/squashfs/squashfs_fs.h
    x86/tlb: Flush global mappings when KAISER is disabled
    ia64: fix ptrace(PTRACE_SYSCALL_INFO_EXIT) sign
    ia64: fix ia64_syscall_get_set_arguments() for break-based syscalls
    nfs: we don't support removing system.nfs4_acl
  * u64_stats,lockdep: Fix u64_stats_init() vs lockdep
      include/linux/u64_stats_sync.h
    atm: idt77252: fix null-ptr-dereference
    atm: uPD98402: fix incorrect allocation
    net: wan: fix error return code of uhdlc_init()
    NFS: Correct size calculation for create reply length
  * nfs: fix PNFS_FLEXFILE_LAYOUT Kconfig default
      fs/nfs/Kconfig
    sun/niu: fix wrong RXMAC_BC_FRM_CNT_COUNT count
    net: tehuti: fix error return code in bdx_probe()
    ixgbe: Fix memleak in ixgbe_configure_clsu32
    atm: lanai: dont run lanai_dev_close if not open
    atm: eni: dont release is never initialized
    powerpc/4xx: Fix build errors from mfdcr()
    net: fec: ptp: avoid register access when ipg clock is disabled
    ANDROID: Make vsock virtio packet buff size configurable
    Merge 4.9.263 into android-4.9-q
Linux 4.9.263
  * genirq: Disable interrupts for force threaded handlers
      kernel/irq/manage.c
  * ext4: fix potential error in ext4_do_update_inode
      fs/ext4/inode.c
  * ext4: find old entry again if failed to rename whiteout
      fs/ext4/namei.c
    x86: Introduce TS_COMPAT_RESTART to fix get_nr_restart_syscall()
    x86: Move TS_COMPAT back to asm/thread_info.h
  * kernel, fs: Introduce and use set_restart_fn() and arch_set_restart_data()
      fs/select.c
      include/linux/thread_info.h
      kernel/futex.c
      kernel/time/alarmtimer.c
      kernel/time/hrtimer.c
      kernel/time/posix-cpu-timers.c
    x86/ioapic: Ignore IRQ2 again
    perf/x86/intel: Fix a crash caused by zero PEBS status
    PCI: rpadlpar: Fix potential drc_name corruption in store functions
    iio: adis16400: Fix an error code in adis16400_initial_setup()
  * usb: gadget: configfs: Fix KASAN use-after-free
      drivers/usb/gadget/configfs.c
  * USB: replace hardcode maximum usb string length by definition
      drivers/usb/gadget/composite.c
      drivers/usb/gadget/configfs.c
      drivers/usb/gadget/usbstring.c
      include/uapi/linux/usb/ch9.h
    scsi: lpfc: Fix some error codes in debugfs
    net/qrtr: fix __netdev_alloc_skb call
    sunrpc: fix refcount leak for rpc auth modules
    svcrdma: disable timeouts on rdma backchannel
    NFSD: Repair misuse of sv_lock in 5.10.16-rt30.
    nvmet: don't check iosqes,iocqes for discovery controllers
    btrfs: fix race when cloning extent buffer during rewind of an old root
    ixgbe: prevent ptp_rx_hang from running when in FILTER_ALL mode
    ixgbe: check for Tx timestamp timeouts during watchdog
    net: dsa: b53: Support setting learning on port
  * ext4: check journal inode extents more carefully
      fs/ext4/block_validity.c
      fs/ext4/ext4.h
      fs/ext4/extents.c
      fs/ext4/indirect.c
      fs/ext4/inode.c
      fs/ext4/mballoc.c
  * ext4: don't allow overlapping system zones
      fs/ext4/block_validity.c
  * ext4: handle error of ext4_setup_system_zone() on remount
      fs/ext4/super.c
    Merge 4.9.262 into android-4.9-q
  * FROMGIT: configfs: fix a use-after-free in __configfs_open_file
      fs/configfs/file.c
Linux 4.9.262
    xen/events: avoid handling the same event on two cpus at the same time
    xen/events: don't unmask an event channel when an eoi is pending
    xen/events: reset affinity of 2-level event when tearing it down
    iio: imu: adis16400: fix memory leak
    iio: imu: adis16400: release allocated memory on failure
    KVM: arm64: Fix exclusive limit for IPA size
    hwmon: (lm90) Fix max6658 sporadic wrong temperature reading
    binfmt_misc: fix possible deadlock in bm_register_write
    powerpc/64s: Fix instruction encoding for lis in ppc_function_entry()
    alpha: switch __copy_user() and __do_clean_user() to normal calling conventions
    alpha: Package string routines together
    alpha: make short build log available for division routines
    alpha: merge build rules of division routines
    alpha: add $(src)/ rather than $(obj)/ to make source file path
  * configfs: fix a use-after-free in __configfs_open_file
      fs/configfs/file.c
    block: rsxx: fix error return code of rsxx_pci_probe()
    NFSv4.2: fix return value of _nfs4_get_security_label()
    sh_eth: fix TRSCER mask for R7S72100
    staging: comedi: pcl818: Fix endian problem for AI command data
    staging: comedi: pcl711: Fix endian problem for AI command data
    staging: comedi: me4000: Fix endian problem for AI command data
    staging: comedi: dmm32at: Fix endian problem for AI command data
    staging: comedi: das800: Fix endian problem for AI command data
    staging: comedi: das6402: Fix endian problem for AI command data
    staging: comedi: adv_pci1710: Fix endian problem for AI command data
    staging: comedi: addi_apci_1500: Fix endian problem for command sample
    staging: comedi: addi_apci_1032: Fix endian problem for COS sample
    staging: rtl8192e: Fix possible buffer overflow in _rtl92e_wx_set_scan
    staging: rtl8712: Fix possible buffer overflow in r8712_sitesurvey_cmd
    staging: ks7010: prevent buffer overflow in ks_wlan_set_scan()
    staging: rtl8188eu: fix potential memory corruption in rtw_check_beacon_data()
    staging: rtl8712: unterminated string leads to read overflow
    staging: rtl8188eu: prevent ->ssid overflow in rtw_wx_set_scan()
    staging: rtl8192u: fix ->ssid overflow in r8192_wx_set_scan()
    usbip: fix vhci_hcd attach_store() races leading to gpf
    usbip: fix stub_dev usbip_sockfd_store() races leading to gpf
    usbip: fix vudc to check for stream socket
    usbip: fix vhci_hcd to check for stream socket
    usbip: fix stub_dev to check for stream socket
    USB: serial: cp210x: add some more GE USB IDs
    USB: serial: cp210x: add ID for Acuity Brands nLight Air Adapter
    USB: serial: ch341: add new Product ID
    USB: serial: io_edgeport: fix memory leak in edge_startup
  * xhci: Improve detection of device initiated wake signal.
      drivers/usb/host/xhci.c
    usb: renesas_usbhs: Clear PIPECFG for re-enabling pipe with other EPNUM
    usb: gadget: f_uac2: always increase endpoint max_packet_size by one audio slot
    Goodix Fingerprint device is not a modem
    scripts/recordmcount.{c,pl}: support -ffunction-sections .text.* section names
  * mmc: core: Fix partition switch time for eMMC
      drivers/mmc/core/mmc.c
    s390/dasd: fix hanging DASD driver unbind
  * ALSA: usb-audio: Fix "cannot get freq eq" errors on Dell AE515 sound bar
      sound/usb/quirks.c
    ALSA: hda: Avoid spurious unsol event handling during S3/S4
    ALSA: hda/hdmi: Cancel pending works before suspend
    scsi: libiscsi: Fix iscsi_prep_scsi_cmd_pdu() error handling
    s390/smp: __smp_rescan_cpus() - move cpumask away from stack
    PCI: xgene-msi: Fix race in installing chained irq handler
    powerpc/perf: Record counter overflow always if SAMPLE_IP is unset
    mmc: mediatek: fix race condition between msdc_request_timeout and irq
    mmc: mxs-mmc: Fix a resource leak in an error handling path in 'mxs_mmc_probe()'
    udf: fix silent AED tagLocation corruption
    media: usbtv: Fix deadlock on suspend
    net: davicom: Fix regulator not turned off on driver removal
    net: davicom: Fix regulator not turned off on failed probe
    net: lapbether: Remove netif_start_queue / netif_stop_queue
  * net: sched: avoid duplicates in classes dump
      net/sched/sch_api.c
    net/mlx4_en: update moderation when config reset
  * Revert "mm, slub: consider rest of partial list if acquire_slab() fails"
      mm/slub.c
    cifs: return proper error code in statfs(2)
  * netfilter: x_tables: gpf inside xt_find_revision()
      net/netfilter/x_tables.c
    can: flexcan: enable RX FIFO after FRZ/HALT valid
    can: flexcan: assert FRZ bit in flexcan_chip_freeze()
    can: skb: can_skb_set_owner(): fix ref counting if socket was closed before setting skb ownership
    net: avoid infinite loop in mpls_gso_segment when mpls_hlen == 0
  * net: Fix gro aggregation for udp encaps with zero csum
      net/ipv4/udp_offload.c
    ath9k: fix transmitting to stations in dynamic SMPS mode
    ethernet: alx: fix order of calls on resume
    uapi: nfnetlink_cthelper.h: fix userspace compilation error
    Merge 4.9.261 into android-4.9-q
Linux 4.9.261
    misc: eeprom_93xx46: Add quirk to support Microchip 93LC46B eeprom
  * PCI: Add function 1 DMA alias quirk for Marvell 9215 SATA controller
      drivers/pci/quirks.c
    platform/x86: acer-wmi: Add new force_caps module parameter
    iommu/amd: Fix sleeping in atomic in increase_address_space()
  * dm table: fix DAX iterate_devices based device capability checks
      drivers/md/dm-table.c
  * dm table: fix iterate_devices based device capability checks
      drivers/md/dm-table.c
    rsxx: Return -EFAULT if copy_to_user() fails
    ALSA: ctxfi: cthw20k2: fix mask on conf to allow 4 bits
    usbip: tools: fix build error for multiple definition
    btrfs: fix raid6 qstripe kmap
    btrfs: raid56: simplify tracking of Q stripe presence
    Merge 4.9.260 into android-4.9-q
Linux 4.9.260
  * media: v4l: ioctl: Fix memory leak in video_usercopy
      drivers/media/v4l2-core/v4l2-ioctl.c
  * swap: fix swapfile read/write offset
      mm/page_io.c
      mm/swapfile.c
  * zsmalloc: account the number of compacted pages correctly
      drivers/block/zram/zram_drv.c
      include/linux/zsmalloc.h
      mm/zsmalloc.c
    xen-netback: respect gnttab_map_refs()'s return value
    Xen/gnttab: handle p2m update errors on a per-slot basis
    scsi: iscsi: Verify lengths on passthrough PDUs
    scsi: iscsi: Ensure sysfs attributes are limited to PAGE_SIZE
  * sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output
      fs/sysfs/file.c
      include/linux/sysfs.h
    scsi: iscsi: Restrict sessions and handles to admin capabilities
    media: uvcvideo: Allow entities with no pads
    staging: most: sound: add sanity check for function argument
  * Bluetooth: Fix null pointer dereference in amp_read_loc_assoc_final_data
      net/bluetooth/amp.c
    x86/build: Treat R_386_PLT32 relocation as R_386_PC32
    ath10k: fix wmi mgmt tx queue full due to race condition
    pktgen: fix misuse of BUG_ON() in pktgen_thread_worker()
    wlcore: Fix command execute failure 19 for wl12xx
  * vt/consolemap: do font sum unsigned
      drivers/tty/vt/consolemap.c
    x86/reboot: Add Zotac ZBOX CI327 nano PCI reboot quirk
    staging: fwserial: Fix error handling in fwserial_create
    mm/hugetlb.c: fix unnecessary address expansion of pmd sharing
  * net: fix up truesize of cloned skb in skb_prepare_for_shift()
      net/core/skbuff.c
  * smackfs: restrict bytes count in smackfs write functions
      security/smack/smackfs.c
    xfs: Fix assert failure in xfs_setattr_size()
    JFS: more checks for invalid superblock
  * arm64: Use correct ll/sc atomic constraints
      arch/arm64/include/asm/atomic_ll_sc.h
  * arm64: cmpxchg: Use "K" instead of "L" for ll/sc immediate constraint
      arch/arm64/include/asm/atomic_ll_sc.h
  * arm64: Avoid redundant type conversions in xchg() and cmpxchg()
      arch/arm64/include/asm/atomic_ll_sc.h
      arch/arm64/include/asm/cmpxchg.h
  * arm64: Remove redundant mov from LL/SC cmpxchg
      arch/arm64/include/asm/atomic_ll_sc.h
    printk: fix deadlock when kernel panic
    hugetlb: fix update_and_free_page contig page struct assumption
  * scripts: set proper OpenSSL include dir also for sign-file
      scripts/Makefile
  * scripts: use pkg-config to locate libcrypto
      scripts/Makefile
    arm: kprobes: Allow to handle reentered kprobe on single-stepping
    net: usb: qmi_wwan: support ZTE P685M modem
  * futex: Don't enable IRQs unconditionally in put_pi_state()
      kernel/futex.c
  * futex: Fix more put_pi_state() vs. exit_pi_state_list() races
      kernel/futex.c
  * futex: Fix pi_state->owner serialization
      kernel/futex.c
  * futex: Futex_unlock_pi() determinism
      kernel/futex.c
  * futex: Pull rt_mutex_futex_unlock() out from under hb->lock
      kernel/futex.c
  * futex: Cleanup refcounting
      kernel/futex.c
  * futex: Cleanup variable names for futex_top_waiter()
      kernel/futex.c
    Merge 4.9.259 into android-4.9-q
Linux 4.9.259
    dm era: Update in-core bitset after committing the metadata
  * net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending
      include/linux/icmpv6.h
      include/linux/ipv6.h
      include/net/icmp.h
      net/ipv4/icmp.c
      net/ipv6/icmp.c
      net/ipv6/ip6_icmp.c
  * ipv6: silence compilation warning for non-IPV6 builds
      include/linux/icmpv6.h
  * ipv6: icmp6: avoid indirect call for icmpv6_send()
      include/linux/icmpv6.h
      net/ipv6/icmp.c
      net/ipv6/ip6_icmp.c
    sunvnet: use icmp_ndo_send helper
    gtp: use icmp_ndo_send helper
  * icmp: allow icmpv6_ndo_send to work with CONFIG_IPV6=n
      include/linux/icmpv6.h
  * icmp: introduce helper for nat'd source address in network device context
      include/linux/icmpv6.h
      include/net/icmp.h
      net/ipv4/icmp.c
      net/ipv6/ip6_icmp.c
  * futex: fix dead code in attach_to_pi_owner()
      kernel/futex.c
  * futex: Fix OWNER_DEAD fixup
      kernel/futex.c
    dm era: only resize metadata in preresume
    dm era: Reinitialize bitset cache before digesting a new writeset
    dm era: Use correct value size in equality function of writeset tree
    dm era: Fix bitset memory leaks
    dm era: Verify the data block size hasn't changed
    dm era: Recover committed writeset after crash
    gfs2: Don't skip dlm unlock if glock has an lvb
    sparc32: fix a user-triggerable oops in clear_user()
  * f2fs: fix out-of-repair __setattr_copy()
      fs/f2fs/file.c
    gpio: pcf857x: Fix missing first interrupt
    mmc: sdhci-esdhc-imx: fix kernel panic when remove module
  * module: Ignore _GLOBAL_OFFSET_TABLE_ when warning for undefined symbols
      kernel/module.c
    libnvdimm/dimm: Avoid race between probe and available_slots_show()
    usb: renesas_usbhs: Clear pipe running flag in usbhs_pkt_pop()
    mm: hugetlb: fix a race between freeing and dissolving the page
    mtd: spi-nor: hisi-sfc: Put child node np on error path
    floppy: reintroduce O_NDELAY fix
    x86/reboot: Force all cpus to exit VMX root if VMX is supported
    staging: rtl8188eu: Add Edimax EW-7811UN V2 to device table
    drivers/misc/vmw_vmci: restrict too big queue size in qp_host_alloc_queue
  * seccomp: Add missing return in non-void function
      kernel/seccomp.c
    btrfs: fix extent buffer leak on failure to copy root
    btrfs: fix reloc root leak with 0 ref reloc roots on recovery
    btrfs: abort the transaction if we fail to inc ref in btrfs_copy_root
    KEYS: trusted: Fix migratable=1 failing
  * usb: dwc3: gadget: Fix dep->interval for fullspeed interrupt
      drivers/usb/dwc3/gadget.c
  * usb: dwc3: gadget: Fix setting of DEPCFG.bInterval_m1
      drivers/usb/dwc3/gadget.c
    USB: serial: mos7720: fix error code in mos7720_write()
    USB: serial: mos7840: fix error code in mos7840_write()
    usb: musb: Fix runtime PM race in musb_queue_resume_work
    USB: serial: option: update interface mapping for ZTE P685M
    Input: i8042 - add ASUS Zenbook Flip to noselftest list
    Input: joydev - prevent potential read overflow in ioctl
  * Input: xpad - add support for PowerA Enhanced Wired Controller for Xbox Series X|S
      drivers/input/joystick/xpad.c
    Input: raydium_ts_i2c - do not send zero length
    ACPI: configfs: add missing check after configfs_register_default_group()
  * blk-settings: align max_sectors on "logical_block_size" boundary
      block/blk-settings.c
  * scsi: bnx2fc: Fix Kconfig warning & CNIC build errors
      drivers/scsi/bnx2fc/Kconfig
    i2c: brcmstb: Fix brcmstd_send_i2c_cmd condition
  * arm64: Add missing ISB after invalidating TLB in __primary_switch
      arch/arm64/kernel/head.S
    mm/hugetlb: fix potential double free in hugetlb_register_node() error path
  * mm/memory.c: fix potential pte_unmap_unlock pte error
      mm/memory.c
    ocfs2: fix a use after free on error
    net/mlx4_core: Add missed mlx4_free_cmd_mailbox()
    i40e: Fix flow for IPv6 next header (extension header)
    drm/msm/dsi: Correct io_start for MSM8994 (20nm PHY)
  * PCI: Align checking of syscall user config accessors
      drivers/pci/syscall.c
    VMCI: Use set_page_dirty_lock() when unregistering guest memory
    pwm: rockchip: rockchip_pwm_probe(): Remove superfluous clk_unprepare()
    misc: eeprom_93xx46: Add module alias to avoid breaking support for non device tree users
    misc: eeprom_93xx46: Fix module alias to enable module autoprobe
    sparc64: only select COMPAT_BINFMT_ELF if BINFMT_ELF is set
    Input: elo - fix an error code in elo_connect()
    perf test: Fix unaligned access in sample parsing test
    perf intel-pt: Fix missing CYC processing in PSB
    spi: pxa2xx: Fix the controller numbering for Wildcat Point
    powerpc/pseries/dlpar: handle ibm, configure-connector delay status
    mfd: wm831x-auxadc: Prevent use after free in wm831x_auxadc_read_irq()
    RDMA/rxe: Fix coding error in rxe_recv.c
    perf tools: Fix DSO filtering when not finding a map for a sampled address
  * tracepoint: Do not fail unregistering a probe due to memory failure
      kernel/tracepoint.c
  * amba: Fix resource leak for drivers without .remove
      drivers/amba/bus.c
    ARM: 9046/1: decompressor: Do not clear SCTLR.nTLSMD for ARMv7+ cores
    mmc: usdhi6rol0: Fix a resource leak in the error handling path of the probe
    powerpc/47x: Disable 256k page size
    IB/umad: Return EIO in case of when device disassociated
    isofs: release buffer head before return
    regulator: axp20x: Fix reference cout leak
    clocksource/drivers/mxs_timer: Add missing semicolon when DEBUG is defined
    power: reset: at91-sama5d2_shdwc: fix wkupdbc mask
  * of/fdt: Make sure no-map does not remove already reserved regions
      drivers/of/fdt.c
  * fdt: Properly handle "no-map" field in the memory region
      drivers/of/fdt.c
    dmaengine: fsldma: Fix a resource leak in an error handling path of the probe function
    dmaengine: fsldma: Fix a resource leak in the remove function
  * HID: core: detect and skip invalid inputs to snto32()
      drivers/hid/hid-core.c
    spi: cadence-quadspi: Abort read if dummy cycles required are too many
    clk: meson: clk-pll: fix initializing the old rate (fallback) for a PLL
    jffs2: fix use after free in jffs2_sum_write_data()
    fs/jfs: fix potential integer overflow on shift of a int
    crypto: ecdh_helper - Ensure 'len >= secret.len' in decode_key()
    btrfs: clarify error returns values in __load_free_space_cache
    ata: ahci_brcm: Add back regulators management
    media: uvcvideo: Accept invalid bFormatIndex and bFrameIndex values
    media: pxa_camera: declare variable when DEBUG is defined
    media: cx25821: Fix a bug when reallocating some dma memory
    media: qm1d1c0042: fix error return code in qm1d1c0042_init()
    media: lmedm04: Fix misuse of comma
    ASoC: cs42l56: fix up error handling in probe
    media: tm6000: Fix memleak in tm6000_start_stream
    media: media/pci: Fix memleak in empress_init
    media: vsp1: Fix an error handling path in the probe function
    MIPS: lantiq: Explicitly compare LTQ_EBU_PCC_ISTAT against 0
    MIPS: c-r4k: Fix section mismatch for loongson2_sc_init
    gma500: clean up error handling in init
    drm/gma500: Fix error return code in psb_driver_load()
  * fbdev: aty: SPARC64 requires FB_ATY_CT
      drivers/video/fbdev/Kconfig
    b43: N-PHY: Fix the update of coef for the PHY revision >= 3case
    mac80211: fix potential overflow when multiplying to u32 integers
    xen/netback: fix spurious event detection for common event case
    bnxt_en: reverse order of TX disable and carrier off
    ARM: s3c: fix fiq for clang IAS
    arm64: dts: msm8916: Fix reserved and rfsa nodes unit address
    usb: dwc2: Make "trimming xfer length" a debug message
    usb: dwc2: Abort transaction after errors with unknown reason
    usb: dwc2: Do not update data length if it is 0 on inbound transfers
    ARM: dts: Configure missing thermal interrupt for 4430
  * Bluetooth: Put HCI device if inquiry procedure interrupts
      net/bluetooth/hci_core.c
  * Bluetooth: drop HCI device reference before return
      net/bluetooth/a2mp.c
    arm64: dts: exynos: correct PMIC interrupt trigger level on Espresso
    ARM: dts: exynos: correct PMIC interrupt trigger level on Arndale Octa
    ARM: dts: exynos: correct PMIC interrupt trigger level on Spring
  * Bluetooth: Fix initializing response id after clearing struct
      net/bluetooth/a2mp.c
    mm, thp: make do_huge_pmd_wp_page() lock page for testing mapcount
  * random: fix the RNDRESEEDCRNG ioctl
      drivers/char/random.c
    MIPS: vmlinux.lds.S: add missing PAGE_ALIGNED_DATA() section
  * kdb: Make memory allocations more robust
      kernel/debug/kdb/kdb_private.h
    scripts/recordmcount.pl: support big endian for ARCH sh
    cifs: Set CIFS_MOUNT_USE_PREFIX_PATH flag on setting cifs_sb->prepath.
    NET: usb: qmi_wwan: Adding support for Cinterion MV31
    arm64: tegra: Add power-domain for Tegra210 HDA
    igb: Remove incorrect "unexpected SYS WRAP" log message
    ntfs: check for valid standard information attribute
  * usb: quirks: add quirk to start video capture on ELMO L-12F document camera reliable
      drivers/usb/core/quirks.c
  * HID: make arrays usage and value to be the same
      drivers/hid/hid-core.c

Bug: 184596728
Change-Id: I50e867d3e8d2d62938b73e54b8d6e614bb3f2d1b
Signed-off-by: Lucas Wei <lucaswei@google.com>
 2021-04-26 16:09:53 +08:00
Greg Kroah-Hartman
d73e635a21 Merge 4.9.263 into android-4.9-q 
Changes in 4.9.263
	ext4: handle error of ext4_setup_system_zone() on remount
	ext4: don't allow overlapping system zones
	ext4: check journal inode extents more carefully
	net: dsa: b53: Support setting learning on port
	ixgbe: check for Tx timestamp timeouts during watchdog
	ixgbe: prevent ptp_rx_hang from running when in FILTER_ALL mode
	btrfs: fix race when cloning extent buffer during rewind of an old root
	nvmet: don't check iosqes,iocqes for discovery controllers
	NFSD: Repair misuse of sv_lock in 5.10.16-rt30.
	svcrdma: disable timeouts on rdma backchannel
	sunrpc: fix refcount leak for rpc auth modules
	net/qrtr: fix __netdev_alloc_skb call
	scsi: lpfc: Fix some error codes in debugfs
	USB: replace hardcode maximum usb string length by definition
	usb: gadget: configfs: Fix KASAN use-after-free
	iio: adis16400: Fix an error code in adis16400_initial_setup()
	PCI: rpadlpar: Fix potential drc_name corruption in store functions
	perf/x86/intel: Fix a crash caused by zero PEBS status
	x86/ioapic: Ignore IRQ2 again
	kernel, fs: Introduce and use set_restart_fn() and arch_set_restart_data()
	x86: Move TS_COMPAT back to asm/thread_info.h
	x86: Introduce TS_COMPAT_RESTART to fix get_nr_restart_syscall()
	ext4: find old entry again if failed to rename whiteout
	ext4: fix potential error in ext4_do_update_inode
	genirq: Disable interrupts for force threaded handlers
	Linux 4.9.263

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I1be8f65e8275474e44ac3a61268bee7d3d33302b
 2021-03-24 11:32:14 +01:00
Macpaul Lin
fe0c15025a USB: replace hardcode maximum usb string length by definition 
commit 81c7462883b0cc0a4eeef0687f80ad5b5baee5f6 upstream.

Replace hardcoded maximum USB string length (126 bytes) by definition
"USB_MAX_STRING_LEN".

Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/1592471618-29428-1-git-send-email-macpaul.lin@mediatek.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2021-03-24 10:59:24 +01:00
Blagovest Kolenichev
6c02278dca Merge android-4.9.91 (bb94f9d) into msm-4.9 
* refs/heads/tmp-bb94f9d:
  UPSTREAM: net: hns: Fix a skb used after free bug
  Linux 4.9.91
  bpf, x64: increase number of passes
  bpf: skip unnecessary capability check
  kbuild: disable clang's default use of -fmerge-all-constants
  selftests: x86: sysret_ss_attrs doesn't build on a PIE build
  x86/pkeys/selftests: Rename 'si_pkey' to 'siginfo_pkey'
  signal/testing: Don't look for __SI_FAULT in userspace
  selftests/x86/protection_keys: Fix syscall NR redefinition warnings
  selftests, x86, protection_keys: fix wrong offset in siginfo
  staging: lustre: ptlrpc: kfree used instead of kvfree
  iio: ABI: Fix name of timestamp sysfs file
  perf/x86/intel/uncore: Fix multi-domain PCI CHA enumeration bug on Skylake servers
  perf/x86/intel: Don't accidentally clear high bits in bdw_limit_period()
  perf stat: Fix CVS output format for non-supported counters
  perf/x86/intel/uncore: Fix Skylake UPI event format
  x86/entry/64: Don't use IST entry for #BP stack
  x86/boot/64: Verify alignment of the LOAD segment
  x86/build/64: Force the linker to use 2MB page size
  kvm/x86: fix icebp instruction handling
  selftests/x86/ptrace_syscall: Fix for yet more glibc interference
  tty: vt: fix up tabstops properly
  can: cc770: Fix use after free in cc770_tx_interrupt()
  can: cc770: Fix queue stall & dropped RTR reply
  can: cc770: Fix stalls on rt-linux, remove redundant IRQ ack
  can: ifi: Check core revision upon probe
  can: ifi: Repair the error handling
  staging: ncpfs: memory corruption in ncp_read_kernel()
  mtd: nand: fsl_ifc: Read ECCSTAT0 and ECCSTAT1 registers for IFC 2.0
  mtd: nand: fsl_ifc: Fix eccstat array overflow for IFC ver >= 2.0.0
  mtd: nand: fsl_ifc: Fix nand waitfunc return value
  mtdchar: fix usage of mtd_ooblayout_ecc()
  tracing: probeevent: Fix to support minus offset from symbol
  rtlwifi: rtl8723be: Fix loss of signal
  brcmfmac: fix P2P_DEVICE ethernet address generation
  libnvdimm, {btt, blk}: do integrity setup before add_disk()
  ACPI / watchdog: Fix off-by-one error at resource assignment
  acpi, numa: fix pxm to online numa node associations
  drm: udl: Properly check framebuffer mmap offsets
  drm/radeon: Don't turn off DP sink when disconnected
  drm/vmwgfx: Fix a destoy-while-held mutex problem.
  mm/shmem: do not wait for lock_page() in shmem_unused_huge_shrink()
  mm/thp: do not wait for lock_page() in deferred_split_scan()
  mm/khugepaged.c: convert VM_BUG_ON() to collapse fail
  x86/mm: implement free pmd/pte page interfaces
  mm/vmalloc: add interfaces to free unmapped page table
  nfsd: remove blocked locks on client teardown
  libata: Modify quirks for MX100 to limit NCQ_TRIM quirk to MU01 version
  libata: Make Crucial BX100 500GB LPM quirk apply to all firmware versions
  libata: Apply NOLPM quirk to Crucial M500 480 and 960GB SSDs
  libata: Enable queued TRIM for Samsung SSD 860
  libata: disable LPM for Crucial BX100 SSD 500GB drive
  libata: Apply NOLPM quirk to Crucial MX100 512GB SSDs
  libata: don't try to pass through NCQ commands to non-NCQ devices
  libata: remove WARN() for DMA or PIO command without data
  libata: fix length validation of ATAPI-relayed SCSI commands
  Bluetooth: btusb: Fix quirk for Atheros 1525/QCA6174
  clk: sunxi-ng: a31: Fix CLK_OUT_* clock ops
  clk: bcm2835: Protect sections updating shared registers
  clk: bcm2835: Fix ana->maskX definitions
  ahci: Add PCI-id for the Highpoint Rocketraid 644L card
  PCI: Add function 1 DMA alias quirk for Highpoint RocketRAID 644L
  mmc: dw_mmc: fix falling from idmac to PIO mode when dw_mci_reset occurs
  ALSA: hda/realtek - Always immediately update mute LED with pin VREF
  ALSA: aloop: Fix access to not-yet-ready substream via cable
  ALSA: aloop: Sync stale timer before release
  ALSA: usb-audio: Fix parsing descriptor of UAC2 processing unit
  iio: st_pressure: st_accel: pass correct platform data to init
  MIPS: ralink: Remove ralink_halt()

Change-Id: I65d15215fbd73a86b6834aad1d7280b8dc16b62b
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
 2018-04-17 10:46:44 -07:00
Greg Kroah-Hartman
bb94f9d8f5 Merge 4.9.91 into android-4.9 
Changes in 4.9.91
	MIPS: ralink: Remove ralink_halt()
	iio: st_pressure: st_accel: pass correct platform data to init
	ALSA: usb-audio: Fix parsing descriptor of UAC2 processing unit
	ALSA: aloop: Sync stale timer before release
	ALSA: aloop: Fix access to not-yet-ready substream via cable
	ALSA: hda/realtek - Always immediately update mute LED with pin VREF
	mmc: dw_mmc: fix falling from idmac to PIO mode when dw_mci_reset occurs
	PCI: Add function 1 DMA alias quirk for Highpoint RocketRAID 644L
	ahci: Add PCI-id for the Highpoint Rocketraid 644L card
	clk: bcm2835: Fix ana->maskX definitions
	clk: bcm2835: Protect sections updating shared registers
	clk: sunxi-ng: a31: Fix CLK_OUT_* clock ops
	Bluetooth: btusb: Fix quirk for Atheros 1525/QCA6174
	libata: fix length validation of ATAPI-relayed SCSI commands
	libata: remove WARN() for DMA or PIO command without data
	libata: don't try to pass through NCQ commands to non-NCQ devices
	libata: Apply NOLPM quirk to Crucial MX100 512GB SSDs
	libata: disable LPM for Crucial BX100 SSD 500GB drive
	libata: Enable queued TRIM for Samsung SSD 860
	libata: Apply NOLPM quirk to Crucial M500 480 and 960GB SSDs
	libata: Make Crucial BX100 500GB LPM quirk apply to all firmware versions
	libata: Modify quirks for MX100 to limit NCQ_TRIM quirk to MU01 version
	nfsd: remove blocked locks on client teardown
	mm/vmalloc: add interfaces to free unmapped page table
	x86/mm: implement free pmd/pte page interfaces
	mm/khugepaged.c: convert VM_BUG_ON() to collapse fail
	mm/thp: do not wait for lock_page() in deferred_split_scan()
	mm/shmem: do not wait for lock_page() in shmem_unused_huge_shrink()
	drm/vmwgfx: Fix a destoy-while-held mutex problem.
	drm/radeon: Don't turn off DP sink when disconnected
	drm: udl: Properly check framebuffer mmap offsets
	acpi, numa: fix pxm to online numa node associations
	ACPI / watchdog: Fix off-by-one error at resource assignment
	libnvdimm, {btt, blk}: do integrity setup before add_disk()
	brcmfmac: fix P2P_DEVICE ethernet address generation
	rtlwifi: rtl8723be: Fix loss of signal
	tracing: probeevent: Fix to support minus offset from symbol
	mtdchar: fix usage of mtd_ooblayout_ecc()
	mtd: nand: fsl_ifc: Fix nand waitfunc return value
	mtd: nand: fsl_ifc: Fix eccstat array overflow for IFC ver >= 2.0.0
	mtd: nand: fsl_ifc: Read ECCSTAT0 and ECCSTAT1 registers for IFC 2.0
	staging: ncpfs: memory corruption in ncp_read_kernel()
	can: ifi: Repair the error handling
	can: ifi: Check core revision upon probe
	can: cc770: Fix stalls on rt-linux, remove redundant IRQ ack
	can: cc770: Fix queue stall & dropped RTR reply
	can: cc770: Fix use after free in cc770_tx_interrupt()
	tty: vt: fix up tabstops properly
	selftests/x86/ptrace_syscall: Fix for yet more glibc interference
	kvm/x86: fix icebp instruction handling
	x86/build/64: Force the linker to use 2MB page size
	x86/boot/64: Verify alignment of the LOAD segment
	x86/entry/64: Don't use IST entry for #BP stack
	perf/x86/intel/uncore: Fix Skylake UPI event format
	perf stat: Fix CVS output format for non-supported counters
	perf/x86/intel: Don't accidentally clear high bits in bdw_limit_period()
	perf/x86/intel/uncore: Fix multi-domain PCI CHA enumeration bug on Skylake servers
	iio: ABI: Fix name of timestamp sysfs file
	staging: lustre: ptlrpc: kfree used instead of kvfree
	selftests, x86, protection_keys: fix wrong offset in siginfo
	selftests/x86/protection_keys: Fix syscall NR redefinition warnings
	signal/testing: Don't look for __SI_FAULT in userspace
	x86/pkeys/selftests: Rename 'si_pkey' to 'siginfo_pkey'
	selftests: x86: sysret_ss_attrs doesn't build on a PIE build
	kbuild: disable clang's default use of -fmerge-all-constants
	bpf: skip unnecessary capability check
	bpf, x64: increase number of passes
	Linux 4.9.91

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2018-03-29 11:32:39 +02:00
Kirill Marinushkin
b1d25da581 ALSA: usb-audio: Fix parsing descriptor of UAC2 processing unit 
commit a6618f4aedb2b60932d766bd82ae7ce866e842aa upstream.

Currently, the offsets in the UAC2 processing unit descriptor are
calculated incorrectly. It causes an issue when connecting the device which
provides such a feature:

~~~~
[84126.724420] usb 1-1.3.1: invalid Processing Unit descriptor (id 18)
~~~~

After this patch is applied, the UAC2 processing unit inits w/o this error.

Fixes: 23caaf19b1 ("ALSA: usb-mixer: Add support for Audio Class v2.0")
Signed-off-by: Kirill Marinushkin <k.marinushkin@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2018-03-28 18:39:19 +02:00
Vijayavardhan Vennapusa
77561e55e6 u_ctrl_qti: Increase MAX_QTI_PKT_SIZE to 8K 
increase MAX_QTI_PKT_SIZE to 8KB to handle QMI messages of bigger
length of 8KB.

Change-Id: I479794c9563ae89b9062b75031b6cdc739a0f620
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
 2018-03-20 10:12:27 +05:30
Kyle Yan
ff97938fbf Merge remote-tracking branch '4.9/tmp-8dd0f52' into msm-4.9 
* 4.9/tmp-8dd0f52:
  Linux 4.9.72
  sparc32: Export vac_cache_size to fix build error
  bpf: fix incorrect sign extension in check_alu_op()
  bpf: reject out-of-bounds stack pointer calculation
  bpf: fix branch pruning logic
  bpf: adjust insn_aux_data when patching insns
  Revert "Bluetooth: btusb: driver to enable the usb-wakeup feature"
  platform/x86: asus-wireless: send an EV_SYN/SYN_REPORT between state changes
  MIPS: math-emu: Fix final emulation phase for certain instructions
  thermal/drivers/hisi: Fix multiple alarm interrupts firing
  thermal/drivers/hisi: Simplify the temperature/step computation
  thermal/drivers/hisi: Fix kernel panic on alarm interrupt
  thermal/drivers/hisi: Fix missing interrupt enablement
  thermal: hisilicon: Handle return value of clk_prepare_enable
  cpuidle: fix broadcast control when broadcast can not be entered
  rtc: set the alarm to the next expiring timer
  tcp: fix under-evaluated ssthresh in TCP Vegas
  clk: sunxi-ng: sun6i: Rename HDMI DDC clock to avoid name collision
  staging: greybus: light: Release memory obtained by kasprintf
  net: ipv6: send NS for DAD when link operationally up
  fm10k: ensure we process SM mbx when processing VF mbx
  vfio/pci: Virtualize Maximum Payload Size
  scsi: lpfc: PLOGI failures during NPIV testing
  scsi: lpfc: Fix secure firmware updates
  fm10k: fix mis-ordered parameters in declaration for .ndo_set_vf_bw
  ASoC: img-parallel-out: Add pm_runtime_get/put to set_fmt callback
  tracing: Exclude 'generic fields' from histograms
  PCI/AER: Report non-fatal errors only to the affected endpoint
  IB/rxe: check for allocation failure on elem
  ixgbe: fix use of uninitialized padding
  igb: check memory allocation failure
  PM / OPP: Move error message to debug level
  PCI: Create SR-IOV virtfn/physfn links before attaching driver
  scsi: mpt3sas: Fix IO error occurs on pulling out a drive from RAID1 volume created on two SATA drive
  scsi: cxgb4i: fix Tx skb leak
  PCI: Avoid bus reset if bridge itself is broken
  net: phy: at803x: Change error to EINVAL for invalid MAC
  kvm, mm: account kvm related kmem slabs to kmemcg
  rtc: pl031: make interrupt optional
  crypto: crypto4xx - increase context and scatter ring buffer elements
  backlight: pwm_bl: Fix overflow condition
  bnxt_en: Fix NULL pointer dereference in reopen failure path
  cpuidle: powernv: Pass correct drv->cpumask for registration
  ARM: dma-mapping: disallow dma_get_sgtable() for non-kernel managed memory
  Btrfs: fix an integer overflow check
  netfilter: nfnetlink_queue: fix secctx memory leak
  xhci: plat: Register shutdown for xhci_plat
  net: moxa: fix TX overrun memory leak
  isdn: kcapi: avoid uninitialized data
  virtio_balloon: prevent uninitialized variable use
  virtio-balloon: use actual number of stats for stats queue buffers
  KVM: pci-assign: do not map smm memory slot pages in vt-d page tables
  net: ipconfig: fix ic_close_devs() use-after-free
  cpufreq: Fix creation of symbolic links to policy directories
  ARM: dts: am335x-evmsk: adjust mmc2 param to allow suspend
  netfilter: nf_nat_snmp: Fix panic when snmp_trap_helper fails to register
  netfilter: nfnl_cthelper: fix a race when walk the nf_ct_helper_hash table
  irda: vlsi_ir: fix check for DMA mapping errors
  RDMA/iser: Fix possible mr leak on device removal event
  i40e: Do not enable NAPI on q_vectors that have no rings
  IB/rxe: increment msn only when completing a request
  IB/rxe: double free on error
  net: Do not allow negative values for busy_read and busy_poll sysctl interfaces
  nbd: set queue timeout properly
  infiniband: Fix alignment of mmap cookies to support VIPT caching
  IB/core: Protect against self-requeue of a cq work item
  i40iw: Receive netdev events post INET_NOTIFIER state
  bna: avoid writing uninitialized data into hw registers
  s390/qeth: no ETH header for outbound AF_IUCV
  s390/qeth: size calculation outbound buffers
  r8152: prevent the driver from transmitting packets with carrier off
  ASoC: STI: Fix reader substream pointer set
  HID: xinmo: fix for out of range for THT 2P arcade controller.
  hwmon: (asus_atk0110) fix uninitialized data access
  ARM: dts: ti: fix PCI bus dtc warnings
  KVM: VMX: Fix enable VPID conditions
  KVM: x86: correct async page present tracepoint
  kvm: vmx: Flush TLB when the APIC-access address changes
  scsi: lpfc: Fix PT2PT PRLI reject
  pinctrl: st: add irq_request/release_resources callbacks
  inet: frag: release spinlock before calling icmp_send()
  tipc: fix nametbl deadlock at tipc_nametbl_unsubscribe
  r8152: fix the rx early size of RTL8153
  iommu/exynos: Workaround FLPD cache flush issues for SYSMMU v5
  netfilter: nfnl_cthelper: Fix memory leak
  netfilter: nfnl_cthelper: fix runtime expectation policy updates
  usb: gadget: udc: remove pointer dereference after free
  usb: gadget: f_uvc: Sanity check wMaxPacketSize for SuperSpeed
  hwmon: (max31790) Set correct PWM value
  net: qmi_wwan: Add USB IDs for MDM6600 modem on Motorola Droid 4
  sctp: out_qlen should be updated when pruning unsent queue
  bna: integer overflow bug in debugfs
  sch_dsmark: fix invalid skb_cow() usage
  vsock: cancel packets when failing to connect
  vhost-vsock: add pkt cancel capability
  vsock: track pkt owner vsock
  crypto: deadlock between crypto_alg_sem/rtnl_mutex/genl_mutex
  r8152: fix the list rx_done may be used without initialization
  cpuidle: Validate cpu_dev in cpuidle_add_sysfs()
  nvme-loop: handle cpu unplug when re-establishing the controller
  arm: kprobes: Align stack to 8-bytes in test code
  arm: kprobes: Fix the return address of multiple kretprobes
  HID: corsair: Add driver Scimitar Pro RGB gaming mouse 1b1c:1b3e support to hid-corsair
  HID: corsair: support for K65-K70 Rapidfire and Scimitar Pro RGB
  kvm: fix usage of uninit spinlock in avic_vm_destroy()
  ALSA: hda - add support for docking station for HP 840 G3
  ALSA: hda - add support for docking station for HP 820 G2
  arm64: Initialise high_memory global variable earlier
  cxl: Check if vphb exists before iterating over AFU devices
  Linux 4.9.71
  ath9k: fix tx99 potential info leak
  icmp: don't fail on fragment reassembly time exceeded
  IB/ipoib: Grab rtnl lock on heavy flush when calling ndo_open/stop
  RDMA/cma: Avoid triggering undefined behavior
  macvlan: Only deliver one copy of the frame to the macvlan interface
  udf: Avoid overflow when session starts at large offset
  scsi: bfa: integer overflow in debugfs
  scsi: sd: change allow_restart to bool in sysfs interface
  scsi: sd: change manage_start_stop to bool in sysfs interface
  rtl8188eu: Fix a possible sleep-in-atomic bug in rtw_disassoc_cmd
  rtl8188eu: Fix a possible sleep-in-atomic bug in rtw_createbss_cmd
  vt6655: Fix a possible sleep-in-atomic bug in vt6655_suspend
  IB/core: Fix calculation of maximum RoCE MTU
  scsi: scsi_devinfo: Add REPORTLUN2 to EMC SYMMETRIX blacklist entry
  raid5: Set R5_Expanded on parity devices as well as data.
  pinctrl: adi2: Fix Kconfig build problem
  usb: musb: da8xx: fix babble condition handling
  tty fix oops when rmmod 8250
  soc: mediatek: pwrap: fix compiler errors
  powerpc/perf/hv-24x7: Fix incorrect comparison in memord
  scsi: hpsa: destroy sas transport properties before scsi_host
  scsi: hpsa: cleanup sas_phy structures in sysfs when unloading
  PCI: Detach driver before procfs & sysfs teardown on device remove
  RDMA/cxgb4: Declare stag as __be32
  xfs: fix incorrect extent state in xfs_bmap_add_extent_unwritten_real
  xfs: fix log block underflow during recovery cycle verification
  l2tp: cleanup l2tp_tunnel_delete calls
  nvme: use kref_get_unless_zero in nvme_find_get_ns
  platform/x86: hp_accel: Add quirk for HP ProBook 440 G4
  btrfs: tests: Fix a memory leak in error handling path in 'run_test()'
  arm64: prevent regressions in compressed kernel image size when upgrading to binutils 2.27
  Ib/hfi1: Return actual operational VLs in port info query
  bcache: fix wrong cache_misses statistics
  bcache: explicitly destroy mutex while exiting
  GFS2: Take inode off order_write list when setting jdata flag
  scsi: scsi_debug: write_same: fix error report
  thermal/drivers/step_wise: Fix temperature regulation misbehavior
  ASoC: rsnd: rsnd_ssi_run_mods() needs to care ssi_parent_mod
  ppp: Destroy the mutex when cleanup
  clk: tegra: Fix cclk_lp divisor register
  clk: hi6220: mark clock cs_atb_syspll as critical
  clk: imx6: refine hdmi_isfr's parent to make HDMI work on i.MX6 SoCs w/o VPU
  clk: mediatek: add the option for determining PLL source clock
  mm: Handle 0 flags in _calc_vm_trans() macro
  crypto: tcrypt - fix buffer lengths in test_aead_speed()
  arm-ccn: perf: Prevent module unload while PMU is in use
  xfs: truncate pagecache before writeback in xfs_setattr_size()
  iommu/amd: Limit the IOVA page range to the specified addresses
  badblocks: fix wrong return value in badblocks_set if badblocks are disabled
  target/file: Do not return error for UNMAP if length is zero
  target:fix condition return in core_pr_dump_initiator_port()
  iscsi-target: fix memory leak in lio_target_tiqn_addtpg()
  target/iscsi: Fix a race condition in iscsit_add_reject_from_cmd()
  platform/x86: intel_punit_ipc: Fix resource ioremap warning
  powerpc/ipic: Fix status get and status clear
  powerpc/opal: Fix EBUSY bug in acquiring tokens
  netfilter: ipvs: Fix inappropriate output of procfs
  iommu/mediatek: Fix driver name
  PCI: Do not allocate more buses than available in parent
  powerpc/powernv/cpufreq: Fix the frequency read by /proc/cpuinfo
  PCI/PME: Handle invalid data when reading Root Status
  dmaengine: ti-dma-crossbar: Correct am335x/am43xx mux value type
  ASoC: Intel: Skylake: Fix uuid_module memory leak in failure case
  rtc: pcf8563: fix output clock rate
  video: fbdev: au1200fb: Return an error code if a memory allocation fails
  video: fbdev: au1200fb: Release some resources if a memory allocation fails
  video: udlfb: Fix read EDID timeout
  fbdev: controlfb: Add missing modes to fix out of bounds access
  sfc: don't warn on successful change of MAC
  HID: cp2112: fix broken gpio_direction_input callback
  Revert "x86/acpi: Set persistent cpuid <-> nodeid mapping when booting"
  target: fix race during implicit transition work flushes
  target: fix ALUA transition timeout handling
  target: Use system workqueue for ALUA transitions
  btrfs: add missing memset while reading compressed inline extents
  NFSv4.1 respect server's max size in CREATE_SESSION
  efi/esrt: Cleanup bad memory map log messages
  perf symbols: Fix symbols__fixup_end heuristic for corner cases
  tty: fix data race in tty_ldisc_ref_wait()
  tty: don't panic on OOM in tty_set_ldisc()
  rxrpc: Ignore BUSY packets on old calls
  net: mpls: Fix nexthop alive tracking on down events
  net/mlx4_core: Avoid delays during VF driver device shutdown
  nvmet-rdma: Fix a possible uninitialized variable dereference
  nvmet: confirm sq percpu has scheduled and switched to atomic
  nvme-loop: fix a possible use-after-free when destroying the admin queue
  afs: Fix abort on signal while waiting for call completion
  afs: Fix afs_kill_pages()
  afs: Fix page leak in afs_write_begin()
  afs: Populate and use client modification time
  afs: Better abort and net error handling
  afs: Invalid op ID should abort with RXGEN_OPCODE
  afs: Fix the maths in afs_fs_store_data()
  afs: Prevent callback expiry timer overflow
  afs: Migrate vlocation fields to 64-bit
  afs: Flush outstanding writes when an fd is closed
  afs: Deal with an empty callback array
  afs: Adjust mode bits processing
  afs: Populate group ID from vnode status
  afs: Fix missing put_page()
  drm/radeon: reinstate oland workaround for sclk
  mmc: mediatek: Fixed bug where clock frequency could be set wrong
  sched/deadline: Use deadline instead of period when calculating overflow
  sched/deadline: Throttle a constrained deadline task activated after the deadline
  sched/deadline: Make sure the replenishment timer fires in the next period
  sched/deadline: Add missing update_rq_clock() in dl_task_timer()
  iwlwifi: mvm: cleanup pending frames in DQA mode
  Drivers: hv: util: move waiting for release to hv_utils_transport itself
  drm/radeon/si: add dpm quirk for Oland
  fjes: Fix wrong netdevice feature flags
  scsi: hpsa: do not timeout reset operations
  scsi: hpsa: limit outstanding rescans
  scsi: hpsa: update check for logical volume status
  ASoC: rcar: clear DE bit only in PDMACHCR when it stops
  openrisc: fix issue handling 8 byte get_user calls
  intel_th: pci: Add Gemini Lake support
  drm: amd: remove broken include path
  qed: Fix interrupt flags on Rx LL2
  qed: Fix mapping leak on LL2 rx flow
  qed: Align CIDs according to DORQ requirement
  mlxsw: reg: Fix SPVMLR max record count
  mlxsw: reg: Fix SPVM max record count
  net: Resend IGMP memberships upon peer notification.
  irqchip/mvebu-odmi: Select GENERIC_MSI_IRQ_DOMAIN
  dmaengine: Fix array index out of bounds warning in __get_unmap_pool()
  net: wimax/i2400m: fix NULL-deref at probe
  writeback: fix memory leak in wb_queue_work()
  blk-mq: Fix tagset reinit in the presence of cpu hot-unplug
  ASoC: rsnd: fix sound route path when using SRC6/SRC9
  netfilter: bridge: honor frag_max_size when refragmenting
  drm/omap: fix dmabuf mmap for dma_alloc'ed buffers
  Input: i8042 - add TUXEDO BU1406 (N24_25BU) to the nomux list
  NFSD: fix nfsd_reset_versions for NFSv4.
  NFSD: fix nfsd_minorversion(.., NFSD_AVAIL)
  drm/amdgpu: fix parser init error path to avoid crash in parser fini
  iommu/io-pgtable-arm-v7s: Check for leaf entry before dereferencing it
  net/mlx5: Don't save PCI state when PCI error is detected
  net/mlx5: Fix create autogroup prev initializer
  rxrpc: Wake up the transmitter if Rx window size increases on the peer
  net: bcmgenet: Power up the internal PHY before probing the MII
  net: bcmgenet: synchronize irq0 status between the isr and task
  net: bcmgenet: power down internal phy if open or resume fails
  net: bcmgenet: reserved phy revisions must be checked first
  net: bcmgenet: correct MIB access of UniMAC RUNT counters
  net: bcmgenet: correct the RBUF_OVFL_CNT and RBUF_ERR_CNT MIB values
  bnxt_en: Ignore 0 value in autoneg supported speed from firmware.
  net: initialize msg.msg_flags in recvfrom
  userfaultfd: selftest: vm: allow to build in vm/ directory
  userfaultfd: shmem: __do_fault requires VM_FAULT_NOPAGE
  md-cluster: free md_cluster_info if node leave cluster
  usb: xhci-mtk: check hcc_params after adding primary hcd
  KVM: nVMX: do not warn when MSR bitmap address is not backed
  usb: phy: isp1301: Add OF device ID table
  mac80211: Fix addition of mesh configuration element
  ext4: fix crash when a directory's i_size is too small
  ext4: fix fdatasync(2) after fallocate(2) operation
  dmaengine: dmatest: move callback wait queue to thread context
  eeprom: at24: change nvmem stride to 1
  sched/rt: Do not pull from current CPU if only one CPU to pull
  nfs: don't wait on commit in nfs_commit_inode() if there were no commit requests
  xhci: Don't add a virt_dev to the devs array before it's fully allocated
  Bluetooth: btusb: driver to enable the usb-wakeup feature
  usb: xhci: fix TDS for MTK xHCI1.1
  ceph: drop negative child dentries before try pruning inode's alias
  usbip: fix stub_send_ret_submit() vulnerability to null transfer_buffer
  usbip: fix stub_rx: harden CMD_SUBMIT path to handle malicious input
  usb: add helper to extract bits 12:11 of wMaxPacketSize
  usbip: fix stub_rx: get_pipe() to validate endpoint number
  USB: core: prevent malicious bNumInterfaces overflow
  USB: uas and storage: Add US_FL_BROKEN_FUA for another JMicron JMS567 ID
  tracing: Allocate mask_str buffer dynamically
  autofs: fix careless error in recent commit
  crypto: salsa20 - fix blkcipher_walk API usage
  crypto: hmac - require that the underlying hash algorithm is unkeyed
  crypto: rsa - fix buffer overread when stripping leading zeroes
  mfd: fsl-imx25: Clean up irq settings during removal
  Linux 4.9.70
  RDMA/cxgb4: Annotate r2 and stag as __be32
  md: free unused memory after bitmap resize
  audit: ensure that 'audit=1' actually enables audit for PID 1
  ipvlan: fix ipv6 outbound device
  kbuild: do not call cc-option before KBUILD_CFLAGS initialization
  powerpc/64: Fix checksum folding in csum_tcpudp_nofold and ip_fast_csum_nofold
  KVM: arm/arm64: vgic-its: Preserve the revious read from the pending table
  fix kcm_clone()
  usb: gadget: ffs: Forbid usb_ep_alloc_request from sleeping
  s390: always save and restore all registers on context switch
  ipmi: Stop timers before cleaning up the module
  Fix handling of verdicts after NF_QUEUE
  tipc: call tipc_rcv() only if bearer is up in tipc_udp_recv()
  s390/qeth: fix thinko in IPv4 multicast address tracking
  s390/qeth: fix GSO throughput regression
  s390/qeth: build max size GSO skbs on L2 devices
  tcp/dccp: block bh before arming time_wait timer
  stmmac: reset last TSO segment size after device open
  net: remove hlist_nulls_add_tail_rcu()
  usbnet: fix alignment for frames with no ethernet header
  net/packet: fix a race in packet_bind() and packet_notifier()
  packet: fix crash in fanout_demux_rollover()
  sit: update frag_off info
  rds: Fix NULL pointer dereference in __rds_rdma_map
  tipc: fix memory leak in tipc_accept_from_sock()
  s390/qeth: fix early exit from error path
  net: qmi_wwan: add Quectel BG96 2c7c:0296
  ANDROID: dma-buf/sw_sync: Rename active_list to link
  FROMLIST: android: binder: Fix null ptr dereference in debug msg
  FROMLIST: android: binder: Move buffer out of area shared with user space
  FROMLIST: android: binder: Add allocator selftest
  FROMLIST: android: binder: Refactor prev and next buffer into a helper function
  Linux 4.9.69
  afs: Connect up the CB.ProbeUuid
  IB/mlx5: Assign send CQ and recv CQ of UMR QP
  IB/mlx4: Increase maximal message size under UD QP
  xfrm: Copy policy family in clone_policy
  jump_label: Invoke jump_label_test() via early_initcall()
  atm: horizon: Fix irq release error
  clk: uniphier: fix DAPLL2 clock rate of Pro5
  bpf: fix lockdep splat
  sctp: use the right sk after waking up from wait_buf sleep
  sctp: do not free asoc when it is already dead in sctp_sendmsg
  zsmalloc: calling zs_map_object() from irq is a bug
  sparc64/mm: set fields in deferred pages
  block: wake up all tasks blocked in get_request()
  dt-bindings: usb: fix reg-property port-number range
  xfs: fix forgotten rcu read unlock when skipping inode reclaim
  sunrpc: Fix rpc_task_begin trace point
  NFS: Fix a typo in nfs_rename()
  dynamic-debug-howto: fix optional/omitted ending line number to be LARGE instead of 0
  lib/genalloc.c: make the avail variable an atomic_long_t
  drivers/rapidio/devices/rio_mport_cdev.c: fix resource leak in error handling path in 'rio_dma_transfer()'
  route: update fnhe_expires for redirect when the fnhe exists
  route: also update fnhe_genid when updating a route cache
  gre6: use log_ecn_error module parameter in ip6_tnl_rcv()
  mac80211_hwsim: Fix memory leak in hwsim_new_radio_nl()
  x86/mpx/selftests: Fix up weird arrays
  coccinelle: fix parallel build with CHECK=scripts/coccicheck
  kbuild: pkg: use --transform option to prefix paths in tar
  EDAC, i5000, i5400: Fix definition of NRECMEMB register
  EDAC, i5000, i5400: Fix use of MTR_DRAM_WIDTH macro
  powerpc/powernv/ioda2: Gracefully fail if too many TCE levels requested
  drm/amd/amdgpu: fix console deadlock if late init failed
  axonram: Fix gendisk handling
  netfilter: don't track fragmented packets
  zram: set physical queue limits to avoid array out of bounds accesses
  blk-mq: initialize mq kobjects in blk_mq_init_allocated_queue()
  i2c: riic: fix restart condition
  crypto: s5p-sss - Fix completing crypto request in IRQ handler
  ipv6: reorder icmpv6_init() and ip6_mr_init()
  ibmvnic: Allocate number of rx/tx buffers agreed on by firmware
  ibmvnic: Fix overflowing firmware/hardware TX queue
  rds: tcp: Sequence teardown of listen and acceptor sockets to avoid races
  bnx2x: do not rollback VF MAC/VLAN filters we did not configure
  bnx2x: fix detection of VLAN filtering feature for VF
  bnx2x: fix possible overrun of VFPF multicast addresses array
  bnx2x: prevent crash when accessing PTP with interface down
  spi_ks8995: regs_size incorrect for some devices
  spi_ks8995: fix "BUG: key accdaa28 not in .data!"
  KVM: arm/arm64: VGIC: Fix command handling while ITS being disabled
  arm64: KVM: Survive unknown traps from guests
  arm: KVM: Survive unknown traps from guests
  KVM: nVMX: reset nested_run_pending if the vCPU is going to be reset
  irqchip/crossbar: Fix incorrect type of register size
  scsi: lpfc: Fix crash during Hardware error recovery on SLI3 adapters
  scsi: qla2xxx: Fix ql_dump_buffer
  workqueue: trigger WARN if queue_delayed_work() is called with NULL @wq
  libata: drop WARN from protocol error in ata_sff_qc_issue()
  kvm: nVMX: VMCLEAR should not cause the vCPU to shut down
  usb: gadget: udc: net2280: Fix tmp reusage in net2280 driver
  usb: gadget: pxa27x: Test for a valid argument pointer
  usb: dwc3: gadget: Fix system suspend/resume on TI platforms
  USB: gadgetfs: Fix a potential memory leak in 'dev_config()'
  usb: gadget: configs: plug memory leak
  HID: chicony: Add support for another ASUS Zen AiO keyboard
  gpio: altera: Use handle_level_irq when configured as a level_high
  ASoC: rcar: avoid SSI_MODEx settings for SSI8
  ARM: OMAP2+: Release device node after it is no longer needed.
  ARM: OMAP2+: Fix device node reference counts
  powerpc/64: Fix checksum folding in csum_add()
  module: set __jump_table alignment to 8
  lirc: fix dead lock between open and wakeup_filter
  powerpc: Fix compiling a BE kernel with a powerpc64le toolchain
  selftest/powerpc: Fix false failures for skipped tests
  powerpc/64: Invalidate process table caching after setting process table
  x86/hpet: Prevent might sleep splat on resume
  sched/fair: Make select_idle_cpu() more aggressive
  x86/platform/uv/BAU: Fix HUB errors by remove initial write to sw-ack register
  x86/selftests: Add clobbers for int80 on x86_64
  ARM: OMAP2+: gpmc-onenand: propagate error on initialization failure
  vti6: Don't report path MTU below IPV6_MIN_MTU.
  ARM: 8657/1: uaccess: consistently check object sizes
  Revert "spi: SPI_FSL_DSPI should depend on HAS_DMA"
  Revert "drm/armada: Fix compile fail"
  mm: drop unused pmdp_huge_get_and_clear_notify()
  thp: fix MADV_DONTNEED vs. numa balancing race
  thp: reduce indentation level in change_huge_pmd()
  ARM: avoid faulting on qemu
  ARM: BUG if jumping to usermode address in kernel mode
  usb: f_fs: Force Reserved1=1 in OS_DESC_EXT_COMPAT
  crypto: talitos - fix ctr-aes-talitos
  crypto: talitos - fix use of sg_link_tbl_len
  crypto: talitos - fix AEAD for sha224 on non sha224 capable chips
  crypto: talitos - fix setkey to check key weakness
  crypto: talitos - fix memory corruption on SEC2
  crypto: talitos - fix AEAD test failures
  bus: arm-ccn: fix module unloading Error: Removing state 147 which has instances left.
  bus: arm-ccn: Fix use of smp_processor_id() in preemptible context
  bus: arm-ccn: Check memory allocation failure
  bus: arm-cci: Fix use of smp_processor_id() in preemptible context
  arm64: fpsimd: Prevent registers leaking from dead tasks
  KVM: arm/arm64: vgic-its: Check result of allocation before use
  KVM: arm/arm64: vgic-irqfd: Fix MSI entry allocation
  KVM: arm/arm64: Fix broken GICH_ELRSR big endian conversion
  KVM: VMX: remove I/O port 0x80 bypass on Intel hosts
  arm: KVM: Fix VTTBR_BADDR_MASK BUG_ON off-by-one
  arm64: KVM: fix VTTBR_BADDR_MASK BUG_ON off-by-one
  media: dvb: i2c transfers over usb cannot be done from stack
  drm/exynos: gem: Drop NONCONTIG flag for buffers allocated without IOMMU
  kdb: Fix handling of kallsyms_symbol_next() return value
  brcmfmac: change driver unbind order of the sdio function devices
  powerpc/64s: Initialize ISAv3 MMU registers before setting partition table
  KVM: s390: Fix skey emulation permission check
  s390: fix compat system call table
  smp/hotplug: Move step CPUHP_AP_SMPCFD_DYING to the correct place
  iommu/vt-d: Fix scatterlist offset handling
  ALSA: usb-audio: Add check return value for usb_string()
  ALSA: usb-audio: Fix out-of-bound error
  ALSA: seq: Remove spurious WARN_ON() at timer check
  ALSA: pcm: prevent UAF in snd_pcm_info
  btrfs: fix missing error return in btrfs_drop_snapshot
  KVM: x86: fix APIC page invalidation
  x86/PCI: Make broadcom_postcore_init() check acpi_disabled
  X.509: fix comparisons of ->pkey_algo
  X.509: reject invalid BIT STRING for subjectPublicKey
  KEYS: add missing permission check for request_key() destination
  ASN.1: check for error from ASN1_OP_END__ACT actions
  ASN.1: fix out-of-bounds read when parsing indefinite length item
  efi/esrt: Use memunmap() instead of kfree() to free the remapping
  efi: Move some sysfs files to be read-only by root
  scsi: libsas: align sata_device's rps_resp on a cacheline
  scsi: use dma_get_cache_alignment() as minimum DMA alignment
  scsi: dma-mapping: always provide dma_get_cache_alignment
  isa: Prevent NULL dereference in isa_bus driver callbacks
  hv: kvp: Avoid reading past allocated blocks from KVP file
  virtio: release virtio index when fail to device_register
  can: usb_8dev: cancel urb on -EPIPE and -EPROTO
  can: esd_usb2: cancel urb on -EPIPE and -EPROTO
  can: ems_usb: cancel urb on -EPIPE and -EPROTO
  can: kvaser_usb: cancel urb on -EPIPE and -EPROTO
  can: kvaser_usb: ratelimit errors if incomplete messages are received
  can: kvaser_usb: Fix comparison bug in kvaser_usb_read_bulk_callback()
  can: kvaser_usb: free buf in error paths
  can: ti_hecc: Fix napi poll return value for repoll
  usb: gadget: udc: renesas_usb3: fix number of the pipes
  ANDROID: Revert "arm64: move ELF_ET_DYN_BASE to 4GB / 4MB"
  ANDROID: Revert "arm: move ELF_ET_DYN_BASE to 4MB"
  Linux 4.9.68
  xen-netfront: avoid crashing on resume after a failure in talk_to_netback()
  usb: host: fix incorrect updating of offset
  USB: usbfs: Filter flags passed in from user space
  USB: devio: Prevent integer overflow in proc_do_submiturb()
  USB: Increase usbfs transfer limit
  USB: core: Add type-specific length check of BOS descriptors
  usb: xhci: fix panic in xhci_free_virt_devices_depth_first
  usb: hub: Cycle HUB power when initialization fails
  dma-buf: Update kerneldoc for sync_file_create
  dma-buf/sync_file: hold reference to fence when creating sync_file
  dma-buf/sw_sync: force signal all unsignaled fences on dying timeline
  dma-fence: Introduce drm_fence_set_error() helper
  dma-fence: Wrap querying the fence->status
  dma-fence: Clear fence->status during dma_fence_init()
  dma-buf/sw_sync: clean up list before signaling the fence
  dma-buf/sw_sync: move timeline_fence_ops around
  dma-buf/sw-sync: Use an rbtree to sort fences in the timeline
  dma-buf/sw-sync: Fix locking around sync_timeline lists
  dma-buf/sw-sync: sync_pt is private and of fixed size
  dma-buf/sw-sync: Reduce irqsave/irqrestore from known context
  dma-buf/sw-sync: Prevent user overflow on timeline advance
  dma-buf/sw-sync: Fix the is-signaled test to handle u32 wraparound
  dma-buf/dma-fence: Extract __dma_fence_is_later()
  net: fec: fix multicast filtering hardware setup
  xen-netback: vif counters from int/long to u64
  cec: initiator should be the same as the destination for, poll
  xen-netfront: Improve error handling during initialization
  mm: avoid returning VM_FAULT_RETRY from ->page_mkwrite handlers
  vfio/spapr: Fix missing mutex unlock when creating a window
  be2net: fix initial MAC setting
  net: thunderx: avoid dereferencing xcv when NULL
  net: phy: micrel: KSZ8795 do not set SUPPORTED_[Asym_]Pause
  gtp: fix cross netns recv on gtp socket
  gtp: clear DF bit on GTP packet tx
  nvmet: cancel fatal error and flush async work before free controller
  i2c: i2c-cadence: Initialize configuration before probing devices
  tcp: correct memory barrier usage in tcp_check_space()
  dmaengine: pl330: fix double lock
  tipc: fix cleanup at module unload
  tipc: fix nametbl_lock soft lockup at module exit
  RDMA/qedr: Fix RDMA CM loopback
  RDMA/qedr: Return success when not changing QP state
  mac80211: don't try to sleep in rate_control_rate_init()
  drm/amdgpu: fix unload driver issue for virtual display
  x86/fpu: Set the xcomp_bv when we fake up a XSAVES area
  net: sctp: fix array overrun read on sctp_timer_tbl
  drm/exynos/decon5433: set STANDALONE_UPDATE_F on output enablement
  drm/amdgpu: fix bug set incorrect value to vce register
  qla2xxx: Fix wrong IOCB type assumption
  powerpc/mm: Fix memory hotplug BUG() on radix
  perf/x86/intel: Account interrupts for PEBS errors
  NFSv4: Fix client recovery when server reboots multiple times
  mac80211: prevent skb/txq mismatch
  KVM: arm/arm64: Fix occasional warning from the timer work function
  drm/exynos/decon5433: set STANDALONE_UPDATE_F also if planes are disabled
  drm/exynos/decon5433: update shadow registers iff there are active windows
  nfs: Don't take a reference on fl->fl_file for LOCK operation
  ravb: Remove Rx overflow log messages
  mac80211: calculate min channel width correctly
  mm: fix remote numa hits statistics
  net: qrtr: Mark 'buf' as little endian
  libfs: Modify mount_pseudo_xattr to be clear it is not a userspace mount
  net/appletalk: Fix kernel memory disclosure
  be2net: fix unicast list filling
  be2net: fix accesses to unicast list
  vti6: fix device register to report IFLA_INFO_KIND
  ARM: OMAP1: DMA: Correct the number of logical channels
  ARM: OMAP2+: Fix WL1283 Bluetooth Baud Rate
  net: systemport: Pad packet before inserting TSB
  net: systemport: Utilize skb_put_padto()
  libcxgb: fix error check for ip6_route_output()
  usb: gadget: f_fs: Fix ExtCompat descriptor validation
  dmaengine: stm32-dma: Fix null pointer dereference in stm32_dma_tx_status
  dmaengine: stm32-dma: Set correct args number for DMA request from DT
  l2tp: take remote address into account in l2tp_ip and l2tp_ip6 socket lookups
  net/mlx4_en: Fix type mismatch for 32-bit systems
  dax: Avoid page invalidation races and unnecessary radix tree traversals
  iio: adc: ti-ads1015: add 10% to conversion wait time
  tools include: Do not use poison with C++
  kprobes/x86: Disable preemption in ftrace-based jprobes
  perf test attr: Fix ignored test case result
  usbip: tools: Install all headers needed for libusbip development
  sysrq : fix Show Regs call trace on ARM
  EDAC, sb_edac: Fix missing break in switch
  x86/entry: Use SYSCALL_DEFINE() macros for sys_modify_ldt()
  serial: 8250: Preserve DLD[7:4] for PORT_XR17V35X
  usb: phy: tahvo: fix error handling in tahvo_usb_probe()
  mmc: sdhci-msm: fix issue with power irq
  spi: spi-axi: fix potential use-after-free after deregistration
  spi: sh-msiof: Fix DMA transfer size check
  staging: rtl8188eu: avoid a null dereference on pmlmepriv
  serial: 8250_fintek: Fix rs485 disablement on invalid ioctl()
  m68k: fix ColdFire node shift size calculation
  staging: greybus: loopback: Fix iteration count on async path
  selftests/x86/ldt_get: Add a few additional tests for limits
  s390/pci: do not require AIS facility
  ima: fix hash algorithm initialization
  USB: serial: option: add Quectel BG96 id
  s390/runtime instrumentation: simplify task exit handling
  serial: 8250_pci: Add Amazon PCI serial device ID
  usb: quirks: Add no-lpm quirk for KY-688 USB 3.1 Type-C Hub
  uas: Always apply US_FL_NO_ATA_1X quirk to Seagate devices
  mm, oom_reaper: gather each vma to prevent leaking TLB entry
  Revert "crypto: caam - get rid of tasklet"
  drm/fsl-dcu: enable IRQ before drm_atomic_helper_resume()
  drm/fsl-dcu: avoid disabling pixel clock twice on suspend
  bcache: recover data from backing when data is clean
  bcache: only permit to recovery read error when cache device is clean
  Linux 4.9.67
  drm/i915: Prevent zero length "index" write
  drm/i915: Don't try indexed reads to alternate slave addresses
  NFS: revalidate "." etc correctly on "open".
  Revert "x86/entry/64: Add missing irqflags tracing to native_load_gs_index()"
  drm/amd/pp: fix typecast error in powerplay.
  drm/ttm: once more fix ttm_buffer_object_transfer
  drm/hisilicon: Ensure LDI regs are properly configured.
  drm/panel: simple: Add missing panel_simple_unprepare() calls
  drm/radeon: fix atombios on big endian
  drm/amdgpu: Potential uninitialized variable in amdgpu_vm_update_directories()
  drm/amdgpu: potential uninitialized variable in amdgpu_vce_ring_parse_cs()
  Revert "drm/radeon: dont switch vt on suspend"
  nvme-pci: add quirk for delay before CHK RDY for WDC SN200
  hwmon: (jc42) optionally try to disable the SMBUS timeout
  bcache: Fix building error on MIPS
  i2c: i801: Fix Failed to allocate irq -2147483648 error
  eeprom: at24: check at24_read/write arguments
  eeprom: at24: correctly set the size for at24mac402
  eeprom: at24: fix reading from 24MAC402/24MAC602
  mmc: core: prepend 0x to OCR entry in sysfs
  mmc: core: Do not leave the block driver in a suspended state
  KVM: lapic: Fixup LDR on load in x2apic
  KVM: lapic: Split out x2apic ldr calculation
  KVM: x86: inject exceptions produced by x86_decode_insn
  KVM: x86: Exit to user-mode on #UD intercept when emulator requires
  KVM: x86: pvclock: Handle first-time write to pvclock-page contains random junk
  ARM: OMAP2+: Fix WL1283 Bluetooth Baud Rate
  mfd: twl4030-power: Fix pmic for boards that need vmmc1 on reboot
  nfsd: fix panic in posix_unblock_lock called from nfs4_laundromat
  nfsd: Fix another OPEN stateid race
  nfsd: Fix stateid races between OPEN and CLOSE
  btrfs: clear space cache inode generation always
  mm/madvise.c: fix madvise() infinite loop under special circumstances
  mm, hugetlbfs: introduce ->split() to vm_operations_struct
  mm/cma: fix alloc_contig_range ret code/potential leak
  mm, thp: Do not make page table dirty unconditionally in touch_p[mu]d()
  ARM: dts: omap3: logicpd-torpedo-37xx-devkit: Fix MMC1 cd-gpio
  ARM: dts: LogicPD Torpedo: Fix camera pin mux
  Linux 4.9.66
  xen: xenbus driver must not accept invalid transaction ids
  nvmet: fix KATO offset in Set Features
  cec: update log_addr[] before finishing configuration
  cec: CEC_MSG_GIVE_FEATURES should abort for CEC version < 2
  cec: when canceling a message, don't overwrite old status info
  s390/kbuild: enable modversions for symbols exported from asm
  ASoC: wm_adsp: Don't overrun firmware file buffer when reading region data
  btrfs: return the actual error value from from btrfs_uuid_tree_iterate
  crypto: marvell - Copy IVDIG before launching partial DMA ahash requests
  ASoC: rsnd: don't double free kctrl
  netfilter: nf_tables: fix oob access
  netfilter: nft_queue: use raw_smp_processor_id()
  spi: SPI_FSL_DSPI should depend on HAS_DMA
  staging: iio: cdc: fix improper return value
  iio: light: fix improper return value
  adm80211: add checks for dma mapping errors
  mac80211: Suppress NEW_PEER_CANDIDATE event if no room
  mac80211: Remove invalid flag operations in mesh TSF synchronization
  drm/mediatek: don't use drm_put_dev
  clk: qcom: ipq4019: Add all the frequencies for apss cpu
  drm: Apply range restriction after color adjustment when allocation
  gpio: mockup: dynamically allocate memory for chip name
  ALSA: hda - Apply ALC269_FIXUP_NO_SHUTUP on HDA_FIXUP_ACT_PROBE
  ath10k: set CTS protection VDEV param only if VDEV is up
  bnxt_en: Set default completion ring for async events.
  pinctrl: sirf: atlas7: Add missing 'of_node_put()'
  ath10k: fix potential memory leak in ath10k_wmi_tlv_op_pull_fw_stats()
  ath10k: ignore configuring the incorrect board_id
  ath10k: fix incorrect txpower set by P2P_DEVICE interface
  mwifiex: sdio: fix use after free issue for save_adapter
  adm80211: return an error if adm8211_alloc_rings() fails
  rt2800: set minimum MPDU and PSDU lengths to sane values
  drm/armada: Fix compile fail
  net: 3com: typhoon: typhoon_init_one: fix incorrect return values
  net: 3com: typhoon: typhoon_init_one: make return values more specific
  net: Allow IP_MULTICAST_IF to set index to L3 slave
  fscrypt: use ENOTDIR when setting encryption policy on nondirectory
  fscrypt: use ENOKEY when file cannot be created w/o key
  dmaengine: zx: set DMA_CYCLIC cap_mask bit
  clk: sunxi-ng: fix PLL_CPUX adjusting on A33
  clk: sunxi-ng: A31: Fix spdif clock register
  drm/sun4i: Fix a return value in case of error
  PCI: Apply _HPX settings only to relevant devices
  RDS: RDMA: fix the ib_map_mr_sg_zbva() argument
  RDS: RDMA: return appropriate error on rdma map failures
  RDS: make message size limit compliant with spec
  e1000e: Avoid receiver overrun interrupt bursts
  e1000e: Separate signaling for link check/link up
  e1000e: Fix return value test
  e1000e: Fix error path in link detection
  Revert "drm/i915: Do not rely on wm preservation for ILK watermarks"
  PM / OPP: Add missing of_node_put(np)
  net/9p: Switch to wait_event_killable()
  fscrypt: lock mutex before checking for bounce page pool
  sched/rt: Simplify the IPI based RT balancing logic
  media: v4l2-ctrl: Fix flags field on Control events
  cx231xx-cards: fix NULL-deref on missing association descriptor
  media: rc: check for integer overflow
  media: Don't do DMA on stack for firmware upload in the AS102 driver
  powerpc/signal: Properly handle return value from uprobe_deny_signal()
  parisc: Fix validity check of pointer size argument in new CAS implementation
  ixgbe: Fix skb list corruption on Power systems
  fm10k: Use smp_rmb rather than read_barrier_depends
  i40evf: Use smp_rmb rather than read_barrier_depends
  ixgbevf: Use smp_rmb rather than read_barrier_depends
  igbvf: Use smp_rmb rather than read_barrier_depends
  igb: Use smp_rmb rather than read_barrier_depends
  i40e: Use smp_rmb rather than read_barrier_depends
  NFC: fix device-allocation error return
  IB/srp: Avoid that a cable pull can trigger a kernel crash
  IB/srpt: Do not accept invalid initiator port names
  libnvdimm, namespace: make 'resource' attribute only readable by root
  libnvdimm, namespace: fix label initialization to use valid seq numbers
  libnvdimm, pfn: make 'resource' attribute only readable by root
  clk: ti: dra7-atl-clock: fix child-node lookups
  SUNRPC: Fix tracepoint storage issues with svc_recv and svc_rqst_status
  KVM: SVM: obey guest PAT
  KVM: nVMX: set IDTR and GDTR limits when loading L1 host state
  lockd: double unregister of inetaddr notifiers
  irqchip/gic-v3: Fix ppi-partitions lookup
  block: Fix a race between blk_cleanup_queue() and timeout handling
  p54: don't unregister leds when they are not initialized
  mtd: nand: mtk: fix infinite ECC decode IRQ issue
  mtd: nand: Fix writing mtdoops to nand flash.
  mtd: nand: omap2: Fix subpage write
  target: Fix QUEUE_FULL + SCSI task attribute handling
  iscsi-target: Fix non-immediate TMR reference leak
  fs/9p: Compare qid.path in v9fs_test_inode
  fix a page leak in vhost_scsi_iov_to_sgl() error recovery
  ALSA: hda/realtek - Fix ALC700 family no sound issue
  ALSA: hda: Fix too short HDMI/DP chmap reporting
  ALSA: timer: Remove kernel warning at compat ioctl error paths
  ALSA: usb-audio: Add sanity checks in v2 clock parsers
  ALSA: usb-audio: Fix potential out-of-bound access at parsing SU
  ALSA: usb-audio: Add sanity checks to FE parser
  ALSA: pcm: update tstamp only if audio_tstamp changed
  ext4: fix interaction between i_size, fallocate, and delalloc after a crash
  ata: fixes kernel crash while tracing ata_eh_link_autopsy event
  rtlwifi: fix uninitialized rtlhal->last_suspend_sec time
  rtlwifi: rtl8192ee: Fix memory leak when loading firmware
  nfsd: deal with revoked delegations appropriately
  NFS: Avoid RCU usage in tracepoints
  nfs: Fix ugly referral attributes
  NFS: Fix typo in nomigration mount option
  isofs: fix timestamps beyond 2027
  bcache: check ca->alloc_thread initialized before wake up it
  libceph: don't WARN() if user tries to add invalid key
  eCryptfs: use after free in ecryptfs_release_messaging()
  nilfs2: fix race condition that causes file system corruption
  autofs: don't fail mount for transient error
  rt2x00usb: mark device removed when get ENOENT usb error
  MIPS: BCM47XX: Fix LED inversion for WRT54GSv1
  MIPS: Fix an n32 core file generation regset support regression
  MIPS: dts: remove bogus bcm96358nb4ser.dtb from dtb-y entry
  MIPS: Fix odd fp register warnings with MIPS64r2
  dm: fix race between dm_get_from_kobject() and __dm_destroy()
  MIPS: pci: Remove KERN_WARN instance inside the mt7620 driver
  dm: allocate struct mapped_device with kvzalloc
  dm bufio: fix integer overflow when limiting maximum cache size
  ALSA: hda: Add Raven PCI ID
  PCI: Set Cavium ACS capability quirk flags to assert RR/CR/SV/UF
  MIPS: ralink: Fix typo in mt7628 pinmux function
  MIPS: ralink: Fix MT7628 pinmux
  ARM: 8721/1: mm: dump: check hardware RO bit for LPAE
  ARM: 8722/1: mm: make STRICT_KERNEL_RWX effective for LPAE
  arm64: Implement arch-specific pte_access_permitted()
  x86/entry/64: Add missing irqflags tracing to native_load_gs_index()
  x86/decoder: Add new TEST instruction pattern
  lib/mpi: call cond_resched() from mpi_powm() loop
  sched: Make resched_cpu() unconditional
  vsock: use new wait API for vsock_stream_sendmsg()
  ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER
  x86/mm: fix use-after-free of vma during userfaultfd fault
  ACPI / EC: Fix regression related to triggering source of EC event handling
  s390/disassembler: increase show_code buffer size
  s390/disassembler: add missing end marker for e7 table
  s390/runtime instrumention: fix possible memory corruption
  s390: fix transactional execution control register handling

Conflicts:
	drivers/android/binder_alloc.c
	drivers/android/binder_alloc.h
	drivers/android/binder_alloc_selftest.c
	drivers/mmc/core/bus.c
	drivers/mmc/host/sdhci-msm.c
	drivers/thermal/step_wise.c
	kernel/cpu.c
	mm/oom_kill.c
	sound/usb/mixer.c

Change-Id: Id01eb66cafc5970b460321e44ec8ffcfa76971a6
Signed-off-by: Kyle Yan <kyan@codeaurora.org>
 2018-01-02 10:37:28 -08:00
Greg Kroah-Hartman
88b151110d Merge 4.9.71 into android-4.9-o 
Changes in 4.9.71
	mfd: fsl-imx25: Clean up irq settings during removal
	crypto: rsa - fix buffer overread when stripping leading zeroes
	crypto: hmac - require that the underlying hash algorithm is unkeyed
	crypto: salsa20 - fix blkcipher_walk API usage
	autofs: fix careless error in recent commit
	tracing: Allocate mask_str buffer dynamically
	USB: uas and storage: Add US_FL_BROKEN_FUA for another JMicron JMS567 ID
	USB: core: prevent malicious bNumInterfaces overflow
	usbip: fix stub_rx: get_pipe() to validate endpoint number
	usb: add helper to extract bits 12:11 of wMaxPacketSize
	usbip: fix stub_rx: harden CMD_SUBMIT path to handle malicious input
	usbip: fix stub_send_ret_submit() vulnerability to null transfer_buffer
	ceph: drop negative child dentries before try pruning inode's alias
	usb: xhci: fix TDS for MTK xHCI1.1
	Bluetooth: btusb: driver to enable the usb-wakeup feature
	xhci: Don't add a virt_dev to the devs array before it's fully allocated
	nfs: don't wait on commit in nfs_commit_inode() if there were no commit requests
	sched/rt: Do not pull from current CPU if only one CPU to pull
	eeprom: at24: change nvmem stride to 1
	dmaengine: dmatest: move callback wait queue to thread context
	ext4: fix fdatasync(2) after fallocate(2) operation
	ext4: fix crash when a directory's i_size is too small
	mac80211: Fix addition of mesh configuration element
	usb: phy: isp1301: Add OF device ID table
	KVM: nVMX: do not warn when MSR bitmap address is not backed
	usb: xhci-mtk: check hcc_params after adding primary hcd
	md-cluster: free md_cluster_info if node leave cluster
	userfaultfd: shmem: __do_fault requires VM_FAULT_NOPAGE
	userfaultfd: selftest: vm: allow to build in vm/ directory
	net: initialize msg.msg_flags in recvfrom
	bnxt_en: Ignore 0 value in autoneg supported speed from firmware.
	net: bcmgenet: correct the RBUF_OVFL_CNT and RBUF_ERR_CNT MIB values
	net: bcmgenet: correct MIB access of UniMAC RUNT counters
	net: bcmgenet: reserved phy revisions must be checked first
	net: bcmgenet: power down internal phy if open or resume fails
	net: bcmgenet: synchronize irq0 status between the isr and task
	net: bcmgenet: Power up the internal PHY before probing the MII
	rxrpc: Wake up the transmitter if Rx window size increases on the peer
	net/mlx5: Fix create autogroup prev initializer
	net/mlx5: Don't save PCI state when PCI error is detected
	iommu/io-pgtable-arm-v7s: Check for leaf entry before dereferencing it
	drm/amdgpu: fix parser init error path to avoid crash in parser fini
	NFSD: fix nfsd_minorversion(.., NFSD_AVAIL)
	NFSD: fix nfsd_reset_versions for NFSv4.
	Input: i8042 - add TUXEDO BU1406 (N24_25BU) to the nomux list
	drm/omap: fix dmabuf mmap for dma_alloc'ed buffers
	netfilter: bridge: honor frag_max_size when refragmenting
	ASoC: rsnd: fix sound route path when using SRC6/SRC9
	blk-mq: Fix tagset reinit in the presence of cpu hot-unplug
	writeback: fix memory leak in wb_queue_work()
	net: wimax/i2400m: fix NULL-deref at probe
	dmaengine: Fix array index out of bounds warning in __get_unmap_pool()
	irqchip/mvebu-odmi: Select GENERIC_MSI_IRQ_DOMAIN
	net: Resend IGMP memberships upon peer notification.
	mlxsw: reg: Fix SPVM max record count
	mlxsw: reg: Fix SPVMLR max record count
	qed: Align CIDs according to DORQ requirement
	qed: Fix mapping leak on LL2 rx flow
	qed: Fix interrupt flags on Rx LL2
	drm: amd: remove broken include path
	intel_th: pci: Add Gemini Lake support
	openrisc: fix issue handling 8 byte get_user calls
	ASoC: rcar: clear DE bit only in PDMACHCR when it stops
	scsi: hpsa: update check for logical volume status
	scsi: hpsa: limit outstanding rescans
	scsi: hpsa: do not timeout reset operations
	fjes: Fix wrong netdevice feature flags
	drm/radeon/si: add dpm quirk for Oland
	Drivers: hv: util: move waiting for release to hv_utils_transport itself
	iwlwifi: mvm: cleanup pending frames in DQA mode
	sched/deadline: Add missing update_rq_clock() in dl_task_timer()
	sched/deadline: Make sure the replenishment timer fires in the next period
	sched/deadline: Throttle a constrained deadline task activated after the deadline
	sched/deadline: Use deadline instead of period when calculating overflow
	mmc: mediatek: Fixed bug where clock frequency could be set wrong
	drm/radeon: reinstate oland workaround for sclk
	afs: Fix missing put_page()
	afs: Populate group ID from vnode status
	afs: Adjust mode bits processing
	afs: Deal with an empty callback array
	afs: Flush outstanding writes when an fd is closed
	afs: Migrate vlocation fields to 64-bit
	afs: Prevent callback expiry timer overflow
	afs: Fix the maths in afs_fs_store_data()
	afs: Invalid op ID should abort with RXGEN_OPCODE
	afs: Better abort and net error handling
	afs: Populate and use client modification time
	afs: Fix page leak in afs_write_begin()
	afs: Fix afs_kill_pages()
	afs: Fix abort on signal while waiting for call completion
	nvme-loop: fix a possible use-after-free when destroying the admin queue
	nvmet: confirm sq percpu has scheduled and switched to atomic
	nvmet-rdma: Fix a possible uninitialized variable dereference
	net/mlx4_core: Avoid delays during VF driver device shutdown
	net: mpls: Fix nexthop alive tracking on down events
	rxrpc: Ignore BUSY packets on old calls
	tty: don't panic on OOM in tty_set_ldisc()
	tty: fix data race in tty_ldisc_ref_wait()
	perf symbols: Fix symbols__fixup_end heuristic for corner cases
	efi/esrt: Cleanup bad memory map log messages
	NFSv4.1 respect server's max size in CREATE_SESSION
	btrfs: add missing memset while reading compressed inline extents
	target: Use system workqueue for ALUA transitions
	target: fix ALUA transition timeout handling
	target: fix race during implicit transition work flushes
	Revert "x86/acpi: Set persistent cpuid <-> nodeid mapping when booting"
	HID: cp2112: fix broken gpio_direction_input callback
	sfc: don't warn on successful change of MAC
	fbdev: controlfb: Add missing modes to fix out of bounds access
	video: udlfb: Fix read EDID timeout
	video: fbdev: au1200fb: Release some resources if a memory allocation fails
	video: fbdev: au1200fb: Return an error code if a memory allocation fails
	rtc: pcf8563: fix output clock rate
	ASoC: Intel: Skylake: Fix uuid_module memory leak in failure case
	dmaengine: ti-dma-crossbar: Correct am335x/am43xx mux value type
	PCI/PME: Handle invalid data when reading Root Status
	powerpc/powernv/cpufreq: Fix the frequency read by /proc/cpuinfo
	PCI: Do not allocate more buses than available in parent
	iommu/mediatek: Fix driver name
	netfilter: ipvs: Fix inappropriate output of procfs
	powerpc/opal: Fix EBUSY bug in acquiring tokens
	powerpc/ipic: Fix status get and status clear
	platform/x86: intel_punit_ipc: Fix resource ioremap warning
	target/iscsi: Fix a race condition in iscsit_add_reject_from_cmd()
	iscsi-target: fix memory leak in lio_target_tiqn_addtpg()
	target:fix condition return in core_pr_dump_initiator_port()
	target/file: Do not return error for UNMAP if length is zero
	badblocks: fix wrong return value in badblocks_set if badblocks are disabled
	iommu/amd: Limit the IOVA page range to the specified addresses
	xfs: truncate pagecache before writeback in xfs_setattr_size()
	arm-ccn: perf: Prevent module unload while PMU is in use
	crypto: tcrypt - fix buffer lengths in test_aead_speed()
	mm: Handle 0 flags in _calc_vm_trans() macro
	clk: mediatek: add the option for determining PLL source clock
	clk: imx6: refine hdmi_isfr's parent to make HDMI work on i.MX6 SoCs w/o VPU
	clk: hi6220: mark clock cs_atb_syspll as critical
	clk: tegra: Fix cclk_lp divisor register
	ppp: Destroy the mutex when cleanup
	ASoC: rsnd: rsnd_ssi_run_mods() needs to care ssi_parent_mod
	thermal/drivers/step_wise: Fix temperature regulation misbehavior
	scsi: scsi_debug: write_same: fix error report
	GFS2: Take inode off order_write list when setting jdata flag
	bcache: explicitly destroy mutex while exiting
	bcache: fix wrong cache_misses statistics
	Ib/hfi1: Return actual operational VLs in port info query
	arm64: prevent regressions in compressed kernel image size when upgrading to binutils 2.27
	btrfs: tests: Fix a memory leak in error handling path in 'run_test()'
	platform/x86: hp_accel: Add quirk for HP ProBook 440 G4
	nvme: use kref_get_unless_zero in nvme_find_get_ns
	l2tp: cleanup l2tp_tunnel_delete calls
	xfs: fix log block underflow during recovery cycle verification
	xfs: fix incorrect extent state in xfs_bmap_add_extent_unwritten_real
	RDMA/cxgb4: Declare stag as __be32
	PCI: Detach driver before procfs & sysfs teardown on device remove
	scsi: hpsa: cleanup sas_phy structures in sysfs when unloading
	scsi: hpsa: destroy sas transport properties before scsi_host
	powerpc/perf/hv-24x7: Fix incorrect comparison in memord
	soc: mediatek: pwrap: fix compiler errors
	tty fix oops when rmmod 8250
	usb: musb: da8xx: fix babble condition handling
	pinctrl: adi2: Fix Kconfig build problem
	raid5: Set R5_Expanded on parity devices as well as data.
	scsi: scsi_devinfo: Add REPORTLUN2 to EMC SYMMETRIX blacklist entry
	IB/core: Fix calculation of maximum RoCE MTU
	vt6655: Fix a possible sleep-in-atomic bug in vt6655_suspend
	rtl8188eu: Fix a possible sleep-in-atomic bug in rtw_createbss_cmd
	rtl8188eu: Fix a possible sleep-in-atomic bug in rtw_disassoc_cmd
	scsi: sd: change manage_start_stop to bool in sysfs interface
	scsi: sd: change allow_restart to bool in sysfs interface
	scsi: bfa: integer overflow in debugfs
	udf: Avoid overflow when session starts at large offset
	macvlan: Only deliver one copy of the frame to the macvlan interface
	RDMA/cma: Avoid triggering undefined behavior
	IB/ipoib: Grab rtnl lock on heavy flush when calling ndo_open/stop
	icmp: don't fail on fragment reassembly time exceeded
	ath9k: fix tx99 potential info leak
	Linux 4.9.71

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2017-12-20 10:51:52 +01:00
Greg Kroah-Hartman
319c8e1bc7 Merge 4.9.71 into android-4.9 
Changes in 4.9.71
	mfd: fsl-imx25: Clean up irq settings during removal
	crypto: rsa - fix buffer overread when stripping leading zeroes
	crypto: hmac - require that the underlying hash algorithm is unkeyed
	crypto: salsa20 - fix blkcipher_walk API usage
	autofs: fix careless error in recent commit
	tracing: Allocate mask_str buffer dynamically
	USB: uas and storage: Add US_FL_BROKEN_FUA for another JMicron JMS567 ID
	USB: core: prevent malicious bNumInterfaces overflow
	usbip: fix stub_rx: get_pipe() to validate endpoint number
	usb: add helper to extract bits 12:11 of wMaxPacketSize
	usbip: fix stub_rx: harden CMD_SUBMIT path to handle malicious input
	usbip: fix stub_send_ret_submit() vulnerability to null transfer_buffer
	ceph: drop negative child dentries before try pruning inode's alias
	usb: xhci: fix TDS for MTK xHCI1.1
	Bluetooth: btusb: driver to enable the usb-wakeup feature
	xhci: Don't add a virt_dev to the devs array before it's fully allocated
	nfs: don't wait on commit in nfs_commit_inode() if there were no commit requests
	sched/rt: Do not pull from current CPU if only one CPU to pull
	eeprom: at24: change nvmem stride to 1
	dmaengine: dmatest: move callback wait queue to thread context
	ext4: fix fdatasync(2) after fallocate(2) operation
	ext4: fix crash when a directory's i_size is too small
	mac80211: Fix addition of mesh configuration element
	usb: phy: isp1301: Add OF device ID table
	KVM: nVMX: do not warn when MSR bitmap address is not backed
	usb: xhci-mtk: check hcc_params after adding primary hcd
	md-cluster: free md_cluster_info if node leave cluster
	userfaultfd: shmem: __do_fault requires VM_FAULT_NOPAGE
	userfaultfd: selftest: vm: allow to build in vm/ directory
	net: initialize msg.msg_flags in recvfrom
	bnxt_en: Ignore 0 value in autoneg supported speed from firmware.
	net: bcmgenet: correct the RBUF_OVFL_CNT and RBUF_ERR_CNT MIB values
	net: bcmgenet: correct MIB access of UniMAC RUNT counters
	net: bcmgenet: reserved phy revisions must be checked first
	net: bcmgenet: power down internal phy if open or resume fails
	net: bcmgenet: synchronize irq0 status between the isr and task
	net: bcmgenet: Power up the internal PHY before probing the MII
	rxrpc: Wake up the transmitter if Rx window size increases on the peer
	net/mlx5: Fix create autogroup prev initializer
	net/mlx5: Don't save PCI state when PCI error is detected
	iommu/io-pgtable-arm-v7s: Check for leaf entry before dereferencing it
	drm/amdgpu: fix parser init error path to avoid crash in parser fini
	NFSD: fix nfsd_minorversion(.., NFSD_AVAIL)
	NFSD: fix nfsd_reset_versions for NFSv4.
	Input: i8042 - add TUXEDO BU1406 (N24_25BU) to the nomux list
	drm/omap: fix dmabuf mmap for dma_alloc'ed buffers
	netfilter: bridge: honor frag_max_size when refragmenting
	ASoC: rsnd: fix sound route path when using SRC6/SRC9
	blk-mq: Fix tagset reinit in the presence of cpu hot-unplug
	writeback: fix memory leak in wb_queue_work()
	net: wimax/i2400m: fix NULL-deref at probe
	dmaengine: Fix array index out of bounds warning in __get_unmap_pool()
	irqchip/mvebu-odmi: Select GENERIC_MSI_IRQ_DOMAIN
	net: Resend IGMP memberships upon peer notification.
	mlxsw: reg: Fix SPVM max record count
	mlxsw: reg: Fix SPVMLR max record count
	qed: Align CIDs according to DORQ requirement
	qed: Fix mapping leak on LL2 rx flow
	qed: Fix interrupt flags on Rx LL2
	drm: amd: remove broken include path
	intel_th: pci: Add Gemini Lake support
	openrisc: fix issue handling 8 byte get_user calls
	ASoC: rcar: clear DE bit only in PDMACHCR when it stops
	scsi: hpsa: update check for logical volume status
	scsi: hpsa: limit outstanding rescans
	scsi: hpsa: do not timeout reset operations
	fjes: Fix wrong netdevice feature flags
	drm/radeon/si: add dpm quirk for Oland
	Drivers: hv: util: move waiting for release to hv_utils_transport itself
	iwlwifi: mvm: cleanup pending frames in DQA mode
	sched/deadline: Add missing update_rq_clock() in dl_task_timer()
	sched/deadline: Make sure the replenishment timer fires in the next period
	sched/deadline: Throttle a constrained deadline task activated after the deadline
	sched/deadline: Use deadline instead of period when calculating overflow
	mmc: mediatek: Fixed bug where clock frequency could be set wrong
	drm/radeon: reinstate oland workaround for sclk
	afs: Fix missing put_page()
	afs: Populate group ID from vnode status
	afs: Adjust mode bits processing
	afs: Deal with an empty callback array
	afs: Flush outstanding writes when an fd is closed
	afs: Migrate vlocation fields to 64-bit
	afs: Prevent callback expiry timer overflow
	afs: Fix the maths in afs_fs_store_data()
	afs: Invalid op ID should abort with RXGEN_OPCODE
	afs: Better abort and net error handling
	afs: Populate and use client modification time
	afs: Fix page leak in afs_write_begin()
	afs: Fix afs_kill_pages()
	afs: Fix abort on signal while waiting for call completion
	nvme-loop: fix a possible use-after-free when destroying the admin queue
	nvmet: confirm sq percpu has scheduled and switched to atomic
	nvmet-rdma: Fix a possible uninitialized variable dereference
	net/mlx4_core: Avoid delays during VF driver device shutdown
	net: mpls: Fix nexthop alive tracking on down events
	rxrpc: Ignore BUSY packets on old calls
	tty: don't panic on OOM in tty_set_ldisc()
	tty: fix data race in tty_ldisc_ref_wait()
	perf symbols: Fix symbols__fixup_end heuristic for corner cases
	efi/esrt: Cleanup bad memory map log messages
	NFSv4.1 respect server's max size in CREATE_SESSION
	btrfs: add missing memset while reading compressed inline extents
	target: Use system workqueue for ALUA transitions
	target: fix ALUA transition timeout handling
	target: fix race during implicit transition work flushes
	Revert "x86/acpi: Set persistent cpuid <-> nodeid mapping when booting"
	HID: cp2112: fix broken gpio_direction_input callback
	sfc: don't warn on successful change of MAC
	fbdev: controlfb: Add missing modes to fix out of bounds access
	video: udlfb: Fix read EDID timeout
	video: fbdev: au1200fb: Release some resources if a memory allocation fails
	video: fbdev: au1200fb: Return an error code if a memory allocation fails
	rtc: pcf8563: fix output clock rate
	ASoC: Intel: Skylake: Fix uuid_module memory leak in failure case
	dmaengine: ti-dma-crossbar: Correct am335x/am43xx mux value type
	PCI/PME: Handle invalid data when reading Root Status
	powerpc/powernv/cpufreq: Fix the frequency read by /proc/cpuinfo
	PCI: Do not allocate more buses than available in parent
	iommu/mediatek: Fix driver name
	netfilter: ipvs: Fix inappropriate output of procfs
	powerpc/opal: Fix EBUSY bug in acquiring tokens
	powerpc/ipic: Fix status get and status clear
	platform/x86: intel_punit_ipc: Fix resource ioremap warning
	target/iscsi: Fix a race condition in iscsit_add_reject_from_cmd()
	iscsi-target: fix memory leak in lio_target_tiqn_addtpg()
	target:fix condition return in core_pr_dump_initiator_port()
	target/file: Do not return error for UNMAP if length is zero
	badblocks: fix wrong return value in badblocks_set if badblocks are disabled
	iommu/amd: Limit the IOVA page range to the specified addresses
	xfs: truncate pagecache before writeback in xfs_setattr_size()
	arm-ccn: perf: Prevent module unload while PMU is in use
	crypto: tcrypt - fix buffer lengths in test_aead_speed()
	mm: Handle 0 flags in _calc_vm_trans() macro
	clk: mediatek: add the option for determining PLL source clock
	clk: imx6: refine hdmi_isfr's parent to make HDMI work on i.MX6 SoCs w/o VPU
	clk: hi6220: mark clock cs_atb_syspll as critical
	clk: tegra: Fix cclk_lp divisor register
	ppp: Destroy the mutex when cleanup
	ASoC: rsnd: rsnd_ssi_run_mods() needs to care ssi_parent_mod
	thermal/drivers/step_wise: Fix temperature regulation misbehavior
	scsi: scsi_debug: write_same: fix error report
	GFS2: Take inode off order_write list when setting jdata flag
	bcache: explicitly destroy mutex while exiting
	bcache: fix wrong cache_misses statistics
	Ib/hfi1: Return actual operational VLs in port info query
	arm64: prevent regressions in compressed kernel image size when upgrading to binutils 2.27
	btrfs: tests: Fix a memory leak in error handling path in 'run_test()'
	platform/x86: hp_accel: Add quirk for HP ProBook 440 G4
	nvme: use kref_get_unless_zero in nvme_find_get_ns
	l2tp: cleanup l2tp_tunnel_delete calls
	xfs: fix log block underflow during recovery cycle verification
	xfs: fix incorrect extent state in xfs_bmap_add_extent_unwritten_real
	RDMA/cxgb4: Declare stag as __be32
	PCI: Detach driver before procfs & sysfs teardown on device remove
	scsi: hpsa: cleanup sas_phy structures in sysfs when unloading
	scsi: hpsa: destroy sas transport properties before scsi_host
	powerpc/perf/hv-24x7: Fix incorrect comparison in memord
	soc: mediatek: pwrap: fix compiler errors
	tty fix oops when rmmod 8250
	usb: musb: da8xx: fix babble condition handling
	pinctrl: adi2: Fix Kconfig build problem
	raid5: Set R5_Expanded on parity devices as well as data.
	scsi: scsi_devinfo: Add REPORTLUN2 to EMC SYMMETRIX blacklist entry
	IB/core: Fix calculation of maximum RoCE MTU
	vt6655: Fix a possible sleep-in-atomic bug in vt6655_suspend
	rtl8188eu: Fix a possible sleep-in-atomic bug in rtw_createbss_cmd
	rtl8188eu: Fix a possible sleep-in-atomic bug in rtw_disassoc_cmd
	scsi: sd: change manage_start_stop to bool in sysfs interface
	scsi: sd: change allow_restart to bool in sysfs interface
	scsi: bfa: integer overflow in debugfs
	udf: Avoid overflow when session starts at large offset
	macvlan: Only deliver one copy of the frame to the macvlan interface
	RDMA/cma: Avoid triggering undefined behavior
	IB/ipoib: Grab rtnl lock on heavy flush when calling ndo_open/stop
	icmp: don't fail on fragment reassembly time exceeded
	ath9k: fix tx99 potential info leak
	Linux 4.9.71

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2017-12-20 10:51:15 +01:00
Felipe Balbi
b6dbace92e usb: add helper to extract bits 12:11 of wMaxPacketSize 
commit 541b6fe63023f3059cf85d47ff2767a3e42a8e44 upstream.

According to USB Specification 2.0 table 9-4,
wMaxPacketSize is a bitfield. Endpoint's maxpacket
is laid out in bits 10:0. For high-speed,
high-bandwidth isochronous endpoints, bits 12:11
contain a multiplier to tell us how many
transactions we want to try per uframe.

This means that if we want an isochronous endpoint
to issue 3 transfers of 1024 bytes per uframe,
wMaxPacketSize should contain the value:

	1024 | (2 << 11)

or 5120 (0x1400). In order to make Host and
Peripheral controller drivers' life easier, we're
adding a helper which returns bits 12:11. Note that
no care is made WRT to checking endpoint type and
gadget's speed. That's left for drivers to handle.

Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2017-12-20 10:07:16 +01:00
Greg Kroah-Hartman
eb4ef2dea9 Merge 4.9.68 into android-4.9-o 
Changes in 4.9.68
	bcache: only permit to recovery read error when cache device is clean
	bcache: recover data from backing when data is clean
	drm/fsl-dcu: avoid disabling pixel clock twice on suspend
	drm/fsl-dcu: enable IRQ before drm_atomic_helper_resume()
	Revert "crypto: caam - get rid of tasklet"
	mm, oom_reaper: gather each vma to prevent leaking TLB entry
	uas: Always apply US_FL_NO_ATA_1X quirk to Seagate devices
	usb: quirks: Add no-lpm quirk for KY-688 USB 3.1 Type-C Hub
	serial: 8250_pci: Add Amazon PCI serial device ID
	s390/runtime instrumentation: simplify task exit handling
	USB: serial: option: add Quectel BG96 id
	ima: fix hash algorithm initialization
	s390/pci: do not require AIS facility
	selftests/x86/ldt_get: Add a few additional tests for limits
	staging: greybus: loopback: Fix iteration count on async path
	m68k: fix ColdFire node shift size calculation
	serial: 8250_fintek: Fix rs485 disablement on invalid ioctl()
	staging: rtl8188eu: avoid a null dereference on pmlmepriv
	spi: sh-msiof: Fix DMA transfer size check
	spi: spi-axi: fix potential use-after-free after deregistration
	mmc: sdhci-msm: fix issue with power irq
	usb: phy: tahvo: fix error handling in tahvo_usb_probe()
	serial: 8250: Preserve DLD[7:4] for PORT_XR17V35X
	x86/entry: Use SYSCALL_DEFINE() macros for sys_modify_ldt()
	EDAC, sb_edac: Fix missing break in switch
	sysrq : fix Show Regs call trace on ARM
	usbip: tools: Install all headers needed for libusbip development
	perf test attr: Fix ignored test case result
	kprobes/x86: Disable preemption in ftrace-based jprobes
	tools include: Do not use poison with C++
	iio: adc: ti-ads1015: add 10% to conversion wait time
	dax: Avoid page invalidation races and unnecessary radix tree traversals
	net/mlx4_en: Fix type mismatch for 32-bit systems
	l2tp: take remote address into account in l2tp_ip and l2tp_ip6 socket lookups
	dmaengine: stm32-dma: Set correct args number for DMA request from DT
	dmaengine: stm32-dma: Fix null pointer dereference in stm32_dma_tx_status
	usb: gadget: f_fs: Fix ExtCompat descriptor validation
	libcxgb: fix error check for ip6_route_output()
	net: systemport: Utilize skb_put_padto()
	net: systemport: Pad packet before inserting TSB
	ARM: OMAP2+: Fix WL1283 Bluetooth Baud Rate
	ARM: OMAP1: DMA: Correct the number of logical channels
	vti6: fix device register to report IFLA_INFO_KIND
	be2net: fix accesses to unicast list
	be2net: fix unicast list filling
	net/appletalk: Fix kernel memory disclosure
	libfs: Modify mount_pseudo_xattr to be clear it is not a userspace mount
	net: qrtr: Mark 'buf' as little endian
	mm: fix remote numa hits statistics
	mac80211: calculate min channel width correctly
	ravb: Remove Rx overflow log messages
	nfs: Don't take a reference on fl->fl_file for LOCK operation
	drm/exynos/decon5433: update shadow registers iff there are active windows
	drm/exynos/decon5433: set STANDALONE_UPDATE_F also if planes are disabled
	KVM: arm/arm64: Fix occasional warning from the timer work function
	mac80211: prevent skb/txq mismatch
	NFSv4: Fix client recovery when server reboots multiple times
	perf/x86/intel: Account interrupts for PEBS errors
	powerpc/mm: Fix memory hotplug BUG() on radix
	qla2xxx: Fix wrong IOCB type assumption
	drm/amdgpu: fix bug set incorrect value to vce register
	drm/exynos/decon5433: set STANDALONE_UPDATE_F on output enablement
	net: sctp: fix array overrun read on sctp_timer_tbl
	x86/fpu: Set the xcomp_bv when we fake up a XSAVES area
	drm/amdgpu: fix unload driver issue for virtual display
	mac80211: don't try to sleep in rate_control_rate_init()
	RDMA/qedr: Return success when not changing QP state
	RDMA/qedr: Fix RDMA CM loopback
	tipc: fix nametbl_lock soft lockup at module exit
	tipc: fix cleanup at module unload
	dmaengine: pl330: fix double lock
	tcp: correct memory barrier usage in tcp_check_space()
	i2c: i2c-cadence: Initialize configuration before probing devices
	nvmet: cancel fatal error and flush async work before free controller
	gtp: clear DF bit on GTP packet tx
	gtp: fix cross netns recv on gtp socket
	net: phy: micrel: KSZ8795 do not set SUPPORTED_[Asym_]Pause
	net: thunderx: avoid dereferencing xcv when NULL
	be2net: fix initial MAC setting
	vfio/spapr: Fix missing mutex unlock when creating a window
	mm: avoid returning VM_FAULT_RETRY from ->page_mkwrite handlers
	xen-netfront: Improve error handling during initialization
	cec: initiator should be the same as the destination for, poll
	xen-netback: vif counters from int/long to u64
	net: fec: fix multicast filtering hardware setup
	dma-buf/dma-fence: Extract __dma_fence_is_later()
	dma-buf/sw-sync: Fix the is-signaled test to handle u32 wraparound
	dma-buf/sw-sync: Prevent user overflow on timeline advance
	dma-buf/sw-sync: Reduce irqsave/irqrestore from known context
	dma-buf/sw-sync: sync_pt is private and of fixed size
	dma-buf/sw-sync: Fix locking around sync_timeline lists
	dma-buf/sw-sync: Use an rbtree to sort fences in the timeline
	dma-buf/sw_sync: move timeline_fence_ops around
	dma-buf/sw_sync: clean up list before signaling the fence
	dma-fence: Clear fence->status during dma_fence_init()
	dma-fence: Wrap querying the fence->status
	dma-fence: Introduce drm_fence_set_error() helper
	dma-buf/sw_sync: force signal all unsignaled fences on dying timeline
	dma-buf/sync_file: hold reference to fence when creating sync_file
	dma-buf: Update kerneldoc for sync_file_create
	usb: hub: Cycle HUB power when initialization fails
	usb: xhci: fix panic in xhci_free_virt_devices_depth_first
	USB: core: Add type-specific length check of BOS descriptors
	USB: Increase usbfs transfer limit
	USB: devio: Prevent integer overflow in proc_do_submiturb()
	USB: usbfs: Filter flags passed in from user space
	usb: host: fix incorrect updating of offset
	xen-netfront: avoid crashing on resume after a failure in talk_to_netback()
	Linux 4.9.68

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2017-12-10 17:14:07 +01:00
Greg Kroah-Hartman
fdeec8fdb7 Merge 4.9.68 into android-4.9 
Changes in 4.9.68
	bcache: only permit to recovery read error when cache device is clean
	bcache: recover data from backing when data is clean
	drm/fsl-dcu: avoid disabling pixel clock twice on suspend
	drm/fsl-dcu: enable IRQ before drm_atomic_helper_resume()
	Revert "crypto: caam - get rid of tasklet"
	mm, oom_reaper: gather each vma to prevent leaking TLB entry
	uas: Always apply US_FL_NO_ATA_1X quirk to Seagate devices
	usb: quirks: Add no-lpm quirk for KY-688 USB 3.1 Type-C Hub
	serial: 8250_pci: Add Amazon PCI serial device ID
	s390/runtime instrumentation: simplify task exit handling
	USB: serial: option: add Quectel BG96 id
	ima: fix hash algorithm initialization
	s390/pci: do not require AIS facility
	selftests/x86/ldt_get: Add a few additional tests for limits
	staging: greybus: loopback: Fix iteration count on async path
	m68k: fix ColdFire node shift size calculation
	serial: 8250_fintek: Fix rs485 disablement on invalid ioctl()
	staging: rtl8188eu: avoid a null dereference on pmlmepriv
	spi: sh-msiof: Fix DMA transfer size check
	spi: spi-axi: fix potential use-after-free after deregistration
	mmc: sdhci-msm: fix issue with power irq
	usb: phy: tahvo: fix error handling in tahvo_usb_probe()
	serial: 8250: Preserve DLD[7:4] for PORT_XR17V35X
	x86/entry: Use SYSCALL_DEFINE() macros for sys_modify_ldt()
	EDAC, sb_edac: Fix missing break in switch
	sysrq : fix Show Regs call trace on ARM
	usbip: tools: Install all headers needed for libusbip development
	perf test attr: Fix ignored test case result
	kprobes/x86: Disable preemption in ftrace-based jprobes
	tools include: Do not use poison with C++
	iio: adc: ti-ads1015: add 10% to conversion wait time
	dax: Avoid page invalidation races and unnecessary radix tree traversals
	net/mlx4_en: Fix type mismatch for 32-bit systems
	l2tp: take remote address into account in l2tp_ip and l2tp_ip6 socket lookups
	dmaengine: stm32-dma: Set correct args number for DMA request from DT
	dmaengine: stm32-dma: Fix null pointer dereference in stm32_dma_tx_status
	usb: gadget: f_fs: Fix ExtCompat descriptor validation
	libcxgb: fix error check for ip6_route_output()
	net: systemport: Utilize skb_put_padto()
	net: systemport: Pad packet before inserting TSB
	ARM: OMAP2+: Fix WL1283 Bluetooth Baud Rate
	ARM: OMAP1: DMA: Correct the number of logical channels
	vti6: fix device register to report IFLA_INFO_KIND
	be2net: fix accesses to unicast list
	be2net: fix unicast list filling
	net/appletalk: Fix kernel memory disclosure
	libfs: Modify mount_pseudo_xattr to be clear it is not a userspace mount
	net: qrtr: Mark 'buf' as little endian
	mm: fix remote numa hits statistics
	mac80211: calculate min channel width correctly
	ravb: Remove Rx overflow log messages
	nfs: Don't take a reference on fl->fl_file for LOCK operation
	drm/exynos/decon5433: update shadow registers iff there are active windows
	drm/exynos/decon5433: set STANDALONE_UPDATE_F also if planes are disabled
	KVM: arm/arm64: Fix occasional warning from the timer work function
	mac80211: prevent skb/txq mismatch
	NFSv4: Fix client recovery when server reboots multiple times
	perf/x86/intel: Account interrupts for PEBS errors
	powerpc/mm: Fix memory hotplug BUG() on radix
	qla2xxx: Fix wrong IOCB type assumption
	drm/amdgpu: fix bug set incorrect value to vce register
	drm/exynos/decon5433: set STANDALONE_UPDATE_F on output enablement
	net: sctp: fix array overrun read on sctp_timer_tbl
	x86/fpu: Set the xcomp_bv when we fake up a XSAVES area
	drm/amdgpu: fix unload driver issue for virtual display
	mac80211: don't try to sleep in rate_control_rate_init()
	RDMA/qedr: Return success when not changing QP state
	RDMA/qedr: Fix RDMA CM loopback
	tipc: fix nametbl_lock soft lockup at module exit
	tipc: fix cleanup at module unload
	dmaengine: pl330: fix double lock
	tcp: correct memory barrier usage in tcp_check_space()
	i2c: i2c-cadence: Initialize configuration before probing devices
	nvmet: cancel fatal error and flush async work before free controller
	gtp: clear DF bit on GTP packet tx
	gtp: fix cross netns recv on gtp socket
	net: phy: micrel: KSZ8795 do not set SUPPORTED_[Asym_]Pause
	net: thunderx: avoid dereferencing xcv when NULL
	be2net: fix initial MAC setting
	vfio/spapr: Fix missing mutex unlock when creating a window
	mm: avoid returning VM_FAULT_RETRY from ->page_mkwrite handlers
	xen-netfront: Improve error handling during initialization
	cec: initiator should be the same as the destination for, poll
	xen-netback: vif counters from int/long to u64
	net: fec: fix multicast filtering hardware setup
	dma-buf/dma-fence: Extract __dma_fence_is_later()
	dma-buf/sw-sync: Fix the is-signaled test to handle u32 wraparound
	dma-buf/sw-sync: Prevent user overflow on timeline advance
	dma-buf/sw-sync: Reduce irqsave/irqrestore from known context
	dma-buf/sw-sync: sync_pt is private and of fixed size
	dma-buf/sw-sync: Fix locking around sync_timeline lists
	dma-buf/sw-sync: Use an rbtree to sort fences in the timeline
	dma-buf/sw_sync: move timeline_fence_ops around
	dma-buf/sw_sync: clean up list before signaling the fence
	dma-fence: Clear fence->status during dma_fence_init()
	dma-fence: Wrap querying the fence->status
	dma-fence: Introduce drm_fence_set_error() helper
	dma-buf/sw_sync: force signal all unsignaled fences on dying timeline
	dma-buf/sync_file: hold reference to fence when creating sync_file
	dma-buf: Update kerneldoc for sync_file_create
	usb: hub: Cycle HUB power when initialization fails
	usb: xhci: fix panic in xhci_free_virt_devices_depth_first
	USB: core: Add type-specific length check of BOS descriptors
	USB: Increase usbfs transfer limit
	USB: devio: Prevent integer overflow in proc_do_submiturb()
	USB: usbfs: Filter flags passed in from user space
	usb: host: fix incorrect updating of offset
	xen-netfront: avoid crashing on resume after a failure in talk_to_netback()
	Linux 4.9.68

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2017-12-10 17:13:13 +01:00
Masakazu Mokuno
05ffc7ed55 USB: core: Add type-specific length check of BOS descriptors 
commit 81cf4a45360f70528f1f64ba018d61cb5767249a upstream.

As most of BOS descriptors are longer in length than their header
'struct usb_dev_cap_header', comparing solely with it is not sufficient
to avoid out-of-bounds access to BOS descriptors.

This patch adds descriptor type specific length check in
usb_get_bos_descriptor() to fix the issue.

Signed-off-by: Masakazu Mokuno <masakazu.mokuno@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2017-12-09 22:01:56 +01:00
Sriharsha Allenki
548380aa28 usb: gadget: uvc: Add support for UVC 1.5 
Add UVC 1.5 specification support for the existing
peripheral UVC function driver.
Also add support for H264 format streaming.

Change-Id: I3efe7db77793990ce76af7dcc566f91daeb05436
Signed-off-by: Sriharsha Allenki <sallenki@codeaurora.org>
 2017-11-22 16:27:42 +05:30
Kyle Yan
1bca48ef39 Merge remote-tracking branch '4.9/tmp-05a906d' into msm-4.9 
* 4.9/tmp-05a906d:
  Linux 4.9.56
  Revert "socket, bpf: fix possible use after free"
  Linux 4.9.55
  KVM: x86: fix singlestepping over syscall
  f2fs: don't allow encrypted operations without keys
  ext4: don't allow encrypted operations without keys
  ext4: Don't clear SGID when inheriting ACLs
  ext4: fix data corruption for mmap writes
  vfs: deny copy_file_range() for non regular files
  sched/cpuset/pm: Fix cpuset vs. suspend-resume bugs
  mmc: core: add driver strength selection when selecting hs400es
  nvme-pci: Use PCI bus address for data/queues in CMB
  drm/i915/bios: ignore HDMI on port A
  brcmfmac: setup passive scan if requested by user-space
  brcmfmac: add length check in brcmf_cfg80211_escan_handler()
  scsi: sd: Do not override max_sectors_kb sysfs setting
  iwlwifi: add workaround to disable wide channels in 5GHz
  iwlwifi: mvm: use IWL_HCMD_NOCOPY for MCAST_FILTER_CMD
  netlink: fix nla_put_{u8,u16,u32} for KASAN
  rocker: fix rocker_tlv_put_* functions for KASAN
  HID: wacom: bits shifted too much for 9th and 10th buttons
  HID: wacom: Always increment hdev refcount within wacom_get_hdev_data
  HID: wacom: leds: Don't try to control the EKR's read-only LEDs
  HID: i2c-hid: allocate hid buffers for real worst case
  ftrace: Fix kmemleak in unregister_ftrace_graph
  stm class: Fix a use-after-free
  Drivers: hv: fcopy: restore correct transfer length
  driver core: platform: Don't read past the end of "driver_override" buffer
  percpu: make this_cpu_generic_read() atomic w.r.t. interrupts
  powerpc/tm: Fix illegal TM state in signal handler
  powerpc/64s: Use emergency stack for kernel TM Bad Thing program checks
  socket, bpf: fix possible use after free
  net: rtnetlink: fix info leak in RTM_GETSTATS call
  tipc: use only positive error codes in messages
  ip6_tunnel: update mtu properly for ARPHRD_ETHER tunnel device in tx path
  ip6_gre: ip6gre_tap device should keep dst
  netlink: do not proceed if dump's start() errs
  net: Set sk_prot_creator when cloning sockets to the right proto
  packet: only test po->has_vnet_hdr once in packet_snd
  packet: in packet_do_bind, test fanout with bind_lock held
  net: dsa: Fix network device registration order
  tun: bail out from tun_get_user() if the skb is empty
  l2tp: fix race condition in l2tp_tunnel_delete
  l2tp: Avoid schedule while atomic in exit_net
  vti: fix use after free in vti_tunnel_xmit/vti6_tnl_xmit
  net: qcom/emac: specify the correct size when mapping a DMA buffer
  net_sched: always reset qdisc backlog in qdisc_reset()
  isdn/i4l: fetch the ppp_write buffer in one shot
  bpf: one perf event close won't free bpf program attached by another perf event
  packet: hold bind lock when rebinding to fanout hook
  net: emac: Fix napi poll list corruption
  tcp: fastopen: fix on syn-data transmit failure
  net/sched: cls_matchall: fix crash when used with classful qdisc
  ip6_tunnel: do not allow loading ip6_tunnel if ipv6 is disabled in cmdline
  net: phy: Fix mask value write on gmii2rgmii converter speed register
  ip6_gre: skb_push ipv6hdr before packing the header in ip6gre_header
  udpv6: Fix the checksum computation when HW checksum does not apply
  tcp: fix data delivery rate
  bpf/verifier: reject BPF_ALU64|BPF_END
  tcp: update skb->skb_mstamp more carefully
  sctp: potential read out of bounds in sctp_ulpevent_type_enabled()
  net: sched: fix use-after-free in tcf_action_destroy and tcf_del_walker
  mlxsw: spectrum: Prevent mirred-related crash on removal
  ALSA: usx2y: Suppress kernel warning at page allocation failures
  Revert "ALSA: echoaudio: purge contradictions between dimension matrix members and total number of members"
  ALSA: compress: Remove unused variable
  lsm: fix smack_inode_removexattr and xattr_getsecurity memleak
  lib/ratelimit.c: use deferred printk() version
  mm, oom_reaper: skip mm structs with mmu notifiers
  staging: vchiq_2835_arm: Fix NULL ptr dereference in free_pagelist
  uwb: ensure that endpoint is interrupt
  uwb: properly check kthread_run return value
  iio: adc: mcp320x: Fix oops on module unload
  iio: adc: mcp320x: Fix readout of negative voltages
  iio: ad7793: Fix the serial interface reset
  IIO: BME280: Updates to Humidity readings need ctrl_reg write!
  iio: core: Return error for failed read_reg
  staging: iio: ad7192: Fix - use the dedicated reset function avoiding dma from stack.
  iio: ad_sigma_delta: Implement a dedicated reset function
  iio: adc: twl4030: Disable the vusb3v1 rugulator in the error handling path of 'twl4030_madc_probe()'
  iio: adc: twl4030: Fix an error handling path in 'twl4030_madc_probe()'
  Revert "xhci: Limit USB2 port wake support for AMD Promontory hosts"
  xhci: set missing SuperSpeedPlus Link Protocol bit in roothub descriptor
  xhci: Fix sleeping with spin_lock_irq() held in ASmedia 1042A workaround
  xhci: fix finding correct bus_state structure for USB 3.1 hosts
  USB: fix out-of-bounds in usb_set_configuration
  usb: Increase quirk delay for USB devices
  USB: core: harden cdc_parse_cdc_header
  USB: uas: fix bug in handling of alternate settings
  USB: g_mass_storage: Fix deadlock when driver is unbound
  usb: gadget: mass_storage: set msg_registered after msg registered
  USB: devio: Don't corrupt user memory
  USB: dummy-hcd: Fix erroneous synchronization change
  USB: dummy-hcd: fix infinite-loop resubmission bug
  USB: dummy-hcd: fix connection failures (wrong speed)
  USB: cdc-wdm: ignore -EPIPE from GetEncapsulatedResponse
  usb: pci-quirks.c: Corrected timeout values used in handshake
  ALSA: usb-audio: Check out-of-bounds access by corrupted buffer descriptor
  usb: renesas_usbhs: fix usbhsf_fifo_clear() for RX direction
  usb: renesas_usbhs: fix the BCLR setting condition for non-DCP pipe
  usb-storage: fix bogus hardware error messages for ATA pass-thru devices
  usb-storage: unusual_devs entry to fix write-access regression for Seagate external drives
  usb: gadget: udc: renesas_usb3: Fix return value of usb3_write_pipe()
  usb: gadget: udc: renesas_usb3: fix Pn_RAMMAP.Pn_MPKT value
  usb: gadget: udc: renesas_usb3: fix for no-data control transfer
  usb: gadget: udc: atmel: set vbus irqflags explicitly
  USB: gadgetfs: fix copy_to_user while holding spinlock
  USB: gadgetfs: Fix crash caused by inadequate synchronization
  Linux 4.9.54
  s390/mm: make pmdp_invalidate() do invalidation only
  ttpci: address stringop overflow warning
  ALSA: au88x0: avoid theoretical uninitialized access
  ASoC: rt5660: remove double const
  ASoC: rt5659: drop double const
  ASoC: rt5514: fix gcc-7 warning
  ARM: remove duplicate 'const' annotations'
  IB/qib: fix false-postive maybe-uninitialized warning
  tools/power turbostat: bugfix: GFXMHz column not changing
  ARM: dts: BCM5301X: Fix memory start address
  libata: transport: Remove circular dependency at free time
  ASoC: wm_adsp: Return an error on write to a disabled volatile control
  xfs: remove kmem_zalloc_greedy
  i2c: meson: fix wrong variable usage in meson_i2c_put_data
  netfilter: nf_tables: set pktinfo->thoff at AH header if found
  md/raid10: submit bio directly to replacement disk
  rds: ib: add error handle
  mm/cgroup: avoid panic when init with low memory
  iommu/io-pgtable-arm: Check for leaf entry before dereferencing it
  x86/acpi: Restore the order of CPU IDs
  cpufreq: intel_pstate: Update pid_params.sample_rate_ns in pid_param_set()
  ibmvnic: Free tx/rx scrq pointer array when releasing sub-crqs
  nfs: make nfs4_cb_sv_ops static
  parisc: perf: Fix potential NULL pointer dereference
  netfilter: nfnl_cthelper: fix incorrect helper->expect_class_max
  nvme-rdma: handle cpu unplug when re-establishing the controller
  MIPS: smp-cps: Fix retrieval of VPE mask on big endian CPUs
  exynos-gsc: Do not swap cb/cr for semi planar formats
  iommu/exynos: Block SYSMMU while invalidating FLPD cache
  MIPS: IRQ Stack: Unwind IRQ stack onto task stack
  netfilter: invoke synchronize_rcu after set the _hook_ to NULL
  drivers/rapidio/devices/tsi721.c: make module parameter variable name unique
  kasan: do not sanitize kexec purgatory
  hugetlbfs: initialize shared policy as part of inode allocation
  sata_via: Enable hotplug only on VT6421
  Btrfs: fix potential use-after-free for cloned bio
  Btrfs: fix segmentation fault when doing dio read
  bridge: netlink: register netdevice before executing changelink
  mmc: sdio: fix alignment issue in struct sdio_func
  qed: Fix possible system hang in the dcbnl-getdcbx() path.
  net: dsa: b53: Include IMP/CPU port in dumb forwarding mode
  udp: disable inner UDP checksum offloads in IPsec case
  usb: plusb: Add support for PL-27A1
  team: fix memory leaks
  net/packet: check length in getsockopt() called with PACKET_HDRLEN
  net: core: Prevent from dereferencing null pointer when releasing SKB
  lkdtm: Fix Oops when unloading the module
  mips: ath79: clock:- Unmap region obtained by of_iomap
  MIPS: Lantiq: Fix another request_mem_region() return code check
  HID: wacom: release the resources before leaving despite devm
  drm: mali-dp: Fix transposed horizontal/vertical flip
  drm: mali-dp: Fix destination size handling when rotating
  ASoC: dapm: fix some pointer error handling
  rtl8xxxu: Add additional USB IDs for rtl8192eu devices
  usb: chipidea: vbus event may exist before starting gadget
  iommu/arm-smmu: Set privileged attribute to 'default' instead of 'unprivileged'
  spi: pxa2xx: Add support for Intel Gemini Lake
  ath10k: prevent sta pointer rcu violation
  audit: log 32-bit socketcalls
  ASoC: dapm: handle probe deferrals
  partitions/efi: Fix integer overflow in GPT size calculation
  sfc: get PIO buffer size from the NIC
  USB: serial: mos7840: fix control-message error handling
  USB: serial: mos7720: fix control-message error handling
  drm/amdkfd: fix improper return value on error
  arm: dts: mt2701: Add subsystem clock controller device nodes
  IB/ipoib: Replace list_del of the neigh->list with list_del_init
  IB/ipoib: rtnl_unlock can not come after free_netdev
  IB/ipoib: Fix deadlock over vlan_mutex
  serial: 8250_port: Remove dangerous pr_debug()
  tty: goldfish: Fix a parameter of a call to free_irq
  serial: 8250: moxa: Store num_ports in brd
  drm/i915/psr: disable psr2 for resolution greater than 32X20
  ARM: 8635/1: nommu: allow enabling REMAP_VECTORS_TO_RAM
  IB/rxe: Fix a MR reference leak in check_rkey()
  IB/rxe: Add a runtime check in alloc_index()
  iio: adc: hx711: Add DT binding for avia,hx711
  iio: adc: axp288: Drop bogus AXP288_ADC_TS_PIN_CTRL register modifications
  iio: adc: imx25-gcq: Fix module autoload
  hwmon: (gl520sm) Fix overflows and crash seen when writing into limit attributes
  usb: make the MTK XHCI driver compile for older MIPS SoCs
  clk/axs10x: Clear init field in driver probe
  sh_eth: use correct name for ECMR_MPDE bit
  reset: ti_syscon: fix a ti_syscon_reset_status issue
  extcon: axp288: Use vbus-valid instead of -present to determine cable presence
  igb: re-assign hw address pointer on reset after PCI error
  ARM: dts: am335x-chilisom: Wakeup from RTC-only state by power on event
  scsi: be2iscsi: Add checks to validate CID alloc/free
  power: supply: axp288_fuel_gauge: Fix fuel_gauge_reg_readb return on error
  MIPS: ralink: Fix incorrect assignment on ralink_soc
  MIPS: ralink: Fix a typo in the pinmux setup.
  MIPS: Ensure bss section ends on a long-aligned address
  ARM: dts: r8a7790: Use R-Car Gen 2 fallback binding for msiof nodes
  RDS: RDMA: Fix the composite message user notification
  clk: sunxi-ng: fix PLL_CPUX adjusting on H3
  ARM: dts: exynos: Add CPU OPPs for Exynos4412 Prime
  drm/i915: Fix the overlay frontbuffer tracking
  GFS2: Fix reference to ERR_PTR in gfs2_glock_iter_next
  drm: bridge: add DT bindings for TI ths8135
  drm_fourcc: Fix DRM_FORMAT_MOD_LINEAR #define
  FROMLIST: binder: fix use-after-free in binder_transaction()
  FROMLIST: binder: fix an ret value override
  FROMLIST: binder: fix memory corruption in binder_transaction binder

Conflicts:
	mm/oom_kill.c
	sound/usb/card.c

Change-Id: I8b32fbdaa2be959a4149cf07d0bda16b75eeacbc
Signed-off-by: Kyle Yan <kyan@codeaurora.org>
 2017-10-19 12:05:22 -07:00
Greg Kroah-Hartman
f931a27161 Merge 4.9.55 into android-4.9-o 
Changes in 4.9.55
	USB: gadgetfs: Fix crash caused by inadequate synchronization
	USB: gadgetfs: fix copy_to_user while holding spinlock
	usb: gadget: udc: atmel: set vbus irqflags explicitly
	usb: gadget: udc: renesas_usb3: fix for no-data control transfer
	usb: gadget: udc: renesas_usb3: fix Pn_RAMMAP.Pn_MPKT value
	usb: gadget: udc: renesas_usb3: Fix return value of usb3_write_pipe()
	usb-storage: unusual_devs entry to fix write-access regression for Seagate external drives
	usb-storage: fix bogus hardware error messages for ATA pass-thru devices
	usb: renesas_usbhs: fix the BCLR setting condition for non-DCP pipe
	usb: renesas_usbhs: fix usbhsf_fifo_clear() for RX direction
	ALSA: usb-audio: Check out-of-bounds access by corrupted buffer descriptor
	usb: pci-quirks.c: Corrected timeout values used in handshake
	USB: cdc-wdm: ignore -EPIPE from GetEncapsulatedResponse
	USB: dummy-hcd: fix connection failures (wrong speed)
	USB: dummy-hcd: fix infinite-loop resubmission bug
	USB: dummy-hcd: Fix erroneous synchronization change
	USB: devio: Don't corrupt user memory
	usb: gadget: mass_storage: set msg_registered after msg registered
	USB: g_mass_storage: Fix deadlock when driver is unbound
	USB: uas: fix bug in handling of alternate settings
	USB: core: harden cdc_parse_cdc_header
	usb: Increase quirk delay for USB devices
	USB: fix out-of-bounds in usb_set_configuration
	xhci: fix finding correct bus_state structure for USB 3.1 hosts
	xhci: Fix sleeping with spin_lock_irq() held in ASmedia 1042A workaround
	xhci: set missing SuperSpeedPlus Link Protocol bit in roothub descriptor
	Revert "xhci: Limit USB2 port wake support for AMD Promontory hosts"
	iio: adc: twl4030: Fix an error handling path in 'twl4030_madc_probe()'
	iio: adc: twl4030: Disable the vusb3v1 rugulator in the error handling path of 'twl4030_madc_probe()'
	iio: ad_sigma_delta: Implement a dedicated reset function
	staging: iio: ad7192: Fix - use the dedicated reset function avoiding dma from stack.
	iio: core: Return error for failed read_reg
	IIO: BME280: Updates to Humidity readings need ctrl_reg write!
	iio: ad7793: Fix the serial interface reset
	iio: adc: mcp320x: Fix readout of negative voltages
	iio: adc: mcp320x: Fix oops on module unload
	uwb: properly check kthread_run return value
	uwb: ensure that endpoint is interrupt
	staging: vchiq_2835_arm: Fix NULL ptr dereference in free_pagelist
	mm, oom_reaper: skip mm structs with mmu notifiers
	lib/ratelimit.c: use deferred printk() version
	lsm: fix smack_inode_removexattr and xattr_getsecurity memleak
	ALSA: compress: Remove unused variable
	Revert "ALSA: echoaudio: purge contradictions between dimension matrix members and total number of members"
	ALSA: usx2y: Suppress kernel warning at page allocation failures
	mlxsw: spectrum: Prevent mirred-related crash on removal
	net: sched: fix use-after-free in tcf_action_destroy and tcf_del_walker
	sctp: potential read out of bounds in sctp_ulpevent_type_enabled()
	tcp: update skb->skb_mstamp more carefully
	bpf/verifier: reject BPF_ALU64|BPF_END
	tcp: fix data delivery rate
	udpv6: Fix the checksum computation when HW checksum does not apply
	ip6_gre: skb_push ipv6hdr before packing the header in ip6gre_header
	net: phy: Fix mask value write on gmii2rgmii converter speed register
	ip6_tunnel: do not allow loading ip6_tunnel if ipv6 is disabled in cmdline
	net/sched: cls_matchall: fix crash when used with classful qdisc
	tcp: fastopen: fix on syn-data transmit failure
	net: emac: Fix napi poll list corruption
	packet: hold bind lock when rebinding to fanout hook
	bpf: one perf event close won't free bpf program attached by another perf event
	isdn/i4l: fetch the ppp_write buffer in one shot
	net_sched: always reset qdisc backlog in qdisc_reset()
	net: qcom/emac: specify the correct size when mapping a DMA buffer
	vti: fix use after free in vti_tunnel_xmit/vti6_tnl_xmit
	l2tp: Avoid schedule while atomic in exit_net
	l2tp: fix race condition in l2tp_tunnel_delete
	tun: bail out from tun_get_user() if the skb is empty
	net: dsa: Fix network device registration order
	packet: in packet_do_bind, test fanout with bind_lock held
	packet: only test po->has_vnet_hdr once in packet_snd
	net: Set sk_prot_creator when cloning sockets to the right proto
	netlink: do not proceed if dump's start() errs
	ip6_gre: ip6gre_tap device should keep dst
	ip6_tunnel: update mtu properly for ARPHRD_ETHER tunnel device in tx path
	tipc: use only positive error codes in messages
	net: rtnetlink: fix info leak in RTM_GETSTATS call
	socket, bpf: fix possible use after free
	powerpc/64s: Use emergency stack for kernel TM Bad Thing program checks
	powerpc/tm: Fix illegal TM state in signal handler
	percpu: make this_cpu_generic_read() atomic w.r.t. interrupts
	driver core: platform: Don't read past the end of "driver_override" buffer
	Drivers: hv: fcopy: restore correct transfer length
	stm class: Fix a use-after-free
	ftrace: Fix kmemleak in unregister_ftrace_graph
	HID: i2c-hid: allocate hid buffers for real worst case
	HID: wacom: leds: Don't try to control the EKR's read-only LEDs
	HID: wacom: Always increment hdev refcount within wacom_get_hdev_data
	HID: wacom: bits shifted too much for 9th and 10th buttons
	rocker: fix rocker_tlv_put_* functions for KASAN
	netlink: fix nla_put_{u8,u16,u32} for KASAN
	iwlwifi: mvm: use IWL_HCMD_NOCOPY for MCAST_FILTER_CMD
	iwlwifi: add workaround to disable wide channels in 5GHz
	scsi: sd: Do not override max_sectors_kb sysfs setting
	brcmfmac: add length check in brcmf_cfg80211_escan_handler()
	brcmfmac: setup passive scan if requested by user-space
	drm/i915/bios: ignore HDMI on port A
	nvme-pci: Use PCI bus address for data/queues in CMB
	mmc: core: add driver strength selection when selecting hs400es
	sched/cpuset/pm: Fix cpuset vs. suspend-resume bugs
	vfs: deny copy_file_range() for non regular files
	ext4: fix data corruption for mmap writes
	ext4: Don't clear SGID when inheriting ACLs
	ext4: don't allow encrypted operations without keys
	f2fs: don't allow encrypted operations without keys
	KVM: x86: fix singlestepping over syscall
	Linux 4.9.55

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2017-10-12 22:54:16 +02:00
Greg Kroah-Hartman
cdbe07ad26 Merge 4.9.55 into android-4.9 
Changes in 4.9.55
	USB: gadgetfs: Fix crash caused by inadequate synchronization
	USB: gadgetfs: fix copy_to_user while holding spinlock
	usb: gadget: udc: atmel: set vbus irqflags explicitly
	usb: gadget: udc: renesas_usb3: fix for no-data control transfer
	usb: gadget: udc: renesas_usb3: fix Pn_RAMMAP.Pn_MPKT value
	usb: gadget: udc: renesas_usb3: Fix return value of usb3_write_pipe()
	usb-storage: unusual_devs entry to fix write-access regression for Seagate external drives
	usb-storage: fix bogus hardware error messages for ATA pass-thru devices
	usb: renesas_usbhs: fix the BCLR setting condition for non-DCP pipe
	usb: renesas_usbhs: fix usbhsf_fifo_clear() for RX direction
	ALSA: usb-audio: Check out-of-bounds access by corrupted buffer descriptor
	usb: pci-quirks.c: Corrected timeout values used in handshake
	USB: cdc-wdm: ignore -EPIPE from GetEncapsulatedResponse
	USB: dummy-hcd: fix connection failures (wrong speed)
	USB: dummy-hcd: fix infinite-loop resubmission bug
	USB: dummy-hcd: Fix erroneous synchronization change
	USB: devio: Don't corrupt user memory
	usb: gadget: mass_storage: set msg_registered after msg registered
	USB: g_mass_storage: Fix deadlock when driver is unbound
	USB: uas: fix bug in handling of alternate settings
	USB: core: harden cdc_parse_cdc_header
	usb: Increase quirk delay for USB devices
	USB: fix out-of-bounds in usb_set_configuration
	xhci: fix finding correct bus_state structure for USB 3.1 hosts
	xhci: Fix sleeping with spin_lock_irq() held in ASmedia 1042A workaround
	xhci: set missing SuperSpeedPlus Link Protocol bit in roothub descriptor
	Revert "xhci: Limit USB2 port wake support for AMD Promontory hosts"
	iio: adc: twl4030: Fix an error handling path in 'twl4030_madc_probe()'
	iio: adc: twl4030: Disable the vusb3v1 rugulator in the error handling path of 'twl4030_madc_probe()'
	iio: ad_sigma_delta: Implement a dedicated reset function
	staging: iio: ad7192: Fix - use the dedicated reset function avoiding dma from stack.
	iio: core: Return error for failed read_reg
	IIO: BME280: Updates to Humidity readings need ctrl_reg write!
	iio: ad7793: Fix the serial interface reset
	iio: adc: mcp320x: Fix readout of negative voltages
	iio: adc: mcp320x: Fix oops on module unload
	uwb: properly check kthread_run return value
	uwb: ensure that endpoint is interrupt
	staging: vchiq_2835_arm: Fix NULL ptr dereference in free_pagelist
	mm, oom_reaper: skip mm structs with mmu notifiers
	lib/ratelimit.c: use deferred printk() version
	lsm: fix smack_inode_removexattr and xattr_getsecurity memleak
	ALSA: compress: Remove unused variable
	Revert "ALSA: echoaudio: purge contradictions between dimension matrix members and total number of members"
	ALSA: usx2y: Suppress kernel warning at page allocation failures
	mlxsw: spectrum: Prevent mirred-related crash on removal
	net: sched: fix use-after-free in tcf_action_destroy and tcf_del_walker
	sctp: potential read out of bounds in sctp_ulpevent_type_enabled()
	tcp: update skb->skb_mstamp more carefully
	bpf/verifier: reject BPF_ALU64|BPF_END
	tcp: fix data delivery rate
	udpv6: Fix the checksum computation when HW checksum does not apply
	ip6_gre: skb_push ipv6hdr before packing the header in ip6gre_header
	net: phy: Fix mask value write on gmii2rgmii converter speed register
	ip6_tunnel: do not allow loading ip6_tunnel if ipv6 is disabled in cmdline
	net/sched: cls_matchall: fix crash when used with classful qdisc
	tcp: fastopen: fix on syn-data transmit failure
	net: emac: Fix napi poll list corruption
	packet: hold bind lock when rebinding to fanout hook
	bpf: one perf event close won't free bpf program attached by another perf event
	isdn/i4l: fetch the ppp_write buffer in one shot
	net_sched: always reset qdisc backlog in qdisc_reset()
	net: qcom/emac: specify the correct size when mapping a DMA buffer
	vti: fix use after free in vti_tunnel_xmit/vti6_tnl_xmit
	l2tp: Avoid schedule while atomic in exit_net
	l2tp: fix race condition in l2tp_tunnel_delete
	tun: bail out from tun_get_user() if the skb is empty
	net: dsa: Fix network device registration order
	packet: in packet_do_bind, test fanout with bind_lock held
	packet: only test po->has_vnet_hdr once in packet_snd
	net: Set sk_prot_creator when cloning sockets to the right proto
	netlink: do not proceed if dump's start() errs
	ip6_gre: ip6gre_tap device should keep dst
	ip6_tunnel: update mtu properly for ARPHRD_ETHER tunnel device in tx path
	tipc: use only positive error codes in messages
	net: rtnetlink: fix info leak in RTM_GETSTATS call
	socket, bpf: fix possible use after free
	powerpc/64s: Use emergency stack for kernel TM Bad Thing program checks
	powerpc/tm: Fix illegal TM state in signal handler
	percpu: make this_cpu_generic_read() atomic w.r.t. interrupts
	driver core: platform: Don't read past the end of "driver_override" buffer
	Drivers: hv: fcopy: restore correct transfer length
	stm class: Fix a use-after-free
	ftrace: Fix kmemleak in unregister_ftrace_graph
	HID: i2c-hid: allocate hid buffers for real worst case
	HID: wacom: leds: Don't try to control the EKR's read-only LEDs
	HID: wacom: Always increment hdev refcount within wacom_get_hdev_data
	HID: wacom: bits shifted too much for 9th and 10th buttons
	rocker: fix rocker_tlv_put_* functions for KASAN
	netlink: fix nla_put_{u8,u16,u32} for KASAN
	iwlwifi: mvm: use IWL_HCMD_NOCOPY for MCAST_FILTER_CMD
	iwlwifi: add workaround to disable wide channels in 5GHz
	scsi: sd: Do not override max_sectors_kb sysfs setting
	brcmfmac: add length check in brcmf_cfg80211_escan_handler()
	brcmfmac: setup passive scan if requested by user-space
	drm/i915/bios: ignore HDMI on port A
	nvme-pci: Use PCI bus address for data/queues in CMB
	mmc: core: add driver strength selection when selecting hs400es
	sched/cpuset/pm: Fix cpuset vs. suspend-resume bugs
	vfs: deny copy_file_range() for non regular files
	ext4: fix data corruption for mmap writes
	ext4: Don't clear SGID when inheriting ACLs
	ext4: don't allow encrypted operations without keys
	f2fs: don't allow encrypted operations without keys
	KVM: x86: fix singlestepping over syscall
	Linux 4.9.55

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2017-10-12 22:31:24 +02:00
Greg Kroah-Hartman
a6d4ce2e8b USB: fix out-of-bounds in usb_set_configuration 
commit bd7a3fe770ebd8391d1c7d072ff88e9e76d063eb upstream.

Andrey Konovalov reported a possible out-of-bounds problem for a USB interface
association descriptor.  He writes:
	It seems there's no proper size check of a USB_DT_INTERFACE_ASSOCIATION
	descriptor. It's only checked that the size is >= 2 in
	usb_parse_configuration(), so find_iad() might do out-of-bounds access
	to intf_assoc->bInterfaceCount.

And he's right, we don't check for crazy descriptors of this type very well, so
resolve this problem.  Yet another issue found by syzkaller...

Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2017-10-12 11:51:17 +02:00
Hemant Kumar
4abd5e5e78 usb: core: Add support to parse config summary capability descriptors 
This descriptor describes the list of functions present in a given
configuration. There should be one such descriptor per configuration
supported by the device. The order in which these descriptors appear
in the BOS descriptor reflects the order of preference of configurations
as desired by the device for optimal functionality. Configuration Summary
descriptors are used by Host software to decide which Configuration to set
to obtain the desired functionality.

Change-Id: I7ec095ce19caa690c0d3dc0fdd3add5ad37a74f3
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
 2017-07-25 10:48:16 -07:00
Kyle Yan
2506cb5328 Merge remote-tracking branch '4.9/tmp-75d78c7' into 4.9 
* 4.9/tmp-75d78c7:
  Linux 4.9.35
  brcmfmac: fix uninitialized warning in brcmf_usb_probe_phase2()
  jump label: fix passing kbuild_cflags when checking for asm goto support
  net: phy: fix marvell phy status reading
  spi: double time out tolerance
  dmaengine: bcm2835: Fix cyclic DMA period splitting
  net: phy: Initialize mdio clock at probe function
  rt2x00: avoid introducing a USB dependency in the rt2x00lib module
  usb: gadget: f_fs: avoid out of bounds access on comp_desc
  mtd: spi-nor: fix spansion quad enable
  of: Add check to of_scan_flat_dt() before accessing initial_boot_params
  rxrpc: Fix several cases where a padded len isn't checked in ticket decode
  drm/amdgpu: adjust default display clock
  drm/amdgpu/atom: fix ps allocation size for EnableDispPowerGating
  drm/radeon: add a quirk for Toshiba Satellite L20-183
  drm/radeon: add a PX quirk for another K53TK variant
  iscsi-target: Reject immediate data underflow larger than SCSI transfer length
  iscsi-target: Fix delayed logout processing greater than SECONDS_FOR_LOGOUT_COMP
  target: Fix kref->refcount underflow in transport_cmd_finish_abort
  arm64/vdso: Fix nsec handling for CLOCK_MONOTONIC_RAW
  time: Fix CLOCK_MONOTONIC_RAW sub-nanosecond accounting
  time: Fix clock->read(clock) race around clocksource changes
  brcmfmac: unbind all devices upon failure in firmware callback
  brcmfmac: use firmware callback upon failure to load
  brcmfmac: add parameter to pass error code in firmware callback
  Input: i8042 - add Fujitsu Lifebook AH544 to notimeout list
  powerpc/64s: Handle data breakpoints in Radix mode
  powerpc/kprobes: Pause function_graph tracing during jprobes handling
  signal: Only reschedule timers on signals timers have sent
  HID: Add quirk for Dell PIXART OEM mouse
  cxgb4: notify uP to route ctrlq compl to rdma rspq
  CIFS: Improve readdir verbosity
  KVM: PPC: Book3S HV: Context-switch EBB registers properly
  KVM: PPC: Book3S HV: Preserve userspace HTM state properly
  KVM: s390: gaccess: fix real-space designation asce handling for gmap shadows
  perf/x86/intel: Add 1G DTLB load/store miss support for SKL
  lib/cmdline.c: fix get_options() overflow while parsing ranges
  autofs: sanity check status reported with AUTOFS_DEV_IOCTL_FAIL
  powerpc/perf: Fix oops when kthread execs user process
  fs/exec.c: account for argv/envp pointers
  ALSA: pcm: Don't treat NULL chmap as a fatal error
  ALSA: firewire-lib: Fix stall of process context at packet error
  xen-blkback: don't leak stack data via response ring
  xen/blkback: fix disconnect while I/Os in flight
  clk: sunxi-ng: a31: Correct lcd1-ch1 clock register offset
  Revert "ANDROID: hardlockup: detect hard lockups without NMIs using secondary cpus"
  Revert "ANDROID: kernel/watchdog: fix unused variable warning"
  UPSTREAM: usb: gadget: f_fs: avoid out of bounds access on comp_desc
  Linux 4.9.34
  mm: fix new crash in unmapped_area_topdown()
  Allow stack to grow up to address space limit
  mm: larger stack guard gap, between vmas
  alarmtimer: Rate limit periodic intervals
  crypto: Work around deallocated stack frame reference gcc bug on sparc.
  vTPM: Fix missing NULL check
  MIPS: .its targets depend on vmlinux
  MIPS: Fix bnezc/jialc return address calculation
  usb: dwc3: exynos fix axius clock error path to do cleanup
  usb: gadget: composite: Fix function used to free memory
  alarmtimer: Prevent overflow of relative timers
  genirq: Release resources in __setup_irq() error path
  sched/core: Idle_task_exit() shouldn't use switch_mm_irqs_off()
  iio: imu: inv_mpu6050: add accel lpf setting for chip >= MPU6500
  swap: cond_resched in swap_cgroup_prepare()
  mm/memory-failure.c: use compound_head() flags for huge pages
  USB: gadgetfs, dummy-hcd, net2280: fix locking for callbacks
  USB: gadget: fix GPF in gadgetfs
  usb: xhci: ASMedia ASM1042A chipset need shorts TX quirk
  usb: xhci: Fix USB 3.1 supported protocol parsing
  drivers/misc/c2port/c2port-duramar2150.c: checking for NULL instead of IS_ERR()
  misc: mic: double free on ioctl error path
  ath10k: fix napi crash during rmmod when probe firmware fails
  usb: r8a66597-hcd: decrease timeout
  usb: r8a66597-hcd: select a different endpoint on timeout
  USB: gadget: dummy_hcd: fix hub-descriptor removable fields
  pvrusb2: reduce stack usage pvr2_eeprom_analyze()
  USB: usbip: fix nonconforming hub descriptor
  usb: core: fix potential memory leak in error path during hcd creation
  USB: hub: fix SS max number of ports
  usb: gadget: udc: renesas_usb3: lock for PN_ registers access
  usb: gadget: udc: renesas_usb3: fix deadlock by spinlock
  usb: gadget: udc: renesas_usb3: fix pm_runtime functions calling
  IB/mlx5: Fix kernel to user leak prevention logic
  iio: adc: ti_am335x_adc: allocating too much in probe
  iio: proximity: as3935: recalibrate RCO after resume
  iio: st_pressure: Fix data sign
  staging: iio: tsl2x7x_core: Fix standard deviation calculation
  staging: rtl8188eu: prevent an underflow in rtw_check_beacon_data()
  mfd: omap-usb-tll: Fix inverted bit use for USB TLL mode
  x86/mm/32: Set the '__vmalloc_start_set' flag in initmem_init()
  serial: sh-sci: Fix late enablement of AUTORTS
  serial: efm32: Fix parity management in 'efm32_uart_console_get_options()'
  drm/vc4: Fix OOPSes from trying to cache a partially constructed BO.
  drm/mediatek: fix mtk_hdmi_setup_vendor_specific_infoframe mistake
  mac80211: don't send SMPS action frame in AP mode when not needed
  mac80211: fix dropped counter in multiqueue RX
  mac80211: strictly check mesh address extension mode
  mac80211: fix IBSS presp allocation size
  mac80211: fix packet statistics for fast-RX
  mac80211: fix CSA in IBSS mode
  usb: musb: dsps: keep VBUS on for host-only mode
  drm/i915: Fix GVT-g PVINFO version compatibility check
  drm/amdgpu: Fix overflow of watermark calcs at > 4k resolutions.
  mac80211/wpa: use constant time memory comparison for MACs
  mac80211: don't look at the PM bit of BAR frames
  vb2: Fix an off by one error in 'vb2_plane_vaddr'
  cpufreq: conservative: Allow down_threshold to take values from 1 to 10
  ila_xlat: add missing hash secret initialization
  can: gs_usb: fix memory leak in gs_cmd_reset()
  configfs: Fix race between create_link and configfs_rmdir
  fs: pass on flags in compat_writev
  ANDROID: sdcardfs: remove dead function open_flags_to_access_mode()
  ANDROID: android-base.cfg: split out arm64-specific configs
  Linux 4.9.33
  sparc64: make string buffers large enough
  drm/i915: Always recompute watermarks when distrust_bios_wm is set, v2.
  drm/i915: Workaround VLV/CHV DSI scanline counter hardware fail
  s390/kvm: do not rely on the ILC on kvm host protection fauls
  xtensa: don't use linux IRQ #0
  RDMA/qedr: Return max inline data in QP query result
  RDMA/qedr: Don't spam dmesg if QP is in error state
  RDMA/qedr: Don't reset QP when queues aren't flushed
  RDMA/qedr: Fix and simplify memory leak in PD alloc
  RDMA/qedr: Dispatch port active event from qedr_add
  netfilter: nft_log: restrict the log prefix length to 127
  netfilter: nf_tables: fix set->nelems counting with no NLM_F_EXCL
  tipc: fix nametbl_lock soft lockup at node/link events
  tipc: add subscription refcount to avoid invalid delete
  tipc: fix connection refcount error
  tipc: ignore requests when the connection state is not CONNECTED
  ARCv2: smp-boot: wake_flag polling by non-Masters needs to be uncached
  ARC: smp-boot: Decouple Non masters waiting API from jump to entry point
  vhost/vsock: handle vhost_vq_init_access() error
  kernel/watchdog: prevent false hardlockup on overloaded system
  kernel/watchdog.c: move shared definitions to nmi.h
  kernel/watchdog.c: move hardlockup detector to separate file
  userfaultfd: fix SIGBUS resulting from false rwsem wakeups
  proc: add a schedule point in proc_pid_readdir()
  frv: add missing atomic64 operations
  frv: add atomic64_add_unless()
  romfs: use different way to generate fsid for BLOCK or MTD
  mn10300: fix build error of missing fpu_save()
  usb: musb: Fix external abort on non-linefetch for musb_irq_work()
  sctp: sctp_addr_id2transport should verify the addr before looking up assoc
  sctp: sctp gso should set feature with NETIF_F_SG when calling skb_segment
  bnxt_en: Fix RTNL lock usage on bnxt_get_port_module_status().
  bnxt_en: Fix RTNL lock usage on bnxt_update_link().
  bnxt_en: Enhance autoneg support.
  bnxt_en: Fix bnxt_reset() in the slow path task.
  net-next: ethernet: mediatek: change the compatible string
  r8152: avoid start_xmit to schedule napi when napi is disabled
  r8152: fix rtl8152_post_reset function
  r8152: re-schedule napi for tx
  r8152: check rx after napi is enabled
  r8152: avoid start_xmit to call napi_schedule during autosuspend
  nvmet-rdma: Fix missing dma sync to nvme data structures
  nfs: Fix "Don't increment lock sequence ID after NFS4ERR_MOVED"
  ravb: unmap descriptors when freeing rings
  drm/ast: Fixed system hanged if disable P2A
  drm/nouveau: Fix drm poll_helper handling
  drm/nouveau: Don't enabling polling twice on runtime resume
  drm/nouveau: Handle fbcon suspend/resume in seperate worker
  drm/nouveau: Rename acpi_work to hpd_work
  drm/nouveau: Intercept ACPI_VIDEO_NOTIFY_PROBE
  gtp: add genl family modules alias
  net: phy: micrel: add support for KSZ8795
  parisc, parport_gsc: Fixes for printk continuation lines
  net/mlx5: Return EOPNOTSUPP when failing to get steering name-space
  net/mlx5: E-Switch, Err when retrieving steering name-space fails
  drm/i915: Check for NULL i915_vma in intel_unpin_fb_obj()
  net: adaptec: starfire: add checks for dma mapping errors
  pinctrl: berlin-bg4ct: fix the value for "sd1a" of pin SCRD0_CRD_PRES
  drm: Don't race connector registration
  drm: prevent double-(un)registration for connectors
  cec: fix wrong last_la determination
  pinctrl: baytrail: Rectify debounce support (part 2)
  gianfar: synchronize DMA API usage by free_skb_rx_queue w/ gfar_new_page
  net/mlx4_core: Avoid command timeouts during VF driver device shutdown
  drm/nouveau/fence/g84-: protect against concurrent access to semaphore buffers
  drm/nouveau: prevent userspace from deleting client object
  ipv6: fix flow labels when the traffic class is non-0
  FS-Cache: Initialise stores_lock in netfs cookie
  fscache: Clear outstanding writes when disabling a cookie
  fscache: Fix dead object requeue
  net: fix ndo_features_check/ndo_fix_features comment ordering
  net: phy: Fix PHY module checks and NULL deref in phy_attach_direct()
  net: phy: Fix lack of reference count on PHY driver
  ethtool: do not vzalloc(0) on registers dump
  log2: make order_base_2() behave correctly on const input value zero
  kasan: respect /proc/sys/kernel/traceoff_on_warning
  shmem: fix sleeping from atomic context
  jump label: pass kbuild_cflags when checking for asm goto support
  PM / runtime: Avoid false-positive warnings from might_sleep_if()
  ARM: defconfigs: make NF_CT_PROTO_SCTP and NF_CT_PROTO_UDPLITE built-in
  ipv6: Fix IPv6 packet loss in scenarios involving roaming + snooping switches
  vfio/spapr_tce: Set window when adding additional groups to container
  ipv6: addrconf: fix generation of new temporary addresses
  net: thunderx: Fix PHY autoneg for SGMII QLM mode
  kernel/ucount.c: mark user_header with kmemleak_ignore()
  powerpc/powernv: Properly set "host-ipi" on IPIs
  i2c: piix4: Fix request_region size
  i2c: piix4: Request the SMBUS semaphore inside the mutex
  sierra_net: Add support for IPv6 and Dual-Stack Link Sense Indications
  sierra_net: Skip validating irrelevant fields for IDLE LSIs
  net: hns: Fix the device being used for dma mapping during TX
  NET: mkiss: Fix panic
  ibmvnic: Initialize completion variables before starting work
  ibmvnic: Call napi_disable instead of napi_enable in failure path
  NET: Fix /proc/net/arp for AX.25
  gfs2: Use rhashtable walk interface in glock_hash_walk
  tipc: Fix tipc_sk_reinit race conditions
  ipv6: Inhibit IPv4-mapped src address on the wire.
  ipv6: Handle IPv4-mapped src to in6addr_any dst.
  tcp: tcp_probe: use spin_lock_bh()
  net: xilinx_emaclite: fix receive buffer overflow
  net: xilinx_emaclite: fix freezes due to unordered I/O
  ibmvnic: Fix endian error when requesting device capabilities
  ibmvnic: Fix endian errors in error reporting output
  netfilter: nf_conntrack_sip: fix wrong memory initialisation
  partitions/msdos: FreeBSD UFS2 file systems are not recognized
  drm/i915: Prevent the system suspend complete optimization
  PCI/PM: Add needs_resume flag to avoid suspend complete optimization
  usb: gadget: f_fs: Fix possibe deadlock
  FROMLIST: Remove the redundant skb->dev initialization in ip6_fragment
  FROMLIST: bpf: Remove duplicate tcp_filter hook in ipv6
  FROMLIST: ipv6: Initial skb->dev and skb->protocol in ip6_output
  FROMLIST: bpf: cgroup skb progs cannot access ld_abs/ind
  ANDROID: uid_sys_stats: check previous uid_entry before call find_or_register_uid

Conflicts:
	drivers/usb/gadget/function/f_fs.c
	kernel/watchdog.c

Change-Id: Ib91e6121cace8bcdc4dd8b1727792dd5bb6f1535
Signed-off-by: Kyle Yan <kyan@codeaurora.org>
 2017-07-05 13:17:33 -07:00
Greg Kroah-Hartman
7172a93a70 Merge 4.9.34 into android-4.9 
Changes in 4.9.34
	fs: pass on flags in compat_writev
	configfs: Fix race between create_link and configfs_rmdir
	can: gs_usb: fix memory leak in gs_cmd_reset()
	ila_xlat: add missing hash secret initialization
	cpufreq: conservative: Allow down_threshold to take values from 1 to 10
	vb2: Fix an off by one error in 'vb2_plane_vaddr'
	mac80211: don't look at the PM bit of BAR frames
	mac80211/wpa: use constant time memory comparison for MACs
	drm/amdgpu: Fix overflow of watermark calcs at > 4k resolutions.
	drm/i915: Fix GVT-g PVINFO version compatibility check
	usb: musb: dsps: keep VBUS on for host-only mode
	mac80211: fix CSA in IBSS mode
	mac80211: fix packet statistics for fast-RX
	mac80211: fix IBSS presp allocation size
	mac80211: strictly check mesh address extension mode
	mac80211: fix dropped counter in multiqueue RX
	mac80211: don't send SMPS action frame in AP mode when not needed
	drm/mediatek: fix mtk_hdmi_setup_vendor_specific_infoframe mistake
	drm/vc4: Fix OOPSes from trying to cache a partially constructed BO.
	serial: efm32: Fix parity management in 'efm32_uart_console_get_options()'
	serial: sh-sci: Fix late enablement of AUTORTS
	x86/mm/32: Set the '__vmalloc_start_set' flag in initmem_init()
	mfd: omap-usb-tll: Fix inverted bit use for USB TLL mode
	staging: rtl8188eu: prevent an underflow in rtw_check_beacon_data()
	staging: iio: tsl2x7x_core: Fix standard deviation calculation
	iio: st_pressure: Fix data sign
	iio: proximity: as3935: recalibrate RCO after resume
	iio: adc: ti_am335x_adc: allocating too much in probe
	IB/mlx5: Fix kernel to user leak prevention logic
	usb: gadget: udc: renesas_usb3: fix pm_runtime functions calling
	usb: gadget: udc: renesas_usb3: fix deadlock by spinlock
	usb: gadget: udc: renesas_usb3: lock for PN_ registers access
	USB: hub: fix SS max number of ports
	usb: core: fix potential memory leak in error path during hcd creation
	USB: usbip: fix nonconforming hub descriptor
	pvrusb2: reduce stack usage pvr2_eeprom_analyze()
	USB: gadget: dummy_hcd: fix hub-descriptor removable fields
	usb: r8a66597-hcd: select a different endpoint on timeout
	usb: r8a66597-hcd: decrease timeout
	ath10k: fix napi crash during rmmod when probe firmware fails
	misc: mic: double free on ioctl error path
	drivers/misc/c2port/c2port-duramar2150.c: checking for NULL instead of IS_ERR()
	usb: xhci: Fix USB 3.1 supported protocol parsing
	usb: xhci: ASMedia ASM1042A chipset need shorts TX quirk
	USB: gadget: fix GPF in gadgetfs
	USB: gadgetfs, dummy-hcd, net2280: fix locking for callbacks
	mm/memory-failure.c: use compound_head() flags for huge pages
	swap: cond_resched in swap_cgroup_prepare()
	iio: imu: inv_mpu6050: add accel lpf setting for chip >= MPU6500
	sched/core: Idle_task_exit() shouldn't use switch_mm_irqs_off()
	genirq: Release resources in __setup_irq() error path
	alarmtimer: Prevent overflow of relative timers
	usb: gadget: composite: Fix function used to free memory
	usb: dwc3: exynos fix axius clock error path to do cleanup
	MIPS: Fix bnezc/jialc return address calculation
	MIPS: .its targets depend on vmlinux
	vTPM: Fix missing NULL check
	crypto: Work around deallocated stack frame reference gcc bug on sparc.
	alarmtimer: Rate limit periodic intervals
	mm: larger stack guard gap, between vmas
	Allow stack to grow up to address space limit
	mm: fix new crash in unmapped_area_topdown()
	Linux 4.9.34

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2017-06-27 10:43:56 +02:00
Johan Hovold
12bfbe157d USB: hub: fix SS max number of ports 
commit 93491ced3c87c94b12220dbac0527e1356702179 upstream.

Add define for the maximum number of ports on a SuperSpeed hub as per
USB 3.1 spec Table 10-5, and use it when verifying the retrieved hub
descriptor.

This specifically avoids benign attempts to update the DeviceRemovable
mask for non-existing ports (should we get that far).

Fixes: dbe79bbe9d ("USB 3.0 Hub Changes")
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2017-06-24 07:11:15 +02:00
Ajay Agarwal
abed8d4cab sound: usb: Add support for parsing AudioStreaming intf for BADD devices 
BADD(Basic Audio Device Definition) is a subset of UAC3
specifications. It defines standard profiles which provide
specific attributes of class descriptors. BADD audio device
provides profile id and BADD supporting host will infer
attributes from profile-id.

Currently USB Audio Host driver has support for UAC1
and UAC2 devices. To handle BADD 3.0 devices, AudioControl
and AudioStreaming Interfaces have to be properly parsed.
The Host has to derive all class-specific information based
on the profile ID that the device exposes. Add support for
parsing the AudioStreaming interfaces exposed by the device.

Change-Id: I726bbb735708fe8e395011c7228a73d5f65c092d
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
 2017-05-15 14:29:10 -07:00
Mayank Rana
0663c43b1a usb: gadget: Add snapshot of USB GSI function driver 
This change adds USB GSI function driver which provides USB RMNET/RNDIS/
ECM/MBIM/DPL related functionalities with GSI hardware accelerated path.

This snapshot is taken as of msm-4.4 commit 4195f84bde61 ("qcom-charger:
smb2: add support of PMFALCON").

It removes usage of debug.h and related functionality used for debugging
purpose. IPC logging based debug functionality shall be added later.

Change-Id: Ia6915c76deb084ebb789ae33c509e835502cfcf1
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
 2017-02-07 10:19:59 -08:00
Colin Cross
e73ec50912 ANDROID: usb: gadget: f_accessory: move userspace interface to uapi 
Move the entire contents of linux/usb/f_accessory.h header to uapi,
it only contains a userspace interface.

Change-Id: Ieb5547da449588ae554988a201c0e6b4e3afc531
Signed-off-by: Colin Cross <ccross@android.com>
 2017-01-19 13:33:05 -08:00
Colin Cross
2453dad579 ANDROID: usb: gadget: f_mtp: move userspace interface to uapi 
Move the most of linux/usb/f_mtp.h header to uapi.  Move the only
remaining structure definition into f_mtp.c, the only place that
uses it.

Change-Id: I952c1a9dc15c36bf295a0eb4d74b6b1ad912ed03
Signed-off-by: Colin Cross <ccross@android.com>
 2017-01-19 13:33:04 -08:00
Mayank Rana
93ebf1f99d USB: QTI: Add missing usb_ctrl_qti.h 
f_gsi compilation is failing with below error:
fatal error: linux/usb/usb_ctrl_qti.h: No such file or directory

Hence add missing usb_ctrl_qti.h to resolve above error while
compiling f_gsi.c file.

This file's snapshot is taken from msm-3.18 kernel as
'commit 24b986908cc1 ("power: qpnp-fg: stop IMA transactions
during FG shutdown")'.

CRs-Fixed: 1001469
Change-Id: Ib7dce6b2ae1670554a29847e4381e71ba7b75edf
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
 2016-12-06 13:40:34 -08:00
Colin Cross
39d46a136e usb: gadget: f_accessory: move userspace interface to uapi 
Move the entire contents of linux/usb/f_accessory.h header to uapi,
it only contains a userspace interface.

Change-Id: Ieb5547da449588ae554988a201c0e6b4e3afc531
Signed-off-by: Colin Cross <ccross@android.com>
 2016-10-24 23:41:21 +08:00
Colin Cross
b26a136389 usb: gadget: f_mtp: move userspace interface to uapi 
Move the most of linux/usb/f_mtp.h header to uapi.  Move the only
remaining structure definition into f_mtp.c, the only place that
uses it.

Change-Id: I952c1a9dc15c36bf295a0eb4d74b6b1ad912ed03
Signed-off-by: Colin Cross <ccross@android.com>
 2016-10-24 23:41:21 +08:00
Felix Hädicke
4368c28ae7 usb: gadget: f_fs: handle control requests in config 0 
Introduces a new FunctionFS descriptor flag named
FUNCTIONFS_CONFIG0_SETUP.

When this flag is enabled, FunctionFS userspace drivers can process
non-standard control requests in configuration 0.

Signed-off-by: Felix Hädicke <felixhaedicke@web.de>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
 2016-08-25 12:13:17 +03:00
Felix Hädicke
54dfce6d07 usb: gadget: f_fs: handle control requests not directed to interface or endpoint 
Introduces a new FunctionFS descriptor flag named
FUNCTIONFS_ALL_CTRL_RECIP. When this flag is enabled, control requests,
which are not explicitly directed to an interface or endpoint, can be
handled.

This allows FunctionFS userspace drivers to process non-standard
control requests.

Signed-off-by: Felix Hädicke <felixhaedicke@web.de>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
 2016-08-25 12:13:17 +03:00
Oliver Neukum
351e67ab5c USB: PD: additional feature selectors 
This adds the feature selectors from Table 9-8

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2016-04-19 04:33:15 +09:00
Oliver Neukum
e1669f4a42 USB: PD: define specific requests 
This takes the definitions of requests from chapter 9.3.1
of the USB Power Delivery spec.

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2016-04-19 04:33:15 +09:00
Oliver Neukum
e10f9a42e9 USB: add descriptors from USB Power Delivery spec 
Adding the descriptors of chapter 9.2 of the Power Delivery spec.

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2016-04-19 04:33:15 +09:00
John Youn
743bc4b069 usb: ch9: Fix SSP Device Cap wFunctionalitySupport type 
The wFunctionalitySupport field should be __le16.

Signed-off-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
 2016-03-29 13:26:04 +03:00
Li Jun
346dbc6993 usb: add OTG status selector definition for HNP polling 
A host is required to use the GetStatus command, with wIndex set to the
OTG status selector(F000H) to request the Host request flag from the
peripheral.

Acked-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Li Jun <jun.li@nxp.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
 2016-03-04 15:14:35 +02:00
John Youn
446fa3a95d usb: ch9: Add size macro for SSP dev cap descriptor 
The SuperspeedPlus Device Capability Descriptor has a variable size
depending on the number of sublink speed attributes.

This patch adds a macro to calculate that size. The macro takes one
argument, the Sublink Speed Attribute Count (SSAC) as reported by the
descriptor in bmAttributes[4:0].

See USB 3.1 9.6.2.5, Table 9-19.

Signed-off-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
 2016-03-04 15:14:22 +02:00
Mathias Nyman
faee822c5a usb: Add USB 3.1 Precision time measurement capability descriptor support 
USB 3.1 devices that support precision time measurement have an
additional PTM cabaility descriptor as part of the full BOS descriptor

Look for this descriptor while parsing the BOS descriptor, and store it in
struct usb_hub_bos if it exists.

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2016-02-14 17:03:23 -08:00
Mathias Nyman
c8b1d8977e usb: Add USB3.1 SuperSpeedPlus Isoc Endpoint Companion descriptor 
USB3.1 specifies a SuperSpeedPlus Isoc endpoint companion descriptor
which is returned as part of the devices complete configuration
descriptor.

It contains number of bytes per service interval which is needed when
reserving bus time in the schedule for transfers over 48K bytes per
service interval.

If bmAttributes bit 7 is set in the old SuperSpeed Endpoint Companion
descriptor, it will be ollowed by the new SuperSpeedPlus Isoc Endpoint
Companion descriptor.

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2016-02-14 17:03:23 -08:00
Dave Penkler
379d3d33c8 Add ioctls to enable and disable local controls on an instrument 
These ioctls provide support for the USBTMC-USB488 control requests
for REN_CONTROL, GO_TO_LOCAL and LOCAL_LOCKOUT

Signed-off-by: Dave Penkler <dpenkler@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2016-02-03 13:54:06 -08:00
Dave Penkler
29779d89fd Add ioctl to retrieve USBTMC-USB488 capabilities 
This is a convenience function to obtain an instrument's
capabilities from its file descriptor without having to access sysfs
from the user program.

Signed-off-by: Dave Penkler <dpenkler@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2016-02-03 13:54:06 -08:00
Dave Penkler
dbf3e7f654 Implement an ioctl to support the USMTMC-USB488 READ_STATUS_BYTE operation. 
Background:
When performing a read on an instrument that is executing a function
that runs longer than the USB timeout the instrument may hang and
require a device reset to recover. The READ_STATUS_BYTE operation
always returns even when the instrument is busy permitting to poll
for the appropriate condition. This capability is referred to in
instrument application notes on synchronizing acquisitions for other
platforms.

Signed-off-by: Dave Penkler <dpenkler@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2016-02-03 13:54:06 -08:00
Mathias Nyman
0cdd49a1d1 usb: Support USB 3.1 extended port status request 
usb 3.1 extend the hub get-port-status request by adding different
request types. the new request types return 4 additional bytes called
extended port status, these bytes are returned after the regular
portstatus and portchange values.

The extended port status contains a speed ID for the currently used
sublink speed. A table of supported Speed IDs with details about the link
is provided by the hub in the device descriptor BOS SuperSpeedPlus
device capability Sublink Speed Attributes.

Support this new request. Ask for the extended port status after port
reset if hub supports USB 3.1. If link is running at SuperSpeedPlus
set the device speed to USB_SPEED_SUPER_PLUS

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2016-01-24 20:16:52 -08:00
Mathias Nyman
8a1b2725a6 usb: define USB_SPEED_SUPER_PLUS speed for SuperSpeedPlus USB3.1 devices 
Add a new USB_SPEED_SUPER_PLUS device speed, and make sure usb core can
handle the new speed.
In most cases the behaviour is the same as with USB_SPEED_SUPER SuperSpeed
devices. In a few places we add a "Plus" string to inform the user of the
new speed.

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2016-01-24 20:16:52 -08:00
Laurent Pinchart
8afe97be37 [media] uvcvideo: Enable UVC 1.5 device detection 
UVC 1.5 devices report a bInterfaceProtocol value set to 1 in their
interface descriptors. The uvcvideo driver only matches on
bInterfaceProtocol 0, preventing those devices from being detected.

More changes to the driver are needed for full UVC 1.5 compatibility.
However, at least the UVC 1.5 Microsoft Surface Pro 3 cameras have been
reported to work out of the box with the driver with an updated match
table.

Enable UVC 1.5 support in the match table to support the devices that
can work with the current driver implementation. Devices that can't will
fail, but that's hardly a regression as they're currently not detected
at all anyway.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
 2015-11-19 11:13:19 -02:00
Linus Torvalds
3d6f47801c Merge tag 'usb-4.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb 
Pull USB updates from Greg KH:
 "Here is the big USB patchset for 4.4-rc1.

  As usual, most of the changes are in the gadget subsystem, and we
  removed a host controller for a device that is no longer in existance,
  and probably never was even made public.  There is also other minor
  driver updates and new device ids, full details in the changelog.

  All of these have been in linux-next for a while"

* tag 'usb-4.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (233 commits)
  USB: core: Codestyle fix in urb.c
  usb: misc: usb3503: Use i2c_add_driver helper macro
  usb: host: lpc32xx: don't unregister phy device
  usb: host: lpc32xx: balance clk enable/disable on removal
  usb: host: lpc32xx: fix warnings caused by enabling unprepared clock
  uwb: drp: Use setup_timer
  uwb: neh: Use setup_timer
  uwb: rsv: Use setup_timer
  USB: qcserial: add Sierra Wireless MC74xx/EM74xx
  usb: chipidea: otg: don't wait vbus drops below BSV when starts host
  chipidea: ci_hdrc_pci: use PCI_VDEVICE() instead of PCI_DEVICE()
  doc: dt-binding: ci-hdrc-usb2: split vendor specific properties
  usb: chipidea: imx: add imx6ul usb support
  doc: dt-binding: ci-hdrc-usb2: improve property description
  usb: chipidea: imx: add usb support for imx7d
  Doc: usb: ci-hdrc-usb2: Add phy-clkgate-delay-us entry
  usb: chipidea: Add support for 'phy-clkgate-delay-us' property
  usb: chipidea: Use extcon framework for VBUS and ID detect
  usb: gadget: net2280: restore ep_cfg after defect7374 workaround
  usb: dwc2: host: Fix use after free w/ simultaneous irqs
  ...
 2015-11-04 21:26:27 -08:00
Mathias Nyman
90ec924780 usb: Add USB 3.1 SuperSpeedPlus device capability descriptor 
USB 3.1 SuperSpeedPlus device capability descriptor is returned as part
of the bos descriptor for devices that support SuperSpeedPlus protocol.

The descriptor contains more detailed information about the supported
speeds of the device. More details about the descriptor can be found in
the USB 3.1 specification section 9.6.2.5

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2015-10-04 10:34:17 +01:00
Stephen Rothwell
b84ee0d7f3 cdc: add header guards 
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
 2015-09-15 21:53:24 -07:00
Macpaul Lin
5d701cef9b usb: add USB_OTG_ADP definition 
Add USB_OTG_ADP definition for usb_otg_descriptor.bmAttributes.

Signed-off-by: Macpaul Lin <macpaul@gmail.com>
Signed-off-by: Li Jun <jun.li@freescale.com>
Acked-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
 2015-07-29 09:59:20 -05:00