3109 Commits

Author	SHA1	Message	Date
Blagovest Kolenichev	39b8bb4d84	Merge android-4.9.89 (960923f) into msm-4.9 ... * refs/heads/tmp-960923f: Linux 4.9.89 usb: gadget: bdc: 64-bit pointer capability check usb: dwc3: Fix GDBGFIFOSPACE_TYPE values USB: gadget: udc: Add missing platform_device_put() on error in bdc_pci_probe() scsi: qla2xxx: Fix extraneous ref on sp's after adapter break btrfs: Fix use-after-free when cleaning up fs_devs with a single stale device btrfs: alloc_chunk: fix DUP stripe size handling scsi: sg: only check for dxfer_len greater than 256M scsi: sg: fix static checker warning in sg_is_valid_dxfer scsi: sg: fix SG_DXFER_FROM_DEV transfers irqchip/gic-v3-its: Ensure nr_ites >= nr_lpis fs/aio: Use RCU accessors for kioctx_table->table[] fs/aio: Add explicit RCU grace period when freeing kioctx lock_parent() needs to recheck if dentry got __dentry_kill'ed under it fs: Teach path_connected to handle nfs filesystems with multiple roots. drm/amdgpu/dce: Don't turn off DP sink when disconnected drm/amdgpu: fix prime teardown order ALSA: seq: Clear client entry before deleting else at closing ALSA: seq: Fix possible UAF in snd_seq_check_queue() ALSA: hda - Revert power_save option default value ALSA: pcm: Fix UAF in snd_pcm_oss_get_formats() parisc: Handle case where flush_cache_range is called with no context x86/mm: Fix vmalloc_fault to use pXd_large x86/speculation: Remove Skylake C2 from Speculation Control microcode blacklist x86/speculation, objtool: Annotate indirect calls/jumps for objtool on 32-bit kernels x86/vm86/32: Fix POPF emulation selftests/x86/entry_from_vm86: Add test cases for POPF selftests/x86: Add tests for the STR and SLDT instructions selftests/x86: Add tests for User-Mode Instruction Prevention selftests/x86/entry_from_vm86: Exit with 1 if we fail x86/cpufeatures: Add Intel PCONFIG cpufeature x86/boot/32: Fix UP boot on Quark and possibly other platforms net: hns: Some checkpatch.pl script & warning fixes ima: relax requiring a file signature for new files with zero length locking/locktorture: Fix num reader/writer corner cases rcutorture/configinit: Fix build directory error message ipvlan: add L2 check for packets arriving via virtual devices ASoC: nuc900: Fix a loop timeout test mac80211: remove BUG() when interface type is invalid mac80211_hwsim: enforce PS_MANUAL_POLL to be set after PS_ENABLED agp/intel: Flush all chipset writes after updating the GGTT powerpc/modules: Don't try to restore r2 after a sibling call drm/amdkfd: Fix memory leaks in kfd topology veth: set peer GSO values media: cpia2: Fix a couple off by one bugs media: vsp1: Prevent suspending and resuming DRM pipelines scsi: dh: add new rdac devices scsi: devinfo: apply to HP XP the same flags as Hitachi VSP scsi: core: scsi_get_device_flags_keyed(): Always return device flags bnxt_en: Don't print "Link speed -1 no longer supported" messages. spi: sun6i: disable/unprepare clocks on remove tools/usbip: fixes build with musl libc toolchain ath10k: fix invalid STS_CAP_OFFSET_MASK mwifiex: cfg80211: do not change virtual interface during scan processing clk: qcom: msm8916: fix mnd_width for codec_digcodec pwm: stmpe: Fix wrong register offset for hwpwm=2 case scsi: ses: don't ask for diagnostic pages repeatedly during probe ath10k: update tdls teardown state to target power: supply: ab8500_charger: Bail out in case of error in 'ab8500_charger_init_hw_registers()' power: supply: ab8500_charger: Fix an error handling path leds: pm8058: Silence pointer to integer size warning userns: Don't fail follow_automount based on s_user_ns mtd: nand: ifc: update bufnum mask for ver >= 2.0.0 ARM: dts: omap3-n900: Fix the audio CODEC's reset pin ARM: dts: am335x-pepper: Fix the audio CODEC's reset pin net: thunderx: Set max queue count taking XDP_TX into account mtd: nand: fix interpretation of NAND_CMD_NONE in nand_command[_lp]() net: xfrm: allow clearing socket xfrm policies. net: ieee802154: adf7242: Fix bug if defined DEBUG test_firmware: fix setting old custom fw path back on exit sched: Stop resched_cpu() from sending IPIs to offline CPUs sched: Stop switched_to_rt() from sending IPIs to offline CPUs ARM: dts: exynos: Correct Trats2 panel reset line clk: meson: gxbb: fix wrong clock for SARADC/SANA iwlwifi: mvm: rs: don't override the rate history in the search cycle HID: elo: clear BTN_LEFT mapping video/hdmi: Allow "empty" HDMI infoframes drm/edid: set ELD connector type in drm_edid_to_eld() mwifiex: Fix invalid port issue perf stat: Fix bug in handling events in error state wil6210: fix memory access violation in wil_memcpy_from/toio_32 wil6210: fix protection against connections during reset ath10k: fix compile time sanity check for CE4 buffer size mac80211_hwsim: use per-interface power level Bluetooth: 6lowpan: fix delay work init in add_peer_chan() Bluetooth: Avoid bt_accept_unlink() double unlinking clk: qcom: msm8996: Fix the vfe1 powerdomain name pwm: tegra: Increase precision in PWM rate calculation kprobes/x86: Set kprobes pages read-only kprobes/x86: Fix kprobe-booster not to boost far call instructions ALSA: hda: Add Geminilake id to SKL_PLUS scsi: sg: close race condition in sg_remove_sfp_usercontext() scsi: sg: check for valid direction before starting the request vfio/spapr_tce: Check kzalloc() return when preregistering memory vfio/powerpc/spapr_tce: Enforce IOMMU type compatibility check perf session: Don't rely on evlist in pipe mode net: fec: add phy-reset-gpios PROBE_DEFER check perf inject: Copy events when reordering events in pipe mode drivers/perf: arm_pmu: handle no platform_device iwlwifi: mvm: fix RX SKB header size and align it properly perf evsel: Return exact sub event which failed with EPERM for wildcards usb: gadget: dummy_hcd: Fix wrong power status bit clear/reset in dummy_hub_control() usb: dwc2: Make sure we disconnect the gadget state powerpc/nohash: Fix use of mmu_has_feature() in setup_initial_memory_limit() md.c:didn't unlock the mddev before return EINVAL in array_size_store md/raid6: Fix anomily when recovering a single device in RAID6. regulator: isl9305: fix array size v4l: vsp1: Register pipe with output WPF v4l: vsp1: Prevent multiple streamon race commencing pipeline early MIPS: r2-on-r6-emu: Clear BLTZALL and BGEZALL debugfs counters MIPS: r2-on-r6-emu: Fix BLEZL and BGTZL identification MIPS: BPF: Fix multiple problems in JIT skb access helpers. MIPS: BPF: Quit clobbering callee saved registers in JIT code. serial: imx: setup DCEDTE early and ensure DCD and RI irqs to be off tty: amba-pl011: Fix spurious TX interrupts lkdtm: turn off kcov for lkdtm_rodata_do_nothing: coresight: Fixes coresight DT parse to get correct output port ID. i40e: only register client on iWarp-capable devices drm/rockchip: vop: Enable pm domain before vop_initial drm/amdgpu: Fail fb creation from imported dma-bufs. (v2) drm/radeon: Fail fb creation from imported dma-bufs. video: ARM CLCD: fix dma allocation size kvm: nVMX: Disallow userspace-injected exceptions in guest mode kvm/svm: Setup MCG_CAP on AMD properly iommu/iova: Fix underflow bug in __alloc_and_insert_iova_range apparmor: Make path_max parameter readonly qed: Correct MSI-x for storage scsi: ses: don't get power status of SES device slot on probe EDAC, altera: Fix peripheral warnings for Cyclone5 fm10k: correctly check if interface is removed ALSA: firewire-digi00x: handle all MIDI messages on streaming packets ALSA: firewire-digi00x: add support for console models of Digi00x series IB/hfi1: Check for QSFP presence before attempting reads ASoC: rt5677: Add OF device ID table reiserfs: Make cancel_old_flush() reliable ARM: dts: koelsch: Correct clock frequency of X2 DU clock input drm: rcar-du: Handle event when disabling CRTCs printk: Correctly handle preemption in console_unlock() rtmutex: Fix PI chain order integrity qed: Fix TM block ILT allocation net/faraday: Add missing include of of.h net: hns: Correct HNS RSS key set function powerpc: Avoid taking a data miss on every userspace instruction miss ARM: dts: r8a7793: Correct parent of SSI[0-9] clocks ARM: dts: r8a7791: Correct parent of SSI[0-9] clocks ARM: dts: r8a7790: Correct parent of SSI[0-9] clocks ARM: dts: r7s72100: fix ethernet clock parent NFC: pn533: change order of free_irq and dev unregistration NFC: nfcmrvl: double free on error path NFC: nfcmrvl: Include unaligned.h instead of access_ok.h vxlan: vxlan dev should inherit lowerdev's gso_max_size drm/vmwgfx: Fixes to vmwgfx_fb braille-console: Fix value returned by _braille_console_setup powerpc/mm/hugetlb: Filter out hugepage size not supported by page table layout PCI: Apply Cavium ACS quirk only to CN81xx/CN83xx/CN88xx devices bonding: refine bond_fold_stats() wrap detection drm/ttm: never add BO that failed to validate to the LRU list f2fs: relax node version check for victim data in gc perf trace: Handle unpaired raw_syscalls:sys_exit event regulator: core: Limit propagation of parent voltage count and list blk-throttle: make sure expire time isn't too big ARM: dts: silk: Correct clock of DU1 ARM: dts: r8a7794: Correct clock of DU1 ARM: dts: r8a7794: Add DU1 clock to device tree ALSA: firewire-lib: add a quirk of packet without valid EOH in CIP format mm: Fix false-positive VM_BUG_ON() in page_cache_{get,add}_speculative() bonding: make speed, duplex setting consistent with link state driver: (adm1275) set the m,b and R coefficients correctly for power scsi: be2iscsi: Check tag in beiscsi_mccq_compl_wait i40e/i40evf: Fix use after free in Rx cleanup path perf buildid: Do not assume that readlink() returns a null terminated string perf annotate: Fix a bug following symbolic link of a build-id file ARM: dts: bcm2835: add index to the ethernet alias usb: dwc3: make sure UX_EXIT_PX is cleared dmaengine: imx-sdma: add 1ms delay to ensure SDMA channel is stopped tcp: sysctl: Fix a race to avoid unexpected 0 window from space spi: omap2-mcspi: poll OMAP2_MCSPI_CHSTAT_RXS for PIO transfer ASoC: rcar: ssi: don't set SSICR.CKDV = 000 with SSIWSR.CONT PCI: hv: Lock PCI bus on device eject PCI: hv: Properly handle PCI bus remove sched: act_csum: don't mangle TCP and UDP GSO packets Input: qt1070 - add OF device ID table sysrq: Reset the watchdog timers while displaying high-resolution timers timers, sched_clock: Update timeout for clock wrap media: i2c/soc_camera: fix ov6650 sensor getting wrong clock scsi: ipr: Fix missed EH wakeup scsi: fnic: Fix for "Number of Active IOs" in fnicstats becoming negative x86/boot/32: Defer resyncing initial_page_table until per-cpu is set up solo6x10: release vb2 buffers in solo_stop_streaming() of: fix of_device_get_modalias returned length when truncating buffers batman-adv: handle race condition for claims between gateways zd1211rw: fix NULL-deref at probe s390/topology: fix typo in early topology code qed: Always publish VF link from leading hwfn ARM: dts: Adjust moxart IRQ controller and flags net/8021q: create device with all possible features in wanted_features HID: clamp input to logical range if no null state perf probe: Return errno when not hitting any event perf probe: Fix concat_probe_trace_events omapfb: dss: Handle return errors in dss_init_ports() x86/mce: Init some CPU features early netem: apply correct delay when rate throttling net: ethernet: bgmac: Allow MAC address to be specified in DTB ARM: bcm2835: Enable missing CMA settings for VC4 driver usb: misc: lvs: fix race condition in disconnect handling ath10k: fix fetching channel during potential radar detection ath10k: disallow DFS simulation if DFS channel is not enabled drm: Defer disabling the vblank IRQ until the next interrupt (for instant-off) drivers: net: xgene: Fix Rx checksum validation logic drivers: net: xgene: Fix wrong logical operation drivers: net: phy: xgene: Fix mdio write drivers: net: xgene: Fix hardware checksum setting ARM: brcmstb: Enable ZONE_DMA for non 64-bit capable peripherals perf tools: Make perf_event__synthesize_mmap_events() scale i40e: fix ethtool to get EEPROM data from X722 interface i40e: Acquire NVM lock before reads on all devices eventpoll.h: fix epoll event masks x86/mce: Handle broadcasted MCE gracefully with kexec perf sort: Fix segfault with basic block 'cycles' sort dimension x86/mm: Make mmap(MAP_32BIT) work correctly selinux: check for address length in selinux_socket_bind() PCI/MSI: Stop disabling MSI/MSI-X in pci_device_shutdown() drm/sun4i: Fix TCON clock and regmap initialization sequence ath10k: fix a warning during channel switch with multiple vaps drm/sun4i: Set drm_crtc.port to the underlying TCON's output port node drm/sun4i: Fix up error path cleanup for master bind function arm64: dts: r8a7796: Remove unit-address and reg from integrated cache ARM: dts: r8a7794: Remove unit-address and reg from integrated cache ARM: dts: r8a7793: Remove unit-address and reg from integrated cache ARM: dts: r8a7792: Remove unit-address and reg from integrated cache ARM: dts: r8a7791: Remove unit-address and reg from integrated cache drm: qxl: Don't alloc fbdev if emulation is not supported HID: reject input outside logical range only if null state is set staging: wilc1000: add check for kmalloc allocation failure. staging: speakup: Replace BUG_ON() with WARN_ON(). perf stat: Issue a HW watchdog disable hint Input: tsc2007 - check for presence and power down tsc2007 during probe blkcg: fix double free of new_blkg in blkcg_init_queue staging: android: ashmem: Fix possible deadlock in ashmem_ioctl Conflicts: drivers/net/wireless/ath/wil6210/main.c drivers/usb/dwc3/core.h Change-Id: I2d77962cfc3dbc8b051ba51bf10b577d327ffaa9 Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>	2018-04-17 10:45:20 -07:00
Blagovest Kolenichev	a8a3aff106	Merge android-4.9.86 (b324a70) into msm-4.9 ... * refs/heads/tmp-b324a70: Linux 4.9.86 MIPS: Implement __multi3 for GCC7 MIPS64r6 builds KVM: arm/arm64: Fix check for hugepage size when allocating at Stage 2 net: gianfar_ptp: move set_fipers() to spinlock protecting area sctp: make use of pre-calculated len xen/gntdev: Fix partial gntdev_mmap() cleanup xen/gntdev: Fix off-by-one error when unmapping with holes SolutionEngine771x: fix Ether platform data mdio-sun4i: Fix a memory leak xen-netfront: enable device after manual module load bnxt_en: Fix the 'Invalid VF' id check in bnxt_vf_ndo_prep routine. can: flex_can: Correct the checking for frame length in flexcan_start_xmit() mac80211: mesh: drop frames appearing to be from us nl80211: Check for the required netlink attribute presence i40e/i40evf: Account for frags split over multiple descriptors in check linearize uapi libc compat: add fallback for unsupported libcs drm/ttm: check the return value of kzalloc NET: usb: qmi_wwan: add support for YUGA CLM920-NC5 PID 0x9625 e1000: fix disabling already-disabled warning macvlan: Fix one possible double free xfs: quota: check result of register_shrinker() xfs: quota: fix missed destroy of qi_tree_lock IB/ipoib: Fix race condition in neigh creation IB/mlx4: Fix mlx4_ib_alloc_mr error flow s390/dasd: fix wrongly assigned configuration data genirq: Guard handle_bad_irq log messages IB/mlx5: Fix mlx5_ib_alloc_mr error flow led: core: Fix brightness setting when setting delay_off=0 bnx2x: Improve reliability in case of nested PCI errors tg3: Enable PHY reset in MTU change path for 5720 tg3: Add workaround to restrict 5762 MRRS to 2048 tipc: fix tipc_mon_delete() oops in tipc_enable_bearer() error path tipc: error path leak fixes in tipc_enable_bearer() lib/mpi: Fix umul_ppmm() for MIPS64r6 ARM: dts: ls1021a: fix incorrect clock references scsi: storvsc: Fix scsi_cmd error assignments in storvsc_handle_error net: stmmac: Fix TX timestamp calculation ip6_tunnel: get the min mtu properly in ip6_tnl_xmit net: arc_emac: fix arc_emac_rx() error paths net: mediatek: setup proper state for disabled GMAC on the default ASoC: nau8825: fix issue that pop noise when start capture spi: atmel: fixed spin_lock usage inside atmel_spi_remove mac80211_hwsim: Fix a possible sleep-in-atomic bug in hwsim_get_radio_nl drm/nouveau/pci: do a msi rearm on init net: phy: xgene: disable clk on error paths sget(): handle failures of register_shrinker() x86/asm: Allow again using asm.h when building for the 'bpf' clang target ARM: 8731/1: Fix csum_partial_copy_from_user() stack mismatch ipv6: icmp6: Allow icmp messages to be looped back mtd: nand: brcmnand: Zero bitflip is not an error mtd: nand: gpmi: Fix failure when a erased page has a bitflip at BBM net: usb: qmi_wwan: add Telit ME910 PID 0x1101 support nvme: check hw sectors before setting chunk sectors dmaengine: fsl-edma: disable clks on all error paths f2fs: fix a bug caused by NULL extent tree i2c: designware: must wait for enable hrtimer: Ensure POSIX compliance (relative CLOCK_REALTIME hrtimers) ANDROID: kbuild: change LTO into a choice ANDROID: arm64: crypto: fix AES CE when built as a module ANDROID: staging: lustre: fix filler function type ANDROID: fs: logfs: fix filler function type ANDROID: fs: gfs2: fix filler function type ANDROID: fs: exofs: fix filler function type ANDROID: fs: afs: fix filler function type ANDROID: keychord: Check for write data size media-device: fix ioctl function types drivers/perf: arm_pmu: fix function type mismatch dummycon: fix function types fs: nfs: fix filler function type mm: fix filler function type mismatch mm: fix drain_local_pages function type BACKPORT: vfs: pass type instead of fn to do_{loop,iter}_readv_writev() arch/arm64/crypto: fix CFI in AES CE arch/arm64/crypto: fix CFI in SHA CE arm64: disable CFI for cpu_replace_ttbr1 v4l2-ioctl: fix function types for IOCTL_INFO_STD UPSTREAM: module: Do not paper over type mismatches in module_param_call() BACKPORT: treewide: Fix function prototypes for module_param_call() UPSTREAM: module: Prepare to convert all module_param_call() prototypes bpf: fix function type for __bpf_prog_run kallsyms: strip the .cfi postfix from symbols with CONFIG_CFI_CLANG add support for clang Control Flow Integrity (CFI) HACK: init: ensure initcall ordering with LTO xen/efi: don't use -fshort-wchar drivers/misc: disable LTO for lkdtm_rodata.o arm64: vdso: disable LTO FROMLIST: BACKPORT: arm64: select ARCH_SUPPORTS_LTO_CLANG FROMLIST: BACKPORT: arm64: disable RANDOMIZE_MODULE_REGION_FULL with LTO_CLANG FROMLIST: arch/arm64/crypto: disable LTO for aes-ce-cipher.c arm64: disable ARM64_ERRATUM_843419 for clang LTO arm64: pass code model to LLVMgold FROMLIST: BACKPORT: arm64: make mrs_s and msr_s macros work with LTO FROMLIST: arm64: kvm: use -fno-jump-tables with clang FROMLIST: efi/libstub: disable LTO FROMLIST: scripts/mod: disable LTO for empty.c FROMLIST: BACKPORT: kbuild: fix dynamic ftrace with clang LTO FROMLIST: BACKPORT: kbuild: add support for clang LTO FROMLIST: BACKPORT: arm64: add a workaround for GNU gold with ARM64_MODULE_PLTS FROMLIST: arm64: explicitly pass --no-fix-cortex-a53-843419 to GNU gold FROMLIST: kbuild: add __ld-ifversion and linker-specific macros FROMLIST: kbuild: add ld-name macro FROMLIST: BACKPORT: arm64: keep .altinstructions and .altinstr_replacement arm64: fix LD_DEAD_CODE_DATA_ELIMINATION FROMLIST: kbuild: fix LD_DEAD_CODE_DATA_ELIMINATION FROMLIST: BACKPORT: kbuild: add __cc-ifversion and compiler-specific variants FROMLIST: kbuild: add clang-version.sh Revert "binder: add missing binder_unlock()" Linux 4.9.85 x86/entry/64: Clear extra registers beyond syscall arguments, to reduce speculation attack surface mm: fail get_vaddr_frames() for filesystem-dax mappings mm: Fix devm_memremap_pages() collision handling libnvdimm, dax: fix 1GB-aligned namespaces vs physical misalignment IB/core: disable memory registration of filesystem-dax vmas v4l2: disable filesystem-dax mapping support mm: introduce get_user_pages_longterm device-dax: implement ->split() to catch invalid munmap attempts libnvdimm: fix integer overflow static analysis warning fs/dax.c: fix inefficiency in dax_writeback_mapping_range() mm: avoid spurious 'bad pmd' warning messages X.509: fix NULL dereference when restricting key with unsupported_sig binder: add missing binder_unlock() drm/amdgpu: add new device to use atpx quirk drm/amdgpu: Avoid leaking PM domain on driver unbind (v2) drm/amdgpu: add atpx quirk handling (v2) drm/amdgpu: Add dpm quirk for Jet PRO (v2) usb: renesas_usbhs: missed the "running" flag in usb_dmac with rx path usb: gadget: f_fs: Process all descriptors during bind Revert "usb: musb: host: don't start next rx urb if current one failed" usb: ldusb: add PIDs for new CASSY devices supported by this driver usb: dwc3: gadget: Set maxpacket size for ep0 IN drm/edid: Add 6 bpc quirk for CPT panel in Asus UX303LA Add delay-init quirk for Corsair K70 RGB keyboards arm64: Disable unhandled signal log messages by default usb: ohci: Proper handling of ed_rm_list to handle race condition between usb_kill_urb() and finish_unlinks() ohci-hcd: Fix race condition caused by ohci_urb_enqueue() and io_watchdog_func() PCI/cxgb4: Extend T3 PCI quirk to T4+ devices irqchip/gic-v3: Use wmb() instead of smb_wmb() in gic_raise_softirq() x86/oprofile: Fix bogus GCC-8 warning in nmi_setup() iio: adis_lib: Initialize trigger before requesting interrupt iio: buffer: check if a buffer has been set up when poll is called RDMA/uverbs: Protect from command mask overflow PKCS#7: fix certificate chain verification X.509: fix BUG_ON() when hash algorithm is unsupported cfg80211: fix cfg80211_beacon_dup scsi: ibmvfc: fix misdefined reserved field in ibmvfc_fcp_rsp_info xtensa: fix high memory/reserved memory collision netfilter: drop outermost socket lock in getsockopt() ANDROID: sdcardfs: Set num in extension_details during make_item Conflicts: Makefile arch/arm64/include/asm/arch_gicv3.h arch/arm64/kernel/module.lds drivers/usb/gadget/function/f_fs.c scripts/link-vmlinux.sh Change in module_param_call() definition requires alignment in: drivers/hwtracing/coresight/coresight-event.c drivers/media/radio/radio-iris-transport.c drivers/power/reset/msm-poweroff.c drivers/soc/qcom/wcnss/wcnss_wlan.c drivers/video/fbdev/msm/mdss_dsi_status.c Change-Id: I2fa32c39bd4ba8a132f8f8abc8132a2ceb32907a Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>	2018-04-17 10:33:48 -07:00
Greg Kroah-Hartman	960923fdc2	Merge 4.9.89 into android-4.9 ... Changes in 4.9.89 blkcg: fix double free of new_blkg in blkcg_init_queue Input: tsc2007 - check for presence and power down tsc2007 during probe perf stat: Issue a HW watchdog disable hint staging: speakup: Replace BUG_ON() with WARN_ON(). staging: wilc1000: add check for kmalloc allocation failure. HID: reject input outside logical range only if null state is set drm: qxl: Don't alloc fbdev if emulation is not supported ARM: dts: r8a7791: Remove unit-address and reg from integrated cache ARM: dts: r8a7792: Remove unit-address and reg from integrated cache ARM: dts: r8a7793: Remove unit-address and reg from integrated cache ARM: dts: r8a7794: Remove unit-address and reg from integrated cache arm64: dts: r8a7796: Remove unit-address and reg from integrated cache drm/sun4i: Fix up error path cleanup for master bind function drm/sun4i: Set drm_crtc.port to the underlying TCON's output port node ath10k: fix a warning during channel switch with multiple vaps drm/sun4i: Fix TCON clock and regmap initialization sequence PCI/MSI: Stop disabling MSI/MSI-X in pci_device_shutdown() selinux: check for address length in selinux_socket_bind() x86/mm: Make mmap(MAP_32BIT) work correctly perf sort: Fix segfault with basic block 'cycles' sort dimension x86/mce: Handle broadcasted MCE gracefully with kexec eventpoll.h: fix epoll event masks i40e: Acquire NVM lock before reads on all devices i40e: fix ethtool to get EEPROM data from X722 interface perf tools: Make perf_event__synthesize_mmap_events() scale ARM: brcmstb: Enable ZONE_DMA for non 64-bit capable peripherals drivers: net: xgene: Fix hardware checksum setting drivers: net: phy: xgene: Fix mdio write drivers: net: xgene: Fix wrong logical operation drivers: net: xgene: Fix Rx checksum validation logic drm: Defer disabling the vblank IRQ until the next interrupt (for instant-off) ath10k: disallow DFS simulation if DFS channel is not enabled ath10k: fix fetching channel during potential radar detection usb: misc: lvs: fix race condition in disconnect handling ARM: bcm2835: Enable missing CMA settings for VC4 driver net: ethernet: bgmac: Allow MAC address to be specified in DTB netem: apply correct delay when rate throttling x86/mce: Init some CPU features early omapfb: dss: Handle return errors in dss_init_ports() perf probe: Fix concat_probe_trace_events perf probe: Return errno when not hitting any event HID: clamp input to logical range if no null state net/8021q: create device with all possible features in wanted_features ARM: dts: Adjust moxart IRQ controller and flags qed: Always publish VF link from leading hwfn s390/topology: fix typo in early topology code zd1211rw: fix NULL-deref at probe batman-adv: handle race condition for claims between gateways of: fix of_device_get_modalias returned length when truncating buffers solo6x10: release vb2 buffers in solo_stop_streaming() x86/boot/32: Defer resyncing initial_page_table until per-cpu is set up scsi: fnic: Fix for "Number of Active IOs" in fnicstats becoming negative scsi: ipr: Fix missed EH wakeup media: i2c/soc_camera: fix ov6650 sensor getting wrong clock timers, sched_clock: Update timeout for clock wrap sysrq: Reset the watchdog timers while displaying high-resolution timers Input: qt1070 - add OF device ID table sched: act_csum: don't mangle TCP and UDP GSO packets PCI: hv: Properly handle PCI bus remove PCI: hv: Lock PCI bus on device eject ASoC: rcar: ssi: don't set SSICR.CKDV = 000 with SSIWSR.CONT spi: omap2-mcspi: poll OMAP2_MCSPI_CHSTAT_RXS for PIO transfer tcp: sysctl: Fix a race to avoid unexpected 0 window from space dmaengine: imx-sdma: add 1ms delay to ensure SDMA channel is stopped usb: dwc3: make sure UX_EXIT_PX is cleared ARM: dts: bcm2835: add index to the ethernet alias perf annotate: Fix a bug following symbolic link of a build-id file perf buildid: Do not assume that readlink() returns a null terminated string i40e/i40evf: Fix use after free in Rx cleanup path scsi: be2iscsi: Check tag in beiscsi_mccq_compl_wait driver: (adm1275) set the m,b and R coefficients correctly for power bonding: make speed, duplex setting consistent with link state mm: Fix false-positive VM_BUG_ON() in page_cache_{get,add}_speculative() ALSA: firewire-lib: add a quirk of packet without valid EOH in CIP format ARM: dts: r8a7794: Add DU1 clock to device tree ARM: dts: r8a7794: Correct clock of DU1 ARM: dts: silk: Correct clock of DU1 blk-throttle: make sure expire time isn't too big regulator: core: Limit propagation of parent voltage count and list perf trace: Handle unpaired raw_syscalls:sys_exit event f2fs: relax node version check for victim data in gc drm/ttm: never add BO that failed to validate to the LRU list bonding: refine bond_fold_stats() wrap detection PCI: Apply Cavium ACS quirk only to CN81xx/CN83xx/CN88xx devices powerpc/mm/hugetlb: Filter out hugepage size not supported by page table layout braille-console: Fix value returned by _braille_console_setup drm/vmwgfx: Fixes to vmwgfx_fb vxlan: vxlan dev should inherit lowerdev's gso_max_size NFC: nfcmrvl: Include unaligned.h instead of access_ok.h NFC: nfcmrvl: double free on error path NFC: pn533: change order of free_irq and dev unregistration ARM: dts: r7s72100: fix ethernet clock parent ARM: dts: r8a7790: Correct parent of SSI[0-9] clocks ARM: dts: r8a7791: Correct parent of SSI[0-9] clocks ARM: dts: r8a7793: Correct parent of SSI[0-9] clocks powerpc: Avoid taking a data miss on every userspace instruction miss net: hns: Correct HNS RSS key set function net/faraday: Add missing include of of.h qed: Fix TM block ILT allocation rtmutex: Fix PI chain order integrity printk: Correctly handle preemption in console_unlock() drm: rcar-du: Handle event when disabling CRTCs ARM: dts: koelsch: Correct clock frequency of X2 DU clock input reiserfs: Make cancel_old_flush() reliable ASoC: rt5677: Add OF device ID table IB/hfi1: Check for QSFP presence before attempting reads ALSA: firewire-digi00x: add support for console models of Digi00x series ALSA: firewire-digi00x: handle all MIDI messages on streaming packets fm10k: correctly check if interface is removed EDAC, altera: Fix peripheral warnings for Cyclone5 scsi: ses: don't get power status of SES device slot on probe qed: Correct MSI-x for storage apparmor: Make path_max parameter readonly iommu/iova: Fix underflow bug in __alloc_and_insert_iova_range kvm/svm: Setup MCG_CAP on AMD properly kvm: nVMX: Disallow userspace-injected exceptions in guest mode video: ARM CLCD: fix dma allocation size drm/radeon: Fail fb creation from imported dma-bufs. drm/amdgpu: Fail fb creation from imported dma-bufs. (v2) drm/rockchip: vop: Enable pm domain before vop_initial i40e: only register client on iWarp-capable devices coresight: Fixes coresight DT parse to get correct output port ID. lkdtm: turn off kcov for lkdtm_rodata_do_nothing: tty: amba-pl011: Fix spurious TX interrupts serial: imx: setup DCEDTE early and ensure DCD and RI irqs to be off MIPS: BPF: Quit clobbering callee saved registers in JIT code. MIPS: BPF: Fix multiple problems in JIT skb access helpers. MIPS: r2-on-r6-emu: Fix BLEZL and BGTZL identification MIPS: r2-on-r6-emu: Clear BLTZALL and BGEZALL debugfs counters v4l: vsp1: Prevent multiple streamon race commencing pipeline early v4l: vsp1: Register pipe with output WPF regulator: isl9305: fix array size md/raid6: Fix anomily when recovering a single device in RAID6. md.c:didn't unlock the mddev before return EINVAL in array_size_store powerpc/nohash: Fix use of mmu_has_feature() in setup_initial_memory_limit() usb: dwc2: Make sure we disconnect the gadget state usb: gadget: dummy_hcd: Fix wrong power status bit clear/reset in dummy_hub_control() perf evsel: Return exact sub event which failed with EPERM for wildcards iwlwifi: mvm: fix RX SKB header size and align it properly drivers/perf: arm_pmu: handle no platform_device perf inject: Copy events when reordering events in pipe mode net: fec: add phy-reset-gpios PROBE_DEFER check perf session: Don't rely on evlist in pipe mode vfio/powerpc/spapr_tce: Enforce IOMMU type compatibility check vfio/spapr_tce: Check kzalloc() return when preregistering memory scsi: sg: check for valid direction before starting the request scsi: sg: close race condition in sg_remove_sfp_usercontext() ALSA: hda: Add Geminilake id to SKL_PLUS kprobes/x86: Fix kprobe-booster not to boost far call instructions kprobes/x86: Set kprobes pages read-only pwm: tegra: Increase precision in PWM rate calculation clk: qcom: msm8996: Fix the vfe1 powerdomain name Bluetooth: Avoid bt_accept_unlink() double unlinking Bluetooth: 6lowpan: fix delay work init in add_peer_chan() mac80211_hwsim: use per-interface power level ath10k: fix compile time sanity check for CE4 buffer size wil6210: fix protection against connections during reset wil6210: fix memory access violation in wil_memcpy_from/toio_32 perf stat: Fix bug in handling events in error state mwifiex: Fix invalid port issue drm/edid: set ELD connector type in drm_edid_to_eld() video/hdmi: Allow "empty" HDMI infoframes HID: elo: clear BTN_LEFT mapping iwlwifi: mvm: rs: don't override the rate history in the search cycle clk: meson: gxbb: fix wrong clock for SARADC/SANA ARM: dts: exynos: Correct Trats2 panel reset line sched: Stop switched_to_rt() from sending IPIs to offline CPUs sched: Stop resched_cpu() from sending IPIs to offline CPUs test_firmware: fix setting old custom fw path back on exit net: ieee802154: adf7242: Fix bug if defined DEBUG net: xfrm: allow clearing socket xfrm policies. mtd: nand: fix interpretation of NAND_CMD_NONE in nand_command[_lp]() net: thunderx: Set max queue count taking XDP_TX into account ARM: dts: am335x-pepper: Fix the audio CODEC's reset pin ARM: dts: omap3-n900: Fix the audio CODEC's reset pin mtd: nand: ifc: update bufnum mask for ver >= 2.0.0 userns: Don't fail follow_automount based on s_user_ns leds: pm8058: Silence pointer to integer size warning power: supply: ab8500_charger: Fix an error handling path power: supply: ab8500_charger: Bail out in case of error in 'ab8500_charger_init_hw_registers()' ath10k: update tdls teardown state to target scsi: ses: don't ask for diagnostic pages repeatedly during probe pwm: stmpe: Fix wrong register offset for hwpwm=2 case clk: qcom: msm8916: fix mnd_width for codec_digcodec mwifiex: cfg80211: do not change virtual interface during scan processing ath10k: fix invalid STS_CAP_OFFSET_MASK tools/usbip: fixes build with musl libc toolchain spi: sun6i: disable/unprepare clocks on remove bnxt_en: Don't print "Link speed -1 no longer supported" messages. scsi: core: scsi_get_device_flags_keyed(): Always return device flags scsi: devinfo: apply to HP XP the same flags as Hitachi VSP scsi: dh: add new rdac devices media: vsp1: Prevent suspending and resuming DRM pipelines media: cpia2: Fix a couple off by one bugs veth: set peer GSO values drm/amdkfd: Fix memory leaks in kfd topology powerpc/modules: Don't try to restore r2 after a sibling call agp/intel: Flush all chipset writes after updating the GGTT mac80211_hwsim: enforce PS_MANUAL_POLL to be set after PS_ENABLED mac80211: remove BUG() when interface type is invalid ASoC: nuc900: Fix a loop timeout test ipvlan: add L2 check for packets arriving via virtual devices rcutorture/configinit: Fix build directory error message locking/locktorture: Fix num reader/writer corner cases ima: relax requiring a file signature for new files with zero length net: hns: Some checkpatch.pl script & warning fixes x86/boot/32: Fix UP boot on Quark and possibly other platforms x86/cpufeatures: Add Intel PCONFIG cpufeature selftests/x86/entry_from_vm86: Exit with 1 if we fail selftests/x86: Add tests for User-Mode Instruction Prevention selftests/x86: Add tests for the STR and SLDT instructions selftests/x86/entry_from_vm86: Add test cases for POPF x86/vm86/32: Fix POPF emulation x86/speculation, objtool: Annotate indirect calls/jumps for objtool on 32-bit kernels x86/speculation: Remove Skylake C2 from Speculation Control microcode blacklist x86/mm: Fix vmalloc_fault to use pXd_large parisc: Handle case where flush_cache_range is called with no context ALSA: pcm: Fix UAF in snd_pcm_oss_get_formats() ALSA: hda - Revert power_save option default value ALSA: seq: Fix possible UAF in snd_seq_check_queue() ALSA: seq: Clear client entry before deleting else at closing drm/amdgpu: fix prime teardown order drm/amdgpu/dce: Don't turn off DP sink when disconnected fs: Teach path_connected to handle nfs filesystems with multiple roots. lock_parent() needs to recheck if dentry got __dentry_kill'ed under it fs/aio: Add explicit RCU grace period when freeing kioctx fs/aio: Use RCU accessors for kioctx_table->table[] irqchip/gic-v3-its: Ensure nr_ites >= nr_lpis scsi: sg: fix SG_DXFER_FROM_DEV transfers scsi: sg: fix static checker warning in sg_is_valid_dxfer scsi: sg: only check for dxfer_len greater than 256M btrfs: alloc_chunk: fix DUP stripe size handling btrfs: Fix use-after-free when cleaning up fs_devs with a single stale device scsi: qla2xxx: Fix extraneous ref on sp's after adapter break USB: gadget: udc: Add missing platform_device_put() on error in bdc_pci_probe() usb: dwc3: Fix GDBGFIFOSPACE_TYPE values usb: gadget: bdc: 64-bit pointer capability check Linux 4.9.89 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2018-03-22 09:54:47 +01:00
Mimi Zohar	27a0856c21	ima: relax requiring a file signature for new files with zero length ... [ Upstream commit b7e27bc1d42e8e0cc58b602b529c25cd0071b336 ] Custom policies can require file signatures based on LSM labels. These files are normally created and only afterwards labeled, requiring them to be signed. Instead of requiring file signatures based on LSM labels, entire filesystems could require file signatures. In this case, we need the ability of writing new files without requiring file signatures. The definition of a "new" file was originally defined as any file with a length of zero. Subsequent patches redefined a "new" file to be based on the FILE_CREATE open flag. By combining the open flag with a file size of zero, this patch relaxes the file signature requirement. Fixes: 1ac202e978e1 ima: accept previously set IMA_NEW_FILE Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2018-03-22 09:17:58 +01:00
John Johansen	d55a55bc88	apparmor: Make path_max parameter readonly ... [ Upstream commit 622f6e3265707ebf02ba776ac6e68003bcc31213 ] The path_max parameter determines the max size of buffers allocated but it should not be setable at run time. If can be used to cause an oops root@ubuntu:~# echo 16777216 > /sys/module/apparmor/parameters/path_max root@ubuntu:~# cat /sys/module/apparmor/parameters/path_max Killed [ 122.141911] BUG: unable to handle kernel paging request at ffff880080945fff [ 122.143497] IP: [<ffffffff81228844>] d_absolute_path+0x44/0xa0 [ 122.144742] PGD 220c067 PUD 0 [ 122.145453] Oops: 0002 [#1] SMP [ 122.146204] Modules linked in: vmw_vsock_vmci_transport vsock ppdev vmw_balloon snd_ens1371 btusb snd_ac97_codec gameport snd_rawmidi btrtl snd_seq_device ac97_bus btbcm btintel snd_pcm input_leds bluetooth snd_timer snd joydev soundcore serio_raw coretemp shpchp nfit parport_pc i2c_piix4 8250_fintek vmw_vmci parport mac_hid ib_iser rdma_cm iw_cm ib_cm ib_sa ib_mad ib_core ib_addr iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi autofs4 btrfs raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear hid_generic usbhid hid crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel aes_x86_64 lrw gf128mul glue_helper ablk_helper cryptd vmwgfx psmouse mptspi ttm mptscsih drm_kms_helper mptbase syscopyarea scsi_transport_spi sysfillrect [ 122.163365] ahci sysimgblt e1000 fb_sys_fops libahci drm pata_acpi fjes [ 122.164747] CPU: 3 PID: 1501 Comm: bash Not tainted 4.4.0-59-generic #80-Ubuntu [ 122.166250] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/02/2015 [ 122.168611] task: ffff88003496aa00 ti: ffff880076474000 task.ti: ffff880076474000 [ 122.170018] RIP: 0010:[<ffffffff81228844>] [<ffffffff81228844>] d_absolute_path+0x44/0xa0 [ 122.171525] RSP: 0018:ffff880076477b90 EFLAGS: 00010206 [ 122.172462] RAX: ffff880080945fff RBX: 0000000000000000 RCX: 0000000001000000 [ 122.173709] RDX: 0000000000ffffff RSI: ffff880080946000 RDI: ffff8800348a1010 [ 122.174978] RBP: ffff880076477bb8 R08: ffff880076477c80 R09: 0000000000000000 [ 122.176227] R10: 00007ffffffff000 R11: ffff88007f946000 R12: ffff88007f946000 [ 122.177496] R13: ffff880076477c80 R14: ffff8800348a1010 R15: ffff8800348a2400 [ 122.178745] FS: 00007fd459eb4700(0000) GS:ffff88007b6c0000(0000) knlGS:0000000000000000 [ 122.180176] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 122.181186] CR2: ffff880080945fff CR3: 0000000073422000 CR4: 00000000001406e0 [ 122.182469] Stack: [ 122.182843] 00ffffff00000001 ffff880080946000 0000000000000000 0000000000000000 [ 122.184409] 00000000570f789c ffff880076477c30 ffffffff81385671 ffff88007a2e7a58 [ 122.185810] 0000000000000000 ffff880076477c88 01000000008a1000 0000000000000000 [ 122.187231] Call Trace: [ 122.187680] [<ffffffff81385671>] aa_path_name+0x81/0x370 [ 122.188637] [<ffffffff813875dd>] profile_transition+0xbd/0xb80 [ 122.190181] [<ffffffff811af9bc>] ? zone_statistics+0x7c/0xa0 [ 122.191674] [<ffffffff81389b20>] apparmor_bprm_set_creds+0x9b0/0xac0 [ 122.193288] [<ffffffff812e1971>] ? ext4_xattr_get+0x81/0x220 [ 122.194793] [<ffffffff812e800c>] ? ext4_xattr_security_get+0x1c/0x30 [ 122.196392] [<ffffffff813449b9>] ? get_vfs_caps_from_disk+0x69/0x110 [ 122.198004] [<ffffffff81232d4f>] ? mnt_may_suid+0x3f/0x50 [ 122.199737] [<ffffffff81344b03>] ? cap_bprm_set_creds+0xa3/0x600 [ 122.201377] [<ffffffff81346e53>] security_bprm_set_creds+0x33/0x50 [ 122.203024] [<ffffffff81214ce5>] prepare_binprm+0x85/0x190 [ 122.204515] [<ffffffff81216545>] do_execveat_common.isra.33+0x485/0x710 [ 122.206200] [<ffffffff81216a6a>] SyS_execve+0x3a/0x50 [ 122.207615] [<ffffffff81838795>] stub_execve+0x5/0x5 [ 122.208978] [<ffffffff818384f2>] ? entry_SYSCALL_64_fastpath+0x16/0x71 [ 122.210615] Code: f8 31 c0 48 63 c2 83 ea 01 48 c7 45 e8 00 00 00 00 48 01 c6 85 d2 48 c7 45 f0 00 00 00 00 48 89 75 e0 89 55 dc 78 0c 48 8d 46 ff <c6> 46 ff 00 48 89 45 e0 48 8d 55 e0 48 8d 4d dc 48 8d 75 e8 e8 [ 122.217320] RIP [<ffffffff81228844>] d_absolute_path+0x44/0xa0 [ 122.218860] RSP <ffff880076477b90> [ 122.219919] CR2: ffff880080945fff [ 122.220936] ---[ end trace 506cdbd85eb6c55e ]--- Reported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: James Morris <james.l.morris@oracle.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2018-03-22 09:17:48 +01:00
Alexander Potapenko	b243aa88a7	selinux: check for address length in selinux_socket_bind() ... [ Upstream commit e2f586bd83177d22072b275edd4b8b872daba924 ] KMSAN (KernelMemorySanitizer, a new error detection tool) reports use of uninitialized memory in selinux_socket_bind(): ================================================================== BUG: KMSAN: use of unitialized memory inter: 0 CPU: 3 PID: 1074 Comm: packet2 Tainted: G B 4.8.0-rc6+ #1916 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 0000000000000000 ffff8800882ffb08 ffffffff825759c8 ffff8800882ffa48 ffffffff818bf551 ffffffff85bab870 0000000000000092 ffffffff85bab550 0000000000000000 0000000000000092 00000000bb0009bb 0000000000000002 Call Trace: [< inline >] __dump_stack lib/dump_stack.c:15 [<ffffffff825759c8>] dump_stack+0x238/0x290 lib/dump_stack.c:51 [<ffffffff818bdee6>] kmsan_report+0x276/0x2e0 mm/kmsan/kmsan.c:1008 [<ffffffff818bf0fb>] __msan_warning+0x5b/0xb0 mm/kmsan/kmsan_instr.c:424 [<ffffffff822dae71>] selinux_socket_bind+0xf41/0x1080 security/selinux/hooks.c:4288 [<ffffffff8229357c>] security_socket_bind+0x1ec/0x240 security/security.c:1240 [<ffffffff84265d98>] SYSC_bind+0x358/0x5f0 net/socket.c:1366 [<ffffffff84265a22>] SyS_bind+0x82/0xa0 net/socket.c:1356 [<ffffffff81005678>] do_syscall_64+0x58/0x70 arch/x86/entry/common.c:292 [<ffffffff8518217c>] entry_SYSCALL64_slow_path+0x25/0x25 arch/x86/entry/entry_64.o:? chained origin: 00000000ba6009bb [<ffffffff810bb7a7>] save_stack_trace+0x27/0x50 arch/x86/kernel/stacktrace.c:67 [< inline >] kmsan_save_stack_with_flags mm/kmsan/kmsan.c:322 [< inline >] kmsan_save_stack mm/kmsan/kmsan.c:337 [<ffffffff818bd2b8>] kmsan_internal_chain_origin+0x118/0x1e0 mm/kmsan/kmsan.c:530 [<ffffffff818bf033>] __msan_set_alloca_origin4+0xc3/0x130 mm/kmsan/kmsan_instr.c:380 [<ffffffff84265b69>] SYSC_bind+0x129/0x5f0 net/socket.c:1356 [<ffffffff84265a22>] SyS_bind+0x82/0xa0 net/socket.c:1356 [<ffffffff81005678>] do_syscall_64+0x58/0x70 arch/x86/entry/common.c:292 [<ffffffff8518217c>] return_from_SYSCALL_64+0x0/0x6a arch/x86/entry/entry_64.o:? origin description: ----address@SYSC_bind (origin=00000000b8c00900) ================================================================== (the line numbers are relative to 4.8-rc6, but the bug persists upstream) , when I run the following program as root: ======================================================= #include <string.h> #include <sys/socket.h> #include <netinet/in.h> int main(int argc, char *argv[]) { struct sockaddr addr; int size = 0; if (argc > 1) { size = atoi(argv[1]); } memset(&addr, 0, sizeof(addr)); int fd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP); bind(fd, &addr, size); return 0; } ======================================================= (for different values of |size| other error reports are printed). This happens because bind() unconditionally copies |size| bytes of |addr| to the kernel, leaving the rest uninitialized. Then security_socket_bind() reads the IP address bytes, including the uninitialized ones, to determine the port, or e.g. pass them further to sel_netnode_find(), which uses them to calculate a hash. Signed-off-by: Alexander Potapenko <glider@google.com> Acked-by: Eric Dumazet <edumazet@google.com> [PM: fixed some whitespace damage] Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2018-03-22 09:17:38 +01:00
Blagovest Kolenichev	e06a1054bd	Merge android-4.9.84 (a9d0273) into msm-4.9 ... * refs/heads/tmp-a9d0273: Linux 4.9.84 crypto: s5p-sss - Fix kernel Oops in AES-ECB mode KVM: nVMX: invvpid handling improvements KVM: VMX: clean up declaration of VPID/EPT invalidation types KVM: async_pf: Fix #DF due to inject "Page not Present" and "Page Ready" exceptions simultaneously x86/microcode/AMD: Change load_microcode_amd()'s param to bool to fix preemptibility bug usb: phy: msm add regulator dependency arm64: fix warning about swapper_pg_dir overflow idle: i7300: add PCI dependency spi: bcm-qspi: shut up warning about cfi header inclusion binfmt_elf: compat: avoid unused function warning arm64: sunxi: always enable reset controller drm/i915: hide unused intel_panel_set_backlight function kasan: rework Kconfig settings clk: meson: gxbb: fix build error without RESET_CONTROLLER ISDN: eicon: reduce stack size of sig_ind function tw5864: use dev_warn instead of WARN to shut up warning em28xx: only use mt9v011 if camera support is enabled go7007: add MEDIA_CAMERA_SUPPORT dependency tc358743: fix register i2c_rd/wr functions shmem: fix compilation warnings on unused functions KVM: add X86_LOCAL_APIC dependency Input: tca8418_keypad - hide gcc-4.9 -Wmaybe-uninitialized warning drm/nouveau: hide gcc-4.9 -Wmaybe-uninitialized rbd: silence bogus -Wmaybe-uninitialized warning drm: exynos: mark pm functions as __maybe_unused security/keys: BIG_KEY requires CONFIG_CRYPTO cw1200: fix bogus maybe-uninitialized warning reiserfs: avoid a -Wmaybe-uninitialized warning ALSA: hda/ca0132 - fix possible NULL pointer use arm64: Kconfig: select COMPAT_BINFMT_ELF only when BINFMT_ELF is set scsi: advansys: fix uninitialized data access x86/vm86: Fix unused variable warning if THP is disabled x86/platform: Add PCI dependency for PUNIT_ATOM_DEBUG dmaengine: zx: fix build warning x86: add MULTIUSER dependency for KVM thermal: fix INTEL_SOC_DTS_IOSF_CORE dependencies x86/build: Silence the build with "make -s" tools build: Add tools tree support for 'make -s' x86/fpu/math-emu: Fix possible uninitialized variable use arm64: define BUG() instruction without CONFIG_BUG gpio: xgene: mark PM functions as __maybe_unused x86/ras/inject: Make it depend on X86_LOCAL_APIC=y scsi: advansys: fix build warning for PCI=n video: fbdev: via: remove possibly unused variables perf: xgene: Include module.h PCI: Change pci_host_common_probe() visibility usb: musb: fix compilation warning on unused function platform/x86: intel_mid_thermal: Fix suspend handlers unused warning gpio: intel-mid: Fix build warning when !CONFIG_PM PCI: vmd: Fix suspend handlers defined-but-not-used warning perf/x86: Shut up false-positive -Wmaybe-uninitialized warning vmxnet3: prevent building with 64K pages clk: sunxi-ng: fix build error without CONFIG_RESET_CONTROLLER shmem: avoid maybe-uninitialized warning drm/i915: fix intel_backlight_device_register declaration crypto: talitos - fix Kernel Oops on hashing an empty file powerpc/64s: Improve RFI L1-D cache flush fallback powerpc/64s: Simple RFI macro conversions powerpc/64s: Fix conversion of slb_miss_common to use RFI_TO_USER/KERNEL hippi: Fix a Fix a possible sleep-in-atomic bug in rr_close xen: XEN_ACPI_PROCESSOR is Dom0-only platform/x86: dell-laptop: Fix keyboard max lighting for Dell Latitude E6410 x86/mm/kmmio: Fix mmiotrace for page unaligned addresses mm/early_ioremap: Fix boot hang with earlyprintk=efi,keep usb: dwc3: of-simple: fix missing clk_disable_unprepare usb: dwc3: gadget: Wait longer for controller to end command processing dmaengine: jz4740: disable/unprepare clk if probe fails drm/armada: fix leak of crtc structure xfrm: Fix stack-out-of-bounds with misconfigured transport mode policies. spi: sun4i: disable clocks in the remove function ASoC: rockchip: disable clock on error clk: fix a panic error caused by accessing NULL pointer dmaengine: at_hdmac: fix potential NULL pointer dereference in atc_prep_dma_interleaved dmaengine: ioat: Fix error handling path gianfar: Disable EEE autoneg by default 509: fix printing uninitialized stack memory when OID is empty net: ethernet: arc: fix error handling in emac_rockchip_probe brcmfmac: Avoid build error with make W=1 btrfs: Fix possible off-by-one in btrfs_search_path_in_tree net_sched: red: Avoid illegal values net_sched: red: Avoid devision by zero gianfar: fix a flooded alignment reports because of padding issue. ARM: dts: Fix elm interrupt compiler warning s390/dasd: prevent prefix I/O error powerpc/perf: Fix oops when grouping different pmu events m68k: add missing SOFTIRQENTRY_TEXT linker section ipvlan: Add the skb->mark as flow4's member to lookup route scripts/kernel-doc: Don't fail with status != 0 if error encountered with -none sctp: only update outstanding_bytes for transmitted queue when doing prsctp_prune RDMA/cma: Make sure that PSN is not over max allowed i40iw: Correct ARP index mask pinctrl: sunxi: Fix A64 UART mux value pinctrl: sunxi: Fix A80 interrupt pin bank media: s5k6aa: describe some function parameters perf bench numa: Fixup discontiguous/sparse numa nodes perf top: Fix window dimensions change handling ARM: dts: am437x-cm-t43: Correct the dmas property of spi0 ARM: dts: am4372: Correct the interrupts_properties of McASP ARM: dts: logicpd-somlv: Fix wl127x pinmux ARM: dts: logicpd-som-lv: Fix gpmc addresses for NAND and enet ARM: dts: Fix omap4 hang with GPS connected to USB by using wakeupgen ARM: AM33xx: PRM: Remove am33xx_pwrdm_read_prev_pwrst function ARM: OMAP2+: Fix SRAM virt to phys translation for save_secure_ram_context usb: build drivers/usb/common/ when USB_SUPPORT is set usbip: keep usbip_device sockfd state in sync with tcp_socket staging: iio: ad5933: switch buffer mode to software staging: iio: adc: ad7192: fix external frequency setting binder: check for binder_thread allocation failure in binder_poll() staging: android: ashmem: Fix a race condition in pin ioctls dn_getsockoptdecnet: move nf_{get/set}sockopt outside sock lock arm64: dts: add #cooling-cells to CPU nodes ARM: 8743/1: bL_switcher: add MODULE_LICENSE tag video: fbdev/mmp: add MODULE_LICENSE ASoC: ux500: add MODULE_LICENSE tag crypto: hash - prevent using keyed hashes without setting key crypto: hash - annotate algorithms taking optional key net: avoid skb_warn_bad_offload on IS_ERR rds: tcp: atomically purge entries from rds_tcp_conn_list during netns delete netfilter: xt_RATEEST: acquire xt_rateest_mutex for hash insert netfilter: xt_cgroup: initialize info->priv in cgroup_mt_check_v1() netfilter: on sockopt() acquire sock lock only in the required scope netfilter: ipt_CLUSTERIP: fix out-of-bounds accesses in clusterip_tg_check() netfilter: x_tables: avoid out-of-bounds reads in xt_request_find_{match|target} netfilter: x_tables: fix int overflow in xt_alloc_table_info() kcov: detect double association with a single task KVM: x86: fix escape of guest dr6 to the host blk_rq_map_user_iov: fix error override staging: android: ion: Switch from WARN to pr_warn staging: android: ion: Add __GFP_NOWARN for system contig heap crypto: x86/twofish-3way - Fix %rbp usage selinux: skip bounded transition processing if the policy isn't loaded selinux: ensure the context is NUL terminated in security_context_to_sid_core() Provide a function to create a NUL-terminated string from unterminated data ptr_ring: fail early if queue occupies more than KMALLOC_MAX_SIZE drm: Require __GFP_NOFAIL for the legacy drm_modeset_lock_all blktrace: fix unlocked registration of tracepoints sctp: set frag_point in sctp_setsockopt_maxseg correctly xfrm: check id proto in validate_tmpl() xfrm: Fix stack-out-of-bounds read on socket policy lookup. mm,vmscan: Make unregister_shrinker() no-op if register_shrinker() failed. xfrm: skip policies marked as dead while rehashing cfg80211: check dev_set_name() return value kcm: Only allow TCP sockets to be attached to a KCM mux kcm: Check if sk_user_data already set in kcm_attach vhost: use mutex_lock_nested() in vhost_dev_lock_vqs() ANDROID: sdcardfs: Hold i_mutex for i_size_write UPSTREAM: ANDROID: binder: synchronize_rcu() when using POLLFREE. BACKPORT, FROMGIT: crypto: speck - add test vectors for Speck64-XTS BACKPORT, FROMGIT: crypto: speck - add test vectors for Speck128-XTS BACKPORT, FROMGIT: crypto: arm/speck - add NEON-accelerated implementation of Speck-XTS FROMGIT: crypto: speck - export common helpers BACKPORT, FROMGIT: crypto: speck - add support for the Speck block cipher f2fs: updates on v4.16-rc1 Linux 4.9.83 media: r820t: fix r820t_write_reg for KASAN ARM: dts: Delete bogus reference to the charlcd arm: dts: mt2701: Add reset-cells ARM: dts: s5pv210: add interrupt-parent for ohci arm64: dts: msm8916: Add missing #phy-cells ARM: pxa/tosa-bt: add MODULE_LICENSE tag ARM: dts: exynos: fix RTC interrupt for exynos5410 vfs: don't do RCU lookup of empty pathnames x86: fix build warnign with 32-bit PAE x86/cpu: Change type of x86_cache_size variable to unsigned int x86/spectre: Fix an error message x86/cpu: Rename cpu_data.x86_mask to cpu_data.x86_stepping selftests/x86/mpx: Fix incorrect bounds with old _sigfault x86/speculation: Add <asm/msr-index.h> dependency nospec: Move array_index_nospec() parameter checking into separate macro x86/speculation: Fix up array_index_nospec_mask() asm constraint selftests/x86: Do not rely on "int $0x80" in single_step_syscall.c selftests/x86: Do not rely on "int $0x80" in test_mremap_vdso.c selftests/x86/pkeys: Remove unused functions x86/speculation: Clean up various Spectre related details X86/nVMX: Properly set spec_ctrl and pred_cmd before merging MSRs KVM/x86: Reduce retpoline performance impact in slot_handle_level_range(), by always inlining iterator helper methods x86/speculation: Correct Speculation Control microcode blacklist again x86/speculation: Update Speculation Control microcode blacklist compiler-gcc.h: Introduce __optimize function attribute x86/entry/64/compat: Clear registers for compat syscalls, to reduce speculation attack surface arm: spear13xx: Fix spics gpio controller's warning arm: spear13xx: Fix dmas cells arm: spear600: Add missing interrupt-parent of rtc ARM: dts: nomadik: add interrupt-parent for clcd ARM: dts: STi: Add gpio polarity for "hdmi,hpd-gpio" property ARM: lpc3250: fix uda1380 gpio numbers arm64: dts: msm8916: Correct ipc references for smsm s390: fix handling of -1 in set{,fs}[gu]id16 syscalls ocfs2: try a blocking lock before return AOP_TRUNCATED_PAGE PM / devfreq: Propagate error from devfreq_add_device() cpufreq: powernv: Dont assume distinct pstate values for nominal and pmin RDMA/rxe: Fix a race condition related to the QP error state kselftest: fix OOM in memory compaction test IB/mlx4: Fix incorrectly releasing steerable UD QPs when have only ETH ports IB/qib: Fix comparison error with qperf compare/swap test powerpc: fix build errors in stable tree dm: correctly handle chained bios in dec_pending() usb: Move USB_UHCI_BIG_ENDIAN_* out of USB_SUPPORT mvpp2: fix multicast address filter ALSA: seq: Fix racy pool initializations ALSA: usb-audio: add implicit fb quirk for Behringer UFX1204 ALSA: hda/realtek: PCI quirk for Fujitsu U7x7 ALSA: hda/realtek - Enable Thinkpad Dock device for ALC298 platform ALSA: usb-audio: Fix UAC2 get_ctl request with a RANGE attribute ALSA: hda - Fix headset mic detection problem for two Dell machines mtd: nand: vf610: set correct ooblayout 9p/trans_virtio: discard zero-length reply Btrfs: fix unexpected -EEXIST when creating new inode Btrfs: fix btrfs_evict_inode to handle abnormal inodes correctly Btrfs: fix extent state leak from tree log Btrfs: fix crash due to not cleaning up tree log block's dirty bits Btrfs: fix deadlock in run_delalloc_nocow target/iscsi: avoid NULL dereference in CHAP auth error path rtlwifi: rtl8821ae: Fix connection lost problem correctly console/dummy: leave .con_font_get set to NULL video: fbdev: atmel_lcdfb: fix display-timings lookup PCI: keystone: Fix interrupt-controller-node lookup MIPS: Fix typo BIG_ENDIAN to CPU_BIG_ENDIAN mm: Fix memory size alignment in devm_memremap_pages_release() mm: hide a #warning for COMPILE_TEST ext4: correct documentation for grpid mount option ext4: save error to disk in __ext4_grp_locked_error() ext4: fix a race in the ext4 shutdown path jbd2: fix sphinx kernel-doc build warnings mbcache: initialize entry->e_referenced in mb_cache_entry_create() rtc-opal: Fix handling of firmware error codes, prevent busy loops drm/radeon: adjust tested variable drm/radeon: Add dpm quirk for Jet PRO (v2) scsi: smartpqi: allow static build ("built-in") BACKPORT: tee: shm: Potential NULL dereference calling tee_shm_register() BACKPORT: tee: shm: don't put_page on null shm->pages BACKPORT: tee: shm: make function __tee_shm_alloc static BACKPORT: tee: optee: check type of registered shared memory BACKPORT: tee: add start argument to shm_register callback BACKPORT: tee: optee: fix header dependencies BACKPORT: tee: shm: inline tee_shm_get_id() BACKPORT: tee: use reference counting for tee_context BACKPORT: tee: optee: enable dynamic SHM support BACKPORT: tee: optee: add optee-specific shared pool implementation BACKPORT: tee: optee: store OP-TEE capabilities in private data BACKPORT: tee: optee: add registered buffers handling into RPC calls BACKPORT: tee: optee: add registered shared parameters handling BACKPORT: tee: optee: add shared buffer registration functions BACKPORT: tee: optee: add page list manipulation functions BACKPORT: tee: optee: Update protocol definitions BACKPORT: tee: shm: add page accessor functions BACKPORT: tee: shm: add accessors for buffer size and page offset BACKPORT: tee: add register user memory BACKPORT: tee: flexible shared memory pool creation BACKPORT: optee: support asynchronous supplicant requests BACKPORT: tee: add TEE_IOCTL_PARAM_ATTR_META BACKPORT: tee: add tee_param_is_memref() for driver use UPSTREAM: tcp: fix access to sk->sk_state in tcp_poll() BACKPORT: tcp: fix potential double free issue for fastopen_req BACKPORT: xfrm: Fix return value check of copy_sec_ctx. time: Fix ktime_get_raw() incorrect base accumulation FROMLIST: coresight: ETM: Add support for ARM Cortex-A73 FROMLIST: coresight: tmc: implementing TMC-ETR AUX space API UPSTREAM: coresight: etm_perf: Fix using uninitialised work UPSTREAM: coresight: fix kernel panic caused by invalid CPU UPSTREAM: coresight: Fix disabling of CoreSight TPIU UPSTREAM: coresight: perf: Add a missing call to etm_free_aux UPSTREAM: coresight: tmc: Remove duplicate memset UPSTREAM: coresight: tmc: Get rid of mode parameter for helper routines UPSTREAM: coresight: tmc: Cleanup operation mode handling UPSTREAM: coresight: reset "enable_sink" flag when need be sched/fair: prevent possible infinite loop in sched_group_energy ANDROID: qtaguid: Fix the UAF probelm with tag_ref_tree UPSTREAM: ANDROID: binder: remove waitqueue when thread exits. ANDROID: sdcardfs: Protect set_top ANDROID: fsnotify: Notify lower fs of open Revert "ANDROID: sdcardfs: notify lower file of opens" ANDROID: sdcardfs: Use lower getattr times/size ANDROID: sched: EAS: check energy_aware() before calling select_energy_cpu_brute() in up-migrate path UPSTREAM: eventpoll.h: add missing epoll event masks BACKPORT: thermal/drivers/hisi: Add support for hi3660 SoC BACKPORT: thermal/drivers/hisi: Prepare to add support for other hisi platforms BACKPORT: thermal/drivers/hisi: Add platform prefix to function name BACKPORT: thermal/drivers/hisi: Put platform code together BACKPORT: thermal/drivers/hisi: Use round up step value BACKPORT: thermal/drivers/hisi: Move the clk setup in the corresponding functions BACKPORT: thermal/drivers/hisi: Remove mutex_lock in the code BACKPORT: thermal/drivers/hisi: Remove thermal data back pointer BACKPORT: thermal/drivers/hisi: Convert long to int BACKPORT: thermal/drivers/hisi: Rename and remove unused field BACKPORT: thermal/drivers/hisi: Remove costly sensor inspection BACKPORT: thermal/drivers/hisi: Fix configuration register setting BACKPORT: thermal/drivers/hisi: Encapsulate register writes into helpers BACKPORT: thermal/drivers/hisi: Remove pointless lock BACKPORT: thermal/drivers/hisi: Remove the multiple sensors support BACKPORT: thermal: hisilicon: constify thermal_zone_of_device_ops structures ANDROID: xattr: Pass EOPNOTSUPP to permission2 ANDROID: sdcardfs: Move default_normal to superblock UPSTREAM: tcp: fix a request socket leak UPSTREAM: tcp: fix possible deadlock in TCP stack vs BPF filter UPSTREAM: tcp: Add a tcp_filter hook before handle ack packet FROMLIST: arm64: kpti: Fix the interaction between ASID switching and software PAN FROMLIST: arm64: Move post_ttbr_update_workaround to C code fscrypt: updates on 4.15-rc4 ANDROID: uid_sys_stats: fix the comment BACKPORT: optee: fix invalid of_node_put() in optee_driver_init() BACKPORT: tee: optee: sync with new naming of interrupts BACKPORT: tee: indicate privileged dev in gen_caps BACKPORT: tee: optee: interruptible RPC sleep BACKPORT: tee: optee: add const to tee_driver_ops and tee_desc structures BACKPORT: tee: tee_shm: Constify dma_buf_ops structures. BACKPORT: tee: add forward declaration for struct device BACKPORT: tee: optee: fix uninitialized symbol 'parg' BACKPORT: tee.txt: standardize document format BACKPORT: tee: add ARM_SMCCC dependency clocksource: arch_timer: make virtual counter access configurable arm64: issue isb when trapping CNTVCT_EL0 access BACKPORT: arm64: Add CNTFRQ_EL0 trap handler BACKPORT: arm64: Add CNTVCT_EL0 trap handler ANDROID: sdcardfs: Fix missing break on default_normal ANDROID: arm64: kaslr: fixup Falkor workaround for 4.9 ANDROID: usb: f_fs: Prevent gadget unbind if it is already unbound arm64: Kconfig: Reword UNMAP_KERNEL_AT_EL0 kconfig entry arm64: use RET instruction for exiting the trampoline UPSTREAM: arm64: kaslr: Put kernel vectors address in separate data page UPSTREAM: arm64: mm: Introduce TTBR_ASID_MASK for getting at the ASID in the TTBR UPSTREAM: arm64: Kconfig: Add CONFIG_UNMAP_KERNEL_AT_EL0 UPSTREAM: arm64: entry: Add fake CPU feature for unmapping the kernel at EL0 UPSTREAM: arm64: tls: Avoid unconditional zeroing of tpidrro_el0 for native tasks UPSTREAM: arm64: erratum: Work around Falkor erratum #E1003 in trampoline code UPSTREAM: arm64: entry: Hook up entry trampoline to exception vectors UPSTREAM: arm64: entry: Explicitly pass exception level to kernel_ventry macro UPSTREAM: arm64: mm: Map entry trampoline into trampoline and kernel page tables UPSTREAM: arm64: entry: Add exception trampoline page for exceptions from EL0 UPSTREAM: arm64: mm: Invalidate both kernel and user ASIDs when performing TLBI UPSTREAM: arm64: mm: Add arm64_kernel_unmapped_at_el0 helper UPSTREAM: arm64: mm: Allocate ASIDs in pairs UPSTREAM: arm64: mm: Fix and re-enable ARM64_SW_TTBR0_PAN UPSTREAM: arm64: mm: Rename post_ttbr0_update_workaround UPSTREAM: arm64: mm: Move ASID from TTBR0 to TTBR1 UPSTREAM: arm64: mm: Temporarily disable ARM64_SW_TTBR0_PAN UPSTREAM: arm64: mm: Use non-global mappings for kernel space UPSTREAM: arm64: factor out entry stack manipulation ANDROID: sdcardfs: Add default_normal option ANDROID: sdcardfs: notify lower file of opens blkdev: Refactoring block io latency histogram codes UPSTREAM: netfilter: conntrack: use power efficient workqueue ANDROID: binder: Remove obsolete proc waitqueue. UPSTREAM: arm64: setup: introduce kaslr_offset() UPSTREAM: kcov: fix comparison callback signature UPSTREAM: kcov: support comparison operands collection UPSTREAM: kcov: remove pointless current != NULL check UPSTREAM: kcov: support compat processes UPSTREAM: kcov: simplify interrupt check UPSTREAM: kcov: make kcov work properly with KASLR enabled UPSTREAM: kcov: add more missing includes BACKPORT: irq: Make the irqentry text section unconditional UPSTREAM: kasan: make get_wild_bug_type() static UPSTREAM: kasan: separate report parts by empty lines UPSTREAM: kasan: improve double-free report format UPSTREAM: kasan: print page description after stacks UPSTREAM: kasan: improve slab object description UPSTREAM: kasan: change report header UPSTREAM: kasan: simplify address description logic UPSTREAM: kasan: change allocation and freeing stack traces headers UPSTREAM: kasan: unify report headers UPSTREAM: kasan: introduce helper functions for determining bug type BACKPORT: kasan: report only the first error by default UPSTREAM: kasan: fix races in quarantine_remove_cache() UPSTREAM: kasan: resched in quarantine_remove_cache() UPSTREAM: kasan, sched/headers: Uninline kasan_enable/disable_current() UPSTREAM: kasan: drain quarantine of memcg slab objects UPSTREAM: kasan: eliminate long stalls during quarantine reduction UPSTREAM: kasan: support panic_on_warn ANDROID: dma-buf/sw_sync: Rename active_list to link ANDROID: initramfs: call free_initrd() when skipping init BACKPORT: Documentation: tee subsystem and op-tee driver BACKPORT: tee: add OP-TEE driver BACKPORT: tee: generic TEE subsystem BACKPORT: dt/bindings: add bindings for optee BACKPORT: schedutil: Reset cached freq if it is not in sync with next_freq sched: EAS/WALT: Don't take into account of running task's util sched: EAS/WALT: take into account of waking task's load sched: EAS: upmigrate misfit current task sched: avoid pushing tasks to an offline CPU sched: Extend active balance to accept 'push_task' argument sched: walt: Correct WALT window size initialization sched: WALT: account cumulative window demand sched: EAS/WALT: finish accounting prior to task_tick sched/fair: prevent meaningless active migration sched: walt: Leverage existing helper APIs to apply invariance UPSTREAM: net: xfrm: allow clearing socket xfrm policies. UPSTREAM: time: Clean up CLOCK_MONOTONIC_RAW time handling UPSTREAM: arm64: vdso: fix clock_getres for 4GiB-aligned res f2fs: updates on 4.15-rc1 UPSTREAM: android: binder: fix type mismatch warning BACKPORT: arm64: Use __pa_symbol for empty_zero_page UPSTREAM: arm64: Use __pa_symbol for kernel symbols UPSTREAM: mm: Introduce lm_alias FROMLIST: binder: fix proc->files use-after-free BACKPORT: xfrm: Clear sk_dst_cache when applying per-socket policy. sched: WALT: fix potential overflow sched: Update task->on_rq when tasks are moving between runqueues sched: WALT: fix window mis-alignment sched: EAS: kill incorrect nohz idle cpu kick sched: EAS: fix incorrect energy delta calculation due to rounding error sched: EAS/WALT: use cr_avg instead of prev_runnable_sum sched: WALT: fix broken cumulative runnable average accounting sched: deadline: WALT: account cumulative runnable avg ANDROID: binder: clarify deferred thread work. BACKPORT: net/tcp-fastopen: Add new API support UPSTREAM: net: Remove __sk_dst_reset() in tcp_v6_connect() UPSTREAM: net/tcp-fastopen: refactor cookie check logic sched: compute task utilisation with WALT consistently FROMLIST: arm64: Avoid aligning normal memory pointers in __memcpy_{to,from}io UPSTREAM: security: bpf: replace include of linux/bpf.h with forward declarations UPSTREAM: selinux: bpf: Add addtional check for bpf object file receive UPSTREAM: selinux: bpf: Add selinux check for eBPF syscall operations BACKPORT: security: bpf: Add LSM hooks for bpf object related syscall BACKPORT: bpf: Add file mode configuration into bpf maps cpufreq: Drop schedfreq governor ANDROID: Revert "arm64: move ELF_ET_DYN_BASE to 4GB / 4MB" ANDROID: Revert "arm: move ELF_ET_DYN_BASE to 4MB" sched: EAS: Fix the condition to distinguish energy before/after sched: EAS: update trg_cpu to backup_cpu if no energy saving for target_cpu sched/fair: consider task utilization in group_max_util() sched/fair: consider task utilization in group_norm_util() sched/fair: enforce EAS mode sched/fair: ignore backup CPU when not valid sched/fair: trace energy_diff for non boosted tasks UPSTREAM: sched/fair: Sync task util before slow-path wakeup UPSTREAM: sched/core: Add missing update_rq_clock() call in set_user_nice() UPSTREAM: sched/core: Add missing update_rq_clock() call for task_hot() UPSTREAM: sched/core: Add missing update_rq_clock() in detach_task_cfs_rq() UPSTREAM: sched/core: Add missing update_rq_clock() in post_init_entity_util_avg() UPSTREAM: sched/fair: Fix task group initialization cpufreq/sched: Consider max cpu capacity when choosing frequencies cpufreq/sched: Use cpu max freq rather than policy max sched/fair: remove erroneous RCU_LOCKDEP_WARN from start_cpu() FROMLIST: ALSA: usx2y: Suppress kernel warning at page allocation failures FROMLIST: kbuild: clang: fix build failures with sparse check Revert "Revert "BACKPORT: efi/libstub/arm64: Set -fpie when building the EFI stub"" BACKPORT: efi/libstub: Unify command line param parsing ANDROID: sched/walt: Fix divide by zero error in cpufreq notifier ANDROID: binder: show high watermark of alloc->pages. ANDROID: binder: Add thread->process_todo flag. ANDROID: sched/fair: Select correct capacity state for energy_diff ANDROID: cpufreq-dt: Set sane defaults for schedutil rate limits BACKPORT: cpufreq: schedutil: Use policy-dependent transition delays Revert "BACKPORT: efi/libstub/arm64: Set -fpie when building the EFI stub" FROMLIST: android: binder: Fix null ptr dereference in debug msg FROMLIST: android: binder: Change binder_shrinker to static UPSTREAM: arm64: compat: Remove leftover variable declaration ANDROID: HACK: arm64: use -mno-implicit-float instead of -mgeneral-regs-only ANDROID: Kbuild, LLVMLinux: allow overriding clang target triple CHROMIUM: arm64: Disable asm-operand-width warning for clang CHROMIUM: kbuild: clang: Disable the 'duplicate-decl-specifier' warning BACKPORT: x86/asm: Fix inline asm call constraints for Clang BACKPORT: efi/libstub/arm64: Set -fpie when building the EFI stub UPSTREAM: efi/libstub/arm64: Force 'hidden' visibility for section markers UPSTREAM: efi/libstub/arm64: Use hidden attribute for struct screen_info reference UPSTREAM: x86/build: Use cc-option to validate stack alignment parameter UPSTREAM: x86/build: Fix stack alignment for CLang UPSTREAM: compiler, clang: always inline when CONFIG_OPTIMIZE_INLINING is disabled UPSTREAM: x86/boot: #undef memcpy() et al in string.c UPSTREAM: llist: clang: introduce member_address_is_nonnull() UPSTREAM: crypto: arm64/sha - avoid non-standard inline asm tricks UPSTREAM: kbuild: clang: Disable 'address-of-packed-member' warning UPSTREAM: x86/build: Specify stack alignment for clang UPSTREAM: x86/build: Use __cc-option for boot code compiler options UPSTREAM: kbuild: Add __cc-option macro UPSTREAM: x86/mm/kaslr: Use the _ASM_MUL macro for multiplication to work around Clang incompatibility UPSTREAM: crypto, x86: aesni - fix token pasting for clang UPSTREAM: x86/kbuild: Use cc-option to enable -falign-{jumps/loops} UPSTREAM: compiler, clang: properly override 'inline' for clang UPSTREAM: compiler, clang: suppress warning for unused static inline functions UPSTREAM: modules: mark __inittest/__exittest as __maybe_unused UPSTREAM: kbuild: Add support to generate LLVM assembly files UPSTREAM: kbuild: use -Oz instead of -Os when using clang UPSTREAM: kbuild, LLVMLinux: Add -Werror to cc-option to support clang UPSTREAM: kbuild: drop -Wno-unknown-warning-option from clang options UPSTREAM: kbuild: fix asm-offset generation to work with clang UPSTREAM: kbuild: consolidate redundant sed script ASM offset generation UPSTREAM: kbuild: Consolidate header generation from ASM offset information UPSTREAM: kbuild: clang: add -no-integrated-as to KBUILD_[AC]FLAGS UPSTREAM: kbuild: Add better clang cross build support FROMLIST: f2fs: expose some sectors to user in inline data or dentry case UPSTREAM: sched/fair: Fix usage of find_idlest_group() when the local group is idlest UPSTREAM: sched/fair: Fix usage of find_idlest_group() when no groups are allowed UPSTREAM: sched/fair: Fix find_idlest_group() when local group is not allowed UPSTREAM: sched/fair: Remove unnecessary comparison with -1 UPSTREAM: sched/fair: Move select_task_rq_fair() slow-path into its own function UPSTREAM: sched/fair: Force balancing on NOHZ balance if local group has capacity UPSTREAM: f2fs: fix potential panic during fstrim f2fs: catch up to v4.14-rc1 UPSTREAM: sched: use load_avg for selecting idlest group UPSTREAM: sched: fix find_idlest_group for fork ANDROID: binder: fix node sched policy calculation ANDROID: binder: init desired_prio.sched_policy before use it BACKPORT: net: xfrm: support setting an output mark. FROMLIST: tracing: Add support for preempt and irq enable/disable events FROMLIST: tracing: Prepare to add preempt and irq trace events Conflicts: arch/arm64/Kconfig arch/arm64/include/asm/assembler.h arch/arm64/include/asm/cpucaps.h arch/arm64/include/asm/efi.h arch/arm64/include/asm/memory.h arch/arm64/include/asm/mmu.h arch/arm64/include/asm/mmu_context.h arch/arm64/kernel/cpufeature.c arch/arm64/kernel/io.c arch/arm64/kernel/setup.c arch/arm64/kernel/vdso.c arch/arm64/mm/context.c arch/arm64/mm/mmu.c drivers/Kconfig drivers/Makefile drivers/cpufreq/Kconfig drivers/hwtracing/coresight/coresight-etm4x.c drivers/hwtracing/coresight/coresight-priv.h drivers/hwtracing/coresight/coresight-tmc-etr.c drivers/hwtracing/coresight/coresight.c drivers/scsi/ufs/ufshcd.h drivers/staging/android/ion/ion-ioctl.c drivers/staging/android/ion/ion_system_heap.c drivers/usb/dwc3/gadget.c include/linux/sched.h include/trace/events/sched.h kernel/kcov.c kernel/sched/core.c kernel/sched/cpufreq_sched.c kernel/sched/cpufreq_schedutil.c kernel/sched/fair.c kernel/sched/sched.h kernel/sched/walt.c kernel/sched/walt.h mm/kasan/report.c security/security.c security/selinux/hooks.c Change-Id: I0ec8cbca6cb6384e22fbbe8def8a9d228229dc48 Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>	2018-03-19 04:18:31 -07:00
Blagovest Kolenichev	fe5289af24	Revert "Enable HW File Based Encryption on ext4 file system" ... This reverts commit 7b939265f4. This is temporary due to hard conflicts against android-4.9.84. Intake is switched from android-4.9-o to android-4.9 with LSK tag 4.9.84 and more time is needed to rework the FBE changeset [1] according to the new upstream changes coming from android-4.9. [1] c23efa5 security: pfk: Error code was overwritten 7b93926 Enable HW File Based Encryption on ext4 file system Change-Id: I6b539a549fe0016339558025807910c3946f1daf Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>	2018-03-19 04:09:28 -07:00
Blagovest Kolenichev	f689e9e0a4	Revert "security: pfk: Error code was overwritten" ... This reverts commit c23efa56f6. This is temporary due to hard conflicts against android-4.9.84. Intake is switched from android-4.9-o to android-4.9 with LSK tag 4.9.84 and more time is needed to rework the FBE changeset [1] according to the new upstream changes coming from android-4.9. [1] c23efa5 security: pfk: Error code was overwritten 7b93926 Enable HW File Based Encryption on ext4 file system Change-Id: Iadb627691de77c195eb8644b2e9329ed9b764d64 Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>	2018-03-19 03:41:27 -07:00
Kees Cook	24da2c84bd	BACKPORT: treewide: Fix function prototypes for module_param_call() ... Several function prototypes for the set/get functions defined by module_param_call() have a slightly wrong argument types. This fixes those in an effort to clean up the calls when running under type-enforced compiler instrumentation for CFI. This is the result of running the following semantic patch: @match_module_param_call_function@ declarer name module_param_call; identifier _name, _set_func, _get_func; expression _arg, _mode; @@ module_param_call(_name, _set_func, _get_func, _arg, _mode); @fix_set_prototype depends on match_module_param_call_function@ identifier match_module_param_call_function._set_func; identifier _val, _param; type _val_type, _param_type; @@ int _set_func( -_val_type _val +const char * _val , -_param_type _param +const struct kernel_param * _param ) { ... } @fix_get_prototype depends on match_module_param_call_function@ identifier match_module_param_call_function._get_func; identifier _val, _param; type _val_type, _param_type; @@ int _get_func( -_val_type _val +char * _val , -_param_type _param +const struct kernel_param * _param ) { ... } Two additional by-hand changes are included for places where the above Coccinelle script didn't notice them: drivers/platform/x86/thinkpad_acpi.c fs/lockd/svc.c Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Jessica Yu <jeyu@kernel.org> Bug: 67506682 Change-Id: I2c9c0ee8ed28065e63270a52c155e5e7d2791295 (cherry picked from commit e4dca7b7aa08b22893c45485d222b5807c1375ae) Signed-off-by: Sami Tolvanen <samitolvanen@google.com>	2018-02-28 15:09:58 -08:00
Greg Kroah-Hartman	a9d027374a	Merge 4.9.84 into android-4.9 ... Changes in 4.9.84 vhost: use mutex_lock_nested() in vhost_dev_lock_vqs() kcm: Check if sk_user_data already set in kcm_attach kcm: Only allow TCP sockets to be attached to a KCM mux cfg80211: check dev_set_name() return value xfrm: skip policies marked as dead while rehashing mm,vmscan: Make unregister_shrinker() no-op if register_shrinker() failed. xfrm: Fix stack-out-of-bounds read on socket policy lookup. xfrm: check id proto in validate_tmpl() sctp: set frag_point in sctp_setsockopt_maxseg correctly blktrace: fix unlocked registration of tracepoints drm: Require __GFP_NOFAIL for the legacy drm_modeset_lock_all ptr_ring: fail early if queue occupies more than KMALLOC_MAX_SIZE Provide a function to create a NUL-terminated string from unterminated data selinux: ensure the context is NUL terminated in security_context_to_sid_core() selinux: skip bounded transition processing if the policy isn't loaded crypto: x86/twofish-3way - Fix %rbp usage staging: android: ion: Add __GFP_NOWARN for system contig heap staging: android: ion: Switch from WARN to pr_warn blk_rq_map_user_iov: fix error override KVM: x86: fix escape of guest dr6 to the host kcov: detect double association with a single task netfilter: x_tables: fix int overflow in xt_alloc_table_info() netfilter: x_tables: avoid out-of-bounds reads in xt_request_find_{match|target} netfilter: ipt_CLUSTERIP: fix out-of-bounds accesses in clusterip_tg_check() netfilter: on sockopt() acquire sock lock only in the required scope netfilter: xt_cgroup: initialize info->priv in cgroup_mt_check_v1() netfilter: xt_RATEEST: acquire xt_rateest_mutex for hash insert rds: tcp: atomically purge entries from rds_tcp_conn_list during netns delete net: avoid skb_warn_bad_offload on IS_ERR crypto: hash - annotate algorithms taking optional key crypto: hash - prevent using keyed hashes without setting key ASoC: ux500: add MODULE_LICENSE tag video: fbdev/mmp: add MODULE_LICENSE ARM: 8743/1: bL_switcher: add MODULE_LICENSE tag arm64: dts: add #cooling-cells to CPU nodes dn_getsockoptdecnet: move nf_{get/set}sockopt outside sock lock staging: android: ashmem: Fix a race condition in pin ioctls binder: check for binder_thread allocation failure in binder_poll() staging: iio: adc: ad7192: fix external frequency setting staging: iio: ad5933: switch buffer mode to software usbip: keep usbip_device sockfd state in sync with tcp_socket usb: build drivers/usb/common/ when USB_SUPPORT is set ARM: OMAP2+: Fix SRAM virt to phys translation for save_secure_ram_context ARM: AM33xx: PRM: Remove am33xx_pwrdm_read_prev_pwrst function ARM: dts: Fix omap4 hang with GPS connected to USB by using wakeupgen ARM: dts: logicpd-som-lv: Fix gpmc addresses for NAND and enet ARM: dts: logicpd-somlv: Fix wl127x pinmux ARM: dts: am4372: Correct the interrupts_properties of McASP ARM: dts: am437x-cm-t43: Correct the dmas property of spi0 perf top: Fix window dimensions change handling perf bench numa: Fixup discontiguous/sparse numa nodes media: s5k6aa: describe some function parameters pinctrl: sunxi: Fix A80 interrupt pin bank pinctrl: sunxi: Fix A64 UART mux value i40iw: Correct ARP index mask RDMA/cma: Make sure that PSN is not over max allowed sctp: only update outstanding_bytes for transmitted queue when doing prsctp_prune scripts/kernel-doc: Don't fail with status != 0 if error encountered with -none ipvlan: Add the skb->mark as flow4's member to lookup route m68k: add missing SOFTIRQENTRY_TEXT linker section powerpc/perf: Fix oops when grouping different pmu events s390/dasd: prevent prefix I/O error ARM: dts: Fix elm interrupt compiler warning gianfar: fix a flooded alignment reports because of padding issue. net_sched: red: Avoid devision by zero net_sched: red: Avoid illegal values btrfs: Fix possible off-by-one in btrfs_search_path_in_tree brcmfmac: Avoid build error with make W=1 net: ethernet: arc: fix error handling in emac_rockchip_probe 509: fix printing uninitialized stack memory when OID is empty gianfar: Disable EEE autoneg by default dmaengine: ioat: Fix error handling path dmaengine: at_hdmac: fix potential NULL pointer dereference in atc_prep_dma_interleaved clk: fix a panic error caused by accessing NULL pointer ASoC: rockchip: disable clock on error spi: sun4i: disable clocks in the remove function xfrm: Fix stack-out-of-bounds with misconfigured transport mode policies. drm/armada: fix leak of crtc structure dmaengine: jz4740: disable/unprepare clk if probe fails usb: dwc3: gadget: Wait longer for controller to end command processing usb: dwc3: of-simple: fix missing clk_disable_unprepare mm/early_ioremap: Fix boot hang with earlyprintk=efi,keep x86/mm/kmmio: Fix mmiotrace for page unaligned addresses platform/x86: dell-laptop: Fix keyboard max lighting for Dell Latitude E6410 xen: XEN_ACPI_PROCESSOR is Dom0-only hippi: Fix a Fix a possible sleep-in-atomic bug in rr_close powerpc/64s: Fix conversion of slb_miss_common to use RFI_TO_USER/KERNEL powerpc/64s: Simple RFI macro conversions powerpc/64s: Improve RFI L1-D cache flush fallback crypto: talitos - fix Kernel Oops on hashing an empty file drm/i915: fix intel_backlight_device_register declaration shmem: avoid maybe-uninitialized warning clk: sunxi-ng: fix build error without CONFIG_RESET_CONTROLLER vmxnet3: prevent building with 64K pages perf/x86: Shut up false-positive -Wmaybe-uninitialized warning PCI: vmd: Fix suspend handlers defined-but-not-used warning gpio: intel-mid: Fix build warning when !CONFIG_PM platform/x86: intel_mid_thermal: Fix suspend handlers unused warning usb: musb: fix compilation warning on unused function PCI: Change pci_host_common_probe() visibility perf: xgene: Include module.h video: fbdev: via: remove possibly unused variables scsi: advansys: fix build warning for PCI=n x86/ras/inject: Make it depend on X86_LOCAL_APIC=y gpio: xgene: mark PM functions as __maybe_unused arm64: define BUG() instruction without CONFIG_BUG x86/fpu/math-emu: Fix possible uninitialized variable use tools build: Add tools tree support for 'make -s' x86/build: Silence the build with "make -s" thermal: fix INTEL_SOC_DTS_IOSF_CORE dependencies x86: add MULTIUSER dependency for KVM dmaengine: zx: fix build warning x86/platform: Add PCI dependency for PUNIT_ATOM_DEBUG x86/vm86: Fix unused variable warning if THP is disabled scsi: advansys: fix uninitialized data access arm64: Kconfig: select COMPAT_BINFMT_ELF only when BINFMT_ELF is set ALSA: hda/ca0132 - fix possible NULL pointer use reiserfs: avoid a -Wmaybe-uninitialized warning cw1200: fix bogus maybe-uninitialized warning security/keys: BIG_KEY requires CONFIG_CRYPTO drm: exynos: mark pm functions as __maybe_unused rbd: silence bogus -Wmaybe-uninitialized warning drm/nouveau: hide gcc-4.9 -Wmaybe-uninitialized Input: tca8418_keypad - hide gcc-4.9 -Wmaybe-uninitialized warning KVM: add X86_LOCAL_APIC dependency shmem: fix compilation warnings on unused functions tc358743: fix register i2c_rd/wr functions go7007: add MEDIA_CAMERA_SUPPORT dependency em28xx: only use mt9v011 if camera support is enabled tw5864: use dev_warn instead of WARN to shut up warning ISDN: eicon: reduce stack size of sig_ind function clk: meson: gxbb: fix build error without RESET_CONTROLLER kasan: rework Kconfig settings drm/i915: hide unused intel_panel_set_backlight function arm64: sunxi: always enable reset controller binfmt_elf: compat: avoid unused function warning spi: bcm-qspi: shut up warning about cfi header inclusion idle: i7300: add PCI dependency arm64: fix warning about swapper_pg_dir overflow usb: phy: msm add regulator dependency x86/microcode/AMD: Change load_microcode_amd()'s param to bool to fix preemptibility bug KVM: async_pf: Fix #DF due to inject "Page not Present" and "Page Ready" exceptions simultaneously KVM: VMX: clean up declaration of VPID/EPT invalidation types KVM: nVMX: invvpid handling improvements crypto: s5p-sss - Fix kernel Oops in AES-ECB mode Linux 4.9.84 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2018-02-26 09:18:03 +01:00
Arnd Bergmann	077463be4f	security/keys: BIG_KEY requires CONFIG_CRYPTO ... commit 3cd18d1981731d5f74b8e437009124ac99905d14 upstream. The recent rework introduced a possible randconfig build failure when CONFIG_CRYPTO configured to only allow modules: security/keys/big_key.o: In function `big_key_crypt': big_key.c:(.text+0x29f): undefined reference to `crypto_aead_setkey' security/keys/big_key.o: In function `big_key_init': big_key.c:(.init.text+0x1a): undefined reference to `crypto_alloc_aead' big_key.c:(.init.text+0x45): undefined reference to `crypto_aead_setauthsize' big_key.c:(.init.text+0x77): undefined reference to `crypto_destroy_tfm' crypto/gcm.o: In function `gcm_hash_crypt_remain_continue': gcm.c:(.text+0x167): undefined reference to `crypto_ahash_finup' crypto/gcm.o: In function `crypto_gcm_exit_tfm': gcm.c:(.text+0x847): undefined reference to `crypto_destroy_tfm' When we 'select CRYPTO' like the other users, we always get a configuration that builds. Fixes: 428490e38b2e ("security/keys: rewrite all of big_key crypto") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2018-02-25 11:05:53 +01:00
Paul Moore	5e6f51aac1	selinux: skip bounded transition processing if the policy isn't loaded ... commit 4b14752ec4e0d87126e636384cf37c8dd9df157c upstream. We can't do anything reasonable in security_bounded_transition() if we don't have a policy loaded, and in fact we could run into problems with some of the code inside expecting a policy. Fix these problems like we do many others in security/selinux/ss/services.c by checking to see if the policy is loaded (ss_initialized) and returning quickly if it isn't. Reported-by: syzbot <syzkaller-bugs@googlegroups.com> Signed-off-by: Paul Moore <paul@paul-moore.com> Acked-by: Stephen Smalley <sds@tycho.nsa.gov> Reviewed-by: James Morris <james.l.morris@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2018-02-25 11:05:42 +01:00
Paul Moore	fe1cb580e8	selinux: ensure the context is NUL terminated in security_context_to_sid_core() ... commit ef28df55ac27e1e5cd122e19fa311d886d47a756 upstream. The syzbot/syzkaller automated tests found a problem in security_context_to_sid_core() during early boot (before we load the SELinux policy) where we could potentially feed context strings without NUL terminators into the strcmp() function. We already guard against this during normal operation (after the SELinux policy has been loaded) by making a copy of the context strings and explicitly adding a NUL terminator to the end. The patch extends this protection to the early boot case (no loaded policy) by moving the context copy earlier in security_context_to_sid_core(). Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: Paul Moore <paul@paul-moore.com> Reviewed-By: William Roberts <william.c.roberts@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2018-02-25 11:05:41 +01:00
Blagovest Kolenichev	8d33d083a2	Merge android-4.9-o.81 (1b9d719) into msm-4.9 ... * refs/heads/tmp-1b9d719: Linux 4.9.81 x86/microcode: Do the family check first drm: rcar-du: Fix race condition when disabling planes at CRTC stop drm: rcar-du: Use the VBK interrupt for vblank events ASoC: rsnd: avoid duplicate free_irq() ASoC: rsnd: don't call free_irq() on Parent SSI ASoC: simple-card: Fix misleading error message crypto: tcrypt - fix S/G table for test_aead_speed() KVM/SVM: Allow direct access to MSR_IA32_SPEC_CTRL KVM/VMX: Allow direct access to MSR_IA32_SPEC_CTRL KVM/VMX: Emulate MSR_IA32_ARCH_CAPABILITIES KVM/x86: Add IBPB support KVM: VMX: make MSR bitmaps per-VCPU KVM: VMX: introduce alloc_loaded_vmcs KVM: nVMX: Eliminate vmcs02 pool KVM: nVMX: mark vmcs12 pages dirty on L2 exit KVM: nVMX: vmx_complete_nested_posted_interrupt() can't fail KVM: nVMX: kmap() can't fail x86/speculation: Fix typo IBRS_ATT, which should be IBRS_ALL x86/pti: Mark constant arrays as __initconst x86/spectre: Simplify spectre_v2 command line parsing x86/retpoline: Avoid retpolines for built-in __init functions x86/kvm: Update spectre-v1 mitigation x86/paravirt: Remove 'noreplace-paravirt' cmdline option x86/cpuid: Fix up "virtual" IBRS/IBPB/STIBP feature bits on Intel x86/spectre: Fix spelling mistake: "vunerable"-> "vulnerable" x86/spectre: Report get_user mitigation for spectre_v1 nl80211: Sanitize array index in parse_txq_params vfs, fdtable: Prevent bounds-check bypass via speculative execution x86/syscall: Sanitize syscall table de-references under speculation x86/get_user: Use pointer masking to limit speculation x86/uaccess: Use __uaccess_begin_nospec() and uaccess_try_nospec x86/usercopy: Replace open coded stac/clac with __uaccess_{begin, end} x86: Introduce __uaccess_begin_nospec() and uaccess_try_nospec x86: Introduce barrier_nospec x86: Implement array_index_mask_nospec array_index_nospec: Sanitize speculative array de-references Documentation: Document array_index_nospec x86/asm: Move 'status' from thread_struct to thread_info x86/entry/64: Push extra regs right away x86/entry/64: Remove the SYSCALL64 fast path x86/spectre: Check CONFIG_RETPOLINE in command line parser x86/retpoline: Simplify vmexit_fill_RSB() x86/cpufeatures: Clean up Spectre v2 related CPUID flags x86/cpu/bugs: Make retpoline module warning conditional x86/bugs: Drop one "mitigation" from dmesg x86/nospec: Fix header guards names x86/speculation: Add basic IBPB (Indirect Branch Prediction Barrier) support x86/cpufeature: Blacklist SPEC_CTRL/PRED_CMD on early Spectre v2 microcodes x86/pti: Do not enable PTI on CPUs which are not vulnerable to Meltdown x86/msr: Add definitions for new speculation control MSRs x86/cpufeatures: Add AMD feature bits for Speculation Control x86/cpufeatures: Add Intel feature bits for Speculation Control x86/cpufeatures: Add CPUID_7_EDX CPUID leaf module/retpoline: Warn about missing retpoline in module KVM: VMX: Make indirect call speculation safe KVM: x86: Make indirect calls in emulator speculation safe x86/retpoline: Remove the esp/rsp thunk KEYS: encrypted: fix buffer overread in valid_master_desc() b43: Add missing MODULE_FIRMWARE() media: soc_camera: soc_scale_crop: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE x86/microcode/AMD: Do not load when running on a hypervisor x86/asm: Fix inline asm call constraints for GCC 4.4 soreuseport: fix mem leak in reuseport_add_sock() ipv6: Fix SO_REUSEPORT UDP socket with implicit sk_ipv6only cls_u32: add missing RCU annotation. tcp_bbr: fix pacing_gain to always be unity when using lt_bw vhost_net: stop device during reset owner tcp: release sk_frag.page in tcp_disconnect r8169: fix RTL8168EP take too long to complete driver initialization. qmi_wwan: Add support for Quectel EP06 qlcnic: fix deadlock bug net: igmp: add a missing rcu locking section ip6mr: fix stale iterator serial: core: mark port as initialized after successful IRQ change kaiser: allocate pgd with order 0 when pti=off x86/pti: Make unpoison of pgd for trusted boot work for real kaiser: fix intel_bts perf crashes ASoC: pcm512x: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE pinctrl: pxa: pxa2xx: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE auxdisplay: img-ascii-lcd: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE powerpc/64s: Allow control of RFI flush via debugfs powerpc/64s: Wire up cpu_show_meltdown() powerpc/powernv: Check device-tree for RFI flush settings powerpc/pseries: Query hypervisor for RFI flush settings powerpc/64s: Support disabling RFI flush with no_rfi_flush and nopti powerpc/64s: Add support for RFI flush of L1-D cache powerpc/64s: Convert slb_miss_common to use RFI_TO_USER/KERNEL powerpc/64: Convert the syscall exit path to use RFI_TO_USER/KERNEL powerpc/64: Convert fast_exception_return to use RFI_TO_USER/KERNEL powerpc/64: Add macros for annotating the destination of rfid/hrfid powerpc/pseries: Add H_GET_CPU_CHARACTERISTICS flags & wrapper sched/fair: prevent possible infinite loop in sched_group_energy ANDROID: qtaguid: Fix the UAF probelm with tag_ref_tree Conflicts: kernel/sched/fair.c Change-Id: I32559a9e5fee34df4f6e50e54032189afe4db613 Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>	2018-02-14 01:50:45 -08:00
Greg Kroah-Hartman	1b9d719b0b	Merge 4.9.81 into android-4.9-o ... Changes in 4.9.81 powerpc/pseries: Add H_GET_CPU_CHARACTERISTICS flags & wrapper powerpc/64: Add macros for annotating the destination of rfid/hrfid powerpc/64: Convert fast_exception_return to use RFI_TO_USER/KERNEL powerpc/64: Convert the syscall exit path to use RFI_TO_USER/KERNEL powerpc/64s: Convert slb_miss_common to use RFI_TO_USER/KERNEL powerpc/64s: Add support for RFI flush of L1-D cache powerpc/64s: Support disabling RFI flush with no_rfi_flush and nopti powerpc/pseries: Query hypervisor for RFI flush settings powerpc/powernv: Check device-tree for RFI flush settings powerpc/64s: Wire up cpu_show_meltdown() powerpc/64s: Allow control of RFI flush via debugfs auxdisplay: img-ascii-lcd: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE pinctrl: pxa: pxa2xx: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE ASoC: pcm512x: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE kaiser: fix intel_bts perf crashes x86/pti: Make unpoison of pgd for trusted boot work for real kaiser: allocate pgd with order 0 when pti=off serial: core: mark port as initialized after successful IRQ change ip6mr: fix stale iterator net: igmp: add a missing rcu locking section qlcnic: fix deadlock bug qmi_wwan: Add support for Quectel EP06 r8169: fix RTL8168EP take too long to complete driver initialization. tcp: release sk_frag.page in tcp_disconnect vhost_net: stop device during reset owner tcp_bbr: fix pacing_gain to always be unity when using lt_bw cls_u32: add missing RCU annotation. ipv6: Fix SO_REUSEPORT UDP socket with implicit sk_ipv6only soreuseport: fix mem leak in reuseport_add_sock() x86/asm: Fix inline asm call constraints for GCC 4.4 x86/microcode/AMD: Do not load when running on a hypervisor media: soc_camera: soc_scale_crop: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE b43: Add missing MODULE_FIRMWARE() KEYS: encrypted: fix buffer overread in valid_master_desc() x86/retpoline: Remove the esp/rsp thunk KVM: x86: Make indirect calls in emulator speculation safe KVM: VMX: Make indirect call speculation safe module/retpoline: Warn about missing retpoline in module x86/cpufeatures: Add CPUID_7_EDX CPUID leaf x86/cpufeatures: Add Intel feature bits for Speculation Control x86/cpufeatures: Add AMD feature bits for Speculation Control x86/msr: Add definitions for new speculation control MSRs x86/pti: Do not enable PTI on CPUs which are not vulnerable to Meltdown x86/cpufeature: Blacklist SPEC_CTRL/PRED_CMD on early Spectre v2 microcodes x86/speculation: Add basic IBPB (Indirect Branch Prediction Barrier) support x86/nospec: Fix header guards names x86/bugs: Drop one "mitigation" from dmesg x86/cpu/bugs: Make retpoline module warning conditional x86/cpufeatures: Clean up Spectre v2 related CPUID flags x86/retpoline: Simplify vmexit_fill_RSB() x86/spectre: Check CONFIG_RETPOLINE in command line parser x86/entry/64: Remove the SYSCALL64 fast path x86/entry/64: Push extra regs right away x86/asm: Move 'status' from thread_struct to thread_info Documentation: Document array_index_nospec array_index_nospec: Sanitize speculative array de-references x86: Implement array_index_mask_nospec x86: Introduce barrier_nospec x86: Introduce __uaccess_begin_nospec() and uaccess_try_nospec x86/usercopy: Replace open coded stac/clac with __uaccess_{begin, end} x86/uaccess: Use __uaccess_begin_nospec() and uaccess_try_nospec x86/get_user: Use pointer masking to limit speculation x86/syscall: Sanitize syscall table de-references under speculation vfs, fdtable: Prevent bounds-check bypass via speculative execution nl80211: Sanitize array index in parse_txq_params x86/spectre: Report get_user mitigation for spectre_v1 x86/spectre: Fix spelling mistake: "vunerable"-> "vulnerable" x86/cpuid: Fix up "virtual" IBRS/IBPB/STIBP feature bits on Intel x86/paravirt: Remove 'noreplace-paravirt' cmdline option x86/kvm: Update spectre-v1 mitigation x86/retpoline: Avoid retpolines for built-in __init functions x86/spectre: Simplify spectre_v2 command line parsing x86/pti: Mark constant arrays as __initconst x86/speculation: Fix typo IBRS_ATT, which should be IBRS_ALL KVM: nVMX: kmap() can't fail KVM: nVMX: vmx_complete_nested_posted_interrupt() can't fail KVM: nVMX: mark vmcs12 pages dirty on L2 exit KVM: nVMX: Eliminate vmcs02 pool KVM: VMX: introduce alloc_loaded_vmcs KVM: VMX: make MSR bitmaps per-VCPU KVM/x86: Add IBPB support KVM/VMX: Emulate MSR_IA32_ARCH_CAPABILITIES KVM/VMX: Allow direct access to MSR_IA32_SPEC_CTRL KVM/SVM: Allow direct access to MSR_IA32_SPEC_CTRL crypto: tcrypt - fix S/G table for test_aead_speed() ASoC: simple-card: Fix misleading error message ASoC: rsnd: don't call free_irq() on Parent SSI ASoC: rsnd: avoid duplicate free_irq() drm: rcar-du: Use the VBK interrupt for vblank events drm: rcar-du: Fix race condition when disabling planes at CRTC stop x86/microcode: Do the family check first Linux 4.9.81 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2018-02-13 12:59:08 +01:00
Greg Kroah-Hartman	f8bbe517d0	Merge 4.9.81 into android-4.9 ... Changes in 4.9.81 powerpc/pseries: Add H_GET_CPU_CHARACTERISTICS flags & wrapper powerpc/64: Add macros for annotating the destination of rfid/hrfid powerpc/64: Convert fast_exception_return to use RFI_TO_USER/KERNEL powerpc/64: Convert the syscall exit path to use RFI_TO_USER/KERNEL powerpc/64s: Convert slb_miss_common to use RFI_TO_USER/KERNEL powerpc/64s: Add support for RFI flush of L1-D cache powerpc/64s: Support disabling RFI flush with no_rfi_flush and nopti powerpc/pseries: Query hypervisor for RFI flush settings powerpc/powernv: Check device-tree for RFI flush settings powerpc/64s: Wire up cpu_show_meltdown() powerpc/64s: Allow control of RFI flush via debugfs auxdisplay: img-ascii-lcd: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE pinctrl: pxa: pxa2xx: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE ASoC: pcm512x: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE kaiser: fix intel_bts perf crashes x86/pti: Make unpoison of pgd for trusted boot work for real kaiser: allocate pgd with order 0 when pti=off serial: core: mark port as initialized after successful IRQ change ip6mr: fix stale iterator net: igmp: add a missing rcu locking section qlcnic: fix deadlock bug qmi_wwan: Add support for Quectel EP06 r8169: fix RTL8168EP take too long to complete driver initialization. tcp: release sk_frag.page in tcp_disconnect vhost_net: stop device during reset owner tcp_bbr: fix pacing_gain to always be unity when using lt_bw cls_u32: add missing RCU annotation. ipv6: Fix SO_REUSEPORT UDP socket with implicit sk_ipv6only soreuseport: fix mem leak in reuseport_add_sock() x86/asm: Fix inline asm call constraints for GCC 4.4 x86/microcode/AMD: Do not load when running on a hypervisor media: soc_camera: soc_scale_crop: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE b43: Add missing MODULE_FIRMWARE() KEYS: encrypted: fix buffer overread in valid_master_desc() x86/retpoline: Remove the esp/rsp thunk KVM: x86: Make indirect calls in emulator speculation safe KVM: VMX: Make indirect call speculation safe module/retpoline: Warn about missing retpoline in module x86/cpufeatures: Add CPUID_7_EDX CPUID leaf x86/cpufeatures: Add Intel feature bits for Speculation Control x86/cpufeatures: Add AMD feature bits for Speculation Control x86/msr: Add definitions for new speculation control MSRs x86/pti: Do not enable PTI on CPUs which are not vulnerable to Meltdown x86/cpufeature: Blacklist SPEC_CTRL/PRED_CMD on early Spectre v2 microcodes x86/speculation: Add basic IBPB (Indirect Branch Prediction Barrier) support x86/nospec: Fix header guards names x86/bugs: Drop one "mitigation" from dmesg x86/cpu/bugs: Make retpoline module warning conditional x86/cpufeatures: Clean up Spectre v2 related CPUID flags x86/retpoline: Simplify vmexit_fill_RSB() x86/spectre: Check CONFIG_RETPOLINE in command line parser x86/entry/64: Remove the SYSCALL64 fast path x86/entry/64: Push extra regs right away x86/asm: Move 'status' from thread_struct to thread_info Documentation: Document array_index_nospec array_index_nospec: Sanitize speculative array de-references x86: Implement array_index_mask_nospec x86: Introduce barrier_nospec x86: Introduce __uaccess_begin_nospec() and uaccess_try_nospec x86/usercopy: Replace open coded stac/clac with __uaccess_{begin, end} x86/uaccess: Use __uaccess_begin_nospec() and uaccess_try_nospec x86/get_user: Use pointer masking to limit speculation x86/syscall: Sanitize syscall table de-references under speculation vfs, fdtable: Prevent bounds-check bypass via speculative execution nl80211: Sanitize array index in parse_txq_params x86/spectre: Report get_user mitigation for spectre_v1 x86/spectre: Fix spelling mistake: "vunerable"-> "vulnerable" x86/cpuid: Fix up "virtual" IBRS/IBPB/STIBP feature bits on Intel x86/paravirt: Remove 'noreplace-paravirt' cmdline option x86/kvm: Update spectre-v1 mitigation x86/retpoline: Avoid retpolines for built-in __init functions x86/spectre: Simplify spectre_v2 command line parsing x86/pti: Mark constant arrays as __initconst x86/speculation: Fix typo IBRS_ATT, which should be IBRS_ALL KVM: nVMX: kmap() can't fail KVM: nVMX: vmx_complete_nested_posted_interrupt() can't fail KVM: nVMX: mark vmcs12 pages dirty on L2 exit KVM: nVMX: Eliminate vmcs02 pool KVM: VMX: introduce alloc_loaded_vmcs KVM: VMX: make MSR bitmaps per-VCPU KVM/x86: Add IBPB support KVM/VMX: Emulate MSR_IA32_ARCH_CAPABILITIES KVM/VMX: Allow direct access to MSR_IA32_SPEC_CTRL KVM/SVM: Allow direct access to MSR_IA32_SPEC_CTRL crypto: tcrypt - fix S/G table for test_aead_speed() ASoC: simple-card: Fix misleading error message ASoC: rsnd: don't call free_irq() on Parent SSI ASoC: rsnd: avoid duplicate free_irq() drm: rcar-du: Use the VBK interrupt for vblank events drm: rcar-du: Fix race condition when disabling planes at CRTC stop x86/microcode: Do the family check first Linux 4.9.81 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2018-02-13 12:57:29 +01:00
Eric Biggers	9692602ab8	KEYS: encrypted: fix buffer overread in valid_master_desc() ... commit 794b4bc292f5d31739d89c0202c54e7dc9bc3add upstream. With the 'encrypted' key type it was possible for userspace to provide a data blob ending with a master key description shorter than expected, e.g. 'keyctl add encrypted desc "new x" @s'. When validating such a master key description, validate_master_desc() could read beyond the end of the buffer. Fix this by using strncmp() instead of memcmp(). [Also clean up the code to deduplicate some logic.] Cc: Mimi Zohar <zohar@linux.vnet.ibm.com> Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: James Morris <james.l.morris@oracle.com> Signed-off-by: Jin Qian <jinqian@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2018-02-13 12:35:57 +01:00
Linux Build Service Account	08c78f8124	Merge "security: pfk: Error code was overwritten"	2018-02-09 16:29:32 -08:00
Linux Build Service Account	3b7febaea4	Merge "selinux: Relocate ss_initialized to a separate 4k page"	2018-02-09 16:28:36 -08:00
Neeraj Soni	c23efa56f6	security: pfk: Error code was overwritten ... Invalidate scm calls overwrites set key call error code in case set key call has failed. Change-Id: I9c9d9026ab1f5c593f78fd0e592e2270aa28292c Signed-off-by: Neeraj Soni <neersoni@codeaurora.org>	2018-02-08 16:22:55 +05:30
Linux Build Service Account	b82affb897	Merge "Merge android-4.9-o.77 (dcb2674) into msm-4.9"	2018-01-26 18:15:42 -08:00
Blagovest Kolenichev	5d703979bf	Merge android-4.9-o.75 (2007563) into msm-4.9 ... * refs/heads/tmp-2007563: Linux 4.9.75 kaiser: Set _PAGE_NX only if supported KPTI: Report when enabled KPTI: Rename to PAGE_TABLE_ISOLATION x86/kaiser: Move feature detection up kaiser: disabled on Xen PV x86/kaiser: Reenable PARAVIRT x86/paravirt: Dont patch flush_tlb_single kaiser: kaiser_flush_tlb_on_return_to_user() check PCID kaiser: asm/tlbflush.h handle noPGE at lower level kaiser: drop is_atomic arg to kaiser_pagetable_walk() kaiser: use ALTERNATIVE instead of x86_cr3_pcid_noflush x86/kaiser: Check boottime cmdline params x86/kaiser: Rename and simplify X86_FEATURE_KAISER handling kaiser: add "nokaiser" boot option, using ALTERNATIVE kaiser: fix unlikely error in alloc_ldt_struct() kaiser: kaiser_remove_mapping() move along the pgd kaiser: paranoid_entry pass cr3 need to paranoid_exit kaiser: x86_cr3_pcid_noflush and x86_cr3_pcid_user kaiser: PCID 0 for kernel and 128 for user kaiser: load_new_mm_cr3() let SWITCH_USER_CR3 flush user kaiser: enhanced by kernel and user PCIDs kaiser: vmstat show NR_KAISERTABLE as nr_overhead kaiser: delete KAISER_REAL_SWITCH option kaiser: name that 0x1000 KAISER_SHADOW_PGD_OFFSET kaiser: cleanups while trying for gold link kaiser: align addition to x86/mm/Makefile kaiser: tidied up kaiser_add/remove_mapping slightly kaiser: tidied up asm/kaiser.h somewhat kaiser: ENOMEM if kaiser_pagetable_walk() NULL kaiser: fix perf crashes kaiser: fix regs to do_nmi() ifndef CONFIG_KAISER kaiser: KAISER depends on SMP kaiser: fix build and FIXME in alloc_ldt_struct() kaiser: stack map PAGE_SIZE at THREAD_SIZE-PAGE_SIZE kaiser: do not set _PAGE_NX on pgd_none kaiser: merged update KAISER: Kernel Address Isolation x86/boot: Add early cmdline parsing for options with arguments tcp_bbr: reset long-term bandwidth sampling on loss recovery undo tcp_bbr: reset full pipe detection on loss recovery undo Conflicts: security/Kconfig Change-Id: I4fea07f15ed92a33aa9475745506cb01bae95438 Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>	2018-01-19 05:20:43 -08:00
Michal Hocko	d88a735acb	selinux: use GFP_NOWAIT in the AVC kmem_caches ... There is a strange __GFP_NOMEMALLOC usage pattern in SELinux, specifically GFP_ATOMIC | __GFP_NOMEMALLOC which doesn't make much sense. GFP_ATOMIC on its own allows to access memory reserves while __GFP_NOMEMALLOC dictates we cannot use memory reserves. Replace this with the much more sane GFP_NOWAIT in the AVC code as we can tolerate memory allocation failures in that code. Change-Id: I3876a6b95bdacc67c65c45f42593423faa9271b4 Signed-off-by: Michal Hocko <mhocko@kernel.org> Acked-by: Mel Gorman <mgorman@suse.de> Signed-off-by: Paul Moore <paul@paul-moore.com> Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git Git-commit: 476accbe2f6ef69caeebe99f52a286e12ac35aee Signed-off-by: Dennis Cagle <dcagle@codeaurora.org>	2018-01-17 16:56:57 -08:00
Linux Build Service Account	e97b6680c7	Merge "Merge remote-tracking branch '4.9/tmp-7d01cc5' into 4.9"	2018-01-13 04:00:34 -08:00
Zhen Kong	50ced54e5b	selinux: Relocate ss_initialized to a separate 4k page ... We need to relocate ss_initialized to a separate 4k page to enable EL2 Hypervisor to monitor changes to this variable using ARM stage 2 MMU. We will avoid getting page faults from un-related data as the MMU granularity is configured to 4k. Change-Id: I74a1e735d5f804a35ce5b7ffe8b8746e5f56201b Signed-off-by: Zhen Kong <zkong@codeaurora.org>	2018-01-09 14:44:52 -08:00
Zhen Kong	c58c561f99	selinux: Relocate selinux_enforcing to a separate 4k page ... We need to relocate selinux_enforcing to a separate 4k page to enable EL2 Hypervisor to monitor changes to this variable using ARM stage 2 MMU. We will avoid getting page faults from un-related data as the MMU granularity is configured to 4k. Change-Id: I574f2b10af9fb46720bfbdd1a61eea7b841c2c39 Signed-off-by: Zhen Kong <zkong@codeaurora.org>	2018-01-08 10:55:01 -08:00
Greg Kroah-Hartman	2007563049	Merge 4.9.75 into android-4.9-o ... Changes in 4.9.75 tcp_bbr: reset full pipe detection on loss recovery undo tcp_bbr: reset long-term bandwidth sampling on loss recovery undo x86/boot: Add early cmdline parsing for options with arguments KAISER: Kernel Address Isolation kaiser: merged update kaiser: do not set _PAGE_NX on pgd_none kaiser: stack map PAGE_SIZE at THREAD_SIZE-PAGE_SIZE kaiser: fix build and FIXME in alloc_ldt_struct() kaiser: KAISER depends on SMP kaiser: fix regs to do_nmi() ifndef CONFIG_KAISER kaiser: fix perf crashes kaiser: ENOMEM if kaiser_pagetable_walk() NULL kaiser: tidied up asm/kaiser.h somewhat kaiser: tidied up kaiser_add/remove_mapping slightly kaiser: align addition to x86/mm/Makefile kaiser: cleanups while trying for gold link kaiser: name that 0x1000 KAISER_SHADOW_PGD_OFFSET kaiser: delete KAISER_REAL_SWITCH option kaiser: vmstat show NR_KAISERTABLE as nr_overhead kaiser: enhanced by kernel and user PCIDs kaiser: load_new_mm_cr3() let SWITCH_USER_CR3 flush user kaiser: PCID 0 for kernel and 128 for user kaiser: x86_cr3_pcid_noflush and x86_cr3_pcid_user kaiser: paranoid_entry pass cr3 need to paranoid_exit kaiser: kaiser_remove_mapping() move along the pgd kaiser: fix unlikely error in alloc_ldt_struct() kaiser: add "nokaiser" boot option, using ALTERNATIVE x86/kaiser: Rename and simplify X86_FEATURE_KAISER handling x86/kaiser: Check boottime cmdline params kaiser: use ALTERNATIVE instead of x86_cr3_pcid_noflush kaiser: drop is_atomic arg to kaiser_pagetable_walk() kaiser: asm/tlbflush.h handle noPGE at lower level kaiser: kaiser_flush_tlb_on_return_to_user() check PCID x86/paravirt: Dont patch flush_tlb_single x86/kaiser: Reenable PARAVIRT kaiser: disabled on Xen PV x86/kaiser: Move feature detection up KPTI: Rename to PAGE_TABLE_ISOLATION KPTI: Report when enabled kaiser: Set _PAGE_NX only if supported Linux 4.9.75 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2018-01-05 22:29:37 +01:00
Greg Kroah-Hartman	bc7ff9b998	Merge 4.9.75 into android-4.9 ... Changes in 4.9.75 tcp_bbr: reset full pipe detection on loss recovery undo tcp_bbr: reset long-term bandwidth sampling on loss recovery undo x86/boot: Add early cmdline parsing for options with arguments KAISER: Kernel Address Isolation kaiser: merged update kaiser: do not set _PAGE_NX on pgd_none kaiser: stack map PAGE_SIZE at THREAD_SIZE-PAGE_SIZE kaiser: fix build and FIXME in alloc_ldt_struct() kaiser: KAISER depends on SMP kaiser: fix regs to do_nmi() ifndef CONFIG_KAISER kaiser: fix perf crashes kaiser: ENOMEM if kaiser_pagetable_walk() NULL kaiser: tidied up asm/kaiser.h somewhat kaiser: tidied up kaiser_add/remove_mapping slightly kaiser: align addition to x86/mm/Makefile kaiser: cleanups while trying for gold link kaiser: name that 0x1000 KAISER_SHADOW_PGD_OFFSET kaiser: delete KAISER_REAL_SWITCH option kaiser: vmstat show NR_KAISERTABLE as nr_overhead kaiser: enhanced by kernel and user PCIDs kaiser: load_new_mm_cr3() let SWITCH_USER_CR3 flush user kaiser: PCID 0 for kernel and 128 for user kaiser: x86_cr3_pcid_noflush and x86_cr3_pcid_user kaiser: paranoid_entry pass cr3 need to paranoid_exit kaiser: kaiser_remove_mapping() move along the pgd kaiser: fix unlikely error in alloc_ldt_struct() kaiser: add "nokaiser" boot option, using ALTERNATIVE x86/kaiser: Rename and simplify X86_FEATURE_KAISER handling x86/kaiser: Check boottime cmdline params kaiser: use ALTERNATIVE instead of x86_cr3_pcid_noflush kaiser: drop is_atomic arg to kaiser_pagetable_walk() kaiser: asm/tlbflush.h handle noPGE at lower level kaiser: kaiser_flush_tlb_on_return_to_user() check PCID x86/paravirt: Dont patch flush_tlb_single x86/kaiser: Reenable PARAVIRT kaiser: disabled on Xen PV x86/kaiser: Move feature detection up KPTI: Rename to PAGE_TABLE_ISOLATION KPTI: Report when enabled kaiser: Set _PAGE_NX only if supported Linux 4.9.75 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2018-01-05 22:28:25 +01:00
Kees Cook	e71fac0172	KPTI: Rename to PAGE_TABLE_ISOLATION ... This renames CONFIG_KAISER to CONFIG_PAGE_TABLE_ISOLATION. Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2018-01-05 15:46:35 +01:00
Borislav Petkov	2c2721754a	x86/kaiser: Reenable PARAVIRT ... Now that the required bits have been addressed, reenable PARAVIRT. Signed-off-by: Borislav Petkov <bp@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2018-01-05 15:46:35 +01:00
Hugh Dickins	1ce27de401	kaiser: delete KAISER_REAL_SWITCH option ... We fail to see what CONFIG_KAISER_REAL_SWITCH is for: it seems to be left over from early development, and now just obscures tricky parts of the code. Delete it before adding PCIDs, or nokaiser boot option. (Or if there is some good reason to keep the option, then it needs a help text - and a "depends on KAISER", so that all those without KAISER are not asked the question. But we'd much rather delete it.) Signed-off-by: Hugh Dickins <hughd@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2018-01-05 15:46:33 +01:00
Hugh Dickins	639c005dae	kaiser: KAISER depends on SMP ... It is absurd that KAISER should depend on SMP, but apparently nobody has tried a UP build before: which breaks on implicit declaration of function 'per_cpu_offset' in arch/x86/mm/kaiser.c. Now, you would expect that to be trivially fixed up; but looking at the System.map when that block is #ifdef'ed out of kaiser_init(), I see that in a UP build __per_cpu_user_mapped_end is precisely at __per_cpu_user_mapped_start, and the items carefully gathered into that section for user-mapping on SMP, dispersed elsewhere on UP. So, some other kind of section assignment will be needed on UP, but implementing that is not a priority: just make KAISER depend on SMP for now. Also inserted a blank line before the option, tidied up the brief Kconfig help message, and added an "If unsure, Y". Signed-off-by: Hugh Dickins <hughd@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2018-01-05 15:46:32 +01:00
Dave Hansen	8f0baadf2b	kaiser: merged update ... Merged fixes and cleanups, rebased to 4.9.51 tree (no 5-level paging). Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com> Signed-off-by: Hugh Dickins <hughd@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2018-01-05 15:46:32 +01:00
Richard Fellner	13be4483bb	KAISER: Kernel Address Isolation ... This patch introduces our implementation of KAISER (Kernel Address Isolation to have Side-channels Efficiently Removed), a kernel isolation technique to close hardware side channels on kernel address information. More information about the patch can be found on: https://github.com/IAIK/KAISER From: Richard Fellner <richard.fellner@student.tugraz.at> From: Daniel Gruss <daniel.gruss@iaik.tugraz.at> Subject: [RFC, PATCH] x86_64: KAISER - do not map kernel in user mode Date: Thu, 4 May 2017 14:26:50 +0200 Link: http://marc.info/?l=linux-kernel&m=149390087310405&w=2 Kaiser-4.10-SHA1: c4b1831d44c6144d3762ccc72f0c4e71a0c713e5 To: <linux-kernel@vger.kernel.org> To: <kernel-hardening@lists.openwall.com> Cc: <clementine.maurice@iaik.tugraz.at> Cc: <moritz.lipp@iaik.tugraz.at> Cc: Michael Schwarz <michael.schwarz@iaik.tugraz.at> Cc: Richard Fellner <richard.fellner@student.tugraz.at> Cc: Ingo Molnar <mingo@kernel.org> Cc: <kirill.shutemov@linux.intel.com> Cc: <anders.fogh@gdata-adan.de> After several recent works [1,2,3] KASLR on x86_64 was basically considered dead by many researchers. We have been working on an efficient but effective fix for this problem and found that not mapping the kernel space when running in user mode is the solution to this problem [4] (the corresponding paper [5] will be presented at ESSoS17). With this RFC patch we allow anybody to configure their kernel with the flag CONFIG_KAISER to add our defense mechanism. If there are any questions we would love to answer them. We also appreciate any comments! Cheers, Daniel (+ the KAISER team from Graz University of Technology) [1] http://www.ieee-security.org/TC/SP2013/papers/4977a191.pdf [2] https://www.blackhat.com/docs/us-16/materials/us-16-Fogh-Using-Undocumented-CPU-Behaviour-To-See-Into-Kernel-Mode-And-Break-KASLR-In-The-Process.pdf [3] https://www.blackhat.com/docs/us-16/materials/us-16-Jang-Breaking-Kernel-Address-Space-Layout-Randomization-KASLR-With-Intel-TSX.pdf [4] https://github.com/IAIK/KAISER [5] https://gruss.cc/files/kaiser.pdf [patch based also on https://raw.githubusercontent.com/IAIK/KAISER/master/KAISER/0001-KAISER-Kernel-Address-Isolation.patch] Signed-off-by: Richard Fellner <richard.fellner@student.tugraz.at> Signed-off-by: Moritz Lipp <moritz.lipp@iaik.tugraz.at> Signed-off-by: Daniel Gruss <daniel.gruss@iaik.tugraz.at> Signed-off-by: Michael Schwarz <michael.schwarz@iaik.tugraz.at> Acked-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Hugh Dickins <hughd@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2018-01-05 15:46:32 +01:00
Kyle Yan	ff97938fbf	Merge remote-tracking branch '4.9/tmp-8dd0f52' into msm-4.9 ... * 4.9/tmp-8dd0f52: Linux 4.9.72 sparc32: Export vac_cache_size to fix build error bpf: fix incorrect sign extension in check_alu_op() bpf: reject out-of-bounds stack pointer calculation bpf: fix branch pruning logic bpf: adjust insn_aux_data when patching insns Revert "Bluetooth: btusb: driver to enable the usb-wakeup feature" platform/x86: asus-wireless: send an EV_SYN/SYN_REPORT between state changes MIPS: math-emu: Fix final emulation phase for certain instructions thermal/drivers/hisi: Fix multiple alarm interrupts firing thermal/drivers/hisi: Simplify the temperature/step computation thermal/drivers/hisi: Fix kernel panic on alarm interrupt thermal/drivers/hisi: Fix missing interrupt enablement thermal: hisilicon: Handle return value of clk_prepare_enable cpuidle: fix broadcast control when broadcast can not be entered rtc: set the alarm to the next expiring timer tcp: fix under-evaluated ssthresh in TCP Vegas clk: sunxi-ng: sun6i: Rename HDMI DDC clock to avoid name collision staging: greybus: light: Release memory obtained by kasprintf net: ipv6: send NS for DAD when link operationally up fm10k: ensure we process SM mbx when processing VF mbx vfio/pci: Virtualize Maximum Payload Size scsi: lpfc: PLOGI failures during NPIV testing scsi: lpfc: Fix secure firmware updates fm10k: fix mis-ordered parameters in declaration for .ndo_set_vf_bw ASoC: img-parallel-out: Add pm_runtime_get/put to set_fmt callback tracing: Exclude 'generic fields' from histograms PCI/AER: Report non-fatal errors only to the affected endpoint IB/rxe: check for allocation failure on elem ixgbe: fix use of uninitialized padding igb: check memory allocation failure PM / OPP: Move error message to debug level PCI: Create SR-IOV virtfn/physfn links before attaching driver scsi: mpt3sas: Fix IO error occurs on pulling out a drive from RAID1 volume created on two SATA drive scsi: cxgb4i: fix Tx skb leak PCI: Avoid bus reset if bridge itself is broken net: phy: at803x: Change error to EINVAL for invalid MAC kvm, mm: account kvm related kmem slabs to kmemcg rtc: pl031: make interrupt optional crypto: crypto4xx - increase context and scatter ring buffer elements backlight: pwm_bl: Fix overflow condition bnxt_en: Fix NULL pointer dereference in reopen failure path cpuidle: powernv: Pass correct drv->cpumask for registration ARM: dma-mapping: disallow dma_get_sgtable() for non-kernel managed memory Btrfs: fix an integer overflow check netfilter: nfnetlink_queue: fix secctx memory leak xhci: plat: Register shutdown for xhci_plat net: moxa: fix TX overrun memory leak isdn: kcapi: avoid uninitialized data virtio_balloon: prevent uninitialized variable use virtio-balloon: use actual number of stats for stats queue buffers KVM: pci-assign: do not map smm memory slot pages in vt-d page tables net: ipconfig: fix ic_close_devs() use-after-free cpufreq: Fix creation of symbolic links to policy directories ARM: dts: am335x-evmsk: adjust mmc2 param to allow suspend netfilter: nf_nat_snmp: Fix panic when snmp_trap_helper fails to register netfilter: nfnl_cthelper: fix a race when walk the nf_ct_helper_hash table irda: vlsi_ir: fix check for DMA mapping errors RDMA/iser: Fix possible mr leak on device removal event i40e: Do not enable NAPI on q_vectors that have no rings IB/rxe: increment msn only when completing a request IB/rxe: double free on error net: Do not allow negative values for busy_read and busy_poll sysctl interfaces nbd: set queue timeout properly infiniband: Fix alignment of mmap cookies to support VIPT caching IB/core: Protect against self-requeue of a cq work item i40iw: Receive netdev events post INET_NOTIFIER state bna: avoid writing uninitialized data into hw registers s390/qeth: no ETH header for outbound AF_IUCV s390/qeth: size calculation outbound buffers r8152: prevent the driver from transmitting packets with carrier off ASoC: STI: Fix reader substream pointer set HID: xinmo: fix for out of range for THT 2P arcade controller. hwmon: (asus_atk0110) fix uninitialized data access ARM: dts: ti: fix PCI bus dtc warnings KVM: VMX: Fix enable VPID conditions KVM: x86: correct async page present tracepoint kvm: vmx: Flush TLB when the APIC-access address changes scsi: lpfc: Fix PT2PT PRLI reject pinctrl: st: add irq_request/release_resources callbacks inet: frag: release spinlock before calling icmp_send() tipc: fix nametbl deadlock at tipc_nametbl_unsubscribe r8152: fix the rx early size of RTL8153 iommu/exynos: Workaround FLPD cache flush issues for SYSMMU v5 netfilter: nfnl_cthelper: Fix memory leak netfilter: nfnl_cthelper: fix runtime expectation policy updates usb: gadget: udc: remove pointer dereference after free usb: gadget: f_uvc: Sanity check wMaxPacketSize for SuperSpeed hwmon: (max31790) Set correct PWM value net: qmi_wwan: Add USB IDs for MDM6600 modem on Motorola Droid 4 sctp: out_qlen should be updated when pruning unsent queue bna: integer overflow bug in debugfs sch_dsmark: fix invalid skb_cow() usage vsock: cancel packets when failing to connect vhost-vsock: add pkt cancel capability vsock: track pkt owner vsock crypto: deadlock between crypto_alg_sem/rtnl_mutex/genl_mutex r8152: fix the list rx_done may be used without initialization cpuidle: Validate cpu_dev in cpuidle_add_sysfs() nvme-loop: handle cpu unplug when re-establishing the controller arm: kprobes: Align stack to 8-bytes in test code arm: kprobes: Fix the return address of multiple kretprobes HID: corsair: Add driver Scimitar Pro RGB gaming mouse 1b1c:1b3e support to hid-corsair HID: corsair: support for K65-K70 Rapidfire and Scimitar Pro RGB kvm: fix usage of uninit spinlock in avic_vm_destroy() ALSA: hda - add support for docking station for HP 840 G3 ALSA: hda - add support for docking station for HP 820 G2 arm64: Initialise high_memory global variable earlier cxl: Check if vphb exists before iterating over AFU devices Linux 4.9.71 ath9k: fix tx99 potential info leak icmp: don't fail on fragment reassembly time exceeded IB/ipoib: Grab rtnl lock on heavy flush when calling ndo_open/stop RDMA/cma: Avoid triggering undefined behavior macvlan: Only deliver one copy of the frame to the macvlan interface udf: Avoid overflow when session starts at large offset scsi: bfa: integer overflow in debugfs scsi: sd: change allow_restart to bool in sysfs interface scsi: sd: change manage_start_stop to bool in sysfs interface rtl8188eu: Fix a possible sleep-in-atomic bug in rtw_disassoc_cmd rtl8188eu: Fix a possible sleep-in-atomic bug in rtw_createbss_cmd vt6655: Fix a possible sleep-in-atomic bug in vt6655_suspend IB/core: Fix calculation of maximum RoCE MTU scsi: scsi_devinfo: Add REPORTLUN2 to EMC SYMMETRIX blacklist entry raid5: Set R5_Expanded on parity devices as well as data. pinctrl: adi2: Fix Kconfig build problem usb: musb: da8xx: fix babble condition handling tty fix oops when rmmod 8250 soc: mediatek: pwrap: fix compiler errors powerpc/perf/hv-24x7: Fix incorrect comparison in memord scsi: hpsa: destroy sas transport properties before scsi_host scsi: hpsa: cleanup sas_phy structures in sysfs when unloading PCI: Detach driver before procfs & sysfs teardown on device remove RDMA/cxgb4: Declare stag as __be32 xfs: fix incorrect extent state in xfs_bmap_add_extent_unwritten_real xfs: fix log block underflow during recovery cycle verification l2tp: cleanup l2tp_tunnel_delete calls nvme: use kref_get_unless_zero in nvme_find_get_ns platform/x86: hp_accel: Add quirk for HP ProBook 440 G4 btrfs: tests: Fix a memory leak in error handling path in 'run_test()' arm64: prevent regressions in compressed kernel image size when upgrading to binutils 2.27 Ib/hfi1: Return actual operational VLs in port info query bcache: fix wrong cache_misses statistics bcache: explicitly destroy mutex while exiting GFS2: Take inode off order_write list when setting jdata flag scsi: scsi_debug: write_same: fix error report thermal/drivers/step_wise: Fix temperature regulation misbehavior ASoC: rsnd: rsnd_ssi_run_mods() needs to care ssi_parent_mod ppp: Destroy the mutex when cleanup clk: tegra: Fix cclk_lp divisor register clk: hi6220: mark clock cs_atb_syspll as critical clk: imx6: refine hdmi_isfr's parent to make HDMI work on i.MX6 SoCs w/o VPU clk: mediatek: add the option for determining PLL source clock mm: Handle 0 flags in _calc_vm_trans() macro crypto: tcrypt - fix buffer lengths in test_aead_speed() arm-ccn: perf: Prevent module unload while PMU is in use xfs: truncate pagecache before writeback in xfs_setattr_size() iommu/amd: Limit the IOVA page range to the specified addresses badblocks: fix wrong return value in badblocks_set if badblocks are disabled target/file: Do not return error for UNMAP if length is zero target:fix condition return in core_pr_dump_initiator_port() iscsi-target: fix memory leak in lio_target_tiqn_addtpg() target/iscsi: Fix a race condition in iscsit_add_reject_from_cmd() platform/x86: intel_punit_ipc: Fix resource ioremap warning powerpc/ipic: Fix status get and status clear powerpc/opal: Fix EBUSY bug in acquiring tokens netfilter: ipvs: Fix inappropriate output of procfs iommu/mediatek: Fix driver name PCI: Do not allocate more buses than available in parent powerpc/powernv/cpufreq: Fix the frequency read by /proc/cpuinfo PCI/PME: Handle invalid data when reading Root Status dmaengine: ti-dma-crossbar: Correct am335x/am43xx mux value type ASoC: Intel: Skylake: Fix uuid_module memory leak in failure case rtc: pcf8563: fix output clock rate video: fbdev: au1200fb: Return an error code if a memory allocation fails video: fbdev: au1200fb: Release some resources if a memory allocation fails video: udlfb: Fix read EDID timeout fbdev: controlfb: Add missing modes to fix out of bounds access sfc: don't warn on successful change of MAC HID: cp2112: fix broken gpio_direction_input callback Revert "x86/acpi: Set persistent cpuid <-> nodeid mapping when booting" target: fix race during implicit transition work flushes target: fix ALUA transition timeout handling target: Use system workqueue for ALUA transitions btrfs: add missing memset while reading compressed inline extents NFSv4.1 respect server's max size in CREATE_SESSION efi/esrt: Cleanup bad memory map log messages perf symbols: Fix symbols__fixup_end heuristic for corner cases tty: fix data race in tty_ldisc_ref_wait() tty: don't panic on OOM in tty_set_ldisc() rxrpc: Ignore BUSY packets on old calls net: mpls: Fix nexthop alive tracking on down events net/mlx4_core: Avoid delays during VF driver device shutdown nvmet-rdma: Fix a possible uninitialized variable dereference nvmet: confirm sq percpu has scheduled and switched to atomic nvme-loop: fix a possible use-after-free when destroying the admin queue afs: Fix abort on signal while waiting for call completion afs: Fix afs_kill_pages() afs: Fix page leak in afs_write_begin() afs: Populate and use client modification time afs: Better abort and net error handling afs: Invalid op ID should abort with RXGEN_OPCODE afs: Fix the maths in afs_fs_store_data() afs: Prevent callback expiry timer overflow afs: Migrate vlocation fields to 64-bit afs: Flush outstanding writes when an fd is closed afs: Deal with an empty callback array afs: Adjust mode bits processing afs: Populate group ID from vnode status afs: Fix missing put_page() drm/radeon: reinstate oland workaround for sclk mmc: mediatek: Fixed bug where clock frequency could be set wrong sched/deadline: Use deadline instead of period when calculating overflow sched/deadline: Throttle a constrained deadline task activated after the deadline sched/deadline: Make sure the replenishment timer fires in the next period sched/deadline: Add missing update_rq_clock() in dl_task_timer() iwlwifi: mvm: cleanup pending frames in DQA mode Drivers: hv: util: move waiting for release to hv_utils_transport itself drm/radeon/si: add dpm quirk for Oland fjes: Fix wrong netdevice feature flags scsi: hpsa: do not timeout reset operations scsi: hpsa: limit outstanding rescans scsi: hpsa: update check for logical volume status ASoC: rcar: clear DE bit only in PDMACHCR when it stops openrisc: fix issue handling 8 byte get_user calls intel_th: pci: Add Gemini Lake support drm: amd: remove broken include path qed: Fix interrupt flags on Rx LL2 qed: Fix mapping leak on LL2 rx flow qed: Align CIDs according to DORQ requirement mlxsw: reg: Fix SPVMLR max record count mlxsw: reg: Fix SPVM max record count net: Resend IGMP memberships upon peer notification. irqchip/mvebu-odmi: Select GENERIC_MSI_IRQ_DOMAIN dmaengine: Fix array index out of bounds warning in __get_unmap_pool() net: wimax/i2400m: fix NULL-deref at probe writeback: fix memory leak in wb_queue_work() blk-mq: Fix tagset reinit in the presence of cpu hot-unplug ASoC: rsnd: fix sound route path when using SRC6/SRC9 netfilter: bridge: honor frag_max_size when refragmenting drm/omap: fix dmabuf mmap for dma_alloc'ed buffers Input: i8042 - add TUXEDO BU1406 (N24_25BU) to the nomux list NFSD: fix nfsd_reset_versions for NFSv4. NFSD: fix nfsd_minorversion(.., NFSD_AVAIL) drm/amdgpu: fix parser init error path to avoid crash in parser fini iommu/io-pgtable-arm-v7s: Check for leaf entry before dereferencing it net/mlx5: Don't save PCI state when PCI error is detected net/mlx5: Fix create autogroup prev initializer rxrpc: Wake up the transmitter if Rx window size increases on the peer net: bcmgenet: Power up the internal PHY before probing the MII net: bcmgenet: synchronize irq0 status between the isr and task net: bcmgenet: power down internal phy if open or resume fails net: bcmgenet: reserved phy revisions must be checked first net: bcmgenet: correct MIB access of UniMAC RUNT counters net: bcmgenet: correct the RBUF_OVFL_CNT and RBUF_ERR_CNT MIB values bnxt_en: Ignore 0 value in autoneg supported speed from firmware. net: initialize msg.msg_flags in recvfrom userfaultfd: selftest: vm: allow to build in vm/ directory userfaultfd: shmem: __do_fault requires VM_FAULT_NOPAGE md-cluster: free md_cluster_info if node leave cluster usb: xhci-mtk: check hcc_params after adding primary hcd KVM: nVMX: do not warn when MSR bitmap address is not backed usb: phy: isp1301: Add OF device ID table mac80211: Fix addition of mesh configuration element ext4: fix crash when a directory's i_size is too small ext4: fix fdatasync(2) after fallocate(2) operation dmaengine: dmatest: move callback wait queue to thread context eeprom: at24: change nvmem stride to 1 sched/rt: Do not pull from current CPU if only one CPU to pull nfs: don't wait on commit in nfs_commit_inode() if there were no commit requests xhci: Don't add a virt_dev to the devs array before it's fully allocated Bluetooth: btusb: driver to enable the usb-wakeup feature usb: xhci: fix TDS for MTK xHCI1.1 ceph: drop negative child dentries before try pruning inode's alias usbip: fix stub_send_ret_submit() vulnerability to null transfer_buffer usbip: fix stub_rx: harden CMD_SUBMIT path to handle malicious input usb: add helper to extract bits 12:11 of wMaxPacketSize usbip: fix stub_rx: get_pipe() to validate endpoint number USB: core: prevent malicious bNumInterfaces overflow USB: uas and storage: Add US_FL_BROKEN_FUA for another JMicron JMS567 ID tracing: Allocate mask_str buffer dynamically autofs: fix careless error in recent commit crypto: salsa20 - fix blkcipher_walk API usage crypto: hmac - require that the underlying hash algorithm is unkeyed crypto: rsa - fix buffer overread when stripping leading zeroes mfd: fsl-imx25: Clean up irq settings during removal Linux 4.9.70 RDMA/cxgb4: Annotate r2 and stag as __be32 md: free unused memory after bitmap resize audit: ensure that 'audit=1' actually enables audit for PID 1 ipvlan: fix ipv6 outbound device kbuild: do not call cc-option before KBUILD_CFLAGS initialization powerpc/64: Fix checksum folding in csum_tcpudp_nofold and ip_fast_csum_nofold KVM: arm/arm64: vgic-its: Preserve the revious read from the pending table fix kcm_clone() usb: gadget: ffs: Forbid usb_ep_alloc_request from sleeping s390: always save and restore all registers on context switch ipmi: Stop timers before cleaning up the module Fix handling of verdicts after NF_QUEUE tipc: call tipc_rcv() only if bearer is up in tipc_udp_recv() s390/qeth: fix thinko in IPv4 multicast address tracking s390/qeth: fix GSO throughput regression s390/qeth: build max size GSO skbs on L2 devices tcp/dccp: block bh before arming time_wait timer stmmac: reset last TSO segment size after device open net: remove hlist_nulls_add_tail_rcu() usbnet: fix alignment for frames with no ethernet header net/packet: fix a race in packet_bind() and packet_notifier() packet: fix crash in fanout_demux_rollover() sit: update frag_off info rds: Fix NULL pointer dereference in __rds_rdma_map tipc: fix memory leak in tipc_accept_from_sock() s390/qeth: fix early exit from error path net: qmi_wwan: add Quectel BG96 2c7c:0296 ANDROID: dma-buf/sw_sync: Rename active_list to link FROMLIST: android: binder: Fix null ptr dereference in debug msg FROMLIST: android: binder: Move buffer out of area shared with user space FROMLIST: android: binder: Add allocator selftest FROMLIST: android: binder: Refactor prev and next buffer into a helper function Linux 4.9.69 afs: Connect up the CB.ProbeUuid IB/mlx5: Assign send CQ and recv CQ of UMR QP IB/mlx4: Increase maximal message size under UD QP xfrm: Copy policy family in clone_policy jump_label: Invoke jump_label_test() via early_initcall() atm: horizon: Fix irq release error clk: uniphier: fix DAPLL2 clock rate of Pro5 bpf: fix lockdep splat sctp: use the right sk after waking up from wait_buf sleep sctp: do not free asoc when it is already dead in sctp_sendmsg zsmalloc: calling zs_map_object() from irq is a bug sparc64/mm: set fields in deferred pages block: wake up all tasks blocked in get_request() dt-bindings: usb: fix reg-property port-number range xfs: fix forgotten rcu read unlock when skipping inode reclaim sunrpc: Fix rpc_task_begin trace point NFS: Fix a typo in nfs_rename() dynamic-debug-howto: fix optional/omitted ending line number to be LARGE instead of 0 lib/genalloc.c: make the avail variable an atomic_long_t drivers/rapidio/devices/rio_mport_cdev.c: fix resource leak in error handling path in 'rio_dma_transfer()' route: update fnhe_expires for redirect when the fnhe exists route: also update fnhe_genid when updating a route cache gre6: use log_ecn_error module parameter in ip6_tnl_rcv() mac80211_hwsim: Fix memory leak in hwsim_new_radio_nl() x86/mpx/selftests: Fix up weird arrays coccinelle: fix parallel build with CHECK=scripts/coccicheck kbuild: pkg: use --transform option to prefix paths in tar EDAC, i5000, i5400: Fix definition of NRECMEMB register EDAC, i5000, i5400: Fix use of MTR_DRAM_WIDTH macro powerpc/powernv/ioda2: Gracefully fail if too many TCE levels requested drm/amd/amdgpu: fix console deadlock if late init failed axonram: Fix gendisk handling netfilter: don't track fragmented packets zram: set physical queue limits to avoid array out of bounds accesses blk-mq: initialize mq kobjects in blk_mq_init_allocated_queue() i2c: riic: fix restart condition crypto: s5p-sss - Fix completing crypto request in IRQ handler ipv6: reorder icmpv6_init() and ip6_mr_init() ibmvnic: Allocate number of rx/tx buffers agreed on by firmware ibmvnic: Fix overflowing firmware/hardware TX queue rds: tcp: Sequence teardown of listen and acceptor sockets to avoid races bnx2x: do not rollback VF MAC/VLAN filters we did not configure bnx2x: fix detection of VLAN filtering feature for VF bnx2x: fix possible overrun of VFPF multicast addresses array bnx2x: prevent crash when accessing PTP with interface down spi_ks8995: regs_size incorrect for some devices spi_ks8995: fix "BUG: key accdaa28 not in .data!" KVM: arm/arm64: VGIC: Fix command handling while ITS being disabled arm64: KVM: Survive unknown traps from guests arm: KVM: Survive unknown traps from guests KVM: nVMX: reset nested_run_pending if the vCPU is going to be reset irqchip/crossbar: Fix incorrect type of register size scsi: lpfc: Fix crash during Hardware error recovery on SLI3 adapters scsi: qla2xxx: Fix ql_dump_buffer workqueue: trigger WARN if queue_delayed_work() is called with NULL @wq libata: drop WARN from protocol error in ata_sff_qc_issue() kvm: nVMX: VMCLEAR should not cause the vCPU to shut down usb: gadget: udc: net2280: Fix tmp reusage in net2280 driver usb: gadget: pxa27x: Test for a valid argument pointer usb: dwc3: gadget: Fix system suspend/resume on TI platforms USB: gadgetfs: Fix a potential memory leak in 'dev_config()' usb: gadget: configs: plug memory leak HID: chicony: Add support for another ASUS Zen AiO keyboard gpio: altera: Use handle_level_irq when configured as a level_high ASoC: rcar: avoid SSI_MODEx settings for SSI8 ARM: OMAP2+: Release device node after it is no longer needed. ARM: OMAP2+: Fix device node reference counts powerpc/64: Fix checksum folding in csum_add() module: set __jump_table alignment to 8 lirc: fix dead lock between open and wakeup_filter powerpc: Fix compiling a BE kernel with a powerpc64le toolchain selftest/powerpc: Fix false failures for skipped tests powerpc/64: Invalidate process table caching after setting process table x86/hpet: Prevent might sleep splat on resume sched/fair: Make select_idle_cpu() more aggressive x86/platform/uv/BAU: Fix HUB errors by remove initial write to sw-ack register x86/selftests: Add clobbers for int80 on x86_64 ARM: OMAP2+: gpmc-onenand: propagate error on initialization failure vti6: Don't report path MTU below IPV6_MIN_MTU. ARM: 8657/1: uaccess: consistently check object sizes Revert "spi: SPI_FSL_DSPI should depend on HAS_DMA" Revert "drm/armada: Fix compile fail" mm: drop unused pmdp_huge_get_and_clear_notify() thp: fix MADV_DONTNEED vs. numa balancing race thp: reduce indentation level in change_huge_pmd() ARM: avoid faulting on qemu ARM: BUG if jumping to usermode address in kernel mode usb: f_fs: Force Reserved1=1 in OS_DESC_EXT_COMPAT crypto: talitos - fix ctr-aes-talitos crypto: talitos - fix use of sg_link_tbl_len crypto: talitos - fix AEAD for sha224 on non sha224 capable chips crypto: talitos - fix setkey to check key weakness crypto: talitos - fix memory corruption on SEC2 crypto: talitos - fix AEAD test failures bus: arm-ccn: fix module unloading Error: Removing state 147 which has instances left. bus: arm-ccn: Fix use of smp_processor_id() in preemptible context bus: arm-ccn: Check memory allocation failure bus: arm-cci: Fix use of smp_processor_id() in preemptible context arm64: fpsimd: Prevent registers leaking from dead tasks KVM: arm/arm64: vgic-its: Check result of allocation before use KVM: arm/arm64: vgic-irqfd: Fix MSI entry allocation KVM: arm/arm64: Fix broken GICH_ELRSR big endian conversion KVM: VMX: remove I/O port 0x80 bypass on Intel hosts arm: KVM: Fix VTTBR_BADDR_MASK BUG_ON off-by-one arm64: KVM: fix VTTBR_BADDR_MASK BUG_ON off-by-one media: dvb: i2c transfers over usb cannot be done from stack drm/exynos: gem: Drop NONCONTIG flag for buffers allocated without IOMMU kdb: Fix handling of kallsyms_symbol_next() return value brcmfmac: change driver unbind order of the sdio function devices powerpc/64s: Initialize ISAv3 MMU registers before setting partition table KVM: s390: Fix skey emulation permission check s390: fix compat system call table smp/hotplug: Move step CPUHP_AP_SMPCFD_DYING to the correct place iommu/vt-d: Fix scatterlist offset handling ALSA: usb-audio: Add check return value for usb_string() ALSA: usb-audio: Fix out-of-bound error ALSA: seq: Remove spurious WARN_ON() at timer check ALSA: pcm: prevent UAF in snd_pcm_info btrfs: fix missing error return in btrfs_drop_snapshot KVM: x86: fix APIC page invalidation x86/PCI: Make broadcom_postcore_init() check acpi_disabled X.509: fix comparisons of ->pkey_algo X.509: reject invalid BIT STRING for subjectPublicKey KEYS: add missing permission check for request_key() destination ASN.1: check for error from ASN1_OP_END__ACT actions ASN.1: fix out-of-bounds read when parsing indefinite length item efi/esrt: Use memunmap() instead of kfree() to free the remapping efi: Move some sysfs files to be read-only by root scsi: libsas: align sata_device's rps_resp on a cacheline scsi: use dma_get_cache_alignment() as minimum DMA alignment scsi: dma-mapping: always provide dma_get_cache_alignment isa: Prevent NULL dereference in isa_bus driver callbacks hv: kvp: Avoid reading past allocated blocks from KVP file virtio: release virtio index when fail to device_register can: usb_8dev: cancel urb on -EPIPE and -EPROTO can: esd_usb2: cancel urb on -EPIPE and -EPROTO can: ems_usb: cancel urb on -EPIPE and -EPROTO can: kvaser_usb: cancel urb on -EPIPE and -EPROTO can: kvaser_usb: ratelimit errors if incomplete messages are received can: kvaser_usb: Fix comparison bug in kvaser_usb_read_bulk_callback() can: kvaser_usb: free buf in error paths can: ti_hecc: Fix napi poll return value for repoll usb: gadget: udc: renesas_usb3: fix number of the pipes ANDROID: Revert "arm64: move ELF_ET_DYN_BASE to 4GB / 4MB" ANDROID: Revert "arm: move ELF_ET_DYN_BASE to 4MB" Linux 4.9.68 xen-netfront: avoid crashing on resume after a failure in talk_to_netback() usb: host: fix incorrect updating of offset USB: usbfs: Filter flags passed in from user space USB: devio: Prevent integer overflow in proc_do_submiturb() USB: Increase usbfs transfer limit USB: core: Add type-specific length check of BOS descriptors usb: xhci: fix panic in xhci_free_virt_devices_depth_first usb: hub: Cycle HUB power when initialization fails dma-buf: Update kerneldoc for sync_file_create dma-buf/sync_file: hold reference to fence when creating sync_file dma-buf/sw_sync: force signal all unsignaled fences on dying timeline dma-fence: Introduce drm_fence_set_error() helper dma-fence: Wrap querying the fence->status dma-fence: Clear fence->status during dma_fence_init() dma-buf/sw_sync: clean up list before signaling the fence dma-buf/sw_sync: move timeline_fence_ops around dma-buf/sw-sync: Use an rbtree to sort fences in the timeline dma-buf/sw-sync: Fix locking around sync_timeline lists dma-buf/sw-sync: sync_pt is private and of fixed size dma-buf/sw-sync: Reduce irqsave/irqrestore from known context dma-buf/sw-sync: Prevent user overflow on timeline advance dma-buf/sw-sync: Fix the is-signaled test to handle u32 wraparound dma-buf/dma-fence: Extract __dma_fence_is_later() net: fec: fix multicast filtering hardware setup xen-netback: vif counters from int/long to u64 cec: initiator should be the same as the destination for, poll xen-netfront: Improve error handling during initialization mm: avoid returning VM_FAULT_RETRY from ->page_mkwrite handlers vfio/spapr: Fix missing mutex unlock when creating a window be2net: fix initial MAC setting net: thunderx: avoid dereferencing xcv when NULL net: phy: micrel: KSZ8795 do not set SUPPORTED_[Asym_]Pause gtp: fix cross netns recv on gtp socket gtp: clear DF bit on GTP packet tx nvmet: cancel fatal error and flush async work before free controller i2c: i2c-cadence: Initialize configuration before probing devices tcp: correct memory barrier usage in tcp_check_space() dmaengine: pl330: fix double lock tipc: fix cleanup at module unload tipc: fix nametbl_lock soft lockup at module exit RDMA/qedr: Fix RDMA CM loopback RDMA/qedr: Return success when not changing QP state mac80211: don't try to sleep in rate_control_rate_init() drm/amdgpu: fix unload driver issue for virtual display x86/fpu: Set the xcomp_bv when we fake up a XSAVES area net: sctp: fix array overrun read on sctp_timer_tbl drm/exynos/decon5433: set STANDALONE_UPDATE_F on output enablement drm/amdgpu: fix bug set incorrect value to vce register qla2xxx: Fix wrong IOCB type assumption powerpc/mm: Fix memory hotplug BUG() on radix perf/x86/intel: Account interrupts for PEBS errors NFSv4: Fix client recovery when server reboots multiple times mac80211: prevent skb/txq mismatch KVM: arm/arm64: Fix occasional warning from the timer work function drm/exynos/decon5433: set STANDALONE_UPDATE_F also if planes are disabled drm/exynos/decon5433: update shadow registers iff there are active windows nfs: Don't take a reference on fl->fl_file for LOCK operation ravb: Remove Rx overflow log messages mac80211: calculate min channel width correctly mm: fix remote numa hits statistics net: qrtr: Mark 'buf' as little endian libfs: Modify mount_pseudo_xattr to be clear it is not a userspace mount net/appletalk: Fix kernel memory disclosure be2net: fix unicast list filling be2net: fix accesses to unicast list vti6: fix device register to report IFLA_INFO_KIND ARM: OMAP1: DMA: Correct the number of logical channels ARM: OMAP2+: Fix WL1283 Bluetooth Baud Rate net: systemport: Pad packet before inserting TSB net: systemport: Utilize skb_put_padto() libcxgb: fix error check for ip6_route_output() usb: gadget: f_fs: Fix ExtCompat descriptor validation dmaengine: stm32-dma: Fix null pointer dereference in stm32_dma_tx_status dmaengine: stm32-dma: Set correct args number for DMA request from DT l2tp: take remote address into account in l2tp_ip and l2tp_ip6 socket lookups net/mlx4_en: Fix type mismatch for 32-bit systems dax: Avoid page invalidation races and unnecessary radix tree traversals iio: adc: ti-ads1015: add 10% to conversion wait time tools include: Do not use poison with C++ kprobes/x86: Disable preemption in ftrace-based jprobes perf test attr: Fix ignored test case result usbip: tools: Install all headers needed for libusbip development sysrq : fix Show Regs call trace on ARM EDAC, sb_edac: Fix missing break in switch x86/entry: Use SYSCALL_DEFINE() macros for sys_modify_ldt() serial: 8250: Preserve DLD[7:4] for PORT_XR17V35X usb: phy: tahvo: fix error handling in tahvo_usb_probe() mmc: sdhci-msm: fix issue with power irq spi: spi-axi: fix potential use-after-free after deregistration spi: sh-msiof: Fix DMA transfer size check staging: rtl8188eu: avoid a null dereference on pmlmepriv serial: 8250_fintek: Fix rs485 disablement on invalid ioctl() m68k: fix ColdFire node shift size calculation staging: greybus: loopback: Fix iteration count on async path selftests/x86/ldt_get: Add a few additional tests for limits s390/pci: do not require AIS facility ima: fix hash algorithm initialization USB: serial: option: add Quectel BG96 id s390/runtime instrumentation: simplify task exit handling serial: 8250_pci: Add Amazon PCI serial device ID usb: quirks: Add no-lpm quirk for KY-688 USB 3.1 Type-C Hub uas: Always apply US_FL_NO_ATA_1X quirk to Seagate devices mm, oom_reaper: gather each vma to prevent leaking TLB entry Revert "crypto: caam - get rid of tasklet" drm/fsl-dcu: enable IRQ before drm_atomic_helper_resume() drm/fsl-dcu: avoid disabling pixel clock twice on suspend bcache: recover data from backing when data is clean bcache: only permit to recovery read error when cache device is clean Linux 4.9.67 drm/i915: Prevent zero length "index" write drm/i915: Don't try indexed reads to alternate slave addresses NFS: revalidate "." etc correctly on "open". Revert "x86/entry/64: Add missing irqflags tracing to native_load_gs_index()" drm/amd/pp: fix typecast error in powerplay. drm/ttm: once more fix ttm_buffer_object_transfer drm/hisilicon: Ensure LDI regs are properly configured. drm/panel: simple: Add missing panel_simple_unprepare() calls drm/radeon: fix atombios on big endian drm/amdgpu: Potential uninitialized variable in amdgpu_vm_update_directories() drm/amdgpu: potential uninitialized variable in amdgpu_vce_ring_parse_cs() Revert "drm/radeon: dont switch vt on suspend" nvme-pci: add quirk for delay before CHK RDY for WDC SN200 hwmon: (jc42) optionally try to disable the SMBUS timeout bcache: Fix building error on MIPS i2c: i801: Fix Failed to allocate irq -2147483648 error eeprom: at24: check at24_read/write arguments eeprom: at24: correctly set the size for at24mac402 eeprom: at24: fix reading from 24MAC402/24MAC602 mmc: core: prepend 0x to OCR entry in sysfs mmc: core: Do not leave the block driver in a suspended state KVM: lapic: Fixup LDR on load in x2apic KVM: lapic: Split out x2apic ldr calculation KVM: x86: inject exceptions produced by x86_decode_insn KVM: x86: Exit to user-mode on #UD intercept when emulator requires KVM: x86: pvclock: Handle first-time write to pvclock-page contains random junk ARM: OMAP2+: Fix WL1283 Bluetooth Baud Rate mfd: twl4030-power: Fix pmic for boards that need vmmc1 on reboot nfsd: fix panic in posix_unblock_lock called from nfs4_laundromat nfsd: Fix another OPEN stateid race nfsd: Fix stateid races between OPEN and CLOSE btrfs: clear space cache inode generation always mm/madvise.c: fix madvise() infinite loop under special circumstances mm, hugetlbfs: introduce ->split() to vm_operations_struct mm/cma: fix alloc_contig_range ret code/potential leak mm, thp: Do not make page table dirty unconditionally in touch_p[mu]d() ARM: dts: omap3: logicpd-torpedo-37xx-devkit: Fix MMC1 cd-gpio ARM: dts: LogicPD Torpedo: Fix camera pin mux Linux 4.9.66 xen: xenbus driver must not accept invalid transaction ids nvmet: fix KATO offset in Set Features cec: update log_addr[] before finishing configuration cec: CEC_MSG_GIVE_FEATURES should abort for CEC version < 2 cec: when canceling a message, don't overwrite old status info s390/kbuild: enable modversions for symbols exported from asm ASoC: wm_adsp: Don't overrun firmware file buffer when reading region data btrfs: return the actual error value from from btrfs_uuid_tree_iterate crypto: marvell - Copy IVDIG before launching partial DMA ahash requests ASoC: rsnd: don't double free kctrl netfilter: nf_tables: fix oob access netfilter: nft_queue: use raw_smp_processor_id() spi: SPI_FSL_DSPI should depend on HAS_DMA staging: iio: cdc: fix improper return value iio: light: fix improper return value adm80211: add checks for dma mapping errors mac80211: Suppress NEW_PEER_CANDIDATE event if no room mac80211: Remove invalid flag operations in mesh TSF synchronization drm/mediatek: don't use drm_put_dev clk: qcom: ipq4019: Add all the frequencies for apss cpu drm: Apply range restriction after color adjustment when allocation gpio: mockup: dynamically allocate memory for chip name ALSA: hda - Apply ALC269_FIXUP_NO_SHUTUP on HDA_FIXUP_ACT_PROBE ath10k: set CTS protection VDEV param only if VDEV is up bnxt_en: Set default completion ring for async events. pinctrl: sirf: atlas7: Add missing 'of_node_put()' ath10k: fix potential memory leak in ath10k_wmi_tlv_op_pull_fw_stats() ath10k: ignore configuring the incorrect board_id ath10k: fix incorrect txpower set by P2P_DEVICE interface mwifiex: sdio: fix use after free issue for save_adapter adm80211: return an error if adm8211_alloc_rings() fails rt2800: set minimum MPDU and PSDU lengths to sane values drm/armada: Fix compile fail net: 3com: typhoon: typhoon_init_one: fix incorrect return values net: 3com: typhoon: typhoon_init_one: make return values more specific net: Allow IP_MULTICAST_IF to set index to L3 slave fscrypt: use ENOTDIR when setting encryption policy on nondirectory fscrypt: use ENOKEY when file cannot be created w/o key dmaengine: zx: set DMA_CYCLIC cap_mask bit clk: sunxi-ng: fix PLL_CPUX adjusting on A33 clk: sunxi-ng: A31: Fix spdif clock register drm/sun4i: Fix a return value in case of error PCI: Apply _HPX settings only to relevant devices RDS: RDMA: fix the ib_map_mr_sg_zbva() argument RDS: RDMA: return appropriate error on rdma map failures RDS: make message size limit compliant with spec e1000e: Avoid receiver overrun interrupt bursts e1000e: Separate signaling for link check/link up e1000e: Fix return value test e1000e: Fix error path in link detection Revert "drm/i915: Do not rely on wm preservation for ILK watermarks" PM / OPP: Add missing of_node_put(np) net/9p: Switch to wait_event_killable() fscrypt: lock mutex before checking for bounce page pool sched/rt: Simplify the IPI based RT balancing logic media: v4l2-ctrl: Fix flags field on Control events cx231xx-cards: fix NULL-deref on missing association descriptor media: rc: check for integer overflow media: Don't do DMA on stack for firmware upload in the AS102 driver powerpc/signal: Properly handle return value from uprobe_deny_signal() parisc: Fix validity check of pointer size argument in new CAS implementation ixgbe: Fix skb list corruption on Power systems fm10k: Use smp_rmb rather than read_barrier_depends i40evf: Use smp_rmb rather than read_barrier_depends ixgbevf: Use smp_rmb rather than read_barrier_depends igbvf: Use smp_rmb rather than read_barrier_depends igb: Use smp_rmb rather than read_barrier_depends i40e: Use smp_rmb rather than read_barrier_depends NFC: fix device-allocation error return IB/srp: Avoid that a cable pull can trigger a kernel crash IB/srpt: Do not accept invalid initiator port names libnvdimm, namespace: make 'resource' attribute only readable by root libnvdimm, namespace: fix label initialization to use valid seq numbers libnvdimm, pfn: make 'resource' attribute only readable by root clk: ti: dra7-atl-clock: fix child-node lookups SUNRPC: Fix tracepoint storage issues with svc_recv and svc_rqst_status KVM: SVM: obey guest PAT KVM: nVMX: set IDTR and GDTR limits when loading L1 host state lockd: double unregister of inetaddr notifiers irqchip/gic-v3: Fix ppi-partitions lookup block: Fix a race between blk_cleanup_queue() and timeout handling p54: don't unregister leds when they are not initialized mtd: nand: mtk: fix infinite ECC decode IRQ issue mtd: nand: Fix writing mtdoops to nand flash. mtd: nand: omap2: Fix subpage write target: Fix QUEUE_FULL + SCSI task attribute handling iscsi-target: Fix non-immediate TMR reference leak fs/9p: Compare qid.path in v9fs_test_inode fix a page leak in vhost_scsi_iov_to_sgl() error recovery ALSA: hda/realtek - Fix ALC700 family no sound issue ALSA: hda: Fix too short HDMI/DP chmap reporting ALSA: timer: Remove kernel warning at compat ioctl error paths ALSA: usb-audio: Add sanity checks in v2 clock parsers ALSA: usb-audio: Fix potential out-of-bound access at parsing SU ALSA: usb-audio: Add sanity checks to FE parser ALSA: pcm: update tstamp only if audio_tstamp changed ext4: fix interaction between i_size, fallocate, and delalloc after a crash ata: fixes kernel crash while tracing ata_eh_link_autopsy event rtlwifi: fix uninitialized rtlhal->last_suspend_sec time rtlwifi: rtl8192ee: Fix memory leak when loading firmware nfsd: deal with revoked delegations appropriately NFS: Avoid RCU usage in tracepoints nfs: Fix ugly referral attributes NFS: Fix typo in nomigration mount option isofs: fix timestamps beyond 2027 bcache: check ca->alloc_thread initialized before wake up it libceph: don't WARN() if user tries to add invalid key eCryptfs: use after free in ecryptfs_release_messaging() nilfs2: fix race condition that causes file system corruption autofs: don't fail mount for transient error rt2x00usb: mark device removed when get ENOENT usb error MIPS: BCM47XX: Fix LED inversion for WRT54GSv1 MIPS: Fix an n32 core file generation regset support regression MIPS: dts: remove bogus bcm96358nb4ser.dtb from dtb-y entry MIPS: Fix odd fp register warnings with MIPS64r2 dm: fix race between dm_get_from_kobject() and __dm_destroy() MIPS: pci: Remove KERN_WARN instance inside the mt7620 driver dm: allocate struct mapped_device with kvzalloc dm bufio: fix integer overflow when limiting maximum cache size ALSA: hda: Add Raven PCI ID PCI: Set Cavium ACS capability quirk flags to assert RR/CR/SV/UF MIPS: ralink: Fix typo in mt7628 pinmux function MIPS: ralink: Fix MT7628 pinmux ARM: 8721/1: mm: dump: check hardware RO bit for LPAE ARM: 8722/1: mm: make STRICT_KERNEL_RWX effective for LPAE arm64: Implement arch-specific pte_access_permitted() x86/entry/64: Add missing irqflags tracing to native_load_gs_index() x86/decoder: Add new TEST instruction pattern lib/mpi: call cond_resched() from mpi_powm() loop sched: Make resched_cpu() unconditional vsock: use new wait API for vsock_stream_sendmsg() ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER x86/mm: fix use-after-free of vma during userfaultfd fault ACPI / EC: Fix regression related to triggering source of EC event handling s390/disassembler: increase show_code buffer size s390/disassembler: add missing end marker for e7 table s390/runtime instrumention: fix possible memory corruption s390: fix transactional execution control register handling Conflicts: drivers/android/binder_alloc.c drivers/android/binder_alloc.h drivers/android/binder_alloc_selftest.c drivers/mmc/core/bus.c drivers/mmc/host/sdhci-msm.c drivers/thermal/step_wise.c kernel/cpu.c mm/oom_kill.c sound/usb/mixer.c Change-Id: Id01eb66cafc5970b460321e44ec8ffcfa76971a6 Signed-off-by: Kyle Yan <kyan@codeaurora.org>	2018-01-02 10:37:28 -08:00
Greg Kroah-Hartman	b8d2f6e062	Merge 4.9.69 into android-4.9-o ... Changes in 4.9.69 usb: gadget: udc: renesas_usb3: fix number of the pipes can: ti_hecc: Fix napi poll return value for repoll can: kvaser_usb: free buf in error paths can: kvaser_usb: Fix comparison bug in kvaser_usb_read_bulk_callback() can: kvaser_usb: ratelimit errors if incomplete messages are received can: kvaser_usb: cancel urb on -EPIPE and -EPROTO can: ems_usb: cancel urb on -EPIPE and -EPROTO can: esd_usb2: cancel urb on -EPIPE and -EPROTO can: usb_8dev: cancel urb on -EPIPE and -EPROTO virtio: release virtio index when fail to device_register hv: kvp: Avoid reading past allocated blocks from KVP file isa: Prevent NULL dereference in isa_bus driver callbacks scsi: dma-mapping: always provide dma_get_cache_alignment scsi: use dma_get_cache_alignment() as minimum DMA alignment scsi: libsas: align sata_device's rps_resp on a cacheline efi: Move some sysfs files to be read-only by root efi/esrt: Use memunmap() instead of kfree() to free the remapping ASN.1: fix out-of-bounds read when parsing indefinite length item ASN.1: check for error from ASN1_OP_END__ACT actions KEYS: add missing permission check for request_key() destination X.509: reject invalid BIT STRING for subjectPublicKey X.509: fix comparisons of ->pkey_algo x86/PCI: Make broadcom_postcore_init() check acpi_disabled KVM: x86: fix APIC page invalidation btrfs: fix missing error return in btrfs_drop_snapshot ALSA: pcm: prevent UAF in snd_pcm_info ALSA: seq: Remove spurious WARN_ON() at timer check ALSA: usb-audio: Fix out-of-bound error ALSA: usb-audio: Add check return value for usb_string() iommu/vt-d: Fix scatterlist offset handling smp/hotplug: Move step CPUHP_AP_SMPCFD_DYING to the correct place s390: fix compat system call table KVM: s390: Fix skey emulation permission check powerpc/64s: Initialize ISAv3 MMU registers before setting partition table brcmfmac: change driver unbind order of the sdio function devices kdb: Fix handling of kallsyms_symbol_next() return value drm/exynos: gem: Drop NONCONTIG flag for buffers allocated without IOMMU media: dvb: i2c transfers over usb cannot be done from stack arm64: KVM: fix VTTBR_BADDR_MASK BUG_ON off-by-one arm: KVM: Fix VTTBR_BADDR_MASK BUG_ON off-by-one KVM: VMX: remove I/O port 0x80 bypass on Intel hosts KVM: arm/arm64: Fix broken GICH_ELRSR big endian conversion KVM: arm/arm64: vgic-irqfd: Fix MSI entry allocation KVM: arm/arm64: vgic-its: Check result of allocation before use arm64: fpsimd: Prevent registers leaking from dead tasks bus: arm-cci: Fix use of smp_processor_id() in preemptible context bus: arm-ccn: Check memory allocation failure bus: arm-ccn: Fix use of smp_processor_id() in preemptible context bus: arm-ccn: fix module unloading Error: Removing state 147 which has instances left. crypto: talitos - fix AEAD test failures crypto: talitos - fix memory corruption on SEC2 crypto: talitos - fix setkey to check key weakness crypto: talitos - fix AEAD for sha224 on non sha224 capable chips crypto: talitos - fix use of sg_link_tbl_len crypto: talitos - fix ctr-aes-talitos usb: f_fs: Force Reserved1=1 in OS_DESC_EXT_COMPAT ARM: BUG if jumping to usermode address in kernel mode ARM: avoid faulting on qemu thp: reduce indentation level in change_huge_pmd() thp: fix MADV_DONTNEED vs. numa balancing race mm: drop unused pmdp_huge_get_and_clear_notify() Revert "drm/armada: Fix compile fail" Revert "spi: SPI_FSL_DSPI should depend on HAS_DMA" ARM: 8657/1: uaccess: consistently check object sizes vti6: Don't report path MTU below IPV6_MIN_MTU. ARM: OMAP2+: gpmc-onenand: propagate error on initialization failure x86/selftests: Add clobbers for int80 on x86_64 x86/platform/uv/BAU: Fix HUB errors by remove initial write to sw-ack register sched/fair: Make select_idle_cpu() more aggressive x86/hpet: Prevent might sleep splat on resume powerpc/64: Invalidate process table caching after setting process table selftest/powerpc: Fix false failures for skipped tests powerpc: Fix compiling a BE kernel with a powerpc64le toolchain lirc: fix dead lock between open and wakeup_filter module: set __jump_table alignment to 8 powerpc/64: Fix checksum folding in csum_add() ARM: OMAP2+: Fix device node reference counts ARM: OMAP2+: Release device node after it is no longer needed. ASoC: rcar: avoid SSI_MODEx settings for SSI8 gpio: altera: Use handle_level_irq when configured as a level_high HID: chicony: Add support for another ASUS Zen AiO keyboard usb: gadget: configs: plug memory leak USB: gadgetfs: Fix a potential memory leak in 'dev_config()' usb: dwc3: gadget: Fix system suspend/resume on TI platforms usb: gadget: pxa27x: Test for a valid argument pointer usb: gadget: udc: net2280: Fix tmp reusage in net2280 driver kvm: nVMX: VMCLEAR should not cause the vCPU to shut down libata: drop WARN from protocol error in ata_sff_qc_issue() workqueue: trigger WARN if queue_delayed_work() is called with NULL @wq scsi: qla2xxx: Fix ql_dump_buffer scsi: lpfc: Fix crash during Hardware error recovery on SLI3 adapters irqchip/crossbar: Fix incorrect type of register size KVM: nVMX: reset nested_run_pending if the vCPU is going to be reset arm: KVM: Survive unknown traps from guests arm64: KVM: Survive unknown traps from guests KVM: arm/arm64: VGIC: Fix command handling while ITS being disabled spi_ks8995: fix "BUG: key accdaa28 not in .data!" spi_ks8995: regs_size incorrect for some devices bnx2x: prevent crash when accessing PTP with interface down bnx2x: fix possible overrun of VFPF multicast addresses array bnx2x: fix detection of VLAN filtering feature for VF bnx2x: do not rollback VF MAC/VLAN filters we did not configure rds: tcp: Sequence teardown of listen and acceptor sockets to avoid races ibmvnic: Fix overflowing firmware/hardware TX queue ibmvnic: Allocate number of rx/tx buffers agreed on by firmware ipv6: reorder icmpv6_init() and ip6_mr_init() crypto: s5p-sss - Fix completing crypto request in IRQ handler i2c: riic: fix restart condition blk-mq: initialize mq kobjects in blk_mq_init_allocated_queue() zram: set physical queue limits to avoid array out of bounds accesses netfilter: don't track fragmented packets axonram: Fix gendisk handling drm/amd/amdgpu: fix console deadlock if late init failed powerpc/powernv/ioda2: Gracefully fail if too many TCE levels requested EDAC, i5000, i5400: Fix use of MTR_DRAM_WIDTH macro EDAC, i5000, i5400: Fix definition of NRECMEMB register kbuild: pkg: use --transform option to prefix paths in tar coccinelle: fix parallel build with CHECK=scripts/coccicheck x86/mpx/selftests: Fix up weird arrays mac80211_hwsim: Fix memory leak in hwsim_new_radio_nl() gre6: use log_ecn_error module parameter in ip6_tnl_rcv() route: also update fnhe_genid when updating a route cache route: update fnhe_expires for redirect when the fnhe exists drivers/rapidio/devices/rio_mport_cdev.c: fix resource leak in error handling path in 'rio_dma_transfer()' lib/genalloc.c: make the avail variable an atomic_long_t dynamic-debug-howto: fix optional/omitted ending line number to be LARGE instead of 0 NFS: Fix a typo in nfs_rename() sunrpc: Fix rpc_task_begin trace point xfs: fix forgotten rcu read unlock when skipping inode reclaim dt-bindings: usb: fix reg-property port-number range block: wake up all tasks blocked in get_request() sparc64/mm: set fields in deferred pages zsmalloc: calling zs_map_object() from irq is a bug sctp: do not free asoc when it is already dead in sctp_sendmsg sctp: use the right sk after waking up from wait_buf sleep bpf: fix lockdep splat clk: uniphier: fix DAPLL2 clock rate of Pro5 atm: horizon: Fix irq release error jump_label: Invoke jump_label_test() via early_initcall() xfrm: Copy policy family in clone_policy IB/mlx4: Increase maximal message size under UD QP IB/mlx5: Assign send CQ and recv CQ of UMR QP afs: Connect up the CB.ProbeUuid Linux 4.9.69 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2017-12-14 10:08:45 +01:00
Greg Kroah-Hartman	3f1d77ca5f	Merge 4.9.69 into android-4.9 ... Changes in 4.9.69 usb: gadget: udc: renesas_usb3: fix number of the pipes can: ti_hecc: Fix napi poll return value for repoll can: kvaser_usb: free buf in error paths can: kvaser_usb: Fix comparison bug in kvaser_usb_read_bulk_callback() can: kvaser_usb: ratelimit errors if incomplete messages are received can: kvaser_usb: cancel urb on -EPIPE and -EPROTO can: ems_usb: cancel urb on -EPIPE and -EPROTO can: esd_usb2: cancel urb on -EPIPE and -EPROTO can: usb_8dev: cancel urb on -EPIPE and -EPROTO virtio: release virtio index when fail to device_register hv: kvp: Avoid reading past allocated blocks from KVP file isa: Prevent NULL dereference in isa_bus driver callbacks scsi: dma-mapping: always provide dma_get_cache_alignment scsi: use dma_get_cache_alignment() as minimum DMA alignment scsi: libsas: align sata_device's rps_resp on a cacheline efi: Move some sysfs files to be read-only by root efi/esrt: Use memunmap() instead of kfree() to free the remapping ASN.1: fix out-of-bounds read when parsing indefinite length item ASN.1: check for error from ASN1_OP_END__ACT actions KEYS: add missing permission check for request_key() destination X.509: reject invalid BIT STRING for subjectPublicKey X.509: fix comparisons of ->pkey_algo x86/PCI: Make broadcom_postcore_init() check acpi_disabled KVM: x86: fix APIC page invalidation btrfs: fix missing error return in btrfs_drop_snapshot ALSA: pcm: prevent UAF in snd_pcm_info ALSA: seq: Remove spurious WARN_ON() at timer check ALSA: usb-audio: Fix out-of-bound error ALSA: usb-audio: Add check return value for usb_string() iommu/vt-d: Fix scatterlist offset handling smp/hotplug: Move step CPUHP_AP_SMPCFD_DYING to the correct place s390: fix compat system call table KVM: s390: Fix skey emulation permission check powerpc/64s: Initialize ISAv3 MMU registers before setting partition table brcmfmac: change driver unbind order of the sdio function devices kdb: Fix handling of kallsyms_symbol_next() return value drm/exynos: gem: Drop NONCONTIG flag for buffers allocated without IOMMU media: dvb: i2c transfers over usb cannot be done from stack arm64: KVM: fix VTTBR_BADDR_MASK BUG_ON off-by-one arm: KVM: Fix VTTBR_BADDR_MASK BUG_ON off-by-one KVM: VMX: remove I/O port 0x80 bypass on Intel hosts KVM: arm/arm64: Fix broken GICH_ELRSR big endian conversion KVM: arm/arm64: vgic-irqfd: Fix MSI entry allocation KVM: arm/arm64: vgic-its: Check result of allocation before use arm64: fpsimd: Prevent registers leaking from dead tasks bus: arm-cci: Fix use of smp_processor_id() in preemptible context bus: arm-ccn: Check memory allocation failure bus: arm-ccn: Fix use of smp_processor_id() in preemptible context bus: arm-ccn: fix module unloading Error: Removing state 147 which has instances left. crypto: talitos - fix AEAD test failures crypto: talitos - fix memory corruption on SEC2 crypto: talitos - fix setkey to check key weakness crypto: talitos - fix AEAD for sha224 on non sha224 capable chips crypto: talitos - fix use of sg_link_tbl_len crypto: talitos - fix ctr-aes-talitos usb: f_fs: Force Reserved1=1 in OS_DESC_EXT_COMPAT ARM: BUG if jumping to usermode address in kernel mode ARM: avoid faulting on qemu thp: reduce indentation level in change_huge_pmd() thp: fix MADV_DONTNEED vs. numa balancing race mm: drop unused pmdp_huge_get_and_clear_notify() Revert "drm/armada: Fix compile fail" Revert "spi: SPI_FSL_DSPI should depend on HAS_DMA" ARM: 8657/1: uaccess: consistently check object sizes vti6: Don't report path MTU below IPV6_MIN_MTU. ARM: OMAP2+: gpmc-onenand: propagate error on initialization failure x86/selftests: Add clobbers for int80 on x86_64 x86/platform/uv/BAU: Fix HUB errors by remove initial write to sw-ack register sched/fair: Make select_idle_cpu() more aggressive x86/hpet: Prevent might sleep splat on resume powerpc/64: Invalidate process table caching after setting process table selftest/powerpc: Fix false failures for skipped tests powerpc: Fix compiling a BE kernel with a powerpc64le toolchain lirc: fix dead lock between open and wakeup_filter module: set __jump_table alignment to 8 powerpc/64: Fix checksum folding in csum_add() ARM: OMAP2+: Fix device node reference counts ARM: OMAP2+: Release device node after it is no longer needed. ASoC: rcar: avoid SSI_MODEx settings for SSI8 gpio: altera: Use handle_level_irq when configured as a level_high HID: chicony: Add support for another ASUS Zen AiO keyboard usb: gadget: configs: plug memory leak USB: gadgetfs: Fix a potential memory leak in 'dev_config()' usb: dwc3: gadget: Fix system suspend/resume on TI platforms usb: gadget: pxa27x: Test for a valid argument pointer usb: gadget: udc: net2280: Fix tmp reusage in net2280 driver kvm: nVMX: VMCLEAR should not cause the vCPU to shut down libata: drop WARN from protocol error in ata_sff_qc_issue() workqueue: trigger WARN if queue_delayed_work() is called with NULL @wq scsi: qla2xxx: Fix ql_dump_buffer scsi: lpfc: Fix crash during Hardware error recovery on SLI3 adapters irqchip/crossbar: Fix incorrect type of register size KVM: nVMX: reset nested_run_pending if the vCPU is going to be reset arm: KVM: Survive unknown traps from guests arm64: KVM: Survive unknown traps from guests KVM: arm/arm64: VGIC: Fix command handling while ITS being disabled spi_ks8995: fix "BUG: key accdaa28 not in .data!" spi_ks8995: regs_size incorrect for some devices bnx2x: prevent crash when accessing PTP with interface down bnx2x: fix possible overrun of VFPF multicast addresses array bnx2x: fix detection of VLAN filtering feature for VF bnx2x: do not rollback VF MAC/VLAN filters we did not configure rds: tcp: Sequence teardown of listen and acceptor sockets to avoid races ibmvnic: Fix overflowing firmware/hardware TX queue ibmvnic: Allocate number of rx/tx buffers agreed on by firmware ipv6: reorder icmpv6_init() and ip6_mr_init() crypto: s5p-sss - Fix completing crypto request in IRQ handler i2c: riic: fix restart condition blk-mq: initialize mq kobjects in blk_mq_init_allocated_queue() zram: set physical queue limits to avoid array out of bounds accesses netfilter: don't track fragmented packets axonram: Fix gendisk handling drm/amd/amdgpu: fix console deadlock if late init failed powerpc/powernv/ioda2: Gracefully fail if too many TCE levels requested EDAC, i5000, i5400: Fix use of MTR_DRAM_WIDTH macro EDAC, i5000, i5400: Fix definition of NRECMEMB register kbuild: pkg: use --transform option to prefix paths in tar coccinelle: fix parallel build with CHECK=scripts/coccicheck x86/mpx/selftests: Fix up weird arrays mac80211_hwsim: Fix memory leak in hwsim_new_radio_nl() gre6: use log_ecn_error module parameter in ip6_tnl_rcv() route: also update fnhe_genid when updating a route cache route: update fnhe_expires for redirect when the fnhe exists drivers/rapidio/devices/rio_mport_cdev.c: fix resource leak in error handling path in 'rio_dma_transfer()' lib/genalloc.c: make the avail variable an atomic_long_t dynamic-debug-howto: fix optional/omitted ending line number to be LARGE instead of 0 NFS: Fix a typo in nfs_rename() sunrpc: Fix rpc_task_begin trace point xfs: fix forgotten rcu read unlock when skipping inode reclaim dt-bindings: usb: fix reg-property port-number range block: wake up all tasks blocked in get_request() sparc64/mm: set fields in deferred pages zsmalloc: calling zs_map_object() from irq is a bug sctp: do not free asoc when it is already dead in sctp_sendmsg sctp: use the right sk after waking up from wait_buf sleep bpf: fix lockdep splat clk: uniphier: fix DAPLL2 clock rate of Pro5 atm: horizon: Fix irq release error jump_label: Invoke jump_label_test() via early_initcall() xfrm: Copy policy family in clone_policy IB/mlx4: Increase maximal message size under UD QP IB/mlx5: Assign send CQ and recv CQ of UMR QP afs: Connect up the CB.ProbeUuid Linux 4.9.69 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2017-12-14 09:58:43 +01:00
Eric Biggers	982707eb4f	KEYS: add missing permission check for request_key() destination ... commit 4dca6ea1d9432052afb06baf2e3ae78188a4410b upstream. When the request_key() syscall is not passed a destination keyring, it links the requested key (if constructed) into the "default" request-key keyring. This should require Write permission to the keyring. However, there is actually no permission check. This can be abused to add keys to any keyring to which only Search permission is granted. This is because Search permission allows joining the keyring. keyctl_set_reqkey_keyring(KEY_REQKEY_DEFL_SESSION_KEYRING) then will set the default request-key keyring to the session keyring. Then, request_key() can be used to add keys to the keyring. Both negatively and positively instantiated keys can be added using this method. Adding negative keys is trivial. Adding a positive key is a bit trickier. It requires that either /sbin/request-key positively instantiates the key, or that another thread adds the key to the process keyring at just the right time, such that request_key() misses it initially but then finds it in construct_alloc_key(). Fix this bug by checking for Write permission to the keyring in construct_get_dest_keyring() when the default keyring is being used. We don't do the permission check for non-default keyrings because that was already done by the earlier call to lookup_user_key(). Also, request_key_and_link() is currently passed a 'struct key *' rather than a key_ref_t, so the "possessed" bit is unavailable. We also don't do the permission check for the "requestor keyring", to continue to support the use case described by commit 8bbf4976b5 ("KEYS: Alter use of key instantiation link-to-keyring argument") where /sbin/request-key recursively calls request_key() to add keys to the original requestor's destination keyring. (I don't know of any users who actually do that, though...) Fixes: 3e30148c3d ("[PATCH] Keys: Make request-key create an authorisation key") Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2017-12-14 09:28:12 +01:00
Greg Kroah-Hartman	eb4ef2dea9	Merge 4.9.68 into android-4.9-o ... Changes in 4.9.68 bcache: only permit to recovery read error when cache device is clean bcache: recover data from backing when data is clean drm/fsl-dcu: avoid disabling pixel clock twice on suspend drm/fsl-dcu: enable IRQ before drm_atomic_helper_resume() Revert "crypto: caam - get rid of tasklet" mm, oom_reaper: gather each vma to prevent leaking TLB entry uas: Always apply US_FL_NO_ATA_1X quirk to Seagate devices usb: quirks: Add no-lpm quirk for KY-688 USB 3.1 Type-C Hub serial: 8250_pci: Add Amazon PCI serial device ID s390/runtime instrumentation: simplify task exit handling USB: serial: option: add Quectel BG96 id ima: fix hash algorithm initialization s390/pci: do not require AIS facility selftests/x86/ldt_get: Add a few additional tests for limits staging: greybus: loopback: Fix iteration count on async path m68k: fix ColdFire node shift size calculation serial: 8250_fintek: Fix rs485 disablement on invalid ioctl() staging: rtl8188eu: avoid a null dereference on pmlmepriv spi: sh-msiof: Fix DMA transfer size check spi: spi-axi: fix potential use-after-free after deregistration mmc: sdhci-msm: fix issue with power irq usb: phy: tahvo: fix error handling in tahvo_usb_probe() serial: 8250: Preserve DLD[7:4] for PORT_XR17V35X x86/entry: Use SYSCALL_DEFINE() macros for sys_modify_ldt() EDAC, sb_edac: Fix missing break in switch sysrq : fix Show Regs call trace on ARM usbip: tools: Install all headers needed for libusbip development perf test attr: Fix ignored test case result kprobes/x86: Disable preemption in ftrace-based jprobes tools include: Do not use poison with C++ iio: adc: ti-ads1015: add 10% to conversion wait time dax: Avoid page invalidation races and unnecessary radix tree traversals net/mlx4_en: Fix type mismatch for 32-bit systems l2tp: take remote address into account in l2tp_ip and l2tp_ip6 socket lookups dmaengine: stm32-dma: Set correct args number for DMA request from DT dmaengine: stm32-dma: Fix null pointer dereference in stm32_dma_tx_status usb: gadget: f_fs: Fix ExtCompat descriptor validation libcxgb: fix error check for ip6_route_output() net: systemport: Utilize skb_put_padto() net: systemport: Pad packet before inserting TSB ARM: OMAP2+: Fix WL1283 Bluetooth Baud Rate ARM: OMAP1: DMA: Correct the number of logical channels vti6: fix device register to report IFLA_INFO_KIND be2net: fix accesses to unicast list be2net: fix unicast list filling net/appletalk: Fix kernel memory disclosure libfs: Modify mount_pseudo_xattr to be clear it is not a userspace mount net: qrtr: Mark 'buf' as little endian mm: fix remote numa hits statistics mac80211: calculate min channel width correctly ravb: Remove Rx overflow log messages nfs: Don't take a reference on fl->fl_file for LOCK operation drm/exynos/decon5433: update shadow registers iff there are active windows drm/exynos/decon5433: set STANDALONE_UPDATE_F also if planes are disabled KVM: arm/arm64: Fix occasional warning from the timer work function mac80211: prevent skb/txq mismatch NFSv4: Fix client recovery when server reboots multiple times perf/x86/intel: Account interrupts for PEBS errors powerpc/mm: Fix memory hotplug BUG() on radix qla2xxx: Fix wrong IOCB type assumption drm/amdgpu: fix bug set incorrect value to vce register drm/exynos/decon5433: set STANDALONE_UPDATE_F on output enablement net: sctp: fix array overrun read on sctp_timer_tbl x86/fpu: Set the xcomp_bv when we fake up a XSAVES area drm/amdgpu: fix unload driver issue for virtual display mac80211: don't try to sleep in rate_control_rate_init() RDMA/qedr: Return success when not changing QP state RDMA/qedr: Fix RDMA CM loopback tipc: fix nametbl_lock soft lockup at module exit tipc: fix cleanup at module unload dmaengine: pl330: fix double lock tcp: correct memory barrier usage in tcp_check_space() i2c: i2c-cadence: Initialize configuration before probing devices nvmet: cancel fatal error and flush async work before free controller gtp: clear DF bit on GTP packet tx gtp: fix cross netns recv on gtp socket net: phy: micrel: KSZ8795 do not set SUPPORTED_[Asym_]Pause net: thunderx: avoid dereferencing xcv when NULL be2net: fix initial MAC setting vfio/spapr: Fix missing mutex unlock when creating a window mm: avoid returning VM_FAULT_RETRY from ->page_mkwrite handlers xen-netfront: Improve error handling during initialization cec: initiator should be the same as the destination for, poll xen-netback: vif counters from int/long to u64 net: fec: fix multicast filtering hardware setup dma-buf/dma-fence: Extract __dma_fence_is_later() dma-buf/sw-sync: Fix the is-signaled test to handle u32 wraparound dma-buf/sw-sync: Prevent user overflow on timeline advance dma-buf/sw-sync: Reduce irqsave/irqrestore from known context dma-buf/sw-sync: sync_pt is private and of fixed size dma-buf/sw-sync: Fix locking around sync_timeline lists dma-buf/sw-sync: Use an rbtree to sort fences in the timeline dma-buf/sw_sync: move timeline_fence_ops around dma-buf/sw_sync: clean up list before signaling the fence dma-fence: Clear fence->status during dma_fence_init() dma-fence: Wrap querying the fence->status dma-fence: Introduce drm_fence_set_error() helper dma-buf/sw_sync: force signal all unsignaled fences on dying timeline dma-buf/sync_file: hold reference to fence when creating sync_file dma-buf: Update kerneldoc for sync_file_create usb: hub: Cycle HUB power when initialization fails usb: xhci: fix panic in xhci_free_virt_devices_depth_first USB: core: Add type-specific length check of BOS descriptors USB: Increase usbfs transfer limit USB: devio: Prevent integer overflow in proc_do_submiturb() USB: usbfs: Filter flags passed in from user space usb: host: fix incorrect updating of offset xen-netfront: avoid crashing on resume after a failure in talk_to_netback() Linux 4.9.68 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2017-12-10 17:14:07 +01:00
Greg Kroah-Hartman	fdeec8fdb7	Merge 4.9.68 into android-4.9 ... Changes in 4.9.68 bcache: only permit to recovery read error when cache device is clean bcache: recover data from backing when data is clean drm/fsl-dcu: avoid disabling pixel clock twice on suspend drm/fsl-dcu: enable IRQ before drm_atomic_helper_resume() Revert "crypto: caam - get rid of tasklet" mm, oom_reaper: gather each vma to prevent leaking TLB entry uas: Always apply US_FL_NO_ATA_1X quirk to Seagate devices usb: quirks: Add no-lpm quirk for KY-688 USB 3.1 Type-C Hub serial: 8250_pci: Add Amazon PCI serial device ID s390/runtime instrumentation: simplify task exit handling USB: serial: option: add Quectel BG96 id ima: fix hash algorithm initialization s390/pci: do not require AIS facility selftests/x86/ldt_get: Add a few additional tests for limits staging: greybus: loopback: Fix iteration count on async path m68k: fix ColdFire node shift size calculation serial: 8250_fintek: Fix rs485 disablement on invalid ioctl() staging: rtl8188eu: avoid a null dereference on pmlmepriv spi: sh-msiof: Fix DMA transfer size check spi: spi-axi: fix potential use-after-free after deregistration mmc: sdhci-msm: fix issue with power irq usb: phy: tahvo: fix error handling in tahvo_usb_probe() serial: 8250: Preserve DLD[7:4] for PORT_XR17V35X x86/entry: Use SYSCALL_DEFINE() macros for sys_modify_ldt() EDAC, sb_edac: Fix missing break in switch sysrq : fix Show Regs call trace on ARM usbip: tools: Install all headers needed for libusbip development perf test attr: Fix ignored test case result kprobes/x86: Disable preemption in ftrace-based jprobes tools include: Do not use poison with C++ iio: adc: ti-ads1015: add 10% to conversion wait time dax: Avoid page invalidation races and unnecessary radix tree traversals net/mlx4_en: Fix type mismatch for 32-bit systems l2tp: take remote address into account in l2tp_ip and l2tp_ip6 socket lookups dmaengine: stm32-dma: Set correct args number for DMA request from DT dmaengine: stm32-dma: Fix null pointer dereference in stm32_dma_tx_status usb: gadget: f_fs: Fix ExtCompat descriptor validation libcxgb: fix error check for ip6_route_output() net: systemport: Utilize skb_put_padto() net: systemport: Pad packet before inserting TSB ARM: OMAP2+: Fix WL1283 Bluetooth Baud Rate ARM: OMAP1: DMA: Correct the number of logical channels vti6: fix device register to report IFLA_INFO_KIND be2net: fix accesses to unicast list be2net: fix unicast list filling net/appletalk: Fix kernel memory disclosure libfs: Modify mount_pseudo_xattr to be clear it is not a userspace mount net: qrtr: Mark 'buf' as little endian mm: fix remote numa hits statistics mac80211: calculate min channel width correctly ravb: Remove Rx overflow log messages nfs: Don't take a reference on fl->fl_file for LOCK operation drm/exynos/decon5433: update shadow registers iff there are active windows drm/exynos/decon5433: set STANDALONE_UPDATE_F also if planes are disabled KVM: arm/arm64: Fix occasional warning from the timer work function mac80211: prevent skb/txq mismatch NFSv4: Fix client recovery when server reboots multiple times perf/x86/intel: Account interrupts for PEBS errors powerpc/mm: Fix memory hotplug BUG() on radix qla2xxx: Fix wrong IOCB type assumption drm/amdgpu: fix bug set incorrect value to vce register drm/exynos/decon5433: set STANDALONE_UPDATE_F on output enablement net: sctp: fix array overrun read on sctp_timer_tbl x86/fpu: Set the xcomp_bv when we fake up a XSAVES area drm/amdgpu: fix unload driver issue for virtual display mac80211: don't try to sleep in rate_control_rate_init() RDMA/qedr: Return success when not changing QP state RDMA/qedr: Fix RDMA CM loopback tipc: fix nametbl_lock soft lockup at module exit tipc: fix cleanup at module unload dmaengine: pl330: fix double lock tcp: correct memory barrier usage in tcp_check_space() i2c: i2c-cadence: Initialize configuration before probing devices nvmet: cancel fatal error and flush async work before free controller gtp: clear DF bit on GTP packet tx gtp: fix cross netns recv on gtp socket net: phy: micrel: KSZ8795 do not set SUPPORTED_[Asym_]Pause net: thunderx: avoid dereferencing xcv when NULL be2net: fix initial MAC setting vfio/spapr: Fix missing mutex unlock when creating a window mm: avoid returning VM_FAULT_RETRY from ->page_mkwrite handlers xen-netfront: Improve error handling during initialization cec: initiator should be the same as the destination for, poll xen-netback: vif counters from int/long to u64 net: fec: fix multicast filtering hardware setup dma-buf/dma-fence: Extract __dma_fence_is_later() dma-buf/sw-sync: Fix the is-signaled test to handle u32 wraparound dma-buf/sw-sync: Prevent user overflow on timeline advance dma-buf/sw-sync: Reduce irqsave/irqrestore from known context dma-buf/sw-sync: sync_pt is private and of fixed size dma-buf/sw-sync: Fix locking around sync_timeline lists dma-buf/sw-sync: Use an rbtree to sort fences in the timeline dma-buf/sw_sync: move timeline_fence_ops around dma-buf/sw_sync: clean up list before signaling the fence dma-fence: Clear fence->status during dma_fence_init() dma-fence: Wrap querying the fence->status dma-fence: Introduce drm_fence_set_error() helper dma-buf/sw_sync: force signal all unsignaled fences on dying timeline dma-buf/sync_file: hold reference to fence when creating sync_file dma-buf: Update kerneldoc for sync_file_create usb: hub: Cycle HUB power when initialization fails usb: xhci: fix panic in xhci_free_virt_devices_depth_first USB: core: Add type-specific length check of BOS descriptors USB: Increase usbfs transfer limit USB: devio: Prevent integer overflow in proc_do_submiturb() USB: usbfs: Filter flags passed in from user space usb: host: fix incorrect updating of offset xen-netfront: avoid crashing on resume after a failure in talk_to_netback() Linux 4.9.68 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2017-12-10 17:13:13 +01:00
Boshi Wang	b0a46089fe	ima: fix hash algorithm initialization ... [ Upstream commit ebe7c0a7be92bbd34c6ff5b55810546a0ee05bee ] The hash_setup function always sets the hash_setup_done flag, even when the hash algorithm is invalid. This prevents the default hash algorithm defined as CONFIG_IMA_DEFAULT_HASH from being used. This patch sets hash_setup_done flag only for valid hash algorithms. Fixes: e7a2ad7eb6 "ima: enable support for larger default filedata hash algorithms" Signed-off-by: Boshi Wang <wangboshi@huawei.com> Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com> Signed-off-by: Sasha Levin <alexander.levin@verizon.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2017-12-09 22:01:47 +01:00
Kyle Yan	01bff91034	Merge remote-tracking branch '4.9/tmp-8cca21f' into 4.9 ... * 4.9/tmp-8cca21f: Linux 4.9.65 mm/pagewalk.c: report holes in hugetlb ranges coda: fix 'kernel memory exposure attempt' in fsync mm/page_alloc.c: broken deferred calculation ipmi: fix unsigned long underflow ocfs2: should wait dio before inode lock in ocfs2_setattr() ocfs2: fix cluster hang after a node dies dmaengine: dmatest: warn user when dma test times out serial: 8250_fintek: Fix finding base_port with activated SuperIO serial: omap: Fix EFR write on RTS deassertion ima: do not update security.ima if appraisal status is not INTEGRITY_PASS crypto: dh - Fix double free of ctx->p crypto: dh - fix memleak in setkey net/sctp: Always set scope_id in sctp_inet6_skb_msgname fealnx: Fix building error on MIPS sctp: do not peel off an assoc from one netns to another one af_netlink: ensure that NLMSG_DONE never fails in dumps vlan: fix a use-after-free in vlan_device_event() net: usb: asix: fill null-ptr-deref in asix_suspend qmi_wwan: Add missing skb_reset_mac_header-call net: qmi_wwan: fix divide by 0 on bad descriptors net: cdc_ether: fix divide by 0 on bad descriptors bonding: discard lowest hash bit for 802.3ad layer3+4 netfilter/ipvs: clear ipvs_property flag when SKB net namespace changed tcp: do not mangle skb->cb[] in tcp_make_synack() net: vrf: correct FRA_L3MDEV encode type tcp_nv: fix division by zero in tcpnv_acked() Linux 4.9.64 staging: greybus: spilib: fix use-after-free after deregistration brcmfmac: don't preset all channels as disabled x86/MCE/AMD: Always give panic severity for UC errors in kernel context USB: serial: garmin_gps: fix memory leak on probe errors USB: serial: garmin_gps: fix I/O after failed probe and remove USB: serial: qcserial: add pid/vid for Sierra Wireless EM7355 fw update usb: gadget: f_fs: Fix use-after-free in ffs_free_inst USB: Add delay-init quirk for Corsair K70 LUX keyboards USB: usbfs: compute urb->actual_length for isochronous crypto: dh - Don't permit 'key' or 'g' size longer than 'p' crypto: dh - Don't permit 'p' to be 0 Revert "dt-bindings: Add LEGO MINDSTORMS EV3 compatible specification" Revert "dt-bindings: Add vendor prefix for LEGO" uapi: fix linux/rds.h userspace compilation errors uapi: fix linux/rds.h userspace compilation error Revert "uapi: fix linux/rds.h userspace compilation errors" Revert "crypto: xts - Add ECB dependency" MIPS: Netlogic: Exclude netlogic,xlp-pic code from XLR builds MIPS: traps: Ensure L1 & L2 ECC checking match for CM3 systems MIPS: init: Ensure reserved memory regions are not added to bootmem MIPS: init: Ensure bootmem does not corrupt reserved memory MIPS: End asm function prologue macros with .insn staging: greybus: add host device function pointer checks staging: wilc1000: Fix endian sparse warning staging: rtl8712: fixed little endian problem ixgbe: do not disable FEC from the driver ixgbe: add mask for 64 RSS queues ixgbe: Reduce I2C retry count on X550 devices ixgbe: Fix reporting of 100Mb capability ixgbe: handle close/suspend race with netif_device_detach/present ixgbe: fix AER error handling ixgbe: Configure advertised speeds correctly for KR/KX backplane arm64: dts: NS2: reserve memory for Nitro firmware ALSA: hda/realtek - Add new codec ID ALC299 gpu: drm: mgag200: mgag200_main:- Handle error from pci_iomap backlight: adp5520: Fix error handling in adp5520_bl_probe() backlight: lcd: Fix race condition during register drm/omap: panel-sony-acx565akm.c: Add MODULE_ALIAS ALSA: vx: Fix possible transfer overflow ALSA: vx: Don't try to update capture stream before running power: supply: axp288_fuel_gauge: Read 12 bit values 2 registers at a time power: supply: axp288_fuel_gauge: Read 15 bit values 2 registers at a time rtc: rx8010: change lock mechanism scsi: lpfc: Clear the VendorVersion in the PLOGI/PLOGI ACC payload scsi: lpfc: Correct issue leading to oops during link reset scsi: lpfc: Correct host name in symbolic_name field scsi: lpfc: FCoE VPort enable-disable does not bring up the VPort scsi: lpfc: Add missing memory barrier x86/irq, trace: Add __irq_entry annotation to x86's platform IRQ handlers staging: rtl8188eu: fix incorrect ERROR tags from logs tcp: provide timestamps for partial writes scsi: ufs: add capability to keep auto bkops always enabled scsi: ufs-qcom: Fix module autoload igb: Fix hw_dbg logging in igb_update_flash_i210 igb: close/suspend race in netif_device_detach igb: reset the PHY before reading the PHY ID drm/sti: sti_vtg: Handle return NULL error from devm_ioremap_nocache ata: SATA_MV should depend on HAS_DMA ata: SATA_HIGHBANK should depend on HAS_DMA ata: ATA_BMDMA should depend on HAS_DMA ARM: dts: omap5-uevm: Allow bootloader to configure USB Ethernet MAC ARM: dts: Fix omap3 off mode pull defines ARM: OMAP2+: Fix init for multiple quirks for the same SoC ARM: dts: Fix am335x and dm814x scm syscon to probe children ARM: dts: Fix compatible for ti81xx uarts for 8250 fm10k: request reset when mbx->state changes extcon: palmas: Check the parent instance to prevent the NULL extcon: Remove potential problem when calling extcon_register_notifier() Bluetooth: btusb: fix QCA Rome suspend/resume arm: crypto: reduce priority of bit-sliced AES cipher media: dib0700: fix invalid dvb_detach argument media: imon: Fix null-ptr-deref in imon_probe Linux 4.9.63 misc: panel: properly restore atomic counter on error path qla2xxx: Fix incorrect tcm_qla2xxx_free_cmd use during TMR ABORT (v2) target/iscsi: Fix iSCSI task reassignment handling brcmfmac: remove setting IBSS mode when stopping AP security/keys: add CONFIG_KEYS_COMPAT to Kconfig netfilter: nat: Revert "netfilter: nat: convert nat bysrc hash to rhashtable" netfilter: nat: avoid use of nf_conn_nat extension Revert "ARM: dts: imx53-qsb-common: fix FEC pinmux config" ALSA: seq: Cancel pending autoload work at unbinding device Input: ims-psu - check if CDC union descriptor is sane usb: usbtest: fix NULL pointer dereference mac80211: don't compare TKIP TX MIC key in reinstall prevention mac80211: use constant time comparison with keys mac80211: accept key reinstall without changing anything ppp: fix race in ppp device destruction net_sched: avoid matching qdisc with zero handle sctp: reset owner sk for data chunks on out queues when migrating a sock tun: allow positive return values on dev_get_valid_name() call ip6_gre: update dst pmtu if dev mtu has been updated by toobig in __gre6_xmit ip6_gre: only increase err_count for some certain type icmpv6 in ip6gre_err ipip: only increase err_count for some certain type icmp in ipip_err tap: double-free in error path in tap_open() net/unix: don't show information about sockets from other namespaces tcp/dccp: fix other lockdep splats accessing ireq_opt tcp/dccp: fix lockdep splat in inet_csk_route_req() sctp: full support for ipv6 ip_nonlocal_bind & IP_FREEBIND ipv6: flowlabel: do not leave opt->tot_len with garbage soreuseport: fix initialization race packet: avoid panic in packet_getsockopt() tcp/dccp: fix ireq->opt races sctp: add the missing sock_owned_by_user check in sctp_icmp_redirect tun: call dev_get_valid_name() before register_netdevice() l2tp: check ps->sock before running pppol2tp_session_ioctl() tcp: fix tcp_mtu_probe() vs highest_sack net: call cgroup_sk_alloc() earlier in sk_clone_lock() netlink: do not set cb_running if dump's start() errs ipv6: addrconf: increment ifp refcount before ipv6_del_addr() tun/tap: sanitize TUNSETSNDBUF input gso: fix payload length when gso_size is zero FROMLIST: binder: fix proc->files use-after-free Conflicts: drivers/scsi/ufs/ufshcd.h include/net/netfilter/nf_conntrack.h Change-Id: I38fd3aa5f077a7bde0a8de4ebe9dc9316075f199 Signed-off-by: Kyle Yan <kyan@codeaurora.org>	2017-11-29 13:12:37 -08:00
Greg Kroah-Hartman	8cca21f23d	Merge 4.9.65 into android-4.9-o ... Changes in 4.9.65 tcp_nv: fix division by zero in tcpnv_acked() net: vrf: correct FRA_L3MDEV encode type tcp: do not mangle skb->cb[] in tcp_make_synack() netfilter/ipvs: clear ipvs_property flag when SKB net namespace changed bonding: discard lowest hash bit for 802.3ad layer3+4 net: cdc_ether: fix divide by 0 on bad descriptors net: qmi_wwan: fix divide by 0 on bad descriptors qmi_wwan: Add missing skb_reset_mac_header-call net: usb: asix: fill null-ptr-deref in asix_suspend vlan: fix a use-after-free in vlan_device_event() af_netlink: ensure that NLMSG_DONE never fails in dumps sctp: do not peel off an assoc from one netns to another one fealnx: Fix building error on MIPS net/sctp: Always set scope_id in sctp_inet6_skb_msgname crypto: dh - fix memleak in setkey crypto: dh - Fix double free of ctx->p ima: do not update security.ima if appraisal status is not INTEGRITY_PASS serial: omap: Fix EFR write on RTS deassertion serial: 8250_fintek: Fix finding base_port with activated SuperIO dmaengine: dmatest: warn user when dma test times out ocfs2: fix cluster hang after a node dies ocfs2: should wait dio before inode lock in ocfs2_setattr() ipmi: fix unsigned long underflow mm/page_alloc.c: broken deferred calculation coda: fix 'kernel memory exposure attempt' in fsync mm/pagewalk.c: report holes in hugetlb ranges Linux 4.9.65 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2017-11-24 09:12:57 +01:00
Greg Kroah-Hartman	ea83e4a902	Merge 4.9.65 into android-4.9 ... Changes in 4.9.65 tcp_nv: fix division by zero in tcpnv_acked() net: vrf: correct FRA_L3MDEV encode type tcp: do not mangle skb->cb[] in tcp_make_synack() netfilter/ipvs: clear ipvs_property flag when SKB net namespace changed bonding: discard lowest hash bit for 802.3ad layer3+4 net: cdc_ether: fix divide by 0 on bad descriptors net: qmi_wwan: fix divide by 0 on bad descriptors qmi_wwan: Add missing skb_reset_mac_header-call net: usb: asix: fill null-ptr-deref in asix_suspend vlan: fix a use-after-free in vlan_device_event() af_netlink: ensure that NLMSG_DONE never fails in dumps sctp: do not peel off an assoc from one netns to another one fealnx: Fix building error on MIPS net/sctp: Always set scope_id in sctp_inet6_skb_msgname crypto: dh - fix memleak in setkey crypto: dh - Fix double free of ctx->p ima: do not update security.ima if appraisal status is not INTEGRITY_PASS serial: omap: Fix EFR write on RTS deassertion serial: 8250_fintek: Fix finding base_port with activated SuperIO dmaengine: dmatest: warn user when dma test times out ocfs2: fix cluster hang after a node dies ocfs2: should wait dio before inode lock in ocfs2_setattr() ipmi: fix unsigned long underflow mm/page_alloc.c: broken deferred calculation coda: fix 'kernel memory exposure attempt' in fsync mm/pagewalk.c: report holes in hugetlb ranges Linux 4.9.65 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2017-11-24 08:58:15 +01:00
Roberto Sassu	2cfbb32f6c	ima: do not update security.ima if appraisal status is not INTEGRITY_PASS ... commit 020aae3ee58c1af0e7ffc4e2cc9fe4dc630338cb upstream. Commit b65a9cfc2c ("Untangling ima mess, part 2: deal with counters") moved the call of ima_file_check() from may_open() to do_filp_open() at a point where the file descriptor is already opened. This breaks the assumption made by IMA that file descriptors being closed belong to files whose access was granted by ima_file_check(). The consequence is that security.ima and security.evm are updated with good values, regardless of the current appraisal status. For example, if a file does not have security.ima, IMA will create it after opening the file for writing, even if access is denied. Access to the file will be allowed afterwards. Avoid this issue by checking the appraisal status before updating security.ima. Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com> Signed-off-by: James Morris <james.l.morris@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2017-11-24 08:33:41 +01:00
Linux Build Service Account	fbf9b0bb72	Merge "Merge remote-tracking branch '4.9/tmp-ffc9972' into HEAD"	2017-11-21 00:28:31 -08:00
Greg Kroah-Hartman	0500222f63	Merge 4.9.63 into android-4.9-o ... Changes in 4.9.63 gso: fix payload length when gso_size is zero tun/tap: sanitize TUNSETSNDBUF input ipv6: addrconf: increment ifp refcount before ipv6_del_addr() netlink: do not set cb_running if dump's start() errs net: call cgroup_sk_alloc() earlier in sk_clone_lock() tcp: fix tcp_mtu_probe() vs highest_sack l2tp: check ps->sock before running pppol2tp_session_ioctl() tun: call dev_get_valid_name() before register_netdevice() sctp: add the missing sock_owned_by_user check in sctp_icmp_redirect tcp/dccp: fix ireq->opt races packet: avoid panic in packet_getsockopt() soreuseport: fix initialization race ipv6: flowlabel: do not leave opt->tot_len with garbage sctp: full support for ipv6 ip_nonlocal_bind & IP_FREEBIND tcp/dccp: fix lockdep splat in inet_csk_route_req() tcp/dccp: fix other lockdep splats accessing ireq_opt net/unix: don't show information about sockets from other namespaces tap: double-free in error path in tap_open() ipip: only increase err_count for some certain type icmp in ipip_err ip6_gre: only increase err_count for some certain type icmpv6 in ip6gre_err ip6_gre: update dst pmtu if dev mtu has been updated by toobig in __gre6_xmit tun: allow positive return values on dev_get_valid_name() call sctp: reset owner sk for data chunks on out queues when migrating a sock net_sched: avoid matching qdisc with zero handle ppp: fix race in ppp device destruction mac80211: accept key reinstall without changing anything mac80211: use constant time comparison with keys mac80211: don't compare TKIP TX MIC key in reinstall prevention usb: usbtest: fix NULL pointer dereference Input: ims-psu - check if CDC union descriptor is sane ALSA: seq: Cancel pending autoload work at unbinding device Revert "ARM: dts: imx53-qsb-common: fix FEC pinmux config" netfilter: nat: avoid use of nf_conn_nat extension netfilter: nat: Revert "netfilter: nat: convert nat bysrc hash to rhashtable" security/keys: add CONFIG_KEYS_COMPAT to Kconfig brcmfmac: remove setting IBSS mode when stopping AP target/iscsi: Fix iSCSI task reassignment handling qla2xxx: Fix incorrect tcm_qla2xxx_free_cmd use during TMR ABORT (v2) misc: panel: properly restore atomic counter on error path Linux 4.9.63 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2017-11-18 17:56:35 +01:00
Greg Kroah-Hartman	44a3afcce1	Merge 4.9.63 into android-4.9 ... Changes in 4.9.63 gso: fix payload length when gso_size is zero tun/tap: sanitize TUNSETSNDBUF input ipv6: addrconf: increment ifp refcount before ipv6_del_addr() netlink: do not set cb_running if dump's start() errs net: call cgroup_sk_alloc() earlier in sk_clone_lock() tcp: fix tcp_mtu_probe() vs highest_sack l2tp: check ps->sock before running pppol2tp_session_ioctl() tun: call dev_get_valid_name() before register_netdevice() sctp: add the missing sock_owned_by_user check in sctp_icmp_redirect tcp/dccp: fix ireq->opt races packet: avoid panic in packet_getsockopt() soreuseport: fix initialization race ipv6: flowlabel: do not leave opt->tot_len with garbage sctp: full support for ipv6 ip_nonlocal_bind & IP_FREEBIND tcp/dccp: fix lockdep splat in inet_csk_route_req() tcp/dccp: fix other lockdep splats accessing ireq_opt net/unix: don't show information about sockets from other namespaces tap: double-free in error path in tap_open() ipip: only increase err_count for some certain type icmp in ipip_err ip6_gre: only increase err_count for some certain type icmpv6 in ip6gre_err ip6_gre: update dst pmtu if dev mtu has been updated by toobig in __gre6_xmit tun: allow positive return values on dev_get_valid_name() call sctp: reset owner sk for data chunks on out queues when migrating a sock net_sched: avoid matching qdisc with zero handle ppp: fix race in ppp device destruction mac80211: accept key reinstall without changing anything mac80211: use constant time comparison with keys mac80211: don't compare TKIP TX MIC key in reinstall prevention usb: usbtest: fix NULL pointer dereference Input: ims-psu - check if CDC union descriptor is sane ALSA: seq: Cancel pending autoload work at unbinding device Revert "ARM: dts: imx53-qsb-common: fix FEC pinmux config" netfilter: nat: avoid use of nf_conn_nat extension netfilter: nat: Revert "netfilter: nat: convert nat bysrc hash to rhashtable" security/keys: add CONFIG_KEYS_COMPAT to Kconfig brcmfmac: remove setting IBSS mode when stopping AP target/iscsi: Fix iSCSI task reassignment handling qla2xxx: Fix incorrect tcm_qla2xxx_free_cmd use during TMR ABORT (v2) misc: panel: properly restore atomic counter on error path Linux 4.9.63 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2017-11-18 17:25:57 +01:00
Bilal Amarni	31c8c49428	security/keys: add CONFIG_KEYS_COMPAT to Kconfig ... commit 47b2c3fff4932e6fc17ce13d51a43c6969714e20 upstream. CONFIG_KEYS_COMPAT is defined in arch-specific Kconfigs and is missing for several 64-bit architectures : mips, parisc, tile. At the moment and for those architectures, calling in 32-bit userspace the keyctl syscall would return an ENOSYS error. This patch moves the CONFIG_KEYS_COMPAT option to security/keys/Kconfig, to make sure the compatibility wrapper is registered by default for any 64-bit architecture as long as it is configured with CONFIG_COMPAT. [DH: Modified to remove arm64 compat enablement also as requested by Eric Biggers] Signed-off-by: Bilal Amarni <bilal.amarni@gmail.com> Signed-off-by: David Howells <dhowells@redhat.com> Reviewed-by: Arnd Bergmann <arnd@arndb.de> cc: Eric Biggers <ebiggers3@gmail.com> Signed-off-by: James Morris <james.l.morris@oracle.com> Cc: James Cowgill <james.cowgill@mips.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2017-11-18 11:22:24 +01:00