31 Commits

Author SHA1 Message Date
Li Li
d5dfb934a8 BACKPORT: FROMGIT: Binder: add TF_UPDATE_TXN to replace outdated txn
When the target process is busy, incoming oneway transactions are
queued in the async_todo list. If the clients continue sending extra
oneway transactions while the target process is frozen, this queue can
become too large to accommodate new transactions. That's why binder
driver introduced ONEWAY_SPAM_DETECTION to detect this situation. It's
helpful to debug the async binder buffer exhausting issue, but the
issue itself isn't solved directly.

In real cases applications are designed to send oneway transactions
repeatedly, delivering updated inforamtion to the target process.
Typical examples are Wi-Fi signal strength and some real time sensor
data. Even if the apps might only care about the lastet information,
all outdated oneway transactions are still accumulated there until the
frozen process is thawed later. For this kind of situations, there's
no existing method to skip those outdated transactions and deliver the
latest one only.

This patch introduces a new transaction flag TF_UPDATE_TXN. To use it,
use apps can set this new flag along with TF_ONE_WAY. When such an
oneway transaction is to be queued into the async_todo list of a frozen
process, binder driver will check if any previous pending transactions
can be superseded by comparing their code, flags and target node. If
such an outdated pending transaction is found, the latest transaction
will supersede that outdated one. This effectively prevents the async
binder buffer running out and saves unnecessary binder read workloads.

Acked-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Li Li <dualli@google.com>
Link: https://lore.kernel.org/r/20220526220018.3334775-2-dualli@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 231624308
Test: manually check async binder buffer size of frozen apps
Test: stress test with kernel 4.14/4.19/5.10/5.15
(cherry picked from commit 9864bb4801331daa48514face9d0f4861e4d485b
 git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
  char-misc-next)
Change-Id: I1c4bff1eda1ca15aaaad5bf696c8fc00be743176
2022-07-12 04:15:26 +00:00
Lucas Wei
c8380dcc24 Merge android-4.14-stable (4.14.276) into android-msm-pixel-4.14-lts
Merge 4.14.276 into android-4.14-stable
Linux 4.14.276
    i2c: pasemi: Wait for write xfers to finish
  * smp: Fix offline cpu check in flush_smp_call_function_queue()
      kernel/smp.c
    ARM: davinci: da850-evm: Avoid NULL pointer dereference
  * ALSA: pcm: Test for "silence" field in struct "pcm_format_data"
      sound/core/pcm_misc.c
    gcc-plugins: latent_entropy: use /dev/urandom
    mm: kmemleak: take a full lowmem check in kmemleak_*_phys()
  * mm, page_alloc: fix build_zonerefs_node()
      mm/page_alloc.c
    drivers: net: slip: fix NPD bug in sl_tx_timeout()
    scsi: mvsas: Add PCI ID of RocketRaid 2640
    gpu: ipu-v3: Fix dev_dbg frequency output
    ata: libata-core: Disable READ LOG DMA EXT for Samsung 840 EVOs
  * net: micrel: fix KS8851_MLL Kconfig
      drivers/net/ethernet/micrel/Kconfig
    scsi: ibmvscsis: Increase INITIAL_SRP_LIMIT to 1024
    scsi: target: tcmu: Fix possible page UAF
    Drivers: hv: vmbus: Prevent load re-ordering when reading ring buffer
    drm/amdkfd: Check for potential null return of kmalloc_array()
    drm/amd: Add USBC connector ID
    cifs: potential buffer overflow in handling symlinks
    nfc: nci: add flush_workqueue to prevent uaf
    net: ethernet: stmmac: fix altr_tse_pcs function when using a fixed-link
    mlxsw: i2c: Fix initialization error flow
    gpiolib: acpi: use correct format characters
  * veth: Ensure eth header is in skb's linear part
      drivers/net/veth.c
    memory: atmel-ebi: Fix missing of_node_put in atmel_ebi_probe
  * xfrm: policy: match with both mark and mask on user interfaces
      include/net/xfrm.h
      net/key/af_key.c
      net/xfrm/xfrm_policy.c
      net/xfrm/xfrm_user.c
  * cgroup: Use open-time cgroup namespace for process migration perm checks
      kernel/cgroup/cgroup-internal.h
      kernel/cgroup/cgroup.c
  * cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv
      kernel/cgroup/cgroup-internal.h
      kernel/cgroup/cgroup-v1.c
      kernel/cgroup/cgroup.c
  * cgroup: Use open-time credentials for process migraton perm checks
      kernel/cgroup/cgroup-v1.c
      kernel/cgroup/cgroup.c
  * mm/sparsemem: fix 'mem_section' will never be NULL gcc 12 warning
      include/linux/mmzone.h
  * arm64: module: remove (NOLOAD) from linker script
      arch/arm64/kernel/module.lds
  * mm: don't skip swap entry even if zap_details specified
      mm/memory.c
    dmaengine: Revert "dmaengine: shdma: Fix runtime PM imbalance on error"
    tools build: Use $(shell ) instead of `` to get embedded libperl's ccopts
    perf: qcom_l2_pmu: fix an incorrect NULL check on list iterator
  * arm64: patch_text: Fixup last cpu should be master
      arch/arm64/kernel/insn.c
    btrfs: fix qgroup reserve overflow the qgroup limit
    x86/speculation: Restore speculation related MSRs during S3 resume
    x86/pm: Save the MSR validity status at context setup
    mm/mempolicy: fix mpol_new leak in shared_policy_replace
  * mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0)
      mm/mremap.c
    Revert "mmc: sdhci-xenon: fix annoying 1.8V regulator warning"
    drbd: Fix five use after free bugs in get_initial_state
    drm/imx: Fix memory leak in imx_pd_connector_get_modes
    net: stmmac: Fix unset max_speed difference between DT and non-DT platforms
    scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
    drm/amdgpu: fix off by one in amdgpu_gfx_kiq_acquire()
  * mm: fix race between MADV_FREE reclaim and blkdev direct IO read
      mm/rmap.c
  * net: add missing SOF_TIMESTAMPING_OPT_ID support
      include/net/sock.h
      net/ipv4/raw.c
      net/ipv6/raw.c
      net/packet/af_packet.c
  * ipv6: add missing tx timestamping on IPPROTO_RAW
      net/ipv6/raw.c
    parisc: Fix CPU affinity for Lasi, WAX and Dino chips
    jfs: prevent NULL deref in diFree
    virtio_console: eliminate anonymous module_init & module_exit
    serial: samsung_tty: do not unlock port->lock for uart_write_wakeup()
    NFS: swap-out must always use STABLE writes.
  * NFS: swap IO handling is slightly different for O_DIRECT IO
      include/linux/nfs_fs.h
    SUNRPC/call_alloc: async tasks mustn't block waiting for memory
    w1: w1_therm: fixes w1_seq for ds28ea00 sensors
  * init/main.c: return 1 from handled __setup() functions
      init/main.c
  * Bluetooth: Fix use after free in hci_send_acl
      net/bluetooth/hci_event.c
    xtensa: fix DTC warning unit_address_format
    usb: dwc3: omap: fix "unbalanced disables for smps10_out1" on omap5evm
    scsi: libfc: Fix use after free in fc_exch_abts_resp()
  * MIPS: fix fortify panic when copying asm exception handlers
      arch/mips/include/asm/setup.h
    bnxt_en: Eliminate unintended link toggle during FW reset
    macvtap: advertise link netns via netlink
    net/smc: correct settings of RMB window update limit
    scsi: aha152x: Fix aha152x_setup() __setup handler return value
    scsi: pm8001: Fix pm8001_mpi_task_abort_resp()
  * dm ioctl: prevent potential spectre v1 gadget
      drivers/md/dm-ioctl.c
    iommu/arm-smmu-v3: fix event handling soft lockup
    PCI: aardvark: Fix support for MSI interrupts
    powerpc: Set crashkernel offset to mid of RMA region
    power: supply: axp20x_battery: properly report current when discharging
    scsi: bfa: Replace snprintf() with sysfs_emit()
    scsi: mvsas: Replace snprintf() with sysfs_emit()
    powerpc: dts: t104xrdb: fix phy type for FMAN 4/5
  * ptp: replace snprintf with sysfs_emit
      drivers/ptp/ptp_sysfs.c
    ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
    KVM: x86/svm: Clear reserved bits written to PerfEvtSeln MSRs
    ARM: 9187/1: JIVE: fix return value of __setup handler
    rtc: wm8350: Handle error for wm8350_register_irq
    ubifs: Rectify space amount budget for mkdir/tmpfile operations
    KVM: x86: Forbid VMM to set SYNIC/STIMER MSRs when SynIC wasn't activated
    openvswitch: Fixed nd target mask field in the flow dump.
    ARM: dts: spear13xx: Update SPI dma properties
    ARM: dts: spear1340: Update serial node properties
    ASoC: topology: Allow TLV control to be either read or write
    ubi: fastmap: Return error code if memory allocation fails in add_aeb()
    mm/memcontrol: return 1 from cgroup.memory __setup() handler
  * mm/mmap: return 1 from stack_guard_gap __setup() handler
      mm/mmap.c
    ACPI: CPPC: Avoid out of bounds access when parsing _CPC data
    ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl
  * pinctrl: pinconf-generic: Print arguments for bias-pull-*
      drivers/pinctrl/pinconf-generic.c
    gfs2: Make sure FITRIM minlen is rounded up to fs block size
    can: mcba_usb: properly check endpoint type
    can: mcba_usb: mcba_usb_start_xmit(): fix double dev_kfree_skb in error path
    ubifs: rename_whiteout: correct old_dir size computing
    ubifs: setflags: Make dirtied_ino_d 8 bytes aligned
    ubifs: Add missing iput if do_tmpfile() failed in rename whiteout
    ubifs: rename_whiteout: Fix double free for whiteout_ui->data
    KVM: Prevent module exit until all VMs are freed
    scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair()
    scsi: qla2xxx: Fix warning for missing error code
    powerpc/lib/sstep: Fix build errors with newer binutils
    powerpc/lib/sstep: Fix 'sthcx' instruction
    mmc: host: Return an error when ->enable_sdio_irq() ops is missing
    media: hdpvr: initialize dev->worker at hdpvr_register_videodev
    video: fbdev: sm712fb: Fix crash in smtcfb_write()
    ARM: mmp: Fix failure to remove sram device
    ARM: tegra: tamonten: Fix I2C3 pad setting
    media: cx88-mpeg: clear interrupt status register before streaming video
  * ASoC: soc-core: skip zero num_dai component in searching dai name
      sound/soc/soc-core.c
    video: fbdev: omapfb: panel-tpo-td043mtea1: Use sysfs_emit() instead of snprintf()
    video: fbdev: omapfb: panel-dsi-cm: Use sysfs_emit() instead of snprintf()
    ARM: dts: bcm2837: Add the missing L1/L2 cache information
    ARM: dts: qcom: fix gic_irq_domain_translate warnings for msm8960
    video: fbdev: omapfb: acx565akm: replace snprintf with sysfs_emit
    video: fbdev: cirrusfb: check pixclock to avoid divide by zero
    video: fbdev: w100fb: Reset global state
    video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow
    ntfs: add sanity check on allocation size
  * ext4: don't BUG if someone dirty pages without asking ext4 first
      fs/ext4/inode.c
    spi: tegra20: Use of_device_get_match_data()
  * PM: core: keep irq flags in device_pm_check_callbacks()
      drivers/base/power/main.c
    ACPI/APEI: Limit printable size of BERT table data
    ACPICA: Avoid walking the ACPI Namespace if it is not there
    irqchip/nvic: Release nvic_base upon failure
    Fix incorrect type in assignment of ipv6 port for audit
  * loop: use sysfs_emit() in the sysfs xxx show()
      drivers/block/loop.c
    selinux: use correct type for context length
    lib/test: use after free in register_test_dev_kmod()
    NFSv4/pNFS: Fix another issue with a list iterator pointing to the head
    net/x25: Fix null-ptr-deref caused by x25_disconnect
    qlcnic: dcb: default to returning -EOPNOTSUPP
    net: phy: broadcom: Fix brcm_fet_config_init()
  * xen: fix is_xen_pmu()
      arch/x86/xen/pmu.h
  * netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options
      net/netfilter/nf_conntrack_proto_tcp.c
    jfs: fix divide error in dbNextAG
    kgdbts: fix return value of __setup handler
    kgdboc: fix return value of __setup handler
    tty: hvc: fix return value of __setup handler
    pinctrl/rockchip: Add missing of_node_put() in rockchip_pinctrl_probe
    pinctrl: nomadik: Add missing of_node_put() in nmk_pinctrl_probe
    pinctrl: mediatek: Fix missing of_node_put() in mtk_pctrl_init
    NFS: remove unneeded check in decode_devicenotify_args()
    clk: tegra: tegra124-emc: Fix missing put_device() call in emc_ensure_emc_driver
    clk: clps711x: Terminate clk_div_table with sentinel element
    clk: loongson1: Terminate clk_div_table with sentinel element
    remoteproc: qcom_wcnss: Add missing of_node_put() in wcnss_alloc_memory_region
  * clk: qcom: clk-rcg2: Update the frac table for pixel clock
      drivers/clk/qcom/clk-rcg2.c
    iio: adc: Add check for devm_request_threaded_irq
    serial: 8250: Fix race condition in RTS-after-send handling
    serial: 8250_mid: Balance reference count for PCI DMA device
    staging:iio:adc:ad7280a: Fix handing of device address bit reversing.
    pwm: lpc18xx-sct: Initialize driver data and hardware before pwmchip_add()
    mxser: fix xmit_buf leak in activate when LSR == 0xff
    mfd: asic3: Add missing iounmap() on error asic3_mfd_probe
  * tcp: ensure PMTU updates are processed during fastopen
      net/ipv4/tcp_output.c
    i2c: mux: demux-pinctrl: do not deactivate a master that is not active
  * af_netlink: Fix shift out of bounds in group mask calculation
      net/netlink/af_netlink.c
    USB: storage: ums-realtek: fix error code in rts51x_read_mem()
    mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init
    MIPS: RB532: fix return value of __setup handler
    vxcan: enable local echo for sent CAN frames
    mfd: mc13xxx: Add check for mc13xxx_irq_request
    powerpc/sysdev: fix incorrect use to determine if list is empty
  * PCI: Reduce warnings on possible RW1C corruption
      drivers/pci/access.c
      include/linux/pci.h
    power: supply: wm8350-power: Add missing free in free_charger_irq
    power: supply: wm8350-power: Handle error for wm8350_register_irq
    i2c: xiic: Make bus names unique
    KVM: x86/emulator: Defer not-present segment check in __load_segment_descriptor()
    KVM: x86: Fix emulation in writing cr8
    power: supply: bq24190_charger: Fix bq24190_vbus_is_enabled() wrong false return
    drm/tegra: Fix reference leak in tegra_dsi_ganged_probe
    ext2: correct max file size computing
    TOMOYO: fix __setup handlers return values
    scsi: pm8001: Fix abort all task initialization
    scsi: pm8001: Fix payload initialization in pm80xx_set_thermal_config()
    scsi: pm8001: Fix command initialization in pm8001_chip_ssp_tm_req()
    scsi: pm8001: Fix command initialization in pm80XX_send_read_log()
  * dm crypt: fix get_key_size compiler warning if !CONFIG_KEYS
      drivers/md/dm-crypt.c
    iwlwifi: Fix -EIO error code that is never returned
    HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports
    power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init
    ray_cs: Check ioremap return value
    power: reset: gemini-poweroff: Fix IRQ check in gemini_poweroff_probe
    ath9k_htc: fix uninit value bugs
  * drm/edid: Don't clear formats if using deep color
      drivers/gpu/drm/drm_edid.c
    mtd: onenand: Check for error irq
    ASoC: msm8916-wcd-digital: Fix missing clk_disable_unprepare() in msm8916_wcd_digital_probe
    ASoC: imx-es8328: Fix error return code in imx_es8328_probe()
    ASoC: mxs: Fix error handling in mxs_sgtl5000_probe
    ASoC: dmaengine: do not use a NULL prepare_slave_config() callback
    video: fbdev: omapfb: Add missing of_node_put() in dvic_probe_of
    ASoC: fsi: Add check for clk_enable
    ASoC: wm8350: Handle error for wm8350_register_irq
    ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe
    media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
    ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction
    memory: emif: check the pointer temp in get_device_details()
    memory: emif: Add check for setup_interrupts
    ASoC: atmel_ssc_dai: Handle errors for clk_enable
    ASoC: mxs-saif: Handle errors for clk_enable
  * printk: fix return value of printk.devkmsg __setup handler
      kernel/printk/printk.c
    arm64: dts: broadcom: Fix sata nodename
    arm64: dts: ns2: Fix spi-cpol and spi-cpha property
    ALSA: spi: Add check for clk_enable()
    ASoC: ti: davinci-i2s: Add check for clk_enable()
    media: usb: go7007: s2250-board: fix leak in probe()
    soc: ti: wkup_m3_ipc: Fix IRQ check in wkup_m3_ipc_probe
    ARM: dts: qcom: ipq4019: fix sleep clock
  * video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name()
      drivers/video/fbdev/core/fbcvt.c
    video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe()
    media: coda: Fix missing put_device() call in coda_get_vdoa_data
    perf/x86/intel/pt: Fix address filter config for 32-bit kernel
  * perf/core: Fix address filter parser for multiple filters
      kernel/events/core.c
  * sched/debug: Remove mpol_get/put and task_lock/unlock from sched_show_numa
      kernel/sched/debug.c
    clocksource: acpi_pm: fix return value of __setup handler
    hwmon: (pmbus) Add Vin unit off handling
    crypto: ccp - ccp_dmaengine_unregister release dma channels
    ACPI: APEI: fix return value of __setup handlers
  * crypto: vmx - add missing dependencies
      drivers/crypto/vmx/Kconfig
    hwrng: atmel - disable trng on failure path
    PM: suspend: fix return value of __setup handler
    PM: hibernate: fix __setup handler error handling
    hwmon: (sch56xx-common) Replace WDOG_ACTIVE with WDOG_HW_RUNNING
    hwmon: (pmbus) Add mutex to regulator ops
    spi: pxa2xx-pci: Balance reference count for PCI DMA device
    selftests/x86: Add validity check and allow field splitting
    spi: tegra114: Add missing IRQ check in tegra_spi_probe
    crypto: mxs-dcp - Fix scatterlist processing
  * crypto: authenc - Fix sleep in atomic context in decrypt_tail
      crypto/authenc.c
    PCI: pciehp: Clear cmd_busy bit in polling mode
    brcmfmac: pcie: Replace brcmf_pcie_copy_mem_todev with memcpy_toio
    brcmfmac: firmware: Allocate space for default boardrev in nvram
    media: davinci: vpif: fix unbalanced runtime PM get
  * DEC: Limit PMAX memory probing to R3k systems
      arch/mips/include/asm/dec/prom.h
    lib/raid6/test: fix multiple definition linking error
    thermal: int340x: Increase bitmap size
    carl9170: fix missing bit-wise or operator for tx_params
    ARM: dts: exynos: add missing HDMI supplies on SMDK5420
    ARM: dts: exynos: add missing HDMI supplies on SMDK5250
    ARM: dts: exynos: fix UART3 pins configuration in Exynos5250
    ARM: dts: at91: sama5d2: Fix PMERRLOC resource size
    video: fbdev: atari: Atari 2 bpp (STe) palette bugfix
    video: fbdev: sm712fb: Fix crash in smtcfb_read()
    drivers: hamradio: 6pack: fix UAF bug caused by mod_timer()
    ACPI: properties: Consistently return -ENOENT if there are no more references
    drbd: fix potential silent data corruption
    ALSA: cs4236: fix an incorrect NULL check on list iterator
  * Revert "Input: clear BTN_RIGHT/MIDDLE on buttonpads"
      drivers/input/input.c
    qed: validate and restrict untrusted VFs vlan promisc mode
    qed: display VF trust config
    scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands
    mempolicy: mbind_range() set_policy() after vma_merge()
  * mm/pages_alloc.c: don't create ZONE_MOVABLE beyond the end of a node
      mm/page_alloc.c
    jffs2: fix memory leak in jffs2_scan_medium
    jffs2: fix memory leak in jffs2_do_mount_fs
    jffs2: fix use-after-free in jffs2_clear_xattr_subsystem
    can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path
    pinctrl: samsung: drop pin banks references on error paths
    NFSD: prevent underflow in nfssvc_decode_writeargs()
    SUNRPC: avoid race between mod_timer() and del_timer_sync()
    Documentation: update stable tree link
    Documentation: add link to stable release candidate tree
  * ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE
      kernel/ptrace.c
    clk: uniphier: Fix fixed-rate initialization
  * iio: inkern: make a best effort on offset calculation
      drivers/iio/inkern.c
  * iio: inkern: apply consumer scale when no channel scale is available
      drivers/iio/inkern.c
  * iio: inkern: apply consumer scale on IIO_VAL_INT cases
      drivers/iio/inkern.c
  * coresight: Fix TRCCONFIGR.QE sysfs interface
      drivers/hwtracing/coresight/coresight-etm4x-sysfs.c
    USB: usb-storage: Fix use of bitfields for hardware data in ene_ub6250.c
    virtio-blk: Use blk_validate_block_size() to validate block size
  * block: Add a helper to validate the block size
      include/linux/blkdev.h
    tpm: fix reference counting for struct tpm_chip
  * fuse: fix pipe buffer lifetime for direct_io
      fs/fuse/dev.c
      fs/fuse/file.c
      fs/fuse/fuse_i.h
  * af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register
      net/key/af_key.c
  * spi: Fix erroneous sgs value with min_t()
      drivers/spi/spi.c
  * spi: Fix invalid sgs value
      drivers/spi/spi.c
    ethernet: sun: Free the coherent when failing in probing
    virtio_console: break out of buf poll on remove
  * netdevice: add the case if dev is NULL
      include/linux/netdevice.h
  * USB: serial: simple: add Nokia phone driver
      drivers/usb/serial/Kconfig
    USB: serial: pl2303: add IBM device IDs
  * ANDROID: incremental-fs: limit mount stack depth
      fs/incfs/data_mgmt.h
      fs/incfs/vfs.c
  * UPSTREAM: binderfs: use __u32 for device numbers
      include/uapi/linux/android/binderfs.h
    Merge 4.14.275 into android-4.14-stable
Linux 4.14.275
  * arm64: Use the clearbhb instruction in mitigations
      arch/arm64/include/asm/assembler.h
      arch/arm64/include/asm/cpufeature.h
      arch/arm64/include/asm/sysreg.h
      arch/arm64/include/asm/vectors.h
      arch/arm64/kernel/cpu_errata.c
      arch/arm64/kernel/cpufeature.c
      arch/arm64/kernel/entry.S
  * arm64: add ID_AA64ISAR2_EL1 sys register
      arch/arm64/include/asm/cpu.h
      arch/arm64/include/asm/sysreg.h
      arch/arm64/kernel/cpufeature.c
      arch/arm64/kernel/cpuinfo.c
  * KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and migrated
      arch/arm/include/asm/kvm_host.h
      arch/arm64/include/asm/kvm_host.h
  * arm64: Mitigate spectre style branch history side channels
      arch/arm64/Kconfig
      arch/arm64/include/asm/assembler.h
      arch/arm64/include/asm/cpufeature.h
      arch/arm64/include/asm/cputype.h
      arch/arm64/include/asm/sysreg.h
      arch/arm64/include/asm/vectors.h
      arch/arm64/kernel/cpu_errata.c
  * KVM: arm64: Add templates for BHB mitigation sequences
      arch/arm64/include/asm/cpucaps.h
      arch/arm64/include/asm/kvm_mmu.h
      arch/arm64/include/asm/mmu.h
      arch/arm64/kernel/cpu_errata.c
  * arm64: proton-pack: Report Spectre-BHB vulnerabilities as part of Spectre-v2
      arch/arm64/include/asm/cpufeature.h
      arch/arm64/kernel/cpu_errata.c
  * arm64: Add percpu vectors for EL1
      arch/arm64/include/asm/mmu.h
      arch/arm64/include/asm/vectors.h
      arch/arm64/kernel/cpufeature.c
      arch/arm64/kernel/entry.S
  * arm64: entry: Add macro for reading symbol addresses from the trampoline
      arch/arm64/kernel/entry.S
  * arm64: entry: Add vectors that have the bhb mitigation sequences
      arch/arm64/include/asm/assembler.h
      arch/arm64/include/asm/vectors.h
      arch/arm64/kernel/entry.S
      include/linux/arm-smccc.h
  * arm64: entry: Add non-kpti __bp_harden_el1_vectors for mitigations
      arch/arm64/kernel/entry.S
  * arm64: entry: Allow the trampoline text to occupy multiple pages
      arch/arm64/include/asm/fixmap.h
      arch/arm64/include/asm/sections.h
      arch/arm64/kernel/entry.S
      arch/arm64/kernel/vmlinux.lds.S
      arch/arm64/mm/mmu.c
  * arm64: entry: Make the kpti trampoline's kpti sequence optional
      arch/arm64/kernel/entry.S
  * arm64: entry: Move trampoline macros out of ifdef'd section
      arch/arm64/kernel/entry.S
  * arm64: entry: Don't assume tramp_vectors is the start of the vectors
      arch/arm64/kernel/entry.S
  * arm64: entry: Allow tramp_alias to access symbols after the 4K boundary
      arch/arm64/kernel/entry.S
  * arm64: entry: Move the trampoline data page before the text page
      arch/arm64/include/asm/fixmap.h
      arch/arm64/kernel/entry.S
  * arm64: entry: Free up another register on kpti's tramp_exit path
      arch/arm64/kernel/entry.S
  * arm64: entry: Make the trampoline cleanup optional
      arch/arm64/kernel/entry.S
  * arm64: entry.S: Add ventry overflow sanity checks
      arch/arm64/kernel/entry.S
  * arm64: Add Cortex-X2 CPU part definition
      arch/arm64/include/asm/cputype.h
  * arm64: Add Neoverse-N2, Cortex-A710 CPU part definition
      arch/arm64/include/asm/cputype.h
  * arm64: Add part number for Arm Cortex-A77
      arch/arm64/include/asm/cputype.h
  * arm64: Add part number for Neoverse N1
      arch/arm64/include/asm/cputype.h
  * arm64: Make ARM64_ERRATUM_1188873 depend on COMPAT
      arch/arm64/Kconfig
    arm64: Add silicon-errata.txt entry for ARM erratum 1188873
  * arm64: arch_timer: avoid unused function warning
      arch/arm64/Kconfig
  * arm64: arch_timer: Add workaround for ARM erratum 1188873
      arch/arm64/Kconfig
      arch/arm64/include/asm/cpucaps.h
      arch/arm64/include/asm/cputype.h
      arch/arm64/kernel/cpu_errata.c
      drivers/clocksource/arm_arch_timer.c
    Merge 4.14.274 into android-4.14-stable
Linux 4.14.274
    llc: only change llc->dev when bind() succeeds
    mac80211: fix potential double free on mesh join
    crypto: qat - disable registration of algorithms
    ACPI: video: Force backlight native for Clevo NL5xRU and NL5xNU
    ACPI: battery: Add device HID and quirk for Microsoft Surface Go 3
    ACPI / x86: Work around broken XSDT on Advantech DAC-BJ01 board
    netfilter: nf_tables: initialize registers in nft_do_chain()
    drivers: net: xgene: Fix regression in CRC stripping
    ALSA: pci: fix reading of swapped values from pcmreg in AC97 codec
    ALSA: cmipci: Restore aux vol on suspend/resume
  * ALSA: usb-audio: Add mute TLV for playback volumes on RODE NT-USB
      sound/usb/mixer_quirks.c
  * ALSA: pcm: Add stream lock during PCM reset ioctl operations
      sound/core/pcm_native.c
    llc: fix netdevice reference leaks in llc_ui_bind()
    thermal: int340x: fix memory leak in int3400_notify()
    staging: fbtft: fb_st7789v: reset display before initialization
  * esp: Fix possible buffer overflow in ESP transformation
      include/net/esp.h
      include/net/sock.h
      net/core/sock.c
      net/ipv4/esp4.c
      net/ipv6/esp6.c
  * net: ipv6: fix skb_over_panic in __ip6_append_data
      net/ipv6/ip6_output.c
    nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION
    Merge 4.14.273 into android-4.14-stable
Linux 4.14.273
    perf symbols: Fix symbol size calculation condition
    Input: aiptek - properly check endpoint type
  * usb: gadget: Fix use-after-free bug by not setting udc->dev.driver
      drivers/usb/gadget/udc/core.c
  * usb: gadget: rndis: prevent integer overflow in rndis_set_response()
      drivers/usb/gadget/function/rndis.c
  * net: handle ARPHRD_PIMREG in dev_is_mac_header_xmit()
      include/linux/if_arp.h
    atm: eni: Add check for dma_map_single
  * net/packet: fix slab-out-of-bounds access in packet_recvmsg()
      net/packet/af_packet.c
    efi: fix return value of __setup handlers
  * fs: sysfs_emit: Remove PAGE_SIZE alignment check
      fs/sysfs/file.c
    kselftest/vm: fix tests build with old libc
    sfc: extend the locking on mcdi->seqno
  * tcp: make tcp_read_sock() more robust
      net/ipv4/tcp.c
  * nl80211: Update bss channel on channel switch for P2P_CLIENT
      net/wireless/nl80211.c
    atm: firestream: check the return value of ioremap() in fs_init()
    can: rcar_canfd: rcar_canfd_channel_probe(): register the CAN device when fully ready
  * ARM: 9178/1: fix unmet dependency on BITREVERSE for HAVE_ARCH_BITREVERSE
      lib/Kconfig
    MIPS: smp: fill in sibling and core maps earlier
    ARM: dts: rockchip: fix a typo on rk3288 crypto-controller
    arm64: dts: rockchip: fix rk3399-puma eMMC HS400 signal integrity
  * xfrm: Fix xfrm migrate issues when address family changes
      net/xfrm/xfrm_state.c
  * sctp: fix the processing for INIT_ACK chunk
      net/sctp/sm_statefuns.c
  * sctp: fix the processing for INIT chunk
      net/sctp/sm_statefuns.c
    Merge 4.14.272 into android-4.14-stable
Linux 4.14.272
    btrfs: unlock newly allocated extent buffer after error
  * ext4: add check to prevent attempting to resize an fs with sparse_super2
      fs/ext4/resize.c
    ARM: fix Thumb2 regression with Spectre BHB
  * virtio: acknowledge all features before access
      include/linux/virtio_config.h
  * virtio: unexport virtio_finalize_features
      include/linux/virtio.h
    staging: gdm724x: fix use after free in gdm_lte_rx()
  * ARM: Spectre-BHB: provide empty stub for non-config
      arch/arm/include/asm/spectre.h
    selftests/memfd: clean up mapping in mfd_fail_write
  * tracing: Ensure trace buffer is at least 4096 bytes large
      kernel/trace/trace.c
    Revert "xen-netback: Check for hotplug-status existence before watching"
    Revert "xen-netback: remove 'hotplug-status' once it has served its purpose"
  * net-sysfs: add check for netdevice being present to speed_show
      net/core/net-sysfs.c
  * sctp: fix kernel-infoleak for SCTP sockets
      net/sctp/sctp_diag.c
    gpio: ts4900: Do not set DAT and OE together
    NFC: port100: fix use-after-free in port100_send_complete
  * net/mlx5: Fix size field in bufferx_reg struct
      include/linux/mlx5/mlx5_ifc.h
    ax25: Fix NULL pointer dereference in ax25_kill_by_device
    net: ethernet: lpc_eth: Handle error for clk_enable
    net: ethernet: ti: cpts: Handle error for clk_enable
    ethernet: Fix error handling in xemaclite_of_probe
    qed: return status of qed_iov_get_link
    net: qlogic: check the return value of dma_alloc_coherent() in qed_vf_hw_prepare()

Bug: 229982346
Change-Id: I5f44cf8b4adab635addd715739ada57c12d99ff4
Signed-off-by: Lucas Wei <lucaswei@google.com>
2022-05-12 23:50:10 +08:00
Christian Brauner
1848ba7e35 UPSTREAM: binderfs: use __u32 for device numbers
We allow more then 255 binderfs binder devices to be created since there
are workloads that require more than that. If we use __u8 we'll overflow
after 255. So let's use a __u32.
Note that there's no released kernel with binderfs out there so this is
not a regression.

Signed-off-by: Christian Brauner <christian@brauner.io>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 7d0174065f4903fb0ce0bab3d5047284faa7226d)
Bug: 228263403
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Change-Id: If143c0d6511946fac6349c5db7c013535950de4a
2022-04-07 00:31:57 +00:00
Li Li
8aad93fa35 BACKPORT: FROMGIT: binder: fix freeze race
Currently cgroup freezer is used to freeze the application threads, and
BINDER_FREEZE is used to freeze the corresponding binder interface.
There's already a mechanism in ioctl(BINDER_FREEZE) to wait for any
existing transactions to drain out before actually freezing the binder
interface.

But freezing an app requires 2 steps, freezing the binder interface with
ioctl(BINDER_FREEZE) and then freezing the application main threads with
cgroupfs. This is not an atomic operation. The following race issue
might happen.

1) Binder interface is frozen by ioctl(BINDER_FREEZE);
2) Main thread A initiates a new sync binder transaction to process B;
3) Main thread A is frozen by "echo 1 > cgroup.freeze";
4) The response from process B reaches the frozen thread, which will
unexpectedly fail.

This patch provides a mechanism to check if there's any new pending
transaction happening between ioctl(BINDER_FREEZE) and freezing the
main thread. If there's any, the main thread freezing operation can
be rolled back to finish the pending transaction.

Furthermore, the response might reach the binder driver before the
rollback actually happens. That will still cause failed transaction.

As the other process doesn't wait for another response of the response,
the response transaction failure can be fixed by treating the response
transaction like an oneway/async one, allowing it to reach the frozen
thread. And it will be consumed when the thread gets unfrozen later.

NOTE: This patch reuses the existing definition of struct
binder_frozen_status_info but expands the bit assignments of __u32
member sync_recv.

To ensure backward compatibility, bit 0 of sync_recv still indicates
there's an outstanding sync binder transaction. This patch adds new
information to bit 1 of sync_recv, indicating the binder transaction
happens exactly when there's a race.

If an existing userspace app runs on a new kernel, a sync binder call
will set bit 0 of sync_recv so ioctl(BINDER_GET_FROZEN_INFO) still
return the expected value (true). The app just doesn't check bit 1
intentionally so it doesn't have the ability to tell if there's a race.
This behavior is aligned with what happens on an old kernel which
doesn't set bit 1 at all.

A new userspace app can 1) check bit 0 to know if there's a sync binder
transaction happened when being frozen - same as before; and 2) check
bit 1 to know if that sync binder transaction happened exactly when
there's a race - a new information for rollback decision.

Fixes: 432ff1e91694 ("binder: BINDER_FREEZE ioctl")
Acked-by: Todd Kjos <tkjos@google.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Li Li <dualli@google.com>
Test: stress test with apps being frozen and initiating binder calls at
the same time, confirmed the pending transactions succeeded.
Link: https://lore.kernel.org/r/20210910164210.2282716-2-dualli@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 198493121
(cherry picked from commit b564171ade70570b7f335fa8ed17adb28409e3ac
 git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
 char-misc-linus)
Change-Id: I488ba75056f18bb3094ba5007027b76b5caebec9
2021-09-14 07:34:43 +00:00
Todd Kjos
21296b2bf5 UPSTREAM: binder: add flag to clear buffer on txn complete
Add a per-transaction flag to indicate that the buffer
must be cleared when the transaction is complete to
prevent copies of sensitive data from being preserved
in memory.

Signed-off-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20201120233743.3617529-1-tkjos@google.com
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 171501513
Change-Id: Ic9338c85cbe3b11ab6f2bda55dce9964bb48447a
(cherry picked from commit 0f966cba95c78029f491b433ea95ff38f414a761)
Signed-off-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
2021-02-20 19:20:51 +00:00
Marco Ballesio
4ece852ab5 binder: introduce the BINDER_GET_FROZEN_INFO ioctl
User space needs to know if binder transactions occurred to frozen
processes. Introduce a new BINDER_GET_FROZEN ioctl and keep track of
transactions occurring to frozen proceses. Also, allow async
transactions toward frozen processes and improve error hendling.

Bug: 143717177
Test: atest testBinderLib
Signed-off-by: Marco Ballesio <balejs@google.com>

Change-Id: I9ee1c2e5fe3d4ab31fc1a137d840bd4cd38a8704
2020-09-17 18:32:03 -07:00
Marco Ballesio
c44fca7ccf binder: implement BINDER_FREEZE ioctl
Frozen tasks can't process binder transactions, so a way is required to
inform transmitting ends of communication failures due to the frozen
state of their receiving counterparts. Additionally, races are possible
between transitions to frozen state and binder transactions enqueued to a
specific process.

Implement BINDER_FREEZE ioctl for user space to inform the binder driver
about the intention to freeze or unfreeze a process. When the ioctl is
called, block the caller until any pending binder transactions toward the
target process are flushed. Return an error to transactions to processes
marked as frozen.

Bug: 143717177
Change-Id: Ie16f72b490bbe1785b82dee2442452f71ad7dc65
Signed-off-by: Marco Ballesio <balejs@google.com>
Co-developed-by: Todd Kjos <tkjos@google.com>
2020-08-31 10:21:40 -07:00
lucaswei
3eaaeb22db Merge android-4.14 (4.14.165) into android-msm-floral-4.14-lts
Merge 4.14.165 into android-4.14
    cuttlefish - enable CONFIG_NETFILTER_XT_MATCH_QUOTA2_LOG=y
    ANDROID: Enable HID_STEAM as y
Linux 4.14.165
    drm/i915/gen9: Clear residual context state on context switch
    netfilter: ipset: avoid null deref when IPSET_ATTR_LINENO is present
  * netfilter: arp_tables: init netns pointer in xt_tgchk_param struct
      net/ipv4/netfilter/arp_tables.c
    phy: cpcap-usb: Fix flakey host idling and enumerating of devices
    phy: cpcap-usb: Fix error path when no host driver is loaded
  * USB: Fix: Don't skip endpoint descriptors with maxpacket=0
      drivers/usb/core/config.c
  * HID: hiddev: fix mess in hiddev_open()
      drivers/hid/usbhid/hiddev.c
  * arm64: cpufeature: Avoid warnings due to unused symbols
      arch/arm64/kernel/cpufeature.c
    ath10k: fix memory leak
    rtl8xxxu: prevent leaking urb
    scsi: bfa: release allocated memory in case of error
    mwifiex: pcie: Fix memory leak in mwifiex_pcie_alloc_cmdrsp_buf
    mwifiex: fix possible heap overflow in mwifiex_process_country_ie()
  * tty: always relink the port
      drivers/tty/tty_port.c
  * tty: link tty and port before configuring it as console
      drivers/tty/serial/serial_core.c
      drivers/tty/tty_port.c
    staging: rtl8188eu: Add device code for TP-Link TL-WN727N v5.21
  * drm/dp_mst: correct the shifting in DP_REMOTE_I2C_READ
      drivers/gpu/drm/drm_dp_mst_topology.c
    drm/fb-helper: Round up bits_per_pixel if possible
  * Input: add safety guards to input_set_keycode()
      drivers/input/input.c
  * HID: hid-input: clear unmapped usages
      drivers/hid/hid-input.c
    staging: comedi: adv_pci1710: fix AI channels 16-31 for PCI-1713
    usb: musb: dma: Correct parameter passed to IRQ handler
    usb: musb: Disable pullup at init
    usb: musb: fix idling for suspend after disconnect interrupt
    USB: serial: option: add ZLP support for 0x1bc7/0x9010
    staging: vt6656: set usb_set_intfdata on driver fail.
    gpiolib: acpi: Add honor_wakeup module-option + quirk mechanism
    gpiolib: acpi: Turn dmi_system_id table into a generic quirk table
    can: can_dropped_invalid_skb(): ensure an initialized headroom in outgoing CAN sk_buffs
    can: mscan: mscan_rx_poll(): fix rx path lockup when returning from polling to irq mode
    can: gs_usb: gs_usb_probe(): use descriptors of current altsetting
  * HID: uhid: Fix returning EPOLLOUT from uhid_char_poll
      drivers/hid/uhid.c
  * HID: Fix slab-out-of-bounds read in hid_field_extract
      drivers/hid/hid-core.c
    tracing: Have stack tracer compile when MCOUNT_INSN_SIZE is not defined
    kernel/trace: Fix do not unregister tracepoints when register sched_migrate_task fail
    ALSA: hda/realtek - Set EAPD control to default for ALC222
    ALSA: hda/realtek - Add new codec supported for ALCS1200A
  * ALSA: usb-audio: Apply the sample rate quirk for Bose Companion 5
      sound/usb/quirks.c
    usb: chipidea: host: Disable port power only if previously enabled
  * chardev: Avoid potential use-after-free in 'chrdev_open()'
      fs/char_dev.c
    Merge remote-tracking branch 'origin/upstream-f2fs-stable-linux-4.14.y' into android-4.14
  * UPSTREAM: kcov: fix struct layout for kcov_remote_arg
      include/uapi/linux/kcov.h
    UPSTREAM: vhost, kcov: collect coverage from vhost_worker
  * UPSTREAM: usb, kcov: collect coverage from hub_event
      drivers/usb/core/hub.c
  * BACKPORT: kcov: remote coverage support
      include/linux/kcov.h
      include/linux/sched.h
      include/uapi/linux/kcov.h
  * UPSTREAM: kcov: improve CONFIG_ARCH_HAS_KCOV help text
      lib/Kconfig.debug
    UPSTREAM: kcov: convert kcov.refcount to refcount_t
    UPSTREAM: kcov: no need to check return value of debugfs_create functions
    UPSTREAM: kernel/kcov.c: mark write_comp_data() as notrace
    UPSTREAM: kernel/kcov.c: mark funcs in __sanitizer_cov_trace_pc() as notrace
  * BACKPORT: sched/core / kcov: avoid kcov_area during task switch
      include/linux/kcov.h
      include/linux/sched.h
      kernel/sched/core.c
    UPSTREAM: kcov: prefault the kcov_area
  * BACKPORT: kcov: test compiler capability in Kconfig and correct dependency
      lib/Kconfig.debug
      scripts/Makefile.gcc-plugins
      scripts/Makefile.kcov
  * UPSTREAM: gcc-plugins: fix build condition of SANCOV plugin
      scripts/Makefile.gcc-plugins
    UPSTREAM: kcov: fix comparison callback signature
    UPSTREAM: kcov: update documentation
  * BACKPORT: Makefile: support flag -fsanitizer-coverage=trace-cmp
      Makefile
      lib/Kconfig.debug
      scripts/Makefile.kcov
  * BACKPORT: kcov: support comparison operands collection
      include/linux/kcov.h
      include/uapi/linux/kcov.h
    UPSTREAM: kcov: remove pointless current != NULL check
    Merge 4.14.164 into android-4.14
Linux 4.14.164
    vlan: fix memory leak in vlan_dev_set_egress_priority
  * net: sch_prio: When ungrafting, replace with FIFO
      net/sched/sch_prio.c
    vlan: vlan_changelink() should propagate errors
    vxlan: fix tos value before xmit
  * tcp: fix "old stuff" D-SACK causing SACK to be treated as D-SACK
      net/ipv4/tcp_input.c
    sctp: free cmd->obj.chunk for the unprocessed SCTP_CMD_REPLY
    USB: serial: option: add Telit ME910G1 0x110a composition
  * USB: core: fix check for duplicate endpoints
      drivers/usb/core/config.c
    pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM
    net: usb: lan78xx: fix possible skb leak
    net: stmmac: dwmac-sunxi: Allow all RGMII modes
    net: stmmac: dwmac-sun8i: Allow all RGMII modes
    net: dsa: mv88e6xxx: Preserve priority when setting CPU port.
  * macvlan: do not assume mac_header is set in macvlan_broadcast()
      include/linux/if_ether.h
    gtp: fix bad unlock balance in gtp_encap_enable_socket
    mmc: block: propagate correct returned value in mmc_rpmb_ioctl
    mmc: core: Prevent bus reference leak in mmc_blk_init()
    mmc: block: Fix bug when removing RPMB chardev
    mmc: block: Delete mmc_access_rpmb()
    mmc: block: Convert RPMB to a character device
    PCI/switchtec: Read all 64 bits of part_event_bitmap
  * bpf: Fix passing modified ctx to ld/abs/ind instruction
      kernel/bpf/verifier.c
  * bpf: reject passing modified ctx to helper functions
      kernel/bpf/verifier.c
    hv_netvsc: Fix unwanted rx_table reset
    llc2: Fix return statement of llc_stat_ev_rx_null_dsap_xid_c (and _test_c)
    parisc: Fix compiler warnings in debug_core.c
  * block: fix memleak when __blk_rq_map_user_iov() is failed
      block/blk-map.c
    s390/dasd: fix memleak in path handling error case
    s390/dasd/cio: Interpret ccw_device_get_mdc return value correctly
    net: stmmac: RX buffer size must be 16 byte aligned
    net: stmmac: Do not accept invalid MTU values
  * fs: avoid softlockups in s_inodes iterators
      fs/drop_caches.c
      fs/inode.c
      fs/notify/fsnotify.c
      fs/quota/dquot.c
    perf/x86/intel: Fix PT PMI handling
  * kconfig: don't crash on NULL expressions in expr_eq()
      scripts/kconfig/expr.c
    regulator: rn5t618: fix module aliases
    ASoC: wm8962: fix lambda value
  * rfkill: Fix incorrect check to avoid NULL pointer dereference
      net/rfkill/core.c
    net: usb: lan78xx: Fix error message format specifier
    bnx2x: Fix logic to get total no. of PFs per engine
    bnx2x: Do not handle requests from VFs after parity
    powerpc: Ensure that swiotlb buffer is allocated from low memory
    samples: bpf: fix syscall_tp due to unused syscall
    samples: bpf: Replace symbol compare of trace_event
    ARM: dts: am437x-gp/epos-evm: fix panel compatible
    bpf, mips: Limit to 33 tail calls
    ARM: dts: bcm283x: Fix critical trip point
    ASoC: topology: Check return value for soc_tplg_pcm_create()
    spi: spi-cavium-thunderx: Add missing pci_release_regions()
    ARM: dts: Cygnus: Fix MDIO node address/size cells
    netfilter: nf_tables: validate NFT_SET_ELEM_INTERVAL_END
    netfilter: uapi: Avoid undefined left-shift in xt_sctp.h
    ARM: vexpress: Set-up shared OPP table instead of individual for each CPU
    efi/gop: Fix memory leak in __gop_query32/64()
    efi/gop: Return EFI_SUCCESS if a usable GOP was found
    efi/gop: Return EFI_NOT_FOUND if there are no usable GOPs
    x86/efi: Update e820 with reserved EFI boot services data to fix kexec breakage
    libtraceevent: Fix lib installation with O=
    mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame()
  * netfilter: ctnetlink: netns exit must wait for callbacks
      net/netfilter/nf_conntrack_netlink.c
    locking/spinlock/debug: Fix various data races
    USB: dummy-hcd: increase max number of devices to 32
    USB: dummy-hcd: use usb_urb_dir_in instead of usb_pipein
    UPSTREAM: USB: dummy-hcd: use usb_urb_dir_in instead of usb_pipein
    UPSTREAM: USB: dummy-hcd: increase max number of devices to 32
    UPSTREAM: USB: dummy-hcd: Fix failure to give back unlinked URBs
    UPSTREAM: USB: dummy-hcd: bandwidth limits for non-bulk transfers
  * BACKPORT: perf_event: Add support for LSM and SELinux checks
      include/linux/lsm_hooks.h
      include/linux/perf_event.h
      include/linux/security.h
      kernel/events/core.c
      kernel/trace/trace_event_perf.c
      security/security.c
      security/selinux/hooks.c
      security/selinux/include/classmap.h
      security/selinux/include/objsec.h
    ANDROID: cuttlefish_defconfig: remove 80211_HWSIM
    docs: fs-verity: mention statx() support
  * f2fs: support STATX_ATTR_VERITY
      fs/f2fs/file.c
  * ext4: support STATX_ATTR_VERITY
      fs/ext4/inode.c
  * statx: define STATX_ATTR_VERITY
      include/linux/stat.h
      include/uapi/linux/stat.h
    docs: fs-verity: document first supported kernel version
  * f2fs: add support for IV_INO_LBLK_64 encryption policies
      fs/f2fs/super.c
  * ext4: add support for IV_INO_LBLK_64 encryption policies
      fs/ext4/ext4.h
      fs/ext4/super.c
  * fscrypt: add support for IV_INO_LBLK_64 policies
      fs/crypto/crypto.c
      fs/crypto/fscrypt_private.h
      fs/crypto/keyring.c
      fs/crypto/keysetup.c
      fs/crypto/policy.c
      include/linux/fscrypt.h
      include/uapi/linux/fscrypt.h
  * fscrypt: avoid data race on fscrypt_mode::logged_impl_name
      fs/crypto/fscrypt_private.h
      fs/crypto/keysetup.c
  * fscrypt: zeroize fscrypt_info before freeing
      fs/crypto/keysetup.c
  * fscrypt: remove struct fscrypt_ctx
      fs/crypto/bio.c
      fs/crypto/crypto.c
      fs/crypto/fscrypt_private.h
      include/linux/fscrypt.h
  * fscrypt: invoke crypto API for ESSIV handling
      fs/crypto/crypto.c
      fs/crypto/fscrypt_private.h
      fs/crypto/keysetup.c
      fs/crypto/keysetup_v1.c
    Merge 4.14.163 into android-4.14
  * Revert "BACKPORT: perf_event: Add support for LSM and SELinux checks"
      include/linux/lsm_hooks.h
      include/linux/perf_event.h
      include/linux/security.h
      kernel/events/core.c
      kernel/trace/trace_event_perf.c
      security/security.c
      security/selinux/hooks.c
      security/selinux/include/classmap.h
      security/selinux/include/objsec.h
Linux 4.14.163
    perf/x86/intel/bts: Fix the use of page_private()
    xen/blkback: Avoid unmapping unmapped grant pages
    s390/smp: fix physical to logical CPU map for SMT
  * net: add annotations on hh->hh_len lockless accesses
      include/net/neighbour.h
      net/core/neighbour.c
      net/ethernet/eth.c
    arm64: dts: meson: odroid-c2: Disable usb_otg bus to avoid power failed warning
    ath9k_htc: Discard undersized packets
    ath9k_htc: Modify byte order for an error message
    rxrpc: Fix possible NULL pointer access in ICMP handling
    selftests: rtnetlink: add addresses with fixed life time
    powerpc/pseries/hvconsole: Fix stack overread via udbg
  * drm/mst: Fix MST sideband up-reply failure handling
      drivers/gpu/drm/drm_dp_mst_topology.c
    scsi: qedf: Do not retry ELS request if qedf_alloc_cmd fails
  * fix compat handling of FICLONERANGE, FIDEDUPERANGE and FS_IOC_FIEMAP
      fs/compat_ioctl.c
    tty: serial: msm_serial: Fix lockup for sysrq and oops
    dt-bindings: clock: renesas: rcar-usb2-clock-sel: Fix typo in example
    media: usb: fix memory leak in af9005_identify_state
    regulator: ab8500: Remove AB8505 USB regulator
    media: flexcop-usb: ensure -EIO is returned on error condition
  * Bluetooth: Fix memory leak in hci_connect_le_scan
      net/bluetooth/hci_conn.c
  * Bluetooth: delete a stray unlock
      net/bluetooth/l2cap_core.c
    Bluetooth: btusb: fix PM leak in error case of setup
    platform/x86: pmc_atom: Add Siemens CONNECT X300 to critclk_systems DMI table
    xfs: don't check for AG deadlock for realtime files in bunmapi
    scsi: qla2xxx: Drop superfluous INIT_WORK of del_work
    nfsd4: fix up replay_matches_cache()
  * PM / devfreq: Check NULL governor in available_governors_show
      drivers/devfreq/devfreq.c
  * arm64: Revert support for execute-only user mappings
      arch/arm64/include/asm/pgtable-prot.h
      arch/arm64/include/asm/pgtable.h
      arch/arm64/mm/fault.c
      mm/mmap.c
    ftrace: Avoid potential division by zero in function profiler
  * exit: panic before exit_mm() on global init exit
      kernel/exit.c
    ALSA: firewire-motu: Correct a typo in the clock proc string
    ALSA: cs4236: fix error return comparison of an unsigned integer
    tracing: Have the histogram compare functions convert to u64 first
  * tracing: Fix lock inversion in trace_event_enable_tgid_record()
      kernel/trace/trace.c
      kernel/trace/trace_events.c
  * gpiolib: fix up emulated open drain outputs
      drivers/gpio/gpiolib.c
    ata: ahci_brcm: Fix AHCI resources management
    ata: ahci_brcm: Allow optional reset controller to be used
    ata: libahci_platform: Export again ahci_platform_<en/dis>able_phys()
  * compat_ioctl: block: handle BLKREPORTZONE/BLKRESETZONE
      block/compat_ioctl.c
  * compat_ioctl: block: handle Persistent Reservations
      block/compat_ioctl.c
  * dmaengine: Fix access to uninitialized dma_slave_caps
      include/linux/dmaengine.h
  * locks: print unsigned ino in /proc/locks
      fs/locks.c
  * pstore/ram: Write new dumps to start of recycled zones
      fs/pstore/ram.c
  * memcg: account security cred as well to kmemcg
      kernel/cred.c
  * mm/zsmalloc.c: fix the migrated zspage statistics.
      mm/zsmalloc.c
    media: cec: avoid decrementing transmit_queue_sz if it is 0
    media: cec: CEC 2.0-only bcast messages were ignored
    media: pulse8-cec: fix lost cec_transmit_attempt_done() call
    MIPS: Avoid VDSO ABI breakage due to global register variable
    drm/sun4i: hdmi: Remove duplicate cleanup calls
    ALSA: ice1724: Fix sleep-in-atomic in Infrasonic Quartet support code
  * drm: limit to INT_MAX in create_blob ioctl
      drivers/gpu/drm/drm_property.c
  * taskstats: fix data-race
      kernel/taskstats.c
    xfs: fix mount failure crash on invalid iclog memory access
    PM / hibernate: memory_bm_find_bit(): Tighten node optimisation
    xen/balloon: fix ballooned page accounting without hotplug enabled
    xen-blkback: prevent premature module unload
    IB/mlx4: Follow mirror sequence of device add during device removal
    s390/cpum_sf: Avoid SBD overflow condition in irq handler
    s390/cpum_sf: Adjust sampling interval to avoid hitting sample limits
    md: raid1: check rdev before reference in raid1_sync_request func
  * net: make socket read/write_iter() honor IOCB_NOWAIT
      net/socket.c
    usb: gadget: fix wrong endpoint desc
    drm/nouveau: Move the declaration of struct nouveau_conn_atom up a bit
    scsi: libsas: stop discovering if oob mode is disconnected
    scsi: iscsi: qla4xxx: fix double free in probe
    scsi: qla2xxx: Don't call qlt_async_event twice
    scsi: lpfc: Fix memory leak on lpfc_bsg_write_ebuf_set func
    rxe: correctly calculate iCRC for unaligned payloads
    RDMA/cma: add missed unregister_pernet_subsys in init failure
  * PM / devfreq: Don't fail devfreq_dev_release if not in list
      drivers/devfreq/devfreq.c
    iio: adc: max9611: Fix too short conversion time delay
    nvme_fc: add module to ops template to allow module references
  * UPSTREAM: selinux: sidtab reverse lookup hash table
      security/selinux/Kconfig
      security/selinux/include/security.h
      security/selinux/selinuxfs.c
      security/selinux/ss/context.h
      security/selinux/ss/policydb.c
      security/selinux/ss/services.c
      security/selinux/ss/services.h
      security/selinux/ss/sidtab.c
      security/selinux/ss/sidtab.h
  * UPSTREAM: selinux: avoid atomic_t usage in sidtab
      security/selinux/ss/sidtab.c
      security/selinux/ss/sidtab.h
  * UPSTREAM: selinux: check sidtab limit before adding a new entry
      security/selinux/ss/sidtab.c
  * UPSTREAM: selinux: fix context string corruption in convert_context()
      security/selinux/ss/services.c
  * BACKPORT: selinux: overhaul sidtab to fix bug and improve performance
      security/selinux/ss/mls.c
      security/selinux/ss/mls.h
      security/selinux/ss/services.c
      security/selinux/ss/sidtab.c
      security/selinux/ss/sidtab.h
  * UPSTREAM: selinux: refactor mls_context_to_sid() and make it stricter
      security/selinux/ss/mls.c
      security/selinux/ss/mls.h
      security/selinux/ss/services.c
  * UPSTREAM: selinux: Cleanup printk logging in services
      security/selinux/ss/services.c
  * UPSTREAM: scsi: ilog2: create truly constant version for sparse
      include/linux/log2.h
  * BACKPORT: selinux: use separate table for initial SID lookup
      security/selinux/ss/policydb.c
      security/selinux/ss/services.c
      security/selinux/ss/services.h
      security/selinux/ss/sidtab.c
      security/selinux/ss/sidtab.h
  * UPSTREAM: selinux: make "selinux_policycap_names[]" const char *
      security/selinux/include/security.h
      security/selinux/ss/services.c
  * UPSTREAM: selinux: refactor sidtab conversion
      security/selinux/ss/services.c
      security/selinux/ss/sidtab.c
      security/selinux/ss/sidtab.h
  * BACKPORT: selinux: wrap AVC state
      security/selinux/avc.c
      security/selinux/hooks.c
      security/selinux/include/avc.h
      security/selinux/include/avc_ss.h
      security/selinux/include/security.h
      security/selinux/netlabel.c
      security/selinux/selinuxfs.c
      security/selinux/ss/services.c
  * UPSTREAM: selinux: wrap selinuxfs state
      security/selinux/selinuxfs.c
  * UPSTREAM: selinux: rename the {is,set}_enforcing() functions
      security/selinux/avc.c
      security/selinux/hooks.c
      security/selinux/include/security.h
      security/selinux/selinuxfs.c
      security/selinux/ss/services.c
      security/selinux/ss/status.c
  * BACKPORT: selinux: wrap global selinux state
      security/selinux/avc.c
      security/selinux/hooks.c
      security/selinux/ibpkey.c
      security/selinux/include/avc.h
      security/selinux/include/avc_ss.h
      security/selinux/include/conditional.h
      security/selinux/include/objsec.h
      security/selinux/include/security.h
      security/selinux/netif.c
      security/selinux/netlabel.c
      security/selinux/netnode.c
      security/selinux/netport.c
      security/selinux/selinuxfs.c
      security/selinux/ss/avtab.c
      security/selinux/ss/avtab.h
      security/selinux/ss/ebitmap.c
      security/selinux/ss/ebitmap.h
      security/selinux/ss/hashtab.c
      security/selinux/ss/hashtab.h
      security/selinux/ss/mls.c
      security/selinux/ss/mls.h
      security/selinux/ss/services.c
      security/selinux/ss/services.h
      security/selinux/ss/status.c
  * UPSTREAM: selinux: Use kmem_cache for hashtab_node
      security/selinux/ss/hashtab.c
      security/selinux/ss/hashtab.h
      security/selinux/ss/services.c
  * BACKPORT: perf_event: Add support for LSM and SELinux checks
      include/linux/lsm_hooks.h
      include/linux/perf_event.h
      include/linux/security.h
      kernel/events/core.c
      kernel/trace/trace_event_perf.c
      security/security.c
      security/selinux/hooks.c
      security/selinux/include/classmap.h
      security/selinux/include/objsec.h
  * UPSTREAM: binder: Add binder_proc logging to binderfs
      drivers/android/binder.c
      drivers/android/binder_internal.h
  * UPSTREAM: binder: Make transaction_log available in binderfs
      drivers/android/binder.c
      drivers/android/binder_internal.h
  * UPSTREAM: binder: Add stats, state and transactions files
      drivers/android/binder.c
      drivers/android/binder_internal.h
    UPSTREAM: binder: add a mount option to show global stats
    UPSTREAM: binder: Validate the default binderfs device names.
  * UPSTREAM: binder: Add default binder devices through binderfs when configured
      drivers/android/binder.c
      drivers/android/binder_internal.h
  * UPSTREAM: binder: fix CONFIG_ANDROID_BINDER_DEVICES
      drivers/android/binder.c
  * UPSTREAM: android: binder: use kstrdup instead of open-coding it
      drivers/android/binder.c
  * UPSTREAM: binderfs: remove separate device_initcall()
      drivers/android/binder.c
      drivers/android/binder_internal.h
    BACKPORT: binderfs: respect limit on binder control creation
    UPSTREAM: binderfs: switch from d_add() to d_instantiate()
    UPSTREAM: binderfs: drop lock in binderfs_binder_ctl_create
    UPSTREAM: binderfs: kill_litter_super() before cleanup
    UPSTREAM: binderfs: rework binderfs_binder_device_create()
    UPSTREAM: binderfs: rework binderfs_fill_super()
    UPSTREAM: binderfs: prevent renaming the control dentry
    UPSTREAM: binderfs: remove outdated comment
    UPSTREAM: binderfs: fix error return code in binderfs_fill_super()
    UPSTREAM: binderfs: handle !CONFIG_IPC_NS builds
    BACKPORT: binderfs: reserve devices for initial mount
    UPSTREAM: binderfs: rename header to binderfs.h
    BACKPORT: binderfs: implement "max" mount option
    UPSTREAM: binderfs: make each binderfs mount a new instance
    UPSTREAM: binderfs: remove wrong kern_mount() call
  * BACKPORT: binder: implement binderfs
      drivers/android/Kconfig
      drivers/android/Makefile
      drivers/android/binder.c
      drivers/android/binder_internal.h
      include/uapi/linux/magic.h
  * UPSTREAM: binder: remove BINDER_DEBUG_ENTRY()
      drivers/android/binder.c
  * UPSTREAM: seq_file: Introduce DEFINE_SHOW_ATTRIBUTE() helper macro
      include/linux/seq_file.h
  * UPSTREAM: exit: panic before exit_mm() on global init exit
      kernel/exit.c
    Merge 4.14.162 into android-4.14
Linux 4.14.162
    spi: fsl: use platform_get_irq() instead of of_irq_to_resource()
    gtp: avoid zero size hashtable
    gtp: fix an use-after-free in ipv4_pdp_find()
    gtp: fix wrong condition in gtp_genl_dump_pdp()
  * tcp: do not send empty skb from tcp_write_xmit()
      net/ipv4/tcp_output.c
  * tcp/dccp: fix possible race __inet_lookup_established()
      include/linux/rculist_nulls.h
      include/net/inet_hashtables.h
      include/net/sock.h
      net/ipv4/inet_diag.c
      net/ipv4/inet_hashtables.c
      net/ipv4/tcp_ipv4.c
      net/ipv6/inet6_hashtables.c
    gtp: do not allow adding duplicate tid and ms_addr pdp context
  * sit: do not confirm neighbor when do pmtu update
      net/ipv6/sit.c
  * vti: do not confirm neighbor when do pmtu update
      net/ipv4/ip_vti.c
      net/ipv6/ip6_vti.c
  * tunnel: do not confirm neighbor when do pmtu update
      net/ipv4/ip_tunnel.c
      net/ipv6/ip6_tunnel.c
  * net/dst: add new function skb_dst_update_pmtu_no_confirm
      include/net/dst.h
    gtp: do not confirm neighbor when do pmtu update
    ip6_gre: do not confirm neighbor when do pmtu update
  * net: add bool confirm_neigh parameter for dst_ops.update_pmtu
      include/net/dst.h
      include/net/dst_ops.h
      net/ipv4/inet_connection_sock.c
      net/ipv4/route.c
      net/ipv4/xfrm4_policy.c
      net/ipv6/inet6_connection_sock.c
      net/ipv6/route.c
      net/ipv6/xfrm6_policy.c
    vhost/vsock: accept only packets with the right dst_cid
  * udp: fix integer overflow while computing available space in sk_rcvbuf
      net/ipv4/udp.c
  * ptp: fix the race between the release of ptp_clock and cdev
      include/linux/posix-clock.h
      kernel/time/posix-clock.c
    net/mlxfw: Fix out-of-memory error in mfa2 flash burning
    net: ena: fix napi handler misbehavior when the napi budget is zero
    pinctrl: baytrail: Really serialize all register accesses
    tty/serial: atmel: fix out of range clock divider handling
    spi: fsl: don't map irq during probe
  * hrtimer: Annotate lockless access to timer->state
      include/linux/hrtimer.h
      kernel/time/hrtimer.c
  * net: icmp: fix data-race in cmp_global_allow()
      net/ipv4/icmp.c
  * net: add a READ_ONCE() in skb_peek_tail()
      include/linux/skbuff.h
  * inetpeer: fix data-race in inet_putpeer / inet_putpeer
      net/ipv4/inetpeer.c
    netfilter: bridge: make sure to pull arp header in br_nf_forward_arp()
    6pack,mkiss: fix possible deadlock
  * netfilter: ebtables: compat: reject all padding in matches/watchers
      net/bridge/netfilter/ebtables.c
  * filldir[64]: remove WARN_ON_ONCE() for bad directory entries
      fs/readdir.c
  * Make filldir[64]() verify the directory entry filename is valid
      fs/readdir.c
    perf strbuf: Remove redundant va_end() in strbuf_addv()
  * bonding: fix active-backup transition after link failure
      drivers/net/bonding/bond_main.c
    ALSA: hda - Downgrade error message for single-cmd fallback
  * netfilter: nf_queue: enqueue skbs with NULL dst
      net/netfilter/nf_queue.c
  * net, sysctl: Fix compiler warning when only cBPF is present
      net/core/sysctl_net_core.c
    x86/mce: Fix possibly incorrect severity calculation on AMD
    userfaultfd: require CAP_SYS_PTRACE for UFFD_FEATURE_EVENT_FORK
  * kernel: sysctl: make drop_caches write-only
      kernel/sysctl.c
    ocfs2: fix passing zero to 'PTR_ERR' warning
    s390/cpum_sf: Check for SDBT and SDB consistency
  * libfdt: define INT32_MAX and UINT32_MAX in libfdt_env.h
      include/linux/libfdt_env.h
    s390/zcrypt: handle new reply code FILTERED_BY_HYPERVISOR
    perf regs: Make perf_reg_name() return "unknown" instead of NULL
    perf script: Fix brstackinsn for AUXTRACE
    cdrom: respect device capabilities during opening action
  * scripts/kallsyms: fix definitely-lost memory leak
      scripts/kallsyms.c
    apparmor: fix unsigned len comparison with less than zero
    gpio: mpc8xxx: Don't overwrite default irq_set_type callback
    scsi: target: iscsi: Wait for all commands to finish before freeing a session
    scsi: iscsi: Don't send data to unbound connection
    scsi: NCR5380: Add disconnect_mask module parameter
    scsi: scsi_debug: num_tgts must be >= 0
  * scsi: ufs: Fix error handing during hibern8 enter
      drivers/scsi/ufs/ufshcd.c
    scsi: pm80xx: Fix for SATA device discovery
  * HID: Improve Windows Precision Touchpad detection.
      drivers/hid/hid-core.c
    libnvdimm/btt: fix variable 'rc' set but not used
    HID: logitech-hidpp: Silence intermittent get_battery_capacity errors
    bcache: at least try to shrink 1 node in bch_mca_scan()
    clk: pxa: fix one of the pxa RTC clocks
    scsi: atari_scsi: sun3_scsi: Set sg_tablesize to 1 instead of SG_NONE
    powerpc/security: Fix wrong message when RFI Flush is disable
    powerpc/pseries/cmm: Implement release() function for sysfs device
  * scsi: ufs: fix potential bug which ends in system hang
      drivers/scsi/ufs/ufshcd.c
    scsi: lpfc: fix: Coverity: lpfc_cmpl_els_rsp(): Null pointer dereferences
  * fs/quota: handle overflows of sysctl fs.quota.* and report as unsigned long
      fs/quota/dquot.c
      include/linux/quota.h
    irqchip: ingenic: Error out if IRQ domain creation failed
    irqchip/irq-bcm7038-l1: Enable parent IRQ if necessary
  * clk: qcom: Allow constant ratio freq tables for rcg
      drivers/clk/qcom/clk-rcg2.c
      drivers/clk/qcom/common.c
  * f2fs: fix to update dir's i_pino during cross_rename
      fs/f2fs/namei.c
    scsi: lpfc: Fix duplicate unreg_rpi error in port offline flow
  * scsi: tracing: Fix handling of TRANSFER LENGTH == 0 for READ(6) and WRITE(6)
      drivers/scsi/scsi_trace.c
  * jbd2: Fix statistics for the number of logged blocks
      fs/jbd2/commit.c
  * ext4: update direct I/O read lock pattern for IOCB_NOWAIT
      fs/ext4/inode.c
    powerpc/book3s64/hash: Add cond_resched to avoid soft lockup warning
    powerpc/security/book3s64: Report L1TF status in sysfs
    clocksource/drivers/asm9260: Add a check for of_clk_get
    dma-debug: add a schedule point in debug_dma_dump_mappings()
    powerpc/tools: Don't quote $objdump in scripts
    powerpc/pseries: Don't fail hash page table insert for bolted mapping
    powerpc/pseries: Mark accumulate_stolen_time() as notrace
    scsi: csiostor: Don't enable IRQs too early
    scsi: lpfc: Fix SLI3 hba in loop mode not discovering devices
    scsi: target: compare full CHAP_A Algorithm strings
    iommu/tegra-smmu: Fix page tables in > 4 GiB memory
    Input: atmel_mxt_ts - disable IRQ across suspend
    scsi: lpfc: Fix locking on mailbox command completion
    scsi: mpt3sas: Fix clear pending bit in ioctl status
    scsi: lpfc: Fix discovery failures when target device connectivity bounces
  * ANDROID: serdev: Fix platform device support
      drivers/tty/serdev/core.c
    Merge 4.14.161 into android-4.14
Linux 4.14.161
    perf probe: Fix to show function entry line as probe-able
    nbd: fix shutdown and recv work deadlock v2
    mmc: sdhci-of-esdhc: fix P2020 errata handling
    mmc: sdhci: Update the tuning failed messages to pr_debug level
    mmc: sdhci-of-esdhc: Revert "mmc: sdhci-of-esdhc: add erratum A-009204 support"
    powerpc/irq: fix stack overflow verification
    x86/MCE/AMD: Allow Reserved types to be overwritten in smca_banks[]
    x86/MCE/AMD: Do not use rdmsr_safe_on_cpu() in smca_configure()
    KVM: arm64: Ensure 'params' is initialised when looking up sys register
  * ext4: unlock on error in ext4_expand_extra_isize()
      fs/ext4/inode.c
  * ext4: check for directory entries too close to block end
      fs/ext4/dir.c
  * ext4: fix ext4_empty_dir() for directories with holes
      fs/ext4/namei.c
    staging: comedi: gsc_hpdi: check dma_alloc_coherent() return value
    platform/x86: hp-wmi: Make buffer for HPWMI_FEATURE2_QUERY 128 bytes
    intel_th: pci: Add Elkhart Lake SOC support
    intel_th: pci: Add Comet Lake PCH-V support
    USB: EHCI: Do not return -EPIPE when hub is disconnected
    usbip: Fix error path of vhci_recv_ret_submit()
    usbip: Fix receive error in vhci-hcd when using scatter-gather
    btrfs: abort transaction after failed inode updates in create_subvol
    btrfs: return error pointer from alloc_test_extent_buffer
    s390/ftrace: fix endless recursion in function_graph tracer
  * usb: xhci: Fix build warning seen with CONFIG_PM=n
      drivers/usb/host/xhci-pci.c
    mmc: mediatek: fix CMD_TA to 2 for MT8173 HS200/HS400 mode
    Revert "mmc: sdhci: Fix incorrect switch to HS mode"
    btrfs: don't prematurely free work in scrub_missing_raid56_worker()
    btrfs: don't prematurely free work in reada_start_machine_worker()
  * net: phy: initialise phydev speed and duplex sanely
      drivers/net/phy/phy_device.c
    mips: fix build when "48 bits virtual memory" is enabled
    libtraceevent: Fix memory leakage in copy_filter_type
    crypto: vmx - Avoid weird build failures
    mac80211: consider QoS Null frames for STA_NULLFUNC_ACKED
    crypto: sun4i-ss - Fix 64-bit size_t warnings on sun4i-ss-hash.c
    crypto: sun4i-ss - Fix 64-bit size_t warnings
    fbtft: Make sure string is NULL terminated
    iwlwifi: check kasprintf() return value
    x86/insn: Add some Intel instructions to the opcode map
    spi: st-ssc4: add missed pm_runtime_disable
    btrfs: don't prematurely free work in run_ordered_work()
    btrfs: don't prematurely free work in end_workqueue_fn()
    mmc: tmio: Add MMC_CAP_ERASE to allow erase/discard/trim requests
    crypto: virtio - deal with unsupported input sizes
    spi: tegra20-slink: add missed clk_unprepare
    iwlwifi: mvm: fix unaligned read of rx_pkt_status
    x86/crash: Add a forward declaration of struct kimage
  * cpufreq: Register drivers only after CPU devices have been registered
      drivers/cpufreq/cpufreq.c
    parport: load lowlevel driver if ports not found
    s390/disassembler: don't hide instruction addresses
    ASoC: Intel: kbl_rt5663_rt5514_max98927: Add dmic format constraint
    ASoC: rt5677: Mark reg RT5677_PWR_ANLG2 as volatile
    spi: pxa2xx: Add missed security checks
    EDAC/ghes: Fix grain calculation
    media: si470x-i2c: add missed operations in remove
    media: pvrusb2: Fix oops on tear-down when radio support is not present
    fsi: core: Fix small accesses and unaligned offsets via sysfs
    ath10k: fix get invalid tx rate for Mesh metric
    perf probe: Filter out instances except for inlined subroutine and subprogram
    perf probe: Skip end-of-sequence and non statement lines
    perf probe: Fix to show calling lines of inlined functions
    perf probe: Return a better scope DIE if there is no best scope
    perf probe: Skip overlapped location on searching variables
    perf parse: If pmu configuration fails free terms
    drm/amdgpu: fix potential double drop fence reference
    perf probe: Fix to probe a function which has no entry pc
    libsubcmd: Use -O0 with DEBUG=1
    perf probe: Fix to show inlined function callsite without entry_pc
    perf probe: Fix to show ranges of variables in functions without entry_pc
    perf probe: Fix to probe an inline function which has no entry pc
    perf probe: Walk function lines in lexical blocks
    perf probe: Fix to list probe event with correct line number
    perf probe: Fix to find range-only function instance
    rtlwifi: fix memory leak in rtl92c_set_fw_rsvdpagepkt()
  * ALSA: timer: Limit max amount of slave instances
      sound/core/timer.c
    spi: img-spfi: fix potential double release
    bnx2x: Fix PF-VF communication over multi-cos queues.
  * rfkill: allocate static minor
      include/linux/miscdevice.h
      net/rfkill/core.c
  * media: v4l2-core: fix touch support in v4l_g_fmt
      drivers/media/v4l2-core/v4l2-ioctl.c
    media: rcar_drif: fix a memory disclosure
    ixgbe: protect TX timestamping from API misuse
    pinctrl: amd: fix __iomem annotation in amd_gpio_irq_handler()
  * Bluetooth: Fix advertising duplicated flags
      net/bluetooth/hci_request.c
    iio: dln2-adc: fix iio_triggered_buffer_postenable() position
    pinctrl: sh-pfc: sh7734: Fix duplicate TCLK1_B
  * loop: fix no-unmap write-zeroes request behavior
      drivers/block/loop.c
    libata: Ensure ata_port probe has completed before detach
    s390/mm: add mm_pxd_folded() checks to pxd_free()
    s390/time: ensure get_clock_monotonic() returns monotonic values
    phy: qcom-usb-hs: Fix extcon double register after power cycle
  * net: dsa: LAN9303: select REGMAP when LAN9303 enable
      drivers/net/dsa/Kconfig
    gpu: host1x: Allocate gather copy for host1x
    RDMA/qedr: Fix memory leak in user qp and mr
    net: phy: dp83867: enable robust auto-mdix
  * arm64: psci: Reduce the waiting time for cpu_psci_cpu_kill()
      arch/arm64/kernel/psci.c
    x86/ioapic: Prevent inconsistent state when moving an interrupt
    rtl8xxxu: fix RTL8723BU connection failure issue after warm reboot
    drm/gma500: fix memory disclosures due to uninitialized bytes
    x86/mce: Lower throttling MCE messages' priority to warning
  * Bluetooth: hci_core: fix init for HCI_USER_CHANNEL
      net/bluetooth/hci_core.c
  * Bluetooth: missed cpu_to_le16 conversion in hci_init4_req
      net/bluetooth/hci_core.c
    iio: adc: max1027: Reset the device at probe time
  * usb: usbfs: Suppress problematic bind and unbind uevents.
      drivers/usb/core/devio.c
    perf report: Add warning when libunwind not compiled in
    perf test: Report failure for mmap events
    drm/bridge: dw-hdmi: Restore audio when setting a mode
    x86/mm: Use the correct function type for native_set_fixmap()
    extcon: sm5502: Reset registers during initialization
    media: ti-vpe: vpe: fix a v4l2-compliance failure about invalid sizeimage
    media: ti-vpe: vpe: ensure buffers are cleaned up properly in abort cases
    media: ti-vpe: vpe: fix a v4l2-compliance failure causing a kernel panic
    media: ti-vpe: vpe: Make sure YUYV is set as default format
    media: ti-vpe: vpe: fix a v4l2-compliance failure about frame sequence number
    media: ti-vpe: vpe: fix a v4l2-compliance warning about invalid pixel format
    media: ti-vpe: vpe: Fix Motion Vector vpdma stride
    media: cx88: Fix some error handling path in 'cx8800_initdev()'
    mwifiex: pcie: Fix memory leak in mwifiex_pcie_init_evt_ring
    block: Fix writeback throttling W=1 compiler warnings
    samples: pktgen: fix proc_cmd command result check logic
    drm/bridge: dw-hdmi: Refuse DDC/CI transfers on the internal I2C controller
    media: cec-funcs.h: add status_req checks
    media: flexcop-usb: fix NULL-ptr deref in flexcop_usb_transfer_init()
    regulator: max8907: Fix the usage of uninitialized variable in max8907_regulator_probe()
    hwrng: omap3-rom - Call clk_disable_unprepare() on exit only if not idled
    usb: renesas_usbhs: add suspend event support in gadget mode
    selftests/bpf: Correct path to include msg + path
  * pinctrl: devicetree: Avoid taking direct reference to device name string
      drivers/pinctrl/devicetree.c
    ath10k: fix offchannel tx failure when no ath10k_mac_tx_frm_has_freq
    media: venus: core: Fix msm8996 frequency table
    tools/power/cpupower: Fix initializer override in hsw_ext_cstates
    media: ov6650: Fix stored crop rectangle not in sync with hardware
    media: ov6650: Fix stored frame format not in sync with hardware
    media: i2c: ov2659: Fix missing 720p register config
    media: ov6650: Fix crop rectangle alignment not passed back
    media: i2c: ov2659: fix s_stream return value
    media: am437x-vpfe: Setting STD to current value is not an error
    IB/iser: bound protection_sg size by data_sg size
    libertas: fix a potential NULL pointer dereference
    rtlwifi: prevent memory leak in rtl_usb_probe
    staging: rtl8188eu: fix possible null dereference
    staging: rtl8192u: fix multiple memory leaks on error path
  * spi: Add call to spi_slave_abort() function when spidev driver is released
      drivers/spi/spidev.c
    iio: light: bh1750: Resolve compiler warning and make code more readable
    drm/bridge: analogix-anx78xx: silence -EPROBE_DEFER warnings
  * drm: mst: Fix query_payload ack reply struct
      include/drm/drm_dp_mst_helper.h
    ALSA: hda/ca0132 - Avoid endless loop
    ALSA: hda/ca0132 - Keep power on during processing DSP response
  * ALSA: pcm: Avoid possible info leaks from PCM stream buffers
      sound/core/pcm_native.c
    Btrfs: fix removal logic of the tree mod log that leads to use-after-free issues
    btrfs: handle ENOENT in btrfs_uuid_tree_iterate
    btrfs: do not leak reloc root if we fail to read the fs root
    btrfs: skip log replay on orphaned roots
    btrfs: do not call synchronize_srcu() in inode_tree_del
    btrfs: don't double lock the subvol_sem for rename exchange
    sctp: fully initialize v4 addr in some functions
    qede: Fix multicast mac configuration
    net: usb: lan78xx: Fix suspend/resume PHY register access error
    net: qlogic: Fix error paths in ql_alloc_large_buffers()
    net: nfc: nci: fix a possible sleep-in-atomic-context bug in nci_uart_tty_receive()
    net: hisilicon: Fix a BUG trigered by wrong bytes_compl
  * net: dst: Force 4-byte alignment of dst_metrics
      include/net/dst.h
  * mod_devicetable: fix PHY module format
      include/linux/mod_devicetable.h
    fjes: fix missed check in fjes_acpi_add
  * af_packet: set defaule value for tmo
      net/packet/af_packet.c
    ANDROID: cuttlefish_defconfig: Disable TRANSPARENT_HUGEPAGE

Change-Id: If5fe1dee627f430a68a27040c29f1015fd7c5ed1
Signed-off-by: lucaswei <lucaswei@google.com>
2020-02-14 11:04:53 +08:00
Christian Brauner
4057c1f082 UPSTREAM: binderfs: rename header to binderfs.h
It doesn't make sense to call the header binder_ctl.h when its sole
existence is tied to binderfs. So give it a sensible name. Users will far
more easily remember binderfs.h than binder_ctl.h.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 136497735
(cherry picked from commit c13295ad219d8bb0e47942d4cfc8251de449a67e)
Change-Id: Ide6275bbbaec2e25df19e11754afb7f1827888b2
Signed-off-by: Hridya Valsaraju <hridya@google.com>
2020-01-06 18:35:08 +00:00
Christian Brauner
34fbd92d31 BACKPORT: binder: implement binderfs
As discussed at Linux Plumbers Conference 2018 in Vancouver [1] this is the
implementation of binderfs.

/* Abstract */
binderfs is a backwards-compatible filesystem for Android's binder ipc
mechanism. Each ipc namespace will mount a new binderfs instance. Mounting
binderfs multiple times at different locations in the same ipc namespace
will not cause a new super block to be allocated and hence it will be the
same filesystem instance.
Each new binderfs mount will have its own set of binder devices only
visible in the ipc namespace it has been mounted in. All devices in a new
binderfs mount will follow the scheme binder%d and numbering will always
start at 0.

/* Backwards compatibility */
Devices requested in the Kconfig via CONFIG_ANDROID_BINDER_DEVICES for the
initial ipc namespace will work as before. They will be registered via
misc_register() and appear in the devtmpfs mount. Specifically, the
standard devices binder, hwbinder, and vndbinder will all appear in their
standard locations in /dev. Mounting or unmounting the binderfs mount in
the initial ipc namespace will have no effect on these devices, i.e. they
will neither show up in the binderfs mount nor will they disappear when the
binderfs mount is gone.

/* binder-control */
Each new binderfs instance comes with a binder-control device. No other
devices will be present at first. The binder-control device can be used to
dynamically allocate binder devices. All requests operate on the binderfs
mount the binder-control device resides in.
Assuming a new instance of binderfs has been mounted at /dev/binderfs
via mount -t binderfs binderfs /dev/binderfs. Then a request to create a
new binder device can be made as illustrated in [2].
Binderfs devices can simply be removed via unlink().

/* Implementation details */
- dynamic major number allocation:
  When binderfs is registered as a new filesystem it will dynamically
  allocate a new major number. The allocated major number will be returned
  in struct binderfs_device when a new binder device is allocated.
- global minor number tracking:
  Minor are tracked in a global idr struct that is capped at
  BINDERFS_MAX_MINOR. The minor number tracker is protected by a global
  mutex. This is the only point of contention between binderfs mounts.
- struct binderfs_info:
  Each binderfs super block has its own struct binderfs_info that tracks
  specific details about a binderfs instance:
  - ipc namespace
  - dentry of the binder-control device
  - root uid and root gid of the user namespace the binderfs instance
    was mounted in
- mountable by user namespace root:
  binderfs can be mounted by user namespace root in a non-initial user
  namespace. The devices will be owned by user namespace root.
- binderfs binder devices without misc infrastructure:
  New binder devices associated with a binderfs mount do not use the
  full misc_register() infrastructure.
  The misc_register() infrastructure can only create new devices in the
  host's devtmpfs mount. binderfs does however only make devices appear
  under its own mountpoint and thus allocates new character device nodes
  from the inode of the root dentry of the super block. This will have
  the side-effect that binderfs specific device nodes do not appear in
  sysfs. This behavior is similar to devpts allocated pts devices and
  has no effect on the functionality of the ipc mechanism itself.

[1]: https://goo.gl/JL2tfX
[2]: program to allocate a new binderfs binder device:

     #define _GNU_SOURCE
     #include <errno.h>
     #include <fcntl.h>
     #include <stdio.h>
     #include <stdlib.h>
     #include <string.h>
     #include <sys/ioctl.h>
     #include <sys/stat.h>
     #include <sys/types.h>
     #include <unistd.h>
     #include <linux/android/binder_ctl.h>

     int main(int argc, char *argv[])
     {
             int fd, ret, saved_errno;
             size_t len;
             struct binderfs_device device = { 0 };

             if (argc < 2)
                     exit(EXIT_FAILURE);

             len = strlen(argv[1]);
             if (len > BINDERFS_MAX_NAME)
                     exit(EXIT_FAILURE);

             memcpy(device.name, argv[1], len);

             fd = open("/dev/binderfs/binder-control", O_RDONLY | O_CLOEXEC);
             if (fd < 0) {
                     printf("%s - Failed to open binder-control device\n",
                            strerror(errno));
                     exit(EXIT_FAILURE);
             }

             ret = ioctl(fd, BINDER_CTL_ADD, &device);
             saved_errno = errno;
             close(fd);
             errno = saved_errno;
             if (ret < 0) {
                     printf("%s - Failed to allocate new binder device\n",
                            strerror(errno));
                     exit(EXIT_FAILURE);
             }

             printf("Allocated new binder device with major %d, minor %d, and "
                    "name %s\n", device.major, device.minor,
                    device.name);

             exit(EXIT_SUCCESS);
     }

Cc: Martijn Coenen <maco@android.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Acked-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 136497735
(cherry picked from commit 3ad20fe393b31025bebfc2d76964561f65df48aa)
[ Using ida_simple_get() and ida_remove() instead of ida_alloc_max() and
ida_free() as they are not available in 4.14 ]
Change-Id: I145af9b0bc25b3a59a4f663c9e926889c2b41d18
Signed-off-by: Hridya Valsaraju <hridya@google.com>
2020-01-06 18:34:18 +00:00
Blagovest Kolenichev
57c2bb95b7 Merge android-4.14-p.105 (e742253) into msm-4.14
* refs/heads/tmp-e742253:
  Linux 4.14.105
  x86/uaccess: Don't leak the AC flag into __put_user() value evaluation
  MIPS: eBPF: Fix icache flush end address
  MIPS: fix truncation in __cmpxchg_small for short values
  mm: enforce min addr even if capable() in expand_downwards()
  mmc: sdhci-esdhc-imx: correct the fix of ERR004536
  mmc: tmio: fix access width of Block Count Register
  mmc: tmio_mmc_core: don't claim spurious interrupts
  mmc: spi: Fix card detection during probe
  powerpc: Always initialize input array when calling epapr_hypercall()
  KVM: nSVM: clear events pending from svm_complete_interrupts() when exiting to L1
  svm: Fix AVIC incomplete IPI emulation
  cfg80211: extend range deviation for DMG
  mac80211: Add attribute aligned(2) to struct 'action'
  mac80211: don't initiate TDLS connection if station is not associated to AP
  ibmveth: Do not process frames after calling napi_reschedule
  net: dev_is_mac_header_xmit() true for ARPHRD_RAWIP
  net: usb: asix: ax88772_bind return error when hw_reset fail
  hv_netvsc: Fix ethtool change hash key error
  net: altera_tse: fix connect_local_phy error path
  scsi: csiostor: fix NULL pointer dereference in csio_vport_set_state()
  writeback: synchronize sync(2) against cgroup writeback membership switches
  direct-io: allow direct writes to empty inodes
  staging: android: ion: Support cpu access during dma_buf_detach
  serial: fsl_lpuart: fix maximum acceptable baud rate with over-sampling
  drm/amd/powerplay: OD setting fix on Vega10
  locking/rwsem: Fix (possible) missed wakeup
  futex: Fix (possible) missed wakeup
  sched/wait: Fix rcuwait_wake_up() ordering
  mac80211: fix miscounting of ttl-dropped frames
  staging: rtl8723bs: Fix build error with Clang when inlining is disabled
  drivers: thermal: int340x_thermal: Fix sysfs race condition
  ARC: fix __ffs return value to avoid build warnings
  selftests: gpio-mockup-chardev: Check asprintf() for error
  selftests: seccomp: use LDLIBS instead of LDFLAGS
  ASoC: imx-audmux: change snprintf to scnprintf for possible overflow
  ASoC: dapm: change snprintf to scnprintf for possible overflow
  genirq: Make sure the initial affinity is not empty
  usb: gadget: Potential NULL dereference on allocation error
  usb: dwc3: gadget: Fix the uninitialized link_state when udc starts
  usb: dwc3: gadget: synchronize_irq dwc irq in suspend
  thermal: int340x_thermal: Fix a NULL vs IS_ERR() check
  clk: vc5: Abort clock configuration without upstream clock
  ASoC: Variable "val" in function rt274_i2c_probe() could be uninitialized
  ALSA: compress: prevent potential divide by zero bugs
  ASoC: Intel: Haswell/Broadwell: fix setting for .dynamic field
  drm/msm: Unblock writer if reader closes file
  scsi: libsas: Fix rphy phy_identifier for PHYs with end devices attached
  net: stmmac: Disable ACS Feature for GMAC >= 4
  net: stmmac: Fix reception of Broadcom switches tags
  Revert "loop: Fold __loop_release into loop_release"
  Revert "loop: Get rid of loop_index_mutex"
  Revert "loop: Fix double mutex_unlock(&loop_ctl_mutex) in loop_control_ioctl()"
  FROMGIT: binder: create node flag to request sender's security context

  Modify include/uapi/linux/android/binder.h, as commit:

  FROMGIT: binder: create node flag to request sender's security context

  introduces enums and structures, which are already defined in other
  userspace files that include the binder uapi file. Thus, the
  redeclaration of these enums and structures can lead to
  build errors. To avoid this, guard the redundant declarations
  in the uapi header with the __KERNEL__ header guard, so they
  are not exported to userspace.

Conflicts:
	drivers/gpu/drm/msm/msm_rd.c
	drivers/staging/android/ion/ion.c
	include/uapi/linux/android/binder.h
	sound/core/compress_offload.c

Change-Id: I5d470f222a6a1baa284813a11f847cfcbe6ee0a6
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
2019-03-20 16:37:04 -07:00
Todd Kjos
e0d0c92c07 FROMGIT: binder: create node flag to request sender's security context
To allow servers to verify client identity, allow a node
flag to be set that causes the sender's security context
to be delivered with the transaction. The BR_TRANSACTION
command is extended in BR_TRANSACTION_SEC_CTX to
contain a pointer to the security context string.

Signed-off-by: Todd Kjos <tkjos@google.com>
Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

(cherry picked from commit ec74136ded792deed80780a2f8baf3521eeb72f9
 https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
 master)
Change-Id: I44496546e2d0dc0022f818a45cd52feb1c1a92cb
Signed-off-by: Todd Kjos <tkjos@google.com>
2019-03-04 23:29:30 +00:00
Todd Kjos
5312a99c7a FROMGIT: binder: create node flag to request sender's security context
To allow servers to verify client identity, allow a node
flag to be set that causes the sender's security context
to be delivered with the transaction. The BR_TRANSACTION
command is extended in BR_TRANSACTION_SEC_CTX to
contain a pointer to the security context string.

Signed-off-by: Todd Kjos <tkjos@google.com>
Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

(cherry picked from commit ec74136ded792deed80780a2f8baf3521eeb72f9
 https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
 master)
Change-Id: I44496546e2d0dc0022f818a45cd52feb1c1a92cb
Signed-off-by: Todd Kjos <tkjos@google.com>
2019-03-04 14:41:23 -08:00
Martijn Coenen
eec1c280b0 FROMLIST: ANDROID: binder: Add BINDER_GET_NODE_INFO_FOR_REF ioctl.
This allows the context manager to retrieve information about nodes
that it holds a reference to, such as the current number of
references to those nodes.

Such information can for example be used to determine whether the
servicemanager is the only process holding a reference to a node.
This information can then be passed on to the process holding the
node, which can in turn decide whether it wants to shut down to
reduce resource usage.

Change-Id: I148c3d9b24b26362d5395989f5979403f954da7e
Signed-off-by: Martijn Coenen <maco@android.com>
Git-commit: 666c420fa3
Git-repo: https://android.googlesource.com/kernel/common/
Signed-off-by: Prateek Sood <prsood@codeaurora.org>
2019-02-12 22:08:42 -08:00
Martijn Coenen
666c420fa3 FROMLIST: ANDROID: binder: Add BINDER_GET_NODE_INFO_FOR_REF ioctl.
This allows the context manager to retrieve information about nodes
that it holds a reference to, such as the current number of
references to those nodes.

Such information can for example be used to determine whether the
servicemanager is the only process holding a reference to a node.
This information can then be passed on to the process holding the
node, which can in turn decide whether it wants to shut down to
reduce resource usage.

Signed-off-by: Martijn Coenen <maco@android.com>
2018-09-20 09:39:13 +00:00
Martijn Coenen
fb92c34f7b ANDROID: binder: add RT inheritance flag to node.
Allows a binder node to specify whether it wants to
inherit real-time scheduling policy from a caller.

Change-Id: I375b6094bf441c19f19cba06d5a6be02cd07d714
Signed-off-by: Martijn Coenen <maco@android.com>
2017-12-18 21:11:22 +05:30
Martijn Coenen
69308b3b07 ANDROID: binder: add min sched_policy to node.
This change adds flags to flat_binder_object.flags
to allow indicating a minimum scheduling policy for
the node. It also clarifies the valid value range
for the priority bits in the flags.

Internally, we use the priority map that the kernel
uses, e.g. [0..99] for real-time policies and [100..139]
for the SCHED_NORMAL/SCHED_BATCH policies.

Bug: 34461621
Bug: 37293077
Change-Id: I12438deecb53df432da18c6fc77460768ae726d2
Signed-off-by: Martijn Coenen <maco@google.com>
2017-12-18 21:11:22 +05:30
Runmin Wang
253c6dff4b Merge remote-tracking branch 'remotes/origin/tmp-39dae59' into msm-next
* remotes/msm-4.9/tmp-39dae59:
  Linux 4.14-rc8
  x86/module: Detect and skip invalid relocations
  objtool: Prevent GCC from merging annotate_unreachable(), take 2
  Revert "x86/mm: Stop calling leave_mm() in idle code"
  Documentation: Add Frank Rowand to list of enforcement statement endorsers
  doc: add Willy Tarreau to the list of enforcement statement endorsers
  tools/headers: Synchronize kernel ABI headers
  objtool: Resync objtool's instruction decoder source code copy with the kernel's latest version
  Input: sparse-keymap - send sync event for KE_SW/KE_VSW
  Input: ar1021_i2c - set INPUT_PROP_DIRECT
  arch/tile: Implement ->set_state_oneshot_stopped()
  Update MIPS email addresses
  x86: CPU: Fix up "cpu MHz" in /proc/cpuinfo
  mm, swap: fix race between swap count continuation operations
  mm/huge_memory.c: deposit page table when copying a PMD migration entry
  initramfs: fix initramfs rebuilds w/ compression after disabling
  fs/hugetlbfs/inode.c: fix hwpoison reserve accounting
  ocfs2: fstrim: Fix start offset of first cluster group during fstrim
  mm, /proc/pid/pagemap: fix soft dirty marking for PMD migration entry
  userfaultfd: hugetlbfs: prevent UFFDIO_COPY to fill beyond the end of i_size
  Documentation: Add Tim Bird to list of enforcement statement endorsers
  net: systemport: Correct IPG length settings
  tcp: do not mangle skb->cb[] in tcp_make_synack()
  fib: fib_dump_info can no longer use __in_dev_get_rtnl
  stmmac: use of_property_read_u32 instead of read_u8
  net_sched: hold netns refcnt for each action
  net_sched: acquire RTNL in tc_action_net_exit()
  powerpc/perf: Fix core-imc hotplug callback failure during imc initialization
  Kbuild: don't pass "-C" to preprocessor when processing linker scripts
  Revert "x86: do not use cpufreq_quick_get() for /proc/cpuinfo "cpu MHz""
  arm64: ensure __dump_instr() checks addr_limit
  KVM: x86: Update APICv on APIC reset
  KVM: VMX: Do not fully reset PI descriptor on vCPU reset
  kvm: Return -ENODEV from update_persistent_clock
  futex: futex_wake_op, do not fail on invalid op
  MIPS: Update email address for Marcin Nowakowski
  License cleanup: add SPDX license identifier to uapi header files with a license
  License cleanup: add SPDX license identifier to uapi header files with no license
  License cleanup: add SPDX GPL-2.0 license identifier to files with no license
  KEYS: fix out-of-bounds read during ASN.1 parsing
  KEYS: trusted: fix writing past end of buffer in trusted_read()
  KEYS: return full count in keyring_read() if buffer is too small
  net: vrf: correct FRA_L3MDEV encode type
  tcp_nv: fix division by zero in tcpnv_acked()
  drm/amdgpu: allow harvesting check for Polaris VCE
  drm/amdgpu: return -ENOENT from uvd 6.0 early init for harvesting
  ARM: add debug ".edata_real" symbol
  MIPS: smp-cmp: Fix vpe_id build error
  MAINTAINERS: Update Pistachio platform maintainers
  MIPS: smp-cmp: Use right include for task_struct
  signal: Fix name of SIGEMT in #if defined() check
  MIPS: Update Goldfish RTC driver maintainer email address
  MIPS: Update RINT emulation maintainer email address
  MIPS: CPS: Fix use of current_cpu_data in preemptible code
  x86/mcelog: Get rid of RCU remnants
  watchdog/hardlockup/perf: Use atomics to track in-use cpu counter
  watchdog/harclockup/perf: Revert a33d44843d ("watchdog/hardlockup/perf: Simplify deferred event destroy")
  ARM: 8716/1: pass endianness info to sparse
  drm/i915: Check incoming alignment for unfenced buffers (on i915gm)
  x86/mm: fix use-after-free of vma during userfaultfd fault
  ide:ide-cd: fix kernel panic resulting from missing scsi_req_init
  mmc: dw_mmc: Fix the DTO timeout calculation
  tcp: fix tcp_mtu_probe() vs highest_sack
  ipv6: addrconf: increment ifp refcount before ipv6_del_addr()
  tun/tap: sanitize TUNSETSNDBUF input
  mlxsw: i2c: Fix buffer increment counter for write transaction
  netfilter: nf_reject_ipv4: Fix use-after-free in send_reset
  futex: Fix more put_pi_state() vs. exit_pi_state_list() races
  powerpc/kprobes: Dereference function pointers only if the address does not belong to kernel text
  Revert "powerpc64/elfv1: Only dereference function descriptor for non-text symbols"
  mlxsw: reg: Add high and low temperature thresholds
  MAINTAINERS: Remove Yotam from mlxfw
  MAINTAINERS: Update Yotam's E-mail
  net: hns: set correct return value
  net: lapbether: fix double free
  bpf: remove SK_REDIRECT from UAPI
  net: phy: marvell: Only configure RGMII delays when using RGMII
  MIPS: SMP: Fix deadlock & online race
  MIPS: bpf: Fix a typo in build_one_insn()
  MIPS: microMIPS: Fix incorrect mask in insn_table_MM
  MIPS: Fix CM region target definitions
  MIPS: generic: Fix compilation error from include asm/mips-cpc.h
  MIPS: Fix exception entry when CONFIG_EVA enabled
  irqchip/irq-mvebu-gicp: Add missing spin_lock init
  drm/nouveau/kms/nv50: use the correct state for base channel notifier setup
  MIPS: generic: Fix NI 169445 its build
  Update MIPS email addresses
  tile: pass machine size to sparse
  selftests: lib.mk: print individual test results to console by default
  RDMA/nldev: Enforce device index check for port callback
  Revert "PM / QoS: Fix device resume latency PM QoS"
  Revert "PM / QoS: Fix default runtime_pm device resume latency"
  scsi: qla2xxx: Fix oops in qla2x00_probe_one error path
  xfrm: Fix GSO for IPsec with GRE tunnel.
  ALSA: seq: Fix nested rwsem annotation for lockdep splat
  ALSA: timer: Add missing mutex lock for compat ioctls
  tc-testing: fix arg to ip command: -s -> -n
  net_sched: remove tcf_block_put_deferred()
  l2tp: hold tunnel in pppol2tp_connect()
  drm/i915: Hold rcu_read_lock when iterating over the radixtree (vma idr)
  drm/i915: Hold rcu_read_lock when iterating over the radixtree (objects)
  drm/i915/edp: read edp display control registers unconditionally
  drm/i915: Do not rely on wm preservation for ILK watermarks
  drm/i915: Cancel the modeset retry work during modeset cleanup
  Mark 'ioremap_page_range()' as possibly sleeping
  nvme: Fix setting logical block format when revalidating
  mmc: dw_mmc: Add locking to the CTO timer
  mmc: dw_mmc: Fix the CTO timeout calculation
  mmc: dw_mmc: cancel the CTO timer after a voltage switch
  perf/cgroup: Fix perf cgroup hierarchy support
  PM / QoS: Fix default runtime_pm device resume latency
  Revert "ath10k: fix napi_poll budget overflow"
  ath10k: rebuild crypto header in rx data frames
  cifs: check MaxPathNameComponentLength != 0 before using it
  KVM: arm/arm64: vgic-its: Check GITS_BASER Valid bit before saving tables
  KVM: arm/arm64: vgic-its: Check CBASER/BASER validity before enabling the ITS
  KVM: arm/arm64: vgic-its: Fix vgic_its_restore_collection_table returned value
  KVM: arm/arm64: vgic-its: Fix return value for device table restore
  efi/libstub: arm: omit sorting of the UEFI memory map
  perf tools: Unwind properly location after REJECT
  virtio_blk: Fix an SG_IO regression
  wcn36xx: Remove unnecessary rcu_read_unlock in wcn36xx_bss_info_changed
  ARM: dts: mvebu: pl310-cache disable double-linefill
  xfrm: Clear sk_dst_cache when applying per-socket policy.
  perf symbols: Fix memory corruption because of zero length symbols
  powerpc/64s/radix: Fix preempt imbalance in TLB flush
  netfilter: nft_set_hash: disable fast_ops for 2-len keys
  powerpc: Fix check for copy/paste instructions in alignment handler
  powerpc/perf: Fix IMC allocation routine
  xfrm: Fix xfrm_dst_cache memleak
  ARM: 8715/1: add a private asm/unaligned.h
  clk: uniphier: fix clock data for PXs3
  Documentation: Add my name to kernel enforcement statement
  nvme-rdma: fix possible hang when issuing commands during ctrl removal
  arm/arm64: kvm: Disable branch profiling in HYP code
  arm/arm64: kvm: Move initialization completion message
  arm/arm64: KVM: set right LR register value for 32 bit guest when inject abort
  Documentation: kernel-enforcement-statement.rst: proper sort names
  ASoC: rt5616: fix 0x91 default value
  Documentation: Add Arm Ltd to kernel-enforcement-statement.rst
  arm64: dts: uniphier: add STDMAC clock to EHCI nodes
  ARM: dts: uniphier: add STDMAC clock to EHCI nodes
  mmc: renesas_sdhi: fix kernel panic in _internal_dmac.c
  mmc: tmio: fix swiotlb buffer is full
  Documentation: kernel-enforcement-statement.rst: Remove Red Hat markings
  Documentation: Add myself to the enforcement statement list
  Documentation: Sign kernel enforcement statement
  Add ack for Trond Myklebust to the enforcement statement
  Documentation: update kernel enforcement support list
  Documentation: add my name to supporters
  ASoC: rt5659: connect LOUT Amp with Charge Pump
  ASoC: rt5659: register power bit of LOUT Amp
  KVM: arm64: its: Fix missing dynamic allocation check in scan_its_table
  crypto: x86/chacha20 - satisfy stack validation 2.0
  ASoC: rt5663: Change the dev getting function in rt5663_irq
  ASoC: rt5514: Revert Hotword Model control
  ASoC: topology: Fix a potential memory leak in 'soc_tplg_dapm_widget_denum_create()'
  ASoC: topology: Fix a potential NULL pointer dereference in 'soc_tplg_dapm_widget_denum_create()'
  ASoC: rt5514-spi: check irq status to schedule data copy
  ASoC: adau17x1: Workaround for noise bug in ADC

  Conflicts:
	drivers/gpu/drm/msm/Makefile
	drivers/soc/qcom/Makefile
	drivers/staging/android/ion/Makefile
	include/linux/coresight-stm.h
	include/trace/events/kmem.h

Change-Id: I01f1779762b652b9213924caa3d54f29cf03d285
Signed-off-by: Runmin Wang <runminw@codeaurora.org>
2017-11-06 11:37:20 -08:00
Greg Kroah-Hartman
e2be04c7f9 License cleanup: add SPDX license identifier to uapi header files with a license
Many user space API headers have licensing information, which is either
incomplete, badly formatted or just a shorthand for referring to the
license under which the file is supposed to be.  This makes it hard for
compliance tools to determine the correct license.

Update these files with an SPDX license identifier.  The identifier was
chosen based on the license information in the file.

GPL/LGPL licensed headers get the matching GPL/LGPL SPDX license
identifier with the added 'WITH Linux-syscall-note' exception, which is
the officially assigned exception identifier for the kernel syscall
exception:

   NOTE! This copyright does *not* cover user programs that use kernel
   services by normal system calls - this is merely considered normal use
   of the kernel, and does *not* fall under the heading of "derived work".

This exception makes it possible to include GPL headers into non GPL
code, without confusing license compliance tools.

Headers which have either explicit dual licensing or are just licensed
under a non GPL license are updated with the corresponding SPDX
identifier and the GPLv2 with syscall exception identifier.  The format
is:
        ((GPL-2.0 WITH Linux-syscall-note) OR SPDX-ID-OF-OTHER-LICENSE)

SPDX license identifiers are a legally binding shorthand, which can be
used instead of the full boiler plate text.  The update does not remove
existing license information as this has to be done on a case by case
basis and the copyright holders might have to be consulted. This will
happen in a separate step.

This patch is based on work done by Thomas Gleixner and Kate Stewart and
Philippe Ombredanne.  See the previous patch in this series for the
methodology of how this patch was researched.

Reviewed-by: Kate Stewart <kstewart@linuxfoundation.org>
Reviewed-by: Philippe Ombredanne <pombredanne@nexb.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-11-02 11:20:11 +01:00
Colin Cross
abcc61537e ANDROID: binder: Add BINDER_GET_NODE_DEBUG_INFO ioctl
The BINDER_GET_NODE_DEBUG_INFO ioctl will return debug info on
a node.  Each successive call reusing the previous return value
will return the next node.  The data will be used by
libmemunreachable to mark the pointers with kernel references
as reachable.

Signed-off-by: Colin Cross <ccross@android.com>
Signed-off-by: Martijn Coenen <maco@android.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-09-01 09:21:12 +02:00
Colin Cross
f82e2c0f30 ANDROID: Add BINDER_GET_NODE_DEBUG_INFO ioctl
The BINDER_GET_NODE_DEBUG_INFO ioctl will return debug info on
a node.  Each successive call reusing the previous return value
will return the next node.  The data will be used by
libmemunreachable to mark the pointers with kernel references
as reachable.

Bug: 28275695
Change-Id: Idbbafa648a33822dc023862cd92b51a595cf7c1c
Signed-off-by: Colin Cross <ccross@android.com>
Signed-off-by: Martijn Coenen <maco@android.com>
2017-08-23 18:52:47 +05:30
Martijn Coenen
e360cde03c ANDROID: binder: add RT inheritance flag to node.
Allows a binder node to specify whether it wants to
inherit real-time scheduling policy from a caller.

Change-Id: I375b6094bf441c19f19cba06d5a6be02cd07d714
Signed-off-by: Martijn Coenen <maco@android.com>
2017-08-23 18:52:44 +05:30
Martijn Coenen
b6cf285593 ANDROID: binder: add min sched_policy to node.
This change adds flags to flat_binder_object.flags
to allow indicating a minimum scheduling policy for
the node. It also clarifies the valid value range
for the priority bits in the flags.

Internally, we use the priority map that the kernel
uses, e.g. [0..99] for real-time policies and [100..139]
for the SCHED_NORMAL/SCHED_BATCH policies.

Bug: 34461621
Bug: 37293077
Change-Id: I12438deecb53df432da18c6fc77460768ae726d2
Signed-off-by: Martijn Coenen <maco@google.com>
2017-08-23 18:52:37 +05:30
Martijn Coenen
5cdcf4c6a6 ANDROID: binder: add padding to binder_fd_array_object.
binder_fd_array_object starts with a 4-byte header,
followed by a few fields that are 8 bytes when
ANDROID_BINDER_IPC_32BIT=N.

This can cause alignment issues in a 64-bit kernel
with a 32-bit userspace, as on x86_32 an 8-byte primitive
may be aligned to a 4-byte address. Pad with a __u32
to fix this.

Signed-off-by: Martijn Coenen <maco@android.com>
Cc: stable <stable@vger.kernel.org> # 4.11+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-08-22 18:43:23 -07:00
Martijn Coenen
f6de81f673 ANDROID: binder: add padding to binder_fd_array_object.
binder_fd_array_object starts with a 4-byte header,
followed by a few fields that are 8 bytes when
ANDROID_BINDER_IPC_32BIT=N.

This can cause alignment issues in a 64-bit kernel
with a 32-bit userspace, as on x86_32 an 8-byte primitive
may be aligned to a 4-byte address. Pad with a __u32
to fix this.

Change-Id: I4374ed2cc3ccd3c6a1474cb7209b53ebfd91077b
Signed-off-by: Martijn Coenen <maco@android.com>
2017-07-17 10:27:40 +05:30
Nicolas Dichtel
fcc8487d47 uapi: export all headers under uapi directories
Regularly, when a new header is created in include/uapi/, the developer
forgets to add it in the corresponding Kbuild file. This error is usually
detected after the release is out.

In fact, all headers under uapi directories should be exported, thus it's
useless to have an exhaustive list.

After this patch, the following files, which were not exported, are now
exported (with make headers_install_all):
asm-arc/kvm_para.h
asm-arc/ucontext.h
asm-blackfin/shmparam.h
asm-blackfin/ucontext.h
asm-c6x/shmparam.h
asm-c6x/ucontext.h
asm-cris/kvm_para.h
asm-h8300/shmparam.h
asm-h8300/ucontext.h
asm-hexagon/shmparam.h
asm-m32r/kvm_para.h
asm-m68k/kvm_para.h
asm-m68k/shmparam.h
asm-metag/kvm_para.h
asm-metag/shmparam.h
asm-metag/ucontext.h
asm-mips/hwcap.h
asm-mips/reg.h
asm-mips/ucontext.h
asm-nios2/kvm_para.h
asm-nios2/ucontext.h
asm-openrisc/shmparam.h
asm-parisc/kvm_para.h
asm-powerpc/perf_regs.h
asm-sh/kvm_para.h
asm-sh/ucontext.h
asm-tile/shmparam.h
asm-unicore32/shmparam.h
asm-unicore32/ucontext.h
asm-x86/hwcap2.h
asm-xtensa/kvm_para.h
drm/armada_drm.h
drm/etnaviv_drm.h
drm/vgem_drm.h
linux/aspeed-lpc-ctrl.h
linux/auto_dev-ioctl.h
linux/bcache.h
linux/btrfs_tree.h
linux/can/vxcan.h
linux/cifs/cifs_mount.h
linux/coresight-stm.h
linux/cryptouser.h
linux/fsmap.h
linux/genwqe/genwqe_card.h
linux/hash_info.h
linux/kcm.h
linux/kcov.h
linux/kfd_ioctl.h
linux/lightnvm.h
linux/module.h
linux/nbd-netlink.h
linux/nilfs2_api.h
linux/nilfs2_ondisk.h
linux/nsfs.h
linux/pr.h
linux/qrtr.h
linux/rpmsg.h
linux/sched/types.h
linux/sed-opal.h
linux/smc.h
linux/smc_diag.h
linux/stm.h
linux/switchtec_ioctl.h
linux/vfio_ccw.h
linux/wil6210_uapi.h
rdma/bnxt_re-abi.h

Note that I have removed from this list the files which are generated in every
exported directories (like .install or .install.cmd).

Thanks to Julien Floret <julien.floret@6wind.com> for the tip to get all
subdirs with a pure makefile command.

For the record, note that exported files for asm directories are a mix of
files listed by:
 - include/uapi/asm-generic/Kbuild.asm;
 - arch/<arch>/include/uapi/asm/Kbuild;
 - arch/<arch>/include/asm/Kbuild.

Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Acked-by: Russell King <rmk+kernel@armlinux.org.uk>
Acked-by: Mark Salter <msalter@redhat.com>
Acked-by: Michael Ellerman <mpe@ellerman.id.au> (powerpc)
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
2017-05-11 00:21:54 +09:00
Martijn Coenen
def95c7356 binder: Add support for file-descriptor arrays
This patch introduces a new binder_fd_array object,
that allows us to support one or more file descriptors
embedded in a buffer that is scatter-gathered.

Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Martijn Coenen <maco@google.com>
Cc: Arve Hjønnevåg <arve@android.com>
Cc: Amit Pundir <amit.pundir@linaro.org>
Cc: Serban Constantinescu <serban.constantinescu@arm.com>
Cc: Dmitry Shmidt <dimitrysh@google.com>
Cc: Rom Lemarchand <romlem@google.com>
Cc: Android Kernel Team <kernel-team@android.com>
Signed-off-by: Martijn Coenen <maco@google.com>
Signed-off-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-02-10 16:00:01 +01:00
Martijn Coenen
7980240b6d binder: Add support for scatter-gather
Previously all data passed over binder needed
to be serialized, with the exception of Binder
objects and file descriptors.

This patchs adds support for scatter-gathering raw
memory buffers into a binder transaction, avoiding
the need to first serialize them into a Parcel.

To remain backwards compatibile with existing
binder clients, it introduces two new command
ioctls for this purpose - BC_TRANSACTION_SG and
BC_REPLY_SG. These commands may only be used with
the new binder_transaction_data_sg structure,
which adds a field for the total size of the
buffers we are scatter-gathering.

Because memory buffers may contain pointers to
other buffers, we allow callers to specify
a parent buffer and an offset into it, to indicate
this is a location pointing to the buffer that
we are fixing up. The kernel will then take care
of fixing up the pointer to that buffer as well.

Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Martijn Coenen <maco@google.com>
Cc: Arve Hjønnevåg <arve@android.com>
Cc: Amit Pundir <amit.pundir@linaro.org>
Cc: Serban Constantinescu <serban.constantinescu@arm.com>
Cc: Dmitry Shmidt <dimitrysh@google.com>
Cc: Rom Lemarchand <romlem@google.com>
Cc: Android Kernel Team <kernel-team@android.com>
Signed-off-by: Martijn Coenen <maco@google.com>
[jstultz: Fold in small fix from Amit Pundir <amit.pundir@linaro.org>]
Signed-off-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-02-10 16:00:01 +01:00
Martijn Coenen
feba3900ca binder: Split flat_binder_object
flat_binder_object is used for both handling
binder objects and file descriptors, even though
the two are mostly independent. Since we'll
have more fixup objects in binder in the future,
instead of extending flat_binder_object again,
split out file descriptors to their own object
while retaining backwards compatibility to
existing user-space clients. All binder objects
just share a header.

Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Martijn Coenen <maco@google.com>
Cc: Arve Hjønnevåg <arve@android.com>
Cc: Amit Pundir <amit.pundir@linaro.org>
Cc: Serban Constantinescu <serban.constantinescu@arm.com>
Cc: Dmitry Shmidt <dimitrysh@google.com>
Cc: Rom Lemarchand <romlem@google.com>
Cc: Android Kernel Team <kernel-team@android.com>
Signed-off-by: Martijn Coenen <maco@google.com>
Signed-off-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-02-10 16:00:01 +01:00
Greg Kroah-Hartman
bc2d62a01b android: uapi: binder.h
add types.h to .h file to pass the checker scripts, and provide a proper
uapi .h file.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-10-20 10:30:15 +08:00
Greg Kroah-Hartman
777783e0ab staging: android: binder: move to the "real" part of the kernel
The Android binder code has been "stable" for many years now.  No matter
what comes in the future, we are going to have to support this API, so
might as well move it to the "real" part of the kernel as there's no
real work that needs to be done to the existing code.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-10-20 10:30:15 +08:00