1663 Commits

Author SHA1 Message Date
Song Liu
e66d20e515 bpf: enable stackmap with build_id in nmi context
Currently, we cannot parse build_id in nmi context because of
up_read(&current->mm->mmap_sem), this makes stackmap with build_id
less useful. This patch enables parsing build_id in nmi by putting
the up_read() call in irq_work. To avoid memory allocation in nmi
context, we use per cpu variable for the irq_work. As a result, only
one irq_work per cpu is allowed. If the irq_work is in-use, we
fallback to only report ips.

Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2025-12-21 17:51:33 +01:00
Michael Bestas
625042336d Merge remote-tracking branch 'common/android-4.9-q' into android-msm-pixel-4.9
* common/android-4.9-q:
  Linux 4.9.327
  kprobes: don't call disarm_kprobe() for disabled kprobes
  mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse
  netfilter: conntrack: NF_CONNTRACK_PROCFS should no longer default to y
  s390/hypfs: avoid error message under KVM
  arm64: map FDT as RW for early_init_dt_scan()
  ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead
  fbdev: fb_pm2fb: Avoid potential divide by zero error
  HID: hidraw: fix memory leak in hidraw_release()
  media: pvrusb2: fix memory leak in pvr_probe
  Bluetooth: L2CAP: Fix build errors in some archs
  kbuild: Fix include path in scripts/Makefile.modpost
  x86/bugs: Add "unknown" reporting for MMIO Stale Data
  x86/cpu: Add Tiger Lake to Intel family
  s390/mm: do not trigger write fault when vma does not allow VM_WRITE
  mm: Force TLB flush for PFNMAP mappings before unlink_file_vma()
  mm/hugetlb: fix hugetlb not supporting softdirty tracking
  asm-generic: sections: refactor memory_intersects
  loop: Check for overflow while configuring loop
  btrfs: check if root is readonly while setting security xattr
  ixgbe: stop resetting SYSTIME in ixgbe_ptp_start_cyclecounter
  net: Fix a data-race around sysctl_somaxconn.
  net: Fix a data-race around sysctl_net_busy_read.
  net: Fix a data-race around sysctl_net_busy_poll.
  net: Fix a data-race around sysctl_tstamp_allow_data.
  ratelimit: Fix data-races in ___ratelimit().
  netfilter: nft_payload: report ERANGE for too long offset and length
  bonding: 802.3ad: fix no transmission of LACPDUs
  rose: check NULL rose_loopback_neigh->loopback
  af_key: Do not call xfrm_probe_algs in parallel
  xfrm: fix refcount leak in __xfrm_policy_check()
  parisc: Fix exception handler for fldw and fstw instructions
  Linux 4.9.326
  MIPS: tlbex: Explicitly compare _PAGE_NO_EXEC against 0
  video: fbdev: i740fb: Check the argument of i740_calc_vclk()
  powerpc/64: Init jump labels before parse_early_param()
  ALSA: timer: Use deferred fasync helper
  ALSA: core: Add async signal helpers
  mips: cavium-octeon: Fix missing of_node_put() in octeon2_usb_clocks_start
  vfio: Clear the caps->buf to NULL after free
  tty: serial: Fix refcount leak bug in ucc_uart.c
  ext4: avoid resizing to a partial cluster size
  ext4: avoid remove directory when directory is corrupted
  drivers:md:fix a potential use-after-free bug
  cxl: Fix a memory leak in an error handling path
  gadgetfs: ep_io - wait until IRQ finishes
  usb: host: ohci-ppc-of: Fix refcount leak bug
  irqchip/tegra: Fix overflow implicit truncation warnings
  fec: Fix timer capture timing in `fec_ptp_enable_pps()`
  netfilter: nf_tables: really skip inactive sets when allocating name
  nios2: add force_successful_syscall_return()
  nios2: restarts apply only to the first sigframe we build...
  nios2: fix syscall restart checks
  nios2: traced syscall does need to check the syscall number
  nios2: don't leave NULLs in sys_call_table[]
  nios2: page fault et.al. are *not* restartable syscalls...
  atm: idt77252: fix use-after-free bugs caused by tst_timer
  xen/xenbus: fix return type in xenbus_file_read()
  vsock: Fix memory leak in vsock_connect()
  pinctrl: qcom: msm8916: Allow CAMSS GP clocks to be muxed
  pinctrl: nomadik: Fix refcount leak in nmk_pinctrl_dt_subnode_to_map
  SUNRPC: Reinitialise the backchannel request buffers before reuse
  NFSv4.1: RECLAIM_COMPLETE must handle EACCES
  can: ems_usb: fix clang's -Wunaligned-access warning
  btrfs: fix lost error handling when looking up extended ref on log replay
  ata: libata-eh: Add missing command name
  rds: add missing barrier to release_refill
  ALSA: info: Fix llseek return value when using callback
  net_sched: cls_route: disallow handle of 0
  net/9p: Initialize the iounit field during fid creation
  nios2: time: Read timer in get_cycles only if initialized
  Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression
  Revert "net: usb: ax88179_178a needs FLAG_SEND_ZLP"
  scsi: sg: Allow waiting for commands to complete on removed device
  tcp: fix over estimation in sk_forced_mem_schedule()
  btrfs: reject log replay if there is unsupported RO compat flag
  net_sched: cls_route: remove from list when handle is 0
  dm raid: fix address sanitizer warning in raid_status
  ext4: correct max_inline_xattr_value_size computing
  ext4: fix extent status tree race in writeback error recovery path
  ext4: update s_overhead_clusters in the superblock during an on-line resize
  ext4: fix use-after-free in ext4_xattr_set_entry
  ext4: make sure ext4_append() always allocates new block
  ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h
  spmi: trace: fix stack-out-of-bound access in SPMI tracing functions
  x86/olpc: fix 'logical not is only applied to the left hand side'
  scsi: zfcp: Fix missing auto port scan and thus missing target ports
  netfilter: nf_tables: fix null deref due to zeroed list head
  USB: HCD: Fix URB giveback issue in tasklet function
  MIPS: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
  powerpc/powernv: Avoid crashing if rng is NULL
  powerpc/fsl-pci: Fix Class Code of PCIe Root Port
  PCI: Add defines for normal and subtractive PCI bridges
  ia64, processor: fix -Wincompatible-pointer-types in ia64_get_irr()
  md-raid10: fix KASAN warning
  fuse: limit nsec
  bpf: fix overflow in prog accounting
  drm/nouveau: fix another off-by-one in nvbios_addr
  parisc: Fix device names in /proc/iomem
  usbnet: Fix linkwatch use-after-free on disconnect
  vfs: Check the truncate maximum size in inode_newsize_ok()
  ALSA: hda/cirrus - support for iMac 12,1 model
  ALSA: hda/conexant: Add quirk for LENOVO 20149 Notebook model
  KVM: x86: Mark TSS busy during LTR emulation _after_ all fault checks
  KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0
  add barriers to buffer_uptodate and set_buffer_uptodate
  ALSA: bcd2000: Fix a UAF bug on the error path of probing
  macintosh/adb: fix oob read in do_adb_query() function
  random: only call boot_init_stack_canary() once
  ACPI: video: Shortening quirk list by identifying Clevo by board_name only
  ACPI: video: Force backlight native for some TongFang devices
  init/main.c: extract early boot entropy from the passed cmdline
  init: move stack canary initialization after setup_arch
  init/main: properly align the multi-line comment
  init/main: Fix double "the" in comment
  include/uapi/linux/swab.h: fix userspace breakage, use __BITS_PER_LONG for swap
  selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling
  selinux: fix error initialization in inode_doinit_with_dentry()
  selinux: Convert isec->lock into a spinlock
  selinux: Clean up initialization of isec->sclass
  proc: Pass file mode to proc_pid_make_inode
  selinux: Minor cleanups
  ion: Make user_ion_handle_put_nolock() a void function
  mt7601u: add USB device ID for some versions of XiaoDu WiFi Dongle.
  ARM: crypto: comment out gcc warning that breaks clang builds
  netfilter: nf_queue: do not allow packet truncation below transport header offset
  net: sungem_phy: Add of_node_put() for reference returned by of_get_parent()
  net: ping6: Fix memleak in ipv6_renew_options().
  scsi: ufs: host: Hold reference returned by of_parse_phandle()
  ntfs: fix use-after-free in ntfs_ucsncmp()
  Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put
  FROMLIST: binder: fix UAF of ref->proc caused by race condition

 Conflicts:
	arch/arm64/kernel/setup.c
	drivers/staging/android/ion/ion-ioctl.c
	security/selinux/hooks.c
	security/selinux/include/objsec.h

Change-Id: I8d163f09e42a8570109c6ea89015000a9f5dd279
2022-09-06 06:11:26 +03:00
Greg Kroah-Hartman
33296e8a81 Merge 4.9.326 into android-4.9-q
Changes in 4.9.326
	Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put
	ntfs: fix use-after-free in ntfs_ucsncmp()
	scsi: ufs: host: Hold reference returned by of_parse_phandle()
	net: ping6: Fix memleak in ipv6_renew_options().
	net: sungem_phy: Add of_node_put() for reference returned by of_get_parent()
	netfilter: nf_queue: do not allow packet truncation below transport header offset
	ARM: crypto: comment out gcc warning that breaks clang builds
	mt7601u: add USB device ID for some versions of XiaoDu WiFi Dongle.
	ion: Make user_ion_handle_put_nolock() a void function
	selinux: Minor cleanups
	proc: Pass file mode to proc_pid_make_inode
	selinux: Clean up initialization of isec->sclass
	selinux: Convert isec->lock into a spinlock
	selinux: fix error initialization in inode_doinit_with_dentry()
	selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling
	include/uapi/linux/swab.h: fix userspace breakage, use __BITS_PER_LONG for swap
	init/main: Fix double "the" in comment
	init/main: properly align the multi-line comment
	init: move stack canary initialization after setup_arch
	init/main.c: extract early boot entropy from the passed cmdline
	ACPI: video: Force backlight native for some TongFang devices
	ACPI: video: Shortening quirk list by identifying Clevo by board_name only
	random: only call boot_init_stack_canary() once
	macintosh/adb: fix oob read in do_adb_query() function
	ALSA: bcd2000: Fix a UAF bug on the error path of probing
	add barriers to buffer_uptodate and set_buffer_uptodate
	KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0
	KVM: x86: Mark TSS busy during LTR emulation _after_ all fault checks
	ALSA: hda/conexant: Add quirk for LENOVO 20149 Notebook model
	ALSA: hda/cirrus - support for iMac 12,1 model
	vfs: Check the truncate maximum size in inode_newsize_ok()
	usbnet: Fix linkwatch use-after-free on disconnect
	parisc: Fix device names in /proc/iomem
	drm/nouveau: fix another off-by-one in nvbios_addr
	bpf: fix overflow in prog accounting
	fuse: limit nsec
	md-raid10: fix KASAN warning
	ia64, processor: fix -Wincompatible-pointer-types in ia64_get_irr()
	PCI: Add defines for normal and subtractive PCI bridges
	powerpc/fsl-pci: Fix Class Code of PCIe Root Port
	powerpc/powernv: Avoid crashing if rng is NULL
	MIPS: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
	USB: HCD: Fix URB giveback issue in tasklet function
	netfilter: nf_tables: fix null deref due to zeroed list head
	scsi: zfcp: Fix missing auto port scan and thus missing target ports
	x86/olpc: fix 'logical not is only applied to the left hand side'
	spmi: trace: fix stack-out-of-bound access in SPMI tracing functions
	ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h
	ext4: make sure ext4_append() always allocates new block
	ext4: fix use-after-free in ext4_xattr_set_entry
	ext4: update s_overhead_clusters in the superblock during an on-line resize
	ext4: fix extent status tree race in writeback error recovery path
	ext4: correct max_inline_xattr_value_size computing
	dm raid: fix address sanitizer warning in raid_status
	net_sched: cls_route: remove from list when handle is 0
	btrfs: reject log replay if there is unsupported RO compat flag
	tcp: fix over estimation in sk_forced_mem_schedule()
	scsi: sg: Allow waiting for commands to complete on removed device
	Revert "net: usb: ax88179_178a needs FLAG_SEND_ZLP"
	Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression
	nios2: time: Read timer in get_cycles only if initialized
	net/9p: Initialize the iounit field during fid creation
	net_sched: cls_route: disallow handle of 0
	ALSA: info: Fix llseek return value when using callback
	rds: add missing barrier to release_refill
	ata: libata-eh: Add missing command name
	btrfs: fix lost error handling when looking up extended ref on log replay
	can: ems_usb: fix clang's -Wunaligned-access warning
	NFSv4.1: RECLAIM_COMPLETE must handle EACCES
	SUNRPC: Reinitialise the backchannel request buffers before reuse
	pinctrl: nomadik: Fix refcount leak in nmk_pinctrl_dt_subnode_to_map
	pinctrl: qcom: msm8916: Allow CAMSS GP clocks to be muxed
	vsock: Fix memory leak in vsock_connect()
	xen/xenbus: fix return type in xenbus_file_read()
	atm: idt77252: fix use-after-free bugs caused by tst_timer
	nios2: page fault et.al. are *not* restartable syscalls...
	nios2: don't leave NULLs in sys_call_table[]
	nios2: traced syscall does need to check the syscall number
	nios2: fix syscall restart checks
	nios2: restarts apply only to the first sigframe we build...
	nios2: add force_successful_syscall_return()
	netfilter: nf_tables: really skip inactive sets when allocating name
	fec: Fix timer capture timing in `fec_ptp_enable_pps()`
	irqchip/tegra: Fix overflow implicit truncation warnings
	usb: host: ohci-ppc-of: Fix refcount leak bug
	gadgetfs: ep_io - wait until IRQ finishes
	cxl: Fix a memory leak in an error handling path
	drivers:md:fix a potential use-after-free bug
	ext4: avoid remove directory when directory is corrupted
	ext4: avoid resizing to a partial cluster size
	tty: serial: Fix refcount leak bug in ucc_uart.c
	vfio: Clear the caps->buf to NULL after free
	mips: cavium-octeon: Fix missing of_node_put() in octeon2_usb_clocks_start
	ALSA: core: Add async signal helpers
	ALSA: timer: Use deferred fasync helper
	powerpc/64: Init jump labels before parse_early_param()
	video: fbdev: i740fb: Check the argument of i740_calc_vclk()
	MIPS: tlbex: Explicitly compare _PAGE_NO_EXEC against 0
	Linux 4.9.326

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I3ca17af58cd0c61bd81028c496849592cfd22f0f
2022-08-25 12:09:51 +02:00
Hans-Christian Noren Egtvedt
f0c556f4b0 random: only call boot_init_stack_canary() once
In commit 166a592cad ("random: move rand_initialize() earlier") the
boot_init_stack_canary() call was added after the new random_init()
call.

However, the upstream commit d55535232c3d ("random: move
rand_initialize() earlier") also included removing the earlier call to
boot_init_stack_canary(), making sure this call is done after
random_init().

Hence fix what I assume is a wrong merge conflict resolution on the
linux-4.9.y stable branch.

Signed-off-by: Hans-Christian Noren Egtvedt <hegtvedt@cisco.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-08-25 11:09:22 +02:00
Daniel Micay
0a94ca6608 init/main.c: extract early boot entropy from the passed cmdline
commit 33d72f3822d7ff8a9e45bd7413c811085cb87aa5 upstream.

Feed the boot command-line as to the /dev/random entropy pool

Existing Android bootloaders usually pass data which may not be known by
an external attacker on the kernel command-line.  It may also be the
case on other embedded systems.  Sample command-line from a Google Pixel
running CopperheadOS....

    console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0
    androidboot.hardware=sailfish user_debug=31 ehci-hcd.park=3
    lpm_levels.sleep_disabled=1 cma=32M@0-0xffffffff buildvariant=user
    veritykeyid=id:dfcb9db0089e5b3b4090a592415c28e1cb4545ab
    androidboot.bootdevice=624000.ufshc androidboot.verifiedbootstate=yellow
    androidboot.veritymode=enforcing androidboot.keymaster=1
    androidboot.serialno=FA6CE0305299 androidboot.baseband=msm
    mdss_mdp.panel=1:dsi:0:qcom,mdss_dsi_samsung_ea8064tg_1080p_cmd:1:none:cfg:single_dsi
    androidboot.slot_suffix=_b fpsimd.fpsimd_settings=0
    app_setting.use_app_setting=0 kernelflag=0x00000000 debugflag=0x00000000
    androidboot.hardware.revision=PVT radioflag=0x00000000
    radioflagex1=0x00000000 radioflagex2=0x00000000 cpumask=0x00000000
    androidboot.hardware.ddr=4096MB,Hynix,LPDDR4 androidboot.ddrinfo=00000006
    androidboot.ddrsize=4GB androidboot.hardware.color=GRA00
    androidboot.hardware.ufs=32GB,Samsung androidboot.msm.hw_ver_id=268824801
    androidboot.qf.st=2 androidboot.cid=11111111 androidboot.mid=G-2PW4100
    androidboot.bootloader=8996-012001-1704121145
    androidboot.oem_unlock_support=1 androidboot.fp_src=1
    androidboot.htc.hrdump=detected androidboot.ramdump.opt=mem@2g:2g,mem@4g:2g
    androidboot.bootreason=reboot androidboot.ramdump_enable=0 ro
    root=/dev/dm-0 dm="system none ro,0 1 android-verity /dev/sda34"
    rootwait skip_initramfs init=/init androidboot.wificountrycode=US
    androidboot.boottime=1BLL:85,1BLE:669,2BLL:0,2BLE:1777,SW:6,KL:8136

Among other things, it contains a value unique to the device
(androidboot.serialno=FA6CE0305299), unique to the OS builds for the
device variant (veritykeyid=id:dfcb9db0089e5b3b4090a592415c28e1cb4545ab)
and timings from the bootloader stages in milliseconds
(androidboot.boottime=1BLL:85,1BLE:669,2BLL:0,2BLE:1777,SW:6,KL:8136).

[tytso@mit.edu: changelog tweak]
[labbott@redhat.com: line-wrapped command line]
Link: http://lkml.kernel.org/r/20170816231458.2299-3-labbott@redhat.com
Signed-off-by: Daniel Micay <danielmicay@gmail.com>
Signed-off-by: Laura Abbott <labbott@redhat.com>
Acked-by: Kees Cook <keescook@chromium.org>
Cc: "Theodore Ts'o" <tytso@mit.edu>
Cc: Laura Abbott <lauraa@codeaurora.org>
Cc: Nick Kralevich <nnk@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Hans-Christian Noren Egtvedt <hegtvedt@cisco.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-08-25 11:09:22 +02:00
Laura Abbott
af49d0e6fe init: move stack canary initialization after setup_arch
commit 121388a31362b0d3176dc1190ac8064b98a61b20 upstream.

Patch series "Command line randomness", v3.

A series to add the kernel command line as a source of randomness.

This patch (of 2):

Stack canary intialization involves getting a random number.  Getting this
random number may involve accessing caches or other architectural specific
features which are not available until after the architecture is setup.
Move the stack canary initialization later to accommodate this.

Link: http://lkml.kernel.org/r/20170816231458.2299-2-labbott@redhat.com
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Signed-off-by: Laura Abbott <labbott@redhat.com>
Acked-by: Kees Cook <keescook@chromium.org>
Cc: "Theodore Ts'o" <tytso@mit.edu>
Cc: Daniel Micay <danielmicay@gmail.com>
Cc: Nick Kralevich <nnk@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Hans-Christian Noren Egtvedt <hegtvedt@cisco.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-08-25 11:09:22 +02:00
Viresh Kumar
3cacffd4d5 init/main: properly align the multi-line comment
commit 1b3b3b49b9961401331a1b496db5bec5c7b41ae6 upstream.

Add a tab before it to follow standard practices. Also add the missing
full stop '.'.

Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Hans-Christian Noren Egtvedt <hegtvedt@cisco.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-08-25 11:09:22 +02:00
Viresh Kumar
3b2f98d484 init/main: Fix double "the" in comment
commit 6623f1c6150c09ce946c8e27a4c814d64919495b upstream.

s/the\ the/the

Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Hans-Christian Noren Egtvedt <hegtvedt@cisco.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-08-25 11:09:22 +02:00
Michael Bestas
87cf1c2fc1 Merge remote-tracking branch 'common/android-4.9-q' into android-msm-pixel-4.9
* common/android-4.9-q:
  Linux 4.9.321
  swiotlb: skip swiotlb_bounce when orig_addr is zero
  kexec_file: drop weak attribute from arch_kexec_apply_relocations[_add]
  fdt: Update CRC check for rng-seed
  xen: unexport __init-annotated xen_xlate_map_ballooned_pages()
  drm: remove drm_fb_helper_modinit
  powerpc/pseries: wire up rng during setup_arch()
  modpost: fix section mismatch check for exported init/exit sections
  ARM: cns3xxx: Fix refcount leak in cns3xxx_init
  ARM: Fix refcount leak in axxia_boot_secondary
  ARM: exynos: Fix refcount leak in exynos_map_pmu
  ARM: dts: imx6qdl: correct PU regulator ramp delay
  powerpc: Enable execve syscall exit tracepoint
  xtensa: Fix refcount leak bug in time.c
  xtensa: xtfpga: Fix refcount leak bug in setup
  iio: trigger: sysfs: fix use-after-free on remove
  iio: accel: mma8452: ignore the return value of reset operation
  iio:accel:bma180: rearrange iio trigger get and register
  usb: chipidea: udc: check request status before setting device address
  iio: adc: vf610: fix conversion mode sysfs node name
  igb: Make DMA faster when CPU is active on the PCIe link
  MIPS: Remove repetitive increase irq_err_count
  x86/xen: Remove undefined behavior in setup_features()
  bonding: ARP monitor spams NETDEV_NOTIFY_PEERS notifiers
  USB: serial: option: add Telit LE910Cx 0x1250 composition
  random: quiet urandom warning ratelimit suppression message
  dm era: commit metadata in postsuspend after worker stops
  ata: libata: add qc->flags in ata_qc_complete_template tracepoint
  random: schedule mix_interrupt_randomness() less often
  vt: drop old FONT ioctls
  BACKPORT: l2tp: fix race in pppol2tp_release with session object destroy
  BACKPORT: l2tp: don't use inet_shutdown on ppp session destroy
  Linux 4.9.320
  tcp: drop the hash_32() part from the index calculation
  tcp: increase source port perturb table to 2^16
  tcp: dynamically allocate the perturb table used by source ports
  tcp: add small random increments to the source port
  tcp: use different parts of the port_offset for index and offset
  secure_seq: use the 64 bits of the siphash for port offset calculation
  tcp: add some entropy in __inet_hash_connect()
  tcp: change source port randomizarion at connect() time
  fuse: fix pipe buffer lifetime for direct_io
  Reinstate some of "swiotlb: rework "fix info leak with DMA_FROM_DEVICE""
  swiotlb: fix info leak with DMA_FROM_DEVICE
  xprtrdma: fix incorrect header size calculations
  s390/mm: use non-quiescing sske for KVM switch to keyed guest
  l2tp: fix race in pppol2tp_release with session object destroy
  l2tp: don't use inet_shutdown on ppp session destroy
  ext4: add reserved GDT blocks check
  ext4: make variable "count" signed
  ext4: fix bug_on ext4_mb_use_inode_pa
  serial: 8250: Store to lsr_save_flags after lsr read
  usb: gadget: lpc32xx_udc: Fix refcount leak in lpc32xx_udc_probe
  USB: serial: io_ti: add Agilent E5805A support
  USB: serial: option: add support for Cinterion MV31 with new baseline
  comedi: vmk80xx: fix expression for tx buffer size
  irqchip/gic-v3: Iterate over possible CPUs by for_each_possible_cpu()
  irqchip/gic/realview: Fix refcount leak in realview_gic_of_init
  misc: atmel-ssc: Fix IRQ check in ssc_probe
  pNFS: Don't keep retrying if the server replied NFS4ERR_LAYOUTUNAVAILABLE
  random: credit cpu and bootloader seeds by default
  net: ethernet: mtk_eth_soc: fix misuse of mem alloc interface netdev[napi]_alloc_frag
  ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg
  nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred
  virtio-mmio: fix missing put_device() when vm_cmdline_parent registration failed
  scsi: lpfc: Fix port stuck in bypassed state after LIP in PT2PT topology
  scsi: vmw_pvscsi: Expand vcpuHint to 16 bits
  ASoC: wm8962: Fix suspend while playing music
  ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo()
  ASoC: cs42l56: Correct typo in minimum level for SX volume controls
  ASoC: cs42l52: Correct TLV for Bypass Volume
  ASoC: cs53l30: Correct number of volume levels on SX controls
  ASoC: cs42l52: Fix TLV scales for mixer controls
  random: account for arch randomness in bits
  random: mark bootloader randomness code as __init
  random: avoid checking crng_ready() twice in random_init()
  crypto: drbg - make reseeding from get_random_bytes() synchronous
  crypto: drbg - always try to free Jitter RNG instance
  crypto: drbg - move dynamic ->reseed_threshold adjustments to __drbg_seed()
  crypto: drbg - track whether DRBG was seeded with !rng_is_initialized()
  crypto: drbg - prepare for more fine-grained tracking of seeding state
  crypto: drbg - always seeded with SP800-90B compliant noise source
  crypto: drbg - add FIPS 140-2 CTRNG for noise source
  Revert "random: use static branch for crng_ready()"
  random: check for signals after page of pool writes
  random: wire up fops->splice_{read,write}_iter()
  random: convert to using fops->write_iter()
  random: move randomize_page() into mm where it belongs
  random: move initialization functions out of hot pages
  random: use proper return types on get_random_{int,long}_wait()
  random: remove extern from functions in header
  random: use static branch for crng_ready()
  random: credit architectural init the exact amount
  random: handle latent entropy and command line from random_init()
  random: use proper jiffies comparison macro
  random: remove ratelimiting for in-kernel unseeded randomness
  random: avoid initializing twice in credit race
  random: use symbolic constants for crng_init states
  siphash: use one source of truth for siphash permutations
  random: help compiler out with fast_mix() by using simpler arguments
  random: do not use input pool from hard IRQs
  random: order timer entropy functions below interrupt functions
  random: do not pretend to handle premature next security model
  random: do not use batches when !crng_ready()
  random: insist on random_get_entropy() existing in order to simplify
  uapi: rename ext2_swab() to swab() and share globally in swab.h
  xtensa: use fallback for random_get_entropy() instead of zero
  sparc: use fallback for random_get_entropy() instead of zero
  um: use fallback for random_get_entropy() instead of zero
  x86/tsc: Use fallback for random_get_entropy() instead of zero
  nios2: use fallback for random_get_entropy() instead of zero
  arm: use fallback for random_get_entropy() instead of zero
  mips: use fallback for random_get_entropy() instead of just c0 random
  m68k: use fallback for random_get_entropy() instead of zero
  timekeeping: Add raw clock fallback for random_get_entropy()
  powerpc: define get_cycles macro for arch-override
  alpha: define get_cycles macro for arch-override
  parisc: define get_cycles macro for arch-override
  s390: define get_cycles macro for arch-override
  ia64: define get_cycles macro for arch-override
  init: call time_init() before rand_initialize()
  random: fix sysctl documentation nits
  random: document crng_fast_key_erasure() destination possibility
  random: make random_get_entropy() return an unsigned long
  random: check for signals every PAGE_SIZE chunk of /dev/[u]random
  random: check for signal_pending() outside of need_resched() check
  random: do not allow user to keep crng key around on stack
  random: do not split fast init input in add_hwgenerator_randomness()
  random: mix build-time latent entropy into pool at init
  random: re-add removed comment about get_random_{u32,u64} reseeding
  random: treat bootloader trust toggle the same way as cpu trust toggle
  random: skip fast_init if hwrng provides large chunk of entropy
  random: check for signal and try earlier when generating entropy
  random: reseed more often immediately after booting
  random: make consistent usage of crng_ready()
  random: use SipHash as interrupt entropy accumulator
  random: replace custom notifier chain with standard one
  random: don't let 644 read-only sysctls be written to
  random: give sysctl_random_min_urandom_seed a more sensible value
  random: do crng pre-init loading in worker rather than irq
  random: unify cycles_t and jiffies usage and types
  random: cleanup UUID handling
  random: only wake up writers after zap if threshold was passed
  random: round-robin registers as ulong, not u32
  random: clear fast pool, crng, and batches in cpuhp bring up
  random: pull add_hwgenerator_randomness() declaration into random.h
  hwrng: remember rng chosen by user
  hwrng: use rng source with best quality
  hwrng: core - remove unused PFX macro
  hwrng: core - Move hwrng miscdev minor number to include/linux/miscdevice.h
  hwrng: core - Rewrite the header
  hwrng: core - rewrite better comparison to NULL
  hwrng: core - do not use multiple blank lines
  random: check for crng_init == 0 in add_device_randomness()
  random: unify early init crng load accounting
  random: do not take pool spinlock at boot
  random: defer fast pool mixing to worker
  workqueue: make workqueue available early during boot
  random: rewrite header introductory comment
  random: group sysctl functions
  random: group userspace read/write functions
  random: group entropy collection functions
  random: group entropy extraction functions
  random: group initialization wait functions
  random: remove whitespace and reorder includes
  random: remove useless header comment
  random: introduce drain_entropy() helper to declutter crng_reseed()
  random: deobfuscate irq u32/u64 contributions
  random: add proper SPDX header
  random: remove unused tracepoints
  random: remove ifdef'd out interrupt bench
  random: tie batched entropy generation to base_crng generation
  random: zero buffer after reading entropy from userspace
  random: remove outdated INT_MAX >> 6 check in urandom_read()
  random: use hash function for crng_slow_load()
  random: absorb fast pool into input pool after fast load
  random: do not xor RDRAND when writing into /dev/random
  random: ensure early RDSEED goes through mixer on init
  random: inline leaves of rand_initialize()
  random: use RDSEED instead of RDRAND in entropy extraction
  random: fix locking in crng_fast_load()
  random: remove batched entropy locking
  random: remove use_input_pool parameter from crng_reseed()
  random: make credit_entropy_bits() always safe
  random: always wake up entropy writers after extraction
  random: use linear min-entropy accumulation crediting
  random: simplify entropy debiting
  random: use computational hash for entropy extraction
  random: only call crng_finalize_init() for primary_crng
  random: access primary_pool directly rather than through pointer
  random: continually use hwgenerator randomness
  random: simplify arithmetic function flow in account()
  random: access input_pool_data directly rather than through pointer
  random: cleanup fractional entropy shift constants
  random: prepend remaining pool constants with POOL_
  random: de-duplicate INPUT_POOL constants
  random: remove unused OUTPUT_POOL constants
  random: rather than entropy_store abstraction, use global
  random: try to actively add entropy rather than passively wait for it
  random: remove unused extract_entropy() reserved argument
  random: remove incomplete last_data logic
  random: cleanup integer types
  crypto: chacha20 - Fix chacha20_block() keystream alignment (again)
  random: cleanup poolinfo abstraction
  random: fix typo in comments
  random: don't reset crng_init_cnt on urandom_read()
  random: avoid superfluous call to RDRAND in CRNG extraction
  random: early initialization of ChaCha constants
  random: initialize ChaCha20 constants with correct endianness
  random: use IS_ENABLED(CONFIG_NUMA) instead of ifdefs
  random: harmonize "crng init done" messages
  random: mix bootloader randomness into pool
  random: do not re-init if crng_reseed completes before primary init
  random: do not sign extend bytes for rotation when mixing
  random: use BLAKE2s instead of SHA1 in extraction
  random: remove unused irq_flags argument from add_interrupt_randomness()
  random: document add_hwgenerator_randomness() with other input functions
  crypto: blake2s - adjust include guard naming
  crypto: blake2s - include <linux/bug.h> instead of <asm/bug.h>
  MAINTAINERS: co-maintain random.c
  random: remove dead code left over from blocking pool
  random: avoid arch_get_random_seed_long() when collecting IRQ randomness
  random: add arch_get_random_*long_early()
  powerpc: Use bool in archrandom.h
  linux/random.h: Mark CONFIG_ARCH_RANDOM functions __must_check
  linux/random.h: Use false with bool
  linux/random.h: Remove arch_has_random, arch_has_random_seed
  powerpc: Remove arch_has_random, arch_has_random_seed
  x86: Remove arch_has_random, arch_has_random_seed
  random: avoid warnings for !CONFIG_NUMA builds
  random: split primary/secondary crng init paths
  random: remove some dead code of poolinfo
  random: fix typo in add_timer_randomness()
  random: Add and use pr_fmt()
  random: convert to ENTROPY_BITS for better code readability
  random: remove unnecessary unlikely()
  random: remove kernel.random.read_wakeup_threshold
  random: delete code to pull data into pools
  random: remove the blocking pool
  random: fix crash on multiple early calls to add_bootloader_randomness()
  random: make /dev/random be almost like /dev/urandom
  random: ignore GRND_RANDOM in getentropy(2)
  random: add GRND_INSECURE to return best-effort non-cryptographic bytes
  random: Add a urandom_read_nowait() for random APIs that don't warn
  random: Don't wake crng_init_wait when crng_init == 1
  lib/crypto: sha1: re-roll loops to reduce code size
  lib/crypto: blake2s: move hmac construction into wireguard
  crypto: blake2s - generic C library implementation and selftest
  crypto: Deduplicate le32_to_cpu_array() and cpu_to_le32_array()
  Revert "hwrng: core - Freeze khwrng thread during suspend"
  char/random: Add a newline at the end of the file
  random: Use wait_event_freezable() in add_hwgenerator_randomness()
  fdt: add support for rng-seed
  random: Support freezable kthreads in add_hwgenerator_randomness()
  random: fix soft lockup when trying to read from an uninitialized blocking pool
  latent_entropy: avoid build error when plugin cflags are not set
  random: document get_random_int() family
  random: move rand_initialize() earlier
  random: only read from /dev/random after its pool has received 128 bits
  drivers/char/random.c: make primary_crng static
  drivers/char/random.c: remove unused stuct poolinfo::poolbits
  drivers/char/random.c: constify poolinfo_table
  random: make CPU trust a boot parameter
  random: Make crng state queryable
  random: remove preempt disabled region
  random: add a config option to trust the CPU's hwrng
  random: Return nbytes filled from hw RNG
  random: Fix whitespace pre random-bytes work
  drivers/char/random.c: remove unused dont_count_entropy
  random: optimize add_interrupt_randomness
  random: always fill buffer in get_random_bytes_wait
  crypto: chacha20 - Fix keystream alignment for chacha20_block()
  random: fix data race on crng_node_pool
  random: always use batched entropy for get_random_u{32,64}
  Revert "char/random: silence a lockdep splat with printk()"
  char/random: silence a lockdep splat with printk()
  random: add a spinlock_t to struct batched_entropy
  random: rate limit unseeded randomness warnings
  random: fix possible sleeping allocation from irq context
  random: set up the NUMA crng instances after the CRNG is fully initialized
  random: use a different mixing algorithm for add_device_randomness()
  random: fix warning message on ia64 and parisc
  random: reorder READ_ONCE() in get_random_uXX
  random: suppress spammy warnings about unseeded randomness
  random: do not ignore early device randomness
  random: warn when kernel uses unseeded randomness
  random: add get_random_{bytes,u32,u64,int,long,once}_wait family
  random: add wait_for_random_bytes() API
  random: silence compiler warnings and fix race
  random: invalidate batched entropy after crng init
  random: move random_min_urandom_seed into CONFIG_SYSCTL ifdef block
  random: convert get_random_int/long into get_random_u32/u64
  random: fix comment for unused random_min_urandom_seed
  random: remove variable limit
  random: remove stale urandom_init_wait
  random: remove stale maybe_reseed_primary_crng
  9p: missing chunk of "fs/9p: Don't update file type when updating file attributes"
  Linux 4.9.319
  x86/speculation/mmio: Print SMT warning
  KVM: x86/speculation: Disable Fill buffer clear within guests
  x86/speculation/mmio: Reuse SRBDS mitigation for SBDS
  x86/speculation/srbds: Update SRBDS mitigation selection
  x86/speculation/mmio: Add sysfs reporting for Processor MMIO Stale Data
  x86/speculation/mmio: Enable CPU Fill buffer clearing on idle
  x86/bugs: Group MDS, TAA & Processor MMIO Stale Data mitigations
  x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data
  x86/speculation: Add a common function for MD_CLEAR mitigation update
  x86/speculation/mmio: Enumerate Processor MMIO Stale Data bug
  Documentation: Add documentation for Processor MMIO Stale Data
  x86/cpu: Add another Alder Lake CPU to the Intel family
  x86/cpu: Add Lakefield, Alder Lake and Rocket Lake models to the to Intel CPU family
  x86/cpu: Add Comet Lake to the Intel CPU models header
  x86/CPU: Add more Icelake model numbers
  x86/CPU: Add Icelake model number
  x86/cpu: Add Cannonlake to Intel family
  x86/cpu: Add Jasper Lake to Intel family
  cpu/speculation: Add prototype for cpu_show_srbds()
  x86/cpu: Add Elkhart Lake to Intel family
  ANDROID: arch: fix backported syscall numbers
  Linux 4.9.318
  tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd
  PCI: qcom: Fix unbalanced PHY init on probe errors
  mtd: cfi_cmdset_0002: Use chip_ready() for write on S29GL064N
  mtd: cfi_cmdset_0002: Move and rename chip_check/chip_ready/chip_good_for_write
  powerpc/32: Fix overread/overwrite of thread_struct via ptrace
  Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag
  nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling
  nfc: st21nfca: fix incorrect validating logic in EVT_TRANSACTION
  ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files
  cifs: return errors during session setup during reconnects
  ALSA: hda/conexant - Fix loopback issue with CX20632
  vringh: Fix loop descriptors check in the indirect cases
  nodemask: Fix return values to be unsigned
  modpost: fix undefined behavior of is_arm_mapping_symbol()
  drm/radeon: fix a possible null pointer dereference
  Revert "net: af_key: add check for pfkey_broadcast in function pfkey_process"
  md: protect md_unregister_thread from reentrancy
  serial: msm_serial: disable interrupts in __msm_console_write()
  staging: rtl8712: fix uninit-value in r871xu_drv_init()
  clocksource/drivers/sp804: Avoid error on multiple instances
  misc: rtsx: set NULL intfdata when probe fails
  usb: dwc2: gadget: don't reset gadget's driver->bus
  USB: hcd-pci: Fully suspend across freeze/thaw cycle
  drivers: usb: host: Fix deadlock in oxu_bus_suspend()
  drivers: tty: serial: Fix deadlock in sa1100_set_termios()
  USB: host: isp116x: check return value after calling platform_get_resource()
  drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop()
  tty: Fix a possible resource leak in icom_probe
  tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
  lkdtm/usercopy: Expand size of "out of frame" object
  iio: dummy: iio_simple_dummy: check the return value of kstrdup()
  net: altera: Fix refcount leak in altera_tse_mdio_create
  net: xfrm: unexport __init-annotated xfrm4_protocol_init()
  SUNRPC: Fix the calculation of xdr->end in xdr_get_next_encode_buffer()
  net/mlx4_en: Fix wrong return value on ioctl EEPROM query failure
  ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
  net: fix nla_strcmp to handle more then one trailing null character
  video: fbdev: pxa3xx-gcu: release the resources correctly in pxa3xx_gcu_probe/remove()
  m68knommu: fix undefined reference to `_init_sp'
  m68knommu: set ZERO_PAGE() to the allocated zeroed page
  i2c: cadence: Increase timeout per message if necessary
  tracing: Avoid adding tracer option before update_tracer_options
  tcp: tcp_rtx_synack() can be called from process context
  jffs2: fix memory leak in jffs2_do_fill_super
  modpost: fix removing numeric suffixes
  net: ethernet: mtk_eth_soc: out of bounds read in mtk_hwlro_get_fdir_entry()
  clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map() return value
  firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle
  serial: st-asc: Sanitize CSIZE and correct PARENB for CS7
  serial: sh-sci: Don't allow CS5-6
  serial: txx9: Don't allow CS5-6
  serial: digicolor-usart: Don't allow CS5-6
  serial: meson: acquire port->lock in startup()
  rtc: mt6397: check return value after calling platform_get_resource()
  rpmsg: qcom_smd: Fix irq_of_parse_and_map() return value
  pwm: lp3943: Fix duty calculation in case period was clamped
  USB: storage: karma: fix rio_karma_init return
  usb: usbip: add missing device lock on tweak configuration cmd
  usb: usbip: fix a refcount leak in stub_probe()
  staging: greybus: codecs: fix type confusion of list iterator variable
  pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards
  netfilter: nf_tables: disallow non-stateful expression in sets earlier
  MIPS: IP27: Remove incorrect `cpu_has_fpu' override
  RDMA/rxe: Generate a completion for unsupported/invalid opcode
  dt-bindings: gpio: altera: correct interrupt-cells
  docs/conf.py: Cope with removal of language=None in Sphinx 5.0.0
  gma500: fix an incorrect NULL check on list iterator
  carl9170: tx: fix an incorrect use of list iterator
  ASoC: rt5514: Fix event generation for "DSP Voice Wake Up" control
  rtl818x: Prevent using not initialized queues
  hugetlb: fix huge_pmd_unshare address update
  nodemask.h: fix compilation error with GCC12
  iommu/msm: Fix an incorrect NULL check on list iterator
  um: Fix out-of-bounds read in LDT setup
  um: chan_user: Fix winch_tramp() return value
  mac80211: upgrade passive scan to active scan on DFS channels after beacon rx
  irqchip: irq-xtensa-mx: fix initial IRQ affinity
  irqchip/armada-370-xp: Do not touch Performance Counter Overflow on A375, A38x, A39x
  RDMA/hfi1: Fix potential integer multiplication overflow errors
  md: fix an incorrect NULL check in md_reload_sb
  md: fix an incorrect NULL check in does_sb_need_changing
  drm/bridge: analogix_dp: Grab runtime PM reference for DP-AUX
  drm/amdgpu/cs: make commands with 0 chunks illegal behaviour.
  scsi: ufs: qcom: Add a readl() to make sure ref_clk gets enabled
  scsi: dc395x: Fix a missing check on list iterator
  ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
  dlm: fix missing lkb refcount handling
  dlm: fix plock invalid read
  ext4: verify dir block before splitting it
  ext4: fix bug_on in ext4_writepages
  ext4: fix use-after-free in ext4_rename_dir_prepare
  fs-writeback: writeback_sb_inodes:Recalculate 'wrote' according skipped pages
  iwlwifi: mvm: fix assert 1F04 upon reconfig
  wifi: mac80211: fix use-after-free in chanctx code
  iommu/amd: Increase timeout waiting for GA log enablement
  video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup
  Input: sparcspkr - fix refcount leak in bbc_beep_probe
  tty: fix deadlock caused by calling printk() under tty_port->lock
  powerpc/4xx/cpm: Fix return value of __setup() handler
  powerpc/idle: Fix return value of __setup() handler
  powerpc/8xx: export 'cpm_setbrg' for modules
  drivers/base/node.c: fix compaction sysfs file leak
  scsi: fcoe: Fix Wstringop-overflow warnings in fcoe_wwn_from_mac()
  mfd: ipaq-micro: Fix error check return value of platform_get_irq()
  soc: qcom: smsm: Fix missing of_node_put() in smsm_parse_ipc
  soc: qcom: smp2p: Fix missing of_node_put() in smp2p_parse_ipc
  rxrpc: Don't try to resend the request if we're receiving the reply
  rxrpc: Fix listen() setting the bar too high for the prealloc rings
  ASoC: wm2000: fix missing clk_disable_unprepare() on error in wm2000_anc_transition()
  sctp: read sk->sk_bound_dev_if once in sctp_rcv()
  m68k: math-emu: Fix dependencies of math emulation support
  Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout
  media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
  media: exynos4-is: Change clk_disable to clk_disable_unprepare
  regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
  ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
  media: uvcvideo: Fix missing check to determine if element is found in list
  drm/msm: return an error pointer in msm_gem_prime_get_sg_table()
  x86/mm: Cleanup the control_va_addr_alignment() __setup handler
  drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
  drm/msm/hdmi: check return value after calling platform_get_resource_byname()
  drm/msm/dsi: fix error checks and return values for DSI xmit functions
  x86/pm: Fix false positive kmemleak report in msr_build_context()
  inotify: show inotify mask flags in proc fdinfo
  ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix
  spi: img-spfi: Fix pm_runtime_get_sync() error checking
  HID: hid-led: fix maximum brightness for Dream Cheeky
  NFC: NULL out the dev->rfkill to prevent UAF
  spi: spi-ti-qspi: Fix return value handling of wait_for_completion_timeout
  drm/mediatek: Fix mtk_cec_mask()
  x86/delay: Fix the wrong asm constraint in delay_loop()
  ASoC: mediatek: Fix error handling in mt8173_max98090_dev_probe
  drm: fix EDID struct for old ARM OABI format
  macintosh/via-pmu: Fix build failure when CONFIG_INPUT is disabled
  powerpc/xics: fix refcount leak in icp_opal_init()
  PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store()
  ARM: hisi: Add missing of_node_put after of_find_compatible_node
  ARM: dts: exynos: add atmel,24c128 fallback to Samsung EEPROM
  ARM: versatile: Add missing of_node_put in dcscb_init
  fat: add ratelimit to fat*_ent_bread()
  ARM: OMAP1: clock: Fix UART rate reporting algorithm
  fs: jfs: fix possible NULL pointer dereference in dbFree()
  eth: tg3: silence the GCC 12 array-bounds warning
  rxrpc: Return an error to sendmsg if call failed
  media: exynos4-is: Fix compile warning
  ASoC: rt5645: Fix errorenous cleanup order
  nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags
  openrisc: start CPU timer early in boot
  ipmi:ssif: Check for NULL msg when handling events and messages
  dma-debug: change allocation mode from GFP_NOWAIT to GFP_ATIOMIC
  ASoC: dapm: Don't fold register value changes into notifications
  ipv6: Don't send rs packets to the interface of ARPHRD_TUNNEL
  drm/amd/pm: fix the compile warning
  scsi: megaraid: Fix error check return value of register_chrdev()
  media: cx25821: Fix the warning when removing the module
  ath9k: fix QCA9561 PA bias level
  drm/amd/pm: fix double free in si_parse_power_table()
  ALSA: jack: Access input_dev under mutex
  ACPICA: Avoid cache flush inside virtual machines
  ipw2x00: Fix potential NULL dereference in libipw_xmit()
  b43: Fix assigning negative value to unsigned variable
  b43legacy: Fix assigning negative value to unsigned variable
  mwifiex: add mutex lock for call in mwifiex_dfs_chan_sw_work_queue
  drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes
  btrfs: add "0x" prefix for unsupported optional features
  ptrace: Reimplement PTRACE_KILL by always sending SIGKILL
  ptrace/xtensa: Replace PT_SINGLESTEP with TIF_SINGLESTEP
  USB: new quirk for Dell Gen 2 devices
  BACKPORT: psi: Fix uaf issue when psi trigger is destroyed while being polled

 Conflicts:
	drivers/char/Kconfig
	drivers/char/random.c
	fs/fat/fatent.c
	include/linux/random.h
	init/main.c
	kernel/cpu.c
	lib/Makefile

Change-Id: I06579fa22a0347a0d8d2fa32bd6b7b6b54db626f
2022-08-09 06:05:50 +03:00
Eric Biggers
ea690b6ba4 Merge 4.9.320 into android-4.9-q
Changes in 4.9.320
	9p: missing chunk of "fs/9p: Don't update file type when updating file attributes"
	random: remove stale maybe_reseed_primary_crng
	random: remove stale urandom_init_wait
	random: remove variable limit
	random: fix comment for unused random_min_urandom_seed
	random: convert get_random_int/long into get_random_u32/u64
	random: move random_min_urandom_seed into CONFIG_SYSCTL ifdef block
	random: invalidate batched entropy after crng init
	random: silence compiler warnings and fix race
	random: add wait_for_random_bytes() API
	random: add get_random_{bytes,u32,u64,int,long,once}_wait family
	random: warn when kernel uses unseeded randomness
	random: do not ignore early device randomness
	random: suppress spammy warnings about unseeded randomness
	random: reorder READ_ONCE() in get_random_uXX
	random: fix warning message on ia64 and parisc
	random: use a different mixing algorithm for add_device_randomness()
	random: set up the NUMA crng instances after the CRNG is fully initialized
	random: fix possible sleeping allocation from irq context
	random: rate limit unseeded randomness warnings
	random: add a spinlock_t to struct batched_entropy
	char/random: silence a lockdep splat with printk()
	Revert "char/random: silence a lockdep splat with printk()"
	random: always use batched entropy for get_random_u{32,64}
	random: fix data race on crng_node_pool
	crypto: chacha20 - Fix keystream alignment for chacha20_block()
	random: always fill buffer in get_random_bytes_wait
	random: optimize add_interrupt_randomness
	drivers/char/random.c: remove unused dont_count_entropy
	random: Fix whitespace pre random-bytes work
	random: Return nbytes filled from hw RNG
	random: add a config option to trust the CPU's hwrng
	random: remove preempt disabled region
	random: Make crng state queryable
	random: make CPU trust a boot parameter
	drivers/char/random.c: constify poolinfo_table
	drivers/char/random.c: remove unused stuct poolinfo::poolbits
	drivers/char/random.c: make primary_crng static
	random: only read from /dev/random after its pool has received 128 bits
	random: move rand_initialize() earlier
	random: document get_random_int() family
	latent_entropy: avoid build error when plugin cflags are not set
	random: fix soft lockup when trying to read from an uninitialized blocking pool
	random: Support freezable kthreads in add_hwgenerator_randomness()
	fdt: add support for rng-seed
	random: Use wait_event_freezable() in add_hwgenerator_randomness()
	char/random: Add a newline at the end of the file
	Revert "hwrng: core - Freeze khwrng thread during suspend"
	crypto: Deduplicate le32_to_cpu_array() and cpu_to_le32_array()
	crypto: blake2s - generic C library implementation and selftest
	lib/crypto: blake2s: move hmac construction into wireguard
	lib/crypto: sha1: re-roll loops to reduce code size
	random: Don't wake crng_init_wait when crng_init == 1
	random: Add a urandom_read_nowait() for random APIs that don't warn
	random: add GRND_INSECURE to return best-effort non-cryptographic bytes
	random: ignore GRND_RANDOM in getentropy(2)
	random: make /dev/random be almost like /dev/urandom
	random: fix crash on multiple early calls to add_bootloader_randomness()
	random: remove the blocking pool
	random: delete code to pull data into pools
	random: remove kernel.random.read_wakeup_threshold
	random: remove unnecessary unlikely()
	random: convert to ENTROPY_BITS for better code readability
	random: Add and use pr_fmt()
	random: fix typo in add_timer_randomness()
	random: remove some dead code of poolinfo
	random: split primary/secondary crng init paths
	random: avoid warnings for !CONFIG_NUMA builds
	x86: Remove arch_has_random, arch_has_random_seed
	powerpc: Remove arch_has_random, arch_has_random_seed
	linux/random.h: Remove arch_has_random, arch_has_random_seed
	linux/random.h: Use false with bool
	linux/random.h: Mark CONFIG_ARCH_RANDOM functions __must_check
	powerpc: Use bool in archrandom.h
	random: add arch_get_random_*long_early()
	random: avoid arch_get_random_seed_long() when collecting IRQ randomness
	random: remove dead code left over from blocking pool
	MAINTAINERS: co-maintain random.c
	crypto: blake2s - include <linux/bug.h> instead of <asm/bug.h>
	crypto: blake2s - adjust include guard naming
	random: document add_hwgenerator_randomness() with other input functions
	random: remove unused irq_flags argument from add_interrupt_randomness()
	random: use BLAKE2s instead of SHA1 in extraction
	random: do not sign extend bytes for rotation when mixing
	random: do not re-init if crng_reseed completes before primary init
	random: mix bootloader randomness into pool
	random: harmonize "crng init done" messages
	random: use IS_ENABLED(CONFIG_NUMA) instead of ifdefs
	random: initialize ChaCha20 constants with correct endianness
	random: early initialization of ChaCha constants
	random: avoid superfluous call to RDRAND in CRNG extraction
	random: don't reset crng_init_cnt on urandom_read()
	random: fix typo in comments
	random: cleanup poolinfo abstraction
	crypto: chacha20 - Fix chacha20_block() keystream alignment (again)
	random: cleanup integer types
	random: remove incomplete last_data logic
	random: remove unused extract_entropy() reserved argument
	random: try to actively add entropy rather than passively wait for it
	random: rather than entropy_store abstraction, use global
	random: remove unused OUTPUT_POOL constants
	random: de-duplicate INPUT_POOL constants
	random: prepend remaining pool constants with POOL_
	random: cleanup fractional entropy shift constants
	random: access input_pool_data directly rather than through pointer
	random: simplify arithmetic function flow in account()
	random: continually use hwgenerator randomness
	random: access primary_pool directly rather than through pointer
	random: only call crng_finalize_init() for primary_crng
	random: use computational hash for entropy extraction
	random: simplify entropy debiting
	random: use linear min-entropy accumulation crediting
	random: always wake up entropy writers after extraction
	random: make credit_entropy_bits() always safe
	random: remove use_input_pool parameter from crng_reseed()
	random: remove batched entropy locking
	random: fix locking in crng_fast_load()
	random: use RDSEED instead of RDRAND in entropy extraction
	random: inline leaves of rand_initialize()
	random: ensure early RDSEED goes through mixer on init
	random: do not xor RDRAND when writing into /dev/random
	random: absorb fast pool into input pool after fast load
	random: use hash function for crng_slow_load()
	random: remove outdated INT_MAX >> 6 check in urandom_read()
	random: zero buffer after reading entropy from userspace
	random: tie batched entropy generation to base_crng generation
	random: remove ifdef'd out interrupt bench
	random: remove unused tracepoints
	random: add proper SPDX header
	random: deobfuscate irq u32/u64 contributions
	random: introduce drain_entropy() helper to declutter crng_reseed()
	random: remove useless header comment
	random: remove whitespace and reorder includes
	random: group initialization wait functions
	random: group entropy extraction functions
	random: group entropy collection functions
	random: group userspace read/write functions
	random: group sysctl functions
	random: rewrite header introductory comment
	workqueue: make workqueue available early during boot
	random: defer fast pool mixing to worker
	random: do not take pool spinlock at boot
	random: unify early init crng load accounting
	random: check for crng_init == 0 in add_device_randomness()
	hwrng: core - do not use multiple blank lines
	hwrng: core - rewrite better comparison to NULL
	hwrng: core - Rewrite the header
	hwrng: core - Move hwrng miscdev minor number to include/linux/miscdevice.h
	hwrng: core - remove unused PFX macro
	hwrng: use rng source with best quality
	hwrng: remember rng chosen by user
	random: pull add_hwgenerator_randomness() declaration into random.h
	random: clear fast pool, crng, and batches in cpuhp bring up
	random: round-robin registers as ulong, not u32
	random: only wake up writers after zap if threshold was passed
	random: cleanup UUID handling
	random: unify cycles_t and jiffies usage and types
	random: do crng pre-init loading in worker rather than irq
	random: give sysctl_random_min_urandom_seed a more sensible value
	random: don't let 644 read-only sysctls be written to
	random: replace custom notifier chain with standard one
	random: use SipHash as interrupt entropy accumulator
	random: make consistent usage of crng_ready()
	random: reseed more often immediately after booting
	random: check for signal and try earlier when generating entropy
	random: skip fast_init if hwrng provides large chunk of entropy
	random: treat bootloader trust toggle the same way as cpu trust toggle
	random: re-add removed comment about get_random_{u32,u64} reseeding
	random: mix build-time latent entropy into pool at init
	random: do not split fast init input in add_hwgenerator_randomness()
	random: do not allow user to keep crng key around on stack
	random: check for signal_pending() outside of need_resched() check
	random: check for signals every PAGE_SIZE chunk of /dev/[u]random
	random: make random_get_entropy() return an unsigned long
	random: document crng_fast_key_erasure() destination possibility
	random: fix sysctl documentation nits
	init: call time_init() before rand_initialize()
	ia64: define get_cycles macro for arch-override
	s390: define get_cycles macro for arch-override
	parisc: define get_cycles macro for arch-override
	alpha: define get_cycles macro for arch-override
	powerpc: define get_cycles macro for arch-override
	timekeeping: Add raw clock fallback for random_get_entropy()
	m68k: use fallback for random_get_entropy() instead of zero
	mips: use fallback for random_get_entropy() instead of just c0 random
	arm: use fallback for random_get_entropy() instead of zero
	nios2: use fallback for random_get_entropy() instead of zero
	x86/tsc: Use fallback for random_get_entropy() instead of zero
	um: use fallback for random_get_entropy() instead of zero
	sparc: use fallback for random_get_entropy() instead of zero
	xtensa: use fallback for random_get_entropy() instead of zero
	uapi: rename ext2_swab() to swab() and share globally in swab.h
	random: insist on random_get_entropy() existing in order to simplify
	random: do not use batches when !crng_ready()
	random: do not pretend to handle premature next security model
	random: order timer entropy functions below interrupt functions
	random: do not use input pool from hard IRQs
	random: help compiler out with fast_mix() by using simpler arguments
	siphash: use one source of truth for siphash permutations
	random: use symbolic constants for crng_init states
	random: avoid initializing twice in credit race
	random: remove ratelimiting for in-kernel unseeded randomness
	random: use proper jiffies comparison macro
	random: handle latent entropy and command line from random_init()
	random: credit architectural init the exact amount
	random: use static branch for crng_ready()
	random: remove extern from functions in header
	random: use proper return types on get_random_{int,long}_wait()
	random: move initialization functions out of hot pages
	random: move randomize_page() into mm where it belongs
	random: convert to using fops->write_iter()
	random: wire up fops->splice_{read,write}_iter()
	random: check for signals after page of pool writes
	Revert "random: use static branch for crng_ready()"
	crypto: drbg - add FIPS 140-2 CTRNG for noise source
	crypto: drbg - always seeded with SP800-90B compliant noise source
	crypto: drbg - prepare for more fine-grained tracking of seeding state
	crypto: drbg - track whether DRBG was seeded with !rng_is_initialized()
	crypto: drbg - move dynamic ->reseed_threshold adjustments to __drbg_seed()
	crypto: drbg - always try to free Jitter RNG instance
	crypto: drbg - make reseeding from get_random_bytes() synchronous
	random: avoid checking crng_ready() twice in random_init()
	random: mark bootloader randomness code as __init
	random: account for arch randomness in bits
	ASoC: cs42l52: Fix TLV scales for mixer controls
	ASoC: cs53l30: Correct number of volume levels on SX controls
	ASoC: cs42l52: Correct TLV for Bypass Volume
	ASoC: cs42l56: Correct typo in minimum level for SX volume controls
	ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo()
	ASoC: wm8962: Fix suspend while playing music
	scsi: vmw_pvscsi: Expand vcpuHint to 16 bits
	scsi: lpfc: Fix port stuck in bypassed state after LIP in PT2PT topology
	virtio-mmio: fix missing put_device() when vm_cmdline_parent registration failed
	nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred
	ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg
	net: ethernet: mtk_eth_soc: fix misuse of mem alloc interface netdev[napi]_alloc_frag
	random: credit cpu and bootloader seeds by default
	pNFS: Don't keep retrying if the server replied NFS4ERR_LAYOUTUNAVAILABLE
	misc: atmel-ssc: Fix IRQ check in ssc_probe
	irqchip/gic/realview: Fix refcount leak in realview_gic_of_init
	irqchip/gic-v3: Iterate over possible CPUs by for_each_possible_cpu()
	comedi: vmk80xx: fix expression for tx buffer size
	USB: serial: option: add support for Cinterion MV31 with new baseline
	USB: serial: io_ti: add Agilent E5805A support
	usb: gadget: lpc32xx_udc: Fix refcount leak in lpc32xx_udc_probe
	serial: 8250: Store to lsr_save_flags after lsr read
	ext4: fix bug_on ext4_mb_use_inode_pa
	ext4: make variable "count" signed
	ext4: add reserved GDT blocks check
	l2tp: don't use inet_shutdown on ppp session destroy
	l2tp: fix race in pppol2tp_release with session object destroy
	s390/mm: use non-quiescing sske for KVM switch to keyed guest
	xprtrdma: fix incorrect header size calculations
	swiotlb: fix info leak with DMA_FROM_DEVICE
	Reinstate some of "swiotlb: rework "fix info leak with DMA_FROM_DEVICE""
	fuse: fix pipe buffer lifetime for direct_io
	tcp: change source port randomizarion at connect() time
	tcp: add some entropy in __inet_hash_connect()
	secure_seq: use the 64 bits of the siphash for port offset calculation
	tcp: use different parts of the port_offset for index and offset
	tcp: add small random increments to the source port
	tcp: dynamically allocate the perturb table used by source ports
	tcp: increase source port perturb table to 2^16
	tcp: drop the hash_32() part from the index calculation
	Linux 4.9.320

Conflicts:
	crypto/chacha20_generic.c
	drivers/char/random.c
	drivers/of/fdt.c
	include/crypto/chacha20.h
	lib/chacha20.c

Merge resolution notes:
  - Added CHACHA20_KEY_SIZE and CHACHA20_BLOCK_SIZE constants to
    chacha.h, to minimize changes from the 4.9.320 version of random.c

  - Updated lib/vsprintf.c for
    "random: replace custom notifier chain with standard one".

Change-Id: Ia7a12d8883b808f88bbe807d6150552bb084f6b3
Signed-off-by: Eric Biggers <ebiggers@google.com>
2022-06-28 16:46:38 +00:00
Jason A. Donenfeld
47172dad2b random: handle latent entropy and command line from random_init()
commit 2f14062bb14b0fcfcc21e6dc7d5b5c0d25966164 upstream.

Currently, start_kernel() adds latent entropy and the command line to
the entropy bool *after* the RNG has been initialized, deferring when
it's actually used by things like stack canaries until the next time
the pool is seeded. This surely is not intended.

Rather than splitting up which entropy gets added where and when between
start_kernel() and random_init(), just do everything in random_init(),
which should eliminate these kinds of bugs in the future.

While we're at it, rename the awkwardly titled "rand_initialize()" to
the more standard "random_init()" nomenclature.

Reviewed-by: Dominik Brodowski <linux@dominikbrodowski.net>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-25 11:45:15 +02:00
Jason A. Donenfeld
9af95dfaa1 init: call time_init() before rand_initialize()
commit fe222a6ca2d53c38433cba5d3be62a39099e708e upstream.

Currently time_init() is called after rand_initialize(), but
rand_initialize() makes use of the timer on various platforms, and
sometimes this timer needs to be initialized by time_init() first. In
order for random_get_entropy() to not return zero during early boot when
it's potentially used as an entropy source, reverse the order of these
two calls. The block doing random initialization was right before
time_init() before, so changing the order shouldn't have any complicated
effects.

Cc: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Stafford Horne <shorne@gmail.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-25 11:45:12 +02:00
Tejun Heo
ac4bbc0a55 workqueue: make workqueue available early during boot
commit 3347fa0928210d96aaa2bd6cd5a8391d5e630873 upstream.

Workqueue is currently initialized in an early init call; however,
there are cases where early boot code has to be split and reordered to
come after workqueue initialization or the same code path which makes
use of workqueues is used both before workqueue initailization and
after.  The latter cases have to gate workqueue usages with
keventd_up() tests, which is nasty and easy to get wrong.

Workqueue usages have become widespread and it'd be a lot more
convenient if it can be used very early from boot.  This patch splits
workqueue initialization into two steps.  workqueue_init_early() which
sets up the basic data structures so that workqueues can be created
and work items queued, and workqueue_init() which actually brings up
workqueues online and starts executing queued work items.  The former
step can be done very early during boot once memory allocation,
cpumasks and idr are initialized.  The latter right after kthreads
become available.

This allows work item queueing and canceling from very early boot
which is what most of these use cases want.

* As systemd_wq being initialized doesn't indicate that workqueue is
  fully online anymore, update keventd_up() to test wq_online instead.
  The follow-up patches will get rid of all its usages and the
  function itself.

* Flushing doesn't make sense before workqueue is fully initialized.
  The flush functions trigger WARN and return immediately before fully
  online.

* Work items are never in-flight before fully online.  Canceling can
  always succeed by skipping the flush step.

* Some code paths can no longer assume to be called with irq enabled
  as irq is disabled during early boot.  Use irqsave/restore
  operations instead.

v2: Watchdog init, which requires timer to be running, moved from
    workqueue_init_early() to workqueue_init().

Signed-off-by: Tejun Heo <tj@kernel.org>
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Link: http://lkml.kernel.org/r/CA+55aFx0vPuMuxn00rBSM192n-Du5uxy+4AvKa0SBSOVJeuCGg@mail.gmail.com
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-25 11:45:09 +02:00
Kees Cook
166a592cad random: move rand_initialize() earlier
commit d55535232c3dbde9a523a9d10d68670f5fe5dec3 upstream.

Right now rand_initialize() is run as an early_initcall(), but it only
depends on timekeeping_init() (for mixing ktime_get_real() into the
pools). However, the call to boot_init_stack_canary() for stack canary
initialization runs earlier, which triggers a warning at boot:

random: get_random_bytes called from start_kernel+0x357/0x548 with crng_init=0

Instead, this moves rand_initialize() to after timekeeping_init(), and moves
canary initialization here as well.

Note that this warning may still remain for machines that do not have
UEFI RNG support (which initializes the RNG pools during setup_arch()),
or for x86 machines without RDRAND (or booting without "random.trust=on"
or CONFIG_RANDOM_TRUST_CPU=y).

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-25 11:45:01 +02:00
Kees Cook
8f73534689 random: do not ignore early device randomness
commit ee7998c50c2697737c6530431709f77c852bf0d6 upstream.

The add_device_randomness() function would ignore incoming bytes if the
crng wasn't ready.  This additionally makes sure to make an early enough
call to add_latent_entropy() to influence the initial stack canary,
which is especially important on non-x86 systems where it stays the same
through the life of the boot.

Link: http://lkml.kernel.org/r/20170626233038.GA48751@beast
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: "Theodore Ts'o" <tytso@mit.edu>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Jessica Yu <jeyu@redhat.com>
Cc: Steven Rostedt (VMware) <rostedt@goodmis.org>
Cc: Viresh Kumar <viresh.kumar@linaro.org>
Cc: Tejun Heo <tj@kernel.org>
Cc: Prarit Bhargava <prarit@redhat.com>
Cc: Lokesh Vutla <lokeshvutla@ti.com>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: AKASHI Takahiro <takahiro.akashi@linaro.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-25 11:44:58 +02:00
Michael Bestas
43cdebbc57 Merge remote-tracking branch 'common/android-4.9-q' into android-msm-pixel-4.9
* common/android-4.9-q:
  Linux 4.9.312
  block/compat_ioctl: fix range check in BLKGETSIZE
  ext4: force overhead calculation if the s_overhead_cluster makes no sense
  ext4: fix overhead calculation to account for the reserved gdt blocks
  ext4: limit length to bitmap_maxbytes - blocksize in punch_hole
  ARC: entry: fix syscall_trace_exit argument
  e1000e: Fix possible overflow in LTR decoding
  ASoC: soc-dapm: fix two incorrect uses of list iterator
  openvswitch: fix OOB access in reserve_sfa_size()
  dma: at_xdmac: fix a missing check on list iterator
  ata: pata_marvell: Check the 'bmdma_addr' beforing reading
  drm/msm/mdp5: check the return of kzalloc()
  brcmfmac: sdio: Fix undefined behavior due to shift overflowing the constant
  cifs: Check the IOCB_DIRECT flag, not O_DIRECT
  vxlan: fix error return code in vxlan_fdb_append
  ALSA: usb-audio: Fix undefined behavior due to shift overflowing the constant
  platform/x86: samsung-laptop: Fix an unsigned comparison which can never be negative
  ARM: vexpress/spc: Avoid negative array index when !SMP
  netlink: reset network and mac headers in netlink_dump()
  net/packet: fix packet_sock xmit return value checking
  dmaengine: imx-sdma: Fix error checking in sdma_event_remap
  ALSA: usb-audio: Clear MIDI port active flag after draining
  gfs2: assign rgrp glock before compute_bitstructs
  mm: page_alloc: fix building error on -Werror=array-compare
  etherdevice: Adjust ether_addr* prototypes to silence -Wstringop-overead
  Linux 4.9.311
  gcc-plugins: latent_entropy: use /dev/urandom
  i2c: pasemi: Wait for write xfers to finish
  smp: Fix offline cpu check in flush_smp_call_function_queue()
  ARM: davinci: da850-evm: Avoid NULL pointer dereference
  ALSA: pcm: Test for "silence" field in struct "pcm_format_data"
  mm: kmemleak: take a full lowmem check in kmemleak_*_phys()
  mm, page_alloc: fix build_zonerefs_node()
  drivers: net: slip: fix NPD bug in sl_tx_timeout()
  scsi: mvsas: Add PCI ID of RocketRaid 2640
  gpu: ipu-v3: Fix dev_dbg frequency output
  net: micrel: fix KS8851_MLL Kconfig
  scsi: ibmvscsis: Increase INITIAL_SRP_LIMIT to 1024
  drm/amdkfd: Check for potential null return of kmalloc_array()
  cifs: potential buffer overflow in handling symlinks
  nfc: nci: add flush_workqueue to prevent uaf
  net: ethernet: stmmac: fix altr_tse_pcs function when using a fixed-link
  veth: Ensure eth header is in skb's linear part
  xfrm: policy: match with both mark and mask on user interfaces
  arm64: module: remove (NOLOAD) from linker script
  mm: don't skip swap entry even if zap_details specified
  dmaengine: Revert "dmaengine: shdma: Fix runtime PM imbalance on error"
  tools build: Use $(shell ) instead of `` to get embedded libperl's ccopts
  arm64: patch_text: Fixup last cpu should be master
  x86/speculation: Restore speculation related MSRs during S3 resume
  x86/pm: Save the MSR validity status at context setup
  mm/mempolicy: fix mpol_new leak in shared_policy_replace
  mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0)
  drbd: Fix five use after free bugs in get_initial_state
  drm/imx: Fix memory leak in imx_pd_connector_get_modes
  net: stmmac: Fix unset max_speed difference between DT and non-DT platforms
  scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
  mm: fix race between MADV_FREE reclaim and blkdev direct IO read
  jfs: prevent NULL deref in diFree
  virtio_console: eliminate anonymous module_init & module_exit
  serial: samsung_tty: do not unlock port->lock for uart_write_wakeup()
  SUNRPC/call_alloc: async tasks mustn't block waiting for memory
  w1: w1_therm: fixes w1_seq for ds28ea00 sensors
  init/main.c: return 1 from handled __setup() functions
  Bluetooth: Fix use after free in hci_send_acl
  xtensa: fix DTC warning unit_address_format
  usb: dwc3: omap: fix "unbalanced disables for smps10_out1" on omap5evm
  scsi: libfc: Fix use after free in fc_exch_abts_resp()
  MIPS: fix fortify panic when copying asm exception handlers
  bnxt_en: Eliminate unintended link toggle during FW reset
  scsi: aha152x: Fix aha152x_setup() __setup handler return value
  scsi: pm8001: Fix pm8001_mpi_task_abort_resp()
  dm ioctl: prevent potential spectre v1 gadget
  iommu/arm-smmu-v3: fix event handling soft lockup
  scsi: bfa: Replace snprintf() with sysfs_emit()
  scsi: mvsas: Replace snprintf() with sysfs_emit()
  powerpc: dts: t104xrdb: fix phy type for FMAN 4/5
  ptp: replace snprintf with sysfs_emit
  ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
  KVM: x86/svm: Clear reserved bits written to PerfEvtSeln MSRs
  ARM: 9187/1: JIVE: fix return value of __setup handler
  rtc: wm8350: Handle error for wm8350_register_irq
  KVM: x86: Forbid VMM to set SYNIC/STIMER MSRs when SynIC wasn't activated
  openvswitch: Fixed nd target mask field in the flow dump.
  ARM: dts: spear13xx: Update SPI dma properties
  ARM: dts: spear1340: Update serial node properties
  ASoC: topology: Allow TLV control to be either read or write
  ubi: fastmap: Return error code if memory allocation fails in add_aeb()
  mm/memcontrol: return 1 from cgroup.memory __setup() handler
  mm/mmap: return 1 from stack_guard_gap __setup() handler
  ACPI: CPPC: Avoid out of bounds access when parsing _CPC data
  pinctrl: pinconf-generic: Print arguments for bias-pull-*
  gfs2: Make sure FITRIM minlen is rounded up to fs block size
  ubifs: setflags: Make dirtied_ino_d 8 bytes aligned
  ubifs: Add missing iput if do_tmpfile() failed in rename whiteout
  KVM: Prevent module exit until all VMs are freed
  scsi: qla2xxx: Fix incorrect reporting of task management failure
  mmc: host: Return an error when ->enable_sdio_irq() ops is missing
  media: hdpvr: initialize dev->worker at hdpvr_register_videodev
  video: fbdev: sm712fb: Fix crash in smtcfb_write()
  ARM: mmp: Fix failure to remove sram device
  ARM: tegra: tamonten: Fix I2C3 pad setting
  media: cx88-mpeg: clear interrupt status register before streaming video
  ASoC: soc-core: skip zero num_dai component in searching dai name
  video: fbdev: omapfb: panel-tpo-td043mtea1: Use sysfs_emit() instead of snprintf()
  video: fbdev: omapfb: panel-dsi-cm: Use sysfs_emit() instead of snprintf()
  ARM: dts: bcm2837: Add the missing L1/L2 cache information
  ARM: dts: qcom: fix gic_irq_domain_translate warnings for msm8960
  video: fbdev: omapfb: acx565akm: replace snprintf with sysfs_emit
  video: fbdev: cirrusfb: check pixclock to avoid divide by zero
  video: fbdev: w100fb: Reset global state
  video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow
  ntfs: add sanity check on allocation size
  ext4: don't BUG if someone dirty pages without asking ext4 first
  spi: tegra20: Use of_device_get_match_data()
  PM: core: keep irq flags in device_pm_check_callbacks()
  ACPI/APEI: Limit printable size of BERT table data
  ACPICA: Avoid walking the ACPI Namespace if it is not there
  irqchip/nvic: Release nvic_base upon failure
  Fix incorrect type in assignment of ipv6 port for audit
  loop: use sysfs_emit() in the sysfs xxx show()
  selinux: use correct type for context length
  net/x25: Fix null-ptr-deref caused by x25_disconnect
  qlcnic: dcb: default to returning -EOPNOTSUPP
  net: phy: broadcom: Fix brcm_fet_config_init()
  netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options
  jfs: fix divide error in dbNextAG
  kgdbts: fix return value of __setup handler
  kgdboc: fix return value of __setup handler
  tty: hvc: fix return value of __setup handler
  pinctrl/rockchip: Add missing of_node_put() in rockchip_pinctrl_probe
  pinctrl: nomadik: Add missing of_node_put() in nmk_pinctrl_probe
  pinctrl: mediatek: Fix missing of_node_put() in mtk_pctrl_init
  NFS: remove unneeded check in decode_devicenotify_args()
  clk: tegra: tegra124-emc: Fix missing put_device() call in emc_ensure_emc_driver
  clk: clps711x: Terminate clk_div_table with sentinel element
  clk: loongson1: Terminate clk_div_table with sentinel element
  remoteproc: qcom_wcnss: Add missing of_node_put() in wcnss_alloc_memory_region
  clk: qcom: clk-rcg2: Update the frac table for pixel clock
  iio: adc: Add check for devm_request_threaded_irq
  pwm: lpc18xx-sct: Initialize driver data and hardware before pwmchip_add()
  mxser: fix xmit_buf leak in activate when LSR == 0xff
  mfd: asic3: Add missing iounmap() on error asic3_mfd_probe
  i2c: mux: demux-pinctrl: do not deactivate a master that is not active
  af_netlink: Fix shift out of bounds in group mask calculation
  USB: storage: ums-realtek: fix error code in rts51x_read_mem()
  MIPS: RB532: fix return value of __setup handler
  mfd: mc13xxx: Add check for mc13xxx_irq_request
  powerpc/sysdev: fix incorrect use to determine if list is empty
  power: supply: wm8350-power: Add missing free in free_charger_irq
  power: supply: wm8350-power: Handle error for wm8350_register_irq
  i2c: xiic: Make bus names unique
  KVM: x86/emulator: Defer not-present segment check in __load_segment_descriptor()
  KVM: x86: Fix emulation in writing cr8
  drm/tegra: Fix reference leak in tegra_dsi_ganged_probe
  ext2: correct max file size computing
  TOMOYO: fix __setup handlers return values
  scsi: pm8001: Fix abort all task initialization
  scsi: pm8001: Fix payload initialization in pm80xx_set_thermal_config()
  scsi: pm8001: Fix command initialization in pm8001_chip_ssp_tm_req()
  scsi: pm8001: Fix command initialization in pm80XX_send_read_log()
  iwlwifi: Fix -EIO error code that is never returned
  HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports
  power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init
  ray_cs: Check ioremap return value
  ath9k_htc: fix uninit value bugs
  drm/edid: Don't clear formats if using deep color
  mtd: onenand: Check for error irq
  ASoC: imx-es8328: Fix error return code in imx_es8328_probe()
  ASoC: mxs: Fix error handling in mxs_sgtl5000_probe
  ASoC: dmaengine: do not use a NULL prepare_slave_config() callback
  video: fbdev: omapfb: Add missing of_node_put() in dvic_probe_of
  ASoC: fsi: Add check for clk_enable
  ASoC: wm8350: Handle error for wm8350_register_irq
  ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe
  ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction
  memory: emif: check the pointer temp in get_device_details()
  memory: emif: Add check for setup_interrupts
  ASoC: atmel_ssc_dai: Handle errors for clk_enable
  ASoC: mxs-saif: Handle errors for clk_enable
  printk: fix return value of printk.devkmsg __setup handler
  arm64: dts: broadcom: Fix sata nodename
  arm64: dts: ns2: Fix spi-cpol and spi-cpha property
  ALSA: spi: Add check for clk_enable()
  ASoC: ti: davinci-i2s: Add check for clk_enable()
  media: usb: go7007: s2250-board: fix leak in probe()
  soc: ti: wkup_m3_ipc: Fix IRQ check in wkup_m3_ipc_probe
  ARM: dts: qcom: ipq4019: fix sleep clock
  video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name()
  video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe()
  perf/x86/intel/pt: Fix address filter config for 32-bit kernel
  perf/core: Fix address filter parser for multiple filters
  sched/debug: Remove mpol_get/put and task_lock/unlock from sched_show_numa
  clocksource: acpi_pm: fix return value of __setup handler
  hwmon: (pmbus) Add Vin unit off handling
  crypto: ccp - ccp_dmaengine_unregister release dma channels
  crypto: vmx - add missing dependencies
  PM: suspend: fix return value of __setup handler
  PM: hibernate: fix __setup handler error handling
  hwmon: (sch56xx-common) Replace WDOG_ACTIVE with WDOG_HW_RUNNING
  hwmon: (pmbus) Add mutex to regulator ops
  selftests/x86: Add validity check and allow field splitting
  spi: tegra114: Add missing IRQ check in tegra_spi_probe
  crypto: mxs-dcp - Fix scatterlist processing
  crypto: authenc - Fix sleep in atomic context in decrypt_tail
  PCI: pciehp: Clear cmd_busy bit in polling mode
  brcmfmac: pcie: Replace brcmf_pcie_copy_mem_todev with memcpy_toio
  brcmfmac: firmware: Allocate space for default boardrev in nvram
  media: davinci: vpif: fix unbalanced runtime PM get
  DEC: Limit PMAX memory probing to R3k systems
  lib/raid6/test: fix multiple definition linking error
  thermal: int340x: Increase bitmap size
  carl9170: fix missing bit-wise or operator for tx_params
  ARM: dts: exynos: add missing HDMI supplies on SMDK5420
  ARM: dts: exynos: add missing HDMI supplies on SMDK5250
  ARM: dts: exynos: fix UART3 pins configuration in Exynos5250
  video: fbdev: atari: Atari 2 bpp (STe) palette bugfix
  video: fbdev: sm712fb: Fix crash in smtcfb_read()
  drivers: hamradio: 6pack: fix UAF bug caused by mod_timer()
  ALSA: cs4236: fix an incorrect NULL check on list iterator
  Revert "Input: clear BTN_RIGHT/MIDDLE on buttonpads"
  scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands
  mempolicy: mbind_range() set_policy() after vma_merge()
  mm/pages_alloc.c: don't create ZONE_MOVABLE beyond the end of a node
  jffs2: fix memory leak in jffs2_scan_medium
  jffs2: fix memory leak in jffs2_do_mount_fs
  jffs2: fix use-after-free in jffs2_clear_xattr_subsystem
  can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path
  NFSD: prevent underflow in nfssvc_decode_writeargs()
  SUNRPC: avoid race between mod_timer() and del_timer_sync()
  ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE
  clk: uniphier: Fix fixed-rate initialization
  iio: inkern: make a best effort on offset calculation
  iio: inkern: apply consumer scale on IIO_VAL_INT cases
  coresight: Fix TRCCONFIGR.QE sysfs interface
  USB: usb-storage: Fix use of bitfields for hardware data in ene_ub6250.c
  virtio-blk: Use blk_validate_block_size() to validate block size
  block: Add a helper to validate the block size
  af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register
  ethernet: sun: Free the coherent when failing in probing
  virtio_console: break out of buf poll on remove
  netdevice: add the case if dev is NULL
  USB: serial: simple: add Nokia phone driver
  USB: serial: pl2303: add IBM device IDs
  Linux 4.9.310
  arm64: Use the clearbhb instruction in mitigations
  arm64: add ID_AA64ISAR2_EL1 sys register
  KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and migrated
  arm64: Mitigate spectre style branch history side channels
  KVM: arm64: Add templates for BHB mitigation sequences
  arm64: Add percpu vectors for EL1
  arm64: entry: Add macro for reading symbol addresses from the trampoline
  arm64: entry: Add vectors that have the bhb mitigation sequences
  arm64: Move arm64_update_smccc_conduit() out of SSBD ifdef
  arm64: entry: Add non-kpti __bp_harden_el1_vectors for mitigations
  arm64: entry: Allow the trampoline text to occupy multiple pages
  arm64: entry: Make the kpti trampoline's kpti sequence optional
  arm64: entry: Move trampoline macros out of ifdef'd section
  arm64: entry: Don't assume tramp_vectors is the start of the vectors
  arm64: entry: Allow tramp_alias to access symbols after the 4K boundary
  arm64: entry: Move the trampoline data page before the text page
  arm64: entry: Free up another register on kpti's tramp_exit path
  arm64: entry: Make the trampoline cleanup optional
  arm64: entry.S: Add ventry overflow sanity checks
  arm64: Add helper to decode register from instruction
  arm64: Add Cortex-X2 CPU part definition
  arm64: Add Neoverse-N2, Cortex-A710 CPU part definition
  arm64: Add part number for Arm Cortex-A77
  arm64: Add part number for Neoverse N1
  arm64: Make ARM64_ERRATUM_1188873 depend on COMPAT
  arm64: Add silicon-errata.txt entry for ARM erratum 1188873
  arm64: arch_timer: avoid unused function warning
  arm64: arch_timer: Add workaround for ARM erratum 1188873
  arm64: arch_timer: Add erratum handler for CPU-specific capability
  arm64: arch_timer: Add infrastructure for multiple erratum detection methods
  clocksource/drivers/arm_arch_timer: Introduce generic errata handling infrastructure
  clocksource/drivers/arm_arch_timer: Remove fsl-a008585 parameter
  arm64: capabilities: Add support for checks based on a list of MIDRs
  arm64: Add helpers for checking CPU MIDR against a range
  arm64: capabilities: Clean up midr range helpers
  arm64: capabilities: Add flags to handle the conflicts on late CPU
  arm64: capabilities: Prepare for fine grained capabilities
  arm64: capabilities: Move errata processing code
  arm64: capabilities: Move errata work around check on boot CPU
  arm64: capabilities: Update prototype for enable call back
  arm64: Add MIDR encoding for Arm Cortex-A55 and Cortex-A35
  arm64: Remove useless UAO IPI and describe how this gets enabled
  arm64: errata: Provide macro for major and minor cpu revisions
  Linux 4.9.309
  llc: only change llc->dev when bind() succeeds
  mac80211: fix potential double free on mesh join
  crypto: qat - disable registration of algorithms
  ACPI: video: Force backlight native for Clevo NL5xRU and NL5xNU
  ACPI: battery: Add device HID and quirk for Microsoft Surface Go 3
  ACPI / x86: Work around broken XSDT on Advantech DAC-BJ01 board
  netfilter: nf_tables: initialize registers in nft_do_chain()
  ALSA: pci: fix reading of swapped values from pcmreg in AC97 codec
  ALSA: cmipci: Restore aux vol on suspend/resume
  ALSA: usb-audio: Add mute TLV for playback volumes on RODE NT-USB
  ALSA: pcm: Add stream lock during PCM reset ioctl operations
  llc: fix netdevice reference leaks in llc_ui_bind()
  staging: fbtft: fb_st7789v: reset display before initialization
  net: ipv6: fix skb_over_panic in __ip6_append_data
  nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION
  Linux 4.9.308
  Input: aiptek - properly check endpoint type
  usb: gadget: Fix use-after-free bug by not setting udc->dev.driver
  usb: gadget: rndis: prevent integer overflow in rndis_set_response()
  atm: eni: Add check for dma_map_single
  net/packet: fix slab-out-of-bounds access in packet_recvmsg()
  fs: sysfs_emit: Remove PAGE_SIZE alignment check
  kselftest/vm: fix tests build with old libc
  sfc: extend the locking on mcdi->seqno
  tcp: make tcp_read_sock() more robust
  nl80211: Update bss channel on channel switch for P2P_CLIENT
  atm: firestream: check the return value of ioremap() in fs_init()
  can: rcar_canfd: rcar_canfd_channel_probe(): register the CAN device when fully ready
  ARM: 9178/1: fix unmet dependency on BITREVERSE for HAVE_ARCH_BITREVERSE
  MIPS: smp: fill in sibling and core maps earlier
  ARM: dts: rockchip: fix a typo on rk3288 crypto-controller
  xfrm: Fix xfrm migrate issues when address family changes
  Linux 4.9.307
  btrfs: unlock newly allocated extent buffer after error
  ARM: fix Thumb2 regression with Spectre BHB
  batman-adv: Don't expect inter-netns unique iflink indices
  batman-adv: Request iflink once in batadv-on-batadv check
  staging: gdm724x: fix use after free in gdm_lte_rx()
  ARM: Spectre-BHB: provide empty stub for non-config
  selftests/memfd: clean up mapping in mfd_fail_write
  tracing: Ensure trace buffer is at least 4096 bytes large
  Revert "xen-netback: Check for hotplug-status existence before watching"
  net-sysfs: add check for netdevice being present to speed_show
  sctp: fix kernel-infoleak for SCTP sockets
  gpio: ts4900: Do not set DAT and OE together
  NFC: port100: fix use-after-free in port100_send_complete
  net/mlx5: Fix size field in bufferx_reg struct
  ax25: Fix NULL pointer dereference in ax25_kill_by_device
  net: ethernet: lpc_eth: Handle error for clk_enable
  ethernet: Fix error handling in xemaclite_of_probe
  qed: return status of qed_iov_get_link
  net: qlogic: check the return value of dma_alloc_coherent() in qed_vf_hw_prepare()
  Linux 4.9.306
  xen/netfront: react properly to failing gnttab_end_foreign_access_ref()
  xen/gnttab: fix gnttab_end_foreign_access() without page specified
  xen: remove gnttab_query_foreign_access()
  xen/gntalloc: don't use gnttab_query_foreign_access()
  xen/scsifront: don't use gnttab_query_foreign_access() for mapped status
  xen/netfront: don't use gnttab_query_foreign_access() for mapped status
  xen/blkfront: don't use gnttab_query_foreign_access() for mapped status
  xen/grant-table: add gnttab_try_end_foreign_access()
  xen/xenbus: don't let xenbus_grant_ring() remove grants in error case
  ARM: fix build warning in proc-v7-bugs.c
  x86, modpost: Replace last remnants of RETPOLINE with CONFIG_RETPOLINE
  x86/build: Fix compiler support check for CONFIG_RETPOLINE
  ARM: Do not use NOCROSSREFS directive with ld.lld
  ARM: fix co-processor register typo
  ARM: fix build error when BPF_SYSCALL is disabled
  ARM: include unprivileged BPF status in Spectre V2 reporting
  ARM: Spectre-BHB workaround
  ARM: use LOADADDR() to get load address of sections
  ARM: early traps initialisation
  ARM: report Spectre v2 status through sysfs
  arm/arm64: smccc/psci: add arm_smccc_1_1_get_conduit()
  arm/arm64: Provide a wrapper for SMCCC 1.1 calls
  x86/speculation: Warn about eIBRS + LFENCE + Unprivileged eBPF + SMT
  x86/speculation: Warn about Spectre v2 LFENCE mitigation
  x86/speculation: Update link to AMD speculation whitepaper
  x86/speculation: Use generic retpoline by default on AMD
  x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting
  Documentation/hw-vuln: Update spectre doc
  x86/speculation: Add eIBRS + Retpoline options
  x86/speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE
  x86,bugs: Unconditionally allow spectre_v2=retpoline,amd
  x86/speculation: Merge one test in spectre_v2_user_select_mitigation()
  Documentation: refer to config RANDOMIZE_BASE for kernel address-space randomization
  Documentation: Add swapgs description to the Spectre v1 documentation
  Documentation: Add section about CPU vulnerabilities for Spectre
  x86/retpoline: Remove minimal retpoline support
  x86/retpoline: Make CONFIG_RETPOLINE depend on compiler support
  x86/speculation: Add RETPOLINE_AMD support to the inline asm CALL_NOSPEC variant
  Linux 4.9.305
  hamradio: fix macro redefine warning
  net: dcb: disable softirqs in dcbnl_flush_dev()
  memfd: fix F_SEAL_WRITE after shmem huge page allocated
  HID: add mapping for KEY_ALL_APPLICATIONS
  Input: elan_i2c - fix regulator enable count imbalance after suspend/resume
  Input: elan_i2c - move regulator_[en|dis]able() out of elan_[en|dis]able_power()
  net: chelsio: cxgb3: check the return value of pci_find_capability()
  soc: fsl: qe: Check of ioremap return value
  ARM: 9182/1: mmu: fix returns from early_param() and __setup() functions
  can: gs_usb: change active_channels's type from atomic_t to u8
  efivars: Respect "block" flag in efivar_entry_set_safe()
  net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe()
  net: sxgbe: fix return value of __setup handler
  net: stmmac: fix return value of __setup handler
  mac80211: fix forwarded mesh frames AC & queue selection
  firmware: qemu_fw_cfg: fix kobject leak in probe error path
  firmware: Fix a reference count leak.
  net: dcb: flush lingering app table entries for unregistered devices
  netfilter: nf_queue: fix possible use-after-free
  netfilter: nf_queue: don't assume sk is full socket
  xfrm: fix MTU regression
  ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min
  ata: pata_hpt37x: fix PCI clock detection
  usb: gadget: clear related members when goto fail
  usb: gadget: don't release an existing dev->buf
  net: usb: cdc_mbim: avoid altsetting toggling for Telit FN990
  i2c: qup: allow COMPILE_TEST
  dmaengine: shdma: Fix runtime PM imbalance on error
  cifs: fix double free race when mount fails in cifs_get_root()
  Input: clear BTN_RIGHT/MIDDLE on buttonpads
  i2c: bcm2835: Avoid clock stretching timeouts
  mac80211_hwsim: initialize ieee80211_tx_info at hw_scan_work
  mac80211_hwsim: report NOACK frames in tx_status
  Linux 4.9.304
  fget: clarify and improve __fget_files() implementation
  memblock: use kfree() to release kmalloced memblock regions
  tty: n_gsm: fix proper link termination after failed open
  tty: n_gsm: fix encoding of control signal octet bit DV
  xhci: Prevent futile URB re-submissions due to incorrect return value.
  usb: dwc3: gadget: Let the interrupt handler disable bottom halves.
  USB: serial: option: add Telit LE910R1 compositions
  USB: serial: option: add support for DW5829e
  tracefs: Set the group ownership in apply_options() not parse_options()
  USB: gadget: validate endpoint index for xilinx udc
  usb: gadget: rndis: add spinlock for rndis response list
  Revert "USB: serial: ch341: add new Product ID for CH341A"
  ata: pata_hpt37x: disable primary channel on HPT371
  iio: adc: men_z188_adc: Fix a resource leak in an error handling path
  RDMA/ib_srp: Fix a deadlock
  configfs: fix a race in configfs_{,un}register_subsystem()
  net/mlx5e: Fix wrong return value on ioctl EEPROM query failure
  drm/edid: Always set RGB444
  openvswitch: Fix setting ipv6 fields causing hw csum failure
  gso: do not skip outer ip header in case of ipip and net_failover
  net: __pskb_pull_tail() & pskb_carve_frag_list() drop_monitor friends
  serial: 8250: of: Fix mapped region size when using reg-offset property
  serial: 8250: fix error handling in of_platform_serial_probe()
  USB: zaurus: support another broken Zaurus
  sr9700: sanity check for packet length
  parisc/unaligned: Fix ldw() and stw() unalignment handlers
  parisc/unaligned: Fix fldd and fstd unaligned handlers on 32-bit kernel
  vhost/vsock: don't check owner in vhost_vsock_stop() while releasing
  mtd: rawnand: brcmnand: Fixed incorrect sub-page ECC status
  Linux 4.9.303
  net: usb: qmi_wwan: Add support for Dell DW5829e
  tracing: Fix tp_printk option related with tp_printk_stop_on_boot
  ata: libata-core: Disable TRIM on M88V29
  NFS: Do not report writeback errors in nfs_getattr()
  KVM: x86/pmu: Use AMD64_RAW_EVENT_MASK for PERF_TYPE_RAW
  lib/iov_iter: initialize "flags" in new pipe_buffer
  i2c: brcmstb: fix support for DSL and CM variants
  EDAC: Fix calculation of returned address and next offset in edac_align_ptr()
  NFS: LOOKUP_DIRECTORY is also ok with symlinks
  ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw_range()
  ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw()
  ALSA: hda: Fix missing codec probe on Shenker Dock 15
  ALSA: hda: Fix regression on forced probe mask option
  libsubcmd: Fix use-after-free for realloc(..., 0)
  drop_monitor: fix data-race in dropmon_net_event / trace_napi_poll_hit
  iwlwifi: pcie: fix locking when "HW not ready"
  vsock: remove vsock from connected table when connect is interrupted by a signal
  vsock: correct removal of socket from the list
  taskstats: Cleanup the use of task->exit_code
  xfrm: Don't accidentally set RTO_ONLINK in decode_session4()
  drm/radeon: Fix backlight control on iMac 12,1
  quota: make dquot_quota_sync return errors from ->sync_fs
  vfs: make freeze_super abort when sync_filesystem returns error
  ax25: improve the incomplete fix to avoid UAF and NPD bugs
  selftests/zram: Adapt the situation that /dev/zram0 is being used
  selftests/zram01.sh: Fix compression ratio calculation
  selftests/zram: Skip max_comp_streams interface on newer kernel
  net: ieee802154: at86rf230: Stop leaking skb's
  btrfs: send: in case of IO error log it
  parisc: Fix sglist access in ccio-dma.c
  parisc: Fix data TLB miss in sba_unmap_sg
  serial: parisc: GSC: fix build when IOSAPIC is not set
  net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup
  Makefile.extrawarn: Move -Wunaligned-access to W=1
  UPSTREAM: net: fix skb_panic to output real address
  UPSTREAM: xfrm: Make function xfrmi_get_link_net() static
  UPSTREAM: xfrm: fix gro_cells leak when remove virtual xfrm interfaces
  UPSTREAM: xfrm interface: fix memory leak on creation
  UPSTREAM: xfrm: clone XFRMA_SET_MARK in xfrm_do_migrate
  UPSTREAM: xfrm/compat: Translate by copying XFRMA_UNSPEC attribute
  UPSTREAM: xfrm/compat: memset(0) 64-bit padding at right place
  UPSTREAM: xfrm/compat: Don't allocate memory with __GFP_ZERO
  UPSTREAM: xfrm/compat: Cleanup WARN()s that can be user-triggered
  UPSTREAM: net: xfrm: fix memory leak in xfrm_user_rcv_msg
  UPSTREAM: arm64/vdso: don't leak kernel addresses
  UPSTREAM: tracing: make PREEMPTIRQ_EVENTS depend on TRACING
  UPSTREAM: trace_uprobe: Use %lx to display offset
  UPSTREAM: kprobes: Fix random address output of blacklist file
  UPSTREAM: mm/huge_memory.c: __split_huge_page() use atomic ClearPageDirty()
  UPSTREAM: x86/realmode: Don't leak the trampoline kernel address
  UPSTREAM: bpf: bpf_prog_array_alloc() should return a generic non-rcu pointer
  UPSTREAM: bpf: fix rcu annotations in compute_effective_progs()
  UPSTREAM: optee: add writeback to valid memory type
  UPSTREAM: lib/test_printf.c: accept "ptrval" as valid result for plain 'p' tests
  UPSTREAM: kdb: use correct pointer when 'btc' calls 'btt'
  UPSTREAM: kdb: print real address of pointers instead of hashed addresses
  UPSTREAM: powerpc/traps: Fix the message printed when stack overflows
  UPSTREAM: f2fs: should use GFP_NOFS for directory inodes
  UPSTREAM: zram: off by one in read_block_state()
  UPSTREAM: tee: fix put order in teedev_close_context()
  UPSTREAM: vsprintf: Replace memory barrier with static_key for random_ptr_key update
  UPSTREAM: ARM: 8896/1: VDSO: Don't leak kernel addresses
  UPSTREAM: parisc: Show unhashed hardware inventory
  UPSTREAM: parisc: Show initial kernel memory layout unhashed
  UPSTREAM: parisc: Show unhashed HPA of Dino chip
  UPSTREAM: parisc: Show unhashed EISA EEPROM address
  UPSTREAM: HID: input: throttle battery uevents
  UPSTREAM: HID: steam: select CONFIG_POWER_SUPPLY
  UPSTREAM: HID: sony: Fix for broken buttons on DS3 USB dongles
  UPSTREAM: HID: input: do not report stylus battery state as "full"
  Linux 4.9.302
  HID: wacom: add USB_HID dependency
  hwmon: (dell-smm) Speed up setting of fan speed
  USB: serial: cp210x: add CPI Bulk Coin Recycler id
  USB: serial: cp210x: add NCR Retail IO box id
  USB: serial: ch341: add support for GW Instek USB2.0-Serial devices
  USB: serial: option: add ZTE MF286D modem
  USB: serial: ftdi_sio: add support for Brainboxes US-159/235/320
  usb: gadget: rndis: check size of RNDIS_MSG_SET command
  USB: gadget: validate interface OS descriptor requests
  usb: dwc3: gadget: Prevent core from processing stale TRBs
  n_tty: wake up poll(POLLRDNORM) on receiving data
  bpf: Add kconfig knob for disabling unpriv bpf by default
  vt_ioctl: add array_index_nospec to VT_ACTIVATE
  vt_ioctl: fix array_index_nospec in vt_setactivate
  tipc: rate limit warning for received illegal binding update
  net: fix a memleak when uncloning an skb dst and its metadata
  net: do not keep the dst cache when uncloning an skb dst and its metadata
  ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path
  bonding: pair enable_port with slave_arr_updates
  ARM: dts: imx6qdl-udoo: Properly describe the SD card detect
  staging: fbtft: Fix error path in fbtft_driver_module_init()
  ARM: dts: imx23-evk: Remove MX23_PAD_SSP1_DETECT from hog group
  usb: dwc2: gadget: don't try to disable ep0 in dwc2_hsotg_suspend
  scsi: target: iscsi: Make sure the np under each tpg is unique
  NFSv4 remove zero number of fs_locations entries error check
  nfs: nfs4clinet: check the return value of kstrdup()
  NFSv4 only print the label when its queried
  Revert "net: axienet: Wait for PhyRstCmplt after core reset"
  ALSA: line6: Fix misplaced backport of "Fix wrong altsetting for LINE6_PODHD500_1"
  serial: sh-sci: Fix misplaced backport of "Fix late enablement of AUTORTS"
  Input: i8042 - Fix misplaced backport of "add ASUS Zenbook Flip to noselftest list"
  NFSD: Clamp WRITE offsets
  NFS: Fix initialisation of nfs_client cl_flags field
  ima: Remove ima_policy file before directory
  integrity: check the return value of audit_log_start()
  Revert "tracefs: Have tracefs directories not set OTH permission bits by default"
  Linux 4.9.301
  tipc: improve size validations for received domain records
  moxart: fix potential use-after-free on remove path
  cgroup-v1: Require capabilities to set release_agent
  Linux 4.9.300
  ext4: fix error handling in ext4_restore_inline_data()
  EDAC/xgene: Fix deferred probing
  EDAC/altera: Fix deferred probing
  rtc: cmos: Evaluate century appropriate
  nfsd: nfsd4_setclientid_confirm mistakenly expires confirmed client.
  scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe
  ASoC: fsl: Add missing error handling in pcm030_fabric_probe
  net: macsec: Verify that send_sci is on when setting Tx sci explicitly
  net: ieee802154: Return meaningful error codes from the netlink helpers
  spi: mediatek: Avoid NULL pointer crash in interrupt
  spi: bcm-qspi: check for valid cs before applying chip select
  iommu/amd: Fix loop timeout issue in iommu_ga_log_enable()
  drm/nouveau: fix off by one in BIOS boundary checking
  ASoC: ops: Reject out of bounds values in snd_soc_put_xr_sx()
  ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx()
  ASoC: ops: Reject out of bounds values in snd_soc_put_volsw()
  af_packet: fix data-race in packet_setsockopt / packet_setsockopt
  rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink()
  net: amd-xgbe: Fix skb data length underflow
  net: amd-xgbe: ensure to reset the tx_timer_active flag
  ipheth: fix EOVERFLOW in ipheth_rcvbulk_callback
  netfilter: nat: limit port clash resolution attempts
  netfilter: nat: remove l4 protocol port rovers
  ipv4: tcp: send zero IPID in SYNACK messages
  ipv4: raw: lock the socket in raw_bind()
  hwmon: (lm90) Reduce maximum conversion rate for G781
  drm/msm: Fix wrong size calculation
  net-procfs: show net devices bound packet types
  NFSv4: nfs_atomic_open() can race when looking up a non-regular file
  NFSv4: Handle case where the lookup of a directory fails
  ipv4: avoid using shared IP generator for connected sockets
  net: fix information leakage in /proc/net/ptype
  ipv6_tunnel: Rate limit warning messages
  scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put()
  powerpc/32: Fix boot failure with GCC latent entropy plugin
  USB: core: Fix hang in usb_kill_urb by adding memory barriers
  usb: gadget: f_sourcesink: Fix isoc transfer for USB_SPEED_SUPER_PLUS
  usb-storage: Add unusual-devs entry for VL817 USB-SATA bridge
  tty: Add support for Brainboxes UC cards.
  tty: n_gsm: fix SW flow control encoding/handling
  serial: stm32: fix software flow control transfer
  PM: wakeup: simplify the output logic of pm_show_wakelocks()
  udf: Fix NULL ptr deref when converting from inline format
  udf: Restore i_lenAlloc when inode expansion fails
  scsi: zfcp: Fix failed recovery on gone remote port with non-NPIV FCP devices
  s390/hypfs: include z/VM guests with access control group set
  Bluetooth: refactor malicious adv data check
  can: bcm: fix UAF of bcm op
  BACKPORT: ipv6: Implement draft-ietf-6man-rfc4941bis
  Linux 4.9.299
  ion: Do not 'put' ION handle until after its final use
  ion: Protect kref from userspace manipulation
  ion: Fix use after free during ION_IOC_ALLOC
  ARM: 8800/1: use choice for kernel unwinders
  KVM: X86: MMU: Use the correct inherited permissions to get shadow page
  KVM: nVMX: fix EPT permissions as reported in exit qualification
  NFSv4: Initialise connection to the server in nfs4_alloc_client()
  media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt()
  drm/i915: Flush TLBs before releasing backing store
  Linux 4.9.298
  KVM: do not allow mapping valid but non-reference-counted pages
  KVM: Use kvm_pfn_t for local PFN variable in hva_to_pfn_remapped()
  KVM: do not assume PTE is writable after follow_pfn
  mm: add follow_pte_pmd()
  lib/timerqueue: Rely on rbtree semantics for next timer
  rbtree: cache leftmost node internally
  cipso,calipso: resolve a number of problems with the DOI refcounts
  gianfar: fix jumbo packets+napi+rx overrun crash
  gianfar: simplify FCS handling and fix memory leak
  drm/ttm/nouveau: don't call tt destroy callback on alloc failure.
  gup: document and work around "COW can break either way" issue
  Revert "gup: document and work around "COW can break either way" issue"
  lib82596: Fix IRQ check in sni_82596_probe
  scripts/dtc: dtx_diff: remove broken example from help text
  bcmgenet: add WOL IRQ check
  net_sched: restore "mpu xxx" handling
  dmaengine: at_xdmac: Fix at_xdmac_lld struct definition
  dmaengine: at_xdmac: Fix lld view setting
  dmaengine: at_xdmac: Print debug message after realeasing the lock
  dmaengine: at_xdmac: Don't start transactions at tx_submit level
  libcxgb: Don't accidentally set RTO_ONLINK in cxgb_find_route()
  netns: add schedule point in ops_exit_list()
  net: axienet: fix number of TX ring slots for available check
  net: axienet: Wait for PhyRstCmplt after core reset
  af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress
  parisc: pdc_stable: Fix memory leak in pdcs_register_pathentries
  net/fsl: xgmac_mdio: Fix incorrect iounmap when removing module
  powerpc/fsl/dts: Enable WA for erratum A-009885 on fman3l MDIO buses
  RDMA/rxe: Fix a typo in opcode name
  RDMA/hns: Modify the mapping attribute of doorbell to device
  drm/radeon: fix error handling in radeon_driver_open_kms
  fuse: fix live lock in fuse_iget()
  fuse: fix bad inode
  ext4: don't use the orphan list when migrating an inode
  ext4: Fix BUG_ON in ext4_bread when write quota data
  ext4: set csum seed in tmp inode while migrating to extents
  iwlwifi: mvm: Increase the scan timeout guard to 30 seconds
  ubifs: Error path in ubifs_remount_rw() seems to wrongly free write buffers
  power: bq25890: Enable continuous conversion for ADC at charging
  ASoC: mediatek: mt8173: fix device_node leak
  scsi: sr: Don't use GFP_DMA
  MIPS: Octeon: Fix build errors using clang
  i2c: designware-pci: Fix to change data types of hcnt and lcnt parameters
  ALSA: seq: Set upper limit of processed events
  w1: Misuse of get_user()/put_user() reported by sparse
  i2c: mpc: Correct I2C reset procedure
  powerpc/smp: Move setup_profiling_timer() under CONFIG_PROFILING
  i2c: i801: Don't silently correct invalid transfer size
  powerpc/btext: add missing of_node_put
  powerpc/cell: add missing of_node_put
  powerpc/powernv: add missing of_node_put
  powerpc/6xx: add missing of_node_put
  parisc: Avoid calling faulthandler_disabled() twice
  serial: core: Keep mctrl register state and cached copy in sync
  serial: pl010: Drop CR register reset on set_termios
  dm space map common: add bounds check to sm_ll_lookup_bitmap()
  dm btree: add a defensive bounds check to insert_at()
  net: mdio: Demote probed message to debug print
  btrfs: remove BUG_ON(!eie) in find_parent_nodes
  btrfs: remove BUG_ON() in find_parent_nodes()
  ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R()
  ACPICA: Utilities: Avoid deleting the same object twice in a row
  jffs2: GC deadlock reading a page that is used in jffs2_write_begin()
  um: registers: Rename function names to avoid conflicts and build problems
  ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream
  usb: hub: Add delay for SuperSpeed hub resume to let links transit to U0
  media: saa7146: hexium_gemini: Fix a NULL pointer dereference in hexium_attach()
  media: igorplugusb: receiver overflow should be reported
  net: bonding: debug: avoid printing debug logs when bond is not notifying peers
  ath10k: Fix tx hanging
  iwlwifi: mvm: synchronize with FW after multicast commands
  media: m920x: don't use stack on USB reads
  media: saa7146: hexium_orion: Fix a NULL pointer dereference in hexium_attach()
  floppy: Add max size check for user space request
  mwifiex: Fix skb_over_panic in mwifiex_usb_recv()
  HSI: core: Fix return freed object in hsi_new_client
  gpiolib: acpi: Do not set the IRQ type if the IRQ is already in use
  media: b2c2: Add missing check in flexcop_pci_isr:
  HID: apple: Do not reset quirks when the Fn key is not found
  usb: gadget: f_fs: Use stream_open() for endpoint files
  ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply
  fs: dlm: filter user dlm messages for kernel locks
  Bluetooth: Fix debugfs entry leak in hci_register_dev()
  RDMA/cxgb4: Set queue pair state when being queried
  mips: bcm63xx: add support for clk_set_parent()
  mips: lantiq: add support for clk_set_parent()
  misc: lattice-ecp3-config: Fix task hung when firmware load failed
  ASoC: samsung: idma: Check of ioremap return value
  dmaengine: pxa/mmp: stop referencing config->slave_id
  RDMA/core: Let ib_find_gid() continue search even after empty entry
  scsi: ufs: Fix race conditions related to driver data
  char/mwave: Adjust io port register size
  ALSA: oss: fix compile error when OSS_DEBUG is enabled
  powerpc/prom_init: Fix improper check of prom_getprop()
  RDMA/hns: Validate the pkey index
  ALSA: hda: Add missing rwsem around snd_ctl_remove() calls
  ALSA: PCM: Add missing rwsem around snd_ctl_remove() calls
  ALSA: jack: Add missing rwsem around snd_ctl_remove() calls
  ext4: avoid trim error on fs with small groups
  net: mcs7830: handle usb read errors properly
  pcmcia: fix setting of kthread task states
  can: xilinx_can: xcan_probe(): check for error irq
  can: softing: softing_startstop(): fix set but not used variable warning
  spi: spi-meson-spifc: Add missing pm_runtime_disable() in meson_spifc_probe
  fsl/fman: Check for null pointer after calling devm_ioremap
  ppp: ensure minimum packet size in ppp_write()
  pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in nonstatic_find_mem_region()
  pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in __nonstatic_find_io_region()
  usb: ftdi-elan: fix memory leak on device disconnect
  media: msi001: fix possible null-ptr-deref in msi001_probe()
  media: si2157: Fix "warm" tuner state detection
  media: saa7146: mxb: Fix a NULL pointer dereference in mxb_attach()
  media: dib8000: Fix a memleak in dib8000_init()
  floppy: Fix hang in watchdog when disk is ejected
  serial: amba-pl011: do not request memory region twice
  drm/radeon/radeon_kms: Fix a NULL pointer dereference in radeon_driver_open_kms()
  drm/amdgpu: Fix a NULL pointer dereference in amdgpu_connector_lcd_native_mode()
  arm64: dts: qcom: msm8916: fix MMC controller aliases
  netfilter: bridge: add support for pppoe filtering
  tty: serial: atmel: Call dma_async_issue_pending()
  tty: serial: atmel: Check return code of dmaengine_submit()
  crypto: qce - fix uaf on qce_ahash_register_one
  media: dmxdev: fix UAF when dvb_register_device() fails
  Bluetooth: stop proccessing malicious adv data
  wcn36xx: Indicate beacon not connection loss on MISSED_BEACON_IND
  Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails
  shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode
  PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller
  can: softing_cs: softingcs_probe(): fix memleak on registration failure
  media: stk1160: fix control-message timeouts
  media: pvrusb2: fix control-message timeouts
  media: redrat3: fix control-message timeouts
  media: dib0700: fix undefined behavior in tuner shutdown
  media: s2255: fix control-message timeouts
  media: cpia2: fix control-message timeouts
  media: em28xx: fix control-message timeouts
  media: mceusb: fix control-message timeouts
  media: flexcop-usb: fix control-message timeouts
  rtc: cmos: take rtc_lock while reading from CMOS
  nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind()
  HID: wacom: Avoid using stale array indicies to read contact count
  HID: uhid: Fix worker destroying device without any protection
  rtlwifi: rtl8192cu: Fix WARNING when calling local_irq_restore() with interrupts enabled
  media: uvcvideo: fix division by zero at stream start
  drm/i915: Avoid bitwise vs logical OR warning in snb_wm_latency_quirk()
  staging: wlan-ng: Avoid bitwise vs logical OR warning in hfa384x_usb_throttlefn()
  random: fix data race on crng init time
  random: fix data race on crng_node_pool
  can: gs_usb: gs_can_start_xmit(): zero-initialize hf->{flags,reserved}
  can: gs_usb: fix use of uninitialized variable, detach device on reception of invalid USB data
  mfd: intel-lpss: Fix too early PM enablement in the ACPI ->probe()
  USB: Fix "slab-out-of-bounds Write" bug in usb_hcd_poll_rh_status
  USB: core: Fix bug in resuming hub's handling of wakeup requests
  Bluetooth: bfusb: fix division by zero in send path
  Linux 4.9.297
  power: reset: ltc2952: Fix use of floating point literals
  mISDN: change function names to avoid conflicts
  net: udp: fix alignment problem in udp4_seq_show()
  ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate
  scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown()
  phonet: refcount leak in pep_sock_accep
  arm64: sysreg: Move to use definitions for all the SCTLR bits
  arm64: move !VHE work to end of el2_setup
  arm64: reduce el2_setup branching
  arm64: Remove a redundancy in sysreg.h
  bug: split BUILD_BUG stuff out into <linux/build_bug.h>
  rndis_host: support Hytera digital radios
  xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate
  sch_qfq: prevent shift-out-of-bounds in qfq_init_qdisc
  i40e: Fix incorrect netdev's real number of RX/TX queues
  mac80211: initialize variable have_higher_than_11mbit
  ieee802154: atusb: fix uninit value in atusb_set_extended_addr
  virtio_pci: Support surprise removal of virtio pci device
  tracing: Tag trace_percpu_buffer as a percpu pointer
  tracing: Fix check for trace_percpu_buffer validity in get_trace_buf()
  Bluetooth: btusb: Apply QCA Rome patches for some ATH3012 models
  Linux 4.9.296
  net: fix use-after-free in tw_timer_handler
  Input: spaceball - fix parsing of movement data packets
  Input: appletouch - initialize work before device registration
  scsi: vmw_pvscsi: Set residual data length conditionally
  usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.
  xhci: Fresco FL1100 controller should not have BROKEN_MSI quirk set.
  uapi: fix linux/nfc.h userspace compilation errors
  nfc: uapi: use kernel size_t to fix user-space builds
  fsl/fman: Fix missing put_device() call in fman_port_probe
  selinux: initialize proto variable in selinux_ip_postroute_compat()
  recordmcount.pl: fix typo in s390 mcount regex
  platform/x86: apple-gmux: use resource_size() with res
  HID: asus: Add depends on USB_HID to HID_ASUS Kconfig option
  Linux 4.9.295
  phonet/pep: refuse to enable an unbound pipe
  hamradio: improve the incomplete fix to avoid NPD
  hamradio: defer ax25 kfree after unregister_netdev
  ax25: NPD bug when detaching AX25 device
  hwmon: (lm90) Do not report 'busy' status bit as alarm
  ARM: 9169/1: entry: fix Thumb2 bug in iWMMXt exception handling
  x86/pkey: Fix undefined behaviour with PKRU_WD_BIT
  ALSA: drivers: opl3: Fix incorrect use of vp->state
  ALSA: jack: Check the return value of kstrdup()
  hwmon: (lm90) Fix usage of CONFIG2 register in detect function
  drivers: net: smc911x: Check for error irq
  fjes: Check for error irq
  bonding: fix ad_actor_system option setting to default
  qlcnic: potential dereference null pointer of rx_queue->page_ring
  IB/qib: Fix memory leak in qib_user_sdma_queue_pkts()
  HID: holtek: fix mouse probing
  can: kvaser_usb: get CAN clock frequency from device
  net: usb: lan78xx: add Allied Telesis AT29M2-AF
  Linux 4.9.294
  xen/netback: don't queue unlimited number of packages
  xen/netback: fix rx queue stall detection
  xen/console: harden hvc_xen against event channel storms
  xen/netfront: harden netfront against event channel storms
  xen/blkfront: harden blkfront against event channel storms
  Input: touchscreen - avoid bitwise vs logical OR warning
  mwifiex: Remove unnecessary braces from HostCmd_SET_SEQ_NO_BSS_INFO
  ARM: 8805/2: remove unneeded naked function usage
  net: lan78xx: Avoid unnecessary self assignment
  scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select()
  fuse: annotate lock in fuse_reverse_inval_entry()
  firmware: arm_scpi: Fix string overflow in SCPI genpd driver
  net: systemport: Add global locking for descriptor lifecycle
  timekeeping: Really make sure wall_to_monotonic isn't positive
  USB: serial: option: add Telit FN990 compositions
  PCI/MSI: Clear PCI_MSIX_FLAGS_MASKALL on error
  USB: gadget: bRequestType is a bitfield, not a enum
  ixgbe: set X550 MDIO speed before talking to PHY
  igbvf: fix double free in `igbvf_probe`
  soc/tegra: fuse: Fix bitwise vs. logical OR warning
  nfsd: fix use-after-free due to delegation race
  dm btree remove: fix use after free in rebalance_children()
  recordmcount.pl: look for jgnop instruction as well as bcrl on s390
  mac80211: send ADDBA requests using the tid/queue of the aggregation session
  hwmon: (dell-smm) Fix warning on /proc/i8k creation error
  tracing: Fix a kmemleak false positive in tracing_map
  net: netlink: af_netlink: Prevent empty skb by adding a check on len.
  i2c: rk3x: Handle a spurious start completion interrupt flag
  parisc/agp: Annotate parisc agp init functions with __init
  net/mlx4_en: Update reported link modes for 1/10G
  nfc: fix segfault in nfc_genl_dump_devices_done
  FROMGIT: USB: gadget: bRequestType is a bitfield, not a enum
  Linux 4.9.293
  irqchip: nvic: Fix offset for Interrupt Priority Offsets
  irqchip/irq-gic-v3-its.c: Force synchronisation when issuing INVALL
  irqchip/armada-370-xp: Fix support for Multi-MSI interrupts
  irqchip/armada-370-xp: Fix return value of armada_370_xp_msi_alloc()
  iio: accel: kxcjk-1013: Fix possible memory leak in probe and remove
  iio: itg3200: Call iio_trigger_notify_done() on error
  iio: kxsd9: Don't return error code in trigger handler
  iio: ltr501: Don't return error code in trigger handler
  iio: mma8452: Fix trigger reference couting
  iio: stk3310: Don't return error code in interrupt handler
  usb: core: config: using bit mask instead of individual bits
  usb: core: config: fix validation of wMaxPacketValue entries
  USB: gadget: zero allocate endpoint 0 buffers
  USB: gadget: detect too-big endpoint 0 requests
  net/qla3xxx: fix an error code in ql_adapter_up()
  net, neigh: clear whole pneigh_entry at alloc time
  net: fec: only clear interrupt of handling queue in fec_enet_rx_queue()
  net: altera: set a couple error code in probe()
  net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero
  block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2)
  tracefs: Set all files to the same group ownership as the mount option
  signalfd: use wake_up_pollfree()
  binder: use wake_up_pollfree()
  wait: add wake_up_pollfree()
  libata: add horkage for ASMedia 1092
  can: pch_can: pch_can_rx_normal: fix use after free
  tracefs: Have new files inherit the ownership of their parent
  ALSA: pcm: oss: Handle missing errors in snd_pcm_oss_change_params*()
  ALSA: pcm: oss: Limit the period size to 16MB
  ALSA: pcm: oss: Fix negative period/buffer sizes
  ALSA: ctl: Fix copy of updated id with element read/write
  mm: bdi: initialize bdi_min_ratio when bdi is unregistered
  IB/hfi1: Correct guard on eager buffer deallocation
  nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done
  can: sja1000: fix use after free in ems_pcmcia_add_card()
  HID: check for valid USB device for many HID drivers
  HID: wacom: fix problems when device is not a valid USB device
  HID: add USB_HID dependancy on some USB HID drivers
  HID: add USB_HID dependancy to hid-chicony
  HID: add USB_HID dependancy to hid-prodikeys
  HID: add hid_is_usb() function to make it simpler for USB detection
  HID: introduce hid_is_using_ll_driver
  UPSTREAM: USB: gadget: zero allocate endpoint 0 buffers
  UPSTREAM: USB: gadget: detect too-big endpoint 0 requests

 Conflicts:
	arch/arm64/include/asm/cputype.h
	arch/arm64/kernel/bpi.S
	arch/arm64/kernel/cpu_errata.c
	arch/arm64/kernel/vdso.c
	drivers/clk/qcom/clk-rcg2.c
	drivers/media/dvb-core/dmxdev.c
	drivers/mmc/core/host.c
	drivers/net/usb/lan78xx.c
	drivers/staging/android/ion/ion-ioctl.c
	drivers/staging/android/ion/ion.c
	drivers/staging/android/ion/ion_priv.h
	drivers/usb/gadget/composite.c
	drivers/usb/gadget/function/rndis.c
	drivers/usb/gadget/function/rndis.h
	lib/vsprintf.c
	mm/memory.c
	net/ipv6/ip6_output.c

Change-Id: Ie8bf6aa5dac3ae822cef90decbba577cefedcb31
2022-05-09 16:57:36 +03:00
Greg Kroah-Hartman
f5c4d2614c Merge 4.9.311 into android-4.9-q
Changes in 4.9.311
	USB: serial: pl2303: add IBM device IDs
	USB: serial: simple: add Nokia phone driver
	netdevice: add the case if dev is NULL
	virtio_console: break out of buf poll on remove
	ethernet: sun: Free the coherent when failing in probing
	af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register
	block: Add a helper to validate the block size
	virtio-blk: Use blk_validate_block_size() to validate block size
	USB: usb-storage: Fix use of bitfields for hardware data in ene_ub6250.c
	coresight: Fix TRCCONFIGR.QE sysfs interface
	iio: inkern: apply consumer scale on IIO_VAL_INT cases
	iio: inkern: make a best effort on offset calculation
	clk: uniphier: Fix fixed-rate initialization
	ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE
	SUNRPC: avoid race between mod_timer() and del_timer_sync()
	NFSD: prevent underflow in nfssvc_decode_writeargs()
	can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path
	jffs2: fix use-after-free in jffs2_clear_xattr_subsystem
	jffs2: fix memory leak in jffs2_do_mount_fs
	jffs2: fix memory leak in jffs2_scan_medium
	mm/pages_alloc.c: don't create ZONE_MOVABLE beyond the end of a node
	mempolicy: mbind_range() set_policy() after vma_merge()
	scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands
	Revert "Input: clear BTN_RIGHT/MIDDLE on buttonpads"
	ALSA: cs4236: fix an incorrect NULL check on list iterator
	drivers: hamradio: 6pack: fix UAF bug caused by mod_timer()
	video: fbdev: sm712fb: Fix crash in smtcfb_read()
	video: fbdev: atari: Atari 2 bpp (STe) palette bugfix
	ARM: dts: exynos: fix UART3 pins configuration in Exynos5250
	ARM: dts: exynos: add missing HDMI supplies on SMDK5250
	ARM: dts: exynos: add missing HDMI supplies on SMDK5420
	carl9170: fix missing bit-wise or operator for tx_params
	thermal: int340x: Increase bitmap size
	lib/raid6/test: fix multiple definition linking error
	DEC: Limit PMAX memory probing to R3k systems
	media: davinci: vpif: fix unbalanced runtime PM get
	brcmfmac: firmware: Allocate space for default boardrev in nvram
	brcmfmac: pcie: Replace brcmf_pcie_copy_mem_todev with memcpy_toio
	PCI: pciehp: Clear cmd_busy bit in polling mode
	crypto: authenc - Fix sleep in atomic context in decrypt_tail
	crypto: mxs-dcp - Fix scatterlist processing
	spi: tegra114: Add missing IRQ check in tegra_spi_probe
	selftests/x86: Add validity check and allow field splitting
	hwmon: (pmbus) Add mutex to regulator ops
	hwmon: (sch56xx-common) Replace WDOG_ACTIVE with WDOG_HW_RUNNING
	PM: hibernate: fix __setup handler error handling
	PM: suspend: fix return value of __setup handler
	crypto: vmx - add missing dependencies
	crypto: ccp - ccp_dmaengine_unregister release dma channels
	hwmon: (pmbus) Add Vin unit off handling
	clocksource: acpi_pm: fix return value of __setup handler
	sched/debug: Remove mpol_get/put and task_lock/unlock from sched_show_numa
	perf/core: Fix address filter parser for multiple filters
	perf/x86/intel/pt: Fix address filter config for 32-bit kernel
	video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe()
	video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name()
	ARM: dts: qcom: ipq4019: fix sleep clock
	soc: ti: wkup_m3_ipc: Fix IRQ check in wkup_m3_ipc_probe
	media: usb: go7007: s2250-board: fix leak in probe()
	ASoC: ti: davinci-i2s: Add check for clk_enable()
	ALSA: spi: Add check for clk_enable()
	arm64: dts: ns2: Fix spi-cpol and spi-cpha property
	arm64: dts: broadcom: Fix sata nodename
	printk: fix return value of printk.devkmsg __setup handler
	ASoC: mxs-saif: Handle errors for clk_enable
	ASoC: atmel_ssc_dai: Handle errors for clk_enable
	memory: emif: Add check for setup_interrupts
	memory: emif: check the pointer temp in get_device_details()
	ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction
	ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe
	ASoC: wm8350: Handle error for wm8350_register_irq
	ASoC: fsi: Add check for clk_enable
	video: fbdev: omapfb: Add missing of_node_put() in dvic_probe_of
	ASoC: dmaengine: do not use a NULL prepare_slave_config() callback
	ASoC: mxs: Fix error handling in mxs_sgtl5000_probe
	ASoC: imx-es8328: Fix error return code in imx_es8328_probe()
	mtd: onenand: Check for error irq
	drm/edid: Don't clear formats if using deep color
	ath9k_htc: fix uninit value bugs
	ray_cs: Check ioremap return value
	power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init
	HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports
	iwlwifi: Fix -EIO error code that is never returned
	scsi: pm8001: Fix command initialization in pm80XX_send_read_log()
	scsi: pm8001: Fix command initialization in pm8001_chip_ssp_tm_req()
	scsi: pm8001: Fix payload initialization in pm80xx_set_thermal_config()
	scsi: pm8001: Fix abort all task initialization
	TOMOYO: fix __setup handlers return values
	ext2: correct max file size computing
	drm/tegra: Fix reference leak in tegra_dsi_ganged_probe
	KVM: x86: Fix emulation in writing cr8
	KVM: x86/emulator: Defer not-present segment check in __load_segment_descriptor()
	i2c: xiic: Make bus names unique
	power: supply: wm8350-power: Handle error for wm8350_register_irq
	power: supply: wm8350-power: Add missing free in free_charger_irq
	powerpc/sysdev: fix incorrect use to determine if list is empty
	mfd: mc13xxx: Add check for mc13xxx_irq_request
	MIPS: RB532: fix return value of __setup handler
	USB: storage: ums-realtek: fix error code in rts51x_read_mem()
	af_netlink: Fix shift out of bounds in group mask calculation
	i2c: mux: demux-pinctrl: do not deactivate a master that is not active
	mfd: asic3: Add missing iounmap() on error asic3_mfd_probe
	mxser: fix xmit_buf leak in activate when LSR == 0xff
	pwm: lpc18xx-sct: Initialize driver data and hardware before pwmchip_add()
	iio: adc: Add check for devm_request_threaded_irq
	clk: qcom: clk-rcg2: Update the frac table for pixel clock
	remoteproc: qcom_wcnss: Add missing of_node_put() in wcnss_alloc_memory_region
	clk: loongson1: Terminate clk_div_table with sentinel element
	clk: clps711x: Terminate clk_div_table with sentinel element
	clk: tegra: tegra124-emc: Fix missing put_device() call in emc_ensure_emc_driver
	NFS: remove unneeded check in decode_devicenotify_args()
	pinctrl: mediatek: Fix missing of_node_put() in mtk_pctrl_init
	pinctrl: nomadik: Add missing of_node_put() in nmk_pinctrl_probe
	pinctrl/rockchip: Add missing of_node_put() in rockchip_pinctrl_probe
	tty: hvc: fix return value of __setup handler
	kgdboc: fix return value of __setup handler
	kgdbts: fix return value of __setup handler
	jfs: fix divide error in dbNextAG
	netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options
	net: phy: broadcom: Fix brcm_fet_config_init()
	qlcnic: dcb: default to returning -EOPNOTSUPP
	net/x25: Fix null-ptr-deref caused by x25_disconnect
	selinux: use correct type for context length
	loop: use sysfs_emit() in the sysfs xxx show()
	Fix incorrect type in assignment of ipv6 port for audit
	irqchip/nvic: Release nvic_base upon failure
	ACPICA: Avoid walking the ACPI Namespace if it is not there
	ACPI/APEI: Limit printable size of BERT table data
	PM: core: keep irq flags in device_pm_check_callbacks()
	spi: tegra20: Use of_device_get_match_data()
	ext4: don't BUG if someone dirty pages without asking ext4 first
	ntfs: add sanity check on allocation size
	video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow
	video: fbdev: w100fb: Reset global state
	video: fbdev: cirrusfb: check pixclock to avoid divide by zero
	video: fbdev: omapfb: acx565akm: replace snprintf with sysfs_emit
	ARM: dts: qcom: fix gic_irq_domain_translate warnings for msm8960
	ARM: dts: bcm2837: Add the missing L1/L2 cache information
	video: fbdev: omapfb: panel-dsi-cm: Use sysfs_emit() instead of snprintf()
	video: fbdev: omapfb: panel-tpo-td043mtea1: Use sysfs_emit() instead of snprintf()
	ASoC: soc-core: skip zero num_dai component in searching dai name
	media: cx88-mpeg: clear interrupt status register before streaming video
	ARM: tegra: tamonten: Fix I2C3 pad setting
	ARM: mmp: Fix failure to remove sram device
	video: fbdev: sm712fb: Fix crash in smtcfb_write()
	media: hdpvr: initialize dev->worker at hdpvr_register_videodev
	mmc: host: Return an error when ->enable_sdio_irq() ops is missing
	scsi: qla2xxx: Fix incorrect reporting of task management failure
	KVM: Prevent module exit until all VMs are freed
	ubifs: Add missing iput if do_tmpfile() failed in rename whiteout
	ubifs: setflags: Make dirtied_ino_d 8 bytes aligned
	gfs2: Make sure FITRIM minlen is rounded up to fs block size
	pinctrl: pinconf-generic: Print arguments for bias-pull-*
	ACPI: CPPC: Avoid out of bounds access when parsing _CPC data
	mm/mmap: return 1 from stack_guard_gap __setup() handler
	mm/memcontrol: return 1 from cgroup.memory __setup() handler
	ubi: fastmap: Return error code if memory allocation fails in add_aeb()
	ASoC: topology: Allow TLV control to be either read or write
	ARM: dts: spear1340: Update serial node properties
	ARM: dts: spear13xx: Update SPI dma properties
	openvswitch: Fixed nd target mask field in the flow dump.
	KVM: x86: Forbid VMM to set SYNIC/STIMER MSRs when SynIC wasn't activated
	rtc: wm8350: Handle error for wm8350_register_irq
	ARM: 9187/1: JIVE: fix return value of __setup handler
	KVM: x86/svm: Clear reserved bits written to PerfEvtSeln MSRs
	ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
	ptp: replace snprintf with sysfs_emit
	powerpc: dts: t104xrdb: fix phy type for FMAN 4/5
	scsi: mvsas: Replace snprintf() with sysfs_emit()
	scsi: bfa: Replace snprintf() with sysfs_emit()
	iommu/arm-smmu-v3: fix event handling soft lockup
	dm ioctl: prevent potential spectre v1 gadget
	scsi: pm8001: Fix pm8001_mpi_task_abort_resp()
	scsi: aha152x: Fix aha152x_setup() __setup handler return value
	bnxt_en: Eliminate unintended link toggle during FW reset
	MIPS: fix fortify panic when copying asm exception handlers
	scsi: libfc: Fix use after free in fc_exch_abts_resp()
	usb: dwc3: omap: fix "unbalanced disables for smps10_out1" on omap5evm
	xtensa: fix DTC warning unit_address_format
	Bluetooth: Fix use after free in hci_send_acl
	init/main.c: return 1 from handled __setup() functions
	w1: w1_therm: fixes w1_seq for ds28ea00 sensors
	SUNRPC/call_alloc: async tasks mustn't block waiting for memory
	serial: samsung_tty: do not unlock port->lock for uart_write_wakeup()
	virtio_console: eliminate anonymous module_init & module_exit
	jfs: prevent NULL deref in diFree
	mm: fix race between MADV_FREE reclaim and blkdev direct IO read
	scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
	net: stmmac: Fix unset max_speed difference between DT and non-DT platforms
	drm/imx: Fix memory leak in imx_pd_connector_get_modes
	drbd: Fix five use after free bugs in get_initial_state
	mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0)
	mm/mempolicy: fix mpol_new leak in shared_policy_replace
	x86/pm: Save the MSR validity status at context setup
	x86/speculation: Restore speculation related MSRs during S3 resume
	arm64: patch_text: Fixup last cpu should be master
	tools build: Use $(shell ) instead of `` to get embedded libperl's ccopts
	dmaengine: Revert "dmaengine: shdma: Fix runtime PM imbalance on error"
	mm: don't skip swap entry even if zap_details specified
	arm64: module: remove (NOLOAD) from linker script
	xfrm: policy: match with both mark and mask on user interfaces
	veth: Ensure eth header is in skb's linear part
	net: ethernet: stmmac: fix altr_tse_pcs function when using a fixed-link
	nfc: nci: add flush_workqueue to prevent uaf
	cifs: potential buffer overflow in handling symlinks
	drm/amdkfd: Check for potential null return of kmalloc_array()
	scsi: ibmvscsis: Increase INITIAL_SRP_LIMIT to 1024
	net: micrel: fix KS8851_MLL Kconfig
	gpu: ipu-v3: Fix dev_dbg frequency output
	scsi: mvsas: Add PCI ID of RocketRaid 2640
	drivers: net: slip: fix NPD bug in sl_tx_timeout()
	mm, page_alloc: fix build_zonerefs_node()
	mm: kmemleak: take a full lowmem check in kmemleak_*_phys()
	ALSA: pcm: Test for "silence" field in struct "pcm_format_data"
	ARM: davinci: da850-evm: Avoid NULL pointer dereference
	smp: Fix offline cpu check in flush_smp_call_function_queue()
	i2c: pasemi: Wait for write xfers to finish
	gcc-plugins: latent_entropy: use /dev/urandom
	Linux 4.9.311

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ia8f55c5ae2f0eb71b0893d8271a10dfd3c78b3b8
2022-04-21 14:01:02 +02:00
Randy Dunlap
197643a60e init/main.c: return 1 from handled __setup() functions
[ Upstream commit f9a40b0890658330c83c95511f9d6b396610defc ]

initcall_blacklist() should return 1 to indicate that it handled its
cmdline arguments.

set_debug_rodata() should return 1 to indicate that it handled its
cmdline arguments.  Print a warning if the option string is invalid.

This prevents these strings from being added to the 'init' program's
environment as they are not init arguments/parameters.

Link: https://lkml.kernel.org/r/20220221050901.23985-1-rdunlap@infradead.org
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reported-by: Igor Zhbanov <i.zhbanov@omprussia.ru>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-04-20 09:06:43 +02:00
Greg Kroah-Hartman
c5804dccaf Merge 4.9.302 into android-4.9-q
Changes in 4.9.302
	integrity: check the return value of audit_log_start()
	ima: Remove ima_policy file before directory
	NFS: Fix initialisation of nfs_client cl_flags field
	NFSD: Clamp WRITE offsets
	Input: i8042 - Fix misplaced backport of "add ASUS Zenbook Flip to noselftest list"
	serial: sh-sci: Fix misplaced backport of "Fix late enablement of AUTORTS"
	ALSA: line6: Fix misplaced backport of "Fix wrong altsetting for LINE6_PODHD500_1"
	Revert "net: axienet: Wait for PhyRstCmplt after core reset"
	NFSv4 only print the label when its queried
	nfs: nfs4clinet: check the return value of kstrdup()
	NFSv4 remove zero number of fs_locations entries error check
	scsi: target: iscsi: Make sure the np under each tpg is unique
	usb: dwc2: gadget: don't try to disable ep0 in dwc2_hsotg_suspend
	ARM: dts: imx23-evk: Remove MX23_PAD_SSP1_DETECT from hog group
	staging: fbtft: Fix error path in fbtft_driver_module_init()
	ARM: dts: imx6qdl-udoo: Properly describe the SD card detect
	bonding: pair enable_port with slave_arr_updates
	ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path
	net: do not keep the dst cache when uncloning an skb dst and its metadata
	net: fix a memleak when uncloning an skb dst and its metadata
	tipc: rate limit warning for received illegal binding update
	vt_ioctl: fix array_index_nospec in vt_setactivate
	vt_ioctl: add array_index_nospec to VT_ACTIVATE
	bpf: Add kconfig knob for disabling unpriv bpf by default
	n_tty: wake up poll(POLLRDNORM) on receiving data
	usb: dwc3: gadget: Prevent core from processing stale TRBs
	USB: gadget: validate interface OS descriptor requests
	usb: gadget: rndis: check size of RNDIS_MSG_SET command
	USB: serial: ftdi_sio: add support for Brainboxes US-159/235/320
	USB: serial: option: add ZTE MF286D modem
	USB: serial: ch341: add support for GW Instek USB2.0-Serial devices
	USB: serial: cp210x: add NCR Retail IO box id
	USB: serial: cp210x: add CPI Bulk Coin Recycler id
	hwmon: (dell-smm) Speed up setting of fan speed
	HID: wacom: add USB_HID dependency
	Linux 4.9.302

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I5ad6e897d8683da99cddfdca9df1863f389345f2
2022-02-16 13:00:09 +01:00
Daniel Borkmann
b6ef4bc38b bpf: Add kconfig knob for disabling unpriv bpf by default
commit 08389d888287c3823f80b0216766b71e17f0aba5 upstream.

Add a kconfig knob which allows for unprivileged bpf to be disabled by default.
If set, the knob sets /proc/sys/kernel/unprivileged_bpf_disabled to value of 2.

This still allows a transition of 2 -> {0,1} through an admin. Similarly,
this also still keeps 1 -> {1} behavior intact, so that once set to permanently
disabled, it cannot be undone aside from a reboot.

We've also added extra2 with max of 2 for the procfs handler, so that an admin
still has a chance to toggle between 0 <-> 2.

Either way, as an additional alternative, applications can make use of CAP_BPF
that we added a while ago.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/74ec548079189e4e4dffaeb42b8987bb3c852eee.1620765074.git.daniel@iogearbox.net
[fllinden@amazon.com: backported to 4.9]
Signed-off-by: Frank van der Linden <fllinden@amazon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-02-16 12:43:54 +01:00
Lucas Wei
023f358536 Merge android-4.9-q (4.9.274) into android-msm-pixel-4.9-sc-lts
Merge 4.9.274 into android-4.9-q
Linux 4.9.274
    i2c: robotfuzz-osif: fix control-request directions
    nilfs2: fix memory leak in nilfs_sysfs_delete_device_group
    net: ll_temac: Avoid ndo_start_xmit returning NETDEV_TX_BUSY
    net: qed: Fix memcpy() overflow of qed_dcbx_params()
    r8169: Avoid memcpy() over-reading of ETH_SS_STATS
    sh_eth: Avoid memcpy() over-reading of ETH_SS_STATS
  * r8152: Avoid memcpy() over-reading of ETH_SS_STATS
      drivers/net/usb/r8152.c
  * net/packet: annotate accesses to po->ifindex
      net/packet/af_packet.c
  * net/packet: annotate accesses to po->bind
      net/packet/af_packet.c
    net: caif: fix memory leak in ldisc_open
  * inet: annotate date races around sk->sk_txhash
      include/net/sock.h
  * ping: Check return value of function 'ping_queue_rcv_skb'
      net/ipv4/ping.c
    mac80211: drop multicast fragments
  * cfg80211: call cfg80211_leave_ocb when switching away from OCB
      net/wireless/util.c
    mac80211: remove warning in ieee80211_get_sband()
  * Revert "PCI: PM: Do not read power state in pci_enable_device_flags()"
      drivers/pci/pci.c
  * arm64: perf: Disable PMU while processing counter overflows
      arch/arm64/kernel/perf_event.c
  * Makefile: Move -Wno-unused-but-set-variable out of GCC only block
      Makefile
    ARM: 9081/1: fix gcc-10 thumb2-kernel regression
    i40e: Be much more verbose about what we can and cannot offload
  * inet: use bigger hash table for IP ID generation
      net/ipv4/route.c
    x86/fpu: Reset state for all signal restore failures
  * tracing: Do not stop recording comms if the trace file is being read
      kernel/trace/trace.c
  * tracing: Do not stop recording cmdlines when tracing is off
      kernel/trace/trace.c
  * usb: dwc3: core: fix kernel panic when do reboot
      drivers/usb/dwc3/core.c
    can: bcm/raw/isotp: use per module netdevice notifier
    net: fec_ptp: add clock rate zero check
    dmaengine: pl330: fix wrong usage of spinlock flags in dma_cyclc
  * PCI: Mark some NVIDIA GPUs to avoid bus reset
      drivers/pci/quirks.c
  * PCI: Mark TI C667X to avoid bus reset
      drivers/pci/quirks.c
  * tracing: Do no increment trace_clock_global() by one
      kernel/trace/trace_clock.c
    can: bcm: fix infoleak in struct bcm_msg_head
    radeon: use memcpy_to/fromio for UVD fw upload
  * scsi: core: Put .shost_dev in failure path if host state changes to RUNNING
      drivers/scsi/hosts.c
    net: ethernet: fix potential use-after-free in ec_bhf_remove
    net: cdc_eem: fix tx fixup skb leak
    net: hamradio: fix memory leak in mkiss_close
    be2net: Fix an error handling path in 'be_probe()'
  * net/af_unix: fix a data-race in unix_dgram_sendmsg / unix_release_sock
      net/unix/af_unix.c
  * net: ipv4: fix memory leak in ip_mc_add1_src
      net/ipv4/igmp.c
    net: usb: fix possible use-after-free in smsc75xx_bind
  * net: cdc_ncm: switch to eth%d interface naming
      drivers/net/usb/cdc_ncm.c
    netxen_nic: Fix an error handling path in 'netxen_nic_probe()'
    qlcnic: Fix an error handling path in 'qlcnic_probe()'
    net: stmmac: dwmac1000: Fix extended MAC address registers definition
    alx: Fix an error handling path in 'alx_probe()'
    netfilter: synproxy: Fix out of bounds when parsing TCP options
  * rtnetlink: Fix regression in bridge VLAN configuration
      net/core/rtnetlink.c
  * udp: fix race between close() and udp_abort()
      net/ipv4/udp.c
      net/ipv6/udp.c
    net: rds: fix memory leak in rds_recvmsg
  * net: ipv4: fix memory leak in netlbl_cipsov4_add_std
      net/ipv4/cipso_ipv4.c
    batman-adv: Avoid WARN_ON timing related checks
  * mm: hwpoison: change PageHWPoison behavior on hugetlb pages
      include/linux/swapops.h
    dmaengine: stedma40: add missing iounmap() on error in d40_probe()
  * dmaengine: QCOM_HIDMA_MGMT depends on HAS_IOMEM
      drivers/dma/qcom/Kconfig
  * fib: Return the correct errno code
      net/core/fib_rules.c
  * net: Return the correct errno code
      net/compat.c
    net/x25: Return the correct errno code
  * rtnetlink: Fix missing error code in rtnl_bridge_notify()
      net/core/rtnetlink.c
  * net: ipconfig: Don't override command-line hostnames or domains
      net/ipv4/ipconfig.c
    ethernet: myri10ge: Fix missing error code in myri10ge_probe()
    scsi: target: core: Fix warning on realtime kernels
    gfs2: Fix use-after-free in gfs2_glock_shrink_scan
    HID: gt683r: add missing MODULE_DEVICE_TABLE
    ARM: OMAP2+: Fix build warning when mmc_omap is not built
  * HID: usbhid: fix info leak in hid_submit_ctrl
      drivers/hid/usbhid/hid-core.c
      include/linux/hid.h
  * HID: Add BUS_VIRTUAL to hid_connect logging
      drivers/hid/hid-core.c
    HID: hid-sensor-hub: Return error for hid_set_field() failure
    net: ieee802154: fix null deref in parse dev addr
  * FROMGIT: bpf: Do not change gso_size during bpf_skb_change_proto()
      net/core/filter.c
    Merge 4.9.273 into android-4.9-q
Linux 4.9.273
  * proc: only require mm_struct for writing
      fs/proc/base.c
  * tracing: Correct the length check which causes memory corruption
      kernel/trace/trace.c
    ftrace: Do not blindly read the ip address in ftrace_bug()
  * scsi: core: Only put parent device if host state differs from SHOST_CREATED
      drivers/scsi/hosts.c
  * scsi: core: Fix error handling of scsi_host_alloc()
      drivers/scsi/hosts.c
    NFSv4: nfs4_proc_set_acl needs to restore NFS_CAP_UIDGID_NOMAP on error.
  * kvm: fix previous commit for 32-bit builds
      include/linux/kvm_host.h
    perf session: Correct buffer copying when peeking events
    NFS: Fix a potential NULL dereference in nfs_get_client()
  * perf: Fix data race between pin_count increment/decrement
      kernel/events/core.c
  * usb: fix various gadget panics on 10gbps cabling
      drivers/usb/gadget/config.c
    usb: fix various gadgets null ptr deref on 10gbps cabling.
    usb: gadget: eem: fix wrong eem header operation
    USB: serial: quatech2: fix control-request directions
    USB: serial: omninet: add device id for Zyxel Omni 56K Plus
    USB: serial: ftdi_sio: add NovaTech OrionMX product ID
  * usb: dwc3: ep0: fix NULL pointer exception
      drivers/usb/dwc3/ep0.c
    USB: f_ncm: ncm_bitrate (speed) is unsigned
  * cgroup1: don't allow '\n' in renaming
      kernel/cgroup.c
    btrfs: return value from btrfs_mark_extent_written() in case of error
  * kvm: avoid speculation-based attacks from out-of-range memslot accesses
      include/linux/kvm_host.h
  * drm: Lock pointer access in drm_master_release()
      drivers/gpu/drm/drm_auth.c
    i2c: mpc: implement erratum A-004447 workaround
    i2c: mpc: Make use of i2c_recover_bus()
    powerpc/fsl: set fsl,i2c-erratum-a004447 flag for P1010 i2c controllers
    powerpc/fsl: set fsl,i2c-erratum-a004447 flag for P2041 i2c controllers
    bnx2x: Fix missing error code in bnx2x_iov_init_one()
    MIPS: Fix kernel hang under FUNCTION_GRAPH_TRACER and PREEMPT_TRACER
    net: appletalk: cops: Fix data race in cops_probe1
    net: macb: ensure the device is available before accessing GEMGXL control registers
    scsi: target: qla2xxx: Wait for stop_phase1 at WWN removal
    scsi: vmw_pvscsi: Set correct residual data length
    net/qla3xxx: fix schedule while atomic in ql_sem_spinlock
  * wq: handle VM suspension in stall detection
      kernel/workqueue.c
  * cgroup: disable controllers at parse time
      kernel/cgroup.c
  * net: mdiobus: get rid of a BUG_ON()
      drivers/net/phy/mdio_bus.c
  * netlink: disable IRQs for netlink_lock_table()
      net/netlink/af_netlink.c
  * bonding: init notify_work earlier to avoid uninitialized use
      drivers/net/bonding/bond_main.c
    isdn: mISDN: netjet: Fix crash in nj_probe:
    ASoC: sti-sas: add missing MODULE_DEVICE_TABLE
    net/nfc/rawsock.c: fix a permission check bug
  * proc: Track /proc/$pid/attr/ opener mm_struct
      fs/proc/base.c
    Merge 4.9.272 into android-4.9-q
Linux 4.9.272
    xen-pciback: redo VF placement in the virtual topology
  * arm64: Remove unimplemented syscall log message
      arch/arm64/kernel/traps.c
    KVM: SVM: Truncate GPR value for DR and CR accesses in !64-bit mode
    bnxt_en: Remove the setting of dev_port.
    btrfs: fixup error handling in fixup_inode_link_counts
    btrfs: fix error handling in btrfs_del_csums
    nfc: fix NULL ptr dereference in llcp_sock_getname() after failed connect
    ocfs2: fix data corruption by fallocate
  * pid: take a reference when initializing `cad_pid`
      init/main.c
  * ext4: fix bug on in ext4_es_cache_extent as ext4_split_extent_at failed
      fs/ext4/extents.c
  * ALSA: timer: Fix master timer notification
      sound/core/timer.c
    net: caif: fix memory leak in cfusbl_device_notify
    net: caif: fix memory leak in caif_device_notify
    net: caif: add proper error handling
    net: caif: added cfserl_release function
  * Bluetooth: use correct lock to prevent UAF of hdev object
      net/bluetooth/hci_sock.c
  * Bluetooth: fix the erroneous flush_work() order
      net/bluetooth/hci_core.c
    ieee802154: fix error return code in ieee802154_llsec_getparams()
    ieee802154: fix error return code in ieee802154_add_iface()
    netfilter: nfnetlink_cthelper: hit EBUSY on updates if size mismatches
    HID: i2c-hid: fix format string mismatch
    HID: pidff: fix error return code in hid_pidff_init()
    ipvs: ignore IP_VS_SVC_F_HASHED flag when adding service
    vfio/platform: fix module_put call in error flow
  * vfio/pci: zap_vma_ptes() needs MMU
      drivers/vfio/pci/Kconfig
    vfio/pci: Fix error return code in vfio_ecap_init()
    efi: cper: fix snprintf() use in cper_dimm_err_location()
    efi: Allow EFI_MEMORY_XP and EFI_MEMORY_RO both to be cleared
  * net: usb: cdc_ncm: don't spew notifications
      drivers/net/usb/cdc_ncm.c
      include/linux/usb/usbnet.h
    Merge 4.9.271 into android-4.9-q
Linux 4.9.271
  * usb: core: reduce power-on-good delay time of root hub
      drivers/usb/core/hub.h
  * hugetlbfs: hugetlb_fault_mutex_hash() cleanup
      include/linux/hugetlb.h
    MIPS: ralink: export rt_sysc_membase for rt2880_wdt.c
    MIPS: alchemy: xxs1500: add gpio-au1000.h header file
    sch_dsmark: fix a NULL deref in qdisc_reset()
    scsi: libsas: Use _safe() loop in sas_resume_port()
    ASoC: cs35l33: fix an error code in probe()
    staging: emxx_udc: fix loop in _nbu2ss_nuke()
  * mld: fix panic in mld_newpack()
      net/ipv6/mcast.c
    net: bnx2: Fix error return code in bnx2_init_board()
    net: mdio: octeon: Fix some double free issues
    net: mdio: thunder: Fix a double free issue in the .remove function
    net: netcp: Fix an error message
    drm/amdgpu: Fix a use-after-free
    platform/x86: intel_punit_ipc: Append MODULE_DEVICE_TABLE for ACPI
    btrfs: do not BUG_ON in link_to_fixup_dir
    openrisc: Define memory barrier mb
    scsi: BusLogic: Fix 64-bit system enumeration error for Buslogic
    media: gspca: properly check for errors in po1030_probe()
    media: dvb: Add check on sp8870_readreg return
    libertas: register sysfs groups properly
    dmaengine: qcom_hidma: comment platform_driver_register call
    isdn: mISDNinfineon: check/cleanup ioremap failure correctly in setup_io
    char: hpet: add checks after calling ioremap
    net: caif: remove BUG_ON(dev == NULL) in caif_xmit
    net: fujitsu: fix potential null-ptr-deref
    serial: max310x: unregister uart driver in case of failure and abort
    platform/x86: hp_accel: Avoid invoking _INI to speed up resume
    perf jevents: Fix getting maximum number of fds
    i2c: i801: Don't generate an interrupt on bus reset
    i2c: s3c2410: fix possible NULL pointer deref on read message after write
    tipc: skb_linearize the head skb when reassembling msgs
    Revert "net:tipc: Fix a double free in tipc_sk_mcast_rcv"
    net/mlx4: Fix EEPROM dump support
    NFSv4: Fix v4.0/v4.1 SEEK_DATA return -ENOTSUPP when set NFS_V4_2 config
    NFS: Don't corrupt the value of pg_bytes_written in nfs_do_recoalesce()
    NFS: fix an incorrect limit in filelayout_decode_layout()
    Bluetooth: cmtp: fix file refcount when cmtp_attach_device fails
  * spi: Fix use-after-free with devm_spi_alloc_*
      drivers/spi/spi.c
      include/linux/spi/spi.h
    net: usb: fix memory leak in smsc75xx_bind
    USB: serial: pl2303: add device id for ADLINK ND-6530 GC
    USB: serial: ftdi_sio: add IDs for IDS GmbH Products
    USB: serial: option: add Telit LE910-S1 compositions 0x7010, 0x7011
    USB: serial: ti_usb_3410_5052: add startech.com device id
    serial: rp2: use 'request_firmware' instead of 'request_firmware_nowait'
    USB: trancevibrator: fix control-request direction
    iio: adc: ad7793: Add missing error code in ad7793_setup()
    staging: iio: cdc: ad7746: avoid overwrite of num_channels
    mei: request autosuspend after sending rx flow control
    misc/uss720: fix memory leak in uss720_probe
    kgdb: fix gcc-11 warnings harder
    dm snapshot: properly fix a crash when an origin has no snapshots
    ath10k: Validate first subframe of A-MSDU before processing the list
    mac80211: extend protection against mixed key and fragment cache attacks
    mac80211: do not accept/forward invalid EAPOL frames
    mac80211: prevent attacks on TKIP/WEP as well
    mac80211: check defrag PN against current frame
    mac80211: add fragment cache to sta_info
    mac80211: drop A-MSDUs on old ciphers
  * cfg80211: mitigate A-MSDU aggregation attacks
      net/wireless/util.c
  * mac80211: properly handle A-MSDUs that start with an RFC 1042 header
      include/net/cfg80211.h
      net/wireless/util.c
    mac80211: prevent mixed key and fragment cache attacks
    mac80211: assure all fragments are encrypted
    net: hso: fix control-request directions
  * proc: Check /proc/$pid/attr/ writes against file opener
      fs/proc/base.c
    NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return()
    NFC: nci: fix memory leak in nci_allocate_device
  * netfilter: x_tables: Use correct memory barriers.
      include/linux/netfilter/x_tables.h
      net/netfilter/x_tables.c
    scripts: switch explicitly to Python 3
    tweewide: Fix most Shebang lines
  * mm, vmstat: drop zone->lock in /proc/pagetypeinfo
      mm/vmstat.c

Bug: 192919066
Change-Id: I2084abe9588ead675414c4945fd4dc19bd1612b8
Signed-off-by: Lucas Wei <lucaswei@google.com>
2021-08-03 16:41:39 +08:00
Greg Kroah-Hartman
6c5d14c2ed Merge 4.9.272 into android-4.9-q
Changes in 4.9.272
	net: usb: cdc_ncm: don't spew notifications
	efi: Allow EFI_MEMORY_XP and EFI_MEMORY_RO both to be cleared
	efi: cper: fix snprintf() use in cper_dimm_err_location()
	vfio/pci: Fix error return code in vfio_ecap_init()
	vfio/pci: zap_vma_ptes() needs MMU
	vfio/platform: fix module_put call in error flow
	ipvs: ignore IP_VS_SVC_F_HASHED flag when adding service
	HID: pidff: fix error return code in hid_pidff_init()
	HID: i2c-hid: fix format string mismatch
	netfilter: nfnetlink_cthelper: hit EBUSY on updates if size mismatches
	ieee802154: fix error return code in ieee802154_add_iface()
	ieee802154: fix error return code in ieee802154_llsec_getparams()
	Bluetooth: fix the erroneous flush_work() order
	Bluetooth: use correct lock to prevent UAF of hdev object
	net: caif: added cfserl_release function
	net: caif: add proper error handling
	net: caif: fix memory leak in caif_device_notify
	net: caif: fix memory leak in cfusbl_device_notify
	ALSA: timer: Fix master timer notification
	ext4: fix bug on in ext4_es_cache_extent as ext4_split_extent_at failed
	pid: take a reference when initializing `cad_pid`
	ocfs2: fix data corruption by fallocate
	nfc: fix NULL ptr dereference in llcp_sock_getname() after failed connect
	btrfs: fix error handling in btrfs_del_csums
	btrfs: fixup error handling in fixup_inode_link_counts
	bnxt_en: Remove the setting of dev_port.
	KVM: SVM: Truncate GPR value for DR and CR accesses in !64-bit mode
	arm64: Remove unimplemented syscall log message
	xen-pciback: redo VF placement in the virtual topology
	Linux 4.9.272

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Iaf3c73a2aedcc4749540fd03d820756200b26a90
2021-06-10 13:43:23 +02:00
Mark Rutland
f86c80515a pid: take a reference when initializing cad_pid
commit 0711f0d7050b9e07c44bc159bbc64ac0a1022c7f upstream.

During boot, kernel_init_freeable() initializes `cad_pid` to the init
task's struct pid.  Later on, we may change `cad_pid` via a sysctl, and
when this happens proc_do_cad_pid() will increment the refcount on the
new pid via get_pid(), and will decrement the refcount on the old pid
via put_pid().  As we never called get_pid() when we initialized
`cad_pid`, we decrement a reference we never incremented, can therefore
free the init task's struct pid early.  As there can be dangling
references to the struct pid, we can later encounter a use-after-free
(e.g.  when delivering signals).

This was spotted when fuzzing v5.13-rc3 with Syzkaller, but seems to
have been around since the conversion of `cad_pid` to struct pid in
commit 9ec52099e4 ("[PATCH] replace cad_pid by a struct pid") from the
pre-KASAN stone age of v2.6.19.

Fix this by getting a reference to the init task's struct pid when we
assign it to `cad_pid`.

Full KASAN splat below.

   ==================================================================
   BUG: KASAN: use-after-free in ns_of_pid include/linux/pid.h:153 [inline]
   BUG: KASAN: use-after-free in task_active_pid_ns+0xc0/0xc8 kernel/pid.c:509
   Read of size 4 at addr ffff23794dda0004 by task syz-executor.0/273

   CPU: 1 PID: 273 Comm: syz-executor.0 Not tainted 5.12.0-00001-g9aef892b2d15 #1
   Hardware name: linux,dummy-virt (DT)
   Call trace:
    ns_of_pid include/linux/pid.h:153 [inline]
    task_active_pid_ns+0xc0/0xc8 kernel/pid.c:509
    do_notify_parent+0x308/0xe60 kernel/signal.c:1950
    exit_notify kernel/exit.c:682 [inline]
    do_exit+0x2334/0x2bd0 kernel/exit.c:845
    do_group_exit+0x108/0x2c8 kernel/exit.c:922
    get_signal+0x4e4/0x2a88 kernel/signal.c:2781
    do_signal arch/arm64/kernel/signal.c:882 [inline]
    do_notify_resume+0x300/0x970 arch/arm64/kernel/signal.c:936
    work_pending+0xc/0x2dc

   Allocated by task 0:
    slab_post_alloc_hook+0x50/0x5c0 mm/slab.h:516
    slab_alloc_node mm/slub.c:2907 [inline]
    slab_alloc mm/slub.c:2915 [inline]
    kmem_cache_alloc+0x1f4/0x4c0 mm/slub.c:2920
    alloc_pid+0xdc/0xc00 kernel/pid.c:180
    copy_process+0x2794/0x5e18 kernel/fork.c:2129
    kernel_clone+0x194/0x13c8 kernel/fork.c:2500
    kernel_thread+0xd4/0x110 kernel/fork.c:2552
    rest_init+0x44/0x4a0 init/main.c:687
    arch_call_rest_init+0x1c/0x28
    start_kernel+0x520/0x554 init/main.c:1064
    0x0

   Freed by task 270:
    slab_free_hook mm/slub.c:1562 [inline]
    slab_free_freelist_hook+0x98/0x260 mm/slub.c:1600
    slab_free mm/slub.c:3161 [inline]
    kmem_cache_free+0x224/0x8e0 mm/slub.c:3177
    put_pid.part.4+0xe0/0x1a8 kernel/pid.c:114
    put_pid+0x30/0x48 kernel/pid.c:109
    proc_do_cad_pid+0x190/0x1b0 kernel/sysctl.c:1401
    proc_sys_call_handler+0x338/0x4b0 fs/proc/proc_sysctl.c:591
    proc_sys_write+0x34/0x48 fs/proc/proc_sysctl.c:617
    call_write_iter include/linux/fs.h:1977 [inline]
    new_sync_write+0x3ac/0x510 fs/read_write.c:518
    vfs_write fs/read_write.c:605 [inline]
    vfs_write+0x9c4/0x1018 fs/read_write.c:585
    ksys_write+0x124/0x240 fs/read_write.c:658
    __do_sys_write fs/read_write.c:670 [inline]
    __se_sys_write fs/read_write.c:667 [inline]
    __arm64_sys_write+0x78/0xb0 fs/read_write.c:667
    __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]
    invoke_syscall arch/arm64/kernel/syscall.c:49 [inline]
    el0_svc_common.constprop.1+0x16c/0x388 arch/arm64/kernel/syscall.c:129
    do_el0_svc+0xf8/0x150 arch/arm64/kernel/syscall.c:168
    el0_svc+0x28/0x38 arch/arm64/kernel/entry-common.c:416
    el0_sync_handler+0x134/0x180 arch/arm64/kernel/entry-common.c:432
    el0_sync+0x154/0x180 arch/arm64/kernel/entry.S:701

   The buggy address belongs to the object at ffff23794dda0000
    which belongs to the cache pid of size 224
   The buggy address is located 4 bytes inside of
    224-byte region [ffff23794dda0000, ffff23794dda00e0)
   The buggy address belongs to the page:
   page:(____ptrval____) refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4dda0
   head:(____ptrval____) order:1 compound_mapcount:0
   flags: 0x3fffc0000010200(slab|head)
   raw: 03fffc0000010200 dead000000000100 dead000000000122 ffff23794d40d080
   raw: 0000000000000000 0000000000190019 00000001ffffffff 0000000000000000
   page dumped because: kasan: bad access detected

   Memory state around the buggy address:
    ffff23794dd9ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
    ffff23794dd9ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
   >ffff23794dda0000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                      ^
    ffff23794dda0080: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
    ffff23794dda0100: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
   ==================================================================

Link: https://lkml.kernel.org/r/20210524172230.38715-1-mark.rutland@arm.com
Fixes: 9ec52099e4 ("[PATCH] replace cad_pid by a struct pid")
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Cc: Cedric Le Goater <clg@fr.ibm.com>
Cc: Christian Brauner <christian@brauner.io>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Cc: Kees Cook <keescook@chromium.org
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: Paul Mackerras <paulus@samba.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-06-10 12:42:36 +02:00
Lucas Wei
7c09313b44 Merge android-4.9-q (4.9.268) into android-msm-pixel-4.9-lts
Merge 4.9.268 into android-4.9-q
Linux 4.9.268
    net: hso: fix NULL-deref on disconnect regression
    x86/crash: Fix crash_setup_memmap_entries() out-of-bounds access
    ia64: tools: remove duplicate definition of ia64_mf() on ia64
    ia64: fix discontig.c section mismatches
    cavium/liquidio: Fix duplicate argument
    xen-netback: Check for hotplug-status existence before watching
    s390/entry: save the caller of psw_idle
    ARM: dts: Fix swapped mmc order for omap3
    HID: alps: fix error return code in alps_input_configured()
  * ext4: correct error label in ext4_rename()
      fs/ext4/namei.c
    net: hso: fix null-ptr-deref during tty device unregistration
    usbip: synchronize event handler with sysfs code paths
    usbip: vudc synchronize sysfs code paths
    usbip: stub-dev synchronize sysfs code paths
    usbip: add sysfs_lock to synchronize sysfs code paths
    usbip: Fix incorrect double assignment to udc->ud.tcp_rx
    ARM: 9071/1: uprobes: Don't hook on thumb instructions
    i40e: fix the panic when running bpf in xdpdrv mode
  * net: sit: Unregister catch-all devices
      net/ipv6/sit.c
    net: davicom: Fix regulator not turned off on failed probe
    scsi: libsas: Reset num_scatter if libata marks qc as NODATA
    Input: i8042 - fix Pegatron C15B ID entry
    pcnet32: Use pci_resource_len to validate PCI resource
    net: ieee802154: forbid monitor for add llsec seclevel
    net: ieee802154: stop dump llsec seclevels for monitors
    net: ieee802154: forbid monitor for add llsec devkey
    net: ieee802154: stop dump llsec devkeys for monitors
    net: ieee802154: forbid monitor for add llsec dev
    net: ieee802154: stop dump llsec devs for monitors
    net: ieee802154: stop dump llsec keys for monitors
    ASoC: fsl_esai: Fix TDM slot setup for I2S mode
    ARM: keystone: fix integer overflow warning
  * neighbour: Disregard DEAD dst in neigh_update
      net/core/neighbour.c
    arc: kernel: Return -EFAULT if copy_to_user() fails
    ARM: dts: Fix moving mmc devices with aliases for omap4 & 5
  * dmaengine: dw: Make it dependent to HAS_IOMEM
      drivers/dma/dw/Kconfig
    Input: nspire-keypad - enable interrupts only when opened
    net/sctp: fix race condition in sctp_destroy_sock
    Merge 4.9.267 into android-4.9-q
Linux 4.9.267
    xen/events: fix setting irq affinity
    perf map: Tighten snprintf() string precision to pass gcc check on some 32-bit arches
  * netfilter: x_tables: fix compat match/target pad out-of-bound write
      net/ipv4/netfilter/arp_tables.c
      net/ipv4/netfilter/ip_tables.c
      net/ipv6/netfilter/ip6_tables.c
      net/netfilter/x_tables.c
    gfs2: report "already frozen/thawed" errors
    drm/imx: imx-ldb: fix out of bounds array access warning
    Revert "cifs: Set CIFS_MOUNT_USE_PREFIX_PATH flag on setting cifs_sb->prepath."
    net: ieee802154: stop dump llsec params for monitors
    net: ieee802154: forbid monitor for del llsec seclevel
    net: ieee802154: forbid monitor for set llsec params
    net: ieee802154: fix nl802154 del llsec devkey
    net: ieee802154: fix nl802154 add llsec key
    net: ieee802154: fix nl802154 del llsec dev
    net: ieee802154: fix nl802154 del llsec key
    net: ieee802154: nl-mac: fix check on panid
    net: mac802154: Fix general protection fault
    drivers: net: fix memory leak in peak_usb_create_dev
    drivers: net: fix memory leak in atusb_probe
  * net: tun: set tun->dev->addr_len during TUNSETLINK processing
      drivers/net/tun.c
  * cfg80211: remove WARN_ON() in cfg80211_sme_connect
      net/wireless/sme.c
    usbip: fix vudc usbip_sockfd_store races leading to gpf
  * mm: add cond_resched() in gather_pte_stats()
      fs/proc/task_mmu.c
    clk: socfpga: fix iomem pointer cast on 64-bit
    RDMA/cxgb4: check for ipv6 address properly while destroying listener
    s390/cpcmd: fix inline assembly register clobbering
  * workqueue: Move the position of debug_work_activate() in __queue_work()
      kernel/workqueue.c
  * clk: fix invalid usage of list cursor in unregister
      drivers/clk/clk.c
    soc/fsl: qbman: fix conflicting alignment attributes
    net:tipc: Fix a double free in tipc_sk_mcast_rcv
    gianfar: Handle error code at MAC address change
    sch_red: fix off-by-one checks in red_check_params()
    net: sched: sch_teql: fix null-pointer dereference
    batman-adv: initialize "struct batadv_tvlv_tt_vlan_data"->reserved field
    parisc: avoid a warning on u8 cast for cmpxchg on u8 pointers
  * parisc: parisc-agp requires SBA IOMMU driver
      drivers/char/agp/Kconfig
  * fs: direct-io: fix missing sdio->boundary
      fs/direct-io.c
    ocfs2: fix deadlock between setattr and dio_end_io_write
    ia64: fix user_stack_pointer() for ptrace()
  * net: ipv6: check for validity before dereferencing cfg->fc_nlinfo.nlh
      net/ipv6/route.c
    xen/evtchn: Change irq_info lock to raw_spinlock_t
    nfc: Avoid endless loops caused by repeated llcp_sock_connect()
    nfc: fix memory leak in llcp_sock_connect()
    nfc: fix refcount leak in llcp_sock_connect()
    nfc: fix refcount leak in llcp_sock_bind()
    ASoC: intel: atom: Stop advertising non working S24LE support
    ALSA: aloop: Fix initialization of controls
    iio: hid-sensor-prox: Fix scale not correct issue
    ARM: 8723/2: always assume the "unified" syntax for assembly code
    Merge 4.9.266 into android-4.9-q
Linux 4.9.266
    can: flexcan: flexcan_chip_freeze(): fix chip freeze for missing bitrate
  * init/Kconfig: make COMPILE_TEST depend on HAS_IOMEM
      init/Kconfig
  * init/Kconfig: make COMPILE_TEST depend on !S390
      init/Kconfig
    ALSA: hda/realtek - Fix pincfg for Dell XPS 13 9370
    bpf, x86: Validate computation of branch displacements for x86-64
    cifs: Silently ignore unknown oplock break handle
    cifs: revalidate mapping when we open files for SMB1 POSIX
    ia64: mca: allocate early mca with GFP_ATOMIC
    scsi: target: pscsi: Clean up after failure in pscsi_map_sg()
    x86/build: Turn off -fcf-protection for realmode targets
  * drm/msm: Ratelimit invalid-fence message
      drivers/gpu/drm/msm/msm_fence.c
    mac80211: choose first enabled channel for monitor
    mISDN: fix crash in fritzpci
    net: pxa168_eth: Fix a potential data race in pxa168_eth_remove
    Merge 4.9.265 into android-4.9-q
Linux 4.9.265
  * audit: fix a net reference leak in audit_list_rules_send()
      kernel/audit.c
      kernel/audit.h
      kernel/auditfilter.c
  * audit: fix a net reference leak in audit_send_reply()
      kernel/audit.c
    staging: rtl8192e: Change state information from u16 to u8
    staging: rtl8192e: Fix incorrect source in memcpy()
    USB: cdc-acm: fix use-after-free after probe failure
    USB: cdc-acm: downgrade message to debug
    cdc-acm: fix BREAK rx code path adding necessary calls
    usb: xhci-mtk: fix broken streams issue on 0.96 xHCI
  * USB: quirks: ignore remote wake-up on Fibocom L850-GL LTE modem
      drivers/usb/core/quirks.c
    firewire: nosy: Fix a use-after-free bug in nosy_ioctl()
  * extcon: Fix error handling in extcon_dev_register
      drivers/extcon/extcon.c
    pinctrl: rockchip: fix restore error in resume
    reiserfs: update reiserfs_xattrs_initialized() condition
  * mm: fix race by making init_zero_pfn() early_initcall
      mm/memory.c
  * tracing: Fix stack trace event size
      kernel/trace/trace.c
    ALSA: hda/realtek: call alc_update_headset_mode() in hp_automute_hook
  * ALSA: usb-audio: Apply sample rate quirk to Logitech Connect
      sound/usb/quirks.c
  * bpf: Remove MTU check in __bpf_skb_max_len
      net/core/filter.c
    net: wan/lmc: unregister device when no matching device is found
    appletalk: Fix skb allocation size in loopback case
  * ext4: do not iput inode under running transaction in ext4_rename()
      fs/ext4/namei.c
    ASoC: rt5659: Update MCLK rate in set_sysclk()
    staging: comedi: cb_pcidas64: fix request_irq() warn
    staging: comedi: cb_pcidas: fix request_irq() warn
    scsi: qla2xxx: Fix broken #endif placement
    scsi: st: Fix a use after free in st_open()
    vhost: Fix vhost_vq_reset()
    powerpc: Force inlining of cpu_has_feature() to avoid build failure
    ASoC: sgtl5000: set DAP_AVC_CTRL register to correct default value on probe
    ASoC: rt5651: Fix dac- and adc- vol-tlv values being off by a factor of 10
    ASoC: rt5640: Fix dac- and adc- vol-tlv values being off by a factor of 10
    rpc: fix NULL dereference on kmalloc failure
  * ext4: fix bh ref count on error paths
      fs/ext4/inode.c
  * ipv6: weaken the v4mapped source check
      net/ipv6/ip6_input.c
      net/ipv6/tcp_ipv6.c
    selinux: vsock: Set SID for socket returned by accept()

Bug: 187007303
Change-Id: I45a9b1e03f1bf070aa6be7c06a7a0cb906380f57
Signed-off-by: Lucas Wei <lucaswei@google.com>
2021-05-19 21:03:59 +08:00
Greg Kroah-Hartman
3aa44f037c Merge 4.9.266 into android-4.9-q
Changes in 4.9.266
	net: pxa168_eth: Fix a potential data race in pxa168_eth_remove
	mISDN: fix crash in fritzpci
	mac80211: choose first enabled channel for monitor
	drm/msm: Ratelimit invalid-fence message
	x86/build: Turn off -fcf-protection for realmode targets
	scsi: target: pscsi: Clean up after failure in pscsi_map_sg()
	ia64: mca: allocate early mca with GFP_ATOMIC
	cifs: revalidate mapping when we open files for SMB1 POSIX
	cifs: Silently ignore unknown oplock break handle
	bpf, x86: Validate computation of branch displacements for x86-64
	ALSA: hda/realtek - Fix pincfg for Dell XPS 13 9370
	init/Kconfig: make COMPILE_TEST depend on !S390
	init/Kconfig: make COMPILE_TEST depend on HAS_IOMEM
	can: flexcan: flexcan_chip_freeze(): fix chip freeze for missing bitrate
	Linux 4.9.266

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ideb53e8ee50a93273d83f69e3dfd8c211967b4fb
2021-04-10 14:14:30 +02:00
Masahiro Yamada
eb9e7f08c0 init/Kconfig: make COMPILE_TEST depend on HAS_IOMEM
commit ea29b20a828511de3348334e529a3d046a180416 upstream.

I read the commit log of the following two:

- bc083a64b6 ("init/Kconfig: make COMPILE_TEST depend on !UML")
- 334ef6ed06fa ("init/Kconfig: make COMPILE_TEST depend on !S390")

Both are talking about HAS_IOMEM dependency missing in many drivers.

So, 'depends on HAS_IOMEM' seems the direct, sensible solution to me.

This does not change the behavior of UML. UML still cannot enable
COMPILE_TEST because it does not provide HAS_IOMEM.

The current dependency for S390 is too strong. Under the condition of
CONFIG_PCI=y, S390 provides HAS_IOMEM, hence can enable COMPILE_TEST.

I also removed the meaningless 'default n'.

Link: https://lkml.kernel.org/r/20210224140809.1067582-1-masahiroy@kernel.org
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Cc: Heiko Carstens <hca@linux.ibm.com>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Arnd Bergmann <arnd@kernel.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: KP Singh <kpsingh@google.com>
Cc: Nathan Chancellor <nathan@kernel.org>
Cc: Nick Terrell <terrelln@fb.com>
Cc: Quentin Perret <qperret@google.com>
Cc: Valentin Schneider <valentin.schneider@arm.com>
Cc: "Enrico Weigelt, metux IT consult" <lkml@metux.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-04-10 13:04:45 +02:00
Heiko Carstens
aeeb58019e init/Kconfig: make COMPILE_TEST depend on !S390
commit 334ef6ed06fa1a54e35296b77b693bcf6d63ee9e upstream.

While allmodconfig and allyesconfig build for s390 there are also
various bots running compile tests with randconfig, where PCI is
disabled. This reveals that a lot of drivers should actually depend on
HAS_IOMEM.
Adding this to each device driver would be a never ending story,
therefore just disable COMPILE_TEST for s390.

The reasoning is more or less the same as described in
commit bc083a64b6 ("init/Kconfig: make COMPILE_TEST depend on !UML").

Reported-by: kernel test robot <lkp@intel.com>
Suggested-by: Arnd Bergmann <arnd@kernel.org>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-04-10 13:04:45 +02:00
Lucas Wei
4b93cc8b15 Merge android-4.9-q (4.9.254) into android-msm-pixel-4.9-lts
Merge 4.9.254 into android-4.9-q
Linux 4.9.254
    x86/boot/compressed: Disable relocation relaxation
  * tracing: Fix race in trace_open and buffer resize call
      kernel/trace/ring_buffer.c
  * Revert "mm/slub: fix a memory leak in sysfs_slab_add()"
      mm/slub.c
    net: dsa: b53: fix an off by one in checking "vlan->vid"
    net_sched: avoid shift-out-of-bounds in tcindex_set_parms()
  * ipv6: create multicast route with RTPROT_KERNEL
      net/ipv6/addrconf.c
  * skbuff: back tiny skbs with kmalloc() in __netdev_alloc_skb() too
      net/core/skbuff.c
    sh_eth: Fix power down vs. is_opened flag ordering
    sh: dma: fix kconfig dependency for G2_DMA
  * netfilter: rpfilter: mask ecn bits before fib lookup
      net/ipv4/netfilter/ipt_rpfilter.c
  * compiler.h: Raise minimum version of GCC to 5.1 for arm64
      include/linux/compiler-gcc.h
  * bpf: Fix buggy rsh min/max bounds tracking
      kernel/bpf/verifier.c
    xhci: tegra: Delay for disabling LFPS detector
  * xhci: make sure TRB is fully written before giving it to the controller
      drivers/usb/host/xhci-ring.c
  * usb: bdc: Make bdc pci driver depend on BROKEN
      drivers/usb/gadget/udc/bdc/Kconfig
  * usb: udc: core: Use lock when write to soft_connect
      drivers/usb/gadget/udc/core.c
    USB: ehci: fix an interrupt calltrace error
    ehci: fix EHCI host controller initialization sequence
    stm class: Fix module init return on allocation failure
    iio: ad5504: Fix setting power-down state
    can: dev: can_restart: fix use after free bug
    i2c: octeon: check correct size of maximum RECV_LEN packet
    drm/nouveau/i2c/gm200: increase width of aux semaphore owner fields
    drm/nouveau/bios: fix issue shadowing expansion ROMs
  * scsi: ufs: Correct the LUN used in eh_device_reset_handler() callback
      drivers/scsi/ufs/ufshcd.c
    ASoC: Intel: haswell: Add missing pm_ops
  * dm: avoid filesystem lookup in dm_get_dev_t()
      drivers/md/dm-table.c
    ACPI: scan: Make acpi_bus_get_device() clear return pointer on error
    ALSA: hda/via: Add minimum mute flag
    ALSA: seq: oss: Fix missing error check in snd_seq_oss_synth_make_info()
    Merge 4.9.253 into android-4.9-q
Linux 4.9.253
    spi: cadence: cache reference clock rate during probe
    tipc: fix NULL deref in tipc_link_xmit()
    rxrpc: Fix handling of an unsupported token type in rxrpc_read()
  * net: avoid 32 x truesize under-estimation for tiny skbs
      net/core/skbuff.c
  * net: sit: unregister_netdevice on newlink's error path
      net/ipv6/sit.c
    net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands
    net: dcb: Validate netlink message in DCB handler
    rndis_host: set proper input size for OID_GEN_PHYSICAL_MEDIUM request
    netxen_nic: fix MSI/MSI-x interrupts
  * net: cdc_ncm: correct overhead in delayed_ndp_size
      drivers/net/usb/cdc_ncm.c
    nfsd4: readdirplus shouldn't return parent of export
    usb: ohci: Make distrust_firmware param default to false
  * netfilter: conntrack: fix reading nf_conntrack_buckets
      net/netfilter/nf_conntrack_standalone.c
    net: sunrpc: interpret the return value of kstrtou32 correctly
  * mm, slub: consider rest of partial list if acquire_slab() fails
      mm/slub.c
    RDMA/usnic: Fix memleak in find_free_vf_and_create_qp_grp
  * ext4: fix superblock checksum failure when setting password salt
      fs/ext4/ioctl.c
    NFS: nfs_igrab_and_active must first reference the superblock
  * dump_common_audit_data(): fix racy accesses to ->d_name
      security/lsm_audit.c
  * Input: uinput - avoid FF flush when destroying device
      drivers/input/ff-core.c
      drivers/input/misc/uinput.c
      include/linux/input.h
    ARM: picoxcell: fix missing interrupt-parent properties
  * ACPI: scan: add stub acpi_create_platform_device() for !CONFIG_ACPI
      include/linux/acpi.h
    net: ethernet: fs_enet: Add missing MODULE_LICENSE
  * misdn: dsp: select CONFIG_BITREVERSE
      drivers/isdn/mISDN/Kconfig
    arch/arc: add copy_user_page() to <asm/page.h> to fix build error on ARC
    ethernet: ucc_geth: fix definition and size of ucc_geth_tx_global_pram
    ARC: build: add boot_targets to PHONY
  * ext4: fix bug for rename with RENAME_WHITEOUT
      fs/ext4/namei.c
    mm/hugetlb: fix potential missing huge page size info
    ACPI: scan: Harden acpi_device_add() against device ID overflows
    MIPS: relocatable: fix possible boot hangup with KASLR enabled
    MIPS: boot: Fix unaligned access with CONFIG_MIPS_RAW_APPENDED_DTB
  * ASoC: dapm: remove widget from dirty list on free
      sound/soc/soc-dapm.c
    Merge 4.9.252 into android-4.9-q
Linux 4.9.252
  * net: drop bogus skb with CHECKSUM_PARTIAL and offset beyond end of trimmed packet
      net/core/skbuff.c
  * block: fix use-after-free in disk_part_iter_next
      block/genhd.c
    KVM: arm64: Don't access PMCR_EL0 when no PMU is available
  * wan: ds26522: select CONFIG_BITREVERSE
      drivers/net/wan/Kconfig
    net/mlx5e: Fix memleak in mlx5e_create_l2_table_groups
    iommu/intel: Fix memleak in intel_irq_remapping_alloc
  * block: rsxx: select CONFIG_CRC32
      drivers/block/Kconfig
  * wil6210: select CONFIG_CRC32
      drivers/net/wireless/ath/wil6210/Kconfig
    dmaengine: xilinx_dma: fix mixed_enum_type coverity warning
    dmaengine: xilinx_dma: check dma_async_device_register return value
    cpufreq: powernow-k8: pass policy rather than use cpufreq_cpu_get()
    ARM: OMAP2+: omap_device: fix idling of devices during probe
    spi: pxa2xx: Fix use-after-free on unbind
    ubifs: wbuf: Don't leak kernel memory to flash
    drm/i915: Fix mismatch between misplaced vma check and vma insert
  * vmlinux.lds.h: Add PGO and AutoFDO input sections
      include/asm-generic/vmlinux.lds.h
  * net: fix pmtu check in nopmtudisc mode
      net/ipv4/ip_tunnel.c
  * net: ip: always refragment ip defragmented packets
      net/ipv4/ip_output.c
    powerpc: Fix incorrect stw{, ux, u, x} instructions in __set_pte_at
    target: add XCOPY target/segment desc sense codes
    scsi: target: Fix XCOPY NAA identifier lookup
    xcopy: loop over devices using idr helper
    target: use XCOPY segment descriptor CSCD IDs
    target: simplify XCOPY wwn->se_dev lookup helper
    target: bounds check XCOPY segment descriptor list
    ANDROID: cuttlefish_defconfig: add missing CONFIG_BLK_CGROUP
    Merge 4.9.251 into android-4.9-q
Linux 4.9.251
    x86/mtrr: Correct the range check before performing MTRR type lookups
    netfilter: xt_RATEEST: reject non-null terminated string from userspace
    netfilter: ipset: fix shift-out-of-bounds in htable_bits()
  * Revert "device property: Keep secondary firmware node secondary by type"
      drivers/base/core.c
    ALSA: hda/conexant: add a new hda codec CX11970
    x86/mm: Fix leak of pmd ptlock
    USB: serial: keyspan_pda: remove unused variable
  * usb: gadget: configfs: Fix use-after-free issue with udc_name
      drivers/usb/gadget/configfs.c
  * usb: gadget: configfs: Preserve function ordering after bind failure
      drivers/usb/gadget/configfs.c
  * usb: gadget: Fix spinlock lockup on usb_function_deactivate
      drivers/usb/gadget/composite.c
    USB: gadget: legacy: fix return error code in acm_ms_bind()
    usb: gadget: function: printer: Fix a memory leak for interface descriptor
    usb: gadget: f_uac2: reset wMaxPacketSize
  * usb: gadget: select CONFIG_CRC32
      drivers/usb/gadget/Kconfig
  * ALSA: usb-audio: Fix UBSAN warnings for MIDI jacks
      sound/usb/midi.c
    USB: usblp: fix DMA to stack
    USB: yurex: fix control-URB timeout handling
    USB: serial: option: add LongSung M5710 module support
    USB: serial: iuu_phoenix: fix DMA from stack
    usb: uas: Add PNY USB Portable SSD to unusual_uas
  * USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk set
      drivers/usb/host/xhci.c
    usb: chipidea: ci_hdrc_imx: add missing put_device() call in usbmisc_get_init_data()
    USB: cdc-acm: blacklist another IR Droid device
  * usb: gadget: enable super speed plus
      drivers/usb/gadget/configfs.c
    video: hyperv_fb: Fix the mmap() regression for v5.4.y and older
    scripts/gdb: fix lx-version string output
    scripts/gdb: lx-dmesg: use explicit encoding=utf8 errors=replace
    scripts/gdb: lx-dmesg: cast log_buf to void* for addr fetch
    scripts/gdb: make lx-dmesg command work (reliably)
    virtio_net: Fix recursive call to cpus_read_lock()
    net: sched: prevent invalid Scell_log shift count
    vhost_net: fix ubuf refcount incorrectly when sendmsg fails
  * CDC-NCM: remove "connected" log message
      drivers/net/usb/cdc_ncm.c
    net: hdlc_ppp: Fix issues when mod_timer is called while timer is running
    net: hns: fix return value check in __lb_other_process()
  * ipv4: Ignore ECN bits for fib lookups in fib_compute_spec_dst()
      net/ipv4/fib_frontend.c
    net: ethernet: Fix memleak in ethoc_probe
    net/ncsi: Use real net-device for response handler
    atm: idt77252: call pci_disable_device() on error path
    ethernet: ucc_geth: fix use-after-free in ucc_geth_remove()
  * depmod: handle the case of /sbin/depmod without /sbin in PATH
      scripts/depmod.sh
  * lib/genalloc: fix the overflow when size is too big
      lib/genalloc.c
  * workqueue: Kick a worker based on the actual activation of delayed works
      kernel/workqueue.c
  * kbuild: don't hardcode depmod path
      Makefile
    Merge 4.9.250 into android-4.9-q
Linux 4.9.250
    mwifiex: Fix possible buffer overflows in mwifiex_cmd_802_11_ad_hoc_start
    iio:magnetometer:mag3110: Fix alignment and data leak issues.
    iio:imu:bmi160: Fix alignment and data leak issues
    iio:imu:bmi160: Fix too large a buffer.
    iio: bmi160_core: Fix sparse warning due to incorrect type in assignment
    xenbus/xenbus_backend: Disallow pending watch messages
    xen/xenbus: Count pending messages for each watch
    xen/xenbus/xen_bus_type: Support will_handle watch callback
    xen/xenbus: Add 'will_handle' callback support in xenbus_watch_path()
    xen/xenbus: Allow watches discard events before queueing
  * kdev_t: always inline major/minor helper functions
      include/linux/kdev_t.h
  * module: delay kobject uevent until after module init call
      kernel/module.c
    powerpc: sysdev: add missing iounmap() on error in mpic_msgr_probe()
  * quota: Don't overflow quota file offsets
      fs/quota/quota_tree.c
  * module: set MODULE_STATE_GOING state when a module fails to load
      kernel/module.c
    ALSA: seq: Use bool for snd_seq_queue internal flags
    media: gp8psk: initialize stats at power control logic
    misc: vmw_vmci: fix kernel info-leak by initializing dbells in vmci_ctx_get_chkpt_doorbells()
    reiserfs: add check for an invalid ih_entry_count
  * of: fix linker-section match-table corruption
      include/linux/of.h
  * uapi: move constants from <linux/kernel.h> to <linux/const.h>
      include/uapi/linux/const.h
      include/uapi/linux/ethtool.h
      include/uapi/linux/kernel.h
      include/uapi/linux/mroute6.h
      include/uapi/linux/netfilter/x_tables.h
      include/uapi/linux/netlink.h
      include/uapi/linux/sysctl.h
  * l2tp: fix races with ipv4-mapped ipv6 addresses
      net/l2tp/l2tp_core.c
      net/l2tp/l2tp_core.h
  * net: ipv6: keep sk status consistent after datagram connect failure
      net/ipv6/datagram.c
    USB: serial: digi_acceleport: fix write-wakeup deadlocks
    s390/dasd: fix hanging device offline processing
    vfio/pci: Move dummy_resources_list init in vfio_pci_probe()
    ALSA: hda/realtek - Dell headphone has noise on unmute for ALC236
    ALSA: hda - Fix a wrong FIXUP for alc289 on Dell machines
    ALSA: hda/realtek - Support Dell headset mode for ALC3271
  * ALSA: usb-audio: fix sync-ep altsetting sanity check
      sound/usb/pcm.c
  * ALSA: usb-audio: simplify set_sync_ep_implicit_fb_quirk
      sound/usb/pcm.c
    ALSA: hda/ca0132 - Fix work handling in delayed HP detection
    x86/entry/64: Add instruction suffix
  * ANDROID: usb: f_accessory: Don't drop NULL reference in acc_disconnect()
      drivers/usb/gadget/function/f_accessory.c
  * ANDROID: usb: f_accessory: Avoid bitfields for shared variables
      drivers/usb/gadget/function/f_accessory.c
  * ANDROID: usb: f_accessory: Cancel any pending work before teardown
      drivers/usb/gadget/function/f_accessory.c
  * ANDROID: usb: f_accessory: Don't corrupt global state on double registration
      drivers/usb/gadget/function/f_accessory.c
  * ANDROID: usb: f_accessory: Fix teardown ordering in acc_release()
      drivers/usb/gadget/function/f_accessory.c
  * ANDROID: usb: f_accessory: Add refcounting to global 'acc_dev'
      drivers/usb/gadget/function/f_accessory.c
  * UPSTREAM: locking/atomic, kref: Add KREF_INIT()
      fs/fuse/fuse_i.h
      include/linux/kref.h
      init/version.c
      kernel/pid.c
  * ANDROID: usb: f_accessory: Wrap '_acc_dev' in get()/put() accessors
      drivers/usb/gadget/function/f_accessory.c
  * ANDROID: usb: f_accessory: Remove useless assignment
      drivers/usb/gadget/function/f_accessory.c
  * ANDROID: usb: f_accessory: Remove useless non-debug prints
      drivers/usb/gadget/function/f_accessory.c
  * ANDROID: usb: f_accessory: Remove stale comments
      drivers/usb/gadget/function/f_accessory.c
  * ANDROID: USB: f_accessory: Check dev pointer before decoding ctrl request
      drivers/usb/gadget/function/f_accessory.c
  * ANDROID: usb: gadget: f_accessory: fix CTS test stuck
      drivers/usb/gadget/function/f_accessory.c
    Merge 4.9.249 into android-4.9-q
Linux 4.9.249
  * PCI: Fix pci_slot_release() NULL pointer dereference
      drivers/pci/slot.c
    xen-blkback: set ring->xenblkd to NULL after kthread_stop()
    clk: mvebu: a3700: fix the XTAL MODE pin to MPP1_9
    iio:pressure:mpl3115: Force alignment of buffer
    iio: adc: rockchip_saradc: fix missing clk_disable_unprepare() on error in rockchip_saradc_resume
    iio: buffer: Fix demux update
    mtd: parser: cmdline: Fix parsing of part-names with colons
    soc: qcom: smp2p: Safely acquire spinlock without IRQs
    spi: st-ssc4: Fix unbalanced pm_runtime_disable() in probe error path
    spi: sc18is602: Don't leak SPI master in probe error path
    spi: rb4xx: Don't leak SPI master in probe error path
    spi: pic32: Don't leak DMA channels in probe error path
    spi: davinci: Fix use-after-free on unbind
    spi: spi-sh: Fix use-after-free on unbind
    drm/dp_aux_dev: check aux_dev before use in drm_dp_aux_dev_get_by_minor()
    jfs: Fix array index bounds check in dbAdjTree
    jffs2: Fix GC exit abnormally
    ceph: fix race in concurrent __ceph_remove_cap invocations
    powerpc/xmon: Change printk() to pr_cont()
  * KVM: arm64: Introduce handling of AArch32 TTBCR2 traps
      arch/arm64/include/asm/kvm_host.h
  * ext4: fix a memory leak of ext4_free_data
      fs/ext4/mballoc.c
    btrfs: fix return value mixup in btrfs_get_extent
    Btrfs: fix selftests failure due to uninitialized i_mode in test inodes
    btrfs: scrub: Don't use inode page cache in scrub_handle_errored_block()
    btrfs: quota: Set rescan progress to (u64)-1 if we hit last leaf
    USB: serial: keyspan_pda: fix write unthrottling
    USB: serial: keyspan_pda: fix tx-unthrottle use-after-free
    USB: serial: keyspan_pda: fix write-wakeup use-after-free
    USB: serial: keyspan_pda: fix stalled writes
    USB: serial: keyspan_pda: fix write deadlock
    USB: serial: keyspan_pda: fix dropped unthrottle interrupts
    USB: serial: mos7720: fix parallel-port state restore
    powerpc/perf: Exclude kernel samples while counting events in user space.
    staging: comedi: mf6x4: Fix AI end-of-conversion detection
    s390/dasd: fix list corruption of lcu list
    s390/dasd: fix list corruption of pavgroup group list
    s390/dasd: prevent inconsistent LCU device data
  * ALSA: usb-audio: Disable sample read check if firmware doesn't give back
      sound/usb/clock.c
    ALSA: pcm: oss: Fix a few more UBSAN fixes
    ACPI: PNP: compare the string length in the matching_id()
    Revert "ACPI / resources: Use AE_CTRL_TERMINATE to terminate resources walks"
    Input: cyapa_gen6 - fix out-of-bounds stack access
    media: netup_unidvb: Don't leak SPI master in probe error path
    media: sunxi-cir: ensure IR is handled when it is continuous
    media: gspca: Fix memory leak in probe
    Input: goodix - add upside-down quirk for Teclast X98 Pro tablet
    Input: cros_ec_keyb - send 'scancodes' in addition to key events
  * cfg80211: initialize rekey_data
      net/wireless/nl80211.c
    clk: s2mps11: Fix a resource leak in error handling paths in the probe function
    qlcnic: Fix error code in probe
    perf record: Fix memory leak when using '--user-regs=?' to list registers
    clk: ti: Fix memleak in ti_fapll_synth_setup
    watchdog: qcom: Avoid context switch in restart handler
    net: korina: fix return value
    net: allwinner: Fix some resources leak in the error handling path of the probe and in the remove function
    net: bcmgenet: Fix a resource leak in an error handling path in the probe functin
    checkpatch: fix unescaped left brace
    powerpc/ps3: use dma_mapping_error()
    nfc: s3fwrn5: Release the nfc firmware
    um: chan_xterm: Fix fd leak
    irqchip/alpine-msi: Fix freeing of interrupts on allocation error path
    ASoC: wm_adsp: remove "ctl" from list on error in wm_adsp_create_control()
    extcon: max77693: Fix modalias string
    clk: tegra: Fix duplicated SE clock entry
    x86/kprobes: Restore BTF if the single-stepping is cancelled
    nfs_common: need lock during iterate through the list
    nfsd: Fix message level for normal termination
    speakup: fix uninitialized flush_lock
    usb: oxu210hp-hcd: Fix memory leak in oxu_create
    usb: ehci-omap: Fix PM disable depth umbalance in ehci_hcd_omap_probe
    powerpc/pseries/hibernation: drop pseries_suspend_begin() from suspend ops
    scsi: fnic: Fix error return code in fnic_probe()
  * seq_buf: Avoid type mismatch for seq_buf_init
      include/linux/seq_buf.h
      include/linux/trace_seq.h
    scsi: pm80xx: Fix error return in pm8001_pci_probe()
    cpufreq: scpi: Add missing MODULE_ALIAS
    cpufreq: loongson1: Add missing MODULE_ALIAS
    cpufreq: st: Add missing MODULE_DEVICE_TABLE
    cpufreq: highbank: Add missing MODULE_DEVICE_TABLE
  * clocksource/drivers/arm_arch_timer: Correct fault programming of CNTKCTL_EL1.EVNTI
      drivers/clocksource/arm_arch_timer.c
  * dm ioctl: fix error return code in target_message
      drivers/md/dm-ioctl.c
    ASoC: jz4740-i2s: add missed checks for clk_get()
    memstick: r592: Fix error return in r592_probe()
    pinctrl: falcon: add missing put_device() call in pinctrl_falcon_probe()
    clocksource/drivers/cadence_ttc: Fix memory leak in ttc_setup_clockevent()
    media: saa7146: fix array overflow in vidioc_s_audio()
    vfio-pci: Use io_remap_pfn_range() for PCI IO memory
    NFS: switch nfsiod to be an UNBOUND workqueue.
    lockd: don't use interval-based rebinding over TCP
  * SUNRPC: xprt_load_transport() needs to support the netid "rdma6"
      include/linux/sunrpc/xprt.h
    NFSv4.2: condition READDIR's mask for security label based on LSM state
    ARM: dts: at91: at91sam9rl: fix ADC triggers
    HSI: omap_ssi: Don't jump to free ID in ssi_add_controller()
    mips: cdmm: fix use-after-free in mips_cdmm_bus_discover
    media: siano: fix memory leak of debugfs members in smsdvb_hotplug
    cw1200: fix missing destroy_workqueue() on error in cw1200_init_common
    orinoco: Move context allocation after processing the skb
    ARM: dts: at91: sama5d3_xplained: add pincontrol for USB Host
    ARM: dts: at91: sama5d4_xplained: add pincontrol for USB Host
    memstick: fix a double-free bug in memstick_check
    RDMA/cxgb4: Validate the number of CQEs
    drivers: soc: ti: knav_qmss_queue: Fix error return code in knav_queue_probe
    soc: ti: Fix reference imbalance in knav_dma_probe
    soc: ti: knav_qmss: fix reference leak in knav_queue_probe
    crypto: omap-aes - Fix PM disable depth imbalance in omap_aes_probe
    powerpc/feature: Fix CPU_FTRS_ALWAYS by removing CPU_FTRS_GENERIC_32
    Input: ads7846 - fix unaligned access on 7845
    Input: ads7846 - fix integer overflow on Rt calculation
    drm/omap: dmm_tiler: fix return error code in omap_dmm_probe()
    media: solo6x10: fix missing snd_card_free in error handling case
    staging: greybus: codecs: Fix reference counter leak in error handling
    MIPS: BCM47XX: fix kconfig dependency bug for BCM47XX_BCMA
    RDMa/mthca: Work around -Wenum-conversion warning
    spi: tegra114: fix reference leak in tegra spi ops
    spi: tegra20-sflash: fix reference leak in tegra_sflash_resume
    spi: tegra20-slink: fix reference leak in slink ops of tegra20
    spi: spi-ti-qspi: fix reference leak in ti_qspi_setup
  * Bluetooth: Fix null pointer dereference in hci_event_packet()
      net/bluetooth/hci_event.c
    arm64: dts: exynos: Correct psci compatible used on Exynos7
  * ASoC: pcm: DRAIN support reactivation
      sound/soc/soc-pcm.c
    spi: img-spfi: fix reference leak in img_spfi_resume
    crypto: talitos - Fix return type of current_desc_hdr()
    ARM: p2v: fix handling of LPAE translation in BE mode
    RDMA/rxe: Compute PSN windows correctly
    drm/gma500: fix double free of gma_connector
  * Bluetooth: Fix slab-out-of-bounds read in hci_le_direct_adv_report_evt()
      net/bluetooth/hci_event.c
    md: fix a warning caused by a race between concurrent md_ioctl()s
    media: msi2500: assign SPI bus number dynamically
  * serial_core: Check for port state when tty is in error state
      drivers/tty/serial/serial_core.c
    HID: i2c-hid: add Vero K147 to descriptor override
    ARM: dts: exynos: fix USB 3.0 pins supply being turned off on Odroid XU
    ARM: dts: exynos: fix USB 3.0 VBUS control and over-current pins on Exynos5410
    ARM: dts: exynos: fix roles of USB 3.0 ports on Odroid XU
    usb: chipidea: ci_hdrc_imx: Pass DISABLE_DEVICE_STREAMING flag to imx6ul
  * usb: gadget: f_fs: Re-use SS descriptors for SuperSpeedPlus
      drivers/usb/gadget/function/f_fs.c
    USB: gadget: f_rndis: fix bitrate for SuperSpeed and above
  * USB: gadget: f_midi: setup SuperSpeed Plus descriptors
      drivers/usb/gadget/function/f_midi.c
    USB: gadget: f_acm: add support for SuperSpeed Plus
    USB: serial: option: add interface-number sanity check to flag handling
    soc/tegra: fuse: Fix index bug in get_process_id
  * dm table: Remove BUG_ON(in_interrupt())
      drivers/md/dm-table.c
    scsi: mpt3sas: Increase IOCInit request timeout to 30s
    drm/tegra: sor: Disable clocks on error in tegra_sor_init()
  * kernel/cpu: add arch override for clear_tasks_mm_cpumask() mm handling
      kernel/cpu.c
    RDMA/cm: Fix an attempt to use non-valid pointer when cleaning timewait
    can: softing: softing_netdev_open(): fix error handling
  * scsi: bnx2i: Requires MMU
      drivers/scsi/bnx2i/Kconfig
    pinctrl: baytrail: Avoid clearing debounce value when turning it off
    pinctrl: merrifield: Set default bias in case no particular value given
    serial: 8250_omap: Avoid FIFO corruption caused by MDR1 access
    ALSA: pcm: oss: Fix potential out-of-bounds shift
  * USB: sisusbvga: Make console support depend on BROKEN
      drivers/usb/misc/sisusbvga/Kconfig
  * xhci: Give USB2 ports time to enter U3 in bus suspend
      drivers/usb/host/xhci-hub.c
  * ALSA: usb-audio: Fix control 'access overflow' errors from chmap
      sound/usb/stream.c
  * ALSA: usb-audio: Fix potential out-of-bounds shift
      sound/usb/format.c
  * USB: add RESET_RESUME quirk for Snapscan 1212
      drivers/usb/core/quirks.c
    USB: dummy-hcd: Fix uninitialized array use in init()
    mac80211: mesh: fix mesh_pathtbl_init() error path
    net: bridge: vlan: fix error return code in __vlan_add()
    net: stmmac: dwmac-meson8b: fix mask definition of the m250_sel mux
    net: stmmac: delete the eee_ctrl_timer after napi disabled
  * tcp: fix cwnd-limited bug for TSO deferral where we send nothing
      net/ipv4/tcp_output.c
    net/mlx4_en: Avoid scheduling restart task if it is already running
  * spi: Prevent adding devices below an unregistering controller
      drivers/spi/Kconfig
      drivers/spi/spi.c
    scsi: be2iscsi: Revert "Fix a theoretical leak in beiscsi_create_eqs()"
    pinctrl: amd: remove debounce filter setting in IRQ type setting
    Input: i8042 - add Acer laptops to the i8042 reset list
    Input: cm109 - do not stomp on control URB
    platform/x86: acer-wmi: add automatic keyboard background light toggle key as KEY_LIGHTS_TOGGLE
    ARC: stack unwinding: don't assume non-current task is sleeping
    arm64: dts: rockchip: Assign a fixed index to mmc devices on rk3399 boards.
    iwlwifi: pcie: limit memory read spin time
    spi: bcm2835aux: Restore err assignment in bcm2835aux_spi_probe
    spi: bcm2835aux: Fix use-after-free on unbind

Bug: 180663378
Change-Id: Icded594ca907f1cf0a53f7a506c1cb9e58cbc213
Signed-off-by: Lucas Wei <lucaswei@google.com>
2021-03-01 15:00:57 +00:00
lucaswei
f09d91fe02 Merge android-4.9-q (4.9.248) into android-msm-pixel-4.9-lts
Merge 4.9.248 into android-4.9-q
Linux 4.9.248
    x86/uprobes: Do not use prefixes.nbytes when looping over prefixes.bytes
    Input: i8042 - fix error return code in i8042_setup_aux()
    i2c: qup: Fix error return code in qup_i2c_bam_schedule_desc()
    gfs2: check for empty rgrp tree in gfs2_ri_update
  * tracing: Fix userstacktrace option for instances
      kernel/trace/trace.c
      kernel/trace/trace.h
    spi: bcm2835: Release the DMA channel if probe fails after dma_init
    spi: bcm2835: Fix use-after-free on unbind
    spi: bcm-qspi: Fix use-after-free on unbind
  * spi: Introduce device-managed SPI controller allocation
      drivers/spi/spi.c
      include/linux/spi/spi.h
    iommu/amd: Set DTE[IntTabLen] to represent 512 IRTEs
    i2c: imx: Check for I2SR_IAL after every byte
    i2c: imx: Fix reset of I2SR_IAL flag
    cifs: fix potential use-after-free in cifs_echo_request()
    ftrace: Fix updating FTRACE_FL_TRAMP
  * tty: Fix ->session locking
      drivers/tty/tty_io.c
      include/linux/tty.h
    ALSA: hda/generic: Add option to enforce preferred_dacs pairs
    ALSA: hda/realtek - Add new codec supported for ALC897
  * tty: Fix ->pgrp locking in tiocspgrp()
      drivers/tty/tty_io.c
    USB: serial: option: add support for Thales Cinterion EXS82
    USB: serial: option: add Fibocom NL668 variants
    USB: serial: ch341: sort device-id entries
    USB: serial: ch341: add new Product ID for CH341A
    USB: serial: kl5kusb105: fix memleak on open
  * usb: gadget: f_fs: Use local copy of descriptors for userspace copy
      drivers/usb/gadget/function/f_fs.c
  * vlan: consolidate VLAN parsing code and limit max parsing depth
      include/linux/if_vlan.h
      include/net/inet_ecn.h
    pinctrl: baytrail: Fix pin being driven low for a while on gpiod_get(..., GPIOD_OUT_HIGH)
    pinctrl: baytrail: Replace WARN with dev_info_once when setting direct-irq pin to output
    btrfs: sysfs: init devices outside of the chunk_mutex
    RDMA/i40iw: Address an mmap handler exploit in i40iw
  * spi: Fix controller unregister order harder
      drivers/spi/spi.c
    Input: i8042 - add ByteSpeed touchpad to noloop table
  * Input: xpad - support Ardwiino Controllers
      drivers/input/joystick/xpad.c
    dt-bindings: net: correct interrupt flags in examples
    net/mlx5: Fix wrong address reclaim when command interface is down
    net: pasemi: fix error return code in pasemi_mac_open()
    cxgb3: fix error return code in t3_sge_alloc_qset()
    net/x25: prevent a couple of overflows
    ibmvnic: Fix TX completion error handling
    ibmvnic: Ensure that SCRQ entry reads are correctly ordered
    netfilter: bridge: reset skb->pkt_type after NF_INET_POST_ROUTING traversal
  * bonding: wait for sysfs kobject destruction before freeing struct slave
      drivers/net/bonding/bond_main.c
      drivers/net/bonding/bond_sysfs_slave.c
      include/net/bonding.h
    usbnet: ipheth: fix connectivity with iOS 14
    rose: Fix Null pointer dereference in rose_send_frame()
    net/af_iucv: set correct sk_protocol for child sockets
    ANDROID: cuttlefish_defconfig: Disable CONFIG_KSM
    Merge 4.9.247 into android-4.9-q
Linux 4.9.247
  * USB: core: Fix regression in Hercules audio card
      drivers/usb/core/quirks.c
  * USB: core: add endpoint-blacklist quirk
      drivers/usb/core/config.c
      drivers/usb/core/quirks.c
      drivers/usb/core/usb.h
      include/linux/usb/quirks.h
  * regulator: workaround self-referent regulators
      drivers/regulator/core.c
  * regulator: avoid resolve_supply() infinite recursion
      drivers/regulator/core.c
    x86/speculation: Fix prctl() when spectre_v2_user={seccomp,prctl},ibpb
    usb: gadget: Fix memleak in gadgetfs_fill_super
  * usb: gadget: f_midi: Fix memleak in f_midi_alloc
      drivers/usb/gadget/function/f_midi.c
  * USB: core: Change %pK for __user pointers to %px
      drivers/usb/core/devio.c
    perf probe: Fix to die_entrypc() returns error correctly
    platform/x86: toshiba_acpi: Fix the wrong variable assignment
    can: gs_usb: fix endianess problem with candleLight firmware
    efivarfs: revert "fix memory leak in efivarfs_create()"
    ibmvnic: fix NULL pointer dereference in ibmvic_reset_crq
    net: ena: set initial DMA width to avoid intel iommu issue
    nfc: s3fwrn5: use signed integer for parsing GPIO numbers
    IB/mthca: fix return value of error branch in mthca_init_cq()
    bnxt_en: Release PCI regions when DMA mask setup fails during probe.
    video: hyperv_fb: Fix the cache type when mapping the VRAM
    bnxt_en: fix error return code in bnxt_init_board()
  * scsi: ufs: Fix race between shutdown and runtime resume flow
      drivers/scsi/ufs/ufshcd.c
    batman-adv: set .owner to THIS_MODULE
    phy: tegra: xusb: Fix dangling pointer on probe failure
    perf/x86: fix sysfs type mismatches
    scsi: target: iscsi: Fix cmd abort fabric stop race
    scsi: libiscsi: Fix NOP race condition
    dmaengine: pl330: _prep_dma_memcpy: Fix wrong burst size
  * proc: don't allow async path resolution of /proc/self components
      fs/proc/self.c
    x86/xen: don't unbind uninitialized lock_kicker_irq
    dmaengine: xilinx_dma: use readl_poll_timeout_atomic variant
    HID: hid-sensor-hub: Fix issue with devices with no report ID
    Input: i8042 - allow insmod to succeed on devices without an i8042 controller
  * HID: cypress: Support Varmilo Keyboards' media hotkeys
      drivers/hid/hid-ids.h
    ALSA: hda/hdmi: fix incorrect locking in hdmi_pcm_close
    ALSA: hda/hdmi: Use single mutex unlock in error paths
  * arm64: pgtable: Fix pte_accessible()
      arch/arm64/include/asm/pgtable.h
    btrfs: inode: Verify inode mode to avoid NULL pointer dereference
    btrfs: tree-checker: Enhance chunk checker to validate chunk profile
  * PCI: Add device even if driver attach failed
      drivers/pci/bus.c
    btrfs: fix lockdep splat when reading qgroup config on mount
    mm/userfaultfd: do not access vma->vm_mm after calling handle_userfault()
    perf event: Check ref_reloc_sym before using it
  * BACKPORT: arm64: SW PAN: Point saved ttbr0 at the zero page when switching to init_mm
      arch/arm64/include/asm/efi.h
      arch/arm64/include/asm/mmu_context.h
    Merge 4.9.246 into android-4.9-q
Linux 4.9.246
    x86/microcode/intel: Check patch signature before saving microcode for early loading
    s390/cpum_sf.c: fix file permission for cpum_sfb_size
    mac80211: free sta in sta_info_insert_finish() on errors
    mac80211: minstrel: fix tx status processing corner case
    mac80211: minstrel: remove deferred sampling code
    xtensa: disable preemption around cache alias management calls
  * regulator: fix memory leak with repeated set_machine_constraints()
      drivers/regulator/core.c
    iio: accel: kxcjk1013: Replace is_smo8500_device with an acpi_type enum
  * ext4: fix bogus warning in ext4_update_dx_flag()
      fs/ext4/ext4.h
    efivarfs: fix memory leak in efivarfs_create()
    tty: serial: imx: keep console clocks always on
    ALSA: mixart: Fix mutex deadlock
  * ALSA: ctl: fix error path at adding user-defined element set
      sound/core/control.c
    powerpc/uaccess-flush: fix missing includes in kup-radix.h
  * libfs: fix error cast of negative value in simple_attr_write()
      fs/libfs.c
    xfs: revert "xfs: fix rmap key and record comparison functions"
    regulator: ti-abb: Fix array out of bound read access on the first transition
    MIPS: Alchemy: Fix memleak in alchemy_clk_setup_cpu
    can: m_can: m_can_handle_state_change(): fix state change
    can: peak_usb: fix potential integer overflow on shift of a int
    can: dev: can_restart(): post buffer from the right context
    perf lock: Don't free "lock_seq_stat" if read_count isn't zero
    ARM: dts: imx50-evk: Fix the chip select 1 IOMUX
    arm: dts: imx6qdl-udoo: fix rgmii phy-mode for ksz9031 phy
    MIPS: export has_transparent_hugepage() for modules
    Input: adxl34x - clean up a data type in adxl34x_probe()
  * vfs: remove lockdep bogosity in __sb_start_write
      fs/super.c
  * arm64: psci: Avoid printing in cpu_psci_cpu_die()
      arch/arm64/kernel/psci.c
    pinctrl: rockchip: enable gpio pclk for rockchip_gpio_to_irq
    mlxsw: core: Use variable timeout for EMAD retries
    net: ftgmac100: Fix crash when removing driver
    tcp: only postpone PROBE_RTT if RTT is < current min_rtt estimate
    net: usb: qmi_wwan: Set DTR quirk for MR400
    sctp: change to hold/put transport for proto_unreach_timer
    qlcnic: fix error return code in qlcnic_83xx_restart_hw()
    net: x25: Increase refcnt of "struct x25_neigh" in x25_rx_call_request
    net/mlx4_core: Fix init_hca fields offset
  * netlabel: fix an uninitialized warning in netlbl_unlabel_staticlist()
      net/netlabel/netlabel_unlabeled.c
  * netlabel: fix our progress tracking in netlbl_unlabel_staticlist()
      net/netlabel/netlabel_unlabeled.c
    net: Have netpoll bring-up DSA management interface
  * net: bridge: add missing counters to ndo_get_stats64 callback
      net/bridge/br_device.c
    net: b44: fix error return code in b44_init_one()
  * inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill()
      net/ipv4/inet_diag.c
    devlink: Add missing genlmsg_cancel() in devlink_nl_sb_port_pool_fill()
    bnxt_en: read EEPROM A2h address using page 0
    atm: nicstar: Unmap DMA on send error
  * ah6: fix error return code in ah6_input()
      net/ipv6/ah6.c
    Merge 4.9.245 into android-4.9-q
Linux 4.9.245
    ACPI: GED: fix -Wformat
    KVM: x86: clflushopt should be treated as a no-op by emulation
    mac80211: always wind down STA state
    Input: sunkbd - avoid use-after-free in teardown paths
    powerpc/8xx: Always fault when _PAGE_ACCESSED is not set
    i2c: mux: pca954x: Add missing pca9546 definition to chip_desc
    i2c: imx: Fix external abort on interrupt in exit paths
    i2c: imx: use clk notifier for rate changes
    powerpc/64s: flush L1D after user accesses
    powerpc/uaccess: Evaluate macro arguments once, before user access is allowed
    powerpc: Fix __clear_user() with KUAP enabled
    powerpc: Implement user_access_begin and friends
    powerpc: Add a framework for user access tracking
    powerpc/64s: flush L1D on kernel entry
    powerpc/64s: move some exception handlers out of line
    powerpc/64s: Define MASKABLE_RELON_EXCEPTION_PSERIES_OOL
Linux 4.9.244
    Convert trailing spaces and periods in path components
  * ext4: fix leaking sysfs kobject after failed mount
      fs/ext4/super.c
  * reboot: fix overflow parsing reboot cpu number
      kernel/reboot.c
  * Revert "kernel/reboot.c: convert simple_strtoul to kstrtoint"
      kernel/reboot.c
  * perf/core: Fix race in the perf_mmap_close() function
      kernel/events/core.c
    xen/events: block rogue events for some time
    xen/events: defer eoi in case of excessive number of events
    xen/events: use a common cpu hotplug hook for event channels
    xen/events: switch user event channels to lateeoi model
    xen/pciback: use lateeoi irq binding
    xen/scsiback: use lateeoi irq binding
    xen/netback: use lateeoi irq binding
    xen/blkback: use lateeoi irq binding
    xen/events: add a new "late EOI" evtchn framework
    xen/events: fix race in evtchn_fifo_unmask()
    xen/events: add a proper barrier to 2-level uevent unmasking
    xen/events: avoid removing an event channel while handling it
  * perf/core: Fix a memory leak in perf_event_parse_addr_filter()
      kernel/events/core.c
  * perf/core: Fix crash when using HW tracing kernel filters
      kernel/events/core.c
  * perf/core: Fix bad use of igrab()
      include/linux/perf_event.h
      kernel/events/core.c
    x86/speculation: Allow IBPB to be conditionally enabled on CPUs with always-on STIBP
  * random32: make prandom_u32() output unpredictable
      drivers/char/random.c
      include/linux/prandom.h
      kernel/time/timer.c
      lib/random32.c
    net: Update window_clamp if SOCK_RCVBUF is set
    net/x25: Fix null-ptr-deref in x25_connect
    net/af_iucv: fix null pointer dereference on shutdown
  * IPv6: Set SIT tunnel hard_header_len to zero
      net/ipv6/sit.c
  * swiotlb: fix "x86: Don't panic if can not alloc buffer for swiotlb"
      lib/swiotlb.c
    pinctrl: amd: fix incorrect way to disable debounce filter
    pinctrl: amd: use higher precision for 512 RtcClk
    drm/gma500: Fix out-of-bounds access to struct drm_device.vblank[]
  * don't dump the threads that had been already exiting when zapped.
      kernel/exit.c
    ocfs2: initialize ip_next_orphan
    mei: protect mei_cl_mtu from null dereference
    usb: cdc-acm: Add DISABLE_ECHO for Renesas USB Download mode
  * ext4: unlock xattr_sem properly in ext4_inline_data_truncate()
      fs/ext4/inline.c
  * ext4: correctly report "not supported" for {usr,grp}jquota when !CONFIG_QUOTA
      fs/ext4/super.c
  * perf: Fix get_recursion_context()
      kernel/events/internal.h
    cosa: Add missing kfree in error path of cosa_write
  * of/address: Fix of_node memory leak in of_dma_is_coherent
      drivers/of/address.c
    xfs: fix a missing unlock on error in xfs_fs_map_blocks
    xfs: fix rmap key and record comparison functions
    xfs: fix flags argument to rmap lookup when converting shared file rmaps
    pinctrl: aspeed: Fix GPI only function problem.
    iommu/amd: Increase interrupt remapping table limit to 512 entries
    scsi: scsi_dh_alua: Avoid crash during alua_bus_detach()
  * cfg80211: regulatory: Fix inconsistent format argument
      net/wireless/reg.c
    mac80211: fix use of skb payload instead of header
    drm/amdgpu: perform srbm soft reset always on SDMA resume
    scsi: hpsa: Fix memory leak in hpsa_init_one()
    gfs2: check for live vs. read-only file system in gfs2_fitrim
    gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free
    usb: gadget: goku_udc: fix potential crashes in probe
    ath9k_htc: Use appropriate rs_datalen type
    geneve: add transport ports in route lookup for geneve
    i40e: Memory leak in i40e_config_iwarp_qvlist
    i40e: Fix of memory leak and integer truncation in i40e_virtchnl.c
    i40e: Wrong truncation from u16 to u8
    i40e: add num_vectors checker in iwarp handler
    i40e: Fix a potential NULL pointer dereference
  * pinctrl: devicetree: Avoid taking direct reference to device name string
      drivers/pinctrl/devicetree.c
    Btrfs: fix missing error return if writeback for extent buffer never started
    xfs: flush new eof page on truncate to avoid post-eof corruption
    can: peak_usb: peak_usb_get_ts_time(): fix timestamp wrapping
    can: peak_usb: add range checking in decode operations
    can: can_create_echo_skb(): fix echo skb generation: always use skb_clone()
    can: dev: __can_get_echo_skb(): fix real payload length return value for RTR frames
    can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context
    ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link()
    perf tools: Add missing swap for ino_generation
  * net: xfrm: fix a race condition during allocing spi
      net/xfrm/xfrm_state.c
  * genirq: Let GENERIC_IRQ_IPI select IRQ_DOMAIN_HIERARCHY
      kernel/irq/Kconfig
    btrfs: reschedule when cloning lots of extents
  * time: Prevent undefined behaviour in timespec64_to_ns()
      include/linux/time64.h
    mm: mempolicy: fix potential pte_unmap_unlock pte error
    gfs2: Wake up when sd_glock_disposal becomes zero
  * ring-buffer: Fix recursion protection transitions between interrupt context
      kernel/trace/ring_buffer.c
  * regulator: defer probe when trying to get voltage from unresolved supply
      drivers/regulator/core.c
    UPSTREAM: thermal/drivers/hisi: Remove bogus const from function return type
  * UPSTREAM: net/ipv6: don't reinitialize ndev->cnf.addr_gen_mode on new inet6_dev
      net/ipv6/addrconf.c
    UPSTREAM: tee: shm: fix use-after-free via temporarily dropped reference
    UPSTREAM: Documentation: ip-sysctl.txt: document addr_gen_mode
    UPSTREAM: net: crypto set sk to NULL when af_alg_release.
  * UPSTREAM: ipv6: don't auto-add link-local address to lag ports
      net/ipv6/addrconf.c
  * UPSTREAM: ipv6: ndisc: RFC-ietf-6man-ra-pref64-09 is now published as RFC8781
      include/net/ndisc.h
  * UPSTREAM: binder: fix incorrect cmd to binder_stat_br
      drivers/android/binder.c
  * UPSTREAM: arm64: SW PAN: Update saved ttbr0 value on enter_lazy_tlb
      arch/arm64/include/asm/mmu_context.h
    UPSTREAM: staging: android: vsoc: fix copy_from_user overrun
    Merge 4.9.243 into android-4.9-q
Linux 4.9.243
    powercap: restrict energy meter to root access
    Merge 4.9.242 into android-4.9-q
Linux 4.9.242
    Revert "ARC: entry: fix potential EFA clobber when TIF_SYSCALL_TRACE"
    ARC: stack unwinding: avoid indefinite looping
  * USB: Add NO_LPM quirk for Kingston flash drive
      drivers/usb/core/quirks.c
    USB: serial: option: add Telit FN980 composition 0x1055
    USB: serial: option: add LE910Cx compositions 0x1203, 0x1230, 0x1231
    USB: serial: cyberjack: fix write-URB completion race
    serial: txx9: add missing platform_driver_unregister() on error in serial_txx9_init
    serial: 8250_mtk: Fix uart_get_baud_rate warning
  * fork: fix copy_process(CLONE_PARENT) race with the exiting ->real_parent
      kernel/fork.c
  * vt: Disable KD_FONT_OP_COPY
      drivers/tty/vt/vt.c
    ACPI: NFIT: Fix comparison to '-ENXIO'
    vsock: use ns_capable_noaudit() on socket create
  * scsi: core: Don't start concurrent async scan on same host
      drivers/scsi/scsi_scan.c
  * of: Fix reserved-memory overlap detection
      drivers/of/of_reserved_mem.c
    x86/kexec: Use up-to-dated screen_info copy to fill boot params
    ARM: dts: sun4i-a10: fix cpu_alert temperature
  * tracing: Fix out of bounds write in get_trace_buf
      kernel/trace/trace.c
  * ftrace: Handle tracing when switching between context
      kernel/trace/trace.h
  * ftrace: Fix recursion check for NMI test
      kernel/trace/trace.h
  * kthread_worker: prevent queuing delayed work from timer_fn when it is being canceled
      kernel/kthread.c
  * ALSA: usb-audio: Add implicit feedback quirk for Qu-16
      sound/usb/pcm.c
    Fonts: Replace discarded const qualifier
    gianfar: Account for Tx PTP timestamp in the skb headroom
    gianfar: Replace skb_realloc_headroom with skb_cow_head for PTP
    tipc: fix use-after-free in tipc_bcast_get_mode
    xen/events: don't use chip_data for legacy IRQs
    staging: octeon: Drop on uncorrectable alignment or FCS error
    staging: octeon: repair "fixed-link" support
    staging: comedi: cb_pcidas: Allow 2-channel commands for AO subdevice
  * KVM: arm64: Fix AArch32 handling of DBGD{CCINT,SCRext} and DBGVCR
      arch/arm64/include/asm/kvm_host.h
  * device property: Don't clear secondary pointer for shared primary firmware node
      drivers/base/core.c
  * device property: Keep secondary firmware node secondary by type
      drivers/base/core.c
    ARM: s3c24xx: fix missing system reset
    ARM: samsung: fix PM debug build with DEBUG_LL but !MMU
    hil/parisc: Disable HIL driver when it gets stuck
    cachefiles: Handle readpage error correctly
  * arm64: berlin: Select DW_APB_TIMER_OF
      arch/arm64/Kconfig.platforms
  * tty: make FONTX ioctl use the tty pointer they were actually passed
      drivers/tty/vt/vt_ioctl.c
    rtc: rx8010: don't modify the global rtc ops
    vringh: fix __vringh_iov() when riov and wiov are different
  * ring-buffer: Return 0 on success from ring_buffer_resize()
      kernel/trace/ring_buffer.c
    9P: Cast to loff_t before multiplying
    libceph: clear con->out_msg on Policy::stateful_server faults
    ceph: promote to unsigned long long before shifting
    ia64: fix build error with !COREDUMP
    ubi: check kthread_should_stop() after the setting of task state
    ubifs: dent: Fix some potential memory leaks while iterating entries
    powerpc/powernv/elog: Fix race while processing OPAL error log event.
    powerpc: Warn about use of smt_snooze_delay
    iio:gyro:itg3200: Fix timestamp alignment and prevent data leak.
    iio:adc:ti-adc12138 Fix alignment issue with timestamp
    iio:light:si1145: Fix timestamp alignment and prevent data leak.
    dmaengine: dma-jz4780: Fix race in jz4780_dma_tx_status
  * vt: keyboard, extend func_buf_lock to readers
      drivers/tty/vt/keyboard.c
  * vt: keyboard, simplify vt_kdgkbsent
      drivers/tty/vt/keyboard.c
    usb: host: fsl-mph-dr-of: check return of dma_set_mask()
  * usb: dwc3: core: don't trigger runtime pm when remove driver
      drivers/usb/dwc3/core.c
  * usb: dwc3: core: add phy cleanup for probe error handling
      drivers/usb/dwc3/core.c
    btrfs: fix use-after-free on readahead extent after failure to create it
    btrfs: cleanup cow block on error
    btrfs: reschedule if necessary when logging directory items
    scsi: mptfusion: Fix null pointer dereferences in mptscsih_remove()
    w1: mxc_w1: Fix timeout resolution problem leading to bus error
    acpi-cpufreq: Honor _PSD table setting on new AMD CPUs
    ACPI: debug: don't allow debugging when ACPI is disabled
    ACPI: video: use ACPI backlight for HP 635 Notebook
    ACPI / extlog: Check for RDMSR failure
    NFS: fix nfs_path in case of a rename retry
  * fs: Don't invalidate page buffers in block_write_full_page()
      fs/buffer.c
    leds: bcm6328, bcm6358: use devres LED registering function
    perf/x86/amd/ibs: Fix raw sample data accumulation
    perf/x86/amd/ibs: Don't include randomized bits in get_ibs_op_count()
    md/raid5: fix oops during stripe resizing
    ARM: dts: s5pv210: remove dedicated 'audio-subsystem' node
    ARM: dts: s5pv210: move PMU node out of clock controller
    ARM: dts: s5pv210: remove DMA controller bus node name to fix dtschema warnings
    memory: emif: Remove bogus debugfs error handling
    gfs2: add validation checks for size of superblock
  * ext4: Detect already used quota file early
      fs/ext4/super.c
    drivers: watchdog: rdc321x_wdt: Fix race condition bugs
    net: 9p: initialize sun_server.sun_path to have addr's value only when addr is valid
    clk: ti: clockdomain: fix static checker warning
    md/bitmap: md_bitmap_get_counter returns wrong blocks
    power: supply: test_power: add missing newlines when printing parameters by sysfs
    bus/fsl_mc: Do not rely on caller to provide non NULL mc_io
    drivers/net/wan/hdlc_fr: Correctly handle special skb->protocol values
  * arm64/mm: return cpu_all_mask when node is NUMA_NO_NODE
      arch/arm64/include/asm/numa.h
    USB: adutux: fix debugging
    cpufreq: sti-cpufreq: add stih418 support
  * kgdb: Make "kgdbcon" work properly with "kgdb_earlycon"
      kernel/debug/debug_core.c
  * printk: reduce LOG_BUF_SHIFT range for H8300
      init/Kconfig
    mmc: via-sdmmc: Fix data race bug
    media: tw5864: check status of tw5864_frameinterval_get
    ath10k: fix VHT NSS calculation when STBC is enabled
    video: fbdev: pvr2fb: initialize variables
    xfs: fix realtime bitmap/summary file truncation when growing rt volume
    ARM: 8997/2: hw_breakpoint: Handle inexact watchpoint addresses
    um: change sigio_spinlock to a mutex
  * f2fs: fix to check segment boundary during SIT page readahead
      fs/f2fs/checkpoint.c
  * f2fs: add trace exit in exception path
      fs/f2fs/checkpoint.c
    sparc64: remove mm_cpumask clearing to fix kthread_use_mm race
    powerpc/powernv/smp: Fix spurious DBG() warning
    mlxsw: core: Fix use-after-free in mlxsw_emad_trans_finish()
  * fscrypt: use EEXIST when file already uses different policy
      fs/crypto/policy.c
  * fscrypto: move ioctl processing more fully into common code
      fs/crypto/policy.c
      fs/ext4/ext4.h
      fs/ext4/ioctl.c
      fs/f2fs/f2fs.h
      fs/f2fs/file.c
  * fscrypt: return -EXDEV for incompatible rename or link into encrypted dir
      fs/crypto/policy.c
      fs/ext4/namei.c
      fs/f2fs/namei.c
    ata: sata_rcar: Fix DMA boundary mask
    mtd: lpddr: Fix bad logic in print_drs_error
    p54: avoid accessing the data mapped to streaming DMA
  * fuse: fix page dereference after free
      fs/fuse/dev.c
    arch/x86/amd/ibs: Fix re-arming IBS Fetch
    tipc: fix memory leak caused by tipc_buf_append()
    ravb: Fix bit fields checking in ravb_hwtstamp_get()
    efivarfs: Replace invalid slashes with exclamation marks in dentries.
    powerpc/powernv/opal-dump : Use IRQ_HANDLED instead of numbers in interrupt handler
  * scripts/setlocalversion: make git describe output more reliable
      scripts/setlocalversion
    SUNRPC: ECONNREFUSED should cause a rebind.
  * ANDROID: Temporarily disable XFRM_USER_COMPAT filtering
      net/xfrm/xfrm_state.c
      net/xfrm/xfrm_user.c
  * BACKPORT: xfrm/compat: Translate 32-bit user_policy from sockptr
      include/net/xfrm.h
      net/xfrm/xfrm_state.c
  * BACKPORT: xfrm/compat: Add 32=>64-bit messages translator
      include/net/xfrm.h
      net/xfrm/Kconfig
      net/xfrm/xfrm_user.c
  * UPSTREAM: xfrm/compat: Attach xfrm dumps to 64=>32 bit translator
      net/xfrm/xfrm_user.c
  * BACKPORT: xfrm/compat: Add 64=>32-bit messages translator
      include/net/xfrm.h
      net/xfrm/xfrm_user.c
  * BACKPORT: xfrm: Provide API to register translator module
      include/net/xfrm.h
      net/xfrm/Kconfig
      net/xfrm/Makefile
      net/xfrm/xfrm_state.c
  * UPSTREAM: mm/sl[uo]b: export __kmalloc_track(_node)_caller
      mm/slub.c
    ANDROID: Publish uncompressed Image on aarch64
  * ANDROID: Makefile: append BUILD_NUMBER to version string when defined
      Makefile

Change-Id: I345c9bde484cf008679253982f61b2a833527c3e
Signed-off-by: Lucas Wei <lucaswei@google.com>
2021-01-25 15:50:07 +08:00
Peter Zijlstra
21183c4d0d UPSTREAM: locking/atomic, kref: Add KREF_INIT()
Since we need to change the implementation, stop exposing internals.

Provide KREF_INIT() to allow static initialization of struct kref.

Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>

Bug: 173789633
Change-Id: I5fa30eb173b15bcb5d291ccbb61294f28ba27ea9
(cherry picked from commit 1e24edca0557dba6486d39d3c24c288475432bcf)
Signed-off-by: Giuliano Procida <gprocida@google.com>
2021-01-05 16:00:48 +00:00
Greg Kroah-Hartman
4a8894270e Merge 4.9.242 into android-4.9-q
Changes in 4.9.242
	SUNRPC: ECONNREFUSED should cause a rebind.
	scripts/setlocalversion: make git describe output more reliable
	powerpc/powernv/opal-dump : Use IRQ_HANDLED instead of numbers in interrupt handler
	efivarfs: Replace invalid slashes with exclamation marks in dentries.
	ravb: Fix bit fields checking in ravb_hwtstamp_get()
	tipc: fix memory leak caused by tipc_buf_append()
	arch/x86/amd/ibs: Fix re-arming IBS Fetch
	fuse: fix page dereference after free
	p54: avoid accessing the data mapped to streaming DMA
	mtd: lpddr: Fix bad logic in print_drs_error
	ata: sata_rcar: Fix DMA boundary mask
	fscrypt: return -EXDEV for incompatible rename or link into encrypted dir
	fscrypto: move ioctl processing more fully into common code
	fscrypt: use EEXIST when file already uses different policy
	mlxsw: core: Fix use-after-free in mlxsw_emad_trans_finish()
	powerpc/powernv/smp: Fix spurious DBG() warning
	sparc64: remove mm_cpumask clearing to fix kthread_use_mm race
	f2fs: add trace exit in exception path
	f2fs: fix to check segment boundary during SIT page readahead
	um: change sigio_spinlock to a mutex
	ARM: 8997/2: hw_breakpoint: Handle inexact watchpoint addresses
	xfs: fix realtime bitmap/summary file truncation when growing rt volume
	video: fbdev: pvr2fb: initialize variables
	ath10k: fix VHT NSS calculation when STBC is enabled
	media: tw5864: check status of tw5864_frameinterval_get
	mmc: via-sdmmc: Fix data race bug
	printk: reduce LOG_BUF_SHIFT range for H8300
	kgdb: Make "kgdbcon" work properly with "kgdb_earlycon"
	cpufreq: sti-cpufreq: add stih418 support
	USB: adutux: fix debugging
	arm64/mm: return cpu_all_mask when node is NUMA_NO_NODE
	drivers/net/wan/hdlc_fr: Correctly handle special skb->protocol values
	bus/fsl_mc: Do not rely on caller to provide non NULL mc_io
	power: supply: test_power: add missing newlines when printing parameters by sysfs
	md/bitmap: md_bitmap_get_counter returns wrong blocks
	clk: ti: clockdomain: fix static checker warning
	net: 9p: initialize sun_server.sun_path to have addr's value only when addr is valid
	drivers: watchdog: rdc321x_wdt: Fix race condition bugs
	ext4: Detect already used quota file early
	gfs2: add validation checks for size of superblock
	memory: emif: Remove bogus debugfs error handling
	ARM: dts: s5pv210: remove DMA controller bus node name to fix dtschema warnings
	ARM: dts: s5pv210: move PMU node out of clock controller
	ARM: dts: s5pv210: remove dedicated 'audio-subsystem' node
	md/raid5: fix oops during stripe resizing
	perf/x86/amd/ibs: Don't include randomized bits in get_ibs_op_count()
	perf/x86/amd/ibs: Fix raw sample data accumulation
	leds: bcm6328, bcm6358: use devres LED registering function
	fs: Don't invalidate page buffers in block_write_full_page()
	NFS: fix nfs_path in case of a rename retry
	ACPI / extlog: Check for RDMSR failure
	ACPI: video: use ACPI backlight for HP 635 Notebook
	ACPI: debug: don't allow debugging when ACPI is disabled
	acpi-cpufreq: Honor _PSD table setting on new AMD CPUs
	w1: mxc_w1: Fix timeout resolution problem leading to bus error
	scsi: mptfusion: Fix null pointer dereferences in mptscsih_remove()
	btrfs: reschedule if necessary when logging directory items
	btrfs: cleanup cow block on error
	btrfs: fix use-after-free on readahead extent after failure to create it
	usb: dwc3: core: add phy cleanup for probe error handling
	usb: dwc3: core: don't trigger runtime pm when remove driver
	usb: host: fsl-mph-dr-of: check return of dma_set_mask()
	vt: keyboard, simplify vt_kdgkbsent
	vt: keyboard, extend func_buf_lock to readers
	dmaengine: dma-jz4780: Fix race in jz4780_dma_tx_status
	iio:light:si1145: Fix timestamp alignment and prevent data leak.
	iio:adc:ti-adc12138 Fix alignment issue with timestamp
	iio:gyro:itg3200: Fix timestamp alignment and prevent data leak.
	powerpc: Warn about use of smt_snooze_delay
	powerpc/powernv/elog: Fix race while processing OPAL error log event.
	ubifs: dent: Fix some potential memory leaks while iterating entries
	ubi: check kthread_should_stop() after the setting of task state
	ia64: fix build error with !COREDUMP
	ceph: promote to unsigned long long before shifting
	libceph: clear con->out_msg on Policy::stateful_server faults
	9P: Cast to loff_t before multiplying
	ring-buffer: Return 0 on success from ring_buffer_resize()
	vringh: fix __vringh_iov() when riov and wiov are different
	rtc: rx8010: don't modify the global rtc ops
	tty: make FONTX ioctl use the tty pointer they were actually passed
	arm64: berlin: Select DW_APB_TIMER_OF
	cachefiles: Handle readpage error correctly
	hil/parisc: Disable HIL driver when it gets stuck
	ARM: samsung: fix PM debug build with DEBUG_LL but !MMU
	ARM: s3c24xx: fix missing system reset
	device property: Keep secondary firmware node secondary by type
	device property: Don't clear secondary pointer for shared primary firmware node
	KVM: arm64: Fix AArch32 handling of DBGD{CCINT,SCRext} and DBGVCR
	staging: comedi: cb_pcidas: Allow 2-channel commands for AO subdevice
	staging: octeon: repair "fixed-link" support
	staging: octeon: Drop on uncorrectable alignment or FCS error
	xen/events: don't use chip_data for legacy IRQs
	tipc: fix use-after-free in tipc_bcast_get_mode
	gianfar: Replace skb_realloc_headroom with skb_cow_head for PTP
	gianfar: Account for Tx PTP timestamp in the skb headroom
	Fonts: Replace discarded const qualifier
	ALSA: usb-audio: Add implicit feedback quirk for Qu-16
	kthread_worker: prevent queuing delayed work from timer_fn when it is being canceled
	ftrace: Fix recursion check for NMI test
	ftrace: Handle tracing when switching between context
	tracing: Fix out of bounds write in get_trace_buf
	ARM: dts: sun4i-a10: fix cpu_alert temperature
	x86/kexec: Use up-to-dated screen_info copy to fill boot params
	of: Fix reserved-memory overlap detection
	scsi: core: Don't start concurrent async scan on same host
	vsock: use ns_capable_noaudit() on socket create
	ACPI: NFIT: Fix comparison to '-ENXIO'
	vt: Disable KD_FONT_OP_COPY
	fork: fix copy_process(CLONE_PARENT) race with the exiting ->real_parent
	serial: 8250_mtk: Fix uart_get_baud_rate warning
	serial: txx9: add missing platform_driver_unregister() on error in serial_txx9_init
	USB: serial: cyberjack: fix write-URB completion race
	USB: serial: option: add LE910Cx compositions 0x1203, 0x1230, 0x1231
	USB: serial: option: add Telit FN980 composition 0x1055
	USB: Add NO_LPM quirk for Kingston flash drive
	ARC: stack unwinding: avoid indefinite looping
	Revert "ARC: entry: fix potential EFA clobber when TIF_SYSCALL_TRACE"
	Linux 4.9.242

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I594296d57790eb8b7fa737119346d2b60572e5fd
2020-11-10 15:26:59 +01:00
John Ogness
7756acd808 printk: reduce LOG_BUF_SHIFT range for H8300
[ Upstream commit 550c10d28d21bd82a8bb48debbb27e6ed53262f6 ]

The .bss section for the h8300 is relatively small. A value of
CONFIG_LOG_BUF_SHIFT that is larger than 19 will create a static
printk ringbuffer that is too large. Limit the range appropriately
for the H8300.

Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: John Ogness <john.ogness@linutronix.de>
Reviewed-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Acked-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Petr Mladek <pmladek@suse.com>
Link: https://lore.kernel.org/r/20200812073122.25412-1-john.ogness@linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-11-10 10:23:53 +01:00
lucaswei
28f89a6c66 Merge android-4.9-q (4.9.234) into android-msm-pixel-4.9-lts
Merge 4.9.234 into android-4.9-q
Linux 4.9.234
    KVM: arm/arm64: Don't reschedule in unmap_stage2_range()
    xen: don't reschedule in preemption off sections
    mm/hugetlb: fix calculation of adjust_range_if_pmd_sharing_possible
  * do_epoll_ctl(): clean the failure exits up a bit
      fs/eventpoll.c
  * epoll: Keep a reference on files added to the check list
      fs/eventpoll.c
    powerpc: Allow 4224 bytes of stack expansion for the signal frame
    powerpc/pseries: Do not initiate shutdown when system is running on UPS
    net: dsa: b53: check for timeout
    ASoC: intel: Fix memleak in sst_media_open
    net: fec: correct the error path for regulator disable in probe
    i40e: Set RX_ONLY mode for unicast promiscuous on VLAN
  * ext4: fix potential negative array index in do_split()
      fs/ext4/namei.c
    alpha: fix annotation of io{read,write}{16,32}be()
    xfs: Fix UBSAN null-ptr-deref in xfs_sysfs_init
    virtio_ring: Avoid loop when vq is broken in virtqueue_poll
    scsi: libfc: Free skb in fc_disc_gpn_id_resp() for valid cases
    jffs2: fix UAF problem
    xfs: fix inode quota reservation checks
    m68knommu: fix overwriting of bits in ColdFire V3 cache control
    Input: psmouse - add a newline when printing 'proto' by sysfs
    media: vpss: clean up resources in init
    media: budget-core: Improve exception handling in budget_register()
  * scsi: ufs: Add DELAY_BEFORE_LPM quirk for Micron devices
      drivers/scsi/ufs/ufs_quirks.h
      drivers/scsi/ufs/ufshcd.c
  * ext4: fix checking of directory entry validity for inline directories
      fs/ext4/namei.c
  * ext4: clean up ext4_match() and callers
      fs/ext4/namei.c
  * mm, page_alloc: fix core hung in free_pcppages_bulk()
      mm/page_alloc.c
  * mm: include CMA pages in lowmem_reserve at boot
      mm/page_alloc.c
    kernel/relay.c: fix memleak on destroy relay channel
    romfs: fix uninitialized memory leak in romfs_dev_read()
    btrfs: don't show full path of bind mounts in subvol=
    btrfs: export helpers for subvolume name/id resolution
    khugepaged: adjust VM_BUG_ON_MM() in __khugepaged_enter()
    khugepaged: khugepaged_test_exit() check mmget_still_valid()
    tracing/hwlat: Honor the tracing_cpumask
    tracing: Clean up the hwlat binding code
    perf probe: Fix memory leakage when the probe point is not found
    drm/imx: imx-ldb: Disable both channels for split mode in enc->disable()
    x86/asm: Add instruction suffixes to bitops
    x86/asm: Remove unnecessary \n\t in front of CC_SET() from asm templates
  * ANDROID: fix a bug in quota2
      net/netfilter/xt_quota2.c
    Merge 4.9.233 into android-4.9-q
  * UPSTREAM: binder: Prevent context manager from incrementing ref 0
      drivers/android/binder.c
Linux 4.9.233
  * mm: Avoid calling build_all_zonelists_init under hotplug context
      include/linux/mmzone.h
      init/main.c
      mm/page_alloc.c
    khugepaged: retract_page_tables() remember to test exit
    sh: landisk: Add missing initialization of sh_io_port_base
    ALSA: echoaudio: Fix potential Oops in snd_echo_resume()
    mfd: dln2: Run event handler loop under spinlock
    fs/ufs: avoid potential u32 multiplication overflow
    nfs: Fix getxattr kernel panic and memory overflow
    net: qcom/emac: add missed clk_disable_unprepare in error path of emac_clks_phase1_init
    drm/vmwgfx: Fix two list_for_each loop exit tests
    Input: sentelic - fix error return when fsp_reg_write fails
    pwm: bcm-iproc: handle clk_get_rate() return
    clk: clk-atlas6: fix return value check in atlas6_clk_init()
    i2c: rcar: slave: only send STOP event when we have been addressed
    iommu/vt-d: Enforce PASID devTLB field mask
    iommu/omap: Check for failure of a call to omap_iommu_dump_ctx
    gpu: ipu-v3: image-convert: Combine rotate/no-rotate irq handlers
    USB: serial: ftdi_sio: clean up receive processing
    USB: serial: ftdi_sio: make process-packet buffer unsigned
    mfd: arizona: Ensure 32k clock is put on driver unbind and error
    pseries: Fix 64 bit logical memory block panic
    watchdog: f71808e_wdt: clear watchdog timeout occurred flag
    watchdog: f71808e_wdt: remove use of wrong watchdog_info option
    watchdog: f71808e_wdt: indicate WDIOF_CARDRESET support in watchdog_info.options
    kprobes: Fix NULL pointer dereference at kprobe_ftrace_handler
    ftrace: Setup correct FTRACE_FL_REGS flags for module
    ocfs2: change slot number type s16 to u16
    ext2: fix missing percpu_counter_inc
    MIPS: CPU#0 is not hotpluggable
    mac80211: fix misplaced while instead of if
    bcache: allocate meta data pages as compound pages
    md/raid5: Fix Force reconstruct-write io stuck in degraded raid5
  * net/compat: Add missing sock updates for SCM_RIGHTS
      include/net/sock.h
      net/compat.c
      net/core/sock.c
    net: stmmac: dwmac1000: provide multicast filter fallback
    net: ethernet: stmmac: Disable hardware multicast filter
    powerpc: Fix circular dependency between percpu.h and mmu.h
    xtensa: fix xtensa_pmu_setup prototype
    iio: dac: ad5592r: fix unbalanced mutex unlocks in ad5592r_read_raw()
    btrfs: fix memory leaks after failure to lookup checksums during inode logging
    btrfs: only search for left_info if there is no right_info in try_merge_free_space
    btrfs: don't allocate anonymous block device for user invisible roots
    PCI: hotplug: ACPI: Fix context refcounting in acpiphp_grab_context()
    smb3: warn on confusing error scenario with sec=krb5
    xen/balloon: make the balloon wait interruptible
    xen/balloon: fix accounting in alloc_xenballooned_pages error path
    ARM: 8992/1: Fix unwind_frame for clang-built kernels
    parisc: mask out enable and reserved bits from sba imask
    9p: Fix memory leak in v9fs_mount
  * ALSA: usb-audio: work around streaming quirk for MacroSilicon MS2109
      sound/usb/card.h
      sound/usb/pcm.c
      sound/usb/quirks.c
      sound/usb/stream.c
    fs/minix: reject too-large maximum file size
    fs/minix: don't allow getting deleted inodes
    fs/minix: check return value of sb_getblk()
    crypto: ccp - Fix use of merged scatterlists
    crypto: qat - fix double free in qat_uclo_create_batch_init_list
  * ALSA: usb-audio: add quirk for Pioneer DDJ-RB
      sound/usb/quirks-table.h
  * ALSA: usb-audio: fix overeager device match for MacroSilicon MS2109
      sound/usb/quirks-table.h
  * ALSA: usb-audio: Creative USB X-Fi Pro SB1095 volume knob support
      sound/usb/mixer_quirks.c
    USB: serial: cp210x: enable usb generic throttle/unthrottle
    USB: serial: cp210x: re-enable auto-RTS on open
  * net: Set fput_needed iff FDPUT_FPUT is set
      net/socket.c
    net/nfc/rawsock.c: add CAP_NET_RAW check.
    drivers/net/wan/lapbether: Added needed_headroom and a skb->len check
    pinctrl-single: fix pcs_parse_pinconf() return value
    dlm: Fix kobject memleak
    fsl/fman: fix eth hash table allocation
    fsl/fman: check dereferencing null pointer
    fsl/fman: fix unreachable code
    fsl/fman: fix dereference null return value
    fsl/fman: use 32-bit unsigned integer
    net: spider_net: Fix the size used in a 'dma_free_coherent()' call
    wl1251: fix always return 0 error
    s390/qeth: don't process empty bridge port events
    selftests/powerpc: Fix online CPU selection
    selftests/powerpc: Fix CPU affinity for child process
    power: supply: check if calc_soc succeeded in pm860x_init_battery
  * Smack: prevent underflow in smk_set_cipso()
      security/smack/smackfs.c
  * Smack: fix another vsscanf out of bounds
      security/smack/smackfs.c
    scsi: mesh: Fix panic after host or bus reset
    usb: dwc2: Fix error path in gadget registration
    USB: serial: iuu_phoenix: fix led-activity helpers
    drm/imx: tve: fix regulator_disable error path
    PCI/ASPM: Add missing newline in sysfs 'policy'
    staging: rtl8192u: fix a dubious looking mask before a shift
    powerpc/vdso: Fix vdso cpu truncation
    mwifiex: Prevent memory corruption handling keys
    scsi: scsi_debug: Add check for sdebug_max_queue during module init
    drm: panel: simple: Fix bpc for LG LB070WV8 panel
  * leds: core: Flush scheduled work for system suspend
      drivers/leds/led-class.c
  * PCI: Fix pci_cfg_wait queue locking problem
      drivers/pci/access.c
    xfs: fix reflink quota reservation accounting error
    media: exynos4-is: Add missed check for pinctrl_lookup_state()
    media: firewire: Using uninitialized values in node_probe()
    scsi: eesox: Fix different dev_id between request_irq() and free_irq()
    scsi: powertec: Fix different dev_id between request_irq() and free_irq()
    drm/radeon: fix array out-of-bounds read and write issues
    cxl: Fix kobject memleak
  * drm/mipi: use dcs write for mipi_dsi_dcs_set_tear_scanline
      drivers/gpu/drm/drm_mipi_dsi.c
    scsi: cumana_2: Fix different dev_id between request_irq() and free_irq()
    media: omap3isp: Add missed v4l2_ctrl_handler_free() for preview_init_entities()
    leds: lm355x: avoid enum conversion warning
    iio: improve IIO_CONCENTRATION channel type description
    video: pxafb: Fix the function used to balance a 'dma_alloc_coherent()' call
    console: newport_con: fix an issue about leak related system resources
    video: fbdev: sm712fb: fix an issue about iounmap for a wrong address
    agp/intel: Fix a memory leak on module initialisation failure
    ACPICA: Do not increment operation_region reference counts for field units
    bcache: fix super block seq numbers comparision in register_cache_set()
  * dyndbg: fix a BUG_ON in ddebug_describe_flags
      lib/dynamic_debug.c
    bdc: Fix bug causing crash after multiple disconnects
    usb: gadget: net2280: fix memory leak on probe error handling paths
    iwlegacy: Check the return value of pcie_capability_read_*()
    brcmfmac: To fix Bss Info flag definition Bug
  * mm/mmap.c: Add cond_resched() for exit_mmap() CPU stalls
      mm/mmap.c
  * drm/debugfs: fix plain echo to connector "force" attribute
      drivers/gpu/drm/drm_debugfs.c
    drm/nouveau: fix multiple instances of reference count leaks
    md-cluster: fix wild pointer of unlock_all_bitmaps()
    video: fbdev: neofb: fix memory leak in neo_scan_monitor()
    drm/radeon: Fix reference count leaks caused by pm_runtime_get_sync
    fs/btrfs: Add cond_resched() for try_release_extent_mapping() stalls
    Bluetooth: add a mutex lock to avoid UAF in do_enale_set
    drm/tilcdc: fix leak & null ref in panel_connector_get_modes
    ARM: socfpga: PM: add missing put_device() call in socfpga_setup_ocram_self_refresh()
    ARM: at91: pm: add missing put_device() call in at91_pm_sram_init()
    platform/x86: intel-vbtn: Fix return value check in check_acpi_dev()
    platform/x86: intel-hid: Fix return value check in check_acpi_dev()
    m68k: mac: Fix IOP status/control register writes
    m68k: mac: Don't send IOP message until channel is idle
    arm64: dts: exynos: Fix silent hang after boot on Espresso
    arm64: dts: qcom: msm8916: Replace invalid bias-pull-none property
  * EDAC: Fix reference count leaks
      drivers/edac/edac_device_sysfs.c
      drivers/edac/edac_pci_sysfs.c
  * cgroup: add missing skcd->no_refcnt check in cgroup_sk_clone()
      kernel/cgroup.c
  * gpio: fix oops resulting from calling of_get_named_gpio(NULL, ...)
      drivers/gpio/gpiolib-of.c
  * tracepoint: Mark __tracepoint_string's __used
      include/linux/tracepoint.h
  * Smack: fix use-after-free in smk_write_relabel_self()
      security/smack/smackfs.c
    usb: hso: check for return value in hso_serial_common_create()
    Revert "vxlan: fix tos value before xmit"
    net: lan78xx: replace bogus endpoint lookup
    vxlan: Ensure FDB dump is performed under RCU
  * ipv6: fix memory leaks on IPV6_ADDRFORM path
      include/net/addrconf.h
      net/ipv6/anycast.c
      net/ipv6/ipv6_sockglue.c
  * ipv4: Silence suspicious RCU usage warning
      net/ipv4/fib_trie.c
  * binder: Prevent context manager from incrementing ref 0
      drivers/android/binder.c
  * xattr: break delegations in {set,remove}xattr
      fs/xattr.c
      include/linux/xattr.h
    tools lib traceevent: Fix memory leak in process_dynamic_array_len
    atm: fix atm_dev refcnt leaks in atmtcp_remove_persistent
    igb: reinit_locked() should be called with rtnl_lock
  * cfg80211: check vendor command doit pointer before use
      net/wireless/nl80211.c
    drm/nouveau/fbcon: fix module unload when fbcon init has failed for some reason
    net/9p: validate fds in p9_fd_open
    leds: 88pm860x: fix use-after-free on unbind
    leds: lm3533: fix use-after-free on unbind
    leds: da903x: fix use-after-free on unbind
    leds: wm831x-status: fix use-after-free on unbind
    mtd: properly check all write ioctls for permissions
    vgacon: Fix for missing check in scrollback handling
    omapfb: dss: Fix max fclk divider for omap36xx
  * Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_with_rssi_evt()
      net/bluetooth/hci_event.c
  * Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_evt()
      net/bluetooth/hci_event.c
  * Bluetooth: Fix slab-out-of-bounds read in hci_extended_inquiry_result_evt()
      net/bluetooth/hci_event.c
    ALSA: seq: oss: Serialize ioctls
    net/mlx5e: Don't support phys switch id if not in switchdev mode
    USB: serial: qcserial: add EM7305 QDL product ID
  * ext4: fix direct I/O read error
      fs/ext4/inode.c
  * random32: move the pseudo-random 32-bit definitions to prandom.h
      include/linux/prandom.h
      include/linux/random.h
  * random32: remove net_rand_state from the latent entropy gcc plugin
      include/linux/random.h
      lib/random32.c
  * random: fix circular include dependency on arm64 after addition of percpu.h
      include/linux/random.h
    ARM: percpu.h: fix build error
  * random32: update the net random state on interrupt and activity
      drivers/char/random.c
      include/linux/random.h
      kernel/time/timer.c
      lib/random32.c
    x86/i8259: Use printk_deferred() to prevent deadlock
    KVM: LAPIC: Prevent setting the tscdeadline timer if the lapic is hw disabled
    xen-netfront: fix potential deadlock in xennet_remove()
    Revert "i2c: cadence: Fix the hold bit setting"
    net: ethernet: ravb: exit if re-initialization fails in tx timeout
    parisc: add support for cmpxchg on u8 pointers
    nfc: s3fwrn5: add missing release on skb in s3fwrn5_recv_frame
    qed: Disable "MFW indication via attention" SPAM every 5 minutes
    usb: hso: Fix debug compile warning on sparc32
  * arm64: csum: Fix handling of bad packets
      arch/arm64/include/asm/checksum.h
    mac80211: mesh: Free pending skb when destroying a mpath
    mac80211: mesh: Free ie data when leaving mesh
    ibmvnic: Fix IRQ mapping disposal in error path
    mlxsw: core: Free EMAD transactions using kfree_rcu()
    mlxsw: core: Increase scope of RCU read-side critical section
    mlx4: disable device on shutdown
    net: lan78xx: fix transfer-buffer memory leak
    net: lan78xx: add missing endpoint sanity check
    sh: Fix validation of system call number
    net/x25: Fix null-ptr-deref in x25_disconnect
    net/x25: Fix x25_neigh refcnt leak when x25 disconnect
    install several missing uapi headers
  * uapi: includes linux/types.h before exporting files
      include/uapi/linux/cryptouser.h
      include/uapi/linux/pr.h
    xfs: fix missed wakeup on l_flush_wait
    rds: Prevent kernel-infoleak in rds_notify_queue_get()
    fbdev: Detect integer underflow at "struct fbcon_ops"->clear_margins.
  * x86, vmlinux.lds: Page-align end of ..page_aligned sections
      include/asm-generic/vmlinux.lds.h
    x86/build/lto: Fix truncated .bss with -fdata-sections
    9p/trans_fd: Fix concurrency del of req_list in p9_fd_cancelled/p9_read_work
    9p/trans_fd: abort p9_read_work if req status changed
  * f2fs: check if file namelen exceeds max value
      fs/f2fs/dir.c
  * f2fs: check memory boundary by insane namelen
      fs/f2fs/dir.c
  * drm: hold gem reference until object is no longer accessed
      drivers/gpu/drm/drm_gem.c
    drm/amdgpu: Prevent kernel-infoleak in amdgpu_info_ioctl()
    ARM: 8986/1: hw_breakpoint: Don't invoke overflow handler on uaccess watchpoints
  * PCI/ASPM: Disable ASPM on ASMedia ASM1083/1085 PCIe-to-PCI bridge
      drivers/pci/quirks.c
    ath9k: release allocated buffer if timed out
    ath9k_htc: release allocated buffer if timed out
    media: rc: prevent memory leak in cx23888_ir_probe
    crypto: ccp - Release all allocated memory if sha type is invalid
    net: phy: mdio-bcm-unimac: fix potential NULL dereference in unimac_mdio_probe()
    xfs: don't call xfs_da_shrink_inode with NULL bp
    xfs: validate cached inodes are free when allocated
    xfs: catch inode allocation state mismatch corruption
  * BACKPORT: loop: Fix wrong masking of status flags
      drivers/block/loop.c
  * BACKPORT: loop: Add LOOP_CONFIGURE ioctl
      drivers/block/loop.c
      include/uapi/linux/loop.h
  * BACKPORT: loop: Clean up LOOP_SET_STATUS lo_flags handling
      drivers/block/loop.c
      include/uapi/linux/loop.h
  * BACKPORT: loop: Rework lo_ioctl() __user argument casting
      drivers/block/loop.c
  * BACKPORT: loop: Move loop_set_status_from_info() and friends up
      drivers/block/loop.c
  * BACKPORT: loop: Factor out configuring loop from status
      drivers/block/loop.c
  * BACKPORT: loop: Remove figure_loop_size()
      drivers/block/loop.c
  * BACKPORT: loop: Refactor loop_set_status() size calculation
      drivers/block/loop.c
  * BACKPORT: loop: Factor out setting loop device size
      drivers/block/loop.c
  * BACKPORT: loop: Remove sector_t truncation checks
      drivers/block/loop.c
  * BACKPORT: loop: Call loop_config_discard() only after new config is applied
      drivers/block/loop.c

Change-Id: Ic8aad76543057de6fe453c1790dd17f9df90955c
Signed-off-by: lucaswei <lucaswei@google.com>
2020-09-09 11:45:07 +08:00
Greg Kroah-Hartman
1e7b6edbb5 Merge 4.9.233 into android-4.9-q
Changes in 4.9.233
	xfs: catch inode allocation state mismatch corruption
	xfs: validate cached inodes are free when allocated
	xfs: don't call xfs_da_shrink_inode with NULL bp
	net: phy: mdio-bcm-unimac: fix potential NULL dereference in unimac_mdio_probe()
	crypto: ccp - Release all allocated memory if sha type is invalid
	media: rc: prevent memory leak in cx23888_ir_probe
	ath9k_htc: release allocated buffer if timed out
	ath9k: release allocated buffer if timed out
	PCI/ASPM: Disable ASPM on ASMedia ASM1083/1085 PCIe-to-PCI bridge
	ARM: 8986/1: hw_breakpoint: Don't invoke overflow handler on uaccess watchpoints
	drm/amdgpu: Prevent kernel-infoleak in amdgpu_info_ioctl()
	drm: hold gem reference until object is no longer accessed
	f2fs: check memory boundary by insane namelen
	f2fs: check if file namelen exceeds max value
	9p/trans_fd: abort p9_read_work if req status changed
	9p/trans_fd: Fix concurrency del of req_list in p9_fd_cancelled/p9_read_work
	x86/build/lto: Fix truncated .bss with -fdata-sections
	x86, vmlinux.lds: Page-align end of ..page_aligned sections
	fbdev: Detect integer underflow at "struct fbcon_ops"->clear_margins.
	rds: Prevent kernel-infoleak in rds_notify_queue_get()
	xfs: fix missed wakeup on l_flush_wait
	uapi: includes linux/types.h before exporting files
	install several missing uapi headers
	net/x25: Fix x25_neigh refcnt leak when x25 disconnect
	net/x25: Fix null-ptr-deref in x25_disconnect
	sh: Fix validation of system call number
	net: lan78xx: add missing endpoint sanity check
	net: lan78xx: fix transfer-buffer memory leak
	mlx4: disable device on shutdown
	mlxsw: core: Increase scope of RCU read-side critical section
	mlxsw: core: Free EMAD transactions using kfree_rcu()
	ibmvnic: Fix IRQ mapping disposal in error path
	mac80211: mesh: Free ie data when leaving mesh
	mac80211: mesh: Free pending skb when destroying a mpath
	arm64: csum: Fix handling of bad packets
	usb: hso: Fix debug compile warning on sparc32
	qed: Disable "MFW indication via attention" SPAM every 5 minutes
	nfc: s3fwrn5: add missing release on skb in s3fwrn5_recv_frame
	parisc: add support for cmpxchg on u8 pointers
	net: ethernet: ravb: exit if re-initialization fails in tx timeout
	Revert "i2c: cadence: Fix the hold bit setting"
	xen-netfront: fix potential deadlock in xennet_remove()
	KVM: LAPIC: Prevent setting the tscdeadline timer if the lapic is hw disabled
	x86/i8259: Use printk_deferred() to prevent deadlock
	random32: update the net random state on interrupt and activity
	ARM: percpu.h: fix build error
	random: fix circular include dependency on arm64 after addition of percpu.h
	random32: remove net_rand_state from the latent entropy gcc plugin
	random32: move the pseudo-random 32-bit definitions to prandom.h
	ext4: fix direct I/O read error
	USB: serial: qcserial: add EM7305 QDL product ID
	net/mlx5e: Don't support phys switch id if not in switchdev mode
	ALSA: seq: oss: Serialize ioctls
	Bluetooth: Fix slab-out-of-bounds read in hci_extended_inquiry_result_evt()
	Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_evt()
	Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_with_rssi_evt()
	omapfb: dss: Fix max fclk divider for omap36xx
	vgacon: Fix for missing check in scrollback handling
	mtd: properly check all write ioctls for permissions
	leds: wm831x-status: fix use-after-free on unbind
	leds: da903x: fix use-after-free on unbind
	leds: lm3533: fix use-after-free on unbind
	leds: 88pm860x: fix use-after-free on unbind
	net/9p: validate fds in p9_fd_open
	drm/nouveau/fbcon: fix module unload when fbcon init has failed for some reason
	cfg80211: check vendor command doit pointer before use
	igb: reinit_locked() should be called with rtnl_lock
	atm: fix atm_dev refcnt leaks in atmtcp_remove_persistent
	tools lib traceevent: Fix memory leak in process_dynamic_array_len
	xattr: break delegations in {set,remove}xattr
	binder: Prevent context manager from incrementing ref 0
	ipv4: Silence suspicious RCU usage warning
	ipv6: fix memory leaks on IPV6_ADDRFORM path
	vxlan: Ensure FDB dump is performed under RCU
	net: lan78xx: replace bogus endpoint lookup
	Revert "vxlan: fix tos value before xmit"
	usb: hso: check for return value in hso_serial_common_create()
	Smack: fix use-after-free in smk_write_relabel_self()
	tracepoint: Mark __tracepoint_string's __used
	gpio: fix oops resulting from calling of_get_named_gpio(NULL, ...)
	cgroup: add missing skcd->no_refcnt check in cgroup_sk_clone()
	EDAC: Fix reference count leaks
	arm64: dts: qcom: msm8916: Replace invalid bias-pull-none property
	arm64: dts: exynos: Fix silent hang after boot on Espresso
	m68k: mac: Don't send IOP message until channel is idle
	m68k: mac: Fix IOP status/control register writes
	platform/x86: intel-hid: Fix return value check in check_acpi_dev()
	platform/x86: intel-vbtn: Fix return value check in check_acpi_dev()
	ARM: at91: pm: add missing put_device() call in at91_pm_sram_init()
	ARM: socfpga: PM: add missing put_device() call in socfpga_setup_ocram_self_refresh()
	drm/tilcdc: fix leak & null ref in panel_connector_get_modes
	Bluetooth: add a mutex lock to avoid UAF in do_enale_set
	fs/btrfs: Add cond_resched() for try_release_extent_mapping() stalls
	drm/radeon: Fix reference count leaks caused by pm_runtime_get_sync
	video: fbdev: neofb: fix memory leak in neo_scan_monitor()
	md-cluster: fix wild pointer of unlock_all_bitmaps()
	drm/nouveau: fix multiple instances of reference count leaks
	drm/debugfs: fix plain echo to connector "force" attribute
	mm/mmap.c: Add cond_resched() for exit_mmap() CPU stalls
	brcmfmac: To fix Bss Info flag definition Bug
	iwlegacy: Check the return value of pcie_capability_read_*()
	usb: gadget: net2280: fix memory leak on probe error handling paths
	bdc: Fix bug causing crash after multiple disconnects
	dyndbg: fix a BUG_ON in ddebug_describe_flags
	bcache: fix super block seq numbers comparision in register_cache_set()
	ACPICA: Do not increment operation_region reference counts for field units
	agp/intel: Fix a memory leak on module initialisation failure
	video: fbdev: sm712fb: fix an issue about iounmap for a wrong address
	console: newport_con: fix an issue about leak related system resources
	video: pxafb: Fix the function used to balance a 'dma_alloc_coherent()' call
	iio: improve IIO_CONCENTRATION channel type description
	leds: lm355x: avoid enum conversion warning
	media: omap3isp: Add missed v4l2_ctrl_handler_free() for preview_init_entities()
	scsi: cumana_2: Fix different dev_id between request_irq() and free_irq()
	drm/mipi: use dcs write for mipi_dsi_dcs_set_tear_scanline
	cxl: Fix kobject memleak
	drm/radeon: fix array out-of-bounds read and write issues
	scsi: powertec: Fix different dev_id between request_irq() and free_irq()
	scsi: eesox: Fix different dev_id between request_irq() and free_irq()
	media: firewire: Using uninitialized values in node_probe()
	media: exynos4-is: Add missed check for pinctrl_lookup_state()
	xfs: fix reflink quota reservation accounting error
	PCI: Fix pci_cfg_wait queue locking problem
	leds: core: Flush scheduled work for system suspend
	drm: panel: simple: Fix bpc for LG LB070WV8 panel
	scsi: scsi_debug: Add check for sdebug_max_queue during module init
	mwifiex: Prevent memory corruption handling keys
	powerpc/vdso: Fix vdso cpu truncation
	staging: rtl8192u: fix a dubious looking mask before a shift
	PCI/ASPM: Add missing newline in sysfs 'policy'
	drm/imx: tve: fix regulator_disable error path
	USB: serial: iuu_phoenix: fix led-activity helpers
	usb: dwc2: Fix error path in gadget registration
	scsi: mesh: Fix panic after host or bus reset
	Smack: fix another vsscanf out of bounds
	Smack: prevent underflow in smk_set_cipso()
	power: supply: check if calc_soc succeeded in pm860x_init_battery
	selftests/powerpc: Fix CPU affinity for child process
	selftests/powerpc: Fix online CPU selection
	s390/qeth: don't process empty bridge port events
	wl1251: fix always return 0 error
	net: spider_net: Fix the size used in a 'dma_free_coherent()' call
	fsl/fman: use 32-bit unsigned integer
	fsl/fman: fix dereference null return value
	fsl/fman: fix unreachable code
	fsl/fman: check dereferencing null pointer
	fsl/fman: fix eth hash table allocation
	dlm: Fix kobject memleak
	pinctrl-single: fix pcs_parse_pinconf() return value
	drivers/net/wan/lapbether: Added needed_headroom and a skb->len check
	net/nfc/rawsock.c: add CAP_NET_RAW check.
	net: Set fput_needed iff FDPUT_FPUT is set
	USB: serial: cp210x: re-enable auto-RTS on open
	USB: serial: cp210x: enable usb generic throttle/unthrottle
	ALSA: usb-audio: Creative USB X-Fi Pro SB1095 volume knob support
	ALSA: usb-audio: fix overeager device match for MacroSilicon MS2109
	ALSA: usb-audio: add quirk for Pioneer DDJ-RB
	crypto: qat - fix double free in qat_uclo_create_batch_init_list
	crypto: ccp - Fix use of merged scatterlists
	fs/minix: check return value of sb_getblk()
	fs/minix: don't allow getting deleted inodes
	fs/minix: reject too-large maximum file size
	ALSA: usb-audio: work around streaming quirk for MacroSilicon MS2109
	9p: Fix memory leak in v9fs_mount
	parisc: mask out enable and reserved bits from sba imask
	ARM: 8992/1: Fix unwind_frame for clang-built kernels
	xen/balloon: fix accounting in alloc_xenballooned_pages error path
	xen/balloon: make the balloon wait interruptible
	smb3: warn on confusing error scenario with sec=krb5
	PCI: hotplug: ACPI: Fix context refcounting in acpiphp_grab_context()
	btrfs: don't allocate anonymous block device for user invisible roots
	btrfs: only search for left_info if there is no right_info in try_merge_free_space
	btrfs: fix memory leaks after failure to lookup checksums during inode logging
	iio: dac: ad5592r: fix unbalanced mutex unlocks in ad5592r_read_raw()
	xtensa: fix xtensa_pmu_setup prototype
	powerpc: Fix circular dependency between percpu.h and mmu.h
	net: ethernet: stmmac: Disable hardware multicast filter
	net: stmmac: dwmac1000: provide multicast filter fallback
	net/compat: Add missing sock updates for SCM_RIGHTS
	md/raid5: Fix Force reconstruct-write io stuck in degraded raid5
	bcache: allocate meta data pages as compound pages
	mac80211: fix misplaced while instead of if
	MIPS: CPU#0 is not hotpluggable
	ext2: fix missing percpu_counter_inc
	ocfs2: change slot number type s16 to u16
	ftrace: Setup correct FTRACE_FL_REGS flags for module
	kprobes: Fix NULL pointer dereference at kprobe_ftrace_handler
	watchdog: f71808e_wdt: indicate WDIOF_CARDRESET support in watchdog_info.options
	watchdog: f71808e_wdt: remove use of wrong watchdog_info option
	watchdog: f71808e_wdt: clear watchdog timeout occurred flag
	pseries: Fix 64 bit logical memory block panic
	mfd: arizona: Ensure 32k clock is put on driver unbind and error
	USB: serial: ftdi_sio: make process-packet buffer unsigned
	USB: serial: ftdi_sio: clean up receive processing
	gpu: ipu-v3: image-convert: Combine rotate/no-rotate irq handlers
	iommu/omap: Check for failure of a call to omap_iommu_dump_ctx
	iommu/vt-d: Enforce PASID devTLB field mask
	i2c: rcar: slave: only send STOP event when we have been addressed
	clk: clk-atlas6: fix return value check in atlas6_clk_init()
	pwm: bcm-iproc: handle clk_get_rate() return
	Input: sentelic - fix error return when fsp_reg_write fails
	drm/vmwgfx: Fix two list_for_each loop exit tests
	net: qcom/emac: add missed clk_disable_unprepare in error path of emac_clks_phase1_init
	nfs: Fix getxattr kernel panic and memory overflow
	fs/ufs: avoid potential u32 multiplication overflow
	mfd: dln2: Run event handler loop under spinlock
	ALSA: echoaudio: Fix potential Oops in snd_echo_resume()
	sh: landisk: Add missing initialization of sh_io_port_base
	khugepaged: retract_page_tables() remember to test exit
	mm: Avoid calling build_all_zonelists_init under hotplug context
	Linux 4.9.233

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ied62cb0768f5bd8e989d75e7c2ccf6f1e6f2efd4
2020-08-21 11:48:51 +02:00
Oscar Salvador
23feab188c mm: Avoid calling build_all_zonelists_init under hotplug context
Recently a customer of ours experienced a crash when booting the
system while enabling memory-hotplug.

The problem is that Normal zones on different nodes don't get their private
zone->pageset allocated, and keep sharing the initial boot_pageset.
The sharing between zones is normally safe as explained by the comment for
boot_pageset - it's a percpu structure, and manipulations are done with
disabled interrupts, and boot_pageset is set up in a way that any page placed
on its pcplist is immediately flushed to shared zone's freelist, because
pcp->high == 1.
However, the hotplug operation updates pcp->high to a higher value as it
expects to be operating on a private pageset.

The problem is in build_all_zonelists(), which is called when the first range
of pages is onlined for the Normal zone of node X or Y:

	if (system_state == SYSTEM_BOOTING) {
		build_all_zonelists_init();
	} else {
	#ifdef CONFIG_MEMORY_HOTPLUG
		if (zone)
			setup_zone_pageset(zone);
	#endif
		/* we have to stop all cpus to guarantee there is no user
		of zonelist */
		stop_machine(__build_all_zonelists, pgdat, NULL);
		/* cpuset refresh routine should be here */
	}

When called during hotplug, it should execute the setup_zone_pageset(zone)
which allocates the private pageset.
However, with memhp_default_state=online, this happens early while
system_state == SYSTEM_BOOTING is still true, hence this step is skipped.
(and build_all_zonelists_init() is probably unsafe anyway at this point).

Another hotplug operation on the same zone then leads to zone_pcp_update(zone)
called from online_pages(), which updates the pcp->high for the shared
boot_pageset to a value higher than 1.
At that point, pages freed from Node X and Y Normal zones can end up on the same
pcplist and from there they can be freed to the wrong zone's freelist,
leading to the corruption and crashes.

Please, note that upstream has fixed that differently (and unintentionally) by
adding another boot state (SYSTEM_SCHEDULING), which is set before smp_init().
That should happen before memory hotplug events even with memhp_default_state=online.
Backporting that would be too intrusive.

Signed-off-by: Oscar Salvador <osalvador@suse.de>
Debugged-by: Vlastimil Babka <vbabka@suse.cz>
Acked-by: Michal Hocko <mhocko@suse.com> # for stable trees
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-08-21 11:02:11 +02:00
lucaswei
ec98b24735 Merge android-4.9-q (4.9.228) into android-msm-pixel-4.9-lts
Merge 4.9.228 into android-4.9-q
Linux 4.9.228
    perf symbols: Fix debuginfo search for Ubuntu
    perf probe: Do not show the skipped events
    w1: omap-hdq: cleanup to add missing newline for some dev_dbg
    mtd: rawnand: pasemi: Fix the probe error path
    mtd: rawnand: brcmnand: fix hamming oob layout
  * sunrpc: clean up properly in gss_mech_unregister()
      include/linux/sunrpc/gss_api.h
    sunrpc: svcauth_gss_register_pseudoflavor must reject duplicate registrations.
  * kbuild: force to build vmlinux if CONFIG_MODVERSION=y
      Makefile
    drivers/macintosh: Fix memleak in windfarm_pm112 driver
    ARM: tegra: Correct PL310 Auxiliary Control Register initialization
  * kernel/cpu_pm: Fix uninitted local in cpu_pm
      kernel/cpu_pm.c
    sparc64: fix misuses of access_process_vm() in genregs32_[sg]et()
    sparc32: fix register window handling in genregs32_[gs]et()
    pinctrl: samsung: Save/restore eint_mask over suspend for EINT_TYPE GPIOs
    power: vexpress: add suppress_bind_attrs to true
    igb: Report speed and duplex as unknown when device is runtime suspended
    b43_legacy: Fix connection problem with WPA3
    b43: Fix connection problem with WPA3
    b43legacy: Fix case where channel status is corrupted
    media: go7007: fix a miss of snd_card_free
    carl9170: remove P2P_GO support
    e1000e: Relax condition to trigger reset for ME workaround
  * PCI: Program MPS for RCiEP devices
      drivers/pci/probe.c
  * blk-mq: move blk_mq_update_nr_hw_queues synchronize_rcu call
      block/blk-mq.c
    btrfs: fix error handling when submitting direct I/O bio
  * ext4: fix race between ext4_sync_parent() and rename()
      fs/ext4/fsync.c
  * ext4: fix EXT_MAX_EXTENT/INDEX to check for zeroed eh_max
      fs/ext4/ext4_extents.h
    evm: Fix possible memory leak in evm_calc_hmac_or_hash()
    ima: Directly assign the ima_default_policy pointer to ima_rules
    ima: Fix ima digest hash table key calculation
    mm: thp: make the THP mapcount atomic against __split_huge_pmd_locked()
    btrfs: send: emit file capabilities after chown
  * cpuidle: Fix three reference count leaks
      drivers/cpuidle/sysfs.c
    spi: dw: Return any value retrieved from the dma_transfer callback
    mmc: sdhci-esdhc-imx: fix the mask for tuning start point
    ixgbe: fix signed-integer-overflow warning
    staging: greybus: sdio: Respect the cmd->busy_timeout from the mmc core
    MIPS: Fix IRQ tracing when call handle_fpe() and handle_msa_fpe()
  * PCI: Don't disable decoding when mmio_always_on is set
      drivers/pci/probe.c
    macvlan: Skip loopback packets in RX handler
    m68k: mac: Don't call via_flush_cache() on Mac IIfx
    x86/mm: Stop printing BRK addresses
    mips: Add udelay lpj numbers adjustment
    x86/boot: Correct relocation destination on old linkers
    mwifiex: Fix memory corruption in dump_station
    rtlwifi: Fix a double free in _rtl_usb_tx_urb_setup()
    md: don't flush workqueue unconditionally in md_open
  * kgdb: Fix spurious true from in_dbg_master()
      include/linux/kgdb.h
    mips: cm: Fix an invalid error code of INTVN_*_ERR
    MIPS: Truncate link address into 32bit for 32bit kernel
    powerpc/spufs: fix copy_to_user while atomic
    net: allwinner: Fix use correct return type for ndo_start_xmit()
    net: lpc-enet: fix error return code in lpc_mii_init()
  * exit: Move preemption fixup up, move blocking operations down
      kernel/exit.c
  * lib/mpi: Fix 64-bit MIPS build with Clang
      lib/mpi/longlong.h
    netfilter: nft_nat: return EOPNOTSUPP if type or flags are not supported
    MIPS: Make sparse_init() using top-down allocation
    media: platform: fcp: Set appropriate DMA parameters
    media: dvb: return -EREMOTEIO on i2c transfer failure.
    dt-bindings: display: mediatek: control dpi pins mode to avoid leakage
    e1000: Distribute switch variables for initialization
  * staging: android: ion: use vmap instead of vm_map_ram
      drivers/staging/android/ion/ion_heap.c
    net: vmxnet3: fix possible buffer overflow caused by bad DMA value in vmxnet3_get_rss()
  * x86/kvm/hyper-v: Explicitly align hcall param for kvm_hyperv_exit
      include/uapi/linux/kvm.h
    ARM: 8978/1: mm: make act_mm() respect THREAD_SIZE
    btrfs: do not ignore error from btrfs_next_leaf() when inserting checksums
    clocksource: dw_apb_timer_of: Fix missing clockevent timers
    spi: dw: Enable interrupts in accordance with DMA xfer mode
  * kgdb: Prevent infinite recursive entries to the debugger
      kernel/debug/debug_core.c
  * Bluetooth: Add SCO fallback for invalid LMP parameters error
      net/bluetooth/hci_event.c
    spi: dw: Zero DMA Tx and Rx configurations on stack
    net: ena: fix error returning in ena_com_get_hash_function()
    objtool: Ignore empty alternatives
    media: si2157: Better check for running tuner in init
    ACPI: GED: use correct trigger type field in _Exx / _Lxx handling
  * media: dvb_frontend: ensure that inital front end status initialized
      drivers/media/dvb-core/dvb_frontend.c
      include/uapi/linux/dvb/frontend.h
    can: kvaser_usb: kvaser_usb_leaf: Fix some info-leaks to USB devices
    agp/intel: Reinforce the barrier after GTT updates
  * perf: Add cond_resched() to task_function_call()
      kernel/events/core.c
  * fat: don't allow to mount if the FAT length == 0
      fs/fat/inode.c
  * mm/slub: fix a memory leak in sysfs_slab_add()
      mm/slub.c
  * Smack: slab-out-of-bounds in vsscanf
      security/smack/smackfs.c
    ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb
    ath9x: Fix stack-out-of-bounds Write in ath9k_hif_usb_rx_cb
    ath9k: Fix use-after-free Write in ath9k_htc_rx_msg
    ath9k: Fix use-after-free Read in ath9k_wmi_ctrl_rx
  * KVM: arm64: Make vcpu_cp1x() work on Big Endian hosts
      arch/arm64/include/asm/kvm_host.h
    KVM: MIPS: Fix VPN2_MASK definition for variable cpu_vmbits
    KVM: MIPS: Define KVM_ENTRYHI_ASID to cpu_asid_mask(&boot_cpu_data)
    KVM: nVMX: Consult only the "basic" exit reason when routing nested exit
    KVM: nSVM: leave ASID aside in copy_vmcb_control_area
    video: fbdev: w100fb: Fix a potential double free.
  * proc: Use new_inode not new_inode_pseudo
      fs/proc/inode.c
      fs/proc/self.c
      fs/proc/thread_self.c
  * ovl: initialize error in ovl_copy_xattr
      fs/overlayfs/copy_up.c
    spi: bcm2835: Fix controller unregister order
    spi: pxa2xx: Fix controller unregister order
  * spi: Fix controller unregister order
      drivers/spi/spi.c
  * spi: No need to assign dummy value in spi_unregister_controller()
      drivers/spi/spi.c
    spi: dw: Fix controller unregister order
    spi: dw: fix possible race condition
    x86/speculation: PR_SPEC_FORCE_DISABLE enforcement for indirect branches.
    x86/speculation: Avoid force-disabling IBPB based on STIBP and enhanced IBRS.
    x86/speculation: Add support for STIBP always-on preferred mode
    x86/speculation: Change misspelled STIPB to STIBP
  * ALSA: pcm: disallow linking stream to itself
      sound/core/pcm_native.c
    spi: bcm-qspi: when tx/rx buffer is NULL set to 0
    spi: bcm2835aux: Fix controller unregister order
    nilfs2: fix null pointer dereference at nilfs_segctor_do_construct()
  * cgroup, blkcg: Prepare some symbols for module and !CONFIG_CGROUP usages
      fs/fs-writeback.c
    ACPI: PM: Avoid using power resources if there are none for D0
    ACPI: GED: add support for _Exx / _Lxx handler methods
    ACPI: CPPC: Fix reference count leak in acpi_cppc_processor_probe()
    ACPI: sysfs: Fix reference count leak in acpi_sysfs_add_hotplug_profile()
  * ALSA: usb-audio: Fix inconsistent card PM state after resume
      sound/usb/card.c
      sound/usb/usbaudio.h
    ALSA: es1688: Add the missed snd_card_free()
    efi/efivars: Add missing kobject_put() in sysfs entry creation error path
    x86/reboot/quirks: Add MacBook6,1 reboot quirk
    x86/speculation: Prevent rogue cross-process SSBD shutdown
    x86/PCI: Mark Intel C620 MROMs as having non-compliant BARs
    x86_64: Fix jiffies ODR violation
    ath9k_htc: Silence undersized packet warnings
    drivers/net/ibmvnic: Update VNIC protocol version reporting
  * sched/fair: Don't NUMA balance for kthreads
      kernel/sched/fair.c
    ARM: 8977/1: ptrace: Fix mask for thumb breakpoint hook
    crypto: talitos - fix ECB and CBC algs ivsize
  * scsi: return correct blkprep status code in case scsi_init_io() fails.
      drivers/scsi/scsi_lib.c
    vxlan: Avoid infinite loop when suppressing NS messages with invalid options
  * ipv6: fix IPV6_ADDRFORM operation logic
      net/ipv6/ipv6_sockglue.c
    Merge 4.9.227 into android-4.9-q
Linux 4.9.227
    uprobes: ensure that uprobe->offset and ->ref_ctr_offset are properly aligned
    iio: vcnl4000: Fix i2c swapped word reading.
    x86/speculation: Add Ivy Bridge to affected list
    x86/speculation: Add SRBDS vulnerability and mitigation documentation
  * x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) mitigation
      drivers/base/cpu.c
    x86/cpu: Add 'table' argument to cpu_matches()
  * x86/cpu: Add a steppings field to struct x86_cpu_id
      include/linux/mod_devicetable.h
  * nvmem: qfprom: remove incorrect write support
      drivers/nvmem/qfprom.c
    staging: rtl8712: Fix IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK
    tty: hvc_console, fix crashes on parallel open/close
  * vt: keyboard: avoid signed integer overflow in k_ascii
      drivers/tty/vt/keyboard.c
    usb: musb: Fix runtime PM imbalance on error
    USB: serial: option: add Telit LE910C1-EUX compositions
    USB: serial: usb_wwan: do not resubmit rx urb on fatal errors
    USB: serial: qcserial: add DW5816e QDL support
  * l2tp: add sk_family checks to l2tp_validate_socket
      net/l2tp/l2tp_core.c
    vsock: fix timeout in vsock_accept()
    NFC: st21nfca: add missed kfree_skb() in an error path
    net: usb: qmi_wwan: add Telit LE910C1-EUX composition
  * l2tp: do not use inet_hash()/inet_unhash()
      net/l2tp/l2tp_ip.c
      net/l2tp/l2tp_ip6.c
  * devinet: fix memleak in inetdev_init()
      net/ipv4/devinet.c
    airo: Fix read overflows sending packets
  * scsi: ufs: Release clock if DMA map fails
      drivers/scsi/ufs/ufshcd.c
    slip: not call free_netdev before rtnl_unlock in slip_open
    slcan: Fix double-free on slcan_open() error path
  * mmc: fix compilation of user API
      include/uapi/linux/mmc/ioctl.h
    kernel/relay.c: handle alloc_percpu returning NULL in relay_open
    p54usb: add AirVasT USB stick device-id
    HID: i2c-hid: add Schneider SCL142ALM to descriptor override
  * mm: Fix mremap not considering huge pmd devmap
      mm/mremap.c
  * pppoe: only process PADT targeted at local interfaces
      drivers/net/ppp/pppoe.c
    net: smsc911x: Fix runtime PM imbalance on error
    net: ethernet: stmmac: Enable interface clocks on probe for IPQ806x
    net/ethernet/freescale: rework quiesce/activate for ucc_geth
    net: bmac: Fix read of MAC address from ROM
    x86/mmiotrace: Use cpumask_available() for cpumask_var_t variables
    ARC: Fix ICCM & DCCM runtime size checks
    s390/ftrace: save traced function caller
    spi: dw: use "smp_mb()" to avoid sending spi data error
  * esp6: fix memleak on error path in esp6_input
      net/ipv6/esp6.c
    usb: gadget: f_uac2: fix error handling in afunc_bind (again)
  * scsi: scsi_devinfo: fixup string compare
      drivers/scsi/scsi_devinfo.c
    Merge 4.9.226 into android-4.9-q
Linux 4.9.226
    scsi: zfcp: fix request object use-after-free in send path causing wrong traces
    net: hns: Fixes the missing put_device in positive leg for roce reset
    sc16is7xx: move label 'err_spi' to correct section
  * mm/vmalloc.c: don't dereference possible NULL pointer in __vunmap()
      mm/vmalloc.c
  * net: rtnl_configure_link: fix dev flags changes arg to __dev_notify_flags
      net/core/rtnetlink.c
    genirq/generic_pending: Do not lose pending affinity update
  * netfilter: nf_conntrack_pptp: fix compilation warning with W=1 build
      include/linux/netfilter/nf_conntrack_pptp.h
      net/netfilter/nf_conntrack_pptp.c
  * bonding: Fix reference count leak in bond_sysfs_slave_add.
      drivers/net/bonding/bond_sysfs_slave.c
    qlcnic: fix missing release in qlcnic_83xx_interrupt_test.
  * netfilter: nf_conntrack_pptp: prevent buffer overflows in debug code
      include/linux/netfilter/nf_conntrack_pptp.h
      net/ipv4/netfilter/nf_nat_pptp.c
      net/netfilter/nf_conntrack_pptp.c
    netfilter: ipset: Fix subcounter update skip
    netfilter: nft_reject_bridge: enable reject with bridge vlan
  * ip_vti: receive ipip packet by calling ip_tunnel_rcv
      net/ipv4/ip_vti.c
  * vti4: eliminated some duplicate code.
      net/ipv4/ip_vti.c
  * xfrm: fix a NULL-ptr deref in xfrm_local_error
      net/xfrm/xfrm_output.c
  * xfrm: fix a warning in xfrm_policy_insert_list
      net/xfrm/xfrm_policy.c
  * xfrm: allow to accept packets with ipv6 NEXTHDR_HOP in xfrm_input
      net/xfrm/xfrm_input.c
    x86/dma: Fix max PFN arithmetic overflow on 32 bit systems
    mac80211: mesh: fix discovery timer re-arming issue / crash
    parisc: Fix kernel panic in mem_init()
  * iommu: Fix reference count leak in iommu_group_alloc.
      drivers/iommu/iommu.c
  * include/asm-generic/topology.h: guard cpumask_of_node() macro argument
      include/asm-generic/topology.h
  * fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info()
      fs/binfmt_elf.c
  * mm: remove VM_BUG_ON(PageSlab()) from page_mapcount()
      include/linux/mm.h
    libceph: ignore pool overlay and cache logic on redirects
  * exec: Always set cap_ambient in cap_bprm_set_creds
      security/commoncap.c
  * ALSA: usb-audio: mixer: volume quirk for ESS Technology Asus USB DAC
      sound/usb/mixer.c
  * ALSA: hwdep: fix a left shifting 1 by 31 UB bug
      sound/core/hwdep.c
    ARM: dts/imx6q-bx50v3: Set display interface clock parents
    ARM: dts: imx6q-bx50v3: Add internal switch
    ARM: dts: imx: Correct B850v3 clock assignment
    IB/qib: Call kobject_put() when kobject_init_and_add() fails
    Input: synaptics-rmi4 - fix error return code in rmi_driver_probe()
    Input: i8042 - add ThinkPad S230u to i8042 reset list
  * Input: xpad - add custom init packet for Xbox One S controllers
      drivers/input/joystick/xpad.c
  * Input: evdev - call input_flush_device() on release(), not flush()
      drivers/input/evdev.c
    Input: usbtouchscreen - add support for BonXeon TP
    cifs: Fix null pointer check in cifs_read
    usb: gadget: legacy: fix redundant initialization warnings
    cachefiles: Fix race between read_waiter and read_copier involving op->to_do
    gfs2: move privileged user check to gfs2_quota_lock_check
    net: microchip: encx24j600: add missed kthread_stop
    gpio: tegra: mask GPIO IRQs during IRQ shutdown
    IB/cma: Fix reference count leak when no ipv4 addresses are set
  * uapi: fix linux/if_pppol2tp.h userspace compilation errors
      include/uapi/linux/l2tp.h
    net/mlx4_core: fix a memory leak bug.
    net: sun: fix missing release regions in cas_init_one().
    net/mlx5: Add command entry handling completion
    net: qrtr: Fix passing invalid reference to qrtr_local_enqueue()
    net/mlx5e: Update netdev txq on completions during closure
    sctp: Start shutdown on association restart if in SHUTDOWN-SENT state and socket is closed
  * net sched: fix reporting the first-time use timestamp
      include/net/act_api.h
  * net: revert "net: get rid of an signed integer overflow in ip_idents_reserve()"
      net/ipv4/route.c
    net: ipip: fix wrong address family in init error path
    ax25: fix setsockopt(SO_BINDTODEVICE)
    ANDROID: cuttlefish defconfig - enable mount/net/uts namespaces.
    Merge 4.9.225 into android-4.9-q
Linux 4.9.225
    iio: sca3000: Remove an erroneous 'get_device()'
    rapidio: fix an error in get_user_pages_fast() error handling
    mei: release me_cl object reference
    iio: dac: vf610: Fix an error handling path in 'vf610_dac_probe()'
    staging: greybus: Fix uninitialized scalar variable
    staging: iio: ad2s1210: Fix SPI reading
    Revert "gfs2: Don't demote a glock until its revokes are written"
    cxgb4/cxgb4vf: Fix mac_hlist initialization and free
    cxgb4: free mac_hlist properly
    libnvdimm/btt: Remove unnecessary code in btt_freelist_init
    platform/x86: alienware-wmi: fix kfree on potentially uninitialized pointer
  * ubsan: build ubsan.c more conservatively
      lib/Makefile
  * x86/uaccess, ubsan: Fix UBSAN vs. SMAP
      lib/Makefile
  * l2tp: device MTU setup, tunnel socket needs a lock
      include/linux/net.h
      net/l2tp/l2tp_eth.c
      net/socket.c
    dmaengine: tegra210-adma: Fix an error handling path in 'tegra_adma_probe()'
  * ALSA: pcm: fix incorrect hw_base increase
      sound/core/pcm_lib.c
  * l2tp: initialise PPP sessions before registering them
      net/l2tp/l2tp_ppp.c
  * l2tp: protect sock pointer of struct pppol2tp_session with RCU
      net/l2tp/l2tp_ppp.c
  * l2tp: initialise l2tp_eth sessions before registering them
      net/l2tp/l2tp_eth.c
  * l2tp: don't register sessions in l2tp_session_create()
      net/l2tp/l2tp_core.c
      net/l2tp/l2tp_core.h
      net/l2tp/l2tp_eth.c
      net/l2tp/l2tp_ppp.c
  * l2tp: fix l2tp_eth module loading
      net/l2tp/l2tp_eth.c
  * l2tp: pass tunnel pointer to ->session_create()
      net/l2tp/l2tp_core.h
      net/l2tp/l2tp_eth.c
      net/l2tp/l2tp_netlink.c
      net/l2tp/l2tp_ppp.c
  * l2tp: prevent creation of sessions on terminated tunnels
      net/l2tp/l2tp_core.c
      net/l2tp/l2tp_core.h
  * l2tp: hold tunnel used while creating sessions with netlink
      net/l2tp/l2tp_netlink.c
  * l2tp: hold tunnel while handling genl TUNNEL_GET commands
      net/l2tp/l2tp_netlink.c
  * l2tp: hold tunnel while handling genl tunnel updates
      net/l2tp/l2tp_netlink.c
  * l2tp: hold tunnel while processing genl delete command
      net/l2tp/l2tp_netlink.c
  * l2tp: hold tunnel while looking up sessions in l2tp_netlink
      net/l2tp/l2tp_core.c
      net/l2tp/l2tp_core.h
      net/l2tp/l2tp_netlink.c
  * l2tp: initialise session's refcount before making it reachable
      net/l2tp/l2tp_core.c
  * l2tp: define parameters of l2tp_tunnel_find*() as "const"
      net/l2tp/l2tp_core.c
      net/l2tp/l2tp_core.h
  * l2tp: define parameters of l2tp_session_get*() as "const"
      net/l2tp/l2tp_core.c
      net/l2tp/l2tp_core.h
  * l2tp: remove l2tp_session_find()
      net/l2tp/l2tp_core.c
      net/l2tp/l2tp_core.h
  * l2tp: remove useless duplicate session detection in l2tp_netlink
      net/l2tp/l2tp_netlink.c
  * L2TP:Adjust intf MTU, add underlay L3, L2 hdrs.
      net/l2tp/l2tp_eth.c
  * New kernel function to get IP overhead on a socket.
      include/linux/net.h
      net/socket.c
  * net: l2tp: ppp: change PPPOL2TP_MSG_* => L2TP_MSG_*
      net/l2tp/l2tp_ppp.c
  * net: l2tp: deprecate PPPOL2TP_MSG_* in favour of L2TP_MSG_*
      include/uapi/linux/if_pppol2tp.h
  * net: l2tp: export debug flags to UAPI
      include/uapi/linux/l2tp.h
      net/l2tp/l2tp_core.h
  * watchdog: Fix the race between the release of watchdog_core_data and cdev
      drivers/watchdog/watchdog_dev.c
    arm64: fix the flush_icache_range arguments in machine_kexec
    padata: purge get_cpu and reorder_via_wq from padata_do_serial
    padata: initialize pd->cpu with effective cpumask
    padata: Replace delayed timer with immediate workqueue in padata_reorder
    padata: set cpu_index of unused CPUs to -1
  * i2c: dev: Fix the race between the release of i2c_dev and cdev
      drivers/i2c/i2c-dev.c
    ARM: futex: Address build warning
    platform/x86: asus-nb-wmi: Do not load on Asus T100TA and T200TA
  * USB: core: Fix misleading driver bug report
      drivers/usb/core/message.c
    ceph: fix double unlock in handle_cap_export()
    gtp: set NLM_F_MULTI flag in gtp_genl_dump_pdp()
  * component: Silence bind error on -EPROBE_DEFER
      drivers/base/component.c
  * configfs: fix config_item refcnt leak in configfs_rmdir()
      fs/configfs/dir.c
  * HID: multitouch: add eGalaxTouch P80H84 support
      drivers/hid/hid-ids.h
      drivers/hid/hid-multitouch.c
  * gcc-common.h: Update for GCC 10
      scripts/gcc-plugins/Makefile
    i2c: mux: demux-pinctrl: Fix an error handling path in 'i2c_demux_pinctrl_probe()'
    iommu/amd: Fix over-read of ACPI UID from IVRS table
  * fix multiplication overflow in copy_fdtable()
      fs/file.c
    ima: Fix return value of ima_write_policy()
    evm: Check also if *tfm is an error pointer in init_desc()
    padata: ensure padata_do_serial() runs on the correct CPU
    padata: ensure the reorder timer callback runs on the correct CPU
    padata: get_next is never NULL
    padata: Remove unused but set variables
    igb: use igb_adapter->io_addr instead of e1000_hw->hw_addr
    Merge 4.9.224 into android-4.9-q
Linux 4.9.224
  * Makefile: disallow data races on gcc-10 as well
      Makefile
    KVM: x86: Fix off-by-one error in kvm_vcpu_ioctl_x86_setup_mce
    ARM: dts: r8a7740: Add missing extal2 to CPG node
    ARM: dts: r8a73a4: Add missing CMT1 interrupts
    Revert "ALSA: hda/realtek: Fix pop noise on ALC225"
    usb: gadget: legacy: fix error return code in cdc_bind()
    usb: gadget: legacy: fix error return code in gncm_bind()
    usb: gadget: audio: Fix a missing error return value in audio_bind()
    usb: gadget: net2272: Fix a memory leak in an error handling path in 'net2272_plat_probe()'
  * exec: Move would_dump into flush_old_exec
      fs/exec.c
  * x86: Fix early boot crash on gcc-10, third try
      include/linux/compiler.h
      init/main.c
    ARM: dts: imx27-phytec-phycard-s-rdk: Fix the I2C1 pinctrl entries
  * usb: xhci: Fix NULL pointer dereference when enqueuing trbs from urb sg list
      drivers/usb/host/xhci-ring.c
  * USB: gadget: fix illegal array access in binding with UDC
      drivers/usb/gadget/configfs.c
  * ALSA: usb-audio: Add control message quirk delay for Kingston HyperX headset
      sound/usb/quirks.c
  * ALSA: rawmidi: Fix racy buffer resize under concurrent accesses
      include/sound/rawmidi.h
      sound/core/rawmidi.c
  * ALSA: rawmidi: Initialize allocated buffers
      sound/core/rawmidi.c
    ALSA: hda/realtek - Limit int mic boost for Thinkpad T530
    netprio_cgroup: Fix unlimited memory leak of v2 cgroups
  * net: ipv4: really enforce backoff for redirects
      net/ipv4/route.c
  * Revert "ipv6: add mtu lock check in __ip6_rt_update_pmtu"
      net/ipv6/route.c
  * netlabel: cope with NULL catmap
      net/ipv4/cipso_ipv4.c
      net/ipv6/calipso.c
      net/netlabel/netlabel_kapi.c
  * net: fix a potential recursive NETDEV_FEAT_CHANGE
      net/core/dev.c
  * gcc-10: disable 'restrict' warning for now
      Makefile
  * gcc-10: disable 'stringop-overflow' warning for now
      Makefile
  * gcc-10: disable 'array-bounds' warning for now
      Makefile
  * gcc-10: disable 'zero-length-bounds' warning for now
      Makefile
  * gcc-10: avoid shadowing standard library 'free()' in crypto
      crypto/xts.c
    net: phy: micrel: Use strlcpy() for ethtool::get_strings
  * Stop the ad-hoc games with -Wno-maybe-initialized
      Makefile
      init/Kconfig
      kernel/trace/Kconfig
  * kbuild: compute false-positive -Wmaybe-uninitialized cases in Kconfig
      Makefile
      init/Kconfig
      kernel/trace/Kconfig
  * gcc-10 warnings: fix low-hanging fruit
      include/linux/fs.h
      include/linux/tty.h
    pnp: Use list_for_each_entry() instead of open coding
    IB/mlx4: Test return value of calls to ib_get_cached_pkey
  * netfilter: conntrack: avoid gcc-10 zero-length-bounds warning
      include/net/netfilter/nf_conntrack.h
      net/netfilter/nf_conntrack_core.c
    i40iw: Fix error handling in i40iw_manage_arp_cache()
    pinctrl: cherryview: Add missing spinlock usage in chv_gpio_irq_handler
    ipc/util.c: sysvipc_find_ipc() incorrectly updates position index
    drm/qxl: lost qxl_bo_kunmap_atomic_page in qxl_image_init_helper()
    ALSA: hda/hdmi: fix race in monitor detection during probe
    dmaengine: mmp_tdma: Reset channel error on release
    dmaengine: pch_dma.c: Avoid data race between probe and irq handler
    cifs: Fix a race condition with cifs_echo_request
    cifs: Check for timeout on Negotiate stage
    spi: spi-dw: Add lock protect dw_spi rx/tx to prevent concurrent calls
  * scsi: sg: add sg_remove_request in sg_write
      drivers/scsi/sg.c
    drop_monitor: work around gcc-10 stringop-overflow warning
    net: moxa: Fix a potential double 'free_irq()'
    net/sonic: Fix a resource leak in an error handling path in 'jazz_sonic_probe()'
  * shmem: fix possible deadlocks on shmlock_user_lock
      mm/shmem.c
    ptp: free ptp device pin descriptors properly
  * ptp: fix the race between the release of ptp_clock and cdev
      include/linux/posix-clock.h
      kernel/time/posix-clock.c
    ptp: Fix pass zero to ERR_PTR() in ptp_clock_register
  * chardev: add helper function to register char devs with a struct device
      fs/char_dev.c
      include/linux/cdev.h
    ptp: create "pins" together with the rest of attributes
    ptp: use is_visible method to hide unused attributes
    ptp: do not explicitly set drvdata in ptp_clock_register()
  * blktrace: fix dereference after null check
      kernel/trace/blktrace.c
  * blktrace: Protect q->blk_trace with RCU
      include/linux/blkdev.h
      include/linux/blktrace_api.h
      kernel/trace/blktrace.c
  * blktrace: fix trace mutex deadlock
      kernel/trace/blktrace.c
  * blktrace: fix unlocked access to init/start-stop/teardown
      kernel/trace/blktrace.c
  * blktrace: Fix potential deadlock between delete & sysfs ops
      block/blk-core.c
      include/linux/blkdev.h
      kernel/trace/blktrace.c
  * net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup
      include/net/addrconf.h
      net/ipv6/addrconf_core.c
      net/ipv6/af_inet6.c
  * net: ipv6: add net argument to ip6_dst_lookup_flow
      include/net/ipv6.h
      net/ipv6/af_inet6.c
      net/ipv6/datagram.c
      net/ipv6/inet6_connection_sock.c
      net/ipv6/ip6_output.c
      net/ipv6/raw.c
      net/ipv6/tcp_ipv6.c
      net/l2tp/l2tp_ip6.c
  * ext4: add cond_resched() to ext4_protect_reserved_inode
      fs/ext4/block_validity.c
  * binfmt_elf: Do not move brk for INTERP-less ET_EXEC
      fs/binfmt_elf.c
    scripts/decodecode: fix trapping instruction formatting
    objtool: Fix stack offset tracking for indirect CFAs
    batman-adv: Fix refcnt leak in batadv_v_ogm_process
    batman-adv: Fix refcnt leak in batadv_store_throughput_override
    batman-adv: Fix refcnt leak in batadv_show_throughput_override
    batman-adv: fix batadv_nc_random_weight_tq
  * mm/page_alloc: fix watchdog soft lockups during set_zone_contiguous()
      mm/page_alloc.c
  * tracing: Add a vmalloc_sync_mappings() for safe measure
      kernel/trace/trace.c
    USB: serial: garmin_gps: add sanity checking for data length
    USB: uas: add quirk for LaCie 2Big Quadra
  * binfmt_elf: move brk out of mmap when doing direct loader exec
      fs/binfmt_elf.c
    Revert "ACPI / video: Add force_native quirk for HP Pavilion dv6"
    bnxt_en: Improve AER slot reset.
    net/mlx5: Fix command entry leak in Internal Error State
    net/mlx5: Fix forced completion access non initialized command entry
    bnxt_en: Fix VLAN acceleration handling in bnxt_fix_features().
    sch_sfq: validate silly quantum values
    sch_choke: avoid potential panic in choke_reset()
    net: usb: qmi_wwan: add support for DW5816e
    net/mlx4_core: Fix use of ENOSPC around mlx4_counter_alloc()
    net: macsec: preserve ingress frame ordering
  * fq_codel: fix TCA_FQ_CODEL_DROP_BATCH_SIZE sanity checks
      net/sched/sch_fq_codel.c
    dp83640: reverse arguments to list_add_tail
    USB: serial: qcserial: Add DW5816e support
  * ANDROID: hid: steam: remove BT controller matching
      drivers/hid/hid-core.c
      drivers/hid/hid-ids.h
  * UPSTREAM: HID: steam: Fix input device disappearing
      drivers/hid/hid-steam.c

Change-Id: I03104a17738ef3d28a296ca370185f58396c9262
Signed-off-by: lucaswei <lucaswei@google.com>
2020-07-10 11:45:18 +08:00
Greg Kroah-Hartman
5791e89d21 Merge 4.9.224 into android-4.9-q
Changes in 4.9.224
	USB: serial: qcserial: Add DW5816e support
	dp83640: reverse arguments to list_add_tail
	fq_codel: fix TCA_FQ_CODEL_DROP_BATCH_SIZE sanity checks
	net: macsec: preserve ingress frame ordering
	net/mlx4_core: Fix use of ENOSPC around mlx4_counter_alloc()
	net: usb: qmi_wwan: add support for DW5816e
	sch_choke: avoid potential panic in choke_reset()
	sch_sfq: validate silly quantum values
	bnxt_en: Fix VLAN acceleration handling in bnxt_fix_features().
	net/mlx5: Fix forced completion access non initialized command entry
	net/mlx5: Fix command entry leak in Internal Error State
	bnxt_en: Improve AER slot reset.
	Revert "ACPI / video: Add force_native quirk for HP Pavilion dv6"
	binfmt_elf: move brk out of mmap when doing direct loader exec
	USB: uas: add quirk for LaCie 2Big Quadra
	USB: serial: garmin_gps: add sanity checking for data length
	tracing: Add a vmalloc_sync_mappings() for safe measure
	mm/page_alloc: fix watchdog soft lockups during set_zone_contiguous()
	batman-adv: fix batadv_nc_random_weight_tq
	batman-adv: Fix refcnt leak in batadv_show_throughput_override
	batman-adv: Fix refcnt leak in batadv_store_throughput_override
	batman-adv: Fix refcnt leak in batadv_v_ogm_process
	objtool: Fix stack offset tracking for indirect CFAs
	scripts/decodecode: fix trapping instruction formatting
	binfmt_elf: Do not move brk for INTERP-less ET_EXEC
	ext4: add cond_resched() to ext4_protect_reserved_inode
	net: ipv6: add net argument to ip6_dst_lookup_flow
	net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup
	blktrace: Fix potential deadlock between delete & sysfs ops
	blktrace: fix unlocked access to init/start-stop/teardown
	blktrace: fix trace mutex deadlock
	blktrace: Protect q->blk_trace with RCU
	blktrace: fix dereference after null check
	ptp: do not explicitly set drvdata in ptp_clock_register()
	ptp: use is_visible method to hide unused attributes
	ptp: create "pins" together with the rest of attributes
	chardev: add helper function to register char devs with a struct device
	ptp: Fix pass zero to ERR_PTR() in ptp_clock_register
	ptp: fix the race between the release of ptp_clock and cdev
	ptp: free ptp device pin descriptors properly
	shmem: fix possible deadlocks on shmlock_user_lock
	net/sonic: Fix a resource leak in an error handling path in 'jazz_sonic_probe()'
	net: moxa: Fix a potential double 'free_irq()'
	drop_monitor: work around gcc-10 stringop-overflow warning
	scsi: sg: add sg_remove_request in sg_write
	spi: spi-dw: Add lock protect dw_spi rx/tx to prevent concurrent calls
	cifs: Check for timeout on Negotiate stage
	cifs: Fix a race condition with cifs_echo_request
	dmaengine: pch_dma.c: Avoid data race between probe and irq handler
	dmaengine: mmp_tdma: Reset channel error on release
	ALSA: hda/hdmi: fix race in monitor detection during probe
	drm/qxl: lost qxl_bo_kunmap_atomic_page in qxl_image_init_helper()
	ipc/util.c: sysvipc_find_ipc() incorrectly updates position index
	pinctrl: cherryview: Add missing spinlock usage in chv_gpio_irq_handler
	i40iw: Fix error handling in i40iw_manage_arp_cache()
	netfilter: conntrack: avoid gcc-10 zero-length-bounds warning
	IB/mlx4: Test return value of calls to ib_get_cached_pkey
	pnp: Use list_for_each_entry() instead of open coding
	gcc-10 warnings: fix low-hanging fruit
	kbuild: compute false-positive -Wmaybe-uninitialized cases in Kconfig
	Stop the ad-hoc games with -Wno-maybe-initialized
	net: phy: micrel: Use strlcpy() for ethtool::get_strings
	gcc-10: avoid shadowing standard library 'free()' in crypto
	gcc-10: disable 'zero-length-bounds' warning for now
	gcc-10: disable 'array-bounds' warning for now
	gcc-10: disable 'stringop-overflow' warning for now
	gcc-10: disable 'restrict' warning for now
	net: fix a potential recursive NETDEV_FEAT_CHANGE
	netlabel: cope with NULL catmap
	Revert "ipv6: add mtu lock check in __ip6_rt_update_pmtu"
	net: ipv4: really enforce backoff for redirects
	netprio_cgroup: Fix unlimited memory leak of v2 cgroups
	ALSA: hda/realtek - Limit int mic boost for Thinkpad T530
	ALSA: rawmidi: Initialize allocated buffers
	ALSA: rawmidi: Fix racy buffer resize under concurrent accesses
	ALSA: usb-audio: Add control message quirk delay for Kingston HyperX headset
	USB: gadget: fix illegal array access in binding with UDC
	usb: xhci: Fix NULL pointer dereference when enqueuing trbs from urb sg list
	ARM: dts: imx27-phytec-phycard-s-rdk: Fix the I2C1 pinctrl entries
	x86: Fix early boot crash on gcc-10, third try
	exec: Move would_dump into flush_old_exec
	usb: gadget: net2272: Fix a memory leak in an error handling path in 'net2272_plat_probe()'
	usb: gadget: audio: Fix a missing error return value in audio_bind()
	usb: gadget: legacy: fix error return code in gncm_bind()
	usb: gadget: legacy: fix error return code in cdc_bind()
	Revert "ALSA: hda/realtek: Fix pop noise on ALC225"
	ARM: dts: r8a73a4: Add missing CMT1 interrupts
	ARM: dts: r8a7740: Add missing extal2 to CPG node
	KVM: x86: Fix off-by-one error in kvm_vcpu_ioctl_x86_setup_mce
	Makefile: disallow data races on gcc-10 as well
	Linux 4.9.224

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ib9fdff8dd9e9c92a2e750251b98eb0e4c9496fba
2020-05-20 11:46:34 +02:00
Borislav Petkov
b263060dba x86: Fix early boot crash on gcc-10, third try
commit a9a3ed1eff3601b63aea4fb462d8b3b92c7c1e7e upstream.

... or the odyssey of trying to disable the stack protector for the
function which generates the stack canary value.

The whole story started with Sergei reporting a boot crash with a kernel
built with gcc-10:

  Kernel panic — not syncing: stack-protector: Kernel stack is corrupted in: start_secondary
  CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.6.0-rc5—00235—gfffb08b37df9 #139
  Hardware name: Gigabyte Technology Co., Ltd. To be filled by O.E.M./H77M—D3H, BIOS F12 11/14/2013
  Call Trace:
    dump_stack
    panic
    ? start_secondary
    __stack_chk_fail
    start_secondary
    secondary_startup_64
  -—-[ end Kernel panic — not syncing: stack—protector: Kernel stack is corrupted in: start_secondary

This happens because gcc-10 tail-call optimizes the last function call
in start_secondary() - cpu_startup_entry() - and thus emits a stack
canary check which fails because the canary value changes after the
boot_init_stack_canary() call.

To fix that, the initial attempt was to mark the one function which
generates the stack canary with:

  __attribute__((optimize("-fno-stack-protector"))) ... start_secondary(void *unused)

however, using the optimize attribute doesn't work cumulatively
as the attribute does not add to but rather replaces previously
supplied optimization options - roughly all -fxxx options.

The key one among them being -fno-omit-frame-pointer and thus leading to
not present frame pointer - frame pointer which the kernel needs.

The next attempt to prevent compilers from tail-call optimizing
the last function call cpu_startup_entry(), shy of carving out
start_secondary() into a separate compilation unit and building it with
-fno-stack-protector, was to add an empty asm("").

This current solution was short and sweet, and reportedly, is supported
by both compilers but we didn't get very far this time: future (LTO?)
optimization passes could potentially eliminate this, which leads us
to the third attempt: having an actual memory barrier there which the
compiler cannot ignore or move around etc.

That should hold for a long time, but hey we said that about the other
two solutions too so...

Reported-by: Sergei Trofimovich <slyfox@gentoo.org>
Signed-off-by: Borislav Petkov <bp@suse.de>
Tested-by: Kalle Valo <kvalo@codeaurora.org>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/20200314164451.346497-1-slyfox@gentoo.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-05-20 08:15:41 +02:00
Linus Torvalds
ce9f411be7 Stop the ad-hoc games with -Wno-maybe-initialized
commit 78a5255ffb6a1af189a83e493d916ba1c54d8c75 upstream.

We have some rather random rules about when we accept the
"maybe-initialized" warnings, and when we don't.

For example, we consider it unreliable for gcc versions < 4.9, but also
if -O3 is enabled, or if optimizing for size.  And then various kernel
config options disabled it, because they know that they trigger that
warning by confusing gcc sufficiently (ie PROFILE_ALL_BRANCHES).

And now gcc-10 seems to be introducing a lot of those warnings too, so
it falls under the same heading as 4.9 did.

At the same time, we have a very straightforward way to _enable_ that
warning when wanted: use "W=2" to enable more warnings.

So stop playing these ad-hoc games, and just disable that warning by
default, with the known and straight-forward "if you want to work on the
extra compiler warnings, use W=123".

Would it be great to have code that is always so obvious that it never
confuses the compiler whether a variable is used initialized or not?
Yes, it would.  In a perfect world, the compilers would be smarter, and
our source code would be simpler.

That's currently not the world we live in, though.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-05-20 08:15:37 +02:00
Masahiro Yamada
c0138cf0fd kbuild: compute false-positive -Wmaybe-uninitialized cases in Kconfig
commit b303c6df80c9f8f13785aa83a0471fca7e38b24d upstream.

Since -Wmaybe-uninitialized was introduced by GCC 4.7, we have patched
various false positives:

 - commit e74fc973b6 ("Turn off -Wmaybe-uninitialized when building
   with -Os") turned off this option for -Os.

 - commit 815eb71e71 ("Kbuild: disable 'maybe-uninitialized' warning
   for CONFIG_PROFILE_ALL_BRANCHES") turned off this option for
   CONFIG_PROFILE_ALL_BRANCHES

 - commit a76bcf557e ("Kbuild: enable -Wmaybe-uninitialized warning
   for "make W=1"") turned off this option for GCC < 4.9
   Arnd provided more explanation in https://lkml.org/lkml/2017/3/14/903

I think this looks better by shifting the logic from Makefile to Kconfig.

Link: https://github.com/ClangBuiltLinux/linux/issues/350
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
Tested-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-05-20 08:15:37 +02:00
Robin Peng
a7d6f7d1a0 Merge android-4.9-q (4.9.196) into android-msm-pixel-4.9-lts
Merge 4.9.196 into android-4.9-q
Linux 4.9.196
    NFC: fix attrs checks in netlink interface
  * smack: use GFP_NOFS while holding inode_smack::smk_lock
      security/smack/smack_access.c
      security/smack/smack_lsm.c
  * Smack: Don't ignore other bprm->unsafe flags if LSM_UNSAFE_PTRACE is set
      security/smack/smack_lsm.c
  * ipv6: Handle missing host route in __ipv6_ifa_notify
      net/ipv6/addrconf.c
    sch_cbq: validate TCA_CBQ_WRROPT to avoid crash
    xen-netfront: do not use ~0U as error return value for xennet_fill_frags()
    net/rds: Fix error handling in rds_ib_add_one()
    sch_dsmark: fix potential NULL deref in dsmark_init()
    qmi_wwan: add support for Cinterion CLS8 devices
    nfc: fix memory leak in llcp_sock_bind()
  * net: Unpublish sk from sk_reuseport_cb before call_rcu
      net/core/sock.c
    net: qlogic: Fix memory leak in ql_alloc_large_buffers
  * net: ipv4: avoid mixed n_redirects and rate_tokens usage
      net/ipv4/route.c
  * ipv6: drop incoming packets having a v4mapped source address
      net/ipv6/ip6_input.c
    hso: fix NULL-deref on tty open
    cxgb4:Fix out-of-bounds MSI-X info array access
  * ANDROID: binder: synchronize_rcu() when using POLLFREE.
      drivers/android/binder.c
  * ANDROID: binder: remove waitqueue when thread exits.
      drivers/android/binder.c
  * kmemleak: increase DEBUG_KMEMLEAK_EARLY_LOG_SIZE default to 16K
      lib/Kconfig.debug
    ocfs2: wait for recovering done after direct unlock request
    hypfs: Fix error number left in struct pointer member
  * fat: work around race with userspace's read via blockdev while mounting
      fs/fat/dir.c
      fs/fat/fatent.c
    ARM: 8903/1: ensure that usable memory in bank 0 starts from a PMD-aligned address
  * security: smack: Fix possible null-pointer dereferences in smack_socket_sock_rcv_skb()
      security/smack/smack_lsm.c
  * HID: apple: Fix stuck function keys when using FN
      drivers/hid/hid-apple.c
    ARM: 8898/1: mm: Don't treat faults reported from cache maintenance as writes
    PCI: tegra: Fix OF node reference leak
    mfd: intel-lpss: Remove D3cold delay
    MIPS: tlbex: Explicitly cast _PAGE_NO_EXEC to a boolean
  * scsi: core: Reduce memory required for SCSI logging
      drivers/scsi/scsi_logging.c
      include/scsi/scsi_dbg.h
    clk: at91: select parent if main oscillator or bypass is enabled
  * arm64: fix unreachable code issue with cmpxchg
      arch/arm64/include/asm/cmpxchg.h
    powerpc/pseries: correctly track irq state in default idle
    powerpc/64s/exception: machine check use correct cfar for late handler
    drm/amdgpu/si: fix ASIC tests
    vfio_pci: Restore original state on release
    pinctrl: tegra: Fix write barrier placement in pmx_writel
    powerpc/pseries/mobility: use cond_resched when updating device tree
    powerpc/futex: Fix warning: 'oldval' may be used uninitialized in this function
    powerpc/rtas: use device model APIs and serialization during LPM
    clk: sirf: Don't reference clk_init_data after registration
    clk: qoriq: Fix -Wunused-const-variable
    ipmi_si: Only schedule continuously in the thread in maintenance mode
    gpu: drm: radeon: Fix a possible null-pointer dereference in radeon_connector_set_property()
    drm/radeon: Fix EEH during kexec
    video: ssd1307fb: Start page range at page_offset
    drm/bridge: tc358767: Increase AUX transfer length limit
    Merge 4.9.195 into android-4.9-q
Linux 4.9.195
    Btrfs: fix race setting up and completing qgroup rescan workers
    btrfs: qgroup: Drop quota_root and fs_info parameters from update_qgroup_status_item
    CIFS: Fix oplock handling for SMB 2.1+ protocols
    CIFS: fix max ea value size
    i2c: riic: Clear NACK in tend isr
  * hwrng: core - don't wait on add_early_randomness()
      drivers/char/hw_random/core.c
  * quota: fix wrong condition in is_quota_modification()
      include/linux/quotaops.h
  * ext4: fix punch hole for inline_data file systems
      fs/ext4/inode.c
  * ext4: fix warning inside ext4_convert_unwritten_extents_endio
      fs/ext4/extents.c
  * /dev/mem: Bail out upon SIGKILL.
      drivers/char/mem.c
  * cfg80211: Purge frame registrations on iftype change
      net/wireless/util.c
    md/raid6: Set R5_ReadError when there is read failure on parity disk
    btrfs: Relinquish CPUs in btrfs_compare_trees
    Btrfs: fix use-after-free when using the tree modification log
  * ovl: filter of trusted xattr results in audit
      fs/overlayfs/inode.c
  * memcg, kmem: do not fail __GFP_NOFAIL charges
      mm/memcontrol.c
  * regulator: Defer init completion for a while after late_initcall
      drivers/regulator/core.c
  * alarmtimer: Use EOPNOTSUPP instead of ENOTSUPP
      kernel/time/alarmtimer.c
    ARM: zynq: Use memcpy_toio instead of memcpy on smp bring-up
    ASoC: Intel: Fix use of potentially uninitialized variable
    ASoC: Intel: NHLT: Fix debug print format
    media: sn9c20x: Add MSI MS-1039 laptop to flip_dmi_table
    KVM: x86: Manually calculate reserved bits when loading PDPTRS
    KVM: x86: set ctxt->have_exception in x86_decode_insn()
    KVM: x86: always stop emulation on page fault
    parisc: Disable HP HSC-PCI Cards to prevent kernel crash
  * fuse: fix missing unlock_page in fuse_writepage()
      fs/fuse/file.c
  * printk: Do not lose last line in kmsg buffer dump
      kernel/printk/printk.c
  * printk: remove games with previous record flags
      kernel/printk/printk.c
    IB/hfi1: Define variables as unsigned long to fix KASAN warning
    ALSA: firewire-tascam: check intermediate state of clock status and retry
    ALSA: firewire-tascam: handle error code when getting current source of clock
    PM / devfreq: passive: fix compiler warning
    media: omap3isp: Set device on omap3isp subdevs
    btrfs: extent-tree: Make sure we only allocate extents from block groups with the same type
    ALSA: hda/realtek - Blacklist PC beep for Lenovo ThinkCentre M73/93
    media: ttusb-dec: Fix info-leak in ttusb_dec_send_command()
    drm/amd/powerplay/smu7: enforce minimal VBITimeout (v2)
    e1000e: add workaround for possible stalled packet
    libertas: Add missing sentinel at end of if_usb.c fw_table
  * mmc: sdhci: Fix incorrect switch to HS mode
      drivers/mmc/host/sdhci.c
    ASoC: dmaengine: Make the pcm->name equal to pcm->id if the name is not set
    s390/crypto: xts-aes-s390 fix extra run-time crypto self tests finding
  * kprobes: Prohibit probing on BUG() and WARN() address
      include/linux/bug.h
      kernel/kprobes.c
    dmaengine: ti: edma: Do not reset reserved paRAM slots
    md/raid1: fail run raid1 array when active disk less than one
    hwmon: (acpi_power_meter) Change log level for 'unsafe software power cap'
    ACPI / PCI: fix acpi_pci_irq_enable() memory leak
    ACPI: custom_method: fix memory leaks
    ARM: dts: exynos: Mark LDO10 as always-on on Peach Pit/Pi Chromebooks
    libtraceevent: Change users plugin directory
    iommu/amd: Silence warnings under memory pressure
    nvmet: fix data units read and written counters in SMART log
  * arm64: kpti: ensure patched kernel text is fetched from PoU
      arch/arm64/mm/proc.S
    ACPI / CPPC: do not require the _PSD method
    media: ov9650: add a sanity check
    media: saa7134: fix terminology around saa7134_i2c_eeprom_md7134_gate()
    media: cpia2_usb: fix memory leaks
    media: saa7146: add cleanup in hexium_attach()
    PM / devfreq: exynos-bus: Correct clock enable sequence
    PM / devfreq: passive: Use non-devm notifiers
  * media: dvb-core: fix a memory leak bug
      drivers/media/dvb-core/dvbdev.c
    media: hdpvr: add terminating 0 at end of string
    media: radio/si470x: kill urb on error
    ARM: dts: imx7d: cl-som-imx7: make ethernet work again
    net: lpc-enet: fix printk format strings
    media: omap3isp: Don't set streaming state on random subdevs
    dmaengine: iop-adma: use correct printk format strings
    media: gspca: zero usb_buf on error
    efi: cper: print AER info of PCIe fatal error
    md: don't set In_sync if array is frozen
    md: don't call spare_active in md_reap_sync_thread if all member devices can't work
    EDAC/altera: Use the proper type for the IRQ status bits
    ia64:unwind: fix double free for mod->arch.init_unw_table
  * ALSA: usb-audio: Skip bSynchAddress endpoint check if it is invalid
      sound/usb/pcm.c
  * base: soc: Export soc_device_register/unregister APIs
      drivers/base/soc.c
    media: iguanair: add sanity checks
    ALSA: i2c: ak4xxx-adda: Fix a possible null pointer dereference in build_adc_controls()
    ALSA: hda - Show the fatal CORB/RIRB error more clearly
    x86/apic: Soft disable APIC before initializing it
    x86/reboot: Always use NMI fallback when shutdown via reboot vector IPI fails
  * sched/core: Fix CPU controller for !RT_GROUP_SCHED
      kernel/sched/core.c
  * sched/fair: Fix imbalance due to CPU affinity
      kernel/sched/fair.c
    media: hdpvr: Add device num check and handling
    media: exynos4-is: fix leaked of_node references
    media: dib0700: fix link error for dibx000_i2c_set_speed
    leds: leds-lp5562 allow firmware files up to the maximum length
    dmaengine: bcm2835: Print error in case setting DMA mask fails
    ASoC: sgtl5000: Fix charge pump source assignment
    regulator: lm363x: Fix off-by-one n_voltages for lm3632 ldo_vpos/ldo_vneg
    ALSA: hda: Flush interrupts on disabling
    nfc: enforce CAP_NET_RAW for raw sockets
    ieee802154: enforce CAP_NET_RAW for raw sockets
    ax25: enforce CAP_NET_RAW for raw sockets
    appletalk: enforce CAP_NET_RAW for raw sockets
    mISDN: enforce CAP_NET_RAW for raw sockets
  * usbnet: sanity checking of packet sizes and device mtu
      drivers/net/usb/usbnet.c
  * usbnet: ignore endpoints with invalid wMaxPacketSize
      drivers/net/usb/usbnet.c
    skge: fix checksum byte order
  * sch_netem: fix a divide by zero in tabledist()
      net/sched/sch_netem.c
  * ppp: Fix memory leak in ppp_write
      drivers/net/ppp/ppp_generic.c
    openvswitch: change type of UPCALL_PID attribute to NLA_UNSPEC
    net: qrtr: Stop rx_worker before freeing node
    net/phy: fix DP83865 10 Mbps HDX loopback disable function
    macsec: drop skb sk before calling gro_cells_receive
  * cdc_ncm: fix divide-by-zero caused by invalid wMaxPacketSize
      drivers/net/usb/cdc_ncm.c
    arcnet: provide a buffer big enough to actually receive packets
    Bluetooth: btrtl: Additional Realtek 8822CE Bluetooth devices
    xfs: don't crash on null attr fork xfs_bmapi_read
  * drm: Flush output polling on shutdown
      drivers/gpu/drm/drm_probe_helper.c
  * f2fs: fix to do sanity check on segment bitmap of LFS curseg
      fs/f2fs/segment.c
  * Revert "f2fs: avoid out-of-range memory access"
      fs/f2fs/segment.c
  * f2fs: check all the data segments against all node ones
      fs/f2fs/super.c
  * irqchip/gic-v3-its: Fix LPI release for Multi-MSI devices
      drivers/irqchip/irq-gic-v3-its.c
    locking/lockdep: Add debug_locks check in __lock_downgrade()
  * power: supply: sysfs: ratelimit property read error message
      drivers/power/supply/power_supply_sysfs.c
    mac80211: handle deauthentication/disassociation from TDLS peer
    mac80211: Print text for disassociation reason
    objtool: Clobber user CFLAGS variable
    ALSA: hda - Add laptop imic fixup for ASUS M9V laptop
    ASoC: fsl: Fix of-node refcount unbalance in fsl_ssi_probe_from_dt()
    media: tvp5150: fix switch exit in set control handler
    crypto: talitos - fix missing break in switch statement
    mtd: cfi_cmdset_0002: Use chip_good() to retry in do_write_oneword()
    HID: hidraw: Fix invalid read in hidraw_ioctl
    HID: logitech: Fix general protection fault caused by Logitech driver
    HID: prodikeys: Fix general protection fault during probe
    IB/core: Add an unbound WQ type to the new CQ API
  * Revert "Bluetooth: validate BLE connection interval updates"
      net/bluetooth/hci_event.c
      net/bluetooth/l2cap_core.c
  * BACKPORT: block: annotate refault stalls from IO submission
      block/bio.c
      block/blk-core.c
      include/linux/blk_types.h
  * ANDROID: usb: gadget: Fix dependency for f_accessory
      drivers/usb/gadget/Kconfig
    Remove taskname from lowmemorykiller kill reports
    Merge 4.9.194 into android-4.9-q
Linux 4.9.194
  * net_sched: let qdisc_put() accept NULL pointer
      net/sched/sch_generic.c
    ARC: export "abort" for modules
    media: technisat-usb2: break out of loop at end of buffer
    floppy: fix usercopy direction
    iommu/amd: Fix race in increase_address_space()
  * keys: Fix missing null pointer check in request_key_auth_describe()
      security/keys/request_key_auth.c
    x86/uaccess: Don't leak the AC flags into __get_user() argument evaluation
    dmaengine: ti: omap-dma: Add cleanup in omap_dma_probe()
    dmaengine: ti: dma-crossbar: Fix a memory leak bug
    net: seeq: Fix the function used to release some memory in an error handling path
    tools/power turbostat: fix buffer overrun
    perf/x86/amd/ibs: Fix sample bias for dispatched micro-ops
    perf/x86/intel: Restrict period on Nehalem
    sky2: Disable MSI on yet another ASUS boards (P6Xxxx)
    ARM: 8901/1: add a criteria for pfn_valid of arm
    cifs: Use kzfree() to zero out the password
    cifs: set domainName when a domain-key is used in multiuser
    NFSv2: Fix write regression
    NFSv2: Fix eof handling
  * netfilter: nf_conntrack_ftp: Fix debug output
      net/netfilter/nf_conntrack_ftp.c
    x86/apic: Fix arch_dynirq_lower_bound() bug for DT enabled machines
  * r8152: Set memory to all 0xFFs on failed reg reads
      drivers/net/usb/r8152.c
    batman-adv: Only read OGM2 tvlv_len after buffer len check
    ARM: 8874/1: mm: only adjust sections of valid mm structures
    qed: Add cleanup in qed_slowpath_start()
  * Kconfig: Fix the reference to the IDT77105 Phy driver in the description of ATM_NICSTAR_USE_IDT77105
      drivers/atm/Kconfig
    NFS: Fix initialisation of I/O result struct in nfs_pgio_rpcsetup
    NFSv4: Fix return values for nfs4_file_open()
    s390/bpf: use 32-bit index for tail calls
    ARM: OMAP2+: Fix omap4 errata warning on other SoCs
    s390/bpf: fix lcgr instruction encoding
    ARM: OMAP2+: Fix missing SYSC_HAS_RESET_STATUS for dra7 epwmss
    mwifiex: Fix three heap overflow at parsing element in cfg80211_ap_settings
    tty/serial: atmel: reschedule TX after RX was started
    serial: sprd: correct the wrong sequence of arguments
    KVM: coalesced_mmio: add bounds checking
    xen-netfront: do not assume sk_buff_head list is empty in error handling
    x86/boot: Add missing bootparam that breaks boot on some platforms
    powerpc/mm/radix: Use the right page size for vmemmap mapping
    media: tm6000: double free if usb disconnect while streaming
  * USB: usbcore: Fix slab-out-of-bounds bug during device reset
      drivers/usb/core/config.c
    x86/build: Add -Wnoaddress-of-packed-member to REALMODE_CFLAGS, to silence GCC9 build warning
  * nvmem: Use the same permissions for eeprom as for nvmem
      drivers/nvmem/core.c
    drm/mediatek: mtk_drm_drv.c: Add of_node_put() before goto
    crypto: talitos - HMAC SNOOP NO AFEU mode requires SW icv checking.
    crypto: talitos - Do not modify req->cryptlen on decryption.
    crypto: talitos - fix ECB algs ivsize
    crypto: talitos - check data blocksize in ablkcipher.
    crypto: talitos - fix CTR alg blocksize
    crypto: talitos - check AES key size
  * driver core: Fix use-after-free and double free on glue directory
      drivers/base/core.c
    mtd: rawnand: mtk: Fix wrongly assigned OOB buffer pointer issue
    clk: rockchip: Don't yell about bad mmc phases when getting
    MIPS: VDSO: Use same -m%-float cflag as the kernel proper
    MIPS: VDSO: Prevent use of smp_processor_id()
    KVM: nVMX: handle page fault in vmread
    KVM: x86: work around leak of uninitialized stack contents
    KVM: s390: Do not leak kernel stack data in the KVM_S390_INTERRUPT ioctl
  * genirq: Prevent NULL pointer dereference in resend_irqs()
      kernel/irq/resend.c
    Btrfs: fix assertion failure during fsync and use of stale transaction
  * gpio: fix line flag validation in lineevent_create
      drivers/gpio/gpiolib.c
  * gpio: fix line flag validation in linehandle_create
      drivers/gpio/gpiolib.c
    Revert "MIPS: SiByte: Enable swiotlb for SWARM, LittleSur and BigSur"
  * tun: fix use-after-free when register netdev failed
      drivers/net/tun.c
    tipc: add NULL pointer check before calling kfree_rcu
  * tcp: fix tcp_ecn_withdraw_cwr() to clear TCP_ECN_QUEUE_CWR
      net/ipv4/tcp_input.c
    sctp: use transport pf_retrans in sctp_do_8_2_transport_strike
    sctp: Fix the link time qualifier of 'sctp_ctrlsock_exit()'
    sch_hhf: ensure quantum and hhf_non_hh_weight are non-zero
  * net: gso: Fix skb_segment splat when splitting gso_size mangled skb having linear-headed frag_list
      net/core/skbuff.c
  * net: Fix null de-reference of device refcount
      net/core/dev.c
    isdn/capi: check message length in capi_write()
  * ipv6: Fix the link time qualifier of 'ping_v6_proc_exit_net()'
      net/ipv6/ping.c
  * cdc_ether: fix rndis support for Mediatek based smartphones
      drivers/net/usb/cdc_ether.c
  * bridge/mdb: remove wrong use of NLM_F_MULTI
      net/bridge/br_mdb.c
  * ANDROID: regression introduced override_creds=off
      fs/overlayfs/dir.c
  * UPSTREAM: psi: get poll_work to run when calling poll syscall next time
      kernel/sched/psi.c
  * UPSTREAM: sched/psi: Do not require setsched permission from the trigger creator
      kernel/sched/psi.c
  * UPSTREAM: sched/psi: Reduce psimon FIFO priority
      kernel/sched/psi.c
    Merge 4.9.193 into android-4.9-q
Linux 4.9.193
    vhost: make sure log_num < in_num
    clk: s2mps11: Add used attribute to s2mps11_dt_match
    scripts/decode_stacktrace: match basepath using shell prefix operator, not regex
    batman-adv: Only read OGM tvlv_len after buffer len check
    batman-adv: fix uninit-value in batadv_netlink_get_ifindex()
    vhost/test: fix build for vhost test
  * ip6: fix skb leak in ip6frag_expire_frag_queue()
      include/net/ipv6_frag.h
  * xfrm: clean up xfrm protocol checks
      include/net/xfrm.h
      net/key/af_key.c
      net/xfrm/xfrm_state.c
      net/xfrm/xfrm_user.c
    powerpc/tm: Fix FP/VMX unavailable exceptions inside a transaction
    drm/vmwgfx: Fix double free in vmw_recv_msg()
  * sched/fair: Don't assign runtime for throttled cfs_rq
      kernel/sched/fair.c
    ALSA: hda/realtek - Fix overridden device-specific initialization
    ALSA: hda - Fix potential endless loop at applying quirks
  * ANDROID: Revert "ANDROID: sched: Disallow WALT with CFS bandwidth control"
      init/Kconfig
  * ANDROID: sched: WALT: Add support for CFS_BANDWIDTH
      kernel/sched/fair.c
  * ANDROID: sched: WALT: Refactor cumulative runnable average fixup
      kernel/sched/deadline.c
      kernel/sched/fair.c
      kernel/sched/rt.c
      kernel/sched/sched.h
      kernel/sched/stop_task.c
      kernel/sched/walt.c
      kernel/sched/walt.h

Change-Id: Ifc17376212d89db44dc48d0963b25d93ff1cb978
Signed-off-by: Robin Peng <robinpeng@google.com>
2019-11-01 12:32:49 +08:00
Robin Peng
d5bdee4cf1 Merge android-4.9-q (4.9.192) into android-msm-pixel-4.9-lts
Merge 4.9.192 into android-4.9-q
Linux 4.9.192
  * mld: fix memory leak in mld_del_delrec()
      net/ipv6/mcast.c
  * tcp: inherit timestamp on mtu probe
      net/ipv4/tcp_output.c
    net: stmmac: dwmac-rk: Don't fail if phy regulator is absent
    net: fix skb use after free in netpoll
    Revert "x86/apic: Include the LDR when clearing out APIC registers"
    spi: bcm2835aux: fix corruptions for longer spi transfers
    spi: bcm2835aux: remove dangerous uncontrolled read of fifo
    spi: bcm2835aux: unifying code between polling and interrupt driven code
    spi: bcm2835aux: ensure interrupts are enabled for shared handler
    libceph: allow ceph_buffer_put() to receive a NULL ceph_buffer
    KVM: arm/arm64: Only skip MMIO insn once
    ceph: fix buffer free while holding i_ceph_lock in fill_inode()
    ceph: fix buffer free while holding i_ceph_lock in __ceph_setxattr()
    IB/mlx4: Fix memory leaks
    Tools: hv: kvp: eliminate 'may be used uninitialized' warning
    ravb: Fix use-after-free ravb_tstamp_skb
    wimax/i2400m: fix a memory leak bug
    net: kalmia: fix memory leaks
    cx82310_eth: fix a memory leak bug
    net: myri10ge: fix memory leaks
    cxgb4: fix a memory leak bug
  * gpio: Fix build error of function redefinition
      include/linux/gpio.h
    ibmveth: Convert multicast list size for little-endian system
    Bluetooth: btqca: Add a short delay before downloading the NVM
    net: tc35815: Explicitly check NET_IP_ALIGN is not zero in tc35815_rx
    net: tundra: tsi108: use spin_lock_irqsave instead of spin_lock_irq in IRQ context
    Merge 4.9.191 into android-4.9-q
Linux 4.9.191
  * mm/zsmalloc.c: fix build when CONFIG_COMPACTION=n
      mm/zsmalloc.c
    x86/ptrace: fix up botched merge of spectrev1 fix
    i2c: piix4: Fix port selection for AMD Family 16h Model 30h
    KVM: arm/arm64: vgic-v2: Handle SGI bits in GICD_I{S,C}PENDR0 as WI
    KVM: arm/arm64: vgic: Fix potential deadlock when ap_list is long
    mac80211: fix possible sta leak
  * Revert "cfg80211: fix processing world regdomain when non modular"
      net/wireless/reg.c
    VMCI: Release resource if the work is already queued
    stm class: Fix a double free of stm_source_device
  * mmc: core: Fix init of SD cards reporting an invalid VDD range
      drivers/mmc/core/sd.c
    mmc: sdhci-of-at91: add quirk for broken HS200
    uprobes/x86: Fix detection of 32-bit user mode
    ptrace,x86: Make user_64bit_mode() available to 32-bit builds
    USB: storage: ums-realtek: Whitelist auto-delink support
    USB: storage: ums-realtek: Update module parameter description for auto_delink_en
    usb: host: xhci: rcar: Fix typo in compatible string matching
    usb: host: ohci: fix a race condition between shutdown and irq
    usb: chipidea: udc: don't do hardware access if gadget has stopped
    USB: cdc-wdm: fix race between write and disconnect due to flag abuse
  * usb-storage: Add new JMS567 revision to unusual_devs
      drivers/usb/storage/unusual_devs.h
  * mm/zsmalloc.c: fix race condition in zs_destroy_pool
      mm/zsmalloc.c
    x86/apic: Include the LDR when clearing out APIC registers
    x86/apic: Do not initialize LDR and DFR for bigsmp
    KVM: x86: Don't update RIP or do single-step on faulting emulation
    ALSA: seq: Fix potential concurrent access to the deleted pool
    ALSA: line6: Fix memory leak at line6_init_pcm() error path
  * tcp: make sure EPOLLOUT wont be missed
      net/core/stream.c
  * ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit
      sound/usb/mixer.c
  * ALSA: usb-audio: Fix a stack buffer overflow bug in check_input_term
      sound/usb/mixer.c
  * tcp: fix tcp_rtx_queue_tail in case of empty retransmit queue
      include/net/tcp.h
  * scsi: ufs: Fix RX_TERMINATION_FORCE_ENABLE define value
      drivers/scsi/ufs/unipro.h
    watchdog: bcm2835_wdt: Fix module autoload
    tools: hv: fix KVP and VSS daemons exit code
    usb: host: fotg2: restart hcd after port reset
    i2c: emev2: avoid race when unregistering slave client
    xen/blkback: fix memory leaks
  * usb: gadget: composite: Clear "suspended" on reset/disconnect
      drivers/usb/gadget/composite.c
  * iommu/dma: Handle SG length overflow better
      drivers/iommu/dma-iommu.c
    dmaengine: ste_dma40: fix unneeded variable warning
    x86/CPU/AMD: Clear RDRAND CPUID bit on AMD family 15h/16h
    Revert "perf test 6: Fix missing kvm module load for s390"
    xfs: fix missing ILOCK unlock when xfs_setattr_nonsize fails due to EDQUOT
  * mm/zsmalloc.c: migration can leave pages in ZS_EMPTY indefinitely
      mm/zsmalloc.c
    mm, page_owner: handle THP splits correctly
  * genirq: Properly pair kobject_del() with kobject_add()
      kernel/irq/irqdesc.c
  * dm table: fix invalid memory accesses with too high sector number
      drivers/md/dm-table.c
    dm space map metadata: fix missing store of apply_bops() return value
    dm btree: fix order of block initialization in btree_split_beneath
    x86/boot: Fix boot regression caused by bootparam sanitizing
    x86/boot: Save fields explicitly, zero out everything else
    x86/apic: Handle missing global clockevent gracefully
    x86/retpoline: Don't clobber RFLAGS during CALL_NOSPEC on i386
    userfaultfd_release: always remove uffd flags and clear vm_userfaultfd_ctx
  * gpiolib: never report open-drain/source lines as 'input' to user-space
      drivers/gpio/gpiolib.c
  * Revert "dm bufio: fix deadlock with loop device"
      drivers/md/dm-bufio.c
    HID: wacom: Correct distance scale for 2nd-gen Intuos devices
    HID: wacom: correct misreported EKR ring values
    selftests: kvm: Adding config fragments
    perf pmu-events: Fix missing "cpu_clk_unhalted.core" event
    drm/vmwgfx: fix memory leak when too many retries have occurred
    x86/lib/cpu: Address missing prototypes warning
    libata: add SG safety checks in SFF pio transfers
    net: hisilicon: Fix dma_map_single failed on arm64
    net: hisilicon: fix hip04-xmit never return TX_BUSY
    net: hisilicon: make hip04_tx_reclaim non-reentrant
    net: cxgb3_main: Fix a resource leak in a error path in 'init_one()'
    HID: input: fix a4tech horizontal wheel custom usage
    NFSv4: Fix a potential sleep while atomic in nfs4_do_reclaim()
    can: peak_usb: force the string buffer NULL-terminated
    can: sja1000: force the string buffer NULL-terminated
    perf bench numa: Fix cpu0 binding
    isdn: hfcsusb: Fix mISDN driver crash caused by transfer buffer on the stack
    isdn: mISDN: hfcsusb: Fix possible null-pointer dereferences in start_isoc_chain()
    net: usb: qmi_wwan: Add the BroadMobi BM818 card
    ASoC: ti: davinci-mcasp: Correct slot_width posed constraint
    st_nci_hci_connectivity_event_received: null check the allocation
    st21nfca_connectivity_event_received: null check the allocation
    can: dev: call netif_carrier_off() in register_candev()
  * bonding: Force slave speed check after link state recovery for 802.3ad
      drivers/net/bonding/bond_main.c
  * ASoC: dapm: Fix handling of custom_stop_condition on DAPM graph walks
      sound/soc/soc-dapm.c
  * netfilter: ebtables: fix a memory leak bug in compat
      net/bridge/netfilter/ebtables.c
    MIPS: kernel: only use i8253 clocksource with periodic clockevent
    HID: Add 044f:b320 ThrustMaster, Inc. 2 in 1 DT
  * BACKPORT: arch: add pidfd and io_uring syscalls everywhere
      arch/arm64/include/asm/unistd32.h
  * UPSTREAM: pidfd: fix a poll race when setting exit_state
      kernel/exit.c
  * BACKPORT: arch: wire-up pidfd_open()
      arch/arm64/include/asm/unistd.h
      arch/arm64/include/asm/unistd32.h
      arch/x86/entry/syscalls/syscall_32.tbl
      include/uapi/asm-generic/unistd.h
  * BACKPORT: pid: add pidfd_open()
      include/linux/syscalls.h
      kernel/pid.c
  * UPSTREAM: pidfd: add polling support
      include/linux/pid.h
      kernel/fork.c
      kernel/pid.c
      kernel/signal.c
  * UPSTREAM: signal: improve comments
      kernel/signal.c
  * BACKPORT: fork: do not release lock that wasn't taken
      kernel/fork.c
  * BACKPORT: signal: support CLONE_PIDFD with pidfd_send_signal
      kernel/signal.c
      kernel/sys_ni.c
  * BACKPORT: clone: add CLONE_PIDFD
      include/linux/pid.h
      include/uapi/linux/sched.h
      kernel/fork.c
  * UPSTREAM: Make anon_inodes unconditional
      arch/arm64/kvm/Kconfig
      drivers/base/Kconfig
      drivers/char/tpm/Kconfig
      drivers/dma-buf/Kconfig
      drivers/gpio/Kconfig
      drivers/iio/Kconfig
      drivers/infiniband/Kconfig
      drivers/vfio/Kconfig
      fs/Makefile
      fs/notify/fanotify/Kconfig
      fs/notify/inotify/Kconfig
      init/Kconfig
  * UPSTREAM: signal: use fdget() since we don't allow O_PATH
      kernel/signal.c
  * UPSTREAM: signal: don't silently convert SI_USER signals to non-current pidfd
      kernel/signal.c
  * BACKPORT: signal: add pidfd_send_signal() syscall
      arch/x86/entry/syscalls/syscall_32.tbl
      fs/proc/base.c
      include/linux/proc_fs.h
      include/linux/syscalls.h
      include/uapi/asm-generic/unistd.h
      kernel/signal.c
      kernel/sys_ni.c
  * ANDROID: sched: Disallow WALT with CFS bandwidth control
      init/Kconfig
  * ANDROID: fiq_debugger: remove
      drivers/staging/android/Kconfig
      drivers/staging/android/Makefile
    Merge 4.9.190 into android-4.9-q
Linux 4.9.190
  * bonding: Add vlan tx offload to hw_enc_features
      drivers/net/bonding/bond_main.c
    team: Add vlan tx offload to hw_enc_features
    net/mlx5e: Use flow keys dissector to parse packets for ARFS
    net/mlx5e: Only support tx/rx pause setting for port owner
    xen/netback: Reset nr_frags before freeing skb
    sctp: fix the transport error_count check
  * net/packet: fix race in tpacket_snd()
      net/packet/af_packet.c
    bnx2x: Fix VF's VLAN reconfiguration in reload.
    iommu/amd: Move iommu_init_pci() to .init section
    Input: psmouse - fix build error of multiple definition
  * netfilter: conntrack: Use consistent ct id hash calculation
      net/netfilter/nf_conntrack_core.c
  * arm64: compat: Allow single-byte watchpoints on all addresses
      arch/arm64/kernel/hw_breakpoint.c
  * bpf: fix bpf_jit_limit knob for PAGE_SIZE >= 64K
      include/linux/filter.h
      kernel/bpf/core.c
      net/core/sysctl_net_core.c
  * asm-generic: fix -Wtype-limits compiler warnings
      include/asm-generic/getorder.h
    USB: serial: option: Add Motorola modem UARTs
    USB: serial: option: add the BroadMobi BM818 card
    USB: serial: option: Add support for ZTE MF871A
    USB: serial: option: add D-Link DWM-222 device ID
  * USB: CDC: fix sanity checks in CDC union parser
      drivers/usb/core/message.c
    usb: cdc-acm: make sure a refcount is taken early enough
  * USB: core: Fix races in character device registration and deregistraion
      drivers/usb/core/file.c
    staging: comedi: dt3000: Fix rounding up of timer divisor
    staging: comedi: dt3000: Fix signed integer overflow 'divider * base'
    ocfs2: remove set but not used variable 'last_hash'
    IB/mad: Fix use-after-free in ib mad completion handling
    IB/core: Add mitigation for Spectre V1
  * arm64/mm: fix variable 'pud' set but not used
      arch/arm64/include/asm/pgtable.h
  * arm64/efi: fix variable 'si' set but not used
      arch/arm64/include/asm/efi.h
  * kbuild: modpost: handle KBUILD_EXTRA_SYMBOLS only for external modules
      scripts/Makefile.modpost
    ata: libahci: do not complain in case of deferred probe
    scsi: hpsa: correct scsi command status issue after reset
    libata: zpodd: Fix small read overflow in zpodd_get_mech_type()
    perf header: Fix use of unitialized value warning
    perf header: Fix divide by zero error if f_header.attr_size==0
    irqchip/irq-imx-gpcv2: Forward irq type to parent
    xen/pciback: remove set but not used variable 'old_state'
    net: usb: pegasus: fix improper read if get_registers() fail
    Input: iforce - add sanity checks
    Input: kbtab - sanity check for endpoint type
  * HID: hiddev: do cleanup in failure of opening a device
      drivers/hid/usbhid/hiddev.c
  * HID: hiddev: avoid opening a disconnected device
      drivers/hid/usbhid/hiddev.c
    HID: holtek: test for sanity of intfdata
    ALSA: hda - Let all conexant codec enter D3 when rebooting
    ALSA: hda - Add a generic reboot_notify
    ALSA: hda - Fix a memory leak bug
    xtensa: add missing isync to the cpu_reset TLB code
  * netfilter: ctnetlink: don't use conntrack/expect object addresses as id
      include/net/netfilter/nf_conntrack.h
      net/netfilter/nf_conntrack_core.c
      net/netfilter/nf_conntrack_netlink.c
  * inet: switch IP ID generator to siphash
      include/linux/siphash.h
      include/net/netns/ipv4.h
      net/ipv4/route.c
      net/ipv6/output_core.c
  * siphash: implement HalfSipHash1-3 for hash tables
      include/linux/siphash.h
      lib/siphash.c
  * siphash: add cryptographically secure PRF
      include/linux/siphash.h
      lib/Kconfig.debug
      lib/Makefile
      lib/siphash.c
    vhost: scsi: add weight support
    vhost_net: fix possible infinite loop
    vhost: introduce vhost_exceeds_weight()
    vhost_net: introduce vhost_exceeds_weight()
    vhost_net: use packet weight for rx handler, too
    vhost-net: set packet weight of tx polling to 2 * vq size
  * bpf: add bpf_jit_limit knob to restrict unpriv allocations
      include/linux/filter.h
      kernel/bpf/core.c
      net/core/sysctl_net_core.c
  * bpf: restrict access to core bpf sysctls
      net/core/sysctl_net_core.c
  * bpf: get rid of pure_initcall dependency to enable jits
      kernel/bpf/core.c
      net/core/sysctl_net_core.c
      net/socket.c
  * mm/memcontrol.c: fix use after free in mem_cgroup_iter()
      mm/memcontrol.c
  * mm/usercopy: use memory range to be accessed for wraparound check
      mm/usercopy.c
    sh: kernel: hw_breakpoint: Fix missing break in switch statement
    scsi: mpt3sas: Use 63-bit DMA addressing on SAS35 HBA
    iwlwifi: don't unmap as page memory that was mapped as single
    mwifiex: fix 802.11n/WPA detection
    smb3: send CAP_DFS capability during session setup
    SMB3: Fix deadlock in validate negotiate hits reconnect
    mac80211: don't WARN on short WMM parameters from AP
    ALSA: hda - Don't override global PCM hw info flag
    ALSA: firewire: fix a memory leak bug
    hwmon: (nct7802) Fix wrong detection of in4 presence
    can: peak_usb: pcan_usb_fd: Fix info-leaks to USB devices
    can: peak_usb: pcan_usb_pro: Fix info-leaks to USB devices
  * perf/core: Fix creating kernel counters for PMUs that override event->cpu
      kernel/events/core.c
  * tty/ldsem, locking/rwsem: Add missing ACQUIRE to read_failed sleep loop
      drivers/tty/tty_ldsem.c
    scsi: scsi_dh_alua: always use a 2 second delay before retrying RTPG
    scsi: ibmvfc: fix WARN_ON during event pool release
    scsi: megaraid_sas: fix panic on loading firmware crashdump
    ARM: davinci: fix sleep.S build error on ARMv4
    ACPI/IORT: Fix off-by-one check in iort_dev_find_its_id()
    drbd: dynamically allocate shash descriptor
    perf probe: Avoid calling freeing routine multiple times for same pointer
  * ALSA: compress: Be more restrictive about when a drain is allowed
      sound/core/compress_offload.c
  * ALSA: compress: Don't allow paritial drain operations on capture streams
      sound/core/compress_offload.c
  * ALSA: compress: Prevent bypasses of set_params
      sound/core/compress_offload.c
  * ALSA: compress: Fix regression on compressed capture streams
      include/sound/compress_driver.h
      sound/core/compress_offload.c
    s390/qdio: add sanity checks to the fast-requeue path
    cpufreq/pasemi: fix use-after-free in pas_cpufreq_cpu_init()
    hwmon: (nct6775) Fix register address and added missed tolerance for nct6106
    mac80211: don't warn about CW params when not using them
  * iscsi_ibft: make ISCSI_IBFT dependson ACPI instead of ISCSI_IBFT_FIND
      drivers/firmware/Kconfig
  * netfilter: nfnetlink: avoid deadlock due to synchronous request_module
      net/netfilter/nfnetlink.c
    can: peak_usb: fix potential double kfree_skb()
    usb: yurex: Fix use-after-free in yurex_delete
    perf record: Fix module size on s390
    perf db-export: Fix thread__exec_comm()
    perf record: Fix wrong size in perf_record_mmap for last kernel module
  * mm/vmalloc: Sync unmappings in __purge_vmap_area_lazy()
      mm/vmalloc.c
    x86/mm: Sync also unmappings in vmalloc_sync_all()
    x86/mm: Check for pfn instead of page in vmalloc_sync_one()
  * sound: fix a memory leak bug
      sound/sound_core.c
    usb: iowarrior: fix deadlock on disconnect
  * usb: usbfs: fix double-free of usb memory upon submiturb error
      drivers/usb/core/devio.c
    ANDROID: fix kernelci build-break in lowmemorykiller
    ANDROID: Fixes to locking around handle_lmk_event
  * UPSTREAM: net/ipv6: allow sysctl to change link-local address generation mode
      include/linux/ipv6.h
      include/net/if_inet6.h
      net/ipv6/addrconf.c
  * ANDROID: fix binder change in merge of 4.9.188
      drivers/android/binder_alloc.c
    Merge 4.9.189 into android-4.9-q
Linux 4.9.189
    x86/speculation/swapgs: Exclude ATOMs from speculation through SWAPGS
    x86/entry/64: Use JMP instead of JMPQ
    x86/speculation: Enable Spectre v1 swapgs mitigations
    x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations
    x86: cpufeatures: Sort feature word 7
    spi: bcm2835: Fix 3-wire mode if DMA is enabled
  * block: blk_init_allocated_queue() set q->fq as NULL in the fail case
      block/blk-core.c
    bnx2x: Disable multi-cos feature.
    ife: error out when nla attributes are empty
  * ip6_tunnel: fix possible use-after-free on xmit
      net/ipv6/ip6_tunnel.c
  * compat_ioctl: pppoe: fix PPPOEIOCSFWD handling
      drivers/net/ppp/pppoe.c
      drivers/net/ppp/pppox.c
      fs/compat_ioctl.c
      include/linux/if_pppox.h
      net/l2tp/l2tp_ppp.c
    tipc: compat: allow tipc commands without arguments
    net: sched: Fix a possible null-pointer dereference in dequeue_func()
    net/mlx5: Use reversed order when unregister devices
  * net: fix ifindex collision during namespace removal
      net/core/dev.c
  * net: bridge: mcast: don't delete permanent entries when fast leave is enabled
      net/bridge/br_multicast.c
    net: bridge: delete local fdb on device init failure
    atm: iphase: Fix Spectre v1 vulnerability
    libceph: use kbasename() and kill ceph_file_part()
    objtool: Add rewind_stack_do_exit() to the noreturn list
    objtool: Add machine_real_restart() to the noreturn list
    IB: directly cast the sockaddr union to aockaddr
    RDMA: Directly cast the sockaddr union to sockaddr
  * HID: Add quirk for HP X1200 PIXART OEM mouse
      drivers/hid/hid-ids.h
      drivers/hid/usbhid/hid-quirks.c
    HID: wacom: fix bit shift for Cintiq Companion 2
  * tcp: be more careful in tcp_fragment()
      include/net/tcp.h
      net/ipv4/tcp_output.c
  * arm64: cpufeature: Fix feature comparison for CTR_EL0.{CWG,ERG}
      arch/arm64/include/asm/cpufeature.h
      arch/arm64/kernel/cpufeature.c
  * arm64: cpufeature: Fix CTR_EL0 field definitions
      arch/arm64/kernel/cpufeature.c
    ARM: dts: logicpd-som-lv: Fix Audio Mute
    ARM: dts: Add pinmuxing for i2c2 and i2c3 for LogicPD torpedo
    ARM: dts: Add pinmuxing for i2c2 and i2c3 for LogicPD SOM-LV
    scsi: fcoe: Embed fc_rport_priv in fcoe_rport structure
  * fs/crypto: Fix 4.9.186 missmerge
      fs/crypto/policy.c
    Merge 4.9.188 into android-4.9-q
Linux 4.9.188
    x86, mm, gup: prevent get_page() race with munmap in paravirt guest
    objtool: Support GCC 9 cold subfunction naming scheme
  * include/linux/module.h: copy __init/__exit attrs to init/cleanup_module
      include/linux/module.h
  * Backport minimal compiler_attributes.h to support GCC 9
      include/linux/compiler.h
    eeprom: at24: make spd world-readable again
  * coredump: fix race condition between collapse_huge_page() and core dumping
      include/linux/mm.h
    infiniband: fix race condition between infiniband mlx4, mlx5 driver and core dumping
  * coredump: fix race condition between mmget_not_zero()/get_task_mm() and core dumping
      drivers/android/binder.c
      fs/proc/task_mmu.c
      include/linux/mm.h
      mm/mmap.c
    IB/mlx5: Fix RSS Toeplitz setup to be aligned with the HW specification
    xen/swiotlb: fix condition for calling xen_destroy_contiguous_region()
  * drivers/perf: arm_pmu: Fix failure path in PM notifier
      drivers/perf/arm_pmu.c
    s390/dasd: fix endless loop after read unit address configuration
  * selinux: fix memory leak in policydb_init()
      security/selinux/ss/policydb.c
  * gpiolib: fix incorrect IRQ requesting of an active-low lineevent
      drivers/gpio/gpiolib.c
    mmc: dw_mmc: Fix occasional hang after tuning on eMMC
    Btrfs: fix incremental send failure after deduplication
  * kbuild: initialize CLANG_FLAGS correctly in the top Makefile
      Makefile
    x86, boot: Remove multiple copy of static function sanitize_boot_params()
    x86/kvm: Don't call kvm_spurious_fault() from .fixup
    ipc/mqueue.c: only perform resource calculation if user valid
    drivers/rapidio/devices/rio_mport_cdev.c: NUL terminate some strings
    uapi linux/coda_psdev.h: move upc_req definition from uapi to kernel side headers
    coda: fix build using bare-metal toolchain
    coda: add error handling for fget
  * mm/cma.c: fail if fixed declaration can't be honored
      mm/cma.c
    x86: math-emu: Hide clang warnings for 16-bit overflow
    x86/apic: Silence -Wtype-limits compiler warnings
    be2net: Signal that the device cannot transmit during reconfiguration
  * ACPI: fix false-positive -Wuninitialized warning
      include/linux/acpi.h
    scsi: zfcp: fix GCC compiler warning emitted with -Wmaybe-uninitialized
    ceph: return -ERANGE if virtual xattr value didn't fit in buffer
    ceph: fix improper use of smp_mb__before_atomic()
    btrfs: fix minimum number of chunk errors for DUP
    fs/adfs: super: fix use-after-free bug
    dmaengine: rcar-dmac: Reject zero-length slave DMA requests
    MIPS: lantiq: Fix bitfield masking
  * kernel/module.c: Only return -EEXIST for modules that have finished loading
      kernel/module.c
    ftrace: Enable trampoline when rec count returns back to one
    ARM: dts: rockchip: Mark that the rk3288 timer might stop in suspend
    ARM: dts: rockchip: Make rk3288-veyron-mickey's emmc work again
    ARM: dts: rockchip: Make rk3288-veyron-minnie run at hs200
    ARM: riscpc: fix DMA
  * UPSTREAM: net-ipv6-ndisc: add support for RFC7710 RA Captive Portal Identifier
      include/net/ndisc.h
      net/ipv6/ndisc.c
    ANDROID: fix up 9p filesystem due to CFI non-upstream patches
    Merge 4.9.187 into android-4.9-q
Linux 4.9.187
    ceph: hold i_ceph_lock when removing caps for freeing inode
    drivers/pps/pps.c: clear offset flags in PPS_SETPARAMS ioctl
  * sched/fair: Don't free p->numa_faults with concurrent readers
      fs/exec.c
      include/linux/sched.h
      kernel/fork.c
      kernel/sched/fair.c
    Bluetooth: hci_uart: check for missing tty operations
    media: radio-raremono: change devm_k*alloc to k*alloc
    media: cpia2_usb: first wake up, then free in disconnect
    media: au0828: fix null dereference in error path
    ISDN: hfcsusb: checking idx of ep configuration
  * arm64: compat: Provide definition for COMPAT_SIGMINSTKSZ
      arch/arm64/include/asm/compat.h
    i2c: qup: fixed releasing dma without flush operation completion
    arm64: dts: marvell: Fix A37xx UART0 register size
  * tcp: reset sk_send_head in tcp_write_queue_purge
      include/net/tcp.h
    ipv6: check sk sk_type and protocol early in ip_mroute_set/getsockopt
  * access: avoid the RCU grace period for the temporary subjective credentials
      fs/open.c
      include/linux/cred.h
      kernel/cred.c
    powerpc/tm: Fix oops on sigreturn on systems without TM
    ALSA: hda - Add a conexant codec entry to let mute led work
    ALSA: line6: Fix wrong altsetting for LINE6_PODHD500_1
    hpet: Fix division by zero in hpet_time_div()
    x86/speculation/mds: Apply more accurate check on hypervisor platform
    x86/sysfb_efi: Add quirks for some devices with swapped width and height
  * usb: pci-quirks: Correct AMD PLL quirk detection
      drivers/usb/host/pci-quirks.c
    usb: wusbcore: fix unbalanced get/put cluster_id
    locking/lockdep: Hide unused 'class' variable
    locking/lockdep: Fix lock used or unused stats error
    mm/mmu_notifier: use hlist_add_head_rcu()
    9p: pass the correct prototype to read_cache_page
    mm/kmemleak.c: fix check for softirq context
    sh: prevent warnings when using iounmap
    powerpc/eeh: Handle hugepages in ioremap space
  * mailbox: handle failed named mailbox channel request
      drivers/mailbox/mailbox.c
  * f2fs: avoid out-of-range memory access
      fs/f2fs/segment.c
    powerpc/boot: add {get, put}_unaligned_be32 to xz_config.h
    RDMA/rxe: Fill in wc byte_len with IB_WC_RECV_RDMA_WITH_IMM
    perf test mmap-thread-lookup: Initialize variable to suppress memory sanitizer warning
  * kallsyms: exclude kasan local symbols on s390
      scripts/kallsyms.c
    serial: sh-sci: Fix TX DMA buffer flushing and workqueue races
    serial: sh-sci: Terminate TX DMA during buffer flushing
    RDMA/i40iw: Set queue pair state when being queried
    powerpc/4xx/uic: clear pending interrupt after irq type/pol change
    um: Silence lockdep complaint about mmap_sem
    mfd: hi655x-pmic: Fix missing return value check for devm_regmap_init_mmio_clk
    mfd: arizona: Fix undefined behavior
  * mfd: core: Set fwnode for created devices
      drivers/mfd/mfd-core.c
    recordmcount: Fix spurious mcount entries on powerpc
    iio: iio-utils: Fix possible incorrect mask calculation
    PCI: xilinx-nwl: Fix Multi MSI data programming
  * kbuild: Add -Werror=unknown-warning-option to CLANG_FLAGS
      Makefile
  * PCI: sysfs: Ignore lockdep for remove attribute
      drivers/pci/pci-sysfs.c
    powerpc/pci/of: Fix OF flags parsing for 64bit BARs
  * usb: gadget: Zero ffs_io_data
      drivers/usb/gadget/function/f_fs.c
  * tty: serial_core: Set port active bit in uart_port_activate
      drivers/tty/serial/serial_core.c
    drm/rockchip: Properly adjust to a true clock in adjusted_mode
    phy: renesas: rcar-gen2: Fix memory leak at error paths
    drm/virtio: Add memory barriers for capset cache.
    serial: 8250: Fix TX interrupt handling condition
    tty: serial: msm_serial: avoid system lockup condition
    tty/serial: digicolor: Fix digicolor-usart already registered warning
    memstick: Fix error cleanup path of memstick_init
    drm/bridge: sii902x: pixel clock unit is 10kHz instead of 1kHz
    drm/bridge: tc358767: read display_props in get_modes()
    tty: serial: cpm_uart - fix init when SMC is relocated
    pinctrl: rockchip: fix leaked of_node references
    tty: max310x: Fix invalid baudrate divisors calculator
  * usb: core: hub: Disable hub-initiated U1/U2
      drivers/usb/core/hub.c
    drm/panel: simple: Fix panel_simple_dsi_probe
    nfsd: Fix overflow causing non-working mounts on 1 TB machines
    nfsd: fix performance-limiting session calculation
    nfsd: give out fewer session slots as limit approaches
    nfsd: increase DRC cache limit
    NFSv4: Fix open create exclusive when the server reboots
    perf/events/amd/uncore: Fix amd_uncore_llc ID to use pre-defined cpu_llc_id
    perf/x86/amd/uncore: Get correct number of cores sharing last level cache
    perf/x86/amd/uncore: Rename 'L2' to 'LLC'
  * net: bridge: stp: don't cache eth dest pointer before skb pull
      net/bridge/br_stp_bpdu.c
  * net: bridge: mcast: fix stale ipv6 hdr pointer when handling v6 query
      net/bridge/br_multicast.c
  * net: bridge: mcast: fix stale nsrcs pointer in igmp3/mld2 report handling
      net/bridge/br_multicast.c
  * tcp: Reset bytes_acked and bytes_received when disconnecting
      net/ipv4/tcp.c
  * bonding: validate ip header before check IPPROTO_IGMP
      drivers/net/bonding/bond_main.c
    netrom: hold sock when setting skb->destructor
    netrom: fix a memory leak in nr_rx_frame()
    macsec: fix checksumming after decryption
    macsec: fix use-after-free of skb during RX
    vrf: make sure skb->data contains ip header to make routing
    sky2: Disable MSI on ASUS P6T
    rxrpc: Fix send on a connected, but unbound socket
    nfc: fix potential illegal memory access
    net: openvswitch: fix csum updates for MPLS actions
  * net: neigh: fix multiple neigh timer scheduling
      net/core/neighbour.c
    net: dsa: mv88e6xxx: wait after reset deactivation
    net: bcmgenet: use promisc for unsupported filters
  * ipv4: don't set IPv6 only flags to IPv4 addresses
      net/ipv4/devinet.c
  * igmp: fix memory leak in igmpv3_del_delrec()
      net/ipv4/igmp.c
    caif-hsi: fix possible deadlock in cfhsi_exit_module()
    bnx2x: Prevent ptp_task to be rescheduled indefinitely
    bnx2x: Prevent load reordering in tx completion processing
  * ext4: allow directory holes
      fs/ext4/dir.c
      fs/ext4/namei.c
  * lib/strscpy: Shut up KASAN false-positives in strscpy()
      lib/string.c
  * compiler.h: Add read_word_at_a_time() function.
      include/linux/compiler.h
  * compiler.h, kasan: Avoid duplicating __read_once_size_nocheck()
      include/linux/compiler.h
  * dm bufio: fix deadlock with loop device
      drivers/md/dm-bufio.c
  * usb: Handle USB3 remote wakeup for LPM enabled devices correctly
      drivers/usb/core/hub.c
  * Bluetooth: Add SMP workaround Microsoft Surface Precision Mouse bug
      net/bluetooth/smp.c
    intel_th: msu: Fix single mode with disabled IOMMU
  * eCryptfs: fix a couple type promotion bugs
      fs/ecryptfs/crypto.c
    powerpc/watchpoint: Restore NV GPRs while returning from exception
    powerpc/32s: fix suspend/resume when IBATs 4-7 are used
    parisc: Fix kernel panic due invalid values in IAOQ0 or IAOQ1
    parisc: Ensure userspace privilege for ptraced processes in regset functions
    um: Fix FP register size for XSTATE/XSAVE
    um: Allow building and running on older hosts
    crypto: caam - limit output IV to CBC to work around CTR mode DMA issue
    PCI: hv: Fix a use-after-free bug in hv_eject_device_work()
    PCI: hv: Delete the device earlier from hbus->children for hot-remove
    crypto: ccp - Validate the the error value used to index error messages
    gpu: ipu-v3: ipu-ic: Fix saturation bit offset in TPMEM
    coda: pass the host file in vma->vm_file on mmap
    floppy: fix out-of-bounds read in copy_buffer
    floppy: fix invalid pointer dereference in drive_name
    floppy: fix out-of-bounds read in next_valid_format
    floppy: fix div-by-zero in setup_format_params
  * take floppy compat ioctls to sodding floppy.c
      block/compat_ioctl.c
    libnvdimm/pfn: fix fsdax-mode namespace info-block zero-fields
    Btrfs: add missing inode version, ctime and mtime updates when punching hole
  * PCI: Do not poll for PME if the device is in D3cold
      drivers/pci/pci.c
    9p/virtio: Add cleanup path in p9_virtio_init
    padata: use smp_mb in padata_reorder to avoid orphaned padata jobs
    drm/nouveau/i2c: Enable i2c pads & busses during preinit
  * fs/proc/proc_sysctl.c: fix the default values of i_uid/i_gid on /proc/sys inodes.
      fs/proc/proc_sysctl.c
    arm64: tegra: Fix AGIC register range
    KVM: x86/vPMU: refine kvm_pmu err msg when event creation failed
    media: coda: Remove unbalanced and unneeded mutex unlock
  * media: v4l2: Test type instead of cfg->type in v4l2_ctrl_new_custom()
      drivers/media/v4l2-core/v4l2-ctrls.c
    ALSA: hda/realtek: apply ALC891 headset fixup to one Dell machine
    ALSA: seq: Break too long mutex context in the write loop
  * lib/scatterlist: Fix mapping iterator when sg->offset is greater than PAGE_SIZE
      lib/scatterlist.c
    NFSv4: Handle the special Linux file open access mode
  * tracing/snapshot: Resize spare buffer if size changed
      kernel/trace/trace.c
    iwlwifi: pcie: don't service an interrupt that was masked
    arm64: tegra: Update Jetson TX1 GPU regulator timings
    regulator: s2mps11: Fix buck7 and buck8 wrong voltages
    Input: gtco - bounds check collection indent level
    crypto: crypto4xx - fix a potential double free in ppc4xx_trng_probe
    crypto: chacha20poly1305 - fix atomic sleep when using async algorithm
  * crypto: arm64/sha2-ce - correct digest for empty data in finup
      arch/arm64/crypto/sha2-ce-glue.c
  * crypto: arm64/sha1-ce - correct digest for empty data in finup
      arch/arm64/crypto/sha1-ce-glue.c
  * crypto: ghash - fix unaligned memory access in ghash_setkey()
      crypto/ghash-generic.c
    scsi: mac_scsi: Increase PIO/PDMA transfer length threshold
    scsi: NCR5380: Always re-enable reselection interrupt
    scsi: NCR5380: Reduce goto statements in NCR5380_select()
    xen: let alloc_xenballooned_pages() fail if not enough memory free
    gtp: fix use-after-free in gtp_newlink()
    gtp: fix Illegal context switch in RCU read-side critical section.
  * Bluetooth: validate BLE connection interval updates
      net/bluetooth/hci_event.c
      net/bluetooth/l2cap_core.c
  * Bluetooth: Check state in l2cap_disconnect_rsp
      net/bluetooth/l2cap_core.c
    Bluetooth: 6lowpan: search for destination address in all peers
    Bluetooth: hci_bcsp: Fix memory leak in rx_skb
  * gpiolib: Fix references to gpiod_[gs]et_*value_cansleep() variants
      drivers/gpio/gpiolib.c
  * net: usb: asix: init MAC address buffers
      drivers/net/usb/asix_devices.c
    iwlwifi: mvm: Drop large non sta frames
    bcache: check c->gc_thread by IS_ERR_OR_NULL in cache_set_flush()
  * EDAC: Fix global-out-of-bounds write when setting edac_mc_poll_msec
      drivers/edac/edac_mc_sysfs.c
      drivers/edac/edac_module.h
  * crypto: asymmetric_keys - select CRYPTO_HASH where needed
      crypto/asymmetric_keys/Kconfig
    ixgbe: Check DDM existence in transceiver before access
  * rslib: Fix handling of of caller provided syndrome
      lib/reed_solomon/decode_rs.c
  * rslib: Fix decoding of shortened codes
      lib/reed_solomon/decode_rs.c
  * clocksource/drivers/exynos_mct: Increase priority over ARM arch timer
      include/linux/cpuhotplug.h
    libata: don't request sense data on !ZAC ATA devices
    perf tools: Increase MAX_NR_CPUS and MAX_CACHES
    ath10k: fix PCIE device wake up failed
    mt7601u: fix possible memory leak when the device is disconnected
    x86/build: Add 'set -e' to mkcapflags.sh to delete broken capflags.c
    mt7601u: do not schedule rx_tasklet when the device has been disconnected
    media: coda: increment sequence offset for the last returned frame
    media: coda: fix mpeg2 sequence number handling
    acpi/arm64: ignore 5.1 FADTs that are reported as 5.0
  * timer_list: Guard procfs specific code
      kernel/time/timer_list.c
  * ntp: Limit TAI-UTC offset
      kernel/time/ntp.c
  * media: i2c: fix warning same module names
      drivers/media/i2c/Makefile
  * ipsec: select crypto ciphers for xfrm_algo
      net/xfrm/Kconfig
  * EDAC/sysfs: Fix memory leak when creating a csrow object
      drivers/edac/edac_mc_sysfs.c
    ipoib: correcly show a VF hardware address
    vhost_net: disable zerocopy by default
    perf evsel: Make perf_evsel__name() accept a NULL argument
  * xfrm: fix sa selector validation
      net/xfrm/xfrm_user.c
  * blkcg, writeback: dead memcgs shouldn't contribute to writeback ownership arbitration
      fs/fs-writeback.c
  * rcu: Force inlining of rcu_read_lock()
      include/linux/rcupdate.h
  * bpf: silence warning messages in core
      kernel/bpf/Makefile
  * regmap: fix bulk writes on paged registers
      drivers/base/regmap/regmap.c
    gpio: omap: ensure irq is enabled before wakeup
    gpio: omap: fix lack of irqstatus_raw0 for OMAP4
    perf test 6: Fix missing kvm module load for s390
    perf cs-etm: Properly set the value of 'old' and 'head' in snapshot mode
    s390/qdio: handle PENDING state for QEBSM devices
    net: axienet: Fix race condition causing TX hang
    net: fec: Do not use netdev messages too early
    cpupower : frequency-set -r option misses the last cpu in related cpu list
    media: wl128x: Fix some error handling in fm_v4l2_init_video_device()
    locking/lockdep: Fix merging of hlocks with non-zero references
    tua6100: Avoid build warnings.
    crypto: talitos - Align SEC1 accesses to 32 bits boundaries.
    crypto: talitos - properly handle split ICV.
  * net: phy: Check against net_device being NULL
      drivers/net/phy/phy_device.c
    media: staging: media: davinci_vpfe: - Fix for memory leak if decoder initialization fails.
  * media: mc-device.c: don't memset __user pointer contents
      drivers/media/media-device.c
  * xfrm: Fix xfrm sel prefix length validation
      net/xfrm/xfrm_user.c
  * af_key: fix leaks in key_pol_get_resp and dump_sp.
      net/key/af_key.c
    signal/pid_namespace: Fix reboot_pid_ns to use send_sig not force_sig
    net: stmmac: dwmac4/5: Clear unused address entries
    net: stmmac: dwmac1000: Clear unused address entries
  * media: media_device_enum_links32: clean a reserved field
      drivers/media/media-device.c
    media: vpss: fix a potential NULL pointer dereference
    media: marvell-ccic: fix DMA s/g desc number calculation
    crypto: talitos - fix skcipher failure due to wrong output IV
    media: dvb: usb: fix use after free in dvb_usb_device_exit
    batman-adv: fix for leaked TVLV handler.
    ath: DFS JP domain W56 fixed pulse type 3 RADAR detection
    ath6kl: add some bounds checking
    ath9k: Check for errors when reading SREV register
    ath10k: Do not send probe response template for mesh
    dmaengine: imx-sdma: fix use-after-free on probe error path
  * arm64/efi: Mark __efistub_stext_offset as an absolute symbol explicitly
      arch/arm64/kernel/image.h
    MIPS: fix build on non-linux hosts
    MIPS: ath79: fix ar933x uart parity mode
    ANDROID: enable CONFIG_RTC_DRV_TEST on cuttlefish
  * ANDROID: xfrm: remove in_compat_syscall() checks
      net/xfrm/xfrm_state.c
      net/xfrm/xfrm_user.c
  * UPSTREAM: binder: Set end of SG buffer area properly.
      drivers/android/binder.c
    Merge 4.9.186 into android-4.9-q
Linux 4.9.186
    s390/qdio: don't touch the dsci in tiqdio_add_input_queues()
    s390/qdio: (re-)initialize tiqdio list entries
    s390: fix stfle zero padding
    ARC: hide unused function unw_hdr_alloc
  * dm verity: use message limit for data block corruption message
      drivers/md/dm-verity-target.c
    ARM: dts: imx6ul: fix PWM[1-4] interrupts
    sis900: fix TX completion
  * ppp: mppe: Add softdep to arc4
      drivers/net/ppp/ppp_mppe.c
    be2net: fix link failure after ethtool offline test
    ARM: omap2: remove incorrect __init annotation
  * perf/core: Fix perf_sample_regs_user() mm check
      kernel/events/core.c
    arm64: crypto: remove accidentally backported files
    nilfs2: do not use unexported cpu_to_le32()/le32_to_cpu() in uapi header
    e1000e: start network tx queue only when link is up
    Revert "e1000e: fix cyclic resets at link up with active tx"
    MIPS: Remove superfluous check for __linux__
    VMCI: Fix integer overflow in VMCI handle arrays
    carl9170: fix misuse of device driver API
    staging: comedi: amplc_pci230: fix null pointer deref on interrupt
    staging: comedi: dt282x: fix a null pointer deref on interrupt
    usb: renesas_usbhs: add a workaround for a race condition of workqueue
  * usb: gadget: ether: Fix race between gether_disconnect and rx_submit
      drivers/usb/gadget/function/u_ether.c
    p54usb: Fix race between disconnect and firmware loading
    Revert "serial: 8250: Don't service RX FIFO if interrupts are disabled"
    USB: serial: option: add support for GosunCn ME3630 RNDIS mode
    USB: serial: ftdi_sio: add ID for isodebug v1
    mwifiex: Don't abort on small, spec-compliant vendor IEs
  * fscrypt: don't set policy for a dead directory
      fs/crypto/policy.c
    mwifiex: Fix heap overflow in mwifiex_uap_parse_tail_ies()
    mwifiex: Abort at too short BSS descriptor element
    x86/tls: Fix possible spectre-v1 in do_get_thread_area()
    x86/ptrace: Fix possible spectre-v1 in ptrace_get_debugreg()
    udf: Fix incorrect final NOT_ALLOCATED (hole) extent length
    net :sunrpc :clnt :Fix xps refcount imbalance on the error path
  * ip6_tunnel: allow not to count pkts on tstats by passing dev as NULL
      include/net/ip6_tunnel.h
    bnx2x: Check if transceiver implements DDM before access
    md: fix for divide error in status_resync
    mac80211: only warn once on chanctx_conf being NULL
    ARM: davinci: da8xx: specify dma_coherent_mask for lcdc
    ARM: davinci: da850-evm: call regulator_has_full_constraints()
    mlxsw: spectrum: Disallow prio-tagged packets when PVID is removed
    KVM: arm/arm64: vgic: Fix kvm_device leak in vgic_its_destroy
    Input: imx_keypad - make sure keyboard can always wake up system
  * can: mcp251x: add support for mcp25625
      drivers/net/can/spi/Kconfig
    dt-bindings: can: mcp251x: add mcp25625 support
  * netfilter: ipv6: nf_defrag: accept duplicate fragments again
      net/ipv6/netfilter/nf_conntrack_reasm.c
  * netfilter: ipv6: nf_defrag: fix leakage of unqueued fragments
      net/ipv6/netfilter/nf_conntrack_reasm.c
    mwifiex: Fix possible buffer overflows at parsing bss descriptor
    mac80211: free peer keys before vif down in mesh
    mac80211: mesh: fix RCU warning
    staging:iio:ad7150: fix threshold mode config bit
    samples, bpf: fix to change the buffer size for read()
    Input: elantech - enable middle button support on 2 ThinkPads
    crypto: talitos - rename alternative AEAD algos.

Change-Id: Ic17f4ff767e98db1ddee5f127d7de4a4c314e026
Signed-off-by: Robin Peng <robinpeng@google.com>
2019-10-01 15:25:52 +08:00
Pavankumar Kondeti
45be79a2ec ANDROID: Revert "ANDROID: sched: Disallow WALT with CFS bandwidth control"
This reverts commit d342ee64906fe8cb0a36ec8063ae4118aeb57620.

The WALT code is updated to handle the CFS tasks throttling and
unthrottling. So remove the limitation of disabling WALT to
enable CFS_BANDWIDTH feature.

Bug: 139071966
Change-Id: I3b3a17cd3e552b6238cfba24c9251b7b83e2bda3
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
Signed-off-by: Todd Kjos <tkjos@google.com>
2019-09-12 12:30:02 +00:00
David Howells
1999644115 UPSTREAM: Make anon_inodes unconditional
Make the anon_inodes facility unconditional so that it can be used by core
VFS code.

Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

(cherry picked from commit dadd2299ab61fc2b55b95b7b3a8f674cdd3b69c9)

Bug: 135608568
Test: test program using syscall(__NR_sys_pidfd_open,..) and poll()
Change-Id: I2f97bda4f360d8d05bbb603de839717b3d8067ae
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
2019-09-03 13:44:37 -07:00
Quentin Perret
e032df4b12 ANDROID: sched: Disallow WALT with CFS bandwidth control
The WALT time accounting breaks when CFS tasks are throttled by the CPU
bandwidth control mechanism of the CPU cgroups controller. This can
result in a negative cumulative_runnable_avg, which can then lead to a
kernel panic, and the device crashing.

Although the right fix would be add support for throttled CFS tasks to
WALT, the common kernel is now in stable maintenance mode and will not
get new features which could cause issues for partners downstream.

To work around the issue, make the CFS_BANDWIDTH Kconfig option depend
on SCHED_WALT=n, hence preventing these two things from being enabled
simultaneously. This should not be an issue for most partners (nobody
had noticed the breakage for years), and those who do need the better
fix can apply it in their device kernel.

Bug: 139071966
Bug: 120440300
Change-Id: Ieb3c367ae7893ac93fb5b38c1580dc59151aacce
Signed-off-by: Quentin Perret <quentin.perret@arm.com>
2019-09-02 11:00:09 +00:00
Joel Fernandes (Google)
3ea0535755 BACKPORT: kheaders: Move from proc to sysfs
The kheaders archive consisting of the kernel headers used for compiling
bpf programs is in /proc. However there is concern that moving it here
will make it permanent. Let us move it to /sys/kernel as discussed [1].

[1] https://lore.kernel.org/patchwork/patch/1067310/#1265969

(cherry picked from commit f7b101d33046a837c2aa4526cef28a3c785d7af2)
Bug: 78013494
Suggested-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Joel Fernandes (Google) <joel@joelfernandes.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Change-Id: If102497a56bca7fd86ef9c74e32c56e1c51f06d1
2019-07-19 08:51:28 -04:00
Joel Fernandes (Google)
0195c67803 BACKPORT: Provide in-kernel headers to make extending kernel easier
Introduce in-kernel headers which are made available as an archive
through proc (/proc/kheaders.tar.xz file). This archive makes it
possible to run eBPF and other tracing programs that need to extend the
kernel for tracing purposes without any dependency on the file system
having headers.

A github PR is sent for the corresponding BCC patch at:
https://github.com/iovisor/bcc/pull/2312

On Android and embedded systems, it is common to switch kernels but not
have kernel headers available on the file system. Further once a
different kernel is booted, any headers stored on the file system will
no longer be useful. This is an issue even well known to distros.
By storing the headers as a compressed archive within the kernel, we can
avoid these issues that have been a hindrance for a long time.

The best way to use this feature is by building it in. Several users
have a need for this, when they switch debug kernels, they do not want to
update the filesystem or worry about it where to store the headers on
it. However, the feature is also buildable as a module in case the user
desires it not being part of the kernel image. This makes it possible to
load and unload the headers from memory on demand. A tracing program can
load the module, do its operations, and then unload the module to save
kernel memory. The total memory needed is 3.3MB.

By having the archive available at a fixed location independent of
filesystem dependencies and conventions, all debugging tools can
directly refer to the fixed location for the archive, without concerning
with where the headers on a typical filesystem which significantly
simplifies tooling that needs kernel headers.

The code to read the headers is based on /proc/config.gz code and uses
the same technique to embed the headers.

Other approaches were discussed such as having an in-memory mountable
filesystem, but that has drawbacks such as requiring an in-kernel xz
decompressor which we don't have today, and requiring usage of 42 MB of
kernel memory to host the decompressed headers at anytime. Also this
approach is simpler than such approaches.

(Resolved minor conflicts in Makefile)
(cherry picked from commit 43d8ce9d65a54846d378545770991e65838981e0)
Bug: 78013494
Reviewed-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Signed-off-by: Joel Fernandes (Google) <joel@joelfernandes.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Change-Id: Iedbe7ac19f51df00e20e2b6399a2b9b2d59ca91e
2019-07-19 08:51:22 -04:00
Robin Peng
ad18574239 Merge android-4.9 (4.9.178) into android-msm-pixel-4.9-lts
Merge 4.9.178 into android-4.9
Linux 4.9.178
    KVM: x86: Skip EFER vs. guest CPUID checks for host-initiated writes
    ALSA: hda/realtek - Fix for Lenovo B50-70 inverted internal microphone bug
  * ext4: fix data corruption caused by overlapping unaligned and aligned IO
      fs/ext4/file.c
  * ext4: zero out the unused memory region in the extent tree block
      fs/ext4/extents.c
  * fs/writeback.c: use rcu_barrier() to wait for inflight wb switches going into workqueue when umount
      fs/fs-writeback.c
  * writeback: synchronize sync(2) against cgroup writeback membership switches
      fs/fs-writeback.c
      include/linux/backing-dev-defs.h
      mm/backing-dev.c
  * fib_rules: fix error in backport of e9919a24d302 ("fib_rules: return 0...")
      net/core/fib_rules.c
    crypto: arm/aes-neonbs - don't access already-freed walk.iv
    crypto: salsa20 - don't access already-freed walk.iv
  * crypto: gcm - fix incompatibility between "gcm" and "gcm_base"
      crypto/gcm.c
  * crypto: gcm - Fix error return code in crypto_gcm_create_common()
      crypto/gcm.c
    ipmi:ssif: compare block number correctly for multi-part return messages
    bcache: never set KEY_PTRS of journal key to 0 in journal_reclaim()
    bcache: fix a race between cache register and cacheset unregister
    Btrfs: do not start a transaction at iterate_extent_inodes()
  * ext4: fix ext4_show_options for file systems w/o journal
      fs/ext4/super.c
  * ext4: actually request zeroing of inode table after grow
      fs/ext4/ioctl.c
  * jbd2: check superblock mapped prior to committing
      fs/jbd2/journal.c
    tty/vt: fix write/write race in ioctl(KDSKBSENT) handler
    mfd: max77620: Fix swapped FPS_PERIOD_MAX_US values
    mfd: da9063: Fix OTP control register names to match datasheets for DA9063/63L
    ocfs2: fix ocfs2 read inode data panic in ocfs2_iget
  * mm/mincore.c: make mincore() more conservative
      mm/mincore.c
    ASoC: RT5677-SPI: Disable 16Bit SPI Transfers
    ASoC: max98090: Fix restore of DAPM Muxes
    ALSA: hda/realtek - EAPD turn on later
    ALSA: hda/hdmi - Consider eld_valid when reporting jack event
    ALSA: hda/hdmi - Read the pin sense from register when repolling
  * ALSA: usb-audio: Fix a memory leak bug
      sound/usb/mixer.c
    crypto: x86/crct10dif-pcl - fix use via crypto_shash_digest()
    crypto: crct10dif-generic - fix use via crypto_shash_digest()
    crypto: vmx - fix copy-paste error in CTR mode
    crypto: chacha20poly1305 - set cra_name correctly
    sched/x86: Save [ER]FLAGS on context switch
  * arm64: Clear OSDLR_EL1 on CPU boot
      arch/arm64/kernel/debug-monitors.c
  * arm64: compat: Reduce address limit
      arch/arm64/include/asm/processor.h
    power: supply: axp288_charger: Fix unchecked return value
    ARM: exynos: Fix a leaked reference by adding missing of_node_put
    objtool: Fix function fallthrough detection
    x86/speculation/mds: Improve CPU buffer clear documentation
    x86/speculation/mds: Revert CPU buffer clear on double fault exit
    PCI: hv: Fix a memory leak in hv_eject_device_work()
  * locking/rwsem: Prevent decrement of reader count before increment
      kernel/locking/rwsem-xadd.c
  * net: core: another layer of lists, around PF_MEMALLOC skb handling
      include/linux/list.h
  * UPSTREAM: fib_rules: fix error in backport of e9919a24d302 ("fib_rules: return 0...")
      net/core/fib_rules.c
  * UPSTREAM: bpf: relax inode permission check for retrieving bpf program
      kernel/bpf/inode.c
    Merge 4.9.177 into android-4.9
Linux 4.9.177
    powerpc/booke64: set RI in default MSR
    powerpc/lib: fix book3s/32 boot failure due to code patching
    drivers/virt/fsl_hypervisor.c: prevent integer overflow in ioctl
    drivers/virt/fsl_hypervisor.c: dereferencing error pointers in ioctl
  * bonding: fix arp_validate toggling in active-backup mode
      drivers/net/bonding/bond_options.c
  * ipv4: Fix raw socket lookup for local traffic
      net/ipv4/raw.c
  * vrf: sit mtu should not be updated when vrf netdev is the link
      net/ipv6/sit.c
    vlan: disable SIOCSHWTSTAMP in container
  * packet: Fix error path in packet_init
      net/packet/af_packet.c
    net: ucc_geth - fix Oops when changing number of buffers in the ring
  * fib_rules: return 0 directly if an exactly same rule exists when NLM_F_EXCL not supplied
      net/core/fib_rules.c
  * bridge: Fix error path for kobject_init_and_add()
      net/bridge/br_if.c
    powerpc/64s: Include cpu header
    x86/vdso: Pass --eh-frame-hdr to the linker
    x86/vdso: Drop implicit common-page-size linker flag
    x86: vdso: Use $LD instead of $CC to link
    Revert "x86: vdso: Use $LD instead of $CC to link"
    Revert "x86/vdso: Drop implicit common-page-size linker flag"
    Don't jump to compute_result state from check_result state
    rtlwifi: rtl8723ae: Fix missing break in switch statement
  * ALSA: pcm: remove SNDRV_PCM_IOCTL1_INFO internal command
      include/sound/pcm.h
      sound/core/pcm_lib.c
      sound/core/pcm_native.c
    cw1200: fix missing unlock on error in cw1200_hw_scan()
    Input: synaptics-rmi4 - fix possible double free
    spi: ST ST95HF NFC: declare missing of table
    spi: Micrel eth switch: declare missing of table
    gpu: ipu-v3: dp: fix CSC handling
    selftests/net: correct the return value for run_netsocktests
    drm/sun4i: Set device driver data at bind time for use in unbind
    s390: ctcm: fix ctcm_new_device error return code
    MIPS: perf: ath79: Fix perfcount IRQ assignment
    ipvs: do not schedule icmp errors from tunnels
    selftests: netfilter: check icmp pkttoobig errors are set as related
  * init: initialize jump labels before command line option parsing
      init/main.c
    tools lib traceevent: Fix missing equality check for strcmp
    KVM: x86: avoid misreporting level-triggered irqs as edge-triggered in tracing
  * x86/reboot, efi: Use EFI reboot for Acer TravelMate X514-51T
      include/linux/efi.h
    mISDN: Check address length before reading address family
    s390/3270: fix lockdep false positive on view->lock
    mac80211: fix unaligned access in mesh table hash function
    s390/dasd: Fix capacity calculation for large volumes
    libnvdimm/btt: Fix a kmemdup failure check
  * HID: input: add mapping for "Toggle Display" key
      drivers/hid/hid-input.c
  * HID: input: add mapping for keyboard Brightness Up/Down/Toggle keys
      drivers/hid/hid-input.c
  * HID: input: add mapping for Expose/Overview key
      drivers/hid/hid-input.c
    libnvdimm/namespace: Fix a potential NULL pointer dereference
    iio: adc: xilinx: fix potential use-after-free on remove
    USB: serial: fix unthrottle races
    platform/x86: sony-laptop: Fix unintentional fall-through
  * bpf: convert htab map to hlist_nulls
      include/linux/list_nulls.h
      include/linux/rculist_nulls.h
      kernel/bpf/hashtab.c
  * bpf: fix struct htab_elem layout
      kernel/bpf/hashtab.c
  * netfilter: compat: initialize all fields in xt_init
      net/netfilter/x_tables.c
    ANDROID: cuttlefish_defconfig: Disable DEVTMPFS
    ANDROID: Move from clang r349610 to r353983c.
    Merge upstream-f2fs-stable-linux-4.9.y into android-4.9
    Merge 4.9.176 into android-4.9
Linux 4.9.176
    x86/cpu/bugs: Use __initconst for 'const' init data
    x86: stop exporting msr-index.h to userland
    x86/speculation/mds: Fix documentation typo
    Documentation: Correct the possible MDS sysfs values
    x86/mds: Add MDSUM variant to the MDS documentation
    x86/speculation/mds: Add 'mitigations=' support for MDS
    x86/speculation: Support 'mitigations=' cmdline option
  * cpu/speculation: Add 'mitigations=' cmdline option
      include/linux/cpu.h
      kernel/cpu.c
    x86/speculation/mds: Print SMT vulnerable on MSBDS with mitigations off
    x86/speculation/mds: Fix comment
    x86/speculation/mds: Add SMT warning message
    x86/speculation: Move arch_smt_update() call to after mitigation decisions
    x86/speculation/mds: Add mds=full,nosmt cmdline option
    Documentation: Add MDS vulnerability documentation
    Documentation: Move L1TF to separate directory
    x86/speculation/mds: Add mitigation mode VMWERV
  * x86/speculation/mds: Add sysfs reporting for MDS
      drivers/base/cpu.c
      include/linux/cpu.h
    x86/speculation/mds: Add mitigation control for MDS
    x86/speculation/mds: Conditionally clear CPU buffers on idle entry
    x86/kvm/vmx: Add MDS protection when L1D Flush is not active
    x86/speculation/mds: Clear CPU buffers on exit to user
    x86/speculation/mds: Add mds_clear_cpu_buffers()
    x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests
    x86/speculation/mds: Add BUG_MSBDS_ONLY
    x86/speculation/mds: Add basic bug infrastructure for MDS
    x86/speculation: Consolidate CPU whitelists
    x86/msr-index: Cleanup bit defines
    kvm: x86: Report STIBP on GET_SUPPORTED_CPUID
    x86/speculation: Provide IBPB always command line options
    x86/speculation: Add seccomp Spectre v2 user space protection mode
    x86/speculation: Enable prctl mode for spectre_v2_user
  * x86/speculation: Add prctl() control for indirect branch speculation
      include/linux/sched.h
      include/uapi/linux/prctl.h
    x86/speculation: Prevent stale SPEC_CTRL msr content
    x86/speculation: Prepare arch_smt_update() for PRCTL mode
    x86/speculation: Split out TIF update
    x86/speculation: Prepare for conditional IBPB in switch_mm()
    x86/speculation: Avoid __switch_to_xtra() calls
    x86/process: Consolidate and simplify switch_to_xtra() code
    x86/speculation: Prepare for per task indirect branch speculation control
    x86/speculation: Add command line control for indirect branch speculation
    x86/speculation: Unify conditional spectre v2 print functions
    x86/speculataion: Mark command line parser data __initdata
    x86/speculation: Mark string arrays const correctly
    x86/speculation: Reorder the spec_v2 code
    x86/l1tf: Show actual SMT state
  * x86/speculation: Rework SMT state change
      include/linux/sched/smt.h
      kernel/cpu.c
  * sched: Add sched_smt_active()
      include/linux/sched/smt.h
      kernel/sched/core.c
      kernel/sched/sched.h
    x86/Kconfig: Select SCHED_SMT if SMP enabled
    x86/speculation: Reorganize speculation control MSRs update
    x86/speculation: Rename SSBD update functions
    x86/speculation: Disable STIBP when enhanced IBRS is in use
    x86/speculation: Move STIPB/IBPB string conditionals out of cpu_show_common()
    x86/speculation: Remove unnecessary ret variable in cpu_show_common()
    x86/speculation: Clean up spectre_v2_parse_cmdline()
    x86/speculation: Update the TIF_SSBD comment
    x86/speculation/l1tf: Drop the swap storage limit restriction when l1tf=off
    x86/speculation: Propagate information about RSB filling mitigation to sysfs
  * x86/speculation: Enable cross-hyperthread spectre v2 STIBP mitigation
      kernel/cpu.c
  * x86/speculation: Apply IBPB more strictly to avoid cross-process data leak
      include/linux/ptrace.h
      kernel/ptrace.c
    Documentation/l1tf: Fix small spelling typo
    x86/cpu: Sanitize FAM6_ATOM naming
    x86/speculation: Remove SPECTRE_V2_IBRS in enum spectre_v2_mitigation
  * locking/atomics, asm-generic: Move some macros from <linux/bitops.h> to a new <linux/bits.h> file
      include/linux/bitops.h
      include/linux/bits.h
    x86/speculation: Simplify the CPU bug detection logic
  * bitops: avoid integer overflow in GENMASK(_ULL)
      include/linux/bitops.h
    x86/mm: Use WRITE_ONCE() when setting PTEs
    x86/microcode: Update the new microcode revision unconditionally
    x86/microcode: Make sure boot_cpu_data.microcode is up-to-date
    x86/microcode/intel: Check microcode revision before updating sibling threads
    x86/microcode/intel: Add a helper which gives the microcode revision
    x86/bugs: Fix the AMD SSBD usage of the SPEC_CTRL MSR
    x86/bugs: Switch the selection of mitigation from CPU vendor to CPU features
    x86/bugs: Add AMD's SPEC_CTRL MSR usage
    x86/bugs: Add AMD's variant of SSB_NO
    x86/cpufeatures: Hide AMD-specific speculation flags
    x86/MCE: Save microcode revision in machine check records
    Merge 4.9.175 into android-4.9
Linux 4.9.175
    timer/debug: Change /proc/timer_stats from 0644 to 0600
    ASoC: Intel: avoid Oops if DMA setup fails
    UAS: fix alignment of scatter/gather segments
  * Bluetooth: Align minimum encryption key size for LE and BR/EDR connections
      include/net/bluetooth/hci_core.h
      net/bluetooth/hci_conn.c
    Bluetooth: hidp: fix buffer overflow
    scsi: qla2xxx: Fix incorrect region-size setting in optrom SYSFS routines
  * usb-storage: Set virt_boundary_mask to avoid SG overflows
      drivers/usb/storage/scsiglue.c
    USB: serial: f81232: fix interrupt worker not stop
  * usb: dwc3: Fix default lpm_nyet_threshold value
      drivers/usb/dwc3/core.c
  * genirq: Prevent use-after-free and work list corruption
      kernel/irq/manage.c
    ARM: 8680/1: boot/compressed: fix inappropriate Thumb2 mnemonic for __nop
  * mm: add 'try_get_page()' helper function
      include/linux/mm.h
    iommu/amd: Set exclusion range correctly
    virtio-blk: limit number of hw queues by nr_cpu_ids
    drm/mediatek: fix possible object reference leak
    scsi: csiostor: fix missing data copy in csio_scsi_err_handler()
  * linux/kernel.h: Use parentheses around argument in u64_to_user_ptr()
      include/linux/kernel.h
    perf/x86/intel: Fix handling of wakeup_events for multi-entry PEBS
    drm/mediatek: Fix an error code in mtk_hdmi_dt_parse_pdata()
    ASoC: tlv320aic32x4: Fix Common Pins
    IB/hfi1: Eliminate opcode tests on mr deref
    ASoC: cs4270: Set auto-increment bit for register writes
    ASoC: nau8810: fix the issue of widget with prefixed name
  * ASoC:soc-pcm:fix a codec fixup issue in TDM case
      sound/soc/soc-pcm.c
    staging: greybus: power_supply: fix prop-descriptor request size
    ubsan: Fix nasty -Wbuiltin-declaration-mismatch GCC-9 warnings
    scsi: libsas: fix a race condition when smp task timeout
  * f2fs: fix to avoid accessing xattr across the boundary
      fs/f2fs/xattr.c
      fs/f2fs/xattr.h
  * f2fs: fix to avoid potential race on sbi->unusable_block_count access/update
      fs/f2fs/checkpoint.c
      fs/f2fs/segment.c
      fs/f2fs/super.c
  * f2fs: add tracepoint for f2fs_filemap_fault()
      fs/f2fs/file.c
      include/trace/events/f2fs.h
  * f2fs: introduce DATA_GENERIC_ENHANCE
      fs/f2fs/checkpoint.c
      fs/f2fs/data.c
      fs/f2fs/f2fs.h
      fs/f2fs/file.c
      fs/f2fs/gc.c
      fs/f2fs/inode.c
      fs/f2fs/node.c
      fs/f2fs/recovery.c
      fs/f2fs/segment.c
      fs/f2fs/segment.h
  * f2fs: fix to handle error in f2fs_disable_checkpoint()
      fs/f2fs/super.c
  * f2fs: remove redundant check in f2fs_file_write_iter()
      fs/f2fs/file.c
  * f2fs: fix to be aware of readonly device in write_checkpoint()
      fs/f2fs/checkpoint.c
  * f2fs: fix to skip recovery on readonly device
      fs/f2fs/checkpoint.c
      fs/f2fs/super.c
  * f2fs: fix to consider multiple device for readonly check
      fs/f2fs/f2fs.h
      fs/f2fs/super.c
  * f2fs: relocate chksum_offset for large_nat_bitmap feature
      fs/f2fs/checkpoint.c
      fs/f2fs/f2fs.h
  * f2fs: allow unfixed f2fs_checkpoint.checksum_offset
      fs/f2fs/checkpoint.c
      include/linux/f2fs_fs.h
  * f2fs: Replace spaces with tab
      fs/f2fs/acl.c
  * f2fs: insert space before the open parenthesis '('
      fs/f2fs/acl.c
  * f2fs: allow address pointer number of dnode aligning to specified size
      fs/f2fs/f2fs.h
      fs/f2fs/file.c
      fs/f2fs/gc.c
      fs/f2fs/node.c
      fs/f2fs/super.c
      include/linux/f2fs_fs.h
  * f2fs: introduce f2fs_read_single_page() for cleanup
      fs/f2fs/data.c
  * f2fs: mark is_extension_exist() inline
      fs/f2fs/namei.c
  * f2fs: fix to set FI_UPDATE_WRITE correctly
      fs/f2fs/data.c
  * f2fs: fix to avoid panic in f2fs_inplace_write_data()
      fs/f2fs/segment.c
  * f2fs: fix to do sanity check on valid block count of segment
      fs/f2fs/segment.h
  * f2fs: fix to do sanity check on valid node/block count
      fs/f2fs/super.c
  * f2fs: fix to avoid panic in do_recover_data()
      fs/f2fs/recovery.c
  * f2fs: fix to do sanity check on free nid
      fs/f2fs/node.c
  * f2fs: fix to do checksum even if inode page is uptodate
      fs/f2fs/inode.c
      fs/f2fs/node.c
  * f2fs: fix to avoid panic in f2fs_remove_inode_page()
      fs/f2fs/node.c
  * f2fs: fix to clear dirty inode in error path of f2fs_iget()
      fs/f2fs/inode.c
  * f2fs: remove new blank line of f2fs kernel message
      fs/f2fs/file.c
      fs/f2fs/super.c
  * f2fs: fix wrong __is_meta_io() macro
      fs/f2fs/checkpoint.c
      fs/f2fs/data.c
      fs/f2fs/f2fs.h
  * f2fs: fix to avoid panic in dec_valid_node_count()
      fs/f2fs/f2fs.h
  * f2fs: fix to avoid panic in dec_valid_block_count()
      fs/f2fs/f2fs.h
  * f2fs: fix to use inline space only if inline_xattr is enable
      fs/f2fs/f2fs.h
  * f2fs: fix to retrieve inline xattr space
      fs/f2fs/inline.c
  * f2fs: fix error path of recovery
      fs/f2fs/recovery.c
  * f2fs: fix to avoid deadloop in foreground GC
      fs/f2fs/gc.c
  * f2fs: data: fix warning Using plain integer as NULL pointer
      fs/f2fs/data.c
  * f2fs: add tracepoint for f2fs_file_write_iter()
      fs/f2fs/file.c
      include/trace/events/f2fs.h
  * f2fs: add comment for conditional compilation statement
      fs/f2fs/f2fs.h
  * f2fs: fix potential recursive call when enabling data_flush
      fs/f2fs/checkpoint.c
      fs/f2fs/data.c
  * f2fs: improve discard handling with multi-device volumes
      fs/f2fs/f2fs.h
      fs/f2fs/segment.c
  * f2fs: Reduce zoned block device memory usage
      fs/f2fs/f2fs.h
      fs/f2fs/segment.c
      fs/f2fs/super.c
  * f2fs: Fix use of number of devices
      fs/f2fs/data.c
      fs/f2fs/f2fs.h
      fs/f2fs/file.c
      fs/f2fs/gc.c
      fs/f2fs/segment.c
  * ANDROID: block/cfq-iosched: make group_idle per io cgroup tunable
      block/cfq-iosched.c
    Merge remote-tracking branch 'origin/upstream-f2fs-stable-linux-4.9.y' into android-4.9
    ANDROID: cuttlefish_defconfig: Enable CONFIG_CPUSETS and CONFIG_CGROUP_SCHEDTUNE
    ANDROID: Communicates LMK events to userland where they can be logged
    Merge 4.9.174 into android-4.9
Linux 4.9.174
    media: v4l2: i2c: ov7670: Fix PLL bypass register values
    x86/mce: Improve error message when kernel cannot recover, p2
  * selinux: never allow relabeling on context mounts
      security/selinux/hooks.c
    Input: snvs_pwrkey - initialize necessary driver data before enabling IRQ
    scsi: RDMA/srpt: Fix a credit leak for aborted commands
    staging: iio: adt7316: fix the dac write calculation
    staging: iio: adt7316: fix the dac read calculation
    staging: iio: adt7316: allow adt751x to use internal vref for all dacs
    perf/x86/amd: Update generic hardware cache events for Family 17h
    ARM: iop: don't use using 64-bit DMA masks
    ARM: orion: don't use using 64-bit DMA masks
    xsysace: Fix error handling in ace_setup
    sh: fix multiple function definition build errors
    hugetlbfs: fix memory leak for resv_map
    net: hns: Fix WARNING when remove HNS driver with SMMU enabled
    net: hns: Use NAPI_POLL_WEIGHT for hns driver
    net: hns: fix KASAN: use-after-free in hns_nic_net_xmit_hw()
    scsi: storvsc: Fix calculation of sub-channel count
  * scsi: core: add new RDAC LENOVO/DE_Series device
      drivers/scsi/scsi_devinfo.c
    vfio/pci: use correct format characters
    rtc: da9063: set uie_unsupported when relevant
  * debugfs: fix use-after-free on symlink traversal
      fs/debugfs/inode.c
    jffs2: fix use-after-free on symlink traversal
    net: stmmac: don't log oversized frames
    net: stmmac: fix dropping of multi-descriptor RX frames
    net: stmmac: don't overwrite discard_frame status
  * bonding: show full hw address in sysfs for slave entries
      drivers/net/bonding/bond_sysfs_slave.c
    net/mlx5: E-Switch, Fix esw manager vport indication for more vport commands
    igb: Fix WARN_ONCE on runtime suspend
    batman-adv: Reduce tt_global hash refcnt only for removed entry
    batman-adv: Reduce tt_local hash refcnt only for removed entry
    batman-adv: Reduce claim hash refcnt only for removed entry
    rtc: sh: Fix invalid alarm warning for non-enabled alarm
  * HID: debug: fix race condition with between rdesc_show() and device removal
      drivers/hid/hid-debug.c
    HID: logitech: check the return value of create_singlethread_workqueue
    nvme-loop: init nvmet_ctrl fatal_err_work when allocate
  * USB: core: Fix bug caused by duplicate interface PM usage counter
      drivers/usb/core/driver.c
      include/linux/usb.h
  * USB: core: Fix unterminated string returned by usb_string()
      drivers/usb/core/message.c
    usb: usbip: fix isoc packet num validation in get_pipe
    USB: w1 ds2490: Fix bug caused by improper use of altsetting array
    USB: yurex: Fix protection fault after device removal
    caif: reduce stack size with KASAN
  * arm64: mm: don't print out page table entries on EL0 faults
      arch/arm64/mm/fault.c
  * arm64: mm: print out correct page table entries
      arch/arm64/include/asm/system_misc.h
      arch/arm64/mm/fault.c
  * kasan: prevent compiler from optimizing away memset in tests
      lib/Makefile
  * arm64: proc: Set PTE_NG for table entries to avoid traversing them twice
      arch/arm64/mm/proc.S
    kasan: remove redundant initialization of variable 'real_size'
    kasan: avoid -Wmaybe-uninitialized warning
  * kasan: add a prototype of task_struct to avoid warning
      include/linux/kasan.h
    arm64: kasan: avoid bad virt_to_pfn()
    x86/unwind: Disable KASAN checks for non-current tasks
    mm/kasan: Switch to using __pa_symbol and lm_alias
    x86/suspend: fix false positive KASAN warning on suspend/resume
    net: phy: marvell: Fix buffer overrun with stats counters
    bnxt_en: Improve multicast address setup logic.
  * packet: validate msg_namelen in send directly
      net/packet/af_packet.c
  * ipv6: invert flowlabel sharing check in process and user mode
      net/ipv6/ip6_flowlabel.c
  * ipv6/flowlabel: wait rcu grace period before put_pid()
      net/ipv6/ip6_flowlabel.c
  * ipv4: ip_do_fragment: Preserve skb_iif during fragmentation
      net/ipv4/ip_output.c
    ALSA: line6: use dynamic buffers
  * ext4: don't bother checking for encryption key in ->mmap()
      fs/ext4/file.c
    ANDROID: cuttlefish 4.9: enable CONFIG_CRYPTO_AES_NI_INTEL=y
    Merge 4.9.173 into android-4.9
Linux 4.9.173
    vfio/type1: Limit DMA mappings per container
    leds: pca9532: fix a potential NULL pointer dereference
    kconfig/[mn]conf: handle backspace (^H) key
  * gpio: of: Fix of_gpiochip_add() error path
      drivers/gpio/gpiolib-of.c
    libata: fix using DMA buffers on stack
    scsi: zfcp: reduce flood of fcrscn1 trace records on multi-element RSCN
    ceph: fix use-after-free on symlink traversal
    usb: u132-hcd: fix resource leak
    scsi: qla4xxx: fix a potential NULL pointer dereference
    net: ethernet: ti: fix possible object reference leak
    net: ibm: fix possible object reference leak
    net: xilinx: fix possible object reference leak
    NFS: Fix a typo in nfs_init_timeout_values()
    staging: rtl8712: uninitialized memory in read_bbreg_hdl()
    net: ks8851: Set initial carrier state to down
    net: ks8851: Delay requesting IRQ until opened
    net: ks8851: Reassert reset pin if chip ID check fails
    net: ks8851: Dequeue RX packets explicitly
    ARM: dts: pfla02: increase phy reset duration
    usb: gadget: net2272: Fix net2272_dequeue()
    usb: gadget: net2280: Fix net2280_dequeue()
    usb: gadget: net2280: Fix overrun of OUT messages
    serial: ar933x_uart: Fix build failure with disabled console
    sc16is7xx: missing unregister/delete driver on error in sc16is7xx_init()
    netfilter: bridge: set skb transport_header before entering NF_INET_PRE_ROUTING
    netfilter: nft_set_rbtree: check for inactive element after flag mismatch
    qlcnic: Avoid potential NULL pointer dereference
    s390: limit brk randomization to 32MB
    ARM: dts: bcm283x: Fix hdmi hpd gpio pull
    media: vivid: check if the cec_adapter is valid
    usbnet: ipheth: fix potential null pointer dereference in ipheth_carrier_set
    usbnet: ipheth: prevent TX queue timeouts when device not ready
    Merge 4.9.172 into android-4.9
Linux 4.9.172
    Documentation: Add nospectre_v1 parameter
    powerpc/fsl: Add FSL_PPC_BOOK3E as supported arch for nospectre_v2 boot arg
  * net: IP6 defrag: use rbtrees in nf_conntrack_reasm.c
      net/ipv6/netfilter/nf_conntrack_reasm.c
  * net: IP6 defrag: use rbtrees for IPv6 defrag
      include/net/ipv6_frag.h
      net/ipv6/reassembly.c
  * ipv6: remove dependency of nf_defrag_ipv6 on ipv6 module
      include/net/ipv6.h
      include/net/ipv6_frag.h
      net/ipv6/netfilter/nf_conntrack_reasm.c
      net/ipv6/netfilter/nf_defrag_ipv6_hooks.c
      net/ipv6/reassembly.c
  * net: IP defrag: encapsulate rbtree defrag code into callable functions
      include/net/inet_frag.h
      net/ipv4/inet_fragment.c
      net/ipv4/ip_fragment.c
  * ipv6: frags: fix a lockdep false positive
      net/ipv6/reassembly.c
  * ipv4: set the tcp_min_rtt_wlen range from 0 to one day
      net/ipv4/sysctl_net_ipv4.c
    net: stmmac: move stmmac_check_ether_addr() to driver probe
    team: fix possible recursive locking when add slaves
    net: rds: exchange of 8K and 1M pool
    net/mlx5e: ethtool, Remove unsupported SFP EEPROM high pages query
    mlxsw: spectrum: Fix autoneg status in ethtool
  * ipv4: add sanity checks in ipv4_link_failure()
      net/ipv4/route.c
  * Revert "block/loop: Use global lock for ioctl() operation."
      drivers/block/loop.c
      drivers/block/loop.h
    tipc: check link name with right length in tipc_nl_compat_link_set
    tipc: check bearer name with right length in tipc_nl_compat_bearer_enable
    fm10k: Fix a potential NULL pointer dereference
  * netfilter: ebtables: CONFIG_COMPAT: drop a bogus WARN_ON
      net/bridge/netfilter/ebtables.c
    NFS: Forbid setting AF_INET6 to "struct sockaddr_in"->sin_family.
  * fs/proc/proc_sysctl.c: Fix a NULL pointer dereference
      fs/proc/proc_sysctl.c
    intel_th: gth: Fix an off-by-one in output unassigning
  * slip: make slhc_free() silently accept an error pointer
      drivers/net/slip/slhc.c
    tipc: handle the err returned from cmd header function
    vsock/virtio: fix kernel panic from virtio_transport_reset_no_sock
  * USB: Consolidate LPM checks to avoid enabling LPM twice
      drivers/usb/core/driver.c
      drivers/usb/core/hub.c
      drivers/usb/core/message.c
  * USB: Add new USB LPM helpers
      drivers/usb/core/driver.c
      drivers/usb/core/hub.c
      drivers/usb/core/message.c
      drivers/usb/core/sysfs.c
      drivers/usb/core/usb.h
    drm/vc4: Fix compilation error reported by kbuild test bot
    drm/vc4: Fix memory leak during gpu reset.
    ARM: 8857/1: efi: enable CP15 DMB instructions before cleaning the cache
    dmaengine: sh: rcar-dmac: With cyclic DMA residue 0 is valid
    Input: synaptics-rmi4 - write config register values to the right offset
    sunrpc: don't mark uninitialised items as VALID.
    nfsd: Don't release the callback slot unless it was actually held
    ceph: fix ci->i_head_snapc leak
    ceph: ensure d_name stability in ceph_dentry_hash()
  * sched/numa: Fix a possible divide-by-zero
      kernel/sched/fair.c
    IB/rdmavt: Fix frwr memory registration
  * trace: Fix preempt_enable_no_resched() abuse
      kernel/trace/ring_buffer.c
    MIPS: scall64-o32: Fix indirect syscall number load
  * tracing: Fix a memory leak by early error exit in trace_pid_write()
      kernel/trace/trace.c
    cifs: do not attempt cifs operation on smb2+ rename error
  * kbuild: simplify ld-option implementation
      scripts/Kbuild.include
    Merge 4.9.171 into android-4.9
Linux 4.9.171
  * kernel/sysctl.c: fix out-of-bounds access when setting file-max
      kernel/sysctl.c
    Revert "locking/lockdep: Add debug_locks check in __lock_downgrade()"
    i2c-hid: properly terminate i2c_hid_dmi_desc_override_table[] array
  * percpu: stop printing kernel addresses
      mm/percpu.c
  * ALSA: info: Fix racy addition/deletion of nodes
      sound/core/info.c
  * mm/vmstat.c: fix /proc/vmstat format for CONFIG_DEBUG_TLBFLUSH=y CONFIG_SMP=n
      mm/vmstat.c
    device_cgroup: fix RCU imbalance in error case
  * sched/fair: Limit sched_cfs_period_timer() loop to avoid hard lockup
      kernel/sched/fair.c
  * Revert "kbuild: use -Oz instead of -Os when using clang"
      Makefile
    perf/x86/amd: Add event map for AMD Family 17h
    mac80211: do not call driver wake_tx_queue op during reconfig
    rt2x00: do not increment sequence number while re-transmitting
  * kprobes: Fix error check when reusing optimized probes
      kernel/kprobes.c
    kprobes: Mark ftrace mcount handler functions nokprobe
  * x86/kprobes: Verify stack frame on kretprobe
      include/linux/kprobes.h
  * arm64: futex: Restore oldval initialization to work around buggy compilers
      arch/arm64/include/asm/futex.h
    crypto: x86/poly1305 - fix overflow during partial reduction
    Revert "svm: Fix AVIC incomplete IPI emulation"
    Revert "scsi: fcoe: clear FC_RP_STARTED flags when receiving a LOGO"
  * ALSA: core: Fix card races between register and disconnect
      sound/core/init.c
    staging: comedi: ni_usb6501: Fix possible double-free of ->usb_rx_buf
    staging: comedi: ni_usb6501: Fix use of uninitialized mutex
    staging: comedi: vmk80xx: Fix possible double-free of ->usb_rx_buf
    staging: comedi: vmk80xx: Fix use of uninitialized semaphore
    io: accel: kxcjk1013: restore the range after resume.
    iio: adc: at91: disable adc channel interrupt in timeout case
    iio: ad_sigma_delta: select channel when reading register
    iio/gyro/bmg160: Use millidegrees for temperature scale
    staging: iio: ad7192: Fix ad7193 channel address
    KVM: x86: Don't clear EFER during SMM transitions for 32-bit vCPU
    CIFS: keep FileInfo handle live during oplock break
    tpm/tpm_i2c_atmel: Return -E2BIG when the transfer is incomplete
  * modpost: file2alias: check prototype of handler
      scripts/mod/file2alias.c
  * modpost: file2alias: go back to simple devtable lookup
      scripts/mod/file2alias.c
  * mmc: sdhci: Fix data command CRC error handling
      drivers/mmc/host/sdhci.c
    crypto: crypto4xx - properly set IV after de- and encrypt
  * ipv4: ensure rcu_read_lock() in ipv4_link_failure()
      net/ipv4/route.c
  * ipv4: recompile ip options in ipv4_link_failure
      net/ipv4/route.c
    vhost: reject zero size iova range
    team: set slave to promisc if team is already in promisc mode
  * tcp: tcp_grow_window() needs to respect tcp_space()
      net/ipv4/tcp_input.c
    net: fou: do not use guehdr after iptunnel_pull_offloads in gue_udp_recv
  * net: bridge: multicast: use rcu to access port list from br_multicast_start_querier
      net/bridge/br_multicast.c
  * net: bridge: fix per-port af_packet sockets
      net/bridge/br_input.c
    net: atm: Fix potential Spectre v1 vulnerabilities
  * bonding: fix event handling for stacked bonds
      drivers/net/bonding/bond_main.c
  * UPSTREAM: usb: hcd: use correct device pointer for dma ops
      drivers/usb/core/hcd.c
    UPSTREAM: usb: host: ehci: use correct device pointer for dma ops
  * UPSTREAM: usb: separate out sysdev pointer from usb_bus
      drivers/usb/core/buffer.c
      drivers/usb/core/hcd.c
      drivers/usb/core/usb.c
      include/linux/usb.h
      include/linux/usb/hcd.h
    ANDROID: cuttlefish_defconfig: Enable CONFIG_XFRM_STATISTICS
    Merge 4.9.170 into android-4.9
Linux 4.9.170
  * appletalk: Fix compile regression
      include/linux/atalk.h
    net: stmmac: Set dma ring length before enabling the DMA
    tpm/tpm_crb: Avoid unaligned reads in crb_recv()
  * include/linux/swap.h: use offsetof() instead of custom __swapoffset macro
      include/linux/swap.h
  * lib/div64.c: off by one in shift
      lib/div64.c
  * appletalk: Fix use-after-free in atalk_proc_exit
      include/linux/atalk.h
    ARM: 8839/1: kprobe: make patch_lock a raw_spinlock_t
    lkdtm: Add tests for NULL pointer dereference
    soc/tegra: pmc: Drop locking from tegra_powergate_is_powered()
    iommu/dmar: Fix buffer overflow during PCI bus notification
    crypto: sha512/arm - fix crash bug in Thumb2 build
    crypto: sha256/arm - fix crash bug in Thumb2 build
  * kernel: hung_task.c: disable on suspend
      kernel/hung_task.c
    cifs: fallback to older infolevels on findfirst queryinfo retry
    ACPI / SBS: Fix GPE storm on recent MacBookPro's
    ARM: samsung: Limit SAMSUNG_PM_CHECK config option to non-Exynos platforms
    HID: i2c-hid: override HID descriptors for certain devices
    serial: uartps: console_setup() can't be placed to init section
  * f2fs: fix to do sanity check with current segment number
      fs/f2fs/super.c
    9p locks: add mount option for lock retry interval
    9p: do not trust pdu content for stat item size
    rsi: improve kernel thread handling to fix kernel panic
    gpio: pxa: handle corner case of unprobed device
  * ext4: prohibit fstrim in norecovery mode
      fs/ext4/ioctl.c
    fix incorrect error code mapping for OBJECTID_NOT_FOUND
    x86/hw_breakpoints: Make default case in hw_breakpoint_arch_parse() return an error
    iommu/vt-d: Check capability before disabling protected memory
    x86/cpu/cyrix: Use correct macros for Cyrix calls on Geode processors
    x86/hpet: Prevent potential NULL pointer dereference
    irqchip/mbigen: Don't clear eventid when freeing an MSI
    perf tests: Fix a memory leak in test__perf_evsel__tp_sched_test()
    perf tests: Fix a memory leak of cpu_map object in the openat_syscall_event_on_all_cpus test
    perf evsel: Free evsel->counts in perf_evsel__exit()
    perf hist: Add missing map__put() in error case
    perf top: Fix error handling in cmd_top()
    perf build-id: Fix memory leak in print_sdt_events()
    perf config: Fix a memory leak in collect_config()
    perf config: Fix an error in the config template documentation
    tools/power turbostat: return the exit status of a command
    thermal/int340x_thermal: fix mode setting
    thermal/int340x_thermal: Add additional UUIDs
    ALSA: opl3: fix mismatch between snd_opl3_drum_switch definition and declaration
    mmc: davinci: remove extraneous __init annotation
    IB/mlx4: Fix race condition between catas error reset and aliasguid flows
    ALSA: sb8: add a check for request_region
    ALSA: echoaudio: add a check for ioremap_nocache
  * ext4: report real fs size after failed resize
      fs/ext4/resize.c
  * ext4: add missing brelse() in add_new_gdb_meta_bg()
      fs/ext4/resize.c
  * perf/core: Restore mmap record type correctly
      kernel/events/core.c
    ARC: u-boot args: check that magic number is correct
    ANDROID: cuttlefish_defconfig: Enable L2TP/PPTP
  * ANDROID: Makefile: Properly resolve 4.9.169 merge
      Makefile
    Make arm64 serial port config compatible with crosvm
    Merge 4.9.169 into android-4.9
Linux 4.9.169
  * PCI: Add function 1 DMA alias quirk for Marvell 9170 SATA controller
      drivers/pci/quirks.c
    xtensa: fix return_address
  * sched/fair: Do not re-read ->h_load_next during hierarchical load calculation
      kernel/sched/fair.c
    xen: Prevent buffer overflow in privcmd ioctl
    parisc: Use cr16 interval timers unconditionally on qemu
  * arm64: futex: Fix FUTEX_WAKE_OP atomic ops with non-zero result value
      arch/arm64/include/asm/futex.h
    ARM: dts: at91: Fix typo in ISC_D0 on PC9
    virtio: Honour 'may_reduce_num' in vring_create_virtqueue
  * genirq: Respect IRQCHIP_SKIP_SET_WAKE in irq_chip_set_wake_parent()
      kernel/irq/chip.c
  * block: do not leak memory in bio_copy_user_iov()
      block/bio.c
    Btrfs: do not allow trimming when a fs is mounted with the nologreplay option
    ASoC: fsl_esai: fix channel swap issue when stream starts
  * include/linux/bitrev.h: fix constant bitrev
      include/linux/bitrev.h
    parisc: Detect QEMU earlier in boot process
    ALSA: seq: Fix OOB-reads from strlcpy
  * ip6_tunnel: Match to ARPHRD_TUNNEL6 for dev type
      net/ipv6/ip6_tunnel.c
  * net: ethtool: not call vzalloc for zero sized memory request
      net/core/ethtool.c
  * netns: provide pure entropy for net_hash_mix()
      include/net/net_namespace.h
      include/net/netns/hash.h
      net/core/net_namespace.c
    net/mlx5e: Add a lock on tir list
    bnxt_en: Improve RX consumer index validity check.
    bnxt_en: Reset device on RX buffer errors.
  * vrf: check accept_source_route on the original netdevice
      include/net/ip.h
      net/ipv4/ip_input.c
      net/ipv4/ip_options.c
    tcp: Ensure DCTCP reacts to losses
    sctp: initialize _pad of sockaddr_in before copying to user memory
    qmi_wwan: add Olicard 600
    openvswitch: fix flow actions reallocation
    net: rds: force to destroy connection if t_sock is NULL in rds_tcp_kill_sock().
    kcm: switch order of device registration to fix a crash
  * ipv6: sit: reset ip header pointer in ipip6_rcv
      net/ipv6/sit.c
  * ipv6: Fix dangling pointer when ipv6 fragment
      net/ipv6/ip6_output.c
  * tty: ldisc: add sysctl to prevent autoloading of ldiscs
      drivers/tty/Kconfig
      drivers/tty/tty_io.c
      drivers/tty/tty_ldisc.c
  * tty: mark Siemens R3964 line discipline as BROKEN
      drivers/char/Kconfig
  * arm64: kaslr: Reserve size of ARM64_MEMSTART_ALIGN in linear region
      arch/arm64/mm/init.c
    powerpc/security: Fix spectre_v2 reporting
    powerpc/fsl: Fix the flush of branch predictor.
    powerpc/fsl: Fixed warning: orphan section `__btb_flush_fixup'
    powerpc/fsl: Update Spectre v2 reporting
    powerpc/fsl: Enable runtime patching if nospectre_v2 boot arg is used
    powerpc/fsl: Flush branch predictor when entering KVM
    powerpc/fsl: Flush the branch predictor at each kernel entry (32 bit)
    powerpc/fsl: Flush the branch predictor at each kernel entry (64bit)
    powerpc/fsl: Add nospectre_v2 command line argument
    powerpc/fsl: Emulate SPRN_BUCSR register
    powerpc/fsl: Fix spectre_v2 mitigations reporting
    powerpc/fsl: Add macro to flush the branch predictor
    powerpc/fsl: Add infrastructure to fixup branch predictor flush
    powerpc/powernv: Query firmware for count cache flush settings
    powerpc/pseries: Query hypervisor for count cache flush settings
    powerpc/64s: Add support for software count cache flush
    powerpc/64s: Add new security feature flags for count cache flush
    powerpc/asm: Add a patch_site macro & helpers for patching instructions
    powerpc/fsl: Sanitize the syscall table for NXP PowerPC 32 bit platforms
    powerpc/fsl: Add barrier_nospec implementation for NXP PowerPC Book3E
    powerpc/64: Make meltdown reporting Book3S 64 specific
    powerpc/64: Call setup_barrier_nospec() from setup_arch()
    powerpc/64: Add CONFIG_PPC_BARRIER_NOSPEC
    powerpc/64: Make stf barrier PPC_BOOK3S_64 specific.
    powerpc/64: Disable the speculation barrier from the command line
    powerpc64s: Show ori31 availability in spectre_v1 sysfs file not v2
    powerpc/64s: Enhance the information in cpu_show_spectre_v1()
    powerpc/64: Use barrier_nospec in syscall entry
    powerpc: Use barrier_nospec in copy_from_user()
    powerpc/64s: Enable barrier_nospec based on firmware settings
    powerpc/64s: Patch barrier_nospec in modules
    powerpc: Avoid code patching freed init sections
    powerpc/64s: Add support for ori barrier_nospec patching
    powerpc/64s: Add barrier_nospec
    powerpc: Fix invalid use of register expressions
  * lib/string.c: implement a basic bcmp
      include/linux/string.h
      lib/string.c
    x86/vdso: Drop implicit common-page-size linker flag
    x86: vdso: Use $LD instead of $CC to link
  * kbuild: clang: choose GCC_TOOLCHAIN_DIR not on LD
      Makefile
    powerpc/tm: Limit TM code inside PPC_TRANSACTIONAL_MEM
    x86/power: Make restore_processor_context() sane
    x86/power/32: Move SYSENTER MSR restoration to fix_processor_context()
    x86/power/64: Use struct desc_ptr for the IDT in struct saved_context
    x86/power: Fix some ordering bugs in __restore_processor_context()
  * fscrypt: remove filesystem specific build config option
      fs/crypto/Kconfig
      fs/crypto/fscrypt_private.h
      fs/ext4/Kconfig
      fs/ext4/dir.c
      fs/ext4/ext4.h
      fs/ext4/inode.c
      fs/ext4/ioctl.c
      fs/ext4/namei.c
      fs/ext4/page-io.c
      fs/ext4/readpage.c
      fs/ext4/super.c
      fs/ext4/sysfs.c
      fs/f2fs/Kconfig
      fs/f2fs/f2fs.h
      fs/f2fs/super.c
      fs/f2fs/sysfs.c
      include/linux/fs.h
      include/linux/fscrypt.h
  * f2fs: use IS_ENCRYPTED() to check encryption status
      fs/f2fs/data.c
      fs/f2fs/dir.c
      fs/f2fs/f2fs.h
      fs/f2fs/file.c
      fs/f2fs/inode.c
      fs/f2fs/namei.c
  * ext4: use IS_ENCRYPTED() to check encryption status
      fs/ext4/dir.c
      fs/ext4/ext4.h
      fs/ext4/ext4_jbd2.h
      fs/ext4/extents.c
      fs/ext4/file.c
      fs/ext4/ialloc.c
      fs/ext4/inode.c
      fs/ext4/move_extent.c
      fs/ext4/namei.c
      fs/ext4/page-io.c
      fs/ext4/readpage.c
  * fscrypt: return -EXDEV for incompatible rename or link into encrypted dir
      fs/crypto/hooks.c
      fs/crypto/policy.c
      include/linux/fscrypt.h
  * fscrypt: remove CRYPTO_CTR dependency
      fs/crypto/Kconfig
  * fscrypt: add Adiantum support / removed speck
      fs/crypto/crypto.c
      fs/crypto/fname.c
      fs/crypto/fscrypt_private.h
      fs/crypto/keyinfo.c
      fs/crypto/policy.c
      include/uapi/linux/fs.h
  * ANDROID: Makefile: Add '-fsplit-lto-unit' to cfi-clang-flags
      Makefile
    Merge 4.9.168 into android-4.9
Linux 4.9.168
    ACPI / video: Extend chassis-type detection with a "Lunch Box" check
  * drm/dp/mst: Configure no_stop_bit correctly for remote i2c xfers
      drivers/gpu/drm/drm_dp_mst_topology.c
    dmaengine: tegra: avoid overflow of byte tracking
    x86/build: Mark per-CPU symbols as absolute explicitly for LLD
    wlcore: Fix memory leak in case wl12xx_fetch_firmware failure
  * selinux: do not override context on context mounts
      security/selinux/hooks.c
    x86/build: Specify elf_i386 linker emulation explicitly for i386 objects
    drm/nouveau: Stop using drm_crtc_force_disable
    regulator: act8865: Fix act8600_sudcdc_voltage_ranges setting
    media: s5p-jpeg: Check for fmt_ver_flag when doing fmt enumeration
    netfilter: physdev: relax br_netfilter dependency
    dmaengine: qcom_hidma: assign channel cookie correctly
    dmaengine: imx-dma: fix warning comparison of distinct pointer types
    hpet: Fix missing '=' character in the __setup() code of hpet_mmap_enable
    HID: intel-ish: ipc: handle PIMR before ish_wakeup also clear PISR busy_clear bit
    soc/tegra: fuse: Fix illegal free of IO base address
    hwrng: virtio - Avoid repeated init of completion
    media: mt9m111: set initial frame size other than 0x0
    powerpc/pseries: Perform full re-add of CPU for topology update post-migration
  * tty: increase the default flip buffer limit to 2*640K
      drivers/tty/tty_buffer.c
    ARM: avoid Cortex-A9 livelock on tight dmb loops
    mt7601u: bump supported EEPROM version
    soc: qcom: gsbi: Fix error handling in gsbi_probe()
    ARM: dts: lpc32xx: Remove leading 0x and 0s from bindings notation
    efi/memattr: Don't bail on zero VA if it equals the region's PA
    ASoC: fsl-asoc-card: fix object reference leaks in fsl_asoc_card_probe
    e1000e: fix cyclic resets at link up with active tx
    cdrom: Fix race condition in cdrom_sysctl_register
  * fbdev: fbmem: fix memory access if logo is bigger than the screen
      drivers/video/fbdev/core/fbmem.c
    iw_cxgb4: fix srqidx leak during connection abort
  * genirq: Avoid summation loops for /proc/stat
      include/linux/irqdesc.h
      kernel/irq/chip.c
      kernel/irq/internals.h
      kernel/irq/irqdesc.c
    bcache: improve sysfs_strtoul_clamp()
    bcache: fix input overflow to sequential_cutoff
    bcache: fix input overflow to cache set sysfs file io_error_halflife
  * usb: f_fs: Avoid crash due to out-of-scope stack ptr access
      drivers/usb/gadget/function/f_fs.c
  * ALSA: PCM: check if ops are defined before suspending PCM
      sound/core/pcm_native.c
    ARM: 8833/1: Ensure that NEON code always compiles with Clang
  * kprobes: Prohibit probing on bsearch()
      lib/bsearch.c
    ACPI / video: Refactor and fix dmi_is_desktop()
    iwlwifi: pcie: fix emergency path
    leds: lp55xx: fix null deref on firmware load failure
    HID: intel-ish-hid: avoid binding wrong ishtp_cl_device
  * vfs: fix preadv64v2 and pwritev64v2 compat syscalls with offset == -1
      fs/read_write.c
    media: mx2_emmaprp: Correct return type for mem2mem buffer helpers
    media: s5p-g2d: Correct return type for mem2mem buffer helpers
    media: s5p-jpeg: Correct return type for mem2mem buffer helpers
    media: sh_veu: Correct return type for mem2mem buffer helpers
    SoC: imx-sgtl5000: add missing put_device()
    perf test: Fix failure of 'evsel-tp-sched' test on s390
    scsi: megaraid_sas: return error when create DMA pool failed
    IB/mlx4: Increase the timeout for CM cache
    mlxsw: spectrum: Avoid -Wformat-truncation warnings
    e1000e: Fix -Wformat-truncation warnings
    mmc: omap: fix the maximum timeout setting
    iommu/io-pgtable-arm-v7s: Only kmemleak_ignore L2 tables
    ARM: 8840/1: use a raw_spinlock_t in unwind
    coresight: etm4x: Add support to enable ETMv4.2
  * scsi: core: replace GFP_ATOMIC with GFP_KERNEL in scsi_scan.c
      drivers/scsi/scsi_scan.c
    usb: chipidea: Grab the (legacy) USB PHY by phandle first
    crypto: crypto4xx - add missing of_node_put after of_device_is_available
    wil6210: check null pointer in _wil_cfg80211_merge_extra_ies
    tools lib traceevent: Fix buffer overflow in arg_eval
  * fs: fix guard_bio_eod to check for real EOD errors
      fs/buffer.c
  * jbd2: fix invalid descriptor block checksum
      fs/jbd2/commit.c
    cifs: Fix NULL pointer dereference of devname
    dm thin: add sanity checks to thin-pool and external snapshot creation
    cifs: use correct format characters
  * fs/file.c: initialize init_files.resize_wait
      fs/file.c
    f2fs: do not use mutex lock in atomic context
    ocfs2: fix a panic problem caused by o2cb_ctl
    mm/slab.c: kmemleak no scan alien caches
  * mm/vmalloc.c: fix kernel BUG at mm/vmalloc.c:512!
      mm/vmalloc.c
    mm/page_ext.c: fix an imbalance with kmemleak
  * mm/cma.c: cma_declare_contiguous: correct err handling
      mm/cma.c
    scsi: hisi_sas: Set PHY linkrate when disconnected
    enic: fix build warning without CONFIG_CPUMASK_OFFSTACK
  * sysctl: handle overflow for file-max
      kernel/sysctl.c
  * include/linux/relay.h: fix percpu annotation in struct rchan
      include/linux/relay.h
    gpio: gpio-omap: fix level interrupt idling
  * tracing: kdb: Fix ftdump to not sleep
      include/linux/ring_buffer.h
      kernel/trace/ring_buffer.c
      kernel/trace/trace.c
    h8300: use cc-cross-prefix instead of hardcoding h8300-unknown-linux-
    CIFS: fix POSIX lock leak and invalid ptr deref
  * i2c: core-smbus: prevent stack corruption on read I2C_BLOCK_DATA
      drivers/i2c/i2c-core.c
    mm: mempolicy: make mbind() return -EIO when MPOL_MF_STRICT is specified
    tty/serial: atmel: RS485 HD w/DMA: enable RX after TX is stopped
    tty/serial: atmel: Add is_half_duplex helper
  * lib/int_sqrt: optimize initial value compute
      lib/int_sqrt.c
  * ext4: cleanup bh release code in ext4_ind_remove_space()
      fs/ext4/indirect.c
  * arm64: debug: Ensure debug handlers check triggering exception level
      arch/arm64/kernel/probes/kprobes.c
  * arm64: debug: Don't propagate UNKNOWN FAR into si_code for debug signals
      arch/arm64/mm/fault.c
  * ext4: switch to fscrypt_prepare_setattr()
      fs/ext4/inode.c
  * ext4: switch to fscrypt_prepare_rename()
      fs/ext4/namei.c
  * ext4: switch to fscrypt_prepare_link()
      fs/ext4/namei.c
  * ext4: switch to fscrypt_file_open()
      fs/ext4/file.c
  * ext4, dax: set ext4_dax_aops for dax files
      fs/ext4/inode.c
    ANDROID: cuttlefish_defconfig: Enable CONFIG_OVERLAY_FS
    ANDROID: cuttlefish: enable CONFIG_NET_SCH_INGRESS=y
    Merge 4.9.167 into android-4.9
Linux 4.9.167
  * arm64: support keyctl() system call in 32-bit mode
      arch/arm64/Kconfig
  * Revert "USB: core: only clean up what we allocated"
      drivers/usb/core/config.c
  * xhci: Fix port resume done detection for SS ports with LPM enabled
      drivers/usb/host/xhci-ring.c
      drivers/usb/host/xhci.h
  * USB: gadget: f_hid: fix deadlock in f_hidg_write()
      drivers/usb/gadget/function/f_hid.c
    KVM: x86: Emulate MSR_IA32_ARCH_CAPABILITIES on AMD hosts
    KVM: Reject device ioctls from processes other than the VM's creator
    x86/smp: Enforce CONFIG_HOTPLUG_CPU when SMP=y
  * cpu/hotplug: Prevent crash when CPU bringup fails on CONFIG_HOTPLUG_CPU=n
      kernel/cpu.c
    perf intel-pt: Fix TSC slip
    usb: host: xhci-rcar: Add XHCI_TRUST_TX_LENGTH quirk
  * usb: common: Consider only available nodes for dr_mode
      drivers/usb/common/common.c
    gpio: adnp: Fix testing wrong value in adnp_gpio_direction_input
  * fs/proc/proc_sysctl.c: fix NULL pointer dereference in put_links
      fs/proc/proc_sysctl.c
    Disable kgdboc failed by echo space to /sys/module/kgdboc/parameters/kgdboc
    USB: serial: option: add Olicard 600
    USB: serial: option: set driver_info for SIM5218 and compatibles
    USB: serial: mos7720: fix mos_parport refcount imbalance on error path
    USB: serial: ftdi_sio: add additional NovaTech products
    USB: serial: cp210x: add new device id
    serial: sh-sci: Fix setting SCSCR_TIE while transferring data
    serial: max310x: Fix to avoid potential NULL pointer dereference
    staging: vt6655: Fix interrupt race condition on device start up.
    staging: vt6655: Remove vif check from vnt_interrupt
    staging: comedi: ni_mio_common: Fix divide-by-zero for DIO cmdtest
    tty: atmel_serial: fix a potential NULL pointer dereference
    scsi: zfcp: fix scsi_eh host reset with port_forced ERP for non-NPIV FCP devices
    scsi: zfcp: fix rport unblock if deleted SCSI devices on Scsi_Host
  * scsi: sd: Quiesce warning if device does not report optimal I/O size
      drivers/scsi/sd.c
  * scsi: sd: Fix a race between closing an sd device and sd I/O
      drivers/scsi/sd.c
  * fs/open.c: allow opening only regular files during execve()
      fs/open.c
  * ALSA: pcm: Don't suspend stream in unrecoverable PCM state
      sound/core/pcm_native.c
    ALSA: pcm: Fix possible OOB access in PCM oss plugins
    ALSA: seq: oss: Fix Spectre v1 vulnerability
  * ALSA: rawmidi: Fix potential Spectre v1 vulnerability
      sound/core/rawmidi.c
    net: dsa: qca8k: remove leftover phy accessors
    NFSv4.1 don't free interrupted slot on open
    powerpc: bpf: Fix generation of load/store DW instructions
    ARM: imx6q: cpuidle: fix bug that CPU might not wake up at expected time
    btrfs: raid56: properly unmap parity page in finish_parity_scrub()
    btrfs: remove WARN_ON in log_dir_items
  * tun: add a missing rcu_read_unlock() in error path
      drivers/net/tun.c
  * tun: properly test for IFF_UP
      drivers/net/tun.c
    mac8390: Fix mmio access size probe
  * sctp: get sctphdr by offset in sctp_compute_cksum
      include/net/sctp/checksum.h
    vxlan: Don't call gro_cells_destroy() before device is unregistered
  * tcp: do not use ipv6 header for ipv4 flow
      net/ipv6/tcp_ipv6.c
  * packets: Always register packet sk in the same order
      include/net/sock.h
      net/packet/af_packet.c
    net: rose: fix a possible stack overflow
  * net/packet: Set __GFP_NOWARN upon allocation in alloc_pg_vec
      net/packet/af_packet.c
    mISDN: hfcpci: Test both vendor & device ID for Digium HFC4S
    dccp: do not use ipv6 header for ipv4 flow
    stmmac: copy unicast mac address to MAC registers
  * cfg80211: size various nl80211 messages correctly
      net/wireless/nl80211.c
    video: fbdev: Set pixclock = 0 in goldfishfb
  * Bluetooth: Verify that l2cap_get_conf_opt provides large enough buffer
      net/bluetooth/l2cap_core.c
  * Bluetooth: Check L2CAP option sizes returned from l2cap_get_conf_opt
      net/bluetooth/l2cap_core.c
    UPSTREAM: virt_wifi: Remove REGULATORY_WIPHY_SELF_MANAGED
    Merge 4.9.166 into android-4.9
Linux 4.9.166
    ath10k: avoid possible string overflow
    power: supply: charger-manager: Fix incorrect return value
    pwm-backlight: Enable/disable the PWM before/after LCD enable toggle.
  * rtc: Fix overflow when converting time64_t to rtc_time
      drivers/rtc/rtc-lib.c
  * scsi: ufs: fix wrong command type of UTRD for UFSHCI v2.1
      drivers/scsi/ufs/ufshcd.c
  * USB: core: only clean up what we allocated
      drivers/usb/core/config.c
  * lib/int_sqrt: optimize small argument
      lib/int_sqrt.c
    serial: sprd: clear timeout interrupt only rather than all interrupts
  * arm64: traps: disable irq in die()
      arch/arm64/kernel/traps.c
  * Hang/soft lockup in d_invalidate with simultaneous calls
      fs/dcache.c
    serial: sprd: adjust TIMEOUT to a big value
  * tcp/dccp: drop SYN packets if accept queue is full
      include/net/inet_connection_sock.h
      net/ipv4/tcp_input.c
    ALSA: hda - Enforces runtime_resume after S3 and S4 for each codec
    ALSA: hda - Record the current power state before suspend/resume calls
    locking/lockdep: Add debug_locks check in __lock_downgrade()
  * Bluetooth: Fix decrementing reference count twice in releasing socket
      net/bluetooth/hci_sock.c
  * media: v4l2-ctrls.c/uvc: zero v4l2_event
      drivers/media/v4l2-core/v4l2-ctrls.c
  * ext4: brelse all indirect buffer in ext4_ind_remove_space()
      fs/ext4/indirect.c
  * ext4: fix data corruption caused by unaligned direct AIO
      fs/ext4/file.c
  * ext4: fix NULL pointer dereference while journal is aborted
      fs/ext4/ext4_jbd2.h
    objtool: Move objtool_file struct off the stack
  * futex: Ensure that futex address is aligned in handle_futex_death()
      kernel/futex.c
    MIPS: Fix kernel crash for R6 in jump label branch function
    MIPS: Ensure ELF appended dtb is relocated
    mips: loongson64: lemote-2f: Add IRQF_NO_SUSPEND to "cascade" irqaction.
    udf: Fix crash on IO error during truncate
    libceph: wait for latest osdmap in ceph_monc_blacklist_add()
    iommu/amd: fix sg->dma_address for sg->offset bigger than PAGE_SIZE
    drm/vmwgfx: Don't double-free the mode stored in par->set_mode
    mmc: pxamci: fix enum type confusion

Change-Id: I240c51a5bde3c2c7a9ada58c87d5d0966f26cb78
Signed-off-by: Robin Peng <robinpeng@google.com>
2019-07-02 15:35:29 +08:00
Greg Kroah-Hartman
e6d81da784 Merge 4.9.177 into android-4.9
Changes in 4.9.177
	netfilter: compat: initialize all fields in xt_init
	bpf: fix struct htab_elem layout
	bpf: convert htab map to hlist_nulls
	platform/x86: sony-laptop: Fix unintentional fall-through
	USB: serial: fix unthrottle races
	iio: adc: xilinx: fix potential use-after-free on remove
	libnvdimm/namespace: Fix a potential NULL pointer dereference
	HID: input: add mapping for Expose/Overview key
	HID: input: add mapping for keyboard Brightness Up/Down/Toggle keys
	HID: input: add mapping for "Toggle Display" key
	libnvdimm/btt: Fix a kmemdup failure check
	s390/dasd: Fix capacity calculation for large volumes
	mac80211: fix unaligned access in mesh table hash function
	s390/3270: fix lockdep false positive on view->lock
	mISDN: Check address length before reading address family
	x86/reboot, efi: Use EFI reboot for Acer TravelMate X514-51T
	KVM: x86: avoid misreporting level-triggered irqs as edge-triggered in tracing
	tools lib traceevent: Fix missing equality check for strcmp
	init: initialize jump labels before command line option parsing
	selftests: netfilter: check icmp pkttoobig errors are set as related
	ipvs: do not schedule icmp errors from tunnels
	MIPS: perf: ath79: Fix perfcount IRQ assignment
	s390: ctcm: fix ctcm_new_device error return code
	drm/sun4i: Set device driver data at bind time for use in unbind
	selftests/net: correct the return value for run_netsocktests
	gpu: ipu-v3: dp: fix CSC handling
	spi: Micrel eth switch: declare missing of table
	spi: ST ST95HF NFC: declare missing of table
	Input: synaptics-rmi4 - fix possible double free
	cw1200: fix missing unlock on error in cw1200_hw_scan()
	ALSA: pcm: remove SNDRV_PCM_IOCTL1_INFO internal command
	rtlwifi: rtl8723ae: Fix missing break in switch statement
	Don't jump to compute_result state from check_result state
	Revert "x86/vdso: Drop implicit common-page-size linker flag"
	Revert "x86: vdso: Use $LD instead of $CC to link"
	x86: vdso: Use $LD instead of $CC to link
	x86/vdso: Drop implicit common-page-size linker flag
	x86/vdso: Pass --eh-frame-hdr to the linker
	powerpc/64s: Include cpu header
	bridge: Fix error path for kobject_init_and_add()
	fib_rules: return 0 directly if an exactly same rule exists when NLM_F_EXCL not supplied
	net: ucc_geth - fix Oops when changing number of buffers in the ring
	packet: Fix error path in packet_init
	vlan: disable SIOCSHWTSTAMP in container
	vrf: sit mtu should not be updated when vrf netdev is the link
	ipv4: Fix raw socket lookup for local traffic
	bonding: fix arp_validate toggling in active-backup mode
	drivers/virt/fsl_hypervisor.c: dereferencing error pointers in ioctl
	drivers/virt/fsl_hypervisor.c: prevent integer overflow in ioctl
	powerpc/lib: fix book3s/32 boot failure due to code patching
	powerpc/booke64: set RI in default MSR
	Linux 4.9.177

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2019-05-16 22:58:15 +02:00
Greg Kroah-Hartman
915f59cf77 Merge 4.9.177 into android-4.9-q
Changes in 4.9.177
	netfilter: compat: initialize all fields in xt_init
	bpf: fix struct htab_elem layout
	bpf: convert htab map to hlist_nulls
	platform/x86: sony-laptop: Fix unintentional fall-through
	USB: serial: fix unthrottle races
	iio: adc: xilinx: fix potential use-after-free on remove
	libnvdimm/namespace: Fix a potential NULL pointer dereference
	HID: input: add mapping for Expose/Overview key
	HID: input: add mapping for keyboard Brightness Up/Down/Toggle keys
	HID: input: add mapping for "Toggle Display" key
	libnvdimm/btt: Fix a kmemdup failure check
	s390/dasd: Fix capacity calculation for large volumes
	mac80211: fix unaligned access in mesh table hash function
	s390/3270: fix lockdep false positive on view->lock
	mISDN: Check address length before reading address family
	x86/reboot, efi: Use EFI reboot for Acer TravelMate X514-51T
	KVM: x86: avoid misreporting level-triggered irqs as edge-triggered in tracing
	tools lib traceevent: Fix missing equality check for strcmp
	init: initialize jump labels before command line option parsing
	selftests: netfilter: check icmp pkttoobig errors are set as related
	ipvs: do not schedule icmp errors from tunnels
	MIPS: perf: ath79: Fix perfcount IRQ assignment
	s390: ctcm: fix ctcm_new_device error return code
	drm/sun4i: Set device driver data at bind time for use in unbind
	selftests/net: correct the return value for run_netsocktests
	gpu: ipu-v3: dp: fix CSC handling
	spi: Micrel eth switch: declare missing of table
	spi: ST ST95HF NFC: declare missing of table
	Input: synaptics-rmi4 - fix possible double free
	cw1200: fix missing unlock on error in cw1200_hw_scan()
	ALSA: pcm: remove SNDRV_PCM_IOCTL1_INFO internal command
	rtlwifi: rtl8723ae: Fix missing break in switch statement
	Don't jump to compute_result state from check_result state
	Revert "x86/vdso: Drop implicit common-page-size linker flag"
	Revert "x86: vdso: Use $LD instead of $CC to link"
	x86: vdso: Use $LD instead of $CC to link
	x86/vdso: Drop implicit common-page-size linker flag
	x86/vdso: Pass --eh-frame-hdr to the linker
	powerpc/64s: Include cpu header
	bridge: Fix error path for kobject_init_and_add()
	fib_rules: return 0 directly if an exactly same rule exists when NLM_F_EXCL not supplied
	net: ucc_geth - fix Oops when changing number of buffers in the ring
	packet: Fix error path in packet_init
	vlan: disable SIOCSHWTSTAMP in container
	vrf: sit mtu should not be updated when vrf netdev is the link
	ipv4: Fix raw socket lookup for local traffic
	bonding: fix arp_validate toggling in active-backup mode
	drivers/virt/fsl_hypervisor.c: dereferencing error pointers in ioctl
	drivers/virt/fsl_hypervisor.c: prevent integer overflow in ioctl
	powerpc/lib: fix book3s/32 boot failure due to code patching
	powerpc/booke64: set RI in default MSR
	Linux 4.9.177

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2019-05-16 22:57:15 +02:00