Merge 4.9.289 into android-4.9-q
Linux 4.9.289
sctp: add vtag check in sctp_sf_violation
sctp: use init_tag from inithdr for ABORT chunk
net: nxp: lpc_eth.c: avoid hang when bringing interface down
nios2: Make NIOS2_DTB_SOURCE_BOOL depend on !COMPILE_TEST
net: batman-adv: fix error handling
* regmap: Fix possible double-free in regcache_rbtree_exit()
drivers/base/regmap/regcache-rbtree.c
net: lan78xx: fix division by zero in send path
* mmc: sdhci: Map more voltage level to SDHCI_POWER_330
drivers/mmc/host/sdhci.c
mmc: dw_mmc: exynos: fix the finding clock sample value
mmc: vub300: fix control-message timeouts
* Revert "net: mdiobus: Fix memory leak in __mdiobus_register"
drivers/net/phy/mdio_bus.c
nfc: port100: fix using -ERRNO as command type mask
ata: sata_mv: Fix the error handling of mv_chip_id()
* usbnet: fix error return code in usbnet_probe()
drivers/net/usb/usbnet.c
* usbnet: sanity check for maxpacket
drivers/net/usb/usbnet.c
* ARM: 8819/1: Remove '-p' from LDFLAGS
arch/arm/Makefile
powerpc/bpf: Fix BPF_MOD when imm == 1
ARM: 9139/1: kprobes: fix arch_init_kprobes() prototype
ARM: 9134/1: remove duplicate memcpy() definition
ARM: 9133/1: mm: proc-macros: ensure *_tlb_fns are 4B aligned
Merge 4.9.288 into android-4.9-q
Linux 4.9.288
ARM: 9122/1: select HAVE_FUTEX_CMPXCHG
* tracing: Have all levels of checks prevent recursion
kernel/trace/trace.h
* net: mdiobus: Fix memory leak in __mdiobus_register
drivers/net/phy/mdio_bus.c
ALSA: hda: avoid write to STATESTS if controller is in reset
platform/x86: intel_scu_ipc: Update timeout value in comment
isdn: mISDN: Fix sleeping function called from invalid context
ARM: dts: spear3xx: Fix gmac node
* netfilter: Kconfig: use 'default y' instead of 'm' for bool config option
net/netfilter/Kconfig
isdn: cpai: check ctr->cnr to avoid array index out of bound
nfc: nci: fix the UAF of rf_conn_info object
* ASoC: DAPM: Fix missing kctl change notifications
sound/soc/soc-dapm.c
* ALSA: usb-audio: Provide quirk for Sennheiser GSP670 Headset
sound/usb/quirks-table.h
* vfs: check fd has read access in kernel_read_file_from_fd()
fs/exec.c
* elfcore: correct reference to CONFIG_UML
include/linux/elfcore.h
ocfs2: mount fails with buffer overflow in strlen
ocfs2: fix data corruption after conversion from inline format
can: peak_pci: peak_pci_remove(): fix UAF
can: peak_usb: pcan_usb_fd_decode_status(): fix back to ERROR_ACTIVE state notification
can: rcar_can: fix suspend/resume
NIOS2: irqflags: rename a redefined register name
netfilter: ipvs: make global sysctl readonly in non-init netns
NFSD: Keep existing listeners on portlist error
xtensa: xtfpga: Try software restart before simulating CPU reset
xtensa: xtfpga: use CONFIG_USE_OF instead of CONFIG_OF
* r8152: select CRC32 and CRYPTO/CRYPTO_HASH/CRYPTO_SHA256
drivers/net/usb/Kconfig
drm/msm/dsi: fix off by one in dsi_bus_clk_enable error handling
drm/msm: Fix null pointer dereference on pointer edp
pata_legacy: fix a couple uninitialized variable bugs
NFC: digital: fix possible memory leak in digital_in_send_sdd_req()
NFC: digital: fix possible memory leak in digital_tg_listen_mdaa()
nfc: fix error handling of nfc_proto_register()
ethernet: s2io: fix setting mac address during resume
net: encx24j600: check error in devm_regmap_init_encx24j600
* net: korina: select CRC32
drivers/net/ethernet/Kconfig
* net: arc: select CRC32
drivers/net/ethernet/arc/Kconfig
iio: ssp_sensors: fix error code in ssp_print_mcu_debug()
iio: ssp_sensors: add more range checking in ssp_parse_dataframe()
iio: light: opt3001: Fixed timeout error when 0 lux
iio: adc128s052: Fix the error handling path of 'adc128_probe()'
* nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells
drivers/nvmem/core.c
USB: serial: option: add Telit LE910Cx composition 0x1204
USB: serial: qcserial: add EM9191 QDL support
* Input: xpad - add support for another USB ID of Nacon GC-100
drivers/input/joystick/xpad.c
efi: Change down_interruptible() in virt_efi_reset_system() to down_trylock()
efi/cper: use stack buffer for error record decoding
cb710: avoid NULL pointer subtraction
* xhci: Enable trust tx length quirk for Fresco FL11 USB controller
drivers/usb/host/xhci-pci.c
s390: fix strrchr() implementation
ALSA: seq: Fix a potential UAF by wrong private_free call order
Merge 4.9.287 into android-4.9-q
Linux 4.9.287
perf/x86: Reset destroy callback on event init failure
scsi: virtio_scsi: Fix spelling mistake "Unsupport" -> "Unsupported"
scsi: ses: Fix unsigned comparison with less than zero
mac80211: Drop frames from invalid MAC address in ad-hoc mode
* netfilter: ip6_tables: zero-initialize fragment offset
net/ipv6/netfilter/ip6_tables.c
* HID: apple: Fix logical maximum and usage maximum of Magic Keyboard JIS
drivers/hid/hid-apple.c
* gup: document and work around "COW can break either way" issue
mm/gup.c
i40e: fix endless loop under rtnl
* rtnetlink: fix if_nlmsg_stats_size() under estimation
net/core/rtnetlink.c
drm/nouveau/debugfs: fix file release memory leak
* netlink: annotate data races around nlk->bound
net/netlink/af_netlink.c
* net: bridge: use nla_total_size_64bit() in br_get_linkxstats_size()
net/bridge/br_netlink.c
ARM: imx6: disable the GIC CPU interface before calling stby-poweroff sequence
ptp_pch: Load module automatically if ID matches
powerpc/fsl/dts: Fix phy-connection-type for fm1mac3
* net_sched: fix NULL deref in fifo_set_limit()
net/sched/sch_fifo.c
* phy: mdio: fix memory leak
drivers/net/phy/mdio_bus.c
* bpf: Fix integer overflow in prealloc_elems_and_freelist()
kernel/bpf/stackmap.c
xtensa: call irqchip_init only when CONFIG_USE_OF is selected
ARM: dts: omap3430-sdp: Fix NAND device node
nfsd4: Handle the NFSv4 READDIR 'dircount' hint being zero
* ovl: fix missing negative dentry check in ovl_rename()
fs/overlayfs/dir.c
USB: cdc-acm: fix break reporting
USB: cdc-acm: fix racy tty buffer accesses
* Partially revert "usb: Kconfig: using select for USB_COMMON dependency"
drivers/usb/Kconfig
Merge 4.9.286 into android-4.9-q
Linux 4.9.286
libata: Add ATA_HORKAGE_NO_NCQ_ON_ATI for Samsung 860 and 870 SSD.
usb: testusb: Fix for showing the connection speed
* scsi: sd: Free scsi_disk device via put_device()
drivers/scsi/sd.c
ext2: fix sleeping in atomic bugs on error
sparc64: fix pci_iounmap() when CONFIG_PCI is not set
xen-netback: correct success/error reporting for the SKB-with-fraglist case
* net: mdio: introduce a shutdown method to mdio device drivers
drivers/net/phy/mdio_device.c
include/linux/mdio.h
* af_unix: fix races in sk_peer_pid and sk_peer_cred accesses
include/net/sock.h
net/core/sock.c
net/unix/af_unix.c
Merge 4.9.285 into android-4.9-q
Linux 4.9.285
* cred: allow get_cred() and put_cred() to be given NULL.
include/linux/cred.h
* HID: usbhid: free raw_report buffers in usbhid_stop
drivers/hid/usbhid/hid-core.c
netfilter: ipset: Fix oversized kvmalloc() calls
HID: betop: fix slab-out-of-bounds Write in betop_probe
* arm64: Extend workaround for erratum 1024718 to all versions of Cortex-A55
arch/arm64/Kconfig
arch/arm64/mm/proc.S
ARM: 9098/1: ftrace: MODULE_PLT: Fix build problem without DYNAMIC_FTRACE
ARM: 9079/1: ftrace: Add MODULE_PLTS support
ARM: 9078/1: Add warn suppress parameter to arm_gen_branch_link()
ARM: 9077/1: PLT: Move struct plt_entries definition to header
EDAC/synopsys: Fix wrong value type assignment for edac_mode
* net: udp: annotate data race around udp_sk(sk)->corkflag
net/ipv4/udp.c
net/ipv6/udp.c
* ext4: fix potential infinite loop in ext4_dx_readdir()
fs/ext4/dir.c
ipack: ipoctal: fix module reference leak
ipack: ipoctal: fix missing allocation-failure check
ipack: ipoctal: fix tty-registration error handling
ipack: ipoctal: fix tty registration race
ipack: ipoctal: fix stack information leak
e100: fix buffer overrun in e100_get_regs
e100: fix length calculation in e100_get_regs_len
hwmon: (tmp421) fix rounding for negative values
mac80211: limit injected vht mcs/nss in ieee80211_parse_tx_radiotap
ipvs: check that ip_vs_conn_tab_bits is between 8 and 20
mac80211: fix use-after-free in CCMP/GCMP RX
* cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory
drivers/cpufreq/cpufreq_governor_attr_set.c
* cpufreq: schedutil: Use kobject release() method to free sugov_tunables
kernel/sched/cpufreq_schedutil.c
* tty: Fix out-of-bound vmalloc access in imageblit
drivers/tty/vt/vt.c
qnx4: work around gcc false positive warning bug
arm64: dts: marvell: armada-37xx: Extend PCIe MEM space
spi: Fix tegra20 build with CONFIG_PM=n
net: 6pack: Fix tx timeout and slot time
alpha: Declare virt_to_phys and virt_to_bus parameter as pointer to volatile
* arm64: Mark __stack_chk_guard as __ro_after_init
arch/arm64/kernel/process.c
parisc: Use absolute_pointer() to define PAGE0
qnx4: avoid stringop-overread errors
sparc: avoid stringop-overread errors
net: i825xx: Use absolute_pointer for memcpy from fixed memory location
* compiler.h: Introduce absolute_pointer macro
include/linux/compiler.h
m68k: Double cast io functions to unsigned long
net: stmmac: allow CSR clock of 300MHz
* blktrace: Fix uaf in blk_trace access after removing by sysfs
kernel/trace/blktrace.c
scsi: iscsi: Adjust iface sysfs attr detection
net/mlx4_en: Don't allow aRFS for encapsulated packets
net: hso: fix muxed tty registration
serial: mvebu-uart: fix driver's tx_empty callback
mcb: fix error handling in mcb_alloc_bus()
USB: serial: option: add device id for Foxconn T99W265
USB: serial: option: remove duplicate USB device ID
USB: serial: option: add Telit LN920 compositions
USB: serial: mos7840: remove duplicated 0xac24 device ID
staging: greybus: uart: fix tty use after free
USB: serial: cp210x: add ID for GW Instek GDM-834x Digital Multimeter
* usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
drivers/usb/storage/unusual_devs.h
xen/x86: fix PV trap handling on secondary processors
cifs: fix incorrect check for null pointer in header_assemble
usb: musb: tusb6010: uninitialized data in tusb_fifo_write_unaligned()
usb: gadget: r8a66597: fix a loop in set_feature()
ocfs2: drop acl cache for directories too
* BACKPORT: loop: Set correct device size when using LOOP_CONFIGURE
drivers/block/loop.c
Bug: 205088357
Change-Id: Ic27556c9cbf426be5c12f72328ba0b18064f48de
Signed-off-by: JohnnLee <johnnlee@google.com>
bad2c16586