Evolution-X-Devices/kernel_google_wahoo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
598,589 Commits 1 Branch 0 Tags
e5a4d1663189b32e1ef2d84bd0d67f852ca2bf6f
Commit Graph

2859 Commits

Author SHA1 Message Date
Jonathan Solnit
f673ae9d44 UPSTREAM: USB: fix out-of-bounds in usb_set_configuration 
commit bd7a3fe770ebd8391d1c7d072ff88e9e76d063eb

Andrey Konovalov reported a possible out-of-bounds problem for a USB interface
association descriptor.  He writes:
	It seems there's no proper size check of a USB_DT_INTERFACE_ASSOCIATION
	descriptor. It's only checked that the size is >= 2 in
	usb_parse_configuration(), so find_iad() might do out-of-bounds access
	to intf_assoc->bInterfaceCount.

And he's right, we don't check for crazy descriptors of this type very well, so
resolve this problem.  Yet another issue found by syzkaller...

Bug: 69052055
Change-Id: I2cc3b5a66d16abd0fc567d69457fc90a45eb12d8
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Jonathan Solnit <jsolnit@google.com>
 2018-01-11 21:35:37 +00:00
Thierry Strudel
75c8bc7183 Merged linux-4.4.80 into android-msm-wahoo-4.4 
Linux 4.4.80
    ASoC: dpcm: Avoid putting stream state to STOP when FE stream is paused
    scsi: snic: Return error code on memory allocation failure
    scsi: fnic: Avoid sending reset to firmware when another reset is in progress
    HID: ignore Petzl USB headlamp
    ALSA: usb-audio: test EP_FLAG_RUNNING at urb completion
    sh_eth: enable RX descriptor word 0 shift on SH7734
    nvmem: imx-ocotp: Fix wrong register size
    arm64: mm: fix show_pte KERN_CONT fallout
    vfio-pci: Handle error from pci_iomap
    video: fbdev: cobalt_lcdfb: Handle return NULL error from devm_ioremap
    perf symbols: Robustify reading of build-id from sysfs
    perf tools: Install tools/lib/traceevent plugins with install-bin
    xfrm: Don't use sk_family for socket policy lookups
    tools lib traceevent: Fix prev/next_prio for deadline tasks
    Btrfs: adjust outstanding_extents counter properly when dio write is split
    usb: gadget: Fix copy/pasted error message
    ACPI / scan: Prefer devices without _HID/_CID for _ADR matching
    ARM: s3c2410_defconfig: Fix invalid values for NF_CT_PROTO_*
    ARM64: zynqmp: Fix i2c node's compatible string
    ARM64: zynqmp: Fix W=1 dtc 1.4 warnings
    dmaengine: ti-dma-crossbar: Add some 'of_node_put()' in error path.
    dmaengine: ioatdma: workaround SKX ioatdma version
    dmaengine: ioatdma: Add Skylake PCI Dev ID
    openrisc: Add _text symbol to fix ksym build error
    irqchip/mxs: Enable SKIP_SET_WAKE and MASK_ON_SUSPEND
    ASoC: nau8825: fix invalid configuration in Pre-Scalar of FLL
    spi: dw: Make debugfs name unique between instances
    ASoC: tlv320aic3x: Mark the RESET register as volatile
    irqchip/keystone: Fix "scheduling while atomic" on rt
    vfio-pci: use 32-bit comparisons for register address for gcc-4.5
    drm/msm: Verify that MSM_SUBMIT_BO_FLAGS are set
    drm/msm: Ensure that the hardware write pointer is valid
    net/mlx4: Remove BUG_ON from ICM allocation routine
    ipv6: Should use consistent conditional judgement for ip6 fragment between __ip6_append_data and ip6_finish_output
    ARM: dts: n900: Mark eMMC slot with no-sdio and no-sd flags
    r8169: add support for RTL8168 series add-on card.
    x86/mce/AMD: Make the init code more robust
    tpm: Replace device number bitmap with IDR
    tpm: fix a kernel memory leak in tpm-sysfs.c
    xen/blkback: don't use xen_blkif_get() in xen-blkback kthread
    xen/blkback: don't free be structure too early
    sched/cputime: Fix prev steal time accouting during CPU hotplug
    net: skb_needs_check() accepts CHECKSUM_NONE for tx
    pstore: Use dynamic spinlock initializer
    pstore: Correctly initialize spinlock and flags
    pstore: Allow prz to control need for locking
    vlan: Propagate MAC address to VLANs
    /proc/iomem: only expose physical resource addresses to privileged users
    Make file credentials available to the seqfile interfaces
    v4l: s5c73m3: fix negation operator
    dentry name snapshots
    ipmi/watchdog: fix watchdog timeout set on reboot
    libnvdimm, btt: fix btt_rw_page not returning errors
    RDMA/uverbs: Fix the check for port number
    PM / Domains: defer dev_pm_domain_set() until genpd->attach_dev succeeds if present
    sched/cgroup: Move sched_online_group() back into css_online() to fix crash
    kaweth: fix oops upon failed memory allocation
    kaweth: fix firmware download
    mpt3sas: Don't overreach ioc->reply_post[] during initialization
    mailbox: handle empty message in tx_tick
    mailbox: skip complete wait event if timer expired
    mailbox: always wait in mbox_send_message for blocking Tx mode
    wil6210: fix deadlock when using fw_no_recovery option
    ath10k: fix null deref on wmi-tlv when trying spectral scan
    isdn/i4l: fix buffer overflow
    isdn: Fix a sleep-in-atomic bug
    net: phy: Do not perform software reset for Generic PHY
    nfc: fdp: fix NULL pointer dereference
    xfs: don't BUG() on mixed direct and mapped I/O
    perf intel-pt: Ensure never to set 'last_ip' when packet 'count' is zero
    perf intel-pt: Use FUP always when scanning for an IP
    perf intel-pt: Fix last_ip usage
    perf intel-pt: Fix ip compression
    drm: rcar-du: Simplify and fix probe error handling
    drm: rcar-du: Perform initialization/cleanup at probe/remove time
    drm/rcar: Nuke preclose hook
    Staging: comedi: comedi_fops: Avoid orphaned proc entry
    Revert "powerpc/numa: Fix percpu allocations to be NUMA aware"
    KVM: PPC: Book3S HV: Save/restore host values of debug registers
    KVM: PPC: Book3S HV: Reload HTM registers explicitly
    KVM: PPC: Book3S HV: Restore critical SPRs to host values on guest exit
    KVM: PPC: Book3S HV: Context-switch EBB registers properly
    drm/nouveau/bar/gf100: fix access to upper half of BAR2
    drm/vmwgfx: Fix gcc-7.1.1 warning
    md/raid5: add thread_group worker async_tx_issue_pending_all
    crypto: authencesn - Fix digest_null crash
    powerpc/pseries: Fix of_node_put() underflow during reconfig remove
    net: reduce skb_warn_bad_offload() noise
    pstore: Make spinlock per zone instead of global
    af_key: Add lock to key dump
Linux 4.4.79
    alarmtimer: don't rate limit one-shot timers
    tracing: Fix kmemleak in instance_rmdir
    spmi: Include OF based modalias in device uevent
    of: device: Export of_device_{get_modalias, uvent_modalias} to modules
    drm/mst: Avoid processing partially received up/down message transactions
    drm/mst: Avoid dereferencing a NULL mstb in drm_dp_mst_handle_up_req()
    drm/mst: Fix error handling during MST sideband message reception
    RDMA/core: Initialize port_num in qp_attr
    ceph: fix race in concurrent readdir
    staging: rtl8188eu: add TL-WN722N v2 support
    Revert "perf/core: Drop kernel samples even though :u is specified"
    perf annotate: Fix broken arrow at row 0 connecting jmp instruction to its target
    target: Fix COMPARE_AND_WRITE caw_sem leak during se_cmd quiesce
    udf: Fix deadlock between writeback and udf_setsize()
    NFS: only invalidate dentrys that are clearly invalid.
    Input: i8042 - fix crash at boot time
    MIPS: Fix a typo: s/preset/present/ in r2-to-r6 emulation error message
    MIPS: Send SIGILL for linked branches in `__compute_return_epc_for_insn'
    MIPS: Rename `sigill_r6' to `sigill_r2r6' in `__compute_return_epc_for_insn'
    MIPS: Send SIGILL for BPOSGE32 in `__compute_return_epc_for_insn'
    MIPS: math-emu: Prevent wrong ISA mode instruction emulation
    MIPS: Fix unaligned PC interpretation in `compute_return_epc'
    MIPS: Actually decode JALX in `__compute_return_epc_for_insn'
    MIPS: Save static registers before sysmips
    MIPS: Fix MIPS I ISA /proc/cpuinfo reporting
    x86/ioapic: Pass the correct data to unmask_ioapic_irq()
    x86/acpi: Prevent out of bound access caused by broken ACPI tables
    MIPS: Negate error syscall return in trace
    MIPS: Fix mips_atomic_set() with EVA
    MIPS: Fix mips_atomic_set() retry condition
    ftrace: Fix uninitialized variable in match_records()
    vfio: New external user group/file match
    vfio: Fix group release deadlock
    f2fs: Don't clear SGID when inheriting ACLs
    ipmi:ssif: Add missing unlock in error branch
    ipmi: use rcu lock around call to intf->handlers->sender()
    drm/radeon: Fix eDP for single-display iMac10,1 (v2)
    drm/radeon/ci: disable mclk switching for high refresh rates (v2)
    drm/amd/amdgpu: Return error if initiating read out of range on vram
    s390/syscalls: Fix out of bounds arguments access
    Raid5 should update rdev->sectors after reshape
    cx88: Fix regression in initial video standard setting
    x86/xen: allow userspace access during hypercalls
    md: don't use flush_signals in userspace processes
    usb: renesas_usbhs: gadget: disable all eps when the driver stops
    usb: renesas_usbhs: fix usbhsc_resume() for !USBHSF_RUNTIME_PWCTRL
    USB: cdc-acm: add device-id for quirky printer
    usb: storage: return on error to avoid a null pointer dereference
    xhci: Fix NULL pointer dereference when cleaning up streams for removed host
    xhci: fix 20000ms port resume timeout
    ipvs: SNAT packet replies only for NATed connections
    PCI/PM: Restore the status of PCI devices across hibernation
    af_key: Fix sadb_x_ipsecrequest parsing
    powerpc/asm: Mark cr0 as clobbered in mftb()
    powerpc: Fix emulation of mfocrf in emulate_step()
    powerpc: Fix emulation of mcrf in emulate_step()
    powerpc/64: Fix atomic64_inc_not_zero() to return an int
    iscsi-target: Add login_keys_workaround attribute for non RFC initiators
    scsi: ses: do not add a device to an enclosure if enclosure_add_links() fails.
    PM / Domains: Fix unsafe iteration over modified list of domain providers
    PM / Domains: Fix unsafe iteration over modified list of device links
    ASoC: compress: Derive substream from stream based on direction
    wlcore: fix 64K page support
    Bluetooth: use constant time memory comparison for secret values
    perf intel-pt: Clear FUP flag on error
    perf intel-pt: Ensure IP is zero when state is INTEL_PT_STATE_NO_IP
    perf intel-pt: Fix missing stack clear
    perf intel-pt: Improve sample timestamp
    perf intel-pt: Move decoder error setting into one condition
    NFC: Add sockaddr length checks before accessing sa_family in bind handlers
    nfc: Fix the sockaddr length sanitization in llcp_sock_connect
    nfc: Ensure presence of required attributes in the activate_target handler
    NFC: nfcmrvl: fix firmware-management initialisation
    NFC: nfcmrvl: use nfc-device for firmware download
    NFC: nfcmrvl: do not use device-managed resources
    NFC: nfcmrvl_uart: add missing tty-device sanity check
    NFC: fix broken device allocation
    ath9k: fix tx99 bus error
    ath9k: fix tx99 use after free
    thermal: cpu_cooling: Avoid accessing potentially freed structures
    s5p-jpeg: don't return a random width/height
    ir-core: fix gcc-7 warning on bool arithmetic
    disable new gcc-7.1.1 warnings for now
Linux 4.4.78
    kvm: vmx: allow host to access guest MSR_IA32_BNDCFGS
    kvm: vmx: Check value written to IA32_BNDCFGS
    kvm: x86: Guest BNDCFGS requires guest MPX support
    kvm: vmx: Do not disable intercepts for BNDCFGS
    KVM: x86: disable MPX if host did not enable MPX XSAVE features
    tracing: Use SOFTIRQ_OFFSET for softirq dectection for more accurate results
    PM / QoS: return -EINVAL for bogus strings
    PM / wakeirq: Convert to SRCU
    sched/topology: Optimize build_group_mask()
    sched/topology: Fix overlapping sched_group_mask
    crypto: caam - fix signals handling
    crypto: sha1-ssse3 - Disable avx2
    crypto: atmel - only treat EBUSY as transient if backlog
    crypto: talitos - Extend max key length for SHA384/512-HMAC and AEAD
    mm: fix overflow check in expand_upwards()
    tpm: Issue a TPM2_Shutdown for TPM2 devices.
    Add "shutdown" to "struct class".
    tpm: Provide strong locking for device removal
    tpm: Get rid of chip->pdev
    selftests/capabilities: Fix the test_execve test
    mnt: Make propagate_umount less slow for overlapping mount propagation trees
    mnt: In propgate_umount handle visiting mounts in any order
    mnt: In umount propagation reparent in a separate pass
    vt: fix unchecked __put_user() in tioclinux ioctls
    exec: Limit arg stack to at most 75% of _STK_LIM
    s390: reduce ELF_ET_DYN_BASE
    powerpc: move ELF_ET_DYN_BASE to 4GB / 4MB
    arm64: move ELF_ET_DYN_BASE to 4GB / 4MB
    arm: move ELF_ET_DYN_BASE to 4MB
    binfmt_elf: use ELF_ET_DYN_BASE only for PIE
    checkpatch: silence perl 5.26.0 unescaped left brace warnings
    fs/dcache.c: fix spin lockup issue on nlru->lock
    mm/list_lru.c: fix list_lru_count_node() to be race free
    kernel/extable.c: mark core_kernel_text notrace
    tools/lib/lockdep: Reduce MAX_LOCK_DEPTH to avoid overflowing lock_chain/: Depth
    parisc/mm: Ensure IRQs are off in switch_mm()
    parisc: DMA API: return error instead of BUG_ON for dma ops on non dma devs
    parisc: use compat_sys_keyctl()
    parisc: Report SIGSEGV instead of SIGBUS when running out of stack
    irqchip/gic-v3: Fix out-of-bound access in gic_set_affinity
    cfg80211: Check if PMKID attribute is of expected size
    cfg80211: Validate frequencies nested in NL80211_ATTR_SCAN_FREQUENCIES
    cfg80211: Define nla_policy for NL80211_ATTR_LOCAL_MESH_POWER_MODE
    brcmfmac: fix possible buffer overflow in brcmf_cfg80211_mgmt_tx()
    rds: tcp: use sock_create_lite() to create the accept socket
    vrf: fix bug_on triggered by rx when destroying a vrf
    net: ipv6: Compare lwstate in detecting duplicate nexthops
    ipv6: dad: don't remove dynamic addresses if link is down
    net: handle NAPI_GRO_FREE_STOLEN_HEAD case also in napi_frags_finish()
    bpf: prevent leaking pointer via xadd on unpriviledged
    net: prevent sign extension in dev_get_stats()
    tcp: reset sk_rx_dst in tcp_disconnect()
    net: dp83640: Avoid NULL pointer dereference.
    ipv6: avoid unregistering inet6_dev for loopback
    net/phy: micrel: configure intterupts after autoneg workaround
    net: sched: Fix one possible panic when no destroy callback
    net_sched: fix error recovery at qdisc creation
Linux 4.4.77
    saa7134: fix warm Medion 7134 EEPROM read
    x86/mm/pat: Don't report PAT on CPUs that don't support it
    ext4: check return value of kstrtoull correctly in reserved_clusters_store
    staging: comedi: fix clean-up of comedi_class in comedi_init()
    staging: vt6556: vnt_start Fix missing call to vnt_key_init_table.
    tcp: fix tcp_mark_head_lost to check skb len before fragmenting
    md: fix super_offset endianness in super_1_rdev_size_change
    md: fix incorrect use of lexx_to_cpu in does_sb_need_changing
    perf tools: Use readdir() instead of deprecated readdir_r() again
    perf tests: Remove wrong semicolon in while loop in CQM test
    perf trace: Do not process PERF_RECORD_LOST twice
    perf dwarf: Guard !x86_64 definitions under #ifdef else clause
    perf pmu: Fix misleadingly indented assignment (whitespace)
    perf annotate browser: Fix behaviour of Shift-Tab with nothing focussed
    perf tools: Remove duplicate const qualifier
    perf script: Use readdir() instead of deprecated readdir_r()
    perf thread_map: Use readdir() instead of deprecated readdir_r()
    perf tools: Use readdir() instead of deprecated readdir_r()
    perf bench numa: Avoid possible truncation when using snprintf()
    perf tests: Avoid possible truncation with dirent->d_name + snprintf
    perf scripting perl: Fix compile error with some perl5 versions
    perf thread_map: Correctly size buffer used with dirent->dt_name
    perf intel-pt: Use __fallthrough
    perf top: Use __fallthrough
    tools strfilter: Use __fallthrough
    tools string: Use __fallthrough in perf_atoll()
    tools include: Add a __fallthrough statement
    mqueue: fix a use-after-free in sys_mq_notify()
    RDMA/uverbs: Check port number supplied by user verbs cmds
    KEYS: Fix an error code in request_master_key()
    ath10k: override CE5 config for QCA9377
    x86/uaccess: Optimize copy_user_enhanced_fast_string() for short strings
    x86/tools: Fix gcc-7 warning in relocs.c
    gfs2: Fix glock rhashtable rcu bug
    USB: serial: qcserial: new Sierra Wireless EM7305 device ID
    USB: serial: option: add two Longcheer device ids
    pinctrl: sh-pfc: Update info pointer after SoC-specific init
    pinctrl: mxs: atomically switch mux and drive strength config
    pinctrl: sunxi: Fix SPDIF function name for A83T
    pinctrl: meson: meson8b: fix the NAND DQS pins
    pinctrl: sh-pfc: r8a7791: Fix SCIF2 pinmux data
    sysctl: report EINVAL if value is larger than UINT_MAX for proc_douintvec
    sysctl: don't print negative flag for proc_douintvec
    mac80211_hwsim: Replace bogus hrtimer clockid
    usb: Fix typo in the definition of Endpoint[out]Request
    usb: usbip: set buffer pointers to NULL after free
    Add USB quirk for HVR-950q to avoid intermittent device resets
    USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick
    usb: dwc3: replace %p with %pK
    drm/virtio: don't leak bo on drm_gem_object_init failure
    tracing/kprobes: Allow to create probe with a module name starting with a digit
    mm: fix classzone_idx underflow in shrink_zones()
    bgmac: reset & enable Ethernet core before using it
    driver core: platform: fix race condition with driver_override
    fs: completely ignore unknown open flags
    fs: add a VALID_OPEN_FLAGS
Linux 4.4.76
    KVM: nVMX: Fix exception injection
    KVM: x86: zero base3 of unusable segments
    KVM: x86/vPMU: fix undefined shift in intel_pmu_refresh()
    KVM: x86: fix emulation of RSM and IRET instructions
    cpufreq: s3c2416: double free on driver init error path
    iommu/amd: Fix incorrect error handling in amd_iommu_bind_pasid()
    iommu: Handle default domain attach failure
    iommu/vt-d: Don't over-free page table directories
    ocfs2: o2hb: revert hb threshold to keep compatible
    x86/mm: Fix flush_tlb_page() on Xen
    x86/mpx: Correctly report do_mpx_bt_fault() failures to user-space
    ARM: 8685/1: ensure memblock-limit is pmd-aligned
    ARM64/ACPI: Fix BAD_MADT_GICC_ENTRY() macro implementation
    sched/loadavg: Avoid loadavg spikes caused by delayed NO_HZ accounting
    watchdog: bcm281xx: Fix use of uninitialized spinlock.
    xfrm: Oops on error in pfkey_msg2xfrm_state()
    xfrm: NULL dereference on allocation failure
    xfrm: fix stack access out of bounds with CONFIG_XFRM_SUB_POLICY
    jump label: fix passing kbuild_cflags when checking for asm goto support
    ravb: Fix use-after-free on `ifconfig eth0 down`
    sctp: check af before verify address in sctp_addr_id2transport
    net/mlx4_core: Eliminate warning messages for SRQ_LIMIT under SRIOV
    perf probe: Fix to show correct locations for events on modules
    be2net: fix status check in be_cmd_pmac_add()
    s390/ctl_reg: make __ctl_load a full memory barrier
    swiotlb: ensure that page-sized mappings are page-aligned
    coredump: Ensure proper size of sparse core files
    x86/mpx: Use compatible types in comparison to fix sparse error
    mac80211: initialize SMPS field in HT capabilities
    spi: davinci: use dma_mapping_error()
    scsi: lpfc: avoid double free of resource identifiers
    HID: i2c-hid: Add sleep between POWER ON and RESET
    kernel/panic.c: add missing \n
    ibmveth: Add a proper check for the availability of the checksum features
    vxlan: do not age static remote mac entries
    virtio_net: fix PAGE_SIZE > 64k
    vfio/spapr: fail tce_iommu_attach_group() when iommu_data is null
    drm/amdgpu: check ring being ready before using
    net: dsa: Check return value of phy_connect_direct()
    amd-xgbe: Check xgbe_init() return code
    platform/x86: ideapad-laptop: handle ACPI event 1
    scsi: virtio_scsi: Reject commands when virtqueue is broken
    xen-netfront: Fix Rx stall during network stress and OOM
    swiotlb-xen: update dev_addr after swapping pages
    virtio_console: fix a crash in config_work_handler
    Btrfs: fix truncate down when no_holes feature is enabled
    gianfar: Do not reuse pages from emergency reserve
    powerpc/eeh: Enable IO path on permanent error
    net: bgmac: Remove superflous netif_carrier_on()
    net: bgmac: Start transmit queue in bgmac_open
    net: bgmac: Fix SOF bit checking
    bgmac: Fix reversed test of build_skb() return value.
    mtd: bcm47xxpart: don't fail because of bit-flips
    bgmac: fix a missing check for build_skb
    mtd: bcm47xxpart: limit scanned flash area on BCM47XX (MIPS) only
    MIPS: ralink: fix MT7628 wled_an pinmux gpio
    MIPS: ralink: fix MT7628 pinmux typos
    MIPS: ralink: Fix invalid assignment of SoC type
    MIPS: ralink: fix USB frequency scaling
    MIPS: ralink: MT7688 pinmux fixes
    net: korina: Fix NAPI versus resources freeing
    MIPS: ath79: fix regression in PCI window initialization
    net: mvneta: Fix for_each_present_cpu usage
    ARM: dts: BCM5301X: Correct GIC_PPI interrupt flags
    qla2xxx: Fix erroneous invalid handle message
    scsi: lpfc: Set elsiocb contexts to NULL after freeing it
    scsi: sd: Fix wrong DPOFUA disable in sd_read_cache_type
    KVM: x86: fix fixing of hypercalls
    mm: numa: avoid waiting on freed migrated pages
    block: fix module reference leak on put_disk() call for cgroups throttle
    sysctl: enable strict writes
    usb: gadget: f_fs: Fix possibe deadlock
    drm/vmwgfx: Free hash table allocated by cmdbuf managed res mgr
    ALSA: hda - set input_path bitmap to zero after moving it to new place
    ALSA: hda - Fix endless loop of codec configure
    MIPS: Fix IRQ tracing & lockdep when rescheduling
    MIPS: pm-cps: Drop manual cache-line alignment of ready_count
    MIPS: Avoid accidental raw backtrace
    mm, swap_cgroup: reschedule when neeed in swap_cgroup_swapoff()
    drm/ast: Handle configuration without P2A bridge
    NFSv4: fix a reference leak caused WARNING messages
    netfilter: synproxy: fix conntrackd interaction
    netfilter: xt_TCPMSS: add more sanity tests on tcph->doff
    rtnetlink: add IFLA_GROUP to ifla_policy
    ipv6: Do not leak throw route references
    sfc: provide dummy definitions of vswitch functions
    net: 8021q: Fix one possible panic caused by BUG_ON in free_netdev
    decnet: always not take dst->__refcnt when inserting dst into hash table
    net/mlx5: Wait for FW readiness before initializing command interface
    ipv6: fix calling in6_ifa_hold incorrectly for dad work
    igmp: add a missing spin_lock_init()
    igmp: acquire pmc lock for ip_mc_clear_src()
    net: caif: Fix a sleep-in-atomic bug in cfpkt_create_pfx
    Fix an intermittent pr_emerg warning about lo becoming free.
    af_unix: Add sockaddr length checks before accessing sa_family in bind and connect handlers
    net: Zero ifla_vf_info in rtnl_fill_vfinfo()
    decnet: dn_rtmsg: Improve input length sanitization in dnrmg_receive_user_skb
    net: don't call strlen on non-terminated string in dev_set_alias()
    ipv6: release dst on error in ip6_dst_lookup_tail
Linux 4.4.75
    nvme: apply DELAY_BEFORE_CHK_RDY quirk at probe time too
    nvme/quirk: Add a delay before checking for adapter readiness
    net: phy: fix marvell phy status reading
    net: phy: Initialize mdio clock at probe function
    usb: gadget: f_fs: avoid out of bounds access on comp_desc
    powerpc/slb: Force a full SLB flush when we insert for a bad EA
    mtd: spi-nor: fix spansion quad enable
    of: Add check to of_scan_flat_dt() before accessing initial_boot_params
    rxrpc: Fix several cases where a padded len isn't checked in ticket decode
    USB: usbip: fix nonconforming hub descriptor
    drm/amdgpu: adjust default display clock
    drm/amdgpu/atom: fix ps allocation size for EnableDispPowerGating
    drm/radeon: add a quirk for Toshiba Satellite L20-183
    drm/radeon: add a PX quirk for another K53TK variant
    iscsi-target: Reject immediate data underflow larger than SCSI transfer length
    target: Fix kref->refcount underflow in transport_cmd_finish_abort
    time: Fix clock->read(clock) race around clocksource changes
    Input: i8042 - add Fujitsu Lifebook AH544 to notimeout list
    powerpc/kprobes: Pause function_graph tracing during jprobes handling
    signal: Only reschedule timers on signals timers have sent
    HID: Add quirk for Dell PIXART OEM mouse
    CIFS: Improve readdir verbosity
    KVM: PPC: Book3S HV: Preserve userspace HTM state properly
    lib/cmdline.c: fix get_options() overflow while parsing ranges
    autofs: sanity check status reported with AUTOFS_DEV_IOCTL_FAIL
    fs/exec.c: account for argv/envp pointers
Linux 4.4.74
    mm: fix new crash in unmapped_area_topdown()
    Allow stack to grow up to address space limit
    mm: larger stack guard gap, between vmas
    alarmtimer: Rate limit periodic intervals
    MIPS: Fix bnezc/jialc return address calculation
    usb: dwc3: exynos fix axius clock error path to do cleanup
    alarmtimer: Prevent overflow of relative timers
    genirq: Release resources in __setup_irq() error path
    swap: cond_resched in swap_cgroup_prepare()
    mm/memory-failure.c: use compound_head() flags for huge pages
    USB: gadgetfs, dummy-hcd, net2280: fix locking for callbacks
    usb: xhci: ASMedia ASM1042A chipset need shorts TX quirk
    drivers/misc/c2port/c2port-duramar2150.c: checking for NULL instead of IS_ERR()
    usb: r8a66597-hcd: decrease timeout
    usb: r8a66597-hcd: select a different endpoint on timeout
    USB: gadget: dummy_hcd: fix hub-descriptor removable fields
    pvrusb2: reduce stack usage pvr2_eeprom_analyze()
    usb: core: fix potential memory leak in error path during hcd creation
    USB: hub: fix SS max number of ports
    iio: proximity: as3935: recalibrate RCO after resume
    staging: rtl8188eu: prevent an underflow in rtw_check_beacon_data()
    mfd: omap-usb-tll: Fix inverted bit use for USB TLL mode
    x86/mm/32: Set the '__vmalloc_start_set' flag in initmem_init()
    serial: efm32: Fix parity management in 'efm32_uart_console_get_options()'
    mac80211: fix IBSS presp allocation size
    mac80211: fix CSA in IBSS mode
    mac80211/wpa: use constant time memory comparison for MACs
    mac80211: don't look at the PM bit of BAR frames
    vb2: Fix an off by one error in 'vb2_plane_vaddr'
    cpufreq: conservative: Allow down_threshold to take values from 1 to 10
    can: gs_usb: fix memory leak in gs_cmd_reset()
    configfs: Fix race between create_link and configfs_rmdir
Linux 4.4.73
    sparc64: make string buffers large enough
    s390/kvm: do not rely on the ILC on kvm host protection fauls
    xtensa: don't use linux IRQ #0
    tipc: ignore requests when the connection state is not CONNECTED
    proc: add a schedule point in proc_pid_readdir()
    romfs: use different way to generate fsid for BLOCK or MTD
    sctp: sctp_addr_id2transport should verify the addr before looking up assoc
    r8152: avoid start_xmit to schedule napi when napi is disabled
    r8152: fix rtl8152_post_reset function
    r8152: re-schedule napi for tx
    nfs: Fix "Don't increment lock sequence ID after NFS4ERR_MOVED"
    ravb: unmap descriptors when freeing rings
    drm/ast: Fixed system hanged if disable P2A
    drm/nouveau: Don't enabling polling twice on runtime resume
    parisc, parport_gsc: Fixes for printk continuation lines
    net: adaptec: starfire: add checks for dma mapping errors
    pinctrl: berlin-bg4ct: fix the value for "sd1a" of pin SCRD0_CRD_PRES
    gianfar: synchronize DMA API usage by free_skb_rx_queue w/ gfar_new_page
    net/mlx4_core: Avoid command timeouts during VF driver device shutdown
    drm/nouveau/fence/g84-: protect against concurrent access to semaphore buffers
    drm/nouveau: prevent userspace from deleting client object
    ipv6: fix flow labels when the traffic class is non-0
    FS-Cache: Initialise stores_lock in netfs cookie
    fscache: Clear outstanding writes when disabling a cookie
    fscache: Fix dead object requeue
    ethtool: do not vzalloc(0) on registers dump
    log2: make order_base_2() behave correctly on const input value zero
    kasan: respect /proc/sys/kernel/traceoff_on_warning
    jump label: pass kbuild_cflags when checking for asm goto support
    PM / runtime: Avoid false-positive warnings from might_sleep_if()
    ipv6: Fix IPv6 packet loss in scenarios involving roaming + snooping switches
    i2c: piix4: Fix request_region size
    sierra_net: Add support for IPv6 and Dual-Stack Link Sense Indications
    sierra_net: Skip validating irrelevant fields for IDLE LSIs
    net: hns: Fix the device being used for dma mapping during TX
    NET: mkiss: Fix panic
    NET: Fix /proc/net/arp for AX.25
    ipv6: Inhibit IPv4-mapped src address on the wire.
    ipv6: Handle IPv4-mapped src to in6addr_any dst.
    net: xilinx_emaclite: fix receive buffer overflow
    net: xilinx_emaclite: fix freezes due to unordered I/O
    Call echo service immediately after socket reconnect
    staging: rtl8192e: rtl92e_fill_tx_desc fix write to mapped out memory.
    ARM: dts: imx6dl: Fix the VDD_ARM_CAP voltage for 396MHz operation
    partitions/msdos: FreeBSD UFS2 file systems are not recognized
    s390/vmem: fix identity mapping
Linux 4.4.72
    arm64: ensure extension of smp_store_release value
    arm64: armv8_deprecated: ensure extension of addr
    usercopy: Adjust tests to deal with SMAP/PAN
    RDMA/qib,hfi1: Fix MR reference count leak on write with immediate
    arm64: entry: improve data abort handling of tagged pointers
    arm64: hw_breakpoint: fix watchpoint matching for tagged pointers
    Make __xfs_xattr_put_listen preperly report errors.
    NFSv4: Don't perform cached access checks before we've OPENed the file
    NFS: Ensure we revalidate attributes before using execute_ok()
    mm: consider memblock reservations for deferred memory initialization sizing
    net: better skb->sender_cpu and skb->napi_id cohabitation
    serial: sh-sci: Fix panic when serial console and DMA are enabled
    tty: Drop krefs for interrupted tty lock
    drivers: char: mem: Fix wraparound check to allow mappings up to the end
    ASoC: Fix use-after-free at card unregistration
    ALSA: timer: Fix missing queue indices reset at SNDRV_TIMER_IOCTL_SELECT
    ALSA: timer: Fix race between read and ioctl
    drm/nouveau/tmr: fully separate alarm execution/pending lists
    drm/vmwgfx: Make sure backup_handle is always valid
    drm/vmwgfx: limit the number of mip levels in vmw_gb_surface_define_ioctl()
    drm/vmwgfx: Handle vmalloc() failure in vmw_local_fifo_reserve()
    perf/core: Drop kernel samples even though :u is specified
    powerpc/hotplug-mem: Fix missing endian conversion of aa_index
    powerpc/numa: Fix percpu allocations to be NUMA aware
    powerpc/eeh: Avoid use after free in eeh_handle_special_event()
    scsi: qla2xxx: don't disable a not previously enabled PCI device
    KVM: arm/arm64: Handle possible NULL stage2 pud when ageing pages
    btrfs: fix memory leak in update_space_info failure path
    btrfs: use correct types for page indices in btrfs_page_exists_in_range
    cxl: Fix error path on bad ioctl
    ufs_getfrag_block(): we only grab ->truncate_mutex on block creation path
    ufs_extend_tail(): fix the braino in calling conventions of ufs_new_fragments()
    ufs: set correct ->s_maxsize
    ufs: restore maintaining ->i_blocks
    fix ufs_isblockset()
    ufs: restore proper tail allocation
    fs: add i_blocksize()
    cpuset: consider dying css as offline
    Input: elantech - add Fujitsu Lifebook E546/E557 to force crc_enabled
    drm/msm: Expose our reservation object when exporting a dmabuf.
    target: Re-add check to reject control WRITEs with overflow data
    cpufreq: cpufreq_register_driver() should return -ENODEV if init fails
    stackprotector: Increase the per-task stack canary's random range from 32 bits to 64 bits on 64-bit platforms
    random: properly align get_random_int_hash
    drivers: char: random: add get_random_long()
    iio: proximity: as3935: fix AS3935_INT mask
    iio: light: ltr501 Fix interchanged als/ps register field
    staging/lustre/lov: remove set_fs() call from lov_getstripe()
    usb: chipidea: debug: check before accessing ci_role
    usb: chipidea: udc: fix NULL pointer dereference if udc_start failed
    usb: gadget: f_mass_storage: Serialize wake and sleep execution
    ext4: fix fdatasync(2) after extent manipulation operations
    ext4: keep existing extra fields when inode expands
    ext4: fix SEEK_HOLE
    xen-netfront: cast grant table reference first to type int
    xen-netfront: do not cast grant table reference to signed short
    xen/privcmd: Support correctly 64KB page granularity when mapping memory
    dmaengine: ep93xx: Always start from BASE0
    dmaengine: usb-dmac: Fix DMAOR AE bit definition
    KVM: async_pf: avoid async pf injection when in guest mode
    arm: KVM: Allow unaligned accesses at HYP
    KVM: cpuid: Fix read/write out-of-bounds vulnerability in cpuid emulation
    kvm: async_pf: fix rcu_irq_enter() with irqs enabled
    nfsd: Fix up the "supattr_exclcreat" attributes
    nfsd4: fix null dereference on replay
    drm/amdgpu/ci: disable mclk switching for high refresh rates (v2)
    crypto: gcm - wait for crypto op not signal safe
    KEYS: fix freeing uninitialized memory in key_update()
    KEYS: fix dereferencing NULL payload with nonzero length
    ptrace: Properly initialize ptracer_cred on fork
    serial: ifx6x60: fix use-after-free on module unload
    arch/sparc: support NR_CPUS = 4096
    sparc64: delete old wrap code
    sparc64: new context wrap
    sparc64: add per-cpu mm of secondary contexts
    sparc64: redefine first version
    sparc64: combine activate_mm and switch_mm
    sparc64: reset mm cpumask after wrap
    sparc: Machine description indices can vary
    sparc64: mm: fix copy_tsb to correctly copy huge page TSBs
    net: bridge: start hello timer only if device is up
    net: ethoc: enable NAPI before poll may be scheduled
    net: ping: do not abuse udp_poll()
    ipv6: Fix leak in ipv6_gso_segment().
    vxlan: fix use-after-free on deletion
    tcp: disallow cwnd undo when switching congestion control
    cxgb4: avoid enabling napi twice to the same queue
    ipv6: xfrm: Handle errors reported by xfrm6_find_1stfragopt()
    bnx2x: Fix Multi-Cos
Linux 4.4.71
    xfs: only return -errno or success from attr ->put_listent
    xfs: in _attrlist_by_handle, copy the cursor back to userspace
    xfs: fix unaligned access in xfs_btree_visit_blocks
    xfs: bad assertion for delalloc an extent that start at i_size
    xfs: fix indlen accounting error on partial delalloc conversion
    xfs: wait on new inodes during quotaoff dquot release
    xfs: update ag iterator to support wait on new inodes
    xfs: support ability to wait on new inodes
    xfs: fix up quotacheck buffer list error handling
    xfs: prevent multi-fsb dir readahead from reading random blocks
    xfs: handle array index overrun in xfs_dir2_leaf_readbuf()
    xfs: fix over-copying of getbmap parameters from userspace
    xfs: fix off-by-one on max nr_pages in xfs_find_get_desired_pgoff()
    xfs: Fix missed holes in SEEK_HOLE implementation
    mlock: fix mlock count can not decrease in race condition
    mm/migrate: fix refcount handling when !hugepage_migration_supported()
    drm/gma500/psb: Actually use VBT mode when it is found
    slub/memcg: cure the brainless abuse of sysfs attributes
    ALSA: hda - apply STAC_9200_DELL_M22 quirk for Dell Latitude D430
    pcmcia: remove left-over %Z format
    drm/radeon: Unbreak HPD handling for r600+
    drm/radeon/ci: disable mclk switching for high refresh rates (v2)
    scsi: mpt3sas: Force request partial completion alignment
    HID: wacom: Have wacom_tpc_irq guard against possible NULL dereference
    mmc: sdhci-iproc: suppress spurious interrupt with Multiblock read
    i2c: i2c-tiny-usb: fix buffer not being DMA capable
    vlan: Fix tcp checksum offloads in Q-in-Q vlans
    net: phy: marvell: Limit errata to 88m1101
    netem: fix skb_orphan_partial()
    ipv4: add reference counting to metrics
    sctp: fix ICMP processing if skb is non-linear
    tcp: avoid fastopen API to be used on AF_UNSPEC
    virtio-net: enable TSO/checksum offloads for Q-in-Q vlans
    be2net: Fix offload features for Q-in-Q packets
    ipv6: fix out of bound writes in __ip6_append_data()
    bridge: start hello_timer when enabling KERNEL_STP in br_stp_start
    qmi_wwan: add another Lenovo EM74xx device ID
    bridge: netlink: check vlan_default_pvid range
    ipv6: Check ip6_find_1stfragopt() return value properly.
    ipv6: Prevent overrun when parsing v6 header options
    net: Improve handling of failures on link and route dumps
    tcp: eliminate negative reordering in tcp_clean_rtx_queue
    sctp: do not inherit ipv6_{mc|ac|fl}_list from parent
    sctp: fix src address selection if using secondary addresses for ipv6
    tcp: avoid fragmenting peculiar skbs in SACK
    s390/qeth: avoid null pointer dereference on OSN
    s390/qeth: unbreak OSM and OSN support
    s390/qeth: handle sysfs error during initialization
    ipv6/dccp: do not inherit ipv6_mc_list from parent
    dccp/tcp: do not inherit mc_list from parent
    sparc: Fix -Wstringop-overflow warning

Bug: 62730977
Change-Id: Ifca755d82f9e4b11016f6660298c2c1b073bfb3a
Signed-off-by: Thierry Strudel <tstrudel@google.com>
 2017-09-20 16:42:37 -07:00
Thierry Strudel
b11ab24fe6 Merged linux-4.4.70 into android-msm-wahoo-4.4 
Linux 4.4.70
    drivers: char: mem: Check for address space wraparound with mmap()
    nfsd: encoders mustn't use unitialized values in error cases
    drm/edid: Add 10 bpc quirk for LGD 764 panel in HP zBook 17 G2
    PCI: Freeze PME scan before suspending devices
    PCI: Fix pci_mmap_fits() for HAVE_PCI_RESOURCE_TO_USER platforms
    tracing/kprobes: Enforce kprobes teardown after testing
    osf_wait4(): fix infoleak
    genirq: Fix chained interrupt data ordering
    uwb: fix device quirk on big-endian hosts
    metag/uaccess: Check access_ok in strncpy_from_user
    metag/uaccess: Fix access_ok()
    iommu/vt-d: Flush the IOTLB to get rid of the initial kdump mappings
    staging: rtl8192e: rtl92e_get_eeprom_size Fix read size of EPROM_CMD.
    staging: rtl8192e: fix 2 byte alignment of register BSSIDR.
    mm/huge_memory.c: respect FOLL_FORCE/FOLL_COW for thp
    xc2028: Fix use-after-free bug properly
    arm64: documentation: document tagged pointer stack constraints
    arm64: uaccess: ensure extension of access_ok() addr
    arm64: xchg: hazard against entire exchange variable
    ARM: dts: at91: sama5d3_xplained: not all ADC channels are available
    ARM: dts: at91: sama5d3_xplained: fix ADC vref
    powerpc/64e: Fix hang when debugging programs with relocated kernel
    powerpc/pseries: Fix of_node_put() underflow during DLPAR remove
    powerpc/book3s/mce: Move add_taint() later in virtual mode
    cx231xx-cards: fix NULL-deref at probe
    cx231xx-audio: fix NULL-deref at probe
    cx231xx-audio: fix init error path
    dvb-frontends/cxd2841er: define symbol_rate_min/max in T/C fe-ops
    zr364xx: enforce minimum size when reading header
    dib0700: fix NULL-deref at probe
    s5p-mfc: Fix unbalanced call to clock management
    gspca: konica: add missing endpoint sanity check
    ceph: fix recursion between ceph_set_acl() and __ceph_setattr()
    iio: proximity: as3935: fix as3935_write
    ipx: call ipxitf_put() in ioctl error path
    USB: hub: fix non-SS hub-descriptor handling
    USB: hub: fix SS hub-descriptor handling
    USB: serial: io_ti: fix div-by-zero in set_termios
    USB: serial: mct_u232: fix big-endian baud-rate handling
    USB: serial: qcserial: add more Lenovo EM74xx device IDs
    usb: serial: option: add Telit ME910 support
    USB: iowarrior: fix info ioctl on big-endian hosts
    usb: musb: tusb6010_omap: Do not reset the other direction's packet size
    ttusb2: limit messages to buffer size
    mceusb: fix NULL-deref at probe
    usbvision: fix NULL-deref at probe
    net: irda: irda-usb: fix firmware name on big-endian hosts
    usb: host: xhci-mem: allocate zeroed Scratchpad Buffer
    xhci: apply PME_STUCK_QUIRK and MISSING_CAS quirk for Denverton
    usb: host: xhci-plat: propagate return value of platform_get_irq()
    sched/fair: Initialize throttle_count for new task-groups lazily
    sched/fair: Do not announce throttled next buddy in dequeue_task_fair()
    fscrypt: avoid collisions when presenting long encrypted filenames
    f2fs: check entire encrypted bigname when finding a dentry
    fscrypt: fix context consistency check when key(s) unavailable
    net: qmi_wwan: Add SIMCom 7230E
    ext4 crypto: fix some error handling
    ext4 crypto: don't let data integrity writebacks fail with ENOMEM
    USB: serial: ftdi_sio: add Olimex ARM-USB-TINY(H) PIDs
    USB: serial: ftdi_sio: fix setting latency for unprivileged users
    pid_ns: Fix race between setns'ed fork() and zap_pid_ns_processes()
    pid_ns: Sleep in TASK_INTERRUPTIBLE in zap_pid_ns_processes
    iio: dac: ad7303: fix channel description
    of: fix sparse warning in of_pci_range_parser_one
    proc: Fix unbalanced hard link numbers
    cdc-acm: fix possible invalid access when processing notification
    drm/nouveau/tmr: handle races with hw when updating the next alarm time
    drm/nouveau/tmr: avoid processing completed alarms when adding a new one
    drm/nouveau/tmr: fix corruption of the pending list when rescheduling an alarm
    drm/nouveau/tmr: ack interrupt before processing alarms
    drm/nouveau/therm: remove ineffective workarounds for alarm bugs
    drm/amdgpu: Make display watermark calculations more accurate
    drm/amdgpu: Avoid overflows/divide-by-zero in latency_watermark calculations.
    ath9k_htc: fix NULL-deref at probe
    ath9k_htc: Add support of AirTies 1eda:2315 AR9271 device
    s390/cputime: fix incorrect system time
    s390/kdump: Add final note
    regulator: tps65023: Fix inverted core enable logic.
    KVM: X86: Fix read out-of-bounds vulnerability in kvm pio emulation
    KVM: x86: Fix load damaged SSEx MXCSR register
    ima: accept previously set IMA_NEW_FILE
    mwifiex: pcie: fix cmd_buf use-after-free in remove/reset
    rtlwifi: rtl8821ae: setup 8812ae RFE according to device type
    md: update slab_cache before releasing new stripes when stripes resizing
    dm space map disk: fix some book keeping in the disk space map
    dm thin metadata: call precommit before saving the roots
    dm bufio: make the parameter "retain_bytes" unsigned long
    dm cache metadata: fail operations if fail_io mode has been established
    dm bufio: check new buffer allocation watermark every 30 seconds
    dm bufio: avoid a possible ABBA deadlock
    dm raid: select the Kconfig option CONFIG_MD_RAID0
    dm btree: fix for dm_btree_find_lowest_key()
    infiniband: call ipv6 route lookup via the stub interface
    tpm_crb: check for bad response size
    ARM: tegra: paz00: Mark panel regulator as enabled on boot
    USB: core: replace %p with %pK
    char: lp: fix possible integer overflow in lp_setup()
    watchdog: pcwd_usb: fix NULL-deref at probe
    USB: ene_usb6250: fix DMA to the stack
    usb: misc: legousbtower: Fix memory leak
    usb: misc: legousbtower: Fix buffers on stack
Linux 4.4.69
    ipmi: Fix kernel panic at ipmi_ssif_thread()
    wlcore: Add RX_BA_WIN_SIZE_CHANGE_EVENT event
    wlcore: Pass win_size taken from ieee80211_sta to FW
    mac80211: RX BA support for sta max_rx_aggregation_subframes
    mac80211: pass block ack session timeout to to driver
    mac80211: pass RX aggregation window size to driver
    Bluetooth: hci_intel: add missing tty-device sanity check
    Bluetooth: hci_bcm: add missing tty-device sanity check
    Bluetooth: Fix user channel for 32bit userspace on 64bit kernel
    tty: pty: Fix ldisc flush after userspace become aware of the data already
    serial: omap: suspend device on probe errors
    serial: omap: fix runtime-pm handling on unbind
    serial: samsung: Use right device for DMA-mapping calls
    arm64: KVM: Fix decoding of Rt/Rt2 when trapping AArch32 CP accesses
    padata: free correct variable
    CIFS: add misssing SFM mapping for doublequote
    cifs: fix CIFS_IOC_GET_MNT_INFO oops
    CIFS: fix mapping of SFM_SPACE and SFM_PERIOD
    SMB3: Work around mount failure when using SMB3 dialect to Macs
    Set unicode flag on cifs echo request to avoid Mac error
    fs/block_dev: always invalidate cleancache in invalidate_bdev()
    ceph: fix memory leak in __ceph_setxattr()
    fs/xattr.c: zero out memory copied to userspace in getxattr
    ext4: evict inline data when writing to memory map
    IB/mlx4: Reduce SRIOV multicast cleanup warning message to debug level
    IB/mlx4: Fix ib device initialization error flow
    IB/IPoIB: ibX: failed to create mcg debug file
    IB/core: Fix sysfs registration error flow
    vfio/type1: Remove locked page accounting workqueue
    dm era: save spacemap metadata root after the pre-commit
    crypto: algif_aead - Require setkey before accept(2)
    block: fix blk_integrity_register to use template's interval_exp if not 0
    KVM: arm/arm64: fix races in kvm_psci_vcpu_on
    KVM: x86: fix user triggerable warning in kvm_apic_accept_events()
    um: Fix PTRACE_POKEUSER on x86_64
    x86, pmem: Fix cache flushing for iovec write < 8 bytes
    selftests/x86/ldt_gdt_32: Work around a glibc sigaction() bug
    x86/boot: Fix BSS corruption/overwrite bug in early x86 kernel startup
    usb: hub: Do not attempt to autosuspend disconnected devices
    usb: hub: Fix error loop seen after hub communication errors
    usb: Make sure usb/phy/of gets built-in
    usb: misc: add missing continue in switch
    staging: comedi: jr3_pci: cope with jiffies wraparound
    staging: comedi: jr3_pci: fix possible null pointer dereference
    staging: gdm724x: gdm_mux: fix use-after-free on module unload
    staging: vt6656: use off stack for out buffer USB transfers.
    staging: vt6656: use off stack for in buffer USB transfers.
    USB: Proper handling of Race Condition when two USB class drivers try to call init_usb_class simultaneously
    USB: serial: ftdi_sio: add device ID for Microsemi/Arrow SF2PLUS Dev Kit
    usb: host: xhci: print correct command ring address
    iscsi-target: Set session_fall_back_to_erl0 when forcing reinstatement
    target: Convert ACL change queue_depth se_session reference usage
    target/fileio: Fix zero-length READ and WRITE handling
    target: Fix compare_and_write_callback handling for non GOOD status
    xen: adjust early dom0 p2m handling to xen hypervisor behavior
Linux 4.4.68
    block: get rid of blk_integrity_revalidate()
    drm/ttm: fix use-after-free races in vm fault handling
    f2fs: sanity check segment count
    bnxt_en: allocate enough space for ->ntp_fltr_bmap
    ipv6: reorder ip6_route_dev_notifier after ipv6_dev_notf
    ipv6: initialize route null entry in addrconf_init()
    rtnetlink: NUL-terminate IFLA_PHYS_PORT_NAME string
    ipv4, ipv6: ensure raw socket message is big enough to hold an IP header
    tcp: do not inherit fastopen_req from parent
    tcp: fix wraparound issue in tcp_lp
    bpf, arm64: fix jit branch offset related to ldimm64
    tcp: do not underestimate skb->truesize in tcp_trim_head()
    ALSA: hda - Fix deadlock of controller device lock at unbinding
    staging: emxx_udc: remove incorrect __init annotations
    staging: wlan-ng: add missing byte order conversion
    brcmfmac: Make skb header writable before use
    brcmfmac: Ensure pointer correctly set if skb data location changes
    MIPS: R2-on-R6 MULTU/MADDU/MSUBU emulation bugfix
    scsi: mac_scsi: Fix MAC_SCSI=m option when SCSI=m
    serial: 8250_omap: Fix probe and remove for PM runtime
    phy: qcom-usb-hs: Add depends on EXTCON
    USB: serial: io_edgeport: fix descriptor error handling
    USB: serial: mct_u232: fix modem-status error handling
    USB: serial: quatech2: fix control-message error handling
    USB: serial: ftdi_sio: fix latency-timer error handling
    USB: serial: ark3116: fix open error handling
    USB: serial: ti_usb_3410_5052: fix control-message error handling
    USB: serial: io_edgeport: fix epic-descriptor handling
    USB: serial: ssu100: fix control-message error handling
    USB: serial: digi_acceleport: fix incomplete rx sanity check
    USB: serial: keyspan_pda: fix receive sanity checks
    usb: chipidea: Handle extcon events properly
    usb: chipidea: Only read/write OTGSC from one place
    usb: host: ohci-exynos: Decrese node refcount on exynos_ehci_get_phy() error paths
    usb: host: ehci-exynos: Decrese node refcount on exynos_ehci_get_phy() error paths
    KVM: nVMX: do not leak PML full vmexit to L1
    KVM: nVMX: initialize PML fields in vmcs02
    Revert "KVM: nested VMX: disable perf cpuid reporting"
    x86/platform/intel-mid: Correct MSI IRQ line for watchdog device
    kprobes/x86: Fix kernel panic when certain exception-handling addresses are probed
    clk: Make x86/ conditional on CONFIG_COMMON_CLK
    x86/pci-calgary: Fix iommu_free() comparison of unsigned expression >= 0
    x86/ioapic: Restore IO-APIC irq_chip retrigger callback
    mwifiex: Avoid skipping WEP key deletion for AP
    mwifiex: remove redundant dma padding in AMSDU
    mwifiex: debugfs: Fix (sometimes) off-by-1 SSID print
    ARM: OMAP5 / DRA7: Fix HYP mode boot for thumb2 build
    leds: ktd2692: avoid harmless maybe-uninitialized warning
    power: supply: bq24190_charger: Handle fault before status on interrupt
    power: supply: bq24190_charger: Don't read fault register outside irq_handle_thread()
    power: supply: bq24190_charger: Call power_supply_changed() for relevant component
    power: supply: bq24190_charger: Install irq_handler_thread() at end of probe()
    power: supply: bq24190_charger: Call set_mode_host() on pm_resume()
    power: supply: bq24190_charger: Fix irq trigger to IRQF_TRIGGER_FALLING
    powerpc/powernv: Fix opal_exit tracepoint opcode
    cpupower: Fix turbo frequency reporting for pre-Sandy Bridge cores
    ARM: 8452/3: PJ4: make coprocessor access sequences buildable in Thumb2 mode
    9p: fix a potential acl leak
Linux 4.4.67
    dm ioctl: prevent stack leak in dm ioctl call
    nfsd: stricter decoding of write-like NFSv2/v3 ops
    nfsd4: minor NFSv2/v3 write decoding cleanup
    ext4/fscrypto: avoid RCU lookup in d_revalidate
    ext4 crypto: use dget_parent() in ext4_d_revalidate()
    ext4 crypto: revalidate dentry after adding or removing the key
    ext4: require encryption feature for EXT4_IOC_SET_ENCRYPTION_POLICY
    IB/ehca: fix maybe-uninitialized warnings
    IB/qib: rename BITS_PER_PAGE to RVT_BITS_PER_PAGE
    netlink: Allow direct reclaim for fallback allocation
    8250_pci: Fix potential use-after-free in error path
    scsi: cxlflash: Improve EEH recovery time
    scsi: cxlflash: Fix to avoid EEH and host reset collisions
    scsi: cxlflash: Scan host only after the port is ready for I/O
    net: tg3: avoid uninitialized variable warning
    mtd: avoid stack overflow in MTD CFI code
    drbd: avoid redefinition of BITS_PER_PAGE
    ALSA: ppc/awacs: shut up maybe-uninitialized warning
    ASoC: intel: Fix PM and non-atomic crash in bytcr drivers
    Handle mismatched open calls
    timerfd: Protect the might cancel mechanism proper
Linux 4.4.66
    ftrace/x86: Fix triple fault with graph tracing and suspend-to-ram
    ARCv2: save r30 on kernel entry as gcc uses it for code-gen
    nfsd: check for oversized NFSv2/v3 arguments
    Input: i8042 - add Clevo P650RS to the i8042 reset list
    p9_client_readdir() fix
    MIPS: Avoid BUG warning in arch_check_elf
    MIPS: KGDB: Use kernel context for sleeping threads
    ALSA: seq: Don't break snd_use_lock_sync() loop by timeout
    ALSA: firewire-lib: fix inappropriate assignment between signed/unsigned type
    ipv6: check raw payload size correctly in ioctl
    ipv6: check skb->protocol before lookup for nexthop
    macvlan: Fix device ref leak when purging bc_queue
    ip6mr: fix notification device destruction
    netpoll: Check for skb->queue_mapping
    net: ipv6: RTF_PCPU should not be settable from userspace
    dp83640: don't recieve time stamps twice
    tcp: clear saved_syn in tcp_disconnect()
    sctp: listen on the sock only when it's state is listening or closed
    net: ipv4: fix multipath RTM_GETROUTE behavior when iif is given
    l2tp: fix PPP pseudo-wire auto-loading
    l2tp: take reference on sessions being dumped
    net/packet: fix overflow in check for tp_reserve
    net/packet: fix overflow in check for tp_frame_nr
    l2tp: purge socket queues in the .destruct() callback
    net: phy: handle state correctly in phy_stop_machine
    net: neigh: guard against NULL solicit() method
    sparc64: Fix kernel panic due to erroneous #ifdef surrounding pmd_write()
    sparc64: kern_addr_valid regression
    xen/x86: don't lose event interrupts
    usb: gadget: f_midi: Fixed a bug when buflen was smaller than wMaxPacketSize
    regulator: core: Clear the supply pointer if enabling fails
    RDS: Fix the atomicity for congestion map update
    net_sched: close another race condition in tcf_mirred_release()
    net: cavium: liquidio: Avoid dma_unmap_single on uninitialized ndata
    MIPS: Fix crash registers on non-crashing CPUs
    md:raid1: fix a dead loop when read from a WriteMostly disk
    ext4: check if in-inode xattr is corrupted in ext4_expand_extra_isize_ea()
    drm/amdgpu: fix array out of bounds
    crypto: testmgr - fix out of bound read in __test_aead()
    clk: sunxi: Add apb0 gates for H3
    ARM: OMAP2+: timer: add probe for clocksources
    xc2028: unlock on error in xc2028_set_config()
    f2fs: do more integrity verification for superblock
Linux 4.4.65
    perf/core: Fix concurrent sys_perf_event_open() vs. 'move_group' race
    ping: implement proper locking
    staging/android/ion : fix a race condition in the ion driver
    vfio/pci: Fix integer overflows, bitmask check
    tipc: check minimum bearer MTU
    netfilter: nfnetlink: correctly validate length of batch messages
    xc2028: avoid use after free
    mnt: Add a per mount namespace limit on the number of mounts
    tipc: fix socket timer deadlock
    tipc: fix random link resets while adding a second bearer
    gfs2: avoid uninitialized variable warning
    hostap: avoid uninitialized variable use in hfa384x_get_rid
    tty: nozomi: avoid a harmless gcc warning
    tipc: correct error in node fsm
    tipc: re-enable compensation for socket receive buffer double counting
    tipc: make dist queue pernet
    tipc: make sure IPv6 header fits in skb headroom
Linux 4.4.64
    tipc: fix crash during node removal
    block: fix del_gendisk() vs blkdev_ioctl crash
    x86, pmem: fix broken __copy_user_nocache cache-bypass assumptions
    hv: don't reset hv_context.tsc_page on crash
    Drivers: hv: balloon: account for gaps in hot add regions
    Drivers: hv: balloon: keep track of where ha_region starts
    Tools: hv: kvp: ensure kvp device fd is closed on exec
    kvm: arm/arm64: Fix locking for kvm_free_stage2_pgd
    x86/mce/AMD: Give a name to MCA bank 3 when accessed with legacy MSRs
    powerpc/kprobe: Fix oops when kprobed on 'stdu' instruction
    ubi/upd: Always flush after prepared for an update
    mac80211: reject ToDS broadcast data frames
    mmc: sdhci-esdhc-imx: increase the pad I/O drive strength for DDR50 card
    ACPI / power: Avoid maybe-uninitialized warning
    Input: elantech - add Fujitsu Lifebook E547 to force crc_enabled
    VSOCK: Detach QP check should filter out non matching QPs.
    Drivers: hv: vmbus: Reduce the delay between retries in vmbus_post_msg()
    Drivers: hv: get rid of timeout in vmbus_open()
    Drivers: hv: don't leak memory in vmbus_establish_gpadl()
    s390/mm: fix CMMA vs KSM vs others
    CIFS: remove bad_network_name flag
    cifs: Do not send echoes before Negotiate is complete
    ring-buffer: Have ring_buffer_iter_empty() return true when empty
    tracing: Allocate the snapshot buffer before enabling probe
    KEYS: fix keyctl_set_reqkey_keyring() to not leak thread keyrings
    KEYS: Change the name of the dead type to ".dead" to prevent user access
    KEYS: Disallow keyrings beginning with '.' to be joined as session keyrings
Linux 4.4.63
    MIPS: fix Select HAVE_IRQ_EXIT_ON_IRQ_STACK patch.
    sctp: deny peeloff operation on asocs with threads sleeping on it
    net: ipv6: check route protocol when deleting routes
    tty/serial: atmel: RS485 half duplex w/DMA: enable RX after TX is done
    SUNRPC: fix refcounting problems with auth_gss messages.
    ibmveth: calculate gso_segs for large packets
    catc: Use heap buffer for memory size test
    catc: Combine failure cleanup code in catc_probe()
    rtl8150: Use heap buffers for all register access
    pegasus: Use heap buffers for all register access
    virtio-console: avoid DMA from stack
    dvb-usb-firmware: don't do DMA on stack
    dvb-usb: don't use stack for firmware load
    mm: Tighten x86 /dev/mem with zeroing reads
    rtc: tegra: Implement clock handling
    platform/x86: acer-wmi: setup accelerometer when machine has appropriate notify event
    ext4: fix inode checksum calculation problem if i_extra_size is small
    dvb-usb-v2: avoid use-after-free
    ath9k: fix NULL pointer dereference
    crypto: ahash - Fix EINPROGRESS notification callback
    powerpc: Disable HFSCR[TM] if TM is not supported
    zram: do not use copy_page with non-page aligned address
    kvm: fix page struct leak in handle_vmon
    Revert "MIPS: Lantiq: Fix cascaded IRQ setup"
    char: lack of bool string made CONFIG_DEVPORT always on
    char: Drop bogus dependency of DEVPORT on !M68K
    ftrace: Fix removing of second function probe
    irqchip/irq-imx-gpcv2: Fix spinlock initialization
    libnvdimm: fix reconfig_mutex, mmap_sem, and jbd2_handle lockdep splat
    xen, fbfront: fix connecting to backend
    scsi: sd: Fix capacity calculation with 32-bit sector_t
    scsi: sd: Consider max_xfer_blocks if opt_xfer_blocks is unusable
    scsi: sr: Sanity check returned mode data
    iscsi-target: Drop work-around for legacy GlobalSAN initiator
    iscsi-target: Fix TMR reference leak during session shutdown
    acpi, nfit, libnvdimm: fix interleave set cookie calculation (64-bit comparison)
    x86/vdso: Plug race between mapping and ELF header setup
    x86/vdso: Ensure vdso32_enabled gets set to valid values only
    perf/x86: Avoid exposing wrong/stale data in intel_pmu_lbr_read_32()
    Input: xpad - add support for Razer Wildcat gamepad
    CIFS: store results of cifs_reopen_file to avoid infinite wait
    drm/nouveau/mmu/nv4a: use nv04 mmu rather than the nv44 one
    drm/nouveau/mpeg: mthd returns true on success now
    thp: fix MADV_DONTNEED vs clear soft dirty race
    cgroup, kthread: close race window where new kthreads can be migrated to non-root cgroups
Linux 4.4.62
    ibmveth: set correct gso_size and gso_type
    net/mlx4_core: Fix when to save some qp context flags for dynamic VST to VGT transitions
    net/mlx4_core: Fix racy CQ (Completion Queue) free
    net/mlx4_en: Fix bad WQE issue
    usb: hub: Wait for connection to be reestablished after port reset
    blk-mq: Avoid memory reclaim when remapping queues
    net/packet: fix overflow in check for priv area size
    crypto: caam - fix RNG deinstantiation error checking
    MIPS: IRQ Stack: Fix erroneous jal to plat_irq_dispatch
    MIPS: Select HAVE_IRQ_EXIT_ON_IRQ_STACK
    MIPS: Switch to the irq_stack in interrupts
    MIPS: Only change $28 to thread_info if coming from user mode
    MIPS: Stack unwinding while on IRQ stack
    MIPS: Introduce irq_stack
    mtd: bcm47xxpart: fix parsing first block after aligned TRX
    usb: dwc3: gadget: delay unmap of bounced requests
    drm/i915: Stop using RP_DOWN_EI on Baytrail
    drm/i915: Avoid tweaking evaluation thresholds on Baytrail v3
Linux 4.4.61
    mm/mempolicy.c: fix error handling in set_mempolicy and mbind.
    MIPS: Flush wrong invalid FTLB entry for huge page
    MIPS: Lantiq: fix missing xbar kernel panic
    MIPS: End spinlocks with .insn
    MIPS: ralink: Fix typos in rt3883 pinctrl
    MIPS: Force o32 fp64 support on 32bit MIPS64r6 kernels
    s390/uaccess: get_user() should zero on failure (again)
    s390/decompressor: fix initrd corruption caused by bss clear
    nios2: reserve boot memory for device tree
    powerpc: Don't try to fix up misaligned load-with-reservation instructions
    powerpc/mm: Add missing global TLB invalidate if cxl is active
    metag/usercopy: Add missing fixups
    metag/usercopy: Fix src fixup in from user rapf loops
    metag/usercopy: Set flags before ADDZ
    metag/usercopy: Zero rest of buffer from copy_from_user
    metag/usercopy: Add early abort to copy_to_user
    metag/usercopy: Fix alignment error checking
    metag/usercopy: Drop unused macros
    ring-buffer: Fix return value check in test_ringbuffer()
    ptrace: fix PTRACE_LISTEN race corrupting task->state
    Reset TreeId to zero on SMB2 TREE_CONNECT
    iio: bmg160: reset chip when probing
    arm/arm64: KVM: Take mmap_sem in kvm_arch_prepare_memory_region
    arm/arm64: KVM: Take mmap_sem in stage2_unmap_vm
    staging: android: ashmem: lseek failed due to no FMODE_LSEEK.
    sysfs: be careful of error returns from ops->show()
    drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl()
    drm/vmwgfx: Remove getparam error message
    drm/ttm, drm/vmwgfx: Relax permission checking when opening surfaces
    drm/vmwgfx: avoid calling vzalloc with a 0 size in vmw_get_cap_3d_ioctl()
    drm/vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl()
    drm/vmwgfx: Type-check lookups of fence objects

Bug: 62730977
Change-Id: I4458200bbc977cf55a134fd9fd08627604e36d95
Signed-off-by: Thierry Strudel <tstrudel@google.com>
 2017-09-20 15:50:18 -07:00
Arnd Geis
34241598cc misc: mnh: adjust easel fw version string length 
Bug: 65209651

Change-Id: I05148b62386382e7123b823c2b2e844d8e4fe2ae
Signed-off-by: Arnd Geis <arndg@google.com>
 2017-09-06 04:34:42 +00:00
Tim Murray
7006ddcef6 Revert "misc: mnh: Allocate partial carveout for kernel use" 
This reverts commit 5a8d54cf41.

bug 63347709

Change-Id: I2aedc8ff6e147d3162de10377edcda3190c82425
 2017-09-01 18:07:39 +00:00
Cheng Gu
5a8d54cf41 misc: mnh: Allocate partial carveout for kernel use 
Increase AP carveout to 96 MB.  Use 48 MB in kernel space and leave
the other 48 MB to userspace.

Bug: 63347709
Change-Id: I3e7b73a6932041cca26ca1a40f83bf1caa048077
Signed-off-by: Cheng Gu <gucheng@google.com>
 2017-08-30 21:29:04 +00:00
Arnd Geis
2f07603879 misc: mnh: add firmware version 
This CL implements Easel firmware version extraction and
an IOCTL and sysfs interface to query this version information.
The IOCTL interface is used in combination with the camera
HAL via easelcontrolclient to save firmware version information
in the exif section of captured frames.

Bug: b/36723642

Change-Id: I1afc7d29817c0cf3c5b11ad2f12603243258aecf
Signed-off-by: Arnd Geis <arndg@google.com>
 2017-08-25 18:05:26 +00:00
Colin Cross
b37ba51aa9 Add BINDER_GET_NODE_DEBUG_INFO ioctl 
The BINDER_GET_NODE_DEBUG_INFO ioctl will return debug info on
a node.  Each successive call reusing the previous return value
will return the next node.  The data will be used by
libmemunreachable to mark the pointers with kernel references
as reachable.

Bug: 28275695
Change-Id: Idbbafa648a33822dc023862cd92b51a595cf7c1c
Signed-off-by: Colin Cross <ccross@android.com>
Signed-off-by: Martijn Coenen <maco@android.com>
 2017-08-25 08:47:57 +02:00
Johannes Berg
56f601d6bb BACKPORT: cfg80211: remove enum ieee80211_band 
This enum is already perfectly aliased to enum nl80211_band, and
the only reason for it is that we get IEEE80211_NUM_BANDS out of
it. There's no really good reason to not declare the number of
bands in nl80211 though, so do that and remove the cfg80211 one.

Change-Id: Ifc56e6297146c9095432b757fabd0c463d7cc583
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Bug: 62057517
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
 2017-08-02 18:13:32 -07:00
Nick Desaulniers
e204046385 BACKPORT: PCI: Make PCI_ROM_ADDRESS_MASK a 32-bit constant 
A 64-bit value is not needed since a PCI ROM address consists in 32
bits.  This fixes a clang warning about "implicit conversion from
'unsigned long' to 'u32'".

Also remove now unnecessary casts to u32 from __pci_read_base() and
pci_std_update_resource().

Change-Id: I9fe11487a5cab742501444eccab7b405a9ba4885
Signed-off-by: Matthias Kaehlcke <mka@chromium.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Bug: 62057517
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
 2017-07-31 20:36:32 -07:00
Johan Hovold
ec443ee0c2 USB: hub: fix SS max number of ports 
commit 93491ced3c87c94b12220dbac0527e1356702179 upstream.

Add define for the maximum number of ports on a SuperSpeed hub as per
USB 3.1 spec Table 10-5, and use it when verifying the retrieved hub
descriptor.

This specifically avoids benign attempts to update the DeviceRemovable
mask for non-existing ports (should we get that far).

Fixes: dbe79bbe9d ("USB 3.0 Hub Changes")
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2017-06-26 07:13:09 +02:00
Arnd Geis
3e2e89c5f3 misc: mnh: kernel changes for firmware update service 
- added second dynamically allocated ION buffer for firmware
  updates through userspace
- added IOCTL to share ion handle
- added buffer validation function to prep the update buffers
  for buffer swap with mnh-sm-ion API and to support future
  signature verification
- added primary ION buffer update on close

Userspace reference and test applications: ag/2426254
Bug: b/37913436

Change-Id: I4dbf7f375b53a0e1c744048ff0f9b1c2cc0f049a
Signed-off-by: Arnd Geis <arndg@google.com>
 2017-06-22 18:05:56 +00:00
Cheng Gu
30b8a47d24 misc: easelcomm: Add timeout field in uapi 
Add timeout field in easelcomm_kmsg_desc and easelcomm_kbuf_desc.
Only WAITMSG and WAITREPLY ioctl have implemented timeout for now.

Also convert uapi header file to use __u32 and friends.

Bug: 37722276
Bug: 62194389
Bug: 62207024
Change-Id: I3ce0c7bff6b846a35a69974d8dabcba95dd98701
Signed-off-by: Cheng Gu <gucheng@google.com>
 2017-06-12 17:42:18 -07:00
Greg Kroah-Hartman
0cb1f41973 Merge 4.4.56 into android-4.4 
Changes in 4.4.56
	netlink: remove mmapped netlink support
	vxlan: correctly validate VXLAN ID against VXLAN_N_VID
	vti6: return GRE_KEY for vti6
	ipv4: mask tos for input route
	l2tp: avoid use-after-free caused by l2tp_ip_backlog_recv
	net: don't call strlen() on the user buffer in packet_bind_spkt()
	net: net_enable_timestamp() can be called from irq contexts
	dccp: Unlock sock before calling sk_free()
	tcp: fix various issues for sockets morphing to listen state
	net: fix socket refcounting in skb_complete_wifi_ack()
	net: fix socket refcounting in skb_complete_tx_timestamp()
	dccp: fix use-after-free in dccp_feat_activate_values
	vrf: Fix use-after-free in vrf_xmit
	uapi: fix linux/packet_diag.h userspace compilation error
	act_connmark: avoid crashing on malformed nlattrs with null parms
	mpls: Send route delete notifications when router module is unloaded
	ipv6: make ECMP route replacement less greedy
	ipv6: avoid write to a possibly cloned skb
	bridge: drop netfilter fake rtable unconditionally
	dccp/tcp: fix routing redirect race
	dccp: fix memory leak during tear-down of unsuccessful connection request
	net sched actions: decrement module reference count after table flush.
	fscrypt: fix renaming and linking special files
	fscrypto: lock inode while setting encryption policy
	x86/kasan: Fix boot with KASAN=y and PROFILE_ANNOTATED_BRANCHES=y
	x86/perf: Fix CR4.PCE propagation to use active_mm instead of mm
	futex: Fix potential use-after-free in FUTEX_REQUEUE_PI
	futex: Add missing error handling to FUTEX_REQUEUE_PI
	Linux 4.4.56

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
 2017-05-22 23:19:33 -07:00
Niranjan Pendharkar
ad108aec8d msm: ipa: support aggregated ipa stats query 
add support on wan-driver to query modem or
wlan-fw to get the total data usage for all
tethered clients.

Change-Id: I56f40f1c0f6b2ec4279e78b3aeb81c687d08bf2e
Signed-off-by: Skylar Chang <chiaweic@codeaurora.org>
Signed-off-by: Niranjan Pendharkar <npendhar@codeaurora.org>
 2017-05-23 06:06:01 +00:00
Martijn Coenen
539760bcea ANDROID: binder: add min sched_policy to node. 
This change adds flags to flat_binder_object.flags
to allow indicating a minimum scheduling policy for
the node. It also clarifies the valid value range
for the priority bits in the flags.

Internally, we use the priority map that the kernel
uses, e.g. [0..99] for real-time policies and [100..139]
for the SCHED_NORMAL/SCHED_BATCH policies.

We also need to start keeping track of the default
scheduling policy for a process, as that is what
we will restore to after handling oneway transactions
that temporarily increased the priority.

Bug: 34461621
Bug: 37293077
Change-Id: Ifc6a0d691c2feb48e8349a21f56fb2eeb22f1bb5
Signed-off-by: Martijn Coenen <maco@google.com>
 2017-05-22 22:39:04 -07:00
Thierry Strudel
9270706724 Merge branch 'android-msm-8998-4.4-common' into android-msm-wahoo-4.4 
Change-Id: If796e86a3f20437e18648d16e35bae96c98c2cc2
 2017-05-16 12:24:28 -07:00
David Ahern
f6b94906b4 net: ipv6: RTF_PCPU should not be settable from userspace 
[ Upstream commit 557c44be917c322860665be3d28376afa84aa936 ]

Andrey reported a fault in the IPv6 route code:

kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Modules linked in:
CPU: 1 PID: 4035 Comm: a.out Not tainted 4.11.0-rc7+ #250
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff880069809600 task.stack: ffff880062dc8000
RIP: 0010:ip6_rt_cache_alloc+0xa6/0x560 net/ipv6/route.c:975
RSP: 0018:ffff880062dced30 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: ffff8800670561c0 RCX: 0000000000000006
RDX: 0000000000000003 RSI: ffff880062dcfb28 RDI: 0000000000000018
RBP: ffff880062dced68 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffff880062dcfb28 R14: dffffc0000000000 R15: 0000000000000000
FS:  00007feebe37e7c0(0000) GS:ffff88006cb00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000205a0fe4 CR3: 000000006b5c9000 CR4: 00000000000006e0
Call Trace:
 ip6_pol_route+0x1512/0x1f20 net/ipv6/route.c:1128
 ip6_pol_route_output+0x4c/0x60 net/ipv6/route.c:1212
...

Andrey's syzkaller program passes rtmsg.rtmsg_flags with the RTF_PCPU bit
set. Flags passed to the kernel are blindly copied to the allocated
rt6_info by ip6_route_info_create making a newly inserted route appear
as though it is a per-cpu route. ip6_rt_cache_alloc sees the flag set
and expects rt->dst.from to be set - which it is not since it is not
really a per-cpu copy. The subsequent call to __ip6_dst_alloc then
generates the fault.

Fix by checking for the flag and failing with EINVAL.

Fixes: d52d3997f8 ("ipv6: Create percpu rt6_info")
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2017-05-02 21:19:53 -07:00
Hareesh Gundu
601a336287 msm: kgsl: Allow draw context to perform only replay on recovery 
Robust context attempts to perform a rendering that takes too long
whether due to an infinite loop in a shader or even just a rendering
operation that takes too long on the given hardware. This type of
attempts can result into GPU faults. Robust context expect driver
to replay IB instead skip IB and if it fails on replay context has
to be invalidated.

KGSL_CONTEXT_INVALIDATE_ON_FAULT flag allows draw context to execute
only replay policy on GPU fault recovery instead of going to default
recovery policy. User space has to set this flag during the context
creation.

Change-Id: If42dc5afc7d5ed1226b73ae5abfa2648d7acf2c3
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
 2017-05-01 23:40:47 -07:00
Thierry Strudel
f40df1df68 Merge remote-tracking branch 'msm-qcom/android-msm-8998-4.4-common' into android-msm-wahoo-4.4 
Conflicts:
	arch/arm/boot/dts/qcom/Makefile
	arch/arm64/Kconfig
	arch/arm64/Makefile
	drivers/power/supply/qcom/battery.c
	scripts/Makefile.lib

Change-Id: I5d59b4df33d458c890db903e3567176469e60f0b
 2017-04-28 16:56:47 -07:00
Jerry Zhang
0673819a42 usb: gadget: function: f_fs: Add FUNCTIONFS_ENDPOINT_ALLOC ioctl 
FUNCTIONFS_ENDPOINT_ALLOC will allocate a buffer of a given
size for an endpoint.

Whenever a synchronous i/o is called that can fit in that buffer,
it is used instead of allocating a new buffer on each call.

The buffer is freed when the epfile is released, a new buffer is
allocated, or the ioctl is called with argument 0.

Change-Id: I54af3205575f2bb83c732bb70907f60e0b785e11
Signed-off-by: Jerry Zhang <zhangjerry@google.com>
 2017-04-28 19:19:11 +00:00
Chenjie Luo
ecb07e0fea misc: easelcomm: expands PCIE service id count to 64. 
To support various requirement in userspace, the 4 hard coded
services could not satisfy the need. Expands service id count to
64 and service data structure will be allocated in the heap
when registered and freed when driver is turned down.

Cherry-pick: https://gerrit.ibbprof.com/gerrit2/#/c/66161/

Change-Id: Iaf0490d4e99ac4b29a231d98ddf7357ee7acba0e
Signed-off-by: Chenjie Luo <cjluo@google.com>
 2017-04-28 06:51:08 +00:00
Thierry Strudel
a13eec6c23 Merge remote-tracking branch 'msm-google/android-msm-wahoo-4.4' into HEAD 2017-04-18 13:11:43 -07:00
Pratyush Anand
9a9a155be9 BACKPORT: hw_breakpoint: Allow watchpoint of length 3,5,6 and 7 
(cherry picked from commit 651be3cb085341a21847e47c694c249c3e1e4e5b)

We only support breakpoint/watchpoint of length 1, 2, 4 and 8. If we can
support other length as well, then user may watch more data with less
number of watchpoints (provided hardware supports it). For example: if we
have to watch only 4th, 5th and 6th byte from a 64 bit aligned address, we
will have to use two slots to implement it currently. One slot will watch a
half word at offset 4 and other a byte at offset 6. If we can have a
watchpoint of length 3 then we can watch it with single slot as well.

ARM64 hardware does support such functionality, therefore adding these new
definitions in generic layer.

Signed-off-by: Pratyush Anand <panand@redhat.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Pavel Labath <labath@google.com>
[pavel: tools/include/uapi/linux/hw_breakpoint.h is not present in this branch]
Change-Id: Ie17ed89ca526e4fddf591bb4e556fdfb55fc2eac
Bug: 30919905
 2017-04-18 14:36:37 +01:00
Thierry Strudel
e45c31bc49 Merge branch 'android-msm-8998-4.4-common' into android-msm-wahoo-4.4 
Change-Id: Ia125b611f401d83ec75c0159b56f35eeea6768f2
 2017-04-17 16:36:35 -07:00
Linux Build Service Account
054789c42f Merge "cfg80211: Add Fast Initial Link Setup (FILS) auth algs" 2017-04-11 20:43:35 -07:00
Linux Build Service Account
8b65846d11 Merge "sound: usb: Populate tunnel mode response struct for BADD devices" 2017-04-11 20:43:32 -07:00
Jouni Malinen
16793068c2 cfg80211: Add Fast Initial Link Setup (FILS) auth algs 
This defines authentication algorithms for FILS (IEEE 802.11ai).

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Git-commit: 631810603a20874554b2f17adf42b72d0f15eda5
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
CRs-Fixed: 2028536
Change-Id: I530913c84f2c3e678e83144ac474195184f4dd3b
Signed-off-by: Vidyullatha Kanchanapally <vidyullatha@codeaurora.org>
 2017-04-11 03:54:45 -07:00
Jouni Malinen
ea3b2dcdde cfg80211: Rename SAE_DATA to more generic AUTH_DATA 
This adds defines and nl80211 extensions to allow FILS Authentication to
be implemented similarly to SAE. FILS does not need the special rules
for the Authentication transaction number and Status code fields, but it
does need to add non-IE fields. The previously used
NL80211_ATTR_SAE_DATA can be reused for this to avoid having to
duplicate that implementation. Rename that attribute to more generic
NL80211_ATTR_AUTH_DATA (with backwards compatibility define for
NL80211_SAE_DATA).

Also document the special rules related to the Authentication
transaction number and Status code fiels.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Git-commit: 11b6b5a4ced2f2c76073b97ee08ca0eab8358fde
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
CRs-Fixed: 2028536
Change-Id: Icc8bbdf3530c46048239ca88bfcb8b100a7f0822
Signed-off-by: Vidyullatha Kanchanapally <vidyullatha@codeaurora.org>
 2017-04-11 03:53:46 -07:00
Ajay Agarwal
2ecedf5dc7 sound: usb: Add support for parsing AudioStreaming intf for BADD devices 
BADD(Basic Audio Device Definition) is a subset of UAC3
specifications. It defines standard profiles which provide
specific attributes of class descriptors. BADD audio device
provides profile id and BADD supporting host will infer
attributes from profile-id.

Currently USB Audio Host driver has support for UAC1
and UAC2 devices. To handle BADD 3.0 devices, AudioControl
and AudioStreaming Interfaces have to be properly parsed.
The Host has to derive all class-specific information based
on the profile ID that the device exposes. Add support for
parsing the AudioStreaming interfaces exposed by the device.

Change-Id: I726bbb735708fe8e395011c7228a73d5f65c092d
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>
 2017-04-10 16:14:02 +05:30
Thierry Strudel
1bfb0526f6 Merge branch 'android-msm-8998-4.4-common' into android-msm-wahoo-4.4 
Conflicts:
	Makefile
	arch/arm64/configs/wahoo_defconfig
	arch/arm64/include/asm/cpufeature.h
	arch/arm64/kernel/sleep.S
	arch/arm64/kernel/vmlinux.lds.S
	arch/arm64/mm/fault.c
	drivers/android/binder.c
	drivers/firmware/efi/arm-init.c
	drivers/firmware/efi/efi.c
	drivers/input/keyboard/gpio_keys.c
	drivers/input/misc/Makefile
	drivers/input/misc/vl53L0/Makefile
	drivers/input/misc/vl53L0/inc/vl53l010_api.h
	drivers/input/misc/vl53L0/inc/vl53l010_device.h
	drivers/input/misc/vl53L0/inc/vl53l010_strings.h
	drivers/input/misc/vl53L0/inc/vl53l010_tuning.h
	drivers/input/misc/vl53L0/inc/vl53l0_api.h
	drivers/input/misc/vl53L0/inc/vl53l0_api_calibration.h
	drivers/input/misc/vl53L0/inc/vl53l0_api_core.h
	drivers/input/misc/vl53L0/inc/vl53l0_api_histogram.h
	drivers/input/misc/vl53L0/inc/vl53l0_api_ranging.h
	drivers/input/misc/vl53L0/inc/vl53l0_api_strings.h
	drivers/input/misc/vl53L0/inc/vl53l0_def.h
	drivers/input/misc/vl53L0/inc/vl53l0_device.h
	drivers/input/misc/vl53L0/inc/vl53l0_interrupt_threshold_settings.h
	drivers/input/misc/vl53L0/inc/vl53l0_platform.h
	drivers/input/misc/vl53L0/inc/vl53l0_platform_log.h
	drivers/input/misc/vl53L0/inc/vl53l0_tuning.h
	drivers/input/misc/vl53L0/inc/vl53l0_types.h
	drivers/input/misc/vl53L0/src/vl53l010_api.c
	drivers/input/misc/vl53L0/src/vl53l010_tuning.c
	drivers/input/misc/vl53L0/src/vl53l0_api.c
	drivers/input/misc/vl53L0/src/vl53l0_api_calibration.c
	drivers/input/misc/vl53L0/src/vl53l0_api_core.c
	drivers/input/misc/vl53L0/src/vl53l0_api_histogram.c
	drivers/input/misc/vl53L0/src/vl53l0_api_ranging.c
	drivers/input/misc/vl53L0/src/vl53l0_api_strings.c
	drivers/input/misc/vl53L0/src/vl53l0_i2c_platform.c
	drivers/input/misc/vl53L0/src/vl53l0_platform.c
	drivers/input/misc/vl53L0/src/vl53l0_port_i2c.c
	drivers/input/misc/vl53L0/stmvl53l0-cci.h
	drivers/input/misc/vl53L0/stmvl53l0-i2c.h
	drivers/input/misc/vl53L0/stmvl53l0.h
	drivers/input/misc/vl53L0/stmvl53l0_module-cci.c
	drivers/input/misc/vl53L0/stmvl53l0_module-i2c.c
	drivers/input/misc/vl53L0/stmvl53l0_module.c
	drivers/input/touchscreen/Makefile
	drivers/leds/leds-qpnp.c
	drivers/media/platform/msm/camera_v2/isp/msm_isp_stats_util.c
	drivers/media/platform/msm/camera_v2/msm.c
	drivers/pinctrl/qcom/pinctrl-msm.c
	drivers/platform/msm/ipa/ipa_v3/ipa_client.c
	drivers/platform/msm/mhi/mhi_ssr.c
	drivers/power/supply/qcom/qpnp-smb2.c
	drivers/power/supply/qcom/smb-lib.c
	drivers/power/supply/qcom/smb-lib.h
	drivers/soc/qcom/icnss.c
	drivers/soc/qcom/qdsp6v2/audio_notifier.c
	drivers/soc/qcom/service-notifier.c
	drivers/video/fbdev/msm/mdss_panel.h
	fs/exec.c
	fs/ext4/inode.c
	fs/ext4/readpage.c
	fs/namei.c
	fs/sdcardfs/derived_perm.c
	fs/sdcardfs/file.c
	fs/sdcardfs/inode.c
	fs/sdcardfs/lookup.c
	fs/sdcardfs/main.c
	fs/sdcardfs/multiuser.h
	fs/sdcardfs/packagelist.c
	fs/sdcardfs/sdcardfs.h
	fs/sdcardfs/super.c
	fs/utimes.c
	include/linux/string.h
	lib/kstrtox.c
	lib/string.c
	net/ipv4/tcp_ipv4.c
	net/unix/af_unix.c
	sound/soc/codecs/wcd934x/wcd934x-mbhc.h
	sound/soc/msm/msm8998.c

Change-Id: I918ebad22a5f81d48be07bd2bc2ac435ed9acb0a
Signed-off-by: Thierry Strudel <tstrudel@google.com>
 2017-04-07 12:27:45 -07:00
Joel Scherpelz
d5bb83134b net: ipv6: Add sysctl for minimum prefix len acceptable in RIOs. 
This commit adds a new sysctl accept_ra_rt_info_min_plen that
defines the minimum acceptable prefix length of Route Information
Options. The new sysctl is intended to be used together with
accept_ra_rt_info_max_plen to configure a range of acceptable
prefix lengths. It is useful to prevent misconfigurations from
unintentionally blackholing too much of the IPv6 address space
(e.g., home routers announcing RIOs for fc00::/7, which is
incorrect).

Backport of net-next commit bbea124bc99d ("net: ipv6: Add sysctl for minimum prefix len acceptable in RIOs.")

[lorenzo@google.com: fixed conflicts in include/uapi/linux/ipv6.h]
Bug: 33333670
Test: net_test passes

Change-Id: I88099591d6de31a93e182faa83a74f951b17f144
Signed-off-by: Joel Scherpelz <jscherpelz@google.com>
Acked-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
 2017-04-07 05:50:03 +00:00
Trevor Bunker
bc485962ac misc: mnh: add ioctl to wait for power 
This allows us to remove the temporary PENDING state. The ioctl will be
used to block until the device is powered and can accept pcie
transactions. The device will continue to boot in the kernel thread.

Bug: 37074557
Change-Id: Iab8d2babe48bce6e3993975a1753648e2a190832
Signed-off-by: Trevor Bunker <trevorbunker@google.com>
 2017-04-06 11:10:05 -07:00
Linux Build Service Account
c57c1bf5d9 Merge "drivers: net: rmnet: Initial implementation" 2017-03-31 21:24:35 -07:00
Subash Abhinov Kasiviswanathan
ecc51b984b drivers: net: rmnet: Initial implementation 
RmNet driver provides a transport agnostic MAP (multiplexing and
aggregation protocol) support in embedded and bridge modes. Module
provides virtual network devices which can be attached to any IP-mode
physical device. This will be used to provide all MAP functionality
on future hardware in a single consistent location.

CRs-Fixed: 2022292
Change-Id: I4dd0f4fcf00bbf9dcbec65cec82436d48a813ecc
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
 2017-03-31 15:07:51 -06:00
Arun KS
2e139766ca esoc: Fix user space corruption due to wrong data type 
ESOC IOCTL was designed to transfer data of type unsigned int, but
was pushing data of unsigned long type. Hence causing data corruption
in user space. Fix this by changing put user to use unsigned int.

Change-Id: Ia233eedd76f1ca1ec3036889d6764e568ee975dd
Signed-off-by: Arun KS <arunks@codeaurora.org>
 2017-03-29 17:25:35 -07:00
Tim Murray
d668aac7f1 binder: make FIFO inheritance a per-context option 
Add a new ioctl to binder to control whether FIFO inheritance should happen.
In particular, hwbinder should inherit FIFO priority from callers, but standard
binder threads should not.

Test: boots

bug 36516194

Signed-off-by: Tim Murray <timmurray@google.com>
Change-Id: I8100c4364b7d15d1bf00a8ca5c286e4d4b23ce85
 2017-03-27 12:31:29 -07:00
Arnd Geis
3a0d54c87a misc: mnh: enable MIPI functional mode through SM 
This CL adds functional mode configurations via ioctl
interface to the mnh-sm.
Available modes are:
1. Rx[n] -> Tx[m] (bypass)
2. Rx[n] -> Tx[m] & IPU IDI Rx[n] (bypass with IPU)
3. Rx[n] -> IPU IDI Rx[n] (functional)
4. Rx[n] -> IPU IDI Rx[n] -> IPU IDI Tx[m] -> Tx[m]
5. IPU IDI Tx[m] -> Tx[m]

Note: this CL requires related EaselStateManager changes

Change-Id: Icedc06bd6b422acd06eb6e1e9c7b424397c7deca
Signed-off-by: Arnd Geis <arndg@google.com>
Signed-off-by: Trevor Bunker <trevorbunker@google.com>
 2017-03-24 09:36:49 -07:00
Trevor Bunker
226cafc1d6 misc: mnh: reduce number of states and ioctls 
Also, refactor DDR init, suspend, and resume so it is not performed
during power-on sequencing. This allows us to configure MIPI
immediately, and do DDR sequencing and booting in parallel with other
camera HAL operations.

Bug: 36546728
Bug: 36535946
Change-Id: Ie9f16ea4f3e7af42651002f333156b14f832159f
Signed-off-by: Trevor Bunker <trevorbunker@google.com>
 2017-03-23 12:07:19 -07:00
Subash Abhinov Kasiviswanathan
b268a55a9f net: rmnet_data: Add support to configure custom device name 
rmnet_data assigns device name by the order they are created.
This causes problems which multiple processes are trying to
create devices and leads to random device names.

Assign device name as specified by user.

CRs-Fixed: 2018785
Change-Id: Iab8e053c6ccacbeedaa7763e760d0c12e756b5d0
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
 2017-03-22 12:55:20 -06:00
Dmitry V. Levin
6c72458ab4 uapi: fix linux/packet_diag.h userspace compilation error 
[ Upstream commit 745cb7f8a5de0805cade3de3991b7a95317c7c73 ]

Replace MAX_ADDR_LEN with its numeric value to fix the following
linux/packet_diag.h userspace compilation error:

/usr/include/linux/packet_diag.h:67:17: error: 'MAX_ADDR_LEN' undeclared here (not in a function)
  __u8 pdmc_addr[MAX_ADDR_LEN];

This is not the first case in the UAPI where the numeric value
of MAX_ADDR_LEN is used instead of symbolic one, uapi/linux/if_link.h
already does the same:

$ grep MAX_ADDR_LEN include/uapi/linux/if_link.h
	__u8 mac[32]; /* MAX_ADDR_LEN */

There are no UAPI headers besides these two that use MAX_ADDR_LEN.

Signed-off-by: Dmitry V. Levin <ldv@altlinux.org>
Acked-by: Pavel Emelyanov <xemul@virtuozzo.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2017-03-22 12:04:16 +01:00
Florian Westphal
0c0be310ba netlink: remove mmapped netlink support 
commit d1b4c689d4130bcfd3532680b64db562300716b6 upstream.

mmapped netlink has a number of unresolved issues:

- TX zerocopy support had to be disabled more than a year ago via
  commit 4682a03586 ("netlink: Always copy on mmap TX.")
  because the content of the mmapped area can change after netlink
  attribute validation but before message processing.

- RX support was implemented mainly to speed up nfqueue dumping packet
  payload to userspace.  However, since commit ae08ce0021
  ("netfilter: nfnetlink_queue: zero copy support") we avoid one copy
  with the socket-based interface too (via the skb_zerocopy helper).

The other problem is that skbs attached to mmaped netlink socket
behave different from normal skbs:

- they don't have a shinfo area, so all functions that use skb_shinfo()
(e.g. skb_clone) cannot be used.

- reserving headroom prevents userspace from seeing the content as
it expects message to start at skb->head.
See for instance
commit aa3a022094fa ("netlink: not trim skb for mmaped socket when dump").

- skbs handed e.g. to netlink_ack must have non-NULL skb->sk, else we
crash because it needs the sk to check if a tx ring is attached.

Also not obvious, leads to non-intuitive bug fixes such as 7c7bdf359
("netfilter: nfnetlink: use original skbuff when acking batches").

mmaped netlink also didn't play nicely with the skb_zerocopy helper
used by nfqueue and openvswitch.  Daniel Borkmann fixed this via
commit 6bb0fef489 ("netlink, mmap: fix edge-case leakages in nf queue
zero-copy")' but at the cost of also needing to provide remaining
length to the allocation function.

nfqueue also has problems when used with mmaped rx netlink:
- mmaped netlink doesn't allow use of nfqueue batch verdict messages.
  Problem is that in the mmap case, the allocation time also determines
  the ordering in which the frame will be seen by userspace (A
  allocating before B means that A is located in earlier ring slot,
  but this also means that B might get a lower sequence number then A
  since seqno is decided later.  To fix this we would need to extend the
  spinlocked region to also cover the allocation and message setup which
  isn't desirable.
- nfqueue can now be configured to queue large (GSO) skbs to userspace.
  Queing GSO packets is faster than having to force a software segmentation
  in the kernel, so this is a desirable option.  However, with a mmap based
  ring one has to use 64kb per ring slot element, else mmap has to fall back
  to the socket path (NL_MMAP_STATUS_COPY) for all large packets.

To use the mmap interface, userspace not only has to probe for mmap netlink
support, it also has to implement a recv/socket receive path in order to
handle messages that exceed the size of an rx ring element.

Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Ken-ichirou MATSUZAWA <chamaken@gmail.com>
Cc: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: Patrick McHardy <kaber@trash.net>
Cc: Thomas Graf <tgraf@suug.ch>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: Shi Yuejie <shiyuejie@outlook.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2017-03-22 12:04:13 +01:00
Runmin Wang
78cbd38fd5 Merge tag 'lsk-v4.4-17.02-android' into branch 'msm-4.4' 
* refs/heads/tmp-26c8156:
  Linux 4.4.49
  drm/i915: fix use-after-free in page_flip_completed()
  ALSA: seq: Don't handle loop timeout at snd_seq_pool_done()
  ALSA: seq: Fix race at creating a queue
  xen-netfront: Delete rx_refill_timer in xennet_disconnect_backend()
  scsi: mpt3sas: disable ASPM for MPI2 controllers
  scsi: aacraid: Fix INTx/MSI-x issue with older controllers
  scsi: zfcp: fix use-after-free by not tracing WKA port open/close on failed send
  netvsc: Set maximum GSO size in the right place
  mac80211: Fix adding of mesh vendor IEs
  ARM: 8642/1: LPAE: catch pending imprecise abort on unmask
  target: Fix COMPARE_AND_WRITE ref leak for non GOOD status
  target: Fix early transport_generic_handle_tmr abort scenario
  target: Use correct SCSI status during EXTENDED_COPY exception
  target: Don't BUG_ON during NodeACL dynamic -> explicit conversion
  ARM: 8643/3: arm/ptrace: Preserve previous registers for short regset write
  hns: avoid stack overflow with CONFIG_KASAN
  cpumask: use nr_cpumask_bits for parsing functions
  Revert "x86/ioapic: Restore IO-APIC irq_chip retrigger callback"
  selinux: fix off-by-one in setprocattr
  ARC: [arcompact] brown paper bag bug in unaligned access delay slot fixup
  Linux 4.4.48
  base/memory, hotplug: fix a kernel oops in show_valid_zones()
  x86/irq: Make irq activate operations symmetric
  USB: serial: option: add device ID for HP lt2523 (Novatel E371)
  usb: gadget: f_fs: Assorted buffer overflow checks.
  USB: Add quirk for WORLDE easykey.25 MIDI keyboard
  USB: serial: pl2303: add ATEN device ID
  USB: serial: qcserial: add Dell DW5570 QDL
  KVM: x86: do not save guest-unsupported XSAVE state
  HID: wacom: Fix poor prox handling in 'wacom_pl_irq'
  percpu-refcount: fix reference leak during percpu-atomic transition
  mmc: sdhci: Ignore unexpected CARD_INT interrupts
  can: bcm: fix hrtimer/tasklet termination in bcm op removal
  mm, fs: check for fatal signals in do_generic_file_read()
  mm/memory_hotplug.c: check start_pfn in test_pages_in_a_zone()
  cifs: initialize file_info_lock
  zswap: disable changing params if init fails
  svcrpc: fix oops in absence of krb5 module
  NFSD: Fix a null reference case in find_or_create_lock_stateid()
  powerpc: Add missing error check to prom_find_boot_cpu()
  powerpc/eeh: Fix wrong flag passed to eeh_unfreeze_pe()
  libata: apply MAX_SEC_1024 to all CX1-JB*-HP devices
  ata: sata_mv:- Handle return value of devm_ioremap.
  perf/core: Fix PERF_RECORD_MMAP2 prot/flags for anonymous memory
  crypto: arm64/aes-blk - honour iv_out requirement in CBC and CTR modes
  crypto: api - Clear CRYPTO_ALG_DEAD bit before registering an alg
  drm/nouveau/nv1a,nv1f/disp: fix memory clock rate retrieval
  drm/nouveau/disp/gt215: Fix HDA ELD handling (thus, HDMI audio) on gt215
  ext4: validate s_first_meta_bg at mount time
  PCI/ASPM: Handle PCI-to-PCIe bridges as roots of PCIe hierarchies
  ANDROID: security: export security_path_chown()
  Linux 4.4.47
  net: dsa: Bring back device detaching in dsa_slave_suspend()
  qmi_wwan/cdc_ether: add device ID for HP lt2523 (Novatel E371) WWAN card
  af_unix: move unix_mknod() out of bindlock
  r8152: don't execute runtime suspend if the tx is not empty
  bridge: netlink: call br_changelink() during br_dev_newlink()
  tcp: initialize max window for a new fastopen socket
  ipv6: addrconf: Avoid addrconf_disable_change() using RCU read-side lock
  net: phy: bcm63xx: Utilize correct config_intr function
  net: fix harmonize_features() vs NETIF_F_HIGHDMA
  ax25: Fix segfault after sock connection timeout
  ravb: do not use zero-length alignment DMA descriptor
  openvswitch: maintain correct checksum state in conntrack actions
  tcp: fix tcp_fastopen unaligned access complaints on sparc
  net: systemport: Decouple flow control from __bcm_sysport_tx_reclaim
  net: ipv4: fix table id in getroute response
  net: lwtunnel: Handle lwtunnel_fill_encap failure
  mlxsw: pci: Fix EQE structure definition
  mlxsw: switchx2: Fix memory leak at skb reallocation
  mlxsw: spectrum: Fix memory leak at skb reallocation
  r8152: fix the sw rx checksum is unavailable
  ANDROID: sdcardfs: Switch strcasecmp for internal call
  ANDROID: sdcardfs: switch to full_name_hash and qstr
  ANDROID: sdcardfs: Add GID Derivation to sdcardfs
  ANDROID: sdcardfs: Remove redundant operation
  ANDROID: sdcardfs: add support for user permission isolation
  ANDROID: sdcardfs: Refactor configfs interface
  ANDROID: sdcardfs: Allow non-owners to touch
  ANDROID: binder: fix format specifier for type binder_size_t
  ANDROID: fs: Export vfs_rmdir2
  ANDROID: fs: Export free_fs_struct and set_fs_pwd
  ANDROID: mnt: remount should propagate to slaves of slaves
  ANDROID: sdcardfs: Switch ->d_inode to d_inode()
  ANDROID: sdcardfs: Fix locking issue with permision fix up
  ANDROID: sdcardfs: Change magic value
  ANDROID: sdcardfs: Use per mount permissions
  ANDROID: sdcardfs: Add gid and mask to private mount data
  ANDROID: sdcardfs: User new permission2 functions
  ANDROID: vfs: Add setattr2 for filesystems with per mount permissions
  ANDROID: vfs: Add permission2 for filesystems with per mount permissions
  ANDROID: vfs: Allow filesystems to access their private mount data
  ANDROID: mnt: Add filesystem private data to mount points
  ANDROID: sdcardfs: Move directory unlock before touch
  ANDROID: sdcardfs: fix external storage exporting incorrect uid
  ANDROID: sdcardfs: Added top to sdcardfs_inode_info
  ANDROID: sdcardfs: Switch package list to RCU
  ANDROID: sdcardfs: Fix locking for permission fix up
  ANDROID: sdcardfs: Check for other cases on path lookup
  ANDROID: sdcardfs: override umask on mkdir and create
  Linux 4.4.46
  mm, memcg: do not retry precharge charges
  platform/x86: intel_mid_powerbtn: Set IRQ_ONESHOT
  pinctrl: broxton: Use correct PADCFGLOCK offset
  s5k4ecgx: select CRC32 helper
  IB/umem: Release pid in error and ODP flow
  IB/ipoib: move back IB LL address into the hard header
  drm/i915: Don't leak edid in intel_crt_detect_ddc()
  SUNRPC: cleanup ida information when removing sunrpc module
  NFSv4.0: always send mode in SETATTR after EXCLUSIVE4
  nfs: Don't increment lock sequence ID after NFS4ERR_MOVED
  parisc: Don't use BITS_PER_LONG in userspace-exported swab.h header
  ARC: [arcompact] handle unaligned access delay slot corner case
  ARC: udelay: fix inline assembler by adding LP_COUNT to clobber list
  can: ti_hecc: add missing prepare and unprepare of the clock
  can: c_can_pci: fix null-pointer-deref in c_can_start() - set device pointer
  s390/ptrace: Preserve previous registers for short regset write
  RDMA/cma: Fix unknown symbol when CONFIG_IPV6 is not enabled
  ISDN: eicon: silence misleading array-bounds warning
  sysctl: fix proc_doulongvec_ms_jiffies_minmax()
  mm/mempolicy.c: do not put mempolicy before using its nodemask
  drm: Fix broken VT switch with video=1366x768 option
  tile/ptrace: Preserve previous registers for short regset write
  fbdev: color map copying bounds checking
  Linux 4.4.45
  arm64: avoid returning from bad_mode
  selftest/powerpc: Wrong PMC initialized in pmc56_overflow test
  dmaengine: pl330: Fix runtime PM support for terminated transfers
  ite-cir: initialize use_demodulator before using it
  blackfin: check devm_pinctrl_get() for errors
  ARM: 8613/1: Fix the uaccess crash on PB11MPCore
  ARM: ux500: fix prcmu_is_cpu_in_wfi() calculation
  ARM: dts: imx6qdl-nitrogen6_max: fix sgtl5000 pinctrl init
  arm64/ptrace: Reject attempts to set incomplete hardware breakpoint fields
  arm64/ptrace: Avoid uninitialised struct padding in fpr_set()
  arm64/ptrace: Preserve previous registers for short regset write - 3
  arm64/ptrace: Preserve previous registers for short regset write - 2
  arm64/ptrace: Preserve previous registers for short regset write
  ARM: dts: da850-evm: fix read access to SPI flash
  ceph: fix bad endianness handling in parse_reply_info_extra
  ARM: 8634/1: hw_breakpoint: blacklist Scorpion CPUs
  svcrdma: avoid duplicate dma unmapping during error recovery
  clocksource/exynos_mct: Clear interrupt when cpu is shut down
  ubifs: Fix journal replay wrt. xattr nodes
  qla2xxx: Fix crash due to null pointer access
  x86/ioapic: Restore IO-APIC irq_chip retrigger callback
  mtd: nand: xway: disable module support
  ieee802154: atusb: do not use the stack for buffers to make them DMA able
  mmc: mxs-mmc: Fix additional cycles after transmission stop
  HID: corsair: fix control-transfer error handling
  HID: corsair: fix DMA buffers on stack
  PCI: Enumerate switches below PCI-to-PCIe bridges
  fuse: clear FR_PENDING flag when moving requests out of pending queue
  svcrpc: don't leak contexts on PROC_DESTROY
  x86/PCI: Ignore _CRS on Supermicro X8DTH-i/6/iF/6F
  tmpfs: clear S_ISGID when setting posix ACLs
  ARM: dts: imx31: fix AVIC base address
  ARM: dts: imx31: move CCM device node to AIPS2 bus devices
  ARM: dts: imx31: fix clock control module interrupts description
  perf scripting: Avoid leaking the scripting_context variable
  IB/IPoIB: Remove can't use GFP_NOIO warning
  IB/mlx4: When no DMFS for IPoIB, don't allow NET_IF QPs
  IB/mlx4: Fix port query for 56Gb Ethernet links
  IB/mlx4: Fix out-of-range array index in destroy qp flow
  IB/mlx4: Set traffic class in AH
  IB/mlx5: Wait for all async command completions to complete
  ftrace/x86: Set ftrace_stub to weak to prevent gcc from using short jumps to it
  Linux 4.4.44
  pinctrl: sh-pfc: Do not unconditionally support PIN_CONFIG_BIAS_DISABLE
  powerpc/ibmebus: Fix device reference leaks in sysfs interface
  powerpc/ibmebus: Fix further device reference leaks
  bus: vexpress-config: fix device reference leak
  blk-mq: Always schedule hctx->next_cpu
  ACPI / APEI: Fix NMI notification handling
  block: cfq_cpd_alloc() should use @gfp
  cpufreq: powernv: Disable preemption while checking CPU throttling state
  NFSv4.1: nfs4_fl_prepare_ds must be careful about reporting success.
  NFS: Fix a performance regression in readdir
  pNFS: Fix race in pnfs_wait_on_layoutreturn
  pinctrl: meson: fix gpio request disabling other modes
  btrfs: fix error handling when run_delayed_extent_op fails
  btrfs: fix locking when we put back a delayed ref that's too new
  x86/cpu: Fix bootup crashes by sanitizing the argument of the 'clearcpuid=' command-line option
  USB: serial: ch341: fix modem-control and B0 handling
  USB: serial: ch341: fix resume after reset
  drm/radeon: drop verde dpm quirks
  sysctl: Drop reference added by grab_header in proc_sys_readdir
  sysrq: attach sysrq handler correctly for 32-bit kernel
  tty/serial: atmel_serial: BUG: stop DMA from transmitting in stop_tx
  mnt: Protect the mountpoint hashtable with mount_lock
  vme: Fix wrong pointer utilization in ca91cx42_slave_get
  xhci: fix deadlock at host remove by running watchdog correctly
  i2c: fix kernel memory disclosure in dev interface
  i2c: print correct device invalid address
  Input: elants_i2c - avoid divide by 0 errors on bad touchscreen data
  USB: serial: ch341: fix open and resume after B0
  USB: serial: ch341: fix control-message error handling
  USB: serial: ch341: fix open error handling
  USB: serial: ch341: fix initial modem-control state
  USB: serial: kl5kusb105: fix line-state error handling
  nl80211: fix sched scan netlink socket owner destruction
  KVM: x86: Introduce segmented_write_std
  KVM: x86: emulate FXSAVE and FXRSTOR
  KVM: x86: add asm_safe wrapper
  KVM: x86: add Align16 instruction flag
  KVM: x86: flush pending lapic jump label updates on module unload
  jump_labels: API for flushing deferred jump label updates
  KVM: eventfd: fix NULL deref irqbypass consumer
  KVM: x86: fix emulation of "MOV SS, null selector"
  mm/hugetlb.c: fix reservation race when freeing surplus pages
  ocfs2: fix crash caused by stale lvb with fsdlm plugin
  mm: fix devm_memremap_pages crash, use mem_hotplug_{begin, done}
  selftests: do not require bash for the generated test
  selftests: do not require bash to run netsocktests testcase
  Input: i8042 - add Pegatron touchpad to noloop table
  Input: xpad - use correct product id for x360w controllers
  DEBUG: sched/fair: Fix sched_load_avg_cpu events for task_groups
  DEBUG: sched/fair: Fix missing sched_load_avg_cpu events
  net: socket: don't set sk_uid to garbage value in ->setattr()
  ANDROID: configs: CONFIG_ARM64_SW_TTBR0_PAN=y
  UPSTREAM: arm64: Disable PAN on uaccess_enable()
  UPSTREAM: arm64: Enable CONFIG_ARM64_SW_TTBR0_PAN
  UPSTREAM: arm64: xen: Enable user access before a privcmd hvc call
  UPSTREAM: arm64: Handle faults caused by inadvertent user access with PAN enabled
  BACKPORT: arm64: Disable TTBR0_EL1 during normal kernel execution
  BACKPORT: arm64: Introduce uaccess_{disable,enable} functionality based on TTBR0_EL1
  BACKPORT: arm64: Factor out TTBR0_EL1 post-update workaround into a specific asm macro
  BACKPORT: arm64: Factor out PAN enabling/disabling into separate uaccess_* macros
  UPSTREAM: arm64: alternative: add auto-nop infrastructure
  UPSTREAM: arm64: barriers: introduce nops and __nops macros for NOP sequences
  Revert "FROMLIST: arm64: Factor out PAN enabling/disabling into separate uaccess_* macros"
  Revert "FROMLIST: arm64: Factor out TTBR0_EL1 post-update workaround into a specific asm macro"
  Revert "FROMLIST: arm64: Introduce uaccess_{disable,enable} functionality based on TTBR0_EL1"
  Revert "FROMLIST: arm64: Disable TTBR0_EL1 during normal kernel execution"
  Revert "FROMLIST: arm64: Handle faults caused by inadvertent user access with PAN enabled"
  Revert "FROMLIST: arm64: xen: Enable user access before a privcmd hvc call"
  Revert "FROMLIST: arm64: Enable CONFIG_ARM64_SW_TTBR0_PAN"
  ANDROID: sched/walt: fix build failure if FAIR_GROUP_SCHED=n
  Linux 4.4.43
  mm/init: fix zone boundary creation
  ALSA: usb-audio: Add a quirk for Plantronics BT600
  spi: mvebu: fix baudrate calculation for armada variant
  ARM: OMAP4+: Fix bad fallthrough for cpuidle
  ARM: zynq: Reserve correct amount of non-DMA RAM
  powerpc: Fix build warning on 32-bit PPC
  ALSA: firewire-tascam: Fix to handle error from initialization of stream data
  HID: hid-cypress: validate length of report
  net: vrf: do not allow table id 0
  net: ipv4: Fix multipath selection with vrf
  gro: Disable frag0 optimization on IPv6 ext headers
  gro: use min_t() in skb_gro_reset_offset()
  gro: Enter slow-path if there is no tailroom
  r8152: fix rx issue for runtime suspend
  r8152: split rtl8152_suspend function
  ipv4: Do not allow MAIN to be alias for new LOCAL w/ custom rules
  igmp: Make igmp group member RFC 3376 compliant
  drop_monitor: consider inserted data in genlmsg_end
  drop_monitor: add missing call to genlmsg_end
  net/mlx5: Avoid shadowing numa_node
  net/mlx5: Check FW limitations on log_max_qp before setting it
  net: stmmac: Fix race between stmmac_drv_probe and stmmac_open
  net, sched: fix soft lockup in tc_classify
  ipv6: handle -EFAULT from skb_copy_bits
  net: vrf: Drop conntrack data after pass through VRF device on Tx
  ser_gigaset: return -ENOMEM on error instead of success
  netvsc: reduce maximum GSO size
  Linux 4.4.42
  usb: gadget: composite: always set ep->mult to a sensible value
  Revert "usb: gadget: composite: always set ep->mult to a sensible value"
  tick/broadcast: Prevent NULL pointer dereference
  drm/radeon: Always store CRTC relative radeon_crtc->cursor_x/y values
  cx23885-dvb: move initialization of a8293_pdata
  net: vxge: avoid unused function warnings
  net: ti: cpmac: Fix compiler warning due to type confusion
  cred/userns: define current_user_ns() as a function
  staging: comedi: dt282x: tidy up register bit defines
  powerpc/pci/rpadlpar: Fix device reference leaks
  md: MD_RECOVERY_NEEDED is set for mddev->recovery
  crypto: arm64/aes-ce - fix for big endian
  crypto: arm64/aes-xts-ce: fix for big endian
  crypto: arm64/sha1-ce - fix for big endian
  crypto: arm64/aes-neon - fix for big endian
  crypto: arm64/aes-ccm-ce: fix for big endian
  crypto: arm/aes-ce - fix for big endian
  crypto: arm64/ghash-ce - fix for big endian
  crypto: arm64/sha2-ce - fix for big endian
  s390/crypto: unlock on error in prng_tdes_read()
  mmc: mmc_test: Uninitialized return value
  PM / wakeirq: Fix dedicated wakeirq for drivers not using autosuspend
  irqchip/bcm7038-l1: Implement irq_cpu_offline() callback
  target/iscsi: Fix double free in lio_target_tiqn_addtpg()
  scsi: mvsas: fix command_active typo
  ASoC: samsung: i2s: Fixup last IRQ unsafe spin lock call
  iommu/vt-d: Flush old iommu caches for kdump when the device gets context mapped
  iommu/vt-d: Fix pasid table size encoding
  iommu/amd: Fix the left value check of cmd buffer
  iommu/amd: Missing error code in amd_iommu_init_device()
  clk: imx31: fix rewritten input argument of mx31_clocks_init()
  clk: clk-wm831x: fix a logic error
  hwmon: (g762) Fix overflows and crash seen when writing limit attributes
  hwmon: (nct7802) Fix overflows seen when writing into limit attributes
  hwmon: (ds620) Fix overflows seen when writing temperature limits
  hwmon: (amc6821) sign extension temperature
  hwmon: (scpi) Fix module autoload
  cris: Only build flash rescue image if CONFIG_ETRAX_AXISFLASHMAP is selected
  ath10k: use the right length of "background"
  stable-fixup: hotplug: fix unused function warning
  usb: dwc3: ep0: explicitly call dwc3_ep0_prepare_one_trb()
  usb: dwc3: ep0: add dwc3_ep0_prepare_one_trb()
  usb: dwc3: gadget: always unmap EP0 requests
  staging: iio: ad7606: fix improper setting of oversampling pins
  mei: bus: fix mei_cldev_enable KDoc
  USB: serial: io_ti: bind to interface after fw download
  USB: phy: am335x-control: fix device and of_node leaks
  ARM: dts: r8a7794: Correct hsusb parent clock
  USB: serial: kl5kusb105: abort on open exception path
  ALSA: usb-audio: Fix bogus error return in snd_usb_create_stream()
  usb: musb: blackfin: add bfin_fifo_offset in bfin_ops
  usb: hub: Move hub_port_disable() to fix warning if PM is disabled
  usb: musb: Fix trying to free already-free IRQ 4
  usb: dwc3: pci: add Intel Gemini Lake PCI ID
  xhci: Fix race related to abort operation
  xhci: Use delayed_work instead of timer for command timeout
  usb: xhci-mem: use passed in GFP flags instead of GFP_KERNEL
  USB: serial: mos7720: fix parallel probe
  USB: serial: mos7720: fix parport use-after-free on probe errors
  USB: serial: mos7720: fix use-after-free on probe errors
  USB: serial: mos7720: fix NULL-deref at open
  USB: serial: mos7840: fix NULL-deref at open
  USB: serial: kobil_sct: fix NULL-deref in write
  USB: serial: cyberjack: fix NULL-deref at open
  USB: serial: oti6858: fix NULL-deref at open
  USB: serial: io_edgeport: fix NULL-deref at open
  USB: serial: ti_usb_3410_5052: fix NULL-deref at open
  USB: serial: garmin_gps: fix memory leak on failed URB submit
  USB: serial: iuu_phoenix: fix NULL-deref at open
  USB: serial: io_ti: fix I/O after disconnect
  USB: serial: io_ti: fix another NULL-deref at open
  USB: serial: io_ti: fix NULL-deref at open
  USB: serial: spcp8x5: fix NULL-deref at open
  USB: serial: keyspan_pda: verify endpoints at probe
  USB: serial: pl2303: fix NULL-deref at open
  USB: serial: quatech2: fix sleep-while-atomic in close
  USB: serial: omninet: fix NULL-derefs at open and disconnect
  usb: xhci: hold lock over xhci_abort_cmd_ring()
  xhci: Handle command completion and timeout race
  usb: host: xhci: Fix possible wild pointer when handling abort command
  usb: xhci: fix return value of xhci_setup_device()
  xhci: free xhci virtual devices with leaf nodes first
  usb: xhci: apply XHCI_PME_STUCK_QUIRK to Intel Apollo Lake
  xhci: workaround for hosts missing CAS bit
  usb: xhci: fix possible wild pointer
  usb: dwc3: core: avoid Overflow events
  usb: gadget: composite: Test get_alt() presence instead of set_alt()
  USB: dummy-hcd: fix bug in stop_activity (handle ep0)
  USB: fix problems with duplicate endpoint addresses
  USB: gadgetfs: fix checks of wTotalLength in config descriptors
  USB: gadgetfs: fix use-after-free bug
  USB: gadgetfs: fix unbounded memory allocation bug
  usb: gadgetfs: restrict upper bound on device configuration size
  usb: storage: unusual_uas: Add JMicron JMS56x to unusual device
  usb: musb: dsps: implement clear_ep_rxintr() callback
  usb: musb: core: add clear_ep_rxintr() to musb_platform_ops
  KVM: MIPS: Flush KVM entry code from icache globally
  KVM: x86: reset MMU on KVM_SET_VCPU_EVENTS
  mac80211: initialize fast-xmit 'info' later
  ARM: davinci: da850: don't add emac clock to lookup table twice
  ALSA: usb-audio: Fix irq/process data synchronization
  ALSA: hda - Apply asus-mode8 fixup to ASUS X71SL
  ALSA: hda - Fix up GPIO for ASUS ROG Ranger
  Linux 4.4.41
  net: mvpp2: fix dma unmapping of TX buffers for fragments
  sg_write()/bsg_write() is not fit to be called under KERNEL_DS
  kconfig/nconf: Fix hang when editing symbol with a long prompt
  target/user: Fix use-after-free of tcmu_cmds if they are expired
  powerpc: Convert cmp to cmpd in idle enter sequence
  powerpc/ps3: Fix system hang with GCC 5 builds
  nfs_write_end(): fix handling of short copies
  libceph: verify authorize reply on connect
  PCI: Check for PME in targeted sleep state
  Input: drv260x - fix input device's parent assignment
  media: solo6x10: fix lockup by avoiding delayed register write
  IB/cma: Fix a race condition in iboe_addr_get_sgid()
  IB/multicast: Check ib_find_pkey() return value
  IPoIB: Avoid reading an uninitialized member variable
  IB/mad: Fix an array index check
  fgraph: Handle a case where a tracer ignores set_graph_notrace
  platform/x86: asus-nb-wmi.c: Add X45U quirk
  ftrace/x86_32: Set ftrace_stub to weak to prevent gcc from using short jumps to it
  kvm: nVMX: Allow L1 to intercept software exceptions (#BP and #OF)
  KVM: PPC: Book3S HV: Don't lose hardware R/C bit updates in H_PROTECT
  KVM: PPC: Book3S HV: Save/restore XER in checkpointed register state
  md/raid5: limit request size according to implementation limits
  sc16is7xx: Drop bogus use of IRQF_ONESHOT
  s390/vmlogrdr: fix IUCV buffer allocation
  firmware: fix usermode helper fallback loading
  ARC: mm: arc700: Don't assume 2 colours for aliasing VIPT dcache
  scsi: avoid a permanent stop of the scsi device's request queue
  scsi: zfcp: fix rport unblock race with LUN recovery
  scsi: zfcp: do not trace pure benign residual HBA responses at default level
  scsi: zfcp: fix use-after-"free" in FC ingress path after TMF
  scsi: megaraid_sas: Do not set MPI2_TYPE_CUDA for JBOD FP path for FW which does not support JBOD sequence map
  scsi: megaraid_sas: For SRIOV enabled firmware, ensure VF driver waits for 30secs before reset
  vt: fix Scroll Lock LED trigger name
  block: protect iterate_bdevs() against concurrent close
  mei: request async autosuspend at the end of enumeration
  drivers/gpu/drm/ast: Fix infinite loop if read fails
  drm/gma500: Add compat ioctl
  drm/radeon: add additional pci revision to dpm workaround
  drm/radeon: Hide the HW cursor while it's out of bounds
  drm/radeon: Also call cursor_move_locked when the cursor size changes
  drm/nouveau/i2c/gk110b,gm10x: use the correct implementation
  drm/nouveau/fifo/gf100-: protect channel preempt with subdev mutex
  drm/nouveau/ltc: protect clearing of comptags with mutex
  drm/nouveau/bios: require checksum to match for fast acpi shadow method
  drm/nouveau/kms: lvds panel strap moved again on maxwell
  ACPI / video: Add force_native quirk for HP Pavilion dv6
  ACPI / video: Add force_native quirk for Dell XPS 17 L702X
  staging: comedi: ni_mio_common: fix E series ni_ai_insn_read() data
  staging: comedi: ni_mio_common: fix M Series ni_ai_insn_read() data mask
  thermal: hwmon: Properly report critical temperature in sysfs
  clk: bcm2835: Avoid overwriting the div info when disabling a pll_div clk
  timekeeping_Force_unsigned_clocksource_to_nanoseconds_conversion
  regulator: stw481x-vmmc: fix ages old enable error
  mmc: sdhci: Fix recovery from tuning timeout
  ath9k: Really fix LED polarity for some Mini PCI AR9220 MB92 cards.
  cfg80211/mac80211: fix BSS leaks when abandoning assoc attempts
  rtlwifi: Fix enter/exit power_save
  ssb: Fix error routine when fallback SPROM fails
  Linux 4.4.40
  ppp: defer netns reference release for ppp channel
  driver core: fix race between creating/querying glue dir and its cleanup
  xfs: set AGI buffer type in xlog_recover_clear_agi_bucket
  arm/xen: Use alloc_percpu rather than __alloc_percpu
  xen/gntdev: Use VM_MIXEDMAP instead of VM_IO to avoid NUMA balancing
  tpm xen: Remove bogus tpm_chip_unregister
  kernel/debug/debug_core.c: more properly delay for secondary CPUs
  kernel/watchdog: use nmi registers snapshot in hardlockup handler
  CIFS: Fix a possible memory corruption in push locks
  CIFS: Fix missing nls unload in smb2_reconnect()
  CIFS: Fix a possible memory corruption during reconnect
  ASoC: intel: Fix crash at suspend/resume without card registration
  dm space map metadata: fix 'struct sm_metadata' leak on failed create
  dm crypt: mark key as invalid until properly loaded
  dm flakey: return -EINVAL on interval bounds error in flakey_ctr()
  blk-mq: Do not invoke .queue_rq() for a stopped queue
  usb: gadget: composite: always set ep->mult to a sensible value
  exec: Ensure mm->user_ns contains the execed files
  fs: exec: apply CLOEXEC before changing dumpable task flags
  mm/vmscan.c: set correct defer count for shrinker
  loop: return proper error from loop_queue_rq()
  f2fs: set ->owner for debugfs status file's file_operations
  ext4: do not perform data journaling when data is encrypted
  ext4: return -ENOMEM instead of success
  ext4: reject inodes with negative size
  ext4: add sanity checking to count_overhead()
  ext4: fix in-superblock mount options processing
  ext4: use more strict checks for inodes_per_block on mount
  ext4: fix stack memory corruption with 64k block size
  ext4: fix mballoc breakage with 64k block size
  crypto: caam - fix AEAD givenc descriptors
  ptrace: Capture the ptracer's creds not PT_PTRACE_CAP
  mm: Add a user_ns owner to mm_struct and fix ptrace permission checks
  block_dev: don't test bdev->bd_contains when it is not stable
  btrfs: make file clone aware of fatal signals
  Btrfs: don't BUG() during drop snapshot
  Btrfs: fix memory leak in do_walk_down
  Btrfs: don't leak reloc root nodes on error
  Btrfs: return gracefully from balance if fs tree is corrupted
  Btrfs: bail out if block group has different mixed flag
  Btrfs: fix memory leak in reading btree blocks
  clk: ti: omap36xx: Work around sprz319 advisory 2.1
  ALSA: hda: when comparing pin configurations, ignore assoc in addition to seq
  ALSA: hda - Gate the mic jack on HP Z1 Gen3 AiO
  ALSA: hda - fix headset-mic problem on a Dell laptop
  ALSA: hda - ignore the assoc and seq when comparing pin configurations
  ALSA: hda/ca0132 - Add quirk for Alienware 15 R2 2016
  ALSA: hiface: Fix M2Tech hiFace driver sampling rate change
  ALSA: usb-audio: Add QuickCam Communicate Deluxe/S7500 to volume_control_quirks
  USB: UHCI: report non-PME wakeup signalling for Intel hardware
  usb: gadget: composite: correctly initialize ep->maxpacket
  usb: gadget: f_uac2: fix error handling at afunc_bind
  usb: hub: Fix auto-remount of safely removed or ejected USB-3 devices
  USB: cdc-acm: add device id for GW Instek AFG-125
  USB: serial: kl5kusb105: fix open error path
  USB: serial: option: add dlink dwm-158
  USB: serial: option: add support for Telit LE922A PIDs 0x1040, 0x1041
  Btrfs: fix qgroup rescan worker initialization
  btrfs: store and load values of stripes_min/stripes_max in balance status item
  Btrfs: fix tree search logic when replaying directory entry deletes
  btrfs: limit async_work allocation and worker func duration
  ANDROID: trace: net: use %pK for kernel pointers
  ANDROID: android-base: Enable QUOTA related configs
  net: ipv4: Don't crash if passing a null sk to ip_rt_update_pmtu.
  net: inet: Support UID-based routing in IP protocols.
  Revert "net: ipv6: fix virtual tunneling build"
  net: core: add UID to flows, rules, and routes
  net: core: Add a UID field to struct sock.
  Revert "net: core: Support UID-based routing."
  Revert "net: core: Handle 'sk' being NULL in UID-based routing"
  Revert "ANDROID: net: fix 'const' warnings"
  Revert "ANDROID: net: fib: remove duplicate assignment"
  Revert "ANDROID: net: core: fix UID-based routing"
  UPSTREAM: efi/arm64: Don't apply MEMBLOCK_NOMAP to UEFI memory map mapping
  UPSTREAM: arm64: enable CONFIG_DEBUG_RODATA by default
  goldfish: enable CONFIG_INET_DIAG_DESTROY
  sched/walt: kill {min,max}_capacity
  sched: fix wrong truncation of walt_avg
  ANDROID: dm verity: add minimum prefetch size
  Linux 4.4.39
  crypto: rsa - Add Makefile dependencies to fix parallel builds
  hotplug: Make register and unregister notifier API symmetric
  batman-adv: Check for alloc errors when preparing TT local data
  m68k: Fix ndelay() macro
  arm64: futex.h: Add missing PAN toggling
  can: peak: fix bad memory access and free sequence
  can: raw: raw_setsockopt: limit number of can_filter that can be set
  crypto: mcryptd - Check mcryptd algorithm compatibility
  perf/x86: Fix full width counter, counter overflow
  locking/rtmutex: Use READ_ONCE() in rt_mutex_owner()
  locking/rtmutex: Prevent dequeue vs. unlock race
  zram: restrict add/remove attributes to root only
  parisc: Fix TLB related boot crash on SMP machines
  parisc: Remove unnecessary TLB purges from flush_dcache_page_asm and flush_icache_page_asm
  parisc: Purge TLB before setting PTE
  powerpc/eeh: Fix deadlock when PE frozen state can't be cleared

Conflicts:
	arch/arm64/kernel/traps.c
	drivers/usb/dwc3/core.h
	drivers/usb/dwc3/ep0.c
	drivers/usb/gadget/function/f_fs.c
	drivers/usb/host/xhci-mem.c
	drivers/usb/host/xhci-ring.c
	drivers/usb/host/xhci.c
	drivers/video/fbdev/core/fbcmap.c
	include/trace/events/sched.h
	mm/vmscan.c

Change-Id: I3faa0010ecb98972cd8e6470377a493b56d95f89
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
Signed-off-by: Runmin Wang <runminw@codeaurora.org>
 2017-03-18 08:55:10 -07:00
Arnd Geis
c670e18f7c misc: mnh: MIPI driver updates 
Added support for 1776Mbps (240fps) mode
Added IOCTL for mipi shutdown
Updated configuration settings
Added polling loop for PHY_STOPSTATE in the host controller

Change-Id: I1a9630495b114bd8085af740e3035e636eb97b4c
Signed-off-by: Arnd Geis <arndg@google.com>
 2017-03-17 07:15:36 -07:00
Prasad Sodagudi
99c4750fe5 epoll: Drop struct epoll_event definition 
Add kernel header sanitizer check to drop struct epoll_event.
This struct epoll_event is not following the POSIX standard
and defining element in opaque data type.

Change-Id: I1eecef1b64eb1fb8f0dd6999263093a453e7b9fb
Signed-off-by: Prasad Sodagudi <psodagud@codeaurora.org>
 2017-03-14 09:18:53 -07:00
Trevor Bunker
963f042c3e Revert "misc: mnh: reduce number of states and ioctls" 
commit 68c04e60ba ("misc: mnh: reduce number of states and ioctls")

Change-Id: Ibe23e1b273f2e3f8b3316c47f7576ed14fe65b51
Signed-off-by: Trevor Bunker <trevorbunker@google.com>
 2017-03-13 13:17:53 -07:00
Linux Build Service Account
b283538d68 Merge "msm: mdss: Add support to update backlight when display commit" 2017-03-13 11:50:05 -07:00
Trevor Bunker
68c04e60ba misc: mnh: reduce number of states and ioctls 
Also, refactor DDR init, suspend, and resume so it is not performed
during power-on sequencing. This allows us to configure MIPI
immediately, and do DDR sequencing and booting in parallel with other
camera HAL operations.

Change-Id: Ie9f16ea4f3e7af42651002f333156b14f832159f
Signed-off-by: Trevor Bunker <trevorbunker@google.com>
 2017-03-13 10:42:01 -07:00
Linux Build Service Account
4c2c203412 Merge "msm: wlan: Define CFG80211_CONNECT_TIMEOUT_REASON_CODE" 2017-03-10 11:05:05 -08:00
Linux Build Service Account
0799e92cbd Merge "msm: vidc: Fix masking of QP values for different codecs in driver" 2017-03-10 02:07:16 -08:00