632 Commits

Author SHA1 Message Date
Bruno Martins
9162135978 Merge branch 'deprecated/android-4.9-q' of https://android.googlesource.com/kernel/common into HEAD
Conflicts:
	arch/arm/Makefile
	arch/arm/include/asm/unistd.h
	arch/arm/kernel/calls.S
	arch/arm64/include/asm/assembler.h
	arch/arm64/include/asm/cputype.h
	arch/arm64/kernel/bpi.S
	arch/arm64/kernel/cpu_errata.c
	arch/arm64/kernel/setup.c
	arch/arm64/kernel/vdso.c
	arch/arm64/mm/proc.S
	arch/mips/include/uapi/asm/Kbuild
	arch/powerpc/include/uapi/asm/Kbuild
	drivers/char/Kconfig
	drivers/char/random.c
	drivers/clk/qcom/clk-rcg2.c
	drivers/gpu/drm/drm_edid.c
	drivers/irqchip/irq-gic.c
	drivers/md/dm-table.c
	drivers/media/dvb-core/dmxdev.c
	drivers/mmc/core/core.c
	drivers/mmc/core/host.c
	drivers/mmc/core/mmc.c
	drivers/mmc/host/sdhci.c
	drivers/net/usb/lan78xx.c
	drivers/scsi/ufs/ufs_quirks.h
	drivers/scsi/ufs/ufshcd.c
	drivers/staging/android/ion/ion-ioctl.c
	drivers/staging/android/ion/ion.c
	drivers/staging/android/ion/ion_priv.h
	drivers/staging/android/ion/ion_system_heap.c
	drivers/tty/tty_io.c
	drivers/usb/core/hub.c
	drivers/usb/core/usb.h
	drivers/usb/dwc3/core.c
	drivers/usb/dwc3/gadget.c
	drivers/usb/gadget/composite.c
	drivers/usb/gadget/configfs.c
	drivers/usb/gadget/function/f_accessory.c
	drivers/usb/gadget/function/rndis.c
	drivers/usb/gadget/function/rndis.h
	fs/eventpoll.c
	fs/ext4/namei.c
	fs/fat/fatent.c
	fs/gfs2/acl.c
	include/linux/random.h
	include/uapi/drm/Kbuild
	include/uapi/linux/Kbuild
	include/uapi/linux/cifs/Kbuild
	include/uapi/linux/genwqe/Kbuild
	kernel/cpu.c
	kernel/exit.c
	kernel/sched/cpufreq_schedutil.c
	lib/Makefile
	lib/string.c
	mm/memory.c
	mm/page-writeback.c
	mm/page_alloc.c
	net/ipv4/udp.c
	net/ipv6/datagram.c
	net/ipv6/ip6_output.c
	net/netfilter/nf_conntrack_irc.c
	net/netfilter/xt_quota2.c
	net/netlink/genetlink.c
	security/selinux/avc.c
	security/selinux/include/objsec.h
	sound/core/compress_offload.c

Change-Id: I41982a5a8e22a21b72ec5dfa61a3680be66213f4
2023-03-26 12:09:00 +01:00
Greg Kroah-Hartman
3193623ef6 Merge 4.9.335 into android-4.9-q
Changes in 4.9.335
	wifi: mac80211_hwsim: fix debugfs attribute ps with rc table support
	audit: fix undefined behavior in bit shift for AUDIT_BIT
	wifi: mac80211: Fix ack frame idr leak when mesh has no route
	MIPS: pic32: treat port as signed integer
	af_key: Fix send_acquire race with pfkey_register
	bus: sunxi-rsb: Support atomic transfers
	ARM: dts: at91: sam9g20ek: enable udc vbus gpio pinctrl
	nfc/nci: fix race with opening and closing
	net: pch_gbe: fix potential memleak in pch_gbe_tx_queue()
	9p/fd: fix issue of list_del corruption in p9_fd_cancel()
	ARM: mxs: fix memory leak in mxs_machine_init()
	net/mlx4: Check retval of mlx4_bitmap_init
	net/qla3xxx: fix potential memleak in ql3xxx_send()
	xfrm: Fix ignored return value in xfrm6_init()
	NFC: nci: fix memory leak in nci_rx_data_packet()
	nfc: st-nci: fix incorrect validating logic in EVT_TRANSACTION
	nfc: st-nci: fix memory leaks in EVT_TRANSACTION
	net: thunderx: Fix the ACPI memory leak
	s390/crashdump: fix TOD programmable field size
	iio: light: apds9960: fix wrong register for gesture gain
	iio: core: Fix entry not deleted when iio_register_sw_trigger_type() fails
	kconfig: display recursive dependency resolution hint just once
	nios2: add FORCE for vmlinuz.gz
	nilfs2: fix nilfs_sufile_mark_dirty() not set segment usage as dirty
	serial: 8250: 8250_omap: Avoid RS485 RTS glitch on ->set_termios()
	xen/platform-pci: add missing free_irq() in error path
	platform/x86: asus-wmi: add missing pci_dev_put() in asus_wmi_set_xusb2pr()
	tcp: configurable source port perturb table size
	net: usb: qmi_wwan: add Telit 0x103a composition
	drm/amdgpu: always register an MMU notifier for userptr
	iio: health: afe4403: Fix oob read in afe4403_read_raw
	iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw
	hwmon: (i5500_temp) fix missing pci_disable_device()
	hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails
	net/mlx5: Fix uninitialized variable bug in outlen_write()
	can: sja1000_isa: sja1000_isa_probe(): add missing free_sja1000dev()
	can: cc770: cc770_isa_probe(): add missing free_cc770dev()
	qlcnic: fix sleep-in-atomic-context bugs caused by msleep
	net: phy: fix null-ptr-deref while probe() failed
	net: net_netdev: Fix error handling in ntb_netdev_init_module()
	net/9p: Fix a potential socket leak in p9_socket_open
	net: hsr: Fix potential use-after-free
	packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE
	net: ethernet: renesas: ravb: Fix promiscuous mode after system resumed
	hwmon: (coretemp) Check for null before removing sysfs attrs
	hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()
	btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit()
	tools/vm/slabinfo-gnuplot: use "grep -E" instead of "egrep"
	nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()
	arm64: Fix panic() when Spectre-v2 causes Spectre-BHB to re-allocate KVM vectors
	arm64: errata: Fix KVM Spectre-v2 mitigation selection for Cortex-A57/A72
	ASoC: ops: Fix bounds check for _sx controls
	pinctrl: single: Fix potential division by zero
	iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init()
	tcp/udp: Fix memory leak in ipv6_renew_options().
	Revert "fbdev: fb_pm2fb: Avoid potential divide by zero error"
	x86/tsx: Add a feature bit for TSX control MSR support
	x86/pm: Add enumeration check before spec MSRs save/restore setup
	Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM
	x86/ioremap: Fix page aligned size calculation in __ioremap_caller()
	proc: avoid integer type confusion in get_proc_long
	proc: proc_skip_spaces() shouldn't think it is working on C strings
	v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() fails
	Linux 4.9.335

Change-Id: I5a99e366191f445d4de1039f5e82812b37787842
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2022-12-08 10:48:04 +00:00
Linus Torvalds
6e3644aca0 proc: proc_skip_spaces() shouldn't think it is working on C strings
commit bce9332220bd677d83b19d21502776ad555a0e73 upstream.

proc_skip_spaces() seems to think it is working on C strings, and ends
up being just a wrapper around skip_spaces() with a really odd calling
convention.

Instead of basing it on skip_spaces(), it should have looked more like
proc_skip_char(), which really is the exact same function (except it
skips a particular character, rather than whitespace).  So use that as
inspiration, odd coding and all.

Now the calling convention actually makes sense and works for the
intended purpose.

Reported-and-tested-by: Kyle Zeng <zengyhkyle@gmail.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-12-08 11:15:42 +01:00
Linus Torvalds
32646215df proc: avoid integer type confusion in get_proc_long
commit e6cfaf34be9fcd1a8285a294e18986bfc41a409c upstream.

proc_get_long() is passed a size_t, but then assigns it to an 'int'
variable for the length.  Let's not do that, even if our IO paths are
limited to MAX_RW_COUNT (exactly because of these kinds of type errors).

So do the proper test in the rigth type.

Reported-by: Kyle Zeng <zengyhkyle@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-12-08 11:15:42 +01:00
Michael Bestas
6762b4659d Revert "Add toggle for disabling newly added USB devices"
This reverts commit c3e80ec97d.

Change-Id: I87caa32a8b6e535682edb8fb2557d8bce718ebf8
2022-04-02 01:11:41 +02:00
Greg Kroah-Hartman
bf0024db2f Merge 4.9.306 into android-4.9-q
Changes in 4.9.306
	x86/speculation: Add RETPOLINE_AMD support to the inline asm CALL_NOSPEC variant
	x86/retpoline: Make CONFIG_RETPOLINE depend on compiler support
	x86/retpoline: Remove minimal retpoline support
	Documentation: Add section about CPU vulnerabilities for Spectre
	Documentation: Add swapgs description to the Spectre v1 documentation
	Documentation: refer to config RANDOMIZE_BASE for kernel address-space randomization
	x86/speculation: Merge one test in spectre_v2_user_select_mitigation()
	x86,bugs: Unconditionally allow spectre_v2=retpoline,amd
	x86/speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE
	x86/speculation: Add eIBRS + Retpoline options
	Documentation/hw-vuln: Update spectre doc
	x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting
	x86/speculation: Use generic retpoline by default on AMD
	x86/speculation: Update link to AMD speculation whitepaper
	x86/speculation: Warn about Spectre v2 LFENCE mitigation
	x86/speculation: Warn about eIBRS + LFENCE + Unprivileged eBPF + SMT
	arm/arm64: Provide a wrapper for SMCCC 1.1 calls
	arm/arm64: smccc/psci: add arm_smccc_1_1_get_conduit()
	ARM: report Spectre v2 status through sysfs
	ARM: early traps initialisation
	ARM: use LOADADDR() to get load address of sections
	ARM: Spectre-BHB workaround
	ARM: include unprivileged BPF status in Spectre V2 reporting
	ARM: fix build error when BPF_SYSCALL is disabled
	ARM: fix co-processor register typo
	ARM: Do not use NOCROSSREFS directive with ld.lld
	x86/build: Fix compiler support check for CONFIG_RETPOLINE
	x86, modpost: Replace last remnants of RETPOLINE with CONFIG_RETPOLINE
	ARM: fix build warning in proc-v7-bugs.c
	xen/xenbus: don't let xenbus_grant_ring() remove grants in error case
	xen/grant-table: add gnttab_try_end_foreign_access()
	xen/blkfront: don't use gnttab_query_foreign_access() for mapped status
	xen/netfront: don't use gnttab_query_foreign_access() for mapped status
	xen/scsifront: don't use gnttab_query_foreign_access() for mapped status
	xen/gntalloc: don't use gnttab_query_foreign_access()
	xen: remove gnttab_query_foreign_access()
	xen/gnttab: fix gnttab_end_foreign_access() without page specified
	xen/netfront: react properly to failing gnttab_end_foreign_access_ref()
	Linux 4.9.306

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I8083a622bda3bf4418f266a34c96d8175bc5e933
2022-03-11 11:10:37 +01:00
Josh Poimboeuf
6481835a9a x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting
commit 44a3918c8245ab10c6c9719dd12e7a8d291980d8 upstream.

With unprivileged eBPF enabled, eIBRS (without retpoline) is vulnerable
to Spectre v2 BHB-based attacks.

When both are enabled, print a warning message and report it in the
'spectre_v2' sysfs vulnerabilities file.

Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
[fllinden@amazon.com: backported to 4.19]
Signed-off-by: Frank van der Linden <fllinden@amazon.com>
[bwh: Backported to 4.9: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-03-11 10:03:31 +01:00
Daniel Micay
c3e80ec97d Add toggle for disabling newly added USB devices
Based on the public grsecurity patches.

Change-Id: I2cbea91b351cda7d098f4e1aa73dff1acbd23cce
Signed-off-by: Daniel Micay <danielmicay@gmail.com>
2022-02-23 22:14:50 +01:00
Greg Kroah-Hartman
c5804dccaf Merge 4.9.302 into android-4.9-q
Changes in 4.9.302
	integrity: check the return value of audit_log_start()
	ima: Remove ima_policy file before directory
	NFS: Fix initialisation of nfs_client cl_flags field
	NFSD: Clamp WRITE offsets
	Input: i8042 - Fix misplaced backport of "add ASUS Zenbook Flip to noselftest list"
	serial: sh-sci: Fix misplaced backport of "Fix late enablement of AUTORTS"
	ALSA: line6: Fix misplaced backport of "Fix wrong altsetting for LINE6_PODHD500_1"
	Revert "net: axienet: Wait for PhyRstCmplt after core reset"
	NFSv4 only print the label when its queried
	nfs: nfs4clinet: check the return value of kstrdup()
	NFSv4 remove zero number of fs_locations entries error check
	scsi: target: iscsi: Make sure the np under each tpg is unique
	usb: dwc2: gadget: don't try to disable ep0 in dwc2_hsotg_suspend
	ARM: dts: imx23-evk: Remove MX23_PAD_SSP1_DETECT from hog group
	staging: fbtft: Fix error path in fbtft_driver_module_init()
	ARM: dts: imx6qdl-udoo: Properly describe the SD card detect
	bonding: pair enable_port with slave_arr_updates
	ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path
	net: do not keep the dst cache when uncloning an skb dst and its metadata
	net: fix a memleak when uncloning an skb dst and its metadata
	tipc: rate limit warning for received illegal binding update
	vt_ioctl: fix array_index_nospec in vt_setactivate
	vt_ioctl: add array_index_nospec to VT_ACTIVATE
	bpf: Add kconfig knob for disabling unpriv bpf by default
	n_tty: wake up poll(POLLRDNORM) on receiving data
	usb: dwc3: gadget: Prevent core from processing stale TRBs
	USB: gadget: validate interface OS descriptor requests
	usb: gadget: rndis: check size of RNDIS_MSG_SET command
	USB: serial: ftdi_sio: add support for Brainboxes US-159/235/320
	USB: serial: option: add ZTE MF286D modem
	USB: serial: ch341: add support for GW Instek USB2.0-Serial devices
	USB: serial: cp210x: add NCR Retail IO box id
	USB: serial: cp210x: add CPI Bulk Coin Recycler id
	hwmon: (dell-smm) Speed up setting of fan speed
	HID: wacom: add USB_HID dependency
	Linux 4.9.302

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I5ad6e897d8683da99cddfdca9df1863f389345f2
2022-02-16 13:00:09 +01:00
Daniel Borkmann
b6ef4bc38b bpf: Add kconfig knob for disabling unpriv bpf by default
commit 08389d888287c3823f80b0216766b71e17f0aba5 upstream.

Add a kconfig knob which allows for unprivileged bpf to be disabled by default.
If set, the knob sets /proc/sys/kernel/unprivileged_bpf_disabled to value of 2.

This still allows a transition of 2 -> {0,1} through an admin. Similarly,
this also still keeps 1 -> {1} behavior intact, so that once set to permanently
disabled, it cannot be undone aside from a reboot.

We've also added extra2 with max of 2 for the procfs handler, so that an admin
still has a chance to toggle between 0 <-> 2.

Either way, as an additional alternative, applications can make use of CAP_BPF
that we added a while ago.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/74ec548079189e4e4dffaeb42b8987bb3c852eee.1620765074.git.daniel@iogearbox.net
[fllinden@amazon.com: backported to 4.9]
Signed-off-by: Frank van der Linden <fllinden@amazon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-02-16 12:43:54 +01:00
Greg Kroah-Hartman
65f1d995dc Merge 4.9.230 into android-4.9-q
Changes in 4.9.230
	btrfs: fix a block group ref counter leak after failure to remove block group
	btrfs: cow_file_range() num_bytes and disk_num_bytes are same
	btrfs: fix data block group relocation failure due to concurrent scrub
	mm: fix swap cache node allocation mask
	EDAC/amd64: Read back the scrub rate PCI register on F15h
	usbnet: smsc95xx: Fix use-after-free after removal
	mm/slub.c: fix corrupted freechain in deactivate_slab()
	mm/slub: fix stack overruns with SLUB_STATS
	usb: usbtest: fix missing kfree(dev->buf) in usbtest_disconnect
	kgdb: Avoid suspicious RCU usage warning
	crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock()
	sched/rt: Show the 'sched_rr_timeslice' SCHED_RR timeslice tuning knob in milliseconds
	cxgb4: parse TC-U32 key values and masks natively
	hwmon: (max6697) Make sure the OVERT mask is set correctly
	hwmon: (acpi_power_meter) Fix potential memory leak in acpi_power_meter_add()
	virtio-blk: free vblk-vqs in error path of virtblk_probe()
	i2c: algo-pca: Add 0x78 as SCL stuck low status for PCA9665
	Revert "ALSA: usb-audio: Improve frames size computation"
	SMB3: Honor 'seal' flag for multiuser mounts
	SMB3: Honor persistent/resilient handle flags for multiuser mounts
	cifs: Fix the target file was deleted when rename failed.
	MIPS: Add missing EHB in mtc0 -> mfc0 sequence for DSPen
	netfilter: nf_conntrack_h323: lost .data_len definition for Q.931/ipv6
	efi: Make it possible to disable efivar_ssdt entirely
	Linux 4.9.230

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Idfb59ec0247f0e8ba270f56daa689ee6f68d54bc
2020-07-09 10:45:42 +02:00
Shile Zhang
0c199348cf sched/rt: Show the 'sched_rr_timeslice' SCHED_RR timeslice tuning knob in milliseconds
[ Upstream commit 975e155ed8732cb81f55c021c441ae662dd040b5 ]

We added the 'sched_rr_timeslice_ms' SCHED_RR tuning knob in this commit:

  ce0dbbbb30 ("sched/rt: Add a tuning knob to allow changing SCHED_RR timeslice")

... which name suggests to users that it's in milliseconds, while in reality
it's being set in milliseconds but the result is shown in jiffies.

This is obviously confusing when HZ is not 1000, it makes it appear like the
value set failed, such as HZ=100:

  root# echo 100 > /proc/sys/kernel/sched_rr_timeslice_ms
  root# cat /proc/sys/kernel/sched_rr_timeslice_ms
  10

Fix this to be milliseconds all around.

Signed-off-by: Shile Zhang <shile.zhang@nokia.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Mike Galbraith <efault@gmx.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/1485612049-20923-1-git-send-email-shile.zhang@nokia.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-07-09 09:35:55 +02:00
jianzhou
c30521f5b6 Merge android-4.9.208(9759f95) into msm-4.9
* refs/heads/tmp-9759f95:
  Linux 4.9.208
  gtp: avoid zero size hashtable
  gtp: fix wrong condition in gtp_genl_dump_pdp()
  tcp: do not send empty skb from tcp_write_xmit()
  tcp/dccp: fix possible race __inet_lookup_established()
  vhost/vsock: accept only packets with the right dst_cid
  net: ena: fix napi handler misbehavior when the napi budget is zero
  mmc: sdhci: Update the tuning failed messages to pr_debug level
  pinctrl: baytrail: Really serialize all register accesses
  tty/serial: atmel: fix out of range clock divider handling
  hrtimer: Annotate lockless access to timer->state
  net: icmp: fix data-race in cmp_global_allow()
  netfilter: bridge: make sure to pull arp header in br_nf_forward_arp()
  6pack,mkiss: fix possible deadlock
  netfilter: ebtables: compat: reject all padding in matches/watchers
  filldir[64]: remove WARN_ON_ONCE() for bad directory entries
  Make filldir[64]() verify the directory entry filename is valid
  perf strbuf: Remove redundant va_end() in strbuf_addv()
  ALSA: hda - Downgrade error message for single-cmd fallback
  net, sysctl: Fix compiler warning when only cBPF is present
  x86/mce: Fix possibly incorrect severity calculation on AMD
  kernel: sysctl: make drop_caches write-only
  ocfs2: fix passing zero to 'PTR_ERR' warning
  s390/cpum_sf: Check for SDBT and SDB consistency
  libfdt: define INT32_MAX and UINT32_MAX in libfdt_env.h
  perf regs: Make perf_reg_name() return "unknown" instead of NULL
  cdrom: respect device capabilities during opening action
  scripts/kallsyms: fix definitely-lost memory leak
  gpio: mpc8xxx: Don't overwrite default irq_set_type callback
  scsi: target: iscsi: Wait for all commands to finish before freeing a session
  scsi: scsi_debug: num_tgts must be >= 0
  scsi: pm80xx: Fix for SATA device discovery
  ext4: work around deleting a file with i_nlink == 0 safely
  HID: Improve Windows Precision Touchpad detection.
  bcache: at least try to shrink 1 node in bch_mca_scan()
  clk: pxa: fix one of the pxa RTC clocks
  scsi: atari_scsi: sun3_scsi: Set sg_tablesize to 1 instead of SG_NONE
  powerpc/security: Fix wrong message when RFI Flush is disable
  powerpc/pseries/cmm: Implement release() function for sysfs device
  scsi: ufs: fix potential bug which ends in system hang
  scsi: lpfc: fix: Coverity: lpfc_cmpl_els_rsp(): Null pointer dereferences
  fs/quota: handle overflows of sysctl fs.quota.* and report as unsigned long
  irqchip: ingenic: Error out if IRQ domain creation failed
  irqchip/irq-bcm7038-l1: Enable parent IRQ if necessary
  clk: qcom: Allow constant ratio freq tables for rcg
  scsi: lpfc: Fix duplicate unreg_rpi error in port offline flow
  scsi: tracing: Fix handling of TRANSFER LENGTH == 0 for READ(6) and WRITE(6)
  jbd2: Fix statistics for the number of logged blocks
  powerpc/book3s64/hash: Add cond_resched to avoid soft lockup warning
  powerpc/security/book3s64: Report L1TF status in sysfs
  clocksource/drivers/asm9260: Add a check for of_clk_get
  dma-debug: add a schedule point in debug_dma_dump_mappings()
  powerpc/pseries: Don't fail hash page table insert for bolted mapping
  powerpc/pseries: Mark accumulate_stolen_time() as notrace
  scsi: csiostor: Don't enable IRQs too early
  scsi: lpfc: Fix SLI3 hba in loop mode not discovering devices
  scsi: target: compare full CHAP_A Algorithm strings
  iommu/tegra-smmu: Fix page tables in > 4 GiB memory
  Input: atmel_mxt_ts - disable IRQ across suspend
  scsi: lpfc: Fix locking on mailbox command completion
  scsi: mpt3sas: Fix clear pending bit in ioctl status
  perf probe: Fix to show function entry line as probe-able
  mmc: sdhci-of-esdhc: fix P2020 errata handling
  powerpc/irq: fix stack overflow verification
  ext4: check for directory entries too close to block end
  ext4: fix ext4_empty_dir() for directories with holes
  staging: comedi: gsc_hpdi: check dma_alloc_coherent() return value
  platform/x86: hp-wmi: Make buffer for HPWMI_FEATURE2_QUERY 128 bytes
  USB: EHCI: Do not return -EPIPE when hub is disconnected
  usbip: Fix error path of vhci_recv_ret_submit()
  net: dst: Force 4-byte alignment of dst_metrics
  sctp: fully initialize v4 addr in some functions
  net: usb: lan78xx: Fix suspend/resume PHY register access error
  net: qlogic: Fix error paths in ql_alloc_large_buffers()
  net: nfc: nci: fix a possible sleep-in-atomic-context bug in nci_uart_tty_receive()
  net: hisilicon: Fix a BUG trigered by wrong bytes_compl
  mod_devicetable: fix PHY module format
  fjes: fix missed check in fjes_acpi_add
  af_packet: set defaule value for tmo
  Btrfs: fix removal logic of the tree mod log that leads to use-after-free issues
  btrfs: abort transaction after failed inode updates in create_subvol
  btrfs: return error pointer from alloc_test_extent_buffer
  btrfs: do not call synchronize_srcu() in inode_tree_del
  btrfs: don't double lock the subvol_sem for rename exchange
  usb: xhci: Fix build warning seen with CONFIG_PM=n
  Revert "mmc: sdhci: Fix incorrect switch to HS mode"
  btrfs: don't prematurely free work in reada_start_machine_worker()
  net: phy: initialise phydev speed and duplex sanely
  libtraceevent: Fix memory leakage in copy_filter_type
  crypto: vmx - Avoid weird build failures
  crypto: sun4i-ss - Fix 64-bit size_t warnings on sun4i-ss-hash.c
  fbtft: Make sure string is NULL terminated
  iwlwifi: check kasprintf() return value
  x86/insn: Add some Intel instructions to the opcode map
  spi: st-ssc4: add missed pm_runtime_disable
  btrfs: don't prematurely free work in run_ordered_work()
  btrfs: don't prematurely free work in end_workqueue_fn()
  mmc: tmio: Add MMC_CAP_ERASE to allow erase/discard/trim requests
  spi: tegra20-slink: add missed clk_unprepare
  iwlwifi: mvm: fix unaligned read of rx_pkt_status
  x86/crash: Add a forward declaration of struct kimage
  cpufreq: Register drivers only after CPU devices have been registered
  parport: load lowlevel driver if ports not found
  s390/disassembler: don't hide instruction addresses
  ASoC: rt5677: Mark reg RT5677_PWR_ANLG2 as volatile
  spi: pxa2xx: Add missed security checks
  EDAC/ghes: Fix grain calculation
  media: si470x-i2c: add missed operations in remove
  media: pvrusb2: Fix oops on tear-down when radio support is not present
  ath10k: fix get invalid tx rate for Mesh metric
  perf probe: Filter out instances except for inlined subroutine and subprogram
  perf probe: Skip end-of-sequence and non statement lines
  perf probe: Fix to show calling lines of inlined functions
  perf probe: Return a better scope DIE if there is no best scope
  perf probe: Skip overlapped location on searching variables
  perf probe: Fix to probe a function which has no entry pc
  perf probe: Fix to show inlined function callsite without entry_pc
  perf probe: Fix to show ranges of variables in functions without entry_pc
  perf probe: Fix to probe an inline function which has no entry pc
  perf probe: Walk function lines in lexical blocks
  perf probe: Fix to list probe event with correct line number
  perf probe: Fix to find range-only function instance
  rtlwifi: fix memory leak in rtl92c_set_fw_rsvdpagepkt()
  ALSA: timer: Limit max amount of slave instances
  spi: img-spfi: fix potential double release
  bnx2x: Fix PF-VF communication over multi-cos queues.
  Bluetooth: Fix advertising duplicated flags
  pinctrl: sh-pfc: sh7734: Fix duplicate TCLK1_B
  libata: Ensure ata_port probe has completed before detach
  arm64: psci: Reduce the waiting time for cpu_psci_cpu_kill()
  x86/ioapic: Prevent inconsistent state when moving an interrupt
  rtl8xxxu: fix RTL8723BU connection failure issue after warm reboot
  drm/gma500: fix memory disclosures due to uninitialized bytes
  x86/mce: Lower throttling MCE messages' priority to warning
  Bluetooth: hci_core: fix init for HCI_USER_CHANNEL
  iio: adc: max1027: Reset the device at probe time
  usb: usbfs: Suppress problematic bind and unbind uevents.
  perf report: Add warning when libunwind not compiled in
  perf test: Report failure for mmap events
  x86/mm: Use the correct function type for native_set_fixmap()
  extcon: sm5502: Reset registers during initialization
  media: ti-vpe: vpe: Make sure YUYV is set as default format
  media: ti-vpe: vpe: fix a v4l2-compliance failure about frame sequence number
  media: ti-vpe: vpe: fix a v4l2-compliance warning about invalid pixel format
  mwifiex: pcie: Fix memory leak in mwifiex_pcie_init_evt_ring
  samples: pktgen: fix proc_cmd command result check logic
  media: cec-funcs.h: add status_req checks
  media: flexcop-usb: fix NULL-ptr deref in flexcop_usb_transfer_init()
  regulator: max8907: Fix the usage of uninitialized variable in max8907_regulator_probe()
  hwrng: omap3-rom - Call clk_disable_unprepare() on exit only if not idled
  usb: renesas_usbhs: add suspend event support in gadget mode
  tools/power/cpupower: Fix initializer override in hsw_ext_cstates
  media: ov6650: Fix stored frame format not in sync with hardware
  media: i2c: ov2659: Fix missing 720p register config
  media: i2c: ov2659: fix s_stream return value
  media: am437x-vpfe: Setting STD to current value is not an error
  IB/iser: bound protection_sg size by data_sg size
  libertas: fix a potential NULL pointer dereference
  rtlwifi: prevent memory leak in rtl_usb_probe
  staging: rtl8188eu: fix possible null dereference
  staging: rtl8192u: fix multiple memory leaks on error path
  spi: Add call to spi_slave_abort() function when spidev driver is released
  iio: light: bh1750: Resolve compiler warning and make code more readable
  drm/bridge: analogix-anx78xx: silence -EPROBE_DEFER warnings
  drm: mst: Fix query_payload ack reply struct
  ALSA: hda/ca0132 - Avoid endless loop
  ALSA: hda/ca0132 - Keep power on during processing DSP response
  ALSA: pcm: Avoid possible info leaks from PCM stream buffers
  btrfs: handle ENOENT in btrfs_uuid_tree_iterate
  btrfs: do not leak reloc root if we fail to read the fs root
  btrfs: skip log replay on orphaned roots
  UPSTREAM: HID: input: map digitizer battery usage
  ANDROID: cuttlefish_defconfig: Disable TRANSPARENT_HUGEPAGE

 Conflicts:
	arch/arm64/kernel/psci.c
	kernel/time/hrtimer.c

Change-Id: I01dd0697e8a78a5046d5513c2dcd1c6e28ef0328
Signed-off-by: jianzhou <jianzhou@codeaurora.org>
2020-03-12 15:59:20 +08:00
Greg Kroah-Hartman
9759f952fd Merge 4.9.208 into android-4.9-q
Changes in 4.9.208
	btrfs: skip log replay on orphaned roots
	btrfs: do not leak reloc root if we fail to read the fs root
	btrfs: handle ENOENT in btrfs_uuid_tree_iterate
	ALSA: pcm: Avoid possible info leaks from PCM stream buffers
	ALSA: hda/ca0132 - Keep power on during processing DSP response
	ALSA: hda/ca0132 - Avoid endless loop
	drm: mst: Fix query_payload ack reply struct
	drm/bridge: analogix-anx78xx: silence -EPROBE_DEFER warnings
	iio: light: bh1750: Resolve compiler warning and make code more readable
	spi: Add call to spi_slave_abort() function when spidev driver is released
	staging: rtl8192u: fix multiple memory leaks on error path
	staging: rtl8188eu: fix possible null dereference
	rtlwifi: prevent memory leak in rtl_usb_probe
	libertas: fix a potential NULL pointer dereference
	IB/iser: bound protection_sg size by data_sg size
	media: am437x-vpfe: Setting STD to current value is not an error
	media: i2c: ov2659: fix s_stream return value
	media: i2c: ov2659: Fix missing 720p register config
	media: ov6650: Fix stored frame format not in sync with hardware
	tools/power/cpupower: Fix initializer override in hsw_ext_cstates
	usb: renesas_usbhs: add suspend event support in gadget mode
	hwrng: omap3-rom - Call clk_disable_unprepare() on exit only if not idled
	regulator: max8907: Fix the usage of uninitialized variable in max8907_regulator_probe()
	media: flexcop-usb: fix NULL-ptr deref in flexcop_usb_transfer_init()
	media: cec-funcs.h: add status_req checks
	samples: pktgen: fix proc_cmd command result check logic
	mwifiex: pcie: Fix memory leak in mwifiex_pcie_init_evt_ring
	media: ti-vpe: vpe: fix a v4l2-compliance warning about invalid pixel format
	media: ti-vpe: vpe: fix a v4l2-compliance failure about frame sequence number
	media: ti-vpe: vpe: Make sure YUYV is set as default format
	extcon: sm5502: Reset registers during initialization
	x86/mm: Use the correct function type for native_set_fixmap()
	perf test: Report failure for mmap events
	perf report: Add warning when libunwind not compiled in
	usb: usbfs: Suppress problematic bind and unbind uevents.
	iio: adc: max1027: Reset the device at probe time
	Bluetooth: hci_core: fix init for HCI_USER_CHANNEL
	x86/mce: Lower throttling MCE messages' priority to warning
	drm/gma500: fix memory disclosures due to uninitialized bytes
	rtl8xxxu: fix RTL8723BU connection failure issue after warm reboot
	x86/ioapic: Prevent inconsistent state when moving an interrupt
	arm64: psci: Reduce the waiting time for cpu_psci_cpu_kill()
	libata: Ensure ata_port probe has completed before detach
	pinctrl: sh-pfc: sh7734: Fix duplicate TCLK1_B
	Bluetooth: Fix advertising duplicated flags
	bnx2x: Fix PF-VF communication over multi-cos queues.
	spi: img-spfi: fix potential double release
	ALSA: timer: Limit max amount of slave instances
	rtlwifi: fix memory leak in rtl92c_set_fw_rsvdpagepkt()
	perf probe: Fix to find range-only function instance
	perf probe: Fix to list probe event with correct line number
	perf probe: Walk function lines in lexical blocks
	perf probe: Fix to probe an inline function which has no entry pc
	perf probe: Fix to show ranges of variables in functions without entry_pc
	perf probe: Fix to show inlined function callsite without entry_pc
	perf probe: Fix to probe a function which has no entry pc
	perf probe: Skip overlapped location on searching variables
	perf probe: Return a better scope DIE if there is no best scope
	perf probe: Fix to show calling lines of inlined functions
	perf probe: Skip end-of-sequence and non statement lines
	perf probe: Filter out instances except for inlined subroutine and subprogram
	ath10k: fix get invalid tx rate for Mesh metric
	media: pvrusb2: Fix oops on tear-down when radio support is not present
	media: si470x-i2c: add missed operations in remove
	EDAC/ghes: Fix grain calculation
	spi: pxa2xx: Add missed security checks
	ASoC: rt5677: Mark reg RT5677_PWR_ANLG2 as volatile
	s390/disassembler: don't hide instruction addresses
	parport: load lowlevel driver if ports not found
	cpufreq: Register drivers only after CPU devices have been registered
	x86/crash: Add a forward declaration of struct kimage
	iwlwifi: mvm: fix unaligned read of rx_pkt_status
	spi: tegra20-slink: add missed clk_unprepare
	mmc: tmio: Add MMC_CAP_ERASE to allow erase/discard/trim requests
	btrfs: don't prematurely free work in end_workqueue_fn()
	btrfs: don't prematurely free work in run_ordered_work()
	spi: st-ssc4: add missed pm_runtime_disable
	x86/insn: Add some Intel instructions to the opcode map
	iwlwifi: check kasprintf() return value
	fbtft: Make sure string is NULL terminated
	crypto: sun4i-ss - Fix 64-bit size_t warnings on sun4i-ss-hash.c
	crypto: vmx - Avoid weird build failures
	libtraceevent: Fix memory leakage in copy_filter_type
	net: phy: initialise phydev speed and duplex sanely
	btrfs: don't prematurely free work in reada_start_machine_worker()
	Revert "mmc: sdhci: Fix incorrect switch to HS mode"
	usb: xhci: Fix build warning seen with CONFIG_PM=n
	btrfs: don't double lock the subvol_sem for rename exchange
	btrfs: do not call synchronize_srcu() in inode_tree_del
	btrfs: return error pointer from alloc_test_extent_buffer
	btrfs: abort transaction after failed inode updates in create_subvol
	Btrfs: fix removal logic of the tree mod log that leads to use-after-free issues
	af_packet: set defaule value for tmo
	fjes: fix missed check in fjes_acpi_add
	mod_devicetable: fix PHY module format
	net: hisilicon: Fix a BUG trigered by wrong bytes_compl
	net: nfc: nci: fix a possible sleep-in-atomic-context bug in nci_uart_tty_receive()
	net: qlogic: Fix error paths in ql_alloc_large_buffers()
	net: usb: lan78xx: Fix suspend/resume PHY register access error
	sctp: fully initialize v4 addr in some functions
	net: dst: Force 4-byte alignment of dst_metrics
	usbip: Fix error path of vhci_recv_ret_submit()
	USB: EHCI: Do not return -EPIPE when hub is disconnected
	platform/x86: hp-wmi: Make buffer for HPWMI_FEATURE2_QUERY 128 bytes
	staging: comedi: gsc_hpdi: check dma_alloc_coherent() return value
	ext4: fix ext4_empty_dir() for directories with holes
	ext4: check for directory entries too close to block end
	powerpc/irq: fix stack overflow verification
	mmc: sdhci-of-esdhc: fix P2020 errata handling
	perf probe: Fix to show function entry line as probe-able
	scsi: mpt3sas: Fix clear pending bit in ioctl status
	scsi: lpfc: Fix locking on mailbox command completion
	Input: atmel_mxt_ts - disable IRQ across suspend
	iommu/tegra-smmu: Fix page tables in > 4 GiB memory
	scsi: target: compare full CHAP_A Algorithm strings
	scsi: lpfc: Fix SLI3 hba in loop mode not discovering devices
	scsi: csiostor: Don't enable IRQs too early
	powerpc/pseries: Mark accumulate_stolen_time() as notrace
	powerpc/pseries: Don't fail hash page table insert for bolted mapping
	dma-debug: add a schedule point in debug_dma_dump_mappings()
	clocksource/drivers/asm9260: Add a check for of_clk_get
	powerpc/security/book3s64: Report L1TF status in sysfs
	powerpc/book3s64/hash: Add cond_resched to avoid soft lockup warning
	jbd2: Fix statistics for the number of logged blocks
	scsi: tracing: Fix handling of TRANSFER LENGTH == 0 for READ(6) and WRITE(6)
	scsi: lpfc: Fix duplicate unreg_rpi error in port offline flow
	clk: qcom: Allow constant ratio freq tables for rcg
	irqchip/irq-bcm7038-l1: Enable parent IRQ if necessary
	irqchip: ingenic: Error out if IRQ domain creation failed
	fs/quota: handle overflows of sysctl fs.quota.* and report as unsigned long
	scsi: lpfc: fix: Coverity: lpfc_cmpl_els_rsp(): Null pointer dereferences
	scsi: ufs: fix potential bug which ends in system hang
	powerpc/pseries/cmm: Implement release() function for sysfs device
	powerpc/security: Fix wrong message when RFI Flush is disable
	scsi: atari_scsi: sun3_scsi: Set sg_tablesize to 1 instead of SG_NONE
	clk: pxa: fix one of the pxa RTC clocks
	bcache: at least try to shrink 1 node in bch_mca_scan()
	HID: Improve Windows Precision Touchpad detection.
	ext4: work around deleting a file with i_nlink == 0 safely
	scsi: pm80xx: Fix for SATA device discovery
	scsi: scsi_debug: num_tgts must be >= 0
	scsi: target: iscsi: Wait for all commands to finish before freeing a session
	gpio: mpc8xxx: Don't overwrite default irq_set_type callback
	scripts/kallsyms: fix definitely-lost memory leak
	cdrom: respect device capabilities during opening action
	perf regs: Make perf_reg_name() return "unknown" instead of NULL
	libfdt: define INT32_MAX and UINT32_MAX in libfdt_env.h
	s390/cpum_sf: Check for SDBT and SDB consistency
	ocfs2: fix passing zero to 'PTR_ERR' warning
	kernel: sysctl: make drop_caches write-only
	x86/mce: Fix possibly incorrect severity calculation on AMD
	net, sysctl: Fix compiler warning when only cBPF is present
	ALSA: hda - Downgrade error message for single-cmd fallback
	perf strbuf: Remove redundant va_end() in strbuf_addv()
	Make filldir[64]() verify the directory entry filename is valid
	filldir[64]: remove WARN_ON_ONCE() for bad directory entries
	netfilter: ebtables: compat: reject all padding in matches/watchers
	6pack,mkiss: fix possible deadlock
	netfilter: bridge: make sure to pull arp header in br_nf_forward_arp()
	net: icmp: fix data-race in cmp_global_allow()
	hrtimer: Annotate lockless access to timer->state
	tty/serial: atmel: fix out of range clock divider handling
	pinctrl: baytrail: Really serialize all register accesses
	mmc: sdhci: Update the tuning failed messages to pr_debug level
	net: ena: fix napi handler misbehavior when the napi budget is zero
	vhost/vsock: accept only packets with the right dst_cid
	tcp/dccp: fix possible race __inet_lookup_established()
	tcp: do not send empty skb from tcp_write_xmit()
	gtp: fix wrong condition in gtp_genl_dump_pdp()
	gtp: avoid zero size hashtable
	Linux 4.9.208

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2020-01-04 13:57:22 +01:00
Johannes Weiner
b231f9db5e kernel: sysctl: make drop_caches write-only
[ Upstream commit 204cb79ad42f015312a5bbd7012d09c93d9b46fb ]

Currently, the drop_caches proc file and sysctl read back the last value
written, suggesting this is somehow a stateful setting instead of a
one-time command.  Make it write-only, like e.g.  compact_memory.

While mitigating a VM problem at scale in our fleet, there was confusion
about whether writing to this file will permanently switch the kernel into
a non-caching mode.  This influences the decision making in a tense
situation, where tens of people are trying to fix tens of thousands of
affected machines: Do we need a rollback strategy?  What are the
performance implications of operating in a non-caching state for several
days?  It also caused confusion when the kernel team said we may need to
write the file several times to make sure it's effective ("But it already
reads back 3?").

Link: http://lkml.kernel.org/r/20191031221602.9375-1-hannes@cmpxchg.org
Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
Acked-by: Chris Down <chris@chrisdown.name>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Acked-by: David Hildenbrand <david@redhat.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Acked-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-01-04 13:41:04 +01:00
jianzhou
31d65a6aa1 Merge android-4.9.183 (a80a7ab) into msm-4.9
* refs/heads/tmp-a80a7ab:
  Linux 4.9.183
  Abort file_remove_privs() for non-reg. files
  mlxsw: spectrum: Prevent force of 56G
  scsi: libsas: delete sas port if expander discover failed
  scsi: smartpqi: properly set both the DMA mask and the coherent DMA mask
  scsi: libcxgbi: add a check for NULL pointer in cxgbi_check_route()
  net: sh_eth: fix mdio access in sh_eth_close() for R-Car Gen2 and RZ/A1 SoCs
  KVM: PPC: Book3S HV: Don't take kvm->lock around kvm_for_each_vcpu
  KVM: PPC: Book3S: Use new mutex to synchronize access to rtas token list
  ia64: fix build errors by exporting paddr_to_nid()
  perf record: Fix s390 missing module symbol and warning for non-root users
  perf data: Fix 'strncat may truncate' build failure with recent gcc
  configfs: Fix use-after-free when accessing sd->s_dentry
  i2c: dev: fix potential memory leak in i2cdev_ioctl_rdwr
  net: tulip: de4x5: Drop redundant MODULE_DEVICE_TABLE()
  gpio: fix gpio-adp5588 build errors
  perf/ring_buffer: Add ordering to rb->nest increment
  perf/ring_buffer: Fix exposing a temporarily decreased data_head
  x86/CPU/AMD: Don't force the CPB cap when running under a hypervisor
  mISDN: make sure device name is NUL terminated
  selftests: netfilter: missing error check when setting up veth interface
  perf/x86/intel/ds: Fix EVENT vs. UEVENT PEBS constraints
  Revert "staging: vc04_services: prevent integer overflow in create_pagelist()"
  sunhv: Fix device naming inconsistency between sunhv_console and sunhv_reg
  neigh: fix use-after-free read in pneigh_get_next
  lapb: fixed leak of control-blocks.
  ipv6: flowlabel: fl6_sock_lookup() must use atomic_inc_not_zero
  be2net: Fix number of Rx queues used for flow hashing
  ax25: fix inconsistent lock state in ax25_destroy_timer
  rtc: pcf8523: don't return invalid date when battery is low
  USB: serial: option: add Telit 0x1260 and 0x1261 compositions
  USB: serial: option: add support for Simcom SIM7500/SIM7600 RNDIS mode
  USB: serial: pl2303: add Allied Telesis VT-Kit3
  USB: usb-storage: Add new ID to ums-realtek
  USB: Fix chipmunk-like voice when using Logitech C270 for recording audio.
  usb: dwc2: Fix DMA cache alignment issues
  drm/vmwgfx: NULL pointer dereference from vmw_cmd_dx_view_define()
  drm/vmwgfx: integer underflow in vmw_cmd_dx_set_shader() leading to an invalid read
  KVM: s390: fix memory slot handling for KVM_SET_USER_MEMORY_REGION
  KVM: x86/pmu: do not mask the value that is written to fixed PMUs
  usbnet: ipheth: fix racing condition
  selftests/timers: Add missing fflush(stdout) calls
  scsi: bnx2fc: fix incorrect cast to u64 on shift operation
  arm64/mm: Inhibit huge-vmap with ptdump
  scsi: lpfc: add check for loss of ndlp when sending RRQ
  Drivers: misc: fix out-of-bounds access in function param_set_kgdbts_var
  Revert "ALSA: seq: Protect in-kernel ioctl calls with mutex"
  ALSA: seq: Fix race of get-subscription call vs port-delete ioctls
  ALSA: seq: Protect in-kernel ioctl calls with mutex
  x86/uaccess, kcov: Disable stack protector
  ASoC: fsl_asrc: Fix the issue about unsupported rate
  ASoC: cs42xx8: Add regcache mask dirty
  cgroup: Use css_tryget() instead of css_tryget_online() in task_get_css()
  bcache: fix stack corruption by PRECEDING_KEY()
  i2c: acorn: fix i2c warning
  media: v4l2-ioctl: clear fields in s_parm
  ptrace: restore smp_rmb() in __ptrace_may_access()
  signal/ptrace: Don't leak unitialized kernel memory with PTRACE_PEEK_SIGINFO
  fs/ocfs2: fix race in ocfs2_dentry_attach_lock()
  mm/list_lru.c: fix memory leak in __memcg_init_list_lru_node
  libata: Extend quirks for the ST1000LM024 drives with NOLPM quirk
  ALSA: oxfw: allow PCM capture for Stanton SCS.1m
  ALSA: seq: Cover unsubscribe_port() in list_mutex
  Revert "Bluetooth: Align minimum encryption key size for LE and BR/EDR connections"
  ARM: exynos: Fix undefined instruction during Exynos5422 resume
  pwm: Fix deadlock warning when removing PWM device
  ARM: dts: exynos: Always enable necessary APIO_1V8 and ABB_1V8 regulators on Arndale Octa
  pwm: tiehrpwm: Update shadow register for disabling PWMs
  dmaengine: idma64: Use actual device for DMA transfers
  gpio: gpio-omap: add check for off wake capable gpios
  PCI: xilinx: Check for __get_free_pages() failure
  video: imsttfb: fix potential NULL pointer dereferences
  video: hgafb: fix potential NULL pointer dereference
  PCI: rcar: Fix 64bit MSI message address handling
  PCI: rcar: Fix a potential NULL pointer dereference
  platform/x86: intel_pmc_ipc: adding error handling
  PCI: rpadlpar: Fix leaked device_node references in add/remove paths
  ARM: dts: imx6qdl: Specify IMX6QDL_CLK_IPG as "ipg" clock to SDMA
  ARM: dts: imx6sx: Specify IMX6SX_CLK_IPG as "ipg" clock to SDMA
  ARM: dts: imx6ul: Specify IMX6UL_CLK_IPG as "ipg" clock to SDMA
  ARM: dts: imx7d: Specify IMX7D_CLK_IPG as "ipg" clock to SDMA
  ARM: dts: imx6sx: Specify IMX6SX_CLK_IPG as "ahb" clock to SDMA
  clk: rockchip: Turn on "aclk_dmac1" for suspend on rk3288
  soc: mediatek: pwrap: Zero initialize rdata in pwrap_init_cipher
  platform/chrome: cros_ec_proto: check for NULL transfer function
  x86/PCI: Fix PCI IRQ routing table memory leak
  nfsd: allow fh_want_write to be called twice
  fuse: retrieve: cap requested size to negotiated max_write
  nvmem: core: fix read buffer in place
  ALSA: hda - Register irq handler after the chip initialization
  iommu/vt-d: Set intel_iommu_gfx_mapped correctly
  watchdog: fix compile time error of pretimeout governors
  watchdog: imx2_wdt: Fix set_timeout for big timeout values
  uml: fix a boot splat wrt use of cpu_all_mask
  configfs: fix possible use-after-free in configfs_register_group
  f2fs: fix to do sanity check on valid block count of segment
  f2fs: fix to clear dirty inode in error path of f2fs_iget()
  f2fs: fix to avoid panic in do_recover_data()
  ntp: Allow TAI-UTC offset to be set to zero
  pwm: meson: Use the spin-lock only to protect register modifications
  objtool: Don't use ignore flag for fake jumps
  drm/bridge: adv7511: Fix low refresh rate selection
  perf/x86/intel: Allow PEBS multi-entry in watermark mode
  mfd: twl6040: Fix device init errors for ACCCTL register
  mfd: intel-lpss: Set the device in reset state when init
  mfd: tps65912-spi: Add missing of table registration
  drivers: thermal: tsens: Don't print error message on -EPROBE_DEFER
  kernel/sys.c: prctl: fix false positive in validate_prctl_map()
  mm/slab.c: fix an infinite loop in leaks_show()
  mm/cma_debug.c: fix the break condition in cma_maxchunk_get()
  mm/cma.c: fix crash on CMA allocation if bitmap allocation fails
  mem-hotplug: fix node spanned pages when we have a node with only ZONE_MOVABLE
  hugetlbfs: on restore reserve error path retain subpool reservation
  ARM: prevent tracing IPI_CPU_BACKTRACE
  ipc: prevent lockup on alloc_msg and free_msg
  sysctl: return -EINVAL if val violates minmax
  fs/fat/file.c: issue flush after the writeback of FAT
  rapidio: fix a NULL pointer dereference when create_workqueue() fails
  ANDROID: kernel: cgroup: cpuset: Clear cpus_requested for empty buf
  ANDROID: kernel: cgroup: cpuset: Add missing allocation of cpus_requested in alloc_trial_cpuset
  mm: memcontrol: fix NULL pointer crash in test_clear_page_writeback()

Change-Id: I770e617e5d63461d0e9a8ff3a9bc94af8e6a4966
Signed-off-by: jianzhou <jianzhou@codeaurora.org>
2019-08-07 16:30:28 +08:00
Greg Kroah-Hartman
a0b21f86b2 Merge 4.9.183 into android-4.9-q
Changes in 4.9.183
	rapidio: fix a NULL pointer dereference when create_workqueue() fails
	fs/fat/file.c: issue flush after the writeback of FAT
	sysctl: return -EINVAL if val violates minmax
	ipc: prevent lockup on alloc_msg and free_msg
	ARM: prevent tracing IPI_CPU_BACKTRACE
	hugetlbfs: on restore reserve error path retain subpool reservation
	mem-hotplug: fix node spanned pages when we have a node with only ZONE_MOVABLE
	mm/cma.c: fix crash on CMA allocation if bitmap allocation fails
	mm/cma_debug.c: fix the break condition in cma_maxchunk_get()
	mm/slab.c: fix an infinite loop in leaks_show()
	kernel/sys.c: prctl: fix false positive in validate_prctl_map()
	drivers: thermal: tsens: Don't print error message on -EPROBE_DEFER
	mfd: tps65912-spi: Add missing of table registration
	mfd: intel-lpss: Set the device in reset state when init
	mfd: twl6040: Fix device init errors for ACCCTL register
	perf/x86/intel: Allow PEBS multi-entry in watermark mode
	drm/bridge: adv7511: Fix low refresh rate selection
	objtool: Don't use ignore flag for fake jumps
	pwm: meson: Use the spin-lock only to protect register modifications
	ntp: Allow TAI-UTC offset to be set to zero
	f2fs: fix to avoid panic in do_recover_data()
	f2fs: fix to clear dirty inode in error path of f2fs_iget()
	f2fs: fix to do sanity check on valid block count of segment
	configfs: fix possible use-after-free in configfs_register_group
	uml: fix a boot splat wrt use of cpu_all_mask
	watchdog: imx2_wdt: Fix set_timeout for big timeout values
	watchdog: fix compile time error of pretimeout governors
	iommu/vt-d: Set intel_iommu_gfx_mapped correctly
	ALSA: hda - Register irq handler after the chip initialization
	nvmem: core: fix read buffer in place
	fuse: retrieve: cap requested size to negotiated max_write
	nfsd: allow fh_want_write to be called twice
	x86/PCI: Fix PCI IRQ routing table memory leak
	platform/chrome: cros_ec_proto: check for NULL transfer function
	soc: mediatek: pwrap: Zero initialize rdata in pwrap_init_cipher
	clk: rockchip: Turn on "aclk_dmac1" for suspend on rk3288
	ARM: dts: imx6sx: Specify IMX6SX_CLK_IPG as "ahb" clock to SDMA
	ARM: dts: imx7d: Specify IMX7D_CLK_IPG as "ipg" clock to SDMA
	ARM: dts: imx6ul: Specify IMX6UL_CLK_IPG as "ipg" clock to SDMA
	ARM: dts: imx6sx: Specify IMX6SX_CLK_IPG as "ipg" clock to SDMA
	ARM: dts: imx6qdl: Specify IMX6QDL_CLK_IPG as "ipg" clock to SDMA
	PCI: rpadlpar: Fix leaked device_node references in add/remove paths
	platform/x86: intel_pmc_ipc: adding error handling
	PCI: rcar: Fix a potential NULL pointer dereference
	PCI: rcar: Fix 64bit MSI message address handling
	video: hgafb: fix potential NULL pointer dereference
	video: imsttfb: fix potential NULL pointer dereferences
	PCI: xilinx: Check for __get_free_pages() failure
	gpio: gpio-omap: add check for off wake capable gpios
	dmaengine: idma64: Use actual device for DMA transfers
	pwm: tiehrpwm: Update shadow register for disabling PWMs
	ARM: dts: exynos: Always enable necessary APIO_1V8 and ABB_1V8 regulators on Arndale Octa
	pwm: Fix deadlock warning when removing PWM device
	ARM: exynos: Fix undefined instruction during Exynos5422 resume
	Revert "Bluetooth: Align minimum encryption key size for LE and BR/EDR connections"
	ALSA: seq: Cover unsubscribe_port() in list_mutex
	ALSA: oxfw: allow PCM capture for Stanton SCS.1m
	libata: Extend quirks for the ST1000LM024 drives with NOLPM quirk
	mm/list_lru.c: fix memory leak in __memcg_init_list_lru_node
	fs/ocfs2: fix race in ocfs2_dentry_attach_lock()
	signal/ptrace: Don't leak unitialized kernel memory with PTRACE_PEEK_SIGINFO
	ptrace: restore smp_rmb() in __ptrace_may_access()
	media: v4l2-ioctl: clear fields in s_parm
	i2c: acorn: fix i2c warning
	bcache: fix stack corruption by PRECEDING_KEY()
	cgroup: Use css_tryget() instead of css_tryget_online() in task_get_css()
	ASoC: cs42xx8: Add regcache mask dirty
	ASoC: fsl_asrc: Fix the issue about unsupported rate
	x86/uaccess, kcov: Disable stack protector
	ALSA: seq: Protect in-kernel ioctl calls with mutex
	ALSA: seq: Fix race of get-subscription call vs port-delete ioctls
	Revert "ALSA: seq: Protect in-kernel ioctl calls with mutex"
	Drivers: misc: fix out-of-bounds access in function param_set_kgdbts_var
	scsi: lpfc: add check for loss of ndlp when sending RRQ
	arm64/mm: Inhibit huge-vmap with ptdump
	scsi: bnx2fc: fix incorrect cast to u64 on shift operation
	selftests/timers: Add missing fflush(stdout) calls
	usbnet: ipheth: fix racing condition
	KVM: x86/pmu: do not mask the value that is written to fixed PMUs
	KVM: s390: fix memory slot handling for KVM_SET_USER_MEMORY_REGION
	drm/vmwgfx: integer underflow in vmw_cmd_dx_set_shader() leading to an invalid read
	drm/vmwgfx: NULL pointer dereference from vmw_cmd_dx_view_define()
	usb: dwc2: Fix DMA cache alignment issues
	USB: Fix chipmunk-like voice when using Logitech C270 for recording audio.
	USB: usb-storage: Add new ID to ums-realtek
	USB: serial: pl2303: add Allied Telesis VT-Kit3
	USB: serial: option: add support for Simcom SIM7500/SIM7600 RNDIS mode
	USB: serial: option: add Telit 0x1260 and 0x1261 compositions
	rtc: pcf8523: don't return invalid date when battery is low
	ax25: fix inconsistent lock state in ax25_destroy_timer
	be2net: Fix number of Rx queues used for flow hashing
	ipv6: flowlabel: fl6_sock_lookup() must use atomic_inc_not_zero
	lapb: fixed leak of control-blocks.
	neigh: fix use-after-free read in pneigh_get_next
	sunhv: Fix device naming inconsistency between sunhv_console and sunhv_reg
	Revert "staging: vc04_services: prevent integer overflow in create_pagelist()"
	perf/x86/intel/ds: Fix EVENT vs. UEVENT PEBS constraints
	selftests: netfilter: missing error check when setting up veth interface
	mISDN: make sure device name is NUL terminated
	x86/CPU/AMD: Don't force the CPB cap when running under a hypervisor
	perf/ring_buffer: Fix exposing a temporarily decreased data_head
	perf/ring_buffer: Add ordering to rb->nest increment
	gpio: fix gpio-adp5588 build errors
	net: tulip: de4x5: Drop redundant MODULE_DEVICE_TABLE()
	i2c: dev: fix potential memory leak in i2cdev_ioctl_rdwr
	configfs: Fix use-after-free when accessing sd->s_dentry
	perf data: Fix 'strncat may truncate' build failure with recent gcc
	perf record: Fix s390 missing module symbol and warning for non-root users
	ia64: fix build errors by exporting paddr_to_nid()
	KVM: PPC: Book3S: Use new mutex to synchronize access to rtas token list
	KVM: PPC: Book3S HV: Don't take kvm->lock around kvm_for_each_vcpu
	net: sh_eth: fix mdio access in sh_eth_close() for R-Car Gen2 and RZ/A1 SoCs
	scsi: libcxgbi: add a check for NULL pointer in cxgbi_check_route()
	scsi: smartpqi: properly set both the DMA mask and the coherent DMA mask
	scsi: libsas: delete sas port if expander discover failed
	mlxsw: spectrum: Prevent force of 56G
	Abort file_remove_privs() for non-reg. files
	Linux 4.9.183

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2019-06-22 08:56:18 +02:00
Greg Kroah-Hartman
a80a7ab5f7 Merge 4.9.183 into android-4.9
Changes in 4.9.183
	rapidio: fix a NULL pointer dereference when create_workqueue() fails
	fs/fat/file.c: issue flush after the writeback of FAT
	sysctl: return -EINVAL if val violates minmax
	ipc: prevent lockup on alloc_msg and free_msg
	ARM: prevent tracing IPI_CPU_BACKTRACE
	hugetlbfs: on restore reserve error path retain subpool reservation
	mem-hotplug: fix node spanned pages when we have a node with only ZONE_MOVABLE
	mm/cma.c: fix crash on CMA allocation if bitmap allocation fails
	mm/cma_debug.c: fix the break condition in cma_maxchunk_get()
	mm/slab.c: fix an infinite loop in leaks_show()
	kernel/sys.c: prctl: fix false positive in validate_prctl_map()
	drivers: thermal: tsens: Don't print error message on -EPROBE_DEFER
	mfd: tps65912-spi: Add missing of table registration
	mfd: intel-lpss: Set the device in reset state when init
	mfd: twl6040: Fix device init errors for ACCCTL register
	perf/x86/intel: Allow PEBS multi-entry in watermark mode
	drm/bridge: adv7511: Fix low refresh rate selection
	objtool: Don't use ignore flag for fake jumps
	pwm: meson: Use the spin-lock only to protect register modifications
	ntp: Allow TAI-UTC offset to be set to zero
	f2fs: fix to avoid panic in do_recover_data()
	f2fs: fix to clear dirty inode in error path of f2fs_iget()
	f2fs: fix to do sanity check on valid block count of segment
	configfs: fix possible use-after-free in configfs_register_group
	uml: fix a boot splat wrt use of cpu_all_mask
	watchdog: imx2_wdt: Fix set_timeout for big timeout values
	watchdog: fix compile time error of pretimeout governors
	iommu/vt-d: Set intel_iommu_gfx_mapped correctly
	ALSA: hda - Register irq handler after the chip initialization
	nvmem: core: fix read buffer in place
	fuse: retrieve: cap requested size to negotiated max_write
	nfsd: allow fh_want_write to be called twice
	x86/PCI: Fix PCI IRQ routing table memory leak
	platform/chrome: cros_ec_proto: check for NULL transfer function
	soc: mediatek: pwrap: Zero initialize rdata in pwrap_init_cipher
	clk: rockchip: Turn on "aclk_dmac1" for suspend on rk3288
	ARM: dts: imx6sx: Specify IMX6SX_CLK_IPG as "ahb" clock to SDMA
	ARM: dts: imx7d: Specify IMX7D_CLK_IPG as "ipg" clock to SDMA
	ARM: dts: imx6ul: Specify IMX6UL_CLK_IPG as "ipg" clock to SDMA
	ARM: dts: imx6sx: Specify IMX6SX_CLK_IPG as "ipg" clock to SDMA
	ARM: dts: imx6qdl: Specify IMX6QDL_CLK_IPG as "ipg" clock to SDMA
	PCI: rpadlpar: Fix leaked device_node references in add/remove paths
	platform/x86: intel_pmc_ipc: adding error handling
	PCI: rcar: Fix a potential NULL pointer dereference
	PCI: rcar: Fix 64bit MSI message address handling
	video: hgafb: fix potential NULL pointer dereference
	video: imsttfb: fix potential NULL pointer dereferences
	PCI: xilinx: Check for __get_free_pages() failure
	gpio: gpio-omap: add check for off wake capable gpios
	dmaengine: idma64: Use actual device for DMA transfers
	pwm: tiehrpwm: Update shadow register for disabling PWMs
	ARM: dts: exynos: Always enable necessary APIO_1V8 and ABB_1V8 regulators on Arndale Octa
	pwm: Fix deadlock warning when removing PWM device
	ARM: exynos: Fix undefined instruction during Exynos5422 resume
	Revert "Bluetooth: Align minimum encryption key size for LE and BR/EDR connections"
	ALSA: seq: Cover unsubscribe_port() in list_mutex
	ALSA: oxfw: allow PCM capture for Stanton SCS.1m
	libata: Extend quirks for the ST1000LM024 drives with NOLPM quirk
	mm/list_lru.c: fix memory leak in __memcg_init_list_lru_node
	fs/ocfs2: fix race in ocfs2_dentry_attach_lock()
	signal/ptrace: Don't leak unitialized kernel memory with PTRACE_PEEK_SIGINFO
	ptrace: restore smp_rmb() in __ptrace_may_access()
	media: v4l2-ioctl: clear fields in s_parm
	i2c: acorn: fix i2c warning
	bcache: fix stack corruption by PRECEDING_KEY()
	cgroup: Use css_tryget() instead of css_tryget_online() in task_get_css()
	ASoC: cs42xx8: Add regcache mask dirty
	ASoC: fsl_asrc: Fix the issue about unsupported rate
	x86/uaccess, kcov: Disable stack protector
	ALSA: seq: Protect in-kernel ioctl calls with mutex
	ALSA: seq: Fix race of get-subscription call vs port-delete ioctls
	Revert "ALSA: seq: Protect in-kernel ioctl calls with mutex"
	Drivers: misc: fix out-of-bounds access in function param_set_kgdbts_var
	scsi: lpfc: add check for loss of ndlp when sending RRQ
	arm64/mm: Inhibit huge-vmap with ptdump
	scsi: bnx2fc: fix incorrect cast to u64 on shift operation
	selftests/timers: Add missing fflush(stdout) calls
	usbnet: ipheth: fix racing condition
	KVM: x86/pmu: do not mask the value that is written to fixed PMUs
	KVM: s390: fix memory slot handling for KVM_SET_USER_MEMORY_REGION
	drm/vmwgfx: integer underflow in vmw_cmd_dx_set_shader() leading to an invalid read
	drm/vmwgfx: NULL pointer dereference from vmw_cmd_dx_view_define()
	usb: dwc2: Fix DMA cache alignment issues
	USB: Fix chipmunk-like voice when using Logitech C270 for recording audio.
	USB: usb-storage: Add new ID to ums-realtek
	USB: serial: pl2303: add Allied Telesis VT-Kit3
	USB: serial: option: add support for Simcom SIM7500/SIM7600 RNDIS mode
	USB: serial: option: add Telit 0x1260 and 0x1261 compositions
	rtc: pcf8523: don't return invalid date when battery is low
	ax25: fix inconsistent lock state in ax25_destroy_timer
	be2net: Fix number of Rx queues used for flow hashing
	ipv6: flowlabel: fl6_sock_lookup() must use atomic_inc_not_zero
	lapb: fixed leak of control-blocks.
	neigh: fix use-after-free read in pneigh_get_next
	sunhv: Fix device naming inconsistency between sunhv_console and sunhv_reg
	Revert "staging: vc04_services: prevent integer overflow in create_pagelist()"
	perf/x86/intel/ds: Fix EVENT vs. UEVENT PEBS constraints
	selftests: netfilter: missing error check when setting up veth interface
	mISDN: make sure device name is NUL terminated
	x86/CPU/AMD: Don't force the CPB cap when running under a hypervisor
	perf/ring_buffer: Fix exposing a temporarily decreased data_head
	perf/ring_buffer: Add ordering to rb->nest increment
	gpio: fix gpio-adp5588 build errors
	net: tulip: de4x5: Drop redundant MODULE_DEVICE_TABLE()
	i2c: dev: fix potential memory leak in i2cdev_ioctl_rdwr
	configfs: Fix use-after-free when accessing sd->s_dentry
	perf data: Fix 'strncat may truncate' build failure with recent gcc
	perf record: Fix s390 missing module symbol and warning for non-root users
	ia64: fix build errors by exporting paddr_to_nid()
	KVM: PPC: Book3S: Use new mutex to synchronize access to rtas token list
	KVM: PPC: Book3S HV: Don't take kvm->lock around kvm_for_each_vcpu
	net: sh_eth: fix mdio access in sh_eth_close() for R-Car Gen2 and RZ/A1 SoCs
	scsi: libcxgbi: add a check for NULL pointer in cxgbi_check_route()
	scsi: smartpqi: properly set both the DMA mask and the coherent DMA mask
	scsi: libsas: delete sas port if expander discover failed
	mlxsw: spectrum: Prevent force of 56G
	Abort file_remove_privs() for non-reg. files
	Linux 4.9.183

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2019-06-22 08:54:42 +02:00
Christian Brauner
726f69d327 sysctl: return -EINVAL if val violates minmax
[ Upstream commit e260ad01f0aa9e96b5386d5cd7184afd949dc457 ]

Currently when userspace gives us a values that overflow e.g.  file-max
and other callers of __do_proc_doulongvec_minmax() we simply ignore the
new value and leave the current value untouched.

This can be problematic as it gives the illusion that the limit has
indeed be bumped when in fact it failed.  This commit makes sure to
return EINVAL when an overflow is detected.  Please note that this is a
userspace facing change.

Link: http://lkml.kernel.org/r/20190210203943.8227-4-christian@brauner.io
Signed-off-by: Christian Brauner <christian@brauner.io>
Acked-by: Luis Chamberlain <mcgrof@kernel.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Dominik Brodowski <linux@dominikbrodowski.net>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Joe Lawrence <joe.lawrence@redhat.com>
Cc: Waiman Long <longman@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-06-22 08:17:11 +02:00
Tengfei Fan
a56988d548 Merge commit android-4.9.171 (3383326) into msm-4.9
* refs/heads/tmp-3383326:
  Linux 4.9.171
  kernel/sysctl.c: fix out-of-bounds access when setting file-max
  Revert "locking/lockdep: Add debug_locks check in __lock_downgrade()"
  i2c-hid: properly terminate i2c_hid_dmi_desc_override_table[] array
  percpu: stop printing kernel addresses
  ALSA: info: Fix racy addition/deletion of nodes
  mm/vmstat.c: fix /proc/vmstat format for CONFIG_DEBUG_TLBFLUSH=y CONFIG_SMP=n
  device_cgroup: fix RCU imbalance in error case
  sched/fair: Limit sched_cfs_period_timer() loop to avoid hard lockup
  Revert "kbuild: use -Oz instead of -Os when using clang"
  perf/x86/amd: Add event map for AMD Family 17h
  mac80211: do not call driver wake_tx_queue op during reconfig
  rt2x00: do not increment sequence number while re-transmitting
  kprobes: Fix error check when reusing optimized probes
  kprobes: Mark ftrace mcount handler functions nokprobe
  x86/kprobes: Verify stack frame on kretprobe
  arm64: futex: Restore oldval initialization to work around buggy compilers
  crypto: x86/poly1305 - fix overflow during partial reduction
  Revert "svm: Fix AVIC incomplete IPI emulation"
  Revert "scsi: fcoe: clear FC_RP_STARTED flags when receiving a LOGO"
  ALSA: core: Fix card races between register and disconnect
  staging: comedi: ni_usb6501: Fix possible double-free of ->usb_rx_buf
  staging: comedi: ni_usb6501: Fix use of uninitialized mutex
  staging: comedi: vmk80xx: Fix possible double-free of ->usb_rx_buf
  staging: comedi: vmk80xx: Fix use of uninitialized semaphore
  io: accel: kxcjk1013: restore the range after resume.
  iio: adc: at91: disable adc channel interrupt in timeout case
  iio: ad_sigma_delta: select channel when reading register
  iio/gyro/bmg160: Use millidegrees for temperature scale
  staging: iio: ad7192: Fix ad7193 channel address
  KVM: x86: Don't clear EFER during SMM transitions for 32-bit vCPU
  CIFS: keep FileInfo handle live during oplock break
  tpm/tpm_i2c_atmel: Return -E2BIG when the transfer is incomplete
  modpost: file2alias: check prototype of handler
  modpost: file2alias: go back to simple devtable lookup
  mmc: sdhci: Fix data command CRC error handling
  crypto: crypto4xx - properly set IV after de- and encrypt
  ipv4: ensure rcu_read_lock() in ipv4_link_failure()
  ipv4: recompile ip options in ipv4_link_failure
  vhost: reject zero size iova range
  team: set slave to promisc if team is already in promisc mode
  tcp: tcp_grow_window() needs to respect tcp_space()
  net: fou: do not use guehdr after iptunnel_pull_offloads in gue_udp_recv
  net: bridge: multicast: use rcu to access port list from br_multicast_start_querier
  net: bridge: fix per-port af_packet sockets
  net: atm: Fix potential Spectre v1 vulnerabilities
  bonding: fix event handling for stacked bonds
  UPSTREAM: usb: hcd: use correct device pointer for dma ops
  UPSTREAM: usb: host: ehci: use correct device pointer for dma ops
  UPSTREAM: usb: separate out sysdev pointer from usb_bus
  ANDROID: cuttlefish_defconfig: Enable CONFIG_XFRM_STATISTICS

Conflicts:
	drivers/mmc/host/sdhci.c

Change-Id: I32202324feae8830306f9a6b56b43392cd076fcd
Signed-off-by: Tengfei Fan <tengfeif@codeaurora.org>
2019-06-06 12:26:57 +08:00
jianzhou
685434dcad Merge android-4.9.168 (286f971) into msm-4.9
* refs/heads/tmp-286f971:
  Linux 4.9.168
  ACPI / video: Extend chassis-type detection with a "Lunch Box" check
  drm/dp/mst: Configure no_stop_bit correctly for remote i2c xfers
  dmaengine: tegra: avoid overflow of byte tracking
  x86/build: Mark per-CPU symbols as absolute explicitly for LLD
  wlcore: Fix memory leak in case wl12xx_fetch_firmware failure
  selinux: do not override context on context mounts
  x86/build: Specify elf_i386 linker emulation explicitly for i386 objects
  drm/nouveau: Stop using drm_crtc_force_disable
  regulator: act8865: Fix act8600_sudcdc_voltage_ranges setting
  media: s5p-jpeg: Check for fmt_ver_flag when doing fmt enumeration
  netfilter: physdev: relax br_netfilter dependency
  dmaengine: qcom_hidma: assign channel cookie correctly
  dmaengine: imx-dma: fix warning comparison of distinct pointer types
  hpet: Fix missing '=' character in the __setup() code of hpet_mmap_enable
  HID: intel-ish: ipc: handle PIMR before ish_wakeup also clear PISR busy_clear bit
  soc/tegra: fuse: Fix illegal free of IO base address
  hwrng: virtio - Avoid repeated init of completion
  media: mt9m111: set initial frame size other than 0x0
  powerpc/pseries: Perform full re-add of CPU for topology update post-migration
  tty: increase the default flip buffer limit to 2*640K
  ARM: avoid Cortex-A9 livelock on tight dmb loops
  mt7601u: bump supported EEPROM version
  soc: qcom: gsbi: Fix error handling in gsbi_probe()
  ARM: dts: lpc32xx: Remove leading 0x and 0s from bindings notation
  efi/memattr: Don't bail on zero VA if it equals the region's PA
  ASoC: fsl-asoc-card: fix object reference leaks in fsl_asoc_card_probe
  e1000e: fix cyclic resets at link up with active tx
  cdrom: Fix race condition in cdrom_sysctl_register
  fbdev: fbmem: fix memory access if logo is bigger than the screen
  iw_cxgb4: fix srqidx leak during connection abort
  genirq: Avoid summation loops for /proc/stat
  bcache: improve sysfs_strtoul_clamp()
  bcache: fix input overflow to sequential_cutoff
  bcache: fix input overflow to cache set sysfs file io_error_halflife
  usb: f_fs: Avoid crash due to out-of-scope stack ptr access
  ALSA: PCM: check if ops are defined before suspending PCM
  ARM: 8833/1: Ensure that NEON code always compiles with Clang
  kprobes: Prohibit probing on bsearch()
  ACPI / video: Refactor and fix dmi_is_desktop()
  iwlwifi: pcie: fix emergency path
  leds: lp55xx: fix null deref on firmware load failure
  HID: intel-ish-hid: avoid binding wrong ishtp_cl_device
  vfs: fix preadv64v2 and pwritev64v2 compat syscalls with offset == -1
  media: mx2_emmaprp: Correct return type for mem2mem buffer helpers
  media: s5p-g2d: Correct return type for mem2mem buffer helpers
  media: s5p-jpeg: Correct return type for mem2mem buffer helpers
  media: sh_veu: Correct return type for mem2mem buffer helpers
  SoC: imx-sgtl5000: add missing put_device()
  perf test: Fix failure of 'evsel-tp-sched' test on s390
  scsi: megaraid_sas: return error when create DMA pool failed
  IB/mlx4: Increase the timeout for CM cache
  mlxsw: spectrum: Avoid -Wformat-truncation warnings
  e1000e: Fix -Wformat-truncation warnings
  mmc: omap: fix the maximum timeout setting
  iommu/io-pgtable-arm-v7s: Only kmemleak_ignore L2 tables
  ARM: 8840/1: use a raw_spinlock_t in unwind
  coresight: etm4x: Add support to enable ETMv4.2
  scsi: core: replace GFP_ATOMIC with GFP_KERNEL in scsi_scan.c
  usb: chipidea: Grab the (legacy) USB PHY by phandle first
  crypto: crypto4xx - add missing of_node_put after of_device_is_available
  wil6210: check null pointer in _wil_cfg80211_merge_extra_ies
  tools lib traceevent: Fix buffer overflow in arg_eval
  fs: fix guard_bio_eod to check for real EOD errors
  jbd2: fix invalid descriptor block checksum
  cifs: Fix NULL pointer dereference of devname
  dm thin: add sanity checks to thin-pool and external snapshot creation
  cifs: use correct format characters
  fs/file.c: initialize init_files.resize_wait
  f2fs: do not use mutex lock in atomic context
  ocfs2: fix a panic problem caused by o2cb_ctl
  mm/slab.c: kmemleak no scan alien caches
  mm/vmalloc.c: fix kernel BUG at mm/vmalloc.c:512!
  mm/page_ext.c: fix an imbalance with kmemleak
  mm/cma.c: cma_declare_contiguous: correct err handling
  scsi: hisi_sas: Set PHY linkrate when disconnected
  enic: fix build warning without CONFIG_CPUMASK_OFFSTACK
  sysctl: handle overflow for file-max
  include/linux/relay.h: fix percpu annotation in struct rchan
  gpio: gpio-omap: fix level interrupt idling
  tracing: kdb: Fix ftdump to not sleep
  h8300: use cc-cross-prefix instead of hardcoding h8300-unknown-linux-
  CIFS: fix POSIX lock leak and invalid ptr deref
  i2c: core-smbus: prevent stack corruption on read I2C_BLOCK_DATA
  mm: mempolicy: make mbind() return -EIO when MPOL_MF_STRICT is specified
  tty/serial: atmel: RS485 HD w/DMA: enable RX after TX is stopped
  tty/serial: atmel: Add is_half_duplex helper
  lib/int_sqrt: optimize initial value compute
  ext4: cleanup bh release code in ext4_ind_remove_space()
  arm64: debug: Ensure debug handlers check triggering exception level
  arm64: debug: Don't propagate UNKNOWN FAR into si_code for debug signals
  ANDROID: cuttlefish_defconfig: Enable CONFIG_OVERLAY_FS
  ANDROID: cuttlefish: enable CONFIG_NET_SCH_INGRESS=y

Conflicts:
	drivers/hwtracing/coresight/coresight-etm4x.c
	drivers/usb/gadget/function/f_fs.c

Change-Id: I9e61bbe81f4d06aed7a63653885dbcbb269fe633
Signed-off-by: jianzhou <jianzhou@codeaurora.org>
2019-05-30 13:40:07 +08:00
jianzhou
b82a5df2dc Merge android-4.9.165 (72b54df) into msm-4.9
* refs/heads/tmp-72b54df:
  Linux 4.9.165
  KVM: X86: Fix residual mmio emulation request to userspace
  KVM: nVMX: Ignore limit checks on VMX instructions using flat segments
  KVM: nVMX: Sign extend displacements of VMX instr's mem operands
  drm/radeon/evergreen_cs: fix missing break in switch statement
  media: uvcvideo: Avoid NULL pointer dereference at the end of streaming
  rcu: Do RCU GP kthread self-wakeup from softirq and interrupt
  md: Fix failed allocation of md_register_thread
  perf intel-pt: Fix divide by zero when TSC is not available
  perf intel-pt: Fix overlap calculation for padding
  perf auxtrace: Define auxtrace record alignment
  perf intel-pt: Fix CYC timestamp calculation after OVF
  bcache: never writeback a discard operation
  PM / wakeup: Rework wakeup source timer cancellation
  nfsd: fix wrong check in write_v4_end_grace()
  nfsd: fix memory corruption caused by readdir
  NFS: Don't recoalesce on error in nfs_pageio_complete_mirror()
  NFS: Fix an I/O request leakage in nfs_do_recoalesce
  NFS: Fix I/O request leakages
  dm: fix to_sector() for 32bit
  ARM: s3c24xx: Fix boolean expressions in osiris_dvs_notify
  powerpc/ptrace: Simplify vr_get/set() to avoid GCC warning
  powerpc: Fix 32-bit KVM-PR lockup and host crash with MacOS guest
  powerpc/83xx: Also save/restore SPRG4-7 during suspend
  powerpc/powernv: Make opal log only readable by root
  powerpc/wii: properly disable use of BATs when requested.
  powerpc/32: Clear on-stack exception marker upon exception return
  jbd2: fix compile warning when using JBUFFER_TRACE
  jbd2: clear dirty flag when revoking a buffer from an older transaction
  serial: 8250_pci: Have ACCES cards that use the four port Pericom PI7C9X7954 chip use the pci_pericom_setup()
  serial: 8250_pci: Fix number of ports for ACCES serial cards
  8250: FIX Fourth port offset of Pericom PI7C9X7954 boards
  serial: 8250_of: assume reg-shift of 2 for mrvl,mmp-uart
  serial: uartps: Fix stuck ISR if RX disabled with non-empty FIFO
  drm/i915: Relax mmap VMA check
  i2c: tegra: fix maximum transfer size
  parport_pc: fix find_superio io compare code, should use equal test.
  intel_th: Don't reference unassigned outputs
  device property: Fix the length used in PROPERTY_ENTRY_STRING()
  kernel/sysctl.c: add missing range check in do_proc_dointvec_minmax_conv
  mm/vmalloc: fix size check for remap_vmalloc_range_partial()
  mm: hwpoison: fix thp split handing in soft_offline_in_use_page()
  nfit: acpi_nfit_ctl(): Check out_obj->type in the right place
  clk: ingenic: Fix doc of ingenic_cgu_div_info
  clk: ingenic: Fix round_rate misbehaving with non-integer dividers
  clk: clk-twl6040: Fix imprecise external abort for pdmclk
  ext2: Fix underflow in ext2_max_size()
  ext4: fix crash during online resizing
  cpufreq: pxa2xx: remove incorrect __init annotation
  cpufreq: tegra124: add missing of_node_put()
  libertas_tf: don't set URB_ZERO_PACKET on IN USB transfer
  crypto: pcbc - remove bogus memcpy()s with src == dest
  Btrfs: fix corruption reading shared and compressed extents after hole punching
  btrfs: ensure that a DUP or RAID1 block group has exactly two stripes
  m68k: Add -ffreestanding to CFLAGS
  splice: don't merge into linked buffers
  fs/devpts: always delete dcache dentry-s in dput()
  scsi: target/iscsi: Avoid iscsit_release_commands_from_conn() deadlock
  scsi: sd: Optimal I/O size should be a multiple of physical block size
  scsi: virtio_scsi: don't send sc payload with tmfs
  s390/virtio: handle find on invalid queue gracefully
  clocksource/drivers/exynos_mct: Clear timer interrupt when shutdown
  clocksource/drivers/exynos_mct: Move one-shot check from tick clear to ISR
  regulator: s2mpa01: Fix step values for some LDOs
  regulator: s2mps11: Fix steps for buck7, buck8 and LDO35
  spi: pxa2xx: Setup maximum supported DMA transfer length
  spi: ti-qspi: Fix mmap read when more than one CS in use
  ACPI / device_sysfs: Avoid OF modalias creation for removed device
  tracing: Do not free iter->trace in fail path of tracing_open_pipe()
  tracing: Use strncpy instead of memcpy for string keys in hist triggers
  CIFS: Fix read after write for files with read caching
  CIFS: Do not reset lease state to NONE on lease break
  crypto: arm64/aes-ccm - fix logical bug in AAD MAC handling
  crypto: hash - set CRYPTO_TFM_NEED_KEY if ->setkey() fails
  libnvdimm: Fix altmap reservation size calculation
  libnvdimm/pmem: Honor force_raw for legacy pmem regions
  libnvdimm/label: Clear 'updating' flag after label-set update
  stm class: Prevent division by zero
  tmpfs: fix uninitialized return value in shmem_link
  net: set static variable an initial value in atl2_probe()
  nfp: bpf: fix ALU32 high bits clearance bug
  nfp: bpf: fix code-gen bug on BPF_ALU | BPF_XOR | BPF_K
  net: thunderx: make CFG_DONE message to run through generic send-ack sequence
  mac80211_hwsim: propagate genlmsg_reply return code
  phonet: fix building with clang
  ARC: uacces: remove lp_start, lp_end from clobber list
  ARCv2: lib: memcpy: fix doing prefetchw outside of buffer
  tmpfs: fix link accounting when a tmpfile is linked in
  net: marvell: mvneta: fix DMA debug warning
  arm64: Relax GIC version check during early boot
  ASoC: topology: free created components in tplg load error
  net: mv643xx_eth: disable clk on error path in mv643xx_eth_shared_probe()
  qmi_wwan: apply SET_DTR quirk to Sierra WP7607
  pinctrl: meson: meson8b: fix the sdxc_a data 1..3 pins
  net: systemport: Fix reception of BPDUs
  scsi: libiscsi: Fix race between iscsi_xmit_task and iscsi_complete_task
  assoc_array: Fix shortcut creation
  ARM: 8824/1: fix a migrating irq bug when hotplug cpu
  clk: sunxi: A31: Fix wrong AHB gate number
  Input: st-keyscan - fix potential zalloc NULL dereference
  i2c: cadence: Fix the hold bit setting
  net: hns: Fix object reference leaks in hns_dsaf_roce_reset()
  mm: page_alloc: fix ref bias in page_frag_alloc() for 1-byte allocs
  mm/gup: fix gup_pmd_range() for dax
  floppy: check_events callback should not return a negative number
  Input: matrix_keypad - use flush_delayed_work()
  Input: cap11xx - switch to using set_brightness_blocking()
  ARM: OMAP2+: Variable "reg" in function omap4_dsi_mux_pads() could be uninitialized
  s390/dasd: fix using offset into zero size array error
  gpu: ipu-v3: Fix CSI offsets for imx53
  gpu: ipu-v3: Fix i.MX51 CSI control registers offset
  crypto: ahash - fix another early termination in hash walk
  crypto: caam - fixed handling of sg list
  stm class: Fix an endless loop in channel allocation
  iio: adc: exynos-adc: Fix NULL pointer exception on unbind
  ASoC: fsl_esai: fix register setting issue in RIGHT_J mode
  9p/net: fix memory leak in p9_client_create
  9p: use inode->i_lock to protect i_size_write() under 32-bit
  media: videobuf2-v4l2: drop WARN_ON in vb2_warn_zero_bytesused()
  FROMLIST: psi: introduce psi monitor
  FROMLIST: refactor header includes to allow kthread.h inclusion in psi_types.h
  FROMLIST: psi: track changed states
  FROMLIST: psi: split update_stats into parts
  FROMLIST: psi: rename psi fields in preparation for psi trigger addition
  FROMLIST: psi: make psi_enable static
  FROMLIST: psi: introduce state_mask to represent stalled psi states
  ANDROID: cuttlefish_defconfig: Enable CONFIG_PSI
  BACKPORT: kernel: cgroup: add poll file operation
  BACKPORT: fs: kernfs: add poll file operation
  UPSTREAM: psi: avoid divide-by-zero crash inside virtual machines
  UPSTREAM: psi: clarify the Kconfig text for the default-disable option
  UPSTREAM: psi: fix aggregation idle shut-off
  UPSTREAM: cgroup add cftype->open/release() callbacks
  UPSTREAM: kernfs: Check KERNFS_HAS_RELEASE before calling kernfs_release_file()
  UPSTREAM: kernfs: fix locking around kernfs_ops->release() callback
  UPSTREAM: kernfs: add kernfs_ops->open/release() callbacks
  UPSTREAM: psi: fix reference to kernel commandline enable
  BACKPORT: psi: make disabling/enabling easier for vendor kernels
  UPSTREAM: kernel/sched/psi.c: simplify cgroup_move_task()
  BACKPORT: psi: cgroup support
  UPSTREAM: psi: pressure stall information for CPU, memory, and IO
  BACKPORT: sched: introduce this_rq_lock_irq()
  BACKPORT: sched: sched.h: make rq locking and clock functions available in stats.h
  UPSTREAM: sched: loadavg: make calc_load_n() public
  UPSTREAM: sched: loadavg: consolidate LOAD_INT, LOAD_FRAC, CALC_LOAD
  BACKPORT: delayacct: track delays from thrashing cache pages
  BACKPORT: mm: workingset: tell cache transitions from workingset thrashing
  BACKPORT: cgroup: misc changes
  UPSTREAM: sched/headers: Remove <linux/sched.h> from <linux/sched/loadavg.h>
  UPSTREAM: sched/headers: Move loadavg related definitions from <linux/sched.h> to <linux/sched/loadavg.h>
  UPSTREAM: sched/headers, delayacct: Move the 'struct task_delay_info' definition from <linux/sched.h> to <linux/delayacct.h>
  UPSTREAM: sched/headers: Prepare for new header dependencies before moving code to <linux/sched/loadavg.h>
  BACKPORT: sched/core: Add wrappers for lockdep_(un)pin_lock()
  UPSTREAM: Avoid page waitqueue race leaving possible page locker waiting
  UPSTREAM: mm: add PageWaiters indicating tasks are waiting for a page bit
  UPSTREAM: workqueue: make workqueue available early during boot
  ANDROID: ion_dummy_driver: Remove SYSTEM_CONTIG heap
  ANDROID: ion_dummy_driver: Rework ion_dummy_driver to avoid direct indexing into the heaps
  ANDROID: ion_dummy_driver: Use IS_ERR_OR_NULL() before destroying heaps
  ANDROID: sched/fair: fix energy compute when a cluster is only a cpu core in multi-cluster system

Conflicts:
	arch/arm/kernel/irq.c
	drivers/scsi/sd.c
	include/linux/cgroup.h
	include/linux/sched.h
	kernel/sched/Makefile
	kernel/sched/core.c
	mm/page_alloc.c

Change-Id: I387345d8f6d2145e2456fbead266c897475dfb4c
Signed-off-by: jianzhou <jianzhou@codeaurora.org>
2019-05-21 17:01:55 +08:00
Greg Kroah-Hartman
25d7d0eb82 Merge 4.9.171 into android-4.9-q
Changes in 4.9.171
	bonding: fix event handling for stacked bonds
	net: atm: Fix potential Spectre v1 vulnerabilities
	net: bridge: fix per-port af_packet sockets
	net: bridge: multicast: use rcu to access port list from br_multicast_start_querier
	net: fou: do not use guehdr after iptunnel_pull_offloads in gue_udp_recv
	tcp: tcp_grow_window() needs to respect tcp_space()
	team: set slave to promisc if team is already in promisc mode
	vhost: reject zero size iova range
	ipv4: recompile ip options in ipv4_link_failure
	ipv4: ensure rcu_read_lock() in ipv4_link_failure()
	crypto: crypto4xx - properly set IV after de- and encrypt
	mmc: sdhci: Fix data command CRC error handling
	modpost: file2alias: go back to simple devtable lookup
	modpost: file2alias: check prototype of handler
	tpm/tpm_i2c_atmel: Return -E2BIG when the transfer is incomplete
	CIFS: keep FileInfo handle live during oplock break
	KVM: x86: Don't clear EFER during SMM transitions for 32-bit vCPU
	staging: iio: ad7192: Fix ad7193 channel address
	iio/gyro/bmg160: Use millidegrees for temperature scale
	iio: ad_sigma_delta: select channel when reading register
	iio: adc: at91: disable adc channel interrupt in timeout case
	io: accel: kxcjk1013: restore the range after resume.
	staging: comedi: vmk80xx: Fix use of uninitialized semaphore
	staging: comedi: vmk80xx: Fix possible double-free of ->usb_rx_buf
	staging: comedi: ni_usb6501: Fix use of uninitialized mutex
	staging: comedi: ni_usb6501: Fix possible double-free of ->usb_rx_buf
	ALSA: core: Fix card races between register and disconnect
	Revert "scsi: fcoe: clear FC_RP_STARTED flags when receiving a LOGO"
	Revert "svm: Fix AVIC incomplete IPI emulation"
	crypto: x86/poly1305 - fix overflow during partial reduction
	arm64: futex: Restore oldval initialization to work around buggy compilers
	x86/kprobes: Verify stack frame on kretprobe
	kprobes: Mark ftrace mcount handler functions nokprobe
	kprobes: Fix error check when reusing optimized probes
	rt2x00: do not increment sequence number while re-transmitting
	mac80211: do not call driver wake_tx_queue op during reconfig
	perf/x86/amd: Add event map for AMD Family 17h
	Revert "kbuild: use -Oz instead of -Os when using clang"
	sched/fair: Limit sched_cfs_period_timer() loop to avoid hard lockup
	device_cgroup: fix RCU imbalance in error case
	mm/vmstat.c: fix /proc/vmstat format for CONFIG_DEBUG_TLBFLUSH=y CONFIG_SMP=n
	ALSA: info: Fix racy addition/deletion of nodes
	percpu: stop printing kernel addresses
	i2c-hid: properly terminate i2c_hid_dmi_desc_override_table[] array
	Revert "locking/lockdep: Add debug_locks check in __lock_downgrade()"
	kernel/sysctl.c: fix out-of-bounds access when setting file-max
	Linux 4.9.171

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2019-04-30 13:09:48 +02:00
Greg Kroah-Hartman
3383326b93 Merge 4.9.171 into android-4.9
Changes in 4.9.171
	bonding: fix event handling for stacked bonds
	net: atm: Fix potential Spectre v1 vulnerabilities
	net: bridge: fix per-port af_packet sockets
	net: bridge: multicast: use rcu to access port list from br_multicast_start_querier
	net: fou: do not use guehdr after iptunnel_pull_offloads in gue_udp_recv
	tcp: tcp_grow_window() needs to respect tcp_space()
	team: set slave to promisc if team is already in promisc mode
	vhost: reject zero size iova range
	ipv4: recompile ip options in ipv4_link_failure
	ipv4: ensure rcu_read_lock() in ipv4_link_failure()
	crypto: crypto4xx - properly set IV after de- and encrypt
	mmc: sdhci: Fix data command CRC error handling
	modpost: file2alias: go back to simple devtable lookup
	modpost: file2alias: check prototype of handler
	tpm/tpm_i2c_atmel: Return -E2BIG when the transfer is incomplete
	CIFS: keep FileInfo handle live during oplock break
	KVM: x86: Don't clear EFER during SMM transitions for 32-bit vCPU
	staging: iio: ad7192: Fix ad7193 channel address
	iio/gyro/bmg160: Use millidegrees for temperature scale
	iio: ad_sigma_delta: select channel when reading register
	iio: adc: at91: disable adc channel interrupt in timeout case
	io: accel: kxcjk1013: restore the range after resume.
	staging: comedi: vmk80xx: Fix use of uninitialized semaphore
	staging: comedi: vmk80xx: Fix possible double-free of ->usb_rx_buf
	staging: comedi: ni_usb6501: Fix use of uninitialized mutex
	staging: comedi: ni_usb6501: Fix possible double-free of ->usb_rx_buf
	ALSA: core: Fix card races between register and disconnect
	Revert "scsi: fcoe: clear FC_RP_STARTED flags when receiving a LOGO"
	Revert "svm: Fix AVIC incomplete IPI emulation"
	crypto: x86/poly1305 - fix overflow during partial reduction
	arm64: futex: Restore oldval initialization to work around buggy compilers
	x86/kprobes: Verify stack frame on kretprobe
	kprobes: Mark ftrace mcount handler functions nokprobe
	kprobes: Fix error check when reusing optimized probes
	rt2x00: do not increment sequence number while re-transmitting
	mac80211: do not call driver wake_tx_queue op during reconfig
	perf/x86/amd: Add event map for AMD Family 17h
	Revert "kbuild: use -Oz instead of -Os when using clang"
	sched/fair: Limit sched_cfs_period_timer() loop to avoid hard lockup
	device_cgroup: fix RCU imbalance in error case
	mm/vmstat.c: fix /proc/vmstat format for CONFIG_DEBUG_TLBFLUSH=y CONFIG_SMP=n
	ALSA: info: Fix racy addition/deletion of nodes
	percpu: stop printing kernel addresses
	i2c-hid: properly terminate i2c_hid_dmi_desc_override_table[] array
	Revert "locking/lockdep: Add debug_locks check in __lock_downgrade()"
	kernel/sysctl.c: fix out-of-bounds access when setting file-max
	Linux 4.9.171

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2019-04-30 13:08:38 +02:00
Will Deacon
3141fcc89f kernel/sysctl.c: fix out-of-bounds access when setting file-max
commit 9002b21465fa4d829edfc94a5a441005cffaa972 upstream.

Commit 32a5ad9c2285 ("sysctl: handle overflow for file-max") hooked up
min/max values for the file-max sysctl parameter via the .extra1 and
.extra2 fields in the corresponding struct ctl_table entry.

Unfortunately, the minimum value points at the global 'zero' variable,
which is an int.  This results in a KASAN splat when accessed as a long
by proc_doulongvec_minmax on 64-bit architectures:

  | BUG: KASAN: global-out-of-bounds in __do_proc_doulongvec_minmax+0x5d8/0x6a0
  | Read of size 8 at addr ffff2000133d1c20 by task systemd/1
  |
  | CPU: 0 PID: 1 Comm: systemd Not tainted 5.1.0-rc3-00012-g40b114779944 #2
  | Hardware name: linux,dummy-virt (DT)
  | Call trace:
  |  dump_backtrace+0x0/0x228
  |  show_stack+0x14/0x20
  |  dump_stack+0xe8/0x124
  |  print_address_description+0x60/0x258
  |  kasan_report+0x140/0x1a0
  |  __asan_report_load8_noabort+0x18/0x20
  |  __do_proc_doulongvec_minmax+0x5d8/0x6a0
  |  proc_doulongvec_minmax+0x4c/0x78
  |  proc_sys_call_handler.isra.19+0x144/0x1d8
  |  proc_sys_write+0x34/0x58
  |  __vfs_write+0x54/0xe8
  |  vfs_write+0x124/0x3c0
  |  ksys_write+0xbc/0x168
  |  __arm64_sys_write+0x68/0x98
  |  el0_svc_common+0x100/0x258
  |  el0_svc_handler+0x48/0xc0
  |  el0_svc+0x8/0xc
  |
  | The buggy address belongs to the variable:
  |  zero+0x0/0x40
  |
  | Memory state around the buggy address:
  |  ffff2000133d1b00: 00 00 00 00 00 00 00 00 fa fa fa fa 04 fa fa fa
  |  ffff2000133d1b80: fa fa fa fa 04 fa fa fa fa fa fa fa 04 fa fa fa
  | >ffff2000133d1c00: fa fa fa fa 04 fa fa fa fa fa fa fa 00 00 00 00
  |                                ^
  |  ffff2000133d1c80: fa fa fa fa 00 fa fa fa fa fa fa fa 00 00 00 00
  |  ffff2000133d1d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Fix the splat by introducing a unsigned long 'zero_ul' and using that
instead.

Link: http://lkml.kernel.org/r/20190403153409.17307-1-will.deacon@arm.com
Fixes: 32a5ad9c2285 ("sysctl: handle overflow for file-max")
Signed-off-by: Will Deacon <will.deacon@arm.com>
Acked-by: Christian Brauner <christian@brauner.io>
Cc: Kees Cook <keescook@chromium.org>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Matteo Croce <mcroce@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-04-27 09:34:47 +02:00
Greg Kroah-Hartman
417da48bd3 Merge 4.9.168 into android-4.9-q
Changes in 4.9.168
	arm64: debug: Don't propagate UNKNOWN FAR into si_code for debug signals
	arm64: debug: Ensure debug handlers check triggering exception level
	ext4: cleanup bh release code in ext4_ind_remove_space()
	lib/int_sqrt: optimize initial value compute
	tty/serial: atmel: Add is_half_duplex helper
	tty/serial: atmel: RS485 HD w/DMA: enable RX after TX is stopped
	mm: mempolicy: make mbind() return -EIO when MPOL_MF_STRICT is specified
	i2c: core-smbus: prevent stack corruption on read I2C_BLOCK_DATA
	CIFS: fix POSIX lock leak and invalid ptr deref
	h8300: use cc-cross-prefix instead of hardcoding h8300-unknown-linux-
	tracing: kdb: Fix ftdump to not sleep
	gpio: gpio-omap: fix level interrupt idling
	include/linux/relay.h: fix percpu annotation in struct rchan
	sysctl: handle overflow for file-max
	enic: fix build warning without CONFIG_CPUMASK_OFFSTACK
	scsi: hisi_sas: Set PHY linkrate when disconnected
	mm/cma.c: cma_declare_contiguous: correct err handling
	mm/page_ext.c: fix an imbalance with kmemleak
	mm/vmalloc.c: fix kernel BUG at mm/vmalloc.c:512!
	mm/slab.c: kmemleak no scan alien caches
	ocfs2: fix a panic problem caused by o2cb_ctl
	f2fs: do not use mutex lock in atomic context
	fs/file.c: initialize init_files.resize_wait
	cifs: use correct format characters
	dm thin: add sanity checks to thin-pool and external snapshot creation
	cifs: Fix NULL pointer dereference of devname
	jbd2: fix invalid descriptor block checksum
	fs: fix guard_bio_eod to check for real EOD errors
	tools lib traceevent: Fix buffer overflow in arg_eval
	wil6210: check null pointer in _wil_cfg80211_merge_extra_ies
	crypto: crypto4xx - add missing of_node_put after of_device_is_available
	usb: chipidea: Grab the (legacy) USB PHY by phandle first
	scsi: core: replace GFP_ATOMIC with GFP_KERNEL in scsi_scan.c
	coresight: etm4x: Add support to enable ETMv4.2
	ARM: 8840/1: use a raw_spinlock_t in unwind
	iommu/io-pgtable-arm-v7s: Only kmemleak_ignore L2 tables
	mmc: omap: fix the maximum timeout setting
	e1000e: Fix -Wformat-truncation warnings
	mlxsw: spectrum: Avoid -Wformat-truncation warnings
	IB/mlx4: Increase the timeout for CM cache
	scsi: megaraid_sas: return error when create DMA pool failed
	perf test: Fix failure of 'evsel-tp-sched' test on s390
	SoC: imx-sgtl5000: add missing put_device()
	media: sh_veu: Correct return type for mem2mem buffer helpers
	media: s5p-jpeg: Correct return type for mem2mem buffer helpers
	media: s5p-g2d: Correct return type for mem2mem buffer helpers
	media: mx2_emmaprp: Correct return type for mem2mem buffer helpers
	vfs: fix preadv64v2 and pwritev64v2 compat syscalls with offset == -1
	HID: intel-ish-hid: avoid binding wrong ishtp_cl_device
	leds: lp55xx: fix null deref on firmware load failure
	iwlwifi: pcie: fix emergency path
	ACPI / video: Refactor and fix dmi_is_desktop()
	kprobes: Prohibit probing on bsearch()
	ARM: 8833/1: Ensure that NEON code always compiles with Clang
	ALSA: PCM: check if ops are defined before suspending PCM
	usb: f_fs: Avoid crash due to out-of-scope stack ptr access
	bcache: fix input overflow to cache set sysfs file io_error_halflife
	bcache: fix input overflow to sequential_cutoff
	bcache: improve sysfs_strtoul_clamp()
	genirq: Avoid summation loops for /proc/stat
	iw_cxgb4: fix srqidx leak during connection abort
	fbdev: fbmem: fix memory access if logo is bigger than the screen
	cdrom: Fix race condition in cdrom_sysctl_register
	e1000e: fix cyclic resets at link up with active tx
	ASoC: fsl-asoc-card: fix object reference leaks in fsl_asoc_card_probe
	efi/memattr: Don't bail on zero VA if it equals the region's PA
	ARM: dts: lpc32xx: Remove leading 0x and 0s from bindings notation
	soc: qcom: gsbi: Fix error handling in gsbi_probe()
	mt7601u: bump supported EEPROM version
	ARM: avoid Cortex-A9 livelock on tight dmb loops
	tty: increase the default flip buffer limit to 2*640K
	powerpc/pseries: Perform full re-add of CPU for topology update post-migration
	media: mt9m111: set initial frame size other than 0x0
	hwrng: virtio - Avoid repeated init of completion
	soc/tegra: fuse: Fix illegal free of IO base address
	HID: intel-ish: ipc: handle PIMR before ish_wakeup also clear PISR busy_clear bit
	hpet: Fix missing '=' character in the __setup() code of hpet_mmap_enable
	dmaengine: imx-dma: fix warning comparison of distinct pointer types
	dmaengine: qcom_hidma: assign channel cookie correctly
	netfilter: physdev: relax br_netfilter dependency
	media: s5p-jpeg: Check for fmt_ver_flag when doing fmt enumeration
	regulator: act8865: Fix act8600_sudcdc_voltage_ranges setting
	drm/nouveau: Stop using drm_crtc_force_disable
	x86/build: Specify elf_i386 linker emulation explicitly for i386 objects
	selinux: do not override context on context mounts
	wlcore: Fix memory leak in case wl12xx_fetch_firmware failure
	x86/build: Mark per-CPU symbols as absolute explicitly for LLD
	dmaengine: tegra: avoid overflow of byte tracking
	drm/dp/mst: Configure no_stop_bit correctly for remote i2c xfers
	ACPI / video: Extend chassis-type detection with a "Lunch Box" check
	Linux 4.9.168

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2019-04-05 22:37:25 +02:00
Greg Kroah-Hartman
286f971000 Merge 4.9.168 into android-4.9
Changes in 4.9.168
	arm64: debug: Don't propagate UNKNOWN FAR into si_code for debug signals
	arm64: debug: Ensure debug handlers check triggering exception level
	ext4: cleanup bh release code in ext4_ind_remove_space()
	lib/int_sqrt: optimize initial value compute
	tty/serial: atmel: Add is_half_duplex helper
	tty/serial: atmel: RS485 HD w/DMA: enable RX after TX is stopped
	mm: mempolicy: make mbind() return -EIO when MPOL_MF_STRICT is specified
	i2c: core-smbus: prevent stack corruption on read I2C_BLOCK_DATA
	CIFS: fix POSIX lock leak and invalid ptr deref
	h8300: use cc-cross-prefix instead of hardcoding h8300-unknown-linux-
	tracing: kdb: Fix ftdump to not sleep
	gpio: gpio-omap: fix level interrupt idling
	include/linux/relay.h: fix percpu annotation in struct rchan
	sysctl: handle overflow for file-max
	enic: fix build warning without CONFIG_CPUMASK_OFFSTACK
	scsi: hisi_sas: Set PHY linkrate when disconnected
	mm/cma.c: cma_declare_contiguous: correct err handling
	mm/page_ext.c: fix an imbalance with kmemleak
	mm/vmalloc.c: fix kernel BUG at mm/vmalloc.c:512!
	mm/slab.c: kmemleak no scan alien caches
	ocfs2: fix a panic problem caused by o2cb_ctl
	f2fs: do not use mutex lock in atomic context
	fs/file.c: initialize init_files.resize_wait
	cifs: use correct format characters
	dm thin: add sanity checks to thin-pool and external snapshot creation
	cifs: Fix NULL pointer dereference of devname
	jbd2: fix invalid descriptor block checksum
	fs: fix guard_bio_eod to check for real EOD errors
	tools lib traceevent: Fix buffer overflow in arg_eval
	wil6210: check null pointer in _wil_cfg80211_merge_extra_ies
	crypto: crypto4xx - add missing of_node_put after of_device_is_available
	usb: chipidea: Grab the (legacy) USB PHY by phandle first
	scsi: core: replace GFP_ATOMIC with GFP_KERNEL in scsi_scan.c
	coresight: etm4x: Add support to enable ETMv4.2
	ARM: 8840/1: use a raw_spinlock_t in unwind
	iommu/io-pgtable-arm-v7s: Only kmemleak_ignore L2 tables
	mmc: omap: fix the maximum timeout setting
	e1000e: Fix -Wformat-truncation warnings
	mlxsw: spectrum: Avoid -Wformat-truncation warnings
	IB/mlx4: Increase the timeout for CM cache
	scsi: megaraid_sas: return error when create DMA pool failed
	perf test: Fix failure of 'evsel-tp-sched' test on s390
	SoC: imx-sgtl5000: add missing put_device()
	media: sh_veu: Correct return type for mem2mem buffer helpers
	media: s5p-jpeg: Correct return type for mem2mem buffer helpers
	media: s5p-g2d: Correct return type for mem2mem buffer helpers
	media: mx2_emmaprp: Correct return type for mem2mem buffer helpers
	vfs: fix preadv64v2 and pwritev64v2 compat syscalls with offset == -1
	HID: intel-ish-hid: avoid binding wrong ishtp_cl_device
	leds: lp55xx: fix null deref on firmware load failure
	iwlwifi: pcie: fix emergency path
	ACPI / video: Refactor and fix dmi_is_desktop()
	kprobes: Prohibit probing on bsearch()
	ARM: 8833/1: Ensure that NEON code always compiles with Clang
	ALSA: PCM: check if ops are defined before suspending PCM
	usb: f_fs: Avoid crash due to out-of-scope stack ptr access
	bcache: fix input overflow to cache set sysfs file io_error_halflife
	bcache: fix input overflow to sequential_cutoff
	bcache: improve sysfs_strtoul_clamp()
	genirq: Avoid summation loops for /proc/stat
	iw_cxgb4: fix srqidx leak during connection abort
	fbdev: fbmem: fix memory access if logo is bigger than the screen
	cdrom: Fix race condition in cdrom_sysctl_register
	e1000e: fix cyclic resets at link up with active tx
	ASoC: fsl-asoc-card: fix object reference leaks in fsl_asoc_card_probe
	efi/memattr: Don't bail on zero VA if it equals the region's PA
	ARM: dts: lpc32xx: Remove leading 0x and 0s from bindings notation
	soc: qcom: gsbi: Fix error handling in gsbi_probe()
	mt7601u: bump supported EEPROM version
	ARM: avoid Cortex-A9 livelock on tight dmb loops
	tty: increase the default flip buffer limit to 2*640K
	powerpc/pseries: Perform full re-add of CPU for topology update post-migration
	media: mt9m111: set initial frame size other than 0x0
	hwrng: virtio - Avoid repeated init of completion
	soc/tegra: fuse: Fix illegal free of IO base address
	HID: intel-ish: ipc: handle PIMR before ish_wakeup also clear PISR busy_clear bit
	hpet: Fix missing '=' character in the __setup() code of hpet_mmap_enable
	dmaengine: imx-dma: fix warning comparison of distinct pointer types
	dmaengine: qcom_hidma: assign channel cookie correctly
	netfilter: physdev: relax br_netfilter dependency
	media: s5p-jpeg: Check for fmt_ver_flag when doing fmt enumeration
	regulator: act8865: Fix act8600_sudcdc_voltage_ranges setting
	drm/nouveau: Stop using drm_crtc_force_disable
	x86/build: Specify elf_i386 linker emulation explicitly for i386 objects
	selinux: do not override context on context mounts
	wlcore: Fix memory leak in case wl12xx_fetch_firmware failure
	x86/build: Mark per-CPU symbols as absolute explicitly for LLD
	dmaengine: tegra: avoid overflow of byte tracking
	drm/dp/mst: Configure no_stop_bit correctly for remote i2c xfers
	ACPI / video: Extend chassis-type detection with a "Lunch Box" check
	Linux 4.9.168

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2019-04-05 22:34:51 +02:00
Christian Brauner
6b65c268df sysctl: handle overflow for file-max
[ Upstream commit 32a5ad9c22852e6bd9e74bdec5934ef9d1480bc5 ]

Currently, when writing

  echo 18446744073709551616 > /proc/sys/fs/file-max

/proc/sys/fs/file-max will overflow and be set to 0.  That quickly
crashes the system.

This commit sets the max and min value for file-max.  The max value is
set to long int.  Any higher value cannot currently be used as the
percpu counters are long ints and not unsigned integers.

Note that the file-max value is ultimately parsed via
__do_proc_doulongvec_minmax().  This function does not report error when
min or max are exceeded.  Which means if a value largen that long int is
written userspace will not receive an error instead the old value will be
kept.  There is an argument to be made that this should be changed and
__do_proc_doulongvec_minmax() should return an error when a dedicated min
or max value are exceeded.  However this has the potential to break
userspace so let's defer this to an RFC patch.

Link: http://lkml.kernel.org/r/20190107222700.15954-3-christian@brauner.io
Signed-off-by: Christian Brauner <christian@brauner.io>
Acked-by: Kees Cook <keescook@chromium.org>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Dominik Brodowski <linux@dominikbrodowski.net>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Joe Lawrence <joe.lawrence@redhat.com>
Cc: Luis Chamberlain <mcgrof@kernel.org>
Cc: Waiman Long <longman@redhat.com>
[christian@brauner.io: v4]
  Link: http://lkml.kernel.org/r/20190210203943.8227-3-christian@brauner.io
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-04-05 22:29:06 +02:00
Greg Kroah-Hartman
72b54df9a5 Merge 4.9.165 into android-4.9
Changes in 4.9.165
	media: videobuf2-v4l2: drop WARN_ON in vb2_warn_zero_bytesused()
	9p: use inode->i_lock to protect i_size_write() under 32-bit
	9p/net: fix memory leak in p9_client_create
	ASoC: fsl_esai: fix register setting issue in RIGHT_J mode
	iio: adc: exynos-adc: Fix NULL pointer exception on unbind
	stm class: Fix an endless loop in channel allocation
	crypto: caam - fixed handling of sg list
	crypto: ahash - fix another early termination in hash walk
	gpu: ipu-v3: Fix i.MX51 CSI control registers offset
	gpu: ipu-v3: Fix CSI offsets for imx53
	s390/dasd: fix using offset into zero size array error
	ARM: OMAP2+: Variable "reg" in function omap4_dsi_mux_pads() could be uninitialized
	Input: cap11xx - switch to using set_brightness_blocking()
	Input: matrix_keypad - use flush_delayed_work()
	floppy: check_events callback should not return a negative number
	mm/gup: fix gup_pmd_range() for dax
	mm: page_alloc: fix ref bias in page_frag_alloc() for 1-byte allocs
	net: hns: Fix object reference leaks in hns_dsaf_roce_reset()
	i2c: cadence: Fix the hold bit setting
	Input: st-keyscan - fix potential zalloc NULL dereference
	clk: sunxi: A31: Fix wrong AHB gate number
	ARM: 8824/1: fix a migrating irq bug when hotplug cpu
	assoc_array: Fix shortcut creation
	scsi: libiscsi: Fix race between iscsi_xmit_task and iscsi_complete_task
	net: systemport: Fix reception of BPDUs
	pinctrl: meson: meson8b: fix the sdxc_a data 1..3 pins
	qmi_wwan: apply SET_DTR quirk to Sierra WP7607
	net: mv643xx_eth: disable clk on error path in mv643xx_eth_shared_probe()
	ASoC: topology: free created components in tplg load error
	arm64: Relax GIC version check during early boot
	net: marvell: mvneta: fix DMA debug warning
	tmpfs: fix link accounting when a tmpfile is linked in
	ARCv2: lib: memcpy: fix doing prefetchw outside of buffer
	ARC: uacces: remove lp_start, lp_end from clobber list
	phonet: fix building with clang
	mac80211_hwsim: propagate genlmsg_reply return code
	net: thunderx: make CFG_DONE message to run through generic send-ack sequence
	nfp: bpf: fix code-gen bug on BPF_ALU | BPF_XOR | BPF_K
	nfp: bpf: fix ALU32 high bits clearance bug
	net: set static variable an initial value in atl2_probe()
	tmpfs: fix uninitialized return value in shmem_link
	stm class: Prevent division by zero
	libnvdimm/label: Clear 'updating' flag after label-set update
	libnvdimm/pmem: Honor force_raw for legacy pmem regions
	libnvdimm: Fix altmap reservation size calculation
	crypto: hash - set CRYPTO_TFM_NEED_KEY if ->setkey() fails
	crypto: arm64/aes-ccm - fix logical bug in AAD MAC handling
	CIFS: Do not reset lease state to NONE on lease break
	CIFS: Fix read after write for files with read caching
	tracing: Use strncpy instead of memcpy for string keys in hist triggers
	tracing: Do not free iter->trace in fail path of tracing_open_pipe()
	ACPI / device_sysfs: Avoid OF modalias creation for removed device
	spi: ti-qspi: Fix mmap read when more than one CS in use
	spi: pxa2xx: Setup maximum supported DMA transfer length
	regulator: s2mps11: Fix steps for buck7, buck8 and LDO35
	regulator: s2mpa01: Fix step values for some LDOs
	clocksource/drivers/exynos_mct: Move one-shot check from tick clear to ISR
	clocksource/drivers/exynos_mct: Clear timer interrupt when shutdown
	s390/virtio: handle find on invalid queue gracefully
	scsi: virtio_scsi: don't send sc payload with tmfs
	scsi: sd: Optimal I/O size should be a multiple of physical block size
	scsi: target/iscsi: Avoid iscsit_release_commands_from_conn() deadlock
	fs/devpts: always delete dcache dentry-s in dput()
	splice: don't merge into linked buffers
	m68k: Add -ffreestanding to CFLAGS
	btrfs: ensure that a DUP or RAID1 block group has exactly two stripes
	Btrfs: fix corruption reading shared and compressed extents after hole punching
	crypto: pcbc - remove bogus memcpy()s with src == dest
	libertas_tf: don't set URB_ZERO_PACKET on IN USB transfer
	cpufreq: tegra124: add missing of_node_put()
	cpufreq: pxa2xx: remove incorrect __init annotation
	ext4: fix crash during online resizing
	ext2: Fix underflow in ext2_max_size()
	clk: clk-twl6040: Fix imprecise external abort for pdmclk
	clk: ingenic: Fix round_rate misbehaving with non-integer dividers
	clk: ingenic: Fix doc of ingenic_cgu_div_info
	nfit: acpi_nfit_ctl(): Check out_obj->type in the right place
	mm: hwpoison: fix thp split handing in soft_offline_in_use_page()
	mm/vmalloc: fix size check for remap_vmalloc_range_partial()
	kernel/sysctl.c: add missing range check in do_proc_dointvec_minmax_conv
	device property: Fix the length used in PROPERTY_ENTRY_STRING()
	intel_th: Don't reference unassigned outputs
	parport_pc: fix find_superio io compare code, should use equal test.
	i2c: tegra: fix maximum transfer size
	drm/i915: Relax mmap VMA check
	serial: uartps: Fix stuck ISR if RX disabled with non-empty FIFO
	serial: 8250_of: assume reg-shift of 2 for mrvl,mmp-uart
	8250: FIX Fourth port offset of Pericom PI7C9X7954 boards
	serial: 8250_pci: Fix number of ports for ACCES serial cards
	serial: 8250_pci: Have ACCES cards that use the four port Pericom PI7C9X7954 chip use the pci_pericom_setup()
	jbd2: clear dirty flag when revoking a buffer from an older transaction
	jbd2: fix compile warning when using JBUFFER_TRACE
	powerpc/32: Clear on-stack exception marker upon exception return
	powerpc/wii: properly disable use of BATs when requested.
	powerpc/powernv: Make opal log only readable by root
	powerpc/83xx: Also save/restore SPRG4-7 during suspend
	powerpc: Fix 32-bit KVM-PR lockup and host crash with MacOS guest
	powerpc/ptrace: Simplify vr_get/set() to avoid GCC warning
	ARM: s3c24xx: Fix boolean expressions in osiris_dvs_notify
	dm: fix to_sector() for 32bit
	NFS: Fix I/O request leakages
	NFS: Fix an I/O request leakage in nfs_do_recoalesce
	NFS: Don't recoalesce on error in nfs_pageio_complete_mirror()
	nfsd: fix memory corruption caused by readdir
	nfsd: fix wrong check in write_v4_end_grace()
	PM / wakeup: Rework wakeup source timer cancellation
	bcache: never writeback a discard operation
	perf intel-pt: Fix CYC timestamp calculation after OVF
	perf auxtrace: Define auxtrace record alignment
	perf intel-pt: Fix overlap calculation for padding
	perf intel-pt: Fix divide by zero when TSC is not available
	md: Fix failed allocation of md_register_thread
	rcu: Do RCU GP kthread self-wakeup from softirq and interrupt
	media: uvcvideo: Avoid NULL pointer dereference at the end of streaming
	drm/radeon/evergreen_cs: fix missing break in switch statement
	KVM: nVMX: Sign extend displacements of VMX instr's mem operands
	KVM: nVMX: Ignore limit checks on VMX instructions using flat segments
	KVM: X86: Fix residual mmio emulation request to userspace
	Linux 4.9.165

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2019-03-23 13:34:48 +01:00
Zev Weiss
45a67f153b kernel/sysctl.c: add missing range check in do_proc_dointvec_minmax_conv
commit 8cf7630b29701d364f8df4a50e4f1f5e752b2778 upstream.

This bug has apparently existed since the introduction of this function
in the pre-git era (4500e91754d3 in Thomas Gleixner's history.git,
"[NET]: Add proc_dointvec_userhz_jiffies, use it for proper handling of
neighbour sysctls.").

As a minimal fix we can simply duplicate the corresponding check in
do_proc_dointvec_conv().

Link: http://lkml.kernel.org/r/20190207123426.9202-3-zev@bewilderbeest.net
Signed-off-by: Zev Weiss <zev@bewilderbeest.net>
Cc: Brendan Higgins <brendanhiggins@google.com>
Cc: Iurii Zaikin <yzaikin@google.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Luis Chamberlain <mcgrof@kernel.org>
Cc: <stable@vger.kernel.org>	[2.6.2+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-03-23 13:19:49 +01:00
jianzhou
b7d9747d02 Merge android-4.9.160 (fd5657a) into msm-4.9
* refs/heads/tmp-fd5657a:
  Linux 4.9.160
  ax25: fix possible use-after-free
  mISDN: fix a race in dev_expire_timer()
  net/x25: do not hold the cpu too long in x25_new_lci()
  btrfs: Remove false alert when fiemap range is smaller than on-disk extent
  net: ipv4: use a dedicated counter for icmp_v4 redirect packets
  net: stmmac: Fix a race in EEE enable callback
  vxlan: test dev->flags & IFF_UP before calling netif_rx()
  tcp: clear icsk_backoff in tcp_write_queue_purge()
  net: Do not allocate page fragments that are not skb aligned
  tcp: tcp_v4_err() should be more careful
  net: Add header for usage of fls64()
  vhost: correctly check the return value of translate_desc() in log_used()
  sky2: Increase D3 delay again
  net: stmmac: handle endianness in dwmac4_get_timestamp
  net: phy: xgmiitorgmii: Support generic PHY status read
  net: Fix for_each_netdev_feature on Big endian
  hwmon: (lm80) Fix missing unlock on error in set_fan_div()
  vsock: cope with memory allocation failure at socket creation time
  net: fix IPv6 prefix route residue
  Build break
  FROMLIST: BACKPORT: overlayfs: override_creds=off option bypass creator_cred
  Linux 4.9.159
  Revert "scsi: aic94xx: fix module loading"
  uapi/if_ether.h: move __UAPI_DEF_ETHHDR libc define
  mm: stop leaking PageTables
  pinctrl: msm: fix gpio-hog related boot issues
  netfilter: nf_tables: fix mismatch in big-endian system
  usb: dwc2: Remove unnecessary kfree
  kaweth: use skb_cow_head() to deal with cloned skbs
  ch9200: use skb_cow_head() to deal with cloned skbs
  smsc95xx: Use skb_cow_head to deal with cloned skbs
  drm/i915: Prevent a race during I915_GEM_MMAP ioctl with WC set
  dm thin: fix bug where bio that overwrites thin block ignores FUA
  x86/a.out: Clear the dump structure initially
  signal: Restore the stop PTRACE_EVENT_EXIT
  x86/platform/UV: Use efi_runtime_lock to serialise BIOS calls
  tracing/uprobes: Fix output for multiple string arguments
  alpha: Fix Eiger NR_IRQS to 128
  alpha: fix page fault handling for r16-r18 targets
  Input: elantech - enable 3rd button support on Fujitsu CELSIUS H780
  Input: bma150 - register input device after setting private data
  kvm: vmx: Fix entry number check for add_atomic_switch_msr()
  ALSA: usb-audio: Fix implicit fb endpoint setup by quirk
  ALSA: hda - Add quirk for HP EliteBook 840 G5
  perf/x86: Add check_period PMU callback
  perf/core: Fix impossible ring-buffer sizes warning
  Input: elan_i2c - add ACPI ID for touchpad in Lenovo V330-15ISK
  Revert "Input: elan_i2c - add ACPI ID for touchpad in ASUS Aspire F5-573G"
  perf report: Include partial stacks unwound with libdw
  cifs: Limit memory used by lock request calls to a page
  gpio: pl061: handle failed allocations
  ARM: dts: kirkwood: Fix polarity of GPIO fan lines
  ARM: dts: da850-lcdk: Correct the sound card name
  ARM: dts: da850-evm: Correct the sound card name
  drm/bridge: tc358767: fix output H/V syncs
  drm/bridge: tc358767: reject modes which require too much BW
  drm/bridge: tc358767: fix initial DP0/1_SRCCTRL value
  drm/bridge: tc358767: fix single lane configuration
  drm/bridge: tc358767: add defines for DP1_SRCCTRL & PHY_2LANE
  cpufreq: check if policy is inactive early in __cpufreq_get()
  ACPI: NUMA: Use correct type for printing addresses on i386-PAE
  bnx2x: disable GSO where gso_size is too big for hardware
  net: create skb_gso_validate_mac_len()
  ARM: fix the cockup in the previous patch
  ARM: ensure that processor vtables is not lost after boot
  ARM: spectre-v2: per-CPU vtables to work around big.Little systems
  ARM: add PROC_VTABLE and PROC_TABLE macros
  ARM: clean up per-processor check_bugs method call
  ARM: split out processor lookup
  ARM: make lookup_processor_type() non-__init
  ARM: 8810/1: vfp: Fix wrong assignement to ufp_exc
  ARM: 8797/1: spectre-v1.1: harden __copy_to_user
  ARM: 8796/1: spectre-v1,v1.1: provide helpers for address sanitization
  ARM: 8795/1: spectre-v1.1: use put_user() for __put_user()
  ARM: 8794/1: uaccess: Prevent speculative use of the current addr_limit
  ARM: 8793/1: signal: replace __put_user_error with __put_user
  ARM: 8792/1: oabi-compat: copy oabi events using __copy_to_user()
  ARM: 8791/1: vfp: use __copy_to_user() when saving VFP state
  ARM: 8789/1: signal: copy registers using __copy_to_user()
  uapi/if_ether.h: prevent redefinition of struct ethhdr
  eeprom: at24: add support for 24c2048
  dt-bindings: eeprom: at24: add "atmel,24c2048" compatible string
  BACKPORT: userfaultfd: shmem/hugetlbfs: only allow to register VM_MAYWRITE vmas
  ANDROID: cuttlefish_defconfig: Enable DEBUG_SET_MODULE_RONX
  Linux 4.9.158
  Revert "exec: load_script: don't blindly truncate shebang string"
  Linux 4.9.157
  batman-adv: Force mac header to start of data on xmit
  batman-adv: Avoid WARN on net_device without parent in netns
  xfrm: refine validation of template and selector families
  libceph: avoid KEEPALIVE_PENDING races in ceph_con_keepalive()
  Revert "cifs: In Kconfig CONFIG_CIFS_POSIX needs depends on legacy (insecure cifs)"
  HID: debug: fix the ring buffer implementation
  nfsd4: catch some false session retries
  nfsd4: fix cached replies to solo SEQUENCE compounds
  drm/vmwgfx: Return error code from vmw_execbuf_copy_fence_user
  drm/vmwgfx: Fix setting of dma masks
  drm/modes: Prevent division by zero htotal
  mac80211: ensure that mgmt tx skbs have tailroom for encryption
  ARM: tango: Improve ARCH_MULTIPLATFORM compatibility
  ARM: iop32x/n2100: fix PCI IRQ mapping
  MIPS: VDSO: Include $(ccflags-vdso) in o32,n32 .lds builds
  MIPS: OCTEON: don't set octeon_dma_bar_type if PCI is disabled
  mips: cm: reprime error cause
  debugfs: fix debugfs_rename parameter checking
  samples: mei: use /dev/mei0 instead of /dev/mei
  misc: vexpress: Off by one in vexpress_syscfg_exec()
  signal: Better detection of synchronous signals
  signal: Always notice exiting tasks
  iio: chemical: atlas-ph-sensor: correct IIO_TEMP values to millicelsius
  mtd: rawnand: gpmi: fix MX28 bus master lockup problem
  ANDROID: cuttlefish: enable CONFIG_NET_SCH_NETEM=y
  Add XFRM-I to cuttlefish defconfigs
  ANDROID: Move from clang r346389b to r349610.
  Linux 4.9.156
  ath9k: dynack: check da->enabled first in sampling routines
  ath9k: dynack: make ewma estimation faster
  perf/x86/intel: Delay memory deallocation until x86_pmu_dead_cpu()
  IB/hfi1: Add limit test for RC/UC send via loopback
  PCI: vmd: Free up IRQs on suspend path
  oom, oom_reaper: do not enqueue same task twice
  serial: fix race between flush_to_ldisc and tty_open
  perf tests evsel-tp-sched: Fix bitwise operator
  perf/core: Don't WARN() for impossible ring-buffer sizes
  x86/MCE: Initialize mce.bank in the case of a fatal error in mce_no_way_out()
  perf/x86/intel/uncore: Add Node ID mask
  KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221)
  kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974)
  KVM: x86: work around leak of uninitialized stack contents (CVE-2019-7222)
  scsi: aic94xx: fix module loading
  usb: gadget: musb: fix short isoc packets with inventra dma
  usb: gadget: udc: net2272: Fix bitwise and boolean operations
  usb: phy: am335x: fix race condition in _probe
  dmaengine: imx-dma: fix wrong callback invoke
  dmaengine: bcm2835: Fix abort of transactions
  dmaengine: bcm2835: Fix interrupt race on RT
  fuse: handle zero sized retrieve correctly
  fuse: decrement NR_WRITEBACK_TEMP on the right page
  fuse: call pipe_buf_release() under pipe lock
  ALSA: hda - Serialize codec registrations
  ALSA: compress: Fix stop handling on compressed capture streams
  enic: fix checksum validation for IPv6
  net: dsa: slave: Don't propagate flag changes on down slave interfaces
  net/mlx5e: Force CHECKSUM_UNNECESSARY for short ethernet frames
  net: systemport: Fix WoL with password after deep sleep
  rds: fix refcount bug in rds_sock_addref
  skge: potential memory corruption in skge_get_regs()
  rxrpc: bad unlock balance in rxrpc_recvmsg
  net: dp83640: expire old TX-skb
  dccp: fool proof ccid_hc_[rt]x_parse_options()
  thermal: hwmon: inline helpers when CONFIG_THERMAL_HWMON is not set
  exec: load_script: don't blindly truncate shebang string
  fs/epoll: drop ovflist branch prediction
  proc/sysctl: fix return error for proc_doulongvec_minmax()
  kernel/hung_task.c: break RCU locks based on jiffies
  HID: lenovo: Add checks to fix of_led_classdev_register
  thermal: generic-adc: Fix adc to temp interpolation
  block/swim3: Fix -EBUSY error when re-opening device after unmount
  fsl/fman: Use GFP_ATOMIC in {memac,tgec}_add_hash_mac_address()
  gdrom: fix a memory leak bug
  isdn: hisax: hfc_pci: Fix a possible concurrency use-after-free bug in HFCPCI_l1hw()
  ocfs2: don't clear bh uptodate for block read
  scripts/decode_stacktrace: only strip base path when a prefix of the path
  f2fs: fix sbi->extent_list corruption issue
  niu: fix missing checks of niu_pci_eeprom_read
  um: Avoid marking pages with "changed protection"
  cifs: check ntwrk_buf_start for NULL before dereferencing it
  MIPS: ralink: Select CONFIG_CPU_MIPSR2_IRQ_VI on MT7620/8
  crypto: ux500 - Use proper enum in hash_set_dma_transfer
  crypto: ux500 - Use proper enum in cryp_set_dma_transfer
  seq_buf: Make seq_buf_puts() null-terminate the buffer
  hwmon: (lm80) fix a missing check of bus read in lm80 probe
  hwmon: (lm80) fix a missing check of the status of SMBus read
  NFS: nfs_compare_mount_options always compare auth flavors.
  KVM: x86: svm: report MSR_IA32_MCG_EXT_CTL as unsupported
  pinctrl: meson: meson8b: fix the GPIO function for the GPIOAO pins
  pinctrl: meson: meson8: fix the GPIO function for the GPIOAO pins
  fbdev: fbcon: Fix unregister crash when more than one framebuffer
  igb: Fix an issue that PME is not enabled during runtime suspend
  i40e: define proper net_device::neigh_priv_len
  fbdev: fbmem: behave better with small rotated displays and many CPUs
  video: clps711x-fb: release disp device node in probe()
  drbd: Avoid Clang warning about pointless switch statment
  drbd: skip spurious timeout (ping-timeo) when failing promote
  drbd: disconnect, if the wrong UUIDs are attached on a connected peer
  drbd: narrow rcu_read_lock in drbd_sync_handshake
  cw1200: Fix concurrency use-after-free bugs in cw1200_hw_scan()
  scsi: smartpqi: correct volume status
  scsi: smartpqi: correct host serial num for ssa
  Bluetooth: Fix unnecessary error message for HCI request completion
  xfrm6_tunnel: Fix spi check in __xfrm6_tunnel_alloc_spi
  mac80211: fix radiotap vendor presence bitmap handling
  powerpc/uaccess: fix warning/error with access_ok()
  arm64: KVM: Skip MMIO insn after emulation
  perf probe: Fix unchecked usage of strncpy()
  perf header: Fix unchecked usage of strncpy()
  tty: serial: samsung: Properly set flags in autoCTS mode
  memstick: Prevent memstick host from getting runtime suspended during card detection
  ASoC: fsl: Fix SND_SOC_EUKREA_TLV320 build error on i.MX8M
  ARM: pxa: avoid section mismatch warning
  udf: Fix BUG on corrupted inode
  i2c-axxia: check for error conditions first
  cpuidle: big.LITTLE: fix refcount leak
  clk: imx6sl: ensure MMDC CH0 handshake is bypassed
  sata_rcar: fix deferred probing
  iommu/arm-smmu-v3: Use explicit mb() when moving cons pointer
  iommu/arm-smmu: Add support for qcom,smmu-v2 variant
  mips: bpf: fix encoding bug for mm_srlv32_op
  ARM: dts: Fix OMAP4430 SDP Ethernet startup
  iommu/amd: Fix amd_iommu=force_isolation
  clk: sunxi-ng: a33: Set CLK_SET_RATE_PARENT for all audio module clocks
  timekeeping: Use proper seqcount initializer
  usb: hub: delay hub autosuspend if USB3 port is still link training
  smack: fix access permissions for keyring
  media: DaVinci-VPBE: fix error handling in vpbe_initialize()
  x86/fpu: Add might_fault() to user_insn()
  ARM: dts: mmp2: fix TWSI2
  arm64: ftrace: don't adjust the LR value
  firmware/efi: Add NULL pointer checks in efivars API functions
  Thermal: do not clear passive state during system sleep
  nfsd4: fix crash on writing v4_end_grace before nfsd startup
  soc: bcm: brcmstb: Don't leak device tree node reference
  sunvdc: Do not spin in an infinite loop when vio_ldc_send() returns EAGAIN
  f2fs: fix wrong return value of f2fs_acl_create
  f2fs: move dir data flush to write checkpoint process
  media: adv*/tc358743/ths8200: fill in min width/height/pixelclock
  iio: accel: kxcjk1013: Add KIOX010A ACPI Hardware-ID
  dmaengine: xilinx_dma: Remove __aligned attribute on zynqmp_dma_desc_ll
  media: mtk-vcodec: Release device nodes in mtk_vcodec_init_enc_pm()
  soc/tegra: Don't leak device tree node reference
  perf tools: Add Hygon Dhyana support
  modpost: validate symbol names also in find_elf_symbol
  ARM: OMAP2+: hwmod: Fix some section annotations
  staging: iio: ad7780: update voltage on read
  staging:iio:ad2s90: Make probe handle spi_setup failure
  ptp: check gettime64 return code in PTP_SYS_OFFSET ioctl
  serial: fsl_lpuart: clear parity enable bit when disable parity
  drm/vc4: ->x_scaling[1] should never be set to VC4_SCALING_NONE
  powerpc/pseries: add of_node_put() in dlpar_detach_node()
  x86/PCI: Fix Broadcom CNB20LE unintended sign extension (redux)
  dlm: Don't swamp the CPU with callbacks queued during recovery
  ARM: 8808/1: kexec:offline panic_smp_self_stop CPU
  scsi: lpfc: Correct LCB RJT handling
  ath9k: dynack: use authentication messages for 'late' ack
  gpu: ipu-v3: image-convert: Prevent race between run and unprepare
  ASoC: Intel: mrfld: fix uninitialized variable access
  staging: iio: adc: ad7280a: handle error from __ad7280_read32()
  drm/bufs: Fix Spectre v1 vulnerability
  ANDROID: Turn xt_owner module on
  ANDROID: Remove xt_qtaguid module from new kernels.
  UPSTREAM: virt_wifi: fix error return code in virt_wifi_newlink()
  ion: Disable ION_HEAP_TYPE_SYSTEM_CONTIG
  ANDROID: arm64: lse: fix LSE atomics with LTO

Conflicts:
	arch/arm/kernel/setup.c
	drivers/iommu/arm-smmu.c
	drivers/thermal/thermal_core.c
	include/linux/sched.h
	mm/memory.c
	mm/oom_kill.c
	net/netfilter/xt_qtaguid.c

Change-Id: I8629ac12c19fb9d63b21b21431afc300b4f1568d
Signed-off-by: jianzhou <jianzhou@codeaurora.org>
2019-03-21 14:06:06 +08:00
Greg Kroah-Hartman
8817a280ad Merge 4.9.156 into android-4.9
Changes in 4.9.156
	drm/bufs: Fix Spectre v1 vulnerability
	staging: iio: adc: ad7280a: handle error from __ad7280_read32()
	ASoC: Intel: mrfld: fix uninitialized variable access
	gpu: ipu-v3: image-convert: Prevent race between run and unprepare
	ath9k: dynack: use authentication messages for 'late' ack
	scsi: lpfc: Correct LCB RJT handling
	ARM: 8808/1: kexec:offline panic_smp_self_stop CPU
	dlm: Don't swamp the CPU with callbacks queued during recovery
	x86/PCI: Fix Broadcom CNB20LE unintended sign extension (redux)
	powerpc/pseries: add of_node_put() in dlpar_detach_node()
	drm/vc4: ->x_scaling[1] should never be set to VC4_SCALING_NONE
	serial: fsl_lpuart: clear parity enable bit when disable parity
	ptp: check gettime64 return code in PTP_SYS_OFFSET ioctl
	staging:iio:ad2s90: Make probe handle spi_setup failure
	staging: iio: ad7780: update voltage on read
	ARM: OMAP2+: hwmod: Fix some section annotations
	modpost: validate symbol names also in find_elf_symbol
	perf tools: Add Hygon Dhyana support
	soc/tegra: Don't leak device tree node reference
	media: mtk-vcodec: Release device nodes in mtk_vcodec_init_enc_pm()
	dmaengine: xilinx_dma: Remove __aligned attribute on zynqmp_dma_desc_ll
	iio: accel: kxcjk1013: Add KIOX010A ACPI Hardware-ID
	media: adv*/tc358743/ths8200: fill in min width/height/pixelclock
	f2fs: move dir data flush to write checkpoint process
	f2fs: fix wrong return value of f2fs_acl_create
	sunvdc: Do not spin in an infinite loop when vio_ldc_send() returns EAGAIN
	soc: bcm: brcmstb: Don't leak device tree node reference
	nfsd4: fix crash on writing v4_end_grace before nfsd startup
	Thermal: do not clear passive state during system sleep
	firmware/efi: Add NULL pointer checks in efivars API functions
	arm64: ftrace: don't adjust the LR value
	ARM: dts: mmp2: fix TWSI2
	x86/fpu: Add might_fault() to user_insn()
	media: DaVinci-VPBE: fix error handling in vpbe_initialize()
	smack: fix access permissions for keyring
	usb: hub: delay hub autosuspend if USB3 port is still link training
	timekeeping: Use proper seqcount initializer
	clk: sunxi-ng: a33: Set CLK_SET_RATE_PARENT for all audio module clocks
	iommu/amd: Fix amd_iommu=force_isolation
	ARM: dts: Fix OMAP4430 SDP Ethernet startup
	mips: bpf: fix encoding bug for mm_srlv32_op
	iommu/arm-smmu: Add support for qcom,smmu-v2 variant
	iommu/arm-smmu-v3: Use explicit mb() when moving cons pointer
	sata_rcar: fix deferred probing
	clk: imx6sl: ensure MMDC CH0 handshake is bypassed
	cpuidle: big.LITTLE: fix refcount leak
	i2c-axxia: check for error conditions first
	udf: Fix BUG on corrupted inode
	ARM: pxa: avoid section mismatch warning
	ASoC: fsl: Fix SND_SOC_EUKREA_TLV320 build error on i.MX8M
	memstick: Prevent memstick host from getting runtime suspended during card detection
	tty: serial: samsung: Properly set flags in autoCTS mode
	perf header: Fix unchecked usage of strncpy()
	perf probe: Fix unchecked usage of strncpy()
	arm64: KVM: Skip MMIO insn after emulation
	powerpc/uaccess: fix warning/error with access_ok()
	mac80211: fix radiotap vendor presence bitmap handling
	xfrm6_tunnel: Fix spi check in __xfrm6_tunnel_alloc_spi
	Bluetooth: Fix unnecessary error message for HCI request completion
	scsi: smartpqi: correct host serial num for ssa
	scsi: smartpqi: correct volume status
	cw1200: Fix concurrency use-after-free bugs in cw1200_hw_scan()
	drbd: narrow rcu_read_lock in drbd_sync_handshake
	drbd: disconnect, if the wrong UUIDs are attached on a connected peer
	drbd: skip spurious timeout (ping-timeo) when failing promote
	drbd: Avoid Clang warning about pointless switch statment
	video: clps711x-fb: release disp device node in probe()
	fbdev: fbmem: behave better with small rotated displays and many CPUs
	i40e: define proper net_device::neigh_priv_len
	igb: Fix an issue that PME is not enabled during runtime suspend
	fbdev: fbcon: Fix unregister crash when more than one framebuffer
	pinctrl: meson: meson8: fix the GPIO function for the GPIOAO pins
	pinctrl: meson: meson8b: fix the GPIO function for the GPIOAO pins
	KVM: x86: svm: report MSR_IA32_MCG_EXT_CTL as unsupported
	NFS: nfs_compare_mount_options always compare auth flavors.
	hwmon: (lm80) fix a missing check of the status of SMBus read
	hwmon: (lm80) fix a missing check of bus read in lm80 probe
	seq_buf: Make seq_buf_puts() null-terminate the buffer
	crypto: ux500 - Use proper enum in cryp_set_dma_transfer
	crypto: ux500 - Use proper enum in hash_set_dma_transfer
	MIPS: ralink: Select CONFIG_CPU_MIPSR2_IRQ_VI on MT7620/8
	cifs: check ntwrk_buf_start for NULL before dereferencing it
	um: Avoid marking pages with "changed protection"
	niu: fix missing checks of niu_pci_eeprom_read
	f2fs: fix sbi->extent_list corruption issue
	scripts/decode_stacktrace: only strip base path when a prefix of the path
	ocfs2: don't clear bh uptodate for block read
	isdn: hisax: hfc_pci: Fix a possible concurrency use-after-free bug in HFCPCI_l1hw()
	gdrom: fix a memory leak bug
	fsl/fman: Use GFP_ATOMIC in {memac,tgec}_add_hash_mac_address()
	block/swim3: Fix -EBUSY error when re-opening device after unmount
	thermal: generic-adc: Fix adc to temp interpolation
	HID: lenovo: Add checks to fix of_led_classdev_register
	kernel/hung_task.c: break RCU locks based on jiffies
	proc/sysctl: fix return error for proc_doulongvec_minmax()
	fs/epoll: drop ovflist branch prediction
	exec: load_script: don't blindly truncate shebang string
	thermal: hwmon: inline helpers when CONFIG_THERMAL_HWMON is not set
	dccp: fool proof ccid_hc_[rt]x_parse_options()
	net: dp83640: expire old TX-skb
	rxrpc: bad unlock balance in rxrpc_recvmsg
	skge: potential memory corruption in skge_get_regs()
	rds: fix refcount bug in rds_sock_addref
	net: systemport: Fix WoL with password after deep sleep
	net/mlx5e: Force CHECKSUM_UNNECESSARY for short ethernet frames
	net: dsa: slave: Don't propagate flag changes on down slave interfaces
	enic: fix checksum validation for IPv6
	ALSA: compress: Fix stop handling on compressed capture streams
	ALSA: hda - Serialize codec registrations
	fuse: call pipe_buf_release() under pipe lock
	fuse: decrement NR_WRITEBACK_TEMP on the right page
	fuse: handle zero sized retrieve correctly
	dmaengine: bcm2835: Fix interrupt race on RT
	dmaengine: bcm2835: Fix abort of transactions
	dmaengine: imx-dma: fix wrong callback invoke
	usb: phy: am335x: fix race condition in _probe
	usb: gadget: udc: net2272: Fix bitwise and boolean operations
	usb: gadget: musb: fix short isoc packets with inventra dma
	scsi: aic94xx: fix module loading
	KVM: x86: work around leak of uninitialized stack contents (CVE-2019-7222)
	kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974)
	KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221)
	perf/x86/intel/uncore: Add Node ID mask
	x86/MCE: Initialize mce.bank in the case of a fatal error in mce_no_way_out()
	perf/core: Don't WARN() for impossible ring-buffer sizes
	perf tests evsel-tp-sched: Fix bitwise operator
	serial: fix race between flush_to_ldisc and tty_open
	oom, oom_reaper: do not enqueue same task twice
	PCI: vmd: Free up IRQs on suspend path
	IB/hfi1: Add limit test for RC/UC send via loopback
	perf/x86/intel: Delay memory deallocation until x86_pmu_dead_cpu()
	ath9k: dynack: make ewma estimation faster
	ath9k: dynack: check da->enabled first in sampling routines
	Linux 4.9.156

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2019-02-12 20:27:44 +01:00
Cheng Lin
0e5c7505a9 proc/sysctl: fix return error for proc_doulongvec_minmax()
[ Upstream commit 09be178400829dddc1189b50a7888495dd26aa84 ]

If the number of input parameters is less than the total parameters, an
EINVAL error will be returned.

For example, we use proc_doulongvec_minmax to pass up to two parameters
with kern_table:

{
	.procname       = "monitor_signals",
	.data           = &monitor_sigs,
	.maxlen         = 2*sizeof(unsigned long),
	.mode           = 0644,
	.proc_handler   = proc_doulongvec_minmax,
},

Reproduce:

When passing two parameters, it's work normal.  But passing only one
parameter, an error "Invalid argument"(EINVAL) is returned.

  [root@cl150 ~]# echo 1 2 > /proc/sys/kernel/monitor_signals
  [root@cl150 ~]# cat /proc/sys/kernel/monitor_signals
  1       2
  [root@cl150 ~]# echo 3 > /proc/sys/kernel/monitor_signals
  -bash: echo: write error: Invalid argument
  [root@cl150 ~]# echo $?
  1
  [root@cl150 ~]# cat /proc/sys/kernel/monitor_signals
  3       2
  [root@cl150 ~]#

The following is the result after apply this patch.  No error is
returned when the number of input parameters is less than the total
parameters.

  [root@cl150 ~]# echo 1 2 > /proc/sys/kernel/monitor_signals
  [root@cl150 ~]# cat /proc/sys/kernel/monitor_signals
  1       2
  [root@cl150 ~]# echo 3 > /proc/sys/kernel/monitor_signals
  [root@cl150 ~]# echo $?
  0
  [root@cl150 ~]# cat /proc/sys/kernel/monitor_signals
  3       2
  [root@cl150 ~]#

There are three processing functions dealing with digital parameters,
__do_proc_dointvec/__do_proc_douintvec/__do_proc_doulongvec_minmax.

This patch deals with __do_proc_doulongvec_minmax, just as
__do_proc_dointvec does, adding a check for parameters 'left'.  In
__do_proc_douintvec, its code implementation explicitly does not support
multiple inputs.

static int __do_proc_douintvec(...){
         ...
         /*
          * Arrays are not supported, keep this simple. *Do not* add
          * support for them.
          */
         if (vleft != 1) {
                 *lenp = 0;
                 return -EINVAL;
         }
         ...
}

So, just __do_proc_doulongvec_minmax has the problem.  And most use of
proc_doulongvec_minmax/proc_doulongvec_ms_jiffies_minmax just have one
parameter.

Link: http://lkml.kernel.org/r/1544081775-15720-1-git-send-email-cheng.lin130@zte.com.cn
Signed-off-by: Cheng Lin <cheng.lin130@zte.com.cn>
Acked-by: Luis Chamberlain <mcgrof@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-02-12 19:44:59 +01:00
Linux Build Service Account
a40398baac Merge "sched/walt: improve the scheduler" 2019-01-16 08:37:24 -08:00
Linux Build Service Account
1019b0144e Merge "sched/walt: improve the scheduler" 2019-01-16 08:37:23 -08:00
Satya Durga Srinivasu Prabhala
c18b403a95 sched/walt: improve the scheduler
This change is for general scheduler improvement.

Change-Id: Ie162a57537bb9ada66a4254d606e17d54b7a3a49
Signed-off-by: Satya Durga Srinivasu Prabhala <satyap@codeaurora.org>
[pkondeti@codeaurora.org: code refactoring and implemented freq to load
calculations.]
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
2019-01-14 11:43:04 +05:30
Abhijeet Dharmapurikar
53ee423eae sched/walt: improve the scheduler
This change is for general scheduler improvement.

Change-Id: I01e6610bba2e8c66a628d6289eeed4e854264fdd
Signed-off-by: Satya Durga Srinivasu Prabhala <satyap@codeaurora.org>
Signed-off-by: Abhijeet Dharmapurikar <adharmap@codeaurora.org>
[clingutla@codeaurora.org: resolve trivial merge conflicts.]
Signed-off-by: Lingutla Chandrasekhar <clingutla@codeaurora.org>
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
2019-01-14 11:43:03 +05:30
jianzhou
f41ab608b7 Merge android-4.9.145 (6328e64) into msm-4.9
* refs/heads/tmp-6328e64:
  Revert "scsi: ufs: fix race between clock gating and devfreq scaling work"
  Linux 4.9.145
  kbuild: allow to use GCC toolchain not in Clang search path
  kbuild: fix linker feature test macros when cross compiling with Clang
  mac80211: ignore NullFunc frames in the duplicate detection
  mac80211: fix reordering of buffered broadcast packets
  mac80211: ignore tx status for PS stations in ieee80211_tx_status_ext
  mac80211: Clear beacon_int in ieee80211_do_stop
  mac80211_hwsim: Timer should be initialized before device registered
  kgdboc: fix KASAN global-out-of-bounds bug in param_set_kgdboc_var()
  tty: do not set TTY_IO_ERROR flag if console port
  tty: serial: 8250_mtk: always resume the device in probe.
  staging: rtl8712: Fix possible buffer overrun
  cifs: Fix separator when building path from dentry
  Staging: lustre: remove two build warnings
  vhost/vsock: fix use-after-free in network stack callers
  vsock: lookup and setup guest_cid inside vhost_vsock_lock
  swiotlb: clean up reporting
  sr: pass down correctly sized SCSI sense buffer
  xhci: Prevent U1/U2 link pm states if exit latency is too long
  dmaengine: cppi41: delete channel from pending list when stop channel
  SUNRPC: Fix leak of krb5p encode pages
  virtio/s390: fix race in ccw_io_helper()
  virtio/s390: avoid race on vcdev->config
  ALSA: hda/realtek - Fix speaker output regression on Thinkpad T570
  ALSA: pcm: Fix interval evaluation with openmin/max
  ALSA: pcm: Call snd_pcm_unlink() conditionally at closing
  ALSA: pcm: Fix starvation on down_write_nonblock()
  ALSA: hda: Add support for AMD Stoney Ridge
  ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in card.c
  USB: check usb_get_extra_descriptor for proper size
  usb: appledisplay: Add 27" Apple Cinema Display
  usb: quirk: add no-LPM quirk on SanDisk Ultra Flair device
  ARC: [zebu] Remove CONFIG_INITRAMFS_SOURCE from defconfigs
  mm: don't warn about allocations which stall for too long
  net: amd: add missing of_node_put()
  team: no need to do team_notify_peers or team_mcast_rejoin when disabling port
  iommu/vt-d: Use memunmap to free memremap
  net: faraday: ftmac100: remove netif_running(netdev) check before disabling interrupts
  mtd: rawnand: qcom: Namespace prefix some commands
  net/mlx4: Fix UBSAN warning of signed integer overflow
  net/mlx4_core: Fix uninitialized variable compilation warning
  net/mlx4_core: Zero out lkey field in SW2HW_MPT fw command
  qed: Fix reading wrong value in loop condition
  qed: Fix PTT leak in qed_drain()
  bnx2x: Assign unique DMAE channel number for FW DMAE transactions.
  batman-adv: Expand merged fragment buffer for full packet
  HID: input: Ignore battery reported by Symbol DS4308
  can: rcar_can: Fix erroneous registration
  iommu/ipmmu-vmsa: Fix crash on early domain free
  brcmutil: really fix decoding channel info for 160 MHz bandwidth
  iommu/vt-d: Fix NULL pointer dereference in prq_event_thread()
  media: omap3isp: Unregister media device as first
  ANDROID: cpufreq: times: add /proc/uid_concurrent_{active,policy}_time
  ANDROID: modpost: add an exception for CFI stubs
  FROMGIT: modpost: validate symbol names also in find_elf_symbol
  Linux 4.9.144
  hugetlbfs: fix bug in pgoff overflow checking
  xfs: don't fail when converting shortform attr to long form during ATTR_REPLACE
  f2fs: fix to do sanity check with cp_pack_start_sum
  f2fs: free meta pages if sanity check for ckpt is failed
  f2fs: fix to do sanity check with block address in main area v2
  f2fs: fix missing up_read
  f2fs: fix to do sanity check with block address in main area
  f2fs: fix to do sanity check with node footer and iblocks
  f2fs: Add sanity_check_inode() function
  f2fs: fix to do sanity check with user_block_count
  f2fs: fix to do sanity check with secs_per_zone
  f2fs: introduce and spread verify_blkaddr
  f2fs: clean up with is_valid_blkaddr()
  f2fs: enhance sanity_check_raw_super() to avoid potential overflow
  f2fs: sanity check on sit entry
  f2fs: check blkaddr more accuratly before issue a bio
  f2fs: return error during fill_super
  f2fs: detect wrong layout
  f2fs: fix race condition in between free nid allocator/initializer
  f2fs: fix a panic caused by NULL flush_cmd_control
  btrfs: tree-checker: Fix misleading group system information
  btrfs: tree-checker: Check level for leaves and nodes
  btrfs: Check that each block group has corresponding chunk at mount time
  btrfs: tree-checker: Detect invalid and empty essential trees
  btrfs: tree-checker: Verify block_group_item
  btrfs: tree-check: reduce stack consumption in check_dir_item
  btrfs: tree-checker: use %zu format string for size_t
  btrfs: tree-checker: Add checker for dir item
  btrfs: tree-checker: Fix false panic for sanity test
  btrfs: tree-checker: Enhance btrfs_check_node output
  btrfs: struct-funcs, constify readers
  btrfs: Move leaf and node validation checker to tree-checker.c
  btrfs: Add checker for EXTENT_CSUM
  btrfs: Add sanity check for EXTENT_DATA when reading out leaf
  btrfs: Check if item pointer overlaps with the item itself
  btrfs: Refactor check_leaf function for later expansion
  btrfs: Verify that every chunk has corresponding block group at mount time
  btrfs: validate type when reading a chunk
  hugetlbfs: check for pgoff value overflow
  hugetlbfs: fix offset overflow in hugetlbfs mmap
  mm/hugetlb.c: don't call region_abort if region_chg fails
  wil6210: missing length check in wmi_set_ie
  bpf: Prevent memory disambiguation attack
  bpf/verifier: Pass instruction index to check_mem_access() and check_xadd()
  bpf/verifier: Add spi variable to check_stack_write()
  libceph: check authorizer reply/challenge length before reading
  libceph: weaken sizeof check in ceph_x_verify_authorizer_reply()
  libceph: implement CEPHX_V2 calculation mode
  libceph: add authorizer challenge
  libceph: factor out encrypt_authorizer()
  libceph: factor out __ceph_x_decrypt()
  libceph: factor out __prepare_write_connect()
  libceph: store ceph_auth_handshake pointer in ceph_connection
  libceph: no need to drop con->mutex for ->get_authorizer()
  libceph: drop len argument of *verify_authorizer_reply()
  tipc: use destination length for copy string
  net: qed: use correct strncpy() size
  usb: gadget: dummy: fix nonsensical comparisons
  mm: cleancache: fix corruption on missed inode invalidation
  reset: remove remaining WARN_ON() in <linux/reset.h>
  reset: make device_reset_optional() really optional
  reset: add exported __reset_control_get, return NULL if optional
  reset: fix optional reset_control_get stubs to return NULL
  reset: core: fix reset_control_put
  reset: make optional functions really optional
  udf: Allow mounting volumes with incorrect identification strings
  arc: [devboards] Add support of NFSv3 ACL
  ARC: change defconfig defaults to ARCv2
  Btrfs: fix use-after-free when dumping free space
  btrfs: Always try all copies when reading extent buffers
  Input: elan_i2c - add support for ELAN0621 touchpad
  Input: elan_i2c - add ACPI ID for Lenovo IdeaPad 330-15ARR
  Input: elan_i2c - add ELAN0620 to the ACPI table
  Input: matrix_keypad - check for errors from of_get_named_gpio()
  Input: xpad - quirk all PDP Xbox One gamepads
  drm/mediatek: fix OF sibling-node lookup
  svm: Add mutex_lock to protect apic_access_page_done on AMD systems
  binder: fix proc->files use-after-free
  kgdboc: Fix warning with module build
  kgdboc: Fix restrict error
  scsi: csiostor: Avoid content leaks and casts
  ALSA: trident: Suppress gcc string warning
  scsi: scsi_devinfo: cleanly zero-pad devinfo strings
  drm: set is_master to 0 upon drm_new_set_master() failure
  drm/ast: Fix incorrect free on ioregs
  IB/mlx5: Avoid load failure due to unknown link width
  mips: fix mips_get_syscall_arg o32 check
  MIPS: ralink: Fix mt7620 nd_sd pinmux
  uprobes: Fix handle_swbp() vs. unregister() + register() race once more
  iser: set sector for ambiguous mr status errors
  x86/power/64: Use char arrays for asm function names
  kdb: use memmove instead of overlapping memcpy
  staging: rts5208: fix gcc-8 logic error warning
  scsi: bfa: convert to strlcpy/strlcat
  drm: gma500: fix logic error
  ip_tunnel: Fix name string concatenate in __ip_tunnel_create()
  kernfs: Replace strncpy with memcpy
  unifdef: use memcpy instead of strncpy
  kobject: Replace strncpy with memcpy
  test_hexdump: use memcpy instead of strncpy
  disable stringop truncation warnings for now
  Kbuild: suppress packed-not-aligned warning for default setting only
  kbuild: Fix 4.9.138 mismerge
  Linux 4.9.143
  kbuild: Set KBUILD_CFLAGS before incl. arch Makefile
  efi/libstub: Make file I/O chunking x86-specific
  workqueue: avoid clang warning
  ARM: trusted_foundations: do not use naked function
  bus: arm-cci: remove unnecessary unreachable()
  ARM: 8767/1: add support for building ARM kernel with clang
  ARM: 8766/1: drop no-thumb-interwork in EABI mode
  efi/libstub: arm: support building with clang
  misc: mic/scif: fix copy-paste error in scif_create_remote_lookup
  Drivers: hv: vmbus: check the creation_status in vmbus_establish_gpadl()
  mm: use swp_offset as key in shmem_replace_page()
  iio:st_magn: Fix enable device after trigger
  Revert "usb: dwc3: gadget: skip Set/Clear Halt when invalid"
  usb: core: quirks: add RESET_RESUME quirk for Cherry G230 Stream series
  USB: usb-storage: Add new IDs to ums-realtek
  btrfs: release metadata before running delayed refs
  dmaengine: at_hdmac: fix module unloading
  dmaengine: at_hdmac: fix memory leak in at_dma_xlate()
  ext2: fix potential use after free
  ALSA: sparc: Fix invalid snd_free_pages() at error path
  ALSA: control: Fix race between adding and removing a user element
  ALSA: ac97: Fix incorrect bit shift at AC97-SPSA control write
  ALSA: wss: Fix invalid snd_free_pages() at error path
  fs: fix lost error code in dio_complete
  perf/x86/intel: Add generic branch tracing check to intel_pmu_has_bts()
  perf/x86/intel: Move branch tracing setup to the Intel-specific source file
  Btrfs: ensure path name is null terminated at btrfs_control_ioctl
  xtensa: fix coprocessor context offset definitions
  xtensa: enable coprocessors that are being flushed
  KVM: X86: Fix scan ioapic use-before-initialization
  kvm: svm: Ensure an IBPB on all affected CPUs when freeing a vmcb
  kvm: mmu: Fix race in emulated page table writes
  usbnet: ipheth: fix potential recvmsg bug and recvmsg bug 2
  s390/qeth: fix length check in SNMP processing
  rapidio/rionet: do not free skb before reading its length
  net: skb_scrub_packet(): Scrub offload_fwd_mark
  Revert "wlcore: Add missing PM call for wlcore_cmd_wait_for_event_or_timeout()"
  media: em28xx: Fix use-after-free when disconnecting
  mm/khugepaged: collapse_shmem() do not crash on Compound
  mm/khugepaged: collapse_shmem() without freezing new_page
  mm/khugepaged: minor reorderings in collapse_shmem()
  mm/khugepaged: collapse_shmem() remember to clear holes
  mm/khugepaged: fix crashes due to misaccounted holes
  shmem: introduce shmem_inode_acct_block
  shmem: shmem_charge: verify max_block is not exceeded before inode update
  mm/khugepaged: collapse_shmem() stop if punched or truncated
  mm/huge_memory: fix lockdep complaint on 32-bit i_size_read()
  mm/huge_memory: splitting set mapping+index before unfreeze
  mm/huge_memory.c: reorder operations in __split_huge_page_tail()
  mm/huge_memory: rename freeze_page() to unmap_page()
  UPSTREAM: binder: fix race that allows malicious free of live buffer
  Linux 4.9.142
  ima: re-initialize iint->atomic_flags
  ima: re-introduce own integrity cache lock
  EVM: Add support for portable signature format
  ima: always measure and audit files in policy
  Revert "evm: Translate user/group ids relative to s_user_ns when computing HMAC"
  net: ieee802154: 6lowpan: fix frag reassembly
  s390/mm: Check for valid vma before zapping in gmap_discard
  lan78xx: Read MAC address from DT if present
  namei: allow restricted O_CREAT of FIFOs and regular files
  sched/core: Allow __sched_setscheduler() in interrupts when PI is not used
  usb: xhci: fix uninitialized completion when USB3 port got wrong status
  tty: wipe buffer if not echoing data
  tty: wipe buffer.
  include/linux/pfn_t.h: force '~' to be parsed as an unary operator
  scsi: ufshcd: release resources if probe fails
  scsi: ufs: fix race between clock gating and devfreq scaling work
  scsi: ufshcd: Fix race between clk scaling and ungate work
  scsi: ufs: fix bugs related to null pointer access and array size
  mwifiex: fix p2p device doesn't find in scan problem
  mwifiex: Fix NULL pointer dereference in skb_dequeue()
  mwifiex: report error to PCIe for suspend failure
  mwifiex: prevent register accesses after host is sleeping
  cw1200: Don't leak memory if krealloc failes
  Input: xpad - add support for Xbox1 PDP Camo series gamepad
  Input: xpad - fix GPD Win 2 controller name
  Input: xpad - add GPD Win 2 Controller USB IDs
  Input: xpad - avoid using __set_bit() for capabilities
  Input: xpad - fix some coding style issues
  Input: xpad - add PDP device id 0x02a4
  Input: xpad - add support for PDP Xbox One controllers
  Input: xpad - validate USB endpoint type during probe
  Input: xpad - fix PowerA init quirk for some gamepad models
  Input: xpad - constify usb_device_id
  Input: xpad - sync supported devices with XBCD
  Input: xpad - sync supported devices with 360Controller
  Input: xpad - add USB IDs for Mad Catz Brawlstick and Razer Sabertooth
  Input: xpad - sync supported devices with xboxdrv
  Input: xpad - sort supported devices by USB ID
  Input: xpad - support some quirky Xbox One pads
  Input: xpad - restore LED state after device resume
  Input: xpad - fix stuck mode button on Xbox One S pad
  Input: xpad - don't depend on endpoint order
  Input: xpad - simplify error condition in init_output
  Input: xpad - move reporting xbox one home button to common function
  Input: xpad - correctly sort vendor id's
  Input: xpad - fix Xbox One rumble stopping after 2.5 secs
  Input: xpad - add product ID for Xbox One S pad
  ath10k: fix kernel panic due to race in accessing arvif list
  arm64: remove no-op -p linker flag
  net: bcmgenet: fix OF child-node lookup
  NFC: nfcmrvl_uart: fix OF child-node lookup
  of: add helper to lookup compatible child node
  tmpfs: make lseek(SEEK_DATA/SEK_HOLE) return ENXIO with a negative offset
  efi/arm: Revert deferred unmap of early memmap mapping
  powerpc/numa: Suppress "VPHN is not supported" messages
  kdb: Use strscpy with destination buffer size
  SUNRPC: Fix a bogus get/put in generic_key_to_expire()
  perf/x86/intel/uncore: Add more IMC PCI IDs for KabyLake and CoffeeLake CPUs
  powerpc/io: Fix the IO workarounds code to work with Radix
  floppy: fix race condition in __floppy_read_block_0()
  rtc: pcf2127: fix a kmemleak caused in pcf2127_i2c_gather_write
  cpufreq: imx6q: add return value check for voltage scale
  KVM: PPC: Move and undef TRACE_INCLUDE_PATH/FILE
  pinctrl: meson: fix pinconf bias disable
  usb: xhci: Prevent bus suspend if a port connect change or polling state is detected
  IB/hfi1: Eliminate races in the SDMA send error path
  IB/core: Fix for core panic
  can: dev: __can_get_echo_skb(): print error message, if trying to echo non existing skb
  can: dev: __can_get_echo_skb(): Don't crash the kernel if can_priv::echo_skb is accessed out of bounds
  can: dev: __can_get_echo_skb(): replace struct can_frame by canfd_frame to access frame length
  can: dev: can_get_echo_skb(): factor out non sending code to __can_get_echo_skb()
  drm/ast: Remove existing framebuffers before loading driver
  drm/ast: fixed cursor may disappear sometimes
  drm/ast: change resolution may cause screen blurred
  mm: don't warn about large allocations for slab
  llc: do not use sk_eat_skb()
  gfs2: Don't leave s_fs_info pointing to freed memory in init_sbd
  sctp: clear the transport of some out_chunk_list chunks in sctp_assoc_rm_peer
  bfs: add sanity check at bfs_fill_super()
  selinux: Add __GFP_NOWARN to allocation at str_read()
  v9fs_dir_readdir: fix double-free on p9stat_read error
  tools/power/cpupower: fix compilation with STATIC=true
  brcmfmac: fix reporting support for 160 MHz channels
  iwlwifi: mvm: fix regulatory domain update when the firmware starts
  iwlwifi: mvm: support sta_statistics() even on older firmware
  gpio: don't free unallocated ida on gpiochip_add_data_with_key() error path
  MAINTAINERS: Add Sasha as a stable branch maintainer
  usb: xhci: fix timeout for transition from RExit to U0
  usb: dwc3: core: Clean up ULPI device
  usb: core: Fix hub port connection events lost
  ANDROID: Kbuild, LLVMLinux: allow overriding clang target triple
  Revert "ANDROID: Kbuild, LLVMLinux: allow overriding clang target triple"
  arch/arm64/crypto/sha1-ce-glue.c fix 4.9.129 merge issue
  arch/arm64/crypto/sha2-ce-glue.c: fix 4.9.129 merge issue
  ANDROID: sdcardfs: Add option to not link obb
  ANDROID: sdcardfs: Add sandbox
  Revert "proc: Convert proc_mount to use mount_ns."
  xen: Fix 4.9.139 merge resolution
  efi/libstub: Fix 4.9.139 merge resolution
  Linux 4.9.141
  libceph: fall back to sendmsg for slab pages
  HID: uhid: forbid UHID_CREATE under KERNEL_DS or elevated privileges
  new helper: uaccess_kernel()
  ACPI / platform: Add SMB0001 HID to forbidden_id_list
  drivers/misc/sgi-gru: fix Spectre v1 vulnerability
  USB: misc: appledisplay: add 20" Apple Cinema Display
  misc: atmel-ssc: Fix section annotation on atmel_ssc_get_driver_data
  usb: quirks: Add delay-init quirk for Corsair K70 LUX RGB
  USB: quirks: Add no-lpm quirk for Raydium touchscreens
  usb: cdc-acm: add entry for Hiro (Conexant) modem
  uio: Fix an Oops on load
  media: v4l: event: Add subscription to list before calling "add" operation
  Revert "Bluetooth: h5: Fix missing dependency on BT_HCIUART_SERDEV"
  Revert "media: videobuf2-core: don't call memop 'finish' when queueing"
  btrfs: fix pinned underflow after transaction aborted
  btrfs: Ensure btrfs_trim_fs can trim the whole filesystem
  btrfs: Enhance btrfs_trim_fs function to handle error better
  ACPI / watchdog: Prefer iTCO_wdt always when WDAT table uses RTC SRAM
  ACPI / watchdog: Prefer iTCO_wdt on Lenovo Z50-70
  gfs2: Put bitmap buffers in put_super
  SUNRPC: drop pointless static qualifier in xdr_get_next_encode_buffer()
  zram: close udev startup race condition as default groups
  qed: Fix blocking/unlimited SPQ entries leak
  qed: Fix memory/entry leak in qed_init_sp_request()
  lib/raid6: Fix arm64 test build
  clk: fixed-factor: fix of_node_get-put imbalance
  hwmon: (ibmpowernv) Remove bogus __init annotations
  s390/qeth: fix HiperSockets sniffer
  netfilter: xt_IDLETIMER: add sysfs filename checking routine
  netfilter: ipset: Correct rcu_dereference() call in ip_set_put_comment()
  s390/mm: Fix ERROR: "__node_distance" undefined!
  netfilter: ipset: actually allow allowable CIDR 0 in hash:net,port,net
  s390/vdso: add missing FORCE to build targets
  arm64: percpu: Initialize ret in the default case
  platform/x86: acerhdf: Add BIOS entry for Gateway LT31 v1.3307
  clk: samsung: exynos5420: Enable PERIS clocks for suspend
  fs/exofs: fix potential memory leak in mount option parsing
  clk: fixed-rate: fix of_node_get-put imbalance
  platform/x86: intel_telemetry: report debugfs failure
  drm/edid: Add 6 bpc quirk for BOE panel.
  um: Give start_idle_thread() a return code
  hfsplus: prevent btree data loss on root split
  hfs: prevent btree data loss on root split
  reiserfs: propagate errors from fill_with_dentries() properly
  cifs: don't dereference smb_file_target before null check
  Linux 4.9.140
  Revert "ipv6: set rt6i_protocol properly in the route when it is installed"
  Revert "x86/speculation: Enable cross-hyperthread spectre v2 STIBP mitigation"
  Linux 4.9.139
  ARM: spectre-v1: mitigate user accesses
  ARM: spectre-v1: use get_user() for __get_user()
  ARM: use __inttype() in get_user()
  ARM: oabi-compat: copy semops using __copy_from_user()
  ARM: vfp: use __copy_from_user() when restoring VFP state
  ARM: signal: copy registers using __copy_from_user()
  ARM: spectre-v1: fix syscall entry
  ARM: spectre-v1: add array_index_mask_nospec() implementation
  ARM: spectre-v1: add speculation barrier (csdb) macros
  ARM: KVM: report support for SMCCC_ARCH_WORKAROUND_1
  ARM: KVM: Add SMCCC_ARCH_WORKAROUND_1 fast handling
  ARM: spectre-v2: KVM: invalidate icache on guest exit for Brahma B15
  ARM: KVM: invalidate icache on guest exit for Cortex-A15
  ARM: KVM: invalidate BTB on guest exit for Cortex-A12/A17
  ARM: spectre-v2: warn about incorrect context switching functions
  ARM: spectre-v2: add firmware based hardening
  ARM: spectre-v2: harden user aborts in kernel space
  ARM: spectre-v2: add Cortex A8 and A15 validation of the IBE bit
  ARM: spectre-v2: harden branch predictor on context switches
  ARM: spectre: add Kconfig symbol for CPUs vulnerable to Spectre
  ARM: bugs: add support for per-processor bug checking
  ARM: bugs: hook processor bug checking into SMP and suspend paths
  ARM: bugs: prepare processor bug infrastructure
  ARM: add more CPU part numbers for Cortex and Brahma B15 CPUs
  arm64: uaccess: suppress spurious clang warning
  Kbuild: use -fshort-wchar globally
  x86/build: Use cc-option to validate stack alignment parameter
  x86/build: Fix stack alignment for CLang
  efi/libstub/arm64: Set -fpie when building the EFI stub
  efi/libstub: Preserve .debug sections after absolute relocation check
  efi/libstub/arm64: Force 'hidden' visibility for section markers
  efi/libstub/arm64: Use hidden attribute for struct screen_info reference
  x86/boot: #undef memcpy() et al in string.c
  crypto: arm64/sha - avoid non-standard inline asm tricks
  kbuild: clang: Disable 'address-of-packed-member' warning
  x86/build: Specify stack alignment for clang
  x86/build: Use __cc-option for boot code compiler options
  kbuild: Add __cc-option macro
  crypto, x86: aesni - fix token pasting for clang
  x86/kbuild: Use cc-option to enable -falign-{jumps/loops}
  modules: mark __inittest/__exittest as __maybe_unused
  kbuild: Add support to generate LLVM assembly files
  kbuild: use -Oz instead of -Os when using clang
  kbuild, LLVMLinux: Add -Werror to cc-option to support clang
  kbuild: drop -Wno-unknown-warning-option from clang options
  kbuild: fix asm-offset generation to work with clang
  kbuild: consolidate redundant sed script ASM offset generation
  kbuild: Consolidate header generation from ASM offset information
  kbuild: clang: add -no-integrated-as to KBUILD_[AC]FLAGS
  kbuild: Add better clang cross build support
  ipv6: Fix PMTU updates for UDP/raw sockets in presence of VRF
  inet: frags: better deal with smp races
  usbnet: smsc95xx: disable carrier check while suspending
  tg3: Add PHY reset for 5717/5719/5720 in change ring and flow control paths
  sctp: not allow to set asoc prsctp_enable by sockopt
  net-gro: reset skb->pkt_type in napi_reuse_skb()
  ip_tunnel: don't force DF when MTU is locked
  flow_dissector: do not dissect l4 ports for fragments
  ANDROID: sched/debug: Make Energy Model read-only
  Linux 4.9.138
  KVM: arm64: Fix caching of host MDCR_EL2 value
  drm/i915/execlists: Force write serialisation into context image vs execution
  drm/i915/hdmi: Add HDMI 2.0 audio clock recovery N values
  drm/dp_mst: Check if primary mstb is null
  drm/rockchip: Allow driver to be shutdown on reboot/kexec
  mm: migration: fix migration of huge PMD shared pages
  hugetlbfs: fix kernel BUG at fs/hugetlbfs/inode.c:444!
  lib/ubsan.c: don't mark __ubsan_handle_builtin_unreachable as noreturn
  configfs: replace strncpy with memcpy
  fuse: fix leaked notify reply
  fuse: fix use-after-free in fuse_direct_IO()
  rtc: hctosys: Add missing range error reporting
  nfsd: COPY and CLONE operations require the saved filehandle to be set
  sunrpc: correct the computation for page_ptr when truncating
  mount: Prevent MNT_DETACH from disconnecting locked mounts
  mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts
  mount: Retest MNT_LOCKED in do_umount
  ext4: fix buffer leak in __ext4_read_dirblock() on error path
  ext4: fix buffer leak in ext4_xattr_move_to_block() on error path
  ext4: release bs.bh before re-using in ext4_xattr_block_find()
  ext4: fix possible leak of s_journal_flag_rwsem in error path
  ext4: fix possible leak of sbi->s_group_desc_leak in error path
  ext4: avoid possible double brelse() in add_new_gdb() on error path
  ext4: fix missing cleanup if ext4_alloc_flex_bg_array() fails while resizing
  ext4: avoid buffer leak in ext4_orphan_add() after prior errors
  ext4: fix possible inode leak in the retry loop of ext4_resize_fs()
  ext4: avoid potential extra brelse in setup_new_flex_group_blocks()
  ext4: add missing brelse() add_new_gdb_meta_bg()'s error path
  ext4: add missing brelse() in set_flexbg_block_bitmap()'s error path
  ext4: add missing brelse() update_backups()'s error path
  clockevents/drivers/i8253: Add support for PIT shutdown quirk
  Btrfs: fix data corruption due to cloning of eof block
  Btrfs: fix cur_offset in the error case for nocow
  arch/alpha, termios: implement BOTHER, IBSHIFT and termios2
  termios, tty/tty_baudrate.c: fix buffer overrun
  of, numa: Validate some distance map rules
  mtd: docg3: don't set conflicting BCH_CONST_PARAMS option
  netfilter: conntrack: fix calculation of next bucket number in early_drop
  mm: thp: relax __GFP_THISNODE for MADV_HUGEPAGE mappings
  ocfs2: fix a misuse a of brelse after failing ocfs2_check_dir_entry
  vhost/scsi: truncate T10 PI iov_iter to prot_bytes
  reset: hisilicon: fix potential NULL pointer dereference
  mach64: fix image corruption due to reading accelerator registers
  mach64: fix display corruption on big endian machines
  Revert "ceph: fix dentry leak in splice_dentry()"
  libceph: bump CEPH_MSG_MAX_DATA_LEN
  clk: rockchip: Fix static checker warning in rockchip_ddrclk_get_parent call
  clk: at91: Fix division by zero in PLL recalc_rate()
  clk: s2mps11: Fix matching when built as module and DT node contains compatible
  xtensa: fix boot parameters address translation
  xtensa: make sure bFLT stack is 16 byte aligned
  xtensa: add NOTES section to the linker script
  MIPS: Loongson-3: Fix BRIDGE irq delivery problem
  MIPS: Loongson-3: Fix CPU UART irq delivery problem
  parisc: Fix exported address of os_hpmc handler
  parisc: Fix HPMC handler by increasing size to multiple of 16 bytes
  parisc: Align os_hpmc_size on word boundary
  bna: ethtool: Avoid reading past end of buffer
  e1000: fix race condition between e1000_down() and e1000_watchdog
  e1000: avoid null pointer dereference on invalid stat type
  mm: do not bug_on on incorrect length in __mm_populate()
  fuse: set FR_SENT while locked
  fuse: fix blocked_waitq wakeup
  fuse: Fix use-after-free in fuse_dev_do_write()
  fuse: Fix use-after-free in fuse_dev_do_read()
  scsi: qla2xxx: shutdown chip if reset fail
  scsi: qla2xxx: Fix incorrect port speed being set for FC adapters
  cdrom: fix improper type cast, which can leat to information leak.
  9p: clear dangling pointers in p9stat_free
  9p locks: fix glock.client_id leak in do_lock
  powerpc/selftests: Wait all threads to join
  media: tvp5150: fix width alignment during set_selection()
  sc16is7xx: Fix for multi-channel stall
  MIPS/PCI: Call pcie_bus_configure_settings() to set MPS/MRRS
  powerpc/boot: Ensure _zimage_start is a weak symbol
  MIPS: kexec: Mark CPU offline before disabling local IRQ
  media: pci: cx23885: handle adding to list failure
  drm/omap: fix memory barrier bug in DMM driver
  powerpc/nohash: fix undefined behaviour when testing page size support
  ARM: imx_v6_v7_defconfig: Select CONFIG_TMPFS_POSIX_ACL
  tty: check name length in tty_find_polling_driver()
  powerpc/eeh: Fix possible null deref in eeh_dump_dev_log()
  Linux 4.9.137
  MD: fix invalid stored role for a disk - try2
  btrfs: set max_extent_size properly
  Btrfs: fix null pointer dereference on compressed write path error
  btrfs: qgroup: Dirty all qgroups before rescan
  Btrfs: fix wrong dentries after fsync of file that got its parent replaced
  btrfs: make sure we create all new block groups
  btrfs: reset max_extent_size on clear in a bitmap
  btrfs: wait on caching when putting the bg cache
  btrfs: don't attempt to trim devices that don't support it
  btrfs: iterate all devices during trim, instead of fs_devices::alloc_list
  btrfs: fix error handling in free_log_tree
  btrfs: locking: Add extra check in btrfs_init_new_buffer() to avoid deadlock
  btrfs: Handle owner mismatch gracefully when walking up tree
  soc/tegra: pmc: Fix child-node lookup
  arm64: dts: stratix10: Correct System Manager register size
  Cramfs: fix abad comparison when wrap-arounds occur
  rpmsg: smd: fix memory leak on channel create
  arm64: lse: remove -fcall-used-x0 flag
  media: em28xx: make v4l2-compliance happier by starting sequence on zero
  media: em28xx: fix input name for Terratec AV 350
  media: tvp5150: avoid going past array on v4l2_querymenu()
  media: em28xx: use a default format if TRY_FMT fails
  xen: fix xen_qlock_wait()
  kgdboc: Passing ekgdboc to command line causes panic
  media: v4l2-tpg: fix kernel oops when enabling HFLIP and OSD
  TC: Set DMA masks for devices
  MIPS: OCTEON: fix out of bounds array access on CN68XX
  powerpc/msi: Fix compile error on mpc83xx
  dm ioctl: harden copy_params()'s copy_from_user() from malicious users
  lockd: fix access beyond unterminated strings in prints
  nfsd: Fix an Oops in free_session()
  NFSv4.1: Fix the r/wsize checking
  genirq: Fix race on spurious interrupt detection
  printk: Fix panic caused by passing log_buf_len to command line
  smb3: on kerberos mount if server doesn't specify auth type use krb5
  smb3: do not attempt cifs operation in smb3 query info error path
  smb3: allow stats which track session and share reconnects to be reset
  w1: omap-hdq: fix missing bus unregister at removal
  iio: adc: at91: fix wrong channel number in triggered buffer mode
  iio: adc: at91: fix acking DRDY irq on simple conversions
  iio: adc: imx25-gcq: Fix leak of device_node in mx25_gcq_setup_cfgs()
  iio: ad5064: Fix regulator handling
  kbuild: fix kernel/bounds.c 'W=1' warning
  hugetlbfs: dirty pages as they are added to pagecache
  ima: fix showing large 'violations' or 'runtime_measurements_count'
  crypto: tcrypt - fix ghash-generic speed test
  crypto: lrw - Fix out-of bounds access on counter overflow
  signal/GenWQE: Fix sending of SIGKILL
  PCI: Add Device IDs for Intel GPU "spurious interrupt" quirk
  EDAC, skx_edac: Fix logical channel intermediate decoding
  EDAC, {i7core,sb,skx}_edac: Fix uncorrected error counting
  HID: hiddev: fix potential Spectre v1
  ext4: propagate error from dquot_initialize() in EXT4_IOC_FSSETXATTR
  ext4: initialize retries variable in ext4_da_write_inline_data_begin()
  gfs2_meta: ->mount() can get NULL dev_name
  jbd2: fix use after free in jbd2_log_do_checkpoint()
  ASoC: intel: skylake: Add missing break in skl_tplg_get_token()
  libnvdimm: Hold reference on parent while scheduling async init
  net/ipv4: defensive cipso option parsing
  iwlwifi: mvm: check return value of rs_rate_from_ucode_rate()
  usbip:vudc: BUG kmalloc-2048 (Not tainted): Poison overwritten
  libertas: don't set URB_ZERO_PACKET on IN USB transfer
  xen: make xen_qlock_wait() nestable
  xen: fix race in xen_qlock_wait()
  xen/blkfront: avoid NULL blkfront_info dereference on device removal
  tpm: Restore functionality to xen vtpm driver.
  xen-swiotlb: use actually allocated size on check physical continuous
  ARM: dts: exynos: Mark 1 GHz CPU OPP as suspend OPP on Exynos5250
  ARM: dts: exynos: Convert exynos5250.dtsi to opp-v2 bindings
  arm: dts: exynos: Add missing cooling device properties for CPUs
  ARM: dts: exynos: Remove "cooling-{min|max}-level" for CPU nodes
  ALSA: hda: Check the non-cached stream buffers more explicitly
  dmaengine: dma-jz4780: Return error if not probed from DT
  signal: Always deliver the kernel's SIGKILL and SIGSTOP to a pid namespace init
  scsi: lpfc: Correct soft lockup when running mds diagnostics
  uio: ensure class is registered before devices
  driver/dma/ioat: Call del_timer_sync() without holding prep_lock
  usb: chipidea: Prevent unbalanced IRQ disable
  crypto: caam - fix implicit casts in endianness helpers
  coresight: etb10: Fix handling of perf mode
  PCI/MSI: Warn and return error if driver enables MSI/MSI-X twice
  MD: fix invalid stored role for a disk
  ext4: fix argument checking in EXT4_IOC_MOVE_EXT
  usb: gadget: udc: atmel: handle at91sam9rl PMC
  VMCI: Resource wildcard match fixed
  tpm: suppress transmit cmd error logs when TPM 1.2 is disabled/deactivated
  IB/ipoib: Clear IPCB before icmp_send
  RDMA/core: Do not expose unsupported counters
  scsi: megaraid_sas: fix a missing-check bug
  scsi: esp_scsi: Track residual for PIO transfers
  cgroup, netclassid: add a preemption point to write_classid
  ath10k: schedule hardware restart if WMI command times out
  ixgbevf: VF2VF TCP RSS
  pinctrl: ssbi-gpio: Fix pm8xxx_pin_config_get() to be compliant
  pinctrl: spmi-mpp: Fix pmic_mpp_config_get() to be compliant
  pinctrl: qcom: spmi-mpp: Fix drive strength setting
  ACPI / LPSS: Add alternative ACPI HIDs for Cherry Trail DMA controllers
  kprobes: Return error if we fail to reuse kprobe instead of BUG_ON()
  brcmfmac: fix for proper support of 160MHz bandwidth
  pinctrl: qcom: spmi-mpp: Fix err handling of pmic_mpp_set_mux
  x86: boot: Fix EFI stub alignment
  Bluetooth: btbcm: Add entry for BCM4335C0 UART bluetooth
  cpufreq: dt: Try freeing static OPPs only if we have added them
  x86/olpc: Indicate that legacy PC XO-1 platform should not register RTC
  iwlwifi: pcie: avoid empty free RB queue
  mmc: sdhci-pci-o2micro: Add quirk for O2 Micro dev 0x8620 rev 0x01
  perf strbuf: Match va_{add,copy} with va_end
  perf tools: Cleanup trace-event-info 'tdata' leak
  perf tools: Free temporary 'sys' string in read_event_files()
  hwmon: (pwm-fan) Set fan speed to 0 on suspend
  s390/sthyi: Fix machine name validity indication
  tun: Consistently configure generic netdev params via rtnetlink
  swim: fix cleanup on setup error
  ataflop: fix error handling during setup
  locking/lockdep: Fix debug_locks off performance problem
  i2c: rcar: cleanup DMA for all kinds of failure
  selftests: ftrace: Add synthetic event syntax testcase
  net: qla3xxx: Remove overflowing shift statement
  x86/fpu: Remove second definition of fpu in __fpu__restore_sig()
  perf cpu_map: Align cpu map synthesized events properly.
  sched/fair: Fix the min_vruntime update logic in dequeue_entity()
  sparc64: Make proc_id signed.
  sparc: Fix single-pcr perf event counter management.
  xfrm: policy: use hlist rcu variants on insert
  Revert "perf tools: Fix PMU term format max value calculation"
  bpf: do not blindly change rlimit in reuseport net selftest
  x86/speculation: Support Enhanced IBRS on future CPUs
  x86/corruption-check: Fix panic in memory_corruption_check() when boot option without value is provided
  x86/speculation: Enable cross-hyperthread spectre v2 STIBP mitigation
  ALSA: ca0106: Disable IZD on SB0570 DAC to fix audio pops
  ALSA: hda - Add mic quirk for the Lenovo G50-30 (17aa:3905)
  ALSA: hda - Fix headphone pin config for ASUS G751
  ALSA: hda - Add quirk for ASUS G751 laptop
  parisc: Fix map_pages() to not overwrite existing pte entries
  parisc: Fix address in HPMC IVA
  ipmi: Fix timer race with module unload
  pcmcia: Implement CLKRUN protocol disabling for Ricoh bridges
  jffs2: free jffs2_sb_info through jffs2_kill_sb()
  hwmon: (pmbus) Fix page count auto-detection.
  bcache: fix miss key refill->end in writeback
  ANDROID: zram: set comp_len to PAGE_SIZE when page is huge
  Linux 4.9.136
  posix-timers: Sanitize overrun handling
  net: fs_enet: do not call phy_stop() in interrupts
  x86/time: Correct the attribute on jiffies' definition
  x86/percpu: Fix this_cpu_read()
  sched/fair: Fix throttle_list starvation with low CFS quota
  Input: elan_i2c - add ACPI ID for Lenovo IdeaPad 330-15IGM
  USB: fix the usbfs flag sanitization for control transfers
  usb: gadget: storage: Fix Spectre v1 vulnerability
  cdc-acm: correct counting of UART states in serial state notification
  IB/ucm: Fix Spectre v1 vulnerability
  RDMA/ucma: Fix Spectre v1 vulnerability
  drm/edid: Add 6 bpc quirk for BOE panel in HP Pavilion 15-n233sl
  ptp: fix Spectre v1 vulnerability
  cachefiles: fix the race between cachefiles_bury_object() and rmdir(2)
  xfs: truncate transaction does not modify the inobt
  gpio: mxs: Get rid of external API call
  ahci: don't ignore result code of ahci_reset_controller()
  crypto: shash - Fix a sleep-in-atomic bug in shash_setkey_unaligned
  Revert "x86/mm: Expand static page table for fixmap space"
  ip6_tunnel: Fix encapsulation layout
  rtnetlink: Disallow FDB configuration for non-Ethernet device
  net: fix pskb_trim_rcsum_slow() with odd trim offset
  net: drop skb on failure in ip_check_defrag()
  bonding: fix length of actor system
  ethtool: fix a privilege escalation bug
  vhost: Fix Spectre V1 vulnerability
  sctp: fix race on sctp_id2asoc
  r8169: fix NAPI handling under high load
  net: udp: fix handling of CHECKSUM_COMPLETE packets
  net: stmmac: Fix stmmac_mdio_reset() when building stmmac as modules
  net: socket: fix a missing-check bug
  net: sched: gred: pass the right attribute to gred_change_table_def()
  net/ipv6: Fix index counter for unicast addresses in in6_dump_addrs
  llc: set SOCK_RCU_FREE in llc_sap_add_socket()
  ipv6/ndisc: Preserve IPv6 control buffer if protocol error handlers are called
  ipv6: mcast: fix a use-after-free in inet6_mc_check
  net: bridge: remove ipv6 zero address check in mcast queries
  bridge: do not add port to router list when receives query with source 0.0.0.0
  perf tools: Disable parallelism for 'make clean'
  Revert "netfilter: ipv6: nf_defrag: drop skb dst before queueing"
  mtd: spi-nor: Add support for is25wp series chips
  fs/fat/fatent.c: add cond_resched() to fat_count_free_clusters()
  net: ena: fix NULL dereference due to untimely napi initialization
  rxrpc: Only take the rwind and mtu values from latest ACK
  rxrpc: Don't check RXRPC_CALL_TX_LAST after calling rxrpc_rotate_tx_window()
  ARM: dts: imx53-qsb: disable 1.2GHz OPP
  perf tests: Fix indexing when invoking subtests
  xhci: Fix USB3 NULL pointer dereference at logical disconnect.
  libertas: call into generic suspend code before turning off power
  IB/mlx4: Fix an error handling path in 'mlx4_ib_rereg_user_mr()'
  x86/paravirt: Fix some warning messages
  iio: buffer: fix the function signature to match implementation
  nvmet: fix space padding in serial number
  bonding: ratelimit failed speed/duplex update warning
  enic: do not overwrite error code
  xen-netfront: Fix mismatched rtnl_unlock
  sparc64: Fix regression in pmdp_invalidate().
  xen-netfront: Update features after registering netdev
  test_bpf: Fix testing with CONFIG_BPF_JIT_ALWAYS_ON=y on other arches
  ALSA: hda - Fix incorrect usage of IS_REACHABLE()
  futex: futex_wake_op, do not fail on invalid op
  cifs: Use ULL suffix for 64-bit constant
  perf/core: Fix locking for children siblings group read
  macsec: fix memory leaks when skb_to_sgvec fails
  l2tp: remove configurable payload offset
  iio: pressure: zpa2326: Remove always-true check which confuses gcc
  module: fix DEBUG_SET_MODULE_RONX typo
  drm/msm: Fix possible null dereference on failure of get_pages()
  Btrfs: incremental send, fix invalid memory access
  Revert "IB/ipoib: Update broadcast object if PKey value was changed in index 0"
  i40e: avoid NVM acquire deadlock during NVM update
  drm: bochs: Don't remove uninitialized fbdev framebuffer
  scsi: qla2xxx: Avoid double completion of abort command
  IB/mlx5: Avoid passing an invalid QP type to firmware
  mm/frame_vector.c: release a semaphore in 'get_vaddr_frames()'
  nbd: only set MSG_MORE when we have more to send
  IB/rxe: put the pool on allocation failure
  IB/ipoib: Fix lockdep issue found on ipoib_ib_dev_heavy_flush
  ipv6: fix cleanup ordering for ip6_mr failure
  ath10k: convert warning about non-existent OTP board id to debug message
  ALSA: hda - No loopback on ALC299 codec
  sctp: use right member as the param of list_for_each_entry
  net: cdc_ncm: GetNtbFormat endian fix
  ocfs2: fix deadlock caused by recursive locking in xattr
  qed: Warn PTT usage by wrong hw-function
  iio: adc: Revert "axp288: Drop bogus AXP288_ADC_TS_PIN_CTRL register modifications"
  rds: ib: Fix missing call to rds_ib_dev_put in rds_ib_setup_qp
  staging: wilc1000: Fix problem with wrong vif index
  ptr_ring: fix up after recent ptr_ring changes
  clk: samsung: Fix m2m scaler clock on Exynos542x
  usb: dwc3: omap: remove IRQ_NOAUTOEN used with shared irq
  usb: renesas_usbhs: gadget: fix unused-but-set-variable warning
  usb: renesas_usbhs: gadget: fix spin_lock_init() for &uep->lock
  net/mlx5: Fix health work queue spin lock to IRQ safe
  perf probe: Fix probe definition for inlined functions
  perf evsel: Fix probing of precise_ip level for default cycles event
  net/mlx5: Fix driver load error flow when firmware is stuck
  ip6_tunnel: Correct tos value in collect_md mode
  net/mlx5e: Fix fixpoint divide exception in mlx5e_am_stats_compare
  ufs: we need to sync inode before freeing it
  Btrfs: clear EXTENT_DEFRAG bits in finish_ordered_io
  net: stmmac: ensure jumbo_frm error return is correctly checked for -ve value
  elevator: fix truncation of icq_cache_name
  gpu: ipu-v3: Fix CSI selection for VDIC
  ARM: 8677/1: boot/compressed: fix decompressor header layout for v7-M
  x86/cpu/cyrix: Add alternative Device ID of Geode GX1 SoC
  qlcnic: Fix tunnel offload for 82xx adapters
  net: ethernet: stmmac: Fix altr_tse_pcs SGMII Initialization
  libata: fix error checking in in ata_parse_force_one()
  mac80211: fix TX aggregation start/stop callback race
  arch/sparc: increase CONFIG_NODES_SHIFT on SPARC64 to 5
  ASoC: Intel: Skylake: Fix to parse consecutive string tkns in manifest
  reset: hi6220: Set module license so that it can be loaded
  ata: sata_rcar: Handle return value of clk_prepare_enable
  btrfs: fiemap: Cache and merge fiemap extent before submit it to user
  ARM: dts: bcm283x: Reserve first page for firmware
  ath10k: fix NAPI enable/disable symmetry for AHB interface
  bnxt_en: Don't use rtnl lock to protect link change logic in workqueue.
  tipc: fix a race condition of releasing subscriber object
  tipc: Fix tipc_sk_reinit handling of -EAGAIN
  net/mlx5: Fix command completion after timeout access invalid structure
  net: phy: marvell: Limit 88m1101 autoneg errata to 88E1145 as well.
  nvme-pci: fix CMB sysfs file removal in reset path
  rxe: Fix a sleep-in-atomic bug in post_one_send
  orangefs: off by ones in xattr size checks
  IB/core: Fix the validations of a multicast LID in attach or detach operations
  IB/ipoib: Do not warn if IPoIB debugfs doesn't exist
  platform/x86: acer-wmi: setup accelerometer when ACPI device was found
  ipv6: set rt6i_protocol properly in the route when it is installed
  efi/fb: Correct PCI_STD_RESOURCE_END usage
  i2c: bcm2835: Avoid possible NULL ptr dereference
  PCI: Disable MSI for HiSilicon Hip06/Hip07 only in Root Port mode
  ACPI: sysfs: Make ACPI GPE mask kernel parameter cover all GPEs
  igb: Remove superfluous reset to PHY and page 0 selection
  f2fs: fix multiple f2fs_add_link() having same name for inline dentry
  scsi: aacraid: Fix typo in blink status
  MIPS: Handle non word sized instructions when examining frame
  MIPS: microMIPS: Fix decoding of swsp16 instruction
  mm/memory_hotplug.c: fix overflow in test_pages_in_a_zone()
  perf symbols: Fix memory corruption because of zero length symbols
  net: cxgb3_main: fix a missing-check bug
  declance: Fix continuation with the adapter identification message
  net: fec: fix rare tx timeout
  perf/x86/intel/uncore: Fix PCI BDF address of M3UPI on SKX
  perf/ring_buffer: Prevent concurent ring buffer access
  smsc95xx: Check for Wake-on-LAN modes
  smsc75xx: Check for Wake-on-LAN modes
  r8152: Check for supported Wake-on-LAN Modes
  sr9800: Check for supported Wake-on-LAN modes
  lan78xx: Check for supported Wake-on-LAN modes
  ax88179_178a: Check for supported Wake-on-LAN modes
  asix: Check for supported Wake-on-LAN modes
  qed: Avoid constant logical operation warning in qed_vf_pf_acquire
  qed: Avoid implicit enum conversion in qed_roce_mode_to_flavor
  pxa168fb: prepare the clock
  Bluetooth: SMP: fix crash in unpairing
  mac80211_hwsim: do not omit multicast announce of first added radio
  nl80211: Fix possible Spectre-v1 for NL80211_TXRATE_HT
  soc: fsl: qe: Fix copy/paste bug in ucc_get_tdm_sync_shift()
  soc: fsl: qbman: qman: avoid allocating from non existing gen_pool
  net: macb: Clean 64b dma addresses if they are not detected
  ARM: dts: BCM63xx: Fix incorrect interrupt specifiers
  xfrm: validate template mode
  ARM: 8799/1: mm: fix pci_ioremap_io() offset check
  mac80211: TDLS: fix skb queue/priority assignment
  cfg80211: Address some corner cases in scan result channel updating
  mac80211: fix pending queue hang due to TX_DROP
  cfg80211: reg: Init wiphy_idx in regulatory_hint_core()
  mac80211: Always report TX status
  xfrm6: call kfree_skb when skb is toobig
  xfrm: Validate address prefix lengths in the xfrm selector.
  BACKPORT: arm64: Expose support for optional ARMv8-A features
  ANDROID: sdcardfs: Add option to drop unused dentries
  UPSTREAM: xfrm: fix ptr_ret.cocci warnings
  UPSTREAM: xfrm: Return detailed errors from xfrmi_newlink
  UPSTREAM: xfrm: Allow xfrmi if_id to be updated by UPDSA
  UPSTREAM: xfrm: Allow Set Mark to be Updated Using UPDSA
  BACKPORT: xfrm: Add virtual xfrm interfaces
  BACKPORT: xfrm: Add a new lookup key to match xfrm interfaces.
  UPSTREAM: flow: Extend flow informations with xfrm interface id.
  BACKPORT: xfrm: Extend the output_mark to support input direction and masking.
  BACKPORT: xfrm: fix XFRMA_OUTPUT_MARK policy entry
  f2fs: guarantee journalled quota data by checkpoint
  f2fs: cleanup dirty pages if recover failed
  f2fs: fix data corruption issue with hardware encryption
  f2fs: fix to recover inode->i_flags of inode block during POR
  f2fs: spread f2fs_set_inode_flags()
  f2fs: fix to spread clear_cold_data()
  Revert "f2fs: fix to clear PG_checked flag in set_page_dirty()"
  f2fs: account read IOs and use IO counts for is_idle
  f2fs: fix to account IO correctly for cgroup writeback
  f2fs: fix to account IO correctly
  f2fs: remove request_list check in is_idle()
  f2fs: allow to mount, if quota is failed
  f2fs: update REQ_TIME in f2fs_cross_rename()
  f2fs: do not update REQ_TIME in case of error conditions
  f2fs: remove unneeded disable_nat_bits()
  f2fs: remove unused sbi->trigger_ssr_threshold
  f2fs: shrink sbi->sb_lock coverage in set_file_temperature()
  f2fs: fix to recover cold bit of inode block during POR
  f2fs: submit cached bio to avoid endless PageWriteback
  f2fs: checkpoint disabling
  f2fs: clear PageError on the read path
  f2fs: allow out-place-update for direct IO in LFS mode
  f2fs: refactor ->page_mkwrite() flow
  Revert: "f2fs: check last page index in cached bio to decide submission"
  f2fs: support superblock checksum
  f2fs: add to account skip count of background GC
  f2fs: add to account meta IO
  f2fs: keep lazytime on remount
  f2fs: fix missing up_read
  f2fs: return correct errno in f2fs_gc
  f2fs: avoid f2fs_bug_on if f2fs_get_meta_page_nofail got EIO
  f2fs: mark inode dirty explicitly in recover_inode()
  f2fs: fix to recover inode's crtime during POR
  f2fs: fix to recover inode's i_gc_failures during POR
  f2fs: fix to recover inode's i_flags during POR
  f2fs: fix to recover inode's project id during POR
  f2fs: update i_size after DIO completion
  f2fs: report ENOENT correctly in f2fs_rename
  f2fs: fix remount problem of option io_bits
  f2fs: fix to recover inode's uid/gid during POR
  f2fs: avoid infinite loop in f2fs_alloc_nid
  f2fs: add new idle interval timing for discard and gc paths
  f2fs: split IO error injection according to RW
  f2fs: add SPDX license identifiers
  f2fs: surround fault_injection related option parsing using CONFIG_F2FS_FAULT_INJECTION
  f2fs: avoid sleeping under spin_lock
  f2fs: plug readahead IO in readdir()
  f2fs: fix to do sanity check with current segment number
  f2fs: fix memory leak of percpu counter in fill_super()
  f2fs: fix memory leak of write_io in fill_super()
  f2fs: cache NULL when both default_acl and acl are NULL
  f2fs: fix to flush all dirty inodes recovered in readonly fs
  f2fs: report error if quota off error during umount
  f2fs: submit bio after shutdown
  f2fs: avoid wrong decrypted data from disk
  Revert "f2fs: use printk_ratelimited for f2fs_msg"
  f2fs: fix unnecessary periodic wakeup of discard thread when dev is busy
  f2fs: fix to avoid NULL pointer dereference on se->discard_map
  f2fs: add additional sanity check in f2fs_acl_from_disk()
  UPSTREAM: HID: sony: remove redundant check for -ve err
  UPSTREAM: HID: sony: Make sure to unregister sensors on failure
  UPSTREAM: HID: sony: Make DS4 bt poll interval adjustable
  UPSTREAM: HID: sony: Set proper bit flags on DS4 output report
  UPSTREAM: HID: sony: DS4 use brighter LED colors
  UPSTREAM: HID: sony: Improve navigation controller axis/button mapping
  UPSTREAM: HID: sony: Use DS3 MAC address as unique identifier on USB
  UPSTREAM: HID: sony: Perform duplicate device check earlier on
  UPSTREAM: HID: sony: Expose DS3 motion sensors through separate device
  UPSTREAM: HID: sony: Print error on failure to active DS3 / Navigation controllers
  UPSTREAM: HID: sony: DS3 comply to Linux gamepad spec
  UPSTREAM: HID: sony: Mark DS4 touchpad device as a pointer
  UPSTREAM: HID: sony: Support motion sensor calibration on dongle
  UPSTREAM: HID: sony: Make work handling more generic
  UPSTREAM: HID: sony: Treat the ds4 dongle as a separate device
  UPSTREAM: HID: sony: Remove report descriptor fixup for DS4
  UPSTREAM: HID: sony: Report hardware timestamp for DS4 sensor values
  UPSTREAM: HID: sony: Calibrate DS4 motion sensors
  UPSTREAM: HID: sony: Report DS4 motion sensors through a separate device
  UPSTREAM: HID: sony: Fix input device leak when connecting a DS4 twice using USB/BT
  UPSTREAM: HID: sony: Ignore DS4 dongle reports when no device is connected
  UPSTREAM: HID: sony: Use DS4 MAC address as unique identifier on USB
  UPSTREAM: HID: sony: Fix error handling bug when touchpad registration fails
  UPSTREAM: HID: sony: Comply to Linux gamepad spec for DS4
  UPSTREAM: HID: sony: Make the DS4 touchpad a separate device
  UPSTREAM: HID: sony: Fix memory issue when connecting device using both Bluetooth and USB
  UPSTREAM: HID: sony: Adjust value range for motion sensors
  UPSTREAM: HID: sony: Handle multiple touch events input record
  UPSTREAM: HID: sony: Send ds4 output reports on output end-point
  UPSTREAM: HID: sony: Perform CRC check on bluetooth input packets
  UPSTREAM: HID: sony: Adjust HID report size name definitions
  UPSTREAM: HID: sony: Fix race condition in sony_probe

Conflicts:
	arch/arm/include/asm/cputype.h
	drivers/gpu/drm/msm/msm_gem.c
	drivers/scsi/ufs/ufshcd.c
	drivers/usb/dwc3/core.c
	fs/f2fs/data.c
	fs/f2fs/f2fs.h
	fs/f2fs/segment.c
	kernel/sched/core.c
	net/xfrm/xfrm_user.c

Change-Id: I33a8fa8d996fb61c9730f4128b50e7716e84c9fe
Signed-off-by: jianzhou <jianzhou@codeaurora.org>
2019-01-03 16:41:57 +08:00
Greg Kroah-Hartman
db71418d4a Merge 4.9.142 into android-4.9
Changes in 4.9.142
	usb: core: Fix hub port connection events lost
	usb: dwc3: core: Clean up ULPI device
	usb: xhci: fix timeout for transition from RExit to U0
	MAINTAINERS: Add Sasha as a stable branch maintainer
	gpio: don't free unallocated ida on gpiochip_add_data_with_key() error path
	iwlwifi: mvm: support sta_statistics() even on older firmware
	iwlwifi: mvm: fix regulatory domain update when the firmware starts
	brcmfmac: fix reporting support for 160 MHz channels
	tools/power/cpupower: fix compilation with STATIC=true
	v9fs_dir_readdir: fix double-free on p9stat_read error
	selinux: Add __GFP_NOWARN to allocation at str_read()
	bfs: add sanity check at bfs_fill_super()
	sctp: clear the transport of some out_chunk_list chunks in sctp_assoc_rm_peer
	gfs2: Don't leave s_fs_info pointing to freed memory in init_sbd
	llc: do not use sk_eat_skb()
	mm: don't warn about large allocations for slab
	drm/ast: change resolution may cause screen blurred
	drm/ast: fixed cursor may disappear sometimes
	drm/ast: Remove existing framebuffers before loading driver
	can: dev: can_get_echo_skb(): factor out non sending code to __can_get_echo_skb()
	can: dev: __can_get_echo_skb(): replace struct can_frame by canfd_frame to access frame length
	can: dev: __can_get_echo_skb(): Don't crash the kernel if can_priv::echo_skb is accessed out of bounds
	can: dev: __can_get_echo_skb(): print error message, if trying to echo non existing skb
	IB/core: Fix for core panic
	IB/hfi1: Eliminate races in the SDMA send error path
	usb: xhci: Prevent bus suspend if a port connect change or polling state is detected
	pinctrl: meson: fix pinconf bias disable
	KVM: PPC: Move and undef TRACE_INCLUDE_PATH/FILE
	cpufreq: imx6q: add return value check for voltage scale
	rtc: pcf2127: fix a kmemleak caused in pcf2127_i2c_gather_write
	floppy: fix race condition in __floppy_read_block_0()
	powerpc/io: Fix the IO workarounds code to work with Radix
	perf/x86/intel/uncore: Add more IMC PCI IDs for KabyLake and CoffeeLake CPUs
	SUNRPC: Fix a bogus get/put in generic_key_to_expire()
	kdb: Use strscpy with destination buffer size
	powerpc/numa: Suppress "VPHN is not supported" messages
	efi/arm: Revert deferred unmap of early memmap mapping
	tmpfs: make lseek(SEEK_DATA/SEK_HOLE) return ENXIO with a negative offset
	of: add helper to lookup compatible child node
	NFC: nfcmrvl_uart: fix OF child-node lookup
	net: bcmgenet: fix OF child-node lookup
	arm64: remove no-op -p linker flag
	ath10k: fix kernel panic due to race in accessing arvif list
	Input: xpad - add product ID for Xbox One S pad
	Input: xpad - fix Xbox One rumble stopping after 2.5 secs
	Input: xpad - correctly sort vendor id's
	Input: xpad - move reporting xbox one home button to common function
	Input: xpad - simplify error condition in init_output
	Input: xpad - don't depend on endpoint order
	Input: xpad - fix stuck mode button on Xbox One S pad
	Input: xpad - restore LED state after device resume
	Input: xpad - support some quirky Xbox One pads
	Input: xpad - sort supported devices by USB ID
	Input: xpad - sync supported devices with xboxdrv
	Input: xpad - add USB IDs for Mad Catz Brawlstick and Razer Sabertooth
	Input: xpad - sync supported devices with 360Controller
	Input: xpad - sync supported devices with XBCD
	Input: xpad - constify usb_device_id
	Input: xpad - fix PowerA init quirk for some gamepad models
	Input: xpad - validate USB endpoint type during probe
	Input: xpad - add support for PDP Xbox One controllers
	Input: xpad - add PDP device id 0x02a4
	Input: xpad - fix some coding style issues
	Input: xpad - avoid using __set_bit() for capabilities
	Input: xpad - add GPD Win 2 Controller USB IDs
	Input: xpad - fix GPD Win 2 controller name
	Input: xpad - add support for Xbox1 PDP Camo series gamepad
	cw1200: Don't leak memory if krealloc failes
	mwifiex: prevent register accesses after host is sleeping
	mwifiex: report error to PCIe for suspend failure
	mwifiex: Fix NULL pointer dereference in skb_dequeue()
	mwifiex: fix p2p device doesn't find in scan problem
	scsi: ufs: fix bugs related to null pointer access and array size
	scsi: ufshcd: Fix race between clk scaling and ungate work
	scsi: ufs: fix race between clock gating and devfreq scaling work
	scsi: ufshcd: release resources if probe fails
	include/linux/pfn_t.h: force '~' to be parsed as an unary operator
	tty: wipe buffer.
	tty: wipe buffer if not echoing data
	usb: xhci: fix uninitialized completion when USB3 port got wrong status
	sched/core: Allow __sched_setscheduler() in interrupts when PI is not used
	namei: allow restricted O_CREAT of FIFOs and regular files
	lan78xx: Read MAC address from DT if present
	s390/mm: Check for valid vma before zapping in gmap_discard
	net: ieee802154: 6lowpan: fix frag reassembly
	Revert "evm: Translate user/group ids relative to s_user_ns when computing HMAC"
	ima: always measure and audit files in policy
	EVM: Add support for portable signature format
	ima: re-introduce own integrity cache lock
	ima: re-initialize iint->atomic_flags
	Linux 4.9.142

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2018-12-01 10:00:35 +01:00
Salvatore Mesoraca
0c41beebcd namei: allow restricted O_CREAT of FIFOs and regular files
commit 30aba6656f61ed44cba445a3c0d38b296fa9e8f5 upstream.

Disallows open of FIFOs or regular files not owned by the user in world
writable sticky directories, unless the owner is the same as that of the
directory or the file is opened without the O_CREAT flag.  The purpose
is to make data spoofing attacks harder.  This protection can be turned
on and off separately for FIFOs and regular files via sysctl, just like
the symlinks/hardlinks protection.  This patch is based on Openwall's
"HARDEN_FIFO" feature by Solar Designer.

This is a brief list of old vulnerabilities that could have been prevented
by this feature, some of them even allow for privilege escalation:

CVE-2000-1134
CVE-2007-3852
CVE-2008-0525
CVE-2009-0416
CVE-2011-4834
CVE-2015-1838
CVE-2015-7442
CVE-2016-7489

This list is not meant to be complete.  It's difficult to track down all
vulnerabilities of this kind because they were often reported without any
mention of this particular attack vector.  In fact, before
hardlinks/symlinks restrictions, fifos/regular files weren't the favorite
vehicle to exploit them.

[s.mesoraca16@gmail.com: fix bug reported by Dan Carpenter]
  Link: https://lkml.kernel.org/r/20180426081456.GA7060@mwanda
  Link: http://lkml.kernel.org/r/1524829819-11275-1-git-send-email-s.mesoraca16@gmail.com
[keescook@chromium.org: drop pr_warn_ratelimited() in favor of audit changes in the future]
[keescook@chromium.org: adjust commit subjet]
Link: http://lkml.kernel.org/r/20180416175918.GA13494@beast
Signed-off-by: Salvatore Mesoraca <s.mesoraca16@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Suggested-by: Solar Designer <solar@openwall.com>
Suggested-by: Kees Cook <keescook@chromium.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Loic <hackurx@opensec.fr>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-12-01 09:44:25 +01:00
Charan Teja Reddy
f9920cfa7e mm: oom_kill: reap memory of a task that receives SIGKILL
Free the pages parallely for a task that receives SIGKILL using the
oom_reaper. This freeing of pages will help to give the pages to buddy
system well advance.
This reaps for the process which received SIGKILL through
either sys_kill from user or kill_pid from kernel and that sending
process has CAP_KILL capability.
Also sysctl interface, reap_mem_on_sigkill, is added to turn on/off this
feature.

Change-Id: I21adb95de5e380a80d7eb0b87d9b5b553f52e28a
Signed-off-by: Charan Teja Reddy <charante@codeaurora.org>
2018-11-14 14:28:47 +05:30
Greg Kroah-Hartman
a925dfbdda Merge 4.9.125 into android-4.9
Changes in 4.9.125
	vti6: fix PMTU caching and reporting on xmit
	xfrm: fix missing dst_release() after policy blocking lbcast and multicast
	xfrm: free skb if nlsk pointer is NULL
	mac80211: add stations tied to AP_VLANs during hw reconfig
	nl80211: Add a missing break in parse_station_flags
	drm/bridge: adv7511: Reset registers on hotplug
	scsi: libiscsi: fix possible NULL pointer dereference in case of TMF
	drm/imx: imx-ldb: disable LDB on driver bind
	drm/imx: imx-ldb: check if channel is enabled before printing warning
	usb: gadget: r8a66597: Fix two possible sleep-in-atomic-context bugs in init_controller()
	usb: gadget: r8a66597: Fix a possible sleep-in-atomic-context bugs in r8a66597_queue()
	usb/phy: fix PPC64 build errors in phy-fsl-usb.c
	tools: usb: ffs-test: Fix build on big endian systems
	usb: gadget: f_uac2: fix endianness of 'struct cntrl_*_lay3'
	bpf, ppc64: fix unexpected r0=0 exit path inside bpf_xadd
	tools/power turbostat: fix -S on UP systems
	net: caif: Add a missing rcu_read_unlock() in caif_flow_cb
	qed: Fix possible race for the link state value.
	qed: Correct Multicast API to reflect existence of 256 approximate buckets.
	atl1c: reserve min skb headroom
	net: prevent ISA drivers from building on PPC32
	can: mpc5xxx_can: check of_iomap return before use
	i2c: davinci: Avoid zero value of CLKH
	perf/x86/amd/ibs: Don't access non-started event
	media: staging: omap4iss: Include asm/cacheflush.h after generic includes
	bnx2x: Fix invalid memory access in rss hash config path.
	qmi_wwan: fix interface number for DW5821e production firmware
	net: axienet: Fix double deregister of mdio
	x86/boot: Fix if_changed build flip/flop bug
	fscache: Allow cancelled operations to be enqueued
	cachefiles: Fix refcounting bug in backing-file read monitoring
	cachefiles: Wait rather than BUG'ing on "Unexpected object collision"
	selftests/ftrace: Add snapshot and tracing_on test case
	zswap: re-check zswap_is_full() after do zswap_shrink()
	tools/power turbostat: Read extended processor family from CPUID
	Revert "MIPS: BCM47XX: Enable 74K Core ExternalSync for PCIe erratum"
	enic: handle mtu change for vf properly
	arc: [plat-eznps] fix data type errors in platform headers
	arc: fix build errors in arc/include/asm/delay.h
	arc: fix type warnings in arc/mm/cache.c
	squashfs metadata 2: electric boogaloo
	Squashfs: Compute expected length from inode size rather than block length
	drivers: net: lmc: fix case value for target abort error
	memcg: remove memcg_cgroup::id from IDR on mem_cgroup_css_alloc() failure
	scsi: fcoe: drop frames in ELS LOGO error path
	scsi: fcoe: clear FC_RP_STARTED flags when receiving a LOGO
	scsi: vmw_pvscsi: Return DID_RESET for status SAM_STAT_COMMAND_TERMINATED
	mm/memory.c: check return value of ioremap_prot
	sched/sysctl: Check user input value of sysctl_sched_time_avg
	Cipso: cipso_v4_optptr enter infinite loop
	mei: don't update offset in write
	cifs: add missing debug entries for kconfig options
	cifs: check kmalloc before use
	smb3: enumerating snapshots was leaving part of the data off end
	smb3: Do not send SMB3 SET_INFO if nothing changed
	smb3: don't request leases in symlink creation and query
	kprobes/arm64: Fix %p uses in error messages
	arm64: mm: check for upper PAGE_SHIFT bits in pfn_valid()
	s390/kvm: fix deadlock when killed by oom
	ext4: check for NUL characters in extended attribute's name
	ext4: sysfs: print ext4_super_block fields as little-endian
	ext4: reset error code in ext4_find_entry in fallback
	staging: android: ion: fix ION_IOC_{MAP,SHARE} use-after-free
	KVM: arm/arm64: Skip updating PTE entry if no change
	KVM: arm/arm64: Skip updating PMD entry if no change
	sparc: kernel/pcic: silence gcc 7.x warning in pcibios_fixup_bus()
	x86/speculation/l1tf: Fix overflow in l1tf_pfn_limit() on 32bit
	x86/speculation/l1tf: Fix off-by-one error when warning that system has too much RAM
	x86/speculation/l1tf: Suggest what to do on systems with too much RAM
	x86/process: Re-export start_thread()
	KVM: x86: SVM: Call x86_spec_ctrl_set_guest/host() with interrupts disabled
	x86/kvm/vmx: Remove duplicate l1d flush definitions
	fuse: Don't access pipe->buffers without pipe_lock()
	fuse: fix initial parallel dirops
	fuse: fix double request_end()
	fuse: fix unlocked access to processing queue
	fuse: umount should wait for all requests
	fuse: Fix oops at process_init_reply()
	fuse: Add missed unlock_page() to fuse_readpages_fill()
	udl-kms: change down_interruptible to down
	udl-kms: handle allocation failure
	udl-kms: fix crash due to uninitialized memory
	b43legacy/leds: Ensure NUL-termination of LED name string
	b43/leds: Ensure NUL-termination of LED name string
	ASoC: dpcm: don't merge format from invalid codec dai
	ASoC: sirf: Fix potential NULL pointer dereference
	pinctrl: freescale: off by one in imx1_pinconf_group_dbg_show()
	x86/irqflags: Mark native_restore_fl extern inline
	x86/spectre: Add missing family 6 check to microcode check
	x86/speculation/l1tf: Increase l1tf memory limit for Nehalem+
	x86/entry/64: Wipe KASAN stack shadow before rewind_stack_do_exit()
	s390: fix br_r1_trampoline for machines without exrl
	s390/qdio: reset old sbal_state flags
	s390/numa: move initial setup of node_to_cpumask_map
	s390/pci: fix out of bounds access during irq setup
	kprobes: Make list and blacklist root user read only
	MIPS: Correct the 64-bit DSP accumulator register size
	MIPS: lib: Provide MIPS64r6 __multi3() for GCC < 7
	scsi: sysfs: Introduce sysfs_{un,}break_active_protection()
	scsi: core: Avoid that SCSI device removal through sysfs triggers a deadlock
	iscsi target: fix session creation failure handling
	clk: rockchip: fix clk_i2sout parent selection bits on rk3399
	PM / clk: signedness bug in of_pm_clk_add_clks()
	power: generic-adc-battery: fix out-of-bounds write when copying channel properties
	power: generic-adc-battery: check for duplicate properties copied from iio channels
	cdrom: Fix info leak/OOB read in cdrom_ioctl_drive_status
	staging: android: ion: check for kref overflow
	Linux 4.9.125

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2018-09-05 12:38:22 +02:00
Ethan Zhao
fe0034a08b sched/sysctl: Check user input value of sysctl_sched_time_avg
commit 5ccba44ba118a5000cccc50076b0344632459779 upstream.

System will hang if user set sysctl_sched_time_avg to 0:

  [root@XXX ~]# sysctl kernel.sched_time_avg_ms=0

  Stack traceback for pid 0
  0xffff883f6406c600 0 0 1 3 R 0xffff883f6406cf50 *swapper/3
  ffff883f7ccc3ae8 0000000000000018 ffffffff810c4dd0 0000000000000000
  0000000000017800 ffff883f7ccc3d78 0000000000000003 ffff883f7ccc3bf8
  ffffffff810c4fc9 ffff883f7ccc3c08 00000000810c5043 ffff883f7ccc3c08
  Call Trace:
  <IRQ> [<ffffffff810c4dd0>] ? update_group_capacity+0x110/0x200
  [<ffffffff810c4fc9>] ? update_sd_lb_stats+0x109/0x600
  [<ffffffff810c5507>] ? find_busiest_group+0x47/0x530
  [<ffffffff810c5b84>] ? load_balance+0x194/0x900
  [<ffffffff810ad5ca>] ? update_rq_clock.part.83+0x1a/0xe0
  [<ffffffff810c6d42>] ? rebalance_domains+0x152/0x290
  [<ffffffff810c6f5c>] ? run_rebalance_domains+0xdc/0x1d0
  [<ffffffff8108a75b>] ? __do_softirq+0xfb/0x320
  [<ffffffff8108ac85>] ? irq_exit+0x125/0x130
  [<ffffffff810b3a17>] ? scheduler_ipi+0x97/0x160
  [<ffffffff81052709>] ? smp_reschedule_interrupt+0x29/0x30
  [<ffffffff8173a1be>] ? reschedule_interrupt+0x6e/0x80
   <EOI> [<ffffffff815bc83c>] ? cpuidle_enter_state+0xcc/0x230
  [<ffffffff815bc80c>] ? cpuidle_enter_state+0x9c/0x230
  [<ffffffff815bc9d7>] ? cpuidle_enter+0x17/0x20
  [<ffffffff810cd6dc>] ? cpu_startup_entry+0x38c/0x420
  [<ffffffff81053373>] ? start_secondary+0x173/0x1e0

Because divide-by-zero error happens in function:

update_group_capacity()
  update_cpu_capacity()
    scale_rt_capacity()
     {
          ...
          total = sched_avg_period() + delta;
          used = div_u64(avg, total);
          ...
     }

To fix this issue, check user input value of sysctl_sched_time_avg, keep
it unchanged when hitting invalid input, and set the minimum limit of
sysctl_sched_time_avg to 1 ms.

Reported-by: James Puthukattukaran <james.puthukattukaran@oracle.com>
Signed-off-by: Ethan Zhao <ethan.zhao@oracle.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: efault@gmx.de
Cc: ethan.kernel@gmail.com
Cc: keescook@chromium.org
Cc: mcgrof@kernel.org
Cc: <stable@vger.kernel.org>
Link: http://lkml.kernel.org/r/1504504774-18253-1-git-send-email-ethan.zhao@oracle.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Cc: Steve Muckle <smuckle@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-09-05 09:20:04 +02:00
Satya Durga Srinivasu Prabhala
3929bf05f4 sysctl/sched: do not allow value "0" for sched_{up,down}_migrate knobs
Right now sched_{up,down}_migrate knobs are accepting zero as a valid
value and we end up with upmigrate value is less than downmigrate value
when zero is written by user to upmigrate knob, we go ahead and update
upmigrate value which would end up being lesser than downmigrate value.
Also, there is a div by zero issue by accepting zero as valid value for
these knobs.

So, update check to make sure zero isn't allowed as a valid value.

Change-Id: Ic44d8fda14e99f622bbadc6c78ce7a28aedbd5b2
Signed-off-by: Satya Durga Srinivasu Prabhala <satyap@codeaurora.org>
2018-08-28 07:44:24 -07:00
Vinayak Menon
b9e4cc2bd8 mm: make faultaround produce old ptes
Based on Kirill's patch [1].

Currently, faultaround code produces young pte.  This can screw up
vmscan behaviour[2], as it makes vmscan think that these pages are hot
and not push them out on first round.

During sparse file access faultaround gets more pages mapped and all of
them are young. Under memory pressure, this makes vmscan swap out anon
pages instead, or to drop other page cache pages which otherwise stay
resident.

Modify faultaround to produce old ptes if sysctl 'want_old_faultaround_pte'
is set, so they can easily be reclaimed under memory pressure.

This can to some extend defeat the purpose of faultaround on machines
without hardware accessed bit as it will not help us with reducing the
number of minor page faults.

Making the faultaround ptes old results in a unixbench regression for some
architectures [3][4]. But on some architectures like arm64 it is not found
to cause any regression.

unixbench shell8 scores on arm64 v8.2 hardware with CONFIG_ARM64_HW_AFDBM
enabled  (5 runs min, max, avg):
Base: (741,748,744)
With this patch: (739,748,743)

So by default produce old ptes and provide a sysctl option to make the
ptes young.

[1] http://lkml.kernel.org/r/1463488366-47723-1-git-send-email-kirill.shutemov@linux.intel.com
[2] https://lkml.kernel.org/r/1460992636-711-1-git-send-email-vinmenon@codeaurora.org
[3] https://marc.info/?l=linux-kernel&m=146582237922378&w=2
[4] https://marc.info/?l=linux-mm&m=146589376909424&w=2

Change-Id: I9f6300121fa5cdcd157b25e2c6e6536ce150af63
[vinmenon@codeaurora.org: add fault_address to fault_end for 4.9]
Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Patch-mainline: linux-mm @ Fri, 19 Jan 2018 17:24:54
Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
2018-07-02 00:33:12 -07:00
Lingutla Chandrasekhar
e787198f24 sched: kill sched_use_walt_cpu_{task_}util sysctl knobs
sched_use_walt_cpu_{task_}util sysctl knobs are used to control
runtime whether to use WALT signals (cumulative_runnable_avg/
ravg.demand) or PELT signal (util_avg) for task and cpu utilization
for task placement and frequency guidance.

But there is a subtle impact with these tunables when we frequently
toggle them. When sched_use_walt_cpu_util set to 0, and hotplugging
the cpu makes sg_cpu() members reset to 0, which sets sg_cpu.walt_load
to 0, but the sg_policy->last_ws never reset to zero. When the knob is
set back to 1 exactly after load is queried but before sugov_calc_avg_cap()
is called, which would compare walt_load->ws (= 0) against the stale
value of sg_policy->last_ws and hits BUG_ON().

When walt is enabled, we always use walt signals for task placement and
frequency guidance. So kill these sysctl knobs.

Change-Id: Id7eea8aa36fcfc33539aa3887c512a70a2414fc0
Signed-off-by: Lingutla Chandrasekhar <clingutla@codeaurora.org>
2018-06-18 15:25:13 +05:30
Rik van Riel
dbe0f61220 ANDROID: add extra free kbytes tunable
Add a userspace visible knob to tell the VM to keep an extra amount
of memory free, by increasing the gap between each zone's min and
low watermarks.

This is useful for realtime applications that call system
calls and have a bound on the number of allocations that happen
in any short time period.  In this application, extra_free_kbytes
would be left at an amount equal to or larger than than the
maximum number of allocations that happen in any burst.

It may also be useful to reduce the memory use of virtual
machines (temporarily?), in a way that does not cause memory
fragmentation like ballooning does.

[ccross]
Revived for use on old kernels where no other solution exists.
The tunable will be removed on kernels that do better at avoiding
direct reclaim.

[surenb]
Will be reverted as soon as Android framework is reworked to
use upstream-supported watermark_scale_factor instead of
extra_free_kbytes.

Bug: 86445363
Change-Id: I765a42be8e964bfd3e2886d1ca85a29d60c3bb3e
Signed-off-by: Rik van Riel<riel@redhat.com>
Signed-off-by: Colin Cross <ccross@android.com>
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
2018-06-04 15:47:24 +00:00
Pavankumar Kondeti
0d2621bf90 trace/irq: Add trace point to track IRQs disable callers
Add trace point to track IRQs disable callers to
isolate issues unrelated to scheduler and improve debug
turn around time.

Change-Id: Ib1ef45d8bed1fc0e128b5ab2051f0c30e8c50ee7
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
Signed-off-by: Satya Durga Srinivasu Prabhala <satyap@codeaurora.org>
Signed-off-by: Lingutla Chandrasekhar <clingutla@codeaurora.org>
2018-04-21 15:57:26 +05:30
Pavankumar Kondeti
97f08d47f4 sched: Add trace point to track preemption disable callers
Add trace point to track preemption disable callers to
isolate issues unrelated to scheduler and improve debug
turn around time.

Change-Id: If9303b7165167e8f79cd339929daf4afc31a61c4
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
Signed-off-by: Satya Durga Srinivasu Prabhala <satyap@codeaurora.org>
Signed-off-by: Lingutla Chandrasekhar <clingutla@codeaurora.org>
2018-04-21 15:47:14 +05:30
Lingutla Chandrasekhar
57eb071cd3 sched: Use initial_task_util load for new tasks
Currently, we are exposing the initial_task_util tunable but not
honoring it. Fix it by using the tunable for initial load to newly
created tasks.

Since this tunable is used in end user builds, move the tunable
out of SCHED_DEBUG.

Change-Id: I17a89b7a99d43c9cc230536ad7d9238de9833473
Signed-off-by: Lingutla Chandrasekhar <clingutla@codeaurora.org>
2018-03-12 10:57:05 +05:30